From 8776a09a7dc0582eafeaf6431018fbc55e670eb0 Mon Sep 17 00:00:00 2001 From: Micke Nordin Date: Fri, 26 Jan 2024 12:47:29 +0100 Subject: [PATCH] helm dep update --- rds/base/charts/all/Chart.lock | 6 +- rds/base/charts/all/charts/jaeger-0.34.0.tgz | Bin 85664 -> 153149 bytes .../all/charts/layer0-describo-0.2.9.tgz | Bin 6650 -> 60461 bytes ...r0-helper-describo-token-updater-0.2.1.tgz | Bin 2599 -> 3062 bytes .../charts/all/charts/layer0-web-0.3.3.tgz | Bin 4884 -> 5337 bytes ...layer1-port-openscienceframework-0.2.3.tgz | Bin 3103 -> 3569 bytes .../all/charts/layer1-port-owncloud-0.3.3.tgz | Bin 3312 -> 3766 bytes .../all/charts/layer1-port-reva-0.2.0.tgz | Bin 2954 -> 3430 bytes .../all/charts/layer1-port-zenodo-0.2.2.tgz | Bin 3054 -> 3521 bytes .../charts/layer2-exporter-service-0.2.3.tgz | Bin 2731 -> 3202 bytes .../charts/layer2-metadata-service-0.2.3.tgz | Bin 2502 -> 3173 bytes .../all/charts/layer2-port-service-0.2.5.tgz | Bin 2833 -> 3303 bytes .../charts/layer3-research-manager-0.3.4.tgz | Bin 2687 -> 3374 bytes .../all/charts/layer3-token-storage-0.3.0.tgz | Bin 3104 -> 3582 bytes .../charts/all/charts/nextcloud-3.5.22.tgz | Bin 0 -> 216225 bytes .../charts/all/charts/nextcloud-3.5.4.tgz | Bin 212732 -> 0 bytes rds/base/charts/all/charts/redis-16.13.2.tgz | Bin 88783 -> 102823 bytes .../charts/all/charts/redis-cluster-7.6.4.tgz | Bin 100132 -> 114056 bytes rds/base/charts/common/.helmignore | 23 - rds/base/charts/common/Chart.yaml | 8 - .../charts/common/templates/_deployment.tpl | 65 - rds/base/charts/jaeger/.helmignore | 21 - rds/base/charts/jaeger/Chart.yaml | 23 - rds/base/charts/jaeger/OWNERS | 10 - rds/base/charts/jaeger/README.md | 380 ---- .../charts/jaeger/charts/cassandra-0.15.2.tgz | Bin 11697 -> 0 bytes .../jaeger/charts/cassandra/.helmignore | 17 - .../charts/jaeger/charts/cassandra/Chart.yaml | 19 - .../charts/jaeger/charts/cassandra/README.md | 218 -- .../cassandra/sample/create-storage-gce.yaml | 7 - .../charts/cassandra/templates/NOTES.txt | 35 - .../charts/cassandra/templates/_helpers.tpl | 43 - .../cassandra/templates/backup/cronjob.yaml | 90 - .../cassandra/templates/backup/rbac.yaml | 50 - .../charts/cassandra/templates/configmap.yaml | 14 - .../charts/cassandra/templates/pdb.yaml | 18 - .../charts/cassandra/templates/service.yaml | 46 - .../cassandra/templates/servicemonitor.yaml | 25 - .../cassandra/templates/statefulset.yaml | 230 --- .../jaeger/charts/cassandra/values.yaml | 254 --- .../jaeger/charts/elasticsearch-7.8.1.tgz | Bin 25704 -> 0 bytes .../jaeger/charts/elasticsearch/.helmignore | 2 - .../jaeger/charts/elasticsearch/Chart.yaml | 12 - .../jaeger/charts/elasticsearch/Makefile | 1 - .../jaeger/charts/elasticsearch/README.md | 445 ---- .../elasticsearch/examples/config/Makefile | 19 - .../elasticsearch/examples/config/README.md | 27 - .../examples/config/test/goss.yaml | 26 - .../elasticsearch/examples/config/values.yaml | 31 - .../examples/config/watcher_encryption_key | 1 - .../elasticsearch/examples/default/Makefile | 16 - .../elasticsearch/examples/default/README.md | 25 - .../examples/default/rolling_upgrade.sh | 19 - .../examples/default/test/goss.yaml | 39 - .../examples/docker-for-mac/Makefile | 12 - .../examples/docker-for-mac/README.md | 23 - .../examples/docker-for-mac/values.yaml | 23 - .../examples/kubernetes-kind/Makefile | 16 - .../examples/kubernetes-kind/README.md | 36 - .../kubernetes-kind/values-local-path.yaml | 23 - .../examples/kubernetes-kind/values.yaml | 23 - .../elasticsearch/examples/microk8s/Makefile | 12 - .../elasticsearch/examples/microk8s/README.md | 32 - .../examples/microk8s/values.yaml | 32 - .../elasticsearch/examples/migration/Makefile | 10 - .../examples/migration/README.md | 167 -- .../examples/migration/client.yml | 23 - .../elasticsearch/examples/migration/data.yml | 17 - .../examples/migration/master.yml | 26 - .../elasticsearch/examples/minikube/Makefile | 12 - .../elasticsearch/examples/minikube/README.md | 38 - .../examples/minikube/values.yaml | 23 - .../elasticsearch/examples/multi/Makefile | 16 - .../elasticsearch/examples/multi/README.md | 27 - .../elasticsearch/examples/multi/data.yml | 9 - .../elasticsearch/examples/multi/master.yml | 9 - .../examples/multi/test/goss.yaml | 9 - .../elasticsearch/examples/openshift/Makefile | 15 - .../examples/openshift/README.md | 24 - .../examples/openshift/test/goss.yaml | 17 - .../examples/openshift/values.yaml | 11 - .../elasticsearch/examples/oss/Makefile | 12 - .../elasticsearch/examples/oss/README.md | 23 - .../elasticsearch/examples/oss/test/goss.yaml | 17 - .../elasticsearch/examples/oss/values.yaml | 4 - .../elasticsearch/examples/security/Makefile | 37 - .../elasticsearch/examples/security/README.md | 29 - .../examples/security/security.yml | 38 - .../examples/security/test/goss.yaml | 45 - .../elasticsearch/examples/upgrade/Makefile | 16 - .../elasticsearch/examples/upgrade/README.md | 27 - .../examples/upgrade/scripts/upgrade.sh | 76 - .../examples/upgrade/test/goss.yaml | 17 - .../charts/elasticsearch/templates/NOTES.txt | 4 - .../elasticsearch/templates/_helpers.tpl | 87 - .../elasticsearch/templates/configmap.yaml | 17 - .../elasticsearch/templates/ingress.yaml | 39 - .../templates/poddisruptionbudget.yaml | 13 - .../templates/podsecuritypolicy.yaml | 15 - .../charts/elasticsearch/templates/role.yaml | 26 - .../elasticsearch/templates/rolebinding.yaml | 25 - .../elasticsearch/templates/service.yaml | 73 - .../templates/serviceaccount.yaml | 21 - .../elasticsearch/templates/statefulset.yaml | 430 ---- .../test/test-elasticsearch-health.yaml | 25 - .../jaeger/charts/elasticsearch/values.yaml | 277 --- .../charts/jaeger/charts/kafka-0.20.6.tgz | Bin 32345 -> 0 bytes .../charts/jaeger/charts/kafka/.helmignore | 21 - .../charts/jaeger/charts/kafka/Chart.yaml | 24 - rds/base/charts/jaeger/charts/kafka/OWNERS | 4 - rds/base/charts/jaeger/charts/kafka/README.md | 434 ---- .../charts/kafka/charts/zookeeper/.helmignore | 21 - .../charts/kafka/charts/zookeeper/Chart.yaml | 17 - .../charts/kafka/charts/zookeeper/OWNERS | 6 - .../charts/kafka/charts/zookeeper/README.md | 145 -- .../charts/zookeeper/templates/NOTES.txt | 7 - .../charts/zookeeper/templates/_helpers.tpl | 46 - .../templates/config-jmx-exporter.yaml | 20 - .../zookeeper/templates/config-script.yaml | 113 - .../zookeeper/templates/job-chroots.yaml | 66 - .../templates/poddisruptionbudget.yaml | 18 - .../zookeeper/templates/service-headless.yaml | 26 - .../charts/zookeeper/templates/service.yaml | 42 - .../zookeeper/templates/servicemonitors.yaml | 60 - .../zookeeper/templates/statefulset.yaml | 227 -- .../charts/kafka/charts/zookeeper/values.yaml | 295 --- .../jaeger/charts/kafka/requirements.lock | 6 - .../jaeger/charts/kafka/requirements.yaml | 6 - .../jaeger/charts/kafka/templates/NOTES.txt | 76 - .../charts/kafka/templates/_helpers.tpl | 128 -- .../kafka/templates/configmap-config.yaml | 80 - .../charts/kafka/templates/configmap-jmx.yaml | 65 - .../templates/deployment-kafka-exporter.yaml | 46 - .../charts/kafka/templates/job-config.yaml | 30 - .../kafka/templates/podisruptionbudget.yaml | 15 - .../kafka/templates/prometheusrules.yaml | 16 - .../templates/service-brokers-external.yaml | 78 - .../kafka/templates/service-brokers.yaml | 37 - .../kafka/templates/service-headless.yaml | 22 - .../kafka/templates/servicemonitors.yaml | 47 - .../charts/kafka/templates/statefulset.yaml | 273 --- .../test_topic_create_consume_produce.yaml | 25 - .../charts/jaeger/charts/kafka/values.yaml | 511 ----- rds/base/charts/jaeger/requirements.lock | 12 - rds/base/charts/jaeger/requirements.yaml | 14 - rds/base/charts/jaeger/templates/NOTES.txt | 27 - rds/base/charts/jaeger/templates/_helpers.tpl | 370 ---- .../charts/jaeger/templates/agent-ds.yaml | 142 -- .../charts/jaeger/templates/agent-sa.yaml | 10 - .../templates/agent-servicemonitor.yaml | 38 - .../charts/jaeger/templates/agent-svc.yaml | 41 - .../templates/cassandra-schema-job.yaml | 98 - .../jaeger/templates/cassandra-schema-sa.yaml | 10 - .../jaeger/templates/cassandra-secret.yaml | 12 - .../jaeger/templates/collector-configmap.yaml | 14 - .../jaeger/templates/collector-deploy.yaml | 181 -- .../jaeger/templates/collector-hpa.yaml | 28 - .../charts/jaeger/templates/collector-sa.yaml | 10 - .../templates/collector-servicemonitor.yaml | 38 - .../jaeger/templates/collector-svc.yaml | 47 - .../templates/elasticsearch-secret.yaml | 12 - .../templates/es-index-cleaner-cronjob.yaml | 84 - .../jaeger/templates/es-index-cleaner-sa.yaml | 10 - .../jaeger/templates/hotrod-deploy.yaml | 66 - .../charts/jaeger/templates/hotrod-ing.yaml | 33 - .../charts/jaeger/templates/hotrod-sa.yaml | 10 - .../charts/jaeger/templates/hotrod-svc.yaml | 25 - .../jaeger/templates/ingester-deploy.yaml | 131 -- .../charts/jaeger/templates/ingester-hpa.yaml | 28 - .../charts/jaeger/templates/ingester-sa.yaml | 10 - .../templates/ingester-servicemonitor.yaml | 38 - .../charts/jaeger/templates/ingester-svc.yaml | 24 - .../jaeger/templates/query-configmap.yaml | 13 - .../charts/jaeger/templates/query-deploy.yaml | 212 -- .../charts/jaeger/templates/query-ing.yaml | 31 - .../charts/jaeger/templates/query-sa.yaml | 10 - .../templates/query-servicemonitor.yaml | 37 - .../charts/jaeger/templates/query-svc.yaml | 32 - .../jaeger/templates/spark-cronjob.yaml | 98 - .../charts/jaeger/templates/spark-sa.yaml | 10 - rds/base/charts/jaeger/values.yaml | 538 ----- rds/base/charts/layer0_describo/.helmignore | 22 - rds/base/charts/layer0_describo/Chart.lock | 9 - rds/base/charts/layer0_describo/Chart.yaml | 29 - .../layer0_describo/charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../charts/postgresql-10.14.3.tgz | Bin 53727 -> 0 bytes .../layer0_describo/defaults/nginx.conf | 82 - .../defaults/type-definitions-lookup.json | 16 - .../defaults/type-definitions.json | 200 -- .../layer0_describo/templates/NOTES.txt | 21 - .../layer0_describo/templates/_helpers.tpl | 91 - .../layer0_describo/templates/configmap.yaml | 59 - .../layer0_describo/templates/deployment.yaml | 121 -- .../layer0_describo/templates/ingress.yaml | 28 - .../layer0_describo/templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - rds/base/charts/layer0_describo/values.yaml | 87 - .../.helmignore | 22 - .../Chart.lock | 6 - .../Chart.yaml | 27 - .../charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../templates/_helpers.tpl | 70 - .../templates/configmap.yaml | 13 - .../templates/deployment.yaml | 48 - .../values.yaml | 44 - rds/base/charts/layer0_web/.helmignore | 22 - rds/base/charts/layer0_web/Chart.lock | 6 - rds/base/charts/layer0_web/Chart.yaml | 23 - .../charts/layer0_web/charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../charts/layer0_web/templates/NOTES.txt | 21 - .../charts/layer0_web/templates/_helpers.tpl | 62 - .../layer0_web/templates/configmap.yaml | 49 - .../layer0_web/templates/deployment.yaml | 97 - .../charts/layer0_web/templates/ingress.yaml | 28 - .../charts/layer0_web/templates/service.yaml | 25 - .../templates/tests/test-connection.yaml | 15 - rds/base/charts/layer0_web/values.yaml | 92 - .../.helmignore | 22 - .../Chart.lock | 6 - .../Chart.yaml | 25 - .../charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../templates/_helpers.tpl | 69 - .../templates/configmap.yaml | 17 - .../templates/deployment.yaml | 73 - .../templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - .../values.yaml | 60 - .../charts/layer1_port_owncloud/.helmignore | 22 - .../charts/layer1_port_owncloud/Chart.lock | 6 - .../charts/layer1_port_owncloud/Chart.yaml | 24 - .../charts/common-0.1.2.tgz | Bin 994 -> 0 bytes .../templates/_helpers.tpl | 71 - .../templates/configmap.yaml | 35 - .../templates/deployment.yaml | 88 - .../templates/service.yaml | 36 - .../templates/tests/test-connection.yaml | 30 - .../charts/layer1_port_owncloud/values.yaml | 60 - rds/base/charts/layer1_port_reva/.helmignore | 22 - rds/base/charts/layer1_port_reva/Chart.lock | 6 - rds/base/charts/layer1_port_reva/Chart.yaml | 24 - .../layer1_port_reva/charts/common-0.1.2.tgz | Bin 994 -> 0 bytes .../layer1_port_reva/templates/_helpers.tpl | 70 - .../layer1_port_reva/templates/configmap.yaml | 9 - .../templates/deployment.yaml | 66 - .../layer1_port_reva/templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - rds/base/charts/layer1_port_reva/values.yaml | 52 - .../charts/layer1_port_zenodo/.helmignore | 22 - rds/base/charts/layer1_port_zenodo/Chart.lock | 6 - rds/base/charts/layer1_port_zenodo/Chart.yaml | 24 - .../charts/common-0.1.2.tgz | Bin 994 -> 0 bytes .../layer1_port_zenodo/templates/_helpers.tpl | 70 - .../templates/configmap.yaml | 15 - .../templates/deployment.yaml | 73 - .../layer1_port_zenodo/templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - .../charts/layer1_port_zenodo/values.yaml | 60 - .../layer2_exporter_service/.helmignore | 22 - .../charts/layer2_exporter_service/Chart.lock | 6 - .../charts/layer2_exporter_service/Chart.yaml | 24 - .../charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../templates/_helpers.tpl | 69 - .../templates/configmap.yaml | 7 - .../templates/deployment.yaml | 62 - .../templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - .../layer2_exporter_service/values.yaml | 43 - .../charts/layer2_metadata_service/Chart.lock | 6 - .../charts/layer2_metadata_service/Chart.yaml | 24 - .../charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../templates/_helpers.tpl | 70 - .../templates/configmap.yaml | 6 - .../templates/deployment.yaml | 62 - .../templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - .../layer2_metadata_service/values.yaml | 43 - .../charts/layer2_port_service/.helmignore | 22 - .../charts/layer2_port_service/Chart.lock | 6 - .../charts/layer2_port_service/Chart.yaml | 24 - .../charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../templates/_helpers.tpl | 71 - .../templates/configmap.yaml | 7 - .../templates/deployment.yaml | 67 - .../templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - .../charts/layer2_port_service/values.yaml | 47 - .../charts/layer3_research_manager/Chart.lock | 6 - .../charts/layer3_research_manager/Chart.yaml | 24 - .../charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../templates/_helpers.tpl | 69 - .../templates/configmap.yaml | 8 - .../templates/deployment.yaml | 65 - .../templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - .../layer3_research_manager/values.yaml | 52 - .../charts/layer3_token_storage/.helmignore | 22 - .../charts/layer3_token_storage/Chart.lock | 6 - .../charts/layer3_token_storage/Chart.yaml | 24 - .../charts/common-0.1.2.tgz | Bin 995 -> 0 bytes .../templates/_helpers.tpl | 69 - .../templates/configmap.yaml | 14 - .../templates/deployment.yaml | 65 - .../templates/service.yaml | 21 - .../templates/tests/test-connection.yaml | 15 - .../charts/layer3_token_storage/values.yaml | 53 - rds/base/charts/postgresql/.helmignore | 21 - rds/base/charts/postgresql/Chart.lock | 6 - rds/base/charts/postgresql/Chart.yaml | 30 - rds/base/charts/postgresql/README.md | 816 -------- .../postgresql/charts/common-1.10.3.tgz | Bin 13331 -> 0 bytes .../postgresql/charts/common/.helmignore | 22 - .../postgresql/charts/common/Chart.yaml | 23 - .../charts/postgresql/charts/common/README.md | 328 --- .../charts/common/templates/_affinities.tpl | 102 - .../charts/common/templates/_capabilities.tpl | 128 -- .../charts/common/templates/_errors.tpl | 23 - .../charts/common/templates/_images.tpl | 75 - .../charts/common/templates/_ingress.tpl | 55 - .../charts/common/templates/_labels.tpl | 18 - .../charts/common/templates/_names.tpl | 52 - .../charts/common/templates/_secrets.tpl | 129 -- .../charts/common/templates/_storage.tpl | 23 - .../charts/common/templates/_tplvalues.tpl | 13 - .../charts/common/templates/_utils.tpl | 62 - .../charts/common/templates/_warnings.tpl | 14 - .../templates/validations/_cassandra.tpl | 72 - .../common/templates/validations/_mariadb.tpl | 103 - .../common/templates/validations/_mongodb.tpl | 108 - .../templates/validations/_postgresql.tpl | 129 -- .../common/templates/validations/_redis.tpl | 76 - .../templates/validations/_validations.tpl | 46 - .../postgresql/charts/common/values.yaml | 5 - .../postgresql/ci/commonAnnotations.yaml | 3 - .../charts/postgresql/ci/default-values.yaml | 1 - .../ci/shmvolume-disabled-values.yaml | 2 - rds/base/charts/postgresql/files/README.md | 1 - .../charts/postgresql/files/conf.d/README.md | 4 - .../docker-entrypoint-initdb.d/README.md | 3 - .../charts/postgresql/templates/NOTES.txt | 89 - .../charts/postgresql/templates/_helpers.tpl | 361 ---- .../postgresql/templates/configmap.yaml | 34 - .../templates/extended-config-configmap.yaml | 29 - .../postgresql/templates/extra-list.yaml | 4 - .../templates/initialization-configmap.yaml | 26 - .../templates/metrics-configmap.yaml | 17 - .../postgresql/templates/metrics-svc.yaml | 29 - .../postgresql/templates/networkpolicy.yaml | 42 - .../templates/podsecuritypolicy.yaml | 42 - .../postgresql/templates/prometheusrule.yaml | 28 - .../charts/postgresql/templates/role.yaml | 24 - .../postgresql/templates/rolebinding.yaml | 23 - .../charts/postgresql/templates/secrets.yaml | 27 - .../postgresql/templates/serviceaccount.yaml | 15 - .../postgresql/templates/servicemonitor.yaml | 44 - .../templates/statefulset-readreplicas.yaml | 430 ---- .../postgresql/templates/statefulset.yaml | 636 ------ .../postgresql/templates/svc-headless.yaml | 31 - .../postgresql/templates/svc-read-set.yaml | 43 - .../charts/postgresql/templates/svc-read.yaml | 47 - rds/base/charts/postgresql/templates/svc.yaml | 45 - .../postgresql/templates/tls-secrets.yaml | 26 - rds/base/charts/postgresql/values.schema.json | 103 - rds/base/charts/postgresql/values.yaml | 996 --------- rds/base/charts/redis-cluster/.helmignore | 21 - rds/base/charts/redis-cluster/Chart.lock | 6 - rds/base/charts/redis-cluster/Chart.yaml | 28 - rds/base/charts/redis-cluster/README.md | 682 ------ .../redis-cluster/charts/common-1.16.0.tgz | Bin 14693 -> 0 bytes .../redis-cluster/charts/common/.helmignore | 22 - .../redis-cluster/charts/common/Chart.yaml | 23 - .../redis-cluster/charts/common/README.md | 350 ---- .../charts/common/templates/_affinities.tpl | 102 - .../charts/common/templates/_capabilities.tpl | 154 -- .../charts/common/templates/_errors.tpl | 23 - .../charts/common/templates/_images.tpl | 75 - .../charts/common/templates/_ingress.tpl | 68 - .../charts/common/templates/_labels.tpl | 18 - .../charts/common/templates/_names.tpl | 70 - .../charts/common/templates/_secrets.tpl | 140 -- .../charts/common/templates/_storage.tpl | 23 - .../charts/common/templates/_tplvalues.tpl | 13 - .../charts/common/templates/_utils.tpl | 62 - .../charts/common/templates/_warnings.tpl | 14 - .../templates/validations/_cassandra.tpl | 72 - .../common/templates/validations/_mariadb.tpl | 103 - .../common/templates/validations/_mongodb.tpl | 108 - .../common/templates/validations/_mysql.tpl | 103 - .../templates/validations/_postgresql.tpl | 129 -- .../common/templates/validations/_redis.tpl | 76 - .../templates/validations/_validations.tpl | 46 - .../redis-cluster/charts/common/values.yaml | 5 - .../img/redis-cluster-topology.png | Bin 11448 -> 0 bytes .../redis-cluster/img/redis-topology.png | Bin 9709 -> 0 bytes .../charts/redis-cluster/templates/NOTES.txt | 117 -- .../redis-cluster/templates/_helpers.tpl | 254 --- .../redis-cluster/templates/configmap.yaml | 1829 ----------------- .../redis-cluster/templates/extra-list.yaml | 4 - .../redis-cluster/templates/headless-svc.yaml | 24 - .../templates/metrics-prometheus.yaml | 54 - .../redis-cluster/templates/metrics-svc.yaml | 35 - .../templates/networkpolicy.yaml | 66 - .../templates/poddisruptionbudget.yaml | 20 - .../templates/prometheusrule.yaml | 27 - .../charts/redis-cluster/templates/psp.yaml | 46 - .../redis-cluster/templates/redis-role.yaml | 25 - .../templates/redis-rolebinding.yaml | 21 - .../templates/redis-serviceaccount.yaml | 21 - .../templates/redis-statefulset.yaml | 449 ---- .../redis-cluster/templates/redis-svc.yaml | 53 - .../templates/scripts-configmap.yaml | 111 - .../redis-cluster/templates/secret.yaml | 17 - .../svc-cluster-external-access.yaml | 45 - .../redis-cluster/templates/tls-secret.yaml | 27 - .../templates/update-cluster.yaml | 266 --- rds/base/charts/redis-cluster/values.yaml | 980 --------- rds/base/charts/redis/.helmignore | 21 - rds/base/charts/redis/Chart.lock | 6 - rds/base/charts/redis/Chart.yaml | 29 - rds/base/charts/redis/README.md | 898 -------- .../charts/redis/charts/common-1.16.0.tgz | Bin 14693 -> 0 bytes .../charts/redis/charts/common/.helmignore | 22 - .../charts/redis/charts/common/Chart.yaml | 23 - rds/base/charts/redis/charts/common/README.md | 350 ---- .../charts/common/templates/_affinities.tpl | 102 - .../charts/common/templates/_capabilities.tpl | 154 -- .../redis/charts/common/templates/_errors.tpl | 23 - .../redis/charts/common/templates/_images.tpl | 75 - .../charts/common/templates/_ingress.tpl | 68 - .../redis/charts/common/templates/_labels.tpl | 18 - .../redis/charts/common/templates/_names.tpl | 70 - .../charts/common/templates/_secrets.tpl | 140 -- .../charts/common/templates/_storage.tpl | 23 - .../charts/common/templates/_tplvalues.tpl | 13 - .../redis/charts/common/templates/_utils.tpl | 62 - .../charts/common/templates/_warnings.tpl | 14 - .../templates/validations/_cassandra.tpl | 72 - .../common/templates/validations/_mariadb.tpl | 103 - .../common/templates/validations/_mongodb.tpl | 108 - .../common/templates/validations/_mysql.tpl | 103 - .../templates/validations/_postgresql.tpl | 129 -- .../common/templates/validations/_redis.tpl | 76 - .../templates/validations/_validations.tpl | 46 - .../charts/redis/charts/common/values.yaml | 5 - .../redis/img/redis-cluster-topology.png | Bin 11448 -> 0 bytes rds/base/charts/redis/img/redis-topology.png | Bin 9709 -> 0 bytes rds/base/charts/redis/templates/NOTES.txt | 191 -- rds/base/charts/redis/templates/_helpers.tpl | 291 --- .../charts/redis/templates/configmap.yaml | 59 - .../charts/redis/templates/extra-list.yaml | 4 - .../charts/redis/templates/headless-svc.yaml | 30 - .../redis/templates/health-configmap.yaml | 192 -- .../redis/templates/master/application.yaml | 473 ----- .../charts/redis/templates/master/psp.yaml | 46 - .../charts/redis/templates/master/pvc.yaml | 27 - .../redis/templates/master/service.yaml | 58 - .../charts/redis/templates/metrics-svc.yaml | 41 - .../charts/redis/templates/networkpolicy.yaml | 78 - rds/base/charts/redis/templates/pdb.yaml | 23 - .../redis/templates/prometheusrule.yaml | 23 - .../charts/redis/templates/replicas/hpa.yaml | 47 - .../redis/templates/replicas/service.yaml | 58 - .../redis/templates/replicas/statefulset.yaml | 471 ----- rds/base/charts/redis/templates/role.yaml | 28 - .../charts/redis/templates/rolebinding.yaml | 21 - .../redis/templates/scripts-configmap.yaml | 627 ------ rds/base/charts/redis/templates/secret.yaml | 23 - .../charts/redis/templates/sentinel/hpa.yaml | 47 - .../templates/sentinel/node-services.yaml | 70 - .../templates/sentinel/ports-configmap.yaml | 100 - .../redis/templates/sentinel/service.yaml | 103 - .../redis/templates/sentinel/statefulset.yaml | 688 ------- .../redis/templates/serviceaccount.yaml | 21 - .../redis/templates/servicemonitor.yaml | 41 - .../charts/redis/templates/tls-secret.yaml | 29 - rds/base/charts/redis/values.schema.json | 156 -- rds/base/charts/redis/values.yaml | 1621 --------------- 476 files changed, 3 insertions(+), 35175 deletions(-) create mode 100644 rds/base/charts/all/charts/nextcloud-3.5.22.tgz delete mode 100644 rds/base/charts/all/charts/nextcloud-3.5.4.tgz delete mode 100644 rds/base/charts/common/.helmignore delete mode 100644 rds/base/charts/common/Chart.yaml delete mode 100644 rds/base/charts/common/templates/_deployment.tpl delete mode 100644 rds/base/charts/jaeger/.helmignore delete mode 100644 rds/base/charts/jaeger/Chart.yaml delete mode 100644 rds/base/charts/jaeger/OWNERS delete mode 100644 rds/base/charts/jaeger/README.md delete mode 100644 rds/base/charts/jaeger/charts/cassandra-0.15.2.tgz delete mode 100644 rds/base/charts/jaeger/charts/cassandra/.helmignore delete mode 100644 rds/base/charts/jaeger/charts/cassandra/Chart.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/README.md delete mode 100644 rds/base/charts/jaeger/charts/cassandra/sample/create-storage-gce.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/NOTES.txt delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/_helpers.tpl delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/backup/cronjob.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/backup/rbac.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/configmap.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/pdb.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/service.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/servicemonitor.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/templates/statefulset.yaml delete mode 100644 rds/base/charts/jaeger/charts/cassandra/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch-7.8.1.tgz delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/.helmignore delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/Chart.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/config/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/config/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/config/test/goss.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/config/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/config/watcher_encryption_key delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/default/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/default/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/default/rolling_upgrade.sh delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/default/test/goss.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/values-local-path.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/migration/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/migration/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/migration/client.yml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/migration/data.yml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/migration/master.yml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/multi/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/multi/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/multi/data.yml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/multi/master.yml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/multi/test/goss.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/test/goss.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/oss/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/oss/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/oss/test/goss.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/oss/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/security/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/security/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/security/security.yml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/security/test/goss.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/Makefile delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/README.md delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/scripts/upgrade.sh delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/test/goss.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/NOTES.txt delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/_helpers.tpl delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/configmap.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/ingress.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/poddisruptionbudget.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/podsecuritypolicy.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/role.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/rolebinding.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/service.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/serviceaccount.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/statefulset.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/templates/test/test-elasticsearch-health.yaml delete mode 100644 rds/base/charts/jaeger/charts/elasticsearch/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka-0.20.6.tgz delete mode 100644 rds/base/charts/jaeger/charts/kafka/.helmignore delete mode 100644 rds/base/charts/jaeger/charts/kafka/Chart.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/OWNERS delete mode 100644 rds/base/charts/jaeger/charts/kafka/README.md delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/.helmignore delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/Chart.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/OWNERS delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/README.md delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/NOTES.txt delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/_helpers.tpl delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/config-jmx-exporter.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/config-script.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/job-chroots.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/poddisruptionbudget.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/service-headless.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/service.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/servicemonitors.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/statefulset.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/charts/zookeeper/values.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/requirements.lock delete mode 100644 rds/base/charts/jaeger/charts/kafka/requirements.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/NOTES.txt delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/_helpers.tpl delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/configmap-config.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/configmap-jmx.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/deployment-kafka-exporter.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/job-config.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/podisruptionbudget.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/prometheusrules.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/service-brokers-external.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/service-brokers.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/service-headless.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/servicemonitors.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/statefulset.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/templates/tests/test_topic_create_consume_produce.yaml delete mode 100644 rds/base/charts/jaeger/charts/kafka/values.yaml delete mode 100644 rds/base/charts/jaeger/requirements.lock delete mode 100644 rds/base/charts/jaeger/requirements.yaml delete mode 100644 rds/base/charts/jaeger/templates/NOTES.txt delete mode 100644 rds/base/charts/jaeger/templates/_helpers.tpl delete mode 100644 rds/base/charts/jaeger/templates/agent-ds.yaml delete mode 100644 rds/base/charts/jaeger/templates/agent-sa.yaml delete mode 100644 rds/base/charts/jaeger/templates/agent-servicemonitor.yaml delete mode 100644 rds/base/charts/jaeger/templates/agent-svc.yaml delete mode 100644 rds/base/charts/jaeger/templates/cassandra-schema-job.yaml delete mode 100644 rds/base/charts/jaeger/templates/cassandra-schema-sa.yaml delete mode 100644 rds/base/charts/jaeger/templates/cassandra-secret.yaml delete mode 100644 rds/base/charts/jaeger/templates/collector-configmap.yaml delete mode 100644 rds/base/charts/jaeger/templates/collector-deploy.yaml delete mode 100644 rds/base/charts/jaeger/templates/collector-hpa.yaml delete mode 100644 rds/base/charts/jaeger/templates/collector-sa.yaml delete mode 100644 rds/base/charts/jaeger/templates/collector-servicemonitor.yaml delete mode 100644 rds/base/charts/jaeger/templates/collector-svc.yaml delete mode 100644 rds/base/charts/jaeger/templates/elasticsearch-secret.yaml delete mode 100644 rds/base/charts/jaeger/templates/es-index-cleaner-cronjob.yaml delete mode 100644 rds/base/charts/jaeger/templates/es-index-cleaner-sa.yaml delete mode 100644 rds/base/charts/jaeger/templates/hotrod-deploy.yaml delete mode 100644 rds/base/charts/jaeger/templates/hotrod-ing.yaml delete mode 100644 rds/base/charts/jaeger/templates/hotrod-sa.yaml delete mode 100644 rds/base/charts/jaeger/templates/hotrod-svc.yaml delete mode 100644 rds/base/charts/jaeger/templates/ingester-deploy.yaml delete mode 100644 rds/base/charts/jaeger/templates/ingester-hpa.yaml delete mode 100644 rds/base/charts/jaeger/templates/ingester-sa.yaml delete mode 100644 rds/base/charts/jaeger/templates/ingester-servicemonitor.yaml delete mode 100644 rds/base/charts/jaeger/templates/ingester-svc.yaml delete mode 100644 rds/base/charts/jaeger/templates/query-configmap.yaml delete mode 100644 rds/base/charts/jaeger/templates/query-deploy.yaml delete mode 100644 rds/base/charts/jaeger/templates/query-ing.yaml delete mode 100644 rds/base/charts/jaeger/templates/query-sa.yaml delete mode 100644 rds/base/charts/jaeger/templates/query-servicemonitor.yaml delete mode 100644 rds/base/charts/jaeger/templates/query-svc.yaml delete mode 100644 rds/base/charts/jaeger/templates/spark-cronjob.yaml delete mode 100644 rds/base/charts/jaeger/templates/spark-sa.yaml delete mode 100644 rds/base/charts/jaeger/values.yaml delete mode 100644 rds/base/charts/layer0_describo/.helmignore delete mode 100644 rds/base/charts/layer0_describo/Chart.lock delete mode 100644 rds/base/charts/layer0_describo/Chart.yaml delete mode 100644 rds/base/charts/layer0_describo/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer0_describo/charts/postgresql-10.14.3.tgz delete mode 100644 rds/base/charts/layer0_describo/defaults/nginx.conf delete mode 100644 rds/base/charts/layer0_describo/defaults/type-definitions-lookup.json delete mode 100644 rds/base/charts/layer0_describo/defaults/type-definitions.json delete mode 100644 rds/base/charts/layer0_describo/templates/NOTES.txt delete mode 100644 rds/base/charts/layer0_describo/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer0_describo/templates/configmap.yaml delete mode 100644 rds/base/charts/layer0_describo/templates/deployment.yaml delete mode 100644 rds/base/charts/layer0_describo/templates/ingress.yaml delete mode 100644 rds/base/charts/layer0_describo/templates/service.yaml delete mode 100644 rds/base/charts/layer0_describo/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer0_describo/values.yaml delete mode 100644 rds/base/charts/layer0_helper_describo_token_updater/.helmignore delete mode 100644 rds/base/charts/layer0_helper_describo_token_updater/Chart.lock delete mode 100644 rds/base/charts/layer0_helper_describo_token_updater/Chart.yaml delete mode 100644 rds/base/charts/layer0_helper_describo_token_updater/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer0_helper_describo_token_updater/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer0_helper_describo_token_updater/templates/configmap.yaml delete mode 100644 rds/base/charts/layer0_helper_describo_token_updater/templates/deployment.yaml delete mode 100644 rds/base/charts/layer0_helper_describo_token_updater/values.yaml delete mode 100644 rds/base/charts/layer0_web/.helmignore delete mode 100644 rds/base/charts/layer0_web/Chart.lock delete mode 100644 rds/base/charts/layer0_web/Chart.yaml delete mode 100644 rds/base/charts/layer0_web/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer0_web/templates/NOTES.txt delete mode 100644 rds/base/charts/layer0_web/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer0_web/templates/configmap.yaml delete mode 100644 rds/base/charts/layer0_web/templates/deployment.yaml delete mode 100644 rds/base/charts/layer0_web/templates/ingress.yaml delete mode 100644 rds/base/charts/layer0_web/templates/service.yaml delete mode 100644 rds/base/charts/layer0_web/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer0_web/values.yaml delete mode 100644 rds/base/charts/layer1_port_openscienceframework/.helmignore delete mode 100644 rds/base/charts/layer1_port_openscienceframework/Chart.lock delete mode 100644 rds/base/charts/layer1_port_openscienceframework/Chart.yaml delete mode 100644 rds/base/charts/layer1_port_openscienceframework/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer1_port_openscienceframework/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer1_port_openscienceframework/templates/configmap.yaml delete mode 100644 rds/base/charts/layer1_port_openscienceframework/templates/deployment.yaml delete mode 100644 rds/base/charts/layer1_port_openscienceframework/templates/service.yaml delete mode 100644 rds/base/charts/layer1_port_openscienceframework/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer1_port_openscienceframework/values.yaml delete mode 100644 rds/base/charts/layer1_port_owncloud/.helmignore delete mode 100644 rds/base/charts/layer1_port_owncloud/Chart.lock delete mode 100644 rds/base/charts/layer1_port_owncloud/Chart.yaml delete mode 100644 rds/base/charts/layer1_port_owncloud/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer1_port_owncloud/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer1_port_owncloud/templates/configmap.yaml delete mode 100644 rds/base/charts/layer1_port_owncloud/templates/deployment.yaml delete mode 100644 rds/base/charts/layer1_port_owncloud/templates/service.yaml delete mode 100644 rds/base/charts/layer1_port_owncloud/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer1_port_owncloud/values.yaml delete mode 100644 rds/base/charts/layer1_port_reva/.helmignore delete mode 100644 rds/base/charts/layer1_port_reva/Chart.lock delete mode 100644 rds/base/charts/layer1_port_reva/Chart.yaml delete mode 100644 rds/base/charts/layer1_port_reva/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer1_port_reva/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer1_port_reva/templates/configmap.yaml delete mode 100644 rds/base/charts/layer1_port_reva/templates/deployment.yaml delete mode 100644 rds/base/charts/layer1_port_reva/templates/service.yaml delete mode 100644 rds/base/charts/layer1_port_reva/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer1_port_reva/values.yaml delete mode 100644 rds/base/charts/layer1_port_zenodo/.helmignore delete mode 100644 rds/base/charts/layer1_port_zenodo/Chart.lock delete mode 100644 rds/base/charts/layer1_port_zenodo/Chart.yaml delete mode 100644 rds/base/charts/layer1_port_zenodo/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer1_port_zenodo/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer1_port_zenodo/templates/configmap.yaml delete mode 100644 rds/base/charts/layer1_port_zenodo/templates/deployment.yaml delete mode 100644 rds/base/charts/layer1_port_zenodo/templates/service.yaml delete mode 100644 rds/base/charts/layer1_port_zenodo/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer1_port_zenodo/values.yaml delete mode 100644 rds/base/charts/layer2_exporter_service/.helmignore delete mode 100644 rds/base/charts/layer2_exporter_service/Chart.lock delete mode 100644 rds/base/charts/layer2_exporter_service/Chart.yaml delete mode 100644 rds/base/charts/layer2_exporter_service/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer2_exporter_service/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer2_exporter_service/templates/configmap.yaml delete mode 100644 rds/base/charts/layer2_exporter_service/templates/deployment.yaml delete mode 100644 rds/base/charts/layer2_exporter_service/templates/service.yaml delete mode 100644 rds/base/charts/layer2_exporter_service/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer2_exporter_service/values.yaml delete mode 100644 rds/base/charts/layer2_metadata_service/Chart.lock delete mode 100644 rds/base/charts/layer2_metadata_service/Chart.yaml delete mode 100644 rds/base/charts/layer2_metadata_service/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer2_metadata_service/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer2_metadata_service/templates/configmap.yaml delete mode 100644 rds/base/charts/layer2_metadata_service/templates/deployment.yaml delete mode 100644 rds/base/charts/layer2_metadata_service/templates/service.yaml delete mode 100644 rds/base/charts/layer2_metadata_service/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer2_metadata_service/values.yaml delete mode 100644 rds/base/charts/layer2_port_service/.helmignore delete mode 100644 rds/base/charts/layer2_port_service/Chart.lock delete mode 100644 rds/base/charts/layer2_port_service/Chart.yaml delete mode 100644 rds/base/charts/layer2_port_service/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer2_port_service/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer2_port_service/templates/configmap.yaml delete mode 100644 rds/base/charts/layer2_port_service/templates/deployment.yaml delete mode 100644 rds/base/charts/layer2_port_service/templates/service.yaml delete mode 100644 rds/base/charts/layer2_port_service/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer2_port_service/values.yaml delete mode 100644 rds/base/charts/layer3_research_manager/Chart.lock delete mode 100644 rds/base/charts/layer3_research_manager/Chart.yaml delete mode 100644 rds/base/charts/layer3_research_manager/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer3_research_manager/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer3_research_manager/templates/configmap.yaml delete mode 100644 rds/base/charts/layer3_research_manager/templates/deployment.yaml delete mode 100644 rds/base/charts/layer3_research_manager/templates/service.yaml delete mode 100644 rds/base/charts/layer3_research_manager/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer3_research_manager/values.yaml delete mode 100644 rds/base/charts/layer3_token_storage/.helmignore delete mode 100644 rds/base/charts/layer3_token_storage/Chart.lock delete mode 100644 rds/base/charts/layer3_token_storage/Chart.yaml delete mode 100644 rds/base/charts/layer3_token_storage/charts/common-0.1.2.tgz delete mode 100644 rds/base/charts/layer3_token_storage/templates/_helpers.tpl delete mode 100644 rds/base/charts/layer3_token_storage/templates/configmap.yaml delete mode 100644 rds/base/charts/layer3_token_storage/templates/deployment.yaml delete mode 100644 rds/base/charts/layer3_token_storage/templates/service.yaml delete mode 100644 rds/base/charts/layer3_token_storage/templates/tests/test-connection.yaml delete mode 100644 rds/base/charts/layer3_token_storage/values.yaml delete mode 100644 rds/base/charts/postgresql/.helmignore delete mode 100644 rds/base/charts/postgresql/Chart.lock delete mode 100644 rds/base/charts/postgresql/Chart.yaml delete mode 100644 rds/base/charts/postgresql/README.md delete mode 100644 rds/base/charts/postgresql/charts/common-1.10.3.tgz delete mode 100644 rds/base/charts/postgresql/charts/common/.helmignore delete mode 100644 rds/base/charts/postgresql/charts/common/Chart.yaml delete mode 100644 rds/base/charts/postgresql/charts/common/README.md delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_affinities.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_capabilities.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_errors.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_images.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_ingress.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_labels.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_names.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_secrets.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_storage.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_tplvalues.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_utils.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/_warnings.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/validations/_cassandra.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/validations/_mariadb.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/validations/_mongodb.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/validations/_postgresql.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/validations/_redis.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/templates/validations/_validations.tpl delete mode 100644 rds/base/charts/postgresql/charts/common/values.yaml delete mode 100644 rds/base/charts/postgresql/ci/commonAnnotations.yaml delete mode 100644 rds/base/charts/postgresql/ci/default-values.yaml delete mode 100644 rds/base/charts/postgresql/ci/shmvolume-disabled-values.yaml delete mode 100644 rds/base/charts/postgresql/files/README.md delete mode 100644 rds/base/charts/postgresql/files/conf.d/README.md delete mode 100644 rds/base/charts/postgresql/files/docker-entrypoint-initdb.d/README.md delete mode 100644 rds/base/charts/postgresql/templates/NOTES.txt delete mode 100644 rds/base/charts/postgresql/templates/_helpers.tpl delete mode 100644 rds/base/charts/postgresql/templates/configmap.yaml delete mode 100644 rds/base/charts/postgresql/templates/extended-config-configmap.yaml delete mode 100644 rds/base/charts/postgresql/templates/extra-list.yaml delete mode 100644 rds/base/charts/postgresql/templates/initialization-configmap.yaml delete mode 100644 rds/base/charts/postgresql/templates/metrics-configmap.yaml delete mode 100644 rds/base/charts/postgresql/templates/metrics-svc.yaml delete mode 100644 rds/base/charts/postgresql/templates/networkpolicy.yaml delete mode 100644 rds/base/charts/postgresql/templates/podsecuritypolicy.yaml delete mode 100644 rds/base/charts/postgresql/templates/prometheusrule.yaml delete mode 100644 rds/base/charts/postgresql/templates/role.yaml delete mode 100644 rds/base/charts/postgresql/templates/rolebinding.yaml delete mode 100644 rds/base/charts/postgresql/templates/secrets.yaml delete mode 100644 rds/base/charts/postgresql/templates/serviceaccount.yaml delete mode 100644 rds/base/charts/postgresql/templates/servicemonitor.yaml delete mode 100644 rds/base/charts/postgresql/templates/statefulset-readreplicas.yaml delete mode 100644 rds/base/charts/postgresql/templates/statefulset.yaml delete mode 100644 rds/base/charts/postgresql/templates/svc-headless.yaml delete mode 100644 rds/base/charts/postgresql/templates/svc-read-set.yaml delete mode 100644 rds/base/charts/postgresql/templates/svc-read.yaml delete mode 100644 rds/base/charts/postgresql/templates/svc.yaml delete mode 100644 rds/base/charts/postgresql/templates/tls-secrets.yaml delete mode 100644 rds/base/charts/postgresql/values.schema.json delete mode 100644 rds/base/charts/postgresql/values.yaml delete mode 100644 rds/base/charts/redis-cluster/.helmignore delete mode 100644 rds/base/charts/redis-cluster/Chart.lock delete mode 100644 rds/base/charts/redis-cluster/Chart.yaml delete mode 100644 rds/base/charts/redis-cluster/README.md delete mode 100644 rds/base/charts/redis-cluster/charts/common-1.16.0.tgz delete mode 100644 rds/base/charts/redis-cluster/charts/common/.helmignore delete mode 100644 rds/base/charts/redis-cluster/charts/common/Chart.yaml delete mode 100644 rds/base/charts/redis-cluster/charts/common/README.md delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_affinities.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_capabilities.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_errors.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_images.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_ingress.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_labels.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_names.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_secrets.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_storage.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_tplvalues.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_utils.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/_warnings.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/validations/_cassandra.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/validations/_mariadb.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/validations/_mongodb.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/validations/_mysql.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/validations/_postgresql.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/validations/_redis.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/templates/validations/_validations.tpl delete mode 100644 rds/base/charts/redis-cluster/charts/common/values.yaml delete mode 100644 rds/base/charts/redis-cluster/img/redis-cluster-topology.png delete mode 100644 rds/base/charts/redis-cluster/img/redis-topology.png delete mode 100644 rds/base/charts/redis-cluster/templates/NOTES.txt delete mode 100644 rds/base/charts/redis-cluster/templates/_helpers.tpl delete mode 100644 rds/base/charts/redis-cluster/templates/configmap.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/extra-list.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/headless-svc.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/metrics-prometheus.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/metrics-svc.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/networkpolicy.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/poddisruptionbudget.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/prometheusrule.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/psp.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/redis-role.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/redis-rolebinding.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/redis-serviceaccount.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/redis-statefulset.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/redis-svc.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/scripts-configmap.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/secret.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/svc-cluster-external-access.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/tls-secret.yaml delete mode 100644 rds/base/charts/redis-cluster/templates/update-cluster.yaml delete mode 100644 rds/base/charts/redis-cluster/values.yaml delete mode 100644 rds/base/charts/redis/.helmignore delete mode 100644 rds/base/charts/redis/Chart.lock delete mode 100644 rds/base/charts/redis/Chart.yaml delete mode 100644 rds/base/charts/redis/README.md delete mode 100644 rds/base/charts/redis/charts/common-1.16.0.tgz delete mode 100644 rds/base/charts/redis/charts/common/.helmignore delete mode 100644 rds/base/charts/redis/charts/common/Chart.yaml delete mode 100644 rds/base/charts/redis/charts/common/README.md delete mode 100644 rds/base/charts/redis/charts/common/templates/_affinities.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_capabilities.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_errors.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_images.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_ingress.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_labels.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_names.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_secrets.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_storage.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_tplvalues.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_utils.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/_warnings.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/validations/_cassandra.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/validations/_mariadb.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/validations/_mongodb.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/validations/_mysql.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/validations/_postgresql.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/validations/_redis.tpl delete mode 100644 rds/base/charts/redis/charts/common/templates/validations/_validations.tpl delete mode 100644 rds/base/charts/redis/charts/common/values.yaml delete mode 100644 rds/base/charts/redis/img/redis-cluster-topology.png delete mode 100644 rds/base/charts/redis/img/redis-topology.png delete mode 100644 rds/base/charts/redis/templates/NOTES.txt delete mode 100644 rds/base/charts/redis/templates/_helpers.tpl delete mode 100644 rds/base/charts/redis/templates/configmap.yaml delete mode 100644 rds/base/charts/redis/templates/extra-list.yaml delete mode 100644 rds/base/charts/redis/templates/headless-svc.yaml delete mode 100644 rds/base/charts/redis/templates/health-configmap.yaml delete mode 100644 rds/base/charts/redis/templates/master/application.yaml delete mode 100644 rds/base/charts/redis/templates/master/psp.yaml delete mode 100644 rds/base/charts/redis/templates/master/pvc.yaml delete mode 100644 rds/base/charts/redis/templates/master/service.yaml delete mode 100644 rds/base/charts/redis/templates/metrics-svc.yaml delete mode 100644 rds/base/charts/redis/templates/networkpolicy.yaml delete mode 100644 rds/base/charts/redis/templates/pdb.yaml delete mode 100644 rds/base/charts/redis/templates/prometheusrule.yaml delete mode 100644 rds/base/charts/redis/templates/replicas/hpa.yaml delete mode 100644 rds/base/charts/redis/templates/replicas/service.yaml delete mode 100644 rds/base/charts/redis/templates/replicas/statefulset.yaml delete mode 100644 rds/base/charts/redis/templates/role.yaml delete mode 100644 rds/base/charts/redis/templates/rolebinding.yaml delete mode 100644 rds/base/charts/redis/templates/scripts-configmap.yaml delete mode 100644 rds/base/charts/redis/templates/secret.yaml delete mode 100644 rds/base/charts/redis/templates/sentinel/hpa.yaml delete mode 100644 rds/base/charts/redis/templates/sentinel/node-services.yaml delete mode 100644 rds/base/charts/redis/templates/sentinel/ports-configmap.yaml delete mode 100644 rds/base/charts/redis/templates/sentinel/service.yaml delete mode 100644 rds/base/charts/redis/templates/sentinel/statefulset.yaml delete mode 100644 rds/base/charts/redis/templates/serviceaccount.yaml delete mode 100644 rds/base/charts/redis/templates/servicemonitor.yaml delete mode 100644 rds/base/charts/redis/templates/tls-secret.yaml delete mode 100644 rds/base/charts/redis/values.schema.json delete mode 100644 rds/base/charts/redis/values.yaml diff --git a/rds/base/charts/all/Chart.lock b/rds/base/charts/all/Chart.lock index 2be0a47..16228e3 100644 --- a/rds/base/charts/all/Chart.lock +++ b/rds/base/charts/all/Chart.lock @@ -46,9 +46,9 @@ dependencies: version: 16.13.2 - name: nextcloud repository: https://nextcloud.github.io/helm/ - version: 3.5.4 + version: 3.5.22 - name: owncloud repository: https://owncloud-docker.github.io/helm-charts version: 0.4.1 -digest: sha256:f1b7af01ca54c4afc63a5dd344e4b8ca30deb9e8312609c1397015dc0886c630 -generated: "2023-03-28T09:29:07.381386431+02:00" +digest: sha256:c23f6f5d58ca92ec95d87fe4d97de87b8d07cf9b0da3f85b6eed9d95e3c5b27c +generated: "2024-01-26T12:45:44.958867792+01:00" diff --git a/rds/base/charts/all/charts/jaeger-0.34.0.tgz b/rds/base/charts/all/charts/jaeger-0.34.0.tgz index cca6f7193e22846ce65540eee98f6b029cb1d2ff..058d4ba0b35aed145607e57059361d95ba204a17 100644 GIT binary patch literal 153149 zcmV*CKyAMtiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYcciT3TIJ|%BQ{X3Ow@KHcF1F=Fr+Lo0wwk(4Y_H|C+wIfW zfk;R~Oc5*r*>Mx^XMYcFBtU``rPz+s$Lu+&MFNAt02mAgb9oQZ6eaEb8BCaW4d>y% z-Tu?*bUOX*ZSnt3r<4DGcdOI=x9;}N&h~D1XJ@DTZ=G&$du!+4K<5r{DLf0xVDfLB z&u%N=fs<0Hd~Ar6eT{17>bzZ zlX)9X;Pc(>7u%?_yR$Xk9(N}@yWJPCH`&^OaHrSbdcN}_m`uj){`1}K-R<4Z7VJ%W zlRoTs`#b&J{?2Z%hjx4Yoqo5!y}R9i-rwnO_b2_W-K`$#zv%O_JAKrf^!9?%X9Q!kfLN6oeq}Av60?A@o^$1dg=KsYK7*WhT7{_UG z`RQU2hH#cuh~Xs)y$D~BkX%+aCrYY<4f#qDijqa*Bhhs|BW8=S7ZCpfC1MsV>>1Q< zT9-6o3g15ig*&163I&2uu^Qh*1E>*T5(9m_(eR zgMCOTjDiH}qT~`K2@VjTi?Q5C0l&jy3jbSD$M=UBBn0L^A&vIxV%%LZj6fm6}y27qBmu27)S zewyO3X(RBg0RX#>(ICUr!ny$f05d|FT>yZXBy0d)bhdlqCkv@83jm7XI7C6#HU3cK zCx{&hE}8;rv5>ap7g3Dwr33M={&@l^<=a$BJpkhLmHtb-zChPBhJMPV&o8^@3{eSq zV*|XU2%ry`G8|16HsC3qMkGNL#0k2@WI zjDRr$K8YrHx=2s}NCenSyz#lL5oFVg3UKHHOW-iN9Dv{dP{i5*Ewu;j?~O)#M+c{S z=cD22FT>MOS^~(S%@2#a^2zb(S+Qn1cqEjAwXib23h@iz-ynt1kULIe7s2!ND1aql<I6Zlc>CD`%Zu zl!eqQEDf6(h+5R2AuWm;tIsOgnnTLeDpC0LIvryTsnWHUkw1gc6wTF802~GA!%2cB z_`?9)(F)4F{TW@$4-p9v{S`*XQFv`mkir_-*Z{-PEi68B+73r*k)6LieeGCid_V^6 zwrd~;Dfx2%-;Rc-M|*D^Yseg-T&2UKgW><2pPUYVIQ*YtMRQ0D8r<1(K~$}i)*=b% z3S>ak{1IUrs<9v@IAZ5C!i>u-uLz|$#?ka7Au&qW^$$2iBk{4Z0ftd< z8zfyiJU{d4upCZ0qY@N{*oRbhUat*7Yu$pHY)!ae#Pbsb8S=z5)2zFha?rmBxj-mJ ziL9c4?~_HucmvgBsEK+;0*AEA;atK*Fx_l112WOIl^86Wm_Z802t{BFX~qsR{RhAi zL(@dhyhRiMEXzy?7bQ8*Pf$z-jg9ooD-|H(ylbC!<*(L73cWoJ$+#_2&7ln>m`39Qh zsK>cF_R*g2i%Bb4hnVw*m>_ro?*$3=3IvKt@EVR$sDD%BFA~hI_esRi2bPr@IX`Uh zQydigj+oJYe!v7ad_uk_V?IJY!cbF6YWsAYU*|YFO?M9|eazv9>{VCK z4hEAcV*4j=-!dHHzXSzNP~!7Vop=AaUGR-ql2v8ZB9)jGsmejU#+30Hb$9|2F3EFV z37Jr8Xe|IE0Qx?nl8uH024DD!JcET#TPDMkqu+BZ)$kkq{-CrlNarGQkmM*BSdNa=wiXuoncF zzk(qz0z$zE<);Kqvb%z87xXY`2gIjsA%(|`w#g;O9$mGsNOFOrY3mBJS&NL{BcIW> z1le{lTEXn(3VFl3tx*^6_r*e=!`S$g5$X+zFzGvn1XBR=XQtyqB)7EK9epe`jJp}B2Lqq9AC@oySqE85miyXSMZhEwJv-MMF07gW(Z>(!Q^@w zWLe4y*aXmjzSUE3DV)cgxyuhve>^)oc_s!{pO5KgS_V*-K!&Cm$y2dicV~C^`PU`2 z{oVOpCXOkN!6ZtYZoJ$HWU~QiXK(3ZEZ;So`i-HOE&xdo45ThfEAPt~tOFN0yBz3P zABq^s&u?JthE%{wajql8I8`&|RW2CC2_}M9hmca)^=9+4_XwYaYNp-yK9RQkC_sL- z0we&_B=)tkPb#&$+r6DkpU9b+V8jY-&Tu4S_F<&A3>w3Tf&eGTXW=!NBxDZ!5DV1^ zj&eJSycd*8cE;jD~5Cw@%`2uFcxWw; zQL%piVf?a?EFZoxOv;9j(_U~b98JqcZ^vvg{riusbTg33Z#|aR&4GnY4I-qCb<>x+ zshd)H=rhHkKNl#u9yny1RaI&H5In*G@?jo@wS*;s*F6YIx#M`wBdOJd+jH79SC@r5_PJ!($ zm7SFPGJp{{lyE?Te3As7mXL_G`M2ap5mzj>hY&Ry&VQg>D^Jq0L6QGg;}3M$t27QpEn_~B?V zA4vpwfnKL$?Qe4wErt@8rXjfHcJU@m{29JPc1hzq-zxa<~aI`Fi3D^PvW! zhf#n&?1ueBMWk`4}a~lLL572VnPsu7roTO)Fcbb!?CtGr|%Q+=fX(@c<#$i(FnPCX{c> z*ZK9M*~oEdm1Gk} zLNIvG$B)g>oHr36zH(r4y(y@WpgFme7PbB&39rF8fr3I4h7#~iM)GgGO3k`!57K){ z#U4~y@6LA|#rI6dooEq;22&7s?qAx0>oXta|EH}*Y5VB-Y&i1R2X=dHEb;%|>h!j9 z{(sxu?cSsR-+erdjn98L3~>17aIT{@(e+(@N5t zre>CuL&A|CE&>Fa>Izr;KsJE~Zf>Mj`&kaZ!;>6#!oO%O95F+4fgWX$EvN^BfD0u^ zyi-4JngRiTMzoX66NSd$NlLG_BtHr%vd7@HA=1?t2hQ*Y;E;hiyao(jAOOJxU4c1{ z7R(UOO|V=5m7YQH65^0cf?B)*;8)1}nW!SWD0cS&_{O9kz4U8R@2c*YePc|j(eU(_ z!+poN)o!>+0nA;QVOs%`iuR zm;`m_Z3vn$j=j7LO&Raj%X~d>bF*12o^r950^eroYM3Ji1IVDqF)PmhZg1D?cpa}h zc;0#5;U`PoDc;%Egd|rm3F>w1i6#x;um;_J|9M{$J__qD2QtLueZD1>*eIXozC|5qx^Rt&&QALZ^0#=4**3>M0Mb-^d&#lLw|+_;M?}i zO@o(e3_rx;XsizP+V@5rYrTdl*Ww3i9A&$P+%a0&M{(NrWWXuGI5kH%12KS4{16xU zpuZ*l#PiW&GQl4}vy}nk{EGiA(c4#dxM>@Fzq$s0E?|f!7zF^vu|V8w{E8%WQJ(QO zcqb?rBOh|%lajgR(kHq*!6*!5hzoJbm6{%*A9y;x7Nj^h8u7Bi{y9eeGp}(t0g2?n z5=gqINoPXw4l{6t!!T6~32g&MUSV5C*=#@71i_P(nEA*SX_?XjwJ6TFX8q%dz<%(u z{-7Fori74C?5#A#)q1-!f^mW)HUZ6lr>%dd%^Wn@?kdx)>~CxO8RNE(|Jel1^X59MiOlCD(#r8N6y;|LV}`=H zM`vw;_P`}Tst$4KvElekm4fEA0;-3eo8W21;pN%0 zB~3;q!8Aj$8rPO|%~c>RV;%Wn5O?&e(q2@mO>sxzS_Bsr>r>g)%vwZV3TRat+xOM0 z65Fm_m+Fe$HJz*WaY)~Y)e&eFBUK-R2Hd3QtWP`n1D zRVgi1IV%#{Qot;uv#W49ne!x-wKY+zfv!W+<$zYDsIWC&m7=0jU5dI2*QcngU7)BF z=sFZ#4ro=1rmkr#OC!2sUCNeKs88JtLV?1iz}KO2Jz%R+S_hF>mC(9gT{@SPuTSO_ zK!M6-pw}UCEm+HF3=7%_$#d^pA5qQBZEb=$A-@XA7>4Nye(=&fhboiquX-pWp5Kw` zk9t~jjgik7Nc{qkB5Y49@wXMt&Fgfge3 zQ;cYx>ByXV85w{&D`czDD~PwGW>tqx0@hKWXB}TnznpKR9Cc35B@&iv7{t|r&(1}t zO=`?_VHYrXS<#{>@d+?8VhLYV_cfGHL|3hacPnFBTnGcP7DRKB9*z-lU~>!OUjv7d z8Ir5HWWtn#eE8Re1@3J{7xZNO4R4WzHDu z#^$4|>M$I@ic>&ea;dP+Aj}*K_74wEY3fd(eF;dlD?wr4%KQrK{Xv^Am6ZnKcv|YC zAdapr=?Vd!_&7+!M5qT9fEGXa%4+HuoL-7K{wxfhh?dC+2`@1777T~fdrxrm8dLTw zX0v@VpF?Aw3PXKyU5tGOniHJxQD(^^+pkqeE;hlFOVJblMbRoEOu_I(RsLzyz)iGq znf`Uo>rXmw>9JTvwDj%BJ8`{w$l+P6qKikyR-@juR^$s8b2gtt|Im8;Pt0yqP;!R z8_;SrGfxsdt3?Kj0r15IHvdq9(a*!*4BXpRE{(S2w5p|s3^KLiN;y@1-dquw@G~k(O&!} z-&;a6X?d^eG4dOnhqcR>Z6WP%8$&B#^NK9i7BvcNwvc|p!DGwiDvR6Ni6_eEv<*(r z>k{%73hSgIxt4El5#$I~V<9Z9vBF}oV7V8BsespuW0@RU$b90MbW3SruJKbJeC z?%3x5=J2Vv)(i9dj@Nshu65RYRh^1;pNUl@0V^;8AVXE~lM9JdiUKTc>Wcg!#Zhwx z)o=7?p&P<)z&y#elz3DW#soCaIxknjv)>HtjYDfOxf7SNqby?$CQ+qO>d%9{ zWNI8kR^5KAkOwApRb|PETP;0LZ*E>@(=vCsx676Gz3%o=j}|%BzaBjbK)yUpYAh`m zf!11C1*)yIx>~N~m4fta9ni{atW~ndQf_^n zlv`47wW7tcJaH-om<*vJBt~n2=giPO@Cig*0*e^f)*@zwQ{F({%eybEjhGq|R3Wk- zua*;!idAzM8PXArkqFbQEy4#Xnl7y(shl_gLI@60_k8n$zn&< zFRoY11j>J)jNfm(k;q_KQVU{yU-rK>xqXMsA`6$4%^Yb6)@ z$K7jZhwOOwS>c%(1V4?XVd;nE3nPxHaWIm=({DBsBGO5&5BV^GSq(=7LEexJ(n6_d zdsfAaT$XCyQiSvI!m~6Dy9`Jom1V830nnPD-6DP z4{mM-#uo;sg{mh;0I33yEV`7ndXp*5_n}&5m(Xk(-2j*_j!YiUK2=HWHUKTZm(|S| zH%GeUC5kR{EU&Op8|UsC!>q^2l6D01$5^tKszPQ0?@fXc! zdE&^ad^$WiK0OKy~ibg{~?#D&SM+b<*+vZ$id@C?A)gOlP6&2dmN2a3V zFqq@0yyxBR-fnkkw?cf0B1Gv)LdMA4&Nx|LA#0ZgAeP~o?RPT2mxWA%V1Vxetd8?m zXOqbS>6Ps=mn2-wk&4x6F=4rpJ2tIcgirTg!pAwXX#fw>y*0A_*M5Zi#cwgn^j2*R7lcm(Z3omYGmQJ-(|-X zmu*50w~`Zv8Lu#_Yeg|!|720prVf8-9O-pH#M*7uYsm<`m^Eg`V_c`be_a*sXFVnQ zUkdL{|J&*8baspS-_E1{_dXsaUBM_Q(E-=>H#POdsfu`H6<~&bL)S1XZ!K~=UyIT{XcawfM@ylcJ`LESdIm#nS-OL=aU2x zDiZDI8G{0{{sofraG1j|GJ+o#xyK4MZ8cv_E@X*Bcg>PO*?BqFv3zPBQ=TeO2v^s4 zplfx!7EBQPniv)DG{wTmZZgWklh(Nqt+^6h1?z># z`kHt2)t<8b|I)v`1HiKVzt`K&%m2N8|8f7nk7p(OkNo!i_cZ*_+TqXNk5)7UN$;F0 zZkyuuZgYxv3Nr1v)L9qWskq}=f`H>9rMm4x6Xn+{OPVfTV$^CmZJ=o)7jF{c+|@xf7+p`M3@XJ>$3)L>sH+;!th%7G^DrT6UI{}UOzg@(Egb!t{V1QDWu zQ{KHshJ;;9jBwOlEvkB?dzoDx=YB7beYCi_)-JZPAp$I@mkg+aDgC4NptD zmC6TZl%)xtdVzl)$wUf;5y;QL%D4hWoQxm^RT$L+>*#%5t0py9Z_ljBTv}hhUDM}H z;AXV>QvWDAQVLHvBlw487p{Qz;eNOX;*Hgq+a#hn__J$lOieV^s}pU*c1TWbHc zllTAK?R6gW|K7`E+JDs0?<`B5b0-F2D;!oIrc&quGt8>>FLu*gxCUOf{`)(5`>%e# z_h|ohFONKiuCe@G(cIENR!<|sY6n+)R>dxOfzQ(z-vd{W7jefi{BwaC8c`j`YFTVX zO|ws6+}}o#Uy`Qoj>f;Z{`Cz&%h%%Oo$vpHUws-Ij+AP_{z% z^~qtaMXDQVQIDMj&wEcf0Y0@vaI`pFPCDLx$<57|mk27>e}LkU zT;KWr&sTnN|L^ZSuK)XZYTf@Z#BBB9~YGhVqLAA<77!a#`hYD5a`XB+ryf@1~uX#{LZX z7j!XiOJSykqDyOEk{KPr6YosH_P&Q)j%72@EER>g7z{oEI)lBPK3&WmSIZgI%kH?B z%$5fmAgRVesT(NCRipkbdf`sm0C&3)h3endTRpnn3;W6}hE-SfSlRcT@My`ftV};mTWEz%ZG#tgwUz8%QqzUKAAa6D zKRG=LHJkPDQQ*bn5;IXgZ%+^=a>A)zx8W4{*c zy|-sS4v)?b_xH{YkB?Sr1TNSNMGX5wY8zB%eU>Q) z+#T9`bMpG|=+*h?>~!yJ`08*tI{)GDwXFA)Y_GfB>%S<#%7=Dx16yO`SgpV2j^OCA{9Fsog2~gJ#D}`8 zU{>|)v&;kTZJB5pYLLH&l~!f56J?pB5{+G5)Z)sY)QJR60{$L^;vbcu1d^T zu{~Qp<5t?(ty>Of&$8{j90zyQ_AyWP*<|8*bZ zKi$t$e%s}~WwNdUvm))w-WV~cuLXZ33I2@z6R!Db zDn8d`DSuzMFtr$YT_VhJbXtAQXAYcET2+T1R;iwqR@G(rBONA5-_XfpS0-zSpBcxL zo%G{H`bI`G*ti)@FquL2dd=xP_Mc`AKNbtEj`PG`?66zZ? zC&{%Nu$mw%c6u%#-d?|#V(8d?DmR}B{(oyRK$qHo^$PJncXuD{zwhPwSd9N!v;iqq zRo$)GcbzNG2ec`C1=3#esapTH6$5n1`tR-J^S|{v+mH62_w#&o#Q!WXfM>36UoH-4 ziDElC-8)~nXf0fvwRr~*K#QTLt~kWBjlCc~-XnUNZ*h!`JC7z1F{- zz2|ddf~NKrh3J$^3^htTeT%iE)87#Z(1}dkS1$a?79v$NP4TB+)Im>|by)jWN5NEt zSRS==i9yMo&_%ScE?un3E7L^~VkH}uR?)De1`%^sDtAIg)yBGn%vE2Rl!_o$or>VC z%A&{>s`Wl1u$lr)AvA2sI4Fv&60$Xg^p)IjJw8=WLHZzcnQsF#xRZ%i{pp#qT2)fYsuIj0a%Ti-RPfk!o^pFq!z8w3~L!gf8Y~K0rCnQ=oymNli zJ%p2C0jFwGt#vxAfU*2&=#$7_BngWAYi-!q{DCB695jV#!VCqA(3S#o?ddYMs|{WF zKB9E82!A4D`XlB%>iRXFV^#^Pw3dWAfjC6LDiGZ@G>$YzeAZ21NKpfT_hfu#xd)rB zqPF8Oa5xV;RHHd;%KdmtT#xGwd8waow^zf(3jVhF*vh#OM0n2%9% zJUM{Zw9NlfK}bi)7D=V?ythcg!o)9l)-K}%ZlBD0W9V|sEDWA=9RL+{+ugsSmtO&@ z(;=xI)=tl)LIZB^B;d4qcaf#iO$pR+=K(9Y^njXfJ)o9rPsOO!>wCEm(^uN@C4qyN z?>BC{eNbw<4?b(3S%yu~njbhV`fFpc1`bXee^6%UzYZo}pE`8;`TvW=|Ltx)=6}DJ z$6^0jq5~)us_xzrw7xL@Ftr8`m?ad}|BSGN1h*IbZ~6M)?iSX6zq|Vw|L?Q(#vO zou;aZBfB__-*@1&Rdgo?^_S4Sn)Vf1lAc3nDD*qyftF&ht*LggabJMHrWoKrZf3F4`U@hgx~)ncIQxRLzu6a;HM32g>}!RjvDV zg;$NfAyzK{^u;|cDz4p`2QFEKezjj=l^?omdpR{5;&SBh|)sI zCrZW=UJ-+rl|oCtj3Z>82&A@E!lA_T?{Pq>9*VUr z5Gr6Sw?If1Au>R#D4|?Zatxzxf`3l8mlohZWzs(EsN405>%6PN~qw(9D)^P% zk0+BcE~|JZ$!cHcJ^Yt?3jAMZ61c@1z-s>A?d%rwf9-T1@Bi-Q`M4yH#GT#%>ee2@ zUXbEaMv=Al0cY(svVUc8R!aVrR(qJazl`y}z0_Z2%g-#nO1P$@chkO?YezPLw`3@ka&F zhmrT=a}ZqH-nN|o-<}1~Qv07?!TzV;d$j+&m&alMQ@8_i=`2B@U5hh+t1DdE4$ z3+IaUe_QE4mgoQI^z-rGdb^M7|6ZPtj{F~a2Jp=B>C0vRaLYzzoBcYuKWbL~_<&P? zShqAaX|qD&kJ=zs%==La_p|QaA4b-XGIVMt{it8vsh_BU$jT`{Rs{6%p=JEYU1k1j zB>c!d75o3KSpYB7|MYeX`9C_{NBz&eJgeG&t(pGgq3d*(u*lolfIc_%ha=^Hy6yZ@ zDF+M=S}ev$MTjwEulP|J}=zV|-%t z)umTn-=DJneSIgkmeKD5tJ$@X=4uaN9}wM6BlXKAkmBjRr@Z^0S`EIl#i5&6ywMVd z{-wvb>M2?Ow;BFxnf?FHPQS4JJ3HOS^?x6abN%0r@qa-Gl)xXB1SnU&lL~9ee8s9Y z+~{4`auU!33O6PxwYH_clf-2<`Obj)rPO|~Hu@EltFCo^zI1)l{DSqo0+nDQ?5;yd zsckt@_#`J}g=T3L^Z&Fbw;I_^LR~emo2+$DUIdla_H~%#5?WVKdwnB&gF@?D*sCGG zCG&bEZav!8TU&Kq!}?tDuhOdCNr5q>sAx5-QU33@!_(i+zuy}T&rkNweq4fZ4x%$0 zUnPaA!vLxVoBiio-R81>$#X?Tr`{f(?;juiaQMpAMjJ7|%|WzXrJjBWWKU7VMmRt|Oo}VAN>COx4MDj@C6q5DFiUhkQ(%@r zZcAX6(7r-}*(LTygn_3sNPkAxl^tv*h)+6{$n^3vLRl-8iN+nS7pFrmqzzBcU!9)p zivZDism#*EA zov$C41d3PM$$O21uLk-a!r;r6?lcPiLo-|{x&OV*@b63Q|N8wx{Lii4_T&BUeLPO4 zx-7VRK2W=L36sTX7gbVaYN34kC7bVO#d9wQQODH1UO;!djoXdq&MUe# z`n99GSI&SZd7!rt=-sAAtvK(+Dz(GB-|qS^;s3W8{(ZUqU#F1&qr3eW|M^}XhySN- z1LWlKck21M^h*DMuI&ivyt}n+qRzyh17$hssTLyLjzudWTy57E&MjvjnKH+H4+?KxjgmWrCo%4d5lx3wHgY0%2XG zaOY6!>zWz_R`>5dy#lRY1AxyMqG%r!h<}T7E*J_hfuKd%zO@zuW2O z^*{Y?|Iz>dUY@+ABp>}!{y*jtTTU6jpOEM$GG5CSRJ8UGb_0oslNM|30>!G!xj*%1 zC|HC!Ye)e|f3gkI>B9FBrISVY6B*MVF=ZsVevRjtxj>W_mcS+uhbX84$X!qZc~8b? zmiw3Kk7PTB0Y@4a;Bd}bhkIv<-1Spq@Cyy*CxX*st8)BZURy=n9Hu=c*}w|UP->{F zouPp1=3CY*cZdR&PEmO(RP@(r0$B8r0xRVtDUM*#KGW!7&Q4E$$ysTFC6=0Mgq@a} zz+tTkYFTVbs1+8QpxSB^)VACNrPiB87_MshA*}ddS##P$t9*%aUsrP_0`=XAwq0wl zxcfO>szB9BcezzL8*|c4Q)7Q`G}=2lI2Bnm&i3}t&QFdHkIqIFubv;O_3zD4ILFh7BC9!5c914L*lvpPPF6EwjeP#}ew|M$!TLMkVbsL4?RF-ky)Bjh!_ zgVFhjkpwk1z&@GJNd$h`AAtZTwBb!LYm0v+`VDXVSJD>$>KC(VoByMK(#xow0UAU9 zViAK04iRm9>(Q&Y@vS$87maT{Hjf+M{$FDQ`~nk978D#F3~9rQ6Y?JUtl{AR!L}@y zkoR9B7f|c}_}8Q1>FAEyShoIq`TP&v?)J{({m;ETFpd*)DKxJw5L}Xo%}|7*MhndG z1qw+5Bi7*OJc`i#ViAUL)@XqkUZOC<7bGN?jRaj{boE&vzBCp7bsx3~VW^4#2qJU^_O${Y_~Al?D}TD6oGb!u zKl{qzIFZiqYl}j(%@Ty#bI75!apW(?kdY({a`WujCKxXmfFUKBP$pZ25kMa>W&G~~ zYMTmmQBYt%l*;yzP_{dJV5#FPdZEg-MGkXEKP))B2P6SLi6Z0+Tp6)YcjCn*MIQ;Y z)MbHo4HJ{|65^1bT{lGuId0~7sp%lRt@$K_-~ggIiAIQtbFeDLE32YuBoFajy_DuT z#x#c12#HJeI-m@Op{C+KN2bx(3j*;|P4qLhfPO^b93&_v6f=@s4;qbk@7|3eoi%3q z3tvCLn%zK;fxT4Kh+tw41c%pXoDqN}S{8xWO#DpbX<8hz!8-}`-KJQV{PTo_A-Ur1 z`eZ(bQIN+{gO)XcYb8oFzQ5M1$s8z2d}_BfXf#@ySbJjF(hG81TZ8gd%Q?uLJ{3my(cVAaKr?IGS)DRz?hFyu<%g;D4s@m zf_)gV@LID;bjgX7-ENJMPv(fPGs+T(BNTwAbm7nVoJ|%{#9Jp3xF(APgv5s-2w}`f z%oit)00h6lDHr1aiY{?NB2K(#9{7zc1Ug)ROmKkI1k$ahe4S4o-3$|Z!P;{N{IdZ- zt3?q5)|KZ3i=?IJGX&#vivL0{yPe+lo2ufXXoRk0@!n3~T{`WL$NPgQqn^y}`Lfs9 ze*Om6t>njxmmP0=N%0WR@ro^|Dhj?_TqUe0+Z=|)&0$}1*GA)T!e;`2VS-?A4QB8X zSxi|ErDI>YRx?6}@<7JYhE%O+p=wxA1h9B1W*ukXLWtmpeDHJ*FA$)-K8Ki~ID|d| z@4ox-cy#uUcbnkdcYGP~zYz1~A{Ai7buxYSc@vADh%m(@I)DrctwR=#?&SoA6d8q! z@#Im%5r?WekuD=S#Cj5^76a4qv7cic#zU7k_0cmJJ}nJemy=t_{V2Y21(kp z*Q3vv6)B9{njV8jL&Rr`7$6e?;hh|JacA*PXmaEX_-*ga>xQD#Ahpy@N!9?_-%?L3 zz1QX78P>;gl*9`@8UrAQLzYlv=cQ7*i;K6+j!h}ktuTV-6{r=ruqD4V8pU}yurLN< zF3K^^6GRCq99#xm0(MiWM1LwNgg#gBJcnw+;uxxJC=eezxT)4nkzqNQ4I4T@k((P*v`8EYx zeiq^&5e)bO%Q)OqCBZ(sT>*LBy~t76I&Qt>?8mW(aJKl;D!J;$F|5Zzh8Rr<8|bw;5hqzfjz%SH%B4cj;&fau*+5p2zJ?OAt47h6%_PeD+>zFrMHH# z;2!3C5Ev8>TS;!PR|v3w*OecrKSO+D6z9hkB#N5CKprdgS|}?-1=F@z;*3N98qbFV z&}_4iwh`5lkX;6A+Lc-g0@+@m#2PbparQO~x2yv!XI5-Q7`d>^sruz>?SQZskpAel z9O&rGdw2;w5;Hmg&DH_`^}&k}^C%5HmMka}WB*e0Q~dVik*U1wiC*sh3`SFg*~1}> zWIL}=gc8W~?l6b3QPE)Q7wDQ15`q?<%NS##k3Qsb3k6)#k)*K5BL2r$6wuuVEf``* z0ivyh5C&R8$dYp=6?T+miwh&rYE2R{7u8-`Z5i(sI7^UPT`VecscJ?o80VqRm#Jo3 zqj5Gvz*I*89CA*}X&!(v3dxn;pP@g)=#sy^men=P1XnYZAV|T_aB=~yT6u-A;`f;bS9@jV zb$ps?D{J<8O0&1pm{@YG?1d@6rp#W6q_RXR1%)J@9dOAloAy2#tFGV34QtTyYEkre;%H82V#fc zR6l$2=S^vSMq=#0{O;`d zQ7IA^4me3KuoO#aG(Le7T^D=;2japl78W|6QoZ-5#-~>Hn17qUJ~cjpci)L?m4ALp z7u-KT3EAVHpEQC0Vf#0|1E0WN8g)h=nuOVp*{e_BU4+ATKsJ&xp?{>VH#sdZo*a?R?ate1vnS93uf z#tx1~AeR1*;ud`>E@qMVT^GElj{?bh#9J^df6<& z6DF>tfGhyit54uv|M^zW35ru6`m6$$DxrW$SX~R2a2MsZ59ivfz`C>iq)(kWy980Y z2+8oYnHH;aB@W0NrGq|Ax);TpcNb} z-TQm1m@HAv-F#9~v6rcrz~^rz3+I6Ns*t$FB*^WMSvnTDV1)XRi>M}_PLWIS zUwpRzQGZmFXm~IU+@WlUS)mw!Kx2G6zX?7RRCl-oc)ux zZy65pUt*=4pu|TJQw-`%lmPoDZ^0rf!y!Mf0r`!%n_dQ7-eBk8JBP!;H6E=nSsSOS957`DrmJ&=T&JwNT)26$yqoBx_R;3KI@*P68BqB8U=) z*4^&ybV}jzqi_muU)&O9kbXQnJ24nice~erUJB{Hc8+4p>^eqr@TI^hA_!z6%Hc_A zO~r?G|NmF~%=-V+==i9u`Y&ivGB`CDb2iZ{nR5XlCSjS&U!DT#!Ve2I=EAU{`UQmVa?)!rVKvUdTX2y6|;ZZ?%pTW3xt(LcV%0Q$gC!dVDQ;ADb* zz2uxj?MMt{YxH1|y(bFV#~UXok^jdAA~OHvY8U98<-V~iv#`)|zOKE)r9`W_!`XA@ zzPOq@{;il8G4e4VIQ~)|FO)rt@WU3H6{bK3;;mW$`lvG0b3!7D#TAjN`@G|LSZO~gc0FJn@#a|07 z3)B%;MSK_KNHQXhg&~r6K;2%)ZtenIi`XNQ7!05f{5XXf&>tManH6XyFPlk|2^9I_ z%miDGqQr8}58RW+-Rs_512#=7MHsmd=xu>-`F~9tLTON3d2gp+RK(8x1m5jfAl>0{ zEpR0fbPJ#uoXQjL)F6pX+>|_0QnKgOauy>BRo*c*$B{-5WK)eqylAe6B7I=Cj|4$|$fYK?WEMFT}Q= zg82mAnOXoh3I*e)GGr`EClX8P@eUEwwsw;8!e~iZ&!kp(+VEV{oQ&TipMj@*Zl>Sh zf^3~*du3a+ZdYvEwr$(4*iI^TDzhIQI?7gAGZRU@}ZgUz;1(zje(gy`K;>BktZ7(Ho=B_RUx zuhNuLd>~}N6O?+Rx zX)AHaCC{womvBAQT!ig&t*O)+9?M%5ka7#JZU6!Q6_uB_LQb9Xl0X{S9HX-5J6l3j`dNd7`qDUZ`GOs>vz?+ zX}H{kZy7`6+0Kgy_BuKAu9av~2RRFVG6YzP8RgVZl%v{b2-BGq^ZhI;VOO-_h4?fj zHA-4IA}H(aIljEmjLyhLWD(#hj=4|zvL^G^^)3Kre0{dhLBc0ByeD2omN7k<< zz6SV%b9wa$_4QCIQ{T6EaqT+#34_}wy!EYic(Av;j5ieSYuoUh-|}sI@agXA+Su`( z&wk8<(zV*WaR1}EaubVJIW!Jn|CMV{zwEVrE+}+y4gdQsxE5&nK-G=vUwV_3OVO72&T>%k7=xb2B#p3i@uGk;}xJ{A20)WV34P`%JiRngQ0%oXv5+dl^^g+w2ljrniThzTtpfl zOFE_~Ek@2N6dI8@*p#t(&KSJhB-|u5Uj{8)`hb-#3lDlq z6{3oGpfidM$J~WU7*D-72I?f-Ki>k<53gj&i%O5^#p2W+16{zK1#62Z?B&Z6X}c~8Q?46VV%B3kq0JBv2w1-R!*3ciUQ&BTq2smvls%7k;B25Dac9L zfPG~jR6_eD^BaDY^N;?`K`zp$4oODn)5ed6Ft8R0+DBf2G7IB3@LriWa&t#xmjB9Q zfOsTQf?cuS6Wy(~wb>K@GmkcR!vFPO;8C(+*)X)$;NjsBizLVF&0v}`5r09*hR{-2 zhkNGqAFgL`AY^)I63qRiNgA;3EC&q5*aGCq>L3Alc$4J!I_GQCA;V}%0cfbo+S8(Q zvwz7i!+lX-sV(-AMu;{*#n!hIV3%z16?FG8q@=4pt)s;mR-3}XzWLL z8~-3WFg$*6x(b@57A|OdGYvuqNwMrYuythIV}6ut za(iN;y5g{4x9SG06Vi#oFNcv~MH1Ndu$km58Go+9YTiISUln%epk=_+PMI04r>O4$ zp1iTY0>q7OR#0w0Vn8#%1H^G>tMkLNKgeE?9Px{-h70`fa1!gI9C^r;Qq5Y>a{fHGaI`wW%t z`F&Y;Kern69|~9*`jn=OpexOtXwF}Qa5GdeMHCp#-ALWrE*cISb(W;lDvvMnCGdU; zG)Sa4sOP8|6ymx%&EXD!ozuG9KzhfRG*P zVzWeu-`i2_Wx!=tgcfz?sh4njj-a%|ym*1{!7r7&qQ3Fa-y`YxqJeJ{V>~+3b2uHs zK4Pa=k0Yy9f3h{1S(%bjqyih(4tgF`$VDS1K)#h1B;cP4D*2jm3H)(RlA%Sy_-V7& zA(=u4^@b?2PBF!2GJ`bzb^iS%xRG;t0Z!8v)E$HB$GZj6q1m9!BEp91(du|Klw0Vj zbpicyjMT8)-Tj&^JgX-}UL^naU6r~g3b_Gf{P7%;2!NVl02p!6`GZ(dCcx-h4xP8h@H@GbkQm+XS z!nX`~?D{m&tn1qxOwK%AD1lX1pt!1~#0k<@i88OG2-nu=W;y@*3h!c+FSE%0C@=mS z#LBvIOv_sFL#1gPChDXtAfjjr9k}v>Dlz!2d>B3s8mZ?dF-?J_u4edc#wsfx^n>;e z=SFPVfNtKdRb01a>rcMoi-X_-_aOYxEgE`zfU)V_mz1Ev^ z_#BzFkvFFta&96sHb77#wR6C;Ygu~!m9!QN5KJs$GUb1N_g^^l_OL8-W1ftSJPRre z#G?P?#_UlVWtalGWH0@`$5Q-dZV5-&bm#=3l^niT#Ia*RdaGwo`nU(=BY_^&L3W%S zeco$*5pHQ8!c=q+WEc25sPQz>*aCNBZ|QtDGmq+pw`2IU>RVz2=NHmG`15blv22T- zupQSWxBc1X90@6y=N2gL~Jk$Ge)L> zjPOycV7|9W$%rJfLGX8g8lyxT$~vb|I>ad1csT|w;P>dR8a9OsJ`8S;Y(cyt?4n){ zl{E2k6dX>WV>fhJgi{U@vj$Ti){SbRHKI^=>_UpNGse#Vp17wbj~+;d z00s4K&RJ(;1laf=Y007XSwyR``M?H8C6uMY=YXiZm2rv1WN3OXFq^cO z?yxVgKY3GP1QBl2+T{4M1xo%E?=rS%#_CdK4eQORoQy~P7KpS1Ko$FTHn{Fl<}=-8 z6I1}NuLfVGLns@CkW>AGJ~acS0X#Y0cd)I{9?>jt6g%qS&V|g#PbP^d0aMJ}sPwvK z?paLKXveOi=P9!d+^BJmr2eS>a?6vJD}%SndA1VivDk**Sq~GpJ@UUVsK_TjaNLF$ zKg?L*JxX9Zuf*^<%mxj{c#{rFdnDC42cFI31#ZJUEa-E-LhvGu^cHYsmYUX&D6sK= zElM<5aS2zgCt#JVWBVq2QQVMu)q+^L_t!bg(a>zM$vNPRxX==|b|DA}GfqzmxDSZm zVw*Qh4IBHlluG8;*Aj-gXgC?3hE^~iB1ng*(^#6Rt3V8OK%Lw&p$^c|y7`c!OQGUB z9jYGX`Tny;j75&xa|Q4k>|Bh4upEq1EQU6)eB(bwlC>f`TFTrKypFF1tQu2>97d2s z^cTcf0(g`X`Vh?}=AoXRXVIR_j zRy7RQ09_#ADwgol#)rH{m@g?T2Rtac=Ps7HLqsLZXX<^V2>t@EOQu20D>!UZ91>s) zw`JoX)ITu8nAbRe;Sbc-KmIX!S=>joY2*n&9v!lb7;rB|{1VVaJ0RMN40tVQk=;!q zBcw8$ZJUH3uu?Ej^o0)?W`@z@E{iESaqBh^qgq&9L(z$QPJb}XBrUXNV2K?LYjx$k z)M(w)lEdo=?I@8Ib0n$sON$xzEKH)gZNuxQr{;VR6~R##En(QR72fm$BLzpOBt3a= zw9xi>-VR4cQ0I{qOQe!D3ot9H2-PtK)8Z5uObm-^;{{t2{si@|C~5lcXUPa1s-~6- zN9ET2oRcRu?wz9w{c|1uCabILJcQ^_E<`JZ(J0O#`HlKY&KFgdimpZcJu0F1!JD?5ct| zFqv>0cr^=Cw5|OGiLLa-MD^S4Q9T_N?+9utj7l6R_eUU-hmqN6ey35?->;My{9;xS z`#49Er+%Ehg?Y~6}-U^cCuTxQ@Xis5RR zN;7=2JKLK9R7!4JG^&O1w#&AWC4Njoe$)FKTx?TRhy^hG-#P!vruLp`F;w9Q=<^Yr zttkgVP$V|?@;;BRTi3tRAkdpW5AvroP|Ir8YYnSr9)Io*#xRAVstAID%Hpz@7)yX1h&}Kj4@J_^@(;Uj`G*WKRx*; z$*6LM|BA8@P)`!;Dl1h6CVH0pZL;$~4jy3g&ts4GaTnqSZBmzvm%ZAORs7)D3Y-k| z9q-3C0E1*g4loL;>&KUZ3u`ixrQ~DZT7w%RwSwrmSq8vFb zHB2_p{0DiK{WC#wXweYyIs7D?s>8Ty%c>UBC0a4Q0B1@bO6wpv@>`EEEPrn)j${#L zJ%L@8Mx_CF5`9~9Y{^z@ai-Id@mHala1NBxysJmQ{=lufuA35lI2LqZ-BpLIFtu>} zZ*nyZUvJ$u!5^r@V9dISRKh>A%8~~Tc`$^OtX(p=5$IYU;tUnYNi=RDDA6*?3e+m~ z9Ixl6>aD??k58B=X|vKpL9%1P$jw&~Q%nmgI~f+-Q!n-MMPN%wq_Ka?u`BJ_OzGT; z9{Y{KrAdPTD9BW&s1lR?bmS@aoZwgDH9t{4#;6{6$|hUAQCvhAy3X(V162ZwQ?9`V zSyJ|R*1=Pt1C8R!*(lTF(h!Vp{X`_5J)0@bn2*57ndDm6Fw6S?qsO&8Yc-Zf2RZF~ zyC*NG1XY#sf98!19 z!?^QQ28(O}{2wkm8GEo&07djT)F;CoRbD)1GRzkss}>%6NBeaLRV>vSuFTG{@(lN* zBcL!Q6>y-nd(Gh|f!awu=ZV)%gdUTKgr$C$pT9UI>y|N04PSzh{D(=FjHVF9uWCQL zGPt}UBq9+weQ<(9cj8HFEVJY5l{%)HMx%Z!+LsshSVwM8iEWeh?d6#B8NY3jw+_@1 zKWQrZx)XOb`nEQ-e_I<`zO4Zjd|u<7^fe_n)?SiwQ7iT&@O zYO!;KM2CfSxV-mNpTA77D!FtW)zB-Z8+pTmRZccYJArS$RNK}llTx|1Z2&HN{Yct z;ZBtXM=#`AUnmS@EUsS?Q z)Ew|&e-5E3d2++3S;b&1_GPDNi;FuSO!OFWGJY`hpVu+Rzk+}1-5wNMtx_fObHA>v zvtL6c#W)qzmO8P|K&%r6*w-%tb_H;6e(ahna5#?nrN*TV9ACWbt{dOyfaaCA387T%tsHd z^rk^8#-@bk;tC$Lge*VH8UKSky8CUMN>=JWCi<(HA@2fi4+161pvIE)o|K=eqo4{X zu=92yf~S!2b9Z3WXy$j~C|Riko8NzPUqYgGQP)V}jN!g_!5t)^ib#q}TXtW|dl{0=Z3 zdzSu^+7?#KNdIh6$VM@pQQtHB$vb%cQW`cUjBLqOEvI%UJ!BCc|wxrHHslJyQhxlDD`jzQ|V(~(vnD8e+)q}=Z zoOib=^nneqfDlU#=7^n&o(P(O*K1-sHBwA_iQd<%2LF&9R7_9C0yFXWW*Mip_?t5y zWm4QShhIFhqD-J`Imp_pmvzw@_*xnY)R^_3z<#q03)ZRvZcSYHcje9=ynaU_bWZw8 z&oi^LB^eXG-+gO>i2sz#88g>)Pg;)7FtjfUj(CuCLZ?i}MCcey30qzQTif|;WuqXD z%JN^#*4}<$%|XD)(fpDXZJDK6nNsX9#9~R7pe9ov#D+7ZnVe(Uhc{gXer?Cd2xn&t zfAkR~RZ=@eCN;kBO2qiXvzX5aorBmGBaOEej;kC1oM|Joz@7y#MJ#}=qwyi9=nC9* zS*I9}HUOjPht>))tOX3!Rq*!q`8R%Q0U)9*0~q0ToP*HRv%ldxCF>=l5MO)`#9u!Tj!_Oaf8?b{l#`OYHzQzmVJ-c#J}ir+l@cv z;?f;P9_6G=P2%M3bLtCY(CG6yHlUL(INEIX>B0B>T#TUG=59@oZ45mDg7I`NF`u=YYc>4j5lUG}Gs zhR16B+}oV)*UvXN4XeWfV7%HE&(Mjh(>oF2D)oyms^&Rt zy7T>+ZCxb*xq1k%tUZoEHg+3q3&TOK`t|u@;WUi%GGBDRXbNiA_gsqYxKypBs%!qo zN@r63+}L_g^Wv@=o3l%rY9j?=U1^;_7InsdOfxn_hiboo`BMSN9!9{Gt!wm4;9FPx zE7A3lN)13#sx5Lk`t{SbFsB`Yx_0SlxYCAw4*B2r~ zRGsu4c@UR_Tfs*DdQ)b_;qoGuNfcjktqv@^WN;i^)@{ zBnn%l_9z*6Q8lh_@J#tOz_GH8eOeOEZfFvfGlBb38B^;W})!Sz!*Qg?jyuITmupzhDa zn$LS=nEZv;n)TbQ5<`J$#UEk0N*K#jd-LVIp_x%EHLX>@z!;_K44}rnsfF^+9v&ff z+v1qeC@aXO;P9ThxL6D7=J7X580IHZ4ruo@h7`|UO3L`JgZ599dp9Vj@Jt+;GygF&LSjaDGQyDpiNA-2?ZvpN~`7 z4+qK3D*6$$?&WY5g~Pu$nB!w`gp}C|^TK%T$Vg&d$ngW3KhdPrbaM3;re|ko72kRi zI7Ee}OV5*6pT8?UcQ~|UYC9pEj+q9G1i&j|p(&RWAd(`wUYcb-X ztFHE0>GbulB|_brxWfT-wq`OX_q~*V4J^v#SrX-+iRCI7)9P1mXS!)At@ivZ2N_aa zZ_i}~n{eNe3A?PlN!SX+xcvRbWu5xz-3pWj`5I;r;#&18?^ zXq-v6*|+k!2GB%qB!(TW;s$1Boa^x=Y^+fpz=N~#971KgYu=7p1|CjJ9nzfg$;?gY z0_(7Q%SphLK;VNI$4)cXN-cMfE!eWh*9^V#b5IKpXSRVkK<-UG9wLITn?F1x3&@Cb zT}<8%uw)jcLC&!`_A)Kb>>qAkVm*rGt8uBiRaFG0&4Rq#Jc9hZd_)8Uc~?NKt%}UO zsz08B=9;y~&xU;jPAYrf&a@=N^6Iib4VjZQ2GvmS%XS2p9&oi4K1Tm=xwkfe9i5Sj z0#bO^NsZpMF|$vK-+Z}J+N0#K5|cAZu2W4FLuLjI(pPxMp%0Qo45_)5p(m4sI|c(Q zWgv*->z(B5#WBj1A~Pam#=P)=ONul7v+4k>Z-f48t*LRdz^F?0Y*u!`+Wl)^M}LsQ z?HH@|*lGX+Ilq*3S9QmT zf~K^G#2Pc9n;`X8)FtJCZpX4$Vbi?p$`v(|ZOTJ}Ye%+LT_nw6oaoMfwU+J2MFpDy zIiI#HzRW)i}& z^p*7J)$761(-lfhaQO6Q)avPP8^vbScS=T3jrTo?MQ@G5;Ig1@;J1wj*K)H!P|^<~ zmFKL++}MO9(>xl>cng_!I=KCX9Y60S8CU$|_4g^um^DvhQdBB`DgcywE>K0UrXL9p!Oq-XgSDNE06(5;DB&Hd5`-ClYl`g$I6mT3BiKdyJyu1B7u-#Ol zw?wxhY`y@?iTDs5!L(tLr#hhnRceKFE_fD;IN^;-Ybu%8NyXgVK02Zq-x9Ro*{?M> z+a|(OpOD2u0_!ld?oVV^U}pr=K$^^Q%+(r;TkrG{9UbSoXp%=_RfDnGRINj*QPy@iVGS+ zNZC_C7V}17vUZWE6L8o5dSL-s!w?T*v8<%WY<~sC;eO${l4p#4~WH% z{!<5N8U9|sL*Tu*i*ugwjbiim7<`ASpS^c(`+CPsjpTXXDLYX|%Lp5npo8KPQlwbs zq|qn9XCacIwN=z5EeAiKv0@6eC8^zF#T&z>#VOTSxHm(f(if269scbZiR}v~=tfk+ z_gr5D+~9T&jv+WpO9jPRPnv~zw~sICR&pUn9tDeb3ges~tVb0csD9`{G47qN5Lhx} z!^7lroBW!lV=feh?WlsV|M>}T>d#4zBNyv(Y{cxC^NB+0GQL3mOWYS8q5WsGk_k8^ ziO%zgqz&L_(2{1cs8lCX4GY_-YG~{&qpr>ZIP?ugRh#psFsi{t_kvYUR)j^7p z79IauU|H+kWnX8*!GBz*_&3z8eukW2vx1 zfBZG({%LA!mU8g=4^5XOa*}qKa=&U=7;_lNpx37!#u!`#W~L_~M`k*eIXI#EuXGIU ziGabaIb<$g(Jj7$1cyH2E4b6+Lt~R>x^Z?j)w{fhztGLxGCrIXhDnBV@WormJ9)t` zPa2R#-8OE(nUUY>1oTgb8pIG5+S>ks4w3>yc7@ewoW*FJ!Ql`mx5Qtwp^X`Gp^dAe zms=HsU+8MmTw39=L?BYTOTT^gs#0&_QpK8e{GEvFy%^v{FjjTo`=Su2o#7i;r){B6 zF;f^jv6gDPcoP-}5wRpDz#39!(YiNuFgDm7mnG0z`kz95kEpy7QJux9$^dFn6 zT_LaHZR2MrKj$Nni~=VD*x)MXE}X5zrq z$-jFU;O6#45@^Q+k~sl%9Yk5qC@|duZAUB%H=D?DUpZp6f*PJ6hkG=SC12AF$Gv4H zgEE<0yaSLS+tw?NtIL!BEJ};eW&Kck(%iB0Z5YhKSA+GvYB)6KaKFfyoOs z#E?VgrQqGew(H>IwLTb&%tg~&<}}lcnCqnBfn|wb{s0*~Cdgyq6C#Y1L1z(%nRHVl z{8-M|BsIQ9A{~a7snHX)ky}OM8!YHd#&%g>ee~G%j*0<`R>Y1bcW!4GFb1PvXX(g6 zrH+xtF9b0;x@eyg1;;g1(JaBBcy9FJ!bZfmv?lz~(4ckkaoJOUNlccM3P!>t^`mzZ zk$&~p$zYLMq%Fx@yO|Piqi1eHioCU?T3w?pERQVdEwy?z^Na(Dx-G#8qN1C71;58_ zma`B7OOE0{ml-nWaa_W?O&*Wkzd}uyVezrrgc(D#j1@TOm|4L*c7%tEuEaO`{QxGd zj02P&_HhL96SMkaIRzi)nUxhj2Iz)B>GO+0%gtY`mJGM z!Ojd==Hk2*IOB%~1p2g*;r;1IMGbL`Dqf`tlATrHIIaSA+ba=F3a&F{Vp*`0hl*IE zGvrZTz;Tt9v&k#ri<2IObm^K1u|F*_0||{WmNYWNWn8;bB(ZFWeT~RU@ZVZA8$}1@ z!fN|TJl8^<;Uo1+N*n}dxcwm6x$#D!snry-LZzZp%u)6-R;)YUw0#~*Q|1Q7zbVq{ zS2W3gJUM%&S21GoFs<+{29Tdp>3fX4Ci7Oey}}@>=vgo1ywUaRkvivuHSI^%`mKl* zSJu8vVc5=SaZVBQ6w|GdKA7L+J7q<^JJQCc>u3L7cS*Tr$fWx!dm?uJ?&=v!G@nn! z^Agzj@Lpa!7r@eA5U#NR^Mu#m%AIwY4=poY9waZ8s3&hV{(3#}Xoz>Wu*EJucJC2g zd4R_5fOu+-C8O2I=e=<;OE<$mqLqlBim!`*wWcUo?*TRE7EXoS;MJeEBGM=vmoJ z2-_Itg)-WoUC-#u*6K=gih_ZYT*0VboDF{IWIIg;icggIBx?^xYZ*#w8f$5!QHlFk zZm19L#Uu%5>6E-YGg)WMv+BQwC$IWzjcL4BtLzGCPKx03O6+bH8UMNJhRJ7+>p*p= zGuhpJ^nK4&Z#>4;vkU(#dFWs;Nuu^_-0+VQ|7Qf~o9Cof8Y5eQ<%0I=D^vzX2tHMc32!urlZa1pcWsPNFH6^<;L0_Bd41uV^ip&S@O*fGu!9wewXItXb z4wR1N^etXEa#Exa{=O}E_)Y@>)u_7Cse58v^wy7Y`+!(h-0DxK;RPD^O!8VCc6iSG zWX25|>x7k{l`#kcQXD8w+nm?^oG12?MIZmRz^WsC?C`}kb?JHhM&kNP_q?JJT4ixI z?0p0$}>(9J( zqHj$_`W>P-$mR5{=)u4% zI_>Dx_ei{oaSnpwD?}EB$ia|GysFsRNMAgH%wgQAbaPfkVQ0YTU-RQb?}{r1abPUk zKH}_AEyoA|)03O;-49sM-Uul;Q0+6XruE|pymz=|!ID~yvBj8}4vS5rQyM1Z>MUiZ z)OI2|6IH>+a|U0@Gl3CLvsvbgcX)37XYRE_n;3n5;rk^VG8TW&E z8bZNvzH~91ka;6}_@oQ}9?Myl$7KNDi-Ehk_D?%TTv674<0&7pBZrcs#fsYE@65N= zSkW%0v|_hNHfK7=b-G8`@-T8z*1uSA-sl(Ee(ATBRUce=#&3|;dezV0T%4`X ziK(2p8zs#}Ussf0M0$6C2KnXf1)VbuMcDNET_ZmE^Yroa`M9_`Z-x)Vbfw%*>t7F! zm)O>2k(S$9bA%S=pW?nnhA(0$=h5JebpCtke2E!V&rCqV;3BiejEiuvRsCnzMsG7|_?ny;UwsKzh$GrEH{&u2PaV9DaB z#k5meQdtuJRg*}A=r%_`@$bfHx7=7#8y6i7sJhY`u*=(N)8Q9d7pezDgcPVh5V%HN zD3klBzq2PPhhzFkqsE2Y*of!&(Qu}ULXG#gq^vsQmnYIhlK0;JS(75i_Q|G`Ueblo zSa;igE$4XHiLtP65-y2BG#W14`P;>WhmGW6kcEE7096Xu5LSttM<*FTOu#|H2c``SZAo`p}obu`8k;DQdZ zuH^XJ$J>Hy~OiD>Aq1cenQ{pT${<_*ENvtNfLa9N+L0-y^B39+q<`3ZUCu{DPD5Pmt0lcSj^o z&HQ}Co3^LI3W%Q>e{k^%T-iC!U472;7+@=|?ZU0cUh|{l!p?3;Y3~`(bCpYaHygL| zS)A%yy>a)c3F72o*t7212HJPhd;aLYX^;H#+TFv@{&hnaP*Pz$b@2pnZ|k15*N5oZ zmg@@A_~|GsI+@rs=6(&i~CSlARW8V2>JY=s5H1v|R^<9Qb!?w)duT?Z;B8fU5pGdv6a zYN~8y^Y-_l-lT2$w{ zR{YD0Tu8Vn3PaXPS3kr?S&WZ zR{h1U;)o*76f^$U%{*m$Go}C5P);*m+sccIP7%a9suE z%Qvs=h3H|cjOfQ$(Th-z{Wl8Q+VjfrHHYQJ{#Vm@!NQokD)70^eO~UPQx^;(>>8o) zhMXq3Mp#c`or!<6i`-a@l7g!oyw>;dye#D#onVDA82WL zg7I#jLDM<)iK$2jrrrK3*KX?wbw8_XG35tD9wO=U0TqD1DL<)3HS<` zI)(EQEo6qJceg?`_fjB9P-NEkHA($i6ZLor;Lf9IGF@nwe3& zpQ!b_P4c|do8Q1ogY3R(4`Usi`L*aoV)5}jo|)9pujw49D1-gacv@?k@(UOyD77jKe7GlDm)hK6Alqu^e^AhJw z@+on?3SUg|Xb!J1aLx`mW5yVJQNd~I-P1=HozO5Nboy_jZiXH?OHCUaw+!ZWE9rie zpiZ&woOg!~q^T=zyDu4rdgg50@Ns%lx9G5*<6`kKB~TYz$24BGNKI@qVFUK}A^lzWPQnWSt(qyXhsC|H7ij;W|H&QRt5w3Ki}Yk7OiW9KmeL=9tdc<%*1-9ljN?!Rm3sV87q*`W zA&J@hWG1tiyhDtH(+1hsgSAsq-TKQP|1<^5SVs44mqbeP=+9}{8a%#dQcW#P6-76Lf zD?z%B#8YHFxoC#anD6qRp%6Uiaqo0;vGvEg*taVO<^B;3`%f0$8D_^?t()$E!;a7G zRL-R8M`8+RF0JU_^cn(TFTTgZ)GneHS-wt;quJmg;^}^@8%MeR*c5Q=RZ67Lbe3*! zJqtiAf}#51B^&`w4E-ES3}jYa{chYmwh@hnzBGK41K8iOoF&ZSF9QO8MBhP2?M;{_0Ve4Jnw z$tOz?uAqXb#L-yd&d>;xO_Kv1ya8~Nv;lctFQfIwPA${P@KxohiT4gkbSNGw8v2 z%CwlTFzlX=lDHjZazg9;4o-#cGhOw5k9q%C0DqrNh$)KtZK_V?QR*t~!=pxY4M8DJ z{~<@fMX(XjUAa1As2OA7?fHMrcuLZ9|f*_rSz?0!D%AGDU%e;>R`PkMUk46D1%FSAsL;xnC zt>nT!n79q_o7~@7{Ud0jP8p5TwsjltR5I^B^BEkaV<-h zrU+A&bLlM+6$9UMN1xj|Vo?>9vMQ%JiC2{mq-cbcs1t1Ay+!Rs1GeI-K2I-YOWr3% zNnP2mr$9chYI7P}zqD0LrbY6nk78&M?_82i zisKOe4$^%wwv*r?OrXi8QmDv76BvcH-5wtv&TI@#eJ(DxNkP41Nl}fZLs^E`BgHet zJ?-Q<0QQ8Z@4I)ngBZn=*8ZbTcX{h`ddWNg8bik($|{OEo6BvI;7Ug_A*B{Cm;1Kj zb1Kgb-PV8h!QB0Ok3eY6avTyx`{OXhreTa^A@U*TVgjD08uB($-yHM8(}Gc}X`f8z;a_s<*M&8skV{kK1W zIx*7Ehb-j+ir&`WW=!%chD7;OVw2S7YAro5rbo7<%b>pH6|bV8+CuI3_<(nnf13SX zTKH;)ghrI;^98J-B$)4$gamTJJpw7bjIbz1KZh6ak|s}y-pi$uzG5c$_obJlYHneJ zRCb(P8YmOTmLW33-p%QMygq&TB@XzT3Yr7^kTKoG_C&6h3kK5oAqoaG0M~{!#oOIN z{>d-#n<8oYWAVu-=T(uOeAZ8O@^csm0{xXn`)V^b5ISJe_<2aQLCH z$hrs&gy&j4Ej!SI;GQmI% zg}@Iv*Az7XrmpW-TH@|6)X30e&S$=WRoyqoluT#^GHT|!|HEp z2JZzcNK+lHN?>)k>1qhBdF-XN&&+>|o=ci3N`zO4|NZrJ_xAp@gkEc}1iXG`Hj zQi{Q%7LKPx%mV_{J0i(U*b?Z!VvuQ6k_rq>0m5#^!mp$E0B-)mBzG|GDcG!xz(@R^UM#X& zps8T=oPRnRZY0gI`2?9lAXX00d!r|v0$8u;V0p6fdLzf5FVxl-eBro0hQR_$M$7r! zQ+bN%FZzC~|Nga&QkgTP6e%j(tP=Z2ZCvF{&)h@XJlOt@KmkkO%p^o!xn3kuRX4Yv z!0e3v$=DJN2w#5EJWu@r&d^3Je_6BdAhQ<;sj}n-U3rG-m!C+DAIgs0jcfg!V^~2? zuxMF?IFE=ZcAku*`7stF5Ewp@AQ{+VBKldxo+KK3n{~ha14^kSM7p9ct|B_>bxPD3 z=6lGStm&ma%jyPC8#GL3bK+`Gf_*LsBjx3P9`BWZ&K?VscJ4|-cTQBj8t}D!e_-<` z^Es4$WE;mtr?w4=l38Ym8&BjSe)E&eAyqc{pP*S8$N!O@BT4fWOCcv*^skeNWkfFF z*o&>WcxF#+AG#fm0|cFgWVdJjEd_3C-XB@C^>6q8fu4CQu8R?b8xJxLSXy9}hhrv1AKiXpht+{+S zXMVdjzc_5%C^*gx0Q@G|LUlu`(NGGVjrDU<694#vh z$G}?K+SNxqQGT4lcd-hh=D5gfn&3kaZA_|W)w1y$?ri%H?o2}*64sRqzkA`J5J4Yp z>8HDK`~EHU>a8e;yn8|&{*6a1)535eHs`0hyvZXOZ|rBPe6i2(43U7Fn}=bG+$Oxl z^UZ0dFOjSfT$!qDjRWH4E8A*|e@1$mS!U`?l;&(Tl2z|A_|sv#LyrDC^**!X-1%q_ zI9Bl6;YbWDAi6}g_2dNUysM$OL3(N|s&A@!|FNAk!W)lig4nW2_m|sR6&BjH)zbA_ zxT4h;U6lU)%~>_eR_#aKK|O`u=B@Z3+N?qXE&}af1HgUw&Yn)ul=DA6vHy{s^^AxC zx^~}K=YyS34Sk2X8l2NnO17Eqk9Eckkk%ZX!D@X}L#8d9sZ^~D@3i%w*v8A6ZOd9) z2YlsG}g(OJD1sq0lZbG%_?c!d||#?4(z4Yei3N0JXsRH%D|X@BWy;B%YK0?ysO+sjZ6ChxX`E$g;nXP0EtYLI%nWlx(=F$~kM%*I*sOnq z_PcVddFK1Ca&&3w5sYS4CV$%M=={5fvv`*2Yg^{4L9`a7ZVW zQb1Q$m7(Wx+zDqHt$b_46~dfn<3(*bSIqy;2?Vgr5iRriQ0kM+Qx?SG3FLiyu6F#2 z&HIJ^qdKFX{jG0VDJF`8MHp6re0Z%0S-Kf6!=$nusiTfMV8!9~4CnEzqw9J?#)!Y&=BV%ye7rw%N~2}wbnhaIp^7=3>IVAVhpDB%RA$t>GC0J0ZG#{PWWDqcH<$U35Ks4I2F*n6-}a zUB!4$|8$tx;1crY@p^Pv_R5hW>x)&O)SN zK&fXjPQQBFnUrw|HJ$CLDYf)({q1X6%e1h6F~DDKn&2kn1oIaurwFaOggl)G%_>8_ zu?)O1tnkKVGJdP4F0>St={yRUj=T~r3=+#Dx9bndzl)+lU8K1W#y|Q#pGQUvGkgo| zw|pexrCa!j?YG1qbZm$VI_9-@F1ga9N*b04-&A?N-QV-kwKh&zrncGqayV5mCU8|;fdHmbgG3I znEm?W#uOGD<#K>Yx$wVH+@agQme7ok-rP_!p9S`(8?RChm1Y{teWUg^5u@qn0t6YU z<0D#5?@VHGOj8zKa)kmeydPTe!>?6!^h}af{V^Y8)`#62jS#?TNpXqBi230?(8*(9 z*VK5m-EW|~fm`=2knuJHK8qZN^Q95@+4(IX`rY60=mX=gM;rZ}F4=)}H{FYvK9x_F z;o#$GJ>^HmC7#X~1FL#b;ZnBxrRY$>A_oW~p1*{8yg;1-)|vRY)wQRN#Vz+XnY;Cs z$0gYFdCV;Rpa}Z7V--M^<{}7((rE{9Be@S z#|*Hx;BJBx^lf_Jma%|uFz6hx3`5_9C$ug20=D2C$H%F{j>3u@e64=hS-02YABI_X zM%daP>jCRGn(c)xcw@g7ZoI9oLU|037N4f`>bdSo*OLExFxo0A2z! zVa6@X?|GEdnDfMZTe-NZE2Jxv@&2rCZEa0;YbcUEB)^Vw-`9@mqhLH*l9i}Q{`iz_ z0C=jDd z{+&+w8{xMR>hEizG(|l*LGyl2N41H<+0Q9JOHxCa#`GZ>k}=UqeO5o*Z%~5v!+ViL zY4q$v#0O92{Rjl95FO*qDdn58`~LprV~Ti~qDE<9)5MxzjGnDm>Vyq`=;A0JYkx>G zfon-E9@yi#u`v$HEE)VpY8g#o8}L@!f6gPd6E_TLsc31PwxR@CYW2h z4K7lP+O@R@s=~fc9sI<}l9hgoYdfAFYn<~7d1MrI7)jCnEtsZtP~<<_g9=?6rOqAv zyOm@Q_G%lx?I?_(TR{WUF3!PpulW#ANr=zpCgNLuTvxB|y_jK$iHMFVeBpqpgzIHC(ok?i%ue)_- zc6=69X*mie(kdSxdq3LsiCpNKsQKy+X}Q(~Uo8DF%-`8v4~UJ&7oGg-{oNcr-P-fn zu?4%v#Mt&$I@`&aRN7vMl-2L}2e8G)zI%)Gqb_K*P5Qu!dIpE_4r_HNtGId>9C{0p zR6W@%tkS%Teu)XL)_g40*DVr;Ic6z*FGDBaTYH+iUvL5pNp3L+E2MpuQns8;Arp(5 zipo(G-`#gsfPQ&Rfuq#KZro@ZswTKUL80uJs`BmG)bD?LLwK>v*g&6={k}Jl>v;dq zRA9JJzFze=<@x;F-Au@VAPvcHNSGq+wINE4ad+}tk@gryr9gGAvrUm_M-3tLfvs*z zw{0`ww*($6`{9YY(+X9G6QV7r$Q zqZv=t=pQ;KBR+`&PfCQ!nPV4nxow6C<0*?oQf^~Et+zPhT+pym%K;k)d$4E?W29EWQQ6-W80KuS}WYl*&K4>Xi5APQK8&OXENkdwR0_ua%QjQrAZ&MKGCQ+#a?nU8p}- zoN7w$M+^otnWG3B@5*=VZ@lu&VyiKWT2S{I#A>d%1)0Ti^bJyMuz;0|BEGn+3;#}- z*izI#@1q=)(I5UT&F<1){=7Nq+aLbjBaL8XBa?th+5}A!0 z`v=JnaPi{7^Jb`n90$VYpeSR8@q%0v;FW@;IGDGRxg6AqOO0`uZ0V&=sXs))D-u8Z z+o7o(UElyi*+JxvDM8dR6~`X6(~Q%sY0Bo1h$}8*MlY{B_(4pEah!;a9A9*!j7jAV z$sSZ^KF7CN1FutfNp#1&j9HXZ?!alSz&t732AuGs=Q=_w#20%X<_aCP_V+&z4Y%_EHGs1{f)U#p=HT<_ZA{HSHT!^TdY`WIOfQePnf zU=PYCBR^D{U_}*U33Toy7gk44o&C)u*at~wk%l6zN2XLo!kP%P$d1Ul+gtJg-ml}! zwUWSve1K_0D^mN;v(ph)bK@9{KbQE+IFkjZfRN$tLH!It)aW%ofk83st+l!Eq!nFo zIZ%e{&2<>@-82 zPE#xJd6bI+dr5pE3g>Ii^-x8H%L9POZXJ471rJ(_gpmzP9CoZ^ANhlg#2nR` zVuJYK4?Aknm}fke&u^jQFls&t6(zZJ5dk6mPoJubMbnj|vr&Qh&F$%TXZGPfrBLkB zjh%LZT>+RALVf9;hb4N%pF9~vZY*Hyc$MIWG17Dn4t77v!R64NjD{Wx)0mhIb@dK% zoecp;%7%buWN*$tb%KNFa|la@`w~4UTut-_tyYH}#)mUiO9uEO*7|TFijd8i{k2Bm zQTX6h@b|c2?T{tWSCFpfcJgo(JCzwK-_ux5;zXflNNd=P`25u*W?2jA-F|$oPn@!f z@7O0$TddCu+8m+x{k5XT8r~^JVWx$f?|`fW;UMEi_!z|1o+&mI&y^qKR%oPpF@5N} z2mOGB1Og6JrRLErBBxl&bBJf_J{vPqgzD2YA@lDyjh&5ty z0W?;KNbIr!EVu#YAKM8Iie7zi9DHIKR-wd5hDW`x4UJ{?vU$SYi|&|bBkdhI@>AB; za+BwPonR#Nn+3MtV|<+jM-q4WxugQ24Au2r1nbbtMTM?-3p?m>S)kSx*0ZxL zH)_`X*JNTtm(2P6m=NW+MUZL+fs*(=OIeDtUXfyYJKDEe)GdHWaX&e-G~%i*P{-@k zHl=@uSPl9~4Zn`YQTT%JIHJKM9S!HW5_DAaXMaLS;RII)wO&nS%>;i&z!fO6MU02R zMM0s{XYP$)d5>+R9e<}C4h2x6bf^W?d4`)$OvOtW zp^AO~VVpKop#9k?TO>2ygMTm!qtc}(tf4*)#4(j$kq>2aaC{Q9=92FB6rv50M&jGa zIIMs~yU8+?LBNusN>~JFzVci(AO{X>;BZe{ZFMKAd)gzc46DiV0DUTQ3YE;+6zhvj;kcw9e6WkOviCYa7PW`l zf>m+|Xr~D}OE(lm;LB7#b?+na8^R>`+@}ayAL9WXyT-<8&_{KRa8^*Ep+~>uv!Gwu z2u8fIn0nwak32*f5uCthxmV9m#zs8!ziEqyc0K#|UeQ$-472iYpI$G@9I0}JrcQKJ zSg)Uph}|nlU*eww;lKO`ObJ|1!3Y&zg!r*>T5g%j^7}T5BI)fre@G?@WgrW_X*_)K z_)~zKMs>k%zV5gfPNKXN6ib_iM7s1I$<1Lfbybm!syKBlsUFyLd++x#3ODL z8@?)9355;t6nDa4mThEX%OfvVX(*D#Padg3jKP;B`;_=nG&Jr2G?BL zT|1g+xg3h?PjhtZyEc1Gi>0$6SFVB(ifFi(-Rrs(oN6{PjatmoN!e!jf4vf16y>bq z4wbj*)y_Qffr;A%e%kCuNH3O6y>DoiH0SeD$7q>&dCt>3Ijv_R1Tm?(`2O?1kgqvu z$jLc-ugsSrDhE3Ce7EU46fN6s{HvY!_bp zKB^ewnt`lJ>~BVU+mA}EstrnGy`Tx@H7ng|WWg8PrV9oduP{I$mnE%a9R6h02f5d^ zym0mxI>sA~A-=84z)(Br0-iS$ml-I(sU=5iaBmaZH*cNnJU6{zAWi{PEd(y_xz@=a7zEYf>uOc!aK(97)b1hP>u{BD z7y5@!TuDU`v zQk9qp!IQ_u<8IQp2TePVjzZy*LxGdH=Kr|L_~mZdwzqBbtvs=Yc3n6yl-VQzBi4U% z$}H+((P!bqJoWoyUU)2#is0n?>eU&*%Us?rr$kloCiPN?(Y3+IJbT--yI%*f?W$#yaHkG{Q_%u z@Z0~LbZTrBnsR#?a3}s5cNU5iEKnX8USEbuJhQ;n#6sB{!E@53X>nGacW2W41blX0 zv+F@h{@M>|4R-dlmSYZpB%GT1w=GC*R~4vmLu>GWo~Fhf$jDs%fHRf?XNx^DHYl6Q zpbTc{&133(s(oivDw>R|&pM1oSUf(oXp_{9c-zRKV_x5$*9Yk!^o-zD znujjTGv)K!6rB2&YVM>@K?^WhaQDq~%C;X7@a`b~OD9mn)X9ntOOWMfq3}0mZcDr^ zSHYYWfd4of+{14lL;eWXZcl4FSLcRO>6=qp)0Z7Wbz$G|PCv=?U#>nq^WfduZvvfVw^_Y#?QfjHe}jo zpx|>(?_gp%&8#dPIn~ydGd!Vc5A)mGb%9JV9}};)&ESqYq-nrg!R>4?#3GRE|&bH!ExbM(?qy}IH8X%swYb(Q)VZ^ z?^!CI>BaD?h$IHD;k?Onsw=)f)^{hSmkNSD|6jAF5+}ouS_(TV50%cNw8P~@nw`R{ z$8hZ~F=ld=V(VzG=A3$FCUt#LKlH3kLNB+K2w zLeu9S@f{(5Pf>x^ojN0@eQ@0r-y6N!P_+Rb+tz&Lc^{nwqjnfc*OEv$WT!Gm)BiRCQ4hrmWJI8%wf+BCGtMZ75#$A#!ZI8$dPI;a`tf!erP$CvT?3GVauFkR0>EHf6B}-6s;{6`5gu(SdVW)Ge3K=P71^kpJF zM>qVi{h}z#ksH}d%Xa{F+4A46~C=3ddELgBUgYNICvZ)>2U%qWVJ) zB&L_l&_UI25HJl=W3Mb2EGLwAU4`WvT`$(2BVW6kih|x0@h?Jf8p3cmUVq-sB2k%N z`{|u~NghXcL;!r0Mv{i$>GUMFxMqnsRk`ZB)RLl6Qg&k+L(^aYWfZBbv z^fR!)TjYdSYK)u?SvmDmPvEH{3qpQ3YI#~IHo51J@1=RKd(ODl9~UJzRG^Ifk;?X= z(iiNi!w<6>c)4Z9{k8n0e!Tt$L{)$R=8#K$-Is7_a0%`1t%WDgQa^~G_7-GQ-?5z^ zf9;1KeK=Ce)`e#h1FSL)nJ_iv`KcbnAbILv_9{$rr`PtZExo*?_}og#0STeH`6{U5 zzD#4Ed4&nthBUMUuj8}}qx(qh_di{uCX7V8x*hHv}=>DXHQLGT(|!hM~FuoX}0)~^Klo0&L} z%V1mGH`I*J_8vyc((-dW#MT`0Wg_pFH$9XOZ|qGEVg2orJwKzAmhe2Fc%wjf$hs$^ znND$XIh^;FaA3BJ5eODRGi^bp^Y2T z0{?{jXK!9f1@#4FZ0$RvXo=ek(rm$4R5`LIBu?S7-F}QuUxXZ@J|h0mawigzKorzL z1c!eYAK%w^Q})5j=I-|la{Ar8!4sC7ENe#Qm5t3erJ+LVx61}} z+L6IHBDpi_2rK@_~NOx=5Kz9)JgXKg8 zS%uQkf>m)D6e|0`SX3ov#slr3l~N1t^D^~f}Uoi z;rR`cuSEf0;Z{bE1wAXQ=(wZJHHhwC5W3hQ<&=(0b6&b3ei{wVyEs?@`Y}gpAZr^X zRpiP3e}!>nSJ)ffvYzfS*^?2^HWFS>$y!9(oAPC>sk3oqV<9Dr-e^&rcYmBK2IR5B zSGDxh?F^Lqr1iz^@nn!0)uWW#yEfemeC(CAvZ}L3ckjX;Di?`lO4j4yTQcIpflc^j zl(E=5#V^qj-@f{;)o9Mm;9^GKHN?sw{ZC=M?J^Ad@X&6%;QZp!9=$3MPJzVUMwf zxUTvQU@|fl#0OB-io`?GAXFP~?T{T~q#jpk_#9ZV==9#^j3K;#Oi;Fm_eM^VSKNiF z66~ee5Yiq(PaN7vH%6|gnV?{_?qR?Q?~C<(Ybnuu%hBVu;adE`XG z6cshxVZ430LRN}PD06pG(J*B{QXFegox=yTT5I8nA4~@ogc)pCeOV0oL>?e!BZ#DM zds31#b7-S_1{)A<(4&iV_Ck~j@R!@GP$xL9gNIj0X#lDNV4|gDpGuDtL zQ82Adde9Uk$QpCW0!~lAB@Oxxfh{ zC51j)F3B(i7A!miB3XJMaiRCuIUV%Qm94PYC#m|D_fq6sbulR~@0{X^=_~fFaBJ7r zuP?6eMH&^O5q?sY^B33n4LWM16aY$7*7iMuj#_m~JjiGjo_)S_@1Ssuu}`pKUfxgZ zf}4&9p87Loh7BDrvWnI)@PgEF2@57E1!0t_eX`obL{e{caLi%R`QR#F{>WaegYB9= z;rAef(|{mq(3x88ykkSk0H2{{>6Wb`OzxYgbop!HD%>5pMlkO;| z>B>4xWWjmWL9=|TelcE}R9X~lG^{pmbQrJ7-KlS4A(Ea<8k#rBXGqVIHhFN3s2?2! z)9cXgBA zNq1s_&5Sd29u}hfYMaxa^68xvjvi;1^Y)|L_vA@5*{&^5Oi*DvQQ=zBiC8pU;K9vn zvzp#fp4OOJ9p#lH2MW+%bJB-OOY*OB4?K!xY$bR-u6NGf&Tb;OJO)E{YiC3dC)p`SZoqql_c+nPf=fL=0sQ`EM0gnk!px<)^$<8 zCZLT|{4GIN0~0MSO0ltRNK{0vUQ-L=PYxhvxMC-N3e~8KPh_R5;?A2I_$c(lJkJWv z48=V%p1(9TUpkz0g=t(Ny{6OFNo_?Jr$=dGtsJ@Fem@Bxj4qhYkxc1039BQCsM2a| z$eNUZ`vwc z-;M;XnCuz&AxCecbG>hW$bgWj$_wLt3R_8bGPCU{;UwC0ZO4hU188i{1XhjxXD6#4 zXw?U31%v5axU%w2S^?>M3(oX}VxqA2p=~u)3v4TwkNcY&a1YtB`nj|vy`7wHarXAS zzgsu=%0L%Cm*BdIl;a3z7wx$tE%oAK__J|29h&Mop7F`8n$bMG%sw9RX|bi|@$%;5 z?sIjWpPB#dl4FXN`SFc z=j#WfLs=~AGgv5fCw1bG-sLt|v_Sw~=gS7{et=)Q>WN(EBJgH!S>1Z^Y<;P=8jFZi z`|V=p%-?R*vD2hThC8nMD_X6n$iN1h<^egHO+CH4wcEddQ|a79Z_$fO;{j7|o-NB) zE;;3myeP1-Fc9l+8wXBZ|j$}G(BE^Jy;}O~JlMIoN0CLSv<1-5@Gkh2Vs>y(NmPj8IRLOQC%>B9@}+F2_?xnvV+3 zdwtAJJDmfago{E-H^!4BGJ*h_K%I5Q4%7GPEA{LDPQ%m3)0fvfJlRi5I;^l{nVXa@ z_O$JTc{2h&%i?^qPwrE@Wukf;Yf6)|(lg&=VF@gt)~Rh|lN8~MgwN6_f=<0ZH#3QS zBa)u?|0fGW)QM|AU1-13R0%DJG4!BwyLO*(BKwpi!F%Hp{H9++$L5%QDbJ8?cbSR> zP~HWxE~Xy@(M;lmacLk)wzhGONUg_$_aATDB%>3}QO{}_FYtZysn`BSxjsIpUDM>S z{{MhrYa!q%FlSBlae|T?e{?-FyYr5@g4s~v#Nw-7m+K896u ze8n^D&p5kYlYGO!nsdFJ)5kWk1$;>9%E4E9|oCJ#EPwsRSS%HV^(KT!G$T@ez!g>X$uup6KXg-qUf zcktgA00N$KP06@c`sNJwL)j@Js}Ccxr&<}!Pxd!&Ap>(?{_CCdLLn%gmX|jtc?FG@ zY}U+4YuD)V#gal=YCA+S6ZI?YP|{S?TOxt&X9BLPNz=n_?tOT z%3_B0g0GUVJ_MAG*bVs@I!(q_t-MaH;r!0D|5%6#{!Y$l+7BooCU6#1*GxO zjB@Wcyl9M*y81I1K|_X-YG8FcJWbMkWcB%ZF5`Pr`q3(St{r!QX56nJ$*~%sW@^8_ zU3qC!zdcg?4IYN`Zse<`@gjFvX7?`LJEt5jb(?j^J40&KeRVLl(0%1?UfLf68She- zx(O|Oi899Bg>3}YS+2nnTSkf}Smm`cf8XotsG-BCHI*5?;lZ%8w*od$WilHH&x;}J zxiFA;lk(2FHD{G|Q{#7(Mi^+TOh6@+VUF%O7xl1zd~GF$H6XB(Mys~{wlVMB!BqikJzA_zh2B0lVX3fiydBDy`Nvf2A~v_zLeeu1 zufF9{x?z_|(;Sh=_AGO-bEqc|Xs1UPoc+SIue>cclQk;}+`~ZyMvX-)-z%LTv>GBV zk*BK5kXEz}9X*K5zZt{t=U)`pk*GEs|_IKM@p1RBQwI1uTl>iuN zQDxsDCH%*~u-;1jdg{W|nbdmo)om3g6u77B1kUfMpvM?vm(1 z%j?rxg@pSHDG35=)IZ0rw)4yTzsu}5if7%ur&A={A*he68|J>Ewlr?~Mp{gq|NE%b zY3O}e(5ihfOL%sz0b;E1RJ=gjV*IdUNFRj;Znsurslfm8_siug?zGc~py{kJm|%rD z3UK>E^}@fIqve0lt(2GUK+Zcp01+H{qfOu3jlBmhyOGo=!cL5s%dFPNcF6Bzb2ThU z)HVG=26RreDA{p1ETjSoZu(+3J8_axfPWn32wE;4|#s@;jNk>IVP@`LiuW^8@}N}>9a8!&6mDe)ODh0YN%vTCeh$Q z(eo~+DVO(Vg9X9yTYm)b5BE0U`dZBv(7k)m|AQs|yghF4*VytGq(n_aR$q{Eco-em z{RUin5=^oAY6`tZNP&OTwfEO;OX#pBM#__A7qMCjrsa(K97yUM`m*04p>;bAAk}z_ zY0W)C8-|hpBDT6OguPa!(?91Q1WY=E`|{XRsU?RmaF=0OuzBF!hnL<6Qx`vbjPuQ` z#%W!Ty<4Z?nQv#Ky=2Ev%2K(U&7q;sa3govU{Ejmd-*p5~6 zTvMqlw0`<{OoL+eQdDo<#^sA3e3=UsZOtH>rdb6%f9O|gMq%7nJ-qY8JV%^gqztac zEn#F5%&qj*#oX___C{Hzf&V>@4`pVp-~-6gAgMPMJ6^wAd&B0#3-4gAj7i}iV_sQB|yq8YGS;x z`*Lg!GN2c{2VsY=dTwh1xSy@kmC|(Zfq&tzR3Z;}&0^rG>)3O5*X0!F=l93^we^;# zJFYTkkP(#|e$I?Z1A)si1Z~Mg=v-cYfr6n_QhN5;aF{z`CP`l3Mx*9J2MmF&u^-Fu zPcfJJvVS4tZ~5}CoIm{sxCc&g0@L^hF?owPkjs1t^uF1|G*TAQP>jp8oFB4`OPxWaA5K>)fu~k`G?n)WZFW`f z>4!^Gx~K;S4KyeUCI|!I8uP*G3#gT6j&$eDmDZ;i>dtv;_w%R^6Ly^JWnziZ1Z-}2 zwAKx;m2h)8Sj{SAOJ?F5?iLxINcf@lDyO|F6=9Z)-^p9+H+;nr8kg6_h*ks2c~0@R3rS;_MAQyNaS5O)hl`4x$pV=F1gD zM?~>q(8i{;#R9juA$w@U`3pVf)+#`|yq-FT6Par;4L<^+Uq#S~+|Gh4*TnZkI~J|! zlw-z4`>Ii*MNiOq*#8zjgBKceBIwAo?m{-Bg<{F6p4K_RrwV&QTVUyOLhJ0Ye)*pG z_^3gpV)&y&w;NV8rfzKPXbw0x(+|{IxV&+KpqP*&{MZ)+JkU)fuP~jQA9@1PipQ zH3Sjx&!uzv4I(2}h{2WcLO5F;V;eF03!51jMRui;1UkH9&Nofk%iGA5tJJ0(KG5Ax zVi~Y&h?W$JZE&g%nSRVvY{(ZzmucdO!l2JTdpC|dDXNM2Le(d zNhdb`R$H^Ysmr3SuCGcE6OF@CbLWYuRS+Ap=)h1J_Ed9LuL~F8l%}j<<{WdV4uv=y z4|+daUmS`%!9_jOI+0BL57qqYt^ZntHp}x6 ztHG9TYyW3|;$KTko?`aT>dRpvD(H;r{jTS%dq4j^1%tfWV@IL~eIBvt&gv}StrmKN z_mcn61r&#Bdc5CV|GbYb3Lc;TyuUY)pV9{omwCUu_>0mz zHU;aKBckrNYfo9aV(qRNdwTP2=3=pL>eKvzba!sY+)!YL%xWZK^Ilfyp@0K5x8{P`y&0*^Y;xv#2q&EKLnD*M$I3RJ4 ze9vglilO*B)hTso!&p_@Afiz)?Zj|jp}2Q0Pj`9Leq1$)GsfHD=c=LPxbTe`&sni> z;bMUNCQ0u|%ouMh?g?i_CS6<*H`dWq`DKw{5z}a;dj*S{c|xXHTW}z1Q*0Q<$%@;H zDkO1RNCAzaR&16nPA23i?b%n1WY#uuAN|=FJx&z2MR-LLeD^(jPGTIqx>lW2XaEE@ zxxVNYF$>?2#iTYbYkzLgpZ=I+BPVc9EY-+@f&^e~ba!%hf~0FiD!%($tEG??Bx*P5 z_*D!nodN%Xur3xiwCGlna)zmsn0E>a^6_r@yL)U0#ov?(s{OM@+41wt+|aUx{A?Fa zr_|f~*=CbQ(Ks>iyFDqj88F!H0*g}FwR!cVPnzJ-Vqovx^`-^ygh2DG#$y5%Cfg8tq9 zel8Aez^}bwZ;ywaCKUZ7C?^9!-h_o^IlA7^ep$cTJlDl^x~S_=vI|?}0g>AI)qu;X z(va&|i>UgwJ{0`i;JA50r$BBy3_5v!-o?6!HmBpvpLKoiLB1SaU-CP&R`0xZz#+|Ki*+gJyPC_P=P zD#cOLFYi?&of^8gdPrwV$sw~Z2mr@xHri<@n1uK-Sz0gsppE*W@Z1^Uh$Ny7`_Q zVeUkZ6Vg1jVj`B+zmfS04kWsCo&A5kh4}SiZ5?XU)w@52(3jA)N1U=N~%6k1HXkYCLp?L&%laAMf;67C5q69ubbSw&b2+;Q>h`oy!m{IRcyM1U_0=dmeQ5Vd!+Kyy}l$n8qjV1a@MB^kBg-@N13W`WXq?vmca?Ytx>iS)8x zpAD6!zcGx(j3H$-Q7%@+N-F*evgER-xOw=!9)IRNGb+e4PGO~rzvhjyb4xX}x0S)8 z4#I8+sQH2#uaNJp)m{^uNaqQTZQJY)#Lq$>3Yz7l#l_OC6#TjPM(x|AhMR|As)b-V z?xp0BFgQe-g;2>(Dy59}sE1TT+VsI~4{GIgKF=3(DG2XTyfKF>6AO)y32HL8GL;EY zs_?7r_)p8tVu4o(>bvK{ih{C<;MkB5hhJbp@L2&Acm*^zUwP0GMq`iSi8FVP55|*U z?&P7avpSM54Jb1Z%Wr_CK-4INTAosuXY&q{wV-{QK`c!MR*RIHI^#b+7E zB(}zWtM6W0FHT^LGztPL5c@0FY70oKlFx=c+FCZ#Kc64De-og26lA^lQYec#p zq?Xd`f!+;N5WScin>3GV)?IcFf<1q<+r7P!Ft&8IBVh{ffrbjQ$@|I6;ptvqY;wp_ z$WG|hfHvFD%ecW3ipqhe%T2}kqQ8hp2t^EX zZa>H_%n-BzFMe;!F`VG|An<$EbwjkA=6Q%QT$n%{y(ehvI{sp?zMeB_e=GQJKqU_7 zXxnqg_R}LZ5boPlNkZXRM?`@Jw(bCp(osUvV5xxJVf6@ljG6Z; zaJcb<>z3SK3xj^Nx!5UhDPfpslhD|O$YcakD zUVS@~zB6v3`GV?ioA)VN_G)GFUeMOQ-1XprVc%LYFiv+?37g;cma*}Rvt|6eyX6xB zcpJ^PM%#10hK5VQc4$lDQn!+&?`sSWeEWXD->nt+wpqZ5kgGYo@wk2Y*v#>tlg+d3 ze|&7_B?o5DWU-|IiGT5-*_U3x%AmD1MbP7@e#ZoXavrE#ZWp)ECvXM0V1j3r^oSSD zAW0qg)LDB>e$Zt~*MIBb@wxk4z*p$yR68hSCP8C?7|WR3dGJ;)?it6(8fv*4NpgsH z7`cja{3h3*W;iNB?>(+SnY5R;gO@=_{C@)N0ntS9Q@bBGJ9{Sw9^i3t(~OAE2K}oA z-cMhe%bt#4*9r#L2KYuWar=GYtT>Hgsw09m)x|^8uD74mM>vs%OoaZrIxzP{FPFY7 z@>0ZtlMmZ>a9GEK8K$b}JZRmzAE5?Fs`h)1uix3f_FwwLWEbJ2F7v}psl>p*SN|2@ zcDywm*WV02=*;HM_ zBvqr3AzE+mtm=_r%YJ$}b=zB!LKo{G zDo9r^!8$!y)fB~DjhRDg-T`pL7o*Gp>G-5w+s23FN6-SO(r0R!GDPtO}{k_88%vA#;$n~`}IO}c??lkq{8!&Sfw-Wh--bCCX~N{fDl`#na8pVwrWF*&iVSpK;*9Kv9RhI)_5MBF`r5AyoLFcQ&j_mkIF&2q2M$F$sc z0zmflP8og{_?LC<`6bVGFR!IVRtI!O6~FrhvWnBdgRA0Df=6(0RLPaa#1DB#k2dIc zC31B&j)Lr?+Q4EqB3ot}zV9N_){NqmObFVm2x3B*$C5_*d4k-1=jCW|4={&%d?ZM)YCWy(A?t=e*#(^*8n|?i#WbEu%t^^};_iN^%={l8q*z@FgJUGdq);$hA1*(v?XmGB7MRVx4EYd^+pi4A z7wyWLErmKzbnrWTJhB+!*xq2V6IO@?Or6$f%?89B=mwN+OAsV*AY=jTLQgjwoPE?C zXVTSfyMhNXD$>TpWVeZ^{-oxF?VC=6Z(vAqbpjYRQ@^5AP``u2H}^F11`x||;N|z0 z*$Qz8dZ2m#ut|?>!x)Jm?y3R|P>b|N*yZ|XZFgrXmw9e(>{Vk9^O+6^f5n^1GQmrb z3;f6NN|XV*LWS&FnS0RxQ}$1O2*8zW1U~PWZAYRQ{pS;bK|PR+#4RO{VZ}8z|Fs-3 zRG-M^jYF2*WD$<9iW`uTf>;J4)OIW}ihPg*ubV(eJB1gc7ihHyz0o!3qM>4d%s2E3 zV)!#Mf8lpTtXj+|f=q2Iba%*V$mGDU{WlT30NDZpikN!`>TxL=H(fig9B$gVtP>gQ zH_sd2DK9at@AUTTt*z!*0OED`xB_!(*LgA3!eDxFWwp28)_|=qF0VlI{1e|+C#I}0 zs!`N0n7KHPDR+M&co5Xi6RY7i)fHddXb4A~Ur?;UZN-UK2{DJ$C~bu+;hQ|SzR;tU zh1Zho7$gb0v7+7=dMwd9!=go`NIp9x7_B-eO3d}i8-Eufjr?$C5<~3G8i)m@L)RPx z)F>lVRlvPb?moYR1tfROBt;~IBxh-91BQA2)+WGx;f0cXCjtlm3RX1oi@O>V5WZVU z2xExX9Px;dlw_bd38&B>reVtF;(lY;3nGON-75dtZ;g46%$;D3%G!p5;T^U#!sC|d zph=yf@R*pj{mi~A_U~Y|Fh<$_N6HUzGTrF4lrZv(AmRdenEmQOllp(~ItCbWA z`_5Xk>@j8Jy_Dq@DX9shne&>n!t02<{iTJJl8M48ZcW1i4r0$C2RqWTx5KN^tWN|F zQJ$Z&S6y2JjAK8mYdzu0-aeREk`FEd!*~w7l;Q5U5N-e`m1yvh;b)RhNJKfzjGNuNAa0u^yeICE>n@s1(!C^Y`JH8Ct3Byf zpzg0g`0S8U^b?~LmZ4G#Ly&5*2K=4Lc&Ii@;vjw0vSb>INi5iMi&wtGMxB{c(iCCD zYDac!TojTSI}H@|tong{s(psTe`?5_c)6k|2%jIutO<4sgdQh$Q~kOYY!k;_0ajm5 za9#JDZ~+S-YP?|bUw4>K#Wp00x@u1FBV8pquYQ`|>);ig>%Eox zj~ifb%Jco`q{Ju@ZV-%`Lb^*!)21}9j#`$BbZ^paeU}a~y{@i{+;c!%yW>U8$Ck$b zDgJEgM_=%DfvaVYlWDdfw>EdjU!~U&l1rnpBp;N8+@cLseyu#0+DIc&V0l_t8pKo( zoKLnvl#-CV@5Lrm@UzoM`OGXOnmx+b$~DKzeIlHO{vIks=4d})mRshhmEQd$2bX-2 z1mT~y%8%Q4N}@gy5=7`?lv(P6Q+)0}k6b}&sf)LxKW>7JdyUJVK7aY$4e(Y}1Gi3F zUFCM8rDMNox>)MCP+cGHm>c*`%VJ==X$p7{2;d0>n?PEqh0WDWgRl}r0HbN@Y%g`3 z_`u!W#hl=!$ik%1F<}(BQkl?QQkhHgJ;q2%)DOMj5M}+9dHlZszCc00!b>b8|LV^b z!yx|&sNMV%E0B4{51{fKZzd%V5-=|jpBSjdhhrM^e>SAbg&(!zs4KD5ayT(5l$!HL zDOprXKXv6aq(%(QxGkkTS4>d`9=zPJd8TvOZBuqD4@A7qnt8C^XSs#mKQ`O#Ma9&T zCr>>~H7qDM&r9FP`Ko-4UtPI{-a-F}C&w`rG@P>Y@-GTN)$ToY=wG;m!3}v{{!9W^ zaJ7r|?JMqHf=NC|LLsIDCX#rZUwJAy;Il4EvQ)-HZ5H}Zw%&w<+?%ZZxs_Y!p{2DUbNJdTj=2(@`8Noh`f6pl54^ONiplMQ_z^ASTPq(&9NVGAABa_ zR2i~erv5-1NKQ5fvW`6E>O!t1v~h#s_Uu3!>Kq-|fl<$KKx%q(4!;Qo^HrgG^cJB#R^MhzP zEmg$*y*zeYJ)c_KsaB}DuU-ML>`vwWAqmL*3A`S_9NlB*H55KS7^b zigRddRi*UvHI(Ji-vD*OeQMpspUR{zi7fZ?kPeXwtyu8mifBAyLP>^%B{U9Y50i$_({U(G&ExV^XS4Oo0ySnFw_8AjsI~mR z&G{g$xjR3$KSD%5;u(dItVyZ~t@aHl)Q3?j5(z5>MqfJ}ewJlPiOK}%pLLs>1@f=w zQ6=bVoKKqY+%lSw@;|!C_p}O7o&UXe5%I3FWX>3)vnfPiG6?mM;(U^#txXm+rid?z zH~pK5=&x*ZRGKPGH+9J{yD{?JT0^_%dFV$<&>twteAw>~`%4|E)&GymP!GY(ZCne_UHWT`ni{-ff@zOBU5gvZf!nFR|mB%3}EfM(nqXGo9H-= zt~`=coyQRT^DMW}+gd{P7f-#OhJ~-FztFqr31!)xDuu)u7Aku%Bw~oy(@3(=iqDAl zxtN(<{m)j?d?{r~pbBqD{WO^3NO=oKHakTEB=-r0?9;D`j26n0ER~&;Z<3bELVrpG z3&uJ$1kuJ67-0mx)IdjxC=r4tycY6LeZ`rE$T@g4PUL3Ca9omOP=cv8(D*Fug_bm? z5YuJUCB@Xw-|u9;vMl;*J2Em+RdoyJFFEo5MFJ9fG=`FvYNlazW~r7tW9MFg0Vh6O znxp1S5=mjs0>h*h1AbF z#c{9D@JoEBJx_?Q9nVZUPBv7V1k{j+?$-|3y8_iBTnER+oqEbg6uf|^ zK14CUWHxEwl2rHL7=2QZg)Mi3GOtPhXI!UP8VMqi|0nw~{E|1!$bER_PPl!EI0scu0Bm_0Xjx-<5s5BPC5uKB7@{*&lK+S%!_Vg` zHj6Rk>pO|rU*tgjb#zGH9g^s|oM;88c%iSv{mG!2Xkq;&ms{viUY>xmi$;hrY1f%aeGl<5!7;P^w1pUZeG zjzyive=f##e(3Pcx5ZG%eWC9#6~^KZICue%emZ#ZSh?%eT!B~?jU{FX0yjLR9BnZz zCPWPsO~?6-8oiyl??Z@qwKOTuAS3(B6qQ}fFs4I4$hwEbdvpFqKK$k2=!O2%nxp#Z z#r&7=PW8`M5e-j=tS@(B-HxeGy5%@~K~S?{(HuI<&495y^Jv`lkrVZa?o|3aw>p$) z@(4XJ^xbG)O?zO2_|@Ylj`1td?Pgn0XNM4_d?UENIkhdWmvb{@N-!LkCslM6 zLyFpToF9#|h@Ft)N#=s6XQlieB&&W&RV+U08=ajtvM>$q6+EHqogvhho7ODs-j(&0 zf|gT+meC&e(fO5yd0v>7Nte;Yy|D&U{d@};)F&PbSc3Q8)u8Q})waU^EY9%dI5)ma zZn)FST%q$=g{aNQQTqw-kmgnS_% zWQ}ye`2FAxG`VDugCV|;iA8j(kIdIe=N!p5m~FSC8JjWkM2^m)qi;7d8+~=vAIH=) zzSD*f#N~lsQ@bn2?n=98(Fws)%U<*ecS@ifWe&EgMI`1^ga&3q@f^Ix-E@+W+d5pp3&Iz zYHOI^0F%C&gI6&vI_nY+MXvN9Wj?J8b*`+Ej`IRXBH=QvqJb4AvAE3hESb<+3cnLx zPAe?9OZ&F?=ViZ%AJJFYrS7~xf6;+rYNjmLeD@RtI`LHYX~I6r9eDDx&`yx20>LXwfRM){5+G%w?;`3Y zS|3j=TRf#38u4qzqZ`HvJ@}6=z^QPIAcr|})hj6+L5NKPDoHQ!hzlT12r*dRWcR7E-`E z&U1w`N+&6ggD2)Ibq-1{!mby37)x>X|qzK%G$6L&v^Aa zUvL90d04qglrKti#6yXya$*+L?Ni7N ztb}6u7i2~Q2)Qf@yKjYH&m*&)WwaWVJ2AaxJk2){3sJz)ZQ<#PbQ<;HKJU)6MNDTG z1~_-#B%jUNPhZsX#I3cf&DflAL%9;RxT_?ER74Q{!abcW_0c62S@@U&tQi6>JyOJXl&51nr_i|&wyzVV2*LJG2kjIzrV57dC9Q!@&*x#svjJ1mO z5Gqj$dE&|);q;b6w%$w^RFL8XhAL+ZkELs9_wKP@rf@+UP( zTdN@}6+#$!yx@LGoof2wh($DDVTmcIOT3P3oXHZ6OyRkCuQ?QTvxr%kYZz-g+xL(< zCah+ebI-+~%_e5LCgIow+VC@Cqg+ulDOUAb4#s7c(<$^kHJ~T<-gLH_*&UdU4Vq0g zXRA?qRoAeJW0X5r9zacJ8_zBS?F^2h6dF6>JWxn`?xitN@n1C6pwLexx8~%D$D)9Q zI-lWnS-(8Opc7V#=Dbh5XgEJL6L^`0nal%KR0OYiQs?K}Q_iL*U!Nu*N=2Yu~h_XjZ5Wu%@dG*31zh9vey%lNrk zpP%g?9>3f>+rK#4JKWzLjW0|)R-J>R7yG|o9Pgc-?VlX&HUd5n2@ym0+lE!?^yj^k z7Z=Z8y*@hI{my!RvVZ*Y;Q5|@)3M&{pI*E^dATcTdbicWTO%plbpNs0Zd=uq;`aO; z8tad|G!DQO;BsjB^tu(MQXIX3jlaE@&0NT}|M2f{1J+gJj~npKE;KgV?FPJg^H1!Sf`4HG}C(S6@gD|f;B7i#4i-Hmk%z#C7j z8fH;todU2oK77!po=$VDZ_2FH_$DX*tE01%gMYm~J2?8Okow*vi_7oWc&uIJ#_&ff zDLfB_qw+*cg6-358t@2}aHy0vhd|6dDlp|TM&s;)Im!nt8K#$bikr0lLmG@+rQvEZ zAyO(@Pq&=fB>i)@a~bf9dfW3*R8c?T60P0yM^|h zV&c=hx0{}U%$)yt`zuOMNgb*IezCDZ+^B(yvj#XdERG(5s6xB`3n*R z?iC%oNYUJguvm`KC3$U^h`h=AS><<5_lF@)*)ZhZTE^x|*JStBxY~G?`_g-B-?ZqQ z53Xz^LHEq&fb&5>vGIJfxHKHFkUDsiYJDPqHpS4XyJ4*zuT@WtQ*&+Vo6?A9s3Y!= z6BzOvH{q`CM&I2DXQEEx-g{03b(0}=Gv$bt4DN39a>OMoDqL(&o!RElaw>V)=4KrA zjaEzD;I`Jx&84dzIMqyKcOXGg8U(6gSEns=P1>^7no>)+1iwj!B$2QbiZUv_l#?Y# zns0hWG3x37;4B=pbPFx#{H>kF`ff|}_Il*%mh^d6Ol*C()@3`cY)7|!#li(7s#!F| zA`P-(=lrT_-Li}rqP}f8CZo-Lh)Sv{*=9)rw(xe(&#eA`(Xp`Ezs!VV6t*O;<|#B(1`VfTbaQ`) zwP`q~yRtWJW_*v`s1{}0Ud*q)yGNG5wCJ3F3`VBq6q6m$+GGcJBS&@znj%fe1#mCg z3l!!v6~-k^h^r$@sD54BzV5E_kRFQM+ex5h!Ad7i9tzQX$+d>ZpsY%QGf-pI>G&N?GE1d=#a~L+Qq>VK_S0;k|Dpef@q1mOzWd=C-%u znREx>o2Kv)eJ9zE%)+gNS4$&olwJl*4Am5LJ^hD^ojCbzX3nSN`mN~*Qd|vv0kHMm z_S242xes1+ZM8InE1Tc5nsu$YfxVy2lU{gSiG5|kqszp_T%k_XMiU;uZU z-1W#Ek$3KhM6NP3z_X(K)S2Wuzo_ms;_5%GHLF3F_w}8G?Lxi`W=ix)PCctQ#ntYM&R_l{Gn4M+ithZ|8|~jJ^f2(duM0+S!ZWwr}LNgW@l@A z=P%IyI8!c`R3s$+OZ(1!l_&Rw6zy8p#d~&#gQ6q?PJ`u~sykwlfu-DY&neO?IEQ+u#}vBdkBtO+E(K z)#m+8n;7T;IgaLcy3SvX-JlLqpzQ|r2G-+oZTqXztNIVn>aEfW-s!n$&v|=`5qI+b zCs=h)9!JSIF(N|T@Yvr~VKYXwTp<-S4#|k_>NXebTFvM)u=ibX*y`=w&EXeZC~K)} ztw`?*hH|TD`g_4Hd>&pT9*OA%n!@ZNIy&;dT`MoRLYDy-!f~QB9#Dg5J`KQi@sWj1 zbDUy}(Ep54T#&}hqW@c+oihFJ?5ybjgOoLGM5J+wddYbrl9)tIBT8himUQcx`*U>k zGCw9ZP|vZii1lYt7NP&vQM*tdGx`6`PMQ9Klhhj65b!CudEir_!=g0r{HaQQ%Oagflt*%G<7X?ZUtX@}%rSD;04IL!6Z` zS-y6rdC%7=UuM>lXThvWmO^E!OKN^>%;}Lj>FoK`2=#@PMd*LMhHZ8qGw6T2-PtbD z|Lv`3TPyni5JjXBjWxc1>ancK!X_}|&t++5-RLzLqE-|`oL zx}AHt0W?>AF%`-IzT6O|PpP#C+3jq0mgq^{vV4r&mCwH{g#Sxk0L|3@J$+Wa|L?5u z{~^kniN!wY0%%KzB(1yrDTGjT&WraiHFrK=#3fEqRabMD^VMD081ydR*p$}uK8?FR z^|oIXT^6GMvC8Ffq0i!`7|zwlEdKB5_Ew4hZ|yu=(fhE zmMx0;yRor)g1@%67*5P;i;#=3sjfFJS@JDWfJ9V6zb zyAE&2p&_g7pPs_ODV)4MIyyM|Nks!Im0V--V7@m_hdIQzO(DR_3Gsh1fa^s{v>6 ze_LBs`oHsRMgJe7l=Odfn!RFRrMVS+|0t;4GP{1;s(+R)PIn=n*?PA>jdJb*$};%B zs2Xq<|F>DW|J&Stw!;4hDQi&7KzA24AP?*E+3Dmu+Q`Ay4Ic4?n&gR0l(OgLiF`0f zG$zxNbU=kA4}D-F+(_&^D~_y_r#1ZZDj!R*{zxJAiq4u7!}|H$6DHW4?6}lO?zP!k zk?c=UmZATP+5yhu|Em6j9#BJPMkGv05R9Gk6Gh|TB__!~Cdm+v za~fyT)ndAvoEY^CV*nVUP4?y#7gcjE@JLV!=jMc0>5^1hM#e+&xGYuwXomg6t{Qju zJ_K#6-S6jZcJgdX&0943s~71p70CR7Yl|{{DMqgR*_7M6dG#H}SaNJssvS}tUYK}n z-)*&>DTp(Fdr=w$E%}XeuFro3Qk8(uI{)k2oX#^iIVyZKpqn1nUhX`&4rHnGzn<5b z*vCxyf4hAC?>yUD+5bF9S;_xjfc&2$+P!N4?tuSuD*zYA|E*{3)&0+dlokH3@P8)$ zn|SL>I)Kf>|E#=F0#7LCS3XUlweCW%=aL}OZdONv(o=P zNLhnJxwyZ4cY0SHplRnbu=zMq0R=}iOoURj<=M5(FyWl|J`d6BDx?&(JeO2w75BT2 z3q3y+J^8OBHu#4=T6=$9%MuNbd#XsWWkS39uPi7>e=M*o+K z05y~Tcgpr3n_D~EEBgNsMah3Jn83S@C}!6zpaT>DS%N9QRmyw36hR8BQb8PqEXm%Y z&Auj_&?kYQN=y<-%sdtJC>59%U;e2CDtAPpND}0mAq}CXQD6dmH7>t7UnnHZu%bfb z5lQbaMk5kgBU*{MpS754$c+0D?Oj%-SmvbvCS}}G3V>Pi|4zFS|FymH|9F^ke6s)J z!S6+RUoW=fC_k-*0=ZcE8|2rLI>Y)S)yred|C|Z@+D&lj_SN^L9yDWX`cN6+m+wP; zU+P0WG<|&P6}($n5dW7_08GdK&X#2MO7j0o|NlTm%Ks*;$WJNrsWN-95>ul99aFTV zNp3h?V}^2*^jBH@t0uyM`dBh~QbJELlVwp_{h00$9g0*_XgxIMX`D}6 zGTMnX3-vt=cry!fN&>+h0s&7zFp2yz5Fy8n(NFcb1q37wB||(YF9Sj&&Ok_)=}YtdEJ!lB^+>^%iwTYip&Yb)18~)e9~ZfvhX0EVd#p1e06UPpMh+5|j}n z#0iQUN5dg&pa}=q=rxVUz$CB}65=N8vsffbN2LHOTT4{nAFvYp7emF$C6w6Y@ljv4 zCC8X4ilUfH-WdVePlI6Wq@hn^DW>>vgS$w;kVFxcJG-g(rTI#3FSAUg-7jc@0tFtB zPXLc%*`_|tbmCO*kg$RoYWEI_fJ;h4ts11hj#gBM!WsH2TyMe=Hjl$YpkGQPiUQ(E zoC(pYPW~eS2w9FcANoWLG2#(-e8f2>1pXdU;DK+UZb5m8{h%7r46vwwQ>sOq2G|5I zrU4~_swL1BH5CI(R|UFW5iM1E4@nlrTHtj`edGLPeH^9HJ*ur#j3=z{SARxg>SQT9 zeFLdcL=xQO5}7Y)pT`t1ZeEpoC{1YXP9YFeSBygs=S)Bc`T-q-PfkQKM!c^^gyDp7 z!yuuHRksYcW&uC6{0?GBVqZ4F^As_X_Vsy;m^%(V>O1`)6+;Nvl|qq_$5Qef!wqVM zHAO_YCPNx$gEY~I;FKapW7bytjmU_JI<0W9q3qiL=37Ot^*Uj4eZBHbXiY8?PEWhB zS!o(e43qt<2RB3J4M8VX74|lCd?u2ZU8V>O-Y*@JDya^fUlPGQ2$)AhfwT|~^Zmg= zrF6t8_i)TTgsb}dj0}3&j^p}Fj$`U2#^X~>Q+`qC-MN->KH`|#f#9XFB+bEC?Qnzs z2)E}vyr!|_$TaBpT*T z54fZ^F%Jg{*Yu9Oqz>-LgzE!@=35#@FbyC^BYp{%0fonnTZJ`cRU6s!QSPm zLoRuoAXEzkKX$6|gbcpQ9m2wtg#$~GU$2ud1XD3;`RoQll6gH5q_(*K5YgpPP|x%j z;0Byu=?LXcdClP5$Z~Ja-&kYB86q*rMquBVN|5wq z*e&O8QfLTu#LKP0LOdtT+DF_Mk7q)SBrP07?Jx^G5)&X239x)o1&14&-^?IAl$+Qi zf#M{b0$g+WH(^hRbj0)yL;%=F5m8p>yl=1Bqs_<84aKg^mQ_8m1Ur)tIyLt_s*;@= z6-HxMpHOb`@&~(fT@&Abx0A!=Hz^lO%2(tZCEj>^L={+o3(!9CamV&ABND{Yw*mQ!AwS@F1`kFit~cx-`C7 zaz_)+kmuxv^Fdrw{Fsmo5V8Q0iT4N|UuwPO8LsOf7Hr8DHkG}mh0XbJ zxS}+Y#7Hh;0-J@_q(G8zq_qJT6#htgoR03eGql>s+8dks-ZxRe8%|Dj4RFtwK@P3bA7-vGx(d@Xw;D&#mIiHfz4VmgJcV7^6J1^t(hM@|$~ zP$#L}YuUJGt;%hQBJaeOWXm6^cll?p74Izh z4NZ`!R??uJiv(9%H&J4mELj<47&&ao0E|pswJ>?Lra9%5g2k8I%UGLwhzb%o6XsAv z0tHx9EKEcJ-B3LWoY{h*F}sl`+9hfwqJSo}3449HyRK=>`s0jSr*cCm7Mls@hQ|mf zeEM)C)w{p5n(w z#5b23-vM6|Kn)||JzSj@t+=~RPnzCn`@Il&XNx7 zz|oD#DjCyCV*$z|cVS~WB9p`^ZG6V~_|RoR{LdN71^SqU|IeP4{l7N1w^#Nb4^j~S z*Wk>yA)u&s-m)~`O6*LdRzYD?u&Qv@P%$qBXbhYVH$xVP#HjbKC`D`ET&bZI8l^O| zpFiRCkqV%=7&CHF!LxLN=>CX0)*pnyGvOr_+NFcGi6$)LW?QY*O8t-kmHx;-Arb_M`d4YVut0i8W6PKC$XiA&MJ%?XC{ZKWSO) z{QoHazcumSH@7!;R_FgilvVtvFTgQ&sY{G|jQ>7LgM=-c{eO=5@11h~ug>P?D*oex zl%?|j*Eo&J9a5`3kS{dDG`|MnEk=k_V()he~_{UhlslM!hbkb>i764;!Y7o$!u$d&$Tr;Q+|n#V`hL(j&T~oxuj;m!h{-=KuPS-kx#)2@c$lc9zOL%SEaTrfd55S zX@Ndw;r~{r9RGK7yS+O9AEclJ;lM;mqTsr#l#C)FNh-RaWD_v=xA;Ikx#a%XC?s9j zKws01{C7jQdJ&QlZFDuku`7h>=#s`4ynlhxT%-H6{;ec2rpngFipDHn=E8p-(NGLo zKlwQE|F*05Kka8L`|k%SMg8x5>R(IETl8wfP*m!w!`N@B-?pCBHUlf=|6EWnY#EWw zXn#T7?Vre$Y(f102=V{govn7o{`1+&{_A1N8oY{Vcq$k7t_EOPL(?t5{*<;q_o{yV zNM=MimKW@ZKDHh<@3yRq&EAx}fwSk>=bwN`f5fsN{a;E3oW=h=ZI|W0t<9DH&%=~Y zBL7vyyREszyGg@ba#*^f26Ul;r&(j7j0zQ(pu&J_tLT%$ZQFGv?f)g@H&5`^@)Rq6 zQn__O{9noda2Eb=wkz`A)6UBN=RpeUe+Bi@m?h)qJWS}j1TE;&a8JAzH10x}27%*5 z+&`^W>kF+S#!5Ax&6h3YQ$yj;Tjs-mv25x`EHm}L+vWK0?We2zpNA=T)c+WJ9Mq_+ zv^Za0nH&F?w*H%~|LJU%^S`urR_Fi2lr?yDdZ*NnsG)Gqi&b8op1wJM13HrQm#FmN zLVOOYo&rJw7h-Z?G@svu0VjS5i;*;cd?k($W%bRc-r1`%PnnzkFMazzNBp;^W&5Aa z_Rh-w`$5V||1+=thYL}!^~sNl&s^72SLVk5fQ(Bb;%3Szw^n)KK{?pd8&5Hg1vz?Xw--DE;{6A|HKxT_L`!DxS z&kmlS?(dyE|M}wJaPKFqw-6oau0J|G+k5`Y#jpD(rw6Z&9^ZrKs2QMk@vMZOGKwT4 z5&ATs2?asDm?pv)I=NmQABmQ`Ir zPzqqDsI>D}1znIeVEs|e5 zkVEyYY)!vkhSV2aWHc<O! zJs&pCyCewHQTNRT+`^C&A6##<-FW<1j^N)pII#!G6;6Sv%fP*X7KtMHNp zPQs32FYk8R|G@f~5zm)^t#28>o!GEMFV(OiV;DQjkTDq0kjBibr(CYvkNL=z=lkx& zIW5^blE4`qSYTPaeGfP8^!68qjz#ND;{i)(OoCmDOqoB+RZ>A?iAiQGy6*>|rVFs( zi}8OSDgIyO{$KvP;{P6^tbw`JU*-}(C8|u5p+u8BwWmYUgd;X#ETICG>GK%QUY^1u zK`ESPhM|w|5~i;SKk^ue6_d}gQsiKwGWE3?6P%vDEDx)Yo|yOh%wr^wd~1!}>T^Xm z3UT}lf2CFU`e*Npx$!8U?DNDP5T79Uz{kGI$cSCV9JR0~mQPS4`!;)8L&_H=Dez8aAViAPE(@_uY8@Sh@^oS2{d;Kchu6(Ay@L-QHZ&Dc zw6UgcrtUX&Kd#+Ljj;QrK%#2Rl5u&pCM~61Fppi!WFTGO>D|(4eZLft5ieoa)S5OX zC*E+JJ_~RXvktZ@ON(t`E@@%S$5VbW!s>e()4MUT+7#Az-jAj;!1K0puUy%@o!&Fs zIl0?qZEdlv57;dGzpd?x{ol@t|9hBnU-mzGi`a%b z&6dj2pY5Nf7=mk3F&4~TSjZA%+9Ur4*Hzi2T^@Y-N*;rjQ61wr`^xO{B6F(<6L)zpq(Pn={(!^~KZVP0AN zPTe3kWw+G2ebseUj&+Il)bBd386@;$K7#XS&33cxk{}wAj^$?tJcM7qJB9B%&Cb)B zkG7lbn%Y0?%Iff_?soQjz^~+BoRB9N@t!2?5&@J9_4gnfcw9(pcA}EomTqz7_ahSe z8oC_%EEYLQlW)|$x*?eAPP_}}Z~u@ZX99@1aK@``75bhDP*Awm<$YupxQnOW?PESbfOd$paELb!UvX-v04r1teOC z{#VcQx%!x;|Lg3O?SHm*wpQ_f9;B>&gHquo3tKe2hD#!bjw5ISE=@T^ETVnF0>?=u zU3>Hx-a7yuN#OhM-ThZTI)8nAy7$w5*ZC{JdK=Dj?(Tb&aXTa<`okOf3d!*IMaxr7 zi+^~dTX0>;a5~OkUmc$vygE9?mM66;-vJzv5e42yBbuKj8)zygJkKUEr{N%kC4+oL$G}1q^A%hkYmpxp1ONW#KlN)pX;UK`$@*r)+!YO3 zKY`8SXA&mn8#TtMAAD=-27CaG*I`UOJ_y-=s1GC_r1DJa!iF69Mx%bLR1nYcc_<}? zK75m%i0(DK{R4hb7T6d%MzRj_18>M-l?Oz-o9KAX*z7D(V zkBo_y*?=yGw}OXoD?#MCF}ZPhnnbA-ljJyErA>v6rl9dPHQDobK-i>Xzeg;@@Ed8VKKpvxtvK zV_hRl!wj!@41#N@glQgJS5ipJY+~1lzh>!T$eFsj%4H$`Z^;+{v-E#E z&no`^&)O^b|3S*i|9@Wpf5XewUYHii-WL=HU>g2Emk*cn_%D{3_+R$_?>ybvUg`fI zq>zYdcCicB9fw3w_7ic!@u_04@zE<|0>5tD8p7a{hk zmvo^r4gc>D@}p3u<9}yoXR{Rlx$~^uUd4ZWkW#h(F2*^oHv(USvmpg3Z8A^0Y=t~D zSzHIQx=>2)BpyrQ+T&qJJ=Fi-3~2~&ISY-mmF^xJmGXS%=!LQiwWwR#mScs0i9|xl z#I=x{CK*x|qm4MO&xofXYF3%A{3;{vo3&v=g1Vmui0oKX(vFH-sWE`U_U)?98aDa6 zdrZ75(1wUbtM}5X)Ec$p6la>gufc-0@A!eX!#G5nyY{o49cQ@^OgeJY85v|!je2sN z2Ej28m^bc1r6SRW zkY1E_q0wo#+ask)9?=nx<={7eV)9AAMr_W?XkT)Y^=0Olx3HGAvAKgS$OmhAE1k{n z4w-sxkFxf&@<)!`(jJLFS^ptTZg_n4Gsh#Q-NgSj9Os$`>4-iL2pgScdAk6J=TRXJ z)zNYejT1`z-(r@~SD{B6s1hzLTY2H6B+g^px?Am^nB&Bk#FMX7umuzH9Sr-h=XnwZ zs~fQRUUMgnLL_>*_e!V~-Z% z?(6AmOvP5#V9)n6KXmmbORitDS)i|u$kT)*k~*L2@s(ox1CY|vs>ASCJw-`*W#<{` zl`nyGl%n|0)c|8X&5NEK@M1`#hUZ{G77}&xa%&D7k_uwhv-D zU_68y6e`fEz;I0>lB=&8CSJ^i(3OQl!i4Sh`|{WrpYezXd@%k+@}-R;Oom(}r~{Of z_?g5$j3^1URB@S43j4rG@h}*p0O1X(p9T`-$UVjsZxU(9)4@&=``~Z}KG$C%Ek|aetET85Bm1IFlqXyP$y2f-Z2o&%IjTs4oaZ~O! zQG!iGViE*2$g9h>5DAGB>H|qM|A^2{*oZ0__LB2NBr%DivLqXE|B!@afYd%?x{h@( znfzSOv9s_k^<=-7<4nR1Sa>C}tL9Wt{|Q{C2}&V>+{AK$<<>5WxN?LzV1Xl6)6hF@ zBqbN!K8k_1v?KSlh=@m<&Kex_5o74Ph{jAFB&w^3`wB!-)|VBcm|v31U<@}TM8O^9 zcMakm9tORpqfQ4cnZK0tGPJkoAnwTj9P>Eosz@Z6w}*bV)oweE9)CAK$rS6Le*8>{ zA5dW)CgX^9;kjC)gJa1gaG$E?kWna~Q|h`wR#3DGhXqg=iF%Vgl6`aH|BD19^kgr( zY5UoHhA1>Rk|D5{{91tYP^W z+yqcTOG7zvXGGq;&TDj`Gc&7DM_t`mS%vUPUBV)dMC6hM40Qy^hxjqqT%8MhFJEfz zS)KPMoF_lBfQqq5=qO`{u%ja$%Gbq*cJFKOGrxg=ORVRB*X|PdMXLe1{}Ud;ASRyV zj)JjMe-Gb<&Su*rO8RwlNZuWi=(%KFy0H0lv$MS|kP2}e^Gn?BeZqn?rf0*L ziXjjDE^MJ935_RS(146jsmDWK$U!?G*+Yh~ww{R;S^ZKQ`ra(7y5m?ReW_SC3gcXL zhp0l`XpzB{ly@W$h8KMvU#Lqwqmld>zj!{R-qmE?Q+!-+)GzRujcwa*(6F&>+esVS zPGcL5ZKJWx#7wYX1&?X?3B;x*Bk|) zFb_rX?Cu_ihaB_;je%=BBASgu#T@^G(|fX(6+Dia9k`uzI)yHadfY%IJWR4HftRGH zc;`pEeYye95H>$q@}9Zr676fV5suoUvh)P7FItm3xTuy+BO}FN_5jqy(tIWlz%OCzlP#}H=joyW_(8O1u zTZj@N73&_K`=1uVXlEsFq8ZfR0ao8&8=g^qbv-6w$jRo*660(*t0x6@^-1>@A8AQW zolPL4r;SDTJ7e&m>x5jXAe;;l;sFG@xRLV-_jXAUpj ze{xbj4>REBULL!Z_P2rOBbO-|-K}lN;W1gRHs+s6G2OHS$DNAQ9efSbqPvqB5tduGwoMJ5$=`pT=7%#W z5lJM3+b`+8k$PiNp61(7kE2-C5xQo&E1Ya)%fGS^rhi)Yw)vx}s#w^>3P zfU2dDT(H4|{ZXZygPb~mUdEo`J}=JN)=w4Vu6!GmjY6R(T@S7)+l%pTuI?dNyKNd`2w;oGyqWHCkJga)-&KNsZ9KA#|gJIi_kci(X9HY#E_vxSju zIDehp$b^g#EwcLkeY+b>YR&!hOzP{9{7me89<5z+bNi-U4K<}xm$)@^Sx8!3sqh8E zJg1-WCsj@}+%yup&z&1G$f9JaW!L(49%-0cN`efeRkB>vOSZ|4UcX>pOL}F+|bD!CLC1p z5e>jjaS=7m`xfl}!Ht52n@h_b(#8|_E34y1;(Eg!j!al+0R=n>8RDp8I+R6#Tb(Lq z?4xf;jkg*fn;J|R6T*)W4~8T{qM*`yEGUDen(y&96B;pixK_t<>ZECDSBpp4RL*WW zgpjCVowN9SJYlciM;-<1GlPTi0*r|G0U3}|eJDF3kJV=k-bkZcm^F>5bp zX%xq;N>CA}c&f*Sn?yO@26Z7go=)JTtbKKD<~s8UT^HgMJ}}N@AEv7wyI2WczU(KQ6HCchZwsRl?9%2!)$Ios>5~ zR&I-Lv2(yXF#@b)dNsDwOv52n_D0kX@bDsCL*2DwcX#VR`e}R>5}B~uJ}w&l=L8t8 z;#M$u2Qp0h{c|3_{ZU8Gbw`%+E&Ujjm-Yc7{~ZRhDw^>(8Qqm_`;-CnaOv!PP&wwi zP9F~Myo^>+)>m|YOaHrDWg``8v!5=ri0xN%h)ey$j?kmfXidGruPiD}ex9Bh4@ZqN zl=2*D={yGxZ#08`XuK<4Gk#;OIXRp91DtyqRHmrJjP$S{TJpt`?kb9U{+iY;`!ID#mIW-IdWs2A9k*5MTim_1-C) z)I_hh$DDZ$(q9ERf%|*!1JTsLnuNLEfD|YVe$B=5^RS--N9{7O;FV0^ zde({n#8*&v2NIJ*d|~S2QOu)sx0P}s-Bi75%4g%kqj-g&P2jH?_bTYGI6qPTA!%PS zpmL(#PROI6Kf0?J7E_bO6_{g5@>aeRUHt(5)gDDoAPt34hne5{SL)V54$id?AYmDX z1<=1_uNS$8MzLgC3DRazA$PX@#1o{;A7}x2Tu=%+Ktanr_;^y_y*Err)ls@NZ)^DJ=`*$10waT^44(UF!&(zm* z5Dl_FE^7K$IIBfax#iog_p<{I=u~XdS{wxW&AWDiuOj5{^P28Mi&q}9XiGsDqOLrE zvANQLhznZ)yUYkX*O$2>YbeN%SkS5W@b3_EB};*2)#SNwMwj2RyLLAAjg#zit@_jT z2Gr(R^#aP%{1}U5sJj$^g;MW(o@4ltwsnM?O3Q7alvQptpQb>b1Dn(In%(eNKk}YG z2h!0Qttxa=A_`kp)k_uAmxb1-N-=&Ub5 zW@QGCs)0F)b*xDvR?ceiSoJckxQIg4|2PS&ft5MAwd`=gyRP~xdgK)+WDfk3ZW53K z{cpi#SC$)5PI<>nmPZ~8NvuzE(u2&EypA^-Mq9%XJ`Oyo=A+rV+}FyS2o4(H`i#OH z7rdtg_cyG>QebHA zVv$EpNnvJRsQ+tWW)~gRQ5%2cG%@oUPQiM$n0qm2gqgv@!$W*6ry5uqzwTWe&ceP^ zZ~h^l7XB}=xU^StBuMwIV8-JW==rm}cM&8a^Sb_4pzt3ku^y8@@`T@v4TXg|8qSSB zg@BXBRs5%F*{xT*ZA-mCmsr+@Ob%yz60c%UkHK6xgOl#F{Uhl{AJo6?vcU9oJe3EA~%0&cJ>QB<=RiD5v! zFtenE2IB9@%~~^>hF+a!RPeTEmNM*Wb#!^nF$Iw`(hD14e|DLoVn&lVnpw=00(ZD9 zoZSw!Mh~?)eXy>Rqvk}o`oubTp?T2BUI{>JEokG%SJW)a8|W_9)jXQN+Rz$}^Fl&< z)dQ<-+M0&DBggaIw~qoFz`Hf4a#XU~E(gDI+9<6#>mB!Kzbus{$o?fd(H6c6HiGfe4Uv-WZ9v?^&Mlv#6Y67qG9v?&M%f!j7deX0}J=&D= zta6x&xEAz&F6aM92`&1xJ{yI56Go}pJiFFv`xTYYY}FhaH?4SP@;nkhs%kiobwM1o zf6*lGP7gr}R4MKA*m)tavDrtcu@ttnN6o^SU(uRz5E9B0OkD*d5h3V_;j|pqdeTYm zTJwP-hNWnNg$_ow=vE%13|!s}-UdN+Buqw;F@ZwAL-szuA5`+pUmce!s>|XeuGLIX znl!tmh}0w-Vo3#zK9(zQO9_;YYmt9m!CFjA8Jn0~sY`O}eEo_aCgj@#`sKrLqSw;r z29BxLGbsdw)I0*a>C42imC*tGWy_SR8a|K%RGrY?Tj8M%4{El zSpLRtj;F8#54Z`ll{RC+sm6qt9D5k4`E8!}jIB|h(3=m--+t?EXMe(yrUqDk#rc~x zawWUou4+2ctL?8D24F5f?ZJPurNLy*5d|{FkHM!$T@-I&Iq-9p9{Ie{7V7Q&QK6clDA&Wn%O?bKY z0L99H4DTXYLT!HtE-WNf<%$Q~?jOkieqHMg;; zsqA90W1ZrVvA+CEEDo2cV&YU)QE#;mb9-VCXMAO~@K0tpCOTA(5jnsDs|zv@{~`I@ zsHJ?!Kbgs`V{2;*m3dYTF3$A+absNJmg0}d)^xhH)}(!A+BOEX7(W zv3~!88b6=5ergwI_gc{@=X!6+F$55<1vlfveIvGp5rJNqqoP}r|>!-15Xd2ksq-E=6Xrge{>>|>G z%UiP8Mv%r_;4(9Iu`;Y|&Ln@KAg8fA+?q$;MBbx#^c>Sk>1d;qc5(>BJp$3bINbSd zt|9*j8%a$GBphw{dL8{?iYTD|=(4mitS0!=9)N__gCue^>q@5XnZgmds;i*JkB4!Y zk~_b$Y)z2noxyaEGA~!&8Emlc67ewMM7ph|LCjMw)X}1cg8JqiqCmTBOa1bL@c4DV z=1Y=~eMuvW(Bi~AIVb;Ym1`$c);x9Gp6iT^(L`t}jTe_Wr;gd8YLCrCa@0i;Z3vt{ z|3PL<6cgF>kDPLAUpi|%5pb;Ht|Zh-=>e2}Ut)Q`dZma$G6Lzhh!-A0DusZs#zhaJ z%UeMjk|M*%VQ7j=ht*XvxGC6|mxAZH0h|@FGeCbM>tEH%B*IqdfXb24H;_FNLvZ zL(B~M!(|+tTLp6F*ps}<^})OZ(1`WNjEbk0Pih(dEzM!Ohl7VZd!uIvFx%n{mwBG3Iwoc?v{FV(*X&9`>W~~&?J%m#JZ5`+( z?AjIe@>V%N5Q49Ce)Q1*Yt4WoRvmZr>Q#=j0p;Jz+k4=39;s0Oy08B;0A9!EUN6%q z`R&3$#Jf()xV@Gd$12*#xc{;WZH;@|+&_$Wd~nFB`xC}vQ=ie_S=2mkW%R8f5Q$bv z5bLhx)d?J$I`R(D?ZMhIF_0eWyynPsn3kuo`{fzjWhgBk9<6poF(>Gob2G|Xnv26g zDoXO*GLd+&!p^DG=KMs`!fO;Ad)dTT@ap65dT)(m-B`bU>U16em)gkPyg*7b13|N) zYZtQ*77kHkitwCMt2Jb%S4w1Zr+NfCiXVx0(Mf!= zQam_JWt;E?h17yTzolDW)5+2wU&X7mIec1LmP{nV`sq*GPN-rYqvbVbU8fNw#G z^u2-geXP}kHNiEfF9KLW#^qb$@kbW5aauaKQD>>Rt=UadmAY$UWy`tCe!NqNT@&75 zV1nFmy$(l?a7-4-T=tBPkZo0+H2NSX3B$!TCc zZ8O)A+P%8-LN7mplYru`*wVd9g_gj;L^$q@oCT+AJ`avV!2svcf560VJ@IIN5xXlv zhNg@rSCy0k)3ZVf?mr;HRW;Q&fbz||=KgW3&V$?7{{L(M^zY&06!=mzF@4upbWWAriBYHq+!BF(3HlAPljU*d z(Fvusc|9to3M==UtBXxpwaDn73>sHx(_K}nSG=4g7va*$={|3}LxvLwynD}D;DSTK zr51>ImFME-hIO)suP=>g*bg*Qw?!)rK2wb|Ke=o}D3oD|s&Fqk%Z}_; z?bf&%F=fj&nw9TjWJvKNJYdW%-;>5uB&fNez};`hJCdTd8jD4#@vL?lV&R%nOkbLp z%i%@-i$&SI)g)tHhU*M$H`?!Aed7b1b8vg-n@Vx3<|Wl`OKV$irC6Bq@eNr$3sc8O zZ!7w$5Xua^Efe`lPB8oG@MV6)>V_zjXn?{Z5PsrQY(+x;A&Em1cK;fp>AlBk{E-kA z0|Pq5^)_-J;b5X3ulc9^_rI3ayu9aCM&Ou4>W>dFD8MoohHZ2_9Deiuf}S$Ji(E_* zOwth^v^%fUm!w~&ikDhUaa>)7-xiT;%+nR*D_@!~9o_(?v^8O@B`wdWr`GA2GyYKg zSItac)`AJaftA~U4U`mX&lQ*MupuE!LIhyIpfd!qdhU0sqNJg7NL~nd0`Is>Dbi^K zE3Fk_;`~6I;{Fh!)^3>#>81b){p)X49|g_ifk*$~8AcfkHyluG(HC@DsFwzZPR{Hk z;rf8!BDnJNixKe+pEQup=jXId0Sb2ST^31=|u_C{q7xOF*>$XG;vg z4Skm!3?kxO-Q+uVM5cbEP?FfQ{nE2*O-dE~)97j+_NC6IX8n!t)H(atp&uyzl93Pk zt~0|04UT*G-??yZuaDCKrlBffkqkA#J4Jlu)qk|aV%TM&|6Z3!1+HQ zmuCQY9{5H?M9|Cq5eD^_(j55R4ovj=TdOsr>k@c?&{vE?59t#Ix;WSHn(C-N8 z#nu)i9KVOEP*Wr5eDwm@#9NBoZC~1;V;T3#&Fo&pCq9^sV=)pb9<$*E?*Ba{%%*4U z_ij1a=qD>d@Xe2O@&VY)%mwVdh}?YM=1AN7KSb8ObM=F12|`$dOVO1d59m>PA~ zO`$-+;>V?h#Cdahet2wr_I;^_=0oXhqFCcT!u>m_N)znj&NV_2zb<;?eKzI?qxQUL zLGV4~KU?BLcg@q%Uwc)1#Zc3bMY9pUS8{*F)=6{jT@us8{SMUp@^b0;ck<8IE}&r# z5;Onpk3~zhWD>eskLI0gTBmf+KEH#~>zy5b-0$L;=E-}MqJnnYfZV@d+db=!UQFO1 z#A2FgMqHCuz23NS5f9AS@u$C>NNB%wqW9I^09*~>*LTG7Q&YZTu{fUdJTji<7?60*JPkp z-WSjt(7W8E5PI3?ugQC@A{3~j#vqs(NtGwC#aCpe_cKGeE^WOpoCf9=1#mM{Jr-Ie9_D6Dg4SnTI-Edr zKR2G&{p#)J93&+vDYFAG`(uNP!(D9nO>|cp8AUOZk2gv_^V==akD6bVo@2M;B4m#6 zyKvuhhHpJXjOGD-6mt$vs1I|}pL_bZL=R9XjV2^d~0IKLwh7hRc&3? zKco=grkJ3bGN|peCm67%g=t$%JX&$oU`Q!;6Zw`xI6Q;01;jBEa>LJRw2%9Og3M{1 zvK)!CFGN1Y+~0j}!`=Bl>I;k#8A>`&NjRi_NoJiA3qjdO#;63T7nJs>_{$Q~QHqLc z)8(GPGc%EAC61mSn%+6i^I_AdAe;Gp^4PkrBZwiT1A_T9u#tgqo}P*tHHxV8QBOnU zM-nR)q;WU1Fi0yb1dE67CS}?$Q1>XGi@Ste1$wpM^c~Wze9tJ~VA@kRE8>Y?WFY(7 zwl4J@4j=WM#A3)+oj*OqvE{>g?xcSw3GybYc4gSaNo4!g0oo% zh#*Qa)b5RSvwmeB)QvZmxi|Pd!P1;Aea%fyw6cJ?C#Fg;Bc9`68mLO`$!a3lqu%na zVx*omnOJ^S3MQ_g(F%pL;I${KSn2JF5l@&mItqEI+~ju?U!hDYpL?FzF3(lQJmJsm zFHk&)+eS7yd23l3Ya#5$(kB)b&fai@lrqMk;hgYv10{A!O_-_NYK%Aul`sGU*IG71pOarR2;DNy4}L4OyFs04I67)cNL6AWP3>DL z_bl}k1U>{I55KTfa|U8*vld`L(h@^e<{U9yea{yd4g+~>F;3(&nc6e>%CMj=6tSdV z)Gg)Dvxm3`9Ze;*BGX$bptF*l4>-_(IXcx*@~*@sdL~O0P=M(*=R*8>k{=`;Zxz9Ayjy4)fU@Z)F`PBdgZ%#VFzLBb&=-?b8QX}zXsCxj;JC;%BAH2!!RVWF;@y|{(`1y z2?UB-vyeOS$Y&h8!9Xhuxw++g@&nm2kAT+g1!3{~_0nm-{4w2WuJtgtQc)4dI{~Bk z{jiBfG=97VuyaAs{3Vh#i5MGP4N|L(OJR7{l)o~Ce^kHs1qoHAZ?Veh zMX3L&h|(=;@8UvHE=U}1h>j4w#DRVx&em{&Y%)w)7rG4@pvedcSo)}7#5+R7GQ~J0 zH~Q#|$ri-C`Q3lV`av_PmIf@eeCjmz!n5cghdG}&WN{}XtB&b26~aN}6;n*Bfx%wL z9hE^g6m;m$xyUA`4ky31OYr}bbb~lD$dh@X92%>=M?$a)c+1-I9SS$*4&F2Zgb<$t zhQ<|Qn(3IADAp{Q#$!2yn@!^A@X=+zHjSx$gUn38#}7`PjY5=N_nJoDKpbb{w+u%; zwqrWjc6wx>SQmIH%DxguZ}Te(>KacsIphA4*|mECs@?cXQOOJzCg8ZWK2jhN8U{;r zaoi$^tJTvfB2n7#3*czU3|YrjI2!28jdJ&h$sh~fJPFF=D}_T~ ztNR!?#sHaAV_^x*x>Ft@l`5GNf3ks${NQ{!&1q7!m-I3evdJDccbcenP$~x(3nH`) zOR^>enlQl;D>MedWU+yQn0}vVVaPFnroa$Aj};2%he>?3?ouuiq(`@mj^QZgFYpu* zV~=DMQCPY6Y*WSC`WFj!4S3Ry96${wAqv2orBJWWAaVb`8%NYGsEPy~lc`R(@NW_AzzA*73Xc-8D!%8V@$Re>$2JLiLrqglb8$(0-`hdV|L5 z>eALV4X>ZNdWgWPTDC5O#3GRVTagF_kgf8}IK<}}8K#P;tnj)7`9bT}bp-c!Ra@_2 zL%RVFPnPB)eT*(rhbCpk!`P*)=v18iRDM_2`rEm+kJ=36`M3@b{?K9N+;&Wr@zSFq zu0qI(5d6{L-OdluYq!;b<*s&7dFWd1v;-Uih(FR;oL}DPT3MIyVt_RT z@l>-qKn7d72DuE2ZQ@-BEZRe~R4n{8MXjnfRn4V^?Yc}UWPlDpwOs15K)$jZrGm?v zilArd^fV$+d}3Vxi#`)%n~%)e823>vA{`<2nZn-w%0idec?>V=jmno21221^5;ONj z<8a88006R@oDU~!IVfauUH-w&K?4RR;M15h7t!i-%ci4>(*KGd^K(k#3b}OdKPZe< z{S|euM*ZF~+x1}5JNrW{V%PD-r#hw*MLFLi-A+&4iIlHT6)@r#AJ_qY5&kg4fD~7u z;RB2lcq*GY z?OvtZ?wze|hdS8^>`Q<%V>n^tlaBZGAfFbU>tHU(It&si^n&>#zM(j(O6`x%#}tiTmG=zD73aZn z^0gA`{#0`zu(*j<#XhM5cYc{K?R(gPNhQsDqBX(#`@zmw+jmi5P6oaItZk~f<6^~- zK_^t5J+aBvt0=wZma~etWdNx z;?QKNeA{hOU?Py6Tp*_v%IH!POw0LwCpBW)Vui;baH@w~o>~bwl3Us3tm?DR-nXW= zU(}#8`6u37P+<4|u^uliOeZy%1+>H*=b3~hcqTubSlkqWsY)sK!zkkouA<+}<(nge zOLWpr`TfHyI~;{b0?}My)ocmg+tlXk%2=d_Yz1>koccJ?QrPPz4Q(Gu9B3-hVZ~Pc z(^81GMYbDT*-9M2X+P~dz^LTS4LCaVxdmBua-;=!f$?491i8;aPU8m8(N04)7BM9) zFP!(9M{n69Wty!8{BtW!1H-x9MV5rW{K|=*MV$XrFYc!HfS=bfFRD_~RW}J5$suC6(^WqvZ|hJg|S2pY0N`CT9%#Lq_MD`i_0ymV|E^q+eCnlIs`%G zE`{*~NJr)rS{^dQY=NtYmk9$*gP{EFsAh|*H8mIK$ck$EKT%Zhw#wTKKTK)eB`v%) z!rjI>TFhn=n5-oUky9fKUYzL85SPi!QlJrhg};m&QFdG!#sWh(+i`J>lX0>xOc&52 z1Wl*Z+@X|CzzDKy=KzP2_A}z>+SCNmzrMqR? zpAq2WMQTz?PXoZp}m|J8TIL^S$oY2oJU|g9)i2 zB8e@+S8MI>L?ov6#m{$^d0&WUdJUrD?43Y92g6J{j4*c7$ub5J1yl8x8AhvccKO2; zy+`R6e~wGs+(T?kAue~)cH*INgATbn9_W?a2_){=n!zjGEMZmu!Q!QD(*w?vwhtaS ztTVP!PNwINxMhMuW#*qJ?nLH>1Fm9!8mrA}P<0x&vAix;1!Znig#xQUoF^dMXgkK0g8G_(sKiVbT^WnA zf(yxWm<5uCzZ!#Dp)i1tbXWLxz(8gCXDaFlRwR~63xT9$k=SUUb@mS8XO0?Jm_YYa z3krAifc{UII5qfNISC($KJ1Xbz>P|gPK1MxJ@wX+8F215Ric({V|O#aflu;SX08%E zLR`|syq*qTB%s@1E}Jy~qTisz&Us*32<@_cT%!2Ho=C7F5EcG)_Q?cuf2(!_x~I14 zGQw0PhiraUvPPk@`#N0EKUN$32TZu?xh_%ldZe49K27Dd^));sWildXBf?hlfl91!Vy7V#G3ULDri&2akK4H zdqFKrVO3KnynZ9&AmrouJ;oS9#hNm8LTvkY>4FPM#ilTnGGKL%i&wLH}$uW0537Xm|gKt(Qssc>=(RH ztD^9yH3Qahm-j&r5b$%wp)!~IRvDSFNkVH_s0vVNBD-y*D#(Y7`@oF(%eRx+N+2LD zQ3#|L56L>-(BB(_)e6U`tkbxDQa*Au_Ii-uFIPKPzN%9x-=j|Gu>8=_SY`#zAtDd0<=>%G5X(LOKbF z7q}mNy7KBf_}I0Nd!{>u;$x2*q2EF3o}0gJF)Ktm2N)#e-cwN+0z zJfm)q5MSe?eQ^3GiE^IQt$gr*z=Z!A^N36N3pZ)9FK^k1ingnR%?UN1T(Q>|Ey%?- z{1E=>u{8J8<(<({xXLEDl~9dcH|7gQ;LmS$0L4h>zKTe3Qe^+gXhGb7#8A4Uo25{? zmwChTW2E6m8wYj?^hm?#XV?-9AAvyzVe41@=y5!Jm5;Gr5MJGSS7%Okr$ANVwaw8e zS2CUuBS%mof~{JtjGBDR(Z<<~iF=PECTlomr}{KmVOtm%UHm!ZD@Gf2n%!H7H8rmf zYC^Iqb2Rh8otswHcH=T_l#G`QmZzxF{{Ry{V{8Y^!YtAPu{!>vOJ1CcR;|=DW6A~B z{el7QuwY<9ofn?(>u(`2Fo6pOCW22tr{i{Jw_YH>|Iy0UuuN3_)RjDj;EX$;N2|I) zChQXoC?^#b^m_dcI-kY}jDQV%zD@$ZGFopeaFa4AI1FVzm+I%YXHc^sAfL?h@<9(j z)D*k6ODiqYb@8q3HZB!y(s~X;OYFvLt+c?G{h?@(i>$wK^d7AjZMRqb&zFezqiX2G zX|1i#@Dz?$WzXfI)AYoFjv@5gNf^}~R+MS9G(>-@nZFflyr7C`{HJ5#=CL{chr2@? z5a#3=F~HWIr`yq6@`NKkRV^`PgEqGJL1?XMlvyX6fdS#`4B@H zPdBY38XH!#`RC+E2z`dSpq)sqQwpaK5|I$|f0@ZBAl$TV!D`_qZ$bO#!N%1U4hWn` z%Gsm|ozA4k{g(YzM$JL1y;$Hx(3{4GMioy-$+}$Dz-I8|HHcZ*$@|fD z_Z?AIK$kYO?a+MtC<;(1p;*Bp`1|m+gHAv%!K7)rx4|UoB7`Rja8EZl!tQ5TjDih#l11#a~RX*Qqq#e2$2p- z|1SE@#SQ15rjL@&wZpxlke^rcdnMT}=w_JE+x@1qByQ|1VolRr1mq9MU>mSj+nB)0 zGD~UZ(_rZ#zqB9Cv@})CNZD;@rcaVA9;_Ukz0V8yraWLqs}8bznw63#*#02G;h0XK z%)4n=NJ`Tu!@bpkFU?oZsqPvqH`(<-jY2zbsshs!ev@$de8i}|y=%&sviC}le!XPI z{XSw^NYgwW0DXJ)e&3zTcD4!n*^4LlRb@Kq-Ka?yq>1bA%-$RTx}qRcA73v_%gn;b z@7ugnWY)CNh>7?3mYzMzo|K+cUT&N)4b4(Fs&WxLsuv>`ElMX~qj9#}e2WDJ`@6O`lW~2802HPVLGo z@^q{J(Vt!5(LLd5yU}41=I1Nmq|F1DJ}5Y9@^E}@U6<9R zPT+O?qcp1=4x~P^U6X+|WTgC<1O5iB52JwKvdDD>$A~cIxlyVEFb^)f&P10W!~tMa z$X-0TUjQ3@J@pD6s>5Ag==q>UXNJ(S73ki3ze8g%+uQ7|hpc#h;o__&Wj z#vDpn){F(6n;@0UW_8VGynHg8*J?kr?$B8zhp0csC`plo5Mu0A(foUdgu`@bY}uxl zWb2zyO5(pi2b~)vhFo0on#=1ZHuNF`5Ml?7NY;{9X;(!6$IUZTOI(5k8#?e#rLJ8g z233gf552n|W(lQI>>h*S)zM9D*Q4p(CYad!u`;AExbs9QU#d~KVSZF1=8tN$V5+OA zQZk9+lj9|7|K`YnU;Pdt4MoBl{w^5+%{_p2gVx*12jW0B>xRYhS)D2IbHD?p?z?qbiKS zwW`;y+a(&^6XNnqg?C;+AoaYvco5j=e~po{ahUK9$$9?Dj2!cyC}Cn@!00qnjhS$a zIO8Tf)La(8A6|&16mwFg++p)om=nv(X-GjUnDGRr-cs#U`>fK63)~?^&2rShlKQ(d z7QuTsiuqt7tnz8tUh_gT&Yd~V1AJZvLaMV8?z3*!1^u-nV|ThBP{f-1CGDv5&U0h* z92^eaYwk`e4p4Wz#=ucOEhiHYVePp%a6EK2q{&{X!fFbpcYr@Oh|roC9ZAJaIwKU( zJ_Yc-v!NE;_HKxHcfOc`R0RY%uD`m2_t`f<$44%=GdZ7YY-H}3!WhXhl_15jO1H;) z@I^?8wBP6bVWz}6@3j5}t$<8uXUX|(Hs`Y>rMn@73@vA!{vAq zLpVF}^Gp|43GkRW1A*X(Vz+E_fAy2nQ9f`YQ?DQ3Z7;Ij8T_5p{_f+OIH(fjHL}s} zBzX0#q!*eCi}WtW8T_?QAn%1L_fOAO(;n{k1S~MIu29#qIjqE?_#27T%btcliRh`Hf|4pX5E@aFGl?epvA5; z|C;xp=uD1LNisvqHg}{-)|hFwD?Ru1#Ami$G3F-XBs$L;n28rKOSQjJ%x$>oJKmgl ztmgKbbuho~{gR7U?#g?=lC%$4@Wqu|aNoT2i68EqYBlcWx+<24BxD|TzjVr6^~;tF zsP(VU|JQPH{qeD-Sw7gfZHY3Yvj+F;O!!ORb(bQndKPWlf2u@(pgt*s#b86M&rAKw zOMcHf+M-R#1^h|H+r6WRQA+IldO)q5W_hGrjjqs?O%2i%d$cZX_uJ32l?Hsc%yEEZ z9p}@bmcpeXIKYo?AJGFHG+B&gv)xS59M&d^*_x<3MN$6eHEaoibRvYVVI&u~n+Qo$ zeTw-N-HzVsk3Q}2m9+SP+g=VdLeau%nkTU)92x^kJz7G8Avp&FO0RjFAMTm`Mw2ja zyt;N11lHmhYIf)=_xjpZII^p*GT;q(z!~2^7oIJBiL!w?CY{S5a4oH&wtM_@-sz9$ z=96M~-*J04QQ?$rEsfvf<;&~3HdH~v<8U|g*e&K^?JRF=eO1!*H?pym)RXP_3s^-= zQ0k0dp-q6&p?Lg4xu#=5Ox47*uBNBbTDwF~ndx|I>z5gxx{114*Y7=@?~C^TnGz(* zO52K1H(7&W0NFo<_ei>a>EL>jw@b=}UvU7O*+uJiL))*l%E-fI1EPQ>{Ck{>sLMl` zvX8Bdt+nm5Zoz$)WmyB?x!)#zxtzO<(zzBcWYTQvbvmm1624wmITBMjQ$uashZW8( zU0$Jox7qnJgoW=;z|D>@h?7&)gAx9DZPR?VQ(Z(A>30l%ROK3sI!L8)6&Vi>KT40w ztg%b_P$9rKZgoyYmn8k3OFDsDi#;Op{@cmIa~ILIB6aR7zv?#^91BJ_kT6#?xrZrG zs!VVHx$SgWl5oKEU;BVb3HK%s(Z-=rPVQk&zf$E?+5mD z-UZge-|(J*btPyk`G}PVJk2J|jlQv*)f@t|PQRqIzQUQxU#~ER!&%MWoy0lS-8S%| zXuD}YmCeM}HxfChwvym}JpQ$}Kvam`xi2@d=ra1Y0co%3ap!t8el4nA3fl=$C+Q3M zr$^H?E)$#s${hUpR_DJxHYwplkJN5iY&qDe)WeAVhv!ObC7lx9Xy)p}M+bJLxcNIT z60nseZl1+wOvpM5;wSL(Fkdlc2i#D8t2d;5$Xol*dr$|7y1LtxG{iThd?>^yHZyJ5 zn%P|ZAMZs4T5UB~*^dHaYt9Phdx`uLnmd&)4r~1UU+!MlQKj{}A|W*Ml#QL&c>sks z1h6Qvhw)yx4sPpOUDvjEUhg5MY0NzMA5j7=&uhieYNTA_t#*n}#-HaAc3`&sh3v7n z^L(S+vLaRUZ*=%)s*UoXk>{=*s z8#2q{=I$?-zjq>iti8?J0Ey3a^J)*|hVisD%~In6Ah9NEpNH`y@PUrumLaDC8ZYDc zK`rJ?+=I^X8wOMO|+-ml9#ig|zmO*#B?`M$z(W+U~t>|;%UH?*WdrNYi zGDzj3aGzvNIEFR1Brp{GqWv@)hD6?nHi+zJJj!tR+wZY(jjC^fJz3DxJ>@0p)*b*H zpn>xd%`bn=10QY9R}qSB(=8T1;3L#$AGqSR0)*7*ooR*g^bubFX=ETeoL2>c)!L37 zTVPk3u0%iWi6S*!k4xoYN)5pwP~4!}K8Z0rjO&B&-NlKFcNW0fu^JqRe z?|`EasC1pI9my5^06dYq#UYnEDaNfJ%vlxtUjDw@)#gJsCZ#~-&{vgQS4IKB3T zIObon?|(jWg;T4-hOO|I!*+OnbX!O^gF}NtgHJIyiBZ3af02ZQZFyD84fiSdw+XGI zPf@IEVoN_Wu=uLgJaQu|W63v5DJkui0MWr`1HabL&N>-K%;Y0_pukzep=AO6MbG^! zR8Xi-#ipLdXBUf)Mz!HehUqB=mhkWW`O_T*V^iI5;F`AEt8iU0=ri&!%3FW$-~Qhq zKD8hOZwm^J#kPE#tuWqG8zCO@(Q!S%;~hjnoEJCO^SSUw*qKGniu2eb{^M?*SpTQv zcN+I9X2O%~p^LMLJo=k13AoZwuboPiGN96uNB^mo8uqL1=v+JdBECbu;@rOI&9t|UWYF#n-+7?(%OJ~VfAqn7-zoosJ0s&6L3<+Pxo>{_aCAUq zW{(@_b!QK4M>{vx{C3mkDRT!J%rsj8iLt<_w8|sw$AOZ?zZKnn7owDVK2wy3 z=!i*U%jZXqCO(WTOe?&`;G$y!BKGX^ztbJm7JEDxRu#JAAUAncH;Q3hbGqua9m^en z<75VteP#1rmE14!W3`Osi*=nvD))sAKqud_ww6{A=$f#t`n@9r_~P^Vj`9{5c)CCP z-$$jK%*FBP54>sIO3z`FzYeU`(SL!utNIKCnf?U5c(%7Yzkn1|-#&NW{xc=)|HqVo z#X5u7bwF4wZ_x`Ax^RA3J41BV6&|^s%rMs41lb!w7*>LO?_7Yu{=jaKbFo9F&Q&aH zkcXShV%t=K9)jd;M*wIM>@{c_94u?Pvv~3cb|4cq_vY~N#y|Ba9oEgoKetO}q@4u@ zcM2&z>JmqttN9y%v;R8!mkL3G-Du9|p!n4I{@_If$~G%&blIqXWI{ygENuTGvl@LU z17C#56$4*T!H?8_Kkkke^7_36`hd2%)Wf$)vm~E&5L1A`QF%-GxP7TMBQikzRG!n@BtpR6;7H@f}EhnH5|mXzg1q1CIn z>GBGpjC`8lu;bfEbV%Io4L42|C zPzZ5%lb(&h&x5_=ot#fP5;Wl}e?7g$w+<6H=xHg(`)kxGOw$u3r=Y9I-oY+X!K?e7$!^2(3v)3S0?VaT(5qUlkF^~*jGwyst80hR!?0nMMr{#%9 zV81rb2(j^aHDBoTs5O|~)R_+!PJJaz?9W@4$`d#@|=X!iK5(*$XDeccZCIl0&da!+;=(O+JHG*^PO?*sq- zdJZ;@nxHu!1Y4`lsU|%Xc!_}V4+VXRgJ403+KBu2wvP{hC)|! z8n*NO66E>SbGvbcv~2F^&osQ{XWnsphiz0l){=UJ9^6y+72&d6-=bfOko>fH;N3wH zyhe-qrbPE~!GuIBt8>V6dY=My{_BC|TyI`$yM8#+eh)Rv7+wvdq{JtNm1* z?J5$o2bS1O>l*e2o}@~5rmWJHfhoV~FL?xhB$PLL?}3t#cQK#+pC;XFTcF;ZYvBK( z>KvmZX}D+|+qRv|#L2|A)yc%RZQGhml8J5GwkNhTv5mg{-f!I>w|`gl>Q!A;XPtfa z*-vj$gGdf>m+xJ@>Q3X27{SIWO}9K4u^!s)U8A|dkAwqO8fl_(9+7`a5F+_xxJk*M z!e()&RAHrRora7526IVF5JvAQM#RGk@y9)nakJ!ZFwwxB2K?SAaw2Qaj0<;m{K^8^ z;)R5_>yV^i4i--NX1$zb5y#joXw(ULj=?!yX^MZ!q?jHP_ev5-<%lJJh%uBN))hF> z=zS~dERUR@V}XGZZ7SdHdMmJ=3ERYuO)_yAFzKL@pTxVD-?Wik63R3J-lNC+I1&f9 z{Jnaf90kCC47S3$i(9^P`lkdBdlBKvC=s!;{PD{G}bS*upH&-{Rom zy-iJM@%nVfCev|7c&(KSgj1F8JIMlG+Ud`*doBT9Ooh1xZ25P(oruS@PXhRA8|xB4 znW^v7_W{p)Gu5B7aj815K*mI1Wt{sZL14lvP>vBya|g(W>eKox#I0)o3;RGAK@;tz7g=>&%lq1>`Mqd-(B<~2HHCuz9z*7)k zG6Sz70J}a&=wY7s<6b+>GF_trO^m>H%C72m+*X;1zQU@4>8cs!;z?Xf7f=X1mk8`g z{(AoNM7qJ(`3!nZD`2GpbA}+Uxb7$fV=%eE!CBH0?+Del2aDm9wdA3l5{DOhp#S(O z{1{KC3C>TaGDVNTdnm(7#4-4cg7}rYz^@7Q>N~-t*19`NZD&Cn>6b z`Q*EIy#VTG69D0G|Ik6%fbmTJYI9isO61Fe@y3R`zjjU;l?oQCEuhGpcDAzb_Wk|lFo zoMG@M6c!AcUPfse;Qg!8`Kj}NCyqCKul|amE{|xauRbrC1nhhEJCk_o3xVNa3}BiZ zQKslCIE#+A84j2~J-0yK@e7(1P5j}_OnT;@SzJjqz1Xy7q>8ZbFIMkfnuV<9v%FNb zkuuI_$I(KD`bX_NHmOl39YRg!kUBLxOU^CeFF_qe&6AKa6w}C_lf_ECE4Iln{4bmF z2~JQ&JW4!K81vPPy)cj{c0BgCsqEf?3om7|PjWF2vn4t$`!LGUDwY=NwC7Ltzkt{l zSM#8q6nIqIM72z~E0ttN8SyHv0Fg4~gYbW)-kZTxO;cE6{8rx~g$wJ*igKnSHLVN{ z$18d3(p31vhs+naLVr4lSTxnoYiZB&;qi6%iK-ZPM$a2Fg1m$X8imOjoDRbH!lK

G;qEYndJg`g{rn2{0^iwDt`kA#@-Wg`rhP{RuPzXQBTH%O> zD-`@PPlw7k3)ePhgfFsHMI>X*v^mEph^x!&5H~Ipd<4jt^S$s$!2F81RC4B&FEfy; z&K89b0*8(*W5&{>>Baf?^`U&e<3RW;;qS>D+HPguVZ4EJ7T_D|0mCaKe#5ju)f&PV z2Jd0~i_VNjm(rAQ?S5++dLW5rnriAh=X?u)t$bsVE%XsruNcJ~`K%Nwgub_(m>Cmh zm@bE+(){B!G}2`VwSPRVhPoKqVvIlyeLu{EXf%`hPgqENbXN^iB^I6ZAd)PLg$xO; z1EMnyoYUrAZ1P%M-U_{(#`712MKH{DEJ%z%c}gN9oRkcf=#z#qOL)$FH;i@H_o-0R9zq$t z)oyHqeH2U%BfSEXl0k3@4LSujiQ-}k&*-`Rj}j(+H?G2~sUav;Jk)-fJP)_CIdo;%j%7SJFvkRnXuyf@Ma|mQrO!4`NDb12u~L2L%wmZDq#r84S*y5|31~gJ=#L6kZz1*IDn9+tzK_$M9yC@7cC+CT!kJ29E`^z5{=Kj z8_fdCV4qm?KePndE|Kg;QI+?yJCW3qy>eIW=@9|lz{dk|W*zBpLwNX^@La&3SGv^2 z22xS$uy#EC?F^;s^^?Cg8A_8>4-lEN52>pDC2Li5IOLknhBu6p!MZYrW+m1W!gkoK zR7@$uNFHZ%Gz$0>e;oo3>_KFSK|tA4AO!;o3HAj>2gECm2KJ2s1j$bdjlLB1y-ea~ zjq|&8#WdedQvr{L??JYv3P$V;M4cJAIbTOeqbU`bn#p$lq1P3&+Z5MTFCel+Isi1U zh@mOf=AJjqB>IVOipOa?3|3U~{ky!zHioZqVO>g^1W1 zXkX@s*yRK*X5wC`*o1CLeHSW&lh|E9P{R%wI>t~=ephwC+8eXF$6fwS}6GW%JmIp^8HWV!|0A7VdI$YwOaJ&*xc!luBb zXnR7NoI8iP(Y^v_Wa<*Q9kTJF#I1V#9588bukhvh%XJqf{)!1Oo(|w; zR3-@v%YKZEWs+Tf4SqgQ_>KJ>FsxNGH>&Xt+#4(bt~`Cdw?2__s~Q3w61i)T!6BRP z;|pIU>l>#!Il~mDD+V^ehPyEG$Q^lkaz~;PCA&Q)@U-3mvdGnQmPHw#cTuSEy}v%l zoL&jEvfh;Re`r;IkjXUtUaqY&#yqz!fO10t*WC93k08vIUww_*Zc`sc@S_Rn3V$bd3KonuRlG6 zw%u~y6Y5kyL-opZp=Q5lU2{i@>HCi@G2F*ao|<`RXjyGIT^zW~VR;$kZ{7@he_0lH z(6X-uVoU7GEQ$WvEf?IfpZbgPbxf^*E6NG~msw#q1ss&jTqTfUS9#N3FS4CyP;iog zADCjIVt%Nl!j55)jGrPbanYBAx)-Uej4BfEmhbJS%7m6Nv1{L-Uen&|Eo)O77e(Ww=LSLr}h8X5)aGU`;~Nz7ymnO z>T4%E1?Wz?Jp$}bYS{b&@lqmY1?D#vv;nI?H-J@`V9h#^@6-Ha=kmRK;~pr9AdN=y zlTKz)*F$BTj_Ox29$KnGWP5KI?2GA8VTOwIn<=KR0(a#O@z$A)q}npRW$*!DY{GRY z8dFdZ+^UA%bM6a}gr{a^ai2C)rJuGA1WEDfBPOp_`@pT-Uf`(!s7dWfQe6RlFa2^` z>~gE+f|Cf-Bp&fc4CwR*tRPh-0bL}z>rBMmCEgj&?1ADXri@oWB{X2|%FgNZT7V$v z{EmzU5&a`3KGm4_dKkl&{K@~(C00Om32}4rrSG+C=zi7$wo7(uxHdZ+T|t*F|L&E9 zi-e4RCVkaXL+XPRrhlAAz1f$b$L0@xuEf_L%xm{FjB6ZZmuaKZcwSRsUdK!~oQX2i z8R{~w-DQTiq8lH3J&E^RvkzZH`)>((`xd`+G&g}Z_+a|Yz*ZlZyPXh_?l2pNH3vk% zNt0l*NbsUrgN4U&HEW^WMgSm518Aa7j`(>qYq@Z=C6In;3+jB=89NCd$Zch61rB$V zljiG|1G{%(f!jWgK0p`tBg#ji5fWGqhF0yY+FGV=;7ZF^r#A5Kj@5C%>E(6~kXwyw ztg1wS{{I=(Tc7C-gQqxxsQ zDDk1To?HM)ueR5LThc!#fsGR2rpiMb0X-fM$Gf-lU)$%SKwcit`e&@OYH=wTk1LYy zHJ^`*!_vVz<)+oBpIOC+`@v%croU|}nxZFN*VWyqWheuQRjsaT;q(fu6Zt%J(soJcUNs6e zE-66KLGdd|Plgu-1Ww%rd>drf4z1mAi?JIy5n)ZUVMTl8q^g!f?rCb|GhXNd9WEzV ztgnQ(0o2)i9uKLCD9`cn{{D||G7(*r0YE;Zz0{P~)(XzgvziRs4D=mlRW^oU+aV#O zw|+&Te<@dVGabgVABnC#v|EwcZj-_0=t@yck))EQ_nyKjRr0XcT;tFgYy{{+n^$gE zTWXXqI|x~GA^Ql-LFJ^Fz${m*oJwZkdJo`cf*6ng#fGv+h|!e(AT%`fMUa`gY26OG z=9;lAd0IhWf7q^GG*c!WS&jN{B-{KQN0HoP6$7u(G0diTr6O^MQ4d~4h#Vn>NNc^a z=B@xBoKGn!@q+`)nxYIo1b+x$1&FjLzHfUw5-9V1o%m5-@ZzZ_v_J+W4~=t4f(~JXYe_4|35J8poIO>l$+y_@@)73EaL5;8x*^1Yssl zFu*W1(wr+=WPYvxEi68)`$Lwd95)f`C9=&gMBxE#a=1zmzWtug;s^ekgd57s`pQo$ zfkMSFSUa6QHa~xVTxWe6_3B9!!K#3@vu@n_hIcCYEk1Xzwh6%iNaWASO){P0m$3@D z&kjZUvZ#rlwmO|rxa?^B3B_6A5V8Rpy_*#@9+mk4_|Uoz&RcGqQ!0n@H##$gTz+1D zc!d2sdT%@X*trtOY6NyZf?h}a@BU(+Hp`xVs5i@KX!`n&<6=3M+Q(k<{4fk~Pl4a} z=`RQp5!+;5K}Kc4hnS4!)nMqWsWpwUoq};l}9F#cc)xT?$ zQ~NV{S|5Ce=zNZy)^Du$l5|DDOf{DF|BWaP)d~rG`zPg>OSWO?YtNpK zj(!2OQgmPrU4AXi03Tz8YdV0Zmt2-5)uF6RV0+vzh$$ z@qqR3x}HgYS02bNTgH`%U*9%PIUBQMI_)f?ewPK@Q+6GPy=+=6*|mQ)U;#_3zb!w4 zcTRjcoP1?{?p%EXdaxgLTm*1Lw}tbH;5I(!e83N-zR+NsOkYsX7+cBvEba_FvvxMk zHktyw{D<$BKhM1xF?n-5mfXiJ$IN4!}Ne=S|#!0;$U4?!KBQn(E%95(y!B zi_DhF2p0Q|&c@!v^1nYt`tG2mwOJ`F71WpqN??R z2c4}*iooY3+9>RSbAR<75TFMh1tfy$3WzTE~=uxW;L<%ryDB z$rrp>%dg^9VYQ!k41enCcXSqoxHNx>hX)?$b7BVXZu z`)D6V326qfHFPAI`XsZelAO)KhId&SJ?=asL>R6M7k0RCoz>-8P3te5HyB zFhkEDE>gEx2(+yTa&TWCoq$5_j=3|1ZSA;KPjCKnYO|xPU=GoIY$u_TN$reHlLgznEounMus@khGFKJS zaGhvIi(CSGu>%%bh=5Wb4$I`kfexcO!%{^qQVwbH`1+rCR6Y3^C0_gQ(W1QOm_&89|ATMfIDCI*IZxE(^#3KnR-NtjXhHLn_rvA-Xc3O zcxfzFSoBrTd!kf-o_Jy2En;@SZ zkr`*hw=m+K@_T3!e>R=}g0CU_Ug}})Sc7Z(91Lp!qBvoua=ii3^YyhSj~;+u_Prjx zGQd`cd*HVG8rfGfjsv7pM3Bejx54U>)FeuUj)ZiLVfY3yXA*d}OnfQcT0<|42z8{f z_)jb=p+stB*+{KBWAl(Lj&VHo>n8tir%*yZVziJ8L5&S!V=!K}>vP!Hvk@mp?sJIV zbE_&d1D^bp9rc53GAN+$VSj8eJP6uzVLT%o>LR>Vc9rW#AoZJi7;jC&otl-Ki^EIa zu=Eh-{eSD9^82YIHl!TT2>hzT{Uf1Rj@ZA3teA$a#SpwQe<#0|NX$Q8rv`X}d4qnT=7GPYq&^YXj}jAs21~ zWP~1aF@V3-A9D8}ZmAU_k>&05jQVL3{1RP)>X(q#=Wgssf;7vS%1l%6LCV0MIy2wq z|M>(#Be7^Bk|i?49I7fby@>2n`&1SJgI!Bw z8h&5n@X|gyi}ryR%{9zOmtZoUBC(%115B01hG3_}jBltaNFAec3!+9IYLj3kg z_TvO|!C5WG1hku-$8nPzm0#W!q4Cu0nJ(4E`qm>2sa=s)stPl(f%$I6xKpft?+7$G z_hU*{lC+L|XD4l?&LrJ+sMG$AC;80w8hlhF8}AqR^HBgx`qHk*0JE?PPwBnmB)A;F zo>7zNn>~Mv?3vGY_#-@ENV(DN6lrcBZrhXaUo1GMvTl<;{&A2SiV7;1^u(k*Nr3?A zY_VWNm{rZ$aeyN8W#O{mhh>W`zWCn`2|ty1XNJXULv}v(|~oX!yDSLTWB@; zo<2PmW2g&s^rQZ5u#c|4Dp~b#kH>?$x51(yr7DPc!BH*2u=NFmb@_!3-agBJP{)LRJ zJ>8(7q7(RgJE4MeJ6pOT7Sz57^Zs2eC!7ddW+ZGZA|hzfV6Esw{rtia4WEi~yWV+_ z=TaX1TLssT@tAbTD7i8;X7th{7Hs`##S5s02dE13As28i<;G9+ZgDi<(WK4q*0s;b;_b2w>1eVBYAcuJghl{ zgWseDL-lw&>lgT7Xb=mm)xx=JP|gayFF&+q4&#^cgd@i>JpV{ot1IEzz_9*l&k7bPA+&fqR`&zB`H zf`Y0IxQOqQ{Ri(~a5(-CDjhHaeR<+N>%Z{HxJ2$@){f8^`tvqR)dB-qCo;Yx>Ztxk zZ+H33MaNHj`QBV$N|tSdz5^J%e8%Ln6x3l4{G!fn-i@e8^pyTNNu3lq(tx7p zF;Ef;c#%~000vHSjZ?B>=RV4HkT% zEBl83+iC3B$F}0_O<)N(9ltLEj|;Lix)NH&B#|*5g8gKdu=W#SG58}Wd2);}hh<1? z$U4>s65OifL4MrVi6+Q?l3osS){MZSi|T{}5^*$AVwcN^VE53kJbj0)G1TTU8$6rx z@PegN|FIP>@xWsn#wiy}$TPY#V>%HE09DusyiTTh!IB;hblo-Z9U3vgnE*fSI?SXy zn+7sV7K&eTPwSRdA1geHVa;2nIa$HvljK?LlQWaqDA#;Z?>zQwgu^@w^^IquAxNWM zvVK-k|3quzp2XMUjK?#o&uW0MOgNL z_*VZIG=@S*BJ2HO|^8NafK zh?1iUhGij?nXO%-*qad%?+%a9Ma1wpjoE)A*b@*0#ulM!Nh=Hbp*X`b-YhBhK4%xq zqAOWtA;(gSgZ)k*A&>g|+D~rV`!+~9=hFofWY8-q1>5W{d6JrSZ@RgJgH3DcG##y| z0gEl)z1wqtp*oGS*4VZ+G!Py35Qty(1eQ~RnArM-zg)jgggg_Z&%T)xTLOtu&z?r- zO-bgrnxch8O{eEiR|ucd5|--k`DY%)=(Ns7l_qULr;8d(%}r4s-$!}=vw%MYUfDyg z0{`T1!B5XF6O*CszLf!Iz5YG)fB6nW;>z>~wzR=Apv0vhabh&CDDtA;i$gmaUu7dA zGjZs}pk$2lO$v2OCo&3c$r|WHYa`{%QN7Em^W|9{2}&E-(Cj49TG+xXXr4xVoTHjfU`dVq!_~aVt(`6o5nY7gi!1xX{h9r zX8%fUJE_OyCDk`_x<#^#e}N2hYHo3=v-Ma|73x9;V?X6>BEV}Pzm9YSPOvMD)I(_7 z5U}t5a4jZ>pWIqqa2X2|HP~at@aH#PHFlHcUb^KH6TN+I&j8of-bc|9!dPd&`bU8* zu0T?bm@lKUPa)HM@lLe2LB#|#E13vMkoZ(@sFG;uO~V_R&oTQmeBb2c=5@P&lKZ{4 z3*WWV!=KOh@$hi><~gV!Tqpb60GkR95*OGR3accsvgpONVb`v26f_w3ipA$hFgo&B zSnX14c$ZGu3f<-I%vPsx^tjMi_70dftx%W$qb=}pygy~hYM|vz)mWhL8|Sv z)0@ZDwjH60$;WZzYr4vSxt?FThriF4_4W8Ts?Y4Rz93+b@59e9zBvy0jtkKXA)czQ znZZ~?$YDB2TKFub_)aJHw7Lk4Oo6-bdNN% zzy@VHAT+V%K^u|T(H#d#s#HC`AwWXk>GMdrVP2_^dco@+#+Jy! zRh({O+1>zP|6pY*BRJ!tM0V}cr>Fs0k^(jv1lBXt z68HXnQYmdLW-g&{*_UbrK|#s@2TY(DZ%r*c=*_!I(L-=OlxA1HZ4!MSQU=MU7qQr; z5Q}J;$dLo*_-6^zjs+OC1L-W;s#Z|@k=VERF>r+xismovG$hQH@$ahePKG~F574cJ z5vam*h8L25q(Tcj8Gs}4aaMi*gSLCu61!PKQ@a#mor(XON;CVm-sl@h3J4@Bvi{sN zMyVC2g^x?dXR&VQnBye4p#z&_6+n%&LL6L`!|?yk0pLbQIxpqW1i_;6zf(bt7hBHuL;5@A083?{ohDx_3#g|4{*v0IB-HgS zIq28UqCNeB=iH_Hj)ltRaPRxZ?hX0_Y$xcm^?VvZ5obpTFJvJh4ebN{MJH`xYx*aR zfQ;{qb@>cl<*#jDbwD|#!oE`O;n~pl2Jlm;9oGv8;@CgVnTO&s0^>-J;2->d7j_V_ zW(`}%^vRcv?39u+anY%-bn09( zb!h|>n9G%a!?gGwHNXwE9`= z!an-S;Vcv$Sb0k$njdDIhvQ3&e9|pZh_!?&UoiO5gDtd^E5a{(m4sg86YhkDQ|+$> zEzhGB0sl~3EnR&|pACIZI$@2PD+GN|dAoiSb2aTtQR4NpCYIKJF*@P>f zLfdKwpJEPZhwNQ&E|`J+UR)TTD+ zJKo1A+hm0LQKBqy8V`5&ySFLLiEAvlvmQe(^PVk+PI);lof-Su3t7r8ltq19n*Uao z_1l>6mtRt!u<9Aq6N_K9>a^Do zDssq|?Km5wHvdr^q~vYQHh-Vp@yz6o(^0x_`#kQELui zc9f4jmG{8?n}7pf7UaKDb9;4Bs#P^xGX+$eZV=} zti4ZZINACiZ*yMwYi|>775Y`8%_A(erMq{H$h!g}IY5U|^_*8OmH6hgLA6 zr%n;nM>^8{feqGU_}o+P@b-4AiYICe&?K3eMJ7$(?$U8Dme6_J`wBvs`g)-&EQUKf zt5FP~4+_rfE@7TH9UAH77LYTM zouImJ&GR!#aVqR`qRQlVQEs*MXb{e}_P#G8Ni14IV|-^EPm*M8TUc_S)9eEj z-oZ&Nw7QuTwag^{Kp353I;&(l`ZRNG2rwYFUt`1vw)2yABhDSiH};zra4yY!Q8vV} z{`8?_@ho@^IrN}Iq?#eE;7*nz{G?$dB-uDN60OcoeiMY6v)p^DEVxrNgff6RI-~Dp zTWNZ477m-_tC{MYuQzkuoC)cj@y)z+AfnygzwewXy3>IdB~Kn^)fUl)7FA#{JWR&; zg?g*})?IV{WClpV@_ihoZNo{;j)%FVF_byoXp+-xUb9k<8=n(h=e;k|HqO(2y;Xa` zEx~Ndo8+_NM66)A7|nHO!3ZqmqcKf!N2U+%0fW!JR38OXzTBPa54JGw$x)Zz}sL*sYjx7(sRR{vy_ z%I8{}cVi;`EqVrKrxEP9@>di>R9R>Ji_XT@hxl{@y{o8H%7-R&9n?91!)otN~o%KPC{QWu}ZM&{5HO1MU2l~*iQ{qJNmqKXb4g|4d5N>>n{zob+uOgf}rqC1mJ7)+F(w z+6HpMMNpHc@gmLRpSpBdIHS^g;p%4C!Vx13=$CJoKYJsq&FcIR5K}3nx z%S>d~9{T8pXa9BDKA~;@a;OSiRgC3Fu5}2+|ENc*{f-AI6fda0*9Cpr+Q~ z!uL~ECyg~vt1c2B%4_wQS+>|g_`?Dh=c-~xR=P~F@nXKdVz{>jrz|^Wl_de`2Im!8 zB(FNgmY_Lc=|2@ZbZGRH-=pvbnw5TpK4YbXCRnPTO6@T_8!3hDHpi=L=*4_~bxH}B zjm%WBM**Jj+en4!ierC4Okol8^65z`+BT=cmsNEl({_k3_EK7%6 z!cktsp+^Zqnk|@D<`NU(b+@9ievRPu^ZD#j*okcDd1;sbIu0I2g6>~RUO%&;Ynhgc zLZyLsWY4wb`CDSupzL7}VD`~S@t+nfQwZP_QQftMRmfoE_Y~`4#x8tFz+@`+j}7z_ z)v@4X!AyqA@A9&JC91Q*P+~HZHrg2@Dl+z^AfTD8&3`N%#B}SchpxMp&3oa(8{v07E3+vn zjG_t_RkA`X|A#~@K3{}s1NmOFE5R$@UsAYkYKbodi%-3y>9{n5Au7j89Mcy>^N%=^ zdihMNN5a(_JFEvGC%dv$99E`_0Pki@mc{1OHRcAQ8u@@qWT&)XS7O%-VcA5EA@06v zyt`8RxR@4?+3Xx025X+9Kyu{)os^wHuF#OH<9FYE&+G9?_X;zrz96yheH^2tF!epU zL@xQI8=Mx6cDN|j^YM(z3eRUvTWOk!C9zpV&8thk{yC^3OmK?E;J>&+9(7A zTxu2k)f*1{j0vk-Xb*HE`>AUc4FrcMj&2zet4nIuA^%KYjpp**o7L<_;J-Z^RC+e^ z6RNmIRcl1uOezxW;0V^Sa{z8oco4Y~e!nghJGI2;6Ct_B;xXg}A%BOj!2qmay9vc$ z1uByHngwq3_K#oLmgM%Iz=-aE>*!5Mg3;R(hu&y!f;*%s!{@L`d2g{93^I5^n3o0l zhUyYKgjTmtz8$ke7kaW2AN{j^6#he9K9xbg~TJK z*+{yv8jCr(1ypU{8yQ2fCFz|l$w|+vV2OVnF;-pja zH;b0}E=zVd9aniJ_O%GF7D4>3ZswDdK8SA}+QP(n(h0O;)_Qs}KlGIs0tv6=h zl3d`d#+wCg6bTxF|J!Tt8i);g2jnoQ?e(7l-c!wvCOrOjJVMWA7h7DJKpS z&vA8C9S~IYHa$5|9Qj-Qm{9$OU+&xzPgwwH)7^4^QXr`{i^ex)&V-Cg)?NVkgN zXK&t2c{N4cY6m`gXVK`wOt~Nt=NGz$`dbo}xiPsL)=M2ciD$5tc{7tW~A4O=Fpmn0=eZSQj5Lw)eera5DjK&8WH1 zK(;<Eom)JlSkDU=;`i}B_;cMJRS5qTAL4cdI4Pd zw~(x+t;Vh{E6U7A8x#ydN)TbFdR+{4Wd|230Yk%^pEO0KAcYLp_XLULikj(=aA(Cf zTm|(lDXQp^0k)@Xy)vM?hgBuybwGmj4`> zvrk_~Z+4zUJn`M7)jABbq_CwUD=fZgR%Y<{XGxsmF>%Bt;HqDwV|G)t%-){suv?5F z`wX9VkEDO;J3911E*mAbBd7B%o%}~W!qf4M2%&v3{td9eP53t*A(0|xUGaSVxrpD8 z$t`if z`;iAMl65bd(7bs`FY8kZ5y@z|73@Xe0-QFo2KS;$dEmDAqC#2gXF>h4u1$4yEl+$S zPEGgRo*N8Sa{3EMsK$}`r*Zf^EHXqr(ZvvQcUyS&6-}Ck>Qw27NSaP6YFAyNDCp=> zN}yJ1dzM{kvww-pjN}bs_ckA?W)Rpqh}r$5R1OjPN|zwTfLhm9fDT^XGsm(uOVp<@ z#_vD+<*IHcm?vTwYu6`2-M#C!bKr>BTl%CeXZ6<{?u@G|VuXNWB@a5F$gEgFv#~)C zu5Ue(0JV|48|5Rhg!-K|uFw2t-*52iEn&x?o35{)C0dLvtpyDqzNnZBUVtmLBdiJK z_gMiE8f(1ea)?ag8=G)p4ksQHI<7WMi1$tK%HEN4xBk#S_3U37N=2t|GyH{f_#NDL zDv5a>wDeQ+v7W45F9N>c%**;k*8mrG6V0~|Xp^x!>9T$+v0>jyjcv`pGi6CLL#K>N z%R5m8V4wC_EA*Sha<#dy$gnnE@4=49X~pwN`Oj+dG!Cd_BXT%yNR-V-$qkZcdJU)& zu-wSY)bPId$QPsms5|?~iP)lM#6{T%jPko#s99mruB0}yI%+oDD|u-~0GnPVDK!Re zcBJ)<}4pfL36-n=J8njU^bO@LNfBir_0Ki0Wn=YTm`=2EnDF#DeS*ZG{63 zn_g~$cV#1bkup(aMkk0u`k){wUMo*L&orzzl zx%|!I=3RA97~cO;et{;}Jx*9=p6i0yxo*qJ$dB&Uc&`z7a!uNiF9h(gcW4A#45P1B zC^l`*O0Xr_@rm+0qo&Xa^Qr&6Pzs1}dU-(?r7>H9f0^E4e|B+;^4vcBI;>}K-NmFR zm$*g{MdxPm?Cj4NCt$+lM*C=QC~G+wkWkv}!*?Q>>}5OI_1!@Ww6owTwZqq>zNL>? z7+!2yvkU2xehAdtP`QYxAx#3?b|N?cr0kQoLN5KnBE67@7prTWgO%>NSlP;El~qeK zdxH7fm6e!|^tzZ`Z2Y9izTpGV`Svwc34CSgYR|p1X!){eTw+=cXeJ=6ZOwTUQo6+( z4a9G$SxPGir@nyj&XZY*#k>?bQ9YcRW5#xnl0~42+lttW(?gQGj*S34>IT@4Z%git z8Fe?elvEcxrg&4Dl+7C3W2Z0Jkh&aZQvE%eYclCF{3WzE>9k%_}o+iBHjXGAah3r=GJOYYxiB}v-RVKLyw*ak!GA_dIdH6#j5kYZ@XJhSH3KEVVF$W zNzY37`knV>J(`dSJUrV4uDH9OB8PHg+Fo+Y6_b39m(CQyITh93FpkF>ojl26!9%cG zb@l}2%rl1*EXVhSRj=lb5??=*uC?s6M2l%yc!vSsKzBilNKud#xIlir z+@N?@O7UOgMkftUbMnd<2?A%rXxHq(yYh!5Wh;5rt|c3P(E}7W&6OtR;S2B_OcUtZ zSc{{V131EvxCUF2-x~*sJrWKjYRUYDo5h_czLrL5UT4HMULU4d&oTr1P9!?D%C__L z9X0iOq0;z9b-yIWQs8npK@c~)PkPU+Y3P(c^Z6809E7u>{=2=5y#~D#kT^>-5}ctO zL8jVxPx5VMdCK6AM`x`|sR&wblgC*4lLhuxRgPl}V|aBvB7;9uaHj(G?Xi7*alxWr|SL472Ba}r72)VEUk6bTJ`85f=+ zVL(4>fc~Bn-KzR0+IPA>tBBcHnYNHGF#~+C=t=PVNt9eeJBlS+Q$>eihD9(lZevG$M_LV0vatk zKAwZzNKIeqbMfyC?jHfHUmNEuI15-mg#RI-SioW?qM9i#?yetTL}3LT(#(BpSLD8xXxk$ptd8e zy#fbt_Y*btlWY2VH(lZw9p6G$ZRv`MovI?;cXi1U(JJHg*Hs zsmdnlwV2oOR=!xQWf6MJ3R#$&rfE18F;tYQ`nggGYZN-Da%X^)$FKY(5~A^E@m+!n zSB^6um94;La60;Kh+wK1jHSw z{V8aV@u)1XTg-sw6Vtsu1M);oWlqvxXN~YX?8^b($%*u;WQFM_+7Sgo}^odr|mg#9P(fJK5zOHKTdj?a0{?G4%YRSw6y(3E0K3X(=F17QYT#4~cv@ArTq=X$h5RI@J^v;j zZm1Y8>I)9)x*Ss;v5@=SfSxcf-w*pMucp*Bs$c0it`_0wAh1>RKsW}m3RMF}yzfXr zLYKw|Cx;Y`$O9Tq=u*BovVYsQs|`q1#FpI7UdopGao*szhQ?%K@sK+sP7gvA;aJrY zuSpOMNGbS@EGP8^MIzqaIpXcKptYIypwj+*7M}Yzc|7%ZdlJGr70lx!Tr^kxw1iIQ z;(q{*9|hM5zC4w%j1`hUlFlxkH$g5noC=Kfs}z;sS&7!0I${}p>}-cKjD@Uv>AjeFWEyia%L?n*-9K21*Mz|3&f{G`M! zVzdy6i8I1Ya8sRCQh0gzyvdsg7WX|vLaOl4Du3M3CwZpYf80X`Uchvtle4e*8=7tuu$*PO@rlgU z0J2RG_Z+#!l#VcX|8hlwNs_FXEV@iiPd1^fbUi!shm?)dEh+bMT1yqROV<=Qq@6O= zWSEiEYivr0bq!CRkv`=S=~J(j$xfDYEt*GK7GK1wnAdHya#>Uy5@#(8wm)K@wqp#=jYzf4EfK{>EGW0Y`Xl{+E{NE?Y|o9jc5JulRRj?L%b^*CqAd1 zzQ*HbrZ2pfgq0{5xtCDO3OhQNzmb})It|!ral6aM59p|A*7+NI4Wx>TqlFbM5%Xj; zsv!+i_bqdGD1VnN%AC}lBqj;%SNb&POO#9MMVLi-=!vE2I)Fy6P8%1yFki}zkvHqULKT;Bv3cn>cr#o-IkBN(6(3*t; ze88?dG)erh&)ZkS{MQd8&Z9oOInStiK1h;C27+;lCFkbvxmtCaxb-wpZGBS6TKK;_ zp^2Zs^8do^t;$Zao*xL083|+x!DHqO9aFr^5ZxXE{^NhdGqv%ac(MXu+-oCHt7G82DE-q@16`tV>OIa(a{b z{L81bv~^dF1+HJ&)GfW!Ik4&Pozy45~uL@Jv}MhjM-b2?p+y z0E1n2sLMi+w_&|uG8w7tNIz~C+R9r`PK0StH;0Z>QQFWYuQzg_3*0;pNiZ(vX&AYB zxldD&nF69TW2=ZW5pces(ZS96`^QJFOF2Iq#FP(MP(Y>lbqX@m0abQ%Dq=ku&|(6- z;@2sNO$Rg)vBJw3b7oa7(Zr29%)O*Zen}cC$OWcxzM0B-Jm(xNK$}J^uCf*YlI((=&rmR{};}E-@%to7N)@_2hW({NSVr^ZS?$^9-=()4)5Wy`rRo z@1+#S6OxQj0bl?$+d0~KyZ;j%VnW&8)O4D^hKBa%X-!KK^Nc|78F4eE0b1 zXn(h2CY#uoGTu%=xtcF5(u;ug9nX*XG~^GDe>mSeIISMo%v-nqm7$T3Xv~o%yVOZf zJDFU=`khf1U(Me$wSipH@fs{60_N5Nr7b@`@3wpY_iRWXJ%SF$)znAJ;FxuoMs z!=WPkt>~hdyUQ318wX<*M?`>KO~<7?9%Uvcf&N6t6^t%(5Hg!C^a&G zk-P6Tt7&*O?_7T3S-b>i1D}J>F`tDWQxCe-B_mETGw&X|4zEelvUU=0P|bc4_Q~eegrm&5Jv5HW=|WxTZj2nl+y=)TsNtF%Yd> zfa`(p4h+bcpN_)_lQ3gOI5$CrMUw}6n6P=oNuL7Y_+Dmi{!XSpKG<^%SRG2+fI7Bz zz25he!KjP&Gnw_T`KQnMi1PY+v(iJ>n5#5RDthKkAK=f zJwMpnUjC?Mgr%jI_Fb`7=Ab!`Lu7s?sTL29clOS|+d14h+7(TnY%i~1_Td)>vzi=~ z;RV_*gYChK_kV~V?kK@u@B-`})RtFPmJ5A?SI}Htt*ut|Wztc7atAA%PfO(7+536_ z^z5LszjuCk&^g;b+CS}VpB(NS9G&g|de*MjC6y0OWPELD#C7S1-T{XiPsFUQO}_xg zM7w%vui@IBSzP5ptfE3m3w59Fh)IKy1m?RVcCuP1j@~)^%5{_tw}WvazYyva=Lo%_ zu2jqlsUjHBFsXaYy`*tH9))u%eudEN`Ej+@*VJNHN=g%$@Vz$fxi)R1Tydu^H9!B( zK5?cj>#z+I_uV|Ts`^l`+>yByEGO*OF(uw{7>tcvax*4F^$L2bKF){wy=9O>c-;!^ zxH&y1-Uk-vIvqyIc+Zd9@bS)?(DXg89xLusDntHONZIB5hexFm35(a>^H!{8vkRx3 zoH$am=*Ou$!b@`&CiEsTuk~{usdTN%JwBcn8<@PiWL)jk@ZtrII0-pHjhY=dX`f3+H~i}4?}8k^7YAD`qY8gPjL-&d@$n3>_q zi1s}pCqpS7m;fjB zNT_xZzB0&|-yXw)qKY6@57=P4>JP0HSb|;bE2=H9^Xh{%(a}jZ>{PitUFB?K)faS` zO;fPd2e9ol_acWT*tVgEx1}B)U;8~fWQk30e4cRgWR`Y?z>soI`dZw5yWi>T{II`W zyYR4~(M2s^??mB3aP)L-NLYy~sFSEID~L6?Rdf=)VnN!g7;I%&V+TG@X3BDSq+OJ9 z`L4^4#V+(>Hk>fD8f66*QD!XRNlYSJ8i37j+I_DM*tS5=?$W*=hJM%=_2m`2J><}8 zG#X&rLvmxQ-iT>&3uvvA4S`k4269BNXl&Rqer~??{5;N6wf{R}s`>qp#q?3yn6dvi zHjD8;nwzcWbNv4&d6wWrCJRP2yc~469?%fFBR}v21Br-xDHw%gshb9MZ@_^MXb?a@ zU|s14kn6bW2J@^HvP_<6Sjo*#3|>HA3?|CQ)lPWP|4j{oWxgMMB7qkrQiDLGFx{2lZ z9wl{IE@mJ86AvI&>;L$dqy5v)`G1=mjaK7%{XfM+q9|rpC_~%OrQrv^ z&jPPY^p zmS86$ZhE`^BMpYID<*?wX{!PffV!Af5c2mS7=_LXXD5SQ<3+V#1SnBuFNCE3mHiX`)!hNk0!(q5MxcfeEc$x zxxDVO(4|qr>(?y43>fk7RT8rxpmEM;zg}u#mt0YjJYow=fj{(>?gm@K$&>X2ClPWN zxb}kpJbC=@u^?dAe%Qx>KG4$(2zcX=41Jdb!5Fwp0x`z&aIJ%m!HA2YGiHa;Lp~S0 zO!1;&5;4zNGNADUz?pT6m}8keN(!LMu5beF-$ab-uR4Ha7EA=Ld;;3CL3?^~SYeU0 z30@UcT!Mp;CnN|&M@3tDNiy)|2YjpPnhfw~EY)792!o5^Sgx)M@I(BpJUOh)S>CcP zE-tKPIgMi)F|_UWLwD3A35#)xwCi=XpqxHq{eY6l=LO>$TW%kAT2sT+$l4hH88k{+ z6LQBvG^~T38d(A!^?a8k)XO~kS7Pe2;ZQ6tZ&masgdw@4z(=vvvt?GXN{c1v@=3cW zzPd>OO4k;0W$8bo^YXWhOE85T#>!FZA`S$8W9%n2bMcdywNV+XrRSy}f}e1> zFgOr0pbO}Z^|Wx{ES*s<3872DMMrD@FY2j*Ne0wPS1zP>o?=BsBql?eptNY+!ioL~ zb3M1PM`fZ?!C1fON1!S_q88R;)pa{{Fj(qFhMpZK|ji%q8?#IJ_{Nhy{2%+3d} zOsQxT1S%KqLr{AB=N2vwdPgidi7BUHazBD0rL;rXz2=m()8+SS{fVAixLAMCd;(1= zmklEpE=X-nsmnJ!4Jrhe^b4C#_}s$9;(VzDM9wK?`f?vi>B_0K44(b)1oEX!v|G6N zc=ymrg_J6of-T0Uvb*ur>I~n}n+M4)kNG?vrHYeP$@9dEwmxTAZ++sY6I1!HU!`Bm-X^} zRf?uH570_VoiGnhOlZzr>b#t1CZ^@mDA`d==@408eM!GW1?nQ5d^Aewh+PXxo_n`6KRqM)b7#;oZWa&l54H1lDGNwp6((=yRV*C8Ul7d!IqAKctgz@&1oT zp;T3xj+uZnN}0($G?6sOH0Q`%1k*ZSJEX}qi!c4Kuiw>|G)Ozu41Y#SWeGrL!@Y$w zER7*j1efko7;!^gUM7~lU@9U?O79NjJ<&v+=FD0DJO`^}d0B_;q>&Dlu zN06tAVQ%J>(GPlX7LVu}dP#E1b3%LJE@dV4lQh)YPbFO4!bOh+d|_o}9!QQ-h5Xo4 zAsdt;o(EYVSDafqbvEoBb@beN2%ZmmJ{_fWn(hZsN`w4TD3!#chY_kkDI@3c9DCo{ z?ulgQn#E8LNRkoBxV;Q1TI)s3TNRuwrU4mC;XGZR>S`*jt)quy6A$C}xA3AV7}bjh z0m)IS6w7J~y$niWlmoPy@I2~aECZQuSO!rLL?ChOUr|9wDQLw>whN@h5_0P&qSSh` z@pa=7DJApP&#Rx>lUeTlP?1UyL_3Tt?q2FQe+u0}8P$uNhy1;kVV+XSI9foLpmM&z z**N;7;?RSiTe#5k_Wr!8FsD?q^!ZN6d#W^YZ5k%AKIKv34%GF$2Rjf`m&H$_h?d1Ovj)%cl%V$%fj zddG7}1|-2qMHqWX1}c&++lWvB-B~0{am!~;m~$v@P0>@H1*OQ4Fl{@=yf5P#;_+r! znwDX)+dq}c;crBxJ)g%TRL6cd^7?cx{fpFo0)ebD$l3*y#gi|DWRJ+XjNoi@1C-n$ zi^dB3;guh=5DiCvCb2JA5>Krseas3#;<2FSkW9Kq6`jiLOC3&ls`F?=?R&BN*I-t! zl~F-e9K~5R;X)4b1-#Dz04`G({PA8YPvl4b2e34%-GV)R=!2B1rS?ybGNN`=2o^=P zS{qPgno2W$VII?D!OOo}I3b(^3CEy=rl=k4GG#9g>wi&GK`xrDdj;+rf8 z%eUv>q)`{Yy?~XSAW$I)UBcA=N9I zxrHOC17JNd6);Lom-bkU-R)BFxr*hUJk4$Sgj@lfl2xf$dw=V zF|oj7uU0XqJ_)6YnGGgUY6p9mQA5-dMs+EmuDgo4}6N|evOK=d9| zE6*t-2IGu-^p5FgEr``6?xm24#De^ip2xHI$%mkwlT+P-45(+?{KBq=f>Of2-v0V9 z>>lZPJU&$&tXKAW%DHbxCIyf+F(i)?#WM{@cZ{kRG11Uc4D}5eIiKixJYB-%u*Op@ z4iu%7RxkB{7V8il##4eAc4nXDxrK{b?a?T;h@qWo{%k<;*`wTt@U~*sebAa4a~#|d2{oDhvbw}*8@MHfzOlU?g#3kGH@10 zFU+ZoRt!OK7_$*vlQ1z6Iy996Vm&hv=3QWKK#E;gr97e3{+Cx|B&r`F!4j%yD@dGY6y zQEEOh;TC=wQ1lOCF*2NNiHYT;`BcIT-t$0Y@B2KS6-!m#@j0wma{R?DIIn+6&n;YV z7I4nOdNDh<{b6`xQ`L!o@&RdWZcWg~O`_CHcmElb`jXuIZ{dQp)*D-`^{=;FZF!tt@W1MYEZJ(rLVW%yxH`6ZmZ#XU-x<&jb694{$^uqbMrNQb5TvHFro3) zEc3lvI8f!Jk%+OzdV>uZsFpp>9m{&UC&IQ)Et}N99y3x<>%+=pM;}JO3kzR&EER{285bt^D8aBFL(31 zg^RD(8*e_v);G@yd9L$uo_nIM;WIp+rt6*=jkc2m zl5#R94ValQ44G;uL3I7cH2t`Ri=jlp4;KrEXabp&Qp%#@C?nV{bZC+VqgBqZX znUO@AHh-q)N#_(VDcNu5m>96K%VK)m0WSSVr;P9W5g?-vNRiM=U_|yc_{de)H z0;Qh$)V!2>=2LUesZmfk+oV2d%5+$_iX|QBP^wKf(6U1Y+#tg!c+7Zh^F5Czqe}_- zU##nNiF?U|cEKwv2&29V;r9DYkvg2)UeU&!+*D78Qg=39d?#emehgf9K@9bMV`K8*0rTYWMMQF#MdQG4On=FYEh>Ha$+X zl{F@{|5Bb?xM)3&HF`!Vynb@#NI=_2@OW7Va_O(=Z7XDk_IAoMs zz%uslXAf(2)KMeLd!_CWE^J$z^DpUm8&44L*U~@#xBwFOM@W%`!G)P6?835k0t|7K z_*XO-1A%|*Y>A zmFdZrmM}klNZmwfGvu8w#(ebg2x~+vx2%7&5u)bGI$4G87~+vkRZoCprb!hxQHHE} z!_yplX;)M(NXSPxDfARmERx9oS>|hO!&TF|^h2)=C(N^kG$9^INZSHDFShZBRn&kv`QEbAAoJA?86$4ZKY4lUbY202iq1% zTv*mGm@wiZD|rDv&v~+p*(lbj`=skC=9t{SNodGr%1Jqi2ABsgMgs$v@i9;6a81sV zfF)e24_Lre&}mLxc_E4+Hxg9Wp<;mzBeCEFfzXjgdN?q})ucLEOuIOyJYpd#@-Szr zOq_>k1n2?}T}ne8d(g2g8{T)^0UZ)MrhT6$@%WFGiWI5YUZHdHCNZV;ArT9po~=Zl zhqVeezz(FrbU>vjm#jna0*>Z%F~%(j$e701DWtJp4GtXSil6Rx&U&LjMiA~1b-}=; z(i%5Isl7s&J6ACSi5QmyHIYHEQBvX%f}^DIPjxKcTog>pI>nsS*sxBR8I02qMrbpi z`PwPnB4E}V+;QVj=bKN1_^J4Bewg|c?Du8CF10@fdk>8R8gYm(3PC`m@5=%^d`d_ZM3ULDRkW~0!v zW7hRU41Fo%TN;_KtPXlfFVe9~gsDY%!e^dIRt!eb(fpOfwhtV>XIZJ{iH}gE6K9frMEY5bnc> z>mW*^zYwy}HnL?1NruA;b@~o;2^Z65wGjGmLf~2HGltOv9hph=<415#6)(cX9Cvq) zc=xlMJB6UQaCevHHmwS7imWJ+o@P9aT$)ChifPZk(S(;7UU4GnV8Sfc(ItFuGJf_q z-<=-+w10Yju=njexZ?VgE%1C$Y(+5iB_xSqQYqGB7P>g5Fbe%Y<&C8b!I~Lg%3a-v z2H{xm()p^rW2c5;R-IQOfRUvR*RPnq7wZ>m`T1{EOkG6YP=!!C8nh?`tdEOGHaq+&{8 z1Se+880WT?FtO#=vp&lCE2yesZE`Uca5Bqfpn9_ESe9S~69R;jL^fQU06H)_hW+Lv zjEyGWq%pvK+>bE|c*3qp>{$X0g4ZPyN!f%NMKz{FlDGq81PKSR#fr`2iW>2SCF{Z! zDF~m@Q7$FCaOd$AqXS>aNGLlKf!LkZmcyo;FbFSKmQ5U5fD*uURsj>LPwFimPQfx zoHTBD4fD|hiDcl}gh4G$649>Lmp`5y@0}l<+_k@MeBD~BtpN=&pS0M!RFE2EOUNKq zg9p6{#P>P&P|OD;G zv_$0S0?v>`xe1j`@AR*=6vgxvPMmq5;uM+_re!V5L!(O)u)9z--Q--e53RTAz#)TV z1%bZZUBSIgNi~i3WFYm%YTJT!9bZxmovPIm40lq!R#vV#tz0uJ*O*qWVL?OT-d=zJ zCtxQiRyV^`6su`!7KC%0-QoXW&*6ENaI zR~M{agr48)p-?F>z;izHlvsk_yJM7h)NwJHESP9rSgIw`&7?v9x!TQzc%8{bEB-V& zeAR);ayl}IwMhv197ds(i^D7^9?JHzBYZSO$#j}vE2@^Id~fW&W0KS& zdMC5$B%^4G43nF1xwCpYAW9PXl7t+)B;>r(Z;HZDLG+PZiq0j_r3rEJ7Y5>J!V}_N z+WO#ci^XQ^#ny(Jz_}(Md8sh9{${P&fLH4O|NN)Xe{AtU8@7%K&HEx2YuudWof=N^p$Hl}e+iPGz9&885g z@&7YK>3fJ~pF@hgr%1h!6nPJUdLn#dU~@9+f4dmCT)su<(**dHYaQ*p-Jfu$cJ}WR z^V9C(yUyAEseN!Ff9r|3(s%17OIYf#OGv;MWy+Gskh=4$}> zCS)P~)+jFquYR_BQVFazT>qNO*6fCzPVnr>P3^3;mb0-bKCf>&twzIXt-o=auQx;i z(Oi4I(QLdaH)^)lT%fh4^L0bFwz1)CY&gxW78tEi(IDVLLjC1A5gk#;>(+J0DYtO>* z69~t7*(E>G7Qd&csy{;v%#DA_1Wf@jHy?{78U~D9vs0wL>R#Sk;Hw6=u&f6^h3q;6 z^qZ6djb*)r<1iS5$_d9o`IjiGFO|v@mD*k6UQ(TIB`W!oxB>Bp99EPK(~$85Z|`B} zm(Hs7667u?7-p)?)(L~t)NWTqZm?<~Wx*ct1I+4z={j^)vzW@eeZ5(SWJo=@K&oA& zw-scV^RoVh!ZnL8fuKQ`w7%+67=@WF0ZB9>7x>!1`@*rTLQ+4&_FM+oiHJL(4vYJB zkGW`pEDg?=a`kX945#EyLK0<|XS}`QRS^a(tCNt>Be9orYvwt-p3LE04Wzne(AH+k zJX2bpVUE0X0?44|=wn?K-@uZ#nL^N3=8I-#$KEKEISm6JJu@#UkWs>hB=KFe4nbkR z5U5Lx_)b9M1Y{PMxL}|G%E*nx)IyWhTSL6y=Ey&Ys${>uBTX ziD4K|iTBtW16i}3N`hv1);|ny&UK6}Z5Ne`;EC&6<{=0m8pRl!+3<2t^BJpLPKIf* z7>W^Bhf5NU;a}v60EtqkWCy-ewqMHnat-`M-_7#OK#KKDx?n@rkc{z)uZxxSOmyIk z!GH#ln2<5e22;$s41~Nn@nbZwz9M0QHqb1jVZz~>N*0?kL~utk2}2rO9xkfm%8C=3>;KA-gh0Q~5a*O{31xdXo)@42^UI&Lr`>KCbWd2ye^; z6>e_LG;LL>1jS*Aggjj%Xe}O-Ycr6o1K(%C3fA-%tP*evmMx`%EF-5Mx-5qOcG?6QS+C05;zF=Mx$@rUUshsL zh%cJ0Ub$4oqzEwg7Kz7cyumb#o}!Pr#HDdzA$DPA4WI2N#sXrYs<6vKJ{r;(en4ww z$NHcDgy#dHeH!bLlw+pS&I-zLan!$jU>l7_qp`KIf&Xtb8pZ!N)?2Utr@67Yx$(NW zxw+Z=pGI?QV{`L=pz%n3ocfG}{PsVM2e(!1+<(a9VNQM;x_C99-I+2s9xz0bHhQCp z9be8Cv(%M#vT8X^r(t=1pYo&)GOm5Qx!G-b-p1xS*&?*tpsxF-`Sp6Y>(Q+Zx7%7L zz4cc2>o;4CO}h2Ewb5w3*`nPI`nvmOgRXBiJu6NB(}r5B(Q4U^H+J*QS#z_!{<_`T zaJCwoo9pWvo39$JcB4`I&sck3!ZUOI3r79GHfF8=*7{~?{ck<5|0j87um8fzo|hrG zER@@&w&5&AYFR72vC_60POIT;eQx6X4W6p?UmVRk21vL+Cz!GRn~m3n_1|i=UO%t@ zCwU6~(Ikq}pX<)1vuSyhyRje1mAp&CBqo9X7xi)`w?pEiiLE%po~0$& z;c!j;{y=cxKSwMc4SAOJQmWsnx2AH_`$JUc`d7;PfP}z2&rnZlcU)^}3GY${jMLD8 zw=AaYipJ6}w_MzCtXEbt%{5qGgUvNyF}!xHr6mC|roHx~v9l%p+U7K|6ehcD6eew0 z2UvnV%KaFrLc&BTr+;JYCwUtxgXqh65)ye5T$3?g-K;d%*4Gs7tCkfpZ_nrP2)EJi zMqZzyY08k?ybH+{@dF|LwxKB+J(L0U2J9M!BpkzU`t}u_Rh7zglvM*yI$B?`U?f#t zUfL9QEGwb$&<}A#{UIhUJ)yDBybcutI&VYsO{0N*&30_y@*|L3T?{8Dc{E(?CUOM7cJYq1e#b0|8** zI5+ka8vA52C`(CL*#H{X?@Oo{<&+zBSqMbiZ>8pCaBw29GOg6$;~n~N#9cp$2|BNb zw(rp}@q1$-;0?{o_6)u@YeQo$!LWYmq_I76H!C@V3)5UmRZVTFY%k;v38F#KOm4t< zQV_SCl4Tk!O|!Hk*F0}pXA3cq+kdf;njieIZ>RQxnepACz%{)M741ziE@WZ-8nIPFb4>Xt0pArD%95B zym>P(Y8udkkShU^Zc){ATL3u;=0T|CKv-$yTFpz2vmih^_%m*tBXTty~1qt^pySG9Z_a;Q%p28Fzg) z;t1LuFnwl58)GgnokZb)Gw?$2V>|8`G5oIB{YT?+3>w^6i^}SwDE6nqfr~0jmA*^l*87BX6wycUv*H%9iFGW z6~#Up6zm3s^CM*GwVGv_Q4RGZ%7Pc#>bhBJz;QqY>9YxgLZ4+BNtN30{*M$2CP+%- zQSrjGR+V)KN8SFe-jcgxWji3GtsFwWjO*o6jIZU5(6*!sxPTWiZzoLr9o>wiPui)y zQS68PP73FsAF}lI{tb0UnlmjS@3uk5r}~MG+fb|CF>7ggkf^6rHa>ui@N$TOBJ&?W zhj=qJ9Ts-w;Sz*Fn=G$^&+0O7pRsio3q&Ltw4qj4x5t%5kS*4}Zf-Pdh_LFN!u2OQ zmgi@Ph#xD%HF3NmNkYUJh&fh;X+p`c4K zF1(?xd@c2Vw$vK(dOQk^rm|dH;%MWJc*2H2M#+H1{$E1)Tv~z?!e#UwPTiO$sU^c@ z8nVZMee@v4?^(Dk!nwBE6L1V>nMUIlOH8qDdD*XExY%9Jq&dnc)ZxSg92IQ91u+?5 z#Sc?U02$h>+{&uxre1E285mr^OL57pMbhg{AiND1-$<+k*ZTHc{rHKFzrBE!ogjcw zgj*Nkbk$nYRBBsGX*9~=7)=s7_{9=y?2?YLgj~;J+Yu$x7lL%xEcWollBB>1PW?KI z5~UX68eG=QZ3&8R*I#FjfkjmbQ#>BUbuROPRWg9w_rn7HT*@ z{ItJ@r>XygmMT3qh=ecfEZu4yb* z>hUOvMv0s`8EQBVlXO}WY!h?Z3v~=WR|dSs1qVjIRec@>%5N!Mj)~yxZK$!hudhN< z#g;mneIpimWBXKPPN7~0Me%drTlxKW@73zJ-+a6B`|sDUR%=$ahfBtgZB6IPt=eNZ zjQ2>ixvisWE`-jy`8i1C5K{_4s0ZRu{$$9@x297e^-?F`jBHIph& z*iZRueZgLzFK>Q=j-wU-9u3Gi)r_t;6i2y2t%3w>oImA>R_ZoJlMH4B3Xm#$uzmFopuH*|4Ovq-+*M9nMy^P!8c}(8!T4UJ*lHTfOReP0xL%*hl_wPSCN21-B|L^_ zc}Qhw^m0Dw6}~zF>XMnPA>&6Tc%9U<=oNy1LYK+_fFzc|hsC)=RerBie^&W$X{did zm3P8`2E&|(L~oP4-fZ@ouQys->tDZa_DIibH7TVVbbWK9x#ewbHCtretMdfY_*Hs& zrS25Q>A=uO38{bS@b$*3ns}L_Q!8QeiXEj*r12VHTM^WnPnA1=b^WmZ*QJzw9X?n(T;H-lK;LrgnD-DDkv_p>L0La|cHUXXl3pZx7DeuxY86X9v4K zou3`N-ETt+wT~$xLvrH}M?(W4mxb;qjzw2gk5tl_)bm%?CYlDytu{s7povE6?ar^~ zyN3t+M`!1|N539*kfBeaMy7}->J|iJlaC=FedyAGuL5=I2DzdKHulqb=if)WngGq} zR<219fEzIP5{8QQSyBLSz3C`t;g%mhSO|h1x{ktkI8UIV~#GOOYY!YEGaG%ya2d^m@zFqRcs*yW5n-K z;st(4jU8U@*k)EOwsrwym*~kamh8umsn4pREOL6IAi%pxaNzFFZaDLmOKnSx zWGUMA1P^kK+?MbM+}*9s2e$dCns*#0%ddvFSR<}3;pO(JO`+y$f8J(gzN|Evn`k=K z+-Kvj1MGh8dH(!VKMV5z^8pPau~R3}{HEYD_E%t*zJ3_TNwPeEe8{30MBG zjhB!;KcLAtqT5437I#3~@Unh)XNgkQ{!OGK)a(3wX@CL8QsrzNw9VizlDF8|cRW!$ z(yI*bH#NTzC3U1dxP>Ghg)VHZrbCFdBOJx5RK4r8XdG8)%sfe~w5X z15A)8Lfjqe7b>A+`9!oK`oYr_Oq>mKd6=-rJ)Z`iys<~iC3z-7Tdx%rX?*XfquiYE z(smV7p()E22}CLSbPx&|3nH^(7-<^@L|$P#g}52>)->^ZDLwVal%~4O!~$~>J>VIn zW$ZwEd;W1X@JwkTq2x1{rMTwaE{tFl`(e_9+E?8Eiq{IzWV?&Zv`K&GW}q>&V#z4C zDKV@#ylSq2&%%6_`FS!3J=Q-!)cnQEE--pN)xPGtF#-+yiHJ7`(nXz~G2&rP)f^J^;IH!>u;!{9n8pOf&macfcSX zu}ipx(9O01SpL{-+pXrC=AD(AK#U&-=fw-f^1~7wG}qTA1vCL$-({R0AD?Y6uON7J z<7q@R+`{lop;vxDO!qj>IB+g{ICNH6nb;p}eDZZ#SWqhNO1 zDoYx-uXfWcnB7V$bhBGZd($ZQxki^SnMB`(7x|9 z;~zHub$)Vse6oLfcCgyUAt|qs@HqRZ+8xkwlDO1 zu)Pb7)ba7|_djf_=5sG`RT-_SkN^7l?e~W}KXkTh_OHX6WpfsR{p*nD-qbX2**Q7+ z*UqWtLd$|B)n9%fu|{$CaHrEb**W`hySDsMe7&m&ez*Rzz5G#Dy=&)I_+2{%?f2mQ zdsr5Ihwc9dE6&SRd*yw@{`!wstIP1mAOFBqgXz64z|jt_yzh28Kc1iNzuh_8{qcSC zk2|Bp@#$W%Kr2_^?Z3|t_O_Q-R*p~iUNu*BFKA}_pEC5?_rwpRGLhaSF>w=MvFBst z>X;279Te<=Y0pe=`~hziP~J14p~1}PoX`tZsNO_Xa104&2;_GtmcP)f<^;a zFJr4SEAnyZW)(9wJG0`D-0UJ~$V&svwnl>r6;w zl(1+N_o>4}5}ne7_#uW_kpwDo*ahI>zX!^Y5~1ap?@Uk|!L_5j8o84Orrv&8Sy3-D z7Q@O4_}k5Yfd37)db)pdc(A+E`3Lx~UO~FnJyu%j>OOSY-(D6x#$H}o@$Kg7s0he3@j4T{%T}RKa^gc2axqJldrtaDU{TfQ$tLF7@F=x@sNb=ZAt96j3)- z3hwq--p7N^@tdti^A6q%LACwWuOG$#@BRQAzOpwXc>h(>{%ZGQ^X{Kt9pcO3SK$Oq z3}FoH5NgYrQEUygpjKX9jdXu1o99G(SclP6~N}LB+w$nKTdoSzn zhvAJHb>(l2rI5(5Fo9|%krCAaH=1xa)P)b^ih%7#P+Lw#?;0#?;U1O+Jxe>$=T>Mv zKMOqz>VH45uD-%o=`VTEV#9L@@OPwmd z`M|pPqM~;3(y&VscTi8&%l~5C`4!9QCHrD}`5))Mdo-X4wIj6RuC)PQqDL6@&{63>Q_C%e6yJSd-L|%v zuy{mWjJ#HDdjIhwP7SB>vuq@9m9Hz9Z)LfhrM@m^yp*MKcJ{iI@lux31e9Z7&OWGc zBwt{R=A!&0!j_1OyRjlLl>GyA_j0eHZ2MITfR!Oq6&uUAx2>vKGw*11XR;vJx+7_5 zm`n%*BLT0`hzu!YM9Ius9?Q=O>0{dkNGFD4Z>dh^^=ncdX|ID9Wluhgk@?nKW_g)m*zrB4d z6chn97PZ<`Itil3Lro|o4*vqEGZp7Dt|h(z$_dK&X-v0EI$nci84<0$EvFw1ugWVT zl?X%?xK&ZF43kDjnlzSXE5epFWiz+%=ZF>ObtT%FbCxBjEUjQPw^eZ-Q=^z>3qG6K z-lIJW%Ks7bvgp!X3}pRq`@cr3RkZ(GZ#ACf|EG9N5nalz^{Zx=CPWMBC*{!P&lVw5 zEkd;H#*F}&rNEa9_G~WsvW!Z`#8TO=Je(OvYdss_{oS4g`M;8AQ;Yq%lt8oi|N8ny zf&Xu8Y;HaC|EG8=ZT}RDo1f2T4jliLe7E1iY9om`{PLtP~UQizQ^H>6xW6P%2wy8s+fp<)2%*7H_O<3-iH=>+SP z8^u|s+q5T4z`Q7F+qPv*WdUW0<%?znW_W>Tj_`1fFj3sR2VXE?EyNx27OfBG5fkCv zi&IR2_Fu;@KDV&){5<-zsQjM=+kPzj-{$MaR`LF4eXH>t|KUjl6 z35|z-h|T;E6PKRkleZWvXlltSoxYimA}{-8X)1CC%*7fN7Sg4xtmOq$D3Yz1H&p}s zlqTIJo9-;P2BgpDH|#FmvM4)ms5Jf-P~}{9N`|9S1fJVkw9{l?dY+4#)zK9M9Fso^YtGoAo%!cK8nkJ7vrM>c3Lz>UE zS!w}fe&-5}&kWMdXJVhtoC#L;Mqe?<^II{uc=c2jB4q)6GwpQg^L<7*6&N+y(iW;{ zcklVITneE&bEJ%}8f8uN>J!FL@P=+yv$BNXXUAbMPV;e>J6am?DIX@h))bJ;bjn!f zxvga_U~!OdsSue~KNaFl9^?#Rr>gK`qE8isNgi&KtvwdF@~N7I^9dsphO;1!lox#- znOyP7Y@oQ2&jOn-KN;@C4Y0F+`t!l=K8E0#xdT?v*TKZK1p|zU+fYuTEzaW7&NyW| zeezB8(e{Gk_&vhTP!YX+3Ugsml25#zMRuOVH;ocThZnX7%40n-<1NhMP#O5S`BbsW zeYsT;&Lo~i;(lqc?5-brHu1c8dlr&%X&E_RCs{b9uvOMrJ0i(odlvMH{oIBuFzR-| zToMczPfR>>-oCTY30U6_=oJlS;gZJqmWhfhKw-LKn}xQ#$C?vhF3Iu3_mc@1hQ&Gk zl)H)%H|z2D79&j6{dSl+jzX2};tM$*&B?+|GR<(Ly;G5pOWR<`y!09~L&AL9uC}Fp zqe~ZhP-=nndg6F)uqgfJp^y_6(731`HC`?VUvG95krzrbv#SGn=h^IH*Erdu()_$- z9&JNob91voPdw%DH0y9vajKC}^4QCFSz3f*tqJz=vnKb!##hJHU}F}+V4Gwi<` z<@j%n&Bn9;*ONR;pkjSu(s4P)a6Oke@$lD_pd100vhj0=vhk;(mqN&uoA_z=ig9I3QGUG>cDXrjDdw%Q=kMw zd=31NI+nB7IqxJarq&Ydvf+@0@bhj5JU`}^)Ay4){wvY9obF$79skuY2K~DDNB`tk zVLbyR!{}n}OK!b%_;qBxbh_lydg&y?$a?wztR?uF#6BBwIN00gmJ`M719cP2@jXiF zvRuqQ{3kNTxz_*jFGu^QoqM-2YyCG~7xKS0U#~Zx*Z-3|B#L5og%|!d1jHTq^v$|u z!zH_354jc7E1zCZ{QSAGe|{eN%(ebc_jmT*?mI*8er?RK|6JcJ=KpWL-dcZN|4;HP zfgie~E=gFN4Y+0DJ};y`m84cM3E!g}NC^Hg3NUE3+{jg0)hy-vd&6?{kCj1^MD2S0 zGEJrI_^j?R7jwzEG)j1#bU7wH@mYv(lb8hojdRw8TzgyIQLmd zV@x<9Y8D}LtkEMwKk!NHCu1o}z2Ct|;KqooJDbi;MvF|(qhf}$xG#pJ9*csT^;PUD zrVV1pM0{p z;+UwsuZUrmQKO=@gz!t9>u?lPJ7S)lD)I~Ovv7E}jE7fW1AAy36SrINBl=5|PvYZhPnVPC(iuL?n5Q4SmS*ihhD zTE~?LX=CV=2%Z8LV%Ox9AXmf>h#2P#8irX8U8lmp?f?y0Jip0M- zg0K@NzP+Oqvh&eFH-en1PB{1bA&y$eJX&8u2O|8f^}IF-J)4Mz(l=e25W7c-SfWTf z9>tV+6Nm-GjTz^tmga@tV7y-V*V|uVUnv05=`Q13>Fdl6Q_#)#s8J|lUJgl-LE7a*ba3S~l=EdqHSSP8kS-~|A`4J`V0JL_HmheUnav&pXiwaIYgukoF^w1y&&xJ6 zQ2az`yqrE`{eY6l=Y@U1mJ*Mh*3>XHlD3VwWU0feHqDER3(Gp_!I+H%Zwy(2Do?*B zX0WKgCV?U|koNrQ15$L%M!3hMbfccheKp-ioWh0XE`6F@h$$(AbP$NDMeL^#QhRrv zBihHWVsd?FErS6G0oZ|9bXgu3>uBfgejC8B{yp63oWb7y$>H(8_xIZH3-w?pilNzr z=IeIj>-NSQXf>K|ux96EXLrA?FAc2D+0NO!PCKn_S*QD*<9DaK`<=G6z5Oky*pv0D zsFMPoQdPb^ID(y@cMcABzB}9pc)Rl}ygM>p>>M5*|FXXadk3A)HP4(as_M zJ~=);Tj{J;HI&CTjkgD|t0R8_M*cEt{Quc|^X;~c==Ac?X3o%C-nMSr-(CPosFe3uz{{1bc0D){OjvA< z1HyrTkf|b?Ghs-wIF@o&zEP>HFmeo6eq)lx%oxhDhu}RyS$a?s#sX5rM32}}E>ffe zk|K-is-C)IB^vOOj6vc`5u-4)LZFg~KBsSPa{H7f6cP>gjU6cS5#vxjvolle4!u@T z;Y8mkrrRQp*(LPGgWL3oBxFcM3sUSB&0n}Krzu?0@k_k&e^)nu{w^r6pNSKmK=y^b z6JB_Zvm2!}iBZQJjq5<*pSy2fqxw`%q3khz6!Wd-)-E(P+^%yC@M=U`U5uRIXM6mSi!w zE=g0dh`U{O1Fnk`|FWC$vHY#FfV_N51rl5r_yAlVp2)?NCK>&^5JtsphJx^#(1JF; z!m$2-Ub?Fv!jGVm?ut!~%hclE;4z5|>9<(I`$o^Pt78D;$BqyObOM1lETHRu*SRbH zj`=9%|DXKbasIq?+aT>mq|SgQ;$5@iT}!=_vshUZ(YcRFcjQJX*4s4+Q^RTsTd>g- z2)gSgicE%h`2*Q#$_&V)J}_dFa&b{~7A4$kF}W^_qj5?6I62te|0n(>1z`E^^lbO! z>~uoZYXU&Cp{36gwS@yT^Y%8jc&S2bW`(V$UA|T5;F!iix%|Tw-_x=PDiD^aST&5+ zi*otd!`>{k-(GGU_bR@`u-i)xyFGu{EiPBb-hld-a@S4hRmd_Pjm1t$6CqG8%n(~s znVJ)_I1Jz=G;cPxHg|TO?`-YRon~`ms}3>kvou7}RXMD|OW0^On@z|0b@y!V9|tF$ zj$(*3IJgqh2Flc(({b$YNnuY^9*=0}t-2K+bmAsWO%VKO*6fdtdBLS=IdyDr%Ms@jLUGbN}0Fx6AjxTg~R?*ZZGO@s#5KlF`Wg z-13@U%L%CTuEJO9X5p0}6Co0gvThXefy=Y5DAlDfq@0t!U`Yv02Q2FkQozG$5b`t$ zyIG3K@PuF-rVz2d=M318cEG4}McekpgcJIr>#5&SBI1pR^_e${`_3gDU$Z2@8*41= zxR&xty#wp`?udh{aeH@x4oMhwphpry{`^iJtVk68NyF63xQT!wzh4eWoYxtW#P_bk zC?Y;fQu1A2y!L!HG_?lJv>PTtUZqRp@A!zN1Ddcx$u5oGhkX_WU7GYA`A&|ikpL%s*K~No*@gH8Lv-ixW|l(Krobzu}MEfccj+k-{pkt|DhpPN#FF zX|CzDo8I;p%Ps%sJyrbQI*vX_AG7)Y=2ok@S?2%k&9C`iKgqKK?t?zgirgJK&V#os zWVEx=xlZYQIBej(7<9+xt|1Ssv|*}B-Y=CWxig%jo#@JJ42#z)Yp0|ytDTX42Wq%i z)&QhF4%<)#g;*%}%eL3_no?#p*Fq&{I`J`~y$(#j2}cc7KMMn@cfOTTLfuh@x)05A zC!F+ZhrPEfJx(a6aat>A4ym!8Hx~1Fn2v-z%$EbnXTwpJQrFnyH=NuwUpgSHsD?ZE zH-JCNI?!%5hwAr`4p}npKx=Db`%Q>1Z9{%jrBzX-+1`8;Iyg`NpkySkHF*bW?r+1J z){o%+Hsq}zb;<#J#0aX$@MjEr1t#v5ROiZR$Lqd~E2~<6 zK;k~-sN*N2Q54d^E1-DZmG(7DE+a;Qsn!pT6&Zxfi};te?IJ~^OqbdkX}j? z=!HqH+FNMEX_m4iBvC#%7ZK*m%lt0kq3@bcIPeh*+&rhg%Ej!ASn$TY)a$_>2af$` zF4}>xr)^W>G59ht7Rk~9OTs^Cf+j$OBUU&YQqUewDZ?pV3wubcVM2p-XGMQTW~ejc zj*%=*@r$z}<7!|DK=&81m_$kQVnjF>0xiB+neb4STQ=9t<=y=2a%LZe_VGu#<=p;H zwQfkCXI(Vzz7EqtD9t$}t(&W-CmfD{5fq?zp3dD&#Wr-qrv?mI=I16;cSQ~<0 z*uE+Tq>DOU0ihzcZgKen5(1JEaSq^4#QLY&C%Y!z)bt$V-I2P$pm}(&I-pfVO@Mb< zTZ}%@NQeZ(Fc#n@uFA<|*#`}?C=Evubxl9K;jF9(!YITQn*yBFv+nx7z=B1i$VeoW zN_H>EQPHZ|)x@%2DYcPzCYTn%h;I{-!JL(zJq+{`NNA5HV%9jU z4&mHVqKxuxU8P05`8`nZbk{^TspVr-&`3+h>S+oO8_>ai8z&Z;4m(HkY|xj z;hjF$>vt&|v557@uSCnWBE<|CPtlXrV4yU5Nw-T6A6&SmVSkWzV5^x!XLWE!lVJhw zsrZ_Mvgufxg}5oWQ_bavf9vC7cobCnmIYJ=z?6DV7JyuTVvl{uMT~qw;mj%cdTUwi zMEl*t2p#WLT!Y0~_(He=mLTg9yYOX*_G03*_;Y;* z{@kmUyXh%iPQ@W$l&~N}6J3E(-dKsk9`(n5MBM>nmmC?g6`<3NSsMCuvd6NjuhkTN zWybd08>GW%MGjTY7SC_`0#A?Gd+N*y9J(#eWpHLW=?fep?OCdRK^G}k2CPHRv4zGl z%ix+wi-~{+LQ18&0S50gA^c{sVO-0v4D4KD&Vbo)><|L*?ssRU7*t?IbB@|29ZMFN zGmP579~p_{TNMGKhX2Y}wAZ74+JV|zrkJ8y{KhOurwkK|K;I6_BU&la?24UW%F#)w zUNm2{vB85I+*u>#6OQds^-d-)Kr_=0^hm_1Y;QcG+JJ3}B4lQ75%OW-vl!S^I0 zv5!vn^01=|R6}S+)1@i#iu1xoH0CMsFI}`4j!EQ-BbeJ&U38$9CIWAwAr<3SZqXzN zq{);XkM4%cldy?+yaGV5WObF1#@Z0_35E84Ii*9Lfh#W zhGZoEz*bEw%6?3-FJ(`zjV9sn82W-2Yiqc|Si)GW!UXo;o*GjyFk{K_rm!Kiowbk( zL7q=vgm8ntNB9kXKC5i(K%N=4Eo~$L{{gA$GH58FHceLae@ba^;zr;a!R$% zDY|A+uc5A9&jUJ&*qA1@yo^*ZHN8#i-Av66YA-VZEHU@niXyGzKB@qnRH4MdB+>(BWWQ;a~ zc^wEcigwT}%A~nf?v}y5Njo_>x}r%E29$fbGR}0OO}ZpgM}m#QOEmS;-V3&2>&gn? zIX9Ff-DAm+q;()%9S88@SyW=ZUg(Enp)sFV2q@+4uCUiNiu;`4k%bMyj7X4IuF3S& z6}G302USFmnpzG5)B7P8uW;*Bs!Lf|ob!hv3ZytsHIk*wQHiD3kA~J5g+Wq0xZsXPAvD<2H{B2|R*{M7fhAe)@ zde1c9e@5cqndbJ-(nK8XeC$tldMb$)Y9zR#Ng8q*c#+~~ye27>j7DgxkTR$pzurB3 zdv@^KS*Ouh{cwD=e|~uUu_L%)y;cVr^DLpb0Hp5F@)VN&9rmW|FCj6G!+Yqj!YU zU0qwNf~W+)-eT?pB`((G!Cd|D`e=9m{QKS4yKnadc*h?*dRtprfuCb#pem(S!K{k= zt=kojydvZlcAMb@?o>GFM4gnqp)F+9P!+nfV_w?!Z zIM;?kf#2sFm&)BHcFL4#6C@10gtqdNMoB1OTWZ#VjE#I(k_W1KEf2*B&sNdAQb8e} ziMjMRW@gtbcr5(D6pzf$h)P!DQll1U!!AvRSz`P|`!aBDT{v_N#AA4Y7m-Z+B}|m1?!Rx|j;|jz8gT9L9aqS{7^h zWeu6X)RwM`^Ofo-&Z4LeF`MWNeE=X-V-X^ES_gl?nDIZ*x>w83*#lVXkJ@Os{_Ck2 z0f_@5&IGY;=f_tEb@37Y8!gdK#hGl~Y=Q+aI*#*xc%ydplPr=4ap_R1jun+-nmGJe8z{e-h=!BI-dlvMSaA z&41J-NsN}X6-K%4Gt|%QcHA3}9uy#!nwAd9)#81edW1u%e zDh;pby7m_VmZkE{4Hr!9dGh>nA#Z1Csyn;59)u|s8}d>2J@r$W)DPbMet{*5wXG0< zEAW1J^K%k)%=t~MmSh-q8jZ&LI0zf^?^gS{*YuiRtFyJWwbgh(yh(XXV1kh(#$Qm062Kb~S5-AoZuB2a?eE zNea0fhYTtgz<{UYh_1t0Ykl?_5k0oe%A*0UJR-}4I-AsA8X-4O% z^;$|g>Xi@(y@MDunPfFzvBba-rBC} ziu9N04s~dxz0urmZ@k#{gDui)5kKfX-`;Aqw>R2;yGhA*mp0 zxldH}rtXe(w~%Ddp05fAgkf3<+Z)$Uy-JZ*fi5E5NAW7N!j9r=H_annR9~^Z9J*$B_}CeU9oFI zH#hD%otsxSnX8vMl@}|vsw-+5$Ge&(FEnMXyIpD)gIYh_4JVWWrOS;LFB$BcPAwx^ zx1Dg{kr<*(~!_(m_4b+KY{6!>S?a|6WG!3HNRfg3`*6RY0zYX9?h_9 z$}fM`)hy+fO?uV}wmtgg9qfDZsznwSftPvPr?txxG|mA%hI5zFRh;#fPy;H@8@xP~T+r@1DxrmWx zt`1|hccrWl&8igIL+=HiPFRs=#Lk1+nC5@x#rRjcD^wY)QtJELydev29QVEzWZ`;1 zQZ6@5#nPn@J?ycB9-YEF3oR=06#kn?^(?Q9p(tbTG%T@Q*?dIwO1rR0(s-l%K)x6P>7!{*@|8yJL?hqcmqr|OAuKh^7`L?` z0O#giKe4XT5Um zLz2bf6iq;yOUf%Vd2d1O=)xEmQQp>~FQW82a|L}q$;svk_WDGVRLJ5Vh}g28$U9sW z%`OnQg4V z3u6Hsrz(Q3=?8k)5weXqk35FpPeDh>iyc2fpR^|>!pmzY{()u^D=Wamh{kC&mRFTB z0*{~tA*RWQk=N!rHRSRC_y7FADeyE2eNji6cu2;CHj_~RYoSLyAn^9+=-69_eQBI} zEf6Gm6OMmqhAhvcmvoHQt0T0}DV#&m{xUa_3|Yg^l7zgKd1-3-vvPf0|g z6Kj%{CPgmh68^&U30HB%0_Y`dXi-nephvRJ5Sivk+Vj?NXe!|PG{jod=uZW~81qi+ z9vu@`(Db1LXRJt2Rg{bNOX}Xgl7jITFu#FBOY${Nsk~l8XFo^IkJ9Sd?yCoiQjtOI z>7<4$CgolSYG}HUjXcRm*ERb#2Gii@DfR z>D8}=%DQbL4aF+K*^MIjUHZG=8N8vau<|gcPdLW3g$e(%R+JZz3q+ZZ=*n#sAr4ft!7>fUu(w&yIoA-*rRBeHohv>+`nHj93 z2-RJ}brdeI{*Qv=AifF{hKgMh!4*kDX+M}UWbR>{!{=BTj+N;4(=TseK*>lNla`D| z?TP^ZdUgJfgWcov)5CuqplK)Sn@hH;6&_)xFCq;&Sr3kX$xS)UZGyH^Ex1Z+OI152 z7)YxmX<^#VEll&!EqN2=ATCQz!i+F3`Yss3ndS6j=(s?+dpdNlVl@E}`1#~D5)7uK zAqmZ0CGr^C4nUSfD(9%Y@@%(uTE?R3ac;mq)&183w_gI`_T?7__7NOE35hrjO8uxH z9X#*3$~-F6&K)*>ge>}JDSL-#Z^9d2@7BwCmth=q#3tlGDeJgASO^JKrj0N!)oqfM5W63-E{Sses7xS#Yj%Y~+IFcy#Vpu) z4)Z)klTLwdhv<~NQWxqMl*|M#6k|1V^Jy;F;_SvI!v@1 zPb9e4n35r+t=?Q0yhbPEIgz_cJ=el9Nyj=A8IM+=sT%SmD=i4sm50KLav#fE={!7UbQcOU=-7hPHy0@;lTHP8 zilnQDqnM;bg&I;_a?!DL5S1pKvNVeC0$)(00yj0$CY6@)6POX_`y8*zSwg3WspY94 z6+^FKEU`+*@;Z#9_%6s-;IlS=N!0SJZYU#*gIPtVb&v_rq@ELfpOS)q%eTJ0Rp-N#i2@0glnb=2d=kztcE~ewcILcmlj&m$0fm3Qh_Jo5;(ks~qODF^~ z`w9|_IBTN2z9E9^kPk|Ul`1f&=G+8Bk{Tg{E~yN$(llXaA|PooH>mc!^+18IJfxsU zuVEO*S*k2>NfbGRbLPv`0Y(=g4Fi2Pq%fc)N(WR{La^L}_^v!64SeetI^ zzm??JwNZvyUr|ffkYN;%jzj77Xr+ousO9Cj-jS4TbuaofZi}AnX(q?8$krzV`I`V~ zLo%`j(|J97_+X~$KHbgUH*-t->Ph+Bho%34&+PO6`G7_v!M4-UJwn0H$^YJLZnVnz z-#4DOzMlU-#q;4q<0)K)!w%{{dtpR{xcPD@(Bcnh2c9-?4K|)S2R9?-erY+%nsk<` zoU7xAs1+_(x0`>H$7`8l2HA_|K%%6UHQ^T0B#V96-oQV@;c3?Eg*Q-h^Tq^Ia3!m5 zJatTlYTbw6Eo1m2BayrXC!>+{I(L4hvUMzRv*-CMXH?S7oE)Ae9#PC|FwbgjxHWigk z`+Gs^%k>DKng*xPPksoSNlBB%rqa}mqW7n+{Lomd=&%y5M6RCClSwIZbrY!ce(9nYnseT>%vtk>f-p-nzu>(s2nslb>Z1mA`8XuVKC#ReV%b~j}#W^C=TLT*txrohj`k$0g}c_o&qO=T?h#wY()Hx_W4>&l+hpmtunyI_;WawD-k?k-hSE1ltAf?owc z8xC3QS+}~fGcp>LBHhY6jLCzVr9_#mg#0bmH!LNEV0lE-V52FqK^xF$=<$I(m{dWe z=41*;G7CuHcE?4abguFFaH*)Z3*gL5fV%uqx?-mS=8Adn7KbIWz?j~+g-F$Qxn$MQ z76C&=R=*2MWYq^miGt;!P*OFtMZi$b33tMYs{4RQ(a<~;Rw_p~8<3*gY<|I7DO_4w zHSKBUl^Q7f1nMzWU(lAMie);AC)%mruk)c6{V(q@)KUYFH`Hm6&Km0HR!n?-KFKp% z|7Uc!ihNpwZnd_WU-f^V;wiByW$Te2$}S7HYNZpVr?$F+g^sk( zF=6u@+eRn%j>CQ{_u$CvGq(_{o10B}?_i`;O`%in5q#|uQ8NCSWTc{94P27NX*g8D z-aJ0&z^ya`{$FSv&?U+Shtm{XX>{xd(8zcqzTh?YBN)l1Ksnyns&gBC>=q& zsp`f$DizS15oTC_`J`EI)!X%ry61WIxc)?k*BMYq6B42kD_SI>S5ep(2N9nr^Qyd+ z4V&U`MJE*Nrl&QhXmrz^P z0My|3-{;|nM3J^uQ-Pp$xEYgeo>d}o62R59JV8Dm&?vIzHsYX?Uhqa3aJYqk8+)x4 z)3qIfx&!Z^S%+2~+VHz6D{Z=3mGwb1tc|GgFdNhBD2%Bo*-z*QTn10xHQg7#|NGgK zQacz%aY)9}79vN1wA3bXz=l${VCrzGE-Ex4<`K<$FbPs$258h&gTWGUq2+DR0G{v$ zJY8)x$`GBXv$7hAG#x?8vkIM|dn3=H6umo1iAHneCGh0m@e_EWXiPlo1XvgMsc0e-LdrgS=?~2R#!<~jx4>O zVlqX005M;(sAn0etxhOwq~0a}PE#T zJqT>H)~QY4p;phwR1;H*b{h4XhO5?jXLa_z+EPSRdyoI(OvYGpjb~k}R7(t?o?oHo zfBkOP3spVaPO((8fQ7=V-{l_%M?c`dI+TWX%E+6XwiD{In6y<;f!hlsdI#zeyDEA{ z&@TXzE1HD8anaCa`30x2Y#XLdh2EH(7QE5Hb$cuk$4O;}I5C={folG_K-kr0t9jw6 zpxcA5YIyPSp&R-`4d?bY4?tZaX>BScs}+1?i}2n_#8WR3*eck|qm(|iI*h}I4-hjc zyH0^`@satTYe*yrrjMrxRcQc^2&5LhD-cEe$l~o5XC`%6C4MCMb7fI&$AycY_>q@! zn#jL$=iuVlumRW2b56T5u1XqG4igtsFYRGl=tZPQ?AjeAVeE$^62Z@$Cb-oYIOKMq zhGO8s!Aw91ZXWso(U<@F_|clB8Ot(%gK1ulNkWEv=FU<%e8+8&(^>F=G!%d zaoviBsd}=*j;*%NSKH^So2pbfT9|D0JPbNeTivKV6yRqpB~cFjlE7{(2nK4_a#&37 z-qPq>2dpkO(k*wOjMph3pGY4G zmBz%ttzPqEnw(O9y{>&J=1=f~5Uchk;jEm0oMCISQI;*ja(fihH|WiDLehK8yL9(l z3@pqtPlF>Zj~{1ApQJ1q7oiPG#g-+}4GrxwNXij|y)1*CRPd~Y*QV<055ePHE|}b$ z0hQY{*?6Xm1OLDF@9Ss9hDEh=Q4L$&L^Lhk_S|+S8-UlDuQe`HqZ6ykQP``-V)aPkD2$>#fW&pX8jUgLvp$k`Bi6Ek-IYML?R_ zQOP_m?`>N`tB0>zF2pP;g?^rW94}4@ti>#yY4@c{7A~=@av^KT6h|GXiSt}-N+B5m ztlGv*f}|V?{>WHLOMJa*k63cjc62*=^p(l@D`MYM@m6ZHK&`q+tuB<`tWNBK#bie~ zi%Gu__1Oj2wdItTbC*F!r3trNxTal|}tf3at_{P&)9?`8QZpE>eh>-ly${@e5C+h6tnpX8Zi z|H=I%9Hsvtd|=ywuAv7Mta@jPQoQd8r^h56K&{$lxVDZvx=iQFv!U^W+LxvCacidhe={nq4n@a!Ush>UZkscLtYITBSu zG31sGF?$sMAQL#K&sQwUhLqbu>Ev7}M9c4%tYKwp2kTkdh&O+fslyu<&<-@8Z*ESN z1#{@`&{2gLxq$gyK5QAh58l<#HaKEFi5ijw8)X~g+V56PiNQB4i;F_rd{iTmhhgZWk0>r8a^&{C~T>xmn`>?XU9RCwfZqUsZrzDtLivcrJnTmFm<7dgxPJ?3N?oJIW#)0c z+>QSrLeP4WJ~?9 zXmDFgV=}dP%)N}$!&pT)R<*=y5{(9ABKVCgC-ntoB!2wpiMO+Y*5=xSO8fVDa30(g z;nd&VX#nd~Fb@xK*3UR&I@wl1v(W^+o*V8Gn{SM0S#Kb^wD&#O&r+_P5U zU52ypP*RfgX?nZ>WR|PuqawEq(NZWbSFV&S=3;!#@N_1ETJiSz&b^KjmNK739XQ)N zcJ4LrqWGlTv6=^*kW8geLY;O4db5~hf~*Xj3fHsg?89o|6b&Fwgm}m&!Lh&QVvG_d z@6fhj8G^rRUN^^UuB`uDP~AC|^IF*xOS>WF<;%B?IgI(MHNvNSmOB4GlK%Jk=0yCb z=H~OS=l@UfEPUqrB5!bvxTJ+8OGc6+h%u_Ow@aDVYQvmoYnC5E&0lST;Hz#`<@Hb}B487nru0R+A+eZGk#- zW^}H}@#d0y=VJU{Cp3GM_Mg^da}Ti8`%)tu!2&%gSAeUfLU{l^_- z;3Z5qP7C%Ge?ilY5|r~yHy+7c4ItkHanF%k%)}7}?_aJ+G)V6)}F_U1;b zZ2#5VXnxiIev${xcSvwWlQiTs(ARj}&h&-XlCU<4GXD~4d0|iI^0!j6Ri^=4FK>6n z_yMPi%ufHpUIRvP@pfrN%ZLRs8r6`-#(m4)9VWla9%WAI(=;I|?N|CV7fVc-I^+=) zK724@^~R*N-%Ou2wHLC)26)%frK~M*JXtsvf_44AMC1j#t1lw%g1IfIj=C`E*0Vd! zB4|pPMcl+C&~v>JXRNFpD8+v*0{z<9;^;CfE3lXGlnn*dtFEgD^SWf6Gtreb2)VXP z{d0dngDj#+ZUHK#Fza>EOR!v{He*WEYTxxS$49A)iEjlmsIEFItbj}vxfc=6i#<(z zDo4+ltT}5?cM08amq-oE1!h<}4#VBTE-V&hLAEvNu{!&(T)1Tf%Q`F%kt(0rAyDv) zK05%4DN^=q)qbs(hpkG8BY(K`#{gknb{(Jya~Mv{Og3v;^nW5Tl08#-jk7+tJ? zV97ry8BG*^LvBuX-~5meAH$%vN(K0UU7yl44dXuVTn&p~-;<;W`tasF$LjeYO-C{i zj8`tXFn=%9YS7egm_W6SX(4Ojzl(?_VG67N3vO>!c9M?T^tKNc!R;T4T3=f?@_Qrn%J-sC?2@|jrLdZ^X{*RNdaPrTDPuo~}7-D7xMU)(O> zq_J(=PGhsN?WD17+h$|iw%yojY}+~0{@?eU^KD>jYX9O4XiOLDH~fq~)#99E#brY0cp5EN^aZCZDK|Oap^% zfg>ezlX|9rOk9MML9(FK<-i-$=5$}qV0%s2SqxO`iW9PXOwg=Eo%J4I{v`izT2?6!yt9D~rh^)j%2xjZ-Rwmf0W>iw8uDDUYo=4$- zOm6e}zb5y|Uz0ln7K6eF&s2o9!{*S~fsZ^r)9M}#PmQsCLvZx6ot4~Aiu#JpP8y9w zSLCuAMP>fkLP7I$P`UG)X<(f2C{vDT+6++p0tHq{TDohF&d4$;l>XB*;x{qQgz2>6 z-h)|OAtE|`MbpWnVGq@L5_Ew~xDHmRJ-(p2i^Cya4xFEz@XM$_gzhetLa-ld*}?OZ zVeEJzKl~S&4@>sq43JGGA&*KRYmaa32vFEeGw-PoW3G%353h`0_XfPDEzXkW;B#ZD z=FRR0oZ_5keaKrro4#NSnm4Q@xY)Fc zv7Kh7#&E$^ebF|gLO)1ND{Yo{$&4$=iYcLA$8E?^6TEvY9;^3~UBC0lD7%jlki{H5 zgL5i1R2fH|A2n=FqW?)IgDrv1Q2LA}uSbytDsIo(>@fD5DC89FzHGP^^Vl^-P;$qa zrg4wWUA7B>cAg6_X70u(&1ri;+*ESewbP@rRjv&7MT^K-?vUS$n~B8!WzBOoV$sUw zBq>qJ)B^vLX^QmI<22&ep9?>4ZE=SQHr;LJp2PIxd0cfF}r z_n0+$#P>rImZCAnCf$qS`{;Nd)HbD!foU=QTz;2B~4cU8>|0soj1+cq+aPp-NVC(A%G+J&d2Y)H79 ze!gHj(pGZg9`%|%+Qt8%+;F^nX0QO1+Zjkpf!%8uvBgZ-*xG1Opwy?%+c>VSl{W;$ z7|mY+p>_N9AIj~|iwi)x?XLd^<<>6H&aQH3u0Mt8oE)KQJq2m49_t#-1FNs$sPSexzQbm@+M*ri0+ZuGMSsOe=gDnOsbF1 z2SsU{12wmrKV^Y$w}0blk$N-04Yk)>NL4$(j1%rywF)?cAB(OKBN^RApV6eq`DRLt zGpgkwiZT&%<9Jt9Gd;kg^43EEFknV#^AP4nGCz9SRARnn*DPAPhrhl^r=f8te)g4y zq$a{IgJ27@!xRWG#v$D>fE8ThI?v}`!f{*!M-v~5SJHgw_qXbW28ofv)lfzaGO_r| z?e=Q;r#&9f4Xi$pRS#AavaA1Q(mPt6!x(ow0RFB-=N{&jXq)JKts@#Up z##g8Tj5{&Q2=m~ddI48%oBWA@iyq8-oL%2nik=7@cVV4fJrk1SV5Ea7rC7b#%o5#H zZ7#VkCk}_~PXbdgA0mlSX86!Ih>aUDC{MYMg&P3j8$z2}`}7qK5m)};dw;ebm^dGL zX0-KcYm<8W)y($m;&A!liwd6^o9rCg*bJkc)ra6w1J%iV&K21MZSHJbE(hndW?GmR zfO_xiyMF!lXNScvjZHu6S+udWwn|$58a`aU19YIM>br_~Id*&^V8a>6AqMW50bFij z4qVY=-f}unW%~(x3=i5!5X_k%7hH(!zb<#8Xwu-)UzgiX^{>kf^+5vT9yYFaMAgZB zkb7YLgA=&Gqwn&D2%@Tw%wAs_%Y$|nTKt-%pYtHUXirZX3SAf-f;D`2E;la~F`GO+ z#{>#ZRIU&S1R_C51WFDd@m+lHDqaVS%4=fSkv$N7gAtM!vxHb}1wouaiUz@cGs48q z(SmAcjzwhnNlJ#>65and>?joW{W0QZ;@ja}$h2WjjN(?S$(Zrr55JnZAW_b~z%3F$X)E5O{%6k!1~~1K31*rCr)L`Rk+sQyN^kV@V;7XXt`PZM+fY0G2z> z50LZtkLAV(u-rob%W@l$n4@&k*S3BOWs;LX4fl`ezEAjxIF9hFy7wJ#ds?KtOCAXv zW1vo32Lo~VS;O6dqphKHPg`4?qaq;+h0D-v9dFoYiHu4rPJ}BuL{nZjr_M)YjB=lB z4_nQKpt`JVeWADgFU$SI9Rt8}GiDBCXJ~u_h7-yuWF6&wTSh)@0I=NE`Z`e*A%9u! z29eWMhYIzgA!IlA1)_)=A8bG_W=LD(bsDSloo)|#QXsU+A*nqK;K4CHN-EI%AUj#I z;1%g6PN`s4FnJQ#{ugIxK@t!2eJq&@Pz|ZZgKImYdP%Fa0!S7CK`;WtP*tv zl7u)S83j!zn;rG9px|t+l@ex!GW|-udlG?Ue1#|T!8Yequav(kHw5s*QrmwjH?J^2 z!JNVyco`()7)56ARU7}g19b+B{Q45~ z(IFOh*8ykgCrRt;xx8#-vn!05eZNODd|xA|rD9JU{Er=hZXX7-D}W^~iYxY{?GquF zT%bTVWAVKhn$8`F-*Ih%*c}f`DWWBwDls1;!d`pLa5Rt_|B6#=wg`a062L2=%r>H% zHzF&I(E1s5e77ZX*6m|KnRhUc+fWet%W@lu{$;tD1HBlf0W7zaWcFJl#_(U3I{-Gw zPhgkTsmhf%r8f-hFU!psWe#Mp(FOtyb!5Qr0${me%#1`qE)zKHE__B9B>^d}0P|aj zjkn5U^T-xgm>S`1=nQ1}b>Ouq2c_*JdJzE2jVhkgver6HxU;)?g%D6y&Wh)VGsR>~ z@ig;eP9`Ih1cpfZ%xg2Pc$u~hcCXuKS$$TfU5w=&iz%4`DE-eRU8aFKY&>zRQ>xG~ zo%0K6{XLk{q#|LP51zLkfs&>h2cOE1?)ugwyH3UkzPoRo!I2ohF)kqDO2!Rr&;cyB zr(Md=#u(j%%-et&-F7Jr7N3L^%{L_|wHCWs5+prM4GpV8zcNLi^K?3`G-5#@cS5y7 zx-2dnKyJojtsNor$parjiA&~*m$B&AyCP#U`RWIvN`F%FotuBxmDQDcz2k2~Ga%C6 z@jo|phf%8@#AwwqGU@V=04(=LrJVD3V~exnot2@F=MOp_b11QgecfnO#_vcI7U12q z(*Ia)$Zy#C|I2d!Ae2DXRqzL}++^n6Fql7~+8*K=n`SM#&G-n5e{Q{sJ}A90Pk3X} zC_@FAh1w5oQVjp*55Ck#UWg0`ea}iUKvFt!YYd_nJn-^wxH(oB%JbxJvCBJoyzDF& zQKHs(HKf@0R>5v#i=G$Bxuv{;IQ8K3)A><4o$#0ChCU6v@}2;&+%o5F;~+BW4ZeKJ zycOz0!5}(vZ z110xng))O^F*)`JDA`*^X5Z3MiiRYauQQ>0VJ#yfh#Qd84LG#;QYR1SK}x+5$uR?1 z?i?`h_P9?`3x0nAU96uM31hoA7yQx6eP0M5UC%u|lGiqbYBPQ9jbC8udgPQ>`4_3mGJwgPEn1PX#AF zA|2y(&XN8cE4fsSP-dPlBYxLs38RD*)dA|NcZl5`F~xSehv}cn-Ly%mNCXLp2ekiH zxr;Et&@8{jP!+$5@`k(_hOuBwE&eyA@I0QFT87BVm*4f7O{ z3Ow*!Gv@N88{56wy_@*_c!;pE*{NCpuFWO{i&C5igaWtiI#7kG4ckg`4x7DR9bqtV zevkAj6a9Q&fVbHpILB6JC}OG%t{Xh_z>!ulbR>=%RZb z25li_E1>iPrMt9V(}Mj&j|10bhLWSfavjYy$yVQ5WogoxN1uH&E`RLaaHp#|Dc@xGQ_n9{{9l70R!${pJ9L=}>&6Zap=z5d>xZ39*ml(Y5j z!hei^><;*S1)$t99>Z<6YX2AIcKi?J7Bn-X3V98|%>tm@96J5?wZkj`l)E@db=plJ z(m4!%51c3^Yt_`hUr8T8mY;m8-e5J9erNN5{07tf8K z7(^G!Ou*`B(!E+aF2SGamClT7X})y-!IstzNYq3NW#c>lQ6fn8zvJ)-FLuyovI-bT zGq#i2T~NF!f~^9)!Gte-h7&-fE$J&jTpL3`S!OD>#=#1_)-&)Tg;8;v-yyR@*lGw| zcpBKFrVMYF=6^V3Lv$u*Bt*G#W-!xxja$kQ%F)VJb$ySqd;)cUIhti`N=vhY>4B$w zg{T9?lI54w5@tZA()-P_MIeqY}7g)io!Sd|X;`YfCfkOfn5Xa%21>x%B`fx0A?V-}DMNf4(~BmwQr`oS{YhZ#nL&F9<82 z7CWRkj>1`j_pY_~`whCCQVu*NN4B1}v{whV9%B8iK|a2X}aCZuhjd?7RDjez$^yOt$Y&7pe~+nW3-ZLkc^8{uc({@chtUl{l6l& zfjy;9#&aQt`;)EAq~f~sbc~p%rrDq!^EBwBG**aoQxakOr*MW3VC^X%fH*u6EZm5r zfv5x!xvgVrwK$5*@uO5Z2QpeapP9wOS*<^%rzwi4`0{@C==d?}TgQ^!AETZh_c$M$ zP+bF0_Rs0lp+Y_n|Jnb*0cyHU=tqPV%PZqhA;s z0`J@5r-1R)&Y(6pwehlmKK(SkDMK#qzAY1FdPtU|lUCAD=32)jU^V8d^c+gS&s6+> zBDcbQ+|3%gC%&v$D)Oyd<(YH1FF@p8-rZ+Yi%(s@pit(jq|rmPcA_^MBt<(9_I8_Y z2lN=zOfu$_ zCI}eMirmPiT}M=zR;}dZiBZNJ}E7_wB>D-liR z*vv01?%rt9638H9G00T!;pQfq#{7P-k^6*{{y1BF;fHsLot8uRa-Q+mJR4cl;lZWl zH#LXtTsfT>@u`%FRkAjYmbmCi0(|$@5R9U;ji76CI)jlBSJGblSrB-%m;8lZ&xX|g zOjFbVL~f$LBKO2@nqu8&f40e!P%|~t`(KfJ=iIiu~azB%06K*a3&gszul6b{3BsI1(Foo){%iM$% z#w`LI9Sr|hE<}S71}x$11W9d#cH-FBJu}uPKh_bo;D3WUCpc`|YLHW^Ex#ILdj>wXl;L?F!5uZc8)ca%dbJmaN7Q8R-loG_;R0Lo#Kp=^L+Jeq-L z<8YpySE?N+A7!VAO;xN;T5ye#UQ-96Mt8&<6$p>p(2F&f1WHNM^1$C(*Jbw zzB7&9k|$6^7Bl3-2JW&L)IeP%eT_BD$>;p^(;iFIh40q()^QR2ZgQrsoU4~9DLB~{ zq@GpgT+Wj?Hx;e&jsn^*Bi!M>3|2D>*CbP6HLwR_r!&BpxwE43I{0oZUh8P513VbK z_Z|TSsGUl{K)em0m`F1Ym))e$QDYj}?~{==mOb9Fb z>v0eM^|-zNdEAQsdEDZLeNdozB+>VF`Vkcp&h>;Hq+z${=KQ@9Mg|o@`{wz}~79M&APmTQ|PhtxZq4g8%Ms}~Oa<&6@=>wey zPR`e^haZCB$e1U?Y#}5z%Gl0D9P#+>W~WZ+<6!5pG(n6d*ebpN29hdixdB`B2)(}1 zC5ic?w>7i03^u^{1T+*8cW97*vCa!dff4Tr)KSrBgv-E$m5nHB#)R*wNvU15x01be zkGyV*-8SH_$8Df}PksaNxJmwc+?I~U?6AlHk9)*qq~OqbM!`P$aV&5ElYaHD$6Y|$ zNlaB0sWM8uL;&NUY!TJI@5n1TCyn~MU11bL*#rn5?LVgd9DEYoXrjRiy`gdF+Sx$`c#VqPXfY2BoJjgT09#2Ff3d0b+L$w)}Xv|K% zK=)4|{Z4?@l2qPTF=%!&pAjbSOk%nSzZcMz$PKadaWn@mN( zFJc?*<8>hx(4+c=8W4G!^#i3S>2$;wY)ny*WwuiWCiV3K`6SC*^)(vJIv z+@K9^L3#!V7pO9l32;alj~IWO@t1H}Zbks^(& zhXJ6)vZ1685TlTa@P?6SzedoSc44HJf@u^9`9=z~CEX4VDaoVV$=+E9c!l!+S=?0s zi<=axgPBwtP%~zaeHfNL)v_eyw!$MbZNvmOyL-%IBH8bGtfKI5SGgHjE1 zt)5~zlgaq0JX%6i&+a^zOSE>0bNUlXOmWd)SriOQc1R#pM*Sv~d&>2X|GLLkWeeL* z`s-82RW8>zV(2Lvn%ghC@);c#g+Y+%LAV+NJ`X|?EH^e|c@_y`uIS;@(7l3>yMevf ztiNyj9#!zH!(MZSSBiobadbq1%6RyX#f1F(972K!VWY`ZjLzFj$$x<1eYm+f+&kXd z=i~Yt)gU>yG<39tw?L-#9|kHm33M;AadbcJy>+CgqWH4=K0MR-O+2gP+fFawf?r4r z9J)<_p%+K()RvdZ{ixvp689erd4Mk|VDZuRy7Mr5`T6qHQRDjO5=uXo-vzM^x;4kh z9LJAaAns4n8Tob-61Vc2o2VEzq@0vUHvKl-SgC+Kr~9v-Q*e$07#lA=rlOIN&@W7l49NDKp2vFxG+ObBzh5mra)VzUO2n~a9 z-N(z>$Q8`NPbKy5O0vd=E#a6@xfL*~4E==X5Avm`h})bwV3M?bSDQ@Z+^4N+vKZ2h z^pj@cPVD5z{AwL-h&7IFW^|ckp*5b2I+PSxicmQ&SND)&~%y&rH~cy zATD%;m_(K7`5w8uD+e^9BdlejQL-kB5)HGkSj7T%!42){h-Bej5<)TDMEgARw&VTs z68{Tv0}5LHLEK8adhM^?q9Eali@E!fIFgtCHVyA`^GhE7Bsv=BbiEj8wVqYZwD?INsJ znu`UujRn%6v&{_{k+r*ykk|KM$zV!71jycqpvXz<$!dp?OWuQ^ z*dqSUKVR|x7C1b-2vJmY>&1p@jpoSUv<*0Gw8jiA`_JM2SGEFhxPkFRt)vq(kc-$) zt5N_C_aDyudpwbbX(G`rg+g7)h|WL(-X?ELLm1}MFDE8D=UenVIi+p2?mL&K-+f8k zO%1;I>p73QUtS(AcDwla6Mx!C?slJ#_pL6R#;ZOqVuEG% z$@>QtOvE)S+N7e5WwmTm%QAdRb1Sm=(%Nx;edAtp-MZFeeXR^Le^bjde2cAf$%TbL z%knO`WuErF`Nq)2mK^Oc%H4BfH=t~0^XOul+NhFB`L^G4tMa^RbIqJ?`4{iF@kp^} zh3)w{Vb;R>DZ>0O5*LmJBkBtW@x=1qIk$>r7ChXZaO*O%-ZBpJmIr{c?S<^sWa604 zga+t>jpsI?5=XD+$B}Y`T2)Z5E)cDCW)D->s1_--&|*WB1aSs$wknIC@eSrkG$w&* z9KX;Nbm>z8GWT|xD_fNqP`1ol>V4ELD?fYlK{$|H*y$d!^(Ea#F&n+xJ4+DiT{k}Q zrB@hbfrI-CX7SjFN`Rex@G=ZfiLO4mp6DTi>d()LvmZUsBTpzX@v403c9ouQto?N- z7ZrBzP(ge7=Zd6_2Uk?(r_)FvFn6|TxpYA2$93BI=1mI6E+GqQyyM(3UW>o!=+62o z(sV}rd=eFN?K4a4P{obpId?cHzmSa|iWJ@R6+5KfrOM~4qR8JR-T|kk@Rs8t=A&*A zEl;&?XD97!vs33Q6Nc&YjL@?zcM0Fd6xm44j|-e3 zq2G!GbPR`GNiqrv8(K-pK;Y!XY)JFqp%)YS83AfCb2_pjxY*ocwi4A=C(Gp?$uL+% zd6lqtiu^E+DyqgsrVb+t-i%pmOer3-U|bz+1=;m)WQsge#*_Q=sSc#Gfv_9YevTo_ zJ}i>aokRg5ul!&!u3DWbxS%aUJh8KcjPw5#?k$%8QMkdvZ)tmue<6$6qiz+A(gz@CmcbjmKtsX@HmB;hiSU$RhN>E`>+Cmqs0OU zQ8MI;bK5(i+#Qk0&GfxRcTuf#HKg~F2EHfLE-{K+v!n<0fu@E=o^ss1zRK&%8!bB8 zIUhNL?WcjV#HF@jem5Jfu3T02fj6EnWog{{IY1;#f(OhZF<=vRwvM|)Cn>*kc-m}U zAxTCFFGYH25}n)RCRBYP(2V~c2SHPMMyF1;jY_K}3Fa;~#rUYfY#2t@hqn)wY$cP? zqBTa-v0y5E0_4xf%4Uf~iJ%d}f~Jr#=pd6wKcPqpFt{fGiR|&bj2)WpzJOU zj^Q&lE?iO4A{fn5SCXZy#=i!)lTvH9_Bdjj5} zKn-$k8$kdBcS+NtHALUx68I{4<9cCt&%8(7>;<@!=loSO`w!cKP4Bvf&5iu^>GfZ~ zAE($ZZ03$Ovt-)qHlcA7KTANGTpBiAesSAa9#u9iuDWfR+j;;-5UQf1e^;6Qb}3n{ z{4lNTV%SOV_yjBHHYK=Q^7S;bH2kpj)%iP5-t#F%8XQP3fj_ZK*Q~l4F}!Sc zKVCQ9G{U~LVrE@WjM%TZ(1d?QSa!CW}C=WF>9ai3$O$X4TyG#H9r zv%sB`fAQhwbFp_SZb6WOql2b+D0b{|(a^Z1GV5m!<98ZB8LP3z`?Mtv(T#W*lg*b8 zh~YJ#_9DAoa?;S`4+TAPAq-Ec-dm>5FDS&F*U`#y*8TK7rTx36mesmtes?+D+mk3!ue$tpJG0R{kW#=E+j|hrK^yQvG z&gxG2AAlQwpy&RAhO2@)**rxpP~b1XO_^9;-Rm^OJ0fAu3~RI@?<*Z97i*4OznugP zoaLI^G;g)5euszC`VLt*!}+=))s=6NAf(s0GLdg~&Kc8~#-*b1F$4qvxS;?5cg{^i zL2K!*(_cwfP$$e^J7jW*ZTbYoEAF6=2*8^hLw0Tzx<{d)UH0=(_huB zpDEt*I|Ju9k z{|Igj?=urZ#brN41*|xlK|4Rp{HQmg2@bXkgfu>uf@r4HRM~vHL9C#<9C_l_3VuS& zRk`uqxSw_U4Xg-E6^6N@1{q?g>uk9T#?tWpJ2IG|0sd()Lw@P+n;xX9O|%>i|&;@suDH+=7{zRGbk^y9g_W`2mKd`uJW z^N)q(G^XuRWP;@_&&w1szZOzT`!xi`@s^u(e-dOMnPXrkk&JzP*%i=_Oj_oqOv+v* zYJ}CV@aRh@>flT51yS0ZEI7Jn--SE5YuSc!sHF&=*&iv?f<~$<vGB zrWK`LwV+v}#2vPqLGsbXyohPHP*8#b2(^jEQ+3SJC{e?3rLE7{Zw5g|vu(;#x%t>CrQ^e!iDgq^w&{a7h$dks zQbBm@aslY>!gjQhrDop3rKcTWTZD;gIn>IOK&0Ok4Xgb$L(to1K+%EYL=%7d!`Rjh zM83S_jLE@Ce9s2eR5P!pYj3hACxsgEBOjxT>WWo<(bfuN5plc63&_Hx7*E`h3_h>R z{cVHT@MPXfD-w3UR$#|!QkHK&Pe!iJ&i)9436Db$)y6$e8n-h@iHl^_3(SS3KLC?N z0fb7EXj%8;JiNIyR1J8+e3vxQkW4D zabMBqyU+KQSXi$|5(LgoJE-H3+wFavxcBIcrtj8uwaL}Nh`tj#d>#F2Np(KLTLp;m z?k$BhW#pLM%aOWe=)_*aLzPM2%axl!ThL$7AzSBxqEAG^2P|XV3dq(fboyVv4RbV>@rT%hoV<7#hiCeCB+FhSOx_8-9H>X zBQJ_SF}RT6+o2q)+2D}0&FKQg0u%gC*J!`3NF2|3^NL+ED7!d+3-!U-^&W&<@xBNr z%-Zk|>CHjGl>-(c}=cu@_;+p1M{C$9($@4D_c4A@Nf8v;WDnZ>bV7a6-GOPBIqV9PhT?t+7QX+{R!B>W!6VJDoTl>@eU z1{VwNQymk>NlEW3Y>2eD299$Ycrnf)%gjPXDS060m4R0bV_IF_TPblU#Dl3|SF*P~ z&YHzY-c@}+9$)0WEz04asIN94k7P^~(voJjR)T!{9$&@4#*W%-sG2-ETtlMyIb#gj z-c0>-Q8Hv2*tF|$bN*rcQn4*~sBcKJtSYBMiF)a(jo~<4Y8)nXd#9mstp-Bv{MoMU=1Nu9nxN2{ z;@+&?%xf3wb=@#dZEn<#7vs$Ly6fNd%=46Y( za1(Dz#*cd545dDuyX`fiVwNN8p5XGwRqR~^IPwN4UHy^pvF%k~xGj!FrdfBoAm?k5 z81Jqvo|#LG3$P|G_43B7=tK+$k_8>Nl<{KZ?y|BFkDeuteI2FiZ_VJ0&V9%3Q)miX zxEzFT(yo8B6-?C3z1pLVolxfRyrQ(r^naYipI;u|m%7?}IXNs?_Er-?dx}Hw>)pr5 zuECWy%!>z)Vs3iujj0QdLV=hfk2p~piV&MewZBYgkw}2pSE=Sz&x#N`&%HkEZa{cYX`_@N`059aha*0MlLwDR=#CJ8G9PX-z2{Qjk{cok*KK z@6*z!tRS>@tZTwoeyBOyYN%%DMQhZNi(u}wJttMmOFi^hweaYrNFIuHs8T$gJf#A= zd;uKq=Oli>rg$XMBMEg`qM5teHQ0Mkx7weHo3GccJMph82zNg3a=t)I+YNoOQU9a8 zpV&KxX$eDEJK#JOTbo#oDYMljna zgPKN%7s0(BBShsv7dahbjOT-eb@#u(-7TKfnj6HS^cYW#D6XHHgqA|uq@XHvX7dws ze7P#$DKqQK`^l0@rOi@ALxMS^8wZizyl0(Jbjv+U%ln6GD#5gRYUm|?6@3yQ^njv+l}6A z_N7*{&iT?~X}e5t@FmQ{>7UnWQHijp5C%US%+WsDjZF8~JAcH3%M8q^T-8kIJIzR0)||12hS)Clm}x<#OCI=H(?Ur&qT~ z<;hCwte?h`I1+N(=SI24_lYG}4UX34L5bS)ss&rh#15q|+5CwFF$=d1Ff$}j)#&j`4@}%DERk;L5xBns+$+T<>uW$dkh+22MT}@L@fw;> zc)QRLXo-InuEFMN-8IC)Kg|a#vqTPT0s-1Ct)ttCsuwD4F2#Q9=gaG+c%9F-+85dPyYvNqzmDcv>)q>a>qoQqWJP%nT!VwttFU;D$I59FJ$x*v z{7Z#_YI#y~a0aS!b2DW;UAYg(f)<{WtnUx4QN2dC1C#WO4S^qEb)}i;KTgZXHy>Zt zAKO$lXw1?cK0dsw9Nt>JXSh!@Ef!fs;T*Zw1+ebi4i=hCmn@qyRGFHZZ!lbZL~1x%v8-y{R9;hd zPqfk)PzL4T>U`cgZr!Y`w7l!&%J#4!me zbX~YSw0PUGI|@V_G6>om91vl9tD7&P(a~LBLmdjuN?e*Xzf(*JJkgabXxtOCIQ3LIz`o1U+mTSldER*)Qds45UF8GmLK4={O%jqcFF3`e) z?cT&aJiRtuSQF4!>0d9h*K#_8l`Q8wi!|yO4NEh6YOPdZm*&q;axXuFzmLoAO9RGw z5V~5+3YwJ*_UzKkDQ0w6*lsc_ve}0#i!{Gre!2UnGL`@@(HmF5;3SxD7s4sAb=2-) zZsIex@QUxmSSHTeFNg#_Qx`ojp=N{uyjKZj= zp~>d*gz5m}zdilnP-HgKIP5@Ni19TF*NPrg^e_80Er~O3j6Pgj2dq2q1GV*3xqSDy zdNV6n@rK-a)eX|Lv{_p_7tHIlX<4m=Z&Yn-Vlb7q!PtvD z;RbsMv~;IP+!3YZ%n3g*cssCzc!ySu+DylBoaw?nV%UeeogC=c?-#_^jC=y~3#=WP zmLJ#WJIAFoc>T9Hz<-2Ev6(TVk&{#&;uVR_lIxS~ry~KR_rA6aF@xQW^?Y>|s6RB; zy9#7Jp>df*-*{>v+_K6sD$gOyb?k#&kPE32&M^}b7#8qkjn%nIe z#p~CmC*w|d8%|#bg~Z-iAI00{7Z0aN@E%1UtTZcNS`&!+tW3!Ytgt{w7RgAnjO{Y1 zJ0S5k%y{X`_$$i*H;0gca=8h!GQ#~h$S6|!o8{!3N0fb>I>B%Y6MiUE$V*N7os^?a z_7Z(*6uA=s79t$MZrZx{(Ow8c%vro}iS6T&9(gnHqUmmLwVkwJA|4nAEk{)rbHTNv zfpU$+d-khFN|Oamb}sTz)7PPXs+B#_h!gRB@?Y9(m}}U5xeBdikjb714b;~ET3>Ct zyYX!y*z@I|No@G?hI|uQ>u|m!xVz6SnlZa&QBl1mI&TO_SaL5gARwD6Essg{g?^hL zprs*svp5=mfi08AGVryES8zrRQA-A&aQ+FMvrPABgbZi2ziVin7&=u>3V3+!0C7!n$CmHwU~!1bYldsW z!+0v(y`nC|UKvA$d2pxd@U-sI9JD)~guo}<{VD_*#+cf(n3RGKx&h3f@tis$X2cW7 z{x$QE{QU8JnMv)v_RJ^WDNL#>Y!5x1Z;1|i4#vP?0&Iw!8`I!NUYK@LtozB#cAe)t+#X2eW9; zf**@tYuDwcyJr@RH{Q>%1DN913ojo_jyZ>~U+*uLd4!OZb*0LObK%Im_)u{7ok=!6jO?QzZG{GrV4Rw%c2Ylf(pm^_n6*NIIG~wn`ZpG&8Ss zl3g9LymLa`-L<1$+&iQQmQ8l)leVDQ<0mUc>4f(Dw!W(1r8)glI4+(odZUedNPYWS zJbmc=`s32|So+03SWt1S?OLU~?wv_kR+@t*oXYPJH2DA--;Oi;O&|T6UNuL3(ftH5 zH5H0dyUvYcF>cl8vES3zdIRwn26ol$iry)r8PeCEt*x<}udJ-iF7eMVM7gr79DVzV zyO;ZKBRvVzM=nbix0VpnWE8S%Q;m(mhbC2e5HBR9g}Ck%M|gC`kt8h4tlO-xcG&kl zx#mYtg*?C7G2L}1WaS`*1ofA;#z9LYEl&a`A-BQO%yuB zWv4v`^Hw#_D{4QxY@m4FXRO;L#g}N(5Scd+`s$Zuhx^;t)YR7A=anFSU%C7?z5aZe zy*${j$q<+O*HZ;6m+#G~XsZVJ*W zipeeUQvotlXO?*R8|jAEfCX5)ZLvIzNyHDD@FlYlX?-F$^BY)7O01%$dHI$Gt$i`d zUxfk=b@r)%NJB~B9+I<~pD<36S8vg@yHxQ_`ADZlfOBM4y$1OktEqHvCAE1*vB9J< zuxRwbFB4D?H-GV%>jPYa;&yk0?%Y1jaPFVHnmw7~lR>TwvP=+bJu!Oko8#kqcZ)eH z4_~Y+kIT1TO*zYtw~sj&U28_~p%Cs)z|r|(X1D5IrjYbMbhNG)08+K z^si{a!+J;3Kyh-{y2|qP-yOzB*$@3ILcrve(T%a?x-QnRaj&D2srfBW`#YY4nov#3 z1?jHUX`U;7^O^o8myyvzecy=;oGY(ntDl3vV(;Ae;jDHHI%342zu6fRA2?kP4>wHlk4djp2e$^HjitfyOI)=3ogOoYJAgTtL}Vz|GfKz zPoQXuN|VMU1{Wc;i4t6^mmB}!PAi9;%I&cu4`ugadf@h%wETON(64&M&FlLIOj7FQE#RbVYN1Q&m5dCVhApiZo zf@CO(UOtDpgi(@Byq-pOp2at{8rpzY_6N#hJu~AiEaFfp_@((&zR7*LRUXbPo`vFJ z;bWP7FK|udx^Z(6l6+}tIbUaaI4Rg7YpfZeWYk;)y+odykOoF=`k{mTQAiRU&&+M# zMdTP+V1Xd$vN?y z&C{aIP06l?L&;*#%hI$6`BpQ|>+Z8Pn6ES}qVA#`7>m#i!Xyzq&4Milipb~(`M}ci5<;g@M*f=_pBoL6 zw0;?P(%4W6OXfk&O`Rl+m5r~YBjSB5>0%Cz1VDDQUh)Mu@SiNl&!VQAdRzU4IL)tQ zKc4b1n%Q91__F9$W>3PxBza8H@vnQ9^8c_#*dKetAdK;S`dHxqT`R_atL@ev?|(hW zvj!s8CrdiczcJj5Z~*;@=eu4oga|oTXo!hrtU+(&5g?O@EB9oCeIJH?*ykPzUNGF^ zS@yka%zOd0aum468U%RAG#=Q9Vm$C}vC9>u|Jk&l6ZlgI1J;tF1XO+Xy#QN=b=bY= zCSiz<1m1?2VHQzm>Aa3ORDT&j=o{_KgLz|uPhi1tMniFlUxVY6c7)i%W_{5 zyp2h969(ZVaKQ`oyvzr*y4QzyzpJ#ah3-kCS{-`H zXu=|gYN+teynZ!_F|LjgNpPI)RFP!UGK{q~IEyjeReHorsIs7AVq13YJL4Ig$-P$c zmhG3Nx&&ds2sH^@9Q#wMS$V-AMkI+RPBMwH@eEqvP6IUd98PfJg#nIP!U@_k51FtQ z12p!055-${=3{(nkuG_KAbczTL2p;!+3==}fkN&c`V(F;7D~Vy2 zQlq4|1d%J5>u?fdGYVZ(9pvZA({OkukB3*?1QG&;>Lfn6G4cXVuNadEI|(BikH*f) zBNmXPO&0YZWs+s#g*+E;MJ3^hOw0f$H(`9`1w&a@-K2`Xpd9Pi4aXG6!a6QRNIF9+ zBDexvz=p=B1iD6^kLY(!p|LQ_frI5T&;W2#2{Sj)zB-JW$oHp!qKN*>z96)M#4}ss zKz2Dg$W9oisv<(XVZgpx5W2X!#x4-C-}0Q-M1gA}+L0>h;{=%ljOY?&v?EcBkvoG} zfSfoagdIzh+-O+5Uij(cS7?g^Kz8Xa`v= z5z*SoxZE4q8d`A4Wxaj5ISbaAx@(rZn#cGNM$QQ2=^!rP%{a&rkE~5sIwclkD8_H$ z1RN?w_)9GjI%8h+XC__#rQ%kXfC%)lAKqAoad~+u5^NajTu{Y03IVxpD$qdi6LI2Y z4a0EgV-$HLCkITf@tCTmgej3UO@>RFI=oD1US3`r#?b(#;e_(WAWYbir#GN8n6}^I zKp8XO{`}$vqv$l8Fd3uhhFzWeO1e!5hD*s^hB&#TQ<5s_KoJ#-*i#UczdOkg?bDMO z-P{@Lph02)OrI{gG>?mM+B#`B05tF4<5sr^hwZcD&Ts9*2K<6uXhkvDHrUS_wHJ+@ zeW=&$eb%yj);ef6q|w0W_FBC+-G*vy80YP7=gs*+yW23D%~v2|PgcvKPEvT{sPg3K z6k2avN5`%I9Jc{ZTED`ZQ>~zNeBAk^eF%p~-SanRy`#=)7ohdJZKPiiPOB~bSlEW# zQz)QMeQXFkt1?KAhL(DIzn#glgX1^dUi;iUI%7ZEzxLYar>$f5`>b=`+vskVb(F@1XekBpL_w8!$;B0Gqe}A9-Q5S!(L1=VPj|SPUSugf2`}qsY z-rJo4c|LjgXVmWyX>>YlcaP57hX4m}&d=MYy~4NImH@Z&kY`;YuI8=}mwlBI!j_Go z=x?FDWQ*Lk;IdpzyabQ16{w9|uv8cN)0Ep;3`i8FP0jCXpY6}}SC@cd%=Nv{CHcl0 zTnpNi2~*KHLIe;{oyx~46NY#a1YFNb1(nDO!^d##REu*=jUlglP~PL_wFjYLETKgd zdSo4?Dn&9v31e}6(NljaR0ERJF;GydVq}Jv2~<+(bGC5f;*+~ja5Cr?I}q+8>O%G0 z&Q!B|^jb0t3w<*+T~~3Gl#qgliRlQ%XpAWYu69%Km!?T@0#|t2WG4T2Tk6mEbOsJ5 zbcaWYeW^>rOUp1?euCqGo$>n9EkN*F>*SanpYl)0`}V{*7)YY_FbWqUKegCex|9aK z5?vBczF6P~s&d>Sy7SyB6aG0tJ)W9Ui7*EO1$JL`w%}e{gF`N*fE&#W!vsmrffu+; zJWdFXO{G=R=|^yqc)^ftQFOgniaNqnJ0~2ojdDB%)DI_2_ov9hI}NAz8`=-C&pgC9 zfF4M~IQZ%CX9j0~V!x=vPv>pekgP*spDszgFAhl2CkeAV zRM=n!dm(vp_2y2c-&`) ztEGs=lK@N;B?(=`{eE~0rpZ2hvp*qI{##@LX`W(A1k(gE0@Hz~d@&{Q1iz%pDE*oq zop?2{q0Wj}SpSb#=K3e^4n)#jD%1#1E&e^*CZREY#cEjJ%WrJT7{KghgQ^2Efxt=V z;?0*bcg0JVkCOlU^rc~ZyfW*+{YLni0gh=|t)$ErW&A6awq)cyWJ!0pprq^V26>5M zH5n1CP73I}>&If6jG6HVCee&9z?1qw6c+X3tm;f_m^bv}nqlBibLz)=yLI>*`->~U zysX=6o%gy0Rj&pBwW`!U&xHsFsHO0>cS){+J-5MbO|NffIyl3Do3H=%svk&QgdHHP z(6DS6_KSS|`NQ7Hz^|`1jxVad!m#Tr4!gd1*f!y-<6wlHD=u|oeC>r3;!mlh#4%MU zmu86eOr~adVc@yYgxc-)?#}-H^Zng@ykDzr?`}bWhhgF|)m2Q8%(Eebf;+P!5Pn~l@&a}?${?|Dc zVQyr3R8em|NM&qo0PMYcciT3TIJ|%BQ{X3Ow@KHcF1F=Fr+Lo0wwk(4Y_H|C+wIfW zfk;R~Oc5*r*>Mx^XMYcFBtU``rPz+s$Lu+&MFNAt02mAgb9oQZ6eaEb8BCaW4d>y% z-Tu?*bUOX*ZSnt3r<4DGcdOI=x9;}N&h~D1XN#BX_O`cn{ta~Q0GGnEpbRGe*7@wV z@}2ui9vI_aP(m?@2H>*WfN`Au?0VhjUZ)Wt>L)m6;@uwjNlX~S5BrK8K?}`*2RYDQ2_9ctKI(lZc^+c|Mu9 z;RHV4-F~r+I=eetgSlEoZF403`t<`72=;s_<8KAJ-u4nP1eao}B&h|N%hqW=m|7;>640Ei%`ZjgS< zD$TJ!gDCVulE8@l*978Z0zb@AfFZBz!9`kqjxUfbmQ{}+MQHwCEP)Zl%!6^97MGtc z7GVfyS%ny0qR@-*1qsPzWpkpWD%g;(6rm_tBt8;d*E3?a7<&QnFHj<8!NQ(F?Z%~^ zo*i#%+v_yG^aA?IAI1MKVYoo_jy8a5{=e1RDf0i_PWO@j-^a574$uTHLI&g%5Zqi& z3a_yN&SsbbOaTPH?Y(*3nvi4;8AAb>;1KZwYCBMsVS>OkA&VFVV0;aHGLK2b89La9 zl)@-Tpe{--QIg;Q0lFB=eMEj}G~$F@V!p-?AcG@D5;SN4;A;Q_z>)=O0DwYB8TKiH zi9Z{F2@ENJeE}yIQ2%T&I8Apl!F!HXy93Z{HYSTOEWB(`MiMv`t!@AqhU5wb8ttbk z9-B4-&l&)*>lh6(Of9S%001x}l-UIUh)Kc*;6-PH{!pcV^hOMVf>_+B~?|LUJ7kW#))rPKo;PG9N2#On)mO=IY%O#1w?d(IG*fHyY4 zTZ#bsfGNY#RAB?2;%P(@L_wUOOH39t1^G-?OKXfog@Fc^O^XDDkWVZWU4l!PP{0Tn zBjA&0f~SiF1%O0=&BPm@%Njv8y{G_(KClE1qssyK{SQT~4bW11(Ei?Nw0CrHx_3Sr zp8hgC9i=6J9NPS_xGSF=pPm(Kri16M^z-ny(aGNauvpPSVK<1g*Q4{{(cbs3hX+L{ z+4OKy)Sm|+#1R4{W^0hup9j452~6Oe4#3Bo6oHgr9z_Y?mt8c>3gsrc{jqY^*+p4M zy~5J4nSrQ9{Tb4tsImI2lC3$UOsx`yU$4_K){rV)YZ>`77){Y!4F$kafIgfgXo5cs zz#Xli+}oegwfqo~0MTDzbR31(<^(CMk&O*79Nog=GpFrvq!!uv+tb&Mg~kVD&~Cd1 zVvv$Q2k`A^czU$=#<7OX5z19MJUSTu&-uye@Q1_yDONOx#Gt{QEf+-9I%zGEkgh-m zL_IzkWw-L(Mbr}$trgodO>Tpt*f=2<;(#IRwA8m3ofm4$Au;xy3lA>%DT84j%Hv-| zBF8*xY=H046h{M~_tA8dm&D3=Qo7kQ0{jJKWRCwrLgtWyM8n!JV=n7ch9V#7`F=*! zwrGCb1aXKUMSvnC8Vrb^9kK*?8x4U&!@0-Gp_a}0;ewCGxpiidn=lH_DgFx$Kv%p7 zd{rp$<%1%gm6)k^ZW$GWYE}1&%9CrBF?+^X;=PgU8K<43+@ zZ(0n^W6sdL>v`DNFhqHdiYlJTk7BQc;3qN$S2OI-07Z;~MVy~&ve<-hqAV!lLcSuB z{KUr)MiG%KPxC)K=i)SQ_AQTtE`G8IL%FF@wOPfBFgzh4_OA!vaB@W0NrEVfn3$1T zlb{*y1_<#SGphLp0Dim}fSpcfp1zr*IZ3VuV5i%AgVoyv{kcH2P_MVsFV^e!o{M^% zt79MS`M#L6l68nVZ-@zk7w}$?V6Q-+m;|rk7=`*bMgAhe?0TO>41Hi(sgd);20z6? zvG0f(?dJzfV8bWmdot!Ds84c(Dnhi|E47K)9fF~e5 zL!!Xk97-0Qs@|TVaNZKjoVHnlkX~pO_zjEUHFBrWk2j45j;2WL;tj|CQaXt4F<)&l z>6X`8L_tLLmwmbM{eTl82)JaLJf9ZA0--((aiq3S$N6=RqtkTvkkZE-e#l;R_3U6U znIg7-^7bvmA^uBH-~=T;-_&{cpW6lBh$UH7RxMJAS&^z7)N4!`pHYV=AmNfc=arBN zrH0l5Fan_OBP!WwNMHcQFoawd1W)k<&_&FT5lBhxyukPB`$%x8Qvo<#TT)}7$bERS z3M=at`O&K-T&$A&t;EIn`C^1ZUQDqG>9+2PYF8VRoIduOjE$*Z_M$fcYyJ z@**GRp@=Mtl+qNO?E|u(P|nqZ&~a<$DERsa@;Bw?OotZ)t`w#t}@emqC`L zoPbRL{pVXf1((8k%$d9V@bt&Cvy*3HVDzz?xdjo>J^ zqsV(fsbps?E;QbMUfQ_PBs%$ zf$T4t2qh64fKM$|_M`eg08KS-&NB(BIRL+>-_5dS`Q`vLCxkRN?XR3a@K13<#&C>7 zOd0m`g<{T^n*-4Cp69-hSk1w5bc!h1HF@hK?&jL8ja&}FUhd;fzVvcbdbfnib{-Y$ z_aDYD3(4}~8^fe*_&Dta*TT`XZ1i@_7Sq4~$VxW@sr=SsdEFdX*wi3G+E_Pzshhef zm4`l49Qt#ClIwv(wpmq`#t*?G93UU&QCLe@5_sK%pp-jq7v-jVI8r;hs+ex@V5_$yG|D)dCWzAVspS;d-cs2~ zxi144fkO!gB*-U8;AshoSet)K-UYSL2hPut7ZM+a>Z{pMDv;P)t-{sw`6?NJXo{l` zB}G|CThJHlh|kfcmRUmsxSDogzMu?@5tzeh0mJZG^(wu8;(MO3vG9z$a?6~^?3CJE zb(aka=!IWKg}Xe~JI?iw2m6}`D(~FIZXk7M<I@bO+N6}&^acLTYTW%L`!o;89OJtWczVoeu4__XIDLg#jJM7!Nmb4RX+0uxt zI7||f&_es^M%$nu3vM8A!V8g#32gY-~Q$*#FeinzAztZAbJ=D z=)-=9U{rDenitNb)yE>*qi==9UAH4Pbcb+PQgSt^4bhggm+~c!_c-r&c52W2t%`ZS z^~L9Xw3v@kay&VJ*K`1OALvSWc-yqHWm?AusWBrgA;E2!6ci5-a=pmqgH`>wF$@vBM1ajO z1&{*BrB3Se1*#R-GlG4TuHFSji6@QhU`PqT5hnyi!fr6~k+L78d;)7bd@hrviWB7X zox%ee#)&l4vQD zj9cw?Yc^_)?l&Lxpqf&(r^HS^zBs=5rZBV_vh9))O{L-{sJ*UEjt|a{_TCJ01c*sc zcix7e3FFwy%g~hZZoSOc12;FD#o{R!dnxd3mac|5VlaRVdK|Oj{O|U5y^h!Mx`XGP z=N*2s)Scp;ZB0mW1(Tp&$DU}?01j)=?f0MeCE=rh)9_1gNsrGxJ_Y&je1^gpCDdc_ zZH0oUmj8OY+r3^+{@dwnZ$HX^_wjuE*!~t=;`snj#6(mF&PreMQ$6%&XaK%#-`q5K zsmAa_ERM$NP_KP&#Ie?EsB$fSpvF|-x9rjb%&d_!S}0c@aF=Cc!E&?U>pm?y~eLdLKo#3Z-aM& zf-&+T7d|POTP}T~yAzDUK!&&wr(CJ&5&D6r<7+{RgQF2IE9{?RR zdzy466z?ztS2zq)wUE#@aO4%XWt7eKV@(h|Nr{<{Y>}2JEl`W%d~4P}o(Sv*FY6Dg zfoDnx3B}$@Q(UdLDuIARmf{CC>=ciPNBlkKiD&C33^rk^pce6gr#MSM)f*s6&l zO9?e``S^-L&C=eO#Fl@n$X(!*Q1SBJzWJX`&^&Lhvzo|!P9m)wFGEp&mM~^0oO^WE z7HAJ#0;K8?mmV9A&r~UBUMrxgoSfFOhkI#wGXAY7Zl%GYxbRb`@(KL8APfPc!%ir3 z7{MtDTI1`1B}J)gW8fs1Rxd3hS-zJoCkj#@?jTYofIDhw;dD?C{@ggLIa}c9dG}Ez zWdkUcZJh5dC@P=0y8cL1_iR<&Q5nmkuF}eRT$BgATbkKCHP%DkhqwuzRvccQJzLUb zWD-m>6svJsC6s|>ZQL#RiUCpdTGCI2omy(!-mN%{I@P5~6C zTn2g_BG-bojK;8_jgUO|zV#8+%-q%{h!gUwkc?rNp5O;B&2y;IX;*H6<-0+tiXv+v z&!RtHX<@>4b#PsUz>?9H`@usQZIk=gA8k=HH zx~dMt0jxL$^d*-H>kPuov0(r3;FPBB1lpH?RJ#%s2CmGnz}_FU`BGVFAdaV{J__RK z+LEpi;E9ieL`;NwPyuN1gRiWnj=|}rnB&jF;E8CNjF9jGGjG9gNWJ$2N3StuzhXAq zC-XTp=BY5$7uUtuXP`O32_I#aEVBJtb>w0bJh>D-;a?Q3BEl35PgLcfHVxcF8<*){ z=e#~ex=z}j@Yc|!oZLZ84Oe0UZLlv~b>KKej%&V*8=>e@cE2hIfeLbJ-t^@K3US$2 znu;I;uyk89Za=HHC?mqYyKOrifkHufinvRwfbc4WyQuL)Lgp$`zYbo1iYD6IBfSBw zMleiMs|2!F z0RkG;b8E741a&$E_wX4BDe6og6PSTS5v~!WzYg35MM=rr-W!d6Jw82HajI03#Lkoe zI0sm*bSjiAw~bBV800eMW}0usWP0eDvptSawTz0QOOt4vg)1 zZ=tYGDw1pY_7*{oU^N!P(i$r)1`C#ZL6{17y*QT1p@qyRj!Cza7DkSi9QAX#L+Xxw z4qy(SdTYHfzwdax=jmE!%~#c_SofJ&MG~+A696()1wXlvNTn#i(x$G+A5t7OXHfk{ ze-^qS{07XEY)gqpMPW=p^Q`l76-h0wH zKf0Z*NB@uec${~&`t08lR>oO^Xc)(|ec5eXU=hYd#Qh&3*3iytgN7l8>M7;c*Gai0 z^;RodEXxz8Qh>=2Dneqk7I@AK-27=NYK=Cqx>{#{^c@Lsh!Eb9xr2b6qju)v{J{p?}=H zc6P{)cb^rWnL+T=SQ?goSiUggm>LHo2|WE~BOxN4HineD} z%*bV_<}F1yA1^GcP>3Yv9KrG-vbv&Nq^!)1D{ zW?+0_a9XH(Vg!&X0Lh|DS*tgh(tIDPWp)Y8meCD>>Eg)b@$6HT)NTXN@_Sj`d~tK6 zOJ1VrGRN`?8?|xnt}(1>@v`xBAYoj;Je@)MGrF!MY%@XPPAu`JN$iUoj23^>!9-R|vnmv$?}mncG%o+M<9%8e?x^G@FSD5A7P?uLv_ORv$|Fk!}U)VC2i{PhsKd!2SlvhR=t*t(2H4PW<17q+WXg4;eOUrqW`7v z-t@nn&Q52ysQ>Le>VNO!QPLHRf)X8YU4K(kPn@cVM^^Eb^u!ganFpjb{^~hS+4`5% zpUV^-pUDfBtpDEjRyVi)cXzfQ?|<&)G1mW6Cj)qve{W}RNsHxJfSNftntDD-5TPQ` zex5NXAnRWsIS+?93?n1>VUc^RP}5fP)#O5!NOadM36!0ea~;d4)-mO&5`}PeeFwT$ z$7>-Qh`|ND4Wvj50$-+xcT53L>k{QYP}Ly+{&sp7UN zUhg)ic&8xKo=cr|p`D65o+Su4E>f!7E;Lboy|Sd~;w46{meU3bHycaZbKM>kwf$y` z3Ucu#Arkg=gom$*?W=y^mcogA~L%H7ez!f9n$?%P+^$qcdm z|9(CCQJ5)~Ae5~%XBY?;JY_%v2o7EOg8LWf7v%US{(b@2{q+6+c zU`AP*;Hek*=aEdLP#A&y46KYRP{hdyQc#6aJ+O}6*R^U=bM^Mjn#`s3_1iUl-XvZt zzDJ?=&2~ZvYiCvMz!^?jG)s$Qq%eFR?gi<5z>pHetBQSTUpsmK z-`!s4G5_zqJf{6e4gJot)H!!z5Vpc$^h5U#i|b$C0JMB9Zr=I+zni!J-rd^TeO&+d@s!^G=-X|1=m2FabYGtw z)>@>xkrrhMWN3;JeGr?trb4=yGyJ^wloQ}nO9V%Y!{wyo?U&r#e0hnWV*Ljw4$1YM z@Be(|7x(}E&g1&OkEhoCZ$%6sF-PX8zAW$X*ne0{zLX+sUF5o}FT2Y%f-X1!Ef}Fb zjbcyf1QjmzSP-I&@F|y74u?{zIz{qKx%6(@d1>s=kbglJ z^R^UbS}3}-_9dCo5j^qE6m0K%$mLiz1IOAC6QDEL+v(HA+;O#>QN8Srd&z8h zumO^4ER?!|l3X?F-=Y`pqz!Pl8&RnKZN1f_+r6-_%wkw|RiD*-2)FfhH-sg$Uqb!$ z;}_+qwZ0jEF%@npj!_1&7;n^u^I(D*IZ-orwKUn2DQ@IyXf{>|K3a8Q??B5kk0@MT z7DEL|tLT!;_v6>Ehx=#8r|18Bc=Ge%(fN;OXD3yWi5M#yY&k=xqvH8Og%87=A9dL)V+mP*wi+7aaUW(?j~MeY?C|(#rAFX_%}~U!FGQZADUX9CtuU({&1UxT)=bK?o29lvb=GH@a=_i8 zy*DSX5074*kIqi_&W5iJhokc!4qrR_)ke%0!fiXJqNql&5ZIH z;g42pZ^l?$+FmXWRn7Lg+r9pa0<3&!CpWM)HjdT$Ywie+9?Q?Q&@7ld-AR0?y9#Di z&pyjM;NF&rmZ1judst~zcJHf=K=qI;&?*u)IVte~?9Y~@t13bJL0F$vXX~oOd==ZX z!{8KqTq_+gdmS!q>WhCk9_lJpIoJa%QWhWMFrOxa04 zUZihiG=sfM#3jJD42SqH!DegVB&+V9yfvzwpu|TJgHr@PrHKTetCL@?87`r|L35H^ zy8){SvSO#_0^;rUdntyF-KTQ%so?*&76Wvt{a3FL|8sZu(f<2ho{z=&pG6yxQdQO6 zntj)~@_ay>!dD>e6`!j0e_Js?m#qKZPCoxzue1GV|9L;pM@Rh60t0yF`u64GfR>0x z%k=Uq#RIKd`{M(S32K^F)hEviu|ey@STR0mIpEK;!Fw2SLQCj-&PFJCHwzYx4Tu)|2)S3x}Rrd`|mYlfIfVk&eCiB+u3_Q zHzsImUr~roxx`ST#M8G}OFI1>kpP{@#C_$$pKKvgMbi|2`b8b|bXkYBZ*>$*MTq55 zJC_)g+zDMo3+vLws=P8?1R++kQE3$oOKK1?XQgr{WK?aeOUPXHl}V`xV%4b#-l{B$ zT%lU;BLb@_z!XBmmW+d<$SNUQQ%GOQ4cFsS^%Uek6hg|dPZ3P~+3mytSf>B&?-t^J z>~tRGzk7M=`2Sl|!Vv?&`o264fL;7PVgXn!KFD|gHcjp^CO~oh(-!Z_hn62A7@?%) zCnWm37|=`Be}8AIm)HMx`;YfO_wwWfMMMwz;P1<^FFge6sLtk{|9(QEb;CR7C*4Ch z85VG=Ce>P}!wMM7kA^;p{6&(W$iLQxea#<8GR8qum?q3nun27_FxQ?gW4qeWh3_Lu zCyVeWGNwOb&ZDkh<2h!Puu5x5s1t}o6s!W#T|?tYW5j3O1cnqf0C-QvXO?@g=_+bF z4g-htutPPP!=~Jix5V|h-jJ92`F49XyiD?Lzv~<>@(r!JEDCK`k+A3&T$@aVn}j0b z4jP%$0Ic9|o1fj)PPf2iT$lq`0xiRCon%=ckhL3~rXQCzpS4u84FOZWaNT_zdSs?{pjn4(DNzUX8dRMT_|uCC8Hk zcumXvFBODzglv&i8qa%+BrHt)f@keAKH&DrtT%=($IQauIoAPDLATxgD|-1ApgJ9r z>S68lOe!?s_D%v$t9KV!D&3So4R;=}f=dsm>DB{kx%O0yTD`uP`!Ic_9bXbSc=>+g zw%Z4#w)^0-_L*ha6s`Gz)1tpN7Hi<(wDAXJcK+*N^7W}hm!JQ?Nc`XK)?@zndwCr8 zpCvkgQlaYZEkWxG;}277@PJuDVg1htOGt2g!T*-8|LtyJ{r9`OkMaNR<;h9va`bO0 z_}`Mlo^0zOELw$$))hG8=qbwNgXn$1$ayLKs^j9_Uud`#q4m?9DJtJ~^fU!_)zE3G znmDqH)A)S{PFqEHVo-kx-K%L|p(W`#bXKlKA_$!NBPVf&?{{2^f%H)5}l5WTQvxfhF(f@P1|9JktmuI>B?=FF(X@V#%lzgIO zEa4R~cv&g5L&Q-bbDz5{!>Q%6!p?=hwt#&e#2#f+?}FJJQzd&0!2Yy zk}&3^Y|5OZF45Vjl$se^voyEOwOmeYxqdT!@6E#6!@*pxb0166@vWt4D&zmR=KNnr z|6B0?+3D@}ANl`%JP!SDZVzyC<2%*&E72&si(mIbtZvZyaBA{|J}}RG5^<2_woMkUY?Ij@<`n24WMrAA?yVy zE@c#1YaejdUL*Tg24|(@Uum_6nfuEa|JzIbRW^PrCE_Zp^>FfVEuF7*vv4^o)K9{- z%H6KnP_5hD!Zk$-;hr*CEx*~xBWB$YImqZ5sP%4Ls-P^JrIi`F>htU+Q=l5(^;2}& zvta!UUD+Zc&oT!_IsaRvJ3`}1-Cy<>UY5(|W z^!Ckz$pn?6a|fBAQrLHr32Ir|qV9HY*EDxnC9TijGC7VR0Nz$^9D9ZS-BRP&y?e}z zQ&syhGtOgXoD>yzR+@A<-F8x%+Fa<1o{JeD5Lohnoatxj&qPRy*~FyY?5&{NY6Da}$450DTyF zKRyS+we4-o`Ty-%04=ru=@smM`n^Z{&wF_s_CJL?AcyYm?rnfd8hcn)K$a5ztGsZo zSpT<`{$qLmk4`@y|E;(Cxc=|u`RK_1k!JwU9G|{i_7AsgRJPf#ll!A)<&O_I^@nv! zQt!kV#T~4rEov%?)_n8{U}4HX3~%P)t&l@8i=f%@?%9nA0JxAkK9$}zed83 z+*7gt-e=bmR-SYK?%H7-lb~-!T+eQ1|$MfI4JUPZEMqgce z<@Nn3>)+RRVrv=wF0h(i3u&(Q5cUDl?KD!qTmmVc-h0Zs|EbmBJ6jyOiNzZ&Vd!6a zjH{lK^?#e;zn0nm@9gvo>%X(peO&+d@i^E2?HKN`nXW|Qv>s9#F$2Wz8WF}dnm=jTh;H_b0t&nr*~Cc^GIgp}Hr zBZW_LLRM&&Rx$ridvdFh-6Ygi1G~vu_vA%TX>DJJNiLyv1+~{VvNtHSzJ?>m zSK`*AZN0Ts*EOuq75^%&>YWrALyC%4vl`|9emgwz6!NRCMa?;ragY(GQ2OTy3-w^V=Lm+jW|$?oPqVUbdM{dWD2#_x~D@AqZ=zB&tc zXu+I)%J_Iy>v!d3bgLdw?nCwzMQnrva2Vwq^%;d*g8 zotN4i?wM)=W+}C^NjRvVkH4b-B?8zonQ6PX+g&O%)s=B1ZT}{+Kxx;$V)5;(;rTV( z#3b{*Z6C3E;_Mf35UX*5xO4BY?8S1yrH0tDj8dy#3xc9I+lunTT5JCv3BL}@z0>*n zaY>+frJcOjIQVLy?;#AnZ0Sy;;6F6Om6H44+YJA{)c&vEFU0@c>TN&X|K7*rWU9-8 zyXOP7TbD3doOV$qRi+lor(bS0ru$cP>s+$=epWp9au9V)-RlK(x7)bgc<#KSTcck) zx_jjec#;Qt3xVEkden;ZUaV3(%=_)G{}TRxo8jM=+y8Y6`9HebkMW=H<#G6b+BQH= z9)G8vpG&Xw9|-$?s3P4;PucpvHRsP7{-0X~`ER%X82|Tv9+&^8#Q>h=-+wvJPlqJu z+=;x-{rMc#LZ#aW0DQ5;0&dPy4o2E zxNg2>&2on*Q0Wwvr$R-4ohE=q4=J!xPLkpX7VR^Q9_H-yY4CRk#rsYcjosR%pLx<~-diMLtp?72-8(uzK6?Gz3L|Yd$PWzkR~QMy zNT**`i91l`xH(;d3IpdhnFUT8E@M7an$3b5CZ=EoGgDC0)D+Y*HwER>wX)0Q=CogF ze{=Sy$I%ZEhl|AYVab`HE~U|uX|bG0B_@7gnVDZ{C)Xa*<+!@6B|%M#$r5}^WEZzh zA}F;>1fM0dlps+wQUp#z#oCS6Z`x_K2+AxM*FoTKao_#;*iVW6=Zo9_^m>o_pZjEp<4gm425$%jYxuSzm28qznjnh)9dd%-v8apvjI*Z zVeG&VqlrZTJJ(>OsB`~d}0nE8LtJRqcU5{a4|B@m+ogg8Q8!#fzA zj~Gc%V*~7y`J6=Hm;Dh4a6%j26tlMYSEAqW#(yPk@vnX{o3{Bs`X{}N+8LlR^e+}M znBWl6#8lH~ssEuXozn9Pd(Cu#TJl_A@%LC&$A(uk)+5*8PiP#K9C~CC89ABW2 zBrswPe$Jx^%`X;V2xpBJh~Xs)BYZ(Za@k1GB}P}D1>#Fn;a~Sr>;H7PckpKD&4asW zqk8>s_lxp>uk#rH_kNxY@ROJUjmGctk3XKy7>ntk-M+fI^5pbj3G{I^MNkvl%cuTXl!hN!-yp$Sop$|w;`kke+Cli(szM>bZTwCNYcl5)8!+Ssy;FBmqzQC0c3w0-6TvGIrKucW~ zXxA_?IWHj&`Pp?-l#t_Qj+dGa!rPipG6)VJnv-aRm^cTkV!W~{nnv;v-_=WLo?}d7 zNR5!VRIdZdU>IsD?sH@sjlCccKh;D(Qw!)v6wX0{VnQ(^$@QSoc=ztz7}8l|roZs@ z1FYE%^cdJnRgDNH=0I?Gjm8-PSfXVSh|R>$M4qO_Asf7tK;LbOb;&4xs1~CnVy;d**@P$U>mQ1;_*kNKGK!YRcF77Uh%)NQ?4B=so$cpu zaNSCNym;C1wwDwS@f@$%f~un6%f(f~da})7Slk@;C3kH!4kvsj02n3+2G?K)FOkKR z^-wzYm1{L4bSMvGENw{DiWaJd1w{ahmtxj&1}=mMe#i$;=kNjn%IkB835rALBk=CK zACE_8|9H0v-hIcH5&sJ@UoKJsMqDS;XP-B*_=yNpOritGpwK#G(db@IU`UZsxEQZ) zMksqJF|91ex9gX(AC=`66eTaedpjDQE`bLry&_5Q^1GA0(dgIX(}RC}_GFNxJ$pU+ zj9HPwxUK0iXf#B8wuk{T5fI+VaTj+M?}R2t&Vb+c-n?!oN)1v=-IQbvko_(7#L|0R z4xV9sEJsPa;G;1BayVoOMRr~)rMtLz%k0>cGTjOzXkLL@aSL1WOQTVohXV^^Am*YR z<2*r>kix-bz$IWel}hyY0+XWN-ifd-;tRc+?Adpt;ps2KQ*gBRX7~?*eHtTj06s~t zEdG2ye06vP_J^luhd&(d@0|_BTk-un{`MbP(c#g7t6(ky<=sG6Q6e3{Pe*&;4hg>hPv zS1l=;LX}fWb5MRR@mUC99EaDSH37@!R(+n^YRQEQjP+ZKXMv-_p(WkE){t*gu;phV z4idqDFR+ZmJyjCyv)dJr*WHU8g{|Y(OU`~AdkANXFRhZRZX84FbeImsUP^8ywWf?e zaPa%32R~j%ZVHaG-xt{Pi*$1ovhCQag#){6wSZuktrik;a8p4+|FyE9;9PoZ2n+6E zz6XIp@vxQT27847`*&UWf%-GVH%4)OTtT9!DGcPXQm=)wLR2tqizUuT1fcPJH~`Hy z3uzls9SPZGu%=z9r67>)1xlZp(p= z&b)`0&?7OU1JG<8@LwOi2r-Y+&|}GhGBNfqML)%FPac`d%bw`v?$2N}MVLJt!brCB z3PmV^Oz#eJ7#kH0wtj)G86hEP;kk@4Ci>_@F1Jv?B^^l$i!9=Qd_@7>eb9m-h7=&$ zN(f<~C4?+FXHsEDS+=+^0U^1Mwlx}O zGXzX^6u=?pw4CMv7^9F}>HQh{GmI|z+iO`}!%vfNraCYW{5nICZe-Jtib#@^2c8Bf zMp2-&OoD@Fa)3IrgNR%yJr%WD{D$Ut`b}^(LkWTu{0t`-(5jVJ2rGV{X>heyW?sjq zskX9auctJ7D~*XI$I4!q@@vZMl}IW}q*72wqN#+dCWxlht;;|cyy3jqm`@TczOOPd zi&qpm5@^MuAr)eyoFylyZZJYVtMkrIIYcQz5pSH33zX28AHVzl^!VrDX?GxY_)Yb* zCx70Q)@LNf{>$&qj!zEvGvRCB3VKU)*wi1;h zap8cI^a4w%CvYGx++ty&^C{JPe`w49?4?m>^r1UxudV<@V@B}_1< z5{L5pA4L$Rfj9?qL;{pLkb_U)<4v)SVO5=0F-@@DEon<|fvmO_cQ;@swc`~|NC0e? z(h`ysbFAs=I=zALxRdz}Ty4{0?S1W{S09GMQdB^aJFEH*pe(?9!&jW6J2^;PI^l5m z>JW!`HQ{YrQ*|Wpz@bbXK-J}*+Sf4^0>~!kuN(%ZV5+1L&6~wxUilejMyjPmcZbC) zc32hQfP`qi98^9glbY!ud#_Agd7lfd=&_N(rJ+5g%(RIUqA%C1KFWG&Xm&Lh)M4!4 zXar*E|0r(Jr{W^?6L_aM`42du%mUg_pUMS60c{{)VVZqDXR0XX?Dd`DoIIw;K?+zzNgqMByc;Q8eQBvroUP!<&ZNGLm!;hZ^$q2P)_ zOQPQ9_=d?6)!fY|B^7&_dI@~~R;PjCZCb z+)&rxq5Ec=>4eVU+PpL?U6Y>{lL9T_ZdnTj4p)(2h(oeA1)(tE@a7~yp(lbUacJG` z-cF|!9zP1F@b<+mQ3mP9v$GR}A$7NV{pY2S?rY~Lw#=?$BnMv#oFaliCZZgkl-5*y zSoi;b#m}t&KaGx$+N%G87A1pIgE40ly^=ZSU{)|_Q{Pd>q>T>4dCV8MM3RI0eWYIL zbl(_J@Sc)LD9M-TNCM*1w(uroZ4J7;kv7-T@9cyx&&uex@(z%7zPJnIkNF1UFRHjU zGf-5T5MCvi@q?aHMC3Mv6!>lJFiwE=HyC&I`umHs{%ve86@YJNcS#$l$z@a3RDsE+ zkjl5Iv~t-lrC~ThuCYg%4W`REg=+6mY1x_^)E!XnzW0Da!*#cSj5#c4*@qdosNmQ( z#0rL;f-C3OS{ZSytSvbN{kPCmNG@oN!Hlqk1VtVsRfs=|uOL8k0$?2HxsR%R-@~Vx z74ub0=DMq+q)RE_QsVIs7TKz-0p#wZ_4C=S2QLalSzDF0%qYW#XJ4FTF!N(mrmMH1 z$z7@(N_h@7W4ls^J^5WyTH3y6E)qHIotZ>VNE2@lmC|S}8Df%%%ln|U!0nurP#SL4 z#j2zYc!5u;Tr8#98(Hn`VJUkT0E)oYVC-g7>9lp`WD@=3YYd-dXM&yD|$4E$8dnJ6uY%nme35XYPxu zx#Qo8i4h|o^MT_p)XqF7uJsk+ZQ&Z>3yNIQ2I zukk&k%GsMt(!to|9SFogs*whef-4k;f=HP0E~P0ZK7n^_3x16aSo_~p?7nKYta^S( zCsgtHAgp)bGDagVqD4vYo{U`p>YNGFoh1WR+Fc8Hj+Kd90k(*X5KFZxnN_DK_^t?k z73Lb{icqcRe zT5xn!Ts=iZgj{X!k*IO|1l~2bUx3~g_?G|Iv>}uR#g+GV3Pwfj+)v=$js?;k9@hd_ z5<#~BiovNo@lFkr*u+iABPAt!UM*)aqF^-(Er|r@1XO->LG&;R(1-mH!N{e1kyG9_ z2E|c;eMEuJD@j(7TLU?$C5xdBR3{fiw1qkRmMeXC7!%+&*y^3;R zqs4rTlH(YbC&Z=VNfRa0U0iw zBeVO?fko{_y|YtT)Ok>qtGi-RPcj3xk`Xd`vEy#MoDY;N|J!JEZH|#&pUYW?U89zdZV6SnR4Yz1Mgt`nsFPYr>*}obqO;vA1;Ii~8{md?_Ii|tS0JgiZeBUy z2A+8+)`zdBlA1wcl%B>!ok96HD!DsBY`}*;^*VdE3EtU0YsMR^kaU<6f2N*>?*!RP zyR)FF89eXHTXAAlBW&xg-2S)a1mIt_Xs=3|U~JDDi$4uVpU0Snqug=A*<=YnG8+GE zMpO@xyX8OiTmBgdx#?$QoHYCp@;>I^`AvE9OW3BD8N6u;#l%Q%z`wwg;- zQ9&3)a^5SPBIfzoUvxxUf(S`?|6cSuok~d3`>7h1EW?qTF&0;XTYXsTs;U%(x zs{|$v3nwC~p}cqt&<7xYi;c<#Tw~svG4I8FMHF6Z)gzTkLyj*^H&Pc%m-goNq7ed@ zy^MsqPpIq|F_##UM)nt`-Mt5pH}yb7BD4uEP%=gdp_@QvF@MKjJ8@7p^Fn1P{sgbF z(i6*j3el3@`b3?0#Wumh1aggTyyyIDjsapyzrJV)*05XvM_CA{$>TaZh6d8u9Y=UCqBm<{{I^PRCWgIa6NyKZ~04K^%2}Ls)`ACFv zYBXBlckl;LS7heBms0kBy#WkW{67_{M@Fs+iGOjMZ7hxdyR)5(|F_-k_8;T_-N$1p z2nLN-KD!jvdnRx;tJkg_QT1E{B#cnL^z4o_pOCpkV)%fOH81 zrC!JDHv&9Glnnr#!QM`P;6LA*^!hu!?oMaipP=yz)a`HWKJRwM{`dv-d%N8i-Q5>E z&&RvFyZzl4y-DwRu!Y9GZU>Eb{oc5dI*bfJv)AeMTAk;u?(?(m&S0xQ*m~i;=)UMb z?{&H_{ixVVKkm+1ttQ!-j3H@(tfdiH4gdmd0t}^KroYP1hR_N4a;%{quSc` zI`_&a)cVg4TwA#9-V!HRvi`f>Zhrmm^!tzbKkntph5dqYoc`SMx?R3)W-h@4uqWht zLgjR^)05Uk{GW#4xa4NQ$22cTmL4YWpM)Kr2gHaG75W-}N z08~1EajC>0fPO+K>ZA~N&;Ys!D}BTgE6v0*ZEq1IB%y0NhV5;Vye z-fS`U0^(nwM5t1dc8JFbOs}*ZKe%L3Gk76eNQ2eniFr@7bsX)EP(X=IAafGDWpSDQUf~}YY zycJ+rpbxYl(Rz^sHp)mMlC`}`tY)UPyNQZmT^a{i2K#4(mLEA8x;|TLsTT0>EPVa$Q z^F_#T9HLg*4sAC!HX0jQ!y@pfK<Kxsp0dv21O#Y;BNS}v>yXs^a{#_GU;QJkL8Z-3v(A2S^0=ejV{1z$k!807#_ay!v^#$v=Ys0LL+kMhyBF&%{SD z(@iu6oD6)`09~Sx#6l^HDcFAXy=b#1ywH4-AX-u}%lp9VJy-R% z?RqA{97T`MM9Sa?nerf#A)zi&VDQ48*D-#XF{7*>Cm|G}5PyV8a0L@|?t3#f4;xuB zWAO1t438$}K>Px#69cgQ3adAMycmF<_#uhCw5S+2aRq2BGs`X0RL6@@VS`!($$GwJ z(ZPbPer4h>7dK@0H#Wd2;xaUf0u+Eb`~YSM#$wL#f$FwA zArz>ee4L}j{G5>s#5aWAPG5|z3cYy+Bl99jc@zknJ>EMXMIw|~6o3T!7edhA6!m%K z2+89ZXH+N(#9`^2Mwt0C{`wW66vsH4o+O+C?D_{BqLKLQ2^hz0hLS5xWeyICRJbVs z69n`{wMey*V$w}f=?VzET)BwOr3@`v9 zsy;s?nh5{~V5i&TZ$-lA^Cb4OkeVW~ij0ov{}~Rzi_UgWhWHlV-vjWX+m|{qL4F8+ z`sIxdvm)$WMEH7DK)6#4K)>7Xb>;fYEj*ctE={UH)l|~nYLX$?6{T2~T5_0G#T%pU z?|-=K!enZ;$$vU(Ehr;%ZLT7NY854moS=Aa3WzAWO!0q>FHs~sL!v-zE?E4E6Ea3= zfU??ROD3blBxt1)pYc9a?X?o!R!g)++YSBcg#YFvjU&u33=dEUua)xvA9p?(P=ZB( zE%|PXzhiig$bzLWclbP#2Bv4T1ko7@g8|@ERjC_{w_A-AoiEZl05Av=B)0q~A5V@C z&JRy+nzINqeEv>Gj}$>%fyz-cU=z;2Q*&D~;6M z8;)e&8^90ABJie!OhXZ!r#-zuEnYAtBpd+#Zz~v!9vNn)u^mpW4xZ_Gg0GWHjIP>O zB)Q;6h%3xyEorVq+XmEj!;a&Y&ix!BGJw}D;vfNv=4I5dl9pQ`7o0ewXE>VDhKL;} z|CR(-(t+4G7y(m}*^>lR-stnGCq`Oq1mQIZ5xi7Enst!I8Hz**HW^mUI00yD3_gWX zGRKji(W?ad=%g^s#d(4RQmwd<5emnPV2T*W`2bV(@_X?v6`JPo!`moL2_;v-2AJb$ zFMHQ(a1d`&)nuCOKM7ER0?wJP8;dxA42@(ojO*-xb{riD3-=U39eNL_=y{D?G(GE- zqj#7IeU*?!JOD3Vyx?2hBHE*GMOJdqP>XQ47_(6FO?4<2 z3Iky;78wD!41*)VvPEX6`GPWGPA8;J=?se_;Rq-4C-Jvbt$cPZ3=ieGR&?2j@ujCZ zpA6s2WV?PsqRgLBM?B3>7Q=8ys-W9G#8E>g>~*XoIbPapL}e3vPsY>(Z+K_M!s$=A zkqE{mt&v16t6g4#!Lc`8B#U+fq^b>hL8^_>2kBq(K9biOfMy5mDz}u9(mk{EmQg&X z;!(TX@B`$+tlVQ4OazZnHhV-I=0{s<^!eKAVK`S6_k~`F3Paw2L`ao#Mn)A?Fr0gE z4*wz%yrNRaM?!HV!4XF;RqokWpXSgAp%_jFpyTzujvNp(Zd@{52pa=sxi4ze8uX0? zg;S&hm+vK0wft2BW-!dM4sy}6VN%ppFiTn{LJR&n;;Sz}5f{fq2yub3z98QFb##6@ ze06wyByWki%sK!I+Cq@BR<|J(q52%J2$vn=fpIeLijz6eCv!QYvO|1jQPHU*gS9C0 zWhDb^#$a|NEocW}6$YT=Yw+s$_|@y-`QFLN>%;xMv%}+~^ZnD|!SLwpaPReKQ)W#x z;CX3S2Z4(e#qp#vDH59264OX*SW9QaUR4{8wX~62m`kcO1Q(L(XUT|+7b=+of4c$9f?_i-6qG?F zMA{O*2E?5=AVScPDssLbYnH`#?|n$oK$W936nUaV21q7~TBtQPfMwGo9BHU{t22-d z)GwfiN-BG|d!6({E>&3yq}b`o_RItl=KFk72Z6lE?;dq~L~wM4fZUF09zF=Vrcd@){j|Eq;Z+CDly8;(5o zfvw%f68oQ>o$gld{&#n4_c8zfy*x(7$NzqvWdZRK<)XkPR=$WIKLYO;sgYCCztD+# z{+}VZxzSlYvSbAZMHItWpaM8d=LS`tjV$AzvO~ zM4q@g;fJn>G8p;D$T2DtQO?C$z zKYncSqo~>;C}`@qNzJrbGvpC(vZbUe4)Xlu`1I_hP0)I@G|15W=+PL-NW6j+I^5Gu zGZj`r3Dx!ST~hv;jogpNqdaoLNo*|?(}AK4vIX^&8W@Rp>c>r!V<0?k!4r*v{EHK+ zA;^tFifo#{HiBxE(;cWB*oO?v;Wc3J0s#mn=nBknv|uO;rewkchbMZ|*D5?uNuB`w z3dI$bNCd1Ai)r07>+vjLQnuUM^*Ub1 z>&k0FLEI=1tWBpi5?UFGY(2S}u;c6M-2r_-K4{^ZTJ~7_pcH)r1oDT9dDiPE|W-LvL>pVd;!CEU0um2r=7^xcnj=^^IwUvyA`B zBsxGXDbi?tijnFzGqzGEN)H@HfFvRa5CL(5E>WZmyh1|hW<$_U#L5=Ie|$2ZW2#)M z7cm#qva22s92f;SO6fiz977qNqfJ1G5D4aYI%9I_XxRV;?-x{bk2h;V22(yj^0HK$ zZD9)hMUtS1h1XhDZ7gi#=F6+Rj^ab60>^m`y}oa59`Y%#{8@hfJD;JDPce_hYnlQt zIsf%`db{@duh;4IAN{}X<@xxr{Vlk}^MP0q6C5Iu)OgOx;?K|keA~XcY4B2w;fGke zgq!zRV(NGeRj#G%E{klim3C9K{G-#_ykz8h`OiFlp0RR{rxKR*-IrH+EM=KO1uyjLX-Mx% z;%0)OrU{;;^vs70Ps@}Rs6})xE9xIlLyN8}XG#kR#oifHT&=e&BN!(*ViVB( zciQ@Q+RQ#APZ*FZ;QQ`VU`P!#0nyN@5!dG-`Xez*wAPD#(o zAWB&(H&Jr1o9d6k(Z>nIF&n-#Td(~r-~Z)RTwC4Puj3K4RR6o1^Z)5}ceZvP_y7BN za;r}cwt0*YJYH{LgO@4)Ous49Uj9h}Nx!H|+`&s-NP*V{5@A{PM8r+n1W&Y;g{Ytq zN#EVvG+M1z!*o|2L*~!gm)$X9u-mx6Q83UkG8_8jG)R3Im+DoXfSa3^Y_|3BV}?!| ze9&a4=S{&f1?P~acJkg3#&Ky=Ml-3cgjjc_H5B820u+Z*!!Q6%j$o40X^0{-lwc;V zw5&2Zsyi>n<&uGE)dH;U3iFsx;Lim=K8l8Y63K&;f2~d9ejv#h2ijU1N7G!O?E&ca zIt>8clku7Am?V&HT-@(kU!;jcHf;JSn8fIZ6OH@^=V3Zq%;W_(H)&zBO-V+9b!z4p z{UFU^jUvU(s&tTC``Qz;d0<>unrIX+CS^CQPOAG!F_@~CGBJu_f^c&)D12scn$C#~ z4PgvE0KYf+1Z@6ceTB(1N8lE4Ak;DyBe^g6S*g_|1pwNnH}}C%lH_Oi=2A7w6IVle z?K%)Gu5U;EfHFr_MQOu`BVU)ZH=$n9WmB^y$^7)p^}r{<`Cr69x90+)REOqkVaKHS zwg#_^pIxRl#cs)IS8d~CRY@(Inr+1VwsMnf%SPLIJD_I6iFlDD(PeF7)PtCrdgl6U z7-6}a+b(TxeL~x21Fj*Ez*-7eOUcqX(wim)4(c~<0oO}yEwUDh+Kj|T+q4-m)=U*n z#-`&O@6-UqpJh-%uiTP>KD=PNTU z_n%){_+RDxmyDsmW;lqY`rn(7oo?el)4qBe`pjEg$b{w?QGUh>xA6SdKv!=~A(@I2mna#FuT#YM#}HH2 z{G%SQHu`{k8;Tq?4j`wJs5x-oV-aNbUu*nGh)&UjjjA%#tV ziyN)agVOWwpwu$p;qLhMvwZ*ebsm_tgF!9X|2zGyt^ED(PXBTLzn3SsDdj>9@F}Yl zt2)6?ext9=!=hDJ&@Hex^KR_srj@-Zzah&rJqORru{<}&Ye=FP2Za(6r^kohm*5r4 z*MA(Wb?IX~OV)q4lVAVc-L3xiD=z3hHxj#z?y8UMj@u?B#_WQy1c(Hn3c zo^W_cZKsU;8VwsqOr-#jkas(sP64udsq3(i+BLea8eOBt`}qg6Mpp#T$<>fA(+l@M zL!*Xa_9cAtsvSKFWLcqZ+DGBHSb{>g-&x}AScyfg>dr%-Dks9z+4zcAHoD8Imd>8C z3f2U&g`^c2L*-Kc(yaDDKDGD%xeN$#2ljv6?M}h|ufO}4|KVO9#R^~)ly4Y?4|a?Y zb7L{Z2{mJIH1&LvARj*zmLac*f5T%!JpN*kI)Ji_kVNd`~|dlsV#D)5psd<35rAP zL+TQ~&9LJ7^ymnGYWv3KzsrinsHl$9s$Ix9wAu#XdE@WUqUee=U8)<+tG%nX(Cl-% zM?QDl@!A0QT*l~@cEH(?S*^4+kh5yf8|j#-II_m=3?1^SzNAL8Q7~bXFRZYh1_0x| z(`rZsg?5rR{hIc-@3a9e0JY-k+WHM3O;GcJcjc2t+qG0GHZ)bnno(I)-inH8DI0P3 zJkcht#tcbqS&M{9OV^!-PGiP0Lqc@gbN-=e&?QLAZNms-*E za{bp(tqOE8mc@;)4m;~IRB2h;1sWEinhr39!;KZOPjiSk1WyYG8LQ+o)AY7qIX&Gf zPuoHatDwKR){5@YQ)JVtJg9#J1p9-W{b%UdtOS-`Y>Vyg5HUIUCi5sA6}zfEr3{ zyAAWmnDGNO6Y6QG(>4;qh)==+INLvQG^N$aCC%*Y?Chl93t1!d!~A$e{ENI-L_vL8 zifJ(=gnnj>#jgs0SFnd4d2YGVuBX#cP89INe8d4A~wi4)y;d>e~@D#ux=yHsn znO%AYZf-WSiJbkF_sJ;{O5W`K&-stTy_56N;r|Yu6Cw@a@Vxt?_ogsnRw^jh$my0u zD@Vg$mp9bwbc*d*xuvSwF*fU?gOlUKqqFnT(c#(tkJXKu8LkSA=TmmoYJUIq+YuKP zj`rRx>2SJg3Jsg7%<8pzuwUKQ!G5>UipmF8uYuFO{hzCwINfu!ktP|d*UIQ@@AT~a z^khkIMEvw37ttBVs@jr?neyO&NJ!52P{b%whW3T`Qe;=rB4ZL50GA(cl)r8svFrrn z;DQ+q6g)>M$8s+ftk4JBmESrRHrrzywdt(637RdR|C^*h0c{l(xH? z%gj{@D9*)_tB|frVb}%p$Gm*zuTn7iqBfvnvanJ>`J(ki+0PqH@Ci&46ob|f{ImK0 zy*>KpKk0uO2-?l+c(&l?=AX^gra=zSXUu~fr1d634#?UwAqVF(ra}%<)m+FO@QQ{) zdKy?~uGDVGtfLKu%4&2AHSCjJzJ|6NGHYlz9R5cYaj=DKZJO$qi88hn*3d90q$L1o`T%%W0oV{T1Mvmu|burbn!5dOO^&4 z3DZR5GEnuPtO?hdJAXlI7B}+V=ZZf?e~QVrteUYp^U3^Gk}8)*$WgScM>dKEz>LkV z<#AkQ|KrV2IG3rqKikG+ng8$hPCw`W*YE5;`v2a`vjI*ZV_OIGbUrbK_A!XDAH8G$dnb1B0XKCTAUxi7dg8&5ZXj3K|pR82__2)4iAR3;l;`S&)&PY zw{0T}0C2jYZ-z7yyHr!Cd%n)K49c1(Y;ZxrG1by!qwi@bv5tXec;s|DPTn zygWYiM!`MwF?;{-wzjvc`+skH`!WC5gFIG_N$0@Mu7t6v`#iCNpkqqPqe!GA3{?T= zoU063VOY)1g!M69Fec5iLaCcf6dOoPR6%`>Bkc6xiu-}y*a!z(Dh~u1Lqt{Rb>9Sh zH>oRpJRp0tFUgpJOhu@N^Spei^cH4fxzL#|kcWD|v8Lg;ls`8?sC4w3j??XSdqfN! zc|7JF*r`GazN!IkRQkyxKkJc{CzhPq?RFjKppTh3RBMVnqCSQOLXFuc5hf-fM)$@0 zdIHJ->91C&s)I^StpGEYtBJv8wjdKa$GaB(%I)e3;JR^^4CrJBYisZ>9wY?A+Q?Or z;V;uizAQ9fxdnoa;t*5aREA(GE`+$XwKZsY?QO5+IJlZjq;+|+h`Ow(vJXS;m=GBi z&1cVBJD7Hdj`%euA<0rq1*~{zU=egNo!8Hk?0Au)MHTLX;40?|OMwYJ8kM8Ud50H# zsRiejY&_4VqKB@ge297U^SLVTF3UF8EcVQxzmwzhNuCQwH)5G`gX{W4_#~kFcqsv+ zv0Dg0CYT>0857%Ey93i0Rd!(a%wkZx1}4N}%FU)$X<}G3xye1}+}g~Q#&}f9*t<2E z_NQ1vX22$Fd>;fRPHn0euHO0XKsz++{TBu5nzxigPzSb_)30L#${Jnl4C`79dMTAI zx);>#yBQ-?318)!>hol@1+faUElE?reN39I2*Z#j6fS0@)6WD=+(E_y+AQ$wYMnvz z{l>~wHy!5}$rzgSK_sW-l7r(}3Kl}P5SeyH9^MC)wFxs_^jU)G$*av zBd=PY?|($xeCp4~v;adJfq5yVZF}dhfF6tt$mB^SnvQ#$mYZ~$x)7o1p?!78C%8&el*NYP# zWWJigBe>yN7(jv>lSY9$q5_i*M1quZ*e!r-KYhhKI0%Jg3gv)=8n}eGTQa=pV)<^# zNTTa0z9H{G=*_WJyB_9XUM^whjE^X8(<&^Y8{oe(xhc*@K5Q6wf|$T3S$uAB1U zpVs1*1#^E8$wnw()fUo6!oEBax|1h~wWh5@|0!ILkZ@qrG3TMm9A4(&Z~!IPvA9|i z$c(5wLS4+2Z{jXX7HDuqU0GJP+`;zUpx1Srg=ttp!Xl&dE1!K;2N_wc8VGqYu<~8@ zqLlXDIWNJf*)=9op~#adEMLbYAtRd7M3~$)1s|m{@aU{oEXi*n^k^OD7T%ibF!9{N zODgZ zxiwb6Qa3jcol(6Gu9OUBH4WVzuif_cmIkT}S7C-)*U&8-AuO_#j%NA4nFd!j>d{0(rcOE* zO$Sk~`xR%g3|DRkTEFhgaLK|NI82(Ba_DiMiZmfHMDzyykkKd=@Ed0+F)V^&J)G_C z1YC7X-hvC&BCeqFG)ZZYTM!pedRC2tEafATGM|Lu7zQ+=suuBmo}e6)a_E*W)-+2r zi76Yvd-{E9|XHfY4spa%z-1n%z-+iG2D;t5!)4n8F9)9uSA|Kh_Oi)zJacdgy+`+`duh}9ebtH9NM+PW{e&~$9FF-2(6D@h-i|M>YB4$#hQ17p;THz(k_ z9|j}0z`nP6M5XFo*L`lRQrpli6viy7yt?U>XL;G04FZ;ExITVb^(5DDm7SgH@m0WO z1ge1hS2Qt~3zIdv7w_)`SIJpwN=q}~lGST#+!ZbwUC*t53okN}@)6MJ8m>vgq}V!h zjop17OaA^-@pYn^*Q@8E2p#|%N>`l@iQ*YGE;sLEKh~H})zGhZf&ziJKfjo`T$nbJ zuF}BV3tXb4ySIBeE8Rl!J{llMZcl<*4;SKVBNJ2r3FBe)CbNhau{js6!mz5!Pe^>} z+f*Xpl#)Q1S|s@QF9}O&6|Vflo5)`dag+F(%J83Qda;%agQw3*8qcnCNN(WlfmVn*C_UEJ-<#I1a~nV_>;gDyU73 zZliH0`c)Hsuy0VU8r?TZKoc6s zLozm(-KGk}vJNnj-);sLT;Hw8Mc2Yr@*wIKz5K{;fcH}x>GQGAlM$j!fi~GRba(C( zuCh~7H}3_nj|(_tF#$ZAy7Hx*b~nY-Y=5_|?&X+8Y?O^87cDRsM_u5;u z%10k)CsKWRE+O%URI&JY`#K~_9ZiGMMT8W2nZTVgo}rq)h3=D&%Fp|gfvZRoICVkX z!kN0YrWn8ig|pM|4_*{E)*yy>l`k=cZB0nv3oI)mL)m;`ISu5*#mppJq>_Z~?vTxd zYr%_|3QT%>?HYG@5Uz4w&1wACA$~Sy>par;()|@c zLs92;V2aL5bkxIjN4;E;f_|3ag2tC+L^WGKcMAubo(Xss=j&6G9FE$SfLD;jzBqOPa3$2wTJhRJg#Rh?#}B>#`~N(j|)=$ z`&jp-c&k%*!!s68pCnd@*Fr+$K^?yCe5YnbE|{(>x9Eg+V0b{dRD_RO8=XU0%3OAg zR3wmDfZfC0sE!&vtC3sVK@UaQJl6Eo8h2e^R-ow_vTYSEJ3RFixbA{4G&Vl-Nl2|2 z6{x>i#1(?~D>mh2M+jNIOpx?5pX7?-6bXN#iMCmW`q>=IXbeL*(_636>iB#z<}hu;K`Vv-K` z*FSnJr6Y0CdS5u;$@V_2Z$c$Zm_o&yERC}?hx;W-iBF@HCLJJx5#-a`&VKFVoMA)z z@8af5eiJ#jO?CCKf5MXy37fAeYMGk$RTO zb@1GKR_@@tr?kEI9c{a`|J|;;+j>e}(&|x{?mh4Kf}L&he5VEA7ai<)vb}a|$7?;S z>tWB^F89zTyW73*_IBLo&$getyX~Ft++OQh%k4ei+v`2=_xn5BPXP)Sg70bM4@V@q za%}&Ni(;{fR8CgmAs298cyeutlzc#C0gWsVpdGJeC(PkI6zab(&afeGn2y3tz_pn2 z+-tFCz%agSX3zD;759tZ#dfQrPoeuzd9|SDPqjqh?B#$9r&$C&o(@qviki|Jv`0YA zk|Ol*U8gOJzKJE}muDqUNeFEiu`rb1ujp8)3R%QZ>5sRote2s;2)Jkg@&DevIemAG zhpp_ZiT%irue5zG?6n{r%5S3dI-w#9Q(zGc5)uzhdpbt&IgfeB2jl#DQbDfruYeSJ zc>>$TBv#P@BaDK9L;cqV0=3`Xl2Gh__peQe_S-6=0Qlj)9)cV57>Bt3?&Ro)H>bz{ z+Gu;8F88lZa7Xf_j8qs7|KH&bxQX(r!oltDwZILzG8fzb|C$KECCO4QOI;@4-Lx;; z$DStI9{2x4JeB+#*D0Ua`P~|G{XS{{uNxNOn+(Wq0nVANp1ZBXBxvW$FY8 z52;YFBcwfwhRaO3nqpv#ycacKLGzLlG$QJ6hCMj+1|C-S6dV};!NCqC#;gX7D@*7Wb+N}nB5Qh9lpb9eOKmsXW zk0*VFGLbaJkR-IS|5d@Jvj!sbhdAC60UnP+6xc&P*!^wWixVExBxO`MRH%3j7}ItQ zChK+JR=x)*x_8uH01*`_4dfdYfI+^WXxpv{`?{c3F`Y{-=3KJdgW zgAs`x8eL-|5e1s73t`=?dD3>X-+#1FdI!dyZo=qA4FWn;R-ORw39X z{6hyC$dBkZc4D-K9R;G{IA!ku+_V5|Q;nsla1G6N)~tI{p>O0J9ei50<52Mra!uaE z62}eq*U^Xe0Nh_kqCG&$X2p9hM|$?-tOJd9tJNB*XvZUM!qV7&#pD}x)wxh%hea$s z&HFOrD_U5~+t}X27UYYyqLudc^JAvo+fde4t5$M^x*`2y{YOga_9Mq5rsd)P8je#F zU0gP5NArdYXp}s`RO*yUnC@zb?mRsAPU{tOoTNuERJhV5bpTCRioDj^T4!Xwv+c^=7LnF*0FE!k@CvUbJ8n63cZ+1!SS7m8}`|i?d%>FCANzs+80tI z#HrXkOtc?xSMU){hw@ZWO-!UKUMr>0SP%I67OdyB*5B)1j>@T#KTl7^2`XpmZNfOF zsz%>Z6JJePy!Fv)okh+X%!m-_^T?-hDw@6>kERg|Zk$j#ZSwt^d5PYvPHgvI zZ0I#8BI7Cc47srpxuPJlghG15)iqYYqxBRc+bjEM3==2i0u1-I1}}yr8YsDfDYg$1 zI$%7~vFwOsn+(?^V!U#~hKZkWA#`EkkSJvb+5o~_R{SLS(nc94LoQOxo*)PDBS``n zQ4(pXq6l29`oKZ)C>)~zp)IZhV8}ft6i7mWMm!q~b=Vud_eS!NMUIJJfVQz}DWcaj znT89DNSWH05WKGioj~)zjUE*#(0-pMX`?jc4m5@&2^!V)Q#K5_$Mr*mV1vk&%SiUo zT$BHGO;2u*ro`=2l4c1-fwTZrk_9D=8eFU4>Hv8JV`v5FHp@sDjy<{7LKI0(otbiK}#b!aA!n5yemp{pk3nSE93Gv-zen8nqHTU42W0CZmn;TmYRk5OJRFOy%+NX)66wPPe z^QNYX?vRo&9ijojnid&cyb%#^k0i#YC0V#xiVFRAEio;pYbx?$kKzg*vPp27k~I_RDl19mXO> zy)n{)-OWM<{A@|s)|S2B2b@XEE*(|f;tPZ^-6{)V^i1nkpJs|WX?X+7ED9o z5+5;Ul%QINBFQk%rAt@cHn}=%t_t8NS8Z6Z(7Cvzrl3^8Re2*(=aM(OmWx$2ZR0hO zi5!FzYBFh;URs-E_Dz>bJMeTzYpKr*vhV}@VDRe{IsA;iz)Ik^W~J^^(9cZT=MOpj zNW+jTeV{rfM0zHVZy1s&2x$U;x22>J6@mzx4Cg`USA| z4MJV1WQ0;uCCoeT{et7)$^}+ce=C$4*jW110rBX*HFAsmc ze0y+yet3Ga-w63Yq(lteZyTjzXFndCzPx<#=H1Ep{`1n8)5Eu~k6s+;Z|%~z!?VkG zr?2mXla7sTN7aB%^RCmVj2gy0HrIWz-$-Hfs@1osBk|NEnC=+fr_ z{q(PB9iFJ>HyiNHJ|-h?!29=qm0Z3EDUG2m|BlMTRgM4p_T4!&bp2+InC6ob&KltU z2;Gyro|JIg_*Y~7{Z_-s z4vo&ohMLDq-oI4y*yyZ3u@Jq!WtA{fEX$NozW(Xcx;aEklJ%t4!?~hkbWJm4_9cxI z>XVcP&YDTQV9d2ik6$BCRbf*+&7&Z#r6h22o~63A$y8kr`LNrg_oFATf>4$Ws zKIYkf?Ce(Vf45uPyStC~zYp=WJ@|#B{t!i9V~ISXa=&3NAPQORIRHg2nL3-|{c4&> zWoi8BlQA(aWu7eG24+S2NpNqRZ4b_=DAGG9t`RZ}bM+$)N03sHDv*ZeXI+{~a9uy7 zB+BC7(|&yDXR-Z%Iiz7s6XB)t3Z@`)_W$nQvv$?~v%S0hxc?vG`S`KF6U}hV0D+PP3{(DP!HiL6GPmw zChe)sS;MV7vLhd!?%;qbXxK^T5`L}}dg-N7h`aszm{+*GK^%)H$IYRh7 z=NGD4$MUJ{Lykp2kNQNO|3Z>K+y6|0*=ID=3PQZUv&=;{v>3wKg|%1YZ{eva)l_ug_*+dh*CQrD>MvymWD#@HkO9?Q+veB3=$a-k_$Zb~QR8oI?>o2E0PlsR2lwRRr7L@{SX!Q6eO5q&#Ia~zw|g`t+l{(S zSS>kuOst9&qaU1y5L0epWVClz#RmP5(nx+VIBCzui8ilc(V*~>saC7O(wAoZ^s^ZM zuhiZn60c+oK2QFC*50Y||GT^GNB;jIo{57%8SYA&SaA(eo?=4-{p#ZIp&IVJTX{*fk7Sa0~y=cuG|@Fv*4|Tdx+x)!%`JENAiApFSyL zLK4U7;{u~=I0`4$fgh7}xCKwNy=`Z|7TNN=QAOd?rw-iW0i~&56n5{QqAa%m z4f$Qo6=cr-Z$I0c@c(S@J<9(N@>KS}nP_t#nDcj%Z9maG?;Mu5sHDv^-tr{1*S)c- zC<^Ls-^%506*SP`ws0#XX~ur6;}+!R)HLi!eXgfq#Yk~iu0W%ZTuhLXITT43m`&d_ zx-h^%6-RaeOl-`)o|V)j<^Lq35ImclSQO;bCr25|PFWFYsM}4|I12(dwIqORU)`4K z;CoX{6_q0{-dJ#{7xtB|EL!}w7ORXIVGk<`dInxej)OnXs7T^D4b+&Jhp7A3vLxW8&! zR?-|*$5YKuJR+$-d~K2NWqG~@HriMEEWH1XsgRogr8vQP{9miRUETlNPapUHgFKbJ zKjB-WL%Xle2rfc9%3ap;W#%HJ0AM=I(S(fm^^2Nr@upC;HcAX-F?6d@!?fl6-Bhf| zk_Gd(UDcs~>6Q5Se2Hf<`k(M{mB3H>nMeP3S`+p^yE}W2^#38A3jMe8joc5(#|BB3 z4tc`18 z!SfpPI;m@?AmMXoOCEnbq!>&Fz+w&N18vUA8O!bQyr_Q`qyHui@MpRI+ufVI|8GCW ze|(t7bzP@KV5-;t1x21DH-!bI2@O|J=9w3C6%$CWWK*_S6PEt9eBbl+9}BBk6;#e? zvmteq7G=;@(EwG-6xV)Lj7_^Kth8g_FqZESjS^mY*jq=1oz}cg@&09S2`XK>I$bA@ zHv_Zn`wzFd{;?t7=f`Ogv*7&2TlL1=%uU>OPnuntu1p+){H)C564bzD7cNcXjIm6F zEU*WZe_Uo%r50xltsD(OZ@o%{gc^V+t5vQwOLyRPwd^PhliikLFf4XE{?$-Qcc|l9 z+<|0P+5ihd^u91l=#NAcP4tgNh+|%M>g-pjq;(bVkuV+-uj0eG`zR11CJ9P(=HPFlTYqcow~K0o~mYXB$0h6P3TsBhYGGoWz5&|EJ*(?f28}?|L?Y1?Ppc`-+J`_ zewar}H49o*PjgDMEUWEMu&erq{9#o%P_lr2az)2m@I*!8vuxfAjgBgh1<@x2T^6zU zEKU2w5j2q+;N!<>r+C#_A0|vD=;E zSDMcqzVV0DzY^I9;WX#chVrfU%qsT2CxW6wO{3zA+}OkoBZg#q@2SW}c5svF!z@w) zOh8(S-&r(K4eMzulqxkEGd!5eQEO*f?dnoB)Sw1x6OGO)kq4x+gKy-;zz%z-;sI~j zvG1k>WEz>igl6azEL_wicUW$d=0ZN}gNgGnUxBbW8;0fW9Ht+@1}z}I^E z|8$u??0~XGu~L}XIj79@spLrsyLPO29V&ivMghV5sobX)p!vsXi)JEKKvA+Li-672 zO|Ljfc1;-hIm4elbbHewMYaOz=O0v-6qeB7B?iVmQ$&MBgQG#j^Vf$TsEtnCyLC)=ao!XK`OO@0-b$-QmW-)sZ z_H9%&;ohrimGL~!>A83e{j?H^Rg08zjLFt!l&$3pYhTUb^770)B9HrFo;-QSjnll1n;{EDs&1Y!m4wMxAvt)RJ3_MLDnMh(xi@kCHWXY9EgJNp@!#i-+VO6h z3;#H*$HxrTM_(CD^5vxl7UrC0O;I%|Kv8faT|f;y6SbG&<|@&${@(W5I}66j%A2Z7 z<6?)5oA^8fELP5hHAOC)4DCIs$8t*vD6@pRs+wbMw`$@L^H^yKO}S!;Ik#JR_!AK=>2j|6B?z-7)_WUO_)mRYciSf$Yi3j z`eS{#fN#M44?OvJ`1;`N{OHBy+k>;SU*4R){GSh>;Qe1^FVQ4|)-{6UygsScETM}C z#8^Ha&x~ii2JI6~HQ;szYQgK)VY+XzKLr)L1amIo67B#b4A+NunH~4{VmD=P4C(4 z^I5f*=9CAQP8Nfsevu%P33VFDwVcI8 zemE;bq+Z%+YzrGY85+bU$Ju0D?ukrj5=XFE1IZhCkg^nSW=sZ4Ogf4eEqM}A4QeWA z*q0C|RK#5QU{>2aJ3lx*zx?6o_2E7eD36LuZ23~2{?0`CVVcIUu?Zh*G)9>G2xFz~ zH=cZKS9FAS8IlZyEVEr(1{o|D++SZEo`WkUfzaoFd1|tQSce>&JIsc4vr5$HQ+t`?LZ$HCC;_Xho?e&w7a*}I6`7{ZKLSSExuUKm{QKR^@O42(4 zBvd;p$)bowgDnW9XlxdKu{~8znelo}%Rio+r89AHP31J9=?>@b3J_ zPq6ajH8H&;4b-`Q`a(fpx2z-;W~usKzv?Dmu4%f*`iO0iz{7T{wFP^v9hJT}qzT4q zV|_S00~4p633%##n1SMa@;<@7oeOO`vL*1Xx&;+f&(~vuQSt}~6{B(72#N??1 zU*&2krqssWjJ4BVkXlW_fg%OJ5SAywE$3k^ow%6L>dvQb9o=Ak(B$IMxtIyo{rAMq5%H2pl-nmzS3uO@lcGG922WzGGJ)MI#P zoypleIkP?CbXoQ$DmP*$eV*Uagu9TbGE?`K%+|Xp8NEjK#2oPQ&k{26CJ!ZZr;1@3 z20HRW%@-w|8uPGfyEX0`Jj^q;Xm__sxs~-{Kw(2?3t5bkZf?S}dSP3yK~HBuzEquG zVj}%X9L$!YtTZuYQK~Mykqtz^gwL;OGWPyMBX7haHp)f|fs)56RdtTB%89H|2SE7} zZpKU2hcLZ29G8a|vuNOD5%Y;iRRrZ_@jT17brqxwN`uSK4@ni#)g@TJ?P^Kpgt4Nv zgH>7)#O%D*blD%dNT;-Rcy{@ZgP#vB-@H9Po7Wl@{~*`oO`O)PJ#COEclZ`OF&8kF zO(O37dITX+`uI`RuByQ-K%Nx$I#ZBer`$q~>B(912ZYEcQTK$}l05!e!WtJoR%OxJEjv=vOnHAj}(s1NzuSh0D zMn&`KPDK-6zPwZYxPyfFw4a5pWk=@f6#HLRlU{Sz-4Mfu_47`*-SwB<)0DyU6v3ZI zsaohe_8V>nE9z5gg=nkk^{U7_A=B#o`$jc$1xogZ1vN6uak8^Dv=(F~)vV5)Jvn!h z)M4UW3KRARW?mH(`;AZ`_P-Rxh$6TNl!_m^ef8{f(W zV(NdhFPF*5o0o@|X8lZCAPOL)C`MTv@l=n;o77_U5=yS-&2~+rB9(MXHM@mZMDoBe zv?ClV+mBS993rJL1pFqd_AWw7r;R1mnF0O zWgRd@jd_Ak9ajH@h6oE7A>4-n!X1nczH~T($LE2c#o~XYRHXPHx6JdZD~@>~LFUDO z+HF_!f9>tHb{^w@Jj7Ft|8Z@l<(ZPgtD3mb{rC|Q5(NigJS4COw-E9hn#eD5$u#PM zQZ%G|<%wZ)$oW;H1Gu(C=KE9#E8xVP{AG2tq_QQId$)nCF1oEGwpB#7lECId!}W_F zg}64yXvvm6l+>}lm=bZ?_3vsIp6iprGU{C-?&c1m7eVRF)86c6B2MTvP5!JW-z@s? z$xX`8De_Kz%%T6S*7nmf{ck^gw);r`ALNmQO*9=Z9?QQjec}&k^Ut~&{)Er0{eMiZ zXrG05+x&~{|DC<+{@>nv%>VcxkFg5yyylRGF-=5MG95hfMputy;E(^z+W)7A2QQBg zy-{$-K4$L!_V)JfPOG~AThDeM_y0pYYZW)UA89xOjHKl_sIkTuxIECp8bUT0rYZ^s z+>o)>zA0~8AW;BG76H!^;Qc=H83~<>at|-Le?=3;*1x}a?>Ub1w{Kimxfwvf{gnGK zpb^GT58(XG3lo>TX1x8c7Ay95>5}@(|0GP&+|9%?(NHi^FwUGaa_1KRWVy+hvNOlT4Md& zl;4jck&-ZE(ct~Y8q0s+w|DU%A%XgonZMN+A?3x0r&KnY$zLx1!mlqhHc?!Dzp>`q zzc*2Yy(mIAz28_1@*i0LhlBt3eq*gq{;kXY$ZybBlExv|I#4y8JOW~rnm+vW{0ssn z(uDOe?8*PW-&h;+8#m>ys_M$B>Ppn*kxN`t)xCNyT)S#*#{mtP3O0p?a2QQdOm>nN zbFr9<#gw_d#Ep_CSv0_=CL*eRX${>x{K(2Y{Cwv4__R?e-M2gn% z_{-{9mv?1(SC&`BT~%C7Rk;VfMB&X@VO7ujWfEX@po_a)2v-+(dB3a!tnVNWvjK}l zO_e3xs=m#>2L;8MWttWrG`gdOHI15u2hpOrK z8*3x|8`~?^RVGqC!s}>(bFEAJ_}<0$ICrL20lJz=5D|&Rkf$k&1{U<{t80HPS1)L1 zu5E>wi&QTwNouU-ins=OX}40^&=9>Fk^K19&rMBk4^Lj+E3titQ;6Oh=G*z37oDO& zpy<9l9$YsWfy+{Gui?o?d=qSTlu=RQ!*4tpP!a_R2}n}|=(@^6Llfq;HLwY@<9rJj z@|b#m@gDxZzwJHuS~!V++wodn%lQ_5%5!tT-}l?zbLU$)R))5@dw@;abH@(3B>UW4 z2c;Z=wW;}7At+9-@ZcZ}<*rJHRM7l2kc8&5Ef~YI5yRO^}X!&^x!ymH~h!X$1tQMcAPUx;X-6_%+VvTbf^f4I9X-H z6WLcvSSUP&=;DOa{6NkMq*SEF>EoIA+-n<(;>igyzW$oDSZsuVgvPw%bS1^YztP=Y z6P4U12NlHnrRVdmY*YiIyEB18bxVfyxGtLMmAyb*L%(!gW9CyT)m1~z4{pbKtM&p3 zZ^+mR4!^tT@E^MpG2`H!0jB6_3o zSfC7hE*JwjT*NmbNH0jqe?{4-M1ahi~#?A zKUB_Tw=m@HBF0iK35FvJzj*tuc}zz<8ACTW+~{HnKBDPRB0^+L@f~;%ZsShQ5C_3V zaVSAhGbMW%5f-I1LS!InAmjDlNJpc$foIq8*cWwGv%jOEV}xuV#I-8u;Z2g$3V??^QjA&^{+ z-1gYJWELSvh~A1k41h;e;A+K#@%gk;2W8MvlUeqE%D?PjqNsAt(G73PW-&j|ag9k=*&kc31WhlE;QDa(T=m#v|N> zq$g27tnfNciQ&Y-(GM{f6mcl@LIoOKvxG;;fn1Y>$;GJHGqgt5vD1XZBEbTxkKE$E z&x4o6l;@K&%KRZvA{b5dR=0-X=o1nQn`j8Mo-uUKAz^_RB-n`vtROk=-EI;;J=N7tCLXdXt*^;O6g)HbA##54D z6Vz17N=OmSX{>0WZHJxjrm`kTkwTPqwZ}eiMfZf{;3`b<=UIz$)*W=qdHqc8z3$W+ zRixIJyoED;ei)faa`r$Y9dbRbMR}5icoy{435G-xkL-Rb-yqI=6pcWk(W4>-+VAru zZFuk|9nwUHa?J~>yWQY(Vz74XT{+mPD6FX=kvh$mpldaZEA_C}|68+hA|+`iv>P)n zW63`mgdiK-8y7)m;6k3VRB_m7i}87Ia_8q3x{`st?DOPOjd36O)W4)`M0u9(w?zfv zHd0TfFX>w)hLkWwL`{IU3)}zE$VFnvvoOGl5&L(B>{UJ`n#qZZv_48Y7eyw=7A{Cz+tirzPfriFgNcf(0^g5}Q(> zOHj%fo0fz@v=+$Il;_;JnmvY@IjGF~d;+RH3QP}{}>B<8S-OYJa2#tpMycbk0{@gro;2%eKDi=N7u|ucHs`0l2@8M0>{4%WEj4+F=UnD&4|6 zy~ib6G?JzBJC6L8tE48&l{AuKW&&@OK&kxI^&~FKh^IMwYU^Ulr=RIbHix7mq6IL9 z$CK6Vg0f%J^ak|?UUi%uc-q}u45^LA3M;kjEl|@yEluTpNd}Pckr2AR)j%D&?WS?q zg?<+Kzb{$$E=WC$uBYyPxP?P>Yq_XZa4dENeO<@T;?JrF)ns7JDm%NtN@bM>{wS;U zE-Tgc@t$a65u{$18u+82^gfU}g#s*&)IStH@mUe6{VWWn)bi$%dqMhwllEu}nH zOi_*=yxg#PrVH7vC%csgB3@_BJy`GaxrOd`+pX5JVrs>cr=F!6mXwr(yzM{TdJ|G|Z?g8+_S`}jEkzc`Yk}06b><@V5B%IhS6P8s zhCLN+QAOXXkQxmVDrS*=Yx_%{>O$90*Hrp$xkhE3pG*sAnZDZR7DNs7GixZMTDdf8 zQCn60DNP22i=0I=XhMdoBwTe3V`W?I{EnU#Re#1vbwPdVh{QG{pzRreMViq!&8Y>7 zxYv4DWA)Kmh_S)}HQsU9{9Z zx6s8qO!t1wsC>s@@zvE=^P!{fl<=r28{QL!n(0{mtg!MN9siI?#X+9iPQpv7xN>AD-xTV zQRrRW-Oy!d$OfzzQdJn5u)PWY1MRK{I-9jbUhP$tfWPmm-mXJh#woVaAh%wSNk!R*Ldz zE47MLNzo>}dHyhnw4W7ODvPI?+ORQ{FvesxHhq{EhWJB$d}x=1!ZOM@g`ArvOl_N( zxH&NHuU*(G)28xA)(29hU6Lm=Aq2P7l|=Pkqo_K0<6&2~kg7SkrIC7u(UAF+npKI) zu2H8(O-VAKX<=ufO?!Ai#xZ_!BJt=7>jD#WjswrY@ilsw3k~B6Z2?;|Q z=5!++(lHVa!vHJltVGl=``kkJtp;~N)EcB#A`wn9|5Nm-l{kmCR#i$re}rfC?Qf7e zu$9J@0yO5DIR4*DC)( z?OUr9Unxx@*~2stx;hS}DfzZK)cI`vsz^;3$K@6hA!;rEZwo$1Ywj-I+LdslpYWVQ zNY*6NgjV|ol*+>>6RE_NLSvwv4!_E0MTyD;=%06+ng{Z)=TRl{Qt3Hk%2xexpO?fyzfsx?u1c~T|=XA>W%F2)tNe>rjD9F|HUmC-N| zv)1S0^ZK|2m&r=OB+!m$ zCLQu06P@b0<4T=ws5T9$5s%zII%4mNREuyOy)CcQGd`l=hdc`)PWUwoXd-lsN^^K2 z*E&`QnBA15x<_x(Ck0v9YBwnJn)H9xwVf<{^cI7djUzH*KE`q*LIuUjeOyexWU}R6 zmYQg4HsC549rmVUP@%;fC25w>EgkSh2W;_HXQ?KUdWM41DF(FaYMOfVR^<@ZcT6fw zV90OuMGB_rS*G*f$Fnj^rI0G6pn89*ThIY!FH9M^{0f&UtxJ-e7OQ%sm(FsPLw&Z> z)>ro2aiyjSiG;+|1Pd^E`sZc;@GJnvP|<^347X*ZB3oGBa3!dZ)NKydZjn|Kyz@d8gzJ$vA|EbCB)&wIEE-W@h|Wk!{v(F_x^Zl)l|igw!s=2RQ%Jd%o`m~odmySLNR70B=?4yitbM973;!g z9@C<$i&!=^6OtQ&fc4QTAkAC!(H!P(&nil4XKif_imXB9Ak_~Yi@J#aT#oDf(BYeJ z%b}3_Lf>Jk9g9EU=p}5tI(oUO+;wWMKrD;K3NwUp*rjNnP!cFlCp^U`EPo3T`BnuK z|KZ^OsTo@}cT+W2M-jAL8M*NY;)Dm83LqqW5|$#8l#(JjdGuzqI^Keir$UO{Bb7fu zZV78ldZl~t18zx@%Hazh0W*3Ihd_^|kS5H(8W(1Fbd)EE2)R!}8z3uCnlN!Bor_}@ zv8$}7vxt>PJY<7mI4&hAxp?){;romCTd08(d_*VkhNqOHEvChksDZ+BoL{KX+nM`5 z#E4%@lZp&7vcFtW*})8BI`o4qdrbWI7w_fEpN>vm>OZY9s-J$se|mnVf4+%nbT(vt zxf1JEOnuTV$2kbYngxsI(0OhKjOAHG?(#7)pML5jI)THkYX!$ zLDZvCeh-pW?@<+tj|N6(r;RL3g9jx~=z3=eRdd@Kh26WdzEaq7%Gfg6!#+B{vZ%-l z(=_QaJX{-VFw@Vsw1fJ@XCX`R{(CZLdv3L@c7GmcxHm40@6sFYbaPkeB32=4Gm5Rf z1w5jKl?kfzx=(DUnX)V;*OcHFUaV2i%xN122o1Peh8I zj-m@D1b1ETf?O6#xr6$;95K3pL~EZXBOpccobw?~FfG(p9#FaJmX>m5O2SlfC0%vP z=&hVd9O-o;SRyw?{=rs{Cp1Kwn}=T)j>s@cCyi3C?)X?WIpSpMP!nn^AJWBS+!GzG zN6<8j9Y3Lg?1F?U5sht-V;v^CM(ewBtD4Zr3?DeN|41cd5tg{BZi_7?ujm)p_!Y`i zj3?FvDK`)c9uE#t?!c3mMRtNb6$oBg0z^C+kq{{p{SZ?>)%tj1+2SeP(1>3v9^Eib z=)o`LG7<$+CS^$0wmmq`(gNWk)migM9-_Pyrf#D*h9cv!S=5^_;8Zw9ki#4_aYFnQ z`9mclnOiLhI~$EMMbB8&Pl!m9%ulm~mbchMdRWcRmQuhv&I`3?lul9}2V16=ItL|} zVN7uB=CDLe(xC@O$^pzVRO3c_g6A$}+N>0*vNkNmGhY1;SxOTU>Y%=!+IUiY^V7Ty z-2x_EmC#3iGDgkIr3AxO*?eWg`^ul^M(z~3GfM^cy{7(fS^hAmI}sB9>T)Qlgziei ztb2>NK4+zrhlM?&d{Mj+kK|UB1H)5`US>(Szn&-T$GLiKYoY}F?&pHgmMB^1lQAU7I7%;izo11ki3 z5t;2gr`4$3N$54>S+RgvgaVFk3r|<1)2I&*cxRC%VmiAt$hq?(`D*5V_M}z^Zp~e7 z#^#(GDwMG0RV68;B7*1_?(1x+8$BxW@G&J?p98n4⋘Aaq{f!j<%UuPE{mq2%3@~ z5I~f8a)q-b_EPrH`8M2X8WCHjk`{K#l}ETxjX5 zZY%5FtXlQaACf4d;r{xX%3~d_*O!y9-@}Uig(}QgvsjOz3Z;-Iu3QmLceTydol62s zxWdfla>a;_PI7)l$0a(bbnz0T4y*=}LdZY0#DLSE)+BA63|Xl*gptQf?w8b=Og|j6 zn1(E>Fa>pq*O84gS)!3CyfEK2hoWv4F$;4IV{K>q9#Y4I)vR*vg&4H$VWw*mjZL79 zASX7;6*ZS)Rj<`xTxL3*QqMC3dSdUMv*YD=U^+HvKGcG(M(I^u!zzwZu3UKldCo4L zT?X4Z9z`WIcFK9EHtmI=QzRaXLlWtHhSyd7@(6=YSSgx|KJlXA z;>---bslE22vjj4crB7TzgV7fG+p`mEG0?WtqWyo?jn31P)HLt7*IK%>ROdJ1!K*G z(Jpw7^CL3lq7v@X?h3iBdVtlY9+Oe%zBoIyG=W10yKRkZ>`r!QV^5o$7aDOzu zH0@Yrj!s@4{(AZL;QajX^klyg@_|T+7`op!tU_l$9-O|seDUVp$@%_s>;38B+t)`g z4)m9{_2uyF^4;m{eM!?h%_iO&N#UmR-FB;G6;q1aiwkHx+3>R@1XqB|p&8KYW|T>B z^aj@d`=e~;QqKLSe?{x?L^ZzIfN%DpvE6Dl;Qjl*Lcl?Ul*Z8hE2=20ZdB91zI}HN z4PCpLBcu7Ggr^3$Kf*d*BSxuvj;6g9OVa#J@Ms;}VEto*MFIVA8Iv@nNhBJbi}ims z8c#|XZTzdT{(h@r;)gXl9~)}sE_we_&0M3i{=`D?`j%C~OsXtXLiYNnPx{o;X^!^a4NtCEG;rmS;qu;Z z)K5jzYOm>366Y?~e(BDzsT?{auo%~^xn^2(NffxH_MLL#)1tSVn;To5hR1f3Ry1SH zJa9zwnfJVDH{}h}QJA-GF73+qZ;LOAG@+`Ca`&f)2QQBgy-~1M^n+uR{kVBQPL+$h zYrnZlRi}rvtXZ6#(O4Fje#mH)Hg$FE)vy=_nTqENY-Q@*W=!i%W%Fy7{-x@G{f7pZ z*t(O4%o5rHNt8lnEw(u2nh!Y%@Ku`d5Vx4sVslL{)ltqYxfp7QQQ<5SV)l+0Fdew& z08-ef>&m$Z3WJ9c@$YXPsdkaXjEL`C(8aSr-^-SDRnuzdQWl^hbyWvdU_Q_4tMy?nd9;31_NK;@*4C z1a;FPb#vv2l??7~^m4={D=J)UPo3H3&~hg7ur16u>Km=5y1{L(nVU;jy>KQok==m= z#aS4thFzVu%r$Atnrlie;S#Kq4oNC;DHLT?dMPJQjl^7jsHwV33I7VSh?$siNhRUGfOc>qV-(hVUF6gf8O`93tV>hZr*|wkX ztLOK~5||d9i_gKxG@Wv?16rHx;BMr|?m$zdDY*ddMSFq5e6GUi(UiD4vV`i_we9Qf zDi3K;+qB}w38f<>SZiBlXxg+wy9g)~oW(IgxRNp$& zT<4e7oyJ`Kr@3Y|=<>e4ldxULSJ|0z`=qElFIs9kv;Ca!XL00RXpuJmZ3(v(|Kt18 zJ3A#m)Vm&ArCWe$uDrG){r>dlO6B5e_eJNw{v^+Dgbw6^tEOf49nCShqJ0+9W&3Eg zTCJzMyZCRb)vEs6ezx=UzuLQdd%Mrtdpok+c6(=c@4uk+d4^nmGLe$xzglF*`G40v>z`Xr&3 zXbQ8B+tHE#?O1ui)pi+hAsi>pk^wavEubN|F21sM(*md1GW0)Z6qlqi^XUIhd#_6W z+k21n|3RKLZA7YFHVY4ZbO0qFrA!_Ap<>PX%zN&&wNvqgKd7S(Ei`wiY&V^?HFzf^ zcjbHwma|UPa<&8A5xL5(_PesUavrR@@DUA&KZ^uPUVyF&lB_u7y2|3MxkLJmwNM%va>88<1L zb7ef$0b^vXd3t=I-t>4dHumW*tYdVt_2Rc>dW`z-MyFl>H6SUmicAA@MX(xraF>$1 zZa@bbYMnPqz?8pf+U~aOLXsl?6!Dua6=@7N&${DShWd@NEmiIl6f%)EjEO%>T{DK3 z9#J3%kav_j9STZ={B4i(RHO-sJtIowpH_71S-3hndYKr{lABpu>@hn6Ct)q6S zKIZcO+wCg-Z|yyOr2h}`xUTCsR&*!Z95_>}ewuO-z&E`ApZlDq^uELt?J+UvWs!_$+4OdmsdP@W25Q&k;xImti9cX4EX<~@8%1)M_omt-Vb;_5yrQ}&KuaKos zndy>R92*OIq)t0~zVwFrojuFY|9TDE{66N;|5mHLTcQ8EJI{6=>HkAKB8zFF_xqQI zF)s|{iL zlv<0B{q}Zyg`U(c%jdXV`TC!w_Wz0(Ky&qfPoGWR|F<9a|3f@$CKmg&3!ohxlC}E-rD(s=AuHoIl)!joIGS8=J~}-luWbmtOXdkA9Y-|B1@wajDN@ zPYf68V;=waba$sh|9AGDJ<|UNdDgx`r4dGKjjl105V#+lJSf+5n^Zi?|;FFIqI&%A985OVuxpEaC8Qz z?@msRPF|^KK&-Ft%-ud=A*@f_`8;p6+D#I(=5@P?@HHbcq9P`~wN`UmoH}~0DYtsJ z4u8eqez^)zfmejd)=>k-3OpJLI;CjDQ&aYvBC-+vz*10Qi~3Am?5GGr4h9e^Bjfz= z^!VuH;Qa7q!@-KJ&r2(p+W#wF0I#6`fBLNTxc?vGxuQu#Llvl^nyDXoX7v|>`c=Cy=RZ~{~?}= z{;y86R}QSSu!8TqlG-h|>$k1?=jq~f7xJC0cl*;Q=N{l$W&ba$2As$LZBN|)ZSOvN z-2V^qtU);g-CfjxJgUoQr<3bwBL`bIc*0X^k|#1z$(~mv^1&d{m`qR70Tq@!3V?}d zJ+KU*6`1(e5~O5GlkeIJ8Mo2>lbiem|%0V<4Pli*JksPWPgEY75cxd9pF6v zZ_@vBXSe-m|M4J?>$=Vwyrs#ArQmZ{(wCG5isnVW&bB6a$WoGw!9?|eYnG%L3FT%V zvWN=LAyLW>bcmS_Gz9Ob4aZr7vth!btDLm{g739{DWMRH?b7!8t$*75AE&e zBXEBm3Hb-sJqQ&%AVwq%X#)N*i>~bKvoTFD#kG^i?~wAMj=!l5&HOm)K%?Dijg)w+ zs&=5U*WNysuR=Cr6NRUgcGlojwVnetkdLNT?*ubG#b|4-O|?6jXf+J8LA zGhhD0fOel*>NBAxk-I@-QOm=d#Bn$Vx1X~V3AynUE0YPD_$r7#G8YMn{2@)6MLRC$ zTNaE*G%?XN6;o>$GD)kEm$}Obtr7e_MBJ73|B?dWoc+K3bh}mE|E<>J{(q2X4SqU0 zd3jfFI*`D?-=O6^^I9tZW52HwB=+Q(F!U#2P$jWN%J+QZ?rS8-h}}Feki9m!#4%G9HP|s#N`h0sHU!3hvH*2-;S=e_OQK>7%VQ zZ_(&Kyhx9!Ko$>NTbAi7F>>WkPcCoo>N&<(a_p^C3sT*_F!9))@3fp58)xzM;w%iC zvW|11&wqtdm4MGW|LfbF%`-T~R`_g4H$AMq-g|Hz$V%sbJ+CvhkGb;yZuR`%d$#jv z|MMWvqx}CnkpGK~cJCU1JM9036@bg{|D9*8$NQfLc^>!wK>Gq@l|ARd9^?!M={YT4>Kj5?6{$I@jY|j42V6T<^zq|LS|9g;U4UXmH{`CCp zt~x-|&R1abajF6ej%bt$rD!X%Ya1}(f&>AN(CaFq6tz4(s6FuU9*r5Pyl2pruvTkewW)Y=gybjE^Q z1A%&p81r%^G|*`A;9Sc5{04K=t6C%lmck7SLx)AzJiMk-z{j{%lF_@7>=9OxL`Y7D*cKY)itJD~jTTOWqj~ z+0Vjo>|{|u6Dg(yaD%Hzz>vf-l`GrR>(bPc%gantW%Uc1qCkNM3^C#ncLLmVObGlvq`CH8}AL<3-1|E5%nHVv=|UP41k1XWX@3u-C` zmaYnPx$?GD={+P_7;Ayosq~HGm*o*kqkB|KsT@yO?O$DuB-F`Mb_NDhqnM<)$mM44 z(LPToVBEY(>Y+5DwJU`{LR~SAd>k_Y9q0#i3_dv!$r$mzf(XM2ax59>4Dwr zDE01K%5y%hF-3vkXQ^b((MVCaS^kK(7c9P{sist2&|XXx4SyI52AmBk=DpIpB6n;$ zR*cZ#T}_T0wb^NMHgBlW@Bq0Ci>CWb@|%>!eYMs!MRuu!6e*bAKxjeI5KAsCB*T-8 zR*i2!{R?X`>ds6|AW88UoCJH9yAJ8HR3KJM3_o?o;|ZDdDk&t4voP*kiu`(=d?}cU zQOoBy5R%R7fgra<`oo1Tw}N`1#~?Ri>_SH60+FfWW}uu%@DR@flRRR`hll`?N$1W;Gd%7f2rKa~T6~)ePJQM_mb8WA-G_ zuRQog&5)AAqsX4XG>cK_((BDScX)7$GAA>V53V&Ok8vpgp$H&_c%R_*rRH1i;kpd2 zf^FHtmIvQcaU}tx#2)|`G{NQQn9bp8;()3Xxv9iJToH1KIp@$C)2x2>*FGVv_E^*!!+A1T5D8yNuw#r%csB<_@iq#-x zU(?GHIKuewEuOF+grY=-azoI6oAF4J)Mr11sRhPjWO-{mt)-8rRWqKNLFfrI)%1{t z>{5$aLCAe3&w<__H1-mC0?T4qQh0Ky@N=NCNJna=p65wZ&Xv$_kYg`=efGwsP^#U4t7zwr%0EVWl znwX-PXLdQIU22aB?U)qM^*u4#iG59Rbu&aSEcRX9>6YIcjnc! zO~f{SZqm5YD{4Gx?9=A1x7!@DAd4t>&EbrD12K$N&hpOB1Un;VdFMtZoOo8h8#uaA z*EEXI{K;=>?&n$X{-?MPTcD4b_rFiZ?0=qYKgNH3kO%X>6`9_)s>$HWF-uVb|4~H) zZ75o3I1c4+$Oo4Gtn@}5*mazgMap7BU-Ci&jc^(cKp6MY(z|%0l9!p^%e5&%y*WvP zg-l6)3}FRc6mWh5DH3 z|FJu^{#(0`@t+>#8DIZ3tGPD$O7;$0Ldl!_VwQr%+&R0fTg)kTeA%g%=fc&6E(;~G6J8W^`!AVLPNIPG3Vzu>aG%vd0rg-1U^eCm(6OA z8EtHYW-6b->GU85mIms|HAz`QQz=MPWBHmPh)?@pc`@vrDT zdv89mnmw0%V$Iu@<`V47cpa2KD? z`*K$;=_jDiIG?JHC<8aO2pTkfrukoB{ogYC|Lpi5J5R^X|E(vF`~QPHEAR%FZvEju zo_gx{*)U=9%*=YQWf>NskEhnS^NwReC{@|Pd2R)3E(NrvL2D26yIgxP-i};2b}N>Z zp>6};6fM*pJZ06b$~bf2AO56iW2kh(bTbq9q@#SyhO|DJZSCQ6Wd%-^U!vof5ulS} zn#J%=ax(~HL5)eEWOnGtr|_t-AYbA+*2e1cPO->j3WK`|FfF;ia!PBbLUc>+%reXS z-0R*v3-JG2*?#=5Ipn|gnEh9KYwOYe>p>p8|1IBr;%wjA;KJO2KH6LSDV_z^|E+94 z{?|O~e`oCcxAXKd{_lf4^R53S*gSmhfj&O9&jRbeEGjL~$E@|g-LA&}-Fnh`-2Wfs z!4rf76HgK)*IlJ#VWHF}5_Sz$lS^Sx6{j-F|d=U1;{lx!!GJgNldirSp{UA?S z|2v=h*HZJAz1lDomAdLM_FL+=t!K5(z$*Da7t{+|Mr1SEUr=}Z7cwPVaQ)vy{J&Ov zyESJ2`Sj8L>tUW1I811KA}9B*24HzZ(=EXMlD0ofRlnYo8BwvyOLj!}t%ohTt?FX) zFBNa#{5|&h7hux&_$NoCI9WVs^`D$tw;Z#hj~8B`ETraw>{VKZW5Tc1WR|+ zfDSZpH)~8hqr#X=Pzm7LB6_EATXtE=`(MTEY7=iQPq5%;J-05n{%>UfIBWfHwZ_hW zyX{B&p9gtR|I4YLrJ)$TV6mXr0xjsWc#r?YY1)A}iz3HKSa334tjD#A7z@=@n=f0) z=f=Wc_nB|~^V_C=#Al}d_enMWdu#Xc{^wzyJL-RoJq~JA9iVp`Y_JF1XWLIK?37^a$vN8 zUBwY2L1h&qYrcOa4(C<%&F7}<$7h~rZvKDk+y6P@zwK7-f3{jXkM`dW@;vH)=GFf& z&g->4#a8i!>w4;*x!3>gTtD%dwf@`V@n4>_AMgJjIV%5(* zq{nB0XRh^c^n>>k|7rW_)|mbO)162AzXy44<^Nfu05T-v?7!YSIX!rBvcGry;-6;+ zZ}xt~atra1&g%Nf>E4T1XFu;BpBx;%-B^O>r~y#Bc#egiGKwT~A`ECm1qDw1lnQPP zom@Yq0gXjSBI_MZMc4~{B53VPH=#qgxdD-8bh@TWtGG<3RaI9MRRY*4F75nHVHacx zSY5A~f(=yi%SMaR=@8sr4zG3EL)du%ak-#9S}$pD)qU{fi0j__smR}RLHrBXC)h~d zSwc9!VrlSvb#?t6{0F#yKx1`P59#b^@8sl{!{e6?cn|;h2T*^&VEn6WO@CT9gUw=a z-E;`ujE}nPy3_Wy+g=-*-7s$Q0k}RizJ+E$FPm9P;(!f7q~Q7iti9`yD9(nR_iJzi z14;sL{jFAGV?#plTY*mOK}v;FaO#HOUO|&2iLCjz`nkeSHemSTZZ$Bk&2h zF3SYA+N?#c>q@M`+M0%Va$7VNW)Nn<6v;G#nAg1Z$y`0lg4T~QfU9KHC}Y=8CS$cT zwIT4Dm5G``_o^`7dGZL73!lq@C`}lSAdEr&(~$!Sy7cTe&E#_s>yJCFLG zhj~`O-0I)v55AfO$5KfXZ!F(2JUgkKI zzd$aC_JB6wN$Tpr4c??&C&a(-a=Ody22oj1Q$VC7=5lZIIFA-Bj;Zdn9CJ2g0qxjA z!tDANbc89Ty@ZHC2bvjAn|wghO7=I+{hN5)oOo`X-JM7?F7CHOIaTvvGB5d%P%RhX z^{FPR%B3Q;#1APO=5ZHM+*!Cat zd{H?C-pLGv$Ro8I#@HscwhqI2IK3L%8IL z_}qKd4uvu8k$;2hs_fD(i=$ED`4x&s_pjwX3$6cK`hd+?|LvWv>iMs|{p8XA>p`9s z_{pr?()I6E7)8}P;OYgY?EwZP#+(iP`zq4J&~FOTZ`w^b zdMa+)(i5+B|F^(~A*qu^B=&S?A!~m4{m&JUXd(VTzMs$4$1MF{d#7su zv%RzZ82{%%o|XT=Q(-rZn>4jgR$H^pLTi<|>4uDSteEY4t zfB1v*x1Ub-e%$Xke*;);!Mj4b`_^RKj>(XI_g;QNHvDbb@>KKU@80VcTvrO5j`O#} zqtk=KwjtZp^TUC|)y3D_!ElQ=PT6pT|V zd}Yc;tPhQ!;*|QVABTU?07%-; zvr=ogWr+qbQ#1&Ba?0I5U{xYnPPrc4tDnB#KYMfV_VC#FIy_%pHzrz!09^(jIE&#% zqR4eqa^?D^g>j9Iz{H^6BCYrOgH|8BY8y#K1%?5}M| zDw9w_V|5&c2Dp)c_Ach5(~uhauy^tX-rRFq`uxOe$@jewkvC8)GGRc1z}yw)(;~lG zwo?+<2XQDu66K35NyAw5pmCsnOZlX3I{waoiyP2D{5G6Ld_)?nda*PNc;#&nT*Dxe0oIFkOj}%TkU!@sFVMFjPi5uc8^c>SxEl7Wek8>`oEp0WB&h7TaV}e2YDX- z|L67pH?myqg=v}X{fXiLl-K_S>0OZK3;E+#p8oaEEdAeB)&IA>(|U~m{V)$nLM<+K z;Ii$IB*}m7crCB(1XKyw_-Zd9{(!U)=A6cL}Lg8WxszV>`J%xeu=q8p|`QKd`c|KbS~ z1Ddi@$u5mQgnbqTU7GeC^-hf^PXO)KX}hFwmc~?2-n4aHiZeCC*w4B|u(WC8q^6nw zW)UT^)tYONSyR|&aWBefEW+4t`iZMNEtPvRudkwJP)(8TaWpFALdyBcd3uFqIQRlv-FnnR%1ZnM6>P_nycbCY(v5V z4&9M)q;pc5M4?Z32e$L7iuWU1LZt)`1xrVHu$w9y!{UwF+Jf{|wNujXKm+&62EYou zFm339Qsz_p<(Aj-TG-f0LjABe0^QhA7DY!a3jLA%n9^Ry$higg^+MJRn9rLTr>U!a z%=FH;lBCp4GSrP2mRo7J1C4{;TPBWD%4sarkX~pXG>HnerJ#b1a>4N`Dhh|8;ERFe zvtg16>Y5gL)5-trz{gLHM3HK^gMS0~Nrp1|Q2!p%AxlRcXzy(Az6tTA0jpG{T~npC z_2fACXZf=vB21J1a)Ni zQxc$8sYr>S{SjOZLVuvA9q;-wPT^`mV^Hps>UxtTNfgq+E1{Uzc&#^nl{ka9=8G2lrwicumd{xE)taZVIUP6SB>&OH|_Q7bBp z;fSOpif9BZg~K$UDGiP(2}ZEaV(NBBE{mzR0f7FyF1$b=RiTFpq$jA+oNF!hTq72l zU};FAVsI`ZOj##3(HzswKjFX=7PvzalRn;#x`|p-2@BrjFU@+e$DuE7Wjhe|^84%& z=tL_d69blpf6!DGJR*4W2%HUz@Gx2-y&m>*CH020lKTWpW~jxw;Rwm%1iv^d${7Po zsN-Vpm0@1w&LQ%}3Jh5miz8*v#}c8pY;Kw>y7~9T)ILh>YH zG$eQzjrr)4@C)7~!7z+NJoFn~iSg~FDocG5Q8(|0H=UIgNf_n@`p`@Oj;5EPPxpLZ zV!@(OWF(486}y+@sA)Cd)#S2YskBjaCYctI3mlR(WXR$o!ueZ8cw_H6FbMkt*SyCj zj#yxZAt6a}2WJlJ#RP#QA;n2FwUGRRj>W)fLeL=}wLBY(vBFY-fF|KQ?8mO;0kW~? z3hDL2I20q7#DPm<5xVA$?B)9c#48E`i`N8ji4{}E{DDk=Wd-*1#DteL8f~h(CoxJw zpF~#BgkBiSliA7&$R77}8?Y{z!h~8Uh!1=C^2LU#733gbEgJhQOQj@XRTWIGC7(qR z^D)E%E}egy1#6niTT)9uVZojSl;H=4VZB6m^pku_5Bf37U+-U2KSL!z&Nw2{rO^qE zs4rM*Udv}lgg@B7PEyJ_?!VSISNWciB(Yusu!N@aRN8@qxb#7XLnys7=X&!_u!Kdd zKYArwZj>ozz_>syU5J{zvs4qIuc*`_X)QkV0lmwAnZ(6vJOU)VRm+FW{;+P2ognXe)6OUMm zS%VV!FMQMbW(ynKzs8+40)j-3?NR-%CRq@+H%cg4HFhb`Pz-2_JV|ySPbse%3BD&0 ziG7;phaFR(9>RPyT`GuIo)?VLhViw+Sb^orBbeLOU05*>R^YW_i)xD|L7>c4%y>*U zT%ClmtOkH!&0-P&0^=2yaeAP8F0g>F4eoM>vK2TmN0@4#3TrlQP~6Ci1u@@587K(3 z2xA|KSvCt@8nG)6TSuu~3F2JJt9y`ApQS1y6D9t@R;^3s(p2ly!}vuy4ilOM4@n~b zz*h5Cv>}&fU$XxJh5cVo_mAK1y@rD$=u2KKPXO{mX)IwZS78b--=2Ungpm-Nu@rdI z*g#^0Hc}y|^XY3mchFRQ+HSYLk^DJeLlVXvV+rBm<)Z@-S)Cso;qoiLJVCw3F&_B! zXXWT1=g#PyqAM2ln%bh`Oj%shv{95%3Z|C##CkVXvjclMZC9zV5Fs5D28%VIcGC&O zTdtqb|9daG?M&=WBRa{Ax|?@x_qAneJb)6hUEIEm|T)DlIy$! zZCpmEB!U6Ef}uQ%Thi~4j4%#ZQ3rwy?fouUl*NLiBRTE5GwzkNT?#LUmo!bofO4-; z#^s%GDnuCfxnk-_uu+I1y@Y1|w(>_dj_2G^k#vuxLn1bTaD5yIK%bFI0i|Jm#VNl=MO^^ zNO7JTBooYwC<$olrBrjjqQ#s8se+10c!DLRev49dTlJj9hUD5yC6JUiP!;INvPP+A zSqdUoD(^3F8IsawpyomS<>q?M8M9$jgJ)_M3gS0y$SL)&!i&&u#Gu%x%^>7SL`Kb5 zdq2F|YrZ--a@(!#zi;n-eWDJ9A&b9ey{`@5|C+?X*M{4FEmC>3^RYkG>4_p*XprEN zrXu7t@FLC6ctcSrNfH{X<74CK_1?kT)BRshJI&_m$D_lSX9q{0I+7c1Ha3CAJWDAq z0Hr%rG3t;Ls{Rgo6ZV&oBXSeH*RM=~r~@~yR^J--o@2elX*;Xy>&S}XYgqk=*gE_E z`0&;K@!7%4Pa7Mv!5Q1}^8HO7;nR%X5>9t@eZ3B%3jAh^xeJuISQiI#_2cWqy_aX- z@4eo8`$B?u^r>UEwUrh4DfZbA9Z67XmCUNV-4Qr3qtXp+1VO=q4LFKU(V)-K~l$R()j>u3Rf=W6!i5qpRqnhNJQF2(v4I)X|kct7#_$E-{ zdmA7IDa-l;An<`)64J+ep_mIwP}Cv7!+`oEbqcs;?>s-<9u?ZqazM;t;|hC7E^?<7 z47B-1agI{!2NNk1a?c!T9UDm?<(>@Rd4u5Ze5?lB7Vkpuz9V5LOhfF(&LEb zyPmaGVw_IZc5z13vKm(!HD!}!#G=r2lxL~MmlQ=DIa8&!Ky~a`z>+>8COLN|+=%Wo}swJG10*#>Y zc%r*ReQVAswDhoPAhNWv-`cOf%WI&qFN22LsH@ayZ0d`t!0hAWo7b z8ku9oQNCQ^UvGYe{cFiF5DvV_Qmz^ilSlp@o@%(#19T~k!H+1BxKSr4$qj-{)tOLx zZAyU)MOyeLQOpSIL6%q*Hv!Fm^d(75FKG&WKwN`Gv?2{LsRM!D&f2y-9~ zXc}J904U*MG*Z;c%5ecFZ3TlZk*fkpPz(dP1Jr0a% zi(u?U5xe4=s;dO1$`45*2~|)aHYPa4lm=*#R>K1A#`T#%>r^FD@>s&y-jF1w#;M|p zSMvWkLd{07ennFB43$j8Pstx6px06=4KL{inC+NlLY=wcoasGJonOw??JO0hv-7J# zD5%_!54#_zk5@c+*gVG)<=Xnhg;n9h@cO4T>g4A)xmwa;*l9MKAL1Zvs=wP?=vS0AZA9#fras~H5dBdUpUETJ)Re%pqlU3mj`Nac18@B^9cfbibRm&D zb{cn};eFM}C+MJ8J*No<^3)TJls8%B3=Ek*Kbwtq`PsA$uSxjn@PeavUYb|vwnq{6K^(c9>l9yaH9xm0XrgwknFo{A``J^Lzi1s>iKrPaHSRnz4LmK_gKj<}L=3zOj z;j-;*d9A-9O_#BmPq##z4TT|PixcKISKFmnE z{j#9)a>aIiMML9wSF_-SrmA(jOU;5jRV&N7;Z%kRC7$RD&kNNvByh6_-C7dX@^y zCNpa#+aB}s7WO?w)v}F`^}fc=r}TBq)~E8d&faINh-LFL_N`*~Q}f-}{?vRb45%s} z=d}OPlRCo&Xvq{^vICNBkJ|!SNXd!S++m>Jsb<6Y-xIfOeJp;%;xKPfVhbhyg!rfu zQG1saJOUM-rJDI(;OQn}(?AD?s)$m$<;*u{6tUG6s*H6h{rzpxkOeo6`=wgixSXyA zL~ylfYL>2|ZNUqc(!&#YXQ4$0S-^i&rJm*Q*J~ZVQp$MK659>#OWtM!8Vy%O6r>vk zY<7QU0@c0qqCIsZ*0p=G3N-~CCJ_^pzLQ)Z`^GiP^$za3Fu}80yv~y=7 zP!pZw(Vl9MQcVYThWYQpTF*S3UeXi=WIqi>sO-YVN#l+71NmYIq>rXK=_8HYiblS> zD~&k$g|N~r!w1$a-|iRYUH@WTt;sd_{h~w*+6u~8bNejjVL%aGimCZU7lfk;xw=SO zneU8V?{D~lb-9~nu`8I1dNQi4qNKpyCH@8L^;~VOZrtzy^ar%;>%gvZCu2$ID|=F% zJhWowV0_Lb{O0;0%`kc^0V~TVQ}-6yN<$BNK)AlGMPEeacjij^Tr0?C4SQWPBo(sw z2O_tuHFbxJSP$h%l$w0OvIo5IgmpZgx^CEWVqD$jcqCp-(r3P|KI=f{|ewD4SiWhnRqD1gf^2=0PCSgJs|M* z@bJjnfS1ZR^-3a0@g^MqFdwoyk6zFbTCXN(pHn)AqWxuIA{nx#pQR~{jp0VZxNr;F zQf>z5>8B+k*@-pDT9cv{a|M5)SmO|&lWm|P5f{``G3ZfjGeoADD0|*b9GXy+KMAqc zH2M=k$c=d?b&rmTE1&`npRzJR)ln|mFX?;#S_;Nnz~TlHEy*$MFJ7;qv!A2pM{D(L z_tkw(smLG{W{vl^zRPZ)=|Yxxiora`2#mhiRLJ&HDrk%&8}jG7ttZbgE<JH2V>somcfpSrbH7O z2Q>CazOX+o$3V%Sk3hK?}{)sp2YP(EFYC|yg`k29cWksde&Mhdg zVGlDg@cpu-%ss>q$z56RBaX-)MdQYTL=I%Lr0po2X*EhC7WbuSr6f0JT)TOv7)+=0-UMAI?7PpCR|79^6LL+IQHYqFlDINB@tYbG*tG3f+2Gc;{rY$$z{jBqx{#; zZ(u-4qKru^Mx%B`fPcR_`{(}N(b>ttzxUC!6ZOp%Th$tmu)Hs#3^`d3j(#poIrG~D zW2IVhl{S{Dc1$o(R!PdjbgQs1Ekd^xO;m%pEI0{M!nl~bU<7BH(@##vCCbG>eo_|D ztR?^gKOMhDg2Bx3B&DUG%07!@>dVn*X@o{h=E`%c{j8l^G~Le)*hAfa&2jrB5pG|8 zVPGH0@zapV)1cCiO47meo~zBHLgU{By^!dVFsG)Wv@*bj)uLPxnteaV_rD$Bg)&yIVUumH2PF zJMG8#Zx8aUC@Dj7eJuql#T1@Y!&nJCIV&l$$>^P;sL&ndVkH3{qTb%xTVFlndBPxN zq^nd0Vvt*88{f?QGg^380+a$=gmKW3n~(!Aq=I0Ud37bM%#SG-DtTD`Qr{+h{0QF9 z>Ykz>u`Y=U{V4tgH~FsM9qUL{#kJU{PY&RrT6LB?lW1k1IoA|7>$xG9)vq$w`t+$& zeRoRwst46JCPgT;h%WGf^~3e89}Rj?lD0d=x3{b{C18U($UDu%UIafF%Ci=UJD(6~Efr6>%&2_=UBqK^EseM8*A6&6FR$GHl zpNg*?DS?3NO5hyl)C7Y9g8C$E@C$%WDOP0D@|OnDbuDdO8rRcoH_*@ZA8Kci)&LWEcW<#2)(RLXVT%;s%m8r7q!lVRjC}ZSa7DX!TwI}KL zo7Oj5W8;?0!|l?3h=heB!+>&<1dZ%7-r=8zQC(?mf-pn)5rOmN|6?W0|Pk!jL1HMkI7qAMqX~ zA~OnRqkHij=c})N**kuF@b<^fS6|u32rOhO5#=+ay$+Gecnv5Zm@~GI+Ro|gd_zvh zdG08C?m5npngmX%1=$*hJUOFcA1tL1P`NEA1%W(kqPu=h1Xm#+Sckp|m^0~ga!mwk zgmQE#Wr!K0V34pdM!Q~7%Il{+Z#~f9YY!>t(JL5+aVE3{E{P(CaL)V?&+EA^LKz17 zY)C=nA{fb2)W?qit8(!n^>v<4Uzb?Hg;f(7R#q^SmA|`@{KhJ5MGLXZ=aguF$GTQO zjHxi!<=FKkiz1_?YpO5`NXMb_dNjO4dtl{W zjvF0C*;egFGKUHot<)aM(fpXD^JX6gQs_ zC0hIe?Z8(}T!YQ8oc-%WyI)$4veZaMx}0m`i0BorR<~PxQ^#wSVg}iZ;Xtyaku~84 zM4H7u>~7?Nh!k;({QxCkVb)G)p*xpF4IG$^_G};`SwJXmEw*Rus1v@Y1u}v zMrmNK^6;Ix-S1Lm%!>DW5_k>m1jH7s)8NC}FU-drpQg;j0&^i;ZUE-TYOF=Bx#!e^ zGslB!rM$)Gu$JB~44^H<@J6Mz)p+hUHI+^Jdrs;r^au}4gA?edID}25r14@CX=+N* zyHi(jXl&GUSPR!Z5`dcYA6Po9+_?R8{2J|eis=ryxmH$d+r+^r&TgCNw|Vg_52y)2 z$bBh-jW!*`N~ZoxU5u6z&_MPxKCuNpvNUQK*=aSY99@cHi4uPVIMY5|SFKa+_n#6!R#cF@aWzMyRx483 zz{a7S-0@60dWrE`fc1Ku3a$d?d6tgQ(>lU1whq)L7CW#splN5K&c+-qC-H&tehSJN zvmCk&GG`5I47X!P@+ojkW5(7VE9DlG#Fg;egE$vo)LrOAUWsKI6B&!W@u|P{jRo8k zy0Whu&^T+{Ua-kxwUJmJcNaRU)i7Z(jfI}#I{4Xe$YRgB)m5F5B&kHYRd*QU2Q^EH zGF}P!TWoGvDhk2sh$g{C1+hWH%)or04kmRF={cDIlF9-SxZP11DD9g!2V6R8?HoAE zCqQ5RXkD>W19Qzhc=N*&Szt_V+(M*oyIQhtX!C%fBdgyAC93KYQKDg47E0=dHV+uu zIpJ0~(RG)I6a&q&uu?m^>422oW{V5fTH(^tsu@o+uhKx(C(w+k{(`n5RV>m`Jl0PA zeq9W;?0qZyq0X;6|AN{|8zJbcwdX;Z%UDjE?;P zni)^!cl@oc^K6laS8YfnNX+QV5_C;#wIEi(CdWyf(FmmTAS_7t^I3KIfJTuuw-E=O^ny3TfWr;^mfLHsC4`mC%+qD)7S@~lFq z=-$Y)NT7EosnBSFycE`ci`QUnb1i?jQKF0&%I7Z{L6Jv7PfiDF=&e+FUz43xBd5ga zD^JzmOOgovZZy}a+#M^gpZN_38)f@~coSBY(UGP1(@dsp4rK}HsGxH_WZKqhNS;9i;)qC~F z{^1Y!uL-4LoHB|gC+&o$EGBK0RN(f)h~9#FL`^@tqJ4s@gu}c$*vRNn}1~f=Nb|Tg3044Lsc2T zJpyS&?;1oAKeBkc#hJ+_tP($x{JFNMvE#x;PyEQsI8D`Gg>!IuY}kP77CEO~6<0-s zl*8D?)N^~-7J3os5xa7eG>rW)ArbtK=c*AK7F!g zY09!J-e8)SBa)IKpSrWuQ13Ley+^gx;?KPLpAW<9+bMr$>wk8(+7-wmC=lzgn!Ttljz0`gXinN1z&G`_w9G<2;+to4O91IhaFpOpRI14tv=DE zs?ow!t7l=*fyU}~V_AToGC`sO`UQdAo)ZkztQD~2y?YCzXWkx*&Q1goyxQXnmc`;u zJt{9a-P^G`;ru{_KcHz9$KKZ)o7&gsAecR9)$%NQQ0+~i2k4Y@hG;O4Qsz_6SpnKX z5YZ!=`ZN~uohqFdn+>b3F$-8zEHN#2po-TCARj9q37y6yhg-kqM>IX5{>G;9rIHGtPh8t*zb4`ER@RWb5(#_YluyGbP14CYBsT%l)!q-#8kU4U9xnEWt9tAQ>8fSKtrDA8WRes2w?R#W(p+jNbq~c1g-G(x;KxxL34)Yz{(LIj#uFl+N6aN%YP6K)dX8DOS}Otr)~GecY8S5ixl*Ius&O$H zt7zqQDta#^dzzznyOF&AXBFC<1xcQ_C4xC=|r%!hu_5Tm@%&`CDei|m?pM(!=JJ5CXfPz); zR8xxgJ>m3-hygU}ZH5~gxTC9dt~?v&eo)WGOh~&@nkr<=f3a?jP}!K*2-N-fu`~*` zp)W(soMoLcjDJuG9Q5Z)7G*=q z?VxmOE;ORmcT3i=GPQ&CENsMEJlfRZ4GU-oT2G%mnJ5bu(A}b=8ZmMX^Sff$DtI5f zYoKj##C#Gp6$v)0HpY$jR!xP$H!O?GLfdRqBaz5@at(H1yyM2COY-UbKVd=0(=3s4 zR5uIyRNQ7Cn8E*ByIb2;`~Tgi+mHPJA)cxP%7T~qjDL?aUOoD&kpIogc9#lbxb)F@ zy<1%PE{QW&+$AS+=EYC^^`4WJ1AmP`UW3(gRI1M=e9u__`AI^hV7r|VI7|K;xBqBw zwI1XDJjhenr_G^ATExll7FCeOs_dpn|K+LtgqUC<7Z1xxDVM=>^3s!CS-t6zf|sGA zRJA4_>?h%n7svcsp4U%VmLOE_{0J%;Qrr$MHMe7&vWU0$xfjA;^qJ28^%Bq#4Y->J zTwG`)n8E*dx1Kzy@c*qx`R{?Aiu_j>U|0Lhd^urOEttjvp4QbJFIBV<#QZ3wz3{pm zZm1eA>I)9)x|&j+u$YJ4h#s+^JP!BoK|`x+^tkeQ+^Du=g22|{1KY8XRjC>=5`0f0 z68khgIC@Rdh&-b4gdvrSBl~w|@zdKh7K6*3y_vEFN<&oT0?yE_SBlL}_}09Vab?-$WI zE&d5`ycAd``0~`YWv!6%k#u(PvI+87$GOm06P)?eC)fBg=Ay#=oaq%C9+Q~?5*BFa z%3RU9oSuO?9bjt?tm%?fgjwh^Qnwf-HqxpMp`#MkwJvOpe4Z1V4l7k6TX}F>r@v2Y zxAEHIwv7#CH87o1S_T98-G9wqTlUi_E&QU|*v36=72akza}Pz3v`@v+9FSSAn)iy_ zDntvRxLUbZvY3hS8N)M~2pZ+v=Uexhq)afMMIAVOapc@--evJ|xns2mIH8zIsf0f5 z2K0J9$pl#$I5nEyNftOx~hx$ucB=HN0+y*IZTqIj6dF zBImWTCsuYt%*$778#5U5qcy@qJ`0`y?@9mr^vPKKr`D6FkLUk~c;-HHeUUdfxwvG6 zB}+z9B1mpjXK$A(ui4_RkJD7+I4A?ghv9YEM6kN=SrSr>hu#>#MaRxW4t|U4D#WEc zc`ssiIwvxgOjtHLmt*}qMmsf@opVgvRIAB~j5bG|88bT5|L#{cRLDx-2e(+G=n=$s8QN@bShVQqI%0P=-e{4 zqR+h;{({e3{9o@n_ay&sw_D@<|LLRu*MmG$?LTfI1215@aZ<9c_zRkDRG^$?x^YkD zY5>J1hi)qqDhjhBo~x!2f~5bLHrbw;|+Bhr1ZmB~()b1j-BEsHN=Rm|(QS-UK14vDiChIT2Ob7^R& z!CNnmiS_Ssd3^3o?D4tvGeiEfbo#e<0GlrVZ9Um;SM9%A+pS0a?}I#OzC(gbnu?Iq zz+B^TJJT0lOTu~*W&Q;;io%}B^7Pee)t?brG=mrIP9IusEUK7P!_>g{oBzo|ZLdM{+D4e*|& zOIe@ecrte^1nc^JfyfJXS6@Wjh5WXlKI+1_ThHDki=YW*=5Z5OK+p6>oU*c>K_&ic z8R*x!EsiO(vH~wMF4#~~z3#exFt01tIb&T}gHUU`(m(eHG{_>F78amN3bS69y#%W@ z8dIi3ul7A3b9_{~82eTtgZiq|!V0KVkuM^`dAX;tPu1ud<29!Z>NcSpZWF0tvA_%q z$6>f#*oFC`EU31|Jyxe5mP@ycU|EM1AyU;dJp>A#(WeJM$%|AyTa90<dL0UAHQ;pr_|1P>i9aw5Xhfm&pAfLp`w!%jlwP>M{@VHar#NE% z#r}0d(@^ecB>MTyVWJ3VyfCLPeoR@GyrDyuj?l&W2bTVml4Pv#8*+WT_vVL`_!tJQ zT`9l^?COLH5ypMqxg3_iejsTX^x^ecfz`8t5Qz!|<5f$}&EHG4npF7BJWy?OQpj5P zM;Xy16tMaqaC4)xlWdnKB4AbmnM&}OIYY-(ud&smh}F8rHXr7VDI=Sm7*WPFR_{P< zU&@d9dRt!8Wt2{`V4LhVWeH~`Q_Z_Ml;g{zEQ*X^H`Yq=u~ab%FKJ9UKT27b+V14^ zy72i|&)Cv7L$wyTdF4`n?48Mh)%=jixxqhG`k~+9Buh|N61=jo3I)TnWvLR#Wdf26 zJR}hYyF8&jiv!+)?Uv1Cl(HlLxKrt?Y&|)#O$)mvaJ-t*mM(d_RcgAz&C4xG#>E2D zMyX!u(-dH)G%-f8b;z06aJis0z@7QW$1~rjoSzO-$_Ff}fKvTB1(@j#)edwjU_BMk zVnTb>uTub<-q1wADlb#anN_z$g`b=-|ALD0lC)Hi3y^WSn_4=alLjj-O(DW5^j2x4 zLU8kwN~N9Yv@&&WD=kf%+*x~KC5D@2STyOBQ}1zS7oOXZu3V|?r)Gbf(_gK2fFD2J z(pAkyNbb^LyhWz3lL@aDkd~)QFVjSp55wyP;2=SOac)T@JDG6Mt`?f>gbK4{rJ2GJ zjW0WQ!Jop%zux?Mc64}rY9Z=Uwo#T#EQ~g$jmWfmbolb@;HcW>4=Ed#8DKA@QE*Iq zRY?WkD=Cf(A~I9}SPk0!yxn`Vzm%Sg1`7qhiCvu>?Y+2%{>oVuO{cH+et5Na_Rsyj zqqD=K)06Q@vgQc6k~{~Qvs2BysP+zj_~B&#^yKXH@aW*h+426->w_12rw4~`&wki@ zae8=M+f79{w$g)nDtB0;@KmT-QBo{i9}xbEj%MhV?X0vqD^g=)@?idbc=&36|7idC z?8V{RxBD+@DA|U7EaUA2kn8!vBBO{{-wVQ&PXqq-;g4r8502|6w(!<%{@v2ZCp6{A zl6~ssr=3EsVf~Y=i?8M%nchGy=x7sG5deE@nlQkcL0Len@u7qA1s%Z+s+NgQq2V>4 zan^tv$dZJnbx_(!(BLdIOVjp&GX9s#{VY^+>Zi2iy{_KW$o877bQNn#OC_rlg;~9H zl?ytWG#xs!-?}M^xx1{%aB(s=a7JXa8~MD9&&N2EQ;oi&qZ&q6I0)HYSH=WzLDk&` zj;UtE^T^$|qG}pn&P&S=OvNj3ItV$09P?R(DGi`YeUfpCnR#EbtN4nf0qh+eK)@(R z@)=P9Tpi6Jl+pqwb;f*dtYDq+=%?+h)hMZQHhO z+qTiMZQIs=bIz^%0`~!S?Nz&Wtu@D7^BaRO%9@Sty8n#eAk$97zo_X{hkmgvv>O?z zP|L4U;1sbcg@NyPC|n}Fp(wj9L0`i}U}{<&$3c;-znxbtBb#sSJU)KcV^xa`#TC%` zD(935A6j5lrEi8XWR&jjHZoV77EMssWpT{&1F*u)`7~rcT|2Gbqy)Kx7$t!MaVX`mXRxn zRp9p{4u&4Klo_rf%4b4I0Nx0%wIB4e73DqLx)W80!lo&$S_Eb&>N5r2Hv^t!c}t!J zR5kkuRn@}IofcbVL2*i*u4Q4o!eqhxekCQhIkz!=X^2%tq}g4&H6sU?o12kOZDCYq|9v;He(*UA4aA9`W^xE4An&CHK;89I-G7 zk)mFI3Ce;qyz4Uxq$2LBG#g!NI_RD*nM-`sxeTK_F}SC{TYV8Vyb*Pb?@;tEhN~ zr>?PstNH@1OgYjym<3*Fc(|#a?cF*5cb358w?qF`qB<`ch|oC48IJwS)c3!C+p!-r zI48g^N!e`UPch6iV5T#R5d9-{0i59@6*l$2Y}m36N;KnQ$pMw{mYWoZ1|>A1V(TId zs(2mmYQF{Pj0d3=E%}$Hh{mFzX%!OM#(}JS7Opkn`G*?(Bss@j^>EyB=h zl}hj$E|QfRyl9e09Dd7e1DLFOD+1dyQt3ZjBQsO2c)3U1&L6$x5`Qj7X^N%J3`f3q z*2_l#KO9Xn{sDk*tPweZ-$!}zKYJegRj)d?#*a$7B&=&i#8yJ!|PafJ(+#FoUG{rH8?HoguLkDeGTzgk_W-+VV@H8iV7p8!aR5(!D#1#nk_sU!FU zypaL4(jPLCbV44=A7_q2U#~P5<(h!e4^O(COV2?)3Gct!fUD~2?5nHu_Z^>mxBnRX zfj^_{pR`^8isq1X#0~6l4VC!~ph6{rwhKoD`7v8@UGqm9*!_T|%}4EbD?2V;|BH1w zqt|Nx$wGJ6Dzf|QJ0pl!aKH2hqjPkWcV$h@0bJD5>R(A8 zK_E8@z>6euK_BtXIt3Nd;U~ZvHo|%*i4g7cM)}8~5^9O+1jk5QI$eNZ8RS*-3^N>Q zo+!>~YQVn$4Uf6}Ct(D}GpWm;wo@2ny;lZ{O;;M|A5j{VRtQ*>ap2wKVcj%}F=`iK zeH#cQ113qtA-}P%i3B6m5~P>qEfvHold=V!Qc(Y!U6INPM-YS0at^M{9?cE=$;rud z1<^qg8Ju>e^oq(Q49?{fS7l$`QiaKQ#S zPS4Uwk!A@V!}A38)_QXka^XWA?7?vyxEbL7frIB1OU|gM4O{$48Jg%ukoS2K0n=E) zaI`+-GrT=-jgX=T|GhjucTR)=_C2*qE#3YqF<(99)Z`(}q4{ea&JYSb)G-p25R^0Y zdMqv&vXn#QjUlT7`^nWEJpTPjGa=BCm_sf7 zi^EJgkmv!h@4@k?yli$o?7G;N!gEQi-tF)ue~&gbAZC2rK;9Ift{|rQd^)J*2}`I- z^dj%d_ieaaIR{-I-(?&o7;}&GE6)G1sun^ho{RqaetN*cl1l(u*tXN1{aNjG?cl|8 z>~*cs_V*nEZujl8MqWG)`@asi^uP#I_S)t|-q1>5>8Wrs1MeDyPi>e}5LCBT5YKus zc>8*I%PwRsZx@PE_l-{ACU$)u&Cs}3unWmv0*E3ff}J+hrdBVTU2cRzE?T~+(u%pV zW3y&F#o`ohzg+e!foNeBIQiFkpWk;f2(ZgB*8fbHbMMIe$^tm($V8WO^jsV^ywclO;iXo6Nk1a_s zzbC!+R(WiC+vxOPA;e55Az5_sYtd?_ymQ1UNKgpvo5QSTyT`i=${iJReDao#{G-zEG5D8Nx?g5&=fgxY6yeNE1z{K$3c` zFxFN~i!YYat{0IGq;R@2_wvMB9DH_|&ku<4ZD=a(mNk~O^2k~%EDQ1flqVsyo6FFmV6+jF-rfeAI02-O<0-U_=r2l@P^CVzG$^wpMe>O z2!=$xHI+fcvO5SIC!w*JnTVJ)>*PXFSNf<~`qA!k-{$ihVtGA5zIv-X9;IZ&KwY{& zHJCEW!A}KMfFCrz0=N@2=Lu|9OoAtR==JAj zUwi(>#zO^+^qJAwLw20*`TSV3IgNtj_>WcF>BSq+GeI%06uvMr3-V&|jdx_W$@BfH zV>4t1l_|ihOk*3m9m*~Mc<f{PsUpW` zaNQ&0p?S#p>P=&w?8$sD#T7Xc1yx{$HiJ6%yP#Z)@U$_wX=bOu@b3t-syck#5X#6o zyGPT6kOb1ZO%KMQDj<^I5>^QRiaeD#$_9EC4}wlOV-c8r;yQgnO`C4I~73tl+OcRZj$bWy$^5vkL0f~aL=^yhm?q0eeau)fBZ=5%&J&8{fHKnveIE6 zk|MzA05-c}b_gVR{?Hi(u62=F-EMVsN8-QFDSMYlv~t#G?Xb#3I8!s6Mxv;lL3zXd zg>ln=>ExbAi;qsidLMCMK073rsS-_fc{39ae^t@RN>Ci4Z2LdhMiS8MWP4|dX@6eh zF259rhY~zOm*SYfS7@d>=wKwX$3ZjYpCJ_3Q!ji*EJxDYR@C#f8xHS&*M!uvFqUWVd5(CkY;1MRXGDvlT82- zEkB#bld^Bqh9O+3-y9y?Op*1m+4bsl#!sUPj>=u_hyP5}2EKsC9`wM%vC220%r8Hb z6b-oaF}eGInBI5^D0k5Ml;ByMLpy`cz`ly;M-e?d>1*IRkF^18_PtFzR9%?}f7jj| zLTm@wvrmTXHm3c6qxikFwOj}<2j&EKSqPhpjBH+LB%l%O*M;u~(5m=l^?y{BO>g+R^hdiNpB z_oI<#3>1h}4@)R=0A=d;Lu3R7?u^K%>pV4?KK!_wtt-$|T0yto16CScGd{{o4HA{U=3xmWRfC?)t5 zhrJcJJy6>~TCc~Q{s}d8bgM8|*Q}qv#lQZ|2K*ln??mUn$`L^31KtSvI=<}9gZ%W-L_HqEbj-(tfroIR!J3B6w~#btQDVS zcopp(UD00>%)``2nwjlV+yECD8D~(cyd3KXSh~N|6r`UQQ?;&vHWD-UuS(u^IxOdu zCp|pLX#7he=wAF%E|7kY zI0mV?nB*S)9Q&e%=4l#3vofx}oO!qUZq^&7V^1T)6b0?;;YFh8#SY;MF~Y>E;eU$Q ziy2*Ty0_(Pay1J4)42(6E;sMuvJB5HkYKQbwQybdUE@5TC48~>FyZWa3H8JEqbky*I zlNs16%zCp-!&?q4M?1*%2B zm8uyyaQxyWO&j*ShPt%QJyNeEQ z_)5o1pvl#V`e>g>&$6)P3sKTT!Un)$C;$KBC|tFpN;GC391~tQ5C~2j#v}&S49#~B z^Hf7zH0Y?qRPJfw$jMtw7Xvtl8J<+I5`Cb~H zDF041zWpkF;_E+l1wHvc3}tF&atkCTB9Vc`@F6q2oX+&2)BjOjUwVN4n35E)>u~BJO;WgY|vI8G`a}A#uZ%V=+SU0xMY&~gQ*8zQpsyt!j}ocfZr1) zO>ro>o)};&$cD@hQ4Irpw%FkYZ2yCX1vnsPWTTy_gja+0Up9l?iT(>JgK`(wbO9$Q z)>P@G;hlWB3?ZvH0)Rt(^=n=UT(R{)5moMmFH%;S{%NfAczBUGHzTv8q0FJ>pZ9Fj zS=|}Bl!u*QIl~(N1OmEUAY7tZ`rZ1mX9{^CHT0Wq)y0o0?f2+jxj$r8j8|Q~DplgB zveZQ~bfPsUk)>LN{kZjaK1vr=&)Px02mh&*dkan2TkA)5izKd$<}R%Ac(yMK%K31%?+U-@oaRiQ#nYVGoe3 zqjie(wfm?9mdqdsXRfB`^8nbRU@5vm3*@{LjZDy& zZ$g$}g!OwF?j6C#_H=Q_*eom_ecox%;7g+%>11pUaqyGRfMgEqB7Tei{rXs1<9m6D znU+EL?%wei{TLmw=EkMrGc|_e-Z`fp@iF=v8(iNoQuM4l{!@}`PSlIi(Fd={Zfik9 zS^f3iONUHJbUdl)U`Uk*-V2=I8Wn-1r-Ky$Bs{5{ZqG4A*c z{+nkMb*OXdbLQoQf8Hkq3mIBbYae+z zLhYIzFvSQqrRp33vxQugE~zZ*XILWfn^iuz%6;Sk*Yi!ziB_CKjJ-SxO_3&ng~6p-1yi#`a%yRlqv3A=n7^Hf8QV?A zk9&H4y}7crn-@?`W+S30yF)W?z1v#+C9ak#i2XHtuiik|L%|_OP}kud z4nlby2sqFCrkn>@=f6!OyOMw}CEjQPF#M8Jo z%BxVVqQaL87D|Q4?t#NYbjso>!g$y`^(tW<8%t0vKc2C`Gd~&m8nw`4aNMagg(yv= zcw}jNxiG^t$rya?A6J1_dse7kgi!N z2?C^{xGTLz=sogE8N+=(UjdCTC0EuPl7qKzle!GCm%PoWi72GD@)ugl)-28kSIt>A z9NyMpK_nw+`9caUON%eIzO--{0cfP^GBKT-$Du<+{{4DDlW_EbzwD+-=>~>yUtSP= zUkcN>g7ez!d}|#uQ^46oRFWbxO~PZeDv19MH(_p44n)G$vd1gY>tj@&qWJUS@O@m^ z&dBbx%+Mhs>hOW7YWWrfli;IiqQKptBrMvMA6_uPYU3(miS_#i4J!ocO=ZyqE3p*_ zurG7*=q_FT$ig(^lVTV>qw>M0iP9V80}En4K(&JwlSU(Qv=Q8~plhaGFmhro>kxj; zd!f$}zZ5h~hTN|&NjoTBhIppkA+a2>0%$n3fC||VKli&jDIP|dzcpj2>;S~_GRmmk zSF7~h%@&0b5g(R|!nEG33dUuVfl?3|lX^HK+2!98`&D|Pes&2FA(5#3;G&~-JO8i@ z3&YtsA>91#u?qc4FH?qkhUW;(XpzMu$POvS8Ga`$;t&vvqwW%=z{cWO3}Iqa!K#vw zdx?tGC(Rz3NRUOllXf{pF$%^7Js2fji{6eUP(uGfMybKyoTZ3#B-R6pY?}-(3)U8^ zNI-)M8D1OP8bfz;VBDT{OJJ!O`|-EnH~>SLFLbxY0H-+T6bz%>V}^T3RFcO7t)X(* z&Fcx0yVNnvut!4n7*^f28@AMwo`9I`hnYLJ=w{w7x=VBTauR7GbH!%n-|^<*QjdyP zQYKK=5eQP8TP1`d{!>3G1jQ0M3kt(NVq$P~ z`n?|cMTu^$#`6jig_$dtmSRmyAyY$5U#3)>RiC2AA!eZ-BplaB0~ZN21tBPLxG$#& zeB$&F-@Nz*YbN{3p?z2Px%fX$BA?$RF3Qx=$D0yiIkvU5HHEf8>GYotHkMs&HB&QE zcWP@N`qLLiq+TB}FkaShEsbg-NOVq7%rEZn;DB>wEM;Yxe*jH&!c)4 zpY88=r%ldwZ`K!O&J8p1Je{^g_M{FsM0+@XD19?DM=)Tx=FLJS(WwjKgnJaxWAflx zgujl+lvul;baAjnzF^3wh4S{%JP7_yXrO0`#un+h=38}yx0~Rrk2(wz1{ekBH(b}` zTP12pS99QqH@9pz<>l{7-RCDZpJ(k&SE$a6w?B-xtGBOrIk3Q5pu8NTfU$#ei8QZ+ zdxEi8rafBLBwbj1#~2*P@*s1C05HTDAhCvrC{((9=Y=E;nPLTjkhdZ51Y zR)mTZ4E;X5j-{HxdR@tXi1jN2PE7`R)1Oo-ahAfsZ*qkU$0yE($mIZckJk>+#wRBu zB%DSh7!)iqLAscRJh!rq$QY6XLW`0IG)*06jR{x3n}2~|0fePVQ9VfYN;$C8;Ac!! z_m<&?L~!5(&cG6^#I;haXoBYQ}~LPw9^e)40ag?EKu$(w(@?kVwNDV@y6 zY<>gd#jXvVVdkip9pW5OC*A0PwL0&nUM7+Lo`niA8Ui5cv0(i=CWEa>LoEt5RdBwM zaWeAV$|OJ;g{2xsjsDH+wRSk~SU|tSkBExDOJ+7~XtBp4Fb08u;XF!qh{X(&ihoF% zd{9pqnmp4z8}!n9*D8Qkbl<0jN3S}diSb-<-}gLUS{Ns7rWIe|WH{*DP8AKHlPkv0 z&-nVKaY(FuUfeV$MzP4WhXb0qAP+dR*gbDT&zDscx8c4ha^B3*SL}Q}n*40?eXMbu z<84Kp8M0l9^RajF@Tp%;*KfA%HrFgTnipH|M5kyyX4c_&l3pqAXH<;beUR4<@R(?3wz9dKiT+cnQ_1l(Qgd)^bq~_jZc=!>>{5!u zqUo4wHs!3dq-2?yIelDmV6)P1W^LJ86lr4lM5te69LO!?G)5CqpKf z!*o+dEy)qxkX_IJK!V_VPy ziee5e+maH?o1#huJq{ghj9zDooUC;FT62TCa+OlzY%sN+FxdR{ru@v&jO@RVP?rAy4R>h^>fwb#*Z%JS2$^^gs5pJ$?Aeti|D9d2DvO6uRE@X&SbeQm{L8)IhY+#y&A`oDV8@AUBM2?bAh8hp;n)tCfDxTb0E z%$lTd%jH`(VMuij1S0)-(1Mfa0cV^_DvfC{8$Bq?$iEcuYvL?a*EIw}+BKK?ne)JD0N#KRp^?ZyX4U(*@i!C0_pSxrcDvKY}3% zOx?vet9yY;y_z_PXm-$Lr2qCj5IO`UvLN_8QV8j8;Ta z*V+#Vgb*iZLs5iHwqO{fZ*T80W+X0xiyBh?2!eS!?(X5`HGn3UZ+9&lH5gB*Ko(Ka zo}O+GM=)d85}QZ(l^YiiRXKb%Wk6jrv~u=1InqgZF&IWl2__$5($B#&c8e-b=z}ZB z@;gm+nk8hK;CIM{0c(0ZL-3oOI4}Li2aMiCWz=d-Em+{hhS$R79bj-f4_ z(UglMbjF_g7kyW!5<^Rpt`cnkd5vX!C_&I1`^f6#$RF428MR{vMy<#zf(yrv2C!jBU^&^jw^7A1)lPTD1XprZ zPB4s;r1j7r8!YA#b~1=6ZaY$Rh-&A(kl`Tw;ykm0z*R}C7vma8zUA=A<_|2KM!R#$n$5E zxDKtyC|_P-R^Llnc>W ztSM_Jb{Gjs{L}nxcy-rxA??Fr`8+%CwGL>f1|7`heZe~Z`upt@-4p|bFuIIto%$b- z4Jd{ejBs+!?L34+@-stP`#mkSFzqz=LDTyoHGY}|^k?;?s8Hq*w$tiMHNZO;H$K$W zf?9MD7E`)QiX!cv=GTR+RiR4dQVSc~9YCX6<+FFW?B;V~Yjb^l)4mnEE331+z4?i* z%)5kl+IvLH_e1q6af8a`+V=i6EiqRVF9TxHx#SWX5sOL!)wa++oX#Xt{ajSLp@OSM zvGFrcHn9nssK$F?>wMYU*RfKd1^Q~a?BuGW7JI8kww0~hrdz-x+T&&E+QmB3=4O%2 z@@dO@eXEFTYfE~4)x}$?6ksk`tW&viwO(^|t<$DCH6qj4b7r;D(t;g5Rh`=G(Wp}S z$+NtzyQkjv%~AM0#EMZ3@G!Kr__F1z1(3UA)B*;^eJF%()kubl@AtAI78@9zM&_-T zvOK2Nz8k|IdUq)`0mE}u27W=Kjsf5oJJnZc%f8(zJMKCF*?Y8WvBWuXfEByubjs1f zP-I}d+P@EGNkbHfUPZnW2QCuej@5gfzuz(~_Rn>Mbc8l)1j!aUn}`X_2pxt!m4C_N z*}~M(K540MtCdyIYJn?UP)D)prz;mn`oiwwvVT%|M+?A>XF1LOzDyX256qrH@CIakOFz37h6uGIXXC-%2AijW4`T)Ng-MIfY zRHg2}X20VwvU$@F9c=E3Zu1f#)9HU_nO*g(hSy`bWM3YK3B_8_d1$O}M1NYBF|&~P`@F_3nK=uj<`0?y#-I=^T+W^K zom}5KfK3%}8tH}t;*PSN0G(m8ycschmWwpC-t5Yz6lp|Yo;F217=lgsM~ z4;Py;!=>*PY7fX^?%%3js;f;O3K8}KOR&Vf*^G1)fld(26}pTbwA)upxlKDCtNQK= z9B@6$%Kvlt+o$D_o=p0C)HF$2ik}IQW+GoX_8-epW@a++3d*%maJK9=Rgb}tDe7Br zLqi#%@$i#1NhoUAV{w6UQ@E_qUkP8lviKN^6)+|=9Gz!=AT0Lj$iSo#;B@%$1Z)*n zzmPX?a70nm3@m4LFyS{_^A|>T?gO=S9gEvLyc@frErMuh9i74H`oQ#oY zxE=>fAyeAvI-m2?RXmOf$?3fTr_==HX1e4nv2dY*xx7;{Ha!Uqxz;So8D_Qg6LT?} z#4gM1sinT5?`)C9Pb6V)%@0_UY1au5)kjvnyndy&p71apszoFnY0(p??Wm4Hw()%) z0uE=Se0FD};iMt&444_7w>2Pw9vF5eAd1>@vOGl5eETQo4p!Zz9cn%#9z+!tnj_r# ztQ^CvElH5Htr>8$_E)vzbvA+wzfhGN`Smk92EJ7 zn#&wI{`hABJxG)t@vCtvaf+-rVVzUyf7P+3NT zVT(C}`4raA3M)hA%<3GMD$|fxVT+Du1{D++;jaN21U3k37=m487nt4lE9YT)$08p% z9fA#o4kWlYkYsm#f&e4_fY!#{w;x)gnG&2F$1>B8DSfaoz9|j>{n!WdW_qS>vws5A+#kZz>`Knk!3ZaFC$Fc8|$*imC2iU3Ir3U zD`xOYhu=w!0ULMDCi{lpHroViRl$kKHCWBqU3QHHT@yfdeI-1qmdDK#>h}>(I0RGo zC^k?xQ4(SaZ`ciPVP=~^wZoN@dAAzKn>SS#RVXIw0!Rz>gGq4WDJ!HcH#ETPm96in z618*1_ke0`j1!`TwdvpuziNDAc}tD^Il2)aw-zv)m79QhJC!1g*dsl0VNdJx8N54x z#CRAEr>n%dZshGNb{8j-DUFkwh@?XLca${T0SgDE62qaT1AwT8GTrC(^;LPb1L@5Y zk6578ln<|%giY)F!ioaPlq%*uv^2oh433gJ&s31~*SNwjG&zw!OtIn#QerHqa zN8{&|QY<5Ft-I_K8VKX;IrZ#sxm0;oRd%CDh~8xcyVFY66ZbSiFYWW9*~0ETF=!)6 z!td7)?BGnw3+*3B$<$lvpQW(yT-fvnejDSK+Zo`-z_IQE=fc%t2(P2^2eD?_7-zdG z{$U%1gPYzn*J89qw%!IyVBR~o^hZC@sHHoKZFRbThgsIphdMxxpiP){wiJ;sH?KZ5 zOB#gkAaS~l99~&v$<~9e&uL%XBYlFE>CnXZcr_4_+l4FjNsd-xbG{vEX-kQhDG5}TRl5cDwvVcE!oK*wQi(HI{~8b%w_e-aMq=vRW?LqIme3B(K@5`WMm!fle@x8DQT`C3j$B zW+aFC_d^0(QF>!4DYKW&ysM}6ZM$*fOBhCLF~y&52_?qBURc}E*3EY0u#Z>xQqbvE zu(>37dmu>Ki9aF*T*KDqUAl||{#TFlvy5i>M0Z|o2JG6O=r>88-=&52R3M+u?hX5V}JAK?`@rd1Hm#Z6)YNlN_JPl+-p=OOU+lNLx*GA4GIExKh&< z%XS2mKN)XVzQ1e%NADN4y0u>)JFRpp)GB0y;D%$u3r7~+_w6{MTqw>jN=j43v*u~J zLe-&Z8c>2fhne@}LONa5H{p2Pb<~-$S1{-LNjICcw{E2d3P;c%ls+semrqCM%f9&s zr^CMdLX30dh0z&@6l`u41VA_+vh{`N4SyNw?x?tY1V)_L#_Oo9N_4H4S)W=rkFj<_ z`r)I^60(M?Dmk!D&}_{z`e_7!AN3Ji=yvqGJWx`eQS_A9F}D>iWe>ZS@mrLG@t_Cn z|I$G)NJG#(X4X}Pafnjtd)bq|h2eiDawg5#uPvH|d!6HA2K&(Vy8T4@QZccn8mZS= zNlAnXf2(_RUB$EG&MnFn)55#J-3`KTBkZ*6TwSZVcI z#{VRDe4ep!3R}HvajGDT7qjLFSW1TL;V7FJJLf3NFnAwv)++tR;@INb$Ehacq&a;? z&BzhW-Y2_LbPu>5;GW*K=>TX?>*?L8s>|dC@_mALKCQJ6jY~4DIn13wxQ4#N_^;Zh zYOgaoh-e&zMNGktybukmIMdLzC;V73HEt~Rd zGbFMYeU5?ECU{`j1{36s6%qjvgp1tj_uRxK?^G`48oRckE$-x9x(xV*3~s`QZ)2>j zIe1=An|OELS&UxA=jggp7H2lqH=o&jY;4$MGk;nn7-09#YwEmn2G?`ZPZzc=_c}B+ zw$qa9xXhL#=-)$f-809J;P~0+Q+v(0YTK7sU6FEFDI{o-EAJx)Qt&V2GAEs7vHr{i z3^HQ{FD_q^C^sFN!XKoJyd*CLDeg|n=+RW#zS(wSxPvz>WlbRY<^eb2ruo_ z247#01SS`bw1DG!Tx<=$NSEyj*M_M=hGs9fid_wCG%h?ulC?Ff)(+jsoKR5fpZ$t* zVJu<7o`_4eD8AEvqfizlbC#LrdcHV2D>f^*zV3kNn*=`~x~)OIni41sLU_B@q!@Qg zCOh0vE6Pl|MpD?P1{YF~RdNg^55-Is3mpx`lwNH(oQNF!YE8uq9lau3ynB=<{;9|M z?YNnd?$r*X57Jykp2f+c=h%EjtP9KtYL_e);WH?TVl?@5uknAk$kNij$olY}5eVgq zL|+o*h*Lw2kmd4=zt0v2@*NyiZn+z?&}ETdMmv zrac)l;?A@8Qx{Ng?w^`QEu!nFGvht=Z>(0dn@+vEoj#(M6`s@6V8T zEMD-UQZ0;%fOa3u+r+9^VOSs`1V@=4q_9aj~X4WPRMYH`AH6-%% zy}e&t^}Ho6Ql|R$=Hv%Fns8)=-ZZsK7tp%8=DI1*wXgDPoejNrk5svc=M{9`4cEPH ztB)^G-*oc=+*PigNssyd&engA*TS0L3FkB&4)7~c4lIqJ5PAPvjZYr<_e5zI{C2Ex zsh;F2eQGGQ=O(P#DQqN<2W>bH^1Da%Kk)-d^55=L(9tayX)w|rEl>pad9vX7Nc9Aa zbRqTk`uvBaEskNC47MVPd8KFNycQW1j7+fHVW;{D0vf{z%rAJnH4r%&7$B0oj_D&T zFD~X_V)jVIJY`<-tGXn~Ak1^uj7-+cJMF*B;Qr_`-mjzKtKjNzs0vde-x+Qr8Mcp4 zBBVcJ_)bt;-a={&go)+fH-IEhj1w;}is-kSZes>g_HJ@`%LPky#(QhQ64Bv)G%hAS z&8!2r*9Re1b^3j))u1_lT{RkfJAL{}ywPQM^1|ITy&2y%*NJ@edTjj}1N>=~_e}xF z-l2hoJXib}@7^pnd$sk_%@lUUHtwZGNj6ZXk`^$RO7o67)Hl_E--bM3_%LF#m|7b) z{E1?p-D`9+(f_CDY<}gX@zZL-nq?Pfh^kW;)HZDEZB=?1MzJRwloJ6RsfuMJaqu23 z=U^FSaaCvTus@Wjv#4IQrAX~uz$ITZk|5pU*#l{U0>L=A4F3`gA^ZduIDCLVYzast z$#;KL*=MOQ3oobAyX_%2_MVw3eCxHl_C5{Xef!*T-lF{8SzU8K{?X~HEngJdJ+HWD z_@leYdq9E2tVjP+Og?}vJD`0jTBiYlB?8%NxgMYpcWK&#_(<;QSbj^fHVZYKo!8yP z+5}{|5GNCKq!Y0vyLp{G4wQM6tK%v5J{}(RtsNn|#ls6>L!SoP%I{BCN1ZYsUbat# zpOxk~FG$yo3SyK_9p(thVOHI_uG8^RyxJo@u zUWFD)Ld$HHSGhS}sY`ObZsyZd4y3{Uaj*vJ?4J2$m9VbsCwwh4(E}rqCE7b%TP!fG zvFjh0p{3-acbk&+KqZ9$w{XsDw3WP6ffSL z&Ms>lpUN#&zN}a8IE89+c~p|J>FQV3s6RPEi4!uN3wv9~-5lQJ@sw|~P5RE(Qz0mu#qiz7Wc%)$6lBg zZI%VWEWgylcXgXwQ)68{u>x5-T0NN9P5p#t1&}0k_UHg?W%8_fU6a;O6)L~oh2qEd za#?hrT`FJZhPqZB(|~-O=qGq8%6AnzyF3eBXxZm0PbXB+@y4m;xA`ufJ56g~?%XJ= z@ZHzGEYY8;=rXJFMO3^@ZNl{0TFeR{Zuf>NZ@aF3;Hx?6RQ+UDSw2_p=+x8>*!Fq{ zmqRpbW9}9OQ{QZ;oP10?JlkIw06t!>ZC^yg7ajr){5@*=?&wlOAw4TCElW=z>9(Ag zU^CvnEkktPV!-m*{}#EL|NX(vFCnqoIZcFS0|R*IztVp)djcHLF2O5$2QB%+`tkfZ z7EF8+KNrv#D#LiXeBdh`mNkw~BIv>Ic%rcYQL-v^3O+<96%H8QNJE}v7Kjy2L+|Y# zC|AMG3w@nEP$6iR=TE(L8c5)jobYh~BB zcYUPu2i`#Znmy@9Ph2mxw#4>&!v)da)r=Mr+@EdbXllZMU@|^7A_)tPD;}Zj@WrtT zs_rS?icj|W*80$7XS^Unh>BvZFuNRHZZTamhNFBKM6?+7iwU_j^}6C+m6P7O9cIV< zWe3eUA53qna1P4lL+36HYf_SE^VEICN8~E)++caZ+jbObejA>_e*?Vq`ort4Y7)Bv zMAknI0EM1_DNM0fhgT71P*kB`pj-jt7RP9sz(;1Pazk>|EbrNKstyXs^^Kg z149(yqYjLLid9HF9L|624k2mFhT?^bZ}eS}XK}@7$G)N`sol!X8l8FczaF-W+yoG) zo42*Sddn0Ng49|TI6yuKE^b2ivT>c=cd(=gZt z%GDmKddie9b>n9oq~YI}pw%a)<);50b`Yy7|K=bfLbmsPx3(W)8~|8z4t)9M6zc%q zdRxM4ozf5Z9v-)?vzw@<6|cvj7yFS3>mr5vsYTm)6|t$ldRw9RG?v644kzQoaOHBp zX6;T%0?+;GFCRhU#vkmhMY+ zBaV7^lRvw0AD;?E+xdBG$$eT~0`e36y+-@R*Jvy|OV<2ML422LPla9&`jJDl)NOeT$De@N8TaP8;ap0!T1c(C7QiFwiL+V;}_6U_oijq^H&CpUoxQr z2F^s?M#@rE8mq=qIt^6Ic^CqGBBj0_$u0{vGGTBOMY{Wp;T;F5w^b+5*<{-)moj5TX-~${f@BZs@~iDXgB(i4Q0VVKK2? zYY$ZyCaW_NIhZFbynTQv?0n65N^ipH2+6r(bKWc~olQ4dd}3xO-OIBMar55y_XK5= z5wwozN1y(N0HT*DYE-V+O#q2=2^GMn8y`Z35lD0U#6zi-KDK5E@w^sL3tL;s+g&bt zKp(`HhrfXAb@t_f`KpVt4mgON2@W918z@jnmm-&WbSr}j9+LP5Sxk?7V6IX00zM?A zI4EVY1_#5SyGSkaA^+dn)|^ES*0U0CWp=JeL8v z`wYrX`JF1Zo3zs53X3x(LaBV7L6c8V@*SE6V0~FIUhPIRctyH0g$WD{)f>`?rXzFb zGYD>gjU3Xq-bJ(K(eFS6e~deTs9|FtfQ_xSCHFtw=;9vVgkhen8BUjvED+-k$5)P?K#O7H!5NwR2enl#yo&xhKs!{RYUni4rcS^ zWssi)h@m$*W)>B-aS3=DM1G)(IX&mJZ;zsgeEZPfG_Drk=k=evlGp>lL~($I6QH$6 z`w>uMd&7P4Q)_tPeFG3z9$-Ip{{(P<(Cq2&`45jN!NfG(ezhQy`=+ztv+f!apQyHciCZ;4H*h& zj=7GmTn2FTCo*iouL57nInE41RC+KvUmj2x2}t!bn#HS2>|neKs$X$}R-2GQ<4a8a z;b9$8eS7GV5V!p&U8DJ{hSNY`!tHy>r7;NI>}Ae8x6+|e&*3fbW>21w;(gP zdkY)`f1MwYz54x{(Okzon|wH9)1YtUvkVZLd~thU8Jt|IHC)}s_mG$4lwn4h8l zqbVSPPF_y*+W@bvLlbCWyg>56d|6xF-#flu;ly-G%MCNPE@fbnxeOf7Qt{iOaYp?? zLa`BB@%wfmn=yiBrEwktf2CVcR$BEmX=IRKz+`)9sL=H7@XrWLhGxU%-{*+Vjq<9{w)x|{SFtr?<;H7SN4Qacn z+9xo{CYlv14#qGXsn~C|!;?~)?X?SMspsuCjS2MOrQCyyzOn3B(`UBAxdA&atmM%I zkW5?EQq8I96XreQZxd}nIAuSUHXMcJV{+PN^gBFGj+ms`mYnIWmn-xQRkYCzx^AKD zY0g`F_t)N-jeC#WOaBUI%x&K*^QTVMvn+sxeNGZkbHR%|(;~fD9ZlTUaJ+|cXGXnj zNRJegE0e$7XBp7UC%w}J5vRn55zNeSR}E`RZe3GP2+T^PtBub z{9gt_1Pj?^U68RKHmPWr{IFWbbQHcWHz4#(MYVW{aF)VE&6k z*VLWee3j9%iihY-&ldR+#oa~-1IwAt2oD;PMnam~vDF(hAGM+9_dE_Z?SRPWD@J&P z6u*9lL8eGcogojB9__!o(uu@h5QFNV$8R>aa(k0 zq4c1*kj7({IGM%>)aLlORcHrq;Asz|nH6UB zFOP0z_9UE|B+n^2{&CNP{6Cxl4TnKLVljP88w>ouYt!-HYFoAE`(ID;tbmO5iAl%B z7{l#=M$jDxp&vwj7!mK9^l9Q)D{wIg5=h1)q1-0}8ivphSyy-@1W|uOWZ4gHDEa~# z?@8oaD-h8>YCNzuifJ#nqrOm-{?EDtr%^Zo7GX_}5^(i33?k}S&Ozt0ld_mvE3nUo zLl(i0`yKFuII*05kXG?ufxhK*e~+v9uX-`)SNT8cXL1u&Ge9DYF6O>WtQSslJF;Fl zU2<)`aMIz(dhtKj3j9dofQ=J4JZLADGm6;<>ZO(w_>@#dxtM+UJ2J)xt^d=XPTJ?4 zN4K$P{nvI1`Cr|ghWot!pX4Es*i?ac@ER^$H>yt@p zIg+^=S}g>*Oskrue1C6vj{debNYhcXTD{h(l%0T8edb{i~R-3C#=X<08or{EU49d4#GL}--IVK<~OPI&*xe{HTfCMxesVwh#rC}}Mv$+gOL zIF6}3V!o{p@(b^?aCo+ehgV&PgaL=@r6Kq+2_iwSm?k6YrARapja`sOE+9plJnG-8 zB+JqZc`n|XO41WKu_Kz^viLfP`s!VEoh$m1a@erXh8)MKbzF*&a)#DK@FlniyC$Xt zxgkMF_&8_KFwAn~QMC*V0K!y)<_6x@DN>V!;RMKN#Q((+gjSRWc1s?}K8y~k5#&@= zk|aSt!cmKuPpd0K3v2;@C z4aVz*AC7;9wmbmDOLrOP(yuc=Ois7Jr$(U>^NWBzH98+y7j6fEH;}Iqqn?V(y+)nB z16M-UyI1S8V4dl^W`(PH$d4%T2B1y{=@j0`K@LS^ZNAbuv5=uyzpycQT#AT~Mj~`% zUi@b+UH+BkR#!k0=+cngI+k^HbtMyQSgS%%#dO4g_xYz#f}|h^ zY@zYkx~77ukhE>YB}*M%CN!_Et}N@Y2NO2tyfI=a9(e{mK7)Dv4FMFHf$-;-ACRIG zHbxnv=|+8%`zpGP6AD*~yYy*##it}!(t#r?7jd8=Xn*%4N3@S$#N_tgS_K0V09i9HtK4`*E)Q8q62G<35r&)W|+}wqF&E3VCowL?{ zyQz!@R_CI1@vhU&XX@Sl(Yww?``kV}!=LS+FWToPtt0$>c6xrX)>$uWD37gd!*eF7tb&0rIxISDqDkX$1>%p|Yh4B#=x$D4H zxte$dL4qsL=(%L6K6ED;w{sB4h-FpnuWNs}f7D-J0g0*5_n4m)D;sbfXmcjaMdN@Z zK!EF1A3o6fP8k45q~nr2B}zP(8OXUF{LAmdwJb zwoy$tRU9oPl;A-zJt8p~QVv0=-5mUtZ6`E^YdYCOlmGh-{pW9d2KL8%hsTM1WlF*; z$Ff>sO5+I6c*DsC5cs8ae1ylRVhBasf$Rr@O!OW`L(i<-5^$?ECvY3MVYFN(5!~)+|V%OZa;hK`R^u5ru~H%BcysKm2%{gYyHqA@E}mr(+Vr zG4Tex{0y*sI8H}2`r+U$!r2|Wuj=r_c^lRg>yX%IOVVsh0MhhHS$>BKYiLkTmHOv{ zOhzVwen*0k-OyOiaV*@EZ#lEL4zhU@QsUFt;kp!!xt?`RC(ZoCQK}CnyULbZ4Qv~_ zK~&X&_oYf)?J)*j5`Q(jZhfjQ*QF6PuLdsE@fC*k z|NYut{TSSXOuEa3S|U=5e~sHDGNiAug!8o;V_U@l#*a;|4yXhI$IPeeU#Z*`UtvB< z@$Z*kS=R5@b{&M@h&VH#F@IMpdFRS^ViZejA~_E*>5dSTe7)V0Al0lUCxZ1!0iSo> zSWc568h>CsnlS<*sSk|Uv|gN7op}lSmJhDYqHt1BKhE2&gJ1A3p#Y0_or~7_MQ2LY zs{uf*sNp%YVM&`$`wV1B4|imUY8@RV+Wh z+nYJ~_2v5UNyV4wc74fi*B5u&O~mThA5iaFNZpv;1Ztg@=_Ia}@86x%D zH(c95ox0hXMBcto_ITyVh&E58Rd~>h#$jl6NhY*A9^p*i%47+b4Se(6rI3&w4JVLz zgztreNQsn0+?VCN0MAAd5@wx}cb{JfV{~Te7DoucM#6^=6`cXOp~ygJZ)``M(@ kSqi+61jEF6wv;_T&(HJomwWzS00030|D$r+)BxfK06A?Wi~s-t diff --git a/rds/base/charts/all/charts/layer0-describo-0.2.9.tgz b/rds/base/charts/all/charts/layer0-describo-0.2.9.tgz index 092006acbeed81bc2f188c3a4c3e9e2b673ab7d2..fefdc034116b5df42fadbaeabbb0453198a75db3 100644 GIT binary patch literal 60461 zcmV)AK*YZviwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYcciT9!AU=QVQ()!H+U{#ol3z*dZtl5m+nx3q$MMg0ckgW9 zUI!u}31f<26QCVU+WXmm2L*rx_>d?&agw>_nd!(RP$(3DLZMKP2+v8{_d>#hl#W>M zaEepm&+#n!%O`vK{eFLccNhNc_xt642ZNp6zYKQw_I6(m_V)G$f9Vf)2QT}7LH$pM zLi3Yxfz!YAAKg~DbKl5=6Z#8DIc4z>-EMbqlH`AO2Y$cX2}wfYki-EceAw|&jAvws z62`?OCH#-5gHTEm#;IWGe2B(0BEw$K_j^tefhT;}LC8Z~uoO>72ccWj(4g-RcKw}> zhj2tOAEMHv^a3`UvABbDu%75H5y@Px1EN{_xdcJKWjt@4pQDuU-W>d`ZaY``vzjk8JM@UJk!P;=+IcQcj#_{#dL^z z68$)40)##IfKWW4@dv<6wnI{n$23WZ;6wB$6hJ6qN<2h8F2_j7PNR?dqkNK-eVAWM zx$|1@18Cq6{=HHnB_T~oAP^gmt6w=0*HeN+lA@oJNs2>)UI5HY{k5>hA&X-Y0G3@{ zzPqr3etu$Hpql5!lyT7p!2k9x2#&my^D=;x%$Ok8I1JNvaDHUz9Zo|M%3lQ>RRM?L z^@r=RDI$MWp~_VX;{UMMEAI=%(3yJoos^hk1NwO1L1+#AN>Ii#97S`K61lmPI7BfM zk`3^L1av${q2@PvZG_`c7KjMGB}hmfgC&m%Sj+>;G7g}FDWd@a_9UjV8It;nA>oKK zMB^YOm=i8fba9~mO$A4379$oT65rC4#WNBMj_##vMdxbbcbW7CswsAR=pK~+?YiXyQA?0pi2hAw-65hk#YDwlMTcqAe`fLz6Jf4 z!wtPBD9F-ijz%d4+KdHB(RxAZbzcLWQ2}dk4IvaHnUuZyGyV6B%z&K@wqL!ax{H5g zgtx8HiCIW4Nkjs{QW)KiV38D|VCAFVe(!YfcuZp|=IV1I7cLhhR-A^!lKqE6B+^XM z7zeVqZ&^q*-|)}{!Qrnd735tEOpnulk|7$rp(Qp0;H}}4^-tfuxjsGq<@j`nXgroI z|KRBD$=UV!!R6(z?=Fsp2!}Ho%L(1-tf7#}Q?uIJ?#L*_w@9ul!sUF~2(mOKv54k~ z-Niw~vJkO2ns0V=HKn&u@~kN#Pe?d|o*WzMr3(@5LWSSl|)nWQe+E<#(L|KXZ~QN_2t3?$>k7`5jBc;%jFTu@MH$4M2sVqU{iM z{~O8LU*l8e^SNNwJ9~F^eCdl1;?Zp^k^gu4{qp&LZ~x`av;6-Q&%j4-h}yL*O&mdlK?$Be2u&);3^3#Zi;VmEE-K&YKkmDLKrm%SmVBYn z7{16!)VMmwqP)No!ZseO@Q3|v`zPfM(7HL?%eN;t% zB9UfsfcAIbC!Jkp<1zh!x?TZHGBNpE;dz)6ETlMK+K_wP9Q~2uh>j@-M8-;h9rJL2-A_99QS<$_OSYjl~#s|H{3;@@@&5YIl|S*7Vz%ht>eg zeO(Zdr7>Wg zq%0w6uG&%BDd=mp5Adyk`NCY?oas5^LxBs%gl|6Ch0PsJZE^F_nfEoX%Wz)Tma>QR zg}{?ibMnofNU%$h$^~vWskB|@jN-mk5c2a&!}p@^_xG}leLO)`y1j0y?UmXweJcN5 z{w)vNP79SO*83|T%30aZ#rG-DwQp0=CaULkV925P7hg_xRZexH z{s=Z)cxo-qV4W$6Wtd$@=6ueSQj^+ zb%&>%$wTGycNdM79pz}b;?I}I7fltb7qiuN^DFUXAk6J;1;o+8)xi%3m&eONnEPWF z1Ze$_&wd%AZj!Pv3yhx9y2iI4TX+3_Uc!Y~zU^TH5#ASh_Rb2@&CbDT=QAK*MLFt z8KOTuDIFLwTp!h?ST9ARKQ&tZ8zQG7jYAR(v|G7IL&zZlGz6ew(dxz9&1iS%n0j?N z6-1JxJ49XOOMpCdWJLFOU~SjkvTH{a_RN~!p5uf1?mxRlyd`ibeP(|NY`@8*qrQmTasGx+Olk`e&_OkGx-|u!x&319( z4q#VusO}JM5VowhB&95*!FkF8!ud%oNP3H-?hx(t?Q+&Ng{1Ls_P$UiOROi!J7bfh zX3NFVWw%OQ5~M`p)wLLb*;1^d-nA--?(e%cmGj@fckDO+E#$~%`7b0%#OA<9A1MGX zk^f%q?Dfm?-_GFK{^Lm=dlSS-!h88nc$ANS%~sg{O1bUMh>$U_UIg1H4*b&I#1j$> zm79s=Fx(LdYzuSM6gQ@gu+V2%1k=-pwZ5+anq{K_TJ)071AF$$h|Z>W^0{SEHZxX~ z2o?z3?2U2Mz$#)xU+Tvc<6@Ahc)s*iA^gj@+HMIutjoCE!fr-8X9O1 zxe;U`sMW$LeU`Em*daU0w(~5CE@6|h&Q0YnLr1e~)I8`<6qhHCBe3Z?kUNi-ClKuR z7V65>R4yblyBFzCefOM~<7`|uto5kWiiJOiTT@N&w{o#oCR)pxE}xkMaIPE|czWBz z3GFSNqC6X&x0$7q(cti19L;kJ=TC%Yk}{CLdn>Gf9P1V8JURX=A-)pEB)+xhi9z2w z`#O-o&*{gM&4y)cV0HbC%rD5e{H?+!lZlte^Kw`z2)v*;602e?4Qo(z&!?XbOEA7( zj9>X1iEqoTdBu)V)0S#!RyZxKQVsk~R;;7sc@p2=;&jET70r)%3b%^NJzGh8UU;h% zY<941bFQ3?W-D{i>|0=>LUO+*VK?rHtFGqmFFzk&ADo|G|8Q`5 zeEsvqX}7vu-1DC?6_&ei>BN@~jeSiqtox;i|!zD4ww#Dw$nl#Pgsi^Sm#5#=rwzK70RK&pbaQbb&mfW;vn zqCwwT>o}xetnE+5XDVW&?Wt81bNshji;ES3vC^7x`YLMVZeR};N-J$xo@PZew)@#b zTKdxG?637{*8dp(`S?%(OY}d3-RLMbGB4bz8O084Ae~XE@W9bcz zC;rVVWdUK-NGEC<)$5RomLIJFD*2{6raUUlh>-{migF4}&Nv)ZlD^d3C_@nuSLg6E zMT||Y0g7_ZR&Z>x&({mI(uH}1D$H}xu9B^x@tS*?G>eFX%5atT;g+RiZ-CsDbkv^M zEN6Af8|W1T9XL5A4pBw+OAFIGc?~s-qp$1DC!3 z(kt?5pJx7V#JtbX|NAco75=}!_ssvF;;Fp^*9K+|&#s7RW`0;~w}ubHy|X2wEx1tr zx^EU#?3B7=Q0|y!9k4uoN?70lr{!8J>WX!ws5?J7M>Y2bL$^&l1-M1JXs`}};8 zrp?Na>L?ZIyU+5YcIo?8BY&cYgbz1yBOdoXQ`nNIi9 ziuRIQb&c8gl(C!c5J7u9gD5jO%PwDb8Ex0ygb4d;ZHPu0pO4sw{E`gf91PKK>$2#& zF$=-zgbxw=ZM{7q7PvqI*p$fWCyajgjNFp+Nm*-o{ri%zbP}_ae6lu{t^d94{Yw15 z{A}r`Ffy1Bm9>-y44aH=lB8+S#a3Un3k}ChlrjOpm(HyZDYD$z)LQ;sH<#+s} z%j-+QQqoyN+SlZl!%Gy>lz03I6+QT`LcimW{+agRzvjhs(v$x&fAZV7R{)ad&@2Jp zSKj%~=XXixJAZ_4I^X$XmUO=Rf1Ne-3r;D^I665x<{dvt**{1iIz9~v?x}Jq`$xyW zqXEOp;XBi69W1R;b@143?=;%lx|N*!ck%2N7IMQ;@d6x;8t%1C~=))5k~fw&O*7QHa5Lj@=OaP1V- za}A0*(5w+~&{)@S%blx_Yq~5d>Z(ysSB!aTipSx#pfkcUfdR@46l6?e=#y`&6Y-K5Tlcf$B(B=PLY$3f4sfc!zp>eZ_xOb@;E{ zBHHWs(O!QW?e%xio@_p^@$c?jdtH24X>+(Ym;;Fb!SkQakxD@VI3FaE1?!y=cDUHt zTP@VrtgYj}{A8NE(73EMt*Fx0uvVZWi`8KBBj)1p&55CJ16JSn`|a`4L^4l78~8fL zTm%zp@OIm%DF=HhLTYPGrb#WR6weU4JiItLzqO2@lx>v%7uk}o*v9hvpS`mFZ*T88|HqR&$_MLX;csFyG!FF6J>wosz>qyis;D46~|tFBUJaj~YI zT}-i1K^OJRq8u4e`clD1@-$06;8_xpty~7^WibW)fSAjdYWrs?!blMOnJDeZEuW3z zkPLDWts4s%Dj&-NW&(bTlWvS>G=fNSi|DYplp)5CP)Y^gL?aed%UG~jQa=0>HG{=EF^+jybDnM#>Qx4XUBo^|dBUwQ_@zJ>sNY4aO z=P6x_QI57BRE z-6B;_ZZPXx&O5}FS%-Y>`@Z}qRP$T@1OxJ35;0-Equ;;5GX&$~HpE_1%%=3a%O71b z;}}PCPPwF0z-F^7)&#Z)o1`otVU`jgZ7f;DjKsnz_9f~2h_lJ6OuWiNt1w&f_Rjqx z{eSuXM`ca!DR<+Z3SIx1-KhkzyG}cpWWKQ(rJ&Oi4NO%nOK^QOObGf__dDmG9%r(nPs3-=|3t)!44d&QxhrekeCp zLxQFTzxkY0)rnjaZ6=>CcF=_3YqgBbM>i_0j;>OPvY^RszkjVG^VHC_VvyRx-=W5FJQvF9P$j>^VO2lYYVF6th(`GTKI$l@DDBF^* z;51zapD&fdYO(zHX}rOg`hQpRKMkJ!KcD7#_Wxe$|LwDsPX1Nhz#G|DNV4MOF!Njjc)L)mfw=8u)`jJUvYh|`eEt|bx0 zaX|del$j7+C56|BiWtwR>6}Oj>CG?~B+Wk+)auYccFus&1ptoDZp8%-Zk$z0XA|pB z4+?nO+x-vQJG*`oPdYbbe#g=f#>Z-^_@m?HH0pRrebbp!ATqdzf+&+1cV?Itfpt6t zMx{e5+RlGk80SO&gL-F`Ct*s1{|pJ2;AS`#H1@}-oo%i7pp}aj;)@lGhN${qFJ!?D zNj<0IrrO=zot@2&rITKvd>r)U6yNz4SowpVw){V0!OcV4SSJ7NZ0}U~|L*QH|9^_7 z%(@@Np9g(^rxVf%;bMsR6mReC4_|F#Jbw8-8If@OYI|pQZ)d+x!tcZF?U#dqgs=7o zqks%vjmG`$!Tw%OwH6zm1tJHgJl1I9sEkZ_2)+x_hwufOf}UtSIR!=3(c z?|Xmu<*S#wuXc9#{;fY4_WRv`*`@kfp5^QRRvnWcApkC1|AXzFz1{7y|JPvq`TX}J z&)ORLPi^3U-Y8uTxVsZUQr=lxGcS)|1J&08ZV6>Ywq==-fgRT!jUvQMI$SWYELFBG z`)oe6m8V}Kp*)plT-DdQCYX@2;lnIVr5J~AF^%vj%1bmLJ5+Bjw2pYIl2{9bJ1$s? zCj@MYI%{hk+0uWizyh{%+d!!$kWoW7)U}&*tLMsjov9K6+=4}KjBuLb8i+Q&2HK_l z4#Z>0q&e9C{Q{|BHu$FOoPr@Gf2UJJ)a`ZavintwC7D+1yn88<`i1 zQYg@=$zO(k`@Mr4LKh9Xom-q`xDfga@qWWhIgZ{}tGwTA-AbNO*=i*-@9JAIRhG6w zK2R=bJW&KeXWIJSyf&k+=e~QsK_;OTcd&3luF%gs?X%ScB#_D*YUr)0xU?-D_!2V3 z*!_@y+o0_LneUgtv`!{@2QG?tFjDm$uxk2=+XaZ>Y?@FpL#tCrPgVPq8Tb5?I~X-J z49@u{i$?jonm)p}j?J{S63b!9HqUaBlIx2&!DM+saTLu97On3(faT<2OpB~l8^F-b z+0U5sDg$CXBfw7V#sJjwsl-|ox?ksAy+k%A|MX&5?afd(#CG^(&xSwzu680v_(vLzfv(1L1_ghe_a3DT}O zL?7=fFs&Oz0Bql0wS;bgfF@)c$1!Y~A;puJaX|w#V38g6XmW5>KtWEcu zPXKJ#1b#!Jo1|<+w1hB{Ww@#%w_n+~4#1li&{HEMalTG3KGzr)TyL;0#A6)nwlkBf=XL85|F8q8&cF%GT$oI1fEpO%aLeHHjm_se~g3Ov;ntW(AU!GOq$qenSa-tgUB+w#$SBbUe3fsV$pVs)b~fO^OO* zq+X~~72;EtMWLMIoWM#`0jc5SZA39WG?bOj<28yyBx#WAWxbG$D2}~B-%Ga#YQ7po za5=f4`h29rf5>^eeh}T^IbWAZ7xbnat%FIJSl?1c6kJIv>nGzgCeBmBNi5bCIA@x< z*#$xt@SfbIy-7wx(t{RwZ!JlQCkaa9iKpJ>TeFo2(QZpM^)6A0-e|5oQ)C~t%nYsr zB^gu;wPrwP85eRCW;o6O2Kd;3YXU6NJkf;Tu44l88=mKzC0@cpFJJmS*%Q?{FG=Yw z7Q{2d-P2;X3R<8!ZSoMQJE;iV&|l?flV(H?>zrli4rX9PZ;1TD3DH}n?Ucb{6tRgK z33MWm$kLdj9}X^ml03V|Qgn9k_C!tXiQLsS*`SXGA^2(-wuBQ?Ve>=lpe8@76qe^C zol(x!&UFZ0KmeKD#UwSJdx<*T=qf5}Wx}X(D!Rzx11=@B;h4WkS(eCURt4^`^UCM) zwniP?)u~tcC~<>DQq;~_Jr)?LFou%=)*xf4V zDiFU;NsNjvP;Tb8ai#^vj=DG#th-g-W#Bj@`LtjtnBGAUB+cRN9?3IdCRix9(ix3O z2+ENEIgxwc7RtEXpY?%;57B!XA}@PCgn!?lKT(hgyE;IOMPjph>S zIE#S(?-CMUPU%>nyD1H(Xo@-FL7)!T;aswj0I;ATM;nrmeF;ob6C5x}xTyuJzq1Uy zfA4TC3f(W|tI+zjK{uBD9MM<_F%lUqPqDBv*m~c54cn$t1W#v5SLz4T84KMKhPRf$ zXfB(J9H?&{2zW3hVHS}T^nE`=GYCh5q%jtx_`HRPKk-qQ3zpt={mOZ*kqv;_j&ea# zPv6yBoWXd=d3ifW_04R{6xEnV}gfctt)4`#9S$8;rPTKBJ&OrlF=5GLibP#h(%u z0=cUbCKuUsDs&A(ZngaZTy!*Z&(BJgywv4l@)VO`0iha!HM8`Bn}a5+zJ47Atp#Xk zsOA(XSpQ1H>O2N!22XK#kpZy?-| zBqf0nG7EQ2bUX032a+jEfjiwoSzO$s(ilGP<)7trPB>%+R;XBX0heULQOY89S9R$O zhAeVH{>W%bLUomOd2aPL9pS)qSV2M;5|G@1<&Pg|3>U;3X$giTi#qwPt#u@nTI5VC z)}>Ert=Tqi^%dYQseHNAP&Qe58P!lxE+AcpqcccVEEku2ZOZZdM*|E#kArE-VwUkk zHk(la`X1{o$bD3RD&9v2O7zm&gduv*;`dwVy~!PsB+=aZ8(ekd-w_LNq!kiuJbvGR zOq|UwiE?=6k;ZLD@n58(7() z5}A_*5Y z{tyjn6s9#6m%u8&_xF2g77IEfp4wWyI~+mkjkPyFA9}wYoO-9nzZ{?D(sy~n4^fwm z$9iu#dv|p_L?;3T`IPw&2fKVrshz4)ct@x-ONMARzqZ~3)a8d zT*N~}Byi8DGdnPwdj9RbJVWX;S%5hyKFFf5??MB{u3@vXp{-(5+Z#n}WXzf`jt`FB z9{aO!O>N-u#KWGk((pht!(tD@)_7?aqYX|}B&z=b4855=r6bC6gAKF+$I&bysba(_ zy`>SE5H6*o+@ynA#trX33n4U{@WhmODPzJjOPc*;?O!36BP#Gk-zPT3+x4UsabsMyLB^CIKK5aUN05u}8AYwYzYh|A?k#>`_Ql ztu_1%ov7k?MAIRvvo4Uxlnr=}<6CrKlIG7Bc!;_qoOW~j9$CXR?lG@_!6`p{Tbz8+AxJ6cElv!ZfeE(|&5jGLanMd;D#8(1 zk=TX`@K!g0(+LE~;-7u^3S^ex`zwy*Oe-#ff{Y6`EApw;C=o@9V~&++OT;Em)ER|o zV|NZ69j2@DEIxFsi!Uv@mb9P6wYK6?Aq_;XhQ~7!9fI{V@h8AAKXxIVT=)azJ>}gY z>hAUXZ-3~5X7oU7i|H+i=38)oAK(}znUKHj%?eWYLV}G{hhL8f?-jSt6(TnY<$M(5+<9R+KvaAmFl9mPY0ebfGDzm(_Vex(%Eps*GS@gos$0-<3NA z-)uvt@9N1TU;1H*N)MTZYjCaMnS-Gxm^UI`#BfMLZ=AB32Mu~mOiAj=11v~Uxs*SvGYl5xkk?Nzc@EO)660``e~=^vb(5~@D{0DD@#2kRoI;}&{{2l)d{VkwVEz7+Ug+NJT{`> z*-;3evOpu}HL;CBUY}e~N7&a3#~2+9jj@bYHI_;(<*P;UB|Np-uOa%=Q}TwIomj0V zB+`rv^PRBBC0S(iFH>XFV( zl`1O_C4uRbqV_ZlopM%g)e(`x0m8z>>1B!=ESq))M0v{T{f5LMor9s9r;zePcQTsO zm(v|B4bSG+^0iKd>htLk{b|HvwDv!GBO3SkG=D>aDMQ^O22q*Cl*SVuBxV=1yWKnA z8V9Wfof;>b(?SKER->y`4*H)q7@-XsgE|cr<{2Du5_1ZHPb|yH%@X!9S-|j^( zyz(P9k-H)g|CCM4{x;R`a!s^VuI?H(2UcVoS3V&cUc@Gzl;aYT77ikitcp#5by)3K zAQm=tM0wEM8q4IwZPT6$r@6^w0s|wdB-?UfOStOj1bRAE)I{hg?uZK*m7C&nBZpXE z2^B^~|5h#NGF6zmigVZCKv(p6OXIhMbI4Gxe*pdwxg`-8eaVAf;eeDGGqDar6$nF> zy}W*iPH9ZeA)FGrGVWSZ6oS@hOpuDTgf`59iH<9m{|=Z2szq#aMQ7xnEG8)bVb1fi zF?o370?!hALYtC}C+$l(@Sdkco{vr;{4XUOsn-&B`Ci8bmLE32dd=fR0um&IT;-)( zgL;@l)J-PPmwHUz;t%%9dW%2MSvEt02^=A7_PTAkwHmu=E;5R;r*uX|-ip1-3Zo%a z$6Ptr+>4aJHR}L@ov+e(%wn&&A1bNy>Yz2YeHA2sBP4;`pZp{iB)!EEx;i{ZH~DLo z-QgCO)Csj!TQ(F%q|!*JbiWI#v;%$!n&=XAWAM-f{!p2eG_3=H1q3FND~4qPS;i1E#7Wt31uE!ReC489 z8maF;U!0;5nb0`4+;XINir&kDzwzIPy`B_9ej7?SzxU+nGK}As0czdG$$61AD|NEQ zDQuvWU#^@e&+k;ASX+O@ESaWyCVXJmw{?nbZ%c==FKbtp)k9~LZs+Gh?I^%U}q|NBf=ATz!4>?IK66sIELk|?_^c))f;`0 z3zQ9+y5W`I{|(S|)jk#2!IaF1ab<&P%-huzkI7sJ-(G1AK z_2w^Wq(ve%Ta9+B@YYXkxk=3|{fC+o<_{QM>yPWijRar~h5JSk&b$K>=s!f1^AP7^ zG`B5s)gSsptvRX>c|a{AL1VNe-y4xmrD@RCQYYuNa02rc_AnZt;ss05nUNc(1c#Ai zCc2*XFa+ibzw&BBs8oo@`RjT^P{VSZU=u}*2RUqT46LgfvrxsVun)KSOLgmQR@W)R z;SV^%aX?bgaGjZQ+@c(B=QNt{Lxvh&OoZH%Xgo3RdTWrFU!r4o$)MLr4?Adp9Z;ZT zN}-GAX0WBW0dkXAPScU}s~K?Y-rhTBfK|Q7|PU##k9We@dbn zz;H$58T5-ojNQdX8p~s-1ag()@t6kM2G`igt246-%^>NLq(oLMY@20QTKISb0pZ-U zOwbBn4^VA;1`W3_;Q9ubYKt9(kf#vxXp&oj*YzS_?@On^CBVB-uCND6Rv_BOQyzD< zzmH=5W_&4k#$7e?C{pBx`9Z|8(9<_lsW+x6xx-P^TT2NSDGh|D!Hii76f*?#N^4z2ic zPiJUGW-L_~YCp{L`%tB%0#LasEL4713FDlOqPe-@$#rM?UKhebsg}_DUPx|xd^&?I z^Zowr+xN;$58RW)6b=Bt>BcDM8ToyqMunzTW;(A=ZuZfG8oakV*xxjfKLDVGax>7P zko{AG+}YpT-2~$)ZTe_}EXbn@iCH$8O19)`MwJ746p;utwDOQNCHR&`K;BO74OZGX zb0@KqbWUc8m>*H&stb(P&{N%0l?L2g$H@^thk-8`9TKx- zoO_`c$2hR|9LZnBJn}29AKH4gu7i#jTrN-LD7=U7=;h0osF*h_Mi{idg$vV$io&g2 zQyLxZ!9evr$X`WpCTKyq*tJ2J(|;1BH0h(hX$ypY|TwDJEDr} zgN`CEob-7v8s~Fxo$EEJAeZHt9Hk)|yrH=nbMdy@?Ib2vTUki6K9pyh^+{_l&wn{w zKDZ7$8f9?`~MDff)l zPJ?l^u&vz98m?lLLA)G(|3Zg7L~Jy6E&0+f=7f)x-r7QkMphAlTHRjrgG)bM=8=8e@_)HUMBvr&#A z&qhTs3O&0EwxOM-m;$9;AgH9-t!>)Ibwq4}&VK<)8$VN5riW9}Na4GHgibI+IX`qH zLu7?AEJ&h|txhZ(iZa^&U-qm2$ZKft>#opNZYa*8XbZ)x(ik{^Bg##57f!?$3Z{(ZcO7PL&s!#`kI=>>*_PAy;MdEo zJSI6Z0wqFk{&u`2KcfGse6$4)icld712Ed7q9mlZEF@}B4&ZMjUo03Bd44D=nt)ap z1c$$-RFHRZ(9Dd0;o9SWLH@`HFUNW>H79Eg(JReZYkRWb7zB5i1=n13_Hj@p5iB8e zX?_%n6N`CPB5=w{lKVn7voI|Mm{#)mKhT1X8fV^tx5^OB=29juJk)hf_ijE*LM+Io zNUv|e^cm6O8u`g3X4*)pe?CoxAiYbvI-%FNMc#p)Xj{Pt(2$G=jez0 zZv|obvV^S({8Ad@YDvX7YDT%PN3cpi;V|ccXVmJ~VN+Y7eM9DrSVQDaBunI+ycNoM zL>(0~8Ghf8`4Dy8aUT^0d@1-WY_|-sQPzT)bYiR3I6Br*JKdm~t90Fj zg0nQ&p zx@{GEJtgfMZ;&;)R>5J*quaTFYzs2KD{cgvmuL&JxIS-$SrjP)?d0hNhE-{~baPz3 zTX&Bua8CgNr}Sk-=_u`l{%|^Ee_4E}F538SeXOn!Y~k6uM6~DAb%`op`T5!z>=uXY z#T|RI+hzko`>s z`w6YCAg)Sb<qbl%HPF;ecOF+uV|60+7%WwcROjrc(2i7*`KDAPRiZprPf|NN%atWfh^(kFS=RcJ zhFj}So)suYfgm1$#qeouEXDHK*`{-9GU5{}Tjc{-S zhNC*ebl${!g8?Sw}lBXr|$em-DF-qF+Z* zmjc0=UC`BC?s5%+$9o? z&7ABGHEULGX(oJ-YmY*<9!M_4^AqWT?dt^+rftM#DoSx5UKja^bSHGw)Y6Q}&F!_X zhr;b-j22)*IRX>#cw(7Le!SPCsfX;Gg_b9Y$(dw#cAXbEs%DjE0Tx=dq}?7;Do9GP zG6!a{aZrJY0I9|q(-~a1z)&~^VHJEof6$i9KV(A1!l5(5x6mEY(aE5U4jrTB5`|c0 zO!q>QP9ahdbW8OIV#LTO937De&y64biF$`Z`4VycR#Kr2#KiHH37@hkL_ew*NaSzYg5nu0-2&8QruT(KpgQ*7wVuQ^0{~G1Kr*v~0u1)T3_ zBKfY|$sro_!Mff>c!&ny>LfR{YiGIhv9Z!>^Sm9*r8B)9m=<%r9iW!8y&bTY^SunL zd@?@Cgl{p?^TM?=-Tm5JZMC`H7V6U3-WE`c`Q8>(%NgGm zT+2CM0oQTgw4U{QpKH>aXn7EK=hE7O3O$c;AJS|%UjdzJrIMqFDsXDA^D5ZNR??}d zRtxyTp=A|vbrFZ@t<~%~?|-WcQ?$!NYceGD$ojS+)tA2`$%9q6)L3 zGc!&9NFxF+orgso2v8MU>Co+hjgbCE=C#0X$h;PyRlX7C;XwiNpczGZKGsnR!Wu1t zorUA-^s;w(d77UmM{}b<($0c2gl+oO+{iAN}i9d2bvj7%d;Izbzo}!&RyL4W#Oz2Ar`PCu`)4(T)p114s`4IJ53esOTJtoc@TzF-Pk&pfZ(NDB4uGX+R#8L z%uDG{Iz}l8DbL}y2>DX4I=ABrxwowyb$`{U%D*Y>NHxE?+%3{DSGNpkX5p$otDu_g5GMj*i+4j-u>^KQ(gOwh8tS*N^MSnJ?WOb*!KQTeIzq3Lfkr01qts%(7mT9h85bAVXm%vk7|3W3 zf8^~}LRAjl%-6&3gov{w3v~abNx;OR)1s=hbzhIoDI^u*c+S&4;-~YqfG>OJ@R~aH zgbDQ{Cd1oKSVCD~@Q|R437x6>D+5q?`7aSASe=<=Dnbn2p_HMPm-; zAkL6U^|mQt6g=GF%W`7iuUi%<;9qkiz>>rD@b5}SczWJ-(8r?7jF?UVK{2NTQ+5_s z3YW9Af2+0AgDCV!mQkA5K>0)Q3oh}vG5TIqxLR-7KwREEy!WTzY)!Jp zF~)PwO*1nGLU{Tlt>fZ1K}KO)B>n!HS6j|P{hI`~WAV6*2vMh^b3$-^X%GVr*M)o> zCR!{Z`l%7?k{OmE%ay*Babm8$aHXFV#UX17lpXUBqw#yb4FA?ydjLm5G7LAz_viQf zDN)}Dl-1}EX!LHHW_EiI>E9lU_ZeaNOmuIGQ;uh6g zDKt_v9o}Th*GM_IJGq3t96g0@-NMI7AbzHaw6*P-yq7TP;|wf?}FMzAcwFJD#L z5~mQFuk_oLE44iP7`f@{69sDqH* z#DBLq9ys5@xRi2iQxy$-er*pg-w!{}k01BPla8*AjskGKygr=0UEVGZj_w*sE5=(d zkWv1CQwHZc20NAvJLM~~ELNi$2~Mg)3unh&rrSk(#dn7{5mORp)ud;p3o*lQ5-&yT zU<&`mRzTqg%)nKOJfNW41v&FEfGaqwJN*F-r}Y6jC*f2D-q z9?qzA5b7Y<9**A~;^R45b>Uw4)66_JRB7g^(4t~!k}v5{Ea_0PXi+WcP}69!9FDhE zn{QS)wr_#;b9{W%vCA*rHdj33qQ_UteGKb$@zye_UUESp#YPH#<8wll?n8 zJ9~BB*8MY+Kf80jj!)~}4K;TjXg@`om992e?>sN?7rb(zn!owF(dO?HQ(R-2U+fZp z|2;ZXwv&X1yYU;UIZc*qk$iuNDadv=3Ep7Bb2TLMvYqxuKhhxs1-^d!$p^b&?rXp_KoBp=fsOED&qNK)z<9;QxE zTkc+U$cW*_p{9kHn#L;SLR@dnwQvghx6!@`U<{n5+3*Z2iniF8vI1SVYk|xUs z@jm`a2f%jg7^qZjfZ!e&Vx*iLQb!2EL+YG{-Qi2Ad5I!ku9%ono*gRPDz(_PJOxB( zZ@=rxsVY4u$U0j{T}{h4hFHRTi@&KK3qLkYeL9oVWW&ay`V){~nI|mFY zM?iE3%r5b*RwqGZYmXhTc5*o=2ehz6!5!$dT9K9=){jxLbheV!l+k4BT4dBu+E($I zcD&g|ncyj3hW?H$#x5i}fHp}L4`HQW=$R-MVok1WeI2D1W<*_8X)~op z(V+E%(Je4PWOEeK)3K<^B{G{0O#zz|w82qjJ+13SN?`wfy=UO|h6sH}^l$1ZUlP{% zZP$b-75(H9A)L6~e{B?&b=TJ_XP_muD%U~IJ}w@7dqyS3^q)kGCH4w0fi!t>$-i`# zl^YMO9{$GFscL7^D@}HY@s)Y-HP65i@)*|U$d#s|ofKftG~97}3(}VS@p!po8&eBM z!J08LR|a4c4ol|1-$Ad9v{p0{GURXbe;MEAwugfBp@IK_`52X+))+dj#`%1WM!IfkVd`I87hS_##z&W_cHt7_f=CdergRqm7% z#Ea~$FK^zn4z4H$m4`pn#obK??eaGwS+dLqX?i>wWr&icr!Bf>F>Gq~aw*Q9F|Qcq z=${czGxDb#=LP_g2&U5+Xx7p#-Fd*3n4gpq*%DyoLK86#qb6|W7@hP$ErO@5j4q~# zFPj}lpSj0hN@S~&nGi(D5s?m$`l^uoMF!8@R!p%`>@4$YP{R=gX*H1N+C@{{n5#6< zMoCaM0^}KI`QUb|jOFh2y2=l%W3=MgIuOTyXVZm-4g&vIRgsb0qWu%=ZH?MAIa!X+ z_@nvjnj1saaATO%uHLg4*m7;HEXxLPu~XvTBbdAofQYI4y~e0Ff7R}WFuG*WZDt71 zQMFwLpPV$P2WWaxY|fH9E!Cw3Vz`6E9D~wpA1u6tp?8qnaVktY4{ES&PHk!Z{xuuQ z%g7}Hwv8Ato3fFM70IXv$>Lz&l%0{jBl4e&V)3;#>RctH*D$Zm*xc#YY+Jq4cGJK3 z&BiRW^Qpa7uCABEgBs({2J5ze&(C4@csygDqGA&`cU+&KsfWfM#BZb-$^aDMm1N*7 z(OM^Kc+KNazzGCxh~bgz`~J>yH-tUyJjun<1cDfd&BPpMM$lyuOgFrHWwDsW9K!mq zKA>lu8^enC>GNk7&r2ATml0p_>xPOz(>G0r2$y#g&&%b2N_)C}Ws5!U+V`ngNYdFC zuir-Q_Qt1FE;f%=^A4?vQIQAi&Wa-=Ab%D@uACdv{{%jbe_c6?0lPapftJ8~;_2b& z&g&WKOn8E$y%b@=yY6L1u_Rsbpp*72^`D*B9K(3X`KZy<$>1pr-q1hBS}V9LGnw;M zGgVMQuFc--2za=6utp7fK0*c420_=heX|{%QzM5Tz|Y(v=~^{AafL4NL+@FL^E2~# z7;wph#WIL}I<{XE$xdXoM_3F+*sx?E z#UEioWss3AX^J97A>}P$iVSFTdcS=V2V)l4y3Uu8#D%q(`Byrv&nlx$xXf>GhrbPa zutCsfBo>N`R7)$ta;vUvnm1R((RBjNz%`A+6pP0pk<`i*Y0tP@;%xDPymn#C7lX}n z`bM0VytPEPyL)snB0}$+XEFsX1M>G8-#kz%qdHrCtXJWNcW-7p?Q;ILsR&`r1hLz< z#C|ls`Xr-zoaVQ0H}LT!A&Tq_gi0Gz5Op~hH4@U?9x^W8HEAwQ573xD zD}TYd0In`7@jgieS3MDx7OZr<`xa&~@m-n34l{gWq?oG0c^dhKLw-D_*;qT_BVYec z6oK$1<#<6CQT?;X&!SLc(ee@i!~610gQKRly$Xp5>W_M|{(Sy@K?F<~K%w7UP@!P2 zH_iv}&i(;4`m>r$Km2b@C8yaH{kTLf7L+Y9rzQqr<&IHzENclqtz z2)?CyV}WN6cPsL%yERUW?O?F;GR$I49=Woi=-xfDzm}KaaYbn+j5tbe$o!zT%rE(& zj1q)`nnV(-H`vZIDJ;;?_QAT+-Dc5r*`d8}P8-L{W-mcIcbF70v=vTs<(-S7zwEs4 zyD_qX=FWZmnWNbBzO0nrl6Wb-t}+<81A~&^(jr`0kU_tb`%86XJJFv;WAo z_~)kuSPk`A4u!%zE8V*}-77`B;IHwpPrCBK$*v+U*e(71O3jcCt@|6R%Qw66gP!vQ ziz!s=5*5}&i7=kxqvEuMAk_nZ9}vyxoHS6o6+d_9RkRQlol3|{$-!xXfw3{U$_ZQj zO6;2fg50|9+UI|N>)!Yi^8#u@+NgwZzM`23HvlNLNM})p*V<;rF0AJg-%v4;rMTiV zW%2Ib`#~{M6>x!W9O7D<=5sTYgRode=g+Is!LhE(90tXNgpxr$wVP&}K1(9xzL*$F}QfsuG z%NG(LfxV^?Z9p`a%Dk*Y)VO47#(Q8GfSv90^#%FU-qzjT(bnni%JM~rUQ;Wb0?-%I zyn+pw{WrggfP{nN_Vc1W!vUzIMVdclcJc{OY+YZibqtQ8BZUNAW#?$PEpzcM@G`hOB8 zUPa>?8!UQyp=+tzXP;w_@+pr36k~fX1-;M2%Q9!J#aA^%;jzvio4c(ne1Hk!5hF7dM;NO_cgP#x4$9~(jN|0vB(;BSFS|Q4$hVUgy(<(bAm|qTx_`N5 zP0W@l@qh2~0!kvZJlG3UjXOKy7tTpyEl{XK{0(joojP||30?RXR34F&z( zX!UZFp(hrumk#i26TaeyP#&X@ze;l3I64Kh#t5hYYu<<%hXgSI^6l(u2IC$CoS_MH zgbcp&t(9XMyh4HoUd!Aeb2?P!O$cGg&4tuSN<_q?lPJO1F>eIE)5{N8-R7cYfein3zrPacQ}1!c8mKly{d#=9q%!5>T0gmy-CCSDMsXx@-F#l6&>&j7 z61W+p6kY+Cq?o9_Tgq-WuZcIB(gGFpdpM^^hE@@`@6Hi8s!g_jl@3i;kU8@%G~xz;||nztF;V{IcUt)dL=73} z3u#LWRi#*f1_R& zuC21?UquwfG5Kzm94B28R3*ETiVc-)Fu8W$rL-)3Wx%%=%yehjb$1^W=aHqMiLmz_y%Vx28!)qV={Nal z6_HQ)qrNqC{4ZtKCtrU^N8#qVklw%rRq^d~SGQP3mdAfFSuL%8ibH1x7em;hmoUqA z{gXa~>Sm(#@Ky#WuL7miUzDyvlP|s@!p+aQukQBF&pWsO2*)99BAJ=0%KNeF%!jM! z?Yi?$1122rt%B}MskMmOG`yiySl0k-`zIH!@FdCNH?IeY>NvpWF~LXnHWVefPtq39 zGWi0#G9_Pi|Xls_yRD0maqLRx91Qxs^g}V%G zbSYve^W!0r1pMr?zY6Um+;^8X((z53Vpe#trk5!Qkx5+qwM z5w;v(xtZ@>+FQZ1E&HCD_e&8%sPVCks;k+h5saF~QjJ`PT2tp``I93Q8l(yQZ$YGX z0j58-R0x#;KAP7PODtL)rc3gQ3ZftP2>g=q?Kt z#uUo?^-EKGk58*UaY@Ou5b29EM7hT71yH3HweGy&w`VCm0RsYuu-r+obWcC8$L+ta zH#d8~?!SPj(HZ2l$XU1txeLM7vrvEQHRAr%srf1RwE-=5Y_8otv7=c`qPs_h3s#m` zS;rB4tvQ(qz{S^~E^Psvm`J{nN4uId4$QEPn0I8WyJ}=FKLY&F2{WiU3LcV#4f*>B zu=hja5$2G<@9Ll2b*=H1CUFi0Q-P@?VndLjfnnvg-wjgZ-TXJPL}}=Q3Qxa~VUWjI z6@~(n0^oigjK|*#JP*E(%H0x9?ty3llzV-Yq{anm6#mxkmjw2@g zHhbcBegkQ?#V6|#aAZ|8L2y@|{WmiaLjp`EsOx*d1Z&&t>#OJZOh+Ks3cm3kyX|ag zI&@IJ5HA^U42%V?ODvxMrp4a@G^rz4bK0Oann0Z<;KnN8wE_r;I|hC39%O2Xna|lR z(;d>MQ2l26@M;q1RtVf*A^Tdv59mEy{T;RX7@Az-#=PtKwU)8F6VG~APrnKw5r%8? zeAC!|mZBosDh{n?pa27jaY*VLNFoi(u|Go_J3S;ONEh^7moTuRlw|E%#wrBWX?E3plH1e5-`(>O=ff^WM&Jh&)xtgn!dmaZ@mW z+D>u`6K0r^U=BtdW^nhz;X}f5sQeCy6e&PH58!{V?%ncU{c`TVvU9hi*+0kZpF z9q?Q>;8x9`=&^7NNd`utNWU;0`fGwIIBH@87$`S}>t zo}|2snQ~5tbutO!tx+BSoCopZ)X~E6^Gt-UP&%IBK1{r?N3v`$4^-w-$6IAT%vwHBp5PjRCXn_3Iu^P<^Q{>@C;LI2nPUViL(xhQaw zVX7`9+|uFju*J(Wis5}Qd+`Yn1E@&?a4&vt>&k`#+v04!2lOt_i5v$b7$iq(epr)74@pj8g4@O z2lp4X)p%v-cLZc zxZ=z`WGeQ97@ZS>ZaQOR(-&;WpCSR!1Ag)e4-Vl!&gUkG&v_Ec%7iLqt+~REwr>=6=HfZyh?)f5et%{;&{CUm zapVW`$UPA+rxN*X;)j;3o`CX>;#zFE>Fj%TK8tPffu0E47{;q-mdG#^wbd%>kt?E^ z!}1eCyu6r(Fn%OS@Mtz%Jt0!t^*5fRRN?Z+)Pk3krz^;$*b!)_{bBnM`pf*tgBw`EzrSCz(^?8;Vvl*nizIg!3r z*Rv-k#Zk&$C|&duI?Ir!bTtF6pp>70Sri``^N=d5{>n04OBy0}CS_|%Y5_ty@5jee zk_3isrI`C)M2^cX#IX>_0+x_6TWZWrWo94JG>ilNDvd+Gi3xY)N6OPXB^X+vZN>A! z9n7nBjSZaCDeEeTkp^ltQP->^c3K-G_~vqrVM1d9oJsdu_s(%b0`{WVi5*3`17-RO zu>GSK@xH%Ie!K5IwK8o13NUd!c|Af7+OtPd> zq;iboreD_nG(QIYlp#s4F(a;Loi(}e6U5qZSY9jJihW~-9#}IpdzqP{2p~-+B z8do7MaAOZC*;q6ygvC(9A^0tyTfXE6@+%agnYnn9ILa^E9n2&RX+JcoMz%#py!&Mz z77m%y|ItZh`~oaxKm8A6!)X<)(Ayk4Rpm2jLAFmDHAxs7eSi;Ix$`wu9uyiwo!DH& z-if1T!bDw_X@7Y9o*E_fJE~~;;)bC(yELOtxEEKJ8bE zmQaZd_(IyZGj{ve3HGZ(s5+>59;rEe^ZS)&TMxL_`56-$$&Lxuo@KIhc-N*;r})pW z7lXe7c;#Se*?>n$8n7`r%BuOJqBRxMEFs2(sRQdk)%$a1-=GZt#hSh& zVVkC=E=b*ArXOca{^}@=CI;-nRtsr6v`@_zH|NSQG+R? z#z#&g0UzfvQbaotU$6M-=()5h(E+PsmGgn`%}-lY4W6v)4Oi$H?*uMCX}!FaFY}hj z-S3a!*M5#17GcUHL6jay(wveBr`sdjyah!6gMY>GsUaa`$G)$EbDczNnaL`Vw4kuvl4JsM?_xwbNu>@Y<|81Zy( zSpwOTzb*n_gO`KnqWpR+LTNM!lEaQ@iHVs&)VAp4(-Bhe>j+ID3I&Rn&GC_;9&7nl z(L%TOZbGjzd@bUtM?hck#-vuK@{gGp$lDG={nl^sx3?9Y>pBx*L(hjWu31SjY{~x$o>dPik{)s=J?I2jeZILSke?JnjFK4 zz@-T5?^^uwHL6~9J7tSIVW>WvX+QbwU9~$t+3~aieh&X)zk{Vqz3d~JFd?mDHRrFG zG#36Wbm8ZPnxFMMRi{;fE~ImkaW}z}e)a%*xqh7<-0aVOy>9iIv0F}J7u!0>{oRb8 zufN}q7P)?=bSF1ZZI6&(?FFF8J1_|(R`7%E2X{`XnGi^lBYLRr{Tn;(mA8*N4nFvB z?DlZ2S!d^DW9R1KSY5Bi^g!B^U;sEWN_kyOV(kcJl|}(NwC(2I)%Ez2N{uzYxo34!Y({ZEXksV7*kCf;iTh$%3&^p!iWC_Yg6JxkwCdQI%~AaBVNQ*g<@hx9>(^Gcv-B@> z$IQ64EldYwM|M~&1cXx`1L<5_{29pqL9zT=OZos%5(t@7=6YJz6g7cv-~KaJ6yp9)U0n-Gn6T{f__j67edF_^&* zaUuSGKxYztllIN~?C0n9%zl5F_s)C&{rc}Y%j_qap}2mPp80`3E=59iIl1e0_TVZ} z;*-B0AXv9Eq#Y`DUE$CKC>SZ_c#!6%sbBlCxj7hdVJu~JE87Dl#rS}C~nz?=k31D&a=tG@!C+WdRFgduUg5S+)J9QJQpbUW=DDX7g}C; zTw4LC?QC-Zg;wt1l7QpE9E^mNH@=#aCtM_ou5d^4I3$ilNzW;iSX4Zcl8vrCReuRr zGXPE%0$;9fDa#kMH_MKev7;NLj#sW2aj5Q6gYX0DtiL@h3;}Vis780{kOJ*Uyje6v zwzJ}lf~c^(55ur2$CA*zxV$M;-C$wMd*8}ULz~kCP2FL!&_Th-(*@1|ke{oF;u74y z>L^8Rbfh^*OT+akixMd`padbJrh_X@Qyo}Fl^VAnbv=3T(ugWeoRonj*_>6Hy* z$8sbXp@unOMyA8Gy?{9XO;BVO-3d`vbZScYmBv`wpENNl^q+NYcDJFRaHRry`pasw$P96{=EkEK4*cSl8rQo0K=@ zi&Kq{s`@lm6kE5f+sc#bCN&TD%x0y;smFOdZX3X4zHXY5w)4==aT_p2EdCJRKXM0H z`lJaw;&e!M=-#(Nd*hyy+>L%=lrFi{jORJphTPjPlUh{OCRuhSP2F&r?2Y{tQ)6lX zp{377OKDFWOTdPv?9`BiycBcP*}pp+s7gw>bW{qabO- zbX`6#;IFMto&Or1>Ez+5IfX<@yQW`2g@BOSEkj3L#7>xis#8%2f9AS_W9`3%8(XzO zt>SS%ZOISKNDWR0t9!IzE1EybU~fzaHN^i$Yl(?a48=`E>@lw`34YIyFqtR~9I!5M zk#KA)J7^CY&f1~}F=2ZJ5OR{G1?hn&)`3=-myjyrD%Qtj~YTv42bCbrtG^!HVv;59;Ikc7v=HQ zXWu~S-Ur$~&$jm0Hj5z$%>mHs@r?ZI-izxQ+p9HfJAyq^m%Ci@hg#dV4Z%y@>2rE$ zx8?BZ51Yd5C%Fon!s+U!56^ z464F49;iHjG=HF4zv93)dltvWT$6M-WZnIhEj1v;bX=IA@j3t4dD*eN{&YKj=x4}f z$Uv|r-wC$9#lXFi)5bW_;RsI5XNR_&AB_Ylo{2-UN1yBfYi{;%pZRxA0ve9aueI6F zfT-S_O_G~|q1*s5R;F!E<0pbi+L2Lu7Lqj}cjK+h%5Pe^GnSZ{g26*yOP4gwu$zeS zSZums-k&%cn<`u|b?&MBXR@_+O(mnQm0+u!nXqXN0#3|Ttdc}vnrAQ^5Qfn$scZ3f z%xyIZrG5m@0ll_##Rz3kj&;>`MN@~#uM>cK{pILx?|E12(&b_A=xEFGmz-Y+Wm9Bcj5e^xeQ$$FYCtRKpqh13ruQP*_ZrFOef_7g4rWNL;h?gjJ+W04^0VF+TOk%K!ZXL_ zpn9Z!0+6ofHjW*ZK?xna1fTH~2K|r1OoNXjxRZu5gK($wK6{)X$woWR!yK)wy}(l=0P&=!1gcANwKZ@OiSiL+WICYV4SFbX_F#l?UEyyz{QglD`Ypunz%$_1$um!e z;ommd>0_oOLMapZw^s4gd}ydQ3s^0tW^l$otBXEWIi6!6B?dAypvDsG2^COQVw-_o z_`qDVsicN@uM-Hswr5mraCFwqHG1-%#z?P{N#&MKUYBG-aJ#sj%H}AwVRL=twz_^h zzrT~i+960f;%F%kt5Y)ho^BhyUx1avYe;Bn+W3%ILn1~Hk5Ho@ks{MGD$efhkg#lF zS3Lz?!#%nAkAyIB1QF@cBn%w1tJL?Y>ZmZ#p^B1z^m(WMGV@VQrqGK@e zO0}b!PCU3v?S->@C$y8|IJg4TFp(Xb>X1yOqtN8N5*6g!qUUt>TY!aa#V_l43`#4Y z@sx41fv0VKd1-CJZLnvVLV*4x?eVr>Vqn=Eg}rXLQm`|OjU0i_)3qUZ%{)`a{Ro^Mr8fHfW2L3GBwktl8T#Q zZpbszeidp`Usg7E!dEfeGCQ3*zx2^N9huvLoMCo@S1R9c^5G{rV|q7@uuBx09!V+r z3gXv{_q%Z|Z?}BUi2kAaoDt}9*#&Uh54~D2^*%uiSZh32&6jl^d!%%Ksxn5lNXHY0 zGvMAFOgU+eUT|pQ&|A1Cj}cZbZ3+AH(ZsdaPLs&{u}pV-21KKd_}l>mu~awu?)QUJ zsvBi1JYwKpGjih^i#CzwBUg`Bq_%dcPCAj=NMuDrup}epMOJHaG#Ww<-Ms@I&>H+k#a3xtu()VlVGIUAjl7$)q?pcHBG*r_c? zQm4Wpu(M0l*@{JI$p&|~j9WIo?Lbjl2Ca}P`NDdnrXSJE|&}Ffg&~DXbv=y_OVq8>RI6j9KC!VJ z-%}Ec;T2%Gu@#zx{bOcZ;uB3GZZ-XXa*0W$v;WN{9w8MOT?iVvuOl2lsR|IB>I}9m zZ4w{lDI3c(D5C?I7trYPLaXI{MFvI#)OHT7ijQ7u!(fp~l zv9a;-?NH*y#lnITc>PrVl+M$r)8+nnC-uHqu5!s^W!1g1<$n9O!D+aqpAilDp2upl zrJBqB`yYn}Z(^}X=$AR;&ij7Cy$B3gMmSgGEt>KPhM7zol5a)>*4F5s$!VrulYh@g zio3gGCuAufJHf^5lM?-uMDcV)e**+~HxZJ2(Q{2s^6^EZN^O1knfTdY$Uc&Oj?(k3 zBrD+NxpKgiV&XBniQCehLxBF}$Hcn9!j?ydGUerW4ul#QRxr(IvC^5PQ~c{10Tm!j zS)AOeYP>&yp2*Gmeab@oV(h?AFH4Bkf+XKOyqOG4qy!YZN| zRSeE7oQ@$z@cb7|Uwq)Gyt!J(hE+CgXr*6|Ye-vtF5hy#pq{kS3_@Fq8W}Rj8i|v1 zKX?_HaHva9T3SrB27jy8t8!?QLDL>R{&xe8bRh9Z&bq9<&ugcDlv)AQF4kLM4kfNw zKtJLj6{7jig&2NA|6QgFq|zhP2wJ@oautQ*zk^fguro1src#TjFMcJy3f-x=C{b;t z-`iF`8nFNj7n&>OL%ye+8KXJq*cMezp_lI?_zJP!p+=z*ebHD*S2F~UFEVxjgZ=o4wryeF=*hhYd>)@2m)gL7q zP!o0b5tx%K-F;XH*5H7z*#)%h0|!q&IvyDN|D(F3Ob@y_dzd-}W) z+WbyoP>YH_N>2&y9)A>dqCX*K`;C|Q&MJ5LL82?&03GCC)wYD8#Q~=ncM12E__)!? zQ+H($rHhV|%9)<>HtpyBdVMuZ>`HXE4^%q3g6Zi(t<@kCX!~^ zZ8WnSN>4U%vmnK~bD#^YJJ3!A)x$8jy7jTvEIDg#I;_$U}c1 z^Yax&;AaTTdI4amFQ*nx0MWOA-CNej*T81&Ztp$d_5Lfz z->ar+*rWq0N3QfGYLyd%L6|7fhIPC12G0#aTJ3J}DsU=`ri)K5+_BTtj{B;;f~6kQ zzV>0#6yYl`??f-dK95 zN-gVCuT#pkE7@8dwUAcdSur>;CNB!le(;AR)@J2HiSdpdXIhr&BJ8I2SmS7T_zzW! z1(WM%oS=7-$x^DQl^hL5V&INI)5Wx*viierLrnNIz(%qU_P0<(Jleae?UzlbdG}Z* zP($Vz`0wAeEQSOL*$-l@x%r5yA!2@ia(Hm;NZE)_I4;6I3oZc@1B#fGA^a(PdQ!a* zVFDa{-8(a;HQtN>)j0_;dWVc>wjbEjvVy{EOrBE5VSjy{^WO2!|8Ru%Vd*0+DB|a) z*rLvbxWe01yKKcr#1Anxz&V0=tzG8&*w5YwD_Zvfm|x&+ZaB9CfNL20vqf*wp9-47 z>1G1p7dny#5MPgx$5}05IMbb=U8Y>m2gKG~z;2xBnZFa{=|3E6nrX4MCsw;dXmS3) z!)z@avb`@ileJQ90gK-=JM+D4kSjKZH$J;R?;g*W**^jAlTYD)-?Kg3veW=RTL3&3 z?Cg0SZ>{<)G!+#U>l>*dk@RyIPf4$Y3b)J zyvL=-pkXA!c-II>v=E`32pcw!_^HswoJJ^f~F9F7S|24C(rNP;oqCM zea->|ffMLmeBL7ay@0&+=Lw5u3ynl!{yjRuc(rl5p%NJ1Gh}?W5Mq;FRQqBUY+lb? zI3``mAES0uh{A>S%6^@%%|`km1)r7qJ_7{ly_U72%&8n}1yaT<#ZKiA0t&g(ufE6evp@EPiBU>Xn*X3>>?ns5s?YR0v7Ddt1-K0=x_mSY+sxlAq$wH@CPU~8c_c5 zOh1c><3JzQ4=wo*QY7_AB+xa2)2FWiS6RmNA?$Fd_pMjG5H9S#ruBZ}gxHZu`#S+^ z+8*!Kkx9Y_fy+-#*whQ30s2!krO5U$%_6mrC}|W>92uprIkPba1g{Ip3epqievKw3 za6?6QLvhTd+Glp4AB)+}k$xMCG8k5XVoM#W+LmcW9a71QLd;=$JCXh>7JoC| zAXjYh1lYKOqokZ^t%=)!lF=`xOSO!T+Ngjj{-1rVKHtfyXjE+j+-#FL7^-CJA8B4G zmwD3<_OK)04biY?riFTs-!Q5i1fU+sr!c8=H!Jy`8Cb^}SLf`JO-arUIG7jfWHHl_i7F?@l|IFrwEa-PM9%K9F zL{#A{mndEHHA>Jtt{8(RbcJri#~#a!hWr>c`DD16%(?2lEy!ObvZmP3ReYN?#zW&f zmF|~44-)*7#zh8;sQzBr$YYMQ3!^t>Cv{RK2fVLlmz9(Z+e8cp!^Dzxm*!*pXcN=L zE+Cq(2z|tf9NPdnFRPHqna97nh_jUjCzS0jSksR&_rIHkkel+?_or0xiBoK+Cu0eT z&}R11fNuJSL-@X0g*=LC>Ru&pYNg5^3(C6u;QlFBi*$LH@8=I28Mj3-L|V#aV~Osw zw;}eF$w4y~CSV6zqq1OEBpqo2N*3k9&q1|(!sG=XUg)W)xg6wr+ftBog3?QdVx9%# z;s{YNd7h8&MSm>Wk}r@`=l0LTTp}xF_S%H^T5P9zzS^Vl2H3N68;Q1>sj@|JaWt#gSpf#Off&LIdAe&vjGiV zLeULkLp{wR2Onz4^PzubSPUVyPyvk_fI}}8O%$D%h?qDof`JW9cRx)4^?wzWNl@=0 zvSW==)iq`MuTT#eO){A}?}8Sz*#szNdKZ@Q-7)E2N`|2@eIjx{>Mv5snX(@&4~)E6 zVTU_NDu`NlU$6$l8py8*5r$e$fu&dlvy`xFWWGj@#hzw9!)O#zV<@&ubX5$tpz2lH zLsHL=A5}a9VR0o!402@+)8~&lePdXV%CcCnY3_WIuqj820UeYp?_AuwWW}b1US?8Q zue&cZ&r{X#;y!VRe1q;cAZ^cpK|aL#!mUC>c5CX)8YMZxH@}#>!cG>F@eLjGma>B% z(N#A<<7`1dT9_>jfl|EG@tUDVd9ja06Yt=TfZmnA7JJmh#f}6 zd}5#Qf*rBJY5WY{vk%t4zlVp9GvTw$7XI}A9(>X#oB2Imcye^)IZQAF6vs&|U>aI0 zT}EQ=!~7!I6&0O0Wa=`~tfxpKtU?(-c76M(T;?bK4R8tjy4Xmn6MzJLU?sr8=v15;q!yH zggahzH+$nw7lvypZ`W~RBd;jWZ8RVi+e3?xv{3&ymS+pqYs$Qu$E}HGTAj!XE9r*$ za7lpHvjRtWPOr-B3Y_yUTd!vgvc2N9)qK9AV+8qghGa&CQ!-N*x`=IY9}e-}x6&(0 zRa{@FzycMW@z@CQC4L5Qf*NN|7AxGH1oWSMpk zOS-H(*E2T1b60YCRU`E6pba@Ix>1I-uOC z1U&s_8LG7TZB`hzIE38+4ZBoATav;|N?fDIt3b4um@GW z=(qlE3PvJqa2-yUO>Q|_edl)zz&|WFfp~BGd8z@rq-UqzX`#f0ZKY^VLKX{ZtLIQb z#t{v{I_YiY6cS1oaaQfopz55H(3#_Cv-|VC%w8^KxBW}RA3vb4P4mhYE^p3)^dxZE zI>UWEj|FeIJrrrKmtjLXO1>6I~aGq`nv2IC-?WGUO>?92hFe0pgm_3cKFXYO&Y5%DkFu?d{ z+I>n4B^0qC#K&^Ez*6n5@pI-l6vj`iXo*krs;0Z&DtJFW(9&`c+cDmKg)h=8a`%G6 z48uy$rTgb>s1wojA$QlwxF{_)V>L=KiU247FU^K@Oit}dn_JfGRUo@@0TU-tcY}Fv znvoQlrBF~!AsR7h_5hOGJ57<;d07(n|07d4M!Wz{1TBeGDA899%@M#L8X>|Mpr!g_ z!#y%pyuLX7)2I*p>sx>B{EnDh208_HPmenJlP0hWPZBvljnKFzr>g;lVu?M)9a&{5 ztLc)&A!2)=yg{jHe6#YXy4-)Ht+LiB%P06}V^29R$pH?m47WWm zuD(1uBK=&6-j>@`usPE(1Ib8uZ-r9qkUkKYkYp$*6Cnd~B*diC`I#0Wxp9`FA*1b6 zCDA#?zI%hgpAsHJn_qS{b27x|ywN4W?{KZMZe{Leg*^PXdnZJISd=JY{4-2bw~=RI zwkM7E_J+1^pu&4oA>iih5Ck4|{4Yg&P|0P->Dde?FEzAIV1O?g(e~lIdN_slgR+p& z)79}`h-zmNa^17HkrC_=F*nj)5eY}-)1yw_CVL&imf{Nz6mX7ZSS<{++93KVeboxp z#)YwS{Qd=ysLOf5hDSg)V#<(;mIyaM8Ms$&KD=p(cMy_#bIei9hrODe9N6j8{B8Ioc7j#c6nui7E`;cve(>P=R~M4o{v4f^k;7s zLYvQkj_y4>>i|Ulp_dS!Y6ZSgdhL7#d;5oqv9@o#EbG;R)o2idKx?B_=Fq&e?ouVL zeV}8}Ff8I`gkVZ(PnRc$*QYmaZ&ivE=gIjP#$&f#qp`P)W%Pk2Q^n`Zv1_1X_gf@C z`?&5I%P~w6F$&JpWC*a(Zjjifwr-m*%=61?3ZTpHA9wOQ%j9bKL!E1;U%^vT{n)OveaZl$}S{m|yo9<3^gyw@JZ0Wk#i+j%?l98W23 zqvgr}jQ9(WA^Z59#2MXcv?E@E#>`_LYBr$iFHY>33`2GgK^Q*wKAj{9W@VW3yh$(P zsO;%pJ3XD6e+6H5t-it!#xb@N(}mxq!J8d!3507)uuJB`2R4RRO~p(qr-Y)8{-xy~ z)enAB(L;)@aIajHZ5h%MX2VS*|Pr@8a@|0KB4Ip2MCudf9#SXS97a%&`n ziD}6e?Y7{ViO`13iVpy-bn|a(+MM1|Dw&lACCLmSC*G?%Fq2ulEQc%s753X3-vkWh zWfBJ$*tpk%`HhyG!=JNK!b@AeqjR267^TDy163z#DVb`a0tRv%0URP&IsHP1 z@ZEP zaEhuQyc@%+qzs;uw^s{CD^>(yqgns`r!cKe^g{{iM3N6I@`JcKSmMbL(SpSCyK?8_^lFFFNtPnKf6Yy_sknc&5Vi3QsKY|GXL-ear$8<%ZFHj~&zK12= ziMMN^RW!c&C*}@N%buYc1zsF;CjLP?yrMiUM}1mh{dc|8I1siPi?k-SbO=K+FAttk zDom9}*!H3gr`kR9O={cn)>z%?O!nM*r(OKFLZH5lhYLI0OvLO2{AlC}g(fS*3PR4S zJ&eAtN5s_9o-rzX<~4Z1_d_T?Xz|RnIx_*&!?Sf!ryqH-=zp{xjyrd-7JFn!tyF3d zeB>eJP9|kc-tXU_KEk50x``6Z{3Z+akFYKXC74aoY%)FJZOzGkI2uuE+x?C!dK}R8 zWd^Hlgo!>Ein*4-R^z+>A!iP@#@LG4kchd))Ov`P!V4Cd(wn3NRrW)WMp$Js2{_L( z7zs86ivfeei(&iD&-52!3u6AhM`a;Jnr?u3mpz5$$X@!Q-YgokmI%sF#N9orLZLyr z@!uzdemhn5ooB0#HUWGxX7g$*8~~Xhg?3%q1F&>{>xEZllHA)AeKFOP%o3zja0xnq|FMiKu6l+zsUnv@aW0PmZkZau91e$+c;9E`6ts?Bb*e^7r z?pOl8JG7c?XdB!Jg#W4vO;V1ZaYL?YZ>)ZgJxz54x|O3d5Gm$N5vX3D8f3+MHhB6# z7ZJFhS}YjTr;@_o4&(68oLmr}k1|;>rH|K4Fc&AI*pKffP=thefH~7)7H%10PTbYJ z`+f2D(O#!e`hDmj6h|A25)F8U(omnZHk<|PI=0&`p2n^gle$*(^g$DGMr^Vh?>^v> zHih0?WS>I}?eclNs@bH&7MK;+*5#zW|nNJcWB;~@o_+APWD-1;WS z5`c4V*uN;qn&ZDO>9*%F#9V^>H(+ufYSaHG;=kjojpAwQYB8=`uKBpznnlu;RbrkX z#wm+cw02GuV+wIcs1apCI%1(*gU^HSP55=o5J#wf z%Vay5P=nUg-1qPZLd*jO>^+~5&rjx6QEN?M={T`OQR212m*az;2`Bvxgi|xC79KuI z$PPy7|6&MRJQ1`>h`&pu^stRsuE&L40jysfxcNpcLFiscSrlnUga83$!ZI&Z6by1- zKM4c;x{5Ugvc=G?#6gUAkf*3IW1Oq*;ruHyM%b2w(y?4YwRJG;>85Z#xrJ~y1ufOw+p;BER? zui!J{lypc$d(TbazVRK7>?cM%tkuV31(_Yo4L)_;LS6ETGOwUfT>s4m^>WrbMHqq7^g+pe!GEKDnyIlUuY#RcwD zRxY~RGgmUw%bDysWs9U$p&EYCl}kfAd+1zPsz-61i51n`Iui>9)XBUFM+Lz z-;M8+fIqSOUo#Vt579U!=f9r+eI#&t2e0}L)*b`jo3!=&?aZ0wGG(xNbc!NZ$va;R z$!NtFPLNKxG~H{ijkE#okZmmvs^-zi%U<7P&oe>O=hhYArk(ITb|Z^DD#7_Ku3w2M z>|Ez$l09Omhuy(8GCScV@m_=|evN2%A177}g{RWBgauB=fOV~#EInvbA z-Q5=qrM)Cn+8Y|F8JCX${ETx*8)NjmyDdTKCejjGednA8tzS=}y$@o5co7T18J1O< z-jGa6DY!PRWX*|T9DLu|DN=BwNGd4$cver75V8jh4TWdrJ0Z!`7ElfNg#2;(fw&(gW3|4D zzQ%D+O0VGDOgJPo!8aUYCM1HP6T+I2|7TsOZFF3Anu43l0n=VfLLT0Y#;WX+&@Z$nP{r(fi?yuN$xfDK&m0=@irLyS144`1(Z+lxv`~gLa52=bIqD3F1+QOKK-Qu%*N4kbO~O&VYs4( z2EAhevgklmu5fK~}#$SRn2Jo%XwG{1~D{h1aE~zsT%laMtH6)SW|;cpT^B z_K*v$;CHiQGEF8k@v7Ol9B<9HhVvQ*(h~ZcPRAu;(kmEt21lhM!v~jFu}>|!9bN2U zR}=e_s7ItOPh1|{7d~?nA&!~0pU+m+|EZr_*%V*6CR#&{V@*~}AWISN7bD?%m1hOB z*_R4$n>!(9*;F5I)DL(Up>Y%c{6#`VTH~NT^?Z1x^^>5SSj(A3-1bwuz`N%izK`c0 z<_HJocLi7^bgV8brlQK7AT_CXaVn(4RwJ%LFSuf$0J7eltQs|D8jvMjjA{c#`V&^X zzb|Zx91Rtcv{h-V0yw{QyQ;ORN=*nJUZCnxF}U_y7rR_@fF(QF!0j|MsI|PDVlns{ z=|;QYv-dhxA~Zr_Bt_S+Vli0ld2Yp14bfW@;}h931<$I<&Yl^r>J>?rt|$V@m*4M{&|gJxFT2Y&EZX$=Hv59VeL1O6t1*6J0x9 zgLD*2W0JJ^@w1ru7$ z5Pc3^gizbj{uDz9;(zuP9KYhyTfsdv!0M z3g^Q!dO**h@Y<5{`CO2Uiz&sPlL~z>!2SyT4@W%rI2Id1c>!Aj!HxPhNqo{ERTl?r z5w(z}k85TILcsffuJDULrHD?S7!p-uBW+q_@mqbai%Xpwgh8vv{z=fFrti+93=EgR z!XS(qT1h43)=!aiO_R1Oq==m#a)~}HvaNVPc_hlAtlt3d(+GXdF5p2j3zaOO!-Oe- zsD_af_kBey^{Sb9#^vPYSlbf#6(@JE6TmlwN7oI88e%2tkFY?9VdsU(L_}fUo=Sxs z)!0NDP1GFZzwP1Y)GPog#82#;8;U?${E2PQs<4;)DH{2UJq&^AiZ9M?H;<{sI?iIl z8hs~ElK~*zgvmPJD?%#3o?cWZVvI^}QS~NKc~%kVC+kpczfk6{)lMXQ5bQqz@HbV! zmA0VJ`X&&iPJg3cb%iOG?CKQA_{86Z-BNa_nwjH3WN!fs7&Ba$0w1Sn#9mFAEo=3x zR`I)>VtbZ&TB37&@k*w0sAJ2@boz>A8!Ud4qNXiCdRHe-c3=|qlkM@#9TR}hrz_yI zw-_W5pTxuOb;aUniRCEfL3D40>D!#>##xgSA<7#CIn07WdB*IxL4qiR_hDKzd`i!^ zx)jgM5XJ)Etl&l$$+rux!7*GxxO)6H7;|1;k#gNv)3QmhPO3@8sTFPE4PuUhw#5$u zUqs&)TcZ^6963kH7gtBNKh%ypmng}SB|xXHwwQW(f2s9M`gx9h&?R@kY2FLNb+}%Eyc+wA50EJa1aNJsy9DUz@U){ z(K%j1Mq;gmp(f9zsH~2ERtB>s_iGCb;mp&=#M7%{f_zBQ#6DnWnq$HCU2$P`qHWS9 z$#209BqAsg;g`wqPZ(;9=4ey4rN3QpQ5{pz!iP8C`G+^smyWGKVsm}DM3^yI%r=>PnN?T zv3b3zp4^7^xZY&Q*>PjsQgckHX_`D->{}_a=<_}OrT7$WaSb#YJXOd;(&;xXoiKV2 z(r3{6m(TXLkZK`idlacWK_yBIBTZrMWm2F46P!MMVT#yTtjQ|>9)1I#WwK6s#!3o( ziiMiU)w3qyEDN6{!deD7HU|+7=6exuuln~fkCIW4sh@Y7(C(@rGkrzDZZWKZS*h}= zTb#WT!zWJTpyx|bPxEnh7!CE(P=FQrM)c?FD!S3Q#I<+1i=X*r?qNk$Rl(B)A9~qX z4-HPH)bdh7k-B^~Bd><*0-Q_FSS?TZ5pO7J;{-pvKlU;aoSBn;8~>-Sur%TCe!()F z*>_)JrM-F;l5u5f-fR(Jh7N!6v`F1z(OFAV4+18M^Iky&nQ=V1TS+wIe?7Y}+iZU! zi3wJJ264a$24hG;dT7{UCp+iY_peM<9eWqp(+B#&5?ZG5+NU0bW?d+?1?!Jiu>7bi zrzLuTRXbbLFj!fD{TrHk5cCSb2KQ+Hn%DZhoY`^(Ff$?#Eo(cUga-peu`W#OQ6`T` z8!W6!S^U`#ne)wrPJBY3AS~}eDNBpi%E;x&@C-ANwi;g|!(y_B=?MpNe8+S%vcf5d zU8hQWT*Jg*29NKiX-t&YWPipM+=dTr!Rp9B zY1D{-FZwT}`rWfiP|pg-s`;8&K%tVNqCd8exo99nRtSuq>YH-Z@kWF_P|M8FuhO7> zAhYIym|+e2KJhSI+Lrow!@u#n?Ub;+cG|M4A<=y-l;Y@F@~nMJ8AbQbYg1ZPGgwUM z%u#Q^RgVet4o0uXrF2$YQKHmm23>ocu^Ci9SLc{jxRT8SV72N7s{WWcL+du3(?DWnuZitOv?`sd zY3R&6$ZV832}~^5vU8SaiSBW{#yJqNRhl$lE`Sm&M*yPc5pY6hWWgINqrIg*%3Qtm zf}6?a{)Gw$D)BL4(&B_Czie8Tf!7qRdL3DpD`rng=}{Lt)YMS{4HQN)qa+&Rtn%s? zR1p8FD!Rbt$by;YFxZ6i%jY2SZ5owEIO zc#D}u38;B-E9b`TQty{bv{@<6QPY@<`a@~9=q08p(9&cnSsl8`Z~m1Q>B3^qwX$$* zF|-WyOFAeues*p-4nc=OAqgv^X7j!F!%!zIHI;e@zDR^|n#yu>T^6qa%ejLD{ROQs-(y?J@P=_ z9MRgUA4Om?1+oJBvU7k?F?NTwx>2&#}ct=oe4?6FmJ1wKqTRT{tM`kG%nhTUk(om{bpc zA+bofrn^x-7U0!auS?!2z1C#T&Hu>%>gZzv-QsWlwvlW$c%ZUi27!7pn*8f;r| z27uSe*SOWC(XymmZj!ewSJjw%(k#JJ)Qmq^`AqXoP>=P(6Mf#T5=XVO_!I^azmAYK z5A_3I=!-KPfTE1JUBPpx<_o`J7#m?PV*YpIXXlM5$hw@V4>@Tny3lO#>LAsk`0rqX ze5c)DIo^P+Ui4Hsu>odLvLz9$)Z}F?(XQMz?B@)4V}FTnboAD z^OF%~D2&1Jipl#3#rf@XD37}dcM@P6{|!L36Px>+eUpptpgZ=3D^?^b17}7`$|;+8 zB(HkDR{wGP(EfJL>Sq64^{Ezk&zgOi1*Xacw{wilW)~_)LWELh*50?p(5tA6Hx&y4V5Ne3aEn(8I&n0i!f$ zazx*+S{&OniKr(#vB_+$J#<;+lVTFUNM9J}?bQfsGSl)mSFc&IfPt*mgE7vCY5ezQHkP& z=9n~Y)O;LS=rTo9z%+?2ects-;Bq;7^(#0ho}v#x63Ll3Q0V}@z25OeTdutvZQ{rN z6k^lqJ?Wa;0@*3zXUFVd9T>|zMz%G2ZUfcf03KxZV*j)*8aXaVwBWo9+Rb{Lu9EnW zMDHYJ531H7;Xw!lBaNm{gL&kv7(=pAgjipkdz2_!)ANiV#p-uu+#C_lazeu>aKMxh`#}cUT9L#xQe8fFbF;V5b#y;*SI~)`z zLu0eFe8N@3XrN@B!3*Is=KAKY_oIe9-S6L-CKD-LUJW0X;;X$G+k==mu`Rtwtsm*{ z)85~~BZmX5d|YrM%oKhqhbf;X%-lksF)T7gdoFEQAM_#phOx`RpWY2b>aY zhury09dpS^VZ4T#Nn@YwIKd=9q#%XF_5BWlR;>Jq$fk>xwy&=iSu_ppiCC*1aCT@( zGOeHnkQjc^g7ZrSyh@7+m`^M>vJjF0s?HWFC^S`E3Q2pS6c#vobelWXj(y5~bh+Ap zOqY&PhE#me@N#Ul&NyGjnIE$Eme|KPntBe;geRDfw92i=@eLceR^QMj+c;QDDA%Z8fOLN*`EB3*OoQ^pWP_I7#@Va)_f7&DOhti0U2Op!4ty;<@{Gt0_6 zy~`xDFAekk9)`SfbR-yZ;?Td`u!h^~`B+dEJ(zu+Gs~rn1fR1vBhw(~fSxyS){A5mwdGXXNpsI7e0u*P(VUSz_sS*Xv zmG@+)vYwblzobkIlcxEEMrvgJD<}Qz9|MWLjjj+*yFms*6dc7eYK6GJe~bGV#*O?A zekhr3fGTKZ8R_{O5NE0iT04>wD~roQD@{;>dK!%fL_*ue8}JrlL1Yb( zo<^O>m&d6Nkh;}@)VLajEOBwVBKk_h({{B_SSr{#T$2%FPYnDl9kLdThf=bpM~KOXR~g04#tsEeKUO*fV-l?DY9nPkbBFQ|o*dv?; z20ly$H96W5wZkRVgd29T`}Z;VsXY!O=#j#wrHp?iQtUJ*c#IRAMu%p&SiHRW633-* z%>N2fF~m;zV0=VzQGTkaS3aZ?7+_G*It1(U^|rqd-&5gw5eDP>zV1n_#CagYr3XhG76YyRlHAdldQ!c89eM z5_&&5$O*7G1@c^Kk|!*)azT%^>>4knmC9sV;ALg;hb$BhU{x7Wo%O%x~}nZ#ved^FN?+pJ_*zp@I*~VD@2)o`RNfeZqs$ZXkqi4 zkUyC#?hfH}UyA5M&>>+WnmHAA%}KttLRu|XQXXRjS#_&$NIA%JeptI^a<8=+snSjQ@N zmNoaOFS>IsHeExCfOM>>O~(qYybDCbYC|Z;hj=|N&hk5Yg7p;(Q^|St)bS`y6O6qW zs%$Yfo?cxpdVB{DfCNDvR1uR~y*nMVOeSHAVwTokORKzaWQt=^bnrv2@5lv|Cxl`8 z>YMBi+KH7TN?2|2kuul*v-lILui0?qJ>qCpKOIi(cPvz%oU|Bf4cxHaAVcwlAS?o| z!IVY^oNb<4I0ZwVW88Et1)T$bXxlguXy3Q?3_SjMQUs=eA%h;W?(`jQ3U#7{+Nbyo zBKe*!V9k4MaG#QGE@EuFR(D(!RDWVR>+T=z*>hw5n015rg-U&svbc$7EwP;?bY$r9 zn=+(93vslmr9_c_YLm48`SO~JeoILbIEdDGz*^Z2u|oB2WCK#eEIfL}w&ED;0*4_O?bpCxu#X4VK%NAGq)M0X|Y z&o7_@ZZd7nr2=H!>wm8nD*;}@q>_=Q5#>%Hde#j0zkBo5CAKGOvi%3zMy)gu?_$b%?#Sl(j9hNE+s{~aXVA9 z6(oh?$1wF_USc8WC=r6&*I6S?4u6Ir-kJ0VbkiGQPTNvS9`5;KV|XqM2EwXuGymeo z8wP6&IQRi<)))3|V1@+&j%>W{44X;dc$Dof&QB~>D7tIl=q6}%{%3>CJ_-eQ9L2|<}i8IZY96 zP!F5gAi5o7l+6d7Hk9rSfq!+xOwi@}?UXQ}8Wd?}0`>Qp^TeMq4ndc{ z3?ztZd&eED3MdcR;{%o9USNfiPy!=e5So7-S^*%V7o0|K|13RglGDg0H|83Iin(8? zFNE6Askem4I{Zu-hGnp{yf6)jTP&oY4+;(<>||_{p%$6kDbH& zQOri?(DGduEyaXgE?!~S5>RO zC`W6V`vh3NGB5u;e)=KTo0qb6HcXzRy>7hJZk6W#fysL;hWeVfqkyq4y6AGFJzvk{ z5Q{>Ac8YarmC}3zT@((cLSjHr%-SmU=Pe3h?J=-GjxMJeE^IJCvYU;bW~{ zRVjQu;U0TPkk*O+T7KZ|#U?@}`*3Igl2Q{d#Kd$GW=0I(U0Kc${3+vITma4X&x#ZgpwbcKckfZZ>ahn2vZ8@q7O^ z--WTpIG|?ag@2xK%Zzzd<(;dla;heP*0B82ABo54&mX8$wf+#EQe|fn2s1C}tZXYN z7v(bT70AvKG7P4Y+AaMj*Z58*FC~W zzRvVzTL)8>rAQn$$p5vXzs~lbf)-S)ooiDDD@Z1_?g^|+b6%~EQXve@9KtpC{|z(y zhjv`Pc_21A!2kw||1g}{zf}q9olRHEZwuCcKp(PnYe%;vqm#(#4CJ5YM`evSx*0lS zv9K8~=!7tv;w}*(e-S?ky`Z|%zPT5Pi7?&TP&I=2$EvR3RGW<Ksi_aopzxCu2z2YVWl3JQzky$Rh(1` zqH+1V((>FiYtn*w+of2~U+@KN>5$2(hj?9tX6gYi8spzicKn86!L^(PA}7CHIuNU$Ct$8qlu9ZIS~ckRJ-8I7XH@ft;ryvg1A%3Y`&$iC`T#i*zry6-sq^(u{B_J3=B;ckuLf|0V{n@ zK}>~-<>_&X6T18~&DlZ%;cea^Llky4>;^6mW@mophyRT2!P^+c$*T2L(9GdVLof8u z+DvRZe9inAd0V5Y!M5c{Xp$VnUF8Z~M$#F8XA#O&LuJ{*t^f3eLZQ5B} zaad$>PV#3VzX{X*XyJcx9rM4g(|`h&?6LDu?fb5p-H(j-8KVPdJ z5NmVLBl|Kr(X9<=WO>Fc+hJiYg6`5Mx$wAeaB>z*2lupu-*ACCB2H+E9bd(o4 z5vYGQ7XK>miD>#rlbOgqQ`cLwM>!<_0i6($m|P;lju9`{2#~kY=Jq(oaB9wwQXCb%tqn@SuXl zt=o;u_bO76RbjN&Sk#+ z)N~U2Ic**uZ_gvmCt3A}6a28-1~;l=^|!&muxt z6Dtf-rsP;npwSzH4?#}m#S{0-pmF^qh-E*I7T3St%H35`#}c0tEt&mqfxgBZc{6?2 z*(hw%z;8M#M~<+nU31yWm-6jf+QB1@-%M*-<6w=ZK^SJ-AT#I;^HV_LUcmx%t=pjI zQV}vR9kS(}Rq9`4-oaMPV2^z~^9ve?nKt#~@q45k*G+_#vP3E!-3E#3>iHF<5j8o3 z^cJMu?6stYEPV_)j z>-M_PX?Pwc)9XYKM+EWSP_+c!V9mRg5ygSuLo+lBKqWaDR{d<+PP>kw@A3bv7SB)n z1!<4!Kd8Q5N-1fg71GZbcSqYCmIz;m8`iZuj>x_)qZ)nrrNY}T;*GrwXXoy;s~$8y zeA#&%9F~=asKbdt7txW-K(!EQBnY#p6jXB{dJbYNI-^Tg*#FHRhbZ}s=C6wnB&f#! zigh5;nS~Xe+Zi>W=!6tXqj=ro5dt-{hm$ak{2HS*b20pgR}x@rHBTb^x z(l!5a>?Kc9a%H2$& zp!%u2zho#ABOVlmfH%A|Wu2RA?O&huHCt%cc1 zGb$D~yOMQXUe`bt5Jqic>Pw?Mf73M2hRiNFA&Z26pMLCB@@IO@{N2Isac*>&>0avS zzR}UsrFKi`SBd%4zU$TYcbTCzMAln4YtJV)2PyiAwK9S11=SIfYY!RAH=YoI*nq1g zg)j`wI<#O0Jq89)C)KyJJ|;q9<%`s2pa*~K8pXG9h_;Kfqea{Bq2a(3OEu|v=D#4Z z{??S|e!<)Pz3Fy)!hYFUTOWLFSa!R9lst~9)#!Fvbh|&4f0R^RT(GTa`3P#Ygj)Z*(Af#q!O`|Bd^W6%W7z7Thzz>O zH!Rp}UMhOIUv8H*eMKdg9|S^a7smv>eJ!YZf3>u1abJA9SY+o3<>Ooj5`n11pEZP$ zt@6m<22W;S!dT-FHTsuv`+!ER8ymNHn)C3qJkGCv8FJ6WL28nBsMMlUsyBW+R&0>3xW&WZp02a)u(-rNO1hdaXJ`NQ!MyUxV%~S^Zurx9CF76rs_yz}+dXpe zRfTm?^5OG)sv32V2qWKRWNZaJ6~b{4-GVizc)rX)TKO3^Iw$(o_O$HpmyAti(nwGK z$Je3BfA$-mAGhD(Bg0Be1Zy%0wJ#csO4;EPz)XSi5-S%Lz=u@G{S*qonjkoUaI{qP zaD)UYMebr`C`x=+Pz6v%)Y+*TvGGb1P#c}vor=A*@wFh)k2x18^7eJG=wkEL?f%mK z(fFSShu8}gOYonSeZ9z%wr*yG+LK-SU#xsOzW&T%rCnA4dU7T=>y$MNY8&WNY^7%U z!sOb^mNVIHo~t~wZG#-ZZMSy;#$bj8d&;X9&GOep)zZs(iMKc4)2#wbLV4n%fhtO2*i(zTp`Zw)TwoIS)rk(y_m^5ki6?gmi#Cz zD;K7Eh6@yjbMh#i3YV#RlpLo<>KX=9w0fo~Mo)vlUZ@9*{bpFUQ|X>+;z97xiP)%A z@z6<#JNVzxqEYaS;MA>IqGN=M<~Y=KqSSS0z{Y7ifS-kYfr-7fG<{R@Q8{OtKHyS0 zt$-w9YE<{fS+{h`5SQ6-n7$GRvTRyKMTK-^R&eH^F?5hS7;Z|MoA(Xr=7$!~*zA`| zwJ+wWk1p1wk6yRigYfq#x;_3l7};(xJLV@&XBl1QSzg}|if2F@pg0`=B}kEWvBGrU zJqQ_PjU6s$8N{5;18nut0u=Q}^UlPI-O>F0y3inJotg{n$c{Wx2!MS1dN{jq(f#yT z__j&8Ja~C^zT;>wOu!G#s|@6He(laEHMkizhUVG&h9g9UFo2n;;)wpe*Kln!@y;D? zS#^JJ9x5KvMPxcHxy{P>$#LbHriFo^4`i0Qu^MPBKHMA@`Nh0?>E^VBg87GUlNL%J zPhZSSOA2Q(d;pNir5ak?9d7}oa>*Y=NF1<_{PY(uMyS$4fG9+#PpA)ff&sO`V}4#) zoiJhE6^51lo^E%&3{MRg4L({Y0aLEyGc|~`ps(ltQP5HZ6CAZ4O?R3FZ3z;XrM3UL za_*;5w5KI2^OeIpMR{j1O5EzHIHN*7HZ}EIu$_mf+7lD)@DBm|J{2XJ6WbS=4g4udV!b&RoVmc}?_qQUB{&r)_eph7KNjs0BsD{chqtx}z zcWr)=ohiI~OB$CMGjxTdX1nP>E6Qk21E`H9nZ=BS&UYdT;}(gLacV!FQdBubw_v7* zJoC7KUQ;zpf0vBgVqE-yWSDc#Rz?uQQQj$y@vFpus>btG%NnO;sg{X**jR0q6j}^3 zeg21v_qOB%TBe^+iffPQW!xVu&Q#PQp(R9F%_5XU+0Joq9QF^_aHM=1TOzlYP1 zw1Z=4y%82$eSy+Pcr5RG0%O17cY$2{skUmrYjj?eGD$ezgcDHy#gStKkk|p0q!yY)N@ALVD{VR^~<9H0~Thq;rCEWC5XWr>O5}2&AZ(<4kXq*8t~%spT3X!HBmWKUCN*t9AE2I+^<;`~GL-70lq$&R>Ytjd(gz)QL6b zpXuJoT<~rPToxUTI=*Hz{oY4g%X87z+nMb~$#<&w?{1!tTazUr4@CEAv&7mli1)Il zAf;yT{f6+>^s_JEvX64(4qz+ht7h}lk=Zr*>C5#|=j-NkOEuf{kwCp;vn(+nJm*#- zVg3VPk~CE>c-COss!5U|%sIiGc*m8M1DPHBouyPat&pGrk!JY%9X_vETV@&*$gBQj zGE8)nH#)!gW6K)^%`q~eET@)P%c1*CA9{g%dA&hVL72$_`SKm%{G-5sV%K9>WBw$Q5W5VmcEW z0sHTB4%h$egwFYRomQCo^>Xtc>|}%QDe~(fTev_-DPfwjR(oW{w7ii9tv%p`X}Kkd^upX|cs zCTMAK^D(QC;7P8Od}AqUw#BskAXA@Bsum1H#ucPEgp-OIm8Xu@Z#vF3X4^8x$oobd zd?Sv*5ymN&#|sR*+A0DqnPyg0Y+_H+#Ptep^rAB$h;+=CDs44*y`a4;uhcPwBXQ}1 zlPDnkd>)3XmN3SM?h0~^v*J0TO$Fmhx*hCSe>?1ERPCNoHz9EcDoe<;-bxhkR3cT99<6ChaoFt8D~P(r;Y!g&IzY7HAs$tXh6z)VHvJa&C{0(omvlAJ`BAhbRDacf>2K$ZC)qdsSKdB(ZdoI(Hd8~S54$U3 zV}v6sjla&$qT9A>%YM?@2WL^@qjQs>7ws{QqWNq{c$!W|SA$%jCdyU9aU?>MP&LbP zw8XQ}N~e*UJF&KhLUjBHGD}WK!PNOmBF?sRzSC));slGT4WNa|N%bP@ z==b=f=4`gi2PJd=w{#cA(H{B3X}ru^p<66f?OLEZux4Iu12!pS-{nL)-(hC+dXWBh zoW|!UX%Ioy=3`qCl&p3pkf)~7EA(OR0h9vZc(Q6#nFeW;xUF@wZ{v{R$z^lQ+s$F z$rh_wgtk}WWbl{PP6h=p0|=zM+MPfl=XSmWdT6I176MkAweWeCYpo?-i`7^AaI{D7 zonZIAci{Vd){y`79j>+Qzk|UbFaJGzark)uV=GS!`>!R-i3CRh=7GBYCn}c+O(Lea zV#MN=ymXJtF9vW4&bQVglWIgISgWoA-*ug0eqf=wnf$BI{LLgYpnl@dg_<| zTK)g|i^BQe^ZsM}pRGJC*8kU^Vv~0;(h72#BDq>&wAYwk;VK-|h1JAZUG3bt=(Ch| zqY-*>1V8EQay}l@Psr;PWjY1qsY)HFB1Qt35@zGeiG^~Y9WJfx&ajZy4M1-w#Y3;& zH^OrVqJA4i^fP3;$0LHgZ$0Gw?%jS+I7Qre9)?Tw#~g=rOi6%n9K&G!&Ih7ehw_Q+ zLqaZ6$6CnIY3<~h)}Zp#L+&|cgn*Pldm2@*-dxJEUN*&XRI}@!xrvo zX5aw4gLAM1UPHSY=O&eM>HU;^p5?+7ltO_Ot$&J-Q06?f}QVRhcN z1~5;BPHU>)HpI4C|EwiKWu+p~X!%vrVzr*Es4*L!MVKZ=i0nq2BC~SZFH4nFW!~#Z z2Znm`g&QB7t$@j97OT@09J8|22G}M=kK0vK)+q~lVF6$Eb!}EEZFO@jb>G{5`m7=U zDaYis&wmDohsF4h{m1y<+j&~Zf9dg$ns~izu2?q>fjCR0IZ(OO{_SO61a29*q{2cX zc~J41hrHP`{kiIZC)ZRDy>?z4q`v2GV|CX_osmdrOr~$^2*`L5!FwwdGMdl@iHuk| z7li8&Jn3#@U4ya{hOmhE=%q?J0#|txU5TmF0plCL_i?V%En3L$LX{yNUEg3HWCw6G zq{-3;2)?D!n5`EVeaDPn^$b`oOo;8ppJ7tP5r*+YrWiU#H$)|T7i2*=4)Zt_SY?k- zZ^z&Dd6r9~g)OXLp3Y0A?x|I}@0K9QY5F9;;pnZdSg)nF(9;+F@^qi=uHZ>gIC;u! z>#BZa@397EzkE+CZvK@;Z9p>&nBkWTp80j>nk*YFI}l-Nja5fQsJbTL$LKvSE!$aI zuF10eO3)k2<{%516$7f)GdRpyTa-QigyYya z3R|965|$H0qkw!`Rcki|y4rcFmfcJf_1umMwk0+y!IF|6!eFBww03>mwg z$H-gA<;ut=yDMUR>bXrDqvNzad#6&Hi2mXSIKfspb9eqv>I)ZyJ=tqH4of?zC~IAr z`HY4yo{?x|$1wfVil1lQXUI8e>y*{DXHrJQCpP6)c^B`Ru(#(HOXTlpm(Q}|= zpx6A|^j{`C9m`(GZU{$va$SEJ##4+2-LCrc&3r~U9ic%N?akx3Sn9LBvHiOf=+&le zC@)5o7FNEh3S>e)U8p0WmtpuLO+XL!e*N`>g$?BWcMpA*+k;3rdfv40OvVE#Ph%o0 z;jo;T&d1}Blrmp=kj%osC8FNUX9e(9G+FL8=m@8=O|sRFa5s8G$0+7xLD^hbySU~^ zBcXygEt<%us$`v1dT%1(hD8K3+TOM{rwxX#d3-kTtYiOA7{?Q`_Wh5+;Kj2?`~N*X z?eBlvcN8xb2_W$KEnQVLjf`Z0?2=&`o?}GHZE;qCrkBBUU1h3{{s1t7(Z_1scRrTf z+|FBb^rgT;H9LyG+vCaVN-IsIu!0tA8J~6X2bh7KBHf%>$?U9l8FlI5SMOKPzGrFg z_H}iYcu@{nn)Sc`qM!Hwd;YBd-Q)Vdji=T69|eR9gtbu+ z?){~{8ip`dIntC|6h`h%;gYRD84H^F#T2{9t>6Xw{US45WGi11hvtiYsk|(EfL&$J zU!vjg|10Cz`u@Mq`UU=f_Wbbi{_j?v7W}U+^U+8}fu$@00S;Q_Ogx^E#;pzI-{^-MgL-$tVc{ImR5&OEWq(&f}zSVQLK;^%(jnSR@z66Yo#3 z)cUf7y7c$u%NGxQMnf#fi)X0U3&@BCq+4P@`F>8r0Fh{c7MLsNNOj1JmG@=s{N-?= zCeKXBY}reXgX(7_*OXof$dFR%)x)-GfC=vu3-b3uRj>pWB4p(I zu(yiJ*0P`&RVDV2GA8<{TNTtIvny7%QgJ$)WE=39vzgg4)eP3o+{&Yj^uSd8)rzwU z4QCc5IU0SiW6hxNWvB0&1N9+{XH|x+CV4yj2zl0W#{aaKp3StU!l}L0POli|(2JGp zFeeL2Zj@t2lu)h@McEiV`9?g^Hbg`tWb&1%qxi}&h*==eIYB3A&z!Vmz_=7*eK;}I z%1mXcv2-ElFFTD>RiH(*!fvY0WepDH2+B@o5#zd~wpIcQ!J&VMA{O;@=_VvseQcLI zy}u^QflG&QX5W?)o&NGZAA0z*|Lhwl3&I8YLB2dbLHbW!%B3>9XnvA!cZBGd9t(Ay z6FrL@atEGC#%H%lvH&2cX+ZQ{O1K@$*Og}v^CpiilYGSrIrcLI30S( z3h3F@F~#!HJ3p%v+P~8%Kwgjk`fKp*?q@N@htFRedn(-6hnE*`&ffgv7+qweM*&I5 zC?NsblOnklIP}YxWBEpw`SPW^kF>B6rLnJ7Kp%CG9WD_ka+o9v)XgWnU^FOVTW7q8 zA?*f4peE6RauzAKX>iW0jzFz(L%1+OsOMnYNpKYObT2*GOV29Vv1}KQo5%kn&+XTL z%LV1&_YoEXM*+uWn?cR`|GYoQ=YRd~#k0rrzpXqi)_?7xL(r+2Y{c`a9@NE6xv&;e zd^GW4%E%~fu*x`O0>7nBR>q0f)fJjKX1Lzvx}0*x$Odadta73~GK>#w3UzAu5Iqg8 z>eqOGm3gN6sbgx^lesj5MOK$_iB=!IQu^Mp8gJzu*%Y~!_L*~iFVSVP78WMoeePO? z)1G$CYt)b`n`Hy0uV8w6ceutGg z(o4v6HV+dT7xLwpc1v6vZC}CMeXNxy(g#mFFXx|VNHJfc@jOy;l(uO@t`j<$CdSyt zc<#o}%EhggRm{!t70cB11JTaFopaI6+El!izhh(U-8oN$RZTW-Xj2of zIX4?hySX>3Tlu6npA6GZgITbRgw-=*2DSqCjaWE`51=i?)-@Q0|p4b1529NsR zR-W7Fe?Q5|e)avvwLe2d4@UPh1Fh8j;P&HsTA%6TZgjp9l(y3NOnu!Po+r~=D}A}P z%2hthM^l;*$THjnAgg%3rFk-~RvmNg$c({mQ>($rQ^)E;q(h-nI)o_X>img6Sl{i03m1?n5uv#_NG}4n(ykYIwfxsON0BIA- zZ7!u22(C;+b{!+_3@Z){-J*m0ri~B=(?uk2)C`gLx3`C{5(wC8IfE%;rY)}|z0{1P9Ii}f?_HJXyY1qt$%{XQdE$01} zCY-8P)->RlW*@lu#$Ha_@R%di-J$X34%y8a!a96r??`PJtD@e94RexzTg+@GW`C8l znt@+4qxLFUHe>et`!&OD%KpQm3A>&BXV8CkSUCSbI(p3iv6bgm_8&RfufG2ePA31k zc_Wafq=#b!vPWBO2~uFMX$!Kux+8;75xwmULc0D&3_@;O6$YWzW*oPP3NucvQ7Jd5 zYNOIaGYGxH2_9mRuOH~w+cGF!5_7|&Xi8GwYFm0aPo}RkTCv(m>7v361+QOMlUW;k zi48@KE_w&nFJ*(UL3og6F}>9N8<@pZ1)Is%={0Sq-WVq-D>vjEEO&2{%k5|n$|fgB z(!eB_ElYLAI9;*<(W~-3L6Tk?Qg(wDI1R|7?X9V>u{qlt2w%gEsErNazKu;lH~V$l z-t-_^%=>L^ZxyYqYkSkpK5*MxV+&1{1bvqlnhonYm1C$g(^w333p34~nnYKrBwvZ~ zY}F9fS^nP3ppuqKZGfrPnwGbf-1=6fKw#dA z%r;lkhvgHo!n#!6Td5nB@9ui{=sQ&`R*Knb^FgtAwd!2L8ymV}RD{B{8EFhz6WNLi z?ODub&$UjJbdjHr707PuI<%5F8_mGox)H4&*+VjF+)kDXSlgJQbxthNRkBIyjSU&~Rt{-t1cSJ7_ygM}2$NMyC)}newCsf#y4@ zKQJj*^h^k=z5JY7u$0@Wy6$jRD1()Kv~769<}hoBEh*-9MzIwQt!WptC+q7ljTJ<~ zmQzq6R^Fj?X0z%+;}PA->X8-wIX&&JUqL`tF0$qdx6?ea4DlQ$*=2kZw(JfcHe5*B0ZFs%2dy8+sSn6Z2WfOtJD$oTU{o=)E01NmA_@Tuo!eCS=dCn~0iYL*YmKo50ouI+9ZsVCK6+70T|I+sC ziw#x*v#7h<*Io;mtE=`xuR`{c9q5!0x7<7O(5@CgRBFSr?rn}u)5SjeYTeDVA^qRp z@(Naf8vXy-i=%$t|LgGZ@&4ylp4+JZS{asQK+PYLqNcATcPI~ReafP7zYlq(^8#O* z?gd_XRhoY4%%BCNUcaw}Rtm*t;b^WVi zdTbh)04KP-i)z1z22y>tQK?)(erg+Y)TMgr5j2_Q`9S(gZy?2+)&WPl`oS**e*k#q}y6p}=5fq;B9NGpFa)0$G{ebgN~6g>;v~cgUFdBy zdyk`_vx6csQC`w}$}pk5QPKb3_0iiXTp|`hO$ic;2}dD~h~M#FUH*P4H@VIZIt5BZ z?@upLK)LAn6Pg^rzY6@0Kl~RzfPc-4>EuBEWBwG2=pbuoh)37+7<3=edFqRsxbxH> z;_J>+Kbggyr~jw3gWh9K*<7HrSFc6Kk2(8DMoGt~0l^2V9A_Up{z8mcKn}hln?zgw zzj*!f)laYeSAXb0 z{F8(;_w{dkCbOK}4SX?$408twi|I%lgsSN8ns9bxnJ!qrC!Eb=xuhs!LLr;b5gL-@ zhR6j+1ET8rozBhX zlkvLI$@q@blz6%mJ1L(2EjxoAhgeKIyGVkM(vFvC9!ohjEd_Aln7%jtE(V=z8U@El zYVdUO6OKDGl3*!4OOO@7B`Oo72lvPGFjT&faGq^y&6Y|uLf$_~7&7#M@i6cd5IZ~Q zEK1TufSnF3(n=7CIa|H+nvF z3PPZU!u)s5CV^%+!V|*%PUm}PI-L$+#sB4p`HvO6ZKZAjX^pK4k}8wDoO1%U1VIxbI-Q;k?!X@$e%tA(@gDgDzptuD z9hXRaNQxk6%)*e}sPvJ;P~~%0=Ocy^@B-5izG=lzbFwB8aDExFn1Es!(D9gn&@RX* zgLDVI9FJ*46Dr~SEP;}{I1NZ75kNSypU>zOY&@VPqQ=i>^!ih*vTdG4@jR)o(D~e3 z{nUNmRJG5Y&*(~XJWes?M=T(|VB_QpeMTx#H^NB1K=PBu=~Ah`vd zvoF_py`5j>hpT5_u8s-ja-p|YVsoy%r}oNGNagxyt{%~Gn)2A{0Z{?=2SJjqFX_a; zQd=4_iQp^Y9B~$XWJ5obKCa5(#Bt17%qduN)1t83m=K4ds3unwiI$D;2+7!;11%iy`oF+@%*j>OGk>rN)>+>SGP2tonw1crV zoW_nN1!otd22P_xVAANfb$ww&}zIAP0w%{k+(Hv2o@BdngnG)3(^2|l%-K%{h2tmJ`nQFi7?LZmMSkg^h zeMQ3O5O2;$B?E}(VW@5bh^x{8yketk!W9jo3o@Z1;Y*}154^!MBG6tyVopXlA;GcS zppe@ICs9E7dDao4kw^#*y1AjJ%u+e}!G86(!)}HfHz3DV*}w}>-G2Bcs7ZE3OQa@F zvH3xktq@9kA9a!;H)p1p?dADdD$l0uA_!m55iy=ujCtw1a|Rw(L(DzB3d&Y~F}<1f zNH!O-gpP8?b7d;=DLWX3Y;theAN=*8|J}jhF9$fLJ*&3p(Wp1*4PG2r>*+E|@Tb)F zJR$;>;mHX0=Qx?ZTgK$d!qYjYQ6kL62`$;jx}foUO3%1SP)@`p;`;-CR^ds{-D!x0 zkh|nn6`p9WU>&}`N<6`;{v#feaGP@979}*B6hauMxr!3FRyoVGX$l}!p?p-Ub#L7j zc!VhQ-g?_#p*}-_Rr9vi)>|@jt0r!(eWz~f)Pb?$*AzA>^GaMsmbYbkjZ4ahS4O^( zCEhLw=QIF@Up;y5>9j0=%8A-;jD1^vT%tebIF#rP5RPL2qiDZr))|1U2~w4XLB-)b zv$QvwvPxRf(&uU}UsF{33PrS*&+3(HP0{Nsl-ycAHsLFWR+p($!7k6%+WU3&+!%qb z5Tdt4%gNtP*NiP!)XVu8ZV`I3W%|?Bg+Lj8?bQEmZ^tw!^d0yTwRjWMS3uu2S*C{E z6n)yw`I@vaD6fUSG>Ruk(f5g?RU@>}mze;So6S`T`cm(F#t|n8r({9EXOoT*4mrWW z5{+PI2z*AS->FK^gZy3?+(2#@{Lj zGir^cY$g(^o|i9_R)G?e>Us9{x4j*!Y=v1BDCk|R!a;6ImV3Zb+lIug2P|0GbeP0p z8p#FWj$04Weucns6c zeyUWAIr(Ewq9k0J$|FbVxZ1svyQb7eG}Zo`(0Uug-5&66jL;j{b?=bmHrBLFdnGsA z)UN*hoQ44+(SmXo&D6y;PQh~)1ax&Iij~OF(tSaZY}sAcHk*8L7`eN0sfiB`gt&5d z7OC^HkxA6u-PW{FBe9^2H&%AVxSn|Wj-O^MdYLcx5W6ox&jpGWj;YTt`^n}nv zsJPEKnYJ3nwG%i%{nbYJDjmiTWGM&nBNeuXt3YGQMPdy>LJSV`SYLh(^iUbsWwkyC z!ZL{AA&OYkGo|fe6ou+*vK+XB15vtcczV@(pWV5=g-h!FyQ@6ly?xuyEnIc)Uvjwb z{vXg|FDx}z;q5c92EiTflIR?{tWi)FKUyaQ#FgI7_Vsa<)a%o$+O9r-7NHRqU~5}u z-c9?~H5uiMG|5g|r|iaTo7Pt9qf4pGythNT{I<7a!W_UjyQpUV-1s6_W%Fl>R0rij zX9?nZZ^1}Ru@qpHZxtk@1edEcfJK}6+e}oOt7fQrkWbzG91iRWikU@X-Jgstb_+la5T}r2LiE3M>biq zxkA8P5Tv2dT9Y}*QfRuP^{8h4%97<>wVppKUE)TjusDBKey{tTLMv4NR%Wqg{&LZ; z(=&l~^XEi6Uuy=7GpAzL-tVMYku$f$bq!{2goVISz_BxXZD;P(w6dYKvp9b#ocBD3 zDID9H$GV+Q=W1Sa=d<&K-{JPBfW7bSPeHNW?GF_C512>R|0*id=6@Jy;OT4qQgDzt-qBukp zFepY-GQ+~Uk06`Mf=_VmB6ZwBC|SnjST;zbNe7`Io33NyS7nM@!R3^9I~6Eo;7Q&= zhU0u3scTlXli-Qn%)lSK z@CUts3@MI!gMN>{IO=rbc^Ik-XmyPOvd2q=RrBX*#WdnIm_?tw3~%sKJVA7v!69+> z1YFINC;KXPwIB%;KO4Vc$vG#2M9C8ck9If80K%N(Wd|Xe5EYGZHKZn(UbsZU03E4D z5F2OU8(06mEaRu+74LUC0U6FMbPrWv@B(VoSj-(bSgv4o3+XkHUnF&tPYK6}Mq|cj z%I#N0b`ka@sgU84wqHh|CgW&CbYnwu+}TOV(x$i_Cv=NTFFO+d6|=vCtm#MgOmudT z8oGu^2T<8T)~RF0SvnkiEuKsabyXf&XO_N=1c}E^N1v?1p=lj${$t973cQ#Bn4tG8 zoX?1R{JM|M#)kI1p0|(eZr(u58PC&!JOU~toB{<)iO`XX5+f*+3!4M6*Yi3ZJQ@)p zeqsTs1NSAAL^Bp-iN`A8b~?HsIQYP6Lf*mz2>P$u&MxV{NQ)l+@(*^rK!^c`n96kd0bh1eVdb`W3yfZl=g3ai_cW?f&RjBFvqP|Yaq zXq?6c$#|66gPkpP>(^xY6OLmV!Ls4BrQfH4oK%}y3b-aqbtqQmnJPchs0s)LzdFKM ziEI^9DFt;0*}(1~luDJdkV&xd16ii1l(>WeOTgxGrTU=nGeTrlBuFGE1hoTR1PRj) zO+=&g$ZQ`8HX|sZGa_UIH#h>OoXFY`c2lf~@^qljX`DudN8RO*=Hlm}z>WFJAzEogF)TF`zZa zQ7-e>aT9V(xthV=ynXlj(oa6Ab!x;S!9uc5p!j}&yP@LygIffPZx}7UHa*bVVdG(L z&c<>@8Z$nUJ0}zAsew)q5BIR;ng#c*2~kTK4hc_$Gi^F59xTRE(>5`8T{e-6(_0;DxRdf7`4lsrAgh^^-M#Dikc^TL zDx28d;Kd+fJR<4Uhm0CfkD-r(MH0Ld?@wQ@dA>!5Up%?MVL@IzL%m)=Ml2xRP8lKw zw?f3gM#Nwt{losg zj>>UpuA!kDED$IpQdt_)h>9r*vWtilnoQ?I2s0=NSx1B15eZJ_qQ}O)WJ-EE%4>HY zB~vQU41Z+Yj{Kpr4hcDIEzYD?tkD!l6CzX~KNV3?e$V0+YK{YSAz^ZfU_552n|~Hu zZ%lA9=d!6FP=WW

+;61+7S~)B-R#ilklX5g?if5{{*cg?XT*j1*cChPdl9+IyWB8`n6E#FcBElc;V`iE1q1TJ-vVc8iq?W zWXV)jI)vdJ8Qfb9$(dClIAQp1n}@|VRa8X8qHx*u(J%iboU9ICYQmOE62LLlgHrBE zUC@C?IFd9Kpcw-!Wty)t3Q6o<*)|M&DexQ zM9%yTUOHx16I9a*&?!mmR1#`HxX!}`F+;LoA;2UwB_l;#XWHzbrDzlTBUe_reOb=+ za3etxf{8b(`DP#5Qx2WclLU?B@`a-%qC(7xXx^og*EJVuIu#=lVNO{Z)GfUgi-lV| zU_{97&4OjP5l2foj~N)*D3s^5%WL+~6wgSo#VWX6Wa#~blQH3Dnfir|#}o{ZP%L1h zxzuuC)>iY*;_&yy(eE=lQB!=dlm6_@1?i2jAfl_eM1P7VYVyn&5{4E>l30EgWIPX1 zNTX|^XudvqfACi8@GibHY0iD2P^^dxYH@b6JCW+LfjfT(#su-a=fl9J+Ze_fRz qJvj#GueUhtB~1T3`kF$4KR%DoDc zVQyr3R8em|NM&qo0PKBxbK5wQ`2NjL(LdT-PI4AS$*&BzQuXuLo{VdgSY(b`Jc%f&b-5SYA@8i1?fT z*?rXq_k$FY(03>#Z4C$RcDRMHx6PU}S;;BwVVIK>26v00>OD zq>77K07DvM&~AHPy8@!fNCpl-3#8(LjL-p?<{fo>ue0mzI4vMCB{G28q-=$JGU3dD ztn=dQ;*N{zqJ#hOy^iNQ7GI*wvqSh5;|YX%zQd3U_-8sm!BC-e#$0zZRw|J}yM29q z?Fp1fL^y6mM3I(6F{L3&kBd>;p`pgNCN!Ol+A^d#;9kN;&K1tCxrhvB^Hxp^bUUX7 zc}x8yl+o5CMJDy52n)9Ts%stlxyE5f@>GQO z1?K}9Q8i8nUdSiy3qx@0{P?2u(NVJm10YEf(~xMUIt9ahuj~EfeCxUWSne*1<$uh> zt1s8b9rEAb?H)Ab|9I+v-R}P5`hSSB0mnEbX{^A$d1DHhNwL#c{0dn=GuS+511`r@0+m4EUx%+> zwT4_wh*B7t6|Dh|F^q{om=ZzBAVvv_!vG;6Qep&@DGoE93Q#ynVxmxbjzD8T9PyN? z06LCCCuD?yH5!d6vG46W07)9hJs#6=7QkVAO=i-Fl@XOn3zdk6S13Hn9e|Xcm&6Sb zS5zwAF3d^JV#=_UQU`z}Yr&F)I!;Um7#lN|B#C!b*oz+JT9PH4p&r6=>u+Jpgb3B* z!yvcz%&3;ykLK0n_M77j(>T_W_H2qm&}e~W=VZ+dLyg6D6sOuWJnd8Dq~>0I(5d9}H!>9~3RgXp*3k0emz705P}bA+)7_ zM@kPGZn8>U62U*r`r7X7XLW`5`DBx`}5+p*{G&ocH zZDori&KQPi}%PZwRSONgU5W zpjPh4B4Au;F(4BR>2L;7CU1(?Kv<*!VkA=prDY7!GA86qhLoq$pbp2JhG@i-8tZOQ zcvc{hSaP5&6i6gW?a{H&{ufGuNEvVj$fi_qHbJH&TvIiMm?{;c!CjED4KfYKy8G9Z zQN2z*I2~${1rdj9!YU&vHA|Tttun+7c^va=%0>pe79esPNc2Z4P5nf7z%WE9iI{Dh z@$1)ZMvoAtBA&rO5W}0HLIGQIR&RM3(g{^&4Q>EHn55eF@+aB%2~LbS>vW&Lrr8kx zOi`}e!eKnZ3yd*TT$s1(C?0DQ%B+0&{k`Lm;gB+_X0|%f3s)*+R?;BT;y(&NiB$8L zgnG2Ed4!qVXu&y>=r=(Xo-rfzB>f8m=)9ygF=Nn|UY~CN>g;9z)ycb)R{>Bq)FS`z z`1R?Ve(&(&;brwrdA z8UbhV?5UGAvvCV+&*l)?Ln5&m$>H(w`N_q_JOWUKDZU!uv%|NSzxIz_ou0h8?4KS7 zaQO34v*P09==|g|fdBm0e>u+F(AI<$$}v-qom~^!04Rz1T&%l$yE|Ri0cdK8iuFGK za!eE%5Qzb}`O0@I0B6!o+GprTHXfW{u|la-(#uE z`NA-3zd5@+x$x8n_1S&gVgK*=e%=4y+dtTOwErKXbUb*8R%?|adGPl96%1xtc{0jI zx>}-f<_U{r;N0A_fDXZXXT8PDRP-{b54X1lLJ&4WYYIW|q5-X+OAQM!hxW9snLX74 z_2x!*v{`SfVhtm2Za`ZYx3@vNeRE^GGI-(k_T~n>Id%)?)IY`&HU5yBn5qQ#4UbUU zz-~cqCRjafJX?JDLCaTob9Q{v@131rzSw-CO@&a!FhT{bmX?q*At8b$;v8dbnRsuC zr?VOiJ?#`qEhJ17J5J!k@@m++_uH1!5L(ywc!yi_cX)Af{_gZ>!D}=~*Xe!zZY%G5>n4BAafyfd z64Y;;CbwISmp!L9&=l3)p&8QB)mONtYb?Ls*>V5P;p>wcR}vnrJGWzSo9?)7_+k~u z=G@wDwx&!f&88RiUg7rEUAmeksEBs;4erwVao-cMnvW!zwD~QM^GYVA?)v%k92a84u|vuxUD%d zEyVO^OXrb5qO>`X_n~#%4E{_>OotRBEiKImJm)vG*bThWedy6h7+^@WaFu+5rGo)> z+(U|SB!LLDQ5ZDQD-*YRGME{j9KX5Hu-aJAmfcg&IURzq>cAo?be=tcV4hJ0*EEi` zeUeH|r_?r08pj#6cd~e{%yZ6^jP!aCpnzEluommJ4$r@AnqdSl)_=PtItz|iELH7U z&{}zVZvqoRnHqxociH;8bZgjbzxSDM%RX1;Vd(|y<&#IaiL@^{n=uy3>@ckHq7AgW zbXaAs+t1md9{30XlUN%-?ti%8_T5idU+1V&!3@=j;0cN%v}2=FW~|LIn7TR6&3xv&!)get$%O+`kv?(~z7p!kIndV!a_w9&5I zN2xxw7z+PoN&S56x3?Om?4CfAZ!ea$Zq@q9$5j7b|E!(uN)L@G*8aN;^en4_)j4bU zcE=jb(X42=ba8#+B&;talF-xYye#bgY`#8;XsEJp`t{E}6Wfn#`9FW0%>j2lu38hX zvgi18(EyhdoL1?52y)B2sqhpQ%Q|zA!^$stH`^_o9mHZ6ELiEa&V4XvjPb;ivms?p>l{F!ovwRlt$%Y-m8!l*TvRcX4g zE-^H9yydH{0LA}BCh@|$r7LUsE3*Ong_gx!>XprjOfK1Wb(eoki*w>fADzz=Rt}wDf0c% zQjk7>)G8wA3m1IVkXf|yW!d7%Oqjgp#j+-?3hKG-QvOysx!!TED2oC(GL!Z-Nt`^U z78K{7^EqxOcJ|mr1Dhh>1_?FkIgaC>`@f!DTw2hK>iN#+BIl_P@}_a`?0jkCN^rE^ z@a@IP`Lc%1joD_u#g_P8DDvIg28!du%fp`!FHY`8k?$W@QJARz$(wfpxQXCV8s>4z z(l&kxb7`;ND%09+T35l!C|a%7r%#}kok6KR4$&IY81Flq%rejo?V|g|e5!4Q zsWgcZTzkSwcj7Hh{86J5|uRfEb?cboQ@heDbq-+kMqs8 z8quaMKgQt(FeI_W?K*(KDOp-6ca~OhhLNCC%mGUEw-xI2!s-z<)^xY4gipwa3zT{) zzoJ7_)bjWF{;uyg08f~rilXeHxXhHj2JZO2>(sh+Nm6}*u9i@4V0I9;OHWZy9?`HT zc!*M-GKFGFVmE*tzYJH}rqDe8y{s4NY+>0XIm^%F*x7P^eBm~^i=jYGms=79xk@Ry zdVLEBx3_MY%f;vSPWj2dg&n!v{);e)`OL`C&oltTHr_WZj2x6^q%|M4KDtOQAt z$abL#kBj%eKozdPrM#|Y1jvt9ufm-N4!oLfk_m=^y=I~%jI5XhIm3ey(HN z%!}Ext|Dl`70!YM_CQTc+f(FsfMv*5**Oc*uH9fs2kT>AigIqKEyPo+*0z*6hg=D^ z_0l-LFiNWAH`Qx`N@O<=^T0=7^@&q4*s?iLTpq1YAfxR|q}!vWdLiYrdsY0@tNM8b z&H0s$(t5OE#rb`XYD+u8U+cx%m}qOxbX_JILC;=XkYd^<32omwMP)kZtusrtpdry2 zi)Y0N=PyKNBDk@?+xJ)j1=aUx^WgN~i|~6Q*k`Ln&*!&Q=3=(fElaLKjHdUNqUnzy zL{Wupqr;3C^`dqbIas9eiiN#YC*F58yYJqf^bdQz{?CUOC;hkQuiWNxsrrBUQDLop zYaU;LG>=RzMpg}0l?ePXSBg1aym&H2wZTKbADm4I`_a{C{sM-aR8S` zy;5CFr^rysp5Ozl(xPd2iK;%N`Q5|HQ$tjPY#WHUz>u>@2GH>&oAv#r<@2K?b{EKDv+rE8(N=6If8RR`Hh0P*H>kLn zR&uafnU}EQ23%&>ma?vtT#7~hQ^i%Q?qGc88Op^dRv(D`))V)!e37zT{wtKq{%wUt zcAQVr26xDRf4^JH|Jv>B`j6-T9;7Uk|2-Zpu-D!7MRUtcoBWuL`(;ggEv?-A*!P(8 zD>nespG-}bnL=dOH@os^*YyZhd220zK`Lhh{-M|;GkFdI_2??*r2xXB0P^O77bwG|Wj!n4Po}r*@v<(7dqUaQj^H+LK zSmbN~!;#G}@+2`HAx74!{C`h9IAie)I5RCZNsyp0*|R*yJHF^&C@#?1fb6cxyQ2$; zsF02~qN;8FTJjxl@Rw+tzxjjlsIC9xU*(jw=ZLf)nkMG%t8|`u@;Y&zc>{9gJoD5f zai0CJvjOjjpgfgudVC@sFA@9?43*>22ua(*3I2!UO=ZXiH=o_d z9qWJhpi^J}`~Kde|MwszO{5Y?CSZ<7nk0XHn;*uW$fQYsOyt-m{j(_^p_+)|AI_~! zGKnH<6PrYESztv2lpp>c1n-0Vp>5VT2iNCl|KT`LBqbcA!y%fBmPOV_^Jl}{)J6qY zoIY=5*$g*qp1FR^M*!_95$%|dvRzA)8_3psrhY;w%etDUs4N{s6`U&oXs1%N<(LS} z5vfT$PoAj6tZxr;Z>EBpKW%7h^W}p#hrBiY6y5wU{Es=1^2B@gwAAB%ipQe&x^ zUWmeN%l68X3Hi_>BYfd+&AVyjp{ysMT%5piL9-(N<(e%_%FSAS&5Z`sVXDSl(7!Cd zZ6Z)oepYG>x}u+DNbDQtn$)+jnXe9;ob*G#0+`J;16sjWdIJ?Qwlci+!7a{fdRJD| z`({18XU@|coJD;_C&*I;ovz;`oh+%ptEEXc3Psi+l29W}+MAtCD*M{h-qe4}%jd34 zvg>hd6}P`SH$O3d?3c+N`!#aMHZ#Z86-gs?tc^Eqpb%X26EZ@8U4OSafcCDxn~6^g z4aIBARE=p4y1BIJH*B&l8k%R&-t(>ewav}na*wd*`>^MCVb9-zJ>7lL;vdzy_F`Uh zFXeEXQ*Kyf2<-jZ1N##shUUXWi{MN%8V$!Py0t|5MoD%2x0j5Q&5V|fWh<(t8aC$S zXs`v;{6eHUdU=}jcL`NL`TqKJWlYM;oHwR+NTdo!G^e}T#{xK`Qvs}MO~%PWRDw(Z zE{@JmdzbxRPG6mvgjdkc#<`gT+V95jD51%n`m9v2$~qq-WV0-9qysQqxMU3L=FDQ-iAB-)0Q z+5cR?kQ&8D;-{XQ-ySQWyc|^jyk&Lq>Y50X;AEsF z(0W836GbGdh1`Jwk7k-6sYDv8RG1%Su)pJ=*_DX_ledab5EM^n_(VQ6?}jN9C{<2? z^Zo}4b3B$MWo`NYDS|&MtL1-Z=U}(K|KoS}9^=0cQmg>UrGDkEFO5pqu4OpJ2{Bi# za}CiHJwzI@X-j`{Ur6j6(_XHrBdYOZ$Iu3@{B zC8?_4M{eFoUcr$p^Ks*1a)~u7Kyn`S#xqGn66e27kSAEQN^wEMNg6Af#JKEgIoN~% zjgie6h#!>OsCr*{a=ZP>Tp12&OzWz;$(hw)%QU+h6J?VwW;2UQ$WdjR3La>07C(?l z661DZ1GG~{O?*Jj^h2xuxc~wR$yefZ#cug(95+7(xr*0I0dg*%Xn=eI{)m%qNG3Ek zndDaSVKr3Fj9(0tO}+`IHrd=;@50+QpJF0akqDK5m3==V%SLpH>@JS21j-rqQUfjH z*N}?ui(v~DM@-q3yyQ(~vv>uUn~o_8BEs>k*|?z?VUhkS8}?b{S_(PyubTR}QL&~2 zwp9OqI~7~{?cP<>^bWAOIZ^`r(e*65W9crdFHeSYLg#PHhx;wdB`!HMmhASz6?xx< zymHA_`de$|E(>QoP`KmK&i;<*ecLu%~%D zr4bqllR-={91}+6#QfwAWs%A7#YP!2Ii?9rDKSe-U<`_kJh;?2sRaBprBf24{b5D> z+m9?Vzv+`_!8dV7-NgvWAf9>fRhH;N3$3WVm;3e^cIB5*Qmb_0N)eEUj@MfK3*yWV z7lK}MQCB$e9jxt$DD0(!n94CmEA8030CRpG6J-oH>s<{5Cs9bGYA3p}-8}p{I!$-{ z^=#U|knxCzMB#{w*(y%m4Oy0n|7D=zC<71Rci1Yis;w2w)^_C?NPDb9KlVIN|BLMW z)*sCQ@^%t)mDj`jAJB*3a<~q&?*J=v`t0JDDw_!-@k~;w`4sZWBxMnf4>3vw z8rCu`A|}XG1?*e$_cMHx`wH=<3~l0EOSU_=-+GVXu{@T?@_m;73jhHB{|OyJGyskO E00f{+Pyhe` diff --git a/rds/base/charts/all/charts/layer0-helper-describo-token-updater-0.2.1.tgz b/rds/base/charts/all/charts/layer0-helper-describo-token-updater-0.2.1.tgz index 1b650d927d0f2178cad20c22e6bcc55e926ede1c..68893dd577cc2ab24326416d03162bad9555b9c1 100644 GIT binary patch delta 3033 zcmV;~3nuiZ6!sU8JAXTWZ`-(%{ac@6&S~-5zFL;-{HlNg*GqC}@!B+qi#{w4cL6Pp zY;Gu0OHxj~+umnCkd$OuwiDaCm)`Dq{zz<+^Mk|T%#cGfGD8`3C&+S?-2_!E=}2_7 zxJBMA@`PxVy|W3C+Mkh(J=q0jGhv zs0cQ(n{F(!OmGi?lMExMze>!7qFTsV1Sw@0^?JVFtGlO_1pgKIp&xjTdaiBTTX=^o zgV>lPq(Z_!ihmJGjvAFW5r)k~>s&>>-re1uFHs?p@uZs&O}Yx@l*XuhA;&$B#)jU8 zqiHtoshHwO_&FbYw>Y~KGO-$|u)Ho9Jg*BCrfDfP)A-mGoKcQm7fL;OU8l}LsXnEJ zBxCe4Lb)cCqqKZ5Ba}suqekgZkSg`B1*hGtK(0(vf`7H9-AHv-jBBJJva8anyY;p<`4!0yQE1qvPmxaFPatG>HkGgu&_PG#s3q zoc8;#!+#M;`=^8?M@gCnL5lr;h&ULH1|u9Lr%4zFVf;Gw#>i0;jY$NZe$XFugMK$S z`5Xq(Ac&3z{_E4=8_U$anIB8{qS(N1Y?{%Mz_ zO6EK-Ef_Pd`qLDpq{*gfo+q)+^Zp!+Nm64n$938 zjikm0!V@!qA(04DFKwn(&$~8be_lV zztjq3!9j39KBZFd47pZtNA(04)taHDU5oMxR1r@M`;U}Uqhuf6r^e185pYNN!b}=y z1$VR6R=89!ChjO7Tk0l5SFeC1KNrgOXNCdC7?mP&_R7v*VkYeD5#mC!8H^;cx_?PE zO8DDc*?;p(q8Zgz^#=eD=S2iz5M<@|3^QxYVgK|aEvNWPfof9>kBbC{$S~GIMrL(A zEtmY3|q=-03~zZjlfzyG&SH*c@r-&|atUwwLi`PrS2qF%2w zu*$Nc)1XIk+Eb`Z3eanw1H3U4BY(mS&3d>8V0Hn$Q5Z|q5p?$9`u_lI6#r{)-7DRx z@^!v>D)2!3KO6+@{J($P-{=320>Ay%dkIsTnJ}bn95=`MHfd(6QgHh0vW^ zQriR_=L6@>?)wX9i|3SkCXr|aQtQA(_!<0C5JppqiAf-=+I{bz=w@%nYoi0R1PVqN zlR_aVkzwOj%q><*ktGUDa(`x{5ZdT%%r4~l<kb$0Y>;z+THA;%5Ub&Nz+=B?c}E(vv$Bn_QKSh(o;LP=*{LP z*^skVlcVBaI~_XYTGoZutp&^_3uc-RA}4Y=5k}aRlYz->kS@ z`O=KsD4R3yy84zxXYE{@OW{73ch>ODoC+9;5jubGK@Rh!CAQNPnuO>aKs2xa^3bwSC<)d6_la5=$iw>{*TJ;T) zA+?0^4Sp$v#->kPNq;3HoQyH)j%JH84c!q5mVJa<0oMUq{6sRgvTu#qZ@=V;$Oz>t z{gw0l&~j3)wZvQ8PicVr3%EVw^pcohm1*f`)AdvwJH_0A}yn z3!UfYr125u*k)39l4^wKEyww-&caO2{i1dgjq3}WRvW_C7w7MXH}5V!TwPq>y!$l# zT*}jKZV>HAOn<2AG=tF+rK?ZZt0}+ws3teIafxgrV4AOME^iuMwV^J5<>)qtg+arMv+IjRf>i`7EyADQ?idO`+Oqes z32f>A6U>>ISrghk06bLxIX(&6{(o>3?EU{^K-2$|JbzccItZNCOT8irY<=RGALxDO zUN#CC09EZ}YlhVk%!hA4d4gQSp&_Yqj9qQX-dC#ykJc^x<0ciJB5;`K)F$=x{Z?kJfE2u6> z?AxY_NPl;3UCl#&jZ=$Yhg3@2?pDuVLGG$i^lKhNOrJlm2rgnGpZ>cPS=4CiLR@7| z*O)eY47j;v^K#!dXt@+$XItX9_>6oyC2~vDHCbK-3uVMPG>xF%QB}ckZWLjEuE{0i zYZkHQ!xlS1$?xFc;X!Z$Fa3~c%Dm4=~qnLX8D&FK78VA27+5m zBYzU)C~YC$_x$tWjX4&fcL3!D?U%D5BvdNTA5-14f1UWAKl)Yn?BA+kGVYl_)mJs; zy*Z%~iEoSC*1nYY(pPu6_tGDcTkoZ>v)p_6-`)XyA(Dzh!Ta+I<@vc3KVz&tpC(9p zZk!Z9d;V0#BEjCD=E7@EM}T|Y|A&5fyv^(T zg{PytKPYE(B#E4Pt+%B=T2X&d*kS)SUV}8Q1MYbc^1%Kd91q&(|Kl*+|NiGuz|}mj zQ5TZi@@+1K3A^qQgW1yey@7zWk04C&_qFi#1ltcHp4!XWrNZhW>ADbKy#c)}3xD!{ z&CIX5nuDu1p(}@1oeTA=70qorZ&r?K)}fwiGH$UmE#E+kp_V3#YOkzEa`JXR!X)9)+(jh%YI-(f#Hj{NJ%5|5pvFrHqXb?o!dq{kplI z)GA-M%295ry1A$6EXdOy`&jXRhx~8r+n@*Ue+KQ}{|x$Jf1m$72JG*D9=!kYg{0%Z b_%+ZT_OOTlhwwiE009608qwy`07d`+IKB-6 delta 2566 zcmV+h3i1TrbI?!M14-7hNn4cL6Pp zEN&=LOHy{d+umC5Ms)(4 z#7&UOvXp`V2wGwS?W@8{YG$OGCy+CaNxvV4{r2;;>A}CFFb*T)wO7WKy@J=sOGs@< zLM|2jP>)dwG=Hc`A+4Fhm`W%8{%kf26>6j^ErN_18fa8gmZA=&n)C@vt-cLwvvShc zDZ{Z0D={HAIG;(CIgd20NC37S37~0dOBSB#JO)y5CXfWM@DmBVJBJJRX(JV#ASo#m zhBAT5*};-BoCK~TJb?evFh0D6 z|MC6~|G$K+!}}wV+5+`}WNd=kB%ljAI5 za7<}-kbmWQ6y-P=#E8T3csRy!cAUj=6sIp!GC_fg8q5;t4Whv?hz3D)^gfP~VU!#U z!lPK!#5NB)IX#GzquTejm06wt(2l3It`ug8Lig)Y(OUNFaVoqyr zz)!NHRGy7oyCAq;u#u4L!TW+~U>Yd=^y=-KAb*#tq{d+8putu+#gtQpFr|voF-HwX z!Wf~VT4M%G7zuM(D==7AoEp?2AqpLXIFYq53B-i3l1?yj=rdv3SnTV>Od#{5VT*1^_wr9SB@LM)B(FKQQ2lO- zO0jHHnnx72Ob_6<&jer(enhBsO*x-~LJRFEG7!?(xziPa>t7MHf@1ux3z&K7WcR*AkdWmG!%}bY7(XzcLzBEkFuDF=a}M z5{1z)W2OMkjN#~Xw_SMwx=ssg{w)*CIyr>%+{PJX5@uAajHJ`77JjtGbuO2j%NY|B zr`eGt#HEK%% z`rUm1nQ%F#-0Ezr69Bsk*tNz~p?^uBw@cUm2eMKAZ_&EHfKwfsYI7>^K>pt!M(g~4 za5&iU|1ToH{nmdDQ&!qEWLzG%+xqWI>z1^@1fKUlemVCc?NOtCW zrCWEfQcRc}df({a8{J#e=Iw5?NbY-H3C_-}TOe3${_TvrnO}sFuYct@^J8bil=g&PZQ_2geP49OW_Lc+my#3-nQ1-*|{$3j*6BC76hlcBp z7Fg|bx7`B`ZV%_rW>H_SY{~yqDRMR`X|>H^;KTR7gEjs?jDH8i9smClvU2|$lN%UY*)AP~w>$5kPXIIy+-;Lfc`mjAh zO#6Dz;Y|lsJMIeati5hwrPAo^HcfadOHYlF=e zEQC+MM25n^zE!C!O#R)GJFnI&h}OM|^7eIep6(E_q$Vxi{DECM^j4Y$wy@H1x0OHA z2geP#H-6~k;*|re%bN3%19ROp0a*Xi^w2A5wps8A#Jah)Yz56BiTiC+qa;{HS9g=& zwrRWIs(&<2+wN2^yhGh(=hCmc4YA+C<&EHKOBB<8C|M?*q5#r{IbC7i{bI$Btz2IB zZPTn$^5cBVHaqUjBtpl*KwqU)-X%4pC9a_(Tp zXGSI_FF+xuhD{MFYKl%d6&cwBffE#4JkTIo6IANym{`&5daQv(4yT46AG3nbs&8wb@{!-DHrZ;uv z?!Gj69_m>|o`++4L!O7GtjP2KkUjW76_d4w^V2g;!b-`XF*PJ)8PdM5r{vEhoa$6& c*x&7acCwS5db{zT z`zI+Rp&yV7%3>d`cP)}6#iQMIJ=+Q~!8pV?peTIH0TNLnd??qA6R^dC#TGzJ7U)Cq z$T4ApO2$_{OlgFEr{lVvqWU`T=YKr6>v~p*BH%QU`rQ${!Ds=2T9Pnj9DYnE$YYc! ztT|KN%%x0(-+$>WmrIwUK*EE$6B0=rf&7{VC|t&89g7AE-#uH?#jGO&iWBB0@yxoy z)spd0k2{C598hqU139F%AT*YQ#>jO`To4-hkf22F&XEf7pJ_~;MT)UduR<(%^+wfN z=6A_aOR$s&hTS>gGb-ol#0}V@GtvY)7bm02PfM;6^nZaQNkjvpm}nIY_S~M^v)bo> zP5vVmTz%y=c9;D3y8CPLzqk7+{|`}`;{Am(tVDR%3h4}m^g+zYZhzlDoOZqa?xcT6 zaJt)_OajuI1YZB(aNqL|@zC?gK_3tIrrk;Jpz9sr;qK(1zdzj#JhG47@W7g3jGRae zeXw`E-G83r?KEXUKQSkOPNx435!utx7l}Sg-i&S4x9SG zLx17Wc*ao(P5VX_b4NPH5h@AV- zY3m}M(fFetqaqu*BVw8)D1{H7bOV5h8GqLWI)VjPC{9C1_!}9~@xawRYhA!btP3Xxzyrz;3ErBpxz zi9^*OLUN5Dl_DZa5d|z30cEMssDnA90css4=c*gzuF+Z~5)5b@aHRu;3M}Hl{O3{t zPh(&)V0=wEix(J60ZS_95K$>3)PJ}OQeJ{cgSqPd9gV3Hco$BmO0Pl4U`gWINGf1y zY(^_JaZ?sWY)Rvp#vajFH6h_IsnGQc)j^B_3PJelr5?YUX+3&`Amz~tCY)&AOeJ!7 zTC)17n;~6Lsl{&x0D>g-q3d~z?0JC;tv$QDuinvYh<{5_+!w-%S%@QyFn^GY>)Ev= ziyjPyRt+v0d*4qMm*fq7I!STi5a{S}qCpFyOo&|6+7#&}net$kb z8lH{^XD7q+)3ZyzAqFOjoqw}|@vGX=0{HNLFg_X%$KM}~2IKb^ZMyQeewCh*%oBntz3`19L5(+Un!q zQWB}(YQYK&SR8_~h`^?xflg0=#svzE7vSjR8m+oA+Vpp-P88Q&+j#+eeKA{)0`ct6+3SC9(j-@F8B z1V5Mhz*q+$AZR>`5PvRCMxduN4m4X9X(VY9AynsBxCKcg?I1xwVi0q-1i==V=@J^0 z#IZP98FE#9&Jv>~H5`+3tPDmn^G3LEqKBhqPcvU3Qc(CYz(iK3PtTfaMucjaO@BtI zVO_Qu4C(lhERqO+SG-cVeb_O5XjT^VENK*}J`}C7>QAX^p??-eh2;ez2W%}~T}L?{ z&fhU+A+w8WL%QmTL{W3(zp5vepfWEQ2RP+qflJ1(?8=bobd7<^{Y{m#OJvDGNf-Fi zJg$Vqg`p~2erg)cd{Qo?F?4f`^?QTVRm&p7FXk+bLNy`+BAp1-;-uhTnxQYLK%f%z z;AlKkrgcu^nSa|F9apS(;gfgH&MyZeSALXVC&suV{@Xp+?=|ATz5V_D$N29dO4o%y zqFJdGD+TW_-oj+1{GwPbAvs5ZIx9qCWlwHy9JTh{4<==h1pqF_N-2hLd#hV;63@^$ zxZuBDYpvc3)fS*^?WzbOd#en<&5i2lNfTB^s*Sk00e|H@-roA1&drVKO5=sw+nXD3 zOYEkZ)%+PLS(z%eEtPTu`;3LC0wud3H`64pim(hm{HT-zoSmNx#>4ZA%hykyDK9XP z5zJ76<0$1S5)vRNA}&ne>7EsDZ*Re2@QYxv8trTQ##I{LRanK(-e27~BjVOB^_XHr z97Jh|nSYA%RB-F&0ivx3`@BKj>99eY!YsasLMm~gi4&5@RJbbKKp{}S%N}lRO+YYb zxmWZgBg21EaBBnO-!c+@PaRHC^~B3etI8C3mkEiY>t$eR$E)!rOUa4L&BB zZ>nQI<3giJp}1Do&Vdl8G;R|kr);2eJAba(aMTi$3x74&37@qUO2xOb_1K~_jA_Trr)(CSeaWTHF>(42s6LgVll1s=EL?m)(!2A zBdRjo{LYSXz$f6CM9Ko%f3U$G+kc-YR%S?gzt@l{wvuU@7(DH!*5Blql(yEIW3+I^ zyrT!b5g=oUhS+SK{WX68Dnep-byS>sX~$J;b1PJ9AfMoGDU;X;FV?XvNK9rJI+InM zrjc=YU|n_%H%$dd_7hn|t#uogYWrP&YidGE9>O9*5Y;5F^qqdRx zri9({UcG)^@2nj4vxo`_&lbpM*hZ@%?D_L5A95e21>GIkp5MjJ+PTlJbw%UQhhr`G z??__hQL0}YRb1l4sD#AgHpsY@g5?p5=DLf zzYR?d3ZCUoQa)$eQ>rgM9_CB^`SUu!J=%W)$^J`d4?q+yKz-|Q(}2r1*?>1}E^dNv zZQh0|-}b8D$>lEF0d&jFzN#xzZY&n~^yXsD%q<8rOMiRY*!av5{%~=Ab~!jZsc(O- zBP^L+Cuqa|>D>r^J%6CtfZaH&)n?gjtZ&b5f^N3V5Gb+LXAz#Mp!}VZcoj!2Ih9x{ zu1qO^Dq=9D-k!Is20f&U!O7`p{ATcWIJn68p=G)Gx`NW?7*gSwRpihcL(6XZMwYhNLl@5@fzTAK|&nmd^395@+ zBp8^3qT0-entz$A9xFAyi2SUQcBmFa2J^R{-SNJ`l?zLTtHK~vK7Tx~a%VXolPcFN zN*5^nVx!90piuG>L3nW;mWTmpIUu>)N`#tVXkU%_Arg2k@hi) zr~sf@Q&OOijO4ZOI4(_~hew8^tSm4A`zv&O1PKA~+X2Db%hSUE&o zS#`S3El(KNAUI_L()R#*bSf!8`!VpmgG|9_FM;f_$8}<2b{Q7bb~$6h&bFUx*QsA zr#oZGKP2s@vyG=mYSPdo)+rTn3#o?CMYhlVnSWsV{PkzT7+J*l`kL_11g%E>dC|vI z+O?O8s2X?*&1|k8w44wqZzrtJOv0ID0gHUNJRY`oxj@NjAh!2!-Vy(Gdk4+mFTkfw5jTEt7iDW^L^)zz)ReVuC!o?SI&g zT#f!)OW(IIt@=Or%pOSpcMqE9|NH&^WB%_!N^34VJCRaT+-nX`zDOzxxK$%peVw}M zu4%D<#Jr-pRNWS`6laqw!H|==*;@`lXI^3DI(8*uYKur3VO8EmC7!7wt2_9c@s;iB zDbX)KvDFT}{S4N(Uiyz^lm3?|q<{JA1jTjtFSiDF=znkD>(}-FuGc$w{QlR2lve#e zWMPZbZr@8eJ9^pVU%0Tpnrp8#jGZ40oilc2`=GlLX%MI=BUjqZt$;jHw4CX59+X-C zNh($o_OaMP(6`%s`1z@7`t+}Ps({ag5AgHTdkuff6&Q_?qgrn=-#IwLYk%b5QWI9> z-&NeDvzT%Gx_#Uw|NY&y?|=37_a5c{A<7O6iIm7=eMj8PJ}l=L!z86qNaGnKB)B3o z6vY>SM4D)~2gDqsNT-+0ZYqsuFM(r3B)vu*5LVukIJ9;k#+kWc`Yh2=B8JAR{M~aG z&f{nWEY^^UBuJ3!4`aBNdw((-k0j%0?Lc-K{loDHLdu2Z&Zz9@zlMCvo&245^xyo& zeAZEa@<(wUcS=MmHcbyG2$< zUED3qKLVKVPq;;AZhu}?ZJd7;u(f$!S-aKH^16xVb!)5Yx%wxP%o^RPH=jVVk>tvY zs&-kuK~dgc$TIbYTa|2gTYWk9Mp}HGXRkLwI*mT^@oeo^jml~3Q&lv(YGJ{q4!7N} zq|?Tb)-FMIelL7|l&03KIgL+p;x|J@D3$eCa~UGSO?eHs6|T z--RotvD~~4o12W>Vnywb|8^x4MjO7;3DcN*}&LLh(B1=V22y#TiG zWjk-SqiWN2ZAXgozN{-Xja{Rs+4iCA|3?4sD`tc4%>VTI&GY}=y~q6TgOtbo&z<=n gmvK7#7f%B{mdEl~{vVeA3jhHB|HewMqyTCF06|imrT_o{ delta 4869 zcmV+g6Z-7gDU>FVJAZs_bK5wQ@OLcuBZ)*CdX< z`?}5ZJa2z*PyhEkul?UU818=8-y0714*J7^g6j|Z``&lpeSc*>I$I_r;oo_`daU;3 z{!JQ5=?CP3vc!k$U5lh?`PJ^bo^6GgViIB!P!zu90Es9OK2-b030NGn!~#f2j6RfK zIi^fd$@tobIgQZo^<1}Cc3&6c{Ez4MUC# zf5d{Tue`_Z)Biz#e?$NGb|3ZsTeP-%f1wU572dT%xOPidk1*9J3AQe&vyfl>|;MXuojpgClW&+ z>|Jkn;D30#j(2d`_xyq95BJ=?!C?1r_wex5pS-^BdG?k){@Av+n*LvtC`0it2mtQU z|KY)KudV-kyTeEQ{}ycrPH;}LNP<~@?QHd?7)&L*!elBW<79!ZwF8$+Du4=xeq)P z4u4G+9EH%lZ;e2-=!;;$vgTP7DU*DDjhxf4875dcrsCST|KliAA;#%g&608H!z)kE zpD$33s|O@WnAA~%o-#nnS&VXtnPyuAoG5a(0EV`GczAedTUI_XMJXk6=|it; zh-5*Nk9v-ZZRCzfXquuFK77&u01-2x3xD(k3$9SAq2MO(%(?iuo~oE=n!6t8yZ!&S z0l_h(90Lh#KHuyWD5py#A#!-1E;tDho@knx`F1D9F-sB*G?#V`Z{LZKw>L~k=x9%t zOvr~2_^We)Byvv2Z2}x)CUHu_kUxyh4~(w}4>44qDmn&%gyHn#bY6g{Pn%SgK7Z@b z)bI6b9;8~e0_E1?SVXgMb87+Yz+VtDk&!4`14k7~U=l*Yq_Pzv#emM&5avdy#0HXt z3LrvqjUbgFBFYd2ED-@^nb4$zC8Ggq8zz@(804<8S|kz-XcBN`1B6N}lED1uQUK2q zUG{R!pHI&w#%?%Z z7dwpwBvR_)zw%yr_FcWhyL!Dla1Z;YcQQJ@7+p?(9Q~xGJJ_=TPDYdCi_`DVr$^({ z>FDfae13X%>9^FtWU({WBY!FF2^7jk_3Bv}z|Q3S_{Y)Z>G|}{`Q)<7P5;00jE?aX zLXs%b2>+p&DGugr*B{baHYrnoKIWG>7Q5z|W7~U%r_hzdaqDT~1F= zd^r04xU0)7s1JYr>A&;t9Tm1H#SthaO%^8hDZFuRM5xH;?UvEcHS#rNLd7>Pff~gx zv_3H20SE}1EFy%9lYa^53lZ)y#(-%vYMWLDz0g=rFYIRchFU{0fR3K0ZdU7;b zDA&5A$-?c-j(=<3yNtU6YZ6Uctfx0S066H^BZXC7u-4CW@kS72xCdw#=aC@sEI7t?00$lK4 zZ$PW(Lcs!5(5}iL@~6rH+}x;vp0sggq+rC&4XEJp_J7vz^=@v=P?|2>-rn4RTTwS) zR{LY5bY-s0wp7Lq>@yakN|fx9-Q1G6D#J4L@S`#gaCUw&nvTyeE?+-+rlP<=MzBB$ zj-!mLNJ)U8n7A;Br+ZdDy}bp8!7qX(YPPTK8&_F)S5Xx|dw+M6oQYezvSUgRNf2cr z<|fKh$$za|B#5@2?DH0Pr{flHin9134ynXgGbbdGnQ&FQfkL2umVddmH3Pwt6;aWX zoDKg;DXlGnf6GYtJ&BZ`383Eq|^9a8?gnzNgjlO-2_VPLDfQP}6(J zzz-U+vC2dg z^PFO&(kzaqxPqa{Z>fN1v$dAT$=O7~DsQ2@`g7MhofpMtL!>l+=6KtrVzSIsOn>$u zlvB&1DChPr@m40ikV-8!YgdpR2R7U zoL}RBPrxyaln1o`WP?4mKToa9lz;SjuVGW%$)*7@bh=%wzb!DSe66*_D0aoNrzgD? zAs30p*zTSEjd%cRN@8SnRNi{&rd1wuD^eRMpWq)Elh{fxHmSrUAqxzh*}BQo!~{IB zsk=s+rUNAViNsN7-~BHZx@W!@;dzpY%@2zHP`1Y!T#26`d`*M zg1f8VBQ|DBh1>qVO4(VaHJlvXynO5{9YZ;bJJ z8?e);)pQyGI@jlfPc~6%Jb%;X zs$X7JT;a@^h5U)msyCghNw(F>7wGj?0rc@yCQ@Si}k{}MU^5M>C^JUZMq;R+_7@Rq~HZTOwwU8IU* zuNs{~@A4Bsw>s>rhceZ{Vo6UQE*8SPgJACIZ*N-%p9R4mF3!&`M`tI^NpE>JHS+9n7DW>sW0Y9|K)a{n zKoKeG9W~4Ls-97lHankq`36o~SXI%csQ%PuuJ0Nvkbh!9yGjgh2hzB9iMY1wbe~(@ zFm7U+1%0Qs7=Tfwh;cPx&`X5;SlsTxNTp6e?*`tqGgqwdb+OvB{b zZyeg^-l(2G-jN9w30RJ$3xCZtCreZ0(*lm;0zY1uBIZ#Pf&I6?{pC+~PRA59HA0g{ z#8wZc;eRL^8lg!eh$tpDRV(jll*8 zn9KY>a2EURjiI^t5!V+uZ}%03qHzN%zgp&~;c7B%ji;J67>s0c=@`Bo8s5!!E|T9R z?`E*Aw?`V<&}P=D3~>jmhS4}b=l)DIegFD1aes_1Vsd>=_-CTlv;Ly#YbxE=OJ!6o zI;CYcuOD>W5UAcx*j$;EGsyxL`EYqW?i?~k$!Q?&9`*3>@bH0@BYKSq3NhwvhRs>3 z+5H)1TT=Nu58aHIHzm6IQsk6{6MZdK_|W%iy~;Gx-vJlpi>P&!x^pgLt>T(~<*fU= z)qiqs1O@f0;}uxrLivM(fsJrrW3=KHdWBKmOaIc4V`Gfk)%R+c`hEB>8R=gi|99qp z#Vxz9^eW&z`Cor<(9Zvc!-L27f4@o75sFIN&hkjGq>{dx*f^x<96-^fI)hlya zT4a!?`3rBI>0>qMugL&g@0sZswtWz2xPLgR;0&2&y`)IH^23B@Z7MPnCQCUpa>%P_ zG7`mGD*8HWJ^Q%7tO#XLbGDIHZyC3vX2r7z8(ef%d%K3#Wp1nPKtwZ&F+Qc9-QfX%`+whB z`+ob@Y5$AJ>>Jtt{z3cx|8O{btp9zJ)>+HWZ=^H~_eQ`|Y?7J*?zG7DSf^>a8&>T1 zSXVSJRd=N<<=y03GUVi8_8pg?^Qf@)I(98%>dHu3X;m>qEuX0qYXF=v!l07@e3FBR}1Zxg|Ul^p-aZDY#;PcA`1eQWfVrceH2g>idG9<&V#DzKg+~= z#y*xu2>R_dAAWwSK%f4-C>8L9@Bw~)`k?9G@d}Kl$WiS#S)3f4;WhH#(ti@x^xsv| zrHh1d{JLY@r~kvv6FeXwWPxL$DX7ypU!~|v;jY66%ASJ;SS)eF? z0Z3%24tqc>F^Y6~*_@`*WbqO>MnuwU)CpnjIY~lm2NGPEH%y?uH~LgrhXI2I9fZ9-$ws%Jb{pMVYv$`d-|_o-*RXFs^StW+w%6}HYxny7-hZ&&@Auo!y!Nm^>^=kU z(HQqAsZ>Nf^FA9_b#i}^LK6BD3Q0NhVcu~_k`$kfw(B*V5EEn}vVfxWohFco66wPh zxoHMGjyZDx7>Ut`;!|M4B~@H3e3;M({Z`9$TSfCcNB%#a+jc!CL>UO0C{uR?KVlR^ zpd}I}T)?|@jDLcmLg~!7Ml(|?k$$Une}C@^lt@G{YlcLTrbIEP0ZNyPY0II3hPPvH z8c$n#dSmV;Z0g+M;+~7pFe4x3G(nGZnvjolnoy@sPE06MgfbKc0LFwyJ|w76xHF_u z{%6W)Gft67T@_-%!XI_3V}EbcT1WC!1a`slSx%{%rGH~L;BjkYX4AYr8I^uIYLTE1 zBuOF~5Y2I?SPjqZxLxOK%j%(g`Ld(^k9ctRXdGMYzt?RK*6jbFeX##eQL5(sk>*-k z>y8uBDN5yooRLm{;13BQZ^ED-cE-cu1Uue%5WF7ry1lU%w8wo6+QWXIyy>_QvA$_PdGR`EMz zw^DIIrsz7);bul9PzeNnIXZveoNy5nr7$$6L4S8R!5|_6VNL`k;|L`v4r7FbNQog( zrZ_BkDnMbJL`0!<9Y>(?IF5PBln-skp)r}FZ>-OhN~LYjzv+BRRYb<_{e9|EUNKG9 zJ!^_kwn{&>P~Xia91dmb8Fg25rfgl=SLx~g{ zjuUe2-}(^ofJ8Gcl|$K7pfrP3l);b~2!B);W~Z^sB|_O$k!&XEIHG|TiQIvOKR!7C z&*5i;RHh_~79ddXKgdF0TxkK52?lhsfH0HfVl)sI>JAZ-IfByCOSJR`Tyu%1(tr+T zoCatFU(GZc6s{F@5=jn}1wu=S)CUh1*#AOF5Ge!B0NI=h&SGRr!aY?ph^SH#8h_XY zDc^%kgPBHuP8roA;lkNOD+7ca?g?9&NoiQh>}-`GZo;F8-%~a<&?Cxp7ZU!KO4A-| z1PlX|l8D9kX8r-X8`kEidiN}p%PmlxU3^MBKuqm!eX zquZ(+`QU zr!zFC1mF{ERLlX<$@(?56@R7-pMhWc-dCh_?Gt8X`38X(w;}Hl%@qhWWbYTr~h=_UHg?!aOd`32^uo-` zf4jRRmgp>4WTCj%mVbYCa6#)z?cM|?f-*IM#y7J0jcin)S-kt`#-`sZf>~N|t^3(| zU$3@V^-P3pFXJyiX64QB#>RP;m%;wdLe%h49|9s0AT<8bfW~cOU*n)BYP8!DFCRg? z9cZDid;2z=Qnn^LnnhRJiy20-D`zdkpgqB4Of_)U>7q<3?SIS~psSKpQa;P=qvB4W z9##m?+ct>#e#>l6 zHnq0N8hEG}BwL$}TUBT}ffa!EfWz1s(z`Vmw(3T;S4bbuqyU}JME}Q5&zP#88%6hP71H@{_ zouF@s`D{Q@+q;VAG5WuU{SPsT_`;C0-v+QP{?qPstM-4`_73*{DN5P?lO&O?ViPzi zmb+#b*njINvOL+lR#bP|GXU}nn7xqY=P?&P0%ajG1w9Q;CK%W|C3D*(S5&Qh1!Zx| zJVb3YD<&$Kz5hbw3@nCRu`&!L7VGk*=KeZ24*C26v~z9lDOLhkS7{WDj6*K-Apq5u zoH`36KXbuHU{!Rbvz{H0MMzBEQx2rLl&112zke80kYKvx4BI`D=hlF_D&6#z&n3Fe zU0wsOjzl*1OP@L26@R4E1MGF`4}!=3N_Bqw^$r);IH|Vf>c!=x8AMd;UbVv=F3Rmq z8g3)ZItpKfI16r-kyW%!2y%C`2B}3EXIGee4od|8u-J2qJ=h|f&xzO{Ze zLx1vxnkki3U=@n8auHiDiQtL{Jo4e@_^Q+v(K#}d@=EYAuHw^p{tH!=?u4kB53LxL zpnI9OIer*zp+{f~evb`#detu27v|sJcQt{X9WcliH z*=^-Qb7%XwW+B(G<+q^A5yideW3BKSj(^hC>k>`*KK3z~zP3wqD0`GW{Qt}b@1F{` zE&kK4=Kps(?cpK+>q$y&{3naKulW6Iwj&pZQi_l@29=zlQgFWFl2`20U;SiZbE`@| zWzHepVDXkbfo8V3)%4d5C39TL$|~)Ibxy#FPqBJ}`O;TY^)Mg4R{Gkqekki@4}bfw zP%8VkndL50&UV=iw&nj1y=wk%-)nac_WvnLt^L2^VNJ}Z@foJMX~ZT^b8UQS6I_$1 z+Q=`@XPnJA<|SfA8@A z^GV8cxFSlSU?x@Ht~1=vkij^mQApVo5)#~zDazsnfJ_tP$bg(-6q$&LjgV3{{T>8H zMA12#lYOb4u+Vu945vm*;oC&ugnq!#dX@k2oeP&NS^#Heq$Ww9^G%Mk>wmZ>quY_< z0-fiOW$gTPJc5u4>9|v>TIR1M-*LzP7A^BPub53+`cM8T=d85^G$z4anwZ>2>AZ5~ zed4@w$K=j=<*GPwUj4809DX8#@>Igv$*FYQMDX7*P>xGOBrV%d@ZTJFE(0E7>o4T# zY}J38?4CXOdfaR9ZTjEouYcwLc6oZ4dT&g1z!|@bM3jBRUpDES$>Q z!mrJ!ziHW1|4Xj{O4q?#9t3RB|L&mcRsH|o;Nbs1NwG<=*Qip#OfGLCxZZYcGP_pk zhjQUzV=}zn{9VOeHN$FR{0ox{zm{pc3cAS3&ffrDWZBtnfy~XD%72~nH-WX?^Tw4V z$C~OYoVT^T%E^i^6q#1g>6(wA_(%!uMU_!5Ge+~!`LZ_SR_Xe&u6;T8m3vCtd6j2x zH;rsoaOCrO5U-w9vks?jsG_Q2!6t+cWv0_fWlC#_;;nC_|BY-^x>c9)MNa$!sr5OS z2L^6Sx6K9FX1X3N4}Yd5sV)ai{kK+)^2XJ>`7B>{Ey|j)y1`sRFfn9qLjhx zzlBC^_H>1v^{pDi0}S7sHND2{QuEtw<3B?o|5SmhFk`0y4^i;tVct9ps?OHc8OmK* zx3n~k6?&?DpKAZ#)Bk%^G-zx5r`xZd|N8yI`_CsShxpId_>ap4o&L?kK!5MTjNj@slt`wak+qA01BoSZYg5nebVu-IJyiyw9u2qSZp?Pe;ZZi*DSiYW33 z$C4!YAmn}PWJ;v==Oke-o?3z+2#&g4`)?2g^?%zzulu6i?SJ*U{dVur(6#%${^1J< zo-A>Pk||B(i{Oi8)d%-CDI}#IP%0{T2(yky(zN_+wEdvr#h4m7s z*iADMNg}uhz)6B3l%En)p{N#e9>SP13|lSVZ=;kP9< zO(rcfypixzKJo5x{vc#*C!^@)HNo`rno#ugny_v=c?qFh6UtFq2AB}aLP$}g^ruLb z`j3p$W|ARSrYgpA3g4Ml&;5RE*Lq51GI9%6jB-NtG=CfUkw{uYJDTRr>9F$C)AJNV zAZf~IM9hqPU*DqV*KNHdYlVv=D|G{DVXa)a|+I#$ej#7vBC&INs z>y8)G2`U|envzcMDC`qL-o#Na?u`2VF?NE{QS|z#d)OTXQG3+GsNL`N$eYgLI3jPl zWb~#tI)ChqgFa#u1V{MVn;=I?G{zw`Izi{K8FZRK|F#{3he6ou`fm=~z5ZeMsQ1sH z9R@*Tk5D_8NB94Xung4~Ie?Gs|IX22e|i6Rf}p$K|Ibnm;1tIsV;bB-TffR0#o?V6 z_sH**7LrWR_YUB8N)=EA1b#lgyl9SvOo-MPTYqRU1g97=A`xapQZizwKnoZlq(mu< zfpRTiE;0!klavvS%J)2p*5f!48P_4SJ&z`2f}us9302x)&mVL)p_-AA|L~CcRMeo! zxo1rot5)TwG3vXu?h$|{lMo~_B+9s0X~x(VVUtR&j)7YLh2A+2X;>61oa@VuvLU}p{+A$CjuaqB0)XH%nn9Hk{E^!Ei-I* zUM!4%8v+v%VN;>BNBKmevYj={c_@q|>VGSH(zxZ4v1)3jnrSv-G%_YpII!^NXAj^2 zenQApMi`reM05TikAVwq3{0gM(eWJO+>*=QKzM8j7?K%+Hr7jw^+v+XlE{>09Zdy| z&>Fs;8Zjt+XX=D00hCA5Scx)$2anvpQY(-d2f+dPj7q^1HVgV0?FO8(qE#q#q+A22|jEM)zCzd;-+>ns?w@lgg#0cOR zp;AQ7f3V}1mA9!c)6JBmwwJPq1vw00RTj47D77+lKeZt#O}Cu z=k+DchxmJjYTF(j7cmZzSwjs%%qeee41W35^T>EiIn{I5T$x`Z;`sFR=4?1z zL~kUD400%6qtd=mV+Rk%gY&yp+LTtwTCAj+-OmUx}HPXo?}cYJL9f87lAWV`}kqiZ)6B zF?OJ014J*UYZ?@$9HHSX>wj+JA?zC_4QMX9S@8BbOX2a+J6k+%)EjTMkG@R zN+ejxh`BWyQ)ICM(yw!51{;n^%!k&eqrth+rW%|?Q)%!H{0r+>HO3jejeC06t- zr^s>fZ`}O3&ZVwPwSPM+m`cj^7#jaj&3~vyjhmCZ%ih@Zd&w{>D{l6F9`BpgwyU0- zkfXBx@>5pcc5iGPXLT9e?>t2fpG*+INQBV%X9F5{ja|XP4Aky!r@VTC@~)%fzUu9} zbV?OXwuD9B;KdYK;;U)PPSB2Q@=3LPR`sG>Y2(aVrpuO8*?)X)wvWp@f%Uw~B#>dX z(&ZEUo(YXr_*=^*A)HJwZjR>5It^X$0;`zdX5KY`7C)1Ot!>+2=DRJki)_|nlLL6D z0g|iD`z>#1I)*7x?{QubL!)3{W3sOI=g*BYylVW#Cf;Fii-7De2I%IwHoQE%^EFcy zF0ia`wcjHhR)2@`tsSKQ=Vb@~KN5UQCkaV+O$I)8|J!eO>;8YYf3)}ipQ9|@|F*q* z%Ht4D>`Gsf)Jss4m}nA~*O10igc>_z$ZJ(f)*U6b8qD4rsa4YT`ay}bG ztfj8YdCLCZ0smu6nV4I3b~^wb%m1`Hhjsk#w}U0y~8w zi^$%0rhmHCnE_B-!0aTfh{t^R1eC|fHFOO-m15-XlBU!4=g3JYHdZd7GR3BRt+Br@z@ZpFfN`$vJ;hSuYLGEDv<|r{x&YK$3hf+|BIbfm z!0X~Fv7YOYXGrY3r-DgyVNKO2zwA@0U`dJz+kZZj=dWQksND2b;}X;6FRlTXdm^8O zmCr)&nmidkHmeMvR)hS0}i~d9}Ss0!l z&aqpb$hz1jM1{M#MyL~+5PuI3sS#nh|iF2zDkwN7ii z%72ZrbP-!EsT5j7f`xE_s23ZY%qP9llvw^pHi`&jK##j6tZi)-QqeziM`jlY7E)vL<|+0upP*7&%B zkSo%PThK+1@?P|*D7+%0a`n0pQ@xLUihrbU?b7Va4rK@bKgZzRpMpJ>|7q9X|93j= z{{H>fvy`>@pFHQjR#kk;VunnElUwlw zn)%_jhTb$(;JETCt8x;qa{`upiscCAYhO*R=lR#yO5fVn_hq&0fd3kmc7L1s+kZtW z_%^4(WAFd_LH+%2FKBo6`2QSbE&dNgye8+<_yTBdTC*vhxi-Ew1h09h+9)p1r$XE} zLa+*`EQ(O660++_i6Sg}n3Pd#o_`o+YCaMl%Vb895HnN1yfmaQe=R(8IZ+|NFE77f zs>01Df|VoDSgbB`7*{w$`E+P~bbtT*W*+H;3yDva@!0=){y}VSqGCE}nLov+n(@|x(TGI%S!&-tD({uA9#Zd>KO*xTxn4T^_-e;_0qYrNE(7$IDGLmt+v#+^%P96q zqGDUFB!{NEd;j)3lI+BG91>v5cKby?KqBcpbfojpk(7wckhh(bap|zTB#2lRwvHx* zOLs=%=$p?`JkRrXdp-T%^St{1w&(4A)9&^Ay}fq7-*128wSW7acIO-LJ`43VB@>eH zZ@eedst@ifDI}%ukqgQaAEq6Pr0M*t-F7|O3Nghb#3Z07e9Hk6Q6hY3S~pI>;+Q2C zKtf{lVg8k4$^?~+&wLos2>n*ebzAf1X+iOSJ-6+8R)`|tG?lvU5PrZYhCnSz7%>h% zW<%r&N)*Xv-1`6MXy=gpdiGbpe zxoI-CZgF5GV$^Ls=`~NJZZr&ehxs~DWSRoyw zkUoeB>GXH~(cA9+ei-cTzU}Xky-wH;d!7CMUa%kR?+xE#FX#mO?a{D53c{ej-+4Ri z?(TNlZ+}N*w-@Z~4MS^;334Ja^ug|Uov!0`9B=Qs?fG5L@AutayW89C^!9uI^4h-V z*;_OA;L@o7Qxat;K3f2|M*lm#y-r>Kd;Ptw{y#@~0mnEZStP+sx(>0-qPS6u;-**> zuJr=0CsY6xK;W0dcW2Is@t8=7p*9Vw!!ZUC;eQBI!YLU>C_pk8BBVqJ41p$+!Hi`b zB*tk(BnsEEIO?$Eh-HcNp>0_-CS&xq^%+wkmF@YHPRCS6Wa!@AWiDkk(_|twhliq7 z`dH!L0+3|v1IGx7Q1MopMbRaTXfX5PFuEf%VObFwVk8u8lBVwMJk)e4Q&ul!2`VO6 z2Y-%@kSS5xHBxppNidL%YyMXTpIZJ!_-E;0@M4Ob(-3{IZEKW8QLVB`k8R7!(W(KN z81N{{RK$6DsRY2d^kLuAqTyqdmwAP*B1yue4i>dM08-9kloQPKm_)#dLTF2#p>0_q zQ!%d(5erB(VM1Co8FLgGSVlPxfdNN(u7913nJFF$M@GU)vtdL7%fe(zIZI+CXA9u) z`1tB%Fz~@Hf?bJ1IwVx6-4JaH;P`ZKd3N~A`Qf`0Egpc=^Y1Tie!4o#zy5G?c3Jv* zdUSEFKUy4%Xc|6zvH)Jd&j^{wNEFS0qw;f@gpe?)7P3e&praXtxyH<)fh3{o5Pu<= zB1okrL}^LD5)n|A35`0KFdCp%Fga0Vkh?~uNF*50B;aag3bofs0`s3s0X$29B~TKK zfIBKD5K$>3)VSxYdc9Z4!9DS>5)8LiaJjaU@1JDQ9& z_J}5`3kiSAgl>-&fdm5-g7DdQdVl;JW2Q%s5M(@>!H^Rzn~_8gFBhVI>E=jdD)q8> z0RTao`Ox;fIR74FtTnsc*?&j#A^x7B*c8G_Scn6Rw6^KlwIqvFG@%zX{Q7UpBBK#a zsGOPRam0os^7DElCzHGlrU*KK!e z{(o<`?QQ-4bCeGsT5n)VV;=-c?Z=g$IEa;4f(iQYruFHQrFvN>f27*ZO;D=@u#r)A zy;-#KevYz^G{M3n)q)5GXoHh?O*u{E2<&f#^R2MqRbg0NvjJ6Z0^Ii|7%ls|*YHYz zhmR@>h)957yEfR4U9RzU&424THD$@wXEU1bb?~w@8XbEW>mAZS84JQ^n~qKc7sFEq zJ<37^+iaJL)>jHI*!tTQW73`v(a^SyAzD_j*2kLAPJaGhUFg3)KLj{G>TMon5o!Mi(E0EbGwG|v0!6I!}|xY>AEiuaxPPY#l12DH^4=| zYVAFvX=bn{rz*CcWPf9v`HEfjxw4W=OGH_lJj0-thh8T6nlrt0w7%(5(I6{rPet_R zbDjtLvw|GNEJ{(rCIwcESf`2RVIjzf&a5GoX@8WC~7=~BDn#>P2#-l^y~r*yCiz$u|! zX`|>!r(|~OOwI$UJjOQ8Zyw&2GAM4IS1LRABEe*XZP)Ab>eq`%t~8Wa5fu_%#mL8t zxUEFY@b$WJC*lAn$ru;tK7Fzr$FVBs@@?yuCZP{UT7Mhgk<^M&l8{K^&(DpO1{Vr! zwANA9bkh*k%+wN-KqG0-31iFg2RiS&yUV7emcInIQ;4Qhnu6b z)06Y-o6}?Cr)!mEe_sMUJs(^jo}C?DpI)4sT%LkmOk)#F1@qwK=<4LUfuw0zfufRI zRG_7bm4BQT$w$?{__m_+A~mTx7vEN4)`?4v_2}Zf+G%id_5SqeWWngeW?n^uMyuS@ z^XrqV^TV^7Lb&ze<;@S6kq;k=u&to?y1w#lRd8>!V{)<+XgEYh+^Hm$FS95b=uLDfB(Jyll~BD%hrmZj>hwxp)d1wlNPXL}K;kTxkXCEH1Rm&~Te6ShGjPUUa!W$T*WJwM9L-QOtOGQ zK3pGNmf9jZ#RP@8~L11}q7M4}a}4 zcN|GbzcdT;d)sA@lBF%Vui{$C!t}N~i@962@#VV?i++_G5F6X}CF{OSuDCa`0GZ#U zc&rOqCQ`bsv7l4F!toeV+wEYztl9tNR`F?9LD%Jf+nxIT&%Ir5oBw^5vd#Z~Mfu*ROWDN7z2 z4XpA1?fzcBmjCVaw)x-ZDck(--#h<1_x+bFY{>cAPxs1>*6!jpiv1V))PIKeBzAEj zZNk{C?Stk+WI=#J%zbb@vsh#(?#3v~c}yRMnV1dPAM=c491|tCUtg-OFaKTaRQXu= z0KdL`y5RhK9KEK;QP~z*q$baCiu~_(W2w>pyJ}|WIAI(=2aPrM-|Kgl-v9PGy{-L! zj`9L7iIm6_{Z!A)IowS!fq!8}qmU+JNJ(%@#wg}507aJSuouJxqe$m7&6x^K#@_+Q zh)6m`okAAywAWZY7Jimzgtv=)elB!9TgQvLQpSZ`c$ zms)S!A-T2QxH3+yH~(k7fcJz`mI*jLJ`t9ia`qbr(sF5tq-FYX_M7ESMZiLA{T&p0 z!_uh#=HXfX%=_uT2D488JN0Nhpbd&t>MPO@nU zHoxg<;H|PWs((DjnUL?Q8|n@4R**b)Ar&X>bzGIHY?@0Mi9y5Dr=8NnB>w>H#z#># zaW=Oq3ik+n^<$_dVV9Z@*1#+h8OlvXx3DyJg`Y3= zm~Dgj@5$MqwfUcJJ^$}@yzTElJWJW;f7a%IT*m469~hnn+LmqEmjA%={{a91|NkJF JKfeH6006W1b>aX3 delta 3285 zcmV;`3@Y=s9q<{DJAYe!Z`(Gv-{1Tc=c;+omuHe+VkfD90XImpyI^S^=7cy2&T z$2J#=)JV#i*YbY@s5Nh%RuccW9d)8MNl_ zMT%Ekq|5$38A7SA^eF#rjlfo2}7AcGt;9dCGBVM!P>G+5YAj=BCdDvHWY!uuoqxlt<3a6_m|2c7&^+fXq1LWs zZu54u8|{)Wy$rYI3zhfye=d{TPavmp_=zm@>+20?gWQ+n8HJHW_blctCu-y&Y``4XzyxWfZ{ixU3?d^4Y2fcr{J8`=m zY~9$S%gX&frMy7>$pGMn{on2Fcboga*Wcgn|IbmLz%hA%9G%Vsyw+gOM;q$f?$t0ux5UOcn|Z zW;v$@bwr3l2TP7*AxsP%LRdz}7(4GXX4+Wa^Cz2*nc;L8-Q5)tlMUD8ky@xy-Ksq< z=}!O*9mk-MBh?mfIyfJW@ zP(G2`5GKY7wIepXCwfxdn5`g zG!1Xw5r8M~GeV&Y%J~cw+Bk<6?c9&4QOMen6 zbi!nz9qVKwS%PkZnTZvHD)L*3axH<0MA?<8?O8`8{=YIBR3ShLs2N7X9WxW)%ovW2 z_gs~4K^Muyihsofv&%4o(~;eDkV?3tVre8bvO@UL8mHVyaxU+f7(4Eq3EPFHzZKfG zXI6l~1huAW_N^Pg!c4l+BP505Gk+K=>TEMIsNm_s)K8<5X~v9O7Eb^m$%_~|?RHka zXPCL2-RT~@V&xEjFHk>}f(V)70J+<3Zgz>0+@cA$pyAj55JE>ICYYJ|<}sH;%H#4N zrgQ4IO?55{+`5}L{Zp{U%J@I`&aImX@*I_pO#b0eU_<=x?RIt>@qd4>(|_K^|Ibn0 zylK6FDa&HeXj~k(apJqonkAWF3@=*m-Vxi2ocxhHKQ}?QB|wh+W_O20QuYh2cVq&q zh|~ZPmN0;@?3ybk%m{*i>F{4VfM=Csjr;-Bh6#vXdoWs$chBLOdxy6c1#p@m1W^D% z7}RTGSMz)>&3bbC>__vx1Ai~~M&q!D_ueT>th1nM_R!He;%a!-q4Od|2>fxWYJFz; zLg3!6q%^^Nh+cN!9nqrNzdwhS!#Gk%4O(qW+gWTdgWn6v*@$6k(TE#hM1Dpvst}3m zZ(wiNO`V1zCbZB9T4q?wu6eVJ81htu1$EA0qYHE{#626%oXL*Q2Y?6wt#c0I-@ayV>)*#mlHFg|*{2e@W-PZ>>x2fk6U3r6h;;P?r?R!SETET{$mbvYS z2lFgf?7HWrm0VjQ)_>cS83wyN+%hTGobTn(`a_qBBU$TvmQ3%T%S3p6I{zI&a1%Ug z(BnD9PNGiOlV_as$;ag zGHN@~Tk>%JRbe%+c^b*Gx<~RBelMiKy8m0rC8L6lF%5^aWq+Lp{tN{79fY^AZvZ2I zp&4J^5$#|sXPouhU*#^Sk|#lw}D`V`d=DKeU)Vc{!gSBv2jN8k4Xk@%Kz>58~ML( zyVKd*;{VT49Dfe+9z$Cwvg}0k`(2kk9j|Phlb4;Uj&n)hts@9)Y}fiIHgYMMou-m= zKviOFAN=O0XihRTG^K{d^MCKgb_Z7**zelVdeetOR6kRT z%!iGjJB>M-w^m#$+`6+A|6Lcb3@Z&Uem*}syZGt&=Hl?D>mP28&Q4FxuWwF|eVlGo z*5iGR^z?jieRy_uczt?t?sIvTb}@~sXqGq+PL8flu2+ck4Qp5|-qc2gO* zIlQv@5i|1UO$FO3NgpZY9`zb=HNg0#J?-DKY>59U=3LI4$NX>rup$2UclSHZ_`kcm z{r>k^%16fk2SxwKME*y|{gVBMM1Fg6zf|Z>?thEmf4|;Vm(ly)VE*dZPxD;2<^bS$ zz8zN}fQ<+GMY60^_+pCcPBDY91JU!p1Ofn5pHw%hSLHia>h>0xNUc44maEP&@gIoY zr(?aWYyE?=*Fjewg4}w{s7WSgpH{6sFR1dIrJ&jz+46}^aZqir${c=mx^II!OG)L+ zf`9XYJ4DwYd9x*6g6dT|1m1#Z%Bw|HPf#W!-EGH;Nw`>+JN4{Z?MP7S;QCaSdw*&j zc2>||);{Fd*MVz{7N7Z-Nl{GW+H0lmI;>jj3jVId_ey5*Qg!ux`$wEz;i%bG?bDT4 zXCIH)mdh>9VhAKH%p^=WLt#Re1`i&e$A7?I-x$3v!Sb{=l@1}P4o)jn_6ld^O^HX6 zIn^SuQLmxEe2Xt#5~-J5Nh1@^r)CmED?_7LqMMCQ{yhzIR7|D=Or%J444t}m3Teu|w0{co zd)sxAny0OWuj*RK!u58#i@Ce+z1?U*Y%=QQPBSvurs3m0t1Vu7YmL|8}~~`=9%J?QQ<|vy^TA_bbZ(mR~ZL&VKhj zXSHW*7dZVqG;Va(zIir|R}J_4=zrtoKjd`jZ_L*9tW0ZLy!;x73QJtDiomwi!dUIL zZ4E`N0#HkMZ21`bk#_>tPtq#ZOP~99R(|i_2G*~zY>58`wef$$^6om5;<0F8L;Uab z_xp|fZ@0J2|9+mb&Hw(r^S|@he<{-yIp5&pqjKnWclB$O;4g})D}GNBRDT!JCQ{x8 zF*rSRktC?~JO(#2i&ci=Zj7d$$BbcE=-E*IG0#Y58MSu%^{MUp^gq=}RgHBF@axl$ zH(dOlK=0%!w7$husmXJkqWZhtSX$}-BRex}ETqCuA!CF8Z}+?Re*fF+_O|~2bCf4= zNsU1z+)wrVoWtD&1q=(uQ-3DLkkjOrj#1Bl0jP`I!Cuf4PCVZrMN8tDcJ1g3*vBw?*!L`%a+Ai%8$)@KlPFj6H%ttPScs}JAXWXbKAC(`J10&k4YzOUPMv9W4_7EW#Zno^Ilqy)l271r{{sl zm4q4uSOAoxYjU6c1^`J>6eZcQ&$+%6{%|A!y8ssZ8>=v~M%n9RLh6ph73scR5~+hV zN!gQ!YGD|L)qWB#mVBJxWCdk6_jJNS0M!{az6IUV<6&1bIwRMP3I8qeMl} zsJ=?fgrZu=bp&(DFzR-Lpj!>E%GLfe40=K6C8%OaGj03cz<0<}hz(1^TuAs^K10b- zqwQJ^mN6O=Ls74yb{O=7 z(0lUa$sYM9Hb;b@L$ zGo0aIJRgse$vBBele0lM2r(qdWZX~U;W+7^g~{2gSAz-m$*WNuk8wQcpPluF-U2yF zqA`iU?|+B=K_~2Y!pTp)FdBr>XcW9U>z@rrXXCTKguN&XeeX+C^Uv3I*fVBkH4pO#bsRY2e$ zZ{GdAGZ!)?T4Q2WgPCxSF(VRTMIm z;38QTTvzTxK!wp_nc!#^-R}&vLS{tjj+h%g$vMVaNW0m+4uz#>Y1BP$o-=0j?2jvy zl7A*`=H4sd&CZ<}f6H>?FnoVuPAa61;8kczAQz}FHXVd>p{=#I#|FrxNKr2_w_8`S zBnF+YWsbh*CBir?5ik)GwiHTxlrJPI3#?gzLt!jY|6px{^NeJoI-03Ymd_ZC%_Wu| z3jFcO19%EQBjhS4jIBYUu^7k`;6fXgP=6W5biRh9;JpeO2v5uehGd1H4Zjh?Z?WJi zrXp7sb-WZbM$4*tX_i45IOZfw37|ZdNE9mLIr7;3E42cda}XSmuc#C}MXnXxP`w03 zwPt8>S6g`rDvy_D`FE64!vFz%KR4_PiGUlzw@y+6%egzPwws#^#>5Tf3yYmmZhxkb zEN$i*B|P7d`gu?wO{umw^%MZ&ERUcU zhH3FV#ncK=um9>DEspqmj_S4$9v2Btky$>sx9e%aj9s=o2EY93d1OAPoa(h3uF=;l zad|$yy8QP2o2&1Boc`qahsT(rT7PzoCrFGOL}JXrlxWbEl$gz~~k8I!32cj^I1ax_>g9b!9j! zFhD+ZHq)%?4_v@$YzqYMo%2~Yj_?t*%y|ssf&EC+X+EFR58!t;$c$+*pS{C7u#QCu zWy}Q269nIdGv(;l35_-Q_S>Zp+OM`{yTD&CF(Yi#?Y@5l&AnKny_HBb0;$exjQ<*b z&k3V*iizxGu@UQ&4NxM6km0q`5b&Jiqi4NPYYwz+Ob?vZ6j|E2Fm&npUExVQgN5Bdq zS-9PGDOcL~susyMCx6t0$5HQ1m85OQRb^!isvVGz@Ov&a*40%jmXvU^z@#%Jq1bp`k!rZvnS0fOHN^qW*^Kax(ZO`Ua9V z=ue;gDq8Xn2;G6hY~rZ{2Xb_59H)rR0?kwn3vBPN4tE4#cYo_&+9Nr&$7~1u|5)%j zU8E$tZ!+*${(m^0H2nWbzdt_t|BunO-v4^uHRVYJZ|%*$Bbk??CJE6bs$QuKrx-?Y z+);F^jI^09+YLt7lsFo>fSR7FB@KeDS#^W8lNC6Iz|7i%V3R^PhNPTXL-eJu?ZMgs z`A;xoVr@xrKYs;qME(bpK{NiJ42Qjw{69vk%Rk97)vc7kd3F6QTHv6ky9xXPCv&$_ z5ddYf{vh(weGlLxP@W*yFf`yMv@PBY7>$YA66^XCgIi0L2~C^dPKl0}fB($o#|~pD zI0eQU$xQp)v%PZ20m}24Mmg1Q#iq=_^_GvfX0&79ZhwlWn_?WmJ*>biSL>Ph5cPuo zt7!W27Lp< z(f`#R$A37pHm$#vxVgv~o4T!)G%YAn8;L4<7$jv310R7m@1qtwl>}^F$mU8mfmrE$ z12ithgiHko?ay2VEua^*XRo^7Z^nYno7gra^3}gdkw&$y4#cI|zr=Zc#58w~w7A7P zf@M;CSlAYt-J; zHh;_1AK5--R4OIpY8I!b!9KV?61d;=e~}t?^%x;@k53c9^zgk6OWj zDy@qgX3bafat6I)Wi47hb_2BuSJ&6fFQpeEBMF9mnCU^q1z{Q@ejVp#L>0?f!O(I)5iB_~%%IWBI>vzmfmz_eO)sN&i1aYt{c3 zB58^F{X3{;TiMeoOXB?ds^FHgHots(TMBXQM_?CJc^sosmCA0$WTm%%vp`*s0IQg| zish{8@l@-M{0D}vbiswhhksh* znEa3WJN5sg{z?8Hr9FiUqBTlxOLg77!_5*o%yP;S$`_E4_?j$GRTaQ0&#a>ZYKe^5 zNZn=7C||q;iHvBvLK{-n`Uy|Gr@(Pxr5L`>B+lsvOq^HwFW&_4BWG(6+(McynE=yP zOa@+XKE0Z1A<=sZ#e@I*w^K-{RDWKupt@`Sy6t~=oepM^p-5{Eg z_&U#Q?UV9e1nMU9UIa68?Y#(ent3n&+j|P{iKHS|@csF>$_p|ne#2OM0Zou}-8?CN z^MaL%MS|Twk!Q3c|E^TF_=(5E{2K6>{P#z_X8u2%obvyV(hmIouNU;jcYpas-quft zKL7V>jLsyHYp?O!qAyLTf6{hD{%h61wdcS)76c!A{~Hg&hX3F1ho}6{qcm4TcZoWe z+?M`jQW&%AYF&*;A1alFy|uE&_y<}9dWp@t*=M#?cBfEp8+BF0DRDuSmg^siV$Psi zEGUQSlgl3rwN5Vww`#6hx__H^UboJw*G@gtWYJj8^n3&@rdk>=s=nl=V6DvAZh8x9 z)n04b#y4l*de(81w`ulzA7rPoMtPot>zY$_+SW7!&81pMuy4Ubg{*YmIMPm?Y4r|j61PNi0Pt9~U&+X>@b1kfaIJB5J!u-fc4AZxZht>r7Ug?8S=NH= z_5Rlo?4#dqsbu|zTT2YvSg^eov1M;ttg*evG*|i^%7rbvzL8YpZSZa(`CLXS^3XfD z_Lrd+cd410wv=o>s})p6ufcCE=4_C&eblUQfZ+R!ICqF$8-9HZ{vHDPzsgVzV%!Sg z09_8#<}j)@UDu{4Z$(SGji&Lp_S2mESoZ&j|Mwu-priSpLG%BAnGC|g$^UzdcFO-8 i&Hn^K(#1b{8tBwc?bQAsw*LtL0RR8*TUTlTP5=NX!_6%K delta 2924 zcmV-y3zPKb8j2T?JAXQBZyUF={=C0p?z)AOG+M3R_7(+hVCUWjZ5qSMNl_F%2E`po zthwZt(N$qO2l3#J)oB-wrJxI=QIPW3J$r4qkl}lw>3Kyh(JSWOTOOo-u z&(-2Mj)(oe`;Ozd`5li&gS}3FFzAmugPxt&>Gyi^9>kxGf`4mTp$$=c@x9k-Ztg2- zBxmnXX(mMii*7*jy!snT2yA46aj!B875HuRhUc7 zj8w}6ri^3KZbwnO8eWvE{WFd_Q5>YGsbaZteJ|ig;EkTYh?urZM#yeSoWhG4gBvW zdjl;CMZE;dUCfx77n6v}tUY$rw$4t*wV#1m=9mDZrts) z;%+M*y?^b*NiR+YgXr+6d(eTL3DwDur>{y^?XinE1Lnl%O7|*gAb%pY6F8Cug0cEWtiDkxG-a~T4mF)iM$xIN zncHPhMP4}x*AkeZ3W-K-Ge<%Fw=x=3AwUX1v0zGy4298f$;=!$GlrwXU6Jw}bV28K z`PWP^s{j$anp*XRRKg_@8#}3i6~gbmoQPp@n&jJ!NHo<2hj>?#*CBHJ^;|XNT3tP+3J6WnKPhH_wY4a zZSk)H^=%;nAyXV9cY5xm8yLxLTy{DJzyA>gWIAPnnWZ1D@z*YKb}~Lcd-?9g`HyeL zZ@vBqiW%y8%UW*K$cK}oVI0@N{(mukd6qyJ*85IhjK{yeIXiLvU)qO$&220GSDv|j zK1ZIT(vivUmkQhv|NC*b+lc?eQRlJ#e~|X~-|c6xU|9khjf>+p-29MPw$M2y@T~pu zV_;_mFW=|RJI~Qo2_UE5MY)18Sj}r$pUwnA=r!xyYSy{ctjGd|&{|J(u75xB1*eTI z5WVxsXFWK=2QaD-6ox(blV#&#I%V%6Y^{;m&|-fF*HhpUixSF)30|ZKp)Y63(I+XR z2157mOiB}0WVtQ~XIxGQUw8ZePoYVRW7@GoVh~8RUmN_F@K-@Nn=(vocH!6=1;3)- zshe-?el2S?Opua7BWRgn?SBNs3t`HTry6Y1<-!2E@aY2QlgZKv=;W8Noy)|`MXRS# z@M;PQxebvX36<{1VihNSA2V>tIJenbVRJVZhAr_cYHyZzndYp;#HJO~nmJH4=gJAU z(gUv7n7(oQNPf7zs@3SMSmLonXP#dkxT1BV_s#_7iU~7?@LS#bR)2>LY<}IlDF0Qz zHx#iZVQb8*0^Um3NqMC*ewIs~ZzE|pJ-l*Xb+-H8t20LUU{icfC_?yM2;q5nH*5DB zbJpvL)wdwlPxRQfQ+t2@QTGm4__4^^`y6=|>3Q2R;0CZ2lN{Xkx=d(eb5)0AQxj^& znK>lzl=q^}Nl1Hd-vUpgasY!BJ4$^WSoQ-3zgNPgeLz?;th`@>Nq z{~vX`!^iypA=<|MUnjU=B2D1fN&Yp-gA5Hxi6KdKOJz01DvH;RRkzN`uF&PW!TOpK zN8>D@=BH|h2GPc>dcfK`6}Sn3opl9*^%25NNXnTtL|%?VseiZdXp=q!RxQFK}(9yDt19Z*#YD5dh_3{k6!;^gV(P zz(k6|K;MGf(sp%cz!@ca!>sF941O(L9%#Dr?Ti>Y|M?S_A9{?X;jA#$SZ3R&?(NVc z2PpSv8xzbN%k?t@-&J~yIEb`ti}QS#R^Ocy?>m@_em$}9#&&iW*M<^|NTJE z51zw8iyl0Oun>lE5SmMQQRJ(eA&E(tSC%xafXn@fKWnj_}WwIBk+Kiqa~GV6}@Hx6!2 z3(m)$w11MPD~{Agl8PS|Nm;|d2M|qp)M}@aflYy|MY1l$%H$iMArxCOtu*NBldEV4 z=xOcRtDg7Uv1olKwh4)1@qbEYNv*2|v<&-aIIWM^=J%1Uq##JHq&S2gPDR z)LoZrrYL2z19}stl+fImyn(C|Xzg~b-f|_4q<@kp@b>t$HpbZk1!{e&$Vb&$GMRld2r`&(OC zr@L0yEo-jdN3ExA+)~}zinr`|Yqj!fYYkCdc73X^*jl4@pSE76e#!PJE8Q;sUz7i> zY=8a!PeE?T|2pxg`Tk=#>O9te57Ktlf2$+Djl6G5X-oB}Jvi`M*m!|ZI}2>2Yz@Qs zZ_h0KJB(V0EjeHZ{5rJ&(^`4W9rNu#&CY8tIBG6-S9IA3Rht>?eNVD?oQ67H$4mpfd}QNW~NJY`}AIiVM1hPrwItc%Y@Nv?3p-ec;s%Kv#9!5hJsAccdpB-sMfy_k%G=wy68Hd0}* z5339RcgJH$nbJWtW2WssJ^4X2`DK@CyU(&?K5N^L@~>Wq_8QTI(2F8>Z=ZDVEYg>G z@GP2;i{M#gvOIY9?_eL^5yfPo;nm4Y9Ynd3erE>l2DTX z3xIOeCimHI0FV?#QIZ{}_Vu0chbrI;D3E3{##or6%jAINAs!< z?l00vLO-C8lrtaZ9fu@I@z`j)Uc(77K^7tlC`#XH0*NS*KCIhKGvIN|nFGK`j6M{P z0uwH&;$q>$ghuGMTCUqFy5~8+|MuLr>p3CHK+r^)cZcvJMll51Bw@k@{FIJSFjOd= z8P{xPN+r^7wSVsJ?p%Qqi3n!RkSNlWDCRUk>2fh`IW*Ap?g>rfX-fta$J|ZW)VamQ z9T%Y)e~#reLE|}1$T6KJSWP%Fp-d6VP#6@935|S6P@!;VNTvMul+k9KB9r=6h=tOA z)V+@Vy{=+M@>B$N9`cb)shXu@H{fw=WF&509gj*s9e=e*&$a)~>tbgmj8h`5yl#7b*Yo=Ww|g)g9<+yp&fmPY?|F^AD|>LOS^skq zr6|8*0JvlQclzCSW&QWt?csj?KSg^9$2cKrq`*$Q39^h)bZ->DMRp?<7i5aA^AfIS zR05Si;OE2lXUz#0F;NOb;~F%;F$NJ42y-GR8GlD8L2(!(Bt%LKfilHm!BYVW<0K*q zrRz8XO=xn&Q>J`qI}VM>6n*1;rc^5Jdw!?$DOC{}yLWe~OL@gL*;uV9LfI<))JA=i zMNR;UOnnd-A(1-XO42C0yi8JeL3B!b7NW|$iBWgv(q*ia(HhU0`>hqpdNJRs4G zOXW~D6(|j|iZU7!1A*$?>?U?fL@1jol7G!49Y-|K(_Tcg0DpXT0A9jB5K@_vC|ZC( zy~`jAfpMkHNG2H2$pXU6UJHC6EYtuIk~xCXHcGUO2As)&@>Ckq!Hm-Yjd`n?W`n}D z22CQ#fwDko%aHo4!2d~e1t zFy?0T2tg{M1&jqTx|t{x@Or82*KS5Mrpl=PB>)6T>Ox0;^j>bP41a$4r{j>xgfglYw!5TX&EoL*`08XdS{~RWVd0p6 zbgjK-YwhCj@7F)x9G#t>oL}FZ9{bQ}RNszHj;>Cwv!3JA(dF6U&*z8lPqH_s=RaKB z{Qc@Id;Ia_?6UNDdUSD~{d|9NeRzC$eRy+ub@9XLS&n~sb@87kN7pxJr+?=^-CUo% zzdSpDMM&j%epCT z!mdVZKywLb9Jy-`oO-VS_kV*8KFb>(d;%p>7Qmoue$sf9PA2ptG@46ddZW<4on11R z;3CJof)2clTSv1U znvL+=@xn~f@%c!@QZ_Za&v&kKI?00}OC;bXWtHuF_8nDlN25qbaH)>p%(kk9&!oN2 zoaf=oa;oU0P+K*&DPT4N+{+dsxuo>UjKqI;e{(CzSt!L)aj&e#EOH_1%G(DEmLT1E*w z5i?a8%yr(BNu{GuLuSlb zWg6LY2duAct6kdxivLXFsJ3r|x$c@gdkm@dD%Kf8#g*8%8Q$trq!XAC`4cX3U})sz zD@5wBKYwl%XQ9TH<+pV>%k$EfAz58k29%w?TouU@6jK{NniHX6@u&@=v8yfLnnpZ&wAaB3H11M%G`8TbnDm zk1Q6pmgY*9VFRraOf8LNUSb1*9H16^na0?FodeYKHh)=i$OP2jkg z{F+^0$LVHy=y&b1-nm6su>1mM2l@Qq=E5hSEJUWDrwPae1AA{|Zj|JT!zf=fS#B~< zP@5Zzn185XcJ{>r3@puj@nkehiqq}O$9G`K1LR`_&=I=1iCD=^U8YeqGEu$EQ2?qv zxjdFgemH|qz^d#@heC^xr9@0=Q%1o_vbkS+%q6YF6(tC;7ok509{Ve=^E<7daDQ=ylWJeSF!EZsi0Xw?g}KE=1*A#C zUELMkQz< ztACw_|C)pe3d+L~2AqY`hjv*yfh45QEkfyjc-hJhtMKgkP4LozwL42cu;wVsx06e- zl{?FOJIFN`xyCKO=v-nHSD#<%hSzwMZdaFV%2%#m!s)qVlYRU1+t&C$^Vg3p1>2SX zX?vZu``_Na{_9CvZT=@q>aWE8Yc3}@j(<}5ko6&zdZJSHzY?xj+}dB^WMONoO3`Po z1>Ipem4bw3w(r%z>yDDAE>&ffHp#m9U?tpGJ;6Nw4y&HZ_S>lEw%~nxOxx=J6-s6Q zHnZAA%GtwrgI)FigKmG-|93jxaPR-0q}BTWOCHwbd>RjO%}rxAd6{eD@h-TgP=B?N z-?`5?zis$nSjsdAP|Ct(R}&WbiS2G$oN2S%#5k3UG5=U3I^vjUZT#|DgTDS}9=waG z^Z|Z({UCMtoA&@iS)jHD2jmQ+$mCjV_LQ>e_aHDL ziq6p_1WNA-3!Rt1aB5aCe47ZI(2p3}sPf;wbK!zT3*gLPYLOs8VXB{9$2}h1j1(8> zyo9XK=flwmLMo)=PN`~{zgB$59se#`=5PLDHf`xY`Ji0jxUU&cf_mi|O-+#B=_TVAkW3PNV_~lO3JJx@9(DkbEe}A9sH!^S#!z4^O}yK08jn)z3zOn$9Eca?NezMX#qc%GGUy9F~h?{9o;UHFe!kbkN{Rg`frge`j6uAA+o>U>?Dqr9)` zmY$}uB2N|esrLV!@!wa-2JOuMRP(>>p$6Z_e^1c%`JbKnA03wqI{g<<1MSgSq^79^E|fu;)`Q@Y&V@=r{{slm4q4u zSOAoxHo4D!1AwF`O0w)YwXZYUKV*{FUsx;_iv`Tc3}w5S3aOiaAQ!P{9ZZPS{){B- z#g~B~2!h>S&;AX9p#HZV1lbVhOL(Gx60;eA@5&--}VD9Mioh#YWr;;-XKdLGA;=tA>nN{M9ER3@+QKF znP{D=u+_S~y?^y3DkL(RG-IMkQ=y#F2$e77xaHBv@Vh5AO~x%1Q5*_CwMkfKKEPmn70e;KFEBtx#urx;74y)mtx zdtNrNr$iZM} z5OhX3>J45Gq7Lcp#joRTC)(`>-R`Kr+u7Y~_g;5Me-ORi>$cn7ZV>DahW&2;_3OQ! zH%5+_p zXj78|k#QYD+w*8b#u(b@Gp0(L*z*USj;Us3=-=LEJ{7gl z8HXT|AyFpZN;AgJ1*6d{gnf2PX3Fyz86s0gGD%barc5<`Doo5v1xKUe`owW1WlE%O zihq%bs+?n_g|ynQO+Kyli}cU)Mj2x!DxXbJN*b?D485F#(cL9{2P`wmxzIK#z!N;RYXOmEbC|@XoS|i^~8ul={tueObMVo zlEyQX*=z8~{gqmQ%s2=R$fr~ao*>r>ZmFICqgpexyh~NS1C>P+BmN!b)VP5U$A2T^ z@(>HSC48YL6|#)G-fFAdNH8XDDIZ(zjBi5+Y=*zV}wc(Is4A`Ut%I`?-8O* zvKb5|v9=j$l<;zH?3aGdG@;s>eg^=eGz*~}1WEp$U}EQ0yR-L>=3V?fLv>#YkBb;D zky&pK&FFesFte6hFN0rx^*k~fQGZVL%r#f+YeeiH9$p+>Ud}gcituw}ZyqtmPFFcSre`px3Ld|AS7yzg_>I0{;B7^$Mmm2|=N@>$q7y zzE6x~_)1@tP(+Q;yJZo^@SWgndKSfaV<0 z26EqRIL%rC{(F~vRu??@2!C2;Jc8Y>eWb}{HX6|n&}hz?nT5hUdz*By$wfhD!amDl zgofMF6s=#!G}6$pZx=%7MyZ(n1dTBhL&D~t-TOCC*Tx#|KqAoyr0lU-(r55{Mi?DY zj7`p9P3n6;q3f%~*QUqDyb6XGkxU^dkzl0;<_2O!k;Mv3;$_1++JEKHE`(nXXLgVd zPcIEFN@f6yI;GEkR>#&#H!Z&v~sGKALQvkqDvj zZ37zDjfc&7*EKtXox18?>N-@%Z#ivum5^$TSR2uNGw&zJ5?@VP)(9I3b5mK$W!aP~ zZL(0yX3--mlgQa{zbx6W=2g~c467xQkMMgYG*$!GN-hcEWPgltb2wYn>C){xV0msk z>$(Qe;%Abum2GR>b<^OvZOF=~;({^MLW%pD(=AR#I)VvNZ*f*2L!)3{W3r0+)2Bwc z7i!!w{qF3}e7|%@mz*tY9m;oKzGkYz1r{}|(rqAER{ptjlr8*qaA*D>2|l9Zgrtuv z25vh4?e^;R|9?S$x3|szp8^)nf7{*-<#7lHcHG~Q)Jss4m}nA~CzQrhoTE7J$Qx8j zRxMZdvk5H)lYbtao*kZDFYVkb@u^Y@@N0P0<*MXW)(Y0}$lF)auB;W@M;C{?lIKE| zVGXYe&PpEhy2Kg=1;R?|c^P93b%C&2wyk=slY4M>x_^>txj?dpLmhD?w>5Q@H7r+R zSNT5oEc@?;JL7+hDHAhm;>Roi8|y#arTWicus#2M5~#+1lBTLvE&_+;;ICK(HtcTZ zn||L->y1l>cd_C!f71dQr2lar>30<}G{NQjOm zC!ejru7BfMOrD%)#c&2bzkhp|>3DfDqnip?2( z1YQ?c*%Ug0yd+|;HWf^obFZjw@=Kah1&dOc=&tgdzk>L@a$;BA&X_iTew?>RiF_JX zUJFfYc|`>S+(GCMQY7KR=i*H3EzT}*RBtOLMt^Y^j!`pl>NqzztD!V$yh%NmYCNNg zj_ION>%yB56-na?(N1uZA5uP$ES2KJ?140HZ;X68CGw%-mJ{3pOp{uqDn@Lgby{Or z&Xk4I)+(e@Xb}k(!qvffrH#=ka#ZSEiXkq_GjjePbzSw8=t&5z1hu4*syABsOB$vq zsegzsF%mphA+)R7NhC3SZWSu$!*i$xtTM6}C&BXo*6z&Xz*3;Bo=(ou7S1g19UzxN zL-eryX>b&VPH` z`(IB2E9*abQGX%tUkW*eb5yPmxfoKrPk&UY{@2p=T3Gu#>@3{fs!H}*Siv+nNtGm_ znXh{*@J&M{Qde$eRTjxr`N2ZEvABbI{2A72E_a_sJ+}vM;W2P${MV?o`)%fT7pdS6 zUkx_h|KIKQ7vq1Y6AZTT|4CqF{681*ikeU3L7};6-KMza+IV~jUU5;iQJlF?gnzhc zgkVLgEQ(O6GGx~a7R8S3c3kdh^V-BPQ?sG?P!>9pgcxi5^3tHb{Iy8lcu$`4pjb#r*e;Rq2=uiC;#>rupCR)X)F=!64Yq|EGW*I44@8 z`+JZpk zJK?dn102V82E*5>#1Z{~vCAs|=Nli+IGcgsmeQyMDN1|$+4uaz%j-)mBzilLU-Wr@ za0xM$%Jaumx9qP|-}8rm$d>&rK1{|f^HaR4DR0dg4M}v9rS|Tl@?QDsHb(Vc`9pH! zz4CREdawTN?ZA5?smK%@A08>sPo?+`BklP#M$&S4QvBxmQx%CATicvy3tQO2-vIs- P00960VSGw;073u&vjy$x diff --git a/rds/base/charts/all/charts/layer2-exporter-service-0.2.3.tgz b/rds/base/charts/all/charts/layer2-exporter-service-0.2.3.tgz index 3326b13bf750c941febfb2b608e53d026530d753..33b3b0aab4c3415d4581e078ddcca652dbf5621c 100644 GIT binary patch delta 3174 zcmV-s44Lz*6@nR%JAXU>Z`-!B{aJs-J*P#tZk8oGb~*t8UeWHo6xOO(Ste#nK?DEkWKg2p&_ zIVV#4OOmlicZMJcg30l*{T~ED`+pdO<457~czk>kj>qHhQGXDQPlDq|5Zs;hZYY!{ z@=;5E+a@O!)P$@{XyNmsF?m=;D>(TC8%Oab8XvRz&FS;h>c1@DkOYc zOi^;wsJyu_Y=7oj=PDWuuCA_pi3*8~=lz6eQq4>GLe2&rjSam$N7HOJP%*`+@N+)% zE^&D!WMYL-VR?NpcwQeWOs@~WBNvJAGD5i~l%upLm=Ve%$Wf#8=SY?M?}F2QRv=fV zDZyH3-z6F&QQ4_&Ax2Mx$w(4sjAsC*kyY9G(oP zNfHl_1AlLZ93|11M9>=s!%;sN_Jflj!XO$2(RkuN|7tk-YVdlkoVE|J@55!7EHj!8EuXxA~P-iqVA@m&h-a7Lv@+_m1F) zIaNRv5cuiEoA3ImkQvb$6YCnxfL9nZA`uouQhzdKs6Y#tBIHCVOn`DNU?~a-8nc`c zjmq~ti8dj5DGIJ52tAKxWQLLTJ~OJc@jbuO#f)l3rvBAc;ZxCaO)gFA%R~(t9}9&S zF;RF?X}1TU$t(hi42d!cS6(o7CK!#E5xihmWT`xlkts4|_>(;MFY8>>r^0x?TyQiK z-G81rc4Fp4>b^*$DpRy8*qVFV9jLND&r1u&jA#CSfl|`sn!L~}KbYyeeD5VIOoI9P z%q&+(9l`U!3PR3MpOp=^iEu8oO$_bo0dgra)N?HC3REnKA=uNhz@FK+DhY)@K6wB~ z@FPN@3c}bDB$^IVG$i|3IvrJU-e?S5!4c7WT$w)kH= z=)uJtS&mZqI=^Kqup|B-hr?h!{(ldH;mOG%{@(}u@yFm9ENEuplD2W&M2*wTh$Wt5 z1kVPaK6z%8_w|R|y6QRFQv!(8`73);^vZF4$IuZh?+qe3@kcDr7^JvU=1 zpV>h6x$nJBtAxlAiG{tlDt|+$Yoi*jC}SprQPy3B=<7ZBq5qa^?&1JsUVfYIPEBVRZhAB zl5Mu$up$NU(Ca>cgWdL@V9vxcLw@UWkRA3v8XdRlKZap23J>;wAJDXalILnrJAqgA zzIS+mee&1UQO~BZd%6gK>i&Hn9#y99!$+VzL9XH0P%%ea_kv*G7L?;yCN<3m2gg!X zcb(QZWkkpG?|<$#i-{v#nNdl&Ax8suTO))wzIT{5dknbcWUJ?!o1o=Ve1BNp5XU9$$QKJDZ-}}rNLOH* z)jDdmUvsVV7R`El*ItX7kV~OOELa3TygY04F}gsGN}WkD#dUs$&;O!s&p#)69>E|( zEorRUotFQ`40DuJBSC=XO4G_}$5g$Et*kB_uJm@px|{Db zt6^)eH-CFu^@d$=@#!|49y-YW8^iAWuX4b*F9q3E z{~Hd&!~4$zLFf6eys=x$`!+1K(u+pbfHS>T8A0P}ua%^=yusfqvvkE3jdY_zG#!pz zBg*#6z|k?@bTnLDqb#ElWx4|FTD)G*VE?2`>wj)i*WWxpv_c=?MzGueYgF3(?Z<+1 zjE!aAC>rd#|C@}DTmF9(4iEnSUZB(epNXX7%-_4YYwlaMsp{N%f07ICs8s7!?`v}* zE_)GJzN(00RH}B_?PF?nAEiO?0C9ZXw{rg6sbjF3mJM-9O|Ks6i{cm`%|9gQWI3rr4 zVj?eG7tjz5h){?f3uD_+)ah|N8(}C-)9@A-S#c%cU@3*HyO~lfJGv7PeN$ zn&9ti;p;iJD`g+s;@FL1ymiuby?tg7F|({!|1b%!iHe@6UTau;8y{DbzozK6B7buY;;zcQ zN|9aZ+>6ywwV~C`OVjAonNiib{(f5);BDNpmSS(VpMt+lew*ci%^mKn66{jJ?sCG8 zxviKQjPo2T_bW^MJn&1H)w7D?LfJgnyK@Sy35CnlE~;3dYu)S zEpc}D8V=V8e0v$@hOismr(e79?_iLBsY11cu@}NMa=BhM*OThb>J z?XmY2|M$!P?sglr^ZsYluKx-qC!<6DcOP)L|Jix};|ob=|L|*|103K0|AFwY00030 M|3Xuavj9*409YY!8UO$Q delta 2700 zcmV;73Ul>>8LJhLJAYbxZyPrf&)@tMbMh5w(`vOV$#S|tfeY;3HE5F>agm}ZdIrUv zl~{AhEygG0D&{%}eXcUcfgf3SiD8Ay*o{t;VP& zS~O&;TsKo|OMjF0dh_`_(rA!sHtlBA(poPQDLv^C&YZj(w&um8XBfw^ib^>lSGbrf zo%ukmbk2Y%~}Q#(Cby5gU(^@pG1(^v7Ao`oow^ zP@<+5vwsvi{kT8q#{F)5@o{Pez}|NgBtULjb!q?ehN_6&0F4 z2LSHz|9%p0`u`{y9`N6T&=H(rPAg#{thmQl-Y5o_R$ZaIG*)Rk!H68e4^wV{8=&yh zi&x)ubEOMvEoMG6xCUp)1l0&LsyQ7CG+-5s5r0Z*3}(QkRj^Q%28%^0s6`VIqR|7A zQ&mZuLP7{H=mb+AeJ0#k7khr^vkA9?j-&a!in!VcO#!BLb!K|4&&uE>qXsW)>m~q} zPEyb)kQxWL%1VfHB{*B8@IuV#!Vn_p7=>~D)3S`N8mt*{+FVEd@m9{B7kNrgG z3EJ~zfiI#`D(iuvA3Z>+Re^Sjl^=m&nmU0Ut1Ildb*n)r{PBSR9KnwWm8qx@3()A2 z1j-Dgvd#)jiHzq9$d=~Ta08W@Yao!$5Pz&QG3rc=DQOs2mGPq4RB?vhI_=bTgE|WK zNQF_rCDU$6joT$i7XE8%Kvxo!1e7zbl`K$N19NVtAh@*xz3fJnFThl6>bif$C3ou= z!OPrPEMyAiRIZJr#a78MTI-d|l@Myq<-|)DT)HMS`?WH@zHl8#WM~Z4i!c26HGdY$ zj~;lW_B4wR2f1iY;Nk>PczOebbtJ>H%i$~ zqn$5;&P1p&6|3U#`!m>7$xq>_MrsjgGi;aG7w}s}13HFn>+JP~Ys=-tC$i5X@-nXhQ4qqE zKet+@&``!L%()N_%T*4^`F{-UlwWFl1@~N?ox^L-e)wLVKf`;6@C9WEozFYax$N971b>9_d0!4Xo15z# z+6ST6k$gBJX@`uDhq}ncf+>n3GSi-)j+=2WXU?-<*Mdu99n$r()~%%FSYb+EG^hI8 zWi`h*PSiD)_wZY#EVd)sRw)IQbb?uTyja)iB8&&F`+Jz@Pytr`L<_OCZl?+FU&>4s zl*_HrCPZr32r;2_$$tlJ59K*bsreQcbzA7v(l=x*nb){Kd=QFJF;&LiYd{8>M*DhK z2>s}wxSVJ-CbGh`v>*R7C38M0XnE(uzPha!&0b4f%4AJLH79nU@+Wx|Itt4L2~f_hoH9q)3P+ZCJ3B0>%Jul+yuX_wt61I z-Y`S})aUOv>7z#K5xfU3Gn5vFPKw*wh8qNbw_rk#OHk9ka0p$R`mEE(rh-~F{qBBR zjDq0Wjh2F2^MB~*o+Eu8`T(d$3*eBLKi*zDr8uvIxbW!B)GPp-HMLSfNR7tfJ;=@O zTDyS2u-q5>moBxC?#fcyo4kgnQNcH<=V|Y0O|(VAdFv9VwamUQTHWxhbE2I6Q>!9v z6?K8tiSG^O?HWg6IK}Gv<~D4lR__+K^v$Vae2~72!*vjjY{>pBzd3XDsX4P!%_U6W3ea)}0 z^;Tc`tbaI~OQ5^Pj%$6i?wMBIv@f6T($ixn+5cnOkN@fbeD|jy``-U1{p4`}^GLLH z|F=A`Tf=?VJhirq)~kWwdK=FOT1R^uAZ;TW{I!r}cwEtf8#SY=2;H@^YAMRVM}Cuc;VA zW15h?xlOINJo5?K_NF+6ab*@`^{(0876o7zc zd|GPE`8&)4s{Gq$5qvMj0+jTeP9?Xi_J7YOBNClmTwYkEksQJDQvdDg1!P2@6 z`M*JZ5{-Y?J^!~Zm`-}`PyN%(WN#&COxaac`nOMpJd4b{B+sHTy&}&dTa@J4f5;KM zrJAeCz{|6*4T(yvennZ`-!B{aJs-J*P#ter8#+V<#05;1%uXy%k%#pcy(0!(Kp3 zXPFB{Y9!^~?en@1I_l3vf-H|*ovP3!TXQ)X+H0djp3mW6# z<(x?EFGHShkvy+|_Ci1Cc?sso6XY>P6?uIij1m>W7Q5-kBFhB# z0657og8HY#TqvrATt+aX45Puo_Xlbd7FdiInkWb9_78cs^}yqNm2$Oacy?Ebq~7k`aMPcL(ffaE!&F)^z3YPARc z&>wkU+87V;;Bd45XCl73KaU;$KNy9R4gVjE5B~olpzYr8=(dg59(oB)QRxWOoD9d4 zXcV53SrAU2kK*SEo{py{WE?-oX%db{!w@HkBnW~SkCW5zWHdU7XVcSZa5^I4Y=X~+ z=%vU}5`T?J1ifJ}9QA`?KREd@45CpGjZggJaCCY+3P&gZ3c@G|dItw~YuL8_7lak4 z{+tAG$NC?JL3{mAg7G2$dk{E+S2!aD)8J;@=2zAzMweP#A-_~wNRp!O9l?)ts(>mW z@bil|-}h%iW<+aDtZOhGUSZ6LL|70>$&{f2Eq`E&kQ1da0m`+2r6?q5%yLFFD&O-Y z+Jxk#D7cOw^gNo86eH_>QmVA^J%7+eN;M->|N6S{sc5+-m!|b)q6Uq}Lg8gh6kb-= z?Ez?#Mj(+PQ6}Na3&zd`qwz9=7wnoWmFF=sMWzgYlIQ+aooo737|)jrjz-Y!nPVqr zPJg8Ci&<1nSWTIlr*^^FZ9X>BfiV`Ub4a@n6J;xaD~(n zoCa1AGDUq}zOb(d=R(`W(2gD;mm)(w$HI<4#gZ6;JuM6DnR%;{Q26-S12}@85DHZg z#+D$_1PSB`aG{MAs2pQDTS8KrTa68bCx4~`L$W~7#>9v*u~={wQ&A{OI-Uy}qqR;w zH*8S)&K?O<0w|BAnNnqT2|RZHrB)yd4uS*n1(kwl$hCrNs^`F{)(kD}T9j`<74h7# ze?vJn^XJ3snXy<%1Y8roHj)Nf!QE)J6>cUN6W5fdmO7){bRo%ag|h9LVZbp)rGJQA zeq+ZkF%x$52yr3V5~h+^-OMyfc)C*cQ@?6%CirI{QfL?z^%!C{B?Cm9pO*1NF6G2#!AoSekrhjVvDxtB4 zp8fSs2;Hltv#+3+GBG7=_1gXZ8rmXR6~2^6GyC#TutG5@XFXgEXWMBK< z>sgf$IU=#J=T>D1b?>N#Yk$g^$>j=@$=L{PgfFGtd-khLW;JPaR_m^v=G1+*cG$}* zm|9VKY=;w_?QeJuIcv>0D*ijCHiulxy7un6BQZknUw=L5UG{G00^IoQ zT6Qw4{bhFj9nsB9-W`!NUB=C>&Nsebjx6)ld|=hFA9krZi@qrZUYzsk8upC4U|vtdm%J7Jz6J~jBt`-(w{EZWx8q^z0fyi=RoxI@`9G z@LqG7h>TF)>292>hJTiiac@h!^)*UoFemCeTvnZ-SCMZK>B9c}xyM9I*jy;xyJ21K z9+SdYqJF#0jk*yyt+qx*c`8vUUo+L90_$Qn@pd3=j^IltGzYj9?9TsV!DlqhNPg$T zz+LD6;bhXz|Hs4OA^(2}SiAoXy(`L-2wvJLe?xMwvWuv`oPR70q-t>1QMRg_bOj{) z8jR1dq~PPhN&IbK_xevTXJVNlzjHarj`cqp9go}V|KvD4tpA6A=K3djt_HOecva7P zhZoo?1*UNClHlQ&hN0JK{w zp&XGa8;4K8+w2;<0EbZSi*2P#MWny7l;$R{#;HZHT`E28JgxCND4aJgahj>CY4cY% zJnNXq7yl(i7Byb=A+7@7JDfFJ47lNBtLvNFpyg70SbyFU$EEDZ7Yib9iMlOFSC9+Y zobcv+&9%;3H0$YIyDe%$E`=7cU=jTI^1RW;=mI$^buPse*ZCPf|BbpWe@^r~fzgH`etAx9ZAgg;8Gu-PLz&@MzpKt=Kd#pYFoxO9$D%G3?I&DhGV`QjlHs zzg_n~!O0>2dkE;<|CJ|pYkA+sO0DdoQ8nO}UaO3takSS;(pui&pOsm<;)+JPQ6ZWJ z$F31&`(@zh=x-VtuC7s*(TFl#0d_53uV=7-(tn|KH>sOXp1-s~AK+H7+y84++Wqav zf^&?`%Dz=J*meFl86UU&|0oz8{QrYMr~f|}NynbQcYD{|w`Nn-x%K`e7u->))~oK< z=0aTcBCvc_5yz-h?Xuh3)N0FfouY1TiX)g7YB?1j>g{co5u=x1o|>*tf331#nW_lj zmw%_XS4^}$5LogOjalkySNj$hDE|`Ix^4Zt^0~6o`<`Ee?OOlC@kahPIys#GJqX#_bSjBldaZ8@zOvhq{p5R{7*oWn^&H!ka*u6s+(t3ZI_bJz ztNI4uZCSVF*UbE?soA;uCZMx>)wotP(eb)X=d80=v-sh$CTWYEdGiUhxX_aFbdBYz z@T5AZTD>i`)i|r}YF~|g?NHlwUf0>#Hq3sDM>U=s`I=GnyLg(0HmeR5Y-4y+&3_u5 zwT84&OE!3-q9>}?>eimd$CdCm6x~&1Za~~swNn|gtDJeUN>v+H-8?jj&fGGp8rSb{ z%KDp)QEZ`0pq$y0NNJ8OixOt8C{s6)0j(^!`=E0lhNGPMc>MuZ5k=vtfP=9k|%-&PG znhDC&Z$Kg=nl8}Zqc+|Xo_I&VF}02tzRD%e=m$((y!(%@efWX1B?xXYjYwb;QARoX zp8x9N@q5*t3rSP&+5dV+@SaF23I(rU{abl{F2!#cYtN?%l7Z_k j#c!U!P_amGaM-gR-~b2sJH!7400960#fjMg089V?xT8|` delta 2469 zcmV;W30n5$7{(KjJAYbjkJ~o#&ue{(f$}fXC&`i@b~geF{Db7~TC~Y6vPFxc=q+e! zWbs0g3Q2k6Ci(6Ml9nuc?bzM~n-=iA*p)@ja5$WYA4zetKsAgiG$bd6L>kqcQ5-xi zi8AqmRQ$n5Q<5af*?8>!CrPsTKTXofgLFKZjL*}_$o5MoXMgGV0VE$k^nPlzA?iW$ z(PM2+?r%b*X1}1)Oo|NV!+_Lv_cKi6Bn)z_QRFBnL!AW?5YC9sV29sCR92M~0e~PC zX3+gqSWC@}RErD>#xWZV;&{+C&)Y%&lf-G91UYJ|SZ&<9C-6P;3aE8SD5QcPn<*-R z26a$MJ4|Uzt$(w@;O6EgR;ZCET1I`nbS%|u5HM=x9oU;yvw@}zr!ua^EO>>B8>w<< zgqACa!14tVw46Z%f1;4N3@XBeAxxlhELai7GpNy^ic4f#|9>M`R5d8HeU)QpwC`Y6i3tZ9SJ>`6R~N5SWI z#uME;eK`MfNnd^Z7<=-6GD^>G<^N=I%K!I4o9X?IY1?M)VUV*KYLkI3$#8O(jnWHJ zB?;=NIYuXmn1C>BTg;7?HF%!^cAmW++e* zgLwwwFn<}2qGT8)=Rc=OHcGO|c|1->7voVnI{zj~vm^;m3G8Uv75{U>8`Pf$0PczZ zVVZ2l|5-9Q;lF#Khwuyw(r^QQ#T~wKPBFSR@)e3}ZKNVIjDv^pbICL?4FrCB^8BZ$ zkg6iaVD3_b?eGjKCkkOs6eClP8jOS~LQS;B9DkTF5*D&iV6dt=F{tApQ0M^3Q`rcU zK^g?CA~Vcf_L(tlZ0`A!&1cMTGL3I;nwZIr)Z}4Wq;fszJvJJzDbaY{dUpU|$Sebe z9ErAot8O^Il$_B;22c16S?D0(WQttd@kw3BuR5$5GiftlEd^RdcO%EGoHbDA;LU8VpIxEnQXKZO-sorI`1^49R^kG{gH4j zfeEVYl4`q45Y+!yMuTbuNC7D3Oi59pFdA-{DSI%mRmA^CqB?b<6lfIx~`6Ser(&0k?9-GA&6 zXruT7riwV*6b2PMTABJ$ycAk7<5uY*0MNS0AWf2L`Mbi(g+)5Nc+QqneBGcvlp_!_ z$1CJWjZ|)R10%UD#m+b2_dkMw6a^E^EL`*F&SEFJEA6WPU4kB5m&j{WIyUtkp}?N{ zKTe0~di@_-OmM3I_d##p4!(vttAA`=GOmu>s_|WA%|c7e;OoKr_kryd{NqjSQgw-L zmjJTx`O57SgJr+SCU_us0A!D`B?W*yrFNMI6j%nQaB(O^y)y%}v|-WzML9(EWNTrGE)K?c6H} zXIxGRU%mFfzk*GboC%*QBnE+W)3$|u0k0dvS-~*3xWO4W4t_;HVb|Z-XT2qj(}i2EXD_a7UnXX*kbM;gKNKw>@fbQ~H;i+ODgJvONn24vw7xD*R{7tD_AQgOab8+I{HF~8`Au^$ArSJ=QV%qEwqjB<*wc?vRmw> z=lEU@9Urmajw{?by}tGR^YZ)|-dTjt2}KCM2_d`=k4pi5elC{1&VTxFoqc~V^fr?B zM1wpB_+1eswTO&9ArUHSRI?RfWg_6=azG z|NEe|``fY*54qwy9Mn>TwzpX&|5UQddaoj& zZQ*-~MZd+8pH8*9zBz`iR`Si_NFEQ_QOxH=9m%?@NPo9fOVwZS{(6Qk+xkyP>wetvq{YvXK=0=2$Wa*FHY*>V1bW>f!~m@ zl_J*}qk?CYC$@^Zbhz@{ThZOWr&)DdyS+I$s&B>ht+_1!+p0Rwe^eMR|7uuHa;Wh9qny^w2f@=_d=Hb`Ext;iGPlw{rTUZHvVr!r4UGMWFJ)x_MQKo zO~xDff0T?)`Tt&MYyQ8K`IbF@czkM(oZGbDxrLu71#kIMEo|@CN-1B38MtwELn&(A zrR>dZYP;pRnW5=#iZhrtdNGx6y6tUM5o?#q7$9ylhXeJ00960%qE*=06G8w|ElC^ diff --git a/rds/base/charts/all/charts/layer2-port-service-0.2.5.tgz b/rds/base/charts/all/charts/layer2-port-service-0.2.5.tgz index ded297b30e10007ba22d8fb166664e5d51c644c3..f2ce825dbfaee97d5bc6ec018bd15a9d43e1b4a2 100644 GIT binary patch delta 3276 zcmV;-3^VhQ7Uvm|JAXWXbK5qu`J10&ADvFxTt!hoopQ!AFXQ;#<@J(yEKhE3I`=#f zxsp(W01JR})F$t<-vAILlAtd$T=3b|Au9ycjthAIEY2s9$ArF7k_U?rAJRMGK_#^8KW^VYV}qs z4})$n@SfTT5AbBL-TyNYUq1|wJ^nxJb%vY%zjN^aj{$Y}{*|uVcGGa=_Ng!3@4aiCnRLtO>mNsF~-Sc((Q%=G8iYrVSGI94USCF|n?}ba;a?BNAawBqd{p3V*bKF+xU^!UQPS0u~~dpfSxD(WnB? zlV}r@Q;~BWLC5oGN~RcD?=z)J8{hLQolmJ|WE|Yw0b{2{((DNoaW5zpwn4^?5*^(c6%LgO6%ll4QZj#Km=Vquv z>IhziRta*7`h5Aqz9O6pZ4*R0a)3;V6!i>qE4_*(F$8@rbM!qA`J76@Q=KUS;UN96p@SX?f508!j2vx&LvyGSQ4w7iAD)8)~bFHEQzL6+u1$>fH=z|=!9Xq{GDQI zmsh9z>K$DU@s}LcZ81D95*#7JSbqy?XV=q$nUHR641W5T=aI>Ta;g`$`Ki6(e;zc& z|CMuYU(JwZC{>`dd!zz;;(tFJ)Z_ngzuP;+|HpveervykIZaJW(l(BpsBw}SwZt=w z;AQ*E7ti$a&OT+<#m>;~5wm%nx8Zzm zhz1{B@>z~_@ENqsc?`pzeWd9qpG@c{@LOwQCPbKLZ?6zGy(kck$7gwh;JZyt(fVyd zV-3Fjbs>cISCZLR;7^$t6SjWset!pbajfc2B@&H5Rzo(yd;!1YgwYAb#N-NAse$(o zbc411wHdNeu!1qhBv%MZq<>gC1ang{p~w;iCiSu&9c?7EG4R{*!cNnh_aoDn@~I6x z-v!>=Ns$COBC)V%R?Cp*-cb!VlrfXTRd3$F8GfBCgfd7qZeSf3;8a2oFE=yqB zbHx@*lWbP?awl&l*iQ7)YFsay4c~IIEr!2!Xl2d2=jC}bd^Q<9BQb*i7a#m9|8C3P zjm@rMC$GAlysob!xS6rLv-W4m(m>7HRt@_xm)f$Zo7^c^+GL@YPSq+( z3(2YR_3Grlnbzv4#($97K=};676=jBcgmNQK>*PRiXk_5zBac5H_WM>VItI01pkj^Z!`z37w`S zyVqghzVrX?uwT#rkGq3I{{I+Ix&Q5W*OVs_oZ4xBM=~!(O%kF>w7Q^N8i_F&XC2EH zm64`EWnY7FDFvC0bE1+%Djlx`wSJ`#_0&51Gr{ilpJ2ws!cNCM9KfFS-y8O8`~Pm( z8658a9tFzlpMPYTYOkEYo7LPmc!7O+?Rv{+Q`=j*2!P_;eINZIYY*TvP@W*y&^Hv! z*4Et|*gFMP@h;_y2FFenXOs50J0&`v{r&4D7&@ZG@>vos>CV7CM)=Cn2Pj4fU~)5i z3|%>$IL{dy*?dkFC;;`ALLf(^$jsq0@H)HFj=&)-_kYB;x}_k}T3beWlefZIiD0`F zI@)ZPIi_2&DjQK@q&##rTN`1}=heNr-_XA!hh)RM-k z-e~!6NSL9dA{k*Uc%mZcl%?^038a+}e$Fy6dUia98CEqII{* zwb8BJ)P|{Sa4YVb))=eXr>}K}8$3!ETx&MvTYs;w;q?2(|K0gt;gIiF3bL>Mx3f|I zd))6F_J5B8jr+glXX7x6OpO z_9L)7RUXHv)XHVox2wfY;bw}uyg80woU6rHd|GXD)07x}{Pe~7!V9OdusTAS8?V1JZKr(8&U5FY#1|Dd~B|Jys%|2zsD!8y?y zCAX!zZqngqh8)H@WeMd|$Vhxmrl?jGz$(vdiUVqfjM=jbcXmek^m~xVh^BM2+tAW` z!V~WZI8N>Qg>N&76Z#1gmsS4PcL99hYypB>Oe2!nl-jb#zzg1tu0~o&^p0S8$$$Ux zbOZ^N$_u7cx9wjiz88#tm2LaCcrlx{&7b0@n)CLW(3r&6d1h;$l=m`FH<|Y`7?W%7 zWuVi{d-?y~5qu<)id@0lH)qNVGAVw>SbG6YkhEPtDSq~Xxr#-C?LSaL)U^Ix$?Nhf zj|cb~bnpG&pi|%f4UP}{zej-`-+zC0g3jMIP{ z71zC9Z&^!LT|P98PTVpo8h@+zxyus0jZ@a8+RN`xAlRnA&5B6aydJEU5jL4%bG>1M zY!%a}%9!R#ze72-)z&wXYP=2I3X!ihq~$sE2CePi4=m?WGc{@`%Y0rcnv71sZ!FlX zsk6D&aM+>n?S+~f$}TmZ?8Cpug8W?#s-}!vA?(o0Zr$uA)#U4%97W}ARk!vuenp;o z-^Yso`}4p1p9bwc|LG0t^GPf=CnyXmM5J~r^f@4 zO9?dyumC7UZE`;Q82}rBtl{vnYBcClD2e!F;ZxvaZE=YRMSMEBGD%~Wbb)uZT> z+uH2h--Kwv-lEb>iWp{HLW`n)4LV^IkQ56PDT;)lj!6qBXH>_q!*5!N%yTISfS@_X zP`@fHq-I8{MGP6^7`NMD*shCbRfGSG!cG{G6m_ClVcfUp@ICSz66=zXNd-TYV^jhS zYBH6!nW-^_j(^+j`FtKK)JRn_ZKc%EN-rHsHE9!;Sb4Xs&GJcGCk)3jEX0Id;bJaT z>I_hEkrr4!(t?VUwBQdEGLVF+|;wTCZKz3)^HUDRnm#FVA0o*hH zyWQ>i-yL=j^Zy~}2wq@DOK!lAy34VgQ}iy4yh3rQjZ}1kAvuDJDbv6-Q26=zs~=mL zR5>*UQwI&U!V63|RR}Yx7#(xeU?hwY3aT}xz<-31u#lw!gL%QJK^+pJ&?P1(vJ@tU z4k0Y36O0}DOqeznd;Vav2{W9I!}+`nncRRTpQ^P~s@sjnQsZSpHC|fpzN|7R07EA+ zDC9`BeJx7P&m?EbB8KODP8XUGPRGc#)qxg8cva_|A(IyU3MtSkdwmAEle3`8v}6{; zN`IFda!@x4RTfA{R&s99`OOTKV(B&cAz40H)qUP~!b_WEzC5#CmCD5MG;&5z6EtVb z5AG8cLK>GKx}F0RO6F*$SUT->qNo)Z7*%3G2#Og~QsmYW1mNX&uiu=XUY?!5`N!$W z#VCg0!qo$~c=N;Q>(S}?+m|P&m!pg47k{Uhqtlb~(~B5_z>a^F)WV-12*45igiz{| za=rkCHrSv@K}ci0Nf(%~Yys)gZEJ3zBDEDb(iwuWu1c+|CQ|5x$x=Jf$yBlgotK-b zZ3b27{hD$ufr&&}x6pRQArk+uj0RN-kOCTg)-Y#g3Y;0k(aEk=`37{EOl|Y8n15i_ z2SRw6S;d^VGa+%~@&Y74v>6{5$g{Hri+LhP1WKX*MEh% zbiGGNO2rp2R@B)hGpOM4%G8g;rO=!iH`+%4kQ8MMohZte?>XjfdUd)_U$JEue=kwr zmV*eH;s`k=Mk+VD#7J&Ky7Mvk<$qT~XqGX-%)%9aZZ!Pwqh0a82IuzW6nTM4ho<<1 zRA5j1??;2p_1hy_N-LCJ+MeS!=O3w0r@yRy7@jhkn8N+6oQd`sA}2>3`ro7*&b{ zhCTPl@==*(>>UKHl`tD3>@(S`gi9|fMvM5oOc4UVsHsZ7Oj%+eaBt^QnxNLqeS%=Z z<(Tr-XaD{cY^vi-ccPFQ1X_352J;2{UQ*67hN;aJoKZva6Z+1&`o?zI8d$>^6IyBn zEpu#ag88Ay81htuO}!kVqkoHpE(U%%Ubta;@p@$IGBI(1=c|ys%&H{F3rVEgvs#8c z|BV@#GtO-eSK18DMO3T&QrlaNdX>4X28(62-8R#jy3Vx~ZsiSJuO$7i>q`9X?H#V6 zXKfWPB|P^g^USrbYhUlIV4;{W83bSG))zY1kmlRH%M`fodCeCagMVyi^>QU|2iOht z(rbJzmkr-?upLKmZP%KX_s`4yW_WKidQKCB;OhW_%iwO)-uKPTVXv>goxZ-V7r33V z`|Xe>Ok59Zp`H6v?2;sehmoOk3l{x=thCAK0GX-oCy7jQpAAd}rA;F1sJjQ<+mHc4CXi zWY_={|8>c?J|S5KQ>uT!MO7JsO8kb9UECi&1Y9PRPo*}&4U_QZ{%A}Tn%CFirPtn@ zbE8L0OcZJz8m=2sU|q!~-yVi-?LT+6a-jRBoAdufii}NiT7P`fX5ha4|L(BAng1Vm z2Z#LsA!zOVw?nR&NMks0!~TjEBu7J2YG_;^P%fRsI*j*@Wr;56u0Z8JgN2kz%+@|p z1CScqE8#}HMu_^{Hv3Pao9BOu1(ypq9G?IHd***{*xy+HccaeWaQ^oo)SUmcD0I69 zffx1I??8cld4KI{$>&nrTS5dtweP-9ewDR{@E({*Q5fi333h4gPY&Fff?h+H=0SsR zPFH)AZo50DCYk>D@fr-h&}#ZDg*I$w=@WYR)XN8`dI?~2Gq(-BwmWfFaz1kToUT{^ zHcKjnypSq0hxZ^hn`^8HJi~HL>~6PILRu@&XfE<@WJIAb9V##+UUmerjg{@HX-QtcsK7&Uwn^AQ~)?ER) zIkJtlLo>WydnmJIx^=VpMz7^wQ_&qMUK`+Vslk@_S+c#=>-MNrn;KJW7^?Qywd1ZP z6-pYJNPix~#mQNtjI$XE)cQ=xF|M~~+xZU7=AabROk-&0XcSBIW}$0;OTz*clj#T( zDN-Fnr>UJnnzGNWLVfG3$933bH|Kv9Ab)?_Rgiu6e>+?Ee~Y+H>i#OZ6#6&Ozf<_b2Qku|2OPM z8-MHnZnrl);QvF=PW(TU>5esja5rdfIk&0qw*~hA!8>lK1=V@mRLZL$2G^!8lLWP{ zA$xPVTCEi36Ew}maSY>9FUIm+z0A#XYVGmMV_Ws{uT|2hCOQWAz#oM?sC z6-~9eeT_3ze>t@7n*X6SDw_zY@Lt;3H-G;J-R=9oy~F*V2caW4qsE{T?y9aIbeK<3 zz_?^QWnuyaO|Iw!b$tU^mxW7lKu?i#w|C+9&X|~d0}44cY=&+b+W1aIN{&F_#LZv$ zvQU_@cbNLD@_)Vx;f>%6kiv0VmF%L_U3&~k_+oT9GEyNqg5@Fq+mjKbOlcBMm}_af zU#~t1$A74{`>j4qCvE#vz3Q20uLO;0a#a@Y?vo}@LOn0YlWas+Rw zVzSim^2MnpVWH%2m>3eW6lvSnQ}QGMG3 zN<<9;EC9+;o4n8d1^_8hlw`?vYu~-m{vnh2vAb9-b{D|XjLcE?S`rl!8KN zK23?#!JK65$-N;A!*JN|+rMELHve|Qe(y=AKN$3nI)lNW^M54l42EI<35542y&DRp ziF^{?n^tph{~WDNGi=)b!O_9~KL|9<`yI`;vD#fP zp;J^k0+o{PU>F?_$*?;}Fg_j+;<(%I91ps~J~=u*9=@6+{T}I)qt5a1c#?$UK6bnD z@o^uIv48*Ss5d0Txa&=kqa+%W2>fo??X|*gD?Iwx38P*Z4PFKPVfSdz8HD}6hn*-4 z{e!8xHEdh|Gr|f~e@+0nWBqs6*Z(l=4-f1AA>b*T;e-@SgPU=f2w8>~ms(sQzf@XC zGR44q3LjIdfGQyH)9ZIXwkASmL~Bf}X)q1WFn?x5BFu=SWXw>RIBkrO6QwW#%C&&G zC?sgiaz-?&!1E;9(Bo7TTu0FHJerXyM%MaFsnW*w{7z?6su>vv*VjcrMZ+|?fUG4G z)vi6p$h9QwvW&tmD;5EA@bLDxAjFBnB4$1T2 zs(%=x@WeD=NM;Dy zs2efr77MOoDhg#$$Elz(T20ldA%ik-x=EN4KzS_9d@6`j!ejSWY6Y_3AUGhOQ7L$a zyxcSZqgpexxEHLv1XaYTA^(nYY9=p$w-ckikO;UYd}SoHZUuLv)t0%5U`$+7K7X~? z8Re!4Nq#MqtqhQ!62v$vzmA3lsennjXOwSOo(|8Vg!f?@CI*aLX`{_@?McONc(x_mvl{QmXZ zA3uD0a}k06Jz>gd*p!JeVG*oiT*Y{pM4}PMV%Wx+&*8U%Fn>Csn3zDp3ODfng>JyMy*9%(f>tobm=p>@i45VNiB^{vYs#33 zOU@xs;YKiHY9ZqzzzklM@_*_WFVF@mr z*j(oYuPdduW-ynO>k0VZsMa^iZ(wtDZ?hD(J+J6vZKBNzFL(83lI>)dn&Vp8aQGGz zZhQG#hgX-rdoItP;fsmz8Ho}6zx&`{`nNLyZhUqvJD%14JiGP|>3Znyj!5bz<7QJA z7+a7c%L0|QtvL4UU4Kf>c3{k-lD>>TkxiIL0xk*1CLw-wL6z zZqYVkaeODO@qCr1k=up9`g(VAb`_w-Pb6a->$a-!?x{>fMkwECZJecshKX^dWxv%W zN+*yK^-r8vjlr+bH;`=V{q?KQL`+yJl=km6CWWy?{eGJjb$=spLT!wS@~K3n0?kwn z3#_tP@3*7F`UoC7o;kqnV0Zi<3qGOKjO2Gd4BUDC-y1gL|3N1_#QzTgEBC)0?~3vy zf>S%???~=ts7XRJi5Az8PGKs2amrCvs+?@{N46M@&8RTdj|A3@)UvkjdR7k&w)HZ# zwO)@c-G6`By?_1_%$b;H$nTsEvSa=ChT+=&|ESwNtpA6A`uZn%uG$MDaJHED4OU>E z_;tC}3)}+U%SHfH2k!gOs3P?Mz5wM3at(ch#cXZe4T8N}P%9Rre&OIqs_J~x9(89# z$LWvv<6`I#SIekGT$7`Ldye##qXAHj)&S*HpNeIU34fGOUG2K%yeI~6w=IjK*$QHj zWyI*g&)}=nhhJ)SL{62hXvO|Zcz&HyhUWFzw-!q)W)xZ}JX_l2%VF>6`10fF`Q_`g zvkS;6pMK}V-%h|k|M31FKK$}ukO)u=F^8^s=J>oMX@X08O22aOa$YbtvH_{8q)-l} zRl(pWVsE&VkP zbCgshBa8)4R0N$mcM?fLADe|m##p^eeYGrXW_3lkTs@ucQvcRgY5m%0*=*%9Y46p! zwm#RWRX0$}9*aAvyV`&?8ntV$C7JqN*j*?+w*TK9|CN`>_ecfVmH*r6b`JMHj|3a{ ze}CnP-AdfIwj3(GsAUQ`{cfZV)Qm3=F3usah+|Z0 zVX~Whx@uo>Jw;vLK}Ikx)O;*HFZP1fR`|JT`n=i-yKON1{QUNUiMBfei(aBpOI>XN z-{TDBUt(Ift$&v?S7v(O^J}nO>%Ti#i~oAV!}A znYR@zhy_(uy>azTz{ciPe&y^G?_NYnUXJ{#Yjuarz<3vnJ3k0 z(6Y3YR_$PSQ~h%6D<{CN@v6*Dw)Jc^XjJ35k**n4YZFaV(ImA&1ltJSl(R-BjUlb& zlC{54(KpI(G;2=dvx@l}lI|)rH+0;Uwo@sxOPzVW3{`7dT|YF5PTVr8Dt}imJIVx{ zwNsW-?Dg^!2)4;@J?E)D!yA)?HmTs|Y@!Xkt*FK-k6EGgJCswKVR@00g>#}cN^U>ZbW;r1DRLMWlqJS(=On%&Q&fvDKvj|3qis+rGG_0BUCspM z)0ZHT5lv@kFDq;1geTrp;5fC07rxCUPUvS$oWJ|qcL99hYz~6ko_~fVFo7te90M;n z8(ogHkmx;yGO7F1=?D@kl^0B@ZrfkSz88#tmu>r76{OR)`KeyjjJKDF#w5Nfa{KLz z@?He$I`>`#V{+xa2y|wig``vO#s7Lw;S-Tm6bjy+y-{9J{^t=dpb3(;Yc9pFUNBR! eNU(j_vmW382l#h}{|yTO0RR6XW9JXzJMF zN|72#IrY|l_Y0DeEWhfc>22-+pFa{=UOXH;=nY4s;Yn{au=9GOaXfqg@qgV}ABIvJq8`L|=C!HZ zKLkj@enzF46bUT)0V#^+XV{D4Fi5dLk)ogsbrN)da7J_jd;F$DWu8kB00@#}0?ki_ zh1ASQwM<~fI40e06m^^7Ma}fzany_AAVp0TD~x;hDnlrg`~#_hiVqlBJ=P-{u9?Z0 zfXnl%Ad{APW`9hflWzC=`Z{U^O^G2LjcUOt>PV`2H(=Cqx#4V<&%2s3oXV&W^WZfu zucbwlGkb@CF0wy#ob zO!jzqviu!e`)tNJsmD7mIynE%u?p&T2=CATT+-Kf=W!ta$AjK@GyjiHj`{zSz-D^?z_e|%c0Wkj9JNV6XQV$G zC#PdF?vGNWr_&Lo{bBEP)E^JY$?56%@hlw<$dH`$PEV(^G@cHz->0XiLp;UdQaN9aE_D{g|Hxskts)Q`+u}4LP4~~6qqm)ma5f)a??0A@c+jawOVzT1CnEh2)Gb6L`X}$x;UaCsX9wibIMbdRP;)dF)eHBE2qBGY2c7C*+w2@ohNTl@lcjc~ zX(ky(=cy*MY*0nsHwo7gn4rq8rv{o4LH&PaG^kR56o6vEloUCNYSRFm8N<=hZbbP8 zbV)PI{y7uOE?xxBX4ZQlm2geOnkFr@Qh05R6K*Csm)A_p9d*uxokG$-O6|sT%YQ&1 zMXiZie&h64m`kTU0xcC^!c-Awo0&lck5;CB6jelXX51=01OQr;3H0JPuYTv4yAbL1 zA3tZ6ihq`Wu+IrZW z%PHXrtW#X4b*%rlhJE$FNzmO%hP*(fBU5}}D{!Fx4}1N1z5e&(-pR54e-iln@9tNy zV0i)>jjQ9fQhb|Rv(O9^_^SKvU0`PgPu~@{D$*|B^>?io6mNYgSTK*DJYBw?vdqJ@F$knl+ZOXB z{8T**oDzUcvQ>(q~ScCNVm8-H2X-rickLNQ@x z5Pq&ZpX+dgn&*3)P}ujp=8vs~wh>g^)C#jZTZ&vNbXEf(Big?rU&Ti-ud=g;ug zcKDo7gz)PS!by0$6yWu9vFv5mH<#JZ_e8f_cYj3EP8sh{b&<^l8S*^RS=X84X4sYG z9Qw8tOlV`fTSsf%OMhB{sd%~5&UCph)0N+a zz;?WQJNp4J@>i1conw1l`0!GuGAB&z%r-t#!$yknZ!5g@5M?vSi2f0m^<)TZ@*6~U zVZVD9a!Co#q&DH5bkax_niu=BsMo+7bwevA<_fir4A(6xuzxOQ8}9(Zwg&gz&m7@) zaJc`cQq0&qC&dRJ1|B^BAB;Eq|4}bK_Wz#(*6x3M!D}Yc1kT)&KPN?yqai6VBx$Z8 zy~EW0;+>-!)CJj9kKAjpIisf3J`&hYQmfH+=~+KC*oS3DTUhsP-T!?!9RDd6TrP7I zAN)DUf%qScvo?f54}p}S2IIB(W{M;5qA|GL`hMLvLUlp_G@1NWQo zs5|ut-U1UT3Ijt+#cpl=4T8H{&}$i^ec|9)>iT@s9d+l#(CnwXNip_>>oBSax9n)) zj+#F9JOFBKEil2%nOuEi0u|I(yFQ$o*8u*ur8%0dfq%+8C)N*sgHUH7{N5TPYOdWt zhlbz4qw9=uv_C)l!cpl^&Y+XQXRDk%84pfQC$G*fCQr`KFQH&!{$&XN_br4MFJF8g z!tehNsRYdt3+UTtfsZPdwz+ht^lJw%7bWLct|8U66)II)BP;DKk$QsxZ$WHYu(h$N z)!%Qz)qgIjZict4Y4GfCsw-u%BYopb)wacU%N9R_2ZgHz`pjH^ooz#csfGr-a zYp)fX_FdSAaJujMf4KjvE|Kr>DafJke|!Dj@&4zYVCVj?I|0fXL+5|v(QqUG590nY|9=wLng1_j zx?|5D-aa*VoZHls!jF`KcYK`|*7s|flvuCB1RP&oQi@tPDSLBISMMvX=V;nH$ONXP zUQXqkW-nN8g&*0ekLsQ|l3qaDH82%fOJb!<0+c>iQTc2W1?V>-fmSsCmT0I1KLDIbz*QP;S^srd$GiYgS zb3>6@l5*sPNlBJvB~H?AioG-cuqFPO84hQLGvtVoCCWiZiwoo(rG+Fj>>kgF z)WMRZ?7_DvVHk${dwcdj48!JsFC6SY=zk$M5(CY5iI&1$+GIz?**anC72;kkjE5Nl`Ga?^=LnhNd# zaFSvK)vLrzD5`~AMlhueqi#0{x>fU{#Q1+<&Gb*7?j_ww>Gkf@Nzc-~2fCY`FMkh88wV}s^~y=gk@ zs+i(L1R0-s7r3+p7{-*NybhRgUZ%i~GMIyYEP_7B(DD4nT31tyvs8I%Uq)Pp7 z&S@vjktUlm1VtvK5s)ln zG$w}KUbPfqFbG2LdrRl8{MqFi`_Dvt@l9}SvH#(qw`u=}{hj^4kJ2>nceLEbaQD50 z&QR$H)SUE(`%%)1U&LWNnZ)GfkQ`v|Wir9(Fzyeh`+NQVWZIAS2mR^ri>eU9Mv~-0JrFWe>mth^?$EF*y;a$l!tJFQ<5_cZqcnP<%D8vg<@O? zMc_Sz4|A%3Dj@LF(Yv>usgNnr8WU?8OotPU8Gn%o3nD3*FjSxgOwf92m;mKkz*6KA zG^QCN+IVZ8MC*SXi=68SdY(s9GQ-GPpBYu!*q-0%Vn#J1li>0)52$FECg+lMWTLvY z#~8VmgpCV7Y<)f+fF`pDBr+t*yksI z!hcx7OmH+rU+porj?9SE9Wga_R-&ECl@6y}iqhrtylKvuG12cAC?!p~EK#4@&40zMkW5rZGu6rR38S%*g3^P9KfZVX58+=3 zxylJ+OOR-`9OMabp^Z$b3}ZT7LQ)8CHQELSS^z_`K+r~Di4oXXa1~RLD+@ZF3mO;k z#N41k893=CObMVomPRNP#B;)9_b;^qnR5^vkT0kdJVmY*Tv9y;Mzv;WVOOL)2Y;2v zbA$dJ<{iC$=U+UJOsAAny>!hr{yG#1RmPman^Sma zVLykFKMt5%?dB(v6(XjepN^DpAeH zw(>9IinQ+km38ip=g2aYD$v>8U4bq8|6aI1Z0!FB!`=DM{gglc=str5O(RgK?LKby zi^J5gC7xph&$?f}c&3;4>QiQo>l|&A0AlJaj13mOqF=|DWXcizRwu#?^r5rrYOQzR z0#36%K=9EypY>f1K7*DykAGo*U>|8Z%BNHM3H;6qnAsi7v$vfJ>tK{4jkRZag5bNb zrfhwZ&{%_S-_C{5enpzC0)NKDgs@e$dw&W|dMxvfB@&H5syUmTdQ;IB6V4N>&&C%|Hc7OkSGFjS%IyoJg zzLd}Grt>uL-b_pP#{r3jJ)J7HJ6A__Wkqx2!`a=`5MNMxvvn{1meq36X~npvQ&aW1 zvcrw!fvFXwM|LjJ;mt*^MrXwq2PHUnJadC9TGwiCO<*P|*HiF+P@Nx?-+<=u-bM+o zdR`O8+A15xE`oWp!hd$93$by%tRsBW)wVKTa<{J;C)kNw+e zzMGuYVn?vLA;GS*gShFgyEBoxrMSkn1xEkp$kIT~yOt3*7+NsQj@`shxzffBwSd+o zqoz!blSkD7emkt{#KwTy81fl@%Z0|e32TLt5>95AbSBGnntw{aYg5M^hg}0`@e@f| zYulA#yJZDk7}9E9oLz>7O>wowxOJVRQ~_6WhR?|d7O&fcH5K{C~KNc)3>msbI5(sBzTnt#}DfwnrSSdA{K>Hw}e#b|=9 zIR)l5S2(8J9j1(l8czvhVu8{j++3)j^@OE{R{}arZSlYF_`v$PZ{tt%3 z4f{Xn?e2f?rPS>|$uiZgHi46B>05Sztr5*C;18U&xX~T~P+qufMNo!p0el9^6XY89 z3<#BB?0@c#?5&bovqkl*CWlXz=hD`or9{W`w_icRzJppSPyw~ZK2yGCjxS2vTh7xI z%BemUtIQ%ON_m~{w79AUa5rr3_`Fsfi!>!>?SBSe&3*W#)<)z^*@jN+KZnPcbIQ=X zK6+xIbYe!KGlxg3O=@g*rtyd4v+>c%$vI?{&wrl!@V7(o&)%Q@!-rq~2ND5_A!g7w z&m12YC@T+P?a1vcXKZBS6IF7dm`bf>HG2c3j5Ogh@FoWvn;DenJgqETh0A4Zw82di z*cR)4{kdb%GW@J|`B)FlOk1$JnOq-#PB|Krf)B@MwKhf<$Wf^?DJHm% z&*1q7>L%?O(entpDQZb$)oir*Hz>?dQjv@>7CccA^y<_}BnkcABveU)^&xdVsqAEV zox0MSUVkNg8~Rzl;#+lFyZF1YUT$dS27k8lws19~x<9*T~V&k)bB0tg6Vtj z_M2sk|5xM@d|fKgw)nr-3peincKLtzQ(EKy;uv?$@7qw2QZ#D$B2MBP2_&`i-iE8z zP{O~8XXz4ZYMXS)3De+k)wZ=xVX0gCn}(Wgsior7%zE37wzfg8d$8Z)_M#om^?$bz z-&>A%)=+W#|=w8Z@WElqRB zicOi@=zj|n+>)K>mv^mmAujv~EK-%nF)CG=>}F(F#u%3~)b%(rf=RBH6Y;5v2+M%@ zvFZA_42WGY3_m}mn$}kR4-8M~j0=h10>?J}ANDuC z{}>$X?tkv3JcKi%HA-$%wcVP#G|5R$Swi^?G7?{q8LBD+T;-W{a6rwGF?%%NPR=Nw zJqL-5Xu3cfzSimqPrQe~ab~p_o@5fI^b;n|tNh#30N!)91i|e{Ly`$*ZGXaR-~}h6 z@kk4a-a{x7JU$+eAfZxu!Hnvz{dMGf!Q^+@wZCP>eAYET<*Qoo?h4R^#20yHbKjKr zEKrx3_bix@3-4K=)69GJ|K3CRNF)`xf;T6xlow=D{ED&m0-7M{x_(mp>IDlGiv+uW zA#bQv|6R6o@tM!pe+|4%|9|_#=Jy{52ZQ~c{@+Kr=KJ4X(A#f*je7*Ik)=gW*i^_` z9-_DQ>Db*rM`d&(iClV(Z_BMKS0TJEd6`ZdQ`*QY z?*5>nAC%wd)?CI%C4cePWM7wHt{J#3owF2VmsNSR3Rr7WT|YF94xJj6jq4YmMQ-NC zDQm&@di@~;SMhH%7q-5_t@)#EBG{g2+Ctl!XspxNlJj)~xNAV}DoDjS^aiY}KOZU9 zQZqGb$;W+E%a)A}!EepfZLqVw)nK@W;a6wqZZNyne7J4=S6wLNpDIudX547NHGH|A zH`jw|vvqBT@}{g?SsH(ho@U?s+W&9h|9$mo(AM*x!LXVC)fuKS-;|}I*UHGmgQHH>SBOfB$=IHn>0v@E(U|S1}z;~ zoKU2Or0ja8y}$i}q$JCa)JdC7F}UW3)FOEvJUma5Wn_VJ(9z-sc}Hm>$rQWC8Id|z zkeq$@5G@SD@L)K!|At|>{%P4R!ipcjN*f-07@(6;YghEU;$R7kKC6%d|4L6n*c znJ7D;P|j$KDu3`YVW?+X7b@y@=ks|WQ6Z6W)=7vaoo1$x)2>HjL*|aNX+G_$nBqhP z1)q91xUdWu!PHP*2MnCoX*lva@CR~{2rnm;YeG3n3xYYJEP?_x${<6k)PI+pcJdOr zGF=Havi!-6dhYi&*?UTqGIm>3uVqSgR!)Lg~7>6o>I-5|dXWa)`ZG$pq6;+#jU}!+w8~_Tz&=KOMa~?577ueH;#xVR{%& zCPy(DPJa%E-V`}XqA`iU?}zt~EyOTxxg z9=5t34?vS?1QHn%Wj>3Nu}i^dyolg6o0Em|JVqwSl;MRGMQ~G2P;xYEQ(?SdAvhYQ zZ-37iw?Y;~>W)Z_pOt8ra%;kAx1vt@JTEO7GcNk=45g&WZONcl;V_K5B=4A&CZ#;P zGz%3{M{pEc5y&a(%c{e65zd9S*`QrFKp{nrI>XZPu3||HLSM@gea}mTNopftA|@;o zN_&(~B`OQ7S%pJkEKy(B;No^jCaR;E>VFjFgwfb&L7lB-sk`1q&S7Z;~*BJkfCqq}xCH@?DDqRPg$^DmQ%Y=4dajd$*j zGh_uy73kv2Q-K}ve;6K&*5d!+Xn+3mIPK3ryDwly^9U4b8^=w&_#ro9i8GAgMfcMu z&&={pKNQxvW@xJf5UKMpwpjG4c^%`DDM#?PCJ_eEht6`U_1=LiI8Atf;Jr&e+ffca zf|ezZ;b35Y()_wiQ~Ck?&VLe_i4Nwsx0?%_VAPPt+p{u3@LgF`k3LIitiiWmS3+pN zVa;}dKV@P<*s|MwKZkXGtniK{5{*EbHJeDjfZt2PXi70LS%MX7;QbrjYVCY&)@($q zV1h9z6@n5u!oQk?!fi%MktGUD@@2g_+9+t_-?PcWZq&)ewV6x#)PDw@=Ye;Y*6EK! z5(|4eRfRj(M|I;xOOwOdXlj_RxV_uH*LllwyJ*@7Zat}K=G;2rPWr&q64Uo~Ezu8m zSGg9SjaVF(;L6F&0XMv^^xm7nLQ<|%@c*tle^>q*Hb?h9MsVBj6=iJgvN7zcm^V9Y zce+v=H_Il%cin9Z;(y<|wzlZq@9NAMKANnakr=`MhY$YPzn|s1#aSzM468db>?S*m zo9Vhc6KQ*j&-k{$*nfsB4^-B*g17@{B`^!SNuP41O&V$ut!hTgn4BbEHwXCJaWyA4 z2Gs`0NBF%I8rv>xE0&yaGR34bS*-F@=UtmN?j-C6K#QMA&VRO!-Kw@bcF>g}TiuKE z%dqBCTyF)pYLhgDjHrL%qMi(XjeZTuHt0{E{H7N2zkET_pa^hTDQdNHinyD5R zSmm(|w*z34{coML?AwF29r=GOcuJ=^DZb_~aM%5BfBpQwZ|3jw|Ho)6_rE>whVmqW zW4r6;r0{aoB!3~AM9oE{Qy8l+PC2R(Rgi5F%65bCB{doV<4NqP$um=CoTHrDv}-P@ zMtHX7wm&v0o5{zYH%_Z{MqpEJgV@#QKb^k0JiQwK^!EB)#m{NNQ^rJ% zQ^J^-p>zZ{H!9eA!qOu0t*znzU)$mT6D*im*uDGm0I_F|BB#m@bYlM{Je_Bhq51s&nZ?qH8HG*;-!FsI z*hHrByW`98>ywi!C@7yk_u+3pfPeY+;-5bJ`hQ=L2v7{MfWG<7@o7b}$q-hK+%8MT zu5EpyYAIApX^kvbZ;;fLCVT|GF2S{62K715RuL}C<+?W7kfteYt9}3cxnr;e{IYfV z*e=b?Sg^dAT!lnF`%#KKYISuWu9LSbOxq)-xwRBhd|2EQ#${v3XEP%23A!y~tXm;u zdwh zEorRQ2QB>#4hxi2B-a=Vo~Q_VZSEwJgnnxlnn!|dkhYyPezLw!UD{2rzf`^r`)ptF zEvKzq{N33uH!O35T76r%glO&$zts9SXn(Y>D3@f~_m*Em>03wp&9)=|tKJcO-BX}l z^?$DyZruOv-~T;M+gkru$G9tb--dzIs?mBc;xvBk0ZHq;cP&+0Gs3@0X6YW(w1RXk z2{YhmwZdAb^3+@An}L>ZX+6bhx%F)kZ6!diX0Q)&d$AqQ=WijtwI1)=m$e=KUw@<0 z?r$d+oMUXv`o7U%*Zc2-;b5))?+?Sh|9_OW)&F0LWJ}HO-_tdBtlHFX8~ulH!CPJ@ z`t@CFCd7>&fhDTSI7X!!m%U!u)iuU^in?7#MldPWVj?~?6=7WvKQ&XI)&;REhT)f| z_Y_HVdlay^B^qtibs>0xGnD^X*MGXz{sSXZI^{y*L(te||D*oK|Nj^q?(csdr9FX5 zqBTlxpK7~3ch4jzC1nZaQz%G$L#C*j7vQQaY=Q$SL&ogUfIB&(eEJe3GNS1WZTZ^j zCp__<0LQ7dUU*hWOz8(qTvqwF=K;LsYypB>NW+pTX6=L5zza^U$Jbg&^n0E_^}yr( z@iin=DleE)-L-!m`(7~lLw4=ox+9x*&7b;H&3Jc-XhPzfvaoO8l=mV~^TK-(OvsJ* zBG7r^z4%}63A`tgic-PZ$*J;!LW6orecv`cb^UI+rI7FU!eV8 Q00030{{gT)!2m!205BgHE&u=k diff --git a/rds/base/charts/all/charts/nextcloud-3.5.22.tgz b/rds/base/charts/all/charts/nextcloud-3.5.22.tgz new file mode 100644 index 0000000000000000000000000000000000000000..b05982d34edd304524d39f7b11d71f8fa67266fc GIT binary patch literal 216225 zcmV)Dc zVQyr3R8em|NM&qo0PMZ}S|c~IFn<2_Rn#$aULcEYU>GLxoXH--kc3}`j|C<<`(&~p zcgwayyVa4@fHR)Gr1v7;EBihA>Q;ZcZ5U>=q4(Jd?v_fWQmIr`DwRTfC%k~hes6z_ znCMQ?B>0a9el|BZH+Oe-)PFZOH}n79dbz#%A6q*+ySqEvJ3B9S|6_CO`S#X}|A5Vh zMx^YCxj^hcHt*e5zH@(&2SwyZ%s8Q8A8xi=D2kGw+b_GD-R+i-BOLlT^a$qtRtG#9 z`b4M_5#?gUF#j#+;t&l2?6&|yG{Nqt768K$6yP<05=wgt*!2E_ls<+6T}Ge2Zbih`}?-HnQxC_pYTF!>h1m7+U;&_cfV-)n0t&w zy0JYNk^loABSyjzaLjHn12IMdqF8VcV=QqKj0S*0A2{}6M#L285T-O{KySkqfR6-% z0rIYago5fXV-)(l+Zt1ezC|^e{|d_%@gx#SKm4%E(Cvr__0^}|HD;ZF3>acl`IGm2 zJVY;sL+|C*_VcZmFOlc(Zu&kR?&7W8f$tA@zuNJ<=P!n7L%o2GXqVrNTGx1bOPQ~@ zD*4>%02h>@5pH!9BCQVG;z6qe(Ku>N5D5h$A!e!;o*)wRfnWa`20p*}pNLUGL-|r7 zoQ#$Ip4RZjjBr6v*d^fzhhv0B|1+X=6yQQ-RWvD;g7_5=hyODmK|m(>I#a{GZ0VnA z*Eo%tr)QBR@ra0VJW%9KDKy5xWL_CP7_Eexo_Ak#x3^o1&i}mp52$zj&@yI@{NLQ& z+9}BY&7CLt{}@kRx<9=1-rh~XKA42w+DTwOlpKEE^2rEu(U-D!`^9d5d)I%y^L!V3 zcxP+4IUL~4O@DLi%N=ja^U=%U3(xZgFa4dbc6YYF`f}SF4u?Bm4Y#(Qds|!H=J5GW zYlK70kidQ)+S{Ak+nue=&hyQSt*!pfm;J4;x-WNLJpXFz`ByLhvbojY+-xsAcOT+O z=l=}~V$45<0$4x)pTFGReVL#CJ1@7N=Ko_nD=Tm^91@S9AYG_{Owb718PZx=0fvX^ zw33UFUVhY+Vm+%7q|7AHi1%76D=h`7pPQfQiU_a*0*(5xz0=+7KJTCid1KrHh~gkP zr2+A#eK;H*Q*p{L$DvR)S2z>F7$;5r^)7Gi;Umr$*V zc{KEJBzRBijKssd6Jl{o*)<7AJp)q@iT+zs&M38g7@~k>60zEItvVchk;*`qK_4zvDjae5WgAi-~}DkSAMe3l`(HF5_V)IujJ45oWTK z7sOm()*+n7nDrsRg5%I*(@1n8M*aEdXeGMCLlQ+;^kLR9Ok>pROF^%3$bk-ruk07q zh08JV@#PpJA2ayh&MCdc4EvpLrb#h|Zy6C7{?Y5+;vnc;hx9h=-QvMeYK#neB=qrJ zHyTG31p>sy9B3i+F$ssX3Rv>J0jx3QqBFq)K`)920r4cXzZ#Btoqk;eRQFd-!+Llf zStNlMP)~6ayoL-!4>8|IH}Jt0lue76h46fH3!ZUrj3>C?>phcjdkjygz=|3^x=Db4 zoZm|DX&Pa4Kn3rLJK+LHa(2sqU#0H?I=T$0xE#_r^fPP+fIJU#ei_hF=0mZ?f5Ja{ zYk%zzViNc>fw|x_kA_1sngwJqd(Qj_F)^J9Jc$A%FrP`AaJ}c^=HqahL9MbC6bmZb zm{HH0shKzaIzL`aPL&@+EsOe5TfQ-+7+t|g_klDD8~6*JvUI)s1>u{ZSs3}Z^Kd27DJ6^LIe zxvK!-PDK5V6xzx@?I9tMH||KQJ5W}$0pGzlI265B@*3kVnV`_`!_U9y z4-B6R8o94q(Ky-<2oA;f62WiDU8y`*2C+v2(~njwA)hQR$=k1>Xv{Iw8aDDLBvi!Y zT-xi>Bu3!~t70oF@Q!0ZA>cb{Q7fN?99D^qd81cj*1 z#?=9;(;AZHq+9{e-YMJ%&I9u%QhnIjePMp1Sd4|5p>I#VJ3KaTHRB}+xV$I-QdB+t z{uK5zlXyr1tiSz4fWY70{cKh=*67%q+APnSa>}t(&g0c`Y@ynwBl(LUldl< z=nSJt*N59N4vof<5K(F{lJw(9BbBO3Z_Eg5LE&I|cyxMlcCmMS(N7SLIrf2u!4!z{ z=Rp(;z;}WnQ=M-B6=Te93C9WV+{)S>onSS9t{yKq4u%CREXBCuwE+gb5REZ&JcBh} zr=DOK_a;c{WxcK4?q*Mu&&Wc_pSm?m3Nvpms1iun6FI(3>H&1eLN9>{NoCD5Y2_#V z&B*SSUc!CCyZXIctuvMP^w?%4z8rL`*u+e&IbgV;6EQ5rv?E_v!F;19=-%mm42Y}s zG62sQFA|U!SECbg@Cn17w1(`snrcyHi|-_BC{~RHO*(^>C>S6!f#tV~`sYU%r!^Fm zv$?G46*zF%PjfGL3?nSdNsxnOp)&SotSds{DhYK6I+pfE;3FN4~pDWqRs zax{qod>M_S%Lp+v!2&bhl`XGK;y{onz#Uz*qh>1!uoj@ngjAS)OBvuh1#3fEXwvXH ze=f%{Vq}8YG;u*M(vRnL{ZMr48Ss||yvCdpiAcx1>lo#^!=KC6jZKu!BW<@l&kR*+ z&;b1RU!!r9{(QE7a{TS#ckmhzV`vI%jxq(SbRgxUY#Fb@>#ud0Oc8)pWf7{+tMA{R z?7x5it?bMD_b00Ixvc#D{rU6Nja)s%MzOS!c_nCo)j{lCW3j4!$QCBkj(N3FD65!T zah`%G8MIjF8c$d44+-$@?ydxs)-P7)lwx>9Xqc9Yc?TmdI$I@WV~#I54^~atWcDP_ zy8F}lvHq&1^{8{fkieszQtQwMUZ;2R#hZx=fBBXM`^G{dl#Y`L;|@OOSMb&N_S0* zFC5+wMnj1r+#p6|L9TRE!O%f?W2Tn%DxaSm9bBFt?4KQ6Tpk?%Xh%!=NWW!t;@Bjb zm43j}Gdy%n70B=YIG?VS(x@t4UgK%Yk+UQuB31d!z_B>wFu+5~u;K*Z(oE=D{0~DS zms-0qX3d7AH$LrfI>BO0!jVNoJLX^z^XY)z*|%O|VyyafbpuwDdaJ*1SP z1etUFsScl1^$zH0q?EiyIQ0f3?D6pibi55%y&aPP!+(ObOQAD_c8|rOtE(V^oc+y! zj@qxlr@#Y@BiNFEhxio;L;~o9f7y~S=7L!LCE*1c#1ni(1`+{yZr3YFvOlRy$}R=guE#ne|v5a)Mht@V|*v} zl~Sk}h=lM%I?dr?Otdm6q-r}zl_kB%AKVFP00nTKtcz-_e^gEI+~f&|i3J}Hd1k7} zm9h`*t%{nw3O7&J52kGos?-unAsohV|6hf>; zwK4fv9PaUB8lF)qjFw1lWN&l$rJh(_MH;Prc>dgd_Z_2glz(Yp_uVDR(pG*@tNWA- zJh7BsghV(LL<_0z{kj`b|NQgySdCv_FCc%Xae_6+0#FFUXkvFqfDTp1wdE+u;Fw?9 zhPy?fuxh3P{GVm6nq;RWw^w4E@SyieP!N$&FOij7B#FwK*j;jV+wDjlLt+hqgi)n( zFBM>%XLX-?N{vfR1yeU;U3f7UbYfIdJ7=Y`fZ1ils5Iy>2iSVm?Y7izkd1{%lyb>n zxoK0waQEb{s>!6fu8`1#c5ty2i@A2=S1GAuKgqvk z%?@Q95}5+FW44e2ZHE3xD!FgI0TlyL81}5f@3?wQe1r*|u#O%QCLe4J$I42}{AtAG zPh%{`QhHFc-3iDBd|20~@=nPqW`ODM1Mmkh#=%76Y84ia1mVM}Dvu(yZK{1%3Hvep zTTB>MHfA?3Yz+=VioQ&9{$N9iarFg-KICVBtes5G3oW)$2zzhO4))&s9o`(AzCHQ- z!JDLW79R(!pqfh*{M1#W7RY>SsZ1-Kc_`L?+j2IR?^92G_I;_p-guJoJP&KKoi3wP zSjYB;YPuVxKSN)?GMm_PG;Cq*f*fEVqmVM}D}^VWATWt}V$~=zT;nOX6zs@mJ8477 z>$IKZtHQz-$jq1AoQ1a1?GW?EL|{*7KeRxhj{+K6p?09??K;dM=8`O@_Kg6oVZwfZ z$Ruwrms`tnL^`9G__&uq79FjR^PaU$jWb9OZoy?=Dsb%Rx!Wxjn8KQ(xm4wivkr|h z@|C(mCU`x8X91~Nifs0a@ks3lh;!$IcF!JBUs?0W|A`TSPeRY4sJHyT{Ek>rbgCDH z^S`~Vl15T(nn>f8MtY8OjF*y5&ib>m(n^1oZjOxtIzVPKBwJMXUw`j9QO=V6ftt7x z4!JMRmWBmVJv(b=Xx(Jjn8^i4j%0oo8zobc({>A^4|E%jHa=t$>yUK4j`^{SoLt7bI}&Acscmuo++>frzTzb==+ z8VR{D1kB9M^$n<{bk(Y;QAy^ooN78sjbXtEzOfUes21nJKY#bes|@ieZLHjnL# zb$42`RjHns3#~u~WJ1Kknt?|rQ7mvLF@+Pwpu{+C7_(B?u6ppO6@Yx)N=@WSMeNFa zchV=a?mwmDNZaaW^RAy*zxz6R@$j@|V;{cUR1q8jMgBJ^K%pnU_8}zFWDcp1b(n|z z-C9aRy|;cUHK**Vu;NT%X}G{zX4`kYR74h|Mps<7k_1!igK;o}lKp1GYiI`C-^i>C z+Uovq_tn=)4X#(dF#4 zptqPwcDv?sn39Pgr&Fba$%)%4n^5HgU8Y^N<{NGf8M6zJ3aFA&M-Lvu9-T~Z=&St> zNs0)2WH?QzmDE;zlx#w4e+vf{O2R!tW4&H^V@f=njE|H}Wea3RDwPSd zljTKmAGS6(C;I0EPt=~k*7lc2#B@;WAx+B5h2br^!6D|{poV;+enpH9u-@I~TG3uO z93Z0lpHyY&tt4tiM>U|7>cC)dD&Lg3vPnp!;`;^%XnKx48v0!JNryEOwJYSjlZq~l zMe_1R3t)&y5Hox+W|)s@;P*kU>O5BL@4Ve=B^3CVz(#HA$59cNWQ(W_ndkRJX0rmD zjP^m56M%9L1^T3l{P%mx$nSE9gH!77na`LtIjo|UP!@+B$F7d7Bs-jO4Xl#X|>RBDCs=apOycL zsUQd(b2zwDdms#Ya3rlIPx16b|5ztT7}HxNo|IAJ zs9%_<1xwOasvkP68w{Dk@B zl`<3hPO_WY6AaS*`i||$ifXb`0%|{Ia)}J4x@SUdnmaqIQb=li6IFqP`tZ85sTy*D z0=2&+iyD*GFnb?f=v9RzDxeAzOR3DSNyOD5BQlh@sbg;XPh(W2wAKctl*=OE=hr0q zQ5Ky#gIlp_TTh^LH+QqU+uf?)%r#b2_QV^^IrFBJm7_d^J&yIdQewZBAR|Redah1k zq7T!xv_V-oj%VMyNA7e;39+uLqREvggr?lvjMb%s>=Z4e@~2jR;z?~=5DyMdH!Os7 z+Gt&75TNkdj6=?lE2wHVf;|x;>PVW$P~;wbD;Ck#V*9J@%@?{rkm-0Dhkd2Y=i526tR>Yr)j7F9SP^Fo)&yOP zt!cST`)!6)h$fgv$ivzltNtRPG3^}k5Tz~}lP+m8sckol8npN;9ViA=BHX(3q})=Y zBNb95#1I=P2ZyR_UBO8EwtuAqU6X|Fkh_@KRu(`^MG4%X01oXRNEkxcVc=sL2fj45 zH2e7$a@A(AM;WHPmm=ArX5@NV+2XaBehoMP&0%Ytp)_^1ZI1Hwyg6?_>ty1qM)0Zxj7zepsU@JKNmWT%pin1LT$J zNTw;|c}fdWHMLdl_^tDii`h!0Ca6-6Ots>c^ir+h!`|uX<>|@U#p`El(va{(07@ge@u1U5 z)wT~GpnHY`Ecq!_;XZzpAFM!vcFIaNcSjq#vQ&q{ubhSv664qH4_&FjcV+YZ=gnWb zb}!{)dp(QS_b2ChykuG446|IDMBs^PPFf8y?;?GC7OQvWhs3}T6bBqr7aK79PxmjBN&)#={( z`A;WjZ}NT7yZfJx=Y1qlw|LzBV;g25#q{nDbUHrvsINjV%%si>dw-CG6-aK&^z6;v z#ojl2=Les#ix!OrUCqb-)pb;lR`y40y9@hP?B-lcj*QO8!V03<6;e-6wVv41b$J5F z-lVEl+TwdP89N;=Wl(0peErPMjtxgmHl5ZV?Rb3nFn>rlN?vOyh2c%uyp;&7kBQ6S z?ZMvp0lYhXvv+X-7vCSi!T(+yoE`7I1q%oEPmYfd_Ad@kj^T9gZ13pc;^6EY4v$sw zZ%^L7J^AVI_&eA?IXc=qegk{waC~s^=HQJqX&#o2<>cC^B(y7ZU(2S;h4Ds?0bVOJ z%P@&lKGw3DP^so5<;q6s7q{hdrAvw;%g_rn8*|Lco0VT`n^lJ%mTWeOS1N5f8Kb)9 z9Y$UX1shFSj)MJKi$W50?xN6g1xqqpq^jFY$+C*`Z{@7kPF$Jotaf#J^5*h*@8}>W ziPg!zW~+4oZ4^bhL|L-p>k1K_isg2t3N*n2>GcRruvsC!F|{7$EtOGtv%A&*a`Vg0 zUQ6c#lgP_Xb%vDPBIY;iz%xq%6;IRuax*Wi+=iWT%~>TMKlWO=#X$~RZe0lIh=iG- zyqv168q;A#@+oc41_GP)Rn|C7A_f1Im4-?le|TG|!h%}F$n)JJMzz*n?lB>zdQ_cF zpv0OYp}-@R&=dG?0TF5H4V%*^35_tBIwD5>*i-u(s%aIz@F{G}3c9tvr3?mGsQnhq zhLlYt4uFN%RmSF61!mM(k*?91W*VurKCQFcIa!k(lzvOupi3%Yir}GBwKC?%AI(gB()Axs*MCyFA6n_Iu$umU^6u=?a%gJR%E5ML2nZOAoo3ctlDAVY$EKvAS{@3wxz8oDYk zWE-*{90u4!Qhnugf}IRGy2nF;1D^w8SVv9i$Tbz%yf)B532%D#G4+w{$l5PsA|2^RzQBB{^Q25=fks5P2B7@$Om(3D zy7{;|cqX*aP_oN^f@|jO!U#r;gklKo|Kgqh;_VzX-R>fsR`qv74pc`9KMNn$@Q}`) zS>&Wz(zR8s_VUxz;eRPtY(5>t^&BuA(WO+FOKl%ixoXs1rqq9%d#+%X08%|tY1@eDiphD9TDEl^Q9w#(v-;8%XjIb6zUpPBU>cBG1EFH7^ex>gA!;J- zCHIBFnq~R6&Z3&HJPgncW$X2msEQ^guYY=5S%yFyPi`>Vr;|udiS~bQb+>jpn{w1q zga#xaf?(d2v&hu$en*7GJJWe+OXV_@A9(L(Yk&pX%E^`T_P$!Sz4VfX?)8_-3tQf7 zgKAmsEFo>msio-3wh1mZ8n?P z?c~RUv!BimFAh%6PA*RNPu{jnZpOardo6;p>Cj;Yzr|EwDALQFZ@I)vWtg1*?d{>k zL1J!{;!%KO7M&~#hPP@q8EutNd6Z6dJOBU9<^MkWiE^lTrWo8GPZ#ftbm?_^a(?mM*}-`oXFCvTnL904 z+QOS}ilGp>WG=4npd@|(z+=g6+DN6X`_~3sp_TQeodvm$> z=IHSFKAhrshnf(FgkBK)RY4Fnl&Nf|f-#DB&b8|(a8FM8>{O^=jAHai1r;vN-ko0@ zyt#aHa7a_`NXvxD<_WK(dQ`}#_Ka1y2-g(lGS^?hZ4 z&W|omi*A_;FzP0;{NkR0bbhe^?rh#rrLgoZf|bxtPtKa-r2?_4Anm=o`2OPWr_C|5 zw-;7IJl;Dx_@jz}+*O#aD9Buj*)ERAA6x+D?)NP8yy$T$-9OOVswH#%?BLB|t(&uY zYqkp?KX!CVf)a4mb3wz=6_Xe@byQM+Dv@0%^mEmfLo!RN`6XOJmeSz9>{5+e<;XWh zw#){sLA0G#8udk1-2-`hu!U6sdH1<-JLZEZ-#u z#;5L=m_$`w5tC@?F37r%G9+S*C%AGn^w;Hkp{p+`BlT&KXV-YT0ngOh4*l09FwDig z<^50Q&YaoR`|v?ERTL8TZ4*twL1mF1WN+$rS}>I!w`YrLM(*v8jZ~y!g-lD&)a7pn zW^r=~=HB+6#4R-?a(XL#IX$CsR7O%srwl@~WO^jCqUw@*HCGgsjb^`ISI1n1Us7q2 zk?TC2ulS=qW#>Q4)#6h$d645D^YVXfzIa(U|FQFw|Lbv{xyy;1(`ndkA8xi<*Ch1& zpat3yidy#Af4}8e=kt#!rmKiaVyIILmS!bTAWIxQDKu4ijDty+kM-R?Rdr0Hcv7j@ zqCKqLFFTW1QODe-&>2j#wM^# ztI+O_g}zO|Y!M~Dof}{S5@HzOfZj^TL&{)J1%|_RcSjZZZ!$chejH$!Q2!FeV*LB1 zM;Y#VU#sut-U&cK06q?h$>sUqJzMYV`7LedTKdoOrhFVu^{q!bwRBl49P6X}S@_D9 zuIv$21huUk${&a7J~H^C&`NROnvRBcH5suTjUzKC`Pa$V{P$m@vA#o;3}J1A1rBf4 zR#V5;>iRl-Fs`#_`zOcW9)1U}0WpTAu$G)9U!CBIC&|$D2^WkEVuAftc>Oi3zCYQ2 ze`LPCSC?9?Zj{susCP}mQIk5VFRGwIBgFz>bxgTXpUQf&;g*ajt178nr>pDm*FNk% zfB99mn(^ONRyBS=x3%QY^;hbTvWeMreD#5fPQ~-CUY4;%TH?~$m9I68Uln9? z?wE-ypaGuky}LNkO!jlzABbs$+rPkTXzMgJ?N?PLmG&e{RyN~QEk#$-)yOyHD|Km96=Ts zu0#ryl&q$!z1l2;L@}gAt2*th*G_FL++SZ&u@MD{n0q@%8%;t^azY>FQ5PqE(d-ce3EXM#A&yJjO_ir{PzjX~t?$#;jxrP#=6U5QO)A4+xc9Kz+b zrFnO0a&u*Bm+(}+t`3bV*0QWNPuVa2`MDiG<|*_4`GbzRu=`Uq?~%H5801ExVQMt>5QqrMUABtpN% zxMhj;VQxBW04EAu0Z#(p+T};VlMtsF40d;L=w;6pIHC28z$M92%fU52T->N9^H1U4 zzkBoBXxitdy{b;=wsa@TQ`FVq`v+J7|J+aM`k&;fc^Czte*J&`a%;1&{y%@d`?UT) z#^WxqD2jM5S!Lg(*@~9j;QR9|v*i^%I*DkAL!n4pTzJ!Yrth>Y4`3;j%5L|S+;mae zgmayyaZtK2{ zNOUUMm%7rjX~U*SpeDj@&LV9wjYgpqMvzZ9@28n&o_7~Yg6ua)EuLi zww_!MTRxT2&j~wynTM8XpyVD`D1^av#)ywo;{(8r}_JuH3S{^(EtcQ$2sVdzBd@=f2ReK0~txXE+8ih zqSKVV#JWPJm~@2QLWNW3#%ed&S<)%}v1Z%?GQ{503o^(gFZ-ElP+C#hQ0D?Mu}>!x zl;skD*rtV#&f(>)BFrV!&qCpDs(E_hY~)n>KMc4f=1=t(%(K= zr?O2i-lg0t9Ny@trxNZ`Spd5=(=q2ds+3CVC|kcUd&WXUEteo>cAQe9MV5-)v`n7x zI(=XtF7{6w2q^cMO+apNh&exHbddVa)+#%Q~%RQ`2|d*7q3sj%>*i`+Leoj@9NK{LZ)x>_b8#2nycd08P)aM?*iWO=f9XQaU$m zm=Sfq@Ekyya#;}OuIc$OvIVn1c&q|zF2)S=F%A40F!`ccKtn`=nBgXX@*lC=58ll|T8?>hK$hm-9GrWwZw}J^`IpP}IgXa%UbpTO?`9}@56;cN zS&nZrAeQFZ43vBDYzEGP9Lq4LG4pV#6DIkXYDim~bw*q2ILTg`@A7o+I(?^;5}La9 zYc9Mzle!9}t1)h73s%h7+$;CEc-9Ii(IB&D%ey9HyMx1*S?kH6md9xLD;*To$x4%{ zBda{V-Bi%yJJ6Gubosc76Kvm>wy_ETK98-{0F8UvTqP|$w(T_+h0kY$)ru#J_o8CT z)_WKsRRQf0Mbra{rc4{n+;P>CN>#{Ox1Rp=P8%Z;_Ub#&B z%m#bL=~8Bye^To^*UNt;CGW|${=~NR9J~6{+RlGu^W({MehkyO)@*(loS3{va8*zM<&}^ZLdB{*0mffK4|u} zYKoaGY$X(%pQ)^thMzSnTV`@3;joKy&7;v^$*gTPLSX61k!EwN?b~O|>h=H~%w&11 z@8##u_I9uS>g;c|UHlAL;O;+!NmjV}u6?fTaMc}j1EVTBiiOux#d>J~R9R0;zAlyr zErnU)Zmg?Y>YS=@PZeHN>>a39&UMDv{Ukmq557c4+FhtU>f>`06`B@v-}dLV*T5g= z9F)p+@GvC8>76ZAb)2f|xC$6+W4{o{RnGyr<}-NLkAJRabMntSL*z~qQ=mgQ3djx4 zJ0?qRn6#eB5#d7lC3`i6D%_XZV%mY3^@*nwrS!g&^vPwWb|!5}j_UOJ4EKPf&nLPU zrHW=wI_y6e-5TGdqMwqjp$@e9xSf5`@v<+R(~WT`NB}Co1#~)N%Ejyd;vIXVYex;& z>t`QQR{jW`1efH49WVJ2-(fEn`1Skt`N7+R{R`N7^}hWIdm}#=#rH`tV_%CiDrMI&)k)4@3AIe$9qqUZrIRMRl;5tuZeL zb`=S8_L*n1n7V{pDv9Z0m}WCVS0U@>g?=D>^C0gTcreHOy*IiF>XI~etlLGBgF8D3 zbrw*?MnUz6tF4@>oq`(kxxQi(W43C!%SpSYC%{(VClUnOv0+9y)+-bYNr1V!G3NGG zO=eglejmQvURSDP(y0X2kblQ$9LXZJuHD7keExiHo6n!uxmoiYqVvWeGknW!3Vpfw zp3uDMzy`=G4x+gMYR~f|L5~YpD#=Qw4AN!P;nLD(Klc&#r{^9|S^kG{gdQ&W`~3V* zTid&vx%>}1FSoaz@;^Mrlam&5=-o>$GU*{=LAi$l5{}X=5#Lirey5>8!726kObN`M zQbs&T$_RS`SrPRDu@M%DH=&TFLqja4^H@;jY5`10cvhChL2}20gs0Sol1$KDbwPBO z78DBi{nK~v1PRFRYT-V`%)_C``*LJmFN%d5B$BQ+pL@RiyFF#{pM)cZIe)M&_AL>=nSPfNmsED03@7SyCY$(3n( zT}U#l3uX=~t5?~kUEwO)_5#FtN?7xH-@eVBpenDEF_2gsXeVd~#*|kDMB6LL!Niza z+g|1BPhF@{K9I;_AU~8?lK8jM%ZkgU&$D$|LflezO~O(4`b)(MH(MD$yKLq{C3vjB zL4KSQOEf^=S`ip@Q1kCMsukr!MVc+4?`hf)S5*9x4yuob~_3%dOn{zrDG+`LzB& z%9D@d&_iFf{y%hvz>aC}X^l_TcuSGmbb5A}O4926@$%xOJW!t-&s96h!kR2m3aP$I zysLkVJbNi+pd{of?QUJpyJE4jgT5acXFjv=9wY-=17M#Z6PjJ$@SR+cG0O**v`c2% zyg;)|u|-bG7D-S%E1L;QsTdDIuW?vLw)E}PiUtXO2aB%EsAQkZ|b&v43Y7TIuq|;ZS~7 zTi*J`;nBg#yNhD;C34D~D4YZE?fK>T4~M6hKOUSNe*5=kfCGMhO`;z$Bg1LgDa?wD z0og?oib(^$+TMIIPkN@O2%QGg(}#8HhI;_9{BU0h2h^N0WO2C1-*IWjZf$OE=D!@% z@QhN?R~JRyKb?M^{b$YA`}%?B-~aL==l^}Vz58VUJ<79~{pVc4qFCd}?t5^%uSQ7O z`DpyOog~(?N;Ksvr1EJeA1B<%|Sb);fY4pn*!Qvg%CoBJbPG0~CpWQ?HTuxB8;( zw-ou`pg@i?`rWYt8SL-PNviPSF*sBEp1VDEz=vSdVx!e zWv%~vO{a&M86^z<6gl*-^fXxiCp45M@A7KE-2LCp-Ms&I_vO?2|0qvM^m<+gsE}?) zhAk>o1;aHY9Cba)Fy&p3PI`F-!T`C)-f;bzWs#Isc!ca)ocyd4-^IE$_i^PQy3(<# zuC)lBG@wN_AUiUPDnhw>HTsaFh5Skf%5mC+RczVpX#b&o@(E*~7ki<&JN2$MV0;|< z5hY3TnvPLxvNpWlS8w;)^&aRP?MWywyFr2Dhc<7Tj9jty+#}EBfVjs{gfH@5lFaKS z2vxxO@W5B;m978T<2aq@#`~oEzuQ|c^YOngcVFy0t^bel%sIVQcV4ahWLu~F&ex`= z$2v*a*lF4Ew!AlDS^q=fNZr#STp40kJ#>pkhBbpUH&zU(Y;;G|$H_9%=$v9&FS{r? zS?09c_qQ1H)YZ%dWrYLh)w!z3?-}roiD{Zqv29MpHT+xV=B#D_%r=MnN{2MH+pVnP zT2iE0KeOnz=iGSS$^HGg<=)eypZfLx-b=rF=AHj}xt;g_@4kGo{j~l+#?#=ee}fhM z^RD4f%Xib|`#uZyCt9LE(W1P-GQ7mX`>B`O$6H)W<-c>1{~-NAEXRNzbG`wTi@f5sd$`1zS2 z6MPv^4+XzK`8Wk{o# zkCSi7$7_rum80>}hI+y73+MaF=yww3>co*A7Ii1}7=?a-nZp2J&cYqIK?Weu7UrGBm@)$FhRdk1_MTK zIc8jW@J5;nAo=|U`!Hm50z#rA!REktG!A?a=o$mZH<+OSCNvad-pv+7zJEDZmn^`! zV8j!h3x+}-Q6@SzFAcOO=&plC`1RI{m%Crek+rk_JRZDJJ>{<~;a{}@1-EF*3uDQ# zfC;*TI8p;7mAFg^eKGvy1l?V#iKw)^t;t}w2*W;vwBsRfjO8CvRg^4EZsdX+(#rsGaXFzr84^|W5(_kv>%_PO zvJ$=-DT@T1{N-*EWM2M?ZV>kviA44_r(xzr;QyuYZh}HG#9S1=FwP4t-GqL3glVy` z{4n92Aq@o`{EEFSCU@#XM~GqW^(`KBP!x5lvA7$HNl?H;{+1wnG{T`;i&TJqZ!n3> zU;JjIYUy8h9pcdt1ilkJH8x3$<{jtyk0?;HUjBLGA?BMuL%++&q$`&t*?#vfpq}|8 z3<#-`8$&O7!6@e)ElE0&IyX?@^HVg!Ji^$Q5=C-2k0W*N!H2;Vj;&U-0h~%LWJ+UZ zMKIwoh)Ix_94gU~6k%84=IiGMf<%r0Mm;?mS z;jk#+FD_1{IT%R^Z095lC}Z^23b~{kaMc|Py)0g3;5cIJOfJ?8vyM4wQTnt)+F_<( z+rltXs{-!-c2qcTC^{F@2zO2*qafws@{kONZ5PHoxNqofC?#SAOaoW4Y8w`T`z=G0 zDnu>Z^Sz^kle5F`4v*W7;hthPAwpokv#&T*uK=3f1apILh}+q==E6Or11fk&%I2!4 z9a0kd_-+G2I;25BZ`cTdyR4FPBmK6WUYfGU~bayn8qBN?RvsF}seiU|T# z&_qxiIL${svK86MfGkpj;u<388dQ~ z13ShH1L6wTAqs*4@~&ZmQOLE@b1cyMCGX4C}@>Ps1K4W6mFgfrn)8nl>|+sR)TrBDmEk%8WYnsSt&xCV;=-9(N~8| zE{Hhv6-JB(fka>Frc#yFUfGnI?jYPseW$er&NqF1BtTWd0Jfc;>bq=v#Slb>QQgfi5R^he)58+FV;5{I5Cd%V|69i z^irn-d=@jJ{^>z8&NMt{TB+cirU z&EAiO$+Nw;nghIsUe0y`ec|mI!`eiY+2e!sFAj$6xMoH%NFHa%JXzWrhh_j?R|HKVnGGwV%F_;*RRaFa;uCv zHN$R+)RHvYSTUG`S?o@?d}RLdPjHKsjLiyMNMWNETDcDF8hLebs60Ir!5MO^AnrU}^}TRjsQL z%hT6+vWTVPM2e9--^!;{^u6BM+?m7iXKJ|WWf1XkPPnULwPNU>@Q>cwU;EO2@Mn@= z`AoYsX8{?^o-oD_?K1A|PTo!ct3ew7UFyX?p$c>~KRGXK|pw5UGPHgYCuU zruIlDrdx%K`6s-W@a@Q#iI_9|TdWphDYybWLf+I`v4zsQOIUHne=6)}dREV(cn}b8 z<}n)1Jj(F<9{LsCy*HZ2OnZ1|)Z_1aH$QJ}|1vWw$@^aSFEi@>JmJ42N{D*b{mc6v zBi`7jUM#I$?ol7V??sH>P1l>L0N^P6JPL@ol=JIS8VK-@weDa3s%W#m*6V(;{;asR zaV+3jTH~1omAoox&Jh$z%gVKLsWSX(kx|qij1NC;fuTvsil6xo=lf@erx%ys9=<&| z-a9&gXO>i#(gZ1Me;&lsy^HTJ50Ae+ar#}Xvy!bO8S*^qu`Y)`p}x6KcJBs}KzS3-aZyGL3o(V51-u3* z=dSm?rmHH{S!yhLTu|}}!$92INd8noAZaeFXV-YT0nb!o6zIQha97NS z52_M;{Aj{QZ0#i^S=szow?91K1pxEnf1htZ&*y*M+Kls1m@<>W zJ*r!JW@XAx#wv=er%a!z8ydjQ8&7nU^XxXVvbv#PG=d)d_$DY@Q4JW0X7-7EQxB6ZP_~o)F>{E z8jscXyc(FyS#NXMOsgctSN(l6O}hGL(A7T0Qzrj)UbV-||G)Wir;z`D`zikSQJ#{6 z9hLd-<|l=c#h&u~&(i>PUZax;{TAaiCb*Dou_7s<{R}f0?C#*uE2fqxSLjW0LL*ZP zNee5QOR7~j=VZYshssds?*-8q9mf;c+N=X*58Thsa+=HQS)Nl+6<-YV6x#jKPRTey zBzM^{pNJ?s)=5Umb`=0wr&}}l3TB4%4PiDJ$cV<95-a~>g%sjseCNir>m=EXb$*mA{uPygE46D1>k ziuqq7|E(c@?`2?~|Nq5iUjDz_+TDGU|BvyMYj$h;^%ob^DYqCe0i` zWlqXm;rf&9kh^lZA)vY>wf`o1a613Ha;YVwkTU$hZOonjTlxGS&v&+;@_#{bNtuOxBT7e%CBQ)l4_~wAOx)GzlVgQyvX}?djy2Qt*r^_+=>mN}Nr1Ssm zVDHV*L3iRmcpJ6zf9v_qX5s$V?Wgd*Rqu89>F)?mR$4Elu>=`9`8-mmd)GP!N3aa0aQRwq-tF^KM z7jIv^IeXP=U0q$7NZyuQs(|5$s?*d7UQonzM8r5ANM%~q>FJv0U=&QI9i|oW6h>NC zHmDHzTTHxbcuT@--fDdTKOf5e_^~=G_RHD|ael7L@23ni{98;o5t#q7wi3C&*EIx% zfDIs2G*^)9>y8-XjxuXi`F9~HuMvlpb#%x;%#cCTbAPWZmFNrj`3(|iAPJBuF0uB_ zmrkZ4Pimf~`D%)lon$su^^dfVwpiDuAJ5m5ePT5Hl@4TY^k3@jQ5*;o1&Y&#WRx7Z zlCaDt11uUx9r;BQl}l=>h%iY>`AerIv4f~I!*B%WYJ(UKPxV-u*B!lY+#!)F|9w2d z>KyAYYb#^>xBhav2W$I5%!LY|T$cqR)bY|cvea1|hUy?4^}H+a=wu>iz%OenOn>N5 z&+FLN=^(`V#D6-8)fAc_5(*Tmv6)a`QX2njL>uvUJO(d)vul)*&m zU?d#U4T!XK;#i*~sFYR$A@&BvuK`^?}C<{pbG4;90#HS0X+GauZnHG`keuupi($!3+5 z(`KLvr5&!kCm6;(DI}5)Ojcdb^imGFau`U`dq^q#xn9E0r<98k!{>i{yIi}GuFro9 z)=iT!S7(V)s3Lw?h=O#AsV0vQBk0XH%e6O=mHokbrkC|iN&%Kx{9COKq=E*vy4yQ{ zX?2{mh@kT#>SL#z&=50gUIEePedEx_EST!kHA9BDV6i7+hFcx2v3>pedG}>^6V`r~ z%+2G07MR?l5e9r0Q7ONESxcp%oE$4#FSggM$StZCt=0ui)Fh?EDVRy-heT~c6AV|W z9(C3KTzcAt(lpibXoNj?8Z@W4ow2ae-B8)Oj5A`Vs}48*?A2;giDU{0HyW=x;emxZ z3Zl-4A}P00f$4)EGd-Z`3H@%X^)-C)#RZAJ_@WPQrBIfAHy!6@8M;!0kxgmcv|KY( z!>>PI{~YRl(sZ zt@dXY2i)l5xM$9znSToZ9M33w%-|@t1of zV2xj_IL0ZOZlSF<`8IH2H2tfiK>+%uoj7HPA= zwg9nb_B^OWj}B9`lQX1Ca>)#?hA80W2A7BDxIeabB zQj07{BZIWFqt_Vey$}#%NckxZzV43VJ&e7t^S@@NkjV6(0)m8C;#JU9swA+#oF$;|+Hr z!o}P3teLYIpc15i{-p{Tg>?2R^2K=Cu^A~>9xD@d;3R8=cV}-GWbq7E*YN;%$23_# za!A`4-KL1o;2qcNpKOj`W^`Xc7*5|7QkQ-WY`=Tt>hg z(>3s=F|QpT<~a6*DtX`DHW=qc{O&>TtutNY7ajE0NaC)@UPH-6N0gJ)Ze;x)N#2 z;y>UD9XpHkHJ;jxdM4SOa#Y!a36F%dWzu^gy%eY418F`H(YrcoH$nRR=;Cx?a^Dl_ z(>iK5MtV_lFM_mA*R#+v&d6wl8R(iohBl|6b#M_b$-Jl-oWa#*z3x#F9@_x-8SE<* z$?q7Fx++vxNA0K-)@Caaah>V2Dbin7Vx2?UM*{hzx%0za#??lXPgt4>1EiXkqt9jPP2Geq_sW0h^tp`Z8O@FDv_2XmX({4^?{L& z1+78ZMOqf^6fw8aKT8+^%OWk;#-%AOD=&!Za!7N*kietHd$u!kuK+QzAhy0Xzy$?{ zqX2mrXyC&s^*Ict5aL^)VLkCB((2^x8PiZx%&b-7Q9pl8VC{!f2>s zO>Yn*(qdeKJsK}A3h8s=V-K-?>k_D09ZQksx_;_YSYkddvJ;??J`9Oyf^iknBqZWq z7%zjgj@WCYeUu`tbt4^3EgAh7--&&@Y2F;^#n?k5eMIAMZahK_(lAi~mPCCKr0qEo zb)nMTd?V4Z5tAb(o~~PhZR$8{f^>7$l=|n3;Jp~qlEiCjH%aH5M?v87zKLUusK4F> zY4@Jjg?18?CE@Rso~#56;C&Wfm!MzI(#ih0TIR_a2{ zd978{zV1vTr00k{2k8Z)RCM4~f~H0(UflRDLwb&@*QIo3bG(6SDv=J&{&-1*iXyLa znf<^23m(J1Bt2^2Yq|&4wY&Kmwk@K!^C=7@LkmW5avKqka7ZY{%D z&qzJebCeH@^y2ErJmq6)zMfBMH|5%*VZF{#FqJ2gR`H`4lfQ)&rU8*_D|lbE~vAi$>9dMf-&qhUtH$M=_1lL7hwa1`ja88s@JJ` zi(6V2b`z1e#4}&yxoPAUl^({$bVdWL&T29m;DNq9L6JLR8xqMYls=vvs{(_5fJfkTtvWJuXWJIC)!>4lIMWP)id8ey$0m(W2{R^~wC z`$oFW;Oa$vEOHjqERoXuTAyuRor}_-8o-cwl zk5!1wJ&-mK?t}IG^QsIZpDZOliqa#2bw8$V;;qRby@2@0Nsm0n%Zrcs6ETPM0^;K{ zN{<}U3y6=;C_QpWFCacXqx8rjy@2@mjM9S(#6%n|u6mS64+HC-EZsn#&LF*r>hVdX z$MgD$m_d3G)#GzYj||d_s2-nFdSsAZMD_Tz(qjQiFQR&UPU$g@&~nB&%-|bJ1B}9q zW&1s4C`9jcEM~JGtf26 zz83O*>;n?8nu1(~0N>!CF-QwIqyl*PW>^mCy#@1<%)qJfkeJU$I->rfBu-#gP&%Ui zawJ{^=|xGLz^{!jYDw$x3@&#BqY77v-K0M z4+T46OxlHN)9h}*AQrNiz4K#`G^A%V)~?DZW)bC>ceTDSr7<9e!KWd%Wt?=c0r3;XtR`#oV0i0B_Do3Hst!XP>xhef@0@!b#ZhvivaR5Vxv0C89lyVH0G{l#>sr7!V13z03CZ(tbb-%=-F4#0V>U|(PDN>U} zzotVbuuYDY@$^Ov8*=#xft<9tD%~$kVlJG~8BmkIv37_yY<@*|*ph8km4GqDOeYMs zw;!zQfE;dhl1@Tv=cr!n|cO&$v-kBdXE zF61&R8&5w9r0FuvB>%J%TwyNjjL{8FGRg+i4fs{k{ShY7{nA~!g6+`~Up`pMvDJjpQQa$VIAJpum3%T;abso%4>sa-98yn-&0Fn($^>Ofxv=Qgtev^Njx>bS|cQ zUK;0|(Nm7|;xQL6gM$K+`sCBqWGY44Mn=FbgtG=P2j@kzdl`ob7b$P#@h9rk+C&z( zlHmKzQU;WTFO=i_N95<2;{_AXD&8=7Ca3$&iIJ4(%LKR_ zP33TI!W)aGBP){|=wT9)HI^HTW+SWS=TDK4tP#$0laUp0{-pWH8sR)Q7gDVhYT zw7UFAmq>8V9eK#$95FIMY??{O(>#*a$_=Ad2&#I4;Pl6Rpka!-Ze$TU*U61ioDJpn z14QZ$F={%yL68#H44oH5HpRJ&H&UBtc@bSIp9`L-C7ud8J2;O5IzU0!dDBp6Kel|H zkMn$?{n+w(KF;%n_G8QE`8dxPfT@m@mv@H0WlvoGZh9=OLe|a4SvUU!p7O3*GKweE zQkhp14dMPYh z2PKYX6?D*CaBZ0{pO;<=tJlHh(X}`i*1^`HGJKd+4JL$heX+Oo{L4n2t)Y_b4RzNR z_O%D*uW+ij`7&E)JRVGlkgCU-+H&!Ia}jXT3<-h8%vG55-s1oRSNj%bqsHW87GuIe zUrVj88Sbx}Ez;_{XZ1y4Ww#gCUJt4-+~I;Uvw4_HSnTevm~CNmFe00a?@HZzp4>Z@ zm$V9{cx}W2S1!| zzz@&O9^8b4MBQ%ihurC@Fa8JI2C6Tv=?8+#VzZRXvwVb-@IxPKT7_UsFjD zP!Np~7$nW@Rw)(NOFGolge$hY7p6N5vUAGfxPPDS+aaAh^@#clA7GZ9*wdL;W%Y*{ zAJw5VjQpP%5%?tZ=Al(&Ir96WJ};+3mgUa$0nmr&)C{h^{EjqtvgA9IG%pRm1!Ud~ z_R~|A9u56OdrH>NAq{-3b)?i= z;wj?Q`76MVEeSCPGPId8cw+OK%Shy(&6epDaV;+;#6|Lqx`+#UjjJ!IQ63r&s*ui8 z9*ePxRmI4cHokRe_ZsbQ&ETrtzQ?kcL0q5ks$`YqNEi1Qitc%)YX(;@?z3KJ5D)nI zHHm)2j0}r=_%o0nIe3@}G9;c<@NQ&L>sh2jM=)~CZfcqSA$hz$@9fM$t1v6c!f9t` za8)m>=cryq#H(`8Hb8ul)Uz|V+U)LjtM5OXQ@x0IRsPuqh%b_Uwl=@)(ukK`0p1kx zhBtrLCTdy`@%ke(GuTTrg1hb*wd=j`QdD~wW^u%84k%?1H#Z_Lhx3CYUY}!aW_7>* zgCta|&7QU-;^leP9K;_YsoF#Gczv!l2l0nUtoA7oFZT-6PELz`bB3S6)rTliG`ocM zv?9@mwqP-CZ$S2|gx81mSKFH}+8?hfSfzA^R!z>uaZV6lz}wM;;zu-;D}G)*PdrfP znPPBe)2yjpNUD)=lyt*5;uGSXM3^C2?ICrQ9O6>*;1RNRxZdDZFMxz_J0{-PwJHct zt`Ke1GF;uuS5SlauXLcqdLaTpYPO13fNC{YAU47xou(%GT5sn4N(W#=-cz>yl!&Wy zGdCzj{Ls7rBn-hVL+~+;17Gcdsu|Y6N2ziYEU%E)A+B+_u+~MI=T#9|zXmjv^H6ug zu`$#UQopVPpOE4?;i3-1FysmpbqR5Hsy1&~N|pN{-fFeJhA+N2rUHNQMZfiR>uYuH zF>`s|Fb?&loE~Kidm@gsBM__*~oj68F>%p{5hwuO`X2Gd@3G{g>xbba0A7?+YnQh6XH z8K<7kc2h~D!PJh26x~Ev@u%V~ED0No((RZ8*k-bqpixlnnK$|5N!T&egH)6SJX2#oL0Bnt3Gt95mC<hK#i#j>}w=}?~B`7Gz0vEg1b z)BHNtT6*|9!%PTv<@iYXdqJWvzUZr?-4Zn$$!pUc{OkbwWzG4q-fFF^z`oA4Er*(L z6Z5OU2ojLrv1_AU$+G_+9bBbZcLfD}hdn79ejXt2dcW;-ESnsx47dDVticGWepn!&k(e$H%^ z{Ia%^L46&#xwTsI+c0J-;4gc}pT*_6GJA z_R(ibN@Z5o2ej>>-t$fyr4$hgNuf|EA{1wddWf`>jWfRbS}nuwInCHvhyW(T*($Pm zU}iPQ@dQj1NdEk7r=?~;j3NN@o0#S>pUJmzkw~)49m=jd1r66KT=ZI$b+3WQagFnt z7{6a49CFbv$8P?F?!Ra-nML7y!sWvIY@EF>y2t18hU%VtoipGMki`kwmPtaCOfeFI z$cK`6?vx^J!kLj&g^s~5m(SS_syr~|g>0jaJ+JE+XLMJBeJ{a^u8^2f8ptx0I5{BC zx7p^-^$4B%Uj1EED82)*$*-{ax6NOFeS7%puirBc z{QB!#-tv;Q{Pow%=bJlbBc&)1KTrTRZ>HfbqMQ5=2759KWYLaYk-zfFbubQ#El{V% zEt+krKNzSFA3nH1#7?M*?t0B-!+-;!a5ONnah?~Q z=goyPE^q5T`Nf2W6q3b8m*J=-MhmFTV;}}xjp(`1`Wf>sg`#kB-f9Kl6y8d=Xg(-R z)ZZvGX(mq!1Q69^hi{5EFy|ICnC$SAGE8o+L4^5OMd122iL(slfhtWmX{U_pMDBbZ zEIP{#n|Nyf3&azMJJRLboLzaEtNIx+4F_5~r%iLye@ zYr^UVkP#D%5oAZb0cihs@IB7&VIHA~{j1GKA`qGI(FY0=I72y4n`MsTCUFP615Q%^ zn&DZDjLo0ly|KOjdYDc4P8!o4b_~B3H$`GLUo)IU#8>c&J7UU79Xdfn3LsUwYAaxR zKOlI5_zU;u+keGrg8(K&W1K42eTH1?1J}k@L6maE$4N+jYn#Y&{9(4zPC@f2p(uLK zAjPOcu=lv=?C-wp^g6wcEjs(+TaSP0b-y(}ZWsUD9ID}cKg9WaIq(Ly&DU2~=kNdf z{r7J#em=N3IzD3m+SCvXY5RIQLQF#?DxFpiQl{Iou^g*!YF&$1hFOs{Y63F=(;0|U zd1Tj9ho90yZq*sWIN_q2`*v`}1A?0=0VvOTVl4SEec}2aO;L+t^Kx+^H&M!+bSa zOr?NZV+RE^$$8e1*-@Mi^jJ<%6i+7uJ`m@uX0Ur2+c3qW#`S>tyT#{_jt8I{p}Vg6 zT|cfOK&ZD-6b-s6!#n^ldOc16`)wGOC*$ZBPV*e4lYYFgkG8h-I|@(#$+2q_G>Np^nAHUTJ(ClvD@+3U|!` z&>okkFr5hoF%DhGtDI{bhS$n8MOv45f`n6$*{^(>GS%i69ENK(N#HPiFHs8vgtn1M zA>$btLvvH=U4+GKyP4@5D%Bxn?Bq7C>-+orAc7QLgS!}tb1TyfLYimyCfT z4+J4-vlBiJLok`)FbpvxOXwu6*F0V?M`D+kx@wWUk4M5y`HV66#|85Q#wmpMgOl)4c1xjRP6fl2rfi62kI2@ER$lO*n&E!G8C=VF?ZLq}; z4WbU&9(+!NRnR)%=B^;XXPpQ+)ShLk#1_XWUY^FhY=#J%b2ZYT3EBCC0mHnUy4a60%zyUR8dI=)9w^Tf0Ze?nt{JeB}Hr! zIzmV~c`^WFm_`ZW?-Sz*+nQmL%o-83Awr4+iUSy==pN;PGz4r58!1kaHVqgTY&&2q z?i!0LPkyH;>E+EP@Six>jUfe)UzFPy8Y-`?&JHU9aOA4(_3jH{L*9LPEf8`W2-jie zx7p_hMwE*0>~96D1H?cx#tMFL%ZNN~svYu|YnWv}39$T-dVR<*X84hI4wuI$nRIUw zd?OMP%M8WE_X5(!o4sw`x6LHcYRAMhKmgXuDH~edV@6&PjIMYobi0@kq-F_BOw$r! zv;F`5zy9z4@BjHf!8hLt*(j#Iy<@7&D@xgks>si~17LCwXT%|ovcGy1eOv0r#4D_ANgc#= zIcXi;3}6%mlH5R&D@665o_=4^uUMjT&GIM1jrF<)9KBwzx4*Z?|J&>J-2e9XdN2Oe z-`m^Y-`m~Wd$IqgUjM~@@8zFBZw6VQRrF zmYc!=-0ilCJz@a%JG-5itq5f(jZhlKhzwfF1j7zkIOX;g6)`aYY7dbq(`DXzGr4^W zu&s&H5&&5iXjpd&bHDSU^Pv?L5oiPPg8tUUwzTZy45iX;y#ru$$5cK3mVF@HVfckr z2b}Pi55$X2IU1roM-ig|GyM#TIATKcX~y7}yIYq)Tq|+K>ZmVjV=$}xO>rZ@{w&IZWTtP6|2?@i|B@~9YYEj3N zk@#1@i-XI0mmHq-+TUi&z1i#UcPve|Bvxox9~P3bbr6oYen%05jp^540m7b z4~BdF@a8YW;mh3@H!s7#4B_s}-52}M_xgX?hx_05pTF4OkM^JUp6~4rzuku~_x{p* zj-q~l?`HSg-SFG6*BZ&o=V$=hyS?4rptm3N_OJT8gBO1p?Dadl-}d%;FJFGU`+v0m zotJgvU&Z=2ZZlWMQM>+kdoN!0_nq~>-`np!t^ddPZES%5QeJgG@Qi_mM@Va9Llqtg zvw;jxv}%Z4a67IWHaA`1JCx_KJi)t-cVrR-{(6EThjz@za*TYdBBP;j_T=uE;-blL z@E+9?I}jxoXcQBg&vwM0=S7&NP|=JWC9RDOeuwg39Eb$pv7mSvl*^A5ZB3MRbJb9# zTI7*CTop~l<#idNNw0!-X_oPff^PP?EwWt(#n-;}kXFFBV*Q^v8vV8K9o|v{OTe|A zCY6D033yD2w|F%G?RE=*jSX9^eCr5B9Yf<@?7XE;p~_Adt91mQqe)jSy3rzX%{5Do^>PCn^ZyzIvve=vVm zOE^fO2uQy`2Gndd03Sb<0GiM3IZy930&TQ$;EQ!MAHJx^AeLIV6pJg|Bg~FM*1fm9 z+l|B*#ZjyNK-FTpHB1b!+@s-$_YfR#&l#Sam*!A)m*4n^3fxVE@`w>Gd>I}C0AC3V zwoC*V#c-5jLgP@lW=k)%BC#ZEUsU4P$zmBw;_PqA-?<9>78@-7hAq)feA2xn(oe&w z`(IT-PR$6V+iHR9%WfVQSx1lpb}0W#aWU1Q@bQ(0R!`q0HVH#Hl8^+UtPUs4M+6+O z|5*kbYpqbl=`c=XIi0o$&~U*#%Sc1KxQag2~v?Pq72Z;2H|a|c4U7; znT?^;GD0`gky;6&z9{0??i(A0&uXrBK{*sLc1~EfaR&&8RBmJoB6JhOH0bw({JEHw zm)gr!Z-k=f;(OigD{caR($doqci{}E`h3uGb}uLrS`*QqPy)&JwlD1 za(EIKy@~XiN0C~JIu^RqtYbVpM?1BkAj46h7kHQTM0765^7sx?6sTeD3izlqlCm^g zM#;%a`i&vhi+Lt%^AaU5tE7q8GAm<7ShEE!YIc~8qc_1k9LE$11FAuWS>6E$!qrPg zat-(^>uCfNoT6*)DQlz`zh)TB<^wbNIQMxf&>T$Z7^SqxOm6nm8vLf6l}=g#9g7GJ zlm|+y3~(9@5uSj4F9^plhatZaO|mgerxTRNp|q1TVI=dY=*ey>=Vhi@ zuNnw{ZRxiH%Sr0Fie%3E;spZ%`t0r1@j&Fsis>f53g1x=Pn1q{-if zDM6|Z58?sb`__6M0umWYX5~o}!2kfIcX5tW9szs@^O#LoMT!gCl4Is+!3q)tzliDd z4|RaE<(m0;w{}?;08U|6k^$lb9OEv*g>in5M~pFW#T zZcxs8QiiOY7|rw3mYHdDr|_$TMJ5_M^0YW4Oj9}leLpE?7Y^%qB}o%3E2|+DvryAu z%|U0GN@C=B>ri>eiX&x7D5}qlHFCb;)I*+zqmFAKo@5E4D47*UyPFxv5!)}*kw_1~ zwu4l7^-H1eQ@Y&V5)@AJn9eo?V7ArbVIbqq!$5m5E1k#gsXA1B|K{E0>!a_?zYgBK z@sFE0G-|7fiUuz{kyVwgDM7<&0`A$aA%vP-8bZO{b`O(UWwTN8vttcD{=G3WewM7j zl;!C70}2l(Yz~;SyBPR22)thtyu?i_SMSP#Yku~pN2|Y;S6oDbH z=v^VM3S9tJ8gu~KK`?cwvV3jSRA_32Fc)j_9Osk> z%Q)kST%Z}w`B9mBnRque3$G1L1sX*$8G!xgFaM%stO`VzX1}aR;AY8eWnJ0?NqmP= zM2HOefl-`_z)gJP-B=br-xlQxRiM!X0!??rXlx+1`N`$VG&^S%+~be=Z5}i0z{Y9J zRL~=oKz5SGOun6nG7zys`BH$)FK0BJ3z}&QI8s2*`CrRJlX;!Y%o(7hS_kgE)2KfZ1uq9 zmjq_%gU#3eI_9f5qgVoWiMaq)pNk9?O@1MWY#ijKD*)!6ZOrU7iqMf+V+bRsoUmIZj9K zc%L zMA8J~%C_pLAV?+Xqxim#I3>X3u+{bjx{~1VJdZHRMRvNR_D<9?L-m9!I-5aKv z-Nop>E4w17mF{<4fvsz7UWP}bpV}(F!$+dn2<|hj_be>~&5GWoCxEza2 zK_pH`3D4@wPcYi0M(4kQNm6)j;E(j~PX+~QhNeVPcg&g$t$md#UjNVZA<#F#M z%9KC=Ws%5@M?2s|UcSdeaIG$PWF3{y&F9>Lhg7(=jA0&KFF5E@q_g2hcQL&H~AE6M&T`*2?E8NAJR)^0%7 z@;L_WncRG;T3!g{Njhg)N!O+8Dq(xQV|^G`)DB*dojVVyKgD=cd!}!9NHsSafSIxz(sHmcp;snX}Wx=MS(Pj z6#-0@5L{~+WnGe?I>@U0@l9*8Lnpk)Z$#h{g z-NmHsh{`IGMq=fmoPy0_Ny#c(oG zkV_MDhNroVYDks2flpBp%VKCL(70h!+D_iU8uN_K{w^SGD!GF^yM z5TQHME!3h{lF)Fd&8YtJj8*AH`Ex4@+Q|?^{PF#0$BK*>*5bdJMSnNiNGo_dX#1MA z+dK00N9lY`bk=O1^pnImjnk0 z8c}!W8Y#b%;J!JPM$+D6BP2*73r~Y{?nn%`o@b*&_(5Dz;z%D+e-MYCM?{U z86No%tc+MyfvP%kRchNec$!AGaM1xP)!U%8O^N->B&Rr4dG7h-dy>wk&O-(Hmx|5U ze9OEBEG;hG3~Qi%n7kf#X1HV5P>yrU=9d+2*RJDr4KDRUxWdQnKbd+F+!w5{`sq@g zDmNHcxGl}-iyVC}10^Nu#^rC%d%a#Sc)t5`|K;D!uIo-X-LDdds`KarzsgRoayT5u zVL7PYVY#XgsA!-f?He*h-g0wE%9gZ><}Gf!`RWK1nt-PeR}UibU~~D35_ioAlb9)# zVhsmzX0HQJ&-4VG%at5*cFHSA@eUt<+A(8;vX$a|B61fK6cvd&uH~8KS{(DY9fBlK zsa)3(z%MQq7#3CE85XdmMTnWgrr+7!Wqb07Gdq{jlT*IOZ?AKH2a+5au+uf!;q79> z@d=d_sbPr(1hlB(|IsbyFAe+U+!{=8FpPkzS>Rifgiw64mx9?Ro6yBNCN{bYn2x+Y z1O6^b|2l3`IlVy;OD8 zx{c}gI^zF&-QB$^##*iCuHVJ9vP!-$tfwjb1QDhv>#Lzl@wa_fWQYXWZb!XB);_~2 zYBL$pKIAg?YR#W0I>*s^SIS+S({cniPK!eM^#C#^WGH!Ssll!f_w!z_ zra$%OVv6!fobsvkLk>f9Zh7pVq!f+#6ckU+u$~w#z=$=Gj^?_nBHys<>(K(B78mPA zWyHA5^+D=m#$_!#Xj~R{j()~bE5D>tPToSc-IgWZlV2L;=--|ts^kpx8NQnG~Cyd zHN}Q|`ZPZ}+(*y4!o%kiR1qL<5XIH+Q+bgnZy&hxx;hKXeUHD)i!miMhgl{pqjLdr zhumWa5-((@G6jui2WkS2TMN!D<3;)GZeTGuVt}a(=VeXw0VCr#c12`+d3Rhgw%$Kz z|Hjevils}2*ZU+*9pp7d*n43wA7bwXw@Qq?7vQQv_FkY56J=i?5!&}ggv!!YLzs7W zy`5e<&c4A6eV9;tKlBx1?fn2(3byxyTshj_5B6&hw=d3yOUK(cn5+*Ka$f;|m6-bq zkgEmVR{&i->b?T-*B^GTwW>#sySMQ^YT&(%`j3db*DL)oWABS8zGU#dX*u(S-RUU z2zP*dg+9Xi!B^EAquDeSJr*w=4{?&E3oaV_4+~kmRh`Z-*7X026Hy=*U18!B$rUS71qBqec>Ye@F7yI(9eG7ZcyiACFgMnpYZlWm^mkq}7 zdg!n0e?_JSi_xEVt_EWy8zgI3Lfou7U4ubz!+Z@7NAwaI8?>Z<_>>Jx?+p*0w80$1 z1+zBj8`v*0F+qLW25V|BnYZD~=Fj}Z4WDnu2F3XmQ#PzLfM8C}h8h|hCvB)A&_wUg z+E9ai!L$u?Xn4@P4KD7=#0|C<@CT=Es1&)^JNC!QAPSaElkKe05KAA&t zA3HCbgW}Gkq;s&mv(}u?!4wHiGdg(ad4QA-W!v6DNgecQZI!GJKJI+gc^wqjR!!{S zW!zJ0huYK*=Z~G*LFxab<^eK5k2RzHgVahV_7 z{?ASQP-6U7n*70K%-rM)CB}U1=@&dx=aKVcxD41h=sHRAALG zYWArz&QtDr?x2;0i(x*MKJ4vwWdf2*l+rjwNqqtmB5TEy4rroq~r>2rxpWEnd1Tc{!Bv8!k zQaEyAWi+2TicXG3F`@aah6+`s9t`6MHy_pkQkCjJQ8=oB!M<+AlgX5dVTB_CV2+9) z85C{TLC^FxK@AdCsW_?C!V~>xT5xR+C8ua@?u2eX1DX#;ed%L1490}7SKf-K^3ztn0 z4~=1p3D`^^MTBnd0F)5zoV|H6Jj0Ybw4`*isSaaYp9s@8Ki&q6z3hDJF^3yBLMBFq z&~y0-Qvi8>5W0OOH#F_Bt3kKjw7sl6M~qeNOinGDkdAE{JB z=nmyG(C=A6#1K$SA$LmN-BnSrgooCNm^h(x#za^Qc0^EL5iV!rXOz1f8Gzm0o}YQj zVM5voE>MU$jR)G1LK+Zq^(9V0$i4RO$0!#YaRLd|`eaOaT%*!NPy`?tVH_0-r@5=% z<8+fMw~aXD>yEL2;bL5i)ld}Sj9HHEc&H*wXCOuQ8t^bzF~E#t)0D=EN!~=J%P|P$ zW_3oPN-)e&j;1h&DMd1tHm0m5gM(8fEmf-B%}n=1xcaf4Lq-%6LW~kr^qZT2Qp^qR z<@q&4kWO<{*uWuZNBBNH7*dp<#z_*(Inx%?03?VIb|6Lnn!<$9wcG3UI_BBHGp^Qp z)`LLfiC~N{F0eDTf3|oD(vk6OGDnCqJu)2uXzrmYju2l$_&)W6R)em9nLsm?4{<&b zP?gW2o+hfxUg8E|zt`hOLkGbC^uHA!JjAd+lLRG~vos_|-aM^l@|huR18imJg&qs_ zm^Ef&G9_Y#uxYB)RqlZVOXOQPwdb8n*#Zgo^zb%KxM%1S4N~qIBt2dhxk7F|d>Xl8 zHmo6!+@-_Yx;%2l(P>?Y)_hapQ4+0ryRxQCYo1Qc&$Q+xXkDq+=2KLWYR#l-J-ODZ zATFD1tqR^}kZsMBjb^$vRo*P)nt$wk8P~ME1MGh70L4H$zggEbYnM#B=94?Mpx2al z%@2I}#A|+dt7KmDLtHiWnjh-do_kIAdg^N!Y4ju9k(Z3hL@<*s36Z{dw35ee01Eu{nqzH4~eI z`_WRd{h@D97AN3kA{2-vq2@#=fUV;XZ0@qtEKIf=UqE|FeDW(_t6#a7$B*P#?jPSp zJj?sN-l^+b?(fmVI+y!<@|k;=dx>73d$||Q5L1F*5fNhs!ZsN8!m}Kc4o#fj)>+ zP5<2CV@gGnv7s1Hc*_H5FjJ2?GU2ew14`H#QolVW9g^@rYVpx#w(}TqYr9vZH`jyzXbc}K{W6j0}uW%*? zTxCkL!-iI!Lh_$F?Q@r5m4$M*wAg5Ua_z=^-ecPW;G6+!ON&gv~YKY>8voiZES$85}^?yRLw|6$9CZ( zYO+h)0V>Cj=^`iTC};gTh$4A{jb%wbmELCzw>6+%cQXmda5wX%*UIe7S-g~WyHqW@ zG_0UT4la?*(6WYFUqy`^CuqO`rxdBMp#@+ce_&cBv9jga2zXLghQ;?8$c*kdAApn8 zU!%yx>iNhpSi~zsfMT+1sqhT!u{*A4sbM`{c2p^T8q-E&dfa44<)S>hJT3SH-Z=LP zIxa$;%(y_od}q zIk`3ZOeIYqMfnbxrtl8NiHJf=`R5n!xfjkpUZQT3fQ#=A4u#~X*uvR9 z$m+Ob)5>pP=)7cq14G3*5yTdY*b~k}fl1$NkTISnkzp#C-$4#vNI7|#RZ!2JxmBk0 zLelYXhKz$*%%2)^Ml7T`Y51UQ#O@RBZM0tEyDGU$dRYK_Vh4R9x_ohuJVq4W^M=Lotz> z6BK}AVi*Uf`X)TYlL<~aQqmbtlZ02MXp$xBDV!FNuJ0u$ZHsPxo5B8N(|Uz(QEIMn zR!^qf6NepPG0>(yR)4+TzUo9LQFJ$^1aa$^bOUfJ1QaXV0jmYGnAa%8LtR(r5Afpm z>NXlpg>$&Km1(x=9K|G`@~al`-834Z@)~H!<9wQ$))8EiDQXQYfk1E_0%!648m6nBK3lLXqjLGU12ZhuG>xLh3wD7|_ zV=p;{AH0aAX~f)iYH(UG`HI`v09S7=%fgFlO;6H96XNbgtfAB|8k`*&063*%VWlD9 z!a6Auxpv1WrED4?V=<^Ep1Ci9;vcl^k+iYGLLh}Gr}2=(CFUyA&8i4iu_-b%#g&^n zbVUTH%OMdmLU^EY=6bN(fJ?%U;WnE|{71*<7srPOSI0*k8Kh#77pH_G80iyd8A2tZ z@8bmVo*fo#z)%*N@KnW0NI#;P7ub(z<^^cfuY`GcP=Gv`OJY&m3osgULk`g(*+0yv zqodd2hL(V>I0ZP5#Lhyd8NX9Idd+WsA`r&e80E!nunV}H?Bf*CJPwI#Nt%dad%?*< zz38~FCeN!OGI?h?o-lDYCH%@Gm*KSX`oj>_5>VX|_2kkxRxpiZ(Tn8JP&9dRXsDi5 zr_ivG`%`GRP<$CQN^raxG;Byt0*z{D3+K|X@%U3|I5?_OX_P^EGHLi=nVB?JO^Bg} zSU4KM(E#*2d%aH2%!tu@$|bSxToUD3P#F>|D;R;gGMD|D;)4|dd_G+9JV&oFq2K`A z!`v4Jm(k*1bG96SfT%dfAd!>jl~YXeT&?2?N>o z%hC@thX?scT^hrDG!^eKJGWkHYVYt5=mVT&2^#2=X~#6eF?jkA8IDnS8{DE98Gs2J z)t$+V-yZykW|m=zw{mYnEIQW_iEJ#<2aiGiVmuLxWwW>=qTXs7J0i}-R_TY>2-m~< zAzBl1&E9@WI7x-Znp{;*e;#@sz~^s1Wi{S@dek1%^SKbjOFBN6=h__j%eXyPAX&oe z*&(aho3I-FANMA#L9qD_>@Nb)Kk6QbeK_hHJPs>V5q;ud7)Y2y{&XV~ByCRxaqrar zOMkatjt|hiS=c95v9QV|wgh=Gmsl4(Kl0TQ?nw?m0Ib(@AkTH~E1~*Io%=kDd1T){ zmx5}KyV96^_8xb2eXDY~o72lDhr78mXlZ{tm-Y4jb{iYuys!gFLq0ggDLb%xHi=P8 z$I}~bunBRFFzFUDJ5YD%#{Jhq?YcJ!zUhkWGu#Nozw#c?fv%$70?uIUvIvE(N$$wk)8Z?T5tstv-`uxhYIDj~n zF{#E?iz3$XG`IZ7i)YE_Eonso7Z!Ig;RNVEAXP8KD6LlCgNQBMLaUk$!1EqyhE_n) ziR8vec?HUwh@$tRCeH+zMmAmxNb@e|h^t-+cW_kJ)eBK5&ZFXBoMnlyNAQC@Q9)2@ za#&G~Cd~OOT~Q*6CF&)~iJ5R=>&1z(bRah;YK&8yOU+oNq&3U5(xt5j#V8qTRg+@0 zU1)6-XD^A^6Mt*oX0ctJ;JT$PYeq5QnHEJvO0lRdsp%j$Vkc!dt!{QPO;pZF85h2+ z4BZftUXje9#fA4{%T$&b)+*U&*K%baR2zz24P26T**o=aj6P)fKo~vWPqUA5jlF7r z{HQ%DK-=qa(FPsx=~E!dZhr!=UV)wodWiD@*qxX~NjadMZP<4x=f3GE&-IJ}u5#iu znocG#pA9T$+>}tJSAmZo0qejsfv%&=KYeP0PoGo*m{36qlm0DHs64LujkuZjRJUl9gsjtb`iH7)+*I*_nuIJ`;sCb$)j~f|U@fdLmh{`1)slcSVWe4A>ARQ1t#5&B%M6%u@ z#*hHX1i+Z^;KOes^vwWHg}Q{~d9h!BNt{lplSrfRE417NPSThfmnr4=lTBgCK1cZ^ z7T(jF&TG~7>mlH9EYA8ozxI79pYs^yc$z7nmLhkNdc#(D({W``Cf}9!1w+CeF{NvD zi!)QWMqtt9Zw!A{c?;3~rs{sedFZ6nHQPO+^x5@Ja`+(hOSk)7tLx`KxqZDZb@sZ6 zAI0SuCCTER6Y{?SVa+{`6XiZTE)*X8e&>m5NZO6U56kO7Q3Z{{kr&Luo)c9F3?B*~ zo+|H&I&jLRpc3ACJSeQ8HXJDWrt`$}C+CR=aGp4^1j8nI)Qh_E)LZPz&X#J8K{vjw z^T1!?dd_C?=jIR4lzk0v>|=L6&AFnNc{jMzO#w+HlG8pjFp=+0wBeNE_Kv%q@pChk zuaJ%LJzuKIaLaRp4RI0`F7ZKxM9eF9&qw)x@{MmtdHu-T`U7wsMV^j7=nn2(jVDmG@_`t zQiLLIo|+)>ehuUB9gZV#5A&4O+2+w79HbNV!OP|;DpjceK*d86zO1(4G+#!=ut2O$ zudtvlsZ5k$JZTVLy9Qy8e5LoLUlOhFaTbA|pIBaFLN8|ooa(?Q{>a32m(0kuu@zi* zSvez0pJUASmQ49W^(5K3wJAp>c#o$MSx5RQK`I5n(b=VQq%X*|tGPSI9n51qC4kIQ z3O~rCRs2#j?n~m{z-7UIB5Or^?JSiy*>Wl zUa#l;x8K|EJ^xdGZ*PBpZ+CC+#r~gq{g==C&;JB^E8uMWn-U81KlN6|<#z51`F(5w z(0(Syxjg`FwkZs{T{hx@9DSURy5gT3?HyK~&N9U63co~AmgP(-r!gY!0r<#;Ya8a_ zIHoA1(;VqiqdlQ{oQ`;VQ6AHTe~`}%o6U74b`EF@uV`In7>rr-1931>nIyn9p)ieL zf>U%2a1O3z218c=x`2$*DTDk=yQtpY0d1plTU_UV+L8U6(y^~!24C!c9TahsOzc^~ zob^5QuvgN|Ws6m4P;!HDf?xr=3cgL|JAyz43Ax94WX5_jDs_WTMccNjTt$X6(7wUe zAR3YC47mA7F9bPEBRm29Ucf{e4Eei)Op>P43CiOT2y#HI1Lkd{<2Z^?>huMGHlI#y zDaLo~ZyDrMflrC98Wf|-rn^@_Fy@RPG>B89`H@^p<5g>gb2W{5Om>5S{auYx&hheiAHk~l&^2y=UIWXw|;dgX-iZUVMP z_9FYhLy7Jh{wa@S#{+z>)YhzYJjW>pG>74Br3URufp5NPwLX3fKs*GUpM*_1is2~5gvQ}1j*3W&PoG*>8qgRr zNGL4;#VIHn@(1`j;2=rlv*IF2wP+z;B#ii-nM#ew{;gr+JCxt&F{LQwcLIZ!dHKhw zO~Ygw6%M>KOQbf#>p1N1P?M(;F1h1dI?BHG-gsHDMFwLSCDk>C#W1K#%~K zWzMCC^5=c!Hsj%(b8Mj&|M*1;jFP0Nqs|fP_E+95SA}Nyhd}{i%THmXK8|NVaU7S(v{~_B- zA&pX+&$tV0hm7kg=F_yp$aGdx@iJGjh6?=pMTxnD1PV}Nii#E{X(;6+@P8&mjIAVD z=jv0m3yX)HT%i5Nhy!jbP}0n+8p0_Zn;ri6k=5WA{bn_9lKyS5<^OJ_jNj&j2kZT{ zRN`YX7~g3R5GF3$9&Ws{nZf0V+4omm-)ZyJ!lWMuJHdp4B)&z-OzN{y`58Mq$3Y@e z9`P{Jbmm+a2%sn&!!#z7j-dT}{%EUoy~`0KI3+va9sxpgoQ{$iAk)zZ5t*iu5lHT1 znJv4m^Fg$M3|45L$)}v!9dJO*{8c-=ambTe5o|)SIAJBmxQipkQV8x~5=X^72u_WA zj>1i?v;L8GmqO{EYFeXz6|>qfeA!o4#xkf~_r?&*m`xGJk0Njvi_{KWJi0J^FVcPb zq>iFP%vJ_Z)_8U)?#y|Hb2eq-lnqa=-dK`irfC37r%G0L$X(bmD3#!k@C3$87t!yG zi)SpfFCh`KkA3N~?Hw7PcEB*s3DwV6R6RW?P^rg_V>6;CPMh*jzk&AYlaZmBzj_mi zPH;ZL8+?a4En8gHjAG@8kOo7N<#9@fp#5hONLlk|!WsQ%(gs_u;!zr}ZQoGM9iY-M zfGwAWj^MK=;kJi*Wet4{`U7WzmC096>Q&KSxh*cZT5H+#@M~4gnPr!3%aMMjFmw0w z))nR&Cnr}+?|hm{nuVzcTpS;rT)sa)xV-%N?ZwfnXIrMWDzgMP(hMygaF%w6_D~ev z2LT5EBsk3=9lvUSU%y-n{`?cFW>qJf*f(>_SNPYxJJucpRwXQV;-=Ae4bPl`m(x8=#pZn=u#waEP;+V6B@8x_GQ8 zvbhyz&6w3?8*KWTXCDrB@wlJLcs*i#2fk$4AH&HXQJb! zOvvEmTt@n6gH=c0TK_CwDjXvqCXu-G0-M%}`L5|j%6;P@-?Uc7Oh<_Ani2W{)M7Hzj;dE5K~HX+9q}JAx=i_QKim{9c(a)D{MpQM!>Hd( zT&fAc`V$Oseh>4g*(@M;VYl&2XwJ&P0$l&khnfie-ItwSr`PF!8PlMw<~7(xeHVXE zo9OcAoTrV|+*qq;*VDFIy{#@i`M#p9w*HFcbD8y?jkZppuDs1IKQo%LcF=eX9(~*W zET@FuwBYwQ&?6-d=KRg93(PZaU%?R(@}%W+JyR)mI=QZ1%(#lQZcD*3v$|A}%^f)) zMWTfydaVWk6M$cDEfg7LpHZvkguKf}IgAk4HZ-7TmEhF=Z`gBLyE6<@B$6df1-u>k z90%(mYb5?E932Uw!hRyNLYjKm#(!A<51gE`z5C$o3OHX{|MT`8I6FQ*0#|Rr`SHc~ zZ!b>4!5MgW{=>z=(J}b`?FDz2lVbA{9Go42pWj~m_~z{aZ}Z(TIJ`JMxH>+nn1_F~ zgX~xSo9qAmevFa~<)lNiWJw%z{J)>~_8tH4-QI3*@5%rBF@7IEcE164@nj(6L7X7& zJUC%&3CCyvzUc~S+5M(A4+os$I=F+V1qvjK@MeurhVS`(_I|cnB@__zB0R;V2-_qE z3wk@?Z~e~8pw|YSLzuyvIEiVDNax4t4U$kgKg3i~qu}u~9cZHu6s4Rg-Mjt`qOf0} zbNsoNY*UECXv*fG3mTWUw&T2sH{{+ftbgt{@$`Y5~Ehnmx7Or za3i1clRf0_YSLd(1ce&!MybbID%PC%e3cNfjx08?Q-kklYL>w%#Xq1FCJkg0Cr*_!M7uPs->a6tHzRR1KHs8QBVPZAW{<`0TjY~*_3Zvpc4Ik~|A=Of z#`VL4h7+2P<&=@ZixHe)L+zSCP3aKYGm*vl5HxCgsssRM50roA10H zG=fy!J(=Y|WmZ<%LRADE3`3Cx7=tOPIeqfl2cojQC0TyFW;Hp{j5(o`9XASg@dHg| zz^!M>Y4C0Nk9H#*1Oh;w!XMRzC?W_c^brvZ1)B}8}MH#K=*$7{YBAQ$DQuc?={b{y24UBjIAA`G(# zuoTa5u+tzD;4l_xrQ;O96e!x%*^a-u<`gE-0bf~D74yI!b|HBFpUn9Yz)t) z6VV&1i8Dm5Tr%U(CDt_y~(i$8Kbu7i(+UQ_+utPv!!2;DK#bsTTiQ zVECqqG+F6EZTl|L+d||u5j|}&uiBvB18pt?+@-Y*=F2B=I7ZSIqJjvn&0hlEEO&PYRG0zc}j`%y0 zguoHn;Zitc6^AfRDkZslRjq9g5)NVFfg3lyUtq>_))!^&`NM|ap*X_{9?dSZ9Kq-i zr-bG(PARcAvz1U-89CPmwQS21`pfz-(4>Y5D&a*@*e;J1tN2eGr=b07+BT{NhWCN4 zs~Q8nFaDbTbnxcg@g?}_;LXX=!PUvzv%#+^+jVuL-}z)}u&95MeUn%HIv=T!%>f|x z_!CONkKYn-CyknoCTrbfa^)dUzOUt~6k(+Et&3-LpoPsEW0(z>TsLY#&uqojK;6KRuf zhQIilyUOyp>_!(epd5tcij|A`l~Hxa?YoEzE3<5|30=AZk|*AV^SF9PsTjek2KEg{xt0#o zE5@)2l$_W_YB7nS)K!t^i03#`PGAC!NNQ9?0~p3AiB{zM)tgIYG;F$2B;_r^chyw7 zDzfgIJXcA}+%*})VBjusUcT3K_2$yUYbi!~BhO*exQJrQrj%borm>PJ_#==beXC~H z?93UeBf)j!$s+yu5jz%Jk4;q!6)L@_q#X>3gMag+IgajSq?gZC2 zBsSc|Muv6jIE|Qs?CVVn$VZ}VMnrM$2^lip%;@l&agD)dn|yX^KHCh`>*bpl@S=?K z6Du=uAIhX1W@Vu>HLIWV>w29XPR0w0$2Yx{_(s&nXg;%r394>LRh_CaB?-JkL6I+V zhKP5pC7cF>ZBn(~(e^`Lakv%G#^XJw!CD5~%k8rK^`}qMrKNe%?$Svna}8HzgViqX z=Wg0AF<;c*6ZvR{4~CepmxwNs_##Mggo0kDas4rZQGy6rJ{RvoNeaqU|24(=bW-9> zgzwV;4k^lmNt`4xK_O-nqzR`=6&SDs2J6%W<)R$IIKg))4`@6=c%ZTB-g{dAkMZ+bbmXgSbL}~5ZakTCmNDg+Mw-T!oj=T& z5E6 zi*|mN5bA3nr!oz*fcHXrJhCbSCq0Y@^+KtsWj>9jIbp0!xBvhO^AV!woUnq_M(nZs zsp`00ozoNd=;@)z25s?NxC-FBcKJ>q4aZ{ncxKHXEgir9Uz7bmq2pkcYoPl5zyEyi z`L4VFzkKm@|MMun6>oIJ?0DM$|6Q(fvN#>R&k>B`6cO@1!68gKWL(_q{73gDPP^g_ z3s&&UFCZ8KCz0Cw?@!(wgMa)3{O5mGyvNgiw)HpAe)iGR?o)fatwE=toTRM`w>qPn zG#HZ%rv$xvwxzZ?X@3g{cn+TR#WN!S6mO5{5&(iR;A|LULcy=TAVg`Fh|CV{(JWt>lai`qM{i_}MF?1cM#)mv#95IOjD$iU6d>?cmbI?^c;V}pv zn*7=Q9j-`@IEFl~yTs{;{~>Zb#zXK6Xg~X3Z4jV;fp&j)uMPh3S3t)ol}%7M#-M!_ zPf!H#l&W`|(TA9VKL2AFo1oNeXoLTF1={Ct&wlVjEGkw&&#q3+ zj^Ajx@c!)G>37E$O~gan2jlR7bF96ZWblJNzPKs@SAxOY;>Y9v@lw-BCTK`s#Xbsi zg7oqt9e97M7g#sWy5QsYZ{M9Ay+1jB)ffHivbn6wc^Y>0C7-5oq(5D}J3Bd2-~OW; zXTP(SzpF};pm+$jG>TXKZT$g&lk->4`hNxbYwxe}lVY?AG~F_2u|bF|@%_K*0;6UD z&IKeWw;>gwV_K}-ruaV9Hk$bt#(yT_|Jpm?E#>|l)e&( z&x%If3d38Qt&HD)w^~2@Uvryl`fA$q&OS3f_)QuQ+24}!WTEbsrRYMv{i7}OkMo;* z|09^!g_#cEUHAs5{{H91iL3j`2+5#V3u|4%n%`-WH?1B9mvRomPd7X zy31PbE=#$hsMnBvb4z4qwA~nZuMK~N<@_4<3)QOGxT^>~V`Z8PpnWOV&LyJlZACKo z;y7E6%U0b$OG>6$1Sz_tIizSbvuak-EnG||C@sjA?FC~g{vS9==3w%Vv$l)bwO58~ zGC}{Lwn{la3}M86OG}4uO%=SUgz!iS6;XyGTT-knElPl^R^YcTO6PpxNduvhZ@F2= zRrv$-rUZGp?l?|;Ru3Bn*{W7NiyE0uiV$pTBi)kcpw5+?fSvCkLFbT;LEDMiZg2Cc zMaFRV#XczlW-10mBNpBr&9QoYh3b%NOhR`j%~8n)OX1>aITk=AvTrtFq<7tww!yV7 zz9xI%!>qsu>6ah;G96Rfe2J#22S+M)Y5%y6F`)-Z3<)wiZxlAxZ|a8EL}GwdBbrvB-5* zJjFw2nO|HBl> zM#`&FVjBIZsIsPBRS~eZK9Vua(Rq$TBqXwmIaj-h@3T*|&w_|~~t)Zf-JWDcgP&2hI(wQ~-sNn0b>KUZ-Dizu&EVCz-bW%?1taFk*~qb&8UEeL)!D)6$@`<@ z@811j)c_*zt(50^3iBCg^Mu8qJ%kBCZLo!NM_@EGXCLzSq5kHBa7i7ms67%TL+)+l#A8vZ~a9b0a8w<BX9lX1G{r>RH$?@6M<+7YGJ;9n|*3RWMXlvZZ z=7Cq9=!-)4&ov+Y2aCf$sG#37SxPVW&8O(-_51UKi-Xh4g$XNOBwT2f%@;NgG?8nF zD(e(HHPCT-_Y=%Z!g&pPg$2H$eo?Q;89TEF$Kh$+SNS}et3Z?``+Qyz6)GZ9(yfK}dnj8Wu zY(h*soo44bzNu(u)>uw8-|`)7O|ZpbcDwnSqG5K4!&^k%anGDwB*x%XoExWv;>o2+ z(3&|gAL05963Vr-W@xP{HXFIkA0|gAfwLOhl#RsG$Q`w8p0&${nE7p8;& zoJJtQ=?LY3j$x{f*xEf`zA&2Q=#DW}zFZOG6yPEF4Nq=j1TtY=MWkcTG6BLQ7)DXQ zo@%?1OE#H?4Aa#(M`Vl>uiu~z&u!sC9Ktx6=4b(kZVMM8`cPasScm19jro+Xv=T2YShdr2eQVJ{y6R$Vyg~_{=AmmT(#3TSpGDgR z>ASs1v8Qg_yvd))-%F#W z8UR_v09;%J*M4_92kz75?Xowb-b=XOon;yiWyJYr#ZAg4 z_=g=!tA75>HP5y}NI?axZ3l!58!mpl`g;Kx4?w}P7~@wW5p|a z^`Gsh+r9?7Y~$OvgQKI0QR0-6LAUGKYWTM+o@DqnCKP=7G+4%rTS0hbq6L@uuI2T zQSq1lZhyWawcKI1)Oc;D-A6f7E^>nWN{%t+{Cv1`OeL0;4>EJkHu8olj!@{V>@^sp zG}!sR!xbLS&r*aUA~<1E`l4q+H19AdnTGxawgAPKG>_8}*s7tkasubm^nko0CdWS0sIcaDFs0U+Mo@B;qLWP2Er;o90PBSDq7tkuL|o~^F#7Oj;ERP zY~Nz!SDZ^9V}RycZkl5QZH=zE6{j?GUW%3=W=&?KGRCDex;ijxzsdOgjPdg|jH)fG z=oQ;B0#U7r$d&+`%V}wb0PVI*R5Lm4PF#z5SsvfT2^yiuqhji1GXTBnnJ9^QxR4G9 z!5XjTCFG@6PO0r$NZ~8tH74|OMiyOOV@&u&tT}afsx;BNO9g@$PxxBZg`@UQv`P0R z*piJGNGVkO1gFGuKz@2 z?s5|p#dazg0MI0(v!gh-NfI^Z?V1u^vuFz6t{eY`-o#9EbKQE>hq?Q@RMzGE8M_&*NmlUNMVP zjfrpld74%v+~aOvV>hduMa}_b#U*dNr~uZo=-0EzY8?M8W_^eWjnmO#0^>%W6X^-$Nj-J+e^j}j%+|wVSI9H~IIh%MD@;M4bDdEz*$9NYsxqFc{%8Au@ zw>43)^>E3#Yql#&*WM=s;Yz)7D3Sx;2@^<)Twey_I-)>(l;9hf6m`Vko{jdS_c;fD z{_m#w-!rnz%fI3`=l%cZy_atO_ul^A^QZjpkMZMoo*Bsw?qHlSH46-0fh~e2cPKx^ zlMLnvwEx!c?7j$ko~_Wz;?A~~B6a)rHVEVll(|K1JZc&nS0TbED)Zt3Cx?8-KX&i> zH;6*@Qt`Rl_{+}*|M4lydo_Z^v%JG3!T0CNXnssWm~dDFz|*(10FW1NVw29N2^xUS z(%p5hE%UNrb^~&kMT3qv+B2hgvOHK6t%Y-+G@7u+w+`9gytEJ zxH=}aKA&*1l*PM#y&|}xrDyFrVWkOY!AF9Yu-dH6UQ?rk*~Xb=%`!fNjHRDCMi|%p zvb5o4QIpFbW^Ac?tY$I$${%W3sqDgI8&h^0*-yUoU(@|xzPhlK4lrl`f3d&!!rA}( zFZ%tb{r@q3o*Ov#H9yx7bEk|imtszQ`6idI=K;R5!@pX%=AONP0ms+x8p!M5LJj!E zc+%8hwU$v^z)I!2*tHcVI?Md81xTLocR!qQ_vqzT_4XSKqwin>(-7r;J>IT=h9h*2 zbA9uQKJe_N$yE-A!#J#dT|j~HHmFhGWM5qC^WR_fJG;9}n4dY&I9-rxZ-Z)T-IG%z z){CcBCmEepwM&c^C+Dg&c4=KN?3#Zl`9j~j;AS#kN6ha{yJWVh?_342FqyKyPtND} z{!mp_3qiN7qqacMR3%p}3F40Z2i8MTPGKEpZ~Nu(o6miCKdt4EP>+0pvw{(fs~rNv zEHG16W)NI1!Q>x@Vxu~ z7yEne`LEZ1y8nNaUzOA7x{iJV-WPlJGtxJFS%*J4jt_DAs{y^1<6jN@f8X<;!<5ni z(A=Yab!}au@qx|(#K(T*lOQrdXq3$|4W63k?_7- zP6M20|9`pn+|~c~_V=IkzsLAF%TbQDbi_2YK%w@XnV&7q(26Xzp%m3*T$Wd9Y??su z$sO~HcE{vij#8Mmgr}R9n#)PoeYLT%$#yl%3b(hDbd)1PDy`(UlS_`WBo2AUj2+!s z5Ikudhgvu#94jn{|HD$68(~wRHo!rW;Cm3Igu5~%Q}$V6agxjha*uxT+zfou`|!J? za|HlqOXagpU;|e992@Z+|*f;FLi`G1Zx&dT{GW62@KJc<#>YV7)=QvVGc7yz!2xw z0kl#|=`^ehOL3`aJd_w$;1`kOO^=&%&wp8Tv$W&4{LMN4_4l9e+vmUj%jf-n z@BG#4n8I7Y5ARawps>oyNIXsahQT$SWgpd2IA8wj9W|dO590s3TaN$k??3N7$^Xar z`8=f@70WFzX2b=X5fxX(6P(5r=W#mfgg8f-%Z;wSKt8vCtaC3=**86V!knI@kFGUAehxl2YYmuJNxi$jw4 zj9CJ<)Meu~c(z(Tk*D96^_#o@OG7p3jx)IAL2#b`*UNq>{-?jY_q6{%#?Q0=%MtIu zDa9m&3ERTeCcjk|D73xknUPH?^T4P?tR+D88S*vG zp-KAJyzwry?|z-zE}uW*u`&Hb+al99(gE*fvj>AET_q``XgEzSk$9MHO;dCdrx&u7 zb!_#mUZbu)_BL-^)Rm2ea^iIk^Z^i_K!@k=iYrs$-*zFxwUtgH|8$cghS}7;cJSn< zdcJUgkZFY$G#=cc9FEXC8Yl5@GE2}L?vy$QDw2GPil)_GFu_1(e1q$x#MaxZ)%a?t zr)Yxn*^=Wo;f+7{A+)>r2ajR}G2Ve(O(k!x|1BQ@KG*-NBGwf~K3B{xx(2r^YcCW@-n8*Ye<=C9wE{fY8^@A+wv;u771coh z?4rq)I$Ci|T;TjC?N|iS1=f4;Gd!_sT-Iu#h{$G#sd+_t$JR_<(ttyG5+qJ$_NF>+8gD#I!`$* zEg!5`(i+Q%8r>(uQQ4<|EoPPi@``WOE#!8#_U@D+FV~%t^~>ntmiwS7cdkBE&zicI z7~vR&w`4l$>W5FQ9dwH?VeqV@UKHzm2MOYDWVeeZTs>=V^VvnlaQDSNu^+qh42VW7 zp3H5IRn!lfBiESZv%$?#$p%Z|5)Vo?N5$(mVx)iNc?^c@Tz*Y=36`eYLk{}UBy*y${*kXsVm zd5#F;o?cR`Y3oyFyV;w2TvpI{-SinCSEn(>5o$~zt2~cF6QCeZn$2$cyY2I9-=dkE zJfu;5QMIavO{YBrd|7&w(kxxi^tbS=PjFJ4pxoW^jKcL0Z(>;|?HNw+Xm*+92u6oE zB{YX|O0Aw$R9RQQswh}rFUc6@=sd?E5)xY2ZHoQH_t|gDt_ReZo^Xt!X@YWlzp;w_ z_^pOZ?=w+K%yTgN=^`&)PlE+;nYTL<*E(-?3Jgok7>e>qobq+`Lk>f9j`EnRE;x<+ zW}Vs=1z??9!U`of-f=b@!MNJ#)oJ*b(tGt97Gc4LL=ooV_z^!fLcGzE`~*k^-^RMv8CU=iPP>4B;yAdIGB%C z+>RYA4B$G3jKf(osTS;&MvBwo3{w!gjDjPOi=lPEXz+9e?-k2df4EoC|W3$WxflWOg6W=I^q$xnqF63qiFXQ>$jIz|37>0-W|7X zG>rG}{S?UBeIohQt}ec$k6QP66^fcBkFqi=bgSlZ~wJL=fH*m~eJS+S^x+qi@vrVwO2{z)&+i;FI221qV zGw4%ANrE2jjJycJaa_jO&9uu?(j!)7j;>kglXs`* z7so%o{r2dzmV(MEJ4%1Gu;{^?H}C#_arE}&{GS&m2WMx0e|P$-efPv<2!;#O(uEnD z5%#w7rx_C6rC^~_Z-jXyFPb)W1qbBC!yVq}Ow%pK?Pcl72x~EmL#wbza4L#Ot zedEug96*DfgT7^|bfA1izjIj=WJpbY1 z@XhO^Ls9Rq%gBdEr{@j3+`$zrqK7DD4Xkc}|J%_&mxA8BmrVQ*y2C%H z!Qa6x;p_yaa89|5jx8rmEk>_?xHvgDJ$QT88L?MC$iX^pvvy&+E>3R1%3%Y@TBGsJ zPcW?*~ zOX?z*qbX03<#BYw_4nkI$~b}s{~Iv%{w${G+;KOu@S47e}Wv1 zUWziUL8{(k%f7fMxgj>srYK;>30Rk<~H z+smiWxhql{tQZk50{4})TZbQ6;cmT;d@G|N>$z=Q&?ccXTp^PTZ#T`rrd`KDFKz6^ z!YIx7v58fV#rJO}Wn{12EXGVkBe!dbAGcLRr^8lmIZgur=F&MZ4bWS?om0mkHtkkb zPslzKGe^wYL#o0hXGzf3NrU$7l6{;bS+~zu;LbN9Q zcT|HS0+BQnS)4bZY&G?LA+;((HJVo3d4Mv(T8q1fqlr(2Hb8O*uF(Zi6_zxwT zFE65ykD!1t)7O9Uw}x9GS?>t~-KTrh>T*W{=}y-W6e7DyRp5=W@SU;^!IN;FLUBxlkx zTnsi@;WnY7`{BtSDf18_w+A;@hr5ACeo<& z>L0Id^q+r`?_Qd?b(*8Y2E*DbdAZRVl;k^41h3~fg!){Xp4X=uvvlzCC!ddPd-_=Y zlSO&LXj216^KWvUKDI2}q0VuCNj~=WH%?v_Dv>Os;I^|uEFbnB@FDM!KK@w~F+_=} zeXo}zDyT{d{z36Q@M*I17}|)@Bvh0C$ue{^s&r+v?#(}gVfm$xE2T65n5vLwNl%3e zwu1&;>SRyiP(BnR@huB5VOZg&EmMH{|gqI(}*>$*02y{#fVz2<0leWLIa(hZ4Ac_2-gt& zo{_YM7ppi(i84sjy^ag|_~r*8IyOK9CC&m>Jh^F+9l_+>ag>#8dKa9H)#a1Co>gFW zrgZ#7JBi`2%BUn77wq}fH*i^hLxPNSxAX4Lox0>|+5*KU$eU0_&Q!X=8GItRyuHU{ z6s@OqUEY31=q{xtiYv?wXv$33)&%<~Z4E%N<6$5_pst;+v7I$c-X$a|q(vY`u<`Y+=8xv<`^Izl@@h4Bas;mE>>6k@#}X_E6g zVJ#xUA$~B|X&r=Dm21S1;i%L_YCDC*oAFWh(L6nzrdT{NONzfQpr#ss{Rc#~tmyLf zPyX8Oc4T&rdZ%@|Ic_kF!8lGV9=s;5{na+FgMS)bm&u`j9NrpD=5OjpJP6fgHo3C7 z&~ynSYa3%{%pBsy>~OsyMAWMTeoiMe#-!CAl|dYPCJlOD?*H*MTk0XpA|EyUD4#>R~ZIom@<%+Q^~OlLfE zinr8ssR2~&soRJH-HY3a`%;@U>@C*1`4n@Dy;E`TgezxQpZgN8j53I09N)^P@SG{T zWN9jwNMO-RBzHK>wgEK*P6SExc-V3KTk&eAdsojNdylUm^GPjGjMCa0$k$it;uX}r zC9w5!`+1e?HwCeW08<5EJ=UHua;vS}4wQZM-wXVZd=(C;>@^Y&3cT=tnd^DIbQVhq zC5$Am>k9oyPsQ#2Y~tVa?HdU-Aa^x1CQ1YR4#O+_c5>5N8;KqS|GDX?o8lD6U)jllo&e^E1kV_VNV}wK$H(x{clyn{U6``3 z4ZOe@FmQb%web`Pdb%53T{uyyM@=w?o*lpKj8FI74T8o>igXI=tl5#Z+&3iS88x76-qq!xzo9UjiBH$TCM z`|QhV_%0my>FRFnY%}7zUiMlTAWnu5qpypl!fzxOOKr&t(lx++*T06uwZ`=!Cd4bA zBhOcHE6L*yboV<%FiXokxO+BxASO2-C|ETQ5tb&lu;yQ=uD?8t(Ynj}O5&V@XpVO# z1Q+~#9$px%=9aRu@*xL`Vtod3zJ+K!J9xi%iC@XH_`MHzH{X3l0Z0vpWJ=tzy{8X% z)8AI789B`2A(5PQs~ky{kHb37&`mBO)2|(Bb3YKPKX?3DP2b0+(O8ps*FwaQ>(H4# zU?DSjMjE_+zuqsR$Ni^W)GJyhcSarMzKlJLvBVP7W|f7OJb`^#3K^F+>4w9 zNO9?Ol9h}P;yBK-Dj!No!A5^YI2y)46fj2!3%At=p>*n}Fx34vBtrtQU;ot=W|18* zJIV=Jh?K;NmFPn9dS4K=3Anjr$BV057}}8ClHQMl_zQL+!Z~dN{QcLPX(E44!oJ_6 zx93Aa;rZ5$P-~92(ipB@dJK&G`>g3)xMbFq**Fjn(+iT^3iBFXUJV$u;MpHS+6y;n zFTg=bEqCJ<{X2#?mL1PP{(JlcvaIi>Fv0n-(e&GvfKQ#~s!)IKi{Vc@{}wO%{97RK zN%7^W$)(&`#l2^Q>dZTRUwpmwuiC*_j+(IKd2PY7KIiK@{<~)TG8XGc9VF7Qn_DYh z)axAmdCS&I)&q}wu1B@2?zGco0`yvDH;wXy)9Nupl~Y}^j>e4iVeEm{>X9B{Dq z-d5D2%)dU%c208B&X9ih_r?_J`2hFY2&AEgXZ7s0$Gm>(a{nf88*+%8-diUnGkR-;Ii$%py=J`5K;irNnt4eszSFq&-1$V*mVaSAYpo)C_|~Zv(~$e{4tosPbikiHN-C}D7Aga1wfuZG z+ko=hoDXz0d&A%EAXJ2wy`?QHtO6|AK&QUeSx$UUNn*%og}|K8i*_mbhvx~8K53AE zYzSS97o1B6nn)WScVFazVm1nS+&He=eSjkpiypWX;-LbALE0+V1=|%P8Xt}Rx9Ao# zz?hErj-_HNNbrF@QEP`xwki%_WpiH0dfHipDmcV^yCIP4OU)nh;briwtbmKI>BXLi zhG(Btm3AwT>sMI+$#RpIzEOOexH271tg*F-R?EEBX0WQ+R`!JcjM8WvP6OA(A=#K$ zT3_kZ8NJ$?(?-d8^Kj#NW$3^GcQc!;&D#>bS|6;n40u_&@(g(CIry}AN}nGa^O$u; z7VsqT^{|B@Qg3s!SQmP{UG#U_-u4=u&bT4Zn`KFjef`yT-fVeZ`8S>G)w7GUmI=jz z8<&d3%p3)u56JXS4a-T*6P$~TVsowf@$2*TV=9M`KfiQv;G34s!uyIrX!L-Rw$f>t$i-Q@2|oELgFZ|4czXkg zYqxjZKCk~1e$`?n5yI+^f17=JTvl5uj57;5I=DQvv>`R!-`2GqVujX$Fm*Ze+L-N2 zDGX~J6R)hV-9gbyR;M)a9Vr&YIn14ddh@tu3F z2@#s%L(~$rF)`a-0$4R??M-c7G=vr+wkee(d^B?DCeRrt%(a~>oNzw%KmH{K5HR;@ z7__nyt<#SyEY#yGs*qj&*60B&xdX?cBTfb?|4egsV#p?AghMa^4=E&WZ^VyYu?*DT zy^j4VT6$vWt$pv8P3LEU%OCGoWIV0EC)U%=tL?GHN^Kh-a%`M*Hn8Whi2X$dcLZ9{ ze*9R@$zSHsuGB?;4TA7g;o698hAV&h%5Ia)9kR$nV`=duKd4IVmW$7+N=-RxuA%p@ z0pc&OXT;e&+#Sl=o#$J_E@$6SZXYr6 z2T&L(nqsh%>wUNw_ByQk;XE10`L6u z%mEjzJrU32kB{@hj-dCud11oDX~s|6x1)Se_0Cg1$m+k*xb=58Kx)-Ta<(She%b3s zO~9MC_4YKXHeLZDkW^Ac^2hrjYl0k`e}=21Q| zBKYtxT{v3EzE9pypXX-~0%0||;+S;K8gm1r5H8v_=6CpL+BmS>L4#}f$misEx{FHw zj(pd_J72}q=j4(bJ%iAI6ebtVzU-VBPD%>6zttlk1FC5Qz^3GnVM&P)ThcT}TD6(% zKmpwMTe;0GhQyKIqd(ocQRT#OsC;gz{AAlj!tkI^0qu${=+2d)N*Zt|3wBZhOs2&gaO- zObMNG@7f9JVEPZFp>`wLm3vl5>C zZV^+5@jI?1I+`KW$wr+}%=Pu4_GACakA`pU+EvTQvJhQHyvNMgfV`-uL#;ZEj z7zmP4a)0C@72;lgi4nLfteuR>7=lE$JhYulu?DriNG~!JeS=ZY?JtX3%#6ibnc%98 z@Nqhrct>}eRrAYGmo9!>!3S|P*BtA(1N%`$R+1W@`dOL>^@h%xcf59_5(>4UDrq@p zKR*e|wR!!BFlhxZx4$ES&mcP7DwvB;ON=&@C)YvS7VyDQ4fd%SZl^@9=o? z3N11kMDglr-0_n&cz;qZ@$mZ;__wjX{@$EvrCO8MKAoE&;4=g2Z&~+K?7$$cq&u{D z?>LVpJlupU;Mg;`ez7(CSH-`YXEi4tKjss>VK1o}p`MjxdS_px?ZK5?pe}EKDl-VN z5MW#$nS5-?SRl6w{qJd&{rcbzNf)(<(}GAF1z&2WLlClXOmsgxdi#;ceNx8h707ph z>s894J>21f|2nVQ5Pq+u)c|sP70?&mIkdEwl+#c8=U{n1p^iY1v4H@#CQU(G6iY!5 z2;`UafcF=1-iTJZIesojWb!oBJ@D?xL*i!kYKcA`a;Rz)o&vD-Ke~aMO|)Z?}C@X)O#$V&DIYN0FT#|yC=>swnM}v928C` zwqsX1pJ{?#=p@dsJd4zN4&s6$Oe>!e46;by&+Nw}GUF3JZ2IF>r5~e1sAK&kxR1h= zu2eqvR#I8nZGEi~C&#{$8798SL0`2>FXX(hk)rj?l0wivA#GnM1p`~r<4Y82cM~+C z-s6W+5}99w2f&h7Wy5Vt#MXe|W*ODjKVVJ$yQ5hNqaIzM-r0zrLklW$#UBbQtP$AFcNom{}wLJ6Ck>^`#h@)ZT3OFLiG_V~Y9vO!m2cU8`0yRj^s zS0N-7y2YCnR{P}-f#nup#pwQ_K&kW-GJ*3TX46*e>!C%lObnq9GZkUKQ6HyJdm>bZ z<9I*|^I{Vnvd>F&((h{y$-K!bB52KXC7a-W!#9$M%ho_iRYOkNrUqK)Y?2u)#u zy&*M4fE=G*vPOj}B)bn?D(vd8Nf`L%v1Fw9AO+sw#pb-9f$gbNIu#}YRXSkxz6#L) zruFUEeA`i3SfG|5dz_*B^hHlE5Pmy8xg29mb{d^31c3`3?NLKzUuXYIPL};3bfk^J+P;eS_p$x ze=Y#ewd}6+T@4K{yzD(4Bru$@3j`rT)0)!vf^9s0?s4eyKerg5 z{*8pE|F{KL3*S4*G)8)PuDio#UEQAcP59`;0jLhM>|@&X9WCw9HU=*)*M`j452YU0 z4cSv}s<_Tw4YuUr*kGH-33oL1p>9%MuOK1c3ngOYR}-~UAYZg=9MIMUrug|h?BYj5 zrmQ}|6=RbW-zS3Tl3ddUD3yY7UO@Mw+^J82UrjpxNg&S~8z=RFSagB`xbej)`^I%@ zi;5+KZ-|F8=6%>To<*(mw@0CY-)TR&qwr%DrM(J%iP@Z;0e9KPhyAlKsG_{4h2qe~ z-C`#_L=NGjRAwF@7&G&fN);o1U!6hAWfcUmM{no4W+OoO&Npw(>{5BzsuUmIV^M=6t{_^hm zyuby}t0n&4ODD*!-tl136cZPsiw|YK^{V&<|^HFZd3j`$6kg6;%-c!H4Gg*F?yz zlUOe3-jLiTlGafXjo5R>dDMhPN-+a;8OstI>;yE&@oZ204VT?r6?|}X8K^jHZ&VGQFj z{Xv51B-wZYK_!pxzX#4K{|3nn9VFgZY}z*~w6Z(;O|RlR1xK0!z_UfE)b0iuE!nT7 z_4m_!s4CNzxSrN1Rj521?6fKb5UwpP0^?0tPb5!)=VPrV$VXDAw(RZ-wf*q1l=P0Yq5-ZrcY;vtJ6o9Ik9dcj5C{)Bgq}USfS;;t=xc9KrTSDk*lT9< zBeCLAyZGX9SpW+}i7<+wS!u3Zc%%`g)W2WB&5_`Ep$v2V%Xs^~cSe*ENy>cOhneZ1 zil|tHhW1V!yV48l?S+0rm){_0p};ij3jZv%(Swj*-XQ3_ODt3t-8czJqfJ%dA@d~M z0jLRA`^qjJJiz9e5zMQkFuLAV;J%(WBi*8I;aN}Sl8{|mfjKU`-R6D+3sxeEKy<2% zv9~QBt9te!4h~koz!g1oPb`gam&vitiWM|uf@2MoS~2eYN4*^&vq!$2-EP!=r;0In)?NL_l36 zn&&-20Gs&II!Ja|nWWwa#W1U!Yok?~RbNS^4(v)alU8#Ok2}9SIycK69{Nce8b%DIYCvjK%yDN5j&hRCpEx}GBP8CrGK4d-;J~>9$ z`C0x21&4z(mpEaj&!YA8&Ps@ zvz)*fu}KnDq(eR;VG@p9dq)$+PdbZrw;;7TT)|b%(&E^?ti1;4{XL=GeXa=bqRUY; zcN?<~W)RT+V5zq$-eE+9;k_=grkH}W6<)DZd)Req�y8C+q9?R36d6(_L}u-Gcx**~ga*cP!l0An(24~C zgdE*XRI1zSKbJA+Hf$V3OPyu27)Q6lj?Si!P;=h{|FJI$!gh>;+MnE>yeC2J?afcK zxS%ZqzgRu!CH>gA4pNfh-CuW)2XWEOt+@TgxAX$vXLshir+L z@TkW%riNun=NZgt!SrGLvA}$(?@B`Tvi}ch6S@M=0glSi-#u}9Qxhl2n|FHJ%JlYj z8!@_(Ot=u*N#)!{>s51(}@K#4mg~QgO9|~kzA_#%=h5F7L{j%F^`u;M&4n@v& zN21Y2@`9R|P-19)Mc8bv12b!ktlqi~0?@31%VUb~Y4F~&F^HNH#DOp48_tJ4d zs~Z@daHmEn0+<}@aTC-p1eoaN;YiB5IUZg=rMkxTMP9m>&E2;~bm66+ghuf2Ht~6W z;^UOL+58S_ z3bMsfon$h+Z^;==Si2cIz&{)(F?D=Muf@r8#?gwZ7~g5LALylD&7D8afwzo7JvZ={ zG&5wtf7Edgt-gNMd%vmW@zfUI5AxsXk2>N}h{xDmRsU%F?-!{{X@{5*kR-dq7G`bb z&5|C0lMHWGYi=Zw6gu-Q;oroR4(?xchM#J)->mUW2G%r1HR@X8hocSK$kPlD>S2(r zs9Ckf5beMt;E09=eBbZ7@6!9!6RtKOsJblJsNOYTy0j^>^rOuq5H_P|><7-f1N$Lg zYhO-L{aRyS5e)j{Av~#9V)k#*B|fxXSnt_N8_ia8jQB|SD!qTqOrm|Zi4d<_#td{O zG6J7jnhe`gy_z@@1KvvMmD>8b7Rl!h&^7;wC?0w?`x_y`E}leZN!ehbG$c@BI{5&W zLVAD8!t2XUt0xN^CQE&ea@wFahVEwHez|D9JwCkL46d!<*2njK+`J{DVW}0&4RM5@ zKp^Q%QCrYBOru&{XrDD;aXo3 zeA7)jPh0t;zm0nDeRg$p;bySiFKU4Dr0>vf0?rW!+M2Ct;1w zb9JXi7aEeGa~7A+G^^nTF0F>hZ$&`P2EGcR*HvtvJ41-naZ&!k|BohepAX}i~} z%?N(sjO$Tq#6^o(sfi?nYddsR{vg)3QSKtmg6ioi6?NO7E@d+vNJlOYq>Clashzd4 zd<*HOB1^3V;{<$uKRttck*ze(oPW-_dQJGp{{cv8;;{_5^m)OOZ!NlvcLinok8u=|T#jyn;i=M})^AEyVVotTrf{VyODcE9rd z;Kk9c$sCyUk{P8k@4C%uid((87>c_?h(#_-n6~o6biM?RXXqF^dVA;q)-z%ESi`Wh zWV!VcCbQ$?G#dGuC@J=D36JRVj);u{gJZP2l>C5qn2?&>;IUejQ`CXS${D{ zg#R%|Bx%NVUFdS#K7XVBV~$4uV~%iLO9;5lBH$gi;{Icf!Y`bK(*OqU;;&b#FOj5- ziokL~r za{XZDWm^)15~Q4Lf%r_O+%pV!FP&5me@>=uHqDb4Dn642HUwqLE(a*0;!6)&B{-+Rq2!5okP2(|%W?O5tj~m)L)}IfBg!q%w z(o}n|hLdu*>{#@`QoDjNzeEMU?aD5WNU6Rg$bvgGUqv4n(b>Eo-9@^RYoNk?d3u6P zwg0fM)gg5(I5@-`n`H7u&8%X@bPe(yX!Ee)3GCE0wD|AqxPh%36-jndRet`l(tlo| zhWh9Zz7)C`;=TWO%cMWOVAsE;0|Qu06a)k!Gq3Zxviu0wp?%habY0zcMDD;2>E}e# zLik)B@WUH48uo11o$;|7>XsR@CUP?n-Rc{8>Qdu7g*mm-djkGZfvr!7+pyA=BK`#$ zsP)&vC!QUy<1Zc7zNU2HBkBb~Ci5-lWZqCh@8zkoL|ar&k3RdCi2MZ{{d4(F5Uw+6 zp;A<)uRWi{RG5VqbksMnK%J66WR|NyZuLy3}fnXoRK0!D2Atf!oH@iuE;MC1< zwAE_E-5P;qgF^-sCy+>@UccPQ-DO^sJ|u1doHqHN8U6pCLOWupDjy%gvfNOuw!lcRnMg74&+jvP^|4a|`rcb6$_!nj2-O`#(h3Myl(s z{TLsiv+(QqWcT7-u^K)a7Wgu!L4A z!T}x$Q5)MQ=LDLFHACp%!AziC=U8RwgPfcKxA@V;GT>RF<;PvNOQZRIC0ipPvaf8QL`nzbcP1F82TUUeBXy!<*Sk}1#(@}l3oF^NMgR1nI zjEikke64WdRyl=SheekFG$+id0fTBc;dmei%S^jGh}}vD?KH#!^IMpj>o|R7q8**W%4pnZa$d$(Vfi0=DiU?}C<%OngzoGp z_7BAT5Bhow$R3AK!*=4WdK}el6EixET0SGPhk|W_dN%#g{&aD(;up zn)){?z6Xr(3qpTi4qxsNLQ=0SU}wy?^3czIz_e!#oPN;SJ`WN9-O!7~&(h*?!2Yrq zj@lk0Kp;ZWAsn*P>$#1we&u9_t=xDt8_wG^in`#cNba%csulK=muhy53TylBXE3t} z#VfkxdVx&3&7FFh$Cxjn%%gW2uUE2&t3koOG>Cw|d7Rb;tn(4y zS&Q@8e^FmNcc<(W6esY-gfZ`PKCiq6LOK#hb|(|P4zDBkQvb0f>NA`(Ob~B(!)cV> zu&viyt{(q3Zy$(QI~Ovw%)L)?8Th&5c^$O?iz7jS z*dB^6?+$a==7GFm|B%53OrVWPpX-iqY;JD8+g)Y9*~-n$y$$s2U-f>C*sz*6?D1-Q zI$yoR4g9;h=KpDWg=%aiNU@e5%a-wJVs+3sHSz%v!qzbr$`wRWg(?;K3I7@8NQZG1 zn!Pc|89(grWZC-dOQ+s(ZSEJQUZG)%arxYNKk;;qf#d&EKUrzL?-ZW$}_*Q9yot+<9wX)65AtVjV9NnL3R@RJX5X63k z3SWO7a~FDKLyg1#lRue?Ptd*I(5gQ&o6!24mx;xfSs?}G_x<(OOan1{^uLgSu6Bz( zLNeDi`$E+}4V_2yM$yA}EWcqyn>Yy&!%|2}*sWdME))i}L_Ht!L$~>@ka|YsI2Ka$ z6+;$Udf|m<$U);Vx@&Uy#H@u^sr(f@ID!<|(N!#ne(?8E8U(P^{I2i%KiA^j znabx|(g7_PpMs?4t(Z3I#aD=57K<;l2#OMrs{l~p<~-_1!mlb&V`RKJiyiI873#Ow zt;HjYx4@&(#UrEp{_f|BjeZryHuP{%CyMK74UMy85nNozN4jOSMk3qQI~_Q@{{V2u z%O_Hm>QdWIB23>39&hs;WsrrWyDJo#g6roVy5AJGu(SLbDa6E%qKcnafi)qt6I@=O zS01+v{#_X7>+W*#vc|A|4_O)#XDgOA{)5+g z_qrh~lGwGTu=?|MY+}Xw*kdhO<6}#=Y3BKEasQkZmKT9Nh9;+P`$M`xc$*h zSl3ysCqe~N+iy36C->M+`INxAN`z!+LLh-QuTo_xnFy!KF{lWkl=Xu!ow4n?NNqD8NZ#p)pbL znvjaB@1yMTVA0NkjUkF)VyGp5Wxcg^?24=YCot&+m4GQy@eHYc8j^a%DBBsES{SAZ zg-Rt1ykraa^ARI4F*A<}-i!yG!F`v62WLSFrb{60S#}H5n@nkZ)s+bR)9h@8v{1KGjITF4&5kILCBRXZ^}y2C6yK2im%tc!D?RKT}M;Qv&6Dc zKrJ2}Uq)J@43XE!4MwewE&he-U?$#-MKm$SnNB)%Q2s)n3GL-xQ5q{rk4WhWHdN^l zPAFfA3E1T)ge(-7_Rg@;2w{BQ5d;;2R7#<5Qo;Gz$z{hMm`9Wx+O!kS~Iv)JGOc(I|xvWK3CY- zuqWzc>wML}S!O2m64J=2e6i0NSyWIyE#MtkQfYL<58^RYR0S3pvCFfHyRqN}i`|EA z+*}5N@&~0IYRmU}Z%{yI`_zdg`!H(qrghm98rx!NcWyWlG;v|(!#5N^JDG}6*qu*L zFvVpST$4#6-t{_VTu4h2q;{Zs80My@Kc>9TJu7Z6DzEmZKNMzrB`8S81dfXplPY?d z(l<{ zPp0@^!>GaV3`Xl#?H`tAAPWKikOss$Z;V*ImS3PrM#>DD&ow#EXj1Dx&}L~_@kqM5 zgwp(~wwl%x|{@^@-gs z3mIjhSkZy4`Xolb}G59DI+gx$u|TnLaS|IrA)Y44~!< z&IR{YaT!j|XF4xEDRSI5%G!?0tqp`F+=nTpML~y7FLDswbX^3iSC>4YxiPOS<*j-s z)|q=Q3w}vE6m&e~=-;6q#CF3D?`*jVD5qLmf8}mEh-N3#n#xO(n@jhZkgM*b`xt>U zQgG05X%!_uLV~Odi-b`Hj7fyGpTI`JNX$4T3X;=FjFezcgHq0VXrT5_zqaT&U2Q=! z65$n6Qz&01cUN|>Kh#{Dk<#dg36U7y^nRz7BS>k6S+m5iQZ&V98(u@fk!@^}9FMAG zWS6D=7_J8Y`e4P{ToJ>$C)0z`?TIuvI2|QMSXHvnJwKcRh=`*CLyEvNQqY2t=O|@l z>(ElU*03GLElinKzGW1~9mD(>|4D;`VI+X#zZw}CGJwvjK7dE-!6ZdS6U}m1WqMh3 zos&cwhb9~T!&E3DOJ4_wz2`eJq$HEe+M&pCi@?^CKzI@ z%|P3t!-xHhhA(9rt9kmggtBey^c!GF)q$XlB5GH}m(mt|V*h8qxK;|2(Qz7pX+1i-iv8tsodLr>lX%UiuGKmcXSv796G`S0Bc^kd zdl@R1If0pkX8@5LBBy~Il-jBfzw)U=W+rg44FIsJIpkb_qp?Joxt(^K{9RMfF9Ps2 zCH~t&CcfJP1upD0F*T7vrB|9V?WXskrkNaPp^DF~S^)f0aF^*KngrkO<*rvtfIvC1 zK17RP@mw_;a}p7&k`X`6`$63SK&%7PcYc{sjdf6lqoU2!y4JI|oO1tQP|yH+w7`X{ zTVlbjV264Gl5%4|5QiR}&O56C5M z5!L&$l1j-igpVNcluP+;S8=uZ?)5la?HHkVYxJc@JK0X{pqPvVJ`VeH+cJWi{vPR=3c4Fg>SW4U?)BZ& zdJ=IIoqKT@gpV3dlZZ?N?kop;sbw?wNsdP6D{Z?tmgllE0BfmN6-bt%o=xmKaA<^| zlw%lx7wMCTZ#c(@YiFb0_`qq@fup2^tNky{R%y5%^29=!NjNOO*pDhuTX;(7wdupM zSI>MOWBA8<{{#)cevh(8Oe|HDiCW{oaW&JwG~JTnYNq#5w!uxP%xnKW>6zXq+^K$z z0J$T_geRr{z0Vib2m|z|07M%{>PY~YSkK3LV~~`hRK!+k*|I1AQPHVFc^JiEO={*m zlz{xNiN0OCz+040ILXC+Ivd8P=aLmGn%>9VyELC;;k#p)A=CK2?1x3{&nP?Tw`~>P z7i;?@O0zQl-kcH8#9)>b;Vdo%Kj1D4bC;OInri!gNqnS8ldmgx&Z0#*MX7j9Xr%-xP1H_z(YWn?Z;1P zL0x5l?gu>l$%;rQ*sJ|$sZbuQ#|L>f)s$6a=fX#p=E72f8&l}*$iw=mRj@bWC*>iC; zgArrpL`yQR>ZBkNyvhf1(^toja;jWn9sEVbSR>x*s1ZXR3Q;QYcUGoHA;V9-(kBEs z-}&2EWe+qHX%#iE@^El3D=>?z)Wlhp$7t!KhO9&baCZv*`=*Lt1Q{J7t9SR+mhxI6 znecyXhyUVQ@P*Ry$-u8{-~CX;&R@rOg#NC~{fV*KSAmeag&D3=a`p62r%g!0$LHpS zLCO5ER@&Fi0@)9OngWaapErAAq=(tHF7O!+JP)f;cj*wr7(t@=M>Jt3OXfOPXsHCl z`~@{$=nkL-dx~|qxOMkK2J|b|MPAH&PcL;ge}ENU#XIXK)+M&pypBhKUmT8wW0Hst z98xYJRn;#q(sPNyxRu{D)0G`HqB@^lI5qw$gf7Pl1sp007$~aI<<1c`zPM9DV)64$ zbufA)9?X`VDopi}t<+Po5;XRFQY9B!ExOE8La~L+O8J!QyTTN#TGLK5c7|#F5PL^H zGwD+6moQ|r;1K!1#R&EfTwbaDaFL9)nSsA2jm zRg&L6qmjF4n+(|ihwFZg&D{0B!b+qyn^bVbrlvGIsHYCeOCB)x49FIvihgrAy@I$CmHs{!sA*QnG9voP@EBk|GeO7E)A%vT!u2 z=E{Gl9?-ujRk{)}178Z$%6I-$KXXm>sBJxau#{9?(eN?Y`PUD65!RB1P%WafIO!ea_KL5j`^48u zu+nY_(nmDW_#l)qa#g}&2zG&3t=Xhxisp1lONBc~ml*BVr-4fB%pBcXe23R}h)5jd zTAR-~I6ocv*(#A~sYR;zb1FSONA<7kfzJAbHu8}LUa{)FXlRuK%-5+84O`bmUrK1d>>p`X`>JO^#BJ$j~TWtU%^13;II7Fgxp1a z{%KAJa{dF|u|?y_z!BcJ{qkWAl}8sR-fwiZV;@Ms;vT;c7A@alPhMaQxAe3kICj;( z^&~{fZRzhkVYz}FqrzR-Y76NP>6g_cD`wX}j#fMw!QOz(iWCY%8#D_LTj4b=^h>mP zWBc+IEvvdM2z?7{W!bU-!V(?eUxt?>RY0KPy$zZ@Qu7!CPG8y-d&#q9OT&fKD8Fs-M8?n4zgyY=N&VHC*%rQ{ENG9M_x{ zSp~F1^z{?Cd|I1XTe)nmieAv(uAAT4eRI&`jq^LZa_({IT&>7h{r9lx@_Egz^L$Z@ z+vcm!_2tv199NBX4;RmK?AL$wTw}e4yXPxV(RTa1nCpjg{k;7Q)mT5I8|eO6ulEvq z&MZA+z21B1YsGr4SJAs{&SkJ(?`?D+?0qHQ9bHKGobV1<3#0I@iZ8k^Uy1xzZKNv= zisO|(zL9XmSO2snht*&`BeXi%!g{wb7AcP0j@4Mp8c}^w7L@Ah6!s>pIu>T*m;k-ZIo!_g2cF7a`&+LmpB!1JHUq*^Tx67BukRjSs1&!LnH2 zZ&`z7vA*BR2L3Xnzv2dc2oYZy@{sBq_{)%oRN}y&uOCvCgQfZUUJD&8J=gbI>%f1m zA5yu4_CSt}^~0!m&=u>4QS`tc>wfDVn31e?R6eL;-BamE%4{kcHS!{e+&7_vP!QODJeO`>dhhjrE;YQ81Z*sX7V{tna9hLe;?cFQt%c zs%xvI&^ocsk^Hb;Q#plYQ0`)Z^;1!y6t-JeO$8U$_gz$>gH`Z=>MAUUbZglhY-IQ4Xt%VkxbA8X17CLy$9#FA` z<*>f*dJD^8ecvS){AEbzstZMg;~wfRl(F_MyimdVE=w5byE} zmASsl0t{uWy~`O?u)fQJ29CMD_qq`s?8dHj7%Fppmz5aGSbLXZs9=4U#Tc5fZmh=8 zg7tdqF_f|Hu^>Z*u1;9{MeZI@O$N|fm7xXednwD%!Rx;6$_$-izm2sS%(zU(h{`!= z_u^nC7&NSowO5|1g*E(8hc*0g zXIR&uU5hn?=@hZUlOL-QX_N*iW^gKQ?;f7~$j|kF#Qf+^<=y#SaQ8iBs#w28bCND9 z{tyFe*lyZh*hGP`(_1-}JFKVT^J%TQLe<*V3R`=gxUucx z4BM^94}_I{(XF30;hd8u>SByjG{uyqHG$DjPO?N#pnI;JA_JStkObE#9b@9M+AE|b zgknbA#5I$qd)^^wSD3|cj<=;6p=r5vlEz?jOt_vj2B%;H&*vEvx&nh!3Si1f4#<3t z;t+*Pzx-88+Kcht_?uCPt}u*8ySt-Q={zpdk}QhqWA#m>@t&)g{7aGcdU8ydNbs?% zGS!hL3uUwe#v&}RP6}#2-V##Qs3<>TR|fW0 zSL|aVi*l`~w|zc=%lSg0U2(r#r2U$a)D={h!=7~FK|2|8=Im%1tep=o#mqbfZGhTNz<7y z%8hl30&;`WvZLT2&zDi&u2i)HI0k{p0Kc6fai0-^2vU|?jF^I$uw1W3A%I{?NLZMZ zaab_LEs4KoIy(mk!X-F?IO1dR3B_#ezt=)?8y`#A79|hZ~)L z@*#~IJ5hw9vqc=#rSq6I33F>%TryOSD$btLfV1&5{sMn}Z^flZ zTW=M>zDV>IBX?9Pu*aqALfQkWC+JC+=FyY1#xia-q}_KdNKexI z#K^-c7`aB$?z^hw8cDnF(vzN~`ANwB>Qmm8i1e0_537i!Cux2X@?llF^d!x1uRW}C zn4Y99wb$;sW~L`;ORd^H7uNJ7%`=?wpsH_rlGd2fTO#eDl;~UoX%D52XRoC7bTOUU z=XJ})^o^qr{FIran8B!P6vx}e`mk>K`h2`ytPkrdu+OLMy0ClI?)|>7&qvn8eCxVZ z+^}l*eyP}#wC-Z${%;=pe3l~Z{;wzde3l~Z{_A`Ae7q%OzeTLgO9smnvGyd*Z`FFQ zbiH=!{1vTbOEf!3=&LApD`|cXgr({@`;oOo9cNF{8f!fp9<3!yjnN8uebgHBBh8N? z@3bCSFUddMQey73Xjzq;J5<{0LR#l47dd9@sB+=+X{&@$ARR z*rYjgEBr}YMYvN*M$&ZK#lLaB(6K1-o^lGa#w z#6{Wzs666HS~ubEU7n<}YJHX`@%eOSNbedZ71H{wVX}788VjAYkhWT(6Hn5*F=UU` zP%6atPMV*3{IE)YobF>4obwuRh_W!(xzUC zi<+vO90-JDQ?E|&?GunVmRAh#h7#qra;*th`(DS>6j8TR;2;c@7XZsvAkEaBA1(y! z^;th9>KLx0J(p}z~5&`V91E7^9mrRt^@-7{owTY z_3`)n)!)PoYLuiX5Jh5fTrNVn%eABkGL&wCEQU7_N3z00EPj5T|6G<`RZ1EpaV~`` z2!2h$>9+@mYTMk+r$kA51%sw#DD^!PUQ8@+-;33e1mvd(osldG&Dy+oN{N`sc0!7f zqcQ)CbbLmsw@*oSDdqVf2uK#Qmep~s2?S>rh`U>r(#cq&B(8tXGLO2&>Z&C_K}uA} ztMqpgDK%|x7bPOZ!vAHXcuuZSd}+%r-c(iSmv)V`IblxJHClU(hlVw2va9_QDoQK0 zK1!_fB)sw#T{ZjUgoLj!O*3J&e4B++bT^x&e4d0?<2jBG^a<2RkEk{Y;=CS(Fcn3j zoG6PvSe&K}w1^6nPD+$7!#tGNNra}v-0>`; zUX}AyUv}@PP%73UvW)Fyviou986L&=W1_8MJPH|4{xZjv=JUt!+6YY^HlT)w+{Pe%aJJkxg4s<)z$1UO5 zQ+?dFqPJCaJ!{^&&|SUeZCkWlqq}5LJiX(K3Ucbn&m}A5`JyWr`&^XF|G`zlNy0h+ zw@{SI*C~`R1~3wlB8G1)(KREKbwBSvfy;;lFmjZUvgPgvmcoPP;(R*o2d2|(jvQ}B z>utOxen21KJc-bLM|2w_)fT#IEl8K2BQ5B9^6rw^>p2#^WUsfSq_?8ml#%X-YL|@k zwls5#8SW|-TgwxzdRXXsF~i-bS37a`7i4|jm#K0|&4N{j@RJO^-+@^UV_$R=5>`UC zRajE)s?cYR&|N95rUSYMjZSqbckA=hdcoEk-OlO$IeNXO`?uxrm(g_=M)X3rm)9&m zfy@8i-D{V-owJ}T==PEY-Im(yK=(c~n|gl=P+ZVS3grfzke z-5yhKD+KwW+eMJQB{8?Y>*^;R%2bjwt8sq1ZO~0wOfN{GD158c0#%bC_o2K?PzrfZ z7rI_00NIGSY7+EA_8o(k9eG!yD;|8kf#u?@99{hrfJ{Hv ztaYnAvMT0xnaHZhWpy8_P3X$;N{<&vbX8d+6<;i-S9SrI0^#}Sjw)Dwc2gwumIb3x^--zRKMPW7u`awCY1zoi9501fF{O)Q=#! zM>=OtP&&ur){k$DOTWk_z14atr5v0Im0IipavP&`dzz9g(FqhMKdGENDZ&{6m$}<* ze?q_KZ7&;SN)6h6v951rU2gDQ9jgVGumyj zFBjT*)rR0F)$a}eZCG^9|CJdyD1h{i*`>hKh{h38nk=x&6ecLl4#eQ zpRH)G;-g&^^Ui4dhed4EzNURv=J^CJ8;kcYXu$m5MYe#}95)2aNysgSzoArKD_-)Q z`j+EHq3v_VSU~UjxGACCbjEm~eP_pwg?959(~9;T9yb=+&1Xz2+IM)|RM4(JWBky* zo8v~I?UQ$50j;E9aG5fa(E50z&<|~)0slZKJ6rf&ntGdGV-YV)U2ap}aY7=Mjd;1u zzaLRAaLy5Y1fb7}ZUMdL!@Yub{fX{C`+g30X(MM8={wo4j?b2}ksnZDfQEcfvz50Y z{eVgZ_@N^C(O%Wo=gMwiib+NRUBnE2kk<9BaOBILd4zHl#=^UMOVaBx0LO$Oz-E~0 zTl*A1@f#OkIHn9nQC^kc(gboTUg<+1qa1$Y1I(p$E7MlE%dC)mo~30(s??ASNBG|; zl%lqTm52q1$?ETZLW5(ijkX;5zoCWc$mVjR_z_&A#od#oX){L}!zh`-@pXO)dyL8U zrIR+AO(yt*BihJmTzti1UWQXa0JaP7goYm=e~!OFeU2LG+u zYA_h+xB`N~%m^sRV_XEtM%DV12HzDagj<8b z<>loSq_e?eU^WBu#Ym9=ejWfI2ZI@#jT1=eElI;<>Bk)SU?4c_irk=F zGof6^suU(oZ%_(ya2#=agv;?@@KW2 zh4M_4Z%+&h6Y&@~XY{YBuFxK&C`2*CFrr(4X2A?V%FnV?c=Q1&aHCsl9ezO3d<@P_ z*wlh<0#&g>i6&p0EfAszF~02FzrD7V0_71 z8+bHs?~&?1paeWN z-^TGIg_NaPz_Jv{4Zdxarrwr|JQAag)Rb;-ss;VldWl+cWn4V&tn%9U;bfj6T;)s> zGY?I&i%2`TN;xPJM>yup!Vg3;0Vl=vb6HJF1pVXUvaNh<+1Oj6al|>0WQ=lqo=l7) zGh?8(=465bDU4N^n5)9G#Z`(`COddl0KJ`|6oD(kW)dU2ZVg|m*IbCjqTGr)+4KjHb39F< zF&lz4D#PQL5d&-MvICzL0t99-yn!*}TSn|3ERJI-;U^@D$SofSQn?7Cvt84CUmP@C z-VahFHu3%d0Q(8;eWA=KMQ|UmG(+N>8KG>yuwCROs~wrx6vJqs3;y*7Q5Oo$$l5>EZ`!v(rSqku&gy<`fk1!aVDA^oQ!jAxT z`pXOCYWw6>HXAa-zC{&^*7b>rg z&uRrqUQH`PHz`6FIChn9Y`qfF!$$FqKq(_y1lU%gw^A z1*|sumOP3?cFY_KVRiYJgoGom(EfG&7j+2hKf{=gq*?RV%kkhyDP^Yj(B5Hnd&)M- z#6~DFy&PpavP8Gy5YrFs)P8(>Qoj&%lc=ysk{J_EDq#Ck4@QghU7xNCzA;dFpMm=w-l8^ zkCRA$NXlJlL@Nt$JQ%#@ za$ji;YKDUp(ivAfSY_UBA!Z7>@QHETd z9%jQx6t$fj2P2u(Kk&SzG(^!aNy(frZI3Gov9U#9AXIfu{{-TQ3VO6Cl{~=p@O+Xq zPhncePB|YPiQlQz8oAC`zWyPYNkTR@b{xtcdwCb>$IFe3(tHgD->J81%dobz2hgmv zClAydC+Vpwb2R6oulb3~yTepii3Tj^J3MM>IR3w8C{>O+FVrpVF}*@ucifOa zNYx~WFd!+Qc#b2OZb}VoaCUTj{`&an4VWS}lHf)#4AaroLMVFRFIx2xE+4t~1cRdS zbRWzYvd>?&>sIiX#6ju6EK8+Y$-#0`)fr;bpxI09c{wX6l$IZkh1qK;*d>Wvnh#4d zyPi&ydUC|AZ;ORFr;i7NOLe}9I)j&BDy(Ud@)?Ulbjn*CB8sP6j8Bw9RmKP05=7|< zZ?lMDZeq$IDA+*eL#s-Bl@Q?iW(f!7DB@ZPKeM!5#SPxrDrOsySUZX-Vp%dC3=RrI zmrMlWfzo-!TpDG(A?KYe4x#MLzcNk=O#(^PKMOq}LDusD;^dQ}enB#ct#l>s4@Tga zNC#3rzj_(f-2vsOcL5bLLX9bSj_)|-Qx@BnDg{xUT?(>fL7W0|8&^OM-o;2%gWwYo z%rLsib!ANXVXe#U>s8WM*t899UB7(!h6FIW6w;B*uXJgC<@eMepn8Eo-s@$!c&33b zGhfh{+kt=vGZbc=kbJ_7GsZDNe4}ugQ*!=_xlz8_GP8-T4!Cv?Zn-tW|KdCr5_!jG zo!jF_A+TT()|uc430G<+Jg(OFWx>x8jgfL~X#Q8V>x?2-GW?+6D8oJ0=X#+nXrT(3 zf-xQpEN^HRXXyLPMOcY|6+E40yoSWv8AT&K(uj|g`#EL)BPUE<^p%L6zd0KW&flEn zrM}eOQ){F>1Cr#cyb?n0LuL^jUz$d!4B|*xA_&g|oac3Rt5FhF8Cr5Fla!yJ(Ly^m zbm2jbs)?J>8my|C`)1Kh)n%-$GNF#Duz%jsE||D4Q&7~QRa*(sEKWG)5>1&7bgbc8 zMgR7l73AtWnl<+9zSl-6z54z}WxM^l`gNt=D=>S$?8cNywU;k~;o4TmP=AasSAE1H znsdCmASmO?k_=Lm^x%9>RS`3N5iGwy%n5v7TsA7uEWR6KvMG5w@2zj_Z3yoC@7=xK zO+&BM?5Yoq`~suear)A#P<;3)q1jt0f^xr7F~0bh)aL-y57*Nm#aG2R@AXk{+=Ehg z3oU+qqY5wynB3Ik;4A{0fVq1-6wjLRo7>jwdIR>vM`CRd1MS6KGvUQxppnI!q zA|IT*=91yVBEO8Nvovg_S}zAb2<6E(gExg>;|yubGgErVvq_$S!o96d7agSIy(Kf{ zc5R7=#(7jZBvNeLVCbs$R5YAm;3n5fPOyO0ej`Wx&P*_5i{D;UPd1bzRi7gTLzJHS%?XO_a{ZVj4b$6AZlldakTl^ z0ZJI%ri`R;infbvn~}=4+1>;y$aT3LLI%0=!)Ed%kWEDVN?q5LLOWdW$q4lCVh>PE zVxd;Q7Quxwn&2>kcn)BcA{Z`Yc#0ND0+@kNE{^F+&*MxgmQ_HNKn2XfV0WzVON+aT zrAC9j#-AmOr(+o=j-q1Lz0z_-dYCdJ%qQ-(@+H8(Jo)MH;`re0kt=WK(IfCJ46d_8 zobW>+F zo)fMeQnDo$H($YogxU`zE;O;rt>Op6NtFLcQu#Zlr}U#?XiNEWo|5b;LUcw5=fAe2;lD_#_K{AbQ+}_F2wx-d2G{s082uI8?2UKE zJDUKI%s21*M$3@H%zVB;y6AjqW-6>4K%to@2FpvZX1vs(DkBD|SY zWKyebturju8WjnEeA|g+G88II_6MViw^P=}lbDBGi*+^7uc(h50Q7U@jX=uJu?s-T z&D?;Bt3@LSH!^jtEKttZ@ohLY59l`m(O*=NYI}{}oa;R1Q9IFA3+EIyz;HHk)71dQ z-KK^jns8P4ki`6a#iD4dgDRDVu{f)=widq`mTuMnEZ^JD_1;EyIVZzsnNgL4c*al9 z;PopCZXwkvWYToFLNj=SNh*Rd1iXjQEnJ9e1w}8P^C!uoX#1PJZ~nAt$e(B9KWQAT zz^aOmn8!(iU@FI$z#AgsKQX!mBt}%`Hs%sp z(J52NMzVGrO6TASjo=M>0%nkcD}-VZwTD4**Fv^ZEb~Oro(g?;%fv28(FA|c3B#8H z=>N~&f5$b^etn~8REi>shy|1qkx&#u3LPa<5(q8yCIab%l7u8w#aK|J2#O-8XhcC2 z8`wJnB3Ka+1v_E^ML};s1c~P}GYJIs{=Lt0_Iu8|_x?Qmftbu(bJexJYpw5E69Kxx z*qp@Qzm-PQB9M~aILc&)$Pm530dsgvG8^=NLCzBpMUdkKk+O7dNjnkJDC!u_9&hcB z*IACu*aYT;>@A?0BvV1O2NxuAq)G!GAwxQW*cGyTi?QDDf2-oKB;r5yLIQw(EBzp8 zANca$szb;=P$F=o4yGj&Vi#br>tCKeUOr9I#F7Yb8v!E9lb$HsjHH;G1g1;eZpMEv zeQqo*2@NW9*^FDhF`O=-BB6avrqSp$;8BhsB9K(!l6*zxN-!AYPJ^JUEDD2GgC~7; z>$n^NkQ9<1DZ%Z)#o-h>Ul7ja0U(A-=bJ)zm@bw!VFG<%1oTBV!6ue2Ak)YKGAIiE z-X#gUR1%7T4$w*;I++$rhf7|$#erP!K;Qq9umd{5H|2r1nlPoenlLy#5E}xb4-nS$ zxOh673V;|T2QoD}k<6okBn1%1L2P|V#F80L=8@R~Iw-q1@OThNf}XkvNajS0+t(0p zKnmbwIhT--lcaM1yAoovOLB^U$pM|*pbf|6(G$SD*Rk+eu+&41k+pij-2~bQV1#R| z&K=}CkUk!0oC5NNWPBoUmO#qimhCa*c8me`*m$hqPmjtf!^IN+1ek0DeP{&dL$AR` zg7J5$KJW@~gi=}r9C#!rh9=8>1INu_|J$g?Eg)%Q5&tXi(1bLVi9tna$b-!1gPCz- zgmmfPK~4(`RPg{(vH4e@75M!`_tRf<8&`VS`}ziwe4JMOSAAP6@j*miKcc5|xL1JV zD#)j`223EenGne4$5Z$MmLOiTe?X-Z3DrUfpV&tDIN+D%HIJ>zzs)|hTf)bOAk)xT zxLTU3^!N1}SIyWzY@D%VCotpd52h1T)J2lhG$AnxJS7npNEGA-vOr=aglu3N^P#jg z$qf>9D^aB5MxU%Je%y$HEIKIM%r*ddGh}x1@Ae#cBTE1xLEzaS`Gd@tq_mOYd_WO^ z499q2l_7Qv*j*@`^1CT*4ChLXJ&7M{rOY%~ATi^+lOv$ZNM{~75eW&ucs`v6CBLs~4h08IF!^T#XIK-PVP zF`Nuv8N;IR$h>4|`u;^_2sm68m2WD!G+cr~7lT3=%&Y;_DVAFPL`^X35x+9l9ePj+>?_)2j5JJ#u~#hC=ALN za-1Y!#`q0@DrHEko-4#E(1q5S&;{^>B z3!O@ig!&B|AcaM)wX=~7EgvW+3v^tfJOkg1Snf!ve-^+%3Z3xFqJB->`p9+qI$ zar_K2KV&p%e+QLA$`Twck6DQ+$bvH3j z2fXZGq6vT7$_be81Z=n@F_gnLT|D-uNj#r!LM8L*d?U%G9Zw$x7f(6{0SBId1vZO6 zROl*(#g67fd*NRl(1LgYhX)wkraU^I6O%v(O$!Y88*9Sl@C7F09f8)_RHnWE%1Hil zIVFa}G?kbQCcqdVXLka|M8J{!i8US9Cum5Y1dj6kK0(r68DaTHvrXvVDTl- z2Y?%sl|Tnt<#FPf(wBMw&qgLCB_&NT&{=GFgpAcW?uN4-_rm=_o*9!okY1ok4>q3; zv@D=cNV(?7ywg&qW&kaoF5Ss70GJj04l@7#x*{4K33rU7Q=@-716(rmzenCNHTr9m zb0Psv<^_8os0OsmgfahH>!1q$>+2xlhU0OaSTYN0p9bfWsnHUj=D)QmgF!8!#UaYX zDp;{x9w$L!*+6MNWHwX^ohmV_q3y>Yvtr_TbYpm;#0dhIv8={3yrjt*;7xpBTF3%; zES=2ek5%P?+?wD#I89h^nd}?BBwI$pNCm_#84QR>C7&cC{dbW$p4%WX{-vC}v8Xbf z#-d4cnI$Pa$rFY`2E)C`zae!=7pHB<~gA z2t5wiebQWG$d(2UHfXER;E5cGLCm8AHaPNk#1c)Xb0x)J$O1C79#E^2MUkB1ao5xs z!Ja(kkQ(!YNf$z=n1GVRC5{1z6gTePmANhgJQ_Ss z42TUuTI0k#fC)rG$$7;h<0ZH;Sz>Jd%?Lrg1CTP-zowI_CdF<0hkypLH>NYgb_g_^CKx7GVkve{l5YMSq?V1 zvsn~VCXdV@v&rG(+c7l_tIFd2C(cC?BVec!yhv^vCHsf5=X7wA5%Q`&2Ow%>Ad}mi)t*%oeuiI zrTJ^J*isr|2f?xAfPkggWDfO4I!+K+0>lpJ zs{9>0@{J}?w*D4uhaURJcYlBW@0ZDRg8v_T@dvkmY`;p;tW2d&>clcE$>WyH1iu^q zugUhtGRetF+!z*>B>*#s1%D>3PGlxa)R=_d_g^`n5-7xmO0rLQ&4bKnxa04Nt-bKaRKsa39#k4mDgp%bSZ)lUn}7y@DWtPOrwfFE$b#S05k&c@NqHfN z<352yVJwNr&?V|avV$UIULOnTuYY|-)bih!T88d5R$L!~i)?8%YDh~;3fl1#SpsS# zod!Y;&_ZA*OYZnBGdV(v<9P{mUWAf_H6tnD5CNyK*km3H*Z@SvZ`Vpa!-79Lh4=LH z3HBlpJ^hSjcz@8_1eBz*N?NX!CM`AN@LN1oR`ig;WGopeAo+ktALq0A^XY#)4WuYT zcZ_`mEGC^yn?PdaNMBtb7^`G}=Add&t1KtW`9A)&?H0dr3moUML?_`NbN#mfJ>($`Jg|B!$X25 zzvOj(O3=vz?3l3vuzVH(5h5m(jpB0orU_^YT|mY}AmK#8xDS=ZCesq=JONmoPYLwM z8H12r8uaAHQy>&2kc}2F$gCJ7+?P&=|L5qXsl=0RX^F7_D;PiqIfIo1=*9o?trDA; zEbH0@YmBkM!z~#bIs(LVz|oFFcZ}rg%g#{!c zxSF8RC|L{%v5Uo)bU`NP%1|n8t7u?s9{b zt93bCT^qPAbjWm#;kv*{1wJtaR>M@fAxve?6tuFssjCeBI~|Y?>VJ0^q#1JVEGnH1 z7$c4xZZeO>j1<82sT^*yEgXZwV5G5BB_+vqvfNR7E}0rhm$qOGmjr;}7$gdA2wb2m z`AXNwRtdySrfCdx72njI=!p09#hYLNsp-#-q4UQbM!;#4 zRAPqCSt6iI$V{HZtHol2C1hA^CSV^i1c_uGU5Um5Bs?WvFkynEy@Jrq*act-aJa6$ zFP!MB3wN;hCHfjG1rq&SNdA8CKzkn_drvW|r1Fls;VQw2~-qDm;eFX2t{Rk_o6#w!{P+Ly=@QO$jUj zD~Xf;F&rf9e}4X7{==px38*ogc$!ojK?E{ZEYnm9G(jWEWXy=-vYG$QXP{6hl!ciY z_%8~D`t4tg1;!EuLz|gdSeRkV%*-udC=A*Hje)^Y|34b@gr9i6fXsuT{x3i4_rd)? zHiPKm390s@LmPQlWAEzBH) zBZH`3=GM`Yr%F&UbQv0hv__)Q&^Lfug+8Xy6IfI_@F^CLz&c90j=-Q;lFo+PGh&_4 ztYiigZO$RniIE)3aHtVBIabn$7nw;nK|_t02Sj>OtoeyfUMRFztVJTvDKaT4Hi69J z(wKo*FAhD@o1YRH%nUShX1RKWATSOH41w%JwqnzLJY$#?LJFF|a0upFg%GUpB=^XG zfDo$~j4y@9^e0#{{Sg=kcfTYnOK*RNSY|*90z(KSdGn)*tSCngGdehh?B|V13=TqI z2o6l1Ilf-A`{&ehujfgw;Mov;XugAb2}z!3cHy%@Y$4-YN^Ltrpa z&Ss8m4<^IeDn-Df1#rop_AEAEc2NriW0df~aVez&kcMNk9m6A-WTp zd`5tm1)u5Z6U2=S4B~hOCwe)eV}04)_U0UvB>@#}<;qP?Fmv)vHm4+8yYiDAh;BYH zkrp22ZjRAp3o;dpjUxp5yCnFhcu@IXuJ%63@llu<>)1%Q5VA`Q*E62Z4oUJ!MqnKH z7!I2f!t!GWTN2nbE;HDTi^T-TC74kH={)ZgvVaogL*sMUAuhaROFA{mi_I~MjE$lO z#V4}~)@Tyh-YJ-l3h;KMGOeTBoKaXzGz*_(&-UTD1^c^D+@c7+9z>d}8QwR^8-XFv zErQX3C|3lAkm&E{$nfB?(V7wEkjwwOFmWy(UcW{d|b7qEE zkmI5)frWE2r}zSbBWC zBi1q5ERI4?i6Qw~qvJ>+@ow>PE|Jid4t7coh-akm6WpDXxR#D=D-t7!B%pcm(B>Sg zAnPEMzk7VLmzjIC8zI?};T!La!Z4D&{GHJW2n-<>>)?sN5UlJGSVshgAU&1f5e2@6 zXUsS32x8 zRj?xRh}+j~`5vE_6(2U=vqwXF#cn-}ySq0(njW&JeV3dC<;dGbj_zt+bLMS0{%N#! zQq#6|@fSs}&YWyi7WO2xZ*5GxAL=;0$;@L4Zm3#iZQn+npRdzr=q%W>Wy_WY8>kz$ zY}pc1gSK~aa{m z)BbOCn_Q6byppmq>d4^dEnBzN^|YTsC-ej@s@2>B}U@G;-s+qZ95?=o455{lOpy6Y=1 zv`{_~a?XLvMcMuAbEMH|Rs-5R<3Z=VHqoayg%#d-ynNn{9mlROdveHG#eJX6-0(GD z<;6e$A$9)~CHVRVAM^C=v{P5VDP2zN%{jU1imsX2oV^yYd3IYrW{hsv8+6XM(qGWE zgJf5|ZIL6lart++o}L_$NW7Tvc~5`v4Bo&;|Ks6R+SS$756xycrq8S^6Rlm6IL!XxP-p;)8y*4B*$1@psFx)Cw$r}4vj>1|h&u{AX{ue-aaooUZLd)BOb$JCx& zS|zT0M!l2P@!&HG*HQ**4&~ZqUc6}4%`aMFVKHy{>cN}T+~u2xhLXDZp|eM*!n`(} zkz>1cl3qU z$Q9e1jHubOXFn_>>0JGKYvG;iyBmTtGc!@KPtD{M6m-#O?_o{H2w{A^xF>hCRcmBq zY0flQeXfpk@5^hds;bpE^Ar1BU0r8sYv=`*YBN=Mo+_MCFJ{O6K%=R* zl!t!&Aiuhv+FWKB+xzlb*Q29qjK=*YshK`)qST72&1B(VwKz1%y~rkB>H78SYp`4Q znFODfTf27c(B})UN=QxSgCEp;PO;lW)QdbJ(psNFr8ZSko!`EF>ms7K)aUBdJE|;C zI~V=LRdmp;r?Ijv{BxU#dMQeXwA8=Hz}{n=>DNG#?-ioAWM<~sIR>_g{;8;{q6i;! zMvY#2R5*3&)EnnxpOrLnjf{+px|$B9_iJ3fAuh@teNiJWYRn(zXQ0WIL9aVH*5AA5 z-t8OelagX{_3BlxurOq5=F~xhtkFsw@no~8qdu*Uvi`~y+i(B;Q%Z_s%}0i=+q-w~ z-PBJSBQ1)9^67cTT` z%&ZglXN_*xJ2c2_K%;qYT{NwEPQ%LO_>>fznwpxDM()(XG9mDcN?h&M49iz*)TYlz z?zG$ZF`{~de4$fLr3)nK>>od`G^)tbq%@^KFi)_8iBwK#S2{Wj5_HXS0yRk&{bt(%2tYUr0n z2g}UXV}aD4LtmSjZE2%NfqpLTS5&9D)0oUdZUx9@=C&DYQd9Fss~vktsXe)RN1uly z9J4dlPf>hx*R*P<-Nu-0d3hTS9DsLY7o?3I%^lsYmp^i>n>XsI-H$C7Ty9znmOuU z)?a97WMu!(`}?JhaNDTnl4*DD+$m{1qBh7}2K407t9?7Q)zD~kp&2W$UxVh{S)W_~ zvGrK#@0XCtWET>tz;0uYp}F~7RaMny=A&sNSnWaQJim{~eWbZ}tpu#?pu0? zhOT*r6YbtT?e%+|h|bQ=jq^-GBHB;WFUEB$xVpK0eHwkL1NZBP%9=H6w(Z%os|Y+jbU zSS$`Y!|-SnU3omy{~zyGDT*S58e zIdb3kF*f(jFwADhZ$JNem_0tn>-~B?U(e_B{d)JTv4RRcDbC4PsY)Art3$k|e=0O_ zyG<{$4rAV>8g8-{i>fyX)k(~`hc*mK%*Z6ta&5GwdY*>H3uG9g!v*V3U_I|&sP5A53@NF@H?{1SAA22UDt*R$TlO+Y{(*~;c@omg@o?1yW(mitUn zKt zD86u=>|>UxVdZFOXgH+&xc19G>Z$LEP~@!MjZ?qFSrk^}W_4&NR#&&Yw3~|yiT;9TUJ)qm{NMKNZOC#U?tI4nF>;}^1cU{`_x-HvZAgD zEsE?ED!LUGZm*4BwBO@*LJFblG`U)#fq}NK0s`7H89Clod=QsrDq2i5>{YjI$-%PK z@ypNcftY5k-pmFfDd{JD{l{FmHs$~0>%wLcYZ)|(M!M0o^b?bYQGFe?RUK)@&U}o;oS^YMIMfAJi^n|LWh>38?8OVE zZ_`$D2^trs^oT}W{38Y-uj3}J%=-D8I%nNlcJ(3~=>Z4Zm$?CW`_j`pS38I0~@s`0;Sp4&Tq`p`e6(Wq77S)APF7#D$wPeW7D ztT*sB-?cGS!^^}%e$2w%_$u|vY^g?db#(?{XWG}BP%brebm`rlUF8*z7bpHs4M^K% zFVc^{+Qd-di?<^3x&6DMH&{_XDG<&77QZc{VLz*aDGP4!=eSk+4{7X9~lUqy`CmbpL&s6?|6Io_xxTi?k@8s1Q zP1{e_6ZYZ)@-)}OmNep8|)e0L!Vv5h6m)>i%z-HKmA8vmeSS(&{Z<-A+ zHA1YNJ@A&`>;&;6;$URyGL`B%yj9iZphj~Q4a+%$yHBtLLjxtgDQB6G6-e0WQ!9DW zhez~7uP_)4ou2Pv!u#y(UOZQWu%?)Nlv1C(vqE{U#EoETnl``}wyskKq} zG%r47RvQ_}Pv6trUAd5Wg|h3pT@vuv(abDlyz-s~ zPG^zd_hfH=mduR0Z#_`9Fi{}+;jsN_b7B!{C2#5Qt(%*HQwUXSStVqO5bw=$`tiUM zr50cS`e)MfzJEA2k;Vzq49S}_&IKn~Sz}|TctI#zPxr8SPM?))KC7yA>iwNxCYx&e zImU{%Ho>XVS4Ok2Duv@08*%uj!)hC~^5wa$S?ThRX8hD~G1EncczkCLX=kH?xP|Wq&;SK4g7P!M-M#kOaCi8A>YSxbli`U%g-FK!T){db zZ(-beeU49cYv;|}i*ld=3ok_*uo%uOb*WJ1+@X||RhCUpIOwmAw)MFdt0SAG&@E!| zw5E%M^j7>(neW9oOd8MKwY4>$uC5_t2PYm8n-?1$QHw7yZ@M5FNl&u&upJMzR!Ya7 zOdB|@%*_1zM!Wyiy+QhQSytQP=H{jx0#W_>53Ss-?@a&3#5j;5z+dM3w%4IfR);;E zJ#sP0TV3z-_FI9<+{yBGPbQ&SQ3|-+VrjW{Gbp@uJ zLDYkNRV*!ZC3Q8`pFjyETDvs;J=e$7Xm5hsad>&vXh~HSs=$^pij}fL^HF~bW6!F7 z>s3n|;XRlrTw7VV&88si6P1mjHhhJ-xo)F>Y)ZDbw||cmfk2?VDH7r9PM^SQ3KEocC~%3)3hFGT~}laTCeu4LTc*-OJcuq0`}f5*)-m8;fTE9JY%AZSn(iZiX_M9)fb#X<${yXNQcEDOiEchB@9@f%uPKWUv1;M$86h zs}QAklLO~XafkEAE+iNfZISRW_rsyPdh>Jfud^ImR|bL#KdcGA7hCyshu^c%71z4P z*Ld4NgB!b`SEzU1&!O4`nzr?_s>{nM^lPNeYF~ky`rCwolG4!{yBvq4=X}%UA1n zRYr}UY=)4JSktxIhDECp8=d73Hp@Bt2p+!P2b~Jt=}gk)up>8-nJT5vR*ruU%);Qx z)X$HCK}Fe*oD8yF$(S4Rxhqb-D+e;8p_gr)3>AmhhLjT`F`%`%HQU7EcbQ5+leA^+ z^ff{GiuSisL6$%M={`MKL9>d!WDHz38_z4oo@o@=O#}sFS-pS3pqEP+J>SdRytLG3ZAy`jS=@ zr+3l}yKnlZGWOiT(qMN6=RA;qUNJrB4zFK`c-oNS@0tU9ry|lVDU>!H0%ceEBe$U) zJQ8+v;Qe>n;dYd2Rwf2Fxg^A`!j*B>=B;ZEsyxK~@|h2JpPQ8;xL$a>L}Wk+Uq5h3 zak_efP6RtISNHR=6Zf&&iZ*vxW}`^2NVU}>l>Ww0MMKG3nxGY5CNjf5r_SkdZkr?b zuh{#?P*e#k<4PfB^+mnQ98$`GQ36x?+5Y_b-V^jcVHd=$YQ8@#S=cGqo*F|--lTfT zg}i_bJ!x7bxawPcP$9I|>J)naWp*a4*IPiTTR}r0W_e#*#d_|NT5ElM;p5wh$JGd8 zx@XT#44Hlx3DTa<9jZ$W_gk8uZxm@p;cFJqi`zuzTrb6+$M6tFl}11fQ3JOBm-`CzB& zdg)WTpRn@PUK6{v6;l6xd~_qXFkjVB@49=zbC}P#fTP_fh^0+ss&u{I4$xU5t#F%j zNbmVx8H^7pbD1B~d`ev0Sfkl%$~8u1&7%UujV^A8*E{>QYfpVR2Vtz8); zm2N#zY8ATJDs&8xeT_PtxgEyA5+0^50feIM=Tk8?fph(LLe8XO8eqAjO zU)14m4Yv5W{TTbhSU~%5=KPKQ&o}0AINVhZbc&SxJ-}I~92gUwn|nGWtoEzuPb29P zOex$}x1fH9!@$DDb<(=z5SiNI;CUAFh>YTW3lA|pevjV&Cd0+2HTq&=jDf+F-a+xP zvu&K=8}->O`zA4G?Ie4nzAKBx)&(y2HuL?mRjG1scCYSie{*xz$mR6D6CBMD zKBznYvd)Qnc#Uk9HfS1xaCn(Dy1YQ}-T*UEHyESzyPt1yx=`MSO2;91SxuJ7R)uKw z5NAQwm0nZ;78MkDf+Wq)jY<1uUVftWCbMQrr3Jd&o5}T!4JLI@<+}EICT9<=@@pYc zwL(!*Yg>@+SPp#Wg>L@I!Ny0@ePLynfRBf8G2~l>ams%%qXl=hz~I`KPR%>n|iWs zwkamb3hH&&yq0BDZyR1&dC-23nl|eD_hJ5h&t`Zj>MqO9Wfk{cZq@_jvrOL~vrNYbB?yMIT z`oT?6o$6sPRrct@7Zrt>{aywfdBI{zq_)Tk9S#OJns>qf)P3uhB|ay6)Q{i(W%=6S zAX*bM*@X1hIkJ1o;g5U}2t@HvSHyN07)osl*4NkXYnnQl&=VgQM?v}kUCMt}R4A@I zZ(6p#?z&>^AmB89=k8r_RJ0p6EWSS6T{-(Q6*RFrl()a3dEjZ|@BDl5q{d_MFRr&t zvh%E9B`=muObqIJZG%tt{qhcp;n+z7-sCJ!wC8q&a=%#Ta4pym@86$^JbiwkAp4}L zSX$4^jDp&mH=Kxzho42xrMTI~ z4|ZHTHoUxZd4jVaoyG0m$mH*;j8}5F58%!M?8cv(EZ6hQ@v#b(dAO91%zc#Y_ zFIgi#0^8Iys@=7=MfNGRRrvTG%Nh^AP@;YJ%6TfqoWg0`W39%_WuBN^&??~bJ@G<^ za|6LKHkL(P@sHV!Xr#DbQfc2kpG3KFNh^nB$*)iGY7G`6BNxp@Q9YSDcnSf7Vc}8N zRgV!smoc;Vi#G2S-5TB7mYJ0=o(xJdzdQ0rE1jEr#5ox~`omC1nFo7MRX9mF47=Uc z_fz3ZF}(BF2x_(ojXnQbD&756enx%nI%~j&jxLdD$E>!0ro(p0m{s|8A^w&>kl}*>v@zPSw=>Ve z=+4PWKS2T)e1Li0Kwzjul4Ab*qYh|@r>}F??6LKNp2_e1&{N=4(B>g_{(;kAU4hrZKMRvjyZotw`nWeXfwccOjBC`B$FXRbC@5!6I2 zvEdeY%M%fP;%t{Up{n@9$Hh~5w-!^vf{a2AOfd0Um*ELvcDMFLSH`a8Uk3V~`ncHs zpig||+5Mp+sK~CLt=h&xQO9_XLS^!AK4r_9Gt&OxTbjIPnyAf zP7J-1#HD#)tEfO&FpPK%Wt0xYJzs@_y$j2BO&*ztqtv(a|5wf4o1-TERwRbr=o}f@pB;J2I#sd# zU-)+W*Mc{tHL0tvxIX2tmjtaQ(6ctOTc+aEsOm$Fa&E12mbSK?ixiNGF%t0PvkNq= z#CP6#w52jTl%n-zCpBHYXwk+5^y+tthA9AJls*jb(8{>uyROnSC93TGsl~kdxRVM`pU7JPySkQ z3Nn?flV#|iMj?(&uBXjxrKBd7tEpJImgGVGJ>4k#;$*?|bz&y;WhPUU|7$_6u-7!t z$-&3HMeF9k?tG3A_WSn$VT52e!f8?2Yx1M|qY+Idw|~8gR_-?o`}jaz^S*@*ZK>3J zOo1%$qwW)repgqQ;N)L_wIi!cS;xcY$-D?P^rZ zeS?-kgOPW=_8BPD)&hshIsSxZifCyY;{YQ&&)=@=`1+bB&`>G-%>}*kcS>UL6kb)a zipXj8@iKAW(3+YWuX0R${>OjpMi$4S3o zcCQ8bc@D)nr)_;6YH=#fiLbj_Q?I^rnY&?%v)5E$b+yCW!O5}Q`|EsFQUceka~m)$2Z z7@3%2+Gm|EPcy$4$WNjEsdN@`D_#sDt3D}RfEc^r>-@z2gyfQJ{xx@(@|l(kUYHbVaj%k z6rvWn`a%@50ijND`YG<}iVXIA8?UZp_OlXB6>joZ&E(`Nr74_upVP|8luT>zyWK65 z$SfrQAarLgS32vy-B9?!XjJmY6ARJ}PdC>-4=dca_Hvrh{Qkr8l=?00aqHEt&3kuN zyvA`gn|!1hW1!Se=_zirL}ls1OYh$gOPL}V^r5`f>pW6-@1AR@F;7a$WPxG$>}(gl zm}VhivC*hz=eG}SIIP9mOydVAuNUNZ_MZXW5FrbT)^$F=DaVr-}HzWmqG- z%{nce-O4u1DotiLv)SynJ|u(vjCKFohDQ$0v z=k;z~ia6VQ?utT+Q*u%ge^1oYw!=JC>z07)J?~Hcd3k^<6)=(T`Ed+xO*!`1t3LF_ z>(7GR?{Ie*-Gz9?j4Hz?qp@3lLj+n$E+4H}9WP7Uws5{56qNh#C3Us}KShT7OVP5S*Yv8b z6_P)8h_iw$OY5jvb_pwxgXrf4A^=&8U0L~?s7z(yWKlZdlgkk zw|g-UANyWEbftAh%bC1u(ECZ;?@HCqzQt8@uVUo~rf71mu*ZZI7WlWLuy9l@2W1i- z7bJ6kyFWPTa`xOgfpbWt&vT$i-bf=_<2N7rH%$ zaw{|A5PkDI^_D1m^$1m8d78VU(HeSyET{KopJEhYVcfG(0=hfWhmhS^S$PRSyh%2; z*5nncb8USR7fS{>9&-=ewAJW?DyMT)dLiu?c2eI(5|XadbRrc zXPwTD&?tK1v{B$U)_SD4v&E1_q!*`3rK)-{^cXX+xz~8 zLxT(7m5SYt|0J|Yp}Pt{f;MzEAk_`SwB`@cLR(uqPN`3y8}#B>(Rjr)54ZV{V9mX6 z@JB;!eq-MR;Ryf2D%65~IwX1`tZ3i*295|>=I9z|Bkrc_sDC0*)|3xpSC*gfNW&I- z=be@NhC44@Flt3gPS^+J3|;2fknDJ`|Jzo9Y~@yj=5EZ~~{{;TBm?5qt!VbikGt?T<64@i)yyay(R^a|N!5 zBjs2<^_z_c2i>(s0P4Zg+F4jQ_fof`6@6!WW1?If;rwl>8;MK`{I7-+qj5+R#{!O! zq6k(QKAlu9a4+R(D;q7Rxo9Lq(WJsSVop=sjyv7t1K4-z>ZZz zNw{Jtbn12mck?*Rpz{&PDd#64?;KPwGR1%U42X3kt9Ed$b08lwW^VWr6kTJyawf_i zEHHqOVEmrP%L!L`%3PQq8jxUiyHfr zfb;S%d(#(|@Yc_sd2j>}KatbxBJuIHp9RyMFrDWnxVw||3O-;k!z7djWb}oJ*#nuj z$lHtV!=E{>s1Gqbv+J|MT{xX(yJDfjl~*usf(7a)>d(tpuTBJ^Hx;3EC=|+E%f7U! zkG(M4e7>}=w{K+fDTJeS<#wfbr}bY%w6bV6wYB>b!q$1=HPLO_>9t5iMjE=ZbU7E! z&cSKR#dmafmbOiKxLZHYP6{d*x)72CtkRB*=yyT4JYG{)YRJ7OS0#7{iI`ggsEi*; zS35!~F^^KKv&J7Vd-BXJC>6>FQ`5b@4U@&Y_V z*jh)Hg%#hi(kiFM6X+zF^7Bova+&mjJDS@ILkF7#L9FPf_CjN;)s3fPUwMM|Q;a@` zX|itYOTB5^tUzb(XD%Z?zQgUjl&D&2jlcT9`|60q;w%W)xqca>?m1K~c;z=*RP=WB z^@D5SR+o6BdJzR4l|IeU9ZV!5|JZKg3&-C-e`RVZem`}MZh<#2-j7vMv#lcRQWnus zi#Ml2PG<&m4QX&(LEW@m=fFr$W~}n|J==k!U171bzw-&J3SEhV;?T&DEaemXbw#T$ zNmO!gK|vQDdUWRcCLkNz)TZ5K9@BH*dgCAKnSzqK>gv#ZjyPBK{p)qgquUc-&GXh^ z42pzLiPW`&g)y=D9HYGEo81CG)#Ov4!u?fqO|MWMeH>(7SXKro5=I@X_0;w8@kvoP z_O}A(*4IZE^y*Fn1yy_PSoNbo2srQ`78L zNSBd_@bmKz5uxR{$XmTPv!w2XW2SYeCGd6T58ls{5L9@6_joPHigqM57iCCdN{{Pm z**ey={n~Fh9>#GkLolVElai8nbuL=BV82qXOthpOihE85EX2;{jsI8vweWaeQ&lA6 zn#J25t83Seq0iYdC+uxbN~*ZDemO!FU(O$s=L5`|o2QUmoWwWEjnT$d1@Wb-A%o<> zfnAypD;SQuYCsdKEGg-Cs0#{5IF=;5m*4|OjojF7I@J)yB~+E$oQpdPBA!LJ6a&-^D`mK z*xSeB>qaXgZ~2!zj!?;Wc;@9Gw}9ODh!4Xf#X`jSfqFF!y9p><$n0l?ZBGw-`v2+_ z#;)_2+DDs`k(L%$fq#&H`YL1sRWmqg*_q8^QUi(eI-`dbsG|HwE%h}QVl5zIyp+zX zY`Of1EVSCELWz-CNT#IT{5h+X;)RuurOpa7vhV$NTcvIe+th(idO#TpA~a zvR(y7mi&5?Y<*Ar>9lf=j%)2Q%hf>n{HWdYF2Sq;cfnAqnym;#nom1ssy>+ezm3a= z*=2!&7J8${g@Kbv&CSgcN+l!e1-z&x?Su}81MjsLvLad{Q3Q{i#e=TlA#*y9wN~-I zht}X&+x}RS*5I!pcj%I#;MAT+u@k=LdIlygD2B>H7{II&vmd3ZfURi73kwT#iBejp zJ5x5bG~G0{#4*DLjp1qOu;p(#M*ru1y{|Z4f4Tt$FD!I`ZAIb+pX*5L=^KUyg#uq7 z;ZxrzOFJK+RiFQAawy0pW8y`j$BP>u#?Tx!IlFer1jbnHzLMU5CT$HPPy)dTKeD#LGFicR3E!kQc$ ztYa=vH?DjNFh$ip@lf0F-|nya^Bgbe%`yEImb(>alctlt2KKiXANvH4{a0rk2y)6+ z+>GX(b92aK7D#2PjGC&2t+Wrl->wvz>@vTZ#xut&Hd)m)4tv-xjhfcv%(i%nt*@Ud zAZoCCMXiEeqg>~*Ok`L`8*(yQ!PN|{&6N2RpYf6`vT^cix-WT4Y(w$FGm|Q}DN=bs zwleg=35j=x@?sMQj?;%<%yWXH{Yl5+q+!>jRsKsQV3lOr?Y4ui_yD$x$$p&jSGaQA zlmFw|jPdk9NK9kWKvYjb1Ff?+Bs?I%!nO0!Yx4{v|Ccn$X<{KDWD-Q*ID!CH^>ox~ z3le@628)zB%{D!6Wu9gtkvL>(F5HlF(Ot=nq@n!I9g70_(c>g??7mcC^nT_ZMv z2ILh-9WgdeRNnR$J|@hQsHfJ4j8V3zyK(Gk(fcE{qM91jvdW09Vz2o4+cJIPLiNy_ z3g*xH8k|a#lIp6es?>cp%P6INdlH&PMGLU)pnw4NM|=~(mEQ~QZ(T+8Rf-_!S!RlW zb&9iU*T4Q_IoHTqhRXyI9Rod<5nwZRoekp6e2qM1{^AjpgLY zMB6*{-B{A9zb>Bn{oAWR>elr4@707%>Te>*Lv4ulHu%-6zl7*bITT9ih^@m}RT)=W z_ElTa!iM~B6p7E(Fzs?1dm9@~?~9z09TJj2(Nq=+4&DJ*Q}hjDQ;Kr*iBvjTNWiawwt_UNP|kulUIr}1_d93vMQPGB|P zz7F0SFhom}s4LlU;vv!(XU|yM?Q22f4`2UKTlY0I!R-B+{}1fX+)p11{*o4HF-&p&kY&c2C2v2K<;aHcB&k5t?oq>+7oPOL;x$pLnc&@u zmab@0Fz6_I=R@E0I(FG7mD0H(Xa~^V95`91E-)SPHyV%f#yC5upd>CbN7~UcV<6BI zUSI6qFaV|Iv5_O_7`C*SB3?HemAJ&*%`pS8SF9vWX?2j{3;&d+s}#v2LuPnku}h)L zlj1(^(_F3duonr+$rr_6jg-#L?!z>E=CL{%2i^Si{5|ThowjOd4+a7NF9Yz5nJw<6 zV$t1Q5A=pg@qFVD8K)=)X9p~%_xaRQsYeXYX=0pV@Qate;GNk~U@vW-eh}9=q9n<# zsdSl`3YJtU_SK1;$HpCGjP6k4Q{>d&G-m{PZPt-}+?kBVV$rT;6!%^|J3`Na(m$H; zEO6{JqLw*`NA4ie0Bw&==QUZl*5KsM$>8{)t;-@y_IR49okl_`My|wjr0{4A5U`+M zWH}87F!mPXQ^X=UOU{@Uxh9JyjpAnN!AYT~mAgN6J4j98S>JNUbRg8>!i3A{KJC@t zT-Dm;(5M622Tt%PG~?R2ArYh@v%i-8ZTE5(D^bR!>~^_+B* z9~hJdttHzOg`3Q`-5~NlZeBC>^;}e>q?tLCEA{cWGme8{$Z;S2pw@# z?iOF^vXA3^PCI#opTu1h!U!fC(_DZ``6yQ7p(|3!;r6}5E@)SZtWDKMJnt53d*iCi zff<=-3&c{!u>E7bCM9el#KaN2ATNh!^v8%r9{zAin3&(%D&`0FGFZP*sAuRZE_8U7 z+jz899b9$xBmZ6>U=_Tblaeq_AB>j8%CisWlmHP-T9IpW4B6EO9PkZgCC}WO#wr?X zfLcC}jKCYWmuK{7BS(Ke4AHhDeNH9_JE|2ys|zIYNeex^H}?h=tMQ zC{1y4^i@+BJ(J5(%W1!;y-EwbcO~lbter~726&dkXr%q z86j=n)uMhIE%3;J{T0)L@$$O$i9#Y;oA|N&L#}ZsT8sLhpI`S6@hCEFMFSAQnmx^* z3_D&}cmUvRv|3x2kI+MIzXY|}?vtt41t1Ic(Nu&3tYJ2Wz5C6G$CJEr*z!DV!Z^_9 z6OOt;CvRcMsf#@^Vk8HpSrU6Zkm7AFE~c_k%BF>a3R(St?)uqAl9tl!6eo$&7CTjV z)p18mae14ED2}B)aBo)7F?@BKE{+l{%XtvkUmt8Ze3!~LZSHeq{VtCnL8)3n89e`G z?&8^YIPlJ}Lfb{iMp_mxfW9T=tA(SCZVx` zBVveRR@!g7Lw-p&Y~xJeXx7&JX?(|gGUE|sV0cup!Kc=e{4=F$d}_h=Q#QVed! z8*YY9DZq|I&Yr;!_4nV%@Mk>;-NY_74q5qnWYisWfD&{T(tUBM>LANL4WwN7+&koE zIW1RhRtEr?d$RsBj%R!@Y;O&wUE|g>7|OP!kv9o4B=3K-YOD3B^tE*~CzZVCht&qm zQP~3;J}t&}Vjn>$`^q&bwpQfCTD%Anwp?3ndFFuNyA#MA{#Qjz4Yt2ulpw6K(NQf% zK&ha$7>te>gbpow=)mT_fOg2Gfm`dW0gV4*K1}=@9 zcK@2V-I4s{e8*L?Xth__CsCd z_J2ElM1RmEGIop@NXAO_A)p%&Ux)8}OTO11f=2%wb>_v+M{6CxNnU_p-=lfBPQq|o z3bAfGo*c2v@fT;jvcXeR2`JD*gzXM1P4NHq&n|eIyXmxHZ>j8Dz+wmV%E!-IF9 zICXdLLU0~qt(at@<$bt4>#Kud6;|_F^pQfQBRE&xnMQ9xtB8WiY@KK@CCU**K(yVfZ3WF5Wdx#$R!tj~3`R-g}dVWz%WSz9~?90DzN4J~CAaS*{Qsp}HhKR{e!Qx@m`)QyUaRZU-F z(&J36+P;w{25Vl_x~*6YwPyG=edRpYCg7`yK5x$Sf2uFLYk*RvdAL5hzdmMKS17m7 z;!ixuj@YbJ_*%v1p#viXb8j&ypM^k?uvVCf&TRRzi%ibRvFX6Rk)sV}4QiFlVsncE{)N0*toE;TEN`0c>Qjt z%FHu@*3iSHj;qu1!xxG$d((u)Jl_$=%=?Sgp$^RV4{OW$hYL6ZO~+lNdhlot4Wh#e zv!LNPfmv`(Z8uNB*S-7gR`^ltCp$pxQJGD3f<}xpwS@`cVYW?+6M@Nq{X;m9+FN3b zQ|qkZ^~=w&s`Q__JVFraP+$>{oX)|xd0(tg_~GpORy}1#vbFFzl@Q8F*{bvrybkJY zOy2Jy7ZZ*7^}XS^USWT4GOt4FigGX~%%fkQMjhCycVDBRnHo z+P@mmEZ{nnZiV*WCfcDCvvOaxO@?tV$Xay+kx33g=8!y zM@dP`6LI7sECB}`5s%8&Umb`)&7Gjm8A$n+!XwT<4nkv>hy~XV=0qK2s=UE#QzX&| zlrcBP2CXiOUpm1F%|yyreVD_%wkW@)Ec@EF=(A3dE+gzRaM>jT%P3U8s=Z~hvhi?3DDTSf2?Ga87D z-^NJj(B|TD0N4i`IbkU_UJL)t(1(ysc zDPwS}Q#n8bfq zh{(;NO@dE7ZK)jaQmnSb>oaR-Jy8x4y!5@rdsXuCmWX(4v50oWVc{;+u!q$H2X-G4 zk@J;QC`Esa6BD+qMWD-8WH|k*62yb*ty8r&!@MwLk9X}G!biFd>MxSJCNX=o0EB=|p+xh7;${=Te|Nfkl3qb%{bCZP2yya6r4Y6 z9FEA$W4>7ojzfvn?N?udk^(v3p$#jF#fkT3NKfh2XRoUnNRz zwck5r*OwZ>cO7~dRb=^&UJf6Tn!>G4Y*rKX1-}-7T?S(IKDFme$#>~uz zK1Utj<~S<^>}898n?qLdxl!%fUq`e_=jjw2#9{ukIAg_dd$oI5CLz;*(Z5>dWe z*I5+fgH?Jk%ls;;n_Q1Mh(74vjDhZScV;J`w<2L%OYJKFFU;0nAHsg8GtGRtm$@Yb z%rTZUi-uS@Ch+QCn^AP@(Ot@wNJ3tGX9unpSea3vfNb@Y? zbW6?P1>}KYXcb{q~=TfR+!Sdaw}~I$tdv3*gueFxy)qu zN(wS}fO)=};YRa^D)QptozHZHciXtc>$m6PNQW!M7KDE`@@NGn0;T(#5Jq49MNfU# z#VGfSFEqiy&8H3FzLUR09klj}-j(~O-eYqzI%VsH@#Lw! zb15&F$BJ>;v6M5#I3peQ3?r1}uyC(rHbFuK1z=M|e6C4!lg{?jdyf2woZ%8#FJS_* zyFeUuwns&q*~^zxo0XfpBp({oGjSaZxifNnv>H&!{yHD&7ePIu$N6e8XRi*yr`g*B z=4!@s6~VfN=JE;J^aSI?|Gx`etwePmNI(ljB%6P!8iipG^|9A^2?$NrLUJ;Uv99IP z$nG(iYBwusDgdp$G9yEt+HgkM2kN*Byf#$Y>IH^YaN2@964svz zM5v*bKNOKrVS(+5GTre;Qr$Yi(_h8_FeVHE@!iqcBF&c#`GBiJkL*&gSQ;J5!;@+2 zC?2+#;oWvY3ru*xCg9q1h!J~py6fL{|39m}Dk!LazXK8&xg2~{PXk!-GIs^pTCeRX zzdlw>KAM3qN0T*{cep)dWL4W1ClSL*WmV z3jm|has|mNe7@-f#g@YsN%#v^&s{tLLQ6qvO{oSkYb5)bl`1+c1EnkY5kIL z#!l@rkDA}#?sBmt7Jb)D#W8eROy0X+IkS@duKneY$jy)0TXpNGky7rH^p8fl5%q4X z`;iG*T)6JVYwAHp^Uj;1>#ex36t$bzF0dA(ZJPhTu#bjY*%9pT&Ru;^ibgxPs+2&Z znlRv6ETFG0WU-8wto61JOJ$e-lf>Rf!@Sd89bm^GeYLEXQHTnR(VBZQ`Xc7W4k;B& z#*nq&8ou!IsxPLzBQwZo7?ZAxSA7}wt2oECy#Kk<TrnP^o4D`YQW$#smg8y^dQMf zOnaf0`$S$3=NElJ<~9e4+!fI{_)i8^Ge`1u)Lb9kD$XO8Gm%zT53YIRT&GH;#xy6x z$yWgprF-rCraA!=K(b0j6>EE@zW~@_%BEL_`qYH%e!De~JM>zQltP64+9#HibcGL% zLUVa;m}M7ZRYgDkm*O8)uxWE7^0`SF=WE8{>F>gsiHWOYx2y-5uT`J^gSc_XdC-tt7KuJ z0R=Y3bu9LizzcVSTrtHWe_cgcNzwAbGZ$)nC3$1(eAq&lZw5aJe)Qh0`@djrJm}a^ zhbx_NaoNA;M(C;X^>W3lcWj>|yt`8oe&hATEvtpKYvyN<1(aW`m5Fhzc@(fxZr9&& zar?=Qf*dC-$(Z{fiTyE~;{Xe>Krqi`^Zn;?Ht@`QJk@3}{Ix#+Ermbs=X&0fp4=T+ z;R{l_yz)L(tmnUO`lHy8dzVf;%U|g~`*DLiHC-LH9F0_&|vqx01N(&>Xl)ydxmteAA>tP|24djob=8u4sUh!(?si%p9_D9qH*Jx!LjN7 zH~orPcYp5cC}ZAcPG3?Md0_PO&%FkAkDmEig;Ae@(k@N?9$3}Csk2dUGVBY_8#fNd zeLr)03FhEn{8xbuGK3SM?B<`EUCB{~?|sxP;ArJ9UFZL%@a9~ydGpMg*C0AYp7+$t z(nm5CgVE>pB7}HwE7*5_y3rWW{{XN+PrnxgmMx<s@bn6;Y$ILeiHy71V|;Q#$Y|ZW(bgL(kGE?c$m6Oo)GAQ znR>8n84$W)1}tB0e*r+#p&?qDffQ=)HR)zO_XYseD+6EmDA1cQU64>as0q*u7N<1} zdcUITP?gy09w;Z0Ry~LW*oRQ|Kqf^)$~BNhjUxiEW5pr z@Xd#8wmY+tyA!V-4{n8bEXb9K{GFJ%mzau`pckmJDxvO1s@>C+GPJ5$paNe+%@M8A zTNLPqtXgpp6m?zbN=KogLJOLLtcC4L^KLeZk4;+kCE zk30;%V4hMTt{9%r+}~`06dHLvr#ZC+28A_{6EZ)kX)6QMLQ$p(8XZyB4NW&>(L%r3 z#vR^&(=|zwO(Tu>>7r>V0WG1pG1E0gj%5S~o@?YxnCgZ`qn6S|1A^cQ5uqj$st#ta z{JHr+sI&p%)f)s!lk8^ppqs3@$_59FRw}f5G^2}lyf`Y+IxQsA~c!C{ovoBNZz;aO83BfiIFmT!o^E6d66}OeN~N zIiQ3xEzyGUv|<)5ruZ6zNh;d)ok1j7O&HKLizE;$or5@R@u9`?eBvP3rHUxRH0hng zu>K7n*YAe?#OZ)Y;oVdl?6s?PVnZV^APu4^a#k5pF;;@S>Hm698cbVB&5)Pk0Irfq zn6LW4k+QM1saOKW45MB+})mIdD{KXlZVPMz^ic z2@RN#P0J{q|8mwHI5JK}tgWe*sDKtt0u5sU#kc+GZD;GZ;Ca{b&UMkSIq)jN1*iY&h0I~^ch1yXM#@*n_qkgE`&(WVG3+2q?6O&|gTCg2k6<^{59T2PdL76;3g z;gQRQ16aNsL}5%!n~*@3)dXfw)bB1x0%TcPSp_H53bknUNh=n@0Ei$cs}?lkVhm!6 z#I>|41pzb+4RP|wb`3-!FknjSh7#yWLNYO8q9rO?VuT4&vMQ(2s^4gg99g7Noz`{D zuuKkD*L>h86I@o&J+C@++=9xH^G;j7VC3@UVmeyt&h!WIqkKkbT$;WLw z+gJAg<5Q~t7qeXnv0p<9$A8sEMtkGGYU*ls=l>m)r#SyF7W3^%LrW);MDh?plhzZ4 zD4}_rHqpOiS56mA6Nkgo&=_DPMGGL1Sb#+#DJKL19j2Io^<>+!TU2BTD+7~I1J%`_ zetg!Ric`p>fi(hZSb+itY40`RZ`1G=lP+3G!O{eVRdsa`1Wgz-pk@DL8W_(8|ehC zEN+-J2z1d9N$^z&cv}M@K$n6LU^N9W9U-8_xzcEvmequb6bHQCA)TWNEj}`iRwk?` zTcAf%M_9m08d?uqBvHE*OArE$_AjTs7SVvJ#R}zC5DSsi+1vAy3U9+N(qt8H+h3SKQuLAEgQ?nou4zL@lK#W_^00uryz(a zqMR}Z1ntRb!%9K}$ZA|OQiMBWqKewrqWCC}1Vqa|RwHRK({-*U0aa*-N;s+Yge)y= z8Cp83Kr^XnRwxOT6bX_K$)=fxX1L7he2B1Ls3$2aFl3JlEl)?r>_Zoadn(cB30JXf zhU^7#QC4=X{p{UOX-}#8pPUjCrNsUZDXjmE9zABPSN|I`wsyDvHyBR|`XA?Y(G5*U z0uV6+ppisb>IY>N{9h1M0HST+KU+1;a-!y#{$nK}DGh>T_nxT~xmII$3$~s{9ZMOc zGockwu-g>aC%&+*nX;wjD9%1Q6)Z8~DTUr}CN1yJ@egF6u?YkM!-$1~Wp`nGjv6_m z4!GZP+yjhv_QXMOxEUU9*5g1pS1~VLaJO^2jW8qzCQrp;TzZtbnzUFKG(aJ3y#P&Z&qw4hWEu!F_L7Y0-%Xtbmih14>c+om!PyXsDH57XL;aZbLCROS9w zQ|WNEJ4U4#7I$IADVf}R#FQ94L{l%X@f=9cCGaf8(1w@g34WGnhkn)cA?3-v(>c$e@fQ>X<$bw20%gmKT_k>|Hszt z_WusbQ%d~r6zsRKAc%^wE;J*cik2koz>!U)eCeVkM-@o6$lDFsLnNnwPA?d}w*KNM&NLQ_^Pn1ETX&L%`S-p|>dg!X5)3CU)+txjla zZU<=A;MjH%xBFf{zQ9hnUksY>hPY;c3b@z>+%Hjt0{8 z9gnQn4x-=ind4jl0niaF-Vj7nt=R-YGL*rrHrP2JUj$r{?37dtpsZSMXqC>lxT1+x z-DvN3)*NQl>;`)gi}|dS`K`JZ5>j9pNDZKo0Z0xYm9ageLxA@)5I@r$W+)XQ7}#!f z3xyISYj`1+&925VT7^%9%(#*xWU@kJ;-X^0{J|Q8IDLzwoh*Zrkqfr6hIZ^xEw=T5vk;7&7fQEQ5g$EbGo7-=53UD%+(bqADqx(_jX;KnJ~qh$(5)f(F?NF_4%qs+wJ#lUKW=OMIVF z^?!PBcOd=$kw~`wKW0p1xBfpEPYM2iPM0?=QI$kPBFDeYoZ^6T3oA}!K=zSrTgUMV zF?b7D3jR*(WVeSmnAI57tN4@D{^f~ikwVdoy9N!q_4nw}qu`c? zJ=2;>5B&(H4r78zPt5Zt;PJM<*&TD2C`4P=5&Hg;w^UN?mY?7Dr&Re*Sf(WLU(o+k zSL?n1zh?CA_`kt6jQv62{}dRQD|HjOB1GkqLQ<^ zp<&1p1ieUYQ)8g67XOq}ZRvPiUIK!lY@MDU*=Rt~qDT=m5zZ{?Su{zgc{JmoPS&tO z9iR(J_NHfOIMSW@j*#EX5zz|_s4HR&g5ani2rdlvy;Gu1xOiGoGGK99ROGmf3=>_) zofQIeAc2m{Tc{0$xoL->n_3F;UOC5VBxZ{ur)27cvXZh1Dk!O%X11ZS*b}D1SfvnX zjloo=V&iG4lYc097d0jr`YDFIVzZCNHRWQA8lRTiW;V@q!??#=xaf`3JUH=_g=;j=jLBPS0H%#i9(Pm4P949LM;!8g zU;90ke4!5Xlxk2Et%r}Qb+SIuFlUXBM}p)?TPm$sa>yyswzR+TNzc6OIRODbMSko+LCB?yA4jQum;2CoNH2uyOl2-{~*X6fWqDA^-L*buz~ z@>{?xiV(l&ZbbkIxf`m?tVo;CpegulZG$^7ii)tMQB$D+@G?Ml6l9ADezH5r&c;+M zN}CqlJhq8niK|4#SXYl|NX`bltjJbIz!;2@)wtHbdr`_*|4GZ3s#ycVpW<;SN$wHA z{nu0_gI1Rw2$Etq>P9y-M8!)}6G?VHJI;>Y&vx@@mI_l??7McY?KRYgKrYbZz3U5A zb+YS~Xf1~5k!Ua9JL@}+q{`ZPcJ|gteU;a-7|w$K!kw-BQI1n-(MB*%AGEl zDN5|%43qtkIwV777sPSQ!QG-|a70TN%=jM(oXPo|P$4EUaMi*S9FL~Wr3gU%c#`AY zHF16BjXUvd*35C&aECQ!Lqsjk5Otj$6yPE+5ia9_tV(c6zFOrr(z$~t3r;r%qVR09 z4{>S+Fra0~up1)Y!siqf1By}x#IUk16*ViJBa>uTg$wU;9e8DCvwIeTAU&}t&35OE z^`4=P_?)Y)308uj0@Z|-41!2C9zzX{A&w((Tk)>nc>~Dk+*5OT5X2r`l*?94)- zCkYKmBEA`oWfPc|hS)vdT<}2lnGECx3!YFQgwNETK!8nfL-UFycG8cw)&=6SVOr$uFSMXRg97RNln5|_Dj5?H!ZAjUyhJ#YFSMr# z%9|1}L{-vKHsJ^uGMpd;CTf}jMb!;zP7>l%o0f)5M_^`BQH|`+6#?4uVE8CHp79`# z94wmg`B_txCFcq|qTDe5lbMcE|9PP^${>_=NI8JUO*15X6qTkr!HzO^%N#u=jT>^$ zX2iS^v^3-S2nsFhmTHsQ-?9)+o4?;K|YLd$qs^$(=h6r zgI>YqKYQ7+7shfMv-_wB-z2N-8f zBPxn_9Zg%ZVhRapO@o=qhL%E7oxg#{3g9QI-qZ1|6eI+KJM+i^=2bWvKE{9M@A+}F z15?KQOE2@uBF%IxpOg#jj)FZuINY2c1d;|xjw>qO?8TgXpRWd4_eiVxkK5BI;2h)0 z9j0=6m!m9ql(iQ`>qbL0#@{W#_nSLs=s7$ERWYhS$wgRuLXGEVQLa-z%5>Sn-l^dH`Exj0fZ&gVpcg4^re%OJ z#R7LMFKl~JN;oB46V6Pg<8cN0PCb92lhtuVsF~?h7J7L=`Ums7Oh%n&*xcdiJygvW zfo{NVSxcMQ+JeZdon|psBPm(PR@`ZZT8WB#A!UX2HsoF=`?o}9ua3J@@9lm{-v6^S zLrlPdJpUPq)OqiJsTo_hd;f1xp3?Kb@HqdPSkSM3M2wEN5?aFDAR*Q>y%Tay=Bk0u+${ z)pgb0_>bD!+PdBHe=weshdzkLg=n zC&XSBDHn1yY+KmfqQPQ*{Bg$ZwQG~q?%ATjuJMFRbj`5ny{-hn^5x^pE4tEA7_$^i z9Oii7!gh)X<(75sYp1E4=%$lZvmAchyIr@UmgU#AS#-$ZZrttBzImX z&BU~y zKX6WHr0>!Wb2YG=uu(MOG&>l zLdg-AVL3~0+|W{Nu_Pl{aOCoC+}NQKzYlV74x3Rbp6oO9N4V`;*%PGiJ z#_NqWE4m2Zu+&8b4?6kyODDK_1^M+3jUC zFX|oSzHOKaz8g=Kt}RQB9Xz38LiXNSUJpKX*(DS>fDh+s3DH(UsFe^`GQjyRb}u3SpFAbXe=fcyyf7x3rl?AWSYR#Ifq!{ zS38)C1@XHrhT=j%+^0)uITH5abe5%9Hz1AuU@`DE*0%e@3{h-JyDZAgFEU-Q1Jj+B z*r7Smbn0pbBC7zJh}Bn5`kQl&ES9*O4eB}i;$zV`5Gcs3V^uDAGz73HK%}e(f)wpA zq0wT%xV)q&FkLVskV+m%EMkz4C3I{f=lp`FO?OxuRx31vC=TV`b3Zr(t@jKW-eav~ zA1OgdQcCwpp{&S0)9bt{B`PwjyE#K5eV8{`2rSJx}7@N*KdWo zBF8X`7>UN;>W(Q6;R~Py-&-fLol!=w2-T*u1(EKf7WF0m8TREx@`UOUm zmy&)X#=qaWZn%E=e>63r_1pgwsUBTho8|u*v-|wVpgeu@|DbVins}@M6UPs{6Noa^ zuHyvadz;%6M9}W1FNkky2RVeY$y=I3h}Itvhmadq4u?>FH;x-b4mVCgr;?{rxt&V8 znnS2bw8W@rdh1K{^`SWl0`5*DIYSS6|z%G51T-|dGxxkDqra0@%g&F3X%X-+;|dq7-#JfuEGe7TV6bG#Q1Wp}jK?r5)U3m?zu z{{v2~ogM4tlAODgS7|3ldJzWP9p|-kd`$({yn*vH4b;M480WrNSQzNH+sA~vQ1oc` z)xYEmqrcuI40IRwEfwv=$gR5VNEgPAnO^<&T#$M7Esy8&SEIjmqglL*(3Xa~b{tn< zpZ@rNbj`F91}x|VDiHq_smt>J)K%|3|2H^KU;IBUWZZXz6NqD}UB(mS;FQ}Pazr6vIOlr?jS-8t%&rpAc|+cH7}dl(k2wx4M(n= z++8pe(&8cZE#JD9^U{2rS)AVc&#)yo@X9L1nk``-A)a$l$=?IFI_)uHa@?upTZ(Ik zV^6{<_=fy~wP=cN-r3+D^_}KxD!hW0=7}f_k6Y*np>kgHTLOc68z~$x>u)KuMCKLV zG39Xa_aRlfyOYPB&e=w(fCt!B#dWbnj_I4zDi5H3dan4v+O^$R%-NBp5|%gwIn>G> z=nNTH^PuP+?GWkV6z#A#L<>t0tSe_v%{+Vy_&KI$sf_MBo%||gmsE4IcGfE7-{KCC zB)qcPH&NnNcfZA4?AxD#lWshrOO$k8s0Ba`u)O12)B7&+d~MrrF}vjKQvsIA!4kS> zn)CdSuiVb@ANR-qi;MO@{;#gKy4vIa9X)pU{f~q51p49tZbbvXV~+n4p4w%6zZjj| zZeRSle;!}b!j5tFW)ZVEw=AhvoJTfiz?}<77tEM~j>~!g;VUOZLtYA{+0Za^xaeHK zxGF+7sS_l3A?5aATS&t+GN8fS(@lF-~Gy!qVC zg${-K6G`Zzc5V-<-FJjPYntkPZkHVwf9Bz~Jh5|p$=tqew+PPJaLI9UeCywS$8{k$ z6cMob)@uJnp)}`{Ka74_W(4Ri>2e|~9=S`B8DgaOMN=AkWaz@V18uAU(?W7D`?-gi z)Zxc0Kj|BjFxF+-yD*sE7=H|Lgvlss5`B&da55)B1=ShAgz+FUy0Ykz@Krnd!T-MS zIA<5X@-U(9UcM?y(77tfS{Tfsd!YvCwV-`mJG|KDS3l%I)3^QU zkNwZDbosmh1?>OPb+ummzb-N+vfKV2jHfT=KQ)I@8EoiBVYaPLbaz}HPwYlbjaOGA z;ZosM`Rq%7@vC4iTi*_5pejB%lfn z(SlOA_+ysz7WhK#lVY@Q6d6ghME@po$2}CG*E>rUxiMO>y<;wesWA7LvYN;;7aSfI z?19c{7tuTNeXf@-PQA6cj9odOceWSqQ_j8wy;l?zoRXu@DesaeN3A5}2O`<;ZK zWBgRILzvu~?A`9}tbOkCZqYt5ilzfy%3MVf&}vK@22>rVVle1++=!}VOAabAJpL2b zQZB0DO6}StwR^T`@IjI}&~R)R(C(PaF;axEcKv*HzRIEzhnw?NA4`WcPB2F!M=2mw z<_Pq1djJUd5yQ<9*<#JUpjnh8Fd`H}Y7sKG#+RewR0<$0L{$=y73Q#pGy2>+M!+me z>>74WQTo4-gi1;HrClz|q}LXyfvyiLX!EjucR zre#G!Qd}2fU19>7LZA$^CuI|uXFj2NtF(tFvFkOxsNNZ_C91sXJ zfO%7)l5)RZP?5AO-K-CX(ZV2@$*`ow%&?{Da?A`Xr07D*LuIH;CH8+O3@xoAkwW+i zC|W{}fhe?kAQCtf5mHYG1j@=l`}E_RS_6U3&Q7FR2PCLNRf1|vhE#h;Yim7)hu3-P zO05SGVTrJWMcrtoY-vWO9x%jdBeYE+rlrF4H);&G7!}QApd29df!%Nhq;;gH+NCgF zqAt&7?RG~3U9u|G17yL=i5a3ENI^?P+A~6#Anao@p%11IPb&(Eg~U7BtX3*RR3i|a z3Kc~Ib2LMdf&_`OGSIAAh9;%)HbfwRg)~t_bVKWwC1?VX(VY46P``9&n4l*q$C4l> zsz?RG?tgsHp&Kfi4pi7f#{;C1VokUqYy2zOA^}pODkh*I1OgLX!|7@OOZ<7$(orbt zy6HgcqHpkU5SEdku4tJQQVx-_O2FekwK%|>*+}5aDu^j*(}IR6kYx&gC1gm7CWs;) zv!ID=47^#RBM|c#ng|<1g%&hHi%m<=npQ121>Gp>h9(KJ7On&p6Q{MbRtlgAV+qh- zY!^sOTUrVmH0{&dKnxm|9G7FF18J8ufA__nQ z@J}yjf@aK+v6%>petN;AB|3~D>Ncx-+A3Tj&>PDC6#70;)p`THpp#B{(WaE3Y7(+t zwYb#@dO<6+(uN8|fL;LfjS@9O3}D%hT)m)^kFTCQYgUjtT1@753{Grl4WfTf4OVu7 zyr?8aLvo>lUJN!Wx+XEAWKl)eB!)>C{Z=j64>KE;n3mEt6{?nvkmDrkbhAoMR0vVB zsIucw!4s-c)WxW*6gj1QCQF~@Sn-eFY%DzC`ahKhq5*!iV;r3YBx>bI{g@T2B9=!mWrnl6=Oa~mVjsL#D+#-KvPQ_F<1(^CC($sAI+liY;0}n z12Id*Q`ZzZmhnTiSUk~624iVMwlWmhj=)oeR*zM(q(CC(9 zu&;8dp{1EY*n#7o)Wv@C=Tyy*mujjdDxgJ^KttNn%$TSYQXfi{pVT>stPwY|3{R89 z^~hu^2pfdhbm?~1!djtrRB5!#jVD&2CK-lil%zcEaII;eo|0{$;-HqGzwL0vZJ?eV zgD5{0Am%e6ttSjog3i$kvK@(JU$X^zWJLi`HPiTjiSPNDgxn2P;)m~n_zeMxy#~ao zA%NyM=yWzf35$0!Rg!Eh%Ct2rX=pt_Q~^d1J09?R)6#S@4GG3T#HPI9*ec!zydf;? z0~f$zzlu}>w`oIXV{=MO6gFiB%Qw*Hr_dZ3ESEx`AD(k%JSOBnUriFNE0C~GJgq1I zm&ESO>=B^6gNw9kniaH-9u|FNB_U}G1lj5E^3Ez?LI~zHvuX<}%5WJ&)2vE6g4(o< zG|q!40G|%%X+d4m4@8E@%)Q1g$V3o0gFQ^i0M~F$GOfAwk`MG0}ojJzAiE zy9ooT5;R(zhJdV^78IpQPuK0qlC$@bs@&gdDjnLmvz&DLbvz5JzIUHxig8Z9nYQ29 z9QaQ9NeE(_l;-W&8B6xyNt*$CN^{NZjK%$1qfj`HYeG`PIx5Dxpel9x3;~!zW4D0F zCMIQhKx+Z0qKQd1p3t(dk!jq}(rjzWr42iqwI(rESX7;+1?_h&8jhZeibjwMW7On4 zh8h!#sBKlV2V$cMBL}m6xi)ba=Gdk?#I@n^!s%5fcG1S1&X+aj#X2&l;X#nPukIAu%KlzAC z2f9%aO%tu`owRA9`~40kPLQ*@f$F?X5Hd=4F~sTQXm4isnfeVc2bIHM3xkPs3gxP5R( zWJcmalnAZZq(v1!2jxE47&Ck8WctAq3197IpT5-5lM{1gBK{W>b1tnL&XG^8U z`MRK@j4PXCTLp7ayH0ZK4wNpp3u|oyq;BoPiWSd?maf*(?0KwPv#=NFWpMKEU30g)|}B-0nIWJ%rVa%E#7 zf0d$q`F3L(%%Dz8mref2fC=KVVOm@l5XSfvl1MWONVKb(LCaEm5G%`A4Of7wsUcRH z??$##-32odcjvGw?bkgjwPrhs4Ehk_zw^V@cHy;su%A90ec1V$!_IDh7kYTXQXszw zzxiB5#+)6=bS}NDs7zOa+Mm2Sopd#;qFcYnuDA1Fxb6976~sgn``R*2bYm5F^pFH2 zCY+dvq}IchO>QX_KpQekv?W{nhjNibd3hOM6RJ-I;X#70+qD;E=iO>Aphc#O}qj-j#S(hhoYo{}J>_`eWfr!ft+e%SLV&@S)*aatBG(yM(no83}WwbOQ zK-z?WVnMAYwgX7Ww1ebPq49I2#WHQ5a*5-IuZ13{(eoWYoZ@OHj~>Ed7aBXi+haRR z9y{*--~k!H?6Ko6yxh41$lYBtD5F?l{5%&z^l|QS*MIbD{IbW5By-=nL&l|&9-KK> z#JI&o(-c+75M5(e>bNyBC<7!nv&YZIb0?3XjmKb(W1%%qQxjVMbruArY2pCPJdke? zDY83z=_6PS?&61CF>^#imDNOHKTHummwvfL3OW*sFxvZN*YjN6L#ZMdnxe>RqFqd& zm7fv|h*2$V(Hudv1hB*e7V`Fap3c(G_XNtyK${L@vZw$VQ_zehVM;W)lVk{#lZ(lq zXIkn509Y9v)+2zjng{?OIm1=Y4#KeFT&`7eE=e|lqTw?@0RZ3}JM%*f8kDIPLSKNVIJvbrP?u*5_mump}JCU`IrAyOwqLK2M1q8f@+hm5+~ zKtN9`3OR~h2q-3YJOe}mzQwL+Ujcy~+9Mj29x-E%0CL>H1JP^*J|tv~s3Mm+n9#z- zo8vPztHppORIL#N9~vm;AS4=wm_cNgN#DM`&Fd59eZEihYC(kbZPIIjZD zamIVWP_PQ{&CJ9p*n&Zt)=H91gr^Cl3?gWZBuz7A4GA_E#=%f95D;TAXqq!L2^K=P z0ha_RO>*wx%!#+Fp;jnLa}3#nv+w|z^3sBhwaH6i2`!A9A_oGxXeA55ZK27pqs~A| zE=YFXynO7;SceRHnQJ%*UCRJRSPucp0Hy#&x(x3$an0I1>y83**cNBpE6__mIW-F& zW3hmIXHyvpy$fb$h`KJTSZugp(f4*r5U0j@oc5X*!G?p#n;wh-&-wUF3qoEpO zH`C(;;e4khU2%FW2m;N%4b|@Y0MjH{p3IhpwzfI5TAKonlG)8Re(M9g?ny|A?_rC( zzvLkoA8BjnPtO(Qne)2Ba+*+`f4X2MZ;M@A!uDbtWE;@-eSgcBWBLWk_-y`|tezR= zp8SPo6L2}<=>(fOt9??NU@akXDyFHXrojH(n^IjpxHqR%NBVGgN|BeR6ud95-?ymX zv1yJYi4@n27+N_s)86kP%N@y}fn*lWlmQ_TWugKN%XAGJO%hAbYv3fKAeEt)A>a)1 zo}n5a3|4ulIX)P~JU_xyw8#|o-UiCqR9}cdc+%GAPQ4$n=N(+4Yla0lFyqTBy3$b? zvlLvJU1bq+&ZV$}Jq|a3kOmf+nu^dHA6zCNnI~|3xIBmioM^(j(I6yM2K-16=@SVe zJP9HLLxRW-AVI`S0+!RagC%^S!I&C|2-QM$ATV#13TA5EFcpOch}2ern(CVBDw;#7 zh8@5KJt96cn!*NBTvlZ>2_@&ec0#t2=_t;$ikEgrIxFhmobS5^Tl zDVrcAF47D>PZK#xWugvK6~;NoniSOpG)XR7l2jOdcT)D!S%ysnOG9EoGjz>9l;Nb8 zjYH8&8wivnk<_!KtF=Uj!cfpmq)IOi>#>`nJpi(0LM4vOD$%eHSTT}Knl)Vr1V)aW zgJT{k;yuuSK&FY6A-xR6ON0|gjtm4spoPVs)7K^;2TMXs`ioE4xmA)*P{9s)Au>cW zAgWnOQmF=aua?oC1B6DFWTD30cf+j7hDj0w15H&jl>(SI6&f&q25*+R8?k_>%d}G@ zn5+`py)jWmJSBmYhNDGwGHrV#CM;g>N8*bBoQ%<$L8DU@Jt;<^CCBiD!YXc3 zOKAzHLNxL{V#eiaWqGB!9My=$8WE#P(4eQXafT-+wG*Bsvdu<>xtgh~fojeyQdan)6guwNus0ESw#8Nj6qd2WX(=# zYUcwGO?PccgC=U82`n}nMKy!Q(LuxM1&Nb)&o#blWX>S8&3t&fi9uHq1ID4j#MC@3 z9+$Dx5f_uRSQ=S2c+~RGo$i{2-L(r-a)JzTxXk_;N}Dhg6HRDV(pf@3sR=T8tPhq3 zx@!@$beJ%nR)8X_T_)iL)-r0*mAu|cTbdz@iWxSbsVUtsgpjMj|JH_d&9p)eB4nJy z9K2$B;!_-_`5+}=2=xKC7wWDFSsMLW8^){IbU6l9WJxw^dWPJNdu&Y8GsmOVtA@>% zK!BE$Kw6dP-L4I~7)wG1p$f2^hBZPps6YjR^i#0%_yFRUl$gP+m&P$ivPot%ToQvi zp7Aj)r7JQqo7rMPK?s3UC;%;LiFlGDEZOQtO99a$S^}a+eK_3H(<6u&OF=UdVTF`3 z!_%7^C(Ue|6skeXc897!({vWdXolr^$H~~m9)P4r!hl4o%PQzGWD8%NVrp@#M>JqS zl1&;Kl39L=tnLWkqFYqHy-(KtFEn5%?5v3W zZll2cPmwXzV?6i2)J3Xy-~T!&50~VnJ^(;Wv|s{nFEojkh^!K~6Rjp7>bm`Bq*|yG z#(8dK$-0xJ#Oqf8u*3wt-G#mj*|0pfyLkMrB&1J9!UbqLQ~}8uU4?N;tFn~|(Th!> z1lmrXj@_52lfZ;VHx@sl6#xiAk1Ro==Al(YG_*AJ*Y;?JA^|B)j26oTP_>|;8#0oC z)KaMeaRn}+&P;Oi6#y{}Y2+GNOv%EdK&tk^SQ5l#BV`JKq=ty+W2LeE9y(7g1Hy1h zG%aY@pXl5T$T36@27@QEXqwP6!=@$1x}3Q#rxIa1ToHW=)znlksi_?;=xQR+1v5Bi z0Szr{Aw)vc0wJ4(fe;`sbVEx)D+$wPASKH9{1`MizL;o_bJ|df=qYo)(Uxf%@On-g z@u|ufhismO9JGDvI0%Pvr=*3%@P`Iho<*H%Mk3%aA+pFLqrc4yRRQ_0XtAz-w^8W+ zzuK((zv`;%>UPWj!FUE*c5?zcQYTagBsl?1s~(t1v1UwNeSCBz7CkN=A6qjfIyQD( zT&x*eGp4R~bmX`?v2I+Xc1&HJR99PFJGv%5u1*{~`nc*^C`BTpqc!7dV&h`f0sDY| zJqRMpAyi!#s;+B~)Ygw4S6?$$7+X8GrlxM(xX7u&Z}YSqv?u5M=e9ul+eY5`9~o0S zc1*2z{@0Efy?g!-##2@XeoXK00#k6-0CG7txi_q=jJ>4MQY6&JU7`j1PpXi~4cUdx zSc6g&mQRb1t8yw=(Y+v~0`YPPpZ<=^iL^mXVPeNaK(ZPTH$7^YUZ=}lTb9U+ERC3A zNsp_tLxk`lCN4A~P*#S$7eB^8D0smI#X}&HSD8ic8@@^qtUGeys-d8(~fM) zhREZ~pwV{#Cz>Fa=lI07pxzN6NZWSxsvh9&sIoFJNx(5MWo22^swc0Jo}S9Eiqjz7 zB%MjZ+seuqXuc+xw;%w#K_EdwYQ~N9K1vs_@q@u%pEQ~5;T5`ziQEXt-B!Ww*fyb6 ziNJF(F+xsjd`3KWy}6~~3(95e5Vkp;X^L#?AHn5odjPXyKEO$ixV(V9wLQS;jfhPe z(!^Q(9#0@z07$q5g6OJJ&k7(#P*ixxcyt=L1fz7k_?)AbhWF>te~Mz;XZBS-pu$W? zL-c+~7S9}`4ss~r5y@(&9xPj)g$GSKNl{Sj6qEzgI)UzK*o-BilvbdD_xN0w+p{mA zLc{JeD=DgMW3Uq6t|^WL#3obl8?15ty>D`qLEN+qnFp@AMliUT03)rqwmOIfMPbu0VDVTB`Xgu3d ztCL7Ppd^b4RWmI)MndE09*h$|gz7tmSfrhUw)>kvW6N@ZuRx=(8(I|7H7N>N$e(0K zVbN`2yMU7ivXTigJA{pdO6Ea`0c)iHTbeV85i&HZ3N%cgzSGty3=(=10;U3?p07>O zNSL4j{nMA$P;J(ftdg4x-O`v%pI9!b%=Wu%FAS3TS-g#GZW_>v?1n7YMc5J(m~UA( zF&M#K7G2Q&mRVNb4!HK#U>~yTSYpCc7`>^GQ>iq$FBPGN1%&|-6_C1urGy)d6Kd;$ zhCTptnU!xPrVy|IZ0fowMI#`SMvjvZUmSzXa_&SSV`nscxLQ57_OgSHfp5?; zbEp6sc8nc?cGz(wWE@ABHD@$A`8;qD6kniR69d>D0t^edzr za<^zfo1wx~zoVh8YbjY+2J&>{S1~bD+A3IAV-=eHndGevO268U}nRNX2R0= z4rNLXilgaGL7W8H!v1W z7nbi)@Zq1LJ*8zPv=Cez1%%qRQ$vJsAc$dFAtS9ag7e5brUTzS+tZFUB@!_lOPiLK za-8s%MkhmmFb_u+Ey^6@t&W=s-NQW*w}IwXczd%itkAL~IXv(WZ!XLSb+gla2( zuI`{ugWeS^+5Gy$5cMAwJtxDdu%{$$vt>bEF5qTU2O^WBl-uuds{_KiX+0!{ILJ(C zwwczAOuhX=GxB0?(<&GCHW5l9-XL~2|5WwFNq3l8rxD0CqKpg@v_x4kK}BblAnU9G zoi0YRU-)3tX=~pyr5aM6bvf1rC6Lxhj0}k}B58dE9NR@vN{U#Epi3V+PGN#hwz1`s zVh9iW14lFaJGqm96|rC2#(;}P{&d8F#Wu4L7X>};pxH`8_WggX30HMLtAhz5R%WuS zKoiW+(yE1o4?eOgDp*&H<4^RKGUs%KU$Q-ulN>I{IZ+^T&y59Q8Y&N+Bh2^oBfn$d}7UMIh1yBgtF zcRzK=r)#!agm9<_;cleB(vv5)_Z%}DE11T@B}YL=+5t}f%FzNe+SW*`K(uJ0yeR4_Pr0%(ca!)HKtKo+0YM z`DJ@C+&u>sGc^m=1Lj9FL8l88(f$0PXS*)h!q8&KDMY|*Yk3Au%i~`{CvV+aB7JFl z7i@f#Q>fDGjj*+Q4^G(okOv|BeZT;N zKzzTj!QP5os3>wA#xgMlPSvz7)7EG5wrpugl4&W?g7($}SqwTf=0-MR*1x4jqhlmJdS+T=-oH$OWKN$TSx)`l!Y;w&`HsH7A{UhBePJ^ z6633VUM|et4L_t5O-<0sXt2je@Sz*bG%-bnsA2^yYM8=dwlBydC^X=!S5PHw2(2Sx0PgP>A>~T$~H@Ff(o=) zaW3zMtEexv48BB*Xjn3q{mw6frb8t=_adkKa2+mw2`qwkI>W+r{8WDE=HvxkllUFZ z21$}>W+PpbvMy)zatYqtD~%zvZnUt&o-ke1$#O^c;=){m_VVpUF{cKiYZBcforGPk zbc=LQ&?as17;_t{xyT+Tn^4&2Zu#K|L|TNL<+5D9mQGtSrG=Q)Cy+bfSh{bs9(0;o z+#7H!+#QqG`$r6>DIsCc$u-tRfMQ{$}`uM6}?lmTbS_2h`R1 z{M>2D#gK|`Xot|Nb*IuRiwgDl$P7WvD{W8{Ugp^mok0I)VT)dRP-RluGrHL&{nsMD z?qKmffCKDV7U)U!qHykl8Gn?qRKOWeEDhk>K#RkdHBIA^@Nb+QBIq75SOY`iQgS&0 z-vv^(gdWhG0C_s`|JeKc_O@{*PZ*uQ^(nAQ?}^ra+(yC=?2XsvkeHcRCIjhzscF9l?g=iE zDqPd4=0pBq+Kq(=L4D(0f_TN3>Kh^G--4xb1Fm^J{C`H8v=I{ojAkVP2i2HXFB@j`1N?aT9(_0lNBSKo zzWWcpn&>~qHlcr#1eITKJ@htVFvDyv4qA@EbMl&GmrBgax#OeAHjlfc>s$`uLadTrXsh5~NeZ;}&I!CI`gL@2RBDkUY z%V$ps;qh_X5@)O}gyeFpS*Kz#_z4-N0QvlX9|6xMc$PAjp!h6LB)`&AIwyROCt)w|-2*XB zco`V|kuyBcf(xuxPlcCMC%Afd=;B%pQ?7*pgF>n&Ls1fV*M6KibCz%0$h3|JZOR%j(+ zWFJ0x`U;zyGxfPN;mrohDm5z`w^3A3Y!ptlp4AckseflscFKJa<7<>4#vTAF($f*s zc~Ro%Q-#v^q4CT2y3JA1gJLJpG{v+?%lY!vri&*=LVoX@F4m6$pLd%uU2AWhGF>YSm^59h z44gJys|}nu^=d_6it*BC%ypVMht8RE(Ua!~3D~rA~r*xeL zd%fvIgjI736&Kdv)yXJr#_n|3b$ba>z5Of1*&DUs*2tLVIL>fVjLZj!Gca4C+512{ zShhT=1i?&fXaNBd%3B&4P03bPh;RHbTRo69$*U%$;3^1FQBb6yYcf<=pQu+n$u6{Ur@?=;BFd3D&UGk!cyis3=c{l_7Rb(bZnHiGnn*tR+RQ-C)G+@xx z|1CV-5=9#fU*wde=-?bu%xpGv9X^M)S?KgtQw*6RR^&2hhB>35TYtNypq^D(F*Typ z`#veECYQXZ-KV3%r0Z9{oW>BZx_i=!s1hA@`AnY1>9F_`?Zd@Annxy+{#rs6cYz_XQuEDk3{+K@m$ELu}v zhPGqk(A3U5N(ohMGV{77UH#cy7upmnW6`>}(Qt2(KIC)b2^gjO~Lq6LZA)#%vwd;t*RKFK&DaXmRADnNSipY;b9>Ag=@2Cf?+ho>@h=j^nX(UM+;ncQI9lR8?x5L0+irO#aO*|(uF->Aia?4m{ zvB}uZs(@&5zzmpzpc~(+ql&{70hu~d_ziS4#}s{laeQ!(+w~OBvXQE0PN?Wl-JK&v zo-6v-*8x^M@X_H|{{O>+hmU=NXMHVodW#5BD71s}8wfqf7jyJ6B@BVRL|-H&oFPRL z^+YWk6S?c(ugHR`G=Kur3_X{)RJYEMxRjy@j=q$C z+tJc>b@xDAJTygM_?jeW$hQZ>Q!zWv&WFZ!qI@ZkO&OZy;_^&2xr;D{5}l69oLOZ} zF%i>8qJCA`HKth(;}K4oh~rg1aH0N)Z40~7KgZy;3~lVtr_yI*rcf!|lF~$}d{LUc zj*5&aF;ksu8Nk)E0O?WmF{J7&tYTMG;&aSsE^m5&mPZTe>M4UDyBzS+JTcXadEgsO zONUD|^*UOj=~yalwN4zUoh^VqS_NhhNt%KY%hg&`ZJx2aNm$|Jq=4Rig%iBWS0Kq( zQ$!C^L}w_;_zvF_-YnI*fJ0-MlKc|MSNgHVO}Hw<#-z|}Ss(OxXoMf%CS|p+;Kxm< zRP#Jff(f*m^*RZ3zMBQOv zd=(4~C3#;T*rJ@!CRCI@EyQ~VYO@nadGMD((om0mmn7-24kdUQ}e&3wlxMuvXZM?R)JT0KO=7 z&@G3)C`Y3W{DL*I@D>n^2C7~D{^ zPTyb{_2%7h820M$HwVP9C88A)W6QqV5)`8(HUt)9H{-l9FosF|w%7_Stlgn2w4*B+ zCPx>1h203%76=P9cD`}o70VRt6MAKfD@MgIt((Si9;7?MnDtouo;dgVeY+kQ!!O z#YUhSz6$z+)$rB71+a#%%B`R^e3fnuuHmcruMe+bF8CV)Yc0WhhOu+o3T&gvJ`I4|sFJZc;6^(k&5#>aO11&rXs4wGcB5v4^a;G- z-?ZF8Z+x538)nE<4Sb^xo?#yf*?)Z_2l;5e*wuLjr+H&wd;rtq}nf~GLe7w*6*zCJjGd*od36ioxS1we&| z00%@x69K(}RCpxWgsEth;6R`XPcyd{s-m(O^axgA9XN)8aZ=-SpYOHQ;!W$3nL#|rtLJ~UDWCFAYPQjee;+Xb)NsWs29z{zX9%r zk+pM&e9?w{;S|Ih#=fZ2aI@$a_4e=ZFSf_OXzkT+5&^>wIJ^xQ7{-RB9~6vQoFNFo z!LZ5bj)YN(6Ba6-ElD1W;30^UA`I4=+0DQg6{0qPzHpJH6wL}o76OJvRx{j%dAM~; z052|{ot*kGE}lP=+^cQF$!x~ARf8U*4YaO-vg!i~pJBFE#n3Q+v!z}}nQ6)9yUGgT zHs*_tr5%*=UB(@{n@g&J;_}0&+Cf_1CnOWDD40a5C^t!XD-Qq^-fI50Okx-3EQRw) z9d3;0c^r#!8Cs>W&dnVFE1nXL1F}+L2jI!2-7P>QblzB0nD={q4-a! zgXt8`gedZV*aFDkXtDcsiDYH~(WA=;I%h~usxo$vP%a8pX_ItYlTmrf&k!V^P%Mo()pe4rKCS&+_0!w#7==W%lzW3NOzpA#3SW~NW0S(0R1F7fB3PWo zjwxDTmeF-(h*bGeY7DD9ywx8B)}9iE#o<7B{rZ!j7BaX9u9}zK!>d)EN!<$<60Ez3 zkw(#eP@`!c$7Y+7TqBxdrFt|7dM@ORwO)*SHM@J*7f=SArI0k3)*CZ2( zi%H>7a=1}7m0aWnh35vVdrbX9V2cT}A(4UXdfigSgJ3#^vtsYI<@(MU83}SmDaF@N zMAgeaJMcwC8)IZ`c30~Q_33}0wJg9_V9U>Ed|Gw6)v>-kQl>K!EB3r>v6!X2 zN7#%)f#<;YCPPO7UgI$s{@c;v>^ z*%VfOwn{_GtyGGsw`fWU-?_z@Wx)l;w&pJ+j2lHPB?&_TA7laJAj^y+n89g@ z%Gg}Geb91-sHa$p=v)^=*IWifa<#|->{fal;RRyZJHB0eC+v!j-*55_@AcsCK0w^Y z)Evj?oh%(t5GO1XiImM{aT1}Am;^L01~j~6OlI#}%BheuuBzXO-R!#+T1^ps=aB~% z!)xSKD)Lu>>RJDBi6G6U2s*~1_^FWWrZSmwgO*Vkd?nBejX?M zXXyDd`dTJVB^&K_&76%hVLcV}mIv#pf14~=PnFx{zY7C9;YP(c18BXP??xpoBxX@;*fR>n1nBrtn znD8q5si5dhNf4-|2)P1kJTw&^P7#10|0Uz!jLyTtmK3>O*t&+L_}USZ>S^!~G8I`0 z!gxxIpa%(XN~Gg8gLHw))BTKy^KU56W&a>k73Gka{zQ{7-AXuJA`15!#^6l<17q3#ADSXLJa*)e{+>%V3u{u=qV z-y(TU1w_bC?=y`|OA>K`h6*KZWE3IY z#rh}5P~0=#RYNfg&fNJ}<(DG;s{GTA61B3h0=gsiK<|rSJ*%j-`>SB&8@gRDB*wdo zJVuVl(}BqpFXLPG>{7+Dhv#6zZGy=IbwNc0lgRivMAjPhMFvniBE%I)$nN|wG2*4Q8>{$C#M$gFy zBP$l5k10I{aLQ1U?d9pGKgjflp$c;xegQxH0FL&J;&VRNo|xW@xSlcz7`jGO1fqX{ z)JzXnzsj68VBW7Jf2^H{>TgzvF}Og-;J)??=`#cH=@XcI`ZNJwzJTu}F=OkuFJHuO zn1P6VNbcLD{<5go5(?7jy0t;KbmL=jN&{RO7(y?cYi{LGH! zuzsp;0o9M7iqG2+#9`N0jTCX!D>Evz-L_Xs-+n;F#oQ~BbBnWQrCPZmTq=ReN;Kw{ zEi2I5^@P$e8#qEqrtQ3vu={0&;{X~3kZuEYso2GCOqVe;QxYj8m4UV|m>1ZtVv8D7 z8q*<`hWV4LhG)7SdBrpI~ykpikQ$?T!V=NCm8|!CW+TSQnIQ? zl!`CJRMWxz?-46*yi^)PBw2FvDPF6@b&W1XPke_*k3iH2~Wqw^j(H`61k~!x@I42RiS&n4R^p?CR zxG1qU7QCFwJ18CMtwwif>&02=trlhL}GdhBlDv zD)B|cq0wHU_QeH51?!|XF{Er3DFrx*@C;@sI<^)b*Ob&b@Q$U8P}P`prm(ce7%svj`>Y(-N=lio8%b1bTr))%7t# z3Fb>-o-K$-xs!ke`~}023UH7a{|^BAI76w7*LnW>66~dfX5h)AMs;hF*FmdNEp-ZzlVp1mH!?+eDsee|8n&B@zbY|A3lEkAxIq-By*kZ{+zj0ATo?9OdCL7%sCcJw7<#<2_PiPw3)6{`21O0WY4dQ^d>4NiE-{ zl%$Ae7_s3o_$1_S2wryD+~dJNkmrQ=&-!B8^AbS!X#fI zif2Gl1#poAJ}m0~QZ_Txs(35rlsYczYGT7mUbnwf-g%u^6Nx+YMZqJM>Cga`A#ETf zcze^yaL)MJvg(ClURPIU`8OLfsuoyLgRn)HkO4D=Po0Pd4NF@;rQ1loo-$T=V`!&s zE$BhBYl))>B^B-f7z#Z#RHnxR`?nMdg~Vm3PzpwgFV2oM^xIp``c_(`tSemjguLkO zySjeQsA$|ze+^5$KJ;{(wT5)*x2-g=Qx-dQlLDYv zLnv*w&>E1ZzEQ4_QX$6xQsx7lR>%t*0}plLH??)I{a{cyB_u{LsSJ<5J)4C(By_!^ ziez@iz8+c?eyPY2!+%zLAGFLf&nOhlUh*nC^#?^sB-G@P#W<==O-ZJB{|fUiIP(1p zKMqAWy65+|3C?&MKjC`)o|y<*mIq)?MPo<~wB%Gue;N4xYMZZxld02;y{v zfB5>L;NMWNRsO%+xH722so$xCJ9S|G{!Occ8URR$TJX(1w_G>Mw0HhgWm$lbl<3rr zM%P=008DDYOGLn#X{1dsCvk+RYZJtGJsL?$1zZZ?C1ILn8nt1Lg+CIp3@6e}(9+i` ztRbX_U8>YDpNg;v9eWa?4C0vWW{8T0RYbX?eVudGI4tUO18v0`90k-`uf5ym(~e~9 zvIgu*WjFL+5sYXDRkmvDqAM%msu=+ph2r)kcR+v9VmD3NhaOWT^{B%J{Qo>2@xRyO z_5W++MRxG|&DD#`arQCWw2fx}|KUH59zL!6{}1o{|2OfR{(N$A1zw-LdT|UseFEcC zE(K%Z#rg7OAbo7ZN6U$|*O5??=j~Y z2&AE2n-$PSO>GW-LNb?L-(w=sa;Iy6J_=~>WFflbeLh9AECvgd$r7Vc8I;NeMTMA; z%dn^~U%)5^FippHil`17{-OGrAm_x0lOvHp1ki8*5t`-;i!_rm{xXoN41@p8X9;-o zBe?qc1vr26{NKT71g4NJ2ZOT&5E@BqL~lZsU>AmpzNAnt$4pVAU=_6Z$jFcbl4eEP zhbmtvW|U-fEs#9NY}s6t=E<0o$AtsMO!n3lPDL}nitBvjl}~(<2!sR)sA3@U7IIx5 z%?~>pP-UAiK_{9m2{_kqDxW@;Vy@AGmD{aA4IY9q`0{1!qiD>oXW~aC{wm_(IT5hi zU%niF`UGYK#)!>OQAoGpx}~M54ChBFF!ax&r0FxY+!jMQrv=ZKC1i|?>k?FZmwY$h zPt#mV^Nx~8&eLdx6U;JcxXvgNQGGC$(!( zj7C|u1|!V>LPF{MaQ`*BM)W=yNo+sh?iKNy?vS9FJ<=;wp$GwZI0kl~Xs5W&mEEHV zMhAQWMf(NQQk+K1o0#8Vl#7G$Q3{MwFwd3+>XQ)HuG4k^z@sYj^~+fV`y-OX>p<>% zpXY)6n=|){fIMAL7^&rIiQ<(swX~4Gnet^$uEBcVLI&jSbBZGEA-V5W0{1m`w!Cy# znHcv4U1mhY{W1rLx4@RfQOt<>jw$E}s8zYn6v2R`jLr-B7Zs zYbL1NmJCKCfxutwydS=^`bG(PMa8J3GB&0pj&ZWMf{W5vlo~{@YF)mx@Le~m!2@(% zt4j~nHH>itGbBHk!=TibNmquMh^IdzNLRBY9MJG;VVqm8y;t~_fGW3Qy` z;QPS^%5s|M{M{6l0Z4MS5=^|UE`l_%`556xvtd+1_ z?K_k}Kd)daglgQ-Z`CFY6!9uD^z%pIGYF(0}~1k>bJBgbf@0{WfKM@clrY zX=W9`uKLwmAZHC4#J=F`b#+B6eO<1**rYKoJS!STH$>BWDovCp)auMi^+WZKVNfOB z&NJqzOkG&Pw7le0uN*q?(nj6!cBLN3qDF6T>XQ0S`O|`il4V;4_p-F^a;<-E?oaF< ztW?*R6zYzoIpPdLqdR5HfPv4ZgYfMu>C~DZ(5>S0f>*0!VG`AP#~L-TXKsDH9k>sS z4iii{XZH;YR%vLpiqRKe!r<@D#>5&<*1w?)MEf(-n9M_)DwV?&4cDUQko zC}gq76Db{$jonkY{>%Y4gig4UH1*21(M4VI5%OJ4$eIPszuH(8hRd1iuMi>g_njpiPQdWLlc7;` zWSoT*W%b9Pkiq{>emQyh_QfUm<>ckr^OLKyH?NQXJK>U9eDqm#U;EGi<#$B-woT)L z;*q=)E7iB81JNN?rYHy;o=WFc65Oj>p@<-BIDSiR*3Cc;$TCfsi0^q z`$KmItkA%zm0_Z0i(?&bBaQ)Fy|kx}2#j|>3_pJS_;I-J9iFf4t-5>qeggcz0^xlm zZk$@f)dnu$miWKJqo5S!~I-@1o2gMG#a`5EUmF+ z_EFK@@z5=O0_ML7uDKpb_>)eWpk@9)d~$SHng5R-K6-dJ|8L@Pcn#d}sHTa&2_{kd zw+3E~P#7@9DuVdf6$oYC?NzC@{8IT;-{T}Ywvl89E0nOR8Iq+7$ZN-mlmbMRMjnkg6Sc74+RjsctFV>LBJG+RIKzUi3Jq-z z96`wCp0W%|sFG%0+A1TL4K(6DNHrU1q1T|6rD(=wpax6kfc5G;SWjhhQg>dhQ;i8V z0xvX>nv}C+*N|>9&(v^?fQZvPF8l@Z#W8sD$ViY$Dapu;#K++6^YhT6SEuKy2@Pol zJZM%LsLhg%4qTcLV%;R#DJ5YIHAmZ9%=`sRnt=6Rxrh%6cVpLWK+F1n^yu($W&MBn z`03Hz`hOFTnv4EZkeVZSTw9#4kJJKNoCLZT*TBHuudtNX6BK4-m68M{*|82_zFTwq zTXVH&tk&aMGCu~N#U8Wy*y=MdtGn|`_49Pl|8^|GD113+^Z)$gsOtZD^5p2w|8pac zWB+Fbci0DX?zoSQ7lds?LvHU{Az9tVShYu?RIOuEvp$rna0?@}!~D1XKnid<#1?Fs z|4)w|J*v+Cqr*G=*Bg0y@c&dVym6NbzpUgoIDZticix}Bx+U7h`xCrN*xXU1MKaHlF1%S21e;n5K|3?p>-ueG-;L1Yj~-RyKOPv!vV*t)K7$2bN@;;(DWrRrzQGD6oc@d{_owbWJcHY}h(;|{#; zF7h6WBTplkq05ZI3@z5OsQpe3V@Cc9uIjn*mCu{T1QaM0s`HE~EPB9@oT|&Ma|oIK zezruj_bgu>Sn)nq*X@a;Iq=>1N|85y1{pes*%Ayr@rlEIF^p^pA3k}?@>Ms#VPUb6 zs5X7J_w9LV_qbX9wUP9V6`xgYhoh~gzOuDokKI()hT%OFq_J;CYc~<9^{6gA&z304V?+hyWdRvry)CM-UJF&S z=ZAD|uXx`!Hk_2#;bV?{0HSrAnQ`mr!TB5~I9nUbk$Th5xE1vW4w`}!uaHs*H&<}4VnT7YK8+z` zc1P8Iayt`i6}ZbctrUs7>~#d5w!+POSoRUdGomv4>1$y`lAb%0xG~ut3yNc04>4#xQsu+I2dF9w<3`#rFcNI&e}FBbdR; zxQJUN&tbMaZt5=w|E@{E@~Lp8SY(O*mOr?cpO6YXv%IEqtrs(gTGL%o=docXcAs}) zv&_?_-ud8AGF{d;U%kz%T#)R23cXsb{NyWKbmnBGZq}&Il2!FjbG3yo#P-ndH+s!m zmmU}O^h~N%caI&d>y7ao&DOIR{Y=RF3iZWr{jgAJY8z%ya_wFqo}FF2K6!Qa?)i&n zZ-1(&U_qAhM9~D&H5g`;6FL;vt`4neX{rC@rFqT5>F|g-dt4wk<_y{Qs#Lzwe7rij zI6Ha%?45N-&AT7ZUcT@$RiGhT7vbqcY>8Z19BSLw@l?P!9k7z(>Kqq?w)ZQ52^al8 zT0yS*ktF{IT3?`f{a528wf$xy$Jg)Cx>!W*-l+3f6~AI^1!AYTN~Si<;s&?+-C9AiK+svAUr^CIB ze#$OhoWDFf6|kr8UcGtlp>Vi@EJJh{Tvhl?F^CmguU)EVgTS3=>5`RB%36I!Hl9u{ z#%|@*a`n&_)68Qf2_(oLV_3EC>K*suKd&xM-u?LUP2$>3#7HK?ZZa4>JPM#n+<-41J`Wi^i|`} z3U$0{eAlOaK!2USste;x!(uo!MdI`LH&?s)kh<9AWJ;~HIgRdmy~9>}SwXM^rXOg{ z{ux(&mD*2oF3{^9Jvw|^7Yq~4BxKv&ta8pNnR-4nOEfrl%wpXfIzZeYUL6{z2N*PX zfq~N#44mFzF(_)ec?a{4KMcS7bV&(Y<&~Z6u}6$Oa;44!(6Zn z-c5$T@MO5Khq_f>`k4-uR=1rG;gh8OoYfb?es{PUcDM?hJ0Q<(jn1EaJ7+067EE75 zuSMdj&k;&8x=smBvXN|L+{Ml8*u&X~p!K~+^_DgtGonBP{Vp#R|L8yhmik80@oO`S zW~__b6}K01PrcXSuKh*k?PlG$*1oxIx0=5g6LDuQ1gnv4{0J3Js(4zCXdzX^sJJ08 zp>kJohX4iZ%dUY6`s2O>724|UAyA=q^m#ju8M$E)jnK!G&buoxHnz^Y-HO#k5ICj7hn!)}v0g8Gz$^no)TF++acPHrG1s2D0_Gq?a zS5)pIABT-e4?Fa*-FX{db<@tK=T$IEyO?NUlSxhxo59jR-Nb^$8CumqB}btqEhsc? zNZC<98P=c)?hKjE7x?W z_$`ZXGfBPp&X(R8e^t(gwC-m06JP+8XqUD*kvpbVRcIHXq|dRwFV1Wvv@7>osWI76 z`sKRpDUB;qT+dfUJ^?P$}>Cz05}YOp&PZNKj@#fMtu+%HsiHfZ=zrT00ky3 z--KA2xW2`5Qd53x_w`6_y1Xv4iW(|yRLgMvXO39a@M9UF+UwWo)5m{0qf#A$q^cax zV#vxIf1|R-ApyfhOr|g{3(3Ft1N5v#umcmD^_qb1Y%K^X;gfL{m^FZ38(ZyLc)H;K zUC(xc|NHdlA65Lnqel<#@PBXQabDYXDG_S!5d3Z)!LNp}=A_kuN!A0w9dP_=3#HG` zASKCVj`U)Exa!}K^pI(m3uqWVcd{J zXO+WKT~=S?P<-4-PuWCu@eZO8savnFD4fsnOr3@95gI`8O9G>3Fowwt(cyl;2d_zl z&I!$i`-(+p>y7NX>9y3LuM0Xe+LU}$e6j`kdh zhfSoMo$u?RvR?-?($^5GNL1TjgaV0nQ4xpg{T)opi{b`Z3^}TW`KX#Ny64 z-*Scf%Oi?UpMW3GPf;Q&8jEim%aogm`X%=OWRNaUCXdccIxJBR(m168=`8#EP56cC zyF^vr#D%eBrnm@A^4J^-zb)d4-f^Fqrqv_TR*^71?`9JT zU!&;8jy6QlG&E}OaD9)xtMBa9>Sl_6?Y+<46S)5;E0ir!&ZxLAsKD^ui-^8=Q=BJd0i##q}@St*0(268DBNQi#@r+PJ#4huo@G+cQwY0bze0T3U z%^?q+g*U?Koapqe9cR_e&0#6q9s4}0Ytt?Dd4!H2j3UhU#xU-Y?$EaW`WG=QD9KY{ zc#k?yK>)qf~)3W{_J$n44vi|e8ckBO6 zJdX9>#;4cU02V*fDV%M1H=y{`b92xI+0qKQyMX_jTz%xaAr>8&;-88&NN&-GGKRc% z1TQ`pnPt+txkhwq{J22b-I5UW1nU1OP9ko}@8bOT=*gp_+WGIJJN0hUkyK(kCO1XdJ+l0(6tKM28lsSej(Dz{CqFULU2U7jro#eWK7 z$M64@@16$$80JVP@f&@U+mHbLU)+^nxnV81jaK{rs2czC@E=c~-s%6Fc=RcjV?wD> z_g&xTj2tR*7Xo94%2vL*CU5kl6?EPy{r;4`77q!Va11_=28Juv5I`%}=QA)XG=o3C z_FVcFpHBKeLD>gF-^(lhM>ttf!~)KPTJ-;uCyyUh^#7B`N00CH|4lp&`(KT+3{EOD zEQ0ch_ANMhyC&bcl3hwk)rB}}EJW`_#PYvM;`NV|tgQQxy6iXXraYdg*JdI2Iwr28 zorB^3WO^2i3Q~v0V(K#%_wP0<-|)Jn4@|^8M!vhIl`pD;RpIXZ#*tN*zA70!?i$Y8 zJU`oKav{IP&56zBjSkx{!*J#nFiAxaLL07SnOQ&ESvrnkvRdCT0wA+= zo-w-E?vt9ZewE%Z$=jqK+C#TDUribWKB$_|*$`CO)>CCel5gES+K`W(OtP*ccbjHl zXWILlo?8&45G!*7&FhA{#H64@Amz8>3GB50OQY!~CqQlSe@74hQ9b{8@{haxzZ-cx z8756Tyt;#i%f)690cqn-?3_f;F{8P-+TvLrEl_snSG?Pwh3?NPG~4pJ!pX@s#4$Jh zWDVvUD=4(>!={d^d<#FmO<<*2>s?dBj*s1;`?byJCb9fa%XL0bguj(F@9rs|PU}C* zV20*-%uv?F4rpHgA3uKd@M&fJfAsk9@NWITiRV*Cu&6GJyD2W775-8cxx8E1?^gEk zm0d|C^Q@NY=Tnj=D)*40Ys`i3XUsA}*Dvu3XWozNMQ_LY$|(?0F0VJ49Vv-k!2~YQ z3MH8%SKTl+>Lpujn>>wRhAuM-Gqg~J?RQRmPj3ay3Br15QsYoT>Z&1V81rv~Fb7@3 zY>8&?S-v{3PNS_+*b~P>;JdL#6B|E+42jDdhTbR|zM%r20b9a{PoA=T)y+R;4VnWL zWLt-cxBiXrJvUalR<)guRGNFt*1)}XR$Ui|_fyb%aWiX16QL$nn?*?hBdTvQkT(JP z72u~DB5K)}Y_>#E9wW-NUirKAwy4N@Ehc9@Z@yF2j(g5)!&Q$x^x}9#p#^0j=CA>T(Ff&43xQ-?Ao&F`g`jg~*GQrIM7pq| z5|=Mqr(W%;DmmMyDiU8HL!omB?G9Ki+&a^vP*TF%h@$#E>z2nXLWf+X>XFaIc2-TkbY%Ikden z{z=q&!BP9=MoslK-^dU!XikHNE1pw*We1Z0L!G$Og(bf6Iif2pAerg`Kt^?SP-SEL zW0T~KK=AU=yMbM)e>*GtYjtov*y31WQjgNIP9q|q;YzVODcvs@^VHFL%~#skP*@v#Zx9ug=~*fAQ??PZgD1-l!>naOoNhGs;OF&SA{Z(2Bv8 z`Y=M%e9)3vYBs*r zC9aj5j=#p`tu9_%YN7s5-%elEMYFhS(y1mAzo)sm;%$c4#WW{Xs-jrfG2#JHy3MYJEvz&oZE=<}{ zI;>oUJ`DGS2utSD9RC&(>cKNoZ*xcc_N{L^_f&Q_NB(|u9Bw=s;qn`Fg|gYcrd>xUe4tU)mqSwf3KFzaRX?5a=E5`K@NQ+4z47 zy2c84ud)Ko=hM2r?&s9jmtD`R^~ZgmR=3sL!&!Ch#H$y7^Va7Ve5s8_=wnJ~hUiy4 z$N0+~V0@e53Af{vez!4VKC8OToOYSg-EHVb`#HdHt{KhGPp(ehUA}pHar)xj>yuY6 zeh{ao#}!-o|LnzN2ID1R+3}-ChfntphO!H#5_qSTfEWY{lLe|TAAF5Ep$lW(0$;ue z^)CP0hxf9!4uQJ=(zs(0^ya_RT=w9caaPrJ!@10|^e2>6m0Bw89d|#awR zFS~AcWw){m!uw@|kjwhVn>j~zV{EtY)3z|eJ+?(N!|k@LaW;S>G=sYc5ie@qC^%g9 zYCY7w|9zo%PgtC#*`pc)jZmZ*I}D?+IQYKgGfW1hT-kh_B%grL5XJPb1^`$6@#f$Tb{b@lIqOC@L3g@;e@Gqe&HA#&ZT4#dY$lEa00rP8H}R|q zTQ^}n^pv05eLj*#t=B10nNzhp#^lR?=7?1nR+bT}{VD*%Ks>)K-behWBZm#RL`qdU zp2d)rX|P6REdv9Fi#s_O4Ki$EPb$`0y ze_hXZfdBdQ(LZYUzde0;cmL0gJfF6}|0-_%Q8#tnA$WZq1g{$6k&{*jI#3S;cfj$g zt-AhAp~^*YSU5cyG_DplB)`km`F%6ws<#Up+7Qdusn43xJtaUkOgrA4HLZ)!;+$oO zo}F8;!k%h}r@Hh|Su4foEmW1wRIPzPI?+dwh!kH@IG^L0I>_21G>Gn(1V+zb43in6 z!~LL7UXuu&6PgY86{}7PTG)0|Z7D}zS8TwRzj$mEycE{+1-IChaQl93VXnE-PoMf? zOE@$3#1=A;nzM5~X!hF<3^hrrzXpaxuJ?(Bqf~j>LWHx5t*DUREGI4Ur@r?7lM;5L?Yw2}%CDPStai!9^OO<<E; zO4YK#bl7i3N>g7Zs)=^ib;*5W|Eb@Fc5?UD%C^iQqy7%pWY~^{&Th7@hWwq2p!$UE|0&7>?s@b*E&KmR zPoGxtzYm{0yu<&#k*D1M*RgRWBCgDG5^%UGSKsdj;3e;_Z~yz@a?AbWn-u;tN5!?i z+Jvc{8O{lv6$gvTJaC?~IVDG{BVC9u4~Yn2R7(|80vmD-r$mh$dSc~4apOiQ&Gz=zXc5M)?_}=$|>JC<4P1@QRmu{tR3Yk^x;iz^o|rKPnM? zCKcc_m_B`sl3Dvs(6#r`N4}Kz&i;PAeDENCwebray0rVSwT{?xn87JzC}`Bujw4nb zzF>FlrnAs-9)0tZ(TSAMJSWRfHkq0}uAMWqEF3mb>!fuY{hb)ELH3`p@S#Ml-oOlO zvHy;qJUOh`e-96z+};0nBTsGLXd;w*E_JJ(`>4{v$3I>W^gHV>_)MoVQ2n2jc&p#? zl;<`cM!`HIA_USF=qvIbB^9@--7O8@eIpSG;rf3?5}Xm*zy5#xxOV^N!=t0ecl!S( zo(&E$l{~ys@?f|+%|$|q3r-f}8KH=XIeJiCI#eZF`3yWR*b14&+TvVlI(=(fkKGn6 zOF90fSFq55i8rCP@ig4sKqs&Cx8!`$hxmVxsTimbiPmLp;Y3N45}cH0WUf4nuu;WH zhUhhn%hMG7CWO5D*R_DnFf!PT!W3QM6(YHDIApyJA;?qDhEy#{LTL3iC*x%ZMb0`l zq({EKKw_rg#Kg&~{j{Z^2UD>9O&Ff0sEbXyYX<4&tQ8B)W&Qp^vC8P+a~wxFS%4JI-opiA}wZsgtJQd+DfGtrR zgGEfHQjy?f@j$533|}LW;$*ysNi?_z610#$)4i0UIsS+u@BwE_@IUs);7t;*0ZGJ{ zoFtGU3Syj~@nHP?^4(=dC>q=Yr$R-5UrsMUgee=07dSf*|0~HKjHiFn1M$E5#d2}L z|40AHu9JhZqA8rc&r>kRF=B)7$LvEo_Eou$#{J(f{^8D3{@haNBjmG)^@aXYB9zCwi|0j7*`4+i&&Ka~!Mz;q3s$>iX{K>vstfC(TeN`OqEdLZB) z@&sq=QG~8hOi~nq%m4pNkzXfH$@qeeD9DyD zy_^$APmRIV5&??%MonnOtf&aAP{K(>5$ByVOy+Y$d0o6-@*$BmWp)KKvPxlsIqRHT z-e+Xa3#~vz5ED6;c$LO$0F$-2-!jIsD+uK#4xvn3?mVvLr5exR-aT;j@_#+Q7z`$p zi2&*N4sfdgP?Qn?qX?)xaiBX)>X5N|Ej&Kz-}+OWunfjASgl7?8mgd*6E>Ml2E6UF zB%>tCXPoZAKyk!ool7>9B?6{;6IAEva$^;)@;A{HfKV@mI(azGm2MbdCvQoE%&u}0C`MG$JQ(==L%%z zd@2Qvk2d6N%T<;nFfQj5&VV``6%&%rH?fhP^G(2eZZ46(sr1j^w8N8_V^`~MC`vVuqBhvP&3 z*ZD89n>fFSYHLQ%znpJ3;O;c@7+s_ zKlTAbVjc=j$3!*duTqPvk=L~%uC=M`M!}S9W-$17@cs8!IQ{o?sp%`UI{A_lzAzJnRR^ODx>)lJyid^#vr3TmRR~=%?0A!5J zFwC^nmtr7?C>9?W(x8O5=tKVJJ@Avr*fqL#F!&6_J($ktGkA{JjA8+m-=N9OFT}(uTBi{oWerx_h)H{)R#}Xdy0xdAh=z1bsR}4NEdKjGX5`d~AZh9xf;RMv{HEtE3 z)aos2l+h>BgCg{10wASu&FlT`_e#Ag0bATXIsq2F>L(y_v!%jX^I177H3=6@lU_NX zYKsv#pxwta^wHyPylIet?gG$NP|P=c2>6nqj*cca-9Hk(0LmzMbMmPL3+zdiAyoVf zrchXc7%>es!BDo}Bw2QkOt`3Un~>rNO|0UVnb2k#;iH*h81v1lDyc(=io>Z+L*pbw z*Hk6OB!rjghlmD3)avn^tROZAhYPD*NE}N|BuaNAz#v4`GZt`X6Gce%jAWvVt6647 zDP+<><^PG}Vr?uDoc35g9VwfI8&+IYW+Y)aLKH>&1tFilIC{i56tiVS5u#3qylnP5%2O{iO2@wjsLWmnOj;|0e#6Lk< z0IW!az#bo(l#(gpo6tDsCQO8xJko}06RK?iT|mva2qpWR5OH&I+!$ir5sF;*9 zmlIK5JX#uRg;5;v@E#e8+j54gV_bwlx?mGMGz-={6`By7$Rxet@5XAVr@*Y!s<_K_ z@!NdrtGRmLWYz6(RsS|0Uw_DXBf*WSX}%V{Uu@Z1?bpAkqa^EFVe*7mLVU;3$=sp@^%jpBaeN%b?`jd%{^1;{a3Fu;~1k0Wk^ z>Zr@V$5S`5)qCEJW(L%x@>$`^HnXJmCNiorCJCAVLczp12blbYwIkm$8l0E!MK@N{ z35`izWGu}Il^#}JZ~}6M=op-dWA#WRrYWRbJ>42>wQ{M!u_eD4ABbmx( zSZr~`K@5<%x#ihSMu1AT`P)37!DO|5SMRE_8+9^jYd7+Of5$EaLDHC3Cp2(R>I8l0 zG^1~j$=yHg-B`JVTptmXe!cQ6S;*tx^7&jYri8ken0g}Yq^TRV^!}}+vRxW=4@e8V zaD~5RsMa}reis?%5y~Kr8Q60y_z$WI<3ZDyX>TZ2!vd2CqVKvH(FWni|T=w!+o zFA~9veD~do!7X{3&2QID0m{WJZlwSQ=0D&0i9kyc6@Xv_$Xp%zqvRS>k_bohH6O_- zFZNe@+Pl$lo5Dm*YGvsZ^H}zxh}88BftY(4m)}W7b2J%)=V*=-6`9Mmf}C^GmKRfq zOZ?=4jQojYVN0Lmd3C>KG-B?ecH51W!!V;8ae}jGdMOSISjFIZjztU$q~btImIU%# z;jblVK~H!$p6ZK8ChCw={aK#fRr+%8HObI1&_~y-IxK&sEw+D&vCq8DDPD2O3qJJn zw083+VeZqW=Ch_w2QIsO+-*uBPvwx5hqG<{pat3tp_8Yj#St+{Y9n40+GG1*FK1|; z$5L_2g->aA;SFT_)iz!JLyP+2M0X47#r=LglO9HWjOS>!p2g^ALf-rN_*`sK8%fLv z5SR=wLw0y0n4&qM2oMV3JVO+)4ALx5n|sWqAT8>bgk>i&h72_h!Dnz1Mdm>|{|-R; zVG{{kJOO=g^^l+b&#pcT8#3xj86fVTx^0WdUpC zZX>T{0QGqq!3c0}(c)NA~1akQBEX03x*k;o#z%Tw{G!iU$s35-F_X)&QEKn)yUL+mD3EQb}(>c5gHFiP+2cN;~qOThiX0HqcP@j<) z(Uzr3)O1xAygBOIB*zz`T&u~9SbqPntSxG}AL;}2{i`Astr{|9*5oKC=P7>&*bIu) zC6cNEGPCS9T#W;$&qzvQvRGfH6v60}B;5GINmkQ2SE?Y8C4o_NN0JmEIVr`2;%qJQ zas1NrnOl#dppl)kW6=+joJ%yzsl2BoLm#s;7~QH##icV<7%0G!9U5$(l{>f_^>g+U zC3#w*Uc3Wm&x`H3fJ5Xfy}Tv%zVuVCS%y~IQx0@|-{Dac^@U5Ic?9ZfZRrqU_Lu#T z9@h6>>S>;wu;S!doC;90>;2sHNd3lrFQ|V_k_&Oz@EKg9jO&?EWI74>a>U*zVDW4yvuMQPNe68cplk1Xt*vPM3|c29t%P*Sh2t##6`sTW01Wbm;& z1_G#89=UT$rpT!)bxm4h8s)bkEsT1{!JVIaZUSQ%KSwcKUy93T%3QTG`5TD%kLqd~ z+4H+%h|k)Ght5MsC-o_!Sm=L)Ze7#4`0Yl>HmHBnL2@#Q(dQulGtl^bH%IZxzIH%}pNfBF;I5Gp&f0Vz0O#irZ`h~vl(Dy7C025B?FXeAHOnpn=$M_m0h_M!> zQ|KJ4eBboesBc@XZ0fyAr%C7RilG3VV^i-{I!>Ll<8cU(dz*T%(sApY-ICu~?!8LK zr*n2m|7S3H)QNhp((&n>9aG=d_f+6ewJM!L=h)?Yrng3YyM=5~?^8NWI%ii5ami_! zwH4}pO2?^lc03LNI;TRtPwBXI&Th%?F84mAW z4P(o*Gpxmk=r{=hk+6#mV!+N&QvcFa+iovxje4!>cSe3N^%s@^IQO+R>I3JLlEaRz2fGOZ9jXDEPr0Xp(y3|k_k>YhMYp8V^` zt{5i>%z0hy9UJfjMYv=XzDTZrfwYN!ebVm^pq9}&3}t3~*VfV#;J-JiKYi5@Wzi6y zqv#Xi;hIOz+m@o!vG1)Ei&pAo>0OZ?c=~`S!z@F|tjU#D+L%Upmzb!)ZVk@|!Q@9s!jl*cCG=uo6i!2XUNHlV%+h-cJPJDV!HT{EFU^ThWz zPd)U9c!f|u<6>ild~HpAYiyKBy|5x*k*FS78bZDN9Ek6?BwSPf+mPEZzfzo`H^~eQ zf1fl+4*t`3*dHW0_|LvQ;Q#s)ZuCZ3)ca#aJ_8*{QpORP+NV@LKx&_Us1LGpWP{C? zg0$fTcA?H`ldF@sM3t-3((qA7xSUZ};B`u(Jx9#9gZdy#K~gUg#yl)+LcOdnEO>lF z>T!az(_;B@rNPnxM0muZYwYxd8$IR?CedI4eGEA@{a9X@Tc(lqr6iO{*9gCOcf zkYj%=1Xv21`dNL9I#XZN0nW~Emim~$=oyS*GIO#}r{4Ym;JGdSn1RVlqezQZ*phnm zF+((g@fC&hIiA%axzz4t7Gu7kDlGi7a~Xk5uVMd5aOJF>v{7$%<)t9)0wxPop7ftY z5tW`mm!z5to_($KDad<%G6K-YlrRML5<*vE z0WJ~#1s;%E4<<55d86g31N9BIy{ze6fKS4TljOt`RLyNnQNWI-t}C7g8gqa6nj~ll2nEAaF;~vchn=Z^ZDT@(QZJn~=Bzcc zW*Evcapj%14JsdZBeIG5*1c6URkxY9cmk!)IZznD0D^N8f#;afT;|+9%cBL#B+?N7 zd;2)efaoGl{R$^1*AT~?EdSmLCwP^wK$5Sfh#sVf&QOx^UAQmeSZJqJ&N9F<1?T~F zGb&e-4;;Fd$@4Di+fE+@_3-1{1UAyoSF4YkP_OSCNjed(sc&1YD3SpGKVy~=x_*gQ z*yRhXQqM`&pDH>vV9E+&X*3s?{#>fWx65vcZ@x1_JM&x~5N@A)4!#-=b8i{wUk?Pi zDG#0L0n#`-r+nAixSx4l$e14GqLK}~n&IQ%o$DnJJIbanrFgrf^ad-VH&)Ue zWaC$4sY^b7g@@LR{OuTN$jL7&?wplh@(`GpzZDZfp5fp-XxCtDEEi9@~9{S7Z@8A4uh^uSl;kM-U1MSar=a*ai>2BHmtnSa)S$==u zIBcEc@8YRf9<~^Vub=4;LdT)Me1FG)+|XXM*R22k*$Cp{7U%wh<`X&(54Q^eK=I(q z$o24WyKn$B4<0N44-dBs4M6eWLj>^faJw)8K*PDCpNHFp3;;sUvTiXx00>>s2R36Xh=F^n**_ zh;?m2CJ5mm^bF#qFC3lCf(>IC);8^bb`~>l^D?ES= z`g~&^c8Chl2OD8Lbj1cJDce0d0BFJosPhnv5YWg&&lmxq2_>M;LoiN2BM&_z1%$?6 zbwvwk>f3sBM-L_IRIF5deY8APxt{wmP!u@0v&bhEkqIM%)>3j z5&*$IvfGO&pm^}13bgWY8*l|c@ILM)&;>S+84ZeG>K9|6LafkXY)SGs0u-$vPKxm4 zz#0uz)53n^h zKv{tvRH52VW;4F|Y|#*f(ZUC)Pyl=@3ofmCY{-#P6_nmfSK~>C>;Xw=RBgAp+qG!B z8gE`>KZ6rbZl@vuv`|p$XlLVjMufN3X6K5$N6CaYu758qD5#ptcoAcbq1PgG+%8lq zSJ60~!db{#pa}nUiDYgDQN0de5()5JF_p?FT|z-pkBK%Lmorc~p3V_nVJ4NqM)UD2 zVSTuvK0v4G{FN|1{LM<@Xf)GdYL7+?|5m<<14K;UbKGi+8 zFAp11f`v?jNs(o6Tx5T^O$6QV4%!7e#h9W6W*J?ZF@y%u^0QHD2&4E8=c1nlL~%T6raglTE50a{_6#n-9$u~T zOfEHW!Nk^*q8VAOP!gdieAmTIfum7`rWhupqoWZm41-46(>#vL9eX(K{5z1!oUlIn z{cQf4WFpho0^4b&T^^@0k>7o(oX=AJMuk{2dF09$T?QZnFaeNK*qgjNwzmzmyV6`j z`dxpg6JGkE-LahtqPx|h}K`Udu8Uvjf^Oz1^#!8c+UfEYMA$*K^?1~CwEiQ9aS#?v-cPGUtresV1 zc$de&a90=;=NTu>;D7p1L*V<#xW*JRh9VIYBBt=Wn^OA0jD;l4hanfJ8h4U+ZZQ_N zj)i1!2VK`*U$A>j`ItV&yvGNA#@y*pUn@z|!yGbpY4n})#BGm{PZvurWHdHLcdlvsE@Ht z=9p70eytQy4`X3kF(h^LYvql47z-OQb=LZdBse3~rxj1-!Re({7+h!vus{=;QJCUn zQEXpizR-DL8ov>ca%9WhOz^g)!kF0Pr*LL{C>_V*wF)pR$px4JnkOQe3*Ug7*d4jj z&e$JhDu9wJN1S}yk{AI85<8X1;FJu~1u75YGa`<|p*;2cgG}X@I59Rh8{&pbja=)3v<6! z7?ZCrZ1z5@v#4R?yGghuG7kTX6 zkKwu620c*GTMR&Rl`gD`bE`VA2V+Kbpg40JH%h;<+G4>Z@)Ab#7_rHIxF}Y>Z?!!1 za8)=ctgAhRx=`c@UZ5C3hRQ0oJ75Y{_Z7yWQRRc3V{ZG_p3 zTqBAiFkPGDydh&7iJ~0wT4e?`g60T`Q21VQnY%sB>Rtv)yhhmvLfk1^3$AbqNx&D|K-vb8_@{ zVXvI^yE>o`u*T%Duh2ql@`Z&x)ipw`w>ISJqfK8AjUMu(s%)g#fvI3B+^$gGQ7*aqeUf>Sbdo@aC z0C!HIHO(4(*d&XX6)Bc{pQOEIsNkA&%Lf>%J%(?1G5>2>CTtee?6LiE4`b&P+Rxye zMC@i6lPUb;ekD_Zm)T~{XK*TSMRe%QIww1P!nrF_y4q*nH#qNn+&O062J=oO+{}y% zme}?)Z~L)x%)CwJT@Reqr{4D5Ic8qlysL4ttEZ7WWH1+@WPM7K1c_^(*%f)Azyh4n zcWU0D>a>ec!p%*RXA8oY`b;7X@D~h6DoIb~`ab~Z;|!%TOzQdTORy*KDV{v4D#m8+ z{PWJ_&Z!)|mAc1HaCwuDId+4=6_?^Exkkpm53FFS9S91RP9X=1eXPt}{jCU;m0Ixk zy=9iA?D*hdfwN^k9nZ+>pqfpi!Yb7#`(yAUx3ZPf1dzI7os|m%(X=E z3gCogFpejZJ@iqyb{`A|lgVTX*>dn5FpGiJdPJ3*=D!C3$i`rvEyt9Q>>M)ofzap& z8G@RsKOcw!5zOEeGV}vX(|7t0Q40W-4&$wx!>w^F8OoT22{fVNsu-P7sT&mR*)&YX zh6g8J1DqL-w}Kk3^&>D@tqTGtRWX9(&W?;62RA^~=bufw^@Cq># znU*P0t7=A6-ksFHsX!d$6x?T8r_U%7S{lae0bu!T2?Qh|S34`2yQvvq57a3CjN;W8 zT$yztDH_R&0L~t8+H&S% zO`xcbZ~|bo!U+}^$l`0>9VBJ|&q0y=J{}BCVxePsfq4A@K=5BDuU?8fqEza?5O}N> zc6CW&VY`)TK>6WP3Aqu04@)epA|bYVatKzsOZsT88Xm9VDs~I&zk~0;zryMF-yehj zBDo+(_l`!F{mrQ4_dVl}{lVbgJp~x5?`-D%tw@nCB9uWKGwB8UP2Knlez^o^R*-(F zYa%jZV@0dbIA!SO!IFF!W#k}FB1BmRlW3$a2p;h|Mn=i~!Qf0tHp?hU7V+B50MJLQ zl{^7H^n4_uT&$!fva2#!P{MMG7+90s6iyHkBV;S1>N8}j}t`U6vsH@ax6gq#&R4_C7W8Esip>lD*{#|(%b#Y z&vJGOK!!pUt(DAaOgku~4M$}*M=2P51yU(7TrB88MW7G(ARg?Si;9s#Qp`Df9vNkR z_|NfwjsNdN4K++tO89CeY+6RNvQP?AUN9(ctOqfEkBU%Zrus-lc;P?!xXmeIOF1!; z8Io(nZ+eVXKW(wx3L9C7r50@=q3T|J=@b^{71&SISQ}5exI+HWnk=$9Ho;jmy_6-b z&aEoO1ZeCk16o*Btzj4BEQn)KcR`}mADSAjSoqInC1nyqsqU{abP!m4V^R8=WJ*~J zffO^1XlU(bF4ZEhb|##`L>{_Aioj&dmXinkKmUx?Sr-52c=6{%e#lVC6-6LZy-+BD zc+GVSN+NOfqlgi~v}|Pzeie&^XveAveMGaISH%^v>Q1psaZ_V`E4J2V1yv`5-n3x` zrf3Gakl7TlJQe!@zCY4OPMJtVt@;54h#HwoY`biU)-pv)h4+x;fm#NIVIiyF1-OD$ zjYvhJm?G5RNnF!79t?iFFil%29hOxpz0Xy4=7<>3snxb%2vOg)F1_ zEXye>bdq)3|ACy4_)j!S(1($pc?bJSWn3y0NlHWd)iDhD$&k&zKbV|g+$6$YHa_392#Yz=xs@<1TNOARpJWMWk8)BDRtl1e}2^V0A z!e&l!9lpfXybKo+6GXcyIL+J=l^CpbrpDm6ON6BM6GFtrUCV+1?oM=9)<5o3;M8Ae zq?#FVon{$Ie0PRdIEGZ{Yo~8Qg4lxpCMb8#zlMpnKzy?rYY&0>`Dlsa z)krij!i?pJDK-B#T~HVap3buS74hfxgwVbdQzosI2Y`{4FoO{@L$uNuu2H0XNQKYHaHjDVR(vw^`6Qet zqR9P|($OV${>2yf0h6Z*V{k5A54=$jkq>HLpdFUNy_P3x+DmWe6va{sWWVUWC}--p z=C;yh47XKfwevb_f4g||=IY(~$>rs*Z!VtyF8x`b#kTHPu*_{@F_ig~WjM<-Ior}0 z&d`#?yc^zCDtT98^9n~7AX6Ji((-MIkx=USih!e|@!|N8ufmw`p8pWSpm@qxDJwi` zdf}f^nD8AA0Y``9r(^IViAC3Oi-XMPc!mW`zO-xjBrPX^>KwVqOb<|UP)OluPRUA} z9iyYeC!>rQe?C3fm*=LX*iKRQ0ilFb@k9)%AZIXmO%xk)+NeEdie_TFDh)SItQth4 zCl0+mL6LM3Gp>VStX-qFTS)A}qKE;Zo%qC(TADrJ1qqF$3Z3%t5SK(1qehXs4uJ`$ zyBalZz9}tJqMvX@KA%g5Bqhg#!3a#$#@E85pMVcgc+M%BaV_=$d@yiDl%{unSs=jk zu|zN$yPD8&@tZYM1DiLSa^vfVHPnL5-`q?$o&q5B&E`BI+4VTskhWU`*Ih%GM$>ZH zl!7g`+*Sbvjalg-@25_TWvf-`JHF&v8!groWk^JFQeS3rR<2V7_EL(jG09n6SX+G7 z+*dyHx1yf=`~2OT=^tp8iO(KLzZS10XMFR=Z53^mDZi&pf^nYl05G|iEPbSM&T$U@ zU-tffy=_}r9EJDax(fW{tR1V%q$JyMTCJV^Zr4s*Kh1|<+fC2`GGng5iktw@26D{jc4xLk+3K+i2 z9Tc-0R~{^Ievu4Tw5cwTZ^ln-JB5Myt5Da;ue=(4>q%iLTvuc;B#j+U@Q3c9f`my=zUaa%CHts|7|lD&NU%5SxP zc|~v>u3Rw{}SOrh0~Xq(KftWoZ{GBW}j0rh0hs`(cTeXV%FL+4sX za?XoyNJ{K}!BQ#y<0K(CRa6_{YX+IoCEKzXT;?jqb6D}QQ_KZP-vb5S z^9Wy)_h^EzNntMOqjg+B!%I`y)qbbL`eIA2~i^Lu|SrEV{;)a`e-sDp;5(eSip2NiG}%90&_ zEwuLwXg^yE?fpF3&z7RSuhD+ik-Vff6%%RzLm1*jTa-qQ_Uzh}6o;mvuID%ukZ9`j zi8g%8!taNKi}y*213?4AyQ)Ta%Yg9Ii;m)J$}J;6+@!j#UE9VpoZ?sz5`qVs+1mv} zm$2Dh?pO<)a-K2P3N7&%z6U(jqCTbLOpd_fV z2c6XeqahBivi$bOqi;uxCvbp-s4!>rF1q?C4jk6ZaqllGMdNImESj;lP`9I$3F8HJ z`tHa|vyekYITLYk&y)RTab2%3bnkYoOIfzxy7waMvmSkMv2$i9w+=O{)ycFvImDc+ zD>}`2gXz6Wlfk8Aq0Y(5=0@u!r)`UC+8TAarM-Fa%gg`chlz-J0#c$T~l(igE%uTYjRm> z>xHC^#DsCvPa7C6XC^cqdoZ9rdWqAB5-Wzo2_DdH4}~;TUbu>iDoczaW5Cjs1R|Pi zaYX94oW_Bc&XuHW@8<>AjD!S!t925i#j0R8nMF~z|9r3awU#Fns>yk2IE(A6lO)4u z`8Hk2O)jHy9J|;3OR%`kT#GDD=+nIYO=*)llTXDsC=bYsvNk%LO%vm|2n&E!-7=0m zP#oDr((G$VbI+9rV`haRZ9LXzlb~GQN+#{!i%i;DUAF5NWV_u(JB8lo>t(!tUdG$) zE*0|nTFBe&tbzP)0r|aKA-|hPes3x6yBhbsj%C4TiUk|XBxnY#ppNM>_gO9GnpNGh z;#2OpF>$~3lipl!SbBw15bsJya6mM>>e%&MXk^#kYBi7LnEybTu2w1@L*ynuipwMTAkp;t5@F(*>gOXevZPXzkUfF<*Ppxxf?t~t_a zwRAaGEj~T0nI?hcQud3gya?Uq?CVMJl3LF1dDH z(;)oTKQ#b#R0vy3GB>NIE`_jYLBxn;%|W+&b93Wkz|v>wxErZby!-0p=;fR9m)@>q zpq~_5SaaKO?m8hy_(tw_c${h(f+}ANaHrvHByMm@TGnkLM<9b0b^IE%+h~m1hv(?z zyp6s+JU=<#Y5jb1@x$AnF3``1XJ?0RE>2#aqqk@1=1lZ%tLZ_d%%@6h3!f1)2x z-W=~BLcuIeJ|qxd#!^J5U>x*Y=Y-@Mw-I&9!8kw>j>j`RCTPsANeaH8uD1)0!xm(+ z*6vZI?)d-F;EBlx5kzbjnk~@!im9JUo9Tk42~iGBfEJ!!uh%=+--rMAdcETR`@QFT z|Iy#yKRDRm-QRz9@E^V1-odkH|ABgIw6*dx;{vDu(Ytk9#m;>pkCV!O&_YOxBx9D& z2k0bcv~6XQ&;VWUws4ZzpMAf7;P+Z#mThH#4$&*E-8AX9N>RF_-H zz%J(q&C;krzgnuAZd*&G65R5dSsA$syWMVyc|rzA3kj|3!hnBn)_r_7@HAZioiMl6 z+gP&x_xcA1h4sJR??0~p_wsCQp~5n_wS`oupetw{opg_mwIvP5;9M6F&I$Kr`TyZp zG%->#B)e*DZMEFrW@%F9(8s0Y!8{G;zuCfg_dQm3tW&~$ku+KjmdyWygWY~%{_j2C z+k2e<_woGsXZI^~O{W9!&5(MY-1J{eC0T+A8KAGapFXu(vRLbkh*>H%I;l=Uw3@wd zKg%|VT7Uj&;+s%gv5)WYjEbF;5ZY)vq=7)~D>84R_IGdJwozMcG;OpUQ7%yX+rzWA z{P%yiJ00YG`qTn+{`}L^aSqE`kW~^0Wk^YQ3@)1I>fU)8k59%iv#(#OlNI9(pem6# zfMZShfI0D{Qsj)dtR4?tk@*1q`6u$P$Q*t8)XGv{Fr5KZ3e?VP<6P-x$&kHD!STY^ zUZ6QhvK`q3`iTCRF+qx7WpxsV=JgGsKx?yqby~^by504rO=yz5F!Q3>`Cp zw#hURbBAc1Vo{W&G!`S&#!2Gm0}XAZ0s0$nyOb|A=dAC=b>_(xneU({$~SZHqGC{r z7(G!794vOaUgdIBYS<=K%dMMoJ=0Y4bq;7h%llS>ELg%KHlF_|m)kr+CX7psgsixa zZEiN^cD2tl8?$Zi{$}Iq8?0A7>ozy%zIIu$@r1kmbgP(bYfiPs6Rpr>d6KO-#hOg8 z1ygEcv*~_B4b{>HBn@XT+?=4{OzCBE#y#tQtLy&(PHYyWW)^_O`hUN_`)t3U|L^ba z_aF8D`*_yS|D8LUoPcnX^r~*I=GaCqNBaCI+vMoT?xW*~4RMs4T*Z$r47cEdQl3)` z=CkwLY>@tui|3D7ZQnpK4b(z*C$(;6Gc7byO>`o^lqD$z|4Dmrr_wdBFr+-4!8zS< z7LJMVn~j-D9_nZCawEsd^qQncY?|Pdp!R?D{oTITYnONadOq+w79i~2sI8jpUiXJY z;C?$#*1EFojnPV{P1PN5Mx}h_*2ctoersA~S+|(sku3- z9iE=(Ao+&0!wEGNnv<}%2@VT`01IxTOkpWL;Xh`EYO~(it(?y}?aiB^$_c zC+zuqfA?F5=myVK$~O{R)s()$%G=Whk%nj%3mVx1d;Xr^Q|{+^jaq`yRNk?{A>d)D zQq*M`J==eN`qW0qI=T8S?QJU2f^>1VZ3s0@$(VcqGp|X1gV+fD`6rBA9S-QzCz~J` zAe+Q!vfo!kImnu_G)Dim=kMu|Af1A}4R=kCaG+BDLd0rYrI7PmUww4}*&tG#?gTQh zL2LvTIAY_c98GCVr?a?fG`{+(p-`>!_c^%c=7U3-_Mh9=zx2Fse(QYo%m4Z5x34~Z zdeTPQIr5;7NHCo{M%(Qr9AKYC-1fO`Wq-wIb^EW%UD(w3>pzzJf9>`6Oa5Q|-QJ`9 z_dcFx_Fq`$FD5CQjVEg5DW-ZFUB0BO&f;MB zZYdL-8NXp0JqFD=_|D@v?-SdYhfTO1A;00>`8k_j`bM*4;?CqJl+Xm*NzG%nXkC6fuviVz> zz@;g%%}qFWbMCFJaEEoFLaE)|VWm#7!!?gIE;ivbXBXGIWN2%vD-`{q{;n zD3&ua2N9-Iz7e#)o2BZy6DQxVPIPATqhf(JlbpA^m37`z?B~IC5MCCvtIF$<;cIm9 zZ-q+Qdm>k?%#a_^2-E0coo7Ejt39jBf9jH-4a$G}`_G;i<-gv+{-gYNAI}Q%pJR1V zDZ6zdeeFq95c(xKK*Iaa3B@o>T3}pnVe*1cQ-r1uJ*qMNN%buLI|A zIw}BjjXfjO{u}T9jSs*PE?2Bb7wC4q*$5yRFbgU+G3jaMI)?i~&YLt0sG0~4flDj%2xR1x zGlIl&O9BH9&C+^BB)h@XaS%Q{J+UdbT+?rPkJ1dLTd}K&&NHtqq57--rN5oBRAk@u zucCeO)Uif7Fs&idhusx!O>u5s(hDwCo+9rSGfLD1db;_mcU5iu$&d956z-5K( zyBx^ecNp2C9;ClP%yAt+gc1qMRRrZ!JK?CUhO%91!^8nqB9QZB*Q7E4X)N;4I@z~T z#IQKnFMc=80jri9{3uzhVy9fJ)txGr0+C8FKzjzrbwG-Y7xRQ5IM0B4$<0N!4HgD- z8hxsvwACKIjAhH!97fx&@R0d>We=H>iwxxOTkNc%h_jxTh3?u>ggJ-R=2rAPDL`A1 zuI1{B9gtQh@10ZE5;q`_k}<|(IFZl?T28VwSUoRZokRXr61HRoxIbR#i^1e}sxzi) z!noC2XJnM6^>SOYSC7J_%Uw<6?v@=;&jqu5a3$>53bfn?2p5^I=Rm5l#+h~6>G)!O zZb7T&lu|8K6U=`kbCd(!E)pV$W?Ya|9fhQFnQv6h7I)UGNAHr#XLb2shwg69{@?GH z<^SIP?xXyFAI}Q*e@B)t+#ylB9B5uK#nl>64#~DMPH_=~AZXv&i_GN^>iW$3D)3#` zDYs{Cnpa|u8%bSVUM(%5H=O5dXs6q1i=GYz*Vp#4SO@+1kc`}1q~}J!!?8cV4)P_I z(KZ)Ce_QgdN~*{8^GknLU;h=;tg!qqwf`LKJu9sLyU!o}|L*5mVf}ykA%WZH3Ri6a zqtqJ=+%?9_is(>is0*u!5kFGXUy8qp7^?UiMEg`~bU zMr8~JG$qdVULu`8USHf6WcMd6>ww-+%7>ob-=ys9c0~Pc3=tpAb#bWu_cm(3Z?E4e zYza4-MbRAnF~boZQK^_D33S$P{Y(^eC@*9i5_4`{(BUoxXD83JMy0kuMsag@A?0XW zlj``*xhxBou!IC1zjZRor@yyO_73f7X5a$4gB!g>USqqM=CWW(ku-c_K3ZP!3L%K4 z0*&bIs*q1&?GezJUmZLxITV!q)@gCgyA{XYMsdiUkw#6FqQYOr9;`$(~aStV&MRzKwQ7Z2d4{gawm(^=zo zjU`XMsisq>D&>)beAU-mPo+wzo1RjK_J%%}dsQ|k<>t&3c|xK>+NQHeP%kUwTzsPM zTD!v5m&lQ}B30E2t4-Zj2Z3DLC)srve#$cHh2Ep-|y|0{6BXO9`irn%d>*~Z;yW!2k32c z!M{d3U)Zvm8tUglnOZS2Y0L`8+F zGg66-xzWry0ybWR*#+wAP6RZj*CaM-#f+0wr{J^Fh7&LAz|js9G8jH;N~tq`F5y-`Ew+ z&_LKH(GWe!{jYi z9hIT-ihv(;`*CTxpQYuB%&S8J-#9iWS;(vyP<8nPhtafLDgg{$s2uOPiCZym@`-0l zGbdjo@77p`C|i7ulf(oHIG&dhmlue}A^EVV))R|#z4PSK>1IGIpKUgXlcgvnBBkV- zNZx`t#V92>oTC7Q^{~;b%t9vBsfy#?l?!+^YIA-TqPC7$4BzE*#uj5}`xSAuyX_8Y zM6gAmWb)QVipNM3%yBAN@?D z2qiSQLL-`Tk=7eisu~mIfsawPUP_$R7v0mb=FJeLI1bs=5>A0p!-+if zEn^YEaURsq69Q42f=Sg8@%ePfB6~UU6403iqe9RrjE6Ghz|suyvmDbfyTVQhH^%D;`0=0cI zLb!s3Wm|B=YIgY~Y~+Ub40WG!T{GhbW7M;_sp%|m;c0H|PzYrWtK0t#dP}$e^0s3)#wQlD!3)%Go6YlynVW^z z*-}tU#cw~Dq6V;D#hmi}9`befZDGv=hO>TDB1&-|oe3Ioe@w)WWd2>srgBwxZ{Xo= zKUt9T zUXO3b4C@%^OI)>BaBs-{<9*Bw2`qYQZ8I%0`{-%zwuw&C}c$C zxYEm;-OSbZU*opvo@#Y*xV`oQt{G1!m@4aCO<5S zEBi~iS6+E+-c_UyQ7Kuf5plGXO{IXT$E9*U=cBcJEr}Hd|6HWDC)*LbAt~CHd&FUs zOfc$qI_l?}*_5O-K>ZHdo+U}S)JL61<$b$u-a>gEP+D4p>ne~j`EaHV>JOvn6%}Be zYXAD{&kik6`+wT#qZHb>NYS&Vz%$JYbT3VbtVC|Y@yTp7ib&X)Pi?24VdiPoq}F4Gl1o1(U&;J!>)F}?Nj+vM%G z$nx&^n0oK=S>yaquoREU=Hfs5{e$BDFMGSs9?$>oen4ik^TQf@_ z3uJ*OHa!;{idWd;odQjh!4#Ux)I0qFa0H{T1KiJj^vaoAiq>466rfbiy~Qiv;)}(V z79NqnT3xQCKW&pg;20=Zq*E{}n?2kuqk#j?6ekg3M3wl|NP$-{eA zU;ndg4^4M~CF_6hpjYz$IM{vuxc=YAv(ow>ha|PuL}jeCrdh)wiySE{5{00ArjUxQ zKp7>P`bCzTD6HV6^SkTJK$5L|B8kiwH>ph3?O|?}ZU5SuQ2vRhQK!201IjD1`utaR zz)i+~^m@ho&%4j}ALBpnqmL=aMCf_H zSgkinkM&!q#+`@w!>nfpstu&`ffHSL=?2SIgaz@Z^XMQ(&?&%|^ zwo@5)8}WAdJKV5bI9{;D^k~|aO8zRZdE%2;&{Vraun~ItH~v)H zDG`m4xvBWc;uD!H1^A4h7iilYBxT6tImG$!!c?m=$615ywH&|f>`_$#h-iUrR-N`5 z8ak)GIiC!~Qe9G8L}3bnyHA8-7JIsM6PBw#q%8RDT#F&b; zy#1DvYm##EqkK7df%H#ZD$iwZ(c&PlcVOyQ9z1n&N0tsd6kNsp^4Zx!3%;Io=wV2n zkIzGRR+s;8a2nHiyn+g_)c)Hm*?;%<9`FCYmuCg}|7SJu2oKpz=nG#`7DW(+g~yA; ze#=>p)VC0O$I@OEQM9&;At1YMu1e=0)%k*6DR3uN=EcUBQRHF z?yE`#NXBE(^(D-7qbz=*&}QDP4a5qTD#77NG42O4&=zCJ;Ec6nK5Bxfq?Gwcp^|4G zFB-2_@ro>Ux7H=Hf_dA^5XhJn*y6kJnb{fL;3EuekQ<|tRb z8dvWsi}!8mZam`Ec&|ircPlUwgq0O^THpsi``k_}8S~;Ss~XPymq$0x$LE&%pDw(_ z6u3nHdw#H6%>Vf8+1{i6cQ4O6`rm6g>c`)1T>CTJ^k8&9)6rVZ52BxMr}ddO?ndXU zAn8gPpQ*3G;hC7Mt@IUORjYhB4JK5OK+Mw0L$xA8PVpk7nV8h8js-Y!qm>nE)W$Q$ zM2+g0I-lCPRx9Ah?bo=OI51}V_0syw)z`)K&qxx{09d51JLM8(s1H;nE{;;ITAV9b zuNrF}@#GM1SUb*Pknas3=`zYXfw(1xtJ0A3j*;#SYdIV`We4|78zBs(%S7I&8KUTK z?{;5ZAmpw-ZD%gD7Z9OlQq^-`MfnCynAN%iGF9QUm}37fhMXol;Kpn@8x#hb;Jt=1 z$AGPXw~isFA(#!DaZD#x822?zICW5NX}~dHAGrC(T~1e-V>zMj4vjZ=INfqxxXnCs zccfJ&R!zMP8|LKvU14N1G5d=g)eQY5BkHb_RU_uU|GZ|nTiSnEJZ87F|MYwNdwV7O z&$Gw)k9&F6vj50YKmPVVQ!@U?=8Zs_r5=tE$n9;tB}k!tOIwiJ)Eyaw%H&uCSv$D4QH7qJc>+Tb7m?<8;XeOs~p&oCwdRl-{5PP9ySYduu9e zY|i!u!q;#kYGVVu*Rcs`uwSwl@v-f!p31TWIPe=)1JgY*^2! z?ZYxNjWeOvFw@+rNpz7)^5qWA?d_sw$nM@Q`ngRr_wwA*{s-Crmj!|@^Z$BQy8rjt zUhgsf^Io2{?0@s~|NpDa8~$=PNql~@A9V6gJ-?uZJ2LYXiMg7Q4{C43#OFd<)8i|L z%-a55E|f=auSajMvW5>c`rp8)^|^h$ax3S9vMPOMPcOxQkA7aC$JVrT&)b}(X;T~j za-7%EumI?nZDWEiG#>4B?Msy~Zfjivpby-()YynoFS^~O3FB_2*R3rVYF>Te{#?~! z^cOdp%}s=MHGJ59TC^BJuviIGuWC?O$efKv;BL(ei+lEv3=Qjv&mjqDNbDVVL?R}4M15J1#&gl0 zS7x>uC%(DiD3_D_ip)JW^31nI`&#X#`H)#$-}`T{RX6a`SYvIru)-ohsKc2st1jGbSJAvR`e%(Ai8`70a>{`H5c$La_3l55*hP%I#pFFmyBy! zyR-{cw|ECDi7TwGx0K|?-7lDnEBmv#)y*aJiYr|a>Jm^JUhmx2lJ%FoO5OGgW|!JN zEn%4&mPiWI+~tQwUo^ z??}pPOmsP5P8I)J)oH7{km_yNLQ0tF9BpULZ*V12p&#ukCyLI}TICAlkIJqY(_o#s zy;iPn;s;hV7FTf@e2K)iyQ*J2Al{{w_a5X2PRK4S5x z*OQCOc2VTBm;S=5cAc(oof))<74t?HMS9>aysa(ELUVq#L+BGNt_uK+wG#^2FIaYIrNHAu%DQg>Zk^l zF4)WX`W;SPC&?N#G93n8Wa@IDiYV3|{2Kon8*jwF@n7Q#O-D7ZFqb2zDd2Z%9KG@u z00sW(-}uw=vSu%6#$kw_dY%-Eq`LLui7c*H0f_~ULtkoP8Ea&t@4PbvEK%ZN=rs-H ze}6)vDILcwC9AiwME>tR+b!Pz+wUFhKg$32@ob?}EaXbXC2y+{mfKE@hBF$4aurW- zaD~T&`>ic>F`*psS(30+aKtAhiooXuO|b|jG#>Aultft2YrSn|?{OTqwopvQ%1e4% znI^P1D*9g?AH9vEIbt!?lqjKuq$r{>@mv1!`TKLZ$+fo75wIkBcXWc{xvTq+ zdWTcWW*nUyzvL}HN!jlt5G|jE1b0=rl>OfFuX(^i(*1(05)J47*~`P@*Dw8PxK103 z=l?-}cW=Ki|9iXr$N7IR&ldWYiWpC+nGLV#FqKlvksSY4>k$3&1Bs^j*S~E~gh=?H z+m+jb&nMlG1-vU*LId87RMGdEgSKRu4%olPDVrs7Nl{#dA~vQ08WM3sOVeA0S?B>KoUJV&!c%Bi*#;DrKc1d-d~^(0BKgal0^ylpQ&4CwUY(Wq;>vmLi;3H!(dAPE!K51WpCvt(NDa+xPq5{JrI={_gp^e(&$9j#P4q zB#2}Qf<`Qg*o|yR;9*4I{8$~47*@d7m`3nTYkqnvYaRjrmw+V%G{caNMg*jGPJ#^8 zEp#{<(U=M<5&bB!lG`{9Nh~QqQsh1#(J|pcNlDa2xG84-yv_5)^ zpJm@SRqbQzBf8X69$QNJF$<;c%0}W6eMDzO%+eTPBwrx;O%rvl6ku9Ku8-)_^{@W! z?c26Cv~Xj0Y=3)r)|UVN?{?=BEktF4(=dmMd~x5XBrG&UDN!Y1p~0jp|BeN%!px!) zuxY|#5(|q^W+b}Ivq~*0iYO(j+#M<~p^k8Zhcs$9r79-NT63)VQ#BixPq^DprA;*8 zj&|VC*_R8w-qSCO-PNNnS4e?Vx!OC+u{mDeRvTszQMpE%_#-+(#@)ba0Z|S{2u?)D zmwe)1s(lS<#z3`r1}TewXG1>|K`yKC#7UB}B&A@|wMAjeF%Z@m_Z9HWHu55>P4RRf z+##M^U_nN+h?63sP4RRg+#Q}Yh9I3=jJtub8ZlSJGacff0?8HdJp14|}GhvPm;@GbfC2bR)*u~^^;ow5)e&IIEDj+TiJtFE8g zI4HG|JhBE)uKaqaItl`X5LB1zY%kpN_x`>bE$i_F5$a`{vUDZk>CUC5O+72?Ld~GA zAiv$Y;I^sfZV+{+0s%hrXURClA<057)N!O-`%VP9p;3fL%x4f_QW-xprq?7^cK90t zZxl$d8YrWNk4{GDGCKfOEPiQ3Np-MDb!%dhvKxeB1PFrR0p4@L5;YAK#t4Hd?`OJ7 zv4Nrsi}~OWBwV!2ku$>k2>grHweOts&(x1dbQnCMs! zYA(_lBV)=%I!8Jt;|-n?jinziF|Y}xm>+HCAu%{22lHuo<^pva!wgw%@l5C>Nz4lgT)0DZ50w-7cH zQ?oqMwGfHr#8d}Qa@%KW8XumXSV?)cVK=juD`mxa)iKt#?@k$b&kb?f){C)h@)v`e zSr%p6F%vW>9E>Onm`_=E7_o78x7Yus+k4*af8E6i^_<$=qp{cb`UhQSS)a!Of3U|2 z0pX~Ms7Ajy#bRU2vGx)ir4Bm^o;y5BV1&1Rf(up50JGyeTs^395bQgmgGFScy*3A z9ml$yIZ;$6b3~Y9J2PM1>UR1&FKfgyV_D1!RxDxnLR63iUg05$?n+yzYkG|%jm_>_ z%ML3dpo)ni3-cB$=QzR?K&rw@G+1o*(HMY-ml`9vT&Ta0U?4cN7+os6z0VU8_?$!} z5G>8tk~+mDzYg+cE*BYeKvHcc9&U;=)<5Rj6lW~s3FShf7VZk%C7I>&5IdgOHpo+s z)}>hvWQn)eBu#0U2ephR@=h#yE9Fs2l)z)o!ep^I`eTM8IdCDuNdmYnG@~}d0RByI zKyv2|hf&0CbiAl?^0no3j!dRH9g+o%vKkFsR2&-A^&R05q&>CCa)F}=mf)w{!L=C% zFtnw!OH~V+N}?HGPnKLXGqv`)cy8WuPJV$}*NV^Lh2@qD$``0#t@yaJK}89;>!PE6 z71u)@Qm}Yzj3`ygdtM<;6_bAG#ZT^E=d%$6XSb(w`=@IQ0b|(9T>am+w+uk8Q;SrX z#WulxCGuU7xjo3Sfl_Q4byRWk&!?sK2ZrpAC6pDN2b* zDY+)#2v0`{M=8PK90jm*gubiC=c431okBBDA=K6`py9i``;{TGX}jMpzuRqhP&*>= zSWMce-$QLKQWlT1Y+G{u*UjYq&X{-ysroxe)dg8kl|3|SqtaiP4MeNrJ{VDcnL9=_ z2_P^^QgRLc`8FiZkk*h-)%Vd-@>P3ceMyhmhXqUVm~74m^Yd)FoAccKJiA_wnbnZ^ zL4>($o_Fo@de{({Rx)l)q?pD9i33u-P&x%Fj#N&wufJ_?Ib~~(Re*yo5|v|jQ?lFx zmfAKXZarYZ%H>0mL^eZU9FkPAqWp{7cyEZzm5U*!ad!HXI~ShSu%e1@%1XuFiP3f z8iy_s8~#oLp$CKtu9E3vFenj5S7kSTBy-t`SCqRU100QL%7xPfi7`YW zVVzMR)Lmt%F01uH5SBpftP%R~`6Y+X-Tni5+=XRHei8TZxk1L9yJWhYT-GSll^@?Gug<03&35$Buhi>p z{)@ame-fhrbFj6|Gw;S7C-hJ`BaSnlhzYwf+orRX`siFLGw<9yS-)*>ncOkZ&kkBL ze)*(LmsR6uiqvO1Lni{IdT+sqPp}kVm2V|nkPI%DHY?C7R<5$QR z#r4rA#QeJKROev}BlKEAIsUegtbYArElXz_PcNHw3-Y#JW^>1SQkV&(OlF`f4To*a z@hgv;O6LA~hs;SOeLr)q!MFvOa~y{$&W+uw<91}AY-rsqkDtZ!GmoLg zWQw^HNhU#MxtLNN(=uowB<2YjNPsjRw-5@m;To7g7*pKIwW{KhC`S>47@!tHD3sjXKk; zwzCVcbMZ`ms}+*r%pvzs-IP%xjp~buUWVlgR=0>=fdirBZt_8-7}0pd(y5A+P>IgC zJ4osd4awVwv2yc^1EPTq$)L4m+0x~>tz0IvJily7`qzy97IKCkxg*iqLaOT;Bb`rd z3pwY-+04@Sqb#M9xl}}zN6u-p?-D`MvDMON;&9x(j5oiZFs||tX9x=PjzzO6$se5W zpp%i|y|&lhL2ff|AO%~yt+;AwmZXt)T1p;g#pa3Af1t(2TvzBM`USJv9LdLx%y>ydP8|N|O z3+Q%sI@i#z$ow@<5*ov@k%Oh*+q{Mfrj`P($XxsRRybqJk2J1BLgB9t-xd;Er5LoR zZXp-hErhI8DGQk!r+y@JOG-&g=&(d=CReJTbtF0@8b_SOoI;LQn2R7`x|#ZDY!5qk z5NA_@1f3Et0o>piCgoVxRzU)(I@eDa=M>UN%vH164VtFBNDc01qq~)@G=HPeGa%E3NO1Ot@l>f4TT&}0B z&7WT9ded|``MPQv!44VnXJd*9!uPe8xcmYdBV$Xb|D`N_X*Hldsm zUQe($Z!cb+`{ILIrvesp7LnWBo6_su@69Q_{u+0uG`u`z>3w;(zC{Jb=42#Sq!CL4 zxpOjZ&wJE%r!r{BH48Fj5Tcec9FbJ;+_32+u{vG@l8mD1TwjI&8RQE?^`hP0DNyr8 zyA3@5v{1BRiuz&$Ps~(*FF_R2*4L-rZ`pZAJ|rv^$N}@>$@bN3NCFW-WpkB2rWuPJmCYJ@4Cd>w9Wa(u`1dCZJL4~18J*&F9r(`IA zB4?r&dcm#7Hl=%jsNf_TNwo^6Ho(e|?B&~6eyjD>S3iT#qelFOqy$l&SefX{P>MwO z|9$mUtL33n?38(8lKZn)`|Iyvjr9D8-(_Fp;8`1~8#O#GSAy8cF~<14Os!L%$}%q6cEGr>}d zBi>C3XVEqBByzj(@1B=1F1!p8HO^fJUXz|w6o)h)ss!<5AD}(&de;+7|GC$N-Ru<& zNGvtUBbLn7?YRFLuw?!ZxqI!J+0tt1av_?E*rG>NEEo6TmSLHMnIY5;5~FidiZrPw9DUJx|*#_E3j2+(~xq6IK zqE>YpqnnfpxH^Tik+{JrX@!)Fln!SiM<9b0<;X1{7vmVU56{ubc^iFucz$xe)B5@3 z;)l0CU7(*2&(03tT%5c-M{m#2(c3r2Cl@Dg-<+ej-=V`d|3p8YygA-MgepVchXnFT zuoTfLZ0COKTqlPyja%zIm||&wA{>urcudfkT@!UkkdSmrx!NFc9JV4lr6xZ`sXP7` zbc@QD`;_i~$vhUi*`|2AHkRD~)PMGDH-G<2|KNG=`Q!aB_whJMUIs0M0xZZFju(!x zz)~y88_{-KI7#f!{=UEO_X@YNlt^ej7x$@x{v4q4(rHR&N zQcqn*1&7h0?hv|)*^R_&1ktt;#oFj7MF+5F(pZpjO2ynqhes#Jp4l(N4x%Ev{c6Ng zLdP+>B6GfjerGi1I}&?JZukxoDIJd?pehcP*)){ONI*iV%lNGclSHb}#>}~no{u6W zq&vl2kko$4=4gusk}3v_OHa%>5xmO<4z6<3noh@E*Fj1a@OF25A9nZl{Ujc@uE-pm z6y#VsO=Uk?o~35XL+V>f?42bo&s@dQnqmqOWF&Ps<6Aq@vovZzgO-QL6w_#c0urV) z_@9t)33rN9L1TZES`%*WgSOf^J74QG*9~?Y?y#M=No;zH-`v-o%71A-`Vu1Jr?>;*i zd_DYnH0+1ZNI&d7-~D>;*|UDo`)2>yX#d&pVAwwh_rD%J>+R#`_&LVUhoghwc@Ka6 zP48g$o8hzFZ+a~o;6FfZsX2JP=U)Gti(YTg|7Nh?_j_OW_74u8J^$u^w;$+?dsxq+ z`R|;9+^UU*^S}SRf6#wcnE%iF&z?Qb|ND5hw$T6R`@7KhkTpPEj;-zu+uA~>U>(_! z3NSCTOToP@CS20!rb~BDVW3u zcag2FlJAl33ql^6&J8j@5`CWdMtOo|=(;u0FTYh`>^e{wY|q_y;AmfT1=;2u(@?L;`@lNR(YnP>JIrhV$px)lnyZP`-IWs(qsvA_ zgu58Ha^6|3!;+Wot-poFK0|jM-SOUfUESu!II7G^K4n$4nyY66{EQ zKJ$0%gJM8Lw)QgxT$M&?%?l0R8!?1oO~I%Pj%BX}TLicR-jXUMg?vkm7O7 zxS)Y@Jl4G8TuLaRWTlKFbB1L8o3CAW>)>xobd!_~iB<}R#CTMP*2z_S-Pi(Inq4c8 zS`T66iM{|K1MEouU$BgMB{G@)uB!98ISoXu6dvLcA<3dfaXRMcQ2w)4bF#W=i^l3| z*!*hbZeeu`lkq8V$||KNTZ&LhMwzK*G8_6jejs4eZj}YOEAW_i9UcXUzEycjZCM4Y zT*XGYR8%tGO4S4&m&?nS+jKgesjI3bju7#d5=k7XQHGroq%6vz3{ZYU>MFs?dPeax z;V(`t?PFT129Xn4g^>!SFg}DjyV(#zVB`Qor2*K~%Ap;oGPJ`nHX|M10VggtzN7D@ zyL*alYvXp*=gr0L0Jt2N<*)t#7Xm3yc;gujNmpGG)ZI!_;z@eac+>9r94i4d7`We8`c~s3@wVr!^vyKVOuXxwmF}#F@o?QXDvL~u@UXs#lEQn`D zyQ|=9$9lcuChM38k}B)Ktz(k_bS@ZZYYQFD#6$|y`p%cUWhh6g_0LhZI1y5a1&70w zF=4aNc;IuEa^a=3^4fNb7J&z3lh`v-^}V(Qv!l>p%P0%kGNaTC*cZ)F=TDrZ=#X=a$99TTD_aG88(WVI*n*-~?EY#NqSd;+u(u0) zxsn~pE(CdHvjEc32!G1a&^iIz?>Sbgs5gL@?`^5NcItVm*w{*Rbt*6Bs0vi7X|pLi znqOxc-6`4=chvnUbrid_)0}F$$l?iw89z&u>!EVp)Vc33Y#w|x1y4O3apvTL)sbqK zQHT?lY9sXO`0!LxPYd(DD&r4n9KKJQ;8R4#dR+&Y>n*xfWA`YG!(EyW%Qm7V7NL6F zHf`zKAZmAHm0JVDR@tIewq})fhE}CvEBCd|v{kh%RPG<9)^{`_9KB|Nh-C(eG?-99AXh>@sgm=4`%>Ki6|tD8RLM@~F2M%kmLH(3 zxNPdoSzV3PtDJncw(<+D0|Z9TZCAG9G@BQ5oDV*q$H63JF`IFz-ctdBt@9R?V=BP* z;HwLLOzu`bK$k3*>!Xr#-s2>R=Fab%lnNq$gMCR~JHD)Vd`}+0Cg`H`|AsC=G z8;#@=TTPAu>eUiZdpOI#Vcjq$KDF zK;U}C#wduWTskKD9j~fz#NwC)nYB^ZiP+eq;4_(Krbozl%*L={Rlz!@Jg5i9W`eH* zFc|~&WJe^Vd`(%)#(*PTRBEs!=K1k00z1M2%i2I7{kMXo%arP>KD?&!Yr;7m%avUH z0a!%jnna*NPjKpl41mm9L8MnSCZ{PG(GTdtSnnlU11uUt1dIH*ZDIxKNJYvJ(W!!W zL8s(jEGEeQVMJdE5hCjao+ex=ks%e5R~=5tOsaWq$i2^xZ1yQ5t8o%2(m7imN@N_U z6jZ8(j4T?G(=~H~0PsvR~9{fd3yHp=HEX+RI8|oFjh;E{((0;nFy40N1K0Yk*H~YPm-B3Y{?~4AIEg92F2LH`xgd*^M%q0oAdg-BPVg{pZdbQID;n(J0ZG?F60I_-Q1 zRTs?H95N{TOE3gCkRm*mI;|)$dv0{9p{k~}uB--8z0nE~%$JZU%}9R#I}jb`EUG2Y z!GuhSG3J8u%r6Z@IaudabQDU_P?>EY3QXU$O~U{8|M|a5q!ST0%V;g-oHFQ~Sj)0t zCaKfKt8+x+Ae|?=A1zsLP<4=});8;7mKudUaW@0C4(T6i#+V<#{LYW$#?;9VZ|Y>yh)wf`Tng0){lb46bh}ap`(+@z_gh!tf9a!> zku@ak*mGS5F?9erGpHAhB3j-*TSeZNyyXGvQp|_&3R*au&#E6|fsbiUNr&K2l{(1Fl@KBa|sK#c?YC7HWSDVJ(SwTWQwL_%F;RP+uzP@A_sLw zr&C#K@jXP_V6%dZMbTW3Xr@AF#fx`TGw8A#lIt#?Okplx9_+uqTy(^sn)GzQyQOni zhwbk74;IzVuyp^_b@vXQ?MrI%$y9lS=2da~x+rHs(hbQj*D9r$+)zxXinbm_>C(A= z>C7N&jMIOSSJY_xVDHOT8Vt$5G$pmnBwH2JWTdn~tyIGYSyT&SPyhu|edczZw!(QZXhZ`mzb^NLkbv+^ zuSVElY)&MS6CzSx0uP6D=1NhS+Xgc zroW>R0TJOSs{`6??3~cL1#2PwNamHmuE@L+pi{mU=FwpW@~|Go{J!K&UD$*i5e4|P zdw%{(4;V+oIYh7%MP)G|Q-odmtzf45#y?P7)|7||3%S{~Y>%_vRChRyY;WZsW}Lyc zn(O=-xn|mo^osJ#2Pgwj_6~HYa+=a9PUi)OoJ76N&vgCL&#ehnu)sGiUrJ@Nq4Do3 zQy}K(2)@6@$r{E#E_b(}U<1sP*loQ;Vbhaj{KF6*E$fc90_COK!pgXIAAm`cu{RlF z=ttHISg^OWFGUH_0s80}uL>~vf(Qm;SUS^efDl;E>=!5pZ^~t+b9-PqopaC@`rqvO z{e!Rlp5N>4?xSh=%&uq^=+uzdELy7c6epD{nq>xMfvOsWGP&Qpy?8l5mz8X(4dC?y zT{@{Np1)ay7j#X4vsRvgUh20?JAt;9IYPw?!JJ{K70q%*I~DwO8xw34u^Z3Wbv?nn zA@QWZNkWzA1P*mPko-Kkt%3WB#>~qANgOk>RS;t-SG>&CTAw>i>kZhX649mHP(n28 z+DS}BI9$3O+{TGWxrTvr88qhMbPPFr>@Kg~7ekv&pVe38=jnP6D$JGVlnXL*@=wRS z!Wq5*H$(Mj97#bs^VieP7?IhcY^vZ43z6cOW3@3wZ0t5)1iTy-l}&-8V+sHzZ?KW+ zsQzdm7%anFSpz}sSm`WASmo=tZ-l1v_p;6R>Wj}O1N1TbD*yk# zxVo^peZ zb4D;E#?L$shxUWq9F-wLhfyfd8Ee9xhJuuFZp!42Siz>D)Ph2(2^~)mzQ#1t$x<}z zf0`RRVx6_hI>uJWKh`f*XO+|Xy~@y~ay%+dRLZ*u$s1`rs}5ZX$$7l z95rEo&CwGMdze_*w*LKt6c;Zh1i>GfpMdhB)op4+Vy=xQz~Kz(0(dZ89XN#k0=yb4 zC_+vr?CfybUL@?LSY7GNb({{2r`kNLd|gz$O9-q}A+p3Q)JnQznQ>cjoTil)_ubpK zExT8!e6FZH#A(}+!Lr)L*y^f|9KA04@MSxNqjK6_%HHv!QLNmh0y0Oh8_~7Stx&(; z96mL6kW7tOn4G#{0oiOpgYdm^Yf5f2 zO=SzPjw?%)ZMcSPnOOQ1Mf94)g!3Jg5*$+br%w8WQ!z_)aMUKk3$pj7P0u#z>E=Au zTzAU>;vi5UseyAUixh2?xsRwu@wbF%0AKEi6i3G-!t-+yusGzP8c-aeP`*T5zXg8@ zw{8RI2}vmn4ct@sbt`~^P6?X{1Mx!rycNh1rqL`V7n79m35!DXoqBI4~257IRwg#8(1JqY<^TZpVXYjVz{{cEsVql>I1JtkV zwq^H9hRuInk7Elhtj4nW%1z)eW!lw2HelP;fi`5^)d4qT-3q|qmG8b?iFu#hJMZcR zx{`CsDP3dnw1R2Cf0Ot_H9nr>+LHA(xhbDrwuks};F#zrOZsc(ng) zB_>s}(yQFgf20jmxtDOVmSt;D0qaU4V{vwHRR*UmGj&a$<=1fCc41{-rSUw#C9R*k z^H8^)o13e&>;kK8H=-jF%!7#hz}OY9GX9ko08pCLaW5&@%ZFsdQn+RlkEF_~anJU8 zx3LVTiq=fh0dw4^WLh{YZz#(;F~9+vCNl_z)tL;sHCu!J?5lP_%e60cj2DiY)Z8?|`|2}22 z1gU>djxCuJ=7fkAtJR4Q8k$^rdwr`d>Z$no$Y;whA!4>{G$Lm$*mM>js`z90$DyjN z;+!m3!lQ3BD4G`wuKu4Z#On2>M=xkkvf zI=k#*NSgq2Ic6d0ZqZnf6n-0gJRFA}js>-ETr%bQU+*v@2`XqqYPoIw1xZ#S!~iZc zsg*iqD@7K%i+;#|O9;!C1#D|h2FoRVF;7Uk$G zT$SalC@q~kHa zE-eEV3)zNb45!`hmTJ(`y`z~IL%ufyM=&~bJEklT?wi^b8e9TYtkP>0PE-JxKxe;^ zlu-E%z{S*3BMU>SFP^$~D>gCsxzSU_mKXc1sFLfTw-B>JM3>W2EjpZrBmh64Fmzkf z@7=7aT2o!zF8WTceYxa`riqdhkla0V7RD^(1x{HY1*h}9@afb^M5%IQW(90wY2%1$ zo0DJi?SQG(O&>Bq{oTENyRI3;>xd_1o1=_C1ro}ytJ6;>o-{aYZJ~TCB`Su@vo5wJ z5)Nm4K4c%V_nGg`(~v#gK~HVnr@xst3k@#h5VK<*+V0sjts9OuYmb6gHg|=j3z=)TU|F^ZwyZLiADw8{_CJC1iE09XPQj zjFY?*a4=zv>m=<%B5nwY(SPmrdcB^vxBL9y`F}4#T}r~G{5!VUf~;#`HP`toOt|`8 zcT3V3beke+EKXJAsntJCj{-Aj=p4e7Q1$|J4xOiELU0HdzZx8?yyI=v0aSF6bUrOb zX+E5rY_h& zR5^5rPM(HSqCC`%(r?C}@*H27=59qAtAD`VXP)+YPrVUM$qkO8?p8{;NNFHE4Mu8t zvMYvwUd8O$+Cp``wNu?g{hqJ>>vebc>v$|zSM8KbxJ_RkQK8?l_NP}kdmkdh%mZMovL<(k<(0vyTC~^eE$EPjxk#c)%spgvQk7GnPO@@}6i>J- zT7*<4ZnMf0{Pf*Xj?YUc(M#Gjajy}k)5s4a<0&;;Vsn@ zXPpYkh{hz`$z80c3|IfuQM7|%R%#BkD@1v=4uG*9#D0_U%{aQ*)=BCkv^`FCkzDV8 zKHt&FV^cX`8Km!je7Pe(qyI#26B3^b99-q^a4O$LxNPXuuKb#XM2*~`a>tY}isP0W zDkbG+m5u1{p)-QRpHnKx+c;>l7(l8Smub$_R4J=K_%)HuU_8)=YlS zb;F#J*yEBcH=4V!6|a(%EJnFH(t?!Vb(bvJok$;pWPAawXnzNH|G`NzK-0OD-17TQ z?jU7Z$K*6sQj~Gzl!FD6R|&Z;?5r?Auge4iXB1NXFfn&-2Cr>a%xhgtiL57KIRmqs z_qUiFxh5m9lZ1E?f{ycGR=4QVPcDFZ zs}RZsaBm$)xd8TGKA5r~Q>-0Pxf(~`Rbb_!Ms5>bxd`ssK>Bs63-tW7mRc$l{{aIOcO*P=ks z0?{5rK`Tt}4>%Y!H`om#LKk=JzGFg{VP6OgEg=7}LPMAJr5qnx*`0?QA)4RamW7EH z1gOVA(TYIP63aA+7QH25Zy7I|L%Ctl=-sfw+F_%GEd0}o2w%;cX&S|_W)0syinYG^I|^m3 zZScXzv({q%fP-4=ab791wZL(Yv90$P+gdw<_Z#3^&qy1Oa;@+2CPQ88JM>qGcdhN+ z#)4k8gOSz;98;?-br^=mp(&9Cq~x%*)r#FZ`7qYpr{dmce4{KZV=*bZX4k=+5-I-j zWpLF>tIDG7Bn3kenHfXXLeMdu5}x27J16{w4Sy$r_zk^gF%>M8Tw_bw!P6&+zT7>y zJy$f_9Rv$Y#W5tYFjvcFh&{~!`VDXdcgO|UB@imGHeRO|FE~u}%`oZaYu)J!R)rEJ zow)#L4A9i#oU@LUDmoLxZNZ^KQ`l}5D-52*Qc&RNY!(sc7IAn9?~1}+epuX+=I&Ot ziocDc`FAOs78zF8K4FBc2&agpbWCIawsx&ukfeb>dAs>RO=EE$u9Zox?%;Ph8wB;HOUlki`+Kv+`6ZgbLfdqi%btaPK#bs{%$sv0vgN5x{0pR9`(g#5JCJ+xo+AN6ZOMMI@^A>V`= zzG4gIl|k1tq0-Kr<#jDP#LuKAM##tbY9>I6c*;4~yEu14AO zcM$mykVGla$8XNjHk>y;+v_Y6@m=&*;B$$g)uu{vD>^1IxP+LVD)YPQtDeo2qnHU4 zuxWw?tjmzW22^ED6sblIG1qcIE%6E}fnyKW{6&iFRXmO?vX*8n!E)O40;XEbQp*{t z$WA$pS(^z?NjjxqW9CJ*`J~`Mk$oP>&&q`2)E}Uu3695#eb^1;ZHYrPhKM+Ad`vPs zg{r^JJIW53Fd7T_OEB~_i^MDH&5P(s_Z>y1bV-Ljx6%sn8I5!Z-!XZ*%yjN~0D89ybOp%Wl)@bS8lM z0*^TyOQs}X(NILJu`WoB+m==I64ST|l`e^|)&^IVtnLjyKzd77BR4=H3$94& zQ>Nb=iVu)6`Ro6Cd_p2+^%rfZKk|D*h*YA7j?w-5L0F=)my|ps3^T(42SX3_gtx{ualf%Km82v?Qh17~;DX z>AI$cmzk5Bk{&Yra|`Wsex|GbNam`*8=N=#x>c>4Rbj~QGibfck)_D>Mvgl+E4QhqHL=a=Pz|J#3A>5SS`2pL5sN~S%8fr{F&t|x4SlWHe* z^x=PTq8;X~8SL0JjL>!GGmpy~H;tl2`Dk z2=bxMeM_{H1#zT&9CG+7wXZ@ENRJYAjw$E~f{DDcqY(>eu?ZgwDn&@HuoH^Fum7N+ zKRixvKh+?Rx(igJZ=T1MtaWHPq04tub)lLgEU>45;831s7HS$NU1R8JVU@MO1+T>A zg8%qAh=vGmYOsf(Zc1GyOCO{G^)v#6Uy zuSC@J2;)GQ)T0Q8G6peczZD15>##s-nLjEmw) z9f+i1C$2N4Q7qIugE29UHDCTYLqaF=sY1Sy4$`W!TEc>V_Akzk&)y!Czlq5P#RPfU z6f*p-Zg+coyFlztiRE(=!CM%FYRw@&zf3=KX2&!x^E#)(Pt_Tqsl<&_tPIKG!J>#7 z1fX$5C*0Kt%chl@Ws7dDuvp237*E?hQtj5QREiCz>l4Q&t&5X}R~mXxfd?U01c$y$xU&b|tMusOb%31M4)WXaI<( zS9%A{Q2Bo*h|5@KbaZkwxCDOBhvLc)=#K>Ro`XSubOiqS?&yrS;6VmMJnhXOO^I;OJy@1a`pD*&&C3f4v$nxO)EO z;{3Ft5g?qSiC9+%*txk9L}2qrZH?{x_#C8v?D9V}eSh3CX3cqlWZ5R)!A4=4@N14bqsTEzcvIhuSYx=nEFwIfIXv#iE9kSFT!OXcJqtW zl16h36t*(fuKi|9?omFnP1|mPef94Kz!{D%FlOt4K{e*KN#GLu4CLB1S6z;A)SK}5 z8Y8M}#x5O9y`CrzeXT2^y1n%kf~ngZTq%yay~&kBsN0+UJkir1FTk|Mnk*kTeF@-}PgMLeKa9cu~+x*0&6opf6A~C<9$AJN8u34)S)j z5$-^*^1=V!{l{yk_1j~fBxe)Fl9A7AHD*IsDSr7#^PM=yhG zlG1)9tRATBB38LrX&?g0S4e5FG0tkg03T znj%?Hbtxde{eZ>TVD&ITm~LmH)5VI2+v5%nVm#pC$xkpC9b|kKC;K9ctEsrK)U0mE;bte3pz@>@K2SF7vhov#YM@= zLUTx^fqXDt7}9QnmkUepLUVoR!WcY3L>Y|Amq(jOon}X!LBi6^sDixd8D*Ib&y06P zZ2}zbAXgwpkN{f5_qdS1s4eq zF2mT$!=>jk1c#``N3)M&BtmO|o>u>ufZl))jrud*YK8SoE|#>dEPxi;B=sDKbI4Uq zy!leai5C`0R4`$do>~jt)=jMi2p)23EkM;uPZz*ktDY{vB^|&D9p)uKv~mh>5TIfc zM>x!?xXprCsS}xSPfQ5mhPV-RP+Nnko-bW-fg$3iK()6*2W$qB7bZRe9jotT2lTeMZTbmpgBP!McEEpu zU9;Z_pB{GS=Bv zr&DgZju*TEPM7bc3i@$b&gPT}9(o!2j3e7C#5|LWEL-v0i} zSKsaI?dZ14kX?zV8~+$LFrqgK4m0`rlP)lAFxn- zFveG|jkM$hlX*v;rKIl+HNo2`r$`aun?f8RnJC2=xz}=%`t)4Eov@h=UIX7ey#0jD zP{gzz$XV0%KwHQr-ph$y(Lp#Aw7%`rpz-ngEi$07D^l#90TXfFd{5Gj5ADJzk7 zJybwdk)--xkiysP2^jjK3$fU z4<-bVrB?Y<2<4fIRTDqGoR7y4eiiHf7=*N0U8ya~m6k6?$8GI{EO1j5 z1VO~mw5ZWi2t;V)w23c$iYZ-}UuB|MhI3UkDRNYVDacat)EWk*AUOHRF*^Qs7W9T& z5EsROH%+sP-VJ?Zf@SI?oqSTa1my$cAo6*PHu(QPx$P#_?f>aR7rK3Ret9(Nu@7vi zJ*I~JzrFp}yXF1A7f<_tkMRuN^)D{LS^xCt0DSzY4$69BUGwSFhWz^5(Z%Ta{LC!y z8y|Z(;$`~7p{+zej*UVaKm7!T^2lf`qW=qLq`O%Vs^Dn64hSe1BW~6EC=T%g`QWFY zHa0$f>~b?-`_T9SoJN?kz&pi$c8d1t)5c}m5MN}E5sI>gf(T?4!Cb^*?T4Yd9Rp_Y z7O5IC9=$JI33WUP{yS|G-y(8H0>)4zf}tI3Y#3?C1hj<{2^NQHFJ0LeVABsgrl*7| z)O61sbxEuPzTX1(APOR%Q*WQ+3;-lky4G%agSCBbyj97Nbdo<2sA9YT=!3{|5={k3 zZjv$bSO}(w$r9aecJ{~xMI9pcvUA8!pFlSRFphh9KQiqZ@upZ!fYZ;SQ^wc_3!H#E zD5n7*jgx5(G!ruZ(h({afdAy91f2f@F5ex2;rZczfo>OUM^UYaH)0`5=icyYKhwrO1~u>4W&sE^*E4R zs!&KJnawRKc^)gbcaaZn1DU`lcN~|sm-Ba12XboPYl6cN-|;bjcqVT)QyKY{kE|fd zW%E_2R`j7$MduIxdQ~j#(OXYDgZ4t~!BC}0*cLewjIfBQ210+PL&h}F@}^q$m>FQ2hR0?%;_#ng?&J0Hs^30tk&O*E^dLW?&P|W416G+S&q}5y~~4 zw%6IpNR+TyuY8UnK)b|3D~J(m?j2?A0Fp$C-_i~O!}HPQ+l!;oRsZnx`0Q%fAC3Nb zesTEb`%P2P$dC?hgSt{!b;toFs$C5Jpg7{j`J2v1kz*lE8raqFf9imHFoqPp+6P^K zs|Lr9A9J+(^r;Tn&y8jkb~(*ZhpN7NV6gV9!T#e%AYzx2g|V@oHPg-BZ7w}tw!o)P zcIv8Oe2Mi4=Tn8yhv_K{Ns3xDKPzaW@p6uy5-P(U=yu5*bi0f#KsVrjAu$`h`SA?h zBJ!i-v?*hPR53w()b#J7==M!#_%`EtNenvRUuvb(?P}ww+XXTGGX&l44AaU9$UZrM z?t9=OqM+*or5A0DrzbVC(FzdqrHt{Dx&mcf2i@3xDwVAMFO?kicp?lSBVu=EPe^xd zZht%%@z|Ba(hM?DN1GR&C5@U6x3W{C2HxU8TF{6Pq1#0oQ#pT$0}~NR`1lYQ4)U5$ z4j~6Vefk7^jAVRbk+-K)KUjoWVTs6Wm{pdML=V#WUjaoy=S(GP?UVq|W!}}iQEKh% z{P5`Ncvw(oGWxySaLVhbfT214edpgj${S{PPGkIcYzn{}>)$Jaf^JtJ_kD`p7dxX-Q6LbgWL6k7#LRc-g?{ZB*K~M2k!j&|Fjl| z-M!bno!(Aw_lxCiOFP97ilThjnz)5w;6sL_bnr&HdVyLnWbYt}f@n&61czY|O)udz zlPYO~E>*Q6pgD*7b8p

2cftznY;iMuhfQ9JcSHe*gc)-s}BWh5i5C7f<{DkMn%| zxcw8j4dw?T`tT$O5m&lz=A10v3>|=%5x*0q|0e6kgniuk2L&p|>ugJ|TQ<9-BVpR>I6elPvZ2Qay22p^Zh*9)(P%{47tZijDpy z$aR5OLL!|THb$hB^;`_3TAb8Yn?#_bKV<53T}Yi0ioY%}W<^t~GY#<=hS_WR_tp~7 zYhMRPEOODESH>pS+R9jED1c3S=84K=H(RwxR~VryqhDp*u1bhQ5iuJa&tb&&Yx!*vPt>vkbPNC55PG3um>~PMoP4W=*jN;uUx#+%BUrTd7H$67}?6yofv5s?!-u|`f18M!g42w&Ty~Bqt$}#fK3*MEnE72tDazm;$4@XUHYkP$ib|0=Zsog{obMDpg?EYMpN(5&FPHT+KB|t!`@2T6&L)HJ6j(ax;$7tRa6$v9|C)T=G;4 zvUM;br`u|{u_^^Bj~E_rK-;O+Vq}+Or8L6JQfAiB{HYzmrA}5J$!nlxPU==6XinT* zsA`>q?POh%Ou#tmGh>d@LcVMnXLJKNScED^aHUSOC%VptTYBW^vO!qUsNP<;=(EgA zOa16LHL{GLWfCUtJ|kaBk$F$cS%yRlIo1zOtCsxBPO}bHPx~c?R_BEvO!~@P8@0`w z@W(w>wSa#S_Cn#bn^qHMRU?kmC9mF9mDe{(mWA%}WF+H$%bT%WkDVO$hvv<*I=Y5F zjC(9h(*BFDaB+Mm}-RSl=mV z)aF?>n1QU3k*xiVzAm`e#I}lv;qa*lDelF_)2o1TU>0ufr}yB`1T&=EP&@vZgYd@5 z$+WmEeFh`WaDS9q+ipL91U=Y^NEJaV| zbTF&NC?CqgSHb!P#v-VB_Rczv^PLDamYaT05u0H@Hvz2POHAYH7P&cs6K1^ZlyT<; z|G+^6I{%6~M$vBS8a~O&b_)(z|B8O=pS(XBf#3Qk$A|sP zQq8}L<&l6*tBTTgcdk@I!mXMqmD{O^Y{_Xg1Mnb4|2Z(qiMjEAZ~{CL!dv(ek1?Bp zYhC)1z+rUQvf+Pz5Oc1z(3l&#g#mM32hpcicb2dyc zZ&HW#zq`9LcPTNMs^m;E`1&?X*sLqynX!4ex?BuLL(@RI__;qYtaJUEVcbRl#L%i* z3)5JyY;p@_}WFyTjzBh8cB9vSJ(t-eNn( zewGqjy?e%)gh}vM5KZN~08w{uqZsl9wTiiqi1cl**V5_CX)*ixJPZ?t-=YW+v6{D- zpWCpo6Z%&L`*Oto6)hf@-h+M{!R|k#XnU|hvfas1 zBl>Efi4L>>uCkSvLorKJ`dKwJ<#f_xNlvzD&m{P;4YmLp_yzA4K{ zZrahzQX`4#Bjcq{j8~HNQN3fNlf3^xyF#K{c@Y+N0y8bs*Gy7Np&*({HX1am&^WYO z zrAzSoP{hp>yGPxw&H27Dwp>1fTz+5Rb0huqq>tP9S1D|zW!^<1@`1Z1Xc+%{`>%`R ze}CuY&eQmRjK?z9D`pP`v$Guq;{d2oLWsjf5+d63QM4GOrvmg6AAJxGdZ9yIl?23&{{Wnsg*N7hK_4=BuptxHiB8OucmbMg zcC?LL*1M`u6dOhYI?FX)`K>48LlZvZm&1LQ986_hl}xhcj<7{z18X?YT!V%d2bSQY znS-YI(+ZlImRUwDHB!B;15~qv26zo6Qaoiww_D3|BdE7_OS zmY0iIC-duqqp3>pErsjA#?NI2m*Pb?pB7!eH~=qS7!JEJ!3=viJOJ+xhpt602Se2b z!)E)b(2t6lVsnDg0!u>;v=nEnh`4oBA7VF$%(rF7xXu6S6nQ)KJ!rKIXqx|bUhNd- z{}+3&UOvtLkMYzU3|G2f_Db{f?XH?*Qy+%L`E_X*Kex#?J5pWCq+5f8M|s@me~U};TI_(;eg2;eg1?bL zfNv2Yfyj=s?n&P60bdK^S3fhh)BkxVYu8zzN&oNf7UMs@da?WJN&i2_WAiPtI;Yz& z*i<;MuVY?V*17$&%mz62VA@{|C;) z2B|Yx`?pr#D?iKWe|qb+I00%p|9MgJ|9bKA_3o4Ye~hP~If}Z!O1qC#_~ma!x7Y6G zC?vl0Nx)R^)v%Ukg|z_OVk&6z4A3H|V*1?2wTMH0HoP$HUOYVgbwac zCVUmLI54kH7JDz0wNB^7I-c%JmQMey?Wj;G#{e0YA#A`BZrprD6Iyr!l!h1A6Vku zRtFGnBx;@tCCPjw{7rzC!@RC@ zf6(h2E&Ko5-s*6F+O7Z9PR|@i0mH;~1E693zyETt=>N07zw>nd`zX&6=f6q_PL&W; z92F=T38HDw!vtZm?%FOMAgD&{>v8vl-KCYcj<;u7fj6KNeQ8Gw6>x^@Tf5iyu;O<9 z(@w)`I}L8q@CP0XipXa4Uv<0n_L@0z(Ffb%a6^igjOSG>iKb2}jD-T!Ig{6MNTbM) zaS&xkEV1n@#GNid#1Og7uKfa_-?%WmT)TvqBYQjoV{{qJ5l&cEIrrKHpo(^ugo+>` zha&7^TGe>D;*fUebqPUoLruQEupwCb^e||aA$TxkXE?$nKWzYDymXN)Ya2OuDt0l1 z4ihGWUR!mW_w&EXB}7a6pFxHuNk~zfKv1>z|L)HI&a2}6uNSXgKb`+Q%JXrlkm7Al z=S-QYIGY=(A|u4sz7lvkgImgM*VJ9(GNaJs-_p5B(_r0BO}2KIab{ARq4WUkiUoj} zPS0G1A-(l_GX(um9Gmy73oczYiG9e>h!M!pRQWvR-^uYItyAb+rlvZ{(|W%K2@wx;i2YHFy!GtFSX*9VAz4lcR;fvC zxx;!D*q9li=5UIJNf^oyyUrV08p9c;tRDuDqTC`jeYu{yj%F_vWc-KwdOS5HaxTe2 zNf{2!t3#c(?+9|5VJ8PlD%gB5)WWB#@Fhu%eVT&D7IDScQq2tsqKJuh>7D{-iQ+Zjm3PV@1 z=M9&=Hq5u{5&v92>l?KUhlmvC8{_4AfH!+tC+sl}@pLhY34+`Ppp3vEVmVAIimVH- zDhMhrkS~E{Oae>-witwv(leC(5TLgNdT5A9fc+8jaO9iZt}AAR&#_@=UWvLQEzLmkznBz|TOqjuQV{VxCGXB&)<#y@n8o(W{T9|A06YW#L@EiHN+JOu*C)3@h^8`|u;e5N zBEV(=1sGBCqh~zTk@I#XzJS zl(}4fs!U5LzZWad=GX_Xc6O=+xR`;_s4wO6lrLCl5g9pP2)yf>i9iaSi=4iEy?bC_ zU~MP^$hEyXBIFmFMh4bKwP4NWA0t8o%24E?l1~zy&3_Y()hZSdN=UGx>q7>=M(t8= zW+^>W*UaY~W>qt=h503KSydPP2{r-4BauWHY}O!Msntjl^{F@r+u8yhm@wQacjwLU zT?DQJA9R!J1M%-$a1XqMiTtdf1GyYUG2qR8?9m9ubcR_c_d3Ls z{l^3+kuVVc^?4Nm03RTkQqU!8V0JGW)q?X-w>AD~1K)Kp*M2b6d1;=m8e829@cQ*@ zuJr;En%wvk$5|CG`=H)Ey%7!12+s#WS_ufD! z?aqA}RT2j)L`wj(>^iP`{j;Bhc>{jf$rR5Un|kY z5?~D!7wxPW)Lh%E5E@0d_6^RTk1x;qr^i=^M?b%RTTspd7#T4XkqD9n=rF>;>r7xs zQ75;TC{>1!#>upSpIdfqlEE}QA6>q^I2!%;$<^@u;_~Y3{prs~7nQ&@-@|tA@3-@l z_oqi!hsVv`)!Qu7Vm9|d`?%TuuWxpA|6#qlW;9)@OV6xZ_&p2FWiIpVsz^6hFm%eCvn(>3fwIB# zOD-ORek3TrqQwQ8l)pB(*HR--yk$kmpBuEOtPcHo5NYz;mz8ZSayKJ+Nwzn0+lYVG z#P=U)2W+NFH)VcCoJ=6V=F-D(t27YZ1?sDkql6-|v=~)wDf0#H7*bSpptaKL@aIaI zXl}f%-oD7d9>zF?b_*b1mY@mG|qu(IHDoQ|V z*lgSw&GzUb@@51_IH3bP=Zn`4o=hAJozefC4c=XxpPj!ST@B7pPmeF_$BA3#u7l$2 z{b>#Y#p6+{?xSQr${hqhE&CC~;Z??;zM7gzn^@an98+KwVHPJid!?`mOq298Ba z8yACJCBG@J`7Ed$pB-Nw{(RNHc-u@^Tl?)OSr2eFEdB{Yz9w)4{-6DmHfy4)-qwjq zVzJ;YD>{zAXmD{nyp+odCt-5vYB};N{nHZeI(=J9f8AYM3t}W^Sr^ROngpkPF|Oa8 zk1n0j(S4}D-(kvJ`)RX*P|@8GlS-9ZNx_rD{;-L~M`!(?PmZoiMXiR>0?`iWL^v~v zLLbIWc2I$7xhnRe#+HsKosh8jB5)92j?~rri<3&kJPbobjc8HMy}6n!8j8`;#cvMW z7u``rZk^PMXqgL_Tf1?M3{}ECcz5KWt0dgs4B02Ts^yEQW*i8)EMqiemnRi7S!dT` zT{h45DLpTaemVZXjua(m5`1V))AzqP_dt`$5ah=EYsBrywxh3x};!8RTeY-a~eA-KyR}BrJ)C z1dl5!nkANVsM@r86q@a3UW8ljLkxY$g8O9DwcOeRl{fd~m#$ZOx$N1qY>-0+;^|dD z34;Ctbl;mn+cPJC3U3;5@xdQ+VR}BtCM~uN^-tEAT>MYU9xpj)2i^Qd|L(C zM&{sMv$}BTagA=TY1q!-7Db5C8cmohvQAZ)YxqeQKIy_IUHBF0!js(SUAM+?>GJ{9 zA(xn-K_BMJtWzQ8TmIrSVi$CgT}@g&piEo_5`;pEv{!9q?jld1wX?;k*Hy*NT^2t_ z$e~I*VS>Dc7ov9<-_YW4SKrn{^g>swkh}4+sbx<>`LR%s1Tmuny)DpCu4?BEqC zs!>G?LnwF65_>m@bWy~}LL`^zs$Tr<74{YKkXG$1RKnYpdk)KiZK+!iynUC*h##zi zPgqI?lm*eW6m7T)RpYj3Azp9|sDqZyyMNnj=U?0n?37c& zUOLU^syAW&z0+0ZMeol9kwrI#Y}R=WI?8U4_Lgo=WGVP}6Aw!_t9hyK^@b2Qc%!3* z`k-?h0Ze>E0K-6XR}V6n>h<5eQl`VX^6)#?3uSG&7xbK z_Pb{S6H3E5_5~uT2a>|513G>{IU07qDZ4IRYA?q+2ORb<`&Xm$_ZNes`a2@}+T{#W z_9ok>i7{bse(*s;5qa|i1qxO5Q*0Z_pEqdnMqJ4ZqKbfQD*J)(^W~)60-N=lTw57s ztqo=yQ(LtKo&2Td(*t>aSleIC^P|RFz>+6dKh?ehCHqM3 zZ_jPh?|K{t(j26Z?l55Md8sX7=EWoI-5^#RUzG`qfs@hm7>A)XJ+5*0U-$Ak4nwVd zFU4oh$hQ_Q%LVCrdH*nNtS*R>zTI7g>^+O>VmU0a9M zcIgPiZd;fbls4qrLt3dxmN>dAS8gTI&HHbu3u53S4?aL3%CzC-LQu-VS58Xv=$pPS z8@{Q(a9&L~WqwVwQd*WS)ogs&ld)E(VyhsJicqv7g0ud0)4fuu=CR0DmF*Xvt+==P zNweE2^D^8jz;@c2L9U0-tqz_Y*u~qeS)t7>-r_-%vl-E7LNpB}y^;3=)s@XXa78Cxnwsgqx7rP@ z+B58m^XpU$a&XU)A0+bwaEj)b)P`Qk`lP{M=p^7Pn1cP4e#mXvI81(29i2#9 z8D8B|HhW-e-@$hP+OuSvS<&lU*s7YU%5_^3BQp&)0MPRgrKi|0T9^bzQ&iu3Ry8lX zT_NeV{abepYj(sbJQBvgSuuON9tXRM9-R^jTky(OHMynEp9!MHMKooY=;Qoar;*?< z>&03Zhm}&6Uq0EcGsmyBw`GZE14vP+=Y^1F`IwDvYheN%c`Vy09Mf9nR0E#xo}O>$ ziO>h;g*frIy%{7%Q0G6xZKl=zwi2Fgdh2y(2>KzS(gVS%kDZ;Jomcz&;@_Q}o#MZH zuU_tdx4Xap>ec?<{{G8X-|g(Zc)h#-9oTtr?7#c&yM!`GzS~*3uOf0^$phoyH?9$I zbO3I5H*SK+KL8_nGQMF>?@lXrdh7MHe5C6TVZ_GJQ_B1Tg$PpAJJYZ8>N|vE6jpff z$Zs+N9wdc30{dE77F55idm^gliY&V($u(HD7Rfp4R zE@fN}V0a^(%%C?@?FWYM*%*18H=?=T2B?&kbm!gh9jJ{k5Njs^J+alf17)TcgJg=B z^e`y3TW>Hbg*AuFn@NRHp|hOS!b9l)*7Lvnw4Xi=^Z(1e{oTU+zqh-$`!xSQ#ouolc(SO6vTs?HGgT(~sA^(Tpz<|~%iHo)^!tu5TLYM&R# zZ88=TRanb+PB8R;h9QhRL^@jz70$4a_*A2#^P>;Ki8H(;a54!z%k_j}JJuTcaaOfw z+8!TE4Ao-A(5NE!k1k*|MO6EaR(-EUvZ~T&#_xD&!-`vLj<_5T>oKTmBee@1a7^t< zEn|jJSp#O)MJ0q)RVflVV*8Ux5Cv=@>l9wr_HAuo1qkE`sud3TX+8UY^}W|?sT_8n z)4~P$le0}Hy=SPgwu8=X)J3WTGh~J7jjq4fij}RAtO@h1rNyAK!4M^(NlN!gQ=EGW z5FcXBG+J*lWq$pOo~I{$T-Seij@S$(lq4Z)y98|7|J~hxRb2nQ-h2JD{(FpP37?2e z7%sRl7{|=!Vseh7fMF6u)1HS3!eWK7oh~tlxkegRnpNHqwl$`{Kx0{JHXsr`)S|Rj z&zYVhU-as=!hy9w#BhDk*7wj3{I6+0T`x(e1SfI9>T@3z;%Gey(W;nKa6vR(?}_zv zX8aXAj`Kf_m)Q5!Pt*Lrx4T!E|9AHHcb?||$9Tjo`k2Q3TNs4mfac&0*raHFi^u@a zV@MF_{O4|O?`3z#;-Kik7>?=0oYAl z%jWRI0eJQD<%^da08FT8Z(Ysldr}t|Gja7|K^dBBQasrRpZRf{|2Y%43zvN6(A6er znE!WQ?!7F`|NAfYp635Yc|O*}uI60V8I#o%UAh>i?<82yk<*Jx_BqR@-x25ZMc<4_MaIlGHS^I>;{vQ+ z_WkW=ci-_JivD?V{2$$6cFg5)a*z9eQ zS=ImNOEgnr0nwG5EpsW?kJTlEEl}IDu5b#ccGbP`rzV6D^p&S`R!^vyG?!T_tgelc zzVJNCGc~nnvBWHP4evbNTnN{*SZT&lDKY+ND!5Qm(8*NmncbEPh%K7lc(OSu z21up^b(0AqhttEYpBSCG3t#*aXbWO+9<+EiSX@HJaPOkJn|7}fDCR0qRl!`ghYZWiP(#{{Ziy4xhHz0tz-$MB3}Sb1GrIO5mceYq9T{J}*3Za>lww;c4RUiDg% zky|7vf8y7VWh=_h@p5G8=Wgr+wZnJe(Vp^nf5c`G>???9`^=VIks8Js)eZ)E-nWJw zjIu4AD!?Z|&if0l>ehs(W@=RntwUl6-<`U=Fl*sY#b$ZqYSS*X_NT`fY`LRwuL^b6 zFTrt@`b%&u)=js~3;@}rnHHJEE=RNfM{fj=fU13s1YaI+kR0K-A0c8CPU^?l8xFZm zce?_X6=aj-6N*C^A;?7Ym>(Wz(9SPCbp$cD=acH`tszi*dtfk6B5-3gFyR;^vo8zG)LobqjCWV#zP(wI7QoT{d`VIWwO5XMv#djYMs9ST%vn^l6?BUj(_`RiNR8l zZR$i;rpMjv$(Rgq4<6YzrrJel49oT)uHOi#g2-{bTu;AbeO_U$Vzs#bq|m}~2v%+O z<~Q7%WML=GjLEgM<0^*($`Y2O!WqKV$T%6q=vx)7b4HNV!((DG0AXfOriTCHvI=|e zV7)MU;odSF6LCLl*Lv0sTkP#BIGSC!pi9jglmX?e=pR)Gj)4@dYCtyfoyJ#V?!~zy zA+gwNd^pD6&S4YUft5KKt~9>z5s@Wi8`j`{>nTl?eewzU1>Z9LWv{)PW>VrfI0HTD z^yZCwux6P3bkeAN_lWsLEWPN#~KFlGkG*V$o58hrF(_di7kzEBvgDONtzY23V z4I~Z3ngN2K*h`j4TQVZIB2|^8x+x&UgXxHjfbgBwv9>aQY?b!d%#sW|Y${NEY)uP@ zhxxa=lYss&lhGirR)wWFy0YoO7^%P%N2n+}BKing^b0n6|1wO+Utq5u%NL|U?Rg|B z&J0k;RuN;QF3mBaz>iTB`oPyW%DS3qKH#PsQ!-5L*->YVM^Q+xxC@3_CZk=zd;5Rq zX--nmQuK;BG;a8l=!_SXtL;DMkwQ8PqII*-T8k+vQwxg|gw&em7*E^9sSXa$#7L2v zKtTY_gEj%np);pgk>vLTB5>{{sn}u?NJJ%74xbN)!^yp{{Nr<9)vf}r9T035HTG@L z-GkX)+j{};4C|&(>ZOBvzLdNRo(vUz>{v&6|28)&C8D_cL42yH>$`JTIIVIWm4OCt zol$_Tgy52E{SzZ%Z7dg}R1ulU<*3!LLJCZIDAi<%855>{o2MaO@lxcnGL!J0y-E({Bp~mrTN+{FA0u#V3 zhr=aY%e#EdHXv%T6QH5+!(+9{-1>_>bNPrM<>#v6x^K6+bikP1HtE?+J6QNS%vHb* zj?Y{#sv@BVzt&JkmuhOIU42BRGfbWno+onvL$<-ncsCq_$qz%n1aVckueWYBU>~@6 z35s(#R^N7{=%0fsBomZePpD!%y&ofu9T=H%ix08*Mt$9k< zJ+t(D9FVGCHbQCP6tRQEzHDV@GW{YMmXB~Z6J7tN+h2Ag`;)VZ7(+EI1;BJYSpOL) z!s)MjU?U+P-xyu|iau3)pLk+@H{f$WY}|w@Wr)=DCF=!Ov9X3(W~5A}s#{>5XrV7n zBAgySUC_aJMHr9h4N9~aT6<*JkT|HVZZ zyZ!%h5gch;s9zmeJjt#~P;dX^A`lm%kV5172mO`+P3u{6{Cx&Y$qgsod$^NC7)6Pc z3igxf9LWo^a(y_RFbO>L2TUdToqgPzwJV6S%aY}pgMR%w2a$Q-GS)p4K2KtWzBzh0 zx?hf7j>cq0r4wH9;n)pal-uh4a}OQgn00?~OeJDyr12 zm8nxO8p=u`UtHmge=j0N$2fD=YqaCLrY%_a$r%{`fUo_gl>tk%XUgInaII;15L#NQ zjGYp)Y9;lNBF2y&2AbzYTz^V)2>)NKf~EN)!cIYqr_!w$Tw@%9#$m~Vr_1M<1Ead^ zfeiU-{?ad%ux!OT*8?ZP5>}VgmmV<-ueo!a`_EY;r6i!GODZejA-v=s){cgkK zuQg&NGV$22o81E3VwkcIUL84&?9?uJ!9meJu5}Ii{^?Iim2FDZnYq1>t1I)KlhiW= zk=~hkW;NiR?4=&h})lHKzWZ4FpKu`#XOaOe0e$Fr90m6$IWL&&~yQA1;CCQb-+8Ilr|H|?(-HtmX2dBW)5q*6}YA6 zwNl`xp%(@PcuZd%c8bY<=1qA4WMc2=?d zE-q>6>3PR=F`L~Mc;&WRl>OX>^N2nc2&)rToZ#C z&bIa=%mwxnA*E_>Iu4ysWf@=paea7R_+RNMU7+8f!8&jUy3`*>+~7#yKJkDQ{=LUe z4?g#MzBqJWcf1=mp>Xc272BFpl@~X@4PYfLW1&eAUJowwC+1a|mRI)KW$R1#9MeVJ z#>M||WG&xEx|#ir9Jy_v$J@L`l}7FVUkKUqgYwkw*3XyCq5g<}TFSc?{dR9J8cyaQ zaK-_I{vHt!26$YLXQ~f~3}0~UG}k<;OTPgCp=jFr^Vm3X2C zpHiVcK@0ZL9)1!RP6c)s{!w^xv7sAEB^Cne<~LgAV$@}Wp9WtRPG4UJ_682Qb#5-R zv<9~I1J044?)QFhNRgvycog!WWx4v5RK9n~Z}4=R#sf~bej^JjXlvFhX>*#^WWMV$CS=L=LWva z4ej$@GCTb?n9~j|g;s7|)~?;!+wYDlV*6MI^%EZJ-m6D#k1K}V+9j-N(MEliFNMwE zW|j3{7WE{Pu|5^E5mF(`b2(ans;>Lkr}G}p%!XTXQa28abh!t1U=4@wRnu)D*)^nM z9sa2-9%8+^xX|Su&P{H-Dtetnd0Fi@Y~iTW-Qt;Igt&$qsQ4@>nKU01BW zbiDjVx;aI@R_+qGsFz^xD>zBrW5K))c#DWrv5X^`(H&1z6L+{D(%yQby^RIJqs|c8 zc(?PTIbx&)p3}OS&R=v9xuL1irAmfw^XTSxG$IKZ8=9OW4S9guqc0;s50%L zc8m}hP9@Ye$a6Gn_PMOu8lHP$!~x&UgKn~}7f~gv77kb@h;(P){f7xhbF%n}9I!q9 z3goy#R&r!jvZRZbruuoreB!3y`zSJu8p;-5HFBBXptC`?bSce0pM-4v&*U9kmMyYs zxZ^&ip67IfHG`Ho@atqnEwRPr)ins`(mW6m>?l4(9t2_`X(V?TeM$xaa3$nP82F) zp_n3(0_2?%NXpggWtBiim5c!fRr&Y?O++=cWY?z*E?q?{c@tMrHoCsJM#GVzZgU>j z)a$3MM{x)}%!14xAO$l@KT%jcy1U(_KF4G}mU~h}N5v!D8I-LjrEbYi+6IQGDqp%2 z6lqZ67w(#l@r&W+xj=ziqS@Hkza5@VNB(nj-#GH^dG6pmHmwAidw$P#d(rLPpg8v3 z+4Y?G`G+w(8hib~mzkbr=jOs|>VDCtO>1gJ`fG9?)t& z&xao&A9B-=;!X=2iC=%wK?vD`2#V(w1m0v1CSY|{PQUo7u{jXCPQ=wr<4 z`>#_DV_lHOw8z(|0Gz{=#opvH=g{o6GRPZYS*2 z4J%JUb>33!aHr|X!?r?J70p?NAVbDd@t^4QNW!K((j%~rg1|Xa`+=oJx%0hu`Tqd1 zsh_pbzp~#*HMz&1LhfAOZ#vNKUm#X%=Bs#X+jgW+bI#HLFv-4>$8R3_U_qV>XHfm4 zOr3jEeoU?-Ih|gGj1aG;{U;1^jX6ZerFaH1YFQ=s#wl@N; z(>{rRqQss?*Kl>TM&)s+{_@R5!Wrg_M{~1KVa}Flhu=Jk!gZV4b2sK`MTQ6Aa$G<)VV9aB99JU>m%0e8pEY@04o8m4ex}g!HuOdsE+gG>R(;upC#%1DoYsD}H#h03eq430 zxvPJ0k11k~8J;|TvC9otM|U@Wp(L%hbSNEIZ1@p-oFG7GXDSWQ;<-z;P?c{CIjaE= z?8C^Nb8oP=1&F{fK$mpbIAUS&hJYx_Sv?3X!L6`Ji>=;Z0rCmlF2GEbX*)#BJ$D#L zpzNQm>+9~T8+C4XN2D=SCsJ=Mt&6Nhdb9@~3u7ZJ?1R~AYz%P1Kl&aSTcCU+hKNsx zAI%&K%4j_z#@1-kZty!@8a^1L{p>Cv-No(IO!D&zgS**ImB z=_CwqSfrD7cMiEfqXI|Z^Ujb=c?RFR-tUgBzo6W8&)={AkorT;pC9V>A7e1?binIr zfEwPVXw|_2>scQjbUXkGO~_0Gq<}NM8NY$u9o-6`9Z!+HX9p#S3(wiM z3Rx!6xl1?4_EP!E+s}PnI!(t(^aFo^%Yvd`sPwAm@4~P0*{ce2nc@`C-J9QYL@n#* zo=`61>$Y_Lczx9!=0|!iodiWFZoiF0@Q!n9jpTU{2U-zo&e3PFSh;@7d~M{n%b1$6D!+N zT&_~2sCB{qNq%?i%#pfLs4$i>R-K?ZyybEuNQBewh4VEA@cVr&t3dp3sBhfBHw_A` zEi)eiN071wCp_K(VbM=QV;_^pL?prVR z5v3OGM3r|$mOpzpRacFp(|5V5Hs`8Ox!0G-RtGd*b0>ci&Q9jh2H=#bEX*e^^<2s; zu;AaH4MAU)=bn&10Bm2gf*U$M@Oc(ry|0F~O+THTpG7}-hZed&dKVBt+JUwf>EAnn zdwZ~H1?F>XR4zPgfONXu(vud@>8Y+8&DsnN3gO)uDYYOc&eTlsEo(Frmx@S_DCAmdAp9+MOQXOm=;>etNjQT73PG&oa>m zMG+t=^wGynrD%m55<`69X9Qq)u-QkL+Z|%IWr3p15u?HF`OU~<1pKN8_}?bM=ASt5 z$%CldLmw`_e+5p&*SUAM-ML~iDf;_Oh z2j`c=3<7??z5V5V_gecQ-T?ElyDj=!hJ8uiu)FW|jJ5u$^`^FeX=CvIC*|}W(^bCH3@2q{%<&FL&C%zwlZ%7@0!?sFC zAE}qv?@tit&Y$M``zfzNW`Fn*=(|Q3+xB_`uid3nPc8nfOK^5k#JHSj0O;PR8fAF) z0E3i(ebNE9c=j-Sa+o6EdBH56J3{<0jEn?78jn0acHS$Gzqp}*QEN^Jb<)@}^aB0N zKy2m$xq*E42=k|Vto&|I9Qwp*vWWQw3KOW|@P+|AM`S@(Ez!HPcJ1RaHvl;p7 zFDTWDaDzN+slpIW=wk%D7gVl@=ix9Vzc%-G^2T8F`y4>J&BF@V%>!Z>O_3APmjDFp zMov+I7|;DF5?DBAC4#VdOim*)yhOWGz&QXVgX=@Q#gF`qbBSXrYkgW~jgy~YpQ+s4 z&9~1gt0e}|V#@yOi zlMf(=6!!-wq8HV+UUH_63v$rrkMBKyKXdhzic$?^*1jNyOHf4aLj(g}_d&2oxT}A; z!o)x#e#n~hBj~7~X9=+I+uphP`HqdQvECE0t8E?p!TKhhrG4K(L*%)5#+P^tpwJE@ zK$n3iiXuL6R+os0W15BrTpAf6kp+$GO>Q8rOAVA-(5q^#WrFPHB^URFCO9e7Jq1Z< zDlG9BMnVrn(TqV!;nWE*8*xmYIC>=@wvS;C{^@?Fmi<`+LJ3DCQbt0ZHr4~o6ewx0 z)e_;oLnf4y<5$tRpIom{2|op4ukl;({Gs?sF)RBD44 z95()!hBP1cK7skwUf3awcwMEq$}4>cWcr?_fZu72xT>c@L}V{@-!2f3!Y|2?&QBUX zK$?8`CsQ=_hV=4kg(;;*7PU z_{udejc-`N7vrT*KAa2)S2~T}TtyrW588)`g;NP|-W4~BiO1AK=RpMLU0?)|(y^iyqeYU~)bn|}$QiLt}AxCn_{=vwFg zL^K;L0Bm|_FaDQ|6y%uU7YLq)$eB%u5gwQ^S}}>Rhh?bWf26FzQ9eGS`Ho3YSnk z(=8AbxncM59Np1eC#}kr?rw^NRKvD1rzdU@g6YU)04;4U!_Jy&pj8lc6SOUQSyLG?z_{7`;(C% zDEdyg4e^m<3#VyVitSsMnzyiU9=s3^r*}VSbpA-vI?h0VYkUaS;g>-iFhjZKCf^nn z&}iFohiuz#o8Yy;{pKLiAT~}EEq&1T^GKC^ zdLj(}3w@ES-HAVq52Pog9l-{Ku0?MHj3lWd)n_KU@vI@9(z>=EJ+)h&>>wVsGJ*mB zsCh>kn%>{ap|A#lPd0)^o&a^J#8KzgkV_vZZpFbm$DjbxgEfV9N&iMIjcj9_zmfN> zSs9PemeA&j`o$JhqhvtB$OLYJMO%glG0D>~X2FudNw}gEuw|4-fXEn6soNcfN75G4w8#a;InFX8(4()xN!XeevYd z!HWjQaB*|%G`zb`6u6zUPF%Db1!Qep&gpsgI3!HL(zh6k>ry7Xe6BX z5~_^*_#>11buS~n=zyL2a0+WS%5zVhz3tP>T0<`UXl4#p)9+I84ZHq0I|TeaCHLVa z_nqN*$|I&RHwP`2$ZX~B!jA3Kzv~dm4|Ye>-?%-w*u%py%tOB??_k5p81v(G0nL3o z7Q5Qp-_gqoQwv|-YH%o-fT%NXB=ppzVAKk0=uK2~!eN5HTwJVd0LVoztQXG9bQDITi&jRvlApHz#CKdr$6w<&Uk^TT=Dfov$*lk?xOD=pLOHA82Nh@Qm zK29j~;Vl;u{m_ppujT;ZU}E@TbE@5bd#zC0P&#>fEaSrEmAB-xf1@$4XwW5x-Al7I>=^E=H7Me`p=}mLh{Vf2;l8&fo}AucHb@Bx?3vj?8-G_i26_NfnsFaVl{> zS*E=cQO;8vNpq~ds!Vb&^!?Q2`@74@FLcl5QzoB24}zSY!KCFZkgY&uZctqednv1u z3Et>{V!Tu)nc;N67(&e5z6&V)FMm`sLGEiXLQ>fAtiW}cd-#DUpTAQ*FQuSnaKIPK z^rb_XS@a)6nZ43)c zP4wc^Ob?X@p(n$Oi{BQyv*I)2G%o+QzP$Nrb_@7fA}R@CyC4o8n==r^q}3ruc3wNz z(>@xa|5%AhKEq5l00LHod_3YYUCNs!s#XicGXMe*(;Lb9B2JR>6G`OCLa*e;VcC=* zM;FZLDb)m?%tiuTe3qHRP5n1bq2K+VF@LLP28R);eZ}s)^6ScwL2gXb%M50M$%>=8w8 zmeLTvzPc=noZRK_2{`Bkn@RFw&P{6?IOLp#$X+sw0yzxQu(|S#^EuH*pr8QA8o)28 zqTfD3-Ci{E)^s>Y#Wzl_%4`T-uxH6ri z4sN6b0*RHY-C29PdRgL`90?3h!%+jN^bN(k=e_VPt-rwaF1(@iT5oHzzz*0!vd+-3~}t{f~%<%}+qi z$zK3WGxIxiPRJ8g(vp^S>b#ME@PM@-g1S<-d`@8X?%eL2l9k>WrQE;=(PbN1|(7=h$jQAa0#i??w*em zq0OcbN7B>sAPI>afLI|8FbP?A(|u>+>KvAllx+L%DESn}kra@}M&yqOpdgZ1Oyw;( z&kG(8kw>*pFyq_T5gscpr`K)x&D$Z#8AH?ALUKiA2M<|i?HRw3g34&0rg$)nhtR(3 z=O5PFa&pkJ-ce~R(-TjpU^TfN%!)^|nF4*j%G$vLzZdH?c7NXxNURi0_V9lZdD6o+ zCpkoQ^0ca6K1FuMOH02k_M|D`KH@-}#L+5`-2O%N&s83Tw8|{JVGf3M`9K{Wzw4)V;K1EKZDYV)Al4t`*+QYl{5*(P zf3xrB(HMk};Eb%;!?G@N6xO#P>kB!#1mQU76G}V(p}Oghr(A|PFL~M(?BUjj7uI#K z>M$&w?pO6V z_5BlMa8FJO{h2xP5BfQ)rrQLD8q*&!n9`0VhZhUZ5vo#un1>w(L|mKyPPkEUSp!lO z90w}g49h{>r0Z`tAKfRG2M0kMF;JYp1b>-yWv?#I#zTJ(g9H4LCmRUs`xZC_kbk|7 zfPyeE+SUVweZcsZ3R81`Ki2bXpFnhIz|m!1qoLUk@B>n^hL`uiily`_sAlz0KMdX% zrUQb4@kr!G^yk(|A*aMWl3-hPeuCqdxW8q5rbLCp^)ekPn!8}F)3XtwZ9@B={|6_iHX~U&ooMLrLs(s}vLU0D*S91NSgDGWHbs^Rs{sb|6ADiZ8chxm zU9glDFSDIiDSH{@p#h@(Fv0Yg>ZW`K&O%**${2b!rY%!EpnFhdQ5Rf|HC24H!MM|3 zGK~rrbshUXSZ)NM8up-mnh1nqp@3198H96x+Zy^lh2aEovRbV{C6^ebK;T?`U<}*> z1X|It!T8y9XZV<7&%H-@zX`erUT3)KX1>?Gk6;>l6<9b1LckZMGZ!JD`)>ySS^G7c zaA4>Y2(l`_psu?po9MWIqa{#Rw$UG*T%ar6@q!)bJ_no@>?|L;F zhrIAHF~tD`;$2@f99L`ye25Q$KtsuA#hyDOa#FHx<-Y!kw2LQ2z-kvh*~5IlKotg! z=LKNk-2J(#R48_J)I=RR9w?;AyWhvnC`k7DmMG+3Xv)y=A3LeHQM5s}B;=h%YPYZ?k^FG{b)5VhA zPY~+%IMx%*SijpTm#5-FhKllzksO9wbZfk%f?X^Tm>ofqv1a>aRZ!nMmPZt_5F9tT z(K)n@S$s6us<5Mw28r<(fWi?8QCfR4L4{`Baf4xR*+T^WKWwX#JDf2`J*AALVXB-5 zR^b4}0md)70)Pxa22%`dp~H?K>>$W3?0LY*FQUIB6)z;7oU{s7hHO|lvqIy5e>MxE zAnNJFJbPNZ!X9=z2HwzTv|so7uxxQIs*en(n}xFK;EvP9?v4V&49E5O;i64#9U1g1 z_Uc0v!c$*=n6&0qQS=MvI~)rAzg_*BiA`s}eXZoLwL-lq z4FiG6EBR31rayOZBAAA5=-VCGbKyvT8{4nYFECThH);cdWTrEPmH0jC_AGM71Uhr$ zFbC6<@7Z(XaC85gVGpv88VFHJ^0bFC@+0F%V~v3urojZm%pfKZu{MdbVP~FQB!mR7 zit4Swx-cu2Tw)y^-M}NmF}%uUt}n=e2YPE}$|HgMB2_J7$B_0U7S3`=lMW!)k0cOS z%CN7OYy~Q_3{Y2|HXD>KRzaP3h)s3`P~bLTR9l2O`O@9`r^SJ%E*~kz0*46Q0Ut5e z?V}ee6y%*GmiHS%z#tO^3a(o}2GLhpg9=H;t8U*W5Ls}o6C8+fbnqaHMLPitxN4?> zLu^p9?GT5m$gGXI9~Kyx%fI2QBZM`%F%GDRC0$H4y@5;CJv7cCNbsO8!tXdgry=?D z!C`xC&c5GgU-rncG_{zjQ7$%`uaSZg^FI}zG{O@&d%=I91n>9u<&uCJFc`-mvV!xb zcS;&i9w16kXzb%zlY2N~N_niVoxHzrZvl_}&?t&>D=EG{XIB?890O#X`p0j0f#L&A z^q_n)P(fO{GqQkP3mSBD0zBNe*AC3PM3^|}zlQu*6hI6>3`Su>+1#cLCqIux+%x%* zaT&Ag_{c1K{r}{EVITj=0h@3NA^40OZsZyC#30@o6{0O+{VD9M6N2^+_8r6x@fev6 zK^U2Jl1|O#v+$m16WXowDmv0i)dJQ720`Hl@iThR{dBqZ_^VJe?B$#NtgGtQEr+Hw zp+Zf!DYYR@_R!)BmvefawY8%Y3CNZjlt1u8{GGRgd+^2xDd%FWr!2VYXis7~?aGGo zM|zui;F|Y3!J!=o{K0r1EdM!~2zl?a^(!Y&Wveu!X+rLqIP96u;e!@i{!#1mSMvY? z(Hvhu_$Y%wn%F3}pe001oL>Tg25@Yixi#zKivd9VCRgyyanErQ z$%-bRZ%WUUh6w{EoG10w|FLX7IJbI|G1K^X>CR5fbdyYdrux|bM~7nF`Nxn3ZUW4% z18;F{2f$_AvKtsjb4>~?G|zUVA%>PDg_&Q2==iy(KJ_pP0*;6~RUUzS8s|L&phfEN` ziH`XM!~hvL;1I}Fwv7MAx(YNDtwod<-m?18MHDY9_XGnav1aL&!ho=np+{n09Rge+ zD36-A9D11?4`K(+hOUnMtBb!?oc^kQjT zSsc&V9R-`|$c0oXe@^I7GzYr@P}GDW0VjzW=@P3df-3ubiWf%Hi93(GZe#?ep`>!p*~J`&3ATU67CE zJtsFVOmKwPtNQv52o`)rH~|?-p22AXVvNz_A9NL(e{qA1ao{0``Xya2JC&TvcQfcU z1~GXN-~-py`T>O=j%KN;+gGqck+U_+byFGCiRM&rc%5k>;C7uT$2ZyW|ESYuoce!v z?pwmT;nF(eE^hDLW9s}|k7i_CO+U`*cdA~is^_d0@t*G2t$pBQy$~#MR`0U2WwmLp zyb#34JmlGw;lX?gO@t6WD_py>AfgQlKo+&UPPDX+!>Sa4m$Rf?p5&V1P!2cfclr&_ zFXbq@5k+m@5u&b$caLymC`bUMI~umG?y16_hJ8NI3>>$>%)R!UtV~^~x!q0Cb`_U= z2+k(nO$TLH1Urn-=C%Jg&?lO(CY~>3QRwj-zc0wK{H^MRTADg;jv5QGVmyMNQ%E)_ zfnNz5GlgcN4xV#lYUsa!nUt0C6uxl^4*?>4ZI=}SjBiG@8cR2u9)FsaeSi_ZQ5z1y z4BM)0fMr5x*K5W$#dqw5VxQta@=kRKJ|cWL}*tN`D04pSWC$@ zC3vKp?3NZh)?INg&u^>~jLT|dInArR7&XRI`7-xgsowvqm7o8c{{G)IfWp)ItpjEl zmhg=k&Ht)ESOQ;zu}WA5sy(m^!3I&o&H{p!-fpUZ@tgh!WwoA;izG|LE@9i-p3J0BiMm zh6P_QPXj8Xl3~_uGec99$e_Y#v@8l+AG^-=;V(=L_TAw~gxEFg^+<$`k+MsK4fPGk z(8jz~%I*bCVO6~^!k*R5j_={q2Mf6I$yV~#IPob}F1gSOD68?!Durud@eBWrXab7J zie?L~h(qwMvPr~C7`1j5q1YbngwhnXECY1>J1XS`;<|El#LLC&&7|@Y2ytfYHC-C5 zr&=>5l;d*68Na76t6H6*Lz$YOv5*SYO2F_zRdf6T>SacJ%79PqrP>mqBVMHXf0at( zzdHF_8=PgJ&5C#VRU(Ijzj)DF%0!NMRa?`zh+d0_L>8l}@@IxOKusNlZ;a|AS;Mv> zBhZKU1`|x^97#9K_ai}(z-}C_BSnR8v;d?2tEf??!YOpY3P|bA%SP&O@t>;jh3=v^ z8VXS-nC)iC3>jueImx5u!bi9(WAyL*8|rR?8I!23<{<}_sNLp14~`g8sD0{9oWp9~ zj(N<`qc=@#SdP_U=GHu!q$y>z=OMO|mas`OeH8+((!{0y>R{)l#>puxe+sXI8X4k= z5^5Bi+yL`5@v#pX5Fz1CZX`OtzNZW+G1V$qKXEloY+9kvB7vR{@)5jLnH5LvCqamyz zV;OQSsjh5rWPJCmxp(=Pyzz5HPo73FcH=fC-s4DtM#@-0%0GPi)-ePqNF)N82XGi< zLz#8Kj?=BTfYwRjRwvc}+*(GJj}5RTU>;>qdQ%dT%jOL{&GmsRf3Zv)3SwGs8jk9X zPO&!E5mHAps-6IfMM1hCfdP$~*rC(3ym>rgrN?9mc7R-D!- zS(q6aZt9wv;cF4KUB;~=A*!NpHcwec@70huTJ<%GTCWED&d}mFq7JdXObMs3w}lYr z#|TxxKZ^^YFuwQBhzsAL%1IDi?7inaYYI-2NimgVq_h~6Cl@H zaV7?4^aWvA@RA8p65EZ5t*DUWyg9RN5AD;Qfv@|V$bGns1z-<&Pgu54W%f&_$=^uP zeL;o)kv{^o1wF=oAOYtSL+{b=CRH zurc#2{mI^5%R-4-K_Yc{y!W@BWM{>Gmn4-mKkNQC9RjK?J#}LBhg9BB_^T4)0JW2# zKEam#i!=`@eEp3<#s3WbQsm*k;fmsRLL-HH% z_E0~@xotN`P|CTV5GbVVV-y-IbfR`sRSNLIjV_J=4?d{Yk66J|FaqIxnh6L+k0Mym!#bZg{Ju67rP=i{Nn z^Pd8sVB&pZ0RQ~@OgYx`cW@q%d@TF9MGQIm=%_)U+FX-bXr}_TsoZJNc}lC36V++c zUSyh6Pg_fstnJ#9Oi;E@eBcbJpzLl+@u(xmVwf4z+rR(^pb8V*>4Fj=F(e>vLnp(T%VJI z8+&Ie_%=>#U=vEM=xxY{UD2FcK_xU5%K0DCdz|tQz$UTr*NEAyY7Lf>k2)ZVqc*JV zrj8`^jo%Y-D=F!k7z=FFJ^IqRwa|)-yNb*e72BMU4pqL)f8lU7P)}b;SJA3wV+uiHEJ9Ckl z>l}9t)l#0y=Txj2Tw?P8ha+zD=N;!{*-r;x!H^@hWIPuyS-W9k5~y*vWGX!R(JpU6 zVsU;0Gj4{`CeI{yIDx5cB+=}dsR1RCU~^hh;IN+7yf#WOWyB!0k=JGo%aT%u9(aL+ zCC4hF=7?IqX7(&Z8AQ?yuul~;j{WyUZ0zb}$xSQdVD^-+H+EAuiJ`OlgQu+c9R`gI z!bmEW;E$f$2(qj0a>TW?$VJAPrk@;#btXdSZ6MbIblWufswQ3r2!lW;xYZvDcHrk~ zid#@a<|;GgB$HI{;#1FGhk+GFIl9lg;8Q}Pk2R~~D)OY%i&z~he)OQhQb8bi0fL9_ zb6ySS923}70O^e-)HRO~0IRMt_&53VPv96depgrh#wC=}9@5e&Op`Td-&jx+$5e`e zq8E{AO1yCR3s`Vde=4AVMALQ`uqY)6%MWPmIUpe#)INnP@a&wK!gB+E^<>wn}$ zNu(yE!G}*>TAdTpsbjD9HuiicjL5qB*%8=KeZH5XTQF1kcw~^&p!AT}Rwb*L+c47z zbc|uC0J$$(DMK!(JX=71xLhnE70I+~V#MWLbq5K5N6t`_f-R5dmK*1}X@vak=ZP+? z3b&}UIa`Cs$`RV))>p>9*L>^#6TZ{c?cox&QvnKJ5eq^zRXmOtxt0{v88)!XkVtND z0#jmqf)mLbp4tb<$Mgy3#KHqK?@}zoHP?&x=h3jWRu&A%%v&$@ln<}qN0$PSaSoR&|aypl+hTW z$yXeIwScj2FKq-BTyQQNA1DGe4>-Yi?$;uh(>2Ona(_3D>|9P&(BH4ZM54-A-d^fA zOitRGlFB^5Eb4ziS~i_(&zMggyx4FOfH!H=s*drrEIF*fxg<(pU%HQpmp!a%1kn(w zjv^?5?q?K4CSRugWlpdq60!*3NZFW^zp91Cmm+?E9WbWP4|HCb3I$XqFemJTAysEy zFfJ7=9v(|O#!uITw+HTA=ezXj;z?{m81woPq8zi(gIDLE8Ubx8dnI61Uz%}yMu;{M z2N6ERjFjVM7*Vqb8D7!}QRtif?;jRy8P8}L^tmFk596ztv0LTwbA5Dx414Ar0u+hj zSaOhiLk1|nr6RJ7WC0ib;D-`-4A!t-{Q{~?4mXGBk0C{$5#|!uG%x$tzmDsF^@r|S zT4zo2pIS0j{?m*JHa0f-@FkKQ9&X_?P~nE}SwYkYJ%H$@q`O~h*!7z=#-0{9NHx|L z$KyhwI?H0K7VU@bW_j8{N7T5YN^H>6SoFo(EF|8RlmjR+^&J+%Cr|X@BEJ#dv-qp< zJp#;RZlx5D_&Lm}yLG)1P`uuGd5@xaPJJ2!!)61^14C3`G zG;@JyxcjyU6e@tzq>}Pa_aI>u`XqNP+q6i|7>j_g_E~>$K%P{j9+>q3NFwwk;wARTbJ3gdiC;?1R%lQKY1(611fUv*V`t-$yvXa1@JC=hrCEF$} zfFMGg1qYRT)z z(sKAc$?3MDWC{DJ+3SeO%j{5%mJX+;=HyLRUm7cW6|b<6X$=mVkw_Ot@c*{C{hUUZRkvk5QOGGq^IZ6goZw~V^x zViUQw-#29BXE+^HrI()qRapt3`#hG%j3)`A!J}fQDazI`RAw$p)J=zMt2>g37+1I< z0m78YV-77nj9|&;&g;oyZzipPqKI>WXpii_d@q9-io6sp4SmW6oQtTsIBqT$(WCSPKoE?y0R@m`rIXT=j z`j6D&9B@8bfckqS)b*gI99?!#6a%nCLoI?us5xT6Cp(g>b0+wcj{1wrX-sjmp+@vo zaLnpcbt%FLhIA0(@7Xm*Y*Uo=Gh%)>#%AWd^4wC-h+C|wBMj{^hs|kHVxw`FVXOmf zkEFa~l9?K)ei$nE?0~cll(`>I*QJp+?qW3-V={m`=Z7-LLKVD(NEjw_vwW1-DUWHT zWS)S54z`o>3Eg9g0?Q7ON77lA-UPA`IGSeIyq%0B9tB-d1m>6UU&knj4ujGzSBB`Q z#q;_CKk#P)g0}kK%U@zYgoBh5v*MKW%$814jw}AKT;-2IfA&}?%*Dd#p|Aa40D3@$ zzhpVC$Pm+PVFql;7)2hL10q3ULBYp#)wp%1U3a+XP)|#4LIX%)``R$P&enEn!sxlbdVT46SFbOv z4z{L|y~ftsHK45f*%c?*gvdzv1?{I@FnzigylP{8Yl~#S6#QWK=AY#II95|=11RAv zAv~HIU|>KOR2Q~m&+BSvY~=IUW{WwWC`ULC6q<;o{V*V0f=MrlCI4}4p>7?mF%G+C z2W?EdJt+ROie32b7(dX6z|rDkbeewvdQtt{{NYbz+VJfSnKpgzIesq?=?BV%+_mQy zwGROJfOKj!GAy*VKK396c71&vuvoB&z@N&P2xMe?GQA8*OgIe+wCKu6bj|y2SD7tc z)$enEPqp#`Ui-5`s`N8fZ7nPcnX3_rcQaY4 zg^%py>E;TR;(KR)O_Lik?d0ep^q*R(DUMb${;rJ0ak0=9oDmi<6-s5fMJ1T4!L*^a zohh#(XNeu~Mx=I|ee^PgFe6q*YggBq($S&X_0cgoUF%cFhn{`^_k+V7Ww~Mw2b=RI z1!xtrYJ$~7vjMtparj1S+HoqRRUg&b7uT?ELQn#c3E@*YQb61?egkG4`IL}AlF+J9 zb3>Qs=`})oYK3!Mg$t~B8iP<7J(cBA;6hcsZMbX@$8JA%hnsN}vEfhwWz%kU@+Bl> z%FCTltW|M-ftXgK?pkt`4`zvT_s`6xaKZhk)loU>?mznx>+g-R z0%xz_!S9)|+}7P(bNSP8v}4S*jO@nV&kF~Xj(}=kKGy(>E&oUfr^=GJB$_~{YNj6x zbnQfuuVF^PJkbPD^PrYGRXc$B>4pB>qTh3A`KeOyBcOS}6!f2v2uO@MWnvfI5;VqBy#Z2O-j#<1 z(L0hTXFLw5>Pm@6?FQs`#UuRR)wlXw-nFd#{5yp7JfL3rUEc5KS^d_IQD~HPm=8JU ziy1$D>t9UjzNq`mhY;xs{G{D%|IEZ&ow`(58Ye$?1z_WzZ+N{_+0wwzXV4w8ZoiiC<)f#Y=G9VvXB1BZj}kNi$vNtANN3) z9DoqopmdZV5bjrepANI_?whDs8D)qicAB#%f&@MC{gX-|A_t?ED4{ z@}}TZ3fq(+9SmrYM$$(o`Q_fq$+@)*<7}0FqW4Cy^TY=vuEfi`7;V813AekJ(ikx3^b4LMBAsHu?#2C1=##k)5ktUF_8|$z5 zg8Rk{Rv8q&=T-0Rfs5C)*=cK4-w={$6B35j7wqSI(M|wTsi)W$)>6d$@$}U$I(dJo zvoFRprpoB^J!_tQ$O|w1y1kV%>kbmSva?a3I>eRTo}{lK3aNlebMO7h98DZ4&%~HQ z062{yAtu{29AFv&XHVn6xa)D)x0Tw#M2sTHH=$DOTH_4Fh!=OP;LcfHrzMN9Wlmte z>9rQ#u+i3RNzjoTCN!42DA7CjkRK=Y4wypjk4U>4V{k`wzELqP3=L>Z#mM;X#p{S* zr;*g$xH2u39?WzR`haaqSWu#LNKM9$a;yn(PT6%XUV)_C=bUDaw?G-})9pztZp5C= zUn0C~T%o;?1QF(>YXInKP`7k)Zggf5cs`JW#(04Zrty@(Lhrcvq|E|cXE37{~JTUYJ$0y+=pu*B&w{8N#d9*d*pX;c# z(NlU?11@4vjWqEx8wi52I%!0o?=hDEG}v*zS5xFaq#}v%Gvo~i~FJJt2a`EG3_1E_&uV0>B z0L{;Te0g$p;-eF@Bgcu-(-3T|1s(ExbY@;)*Ndh}_06m_PC7)7;x1J{mng^vZo=Io=fnr*^~yYa4+t-JAVKXG@)|Led0%g5O<%FL{Tt4)5O z$`ULm^WZ*9WeJEZQ0Z)OG{oa-jDvv10ZF7NCFfuv=rHakEbJ;nZ*R+v*2Qty#j&Ja z`^%2+c_#w)8FHtnxE*aTIZ(!*EL-GieTK~o)8DTC%N;@+AaJ8shIQ_Z7?Jsq+lb?F zLlm-TYRZn4NRWzRUUaTULMR~!a{o%7OD`+>)rfCENSH>TxIkDq*E40 zMZ=VaWJdOvwgw`b2JC*`RmQXS#k+cMPN#UGUy>omA>g!RW?KR26uL84MP<1cCPiRY z7IUl2H8=U6#d~HjldXnc(}2WEQ=GD7%IR<<(SHOinf?PE>>nIhVtbxx7b3`$25e6f z9E^zVVHdqK`Gp7mKH63dI_6bp=N}$e&v*)^hW2Nu-bc4L?m#B-IEg5nX3UH=(}fSI zU8)1thizMo6qHsvO)G?@-q=3N8vG@Ay^wpcoSKR}D-}8Qn z;q-Y{Ji0%%S(Z>u58o=L$3t$MF&d*=P8DnIBEbgo7IWfdD^-C&7Aop2W%}R*j#202 z5}jRk(2JAHv&&uY{n^z&-~Mui-k)4toV>X@dv%H4UZB&rZ(g2VoxOc?iQfKzPTu?r z{dD%`<*r@B$fpGEI$|6=E~*?m>v!A1vn%bbjS}H_m?~pqsQky+oPTh4l|3-gjf$(F z!F~{{GR^r||#%{r&R)d;8xX{-yWy z>Cw^CgQriQ9sOnhp!f8s_ZPIk8I+4pDkSEA*MV{}%~ zxgJiaQGv&3a^T@4$^Pv5y(53$3-cP{$LIvTrhSh2RIg(?RIj8JE?3ggd{_b_Hl#u3 zFdF@jY}gW^tHMDzrC@dB4)j-lil`JM8u;Fbjma@u#j@~dpdhzhxJyyUZsUmIQ0zr) z$V7Hi(HQd^KZ%Fl4Vgl+-?7&?^{@S@!Kcn#&opx5C6_bEbs7gF0GTHZp^H@-$9#fXE-nhhxxYOoKVR zZKpMSr$Z76QtVap%Obt%FABXHde5LeXh0{xyjO}Tx1W!Mg(ZC$uyMj-63c8Z;5L_^ z71Qd9SRLfQ)7E(TjrtmPQab2S>v?iOuxLNZfI!F3^G)^+^79v2+X@iQCxFuqssg&a zYR;*ygxU%oY++kz&!usk4|xoeyIr0OUB1a57szXg(3>?}4h{2aUpZN;14)*!hz+MdDeYUN&xncqkVN}sZGFO7SmeHr zaOSJv-3jO7>utAQ2-hcqe{(srwfwCveKoSTq~x`hyV8(VnOjZb+Q{1s30s?R-Hjol zM_Pj&;;fYGGeaB+pJ#=v-~U_6{||7Il{sn=0hsOo_j(7% z`PaVf#SYNevn#h|l=Y0z$~Q5ElsHQ`g{rUF#+^;*38~;I?9=tra7d)zZq5>unVR)i zm^nel6T(l~IKiBt&j0H92fglor@GcR^MSvUbqMP<>gXZ&CcQq9xYsF?wW)1qZL~5e zxd!oeR4S$Mwk6j0E7K}357Lfad2+jd^EX)d*Gam7v-o$`Z%H)U`Yw5^uMD(yq_R!d zN1pujNlOYjAG9V?@9CX06;2YdRzeAhB^jiVXsxE)FYc052KBE&By*ynC4p?~2IAPo z$26Pq%IP6%)uM?tmcI_e)(`yml?Sd-=$!UH!QcJ1geH<*HZ&qLL z^?<1yF>VT$EkwdupRbRUrx!2V5-{N50`yy*^>9LSwqJ;J4PUO0YA5Gs<|3Asw8IIt zAG9ao{yIo#Dv&PDe~sU+kBt9Rtj%HxC&NN?l1e5591-48`Mf zat9S!8OUio+?yOglR3n#e9%PJxgWQm4uK?3iLKoYhp!>`(^lrC0v-B?-}&ANy2Vp{ zZ2<{x8d~3Co$X0u3H8Mx_gvB_YjEfv`ujSSzUWb_ZVZ)oP5JArWM8r7R_D(zUpfe7 zNv^&(D<`s}GbcgtGu0xG8IZ0|FEourv-k`s|4BJ$Z5k)ulNZvkBD0C$=uN#1R`l z7I18RoW^yt@#INMquP|~bzm*XgF~6lpWBlU``y3)y7T12|NG_FCttoi>Y(icdC+Gh z*(H<}MJ7_O`T_Qt#cf|ZR`%cVSt|ak&n>me{rb!N{IA2_(_Sh5d-(mq(}(!)T|DjL zzo6!?%#9;3`&!YY_N?QC0LGp$+9Xe`}-Z#F~vIVKi=Rm>7dSl zk|=~vbkpwsekWg_D-iZJ1z~Ri2zwcX6;OU@lC#ehrn>f++YOl4o6>&tJ$v$6}P+DyqNa(OzjdV z{yCckiu9(X<*DN673ndo2!B z@;`o#{A^6$zH%Ge`ewDwv)h2O4x4qrwcLzH;R~K_s z+OT*5D#yrlepgHh;3=AxdClcOb1=bWDVIjwEDNzR!gGWZs4H9e)vsm5;$L22XmguY zw+d8pM}W`)+IBNXoo;quKFVY{E*If-oJf7^it)6SIc(SI z8BAW0jJ30R$tj$}-Zk*dXL9q_I(AAY+kY1(+O}v;E;CbF+ind4QrQ)dNn}C;8u4OK zpo4sues-T==UWl8J4fdm64tM6uC4u9&i*&q9W5Pzx%PkWpnU#!|L7t9dneB#`M*D! z+M=kBgBv9gB-V8UF+|`3HcqgFJIS+a-<$;Dlk+pX`y|}ZZ*`3_++{||w28T8)I>tf zTl1HBch0!X-1ZBYc)>x_1;-5eFQ%#6@#`JHIrI&~a0T`Uaq5*AY~rb|z3qPi3bvhCTUH3qT>0-H^(5 zNMl*-Z6|*>h!~bfPs{J^aKNh70Y57it63>$dv)hJr9g6J2AIqMr3aMBcr{H3g8dA* zb=(%oZJ`+KZuGh7rK8vIc`RG~%we?cnhcr0Eu0}!Ns)m{rL&VYG;x;8vM{KfMpy{Y zHY?Hdtkm0rbgh0qI{|5N@@|~E8F2%`Wp|8YJcJzyv!Ue_O9Sl*_e|1ZOhV7S4$xeS zo)yzKgmFLjF32D+>*bD?6@X3EyzLnx?`>rh+I72`Ke?*!pLN%286ZODzMj)lLp09n zX$SGy{@jdF?JlKORU<5ZB2!f8x>F{EDTuGPLby`%tv<_|JNoJ&yQKD6%KkU!b=MUC z@AWG7|KZWoqX+x{E}jMA|BfvWca2~k>I2`RQ5_gYvCXv(s2;-3Y@Fuv%w{bbk!b9T zk!H;qpTK+bO?5nbowhb}>~^{})T-^ZY6-jjY4Hn_bXyws{gt1pQFQPW&Qu`A^-1go(1&( zt51o&l{q#6lI*s&=752#W4d`0a}*lB1#M!@Pu23Ry|e$bGTY(+9Ua0y>G(1o4Cp7+ z=~iue4dki0YZWR61DFbCoAr!^PBk|dvFKKyNarD77L@9yXZNqlc6Jfb|F(gM&v35{ z4hZUe*Fl}%I?E%4Gr|qhD4L=_QXJ6%RgOuL0J6UKp6K48y;Nf;$VHZdF4(wmWmWDq zYPZF?zzC|?Z`(U--dw7-5D802u;Y7Y1Dgw`JIRvl9oo}8zy)-NGN)qyi3hwi1gbY`#?eq9*AG8Yzl)8j6}Y_mP& zxlEW{%{#r9yx8nYYi`WZa~RWBg;K+qP;}nTy3IRN%*Jw0xpC`_(-|gFuSF56eY>(K)%Ln>kvf43+?=dh=VCjZ=FBvCLSn93Nh3+S z?(KKkEtckvkv?Rf+WPtP7iCi?sz$+PZyPmibBh9L3pCVlFQ9FjmO7*_CpTfxJYo2; z$cfl?fvKZJi6JU+%JLHB?=-b>%W>^2#65Rl|1D+z>mvzk+W+l6-G5rn|9rZC^ico# zPM!tq|7`nLPrq3}6+9-X{7~sNN%m3y00cSI!o&%_7uS3+5Lhpdp=**t!*P7qqUjmsuOmfl;`M z*es1KCU6@gyVW}iR9eNacL(j+m~FUCRBs+<#NUBW`Z&0`#XQV6;AuqV)CUN@qw#>P zb}!17#b1vMRIN;idx|Hgq`pT0@Q3>`=>XjleWkG=6T)#+rm0Yx-K~zZ>HX{?k5){W z`D(wgYn`p3H3TYj{k*)s7*nVE-Gbg?*Bps1^L@U)Lnc*a=Q-b7)8EIgjb&l>>lf~- z@z>bY1vICCMZew@DC?aYGHs=HporuOT1OY5ydjXs+<8zfccWTv$h7`Q;2S6Aq#9X` z0iVtnaG1@EOH~KQ&vlXag5cK3O|jH$MRJN?6w?~3J*p9Z#z|ri3OJdU3YO=H#v%DM z>#Ii@(9Ow{bH&YeF<;uUL!68wP9&#fLg2btI>;`m55QOtTS;YpWK!>{IO$!51FzO? zE=nQlm=lZPyJA_`@)_D*&AHlx&JOBCBp%992le)04w;%m$Rj9v@r8fSOdvDDU*TBP zEwJokJ(G{K%0lRNM7X}rFrzUQNJzL;dX_Addae-$eT9WfDAa{Bwf{?Z_MgSx%4*4; z^s{;8HEL-W5r25B%rNmslu@|jqxUq5P(p(nG@x9_{NhxT6lml#)SYQi^_-wC7)tM?-Ur#2;1t|JoDai8h^xfWgL5sVr` zr!*frkOQh2&d&-=!~6<6ZQR)SlSum}em?JvGU`?iDSL47I1k|{sws7%uO2nG%$ZZt zFi=sN74!Dg@}LDcTZbxKsuk4s*#O}h7FJ`iG}1v-?x^SXhYcATWA-L#8u_k+wjJ=4^Z8cWEWgMbgF$H7QBB;~{k5qx0-+ zyG3t6eTk;fTbte3f`w0S?i7a+ifNMG^l8&(XAcYI;3wRSFqZv_6 z!&;;deRKh$5ltOwDUr)ye1c+fYbB{lQ8Rr;?9Jt^V9985=ogO*x0wzm4C+F+~>B%1l%@k7;xbLP?M*frry`k4FLz38XN4%Qf} zZ~bRY6=`c@)s$Sg$_?y~oxh5Y9TYO6Yg`%imM!M`{l~at(bJ>OK5lQafE(u1IZTyf z*U;8E%K91gkDih^aIX(=@pjG`mJUyutNIIs%>?SXD@9GGejeGh%X3FO%e7PLInJ7r zmVCBs3Xrj5!RR;;)i9}h0<8=R6hK(2`b!n7ZgpCgtOe|vouZA` zs9VnS6~CIJwxHoY&see8c8km8YD;8wb$lqj_wX#Y|0fy8L$apxpS|8u`Tm!u`_CTs z|L){jy#9+@qu^3A0)jI?wffs|N}w9#2T!u{T(Bu#6N`5mv@Hfx8Y*}1%nN`Kg1%1Y ze&J=eTDheh%{4^Xt6!N{+vE?}1}Ze!DTS5o8t%5yhaNw6 zK6czX3$9%;?^|ui)I-*Y&BJ2y?LABB|GeNss}*35{@*{^ujGF`Jv@BS|99~$r2pfP z@GP3BgSA;`*0RT}M9P{%A*fg>q-H75L5a3`k<}qe8oaW9H^~Dex#p8eWZ$?&W$JDZ zb3fVkCs_#PUw9nt)PMaA)fHJv{&gsDZRbDs_bc_EpFMpz|8XbJ0`jj9^V3+@%ZHP< zlA)pU=dE{b_Vk)HfaV;tO*tge$o*`$-WEMJzrr_N`(sPJ&@gc3VNWo(IY0F$iDy##CW2zB=kM z^t)iOQjX6%e?rLHS1t6R|1V#@bkJwi$ATO^MO`RzR}Rv=NNE%z5>Lk%8a_TrA!%`#P_J4;vl}pcVkZKz5?$FW-CApFodjMr>B^_F5V`yS{~-48*u;X(FN^LXhqgp_s*8 z)4C1IHE&Xu@^)^>v{&Rq$kthu6AR;&v%L)ZumPXF<77g(AU~-ekDnv+r)gE>GPh}Y zl9$^s^=mhtb_!dT4m*@m#r*2t*~|#O5jym3Se_5hx9}`w|KDOB(|Fj{1(+NE-LJ%d z4-Oyh|GtxF0sH^Go^^!#ES2WM7tW#xPGRBUEVDmj7}Nd=4`-DBzF;R z@PyH@N^NsDSOOQ6L1Gw*CzP{TADe*W?B*LN3~dM(_7Vz6;Db6XT{B8ojnZ{mdQR-( zVF~$f@+_nOog|mN-vTTIjzf-{7lS$a|Ji=;sHFdojvmhc-OaOr{x_LG1fAL`&nx5Q zR|a9OuPLlt@zo|*Drcsw!=~VnE&Q4#bJ-;RqQ}rK1*CYo#I)0CA33tN#5yM?_rvDE zXHaM1579Ny>TzwBSzTtjpCzW}BiTc9SmfU_uE^@6m)h$)*7!EAk!^|V_@JeuFEt)b z-h=6~a;&P*pGg61)sb#n>LKj^A_za{WI#W)>gI+_ef?3XCz~M2BO_sla)kTDHn(>}G`{1vgaKJR=sd8MH6N9F^v4NcFCZc&|!#n-Q<)dm);;OM$f@ zGF!ov1^(ux&qZR+oR_7nZaRx^9@0D?p4I)oG3FG9{aK;FIsV`GM+fElk4J}x5B}es zJj?ihKdUK!`C{$fpJkJ&z;=|?TUHqFH8 zBQ-zI{eHgtI{W(zl0-BB7HLAK+M?R)H|i3XXQ|OGE;MX*jSY`<)fBJUJ1#&_#0G$L z8D*J+xD|%0^N@>)k?sv^1sHa!3GV9-LRd;yiM-Y@L^bK-PZKCOdzLaH){^#SR@vh z_a#F(O}(rbz_Hza77?t5@75fcQ}VmO%;skH zy`0q?{5dn~YRS48bASK3VYt=fKP(=yRpLLr{ilbAmH5xIhw~qI@+=kqQB(f%#eZ-z z{Kxu(K!%^bogk2lZF3|@gS}!b$Q^1!0ih~+7YhiP@7EF#D)!Y75SksvDR$8i#+e&b zDk0SzRQlEeLNBqzeJsk~hvw(I3MgF?d(NX8O49G<_H>fU(W{(SoPILCXb3~W&##)< zY>{}03&k8?bOX^Z9fNQ|_$I?*M%Dcf2#e_tTp?R!)U2QR!8pZPC6r6BY(6GeTG76# zn4BQ8MMy4JOY?$prezDJ*X_H4$Zl3rdW{h{1IR<{t*x=KzStWWU;VYXjV<6_CMICI zz2C7ngTw;!zHIERp_f%-Z>HOCJoeT)LepeHZ!$u&W(pS#((hT^J=k;}BO>@`0^+lT2weZh}c^MB2I=$a9CP1O}Y%d#M zs_kRd=n{1LjmMT+2QivWw@rpHHX~juM=rEn-Sd2|dNcao&1U-$VWthg?L4k!pOxc3 zdHcp7(473Q-ccp~^L_8({NLR?%fx@q^^|WS2;^|nHxmiUVQLNs+YoULYH zv*Cr=n0-ruhULuXkOVX&*&TO80j5?&b6JpqbJm(yWwulh-`;RksL6dprd>AZ+IO?o zwZ=>Hp|ZHS_uoRRZ{Ve|f!Z!%B_-atsLaNoXik@$n1(x*YFjzuIP9r81#ZZn`;{rt z?FJi)v;Ng$P4idK#Uc^&`*RjLO{m6eeivZS@*wjQX6rp=TgZI7Jf{vU^)aNKB04kt z>Bcb@?Rd?hDhI^{IcB+_)r^i-j9j^s^=*f*Y_OwZ5-vCe4QAyAgCXm64_afi5$%yT z{UzHFov%T_R<4TX48BFKj3pJ5v3RFb-AC1yaU*M2R-yV4H=s#eV|6)IQZ#q(F&Ee3 zvp((S5_&;RSMGIAS8LXH?r6#KDzDbJy~pg*h|?UFX<&(@B<3zZ%xd>_;>Rn;e>n;1 zoQojlg`Ys%Qb%y*1m^VLBz#A>Xb902I&(hpC;FR?z6+^2hAowa z$){*LPkw_dkxF=U>XImS=6+TEfc#O5nhgy$h1(nL>Na^`l_J}yM6 zEQC0pNN&^Cf5SZUYG~cP@~ z9v=%!QK9WQtH8BPqHSX{p#OZ1dQW#+&qS@+u>$|s_U8n<+?B^F_2Tliy@1WNqu0Vt zgYBgTFxP@ExptJHoo#;5LDTTA#47flBaC0$f4c9_%KpE*+%-f2=J@|lj}FWJ|Mv$^ zj~@L0yLgsy|BXAW+JK|qCskix+wRaF1pAc5gZ+J_T(-+5Uv}v){M2dk^|NFKVbUoW>?(8+hQ*yJSF`iOCu0TT)6OJVb_u3z`G`GOd8(%jwxEWwVEOGr1 z&3O+k?D~AE(l= zcFHl!WiM*aC9dgkr8cQ8Vor>z({bZYekXT+cI+Wc=a=ek_oTAV{b+)-6QfET%u-fp zG9>ae<($NMP_fe~2X1g2W}3rjj8go>j?_do_~?qgiYMyOTY>xz74;oz5VZxNHnIym~pb;7<26Z{bvW|`+s{! z-|s)z|9A0hp>r&irV@&`_4KM`Cr160MxoN;2@Y=XkO<$~LRTXykVun+aVd}(ktl+k z7c|B)7}0pRi#Um}q!Y7j=D*`O^tMn;hB`}nTZbl0HY)nRc6{_Uj;4sk@TCF?C4{4h z#>DshmzTd?szuJ*LZ`rw=-ufh3Mm(!KcsRG{;R?F{QkfB9{kt-FdFWu|JXmpB;LzA z>f_)hO~CgN-V>|C+NdJNi;70{Ok5e%0wLR?Wr}v7o)w91!7OKga%?S(oKIe?6alX z>_Gf`$XS{wm7-Y+MQlg|)F<+mD1~DH(ck%=x3z_?UjO6eh38#gUn|Sn3rRxaki-Ec z#(Gz4>#^w%)_D_3Jw`qMlmE$P-7rBVA=iSgaJVwfcr^BCd;*E*K%6e8HYk+H9CiO!2gEWeCE+p(| z+poq`Z5pA@KS>lZ^q%o3>}Vjiw$NEDISW(RhVVR4(%KM7IGfOr2!t)oZ5U7Cl@Kn_ z?T7{=6yR8yKoI_igANlCu>{5B*31V=m0_*9p)&tFc9B419OEJ3zURFtOlM&L(D)yI zO8W#SiO74qF~9gBne1tn2}u&M=~x+u%2?Ii!=G$`fHO~Z|1?HHlnP0>VV!eM!2K3f z65)AWq{ibhkwl=L-~0P_URQT;=pXp|-|26ZUr1CRii!jcSQN2ag}220h`^Ss-c_*F z!xKy+cxRj?!~KS=kTMdmgn%;@(!qd$p({wBofb9h7CIRWXiOzlfPPj`sg;k0B$jkQ z2}kbp8NDPT;1oP7)cX01UVTbPpggRzI7#LF54_La+0VT9>-y}o_ZeLqDZv?~{FsHx z-D3lJjXt9bB2ykCjMNWEy)#6eYM+tTk?S+Mc2kmnc>A_vViUrK>N+n@E;{PJ|EIHa zjb?%}!aOX1qJFq*P!bkeqEx7ou+T!Xr~VyFS_fGMO2Ebmi%BdqfbzJ?b&*vXLD591 zP-SzVfIyw%1ovswQlx5xWhohJ|I|t2e1ThCl-4nTJKKRnXJ4srvkYFB(KWNLG^E5_ z`TdSMwmY)hdW{Jps&u41vO@>R?$A3UAS%Fb7ewy(ickD&y%ZqB7^o4>fV22_*7x&O z`??NJoFtqjoI(^dYYMB9?O};|UjWX0?JI-Y7EY&!4Zt0&t?F1MS%dH`DrrbI3)RL z1-*l(bl;gow={|niA4%$GHQ>U4C#c#I&^(Y;1}JcvM8~RLip%xfUfgBL(SsX)|AwH zany_^N1WXv93ub_q7U%9kSx(+s3AreTzNnDRmuaDvp(z#C+8#kskeiQu8on#voRjd zcV+G>Hn8+FPe$%4q_FhkaxR5A(f_NpB-Oe?H0un~C_>N@B7oHyFuVgzE*O)Y%;~WS zOL9c?Sg2zUR6n}jMS>9Y;mm&a>-HA3;f%?hEa_NCo zhH%Y;=zi0a1w`vpXUQ18VgBqxKlzs6P8Bo zd%Ml=4t8?d6bpk~*CAekYI*c+ah3eAn8-q{V*NXiJJ|32 zeQ*E!z24vUa6-Gz*P=_~Zm-)r+H=(UG?w^Nwyh8lf$E5A{fl!fM_1E?TssJ!a~exw zPm&l1BQXta8d$dFPr^0GQjN>;jX$%9Y9{(L!a}H({kn;$wA65|#QkqV)PQjLv))0x zAb+Gp$lR`~5H<4y)K^`z@rZC7Gii?cC^@-$eTf7e#-<$|&;XWc*qI~JZrfRTbwAI< z-}$k@EVGftykU(ByAz^T>LGTLm$P$`YPPPeI#4a%P6+2TEOs@ICyIF= z#VF+|C)(h#dts{C6#bFnNKIUbaFPIQGsCFuAb|fSI3R`nhLb2_x8{hY&Wp|3nX-~h zBOQ_%jItOFTu>YuG~teL2-conWQD|01SiNv82W zXUpb_GIWcaR_er1Vl$L@8iza4aTP$wesP>wpNw~snPauyHs0#!=?n_&w7 z&Y5@@>F;-u{uXRK-S)(~joN=<+1af+?t>W>*M)6FTQdQpgp&!Rv}dQtENLzI^!GlR zOTPL{to!uXbyzZvhh%*@m|thnU0>$r*ID%n%&e!x4uC*-|;r-~PJ2<+N?sRsjyWN_1J;b=h*?u+_FEbL$&6tXw{nNt6}Ui$lUS zE2@8q?1(fRW>v}%(>UM#DeMcU4Xmh-1Qu6;?3{0Qz8HxSOQR5J5Okp)JIrq8R17%z zBPFqnruO5Y;B;I+x>l>E@MWVy9eM6?bB646#*P&;$*1P=d{}L(wUq4;#8(!P*`dQ-W!`HVQzV`Uv(BmqW zIVCyV&F2N&&iobY99`GVpKa1y91NXF#Le1* zkr-iR!0OyexKkKXF0(>9i_G78s%u@hBh@$g%$vVbi6vpSKH;FS%T7%hwlG6Kt6pBd zDAjjgep;*6nSryLOWll8r`NgcWSJCJfONMPHlg5evQySfWkuNR&> z=gQr+Okj2HoI4`F?gTp5z1+zx&Y8c`9STdzo^xZyO7mBpH(mey>rR4q>m=-aYmBJ!(0|_mh_Lcm4m#c3LRea8(h{nS!JX9;cAr``Y zmP%7r$Fx8a4?)Ri=XtIdKi}hRZK2DA1QbVz0tH1dB4aF^lVqx^ynGQiXIhRugyb|K z$Ergb4?Tp!e7cV9K^WWIDNm};B~gJQ24{dggvcj6P9k!QLioz3%=4T|Oml|1$XWs; z=O?G!o=wH3y?99DPo5|7a9+2%ABl%LElW(e-R+Lu$*hMpGm#(6R0Wu|W>LJ*2gr-x*yv&*XbvNcyQm?!LZU zqCy&ti#@#z>I$@5L~kI0P;oc;BsoSj9xy)ECna=kFyT&;zIHEW~rXRU8;cX#}x`D`);MzjYesL~Y=1P&dbh7tw==R9j zZT4LvC^~wc*%OED?s>fV`6;IvrEi zDx^ZeDNs071PyeZF+rJ9Yz2rr-HzwsARt2g%tA5`+!JVt#w^UQu55(6Fwh0T;d@Rc zc?%OD=)dOAHm+ z!j=fIg@6J8^cL(iIm2c=Tg(E>*%pe_&B4;G=WLV5Y%ZXS?09N=zai6~agxv&)JCB% z^LthbQ1@x9fEzM3dA>Et*y<&Xn}E>p>&>^B#MV{$GEldW3+xs`nN_J8*-M&!BGZhN zik5(|0xVUU>b*IM4z;EKIk!9gVZi&Rrzfm>@~VM5qpKaSTE^RA1{u z0$lIwCrk(mWhAD0Sd#`#xhPXZ`1$N^<(hoY&%HDrFF& zRT+*5m!dFjrmm_vuYr{Pi^fxPe*hF+FHP0+PG`47&F7sC@ciRa)0S1;%L6>JqW+ue zqEzX)GJ=oo?GN4jT#7x|lXC;=GW5G(u>$XT=TBeh zJm2BNFCC@eupmcIQ8(Q2>PXOAiUd8E1ikf;ptk`M^vWc#WpID71z$`uCPO`c-{1GV z4{u}ihE2%0PdMrw?xKVJgZ*7oL+QXCz(uzh&Ww)1K^oAQiV+F(^V&lyM`<5w1uNz? zHH5c>#4;6KHt5O`>6+T$JG)4Zs6b=T9;dn@dS|1~->+q`g zd6iouW#A%6rqlxC3Cj*;h~Cku(5-0uy({#%xGpqGtX9VFI507EcSIR$DRJDeJ6Q>{KyoNVqwb4Hcg9 z(oP^GG-D&pTxTZKU@T`_sj1XfC+RsyA>jOoW&~TM+Q`i=^rzEr29Wo-+@K#}2X~gkV&0`Kmj)l&XFUp#WnwA*_ zwwMKXkr-wr;bcI#RZ}0>U_c@02+cwkq{_2_S(`08lY`$Thrf;KP*3sRR`$CFWH;)RSj%kPJ-@6|?*z$RLeSMB^KwdBKjXMl95Om#Ji&;z;aqB3LvbT?O0$ z{P(b%Fd@4+AbOtnoc`KiQqvsDeCQUWt8jqvx|4&hWagiTd$5|lrU8kSCwa<}slHJ5 zKLVCa|Djf|11l|_XWE4*jYD%C>Pdow5wSh&B3sk&z~4vPszJxR>g@c(Q~WZDVY=|Wf0+(gUt$n)1*KixOe=(?wh|OQj`#L%Z*P4J zQ2LAy_afa&?7coaef8$@Rrf$G+rPvS5h7n8`%}F(2D%tKzC}uV3^~zSoyO>vQwg_? z2sV(nm=iCgLUP(qWr08zDk_lMKq=!GbxtnP*<}a4IJrE#-1Xj{UH$XzFIVXO$;HLV zo2#=|m+0*UI(_@*<=NHQ+c%f!?GNbW&A-r3XK!BaB0_Z_?^6QxBp63@49mIiU7F%B zcJM5E5208Zpa{pq6b}g+vI)_f1PS3|D)a)0Dc zVQyr3R8em|NM&qo0PMYcd)qd$IJ|%BQ_PWbevZ4=#g{m(a?(AnE}DT)GYS*;FQh0R}S|%nSyD2;U1Ypo!l(8Y3p!6BGu2 zS@YBFcDo1r`|7{lZnyZ~ou@lb|FW~c-+j8fx4XOF{Y!UeZ@0Vq7wE3LBUMkr1!8~c zuH04;xj)E*V)7$qoY1HTx4R7#$LXKD2kmaV+wgIWBOgZ|!MxXKfkz{s2vs7cT#Ojz zzXfd^p+SKC20(;D?0#whFdS1(1Z9&RjD?7Kuha1)yYcpbhzNzG?a{Dfem4MaZ69`a z+6V2g@~wu55#$d_O`7+sw%0AT$FNU$sWtU>wYCo0JGm|dkG_A0(1xynlPYuQ3Jq70>J=zH$Wmm^_MY< zeBN%1sqDV(YC8W_FB`;@ok;QUqc%f#BO=sSpL#c#wE{9=h)v|5yyN2`dNLe(Pj`0r zcAh>(o`2BweLOtCI|l>bA0B+O?|FMqhFL?MfR1RJ-;NqLcydRXued7x+-Lz8l%WxB zv{XkLEx5yjMhoI`+z1hg1R@b;sum6r33|Y9evJa3-~MmRsGyO2DLb6f%6`vkcw7gurC|>&kQwA6XxkzWQTY} z#5ftK;mt;9jDv7i8BL5v%1wLiC++>l!t=i<{{!mXtXsy+kpJC-o&BQx-#OU(BL6?e zQE8*zIpoB?oO}UZ7x1}*YITX{}u%a<{v@`|jSXOUm`y9W80qClO)1u~8bQWP z0*!d5v9Zxmka~srnXQNb8z9iA2fO?2ZhNnVV&si+10YU<;G71;oAlshcuK`N!yHFK z)sP=AvB$9BJ@o>h1>xiZj|dm+?|7m=o}v&p)FOO#iy0$6?m@HJ7$!kbdKpvyFp8)^ zQVruhc=ui^z5$(tI1=?=UZDXF^vlKuoF?G_GpUL(90$Zh90Y{{23-OB4fFnpCXwjD zPD76EVGz(esq7^j%eo|zqL*7WFTjkKNN|%3FpIFjyiKUq#5@{#I2ODkbw=W0-iole zqwI!6qmF^8Nuqztkuyqd4~8hQ%O2jIO0Hu!)Nx3LZLq;$(gn6EQ4G`GyJ6ljTEfN;NUUvr` zac_)6-0O56Nw^(`Ln^Rruj8ZJ6!`nutpp#Y5k?18@V2-YE^s90qx|<-_Aa2Kendro zNR!CVF$w_kJj{7NprhP}a*O|le{~-Jtv5(W;6Dh=1%L2pG$f;kfD9h?m>(l1CJzFK zaexHo57LU;>bQOLaWu(wt+o}E2rAonpq}@j=FS6&e1aeRL0>k@X@Ixp04)MX#`09I zIzqf90-l1AG)OCes+5_Sa$2^f{n-ErGRX-LBQfql$NajQ#JC6N3=heDL&{YpAwiE- z!Zez62mu*lZ{h_Q#+2Uh#%viW5Wi89QUSuPnEEX#W|c+RK|&yJ+>&;3pzK@&zJ+gb zBsz`sMJffQo_r|~6Gt=*QRMgF=U?;(hA#z;-PetH93KS)N8$(B!SBg^r36+ctVaWb zN28GrpDZqiw^uWw3CB$9#K;dxqz037X<yhWl;9O3O z27q!o)RAMzXn5%RYEf51uipAJL?r5&{~8AcD8w}+%T0v>pnXcX2b>4yO{}okKX_vP zMu`{;HA`Qey*xQJZ#DC!9dP+i{!#;T{=+#Oqyxabg=L`Qmo7A+xB5d8EAFUsH-TdsnHt7VcUnhF^-I$kPf2MJLJ%hW8JAt!Fge* ztc8Ws%ahmVXBSt8r&qnS!wJVe&?uMyQC>KR69M>MFl4IpZJ=U|*&X3H<)1rQ+oK^? z1a!4;!ErDw^}>!ASNt}>pckVtW{y8^im#|67{;9tNo}gLbI|T~^za#ZDEU*jW{1Me zohzz@681!aZ_|1J?Xl3yU^=9-=7qG)Q+#vsyP=nHpYXPRFIVhbdeS~COijL9JZc}abDVh%oG*poJlrK_nH*S7dZ zvW8;SM9>r&tVF>8nF%bv)zrUyeRV!%1m$e5YI*~X9rn}Q3m(JBPOAz+c2vFG5-JzX zcHTv-WnyRNNk^?R{SZY73Oc#2^-UrDvd>W%2e==P<9>`73bDY9w`I#4VG;-u2e_q+ zw$yATfkeS`CZy`w_mly?SFpCFT_w$>%RNcQn2`{%N$NOW1dqLGc&Ksf81Q`qUiX|6 z*^!oc*D?xpi|@(SjU|)KBW-Q$32vW0NcGOxBvWfgNP&QlO2gO&^3;K`=_Ljt_NzpntLb&Sm!r5GL& z8fB#t-ol8B)=ov)gyTNv!KNvj&Ytwya{qMx*wQB823!h;1RhQFA|R+T{gH=(20p~p z=en4)YDm7lBVr65Vt5;fkO~G*MkCCH1`%L%izQ>LeIF@3l6b_Bk0DN2OgT0{=XMF) zQFaqhq?slVJ` zCTxUzu;ada6QNr~0=XDV)k|TeQPbiJN4JF0NOlo!5hJo7S9+>o=s3DHQ_K2-FV9{d z_b-o+E{?DI$EQD9YAMg=_l$;)U7}g(?|5>7hpxE-#XTG6(~VLbRmJ`do-`aeOClmN zrOyzKB@u@K9#V!CCjghGLfiKLBqDODwcA0uL~bVMqRs@G}sI1kj59x+7uC1hM%` z$_q3|Lj0O0kz=NoF*GW|@Qsw7uaR*W^(+i2J%Be$}f1;Cl(Q&*7|XAhctdrkN4OGcBp{Mx|px$BD^82Ldh%@ZzgXo}2%p37q^ zq8d~G@{?k#jIy2<{Qsm$+HsBrpa_O>X!jz34i(bc;*&$*m`&RDxY)PsUsZ0F zbYG&dGhtlbpm!xu5R*tRZM7Q`sj8aVOLA7)%|9KnVHJ1<-YVr%amAX384^DAl=_va z_@-{oD)166XlPVOJJ;kQk6AxvR2pKK1MEC&w;O8j#YP^a%JgS2cfQ{JFx*5UE%sg* z6D#LtGf;}Fd}Cvyp|uVzF|B!4Fu6818u)$+bj@8xF-+o^GO5v}z_6shq(V61zXd>9 zexqG$RqC68VH;7N8teWmelrf2M2)J0QofYq>q^}+#WKcWX8T))rW}VK%WvopraBD$ zLFT_RPoiZdaFgP?j)l*=mf3CK2z?Bz_#N=8G8b`VxmO}@|E z!uj_V&S43Ud1E55C$tAppvXr7jVx0is}8uXN=Ue5g>(BxfL`0-C_p4E8YN>?q{_#E8IWk!QQ8w@AN!Nh}+mYoT!Yf3IpdSuK2_ zG%IMVxshXBy90|0s(a8R)+?*H%bbyQ_I$spP<;7`ySHpYuQ#Bj^ z@n~;osa>ESo{TySYGb3(P`@gvm(i!V9J&Lku;B7&7$*X^Qe7*RTNT>ZoEw@YKjzxEGy#g6np3tlYc@7N6Ls=K87IcG z+e;O+BOQ=(a^A2TV`h6VpveCY1t{|5*B(SfYIPCyvEBuge>av|L|0xyrD)Gf%?)Q7 zOJxHd=k^4)Dg{V65NN}-T_l(?4#xWcN;VpA=+F?|-_A)+tr-4~`|8`YhEks>G+WK8 zO3mgr+>MDh2A^={Cj@^YMWY8Xqqjs_kH(Rvpe2#%0X%jrv@NNWn}(t!2(}@jrN)5A z*aKp4k^CvP!5dSmi0ImTY0H?k0UnRyU7!&h{&cx*R4e9#GV>Iimw!LrmLK8&!C8!> zOM$$bt<)!4Tw+>HBh?N;i_c&JI&8|XAc7QZikWns3$3(rmkCR|q6I>o|9Aw&buw+) zxH&b$>8;HHhJh5@jq=K=G|ee$k)sm10Sn02XEIO#@vWD7Kos9)TXPI)y?!if08a)n z5@YK)u#`Ff@hAm7Oai6q3u-pzB#|V<;Se)9hVID2W85CKWeFb8JIo}z-Ec{!bRx*< zRBHn{oBCA~s+!PM+DBuyZs`nTei2f;?NaJ!;xX*eFvO9s;vD2q#MmRlNjh3-ZN*3F z4uvvi5C^r-$UQ<6y=Hl1N<5s>N6IGStV98)KqARL94oyj^03j5xRlUxU>&bN*E=Nv z5hAerdZsJez!PsQn}1Crq5@$gyUNAIr>PgnV&YUwB8{z3of}dUeyN}b(mvk?rs7n!HLTo_)FTO47|P1lf5)L${91FW|`xK>0L-Ybf!{wGr#Ivc5K z(NYa4l`}9sIG1m#ye%Xmf}r394$$Nhdo=R7#7W1z5aoSz-bt04CL(?LqyaEQBuE&( z8Z*qtH1K<{C&fgf*xz}((@00)v*?Z5@k!!xUs6A0RcH2A>`b?&H#zNt`YP^#dnnMs z$MWAFC?mg15(nqhKQx~)nQRSd`aU!yQA4qgU z5}i{u4k{Yz-u%&RG^BoYi3274wT3NdfSHx5KmXEbpy5!C^F)7ECN@($WH{k)e6QSe z3_9={3r0M})1m%ZZAuiQxV6_8gQ*1Af|MGra`)Us^bW@KPKhUF*f{DJCThWwV=L7U z9rp)jtewzoxe6YhpXi7msgn!(r!lOuvDQYVl*=OEmp3H-Q5Kyz#I4yGm_9(+ zmO;0D(C*IMG1%C!%$A|?ajeme3VXDoGg3Tc#~xHq^jU|7HV{jvCG30mM1jloE2&*JR529@ z>coJ@Q0$&dC>PO|U-O&Y?h{=g$RVDWF=w$9NR+{)#`86eBwLjNx)g0EOl@4@G z61gOIduCf%pkr!N>J|lXVt*iE2Evkok7*M4(rnV~=Ud3RmDiEk9%Y#FPS(j5HI(ZN z0y?lR!WZtAVh6>f9r_zM@?%OO;i6^xC^ZN^CtkX%S6WoVrO~$4Ae(nuE7qvW_qv9p zIgb2~k7TaH3lLCGZxiNW{;&p4ezv)-xk91A2FR<_cT7{r^OQ!RYHADH@z54SRPvQ7 z%}J%|7_^Gsx&QTX%&@1dcqxIeGcRp99^hIn(HQxSDqq~EKEwFsS^ja3Y}#W-ozt_c zesx%}jD%ha5 zxLlXsT)ay2!lasbW2X%-jb)bAkwpg+tA;5Dt)Z&%_;6^Rnw^YhN@D}GEj4?1uM}Tx zLBQepdH?+E;_CUM$I?>qL;yF)+9U#psyS(v zB)pCEK`gA^nLlI?%z)y6VnZ#H(leDrz@7}5ZGZc+5JSLHk@4-^e zwG{11a_DZs`}eW~`ad}G;r;uj{C|O|&JQmye>%H(QN%@sH+?{!_mM#D^5Mz%O?Ut) zrVsX^)$*}NeHF)GCUsHR`-67sFna$!kJ*dEtHbXOFONSUinbebplXWFg{Y=h{*T6P z8;-2lE%>1v8J&}bHG^hXNIgB(dScIM6bC?Jlc`!+i*MCrY_+(QLAeF<`6D|!wjIsf zAgw=Idc1o#o21(nuQiksc~drTqyp=G>eG02e0X^bZ_ZyFULC{L565u)kE`R0)5BL_ z;lR<^>FM#&)ydf@oF85szCOM>zPN;wQ&s%?vsbUqemXgQ2}ftIUmu>nfWu2TJwASM z{6gAH>mA4H;o7bpXjkYymrYj-vz7|gO{X-P*1W^WOLf5pl~s4aex2HdG>X&hLc1>gz z?tDs?Rh)mTX0>MOD{bbrtMjuL{nNwO#|25O&WOynS_jZXaa>50A}cH)X^-Rvc`EDPxm?N z1GVhCelw`XI9kMh^WA9psfJwPF`<~6s?KImYABIN;E~GJ2K={xi0pi}P5zLENSNc? zF{6Issl5@^vU3)S+jy~0} zw2tz~uOUjWq0GxA^{YiJ%};O8eX-{Lv#hz|B2z#rUA!7O%i@n_0e(^A*QdsR(Wlp~ zPuCbk|2%th(YG9$8LX1n?ri+jzVtuhQ?>uoALAg#jJHL+mQ=9Q_kVWx5B7En`#(>f zJbm(I|L0>o@7{I3f?E>yRBY9d1XxMUP!5YX#y$9|qs-jSSB>NQSVjL9A}dtvZo6U1 zwd`q*lIhsWzN?txwoW*%mV?x!a?-NG0|=Hx9vtkcpCr6YhC^}>%~l3X&U~{4)%mJn zf?rVDhFmx&@LPfcG9=gs6vwLX?Z!`7Ls#X6Y(wI~VSqg(bzDwE?BrU|7!L^!d=7|V z9hRlT+*B0w0VT8Z+HM+$-7^ZDuO^fMg`4JEH5qGv;`VfVA)ex<_c!ft5YDL^A75)eT!Z_8O^YPVk!Vf&p!9-2}E zjpPU3x!oCHfp!XVrMkUumTfOf(%ruKT6tlso1LRto;xdsHsjRF#9CZ=PQnGE1A5MCD+|%vpIs!emuVT>Eh(-`26DR>g?$3Rl{WY z>bVZuGANr|7ariZgbEDh@p9)|A(2Q`PcHxO)ydUyYLisXxn`K z&&&UNrL7;gxy*B5>zY&ZuK(aN8JJr!Y_5wE;HkJ+&?ph(%!YGt$-{bcd3@0*WMC^N zU(3Q9r&)~oBqQxCl?Xhf%kAUoOO`)qZfU;_*nDmawCH3fahhy8c}kk)5wPxx|Cmv5 zlCTs;!G3Ah@pSpVFn7Gp&n~ZCUL0Re<7@}QROZggRkrZryK*Rm13J&#YNRTpOI>+q zGN}C`>r|WpMCaC+8*D1HO33}0=Uh4nfBI>cvPph_xzvo_XwJBS_#anCug>1Q=pVj# zeR8@Ar#M#DJcC0bFG&2l9mgpnQ`=4rW0Y?KX-*q~6*=XTk3tP&l(%YYM&at>&E?hc zi~ftV*M}#kmz5%@6!c_`*huY&i>hcPm79ADy49`fP2m}hX&5zTbQz|UqWu>q7c-!m z`%#Ku9VOij877rh#OuS8SN-oV&R+KqU%a?DzMM5|3XXGwN~P$QFf|qCfu=81sRDHQ z`s%!XX)1tGcRSRrP72cH@zI-$S)|Hf>3dyjp`D*y%-=5+^-u@t@Xgf^SN}Ypzi0M7 znOcaahp&(SsA8aSL6Iv8a#s~K%M|&83&6syOC`+9mP@4{E_VU9J4hGDFHWYq3+lHx z+VK8;OP?LC09QX3G#p(q4Jc7Zj`XJr*@Ys%P+b}J`LUW^!X3!UF<6yd>ibqp`FT5A zrKeBncwHOr5tV9Xs&=`sH%90}Am~3)7|bj;hbP@+JS!yr|1dst_woYmJTKo|AeWv- z{>lQI*RPRfAJfx>MTkwH$tV>~S4Zx+TR%=5mXj;a05X-giV;IoD{aA|Js*oOsO!D_ zwsh}Rww(&Bdnr$C!m3ef2;e#VSWtH8xq1W>@FkJJnQKNZ7aYXbMhO7QrBYccRmRsq}F%TU0Z0@8g+EMJiXwwe(2cbaHGK zH+R6?`#015|9J;FyQi~yJmYa(HKcN!avgd|r$;&~>aGn{b487^(d@UT)iIZoR#aMq za;=XS%v=@!Yc46Apl~hWzq9hcbe}ve#sBVicfZ8{evD_P7?ix2g~k!c^fOtqbPlV^Q>hAMg@Yo4rYetd5VrYPUzAW+$3zOImC7yJ z6Mem^gDW+4OzQ2{V3Mz8a)Zf=dW@D_7QvAj>f$H)r>^<{B=T`2V1HhjU%ObDGgPxG zG}HTj&DMr<|8IIHRUoa`0S@S$ge)y%bEWTYdtVj#A2NJR{Ungqv)`8%{_lN{GTipQ zRo_jLazH@Y#!O0AR$H!n4c_b3~pl&@Ddw6V9%f^6jR2n!tDKHkh6GMigl@Xok= zs;;8d&t`~2b$4>xCtNTxNCfuHjk9M*Z(p0QZ`Bnjo7)xj0_xq6Xf#h9g-iZQ+VtC) za-lv|VY2O(j47)tsa$@WTky9Y9PB;)CST3?oocHZ|CQTX`g7}<`cXA8=cVt|3$6{Z zXIz3^qI?})H|85>;A?pD9HPgB-ys-Mrlg|nkx@6qM)#gE4q7iVWz?PfvXB-TkBwq-1Y62 zFA8_Mm)RmK(YN-{b3Mk-O0u~SX6y=RfJcXKuFf=*{oM2iViM!#FYp|iI+sE7SzSq` zJ;{=_%{WynyDP`l$T#KVbNieRpxNAl|M&kO|Lx7?@kQ19OrDm%71yUJ=&PF)7r?&Q z;o6!B$E>2JMyIxxTtzBsWysdnlnY!%O+6H=kjM$j%a3&~z^>*~HI;H9gL4up9xX1d8Du6`ysa#=J@_B0*nvEu_BDbL3w+ebp8zDVk0vtIC(u%{0zJkA5Cm z9nB%X!2ZD#=)vxjN~k)FqYO8z--FG{{!6>3T<`SobwN7kf)A=uvk@C*a5nhEbmZ09 z%ahZ}-pFZP+nZV(Ds}NfhpTH#^R90axa4YA@Kmv`4(Tb^vaB{s*)RY6)Q%tXRQdn> zK}!b=tjPs9-T&9!-FdoK@c$ijyZc}Ke;?y{w|xHR(zbTx=^iJm$h-lyPVGw1qb^qM zcAOdL3wkm7leir9l`Cg4`Ypi?J6P{#rZWZic5MYb4cuy09|cT9a~@!Du#Y1ze_qK6 z37-pGno+MB-28{j=E7w5DXi7eo888|IM0h!eb%3)k*LmNG^M|PfEDo1{Zy|1X`X`h zC;-#f|Gg(qx=)Mi|K9H2m-YW+JnjOE;+S{RRrW=etzyXyzCX`0TV2tkVN4?&2{p9k zg*TgL`qH%Oz>89;{B~bOrt``socr30gVMbOZCbN#%_(j37^~Zj%;ku@5X76^m}tBK zf+2xNld85eirP}8hPl1*QH_0wgg1WW@Y;&pwjArs#RGQQn2tL$3m`vV)_}#bc+7=~ zerCn$XXWOP%lA~)j>7eO1xBxIJ-vUhdMag~Q+E2g2rbt@#YKTo3g2pt5g%v92Rs(^ z|Kl{8=_lJ#35DuQd$!mE@G;tba=??&?QJ}cOFgIs=0r}_fGY+IiNpX z*O%&%t!8xry_GYqUo)v*kZzTvuaslc=x-%jMUy(EQJe&UHb!{{MtwTZzPJ!{+{YY1 z09wugjqJVYVe#**KzfiMZPx|lWWjQp(l?&g$P|-~s$HsZ?p$x`Cc83dF<_4MUXY5`gq;FSkL6?=!mE$J6zTuXW=EUYgSU14M?gb`DhN zR33*4KCVNI;Y&f|YP9sX4~A5}>BUhhyu#6~j(V!#E|mqUJ!Lu;Tt~H1NgcuJm1fUa zh`8Ynh?yPd)M$~FVmB+}9$EXk+bq&SXOrr|)zSGJ^2$9elDjiKMd)!Yu3PyzQn+y4 zJ`&xRxWMkQ4l6c!vF%=qJ8-3O(vW_@$ae%ueq?{3Tom|f=IP{|f51MKH=sK(@*`DI zxLrz`P!v^7S0hjmOBuM|zwgx)5@-bP-#6!yW^TP|nf7^E);VWM zl?naDO#Wgfe-JZyhKc;e4E|yUuhR^kZ(-NsdtvKC)moF~Q3dN0SRJ)#Gwf575h-Ja z&m}X`N*I|;NmH@m^ejx;22ajyAjW3Xh# zr71#S>B*60Vw#HEC(FpR1_W~%nxAc}?8QN=o05J(lK6<-(2VU)qF@Z?OZTWR;#SpKCKHEvne%B9Zsc$CIy6v0>M zNCykGM}2&0BIB}R?%Uq1_U3SPIEO_F2%bblIM~fPQc@SP560{`Dh0Dl=YT@YY=Nh-UZ$Z#ch1b0WO+IesU$ngZ3+IGa5(yH3 zI^z$mmbxeUzj@2vYSvQZdj9BL#>(%Z)yl3Cf0w71{D|+dmk9j)ZS(T@)$!34>^yth zdbfPzCo83!*2>%qHOn$QPu>dbKItY_d0 z{hN;rvnnl16oue?w#KadwRJ;Su+Kc3$!ZZu0W}~2<;%YyqZl_?1`8>ViJjQI@a#xUc^PYm)fS*VZ zXvao+Uoz79AxVI_y6xfaPEBTbO#B{vy}PAU#}ug)){wtsG>K)Asjl6{+uYlm+2-Ef zG&gHuIHqp%l*qT-rqI`m?+MMC4s3wDG7-(~Er*^b2lTXb9g3`E${<}vU))^P?594) zyYy3a{(Bsw^(B9vo&RNL_n=!i|GodT+x>F>`(r$XnIcK=CTGtb4^IT;9tub_%1(*@ zKpFX+Mgj%r)IT&OF#B?3d@V=D?FmFRs8@)Mut+WG(kXonv3#6=L3N`65R&Mk>J+!+ zj*vv>)J9T-=)S%ny3Yy<)%T=I>*ezktq5xWL+;#gc~1`N!m|6U;fjc zD)~>M5yPCXZ4H=}|Lf_&ZZZG=!OoZb{~zTko@+LwuSvmG6G3k(WhIRy(IVyMWgE8~Ib zxv^Zeqbj7w4oWH2PladkkCA698yTnwH_FhRmh-Aytm^#WyZX#W^%;fiI)U%y!iHHf zIH6g=v9p4ea>W)o$d<2JeUvR1*ibW^g5Kb$D#$TQp?~=1>WBW-+24;(ot3;M24Y$S z#7DcZ-9B?)+^zcelEZNZ|A%GB1I>E_s)RtbviSx!s^zqPF^3M zy}2qkUm>T=!L%6wUtRVu|9*1b|MB?Z#Ba>+4ny@DcXO#`(OOOALUuh{&TKiP^|IA?pwRvH$}MG`DpyOtu)TD zPNWtpWO8-C7$ezAU8Pgno$3glqZ_EwDyz>VEsDO)B0!P)H}%?%f16&k`HCX{I}}Lz zvZh2Ds+EFt;GFU&=Vmh^_ik$cs;V0`qm@Hi|CKJxRZDW5UxW3As$Q70VtMO-rRlVu znNh*uf7+$?vwY@Q|3ex{Q+;_gVAlHo#7!<4r@8g_~bgaNX`-thD_%XU&$;W4snar);p@m;Pv=p%CpX{4?#=2a4<^kPmK-^;}##cpuOz!nO9jbxz?z6u9s%rhuA4O@! zx84Wc|J~gwuKznv5B9#?|MXFw87H@`>??7Zq|SJ4}>tpA~O zob1aYTpMCmPr5}T!{&oDGgb_#RBW%QkJCkIt}}XBz5M#@WLVSg>faK~GZ#4*l$8!! z*XL;>zvsZuJ(#8$72D=ie2jm~-JCNY0JA;gzS1F0&1NI7xKPdPrHVHS-$68zE@eWKhP5W zffnTjmfk}L?VFAM+}El;6Czw1}(6Es>|wsek4eU`vLV(@C!5_nT4eZn}u*T z_t|`;v$Mma0re;S!9-x*=W+pTK9b1x86IMW*$gPAuYRA7xyC?Cw!cKOF!OV9IO0u z8>8PzT&R=8nk?#0+A)g!05gXHz?_Z240d*(w!7_ad#CqJx7*FS^xo~cDw(eysHG9U z?mDfi-oOu+SC_!CkoqSteEaF};`HS7We?7xU;@bZL5wlP3KfuvQjA8f5K}CU>(R+e@!1pm>*oTO=JmihB z{2^6E$dlC45Exij-M247)@)yQ=sioVK zx&9FcYSzo2w;p1?`5F0bM#8pSmSp?w`+$1plQ1BpN^T6j^aZ1wx3nZ_#p=96iOnaah*Un!h_;w1*p&5+#HxY$kCqBSjzsHf664lcY?PxS zOdgTpuxabhg872pMN$&hz%wu7FgMfNB zwJX(yUMBw0I;VG-VZZg=WE<|r#2d?5gCZc2R!U_%0Y*2KE7X|y*crtXRK+BgQ;w=x z$0!v*%}iC6N)VuuwxLSpvdWi$UdGrX!wHP(orJCRHt-2k(F&4ot(H0pMuroqR$O;T zQa*C7gm0rGAj#3F(f_sdO)N8{@1TkWQ zcu9cRwiJr0Y6i(1j4*UIL!xr9ZI?7hB-97V6{>HZ2qwBE|Ct0$q~?Knv?;b_Cv;B? zYO+#{ILAH+TA`B;nOyX6aXNCI3~ zt(-N=nRu^>T+ZoGz>C8l4U^}wx7qPq)B8ngi`IyL@s@QUnIzDY4RXoc!ci(-+Ne_fs(tgJMB9h1g)Eh-bL3^ zBho@e(*isc0T(0)ihQM-S5q1DmaS~WxTkP<3-7c&!BkZa2n9S!dx8a1{_8cF_yUMwCx=H zNrXb;p&*!;fzPYY^&KmYuk++PmWdN7Mv8nZpGwj9e80OtgX1q0xu(k?;^TsFSH-4^ zp?|}_I*lQx3?Ao-O)Xt(7_SQ{xy-Lop3T68&_|8Q%gf zb+;aO+FxxwD$9P31w6`XJhGtDSI?$Sq_kz_-sr0guX;+A*H`1m&RSq7tXL6q-{JD; z;^h3Q|NY6Ukb0XAa)wIve>)l3eNejc+w3nI18-_h zz|SmX{mZk)rz-wKiqQ2%f6R>k>pnf$DaL>796bFJ|M4-Nc`oPpfMFo+O&ou!AP_n3 z3`HXhk8bc}8y=~IF3@{E$2}?U-lkkMhj8DZ`!i>KjVLm@<>WJLkif|&Z&l!?vmRRiD_vwgcSPAs zA8~+afK6sFJ491D+pu>EC@L=9HJ+&Lc}1AqS#NXEN~0n*+4Q?s=0Wv~p1RyqCI59k zxR00rzx#B*l>fiG|3&_PjHlvYM{VA|*-4>fu`hZ4XK8>suhChIeoJr`6I{v?S(8lB zeuf7a9PH!BE2oyIR_IMqMI%#7$rfvxORLp4=VZaChRRUn9|rLlohBjdbfI#1aK-OtbA-;l{8~Qn6&O_xd z4x#_Rr+WQgPu@rS%(DLuc1rf&lc!(uKYoBbWE2T56N@Lh6X}@jTaA*=a{lw9JQewWaz4Om z9vY8fq&388tB7^`R4yj-Ie@C1l!e06Pqsthy5TtiO-oYyAEF0m^S>>ZS~7|#!)tD1 z=KS9&=Kt8+?|#w$KFXtx76{BD6}zCxuVchiR3C{(5F_sfjWBOFHgs&cIY7jLk8u#d zD4+wK)sRG^ZD2S+DvC!1-vAy96<2 z>hMsz(SC8+zZ8_=#s(bGFr*RucytLqVZ6~E5z$fq>h3q%gWp+4{cB&0M;-Z({gdBD zoea*IFluf2__^M7aepj*2CZTHES{68P(*~mO!jmFRE?_VC< z^UaQxMZ?aPih9*2TKE{LU^sJFP({kei8;z+g8GzVk;VqvLre570;vk9sRtwyRKFji z$mi`wV`BrZUOjtp@vPCfzP>i0y$!iO0mCs>N2t?&LAj?RBF4!;s@SqlN7pnbr68QN zm{!j-7+GD}pz6Sh?7yF=gJO+_K2syjOc+oqxL_z&$A7AZOt$S)?*=n9X8jC$XA81R z6@f;8;OD=mHi3rF>vVEv!WMWz!UblKa2sv;^A9)(od&g$yk$i-Xw#Lo8;uhIDBv^| z;=1~GL_{bg@ES3KUVNu9%ix*ulbz4HqD^q#5e(x_h-8mCTu3dk6G|}tU@JQS$MA27 zI#x5JEE};{_8+CKIzu6gsna+}pn)Wf0T8Nl7v}s#Msnw*u4b2WhE)wt1m=xK3$js# zo%T0>)r-t`SRgn&KjC21+eQn{f7IuJr1FZHUE6@@gIG!AV-`$w*z=GfE?DA;gyBXD zBn{x(=X>p^?Jhk2S)#y`fo2l!(HH~1kEx{DFOM@0khI#^d9u5;W!Ow{r6ufZr zEXJ6ylLL_JirUAKS6g0NqlyD2y^<%Cq^{oV)J#9p&l}AjV(J~`bMr_In{e=Kuzx(m{;_~F|^!;iS%P#+1j1@IHvbH@b zu$Jcmu1|)iRGc%+aU>Szq e$bv5bl_n*1N&Ub*?Yjv9+?I-fdnCRyAVgW|&o;bs`ocF&NpDSndDk_yhOf1TW zuJC}XSC@Gsc&QFKfUkf4WqFb*#PataFFMB@uLI>mQp{``IvyN&bMb1yDVOWlO)|jk zFeDRl&LuAg%Mj>^O)mi_FC|HU9pJL3eP&$ zv3ah_uWKQX*bSc81YaiimU7S9Sm@6NG3RdkRS;Wh=6z7acqrmG)2TKOVwbP4&KD-z z2S@CDI@RVzY*DhU7cre)Z9$cakWc2pqZ(+; z=C;Wm;7FlCe#em3RuPRlxItz5O`=F`NO7GkabCo}UIDWLVm=bcCyO{2U6o30q56bn z2_;r|q;~ISi|k0~3n&hG#N6W!^8v{%(7I;FCXB@rT$>wEm&Mn#8<7J3 zFo>xDi#ZtFAeP1PI>>3=HxN!@M=ys7x0In z7)r!g%;Enq6qChqB&=N)Vlk$xS!EA!{p#%H$>|!UVtP1jfjPF60zU)r2V%uJZRv;Q zG{HG~wpPTnmuazWBpnoBG9qd}jt?X%Dh?X-B0h)fcgyVf+3E$KhkK1yGB}^@L4ANr zEOZh(U0y{aWoujJX1rCG*e!zC8ihxe1!i7|4=P_}J=GGz>g1bEm*RwsyG8NhJC`{nwh6^T9(?$5WA3t z*XIlVpor;sgqBXx*h*MX#xg_fP!%pf8&l0R(D$}{dc@)xoLGyPB$cebWWPQ%Vu_$r(Q*-!gxFT_?X99;Q808I-7b!px|)m_0|rO8gwaTaMc*Pu&>&cb71y{xE5t5|k3GbW ztTSz@7E*~A*AOy)+!8Wmy*ru;v6G01`LL=(j6_7Ngw=;ZOkcS?r?yy$nAUfB8l8WN z@5PY~vYH>Ub+e*I>@`iIIpW}^AO@iVu_SuyMa-U&QMX9l&*SuPd>-im8&B7+z$kNq z&x6=H%@*okE{5A;h)GgCRy*)IO+N|(cP^R}1~K)w)`OUPLGHqFCMNn#0fEQnj0;zn zPf8Or9>=X=9O^jD1)_r2;^J0_Ef>rEU@%&11UDE~l#thj*rFlNdBoNf=nN*#BZx_~ zN))$?*rFlNdBoNj^1O~<=c)^k=l6LO;yhAGw8?>CeJ`PpeS^PlWKP6ZSAxr#*B1!H zv{BqB+oIK;9m)(g%k^v>>zG0;O{Kcj97}62-IWsHbs@I+;tX@HV<{KTyEwy|7U+Ns zu{ZGo+>R+1mjW?yq<8%1+D0<0=$zn80m7Kl8z@5k6o@f=DQG-5T5}?ngF0`|))Ese zFpE&|!nh|EQ9?>m(ERfN?ajZry}IxyA@(0T#}ba`ji-{VXpl+wp^d$mk#Deg$36^V3j}jNfDLF& z6%Bn;-KyK|AA}Vb2<9$Fajz$c`@=}Z1%kOh>nQG7h)oOT{;Z?8XCXE%nESJi;x-9c zmOP_bm}3%?T%wp|d$xu-W)VY)7%#Gh>Gmz1wTmh{jI`pj4soADY{7Fo72a^GTqQ%xJJYq&d#3s3js#yXh6CP$A78Ks7 zb^83rBcM@=w*kHgVrvr~m53S1e-t26<&=BSXgG()Btmk!EsIfx*vb^k?4`veex4QgL~lEMjX&E#s5r(v%dWqRr%%sJw(e(Gddy^=>4_ivnJq zVj3|unN}0`*xapc#Yy3qfl3&s5uOXNl|8`@VhbN#*V!RbRCKqK#iRHt0Iwc*?=c$v zO4neI6%NK3xJ&kI4XkJpTV^}yv))FkKy2>qq|bUA$s)GQX6*wUoxkb4#vx^sbiWqN zjpV!&kdQdxRF*ky+~0J>mfot(VYSRo?W}#;r6<`s$mQOPvT!hkn-kRDTBFhsuJ}B_ z^^wltdUC$3K2?1q&Aibo?nO8!u?}%|5p=&VhS=IDX0M`I1lj}Gn{Ub}rC*ln**dJu z1^fWz_D$%U1H>fNl^Wyn&ssEK2eCzSq&=wquOS~=8Sv`SE4j09f-*G1M**7W(7HwJ zQr7}it#B@G!P9UVV9kn;m2!rHc#Obw&ZIcZMzbOYvdoGzJU8X`52I}3Pa>&|&DC*R zH)8r=+iU92$=sS^hx$02thOF{Da0-?@_%AP;IqhEbgq?Ik^H`3mJ*j0FSNR`4&)x- z`s=IPt9lR)PW%le4Qvg!*wpi)+!bAh|QLf55O^A zO|aG?wpOW_M{Kr?tUzp0!CH&hT7^e}6=%xG3d9x_te*n0*)p<<6&Dn&wTP`%Di&CA zri`p&#RUax9pE)c#c_NT5FCjggoyd~WRW8i>O4M&vmcKye!4ihIzGQRyE;2Md!+=U zy1XLI8_cjz820AR-L$$?EFoquyPPX-_Jbj&s;}l$Tqbziwm*+wV40q+LEO9787^)? z8?)tt23TEO!DxU7BvKcnNwUR^+~NTHBkaTZ<@x-8*Wd=Oy^?VrR{SaTDSDX>;=%&T zN{KRQgq>qcvI9kty%slc&1I1DnJrgivwdVjb2!#1s|{8vN=IKhlltcFNDwGor{L!9 zA+_?Io2y@Sh|Q}PJy;KpMPywz=Q`$CKyGn_IX`D~u&8t30j?4jsmrh;ALwuh78=A7 z-10qJ11shcBM}h<1ut-bCYMTKpGLC>Pz7Othm_$WR)m8FCzeUBxU*^w!aQOzW<;IS zoPm;U{|9;pbSSXOa}i^v0-IID+o}{>Gh%{-m?mOQ%+yv(5o?SAZ~#e6pliEK9`{+G>+*J^Qpd#1;~Z1*urXYI(7^4&hNiY$37uSxdzNVhf4I z&sr)L5L-wre%4a4fY?G}@w1kSTp%Wrco|i(LMj?)D^9Vs*kd`w7E={Js8rlrRe0nO zTTE5_yrp6evBgxy&s!?y5L--D{IF7StrS~KRs6iA;y9jX!>F$P?_5YCr9QD zuLZHiNtL!gjbbZcw+_TYEEw^Yy&Y7A`ocM*Ar@nta4_K1P5NxfTfx_Kc+4QS%to8a z%qsPHAVa&+$J6Yk<~j!XbCDPi$RVb;*Cp&l^2WJ{33`JUy?0KX|ByU*gH2}OM2yvW z35=wDmLBcyEO^540j`_P6~%pum{#l;54zXdJ@*)j*QVY}?S7RoksM+Hzq}#wkC>6+ zyyqFa4?1)fY>wIOoRe;yb8ML`gbz-)OHzZZkeKiRuJ5JM zD;Gf&bh1rA3w?%%x{TOjSqSGqY`MgQ4{+UWKWQ(kFIFJ7SQf%L5L+%W;W}~GgQj2! zZf-;VtAyNx<~O_DC(ZZQHLSRR1gR4qtKgI(wrT)N0kPLKl8VQCR!kbjeVMBa7d8-1 zVJXL&M57cUE_@K^bXAh zdj{7lMcz(9>{mKa%i4_nv0{*z;zyub;}?jHu*gJ-Nj0W(I{iuqU^B&K6XwGsrm|$- zqFIQYm|}p0A(&-2KBh_F!@ycJ3vDDR-~IA-%QVDvZ?2{rY1xrlMIc=m&``<=jizI& z5e_=X^L&VXD2mM`9923@hFpQDZWGRnl4W`(rQ(uUDa0Dz!dG9NQh~qvs@M3o@hyB` zycKPjMEVv5EOZ2_Tk`w=dvOYnolMIR~WgUbT}q%Gs-OT~htEr+RI-JQU^oRHsno`i3|sqX-a4V}jjc-|c{))g7=s zQ^|AM@B_WW(vFS;tdg5hfo&Wr;V{HVBuud_je-fFTSNjCbxdWuLwpAsc+BW6@iF7@ zc-Y2mc=`9^Esg3GwcP_$HBON%tEqT>eLX;Y-1rtop1Bz!j1z%v;q;QY46Bxg*dnp6 zubUj>${~@XJdo0oQ%~<#*ACKPV(B555F)IIy+uKi4&fYBx*L-K+bkUtR5tXDhLsx_ zd1I%JUVc>rt(G)AZt&!}YWU~v^ye?vfY>NeF~Wkv^%w`CZRfhJCIr4mVI1J?M&tVW z+M^Mt0dBbEpw&{#ML20Otm*%@0iYXo?(Q~@vgaxx*tT}#WOm8J!?cYSj#c!5@`J4D^ML|Ga{on~y5wbJ(F5UKLl>iu<=!-HW- zXhCjqFljq_pq!dSWbN8qTGtY-Yn`_#2R@JCb-U3x3{(zB4SO39{PXbjD|OqUo?`i{ zqZC+geGM6I2&kmqp z9y@<*H5wZmaGsqF(&YX*^|<`TE)B4?=M ziIUE_+r~JU@cR5EjB>h)aVoLXg!k=6BkiOBeX$Ry17{o%!>Nz_2IDw86p1`WId>xX zc^j^zC?yRoQ9S?gsI7=_q|--80uXM}sVQ0t5|H1q>u|W1W&b}qxXupI$X4&M zCk6D+1LWO|7)>G{1mZV5qoGed-gYl{4LjO(+X;}sTy)g5?1v~yki8Jo^tW#cX2AQu z(gE-13biE-x7v-ymCX?+*DbUBqkxFXw({PT6W!$2QWJTqM9m!$-WVK|Lh37Yf5HO^ zMUrkp6P8;y%mwf<8ZALUIq8Q9Q^#H^NoEs$*uih-bRad~onky?GDrQf=eNRy3$+Xe z+_H@ikJS*FBH0k71GA;YW>HldBfHC|*Wo~)u?lWwea&O9lR%I-u-9s~<8iD+V58yq z@{?E^)*R$QDn(g-3>+b-?xqhdNOf^+yJ1BT@_j&TKm*;C*8qbv?>Fi1w^1x&uvYO zd4{~It`!wkw|L=?6dFcIW(!?R{f4F%*u|r#32rHRu1zmFc$ZpHI5}@LTJRd(VBk_N zDWXVGKd?Ui*qCb^xUI6S7R7UIWPZh0vxV{NU9Ann9Z=+4oE;n^z zR=$c>+Hf*V@3^z;UrS%?wyhSFJa;)>?_N5TrkWh|+;?f==!?+Ix_Xo9Q*A;!diYu% zW!yTtXH}79TS#`MHO5HV+dXLhqxC&ycZm7em%o~d5-sgV#PrM~;e{yh!ji zoJ7@gW?S;Pv-qoBV!8HT593g+q(p23WpJ%GTQxUd%QmH6A+-oua9gvSF=PTf6jCEM z21BDIjW6Id#OiK%_Xe@dAGflfn?p<9{*bc1A-vPt<_}j_ z=ly^5zdyV9>G0yk@eBEDGlk$t+aHn`l831;kDU%!-41(>#JC3? zAK!M|?`gIK4Z@~6uzg62%9eZZq}x>;kk5wW{&P$}FJTNvLh1JA2)Y+1Y6NXs1>J3sC3A{|h&+e7o28Kt7`GIjm`;!QT#FPEy za%u8_lixAdj^_w#Cx)C+e2f_Ob1sAd7I)YLn`JGu8;$h1g6^sE)FMHOE(mKDXKSVN zwO3Lh0J8iyJxEj7yhhPP4bWe{Jb$7mbM`3(oOg_OxpSnPoRXbZZll}nb`SRV)qlI) zZt=f6Pr6V3va`S6eY(51ySv~0OLym>d(iz0bk~C6j3<$6=wG@kw^c;$5AqarX%7iJ zQu5NK;%}gs{HV>J9^CFWP#mX!?sVG+?XMd?j&bDU$Rlz+w9BbS!;nU5t+a8RJ+N*N z&1~%f5mIg{H;DP&0BKUG&a}Y1Yo)Mm)27?^?fZt0xyOjw=j)}L2ii!ZF^-H0vaR}( zL_|zlKEA~Pjj<1x|Mx1pH^BtD%2lZW62cwvaUiuYz4vdtu44>$lm)(2r&MNmAr(1+ zSb|;T-!!W@2WI(iM6h*$$i-Q0SD06bF2UvUJ1op--BrN3Z|DU~oZ*SXH7Dn;? zw?758()Sm;zev92(xrEIKijd>)@L<|kL|Skyxn~)NQ5NR6v0J6PTVBtv!4ey5+DH* zlqkn(&1bE~B5|1+3?Jgi+81heQ?rz};r-yFC zBr>EFF}h0`oLm=k9WQ43@4oodKRDR?aB%o^kS4ROYjpdbWRVzJ-9sOUyB4?lISIG= zK)xuPBDNL~>*cKAi*3t@NE2I@{cJzcyaLT`Qg+3e>{iJzuP~2_WXJD{BZB^ z>B027=kUeTf9xHiXn+6d_~5&P$#;{zt(meTMnlj$*gH7r?>+DDJ-^&P96tSSc<^HI z;_$`6!SnCF+y6hkuX$SD+2fu6hG}ZuK5FOx{?nY>U+I!}m`b!js&9HwTqzz*e`b2P)0Ww%e{&$DG5%lkg1ZNbdvyY=XiFc|!o zXhbzXuv#e*=v4HXsgItzW|ww#T~XisD*SW-6dJ9tLsnZf;nl6#33jI>%MBF5vxQ4& zoXj|OvJtLrTUZT2ueSxjqetM?U^b9{l|diM*IZ9u-0F(|M7J0DJ-4EOZrZE~e*1k3 zSdvNN)u~oX354)4OcF)G?jRQM8Ov zCawWC?*h)hfNdgktj=MgPhfU9JQ1cTWRtnblfc`|(6rF6?9-@-Oz5s~_u19Hcqr?u zVac5YP(OEQ$h)Vz90d!`5_<@P_=z~21V`fFg-qp3pbqE-w6cKMu`=QHDgD^C5tqcm z#ghvtz|bO%Awz<4M$=-p^Ilah-3Y^3LMX!%>GPwGKMQXzUcV?L?37Z}D6s8s+L6ZB z{5Btbk<*3dr^D*pA`${$+Fhjwq%NQ)U4)VyEyQvws))&`14uWfFLz?3n8Z*zkEmU- z19#P%YD1q;&={e#u1}cFC^+K(S*15#TX%(%DNZoEwWV=>0klslt8IN@h2b*4!rLWh z!;0x*m%*9fTaBg;1y;+V)w*k$Er$+QYUmG@It%!lbkZ zEL)m@^nZ|szbD|i?Au#)r zT@}Fvh3AMG5H3V3YThE#tG2Q3uo$(cuH?S$bZmxf{;NJ-Ssr~EEQLgLj= zGkgOX${A``>34=R%OjAkqTZzy&5n<}943}65g$=;ye4=r#@EWt2&uIOCsUFwlq+T; z7*)1$$^ctt2?Z~YE`H*&dY5G2&C%;q$Ro+9JPz z+kCk_q6{Vxj7fqz`;MkmeNP+P_fVEsL%WEYoGf*N%~WqQP$6vi6*!S ze6e*f(aSCEZ}fRG1d}CYWKkI5^Xz5oK)ySU$ygi4&tDy#ynZ!UM31x^WFPi*e@;yF z$01nUUgfs!3OacJL=_$TvgtcQMMyRmJ{nN>sH9$oOVImP+?LCNS}rhV(>qS4LMhMR zi(Wfn-DTQ`eWPWqH0Mlf12fEDkgOK+oK`;Qb0V}N-W{S_KUFoLQlyI;p3AU{n=dpO zBE%q$DcBxW1li~b7}?kP>K6`ZM!EKl71cy^5uRM52rN_SmM%<75{ez^l%zmXUh-<` z6Fhv4ZfSn&zb(Z$9Qg->W<|)7aDCK8^4Ixhz@m|xj#H9NP|hsUM8VmEnjw$M+og!2 z%JmPcx@*^=1(7Zz9HfEpY~sQv;wuo0g{~;w^sT&1d^AyVgENwd__iC4>Nqa+pK{Ay z5Tx9*q2NrT zVj_=(Q>D3PTb-DzyGtE%pq8se9EKs-z2OS%uF~#yO=i;tmqNIB3Kr5181l#8t}UYY zM$rMHZK>e9xoCVL4$3Jw!7^wklX|N72IMKaFh%6s538IipyE)nWda}rVzB{Zj;cwy zN000-#T&raQ~vr&HZ`F0A^0S}0018S`|cPgyCO1GzeAHb0lgC<+*R2eC$m9MY*(zt zYjBluL9by7iobFzhK)JcenS`<0&Pd5U}QBVbw79ORnw(j7|v7_NOiaTT8^iugbMSp zwM2b6zqT&q216YTSU8pIA`VdULfdplB#oOcV>u_KNKlhjZiRNr)`(oYFTo_N4>bUZ z@0~#-tQ9^`@_V*_BILS=^sMcf5iZHd0y0#Jic%hiT)z{!22}oG4T;^E;6)cqb3)ls zj3Gr-_+J}W5Aja`%5So6&0cRpk_k!~-BmF@w4WgMo@CcJneDZ62Z7|}i>Vjqau zq|ZB`ea`mc&%WwwSEFFS=B24kli#SYQ2*|tsZmUd3Y`3bCdx#Z&lrckBRnsJx^q3= zMTz{KZ)>@JBi=|v7PpgRy8B4QVf4wgZ*?sKxeC@bzU1!bze!Jz-(@V*HBLp8ZePaL z$+#Nyfs0zqt`s{{;TSH`05Z6cp6guqj&SzWbFIH z!@cJcCa&Z$cO|w+6}@;VQJgJOZy!tnyMQ0AlymG=3Ptn#&tFSCa1!-Z1poKnN^o!_ z=-2>4G)QqI-HOSqFWk@FHTbSxSBc3?RGG|S1}6+y^2(2f3#gbRGgX-n_V@dHgS{=uG!t?2 z-|y=Wmtv{DMSueHK(0}o3==p*SqD(H9P+B1$Zrf4b8Z3C{9Gj8K$KSES`nfw7;oNQ zz8cDWoR~dU%G(@)$5!FTMyN5SdJ9q3*K^1!D!ayEnMRPI3zk8KX15}XTn=Rs)d?A2 zsyHN6l@uAr!c2C#80VrpCNL7OSVm%TYGbs%`$&S*SG{0EJ-6VL#(S>5sTY?L8u9K} z#sVp&_nZi8=Q~lKuWWCV6BHw+i%WTOo1&pz)Jd((EO7=iCK5Y<;x7qiK_$K(mz5s_ z;qWCefOe^df);iv7r0(tu#-QU`O8ugRg$xnxkMc9wPOf!!xwh+epfB(a=BAyal1x` z`SNXp=+!{-Y>(A+LmLNM_GLnB9H{!pK9z@1!sgCgFaoHG$cRH`*;+=qVyX)1UEcs4 z$rVtg;244tB~vDCy>qB{_~EFl<5i9{x{+I^U70dSXkZD6(C#CVyG#7m@bn>Ha1(~} zH|Bs^$k%fx!y%+HJK6}n&c7(VDpVK(4y6RGENw(&T8S8&K!X3b0xf@80#!@t(&$!8 zy4NBXIzoJRIKZW4LGWWB%-87F4YJI*$3HUy7Q!1M2wvT_@=FqbU!&V0=#>J04^SWe zDb)I&iGnQK0t1yYs0ImDLgNugco!mS4D?R``at5bUww68Vxgv{ewFVm zcMb@j6qYttoem8%8A$s}MfyE)PjH#c$1$BMHstrF-k4huR2}aU#2daqu}D=S(#STg zn62q%oJ9*sK}Bzzbf&D(Fn9rFBt|;((xvhDrpK2-oG>w#1q3^!ra;e@7d9 zsM?&2w|AOSNK_rCJd5yau>s>0Rem3?cS1NMBAM0%icDf8MMe6d4wSGEg_uPBMGjeC zIHMR_3J2U?yctPJOlG$iX@+2QOcJi)HPpdTwJ5~L$I&kfxO;7`D&tnl=4XYNfK1l;Bx3)LLtL+Dh^tP;Do#( z>_V|wF?W0r`DRj@VUl5XEBt81L^@M%4FBIv$^uSw4Mac9kVq|Hh=U4%1y_~9IwKLF zXtI>hlZ2rUfgDlq2cz5Ut2TEZQN)CEL-|X8O0quW)qV5*Le)5y70UjHW$+s|S5my%ra=Dp^dz@wiv$H+bCYQj9?KK9TguSFn9`-@q;gRX2?s#+G6eg3d;9LeDeU?8 zVuKm?R?2b+3LYvQ)$q^OK4dOq>aCtjip@TOhIVXe(FRSBR+!swgra;#N zsv)7WpE%F;W(mJ&E>??Y(<T zv>Z4|>m`2iUiaD0yX?zub{`p)#hV@XZo+Y?biN=P-=@*Rl89nDm|osz6& z+t%I5;7t5lqdEJ=VxUs!uhC%nreN@cd|_O{+P=~9Exq7EzG!Mx1c(*yN-L7~MFPMv zU_-EfAWs4JZ$0h6X}lY!HwZL@(Br`oJ=Ofg>il(|+jXU{ov_B}J_uzuoHmUP9& zPKLC$#tL}EPEc6oM1+FYJoYVvZub$mF#7K_{I;@#S__*yrf7nE}qE1 zFJ4fDpldMn#VEX8(VTRAS6K;C3a~Op;HeDllr4yKg`Ce(q_$`O4TK-yK=@&^Ia0wj z(ompY$jWO)35oEs-GirlmhUv!78_bU6pG$E%A#5wy~3j!38?ur-_!5-z;R(X1P3Lp z&}_lSDnc#$A%?T+`5i2rIkdYh-xq@^FRj!&={KYApwQdwYH^uH8CkC5g^jrYVhDQu z{sMmJt1F+Sza0I3e{XLOh%Z;_3&-mF{b$d5g#(k(h}$GDio8m0eu0^G^Kd%&E6+@d znCX)1n*t>~RQr0&bi$y^|C3v~#ZlxC^jL82#tjGOKkm~h^#O=_pfOQsj3nUkZRXJ-a|gFBF(!R zS`RSJ5!IOJj(yIH8KR8$V-m*5st+?{xG)yDnXuNlF_`$#<@gM;Ik;Gk^UF8%QL7we zaX2Z$hD7$myf;-dv>!7MP363!;84}4PEjNC?5O5Xrz(agdSYdVk%vbAVZQoLqmJ@y z?Dc!DYQ5eQwfw5I57eCvr)Y1PC@8?Taodu(h)#8tEaUhINJynSu}T0;3!9zrR+!8Q z$*(%lD`Va}$_4;z&(Z@vH^fy%GOjp_07;6Le*CAr$q4-az}plh7Yt6WcdP*`C)8;k zHPeZ)dC(?eju>^!-eJWLv9a?!5phW8vNRCIt$vGEbW-bnk=OWbG6|6a6#rR0p>c36 z{?qc4<-dpEyB~2#7uugBcPz<0pG;{}5$3vSUEi<~i`vSY(y$T(n5ILpxb4FRO11R)!#trttTwFD`G6DIbDWQ8*td8Oo#I2XtuP^I7S&^chd> zE8j5%Bl9NvQMdFJp2-P}`y7nEzFNmR?6cqtz!!axOi&^FQ)Wn8F5rxrK7Lc z5zDNBT7Vy%SS9(2P)-oAD>GH}H6S)_B1Mk6Ye;xwNRavxq&`k<{nUX=K6_gXyu8%t z940dvGAVD{okM0`@gRLW%M7B~0aIWyg6@1RLgj}m>Rw!RA#Z<*GxQ$D@$Mt8*JpUb z`l^{J$@=CkO!|5@m-nxa0G2=S{@y_TZ*TYDsgLoj+ES)BuwVv-bWnB!c~PLadom>y zf$fB33$gMFV@MuEJyHwDNbdS~O1z*N4S>K@L(e2t#Vt6-;${|6H=Dy-5sj`=D74o_ zb?+2Wu7>B%(HHW!?JZpucTe;!OT9NFK|Q`b=pBpMaeCG>wiCrmk=c}@$&%rld~)Y* z3`KUjOvcPAZAx6haz>(VMcEC`*b>HloKoS(tM3g|7cJR(qeY(~cq3gKThLV6Y|Id< z{5DUmqLgYBYOkXqV@gaEaV-V7d=?-riavx?o4Ho(@=83xG+PP{6uewUGimB6oFLmA z@Mg=z6ffq1Z!|6pF45R)XoGR65tCSPgC=4_!OY)lBvp7lYG2S)he zT~ajr8h%&>N;S`yNicv`w_d|yhNJ=DC(O6*w?B)Um~0q1V7i!sM$3u(dWAfB+=cS? zz9>Q+TwRDGGiSyMIbrH^R`|+L{oc-7k-yeCe~yKz=}nGZar&X#HH>Ix>LO9Gd`?$1 zzgl990-J7AV-#?;O^&fHM9%aW1vm`}GCaL+Dn&*C*VmdP!(_nPG#M6U9};Dh5@p<% z>=){uND0(K4va6714D7%mrra_%9 zFJYTZa#3KoTAGW3Tkb=m3k#d3R2LfrJviBgO@4O{2Mf;ngcpXo`4>!iQQ}o^(u)$o z8q;2^PqnWg@kJqn?s@8qVl~05&8o#%9KO<-`~! z@ayJQXh7{DyFznz1w-X%lV4#oOtnUag$g=fdEymI73?zg%37O(4JTiz!gy~JWmx00 zPO1#oc!c!v#nWZbss;Ui43#_Kgk`@DOPNuJp(|-dKo`wvGaQ|+)XCSBI>UkUL-LHj zaPkcEth8xJn`oPxX#cX?R*+J(-55!FAGU zc$!={p@yf~hm;!kCZ&eySFuu34POIYrPc7YzeZvWUz2O4*6=mDc5)40!+-ts8s>t( zVuB5C6P=~l@b<7yk_~U8>!sQ7HoJbJ4R6zbgH#*F&TXw^8+H0=K)Q`G7^^4TXa=M{ zt43a;2s) z&KDk%Q+)a46z-98rKhMHxHS?~cmQyusHg*=vm_NBPBzn2)N*iOq6$wp_cv8VX))+9 zS%r1r7@Dra2~O7uD;%p-tCST5kn1I_@KLBCZH2LeSUqutuWx_qio!16I(dZwu`7K= z0n6G6EUG=ZQdrb>xMC8EYR|qj7PYAkpE)+ z{1=T>{VFqH*bayHAqR%BVd*9dM#aw%gyg}n!DyceqvR(nL_D37Wh|VBAWm{OSZik2 zC%z~FwL0OyV!|bh`L&N-LbG`I3)11wBl_kLKoG;p!cB|m;!tc=CT~c-wmldNjfwa6& z2ot6#m_({5S4ns;PXH9wYW`aWv5Rw--1wvpHwM#X9E)-cEz(%W=57IH>aMVt1+KYN z9(jUS^^VX4eap3Q`g>V2B5ad35iZF!O2Co+nCoO}qyZD(3xS{A2;W(&P!3H^7g{Pk zdIZi%jKE9Cm6Ic(dWCSR@Xp_bOExDN{!_}}Yz!xY75N`F1M)YT?S7pj85uzI=<6K>&(k*jtyLGP4c=^R@4>}s!a72r0_$U=>v<@^g2N&^mc6(ozMmCt26y={(B znTY0cZ_oy*ZMsv!Yg9pOlv|U^?qGEQi?i54hGv+u?6x#Ss(e2+hE*Qk>I#9ar-Wj0 zI1t{xt`gJ(gR|hKdD(5eSS*>8y>KRzb>}|PDB20?G+oBA+VzI^&8q+rHxh;yFE0Kvr-rts^ww=ffu?$aK>&I)6;)U<8 z7kvF%QnA6$7|Ke87qSUkSgV)0h!&ni01ESSe*!a*R@)5_sk+&cAbq7FtC5%Gs=1V` zRCWqOyE+$ZrFyL;o!z1#-%1Vp#8|cd7ZP4F8BpICMkT)X2K!G3d!`8c$AbjhkOb4* zU~2Qf$t)|sSJZk=i=4}JL}E#wmp$gQlv9LGGAQyn@V!aTQGmBN1igRk?>+6g#lZ)b z!J}+uz$UGTBB`JB^GP99E=-cKt}OZB_5Ug$*)7$p#98-2zds>yj3#nlawQ_D7Km>Z zxy)6$fvj?4oWx{yrOt^-gn+I)4QRXR@qHL;*p&QNvBDh+_0JbYV zi0}+icEz`AS3<97S$~x}oa({#-b37k)D*|)N|p{Nh!e_0AZ2}7oJ8mYCIQ`x0Szx1 zlgV{MIpuQ3MfH`~&0a0gVvMpY4?oZt-XO0~kzYkt&+5lHf*Bhl=opLqQ_k6SWtcL9 z7G4;9CD03v$ncvV|Kujns-J?AQHG*ijz4Z=Sl@88xL)`gW5q*4{41Dml{E}`zEKlt ztxh}2-iPY-1g3C|W6Ut3Mri<|jHE;GTkp-Q%d7LFUwgk7A2S4_w@G|^P6+!U&k$g= z93J~^==(LhkB4yXziK$Qo-FNyxgEPnUs!jwlU7090X_Xa!@KWew5cBJ6=O}^)w_x` zb+^7ooTTdSyi7<6X==mc08YWID8ts0~oRuSCJq>gg2kU8nohVpO zlk3I6dKz6n0@l;;R}}x+dKMYlpgxd(O%lvVgK20&GDN6hA?nMFW+W^5HLKRjJ~W!t zcByjq6wJpB^)l{g?j^IaH{`+OnU;VF;MGnKwrI+ z3b2GioQ8`Ud_2VYfXi#zYSaWqP9ghiC~-0*Mn^c)oy))F3MFi?Fim5T29QdPQeRo3 znb>JN51MYf~8)og4dKogsl3Q>ddqx5f^AES2F3jD<`fjV1j0} z*-Ahep;DH(%->sGHAZ{Ot?@3)5Yi;ppBzK+$aq(F#mq5t$72;WMfg?m)AkazqObzU z5qnba3uis6sI~hm<;XW=yIx3)cjwC(IXq9dOr&@j-?C?y%9lMn1tYE#jGm}tHVR+} zB-_Huq5QBZ7?qBSN9q_zwk_-lBM&6mGDdW?(|XM;HRD<{^%#_3&lmM=eR+>|x;{rS zg4AeYr|rU8f~s(4S2Ne}gjS4V-L*zh1Sly3T=V%I>J zV=wv^aktnED+QnrV2m<0)b^DA33+cs#RBvp&4vJuDN5M(GX3}m8GqkXZjQar;QQ~v z{*F<6%IDfM)0z=iLnZ-5Hz*U1=h6k&!GNuif_bbVdmGe+tXMre%Gc*K`wOvS` z8Gw%;!RX`15%~NWd?SGwSl>Q>7T+)h5qY0Hwn14gq!ql7FQIdvaB+Dgo7wl9bEsk{YLA3-@kZ;ca&-Co&K#MQ2hsL*=bcENo+ z0S)JKFAvVm&z_ZN<%)121WGH>fNQoi&)%*lluomOBa|?$=M{iGE*cyJz$g;w)9@vMGYv8=@3iBe33(Ixhxn}3~^$%S{a|vwyPD(KFBt) zaWcyg6%va}Fmd1{J%HaP@$C;8SyVkrMGZ04v~&M8qWO)NN@9p0ORhe}w<>TQ^V-7c z6#{YN&}13I43G@Za8kz*0Wj9^^BWHnOW4H$gN%sd8m~4Bpd1~JhB}Fm)jUjv`LB5q zUzbC)O?TEr&N&gzNJQ@zBN;QjCN3&nlvo>cT#n@(ln(J$fjhMK{H*j|GqVrMF4Ui z*23eOk~#+7vDDeiQr*I2FHH)A{EPa-w>CLDs;sMa7m^a?9$YJ{JYH6}+#1uJ`g%5o z((1V{$ZNdpFOaCbK1L|Pd?{SA84)3OGGPIKL2;xU9Aw1*6M#NUP%8a( zPTpLA?UZB;JUgrvw2PdOn#MSb}m zvsir4)*`Ecyx5dvi=I5b&EG|cPBJW<5O@RCD;-73x|k$LUhHVNn~tRY^79h~^pee8 zz#7Qfz#c8xoNK4DHQO#-543}3;(bO4JA;(ICs|~D@zc&tKi-fCKM*ZhWgYOi2zg>y zg(1jb5|IVi-zzTd1~5+NFj+28h9^Km1#lh%-pkwmTy)dZqIfOjlsL}YszbvHUbpKh z>%0!EiNqcHqToJd+BHB$NE?|Fywr3eyrg_>S#*LhZ>ue`yv~YLrFuNEzok$JB+f&*P%uh- zb`sK%Z|^wjYe|u!t#IZO{Gzw->iRvSp+PtF>J@Um=OLT5hP0vES`ygFi>(NGKNzwb z0&kiB>V;MrG+M2-XUb}lCn(k_lvZ14jg+UpQ7(Z}0>?ib-`Tj1!jQ8;)uD0))iJ)P50OnLQhGbWBPO0?g zE#I%E`I;MO|M|{^K{cKFgE)8)2j=&$S{zgofP{zz z-`sQabuCYO=TDiJMG}%CJ9Vwn^^PI{lS<+xBGQ@ZOq*az;s|A~O%UJp=uA?|;Zh`C z5~>+Yyid%hEKepN(8R#imiU77dV z`&w%+Y2%h_t&<{~b0t{>L+H@9g(JaqiB%Q}96O+HzL1H)9cDUMMBc}zNp_S3;Ja$@ z(p7aP*^l7hrTuQ*^zNFexSCkEfL~7?uPZXVjkug+3|aLzF!#$^fRh{R(1sJ`7{RHcAEeKz7Ge! z12E_A6eUkG{)106MQ`s&vG80Ou%KvXPv&&*FBt1*85Q<=nPEQ%)nSuwStKnj>rf=E zZO}H~pLLxm@T0{g@F-XW`wC3+`cl_`GlQ8AO(;dI#C|vriU=d8V zHpQIXfHjSjLjL|WNS($S?ZQlm=Ac|47~&6Sl#OtSqDQ4BbTWRMLYg!VRk#E! zX4RdmU6_@4ml34I4EG%}hjRN2>GZZl>-7A5Bq-d6IGQ-y_D2C#s7cC()El)5i&s4#BhBS|?4oV|##m@?}h_&XhBLR0A;rMfUv zf5=1Vb&Og-Mj{$4_uItmXy&bxC;Ntzqfmyk2tfky5O5=lj#^^^PUC>Mjv5RKaOCn;LGl{3oo>x=EFjP05#>WD86gKHpFdc-}M_+SOnlzaAO8GAzs zPuBrBace$eKgT}hOKr1{==$T8d5+jVNx{4%g$&dWj-!}`0iY&!x@ZiuI1QnkNM*ZEN z{R#FUl^)f0J533bD0|c9i|G5`bPt(P)+`HF<*`ltVVGJgTS_1PgSkT8 zfcLHl%+a-LEQvj_*Cjegg8Q|d*IAtkGXZS7TteiSI2_VV(CowqSgf+#?#Uxxz{m6b z&lse`!?m^(%Dp|^1L7d`mgQx5@ak@h;6?k1!aYpv*Qw!;Z`>G;=m}X83GlQ9VTnU5 z%4S(E+Ej6B;m4}g^76Dj_c9E=s5)Bvv!c!*=6E8}rcOKt{#w*QyWNa@kZdKA2h7u$ zmCUtQ3B*IjCV9DJ&BJFSrqABsVR?gagj9(9DV7zunKb7KMgE2zsxwc!+HRmaJ=I-X zJ|#KzM{c2*)Sc`tAlNj5bqt&yOif6j@KmPn&&96I2+Bw327um-a&B?#{nwFq&xQ;uhBgH^mPXf9YM;a^=QW~%GkZA*aNuf45oHi zvkJD-UF?&GGBm9z! ze{+7b{iCJEz0!#Uv2nPT z81SpLcW@vzlpXh{UTxg{ah1-qWL6fczf#@SpS&uC^buUod5m7$;NEdc^ScYw>TrayR=`$ zr!#_RP}5Av7F}(&UiHe%SCssKimSeJ5rx?wF+5?bMAdgVthbF8)LuXGJe>#7ahj@= zcAd~LX|<4W^bBX?DgjoF676dZSZR zTe1OcOxdw!Eu#&H<^EOV(fJm|>icaWwaGW>$gp9b+q4hWvnPs2n*z08y z2mj{Q*V=YvXz2;n2!M{g`*Ap0soSnK0JgmkXlny>qX7aM`uYNHjQ~9{5p&madMPz! znON7T2PnguEB<{qP0eiY=^K*bh-0EJkI(j3;#0jCbx4a^7ph@4*Jtp8Y{W%A$2Vtl{yVcoyJRhIO%u$mxf1v zQ{7~(9fo!KcK;cM9lMp3>%Nl+!*gnwst7jQ!=lDnhn*SeHHcbs2*fXVE9+>ATu2)0 z2|Vi_9mG}Fjl9&njJC>I=oQF%Hxl*`%EY=cO zS&6@(cJp$>Fnag|RP|3&HTqL#WGHQ#f0clzTfj7W;9VUhH^iU!T+y3-gV4zLzt_tR zcXf0$UU3u}f9(lw`{?NWq)`j(_-Or{7-iRm02mc!FhrV|hnZd-qlXlsmqVP>^$+m$ zMVr9EP&$?5!ch2D(1)Syt)1*@ZBu97OtPgPjPg12X-uOaaAP|}y(*_7?6b`e`Tbx@ zIOXeP#DC-a;qoj7@?$QKFaE3Gc-xq8zT-L z`~XMBD(1~`D@bkd7)igu_*-yKkdJN-&~t+LW_WXS*8i>AdpoL6^VyXAVf3jyFQ66h zeV%QFd!cyCVC*iMbjUk}V>Ua}(4oPw!sl6?k-nV4Io_(8nLADQ4sSsaFczL5D-Yt2 z&ZUh{R{f#?C+@GrUtauGQF!#*6ss?o+SH)gWMSAjU=Xt~9D0|=&1nnl>q04Js_yf$ zckyQ;H)rcJnKtyc4`+bJpb4pJ^|7D+i`8mt=x49|xR9mt9G-UEYiqUpwKWctN$bUP zuP(Sw0Wzoe^FkA#Z!Kwj@7%f(pjdKegJ2~8P3V*M1^6CVg8bOa$xi4)hJI}YeHFUM?8JpJhf;6s6*i7GnmEc@dqx}02OnH zh*RH$5k7PI0yO~7yB6(Dd5GJZ8_cTlk)h7-hPsH_i+7J$;&seE2d0y%0w!~^t}kpx zCfB;My5JXMU~rzB{+wsJn+2|PYcT9iBWyD(589Z`nUfPmXqSm{>eg5aMMP14 zoGM)iO7w`diLb8vzm8HZegB0vm0*cR!_~xPT#zGsJ}vU;r46Vw;EpkPX&g`BiBDmf zlN_7pv-ErCaGLgD6q{`oEOvAp;OlNUi5SQevOba{)&9%EW{W4tRd5d8sBOfn1k}Tu_-}f>LRWVXO zyeoXp%Eb>06{W}s$m@UtY6gP*7pMW!W8H$i(wVJWb!G%aT86kE);mRS^}%^i?%N;S z=eBokeTTH1A6QUZ+l$G-1GIZX*0TXJX0<>1fKB%Q$M{XMM50VO~hqx4SL zI@Gqi!}>0E6}zt>GHgcc9`*mBozs9f_*M%(M)5Kox$;Z5ECpMJ7`sqB4C*xn?^%BL z)_Kn$vRkpXI2|9ieuaV3-|p#pDL=-`?D8rT^Ev zk!Ng*zO!)1S8oDE8E1jaHxg=+eqX>fijdd+;{CkY)KO$_36*L_G+6Av)bGqBa~OdD zh@VL%&k$nfSw_G)FFasAqY;atzg0LyQ|X$ai#ezt))cm6^jX6PU5(n#jJyk9FWL8C z=kNQa6=I1(%AAqgWb%bM2v--Tg8FPx=8v^9Rp=VPdX6Dq?ok&5Ez>o{>Yhvvk!-Wk z)bVUBOg_9YIi~o?o@OB<60Mti-!^LvkAr{Rn4YfKh^H|+Eo7mlRq2#OlINTg{BuFH z54;Mz_Vk|7#f^^f;DK1N=@J#W@G#{QPuY@=_5WeH!Ti2!anWS-YeV2<9JXPHrP`rcw0xzL-jb!8W9l)5scmz&N7)tMCZvNqs%<)JfCh>nSkla0Rg zQI~ONBdAZ9RZLJYFwpi~*86gLf1qVl@!~MMAmQ_iq-WLq7qR*5&R2Gn6W@}2c#ek| z{O5@l2paQKP)niiJ&6c_x|3gG{Z#Foyy?rDRPxN;IfJR3gQJc&b(xV+JHAd`ms|N%AjOT zUZc+5bnoUu?7>)(9wTBa$C{8%#v=TUG}Pp;NxoeT=;agad_OoTA!Ou>y;&F5nR!_a zRNblhpdG%n*Wv!{IpE{$<>vo(eR;lCvh>sc(9AfgsMi59xN=M+PB(6RS*!7HZ_^a6 z#)yq6Fzn&!>g4mgO2Icy{IT{tqQsD^4!JZ?1dT}b{0F9KhqdURj%$1b;kfh+-Z1TF z=i&9$ebqF@XQbVnw;&d--CfYID!A#uRg_BkVgTMPGznEOJMrYG(=;L$cIrIWX&7a( zF9WS1JIeskQ-5UaDY;QME)Wo3@-?xCrY%sKuIezkEwQnEXtK#|VtFkZJs|Lj9FQ0h z6lP<6oS;rsz# z0iYa`Q6*_GXnS^wM4&y6pYqQ?&w07Vzhy>rSoBWCHzIS6Q&)Zu3zw^d4Xb42ZfUTt zg}7Yi_NeNuV{ur@4obmPwOL>qN!i*)X+D_{0SDH%&FqWv(~C1=4IkV6a^py`KUSKC zspV<#uKgjiS6IbxSD)XwZ)G`WO6Tr7Z%6{t*>l={43~%z)y5Ik{T-n9+pDLams{Mj ztBs3~D@ybzntsp9gH2nh`=L+flp!1z7GngnvrsxaKB`%4~l6+vV+7i9Y8&5T5poERLME5v_k_YP(iGM=~RES&6msYD^`mj8$eUj&Ctk z#ACy4@la(v(c7Gq8f^Z!tIel%d8k?0w1G;7O)i{#aakNi3olC&sw6X~^5b!)7r4jc z_9^V8ejJoHYFG5DuY5VEeYvlEMn?y@xOus`-#zcV-Bnlr{4ovv_WtJb&{;nNTJck$ zV^2bx4h{}>AM$qc$%@cGGRxCGgFgeOEvV1Yr*t09S)_I@)1ED@^YR zUp*ChxDxE~_*h}N@~u0NbJ(&0Vl{M&DwSvLXJn52mHx2Eia4hVa=_Q4*W}QHXHCHw z_O16e&)GA-H)edM*q0p>ER++RnkjM!dH12@jb4&~yt-&dfTW@|O0YY3puIhV-WqfH zvu8SJWjvD*2S-ao@V(csyP@l=Y%GT!c(BUkG15wtzm(E2 zj*>Y_?F9Q>t2T=()_EM{)!}mZZSbo4Y?nnoq`DJ^EF1}pRcKaBZ3&+Ea}e}o)lFpdeN{r4%4(9Ee3#q zqH|k(QB9-|&oQQ;<&`(e-3=W&yD6HJv1r`XWSzg(P!^gFC9x-3R_a&F698`BWjt8Y z?A)2di5Se^5~i)9Al}WHvBr96$$g$6M>XILq?8<2Y(RS(x=K}{38U&pt3du|+ct(n zOB8^;88gzifP$MosuRH0&n|cz;6s`4uvrJ2RrHTIWN*jvw%Sa~b?|&#dKI{z{{B@R zL#7~4*dLKx*;GD~V+ zzBVQoSI#B=MbkS@M7Ik)pE&062rraKsY6fi^uAj(Oju|i#K+fn9Wt1tau%-=F z=>R@z9(zK|QL^atvIj$-vpXH@F{zMUq<64U`BH@H&xu}|M(pK>PK<_M%E(tJx5yT) zamy7HUk&K-qn#vT+7}O27EkZvN`;hJC|A>cYns6-$iAHsJX9(F0(8XZavX@^p3fIL z35Lh$Tl&SX73d?WPo%^=j)pNe9_r9Vq1^3K57bf&IUpPi9oK4X3s+35*VxY~oi zcNHj6{zwRqrt^r+v$5$oI{PK`R6E+Q*i=LZob}8Np|%4kVTb=&NwYc|s@dWSEqw__ zKth&%0e+mqUlCsbeLh+{e;9u*!_hEkf>Z_=okTF!5iy&wsz*5XxDap=7-;Po-9=liDb z*PZW;@mF8WSmXEB+u0L);M>U$RztfBPgUjZfWSj(YXgjkc^i;couJ1#TnwuEY1#`h zLGP{jo~RkWFYb=4P0^Zzn;I9Fz&cEj9$HAL^qt_0;wOj#kf{jFg2=<`{zo_6d^r+e87#M~N-R~sN zNQVQ^`Vs2-{&txbHprDa;k|c@WQg{ysg9k-gWE)j>E3nZHpuwS7*sMh)Lr4VYpY!GW_HdG`ge z2q}L!$;g*A{JSLcO&QrkxzXBv*!N>14Y%s|QVRJDc)mO{mi`vx^>uzF`cH750&G&t zTvd>bkFejQgb!F zQ-QsX^L$-?f&)|;nvs@ytIhiA)W)OdiBvh_6iKdDzuZ@^H3ZGz}A67i*d`dtIoJW~&wi?<_$=enZ! z$Ede4S0smK6}d_c)BjgSze?L`S7$ta+D_d^+RQ0U@8?{MyFg-CUpo8E0d>B{g`jz2 z(HTp5Wa|Rx`H$37L`2NbSOp9XSuzr=0=j+){E@?0v2fuOqY6{oefDxy+2&4cgZz#la?#yLjR=^xSo0N9E z69U!ohh2El(>~If`NN}9S&>N}#7nNBjuEj$ZPnAB!(M`*#HyJCE}bu-wr57<2=WNq zpO6;&8=U^kEWX%0mWAOd`et>joA{zNGk2x^O+%jdn!6rObLC||$8q^@>3V}j^ z+E%IQT?H}6B8H4gFI}_(%0J{qM0K2pGz#a5Sh8S+=|n*$G9Yw6IHQy;FN381C(_mp zSL+*Rheo3~h~3PXF#iBGh*O^*k7dt;owz2yGj}R>n2MGbdvvM}iRt4E<2&_-mhwrm zfRY#^E20Zo?@SxlE#=+zWpazM&Ne1-IEW%HduGvoJKBO)%XX>{U(vnRxZrN-WBQa{ z{xzWda4g||wX!#k#AKxq76F@Y>Sqp_1|6MLILIbt>?L6s;!^}bn=BTkbhUi#$C0nf2NSy zX>t8@oOxY2f9^eG*PW&C3yaOfkdsN~D3dCDm z-8_~19|Vy!TJF|VUoY>sf2U7pD-+cjH~w@{M~4#fNl=_!;QZ;%N{v3PGx+t z^S`)ljZ`AiX2Yrb2yg$VYa}x&9QX8k{Cy5PZkr`de}#Cr()S2-w)?vKKP_#=$TG$s zR4(FvaQpc9dp-TzxyY!W?b&h9Kw?kKhT(8NJM4lbG&|%G&&e#CXjr_ewK%cWKh)_w zdzIDOJs%ti8(s5=u>AsiY>q8LgZ9QXfD-9@xwXW!GY4r${^PP8k3Ohhm3^g#pmUoE z+xRhID*qDUr8Uzv7_HVWINVS}sAm0m-p4qXQ0M>pb~*-|K<9cbQG-yGTnAs1IuJ|0 zWJqk`xHPF;2m3E(s^nqH(^9jKAkV-cudkC&&~F9i)g~e2hdhk=D*bmg)YAiF(;BGv z`FXywv2uK7yN7}c0~?1d!`R3KZexY8O3{qfs5vpiSjNjFY>7cr9pQdmT+fM-y@S{1 zKt+^bOlza(J_@;T_3EC+{!mSkXF_tPn|*<6VEId5%2laMO9xWHb845^&ONC)$;v>m z%r+PCKe?1;He;JhtJ?Sv$Fy0j_N||8{TapdaiAMf0d>&W5saNfa=(Qaq~Z#BS{}SHppBS=3TaE@p;MMjONjx zom|X{1@qr4XM+-CdXh~6?q*xP-%>|KV+8m8OAe`^F5LXExc&@E*IJxhiUPy%3;PR` z>bF1Z@%Fz!35j!?y3}`l&!(0v;hC{e|GD#srGeWe;rWJ*Ce)-34#@Ll>#KvSt*)tX z8>^Ehvi}s0W_AKjeEpM^!{MMmlCO0D)as`HpKt$L%#b3^_LH_wZOgv^=2INn{hmpf z0u9dAtpRQKMskwVP75h6rL-UvaO5x)_2#yLp|ke#dwBd|UO|8Nr=K-neKS&d)=)|d zSo4shV9H0G43GFJ0D5}(B!{X%=~)vKK@f*bz^VVg;)d09=Ra|C_n)}&*4B;?TJg8u zZiM1#HngGRWt!#6vFSRtG|1m6&ObQQS>wzRNXizJt}J%R1sQODNmHIA+CT6GZczUrsvq-8#=WZXqL^m zv3L~XW~yjh)K;XKhB@LBD6?=!b?qxUaexsDYF;0ws=jiC|0)8#f3O{yk_HW|{`&QF zgy4Z?7QuW0kyXgM-Pa|DKeO{*JZk?)3ugxr4+9Y;h zyZR$6N^5e-@np@KtwJ&pUOCoPQto~y-CYW2USX-BW31TRW2)a-(UR8f4XP&2X>L!1 zr0^&VMlzCtovUyshHqw{LI-tS03B;Eh(&>#`s5K@)lH1dLyCQIMWvR9#8!9}zKIeq zpi&c<-uKH6ts80cfqQKo-SwlFgGh7lbSy!?h&&d1%LEo1YUV79fbGK`HuRipWe-H0 zWc6cwvP8{$11PjPslT5oV=r%yYSHDWl4cx+2bc-gy+?2w1)m ziQ4XMD`s3ut670L0^!si{n!8Mj+KxS{$WH%Ul7915~ z4Y$=Wzd60Ckrcp$oLbQE6%ek~&!5m+VGIa({q*7nyzDMvBEI$A98o_5R<_$&Nb6!< zP|lpxYkK$K`eg<5_P$@Hrs!W1993U`G6m|NR%qmor=4V)r2QLyFN2sX}6?RUnIMQsQWiEPY7ZxvA9rKRySVD>os_$wR%=$%_Ucz{J(t<(PDY9U=8oa^htH1&5|mflm* zPr-35I5jBAizW`&Vlo+Mg=kh5O+1P9--n?^mk^^P*3tf`AO@`-BgU+7a6CT(O*N&8B!=TRH zx4$a@NLMt*TRLKFowfvsuYjA4Z&qEvUV#7Y=K$bEAzyMI?&oG73L+7R=XmQMkHTbd z$Tc_tSL);fZyAa3hahN*yF8FV_23)i6mNt%bHt1e99qFbF_g;u6(S0W@-M$!ajhhg zFsn7|jsh#&2%!?#t|h+oJ2R59PCV;C0SU^HZ}gbI#)};8D>#EfE0{VSdFS0jXs<$d z4`KAy`(g`Nw^VoUyH7WvpOIA2cZuJiDha09V@!es!z9su5LnsM18A18JnNh9S6A?Bc=J9&x{@lhcvpibP9M54YW6lA1RxFE2pPDskb z&L>bQXK3c#^t%jR1>@=$CTpNju`HuVgc1;#lcMf42CDUeI!`B6!K&LO7m%$7C|t=t%A$-0vY}X5u$r zRNOP_Juo@xauRy($nJPES>wOv`x2X1znKw%VyP$C9|#p0#clv=BU_wr)3|o_)C3u# zq61(QMzLIyRbl#xh~?H%zdmP(L^!*6L0CdgyHmvdzqleIQc&=wo}C4hx*sGH`nAJ{ zlW0fa7HVq+sKQ|{5uX8ffW7l62n0yT5dQCrOH65sc*e;Vj*^qTWJk_JUFMt=YY6J8 z^g}28yHX=V{z;JEwY9Rz59|T79co65C$&ee3`PULjXoC|SQqMykHNTuEAgn?fp){VPgzQ)5&0O;gc}>vlkQuFR8W zfhjfP)YSz*_kKO2RP6clf(e>V0*z@B%dUXoK%3mwm6H9+Fe2Q^cwce|H5pEPwL{r3 zs-@{s&ny0w){U)`h$~REyr1p1!cdMTBr^dfTHeuX1j;Se_}j=S#AG)&{PTqLwj^?$ zU8<|~2|Ch;DQ}L_DfpCZh(z5#j*QbbGLH4NOLHTFNl8gBt5WT1Yi}W)R4huV3K;-rI4U?0EC}z?&@5Z{di* zhA7Jm3*+G*kb{^)XW)(s0Yu^T)}v5_^5MqQoYhsO9>kM~6*};7s7O01*jT7Y2IaU!HbBbNW6;_{b_fWT8XbvT z>Df}L4$y(Xkv5h@i+OQqM8~YjNep!sS!ZSarNNVcsK37UbSzxpK!ms@U5!u@HVViv3F7j@DLL6A9W{9#IdUS%~TdR zZs0zx^$iV$#m;v@W@@>yOk|=&V>3f*lb0|&h&Q|*&QUVaTs^^4|72M0+o{!Bq$CYs zuaCxzBu72P4`it^undfR0tDaD?KWLK26bf>tLn?FFB!)-SaRu4og=(#dH%3^=Q(DzAD0#~%3_ zEpcI&m*4}x2RX`|rYdx8iY2WJwyB@$8&g$pTJcekUONG071demdqQIQG~{#8l-3SynY!8kUxk3q&@$3789g>^uodPBqKn$!$!H zP+Ba6G1Tov(H*sB_rz>jlBH~>Vf`>N1dHh5ABH7oED*ZgLz|aC(8A$!l}uG|EDu&| zQf&ABUQ#GgB<|9ED8#jNUg1lv#UnmR$6G~KY?nz9MWY^PO_c@bx~gPgsz$ngo<==>MwuDQ=KrN9sUxi03A9bGie6qd*}!iZxW zHU_4r=A+blZRnT7lbT2t%BTHo#iBojru^I38);UGz`Zhecv&Ylb;TK4L_9CK*1|^@ zP)7eJAgXb$dzPhpKNr*Y^!V)RT5)i@LjK88z7|1`R({=d=)e)2%4w zXY+x~EKNh2kGWaSYvd!n;D#+bK#wUvz7fWrc%Ay;wt+~0`hdE_UWobf;ST4G^~juG zJaI)PA&Bg9HTGAvSGpEF37N=+MJU|vMS@8}HJMn51*ihfJdh=`(OgH7IU}&8umE*3 z-UN=i3O`tJpDKDf#LWOvNV^dslszA4Qy1-i2rwb;8qyLQsW0@iWumHxGYQiI^^Q<$ zEv(n8Ivy>&4V!2aF9WZ^=t`?e2cBnKf?{zSU>Tpk)F3NzA26IZP)A#@DMXA6Inglph_;FJ)R7tGc#J_mqIZU@g z1x(v}STF^Tyn>I=QHk)Ks@G~oC+Jhdm@E~nx1d%xfj{-p)mKri`55c|moDE96yeIC z!U(=~!kIWmCobJHmUz+ya=#GP31k_fMWJ6Sf_=r=Uk)7kp^7 zmn>#~j;N?kr~@ER!J_BMldFJPN-j0@;y?>6$;g?rb_`0fgBO^k+wa3rHIle9s)!QF zgOuGwbJ6;_|A*hyMvmRN&QaF!M+Zx|&4z0W#=0`hn`KS-$Y8zq!&tgilOJa&s2dle zq}wSOf0RxSToo2960$bQ$1`j%z14GW}uod0BAnfQ$dJ>P6?)rSah zLN6x>x!2Oeku2A3z@HkoyoeOgr;uhB@WrSGO_TKy<{%UqW<7(v|Abv(M!*;JgPZ8h zGWDjRJ+rFcFoSo}%rA3Z)PehMZ@uNLRh8U0hU^kb_q?isuzeW7J zOiyvG2>;@y63O6(DloX#-0KhN2K8FEHWj_V#l!b#o^qMbhK~^k-q@e^ zh>X#@a=`lA_P)U27ff%EeHQeeHlRNm6#Y%%#trX{dd?abU7>Pw$uiBj!PHmp2(Fa9_FqvUQI82fyS?x-niug8_z{~6e#+e&Yc7PQ?U66jaU3E_E~IW*6?VDN6Ohc%gQX{mLGyx@;QB0fmL5edvI3jH-#zV4xGOgnF@+{b(yQY6@h z)!$KHD^$QbQ{Iobmj-}g_Q`oiB*vRh$l$Wzn&3X=ABL0rXXOGfbuL&2B}oP3o#b{D zfyMDlN}WEaf$ME8U!Pe4Df9kMHZ<-nm{)rPT<`zD7W~im(!DDo`W{y*lk$MI&23bp zKF%URfBnDa%6|(=_EE17a3tfmvTK%-pEV-INgtaY%Y_j6{DiPaQj5$~EM;ij`k+Js&Tw}oY(N#NM0DngVhSqGeMiutcBL(eu#jI}1ZF^O`7!*!1eN z7W58%6U`0;c-R92t|j$s$wp7hz^t!(p^N8anqN{(^rb33IQQCnUJ$uU}eZ z`?(p;XAy=Fora~DdQyQ|!Qi}0yT|H?7PJ8?%w1!=XZD|x#~QOZ7b}JB)&bovTl^&b zo?4bjg{WzvdOrpg(FNU^LsY2pRhA#Abfrkgz6Dpg92DeBBOYBsco2eVPH!rsK2lIK zf?1s~WfdKk0;r-{tf52YN{vD$VRgWi(j+AkK+F5_g8s}$$jCK1L|b2MtjXjAcb`Nc z2MUyik~HKc+7V;ylMMBZLzb?FB)O>=Sa;X}`^7mh>hh#a5FI^Xj#QafJ=~o9Vu6JH z1v~m1>eBEHy0MJ) zEVk>13-%0BN>=#m&C?efXmwCcRR**qDepFZW0O4IhUKgw6Dhnoch z{y!YHVG2VlJU^tSnug1LFco}Q#d?$upb=tGG^&^XuJK;=u7FTCsgzz z@XY6P!X-B&z$k1tc>mi{JZoD!d!01 zqP+t}P|30{Tp=P%2%brj#_(}8Xc5;W?_HVzo6mC_=XOTtFQF~gox9^z|4w~3!P-q$ z4valQE(F`L*Dj}Xv&QlVaYZv62P}K|Pbt8#jbx86{ zxU!sXFa*Q3@M$n&tkC?T?Y&q3hDk0k@i*KPb=-spL*R%)EdbBYRenZ%8nD5=GmH>j zV+Is5obL_E5<3H0yO*7h1b@eTz3e;n6$6B6_5a4Z0BMb_84v6nTs-DkfH={4`uheu zt*Z$HqFeQ{AmC2J%!A_?bG6LCD+&F1y96p^5EMd>*oOmd<#Nj<1zI+T{(Xp)OIe5! z5zh)9`fk)ZgP{~7I`#&l^Yb=qVZZT%HmJ^_6Cx`lkgY;Ow(}`fKp=A2qA)~Ideaku z1+rD#5dSneP_Vt(3uj5-;6R3YA#%h=q9zd7&EIR1uKsg@65(&zoqt$Vz_eyqKj}Sq zL2&dx@jWj`{az?;-}Cn6z?cX&@r*`hlz31hMP6}TV{Z^bGg-yc+)m&3r@w01Ky53q zs9eBXW)T}a90H4h`G1SF;LB6^K5P&XyOf0?Dlq`PYGCMTU9D3~!YC_gG3w`0(icOL z6)Jb^c{kavdbk_(jrxN~=C3P&16c(YCN9j*X2e3-R>#efcS!u?5Y_da;Gn7PFdGbO znKt1b@Hk-7gjS#O;SNcU>l6Y3+~dvcAe7Z0nWDt*^_bIO81<8bO3zX4Js2ztS@`mb z?1C!MAZTaC7*j8X^3Fk9vS$sc#v=N3C$JY0%;DtxJ|pcBRk9rZnZyvSCv{_LQzS!8 zi#3F2ccJH;bL=EVz*7$dR}4@kuweaLAap<%UfKcf8dqQ*pNCUT-^msTg_v*B5oFI) zUIy(nkmO^H9zVh{2bII4i6?wcRhnK~SC(CO?{P39G)?aZ-&F@ZpW%(%{U-2$uuKn7 zrn-ci?dLF{OP6C{caj)cWf4Vf(kdhqQGTt9sRsG@f{J67d;j?OqSJ)4F;>iQ*1KFE zGCp|{qA?xpEc`fogf}KxT$A~;1l7f-P)5@GA%a~%4tR3?Q+_|5#@LA_^i#PtN*|bg z-D&Kp4cbBfha%#suL#-g2HIuHiw@?4yt@eFp>N;ZP@Sq9Y5uF}FuI!ejfMNqcEc;i z-{;Mz44Lj@?{lLh-}XdM?UPa?C26j1V5)e*cht-vHd5HSHTp^>FY}tE+io2#-zlyJ zWLNsVl~Duhea;4(HlI)1Zb)WV`+5!y;hG`xo*h#vphG>fbK7|A4y0zxZyQtcVIKV( zUD7|C>j6CLtn8ryRN{@%nYHL_B&(Gy^Ek{2=lkL{O4wC#e#q#95t)+pRK%-BEShm? zoKL=<$q6Pht1Ss_UZ1d@(9F*H&T0jpii9?ipZ<&W%weg;Qm>(r)V}VTB7#_riG^k55SqZwo6J(mXCkWJ1>S3~whX8qyFfMP$Cb_9tZW;+@NaTYDq9 zf=RKH{EJU|S4qkt_}_OIKgfo;@&qBKMH3t68`6v}g=CUmH)AtbXnm>#75p4iY9b|c znh_20GjDJb&oz345uM~*m`;u+JT%_FvRxU`#F(^vR>v^qhs}E{J#6IT>S=%pakU4+ z*bt+@mix)6Xk%nCIHl8!+lx+hF`Ld;bfwo8g6>0!<~t~490gDMJn+ z73H6GWmrs&M<%8|n?2aj&ONMw(+CI6Ff=heY2(CTDC;R|JRf9@6H}9d#;}N`?AIsE zAj%P;mHAd1n(6E3Q1T+3CmvQ3k%C=}%k8Fv-pDO2r7_$54UJVlV5R`2j)2^hHl}t0 zMgg6f$fZHxyf~p1jiFu$JFJ27GK1rf#$905hIU3`jbG=uD8nu!nx9ts#QzIr zA+5%@CY7T+f-t87`K#-it0`tju8~S=U_Biu(T_)b0JA4e=h{_auq`VY#rZ$dZ}PVL zy2p%w={kyZ1czXP){ANTOx43nVLAxjrNAjgPP7djCNlo=)2J6Jvzz03dF{5oyCr-TulaBR?uF^(zh>ook4~bZkl+d!AJiR zqLIJF1BJM(a`jG}9wemRNCpU(D#jbS*o>lP6=XIYQMDrol+AF;jRv<*qIza;fX0`) z5BqJI!~M5y#UR0BRt(o=d6nceF-tz)=u5Kq5zN|BG61W>DoB?wigNP;u+W6urC+dL zsb7U(*jJI0^m>yd*9m85`#GGpq z^y|p7rj(kt*mi^J-74Vn{|ApiaKFaJXd7Oteocx4n+}_8(Tz4Rc8yH?9-Xp8JZ#7G z5&meioN1DmmDQa0=vd#1*dR0OJ-Nqc_1?K7UCU?QUvS>F^{!#&-D2LE12?gE!IHT9 z%)9&8HO#!*%)1TrtUmSb-n)jGw`|_kdU9XS!rl?Da|y}j$1KYTT>C68*mILCpfUQ+ z%sWz@b_vOpy2)m8%+yjZb*2IJLeRt<($i=CcMy3OlU#>MJ$rSIwjn>olf9~7T->|% zdFS`8Q8=~&Z5})5 zI885g_sBbN?d}A@<>loNi%IYZ`Nhz59&+QR`6WO|H-=|&5^=`lDHh^}@#LuvLCww2 z9Vn1siHBH_r#R2w+8+P~p$frN>;7=tJeGn;QOXH)$>FLPd!o`d2;D2=a2a_XoOF(; z^c-&v8zuD#KuFvZDY}0VgeUW>!_n z%(*))e{;wc zvo~Qkp=7;TmJlu^&XUkv5F9EPp;xjS1Si1RLUNXk)46{Fz;3Zt&IzcYS0jn|$a5fV4&%Jax8^Ynj5|BC+W(hN1ubI#Oi z1v;%@R#+GTsV^ARH`b$+UJ(~+EDViIgctoojoXM5G0_tvi-}$%-qwrLmi zEJ#y;?NHS6!(yWZi~3vuDGnhN;{KZA1_WK55~i=1G{PDf5@s5+skImP(k$}EGEp7O z^rkE31YJgAa=D}a`#m*#S?bSd{KuuPC`i#OPLMQIa6%xRE7?M_1g?IB7!k^gRwDE> zEE3R82@-in;+X=a1hF9}SSiiel3v7B+@WK!w2|DK+Z^bZnd+a~GF&c_BO9~-ib7t1&h0^q_`jv8mlR2VUoX!#=7A4F)tsmQP-erRXjwQW@ z$uiWb$;#G)b~J^iS5Nh3a$#+NmFw1QNvGffEV8iqQ{09xDKW3ZMPPzhH-*AkX`(s@ zYrRtudUH;QmVUrQirpVJ z7JSJN*6q2>J7PlHbM7F)tSaSkB#hGyr;=zMrcsf^#Jjp<2S?`UW3B8*Tp;PU8P>rI5-59&TIxNAx zHp|Sk*WS({Ni`Q}x>#FOb?UI@wz6eBw^e1eYjxJXIeY#3;_d0t`T5VU&z}9N{aNq9 ztUH7*E1ejIayAr_%9+%&El+VwCM;ECcv}JTw#dy3jxNN8Z?_lD(m?-U?L}LnR^0i*0CTTGN z3~}@#GwhM9=eRH&aW=JTM>yy|2_^G>9`w3;-?U)cA(1zPWD1KXFrNg(ZnVAf432(o$ONsDg|qT7(YO zc)%r5Zqzt2*C7aSx|>n6>YI@=MfMXV$VVgHA&tpl5QON`7`~-^^q1%cgXf%+SV^%R zbmQd}F_ONqrpo}Y#**M9YHGr!i@#knwPf>tQ_cDHS8HfVZvMs1tkuQRI~%j5NxF^tXVo|<;T?5h+k&dG?rvs3a?x2fIt(B!4@^50ZTnubhK+s@^V;!CBC!d_DZeYzBtd{19o zns^7Z{FkUyEYy(6z^{0@Q+#bpCZ)=F>va!n zn$Cg)IZf3HUEY2t@?d0tE7Px~_oIlPn%~B#n z$@Qb=ks>UZ)N%si71S ze(&GPsM{+Wb^E<7>Y))DG(uz9K?R&8s$@61725k1w4dAx?fo*^PnM#+Z_s|yRlKAZ z6?@bGhA_do@hFWv>)H1yX%6Lyspkb0kaQY}iE(_Z!f%H}$hSGiv7|8(Jzb->WkH1c zMOX7R6^@a?8BH?@!6QTzDK54DO9=w>CZ$6T7w@U2TF{Uzr?KdnqHlE> z(4edxZC&d)+JSg(By@ritRp^PirIPZZO_`C(c+M{-jUWm)Vb$qIA)n3zt2b(gUS94 zj<0SoPXw~uq`PfG+r~4@aV7~#AOg*j?H;|4 zuGxx%fHk|_`$nf|oK5pZGu9RAb+s{JqrgsoI(FJDY75(Co9o-wAs{&arD_wVH?4 zsj6RURaL9ugezM_$*7bu#lhBv&9wcixEK(mQkXj&wsD?|?v9hA+t-7x#`KD23EF<< z_UpS5I#NRRDq}aWkEMXXT@F9#x3`0l44%-#~H@+3jHA}5BN z;48xQBrbM+9wU8+1RJ4iN^W+LU^Zk;iIt8KBpoCtOxS+9gW+msLep6Y0~(>{n5UFD zH5_*EfOdN*p^1*d)l}43Vl)|J#yN>)IydTwvT+5?VxygFP1)Vg3!xb~iK8Gm$%k>>TxY&V7U%SF+5e`k zNt4N^VH|V>Y9nPk?4O|2P;7qrIBM&r3uA*rUjHbEg>w_6{%8+p$o4rXeF7Kq1 z4jx1&4c6D~1{K|IchO2=*7eyn#{jcDuJgez$`B-kp%&EhE3T6!%?& z`(D?v;1kV)E9)d^2CSgB>5A}Kqvl$v?pX1$@WPlx6#Qrw*Bi#KFbDOnwgm@7b5h62 zb7_#h^-^mnr59QyUs+0mN9bxcR07M!?E4~wg97z#}kSEEoS-rpJ=zgyKA>}g20sX&ElgR#}i^9>>wl3&~DU6+p0jveCl-n z835Js9L7ZJDOBh{esjvn2&t4}C32lyGa#biUj~5QDuksapIhl^N+B!*I5DDF^RU;u zxw(ljU>Pw!?xnhv=)E{Oe*WtGdAO?>=ts>K&fPYg`$5PlzEP_k9&@8ZP#tRl;WUDc ze&t=6x`C}T@L5V7)Nvp&cP@+C#2N4J5i?t zjANAIY&^qbg2wEcaEJx*u$J3&aEC2OxTnhHmP?j z8}I>*73LO%@5@fuO_nm8h+fLZOt_H7DdtyEo{fVmGKa%mhe2pM7KF;e$_WobB*`>S zu_Qr=Mzah;7lP3CHE_3ca;UDBl0zrX5t{LIg?^a-Nez zWR!&9x-#G&n{_`w8+cZf|K2gT_1jn?|NDc3gNpng^uPQp{~zSp+CmjExV44!Q9)nP zIzH(gKQo>*oI!A1OoSjJQsw_sT+!TW$&lb*{*~ zgF4^7e%(PGz0h>fc1ndroo|lLI_ls5>U6s({O}au=9bVcTe=+8eW!hDa_^~VEJ|CQun%%(ZZNG9D_z`4qoifMHaZwEy`X^p)4Mb(B7nhtuj@;G@Y*ls^^ zNT9=~E?}k8K~eF+m8~J+Re?TrQ616Si{^srYEs*Y2mWC@+l$#aEt))p!QHNog-P5v zEs@tyv5VfLjAn`I?x0_uriP(2Ceb#T=5p>4ty?XMa!xZjLLHpvQTd>ut8|F|E;>Ht zYt4D`y((uOU6J_?dZc4B51%#+N)@9=TEKy@GxZw9QLSN@RIMa8l{_<4i%bsasL1

b6@$axblR% z`*drVY`2_hD^Ijall4iq<`i3Hf-RU*8=FlJqiX1uHlS&EYvJY;4R1;>(=#5}{#)Pv zk8$p@Ag$&BSZx0f2D?x8EB62X?r#6H{r?cpE$n~qjwbIwxJ`Q1Hdjk*qr{QfKPnbE zI&$miIAueemL^yAqYuL`xS&+%6@&Tg{k98abnN5#Ls2`jP;3LOko`$*TG>nsE14!H zksoI{rw~8sHtuw~29_jL@EPpW4QI)i$Y`}O)5$}l0$yq41esnFe$1vh<^*;AeGu&q z!hWZ|^0)Ir)O7%1^+p}tWbb+~BoYrgWwN%F?QD!zCT*(e_-a%tXKr1YSYO_mRz=pW z)#zmqrP(;T`UwFVE@6H z%7i^`j!<5x)QXhyYdj>WOxHgKkxXvy6$xZZw-CoJJ~k75`zH^AE44xqt4V(xhHY;6 z>pM5xBu+OXg+Ej6q1UdnZ;p>^u!#JUy*h=r?$fCBMr?L(2-DZe28!GXd(qxMqTmSK;JHruM&hfM(l=N~d%8oU37Tb+ zrmnzVv={Yt_<7l)R$vU3ciiC+h_KWt>WYk>oj*T(=pf{RT%*85n<}&*U7Twhj+$~Z zChx$_Yt!E#HbQ^?2_x5r1N!j6B?tz{HZhv&_Z86rvbHSE(7*3Rd*(=xNx|NMyQW7t z)+vAC#A-*Ukc)yZzPNyF5Zt6YfedVLHUdkWvhibqrZl6|S=KZfUwpBmQf>10dAOG5 zgGZUppWD}O`r+5VcE5P@e|`A%iw_?jbz#h69IT z4HYv}ZI%ExEOku$Zn=H9h7qZgpj+PJRyx6%jT?5Sr{N5{&>P0p)=+5Eh=s`3jL-|J z^A;AR)iSM5fSUDA=^Q(1@zKe8HS1A{ZdmqMB01sg#x9boU4tbGUAA1my;BT%m+a#Denq{ZG|l~k||{~MzjY}?nV;O|`GENQ4;+xk5bKbrH5{{F)wz|qk3@G0v2lG*d^ z=ji#_+3PcXw++lkbJ32yAA|jUUq(|U&35mIYF*TW-dA6 z#7`=^gIJoBvbUPcGE9blEOc6a^Y+S|P^@QUj#EshVk2mOJLCGg6EEMdNp$A&qhg6R zlbpA=Rdhbo>=(jy5Mgm>SC=;;J*&qMq1l|pJ$B8B5Ka+ zKXO8JY1GlX_g1B7TaC*tI6cicmgY)lQY&EO+KlWczpzby+*sUxEGkGmu9Q-5Jd@V< z=QIa0nAijj!D3`X!RlRj+ESx6>cIP(jw-->XU_rVHayCCgz2(^A9Giaojw=Q=8Q zl+f55{}W|I>T3^;rLELqyHqb=^4iSUIICBT!X@n8fX{L!H(#w`r)0AIyEM?YM0;?V z8Pdjb8<-%qT>+V=#x&I5tHvZf~|2Lr>s~Z4I z_5Z24E{4(E88JER3^Q-EgJoUVh9!%$mj9_(zTT{H7*Gx&U^dM=leM?%zb3)v)zQWbK9vCENgdw)&|GfMc(fF;nO8M;Y~4UjT_>O zqiyng33yYqQny~JJ+w$S;ElXq27Fd1zN>*OeTR{)+Ckdj9dTm*crRt{#O;mwSfDy)8GOp$}&H z;40WJHE6XA5Fra&&x6$Bjk9vv>-b`OZb7Sdmr{$W2^K$)IVyqfR0$EMGa(7rTOnMD z`IV}<;-0+v99`1*tgru@qr02){|^Rr{lC9E_^kgw#IuI~-_zwQcSy8~1H&t}xRwF+ zBiT;JsR}VT1RZ&6k-Z#3U!U1t1-_d)_4e#d^IFaEPf|CR*P{#M(YADi{;uR*msFqS=U@FVh<}>ZdCC`kHV~6N26= zwJnR$!5;icr{}ZLh`vLeu&&cUah9Rfb8PLuaGlXQH7)d8yh^ zm{k;pa_h?TG2N%#C z!sr$92HV9nR|RW^q~#O)(eX-HIf7U#uoB&U6Y^1JA_7+CR}W7|4h^NebUIv1Z`Ve! z%7rCpy4`h{ZLx*ClnINQxc-v7*ltQ|ZuBl1D;U$}h*HfMS9DR%#O3Ldy39`|(~aex zYT=bPP8Z)0e#+_+6?NOnc)+9XTHNyh`rrEczdnz!x&7b4et*9f z|GB&WIsfy6JZtFxZu?hrfLS&dtecioN=v2PP(3&2TbkU?r(0wxpPJ4D~TP*FnI^5qcc=q5r|{%d=@PaBU-M=y!lArE6?Yo3R#H(RhLh2 z7){5e3c%r0o#VYUaU14MIq__5=9Fuc!y4-lRf{iip4)>0UgV|1*p*XPZ03$vEOfa!Rg=;w?C*m~w)XIf_A9Pga_h#gR$9tKx-sl@7dGv$;GA zQOBHEOnxfojIExb9W-h;K_{DiGXfokWY~LIrZeWY9NQ_=G|soT>eH4eUS4(5hm|p7gVE zR~9$m0HL6BKCXXQF{=RP~sk5Mqo9d8u&L zUrbNOhBp($ah9;DBb)}KhZBY98^%(CvoffkCj?GyN~TOlB<9m0OWozfOF$PMj0Q!g zG9KEI1ELwu&k9VF;tD&h+*tpUm<^5peAyXg6xI$Y2Ws3HPv9u3Np+&H>om8_nN!lx zPoe4(BuO_wXg5Nq?rgj5 z>NUmHNm39`3Cv=;3X8NQPkF8`#2;cmVS>6Ti+vH`s}72!6KpEX$WFE2#LQ7gR8z3A z(|Zv*gQ=0uz1dPBm+A45zJ_1Vq&h{-@R@0EE#k}%^K8j5DU17rmma~4)DoS-7 zok^OCXiVe}Wd1E@Qzg~?8+b$qMHSKSEntPY($?%xHmiMW!%#vs{e!1q!!q62hlQ={ z;dzE725ZaQ@ZPyr%eU3lA1%mvZ^pM9B?^Rh=FtP}t8gZK%>V4)^HXLAtBf_5{<9&A zwAHa1QZ8H+3idCZzl&cwC}BkBxH96+E#~_BFImTSPq(`GxV?!2ZW&MSFjdjJma^Va z*7s<5uurnszgxiXw|CC4a(Ielc$ku;L|8YWp8B(>?bOdB8+Li>P0woXlxB{zs-z{K zO`8H_>{v899!3pJ>YqTXq5=sJZk7F|-m9=aHa|6_4$&!Dni27=luf08X~(5;K9^5x zMMe{=4F0*~t|!|myCEEHt2N>%%_kTQx?TPA)oe;QjnSZswr6=>FZJH!QF+^Go3~J2 z#FW-#a9ag3ChyMlM*UHmzMvAkQ=MOa`Prid>ilO1y;n+`kQ_Z(6?kEJf$e1|QIsf6 zI5C-xMk#5Wdd)(o)^SCsSF>piy#*kfgZWD)W9~C-dwBYdQL}Mzt$s~gz`oikREvcRNR*-E4H^`d6~T15?NmzKd0XN{M=&yPcn|jWOL^~2ZMv^{V#jFd!P6J z9^_d+|BIia;9T(X z^f9bwZmD{6O;UhbHUAc`a*IzFS6aA50)nUq&B#{H60t z$Ir9i>lMrDYDK0Qv)0~xUQ9l{XMOo!WP4b31y~~g`v?76{KrB6;IsUHh-WSNpCyDl zZ=!bAI@he_kVS!%4T(ZfIa5f(QlOm@tHwpvo2W?e+Wy^j;UFm_pUhMH#ZM~JbbFXz zWjnfdE|h=aY1(bB{R!n2S%3a(Kj0?MfAss+{Li~z4nCj%c#vm}`L7T2(@f{fhm*IG zp|P^(t#xho^x7qWW*)OmIVRG~`^9FxO?qtJLY>gQTv0BxH0&(wYs_uTPczQY-UWM} zUH^o+y~dNg%NdvEURMp^!-uDjwy$PG63Y~bV;v7(*zT(LxSA{s##TomL%#`@DdG6E z^C!5xBUM5l`v36ZLkGP_LoCR_J_;epUDZkR&5WiABH1;%#$0co>F^S)K672=xc#gjV{l>9AJ=+=RzikZ)^M!P^*Cb7NK8 z@E3_zXhk}#wi4S&J1isAZBU5eXW_eSh0+q2A&aGV#M#s?mU;x2j@-hH8y6~}f2}pA zYJdx`mFkVz#_~om>J)J|X6~6Sr;b+{RvYXp4k0?wb2=_@*##WO(rS_`PUZ(r70q?$Xa!t4(Kd6_7Pm%d)N|m|HFIpYs+ijRejT=wh z(w3#i4wX=`sJ?f$(1UL#9r`ph&(F`N@T{-@-(a56Y`lgEu+;zCulaxX2cPf%evoGk z{r_h@@CXmtOqvT{I7?GFg@wn9)PBb^ru+pSFG&A=#+Y0r?Hi%_K2w|}Xxn)vIyUII zgS>>^U6WI^n!WqI-V6SgW(n$q{Fh&ne>{3GCV2PB!C^z%Y_sQ_eDdYyyI_+i##Sv>{yBODG_K5Aw8xrj<~&5_%;A&v)^83HfjGtS$e& z2$$a57z=^3gyV&a!4moZq(3;Q$p3@>=ktFL^QL73}n3Tsz< ztr9C$@RI}B<{Yw#UtKVl4dO3b46B8JluwtKaysmz=&Vh#&WVZrurcrsYv=wDp}|(S zYopAXBGV%mm|nDG56xjw)MZ?eHA2s{)pw}-+qy=sN?gwdtsH%6uxJVh24wA6RSBL6 z0bB`?E?a?+41W}apK>yy?^XhHMdp#NRDon82K`vV!Zs?-FI3trhqZxP!MIi&9#zl% zKnB|C88X;o?b?rqAUY{!`J_-SvQJcez5wt=J>{917^7l zfE)*T?Y=wKQxh@2*55ECRVQpiK?DnYl$*)*E{(-I@n| z^}(=kRu~1}RoFfvwqpxuU-CIB$=4F<-Q@AUE8T5GydLkhXznisR)cW5f=LVf$YlapH;eHB>ECLiYUgh~?28E@QF zt0LqTuR@y1NxSJ-fuj~$RiVXfJY!6@n2y~0)G4*v07osqHq69>F*C21)?aSEF0Ow@ z@|4EFB5mENm#9PiL`~xAD7Bi!rGo9IvEh+W4e^Gp;}Qnt-T;z5quk~oZjIrZEaY-v zq<_O&35RYyzH3&4tbaBD74ZcJ6B^zXB5$weEpT zO*k#4*#8tq&MGV5#(X&&R0dYT`xed|3$_8?Z5%l(g4wVe$97_kalfStrwz&-9XJ;3 zC+@!S#pyb8tfbW4qx0q-r(3BDcbRAYinPweYN@wj$DEqKYm986X8$EewLpK#i272p zX~g{ZAJ+|cNBf~L|A!O=r#359M)#4CZ?8YgBXmR5#bt+Xl)$UaK)Eq+3 zu*5?ws`V4|`k@?3=fs}#sJoK%x22GdW^(ep;1v&!s9U&c?$sr_$Rzpe4$a;DqISsc z-!J;HT{92z+|mCB+5eXv1YH*Y^`v(H?~~nw&*wiMpA(L_C{QMKBQYle3g*7b-b4k<#V*x=V-6Gg%30Oe}Gf#W5;@x zBbcPcfO^4js(Q*#R3kiWE+Nzv^) z8_J{p(R@wISJ3r55zFCu3!NrZ>ovb?Fle=riQn%cl1@?4n z8|wnzu&c`J;+hHftWN+@pJu9!1d~ z-G=CL2?DxueQGY?TjbBNyrwdi?{sRaR4b@bNUBKej;47xadm2yeiSPuG7(XA+`IkrP46@ z9BmiDZ*V12r5~N9Ad2qNTJ;L#_r|VS*I=8wy;ZMXB@V3WEN+ehs|N`tRQS%vwMgY$ zh|7uO7hRb=B`kjwyM{l;pI5a1UX#`%}>Ic@7-KjQ0Oj^ge7XXdr)2975=tq zqxY3vc3%8hh1(Xy&iN(VecNRb+}iNkadLj^e|^XGGB=bKu#48}=0#yW=TkF`J6dKM z=qKrN(kq_6OVS!*y7wzn8ay&);k-v1YhzkS`?B9Y%({+0W{XLGJR$LwaJw)-Z@?cQ zJ{FduLhEx@fa^JlwvEn!{^Kbc>~~iliAJ^K4*cH;&vSP9D~}cG<>hO84V|m2*TPPV z?xh+q*Mi=1?WkhASpA@*w&wjAtJr(VWc=9n(_j6$oBi*vb?sh&CHDXR!Cuw=KiJi3m!*{-U5?$Td))oHW!T`+@Dk-~o8 zsL3s@4K~}_z_qrD%Gajp>1&T0Y17n&`W48PVL-XJ*xOztd#F2AKp)+}uQa z+`|fbeX&&O8>1uV9V;13%ehC;Y+N%J3LcK!K)2dO=8pV^>!nvyZylG}E9V!^_T_zQ z?MtV6MZwZ3Ih}`o*+Luk{`@>?9(K}HOpO|J6qdVZi^2uCUjIBtvg%pi$T`=%O%}V_ihE z_TewtFPV)-{JZ!iYp`^5;~H}{a)ts?w;cf=AOBrEu8TEyK{HMg^f(NaTBOXa zr;k)|BLx%|I7=dBg%zw(jK25I60k;zPs6TRQU8x7B%RW6#yDBOjV1bj|H*Fk{@+1= zfA6#Y{}9g>I>k~+Dxr8=kFZ*HGBljgG*MDK$MF>&6A=Yl=wdMxCo~)HAWl*&>9tuli}yH7f-RJhv5u17)~*Q?jf(zPH$tzobdFdCH5E!ICmf|T zBT*1NJAZqw7P(*x9Ro|EpN`K_Lb(W{F_k^|SEC<9!#{Wr{(a%{|>g$Pnc6S6X@jGa}h*2XTOnH1`$mN?&)%z z{T4*mB4!Ec{e`>|E6)G3=SR<8K98o!ZQ58o{|^Scd;697-yeMWdHz4hvxUB)GQ(49 zXTu9RB%PLD|GGVqG8c!vo>~?nG3g~N7Cp&w8jD`4i@r4+w57^) z!T&wxY?dpLqPYsCY)oS`B=UwRfnyNS^`aoy+CmpE{`u@I2re%#m1Z3zBqv!yvX~O1 zy{onL(7=Or-ndc^(I9#ky|Ym_Oi;=A{192hO(UkwC}z{1`CByxEe^4m1dotHAGwC- zXqGEI)s+Iga87@+?OqRpE1D&TNLlc7{1WHElt`?!XN9sxxWQynA4D{orKygEgdJ^L zYdY7e5$b$T(v+c}8BddrMq+CVon(@;WCq(1K>$KpDhno4WDKxPG>?AE+V~5!B&xj-fojO{gvsotTl$24-IZGnSdR?^r%@3z%-3UDcERp(U zcY*LsvMCre7cb6HOt_>Y8e>Vsj^g{VA|~{RWr{V`Pu1T!n{kA57ba%r!6_%;OAu5N z5d@)+?jRa`{f{8j{oRXpqy9g19cAPaMG(aj1dUjlvK!Tq#KV-p{;}R7v8;fvF-_r{ zvHZ+bHar6HFEPsrScVB5jRD?jhi^LIIk6?IRtd?uGy2;PT_pJm@SRqcK79$lI#j~%6=j3vr;Wg~fs-lH=j zXFNj~sTW9nGen(h1DH0E>pi;kKNyE zNYfRkRKsMs)f`*>X_}48C*0kq(k2@4M?3cD94SF>*7VD2cg^T42`MpG(%uutc6)hS zFPL#km5j9KkLU>5a09OeLZy3Kit)sgto(95tIIfK+&gnVf*EA-#l}ksbCl9mj#RSm zM4}s-rif%>1_w+U&(DnMHOaIe{)WIC4HCQt+NlwtlM%WsHb6CtUs_dCZ!A*Nnw)TU zgK&lbL2x|4dm&k_r=i9eVKC*R!d9s^Pz_^P&xMqkMZ(QToQ zJstk&at8@Q(3=xm?bq!sD8m_(T^B(uB%eVZ#0WKXAfKhFK42j(8$0lf#aD!D9zSPf|G8g>u$2N_I|L_{%yBg z(59T_;)lB-y}RYA`uI@n;cH%|IWgSO~SUU$zmIRtj#Exc^Ov8WS#G>g~`o^81VkS?E_TWo1;cGX(8S&;%&>?yLO?6LB;BWwYrE38F>#cm&i0YrG| zF;e0}|Aiz2#hGR3Qv2;Ak&`$QBqgzAyj)A!6qn*UE|%LEM+g{F(+E#v3p^v z*c|;n!>Jm$1mQdf+!ne~SHl4Q&2dah`wd5F%5KbgQ61##%9$LQOm{jV3m9cR8u+Mq zG-&HP!U<@5dXW_przwcw$HK#PH4I>AYkQZv7BrQoGjTgza?#8**5~56dB-{V7qq(8 zd=?9qI|`J)pnbLG7YR$b%f+B8yDHOl>9f%l>RQ5cn9hFJ4n|B zT~C)ivSy>UUzj_H*2H}P&aJ$4ucTny&NS#&oSx%qKcy%IC)A&KG?3*SBO`{&KDA#kk}+?p#jO-Pc(q*+jU1sb+g zPK&R?oVl7c-F#-`g~(~6>x`^-C=1YCTx}_NTZ;$4%udQoKZ32GP>%e_VSyIZs|Mqk0baE~mvG0;BmH5?n(tNJ%HnkI;3*Oaqts!s!R z3a1f3LDwM>SgQM zPo^vBWh-U6in6=p)wwjQ*^b%zRd&70e^IvQPcjr^0lv0*5#6}s9X-^+h~pwAV#03h zvgs|Q5jt1K%ujxvtY5dcZ0;E7XBRCQzjD&1%ck+OMcOl+p%aO?Sz9m?6RZ?i9a{+( zBtyuh%L=s4_-!Ut*yU=Z`Xrxa<5$TSCCt_*ocZLZVy!r>DdyQbS?FV`MB@BZM8 z3}AiiybCWs?f`ms*F4B5E*Zbdg%G!#d*1aQcN)L?xanl>A9u*SRMHPK=T;cE7z=^3 zgyYiKtvhbV7RrX?W_|n|o*#J(9Uc!gj?30OmW|onbruEX**6=Qd1%of8e~8A(xLSbe^y$b?~$IHNKI1-P2FoS4t5DmhF3@OgSK|kaNdqI%T(o`SCUIrA1J(?q| z!JoQ{?g|KSXg@wmZ}40^Ms!r*p=kCP4hhM}JNhyQK_nDE8NFiiloLTR`B>v)0>ui1 zFz0w4AVek6$$1xJYIDn`b0jR%nFfN`s6gKy(%LRAz%HF{^!SgbIbH zK*?MYG}cMe1Z7IFl`!svoglz*OoVvJ60!{4BPfZcEGh2cY{k3O&>6wW&zwr~8U{en zKbAIjPX8clwD8q;GzfAmC(GcTn&j8RVjzAs*t^L>IX7+q*Szo4lBfF zN>cr7PNGAiaU@74DCBsBxd#ZnJX-2{t82(kT%Nzzxn|QjS$^eMo@oef^vX zK_QLATsLdNpeYwsYKW*9-K|2B_YAGzeHez#X&DVwZl9A8nWGeXg~EBhdR0AyuXFtS zjJVv6#c2Hbrx#CQ6#w^Vc(6~h*xpPJ3BvtOCwW@*IEo^ZeVb(0hk?~3ZJx~2qx18h zU!Oe-3MKQ}Zu}kwzV4|>3HPv#%3l_c%a62m`P18?JX^0Td}I=;`_C1bFKqG3OW3|@ zgLVVj-S_w51JEzn^0WB^St~QDJo%T+CRB35n+f*n^~Lk^NWRl@DrT8rDY?tNDgFM# z-kj1O+~V$(6)#U&dSBk1Z&870fzeg{3I)jFiS&%7%5G~4ZO1KoI zVKYf$&3O$-GK!{ia~T3;kgp8Y(@tlnLd~b04)FZrO3@Wl)K?pLWT*OD1)`F+zCHDR z;N~59moqMr2j=Oc?W@_4#4?4-_9~08IG17%_7vQJLWX`5EK}$`?fe-jnHPC{_@Sc& z92VqYAB9ObXd=PjRwNksBp7Ul1cQ4Z!JtY4o74A4oAAX1V=^>|`cXd!-n`DxD|St$ zL&DKuZwKx6cl$dghtjS+fQxQ0oEe>hfi$8S6%&#a=e5UFPG&>Mw5yocBt+g463dwg z*(j6~5}HKk-5n$+RG=yTjd4FulRio%RELcUQ=DU+;A~8U&Sk5U3ajr$%3d?ez(kNt zi3P@U<_={P>19U*%NbXol0>JT)m`1wIut-rGtnr$5Z2?GGCe?43X+bLS%tYfU}Z`6 z{Pl|{2)_8@XNY+;h~E%S5H*RFiMb4=N`(L8i!Xv8M5i|X+`JZ=95xBD?k}9ME2|`z zXxkq0Qe+s;(U8fBuCxo?+q1Oy0I8AHS*W4=Wth8lm^v{qVp%%xM(EA=gpp>>F@MR6B>%FLi z)(HRJ+cKp?KrS>~z62Z9;6<64^nrt1+rL)Z{sIUK>-`sS5kQeKnsF1In&uNcB$CE3 zp+Lo*uqhjpjHr>n!Sj-<)#jDexs#*NJg87|q#c zYO0jgL3-X%2sl5Y8NsI9HuGi&;OX$&?6E{6CAe@lM^uOz5vw<;b#ya}44;aaWSCRt zQkuGa09cf3CyWTyycJk>HsWlq#<4)7=!K4xFV8iM?BdO4GfQ=Ez(CxWHdBvi=l!oPcA&V&pLMD#fKJb0`0 zq@g&Z`OqausQLiyh1a{GWaiJk9;{|BXiPF?NglI&u5ZWvx0vPgf2!4M*Upw8Fy#_7 z%Mx?9>rsy539%4%kj-hh8}-q)D$p^XI^BN;ieIL94y-qWm?J9mj3)15lEaLT*)&h7 zHk<8YVL(K|zYG92lo%$t!qTp8rWC?bYYB=ThrQm-%}s;>%ZTxDFV&?)@5RaS^H=B3 z!(Fv(|Cpsjh+=^p&TXD|NXCwDkdhu_PP9~~8M@(A!qq8)jpPmHBuJ=`oDOHQL?DY5 z70553gmH#CN9X9|yo0_uIzKtz34T7g`2O{e7wG4sv$LaD7bnlp(d#pG{QA|ilZ%tr zug=lyZ_&}Kf1w{vUOn4Eglb3LyBzXKFplUHmh&h$H_2gaqQ6ldcZ9uqWX z*Fs_&MXMNdc^UzMgc zosN5cfRri_?(X*A?e6VIc{UEN$Q*(c)L42=6+eQ|Q8NgU{>F*Bvm^-ZRV=|2Q#e6J zxW^gaxRIXmbOjm&AtF;u(?b-Kgwyyx6CxDcDdv)9(TF=2Zs~*Z+Ic-NDZ~#wO{S?) zW>L1pr&$x}3m|I!_d?^84iFSfJctgW-GfhbHCrzKQx;#{t&L^(|Ls-p{~8<|Jo$Y8 z_k%q5D7yy-(I80Zmr266xE{U@XSC&Po` z;2_!mYV@SPkH5rUV*KTBbP#{p$6tNjKiK_x_+?>VMVWKR9^u<=6k!`9x>jr}ZqF|K2Xho!VG9{|8?V4hByu^Z(1i-u~zL{}9jC z7Wz+fe;4`=vIgkOvGu)STU+Q9ydyixpeFXZW-9cah{={kOrA|!ZO82KD3i~ZFL0`R zM8`9(O(@kY zer>|o51_Evp8M}0(7qZ9vMsu{p-KdXB1(;UHd=HXLOc_aO?5+(nY=mmCT-PKo61}JxMG9( zntgNjO1*FH(}Lz~nN^#s?2g-jm`db@owk)@95E*lA&XN{$D|DTvKy_2kc&VN5wMQ8 zweGMp0W%vwazSgC_G)5%cjbg+=yD|@!d(nP2k)%cVZ}=i*568FAECRR?f785ZfWqd!+m_pVk*s=bA^cMxGRP@l+j8Yck)Po2y)#i@fBOBkX1Ff~6 zPv|>~p@7@cvE(VoePh=ZAejdmR4uO?KnIh~_$YA+lqGX}yt+k_6t~ksr@V@X=+6%| zm`7e(ZUxv+)4d{e4}@*vxsJ9@C?01_NE++FW5X-nrGyGfQOX7~7f6=BMJ9B&4gR)5 zH|K0fj8QNoHljLlL9Qn1#uX^i>^gnaMF{Ii^aTi6V8`Zv$qMFG$Q1s&rp}w@3=l0T zLL^c`@&cLcyai?4wD%o$fY7&p@<<-k=I-Sn+Rn-bdIPu1b zB95{slWq-Camt|%P<=!CD#6Bj*6_2(U%Xl-#(rR=)ZJLI{*T5sqgx zAw7LbP;V>eBvkaI**Mhi?Br-YodQj*dCbRH;C4JAa&QRu($4^f$)jrLs*Bu`8IvvxO$ae(T*#2m>ay()EdmdyCUI!B>IZEL zW=EyLz#0pMn9*hitc!N5^G88AIue48GlYxN!6s^{(c2QC*K$Jm4HaYuaWZ9+n4>ms zIUc4;5Lu4~6;Q9dF#8CYQ#>_PZ|M$-(8)N1{ZTqd;b zjjam4D|?SD*ovW6?f!ZmqV>AHu(u0)xt1Tv34*e*Spn%;gg=&O=z@UV_Yx~L)H{Ti zZ(XUjcG`KW+Spoj^(rsss0LJ;X|pLmTGZwm-KqK$cl7-!Z4|q7)0`T*sNy+=89&Q) z=%EhXG`a6DTpoNhg-AV|3g+d4H7C_B(*)-})kf&Wv!hc*J)_J=x=b{rS@Jet1)nN1 zF6uhQ!Yt82i{GO%4)^Iktow+Tc!b(<+q9=|gQ(q;SMC-V26c~C-J4Zg8G=T~R_SY- zYpY2tG_D`E*0(ez0=;CjOqM*5;BXkhM{`GLakdd>joEI!#ij(^Q_Cz8Jf2WVAXh>; zsgn18`%>Qkm9mWJRLNfFF2M)lmp?>Ban;nBCta=9tAl*Dw#tIm0|KMxx2sz5nk}n2 z-iJucvv|T;#%4m9_f&#n>%9fzm`do4ZvUqDz)3`KYy=w>Zz!x%c~qQ%Tfs z@GqHbr`Tw8*@{j!o1PbK8(IkTY6fR-*vJ+ZdS?^_+XP>e62?A2^omJxh>pSKqh#P1 zmR+@y;Y=Zl6WfZNf5(ccE}P7ghOi^BQOtR!9-n2BPD!Z8Exf^LG?CME>$@M1!}EW= zI{yCb^{dxEo`=V;U%ouKa5Jqs1c#`@Mk6I+o5^vA`mF>s5zgvwkQ>$o=)E^rKABi| z&`*+UoW%*$cJb;f9t&~Io*t=e!9R5?FxYhSv%VNYKP_hQS@YgZ&zDL z36%wMTU(p38L$FMv#~$d)vG9Fi8vn(TV;cYZ^QZ^1L z#7y$S^#~b{*%%~N6Rc-c#O>hNOp0{?=3}6q>WG3=uBmFdGvLS+RTeDCM0tFxz>cxR zsx}bF{H-CGGPSz84=-u^8x>pi}Y(%LsCRSk+fSgp>6WPjjJ-$b?G8s~)Em zF4ZzOl-`#|w)j+#)dmSv>0F418W|6D3M$<~K^6na>zds`0R6GH%ou`zDp~PHLj@C& ztBO8*etP!&_~_#KGhKYfQ+MOOS_Q7P=Le(FOf6LI@Q+ei9-A8Uv0baHjSIrB2}dWV z2q%d>5#c9r(C9#^s9IT{B~|}qX8Fjfb-)hOqktr<0nlvYZ6a|9uCenB%uB!q)T$BV zQ#*a0y@GR+G^=+BE}rs$;`~-HtAtm^iO$)j2W9Z$%VSZ6L6&*IWTRD*TiL`SI&4V~ErPJx-5 zwn_5;{lEWDjdU^zl_ky$T^aB+`cY@Gj#yDaHv{8UUn>q!@6ADQ^f~ckf1tnT62o%qI+wF#TXaEt zV>5~Tqle16m`u@>Oc|fUy8X@EC34VvbS9OhQQs4^4L&Q#Sd`Aqh!!SAgM&r23oQLVP2IhNC;N(;Vlvecp=DFt zy{_t6kaR<_%e77^rWO?2sj9C>Q@XaVU)wV%8WZ#n@`74xAN+lVq`{E<%TUtjOsZ8m z%}3fAG)6UiP(_V01_e;8%xB@`yd%kDVFp}7b`iXWAP%KNH297>+qihEr>FHN5p@>6m=8qwJ4ugfDL6d*j4>^pbOp}R^_y`Ey5o<3*8u$L%J%-Vj>X7y2b?S0o10#<6;ZA-b@3> zD1`i;RDA5X!5dk=#Z0x_K#4lcnorp_{Vh!is0hbJ9k6aQZ->?|*b3XeH8XCc7gQ86Km~w$bf8C-Q%E>lrk_k<)AU3XCN@ud6*>5^iAQtEtzQ4rzEu4Qst!{C}2UsSt-+GP0wkP@c z`yoDF)*a&oDr>hD$$0BN0F&h7a5BWukD?bKu(wPsMGetI^ggsv72xs(6%5ocJ~M29 z5O~kr7bpjB>Sd;Lw_!S+3$PXjU++ePgRi1~)bH)?qiOQQNwfxZT1ae#mM%TTd80&g z%%D9`O@mM;_p8?z&kxaMBU>5=c>6%tcIvA8Zw}!FU6T;3Rc4^)=Izo>pl$7r(C39< z&M@v&vr^G+1ApDc1)HYqCbWLtP_l4HLZxt$L?=3dO`Q-lzfdh}5WZqC3kyIB$AWAP z#8}D|&r7v#&mFe)71*Q^(WTr_L$v7HNk(NdTq+Ol5=5j!!yvc}8VfNWL(U$z%Io*l zqfNHY`m2uf^rHtg<~nl92U!I9^RZ|MhOfXaQ2iOFN|7$&^-M5EYL_UND!9Nxa-0dQ z7p9br{pPEHm!qPyDG2n80zkzZY-BrXK3WJC%cNA+LeMJ~pJfP3b8X^~F=;CsZCdNo zx{CXa&~*M*wfR^Af* z#u>U{{0iZeW#iV)!3OgZLN`&Ma)PC``>^O*rmRd77tW<@$9E*2nM{I>ob7@GR+zfh zi`vqzABDGCyY+xAD`|^ll;$kNV`0(p_6UZ=#+hfy(0x#gqjp4?V-y;6!J4q9p_nrv zY?;y)EBG|DSx_l8q2md{*O;azS&D)EFMDH0X0lefz}N=;$Hk?Zta8S_*BQEWjz`VO zT32hr(8d)tE|`WK&eHbGRMS*DZNYt7q9&}bC3?bU50eYqHow1D>f*(OAo!z*6VOq# zrcL8WEVZ!;aM(k-03PJ)1Bau(0I$Uhijda{H#@wx7b$xj>nojwIi~~TsTa?tSQmZX zB>~oHP+2mT7$e>D%=oQ%LDSlb`}Xzgz^xTJpDXGNG4FUfSW&xrwz{b!$1m$Ke8o!P znVhbds&}I56svcsg3R&DmFU_QR%qUD4xbi3NMT9n!#D0cnWvN+FQ_fDJ=38bI@cv^ z#2b}I9|P!C&*ZcX3+QGG8iemFx2E+r+f*Td&AGB%`-WS{R;Zd0jN%8!g#4Jk$mxIwi46?cXhU&6tF)rttlk8y zb}oUbn$nsa&e3UGvdK?$Cl1l>lY^Jkyo>XhdeNWSVNaCdIO9~#l?5cpJGluvMHrZ& zxpk*`v~v(@P|&npTNN#Cv5(twFeC9DXR{pXe@~t{GUv=YB3iB1ral;GO7ivx&RR56 z@#B%tm0v={LTs!=&Q`E|mL2Ky$MBCwRaeE^S#E^UMqvlqr*Q?Z2@~=trC5;C{*3i^ z+3BqW*Sl)&Df8XqF#P&FXJ8!9L8 zXK32$*^YZiwt6vCnOC|cKY0Y;ZZPnYN7%uv$5^3l?<9)>-t`eNjWk8}__&;$9@p?t z?>2(N$?5T;_DxEimpDgk=P0V=+G!C& zFP8TOm~>Gm9GFE7`RJS0su_gVYqFY5sIA?R&RYZ7Ib;jf5H_Xs6+5zg8rzMADddiM z)=%;YHj;WfX@Yrjxtd%p=5#zE$qaIhkZZkn*~5@F0p@bX64KkEnIs&3TYN&CB_Ylv zb#Ht!mHOWvFrx@6>5A0y+xl-vvKk={;WCp}ty8s9Wug1%hx)gMuzFd+wq<9qUNVyN zoHUJcQ;*;(*9{J{+gQ~1YPD`?HlTe)=B-$R41;(?cU)p6lx^$Jbv|798!qtdl*f(i zk`Vs^m*j|Rm7>iS*W?~Ct z>(X`MMYSM&A#Rz=#5?q!lrC4a;Smauo8TCnrA$z{-Z!SGvcYBY zgs=`-sw_pKNH9uaO>mGpzFsK5?_uz%mY%SI&VWdPSKumT*#t*8z|-X@iV^hsI3!6- z+oYKAFMxjn>NkoRTm4cj0O6$|w>wzkMRx5D=Qy0olP$+%u_8$q9GRm!axjOs^q?AY zfT2gWDP8G*9Ep>|VWPV*3HkQ3;yY)8*@{Rqx|PtRl!{U8W429_+3D$ei21gX1@l&d zY9Q#&YE|z-gQePvSS?Y^y8S>93$7LGOwi*61&B*F1@r%|vp7OKOiL+OYi zRd&8I)vuHGlEbYV{@P=Mne@be)6EcDV5O7B!K%WopN^~ zLr_9)H^358(;b=T`6BVujat#>z)$s_%J*Dtv%*WZ0k0CWoJW_^QzI#;Qifyl(K ze$=b7jJQlI4Ok-c^|FX;ntAv*5(SkoI;s|9fj;skFSwJhh)XT+WVpMWxM4jW@N=Q~ zMv5AVnuT)BuJs)y@>Ql}v(RFW1VqP;#bai$ipaYhB!`3K_>qdd5tmeKHDHnvYkkNQ z?Du#K9VCLM!5DE1b-C%6kuzHW3i65g|7zEqTVnmYIcN0f6 zLw9);6-hwHFngXo17+BzQ{4f(J6-<2o$bB-G9J_F@|CiN+vws(1^5wL9&^H6+JoCk zfvh!)t_flpozpX`5&v61#8Q?*QSSwFDH$Wsp%Sk{WoD<(c<^|T&aLB#@{*+wBgkDa ze-$x>QtN~)_dv}3XXX77+fHL|y#nLLkCO!q96uuL_(Xi5jP%h*nzKiaKAMELq$xK} zrV}PrqlIH)mUdgOk-A-(8d6R!T|wLf)yFDtTJ&;frvf3-W|c-2$vk9bT9s0uOtVso zxK)V}6)yElNz zj9HCDPz0S5@i!#5vr@zkYL%U2>as!PP(2SN~G#hy)8Ar(>$t>AV29GvA%bd@2NZOFAYl_tK)1 zknhc8dy7y&0X7xGv@I%IMOWb>2ws2?7rJA+E8vq%4zR;|ruNH-Z_>~$?H$Ek05+%5 z9-#96x6um`JT|5SmbLW$m!lW-Gx(q2JVN0pf$p`Q!>O2yux{x1s(gw)#7C~j%`xeV z{J3dD#kJh5vQ+&YFhtP%E%p<19=bNdfQ6b-nP$kBqWbP>%>(d{_r49D6)HVj&~=Gs zr@w1x$Xk;1x+IH@rV6%vDoM&>KH*ndEaZ1tlBIMd64xLZU$9<;y@R^`z$iKZ^Ci{X z^mRwONU1}NPE)Q$NkdLLSZwlgC0A`bE6iFiiv+^%DCqV>`rN4zyf$$@u5~^nvY3R$ z2+V5S-+XZ7l8C@c5aKET730CIZr=D;>%=}}L$R}`=nZ*NuE!xVqx5~dM3&;SCcj7% zX7!$trBJQQJ<*=m*pL__r5G|a}^iN@>W;%!z^$4n|H?4b;$eo$TakS-)@-(5bn=6Gp8KX zIcOT>#htons{8KybJEPMD=j@Wo9Ya!I&7}opS9m+X;0sd=cY!h72P-M+WMw_ICF;t zYjxzbYx^sCb85hqxO8R{>ESzd7Vue*XQzo8w!WPOkiLe4r@n$V^zy94zQoT{KmD?^ zgVGr-J?yIRhRh2sYoE_bl*+w6^Zm7O{jBS`%K5X`o;2)N2XdNy^|4<`357$FfU)}25L~{z%lcT7? zQMAA^Hr}Eu5_Uy@Q4M5Er_sA%h1PDPITW6JN89_3>Z(R72hwWQu-1iCKcIcIexy22 zHgzV|b+||4PO2eY<5QZUXy;X0)pn_CskxJH*}1f6!*XXHriP=*Mn0xxpsvl)RGUS% zuBN*DS;gPf*!|za<5Z*Js&1!dGCq9A(;|DX;(c1l%T@lTiU@4sfvV4jwYs4in|?&T zs7Cl7zeB1Ktq0(hYJ{utk!)k`LJdkukOWK-u)f9vX*xE;Qd)kA%DP5t>rK` z@@&m<+>>wX{rR?*j^O<|xRx{0+Pz%MF7ic58Eb6$VCPKcF17(o#Lo zlLk!@EkHGgXU{f5wT|w_s(s3@ebP26ZA+e*1jm$X(o*T*iJQbOT|G#8uPB#0<}6G%jvfjV znOZgj?0ME;*8)an4p{+R#9Reh!!=0ZVwZ_sIZUGaQgiy;sX~F0%3NSz9DsQWvvxXC zsHjW~wFiX`wr#6bQf2Tsq>2Io!$p9UEaL1XdzV-C^kGp;%G|A7il2wU@~0Tj^9(C$ zfOruIYxX(3t_W<+mTWHTeOiAK<2hhH>51eiPgl%aDB(t*{x!=s;3;sMWNT$ijdN&#J@VDiel{rhw zdRB<9_3W@ItGxp0O-MOS6a^F+bPn}ipSHsWqUjX#cMG@aXAD)fCCcAHZ z^>V99#aF>=z~>agbT?JdTfrd;nMsJmlpnuyT*Ykm2?%ilTs)6p!sIfGV8gb`f+%zw zIfg{&1*OExZ3&d~V8LG~&tCcK$UJKa#!9fZo33E0YL=>Js60DqJ7#fAFhKF#XJ^bL zzimFwSx{u359nupgrd|x0R0&Zr<{H8EsNU{dSJ>t;>6)&l$}%X`kQ2npF>924-@)V zg2D65Crfz3JqI}Crhru3(cOEodyO9ppNmVriXER9?u=ibH9^2)_g{pCo&9!WH1$am zFLRU@<()_w8dd?w3YM)$nE34E*S>vO#j1w{POY1!WjFo#e33BfCvZyGwPcK3JfE{j zRa;h_MyUysb>Fm#5HZ$W@Nh|_Ss#Q~O84H(21qQ)eB=&*huv!wcYQ40ONt)=dE_tt zb;t|_{M0{z(*v-(>v(AF!_e8?b>h93d_SWYWF1e=aKfz3!}L1BU=ajE09kA=Jjsl@ z1iGnaBhjBPNWv~UV7Oqd@au0+-gjyTK2{fh)qbcHA7Pmm#r_Rs{@t8(+p>qF%*c&v z4;lQLpq(#=qUtYb$qSr8{m@sfnwnYVhWtLA){7ij@LaEF$P{1|MvD$o{2Fv2>ooKn zSI(@|uAZ0pHuFn0rj^X_Z75|iJ13stz(X-z_&pr5Ypr@GV%{npMyf2(rp741w+8Ci zwpB{r79P#|%4Fx(tT-|6=GD9&K=u5jatb?x0?f`SQBm5q-G6&gf^ABo@P-uW4RL%%Oi|@rdsE1wk4Bsfvt#hrA+F{!T!EM@i<>%Dglr$0-vNL z=Ah68Hy;~>>oPWiCp94AiXC%jN~2hacgny-B$DIu+YB+8NS6x!h8swW%3=!(e(Md- zj?dm76u+^>21PM)r7EP@UES<<_jUn0onqVPMF?-8ABa5%`}`{XOb0t6QE{v_5q>J} z097Hb++t-&<}Vgm)F1$rD>`Pb7AM)VQn783t>rc=T8Qzq-6PR%)lMbfV7foCY|^+n z(Ho`P46D`}???20lwF8bcV%0UVyjZ~PD5an^M7NG;%enEP107B) z7HWD!IlwyA1PuVu^irOnDI)*R1)@CG86BM*^)GGXggPg^cSk3k{8tYVH})eDx%*5}M1pKu zRp^OQg0-9m;@0^ie_oxgMQTv-qo$F>2PG>PAP6;PeWhO~?YGQ%&KRX!`g{%EUmpG6 z!TIpwXn1*eJnFqWIl4SN`lAEgwQG0ds{S`);)8gVT!^}PfEdqz;g z+!*p-n8`kL^i66(qFDwCTN!KHezPt2NRMpOv|C`_{o4U>hQlGo$$DTAjoBR%*u*{q zTD$75%QB979UhM{qPiT|*1^=PiDJ>$x+1EZTVElVy1BuX;;5UOTsefgx!JE1J^lUy zOiQfe_Hol&FmHTE!P86HUnOpONt3IEOfPA4^=RoO4S)NA(k0?8W2Cp>;kyWwZfv`K zjC5mjtAs~4Hn?hJbYr7mB`EstJqAVB_x1N04_)v2zC)qwz29FH^n&)y!zD-uiW*@c zi)GiIBHDqjS1aKTI+8jlVxG{{>W2j=0h{a** zeEI~soQB=%sqp2CI7Ul#4zatKqc9P{SR=nX z_nw(JR|08|7Kc>owenw{orGh@qy#I)Twg;End4I2AzB)c_P7bhM#X+XMrmjEsod~_ zIVljF=d3I=2NxR11LLK_?J9U$Sb7_pOP>p6^7tW1U|4h>ts`}s9d!odB+ZP<$eZ3# z7Kh=P@-8n;fQ1io31Tr~K(qKBL;jl|baEjaMFEQ$P1w}{k=byhWYN7Y(v}P{T}ry= zuZIc{r|KIEQ2cO;NS+RbX6+%G;Sk3nQGmRIR^O#o;OT`;HrY%QL8;qFr2c`&tX9Di zi#zNHGo=K^QlxoHNnM!%&7?_c zIS^^cl`Xt_srnE(@&!Pw^S32Vn0kKpz{Nf)(Rc4>4$Ex@DS)2Z6`aRyG3==FJK$I ze7&;+{snf`ekXK!*qy7d0+U+}K{qI73cefriSNQd{a#SG(|X!fx`G?y+E1TAE%e~a z7cEW@0Rfy&spdLf(grA9zULz3%a;x_}4U79hX}tH{ z{XZf4n6S8VQhUhwa+@b3V4=O|u=@wWVY@zdc6N4N@9(pJcXoDi|L*R*dHM3Y-TnQY zH+wJl_V#za+u7TB`R3(!U}xRPnw|woVEo2yp zf>*&;hqt##W++Ug9MH7sYM>2dWAFLGF6h7v3bgMEP-Bb(1hZ~*$izj?zdLeT|GNWN z9DTZ$#(JeZ0a=0t=7CShEsoR3ge8r2xo5zf3SE|bB8X-%T+C7I zyMO}({M5Cf8Q!UVS}T0B`6R3!)8?u$RPEz(^@RQ|txCN`EZr}5Nh0rx{J&DCk_>`o zXwy+(tN41*t{qeZ%Ct^wew@G^CCwAj{gIi6^ac1 zuqIAX6*_BnVFZ$)F6J;4=Jm3nZYfsU`$qOM3N3U*N|MGl(>N`w;pGZTG$3si9wbSJ_B68%n>hVOqURWy}mR3m41nw79f( z$#CU>u4;>YZe=QE;`|UL&<{wxxDrQ{D{Wtt zj+^QSS>UEJ2>dWX)4W7WAz-1A(s%OUuB_bGje4#$&V-tQ;?0Xl zUmT6P$;YJC8B@*q-`@V4-QxM*-qZQteLVf2d&3KG);m2q0G~dIi?S};*L?Z1!N2}` zG#nkDpQ#0YrE?F5v`lX>FqP;m#~;CfUm1;A^nYfIbUX6{5gd)y0X_j^M74Sk zMFCzS5B&J!#>S^l4psA|4UOl+X^2VUyQkR8ZqdGc*|qMPh7LSfdBAA+nRn6p@{ zy&w?YF<=I7kf_1q(R<94P{xy>ztcAH4T^7LKS@x?f}tI3Y$$2S7__+?i6jcdS-Q|K zz^3QBiChxOP?J4(gp*hYe7^-ggU}B>O1*uGGXOB2lC^eA8?5Ye_2@1EOu$UR1Vg&W}NKZ zX6yN~1-^VSQ&&vm3oK_iT`HJ7OmAW0MP7>PtAZpNEoW&dAu{X%$BE~_agt;S9H0J$ z*lP6l`5C%F@pH>%lg9)p8wB=I(%(Vh&D+l4eKzI=Ht2wVi=B?+Nae_JKt%owfaAwsjt7KXG&P>y)bK`2K+sDm^CvY0%0?YHk^NH2hx%V4IqLC*DL_iZ z?o6NH=Gs*Mc){Ya3xlN@OjsSMUUXV2H65yDr%DaH!9LfZQ5-Yb&eE9j^^0AYut>tk zhd?oqm*Zp+a^TCCFTlfy$0ufadpgyVg{c*Wh|G#wWtd6iAYK0jPy}?&M55MC0dOtz zt{fX7*3Qlkk1me~Ibp`5-`hsm{?jE1OctaIWs*wzPW!{kthyfTE5!jfw;&{BdB%LGo;^G3M^)O%(#hfZNYPG z-Mz8hF5Na8`{&v`866FOJ?X z`25et?6AA{rn}SK>Fz$*v2CcQC`^&(4^tC2Fz`K?AkH1M5l3!NbBgROj6*-1l5UKH zzz?SvaGG%yS3z4nK}if;e7kvghKK}4nI68yP<0nh9M zqlo(l6+&3?>|y*OjcojeKoT!PcH#*W@cJb?wkKeWT(}?z5Ijd}2w2{xj{=X!6lHGe zGF7%uz~-1|C=^GCRC}k&=~j1xK~JYW_cW@J{Z4lNWqsDikNO8ySu?G_b>+q})PhCune7u2LQi@CP9A)e{p4_-y*`bjzvp^+FwZ2qMoKT*!LPCQ>C%;;4-yP>>%yb-FAhZVB06LyVKWD%F_=cnpK= zHUE371@zL^!4eBCy7S7|XsxY`RfYoCG-sYDO?I_0Ct{b&F8T37mg^K}%8sr);h*gVc8*#!_}*6{k(tLOL|!`y8QF z5ZA!^`PLPFv*rGL6HXHd+rT5(*J@6*HPET&E^fBdh`nqy3aJst3r2J(t(o{4ni4=x zriiPWq`VBDNZJf#n67i0>RivDx5ic3@N4lrtF>G8{>Vzd)uSpZ0d}l(|I*sEd!qcc zWqAvCK`8CC>hTawb^sM~~ds4O)b~Q*>l)*sdGfwr!go+fK)}(XrF9 zZQHiZj&0jc?R@`QYmdE-_DLPpL5-?8Yrf;Up8I~_fvvfVBRQaCOK5+|6LN6hzSYh@ zo-kilinY8>DDqP2~hgOWRugWf?kAo#u3a}qjjUP=OJBoAqhlo=-fu&BcITu{mbQEjEa6tYXyeAG^ zgZL(^nucOy)JScy=nt5VKce_%#42)A*b(b7n(}XQQ*7Th7#cCO6&~nA(N5ZlWdE7g z{9P@P^Ejv}%NP_y^r~@Kmn#HstU{hVN>FzfJ$j-~5G(2A!oF+U*wI>STH~T;)0W&Y z|9zid-^px2M1GrI(+m~DEUBOn5Cm{sN`D`smL$u5*aA=hHwl>hJS>HZuC@cnSKc4f zaUGV@L@hS)Q&qDTm=Q)MBjM>r_Yu!3_kp3bmd~65lTdzJV9oB-aM2@rWmhmplq1v9 za9;XX$Y+tcH}_Sg2%d7wS2Eg*L%6zc{O@(%HwQM5-e>t3L@&(I6LUxa!r7lp^|z^! z(O(t-8YWa?<7BRwOEMTd1t1+93`ZajNr~g_5%0x-u)z~(C}clK2NvV;$b?`=q)Csn z{xaaiq*(p&=kR_CF|oZi9opvbpy~+n?fpqBh+W}`Z`iyfW9tLI18@f|D0?#r zzL9Y_-SK@5xEb2w8FYWCls{B=Cj-b*!BBsVybrvfgzBKa1TmpD2a3Zh8H^4UpMo^F zkGOFu(m1FG-*>jRD}EM~=0qII^1Z%u=#sI9^|Q(x_n&(+W5KI}TfWw;Xf!#$@$|Pr zgVvR+wO~@jZ?0M3?s&lczRPF&qm_**L_J!j2~w{wME`ValDUTLOw~Dj=Q?blNS{Y~ojmmccK^%l8x zXI*IH)p$Imb#JP2Gk7K-Nh8|BFcpC) zm}zM;1nN{Sp61FJl*zB&%TK`EC|M}NR-Q|$!}cP0-8#VD-2COKvJ0@2xwWG3?e}t5 zw-m?SDRXUP>@&81T)#j%%8b3UGLo`DI(BvfqK|u4O6hZX+$(7~$?gnUKL+`nkZ1ON zbJaUO3;4?J=2Un92oMZvGeUUvLGbb_DKhvwkz?_~VFHu3Lna2N?y09mrD#t^l;iugIi*p#t^Cb7HXdy4PR+B`RcM?Mz>&9}M>eW6Kt zF2@Ht&B41Kn(|abhc+CV;6JlFGTH0u>3y13^E&L13l6HHr$Lrjb&Jd)X=4BfS;1Z= z>1Y5Ykb!N{AQ+ujZkg^mq)fiF!6T%`TNa=ZkRm!(Y)oiqPu7^l5_QbvXioVwSd_FN zan61dDKi;qN|yM>y=y^(;_ZCQ!xU|vIZi$@FuzbRi3z#8Br|Nl8Q~cC8xPMPF${F0 z0P`#0l%(J4gL)zMKHZ3Y#KOOr1Olg_F<$JFrvjnAlK8>)jM?p?w@qwY-WCzZ7W8}> zkiEj&{`7M+`~F^d_ajtT8g?j$HfyaD*tv{g=V&%8`>n5&`MO5mvX*?Vjj?4UYlS&W zidVqI9jET7Q2Fq#Za&UUzRYPiFDb{rG_ZFF^JtOnG&J?Gv7wkM5yzj0+FRtg}i>>dC` zNT1PYAl^aytLAG;%iUv{^t-ge-jB4#tZ%irS{pSWuJ?X^oP>b8r|nD)h5MhMJ<&FP zo@?vUK*gx9C&o3u+VMj}3qB|K^F8=edenz}Dl=eCjd=Bg!sL}kf%T2isDxbwV0{Fb z+#2}$x%x_9dtdIc4twFEDDA)RZ{FJ9%ELF?I`UG}Ide@ucO*vafsjEJV+2siY=}@l zcN_>79kN-P{H*V~?-%616LDMn;T5;OW+wx`RwgxS-Es~AK78Ec@u^>?|9r>>82xA) zy6@Q}i0C99ku^gzSM`_Gy^z|;5kj zS8uF2{By49hgf&gSn7yeEtufl(AJ4z-6!>k^ID$>(>L0jfL-^|8OHe?b~Fc;YJXuy zjk$A-3cuIIiD&;|V@cPq%IYa)SCoS{VXZmcjhN)VdI}X)dTHA$sOCm0ddQlg5*K$u zto^MNNTeF_3i%Ka^KH~`8lfvD#`@nJR9Wq>q}x~TiE~BVCpY7 z2u!F1=_mE&y6WH(PrK@DdBB7!Kz{Ju6fkr*JfT0h!gkwbKMh8_ipU3>G4SzvIVVu( zoAKkZ)VwO{kHP)!GZshQj{2-TZ`#&XA;oNOL`C2&k`(sT6H6?+C=%5g6Rs}rN>RZH z(F^`!>NNT*>rVXaayJMz%$dHy2y`Dk?T=}VdE0-2OGYXlB!z!+}qnJ7j@K? zT3H4pglzw4Nx6TzpzZJ_!f)4tp_c-3=^MN%n6b54B#czoYGx5h-wN7Jw2el$K4caz z*T#CNmpJUL<6N_hWtW)V?SIpW8K~5GLnI8EHYHR_cB^0>$&8lX->p$QZe+)aQ~8>P zdCTk-%_&huRv^p^2d`_W8NWR4!XcxAej?Sb9{?5!$#8IMYGAUo zvdVRx9W;lPco}zAK|cwUNBHjxQ2M`naEV2juW>}SsF^*wv9*QkGSJun!(KuKHRx%w zbZF|~JWtoMg=czUdDcsdyrL*MN)dAJ0+_7?(N$7vk8u{7be)2B;V39+OtK*nGqs!(lTSdk&kgdcq zank7hc0v}2KZGKf@QRnl_QAS%f6gs5&{+q}*Xo`$>pSS^<#J>F1gMFYel>w)A>VB> zLQGP%K=4>P0A`(9tw(iTrZFk5#D7ukJV}oR`C5h?2(rXi_o&m zj=>{fIP*X`=eBbrPmk!gQ2E5@;?d)$u!z)$8qsK$>uFs2C$A)RHlbIHIf{@(gOJ<0 z6gGLp&(nHPh=Va2VIp_Cym#DNkXBYz8F>x+I)5MnZ~`JNNJv<6#Oa>Ul`?MK z5Kv)Z;Z6WG*w#isy_>0w_i58&M6G?2qM_!JQMoAfQ~aGe?rj*M0f&Vp9||3~GXNnh zbfM;0ke*Rxe{e0;T7$8{`V4HYDvSIE%OvV2O%cViQ78IMv$QX^N_t6RV-4%FOVXch zA@xV{kaWE&QZcG&~c@EI63cMv(ClZ&gi<0jYhim-&Sik1fx$ ze({s#^OL(JF@YKA?X4jK+9i!D1>>quOPi@vr_)q$RXKR!xU;2nK7tg>!dyOUXg`AM z&*Zf4YYDS!8MoPP;1zjxD=t(+>!@v5)T~o;rmMh6`!H$7h)az;cFS4f5vT)Mq zamLS4pG6pHZDD1Awc>-J|N5x6@sNpY?qyy^+*wt`4;3LZkb)^e1u4Tc-Qp z-6kpD+=Su&n*)wf!s|8lvvf)2W>&2WZNi0Qlh&VX&6YAO$N~n^|PMjV;K=+w|zWvQD@+=2$<1^iK9~U5{J;b zX22l8T$>t28Cdw(^kl6^oG0nzSkfR)3L{?z3+Mf^brEL5FjLJ5<#+JmWdbT+23u}! zRvr=&OC?gnMxVCSF6haBYg;fDcPPMIe++Jm)e`ie0YuXJL zaqVeZ!?e24Q8~C;VwRMdKWaN#h3x2i7Jc$JOEs+m_tskU)!62(6gXj*J zJ&0Sj$fV@+MmmOL7R8>pJgoO8{tYQ$egA2DpB;Q?d_XLm{C+z-yAyljtH0QEQ_k|? zS|UO+=CfM#X-kV`feOAPh7VB(Zu%Y%n;)LPZQ#Vx&3Tf~R00z}v)}sssSq{aO)GAy zS6UUj&)mJImKv8{USqdN zeX8`4p52>Q7zL~(6fkGJ65=jA4k|43#|;;WA>RBcESwx{4E0uc`4eV7?5=0Ab#u37 z80q^pNBejYmV=oh4S7|SuXv|i!+m+0Utr*(!{=KzbQNI7L-p%y+Y0@d5dSIkE0@s= z6Z5EHf-f9wp8u0vHevNKKb5RrP>(H*3@;%!MuCCm(2Sf8RZubxIV1Nq6+Pze^gbh1 z=%~`VysAP^cd62;vw3OX>36{OzRA$g*1TesLh9E+|E$E|a-Xti_&%~u@4GLXh~wEz zK3LZG{B6PeYs0|lD3g?Q$J^0qug;5dkNqrsaO8f`&c`^SqQxpu3Ub~GLY*Eo@MSd1 zCYJ@w#cdIO-C!cR!u;EG+zDlK!{H~t%0soAZd}VM{B07=i`t0|IsVh^>`cu2e-!2^ z^RlT{072x?iE`3x>t|j_`^n=JwY6tqK&zn4XFtrM?}>nyNg-x7#-^D@g^~7ZWdVZm zllvVutfi@&OMw5~@5CJ5gW}2n{#IONWRudv%9;PG=VkBqH89W?y87Rz6{X3ao7AtL ze;9Z)pR~R_yfpJ&zI+)ee5$X+gTlth$%TW)$%VrCvX}2MH|4f~*nz`EL!ncerVaNB0uf7^wD!F%`~)T2iQMP3Xz~!6H_DN!~As4*)?`8 zYXQIUJJ4i%#4HdC+kbylUg%nZ;|+jY?59IwyF0}Q>EZm(l_~jJ=CLdBB<6W8IcKR>&zod|R@Fa6f0ti=2BV>t`0%a$n4CtX3y-%##BzJ9lz?T+3Ky{cnf;ylb47%``KGk^9TKShc`x% zvBQr+vCD-dZHk9cNa7S;cPC-Go(>#Pjyo7=&QAZ-&4&a6X>Z!3i0Bd{;%|&NOw{im zTa#sC@E4OvbgVE}GFaEI0Su{V+Qte;`du5je*q}ga89k8a;ZQk`?%B`4)s?c_cInr zIe0=}87NPV0u_!~Cv_v8t!s+0E+~Q*X7}X$TbLoBY+XXM5zF_VAJ-zez<6wfn4ao;^<3n-LCP?N|n63`CX*9eUq>4^5_^YL= zv4niG3t{MJbCS$ox7(oBFVHtZ?D7mH@=Pr1cY0fP9IA7ghW~W4?Z@eHJv;IHZPuf9 z=P3?%$3*|a`)zv!K>6t`hE6c*s@CjH$&lV)ERiXQn!88+=X-Vrk!YV*9CMzy8~DO0&Y}za zkB|1x^799TP{4)mcbb>qEuMqE26J+E%@@rG56{s;`IS%3y7pxYtOl0Z*013_2ci|c zf67w-_RniH+mR(!a(jy@!h6DWJs<<97D6{d@(vSg(~^$25q)eCyj8pmf6Ho``pPvb zSp=a&?<^DJ!~Kp^0On$^j*qX zmg7RH%8?gI?WsT$JOc90C8l!MIrmI1E*FBnY)`Mv-P<-f9TQ#ub>{@Lb{SCa1G@oi zF_TbjCRWR0NNZg|w_+O*y~wr-B(x$HoMpsVYdFG`RdBxDSiy6{6SW|B()x^|eig3l zF_h%jZ1n8L58+16uT74|v73Bl)l@x`3oCk`X_2t2sdu7*6aDIkjc;uWrw*g#duG%* zgV#HTZ5+_~^1k%#-udytYyYfw zeRXx?-P-ta|CE`!6Ohe2`rUccqZ0=#ao;xvNR|e}Bk<4MinbPfMCc3O ziLx)7>|Bb;{t>j}gl7W5)b+?NAxwk?K*E6?=J(AEJ)m6T!hgXL0VAZl{ah!cb&MgV z@{bQ4lvNe#MOQhZ)^#?F1;T}rPFP}F7sFV?#L`G-?;gBzYkojr*qqW1r$^02fxb;7 z@>Y=S;YV|SAOw(x9$?IcfCa(k9=xA<`-#$tfwoM5L6PW30u;>5xv)u2>Ai9=Nq-Hw zJz}T5Qr-4pfxluz#lvD&ITp3}TtEUZp^z|%`*Ia`hy`zgdHNgR1>TY5vo}3^gN!iu zh{G`joq0^f8{5;e~5AlKma)e|}z6FpFd^o_FJLIakPy11H(2{l0sD+J?{| zZL@@iE5M$LZXL^x%@P~yn!!W+GliCe7Y>JktBfy~g3JT-Wgv`#Mu^C9it+1H0LYxH z=qJrO+sY&h1P6j-7<&sh3l)WumN!mMz?B zUsp9oiHbb9D)2@K93kND242y2j24KtcZ&Hr@A0372W>rz83Xi@&z8Vfam=Y@1DZX~ zf%z{85KJygn`;ea4x#*_sW{l#ggz$XS^Z*gl&CxGZIp)_%*%5pT5IW+&faj$st@R( z#V~?`I0Ft5;Z6ATA9{aHw2Et^cJBIu(U+F#9JvWpjTM*0D=@Wp)6NqUM$w8JK&Gl9 zm7yjpP==g_o+(fT9}~%I6TP(7TI&PQiFP^5#JOHepRxdIFM9OFY?nPHp|FpcjdHZ@ zrQ!7@i8FS~AqAl9CLvbQ480l+$>s4?&`&kR{Y5PONDLs!NzaiKoi8Rt+rt^{;b zSZ7Ow^_FnKvtu(s-nc8=Njvwe%0S~H5~w;tYMiRBq>{cq=Q@h8-?;rdv23`#*84|O zbZ>QUzV|lvejNV?s>3|zCCJXVgai#R*&yxvDTE(z(O&NO0+~Uw{jS|!^tgE;K*cb{ z9WEh#_elqqx$3{2{j4M;f%6Sczlt(ZP+YgLgnPCtXher%YFg~wMyUeI_x<^?&jSf< ztCieeb#fI1N61+szHkMFR1WchQl9)sPjL7BPs)j}o!>%rR7?GE=s6c^|8cO;5*!Gw zin02z4w7+;jMK-|vO=9s{%|foW-fs#y`jju(S$B%sxzZMKsktK8+vWtGcBu>zHP6X z-#*A&{ z+0uyBC6`6h5tDjROuWG&g}^%kZdX;7+W81r(U{g?KW!;hB5;Nv`yn63v*b=MnDd2! z-kuQsd!!y=$IHf3ga7Sx@@?wqt61p1pnX!R~DSV=6YC%{U)iYTd z@@a1artSXS+6$n#0n|4(evtj#qV;irO6gZ=>wgk7JGM2CS)+NMexxHMmQY>E(Q=jc z{Z>_S*20W0mt`zrlP`K!2pYoiS#LRO$F(KO*>V}gqME80X-e$ktV5=%a{rvBx5J*0 zGduhsZS(uz3Gbcld}$X%LCdrNFE4s0FMf>W(zi|DJA=lWfMKqOjph+;|8{i2BEDf+ z$j8JK0@yT%pMz(v5g#Kf1&i*fC1>m(b1gZ?+0mys)@H?O4iX~Y&-F3mxnBeeIc(it zL)(%yqPU;yw7;F!>E)yoSTm8)@hZw~j~?32;5JnU;+n0gv%wQ&X_}Cxa`b1$d za*T^yfop>I9EA3q8I+araaXmiYhhm-{7FCZl+ZGgA>~Sq4Bz>X-phen3w0Ti+Eo?< ztP}0j?cLUiDF*f#l1{^36n>+JLoh)4LCSqz@WDU&)f=ORZozW^xxND~wv0YgwU04M=2bnm)-X2a;*KFN!zZPIR0Vf}eyqOf<3CoC#{Jv!iL1iFW5{wj~8mnKFn zTYaNZc)wldLMVIjZ#7qC^BT)%SltibF@$m>(OxyStPXkU$5gz<469WWJ#)hV4psJl z4kK0)c!IKu-k|7^8gCN+V_GrsxPwr?U!8+7rM)$-n&E}WubP5s#G|mk94fMe zX&F}zMOEglVeJ}3qI(H4km$TSaM>b}HnAI6@%ABl<~ z*~8_4>i*=Psw8ZiC^j9jda=WPu;>IV3JV%pibwYmqz5%y)zQoL&gr=5+c@jiQ+~|S z-tN321?#&~^3yuhfE1%!U(tNiKxEPz(N!JRG4knF&>kW(bZ>PxgoLa1|M41pH_{ZJ zv}`e(Chm8;A2qT(^FEN!IDIA%Jjve{+4LjMCJ--r-4u~;R>o$U7|Q|<9Fd|+r{!z3 z6?4dYIbBM@n@@Q0Nt`=IVU#KUIT!y-^C>FTd&(&C*pe1i)ttG+g2a$+ZKRe*$%0U&gjoj)UJapm(A#^!C`>%NRH%Yb zSIqqu4eq8R7H^2ED9N>OMj{PFS;o>2<#G7{?T-09fxr=u3XmsKUH^?df#fxYBdWa$ zBi^irkOvj%KAljkquwqq)2}epgTkmE>QKlntiy;yTV}t)#o08o%-1d!?&&kHtXG2! z-(1;jjJyY=kXjhtbA1r^zdS~H(U>+f9jNj2t9X5^v7pv7s3g?y1+>J3&(iy9H8I-g zJmPCO&q$!*Ke+1`PE?QUA)m6-uRz1jf+l>=0-+2zd8_8a1`em?U5aW|c*>K@nb9T~ zg(b6EMQKsdr{G+JR%bod8B_PZL9#jdNn#dsxq)d-4USj{Zq*(rj=!@=iV~O=3dAuU5L@ho^yzl(qnj)g8&IgUM zmkC~Ww2;reTP#L9ZZbN@$iU__reWAm*@(50rASrP;(4mWq*@YAdo0%~iHi=E85fZ< zRr5jW(t8VAyy-JuNXANvzp-5oLl;T_b*Hljz7jrIcvHssx*6%MmI@^+0W3+uG81422HQT{GE!tYU8H9;4 z3@!s_vgHgs!lmLFxI&*v`1};wA*mMDXb6a>8##s;g5(vF)}c;kK(EaVze!3EORu)$ zkW=152!#3jt;sP@KE}~SwxaNQeVo9zBEgFax#9q)RaEzM-TkKL^OXH&%+EEscliI& z5OsXenr9@GEAbYMk0nhuSJZ?E+uQHJoNfzXm+VnMY9A}ozAdqum{(fH)}gJd{WN3} zd(m$WPg{4xS~ric_qV58VK3aoGejuVpZiE7GV!Q*E}DIhF>W#A;1OXXk(SeAcIl>a z5DUBBE_c2jZ11&+lmF!%?=J_>ItvY{9iDP7pTEBT_}=e5p5EWK_3*;FmKN#j6ql;n zO9T7)t#+O+{mM|(A=wZNSfvX7rqOoKZ3*jF_h$4Zv{8=)pJnIF!^`{i<^ z{Ohq#j0F{rnFiX=)$c#cEKF+ z1ZRK%Dx9W&6vD1*2vjvzi%`V>4gM#^R7$XmkX#ItzL%@>qU(?z2!AI%8xLq7 zAF=<@QGGEjtWwidEN#z|F`Hm@aAc`a*^Qa`b0Z(a@bEJ~d5IE_a2niZ%qLl&S&JdT z2;+iDSvc8$dsPOTi%o6H3*}eCZb;h z_wZGQJRX1ZqHw7K!z-e91Lga|PAsxYraLS1^L2AuEVY(-gQIy|8Z`{pwWHXq>Kr^! zsw6=4*X0*6T!fJHJ$^U8Hhgq;w{~bRJe3j>IJ*I)N@x2~DgtK>`Ew7|@B~#AL$P-S} z=ULm#zwCKYu$pl&dj-ZkTFi7iCG=~71hPnrH9FJ3?%!)~hb=GiJd_s<(~d_KRCT-K z$6%7~sY0G?$q$b{phs1#ErEy@39(vKsXn%id8Ne{LcyYpv_Lv=l(KCW?F@REzTco~ zzPp65n)Ib9h)vh95jPL=q^4qLKGMf)y=|DtnF)f%6A8SZnbitHV?mN*^!dfC2XYdG z6UxM!r#xHD!aN>j)5UyL(MrBv3Ifu)U-{Tvws`!1&@^@a|3=fzV` zlBgbAFD_huPxM%%I7{@_t@ZXsiFGF?P-w#LvYR*Dy8A69`5vZEO7g^Fof`k=0a0F( zr%%{yTnojPa+mVC<=N0!ejEw6)hxO;-P?*uw6gW?J_I?J|3o2v$SjibzhRs#<{mxEW>`>T_<* z3IuTEWCJf7<1x!2A6yC~(O=9ma1i~S#gFj_KupzZxOvrAE9m-WQKU!yd6yX# z9ER=HgA=RZ5Pa_10))O5#M{k8Cyr&L!8XLYvXAY=|IFb=%bKypj`Osg{VX+}KFxq< zypUtm;Ox;|Qfv#QAt&Vv`;lwd~!6AQpQ_rx2*0hv)ar{!7KfsxFHD%O4_&2%g zUg=l@`nJt9@#$dDZR{s#{-Nfx-GA$sjq2lkgO~$)eWBXju+mIe=9eka75g2$Xp~tK zEV0zGkB&7L{SgtDBAtNY&Nw^~&DHU}E8i;cz<)T<31c4Lvds_&o*O!B&~bH5hqI+o zWS0N_*g8#_2x*Q$I%rqyTV-_=nQgQ8OGJWvLxg?DYzb74#F~y|q$!vkI#{U^Sl8=p zq-7?|*BeM+&0vEp)1`c_0$tO!iz*h?m#CrPk0K=nlgwuc&$cZ)?%c#ic|vA+QU=bZ z^Wj_M8!(rcGah5*q0chq9pD$Gz*4HyKY_12TO@j#8U~)^jbvVwTy4Z@v9bWEYEY0= z%+J&RtjZVAyE7@`X=;GwRxs(n`5D~aKaI0P`2rN)U?-}c+1upxijEz7r)sT0F?oj5 zQDaVQBbG3gj7hHCIJmU+*6w{avO&ums04i^O|%qy{f z&Pn4AG{iU@@F@i>mcIovf;S8A;5d@7{n|qp7BUG(`E1{iL;&P}B`g2sj0~blo3C^P zp~_H@0+{aysnzgF4k^Y!!48n3FrlmSn@>=gV(!?D{E_)2c0(TofIUEbrNRz{7Bk4D zL=jqAOMO{%qNt-=8XZ;q-h=6o)_k90S8884gi<~lV1q0moP+3}v;Y4| zEVq2!|4m|zw~k24(y$SaK(TaL2MJDRL_d0rZdk<`@Nt)Q-9eM? zrT^HJ>vpMkoQU6tHmipo6`U1GtAQL)OTWt5=0{qE)G-jd1nJ(Rcc?Z#_0Bis3j9#1 zN{tVDryn>q`BnM^(95aq{l*N``ysIKE8oAa?RZTM=q=difMD9x^!moY>)97ER+vHs zq&a3O&>qEF*-%SPgO3K)W(ghPIFcoARTLsH=yB=m+Bv@8>Ri=xW0M zYCc`K^(KO0o2$j+yb`M*!PAl3fOz0Q`&~YBSYccLsWuA0PC2CdIZm5~A{XaMg`JZPW=62D)f>^O8OMcC)?hYX@k3IDcCBzR}D1)FlvU zy%>RV+KREi3FQ)6A5lO*HCk_D3N#kHMb&RfP(uRg{^PD`7JJu3S+&ee@F;b|Dik8V z8wQOuV?(3|cIvOOt8{b*TOz|0+ZHa`je81Nb=j{|CpGs8G3@hG3>77GlH0k}tuYhR zpCEA{M3csPy|Iq+k`>XA_d*sQEm>42xMXK=*y!SaX4?RoBVmL3=soBGI^E;-4?YF` z33)HXUXf27mI3OYjv-t&dR;D2vK3W!Ow`oG$#M#pma(aKoyIWa0C!^_M66-`Cj{Zg zliy`n4xzkG8SwuwOO4JSW@+#K^7P*rdhFFZASU)Z5$CoDf=vUo>=lWiIzoKS`}IiM z8;HxAJ^?%CtJk9;=E84IZWTf+3LwNFnC;;2COGf>y9>&b?F&axyV-ljsRJ5O;8Sc` z{u}ltBSohV=M8XgD*SzO-M!}ZAFuSTfLa<~0lpR>qCb$i23W*Xj(@)-UVdI*@CEuY z%!T54B{s@yW%U0VgCJdyd?SU8zs3ut!%E;{Bnyhk1LWtDTy4XU{-7v|LU zZl$rbvFar4w@ue)*+IDW|Cj)fF4<~&LEPHkfS>3Rktv)5uL$vN;z@9QYA}cph@GV? zQ-6J3x%6Ly9tb!-tl}PGE1aJSYCA;61$o%q0v%7ovwlfJRLnsjWK4D&ME_ZX&p(7A zc4xLtR)^osnCp=5tLJ{Q#G$&xb`=oIHvs+P7eH<9W$*RLcqfJxFX0hc-o&-cb!F9b zFU_-t!XE>gonGX|8a$b1&Qq2_oq2E6zB8DK0>V>1pMYAWvX8mr_sX&tEP0^ILq8Ox z(l2bGt#7}ZBR#$Eo31s_|Gw+R8vvsT7%+`+E181d%`b;r3|XbsoAP8lOt-$tmD+z! z$|5Dj)iWTP)oGJovX_Ki?DP=SOq&TuNVEBb4Gqc}mV_pb@%As~d#+?9*IES9BB6Rg zjS2pkf8aAJ@BED92K=j|f?N7qU@}?q`eU~Up}q*K-$2i(*ckrFQBJEbkKtrc^(hIj zJjYd+&Vy8$k}ea>J=2>lDq!=-4?W_%Eg*UR@Dl0zIYcyw{DtV5QI1h(={Pvfmdz6Z zYOC0T%iW96LxL}Kk zEk{n$lvfUa|EL%QMAByk3+ArkW z&ompCQs0K@@5%n1(-=TR>zdzDECpFX8>OAKOg+KVn7YhxJgbp3BP|v8-YgORz^lxpQ7Wy z2(TFYc?mY1j78phsBd0cfF3R&xqcDvrbGj=cEW{4LgEb&$@Dwm?{CEY79FCxZ3muD z*y5if=|eN zU$1#Q!|7&y0uaJ*aWynFj3v!*RYic9BbfYiAVvEY*bqQ4sej*P42vN3dWs2>LBoMC z>GK%Hf<-W^SnA_8T^um|t#5TmZ$E`76}8y{A&3C!DjEXjD#AB$By2!n3;83{(Gmcj4=OQw{*tT2G&`a4*lE&2-VSqNS^7mM;1!<7xU6h(*fat zl^X-DEIJxCi-pK%((|w3EG1^C;D)`vDc&E~xPxy9Sy}V$Dd-_f3Dvs@ZUz`?GD2uN z(+)6==%a~{@f%RALGA*y@7d!ZIa_6ld?NI z4vued-_N^&*q;}mtk>XCL}V(|{&S5evL;#qbHQL=>?_Rsg_baoq+1Vqntb%C<@Ax6+j00Rze>}tFx_@esb$yIM`X95<{=o(-VSls0ur+RhVKvo4xI5sG z!M&Y%$u~tPlQO{?d|eJeD9KMZ_>7WX&AEh=-ou(gi>PiA#aiR(O}7JVzDzW}gy+CP z`*Wb$9O9Wm)Pqg#m~d}Ir)H9bPjhGcyv*kFZ>L8_%=>0q*7PEr=eDBozpMlYYRsXnQMSu>l1kfV9AvAgclwm#L2y2K$^}_gN zr?E*LvYA*##E!tRe>fq@#@C=2n~KGQk{EuE&u{#lkae5C)2>k9vGcI|)k(>P^{OVxZz$DQlgFx8_ol>T`|8wg*z z2;G(Yr#sN^Z+0soJ}Qs!B~wu_?oqx{t(7YI5I*b<(KxB(j6edFl7FS?_+moUEUooz z&nD+ibc7wvjoQ(>4x)25W2xcn zhnb+STc~quSUH;di_Vb|$xbZan((`WUJmR=hzt(k;x~}i;q5%G*2I+~OTi5f!*uo@ zQJM{lOv$-`27&X&7vN4N=|a?#w0e53Qynw&>^$-*q`fFY9ctl*fq80qN3}G)Jr={^ z41*j?hln==>(NS*&!wT3{v*E$hwL1K0m=!<5Yvmf!}=T4$((Sf#OJo0Mpc^D;GYIe z0Mn{$LBXVmZio7_0UAb5zbS3khDS-Vp%Te+PF9r6A}|4>>8)D?B)A~PfDo09Dd)bv zK$nl)9W)|%1kuyGbH*DX^V%(9wj+2FsqyZ80XF;P`6FX7(KKNquF7r6Y=hK&gd zS2Z^mXOt{Rslh_-EGG1998hVnR@hKDgC$+>F(?nWpTW<&n>%;5Zmziqa6Xt^+}yK0 zZi)*UZ{z=B2=^8K=1gO4LfPHhyGAd!-+zOviJ|PPkyFrS_Om|)5_%nMb{@?CV3FboJejuya(*tzbSq` zZSqiL!bP2p$+Cy}Civ)7-&UdXq=(FqLTJrAiZ1%VP95nD8{b&#Ct56EG4^b%>V)Ux z%<@(Ae9^!G07Vh4}ynwh9C>tjI+#6YO7%X^RFI!d9*z*ZxvQPYMyH=OBOFEw?(uvu*& z5i)e=;Xh55S93MC8QHEh?>01|cdX+hfcpY>UubD^J%e&?X|j0ISdoq)kRg729o3X0 zF76|cO5aS>yO1<^n@C8sP=0Lg5P@k}ur|o7f^gh2!`F=Tcsk}NL5Br`w*AVCkS@3l zALZkwar<~Xy1yy=ms!WPsC)~=BEXWf)EPNA8AuxCpSR`CM(>Ge&4voL=%dLOJT|+p@EOcMGRd3v#EaLh)0!ayan0`@T>{f-E@lqvCxH z`}%B@XON|{X(QL&JcMKqk&s>fY!nl9!eLOGRNoCn(p;PhK(9fI0ahlXha@?rafh`u zUbuHMvF5Bzir-;bj2M$#h7q-cx&VID>{(mrpHvJ)xmU9Wo+65(lBGE2_XMZ_GW72Z zEo0q&N$7DF=;cOar6~zl?9+X;nro*hTIkbiZ_7~0k11@d1SN424JTeFgSt?PF7PoS zqCn>tiDnxm%8U!Cz%j^P>BU9W%n)lw0kfl77(CgHB%AnL3(5;|P9nhrjn903H!lpO z5t_ZFt9jQ+`Z=e=Z{V{5@q!O2I+?s02udoE$k3t8+tvyx%cA zIzLL;wV1;I8e0qd2*Sga=t$y#F;W}E3O`>*;w!%P8!AQmvO z6r&Ndl@X6;RTixIvt1sv(#OR_MnX)t0=QT_sHTgb3K6w95>5UTrqRL-OU7E)8kmz` zW~CK>$@3BaKQ_M&#Zb|H!HK_~RdR37xgf9tjNQxJ+&Mq5Ai@qqz7(zKjlUQ@xAg;V zteA*`1DB*xakNL|+)4zTTq58OY*Bn{z%}WYGosw_Vg%#vg8YgmOB*SQiXGM5LTGyb zNZlgJ<*QylJsqWA{UX&BjSb4fHGNz7}e^;NX-JFJ7nc%ksxo2fsb%~w-VG}JI5 zOjH5l$vC$U;Ns+be}a=RcKR6R&AgqPx|0#SC{m!?<{1PyzlvGOAj%QKb44>5ILqbz z@ko4qDU}{W3}ZNaSmh~-_c}Aq*6mx9SyVmWxGF96%53jNG62|}-)sCeZPd?DQ$J8^ z_RVuJG{YzJ<>$a^qIYLc&^YN3NkcCYd0Cp$#h`HF9nJ&A_nCI6rqOjgg2QHM-!#$)^EOuS}zv*b}b15fj!+ElDzMf(VTJ zR!fi3XA=nw-1GA%nB-^5wHF(i=IvvOaPqdGB?e&WdX#aeKa{H1g~`AYVWwUU;; z_E*T`#>gbTBU#8v7$XC5sP0WSq&asEpE-n#Y*{zUcWfFwaaql3+VpQfAjMZkaI%Br ztIh_O>+%tmIc#GlmZ>naop)eeN5aFV(TlmbaqG@~_-u zd8_cSD9og(r;NnJz5PdCMXNY-Z5qs$?i9*Jv^L}ZRcL!Wtn5vLKSS})laj1i`m9>T z?LW+A2EGwz2p}KA^XS-*aev=BsB=e-FMOAB00g_rHq9|1rN$kI>npUT zN!>z&b_OiP9inscy<%q5euppG8_x0 zE$h)C=$y-6r?-o|zq&$MS9K%829_VzA`zn~FIcsJ$71HSq)6-7mruQ)?&+@x1w7g; zXxv@-5&IfaM%BfwbJm=f3RktTx1SgB5h28jm@?ZrZ=Ghxoe&Spv8#24QcOIn<1ZE| zCP|mER^qW@_z2orJu@M&jc@G9p9|Cs^?!cxpqlXIAQURrWjj;ibJA>)LJ%OHa^}i9 z)BEMA>Xgp0_n}A9p+K(L>4~lK9l{{GZY0o7K^RKd&8bkdJIgczsfvZ1AUEh&3>c@p zy;(W1e>d31QI#}JvBHh=%grm9M;uVxDYiS84jQ((L6X4Qp z6ni(M?6;!k#6t>_JiFKzX$i1|lFaUF-76LiY(PLR_lF{xM+u47NeBnCA6qN`f=l>w zc7jEOv79d4>b{MY+v$`IfwKf5k#iOs!j+ieg->Bo!}NXMAPZ5i;1ZhH~4#z ze*egDA|kzU?xb3H_hL7pneGNAO3V4JkO+Y=z>}B+XXg1f4?JvN5Qn`VSO-5{u_M{e z`&VE^iZ(D4#p%20YjR^Rxz!KzixCVLHi}1GkMY2^G`LVB#be_be7%+0t6#mU z%Ks&K2)(buI9+tE?vH)?C7WS7=!vcdH1CQ5XK0q+Lf4yuTgK1H!K0fzknjJW$KA=k zU5rq;7_qi}q+^ut5QCvnF*cW2n7x#!p~Q#;dAK&_5hV`B?V@}z=<10c8!oO%jbzhx zZCndqjeWSrohdR!<~dMbT@Dbg1G}bhBpPIxxm&Qf70!qemI4Rgv9L0Rc6Cw>R2H2A zT;55QLFtwymdW#|B#S>7wvAV|A9Z3d#k^Yd2vz6uzWvCls7^Org!-}l2iZ*8N?Z_|JQIgGRHyYnkY56k zqFRE@Lj@w){2MMxVi=Pn)4;F-WSq&SHgZ%Q#iftg!9!^*(BlO~ZRf>ow+>cfMd%2L zA+5PWgS|j@46y6QzJHtogN!hs#~EUbeR;IgRmItaWV!mF!E7LU=W6O_ zGmw5VU#Q#RX4RPmMjE)F*5DS!-OpMymDaX0`@}b%9)22#!$ki*SUp_vo+fIr!XhL; zL(4fy->(w`z9kib=HTs<0y;7N4(p$b7$02BxC+xgV#60KOF9yzWSsrt181~FlUuw;Be`02Fv`l$HSgM;2+&Szj|RLRU%6n{R= z8YIbb)HeQ@m5Ya(+da!{Sq_6KMckm@in#4jLH-w{r1P;i)hS%{6sNKuYw|HdLf%$x zI9UC5dDP|T2!RkocHy(jxVYc}u%&Nf&(&C3<|O`U!vYloqZH&WuG+wm&-1wWa}jB> z8uous{h)Oj^=iW$Djn4SmV)oEE|Dz@vRt2q84J4$6CwFDM;v^&Js^Kl3?Etw5SapNqXr4(yK=wu&T8N#ZNL>^)Cp3EQ zZXB>H1^(DW8b~zDs%ennWPbY8e0ryju6#IaE)op(v#}2)=#h^63=Qo4MNe2bIaE>` z?SHYMpFPAZ4j0n@Ltt+%1AT+Cba5|miq2__e}7cAYdPhApK0a|Q7-qF3e~ftb#Ww3 zqy2Tbx3G_+&pnt>Q48UPLner%^b5-=u-*Z&-vw9-l`>u`re$wVaCPh~|AkYx#RHvkqr_)21{kena?cx3tF(`(dV{axEw|n&Tk^Y8`vYgwUeuGl$Iwk5dlHIT2 z=LGUam19By=%4oKtWAfQn};-bLEdrR4yD25QY`<{Q zOaG|W%xkj&mJa15Q^7~UsbNlEQadjVwnBeJ)JtBFoO~xs9!v(Kdi{k^VacYtN#n{{ zw86~3^_i&|xl(hxVcnUaMVF9LFb`2BV%!vgnJQ?`5ot}&HP~ou5jW-|J0CA}#CvKnM$p)5 z43GI(&5_=-BW}xo;oC8&;C=5mLu& z1|bH4quqiCTK3v2o0%||@QuJhI1XV>lbEs8JMDv5^Xtg22uwt!g}KMv+>YSiSr6g| z$_dXTiE8>cm+jJf(L_= zDbx@d>$I#@MhzhkL+;5-neQS>|xR5Dcrj_X^-VNA+O9wT+wz0qG#IL;;-E-4-5 znv9f}jqymuDMXF&OeGi`1T;6^v@@qk*(x9on@M>p0F2M+QziZ9S-6JHd>HeYVZ~_I zt#^r(ZJc^V}rGGpgmr`Ds#C?r%RHa3CF zF~&sQMTMikLd+Iyd-)o}B}Y=qWqQR_)w7JO6Jt*~Q^|AE zMm55=W3L$(o3t2-!55uFQp$EzOCc*?h5T z1zwK~>5661N)KL6yVfMvYOq(+ZnElYGF-0(|2eg3FrA9DxwaTi?O+ct&dg`3AnaXV zL$_w-bfnT>9YjabjG=@u`7Ff2A*v`YBX=a0*4yK74&?j5J+avGS2~GG{bDn{p#Z8D4&y_ zKrC}~JQ!x&>L9@d0|t_Jdm7)h9rj(IHE&qB7cSjTq+Lv7*ujJ+odI>iy8^5kHoY}3 zL|-$n=MBIwEn&X>?xHWrZShxi5koqH%sgwxGy;q?!JTjqClxhs+BAOBanzp!2LXh! zkR1yy4Al4Tsd3nPMB?{}Y+V|d(zDU@>%QYE%SFU(XN>UF;5;U+3!wnSXO;87A0o`BWzo9&+<;r zE{4pbElqK@g7iFFZ@8s#D+q%m%CP6f226g0K$&D8RiLUR4zheTI&>bN&; zqjM-Z4e|bjmEZU9F(4+ZHdQtLj$YHBpUMnbjj^oG^z!Ot{?K+7{Us1v>uh49`mF-$ z>G*C)@mk<9Dy+^TAjoZ`(48W;Wniu(<8ZS?xFb_y+{J;?$ z_XhoQV=-i1e}0_iz-qDR=aQiGjIgkRz;*fL^iItS-KOxS1?DNePEK5>J-bk8%)D$Z z)vRyS9%V)cdBgorPz+A1VL*sFv?&6ccHWzvG6gqAZiLI#b=kmQTEJVgw$BAMjr>;x zH;g@91DbQrf2z?`*y@TpssbC-G3?GuNqxtv*71m;#*nxb;PZx z=OM%|ZREQPt+7&NM@(VGt)k~qiZy%b1=}R#yhTQs32$u3iZa)dzDx*e7@j2KTPtD$ z8t1MNSQunC!<%TGHVCEAD`UZGK}fpfUw*IunRoCZt?H!TrH$t_ZHiz?q6)}(Q44Nn zoK`jy-)%gLX7K2s6_@donzqPlM4)}nqU2&0(u1FDj9(!}6~(67mQR!OA}D5A51b#d zWLhEt)rGS7aawO~IDnO!wUFu2Yi_uJagiANC8(J+_sgc*TTrKG2S$7oP0W7P*T^UM zCaQOE!%pc-zyHT9sox8d*G6e4-}btW0MaL{Ww+E<;Ce$3cj@@F+4kP9QdHo-V;};9 z8+xF{Ke@zND4;hRcIAxqL#?~Rk+w=g|G$fjXBhf&sW|`khMo}V>rXRmzp$x7>1*)* zS4chYrHug)id(gP#gshU(wEtwJa_3Hv7BDq>Wj3E58VoOo)~}T5ZK7J{8zO8(7|sh z)FA6mUuIXj_*AS2Z_7=-67EzPiTep3#O?3)+Lk@jAaIJyfo~p7+HF;+W-PKgKq3^g z#(6_LTK2j6Gw02e#QuxwPLwkBIOqRjwUDjO^8?M0y{KJb<=;r&;IH$+keJDjCX;(K zD<&XCZOtkT9AV0t)1?TZjtB%cBhqwYR!-~82VMZ@$fZiGHKx{|FoOf3^d@Nn(x-wG zM;nS>$+>ksRdPxx>t|&#Yd!6FIh%sG>sz^S!dWy=6tq}CGiL9Of*!r#f?Qa6xA?Qb zyzuwT!3|^|*6e^Jzb)oT&dD(+Azojgk=9jPoa> zRH(~e)nmx47rV7ADEaeSCR@j9%3m@zWnNg&5k(Iw{jrY`s+u3!efi9pXxHUTU!rBY z^NAF(LgM?>chm?G^&~!u$a4q_t!8B4;?J{YB<^-H+5BGa7R&^O2F!gA@v<62?jo+A zSJAT;2_eg6WQyx3R;m9GilrtNch{lv$sa8kFr@X88TJ)X9-$L7d}(ryz^#to-B=g& z7RDkF?x_FkL@(zWD6DUCaf^K^Tfc^LTAE>NY-C~MUDu0X@a;U~DET`pxoP-&Wj!?g zn`v1uTcL#b`FX&WEkn%aH*TM=Bv&K~7fGs9@I)FW`}vU~YR5iFj@JLxXMI1eN(H|W z2RxdO&mAWRGj(GJ@0W!2nBXMD;WxT^bx%%CB4aG>5FN1!HNE*`=l&}x^IsU;7nWUI ziYikN#~ukvJE<<*uQN0sJXo*! z*;BBa%YFGP!i0ZHBoQbA?A5|0$6EYDwFGmo#MvHa1J_zdo^D($?{N@H$Tq*giHRjo zgdZQ!u>xA<{4lsYQ=*?#++wOSWn>{biG+`917##;7%hu}Lml~vf`c$)$cZCMS1mc! z$&ql2m=h6BUdEGN)5VxGxjh1BTtu1M+bzWn)ks-fVAO*N9gRFBh@^>*sB8nbycx(= zlS%BgR?z-6Y`F%72-NvXo43GN!R z$KsbY*0_e9yT+kZr6;r2kBf7 zF#LD|8R3 z^NBmg3a#I;r~nGl@*M4 z{l?^?yxDmPT6yXsi9YXrO#1-F_4Co4GaU>o4;AwotCSv2 z!4upI3zR&TR)tWOK^6JOjs{odIzOq`y~gAMO)saG{#I>BrI`!T!X?W#kk;W*B*G{rm`x@`xlI9Yye&V{X`GU*p(a<_4 zw{(d~&rSuBWK!&hfq{yEW&^fMyWz7$_xsI~gQ_*;FQWx& zmfQ-`Y@a37Z87Sof{N{YaxxIk6(s{%&&JKN)TMJ3QLuqWdFwv^?McrfRn2ObzWE49 z*3HN=?Uf-IE^uEP%)D);^Y(Rjy}L_zd65-oKvxEBWRZT{y*8iho&C8L8$ZYO&^m+4 zBBJIR*c9Zo3Q>}67&8_VFH>7SVUaRNSC(N0MOVXts_eM*BQX&Ef;V=yE>+abh%wt0 zxZ1f%5D!)i2Sy@Uk2JdjYioD5_xj?14UiDR)Zd%y-<76%9v4*2VF%-Oi^wZ}6<^xq z$BM82h+W_6PKnX;2WbpUw ziXwGTl=U&?dhqr+&$@MQi6zSx>KpLG`)!a4N|ZUN)#Z^Jp*v$}ABke8N2-s8o7H!~ z+6TftOs4C@$y;_Qo4_N}!8+##;YK@3UQ#6tL%3NUDB4uUuv05eAixJZNO^_sF-47J zhnSz~EQ@Y}R0tSNEmggljwKugUy=vp6Y^b0p^82s(#~`SZ>q$1djp>NFM+|E0`B=I zu^$rtMG&vxmiEk!nS>Y@0AOC^55b9Mo5#k*!s?u?8*$W%!!26rL0gTZxs%VKtn?9` z8CQzSLuW7i#pA{0>lt(yY^N<&ab~cW9s@JvgA#i_-btFm!LJ z06vKR2FHMYpUZszWrnLOYRSo_&wTl1H{;bE#dfL+p|w1g+R)+&4|S=ac|c4O4i}P^ zFLXnR@t9i-C~q*}WD2MwUnPs{E0vszkw&+?vt zbA}hFqujR^a0kg)_x2Jwb=h;v;YugH(3T9_VRcJqi4AlYuv{@O-Y~cDUJuDzKRGFt zClVL}_N_b-OeeINbZ#O@I8c$76%_zC-1ip`E_s7d{;TKdMVV^$G=-0<7>3Vid1at5 zz9T)+oJ~hcWlII#%jP{jEs?AT0Z_@jrQ7_1b?=^uW*S1!Eyw~l_DpNbbgHPyJ z0boH;#-UmBkndLm`xIGcAlCqhc!6+gmU3VRiZqqwX2sovQ|cP9m9S;gx=!Y4w&>WDEHWOt=NZ#ZAbmGe($` z(Hpi35&Uj{&+O9^cGGZ2Qg(}C;x6duI?n9C4n{j@pApB>tmj<)EBPhdvEL-j-2LuJgJo@`gV3|K z6aWr_sMyzWUZVoi&DK;6he_^z(&K;yYh+ZC{QO41MLV%l?erqP9=lU3mB7p?vBeka z2k;#I!*ljd8{n!FI6Ft1H3e++p->q)J0RZ+@sT2GVcJ>M8`V5fu_6oR4+bb?!ZNf) zlmTro%Yxt*jfpacJz4EXg6AF zao&jO$s<7^*9Km0^(F;I)A~+8l1(9XkbMHfrIO^sI9s?U)B_O_;F(9wKg)0BG?CBD zn5Pf_i&yAKYRfJa9xk4qN!`0X+lJ;mZ;X_X6%gQQFLMus_yjgcs^j{?^^M0WniL;n zpT12A&IOYBAuRwvhRzdCS0Z(thZkVtUWLSeyVlWA-|Hr7U>qUJtE^pmDChS7r1T2` zR9&dH4J%Df%=QY3F9O3y-8TB#Wxdzn5UrA5(_=gK|AOc9J=fD#^HI1zbh)jHw0NuJ zRx8Q#R6!#jaMrp{dY`N5G~?rz69wIU=(E``1AW|gB*M@@Pg!RRGn()`w`k6;94?sM zp9>GZ`ib6Q$DkNp&p?>NQ+b_vxfUts>kua@U z0AEO`__fwmg>NVS_3jw7fFL;av;rM3M2ty>x~rKsj}5!dl&(p~GUA_3I&2LF0`mIz zrHDeXjK>4}G-tK@k}tAp2z&Y4ALAk}G~seHRgAWcrWLAwh=`imy1(3Dt26ajA&Mq| zOs*M`SJISdK&OBP-3kuQZch9`i5%hU;uRz9>qQ$9GFWNRhEvq&ZQFrBa106Jec?!?@6B`at7K;V;}^b z1kHlXHBnF6$04%Fp$8(7F}t44u>xXZFWW}e(2nB8>Kkzvz!35RauAlD6acKBFR;DP z-x0(i1wq7EFfWURrmPhz#^^M;-46cPF`8QhPzHGIyUX_F(V-%oCV6IZ4_+Zhs9Fm3LA~=FUWE}_U_Yv!bfJQ&q#G~P6@hJ@6J2lFiRpXydx*>OtR3w+9cP^E*mzUO$~3vTl7C4h4!J=nchOQH$6kc{2!r50Ne2JP>K z=&!C!*&Ktf^+ix7fd0Rs?0?E@9&0s(_`l;=$v&m7TUZ?>^DOxZAeP1DbSpsvm{cKS z&OUfbq4;C|oIX<~enKh_5#*YcvPv0epB281Y181673ffUc6T$1o$(4MOkxWXD(~oB zX{e*+Bi7+_{q`&)jX$8*qLge+Uowy!`b?cbY-;+=Mo;N1|A#b&vGEj=wG?7)5sI*d zKq$NLv5}Erq1M2pN+n%g;F=9MP`ONjG03bTR-}D8+dfcsH%HIg?dAQmEpJ9I@7mO_ z=Y8bu@agRH^Q)^#ZAOmFPL5XB=W%m>-R<;PZx^rI!^IK8$@hJ`swj#G5jO*sLpC`Z z!pw-|3~9HB=+V1NZwYysNx6cA(><;b*bHtaWom*&JEyZ&V2HBwZs<4N)X=eZ~6RzU)-lKXd%h(%*XnCgaq2#uR%2z&Mj0@jJMEGHWYOloLP zF_^CE4z7e3fA8o%*b}OIwXF4LRrr&yX(iuHG9%8Vt6XyVavJafD}Nj>aL<#$>C&y z@)LQ~mPeL;p@XoCyS3kwxPnyp^7B-~oK2!riEr`e;Y}JbzZ#LGt(C>)Lm%|Cyel@~ zrL%8EPCV#U|H#vu26V&1YCs(y+rAJcHa{ggeCh5hxu5?o^z7=|qgEhvoJc?D)vb%5 zlNMLww=Y-g905n3!BlIc8xpmkA9!r=2l7tNoHzrmmd(IJmqEdb4?Ux+fe&VdTl@0P zPd2lOLVQ}!Mz|N`8%B)dcsO#^-}E3y45?K}5JRe)TNX@yD0Ns^^Jp;3H`b(|Kx&pyR%KnQyh6 zW2<}T0$c^WM4#qcntO#_I5}%MKoUlnIf(DG8dX+j&~igvE8^B8<7^rh=Qmd^HVdj> z1lh0{g?V|gv9bMuAmGk#c_O#!-e)Z%NvH#$f`NNaBNiH>38fJ&K zcnHll@;hb@zAUoEH9_CVBZ%X?giFOXkXm_Zed1{t8mHiUo`aL)w#Y7aMsCK<>sF4o z$M1C!+|$q5)%EG+;OLpd(=9Z1x7)|X(c$6dn#1#zhST$d?rCs*Q?1JtkqFPI++~Pe zU0WH`b>*ftsEp*gCKlzuJdxbQsPJlZY|GDHF2yUq5F1%daP%V%U?3;VE6Happ)XR0 zjZx`0KVXTtRbvmd>=OO;v;CUQ?f=mpdyN9%-S~Yy@rBOjUiex(}9K%)TsXdp};x}oxYRL836vpiFUj$hV2y2v?2R|pGiX?6$rwG<= z>)GhTpCQa82h#6$@M|!3u=5>I0`%(H>f2wE!A-TzE}U>N_1j2;QU0{{Rh98E8D%xo zR(1{Rnc6JH9u#gTJ*MLn$}2UxeDGv0(?$hnq)-eL3@8+Mo_?=u^l=dIov z^96{}ptFC5xi6QyH-?6{ZBr1h#(&kZsMP^qX_L@h z4tbV}%{!f$rRFCEhp^lWug}G^a?=iGKo9|3DS=}*v8-yuj-DR@)|&we($Z@6A;)JS z)m_4PT7Pz4@_8^pXBoN@@LpJ>~{e8@m%vg~Jlk8OB!v zy+owl@+mRQ)ht`EZ0Q3Myw}TczOdkm1{P}}v>jYkS9_vxfHqcO~sC^cYDZo0q%w|os7%e*P_Q5u4UaeSW z>+xayTi1j%&hMmlsad*AQCw#jBFbU4@UM@POZ3h|#2chd>N7bKn-r`f3}p#8MZB?x zg296C^91i%XI)HsSThN?A{>urkyCE-MCvV;-;=@=f=}YG>`1OBU6KyUSnTjUW8>2> zv|*tdt##I#lb{k9P4O}(eB|d@d3hA5>m(5`n;Y*KX0}Nm+)+%M;J3C8uDf=S%Te|| zQg^qsX05t@Rdqd)Ep0~=R^2x+LaD1;mQ=OVo>uAxR$AI_Md4=&EBRsUT*vQANM<2) z3xX?l02&j(2fOSdPRkt-^Cn<$zyHw;`~&dz-QNWH0iew#x$-0Ht-zMGbbMc;8O50; zk1(2vYqW`pUCdb=I_kPC`?qjCXtOqFxyKwta`|b~CVaaV@)&kyHTz-+S$@5)(`K6d z96dL|$`Fyv9>oz-U3cD}1Ahixz6YJX7?Y?kSiBl*+7KZv^D(I)8^6x7KWdF(Br6Z_ zgYOR7*YDNaxx9Sq+mzr6{=#~Gj`vy}L{4yDo0YTD+5Fx(nFv0@8rqyzB#3UiHumX$ z&^9?2*qBzs*t*gA!e#w-kZ)1SuTuF zN##QvR7L!ZOM$FKDYHr#Kx}ed^;-RJZcW3cIJGJ=u6|cwr@CkN5*U@kWQ&;kk~u^s zug;D#ZdSJ?hd&Pz_r%U+WsqTdt!Hs**}J1hgNu`gAw*qs1~<0iEB_1arp^dP24dmn zQ|;sWz4YE|c!N68o{5@YEW&tTlwhC6%mwQZ0qcCRb}{3fZ5vm0dP~5f7Vd~S^GXMg zKM6cZ>pkCA^Ox^dE)Ix9E>cz(Hm#n}RoV2E6u9RF&)38yZUHv;stIhkpUUDp#HG0$ zmc$qxLc?ids6|lOj*^{T*up7|<#J5Mu};!Ar_6fVY{xR-afkOQpYmju5#9hy%qC)(_xGFdRj-F5kVYvdMx)hu#Jsh?ODJL159)m_&l)Hy3WwuK zsgf-ctCxM5T8J}KPk@b{?|Qy}qjg+zyq~>!zCI7_=RiyXbp4Unw!%9_qGpeedq< z%PC6mpo{?f70^C?NIh7jM(K&7_C`0k&_Q9!pB5GQVs3D*HzAu6)a>>4{pL;t?ObLG z^r)f&U`DNepr1h5lPGZCh^$pom}a^q432ZGPRm<5T5zAI@`fh6(v0mDX~jqjWC5si z_BR#w?UL~r<7&K>+pvgIChjhJ84SXXpBZyt(E9^*dsq@X3}sInR*{)xjtAKRnN!CC zkDogjeI^Hwcf@JZNRhn#n~G6JdP=WR&R(%trEmp|HpGs4|ApQ z&FDAXv0|Mslw;2iS5macs%nLZ2pmJ0m)yBJ3AFRAj7@ryo~oK9i}Fs zf0sGJZ{Ek=_cacilE2HU5~`&DUN2W~t0G^w!%cN~PrY64oM(Qqt0Jf8Y#ut&_3{#5 z^x7bR%OacN7WjXU(F_^G;~HOLvJtj1@9$4Lm1r(q4!*(4a!n=<_(_0$siP7j&zF?V zwG*}~>s(b(Nxpb@Me`D02WidKJSE&QeM3}dL<~agPZiO9lj&bA3Xn6s=k0SDmsglY z-@8LQyF&!QJ;#~or{Ht7ZrB2Hty!Uno9$0=7UXa!K?{deE1x>lXT}>{hz^8_Eo|$D8}MUtK{t(N&KOls4+zkSRsRoV`?~ zV0TN|7#`Ed{7wx0CKPV55Ef{L7Qtyyqw#92uT^T};cva39R)HhRRWmh|6+j(jGC`S zV>!34fOsMo9o7Ar+32GU>ud*yV?l5@=vPJo!k7u27m*FkDV)}?=MbcHHPJ0ip8e$7 zeLLuP)TWM)D_E|Qq?>-HP&QgikZG8Ss;ydsAQU+;W9-bez%lMS6mw#^Tz)Uv`lnJF zrf#t_znazg+B#cb%s9Swh25H&fiNxrgFy#hyI*FA-@9BMokIX$GsmbxG zKf-lNquA$98JvXOnJD_5BNgYHUz#yVzTIvp5{UhBl0*46BQm5YfZDo&VsZB6RN4uhNg zH5++*ZQoaU3~YxUrE--#t-4)-KoPH90ZhusKMq{Ns5@m8xW^4z8M{f`K?4@V6T{2W z{q+2&C){K*k0ZKO2btjUbq1NS1POCYc>|}qfXu9e95!gfAv^@gqG`c97tQmMz3zB6 z3pBn{?smkCEk`@go+Eu9N^Vbh0LPqTe1YFnFh_zjLVV6?5;(K*%!1K}iQ(q7n~8B| z!Ly^N1X>?eq>YDZ+)Il>0MeE%Dx&KBTfwcS6`0W2^pb;T+5NCO+ZD;K^%P6Ar7T%f zS*GD%z?4GmrLO~_w4k>S+CWOW-LuBVR)QMhJW0x|;(KpLT^A_;V6VOa$m?Nu|IP>O z4lnitZqFX%t-v1ne>{9z4*KXLZE8*U-%wmD50`e$SiRLl(k(d^Nh`Yd{dJESazGy0kB_ubh*5A6M$31dq1~F=XgLJ-$*N^lQ9mlMN6w^ zSOAp~ga)b;I#v(3h2gT?@zEi_?f~EU6*p$wx!4k3vWqADQA0%w3}z6p zGn_Q>mdSh`--Ud1)T}-rE{8X&w zOt;lwZ?ueX|CP^+z6{y08L+1y#y`-N%pDjINBd9x;BF8IGV4XR$Y1OjGdgHOrtmFbBJP zW2TBrD4=h7yrkH9_<52T@D5U(uwf2#$;PgA2UefloYVP4m?rhBQ`wqDo@T>9N1a~k z8#>Wt3cuBPO`LS9d6Ayk7q{?Y${cPpGpqNHvE>HpDc$E09o28ktWJMZCjI$3Rq#m1 z)5s~U2wZW(j=-gP3GzCqA%<5x;mPgrR4T^09+ZD8_Z$_Xs)l`KQNP&bnT{2g`}d`C zj(FPasa9lom#r<1k9x<#SW>-|iN3=R*L2bB3F*+O>5yYU9vaT8#3<&T`;%bPvaSv9 zEv4uj7-QKJvJ)LiGB=%U z|6@&)V?-GrFR$EbL4)R5s}9#09Kxkw4&-JDNV~b}edtCXPV7E6JDi{zTA(G|Ig+n1 zIEbUq+3yM4S)>cTa8$D7s;Lk<^Xd&j!ER1we zb#RWVZ8boGnCOsC&shu;UNSA&OWr*j(jI-em~*~FOeTfHNeT;MqRw>quTTrm8F==M z5DD!vh~lC2dep^4Tts=nDEY0z;!?0Q}rm!=|){Z~INWrbBj;*Pn z6n(dB^wiXTmoH#e;YNh^aOviE+TU<<;&xGHL*qH=b%ppoTxHs)|g6 zL`nC5mjKxArSQO`&v4X4|CVHR_yVMs+Rn}uvg$Uo$oH^3Inyc_uPiq>)imtp&xV;$ z-fZ81e%YPo8tgwLQ!M9YtvL&HJF6*d*W`(@UOg;nMss=II_|}T!7AiF=gC3|;TuK5fAxa&4&g`x{M3buGe|H>F zkZuxm5#ZQV@f?sxm;Hu!bA8IQOTye=5*x&A&KYv(Sgsi_deG{%-4^uPSJF)EcfpH? zeseEHyoejPgHPGZxd1#&dYRGwjHqAdYZNzvkIp1m+QJ&fMp#e5sa^a1${4>Mh$=)I@^0g*s%zjZqIaxVwv z%q>N4u1N||`pm7{l^^kC^GA(GBp|EHUzu0itA2yr;*N=4>xZmLlb4s zTkG1K>D5aB%{k_nazdn8_swR#O?qs8g>MG-$Ch%TX5iGqzQ)|f{8YmX<6W@V(e=-m z+e)3}W6ZcTm0WcPpFX{Ow0)I~h%ZB!9P4;+!gl}qt2)3~zs={myGhjcmZih0Yq5>A!_q@L6$&x@nfWejd#Q=bklEHd=4@s+OHILrlxsY=Nkb*{ zU!B%espHIRrLZx_SPlifeinCQ)}A?X>N_99RwLhyeutXMh2w>^nW1JnQYl`?>1R-J zP!sF0drqz?(UJHhl9Zcp2sTEK|0W(AKP93Ovc-rWHJ`|2DZmqgUZQP#kdy(F=Md+` zOZ!=sJ1%v|UMu=#XOH?5=n*yeX7y>WokQo;Hy4wE7&k4AM--M2g!_ajV$r~~Zo_i* zhm?i5ohvdQ=J^n!b-Hq5ZoFc&mq8y6;L~@UToW$H59-Imm&p8STIIRSZCWJqatEef z<-yZV?#R+%heD{BS3Wyy^x&IChrSHW^Wpgto~88v8_XjbP1>3O3;nA%kylTFgTvNzXfilYE+r=E$v z4La^4C!zO_$thaQ-hHdjg1@CvfcgXe%P+xKk8Z^jA3T3?*w^Vs-yfa5J$d`xAv(*j zM*)$k19AHFEa{}(SF?*HA*(?R~5NFaiaEy=UYcv;CH%ypT< zQi-oNu~Hc`r5)Behiu~4G?>c<@#igub|E17+a;!*4*STEwJFv)F|i*u20n#4b$^I~ zfmV-eqs*!z)4en>JsZhhn!_UdmT@($9(tv%zC(>~?H<{7avdAAaP_6aqRDzNU6!s@ z<@z%rfUP>xZ3{gFqn`xfr<{!G$5!23k-4WoD)eL{2HjY~%r?sIFBHbihqZxP!MIi& z9u@EXKnB|49Wpp$-LWstgy^J{`I|ze$UaeYUUi9zETLN)5?R5#{Y8Lfez5Yp>iEX& z0A{fafE)*Lsa~G#w<3hnjY+HwNo>f#kbI;e#eD8u5YRqt$jU$`Q)yjpj2CYFH43+d zOT}gmX%JVRL2N7pJLh2YG7ue(DTV@Ped@JUyklqm-GxYmrY>7|v@XJ%m7Af`jrLZ$ zRTI5EF>F6AsNlK^>nUOpYnc0-&rwOfno#d5kN2wcZX@C~y*tghyA@asBGna4THr5! z^|?qapm}kXRgp9Q<{`}U;aT1On_*6IFlurIF0lW;esNID|M=qR@WKAOlV=(G??*-Q zSKqAN`m?O`#n^rp(OSz7Za=SP_1Q5tWAjx^X(x-%es8+NiJUHN^cDK5Hu*63r&JPO zCcN@ctq73Qyx3DBr}d^|p&zx;st;<+#xurbjp@jpSN+_m75%8~*M^xmeI(}Rh2JkW zUz@)_BXLN5V39g>$}P&hexW9DkxI2@ajs##X>538ph&!C>o^BN9vcACWt3$u;+7b$ z%0kWuM!FT&axmjQvk>}Jhw9E(H;x-aR%sq1A$ z2afIb3wPhR;e%PDmmblz-mx#dt;Wu3V@QkR8Q^WB;qb87u|plqgQ-%F}y;4h%4 zDe^@kOtN4G0`_G;}E%|?*KHUGflV>Uak0SZ2Z~l{$$v@Zc1Ty^e z^+aND@ngw*waxWr>`?!ar#O5qQ(scKfkVLvo8J;7m5Y8 z=mxxB+6Uo+@I|`CjHvq`;1<&#xQlF+QPX}FJL42*6;Lj~vU#6eVMqI-d~$-w7B0C= zEG=@znU*b>Ubi0zA_r+o={0)b3?L7_x3HNX-1pYnLsO?gZ_-1vW;>@Ahed80XF)CDrrD@Vw8A6E4L0H@aHj`hk( z&M(TV^qC{QGy^`wd3_#V)51M(eV(RuZTyR2UdF^U# z_@dq@_Lv&H~XqAo?FTdG*MsG^FS>?>uoB8GD z^>%H=+E`PHnKBf4_llVzhmf7P(4}HVy}TcxVu&I=8Ya7|L!ps5TTx)M?uBN|z9dJ( za_VzHd>W9n#vM_BsU6W23o>vv?RjNpO9b(3g`-?f?kh4Mu<^jYYueXpi{?XSaZ~r- zLaQtA(#Sww;HK#y@{Dohc6y2_~Ay4(s=4)EK zgLd;oEbhtS{SrWt|-*m9QfTYShXNIz!fL9<;`2Bhn*l`crx!x>$mMu3TQ4 z4Sb8-H5Qjt#(Yhus*lPoqgvK3?LyTfZa|W_%Ib2WB(Lt?V=k`5XMNJmo#>8|uGs5> zuGTE?+|lCYMP8+CdymWii|8f%01%)6M#Q(i`y1!qF z|9hzacsEaP83*v0qWNa7|7v#nVtl^u>tH7E-+rTPh8c&(U@k{01eF3V8IZ zf+%(tepUW}{85RTbq&_J+iUgeHgRA@XK{5DSUE^Apu%-NcABcxg}8W<+@`IkCkN$E zf*d7s+MS+;g%`t^2y)s9%rC;5?^G_#W@wd2!rW}vdr(u{75sK+qxa=qc24|Rf!i8l z=iHX{zU{mSt{u2@oSZxQ{dZh1azkkW+q73#ZwlR_Xqo9wzetyp-tlxTNo$B{ z>|4(?cx24Rxj`FiZCXhEwqH+X{f$er=BYoP68}o1r!X+z06+BjSlAgATA#B5T(3#A zZFC0oUoX+{*-mRpRH_{-@PB20j`w`rzRCgZ+OO&obt}F^5$f zF!V>HZ0l>?9ooafK4#H)e_sig?V`$;7X5{v`gOK`8q8o+q{05aQIl&%8?JY>VLDnH zm9I|I(`An<=cWpUatY)D8BpwO_7=-(C&$Iql(m-3Y9au2G%;P#$k9-|Ii7{N+m4yB zSL08~)QVbvO7*w`O-MvImL%9~f6dZVfnPMfZf0;Zzyw(0>LKdm9$M)2*;b`1MtiAu zEN3t+<{m+#Ny%Kuc-Tt`U27Ma8u=CFrQ4~uDVN!j^Np*0F;2C(^ou157B0!zeBidt zv|;C;4~yn*7fr#`DD{p8dGu^kD1htW=QxrThA~(mW3S7i%&(oI&vMy9?b(W}yIiSN zYKxfTqw4ovzmwO`jGrBQ3DfzdeA<0oI_G|Ljnf;WYB`v#EZ1a0bAc1@UQRP=xCc<5ae&Jl~?O9c{&2}dD~h}ZL8o&R>OHo4vw zItG43KOdi?fO66ECRFahe>M0$Z}cbMga6terjtGOAN!}cj`p&SM%cefVz7Ng?};aF z;@%T)gs*x}JUNSdPyWB&7Wx@;$`XN2UcDAQFXrrb;>(^#1A_N-JI;RZdDp^c0ol7p zUWxYW|LpbAs~=x`v!L@B&FlZg{@25=i|c=X{~`a+ojhCU8!96_qjojCp(C!emSaWy zUhfEf_@0Eb{LjB`Po<2-;ohFw6Ff293z#qVB#Wsp_CnqCH^V+#s?84gzbBj}u@Who zrBKKw)JG#CZ-^2&1`z$7*XwOFe0A3AU0z-)&AJzmm_z}Id`gV=uJ+bL(;w{f z#+7=AhTcc-qm8;@f=b5chsXkM1~FrLKAY{Cf2+Y@#1R(L-Xo;IN9n+Gl*CF;OPCS0JKDfOqw$B|Nj z!2J&w9j-~pVib`ZLl2ZF#aeSiiT*owlRz^Z;R)ehulG%koVfu&;(z!d84(=EBJ1tS z{Ne@VdQY=VK;n?iXG%F#%Bt=j{$yhWoO!JKrxEhQL`cF7>zr}|=C`1dh+c1i)Ob81 zk_a^PhX44gH_#nC^$xuKuk<&{E+ncCHH!p|Ss1b#g}20`kie0vK2@-@hp#aW;hiy- z4ELL9g^&@S#RQD0fR4um6kS1lZM3Lix6sjeOd~3(0`yivrFK3VkVw)oB^iXXto%Pj!|4)DC5;cM{#XQJ? zqJFq*P+}I?Nh!@r%mNF^p89trX%%ECC_bCTEFzIi0m}R;mw8sH1w~IvX;wA|3M{B& z9ODrUTP~@J#j?~IYyVWO#>ES6^`*3q0bFYP&OCcce4B0XvWTvszLJmYxgs0On&oX2OcmYB@0aK^jGf`cF+C^zn)+l}xpZ`TVtd#i-KQ~Lkw3p@ zoc_roi9>YC0(6u}CVU(&QXjg?PvcKh)<_;$3#ZVbFjSwOfDHwv%XPLFKJ}h{)om{8 z;RF@xHRp_XQl2)hHLdIEYzwvPwS)e)am8(2&t?F1mjVGk^OAVNaX_-$3i=`nb2zzY1j1)fnRi&N~6Tu3*n)YF}lpo3^j{iT2)e?#ZfbwoN{)9 zaD)Ir@IJurLb6ydLk%&)V9I-$tx_DI81-RaI58jTPs1IQH*L&nJelFiVpHa>d;?2A zi`K|pxfGUuT+XFH6aBwRO;YVEM6=E~2}1-e!2?*PfZ-iza>khKr$&zrSdvqs$3lI3 zq59F~E)s;G4=47sU$?iQ4QEX5q(R3*@&r-`dZ+?{I0-|2CqZ0RBJhg&SA=UGL}z3| zh2(Q&t}(pDGa}G-Kw?gOEJ<*vHYk)If|Dp9{4^T~(MU*wgPj8E>0+tHez;rz?qDaI zn|xxB%PPc6P%V$XO|Ft%789wfRjeP$DhZ)&lWyLQ&#`6SowQlo)6F&WIX3ruqflf| zZb2HudW8Ke5(SqPBtYMpa3_TA!Za+8%vXp+YGLZL8nx{+y^N1ePf|^}8`( z9**h2`C1HUG#CzsFZLXw(mM4+lkwf4m+meY%QOfDS+PdSaGus2DJff1XA zHViC1@+ZL>)>4JZ@r6H4lWGWk9AY8V&VE@pskG2=t&{t2GO0e{@<)Awct-w6h>)3H zRhrb)4p3hW%)ukVQN*OV>Z8`l#hY^^=p-`j=$QJjO~c6?k@ncmu2=W-boo0!)~IFH zvzRrk5Mg&Rsh|tI!6OoG%37!!dWj>A_3m1W4l6>K6?^e2$a}1u;|SXT=?^;1L9^S( zKmb8ennp@o=zk%}KyhXfy3~GqPsGIc1PO^R8P9*EY>G>9?dRKEHaT=aQ*Eanu8T94 zKjvB&XDs3g9d)4vcLnTfnw5BnoZ#j3UZkSdr4NYS4l8u3U7?ucACOQTWZYv8q%lRd|IqRm_uNgrC~K&XY0R zXYSAD=|5dx2sp!D=f3}Sd&_nxOg4@Rx7a$kuQYvEWS$=6q|;}vTU?P22XreKx;qsJe%(NA~!$Ju9stGO%l%!v2fku9h0n#AoL_Kzx-PEWUbMi+*A{ox@ z$9~S}xO{Y}c1>lC7_R+E(#77Q&7KymjnP}U7dFUpYwOzOy^5Q*dRPA@p<#eXbWJ&n zX8Hmxr*Inq6m%UDfwjueF&s>@Y}K9nE}MKAjl!MX)LjmyJJ(lOgiWP|txlqI2z2I! z1&WKs&io344D65jBi14sh1=p7;`pDokN$1jeaM-Gz6hi==}3oPCKD-l}liv z|LUTARig0&nJXmTP~lz~5NJ%fkPZq8Vz{`2%_aQ6pvt&uYwST#mO%{RPO_MY zDZ8=Trn8lL=v)~yKf9@=e%;=(=~e*G9khUc`8-FLRrIq>>XU<^6N$LlTQCw+tQ1%s zTM0FVA>=Ymq|=3d>&dQl*>0-7$Y&A#3MrO^Ir@Z)!Y(`2Mc4v`epJ1@`lgWIeR;B$ zwKD_fAX{|}sZKAmwUb6t*af6rW?(Cgh>o3C@PG@BN)sU@5Q|KPr8!IV1SEnW1BJ1g z>(nLzZA~TOv4n8yQ1TwJbwz|%udU^HD8de@^BBBBIb8mebio4zXz!mcz z^N2>1#eSF;K9`l;A`2Y}EsXY+?0T20Z_KQCoP{BcCKq_3c78Ki2#;7IO(E|=vCWMQ2hTianHyi|HL~%42?hp8jr@daBgrUBQy{J=|?C~67-Ti6$ zVOli-9NLeM!W%pnj}aYbaHu(Z43~uD<6T|;vAfv>Y?vXAoQJNZ!i@m)J z;tHf&NUtD(P;oc;C^<$n8Z$oAHzjm#FyRtOmz_|&eH7_1zsM)1vk^J$ZKZ7Ka@}|D)I9cj z=1d%pyBG21cT*;G>fQ`MiGF5bG9&qe^Idc@w!GIL^mmav%v;D>*6*9NRsj_XPJx2C znowWo855K#!Ip!#Kj`;**!PJLKeB)<0`~}7q8SUa(v`Jv=LR|>IC#&gB=3L#g8sR1 zuygt+=`h0IzoWfgjOBDuzo#Z&^e7`_kn1T;HP^(>mUT4Iw{qmr^SXtci7iaP7J?Z7 zptsAU1M+ncve?fVxkk z1zeH2iSw-p##S$BR0o8HUmw0TPPWdk^tA|`Y{uN zLK=y=9@d0GQ!a|LA-s&bTbU%^Gjj#M4+ewkOonDwmQQ1d%vB1#L*Y1X|EVV7yBPnG zkTe})MvcGza^fkB;(v=qFP@RePmBM5`qaxI9mHXVvFCXvVKs@a4|`UVw5cUekIv8E zzdL)?%aqJ(d+>YMb9GNWl~B5DoPX0WU2ddpnsU4@%Cok@-y@TQ+u_vA+{r+gL(7Lrv;jqLB= zZLyL4;S%LWTGks`SYmGF!XrSNld+OWW5#{8b25>h_vr0TXV6eG3o>O8qD2`F36~;A zHj`J?+}A)#|3$O8sUHAI*9)Y2+3)WbX7gpg4?O?4(6nV%_u>GL>{9|Tn!*pqPs8Zh*`V37jvW&bZv$vn^D!%uxB z;IJSso}odo)2o_-;ZjpDbf;jro+%h^UP@AW>si_lwk zO=cs)(eUXmI@mwh-!(au4(tV7bc5l}=nM>`F^#C0k|4XUJ)v@%j38IAVqTL&cuPnu z6ER@pft-?o$ql}+lxizZ{ zOa#f4SYSM6>7|S;z3iA^nQ+xr5a`si8r7#-hk{qnG#Ncqf^Md5tMLm$2;oHQrB zw#lv)3*eXw`E!n0JwqS@&(YS0Wb2*q%R!A+WxiL_7j*`*zcb}?tC=G0*#dR&bWzA z4dW>u5lMYmP@v*Y*^Es{L=@$3@I2>gwHc$Gw9bmfjuoQ@gqvI0kl`sy?F5U2rfj5{ z>%_PkjOJ`JH5J7V05$2SoDNWOS09fR|4j2(?cq_2%YQ)i8(J=!f!$QZ&=hvExnqD&sY|#XFelpBX z!pWF$E2ciM@tA_s5t;?ePn2Z?RBK*4*9X5{KmBb+Cz`~2Tj@Usi68?X3nF&RDlxC3 zi6)-KK{9mxR58m>f{c?8g*3VnniuTIYQ$W=cbQ1WDGtRRCxV67WT1dMfd4)n#7xLR z28gEfp3`3&Oe&f~nh)KA3=|G9-r)LRAes5+(>>VD-cX-J%91>0@mv>_{ZF68^M9({ z>%gv-UeB}(P!a{E9O_Yw{VB0M>>``f@W9(g+p0m|yz1}#v#0oFhUdU~3B(*xp;t8d z=#v;$yw7HFNVVB)Hw)8+*ZY_0fQ=-EMXsQ5^z+0omJlh^0y z-5EN5_x9Dv#mT$3=jh$H=;-ag&<`hXU+p47wIlCi4EZD&M|1|;xz{^4$zkl^srMdS zvD8N)jwT775Hw-eL?05wgwLqZ8zhc`UPx!u=BFs3<8?1QQmX#}XSsWsa9=}>i3Rn4 zhR^n&=j(qApFe-`;-UV>T|7?45@neCSdt0&%3ooLm5QDB2p#lr9H)Q2@D9AM3q?6f zB{@1)-#|#>i7D=3ejB8H6^eTlPK*L7w$FCdn#K`gF^P~)fV_)v@c*;-_I+*S$fEH1 zn@^!*vL~<)ZC;X)S?^}=^#C*BH$ZrR%-r+L&Lxdow)@a-^|aI^o+RJ>`RTPKwbU=R zVUjGq=k5fxR8=aKq*AG>bVt`NW=jl2C=Ee5WS77(RXqtz`F57G%PWHD-Wzgbow{8E z80L2{2RNn+;Vqo=XDvj?kFb;CEvgAkA>QK8MQi~K30?!--IMR@m>J}zh%(A?x{&u2 zVoH)6!tGgz3Cz_eHci*!5$(BzptCc?6vs9u;pkRQ>UcKU7VaXnIN00U`LOrwc|S`h zYqxODZrSMoa@YawAmi0q!1%zVVHU=$voP1j`g=8YMV_?i(OLlDER2%@7{MryNB=v5 zn8KZfIf>K$I9CQniN>w&h#I`Bye;x|G8Z(2&xet&nb|LiMzu4(1J+Vwv{ zquUkWXnOzc*|X=B_5a1=`%e$@TlM0ttMIDw;#TI{QdG`4JktcN9>SfG--1czTz?)T2rmwREruivj{3|^WPQCd1_NG9)&JRCHv9>Sd&D#D0k*y_LF+BSufMGU+fSm$cCjcH zchBX`W3R`DR!YBk|Im{*}n+X*55qBqx;&758OyUvutP&>t(*1)`M__`!OC)U1H~?I1Et4Uq?~xft)i+>rV-qf6I^*faZkG%f+Vm5@n3>U zQK!U+6FSVXqwfNnfWeoE0N@0|tPW?GPcRtL|5*eZZ7os7DS!CRT#vM6_qe+2vbyrZ zM61dcMfxp=<5Fd($710WN!4}BjId3@3EtLZkpbzey~qad+TLUn<+bZ*B)?Ufk#JJ2 zPYXBV*{tACZ&DhW2Y(LfNKs`W+N?k-y*8@=={LZiMsl{3JF>f>aGR;LWX_;+Ch+>a zh)xAMP^@ggcA=_&DscLzax(?s{;AB!rrc9^gZvqnO0U;3|GYZSV+PI;Co^$5y8tOL z%!5f0M{t`zaj?Cf|_YiYKKl9N^R8*N!H|d^C*-Ow{ z73Gj!{7?k%CAXAtU@zLt1G5Bpeiyp6*mdQ+$~4m%@k;Xq4pZCTm8(d) z)aQ^zB!vlIhL}4cbG%PMOrBy&$Ci0pZk=pO*`Z5kJV_D1E8t^f5Z9&yn%^Uk|7PyY z+&xDowT$>hx79tp3xX0*@Y~XN4qO)P8q2*jxw}wcDC_(XClG^ERHQ^_EP7&i6@h$TengarnI+ z539A2InmE0|{=8ap6Me}Db_v;jY4FprskO0p##44AuI zECMkNf;P)TLXnaI*maYlcj2IpSAsOovZ@;5kwQg-A%oU56~u`1mN*b$aipv)it;mM zjgU8#I>=LS-yB43#YA6wGI-OX;$ED_>e&=YZ)} zi^hR;k_aTtO6M_qDi2jZoV>k!efYip*YM=TJ#PHasH`T^Ayuh)>ae;|aQ7nagT^1L z=2L?!xSRH2QmJevN_KXv!NGVe=*xR;4@Lo@K2(D)L?jnZKM z*~`DlHCCK4rP(hlUokS)Y-wG33X=E^ru^BW2v98`W`A+p+bYhtWw}HZC^P{_v%Ri0 z))1TgWa~HPf=F;z{LjVVjl(!8a(Fe(A)cZn0zdEqKvYR*n7ClEr6tTuUeE-S z-N2M(T-Ga=TmT${H2`}%{E|lJ_5i%#aqR}vWT{Oi*UbR1S;FgAx-6yIDVN5_j)G|d z?k1T=+h*X6ve^+{3+e0#v88-=gxXRVV5G3G~u?lh@r<$SXgiTn9Y&~?R9q@0GSJaZxiV}W8`$>~xdKSvR!2M}hLV8;OXfviHmmbQ*S1Y2*fV@Sl!g83yF zqdW*{bLTOi&282|P-krvk%L1SittlUw;I8Z@sBwwGM3@T3HoW3V?Z=gri2Pu-_j-; z4#4it&aOQ=<+1Eb9wG&?`#|YOzBa?U-4nS_N}SF!(`X8#B7r%xR}2#Z^OQYPCd)l$2|D+>NM{($;xwjB1K~lW39L;1 z5Gbrz^}-;~XYJsj(U&9-37pLPWS+TJRE@H&>l|Ak zh>A3Mv?G2JYp6y@jmmiGfee{YG!vae7`Na z!l@PRciSA>wzhd`9*u5leSU`zM6nj!r;}~_HoBIzX_&+F9MOZonab30NlQTp_0Uwqmh=Q+8UuI>Lm9#4g6@aKAn7R60Fi5$3`T14R&6-4iUh z58CPfR*0m97KL(SGl#HRk#F~`6BhMsgInDwTKlHR-qeP|TR7(gvNc$G$*>3UTal+D zzg501?Qn|(R~q^<{g5R^e#vqdoGvdAj*!^Y&U>Q zm-0+*FRF$YLRCl`rj>AAdgohg-)$M+D%0=X7PE1@^A6iP<*6Xuqu%SDUh3*xH1h3( z6!0ZX;E14H6M?!NyfaHR;|rVGnBimTL$t{)sqj%sP@+=gTxtKl|FNeVFk$0d(x6D! z$nwc6K^aQWWPX|DFpLgRO4ax{B^dA$pci?&vv_aH^9AJ!{hvUR6ktXHRWl?7!W>ox zFnP(>oqWR&m$&e}avWldplHW@?NaH)%RW(2eVgKt#CXg+2nOH~ogs25&T=JleW*RG zj#4bV;}6d+f%vDFrCm2K$5|jsF zTRm8pI5BGc#YKL_k0XtcG|=jv9M5}pMXqlL!a^D35M?msJQAopi$W5Q;b=Ze;A@0# zTNz6?@Fw$CDF~X;ldtL2b_2&KXUE}iEGz;!DeZYCIv-KYyMad`VwbZ&_kLjMD$!W? z8oCp0{N2b4<9GV0azo%DM}LEt^glc@LfH_2^_M8$J0;l1v#+g0aLuFND56TGxllo&jx89h=MYla`uGic#A+)T~>=}%o z4~%YA%*0K7kOyTAU7~UXFk6WOm)s1wN+M6Wr3HkwJJFsG5IO>TMPN1$!Yng5WS)~7 zNTv(LC3l_>9vkOBABe1PtXKzKR&EDe1;Ws+gxzX}r8_gl!{?BUSe1dQDsok5+c&64 zBXe<40W1D((AcK<{-u*so~j)8eEei%Z|W>mkbUuN#^S5@`cQx+<)xcu4HU<}X%5};WW=qrhB1WIBfr1iw zb`F|l%0nk*j09Nm51YTJgNrOTP&CL0pSf~qe#_en1tyF<}BEpQ6l1UM@dW-N zuz(G zz2`p08m$}WZ#S*X%lFQDn#7MGOD3(ZhA#Qv=3SAtB#3rfEYa-^1idqq!X8~CdIxNc zJwESgdVX2RlDJ_wD%hh}d_685RLitLIe+9!7-29~_|H+a+L>|}=cEXeAkHwmr;v+K zmZJ}`smojZ8GtkHnA@JE!YHi`u1FYBD%w_yQu%cN(gboOcx$M^wh#BSot>Kg)SHV5 z%x7`RMCr#o9KmzLWB)iMaKc28b%*stYXK&-iEuPmUFG?PZC{Ty0BUj3Zg?ZcMXnEA zA2Tj$nL*>CurL05;13>GNL0{x=|x<&9e`&}_#HyQ6{7nH2AA|K6%Fp9@SBVWFGug; z0>UNE2Z#uls8$gYE@h(hMDz!ROS~(H3OCSxDRJRO|5gzg?wW895*qI6$%<;`V_#ugkNr*!L*v8-xfZIe!DO4M66Qdt^akh4fS= zp|R{hZNTw&*$m@F_3W-;(Kw=k@rLu#ChCBZu^YQGvc0-HE*M+y9<+bs=z7W01;guI zD@`5b6-C%PVJ{wH?*z9@jJ*@!vO)Gvp!XAHUmp>=>x>8$rOSpe@9jA|y>Og;3kkiS zPRlD#iRHpTvYD!WvwXvqh)wl#*~7r!gJjzI=u?Lh3DtD&$q;>WQOjbe3CnvgPS~L z9AfUdPfLD3MJ%OWB6Ee4h@b2CLDziiNk*FnFx|DH?@2BW|1 zTn*Ytwn)~nz;d(dbPXE8E%PD6n6{yThI`H1 zVB_{CZZNfgKRI=ScgcOXWq$M~Z}5-ave_GS$ZgU$EXUX-6F5j>TV`;$7a>?UheJvH z;z=Cz9zCXUs7vFZ{P|ksaS(ME(NP~NlY`cswy7K*zE^*KGKca$wkex~j?tIgE9VFM5P3+)g++%8o+SCr`51raU z>5hx!b}(HqR+QbrMbUkvcW~jk|NIVh*cZ?6;JyXc4iNW{A~5X`%U%W?8O(J>%m3y>XJP;x2XHi_E57kE|Tt{yff{Z z@Ih&@o{SF_$lY>2*x)@$AFA{(miEC$*E;Wm7LK(1QS{Ht{9yOLG4(@*@!x3j2b(dC z$rmb&`PS1fI7H`x^JCZ)I5R+0#-)1>2pf+-2}A|i7oP^Au5Z3P5DmS2%mmRWsSBrq zuvy<-lY7htvAS#!4LtoC(?O_9o%_lMQFSC~l@Wr`I4lT~K3|48Tiptl6?}TDR;3!? z!%gT~6*Xc`dr=t!TaRZJrx&u@r*Rt3idi|6C41NnSlP(18kOy3Xh;LX@I#3({Lmd? z*?s_a+h8PNK7r)m{4G7-j$lf{2@BGuB?Pf0fG*tJ=HtPtVASkWRh*~H^V~u!3cF!G z6+Y~}o;Lx>B}_@2!lXU{2^O`?3?#DDh!=OkHc`@fBCe#4PtV_6Tn*2z2HYCR7EhV3 zgAS<(;^yH2=1##vCpZ|cQkR}#8nRNW&$tcd1_>>VhmBLnicY5BsrwImQmn6o?_-jN zv)I{5X50gJ^f)W#uerugi<^FgMz`!uyV-WWeZztA93g>Z<~9i@R;-NTGegnO;UvZ+ zpVv?!tJH&`9AW0eIzX~g9Vik`YGBZ>8}V#b5I(Ho1cNY#WsnSvHtV2g>YAVi39VF~ z)M{bzTnM-c80OXLphfVen8?MJH|0e$d3U}hFG0AMvKW>D5P}dRQ7*YW0B)%elX@}$ z`~AKC%OHX`ahL|XyFo5hIB+Sh14H|EMOHZErbl*!dCD(bo`QI+4O5K4(~}lv`+P!af5gRDmdAG?i-+SfuUdCX{2;HH$;21L{k+}sV33@LLj}u6)W#em3)peYX z(Z(jLj{z!3U-tlGk#sQ@T04v2OF~_H*P=(Uuzu1tObvV_Qw_m8n9srPjuAv00)j}$ zoRatUWE3oBp>;eaj_aH;<`#o39@JNc%bEBo7e7N)a=-SLJIALsI0hw1J19 z7oqp*a7FZ|$$G95vSq%b-XPhzIxIoX; zZfS86q$1;~Fh`J3Ju;nuP~SsS6hStH(EHR4S`NAdrUT7jK1TVBLzO;~0N8d?YjVD~%z!9fiDGf7}_IZsDe%bTavOePt^Hb7^Fn&>fCk7;8%CI#j*go>$D zSD6P=SRvoQsXXs&$~q+6Q^VUf;hv^Xv`D$9k@Rp`+;Bz zN2gUKT62lQgCtsWc4bAG)*PK`&a~zvXjQ4!nkn+6TGOdoO|CT`#6^>>`QUv4+1B*6 zQBSuf%iCpKbB~=XzZQif@#-W>rO4`73E!X17AGxnj79Snb+J9mrcFq zhWf4NUQ@kZIQd!|IlZ6kYaZ}Rq+jzuTq^&X2j&^0%Ldt<<+3I1!tL_(3zVS-2l8725!>Kv2J*`u1db0$wCS z0UIk+Lxcj@IQl?km!4+BWV7`Jw3Ea~zw(v(l{>naEO85*Ey4sk>mfGFdt>ERxF7ho+j!(n_po zB~1L9lI&IOMjf*3IT+TEWv>~XH_cuvWcQn9PdlkK#b)CQwf7mEZ5nh}9Gz`j?Q6rb zU6kBITy|9$+QntNKy;3WDGf}XfS3yCZUHeB_@0OuJrKsSv9^P#gtQ${T@pa6s2i7^ zxR$QA!8q;Vs6LvYtgd`H!91e+_j8u;Sm>@8%6vvQNtoVl(XzR6q@KVO=ApQXXX6p@ z#bp*|y5<9fuFkG?q=U~E$PyT0DDo?Zg#M%SWH293`+vYLh*L#>eIc&1*KdgTlkgOH)INPJ!8%KI;(KT2V7=KGsA|K6(R9YmG*g? zVikpAw=~#je6sDvY~L11tk3j{rNN;t*usf|x%n#RmP6)RD*P$sq~jSf>0pddnnK;# z@s}yn>zI+1VcG&HP3AoPpxUlSD5ta3gvVy^lq!*eAZY*$SHB9HF(QSPlY*Yx1ASO~GDIJ@okEqTrWe4z%AJs*U(@9SI zHH;#0f{jH=uRm>#tmQZXsdE>BB7ffMUqLB&PLlNno35ZhT)tP5^~ z};gUth~?ROaqi z`P>(gh`&rB>o!4UY+{A%KKNyLadv$6%gBkidKk6lr)D z#tDx?OWEfa>a(&GGdf%wY_%8GK3<{jDFzqc4-fdt;n~9JK1l1>W3!gugd^)E`85iS z&*oI!=v+yql4kq(P3W%sTkzNDJC$C)QPhS!HejJIDxEZ2W1;D7KJ)I zSZYh8m&TEVsU?fxI*E?9adjb#&J$RXyA2H|7?cKgqF`a60? zjGf0^606Q7QI!I3NU*4&1?q}i_A81HmIN?)xMF#ZUL#Dv5WElP`s>7WG{qaC@tv_c zO%c|T`HQsI%wVjo@&{+zm%}q|+mNA`YvO9XL^}Yz1dYOkg6z51(hnpLhxtTa8i)C$ z;O{V7w_Z}Tx7Y{xA)I9i9H^6NUpK;0cwf(Z4S`&-x1U^`ghFEo zm(S_XLC-z-{54ZnPQAbF?(J6N15|H1`@~8X z`dnfwkh{6W+Thudua5Wq=-gL9^^H3BIT-W6zI`?YeviA#n0)abcXfU9 zIovh$^3mb0QGyosx3gJa?{Bxh4$ezEkTB$fQ#AI6BFoVqqTw$ zrAchyO`c|hZd1$+T_|-TFjkTOrtCFn6$9%bt9<(WO1C(GI2AFe+Et4r*77tr{K(5^ z$(yFMq<}3JcVWT^P=AC(z7Qj|T6GV?w{QckY&HPTc5pki9EwULH-*wGP~1e6z2`Mq zCcrc@@ftwdcR7bl^-7q7qqMGG@Irnb+@7c@N>MH}W0{gxFH=gFvL2M9q|H@Diq^K%+$hgp0@n zyE;a7Q(M%GV$3ov@`#jjQX8wLg(4wG)oT&u$M#~oR(gMBV*P`vq z(l@7K7gnw^qn<-*lMgN@9SmoLG&D*(}WG1H&0N#f0ir z;NwR?JMe^~>#Oq5pL^i*XPLoNgBC$N%HxbD$y@+pnHE(7HM!0c^}miMQv)w&{y$Ax z#9+)=lWV$cUEj#;ueuQ8L1JHrKBX5 ziyA=)%nGLL%=k5*j=~U~Pu54U6k=JACky6Z|HAIB2-f^TI9YwK@cjhmN2Sw-Eqyl0 zEF>|+aD$5jbN7JJ^(~y^YnJ4C8G-oq#q76D@K4|ngI)Y(iorC*KrjJNCfxh*>j+&E zz^IUykSs6u3owh*f>?<(O20zGUEny4iFTP%jX!zHE!pQVpT*pJ`lU*LMqWbv2g573r< zEpO~&Tb>%O=tbTQ=5$j+;)&#x&rFzzcPDybK~QhY-p<&$nTS`&rszGJs?u=Fa)XUg z5|u9TK?HfsD|63>`G2vEZ%caph}`-E@Gg!(P`n$k|NaO*fl)y~5cNP01mnGT5(B4- zS@HzA{4z#5@4U%idO3~9()LIdB|IAOs~VY;uVDR-Fxa5;ZAU(3!UC7%4$$b&pm{Iw zpk2zS0MGG=BwjU$8JGx?FI@mpof~hc=EY(NBD$3RM1@g{qTWa$jF@?92KoCnl*4x@ zj==jcPidV^7X86MT2UXYtVvPvq5cyU4?*~%+J@D95f#G#u`<2FfV!YEQGxNOL44~P zggNqF?@RYew7SPxIC^$sd5ti+oMUjR0-x9;6YsY19KX}Hf_K}roD!wZF?xGrP5D#x zB+>cAS%wtqwfafU*KZvAN>{5?cRPGl+ zl(PNlJ<4zU0GuHL`O{|Fvsc3BfZIHhL}iJ1rvrIsycys3Q(79&byp_gZL5_Ca3oIR zKUj(_nA#ZGH6iPF9XF&Hy2B%&WC*);5%^K(tV_!wG_2LI9d zm%LRUeT&dGZ@q6Lw+!knIynFOu{q@6O_Vt0OjDF z$Y4n8zbhfbw4jiG?UmJgTcD>^?(ysV&s(B@1(~|~rSZk=*RYJ6q|2TW%vs+<2YUt0 zY;7?LHA-#}N?=&R_Q5yFe2XE-LX6*|Jkn!5DV3_h=dx{2R`!u$4YX^p6^K@(S_7^> z(i?(2Od~V{yE_40(!vpYSCFoxX)%L&JOZ2?5UYTB6X`ULBA8lz0iegksVA24E%RFz zGErb6u`LHhtMYlx{?}(il(;iiCt(tg%W6-2^W*1Yf^-|Fiw)l|D8Efm7=fQCghfWL zGF=a0mZ13zri4$|OA->Qf?q=N&cvXmY}tfPS*?MXvcQ(uGO@a^*B0Z=UhD5qPz7{m z4n{jZc*X+wCpKuB+;#ZO9#r3{r~^y^@&|XrI zo%oT%G-4C4hm)B8t5SoPpT?90yS}gChaQW{@qB-q#)RVdF|NY*EH|KG$pQMZBYZiv zk#Q|Tz*vavznYdPA={nSD89CLT%sHdQH(J5=CukR43$ClqH*oh6B_$ggP12Z?6{Mb zPvn}M@NAvT)92^nzRE6#p80RKndSrLm2kvX> zuHm2bNVYt{8&_?`O3QPcAVBhPbnA72Rv5djs4LO2I7us9!`A5kU&Ls)!k@?fCw&m{ z_Su`Oqsu<|Ko-YQZ~xnSvG;tpYX5uwX#abN-@)tQ#T7Uko*oUr$B&?YK&7D1-p%{` zd5wSl`RL;E_|2JK;b*$3qm$a4?NifpFkR?5#`=<+GhYlo}grPXeq#2oNGTq zes?KTHn22zH*)|#uw4G>gt6qdxPc>*fC(hLMi7*-CR9)^#I?zpD*gN!1PKVU%)0cD z{=Bd3W{jMnd`Xt&jt6s8fcGKy3yt7SF)>KfDWiogsUk7>2c0G0%@5$}^$|FKbNEjX z1mGsb)3vo@E&Z6Z7Yo5wDuQ^w3-FB)3yQ=&pA?_9wIAfcjqwnGZIlt^{~_9nMH;3g zpEDQOKAzT9%!{;7$+Tut`7&2Ihf4hFMTtg20tu)!MP&<}G?+3H*gq4@$5xQ6a`j2t zxy8dwF3>yC;(&V+lrZzkhG9XbdWS!Lq&3(@zh2Fmq<<4^xW5}I<2M=M!D@eNGVw7V zjPI2P2wg6F4sN_MnZec(z3;D>zSCo~g|2=K>vP(FV2`#6*Sj2s7^Qd%yoUgj9Ho8>JqSv*dydjg zt-tz_wx>enpHi&h@1<00hA;EVN}C3?^IjWb5wpp|_+bR@VxHQ8Esr(~*Nb$YKg*-& z7}1%*k~N-P@;h^u;hc(0oYLXRBY zEVLFrQwTR5)JtpVL(m^s0#+qoKB?!U-@7e#oUOHNy8pQm{~QF7IqHylrJ~%lZbXNpRX4UC}d}a5~U^Z0`PL8jKZ?9gz>RD5_SI%8E zR3MnP-Yh_nbx<@-Ld}UyWhTLNWuUTZPcje$bdFflg4Pbp`a+z`)o2}DxKzilfn}Or z`S4s*Ix^Q&q$Em(=HB>MQC!=pdk@Z{2jPHn1^AMA;8b}3-1#L$=b_o*IP$N0k6T+i zLj(@MWt@(zhwL=x_{xiq{CUU4wndpqh=+a|sx8;*tRt;M`=tsrd(@l1mR1lPN5b4H zUU4pss}7X|4@`cx+CDdHw@lkiS=yxht1`1$3iU`HOU~XL9$g=wTj!A!MX;^;+&pT; z1kUiUJHPcY2}yzbVHD-`n8?b+AD?@h6%x+hTwGa1EP@_qaKv{Xicdbd{<$Zuh`6;3 zsk8j5*MKL2<#Z2yqWW&DN%ue5OQAR9$h6|NktH6rd`!SBobxyILokN#Wj+%XFQr2U z$LAu_M;Wa8>el)f{!-x-0xm@S(hEE_PRw_0FH+vO9`dKg%(y(d`1$z2F*#bJZm&%R zWj&ECCJ)mIq`PJWKL9zI^t7Y$)km-+HqJi(4 zw`sxcZ=gnsAI#aCSr>?9+`bAYn6D>mF4r@eVyB<0>ZQba(z-1KOV8@!A)7gJgaq;y zg6NeR0CWIuy|q+iqd;a6a@bC!y@aBTK%ZX+45)97{!7pzvemZ$GWNp4b0tXjI!>gl1j~xEl4zl0) zuhIYedJ2;a=D1I?WI-Ga{@>4b_AUSKy`A0tXOI5h5Apl>ar>{}E}jkedJrd&ISFJJ&!BV^<%=(S9Fo24X&?xj~&JRH{|0zLk%zP}!|W9gpz)R~2NAkvWW%z!?D)O4QZ#ZgzFmL0Z3 zmJJUaGhi}jn@B$g*!iG#h0t=>$$nMULD8{Hud8>D{>cIp%w@wf{oLZ)G_)?}ZTh(v zG_fztC{0NNOZJcBTV8_<_KbF=hL1_Xd)1w?xVG zNUMJNY+C>JI~LV(r?(KS>B1(S)SNQuyi8wy?qgI|sUtx&v1<4EqCDcGR?nA`k6pNt z7wlvoGIurMugHT!wRfZBV=bOJ$3I^sn9n1F4fNFDI-2TbVL{N3FoikGA-PeBpjZ;W zV1&X1V$BV>+S`VH>g?8m2U_n-`$-RMkSsAOKH01aR<&U;%1Jw`OD8U8AyFQC%;-RM zN5`~NJUxK9DPkM8dBGOPKG<~j$%rfB=M_o;-lkmYF=p$iD!fr4^t}V^?Q%*#Q#i`B ziy~K%heriYJa(upp^H#k63C_gW(b!KNvn3!w+Bc_$u7U^266GF)KEhu2UXOc?CtgvH3RjpcN#4 z_e7QhnORw83zZRc;b_FO03%S~n$st%J>-?mEy?iX)vF0X(_}&=J8l*1;s%u=U}6E<=^u6R3E%3#Tz#dJZ{ zErVxpmXUc43%YA-GJssg=WwmYJJqp6AFJHrn7Wre(e?RUSHG&FOF3A{kX3q4w{w0+ zoYNyHyn_)p%Nrp+Ex2 z(;!{I!R0S>a zkp6R%#gQ2R=s|+Q_*|x(;TDt#e&ApFbUZ$RoBihz92sqm#Y^cCVHypSY#N>wGu|7c zi8Vy_x}?XUiShM`aCQ7e*#3sO_;8C#-)v-@7i(*pqUc7!gt-JAIA9x9{L8;uFkE6H zOjc@8d#;Q09$)g>EImCgS3R)11A1%?u&350XkMSd!4!^eDQD=6fc#Yse(lPi=@7}o zxTOvFHj~OlvCo)Sd$+s9t*~k2TLgq@5OnKzXqLqZ1Ywe>H)ZIgMl45II$`ffVjNE3 z7F&f!wBk676YolHUsWsHgMfqS^1zIn&M#rca@Ln+_W8qv-zO+T37X6=vmA!e0ZK8+ z!#E|_*vytfVPxc78PuvRkLxe1!$6W6Cdh;rWnr&6R(pg0A+f2BRGYM^-^sJgN- zQ2XM)(w~PXZ;vj)&%=}B!{OEOo3p{cQo8G^MxU54wV2dDi@u4gewB}uugw9#=J;cR z!B5{|a3_qKt%S8sm@I8%!?LmdW4FJ%-`2#sSqYx^B4&6Qtpnh##8&Hb6oD&I1Mn(9 z2SmwaAuy%7fl|gJ@XuF(lFu`n#AyU({Dt^2%4ht@5|X;7Rz@ft!HnST_ac!t-p&yJ zpFk2F@ByNS2uafRl0(j(0^;dTph|XPIKQ+Tb#s2(1D!&TV~v)^ceAFN>3^dQr(TV* z{y24X0mB522#ori9g-KJMFFLiXOhwJ^<}~`42hdV8$rOnX=Sf^A3l8e(A%txj-`lK zU5L0Q(#jEu={r6~yk*hC+{;XP2%!{|{bkwD6K&X z10@8zOf4obRJzLZ9I+fn(g}>C;Yp2rG=OmolW0l4U!7b^qhZ^PBB^c(uB)cXRgrPu zzdHkJGmB8`NjVsl2mkg-a|G|*4>h^ZADT|BzeBZDPc%SI`;q4r zFWzrYCG$b6&!49V6WVc>1JlwiU0hYJv)teP$t|33u}8_N-sr>We6)*``J^SCwCXMU z7o(J6`~-e45P|-TV;>*=F~8AYqyMKeDfj2$Y%veedjHRz7tfzPxBWk#Kj!~^m|yKh zrFI>_f-=@h_o4x~+g-bj(`W#AtS=r1v#aVt7cib_4xU z!S<qylRG|;P2D@CEalN*3f0qfH`c#B~k(9=f}Q#FU7G4J{Y{;@bP?gUpiBqrQ$ zBSSlNltxrRcJ*crh)1GKMnrM$2pQ7e%;>Y5afQKTn|OArnQa>C)$+{=xGUq_#EMMZ z2O?>QUYYAm?ds?3x?W|66Y+xl@l7Wst`T)Hnn^Y{LDdbZtm7L~oP>8UDDy?mA$E?n zfYV~Ib*ff7+HS~84z~o_db}GNtYpBQ+^(*_?(}J@v?3S1Z8FP5u3=v`Smok=Zl~?y z@*@A9iAOVBFu1&4LeeGiMUbKh20Q)M^`|h55{U8Qxp+GzDX3Qcy+C;}t8gYl@6#Y0 z6PO3HI7wm*M~DhY8%|X!P+&s}>r@A2qa25Eg6?1*kaz}B;U3vWToTHa0Agdw!aPh8 zm;`v9juz~XgmKA0cs3S=v3a#IgnhNkjR*9?`?9-NYt^h{|2{|E#`7QiK=Lq1VoVl3 z05+Wec6Rq)*yq3fz1_$2-$VSWyDJ-T{+=qG1Uw^s_qRpN7exO3Ce~N-Yn=abj}Pcp zzSs)TF#q@Vp6y%ne|LB1<>UN+h@aDxJ-mq*Vr1dKd@lPN}IyK8?0HVT??;000u^6G+Y(VI`@p*kkrn*0H7d92ZSb7C3ZT4p`p!Z!n)2!6keWYxb^P{!ZTA0!OoL^vf$I1F-Dl6A?b-YP z%V&@GKM(R-@43 z7`}S4A-6eUe+w{p2A=HlXGQ=h-yTsV00dLO*f2$yfPcAy5Uq`wHOeGUu1+p_VoVJp z%l)SRE%LfKp1{%KPMMYaUuNXT*mj_r9esn`DD|#TZxst?p@NudTAniSv@n8GjuLAnb*f$;q;c>0kiJbAMF_s>r^8)qC9O#P!m#cQ3s86F*MoRyS#tfRF+jaOT#X|eI#Bv*Sbg?LW8U>=SMI zNmddB#bdCcP`ujRR3891K7aLO_wPV`-TAxtBpEFOO*b@JOb|Rv{O;dXfmX8wX9MDt zn~=)TF}1ARrs#dDY&6Xm#(%;5|9V^C_dd{OJD6`XB-+HC(q;L z`GzOYmvoF+c(Pj7ucQJmAs7R5QsgVcMnBj*)`ea&CHc(ubydQZwm z+aAMPkIsxwpN!T|{#RpjMPE&O*4Zc82e(P%KKolSo^hFJEym>K_UzIB<3WC6J3@KK2y`R1*0zdNVuc(IWFtM*1D$ek zTqGD0BZV;wlH_+%)jM=rPQN$ZQFVKG=1;hz3bU+lW`-D{S%y-Wl7WakSaYZjk9S#% z-DOEv6!{vmOSX7sM$?Uf^;+{+Sj?|szf`T-jk}D{(`KeV0eY8W?p#9B+ms|TFOIX- zxNOx8w4kKOqL9E#l7|FN=0;5~-Q2}=2Gf#k(VjDwp#KhMNdqSLI4irDS$k=?Iuq0% za;p^bp)E%AxA5xlovwnnT_GH+gp4Rdk-1VVy;@WN`)1&GHcIP!;Yb4^lW*Bs$7T6F z^rixNvF=z-eMS#k2HDD1EQ=a0W@QMrv5{_wb5Q?E2w?yF5X1A3OhM0z+U{*K(ZbVk z@5MeY17Y8!@$8#z80nmMm2GgPldsJl zct11nUi#$*zevaAHeaF1_uzahi4@el zLFJQ6AFQ@F&Hx?QACAXy8k4!UWr&iMh>QZ?QeKQJL`6wy`$N&NmORlU=DDuQr+COb zb1zo{+IbFHmN2Eq^gvG@)I6l`?if}{xd95o}E!d!4$TJ{=w>PP{G2 zo?mFL%&wZbEVZf5Yx=s^QraopOL2fI>*}Q|k$MBo%2rB(5}4Z?oL0CJ(sd*&q}-Ph zQ|pJP%8GjBBVc8H#M3Z`=Q$cdz9P$*bGe(iKD(Co1~_f08BJkSBrrEO7o*sT-DtPy zrV^!CBt29WRgnv;qkel#{J>&h;zcWwoD#tTl0slUi&Hk6e$2xWJcoJAG!&FZPCHL+ zgA%Sv$)FwTWPFVtLqvZ}v2s8oA`Vqz9Bt@9Sqf-=tM1DCRRUeVLn-M%e1gifGZd<24=;S z>Y$ezCq{}jNWsV+HT`KOVei?-B+N-*{-rkZrs0L@osE^R;ol!$oefWquMdyDfBU0R z1Ms}JVm;5(FrR}SOIQqg<1oRn2R2Y{E!YvfDJBh4wCP^UOPaX9%Ei(7$?*Y8|9*Y? z=J3c(oMi&m!3L?1yu~ILu1+qmkIshQpB%LiD<)A)xLm$g?WD@%o#m$N z{LRIcmn@$;aIOVqH%w9u)$r}r>+6G)B;Pz1rqB)6J7ASUEo(? zEv*?^ql(E!X7dk|Lzsl~8rzhK#L>tewXDh7WkSr{wl4l#2X9jLlsZZykf3w|b3mqH zDv#L8Jzu;qn&t40GF7}>5u+5KG57<`Zej>BZe4}AZ%P>lp%WZN(QZA}W+R(yT#P8D zt7#7L6eUi-K@*Sn^~=D3M+^^;t=%h$|uv(7@(+(NU8d2WHMo#-tmp#^gJS!e-V#Wb`) zei`$y8ne+%`BF3S!hlsPuB)4i7Sd%WW9u1;QIU^qOOYzBbNDRVcBJnPCB+P$q9XO_ zriP8ul8+f}cOH`IpoM+Y37rd94OmBoWvp$cp{!+hOj}zQs}e^Sg(UQ&YX4wD`NPFc zo5rG=k2-#8>%;{16-EIhwt-vkFqvh{m$4IQNJiUEm}HjK0J6V!H?WBqOzmy5PIS|T zb_=>Ry-Aa~%HL?x*X>yQvo=Q;G*s03T~?9!JQQ2mE9{8Y7T=kJi;kb)p6-^6<*p2RD7+SUctldt36 zxb^KQAF|=e@v!bb1PfHOUw*NJ8D!TnjZ$U!w2huE_;|xyz=SYl^C#2C5eof7{*LZC0cfJM2~( zuk5t@AZN-hC&+K)7^BPQ{hedHSe8D>G@Nb34OJY$ku|edV2n~=n|+5p9?wrw2qVln zat`xZj4^Y~AG|WcMV)j+wbZNXQ?ACR@MAFTKOJ5FPApuCyA-IcBI9FIulX#sBA zK5#fiyGPqXy4o?ffG;%iif|u497k|20zp>RYI7Q|3QqTPxd%q$3BBuC5H=kK1=HZ~ zU;_|zN%AJ?GMg7@%g$O?zyh zr_i;x;#7vtNznqttjLU1#ki10R|jV0HyK}^F}_*D@NHRTujq~u@M>+AYyq(SIxWl) zpx3jBYPU|?f@?4@%j3H^ffE=xR7^E(24Kf8iGrB>3+b>Btng}HKwfC(RNAhD6gCrH zBTO#mxa;(qBFqG_=G5V+(njyD6mVi3;cLDNN9CVrlI}{dB^q}~DOCQ%TscJ%9Dtpd zFJ4p#tXyYypse%rG;Ij$dhl&L^ooQe2Kv$l*xf`J6F93#+%gtJ05T?xo*p;^(tBUp zGM}BDBw-tmgUgvHtPH_T!Y*?Y)m*0>4e<=R9v%j^n zy|q{ot%ZUl!rR=lCK}86-i!V2CM(TUw(>kq2J9uXIMtZ=R-dP7Nx~iO_BD1huM}Aa zlqILU_M!q<$)sP+B&%`!Gnn-u#w1QB2T2&uTC+?+Abc=cYjggMXptkOWDjhRtm0nh zC&@@FDIc|HpCs}=J5xdn7ReiHj_qBETV|D0FVNaqB7wg4W5>zOvxy`P~2rnfowZ-Ysji`MA9cdD+tBR=}pbYf3v7-}2~boJW5z zAhu6`n4nym8X7inAMyqTqLOf_=`r4pCU+;YRyna+@3uM$Iv*|>clCB<>B{@0AzZ3g z7DZy<`=cbpWv(v`aUD^hH%ZVMx4-uy*l}!yMizIv zwUnvbH#b2bBv9lQHStI>)~-UhQB>r`1y&CEjD6g`+r5D#lrI&Z+l{~eZ15i+v%LEe zbkFi0CJB0fE{*0#coZfK)&Q{dEo%UXi#NVW=S2bs;OS|B$wiS4@l#$(l?b(s2VfSb z&h5MIR!?mWv+%3&Um(k*lgb4`gqbVnn82C- z{r4iyVRV?I>_D60QhgnsoUG}W4a;+`)jetx2ipR{@FY%)4+hzcPMqY-y|6Xtw8Bj|epxj+ix5ntPRB=r7O>i^%wAKYgPF#eMa?oUgN&h{T1FV#{Iam&rK`#1Pcydo9;@kQU-?rl zE8Z?Vv@vC`mHp&v|Fzx!#j6Vo=>QG;|BL+?Tf?e_Qf7BD|EpmExfYG(sKwf4!W73=v^tFw&EeeDvh#qqi9j9FUO z3$x~*N

3E|{6j)e-%B+b-#C>O1EFHcATm_wjji?+;{EIT2LbI%-P})sFLS(^okaAO+2eWLaL*UOegbp6SGrN*3xIeIpq|G1}LfEPCaH{Jig*ne)@e_y_Qy#IfYpU-J@RYyM# z@2frgY3UojuEU=g$NM<_)qq~f@vjE{zwi0aVoK!zsPECPx~4AC`aoxaa-ZnhA1<0H z+w@j;ooMRLLoJ#=D9zO)OWh&Jo5`gSbZ7N=N=O!%iE64EvW1emO zgL8+zT(gWiBy5#hpC9@|t9@VSO+usomvRpy?tQnI2H0f(fBF1b#s2^N#iRcB5I<`= ziqRI1n3@*I)xIyb~VpRx3}YTl0%HWR&vwHC5KrOk66dF9o?D`ENL8rS~?{hNi2~4!%&)AVUwWN z!7xeCdl03VxiTaL{VcFpN#+8vN56Qc2R^BN`0e4j0TLDD1{G-pMkr0;h>spY0Ff!o zr9qPp4z5SnJsG1Vq^`@w8YHT^g+`X!n9SFJk=X%D^5k!63EXXY{AiS=rDmre`ohN% z0OC}WX(>!`T9Ku1NNOB6;?{mfnQ$adLS?(Lkp#A-ycr)r>wPd7u`H$o@f7I;OL?Pc z3#mD~JS~BlL#B4|1z6OS!&^v$d}N0FDJ#YAU8zSI$N zAFSz^x~ADc3ACjt%h3#yDJ(F+qdd$Y24j>P2T<=SrP8o=Ud4r?abL^01m9&HZ+qNq zJpX0U&BBh~;@5Eg+ueV*Z=U~lU+%r!e?0#^#Lp6LI@<2=J3Zxw%ljhp9QIV4-eHXM zBBR>E_eC^;tHyut?(e*OT>l^9=kk=YR4lu^l!yx|5uU5!8A@Y<@;IIJ zM<|DgtsC3w0{PqkvdXA>U10OxEtQX zZumYX)23mgE3oLmM2kxf8mA1OE>Frs7K0@28M6dz$jin}@MO7sB9FhX>({vd3qv*D zo@U{K2f-%)ua~=(_@CXKXOH{;L;M{3zZmg;SP+CqVM4cXxyf(T1qy9;Ju^~~(hrPs zi8U5bb%uP6^7s#wk}x?((NGWv^F|*uDZyW>6PloZ#T##@efQhkcA5O}$HvqXZC%7S zQUUK(vj>GGTqQ|J;J8RGA%B=|MIt(j(+kncIJUZGuU1zbd)qfI>x#x)IdM7%x&Uxb zpo8)FJ?k7Gq+6jmjl(;bhZFdg#7X>z$P(1R zol56`C&?$Ts9Wth6EtMnw{Vq|n0mWkjrT)6g)@}T7aYGCYy71Tq1nYhc@#awI0te$ zmAt+Fw|E42qyJaM|9@|1=Q01wgZw;RuXV05-E_dtAp?)<+Mg6NAeWJBN_B0tgk!my$m=wDnkxl~6z$HWfjKViqhkaRo))}Q}g>_4yE z|L?urdG!B!kl($Z|C)@bx>$Lf$8-zo=6;7`f8A9V1C!TT$;E#UP?3@c z@(mMq#dZ=TwkOA%O~Dj~Q37$7Y2w*oi!2HWyd-%@;6x~jW|=db+0(pJDpLs~L(yrN zh7*>uT|ag?J~#)`1;BsYlzXEXSL-RKh1Un;m9*AtM2+r~p{VN9zY;S`33N>fd zt-L!`$cuHSV*S#3xM4qN%ABhY$f7 zZ^cOW%ySqFS2_LK?1c9-2k)a}9`K8FOn(*5povdE^;|oDEY!cndPa7NFc~Isi1o+f zw8GVxF?1}R1Lb!nsjdh{huGN9hE&2S?WgA%EHsO&DpM62=m~H=@JVj>?Fbf%%5XHI zs#MLR*LF4Ip;uqG^B6HIlMrLtsBBUB}hQ8(5!LG3yy-{QfiFb zZAFTjTXa6w(kGhm_@Agu!%pUzXWbIu&U1(%^Yjv0O;4RNd+pxbV`~M8S52P=a(Nn4 z6v5U6(#lN~>Hs-;!fbZS-feHLeGBJ8cyO!wysEEEyw5}_*3ZH8r;40-9Su6*(r%k2_uwTd&gOG1Y>HaQ>S5HD(}@R zHPta>>{~xmAKfAN4r5mohm#ax5|2(%ZgZ>t$>3zcu5 z-K)~wCfk6whu)Xd zZ46zBbyB1i(W$?E6Q|oZA)emDz=io_$?e#}LIJK~$QYazlWM?TYNQw~)-VMld)!b) zwr^sRhO=1On6@zqa}t<;l}bX>2*dQwM$0#b?~kv}hNs8ZhezMP{n4la0ONw#B=R)O z=OVig=&^TMd(1Jw+yx?dQ%o8JY15aZMbdO}ba;GueQ|Vta(pnnI(~C@efs9`$W0th z!aG<4<#c#?b#!t4`pxB)QOmk!+=x@M|Gc#S$fQt3N;bjnCfG7_|Cha9=kn?@jvdo5IhZ`}l6u*LG{+#B+#dVVv3&yM=b~o~)26TcSM!eg5X+>iX>M z>Gww$-X2s&*^&CIK}3fqCvSeaJ~}X~T+{Q2*V+c}-I}jz2NuO1t^+&2-PR3ba}r zu1+qmkIshQpB%NArEG$-xhm%oNpQzWs<&vQjILRYi&aH`@32~FxQ1`9USA)a93P!s zT`tNBx~v?qe1Baq9~@m=)y#5-RFDK8z?{^Gx(5EIqyJtAdi`9|=^u87KlIS=kd|nA z9_HZ;(=|FZj5J<~4qsoN4=;wNmz@bae9e({oMz37>3vCZ4ONaa0M9j=-u)crmF;d7 z=KuqK%kx0}(aRC_q9Zvtt^LgJ4l5deb$xHauY=R-5Ubbvom)ccvmMrhU3^Gg-KAvm zU1V_@-EiAma;!9tpvL|NbbFoGk+~@;?W(P6>{MA~=Q+CZG}LP>cBbBNTBUTjr6p>! z{p2E}>=KP`%}`jNyy9*C*BX5aOwjC7r)b4IXn}EAGo#aHdIwX8an0}=RZLE@Tfs0n zgh@EBGgg~e9Ifn;%Np(9CdkZf{T5;n&mby@4lRtL-3E|mD;p***vs!%(;VU{N}?7t z+D&Yb<1kK&9CiU|H?cv&52c@p{5kD{fUlKPN1!PHtB?CrzC9Fe!5wMsdTeH0vxjEiF7NnU@yKl}tG>v;LyJOl1yO@eNx+o-J z4JyZHT-@-FE>}I6;}{c|j_At6>iN*~Lsq9=vac`-AhEBI^d6B}#ypfefwn<*w{LOe zBbbwT9FIZ*+X^HnfHt&S&~@ZZn#>1)>{P5O9tq#-)n~W6!A0-thKGlqQDT(h!S=ReUu55SQqR{26Y%-- zU?EelhjRTgu9o_v|8xH4;_B#vUuLlzz$-Lo zW+DZ**;C&WVelk{Fv6TC=P;keERz$aI+z}*dS_Rt#H_k(0^U0Q(8$Fd#r=29aT=2Y z6+YnYvTTOuctjj;Uz%Vlq2~=)S3L3-^o7P>k?!M&f`#Yyg5TNgk&Yuu(&&SBCQ<9pbkb=3sLZ^umImUR4hmP0{-l1Q+04 z9D$&CH(>w$5qtupf`A|bJQ4n)~ z#y|_f3NO_KcVRL~V`!DCX>jax3%mlIK4C1KLMhmYLaAF*BqrOW)F- z?n;0s8h1$SRsO_WIYkj1fSs2wUQ`IITsd~2jJI7eVO@{GjYnXSDab%yn$x;l+hPJ| z6^UEM_y$16q|ws@hd_F-Jevm3&Rr$*E;+i|Z9dk_Iac0@gMLcrs|vRk0U=c@7)SS7l&`RE~l6Q zJ~phJQl$V|P;Nz<2{%U4gou`<=uMaUMaXL9j!g$u2YYGD41Ik*Pvv5R<94SV7 zV1r~;Z!AAedY;je7k4FInWsg;HrNoKJNh$a}%Y=hnL4Hb1W5U*!tU zh2Z1I&aVZk8)56AK#qYsJftXseLNiq&&KutEPWwaLEjxhoy0c?%WSOvItiLISGo(6 zIO1ICOSBV6t}~RAjZN+LXNoXw3}5x0?3M`-$vmSad%ZPPL|b0ph54%|8*ns5p!ejX zZ2N!z@8|2wql=%94~}>S%_sc1hfe^*2=wrFuzkHf>1`UYUOoBvpAzQh5=}e?zk=Wo z(0f8Z_JAvNZWLk&7!DBIL3IH1E|1Qxj?a!xdUmuN|1s({3%eRgD~LvxR~;7k@9%%F zqGmxOE%Dan4{e7M;;{6kg$XwOwHQ9eMO7@q1wWVaKo_)YIgT}g;j_pW7#@k|%@5Bm zUDueluzc=+tiEFeH5j-UkK+$qN9mbH^y;g-YVbU-2{%*XOfc)fTMOvP$Ja;0!;_=S zOF0p25T*TJaG!|^oh`4PY{;1jdQV=zxx6|Xo*wl|VPe&7_^)~om*iIrKcAW@=sl6K zQCCM7XTuXcOLBF>^16!Zy0&W-Ikpm71MQ~U@?vJpzIY5`e0_sZ0>kur4zc38B1+3j+H)+D9O!kNj?uMnmZS`t%8c`W&oUS@nIJ&)_8ZPp~IpE&KD zv(mm1OhOWBir@gC9i1lcXa6m103<+y6eUr%+lkh!X)NKgH?Xnq*m$z@^F#j%=#JuR zn#4`oOG43bh8}wRhlUw?7+g~{9LhwXA*9Qohrb0dEiT@DM8n|~S%h2J8;Pn>gj+^C zHO&efH8&2*1^v?n)b`tH=C{AA1z#U;=gPT4746_lmP;fV;(4mbuuSuP7+4Z#0k3fq zY=Sj}Yf7Yj*8#^dA6_noP~UljllBMSvmTdjrPCT**6NWBHgeBxU>8=n69|uytkLfS zqN&_Nhs8~WTo8`q*r|M5+*Z^U>I!$W9Qz0U*5z^@240Lnzx;y!<3Ab-3`^2F~VmQK_x zH3QtW{|rW^KX^()gET!~vQwGe5}utmBpb|>u)(j1{0S#d9{$%LtJa69}pQGxDJ>}y;xG)3gVk9^x46jrBpJ0fPOP?V1NGcv(;wZ+o?|1xZq85ezC!v znzww*@-#*nC)bqa!fNIZe`{KRk0-@%VQ4=hnyv;@36g$_X~$HfT4@K3`fgUpK~u6k znk^j+o;`(fq}CV@F%eB&4;@-X!<3-II{oODI}e+daR)tlf|j4ga22ly=nM;jj!w`k zhHxb5H7Ny@#PUR4`a zU%x&4<>P+%m!n@kItM$n#tq|z`}nKdFyWwfq-*o`ah4ySpwj@w8(OAPiFi4qLKEtJ zJF=g*LoeW5`rzN{(e%0ml-+`v;9RmfmgG#kXkU{^nYs(Kn-F+!uihhOH|gm_68@4V z2^G2!^&UDtJUp!3z~w~p#XHD|cyi?Zaxw^!MS zlmw{OTW~5+o}rZ81YURZ?_?NeZQ(HL>(X$C&q?Z>aCyX|g%=i9NVT_WREbt-fd3rU zxIwdW3_{SeJ>rS7B{ib`?j5FB89I9@do9?C&P#{);L@?Y9rX3rol(+V%-2JlrYuh* zG6e4Tun6n*F(l2Q%VX!gJx~=}uev;atv!kuHQ;>F2(A7w+t4i0D`E z_L^3^>76!zz<4&ypjikH|J}Ba&Rh;dtA?$s+gi9$oLvi>SeAcPCHf9}f{akFt5YR9 z(1J~NY7P}e!XN8jJKWF0Wshp8Hb#JY^}L+?E2o@faF?#;HLCBU78h#F08Eu$p~cms zWSmJ7DW)`MG0~472KT4zV&ca;!G}t#r?>`ohu)U$g^AL;pZ{%wr(POa_>yeBtpTWV zEw-659V%pRg_ar)-#~wg!&D!(R+9s=1D0_15u=d7^{S^6QcbkHO?j#)qru~#ShtQ|Qxlf66_akvm zwQJ3rtB`T`L_4(IoG%!^aM>x5{7w*`sld})XvonOSt#T0=;Xhk7-KqB-#AO78$v>~ zYIl4x{OHiy19X8?D(U~KbDrf+?X{u@{Nv!@=bsOL{`u#hosp|8{^Q{1pZ}xf_n-gk z;OC$J%V_{Qqe<0%qD(6tax?vYHoyJ6mJWVzx-14cMBv*zIdnI?mLw!%dO<|)#fTX-g5dt zYbd`7mU|SZuZP=_jX*R>A9X^u6JdXVUNO6P6SbuKC?QfHbEDfP+CW^YJoMcHX+`@$ z@Nx;H;jX^lzVrhRYW#i0NZGANjNuq4o%8n_Dn`HONKP=^QJ!Qs?%|*4mCk=xpQ^nc z`*T`GlyfVG?66t#=@V)09rBN({o2=K}ZPz4poJ**Mv54y0gvtcFY3mO{$ zc8#6TCA`xHN7&3nJLR03;dj`zaEe7s(qT}|(;@WIordH1-BrqN%A~{&jy0N9+-lCL zwmo)~B!X{f2LE<{`tuXd=nrOq)NDd$)d1pR-IwaK4S~A?o;~DwBT6_O_XTokqU>2y zl|NRN)%dG7T-9O?mmp%6Hb5wAuCW1si%V=AK7obQ9(Qya#|Re%w^UDom^MCAB5xSK zLRe^UZ8D5N|54zk{VfxwH4~-XJ=_)KU+54$+}#a6r4Ii+gVc_XABRVKdwc)s=9!ec z*V*N+W*$CN|6kc|wI)i5&{&o0GJ05b#qAW{2xK(lBlPhzXW8l}*`=0vdMdMiU$vJ0&5v**Fr&ofvmh_;k*;5lRh zG2`VK2n`ORuBixN&(SJ52|=IIO8EtyQW(5xLb(k6XDN77c28IE{|x#(LP6p7X3L6} zgd(-8nbAX6DQF>fF97TVk#Qm<%QlSut`ym2;vU6yYd*ziuYP)`_|6lrJde_o(Qck) zgm)>>^TEay(9UoN?Y!IBLpy%B)eF#AdT59M{r2ZZC_jY-?=~!m^y^gb9Muwhygi3S zJkR)!?;77h!wl_&o#Q)xgd#X?A%J#Fgd*6=%9))qLJ=PA)HHL{vj5u>Y*-(&@C2S+ zQe^&4XiCM5xZBd;sS0goV`O2u@1byTg?u_q-Y1Jq(?x?nH@Gwloe3P8u31sfUg;7? z-ZXhdO*3h5iww;Xdf-ri$-Ac!WQ#{E74Y&&#EFuk6ej{rIGcklYt0Jb7 z2HYz3fJzyasy23lGu7V=eYcLb{JLl$Rz-_ z?E#H4kPH4$z`Zs=%%)A+QB69%le3t@HtIESNV?Ph@2Bnp%yhuW1*i<*g;1D z9;_E%-xNnPEYKw(DH1t6)iKG<{RR>vi# z1V%cla=?n)znBbuwpyPl(|MaJpCSU7c12OSiiA8m{%UkMIvgEo0pe$hH^{_RQMg0` zdV+5SdFR3D~77nw;k_>@> zO*MhDV?B%R-8L#`VW#O&%>s40*HnVN&c!CT_woq_4x_qud()uH6`sbX>)qgK2BzIr8)&rLQ5&9U$=#h=tG=)96mWGa zAnl4}8~tmM%b#wZXdUO%&67_q=DWXn()}jMww3DJtaFC`@Kx#1eXgF+6}V5u6FwDB z_*0-4gMHB8(;e!@%+U=&*%O12$b>~$Nw(w%+^7p?;#EIPK z1?Xk(KYn%idFB1D!^5NFPw#)-#%I~}fZdeI$}jJ!kTjiM0Ac9IcZ08p=?0(Pd+hhM zFvcCjP%W_gp4SRbi4B6bZhgqYCfo?``nXGx57eCN_F!61o3shA&L7HHKS4ia_+L30 z*mIyczEU}E7?1t8RkakiziB$X{PJ^>MlP}28HO7^M%jV?n?%l8hS!t=OZfleFTbk2 z|9kZK=oA0HjZcfC0_T#62q!e1)^3XxJ}F17Ugfc1MNIBn!S*D2=d5@>_|8gL>)e z)R1d(q3ebxPQXGhf-{-(8}1X5RgLKSs4vN!@x_|^H;2ymeG7dQ?|2s*fC+A7KbF7# zbl3mjexwOOiIp_LCHmhNUwr;$MgMzzbo}`z{qHtDzxDW{^X>{k%RRKKELp2#Jr_S_ zQ;uWOJV0u?+W0ZBf218*K~@xO$f zD-kday#byer4PM#TJ2U8kf8;CDfD}2SF#HUj~hIsd*!{@ojp_oa;p==G&PeJpMC?#Bv`xUM7XVdG(UOor;5%e`7v z>|00gWi?u7SZ#HhHZS1j>SG62@^Ur#xU6ZVH6zR82RaD~Hf3lInq8=F`&6?0B2meL zVt;~jw~OO=wP7AobX4e)Sx@6s)khCTpD$Nu4*puJhQlO_SaO2ioShF!-L#xywRA7L zCuMTT3LE0(aILo)dWa2oA}~n%Hk2Z&wgFBGzBv6ZwIB(JB;#5*2;-O$L{cDU~9Bj!<+uEnQ{Z~<3SFixv z?Z2bLqt6ek_TT4U9DcI@ZsT)@_MaPB?q=;NU=JRZ)hrV#pw8_TAsLb!M^}hVw9ap1b;UrPrW8iJNQ!$eIJ~WPN zlqxG|U&(jCt8Qf)qhtr|sQ>Mas3dbyYFIGLNGVt&JyXSzXV=LOL^_Z?LAyB16d!WF zEV}J2Q|;Uv-+FZhiXoCz3M6M(>ePI6L*)!TfQ#H(?pl_;{)%vl5+VdppdgCw?4|7a;3v$59mdRxZfKIAOJ^FEOK&v&zObAT%5@EO{d(UG zUW^7aDKl|$a4;jud?aQEF^hy|eD5xaknb{%BS|CTGQbBG-=X4o!{V=NF|>_}F9!oo z=ImO(QCf(QV!;%S3Bl%fHC*|dWN1c`OfSy>NX(Msh1y@$11Ky&eNWs!J|MxkJWaA0 zI29h0zxbV;3BG4HXpYl`L*p6Y$kJ@g;E__C!eP^=Zy%BO5y{FM^iV{>_PCkRXa-L^ zCpUN@ki20f+-W|)B%Dp)c%Kulc)~?_JdRz+)aV4BF|?prQ1(&6Scc?`< zEwEC20d(G9(c{DN0Y~Erxkg zr5X#rm*l=X!@~8_*zxw9zIz}bD%b!jdp`F%cvSAT(l-(sDTc0C3{6X3?y$R}xn0HL zi-1{RL56Y&WlL8stOY7gIKlA(>2davj)tCYllR_OQW%Tf+WvLlWAASTJ5Pt z6iQv_IW_BL(G|$0ee`QCB!aS(a>fe|!ikpo1+O)HL^4y!@_o4)W_2h_{R0saqQy~J zx{d3uUR6x{BHL7>v`kVDp;p8lQn6YPK2vpq0jDI7h^YV$;YTU^g8?UhNW!n#qVhR z3in8Jxb;kqu89;IaqNI$sT{6$)qPb_{^m%@6Z5{vHcAWgScaFpbq;bDiMxY3xQZET6H=-m!;IY}dsjeP|XN{pROCN!mTVKWZAFWYAij<5*~TH6UiqJQdq z38x!}4Nu>GkI2KX$Pz1aOJroq{Q5UP;W%_-Rc@qt)dRGGE?YRFi#(UryZ*Lm-KUlm zrgHQZAk7+~bZ_HUGICZ)@A*A!sFyaj?M*FNR|tS2nW_g`DMxK3m~x}tBk84Y-pfs_ zSF~H@VAgy0bT%7vJVP<9t_QRM+74&5dp*G4#TKu6R5#t`J3Fl{6jZZX)|jt7DYXH| zW@=qZT=gu^jVZPzIkhYN-2~VQuy+}--SQ0CL>!;j62kgY>73zLx({BY+O~OA=2%8E z?WrH|G$$sy;=;Q)&GBVc>MWS)%s7zUmbn*$^U;FpC0}HcNzd#rGkS? z$+Z#=_3{mW5_be8>D5nQg6K7mUPBA*`=;b%|m?V9JuM{f)Pj=sTyoMSmd zI|u$1E+tpd2P9_r_=_(^K3}pS#l$m$6FKWXt8PE+K6x>dd6BLARHnmPb3vWL6{aey zqb^&>@W~5SFYNF5brE6PIfL6ktYP?d5VKOc29rL1bdIOwJWmo`#I#wsHtg(-33-}O zEQo`>^W|nCn9wW@cKTmioP*6&S$$%l_U47~8)$UcoYrs6)JH=*X1E>n!OHq>02?jk zG>Vko^s1g4VqS)l?E!MLm~4p847(D13YX`!1>}3b zFIruSs}jC9Pk$^^vV`!euyelb2Y7duK4H&T!lsLhj1wH6u~bNoX(~NT8k+QlR}%#N zVJT*qlXK1@qIt7@1<6X5(9c0Gzht1!@I*5b=LzAyr18EE&+m0yTf)StaLr%!DZUEM z8|bjYTy9Q^nX8Xnl==*7P)zGXvf&_9``fd{$VI@%vG?j#ck~A|&Y(I2zjzu<(Ozk& zfjxuYMp^M=olKnFa?3Ep6i-toB#mCOn1r4>Yux07PDr$f67oG`SC!Y@ir@O#?aEY5 zg7&x$ceS{u3!3vKJT-nHS>}JKpX;c8hwNMP^&ix3mk$(%ejP^PPN5gc^&^P(uj*sy zRZP>swgtZoK6KLX)L4)py4wOxr1F;FDwU3 zn3~=dYXq-ThR2dgPhY(F;h*oGy*z*OKgIiD%hw}i=JB^Oa_T*7)!YpyN#b43;{UF|;p1Ka}L4#Xb@y&$J*{MuiPH!m*UJ$rTf&5LIp zPAMEvIIH#?xsPCWJEVbUGn*k(Olzy$3WcAlTz4rHTRGDYVXiQ9@s?-Hv_4hHM4S;W zTSy(%AN^c)^!BraYLA1iH2!G=`~hlddiJvgBLA7sRRDYXy`F5vW44@`Zi|vTo${xr zZ%*GmecoO2H@%wNuuaYbnUJ9RQa_ZwyTtk&8~~! z4l8!{vcBn&y)7S*+G&$pvVG9?w={&T0#b|lpkC1l#_+h^JtxkcwGybXXAilaz%{Q+ zq2B#G|2~YTP0uqwIo3SN^L!s7U3nu79hOB^Q#- zFIh0yZi*caK~z+(;m;DKj#(>AtyMdOHQHRX1!xr znWvX?SQ&HEgIF1^hm%+tv6rJ*8S{Re#R90-!??l%FF%d1y}?=uw#V~WnRU|x+5MF2 zM+`+3PxEzaPI}pSMF_81lF!LYmZwc>q~~<65XoHiJI8W%(!pUL99>gb%dmk4zcpM+ zbZy@y7Hn~|G{zElL`pkmi+gB9Mr+s>EBUW|SMVxe7T)AlTn>7=_7z#f<)9epWvAYz zT@!rTAY5q~;8zk4tDEJcEaw>{X|FVN(~xqWwTx5!b#*7J200>J(g}^QBwY`s23vKk z_E5a^hcsE7K#}WBE#{vbma;uhh&Rhd?vUV{VEWUX3{x+$e44kCILD@0Q)MW?Z&=q7nrASFwQf3ST^X_2&7jXD{w?j)e!}Dj8x+>lby4 z!Fu!GO#+4o!WJ_zym_{olHp@?uW~ay(AH1Vs7>2yi{La)hDGrAbyF;wCR-`TB9Ot*aoi2IwvRlE6$b7v z(V|+D)P9;XF1ptzME$#gZa?iJIQ7=@E<)SUZol7J21eVIJw|^WFWfeBFdC-WDEQkj z=DNY(hT%2{{x*!bQSi56%=;1ib$kaKu55=xcsofLt&?sm=-U_j-gZhy(?tCo>z>~O0mOL#rI=1NpM_Z=c%Htweg`MM$J zV1)BS<*d>Pdixd)C+M?=u-a$nmtX!9$r(v&%8$~jz$@to)1Exsjj%)wd zh^cs|M<)EY@*(RhvT)zlt{pFRh);D88V!fP{RTbI$B$3kXSUbYLw+B@`Od*-y=A8_ zo}adbnYz8t*|=tH(PJNwA1|8XZ84ePJdvSkc3lfFsEO=-3jcNxx1A%Ur%#_Y>=HmK zP7V$N;s$w?|M2?Fv)4Kx2m#hDMIf8!>oc<2 zDf;dMak?e|ZK2TR)aCK#&4Ny?1%#VIPHRM*TH+IRO%2rp6Ms88K3c9xt!2>GJNIVK z-im3riXr#MFlIdZ+?p-ZJj=$WOuKbc+yJIAi7H3Ck9$PLxXY_R2EbKcJWL6Rg+X81J4f8xb6+a5X(cT`~!MS8Rb?rBrv6~bPU!yUN(J&vMz<<9( zA5fG_G>p*>+Cjs~@pwIdT~oS~GjW?j+Kf_IlMNjGiTIAQJX4nG`WQ4AsJF36%iTEL zXG1&1blqJ#wcQIsv<5Ie`IPE2uBF|z4bywv;y(Jvm+Ko%qN~J9$&I0I)`fAK0lRZ+ zo+J5`{%aqBASdaIXldQB5DC2>IEEDp{II&7vz1I!jL(fAYenP;O%UN6*F?b{0| za2CF2LS8Jyst0Vw1Q2424H9V5MGLQep@9jMByS2Z7Rib}=%Kd|P3INfiYq_nth{6~ zIYEbCeep#Nz*_in1;}*Yo&j6c3|?vioA;-@=}ULu>fS;s$-G8!n>Y^<%77XhFbEK2 zV+eEE=2c%rv#)stP+jdjwwyWj6&$xg9pwYJX|wQg9nD=!BrFTUH^n^NVdo^K{;OjM zk$EN;Pboh^zj+Ahw&7%%z?ebNv|R6UW?#ZlTgaxdQb2>9+2fM547v3c30F1vW8>U_ zo#UqJ|BXCv@C{$cYw@r3{|4SR01qWO^apu(^qxR(aQJp|_I41u6yz?gNU@jV*~_l}at(o`LKG7??xj8F z8F~N8iKv=XLNadc_g0qz{olX?TAemW)Sjwy9`No*Fa@XU^rm1Fv#da5mT43vSd^~{ zI@7kogm$J0yTnP^NdFyV;a$|%3YTj>#9Tq1ZGP^y?Z+lAfZ#Nne-952tN%Uv>hSTOjz0hV@T=p; z$H$)^{^{`e=!?&f{)7&FiO&3Dyi1XY?m^s91V} zu8#&+G>uQth1Yt3bIHKx=70Z&U6HiH!o6AA`l-2HO`s)dvhmUH)PKIsexnuL%zjWLgXHRAIIbw~Hriig)^U8&*?*knI{-pJGZtPnkz`<#B$E>-mySA%i! zZXLWo{M}JkTZDiFZO3$D$4BGvtM6XVVyG+spR<%o#<#)$AAfoHd5!;n_2no2e;Xfj z65Qmr>K&x&_l6=~8j5fXH&;j)f}!bj6fsU19NUAc=rDsUWAW{G3Vi-^f->G;tDufOIEaci-+YEkpr!@%t;z&j25{8LsL*? zCS^AClgPVK5=|xH*Vw6KW4{UB@mtzEm{YJE3=wghkvID0y5o;K1(Dz{!QSba>11F*bY^(p!p67ewM_8)=$wUlwFl;T|?@t}{ zzsFxx?f=6sk3RpT|J}yNoc`TvvJDviZ)}*;W<|jji83^bPM)|aRuPw-^Q&Ma@}3Gw z)9D%E67E>+CX8L>8QQr%+Ce+T-1QUe0I>&-NA#gk{6I|GDI%=Kos#tI)ZjLZ@D6(X z3y8QBU zl19beo77mDi1txUgX*wchR1b=wYjN{!(Nd^VAy|2BRsJ2k`$I z{K4q*fB6CYzx`r1Jy8E={}k8hK{?PRj+D+hp$QR#MeKnZjnCizJRA-Y&a$DY1){e9KRB8GCmIgF9t<9!Z*zJt+dVsL6?hSsi}ZfhLs_yq&PuY&NC*6 zKuj@7g;>mpfZSo4#*osCaJoPuW2szJ}O%9 zwpSdUIZpAE@X=sk_gXI#(DWrygkS_B%#X9IGQ0X_6qDilwM5H4E`2LHoyeIoUEiU`>R7DL{!+OP)Q z5_Yw6*llLO91R9XBX>`oNn5wq$T7(YIhez97=GoJJ#<5p#LSK`(rtz!!Pmr2zOVNH zc9dm`>^7S6fnSkxsIRi+98Tge!yM0v+L=AIau82dtD>pOS%3?h-ZnV)SEjx#8-Y7C zt5993z>Jb*EMe1yUN14jT&avBbx0Ml(-chzR%~1VYB-vildBk_THXmu5_Ut=>B(U5 z!JVPY=R*jjRX!gEABJmw*6vsvXz&4DSdDs~Cz56f0U>ya6~k}Ezv#%U?rb}b&^JVB z(TGmag5_wY$Qz?eI)x^JNPivB1x=?3K{uRAf*>4;c7^^<6Ukl!3@aX*kP{!Fc6_lk)H_^MGn5?4dJdFuYfV0tb!f~O?7-0rd z&q@r#Mc=SO9I9{iAt{)U6_4Nq9GCKPd{UFg-Gr(-p7u_@KHtJUOH3o;tb-MG21Ve8hSXwD)Mp%7Evs%22j$0-lYUOIOH(W)LX2fmh0a^db6{%im`&9x8eLgCHmIB z+L{$U9}u`N;oLSdH`MZ5>&JG4;m0~(*JtfT9z(L?|cYh^+-cB}z` zd+ASMtt-d(6nML`U{sT08zi&FQB70p3RhbwXP4E~AA258P=f_4>^WSm_R zp>4KH)kf&VT%|ooM;oyX%!!Lh3LGCEiypTEVn$GaoSDHSD^IQhA}Wh87OG<5qUg9H zJ0c+@+c66h0tEA^7~8Fxir%5HfY5Y8Qz{obzc|v+k*3c<-B>Oc*Aiu zpI&)gr;Phbm$L+&H7;0E?Qir^0w})d?VJtRF=me>plHeKm~9CB^CR=xE3f$L=&`aknrw>UWgs>Thk> zJfFN`@|+VvQaP?KTIOr4;b}}Q<+f=moTxetJQZKcZ^Mc76#5x?U`6epI-fDq)Q*;x zlfHr3*{CUI+m0q$J(jH|(1wR|)p7NfVIIw>B;a+Z?`nk_-Nqwynk4Lo#JbMAI6-5b z$dj;?j1l8#Y^njss+OzA^?%mDI8Qr-fic8X7$>R+Nu?QP{cRdco|pKSz*tXg0Gg%1 zu(T*apac)w7#P=Nt91&QZkvCqO0u&}CgVmkl!_YkW@cPaY@#e)+t#Xvpai)`n3GtC zua*{)w*0LMZ^3ia$$E$u)`5gtK`KzRgyqTG!9hRH3w^hcFg8qX1l2 z1jlO4v}a1KTzXA8OFW+;d$j0n5_L&HFum)|7VVh2{ zym}lZ?$$;DY^ZNv{CM&G({Fb6^}kMEyinGZzskm}Y#pj_p*gV!ZR8b}?QSl}Bu{ky znr60!rGT2cGz8VG2cya=7Y69MAj4~2J;2)?w$>gk;~MmkKZqu3jE0lB1(40lLQOz>AZw3ONFi{Y zZ)-7>H9$Ul+0b6gO7MWy1h}DU^<{yL!lG%#TR`u~lTL8HW$KV9VbP3BSIELT2cb3tSV^ly6vWzy4QNd!PPe+bX0XfJrf*hky zSWA$*&~gRjAj=4IjQ(L>kCuZhqlshm4fJ}e9Ap_y9AgV0ck;=BhvdRha6-1FWnNzS%Dc0AJ|Nit%7XpUx#Q}gABiu*a5y@s5^q({8+7Pu0AtG z0qdY;EEb<3I|Qpj^ATkW@XQB?SeWY_8kdF=zgM2RNEoxcowpA_( zVDq)^xXR043>`PFax1vyi=%z7@)cbYb%3FM6a*0}XN04t&Lu&PE+m#@k|zqMUBltJ zx$MIrJLA=J0RqAQB1F8>!yw!mB}k&EO8mj{sFQo?XOBC<78sun-L^9RgW1w_5KF z0PeiXGbZF|La`ui;hhEoP@NIhy*C230J&2{ipBMW?AlPzz(uc%3T=UiOOQKCzk0@W zZ74T^dTS7O1zF56C+D0g4Zf)6RP)JQs8$FgbK@`5?aQiA#XVu1B=&xiuOL(*2T4alja!>z*o!T!(=a>`=j!&~RgAJ8inlj<@97w#42j;kC1`HC#6-XZ`Q z7>3OagDNzg01ko>hHGt*^-_!*K-Rx*1?sNJ4aMkfLs_KSI2;y&PSX{#?n5AVVRCAf zZ8g~DuzR`6t$cYys5^ozSweW59MQI4*=oBWcOeXWdHNz#7XKMbm0Ctq>C>|Q6*)gQ zL%u%X9YKy$QKaBE5B2ob1v1aDH-ozIr)vgRDs*neQjohOo^1wsM_NwkghY!dA>T80 z)u|7BnVNODdEe>NJjB zs7xnUzcl&E-Ip{tPbZL-P%F}KnpJ!sWYwu}cvmo_>hCB9ENpwP!Fe04C4#2Y5o`C* z5xltCV!L$p$<>~Y4S7D#IlG2CedZNfpwY2?EOu;<+^Fk%HiFzq#jm_K_=3)9UB$mp z>hX*M3Fy55tLlG=_BHo}!5ScESk9VV;!vznk*o%&xFibia*-He877wQp5_l|d=O)a zm)U;qD(9EyA*eOTBEO6&2bHfVIc1<%$}`-^*bL@%2%}cy!46eFN~SG>mkpOKU&qfH zAUm&mR&2jI$hs}u^y>>^ohAO7;P{`MO7cS*5qtHw_4tKpIk3v=?DhQlfX09Qjs};x zag`g~Mt;h*j;G;@|432x`A=t?g51f$6?mw$9`|!VPKxpgV6OHC?|LAYZ;)1<0wz?c zz|sXK^-HBaf7SrGxI(1_t7l04D3t6dvX>R;H!~W|&^#9s>LkG{4N&$k2Zhfl$d@cn zJ8S(NIfkjnA9mjtLj}C}y5FXb`zpw$*4Oj%ssIjvoHb`$w}K2Q*!_XrDdpOLtaPxZ zL~-NC0O&Tl(y$!lRS1K;hnQ3HhU3YEMxNE(w#v32lDgy48}aQR8^Wk>bQolgVVOh9 zrw%;m@_I^{d!I2u&~D2391dGqs}t&l8LMTi9e91K_!eY%oNJ9$w*9KByjxtDb1M@a zjgF6%nLPyt!_DQ<9Bzc|t-8ul!%K`Kz_k+ zjBLjZ0p9>*EdgKSbV|&Phpr&o)RMJ9UWJyMR3g+-Eow$;C6GG>(G19f2tiqT8uE}U z+Yf&AUE|KVGNbI^PNs0zk*^6Yk};!7QIy#L`ryp&8l#f zo-3?s0OU?CaR9zRLBGQ1G=&}hj^l`&2l7-upy#P1Q`l^PSC<+td!ni8igb=^fs3vJ zxhZ?;tz9|qaOvFa$jJQntnKo7!>#jTQ_I`t zo3Hiwaa)e7g}R4}=LPiJzj|(=-ooAU4X{{t`@CH1`*Zz#xeT>X-=`bs-J#y@CG>(= zdWL$t_t3Wr^;WN)>6uva^#qi}T$bYp)y3wE% zT*c!XnF4(C&$8sO2B>FD)E679cMoDnaa4A!g<98$>I3R^);eQ61ogS+)T#SOTx2$c zy44-!=plVoE$BfX=?ZmUg$w#op_WBNgHYdb?E<7z=sVE$eJWqDCe(La!2m72tQUm( zj*A!o)W^rGuJs+)F+fXi8Cs}&D`n6N6Y0uB?o%}bwDfjz80xz%XwdyM-lv)d>q33E zWewJa`fe*5bmt-c6*uUEiFD;5_o==?cOG(|N*r{j>-$vYU~Rg-(?SPpul1eQI_SRE z_o>{$@<5Ic_5G-LuqxE|qv%0*sQayZ;6}2xQTd<_bx)-aHUhjW)N5BiD4@H|`Ufpg zFE4=LLVT+w5Nf`sRcjywC}I0m5SBvSRtBLP#9JtYP}t~wl@;*lygQsVs5|*oSFS8j zKzA3l1I(JBRS|spz2&+H&RTC+7@?PASVG-ZHf~lM zp--SYLwyJ35nAx<8UyR8LPC*Duu+MGRd`5mMG`g#eOZ|VJ43H^5;g|A>st3%DxnGH zAQ0it22gKMEn!o@JLlqTR4~D32iq^1;I8#XH4}OTyerfjmrdv!>P{5WSLFm3`0dqB zDDwF>ES_M-=|!HekcHS!{e+%??@HHemr$^9_E|%rGt{?QMZqQhwdyDYpuVL-3Uvd& zdntuNQ{7rEg{2D{oT(esTPmlp4#=xmVEt57sD$mdRZ}4Z^<5WLSivf|M|Bm}gSzL^ z3Tt?>mlanCu657V6;=m(Eeg5g0t@Rweb+S>(9$XkO{XzT*SAw<0WB@G5M1j!uC%a% z$Lt;zTUZb3yRNse9@KYTa-lm9S-I*$8R58tx(ijPI~QK4L4BL07phRNS$kpCYdp)L zUWr0FmtUx@^=%els6ySjoIwrh+bn1hSnE5l8?l1jxN04S+FIXcC59^0ol7y)puWvw z3~f-iR%2KK^>*tqRH5#%AVUqWm7wkxxw}U-8PL+I3`?NCld=pec-^;MnPH{aZ)?SC zQ5Le=Yp7*RP|3o`wWDTx-Xdz3RHk@N540L#aTy0ulej%5+>DyUQ?yIx^IU?iAn{Zn z%oWNJo6kualX&fyzZy~da&$cUY8aDCiqqlI(U2RRCxlv-CrNXxz6~|ia}$$)E!3V* zUNH#?K7LiECe(DHjBuQG32H)jy*1QYEv^b`F}ci}NwQE)H8#)~!UEgGpz+h0L+Tn8 z)ko~AgT1sB`y^yhZWZ)ppATp}Uudvv?spHhf8~saf~x*t1r`23Xueg@mwi5EyE>4PsVyiHD-yMXDjLd#CexJM*pfjy z+Y7I`9Lu}_1!_GME-X&U=7kHpe3lvA4r=$QPGCpWx@jZ#tC(P~sBO36U_q;Qf!g*9 z{Plel*FtT(RRH@!u`?UFrBZ=CZrv)V-J^Pf9Z~D1Xx*=(gB?*@YuE0$GGRy5S~EIa zZNx2KSbB%N!8(;Myd|wf88r>K`Ka|(bMiCsSH zp?2pb6+5EVS~w_-+MU;3?1)-xZN@NacV3*aBWm4D(cUUJ-WrSS%pvbrna7T(wU%*f zK<%z;L3Tu~8ymS_1tYhJ+Fe(b+#+gsU3#)3YTY9Qkg-Ok$mDu>w-wYARL9oNk4h}v4acE^P^JEGPxoN=$JZ+1kjHKVtJ+I=a}xdqhj zOC8T%QS0eqy71-ol8foP&)zF3GbgFU$*NJD&Mwybb<4NQr?ZRoeq9Cb@>zCWIJ|3j zeqXrDN7uxB8M;;6vTJvKskkF*tFw{2zj@r{vleQ1e?7U&XD!t3zP?A7PiGF?Xm8uRa5o}{*GeU>Nb@>!W6JJ&F&q1I;&ldYrH zTIgg6YMT{0>4@5D1leOXlp6BAqt;D5zF#F%I-=HER%ID#cT`uUBWm4tZR^EXQZ4QK zDAHY^)?A=PmxTC1&Im{6f55U2f0!x{nhaASZy3MQTGX=24n^n*>Li*MeqOmFIIgW* z*b^Ii3Sa^kS8c+6NSk^J7d1^eITQhBGp|ml;}fwo)mIE}2NUDA3hjwf`<|y$PDI!# za2m(P3qW-%#B+1!M==3^f3}Z_5yMTGJZnP4!-U*5BJG%%g?@GM63b{-d(G(sdQl0e z6j!OO=>a!I7;wqrnV~IFS}BRzFga&&02%#WPc=MrSJ+fAaUMQ2*y#GLLH6|l{c}bD zLdi^>SA-RIl_AhSPhY=!{_4Av`fqT9nq-_rP$ZV7)gqKfN=r(xBzzy`DZa)u(G?z2 z`1y59-p9=3X%JXRyu{@Pab|2D=c>e}8ROd!Of{^f)ChFy_#?DHqo z*?NtKmOW{+tGg#uRCa26n0WFezU<7p8qUc%i=R@#bFf;z$>S-xox@U zfm-o_YLh4}>QR8H2#In~7F|g5qD3jsbi7aP6S<~QzXn>Fyjfy`-~U)j(-vHy0%Z^r zI7~dp4FZJZwf% zNtGgXYgnKfg{(`VT#Dp0?a~x69&7DV|+&sKt!qQH7%uLf^ zb=$8JSa4Ua(fiDT*K3X5WrcUE;C8ONTLZV3y1TVvx^~mXA#hiyrP~boCS`S%88CYM zx6xs}LT&)u73$+wVC<P%{7fPzfhJ)+xHdP%7W1P~sHf1R_O}UVE%-#)Mp5-hV*jghe?+=xE*PC&Fu98ie9qU zm!+gH1-C6Dy&I^jWTY=kGxvz$woQvIOVf87x zafaUSz^n&xS8y{H*Fv`Su{7T`q0a`UyHQ%r3gDi$I@LAbZO%{Y1=`NwuAJ^)fY)of z|FRtZD!9SIh@HUgX#BUMaSFH3C>fP0sj&0YEK$|=3I)$Jvv zcUhip8@R1$x=X-aGj(g#)$K9$wuVqQa93euFIlRr@22`mXF8SS!fRYew_UNPi|Iui zL*ZMi7MPk0g%9P2jBu=ahQRIQ7O8++XyN#WpAb#W1ISLy)uLb@vR^T1xgzaa zaN)t%Yg{efs=&2BAuR24%~rQ6BCD{z>qJ%|mo+R@+rZWHRUR+U;F_{VCcaoMukM1V zK;ZdU9aOab>T&{lOhVJCTW8ODU0>^;bvCuO&9W@fHZs_g!d~{YblfqXvLa`&;Oegp zR2JrSz@>@{D#p&|QnpAiy%FZ9{~wm$dmy1Er` zSLeGG$hXXQE8un}hT?)%eVS*`)T5m<=Y-EG-1_MnYaNO3epnpi;vbU^gk@2UE`S z%qCEr|73FVGz*sujSIKi$wYjo+KyXzN(0#4VqM?pzz({Ykz^Y$Q8tIVmVn(J^9qCA z-z$?&$jkh9DAZKrcCeSlzCvL4`GO?8ZX9?Ra>;5hi-Co}?(=oX<`CFYu-jr`jbQim z@?$e+ZveXo-)x1ytO<65{9Fq5CO+CtAzvBn?qLxhw9iDJm3cm(aclA3g@|Ogcagn8 z8^jGma~3Ph;U9$SYsG86Q@=#q7_hs@7;n%!7B>~J+hj}!uy0M=cwo27n5AIfqPX$E zZkI7j!M;UtQv2qb*m{XPuBo?W}@3nP(1CD&%vxra* z;}pERH;iA65PHQVL2^cgy|ph8hTjzXqN$KLNs6ijV|S1-ywXQdF4Xv~4=`8ut%_Ue zF7rb2MV6KmsWMYan$Z6xv1YXus2~;qi`C!#gcirzGTaK_|3Mb6BU|x}@<((<7PpU< z#m${*gp+KBM_0uq>=9)L;~;J#pG@fcK(tZerdW|~umWC&8WrsllyQ=g)OhptNJY4M zqO=G1t_>#%!L@s*E&f}#)nG8NaRq{-nG;aZVjKeG!=WHj?b8#8kiXq8{`t$e$Rq^$ zIwQ&4o}KXseOsmw?hgjz@%R#p+2A2^o1yt)Xiz{u4-nFm;atu}85ZJ(@%V{Wmh7L< z3?VQ5SPecH0A*dWYf@+?Lg`qw!le9~a8wMZ0QYAYj|PLU(W@WcJUc-@q>*70(F}8G zF6}35LE?QxrG3vmV?t0+o|*CO!L&Go$G8=te|!9>?4s!GlYebWgI;E zh?TI3eX|eWlVml{L3OoZuk5rv8Q7)mkWSf zRv(JV5s9okXkwcmy9M5U0Y&V_#Dj7=zqLcEv=V&lEEz@I@#XiF5 ze@3QXl?bG6!@+=+?AG!a_YdHb4aoPN4M z&plJ^m))6^nK(H(h*=~?22!Q;AC!5V2QzjvllXdjHPSc_`o)jq_zzWVB9>5kBw8L&E$D;c|Bxl5WTW<;MLL)oS}FpVHp zhiV=t6u(neDitWtVhCgbN5m+mlL_H!ByF4x2G-_+$d}zt4A0wZvW5{r%1hyv#a2`b z&92oE(Sl#iKF2gI+wCJkrzu?FN((cl`Ip^wR%-D^kJvk$Dz5Uv})b(N% z{n2YIOXpF`!6=3N0Zk_y3(50H=A7sQe&Cg+KG2&ygxQ8>Ne}kShJNF{M6IbZEgyF_ zd2LEKxiUnloLT1Pp=ok~w1Z2ohGJ<#Q$;LFAhHQMFR!2LYElsNPs_`;`mtr_Y(e8h zQ6S5uQ1(2VI7Mbg$Q;edghZMdn=r9bg=dRPPE95|dRh*8Gb5a!OD1O;BEN2p+N$S@ ziKS3(#R#{bD3>`-&`TW6Xi7Ba&M=qwifG=Uh$X0s!ESS?N$Ifa1Y1F2tsbmh+-em{1DhvT+IKIZIR7VER4+U|oIsAkr3A<7AV4*hw zI{P)vPe9Npem~#@4)MtVA^!>O6HsQ1B6xx%&k1}pV?v&kwu`=Gb*K}YQk)EI!N2}S z1fh0vgLz8R=}EEhQO*?$NEX^Np+$hHzbeYqgQ9Asq5!@2Jh#VLGw_tfVK6v1 zyg3m}i2x)0^#yWse2OaaP(0$2K<+$A_4&}bvZhS)KFlm@P=jo-yQ1|Eqtg+WaBFl< zMR5YtSdYNx8v9F97>dR5El#0XntiQ&coJSwy;PRKrD9TZc1>afG_l>R)Uq;1opTZ! zR#PyQr>`y=8A?%2D{k-W5qiqtmOj(d8iUzwDH+Q0%Y+Jz<+uOu z=_`F$l(j(3LEqP+2(n}57?{=g?-`4SN}>IF^mikK?VoWfhT5$8dOR9DGfJ83J@ijl z)0y&(GB^koqSv#WfMznX=bQ2A0HL7it&fhB$q70-)Cb}R#hr@H0d^xR)ee+$UMLz= zpfMir7hXu)5Q@2|U&~StSe&3S9+qV_hleBc=co$tcm%fP^K(5ZmU=5-+e{U;nO=F2 zB|@->!X)P`HcS*$3aeC?tLw;F(;JS$fm_hup<%m0%I+aI0L95*@Cc0!hZ`!>K2IYu zq}f<~f0eSEbXe34FTXM!;2W<~l?koupHZgr0!{KX(i=T;dCvvW8~K(^CN!cr@yOm& zR7yQ!O64rStY{EJL8s!t1wbe1I=6fLC1l`h6y{Ldg4B{_EMZehw8H-YJ=I3U3DRtR z_*$=*7!3ZYPD;qk(d=l9c{HPvfI{=cEVG(&3>GWUjIrskcgG0kK^GEBGRcz*qAftL zjTue2twzQbY<{sBXPn@8SbSUP(gL)@H#f{CS(iO@rha@f7!2JxHU75w2|8!g6n-g3 z+&58GWu}BQnDfeiK1hOe#&3H8rCj#oLcS9X4T*Re(NQu93+jb<#QVxD>x?3 z<11PUJ%NjwD<8RCATO=b!jFck_PQR%=hiI5f@l(hi&_AKv0}BxDmixIGk{~D47rgW zZo>qM+Rh!p$R^DXJntI~5&C7E&6%|JxWSM*M+8Tpsw?~_m?i@7v8+_nfYQT@MY1$S zMH4v{bo2~<7g}pnI%DaWPii$o{5?6J{9IQlVtl&F5W@{Au|H=tBjy=%K$`)dyTY`s@LLlF{@8 z%@?}Q*Vc6lG^SxNIkx!nKQ3fg~ZzOqbZoZj)Gm`$d&c*ICJRf zG_5Bm%KG+5SW)_DFc=&826YCkr397ReiQ8LTgRm$K^y<)ZzORb|=5SeGA!QiwsblC&| zkBrU>Yw48n#)@|GG{(BO`pS_M76r!5KTAC!Bi{1?Ao(<_U$9(5t6hmFgCTmwv;(PF zU%QRw?tpRBhXw^6VdeyyQzy>&l;PM4qaYgDWk%K{NI7CRX>G{C4=I6a5NZLU870?+ zu1tjz*0$Wf-6ea4&D!AJ^~)zOScH=?a7Q-3w59ot-_s6(%?kwjUazF(GYx8+)rO|Z z4n!iFkvLa~6bt6an7{(5gQ9p&#rX?sV|=w$VuPcOly;A9lr^IMQZyDbeaB~;$Kyv} zShx)9OlU&Dm70Uc)%(86_!XcjF|G|u|E6}GQ{+mAAIvz$a8IpVFSP~BRIxN;j0OYG z8@h@!^lctOtb)J>o=!Jj!_tFXkfEJvsAeksoI3weA!aW6YQWySxEKuHytpVzeVMao z_Q-k$G|HDnC4|CZl3(7ajeAi6=S*#R#p&N{DW8!ja-=#&i%PJFZvs?<813 zuDPRIW6$q<<&@HE?(bB#J87z4SLwY0u@~F!ESXk&)h0NuZ6k*IBYeH`s? z9aq+9u(G6wqH|%2nAwY9#rk!B+%5F{8A10* ziKqL|%YwB&Q`vArjWfAMk7qBQqe+6z14e4{w@Rl9ZXHYLHQ|ScU+RPM&JOaxsOQ6k zrep}C?Rjzalfl43LMT+Qw%FF89*HZOsna&RCS3Cq%2KmxYMriV25`DRLuv#B`|D0( zlO+K0?O;tTi@154#iApsKKtAhShp%i7n>x741c)T0qUeAcjdFFSX{tDB z8L1U)j^9TtO-+>xV5%_{_%bmfJrx-SOK6r)m6kIl8**~PBGm8z{Z-}mfsK^*&dCcM zV5p}Y+9?fVN9X0s=!3yGg|BYkL2|AOF=6!fyiAwT1)oYl{Y)_hwwgO4nG^>?GLEO@ zpv<-znrxecJ!FDh|pf%uiVuB(}Lyikh~+27#|2+C4WtDi$~p$aBC zOE8@yoN$8Ug$_@NGD(0+6zk1#UFk)f$;7hCQT3oO=3sC%viGIou41Lp;JEc?J;vja z4ihIyx$2$Lav(j-m=W$1_g49W;h&uUboTDm>C0!KyqyOR&^I``$}^MSq_&D|Lh6?| zf}n&qV#PaDsxEE$IxAB8C7>}hC|L6L9yS6C$f&>OsUCY}!Z#uIi`9OMZA(zIlY9y+ z2}?xPLDgjgD>Bu8Oi2-0>oJj7T$R`mJ~XoWASO|QIT;!Nh8oldy8gm&!SdlHnbLGm z2YVGMG(9<{)N^YeHgD~corTdX6Rj*CO}D(nP$?xim2_yoQA>0xDwR0*VI6Fmo)N4WCxS>{q18%K#^M5>ef^g^ zg{DAoPZd}@uR&-I|JJe}r8+fe%0&~kW8y$^Lad7H_qO;_BKB-n;~S>5L&5f8bBi6! zSZw`3aG^<#_sbs~CsFYueqN{LC^`%LI~x?T=NNN>S`CjD8_G^cT!(xAiaiOqX-yAPFc8NviZDnw3% z;haBaQ;uW6=@iZJuZ){>WYg%3-)lFaR|MYR8a+nCuhI4K=x}tnhiDp`*9>eT3kPA2 zQ>Boxd4?tA2w!r7fw`LTlyLy{L~xqp1mVby55HmP=u0)eIoTR6D-Su*Ny7q?Jrb)1 zd#Qoif{tT>;2vx`MH7M**AbvL7RA~x)doVwOOe&0L<@K`1!Pj2V{J1m%^sBrfa=&m zG8u^tBqxJm&D*JK<7voarNxFC*jLm?fdTAu>@x#`?yoUx6f7J7C$TJ1T@V#U173AYP~NgRQ;hvW^j zLIaJRq!XQ8;pSTu(1=PEhezW!D2xJBDg9u^S3fpYhj1q}497Z{9(l0~2zE8hUY1WY zLp&M-87UU^irl!vm||{5O*d}0{c!2?eOnS5gt>d;R_r4pqmia-9LFS9Q=NfEV5)GL zpKxY$Fzrs$s;jGo>D}P=>DH2uC{1c4W=3yUjo)1oA>U13Sb}f3c@v zaWB}+iNrCM7+66VB$HigLNWRPy?sq^JSWIJxy7{WUBTYQ>=Y2XD&Ykuh z*y+{amyj>y_(TwuHhZ1^3jsIdiiC8FJmj=c5b;V=IcfA+ z!SBBNDR{T>?fL1&#Xo;|{q&cvzOA><{`>jGo9C~-dw2fR*)Q6s^#LxBo_K+5kzWc) zWp3yPgw9OYLU`wo@vc<(-Mr>vSDIE|Q_H&&1!tflTy3u^h4-%%&5vs~PI1`@ZhX}; zopezbbEnC>7zL+f{N?CSyMewO9h-z~MaDv3TQePuxHW>bH2Pdud}%~!i%y4|)6XDp z2B(XvJqI1B1Wi!Q4apx^m@91<2_*<1!!cL8tg~YPTpdoSn$r6yv&NqBW4(2j;mgr+ zNu5j*hdXn8Gt$g27lbRpKvD^OP`jJ-|9?3;J~%uazJB)N+3CfzS3kUYcH!!N$D_x^ zzSvcUkQPlPT=*lRtW=||`|&=)=xstTIpzz!d<`N)vW!OJz%+elbkGODgyCk55~n1M zNg6Fi=p}<>64xoKy$nSuV#M1FI3#a>NYN{HP2gqHqsRN``0)5} zUpr2&kBj^UB}yl@>iLAGRLn>mTn4q^W(}02mbntjOK$B?|W zH&VKtdmKV1(w;;`0yv`vso{i@B;G3=sgoAZpEe^3xW)+jD!Kp0-&^&y(2m%&$jNyG zc!Fy9NM}41_7nK4l%btuGki&ktHLS5XvXI7ma5u_8?0j-HpXPVR^>7Zwc|?Bqj8b$ zt8XD$N1#nOw!5nL+N1;AVDsvCsqJ|dZ*eWvPzFnj%jwoqGi0n?)1_RQ;7Cgr?VjvD zWmzo%T^}2=DePgRtCspRWPUikV@8CU-trH7IB>d9n_PlXVqtvf9_hQNX%bdoi#E9Z z#i)uq|DFysYltRY?Ty zy?_7yy=S1)6pbCLvvkA#t@Ogxl4lCeqvb+u54Ip`WJ$a$*UWj-(y18`=fqNSqLf)# zRWifR6~$zP&SoUKs+@rgPghIcIoJzEIsF7Q=Yc&?s+E-SaBdnML~!sqNVHqVb>^7r z@ne+X=*svso5pl>(6997Ja=Lhbe?f`Z7dso%?GEt6nbRLYE6Cde`=LiQn_^CJ>6$7M>~Z0cD*Rw}Bb;h2&T=2> z<^HyelbUq1aW2TYaZKn-;>Izclj2JEuG4M|M}xBjbVEpM^zQ+9iG=3BfyGl?SuA9! zP9cX4jNLqPo%RUIDgvK&CB=3h&DafG{A|)8#V17#)s|#t!*ZaJ8JELZO2p`lq>^sZOQNniR!GUlP}JvASk4y+4Oe zzO{ECJjKEW*C2Z#u)R7te;=jHMAT7vmpm@1<*y3KzXqwL@}jk&7{i%$g(r!p#c~t> zaa~YRZqWGpX!L&cer!vblwOm$V&SD45G8r+zA6HNeQ@i31{Z^k<}ZlJh={S6T{6tW z7JZ{4;O1ZhWz)-pDaR9>;&)~8^*i0Gm}B&-VCkMh$hta;3sP?@x_|~^brt17!N|1Y zdiY-HtVi!1&Bav2s%ZwE$b&GWK-gwi)D^6k^;@?w(YZD1tO@4bhy=H;HC%2AxemEt z%4RTf@{+wDp+M4+vieLDx1@#fPsJ=H=E7=m&FaK?jV5ur*D+A6dDp33W6Q-Emxn-* zsG`Y*rQz)$u^@{%%lSce9StE9ctZG|zMGJu1m|fqLl{js5i=+6#3=*;P{sBeqS#HqO2J2Axx zO(DGDFw6OrjLY(4I&57CJe_P-I;~o%NAEj$piIbUzqa2%OT}Fcwe6lgT!t8GE9ira z{%#z#U)Pqn_@$EdYS*p7MO9pKC*T9O_t#wA(uUYUIW`9bO0l_z0>`luPkO=TBXpWF zkd}0=&UaZXO?wToRE*iAD`8NyW`sk1Ay8wCMxrEyQOVs3ehMN;iZYg-7%3H=rbLKy z&MwI)Bb-90m!+{7?;|=vWS%Kw@}_v?jp(A4M%io~z%Xx|Wt`z?h7ufIDdH&d=A(si zbO>;5(FlYCD{P(-`c`431cG8Q)+ePUnPZ^Z>$uKEwqMm({~vpA9uMXF{tZuMNt7h} znhc4U#V#hx3}YMH*b-*O%oyvK89PlyWE&DuXtE{RXhWNjwMDifl|)%0DrCv@ye{s+q$JdWf2KF;GjF2KUBC7%rbJw9vwAg%hAEsnu~ zf2B%XbvXYbZaBJpI58k#?R?v>&85{ynzgJ2t8j1a!s>H>Fx}M;&j5>PE%s*5Y96OG zumq@`RafQTu_ImOkC3f@x7ohd=s)iL`}Y4{?6*$P|C_z|M{NIJ>-86!{Vh``;mcfB4<#|MsxG+HZ%GBd7rs0)?@9f|&8oL#uyACa;^Z_4vO35dmF?LP2XO+5h;= z!*8RZ{_C3;zv@^&e(;Mw;MSMY@3|NL@v7y0D73ZIaKBUlgBVB+0BjRb0q_cmL90%e zH4KDf{LLJ#g?tjJz9>hPe`TilH#rv9c`xJ7R1?5@|0m0o-?Mh&|DPl~FqruwAH3esq6`2gq)+N%5VSD#mNB&=No{$3r^UmnF@(X+pYFaC~@s5pkN_iBrO(8#s( zME_cAn*RnJuf60o_mcOj)OoK(^{koQH8nsb64dFd{+M8z`YPpL|D4~JHOT{b%wGv$ z=@bAWc>j?$ib|zxghBB{1`g(}E{|sX%ZEw{!uf;|X^hq6d|OsMa%!uP{nw@^Jruu& zq8PvL7Lah10CjmsB2oUoy?d##?n&3tfoZR1FjynxBuWHe7ypMJUFW>G-(9<_ImUuk zg?oK$Q14Yd2Z#>-FYDq1V2wXt;a>vwr*TkU4V}jY1VpYT3HqPvqb>vvXvEdoTqTX` zld&GyMG0E(!f$7;oYqyh`mazc^?>znG}6}(n64p=wQ;PcO8ngew?4qXvPu697yrHh z*0;0&VsyX7$@quji3CQ#uS$ORNT~zsMts|CtW_8q|Mu7k-_P zv!)P;K>!&s4W>rYC}dxTyb>Xp8fhR8gTP?F_ENWOSugi{?5HsnNAM;7szFVDeFIn? zrVf$c0~AnLzonpJuw@lD;Ud?0$9ksq)%{*#1c69ptY<%=22fVr`+u3;^(xd?PaFdk z1moAd;_^T*e_??2Qt~*)mbDb93{IWn;1Ky9o4qDpq(r*SSNWGV+RLgTPHNqQ6A$UZ;G)s zLpz}{wvO@`l)SO6o4gg;)=cf!v1?)kbuC}gD)|anwamZr9sX+km(yz9coXCUa6#ly zz+9366B@Km0slggxFDY`s|jG&_sRb;9Cgrt{r(UC1rZ|{gn-~spI_E!Er5&?NY?lT zG*?N~zQ0HmHHiE_*#-mxfoN-LuKo{!K>qeWOdF;H0YNo2Av!QP45kSIL10iV9Vkd1 z^8eD9|M-Q{88{jU^1s~H-v{@<$uG&y)_m(0$t@rdXe-*n%mD=2C=3E^kl4%v0)h5D zFB=4bxKbEMS4Ln2pu$05xarzoU>L+Vn9cyh&A>1ij!IScq2S0gTp(RNh{yoLU|<+z zJv*(>S{WDw2H6ME+y{j_K_Otcv8FBa8suheQqJ4vPyw)lS!Ue8ZVuvFW_d(Yx z(Q@{+#p}_-&FmmhyFl%5nwf8eUtk!HM)e`P!0m#GzV`GeUpKOgra8sZ&K(Rh0mD!@ z2b^vY(ZM!=j7LR5Q6v*Ls;)aq7m2a7=g0ZLjqbYu-!DN58D4df$EZof%3`3caX<8^f%_vhE&DOz`fOLkz@g^=9d#wno z5HqA>5Q>fuWB7q#CT2cZ9fCjE-aMRQ?@tOQgJC8%Aq-;}l|PuMLKw z2)<@;FwDe(<^zVIu*P;ITA+;$6%0d>NDy;P(;yo%$y_&zLGy8@;%tp6K~PLM)+xfy zH3I5n8E6{ijz?;RG8|A)s9y*nM3X@^AwmNJabZqwFh^ro6kW&1+}44pO~IP@2b()m z8Bnr?1hcz{m&&%Ebb0jV9Ac&UV^#vaN$F)z`%}*w!uF&J-Hx7-Vm( z6%5fqLHu3$|1m4+eXXE)E}pfBf#MyC>N|n7&gj=K)16r zc8Co1g9YdX`dYc;ECQ&up~N8f2!}{8%!CdL4#K-roPykRP(eOavYQnZ4s#0$)5Nc)8?=w5Ceks&9t=YfwcVgD5KAx&6^?Z>B{@2x9KbLX&<{%@ z8tOoG2?4`QVD@1I(nNaUuRXz{Htp;hj(xIGnFlU~nMZ!9foP zv!jN(qI5_B)Cd>2HrkcKpi%roP2t*_aAIhvDcm$tGXzhJ3cxt(K|?U^p;n0(H(7>17>4XPEa>#FAp!CHq#+G$$*TcIL#NRFZA5Ev=K z4r>k#1H({(a1&cF45e!fhMR(6s9#dKDx$#cHN68z4t_Fr0fFQ}XftD{i2SKH(RSH$ zubRKKm^D!hBot*UV~{3^j~actab-B|8#Xphkema)7p=ZzWZO*bFT9|2_N;{LfisFQ zYioPDKhgbc|7k95{Kb)7rq;rCJ4KIO{F;~W9a|qiHpSs~sfqF* z$AT&;)U@-m8+>7D3E!Hr zD;G-O$;`~mC@9$X!@%U(YH#Q=(!yb<&z)ltAD_ncRpKJv9p&9FEiG`WEq?La=x#8W zyNfAeE}d5;Wub(8Pfy{}vDgio`s9=fZb zskt*xJ22BIZ6ayqq~g4Jwyu)o*eQ%rea0?RYKP%>c|}DoG#XtKHg$H^Z7XeV0(;r3 zPPV?j{<-E>)5L8}W$eRyV?}$9tv($7KKEiGo5_(FZcdBK$r1C68V3jTUq>z}CidNn zgf}!ayc-|qyV0L|^QPwbsm+t=K2?Z{tu1CUm)&mg+>e@TC{8y@uBp)-r|0k0))qC4 zo_|D0H%wSqh#04P>{uo+GyCM0FY&XI+|@kqiC;Nb-P~72IC=K$-dNT})5LANV6Yv) z#jaAT(vA?m$!XE~(HP+0@85Nm{AM`I)5CA0r<-n4x~X#$*l{}JLwmMr#MG^q&x?@! zYM%F8m!wVc%dg#o;Y_Bl^vWzRtFrh&E$MRR({Jw!2?^CBw62`9w6xqVE6aNL@IV<;u-3k^ zE`h+jO<-XADd9?$5hu*dP0IfA>EjjP{%#Vg`P-G z&NMQ0>0^JZtgFK_pAGx1)b`|V-n{wY?ZAPO4yuZZipp4LapJ7Rorj$K^p!UaocxaL zC3+GRSLOO{Xz1vZC)VSR9u84a`uFbLv-9*+k4@e@ubi?{g+O2JVh^>%H{p-oy=(CG z+qY6o2t`cY<49g!-s9L$63gAZ^DP|3S`%i1tS~n>_ssY2IYx06<6Wiv$;rtj9n>xJ zWr)diMTuI3X?hYWO|stamL=P`H!C~45PeFii>%AN+$}e6o|*cZjcYOc^y12w7CEK` z+gPjh>C@xY)zz~S+nPADDJv%xi|5I$P$+H0LRybzwj@x2jEd54XlN+upl+ToV*+hd zAsW+?bOvLD`Nh<;jN&G|>yL5g8pYn3l?ZF%^we`KGCP;xJ-L1Nqji?%J}JlY^ftmf z_Qy>>Shigfxa-ZFz%douELJ2))~;8aZ~FBn2kSamySYicx=Gm`oA9)ceYQ^y4YOn( zIokXv7fSH>++m`V+SaLOPnwYk2XC-xYIcWO7 zuwD|N9cfOJ8g5RL>LT|fuSke3??&&PbrB}EJgOc%oI+;DIs;{lVwc`6PuJxb6+2IM z)BxittUJ5MKafYa4L04JuVvlY+1W#jqwK`=biw50WXV~7GKo}l z{`^B(@#l3L`L(ukGW zQ?nAxOJAExD3UBWgy-DL9Q8v{11W8Ow-nUXuTD&-u~;YyMde7ISJ&*BECJ< zvG?$Z89=bloZ)--QOa|g%y zv8a3ahpue&B=pgvN9WI<2mM@`W)@N;wS(UR%6(yB0T3JPPj#E_O26K{9`_>b7s5xT zWemau3Jk(e15=j1g2po^F~M0f!m_fmtsNaXM#I5@uWN*qPVpsflR3s_%e6m#d@?(m z8-YOlm}dUG6a_6Xij_a6|Hcv-cTMO8-jkel!&-A)@72dliJ=(!;>AykV z@cKvhbXQjw2t>Leaf9@KuZ{Y8m4@_8S_Oc3c!$H!a;# z#1=De@AI>Kq1Qu(QC!^Ig*7$eMn*;pb1%KBd^;6lW;@LRwOiq7UH6k?kRT}MIY%_I z060O%zUkgBEWGJbZ*p#KZbh9oW9)f_*z**P2d;C20%g``Xak6Yi{OX%?(HW&xaU&v zmVNE*^rc4}Nz`vDE+pyUu0Kl0KS~BSxdsH-NkjFM{uceo9DAPOgyqO1R}-<=4A+ zVPWB2!*TvS`}Q@BbruWl+!>#lx#NSU_1+&kroV{=ANK9jd!e6RRETxo@_z}eGqpo^ zc7mwyAMr&*Mh>-StM=UupAPgo7rip~vXCNq_{SIXR4JX$w>1W*`fu<)yb^9Ew?ATg zX=!QoN-Spo7cTWfcbw*UN>Wn=+6EJ%?1$bw`F(xa+uK{lutQ^aiir((m0DH0UjZHQ ze|Z(V!dzTj)D8bEttR?7@Tc{MY7F-0veUv>a$wlhtK)5_l&#qIs`KH(%ctr&L3rj; z;bd;EPVn2n>9^qFh~=s3FQ4yDTLMMM9)O;E?q!oDBOE1d zp`jt{AlT?)PuHiA4OhPVR;Zrdyg zT(AH5G!M!cv-`si`J8};{8$KCSX@N2jkRaKe5r3crCi$KyM4aQ2x#f^wai`3T%c4b zooyi@Azfs>+GeJ@~ z`uk@jAife#f*8b#=KS=aMr^{NO2k|xBGadYBcP=O3T0X(tHRz3s^Xaw-b}?d-xY}< zYtR8#*IWlg-CL2;3m5jT81~-6F_&667MViJ@R3{)C^$HHro)vp&=Ol&+^o<6<8YB|=3)Z}@ zg(s(^l>P~8_&|I1?K_^AC#CLDBOjY=Wf1;ZTGOU+?$gUsOvv8(GC^QL(~ffl5K16G z<~=<Pj)Q!4ep!lSoA1I0P4N zLN|cEeEAYFQ_p*{pkQBY@-7*}sGU=22tlH z-5BFt+$o~_GL4$-MAbbuGnveMgK*oWorefaRy}7TVMQ-N_50{`LXiW5p&1hsQ%UZS z9e2!{f2uQh-ZXJru1@f|SryAw=qs79($Bj*oC^Zw?~mLOyF8Ed_1$yz&|RfimP2xK zvN!C^%xikb(33OpuF*Y7D_YXaH)NLmb?3wRTgdLyh7N|Y19PXSp`nO9Q?4fVG9x<^Mwe9X+vckAkk7Z`*m3l! zHW(ZZ6bpEBM?}@->Z2!T;6f4-Nt~5s!bs~$-`6$JJB;yT85!Gw=JfO=^z`%^>UNJ< zPo^tYAzs!)cL5@4&XTTwR$w3`Czl@i?IW%so=<##1f-#%Vf*&&ATKYki0J6X#>P!g z^K^hkc~&QQo1mZ|aPj3!u?-tGZ06^0d{-YQBqDM={B0!fmoH!XYU#??uV1GQH*X!s zWHU|xQ$n_u7T&T)RkgA8E_^{CRA;pI>%^k2|(<6;Y;@j$t8xt4f^g;a|j!0N*M)K%J9Pd3Y3T^UO) z(8A3|yE9h@-i=`KA!j6jb)4D9=7d=9Io5GPadkAa>HpQ#e>L^Le^a|2;;ZBh4P^$Z zgUtg1)JPrY(y9n8_=iU}K+agteE)9V!jkE{9eD6&K>v= z;PyWKut~r;=UOWXh(kcb&1t3#h9;gssES<<^YQUHfAgl(k|S7VwIdS3E%9+HUmt5& zSXwruO2D`8+!=3MpkM#yjSLQl6W8?J{)7YvxVM)73-1<|OlxcF!_H#!kcl3Zkq;jV zD=W8)rf@%eDu%=1c76T&l{(R*B5fG8Q$j+buZqC?{{4Hv800=B2}o*gE-WnceQ{YL zCN>u8)4KghE_4$bjc$GROq3(Di@e&K+HEX811k)sWa%9Uf2bL!SbU7^+bVJ z+YuUK-FLC5Xk%Mj8`kUGr_N$t00C$`SlGzqESAkiYTb$WqM#l4D&EC2lKaiwaPyZ} z4+%+1Cfnp`quHpr)%h;AlosAP+osI+Zq3+LGkPu>Fk~eqiXL~vY?dzb)JDzieR0hz z{oOln-?IsYrit&nF^FuV6uvuLh)^Xq+by$OV(Z7(jn#d+S38tOEcLwb1R&+6HVNJ*ufGmL&; z)go&e6LW7??+*yEPgKJ*^~IHggvq`t3mcnkBlDg@)5Pr(5=p?t@vhRY(HgG#aQ_RKrs(mbGgY5wTi0 zpIIw!WLnI$`1tt7y2}LLMhtHy4qA_>A(6;j?Lf(mn>L-y&D|5r+EoeQuK5qiHYT}D7npa^ne2di)B^ams;X+NuWC1qMk~QUONLw0hYJ&B8(!V= zFa0~#l@cc1kRaUv@HK?=MBEICM6(N3Cp#kh2ED2fqan9A9)8wbTwLA*w*$M#HCb6% zJ7>o_O_u}?c{882aDs5mXQP$?Qm=GXo0*w8Kq6h3RZ&+lG?el5^xUJNkz<79T0XVv zl5!dEm?1Ras~*02BeS@;*i}|@lV42z;nSy2KRlRAT^Zj5FnW(dglT%xv11z-mY1#A z#=QUtM+PU`(ZmhX)AwC%I7d@8m+MritE5(8E6>#^C`C zoF1T`LQ9(jU`p3-+~_Q|5*vrN@;rF(pq=w>*YAw;(Zi#gzI@2>vSb@;TcFX#c6J%F z5?dQMJpl7-U%@&Yww@fQ79_N=vW?;<-+jpOYCgJ&x1{5u*gRPp;QM`Eq3!8>r`qC6 zN)*T8t=o183k%80s>h=4S0aYJnTqHpPK9HXbyil^`N(e{yT}B9Zu~=hHGh zDK}T#`m82;N#J_%m*Ez|+(hp`id0rYO3KQt*v4U5XU`^|II(#gJ`ukn0ZiN8xo~A- ziy4KYa#qVSPIlDvu?dxRckI_Z zyRyt5AwOojFF^e*S=`weuyBkdP28zmdMaWNB%s>)o)a zKm>l_eNzfRY_@FKV&~zJ%KW)J_*`>q2jb`c>({R<8rkH@=u$x#!?~gqc8(}f9*U736NTyrb$ zHt7S-&Z2ihKP7~IdNGtJclbz7j@VU?+KnI!TiXOSTduvmeP;4T2mal|qpi=LH5VaM zo);nc^ASwXiSEEkLJO;qKKg9+6|U*(@wDrNhQ>zIHk}!ddl5naR=;=eUWN1bEEPvP zPtU^xDdV%_-MTRg5YW4c-b(=c#N+YQsaIMH3k%+Z4`M6buPnT*;~WR5pR#TKkqZ>v z=y|nO|H026qll`&0qr(SwXyo4J6sqH=5G#gA#w3Nu_pIL#KeZbet3-idH4KzP@Z<+ zu?v*Go0RTAjSGX!pE8Y!g4d$zDQ6RMbHzbAgE3nEFVsBlFv|U6T^{6q{^5Fql-5(` zFMJ>2b$`%Bc-|#EiuoX_?wZo%wa-p5587FLA~}mobDxGrM-#t({W`$8(;v|Mz9}U* z`Y(ScYu(?u0d(ff8Q;MNhDJ+cyWl!f_$;0>=m7Ck*Z`zmppK<`G`%!CUR-Kg2TVOcK_i1#(x%-HE- z-{^qd-<_NygHHuOUa@n%UJrIwV{AJ} z-pEMS$jGQV7Ber1_(2`GmY18mXO8m9?07i*24Y?rFyHs>!>rAaNR{ugFS4(C)v@TK z&xXelD>yDg=< zSJmD9`D(J`OW)udX5hTCX+IPi{C5A7vszY50<WMmv!Qqg9+pOu(v;H1U@%5wRV?ILsoNaNnj zu}p*vE2#foBs^i8%-&d3TqRd*B#>8$2(3b7`owcUo6`6|GqbZ!^97Yx+woQBZSu6c z$bH<)j;r=~qQj1WpMHCPvw%PrU@6DT*v*`k<>g^8q@edoB8=oQK*Dj38$2v9;ec}vOC(7n4f)eXc(TEAT11fH#L>^`nAV6 z{2~weS-x@NHkpzR>Yn*BFQAHBh(;D4$oJQN-+4bvOUvi?BI$pih3AB#ix)R@IGirB zomPQCI4UHhYF5Iwo->=ca#C^kck&o?1E{pLluD;J9_JS;!GusopB2Pipwt{*xihO` z+r*hYy1G65oITXS1=BZPims~W);f$jzdUDHmkFV&lRp&+>2pd64*0~Sa*GCnLQE3e$ZKp~* zo{P+n?w_2#*2n%<o;zcVxT3(=IKR;?uNNm2Nle!+~S;G(Vb2*a&)d&M-y&&>ip2B4k&YczeTf{-NpVbo%HsG`q-uvIE-Z^`;WhLjAz; z2(xxdX0Z~|(*@@z`*+7CcRg7AD8(3izTw-)r>FizrqaToBd3%xMZtp)HgDb9bj$x` zNr%0qy}gjNlJL3c&wBZKbkveGxazmCfuY=sq?M()%>n|CE?s+&{5VI$ie2o_&CQ*w zAG&vG?o%RwM(6@ZS9)cZZy@Gf!Y8M%=_>in)bq-{d$9buv8UY8-qm$aEbHpX=qRB* zOQq%~XSph%A2v=GNLqO#vrOMVA09qA{aIJZ54e0Ycu=<3JiWO-j<>W!Xl^(ip`f6! zaq87AKq>z-&SK)-a5|z{7_miXyZs*IcM~@rZSu4MfSGyf)Yk6}cS44Fw1Zxs5ZaA8kGXRqdBO@d7 zIyz#Di;H_yR5pOJva;k62)WwY+Sax>Nn!Wy&N?PDRa$RH znv@PINBs~$Qpd)86_u5DD=V8XgvaNvIweN+b(OfXa&m@SPwwukr7OQ59tKQ>buMH> z9IqhC)m41s#*Objec}%e4vvV305I-m0RgjbAD<2l4Q&Vx4qjMVQjnJi;cz(d{SlC& zqN15+2GfAh8H9f}b9NRDdR?ThVr~LlA@&Eq|asR)5|DE`Mn2wg#-{SuvP^k8Q#sB|* z@%v}|{{}1w1p2ZX{~tZChzEhVl>fuy|Dj;GFKVHs{eoSCOoJW5iMCjV6&mi~ zXXA`=HgWfNbAv#Gp_(uoFbox75=9CPw9$$}n=m3m?Fl3YGXe_bfHDumYg)Kbbal;q zEYL(4Hp)adFxXVn%~=;>>=>wR=57UZwh7d7W(0=X2lz$VQNS>iosOPOL}-8(#XK@B z5)-aNu!35^pcJAu7-r&N42Ge6bqSadGmNXAGu|Q6&0fn!CnSIp$#5gs**oKO9O)Qa z|6n&uTOV7reFWVnGBPSO90IezTbKrzSTRg3eS88)ZuAIycSf)U1g5R+=V$DXMTU?a z{run*q=l8XE)q!w!%#tVSRfvPi$q(6yV;sr!_cNSCR!+Xa1h0ofJ8#UFqAzb(1vag zqnQ!O?)V6@wX;1f2;)jO3G}16Be5`R3>NA@LR$qw@p=?1CvD#lZC9iVFbpjW#yFCp z8_IAuCWT{Ano%(8V4FZ)2O`5d96}-lfMF;{cQDL^1csUT+C;cgbufB%kyx@O6%0c$ zFuEugYJk6wBP`O!5$J|#n4M1)%^7ax9B5~YaixP{CLwM<=Kelm&X#_<;WmLdzbI{@ zt!oI}Qa4N|l;~(2rKKI{Xip3`wsv(jcMo^<4@7F4z->cA=nx%DsIMC_#M0M-VM7jd zFt;G!LxMv6$#4=1YibIHnfN2=TD}+>+@4~BA_Nlc;iORWK(dcnu(_osl3=D|YwVqq-UdK$=5>B!J!%V`XLbQOMV}XVL-;T{M?0I(X_t<=Y zC#N|{o|!8L-mADM>Ax?1ax%lz)5<01R6@V|8TX6ctOLHAi+xGNvXl!K%?+#^;f?%z zR67Oe7AoI-Ka@gl?562$-j$If0JS+FBt8P`SbT@iypAW$KVeQAb_8Epl!w4O-rW<_ zfH%sbGZkkZ31jwuQ5-;T6cW;7m0Fr9?moR&=wzyEg_#))U%o@A?ZkiJMaB630906* zcG%RbJHBg;cU9EHM*fD_Y%})&!Tji*a z_1{q5xM>p(A`YRASUh_4NM2oi8y_EE-z|SJ8jWUm@Sy6_h0Hu$d1iO)&z0{MXmtJS zTDp+5bgJk5sQQ5csiC1Eal{cXc^9IXOKH z(B4$z*(@R=vS;7ErgF!!3^qGGKVN$C?R}}Fq$Jl$?+vM_-Kccgw8}~d0GnnE(^XFBu>Ssj*IRxf&1q7JEExj@MMW;2xD6>{8Yp*n$-@gn zyg46L)YY4x6&O@Se8Gzg@T5xVY%9qC zE#GdH9YCAxgFbrn=s;QbP(PX7^sK-DX--R)F$k02zhBzO$Os~t*4o~_Lng`TSgGZ{ z>$pZ90ZGlx-v^n99m2xMmXPxJcrF2H-R%JAc5uiX(=DN@VV4{q=V+LZJ}VHCkx5HU z73d6!*N>XrQ&d#+yp~SB>{08$kapN}dheT_f#ABdgTePjZjd{gdoQ^lTkNw`U9P?> z&G9t38#YxLvqu|lL)u~U z>Af33Tlo2*KCRo$P^hohG6I|&9pg@%*v!SvUHe0;rewbww&8Ux9bm?@vy4uAr>S@K zabvxg#6EVgHT1XeJ#q*ol-U*>W3%PhjFbJzBC7AEr_<$_KkOMhcN{65xUgf#j^{VX zn4Mx`DXb#&@#Dv9K3%+^3|7=;-3hm#rB)tHXvGxFe#XzJmQFTO4|8zJ8@~@$e+GjCD3|-h6;aEFBXc zQB=dG`S(_csEMYGi8JEv+|iGSj7(w~+cr4#Rz52*7#?LaMP=fGib_hj-rNZlmWj(h zQd(gztZe(}%Ww;_y=BXm?c2A@>+|S6?C416t?2}vu0W+qYHeZ1 z&Yu|*A31XKrY09JZwkwJ8@}A{Kva}|QE@S{MP6e6_t$jYn1#wQ@e$DJ3LbF*o|2Lh zpnHASiTnx*3T7?xyp>Mas~0Zt1PcV0GA8b$e7YjJ_r;4Mn>_6zLWVHF zDGLjY83NZgSz(*zrw7wpWTUMa0<>d=rit%AU8@t7iJN@rfUP>tFIMs1@MHM&+pXx# z!{1+ehK7bld~H)MeEDh0$d?`zq~8Ac@rM)Td*~mZ)MtXN%v$6PDxI(auWnNMs)N~M z;>|maM`RU}zlel^_o?t;^l+Y+r%_Hcm9xB^jEgcKQR6FK633PUN%kKRuPfd zGc{1%=nZ){)>%CB{kwT=tl`(MUjfnnxiZas;b0iMqzQw=H-KEOc{Yu-of49hOYbhj zm}ag3 zIqHXwrKhKliTm)Lu1MzQ=1yWgR~V=cHm6b{6_+j*zWns1Q4rzXf1MaHegFH+a5}=> zYOaiZxMAVT@Rd4_Rc8FcLWHZD=%bdFg9z=gNmu`qM&F*mU$i)ppXK*Y-m?+hnsxeg z#mAQ%sqzm$bIuaVD{{|j_ntp5@2V#H=VXY`bofCP+d>(;GLEqlEo@7{zDB4c9>pOE0s3Jek( z69pRsv@czCsx7Y&v%)s@e9iT9EZ5f7R!~*t&s21iH8E@1rKl|KiF)-us^E{9@|oZ{HR@ zrHnyQsSrOuKPQ)p7;Ef(*NVLtPLqEk7Dt5r%bl^`}Xbrmxc@P;%XSl`k8b1@(S00fXjP5%luL%Cj30^Fxr-k4q~y`7aiHz*+Z{u>5#mqPoH(q zUcV$&XS-D}<;R)((cj-Mj{;)(kiN~+|J=}iU=8-W}^&k&+S*y=g~V+TCocXg<4o!@05v~tPGoS zf7ILzXm;;%ztr?}LAIW=#EpIdFE6h(GmxeiF(WS+bQzYu|Lf*$GWv@8JZ%MAq=)E{IL&eGhq z{IdcBW&JID4;{ddnwpHSy&QgcbW>6B#aB6Ahm&Ltqr5wdkVVBA2h^||SEGs>6SkVV zx{6m+RG78cXScUoiVN`U=PV5C(m$q-=_-m_WuNW86RLXb*s+=SDH`v;et29oyvIE< zQjhfX?D3(-#NA-uh()1mMUTRC-A^Ogm>J{Q z=|MUFmsgKB;e}+{z>-o@Rivkqvr_|Nf`+r(Gf$mDnkyV9lxNz|XteE8Qv6X>o>n;-{J;^tCDi;~jPBo=CKivze{260&W%a<<^AJ35A zefpGAMQBmb)ZEE0s&>H7Z?A2>?oii$Zf z^*Eb&Gp*Fp*2T$*>r`8OO^t4Rd_1r=XJ%*P>%AYI5Zb+6MCAC`m@mMK@^pexB$5)1 zPPg~)NX^XLk(HfYc;N!i!@1&*Ioa8TB_&)jM?`p!w4SuEv}`zM7@d)m zlbDde)2WmFTEHrM=kSLdFH{RlChv3B3&%X|KnS5(0Q6GuVBZCsyusMC^mIYaVh3}} z18y@ltV6DgXC!xlLHO;{rPb9sMa9K=u}??ZP7O^>1+GYXd3oLAEPXn*Ls+ZD0X(#3 z6cUea;>FLrs|O}r5q&HtM+}uJ9@70yK+Z^7R#rAckxy1uw&o{iIb<;QJ8orZPTdyM zBW;x(uLsbJ;^NK$cRgX0NXrOw7axOj1M_1h>_hW?=x^^TSn zUgq+^Aa$aroFs>_wjP z*H${UkwjCtKfS!>^2Yg6Urkyx z7^H@+Zo1N=S95=dRqs=(YUtLWYoAj}CwR`@?ppqQH~nBa=(Xn?ek*L_;k(%+5-FKA z@}lPc9p2LwJRz!Bqo8ZAnjCshT)5(tsTfqcw_yq!?OL(7<%*L*&3(U3R@mb;*?v;h zE}?|-ip|vy-y5f}v91+c!YBKnL8XtTut?X6Exk9h-!gx$ytXWt2)fqZ?10@KRO*u= zRqayT**b;YmEgPqL7hNl024Rz~H?ABxsG=fN?J|lhZy#yCk|hNy=c{&! zta6fhcqQv*{J^FCt`%XvOKs1tWZg_2xU}M0v2S+ZN*1E2O@$hHD3)|mZm#&FrlwuHc5S#DHf3UKyUowvA35lxkk=2B zt9}zEwSWJ9>i0L{jRONxQv=nbF|QAtDqULnKDZkU=BAH6LsF@bsJRL5;Nal+#6-gE zSSLg>&9#QQOFN+N$eX+2yOouB7Z(?GLnn4xT3OlK+i$qhFYs=u;7U=^#?sPK;QH5Z z-%g%76$ccCLWTH6)sA%fJ{s#R77`Ur&<=d{u%kne(41QTx|V)2GxON7V;k!Sg^IjF zjPk97OV1V*q+u^P<6hT9Nd|fM?BBqg0 z@BOeQWcYcxqjG$F{3_nGwPjg-%ZMJ1sX4vZ>Q+^ikkYBPCI7Y~8#Y1wU#P|W_|gK< z1GAR9j*m1{r0;1H-Uo@86r zc%#E8rNAIOnKiQ0AZ+qLM1*ckOpLdtOv6(5PwT&VvaEDf z$0x2!l?QlANr_@-h{aJ|x%L9VrtFEYA0Bts(#dA#=DTd3d7tQql09_H0#`nJz1hLV$-oh^ZaZ zRRoO=r>g`S#pn3_?hFyExcd)h2yMeN^T#Sgqxft;9Bx;FfW)!ZR*UKdRertRo*sDx zg^k9>#_G(pU9~);jfaayO)biw6&Q$dI2;QMCVYI(?`eG;Z|5Z!jVEk`7h`9p(5R_w z(Z|Np(x{0Zm4(Gcl?h|wKG!Nd_m7p8FT?4GWR}UccQLw&mqr_jrDroTj+`@$E~=^N z8-MwMwS}KQ_`30^*PZ3<19l&k{fBMH}TiSCDQ<$mlZ;1O;84%&}qa zGcb_SFW5FWH&;~r+=goOi1sl?x76t=34ZVXeS2qTrB5F+1JylhKo|_>fucE1SFZit z<;9HqPLCfy2H@kshm*q_H*U0Zb5qghIr^>8jMkAjS^BC1tLmyI+OM82?c(CXtD&LM z3EiA82+oW)^4ZtB?oK)V;ktz<7z`eJaV2j|JSgp3p$F|*VnC^W$a^zs#9@yFixIW{ z{{GE^f?_g_`$CMeFjp5dN}ar7=dfyr?(_^n{x9~vJU))%O4w|ckW3EeAdnEim65=b z(X=#@EgKP=$g(lQmmeZ`PuO1&;{%8kVY+|jeE3;pWQx30S3l&d!W_~?PlSAFQH zo_iL|dgh5=j6JYn_rV7r{Em0LHWx?Z@#%@#?0A|j9qcbO?%+zmFID%%Ws}+ zc;e*c%X@75+NVDJwV&Z0zIdUw;*@?(Dzf%7M#Me|!Bem#Nu*c(P}k@%5P(FQ51Ek01Hq zgAcx{HGIZ%$b9XVy}v#B^e2D%jsB~yx@zggow?_Jb5iVo9(m-`#9B!Xeqqn08?OKL zj+MK9c-G&~{P?R6sOM=P-2I~;?L6e|Z@sN&$9sQ%|HiWtUFYoHyy$y({M+7ZuN*vF zS%1Z^Ui<1@zxvfbpK*=#!*BogY4^S#KcAR0XYp$L$V9U~96&+7cw zXTGQ3bFKBqMa#Z(!_EhdlZJ*sr}>9-fAyV@fS1f-1;TtbpeeHsC1$3|9^0t|Oy79%EapT2zeCY7QPk#}tJmRAtP39h&d+6bZ z&%g1WQ(F#eJoebr&Pv_>^PgXO{q=`^biQefJazr&4sT7p`PY}5T3eUp^YhL)>u>p! zFF1SlC1W2b6bfSN=D?YhlxzIZornciemL zy<|z9z5nW?)?RbQ7k>Tg6@!C=r=ED$V_*ND&$ZtCPmR3`#{Sy&$}6w@_L_|+8V`N% zoqrtL^B%YBC>kxwk8W((aMaP;o=blIhy3{*blvcdJx|{CxgXvza>C|E z|8eVUFE9iznDtLz*!9q*J%_AWbpH02A6@$98-M)!Ijb)J?pt5^`tkVKXP$lb;)nHB zmn~!gUeSJb`|ba^dv|Q>O-Dcd^wZa#+Op-*&(417ksY%xyW)y>T+sN) za}R!Z#y`FO`qnoeoAvj;C*JtM#vi)xT(oG>W$G12Jozts4tn6!-QC^Y=RN*`%YOL7 zBQ9*+c>P;9{^&U`^H zWy24(zv;hsFW>vT{?l{bbD4Q{&wu^(@84|P^yXWe7oB$XuD}2IYkwU4zWH$Mth3Jg zulw(x|HcpQ&i?F`C+@iTVg2(bHC%StW#9V#=DROjdg@JE=gk1~=O6y?jia}3d-0|n z*IwIpYRh4V9(w2}F2CoIH}~$j;_9o19#;=+yRH1;mo`sbz@pt<>- zTW`Ag!QoeL-upinr!Tw_-Er6_=il?Ou~+}NdFRYK4;fOgyzREzcE6C{vhwN;H=cu^ zyz`MKFFEU^T<-Z%>;d z8*lyfI}huNj5+r%{oG;jzkgIXPiy$h*2lgu|E2p*w?2E`rJHuneEvI#e1F>^?;U#J zT1dVhA)G3bAYM0ozkNsI`wK4k!lAqK&)%0cj6;v=xp%>=htM5k4~%{M-gD1=hlbFD z7k}Zu@<7L|k$-*W(w-gf`_PBbJ%y7mI(FsP&Td$C-nr*p+Prh-^Ven;JvV2~j4jVx zdHG=BdmnlI-t&$+p>5>3Q}0gB{p_Ag&wTaH9S`q1?bK7>an@O9U3}NFUtN0tvzuRe zyjT7jo55T$-+T5)jrTot-SGQA`qAUM&iTgXMgMijm-gCM3?6jL?YHl^>&S0@{z2oM zYp%KGsSlf<-gD`q^X}a7(_LF%`cwCsqj%o_^@XqeqG5si)cNwq*h@o4Zu-f;ocV*J zpX^!q_*Z9s>XZ-7_{mRy`lT;_`LUOtIDd~u{WSkpSS=o(h_TCy!6T|i#Kfex^dyM^S*iImEFI;KDYFCU@!X0$uE%E z_c-RfA+zt+*IxL-GtX@DC)n0CGp@Mms?S`0`D|tV4*;3JWgpH{Z{Il++4qr2{?pIC zc=Z+cJiW!}?QU;x|Lt|d>+ViIHIv%_R}EhL?jskx?}U-(?1!GX=f#Uw9Q*Dg=AJBB z5@+n5(UyB??$OuXzVz6YU;EkU(lsBsbH}qkNG)35zx$TIy!MYj-gD;(pX}@V)1RMp zmhIiU_o;`jJFYYLP-9o@!B6jbWc}4UXI}WPb7t&Zxb3im4m#-6>y3++UwzkxmJL5V z^wXdI^n%eBc0Seg_>4Pu;2&&VwEnc+D<6II(f_#r+0B2t<)91CxaPjGy-!^D)ZPDi z$YF`o8oOe@Ja^B>W`1(d$Nt~oL4SJumtX#Hr}5#R{NyKnYt}sR%Cqaf8+Q9V{*OCn zzVX?Ap9yz8q!Ft&7W>KPT5mr0jtg7gb;qS|f8vQJzB+ICuybb4I`1oAIrQ$$zc_fo ztiFGe7r>U!3ed|ImlNx$c_7 zd?WVJQ?C2v8!!I&i-*h_d*9#Qc) z_T!IhcYjHk$^W+L%R6@-`Lo+@`^o+HAO6AFtIqzV_PakEb;YHZ9`yU~TeqM6&JU7> z!iq~49d*MEH(aKEDP}MF%CeVtZT-(E$Iz{BlyVGx_{pA+46fNd|DhZ3?07u>+sjwa z`t#HG9MX~g^)1V0Z9kjLTIY=n?Ao>Kf$MW0{l@A`&fE6lO^3hj?eG4CrZxWVcfVV* ztl>S6j-C6T5B1-4_sfsn{{C6BzL@#3+-gWGXum01#;rl>q>s`AF=Uvl(|BM+2<$ITO z5B}n&&5PDA|KP6IPhYxpY1>6B&i&lydQLw19a~>};XSKYum146-~RazC;#D-pZp}5 zo$kBp^c|}g?fu7#F1qL!zxmD5&6|^_oN`Lv+O_9=?Q2KOxc`f>GuEy>=Yk79aOmNO zH_V@Z_(d08^w-C~y!zUa=TH05-v7C{vd8G|YZlD9bJs8XZ@TF9*S8*d;+aQod-b{Q z{{9afmN@Nf{hn_;^7Q4GoU~=jg4bVt{#_@Yc%u94eeWR_`0uaJy`M#mUe>eYy-(eD z)koia^UdFW-`aTgjvbGYDu&VW)?cnU>toH$?<5VLamLX{9C5@Fvbx>8=<&xocb&52 z@mR~6c>E*Z9{lXN+RyrriC^&k<^Ou_$tTtArIuLp@5F-m_s5U_+pPOO@`IoM{psCL z&nO=>St9Yt^zo~ejX<9u0cUKGm6}l*6 zIfX9JYo;BDT_>-)c?ZRUw~@!7ZF_$vm1L*V7Sj+`9o=^6yKb<8U8XPJaGtgtc1N(d zKFczJVP$j`q>wv`kSQ*?VpqptB?j2dHten(e&GVkp)YPhXE(qrv82 zj&>b{#8r9TCkjeTR|({z3Hjb<%^Ecg3u?I4urd}F-x4|K3@f&oi4CK|sO4z5E0*8` zizPr788&ia3GafPSOTQ;CcU>XmJnl&c~|HDe#kgXu8t)rhc}GRG zxym*DGNYrTf$OegZox)fz+jY&jf4okuUU8csl!v1{+F)T9#0l`qm=ep?ChH2eE^zxw`L5rG2U0_b@_U*A4DHiKTZr(8gq?h5)i{85#Hx#71c0p|0 zHh%Ll0&&Jbio`Xf8dgXPanPjcste-7s1OJ7lUA>egE*UN;-JaUu?ymhyZhth-_zpF z%^t zDj`!vUG$nEz^+MO%C6xN<}!N{U>Fs;z_x8b8Ab)LeY^Js0Lw-WbS;M%)Y5A<%r5B- z0Ay4Sz3x%rH(>@^BK?pqz!=z^w_FtdN~$AM6R$^+p2@mhAQ=-M62*kfLPsk_$g1c_ z8kk% zGf+sUqE9|@`n5W(p-2rP1EXN8j9+SLmDLEe%JE$W_f!SimL~AuN`9NJUOPQ(OAF~k z)ymnHiA>j{1-;jDrGL9y94KpI!PdiVK;g}fUbq!4WjWlQ2Y;G z*&-mMDs)WEpcv5ct7aeTM5u+}(VGv2wENO1-HF#liQ5#W1-mj)z7vy|LEjQOJO zB>f)NGmXQj&;lCSMb2FdBZv})sF5i+s_b~ZNOe@yu?ces+fYRTy-D;L$C}d5E;dwF ziIT-Fi*v=xi2;u_aLT$3A|z{JvLZn>&SUkH#=xw$Z=}(m_NGo6YoA~f(Nb4GnOh*U zV$}jSadC?fwsDGD)q)o4vRKG!6tQXqtc*z2O`4|0)L=c;!P1cC!ulB+l1NvwGp2a` zSL^y;g*Hs-Mok`o^6UR(vVGp%@cMs#`~2zk|5QBVSpU0O1YGE3kPDW3YDHW|UQ$*A zj6>8B-#_vvIX&&oqZz|WK_ehs;g50~a=|jC5>hcL&(hywf>e5BIG6ji714_5pk&Lk zQ1f2u(?eBD6G9zm+m2;BI&{fzv2jQD-)u|MbnN8mK3yuWWss{>M>E?pbhV)P?FA@@ zQEmh|Jyy-5!#toakhRq;*s8a$c6fxJTLzO66 zKlJ$bz*mVOsY2CAO3s~frh>MO>xwAsLKmg;2CiC7$u*`DReb3C0!g}=aS+B;B1n`j zfgCaU@M2{?NiBG#swg5X>3zen(H$Q@;f|x!X!Ol#Ja&KECAO6Y8I)(B}$J%7VW8WVB0oIxl%BI?b|^LsW6WbYgsolls(C~hY<^q6=ii3e7r;HAhS>2 za0vteg1BzF$Vo#LQH-Rmys5QQ?Qvf|+47k>S z>kv$EzddP(vQIf~+tMys%*iMF=5KR*{in4ByKlQlq?^dKw(h07`<67rhI#gNFu^7i2( zC{m1q=HM1Lu?hM`+_2~n*wBG2_$mRyy@3SaQ$YfVnhID!0I>ZIq0$CoC6xMmdtp@3 zZTL-=ZqjZ0Vl2ozm(bKA>KASO_Tn`Rj==syBZZOUv}+-VuQ&U;2L{%y?q4zhmiG6r z?(YJhvhqwGZO0nXH3SM)-T`Xfp;++cHzef5u5ftg@zR|xjL&kdB@En2k2(na&nA2RcMm_trR`VqXFo8$7(c7#es7*8Dt^{ z8m(DtG~rsUu4Cm>2Etj(auZo(72{A2lcJA2*9wX%J_-_rjzoH5&(e z@a#11SSk>kiOhhC*QX*r$%SnT>#kLzxcKN-aA77?ioB7Qw6Z@ZI*@_KCa@L+L?RTd zcnAwi)F>HsApO?Up~hrqPa4FJ!L7&OE*c0IC>F*G9d>EA5p78{Q>J1yEkkktw|=Oi95bI1Tff%z^w|g3MAfjuKu>Vo?tZ0kmyG zx4>H^k`aS{#R6TkK?SPuFZL7xqNhQV97ifO(@g0RMoU)+(m=G zWK09D1vEWPPanIW0CNV=5YfT}3eVjMxjz(G4gpg)U6esZuFfR{ak8ItFpIp;ViQtG zw`WdRW@!g#5pleAk+l2XwXniYcvK8pNOq1Y(V%X+!Pc7n zZ)wAVZs*+achMbX)#47v2#ZC`l;u}-eJrHFb%+_jBLj#YASUBr!A5}YXApkoJIqL{ zLNSQl=sw;`oXz2tShl#D#ArKT3_0VAvfxAOF(AfN+e`?b zy`k1>#A|W&@&QP-qj%D=>mgS~j+@9q6K3d+1mDn-lBH4YIk;i~U_E0ZEk-KnX__ItE`kmJ)?vHLTn<}@fH5~)J41`oQ8_UQ4W z;I2hI)0W8({V3Q*s)G56dHDo9-S)>LYOq8l+y;)&PZYhiqH0=y9_UZ4`k%2(P3pg* z|EIGfeE)y@-0Aqgsd;M9|4X;nL_-ma*5nQn8fZ+DLzh%jvW`jkMfg!@T9;}QVSbX5 zt4EOI=o$iJ#B4KF(AhzM>bZe@I<0R3@kFsr&w%W45Og_E3`_#Eh=$WIGE&kCtlE=8kHMgIKC zlQL~5Qo(v(OKRBCB?738NL5vXwkb8$(Suw(CRq*`o{fDZRy)B&VIss3MSjZg6s0tm zDkC+nG}pvEQ(*tqYX7s-2=(0mP0nqbTNM8}f8KQd=P7w=u>Za7U&aG`+AK3~3SJ3J zm10A6fS+%PaytjhkSUc;Bt(BOX^De)uHgMFx4|1~Dgl-TUbK2=PgdLPR4CgcCD1Ut z1Ib&!B8rf{mu^J>8GQtqVp);L$l)pYJZnQbFiMJusnIf#0_Zfrb`*41D1Np(D9*+- zZOUVpZytNdZ>CjJP#qqHj^=N`>xS+Y6biv{x|y~nb}veU7(eToVzr1M@+lr4lk6S= zI)2ME3S@Q}MIZ}D$S_8b1C20FG12UDcAUxH&kpivkqJ{-?FV+Py*V@jL4l?hhUXV< z>J-N20@g@6YcvlB#Iu+231Z^-bBv5-=;#6L+!kSF)%KsE+|L{Ag1ktapY{ zp(?dQGfYlE>#z)!!-&Q)$EQ`x)TowWRERzjxJvRlkwQXa(5jUMoKn-{Qqn-zLYCt_ zAh;276HGi?Bsswv!LY{S7D2zU0#f89fn_1kO$}`+SF6zjx^(blMR5~NRF*dH z5U1q;2f2=pMiAjGdQQ=B5Y!4lrN+8el~npiCfTlv6y6m$@G6$gK`8`reqvEu8_XFS zK0}*~I9J;qZw7G#nHe`52gx={LyORm#t{Tp@qyoE1IW1W7jY~|1Xy-9qvUKavk(}~ zA_uXEZ-HYS1MFIa-OI^BsO1P@U^iIEhyn?EruO5ku|>hw!fHvJ^b>LA5o)OgASKg9 z%rLy!@Gu-#z&hP9fUT>;Agw#tWoLhpiyR&l$mLUGjWJLeO+bRi82S2=z|6kzk!Cn= zYQTY}X5~D@v1S-KK>{qcECWF^*wnf#qNg@pi!2=hF62@c+n=kVY2SkpVd#YD!5leM zHPiF680wmTg&i|)g#QWWQ`~=E>5MW+6dh8I5xQB9MvtQMR43F?CT^MIr=)2|L1`w; znC4KS8pxXj3U6yb@Sec#Y|Lx=+#sBK9;|F{0lE?0 z`1xBXvr|U$`+^vI2Z6!tVN@vFjVltQFwUkl({Xqv_C-?o3>hks)*J(%T>*XG*>*A1 z5gmqw#77=cn7+7T0kl9*P*%&rPh&r+fO;YeWfdTs4g{rH$SdSgOL*Lf%czG`UNCad z9SZ2DqG1#yX$hf=kGLC{XjDj2F-AH0xY%PGsm!;-hcKIcm>tj^3?RQ_GBzK)iqn7b zwBt>TjUHrO3qd?CCeKD8o1xdfDhQ|I_dbZCqG7JZr1Hr&pzz^)g*guh&RWh)l<+*7 zcXb0R8RRZUg_9gBN3^wuzTiEK2Wpdtg`Zg;XX+k>lC^amba6EiW{w&|~6J!Trj768; z7Li3-*jN!M7Y2O;dwu*Eygm*z3$YwmT)ladIs3lejEmv1Udtc1=TX2V=qVkh@<&&q ztaOxh45T{eB2$&`7Ldm+oihv_o#Ju#_y(fJm#9dZmCV4NIgv z2TyA$+!6~Bf53ITku(|BC~`m(nIpOlI}1UwxtaaBDxX7+u7YGUXv*7maj7w$M`dHY zl-$ztSk?6+9bBpc%AhU%Y@@#0FjnX;^-jgtuU{wO0>nQN2V=x&!>$A7Rol3~@}g@m zjtRd+K;UpTpH3SnQuLygPSL;#qE_W|Mc|cbGCG()uw=AlhAkbQKFZB(2y6$9=vE#V zTMJM&J8?CuMpm-YT5+E()M_-`D;Xp8rfH zJHz+Cw9lVAz5h2QPwn|%~UfFN@cf5sID%q#XmKn&2$?mP^3BJ zRu*%(T!tNbTpwQ_m-8&hc15MS%#ewOtmJ5>CzJi}sa5~`xgM&Y0V?SKw$8S2{6|Me za^AH5pNgj@{cmc>@w|!5S?jrG1&@>qq>M-u0)m-BBBlc7l&Cf?vbc+o1~1yb8}S_^ zzUFgnLwu2w%0%5BCRb@vMm!hFr(n)#j;_5Qr4KwX;&{}Gatc8xa#uII^Eyv~ey0QkgZ(rEhG@MT%)io$`gyTU9+pYE< zSDuA|uhl`q0-La966LrszKy!P6;gs7`rp2NdmM~`6vU`=E=bTMcVQ>Z;=FEX0GT6T z1UhW{jD?p#7I$Bfav>}*vI$b;3JGr`xH2t5O-XK0`h|u-*@jNN9+>=~IiZQY%Lgpg zpl-q*h|x(!RjIcz5zdVj?n9m=O19>w!zxvx2{4DH0-7TXV*01=yDZsCiMR~cpL)}d zl@pUCqhLkKmEE}ULM7N=HOW*_!@k#wjD~MxNfcD#e%uY0J-+1>mnzfw#$BD-L~mFQ zZ7+DmI5oYVisE&ob`lXAH8u;ochHEASR_6&UESf~5LOz@J_gU`eoCO5K-^T^Sbj&w zPXV4sU?FG{8%aJeK@O2VEELtE+;N^mc7)K+-+N?LXp5kXZ=?1*_%|Ro`!Du;o z*|iYxKY6Jjm&rxLL>}LUsS>&I)EwBdl-MB@Dy9_got5?AbD;zKhvhl_><>?^_Wvk! zOx?`Xv;?T=|7|O}|2vtSzW;klo*L}`b&T`?rmVcnFMM$f*}KQsUhqk}seyRHS-)O8u5k=! zVf(z!t~g6Kx~{u_Rqv{0U7+6|JZGJbHO)n^;fnmrT(H+ZV$0lfScIg`^IBt-G#U&Ip zfRE;BN$_40q?d$LGA8*hrl*kqB~Oj|Uy5&O-Kav0p{Y5r!emfE|Icenc82u-ym`~- z|EA`tLI3keAOv~@-TlmX{*^({Vb>HEUGY^-td!4DUW28aLn8637tAGs_=78k>Ow$* zr%QM_7WUx}R-{;W5Rd&3G4LMLp8EqQIJB%^5oHz?nXY(&>3&b*&>X~mUCSY8RlpLq z>g!_TEjdS4i(F|98anzCv7+%?;7t}Cs|vKoLjbF4h?NbsprzJe%Say zbf~2&x&kY#|K@kLhx0$qYj2-k|4qp=p7q~KLiZ($>%RIE{IuV!{lq{^uKeif=ZUTQ zL?4s0=8HgSO)EZ8pEn2dZg$*@zEE4yOFrnRS=~jdn|C5N)xrQt#ltP--E8TlW2hZ6 z(UJ-!mW}-Qtu&{fJJrG`^nqPW%l zbV(ehQpsg;pkV2xG3Sv4A#t5o#{md}qoF{`j53~sxJ3*XwL%UCM#?v=1z>0{4sfrx z6GC9R7|C^YLxkh)<>9jngkpEsx!8dD^>+esrrLj;K=Noydx99)6Z8ei zT}_fhs2IJqIfQuqx;TV_ZIy5cm3QL=n<(MNspwP+4XU(LX@7GFErBjfK^(5H@z+!3 zP#QquoJX-MiG8csQg`0XF7GPjc@{G&>R~Y!@iuybL0yjzQd$%7Q-`B5*C@tUybg2~kZ9?unRMjvq0tlmZFX~X?Hj%&QnMEpOth24yUDmsBG#D66_ zi~K*GZPVxfrsf%s|EG`9eKMRt5=-qjo**Bl((WL?%*1>`QeTtf7>Y)4P2M4?i3z5G ziD)U(MdYn6z4G$%t8%ME+l#l@cXU+fLs~19i7txnEz+@~1Sgw)=uIgu7Kz!?%lzWv zrPs9)vQeiLGsRE@-76eJ5+Q5iLYay_^@4tch%UnPD1+=;9SUWcvnmQqu6v>U$o3~k z!}!c+4XL_@ygTj?0gTLu{IVbpXSq4AnA!3eDdL8sKu+#qR7hCqg!oo&UMqQNKFuu7 z@BJ6hvKx4HlS3`0u#gfjIjNK%LC~BIEn-UCsT5gC>PKQv#wqlM{ED@Bif-B25TyD( z^EFkTL2L6wRBlh2=oq3(Uh`W6gN8e)955TbQWlBKo5D1eV2So2H3x@NW<6c9k6Ih9 zv#UxPVvQU#KBrZgh9>B_l8Lo{yRU?^qsSzzkpv~o%1LyF)OUGM^@t`#d-z4ycpIXX zH3+qpi$${x-vU|2>>`sfc&AfTrQ(uiN!Bi!g`#_$1Wh6vtK(B8L38&2=Hkfl)K9y~ zh^|r7ga zj<&X<_`m7w<2vVa&QS3U7#_kiZa6L#Mxa)rG3~gu`rziX!3*K z=#@yJam1s7D4HwQDz1PwM-EN621~iyOWM`d#DRsK#nDk<#X*9aj%DX#O{nr*h?S8f z7p)pS0VvmC)SY*;wbPTcaAg?t81>Zz=6>PLmu@cfF*K1#!T`2Qdr-Zx6Zl2f-0lmy z?4=)db(8ivcwYht{{y2di`{uKNDI1%QIa$FF=L$|J=@w@cO?q+0iz= z{-26xJj;K+942MxLO+Fy*ZRzMr{$?&_gH4St&J#`rm)H9UHVI3#Y?UAyk+_K(Lh%*IAu<44n(W0Wqn#XsS$?gxYY9t)LTzSv zQ@SZxC`tk5jKFC}f3a7>pW>SpCH*PU{bGv5U5a=xsz zR~}QzvBbky6jT(+Tp=Ns^{rv)=d{pFtiO!861x*#B+w z+Qaw%w#}Q@K5hR`#nS-#pi49rCcMpPOr{+Zr1H9<5iM>*br@z4R$>icFsoyL^R{g{ zE(SP@41>nJfE;wytZrsnfP)O^>LYyG^xs2Mi!}ffWmuGS6LU@QXjJgAW(BM^jRLSt zT9beTY~%n#H<1!kmJDnhAd_6I0rXI&1Z#T+fTlY*ret)tmHx}Xk146GPAmOayvSx+ z$v@&xJYu%`4W*zuoVV%P2gl|pc+`%~QBrU?Hb-%Dc5Kd>u?DafI=Yp|pm)hq98+w^ z+Jsa$rsx`it*o45ZHg%)ShY0NdH{JPs*?ZyrQJ(bE>&{c`1&X>|DDP9j=4ekPtKp; zHZA{C@-%?Ox@*FmE~H_Fo^puQ(nB~P7V8G5pNx!L@b!kKtn1pitF@I(3<}P+YL<#y zUCY*0+-k6*8#xa(kTT8G|DAEHyiHUJ<11iT8C?Y_Wn2>8J3xB&7tu~WTL6fS7%Yel~!$=I-NYF&V=;PuQ(XvcEMg~WO$ zATxj?mQ3UWR?>OHV6l*NM_bg&6_{xR;wK}+u)sRYF|;@XqM-rwnyzDMdAbb|i%})b z3=!M0Msy8f00qv4FOQ7NMh*s}SzXNn6`I5ZqV9is&|w4_mJLia%IN{}#IR=EP(=S` zF-d?NG+_ogN-VZGK+Zr1RO6q%JfA|)wz1#ZFn>eI!B|E^wqX@=#5g3zDr=tpX{7<> z%pTUhZUWWFV;4DCVbc`-%FvL77^Db~xd@Xr2HmW&NfW0FFbOn{iClz1pNC7(pEq4S zhk_v5j-@HO)!Gc27BBDXZ&tt(3MC+aiCrL=cdZ;<&D zj>s|zYmz_7cnenE0nqls#JC*vIf(iauAK;59<_{xuqGUpK*|DswpqANp9Pp1*J+A&gn zP#ZvZI<1?!s}n%S2vlSm*EM7k3?K){&lp&Ou3RV9PNJb8tCR$VA*Bc_lLrbFs2*s;lx|chQW3&3E*Y!-iIT?30yl9{ zsz(PhwN(kv3Q_cYP9F*nms6i;NEbRp+e_+LY%e#l2~#z6q9eumBRvg7xPjCI&@pvF zVB|I{gin+qHm?EB7@#Das$-d(td!!LAVX1bLfdvM+tH~@*DFe=9MQr!=w1Vy{zM)I zwOTl(7A6r+>_Qi%^9Dv?K&ypQZejA^)J=LwX99E=E!2k0TH$n3P>lex1~~f{clQ7X zVJq*bs1|T*lp`$~%&Ot+>0dGqWY!9&Z5g^+hyt}*ILSV?Xz-c0P)N+RV ziovZGPToRoFxCtwwDkexjOZ#FuU_iz>lH0bBHgn#oFIRmY&rT?%XFau`Ya7}=Uoe{ z(5PfS)T%$ZbC9e?g1`zmF^lWb*;Wu;5YnZ~h(8y0C>_VuhRf1$QWI*a<5*5j#?z!* zP4#+eUJF&%Y7O?=q#JJadL{=@SricEGbL|l9H=4x=mp!3B)YHH1*5uQ0A%7kJzx@f zekP-jAd~swM-hF)nxtL>=G0I?ZyF5w8=#EEhlDA~HWqc>o11m4Q21k*RVijQf!} zSEn>#|3zAoWL`mxb<%mm0JJ1^XBJa{^A0W2Z&_~KTl9$ND>sW+Umz|{hc^zj0E`eg zy;oG*(9}T7IF{u$dlA&wb@DV1q5>iYVCM~k9k9Sdkpoy_sl&)&JP7(xM#rvG0Q^kG zDwsnUG-=3okP2O-b&&}Q1iNsMsUfG&?+EB7b`jK?Lqqq3rR3<7Ev3J;H~Y8=W;q#( z8h8;@;~&1r6yu+K!=B$5*ME>v8iK7&YV&sNiz$2Rv`yWf+FUdHVsbxV3=01V2qa%v zr=U8FOl>HF1YjAD-2zYuCTDrTYXM{u!DJgxWZJiw79Pr3AIT2HZ50ILmMN^1E%O!Ys#=Pt?g~e<6GP2w6UjufvsF^-1=EFFyln*)VGxB>vA*boZg#L>qakU4eU5IrSR9Mt3k;hV6ftdH z`~uSIAWIQTj{W>8hg44J9s^=bX7-^{NYz6H>x$g}B}i3~%|%4-{z_p zXH?<|7DB=lcLeMN%|tzzQY5x_$dgcONT>r+V)Y1e99;`GRf#8pK`cQpWsifH!6Wv< zNU;LgoQDP>oCct6Q`pM7QLBT1{%b=O1@;@d4Z|Ac=S5kNuUC%e$h6p?HB^RCYQupH ziiCqwV+T;9)*hQ=u?r1@s^HmJg0(sbC~1rKE?F(wm2Kql_-x5?lF3(}5 zx@vsNE0zf=lml>mRpTQ|13M)k>qTk#71oFRNI`kp2ve#k?|FnZ6;ArWl^>bE2J&fo zI6Iyzct2%d2z7=n4bbC$^m)d%)Y`0i8vh|DQ9Yl-bK1xwM6xc=-2_PV_9W+AY^SvW+0<{8ttiA#&qAxlU z>p*(MJnUKy%%J+kVD6hqw|F!SKY@MWdtARzwP~#ApHOXp(bL|>euk0xKr9 zIifq3nPaDc9i5&=pawb%iGa*xs4*Ojv20WVfm$Z{;$egiAbaj|x^#Eg84~QB2oW|3 zONdZ2FH|sG#OU~2+DSsZ3~sT8hY>pZ&P-I-*9B?E%6ZPAAz-C8A=Tvs(Ot}v=|eYL z(=dhu*;v?LwHRNK!&r_AWDqNKEFT%bAgw#tm4-kdrl*h~&nTerp;`_v%h!X{Sf*yU z0ZhwGh|=;fijC@FR7eH~M@{Ld;c>0C)=y+Gju8KSAFj3^&+SwFjN|CTzPB9qb^rU( zBP*5)`9?6RsdT`A^7^6Cun*{p?c{gQRPm;WNTp6@k*3NiJy75wPN z7U}3A3r5WNF%em7R7{)FRH}dhvY1&b=gHd8)F5)l&~Y|{3iJymZ5oQApD0o~(;4V> zfy3t(2yhk>1D3^B(hHJl$fcJRs22LwCso)`b*S1epGx!#<%`06>yw`OmD#COge|4e zO47=b#i3;N<0oseb;jXL_)=FUZ|jgRJ6wo4sYhVgk7yTl zd+bonw3F@+t_uN+X(wHHxo-(5-CZ*!RIEV1(1j4=ls)PCj|tJQm~JeY`@SWaluCMP zWUdOjsSsmmY7Pw0u2#DBh*s*PH;d`#!MTrV=)o~nbgVSzS!TwXxXnUZS+ckek_XBW zkpsK0r#=S7)J}fX6|)XHrfy~``(di^xlG6{Qqhr6#iD&e>w1~1M>$p$$1)7v%nZT| znfW=g08CkVm*)uLC4dVvRLOhid4_5~-xF(S00TBsb!Y&cVi2oYl!I70Nk*FTb1^ym zOiNb`0JmVHF4CZGW?}$nKDoNYK^Re7%C*YQCFvL#7Ci$L0|0G-Iom*8K%=!3-HOGe zv{Dti>i0@gM)prm$u0BrQ>|u3H@C!MF3ePFmbK%;jND98Np>p9goaW&G!x0Tgwxp( zi`jX@U`MelHA<14E&#}y@AE2pS3ppQ_UvwB6c+Gopr?H}2+n5HLqhKC7Iv8fMlLPh zn_gwPeGbCNbZ0Yoc%YaM5Of?^hykFxh$ZJO52?s4YZL$$K%1-)V5NQV#UZUG{{rm5 zc_t+m(@-iep*zKH$|yn&8;dx-Ow|?DZiYTg0|*Isqb;rjfo`TPC&x}outaBACK9_t zgYb5@$-?|h74gPWs4Ldsv8Bv$4S`H%L4Ii<_%A{I1|X3i$drgR05)_E5zi;q0Hpn5 zU$Xf9C>8M}E)`+rfwbGK$Veb~jK%n#INk29#GA{q7G`;feE?ms)-v)r6x=v(0ljI# zd+|iP1<2j3qAA$oah}#n(=mY)1Fb+1sU+f7S? zoTd5qaF&ES&{02v+B!#f(P~NntZ%K@*?_(k)zHI&WqK@TLpNKg-9DcDI^`2m3$*0r z%`3;wf^`_t8v^8Dcx?a@VnYaM02Bih=mxseBz5cYY%mJUXIq+aufizh%*w9656(IQne9ii@*2s8nQOI6)=nnJkB>F7@K_5%~C)x_}S)LS!A;mgC3|2 zKnAt}0MDufFaa!2G}StO5}hU*2N;=Hr#W7!EK&P2S3JMc*e9 ziRiS994q6`$q4vS3N}MQ+pfMUBjIWrZq6ewx1&#uZQG=H3U2t1fmG*QWUAt3dYT|y z9<*i~{)iPt;n}y5InosqmZZp&+1EWVux@q#l9+E~j);xlu9$3lGE~xg*wVo-WzZ!@ z+IsoZOGSB>ysog3Csdc8VN@vFIiY&=OUKd(WPjDlQ&Uxq+4$cIR^FdlCS zVRKcbs03Q^xknh2$>FP(Zn=E)t}Vq1<2q-GX2HVx-fNOcWbSzKk2 z@Xw`)gFQYsfP@7$Vap`oEsSqdh|W_aKHMHB3Jzk_ITs|f=2#R8lH)=_Qbs|tJ}5{| z0t%906o{O@Yed2q9*k*$q|&Ce#bT$gHo+=u1m#l50m+UQ(B9VG*1~frwTlC|U=-3b zqdB@jO6#VMvqvR*H(8FH zr->bhMGP*=?Eut1I$F{sf8Gd@%G=gs4Ax&u- zOFhem+QDon+6s|GZuHWy9J>^XHfPQ{8uQ2jA4LuV zI!~;O_+=(2y#Cl;vhwrFJ^J z4uN~AAwpS}g_;gO*k*fin=COfuuP-Stbo%`Mh+^U!CPeRCM*DLoezoylQq+IuL@1V zQyR!w6ifbUmpOt6c8BD2Wh`nhmH=xA7MLBxvkMOu!8FpL1i(te&8-c*bbM9i|YT{SAOx12?$rchZHq$eGPpyx*z zBZ!pSTy9!udo29cob7@%QC!e003G8z!qs=lY;-O~oKLZeOz7yAm(tYB2LN%fwq_wr zx)%ydNFy{0gpNKK{wP?Sd{EZpp)r{uVB>Od2a&;N5(lM`Bh=LCRywUyrz0(LVhpYYMmh+ytidRqH-Mp= z!Za zHH$3KIM>&9QQJH?GpXq1%Iq;tU9{>RV|Jwo!{s8tA0L-cj AJOBUy diff --git a/rds/base/charts/all/charts/redis-16.13.2.tgz b/rds/base/charts/all/charts/redis-16.13.2.tgz index 72521966cca3df9b201b87147670647d98c053b2..a6ac9c37b2075bdd3a5094f6dd2aa1b90462fb38 100644 GIT binary patch delta 100691 zcmV)EK)}DxwFRf629P{|{de2A(I}4hXa5y=l=O++YwE>`ldanHUajrj_-yR>YdgE& zo_0?HlaPd(B3J^nt!DGTe-7SA00b%O#oi>f?sK~_2+Rxy17I+i8DuEJw0AIt8SBpB zEdIki{QCWV|K*Dp;=lcV-~I34#bEyrgBSbzFJ2Ay_xA^X=nwXPo)2F90rc;K826V` z2D3l(*T&^`?koAhBq0nkOcFZW0w9D8O-ME$f)-7?f6+~o$<{TR z-;yj611Vt#yn}*QTY=z%kct_^qO&LyRpsb@FA;A6kY{m=9&H5x%^;44AVg7y!~Yi{ z%Hhsn#&FUdXNBBYAGTzfBu@^lAff@EmY|4)*C-2Q(^86Fb_dV9dt1NvWc(d|=K3F# z@cKS*ELi{h&-Z_xyX*hnt5=Wf|3m!T#e4Z>+E|MRFT4G%2u~1YLqMl+Z~x`+1&rWx zboJ-`y%(=ug?mvyMA6lESNq?EFQVwh^Zmj8tCxel7h(T9w0E`t=T}!(-$k$Bcl+?W zy+PE!dcHM53CbWt(GYa@`g_lV{$9|3bvft{_xr>Cpu1N0a)0kd|HaF}|LG5g{eI`a zaTc%slk;CJ@ASSDz{dH%*WZ7&x986P{g;Es`Tr2VCr`ltqbTI66ZkPES1<-C%-{?$ zl+mpxPjum-*f;^6!3lC|oRe7tK7T=;Whh|)-as6~tGK99L+ntNoTCY*ESvAjKhN?w zzCdAy7?r9SBN?2agBViYy)BOE{|O)peAj~FWl*L**0eQI+Rb%CK*eXV98;l!CIDs` z^guM})zB`?vN6fP8DFF+B@h(3>nH|uJ+I7y5Ub~EdfGks>isVI1>`9FsYU0J-`X3Yp-d*=h(reXal;m8Vc({<|$`qm2V! z&ZEWfWjzkD(!!-U&iM)KknkgrDFEsNh~yW|QLFw?*W$`Hj192pj(=tFQ1lRt_)G_6 zEDLpaIhm3L;1;u~SQ0ZN7GI9X03c=phkcZYWii5Vk`T&p2xcTg04Jic1U5s7=yzG^ zghWV9Lq(kZt&0TMs1E!#AFMPZS4iywSG*3DZTJ$)k@JD$|JD_hXhta6(Gy&u8G2i0F4n!n{dKxLcxgt&nnn>YmEvgW1L_% zx7QZ}BmJ$?jKN8@J}=zHvsuoBkZ~FT%s3oAQe0Vxb}Eq4Jb#YQNQ^@d0sI?C#Yb;D zy(9Y@%4LC8T1Mz9pXiw&>&qfO75G4jvZ2_8^e(7|0u$$iWgB&b1xy*)f(TtEH6?N;_)27awn8sm!A*O80N8DHlB^*TR5lB03I9M#S}b?Aw!fs+XX152vEdC z_2cm=VP_elD1TwkBsfc+u8UQ#i%BmcA?@W9Wx*uJ5$XvHwD%;OLy!+X3ZvU5S2;Ty6bL6J+WXpiWAJjDP~AoP7N~5@-7&~F}X#N)b8mJe54E}5sXQK zJ_3?~j~Pm190~*-&5Ex%MY6HzEXH%3g_0j34HTZ2iOA%vSrr8t)(h?kKwK5<{ zFvb~WL4TGDK5*sO-b;nL?ChY0UJWf`D;pupa#RJzXAVwKyZ{;?3D8yfsz5Y&U04Ud zfaf_0RM#2^GMGeU1_u2goWcx-Tq%NaI)zC-Lm3X0ft)W!31NKEDTLkB&Z|tj!;~{# zP6u$QCNp0XU;^}4eRL8!k}35Wig-t1ESDj0`hV{7Xb66pq6A>}jB+}5#R`#T=mwL# zaWe7%md~(W3=cAO|;EW_( z6@LOZFvDD6H7PD^YaKI>3kTN9^$#gdzv>g5y{<`S!YC3u03%|AC4du{R@MM{1jeMt zNQy(f?w2PG3-u8E7I5PA#2dZ)p%zf8Pv9YX0@D;Fe65J*0cRE02SpJt0du)efsY2#r2$K+*2dHgy zm!b@FF@*6h$k4xYoFU5P1WV<^CTOQTCFBVkf`OkDvkM1Jyi%k|mQ~e|8YwJjuzzIG znWl;ub>LDbBC5`ml|@m1=B!cjMiLKs1sr`|3&|{v5kv93JlkE(L5BE#nM?qJ;Z$q~ z2|%-y&DEmsQ@Y&VQWWMHX7eW!FyCs)IFPC!4g*bdq4U^1)u*Z--oC$hbNIda*XZqA z|G3FhV_`OlyQdt#1Ao?SaJs|=s}DV z1jeGGcZRqsbO~5%&;jTK!3^Hb(2QjBK%Vcw4T&McF$x%qJ7!I;Ck9tAynl|#B%t^| z2n_mrFJ@Praz89EGq?%U@e1zo$NaX4 znN47Eg1HKMh+@c3(uA*X$FdAWypSu;qLj1LY`PFM*A_^mfu4!KR)2@a@C=chX>gbF z&(-0LA&&D5T~0GZrzDQR53&HTqGV~9G!H{WX$kW}7A%4(u3*YCDeDzeE&!gv8iKvP zyrnU@Jp}ur&}N!0b;*>v82~OzWc^B)wN!iM()zfhVA_C}lT54aV&Ds9b4hqDq;pA# zE#-4bs4XS53Uv$Eg@2BWDl5pBBBI55>y=Ua>ykq1fL=~Y?Zz#@FO<`zA-0gzrD3*| z)urLKlvWR1aZ6y9-kZD*HX*O_jB;V_=?C)IV(s(7Q>1hwkk@4L97K|$<5ghdI<^+= zTWiTycA4JU8(@jNI=?d{y~nFApaKRu$<2>fXZ>xoKr`;HbBneTH=O@fuz?st%1n-jFZWGQM&OFdm^y~ ziYQzfUVm&dq+mXI0(8NpBwns3FacME55&1iFqge|$svjn)77Q^G*8jct||rHEU8l) zgvpgpnix_lq^E9$uGB0|vCfCO@tqRNMlpsI(Hbm(SCO$>`mE4qY$(cZaENG-AjZcD zCzBqGq5vf{MrNv-m~>q%@qWAidx8vWGPIUYU`#YS|WNw(|U=v&sNFhge<;Rk_J?J)x` zcqxE@;$#vdkjn3+OAWX}>=vO!xWSRJa`ZF3;nrUWYqx1mTcAh^3X;lo(AOiMZ=o@I zV}I$GC%lswR{{Z4MIaSrU2v=}-|-lH)R#M|&PR3C?sIM-VE;;CGN$10j zZm_sf?LkWMBoRE}$NkU=jr|VYnzUWy0!f-8v$KhhZOMOt{}3cPgD8 z0#2oJ!ypj?PWKcG?t^yzzZD{Rp+lkG*njLHtX7oUz37BPz1ZM3H;T@_DMYLth1X~< z2^4Fv_L7-F7EW7{XCl8Yd|TS#mK`$DtCCeH(2)<~--=cGPXGdd_D}%-GpH8rnO)F4 zuDM*+gQz>wu-yPDU4?6Mdr`H#5UN7DU|K2HrH^%s?Z;i~TV?uv+!Z#CkF~@0v48MX z(C$&Url(hNb*>uK?SmZf1&UF~NM?vY(+<8gOAX_TnA%j}<6Jc-x2B?wQbuBwDfQyg z`1k#fJ>P(t80V6Pf^>tdI(cOzB{7-IFVYOb=zt_#jmHV2K$ZZrsJ1(+_oh5waIWzG z2{cIo6%=qaLsOv4VPynUE%~OCFMqtdxJI{yR>LS15$B{%t8)!{Wju#!bqSUtoWq+XzGDK38 zNFFIvHH$)w$0(eKF?vJDbt_}(Hr)~4Dmf!Fe)6@Q+OE);Wa2ms$I2p*vC^JrqpKrI zcsIx}MCx<)m);LCrcAgdmR>_Qs!e@2QW9;Keo-c(MmHE)N4T=CLXm3Nj=LV>WcxY_ zDUMJme2t>W#I4HB1D0}cZGYs8;bf#CR|IoT@=QfFB--2{L{tW|7~h>wXGUO$j5#SQ zq}ugG{avEtUu-=5XZg$w!C>$Ci{dP&39n%p-_j3Cwm6LAUzg_Es=EnCR-RI6B`Cxu zwe)Ih9*FvJSTqc!W8yP9eYOjp1tI@m6ix}~Oi>&Ya7(f{>OA{Zb4}YJvEccc;e%{A z>@KVG6t2uHP!qhgRg@TNPBTW0N>GJCUj4PWa;&TbNP~kI;u$ry?y5n%k(?Qda6SWP z8MzUWfj|}TW#Xgoi9N)VMiN+mA?QVr!4|B`ug-K2XnqypOla71ZMssO;paTzWxh%m zZ~`K9W4eV}^ePfs4z(H9UzJ$(8H6Hrfr55C1`!(L1Vy`6XuPx*|J5w|o6$yD!8<|6 z*R0do1-DZiPPOwj1<^c#GaQ1Hi#x?6!O6scmnVt}ux(s=?{G~*p-S?9INk*bsh|_P zusTKWf^bTR5D4?`yg(}Mrb^~kQvodCFch8-Ct_i!GFW~U0e99Q8m;6q#TW2%1fyRv z%+R|eY_VF1dFmNc{2$~_&>{HlN8F+>rtR5qy_Sv%(6L5ycAouwV0EivCSKGBeNZ;g z#YK_;VJq?A(wm`FN%Sdyx3qwWcFNLTmWq&>A(+hrn5Gto>~r!0lKDb$A)P0b$Hv*u z2P)m0C^kWtmD>R?0%7=8B5pNd>CVjY$T_4VR&}6i5xJ_g?JJTek-fMS0W0;}ptViO z{mUe$JXLw_`Q*vQ-PA>>p!ia=8LO|g*M|x$D=*y)YoI#*9iKHo!%hu%>;}q7X4(AG z((T%Hyl%k76$I1$TiAbu=XYJO!uqF6eX4xIxgu<7MqkwEi#1SDqHkRO`n=!o_k-tq zlUo#-1cUD09+UVKi+^U&@5=w{_x4`YG1h9maQ-f*mDTcnX+2Hjr-*Vzxwsm-kbm2E zMaGh#+U<%Aw^s;sPDz3~e2wTFh&A^3tYhf;WueI8Mp2kEe8bNqyts5wE%O5LGndTs z#+OOT75+04ZFZ*I;Ed%k4sc4vJ%wI`(u~|;TbFnEGX$s7F_QuoAAf$op+C*$VurFA zPJ}4^n86U8Sswex2}2Vhf}%U3Cq@e};Z2mIdC^swXxR1j*aDyt7w<-G#JI}!L7QX7 zRV_PcTorcJe-G+|#|tDy(0J)ZT(%v8=U(_rgn}1{?jsmn)3a7IxR1hbG9J7fy@v}3 z*Ek;_B3z@|L`b-niGR`)u|6nVC@uq za34LJ3J+gQP)&fiL6lIxPt--Cx_uDN>-sFL_C1dJiV#Lw2GdkpMi&AU4!K7TBvHsu zWg42u4%7ymuoj$I#*6CN-N0gS!~jzp&dZw=2aHtQ*p-p()sr6=F$;k=B2<;G8^XM| z=aX9(%?Kwr!F+_f;CPcT7*Kz~-hO{plt`NiFMN4|)oIGgjnKB?SCT`aFpMpgM4=G# z7HJe3Fx2ExFrhzYQm8W^tTJ4!lPN63R+~+s6|Vcur%;?Wm(5RLiS;t0eoq++bVnAX zC@9Eom875s=wp@w-)%udngVAHTq99|u|l4}1Wpj&7nOI5uS_@;@-lxwL&&=UNU8$O z02zZn{_$jVeEQ+w-Rb4%`1I)f!|CYc=#PI~CB(kP!185oR!}G}8;s%g&|lmCnoJEA zqrdE24aP{eNY=2za0l#zVhT0|fy3;n5!^1@P>i19PP~OKb%I2WC z^C0OQEbpuh=W{TZgti$SJoMZ{N{6a#Z>gjX#c6GwtPVczeA9UyG}qQm?BHeGV`_)S z)DCBpK^pe~l#@9dCjr5eVH+TS1cNph8O$b#9h|-A=i3k^3{FIlHZNgBECGDsmNuUn ztObmQeX5G{M0lP%XjS2Im`{`sd#6*IfaC%t3@0dVPC!CcEjt5=F16yteXwnme4eN) zspFHgcjuR*)61c>28zW~r|aNDs)D#>c!0fAh|mcMMyk}MXPAMk)ap}zX@j{UN=uVr z;~a89r%>>U`ww?gJb41X$1H&}?Cqp5?tvSAoK^GJUgM|vRW~BxwRqER*2{WV5}3>p z5@=@j7@RnoG=B?V#p9>&vpTdY2lsy?09@inDA&x*t51ujB$T|B5mK|d>e57@&m5N z9&TI-nHV)f&+R8n02B#I$hhpc8skDS)?=ta}!NSgv1mgw}~IL9&`=N z1e&63OtP7Ts+|rCG0|Q25;p`d`+adXbPx=|;5+%jLk#~jj!}FuPeN)W&MWkPOd%P{ zIKXE{G10Nqk9lK0COMTego~-xSA`1_tdMWvEL`tg%9hBuR}634jC+Pc(IV%bLDIve zkt^4&`_Cg+O2Y;c$z3?SZAv6po}D(8Y0W1J50Yuk+m#KaTJv;jajG>hL7U38wwR)t zTx%v(n@P4-2XWPGYjyCxfOKnr=GtiHThrz3Qm*;O&X;nnFnEByZ$0f=!P*t`uKCuT zM$j8dyygeKdge7hymeBq`5~^Gd(98^TTi}L^m^s&Yi;E8e$ubifL|m3S`Eat60p_4 zTss3>4cu=%1zXYWHFB`E5!w4n!d8c1oh)p1FxN}NRtI(cJZyE4zx_miY^A>Sz?s+_ z#1EQ^&B6U(x!8W!$0y4Z@G2n+)LNkygeZXRqdP9U{4@*Woz^$dUJ@T2%Qxy+?&a|V zd6xUfcNy36LBD_EI+y!|QpRWXi{x2aX7;kl+mostm~TAwd;H^)W#eY+rm# zP-Exnf`S%w^D!uBv9PWj73A`Mg%kK=SkUIef)+9LYm5sj`gCuBL5bAJR(>Y-9h;)e zOj+~fiKuWY2VAF0v*U)=6(RM{BJXpLV^xJ}x3t)3eRA!8#$w-AS*%aZilxD!DcZt| zLb&-B&Mk++wN&|2>PaV4Wb(lXNs=Jb+3}aD(CdVeRbbi$B#GxT|6s9Qha}^()P^T! z@RTc&iXd$ORWrE^9 z8X?NGL~=TRc1j;nlU;=!pmzMYE^?eqGTyII6sZ#|RwY@kyw5mpYe2p3W(ttuZsyCc zmD;JZL@DofrCM}hSV4^>Tr!)XWev5y${HDo(U1d97}9Y=OTa$5<60)Q(&gC*L{?Xh z#rGMgl`N%O?#A`!xbVj1eCB_oSM838v{c4x4K`OpJ zdBSmPYvy38u67tY)|ReHJ7iEqXl2U9HG8gkcvxlX72+qy-umm)KpD$1_h8WT-`F5o&t zaXBMM;fsNY=MXyENEwkT%%#?MH(uBLR?l$gVp+)Yidx~I;T?K`|1;&LeYDYQzWck$_>D+5HO-` z2fP+cv8Yil4^3TNJiyD}tJ`P_DxAZ;txWSx=Md8@7gsId`#hSU>Ktgv<19~1YmCYB z=t?gB(Ur5@M^{a==8Qxob&9wZRx6HwWrmYcv812i1SCa#k~pdeQ?LkTrA%2C$}K=% zv2iBrXB;$A6RaD4B+$aU_r_jw0`I(tm1)G>b{cS6FvW~}@&sJIy{Il;tkConO)RGF zUc?(J{i4O$kpqA^n@TGU1?SdDk*c{nMG50#fQ-qYn|Nej0VO{cYmcIh7nTcuQiw8! z#{w=jXIas#j$j>|qC!*Lb+ZUvkrC=@NaPwJJ0A<3DX0wzRuzmu zU6ss!L-E0y03i>TBGJ(sLKzr=TR1nLC+4H69tp)a*6K7R)X3(q@?Hyrv9Zb@oc1n8 zr_#2eLoc_~)q06`2s$x;31Q4ZcKmDU9n0V-o9Ihpm`!r|5VLdZrA2#Jd_Z?_md0pU zoJ_l>5st$v4w2y$h1bC~n$sbe@loBK&Bg7(PiSr#mP9M}Cd8t16OqWq6utKt;Jql|OY(5104+-ekrq^NbkNOs` z!%9`8IB{?cG|ZrQyOA#>9Zv;$@6`G8U~f>34=8%Gv`?&NVVz5C1@dw(u`YOVcec*(4^IP4g>Zun9?q23%AhfW<&72PuroDP>MuyQ>48D)lEd%ds$Ot0!$(suLY!imop?( zuUI%ZYU}EMxh$0DQF$;<(^%Rg#6h0wASf*yR#c-2bMZ{ql*nR*dPQe9LAjN3A)Z8e~UJ9`%{?@$B;=4K}O;cOdj4&0M z7G*?AIjOBx(?M>;PO5O)qS<*K>ztD+E_~HB^od-5={3m$8ZNybw@hW3W35~J>{{;H z2la+xR|Dtz=y|^@phH}%70{t{%@xq0poN?j8S1T;E###IddsiH*q60$PQ@-2P-gEec4KsxWb&0sbkTF$r$Wn8ZUpFRQJfu|B( zwKhDP1Fo?DC%se^zx1(fd=~{e<(< zNu_JHdqm~4>z(BALF$)o_j^{?&wh4)`}(oc*^h1fC@!Wbj+ghGQ2z}mZ|-rNsP@@$ zq441MJ5SU@D%>diu)Gcwby_0;gRHYT<3hgTfkW!+~O8 zy(cnw^q#l}?}=k;Wq3v(^ro&Vd&}L~*~?mM(5Fm1unK(Ez^$yvT+={8HEw>^$*qFpo=@TDB zNCv$M|9q7Fuh{u^wcC$Mu0I4HaRh?=<52wfNAMd6a|VK_13DlW?|sx5Bvrzcr^uDJ zG1`0QU5b*6DIRO%BiEE@7|OeU8l99c7yXVX*yi)Cuir8ekxP0DSm@ATxG%`4UCyY0 z&S}WvT0KZum>AJdT>w>GT5q`OC4vYdzLfsNh0zG3-cAsTgnep;_e0-(p2hD|Bjl6B79YK!)d;Xj$wh=m||f;T~V8;z<5-DA-;JP!XEls z|4aW;w7KV5BzkdXc|$0>m{V|4gg%L9CO-D)oPIR+f{#63&WS2cGG=>gQTbgJCDpl& zX-5@!52q4Yhx(i%odn?U^ujsRm*m>j+%4k2D|^FBv}qh^RM6U_g}tvA^zL%_nrR^`Y-#>|1fy5zyIRZV1Ivq@Q423 zMSt+>51_wEBIbYgki78MIcb(K(a|s{_{y^ zmse-=6!E&!D^Zq{pe_gj1e2*QF9DL1*)BH$Mw1aQN`DOcK{$mO48^O0d=*Xd8Om@7 zBsl;V;qo@pDUKqPIDG-2BgCnrmhfHsTMC6J2$AUNK{2X)-g5u-*%Bq`inWw5si$R) z7ry1$b2UM_#>r~K_Y29cV*(@a6Nj+M=vAicAxdL1pP_`w>3YE+EB1>_8r z=V6QHw<|gpz|YQ{q4+;8^T7hKs~Lm>?F9$96hAVQL}KD~XpH&4Dm7&J3Fa&q)P03_ z9TAgL^Zk8-8OQM>uEMWbZoq;i2bjx_^5ir|#(%d60c#<0|5~&}DcN3Xjgo8ol1r3_ zAq69>y?Lv`2TNtpy;!*Rndyw{Rs$?k8ZNn$mJj6GoT%AGH@ql0I3L%f$2AE&+?u51 z?tT}g%1uz4<>^6{X(gbxgNQR39hv6(H%vU24HOk=J0oo5Xba>hNwWSTyZ`4btp&U zuoRxW6h|lsVP+4Gig>C*uN4^YCSdzxFS8Ha*V5gG<#Qb(`yg)vFa=kLPxwe2=TQXy^rx+@Pk)~R zfXATwvoumi7)}yG84gcKRK{6+{=9Wr0GdJ$2_+>UoPe^Scz&-7Mschj6_+WhWefQp zVI=O$bYevQ?*b;dLD_AF8AFM<4;XHl7k`4bj;e zca%>|2Rz*YzkviN5$E0u-e&-yOn*V6(q1o%UD`#`lHy2VX8b9&Wt0nIYB@ zv+u8kzS9x2g|B`B?2J$bVtkF_xzcB&>LYe`hJ#opJQ6{q$=tavkU&v5g$bs!uB813 z@noy=yUP%yB%!Y|gSqi}ojB!-ngOJ3y=O}&Dx|<(qcPdo=sl^)oyOe6f z@MT|F8PlL~-Wx-#A~t0ZKZ?K&mWdt2^60|wy+`-?vp$NB37;7vRpaS}ye}8|&AG_n zgbz=qUszJhOxy66Zhzfc-K95S*Pv8^KO{4Vxh_(?GA#l?T>JQ!9^c-P@o5)~ zaYkA3ctzdAgA$c~+8CShL^x^7!{P`9TD1M zNYV@^Yz#Voq=8y%{zwI*|42Jv+f_U&SFx{P6YDZBtuSIf7ehh87P5OS`o2PL$mT0RjJ_BuOEgzV3Vy&qPb^ z2b#do9q^k7$bWkI0tAsg@VrOrc^kfWiHya6rwplzUxppyqt3 z0~izg;D7D$aCt?rWLA?dC|CCS87!vi!Q0~xqxY9@UU!_S+bQR6F;pO!w%#m2kS?KU z+JxE@o6Ag0`O3g$)tzJ@2>2XvrUkDJ%lb;3%hl)!IQOZJUjxewz4GC?R_Mr5PtlU7 z6`FhFUqx|kr|vyCiynjng)6|9%mc5&`}@u>C4V{(%?{6zf75&1*48OuXb3KF5<1V= z8IJLl_a5crj;n2pI**Wy`?6G9snt10T95Y26=?CKw|pxtXB0=u+^XJiE{&@mm4gm# zezw{^cN(`$*GyU3r0Q2?VY5`~kv^83zB@enaD3*RM-mdDw&rvDsDT-p(SP)R?NSC= zPJg>FiZXso6lLm<&z+qL31{!lFC8LQK~GZ@%H4UmTnUKNpnTql$3|8IZ z*7_IuPT>>*DMa$p3p}$<%r|W>Qf^xh`F}HOW?USd|9pJlnH;TAx7VhEvYyHnlfh(y z_^uhDJD?|%nRHaY`3U-Icjx{@xa7@p%JUZ^<%Ute-Eye~fcGaDlk65| zQ9CK1H({@}B(!Jca0#ye?|livVDDA8-|cq?Uxye})w~wlsPE$MaT8trob$M`ntvN> zy>vZptM%LJ%EI>zZMDr;EMJP$dp6pp1$FIhc6G^U%i3YziGkmZ%~Ys zJeZ3Yv(Aagw|xmGRIVpmKG!pyU#FWD)k}%1N$R!|EHkA`4cWqx12QCAD55uN05Adg z_1036(e@cVYmVvrbdtdcfgM8wdVg9APVfJQJ(ssTB_KgEQ&KMB?W)H(cn^6a`B&-a zND-6v6O|Lv)We?qkM;k+@d@9%N2iy-`Lgx*ckjXJ(a|Bedj93Da2}j-wuDnO1b^zu z)w1`et#ickEYUgHQ=}b5<>D)zh7`5=?3GFRos0TF`CB>*yv(7bD=8mk@z*&a#?epW z=}cmB1>>?<{=H+a8^J=Fi+}s5#l#m&@Md~pgIl{hCH-JqpFwo=jQF-w*Dvd3+O@l7 zLA#e;Iq`5(iwMm4x90xVs2ywfyiT22i3chLnM?~v8b|_Nefnxzo z=WA1`=YTjLG_DXv-a6f{sye7TmYQ|V?(siGV1m7D)J#9W_%0e+AAj?9>bVyzVjoO7 z12Zgw;!>;wXSn363p|<4uv=xHbHP_MHW)Yt6wPi>c0gt+!AB8 z=yyQ(0H*K?$CzP6yFcYuNI~iTh?%BF!xLvZ&_Q<$C4wovo52-ga8RNYdZbgod^D|l z{hf&FxG`HO)-1y&nSaupGwG~MUVc``sI*c?gIL6>!HZRSBuA~8FC`zB;YOB=lRXsf zYRX?x289~0M(L+oYUZ5$d>KyAksnclGLb)WyAneo+TCHwa59l7 zcB&OjS36Z{N8R{~BeLk}Qc|M0p>_(Ks7K-}j(v4(VVWV*gMU-wds@16g5hfr5*Q*M2_zy##9;q)nLk7Q+gOS1fU&1y=}41bv@5*@b+cJTvERKTrAv6-|aiI*B+*wT*EV^a! z49!wDZ(zal+L{g^FXD5gR#Q9GsYf5H+~U}}mpjqT`P@{$s-kN-*vODodd|0Vc}JY_ zBPhB-k$*JHTOmFzxO1i;y8FJV$@@Cq@XY|ZEI)lsy{xt4pcd>Jrr66c%rd}IzQMsy zgM0ypSf-T534jUEwCS_KHXZ}aWHH^@-6Cv?vRh0MFP*3(4J~tt3fLb0PY@F<_#q=R zy`>wo;c1K#epcAltK;A$=)OhCgiUwAZ-5{F%zx$LDY^QWs2&q?ou{C~56GQDRWKqC z`9F6=9GL}xA0#-8&t=LPX+eq5o&3_}kN$=+B^ zoFQ`8B{L39jc=U@SI1w4?Qh$QkF=3{tKQ<1N}EOXBvHvBFlDT&EsevxJfMh7IJ zEQ2^<)Y{C}LSbd(+!)lVEl=t%o5R531}5l)7iD3mI##^mzX(o1=buT(s2UjF2Sr`o z7!>>BKa-zFZ{HtXfS*Tij}J$e$L~&u|4jI0DsgT zf66HM={pK;lu@&lur>*kqm67kHrBrmx`UT(O{_bW;Q3m_0d)%uJ?;8N89 zvI;N(aWX{+OsQ^=MDPgw?KR-!%giP?iNH+04?iZ^OdeSvYkFoSBuR);Mtip^kv8q6 zME*~pi4Nod@k4|rski2ki)Vmjx_=W?Bs;O3U)qhjJ-^+7PEd_wjgiK8r=gnde`5@% zSxvD1IPr9Wq8Nn?MP11b%?s#Iz-g74WK4Wrov@4|=I79M5QuL^+3U{T-Q8Vhr!qQ@ zB3^YNlA1^>Mq3B;^8BHEVdq+su?O&c}uBqFenfH?UUvx-uoYE@}EBpo!WeZYOS6a zfV}pjnisreziTSlk6C^GJSCLzj*A?aj&AAWYT-I7{oS8lqxr6Ql7F1*jdeJ^4|Yj1 zpSGlvSG^Yh5|j#zzkz?}grWM3W1k-VF~8BD>;G9;kh^m@+mHunv;Sv*|M{yIj{oQW z-rkEx|Idf`HC|L2*8w6ZW2XV!he5(%Gk1>Quv7C*x#u79`@FEH3_Q_oE;W}AU} zvwZUcUY2owVpRt21C^}9tSohv3JsU?T(T<#u(Q^`}QGN-N{v>9JX=atYUEdo5hp&)l?J zqFwR#Og)O>gMT6A@&d7C5?cfbiBQn*wyr-#Fp3eStLNHXDhWZg>c4Z6<+BQBB66Dq zaLiB^%y1lIibBE#qz$Jk6*#aFhjn6ta#4;Uj>!$m0)}UZFT zqd1`RBwVpS8peeHQM1?-7#FWLmauPjxv2rY^8V}Z)qhqstJvdFR{z}dAG%{13}Q^# z<_>@h&VT*E%YFC!_x#1n$MfGq{HnXJkO29fDxV}WBmMGki`XxSJWjkX^ykihz2ygd zXW!5Yuwef0?d`pE=l{#+&mZUiL;SoJ9rY^PLVJ!DmPb?0G75`nq-ky0`Q3~;4(bJ$ zE0wXJDSrxiFWEdrLr|oj*#bIM=keJPoRS2!J$t43RgCHMl(2IIqxneZ;wqk0v}hM+ z45`)zN`zUM2BH_r(~(yhI%#1%sFzAft@3EJ%>`p+zy$y>m`xBn6NHtdwqlRnPhH3D z>VlrQM^X<(HfW3I(nWw|jnj7qSvZx`$0Ier_kXJR-}CeA|1p~e8@&c<-v0;BU+nEU z`~S-qFCX)NJjid&8yzVwkNf|(ewCBrWbz?HFv1C<^g~QS7RVrCMYcp9q>P|LFeq<>5qPhWyKnZVy?va20c!d$EosdO%*K$ zKj4hAUq}|ce!49h7n1_~2Bru`AV>z_Hvn(1!Lv^?(aF=nUp_zESvcdkV45EbRDZJ8 z+jpbG<2DsfMi-Yy=ZEipIbCTQw>yjSnO>fuYUcPSPq3B4}1TFS!>pP&v9PoagFE=QR!Rv6a$yQI!42VU$NJwaOmR6K47lhkwNOm z;nt|?x$n{GcHwx+EuDiTH7RwhV$=A&&4!~Md#z`?qrHYLbKxMSako*2@6&3bu-c`z z9uXlr{>c8uvp@bwnn$dHPm{oE1u8`(%U!x3zW7`?fK_0XBqQ`qJhRw~znbeD=_WCJ z*-LTGU5n#%5qpcr)9mdb9awxh`P5zM$f?flJU&<6^WQG8&wj7OmQOmhb;i&wYwm6q z{V)VB-=p_6k%~k+E?+o>CLaY~U#s<69tEpk7>V8m3HOVe$m8g7d~FAp+LmIaDq@Cx z>DZL{|CI(0xyzu`D`AI!mvpC8?UX(`czey`Eju90a_`}#Nh#9h1xQ6C%%~+5`hsX~ z494?$__jOz>|}&mUWuYkpjW>ZlDyOTv#s5 z?GJ0eWhu~sV}9jPAh;I#dV8$A-?a#K%O&t%1u9Qogvf(b?SrKvs1E11ZbwC)BRKgN zs7$BvNsg-Vt6WZuk#gr@`_p=l6_ysYX4KXBUjnqowUr1?+L``s$xy=loVEofQ9 zC{WRjTLEW9D|Era2a#-~tTucN!^C_9zJ9Prs91vFBYn$iJyv`2H~-ygt!HRWI~;GO zAxTICabYnHaNl69@Vq|{RelkvLoHoP6gAA%Yi(Ww&A5bN^h46(m2|cw zmTwV!9AEtajn6vkC7BlDf=-x(S0i`WNl2V%#!`alj=r2spBQ_K$r*B>ky=I~Kr5b7 zuh6z=I)E}%*-k3V91Bw&Q+-k?X-y@W{j6dfNWA27`liw5|oPM(oC!UMq1+B-{zQ-rQ6uTgcXysW>d+XHB>mMt`3 zN`gwvg!#V-hmH}5m!}4eu5Cz#4-LxJ@gK`nc#mR&8rb9B;V{%|B5t&xnluA-3yDyI z;sX?d`q5B{1y^aJM?FY)zt6QQCgGqSn5zJP69XFD;|RdV<4(y(sCLmBol;lcYI?2f z4wFs{{(^8a8Gua$QM3Q3W|#9rH;?g~Az;6iq%gfYQG{g0Tmdlfp7Z{Sjz)&7R{h;3 z($9*LixR{q^!oe|FNchIwq5kdB4hb!p$w(9>Hx)l9B@F5m4~mYHrB;3e8q` z2M@ErTYXE)nx5tb#xx9WWAld{E-s6gvMfq(;IJ?vS|I3 zoJGpY>B2&hvLRN*?jA|8Yxb=ziL& z1;ha%%L6vEzm87j1B<8NqJoCWMnv^nb+T%$J%iF?q_n}BFK`mA%Ru84VBd@ z!TM5DgsNm-_;>&Nk~P5;g^yp}i$%3%YT}uEjr4=y*BGLpMpeG+=S=B^eaZIJGa-Te zj4~Y3cpyNlelllGDYnd>Y+d2;A;Ko6r-euIz%2=oFT3q9yp|ow-IkY|H+xkVRxl-8 zo7mZR5xV!sVqxK1P8qh(xRv?v?5szRTj{!a`N3TCOxg9&l`U3}S4W5Lz1YGZn8$Qh z*=r5a48ihNNq0!^Mq`Wn>Fn0S6BlTl65qx>9|gd$|3F^l^E+|=dHfMZCw}VHF$Qb+ z^mc3qF~kpruE0kv{=nq%hDzEpO8wzZ`?GaLZj=1x;rycTNKB+qx&=wC&9jbfE}qAE zlw9Ts<3nNNL28ft?9AcyF3fi8v-RfLzlM`kFj6Nq%eU6-yX%D#EN?*ykOBZnHs-`}ujk`Ft?j+L49o>hb7=pcZWx-|RtuD9k~R7GwZ-bD zSO2Q6^lw^TS+Vb_=wLR~AOFFy1SMPbwKeMWfDqGPbHj~6+hyt6}o_G^^5m3_jQh7WSs*hLFCxig*Z$H3! za=!UpZ^bXly8_5}XXJ_~jsP(Mq920ZB<%?8WQNpwWDJQ}AKuT^!3+l8&Y}R=AJ$yX zZe>!(GR7*Eyp^^({3Kxme^-Bf#Q>vSPL)<@x~pfi zf!2Q5Y5zA%&OamTNB9LwAt_L8EX?!dUhn$v;&7W^~Yirx^ zv`%sCkdSGvv`qeEwipz(w6*&pFLKDhDU8yjJPP7tMx9QyJ3%42q|;zU<93lp?b*)o zf#eb1dU)7&e~bk8cmdYOqIcv?U$q1N)L;Vyf4No#kT z#y+bx^$0xZGuYL!$e7|y@0s-Kv4$)AhuYn`r!A3f?AdM`aF!>M9Qo88CUEMhfZ(Ox zrKg%8L;;xfmrSNysrUoP(^~ZvK0W&eVM`BhaPF~`g(gte^$ojv>hf`kYD$8ZvjUR) zUM@uem=$r1ON8s`sLfL}>K#I7W})Esn-;M`bpXe5NoMpfQVX(3!@!R>yF{{T@6T}_ z3FifMOg`3bJP?Hzq}zkdTCw%$wbz(rdK+5^qp{bb2J>tB=&U98yKU~g%adr9I1A-| zKiLk%XE2DoxZf7D#vRgW8=WIs2LqO!>uFR^o-N25?CXhzcvtbhzbo~)(Mx@=f|v_T zs{qDt_GpSZtf8YA5#u~JcGF_7qpumljvrTPZ&%ctBjepS%{%X(NAJnDACK=xjCulx z01%Sh@+xD&)8@-{c#4VL1-bse5%~o2@tgC^<~q_#7X9ql?o@LMi}ULgB6I>-8Gb$o zA^p@)VhGz;&7q}dlsG#q`YRqc$1qapR`ERK`0%Lj1w1Bh^r8)(>8_ZfMlVu1(uih} zhrpJQL+B*+E3J~S8&b#*(MGt z|6ILZ{UOQ8$R&FIrSH4^UA;DpXHdq0F(cz=GHX)P7mrs^#syW3w^HVUdCa@{nEtpu zdX2A8rUskLiCo;(UfVI z#wpdzsneGmzmBD0^EOr&3uVUhv~JpGrEOj;GZuaEi7T6SlO~Hx9fTUDspsus^YA}F zPWfr5LW50SlgNx3`7%8NflS z`SAg_{LwDx*6|6%=x5#@7e#raZmGLIu+DLM>IMt4dq3L0Sb=oL?&*Jf``o(C?oSv4 zo!Q9ua<q4+b9RygB!8a6!MghAoY-G?LVztWZ9 zZK5pA?~+qh5?LbO$t3-La(hI8^c7LfL&^$pHQ;RCjA9cI-|NzFe5Wqs{pHjeKI)B- zvO@5iO#X8zsR#HmzBl|+Q_IR_Nm&1x3k*aKK6R-tAU=%FOIT^I6~^^}c`AU^8I@)| zvXZQZ{$TP2MC%IpK~sOKvh9>>QhF5T-E3)pIWWs;Hi;8zNv$R8q_!`OM*P^DMy|X}#{tNI8CyuPvItv;Il%r(=|xv$ zqDXZHsnjhDW2=y^-j$kdsW#Q|*Eb{3e`q<$`kXtqbd1_QZQgm~bZdQ_9PJ z(s;@2_5je7Mc~{X1$+@<%PYbL<_GMsH+D21Tx-$QmOhP0CvTn%-+;%m>utttLExk1 zLvUdFi20yI%hsKm6s(+srrsMFvFQrJV2TKn~6 zJ|uqx$;7fUc6CEFo1PEd&&CCtkv&^Cr1rn`X285?|4_2gqHiclGCo}fjYAqAJ(4C^ zT${O!aZM#7o@>wi!`JzZDH`8=FLT6~=TfUxUWncrBa2GMo2a+Uq#IyvP(m<|tE>ari ziDLC6jO=XZ-$>U|ugCQbm%xpY;h`|fwIr1F5@@IDG+r*c1Cr7I_L+1E-59nZgdW0E z9+f3JTi;J=<=fhy+ibT~l;cVt44mN~fBVkwi#Qdpr%3`9WgG9ONev1UU!h6yt+o3x zeo?an^gTXKiw*R9{IC`Ws6qUPmIP={ytpP}&z-|5x=lgOoGck&#?Dy)9ke_HdWb&z#RfFvp;a2+jt*C@+ zWnC3o%l%D8)1dk)goSL7b28l>fu0SDb3KMBR(O54IGg13tQTr7*`a@IH1=BsvqsWwG>Sc;~mUgJ?my~7^qiwfYT+b5uT`{|eV#@*l(_-8AQtfn!Fy<5c z%NOzGOH^gzgAO)N!Z-Ps*=BE+&uvny3)vu9=`Y>Zm3F4-Ks9S>+HUgaQ`!V2N5jbE z-HVO=C@^4PSDIpdAg?DYnVdg2(n!)^6ct0se(9vmxU2e}xz*qEAEvsT|A(o}CSX%R zl8pw{?0}LVrg_R2r*g*CZDE+fWEk2QpZ*W5CQ9|?p@@CKs+ukQ{|~DmesGrYBd95p zsxCw`C|7kZ0meR^a3WtWFCB70W*a_zTG8!SP8g1KByRpS))M<~tRa-cn<#Vn zA%|rwYe64Q#OdzgqFrAAKQlx3-^OG~D2Hj{-9%#Tf4FJwOd>%U%4qh79EqC6=ko}5?tz$k##FCKK;BUM^HV`1j^w zFgSmH7I?Ia)|yaa{xPVtcpEb4G%9J?q#=Q$UysS4hVkwdx;WPJ|Kho3Z*tA8VPOva)|@=*j8_bCvTp>~2lQPQj1L23xN@Y*Nym7J5$@z27~)c5P_a z;vh<=ZRW$qU*>(ujvUf0NMcIn*B5-l39VJ?q_ANzcI*Go+AXb_V-EWtUz3+xc=~U1 zHoJZzu7%m5AMO``pHNkzvV5*_Xk6e}Zdvlz%;3lT9We!QgkTTZOAb+8I>V(fS~k}7 zNHawRMeF8HMuYuUf58ND#6Lexi)Bq4Egm-x7Dj>;ywnuL34{q5s9mw5qHnk3Dd`Z3 zHk3!G9eRAc)AR&{BCk9?6!l$r25avhN(Q}k9A{Tb2o?#d{xX?y*|4(S+3V?6KkdOqiJ8s%J8)+xY z0+2w*9U3kzZp@8&Du0pxatW_8Ds}vBYfAUDaQYY25&E3-&gbCq?-Q}rukm(3gMPiu zw}y?5}R!WQDz+5L8gD#X{E;sex=*-g!{@(%v(YGsnt(8u|2>=CyW15XAkf%iV&9fFq@(2nU{3SMFI$J;4 zF8{08TX%Tt{1njO@+U@^!{ZO1WgCP=@8DCf^7rxd<@^v&XHnhtZdY`WK~iG%?`74I zUP5k7C@0&LJZ?!ol**($+Qekv!JAYys zZk(h89|JjCBPI_h3NG+`CkLu8748Y#FTr0CI>-Q8Y~EioK9J!$DQnrZ+>ng`Uw^W;ZY$M(6!;6mz=MS_(OgHetsJk& zRbLp-@mXr2Er`EUbE~AS&7otUlUZqUjmehZ;E!!3yGMLU7!i=p3W-T^JX=~Nu6J^t z@bUl_#s~NFLQuP|3d&k8g=_$qU|_x=5?$}*C+MC#r`7@b1PPe#j92KD(-C55=S{Q# zZM9?wV(%8Ge0CBDT`NAXP|?c+yoNe^iz38Qs$a&5qobCq72e@5#k>~h2s;q6I9yt$ zf5;|<f~!Md%x?EP^Z&q;KBb~B*(Bi^kNriF5#Z7NP#QUXHK zeKQ_O;KA$RmD|EO)@aJZt0!X5%?1BQ$FEMyRcIZXlJkqKJ|WKoNoF2!Z9ZyoW7U3> zBb>?QU7qaa{gd&VIxJ;7KT8!YlYRS*W7Ck_@X3$Sm@p;h7e7e1jmLu+Hz!jd4k9HXk-*k5wy*BT7iYr%4-n#9h%*?LM zQ`(|DZLZ0cJ;TG?Dp9ZEUDkA(cq*_AFm#>hz96Et8fyGU<5S=Y;ETi@gw9ulTIGWE zYl<)!CU7bNe{4&mKSA%KrJp|~^;JJ_<(1z*{ek!4z_(9%#D}hh&(1{oSbLp5p(7ed z0<`DxDh!;r?byiWr{qcx#??>q#}CWaN7YRC_s#wQa`9zk@t;mm!PC+h?H_f50&Zpl;h=Z)!?jP`jljBN&6yq z13*aW&~k|08iI1rh9a2-k>6t#vur1ug_X=}A$5EgSG_}ZMYj5q!EJ9D^udnckbK*(O;8KK`1n7OhL5!&}fyvDpX7YH0ocb5j&P{w~U6qi0 zJ}$3m*hP7Ke4dYT{&^jI+1@_C^7{MPe0`mCD!}p4JLF)s**T@p^<)?3Uq1QyRO^`7 zGeN3Dg98HjK8u{$~cKl2O~Y+f`@pfhS(tn`JdCy-tOYg9U(O`{OYvUY9wQ_G8I%WKRJJYCbW9v*q(@prF%|>TiLdJ{r#l+I@xMLw1EaIy>Xhc@ zhu_hIM=m}+?#W9-=5OBqCUK{JJ#28Z`H@|eUN*d=QQTzso*>bdUYvgC`{}PCgQuB} zNFG7=$HU{qO!8Jw1J!l-)3z>uR01rXW>I$pnS18gPxgobL)$4A_XKewK4B(4L4i&x zCW^`Y*}-b++><_TFE>~wpuL5R>?c!~21!z-2V_EGqSLWqoaGE0zWit)ViG!>Mp^73 zAFFd$19ncv%hRHCD#+dQzoXzww3*x;tFQs*73qN9UxvgP&Y6V(txNid{;EN*)gYET5i(MBUvoRo??&uI^&MLx) z$s}j!#2m;)vK;c@={-^N2ryoK{7Y%nI(m9@S^7iJFu6E)`h=cb;N}w6jTOlIEqrQ^ z97%J!m@Iv_X*Ej@;5^iQ!P%`QA3AEAJ(}KW_GmB*NpC}BfndfK?Q#&yqYxR}w zjPe+Qckq)ulgGzD08*gd*u~b;D5ZWt;y?$AbRNLEHdyB9kr^M2J5@v8(($c!#UdNZ zn9=>GxZL9n+&rJz*4rY5&#N-HEoR6srzl@1T}j{uf6qO}jZeTCefv9H2Jz&X@_rcn zz}jQanc@(mLS2+QCAMe*)%aAUKJqg@o-KtFkzzb+%&9;O=aCsjR2PX}3nCxex0B_) zB&k1Gb({-)I@|wn{&;%#9t2-FsON*&O&A28t4r(|fFMiZin=9mPCkM3#p`7rpwD~s zV0)oe5MNCdi4DHdE4ayRJSI(o5fY}fy~Yjh#*jATC&Fw`5CM-|>c#yv7_k1!;ycfd zsU@20mqB&w@FxM*oxhq}agm>X>80aj1;g3Y+?~kh3K{7z#P@q4`k+~2m)YDtjrub4 z8s@+NkZjlW=hd@3DAW#XWvrHU(s0mC)I!Dc-TNwen)gHh0eH41u-?X1k2t#8tFj#o z@Slrim|P#$^!9{~;zO^tz;U!6yyZ3vQ@C1>^-@COk3X7&_*9E7nja)RH=6)2%Aor$ zK0GG!iU{#@QP-~$der030U>c~Xmk<&>@rsvz@!{n(%jp-wWW6g!62H!z-S^eaO-uH zoX#DkFw1e)04+Jnou3pg3Qf+Hb>V{-(yGxwox78nkbDpMn}iJ#e9lAzSHuPCbr5Sk zZlfDaTN`s?2kFb^{Ii~}HWzf9!EmsJk`rM%%fhOaa0Jza5k!(C_V(Og32U|f(6g=& zgd=R@jECS3HJO&!jn%KWB|UR-eP$oMuCE71hQtP2W@$lNM_`<2h%vI8E!nA5009n?TMA7~sRNXzTtX-%a2-V2H??JEad>X2 z{*bTKO-1(e{-)O7LVmliu2fXgy;~*)u!qSazp=$_Tp1oNof%7H_#C!Z9Iy$nPu&JQ zA8$UIPd5kU$2xQ)JvP)!d42->NPI?z;=-9l@SEm#dmxGeX}i!E9{WYCcFnX6clTp5 z79Xt!_fF#M?*?N>`9kDWdbRQ1D0jA{@7W|1Q}8uhx^M z%nf<#Z7r3lID>2K-C?Fr>epgKen&$3r>6Ea;^Nf^sff}P7(WKG$Mv<}riIK9%Ncot zg1sjvx{FfsM7oM-S0l%GOBvvqi=c{rGH&0LDWXbo!GddR#UPj71aA?Hwf{o8nb9t5 zaEp>QXg;>V&d#RG#Cq8l{e1`y#64$^Caqigz#Oxmx*VgXL<_tUXwV1lv$|} z<*IRN66>S9_<#Xg9P=_UAwAFUpYNjE{i10x#@Mfr7=1C_(vTTbN%5i$)-*m9$areo z8caEKe&@FS3O$+N0V5XO0aKv=$ek{wk2l_-Gtn+ANsnMnHUt(BtvOBs>8Na+i-APX z-k5O}lWTgWyd7Bjz?Wv=NsxuWm=A4RLpmRKEaunj<<9TB)x1Wi9r&S?Js{jMt3d6c zu_E|w`0{dE@ap63c3M!I6ifTf{_!aLQ{(o_EUtgOo&Gdtk5S4;T=Hf}pgnM!fA?PM ze&=i0!N8(}pMi*C9Eb$=(9BLZFb$r%kqF->2>IWrFkvEyBvIr(wEdsmp^Ij|^6acg zAH!qofL&1iPkeyi^9d+ST126+qWE!vwZhtEfV_kD9VQGX93;Kp>mQ5+Qv5Y7!SRDiS-H+4!^k&5QFh^vn>Q#H#5{^_gtw;>lNuje81cT}yE@Z9wvxLk>|POgnKoat zCJhUXWOVDAGd}_JuMQoE(QjnySxAo}t~{SMHf4u~=hOC=%5u*-6lV|s@+Y2DVabQb zG^QXHcSlut5{N6N4{V9Xp<$p9F!OAai9y?{v8(W{rtm(112Kz->&=n^`_PdlXxnJ{ z?FS~iVXz*vJol`lBQAV@czMdkzF{amycHL9%3_7GjRycfC`;De8~WD#KCeDaP`Hiv zO=%9MQZ*jg{A`PATCL@h#jVNLICA7~!vt1OQD}#`q{@emhMG;ao}+3#yS0!AV`Z>{ znvOBT2V}Aao+lq%Dc$7`6+GyKl5J=fJaVDuK*%<-2gG;fowVQBkRK_3i_Ynl^T^PM zH~BY=j@5x0C_-Bs_wds3Pr~t?sOfC+uajpTXd;!p*|f58z+#Oi4EtoXZq`5}7NM%R zamEp(OWO@fWe58;>PF=Gv8L5@Bk8iNITKS{yJ`Sv<1FU}6!BbnqS2~lRx(jtsB$W^ z)QD7M*HRmiwQY^e1U`Wozn;7QTO>umWz0hu#0R(_aiXVNxFK` zshz`^eqjvk$n1ri9Sh3!rq+4&_`Mb{AO3ZOUFNis(%!vYa8b?|Z&FYYK9Bmg0zr}+ zVjov=@_w@3YO7|$uF3*B|QAvr<1Z&H&;0h4E=bnD6D4Z(zu(EHD*1tF-a zeG#yq!S*Qm2jcZshC0S*+uQC82d0{R+J{PC7};#z9Ab<^)K+v&j7@HE%o&BGixlX( zb`FMXi4@qJ*lHfs8r&zi7Hex3YWmqcv|7Vs_5p+6Nf!Q|xr<%TUDsULr*yDBAvOK8 z{(_kG_p>#R>Jp{D?4q)NHH}PK>I4}=S`(n97^P>iC$7ioCMv^P$rK)OhvH$N=o8g3 z>>GiFBr#!f5${7{A8v%r%v5MX>`Xjd4qin(=%;Hckho&3M$N0@P_0s1dyql>QFPMo z(r^fspOrFPJ$9#M01>9$3I5wqa7#*pDpE;04om_C`O)2P4@V=1nQJdb%HNXOy$6`7 zyV<3tifH@BWK0b<)6xM#>AnSu3MDZ`-4h>;STIK2W^N<$CsgcG;ySak!t2(s4ySCd zjk+?Og{k(gj*mp#$=8^=+*97rM-F9>1&=*cxCoXCzPBqFs(eu0Zm<`h<#(t8yar9U zvyAe4A825Y0n(3Iqq+sns=6--Z>IH$XTudSL(b$bEIIA( z-PKkXk9!pZt9d0TISN>|4{}!TFTuyImFp!t2+Z9m=GNKG_I<%vV^`Bzpc%+AG>uRX zM%gz{RfwV3J!5ynsDE2XHw~55G2IzkrYX^Yl3Dtlff)}l$ z_3p>EAL*2QiL&Z{dX*7mI!l42`I1$Iv+R<;7jmVl+w!g~En0;!P1UA*@8zw@-5q?2 zEK|wJl=?CguAesr@6vIyaEr~UC-85Vw{yO)8G^a=zxC%RJtedMtB(cFM7H7`t8{xCvN$XV3@QZ!%DkbsDE=*@Bf!7Y+J49i$dsE7+-jjfa z*#kXXKbKxR!D1S^q#FhScUor!k&bqf(OlvA4=G?5h)?N1P6!akr4zv`S01Azc&uh4 zmqFDW&l(CLa0q|JvrZE9WJZ zv(GUNf*l+o^ci2|7kHno7=frWNQ~42%X+*{4dEitN+MAp3qabXYgI=QYXsC_89&jK6LA`|Dt92 z_mBwqr$}JN&Yxaxs)f$sAF|z1wQ=xz4*34p)MGwH({ah>dKlI}p`ZYRUJ0qbco$6h zTp7pH#OUObz&SWL(>a)~H99wP>q7GbMVbRt%mnbWalJU>!2GWiB>HVUpQ|<#d^^G| zvj4kGk&Fj!F_jn(Q=4ZiSN-F%k{o`Yq)?vlZ*NbY5z__FFxwycX7V@4v50uPA`X>J zIF=#ou6?W$?;QK;Di%mmf|VVhg(I1Bc^F6o(8Dwm6(9~7Vv3*>Rk>bxh3ObOwt5-f z$!S0?G(?7iGdGh>j$sHE!(2c>e&c}e>@T*Jnzp6aVx>>ok?^DKQbX6>CnsX#OOc3@*lQF(e0zl&~YiSLzKrn@gJSyC9EK=i1dS2lTt4Rf7HjrMr zhN^3hFG!6d!w-Ho4X5NojFZ!GPiR1E7_%$)=9n*yI!kE9@Iz@cNrDsAbxpL{aE7`( zwA(fEeCtJ4oWR*}98vWVXzBGtBpf-~kh&D9yCcsg6;jG7z~7iqq|5dkXRF}#L3sw$ zL5z`!hsYpU$d0G@CiURG{Ss0Q?<#g6#Zg)siioLQ#gv_cp79OKSW3%jyg7e!6Hai; zul&8d#1{=`PQMBwGidL{SMs(G#qO4%g6BevnM5JN_7wMnh^p(ZS{-2<>%xbp(u%QC zEoW>0SqFi}B?f)EJ^1_CF2jdA47Cy9`zC1=gg-s-5k?r-$G7mf@v(@$ zUWqYu|yIpTMo{bWGo^9_LNaj-x>f2Whp`M zQyK(u`7lfDom+kT;llB$%7iVM>u43*R7bR!TZ@3$)O?%Y@CwcMwCw2n(%o}34GZrj z$65idAH#Ch-Lu!(ft)`tad?kGZ|e5}7CrO8=;}W?iix~)l(Y%v17)W2>I3_}dP_czP}7q8DexexPSN0DVnH;CUw=&9{j3Ye^uJK^8; zz9;$%dtT|!Z;EUEo)X(oJc&0=qrxwb6+RPdn5nPUI0LKeZju=2W`i9Ej(q0PRZCq= zD+aT0MNIqP*o%!i$y(wb=MbON$GBofsh=~<@V|aYaAe-0c8enCBruNjYco|rr>lVK35yt#SZbE%D9E&yQ0!+DKZ zg-p_&S%E`E!NQIu8}u#$V5~1-u8lkJjgQUe!8n{>b&@QMLXVUOocP$kHP+(Ll3}SV z3@VUZXg4$Yx|v*KZAB39yh4c&v7Al(2r-(Bgr}5v{lfRfmgR((7^aTnkAHhyLsc-z z$#Z3yG0x!`W3VXl3$Yaoey7;{5DDdXNG?JlMz;=p(u&>*;}6;fO0y$G=4p)c*s4q} z$va`S1V%A?yKoorUo(#svI-7inlQ;GVs$`qjH%a*P73Q|P!AbeFojN{9KTUDN-I?p ze^Air=?gp*e+`D9ft?h+~Y8l+MMO8u-y*x_-6Y=HU3jeoA3J@%u9^6xB+MR4W{Z2#J8 zYaZO*15a$4|3j7mp4~XPr0f&g=n)^(}5xbC!tLOa-u1B!bt+ zhmh6IQ^g8=IrCrM?rUZkQL@Iu)|yuyDYud|z7^-=$Y{&Uvrb{g6Uh{FUn>&4U9On_FU=bV}kFpG`S7>dzd8lZ2|Xhm>df*SnGF1hZW;cLYQB-W95GS5~@ts z>_eWBCPWrBBl!j!ibgKhD}g-RRS{bx-r+#vnf_ zt#R1fMW}qW9Szya$N|-;OPzEhD?g?6zU@n}GZ5fUI_Md@e72m(UkhsF3dYze+^+dQ z|L6vqrt<21_)=)K2gk$`8K;7>1Q#CwS~(9{BB9E60Jz#2tvC88w#(vke;fP&@UjUn zK3z{ij^jpqDK3;~f*o*!w~doxw~GQ_IAhHNmI~LY5*Qgen_cUG7pwp%M=+FpcCFKF4e{!LBRHvmonX18prxQYM|{=rk~ht! zVPUIDRv)7BfrU~!<{WU-u?qLf>upn2GnvsV`(2IsjV2^jyA3>^$J-6m{Fp701W4>? zcyXv)S>-l-qw0$xhWm3iey_vSrAc#lC%A|WRbE=BVUVM8?bnKc&ST;`UTr#-@0&|# z3oVe^-bK)(CB+R3M$FksJsfb{7E@@Z=Fw!?Kuv)<2F>y?G?s`cbVAwvO98hB1-{K1 z)G5RF=CZ~!^bAdo!&|z{eqtVn3Rqo5J*veN*c7GGg@Mt8%qq*-+tc=FQ4Yh7d;Z=i zL0VrhPIl-$V!9{@Rg<#UI)|Fw*Fqy_kmHj@rd4575QOL(lG-ntQDx{d=JE>dT4=nMg8+0YsVjD46%q zcT;#%RM<}7s%fBK`r{^vMT--_C9ciJ2T1HNx2N?OwwV;H-2Av<=b;rJi|o4|rmviI zo`YbF&C0uX0(99Ww0rvPE6vQ_eJmnkv(DI5k@FaKN zh}8qvY*+2x&s_}5%EBLV;9Z$pixJZ93+dRrha`8sOQoFAyT299c|JqcuDiSc+^){= z*&bDo)=3m%12Cj>v6v(I*AL(4wD$}0W>S*BubqLZ?k!n?Z$(=700jud={DNo6mV#% zZH&4Wb**zU(M(w88fPHxq1*BgUN-mz_3Y%)eRM`W0!=be^QnV+QQ3<4r=wBTJlh}191wLfc0Ejh$kZlAHJvr6q#&+zZ z>L~`fEqt%n(}F?jL@1RkRmZ4v)RYUv(&Arc>?VE|HVN9GK<=1o^3R$?V^zrd{s~R; z=`;)7vKdR0+DtM3lso-Uy0gGiQjQNtCf zskUKp+L3dT-Va#$U8_{mnPpR5#xm9)iRHCazRR?{Nq48|2T#ry z(_`eCsP*IOzr!(jy>++ldOG4BH`eSEHS4@*7MmA>feH{M-CMoZJdB7B`*m%(3Qj9- z1@Cdf8hT$^fn>1G^|J!ZWQyVh9W|#0?TVs)TlY$#hnCg@^Y%&yI1r>bR#cr1DYJw;x4_}g&yVc(JdN&UY zSB6qHpz<|X=FP=f7ShdEVr)J7(1i+dc<#GUMCLTLkt1p#JtUnAH6nK)mlX9Wi%G4t zy+k%d+uR2q7-4<=@-ZJ6kB}8-@AY|Kj}uBPh?p^lzMXx#{0{A(3Lc(|Yxp)t+Z|*j zaN&*Lu$vs^1pR${of-XoDQAQOeZToL2Kque0sO(fl*c_fGoeMoAw;+hPuy*8|3y^m z=%ZSuvo@%@cWPBpcuf@fcV`4Ky2p4zpt@FxPr3QQ@Ap7mz zIT5^1{9y?vJw6;n^vW&Z%dqLsog(pX#iFhi$H_KCC1jcJx@_MY`^+irru4hG-JPS2 z>F|-;MMBsQ87+_eoe#UyLExbR5X6kQZmrqK`Uj8o2Fgu?6WWrm;7kUiZ+~_L>D{Gg4I_@?I^nX1ck3aF}Ex#py95r%7ZjiWS6Li`p|l3 z95&dSnxeVF5x+fR{ZgEev=mrG!MeCb^ZS?-Y9?~|o9SU}kJWWivb=3a50-B`M%dY% zgkc-cjEym0aqw1&?WlTWH~8C%3jk=vbjF{xnGfH8e`q!Nv#U1^5_e>Nk64rBJh;0E z_p;+D$hXY%j&hd&L7=*KZ(s8Ye^!EfC;0Ezwwj3edqXWc1W7V5{o8!4K>BmZGiMK#Zu4WEUH<{CD4m1H{Dc= zIymLkK9WB4zDumXcyNCI+nXjs^{YFu?LUj|sry&$75D9CJR3ASzlH1#x>QPwT-SW< zHdq^UKgX!!qK`>gXP1!J49n6)MDQ@MqIzbos#2FnZx@+}nvxAWQouWb{|lO?FId)T z$BDZUjy$c7>euS>)fuBtfeo39QwOyw&CJIYi2dPu8bCXwh$*tgE{$IM+np52y8cEt zebxF>)?7XoBaMsX&oM+-SN`S5w+o#l#b;k8L;*lR=cFx_GaoNl2C^sT}jVGe( zClV5=%+s#oAou_p`5i=MnqM7l^q`L#O8J>!ku0W&+PY=`~^hqpR8y&u$N73TZ{g>BrsUzf-?v#j&BJ zot$E;P?a>-N=}+(Jk@D9iJ+Bqb?(2rY;K8uxHfaoKRq40 zMtvNTV7KaTx%atfZETY8`C9|6!fUHbrfYtW8dhx|U`BNZow3@>4gP1bp~QD}hZNV< zPhih_VWb>reF^jW11g#oNCdrSF1>W`GYJzPppozImevs4C#_Fqz(+k=jvt{}lLyyU z4Vibjk*lWjF>8Ln4l_%<@_KkOkLpAIXbLr=vYiEbRtCvg*3?5LN3;{{#SK(yHVWU?|l2&?n@S}0vy@DHX+@*EjfHX~Ty(n5tj<)$_n@*BD z3Zs8;+YqdqgWRq<{C@z@Krg=lK#PPgUtoF&J~{}gw*Ful&zRn;safu_W^drAHDptn zDWF2n>~TqIhTQmy__G@PzHzR=&N5T=Un9>Me9a1ZHTJdsYv64Ha9@x^e~|k}?+Nq@ zgKsNiZ;MN}aDNx^NWW{SxON?h;o#{rKO&wBqt0wtiB|n(@w;IXZcin}9!C%_Okqwf z=!{B*c0u)WwWz^cS!3BP<<>_fUTZy}zkX(^#&tzvs;Z%?pf8;;yFexYP=?_OdM;Rc zRlG&*?0Hvrxki$td=%q3?zukaD0#o8h!s^T#tAk0dw;D-0sq@mK&#c}uu`cytAKYu z7n66oRy75ym}LPXy-edEf-J8pXiZxS6By1SatWink^0-q!rO?i1uj>8i2XA1y*S5S z#8y1Wjbm;0B>Sho4@cPxS>Q< z&Wy^HH-FS0{(t`0@93j~8jMAV?dlrJP}NYD1+`%j-f-T$w>{bvW?JozuM*9(RXpOkS(|7&mUxr)gBMm{B;Vwcb!2NXfY zSYd*H5{HY#hv0gDaE0UW5S%%!2QcMC+TPsn&wt4kiVLjVnWe6unA?^JYJw*#i+{&% zVb^ykLXe?xp^9q@NrG`0hmeM@81bY++);g%;Ndh`^;U5PtkR#KRPr=8Dnt!tm(#D> zouV9LOE5OxwS)JEzddTVMey99^_Z@0_^2Gd`|fS%8mi#`3ld{a=&kVo$4|d`Qsn=S zAAj$E;s3Ys(I>(Vax1P|GbAcT*D1i(!Ou+GP0mGnmLNY zgy1YTV5AeO%sEd+ZV-7pO2RQm^cq^3Y=6u*-Zy@Yy}dC7&0w&A!UUbGm+O{2!v4Aq zKo#Sx2-Td#gu1i}fc0e?h`eL02oFV)i9|TIbE4{R#h10Q{dI%or1xxXDAm{Ra;WkF zNXGgcbeO4|1%vo}VhQJtL6%AH@WVMMfmt+gMT^L)?j2u1miM}KUj zd|>^^e*e`%{(JnSsQ*8G{ABNo{C684%>}lKK{rzIKR5196CEX=O5`q5aQNH~wF)S2 z9cLv+LLV^WIG!CN%H>;&t%#7TGy%iw{UI1;bC*xD1;n;AK!Q(M%%!}p%@hF?zZz{LO9buj(|8@jNU7uQ|C?R=bm zMkzt#TaeYET5Yu9{=qlnz46{yP_?Y)G$%~Ri5YQZ#6`KL*E2keQ7BG^)qgC;k+l_q zhy{UHo9DzC@#|LhDgI(4`|YU^e3_s_;7S`jVgs|$0UQT9|K-*U@glDss^5p(7T?@@ z7{IY4xKH5n*%K58nLeyTV|m2tN7W6A!&2@a*BaKurdAGng_fRS|Av${|4|E9wA#+Y~gxKKGnB63UN8?L) zHFz}Ui)8TV{~J62KS7E~%D~GPCu}fIDESu(_+X4f1b0+UVq{I?>~F`MgO~%&tJY8jYa?_$w=n}5%lm!ie`TXqtRang9qSS zmHxo60Wc+0wc2{OJs6mO0n7l50ZC8{RG7~WfZ;Wa0~CTQv>d7AN=%&LF?h*EdotxH z1{6&Zr6?5q2QmO<&Ib?IhcBFE` zb^t@1Nv{SYl%r7oJsu3+zr7ZcJGud6YT^3J)|~U?a98Dc7-OCiA=?XpDGbp9(yMGR@QR0Ha1<{A#j`nQfX@*{I0ld+K#@d6B3fvjG6XJ{*-~RB zS6QwMiaCZ6NPkkA5QZ2af=LR*LV}o#A;xhiLz@ANmw+WCW`wdiPIiOXY*c6N9cForWk$Af{{Yqd<0rZ15o1brdO`C*b2W*6U# zLv+2nEq_VGf?Cjo8eSnW1p*dutj5Q&fmR%Y2M->A<2fN>#ceuJ2S4v82ep1V)(Gb< z27`Z+RGmmQo*+Upm5ae|NNHG&ZVtOxIcPW2V2%fa{jt5L)}*!Dt7h2c6rtUPEQ{f0 zaM=boIEwV_00Px!q+?yp^gC)7oI(Z;_Cr0iJ>-Nx>XmBLKlAp2;Q*ad#cS8IETW0yh+M z1f*jUY%%qnB9iS27+xEgt*#7gWvHm$%-`LG;VYY}&oyoRvV|8jO__$?#z{Qe289lW z0(>1cNf!r@7tAR|6#bfFhB;z`!3gBcAAjtR_y7C<3`Xi`Jsuy7_rzbPKY@gjYs@f- zg><5JL9kgt(`g(c8cE)U<0*xiG^4LGdGDD!L-Wydl3j@6TXje>CS)#1X$G9+H|FH9 zbR)OBR>ko&uk+RUX7*Vk3K44^%w?xhGxZcVx^`T4E_opJvzt9qeq9}6=oa=gf+HI^UaA|4KbCHB7Tf< z)xxLdr`-@mh%3fqud;Q~mKR+2$(xr~n4$%_MhuwUwb#}72pNEkkpM$(WPqFw)GkG` zgGCNwMZMV?s+;|L8R%>+tzfLu(tlfVeqSKo=k2z{L=@$QeMp4{C|l(ymhk8 z?_i5uBT8|I7?{Wm23gN-Yj`azDpN^Il3JOf8b5~QtZ!G@At0CkLIJOp!m0uJ__+!Y%k48U&23jupU_kQqF7ja zKs3u+<5RUFw!3s5NUx*34M% zP#8dPJjF5Q%i%B9ZD`%5FQvHAd@rtgC6+HdkgZ9NH(pggwe~7!8Fj@jYY|$@TyjyB z-EEA?q<~L0PeK^xM1RiYoyYuMKaZpIOv>|cIJ1boJP(I6u!R?kl*<#x;f!fJt~doK z4poWt$+Pjn_?uCPE-{Qp`}-rhzdy0($#cE=@e#j+L?wf(!{_Dn4dJI0F%lfr%eCw@DG1H$TvC3qR4#JSB*aB(7LNF9-rYuxq<>G5h zNi4;ZYe=yqI4>{`yR;OEW1BA)w&~c%I@JonFhn81F@Gn@7G{$2t-3N<$d*ahHz{_i zqM3YZNj6K8QlQER768vY&x)vGnUA6jOz8qq=I8Y;5C@Y@SvQLF_(i{#*G$dLu&GbY zJc>xvPK@PySRem)uz!;-E)jJd^=2=nxi$`vt$}T!4+)}J93>d-$jl;`A_nqDZ!QUJ z>v<;o6@Q?(AXl9-8|33UdexvSvR&s>HgI@B*6N?u)0nq|QEW>LTX&MntHu%6-O4CP zUFy46Kc4;Y;@jbl`q$B`S3;|DS6Qoc~DeIW^EU1_{N4N{bMOlox!| znnqfFT7oRCF5gA4Zmk_!h9&4_Bq5lJF)B{x20+%ehN^&eKvtF|pFm(6;Z|ZOD}a3b zx}v?hE2Sl@bb)KC7GGxA2rQ~ryax1^OwI<`BdJz_teW--Z+nn^Rm@6iFvzN!$Vb7_ zzJHY?yfv1CI*>hO)RlYerTPJc z;uoPE$ST`n^BpYK{ConFgS}?La6op7wA*&7Q~ATjV9h~(+CnUHKz3`D=lU%$Pq;S= z^C}=0OTuR!knhwFfM>yD71j@7wVQESC_A~)zuT79Yf%L}`@?4}L!8RC9$zh-4{P1(*>K;GZm^YS^bwWwyT>sC1@fc4k9 z)6axJ)d4br|>`3g699pq3yG6WFjb40-l>$xBWXB=`gO(TKRmVf4O?M(K5 zkgf5`v4O@Y5X@1SMu@(F3-6XF`*Oq)jUh)MYhPj86vuH5klR>3(Zk0J~is&nsD5P;|mpnvMU7O)w}tvpgBEC*(nhB}cZdX;8q14NvI-17D-M^2Z9 zvID6%260=E*&I@IN{Nu*v%F3vo7|ab1t8Eb{}RF7tKH-+l|3Xnd~D3c$)iab(;ym49G_15Pvr^e*$kvh>FWBxp1#Aw_Ifp$X94tv=&K_ zCBrbWVKN_0D}cQq_~BX^WVIBN3Xs*W8-coQa6>kF-B1RpIt~XJ!?Ue zvdIry?RL*sxt1@l34e7>Yb+*$l_AV!f>iZd>3TVsc(2YC{pFhiXIKyylb$krPX-QR5)Vk zJvxvzSZj2bwtqIcQZZSd<@1!1Yx%ZM*QJ#-Ix*#AC+5hF+pcFN$gM>DLIuKCc!A3z z{+SSu=U9?}+6$>w{TnG;b59to0CEEPyxJr#(>4l{RRCp=MP-F96avWo#M0i<{0U5U zL&#y1?q{!ZdU@)DT7k^c%Mep3@@2`VH1tAvmM=2agMWDy!YCzsFhiA(l5PuRt;43} zYx!9LWUJ0+LH8?ztlG+_etki#qQu`J82+7Nj^4%rGEabOkDs5GJ*zCvUeBLTVDhK$ zv3Hp(SGmG$S}NBt_E^mm9%IS z(5^}WmVZh$scM(@{8<6y>{ST#;v9PmK;N8=J%WLv!OgzeARDV!+jBCo%8GEY4HN~fSgoET-SmuL$Lb;xmC!u z23g2pRe|E#jv=92>q$d1$Xy5neULt<=$yjo6n_Vf)?K&CrXS#{W84Sjwrg3t%3WwVA~5_GMlcS_ zaDUf<{EEO3n2u`#z6QwZ27CwO8PYEv+JbCCOI8NC3oTcPM4+WuRE<<8kXt#?G{_7w zhDm(nvycnjPyXtf#;tRuN7*s?4u@|@jE3T%4UZ#?V*c`U*b3w~G8w~4AUmc-XO$V^ zT-IbWB3z+ohgJ1}+{z@5=mN)bhrg#VK!2y6IMq+!Wz5k`ZnlJ1B^}Otf|=+FRE%qe zi^>Mt!Tb6NOdeN8)|MWd>!cT~x98@!_TC)y_~QK5o}9OMbgp+~tp9sl_xQZx)p@q5 z`D^p_*Lw1}F2>bB-NVE44EoJKJvUHq;O+SuSTwyp&)53?JU?%~Lk-mT=>>XwsDC&6 z2t6Z~o}u3CJM@i0z0s%WT@L3eP;d4%dK>85a=u%7klu2^J3uX!!q?ir=zn}A<6n)E zt|ce|S5}525rD7%X$lUjfO<|?d9kJT?m#R<9EBchpjJ7e`ha?swN422L4E2Nb;>pp z8<{nst~Ezla!6lU3wn@8+Ctq|;(vmEM5rc@s2A!x&Rqah2z?8>zE9~3R)qSFGZ=uz z$9i6LEpg!ssG&9s|($%FsaFTPlNIm`Gb5a-XspfX3I!eyHy@p+Wo8c%O0_ ztP1trrZrd<>buQs(4L3%m)xKaCeoIN+^75o?Rm(3N^#JhuJ2QpgO%y}PJa^}ti0BD zn(LtbTHmL12hENg7wY?w@t`Zz_ao^+d#L-(dtiIAHj(+D40TVb57q*_Ez~P#KggiF z&HM*7P&X$)upz$H6bL2TQ`Z~_9!l7J7KBEq>(U^!gLngp5HcOTue1UVowtXx1a&K$ zYUj)X8FY7%TOjv=bxbZ$;C~&rn_j@;A+NJK(-lwZJ^@cF6&ftQ11x~D3@1tSn?^vU z;17Rzef09p#qrxW=SMH!oV>eubM*S;4}Yj9ptewV&WhmD?=9y=u-1Cb#0b3{!yM|i zcjJ1w5&8tWHPm;I9-#)$wmz_)G9+Zd1Z$;8=)yyKOOmiY=uK%7%zq5M=1Eu^?6zy& zW2%HIn7u&wKWjj}Mz(}?0dF0PvsS_cmmO?AWrDrdYvoMn74WuDubnobZ>U>QNMD%~ zY~VMSJ0XkbTQhlr9;cW4yh9XXKlu}S0=_L>ube``z}aUGh1O8tY8C~X_*crK;DP#< z5-F4w{Pw97GD&q~xqlQI7uGvdJE%95PGJ?0yJ%qjWK<})?KYKD!3XtSCspX672Kn| z3adfgb83YZEZI%T6})TRb9RO9V6Q|Wcbs5hHK^}8#{y`~vQTvz{d9dhX%;|Zq6P0- z-*Kje4i>X}lx$%&sP8)8!fH_8b;^bIJfw5hh1|n&2YDBYP=B{hyikJrHd8MYpOqvVJNNjZDwL9LftwQ zLka5JOvX?Lb!|3=2B6foPX$;gJvs^v7=g@^0n{d)7H0ZL%qQ9JH0Xmx_*sgyhs=MK{M+qJp&dF z>qFftPSt@LeyD;Pez-NLE5NRVnnOB6{P^_8vPT-x0L2{6VQpJ<O^<9>WFRRbqs}W#UDR!+M`^HEJBrz!qLC zQZ8i$4u5A1Kq^oU$YO!w5QQsO{;EXn+4x}m%_u~d7{;Uh{Sn<)&ux9EC215@`|9gZ z6Ft{a`By^i<@62VGQh{p%2b7#N|fRE(>9>SRM%TWtybeIpcbObw3;L{(Ntk08%wvq zCNZe|wC0d1M@6xSU2(A2CSxC$QIs16z3KA_On(+j1$N2&?x6N-N~q7N>JFAs;s2A( zHwt>w=M$JzywNY9CWJ`20{XF`pN$-8$KMoitUQ4*ipY(zg3l1YFe6^51--!Wlx%Iw z_6(4e_jZ@d`~!Y9&_&He!e}$rI~0&>M2m)kqby!VTf3-k2XG7m83BGXNAf)*0uf|9 z(|;H-12N&5T#Z5i!HkeFS1IE#CyE;qf6YyF4i2PAa0+oG<`N5v`MCXA3&~AG4X~*&AcBK%2tRt3Z!-pZO$1Bwt^WD1NOB+-jBG~_V)IC`{tr%)})3W3#cWC zP6=Ho+@w2AhIN^>-S|f+oquYBnoxG42!BOq%Q&bC=dp7VX47&xDN|$`qZ^YlNJV?W6_=yQ3Xq}JL*l~hq^zH~u+67Q>9$b2Pk91cqSj6txnIcy zdqr)t83!|3y$jSfpWv_Wqqq`ko6Q2)7mBUf$StJ`>~ZV5pmvY)3ARM7ouGBUl79}i zL~W&AyW`A+Em5nD=&+>`JAGkp9dZV1mA>$nq!OXjRN&^K)>n?h+mp7MqL}@t-FYI! zmZ;UH9rUAi=h+h5d{#s4&QmJ3M6EV)kRP=>&%4+Xwc6Z_e$?(fIb%!I+Nq+wWpKPT z7TKCZ-mf%|Em5mY<5q#%UFU*qiGNxAXx zi)_sy?^hDbmZ-JkkoPOoWlPlBowfUw4znd{E1k7F&Y9T~wUu`5juUIPM6IPe<6dRo zY>8TJL~jAL`;ww_1E}4XJf6Lx*3-ju=HAy057W0!K8RapfnpA$u3nthCV$rZ^~$%+ zr?rXoemwz1gs+qK>^U2hz__JY=`DVjYf^pzC55w&&(gq89* zw?k`%JkBjqtIhRnS+rJ6HGjrR==G6ntQ~6Y2=Z3*k@XV%(=8f-79qys;JSQQJfyoe#B^!4>PJ0=a`v zYeB1wT6yP+sNKruRDL?6);bkRiH-D`3Z*4#wTVZ3sNI9iBP~(u#((@7f(h{}Wv?@)g z-BDhZmZ-JcwT&lViPdf2N0ROgwdw>dDka2QK1URs{tnYV{BE*5C^C!@zajKWNl{Ii z9WvLG%#)}q{JgP8uzyTjx3DM1_2j`sK3p{c`#x#vg?y-~)5(EAayDIcLL8rf#Ibr} zcsrPAvz2d8gxL2oo>9d7MuDR+)K&njS^=8sH$Q?2xcjqtO!PHeg~>@3A`T|#t`Vun zL@)H4v)7OZ^HMdZPvBL-p^`nNHmZkwDMBQd%*qUHh|=<#sDBQVQxbZRQT2L??xDNF zrhti6_)ue`^0#`~*C+7zIg$`^qVv20D6lIG0semU?#;_L-yfELlP{=ILQx=-#NxP^ zgmPaxRETh!hr@*_k@O%^m zB#n8)?)dfuf-`4`+uN1G%~-%Bt}bVpdEH|D)Kc6a1uWE4`djgo+Pb$76X{|R|8hY* zCs!z*xV%d=)fxJgUZZqQm?3qAHlE|5W>4z$>h=K@g@2ve945|v5?;1uT@~l#l!PxZ zqp8$dzD>g!x}C#PyidZ*@dC$3<_4<8M`oJ@ah8uls){mDPNqd?TvxQn?=$7^6Z?d& zanP@VmIrUsX9$!C>5D^50vq3O6S7U8qHGna@`~laW=~ zRDaFEgp!32ds8M|(Nq`S&~9nVJ*KB=vAXq72@JTMbM&4V@OsVB+mv{>2yW}VyCraY z$-7%hrfW8B;sdusF5PO#*Ga1@)PV7m$KyRaL++DF#p-s*k6VDTr~J50NpH*Gw#<3! z19$zLw@u!11MZ4R@yvhgw;x{Zg}FT=>+`)#nMx`)tUN_K&d~cCnAIR|3vNQflFPO{mg2kG^;yAm z*9xoY0Paz(QC;!f>iD!?pluCq=WzcFyk5ion_~Ej;Cd4ywgR`8YL=hCb$bcvZHm*a1GhFzw*lN0L$|uFZjYh2C4}06 z+l7(6Cb7`ItMVrut5A|Nr*U?>ZLw{YOfR5NCcZUdfzHX0*-+jlh(giR2W~5~NCDg| z4#&|&GsD093E)^4K(>6Y1_e{dzN6E!BkdY+Wx>~LSWMn3z%@Ss$W6IsBY#_Eo>jTN zt9VvrEUW)gtpiuhS14Yfz}0Duw0|*QUeyI)2BhVqJE&mw)ul+vF%gbucAhBv%_WahD_q2reRl#ZOifUCaNP#Kt40T&A{C>TdOcvl2>PGUlf5~Ya` zSOV+kybxZd0Oyo};xHk&Lw~fxiku-=Vl0@w=^$*+xwwKEspE6HWr&%qtb#&txwJT3 zdwDnO@-B@k^VS`k5I%iLxV^wT4cO}3x9#c{!0pa=3y^P^?-syqO$=EnPZ!!%KPwW0 zHy$s~_mLA@&moYtoI$y;UdEVP$;Q`t`(RDGX`fcLORMukhc=F^>_< z%Id~WVMt>Zs0F*p2Y==RyU*&7)h@6`u>Km>b z4R)J5#u@aEubTqcb$3h)uy5_Ualo#>V;aG}#p}iayZ(-81b_P$ubUFs)ptxguy5zO z(O|cUyKn|Ag|f-ll|h&*=joSJxUBv6Ax;)YOP4$ zqf`OyKvDGQ?tf}yxw30WF-aL<%b3FtO1r+1hJ4jC^H7e$SXy^)2)!Bu@P=>%_#89y zYM%ipe-rEr$Be@$%CZtn>_H~7N*@9#6XVwwU@q)i5x3l2=D6guC@srVrKjXL!v990 zVzmXRq%S}&R)6mkY7A>lxMjfq4J~a$w%{B2kKhU|Z+{;xgPT3m7)Hq)j<2#u*kep~ zCtloGI-TMV9&e+-O|T->paWi-8U^hlkWiGMSX=YeNSV8ODx?SdtqnyHf~9w-HTGM( z)nG6%egy=Bx#dt$*SK_$k46k}u}{yXhy49c_Rn7?StOynU*{-Vn6on(gYWVX!kxij zGMQXLHh&*H1a>p9SdKIb;O7AVYBHGe`8a`$-4Gf+SHhC{Q#J#@2|pHt4+fI5F3B~@ zBoiiNtWsi9dW|T^h7*9hGfc*V!C%3fx92B^;B6deHWADr<@(WnM3yMr0hpV5?g?QG zOW~Pl+n$^jCbAf}AoQ=9$1bP zdu-;6ZV#$`g$hiuH#;Ci5#r+5E%QA8Jd2UrI{k@lE1%5eQo^lp6)Q;5NDTxq-x08x za^Ws&mnn|;2*&`13mgmGO+~+QLLvt6G=J_n9t@81@Yra%10eY4(d$?8HHc5|zVRoH8u+UrAVod?hN~X>l~w6OWg05&5X?ui(+6bDTVSbO`=Q zQVEP%8zVNqw}$v-%lczm2rz}p=3=#-dnZI3;)p3(=lwgPaQf*CymVBxU$*9)C+u){ zHzWZYYe#(&|6ssTr0jFHuHdoXw@>6&p$;#st`^*~cF zzMw6NjTie6rt0ad6{R}{=X1&GSSs$=B}r}41R+7{1Zm3F*@1B&Lv^s?aZK<#p`~I5 z(j=6QEXffe2=R1^s2E8pXM=&!xuoaIY$ufE?G;(e5#%k;nVl9}P^oNoEslt~_ zWK%e38D#RT;@DzLJ9+%MHF^OPrGQ$j-7+8KtRKeVE}_mimSLmR+qRixgN(sDG*w!c zX!>5Qd`JR$S>&bs7s{_bC3K;Mt$$cEH|v~>lQAbZhW7XzE!6fa^-|@F5%hzBAn^=g#^W`PQI+7i{$OpZdBZ|N!;d2F%o3}=6)l0#|VwrA5 zUv58P%2ODD*D#pl7%9%3K+542QoKVDRfI~jY36~M;M2)8jYMmPd8(yi1q_MBAzg~Q zV1Z{8TB{*RqclB^IkBL29)CNCRUtq^2E%I@b8%$k`N8r!RvdmxqKMpxc_34pAUnG` z%@5^8Bl!J*B6)}p2LQMwv=5~)qXof3z-fx)H*>=HVXnKVM^<|(uqlSoz$Ei z9o|41<9K$MEqstt!2+VCvP`HeK<8g&dFVlwwNg-kT6>zBvGXWa=R?KH>NL$ea%NtFTHY;YSCssrWjbUNZi&t@ z%T8b%suAcyVSkA-MKL?R*(uaZv!jF$=Y|(l&xIy%DVWrPT%%9}jZ8OlYneMooO2Xv zR+BN67jMog8A_H-D}O@Qh{BoS*0!Z2q2ymE;A8ND$XEJAO{*1VyCo+eNiQSJ6qeup zzZY-RVG-H_)(3q@T}3iFW&tI$n*1dp;YbLye;xltU&7|kFlHmA*8Fuc9-L^Q%(fo7 zC#>pBxk{Nl2nC{7vm8pvWNgkip|b%1Ue#M29nPaeu)n7c#D81CowCi5?1mSz9SGq( z6ErXb6FAw)tdORmOy(kf%~L%~ znnq_xX@E`}JsPuHjkPIQ|6(G}D1zZA`!gx{qS%w7};|w{7v&i za7wUF{F0BjqtB+C^oC-N0FhC6QcN(4BBFvrq0k-QENs;b28W$Y+>kmE4DBf(MT+k# zC0c8Mv~iXEchHH_g5(Xl3{Gokdsh{UKP0kN#3kACuBogCISbsQP#&P3JU{(h?^C>$h( ztl@KO94mQDtl}%`7J4opYIZ(yTavt#NGpHTRDZSI_AtIQY9VAuk(hj_C1KE7tddwc zg_eIt;^;|3u5S;!VI-5ms$qZ9c%Q&OXl8H>+9Br&Oxt%Dths>earMcMH(C8MxjgTZ&Y zR)1}AtQ}(kv@`9g3pImDS*nT@EvV>gapQ{akV-Al8p~UUM{kXQ|JM{zZP-(Cv03?C z+%gu^OC)5+E%k#EO@asmLIJ}I96`FRB(TBR$(!?+Z%$r;8R8=~+z5st9bGP^pa=e9 zL?3DLQD;vQC>qZW!D6ZU{MDFlC5w&DF|0sU-ytpzhP?EdSF3_TrTO7l zs=bzgUEs)t^>8?|uXLJ{lOv&hJ0vV9eLNUU^!+CD3{JpIYSS|0GnR?yw6!=y49^4` zpK61u@(=hqh?WyxrxC|O#Z*%;u!ZbGtD1ck01)zK0S0X-5>kn{vy5IP6yDfLW`7%y z*cgf#;%PD-432U|mrNz#ftGpYT3Ttmp`e{K4x#ETzOrr#g94%YpShfnAg6qQy!jNX zUy@Wot4xW9gAsT`lmRJQU$c$+?SMAa`v#RfLeD8_PMkPxQ9eQz$XEsx%9mLtgv^G_BQ~DcN~m(;C|)8F&m5fRReGzH z5>+c&YAX{eZqR6H3>zl#pnn0?hD}NhPFBrBJ87owGB#S76i2n&KkMiwOgvN}DEiW> z%!FtsCmaiord0zwi$+{yThvdb%ow*5PP=m){-f) zS8Rf1+Sb=le}u1geZ(V{QM`U2sQk(b4U(ty5OmIT5;OAup}_ZAt3<@BM@QZA-2-;a=bapuvg6nw-jVaQtxg6h07IlugulIH+4 zh3i>B@nt^Gdvn!W@1XSCLdTxrHIL+Y+W)+a$mOoO19lyX*wu5{tw&ZQ#&QvDkHO1n zwpQX=QC1!YZR6*#@PFPZs>nyDF9m1#u*@DKnkWrds5aXnE<$y)&Ea*<*aShk{LJPa z>TXgupfqpm+r>EPL~lh*nO<9

gI_4vAtL*BJV;J>?CjSR0c|^mzR0C74D~7cdf& zzZWukk0!lxWiH&RT1E#?kT!r3n4gu)rx&7*BbI)B<`cN=IY*JL+@917uw&(%$! znn?eZey*#ScDNLa5t!fQ8DN;iQmlR{oeM=U!Eprf0>FqO7%r82iseB9n1fJlj%`ZM z{7l-Hm5-_hm17PD`(yK7TE0~*G#VV#{;bA$JXUVvD9Ts8RalM;57TOdUEF5&8aDTk5oV|h+s!EOt@!aT#)mz)JvvM@U zL<`G@2$3HTY zf~A&i$*W$77o~NAmn7u{ATklsB9RK0S{)O0qi`T&covVOUzvnx_ko#hB!m(eb38KN zh<_zIVuehcJ8~UNn4Z2^6N(t(u0X4Vq=bYSK0E3!dkRH?(ma)6ZB>I%9R9swKSFe> zkd(6~V#nAnrwADl+3juc#fWX2sK#?5q(eq_GXJCq; z;5tl-jajnxOR<46;w6h}5m$?}W-=K`t&g>du+)2$2LOs=CxgjQs3AEVj7ru{l^ah% z9ttVe*T7U!AA1Hc<;ZIXDVAfG1Al2Va}6lI7PUk8fvIZc4CSqk?~YSZK)-Gf^FN3os(s=Oqq^BJQKHP@bU!%H;|bSGNn3PqB*?Agi2=&0e|mdbOV?2 zSwY^b&Ha<4QMCKb!8d=}w)oGJ@t+Kgj$>8($1*d61y#m^4DY-|0W{H*X~H-~aA5+` zWXHS~q6sLONnO^LpAQRO6hvugo5f7o>;T1(VxnGEq%d+2k&8V7XPRHyhG!K|pmvc^ zsU9Z@f>g~hh1W#-e`0h4NPmo&ifzm|vc^+|kd0LCHbfWT5sTn8dIaW>flGv9>9vPJ z{?L8;$yh^kY`qS#0=*@|gw9|r z?O)1xBBcnJ^0^((t;d-dFKQ-d=cAR%S!OHdL{8XU4>9N&d>c2&%tr%%&EJeo){5-jQs zy0M4R$=tMR3tyIt!Qn2_{+wQ|2@! zy4q5h+6`(-x8{6ANPkjeHrH~yXnb*r7{5rU5Mlzvc2$qv2WE(o`eIwaVn481APz&w zp=1SqkaTpZcEzXz^!^=!;Q|3&a*HU_yMVop*$E)nE|pzJGt+f6B~;3Wg7pbzjebp0 z90(z1@GT6kZXgY1kb;!sRJ6YKSk6*NVa$=_T?C|3kd&6XiGSiblU%=6aRWwxvtuq5 zlhe;R1XZeNcKxPEERHmCOC2tu=vuye&D>-EG#2UuTkDb3By|Mo;mY#dDcgaWUJQOI zTBd8+A0 zUOID?3*o{Y<02RM?YQP_SE^QDQOiY+f;CX)t~O7V{D1qGU(Jt8I!^Z3Nxt|hMLMaZ zF8WQA^Ds)DlF762o-zYH8z1O^Y(d6MJzLWq^mVH*(p>4YP4T%Br8GL_ZjQf}aWgPp z7WFyV5pyXCin(R*2W0w58w5;T1Tw-g6}zmWVK@j*_V zgd>YPQ-63fR?IJDh>D8=#a!}1Wo}ac|7?7)ySF!bck=4w=`z;h4(@e~9IoYLs?A*#Qu|kMJdhbg7oF;>zG8!2#RVO)sB{3v5SV~~DM{n7#(&w>-uhy$4)y0qgRIO5+hcI5Ps9RV zA;40qAG2g`L-TCWGC>;5aGqfneLz8~;vV9qxkjALkcZ^`+Zend*GN_--G96T4)zZA zc9h}d`XGyM5LfBcWIdna7_&JFy~`jLT(5z+sd>sqWIEz=G}03K_Kru^HGy9gu{7fO zgMW1C)e5uIARjO)o|HY8P-2KOIzaty8pi>l3CVA~?D?UwS12(?9503HV|6Nt4*f75 zkc1$OqM$DzMdE!{ z5)gdf@4I{7v!A=qInU+~yadFiO@Lu_oz-l@ z%dFX)vH9}_OjHn#LG=>)3g9Sc5Lk2e1co0PiWQ{R@o$3hrw5;X_wzaeR(4LJ=zo9o z3Hy7W{9ECC@|Kn!fbHgQhkx3UvpW$G0UU!WoRlt^N(v)t%>`1)|0eP$a3ki%6$Iwr z3)p?ng=-63W(fkZv^h@BCjLD6&~TH0@igZ@@#9s1qaDTw#^FhGslqfc4jfDm=YLBT zScqtx;EZGTjA=G%_4_rlfE5RT9)FcMNB0$EAr%t14J)AsrwZC;aO7Z?w0- z!}IFSP+{2ZCA)Rg21u}!ju2;NB*uB0FHtQ#b(YQ7Gl-k_?gfA zn0GgkPGSL%pVc3;n*&FS1s3`DFn-TM7(-tm`tzqI5Mf~0tbaG|g)iezbAPumPlw;^ zUz{fVlPE{Q0;Ax8!o*NIO@HIuuey;ek}d(qBC)iDLi;;?l)rehb70fKQE)(5u!2HY zVN_ZuOCSsXG62nvWYd{|!>!LGvFKq@B))3_zz^!8jUm9wCt54IjSaqUcoOZww_QqyP4?bcEp@A#XrX2ZG8H zJ|6&X6lxR+=#@#2q|AQQ19-MxOiWD70tcN+0|(9XI)8`Z%zj7V{(nZEnbSN1yFi@X z*envzGn=#^<(fY4o0jux1`s1jvyvPJfLZpRAoHI;S41S~fo+0GgwQ|s00T$)&yjcZ zwf^yxb0Gn3-Us&hpc=3;3+DW3^!s-?_5t z9ljuOY#wz|OJ{*+Ea-|%WwO|RBzg#=oB!gdd)q7k6b3Q2Yi<;#FYv`i7f_sYnXdDF zsQGGENW&DintdrOp$vcV52FR9HHd%A9mL;-zd@)_zyvQ1(3$hV%AbH^&brQ}Ezf(5 zKy?bAHJfTiBMNqa9@w5VnUg~^$~t`x8)S#t}GC(Up5;7u)I94#8j${6_NB=K@zjdO}j09*}X0L%)FnTK426|w$?3>KI?{xKs9 zjGJXw{2hN_IsHBBmPitCYk7bgsPu)utxia=cGw0~X> z5|KrU4W~yk^%+qFT|N_-Ok!#YauaCaFkB>!5Db6Dfyqn~D|jC7WL_Z%{wRsSX!Il` zz+iAtP!RCnzv6KIQ&9Y0hr2gBBfWvHEoXa{&;`#cAP1O#_WUF@9Wap&#tE5j^k^EG zNo9pM|mk6jIRd@?(Ny>p6obAe;RTTK!w;5v)5u0wp{$()rtZ^JQr+ zR|9`o_67d%?<0o4y}^Y;25%MyYAyfvis%0F2kUkAz5R<2)m)N0i5~->&0m|3EoYC| z`QTW%LHMQE=5GodkqDS4!3zu516$GPd}~P!2ln^xVrhb?A&w0wW+7b(#|K)$BqqPU z5Ff?}5eZ-+gphoG1wUX!d{UIq(_`rY5T1WZBe7VnOgf&V#~?AO{G(nvjmQep0aM9f zQaA%}CZp#*@#!|8&?ccS2R{>JT}lh;`^JFikFVPP4T*x#Pag18&& zACv8M<|QY`Fv6$=Dx04{%>H}Q>Oy~Jve1kP`F;P94Jw2}G(k!B1)q7CHyg(9Z(hvy zAxuA*^&fCTQJPr&;jrYNi=@YMSy{D>_5zrfbvOV z1fx8(epjaWhZ>7Qzn8tR)C3^!fA=!Mnu3h~zdPCCbk>|bp65Gj&3Yrug@u2ESZqO| z0bzL|0mpp-heAhqB100I51|AF&HH?;z<&M9Peg6`W2xuSz2=JR3*aJcwi>m-N(u|w zv7)JLLNJNQhZ=kjffg&g9e0MV9(XNB+=N+Sbi#>faomjnV%bm3d2zZ1)~6m zZhp-sLAuI)<3CMGar zegy-8Lr$i~0Cw>|e5=ss#mx`x@@tII_?ufeH)s$a&jDKpKWANt0M=Oe3gP+I^CNJ=3C>lM{sR}!7XaaL_MAsIk0%ovi6;@*VY8jgk4WhOas$@YCE!>D z9Feqz@4?UW9E7Fv1RFv?e6gYt!6YJ;{pVl=z)F)(q7wSk00b21WUYD2`VS*x@MB!_ zW3PW3f}nd{U3PyggR}*3jlsH%EgIW)sL~m#=3rI9CR5b`s{%U}xS|iNhW@NT=+E0z zf|XT`->&hW8NlqM{;P*Dn<0mx5=b<_8L^==VwqG*FdM8+pfh4Ez%T93lD(7Fg*jXCeT1t_$O5@3kg1M!o`0I{SINJb^duTDTY8|u!Yr6 z7-3X?cz@393cJwbXB-0^(D8z(I2ah^ECvv^0^`^cf)c1~Hp5(BKRP;E562&+9-T?i z4->Rv>0{6~NM{eEE)39`SXvl~^*dk$>^5N~X2Cv-25bqA!W2fes5E{F87hqe_(x=R zG>%DM$gf%edm@J4&uyI?)R-d67J zR?ePiqzBl=9c<&`Y>W0pyEuD*T~J^vXJ4=*+SyiTHtm`e!w}R<;yYhqe9Jsr?{N0v zvq3AN@g{)7a5PFJU@j?u38e{Lz&R9&qY)+e1z>-L=j4BzjvnZLe*Ulg5wOIl;S~K@ zG|Bgrbmu%J295H+`V0dD0|R42L;n8;1_pop4>N|D7=WOLMn;AvP$MHFD98Y642K$n zzy|*{Q~dWokt{Zj2{QO!e%7Cp`#K;Tw}rVzLl9HwUsgZT;C<0vGWutOs~0|?AO(+NkQ z(%5uXu$G_&iH)NO8lVhtxHve`!`RTqH`srN;A&(RDtxLC3k#Y-VR~kIP^jQ9fH4(Z zCX%A41QKu+j)cH%ghPkG45-4v23nEBZK2dyG6iZx$C1#%bdx|qCp28RuoG7tg`^7= zbYkQc?2I>KMccX>KwZO)qnWnBF(KhmI3|Ng@rJw7Nx^QcxL{w3x1k-?!PO4}vxa}b zP&jv-DUIar97e&T;-Dz9wJ*ce4`qsU!32AG`I&~nJn&2k7G*-gLSWVy&lpn^H>`Cy z#VZa1LwUQnu|m<*5F0ur)He?2=?07T^?|@p))b}@%FHm%hRJkxw;>?CU~s&(w~L!m zjAMi?(u0O#;iK3g5SXCR*df#pGjJH%p$ zWT!|p%o}FogQP~dVBA8;BzsC&u$QfuBbDtPZ3Q(7VUQh7fXVnVAuyB=%E84m!okfL z0z(mkZQ&4@wL6mtfuXQgu4HDolM@31Ly^e_c7`@ICkollG>*+AdNFX$R#bl))Fm40 z8RO~`1NC$Ww~6z^BaI^2?kFfUB!UoO$YxlRpkd*-C{JIQhm{YCWkR%bb|)EAvDTq< zI}ZjMO0l;``I7wb1a?TM0oyG+HinJzwnt;o6c*Xb)tE(bcK2Zfd;8FxeWP7%py3`g zH!CB$feFeW)YO3y8)azg5o>>hk2P~(#ag2s-NS;7os1l9LUG180vsNJ^2XXnVdI<# zELR6B_t?k~SeRLOu%jQ&K8)cUNuv41xW__Z)+`vEhWDd-(tJ%&G$MoI>&Sq^d?TU^ z@!lk+TO5v!_i-n(=rlijW~>Q`5aLRs8wQ7m5PTwIX(%(O3(m^cmt=q7mn1wjn z8NgwoRAh`5&7JA!i?zo)hM+v0&_oAAq(_V!1co9R`$D}993U`MG}hCG?BRiOhrm$4 zI2=f5s5`?u0s^y!xkV9d;(P#+3$c&1b__POqxc!)B0^1og|jund!p=dxM0U{dN|zO z-3$kFWkmX*Ovqu37;k^LG1`a9W>P~VZQ#a+a8hKX4csQyFal4C3v=->gGRXcMLI@C z*ar(l+SfMLE0P??io)2%FidP{rY>Y37dFwA2{odd`k46`U@?)gu7;RUM^vl{*(1`< z07i~+#o9rmATU%o+}areLz!AZ;5HB#YIaxhw_#d4oV;5ZcztGbaDb z>m9B+V=o%MHQLrwE#%ddD|RBSlkV3M+i|5hjA%gS;3vbpfI(XnIl z%3F`B!7vy%Rw&8uSoaYTWBi%^4K^4V*EMVRp8Gsgx2QF1cjR?$&*cj(lANKa?(~-E z$No0UTMeC-ASQomq;`$$Q~CKeX@!cyfddB)DC{NdJ#gSaSS{4b*4EazHxI0;s(PG( zStTuf(8*N&z<~oz>WVV9wzfo>jAg2-s+X2EibzXKcPIRBbeo8e&f4PAQo{83mjmhP z^+Vm4p;1FVl5z$h^+U^eJl;T8<;EA+!c&jvZmWI$T4{gJo;{4{XuF3;bX%{5Z(|R2 zN%MF-gQFNZgCI~t`ue1Sf#CZM4fyHtFHKENTdCBt(NYKV`#k&A({S~SW#ZHCa|5#u zA5M^mlfjyrOAE{+_ujf?QCnMU5d0LJ_n7>sz+zqKvvV~WN)}lM5AG?l%Y4^S=F#-< zp$!hVL1%yM^4-VvYinz*``^Fs?I`mwjT_a3!C)1H#+CQ$>v2!=%?yq|mNN`qWo={A zdd?RD{@e!?FOOG!~C>d1)`8Kj3ta9tI+n74bxS1Bq= z9%@dQ{OjXJ2t>4+H+9xyxVgEx=7{b#0}gLz9!7s%a=o$SdB3aH42FT_&k-9Uk!U)m z%+wjT%kJWSewSC_hD3^HA3AjQ?&jx3c2bxEbJ@V1-$Z#o|8g1pD}?>+9Ww02m1P%i zf0wu!J)Ci2`z=*N!!^f^!?P{ZKPAr`R2#R;F;!O>IOJkkleNKy(X!=X7}V6}2hP0dro6*fsL>r1)2HpQ>)+{?c?`d!|cBrb<1-`9}7FE@8x zK-?fCtossjN-e4Db}YQMw)XAd;IhlzX;-co4jx)Mlu4{al&@&CRXXQ;S?o^SSZz_J zWySh!+mdd4A)H{{`3@bxlX`spD9HfJSV!5reZ{Cmb$3i{?>o6 z{=wa&O};59DF)#$3`NAmRH0C}DMgzgPGlo*D08M$X?j{aV;QJ1Q^juh%^hiJ=^BL5 z`4bKf4y%-vGw$8nTFQ~S;Z{+dNZ?!}a8@+(Xc3c8D4{`eVsaAKb2q-NR5N_|&7Fac zG8uBq3ElV<_bzUHMRg*MGhV~J_n zlpDH8>*5lwGdX%@>UaX7wUS`h-`{V~#oIS#sx;b2ZArKq`rLtg%5kWrvMcaQ7ng7& zgrjGo{)h~JM7}&KuZMe-2R)FIl5J_@-NpT@qPiN-dD0g$bE6|~>C&b5u7!WUEN)?F zX=!Ny7UCYaF$(dp$LvfWpZ+m<9JbHu~^ze6&i!;A{`?hO9fL?sc z(s7N{nMwruLL0ZYF`*v6=hiKY?|=PO;u1k!r{}->`0?Wp<3Gz!w~LQA^3-lva}t$h zL`6kMe*DO_+*dx>RLcc9?r=rL?2Rb zqnL_Lx2ufXWv9L3;u>u~KRf@eQH5jAwK8gY{CIy=Rn@5c%6i^t>dZm4qH#(S6w2(k zS2SbVPDz#{&_07sj<%*@nW5I@RrT{hVM>0Pf6Yi;(Wq!)SB&QqZE=R-=DU>3|T)lrbO4f><@$oq`H8w*o@k5zvWv>DuHfhOwmWaQ5s9$~9a$i_h zcJ|(rC&7bog@l>1%$b8~In!s0f97>n(N!8Ul(gf;x@#WlSEnrzUun;E(;sRv?NULz zS5|*ItRka+Xc-!fZlh!=si~{0Zr~b~oo7q_Y=Xn#>|I=PE%yy+ z8X3t-OG~#=I+jhtmB;O}JwFXQKgdXKYjZaYeTJEmWbSTAU*Fe|zP^ppkuoE{Zh9kn z)2O!$squbQ&#r$|3OC*hXk!^a^>%u=I@hwuYpCTqFrUKeW11G~AD$GXc3-AAa=%qY z4RtMYYUh0~ZO_Tc>7D$@P0GxaN=Zpk7!9S6$)`@9yr)e0^k8(by)vj~@gO{;p4Y`y z8*k)|qPn3_T&>8^n>*X4(yDXv^Cg|y-wqFFe*gZxyqbUaP``R>yJ1XhtkHxhl<{_} zqB*-Mp!8G2h3&W4zZzhGELS4NOHCeRBsZ#X6cIC{heqW&XTR4MQx!5)5CLP)bM>~z zy-aNmxvHwCcj41;dPW9{O4ZtZJg{x_`}e)4sWE>&HgWU!-}w^3J$iK6+Yc&1eSLlV z*6R8NbzgrXU61G!b8vM0_9FCRFXGpv)XtqdvyL6x^nKb@MSP{=Jr9>Hka*PjE|uv+ z_jz61H<}je%DX0T`KA%pg1Myi)+P0wuXC&aA=eL=h+g7!b!<*DFbgDbCWk*&)K{|i!^-Ub_=cMVbpQg$?hM@QF-#>Zs zBl~)WQ*)FQ5cM*GuLv3Q~OA#cVOY|+ln7sxQ*SHDT`kHY#(lGYXgDEm*p>$ zAD2)4_}YD0+|trgQ%5JEy1Lq(K5&CQxO(%JEhQ~yWQC@seLbnsHYn)i=(5O55q&5T zQPINd*X1lNEhomF2UZ5Rs_qsT=`WMe4QA#CXjAZH5zDh=B$=S}7yu7^f zYGd}m)ADssQ}yrqjP*#CVvaIjBDPIJ?%lqE|Ei)Gk1k8ekQepbG&{c7lQK+bfw-&_M?yt}_FCN{SBL5_CU zt?1$Kz!N)W#-0~a6?XmnW|y|!~B7#;mCE<9*>rpK2*b_;W<-<*(v74fQAmp+ivJ0P;YN9wugmj$U1f` z#jOa1=DKMNwZs5wuB_TZYm2(qIiEerG8ztCt0vp*al3fOeObmR=f8h{Uc<6%BuJ<)CGqUKckGu&3^vLdl1A#FNREAqHte00HlFh-h@*ej96TdW!+^H>_~f}G zs^7?#oIbs2W=rQ)9A~PLXP+%S4e!qbf#`I4|A!9_Tq`3})(1&*_5e6O(WVkHgXgF< zpP7-5!hp6OQg?Fo@=}i%!+N;8@BQ%jxFffB&5#QR7#kCSHAp0K7S_DF0Z&OyEm;U_ zmVq>Nb@v}XzFvRN|2jB6#nB@AtD>P(-Pq^nB`y)0#!ICDfoAUKNg~uiz@85X2(Wi_ zJY-o9DLH-m)b?9ZZIlBz&Lu$W_iviHaX;@&$7PC3*qhtFQW$QpH*6FTvU7b<@cA8{N`JuknpbBc8Xx(M{` z+qamJ8u5b#1-kJm8ilS}OgoB61aFK#cJrU-n>| zXzE(sY|DDrwR-+bIUG*DMYQwOn(YKmMh)*%;*43M_K%O32&dfHY{Q*9cUDkZlm|Ty zk3Tl)Ica~Bv@*|xeqvP1fe(EZ5@))_r~C3ip#06TtK+A~k-@>57q;J0kI!&VNl6KU z9UXbaYUzD+6yEkxGkL~Har&~-bg1cg^zueqqtDMT+64uH1LDW9{&#o!PAP8J*3`V$ zQRdNlF%Y2!fuOmBr9&6Lc5!Dat8WrGoO-C+J}H083DA$%(JH5%3sP!ptp{0b2m+zv zaT-%I^P?w|^zaCpORygr{@TUutE|37;6yh<-BL*pj}*pFkIQX|GhC^>Su;N4j0)$c zw6wHz@be2wNAv^r;xinBI8_yhj|5ItMRj!})JrE;m`cP?d(8cHduGZd9mN|Izs8;;iJu?S&#_g{5<^`W@v7DCNuwg@R#~JBF zN%_6^@7t1ku6X+R97sqI0Zd&)UxS?GPE&v5urBa?kFH{$?zU^-&6^ds--<#$zpx!j zZByIHoBU|X;oTmk8a;UUur6`MdV`2}wwu2aaGWr8x6 z-LhczFU8~WBkxl6PdObomNRE-T3cHiP@X6P9%*BS66@2J?(S}TXXl1|GuEors{wyB zdnNqk+Ks5RdnvNoSvfiHJ9acxcB!E8oC~Rh+8XD4(>?wDL|Z$%ji#n@1s2hX$B(ba zsLM?K7|v{JvVU~UX!%*M^R>^;Z;O~1!4b)1RSgaC8#it=wY1ow(aS(5i;G1jCnuX8 zKSnw`uY|$jK(nydH)XZGFWi506fS=)FQ3etnI`l%9SnYT9eR^JxHl_n74SGSGkG&J zv)by7{g|OlwMxYE8t4XKOWI{9);uY&kXBL2jQ#5at~Ozr+~ydA+S=Mxt5$&m0|R4r z?5L}&Tk`n02_TfmOz116q@;k0&!4Ybv}n=N<;&~d*6fp(mE9lxCRY60w{L%4H&_~% zE?r{uHLMtP$zdM=mV|;)l#$TX)~;(hxX}&JI1)F&eD`0$RDI3Jn;pY|M-=npb##f# zhIRZ%gU6D_gvG~9$ z#P7`9RGoc+nd7~SQE&(@XkC8;EhKb$Pa=5Vq~@CWnX0qTQQJ?CjE*K$Rhbw%+1!fy z^0XYQZ5aN-bIOppi2r`BGB5)jCOtcsxVX5esjDx(K6w%ZhC-!JoH#Kt_4y*CW#c{q zM=g1#EQw$(y%VLzk3^Jm6lGH0!d21yE@t}jTt&FjXgttvP^B?Jbs~Swel;LnF279G z*VIsKv-y%S)d($IYPm6+Kk;@%#xmrHJRrx}U0hxSMssh=0X6>4waTCas~yAsyD`s>%P6V<<_ z5!Y|sDk42R68!R-u6cjd5MZ41FzS+W2B5x%bQ?C?5Kkaf#!p8PiNupvu6Ry)K$Q3c zk(X&q*f;b2p}xI?Lv5NoeASvY3C;!PHLqVQ;cz%P!{Akq$Z){-HVS{v)YNpZ zwa6~wQ-@an`}c(v6|2^!ir#y?4u`{S`2PJn<5P#0;+D8I^74Q3U6lm!ckkW-#vt!8 zSyI7pX<=bu@UwIBJLBV_#HLk`@}Nu5Xmrz)Cu@018z}tI+*p~h%)-&drSTH!p+Q)e z!RC>BOO~!&nb=IM{WFg2A^ z*)_2N27~3tNtu7G1zv4SWCW(`%&Ak0o12@lfhRt<7KsB0K>zN9{ePiyGsvcaejl%!<)w4Q^0V)`sgJPwW5;S#hzN z|E(yesdHjC;>I>TyBL`H_H9t`vBW}~q<8Huh#bq*kQ#sf%@z@uj=C1aue6B1hMI>D zm+RjdU41RATQxr0ChW~^c^nQ0=-KWtl%L zynHfnaj<`_r0wH%k@4u|(=1Ei-{~ESGDb1KW`0Br-}!-mafNz4ZmfLN>?ZU51KHc- zFG7P`Pl>M8573Fv*uY0b8I8QJ88fey8f}f1En7CwUMlq_rf&tQ2h*>EL?ZKy!xa`U zS#mHhPcuGaLj{1l#v6H`GG=CE8%1{aHD(q?55IpoaNxjO?lCVH2n4cJO3E%M=wy3! z(ksobz`9Dr%gX9R0;lTw&%8V+LG0(xpB3~T%R!IB*P@35*q=IR;;gE)Gd)tw8>MFRr^?;dSF#>`3IsTH~Ryv?C&5|7VHW_Mx`riQXYh`8S zKv#d|MkbS4>;f(BYs~B`Oj53WaW%B$PprFMhJ0C`d>O#k2INO_wn!wJTc|zM65G`i zSc&);ah2yEf)NoB33_=gyp3}G@ZrO2Mh9ALrX;rqah^2tXgJQ3j}8D*ukg_s85!A1 zCZ8VF($m_qMJXU4KvQ2o*Agi*eTW~D@*aO|86ni-EAPF2tu#3~*;ab}%JOx3_Z~lf z{QmA(+RWe*z@zssMA&2|@7=q2VtU$x3)~UK>3$Xj!D5fIQ?Fir*UEJP=`^V{bllL!Q=fJg!tO%-EjNw{tpOU=w z+vN(u486Iter9UykmbHly+P-~2PMbA9M=uPo5b$k zz59UocEfy+^Zva(OTN9&4RqjI8QY`LR<5pDqw*_ic^!b~_h1I=z6&$-vPz23n2}?- zZ|Lp&+`xuCOT>#?&a4}!C<6X|S779W%w>m~6N-z~2H{OBSIfvqD=X{8qwarHAo_wh zYUp}ixknu4@ZrNJWB>ZlM#)k#qPB^UNTh|4PlwFpygWI~F+=o}{!Zy14{?tpAu%|fo0n?7Og>Qw53wDjv0lj$BUV5?Q2Mn06-%= zq@I@s_|LLaXOk}x-o2z(*I$2bvDA)7?UP-z28=)iPDyV6)Ltre_ZM%+Y-=;+>01_p z8}MIW-N@Urv0-9sAA`CF&QzqomNs_iT}H`rcEsM#wz z8?a?5j{o@KIdD<^K}Pa28TFtaUthOTI#TQLd#bAu&n|3FJ#|Xe|L%WIc_g5%52Y`+yX$V(>;wOsGw5-O^1x(On?%AB7OKS$eL+9(~4&d$!A z%S+vnNKti6-tPST{Feb3ud}id5fRwsmgeRPB_$<3x1zp;Bk&XN>Qe#7MnXcu)!#pj z^J}{2so{zi#IMblE?s|8vvfMHWXb@!Y#BSukHMH!BIJjL)yGR!9%LjZsqB)|aL&)N zED8WN%lU04SAts?Kg`u{?5#_3^YQT+`{m7n#?OpBe`>fwe5K-6FR!&XBR?lbety=Q zq_S&wZtl7Z{x=qb?46wxxm=Y84<3vRU2eg@y|<_7$&-dt$kczQr;y9@5uAWe?co)K z#*9MN$0z((DA3h|>6Zw#b#*q)CL{j0W26DBe*5NR9We5zbSv>;^Oj009;y5PBY&6j_kU1ec#_d#QwT<@+9cEaroZT)UGSk_Hg~v zJ)B=kbxBee<7%kK67%xpKqfsqjY6O4_}^rgg~WT`&HMV(=Q26Hqcl|J4kGYQkGIUY zcXS-*Zd~<6^`VPjJ$K%Hkg-fQcXDd%bMMEGN#DPJf60Hl*&WvKu0EB%V=msAA&hq} z0v$biG`Q#P7R#xDjR}c~wINqkEiBdt1O%9Jc$-sFQ*o6(jFGoi{3@^&vbo!>H24o zQ?}=^Bq%U`tTXWLnksy~gr}#c=bgNil$46-;WsbuuA3fv9+-5RYRVp11p-@IDqC7w zR>ixFOCf$TUS2$&m!~;KePO#l8h#lut^t_uJ8pkb7+WM#>qq>voC|@~8LW>_dNUEc ztyJpZ_Fs43y~F$8WH0kND+^+Ld2!Wz=EXWa|K0WY%9nSZTnl}!hdHs?cPh=VvijDq z7eg)Ix_Vx7!pAjix}i||o6V1o897c#GIv+?>{>s3clyGg;mAr#i}L7~m)<~|H+Oar zdhUP5|LtsM?DO;1D^!m`c+;YZ~E-jw0);Q{dLOFL}2Zz!najGKRH%*e@6`LSAF+CD&8PM>w2gf0T<-yYeU zjZn&EJKC$3c56pz|hff%bqWEV3zIg(KI3>Cym1Ofrr7fVY^)7bCD3k(SCejaFd zL|?-OJw4|s$&lSS+TN<0HaSd59jvIfs zQMyE@J^1$cQ;RDBKm6v-Qc20ffTbKPqUrb}8XmXDVL#v!ePTi76S@~ad&0*U&G zLk_tp0p{^MqAqIdi&)|`m0y| zgYYwAlqdOCNh_6#TNs+-rGY>fR}p`88OuPyv*&#$LmV6&p5BgSEkFxT38&7SS<2(_ z+9<9@1s2h$h=|HjdFLA5Xwu9~KsiGB(YTdlg zQ%s%d%$PAda(4VoKC}>-D$0O%AJT9+Men)0 zbj6DLtD(<}TihJn+@vw;GADL?HOn_+p{5iemGfu=y?JNIGgD(rB_)6FpS^fDxK=oB$H=eD^0UDk4Hxj4SzLN4*@P;q4y{k*=07=>=Q3( zksj;IM5wB&F8=c3DxiOq|IV}c^tLY((IDfpdC%9^w+Qbay>93p$db;OIlPb5ZU#-Gsb|s)lK1UP*W30S1_v0+F*Z^m6vyB==c$d<;xFd zW$iwB5^P9&C0Cau)tI5qEd@VwWPZAixEcz6Zrc+hr(PVK9;b zJHH{XP}{|9l2(5r?d_L-cyx51({bb8u1bRQ9SsYM_07%Ad2q@~Yin!3ZN3)%5`X`I zv`-~o^wOnE3tUjsu4EaFto;16fq`HVaq%M7$0rOHYhN?b`WJ6TT3$Zc_c9sRS&r?x z8L7Qe#WL;DBTRpPKiI@%-Q?t?rk2(s(BZ>}!3c!PjT?VAnwp!f$Ygb(+4*f%`1cQT z^2}K3sv9@9R&zLMie{_R*PEbn^|k{}>cBv-nuf+k4Gp`A=!ATJP~xMxsk+GF+}ysV zgB!bUur%KF^#P^=lV`AKpSTpt$474Q;>B-2e_l?f(_>;{0F1j-QquOX5086$dl%8^ z^ogk{RWN@Tgu~(FHpdv8I(2H~iN!Fm=`5nZ+Io4drMZRX|CXOW`Tzfwy#Lvs{}=v0 z%*4p(5B|TQu_63_`2YWZ{QRB&zX%Hgfxhwi|2u!i)$kyYh{k_8{~rp0Tfq$>a4Q&0 z&&(M5|AGJSVWb=8ii<;gpva^^Gc%@}VGQ-Zk^gVv<@cNaPs2yM8^wgh#QCtHp^?!{ z&oBd5H@df9bfg;-YwhhDPJ+Nt1ZM5&jABQiY@IM3M(*~}9*$&848_OMjp-Bx zW5IuLCcY6)hOstQE+ltWsI!5cQxpV-B4Qvg6vh>8;9R<^!WhMAQw zGKB6!v!T03lbo?^M>O0$#K{ZgW$hR0>uUg|Lk(e05Ev@VI*uF}?qn2)wr0mfx)I3k zwgeQ)9c34VH?;Sqnwr`Y?a?F{HqP2KoNj+(=<8)_VC4~RZ0qL;^KuF|@?wWax`lD%K_1gy0CZhe4?%V+hRJ-3kIj1)CCFB5YlJ%)IdKvA%9b zP9_my)L6DJ!PU(RXX3$faSo;XIye)Z(QYv;Vr*<&WV8Xy9&c|GX6?wfaUc@I$i9E9 z7&kvQ-QECZY#b6|6^cbhP&`6H;8di&qp>LxNrAvnG!`rzZ-9$MJ4X9D+hAa58z*Zc z6r4_@IunpcCBW$b>Km4CUbmfmxFw zFzaBa7$1g-iF%IMUb} z?i?AxGB9z84E7~OI0W0Xohae%cJ>5(1T8X@0w<%eHZ~BLbtsZ$6zsx;yHTxCgm97@ zoE&KvP9fUT?Hmk|1X~klD^FugL~N9i3C#maW)e)O&PFgZs*{PEiLI#voNNz)Sx3i3 z7y%>40)qeVx%q`1PfpC|=7)cJdX6cGjhx^5PRm=}{9VbTgIP8Kj^4S461)A5`ke{N z*c!aFD40wtO+9_a&ce|HUbkFRyH%29uk}~(`x1l88<}QHH)Q2XLY=ls%k{%rCg0+- zFX74Kk2u3yTIlB|!3OY_x3{JA;dRRBY_*a5GA^6Hsl7xmmXJ4;X)>yn`3C=*yfZ1<<|Necjp5Dr3%a(Or4PD1% zGF`WA)1Eq=eH>So-5!7cYvzYN8eQ}121{B|F)iRuT+Pdu>w9~9<+j8brlB^j)$>2F zV!d(DkFT!*w7F}SrE`J#{yt8+EL7FhM8x(jN?oUq^7B*JHPI`c`$0=jui;67MPQ~Sr-tqXl8%uWT`D9G-lL`tLy}uuPs~Um=nev>Vn?Ce}8Lfdv7;|TmPiM z0%^xgQL=~vZ{DnEX=!Poklys*!D^*s&%GrMx|eWuVv>IfhD(3+a1g6yWRQ&!WeEu) zl8UCQ0MPC3o;_e%%+SG3c|6S3xBK{{Kw3#DJuOYLH6p=0ZdCKssZ&pHuqfyJZ@9A+ z-8GMFdfoAoUY)*;en<8)rKO?stT(dJ?Xb4@g|{WS0oJ#ozEtd-WVS}w<9y0HFia*a zaivmP*>xXUxccT2%kH~J5=xy5 z_Hwx@T=v246j|-J!^4>>oS$y&HLG`*d^){)_3D48mnkl5)~!p;IECK7fB*H*7j9KV z^r2ean(BSZX-&a~wZVod8NF*yV~+0a>hfuYHtqK*r=6zv+?^P0cR@BXw5e38oI%j; z0l9uv9jpn?_;_ofjd=fu4=EY%j$FEYxv+iEH84=$T*6G=v2#V+SsboN|Urh&_9@<$htFtzBK#sld z=1udM*x2L@E9YAG&Wa}m7JVPNoV7~(Xs3#cMPA>Glu_E3zq_Q|O-94{{0QYlbZ>>85j}sRq3Hm1qLZ5zSzP6g(&pPye`r?hYA zzB~5D$OwZ-p`>P5!5%ag*Hj=K3}X}tF&+Eo;$X3|MGR^@3wr19)7a|oxSVF^MJ_6$e8cV z8imh4f3XZ^(P(-P9zJ}3piGnX;ZaRC#L>19Y*FEf4SR8g+Eqp84#;tui7FsS|!D(Nw zaJsbA=Hm0B?YE);wWgq;;JSZpTWW4V+_GPjEu53jKOa1Ja6|ueP-XnM7yZ7#0Jo@>$6rewGxD8@b%4ri5F@U3A{cC?lUkzQGp=6Pj zlOuX3AQR$v#OI=8w%WOERV&x&2dw$2G#RSloWFJW%^jrRC7!cMT3H^G)bZtIRb7z5 z+kw`iksm+o;^Vh`|Nb4=+P`LoInUg;#7`N*;P6Et?~4KT{mqA@Ra7$DOI>WT`Ao7i z7cVwW{`E0pe8?B{{MUam9c}I9pddp9DE-am&tuA_3{c!1Wm#F-rIM1Koid1Az3qE5 zGcyO|h~h`eQ$$5YlQW*GzO16#F&GBrXU`Ts|NN~^3K7(Oi4-$@=f_B2Cc@8gtdzT} zcH&##`D&hHcEZF&jE~OR`;Cp;5XMnMKA{IK|9S*}*62xjlHY$lblXX4#o;4I%0E2k ztuK53EB6?otUT|Sap%dCU>}{ekB-8{D=RCXejYQ8cqih_wG7wA7PTHYb4K%XxZjmv zX|Ia`>7PD@V(<0(N{cl9Y#utXQ$)u|sE&!Q0o-J;?a@Esx0XCj}NsbxBfn zVa8`Kc-|;0U*~^_t?&4r7vfQ7Y;3Hmt-U;3%~wTCQ%~>Okxz%UJVrhor`O^u!6qi_ zvej_)DYB-!ewwn)l^h%#Kp<}Xxct=E=cI-P)aM$a&f4YA&TkXH6Og%lo!-f7*VZ1= za6vH`1|cCKp5Em3zY! zre>e`@tGIA?+^8Xg_{0Sbs#yJIvzT+XNfrI=aj_WjdmF)uU)&={d~*B+kMyBgV|%r z<@x!F2YbYhk92d!@MYybVPWSs1(b%Qe)<&Rf0NxjWw{ND#Xf7v$;s(`b%SMa{PE)_ z?W32@uCIS~ULlqG^XQ!&Ki*A#Y4&bAS(AqOKaZEJ5AO5@OrtD)E5AK3={1u)VI>(>kaqNl1_J9W&dEio-k5_8ND z&6d0*55W}D?d|PX3G|cMo^G&3B9k+$V0nhr)ftLrs^(&5yGzQYUABy^v78z8 zXoWT{vWObG*HuYCHiE?~J&jIPRIK9hc&7+iOGe|iIG@<8WiDoRprm{Q6biM+VAd$@ z8>)YZ`r>!Lp#jkBL1iInnVC{tGcWne-I9TUfdVs-ZWc2FmZF`5Wp4hybfuEHnz>kW zLP@#RX1S!ek&~t`>fAfejEpd_N{9|65|KD!RHks>y|aS$`lfH@5tj$d50B(W2U=~| zlFY?N${S*1V+$`_aAr&1v~qG<@#0#zwz+?p*)m6L-zIHsX*oGfbFtSaqle#|xo}~v z(!TtJl22kGp`pElgUQR+=^e;;_v}f5g*ZB!@#Te4t6NjDPdV+>-Mh->1sRP2vT7SQ zF4=x7N>*u~|L&4cWU-Zs2b3(L4rKItVbo>BRw$^Mi``i2*tx>#xN*AORpvqTA@zT6 z+udGEI(9liAducC7Q?nyR(l3Cj~(W6GcRnvg>OIYbgC#TwbJu-SNCO#^r}_6Ne_=C zXPnY<%+*5%1%aOwSZJ6_EW76pxnEyzb@6%My**1#6`gsJ8@MZ3c}rYS>nY@^qO7et z*u{KSab4mH8y_FJ^73-qMz@>?4;+8wB*ixKCi+ZSAJPU))#My=j&#zKEuBkT)( z$~#nttAAN4?;Noj9qv&HeSTqoJziR=8KSU$eI@y^!swTm>!h}fuF5`i2x+IfpHPR2+b0G`Sj`TFE6VIwF%1r&~Vy?oAK(Ee`}>Z1c0y;O?)C~r@u<|Y;n4-RX89Y{&3Js`c&AmW{EOiT z{!x4T#d|6022r!<4LJ zj{m2sZG(v`)*p+%d*;m2syA`kZ1e4@dM%BO;+*N1J&aEsWn>k97YwF<+`+oSvl&9W zmh%SV?ChMn{3^OJL+K!w%V}?k*a7h-lx4U7?DYB+@+zQN)~8(UR$5xx+VGN7j2#dP zzARgZ_R2wgg@W2n?QkvHMKzNno6Kwnw^1Dfr9ou`-R)_=+IODSol$Y8wvPU-g z&O~WD0U8_KN_!O`vwAhKzk|wFSGkLm$mH5!L*@<$NC#V0f4;-)`kmE|osSvXkt=8y zzowRa5<7OSZTjo2%xz_$R{^h=J7Vj0-O3@8$tfBA&#vEpxha06Tr5HxYe~EKqTapp z!0Gdz*=n?sO|@UJJABGFHJ?mz0jVB>wtC8CGA zptO?vU$97@a*56>Id3?>W?ngz$QkazrbNyrG*(N|TZ^ z$w|_*1X4`X(uUGDBx#G%(#$!t&pFe~nVHVaIq7MCQ}Ds1_@MIgA_98BTcJf>Dgq)1 z@>0+uB5%3K%koyJfJMabw_h`R9_N*ur0xAOf3znv`?2=gYpuQZ+H0?M*rYA{-n=}2 zWB(C%UVG6`&wBcr<4@h1OTYh{ZP#A()2}~$&A(3F8vXmz*IsnOy}voaSbx(I3*Tup zj+y#@^G#0=K6uNbE#LiJQck53k6*WP!GZ;Mez0=~+U%ZRGyhiuO`xgi(;e&IoqMsk z^7nUaSig4t`WN23?XPEV+_;Z++Z%26D}UGn` zwbyOAH|8u}{HfK0gY%y47cPCWdCJYtJwjj=C+}lY18)E zxpU{N?5hWyv~b}mr<}6aPoCWG&+lJ;?Uh%4Wb@|D=>6L}cAS6Vg~A5O-|hR&Aa||t9AYb7kuR_U-`&g&+dQasx`AOTlm?{ z-@W|ubC+JTO#0I;YhHfh#+o^E<_t6)e8bwe;{UUG^K%=goM9;6d;awmiSv)?$V z@$9<>?!0Bq3%}peH|?ym&cgcU;>DYP7VbE2{R_jl{MYn_H{E#S{zqTbo8ZOQEWbYf+GE##eBXV4zg*jW z@Nv0@+5hBR$%%f0^jwQFY$ z4-XHt9(w+_zdg16Gg~HY@5&!=+SbF`)I0yX^Q(V)d!TmTefK?hmI2T{<$wOC_Te=P zzC3Hn1D8*}_uH?&{nCRE-)g0Q=FXpAQ&ZDrAAZHABRjr+_0@Iun}0gwnB~_UaKy#~ zzO>`5V>WNw7(eNqH*S9RzH4v(->*OUlhg~ZK6=fSFVsEo?PHez?GFnZuR!~-JBDw4 zc~)Wd(>8P{!JLD^Wzy9@toBwgl zCyssekADP$@R82WPVvlhkGl0^+wVT(%I#eXwrsonxPw0Y@WTa5mJGe}&g$RY_0@eI zzGivjZ@+)SD*J#7_TS!h#Y~Qb;8#- z&H2=yhi7fPX8YZ6^LNjGJMT;1>sWu~Ew?=J%HuC>ihSY|YaU-YB)xFoxmW(+yd!2! z+4j-{JB{uwhn{=l!RMZM)#>}JoCzN|fasEKe;&SN(=mU!`<2a4-K?(~e*cxL7T-4f z{_Q{gY3qImH+|mTZ}nc=HokW3`q`H)+nW5zAxE^^pVzeOUcY#M(V5ZXjytUV@=v|< z&O2BB;P;D++4q=#8J@Md|98ojU)+BCDa)1}{n|?xWW*J>Oj@#J$sM)xrCC!R`16l; zo_BlygAYE4)W@e^I{$@_eB>iNU-&|O`^Ub#>BkFBpE`Bw%a2`q>B|Re=kB;-g}H5`y19ML z^K%bB;fxh$FL<%x$tR!u_~gk49dUPb&FqVoT(|SQ&Hbx3ytA}n<Y_DE?@PvP0t-TYs#xH zygWRsAMNBXZ_hse(Z5dbTfTfBtaZ13YsVFfH*MS4wYeQWaKMMx-g?rttA2T8-&Ko0 zcSP4Cv!=ZI(yxb~Sh;oYz4!k3$3K3PUVH7lOWQK9|L(-dU!HsJ%Sc;^^`E=rij_b6 z?Z!o$e}3k_&p7_wClZ_F&u;z2FD~2XV;_FBYvZTxeSFoK(e|^qu9^MQ2mfp54O{vT z5?5S*{lI(QdFX)$zH<8Y`p<9t{VVokzkDM)efpgD-hAen55YFaJkv8{+s53J%~RUG z{pwGZM{dxcojw1@w_f(7dg8zUXw&|5&I1pewBnB8L*9Dpt@CR4-Mo2o-Sp{SS$tJj zK7Z@WSI>FlncFU2a>J~17=3f5UHx6oyfAEjD>KYs8XR|X-Kl5MN z1s9w(?fb)@$>;Ne_QShBHD&fUH%>X@RC~XrFAT5P{^ky;Z_EE$4|UW{pKjJ(`rxB~ zk3NdF)al2sJ7U@Or=R=V-=5sx-+$@}XTEUxU%t_J$CqlmXAS?O>Fu}Q{{8iAuen@A#zMegyUwrB^prt~}z%^{>aidFYJD-h1zT>d(|ep1NspSyR4r?&hbi=-OxL?DIB%y!HIN5B~Y=zt3KL)lWXW=<;K&qhEdPwM(B- z7Jq*>f@0F0k6yDpmVaBm=l=VDuyt!>-R(!d^2#eWoZ7JV`L9j;+jASITzU1?AHSgX zx!0fk$)qp6|NgoUUYPRlo|pc4%c`H-`_7&{`^v=Chi?Dsj=i2Zb!%s5=cX5bKXc{J ze}3r2jjMk4;cdV8#o=4FY&oxX-z{6V{O--x6aMx0&))Z~Df;b+ZftRx^!WGB`p!)K zNO9%Q<$ozp+gI&;L%I9xPhP2A*Y(GL{QH{P)gOGgX7(4a+x+iee)rk_o3&>mXP$ZH zA0K~w=09(FIDOCCFFknaGs-uAPprA}$}4|#^O}dRoOkN&>t;*>GiM(3%xy#Wum9`q z8*jLw>C}b;4>;g}&tLV(b06&7arJfAo&BVG-}yE3jklhkck#1}=dbC@9*$tY<*vlm zsZ*z(SG(^q%YO9vMT@(5CCz*5ckDcWy5Yc2n3i?z z_K%+NuSe%yQ2Y9`znpUCJKuk`{qj#e{jLmRZqNe(?L_5)_?Nv zNq^h9{rmrZbNP8Q1|R$H8*hAg-BnwD^rL(3`szNH-oEUwFI~Lq?Aq>G>;7Ih3Dno` zyYBWoo*aDlj-7wGG|p1>(;FYu6*}DKXK4N+okZq*H*88@6CI6Jaj@M zri~B(@#ANd+3NI1=Y8Wq>3@Hb-z3-k=eifpo%y%NPSd}(>5A2VmrZ`-#}Ix0=suqs zc;W^LeLs{LRX9exY4CC5!RXDiE;#pqt=ZQeORMSuM|3?pYsypb!Qm%{kAL)>b3QIZ z_~fPM9#B_P^U({BUi6tGx;{H=%2SEghM!omb?~tt-SziZ9(m)O6HkJzhn|1ld7%C5 zqm9`=z5lVDH{42p7m+u9b7JJBS6C*=uc=olY-Tc&d&pn{-*kdoz zHw!J>Hs+panUeeVt5oeshbA(KkTq$+Ry&sn%RGR@cf;|)%| zef{;!-m zw|8~C_?^jrUpVP=lYVvg-REC;;R}Cz>AW2>w$psYAdA?w{d@iQX*X+i_4VhYH88d9 zvd(WE*)jKiWAL)cFI`~GmZM82{q60y=d4_Lxq9*ZP1kJM()skyGV|^S#_Wq0yopxd zV~Ftvt-kBtd-L2^UtR4ku#HP6U48Af|9RC_)5H~jw*a($^ERB9KX%zfzE<;heBxVHb&{SKe?>Em**8&AFT$X_ox`RM%)ZC$`= z5~pvS)RcLu^~jsFN3N-(NH5 z@7%e6^W~>*I;Ji2RBe0Y$uIACZpC$%O}_Zs(`&b=-^{rbm-cfNG-%Mbrx zp97;`tZk3{=A0czO+IDEQUBAw*Pmbf&4mYlx2XsJ>Q}$&S-SM4w_jWS6TjK##s9c$ z@;|@!y~)z%r(~qnMk2rZM&ljlJa}>ACmy`wV=uk*(syPI9(eZTDVr|3=zxdU{Ce+M zQ=(U0wDZ%aZ(a1i`Rzyi>5PBAfeK8YK7H=}r(E>oA2%|x4htFqf@_((q@UqJezvsUDe)af&;|G0q+Tyc*Bmdz~M_hfy6?;8>vwr_s`+gQ} z6i)vB>?3Zy_0}sB=SPg$7tMcb^SU2|8HVoqXCcGT!P~nI>0i2a=2N#?(*!~I{Z&h* z{QZ?j_GwA}_RjfJHk^f4txdVU&6_tr@w3cfKV0(tP3!-9`#~T5*nXdv<=Q`g{NWFC z=huAl`QdYZ@Ko>Z55M)o{rgXu@~zbO@*lh7jyupkVoq1rjRSXmc&X;BkJ_Z^aAKIMXbbasRlP2wz?Vj7& z|Lfb=%wDnZvzy;PZQi_jO_!X1e9kw%(Y0W~$Jf30<|mgdS#t1xAN%IPv5%Z`$|-1d zdhFWMHZGaH^FJ=RkdDE;f%xAzx#S; zZ|`RgjDGPf<&hsg_sUh@KXL8aS?|C5#wSiV;RO4&$3BTP@TY&4*`IigUfH$rQ!hVu z?O`8$@WJnI)>oaiapMc9imEnz_|Elb9#vnzFKY1g(~ms#&_m~<-R+v$FTT*W`J}lo zMjDn1!XY>If9)Lkp5Cc{!Ug*;{PsBuPOREXIlAC)v*%-R#WO@i8mz|JM|2n%Uy>|C`Y?vuVQrZ#*7J({vj3yFCIxLb72> zH}mbFTT7afWt-WAoi$;^n}a+e8HV#`OpLXOO%WMd2~#m_{H_y!oJ>;a^Lfpax=Atv zv!q$N22?$zBtRV6Ll9~#wG~MiV~G(!^4X9KIW)}ziJZ@JpOd`rVkE6+V0&181t-xz zA#vM;kR`}-K4DNIN&-R7n&7iN%leR}>XK|Vs(MPd*tcj#G6zLNOGO4@en>ZEt348> z1B*mK8ma~~BT*-RtxhBgl35LBD~v?hSR+p2ToYHXLnT+Io6TYiScjBqS6DI$;9NJasqlEl#inX=*<$p`d zg!~_ur=|w@#9&Pg=(hQ6sz}UsbvJg+1-7oMI9UWROg#aAEel#AD*t(FP%&6uuw{sP zA~iJ;{%@h( zg2?*yG~Y3Q1OlNbks~8i%@R=y0;rRfgbjp2m=}O>;*uo-5XjmifI3yNY#_|(>=n?z zUli)=L3G202nJ{U`Y7qKWDlr{VZtOdO(@UJnu?a{OQfNkRTVAOozisY^*o#k5a~A& z0HT0Yf?5K$(FbvjYbsPG>qUunS+3O*wq|$afh(*|kXmBFak|`IO z$g<`UH88gGNP0k3*m_j{G@=&zXiBVpXl5wFqkGa^7MZF0bBz_)G6zejvRk2PilxY_>Om0Dk&9**>xiitxGJ=K*yStftDd9phs>Zc}B5+ zCiaqahT>vYGT1V^XuJ@KTQ5S=x`lQmu)=k$dfez))piXxy35}9abx8RY&4wfs>gG) zcv38z;YQDHA)9^)Q$JBi{yJut=#WR}Awr_cvQ0#V#Jsg>G$;wZb|m z*fP)5w3q7iP}bH2&5mRkrf!&uWTW5g;0~X^8M-VhmYK!pbn&d5g0@)RoEf@*swDEF z+n#6UESSkbvrEqyk_mxud`xVPMVo}+%3qic#CoSeym|wHbjk9u3tqGqDl1eCR~od3 zbaRjnygV$?Iz1I4Yv!nN70h2>9A6YrMN5f;v#?fBP1Ge!U0bck%S0M0J)X1`N9tO6 zsA5H{haNZkdzl#GDwK_+SnIfd6P08bR#g#Y*^&*DS=B0AOz}0w6IFERy8=mymNKDb zm5Cr$x&U(6;zNrS`NXy0lq#bL)1-F|!G?Ey?5H~q6Q@;?!V_2<@3pIUPG=V|A$6iD zldH_Ql&C=7jDEc*9cJycZYt}r16M^TELOdGsO;*UTP^|91hj>Y;G~B5hr>B^C7OGU&|O zx|NVrXqJi9v>{cXk+xKdPRH8GudoPn%>i6d$Q3Qsm}|yGN+35-p%7Y2RxW=!EMS{i zyi}lh$y!h*zMs@E02B*=b(B;|pvgG3r81`CuPl8CpbqS>Y{XA@8cSo4xhHlyx2djr4ILrv^>vE?xMUP!sKmD}RH>{k# zVMDC|>OANH!@$;m`)m_og4*p-JD7ZmQQNMzmHl6QO4xrfm5s*tYf@?dua;P=&;Khn zv!!Js{_nUv<=KC+nD0-UdN!3Nl7|SItdTM$8S!z}LjRIeIYY86><&*|V}PBOY=D}? z0xS+mIWZDhYDp>BPL3^elB&p98JLGUXlerO9f30yw~$4D9cx6?u?j`pq;uAUzb(W^ zOon8qMOzmcR836+5GXw zq0CDr2|CSNK}h&vIp=U8GZI8Wz4wS4=>)yZZFn!UzNB|t!R22clOw&tq@4?e zJMEyVr01ouLIeJ1v2H^m9AFM=KuX%s1SUkvm87b8>yFNwI7+nw+j?GY}+HNy%7M0sF+PX{VtH6fLQn8A6>2NkjeX zaeS43M+TDZT&t1wgyp$clY$yFCABfF4@GUg(KhvLT!mIz*X?K;su|)WA5|DT|7XU?3^|Hk8~K>y>cE{3Up8%O{m>HyS}D4>2&+QI(`pbiji1OM5p z>$dAP$MhdN4M}MrkkfmnQWRQ^y*)U38Z|8Ck^g7^vD@k8tys;+UD#}dTVl-=saTFlj}q5hJuwJP(2WVg8FL@jh5`0^19dVqOqh^tD7OP_VDZp} z2{jp-Jy}&HwJc_~sV_pVhFjc6w2oq2kZxlQg}*h|yHxG`?#ydNpo zOg)|tKU&&-ka{}Cy|Am>_+Ez(4i6aBqko7tk&=ys4&7-Zb(pQ*MTk7W8C55B-=?qx zd56GLn#k!_wy{Gpnf>-mG%Hcqxr|O}Xt^pdNZ?e!HdJaFAOrUr1q2}S_+#gP1ogWM zn~nQ$b|Yrp)#_T+pHlii_2U@T2B4(=A8YpO|E)78?7!pkRO0_TAKNW#2;x#=5OD<5 z(2|4=IEsaoFGI4GxC+U!oTRF}gK%e0H#>c@c++oijiNM1dvT2t*GBy~wHv!NTLkzO5;34o zH-VPT#GzS_nnVjcttNtQ8w@F`3gQshrleVj>11H*Kvt6Y_OT7}Qbq+bL{b<*;g~xm zY7YgviNI7e8>V2u)HxR+j<<96r=jzi9YQj8chm`8D{KG_OpdcJ;!fXx+dE2}gopW{ zg&v6OCa8mJJdKBWE7b=}6?QEm9dI*GmI0m=-0x^2J>T)n`u9Qf8@_W~s6hY>)E2)H zM6A|r0f9`V5a@&50}2JebXtX|v!sdDs=Id&c7CZK6Y zGm<8y@QDOH(BgunVd>d_av!jilm_Jps-Ps51X7y-8X{Uw6|$j!qln?FM|xq>4eQ1C zh9s4&C#=RSnzu%Z^NqcM&aT~JK%GA8O4p;w`CT`WzQ`iV*|$wAXpWC(_l+NLEyTMPcF zWcsqnq_P$W(V$LGfb24%WK*CBm1uMgYPpVdR679K2zTA zysa2OKNWgfBmGuFY{hrTC5ez&DWR6g?~$}vcq>h)(H$N~m@GyV>V}%4-E!0~kCY^3 zmeEKzjC%Zq%RV?Q0u#?HT&G1irf8`uu#JNrZ&&5APFTnz4*0OIqh_VhR;$fYovNx2 z@m{rmZqz60=ByL+$dFuV%VbqsiMoZ{umJe3P(shdvG*y9pI>@W#_fa(Sm$d&30t^? z2el!gsw$8+g_b&ek&F5y^A5w)EEkF8E-+!3@DW77PU&Bw#QH*IxW>i$il}EC^uH4N zKe>D`rsu!0)~42g|7YvWiTKas@>HPzJIB9&ged5;S!CU0#N$~i*@0>wz26dMcJ`J* zODbMSko+LrA^;(icYYQ-;Po{X1@k;F8lAf*OAK-=l$?N1;u89pPUY|yD@dEvzAQ{j~(RK<0^4~ zDKR)CnX-ETuc(Th7cm6KC|XhvB z&@gh)lvF=XEhO3b=s072p6#X4fC^Ju?0ZhFoi#KBL7t{N{Ob!IvoIlA#z(Xa!hHCZz{Q-+2^C@z16M80;CMD2Dn$*ncaRwG9>xvf8*kv*0OxpX zc-{o5a#>vIUYR7PDx7Ci5(M? z+m~cn&P8A_Z4l;*c4M=D04apB@ti4^eBHq@LV`I*E; z9uk-?yIKrrh8{1k7KI=Ceqsi7SXSai0IxbAl%^$GAqyM)p<4t0R(|9p0$iOeXm_n;19*`d|*Xc!&HiKFo)7KwRJ=eJ&zQ4`#qN3LOBg`@6c{AWJTkCz;nG8SHXeMl5( zrelSKT=nXPYlQ%09g-MVRJ=KhIr+Xq6WH)buf?z1Q!n5G^T}PNaz|I7EO(W4 z7{uFJp_brt3-IIS?iu!mxz$v-h@^ zNHsCv+!knUKt)R9b z@oJ}4&aRP^EVWnMWgE2$757rg3L9k^bzs^_|8wL{HFAiKn2{3Cr)@Sd?+4bi{}cI8w|$RmAk#8 zA25vA=*u-OdOk*jkz4%MTpAQ0P>s*xzxMfEXpp^@|L4;gjHj^ShjDAaNz1 zZK&)EA5n7IEjE>8vg zPcHK-8i|*WZ{FHENTK~a+g;N$y}}ZJ&=WnTOhKFSeerEQ3wli7;yO|GvP`*9pkrr; zos&%F^Aip;?yp~;r{$JOCQIW9*BZKM)4Z;vfejlvYU>8GahR}Gj2vco;M{i0&Erac zqcG6DI*96EwWVuFICco@vB_IRCCH`!4I4HHU>L+D3%0d_C=PPxH`2_>Dyj^imIFD- zB*$mOy+k5@_a$e}hXpciY$`JOsB;ipdMLL+^b4w$Qf z&4gW&1y2lA#n#5CKQ@-X4}Os-*qR%E4y#a!IzSATBB&2hi1DAU?XqAi1^hB>cj--< zdWJ2QWClylT+xFY$5n#-RS{1G8g{K#Xf*T~i>#(b;r*3i#`A?LV4;`#pm^scd$mY=exo3~03T_b;vCWdxUWP;N)Ys#a0d$j= zq!v-kLfG9$1)8o!Y3XuEuJ9qH&u?cC=3`zu#NIlUQlh6nzqc11K0bhVzL_uwO$#nW zFWWl+{gamRQW;;=KglCIFcm|851#5hN0uBp_*})r;MrMG3qEB!uzP5p6VLAOl+gc& zBvVtg)abSVCGEdW0sAj1KB51Q!&8C&znstlkm7pQrU_q6T~+ZdEGbn??RUtCmhYER zMZ$mg>bhM_+K0Br+e{@*26c{QLSRnE0^kCA*VCAy{^;Gqy94C(1r;c%AgLZV z%@gpN2)Y;{xRLSPltGe7(i8?#e3j!X<&v1wU?JlW3;gOhb1^4=?~b87 z7ZC655?YS9eYk^VA=XVueLt8FyaTmk{;;AHTGB7`G7Ixe7ahlcbhjsVX-=}-y1I$b zDuTIW*Vj(QTX2mm7rERX)OYnIWJlw+K${F)tMar*T>#5!h?MoUAjg+l(Cjf`QdwJ8 zGlMWMl1jdon8zUROX%*6-1`f@KD};jSgp`aqBzw0@BQEiwEjC}_>8rleWVB>K`FgA zg#w;^mfv_)iC1KQV7LWcB14E*Cndz|}j<;yqftGmm&O-xcAUUkaE8;phr9Ebwm6ef%Iw%(oW=h5wd`dA-hv*!yzX+=9eR-ZN}W$pBcH+{ag!nb^qnMf-(OxRg7^ia(Y5Leva zQr1ov-a7i)K?^OaP+;5GtLt`wt)t0(5l!p+4x~UTq@;!*meIRW(ES{q6bTlLSJ%^bt5-5Q-q7086{uHb!yMw@3TD<-v-ikZb-^z&qr8+1 zn=$_Vt~J9|V*k;#lwN)NPpql6r6pkhX`8tJF)q)D>_3PQ=FU0VgsJ1IZv>)Lw)+@? z_|X=&1QD=DX$#`J8Y6>H5WSTdglPS$7=*lkZ51#G6*uE}n2Bkj8?s)`FN#t9}mO8U`dY(%wTssb36fi^K*YgUKSta%o9*Pos z(J`=o5gP;#!ft66qoVHr1G5;Zz%$usdUe_u$|h$)y9|?m zoGX?}8RKZlGKij(k6O@|?rPJ_xIC5E|8S`P5nKd+E#?0;!=L}RIW{9UasP8%o)Ovq@_nbATz$iz zCzHgkH~Zm1j;ZGt?qQ6~e12qBX5_=Qt778gTN;`+M=NOn7@uczXqR_?V;r zKQLSO1s$8ixA+1pVzLjHI-cRs%L4c*1}&J=8^2MaHD&+jR_Bbq3qcn zseLK5jnP_{aHG4qZK-S{Mq$-$EKL|=!(OAdToAt6!~MC!)#yELHp@2=I?{0W_Tw7q zQ-S@*&@DSCV;BlYa7ET3u8C2GfeC4UDbz&d>@J=1{PwGKt4P|jx0Y+@DA5PES1RIN6y95? zVMX*VHoMT85-b*q*}~iWVDZBH+7RBTQiz!#6khWR#Sk}<6;UBSi|*`s?Fb=V_~)Yt zvMV(x6eZ5GW?*d13&lsaI~f{ArasFsp~%q5aR(7#Xho#Sf+(ED*1RBpv1KhNvJ6L_ znB0RfAJvml_N~~uRxoKkjx0{|{xfJv23|#@P_re>C&UXbD#b_ORi}NMm;yPKLQ8S| zaO6oS1!u@FS&N3~=8X;BS>I*0rqU~DWtNE2?QshoK~%vszZDRuzmw7qv*9~s7RbEL zKc^fl;Wngt?{JFjrwjIfQE9_fHdS#$tdL?xX0$5O&?qfe{ABIk<|}6G2&jY=PC)^+ zatw_j)!iPHJ)$v@9&XX4&VguY34(RyAZr$(Tfp;}5l|VuIi12P1xsoLNjtC#h4(lH zl7v@QMh2y)#i8S=o^<08U7@7&w_2j9D$6^*H)G@?FLZBzy9bj?!7-H}nF1tX z_}HAMhhpV+js3U+`!6m!2L69-Elo{+|G(CW{Ey@FL`Gr&?nRU^HrIa%k?l6NUkpxR zvoHQUI*TvqVQh@O0c4hEmL=87v&a^7xbrkJ2=kU`;Ih7kaLNhERMtUx88oc|COS`J zToo}#>IftkQehi^wv9AQGY{%q=Qo@Z$u|xm%!#7DWUXKYxF&RH%rscY++I+xF2@hd zZ!8Y?0t-3`%8JDsA1gwYV?r#AB)(|b=ze9)UXvZ?f99jMBEEBc$-=gOZLbI}*m1>va(wT5zTvu* z8HxzlVrzByqEMOfDZGtQ?#xJ|yQRsAtav1sB-@CQ(U*;BY>}Z0=NRs>s-}e$UiJ%5 zGpWPRS#i{NrD0;wa!z3|zA^l`#c3A9s73TSCcp_#f;y@*fY}`&)>>coOoXZ(qoDuL z_Bdk~zw$7Dq3&J2>MGE=>d9It6wtj;2Q)3{2-gljw8hmAC0VF@o?{Vtmte+Sy?@%% zp9=Q>{K8g|6`;iazqPH!zyEJ;n=xZz|34njNVflUJB-TUjeZ;k_xeP4$K^3&cj;QP zsR;>}I={;2B>ly&ghG3L$C-huNYSPyswNlcEmqxs-eOK~<*0mxG(D2`I21QwLkOlo z_DusYxW%50GTg|~pQdT8ZJlW%7-}s=n^H7RLlN^*M)llwbT@ki>?y8VQP7?e-me8x zP=lsqL%Fg1YnC(%e5w9PF*-I1j4atwco&8J9?H<`-KC0Tj20d1m}kROntCinO9i$I zE)9!+&O{g77ttK~A?c;dQ*RwAV=3p0a(n496&#D;Pf<{kB{TUbU)I%zxt|kEGrmmY z+iC<_2T||vSW%n+mm42vNJb+x@D3y?R>G8C-tpTkN1CYJ<+wtZD~U?Y2FBT_1cA3Z ziGsWNsb`lkxi`Vn?p)xUyEZ2|H%1XV(51|OQzQlLuB>T7%{3|tg5Pi>X|f|ZsKoHu zPgqZdu!bx3>+`hSGRfqfBnyDy?qNW`yIoF@B80TtS7<9V=8ZVjTA_vPbV%m}ax`-k z17dvvM=!4hfHXgCsx>Vr)|>>*k}QL1(I`@j&~~e%78R#b06`&XvWRwJE@`;4&%I-R z2n=9i_t@8j>HlIHsu?Av=_ag7A0_nvrWwt?{J*go%`<0C=>OyK)PNqzMv}@xv`r=* zEjt>BXBAaOQrwUdgHj4wVx$K2rxgoWS;Npx+X7Y^sw(z*0U60oq!lgI08FS#wvwaE zru$yf((2>?*4E|;{vVg82Fy`xP0A>Y8%|c@Cem8E z5J^NLo#3udGYkwqdn5Hlme6w9<{Tp0FBi-B1!%qe_adqC{1L%G6`~cgobW z1`;WR(15C^lmv)Fdk7+dLjfUw^~6Y|rUvw%eB9jLNMvAO0BP0{85&TNp_Wh})!xzC z+D_ZU>pV53wu6|sR$R-xZgfkrbu-@%7~r%M+NYS%GmZ2&>J0Z7m#lQ879j9}({UbT z4Wy?!r7&EQp)6zl=3RU91$rD@g5IoVD;eko(J*ycRP@GrP&a2` zPj9^l=3*!T`iq?cNm*OZ;0;ax$$cOJO(aB$E(p?G{Y9pw@uSWKz)-TS0&h zBdE|auEP0Zr_}dqRU3{B zg8|C&l7lHx(`B@G)syxB7zVx2&YBvK0D1w?H;U9e*#IkH=o$tCynpqHOO^=K&|)#W zqcEqlS3v)MQK%mPML|hRrtAR)y%=v$3|(eO31G$0Wd=!qBl@k`N*H7gC<#4d=o-{) z2O!r-G~gwbf}jwj1h6u8pkRjTk_;)XsAaNL2(yfc$I5@gxUn?Djh>aN(E&f(2@cO9 z67+OUAMg*C&OVZmwqzn{&xvDpyj({X%!H~S8OiP+DM`TG4Y(eFVqqhM1?_qf(TO-f z)-^y00~CaRGhyo5YCSHxD#$<>oRVRfx?w8Vr0W#LOAc#c1oK`2obE#I2en){xfaF{ zPRo{Tn9Qmc^aENhoO}yo2dARpOFE;Nch*8>$gC7jGcF}UfUE${-Z`CJz=W2bH50HB za4X~^IULNg;q2<2I|5`@3a6o~N+KTyYPoQtl?*0-vZi9^X=7snrv~jI-5l%*f?F<} zw1vuGtQbzoQ2L;mQxb5ba;dYYo3${8^PV=OQPSrE-Bi};nk}iIN0&io*4C|rq?S@2 zDwUtqIEZ#5USJuV7V+y*$Waj95aO*%&Rq*z#Fk?!!)0MOu?jWMG00W2(5BR-h>jq&% z0x^*AR$g@XD*g`qE-dT==fL8;iq!+})`oI_V|PYMmEOvXmu+CgPbnT5FO$NEAD(g* zJSXJ8P)!o8E0B;*GOMZpm&E4G;0#dO!9{v?-4>ip5A(jV(~$H91a>>TcAx=R5Q5XX zS+$jQHMoqa>vp~4L2cP)7RNypLC64%tg4a=7S=%M0Osn6L1+>h1idh&Shkr5^iIZq zVkrYHP$xsfgbB%paywd}fVT@1YBDr?+>U^vSvHj9df(6;W+^!OSVQ4&&GjyByiraD z!Ui6IYUIObkz(ANZ>wyHnKFbP5SCY4z`cEyrCe$u9DPi3Z=U9q_DF$#tIco>py ztm9H*5Nh&3$P|G2)OQO=j4>(616m7zKn*b_Ie0?LzE0S#GzJPl+x0QtNV1!t}L`83mt9q)jxhZyRW7EvW*sMm$ zP@-IIE2^x$RZwL?_vMMZ74C(*yIbKGDBLOBrErIfySux)ySo?e?hb_(dYkXx(Gwj# z9WgO89dTaH%XvAGnLGDhzqKspG&z=+$HE`G%mCKe#=%fcBDl(Hp9NA43m+bkDE5$- ztXR`6tIfE;j(!#k(c^{Vf6OB72wj*BN2}AhM$*L?Tg9>|!Rk-`V$y2f(3KIJAaZGW zk%eF4F+aTaG8md{G-?q@meyeNw3R#~5GdpqY(0O&|CRaL;`)@8@fk-IFvrIUo7U=y z4m5f?20u3^A*}Ek89JbUh_AMhU|m2^102d?mhAF@iYw$i^JUi+YUg!g!0w3ArxjBBivBxy59m?*^UL;GT8qlN-UJdF5L1?Fs!SseUi8UAaC z{2QoJY%y>#wBM}knjS|ZaLIs#H5tgMB_n}B4LQ!jVk0qKb|mTt;w*xC$l`Xcs1Opr ziA1N?FC~nQFHaPmtb@x}4S^)aM1c(+L7~92_A-fYwvkb*hs!Z@s7rwb&spzVqbv{Z zWLvD_WYcTFHJ{%yci1MR{CVx)S%Z+f9{@B>f-pth)K~j=yD4G^f9n{(;rnt#+O4eU zZI?!e73M`;Apa8RtGE}sT-#%Vu0Mm#=5a#(8?k?+&LiiQ{=!N#5F42h-3Yr9<`H_9 z8}5EaG$v5U)6E1;-Cl&7?twQy{_m5E#(vo<9PdNB6qtDVcR0~prz06|e|TFJe_mi1 z(Oxn|oGON_BQeG81Zm{E(6$qRN%n_@Co2@xIRqW^eTP0PMPrY#*sWfpA}SP?6)iub zpC$$x!^UEB5`it^IB-4sq!loP?6>$EtcYp(QF=|G#g^g?XRAF7Thhl}vKsskD;Xjf zDfnOz?`7_dZn$xo=_&c6gd)1nUJg*xYkqLqP=~u1vnmJmxJJvl@}#}pT3ry8HIeok zMuo}WV~=g2pQXqK3lV^7807^90xNi2CYp8#QYkvY>y@tsue$~@N|zS!ii~dDs@<_^ zSJkX0v$YT5N_(-!EbIPDPZOi2tVDswzPj5;x8F^WVS`T`5xuOh8mRQQeya;m&?TcNU{gIsk(B0Q z@Drho^tQ+CK^%)|C;Yu7?+6SXaB94yl~fsQnKG!4l@{y7yR;5krJYs9JzfkQ8{Vg8*ZK=zSjY82QNI9TDldRw-r zeGJ2f>mLcKansm{UU~ZKD{22|xMGdc*#X)*-Gc^%|08?fbHe-PG?H*C;Hjk*Un6eI z;ot&uYPBp9>pR!89S+>v`r~FzLaMd8oZ{9^K+skhI)ul1^eSHTrQ@@41eC+Q&YGFw zeW$iI)kBUX3LMo!l?6`aa$78jtiIQi1(Rp{+YzKW+s6APr^G=3yy+bROfDVI#Gxxp zJ}WTjZ1MzDuTp-NzuXT;Hk{5;_uNk=s*s}U2>ggtq<1>`7qArTtsS_I7tDU{s2AT> z4as!FlY<%MA2yD3le{1IZ-(5x4qlK6R9mSzJ(j2wFj$m3(^J&#T;v{DByKXW((hO1Rt>cOU zNouE=u37!i`wO~QRNQmh!}r3B-rcTvgX>P$i8jUggFz?LDIKu}2AM?padx-l866z! zVp&Ia9w16qr#ldZh-bu_7*Orekuon;+nA?*JW~#F;%}5F?Z34I`0j7yjU#Lmp~aM* zQBW+qVK`CO9yP(BJRhexQsSff=9yCwN~12WqM;@Mcm&Wk-Km&>)7F^V;**D^fVCtI zh;6t3VOM>LgaxRTL9lfa-&E5F))=LFKPf3M!N5W6T{k zWZ|W~DIdjAwWWwmhdoJ_{9tO(r6n>&dLXo|ZWn*MW~-N+h3IsS*fP{{)DvYZA6d zSrIlI($3#k9n!xq8VoDsf7Q>#O^-5aGgTKFa(m>JNO>4ZPQHm@P*`LXpGwzxkYE>xQIJuh&o*G6u`xi~Q8U4_bzC0rF~GH!7XG3c zpOhaC0o+1qPIM$>KhjdZt5$%BQ0-^}l;DY37X%%qv^-JbInIEsJgkK~<3aSTwQ2`S5AtCw-|x|qgM)0!RZ#*| z zEP95F$YnFafh_t>qoPa(UhPB;kQUTCJ0Zxpz<7M23}MO2*ut(U{fJDzQMjLYHh&X7 zJ$wqfQ^v}JYP32Kq!PJ{%PqaxOF4!mK}SwP}mUIJTj2LrQ)9D)j~-){?)CK!lfOT zzC@(p6>RT_G8#XsmBH(;z7FI+lcVhPH-D+m{j5t0TkKc}Lg96WleOp~%e2Fa-OTHjCqzQ|LgJva$u0PKs;ew$Fdr|5$ zdSx;N*Dqr)K`}B)T*VB}Y7vKwd?cJ2%7-^%M9yn3Z!h;BQM59{vG0!yx`{Hog`q9C zh)51;@Y3fmUOlrRlv7sf%Nxf)O_ZS1J$?NknL#}lv><1^Q@=eU;7n2wgXB$n* z7{x;es!0@zWSLzr96Acf!6Ix$Im27j63%q%jA$}j4^3Fn(}jF^pFE2EP(?8yf??D{ zIPfCA!&A%U5{CoDMN#jCOKTYeP_Tp2qHuQV?kgxD^J4Vw#4N&2M0Hyiij>)je<2PE zuApUTp$Frm?rfMj)ybpd;+|$?)Z+A8BIdzIO5K{pcYcGH4iSTu$QnQY+rv$28CGHv zH^-W?xy8f^MS6*HyEhTG@{0l?g^U4BFiaAM7_KkL`pbXSfU=k~nzP9n6B4Ib^%n&G zqG4}p+E_4T;3Y7sL4+GOCur;aIm0CUho5MkYBg1a}ZF(?!de%DFC$9F^~TdEFWl~8`FAgw}8>}TR(J;~Rk z_$+6@YM0a`kRgSGVIeHQKyNnN#(y;r=b208{+{`knMt%hzI3f zRJM->AM%lK!zQ25G>GoHWS*kf;dMg_;9MP8iQm8s(A?lMy1XQ04ja3gw$4sgZ7& zwP?;#4UOSgKzeSbuq2Yxter~&z{jbyAqJ$pj1OjK<7fFC#Dhz^_s4`ShV_(+jvI5p# zXhV6*41G8v1DcRx=HE}RG5WG*daipy#_p~^zkG0>0*|u0yR#$TI!_+`DZBHm$M@T} zKDGeZ&;FFu0W-t;V2GVKe{8`NNkh7tVPdHBGeyRCk94CR=5|@CoJKuk=P$RnEvq@xa)0;G<12Ti3iaxb2JX; zg32w;7Q{bO|GKx4FkgKGLr*|f`RAVhAK=po^MtdQQ;K3x^O#CI{6DZ~?b(J5?%-K< za;YD<-=wJ+7J`wvNeAQH#jvzC@Q(<0Ct_>6;V4DYkS)f*NR-Litg~?ZCF_5OIdL?; zj1g7!5~?NDex6~!VNXjR=UG^kkC99r7=JuTCmj`p&o`b+FV-(f6e!gElTM1}Oo+$y z9!JP%<74Hle?e@1?)q!TmwugZ>cUU8=4 z3$PqH6FIx^ur?%%OxDQKi2Dy%*|6}Fu-=Y%4W8X4J-epiK*j;>xH~kp16+Q5S-wc| z?WZ2&O+Q^KcTUcaml)B)HpEYoRed5WHZMV_WYu*$AZ&fy;kD_}1D!Ro5~MMIY!R$# zaJAIYPjajLSV@e_P%0<7$ZHuVEt4lnR)?7^QacQ-qv3n7i7i@IgL)fQni9rVe}vM&f{0;c{`H3BAMbg zxPeW$6y~Az4YLaO8ytvP1|nif`Nw20*u`#&-$fb8UsCRI4iD>&$?8wG*qv77OfZY@ zFGt2T*{v<|cO?9uMd)qmjX&m#$>hFRYs;86{Fj%NWxBc5I>5z~ z#@bq$@1?X#(+oRzVYtx|Vcp2X30qp=Je?QO%yIT|o;}1wj08yd9V63tj*7JH4yOci z?ono>k{eArHM(7sa9vsMwxC&2E8nW^j*5g46%ah1lOnP_rF4K$)0`g?jd!#c2~lA| z>tK()j8GBIm!i@kPz3Fy87pWz9N(c%T%kF4o*xP@)gulOYcx+4QLb{?43}j?s;mgx zcd|?kEx&!=G6u%d@jdAIQ>4_D3P3?)goZNpH)+QI)J0S%XNzEw_gq1C(SMb&tSr#Qj#t4L# zMU@%aNbK}WUb2yJLHI%%jWGW1JYSb7v13jma|{GxjQpCn_hrP-k=E=r3vPOrp^#DY%nNjP&q&4uM6rqgD_lpAOn4+ z#qK}s`rz&I#xX{6(K#E7eE=UExr|`tI0XDPg=ERkn^BxyxwJVaMJk+#+hWQ89hq42 zBFd{N_}*tIsi~jJUk#-7yqtJFE6wgPJbFMTu!2@R5k0qDWj1xSJ|R}? zee3x5=I5ZIz4!Wm%QOL#Ox_x)L+u&_3$Kcc%LKM6e@4_Sie0v-Qq9J(+&lrTBShXw zar(|Q)nzQ_Q;3W|%}4P2(Mn(Gly2aE){}^$1Qr#Qb*^|k4XLcDh=B%yqL`zaAZy!f z)`eOS=btRzd{Ff0m%MRQOV6T4j494C>{Zkf7DVmGC(?u*EMbHEhe#^J83WfSxnS1n z@~VGsLGx0M(5JK;GE5=20OKl|eoD+L1ltXwl@H5?_J}@s+g?X|I|t)>OvDF68WD-? z7y+A5Ov)c0x*Mf!M|K{#g8TbY2EwpniD$`bG{!#1$hT|P5QmFkFGZ7Gf-c2)zHmt5 z;C>&jw-1jUc{`+gTO=C^8Dk%}`-J?s9f3!qgg9RV^uoqbs8o7^!H}BT{_^KY^YGCJ+URC)CXmB>}|BNh$QA2l7pR{53r7lqh#5O zNoWY2O2x18c`VXkFsDOkaamkuB*G4^vOajA=;W*AQAx8mx8<^Dn+ITK`wn^D$gUr{ zy9Ohz?n8VWW+yBKQk|!CA(F#`rBrRqJ7}rk`5WZ+rn29VV^Kuf2`eEafo# zgpw544a(R%OYtVF9M))$NFt74OL9YlsJ z$A5;)xze+cj7*yNDLEh1&)@(VOU0Nx1X*Pnl4kgm={8SW~a9fAZ^ z9t3mjX&rJ2N8@OAV7^jM`g~&K`Y-Ve$w{y#8@JlgX4O9Y(L)aI+x@q8vhD^IS+a`x zgl4p3|5D5T*s!3CW*duyLNtum%ukhM~W|GBWtHpmPz#`yeF#Ho^iPO3Qv5>gD;X>C|`P30CD#cIV4Iy5tYERPt; zx(R_LW^?v;xuW9I!Q0vGEd-_VDGjl}3|q8u#wo(Aian z#V{f`NxS*x&UEwHFaB{mQ)sM6au#LE5DW1~vK0xcvm-++ zw+6#wj?&trN4ATw0h^AxvknMAayv>lw`h}%fFBKw&WsVz=QI_^OxHh5>nW%F!aZ5% zvrT#oioT7G=L~l5wI&quP^ zQLFax=_AUn4p0h|A;YTy)%=@in-=#Xbr-4A-Eecv+NBxX{NV?KVo4xeCq#Vz{I4kA zWG!#V{~qPzxFXf!imb}SDh@oFp81rkb|w|Q3$%{}3zFM@(Yo|oSy5d~rR9H!DS`?yXtqMCB0GC2vfq+EG3YQRJxpsKX+>|eq4M7W>C}M@6 zOUFPP7Lu@$(db}pio1!l6bP|7c}qwGtwoA8NZPR+Ss$!4^cA6bU|wq55_z_iCvQVmeZs^ja6j879z()MsC`{(Vs3%<4Qmv*E0P@c#kX%Q1^GrClaX zlN6G>A47qN+hE1dMEo^=B;0n%gJ@h0spSQW2G!!e%(nf|?JD6fjM;ndk7bIiLOYTi z%LyKjvO_Cp>8G?TR#5P7Wv;5aEF~@ANi0oxZjoKO;vUbP0SF!@H1~(m;M%oVv2{{Y z^(}zt0KM!YI4dAJ^=y_E^D0~JkM4NNtsP+LvA+sDh)}yHz2=t=#j#-aj;E5OyuBN7 zdx!^COh@eB+!q1iUycS7n(k+hq)J8UF<9u1`8#TL8gMGrSP(P77#CT(?X2M}Z~c6D z8~37>{gtb79H71b%OR6Wdm+7IO6LS0(!OoABH*?i`k#Z-Gm=kgX&%+E8jTm)1&b=| zABkYQk43iDFPl%nk9w5>+L-bLBp(JF1j)j_J~W;%v9P3G|6|xAQ2q1OmhHh<4(MLR zpm-`ex!z(@X7kxo!F9!fZ9ynop{pe^YfT{+TU-o%9f;WnBf@(w^VE3L9|@&jKm+jI zWCfkN(xB0(V)<2kM}STSGpxR3KKk`I+3=zo&nI4LQcgAWSD7mrq9i9};%}C4^$`J} zisT)!e?I3@`~jb}j(jETfF?(b<@E7Ec!!#O$Q}$vur6`Pp?#4%QR=8wVXIB;$ivUU z5~b!13@AUl;?%7KB$T+RQ#@5YnN0nI!YpzEbnD}`Y;x%Dn^dF!Bfxy*g{NRb=?EF~ zGx0BvSn`ir&v{xGUAA){Hv0J1qKR{Z&#Xz@P6VCrIli`2HgHBE$7xhuHjE-Gmxq<^ z(H$m-gKat}rAp*0uZ$BHNk}8mvBe~t}7*?VX!Y6y; zV>9-{@i>Jn!#V*XNyzE<--*_LRxeV3R_R4uz0ZmFrod0d4Uw;k2BOMl#lAI4=;2@S zJ+S!TSj+w@qU3iosfxUo?Qde7#J6XTDUg;`C_xn%@;&Ht?-OL^L&wyA|C5;Jjmo7$^0)Z@Bg^#0USHKdO`gC)QCz3GjO%`*>Y^R)F zu`#&$)Aij0A^#m?rr_7($}>%^^x(ghJm5~sAK>Lp>YXs^FQFVzTXN~}zm?Dz*14Cv zrEwk6e(~4)zzfv$KNqbp74J@aF)oWdFi=8@AUS1HaI0mDUy&46Cw)m7$BC5y3T?l8#OaN@dLu%B){8D$o-PrvBADL~nUn86%anq1bKebc!iOJ0Lnir^6vJ zMD`TejIUB0!M-T_G-6}Si~hi`wHb})Wj0xU;9Z4H^4IX8v%|2xt~(B!eO^w7Zuo-d z@qwPp%81DI&nzK1QFv@v-&D|#SyuN~oX^GGBrptv-*mnW-cnQm@Enp`1mNXrbWv1V zR|t=AS3|B^zXL4^f9l=j6Y(Q;g=8I6=2B;OO6W|@Zzd{8MKf7^aaCketZNK#F`1pD zUlK>>+_Z=e{2CUlV;A`m%a)bl?N1SNze?V$Aca1n^LdR3KPdExyCIHqOH_YNZWc(8 z*0vg+YuE`qI_jjv@L`G#zXR{K*OZ}lkofF{8UBo(2nirRfjCW|633@?{UqPrdV@d{ z`>{_TMghi4&>w9aFv2&eXfhWBM1_>}k8=FQoEg7Oy3^?QPVK6lYS_xdLX3xP2T+^;YH-apRX zfQ0_{RnH{i5YQ0822vS^3j4P=JF$lZTE}nC+e|D}urfD2v+y4eDIQH=NaJ>7Mgu3i zS^ITUwocrdRZKK0{)S;wtcBv=GZp*S9=R29w@F5>C^6~$ejZt#Wvah6B=@MyJJm&w zQXck>H+p}%4QM_2A_7TH;)0M`^pNn6L8)(ngAkuy_P6ezH?BF@_r2jzV!K0hVkvmc zoosMyKJtcV5w&VY#cWsr`YOm!oBb7zv`Lu1CxRhMVj_2?06AWwr+Am;5>4~5A>UQp ze@W+zs~i$9zH-d#8Y4 zsl+9N3I?Lei6wI}FpUc7RK`WL7$L`@8C?8>T6#67VCB6+C5tj!Nw-xfLCgq*Yr14l28~O8T3wxJ;dNCL$@J?< zyVGOS9rFrLuCA5Xujd1Gk5welICNF1VOOi@+b1kiyukaVAWsd_ZSJGa=&+SLyJ06c z+B$4;EBdsizGvTu_H2td4~HbRaCXq7aoWkj!U!l+G{lhS%VCG>A5fT(81qh;7|GZD z?>a+^8DFUCVv_p#|N^-IIG|QGHUXAiOhm(P(QkdQxd%Ngw;i_jg5Lcv{WX z1J-$kEAWK`u|zXZgrdq(rCK^prAt$VtmLuAIG?zEb^_IEbHqtjBKl%1E0?cbo&G$2 zvKE=$;aqy^V&o=sYvpJsw~%MRUpcXY&Mu*D#9rtXzE~PME1I2!a0|;lxt7mp6X&7eI)xF{4;~&TW=A2bO zt2GdmA*xpEgLR~#IB;3XSXUlVazyy%2JWb?1e|*?n>w&7a+ZXUtn@7r8r)9ja4<$c<-y9kFO;u;krpXrK_Y z1H?|4p1OpkU5a{#3GZk$NgmpKc0(L&?g!GO&rTl*2Y%rE$xXe@9UQ&?-g;LR43d^` zzke0R&3L!HCyASDc!Pv!@2-{#;8^1x3fL@Zfr3k3+dx5M+xZQJHnE}x3C9@faHqD| z#}l2WoUihjH}3-(v@P;A$j9kLoxa$B046cT37#m0Bs~0%<|LvvdgWTcD$P-4wlbi3 ze6{V)XzmB-(&2m0G3M#x2inWDrPigTpMN47uzvXSkJ-&zY5!!$rRJ=hJ%V7|7(GOw zU+*3`D5Z^^2ja}WS7#TUP<2Ln<=Gy0~0g62H zrTLXV85;jC!C*Y>VR}+mnUt^RR=E-!-By>hIA=JuCF3A?a8069F zvCHh1IJ7nBTal;}{jSVt1Aj~pWNRcEEA82a8#-BTG8@u}Nozjn-qa>8?EZQthm5+W#^we~k_*Ckxp`$+#Gre&r!D zt1UaIILoMc{;4lc7LD>;u+2mpaSd6Cjz<)%A$AwgXvX{4Eo$czPn!XTJoCp`Z>eGw^lo@8_XB5|$ZQ~?9Gx$>NksAFAMF*@kImBJ7M5N8 z@~vQ6#X_^_?9yOL3QAO3(lA6{IP_4S2syB zl$q4W*F3phfTOZ9Z`(WEB6Auzr=Z?^U_ z>a18XPiv$PPj`b-w0$6%sY0wegRrRnu1lDDpxzxj_lK9atCRy9k``hLbF@_!kzbGQ{24iMhfyrJ?$!p~F zudG{WwmG6n)w)3948Q|+n=u1ZdejSlc7+gKDn)aJo_27B&gOvJK7QqeJf(-zGq|;b zDUgf1vpvd=cLB@Vw#;hqK6^vE>oZB?Y(vPvrTj|ei*hLw*Tp@q5n`Zs_^yGq zCHB6vcmMHW^u7~0`u6?z$=_vgzdyxPHYfjT)f>D5Kj?st=Z5-^_tR+lTLZ3r+vw~X zfu@hjLA(t5n$c%K--xo8KRXnHklCm6t*-m}xrxN}w;QbxHJ zFn+Du%ntPO*;oZNG>O{3m3OeGu@f~~7Ii3gwat|p;gIwJ!%IpAMe3$#`piJHk7)YFqblL_g58MHPL_zB2w$}W z6+7OEW$PK4Ookk=O1lqs#m;(v(c)#4u zfq=cy=0wjsZG#O_jt^30mlxI>ddV7)Z$SxvKYOxtT_dRUJ{7ySzpc>1bwa?D1TRUDE2_KlfaP&L(tq3 z_t_joaP?_XJtHXmz$BXFm7884WKB=n43-Q1P@Qe|jc+IK-S<3On%YpEyiC3aNO?Ks zTD{HF{!*Idp)il^(cx+g$rk<&JAH+c5m2dALG*CH)hMw9-KGE{B++_eQ70Z-{S9QN zxi>Bi)2i`O^5WV*N71lKTz8%7FXJP^al7MBzh7t!Wy$6~+Pe0z%zYatETNV>vS$Hk z)r>)fCkC;Kvnkdu&_Zy>1)WV9nngkQ8tGIVWW1gx^ibaajB6K7;50E2LTa1ZJQBf~ ztMGXU_9o@R|I7T2SbqD}$Io!2!u8MP_P=D1*zK0+<<8qUBy^_$T|&sjoxzRZKx|Dwxx^L5d+<^OAudy`Z~1d(h49 zQ9r7%!1~u!&AA^B)3Ibw<*7Qq=5HgzEO@_=hFKMw_M7WGonlmC~`7{gFTVYS3ebx(4?X*WCQNU>b}&-2&3kIi%W{y_ognamdP4=&%v_Qv`11Yjrx3N5 zmIOJjE@l0lPuug<$x8k66!3dL{Y^TvS^e`R$V2ZIo=pw|MPaAwDCax-D?dWe$pKow zpkB<}jv#Ob62G7uHb_=A8g$<}`rFs{;?DqbbG`TbcNCPIUYaNn4l@ezD5zRM?-m~s z!hAI*#La!EXvvXGZQwqppINxTBIPTEYDP6I?fcc$c=Eu>LU$aDH}K~yF0426yabS4 zb}8A^69JUNk}>2cI~M^%#@7#yOX?7P7-S4LxAT&-auqP?2J~{e_88n#)L#A-W+W~q z4iOdg$h5Ldu9B;Lf}G?D1@ox^s*LW)Cq$gUmg+;d!)LX91<$@p?=>~982)ysaswZC z7}&H2Ep233T2hRu2V@z^wduU~cMFzrhbn@Nr4}As%_Idceq@kYhSF%0yMw)sO{AHx zkF%26@a5F8Sb%f(6;~4PH=ih|D-1t%?Wg?~6%xK4ax1_oWBr4|%sJ-A5O|Y7>u%1a zMiegWiVC5eC|Ed$KjwQa3g48HxUtA=b3CkckzsXnJ_RU84@l96gw7*6_1v|>>u`*( z$o|PJOi2!PkY?Vjm(DFqsBJ2SDdo(XIFiqy?(%q^>x`6SmUH^b3ND&t?~nWZ$X4vT zWRoU_BB?wIwLd?qn8{gRwT}ZRDGK>Ufd*?%%iQlF29=X95YAedAA9x-^|I^p?6T`5 zkUK(_1Z3*w4>TYZF)`+5H80?d7b{ruE_SIcX@|;;{-KF zQV%^*BVp19^r{L}k4Vn_nJ-6k*=4Il}WRKW>A@NcN69;76z2xB&Q;h`Jf z9Xp1JrUZ4Av7~VbR#7Il8X%_H5V^fIk6mXhvZzM3RAmtR><|KhLxC(NBIxT~XYlEC zNStWC-G9>-`6_KKMS&|o6gr;qQ~>DX4S~DQVF+&Z!*0?6Q$4YrEt~q}_p*VR4xceT zaL+(V;=ICnA{hx9e$dE}ZUZJ8D%^UaW@h5>>$BzgMA6k}L99I@HZhP**Imxuu2$Bo z1)HU;UHQJB(s-YV=-}k`l0WRT;3gn(Inz;XPkut8$o{7ISyh~P(MDX=8j$p(OgGh| z1zYGj7t~C|d~v2qwWu>fV{Iy6yJfWwTwGYk(XL*`e%e?@Zj~3@AYCLvkUmS#9m0V5 zkwnxzyAkhr&5yN8gr2Ye9-On(G-#hdoLdg71_Bd}!p8}lC7dVeFh$d7(_0~vi}Pm-H;VA`BJ zUtpq{#&JuXe{*gLtD{cbzlQCf?c5it}Fpzh5^ub8bjx(P<~pZ z5F6ctu2QrCLFC2vK5ma=AJoTO`qZfJ)=_~}sQNGuXT_vha7Xf*R{-gNF7fII{axL4 z7a6$*ZGjJNW)8}!AG4zKB7?X8FutgVS#id+Ms=;h_fRy$seVG z=13U*SM|6D216xz(UyP%AdX_2f4%CSyckEQz^*ECfslAgN; zGU%v2SQ2w}dzljI`Leds8Rv!d7{vVze>?4fIu@F-922#RAh0)ro|0GHg0ase6()q7 zTn`bNSMxf*z0EIP2YYM~MF<`T5uS>ra%dot;6vsJ%SGG;U|5XcLJ-l) zlF1+RgoWIIvNgYzEslAi_^6;b-jh&!8{}GSQTdMCV6%x&#lz%=njm4`@&=&`O%hBu z67G8~sh-_RhB`%ny@(I36Uz&xvDF)8A2=Dr;+6A4luANVw&d$jXlO%7(`w$no)j|; z%MCw)H-VB*YEnjmMWZ!?0c<>?nUVcnnG$YJ@tJPG#`B{jt;iu%vN1jP?ctN?Rlfjr zHrwdp^bu$>@QNIoYzQnJI`g&K-fQRV2F?vS*+3@aY-2Z-mQBHybuJUTE#tw7r61p< zEJH-l$x76eK8F|Xx6e&#vXDrr)~GPB;N%-`z_97I8rYsE3`~9>;4;D$xYeZQy zb5$t?8cof9hbJS`UX2aRT442NOR6k+kc?XP#cac4T)(!P8^QE}b~lWqYpt))+p6T@ zs?vB|fsYaM8zW?wHGAb?89e6*V4HQ3hFYZhF=@|I-Jk{!wa##NWQU1DQflAsxRoyS zV_*S;beU=n{+srNSm2(Km-%*utvhY_0OhDmMeO(E(}|B43MpcPKuKaVK}Qd_o3 zHB@#8x~^)w&V2L}d^6B;oe55LqZc{3&d`ZB3VcVv5v$^T%DND?qv&nebY^?*#7a+; zeRUn#L~um>ulDt^$%?uibxR8Jbf)P`vGaC4k_w+4AV%Jrm=eR&DN|zk?)VW#l30^U z{Kuspvrk6EhTc0S<~<%;z&Nl7FH{TMsr?(nJRC*UZqv?Kty}Z!y8W;@M+8f{?m)Qi z3v%Osb^QrNOQ6u~3#eWm1pd^0yb#xJK;y6?utb5W6CUKFU!f{ zl9Qquk(Hh0Xw7w2`ZNZWSerw=TU4&C7wd=7n&B_Z^8ovS7R^HO(eIl}B=p?H6HexX z*;%eUeEAnbMDIiE)zA|<2%;&MSZc+-KNmt^<}^;gs{#c+ytMO`4K^l-&X>>k=P=$6 z!f$_77mOi>*#bz6?SXsXe$eyd9;qr;PLq;|eT;MB8W5*E*Gv)Guh^Mg3RKD zLx#`NJ4s4L(btiJ-Bl&@oShQ?WTDYyuO#)M1HlqmP1${v#i;oXYT_P<@ReI*!%^!GAf(>=l7m*DJ1#=V62I~v5wkw_ZA{YNl<;3n zn6c)L{2MneJLTfM9|RhyYg#%po$tS^Ot=v5M~Q$7&C#UizmL2y@et{3T|Dr2_SqhH z%l0pyr8TLO9w#WE3sKe%2VPhQw{MK)FGnyUG|l0o`@&7%$C26nzgpzH+>ybkRd%+|~nmtOpWy_QHvF+?nIgNVSV^zPZoi1c;6KkYw9CZnd>xBdy<>29brDsK&P&43z$^z4dkGlaXDCK{hQ z2B@j>JKl8jhv%_tvx2TFxh%Nz7T!L4fEw@j9Y8xS;PCQ5*aYfl$sCj;Nf(~Mjj(P{ z_wBHT;7{lzd;I*&&CG^gU?+F!CF*h;zv=L#3jWPx=U+xTS*}uJUh-&K#KQ?0kB*(f zRQ_zyA2V8XDllT6bb;TD0#1g^5{5GF@#)5C(io>q;phUrMOAD0vbP|(^PX&BcUNvp#!Ju4CsWzh`sQjD4FuhH7ZX!t%?rGoP>0~`b8Q44) zZxQtiYdMk2)Dx_3mj)luiqP=jmu$MWfqLWp$Lr~`F~Wl*NS{0ej4M1jz8$G}EC}>? znSS!vpB^pDUE6LJDlb;`R;jRhB%eUKS|8d)K_H39Qeade%%`~JW#@6DNTDga|_I;Dfjddlw&Adxy1f*Dm@ z%Di0-1WE1=-E?I-YR~I~kCF@84l>z=hb5Zk&;1-(WBA8j*Ocxn;`&C*8>o>DUgnia zA2^7$|7)%7XNs|Ey?>@I0?0B(Q)Z%5qj(BONZ>#XC}rYK>5NVgK~nP9aFK&rZC+`A zCr7nZu@kANA!6oKw#x97rFK$-1gC1GmFv_%4aRb|nVJe^b&#HO6hfUJ(TZSGZkutl ztLoF?x8$h+V>xj_vH+O#1o73I)Hb>qMMh6~fCyxmrYTL+d;pN=zYZzlvUxjU+0h8e zLdr2CBkP5Zlh2Pew`+RLNV54dy7SC`Fe?c|W5nz<^$Q)3u>u`cv5*Fd^lX&WmXDqJ z!Ef{Dzs>MOi+Hb_{@G7B>IaY`-ZP`b{6r>Nc(xCMg86f)EFU=(3AR zf|@^{@2S=79S#tYp5zIQ7y5SG{|IQj_?uk44(w?0JX0JuE#M9rpVT?3v5oq z1Aiav$O0YnQ>XVgPwLAIE|lseD&`1tJ)+Uq0L5y=2Xq!kSi8-3u`pHm-akzRbR?h} z;} z`!~A)VGZPcja5Dg$^f3J<=po!OmZ08c#7UDC>94Gf@G4w2?7&3M|zVWMr?+;ULYX} oy$H{+%}-J4j{kseQF(kGpU3C%d3ewN4*&rF|5u`%9snc>0D|Vfd;kCd delta 86541 zcmV)QK(xQ7qXy5l1&};{e|Ous(I}4hZ@&sWO8Ug^H6_c5ldanHUajrj_-yRxYdgE& zo_0?HlaPd(B3J^nt!DGyKL@`^00b%OhrLN^-RE{=5SSSZ2Ebr2GssYcY430fGuEBM zS^S54`0efO?Y(^QLi~4cZ_oX2|3&}c5B(Ph2QOar51#XS{r%^E{TF`#d-p+%`^zbV z*&p`S#^rYIEBV1BAq+B15<1udAcPD}NH!mUBgo(tq-YDK_-B++Op*b(+24X`TKxI4 zyWf4a6`>R*5lTXg=wK@VFvgG$fRL;pB(oVwwg5=r3=Kf>XNFQjF%zi9I7WkBFXTc< zdqounCxWH`Tw#_7z!@%q-DnE>lS2VA0!|o{cL7!b(38#qHhK9%6*GuMXHh1q%F+E^BHjWZ&*Bz6+6n-gK^zZ2h@uRK|1Uz6 z!=1s5;iNmx3c0a9Y{@c7o*Y_1L<2r8K@kbBQ5MLir4+sF_Mdn6w|?)*_&fZ}^*<)z z^?l%2u>S8o-+zDZuK)Y5UOle=5Akys@8y?iV=eB#?Cxzvc!DS!06K;H2QLRNU<99| zt3My?zj*a3+>iD`6kUCHb?{yIB8px-KjaxE#IM^HP^;o<6FAw%#?7eu||37>E!QNiy zzi}3?{*&`xEbsKb6u`#$zrT0zYJcCI{|7JokMsW_eovl&|3^{CRVVOcOs-%IQkcOR zVko0qPoC()Be8J;JcASD)EJXk13rIYo@FRu0Ny|x!>hQcQA6xNmYkyrrYxK9%0EYW z9ABU?LySt*jFAjZ&|wTI@7@;2^#2491-@%R@iHh=A8Xp0DDCFDA)w;3SdOVsK@$M8 z40<4%^lE4qX4#lzV8j<`$~d=vCUHJP+jOT2N-PH56jI7{Kn+YN)c>2I$zOj!@o8HR zECnB7&Zb49j~wilgvXV4i&q2C>1+Y;xo-Fqn#<2;aE3$$ z4ccr8{_*P;u*Odz6#e3WLD2*8Wy_TQL$RURvTY9jb$*4^$p^gCV*OKog|Y-OMD;$% zTNzaao)QQj&!X{#I45ukPq}|y3*&fRP8hkrc7*_R$9Wv{e{tX@2nV{Z=E1-}wSn$} za4^VrZ{Zb+DNz66XQW6>R2av6BFAKoB0#SGg+eB{Xto-FPoFCQhvg|0nE!4I+Gyjz zm-A>bd|8h}th8_`j&ptjJ0koDWD0=#03!KCbJVIo(6zX-4Pyf=x?_JCJQ6(wLq5|1 z8OuW5T~4NC0l39%Dwf0yiN%-WF#w2}z+oRJVp)tZoFs%Y9D*5%5WtCOEP>5XBKloc zIwcWO(@+s-f9oOvHmU=^%?B&Z$Q4q%z!k4UWgEW4a^!sA_`h`pC7KaRcJu^SXa-;m zV~Uyx(!dVYe;Fx7ofChfPUa}1p1vz=3Wi)J0zhMg(k7fRn@}+1|Fa4<-ddx=$rvY? z&F%HbSawgUyRN9K&f8{Hu_*Fy85)--aDE(?M_+L&cFYGo1}C&<$f5w!E%qW8yl;Ec zP4scW*GPY>G-Gg5t?Dd5s7i=A%K4asrcw^ zr*~w3L%A%_O3Mgc+AG0;x|sAL64G8yQ5H;c9HE}TKzmQp3 z2I)0F?kbHmNJ$hFGrY%pB0CqP8NPuG1$vx&5kp62X`x z=p!H*_?V$I#-Tv)kz+8M4}kHNqc+eCb2dc@Qy-mvT7%!VvlKDLWtvS3^8LlN&NjO8)}&fb4r9uL4TQ5N6u2><`4BcRo zSB^HN?C_-%PZA<83FH`A#I@RXOP=;W{$0w(pbUsSS4bDiy zRUvp^b^s7F>+3T8QCX6Dn127^+SOPeOX=M$NM_^2P zjHEc!>wbCCuuu=cZviJ>PrTu~A8G-m`UD=LCooM>!qR=0$vXBrD$BZ|kiWBhc7-zDlPY8`hA;_{d4SqR zcPYv+7eg5Df(-pT#~GqrPOwxyY=U;mQ$n7w0qFZlF}rZs#4AObWLZ@Wsgc5h21|bi zooT9wQ3oz{BBJU{Sy>eIXU-ZWZzS=MSHRKdwUErx7%>#j%d_3p9At>^m&pVm7*54@ zkN`AG*<3C9KBdd;Ek$9TVK#pv0rRbvj033(;xN!O7dnsKQ+=xX;qCj2H%H%_e+}Qh z^^co8H5O)*NN#84L9RHhZs!z@^B8~J@?AqNYHDgo1$W0iO%^JfjZz#Q8}Nzmt&xet zWDTY?L&tY0Je+YEFr~X3_$*IAnqiU&LkJUhtdpv=7MpYlu@0%QMf?!Mi6wWif*!;; zL0~K@dS{5MLYIKG1|5J-5X|7+49!S359Ij{+>jVD9HW4-xMSAjdSY+|!|Q*TOahAk zgFt_8|HbU8Q|^ZahNjLPCpSOC%<7&r*7!C!)6mqo2sj;8NQ}dRyq^2v-8)?bq{2J^ zohz8xozSgYbmQ<8oT;6_vkfS*6ti0Qk@u};%#02>q#T~styX3&rQTHtQsorsXmW{?R%!6^`Kv$cHCCN5wcRh3R!XN| zrFrQYi17_dxYEZb6W0Q;_)8k!HgUc!%QdQ?Kodwby(dOv1F_9dv99Flh*xlrKjybZ z%xnUS6U_S{;8H!!ty3rommx zKUar0hB(eMbUDososu{LKga^Wijt*a(mV_ir6tS@S+EGExPmFmq^ws=xd3Zy&BI{SWtfks3m)6H61=9w+oMc*U7Xx1?n@hrLA)QM? zY$=~hLTxFbRj6CQE_8onR9Qj36cH`fTd$1TUzZe82lR4MYBz2HexaN$4Y7r!E)BD# ztS$|=rL=nBidzD+^xovPzX^GjXOs(bPd}8$7Hgjuo+70ifxIS@=OB_49j^it*Ri!| z-&#wy!fUVN%OJMEHDf-vC!#{_OwVO-+W<@C)%l$v=>;q77>Iu=N0u1RFl(s<8n-w6 zV4sU?4CPwe^9#57+LdU8HK{06xP?ITK6=ePN{MZTUi3)97k{A0z|!RFqdaZ zq+%>6m{)STRLDmpqWl0N>=NP_fbQ5P^lNSF5Jl*Y^`20~)XjqZB^Z+|fV{c)m@nqG zXrQQbHj2o@p_G3_^jS@}7J?tsA2X7t-~ur}=x0@q0oAB5B~-xHEp4jd0QC3v`tInI z$FeVZhzf|y50rW2YcpK6sIoj6()Uzw$~SCHh(OV}a;j}Phy?(17;Vb0aT0;|6aj?U z6lLJ3@SFf70~ZW3G|ppA{I*&+ciN3{NRkkxjP`Cxb{&5c7>Od5kvK+~2#^qvDPld{ zJx@1HNPGb}l zSZUDhao2R}N)nF2!sxIJl6-auG(;A4J&p4U97o{5?u_qE+ zpoqey;l+O@Lki}TCqNfmO5){u0uyjm_&}VS1asMYmmHxOFaT2Dg|^#Xkdus}O%wgT`88Hi?we;jyrg#qy7JXIRl2 zu9@9nblX#1k<=>xyPm|>Gd3^7rO{7qo#WvHQEWu_nPj`pjlN}V3Ntjy2tNp%X^$Cj z!Ak)I6ep7yfmD7kU24D;Vz&q-!VQj$m7|~O4Y&S6Si4Pg+5$yVP>@uvgT5a5d<%`y z8%ux3JmHw*(?`HsinqrTixbv~-AcAs+#88hkDGKE?6amhhfOFAEJ zbc4l>Y7bJ1CyC$*KkoOQ;DqlL{BKQ90Fx+y3ByH+DHB#->(&t=JPi97W5WIRxKru$ z0B|am8wQCGaJr{ha38eu|E&cs}PxlwfXO(A0KD7;2< zNuXGRwU^8cvT)jpJQMkK;oH&+;ZXe`;FHnp^MlwSLns)G|S!x(x#MGt&ALpt$xiuAalrj>dOsN-_ z#=q}>?D+=F#5k8U6r>wu)yXR(DT&EsevxJfMu#NfYCKLD1+oN~MYY{oy*K6gf^&uc zPoPN(sGxwW8JYrR4l5&=YRNa9eBpoH#WlJu9EZdrsM-l%yF@$jicefr-zO9@Ovl25 zU;vKD8DSUdELSqO4s{Kyql7B=_@lE6p#E9Q(q%U<&siW!s8|%#w+izLf(GDF9&3NV z8Ra8re5vtpN~kmeiN3UPw|cNHNn(oeR~PveKaM0K+CXc1a=hrc6{Wr%C<}jOkRg(y zMDj?Xs#z3bJVxO>jL{oHu3H&Px9N`XR>>Ke@sqFZ)OLl&BooJBI93*cjFt908(key z!n;9+AyS{Szw~~HF=fIvvGf|cQElqGk&ME86^c~DcHH$4C)?Li zNO6Qh;cFB{CT>-39qYa@SO3@0NExgwZzl4mNaA<^arA)+#v#rW=g8X18dGUlYL zkZRW#^>>Mmf3flKpXD<%0R8>vFN(9ACcK7ad`mwp+2Syce_fhutL`QoS$RsOm7oxt z)Y7Z1c_8Y?VbL&@j)~9c^w}kOqe_#4~DY-Bp8jBRMk^;d};0 z8MzUWfj|}TW#Xgoi9N!TMiN+m0q8}L!4|B`uSU8DG{1^)CN%81HeIRC@N=Hn;GLl3 zYu4%Pg4-z$r`q|Nf@q$=84f|p#hqf3;ACRJ%M(Qf*fuV`ceo~@P$hYP9PfgJRM3fC zSe>GGK{zEu2!wfeULX~BQzdh&sQ?ym7z)paQ?W2q87#kwfIDjtjaG7*;tTjWg3&J- zX6RiKwpcC1JoStz{tt2|=m328BW}?b)Anq*UQ5RW=vbpUJ4ZhsTHUIci5K-jACwJr zagiiI*h)OO^kyhk5`D^lEiE9TowBr-r6Ocz0A}+5rm4jt`<%RhWWG>bNaqRVu`&Aj zP^Ehl#U|*oay#HfAPnD1#H}VQ-I+NaIfrz_st!~wB3G5ReMRylvKN;kV5NQ=w6-a^ zf0^Wzrz+1qpFG*Po4N=U6klpKWA(N6`cQ#o<)xcp4OGX!lTkB3?9_0_ZlIiGmd!6M z-L757>jqq0K``CFh5bi(e%A#ntbe-Hr^+XsE5ep$^hJ%nSOXO$`o`t2&-eEB_JZg8 zlUo#-1pV&*K9l$qi+`rS*OmXb*V}(l$5^ZN!uh+LR#waRrS&w8pCZZ?<>G4SLjG;v z6&Xu{YPTyg++HEjIU@<`@HL`yDAw4MQOD5p%R-UGjiNAT_=cZJcyZ~VTIL1fXD*rN zjW3gwEBqr8ZFZ*I;Ed%k4sc4vJ%wI`(u~|;TbFnEGXQ7OF_QuoAAh~QhW<30iy6vh zI1!@sV+KPsvOM-r5{4#11Vwj5PmC5|!kZ{Z^P;OV(Xi|5u?0XQF5ZpWh;fzcgEq&E zt6Fx@xGL%?PJB!F+_f;AE397*Kz}{=wd?D3LZ3Uik79tJ9Q~8=-B(uOx>;VHjH~i9#Xf zEz&47V5rHXU_yV)q)=x-SY^0cCsSC6tu~uND_r-RPoX$%E}Ngg66<9~{hl%u=#DH% zQBaWGDoH^N(8nwVzT1L^GzHEYxJIG^V}(4037jClFDmaAUzuYl z0Wt=E{Nw5H!b~J1e)mmSsNO#FPXMs z0S)(>x533-o4CQ&0)FSz4Yf<|$6fnlZSsct(OWlrg9*7!`iAuwyJi9hO>D~y4)-Di zE9Y=1iC;a5gW03UG!9K^914HF7I_?0-Bondhsxw&bf;}9hlfP()$gCop}db>l+8hN z=RwjrSl(G1&gWn*32ievc<8x@lnzzf-cm^&iqqOUSsi@b`KI$aXs)fB*ul%V$J7pu zsU1d>K^pe~n3FjhCjrHiVH+TS0R1)?8O$b#9gg1f^KFO{1}7p&o0l*mmH@tROPfy( z)&fSuK2^neDm>2}w5o79%%{qSz0;{pKyrZ+h7%MwCm^A!mYsn_ms;`SKG-%&K2Ow@ z)XC}S-TCG4>~bKjfnxF0={oq3svvF|9$@bjB6LE6kt%iR8D=0Wwfa6G;1}6=Nzm^HSzo*5fD3gW2;J)yUExUD9>p2v znY?j%2JqMzCrrV!7&1iJvt58prYoF?MWJxp>@IiSuX76J{ZTh# zX@+m02#AwH(DT_54f(Wm_SyVgHTwz8Wd-GvZm~``H57Iwot9jdhCyEH^Fb{HT`s^E zh=Eg`w2gtpaEC8{Dh$AEUL+6oK>Bx1vV2xfwf~>^TZ55b2Vmddm~UnRwhqx9svC~6 z&=Q4TKpc}>ZF!s^_CYuPAgTI*lQG%e5%nn`IqRA(U?P+bQ>C_x5WX0i>bns>N|pJO zFJi^OM>^LKx7m9m$(6Vxwj|Ih7N)O=zk|ac!=SD#xaU7=1EA6#Ce5(o+%_l z83*{xC?-0V`Y~_J$0Vn6hHx>}`l@h2f)(;DoQ3P1OW6_`_ln_dn{m%jC|cy)Ge~;4 zG;-y-b^m$fN@>_YBDo8Pw@r!U%Cpm^GOhVU;XyL3dAqWqRBN72El#!OC1_K*))rG# zlWWbSYBR~!>L9L~ZLJR87m#j$&0HJJd~3SAUCK58*!fbf6$THm|E;H8D_FZ?-ZkI4 z(+GM)iP!wVSI@lWhqq4ZH9y34bFcZKe(TBCie9greXWh0-cS0q8t`l6U#o$*Rsyyf zm}_TXtAYEir(i3(y+#hUHX?gpN!aQTtdoVU4(57k*y^CJpNFju^0%LVh^^GO9yk-5 zgZM#Hu{pROEEn7F`uJpd0$wFVfm$onf)E9;eSF7dm!D=~ywmyy+Dqc2WBEoM%e_2) zAkT9D_%7pG-rw6hb)C!oJ-T1-a(_?0aQAXA(VO!x_k!P4#F6a;Ug%2?naR>n5>`xQ zY5HLJQdxR1tdh&J4ox+Gm!*?g(aD(jHD%eW+KrY-v*%&hf;4-J(beYJYlZB7^XwTX zwMD_%v_kEDMrYdw-3^ClyH@+gxNILK_Yjy}6^3?!***|U2gH;HrkaSD3h3n`Vk+=! zLSoEF7{|ui4q_ps?SPt+09u9J`0T`ubhVAfX%DC9qYcXG%9j&=&7-P+KNlH~mF`NB zPH1!$!{mCGm(2@L>Iq6v2Gv!(7>__ME;E>#nh#LAy13TS4nDgejS-|sC0K@x|D*I| zuwPI6KcEkAQqaF}__$KhW^5P%3|@-}8p73MflPX=iii?^hAbW*Qw~YDQye3i*Lf!3 zOk}+)NUOnN3&Nv+OgXLB{9A`iRp$RU8ZzbM%mYURRY>rL1XTuP`H-LrqWYMi3brpk zCaAGxz*2XOZ{0$FZtHwOd+jv_83ic4M(`t1Q-MX2sIr&=hUq zMIqdL3+I+2;aaNvDfOh2DKhzBgd|Cj>FoH+ROofW$SN@H0+PgYnSZd@u0xXXS!%-* zGkD6CNJWq~fU22X29H=NU#K|$A>mm>lCGqHAIEpiY63Wimok%R>Fx@Xd1-We@&s&G z2#pYBS|T}r9Xq9usL8Iv4p2LOTo*Y>CK>P7FpAU(7ORphSKenFw>6+%cQXaZa5wYi z*GlcwS)!D8yHYK>Fsz_P5-yp|(6WYFUuBJq#Av_)Ck*Mhp(S7+-*GLITIup^1R|>| z$Kv}8R7!V}4Zum_uTiFA^?c+QEaJ5xKr`93RCoq|_ShX)w9>F1uR5xXJdSCrF+FZG zq-s*0U7VJD0&ksrg(5COpUlL9Ld4Ee#JbQnSVkl=5sgSxxx`oknaI~xrC;sRHAuzR zCr>zTZS7op4^&AbWZq0=Qr3wio;=w~T~zk&SNYskp@_dsk?1xfWpHAJ>@N6acz$+r z_T#{R(ZzX$%?4c0r!N8;D~WhL(uW2gT>YQY`53ZLrl|IQw{o zx@Q!ee?L5wD@V;1&i6rH#~quk>D8!97Gg}K!F?#Any-|86-T`UV(UQsI?RDAY}tExn~U-O;DK_Vk5 zbYSpUgxPRS4JMJELzpVf2}(ei8pgrAxCsx*Y(^4+ly=8?9E-{f&C*!Eg|h{e>wCq2 zN!y}Z+-C59*|c7gYm}ICoYzx1_vB$mS_}$PAFsbzZ(n_)Qz&{*a*BlYOSu8K6#_=I z?SR*UDHb)#<)NvoiwAi5dvzO4L4|X;x0PwW=^SC2<>IOZe4j@XRGkAYd7R~mX^k;? z9$m@BKe}?3`{=4^){ID0Qm2SpVYT9aSY|jG7EAgmPC!z`CyAqqFa?WXR?3uRq1*!G z6&q)=e#Su~HNm>!M*=OpdvEL|r|`~;SeZu5ZKnaJ1yjtpCr`lT+l%Vr#R^SN(Zpiv z?nS(z(l1(^9XSA)v#GSwP;hRY6selKQIl}cDJnF@T{nx+6&azfhD5Fr(gRH}*Mr>#Tv_}$ZnK%fe{?)LKRz5@ z9v^j8kcvefPAEe#Do&hL2(^fQz%dd%J1pCPu_`p->58?GenN9Eu%FP}3(%-v3-fST zf*dX+v8?R{7)^yChZZ3DKg_6qqoX(ShL(bDoB)zVa%Z7=D(=*d-iVu@2!uGDqO80P zb^%wjeVihe;gGtPq?s(XC!8uQCY|ur6p1xtD(^HSGrrvAR9tyvDx6kbe;7-(0@O4` zJ;^kVHB2L0^fE~_G)Uq>SY|4Xbu(h?u+N$Ju@Z7i^p6No6aRsm4e!kU{%2g z)K$ssHxwVN2@vvdDH0vMA(Vk3xP^1`d15}A>XA@3EpURtzw#Rqf;XK9QE z#mTg58sRv+;t&~5QFt9(qd6Ub86VZ%*<9Qn{DkI~VM(-dZ$d0OHxY?!OwoIfLH=qy z5zA?_ydz?<)wXs-T!^jK53v=l`}IS#1aiaPetL0I3XLUPbxwbO9(wM<=Wj7(4c>mm zs6C|TbGZ<&==fZfwFU53aeJ;ovVzyMLsq*-VGH!X-=nYw!RAA-|B!%wZF(K{{-|&9 zI;>PhiW3LNK*J1*w;TCF((zP~_fDNZ_xJnN_<*7}OZ&uX7S_4MRv<6u66=B&N4`eF zJ=x(0fcJU<sc&@-cME#?=y11Cf>!po zb6MZ)Z};R07?pM)WylAoB;f~k&n7X!Y?@yQgH1>>L};&EvjcsHZrpz@)vk9HldGQ0 zKGQoQp*UKp*I-lJokdSj5~T!}cMPhJirxh)y{c7c=ZDIF{BM0NG>L7xBhzf~ZA!SI zE2T~a#untiD|-!E#lY5(Rla?GX<8frPE<^)an+)Ubv(^2Kl1Wj@xS_LLB6&4uaCcVMR5XFc;5sO^Ga4s8=Kh^TmbF7bnWn zf!v;`DM?7CG-I8T)+{TOuEKgyj*>A~3sQ`>OU;e)?4=NU;&08{EWWE#(loVI%?MMG zX;DU`l#|+8H67$e?4$~(Et;L@vCcWE;=)&5L!Zchm0pu9pyAT{am!SeIo7(h&#vXJ zeNb;Gb~SLWkDm9t0y@OCS^*tO*IWS|3R=ink)hsd*+O1gptt;5jD1=A=2Yy$g=oll<%j|$N7dR%ls7kvI4D6%`B!Ryyx z&jdYxCfNY&&&;B@8qm%+>>HE`-*l8^g~R|?IdK~0vl-0h1IrmVp^WQQ;L|6-JMdJZ z>lWpoKX<_A&pLyt0WCr_%y24`WUc_QOpB_4+FX~J`rqKm)WR#7|2LZ!H5fC|!WoL{0;nn*`~oGA$}2Ql92`>SxZW=Uep*NV3rGI zXC|-tOca*r{N{WFYa!P4WU^rS^^fB2ic!NKM3U956~3R){J3=5aHY>BS%f4)ingUV z2zL(@eYi$*`avYQUPmDQaWMOJ2mB3q#Gp^VOfi^33KSCnXTrS?zlqQ%0fGvB2`Tb_ zVjqARPIBfX(kT53Eq8&F1T*6@r5bD4SvFJ^jpiuG)S+1RPG~SzqMWzD?A7 z9+QmZsrG3pa~J7HY^67yPzF`?H*D2?0P3Te31I3+x?!^_0i9NZeKrEI{UGWAH~HK#qsi<6Y9SK<;^{g6V*OD zE)*X8e&>mLNQE1PAC}jFq7E8^6EB#hJtyiA7(Ns}Jayg^P2jXkK`p$^cu-hFZ8%W$ zt@lLwkKPma;5~6-tqjlTgWl9tWpBAVJ9}Ac4Z8Jpod^C3_j5Ljzchz{w(M(vd1a4X zd0KEsuM%$vubUE*%p_Mh&A?baJkfzUBb{A$KNAOMrrsf&l3OuVwdGbM2OE<(Dt+RE z2+5#V;h&GP{}nsmu6FxT$@K@|BaT3je;kPa{s?{pVa`AhbwCFM1bS?di8nMC6j*0v0+n814%)YL_!A zpmQ3sxKC@Dli^@Rfun1g|LUd z*8kGK6m9N#7KvV*S>6!JF6I=R7NJk#nTd}*I;S6vz2IYymvf?ulZ@HkT2y{lMM-sT zW7<&#-ovRx)}cP9NGAa}I=gTV^(DD>HFwLnff*(_1$3S;c&E}7i4__&NuLEiIh~pwp#77gzN9)=6Zat-?`P_77QvS9^i2}!PjQ=B& zY@x)(C@u;`znkzCFn>aGF_vWsxJL60prHA9jPC?&K4j|8wr~rs^D#mo%}|OGb=4*z z6%H(8zB`x!Mi~+*(>QHgHcZW~`6`;^GnC;F zNOAx!!sTtGQyfJoary#4M~G8LE#bTNw-gFd5F*jjgJM+qyygDuvn5K>6>BMBQcueo zFMP|h=W2p;Ck|ni(W^|?Bb3HuK0^tU)AfQu#?|iH>>iYZ$* z;ZxRVpns+;a3!`(t6tY@hw*l=&DSTm@;S2yqa7b=#sbt&Y_Mo@H{r8;P<^GM3dk8K z&%+kYZ&!3IfS;W?L-BuH=7R-dS2G9&+6xYHDSl)qiNwU~&=~W7RcgrcQ_NY=ulow` zIwB^g=KK2uGmhg&T!mk=+<*m34ltJ;<;iJ`jDK$t0@gz0{50=WHd$DlsGt(K@tp-@8G+c5gEg#6WIZ?BXZg^30a6Ya{k82WmxHU=1 z-Tf{~m7Ab8%hQ7@(@H>X2N7p7Ix@}mZ$eMH0-;A{|xv8@1rDZ&@#=Na=2={aho&Adcz%3{intx#D{8>rjry zVJSR$DUMJO!pt5V74cMsUMn!(O~CfYUS=P-ucfWBbofwh-yMRee0|r~>#h;)y3FAB}-FI0UD+{|)?Z9?~L#EfBx~^%= z9pw|#0Z(_pZy>=*#JTr^_Za{v(|?m}4lM`Rh;!>lB=0SC!UmD#?rILuoyg>$Oax1= z^D7jx7)%h8HG-gwG~t4BuC7eZiqg-YK@bC&rp|?j_U3)1=>77`L@K&>e%TbQJwM35l<8B;m7isT|wpQc?}JnYm0owr65a7TkuW?tP8 z=4@(q_|qp|LtOHk)x0VCcYnaP|GSkien$`8$<`FP=AHanR>{n(*;9n zX0O^6jYE;riV_ow#R)4d#tn`*OCh*{F^eL9$gr|_vk)<)<@AX;WI;|YCOA;_vIqLITsn6 z@Zrhy3rlL5X&e61t$$mqyYwdP8k8#VM`Q*u*F}m~#^oaxg(D%AYajp8XL8)Gw`2q$fMSiFGt`LmIqS-g1@$xaA9!Yguvx?A>g*)WQ=BSKpY zNt)q=jX~#+G*D~JAE{vUA87|{yNX9;ymov;wQztc!vMBj7JoVmpDlzt9_qC<^daaE z909A6uOHN_qrY}rTynNHvg!Wks+O5mr|g!q`k9NFyPt1e5}|Pla*NeF%M(SjH1&Y< zv`Y)`MA>~15b!Tbk`%J(>&_?fOtj>F zpb7lk0l$fWtbdm;KoHpj&wHevx8Zx2=$Nx1ixKH}!FiqlXny4SaIuSWNy#Y!kOHWZ zIZLMKzGr#TuG5lu_0mreWJoBtub-Wv8 zj{|*N3Iaf5gi?SL^=_8C0h$@IIfDTJha{a#*1CD1%YUbeBAZ)b+KyR0KJGn6dXirv zO|r$oL66N+^Xn$CT%&nCl53ITa&;Vs!@6FmFSY;!AaY>ai;NyFMgU|CO2y2}Xmw0u zYz_i!%ice?#4;2VI{YI2y&*fL=@N>j zO{hJwxy;0ruMAvP-AM+5fX@+UTJYMitgpnmT#cT9bD!$?HL%RkD<7U~g^n!s6fKEb zp}9ByRTS5D>fVF1=s`G8xB`61Jn$;Kzwi7~qJQ(y?C>1PPxZ1X;^9aefFH5zRTAg#G^=Q9bffi4C%eT^UMscLft?CWu(zxnTIq1OV zXRGaVr*X@4&6K50s(w`#HcO=*>0`;+yQAX|CnM)Pl8^|sHJ{r@4b0Gt{$uagE@hDA zw0{euDC5UOQKtU*+}Wv+FnV`>=@79BdYYn8?mir!esKMBM_UnTYZ)re@|#`*o+_5} zJ@jeOcUMii|H)noy(LGs6}OEn$&lp}24-+BU(knOjBa%{lOk5igbYqbD$1uYSapkA z>tEzMg;NBi5Xnm~@XR_f-?Y6*xoth<&ws3$adCY9^U0xSaUYiQadMZ~;29pWm zyJm#$fSycd(oy~9BiK_LXIK75jxJZeJNGBTC2y8fp1&9=H;nr2mP;)Fyg$L1WVbMj z+DQSu345(2p*<@HOK|;v?@JK+`>(ot-Mw!A>kxygn%80*^vXfCdMR-=N!?b0Wu|ngAzL_dK!#)sMf64u044yx z-dZX$+CHOa%?W*HXiZ=kj)E1SCjiO3Ed?UG*3T?;&p_|0*3F zDPq!oqH;o-df1cyvHl-8Ipurz@az&eU$*}K?maj=K0X4M@4)Ez{D*hvr(k#n-j9Af zA08cpAKsk{cR96eUV!1*5%}fZ`A=`(4Mm&pkHO*j@$mBas74NdZwJ|L{D0^Ae}9;w zI7J!lvNYZljs^bT&-Y$d{J&rI_a6PfAL94vQ}0jU2G0g^J-{&%&Vw_~mT-y&;7>id zTK4|5b&gn`B|0a2inODsTztjTkfJu9y)r4kb5S2Ce@kb9mpPPlCFP?m{yHbbIQmIE zok>itU|bfkaQnRkvJ^rT%Ot6=Yn(5~k-$g^~V}IUGJ@wfn|u(u2T+V8#! z_Bx<@2vc~4W6Ut3-JkL+q@Z+v#7tA8;fXUH=%71>62X+-P5%lp*e_8EJ<_RPKAP6O z{!T=7+?XvCYnEY?On+(4nKUYsmyhZgl~(F#5Q|vVf3Yf$+{kiqvWLQ5 zP5CRzpitx0DE(AR&76~;FJmg_k;MjnYVaLR%`%uX@*_%6Ch|vaS7IncyE{x7P9_q? zPPKyRYNsmgs2hKAL>4_=N=g(r)J}mD^+FnA3@0%JrC zH{fb-7xdF)w+TEjdSBX4I$)cnu~qTuPF1j~4TCUa?W`_KaXE#o@YoYZ2d+DMrd`3) zLzLMfw(Xi1TygAz9dDnkxFUIg;S|sw=Tb*7+eB62O%X!hIW%4_=kyDOqfEJ|5(aX? z!HIT;=v0RF2Y=o2w{|41$LDJ_Z^i4M(EOp;eT{r;Tr<0WQr%dMBaQI*hKYAnMtLQ?OAH5MtS*gWzlk#XPD-^U_oA06?w1QOMJ(cA^ zXI0jjLUjZk3`3a#n1Gx%oIXYEp{#6gNtPe4SxpI=A%7D^qT^PW@)SrXM>Gnh6W*^64W{L(x1VF9mk+pTZbb`!R8J#KhAE|kHNJFDq}MYk-T zp;^l24J=q*ThjsLMSPCbYHFuC_2^@jTO3>WawobupPTAeRdg)}8yT`n&-r#P?}#&g z1VuL}l7D7-E5xS-cSZ`LyYHKtyszU8-wcq;^3&JU%UU}QYQe5yioFcOECVd%8yx&J z$QN*kWlCwB0GI$xn?4(C<1xTY7So;GEyAWKyTugo(uq3K&@z{(fbHS`1Tn#aA2Kr2 zTe>kDp2jHQXN7IOI`&_J?pu^h*mMW{2Ke#MTz@W}lB<7->M0OBmoFj|T5YYxtI#805)I>Y3eWPH?2XmL z86tOGGUL$H_|}PVb^KM>{Ze*Po8*AF4=tm)hxda_}U|Ut{m;YkH@QH~s zS$`FS+VNeacjS`SX6fljx$1!a9_WZQz@1t#U6 zs{j)aCsTyLl_2+ZXB@MDtAFQ>ic!c=)RpYeynqe`oK~4h#>Cgv3Ck#AehzI1f%s;Wz3$xI-Q9I|Dx>2l z;#C(Ssfo05L=yT=9V6b0XkqDPR(J@J1eE<1+0XO~ZZuCt>dQzvrd|@2GJnm1unSVn zj95fsP2K2X4pe|pT(NR7zc#Awx_y^%VO5qbC(xBEAa&wxDaZ9YO3et?HL!0usbleKqMr%;@?0gYa@S-GgMqukd4Kg*)8*R>53kiSDjInXo5n>HpEi~J5-N?ALLpv&oD{ce zX3g$`p*oUWH=Zjh9zNp7V(X!)nxR6Kx0DJ8gYw|tK535Pz5kIW|M|nvsm(X2*6N7? z$ZJ2UdBIEeyQY%;nAPXcQ$iW-~H(|n(vAy$$z=tSclX5V3#EG zX-hhJ)obxDL8-v_8~Arl7^=@W_UX|d^BeuS{-1>fxjTom4S9ez`+x2oJb(4V@&7#7 z-+%Gw|M?KV#*0ehIzR+vY?bas18~#dy2eQ~0J7F8Ot)r;!3Z)q*aDzf3)i~@5$3ca z-egc4aIyttQi7UPxPS6nS1Q3-#FyVnBHc=E9NG4*XbOCGz4|=6z?*2-0%&B|1)j9N zRw|4d(wtqud`Pf;O5i3^O#}<*HK^4hP~OE2z;A)*(-ZKXqAcL2ju>S;amCozn=POohq4(F;mi{%WW1Hp6@NG41qPdK>ba@KY%@@A zmTz9b%QDVStjfTBsFHP5HszDo#*7xapYsc5Lw78LL5wNe z+yQXG`ERfP^1wa+J%91?@%;A?zv}KQBtX8W$|s4;NWc8sBK8X+j}z|;{kijBZ}|b= z**CNTESUfM`};55`Tz3y^T+xB5I?U)N4?6n(4M1(<AG2w&(QBaQ{lEYG#s0pt z|G#|k@-hF%gZ$RK(UIcvxc`6aS2-z8CLb~cBb*>gKg1-2ahFcZd!7I3UE!oB->%>V z|M&+8#=uFS_Th(1)Zm#JncSrb~**<1XPo=RpHiWa#Mz6 zntzgnqSsHi^){#MasdU;!PCBcUIc*h&5@!6fM5y)8>WOZ@K0axp|dfIMyck><=YFH z5YvDta=w{=t9)*rr*DjSQ(^u7rycPzb{(gthayiLHHiT_zg!J`A9SE{&(${(u?HTS z{8{}St|*Q;20o#?;AA5HkhvZ482kfto`3$|4hYb{L8rg}q62>Y3t&@}s3s_!641HC zGZX=mGyPsOy2A|g#UEpAg3{8^0sr$FbVl#ae)K~uE7m|1b0x+%=y9q%PL*$Ks%SCz z0cVu`LbB-f({0hXm=xeQFhwu|LDC1m0eE{2o_&&uPM-Gv^7+}$!WqW})BISVl7F?{ zz8fB$w5fPHytq6*KYI7e*-F#6-C2~+^zsZqrU)|b8pI8yezE(aIKXO|~u z$8U>u;ltVc)9;VZ+bjj2YjgBBZv%nslGOHp9d zEWx>eB;_`wGGwe+R<09rn-n&h#TUtcr1JkdyWnKBD`)_#Kvcim1yA>M4<%Nolb?TW z@p6s`+Thhz@saEG;?aVIN=;dFCw*Gn}#y5zhEzi*P3LA9bGY>3PLr ze~_* zQi&DvIFN;Ass}#x&^V7NVpa-c5hN+^q^fu6yqteubVs$^!!r+fM+MWgYiECi2+1rZ z2};;NMILN8;SxdKcEuEpHBwMwYjAi8Sa27AX z5S~>+N0gDsUMbdIEh>QPX5e=& zO6PpxN&ldeZn@dUb@@H?rUH4j?l?|;Ru5YS*XmXxdm7DWWh}O}fo`jFQ1?;^VE21S z(Fn3B=s4lqogE=sbPD$mUeYpmSHeaEs?xB&IUD`jcQ$pD=#*iYT^G0E7 z{ibPnO(a$rg_i@BfvuHDod)Pof~*?5s9iyJhRiTq3=DLN)ZxGBy|x{>)eP4IpB>AW z2)nzm(-|g$$QV+3rc!@T%LbKCK7Fv--pG}*6#Lj64}8DJ*ERX`hZqLdVkNdO7azg;SEz~KwO)` zghZ${dE!;-X8KHck~sCIq5ndo87%!@Yk{2dJ{HS-KIax6o{C zrDP;VnY+Omg&QH=M6yB3>r!DF{ivz3py3zmNasdbW=NEuQH6h364K^Lb`UH}s+S<6h)>kg zWn%Ng2D8bUTc(4B1KhxX2{0R`)C9fOI0;gmK?*{5)XXQDl)a}%8O&H<|5a?{i-s2^ zH!fDWhJSx@c{V&f`EYdn{rexS8bIc|RqJ_{z-$gWB2h8ujA2Ys2W*qfS+FB?l}{E( z(T;yDFKHo?{wn9kqqirABJKN!(|1S5e&QSxunA`P_U*f0J{+Hplg3Iz0dSKFOD=z( z4ZnYT+(N8`L^m~M*@?zg&ijLlV7!A*drx!~T zR=z~I)GS-P*xZvKHxO0TDMU)3MYAGj?93h z0#RMr7xU`yv^uz&gpIRw<$gt&H^r=yHq)wDBftfrc8`wq4y*zz#D(|%5|Fui{u;Wc9J zxTj7o5@Yac&W$-`WOiW^v|$b`M!0!{gmx`$7+R}}%|>DKhw%}L;k>~%Wh3!4az`y) zWbLvcrhZ$O{5=8h67hsONg@!FWP&olrZCY*?7}@?y)2q$=!P>@y;y-s0>~Krhs>@p z0;#mFBHFd3OoA{8hEddSrrLjQW{6Hn?DZG4;khkbh+~N3JVQ%BbX&L( z(Or2lt$$v_1(0j-)KlmjmSv&xzo_w@UPyNnXBW=!wQBx0qs$u{xubmx7N9zIOrEZ_CmP_A4tHv9@yIlbH@$z=n z8&U5i+;7e_#bXt5{;cLE!}3t#3!=kPY9S44W=CT0A7OP$y}1 zuk-%m_}ouNgvKzBnGcN>r|8vxb{=p0TI{l|Z{LPTM>V4)D5Zm5&$HEtZH+)egIr#v42BKFFDJnG@tUa*Q$M^Zw2; zwOH0Z$SgS9s2eIAq0pJx8!$!{U>Exi*LXZXO%RHx`y==bggFC21UjGtg7N;7*H3qU0PNLE zq9W%0LOL7-8@!rVkXM>Hm9`rpMa+aZgtCh{U3Pj+2^E6aaO&_>X`^>n3M4U}@U^-N z$HG6+Cf%1 zfXkZ*F+;P8#I0j71RxdCSknW4k3iPmmo6GSH${$4@8ap|a`Ula&ha8K-L|S-?wM5^ zI$C>+>pu~hyW9*#*iIz_0Gg$2euOidBw2IOuBqU)i>C1Hy7)inE#{h=>(-+`EZnyX z2+Me#`?a`&6X4T=721FK{mB1^;(t5)TPxdJixtsXC|In#&1=>~YdPP4KX|#k$;vR5 zZ9I>Y1$)gbP7Nl$&F5)alW>o_eS_VsR*IYh%9>N&cu@gtWYTYDk~KK~SNmg1({isFzB$4;onG#yCO1@ZoY;Q{3 zI;&jq0n z>&U-78|^3Wa}Leoy>#=xA3T5Y@-hGWL;S?uXG+uI4a6~5 zx4_^v*rsT9gR(<1OJRmU=dbLL!d1wzqVoaA>F*@EO@ zlWkKt3IC$<{?Ebl=LeInQz-&XzmwThLLK`{*-yUqU(Non9$VOq4zOVVKY024z}f#_ z?)P7lI8*W)xvy{#2+QmkTlacO>UE0(OyXNmozSQ^5g_+FP5%YW7E}3nb zJ68iNjC20?$!Kx!4|P>N5sJ1=)RqX^s^q#QMZ&Rve`q}vBDzclAjn^o9YRhOK1J9U*41ya#m zkgUs_`dZi4^v-ENL4XH$lE?9u_ny32425f%AZ^KAx{a6_z?)^uA-efwzfoh(!yY{= z=RfIx;1|#h8h{tw{~sK@aP7Yb{m1+N2l>@Gk8bMdC*gf{XFnr-!`F5AQ{#6Zr@sc! z8#(?p!2j<(|2a&l901Kd+E>@sC0ZZo98mrfUHikuV#;=EEBj6~P3NH&%^#HJ>XD`C z5LBDVWg+OL)#E8+X<#R+scOg$c9F`hQ1;S)j4%?CcmOUBM;?8-VHx#E*e12Udgu?W z_I=?u39kN^NXH`SY_}l|aFPB0)$`}B{lEXJ|ET{x#Ltx+M1qg*m|vwkrtor9i|Lm1bSqZP)mGP+dSl~4b~#T=x3`mIk|9ce zYpvwAb4!NO7>A-`#*Xex1d%jOKrNjTjx`n}{$VN2t*~iOPrxva$t{QyDqI=joPSnW zoFsFB+M^Gin}JWoKK%Y@WPv0(yCQiKfsiB#3gzfA0tlO;OdB-$;Lv7t%O_)Wgw%Jb z*np&{?x4}-E++dmU}AT`kv#odTLSxkEsq}yWofP1Sr2{X;|KsaF=Sc`6HY3!^bJXk z=O*0Q$2b#?)k&yqH@1?%wv;#P18BYf1)<1dI#5rMKCqN86m2CnXBVd>Fnh>~-FpQV zElTpd94!UoMF!~da#9GC0$vkE-w;Q?m^C93)l#&Y=&Z<>CPMCmHA|+hS!|ep1jf>o zW@Lug6y+4qFoP+gU`#UW09w0B6=_(PUd5H7abL^02EWWYzU*<+J^!WA)#e<()o;Q1 zum5uYrE~s!vA4hfc>a5cpCjaa`2FE`X6g-}7e-oh*el}njxf#glxq#&=g|bQ$7A4s z;W5x7ZZn*eL7}3ZSz_sT{_0JCOc5>M-TMSOD6Fz75>FGqVQ_ph-sHEN0)=*#Ju`9{GY^bPbzNP4%meg3a}kPGN>d8Gi|pT%iqnjo4p&pZ&J%W#B#HcHoyHa=;3Bt#6-sWr<7_yB3ANL!(}*vX_v#BZ)iY$`TQ@B}`a|$N z#;yp%Nq<5p!{I53ysxU)j&Y2~D4d5edPB&ylOv$`wwb|pP}S|T`&GKzWE-gMVeQL$ zUN*H?lk4C%E6c6BXY{1a@bWQ%NwnTbIfxX@rAEqm#=c~h1hsjZT@1?->!rvj;#0qO zg_GVDq|RYA9N;E~Ou*SNsTSk?B$En{-cvZuw0U^d{^YyR~xSIU+NN6PIGY(5~K-4N~Pwbj?7I-ko25ID3Ek{qcEi4=SVVN&U4z zM2BzRzWe3F@#*OD?;l3Pi;G|0ogXcpJ%0)5fX>`J>B5{%iv_j@r?Wa+OuC$vE-%R&vR)JQF!{ytH565T2?|fmS{SH8JtnRMkkh$ zrk0|kHy=jB^Wo{m(u5tok;s;uW`Bzp)BBR-2C6(~0GVqvx%nApmF;d5=Ku?S%kx0< z(aRI{Vj?*_ZTu|n4l5deb$xHaufx;o5ErlYd$)w7&UV-gcJ(3kb(fPVcaha;^uuj$ z$#K#+f(H8=Fzt1+guT{!~TUw%a+J8?j7N!>@ zytYGOLE#ne^1spOlT$`!7bZm;=0OXL>zWz8Hq#rFAW9pC*Q#Q3Qrrr{_z1;t-ejz{ zv3Od!BbP3;f7>8azx7**0iGd}GZPw&qW%Jqb}JVq&Be>_m(vWT*tJ7NKrGRdJ(-dD(bL3V&}%oX^lH$&)%Y z)4C*ZU>j0K-sJv?9zf&GRau>3w8 zKV%JUdG`;iWm`88xACUE9TvfT^mgzL!hLx=xELPF+rfLi{+qL^;4%2eKR_@B&uXrf zo`GL~{R?1IlsGNXop^TAzDRogbUTC$)WF(tK#Xx^jf*h-Ab%mF?9;+WRElMQFE&Hz z`~ZSLKa%qK^Xu|$l+T}6)_lGWpODsW4|2$cZ%>9zw;=7ZeAn`<>892u`26{BB~xz&vOoLY*V8iyxpYk%6)&AglZ2-SnKUR)5ez%bk1EL2pIV>!R2FK2#Rx ze&3kNQa#JsDoecBg2U;GWu-?l7gN=MA&=yz_<8SK9v! z^r{u{D1Y6G5JpMfs*V0#CZFz_c*PivI(b)x3N>j|deP9YU<+_^#wm_xV55!?GL@%*jm*M(@A`hhUUW4&{Hp2cJNYaxeKIfgcz?ICNzL|}_OpRuHeGw$O=2J1U)*{^~fuool@UkK#^xbsQqV4*7bnR z34fD>Sfhh@nzWI^OJ68pJnu%UoPt?IpbNS$@tyA6A+cBf(P!l~3DF_g`{wD>5`ZO_ zV+Y7o-<|>Mss=Zzz&cZqGktDO>uzns94$%|w~p}*fJ9Pb1qL31taN!cZC){VmC3v0 zLABd?tT}VyD|y@oWt4aArZtFGI$|p{BY*pvTc8lTNuB_Z*{WaQVlj5vvhm*31Gam} z;JtY9ztJl!#J6HRj`^Ya?#_nj67cPp<+8;99~-!IJBv^&Yfy_*Ss+#(=>X%3bLp^@ zgQw3{Frrx2oBor0IfJj6;;Y8&)PEAMH39d8Sl3x{Dha6|DX)9-!NP=9MN{g(Vm5Eo~oK8LE=Cqc^a1_Q1vhDj`_F!V`a^_7G4FA^zM&?2(mnJnl*7PRA4xZ$R&*OM(S_RE%os~ zp#E_w|3B%g>VN)es{enm|G1F<|H;ALm-@fA@+mToOBm=}#h_y%f7!JngMa@!vhf=K zvQ_UT`@iJgUoH2(sxz;@dzi4~=o;cki0fz;P0)v`r@mv9oj69V7e#*{d(Y)U`F8UgoMVDoQR$nG1d4Q(M!8w%8)yX zB<(}+-ZiGFmnLnEX}>gO(tj6cR_>Mc^U4}*K3El@9Q@~8tiO?u@BY8UafsttZ(=~h z{lEX@={Lpt|4*Mj{&N4{#^?6#|8EsleGvoxlf(cLAsxePF3dxq2qoonLUncQ@ztN$ z7?Xi1oiD}3&eXxu%YUIj*$PI$DLSlE#}7b#@N`9*`QP&$RpkHvT7Mhs%~8+)pFR0z zZ@*ao`MghRC|V>9gx@r#5|zO`+6f98aV z&gl8@;eMU~kuMYR&40mgkbNb3UR*=^{NWY~<^&8Mel&gm_kTZMoSnS;>E-c>%AomB zm3#OE7z)9V?T&UYc4xzFXRPNBKYnG#{G3mNr{Fyp{TmD)iXVr-_jE3R3;{U@z{N*( z01VGg-kiUDbMk6fd@ZLw5_-$Rp6z7e5smr29I&81fBtiMYJd4?q~*MI`9s@Hi5Sdd zX;H-7cr7`fT*d5b{ao;KP7i{SU6_5WA&e@Ee9F*?E^q$g&6&@QStORv%XBo%R5 zoyu$lOtN`#{O7~lOY*C?UmeXD3?G`eQRgS`-WPy7)CEG+j8S z4^IJR7ng)Y2*wvn#IjY-fU>fZ4n0g#4SIp&DY?+Wl7C_WOEuD*XQs}V76X)1AHRAj z6M#M+{`}B=0y-3YO_8_`dx0&tNpV zLQ8)u^CD3+3SiA>N4i;tqvFQidqMqlCUg4@tNHD3YQa~>+j?>?Pz6JHNm33t0W^&T z8RlWW4}U#NVlCh`jJ!?2CorQZ0i*AJ1w(cblACyFb52h2Y=-E?0>&wfE~XGil~lo&U&wdwz*nb9iQTo6wgla_o8rTV9|NJRs02k@YsR z&#h+{I=l&##Yk4@_X*&bZ-c$;r9#ROg<)uAzRg}MDh;*6+bm1}k$MKfQjK7ZY9 z*6m?&y2=Hwn)B%zb1L5Q9ZBO5Botj^l7BKInLqqkwE&+Fv)}yCeg-)122&1_D#bL^ z*{C}0pcdct3R!4!k_Pj}!DQJ}nU2&b<31*$sOzCct6&r(uvexZ)pGc-Y8i*%`E$^G z8vR+k9)M%W5ZFHiZwP<^$JZ#ofCLlAalWJOGTk6>BRGb*Mf6^eMt=qBC_9rV@_$g? zi&Q?e7JbAr0chyNEnegBw_+)*=fh%`l8B(uI#>g(m~a~{4MYdLOl{&Wh{<|hZjVwS zuje%{+k%+*^38W|pKsML z@$CXzId-NwtQfB-jf$_|@BQ+5$AACJ{x6@cgY8@6it+q?+|{j^a8NqZrFr`}%a0Gi zk%!_nEn_aOcs|EW5$b(AvQO%vXYyRS;NR-ebh>zi-He&Ql#>PI=vbL(-=RRLx=XMX zAz5#)+#@76@zInc`WiKV*12(b2QKBy z8-l<7wKYnri~f29TNz1yx@?W#I$?ttNZl*nd2Jlwi%pRKtphE{Z27q>MtqgcD< zSFsHLD&FWr@Eqt%y?-oD<>=_OA=6>Wq#}s;bNOqF{~5^4VfAIl@X)WB`PURvl*rd~ zCA(31C)I@^#`M5c=;d2pHA+GWM}c5V3lbt#{?NNac^B=wNZ09E95IeA5h>= z%VwGh5)nAR|G&TJd$>pwatveNph6h(cgcX$*>bXomQ4ka6=K8c8w&=MMUdTX5DK`H zfDk$Dm(V!?zJ$(w37xwip>v{LZRA{mjN6CWfz3vJ$?-Fzow$-O7;>44EWQOs6kMUD zQ2+K1|3{`{jDKh18*6D)Lm3h++8rE@K3lZ*0Gz=XbNp{{&Xd&2zLxcn|JdFA`RCoA zfByMrYvf{!Kkokg^B-$||M`D*fByM@tOinQ)WO=%g>t2wZo1#k`nR8l7QEtug#o(2 z@rAf?e8Nnf+X4*#_rar|*`tRa#Ug?6BPqhke`_#54}ZZFnsffyvk@>1osCdD;On2` zuZIu+uhgGDDu-hYRMDf6wQi*9pe9d9{+pw^jR1Y zJ0L=w0sWTSgxW~YRDS5&xze)s9`|Jfr2ek1nsMp zWnYfh;gO$Y+wxC=OTyKb=`IPQ~zB?3zEwq9*LnE9NOD zdTvgGVR&&Blbbv&v4vp`Ck3;bb*fE|p}2|UH#m|1wtxESxuf)ZV?atep|xrf;%wa; z<$u`<*IfqBHgK#FIh>aH0@yT>_biFZp9{;X?bU0pYPNctij*l5^IBx zXCalv9UO%rfLY2d(USq9l#dwk8$z!DWC~mp4#U77Gu)KDWlEG}BBZ;ATMYdQ_Q1of zEpIV(`QKw1-0}JIXn%Wq`_FcyNxplnO@HoU=Fvm(|Ap-qYa)aQg;l;T~AaMI+V~<=bdk2#j3Lv2Bp2~W=aN@i1jlzMT|t( z8yUI~UtnyXJrBNmq(S3Fw4s;-#~|bJ88^ouR2Ycb1|#?_M_r;4yf&py5eBV-7=N5; ze9;X3$0;~dwhvfv|Mc2Cd`{u|W=&~Je4g5FYV^n!3TlYmaR9qOBor}Dk~O`*ojkjQ z-6Owl$)*u4jMxb6&|3E zUsXc+#VvTZZb6{xQ(ai1rL^((?0*(#agfuomXvAU8XEDF$(_c)O8;(q~&nXG*h zP$X_q3?l}nlq{q!1%**}0A?&j z02-GU;3UsGK;i(&IR$v~(SLzdIYsxZjc6~?$Q>!Zvz4`PK1?=4bzC>4byEf=mR^=e zEevtzf%>LPA@@FIU>3>9>w<+=oB9PN| zyehlgkoyPUjQ7TS<9&63xUu3DcVg{T*l+_n7hi|_&Vkd3j9&3lGo1e2+gB&g)n(?a zHJ~Iy;1dwSGZ^jX-WNOG`mMl1+%YCMx_g)WCvxnrEc)-(Gpvm9>M(-*EE5XSM0~vl zuVR*;db2FCiK`4;`F~mk73+Y>8V<9;qzoR1O)-G8Wk!qk-PTHIp{Hq)&jPf1*_4C5 z%F`yhck=`Ti&5RfH&@`xBc$FQA^mor7kQw+g||F+{fMXV45ve1>wNq7UN>m-gr~CU zYA<-IfvGpudKxtwYW)*6yxl3a>ig+V23M;T()P7%yni+K@_(0?CrZZo^77=1iTUnd zp0s~SvT33EHZz@p-+f*>aG&!hv<2=<`h+j(6Mh?-%kMpX0_Z;l!hdY)gVnVrPuhfg zl=`3soO;cvd*XwdsqQ@Q!G@}4mg;|@fFj;+1?Z;wkI%k&Qmp^{^vTmN^}lZ8)AUGS zD<-_~%LmLjj(=xol2TL=UT+mK)!<9L$9}4X5o)Q0VqxuiUL8t_4ZNCedB{v7Tnq2= zxQ)nra?Z6YnAX!Ktplv}hfviI!P^A>nxcWBf5q*ExN$>h=+;zKH@Nvt(dp&0CnyfA z%QEBqqn?UUmifPq-kc|}uUnvj|37~AtW^K^+0!rl|9@6KHRcMKa>4=_;doYhGnQGV zEYZ44v0y=6cCBD@BAxS=l@I=bQ2cKaa~PeH@JNG&Xk&Fs`K06im8OJAB5T>x7;(hL znCu2*k&qb0{Ls9S>G@XbbSeG5Dp;}v1%f~%&74CzLtK|6mPLtMlWd5Rh%6T<=H)8a zVk|B6aDT|rG>y(sq1y23WVyicJNBrTfa8CqN;dQ27xqzDZEvOhj}JlgZD zp0iitbmcqbBsEqr9$g~}XXr1-d-y zYqTJAx#IpUWas<7g)WMByo(jUcsH^?tv~-%%75}vr1m?p^(4Ut`S0n|C(jD<-#5>m z?thX0ZsYT@$I8xI9bA{&U`uGUM#g%{eoST*hNyagSa&sEWXTc+x&84W28Yi<8gm@E zd4KPHPlrus5g}J;0*2T7LzC41HB5%!p+^|pvTpQ0Fd@1$UFbqm8Or(c z^7_N=?XeJHGk6T%(#>=D9PG)1uM4=iU&@`!5zq~t0iFXP7k#i=Z50HOkpaIE`faeq z$r+bL4j$s|{B`Vb82Rm82 zs%%|G#ZnTI;qe0%3MDsXqz{@|sCN65v-~Vv$$(;hlILym*h;C;f_B9HF7YaBnSWX-8G@ns z-}V@Dv|zb}C5IUc0c)&gDj4+4I=K!>3$o{63nq!+L)MpBx9uj;&VKi;R%aj>B8oW! zd=9w^&<8h|&%p!voLkAANS40ja|B4rlazy-If~_zZ<&U52QVW43SbN(#F(T&h6LT2 zr`e0aPmnS*jGh(T;3xu@)_*i4<<4lT&M==NOjRazRmJZHF2{p8=LtL9-JPRoF=q4K zkOXWum_y1hE)nAw355a20kS#b1B35Ku)tCF*EJiNM%kBx0YwXPt!kBKS4g&C0>=nJ z{ks@0|BVwcM^U1dXCO(;kmH%yU(rKSn1}kF+kbolj8J|QC39(1cz=-p;&!qo_<`Jj z1&o&#jVFi#L$e`~#Y$l;51TrDI{f!_&r-dIVGRdjDt|5?);3`YCgh=&S&`{Uk$xFn8faZ@Li(WQEA-9RadWg zO}kgN&Pi#Qq#8o3h&`lWwes?ri4!bws=GTL*nNv))#uM*a-k1-4Y8SJeU0G2Q9(iZ z5-hk{U`Aiyt`?l3_WqXrFyjV4jNh}OR1ecWV=^)vmVfOCAxSY)#)ZlNXF?u&w5t#+A&yq*p=9C)py{SEHI^ zzw;c*lYi7a!PbI=Ig%?NV=P5mEWLCVQo`H?*8(Wrac%&mc1h|r#NUL)>&wUfRNDWH zA*P2I;0F8O!Q;KBh4_zWPahwAvH#u1$9i2*j>XuDYvM6V2EEp{yitC~_F{L`c7=N+ zLEL&IN83P(HDWeePthEmv5D}ETYfOqDGuWvYkvyPv!a?Hh81HlHXeep$q0f3>*3a%8VI3Hhl;ed&{nYvq zPCE|kpT7Pbk%M0r9hS$G@IWW|bzgqUz1+ld zKD#alv)sFGNf^J)jlPwm75hvjP4lwz%t2U3Z)B?6lTUP)Tc9VZQoc)CwG{ zskM=~%F&%`Q*2F8YFqf*U0@wxZ!=)M=IPUkC_F6%g7qcRS;KdF51xhC)>%{*kbehr zWvf`(sPe_x(DSF-{%^%eujvD*wg2z$9Xxqf%>VSwlP8bA*#B?i)1&?WP8|SUGCA0! zT}tIpPUG-<%rf%Zv{3&h@{G{BbQ^{8#iiFN)*ZRpUHUASRN4@LKA~?sWNivob|CGK z{wxz|5<-s7IE5U|w4uxWPT|VQKY!sOYU*BZQ>p+VA>nHn!x>tjm}^V2wn3GC@NS%M zfNE2;xli?`S`0*dRzBN*$~U*|`SzS~3nllUuYK6dBUc@tKNaV6v{$c()HNdPo+DoG?&a%*kP(X zO={CZ`cIxWdtraaugw*;hou*Nwl9yIrt`$2wCyXCO z7&2sGZ+*F*3&uA~g`WPW8h_(pHB}Z143sKfFt>q1hb(aUwM=<5Fx0~h!6$Rqw*y#9 zDMvvd}m=IkTvee8<&sL2##Y93GLB`%#xzYhB{p1%7N&`58L6vuxcSDwvA&Ky3LzE{q+qdrpN^old`7e|80 z+6xKQvuE5HE&HvX z-7ZX3b{}(ZEMkFVIouar7KM~SDNV& z=Hd)%9Uw39`+v#4uZ@Frwx;A!m_-cO$Ck-)dIr@Qd##<4uoSkbz<*kC9`%=yq+75Z z6kiwTRQKPvFVEi`y?%M|;^f;Ozb`OBxdi$yq%ovRFyvG$%22+NAF7FvZkxq$G=IlK)VC+yFt&(sVcvA7vucZ*~Q75qi4Mc8{&n|$y_(4t9@t8F;(@jxwt5g2s z==|v7#mn|Le^t%oifyurW6A*4*Q!i$C7051?pdHd1a4#nYE8U%>3^EpLqPJg1X#el^w#UZBJhAeg|4(YQ%SK6OP zz+-my8l6W#2WagkIG$Y?m@Xm`z-Y|o>n(2c34CRbRY#{ioV2B$|q1$G) zV_2A{mvdMcbKQej7_NttSQxRFqgWX8ew@V&sM^EWVS$@Z<2z@tT7vEIJQikM_kTdP zKc%XOAuHmkzpjl*&pUU7@R~&F0=*__TqQ<2M)v}dEJVLk$mfSG4EEm96@}Fd>uK<@ z;!&cl`!;B>*~`)pa@Z0nWthz#q#+)xpj&jZU%RH@E?{QXpy4iM#diUY_|+e4|q z79EQ{1TTFXN6SN*+1fZ>3!!AJ~eo{ffNxES55*bE1>)q^xj)Ak*$k-^z2C}7pY&`v4N)56?Z za7ERWn~tuins@#13VYVd4FK)ewuS$vVYYcp?~Dj=RRz_7P{% zVc`A(Es8lw&8IrzqJ4fs(7zez_QNi`Q*SKp!nYmu`unX#VAM_7qxaXc!fi4Jqhgx1 zoWB)guIl`)7;X*cZ^ejfIe#n0ydTbA%XYBl%CJL#sJzJGnO?@fnvR87>+ zvF<6TqiVc94tAem9aV$=2OjO)is-1HcGDpp)`qVT)8Xm;9}v{B;mC|HAsBZQf{|}a zRV>EuBLu=#IyV*rQ8Ue2CW`_##l(7^a0%VS8n`-I!VK3vSidgI|96GvIR+mxLc7RY|L)>r8w8a4UcuRE)P> z7-ot~+#|&7LXC{*$GnjB6g7?Lo2gx0&dN2b^B%i^{CHO7Zwt{BrV;l|vt?_5UVlks`-}Ux#dX`-Q+o8` zMa3>jNZH};uIIXuzn#l6DnAg$!ROD1E4`KT!fpFHYhge6$LZU5=O^!!Lr^+cH{^k= zp07{OYAf%%3&hci0Mxlco2kp;&+9pzY7+=oxtvz;IMw(k%90u=J0|{n|6spal3Gcj zEqCrspS=~;u78Un_xn(09QxdtE>k_r+Nw;wc9XpT#vuv{N4t-AMA^8_Ss*>&iZ33< z2!%|o$tj`>EK8d*Aw$~v&##LON}14oI(}uF>V(^sH(#ShRrZ9NF>s9eah92~66H+u zU9x~jH!LFwCZFZ_+94o)@AOfa%GmRGx7q>8@^=-u)K$(LUZRZ&Y1fIbP!47^!A$ z7`Gm6Is|*)JbhXMu;jk%0GaCBGhkiS z;6@c#*Pn8x&&`3|t%aDQMTz3pF&+YtNNTLWz(bIgF3hIQD}Po*Gu6C2sCGM#HD^wI zC6C*njPd}+Ksmpz-L(4hu?@{_QzSGw;j4U}_OJ^SVz=rT0BDi$k5r0;L-#5+`*jZ+({%hnpgRfa3ug1RC ze+|4%0PYKN=nr!L=skadUSaTUW$bNn=@#xH9_e=t71ypKF&sR7=10VHVbqxoE77XI zEPgjk!tJS~*y9M|g(=Lb1)Wi;&@QN6t`;?TD{CyfrQG_c#A~f5^w-ZU)wr%mOjR{h z74)SOW*5i=0Ln02LC*zCuZp**ojvdBF4stsl#gOO$355Q93_A6*A%g$O2s&#Mt`q0 zDd2y53TU<399Ak-XBF`7=VJ0s*Q%yq6|*crq?c(NM3CiG1+8goVFJThL@r^JH&TCl zS$G@qwZP@753yfHz8B}%i`a?>xpAz`o@D>@_u(jeA!~V-{e3rgnCs_T>ohkYB@V}# zTxPpx{%ucT{uO^y-VvYjfz_E&x$=hk!~f6!`W<~#P=m1uv0Yt58LAq}vcUP;bL{Qy z?LB+)ME-YgZ?E{@{b%1i{;&NfPoF;dX8-A9(Qg0Q!8cF-3+(lRVZ$e79Mb>VTYIh| za=(#JiKo~lw8sHOP%&1R;Ge|dBJm-(-XC1yI6MSrPV0XGOgWLZH~0HnG;6C4!pZ$;#s2v0K>n9f}ZSXk4h`+Cq|G9L6D}p({o_sStNmUnO`rO;){CoB^x! z=O>js&5a6CgW2Wut9GX-$Ji2#jd$(f{o!wq+HDa$H)uVkYa2c)hwr|78@h%n`2T{$ zm=k&{{QrOP({G*>`Tyg``(OC~ZG7~Ju!G!+Z;^`MYZ7^_NyJj%>`OvZ5RPZ#fKWu_ z@!c(69eR)^7GM9ippm~fV3759HHqFYgo^257-GQ{V6@U*QEM%3nyNxzZ^=LJ;SJYt z1C_Mz+q;Y`XpLr$;xHjNiwzj*ger5+laU)l-j08gaLf_ChE^sU^Nsh7Ut@1?OhGdk zETAw!=j!FUWsk7GZUa!oI4eRmCo!QetpZ?u*#;u-7%RdvhR+YEKar_YR)Mz)gnJ<05i5ouH>=d*I>S8Es%EnsWy zhvt7g-!nTxQU2o*8z~=HKeFF{wUGZFKPl?}Pai+o`y&6{#z%93tzyuPRQ%74yVFER z$)^&zixeC_w?nN0%3H@-$&t_p%s7r`$B1(I)?zCn3y5R;k+J)O zX>Je~EgP4{T4TvA-*oOcM=*>KV`uIFZa|!D(QT_>Bo|xmQiK@?TV}{d<3BL*KXx6A z|GQm3@l87|DKnDg<99=n%Nl29MalY;*v}fzE%q zHAB3}YlrIh;kLy$w;l#?ED7!txP0~m#X+VI>(E#pvHDSUgW|B1`^UA0HL;8DitX18_da46rnjuipWiqbLHih+HZ?3dge@sljr5 zjb!w+^*xNk!2=MZndEiihDB5S0fpcO^Evoxdko&j(GrkY_7ot21W^#-7>$1i;}>Ta zXPi(pcmR$i+XO!ypMellHW<$^-7oW5?&1+jrk%OJo^6z55P~5Vv;iO^2G@oj1x-!g#tbp;}F4J)sB*X z{T4ZmI{)uZj$XVz885<(%u#=P{vYo>-Fv!MIRE?4o_^8)ZsqfruSTO0fJrjaIY9(H z{E?#BpTTJK*TLWc_*SJqFl+!!301AO-fa&C=3f9a0AoNB6ay9Jvjbpw4dVcX;0i5A zD!CF9XLt-=a?zelIf?;AQ$#5W1^!3gCjlz)#0gZFQ*h2)NI0GV32{<1aaJUQG|IUdHC zY!3!6Fbg7x7l`UrkthO+W?0Df0$>V5w1D&~8w|YS;TRmnOF;2#&KclyL=lbwqzF(X zQIUuiTBi(w%VoCIn8|-tmMeo|j$s6nlqQ5B28dvi0ty1ApjA|&;rGL2M`M2bc!Ra`0pj+HweWRBu)fY;WK#f0Gz-2^NV+b!DKR#@5LVi zAv6Gr5&~ct0-Yv9TCdsR?rt!Ll(Vt^T6%xE4E>;fO%`}+f!C-%E@2NFu z?e?k}b~#08cOlDSxEWlw!3~ZgJv)FvwHfJHS2O*N+68~Prz8=Cx7MT&+}xZa^{6eS z@+^)LNZ|sBz1bFPCq1fST@+neOK@fa-3ABl+LSkDEpSJA6^d)+nURx(L}a#9>&51f z3ZZcf{`5Cgo5SQ;-7USMtU|K$KYEerCEz=FZT3^qgcDqWD%F zl8gzN3sRZ^C;5#zIV|1C?XFdEJk9HTb-tN>mWV>cS_gC4X%vke#^GdRAclQ^n(?z= zwjO`j%#9&=hbtjX4wL^1_#AR`51LU?2*Q-Ab(C1CX$FJ8f=7?eaq{TVA$Wxu2LfS@ zEz^8+B3DC9rKE@-V_dcHsrhL)L=obOG1;qZU9{x|*M0KlP81Lt-4{}vQ`tDQlunnm&`*ZL2`CSLnnsZ_ zowG@4_-tThKUZdRskaCrpTeaz{QF-D!|Rat;|MY~0S@$M)=yG8IyIr}9H=LgTMmE! z^g*wb7xOlMVh?YfZ1X$VBG-sg93loLGJ`?ZbK4qT3yaEB(vqZBrl`h`Avx=t8sb}- z_F5CC{f*cOA);$X%*2KJtzK;V=wGXrYp#geDR)ICf-cRJ6Q{XO0>z2gO`%%~vB3c6 zbp);jh#8~^j17or(+?0efY^>9cSV1+vxqA_R{STEc~J<+<-btCYo)MiKt6u10>pCr zOiXjz71Sp*6@Vxf)*cYe^49oNt%&U|o!HGi@<*ur>)mL=1BlTxr9XC}0Ff`$U&ysC z9N#0!+l2-rnq=F+iBXP9l3Hs(C_R(%JRHs}VlU6b;S6ly z#UkbM#Bn%d+Kwwu0g6LaB7O2~d@%lI6rxKE9i0Q#xYm zzH}AM*2+yb-DV`x;_<9ih1NWyUB^{>25B(I97*egXJ1`Hu^W%UQ52CI6spYc><~;; zXir39Gy#NyiME;YqO_~Vb$?dCSj8Uvz-Vg9loZhe#as`w`Zi5CO_6(QBrwJz>m&Il zU`U)LB@h=7SsNHzbt`{$@~Lp^e~QAgwM{w(N3oQGICMVOrYJHMny+bVL_{eJ*+-b7 zP&u+1teNeAu~O9uPG|lES7<2&flI-oImPH2g8dDNWvE&+3ED6pFjKeN1MdH}zi-m1E_OX9XwL&lqQ3!C%iL!;6 zqovLUipIVa5lB5)D>LT}QpyOKGl+17vGpTj)cAC>BQv zMmsXI2&RaE{Lz1#O9I<^p2>a%C@#oVr_2WVxQ<>m=!$ID`IHSDUXZo=r}Z@E?O+t! z62sP=SgUvnJLZkK`3P}({Q&^ zhNfwxBH0wP)htEIsg16v8cDdY%9$d%D#)^aR}b*E2RVPC=;Q+mju#a~p@urLk4;Vu zG>t(*F`?2T#3AJcAGM~DmYukK1|2`gRTnyST@88!losuiyRy(N>gLH0i&-GcbDkzn@$)jsT3xam_YH52 z<)98^PZ@RP9($>N0HOFrXa};&w%B|Ji#0!=z~o@BnJ^rXog(eFo$6HnurXM3ke{{? ziyV;MTIIQZ3(OPl&BDA2$i3$8)AZb{TQ+Fn0p^owLOrbya~} zpoG3*ZV7UhX?h&t1?FD!i}FY0mB3U>NzQ))Ot1UEM3ih4WRnrwN6QLi`8x_N;QNKT zCCJs~Yi)J)M5hNVgO-qxeGSYIz*JjY>C^JUt}eT2gM5a#AKb558C+Aga}|*H_x8Me z&TB2IS?ju0&Iw@swQjk}%{4?Pm8)C}ZeD}5?^V9S4PFO1)Q=1Sg!vp%@WOg7NWp&@ zha64QNZ_=kIb1uFy&q(2ymD-yF$x586s8fPZ{WhaCCa`WaYSRt5y;wC*fzy+Tm$4b zmd`W^AxCGNLXKw3F<&OW+pi27)62mS2Tb<{qW7xsDv;k1`4;3y302Xbo%u>Ikt7^J z#wu3Y2eM*rrQT}*+Wx9%7GySu6rEBcB={_^Q^_WGCRzaq^vl0Qwa@cIWiN(d z6q%R4ZnSM1BwJeX#VSu#1g?yH^hFJP0;eRDZ`(yPkjQpp@KPrG2mzkvzFL3XW&$t+ zvQat2jZC=;ZkxkGAXdxcCkcb&TCg?9F~_5g!u`qoP!DoULgd0*=FOkL8xo@8GD|Mp zE6god*#q(wS{AKE5@g9ROl+9UN7D*mF9?3PRt8xu#iRmc_3K8UZX4W?jb1mDL8^|! zLB{Yb?ht+N1Gx>86RT|U!&ZO0-Sbth<;!bA-4bL@B1G%%5vBX(tu_mC8^SP;sLv9i z@gI{|h-EnDE-kBHf%S7WW~qc4V6soh$CHTy#~#Mgj>F#t}cN(KUu})y<$;!kkw#q zx2F@x42LMF358Na9fhF{mF{HAmpWd#{gQg;X$7*l)Uq&~Y7yTBS#;_f-VTaXxw4{1 z!#3|4tZHdB9yAq>SbBet4rC418r`L>O|Dc-)@S)VrQ}+^?bCH>C5=u@`Phj$a^tq^ zSqXA05x-D@@D*O*vWR~s#N#=ZB%t;}YE}P6%GTTy1}lJ^Kt8WFiOaN&f@Bpy*<(>z zp$mloazC-Ow={nOlid(<*rfZ}tDIh*`k+=Iv-C2=REm6A@+p4}y%3(|i;VSPUWG79 z$sWv5<)ftA0$J;@Y57`yRsh+m^I6dS${?$@@~K~65UVKhcL;`mr3i&5=E_yBFdMlc*UFy;3-%*H*{44puM2W31DB_CY1!{*fgELN z6r{S^8@#K5oL7G(EgA*1t5SfaQcbGbr9FRE06BX?B`#J+k@}H|yCaKU7NFnEaWDsq zlyR9aN!DwS2>??m@M!`0lB98KslO%1(3$!D=KE|Yj}>3_Ti0-31X<_&dU;yBfIT25 z)e+aVAj=T!{y=UOa;-rYGFVlhxVB?R=+=7D&a~&7KhEJ|u)8uoV-!kcTbL+9~sfX{}|V40wHu z_y%NIu4{!=HvNjLyp=tevojR!j}H!nnmv;YhU&+oseBQ(-F20Nilf>DvPtXr^0e(* z)~<3FT8@7R48MgDjDs@Vbs)bYFa)OKnt-nXvbq7^!FY!Bi-)!#o6wS#LGD7!RU#2+ zDHc^D)d}QQPBaZNLyTb(ANefgLidxux~6gKTsV7eL6L=YOG?SYx z;Z;e8^PXTPx&jsBn&G0dfp+k|egc!nm65fj$L2ce1?%m(`K`S-2R*(xzqKdlEgqfg z9U1HY9@jlSuXuHyZEF77eEqeaJg$pzHBk5P@H~Tl^H0wW)Ejtvz6KUeug~+fzCX{; zo9};61ND7+f!-eK%|1fUh^1$!H~S8Kqfl@3DSDT~xeC;qeU07*`nH_!mL8wlVp!z!Sj6INbqsl7W8%MeGQ#~P?rj;KDM zUS+KlLVZx5I!2wcjl@P~O{iQ1_L%pdS&c$s_88`i^rK02M;t zg0AmV`hpdqzT*rApz*Pu7wS7sVj!VDIOw|8cbvxnG`=!4Q1_O~pcf|6mWSM@YzCn5 zb+RAoyG>}&{xsgFoCd2xeYa^1R)zX*GaIz$A^jyc=!1#0mvp@#jUF3fj$bDcPlM57h$L*#Uuz1Mptj=`Ble$m9(@KQ~ zi|+snpe(~l68)wTkSX}XA6_55d~ItYV)Sa^;xb%C= zc@eC&UNbR5FUK&4y6xS#UT%awfo=`;9i&I7!LzLotfveKSunv`DH6KyklufiB&-j5 zQP%v=znM0v9 z)VG>N!6yEd@+f$qzNJJ8Wd(n~eJX`aQr%cCg~o;T&eRU-4W(091>`OoSU(vR3U0ei z>edsSPkmC&bP1{)OVe7p*;`joOOR8_i)@n-i0F6 ztrIVlpuWx23q`0`%)QX{8Ba6RohYPr`i0V3-(~`aBGj$Z8I+*D&4dP?wZ8Mb5gqi# zu6YZE0PQ_4y`Zkj>)InXFjiCYR&E{h$LfvCRh7w+#pl;{6yGJ=0Kx0;h z2B_~OEkg&Z`=&E9bn<`w*5+og{W2*hI_99+iev1kR;PUJ`}nl=?b=W;aQsfMOo6Un z;}|c}MSjrCdP>iLg~R$#w~AABpoSl+poSlA4eAQ8E1~9)&JaI7{juzkMl?V%hco$l z_xSWjajyp?7FRb_Z|8e~z3nYihWa&H5V|bcLoBFOi%kGt3w3`fQ_2~NIgU}(U#65> zOqJ3On%>f>++seJHlN0vD@^ZgC9`$cNhsSs%5cq!;zC&47Tx%1V$K;`)=;a}xC*F+ z=rXM)$xJj=*vQ7xEwD)pDnG3`q{>lIEMiw2?6t|*$7O#M+7WmNe8Wb=)J-t_qdCKYe=3#bVpQm%l0Z0KhrN80f>1sp3+AdDh%W31pa z#4pT<7ivK-a6Bbj+p;|aB;~!`*#)7S22E>4UZIJgP?zO$W zJ>R~$sF^jXp~nJh38GU%7YaA&PLp9>W^FhA5lVmOpW2`%l$|I-(b+N%s=|5foP?RS zEFT$aLzN&;r9q)kkf<3{&``=0na1eGqzqEgUU0?bXtDxisP&MzFgq#hCoXLBX;Qi^ z)b3NBz?P`BlSb}WGQnO^+ib?cj8^Xgwaq8^>-#9KgxY4a0QQAqYc_IAsRDc4x-O{Q zqkMmYEm3PHXx*=*gDp{8Y1i&JGhs{AY9l&qX~a%nm|KUO!CIv+yd|kbC^Z$hxv2G( zQhwRUIiex<`~iP}nM?T&M1wnS~E zUAyDNnk`Xl>CU)U**9CFRvXbKuc-C(FrB&gb;HB-t&67pJv}^?tqbZS!euV!dBaf!lnVo(ubT?ato|xA~}?n6G`WifeZ5&L0)GM6Ej; zx%-#LZ9XfZcK6Sd+k93+?e6n?wE48=ko_jHwjUX+lEk_tYVCHd_e|Ft$F9AgwQ7oH z4+?!H#co8codIE`JkIUVS|N{fOVodAb3I!Ytrb&^u@ZWHrDx+53xgu(}vN@HX&ZxCcg;HW8eWpTbiCS&q5g&hQ_aO5~ zOVqkC|JLbAO1su)dXhGu&IH*yhe-*wK699C9JSg+Ck?2rm*}J=YTXF3$80DieO~AfSntCB0YU*@y zAds9*SDg^YCm?aGo*3Q^CfaP}+Y=%7y^LoRF~3pZC=9g~0IODjruxl~U;^&`Y#tMR z4Od}uQiX_v3A$@U>M_v^{pRd70i6ex=taofBqAU7?NVc&LBblRCY+eLzKFr#6R) zbDxBltyx#aIXNZa3(ROLwU%$waE5N@uoUl;@N&Gs@sYWKYVncTCPAF#qmZhi43v{; z(HYkjE%N(J`TN8^p=%uUtDxni-%!;krGT7!$sKrXx-~37nRjVS$oD8l zR2slkaeZ>O~bLLFPz4%j*t<6AHo_n7?m7OcXJ z34Ir8(OZA!^OetJWK}j*b1IyYr{N(X?&(4thWKyxZ9rEKA zVC*SBZd20RGPo^s-ul2@Kj&?ex7>icVp2SF;`4tDa=PT_iW&0Sf-4F8T&B$b!I#2G zjdcWWpiGr-LMUMjU?e?79A7)EYfc#Ne&2rrlZXT`@}!Y+`R)f!;Zc2ZJ`?r>=`39! zPt9m^jCbS@=mT6N5jyM$Zmp-<0e7Pb>9TvI0o<0fyJGZu21PH?>rEl)jo{Wrq_+dL zOGJNqQ<%9!47U}EZTN{1Jsfab5yS0=S9@V@&&c|GFH@$HiVZ7I(T+3p{sv|>h}(jj zkg(*kEsv%6u6BJ^Fx|DnYC3>>RBKdMe78D2truupgWEaWKLfAVaQ~(l{vx>E#E7lH z?WLOKCouW%{exz{+c^rl1a2=;&`qJu9&mr}GP1cX-|ZaITUy;-LVBCxbnC#a4byD^ zcg4`HuB+Q)=xqt1cHnklWUomqwC}3?NyjRb}lw@r9Y)3XE5NZuQgN#=2gJOf(r`9 z(GK1f!JU(s(4s_X;schz`Z+Izmnnb1Ic1$0meNUlMLF@J<7^I`?h6x&?5%^W6gE8|J$O za9a~YR?5?bcGb^{#Nds`%kzEY#MW~NWG!b2Q$({9?QRqcP$>ip25 zjpM1OPxTCndX#bI6ww8iuYTJ4xJ*ShWvw<_srcYriq!H9kee9M-5DimVge{mf6_5| ziiL9mCYjmoaLT?HZ6`H6r2_1BzOHYTV+WkgQM8Fll+~`T2C(aWUVgCqt1@Z1y!3xZ zOiVSY2fNAla4TsCrhsVx9Vi>qdj!=8ka&z2obq0CwFS(*o>UyKWq?>+hIGuy23yx^cj+zhfG~ zzQyaN1a|cu(+=$0xo$MrZQ?GRK}#VRf~SnsXnoWuYzMZKfPWy2pDo)xntGi*W094m zCc8{@oRUaKBTjb3_aoM7IPVN?7+{+l-5KZ=@k#^~^k!qcE1% z-5Wx$#sIt_905MZ%)HuX0LtG4`@%8fFp9FQ1QUCZiLBCxK+44UwFQ_9`&Ps)HJ<5IgaqZQK(pL0V?SWkc-vd`-B?9S`%&=@P9)~+mL@P_(uLCxI)X@N6X-5 z&oqWnGKb@<>=E`Dlii6IHe)^0Tz42)j^!C-DV6x1~?9ps}CLtO0BbLk;}zmxs*mq`{$DDT%f ziWcVVOvd25JcNI6XE2ydCYO-S2M>YW3@nx-jRN?20DzhdrhGn5AY(U#hR>C-Wd4-R z0C2*O#o&X1q^wJFjWWrE2^p)Dn3P^43bNq@;O-2Q@nG;*@aFCL$su?f2bxU;b4a;< zv>%Zr3U>hJrk;C37{gL{Cfc?qr-g|u#w`f_Yi2UE2NZvWDCQVOYzMG3m;=bfT}Guv zACMe2wxjpq2NW&F;M^XYIiuTyYG0uOQ|!$S2vLN%ICjfC&p*#%N_ScuP4&d%C0s;4 zYWpjA^ynNXj~*R@f09%JW7fuq&F`%te%Z4A*cJjzp|ZJHZRg$z5r;TpO4fP*jwqad zIs-2qRqdCpIp+yG+}#aHz{VOY&1IHGF6kr-oSwcH*I zUP`)VoRWAJEp0u}6pSxui(=!&K7^@y`f5e#j=}j{vO1QEJ9bG@n>0a4kUBw{vUPS~ z9LP`|tauy~{7z`8n1M72r6WsnLokfHg_k(OTu`xmL^xLa z_@e|ShuUIHdfLI@JTuu84q678JgYdi7}HK3e{PLlz(gsa7HhZ62RZA9akxvUGmd50 zDD}2&CfOik@D5Ft)+L(0S1TWqKwcJkDgS?k@~ck?U1(t|*38X1=i+3{$&H~sK1U0+ z{Yt%5`CPnhx)M&LCJ<~T-*b0?5;c!d=25JVNB(rlV}U?%u@dKcGk+;==&|ZVBx}Da>d=@DOmCBKggnFn*ZpF6xoh zo(gP=VKgua|N0wIUTTLokj6Nk9cBw3q*SngXsIj{>I%^LS6Lo&6^`e#1)`#fAxS|AD=9Xyi6W(iDc|Niq-j0v9dZ%^NyUEm!Ot+ zi`f+=e`uKw*@Ro7bIh_67>8;Ex=`3(qD)cDj&F7f_0sGp;lsJ%1=Vw*30w*$wIJ6h z)IcNC&D>h%&JpJvg__l5Oyz&Yo3l!Wl4aA1&^4lPX1KL&DM={#7Yg_oydd(GK2g(Z zh1qV&2}sh*2s4G{cmMCj8+BNOwt)3P-%(eQjE-4A$*d-SNk}*n0_|VNf6gYJ!eR5oR{=JWKjAVG{6p0QmU02QQbz3y?BkVso2(}&t5 zq~;_c5t(761pWu$g;F98fnw{UcWS-ZVDNWwQhaKTVn-85gE@cZND4I1^)iboCsJdT zG^2Go=)5tK^MErBIhv-?8B!Xc(?*ZR>{erK3f8}vh%<^{ILf}wWN9X)!}A+rf~@l% zDpEf@91KSGoC<%_{1BWHtP{WFBkt(4DJQ+5m?J=B6rL0ljG~CB;7}-Z$2SXGHG{!n zClfcMP6R`H3P^vE;=4+T)*9e=FnB5WzLpyF3I`Ojxez;eY29uh<{*tZj_eLH=dL^n zEP*$%;2kq@L1=B=y2g%4%!OiyD0mHHI74)-$>~feeJ~<1>PSE=>*%AO{8uN3wM`vI zM!GXm^|!y@Y6%JlNg-?a+#1J99uuqhin@iK%ZHkskKBKjBrhe>${#gVZMQv)FO6CV z8B!!BA8JV$v=*x*R!*VipOH9v(va)h!)_SKq_zv|VkFb*0?#{ILX`ayN*070eOzOR zts?>hDXI(nrw~U>;$v8;q5&a?XNzQL3bQJ5%IN4s{?3%tC}hUs^AAZ(YGmtR$D!(R zkabaZyi9+|D6H3D@SUzzTO4c0SOD!zd+I{XU{aQOw#phS}(!hle~@B&AWZYv3FaCY+M{N1M`$Bu~G~xP}O&c zi-RFAedg7wpipUkIF@R!C14jga$!9j&g?6lrsU*EXx|PA3rZgk1`~b1$vlG-Fq7J} z4Ec;@B06m?4iUpM!N#ZBpsM@>eh#ALgx6`ru~0G96bx)3yU?m;Uj+b!yjg%j8;XQf zBJO`IqgM%qH+GWQ1|&9yVupB{j0c0GT+t;{33#AoUb&W58gD3QCyhg>dW)~Do5G+# zsQzazCnU%zA0Tf&#p;(NRnRI^;^ANf-VkL#%GTFxqkcP}4fVc3C6CZ^N}3ZVPTQ2_ zv1M97)OVL2S&<;7fZW8TAqQ_`B(p(?1qgrU7+q(wGG^kkHtF`wE}186MhADEUp{|D z0vJsscO;8TlbT=KJB~$8yX8e5U^m5!c-uVEtqx3cos+;6v1-} z#$UNM+E!a6HhI*6knX{a&_={xg2qCk-uP_tc>E|C7R=o`Qyd{_N=>E3)%m{2_yvEU zG18_DL;pH=ot5NDxgYd6T5*rfy`D=8hN(iX#~2R=jy1H4G4y@vL#%+n8kSDmUqj;E zl%bKCX(VRK?3^n8Q6Q!t`YOQAU!4sG=daGPRA2h+={+)*0fq8qmI)!VA@hihC$K3aZ4ET z)`FlquT0J_|E1(P08Qa~7EpYd&-30~_0~Hm{kG7tXL!vcIiB`EFC%iftL}hZhaz_M zTz2b`6^XH2MB8KVa+uq{J9W>+{7r)_kNsNyG>#Cp}lI$hyJ!fF33LnEZKzicGdQ3BGx?ahg05ZAR? ztenA_Rar>9BtioLmTES-LQ8oK+TRJbXnhH-FQhIbc*hTfaT9QVrUUK;W3)8?WmYam zoXPA(m_B`1s;|C1WITWCLbYVn>dQ{Rc{rR zBg4bA8ex~XH^P6H9RB&~PsbN;j$WVm;&vW90N=vkDou2Jlh`V>4yj+lKsqIy5ewF# zTy&|6*Xc;SPAcQGu5Oc@hSN%%Db#tz{4g{A3O#$1{5G13-i z65*KQg;q$#z_gtSPc!lhQnMBOMH$QYi*Bk5Nr zA=-UlW*dJAp#;VpkIXk>iH=wy6X%Xx2NR~JFV=)2hPW%xDj_K$VTR9+`pcd|QJ^$W zWmsF)AQXpxZ`h9zohl^dtcln$w#z9(Mnrad8+UV)p;YUl+R{Z6hlJqh{Y)*fOpufSOjxKcAR)}DvZhVCcK$H^7 zgl-RYNQn;H`^oFNbjWqjk~jgS&G9tp+ULXBNO*%cOQw%Wh5sUVa8I#H0S&= znNb)@oQ}W({)lE`VB;B>A}F{HlVW3*to>4Kpp1CQqFTh&BCVNBMpElzZ6Yl79_0am;@HVx zG8Ae^4hN%>wNvHBQ;>&3iuE-xRn*6x0Ze~6^4dX)<=Evw+RR)7imyfO5Po2)S~){` ztK+-lR20y!8^nB32CAtVzrEI(&!cjoofh6Dsu{!E#E)0aDE>AT7_mf%!p9^Q_bZl3 zTRm9mFpT9{skO8D^<$Z4HG^em`>8qG$W7;D*(_70V-U~8?HRm$!N3h4wrvu z4zDqx(iua*dl=oorF>S9_iA(hBxw}wesl26pSCUj^JM%d1Eb?u)&8-}%wR#4u^_`c zFHrzZ^kkYaP7z#~Ks4DguZ3s=N@h}*_2uWof)@o*8ro(tQ#Lz5F{GHNR~0FY97N<| zkHDGcm$uUN@L##k=i7=rv7)$$?GM-2&0;YU!hjZ(3CdP}J$=Ug6rE-?piaC)Jb{BtnO~OD* zdw|~%b7_Ey6?CGaE9`iS3>sF*;_zrv2Za`Z3aKCT_~OT^>=5>Zn&B7&(<8@sA)Q?n zv*+p4^bn6Gl8gk4dV_B4VRSM#Ev9R;+m1i=`Ho2mEiZHX#Vy+bhzDau*DwrGD5g4= z5`oUbrGJ8nmcf)cO^L3y6sCW6gPPK zVx+#<7O>b4Y!-;a5OOG4fgdCtU8-F%>HxiehhVrsK$qMi%JeQ^uVZ!s2)0XQ*U`*$ z9Zd<9vY}vof?13^r-94mr(m}*|a{% z2c(CNBb%j{jANc^`jMB;T;)QzaL2gF1%5lOIop-0)mPMVk)wZL4V1a7%~K`+{^eKm zWeg2`fO8t zu0$z~PPv=ouVvf}jF&}yPIkmxN`hi;8TdH*&B zZ^$*0l}Yy>?|_57gS{PPIJrK^;v2+OIyG6(r#QxJjzaG;hy~YcAZ}`&vJsh%_#BP2 zgucDwk#&Df;1@+Kjd=bbU3#^`>@>&+jEW~^&n1)?qKpnuznjK!Kxjhp8!vl)XzUeA zj1k96q54>zN}@wQj0YrRLb8?7F)(K+nhLc7(#(Nqmh9y1tMOp)=+WQpA~mT z{epjvfR&w>DB2%=!v5YT?^ZaEyrrcFV7rCe;h%Qo+)e~U086I`CZ$WF5W@*t^MO>- zzlr?u-H7>d1%r9_0(ReX@!A5HnfyR3b)J*6i8oIkG~C2zJk9%0ym%GhXou57usGs; zsxTFd1&7cgc;8Y579s}AKjWA?W15Rv{eFLqOkl+UphqFh(|!3_NOOU}Il}SWs`A%b zKnIAy3cmXN8|^Lfc<0kn1(HFd&L^kOd1?YN=7*+#+Z7TP&$lf6@Z^8|k-w`2fTLjo zv6=UW1z7bre&#Vh7Tiss5t+c_=k&+i=DrN{f%5H%&u<>%oMiqE?(jW* z0p%VGp088OBlj@_@0X$nTHa0ePk%La5f`b=$oxgv>aAv=w zaDOAu%xfOLT_DVDY$g%tnMGWba!p(CP0Ix}0|-&XIY|x&z%1)ekonJ_Dr)b@F)gR2OJ{^ zf`AuzR=+d6=8`pdH!*?Nf@Ogth*&CfzA6tttjT*1wu=^gLG}$(kS!x%qyp*|%R3O6 z(|m%A^Z*P&^S(b-=I`7Ff%8Ad$(uh_1`{ZRxm;#J3QydksbG1>y?XzI)CI?X!1Jfs z|ClbapbiFgu2#Swg2~JG*A##;0exsux|< z7kFZ$3nxhtYh~8q7Q94(9E`-yl>VVEmT`=*$IR zw&6bxkiNNGW49T7e&Rj??6UHm&VHBYd|&IhFC<6v`t3$dVD%YxT! zz<=GS-{+(Px>;}(ljtf4Oz@M$1%UxRDeiZ8cR{;g-qv8y!g<(`M{8W12e61pDA;g3 zk7qt*ao(2lDdfBbBrN2S^J$MfunOkIwEv*k>VQLNF}ySme#NPU)usg7P(WVgRluAp zm9!v*9(V`50N`An#DdCyFno>udyotYjbAR)NY6kI8oWS!{+R2WCip`_#dX0xg5*qK zSMpht%=v}J5f{2Hb69i!@r$3qC*RKHKr8|lbBAj@_QF3bFQ1&R1E$ghC+gtex#Wc3 z(qals()1st<&Q5~3nWIMnfVo-SXlD>>n1M#xGoQ(#DIgNp?a}@da=QCrA&TDO(Fml z{u>71!=nfbzbe8z*yn|HHF$}^0_4vm3K$UtEHea0!!rKaqyLvcU?B&aC)pI7KAC|f zVX4@l-{k8c{$2CW&OU_Bk-#LzMbM%c`t)eLE{_RJA~Ll2xd~K%a5y%KiVp!}!6XKe8M1(P zvY-$IZ4zmUBIe>w*^)kORy=YhjX_ z4wyg#V+Bk%S_~D;pfJO<%mu{>1%>c*b?H$IGBNmf`7!>n^}NC3lg)kyt^Td_@YkIe zff5`U>HKYfy?L@UpQ`~Z`yzk%_YuS2-r(XPgEtETwU&Q-#q)ppgY`Q1-u^|1YCg%G z$cur`<*zNomUBn!Ja8=7AiPp+3pWLpKmg1W|Aj^9fvu=Cp0%Vz0Q>uQu{3_v5X%A- zvw*IIW^5}8a_1`S8lqZ1hv z-cc`&N?-=-fGH#}F@g>_lQHujc_Z?RRtmu8zwJPvys>mTgNDV2fWxu)FhDrwdGq)< zL7;=l3vE&GJmWx{_j&ZdC}38AK>$?DTuh2@$rd=MbLqGX64^q5OMr#t7oVgpd^Q97b0p~f#4a)?_5W~ay`E7HDOFSkGziI&w?(r}1?px&P@;*ER2oaxq zqsgn|#0N`&+Tn#N|HO_=twofre>!aEKlE>Z`{(EX*=)fenE!SZf8+Mg%j+DPT~MhL zzqkxb+;2~2QQVFBkID8r3zCy#>ERSSg~iK%AZGnNX>~C(SzyKl{J#Il1{FXdD!(NA zqR%`mm<|2+H!tS;5TqZ>`43ouC@rkL@V8eDCQums(r|MsfJKa;hXb|==m2QKC!)6evD6FbUh~EE z`EZdsSB;u)B?SfTm@yOf%K@FaVK#ddJ@keHI@Ene3L=zdo;sVx;pnyX#7)POE z85BSO(4;@w&P9e*@0V9nRNBvM(7I9@6rpXe;; znU@=e3dfT91)~6mZeh(Pe!ASe0-SqSJVv2FC~X8*J$Mf5^YZxV45A>60YE{227_M@ zfXQO;!k2Sn=G92xUj%;V&1pWOILDq{NMBrtkmy)eNHFh-i`+* z_}`yi>I)+2CMGarUIhcbLr$W^0(S8~e5=6c#V!o(@@kAxd7E1>H)t>q&jDKpH*Z}C z0M=Oi3grO{sR{;6ac|-_Pj^8fF~0cg(Kow;d7lV zj7aGLas$@Y#bcRxEP=R%=fN-V90aBE_#1*xe6gYuz(fLt_2*#tz)F)xq7wMi00iXg zWUU3u`VS+c^I}{JW3PXI8v?(3U0qfjowx;XjlsI~EgIW)sM6@F=3rI+CR5b`s{%U} zxS|iNhW?yD=r7n){FPNr*sk%P8Nl46{;P*Dmm!Ct;E7bg8L^?!;}{fj2n(!^r_tjq zz%TU%%=X%fq3l4z6Fg*jXCeT1t@F!J&EemlTZo2- zb>4X|F&0mxvjo*o=;0Jzcz@pP3cAqaWgG(?&~W^yI2ah^90m}y0%KX?{1T`v7TsK5 zKPDzd56c^+9*sfP59haH>SNG0NM{eEE)39`Ues_R^LM}q*lmJJ%=~>81K1KQnIVX3 zQK-BUG88Hq@Q+A;tQahVC{CaN8XgzLTJ(bEM#V=r^9^_VGD%je}1MQ(B z?t}KUck%KB`&hZVTRD58kse?dcd(6%vn|>a?c(eKc0qxyoc+L#XlGlUxwLCyES+C3 ziRXNU^DOgRy~DYO&jqan#v2a~$5P2rfVm_CCX_000q0SFB$i4L=M{hzoRj};I(nf0 z`T4){htCqDM3D98&?L`O(w+B|=v4Cm>N5-s3=E774SD|?7#RHVKg<|rVgP~~8W|ay zK#kx)JE$=nY77D!{MStJ-~U80Sy%?h;D7m9e@^cIke?J+XS| zDh&cHky|c*0s?__pO*E4KtgFOq%SKX7Es(E2;7GM8w6$$LSwQZa9aorhNaW>2ox-t zfsJ75QHd-F37x{1!wOmdtN}GQeWv;RFwVV?!Ii5MR8jky)7FsRAs_Zw7_w zndw2H{J#Lklz*8(jHcj;z*RUB0=E$i9Rf3;2nHKuMT)S6QsPKts1XfIM2FB!g7}?K zu@Qn!T(M-LE|lMik#~qQ&Wssj>uLaXjWCX3*oMT0Mnq#7bOPB2?n)zuxH02H{K!6r zb`%GHSAPi18UjOM-La-rqPufA8Hb98qDa<$bW?wnDbfWK;_dBk8V>WoG00vh6S5Zs zW{vTTH8pYbvW_5o$3tK!9~U=f7@87lLnDXz#bZ6)U@?Ba5E#mu%rHWk8OGZ%7|!lC zc%(NBj31P*F@=G%FMWv$iFFc$whC$ZmEq6t^%EjSPWVJ4LeGBakGT zGl`66dJy0aaTo&0DGCkqf!X*XDUmK1w@?z%o*W+HZR_nwVfn;ZL5)J`Bu5iqGX4w* z4CRY*aPf?Ea5IL$Q1}pAI0R*^Z|^>m1^iTB4LjiOlYC@3^E5+7;EqFWQ8;StzqPd}K4l`o2E zLa=joCmK_{tixz_9&{FzY;TY9Bl_d;tk5t6mRm$zEDPmhkH(>&F_Y}SuzY z66j<-tl7a47c^C2?a;;}58uRDQBqx#!3;!KG6P**C=FeD-r?;90IMVUc=U9eWR zenbOrHyb?JEY#7?01gYIAY-kl?hHpiFMFJ0D9XbLO>i(odc?XxU?`%oAJoUd0RltC zczN28JUmeD5Eu#=hXWA}b*KA8LSWV~w`jagye}Yfq4rVMjv~h!Xmgbphh%PUo&3=FHBUN zt05-L5fx`b@`$oCfRSQdz3iaT5Ev=~ZtV<#p-inHa2p5=HMc8yTNL^$yqE@fVHXnrs^=7IJFJl{=Bv$@l9C9oRCg@nt6`PlLRzA!i)F zW#>A5*<5tm=-4qi<*i56U>J-WGmPketmlZ3G49O31{;jD>)LgD&wZY)U(%MnJL)>8 z_wt2S3HESwPeyCZ;{cm~6>Wx2%Mg>blDkItsr-DKyi!H}z<~n?LsxzAt@=Tp2Yu+ZWHp= zSyxh4hM$@Eav&q4VYufqGDJen^bVM-bN}-gGl{uK-=i0BC zfvabViO#&w3(7uxI8hEx0&8k6FEo$Zd+U}(U0t0)$Ww6sW74BSi}hj8&edirS!5qP zxTn}I>s@ELNAtsfhc;O32Ay>)b|2TTtE;mfc>lhyv)scpeoPYvgH__2R^4xCz&

hVTm?3lQZ&)SlIG&vbN#0*$7gJ^D8m>?}=;NQfhM27P4|26*zg&I(^b~T1PT+0dX+;|xJEn=Nm^J%aY37ziW=iOq zHEW)Kmbs|h{?@4Q;O^08ztq%JgNPS~LLwrnP^jCqqD?S6s);+CHQS{$Gozg;25QPu zu^V}FM@mYn7GZS$goA^_YGvijd-t}Mu_bS~Rn{co+1K#wl}%h~zSxOBEcV#E|1CSVISo~52U8%Slak>bN;HVsll$=9$|(&0^H-{ z&2Qhn?HU-Umyo)ALL+Uq3W2`R&gpAPY{2cgb<5)WUw@UlL{ir41?)b4{P@F!&vG*z zq7zMAwHwy#BxPw~Vd2pqKk_X1RSdO%m##=nO)Y7qi%*mxhO^Y9080Cfm=?&VOrCVcT=8jG7-m-d|l^JtnuRfjgEq zdr+--g4_&+G6w7w%^0@R5*5h!c=Nitx{_A<@`*Aw@Qf-%eMX8&?@s9z>-7$QTkiW5 zT)S5|-!kFmm|S!Nx3iXOpVKxC@67MMv%_S1{If=aNLM|)b@RTFyED$y61RfcpRjDT z7W-K_62|wu_m$ADRGO(f#?Mdg#TClNgrvvaoMYW8XqW?g_nyZ4`A~eo*H&wj)ULBW z_@9&C+R5FCv*o}zH;#$Q5-Pp_Svy>e$lLhfv>&9FB~e{ z*>l|Vhg(g%RnYELHJ=WvNUI+bL!;5{Lvn**lPd?#2v-{>BW2 zc5-LxtlavUjp$8dKGMX0ru)^syVA&<1aF{?Wy18^nUR`2%VO{0*6YB0ifWE&TBv_` zQkd3rne52LVvPD@!spHC28rj7%b(I(hP*GWpYkv7wHt z;M%1_@X!WsH%D!vi93esfkLr$Lc?$FY@1H6$t@_5aO!wFGLrRw{rmTd8ty~=nynp% zv2k%mlfqE?+pUV`tmeS7PmLG0-(vl0gaNW#g_tNad61dXq{3E2%#IxzlVhL#-cUl3 z&s0GKjz7=S+aCWittIrTs-E73Pa_$bnJ5ZHYxnV>_Ob8Z_nxN2{`J_zEg)d$O9bcW zQL(olRD%2a`}eJX)AbMTxkS7k*)QVY==kkL*u_4?uPMo$J9lOuJGSZjjH`<1D#d#q zE?Xc8sPo+_Gl%YTyE$((E!35FO=1g7Bdz&!N$;yq?mu7srtV!s+7i&ZG+{26>wB5x z)Ri{$`C?7dX^JWRE$GsvOHa>lGdZ`ddKH^HrD5n)e`3pjj_kt14C?EfSnkg$(_KGJ zm3It7@87?F^5jX-uh|iH5k=mZ_6AVylarIcw(YipimKP}?bbt&~jV#%wN_HsBX4<0@|n42q%Kp=jO zuz#J6hZb6YCdemCs)&FB?!?O!+hw6J7zt;NKelq3dM=Zfy!zQO z(%#+<0+BAuT_!!QnEvs#=d!4!rKP5hPGU_>jXQ1d25V@|<}F)FThGV{OiPCXvB@?# z_~e*a)TPLNl#sA+(e>-HmX?;2#Uk+b)? z@~DwkpOGJ4IQGio2Y;P+?tvDy!z3jn61zeh#)dkiWMqU@R8$l#q9w{)I2YofM<0`H zQ7G?!1n0j#Jg)!#{-IkyKsucKq=cLrs)C!gF_^bX^p~s;IN>VZ<-Y`)U`jUo)PQ-^mftUta8QIi%spanqiNk)AnJ%cbJj(?!Gi z`6jeC5hHIP{joD&s=s}`HR1p?AqN0|dhThE(_tm)9TUS=y>}BzTfw4(uWy-5e0iw> z>_$#x6(Xm^nr-A3jR~mPrQ~$nIM;HY;@cBDzFHxX`^V(2;@FK1T>BjH*)H22=n_z0 zU!PYm6VsS|>{zN>F$&Fb(->}z1=L)5jfK`0b?_&Ag`=(@-b5e`5je@;e!PEJjsIabD_-@eth9MULl4Ou-=W(hp$>&2W6jY6Pw z1(Q{gk&*3W*JbAdZme;0b6acnfH#-Nd!ek(z-IGpFXwyR&+c00G53T(E0=ORww%@cwUQR(l zdf=USG^c3AaO+feukLW`R6sc*PhJ{ifUOha9^RrMXB4_t-Q|RTPD0X!O2kJjo87=I zXzH3~-heIvef#z;cC=RXU}2$dLh1&kE%9r=ytrC_GwO4ROB-b3qwny==;79?fUAf+ zMQIRyV%U#0)GnO1PB+K0!F8Qpz;ZU5U0@O8JiT^1o}F3C{ggComZbgT<0bqlcNWWV z=gys#aH=&&v({kWJU-_ij9?_Zpd=RK$bKIJQnF(Y_h~|au zx6~6d-BVLjgJDNUUol(z9vy|Zf7DEwHBy|ptTYp5IuWy?$=2xe^NV)D!QjAzaj$^8 zJN>2=w`*%^-s>#)XuBAMP=i3w9Q^X(i(k7rvsE=W@oaW~1JrGwq~#>&$LkoC)6Rvd zb#>N5Ocn%zQ1Lj8sh$1Nn?-zh1kJ(Q508B9=JZ$9+`_YCnxJlJ#D_1#WJrVm(j5YE` zN!#Z_VpnK?u4RkXrcIkFaSh@^LPBp_G&r`_)_cd$dMN;g2AmAxCfh9p0s*{flX%37 zE49rBHy$h~2*1AmS%!j1Wn@1pT^73Zy#Lj@`zg`~j~>-ZShr{Ppw5Kd)xP|YldYCB z5*s#b2i|lWIl(pPxY8>7TUg*(P?$h0N4ZL}? z;`Uq7$mbWfLn-ZQJGoOIP1)SrV-%wY4N@l$YiMtF z_G;j9W@d6`W@dFY8wW7MS!z{?=e5ucz?QVjRIGhcXd$Jdk`?#Y2W(xUnC#|QgSxu9 z)vH&7f`Wo#ckHOIuV41~xCtPX$4qFeBqb$*i_f30U$SJ$@)axU-`4Jvl9AaT^CnJz z^xL;@-8YyTmo8nR_cyK_a>->K0G5P|QIr?sGfuL5r9pcYY`zGma2< z>UesE;&Fk=*u?A1+*F-)fsyO8i(Ytt2+nU^3oXKT`Ai|W-z4Xo`J1Y<&QUr}kB*Hc zR#%%CI@#Qc{_?cKOWQEwh3B*(V+rs5T%}_MJ573bE^~2lQBzl6dVT672n>Zvoj7q~ za{BW{NbAOZc(z)~Yj5?1Y{s(w z=TZOjsQ>dHwc#GF3cO{D(#vX^U3j<-sr5ug6}|~~Z}$>|qnObjKkS+^mD;XFY`YTP zv*zp9uah;uW)RnJ-6|$NJQDJM@|v!B^e|wY^D*iYvIe03#ta)4%MgdhS0&6u69|Np zSFU(Ydq9+U1Cf(%O58X5{h_|SgF{`q9DMcKwTaG!=C!Y1D`Bx%S;LUkk4SL9_cjW9 z7TlDn)ZE;BudUcF@>8eQ!29<_m6fa4r3v4AydI0iZutKFJN;9qmg1Iw__cC!a@|#U z(Rc6O0mdNzF-bz+aCuQtQOL7%ayt_epoHetkMg0*&}ek?lPBxAN*l<$(cD;-DQ4m5 z;?i`9_|PD{+hFtPy=BW+tx9Sk)cu_L>tIgK-XQjDSNV^Dfq~$MM|ATMY)g!~bka(N zB=7V78%#}QRd!8ofWcsY1@V$*>ws6=8WoA@K6C2S(w3GMub>m3+loa21fYL+aw(fT zRW=r9bTjsws&T}NM4!Mo;n%lf?4DoPE+sFY>U7)~%|VUx*1On2QF`TAiv}mSIeWwP zk0*8jhODGSE#OwP)ATu!8}Z|to?Q&ediypw#hb#2&jIFsA-lLk3V-x=7wj36V1@vrBILhDu*ce)9!tPSHN>>v8)T(Fa z{PqRjiSKK(Q$Yp<6pWcU%P1(Mo!GMDT~(8^&CZ>-$IKQ%2;Fu1f$7iAZ^I9FSJ^u` z*X)nTkvl(dFRoCo$B$Qx zncZZ(e;{*v;zd|U+bQ97`hhwLnHzYBD6@(CHFNg0Qj@Kbn3&jLN15cC*#4EoUd(_F z5{b+=j*wrvY}vv5e9eT+4V3`ynrPyF%AB2*X%gDq-;`B<95eFfz<~pAImf(RAP~rM zNlCll;FBFS$*(lKgX*ggFRN;j@a*dAKlAgUc#)q!e^%0ZEr&b~UyB(DWPR!syG(99 zVu{omZnf+Vs;@-M1he%vt2-B(3kL-S-96g)jPs$H`_)z!q<+f>wWE^`M za8BKS0EbA{jG>mPXr`JV(xtj(3$Xj!$)-Xx9SGnV-JHJ0`^RZ_Q}(Y|@4&H&stm4O zis4vppO(1w+vN(y48OUfFgrbd$a3GOzN6$5wK2U38jE~2xcWJ7ZU3vG4JL|Or_Y^} z;JbUIVHYRBV=6`5+lt3M%7^OxAQve#eCj%X3*GfIb_gC`$L$2hDK))J0;YcH^5wQt z$Mr+-W|6yh?>^wZ-LTN(ynk=cvTyJ6f*d$j#`b8mm8)y^nB2-bZYSXRJ(%@!--Q`| zSuKfg%FMOgH~jW}UQpwnWuhgmXVy=U6#;+0J1FWwme`?|#F7%VA$aquHPX^j%F23w z38*`ji2h)<8oGg7;SrBHeE9ImxW7KMle3kKDD6T-B5`r#(;+J*KVKGe%n&^-ajE!Q ze-nQEQ`g^`R8|_4l$AMhtfCJeJC=Ij!15vZr^Hz~VA(c}$7m3nY$+72V@6@>2_j}& z`x`SN0ni8!ZQ!N@{af4WTe*$OLKGi($Z4jThU)45V*;A4QYU5 zBQ7rP8W51q{x#G4)No}h;@9SXOP4OGSvnn8GNprDwu~R<#b8XT5OTvK>Jw!u4>D7d zRd&g0I2UAF76$^G<@`32DXFK_*YfE!Ce_Rh{p9FEF^2M98j7#{s`g)rdlhJ_Nu~Gn5zkU05h4+ucS{|-}fxBL& z4UG+TnC_f30KNUxbr$eGaX1|P%L}8)$;sf}y9t&4=O>@naQ6eQpN4b6?$Z?09TPgd z_`$EA9}!g%FO6GVs;%^Yw%-(TadG)004^mftC?VZM`r!{{_pP}di}a}@+9cEam3!! zlD6vR81fQ}wL8q#}ri{Awgy3nht78VMDfq|xM?&j3AG;EbGee|tW!0p(! zAx_zOPu~vsb$NQCoKp@dqXj?1K zGuw>u1KF2PL1Tn6d^} zgTR)S%9fUv)d?;Wl8B%5mlu!c=WC8rUfAxBfnP>UXaMGa`;J>Q#ukax`jPM~_d-xj zCiCNyzAOZHD}^$&{ny=h?{EP(Sz_L2WkB>VFRq%;zF4mpu)6_Q_43Y>YhlmzFef(q zO{e=;)!h2^Vz~8NckgR<#Ds=T4-`s!v-#06Bgbh8#_sCgT?!+2XD<91j;tcLDvy16 z=>xQRb7u#CzV~jz-_B;nKR<7~Lh%@aH!t~mFg&u~E=!W#!B(R}6>X&6(~V z9?;NE&Bbc0wCR4TjJ84KJ6oX1BN7~k$N%jlXhJ!nQ&$yY!j-DKo8?WQ0?*o+O%vt9t z=n|0r?a{qC2&GJF&+RyP(ki7*38;OQi18{!P6>mZD*;u{R6(plAP|6kv9z=_jr(4* z$bi7^=Yw`f_BU?O({rAd2;H5l?W4MBlf$&c@k&Hg6(Wa_$OSFS5Ce^ljd@NKR$h33 zt2*g_blkX|+$}ug!L!GoT3zwDkvDgiOGq3BEagxcr;$55Q`%a&VxkN%4(XkoqDG;U zUnS9zNYqa(a@a))FpuXE^%-KI6I@IdrJ)tdIT>oV91xOl9WQ{#i4Q_V`D4{8ErQCjTDi z(nqyoR7TxE%c0WNr!o^CHxG|o?B@J+-Jh*zqR!iMl9rR;OP4Q~xDUv^(f^C8CM`o*NL2@l4IkOv=iVoEYxen2_3jcj|)zYw+okzdk%Zv>2HxN`rPE z(r`IN>%F^t<;sSuVb4oi-5lK9q%i8zCw6=_D==fCrWGMo3ups<`DaM8)8os3B_!^j zy?8hEVV=Gtr#MVlSUBH2YSZ-i=VSnlFeUcPb}7wVMojp`43AtiRSzAl6;*kAcjjw- zXSs))udil8=7oWeAMp0SsH&TX8% zix^X19gy0HI_Y)RJKr=?6$XcwwyIVlavHd2i~)D6hs@carY4jjZ&a6my}>3sKmW|| z@gw3ZRvgUE-hJ{U*pT{4wmw<1DQTrbN$V;9O2GLZbXJs(t|UHOmzbPf9QORe;ESu; z>Q2WJTM@q$Kelr6EYG9j;^F{(ukKuMz)m?%XiNOqR$E&kcX#&^mtv7%zy+1M2gSzN zWhz=>FcN_~zag(sIz()Ll2;+^?U#RebabE7apS)3D!lU@4GRl}mX?-$IC+(|wKd>2 zUyFE&yMI8+w+bhG>C&Y|E~sgDinK;{K|%W9V2F^YXfgBS6FQT*uZ3X!i#sbNCzs-P znS|}C@an!9rM*hUGX2pb%)r0^*u-T0)YO!wmevx`;lqc)2!zUijT<+bTUxA0Bz2(K z`EAv>_YZRO&6w({8#lJqu-WN~W@|DOOi+1x+W{waa4T|W^wk>#fwNnM#B5D0`uI@?~b4&M9U&71ze<>ycS|9>U# zf9~i1h5rvTF*5pt|8Hn)2>&1c|NkF9f9L-%@dANB-+26g{~Z%*I1ork#jW5Tc|evwXwaW+;iM0aMGvw@vcGz5ksU?4CQ#uaVgVaIT=cd%lRz2OE{ zwtf`4nUxM zfj|g=7CYry%VejZKkAG6aUAGGP%o18f}HF~-l? z1_MLeI9VH^;4~`58IMFlAuyC1E5eEC24mO~$^N)lGRE7DL3QzET1SL3{E=QTjEfi4 zorHFbfa1(3j-JLLk;cAAA7C0rE-qGaEYm1|mcJD##sy^<55v%$B23+hEKH062_FuD zp*;K{Fl!P7W*y=b>q|FrF>{UcA{){nFcizh6y-w?4Ugqp@UMPNhYjfu{_k#GmoXp<ucwK zALAPqfi$*;J4Zz_4NP33Li~u44k7j|Cvt?lojo2GNsS64!$~MF8yg7BIt=uk}~R`%;6;8yRNHH)Q8YK%KTq z$qv9;r{3anF5yTMkJuwyT50E}zy|Qvx3?wr;q}Vs9JSH=(k`37sl7xmm69@l%Pe)U zRoi%Elhna<-wIn>7_NMcRLgjV6XyfQFFZL%U3O(W=RNC6w0NgAgvTW(H zWo?(qF07$;;V&<%ldG#u_U_#aIC~RcUKTs%=?(T=)>yi18P-77fH7cy|Necjp57`k zF|qEeVe1(ThU>O%+S8|Vj$_Mzb2<`!&Hk`QqibK?U`i<}rU%}MuYLJap|7t`c1yfr zI%?xOy?_HN6^w&_e0>d|&0V`JoeRzPx3{}{dV1aqH(quY^o5RT} zC{P@Jb4MX1CB?Tgcu6{HBPvTdqq5Qf0MEO2?UIF)BtASTOgnsd?b@|}YnO8~vyW7H zqN96ydVH^j$~0yuBxfpFsH&+6iR@dFwq76Q?=Qb=vQIScgO;9Nv&CjJj~O#`}m|#N=YdrJzb(LGSNJKO!L&KQ%`R& z$>#!YxU&@9HIHn1-T9JMld+9Ix21W3*0-X+RPLN&v_;xu zeJeUK3fxzQL}u>p!$|^v%V^ z?z>0f%bW}MayTj+*1?`s8SS?tBUvi!pKh$RYj&4@I=yCp&6=l|$u4WxuTRT7h2Fn^ z|MkxoZdFG1quSh>8+}$ed|tRj_&R5_HBbU@As{so~HHQogC|MK{nB~ zDHMvVLGbQD*#T7@FB7cs@wOrx(SZ*iQZwHjxpet*QOA&LP>{a4xS5<|*UJ3Iq}Uxh ziqD7eX@nvPdSSXYIN z&bqWgS=PRrH_cF3dVMoWT4`Uw?$Qc3X$|N5 z-};-7O(zit3kx$wN9k=)dyV7T(oM|Tru z40cY^+n~)NS(ek9cc(vTw?XaIb-Y$q`RWXImP>Q;-H+b9X+AkUotkL{!aN*%Org0KOCo29qt`}paq-owSA)$(%%lHc0GG`%IUcADSWmx;8PYA zS+OK8Epzm0m>B8JYEs^TVM#Fd7TF}f`+TuxozlMHd+uIU`&X>5c(>(4%*dOS=$u_Y zo(D!nMa6z^(I|TU`HN);lSP`4jI4H|5FZYC?t+Cjm@qTTe3*p`s>(Yc%Qc|8>%t%YSe3#R~ot-J_7y_f$1SX7o zdHVR6Sg<=3g(sZA;4wj2HVg)yh8k{PV$s2R97N1gF&} zOZN9AtISPw$JZO8NF?$U{wL&6OX9cwrv9tX19`FW05-ht-o35i-IcZe6+t_{39F&& z`s$Mp=H(^tnw`dWoOYUgpBDs1uUVyNx_j^5rDLC;O9J{6i`^h1shmDJ84Ean`Zd31 z_0`aInMxMfxw*o30<$2FM|>|j=BS<9R=sMye&E`lN>gDP&IMaX-rPa*U*b8N(bR@Vm`yd7*S9{usdE+Jvd_wV0r z*(Ht0)7!o`D=TYImLPhhB2`#eI3@F`>dR`H9i47aarSJ{^UvSvB@w|rmx!?=cYcia zXCeF@$ICdo>L$PSpReIM<|Ix|#`@~4yWiBb4PhKT>>GB_@~=nmXHA}e~c zGiNkENBCa}k@CJ6nDOaTXn`41WPF_0CUD0WBMCW}(8`r7A3Jmf8@zoT(~C?<*z$-3 ze^O|XT%RmiA8vg1g6EBY@{0A2UJae!^Fuw#jg5^}wY68|sQIagXzJ-*JM!tUmdEIa z-Pn2?(u|D4>|i27Vh&{?ydC$C+**7JPJ zVx;gX51MKj|2MyL48e#(AY=+RvkRcKmoZ^^vn)An(Yubw)d`9lz3_Ve;nQHrgGC zxk%5R(h8jDD#d%1*m~P0u!by*u)MvaLm-XAFRq4Ne}7~f@E5>H%PS}d{-URn zsXZw@T>^8=5Y3XfB<<++{@FRdeM22(fF6R$XV}}@ujcE2C$q~v5;PjE4Qh`%apJ_| z%n!&vcfB_pOkp4?f*si$tbmTEX%SDQhwn%~Z`r%yySn zNV#koUu!u#=FtXiUSbhFe6PC-k8A>qR(Tqos;pei<#JEqvzLv_BP7 z1}GG2kHM^eRoXXP8U4loeq$q`*@MeN)3dT9IcDB+mwP0Ff`a&FAj2$n6f8+S2g}<0 zefcUSb2W33mc-HutIe{>@uMeAU(~yIof#dadnqA0m52nws8PB6efO?P>g$_+Sw~zR zFg`qz8yjr1VM#ES9;s-Ii;F9|aKV`+ans7lY2}N5YZ2P!B4%QaUj3W2wWVZbHO)m{ zpNtuKbLPT@bxQjR5=%dcgocIn4GpENSg&^=^WC#2g%+ad9Qv0RMs04*DZUldQ+Mww zn-^v_1+|7T3PKG)I4^W!^yg^{T8m{w9~2L?6fM+*WEpr z$x^FV?o9Q^na^b-b4HSjF{8D{XvzWh*KwY@6JFavwZ!kd+YG%$@8vWqwE>G*y#z%stj~ zGfI2!-o2ym()8bbfB*1Qzovg&oEhoyvHgAZ$r~XM0X%x$X)$tp-%DDJ(q+pux*uPjA3`&QUp{@h`^(E}d|jd#02)raa57)L3TUgc zhX9aP67h3&QBhGySA|Sty4*h9ZP(6!OthR&O%+$u(Aa2dDyyulEQ{E+`C7zFbv~XY zR53p~+uGWmbm3SIc9cny9_8=JvYcN2v6Zu4>C0&cN5`s&m&O>5rP7Z#JM={)WOp|= z+n1D!yi` ziGXa5j*TVO2H!g%wQ;qK%>Kc_5Wp`wZbCzmNa_qG(=8w%Jtt?);oRJ!)2Bu5jTe8& z%grq+DG_RDXlQ=?7)c_j8`IvT$NlvIfBWFD)`8U2x&u-h4IU2i!C+8PQPF|4 zw0$iE>&VEew`qP=^{=L`MCUxc85I^AA7A(I z;lud&frEC(5*~GQT<&?kBQ`d8p!uM^gG1ekEjzOF@{*I1MA}SpUr9LTuI+!He;0&m z%2Yc3_3$%~5ZPerr>Ej!P`6c@Kucxhvf z8?W^9^Si!t3ijd(W#6;&+lpzuciHjWnqRXcK*zUl-*)x#+W+Vg22*G*lcTmlU0tLp zQ;FH8yJ1?!F*o2-^|qm;l?ula?w&cby!uVNHp_f_nqF&DlPG)UWiS0xe`h&K#RY>I zm~gPJ^lX7pujRhMI6FJ1t+Z2@Z~ujKfAm?g}w@Gk@2liyOo}v zzAmEl6nzJTj4RL4p}ukuT`8}&Q#(S7dQr{f$R;z}p=}h$$Q_Uym7Xo6b!oz%pI`KO z?ft_2RbY#hj#p@vLUnt&e@9tGH17_A@U#TixTZ zE%l}Ltjv*3ezVcqPJqTnw^3gOO0QW1?C;?6HP!B-L=vek#E`KA0@CrSZaCj*cKyy8 z$F9e8?WmR1i(k`9KZzW>);{y~R@Sz1(5t}LD;&M*ciqY*kw~eTe*@31-?=Gzq(UT8 z+sl%A@kN7s*MZaLJ#*BkrJL%$c*GQDpdPK;ma$QSG)hH z|KgS4TOl4Z+zq9c-v8o-^sNx@x{~{b{cHA>L%AIF;)6zauhrC2LYhLgPjOrG7q1Pz z72?_1+4s&LR?NxHf4;}Nu=myVT=@(XwNz~d_2RoK&+X~kv~Gx3`#^mw^zNNMZ2NBF zlfRCa#yf8Zhx#vFQ@#~2i|AqB%jb7*)6$Zv_W6h{e=yK^{;&e5T&&tBuF6yC-ueHB zy)TciqPiYOt=rQ|trXn3z641yZ<3dUfKjj^VTmk>NdT)Lf0_5@zW0XAn;B;2z3?Dt zZLMgnxVCOs3oTW!xU}wDwQf}_O05g1b*13GP#4_#``l$_?#!FFB`*Pf-^?HIGIN)6 z&pqedbIv{Y+{O!%TIdriKEn|w;whA zvr6^2QTMEPf4S?ayJoJv`ss)ejfP*mY5ufn(;ob0$981wUQ#mkZ=F@3s_F+5mVVxJ z1vmfM2bL{eymaYXAKv@XxyzUDE8qJ;o$<~;_eNhkJHdhb>@{V@k>_7|<)M!}`sgvo z9J9y0$qy#Ynsv~^uCB?ib@;E@R6X*}SCdDac;bobe;2QIKm78`M||+|om+ce`SE3I zzWVly*Gfi>+FRecVX~@LE&1%-y%j|{XZiB*f46O{I{d;@?^2JclV1AitM_)7j2^x3 zjvYJ3C*B=)^7QGaoN~$@f7x{4>t9{Fe)Z}-*Q{BC-haA%`z4oM_H$G?7(DoZ;T1pK z7<**ff5zV*Jbd`Mb@9y)KJ(1b@MFJv=#{(mOD?_iXFvPdo)5it@ahGNCa#=*$eOFK zz4pS{H_qW-xogq3mu@YYG-*<2)uFd6{v`B=HEZ5jKJrXe{Oy}>hTebW?n5pZQF-n| zoe$o%=&fhhwvRsNoO7_gIcwI6>Dw<}`c}_ff4>?=@Fap2muYghmNlE>7EkF?ER zEC2hx!@`gKs^PsC)*pQM;lI56@?jmbXP>_UUUB2xn?vutuztV&_dmO|`Op)R6%)UF ze|@iww@!O>{KzMN_hnnW{?PMhUH|Z3o|$;TwI_7{a>d)jPDsB0Gn^KTeD$# z=;Y5nxbwBg*5CQ>UvBzK^sRTFzj5_jWl#S4xVazyb9&_}WQRS_bN9CKr9-y9by0bI z;yG6=WSt>H*WH`u4AJ)3F!iZ&IPsicFXZ`S&OPw3pZ)#s)9(E8xC4%V{$KwBe}4a- z4Gj(4Sr;C2_dZ)6K6CZf#%XIeTzkTZ@4owPT1!j!JD)9l`k|liyYa@kmH)Wzqy@&X zOAp@Kc=YQ3JiKPjl6U`A{^gDx}uyplZcfIt^i(6Lse-1cc(TnrD`L`asaP{vmK5G2P4O^bvp*F8Q{K6@R zUO46YGxnW74n8@I=#q7>_uRGOxc@x-&YI14DhqnPdguCC_x5~s|82L`9(ZWgkBtKt z?y+I{d&e)GxN^?A$X^aSs^0jqEZ_A06*JEYoN&Ss_17Ns*=L`v{{6Evf7OYPX#eRM zzoz5qNX>os-+#)SImf=Y<x!XO_ReX7jq)$DLX+d=q!kk#pzH-M6x`a$|76l|x5ex^$ut zc%HgbezWDz)6N(*YSgwDf7V~K?NIr`?W^W#8KDD)bmU2A&O3M7+ZCHOZQ5_> z&=E&H99T5*@|K%+T)d`Z!LrY0SIocXUvE^s-820+6%VaEUT=C_J#OXD&n^y6Jd%5U z+1H=*Uw-_?LB9YmF8S}qsh>PQcft89-WWc9lxpHEct8ee-m%+_0gF2xpVi$ zT6gV5+gHt6v0-`RntJ%;u>pFkL+kYY3bI7 zZ)%&_(lXUBZhLy}f0QS;zoI|$#>a0wygD57ZEZZ^{i}xFi_AwbYSg2D+f4Ta>9nT(p`qqd4*tUNC z`pMVS#ovE=itj&fym2iBtc4_sUJul+I32C%$+Hk8aGLf7H=S-w*!k@UgzV_ul)| zJEX%l-`=%+`_^YJxaaQV35(wR-jXjqBnTcq@~0QB*}ST8-`Nu{UiQhGlfU`;wf~(v z>-xWZclou)>&L$P-h0=)D$crYB7$PbgU{bMe>a%=RCwg^$A7dB|xzhvwX zFmBw4SMTk9eCbE`FTdrMs#7b54;wb@f5+E9_r^Cnw%>5mP3LZs9=oJus`|;BldpJf z*3?Dqi6as0cRdtdH)_6Jagvv{}HKq;JdH7rd@i@vadfMd+&2IuBzT! zd0@w}6~hnEbbbBSz0Umh`N@}-zW>@^M?U!3b???+d(g{w#P=F<+=V8{O6j;75BoYhMzL-xnp`he{Ipqp&Rz?46l9cvB%bZ zm{>gXrup}tt8d-##@6f3ni7wHe=zdQ`H93>gv(_MR;^pNZutDqe{sNw&bn*hQ|~QY z`o)KjZhz*aN=zHyefj5C#fj3G=Od!q^op{^hFYLJGZn}tk@Wd3~mUrISaqoz;E?Z{R9P)$V!_QrR`kkAvzHnIC z@yB1Ktnt@uSe|^TW@Pf$fA6kpT>gU}{Rlpnns(K(Gp|0UWa^6ZR;(&tIrM{Dq7&aA zGkeJ5ch_Fuk-F`$uby9V)CpC|_fOpztUZ7Gsxv>|u>93Er=5E0erKI^)-}&eeR9={ z?=AZD?Pm6?ZwPV4-1gpmr7vv0z3bp3jySIV+&?aw_^+of*`eOhf3e4dk3YWrnImuf z)h6lOn{U2(+oAH=+gD9ov0?ecYnFWcdc*9aSH5`dgirroGTzvBG5gW?ap#c>|Mv4U z?>c&GCK84?ld#WtYA6@s^9X3)oNdGnFi2>pS-N-RXDAW##3UpfxbM zVP(TbM^9*aTG`a~fxd&tM1emZIX{A;Bvrmnbg?b?Qy?}$%+9HI-O*Kl{Cp zZo1*QcNR;{4b|1v&)(iOcVlqdP^ts0@3`i`Bgg;Xgyj3`f95UEeRS1~V-GyMb{eBe zoUv|5ReW>p(YHT7`Pi9PKhiyU_F)^Azjs$?;=HzX4}SK=_x`$l!wILfw!Z$~_q3@y zcI?=;`S#=L;+sqBeVfkS{>HqURt~-5*JFmPoUnBG9((L@>K)Qm({Flae#QKIhMj%( z+2gxET)D06f9)X~mg{#dnKX$%pW@Tc>V1sE<3bNI`nUU`&;Ym*;_t+Z|+~*ZlAZmw{qy$=l^yn zzh<+5v|69WPaNbi_R37lus(rR>*>dIBuHokne;v8v^2>*9T=e(7$BztLfBB9d zoUv}^zf)U}dgaWoKR^Y>j2YAP_$inF`Onq=Sb6**-LEX#ch36LM%5p*|ARZe44-_> z&_^#{c-ib5=d4=##fMj(nELa}e?8{aJ6}8Vg1`TLn(@KrAKf_j=Ha#y`{v2FKk@ZP zf4ykme~~>u`1b2B9^ZU>7k}%iO;fe=AA4-dpMLU}eU^Rw`J;_PC!F*4+rq|6Of~s8 z3ol!_^2kRXd+cv7zBuBL(X-BZLipz^N8PY$)gCY3sXTtp{)Zq#Va9b6kGlKryH|%V z@u?FppZdv~CBOG_3_bL9CdbgBTN@ASn7wY?f9AXO(SE=G+3QrY?aGI7WEuDa@~zd!x- zzp~~UVZi9LtebdcgCDKf9GC$=?{mE7*R5A+=#2Ly6VffFKf9a`N3)T z?fB0%xjjZ3ZyrB#!s4bw!N_ah;P36=Gi-y1?MbZ{uZhte@PYJ zeRlI%$CQ`vj~YDVjH3@f{O~4Z-7cE=_FHvpPHuYJS25e~KkU|y^Uo6=X&dFg^x)~g zK5yETqP-LXvww>;h~K__{I?@tIP9)R|M$+icZOsSnk4amH2*xg{k+n?ow+zMX4&Ka zs)AMHYFzPuW2?qh4aWZs#KX(7e?qf<*ZTkn^9GD6TB;s2%Mp#&4J{Ei5*qY5?;!W_ zs%rfiw>9nMHBRTUw{tG7XUFRsZjF;tZQ|A0T4;Z z__jh{z#Oa3x;R(E)ny(H#7w~tKthx97?+P!qkZd2LJLFOT<)57neOgx$0gT3Bc;N6 zAd#8$C0!G~vq^XGDZ=9=fB%^~w2RV54*6ddtgCa&|C*XX`9B~}NeOU?!IBctY_PYf zA~D<8T-n$J3`LRfWf4HtlrYqFsB@_NkM%B5HSYzRgQ&+>QsQI(HbqkaQ`(^D*kv9s z{x{bvy>bB`AvdQ&oio(lN`oByUsqQhbn<_7Rj_vO{)Yj1mM*Ove*=uSv0hKcR{cP^bfa`)Ouxy$21pq~b8gD2XQmC2NWSI5L8vxL#G$W0{ADAu?(a-AVJ%Pg7R zvU$*WIuf@|gv1mbStPK)b*y;Y=vdWu4maA%-oSBV;R|fQo9l|lbK_Z3%$wo*&Tbye z)=O5)f1A-v>`Ft73< zQR4BuJ5K`CjLzP*yc<8Zj zf6o&`OohCW6s#R^qT*FmFDjyRgEwF#A?bOGDYnKyqKXcEXCO(GqZ-upJP~A;&VU?q z@u9`Cd}3O#O65_+)TDO~!FqRme4jh^e-fufk-~#m8|byGZBj!c&>#(>$&;(J5Fai; z-t>LFCmkk?n4*bGZ~#|9D9l#9c&Kb_YswdaVNECie|;xCUKMS!F9>xRY8DS`4Xw@X zP)mwom?!RdRWvK)kHV^ApiqNRQ8%>0=`Um5;-PUGB5g%BcnP#B0%%AWiXP@Af2ie& z)tJf`ppn)TicZVh$*!;nbJc0MqL7Pnv@%(Zi{wCVT7^t#%~?7B>Cl0pCGb*#<|Uy+ zfy91N#{dv@P{Y+6$N3sSH=hEA0>UvE?#fWQnN zc%Z>3T#VhkK$LX@@&ZsIVChmkbD3ZO%a(x<4D$&cl9oj|ipdj=y9<&4S+lGtgA;4G z8npT(Bm+SJc;FXh18NaI3^7I`Nw_0J>w4e=tUvH+V^j zj@Ch3l*M>L_L_|`WAaq06RN6chR(q1;0FdX{-tHf)2jl<&o3Wy`WegSk6E^?)DOxW z=m9;zP}&U*VS@VYQ9GD?vQgX4_Lcqr_~h{aVk+xP?AMUo@n1E;T37s6a9mBzVE*3$ zdGhoBVlm$l)09LsMkEgre>4d-s__EiCA)Geuj@D*o`%K%BgPv5HHigS2$FJ~ z&o^7=qp+TATPAr)6tFTd8Ff%q1?nfH?Wx#>bQ)O0p^hcU;U=xUCj4zW-eOXDBgPpD zXF^p~gKRepPYPJ=MmUl0Zhe}FJ(L6`;#WnMB# z&}v>!hlCxLwGZbpBk3q8cW!YbouJK(8#X%xDzEV*_$mP0y@3FrOF;mbH90T?0iZ;f z(rB3$<*1Gn2fW@PoudLRJ|d1*CZs1Cpj(kg8^DNZO1HU4qJAlqAOISzUv_`3yar{% zERcIT3p1&{h^TffcvYyyX4|DhDaNO4*}0r=<1 ztqtw%b6eV)+QHnCp3%&n}1zQj`RwRcJ9yI=>)1u zI$rwc$-w>0QVd9h15830@DT%QK!ZrR;w1@>y#gqb0Kys+f1qrLyrhFTpF#v6Lnsi% z%!t91`L+wHNM{5pQc`pSjV7r`i8usdi5KH~QNW&((2N+=fG9^4El#L2%*&{MC4`Ui z2!J=NV>N;j)*a_+qELn!FIC2r?tr0G8k&*_Nl=d|iV=uGDNcgq1EQ`cpk7&G4?aN1 zFVGzmB^a>ge}$H(Go$xnh@)JUX!L}mSUN%WfCw*2yVid8;8WO>L;n-we6&xo|3h-? zf3>w^$GP>t>T%-+^}m653ef);uZyZFDiVN*IslC%N>e{5?co3XpbQXg1OM5kD25$1 zXX-yj43g5oPj>H3l_Jw>?CinP)2L%9g>)vg0&-TLf1LS=EvzcKXeb$qn;-281|M~m zLT?z8mi6a&2Qtvu1k!>Dkr@h>K7btgf-@NtPKMk^#;lWsA@3G8&IeR*umnU3k}Kw z)LIjge?)5OrrV}G3%ROxaTn2Aig8A|4OV3SR$XpWwKGN~9};&!#VDD~dqk8NJcLs> zt+5nH&n2)V#o{Pn#U!TnFahwYissGnmh&V;=U+ZY*JMzRYV?abK!Au5P{ziQGR>6Z z`EaA9-UX?nW88~*bQ_=RaKYgKqj>ZWkrBxoe@N(1OB<=f=IWh=$kRBZ=%ns43UiRR z2RylnoPIS8J0z3M-;RkkOJoi%qf_cxt_Td0wku$$5_JubfjgZ7e!#K#GxrI~cNI1p z@Zs!2%(}DHwW2?{^nV)1(I*2Sr~V(TcI*GO;|Be|1M(CS|2q}?Eer@ke7Fm71eDQ| ze}o-4qK=d=l{dtY1j)7>FG*~Ga6@aex%;HEuHW=EiqahI#gZmE+2W?2Q2LerMZdKw znqhyVf4TjWt&BI4Y148c^^G*(@6zz^{;q0cDB? z+Z2CdKLCZx&kmO7!xnH`{MlVjOM%{p|hZd0zn3*Tb080w?cQlcX?|5e2b`brB&m3oJ5C9dmf5jSt zh}D{P;3re*PwT@x2jmHWBa)q>%4|@S4QFfR_P2gcWU}#7UppgMc4j`4WBc(!s_cIVZ(;a3g8bfGh9uYF* z3yzRU3z3QNk`A*6YY^o0F3N%qf2~pCbsbBaKH;<3)mnjgO|PCk0I6{F_B(bh7S01Xi>ry?=vC}P;^zBU-K(|WPJ zAxR}DVZAbe=B<(KwWdQ1iZR;^DW$?zCa+(=XWC#h?`D^cW%7 zELHG#S|`0fyumDosb0mNf28&3H7wTv=z@~I=@}S>bZ2%T zNJ5fQU{QjX#E6It6II27<$QA?X&sk0P#*|# z-3me1l{jR*a<WyC}slu=YQ&1y$wu_sK0;d0K`95G|TNF!E|J%fAE zc5q?5<1l&zJcTwp&QZZML(-%Z^P@#80oM`4v;ukIoi!m#Wf~EXH@z}&TIe9HIG0Wf zR>#|d0d!NLqczfRA;gy5Le5Eq#7ha~aB8=t#muHOp+-)qj7np zBq=k8X1Xz{$6Yw@jngbJvCP7BnuTMsmMQ|KOq2 zFNgk54j=UE{%^3hsx~eDvv%BI{^tRC3ef+p?O#F^blJ?ZZkoj7SSrm8)pmNm#mnvN zEQ6L*ypSOILAb>a{PC3aGusBQtEm8(?08XWojqw$f61v(vPX)bA$kX7w}8zkLj0b& zCILjnB$Q3FBB4W#rr@)*4d%coDq=2;iVQh`mjSY)AR4CNC%c2@*_g703EiNZ#}@L- zag`7s?&{_>!QOxuCDBN67=q(OIimFKUX&7Z{G?}$)wBs=Px088B=-p5@hh^FLaR$R z1Tj8|e}<8S8ZWtVsw2tHX2n0O>1e;JFifZ7-^hwrTlxaCe4OywnZaE8e~ zNF9=)vJ2ukX8)jQ85q&h1ykNf0%tKkCsfFke;BxGZU)D*X;CR^pnd|$@$O(;5593G zo=xK%XANgqV|t6I$C>>+_Uk5t7Q*nAU9aBhynq8ruIbA*hFV*Zn0#Z^fTkiJ;YK4fLyd5sbTse z$-=Oo19L@50;(A90ufQu4RZDu8c?G_e}R-g1=1J+mCOkU;20xYULu&u7dp}?rA+~7 zyeuej3vr|wGMyj*CMk*pdD+?2+!(~CHVp-tjzCYvLkiiS%cE)AgW;j*xaNa6aWrI z4Wi|NFtD`_rBNvnP-V>#zPtz;0!YXR3Ttb?q&*Y6qjg%-rUuigXTeJL7I?#> z8#{jsCU#6nc3-@%TL*!`=q{Mb+Kpi*NFkJs=S{tt9sRdd61mO3Zi)X3Ho37WkC~&9Zw?3Ff&4#HIW6B4s07r*!e-)-QU{cm} zqN2Fh(S#vNIv0h;beNi=DRCs#*&BFtKj2)VpIN|cb0t%^bIh#v89T-$P}kEL1sgBZ zo@2<`JDHv)-r%vdB`Hc*LIwULTE0zPy);YCdpf`6oPe5O&O9;=vnm`7A7ekW_xw1? z!Bob)OE2}vB5mqe9w`?(e{2PNo_~}+&kqCzk{nl5yjhDm`94qfo5Lf$W8nAthHRTCedUIr1VG>0-TvbJeC6Dl*l(O zGQA6z1W(()OWF<+Tk;vIWPV|j%6Q!###Slgl9mhQCwyEg_pZGQl_qvh>mMxo5TGo{a z!LT7=uNy& zC%JPwe`zKqL`eWpPJ$$_k?k`QUc!^O`X-&1&2VX zl8C(?I{JZgLL+^b4w$Kd-Gq(24yUA5#ooq%J2#fQ4|b8r*qWUVD^rOwKpd7FDECl^ z@t?NuGGi+l;xY_->5XVg+*~Zl4Cb7;6`I*Xi0Ww-b3-JxhuI&Y@7@bY4r?hw-rk#MtMvY3s?lqVcA&JC?vLR|T972hJ z(WCUy)K3XS8JIT}muBCQu~UF2AeaEk%#9=)7$=1=A10X9yxeh?LpF)#&)$0^Rd9CWOjWWF&RM7Xi4f3#VmxweIy_&a)6f3hvYJEQo7=Hx?n2kq(dC7Qz#`m z`g2En(c$9_c!k}&9n zFPb7r_!Jf&&8GHSWJJq%@X;*kzuOeW$R_PQTVs8uyexn+%QN9OgO2@xN$6cpbBemN zclVIJ;3=Xk0DnN6H%~aOv`3He)nn`G{UqJ!+=jMU&9kP~gEo8gK!64e8&Cjce@G=~ z5{EBaR*&AGGRu~gR{*MV$kyE#B%vSKGM7?7gJ_sgrr~pZQW1r8Y}32JRD3}h4h(~G zQq&Zg9Gk$w*_m&kptymWZeBux1Nd;BmH_P~fO-iqC4G$VVsHuh|K!Oo|Cw->$^~Iw z*Lhjc_(B(h9P)o`Rj|(G|E;bbe?0#;Fi!#UpGE>f&}b5Zof*%*GKkm6HHB$ceB~1> zWs{iIU?%5~nfTQT<}!o$ofboWAt27vCA1s~`>+RVrdZb?jr}lV;4P>v_lF*!(2{=5 zC^N6fbj}J)w|g=V&GEWjSJ4n!InYF`zIrm=jB8}R$YpF$*U=Xbi^gt&e>RzRtjf_I z4FSxnAyU@Wf)JXmL#k&f9f5s$wh9qXmz>ruhN+PeNm;(aDr;W2Rh|!o~y4)1ab>c6p zaLdUmX6BGA;%X;|jhtXR9BiBoB119mP++@F!dvb$cBa4E6^W3o$-EmX*2GiJwTDvJ z+?&$Pd(!it46~g)W`T7TW}XpqU|DeQ@HryMmm$>K%j4Zwyqgj6e`LN3!a2JXm>Pto zE6}vSyFB-?gUB)GZZ7khPUn}wFweoK5c@CAYa%a%3U>wOu>Z!@RlD*(RtLw`4%&YM z^7O|3n~4aaX;RUxKa;?A8QaesXhzEqpMLI})o1q6KQ^BSN(-|1%=)xBK4HXqZS=X? z@;3Q+EgTaK7&a1`f9Ix}8z82*yQPE?%WOKj+Cd8~s*u5KY*Q2?gXyR-pZtzqJ=#Ib zuNh{-w2`2%bJovozGkoA231K6V-m?Uob(dut?r^Gv3r&>n#GQSnN4F#BLOtUMYfI| z5I9GJfn*7#HwSUk2+qqwb_PbWH>^2eC{GV?FSZlH#B@56e~apdaL3!T!zULAvC_xS z@Pa=J5;8DVX6o}Op9c}zwfX@~UNB|H*#8wrPChGO(R?{YR0i^ayBE$JvssV!dgI8+ zvza2ham+y!Fz>x|;bdy1j}9EO*H^`rBqAKA?@gud_@yCN0BSQ+XS z*)fOsw}6?of7R^Wa#n5dbId3!CB0^heZO^Z(Qhp8pt- zr&s^}N}*sl7?A(W2Z!W=@heo-7k&bBf* zgtEJFoK0kKCni-C1;DJT+TRJG7q9BU*Qj?&7|;ygf9TH0b{H&=lFu z$vB2wZW@N6df}$&SC?oulVtaun!fu*%_-}Dzv#|(%?!v>i2o0#`tQX-&|L9fW8L@v zRtLuh2hV>F$kQwTU#k6-8O3+}Ic}2J`EEZvf5?7~{K7r-lbg?t%)*>}xOP!od~8d- zjQDZ@)9ZLIww1wXufb@qbPFGI^#1{;*3ORga!Afy%B!@KBfSU#4#s)y9A8t;HLrM{ zreZDpxnb^&g@qg4y?so02zk$TZ~aT2ZS>WGt4t{vR%p1&^z^6fMHR9)*W{c z0ftsYdRY*KGuxV%PHYJsa^?+3j-1?GFcnZD0rOk7buHti`8cyUz4zaQmfXNAf65eU za|v?^@r;W~_7OPMX_pa`;Z7ybQcOP#c@j#&H{|E6MN@RM&IaeK?=)Xi?iI8!Pekta zn1zlYD&sZ31rVsaliUHb-j=eN$h^!wrwlCKKBRKzaI)Cb8T%--;Uc@Lm?0KOF}-tI zWof97o-1~;c5U~S>Fh{T2@9Npe++76KRQE-YaZl1qJEJccG20^hG=dHf_3F|*33e; zfaNhYO=Wc6>Eu-@y`-Fxw9{50?;iU>lCa8Z??j1H-QA6;*mFF^lWr`c3zT&3R&z8} zWO>K-ruJUsdD^zSF}Y+MQx1~JKoY8p%~^WLR&M9`j|=es;-dW!|5sO2e^up<|EnFm z|8Za*UvC`1ZHN;3=lCxnvR%gai^0k4_Qjw3=J6#x^pCSQ4Vn45Wl6RCJhB-B?i`JD z!IaLaxU8!oeB}hMiA$g`2Wol-7oDRqrV5uNb^PQmq|82S18JCA3Y6KwZ}>_i*EsxM zK@{aVYo%9!i#&&Bx&|}3f7>(a)%nDMxt+z{QDEsof`X{C&c}jKWw{V@BZ)1VH+mdU z&emZ=!iW_a< zm!xTkk_$b7R8=A2Qs!3qtV@6KD}N?i-wI}+DpH`TimJ&O zdJ7h}x1iNqJ}O@(O^;lA?1>w%A*5e{?3xCkGK;-AN^d7ee@Bd7Yi%f|CW4`sqqHee zW;7Ho#m6PbX-C`G%ivG3)ryS%6z_g@5QQ?-cmoQR`5&{Sx4`G>pA@5GqreEf!FzX+ zIqo43z207`$c@pQUXH9fQyNKSA?{U3!e(J47W#*OhS-Cy; zm@XoAll8WZFJ=X_B{2j3RcR zOPQlc6dH{QO@p%SRP_7ZjvHPUEXhG7hRc6q_LK>0f4EYIGFeW};Wai$G6NX44FfuC zb2&_k5Yn!nC(o13Xv9(aJlVt2A)OP*(acc{aOD{Sy__BZ(){RA`sj4AW?j(C3j!D& z2q3ixnOhS|QE@5-5EQ&DaL5X?NyDCf=ADVaG)(Loc8!<*&&8k=7o)PG!J_n$L;tTD zTkX34e>XU`dfd1{{eK{y641&UNK)yDw#lTUWk&{~geVC}imQCMi;qH`^Ob;(n5Y9i zp{j~z=s=G_Ny0HNAkG`%m?%dpfCeSr5R-J-wBPfx;41+#jFKqnGUA$`(Wu~JMP3;TX(IV$70gaeSf5Du_b|8qF?&G4OQHlR0;QP4H60H*d zYrcp@E73pZpL$ZRv>OWX;jV;=Z6Dn?hSR%M-xw~$clpL}MqKrcIn!4H=J1-RBy`Z+ zG+Fm?s-`T2VZ+CX0^}=6IZavU*K*Q;z-LQB6sxNTd)#1CkOI!yp8WZioa91%%Y&e7=$r z&@tnLrZ%6iv$GRv);}nPus)mJawhkgCMtKL$l2B4qAj57t zA0UAgYeEfa^IvW*5+KgYd=zS&&o{|2osJH$#6Nv{A_RF=)$P{0=o>s8gk%J$N=hn@ zltZMflIHQBN(5laY$WZAG6+ivf8BtZ&XHvbeY z%@8AEm^Ywaf#^Ppkcmg6$cQx2pJ==(C7}UcwZg3(| z^99IwYq)Bz>Nrvd8MzQ41d#*;5k-=eZq$*%ha`yikI5E^NeXbhp4{IVe6G7fj z5171Ig<*uYwM2t?*1KOaG&}6^^ z^a7x76saj<0E=Ge>H(c>eD#!;7C&{g=%(M%KdGV3kN!Q)U)~9_f)e93!2t?-G0>o> zieMro4J)c5n2=PW-?AZkL1uvxR^qB6L)owZvYkYoPEyGT3PDO5e^&Yr6wFYKyvm0} zDNmO2V3uC-SpJU}H|A!zzOzy>I$&oz%;1?rf}XDFo$le%*+&x6;58)e8F6fGFPD)8 zGc1WnMw;i3#0W6M4VWH)sADID4vlgS(FxZ{)-^y017w6VtSRzBCB)e(NT(N^ysB!7 zs)^X8YZb*yj@d#lf9AaaIPHbp4Qjq{GA;BYoVvjqFp`jT=ms=jIN28Z4^C0WhjjWd z?`8{yA+u08wGbcn0I~o$+a@(M0uAa)LJPw}z%7uE1aC0&hO@D)sTasB6i!u<#Bj zX+ycOInGCOn=%9C8|d|ui$?~^rO@k#rCbru3Hi@cf0IP(3M8ZxNk|gFC9yj*eFiA) z;392`V)!ki$Be!*VvzI&{O0NK(#{H?LkLc9Hml7qE5T(nMKQ{)2x{HX5;zYc2RsI# zCM1a*u+Td_2hgO1yP!sB5VXOls2f@e&@&mc_&C%-nE+J{hIs=D^=N?t&Mq`43s7sd zI|8Dte;be&%3VXZm?h)rgB6*-RhQeiab`K`^cr{?RJ|X*nJLCT`KDWbW4-u;^pX(7 zHYv>8u``zJfs-~xdkS;S?2N^Iw^1nU$H9=)unzIzE+`9~9#a6O(%3D)n~X_G9?)6< z%7`(^#uHlh6~e|1t<9FET-damT&ojf#f+*`e-yvyQ(=s{JlzD%6pI0t z4r%eIZ&@+Kuxn$4c)&POsSHU_N%7I`YSXar2^^|Pz zi>+;iFw}t;Qce4!l{aD?DHV1y18mhq+0e~nG1S0NX+bll&5B=uLJ@e$!{pe-pKM5_ z6Wu8Bx_^#V_RdU564G2=PE--@+L8-s2 zg-l)dVoRgAt5&Yf3JGJyJVhorJyy(igjoQP3V#LRAiLX#LVzQ@$Q&VYL4E;4!HTmY zgHGbN=X4c@IUPzcY$%$u7P2Wi^<>ytrZbyE2WzVNsfWd)jNWf^6^k-*(F6%0A%fcj zc7$dm9%LpG+dAZlW~PnF<-S0J9KEVK`txVQ`RX?0^@r zwnr9O-QXn&i{Q~Z18aT|;Hgd9yCk)6SE`iId#6ig<4kIOX6Ma5^5kx4brtwz7c6}g zD7&G3Rp7&N134wY%0e>w0=P>vcgKL}ObZG6c#3)Ceh}U%GYP z8=uTY!jKnbd-un&FPz9gisXEwa}}@-EnA1BfgV#5k^l$@BXQy<#DkVQUy7_I}zmb)CA?ix8mqFX0IOr3-z zL@1aRawsn5=;&MANx*#R+<#(q55slzov5gWEej%=61SW~oj?gKgkghDh-l~}nLcmC z3K~Y2BO43(s}SYOa~RWM3Jqe0sIx}~bPy3W-C%}*AjYSVc$!f_phHzOT9(>_SXstu zxCCTH4w$9cVWcb7T`(1N4i2l*Uc;kOYmS}Bpcf(jJ3m})7hc;3`hV%g(TAO{IqdBI zccF(BEIIOvu$#|$WX$PLqI2kFd1bod7=V!1>O2ZcDb_ zqZ=!jqlY9IF>1#|#FTDx*<_Yd4zwdmN zsFkKkMc_P;ZGRFeuseI{BTx+N;)h)^b9qe`pCSwJAthnZ96_`MF!(4I^458t&ce_4_)1DZy9&c1F98u_P!Gpo zoY$F?WT+`S7n4TMwAA|mFj6Y4M-7T{)CYiIPglKp5P!xj&g5Dp=aNJnND4j!w$o4aiZe$F=?f8bk$~+#Dr|0oMKz1>8C2?s3H!AIFbQ-Wu&2ojKw^?jKvj}Zj#uA0|*gy!^MWi z15u7BTAZAeAc@X&c9O^)8i=+VWD@2lhaqh&1b^#&B^Ft-6j$QNWagxo5`_N@vtI(3 z=?Cmg_(}j7I)#Yl6DtACezDD2^nR3_crq^)A>{$H+sv^@KzQ`|=$<&@QV5}8k~B>h6(rak z5P$mvexHvIhoP>|R0Nm{+y-0{#1+B5hchGGj*i+OFU-|M1GeA^(8VP=J8Ku0zyf+0 zKUMVkRNjc?YPXdpzYf_GDL7iP^5$hDXOncuq?b6RgW$CUFo<;_paftHV4zFzP7~9u zMYGN*Fq>>~#=RV)WRp{y!DD7DAUoK2ihs7=1yeJ5RTX6{HXLoy_f}p*(k9gcx?qaN z`FaFnqmQDT2?zo|*?h~2Y?5No0<{FNz?J}DX_csudE?Y{n6glbaES+u081cAHJ6@5 z$BD*)4rN`$IbJa@Vhxkc)F;Z;W@iP^l{f^37>7D)pqrO5Q$|s3a!5cU`}(S)>wh9n zBatHA(lBUI)7{w6IeT_XY)M{8afROp0s-%|j1()q&&derQ3|p`@v54CRWgMwD!(WJ zt=x|GY%E>M#8XhkzXycsYM~r9Z>Gly!r4I!s$`Ft<2agq8_LOgpQ%Zjc`{oY+S}*0 zv^Du`B{OMm{MP$e-IJga-@_Jhet*e=E;iEE%AcMo$}{72g{3s1I{S3NRMsB5n1t>5 zc4%%uTlf7fTZZxHD`B(wW3;+B%E|n>xCuC%@RY%3wRB8w=ZwWfPK6a&S0vb%dsC{a z2KMHZs$ehfPRaA~l$`hF_4yVRJU7h|B#|PD7Dg+lqFehtWVs_5G?2`~nSU}MB%+L$ zpl0ZfX`@ME>3I#DWE8|x^fCmTLEbf06a4-P7d9vO{g~!QyNc$SqTby>smbaKP!q1S z^_f%e`z*eLi&aH40MpEb(z32Z2!;&_S2nM*2-xRR%!55PHGqHu7V3(Oz?V=JcIyCVZj6mRdrPb&7o9n9>4|NJU%lT#|BbFltn!T1^c{qR5W6V5YDuV zh?gcrF3}C%Naz725-?&gKogypR{$d>>LAW9R5UhE6FEwyqXAPD#(zG?8sp_C)JZN| zl2jOdw^Q~~F2g2*p&+rKXsTiz%COVRMj&q_G}M$Jkkqqes5L}~!mS`qq)IOi>#@3` zBLJeILn(sHDqgb=SeYoB+%kjn`NoWyi(?)s;N4JzK%|M4A-xR6jf9iNjPdybpw)~& zr>}K_4l@Zc881Fz=YLd5IzgFv$P1w%lma2eh>=Rwcz87??wN+r%#tkBc=*mXtJB*g ziGhJ4OQ~`WoIVX|Fnb1XGjlg00bUj9phz%TIktPlyo_i{0C5Fl$+mWhBM4!)lTBAf zqV{|NFdJck=s`5QaAz7!$r{c9R)k+vSwc$(FmM4%iHRIIP>KC(YTIKl zV)1%E244hVXN*=f8l5VsF+KzhF^m}stGF>Gu0){>(ad-ADTk}o%qz|0s755#hzM1H z8aVTop zpEZ?uHJc%Zp^PlaMnz4L+i{N#D{ATlw0c#W+~V`maso)m0=?U{LFL0SXtq!R%$$bR zToouo1%LeXlfV1~AEK8ypTeY4lqlU(nyh_VKWS}s+-#aPalVvqShOHn8-4Rkq^nb_OiO)L?A>Rtbd;d8)kz^2mV zd?{;S*AA2M@Wb%KRw{H-%EG{-bKC#+`3{qs@tmnbroOhljQglBx3i9SoEHl>_a zMx;#UgQZxia>Wv!ECidWa*Huu6q!tLiiYgSu!QGqDp;jO%8X*#s8TSVr%a3TTCkKG z&ScIELRd02W44cfe6IU!!SzDu{uX1I)JFH27Di)ZRazYE-@~nivXithrqFx4yK`w4 z)pVGs=#bd$M1E{wEa72=-XDm|1Yc%tC5*BeRUDYf+Xm6(9{Y8~2&a zldMW*K4&2x>a#@UGdZtHl&~s|?dOOJN*oU!u>GnmMQ#|s<`Tp?_r)4y_wdQNm|LN5 z)yF@7&#ElD5J~9;F{4U87yB94c6eL1r#}J^0zZtPbWTu7FW0mUyNsK=hD^h2V8@zq zkYIUP@(ze0z7E<&_-v+1c4nEhHg>jtR9UqY+j^%B3WcMBYi%Vxl%W4tDdzv1`Dfd1 zMKycx9=^Arwh)FD)T8;?W4+!MV-Fs%!{K~?h`%)_VGkc$5r4UI4Sx_Te0{=~0zPn{ z!~GA7Wsz|s*fwksCoKbkmjbpD^Z|1kb_UqjcsPI^xY$=4<6*mh zX~JrBMW@4ovdFR@s;MY*VTAT`hHosS=+iyd(n^#(3n2nZlUny=;qOK);ItS)NFfyJ~)Y9v+j6 zE9RB{&5uz8mWpXLcN+uy#z%I4XV`59&-UP8aR(c%o>UD*soN3*B)OJK44>l{5shqU z-guy^q5%8Rz)t;u=josny0E9*wV+R}`Zma9ex)5P8$Kr+-XIlI$@9T@JSe|KJlu@( z`pm_}!q*34#;Xk3-or_D!&mwtle2&xq-GB-lhfv5pNUKhriFpek7g%-%AA!#i`+cy z81|bw2l&j5t0t^H7WRc*oq~N3j%w}3 zNK|2&dQ-w6k;M_(veL$~y(P~pfRU7fqwx?p22fhT6EWOuV20}}t4x!;J1A5-@O)_3 zjsyocC`x(Fjqs$si}1yNa84}0_!N1nXo*t6=~L4`eGN|>TYvC?od|QI$}4u(+@LwW zz~{|l=Olc&wh_-Vb#wT^h%)CHyIctB1rW;M7%z%!HDm`We`r`K{#waWuq2aK$j$5_ z4w7%8@*Jf-y|yoz&r6~8$;BIPk_E{N6N^CDoXtwLWXdc=SueAH)gDvd`Y`U`Gu`^U>YE1AUh?QYCduvYYpB5r_ zTNWPonaZ;jqVGkVM3tpTXlq524+6r1Ukf)X#uGbV7M^Ws8CJvxHQ2;OE^}gqDjy;i zrmRFi{1#waaD{1quMp2yWavjQ+f8IyDzuR~NREKU&d?w4A=T|c$5!j;pbrobgIDny z!P_k@%4?a3Ns_24H?e3IzZ)VOA+9T}0JadY#GGA3UoyQ=RhC*FM6AaPLhxso)Ya$< zDJ5136ftB5b9mrQrxlYUZtfb*$2$jw}Rg>l}nJ8XKK{ z*o`b-qa@g!w9mEXd0P58V${knXG24{t)I%MrTs0Qh)Z=PayD@<+2riVjy@H+Rre4L z?qFGx1Yo}ZTY$QS+A60!iD|<=Sx*t?FDCn}6yy!roE}P*2^3u$J=qt-vdV;J=kQ;@ z_~7rFDZ43uG-@;|6Lf5nPs{;?_8vSNFkZ-4rK*bHp?xeq7?EpW$Ms`Bn($luwPiLU zsY+>9AO%VhHoF$(wAG}7!8Re=L$CGeJQ2exwqaGYxaf@V`d~K!3=8O;de))3VAZ`mGivga6#CtzPNG zWSU(#S=t^bDRYk-fVSEYqCTfAZh~dz+&MVW0yojIms0D(u;8 z6qC6nRI(4|!VD8tilJ6Z{=uFLWGie)N`!VGB_Shfx8L&A0)X~dZ#)`}Mm@L193&!> zdIArBq%JEs;a^ngTo`sNm(t)K%B$s6l$P(pQA+%`6zFEQs&?&hMtiDNrBZd1GcA`@ zW_T`CrLz?tch@Sba>L7&)zzs}-O@HYM9)O!_5jtp_HfP=PxY=vXg3D4)iIieabzj; zi8sN%k$H23Fa{8uwIQoPZL;MvtL@nt5Z4laj&a**2(n>~TJjHX^Sb>T{-Lu!=cUi@ z>?(riI@_;p0k`Z>FR9m08$>l}?ri54M6&TVQUtQ_Fd-N~@R6nD`)n zt-Lo!MaMD`Fh+zbEN3OpQ?+E{(I8pyk|&l_cvdWUUM)o_6N=%m@Ipx_91Dp0Hku_Wcdjc1_p!AzFg49W^7CbDUVcFJg|CnVsx$Ic#tHcPe*>PYwOlWj5t zcWYm67Jd*b-|dxHIRdkt`<{%lTeB2@rj+7Zq{zo$U&eU0Q3!fzU=u9FOKJH6h-6>em%jo>LvOMWd&mBaCJ%}Z&iS~tkf0;^SC+u`N$g?CVSLaome!pCH~$pvgf zvedx-bu1tFe931snQUM}wSetX?SrzV*?FY-A~n}5DVWtpl?fzL*V1p_7Hsu@%1iO? zHxy;Lg$b4ukA2)SW^dzL_c22ZUI@_mn9__+GU117A^jj$oxtpd>jD^j zzZT~Hqy{;;6UF-LPJrp+%>J%_JxJJ-0WUasjV?CLwq?##nc94HV63Ofpc0;)DVPkE+t0VX7STsj54Q!^i0L^S$DL#G$?48_mMq&{0*5?PgIH@!v+-}3gtG##$ptn*HiENKU4ug>UooDh60K~ZC4k*5WU^pOzQR)o*k?-i+RKI1 ztq4zn+Q+ft=?k9mJQ1aTAC8@P)I`Wssq$>Kq49UKrFD=8Rz@F834wceMl_XnCA|Gsm8H;y%2VX}WLIez ze(X%Ri9k~YoS~L~B#H2gNdY4EymAf_z!sfT^z`th3WmIc@yodL4UPsP!hl~3P?%k8sB$=vG%YN-fEc;LrWwz#Jf%f{|erpiG`rGscY)V7Fq;|h!uVjap3xh`4~9z07=q(P>vmc;0g|85u5|<0r)-HIc6=i zmMWjj&`-}U@NecHSY8qw?bNRC4uGEBnmsE)_fTd&I_vq(Q$K=uH7%0L$ZPL`qTLfl zQj{Vwc%s00XvLy4m43;i;#!ub;@LnJ=me%0mS8`~S~hOXOTdEen8AJ62;o6OI%{nM zY_uSYTNfCAPvQwpK7!$D`32_?N+3K z_Ra+hZ;v&?MpAD0S`2hGh5oIUrK>4Yq$*cV+agqdYV=g!A~dTqE5xPZI@Flay=cYh zvmasgmsMtDk$Fk4CO7Q1#oHs)!iYr*Ut|gVrDkl(lPg%oANT$KOT|p)BJD@Pe20YJ~-~cuhkp$x*GL*eUc0*=1H@3WoI_Qqs$VWcTFD6Sd|k7Y#T#`NQAJe26mKJ zS=MKNxoUL=2Pz|Zn^}@JeU>bg@-8zcO8K5eIb>{mUOZx!fBkgPCw->0OW@$V`r)u| zU$XzjP79G=7@k~tIl3c8vU@2aX}WvcgaX+nf@lOD4vIG_6^TaKHP(7?7wWFFpbdJkEve_ygrRXkJhgp|*q@1VDP6<; zg%w4Bj@3<$hIw!gAr_9!0FNn@L~rxCw;_{X$nw=T@MscRubUP(8R1UWqXi0%ghf$* zw`M*Jm!ikOKALci&eu{zTl4A%fA^%t)N zeLskX5C;Kn2Hgh+ZVuna32xGZ;q#3_`#`umUr)*Fw*NWJk0!`s(?hr6*)40vOo9P)M#h3gZ8-a-Y6bp*b#yF=f+ zlfN_k%{%LS@IWoh+fANXsj^Izknr!I?><0m2GmPnB8bs{^qb5*xI}D_ zU!t*ul%8`1A=z)Cy(Od5{6J*FM0^*`snMs+z_hN(D#HdtNVx)nJM+I`13zmH=ogwT z-=mHgNr)BB6l4C=JvQ3vAcI1sZ+OnVqH_|NN*8%ml>&6n`wq|eJ zFI-IgYm08(X>hB?gdN@?y+36IZ1o0w-UP7dCHMc75ZeO*wBU_x3k%_ zLh)@{Y5O1u23Aw}E(IrOK4%cP=xomb%QhIY7b~aH?$I}2gWH-tXJhZahLbYvxXa7U zEEan~s~Gc4&P1|GGVxleE6t9>Kb@B~aM(t|7n_QiDuJATFo;hZUYe>HvcvAoO7A9# zI&E1|5Hs*Fqg}-Lu*oJ9B#m~b1BOl4Fooa~h)IgOKr2YIqn5m*;|~@|Ipo_r9x}xbdz1T;Nh;FZ=MwEk8a3 zt4^Jk9@=PsLeFXo*qUBtE=>^qiHjv0MzFi+A_lT%u_)ld^+A8$ryB=hO$UWak8gAR z$D!!=lrHUzUrTYbOD7zjoRkf{i@odya=;oxCSh7i1wp3XL>}Pw1`1q(5YYP0chG#% zGI4wUIg|4xFTyDa(@!I|<0Ssvo1^bII-qsHGO@3JHMqd0KFqIwv@|erCK+0DOfK(^ zPy|pfRmnuHc4N{7Rogn8oFAUQo4mbz?OkdV!0to-98;nGZ)0Bc$^ILL&bBwaz%%(S z92?*7jb>v^b8)Gr{Ua?;5aIc>`-~%tl4zQcu2SHxXh|jTrNtX z7b;8HOMJkLe{z4I5F@H}4fLX-#PmCVfPy|5sz<=xo5@fp{5Mu?k3B_)Q#j%7VKdkX zpEl9lV`F&UoD=+h^KH}6%l@_YO&Kw+=EjNN-rf9uTj##e@7z511-QZXxi82KH_&~- zZn%Xyz=BK{>HfdcCK`X*CWBUE7uBTxPWo=P01#@(t1#NPDb_;oT>AVyz z3!x#VS%ZMPcxVX4HbZt)C(phoS15e~-c|Sp>f?x%LY?;5d#z^Xy_G@VFL;^0zo+I* znugVxU3T^^*ILeVIBRm1x>Oi{_}k$FHhG>K>7Rt!bu{YRECNQ}F+*Vw|DT(t*6{b3 z#j<6Mu+W>t@@wF4|Jy>;K5Ssw=`(JBhfel8#sPk(FSeu&Pd5Sj9r_!8O>-CiG~;2E z7otCIKYA1n#w}HMn1`bTpBEBkH8fcPP^-7XZ%+D=X}L}GcWhO5qKvx{q0Q0zw=uIm zDE{kK&L^n2iV5I*mF6KVgO6zOxgwo5EDQF6LW(i7bgi2~-+KlF6DDv5j9s>q81e?! z{Td97%0x+4-^<|lFM;5HnkBZ%k%8r`JNGCD_^csIqY9O&`Rbyu67#;wwJ9w`4Z$Jq zEz|HCQjpyHb-tZXC2dv&`@cI~iy^;;iE=JF>gs^>3i z+EJIe<0H3yp_BtW{%UWPlqfDnZqII!cX9{&swlT-4wvjsjXI-ph=dOsi zU_#2d4myE9@6$tP@LLW3-!;T1n4rLcWGUjF$uKpbhBL~-LSeH7Z=I{C3#3a|QO=1- zg&+SZ?%f)*e`#-jXE&OW$1^Bi@%etw?*3xm=cjkL#sk{u^jC;@>FnXxjC!d%{4K&Z z;+-2yQE!7Y>MoT!U?u;S`r_?sb%VdPRO{wU-KkptyHD4x>UA(1|KjR(y$tJA>^sKN zp<;jL(%z+J--@zTsGAtyp=#fP?ysY6-#P%&s=LQzr^K#|vWlMEUN`6&lD>f~m z&^`vBKdd9u9uC(~&6fzJ>w@-A2&a3xCe-cK7Yn9;d-SxkheuDJ-4aaKX)OxVrdrmb zjvK#1YY~}qVq1~B#R{|uAB!cNdr$rigN3QeLA!@gy9kSJ);6Yw)!Z43+$B{GfIE_$ z(GBw&jWRq7Y9J$o`f9zPy0jj$H-hK%v=sjEdCc$@VW9lS?sM!1;cav69y7cm00jn% z>X=P`JtOHiAdh{k0@en4u^{Qv1@>Cx3EUoNdwEXdIGth8H=57B?tJ={A5}0vjU_{< zmr>R200&<^pTi9{7T@omv&Uh{GH2lPRpww|GcL36Mozf~di3QLY?H zlu#et7QUh8-aY3`-N)Z)wo!| zb?3d!`%%!mRkEE+y=yzrJt~#a?qbLwIk}Ng<%)h`S(v6q;wCx%su`&fUpwLoU3!Mn z;lmHgf^O7dR7da9l|u}QUTR-Ul4@e&^kVfd>S99oW-b-5E{OAt$|TzT=1T4PX7mex z>OYOjh4;c8DuJH4a-jFa-Q~Qh(gfLH_vpM))X?9smo=&z(w^bTqRBFc>{#S;v+&g_ ze2F!#V{XvIx>B~L|N*d;E;Y9$iJ*+Qu+x>?D?2$^O)iWc;t6_ZPm zn-e;#5o5S6D1LG7jw`8s`Q4BsyU~U$dF|A6c3K~{i7x@`Z~SZuTVdB-&|I*8)ut$% zw~zeWu?WPNb%>ltNA4}SS3We&2b+R0jC*Q3 zZ{G;ZaI{ZrY|G+jrCJKJ5S7If&b5;5x^{3i2mTsMt7XM)yKmTRfLK=*s}1U(R0|8G z*8kp6EK{ONq4aKz^FS4% zgERB{6$THd$z7oLYJ^Y`NZ&Y z4%eX3^&MDyiKDp=yvT5uYaa6b5H;7!=2TY-Kma1D&+&IO8ESuzGcXAB6}VzQK;r1L z`PDWcVdm?01a1b8vNuoMIZk|h9*p))_+*1I%X}_$bgk-tZ#n1|{y|Yx%wn(E#(9Oc z=Db1J$YWU)bcXuTt|cyQ znqeQAD2>eL?*P>9PM=aRN#chaoO4Hs_3a7~dTZ1Dnk(g*b*Jofxe%7smV$xjnflat z*>Il~Na{T01-Ye-vI1|3MIXIB`G#K!rXdef1%dy6==*UuIFsYL#NcXe=B3bo&HT+C z{zM%xn4mp05ge$SJaEH`4@F5yC-17_7i#>x_scJSGqYZzmP?f*r3~F=-#s>DA3qLg zwR<1g^XF_7K%Uvt`BCWdr9(A%Vh{3bQ9|5{C`(la?|4&<@lC4bl9#K!=;jP3;{5Up zv$+3%-aq*GvBy4sgxhr^D5=m%DGRLNc^^np1F&`T`v&~lujPEvn&s~!1ZdLH5B|>X z@ORUd5&E;%;43yBjpA;0Z|QZ(KYV_tG5qh@xBt3S0CiHpGOiR`R>^|G5WW~?AawTu zo_F~6zrgflbZ|2=_Pvgfeh{lecZ+e8l3ehA%{Eyo>~|u4cO_Q(9YhO!&U*go>GFSe z*!S(tJl6jr%edg0(U_SX^Osq^5Ng*7LRZcPm~m~`Q?`_OWkf7K*B8ropNh>$vo3SV z=hVS#$gb$L4m|MDwSGuJuFcM^fErHRx7zy`j^j5*-Fmm&Z5PI^>wBF$u;t5!yNytP zTEBfTw^^_(L}$imT$~t%4zzC#ysgVS?hkaz@zC#(_8o$?`>1h`;F^2(y7kOJyNx_L z7jWA>J3_ZX%bnw1hdC7X`CIb67NVS~a!HrwlRQiTBTJRa*^2#Oi7>cSY#Ym}Gi_xt z>C#iKl}y^#MKW85-Fjl-j^my*CR<5&huGvWogtSVi4`2Wx%x6^=m8 z*ziX%8xB*+=eg2GCT~<)3zr{1Ze4mnR%M(DxXFS5$(+><;ff5%bEHy?Sg;mb;2oq` zv(*H59eJ4QT9h}XG)Cl*K(n_M3X_1Xn;p{YO_8C^b6AQz6=jcYr!q0D2TyzJhUR+i z*|S1?Fg^DB9rkyY%RIGzv-iY~*;Re`g55&hiQD?zdPVp0XHpw0KS9#ibVUNT%;zvA z_O!P8##|WuVo(>Q1$re9!?3Ph{P80jWQ-TZFh1&?N#J?28K5(%gWj!*9tLHmVp`23 z)I!XlH1K9v8Ogr0o0XluWS6fG+1csA_iQj=Q?3_VTSqxlB}qbm6jbQSlz3T(ir6u< zg7}-V(5d0bXA4fzT~!$G%BAmj;{&6BQs4rU^o|s$c%^%pZ6kW)SF3>rM)gD6A>WsB9W(_rv-T5 zk&R$mT!Ohi7m4wImi_RuG`PR4ogU#+IKXWY<+CxFTb&y8XjnCSZtt-p!LnH>KYjwyDAKA=2Q_ zb{F|t-kha!2DcrV`pWvFvs6{IlH>_(PQF=bj6VY1Fqcbe+4fTflz=(1|HW|WKb$)tT14y z=9gdC?=d@n%|2+%ECx3JoypwbrzPA|{CnAFzrVH(s@%xT0r>dwE_C80`4bq8*~gFn z^W44|xXcP!3;<0DeLC*ZYlOFk0oFf(do{|=ki|g4ns%+VzmIUb3i-v*QyMVZ0g=oa zt_8L*_s!AC%hNs39q+DqMOKKQw>(8*%RcDfcquo3d}>9owT!MllR{QUhm$7aM0+^9 zI6VLHX#eot(b@CgZ+{X~+LR-)!Jz(*JOD^R+g2?3z=p^nBf1#Md|q0yV6=lYM^x&l z;N!>M&X#w)Va{H{1`GE4dSGl&gnTAsDDL7g7{*}zDar<%{r>#$;OOGr+2rElr_=KT zk3@Wb`kE{}vh0{MNHr9tVY_Bo>?WBNnuqXUFt`${=&}8KFi3d){r&{L_1#5u;*L=- z3Rr#*tlo>vyeowevzQ=o7ZT-wl1p`4WiOjrBQrTtU?Nr=vmJ_|tHp#;_uP z?!wC!V+Y@kF;hi$B+g#lOLF z-J7`ut42rQqaoX;bAtj<8ab)QM|*UCV|E}SY>N8r3-Yfc7!c)r>9yX%GENuL>Pjc! zw;1COAp0msfPo0h(OCM}`XuVuaza9VAG4PUu(WR^HAE6bWI&6F=$dCTmRa_>0{jErCc?m6pG?{lm`q$73qdRUgKjO@}hC$w}hd1MQ< z+dLCPu`JB0*D-)#bWLawJ*9^(@7fJZJ7BeWl{y8ybdPO=rL-IEo!HdXB+P(Y{j*&b z|M~fXKkNK|?-n8}M5%|S$Ue7!kK6r!kH+KCvxfig+2dzV|KtDrEq;FaW%ny~Eth*x z%V{Pv0YcmT0!6n5!Cs$7w9 z(B(GTaY0~N&mZY)##e;jhNJXCM7#|<$#-Y{$UDT|c<8*agD<6(yLlm9B!MMjlJ+q? zaM&JtLmTjogF(-j7RzgYQSPf{!Arq<-#;G@pA1HQ_T6~+&0y4H!+l=xsm!F2LJxna zrh=dhUrFPzaqx;#=7#me2P1MI+1=~$R2V+4yYv?L;QRWzg5lL4z`uMQw&>OlZk?uA zrK$?dJA<3Ws#2QO*}91;THiPjcTLs!$*0Z{uG;PMQqSXkW}~cs1ZWaq5~RRSESAub zk9Nm?!Ot!;Dx@DxN2scVDslLXS4O?^w*W^<3^ZvdGOZ6ni>CW1Fr33!??orNb)x{B z+%5CzT@z#6lwf#HBRIze_9TjDLMP&uLEkalaKc02p$`kFWyX5{WqFb*vgpH5gK0Xy z>V|`)G(EQ6WP&Y!1%JId)Xlf)rbqA_h!VxBjt$tF+kH{S#J0UowQmyWknMDiF^b3l z7`qlDy=!N!2a_Lm*_tb-Dze^wy+|+~OcJjPcwyaYOHeX*MwMP`nP0k=f8Pwn&ztuv zvAWmXgPGvBo&GD)#SL$t{vT*qpSA=)h}Cbl3j33LZh*;uZ@mQ){z*GvfASeCus`|D z7U1ADChF*om*C(vRGih(B7`GI7x;l6Lv(!KHIj`Wtsmxo?U4=ZTew;lJi*uvtZ8wl z#E-2e*eE{IfQR1>NcXMGolJxapP;xR}k9Qe3;rh*3!1J?16~I9?+%t`URc z$D!$Y^NH+g)j6k#du1H!b0Df^Av3{vmid%eCUc{pB5FQ|Is#hrxxia3 z5>C~B>+j@gO?RVL_6VM~svg*aI^XaDO8C^z)(LWPKUBxoSH0H}cmE== zcoiRBkAa!(VBjDSdE#c!}82JW9+Lom?vefQ01J1sP;kIL0FOM(q?Hj4J zhll%e(qXK11}z`u>YRC(#}~|$d^VHG8Z(3sa2mSAM@@QAhfx-ms zM$!tIr%GJZg&pi*?wwcRm+Qk8|JhM2|M~gUpLOwHSQci+{!{0W*5{nk<#o^r$Ywiw;E-w_nk84yjz>aC~} z>bfk1t)S>whm{214YlEU%FERD(5gSsR#R=@0SqI8JE|c>8E$J( z3+vQj35BQ@+vlSic5ny20k&>`xsfx_G7c?2*kgYmV3i#TABgJgf(Q|o(PiubeSM<9 z(8&#xQH28TN?SC+^r-_Xc|~9#(Zq@+(qKk9^a$=QuGvhM+W4D3_96s^lx0g9_CBcz zjmWnDtq@g}vnq!oMIZrTnIWd--#|RVnsj|8p;CyyK%~Bsi$F=^432Pr2`>ZfOU>B$ ziamYxf<1Wy5{Opzg;~T1kFVJC@7Z`X8Zjuq>K{+>`J*TC^QHT|)ne&eeAR9?51O@F z&f}J?=JXxR6xdo5D;LUKi(E@1uZ11k_|*$Gel=y|`3v}lXPLj6Z%C7V=MOtN**|`J zaCou7w-4M(9?|AeITR0nU#e1IVM(GlpdQT@q7*~sFH^0wm{l2FG(wQ5^nhbObw&t~ z^juL{!Ym`IMJm&5TA5lz2}?5+bo*X#7449D^byMhsujW$0)#_>w|zU& zm8KdVH&Tmi)!KkE5llh-Io2acJ$9q=hXy@hu9VDl<@51+`==*=FOOca^TVIck1h|X ziZ%Mkc)EnWOhdj9xskcZhLmQ5Pw7_GN()_AMJ-B|2(A5$WL9$LnySC68D2FVFoaZ= zBC+%YqVL0$O@)CvsFiVZ;%JtmPBIm9iT9a+e^{dTyRIGSO6OqmArM2dfJ|;~SXt#p zE*l)|Xa)shEyn_X@f%9@8&P6eHR;S?4jtQ-?WB}xgT1-cgO$*ZiO`7XDh9{)c`$2s zmSU9LSDu+=D&ZM2vo&7;&4ldk?w$AM^x*CBW*e{GdT`(6Ql(IeoEukj2CnXQ?s~k? z)M`pDODYRm)hrY*B%G?!4B1hOfR(Y^$L$@PZYk}R_-=Mg?G zw>ORe{No@0U_VXHPmWGr!S6)aRQs{?_bK5*NKJ#tR&)cYyI9fhR0HJ-`p_>{Aopt% z%$EgZ`BbSYtWgQOgDy1C< zz}utYHf&XTo?jCJBvi`Ws9=GQ&aR)ZOsN7cdGaH3tH-wS3S_vQ8sRl^DIKFv5>c3l zp6fagn2Q-+YUQqj<;!4=q;b>bKiz3?{g>?L)3 z7jQJESte$NsRAeUq`C$ zMLzeJvpO2IJH`(C=;pV)J)2LwYN7$M?Zjho68R@RZH&fbz@p3SM{Zqt<$D| zW7fUl_h(hPPq!Vz3f;w#{}QDVU#5L_2Z8{No_4z6amY%8aek5^`4 z#Y?>OI-d4E%T*awk;nC|d8T6+r3h&OSX3G$+jp`#!6_nhbCPN2$_t(yQWa3 z>HC?L8m>lX+eed=348E|@zcjop6m>NYXK9=8I7WoJmi6vsy%0AoL%mp(P|Q|wmDqB z?uc;zj2dk3z@>Vbnm71c&K7dM@a1v`sEQ=YZq58!mMX_vGkpm$PAv$WXAHG=gX}?P z>ZV29kX)v9CG;>b2|z_FnO7g!6;xd(P%vgKGrB&ota5NwNaI3Vy}qz(HHuw-z0$k6 zFmM6Xu2xI_!FJ2MNVg2{%qh9lf=w0K5j?269n>R93b+DAukv>^V1K~Y{BTZ=kW^@J znuysCEXWmfEU+00Hkd_H;UIS_D4Or%>nttt|FQ>w`j+OZLrZ7S5aCmq&IX?RF5NtalPXWMW{|97TMBOrHe5ysBc+GqU8g!L^6UQ1hjSH}- zH(&tM^^GU>X?7qi(_yLAHVYw29UMTHmW-S8V~0~;>J8;MEf&{O+}M9fxUUa5@z+Wg zAm@>RYAMsSX|y}daa;BqTn#tNw#?ns@7SS1$D))f^&|;1W@l^IG6TZ&b*wb(BUORY zffBV{!`kRJtZ~C*1X)IZ)IHuE=h-oS5vvsOKqs^i++PDs+s=v{g*$T|k4A35eYz}^ zhMkL>ND^`kAGBV(1HoR2?;Z~y4aYTa@Wg1rZ>UkS%j1jPi;Lq=S126-P)jtO?w8)l zC=D)o&t!UFPnBM$38U6M!&~T}*ey6?FOM$<$VcoPV6nQOm&@aS3tA!v&q*L~YF1jr z`vOl#cg_%I(RsJ;qyom-|2=#<`Zn@$L$OP|$iPK@+iecFzXbwDBny%VS4$}(b=$tr z@P!Hj`rTT4dRh=WP4n^$yI3_<$y`y%tL8Vt_d$Vb|%RtLObFu3%g5 zuxXWBUad-^7geGlUQfAj^hod=U&ZRAIH9E1GS8$C%0dO1B3UeiG;d;h=o+E+6JLt;h<_S&?y>gCJ3lBjAfpQaQe;ud1)0 z#H&$>%KDyCJI2%Ax{fggh#uBTkh_D%c6N^L;woS>=G9tqc=*TKSQ#EC2x$a*dWNh$bbd#rV~!u|dfOs(vR zOeHt`gZD*fQ_6ha_K@zm8tfrM<3*84LDns!*muv}&^tI1qR0*oUryd0U+(>1Zw?QR z-o9CXKT4VhH?~Szj;`QXw(`Q?uDJfYf1ssbL_<9>5dwpnkn1I6KiSV8t5$&VrloD z<)IH(LO&$GDB1#~X$$s&9(hwrD|WF$rYM8Rob6t7xB`GwLi-AoN$g1e%}GT5@8H-t z!mcfH*b68;RRLnQ6)^DZ_TCS4nHo{@#NZLJQk7#bx++9@Euln(DTNr)-CRx?gR3Wh z@e`3+Wf^`3_P4O9gJ19ZsGUP@z_gs_Jo68xD^^tC>h;!Bqu9mKtBcFiGqAjMfujM| z;M{}hiaB@Y`QhZ?=jUU~Dt>=*dU^En=XV#U`#&6Bb^+v-Q8=y?RnGQovZXK!m9i;*V zuoq!7mD_z9?wY?22i_#PKh z{bMP&)fsr4>TW>KrheQ3pi%RyEw(0{65=uB)9ST3KrbFGWOyU54hJ+9+AuMj!KDjw zRy)>04>E-Xd&f?$%mO@DJY@^W=h6|UMjIngJS;?&v)mqLnTww&WC{p$q_lg();p_% z+JS6!81bm1Yf(;>mS)8=aV;``$2Y+)MA|dBGo5FHE{xgcEK_99_NQz=G$W-JoB~_U zt`QLSyF(xVQ$Vc0uus9ZmsXZ4c_~oOf$)}mruq<{0@DX6f-I9{TEfl&)17)IWny8e z6as^@m4n}BH?C+o*!m@SZqf=3Iz_3be44Es97<7S+pwXpMY*zCm@18Jy2}#Ff5j4> zF`x6s;UxIHH0!f65}`D-b^*qM#PLuI;X&GJ(-4@><;pIKEmI4UAR5@_J(M zWH@3|vEbKIl`sGbS+g_4xHAyPvmB`0JH579)9^-C9{1E)Wf*$~|jir2c zaWXl(czt?#d35sX?$4vyxZu|~eu5J- z04Ha)8*Oeyt6=ju*NnTu4&HlE^>?T#`1_zW<8y9xFpqKqX^jnQDJ00?)lLxN!=@rr zHx&N|D_Ygpby$wYy@kXs1o)J`MWa639>ZPjJCGLS?1y8pi{eD2jfRh1!>)ECyb8X% zTDIb-eE#LAaFXtUf^kp;v0}jZEOP-%oiny4r3Rz?V*7vLIP^N zpG0&KZA`lEc!WRfvX1LNA47Oo{r9sGPWf8CNOGYnC~yOue>f!6&)E6F3#M~k=!K%d z=P+yQ0ox8O(AXo)&W_&*kYZy%_n4Qe%5g3sC%^V_T`n9ZOXu^ev?v+Bv0ZLUdzLIL zkG+ zc!?mERkbphQKgR(7E$zeAREz4iafyxWVl+--|R@65u=O+H&qF7?+t5+Gj5?C3VRIV zExD%T0H;0Gl}oJXoQWk}M_`xE32Z^J-hPxrKw7I&f5iZ2XQ1-IbZ&`j07c_NL-4*@ z77%ksn-Gg-I#J~K|9MHKnQB?EVVO>Ak>dXlgqNUz;Ks4zeW)=jRFScWTb=fyWiLym zjXPR7yYUO=j5=;MVH;Q?WBX@s9RqNDZXvT2I=~o^hq-!a~Eq}b%2XoT0!TKLpM<=9_d%IKqH0)Q7@bW7_8dmBFHvJvy9!nmbg*M zK&g4^zp<|@*>8ER5RSxpaG*L)SCP*MWK$Oh>1w?M{DWZmkh-VMTHY*33LvlvXn)J4ao&Hx*XGNxeKiIg2C6>Zv6|1(YS+Ih>3ujFuKAqE?`h7J>MK-XjG(f_swR^j}+!5~m{Oyp~gBM;Pe|PCd zGN;=gy(?LjtA3o~2m8^R6y3T_?RKmKI3Lz~_u;w(f;L7IEb??}70Z`0BZ&v(;ksOO zH@v9Y8w^u9$B)6jnSTGoBDvx56_N|_MzI--Cw(PdjkYC zpfWKbjiJ+r9@tY$p%}^=;ogv~e^soQn)&^NEGHDEhHL_vZeWcC^HG(jq68}e>}K*D zMzH|xs0+rv9<+YGMx%f8&DXxo-|+(+D*pa=HW&=P$2V^5_Hoc=yA+84wFLyJ9S7#` zjBSe#JTWlrouJLVaif;wo%XolTzC9XRT^!z?p#iSh#O)7J~4vizfQ$Pe;O!i#?gW| z6+nk|WD_cAq`TDMcuTK$tRo0Zj7ETZgfq(5Hw+iN1V&$q2CMhmz3!F9MfRj-T!x*W z%*vDyzQszB0n5!+OfRj{%9l_E))OTKgJKMOD8AQI+3d!J?LyY?wid2H)`wtfv=99b z(hPUJrYrJ5zNENBkhJp-f6M9P9Y>0u0G!eT4BmTZ!S@Q9Aeh0ft+sFX>ja}@YwTQ3 z7fd?Aw>Ukg>5@3&(8(5bRqaYo_Pr>$QI0sq30W?G6*Us^$x)@7TSFvxu8?vVW}cIvD($ zG#P^T%nEdKIQPn(zPDI7DHZ7syGeM#DN@&ETG>y}E`C1Q_xdho67xLW^}?vT$C+Y! zNooyF99kfEh-ftO7=ZQwuE{VK_MIn@ zVHE!24|dBl!OlLRyLQMg=|) zD_6Fn-K9TJFal_o?hj?#4+IY;lde|l!9F;{pWX=rjJ3YJk za8!=3)~nPDf3r%jB$^}KZmfZUbwR-$@O{_y>B~NlTc4dBoxJL^i`Q>24^DqN>4V(4 ze|qw=&(2Se5Bm&j2J~xi7jIu&?4KXKIP9~xC&3?Q;qURAw=a&5E?&bg7jIt#u=Y>i zyqTOF^x4_z#buwpKE1fygROl$xja1C|2drKwG$jze+7Q-kf_{bhe@=QZc3sQ)^HxO zpD5;rcCHhE+Yl_(ptE^aWnj3l8Z#QYM6nP{QSuClY{9r!BBShK>TpvtFJ~;Jz9mjNEC%st z_$*8}e~x6uQt))3@{Y0zqT2;<8{S3~5Gv6v;>PXv9~97#+LUN4Xlz4!_}D{; zb`v`|eDU^G!`RC%72_!P}&8q1pvi-wTEUTRd%Mxors%&4nQakl4t!J zP{kdY1o!Zg`Q48tlJ8Z> zfA=;wI4nw@>!sb;X`Q;|wYfHix^2855NM&ci;iBH4bR;Jsjnb8QKWkSj!G^e3TXO( zfCF*kX9g{^$OXY;LUz-3Kp+g0EP_LJ%ne#FSlRhR?Jl>?wY!KFuGctvk8K^ z{GH^k<;-$`1qqW@%^cQ4Y1u0&pxU!w3czqQfO-~eu5fRcCGJ0W(gg$JLDHRve-gSA zo%rfTq;kRVE{1m23&_abc%zlSA1QMj%3am^0;I<@>uA_ zL{~JW!2(EYuoEM^YUZKPx);2(3@NLlsUup0%xpVanaf8RRK{u=hS&K}!nQju|2VJ!^hgk=dG4Z7erL(`36S>eoSw8bqA+G>zi{k9=4u&SFh4JE^`Or+E|YJC{i= zJ{Z8>b=OCqb0cxl(JIVY?1d2~<{d;;?L&sz>Ns-PXTn+<3ZxsU*;Drte*_eAr8wQu zFstuED5?)nL|^5o6)x1ZvBCAThSUa#>QhH=ZF}rz{5TrMnm>Cm`JR@+r)7!wLm^6u zr;)3KCdrtA0SEzQIir=c>&fL(q!MFmQ9s})G0-Urq-4eRT0gM*yk==t)=?faE;Drv zsY`7Xzjg;9mFBYDE_j~8e+?-|yQd%eR2Xz_Dx!EY&$IVLqjyIr1V~%QWp}h(;k7WHPnG z)Wd|jGh@^GE+AonDLzW z3b1`rG$=YI2ownTu9pOsz*?+OrQ_MaLlDaRKyZuurbg3S_V&Srl!HbsT)j=efoIo( zO)D$OYF{jcjGlda*6EgL(pmslx58q&6fjf{^{y6m1e;N8mQ{M;av}_-mYFJB`sa%(yQ3b z3prprZ5P}Ipj>FowljdT$^H*9K*xSfEHOG)Iu;}HWW<&-%cK)` z1518be+J80<+zuvZ?UsBrY2XtT35n6u{+TVJt$BRIIR+qf-?XVg?g@{(o;?6U4+() zsJf(O6j1gU6QXV)3_4F%7~CLpOb3JVVvhFg41w#~n{NZxR9Ezql@USKS*SuYe#2LN zW~wsxQpQ)Jv z_aMqJ=rfRYlz~;pp@y|H1x4{2sI{wVzMxdIf@?2~Szbr=SdjEude2fq6-X2X!m+hg ze^83wT{GEz3JuNOH;$D>{>W(%w_Z;ph_=9Nr}qk2>A`Wh&tqRG9>v)#nD( zo}4u!2NEQ(1BgNyFMTvB1$($Xu;5V9jV7TUpC_OOy_gzfXUm~YJu3xNgX%isy&(n< zdT;ddntMp=HNq{o5$*>+{v3iN z?6(mlu&3Zr)hA1iS%?)m>}m_>Qc)6|JN1ERNKNulsAOHd==JF2<*DQ0ltPPgkqe`a>&VBJJUrHT7_>u+;_OOz;b|N+ zRtFZBGZUN_7?ffu330;EWhcPf=iUz-<#(8c zrN+RtYZi4^<58cDN25M_^wiHuf4EZ%nOwmjF-xb})R1cmIpa+$yvRij)zLG)Ig$@A zuOexl@i@~yxE9h;kit+P7et~}SYa>*@E&eSjOkrM3qeZf3@Nniu!N5 z6*9Z~PC`!R-Q6;`3VkMX(X;&3bXad~SE0F^4)V(r{mI&ee!80z-!R76fj}D z!vTG*P2&?GS<@fnHf1YJZAV1|QR%R%(;?&Sp|9Rf&L=0AhldF5r0E60kPO=`EJ;5I zZlL_1rKI;VPZcO_5Fk*Me@+C|-kIslnL+qm!>a}%t*#_~->2OBxof4p#zTB**P0Sl zK@lL#bWx# zC;fv(o&;cuY{KNWwR^7{nL3(j#I{|2oHLs21PWOvwsq_A$j7uze`0s8J&1xE2q?G$ z%gICfo+^#ANpWL%vhb>J;6-kD%ZKrTEd=Y?6D*WJdoKLf9cwf4E5V@`l&)diIc#8>{EZIvxl9TAI6uy~cYb<& z*z>`ga3xEZT^Se*e`XFHouOZr=G|xUm%>gzp723nl&16-zY?un-y6Pa=J_6-p)=og zLLt)Lo&o943z1xTB}CXG4!`zLh!V)w;G~a6NU+nBnhuHvMrTls=92UsGM7@}-!|O9 zInwr}GH}G`1;3&yl`@z`r%}}fvxAwW@X$H|pe_X+)qd_2e*i#X1kf{8-tZFR(@S&ueo8q>(843U}j)sfY-8vcT%PGAxNfL}R=68m26DQ~NMC z%9+TcvMn)5)mx?B+%RP-C=J zGfWtUfc2`({fhZ&-)TdSfhw5+e!k36T~FLyutE()!^AvC2hkgs*EaA)8 z!k9wu?NZ4tsdkMjWTJPm$AO*f0Zn$)5^I5#964$oq(LGwHt+k0#yYU@uazhzl@s7v zSIe+Qf9(`kR-}9GzOwcWGU(F^OG`=@w^`4g18H%h!evlH18jgQrJ#F=q>LbG^z@08 z?1Qxo(!Dltp9R%sGQOr`onPtnP0KJT5`f?>1iyyhT!n#0lrPM!B<^ldv>HC#Vuc=m zT4Qp7wy#%!<$&&BtTSN}Qn%5?OSrXU&(I5be_MzR_X*xJyDnilbkQ|SH2Z-Zh|rzb z_QvfJJk`h;2A5MUqYHQh&_qA3z`>D$i))z}9B>C6AP%)R!_`q(u^T}Fpfx#wr4ntS z8JA0%=#Ug;w3+L2L5>~R1I6`DZvb`2q@of>B0|nht-DE*+vQBH+B}QhEV%knWdz7m ze~oHWU{0zdiFO^P>+)PP2`sp)WUW`= z2;S}F2BjK7p~dXTrLqT6SNQr3F{X%yIhrp097mMeRln4$pcTl@?+NTLZ+7OQL8Z;~fklIQ)XX97l|Gv$kLu!y?aFJQrex`S28^HeR-(Z&si z*=V>Zjzla12hA-)RX(rmQ8~?mf5GN)e}dk9<>$~HJ;PW=oa`UN`jfxQ$4E3( zL)^SgA*Yd+$A-fp<4ML!h;$nc*P3HG0ok)$lb54B2U2 zIb+t<3;7vm8K2KxY`Pm;p!&3ig+hVE3y7jYp$#;+eK0fsp4tRw+ z*-j*}Per4PT2}PJ2?W2le^%boGLjx976_e`aw<@>;CapGQbpc?fW#Xlsd85T9Ok6c zAg|o(kmlmFQeBhM&_kTfYKRBEgjEglVdykj2itF%@P|w$)MHe>hVcyQH8iczF zI(5jWIfKTSESPJ#e%k1+4*bq3P*4l+kC1cKXMfbf*#Cl24Sx5WtpPAh73(uszW_Y_ zz|$geVwhmyU|4cA{xLp_#%&toEQyY`(Vb3gyBn#HC%Wlif3!1(hjer9F#dod3A65* zD@vh*tE|GaG76!$f2vtmkJ3C!K`021^ZGxdO!29Qhm_lv_c*+y;NFld>55$9DxcMwB@)6$tmD2TqYC#(>h)602|EJQq+pf7Xe*PmBc7!+V7P z@f9vqP5Nk2y2J|rZNHu1KzW>JYC6znmHBV$8s1n=9Bg*oTd{rDk1LPhZ)_%@I$T|t z0r;tB@E>2fe-G?dH13m^KAsvF4zfm|N%*1#{rkFp0Zu&`v`Fe8>x+YhywbmQnK98Z z7yX0|o$r?`+mbwqY07%|pcnSCj)jGn9I83SP=KE9NF7mkn$%Eg29 zuGH>f>VTMG0B$KV;(aF2j>yx2MMELg$99<3c7Q;-e{4~glgqe^tG3%cuW!HI3pISF z3wQHpH?|vhf(P||onYc6-tb2APH<2C2) zs=kyg6ovgYUCm2Rd$3zVfj9mMOXp@8QkuUa2*Vsphwe-*DQ?FtPA*wKR=%xst>gAm!R2wf6V4XUGb%i?tLS&n#Gb`hJ zi-@rl?1#|Uk1zxW6#Fg2wxRhjz)W~liG z3X8?j&Ral?-2_INKvY(4e}Y=G7l$PIy7ibhTgM^?mJrY}EknR^ zk5^(rfV+(clP zfAqNvIYe}LYGs%fL`N^e2Qf5CMc}9s)G7NxNGtYr0~{PUf8?>a0js7cO+Cv5&~|g9 zA`KQw(Lxxv%OP-1+}kIbrWgl!>qMWZn>NA}&kWEOJY_2Zm8nC`DwrE$a?af4RS2Ao z*2IEyDup0tx*&vjJdTh@c{n7M;t>O7e+(OOF#j)mf4<(vk>v@)^|!7f3RbsB7XcEK zD7jdcduWof*``Q-BxO&v$B!z23;@|oWTZ0_q+nZf1>YsT_w?Sv`@~sd$pruxsqAWD zrd=YC8S9A?XZ;;(^LNWeAkI|oK2f8xTk38ek0)i_7*#DIM}}$BT8K=QC6s74fAXE( zPCdI(15rTbt+LheCx^)+k82#Ce$!~bIM!n{9Tx;m?k!##Rck`3YebEy@_slHd;7;E z)pEnG95T2tpy+Qg(YmblHAwXE$~HHcH#bHgv@w?M9_qB1O;y2ei@+uCyPhaKAW`YK zob(tEDD)25DVUWK=Z6=Emjdq?f9Eb^t0=UC_;Xb8VVER(j1f&L75(imY!z^JS*v#d z8k;~DuCkK#YuIXZObO;aG?e13Qind+lt4eTx~Ig-99@|h{Qy*caEK*{6pxMK(i#@P z)whN+WqWh{PDNZrfua|j^Uxa;5J>5+I*9g$EM9X1u;&bBF4M##Mw~=he<{+$xOo~c zs=B?6V6%xu1}h53nz1tgyOUgVFfi#$KGcc}Uv%KFRE}4tfQ4%9dAMT1aO5z-qEV_G z5|ArC3U!V1d!~V`_=dbEn ze>iwCP|t@u+YM`9s}tj8hhHHE8g~YPE_8g%jg(qZ#awt^@t0MG-01`lVStpUaR41y zkW8WkCqXk57}k-)9rWB*r>_XDDi1)pyev=;c7uWPdaF9ke?JrZ$47@JmlrElXRRg| zPUSlzIMg>kvNu*bF@tmPQA6YxAp=q4X3h{JXtjWTnQNs)hApv|Gu_55z&PtsZ!5M_= z+!fw_$_&9Se;x%X`7uhvM0RvMS#Cku8E|!zazcYpICJ}#Ii@{Jk!YP!K8Fo(g_UAs zK7}lLldzHmWXk%;7e-HmH?|nCQIh^?E^xrux3p4K^E(6$FmkavMl&fMvwmkR>*^@w^4r;0%&3 zhH{>G9G2 zf8Te_4IS_pOo@eP630Mq5PqB*Wi`oi-k!xfrq{s;z(nh8s9X@Uf=G0&6IsTI>L&S2 zbiWdZ5S2?&VOf^zckvXQC&%Y+Hc*`ay25<6)M$4xgi>428u=5$1}XNlrQu#}Fry`d zd3D>tj8+`XtNLIlc&_^ud-tTEuS_GHe*n6u_k}HN@OWw+mu2F;Lw;mujZT%!p@25_ zi^yElIMunhygYVAp6xB${fYpm6fXm)I~$CR3+%?qGdiu+@C*sv+!g37Jcew?b2Ws3 z4)Mmtx0;K@f94gywO5{EbF0zpfy~TXh6x2LVHjjXa)`HktZu;4Lj0sm#yXG7f626H z4B|zyvEWu%eFzSDtcu|JZ(AH|A~zqmP#YG|#Dz&0vlydmFvef!R{W`EpqbBJ$vjta zHC5u>MQHBc1x8t@GJR+MtKI<|Od2}r;&hmcNDXt5XR~4=68JCt`yKxAP9$+!sJs-3 zX)n)oh7T1o3fn3`yr%yl%=1|ae`rzgKlD`;k4E@k{NfiGMdBATkU{7Q`^9_f7q8KY z8OH=CHkra7__m<`G4rXkHC816`tyI%cVOffh0R9utcwobvRV-$lsmm6^vIFEqta=d z##5P?L+25k#i`D6H3ZBi_Y>f+)Ct#nVl7B9GB+msQEX-AGztL-P>7X&MxY>&S3Kt~0N*p&6c~#E5}1<$?KNa=SSyzD z;(_at*df$nRUod9&FC&>Nm=wne@pDSH7ziv8#FoVdoA;s0=5MKXu2p16npm1-t@#% zkfJc7kc~Ca1}e@?k@7^N2hEDEmq&PIS2A0qx^;W!il2n z-lI_$aa7y&xNz0GRay`ZsIQ>eA)DhC7EtVUSZmC}5KU0TdA6hM!0mES#Zvq4u1PP|unxPr-iEScfphF|Jo>eG4zQ;d#8#zzEl*v&C0Y~l_PV=1o!ZQPo0oW8T( z6Bj;|A1pT(6%I%RsnCb~Q*&!KzE;egc=C+dGl}u=%fzT2T|Merjgq2&JQz~TX%G%7 zCM-s;T6c|GG^YGn#^JLu~&GH{W}p<=AtWKQ~WsVEdB znTuj5Q-?&5XnjRlCgBWS(%^<~;jg$PK%ERoCI}mqxt*&s;aC(LTrx%3OzgOTT=RIk z;L1~@kq2@?f6FkO54oNtnc2{(L|VucDaT^glqxk$W~k7l7fjvOdt%F!9eU6*I^Eqx zWV;aCJO2iw)1^#&cwh5s6fqE>H8GOAvQodaw$=fnFwMGyYtgYjTnnOrW;-UCerE%L zml6 zkU_V*f5ZS1N0w~RvSvR>a&>Z#lXy7Svea3@P7a8J1v7tO$MuD9jvnDFoC)4W##k!^ zc1;J}mHT8#M9zC$CDE`luJIHX^|q++B{qoh6QJdzRjOf-9MNQ+^h7cdlQ>L;G$EE| zn#r6!KTygYavIo8vesWW_vz_cqQ`Gf)&s{Ye{5eZQ{GIbX%ftfZKzXo z&ja7`&>9p$N(AvD5dCO&+(QqfY)7Hg_hn+ zLL$WO%?e;9aN#9~`pbTBc)Y=jgjIvvSHrG@q?n|xp`YCFPn(wnY|t@#EF@;FJDCSz zU6G0{GCE?$^2v&n!;+IGpx56v<0E_kihdCOYw~>qfN1OmGV4 z(IWzusu|+M1tloKw%{PJo5IWT$LL!$x&iDHr703Df)^*nw&G%_QkloPUSH}owHo7w zUpbCkzMd4|{vs<%pz{}Ae6>%`AW-L8Pi+b}F|T{Iez*{UW6DDlfB)Kz z6>mDq;g`;)DpQ|%A(E*U2~>SA0*V(x9RBaKqw_;PTI&{mkJ&k>{sFv#cp8kNw#P2a z0`;#_8wCaw8qMRZs6voE#S%kYly!i!^TU(9*M~va3(+A^asncTYmG4d{S#qy2sw1z zoJcWMJ#i6F<3#4kTwJ_4IXXSLf4Dq7KXi@hTwI)CW;U118ILxmm0E^xXIhb2T<$;1VJdZpNEo;h2s5Nn=HIuHvpg z96JuYPpq`X1KMaZN46OvIT9$5zs${T*ERp>T3cDFn|?)IrSUhs8M={5_;*&#;b*)H z913|uVAh6>xq*d41>BOge~WY<>WD-?nb_DfAauHC;d@(DS{CyS6aXVCqHL+a+Te&T z4-Sv5^_KXQhKj%(eG40ay{xd4PC-1D?*%M}u%lU#m#ezu}4rPL> zdyhi%k2X)O4IEdXe{O>yI2Ajn8!b?vWB&;XBe^Pc?gv+Ee|o9TAwV@ExVy4mWR@MD zKGv}r6Rjzyj&Fz?#Ssz+*G2)D9NjwwoHrF1_t7}bNVLyvIJQ~9V#9omertXL%(9uJ zC-??@Qv_xu@r7HpLd;TgjMSTaoG_1Trh}B`@)Q{M1 z#LKWX+QT_b$ zD;T_J>FpOvfBmuUatqJGX>&TJd!W>!j~XKgAv0ST%rZ(ZMIeYR^alzGYU)TIs07=h zI&C^9o@G&~eGdv%TO&8i+V;9A=EaaLAGSJCX_1+nt0AbjNENB9ouiq>D#mW%lS}28 z{lYYyzF=#c-9i=t$6@FU#K6tDD%y6c8|f~Nfy9l^f9!dl5r`d+79WeWDxhALJ;vb; zb9#9w`n%|yYZ<4PP=vlI$Q8qaAfn~_uP zX8I2OmDLDda*F(JUu4l}c)h<0IBJD@!RxP|F7mFVviau3$?Y&IokIbr(u4Aod;DH+pIT ze~Hg6QtWCGMY){HG9F@!ZLDh_h`3V|yRz7Dp9f%OO+x0dzDGN4NxA=M29J=3g*t*a>)f0p?n zI97GvJADN?DWL>|1!9eeaaVL)13jrnoprxi^DF}BRh|lJ5*kuoTSt3ksf_Y!`aHGU zeu3ML%IM7MCCZx44A=3*MM}H9k*K@a$;0CzfIf-^J#nF@N}OJBC?Fcajn2*of5Gc% z10#@8t>bsdBm<&bq|N>9Y94O0?SAwnIiZe<;4nBB$usL>uGB<$uILYMz3prAT zn|dw-bI*s40nUYnE^HLs6ODJ!lR^}!%!-KyadVw*eA))vfYU|hfAb9x$U8_i z9ex>iHqkeDUyDIp!b<0UPy+8{xZkhg460JbNx^ss41pd%x8!9!v`LZ7-Xs(t|D`w7 z)6Gm5CGxwjH_2|Krt_i%GjDHFPLt3oIubJoHKTc1YO`pj#Io>oz^r{v24C|_4R2Hm z=JOTd-_u@F92E!CxowhSe`q}K8gDhK@qA0J`H!HWqI2j9YOJ}Raz(})ujm8O8`U$? zCD#FW$WDrjmQzMC*0u~iI{`a`JX`SFmKvcanUH+GUI9_E8u%!F7gUQg5(+B_zy`qU z>kS*%6YRr|bNY@<7z-2iEcgBMPFoy0>^NsMcP^^9jK_#|fZ~a{fBz9(vx3i1po;8%_9?z$syN6?l zJx$(UOAtwsNk4U!f0OhGh?-XCM(0IoJ(psQStDQ3#P*P4Nu910_4RBn9KK|8x+odT zD>v%n;U)?zO$!?^?QRDW>I%3cG03{T1hFUTBg;s2*IUl6PP=$^mB&=}W~D|^oPTQ( z&3aXXw{#G&*a8)Ip-Uf1&5a3YV`_mM%u`No4`}Yj=Wkp#e^rcgeN%84v2(XMvs?pl z#swru#b^R3c5SF4)%+0ER6m>ajna$Td??6T+F7l|Bg0+z&xtHZtuVTs7xoGw`-b0* zN9&+Clvb=KV3C?W7#9NEcw8L-<8D+`&3(q=vPYxZm+nN^im4Px+q8^av&YuyqP#y9 z^~7Fc3mE$Ke`y#YQrbj@g6sJPi;6Lw*mS8p zCl-U)gE@j62UnI9$y71J+KGhL-d|L%t5vrwHnOFAGel~Lm(Ln|@ur`Zx-0dFk6+j8 zrN6b+{LC~?vCQl9XI`Dx)U5{rQTSoAWj;#@n3`hre~r-U>P-3eZzeyw7B<4;2O{8D zl@?5OfJG%rT?tLV%K%E^m~-G-;UGx3lr7UBotj-Txhy8C*a$pB;35YUq-QWutDFl+ zFsFC|LL~RpsF$!yimTm=HRpM=sowq|X-r@o2*(39hXLqPt+oOOKwUTk!FrQkW<+ik z!`-Ofe{t-9O$Vd(iVJ6-fLerT@1D+vfu`uiLqXiTy_`~ggP~!BhhAZ802b^-zjkVA zFZEmIIw9Ibq7*`Sht_R}v|OPKTj<$iBZi)5S?S4-aTF!0 z)`t&gQzz|SfFpp2(HUYqd+KWw`h$!-yNZ=}?2tLdimbknDs4?(-fRePtxl6(4#N*v ze^cI^Y{j(c+gYIR(UXKM>B2(cFQQ5k?H1laHWkW2_2GG6B|t5fxoTKFHI_HN6M;9G?zvMBM1Tk%*f6SHTY81aykqtT8V0b0?v7_tAbt$E9^xd4 z8;iXj*(gUy7pOGV421&B4PrWM7ol}JPQ8Y#*lIgr+#Kk_CJitai4|7}8iXsfe}xCQ zP8}3D&6aT*nR+)=igvhVl5qUpIl(;;-yKne?!~unE)PzBI1wkOppJ&9oQ!)#ms4!i zwV;SUWSH98%sectv=L)*oVhAlDMk^^A+SRg0@ybvLjor^V- z%XbSMDHi+RRdSo95b>%aZ_il5y1{BqM9;}gcFk^f5l&-g8&n1e!NTSkP?!;?j{iH&0mFnbuhN~#1I)oFbFoE%di0p?p?^zacsX|-|Sg&3%v|#yhfGp?)_Ou1#wXD{q zMH*?vZaT9ZPG17NY!t;Ke{f`j?S(JSYn3N5gRQd<|7+JwlU(#m9LiASMqB;&*^ zl3(Usytb)04#y0bFP7QELYN%%#*m=icth5~Yhj+~@{Ic4nHPIDe~uZ>pcxZ{e4*Hb zDA}OUd#B0fn8zcCW;V;orWUQQ3NZHSq*f5#S#}FR@&LY!bw|BA&0!!ID3NjqXl%@@uz}#Gzn1jtlMXit) zSQ|(n9>+Kt8C^>>e;QP>y*)>7;Z-B>BF}{$jf^_7)*x5YepzVhb+6FHc~E1Y$AjLg zI2XB0uMA_r*2&Y5kxT){)YDB|v29BPQba0|U@0}6GS)z{+G{1#WE6^6}|=0wFhP1z2X%?{c$@Af2Wf;y%N5=1H=}8Q;%BKCbp+5a^4-uVX5J%z16_Be6Ucii2l!K?h zgwUJji*TMttx^C00Mi`FHl2W12sel780s)!y=lT^=bE{Tw;CeQaKw5fwqQQP3Hre{ zxURX+vB@1=-N70{M6Sj%k06oU=bXf%AR!9RmR}2J8bpDtd0CC~C$+xuT3E>NS$M;% z%5eXRe?9fTz#Q)>XSfthfi|d#-IB^BEE!cH#^j2La$1zP)&6>UA(CvGXcmsz2(`ae z6$}HYNSizzk0FD<)I#UkM5X}D0Z=s?4j_WQv14ZVVl^tAqNejJFWao3`;4MGi(sZQ z0E$N&VvJ?5Nv;G;PZvTe)9Ub?4o1}(ywe8df1)u{k;PQx7*q|YHq?sEoH3T$*Tx3_ zJJE~K<~b#SWlAi@?1E%bI>2r!18y;U5`w8fAV+FqRd5gpxtcs7`g$85W_0P>Ey5lpNO1;9+f4zbI0&~J@> z-VclrXuldlsi1Uht#Vx1AX25dbxN-)r%xs_HGfBJB8o(#(cv1@#kEv>(D5loPlE{y zbAi?aSDw+UNUCIh5o0MsbkBheY|R&90Fe^?rM7z?Fu)a#r4g;W;ycvCKn?X2{D9^L zrYaD#)EWNRkXqKF4X}!qo1ZL1p*56^=U!kyn0ZG_0%1wv=JD<2Qt$%=uVOavOD^%9 z0e{!8Sv5SF8;+;)y@6_}*-^WlY|&%$RT)4Naoh)RG^Q*ZcW9uBv?%n3I|kmsx@3Ln zj%G>Hg}3F{8b@pzL8{wswT8ESgOumkA-}Qj<0C<;@c1j}n)#e?wVfns359qJ`KswJ zzKue}1a||mUmvvu%k&Yu&eOT$5!M}#?0>Q~$BYms2+|lWph4iI_AS49WEFpE55&-+ z0(DQv}7oB+<9*StnH2KxMK`CZ#Y%;_vBDq|G1&l5#?FT3Kc9t7+Oir5D596DywWz znx%sggwS!wJ;m4uc14hRo3|Ijet$vIfGk-^4(W-#@Gw&j4bVZ~tlu`aTrtH0u0?^^ zcF`uqpv^ox7pq(lsO!n=90cMVs9=NwaU!-n5oIZKKMTKgn?%S3CB@G(ozJFlpjilq zyHww#DlaB+=5%7R-vzf(^C5(Tgei4hLzZ1Q5?;o>?{iS)EDNM8A19Dp<9|RcdN>16 z9gniTJFu+gZrCz#OH;e7ljh)b|GUHU&6B-L>&R$*&6^7+w?`^V^qklKQ#fITo;bT-k?_}??TLM_Eg^7#L+8XU|Dcz*`{wSH+t)XGv^ zykg?QRwhbDE+7aRki#owg${;oL_$EatkipSv0Y*+5oCZj$Mc|2do%!c^94Ck0cH81 z;r<31&SExkgIf07pGKr0Sxs-X0YEnx@iLWJ#vSp}f*FhwaVgjX zqczARWBn%#2LUhr1%K<%1n|-}GBlmzLr?>X=)@IuwaOlZ>w=Cm26zb^osDX>ZxZ+j zIvZLBhqa7?C8=eOGm$ox$!a(mqQBMa_xin^wnt!a&!4{dYuf{M2G5^bi< z%px?%14M%reW@|5MlX}A*iY6(VhW(4DKN!1Wo%eBP*P4@2x%C&|9mh*cHOM8P{!6n zW&#}S%MW@{5WuIQBTNK|ZS_%PR5B%U%$@5QcnQ=hC`wzBcB&*KvsbQ|zt;ecNC>`x zO~NI*(MI5uQ-5V7l3h%OgJecOn)k-b76|ue17nkhxpuaGO>&n9PnDdB* z(wsj6=V%AT{Zg^hpujQDrN{9@9#$sCeL@Yk5+TJDr4D<@RqUpu_I{ozwB*o>Hi{=m z{B$=Y1z4$fS&mS;wZ$l?`q|bNJoxi0zLtrDOD(mR%zx}>8+oxbWK1IyRS|3=`5de# z!kVHWwj9(_T0M2N+QL!AY^o~Z-7OVxfva*PQ$VhUW!bX0;n?dnZ3z~rY2XwYvC6e&;twX2KGuT&qC-FeM zV5Me2pYLM{i^?;1z<%&bAoMtazw`=LV+BN;GMVLZT8eQlvk9R_4M0B66$s7^>LjiX zr|A|xE)@z8%8!UZ^$xRhf1b(2K`Hot)kSeIE`J&28YdsFS(i2sU@(daLH9M*fIuE& zgiAbS7=!H&vN>`aJUz+53Hw&Y-*7%JjHwitv5 z790-?1O`yChQ=`3%S-Cz)~1<6cwd`_=fHY5*w#(qFA?S^1E^7=Wz-YL*fneIZdQ=8 zfF(#)A(8=~1{b3q!Yy_jM9YHx`_kY4uR37sLNy1PX@7AQ$w?fO(1#R%s!Joip3MfE z7qfw@t_jKu88 z#c~P;Igd|30Zv(fb&&%vCF!B^gd6xW@BJ^vHMSf5ms zJa9^P7i2S1u9{N;H5nrOhVw#sr946z&@rmtSFM!j`+t6fCCxk0U%m&3Uj|b$j z8%|`JTGs4;0EMT*qq(Kk$NMgP%#*n!^J?CWU>mFz7|IYJRw&9=Mxd}K(7%XTiRHg1 zk}7}dYn4xw43s>7UtF^cjBQ&!{-qv??+m3KZW!f@PYGR#kxF88;6fWMi_qz;q!o#8 zPS3tQJQo*-=ieVLQ;F)*4O+VaSIm|~4AMxx(b)vUfdO|A+;&bxk9}aX^H=+#|Lo~= zv1WvsVs~@%=H{jst8&!S`FJxQ4bA_VCwk?(vH|d{(ig;k6at6NbT&(*&9E^Np?LDw zt%4I2LR2&-;hTqV)WDf4Dsvp@a$-|FQ?4qGZdih%g*WUZWq|&NFB*yg6I6d|OC)iM zNN@n396(TW*M7P?xl*dBRp6T=Qp5Y4mL}CVGLrM+Kg16zN$j`aF8&Ok$p= zIbpgL1rmvWDM97h_&mLXFbLGLBcmc~1Xfjy6m`XOXo33=LoOXr+~U#jTToi!uQe3)~4yK01}rVP7*bi$u4AEz>P}JvPhkSBY?i-A_Xpa zw6ocN@vFF{+A=E=QVS}JXx$y=6az-KC=yvr)_XQr?C|1jd(-^)sT(kc{@Ak9Mu`h< z+e})sWsN0O7zlaOkQMlj1@q4vRYU*5`$K0SE_#vtCC?EgN$S*t{ex{$K*`p0NMZ^| z=bcTXp>2fmf*_BY3pt|S8U6wX8=6-t6K(f@ee&_a+H>?;XQC5@yJi9Xq$NK<5aDSt zMWNk)9czCQ{4*el*n~~=540u78M%Y+nQ>fBW&^@dDTk@ftlJA|{#*s+U%OAg}U9&dLla4lZ;$em<%Kbqd0Jssr$ibqbma zJ4Sl6>6|N;ArN~9-|wC5A09B+@ru&jw+LK<_}4}hu~n|wWUoe}cnDh%R=Tu^Eu1yS zk_x0pxHw^zmU*natP}th0$BMn_du7)vm`P0+O8m(@PJGSj~l+QIaeM^ZWF|RwO?Sv zv^kN*1Uw4A#Fqq)8B4>0Byq0pV>;xG2aaU(ag(+#n&*>&t`uklsW<1Rg8S9 zzDPFvKJ#-iK_i4H2o6H7I9ovgK&Lk6jUakd4k;}7jn`SiaLvLR2%FwVV8ZT>S#&_m z==L{2*>wz7ba!^mJMjFjc>YX(d^Zr{%WfC8)Qc0t;!1ee-st=apdGl4XMP(`x7*s_ z$DjI-_n+Ixvs@44fUM^Y?``|rQjx`;jZ9m2_>&65!0-co&% zw`3Hkt-Q0Qy3O?oV-k-i0Nmzq1|8G~3l80Fu?Dj+gN4$0-M(0RX20=&J>Oh)*bnwY zqsoSmk@br+NS&dmRGBMEvP%z+f`2T4!n)hxslY_5f-;Y%~x1d0I|E+pf`<}1Zk z+{7adi9EpM+4akqEFznK6_d?OXMR~U!9@uQFIq}$?b^fx!wnNMX!3yQss1jl1SflR z&<24?&-VFrEM{pLCxq6~r&#=yE`HOvSKAEhmBA7adK8B=K?13ala71%Lhp(n&2K+- zzk-ZH`fsn-0lt|3;Nu$tzpti0`3v_q5vOSwAjLo0GHI@V`yW&Fu3RvTELYb* z)rYe!K#Ya;V{BsX#m?INZ}%(H0k1*#E7KnTMwLVFsPP!ONFml&f1$vK1osNxHgE-zN6Esdn`3S(&Oy3M&D6;{IVuPRS8)NT zGgQgV9W*vPE>1;%E~EIJ=x?!c1+q6>OV6Jn_HH~*Rb*fExmsJ@3F12De<`E^Vh|Xy z!ND!EgrUm7V1m+KT-f#C0@Vmq%d0~{1q#_%oR;RF{_W2zY-`LxH6xUd(g?N%;y&1! z;0XaP!rzGlR*B^x-3DO*eSL2K3R`(3a)@{oALHyae2q|lQ9tM1Fyk4h1Y_a?*>oD0 z1nl$+uRv7*>TiG1{6JLz`gWeF{8*2V^%&~+6cBfX#e&IPHizN{P!JKeo_7=&bm8q~ z|2aL3F_#?flLnnQxvsgpVXlk9t3?!3-<&Wz)akX#5tqys>P&0xRC9`P-a$A*|2f6` zKq3Y1R07d|sOZF(WTik8y^jT3?+)GlwlcgEv>Re8uo9E4V;dLZ|B9zD6z?1WS3o$2 zRE^@Y2=7VqCR%acQXNOc7c4RZToD<{#M!I8g9B!eHgV~6?PT4rW(eD2PZ|uGO75b_ zn#&lmmZ+is%i)%0yZ6uDu)_+B9Yd9;SZ;x320hJKt!CLtyMkwRqkq#M(hENkr z0t6nhl`YXlR1)N4q#Ptk7v};804ejS7b%6_I3wo_b4@rbBrb|g5tnMpxKL<*tf)+2 zYym#X`;seQZi9I2;|?Jc@hXj(hK-^cN4Bb1Su2dg_R*SG+l2{E^bPc7ebByI5!1o7 zi%kuG)-?zk4+j2{Yk+n3;wCPK6Y~FH+#Yn|VfP_KFjv5)r6M*2vAa-fb5vnsg(qi) zRoK1w9ON^Fh{vhURkT5Ipk4q(V+uW7gDwy3omI%NL01k*IJy9EEUG(enW$F>IJft# zmsN_BMQ|L~)U&O>K5zWl@@5Y`2TLF2%3MuXb;ug-Cn&_^ znq@<}E1fv$r(1}e5uTd=Rdk}**{EPKOs zrzCO6Ng{ulyAkf<5Dm?_IFz}bLD3|ty5lMX9o)6Jq!PEybaK zAcAmig@~hsA)L7l$icWqD;HJ+$FSt73b;O@IJ2&Xp^+ZQZ}NphZ+@|_nf z4vlw_YPv`@1k>os>~V>xX79>>f+oI%1^h~UiAUUg_m%jv(4#W^gF`wi0yxnG;E_yK z6r+3E(Jhp@A|xl*g9nTXm|1Zk1lzuS{8WVK0=KdKj%mWhFj)D=vVUX}Ym~DOW#}v_ zLPLqp`Z%9%i>Vq*lmb}94aVs7B=_KE6@kfjl0cMButwhEv4}XTs@5TY-=I|phKB+< znR^Nd24dwV=xpQ<2p6*mhwmZxV&y)4t#SZz2&{Tj0x@j^ee!~RDyNUR7UPq0un&S^ zXiVb|kHw@XO;0m(ezHl(;RMKg=Z3;*FFST5lf zW@N6Ss^a{$Can-iollXYY2v{y6w3+MhIezoJvO?4xzMI>ng6%!S)TRw&hzO2DkF&J zOJAZ@d%8Uxh%fLBHe@4p8_8jAkBl4+XVV#k9C^t~s1ME&d5P$M5eq`b@0Ih%_t2WHu&+cT>GnLl=ahb0L%Xss>d7+XiC_cdb7j zcxmOOU)7NU(+0DD7~c8FYW-zAjsf`$YwcYngs!$6`W*Lc`PT}2w|mvf_a{3jM9WLg{qckS&~y_ zq~o7wMms*K5PXQRSy~_ z8xC$A6-DEJJ;Dn8w8+q5maAc0)HwMiTlpb@l{_GQXnALAYeR6M6q}uB{^+BDl)aP= zjD{4qI8w5Qn8O%%OPD1bv%%|+IFoP-$(XfV@UOB+w6$f+(fc3@bgLq&m%i~5rC1B2 zD|GUUhqrgaXE`pz+CmHo{Oy17p0f?K0gRAOfwh!>@j0>rQm+9u2sr&lATDlrS~_7N zYutBV$g$YFh`nY+w#s1_aeA!-Ae;Kl!V6Sn@l`b%<-$Ux^1j%0@NX-u_^9%0Nfrfr zYBqv&V+~g&5+_Eu6kaY2F;2*D$-BdQH@Bj<2ExB@IzD6m`$&q!RBiE@@f#yTC$ih1Q7%R(w_ z3Kx>rt~>dqRw+eNc|TjzqznqC#8q3bi*}%YE%4-!u>1^EsIwV5Pq)SEuPq*v&AX`{ zx`v}*#I?9|9k3xcF0Qyz@eu7d7`2&3czW1y7mpjykzbk1YoUvU3hM=BA}oNY3a`@1 zzwYYf(V%N)yLf5vW;}lN1{0=0)Gd^9DO0RJtOsz>P6k7kF8v@Ls9tOF<*m5E49)p} z8n~39mEY8q6u>yWRs|I1bP>h?N1_=%6|;5xlDeijf-J!c+{}uaMuc6syMeLsNJDQ$ zoEj;npv5qxEKcI0jE9cMkznj9#6wrw zOnd{-u~tO17oQ-k3LfM}B^eMyg88!XW@38{(`b;zR|*UC#GaAZB5l2O=T>lkLt(0q zuofkPGTS&D^P-(>ITvRFb&TN*Q3_-s`kQMyiQdAjK2Juow}~FV#r^+F-2@+UJaiG%SWGeH2E746I>`yw( z9j1VNc9_IM5B}R+(uOV7PzTH?#rAH_cvbmHN8AXYG2 zAI<5n^Va&+%zhmY?J1psr5}tsP+$n_UD&};d+ZxAR~NU70fSL|9Y=)mbECx?;9`6C zmj!f}!Sx6g1ipMJ`dbZut~s=PthB%g0X|#K(+8}NqaBgmF|Be z1sajg#hUZg1C17xX8WIN3J-zR#t7A=O6FKemyt|unnTYSmn1D3HAzKS9bRW}>H)5c z#2ara;MBD4-%^WzQ8Fu7TaY(c>cqv$!I04N6qkfx?%`s~^s2CMUzFRi8(9oKmqPY7vbzQrFeu1$$Vr`PR9t@U`?1H5RQ*t z!1y<#bqrJq)w>coRO^KGQ?nt%V&uwDn!k*w#dymBltu!&tqY#3466Z#wgD)r<2Q^H5y-^4km1QoN3<4Q>lf{h^ga^(34M2QD5CBfD_DXJDdf1bE4Z^#}aXNb^ z2D3P+y2ZD90KSKg7_PW)t4#W{t%WN!(GS!nD{9Ms{IrJ&rltk;E>n4|%%2rT#m=v$ z?mf?j5X}A@xF_M)`M_X!(cz^85m!w@j(@;CLxNvDXB4MsBBEev)ZD|9UA_8-poESla-Z|uq?#An#8}^sPVS~Sp zQ>-3;Ws&p3+1$tiE96jlMZb%nmcN~a(C$@L0o8ZhRg(^2EvY2fC zV*Uk*ZlhQw5yL$&x|{P<<=QXI7si{;LEdg0&Q!kZnjgE=eBTSpxBS)jej)TOhQFZW zng_$V)sDwQJO53sbO%TlGAO272aC&sf*<$>%CtP&!t!)D19az8gZpQ13LC(R=$RXT zf&2&58~@T^M&`=Re#QQ(UlAZ{{N}>p(x_0LXJjp z8kcjiwXwbNY~wkHed7ynhuIAJ-|D{D-LADgSkPX7V1!*E24NJ z!A)f*-oM8u2ob%5QPaILORo6^Bg=Ngnqiru1K)O9o9h4^$Gfs49i}&Ib6@U zAC*StpMSdlhfQAqU%y$ZX_m-;QWcxvY3Q0I=*{IcxmO=sTU%StpFR5%n%}mn|GU+H zzVoO4vz?u1FZw$>JN-Xx^Iav5Are8grP!Ai?H(t zP|d~AShw4K^y{y;r|gi1ADnJKeIDl1cK#Qr)pRH`m10Xv8=%SQuIc% zBr*RoNB{l%F4GUa31($@y?2ggson{HZ8(Aui5#e;Fpt!)QT(k3mLQo&ri;p@XzuRH z6^-v6!>hp~%Q=~7yrhGF20iX3YF9LOMeMF+XnSd@OERCsQ__9WybiYyK7gJIrxa6<^YOqT_T}! zm~|a!8$N=RQ5A-;OxGEdEkJ>m)>ep8=3`Z!!K-0|wQjnD+3mW28qAh;L`@>-xXu?6 z?NpY-2@*{M-Tt$We=Gl=sxps#->gZ0zu_|bP5eC5rSjNnQmCfhTJFK%-uRck6j$A}n`b6E|LJ+x34BRJjfp2LRz@vM%JeLVRlpAc_Ix`&}uXLZ#{q`fX(nQF%zQW5`neO}SENzu zzw+K4&AH1uX<3@es684GLS|X-YBm5&Y6bP906r^KX}K#p)M3Y$GA`;%3Ze#UW34g> z_uc(H=qI0(MWqpc)&AFi@yY)8Q9do~kv;7dh3+9OgiezACm9GUT)L)bJlGw1H~r#w zuDh*#Ayssm)ij!an)P!jmDH4&ha{9+s4lG*+jdd92W9{KNy;>8eb`!i#hUtgag!Zu zCGM|y_cc)zGA>?!p86V^8F)v6Eht(D5Rw0 zx9Ygds3V|%jOHddsnS^5^`y?mPJ!nuCrTuQ&)d6^o{DU z=gJQA=ib(wK9NiEIur{MyPhH=1VpCmzws2ZVkUM-wh+vh@S6J8J2eG;m zhFCPaqEqHG)%mEq=~gB%bk*2fxKKm`Cl{|>`{8=E7{FFqHI9XQ45$;2F&B0B@@H-BDY?J>p9Yt}G&mh%uFpI|O?t#F|;{Tp+_bc%q{ZH|~AL&y$7@3X^ z?6!Xm+g`N+HrP9cGDG~C7@BC7`cZ>8t9Nieec)4c;U7{T_)rc%c;fIK7i{yy@L#Xg zd{_Lp9(1v|KGvSl`K~z8c7irvhYl~k#GNV zFNjwDZ?C|7mZ)){ED}ZHKvNVRj(*(x3o@Et( z2gWkv+heD7K}&a?dFu?nsLk+qtWN#mKCSnEk=;M>lRiu1Kb}6T_z z!hSsQ_(Bb5d0fuPTtwha6@dcv%FXM4{y>$o@6^fgtohtPYEz zOb7ybB$Glt5@J+*W9~M*+RQz*E1tZb73KLX-7B8pw}3e7^u=kM2BM)yr~5d-9<}P* z9jEf$t=^jGqC7g=cOx}lkefC9^6coqeUb5GBllgdWOSM)^K-4sS8<{cn#BKq9g8R& z-#GCpRVRV z)YXi-Abs~i18=nzJ_%^D{w6<*g!$wr${#{JNN6C_Q9|{wYY)XgbBfyRCBHV3)2w)nb$Geo6`X7yc}NzyAj@lzhL3 z7_iL$`|L&4|GV|{=_mXDNBMlj`~Pbsq)%eN|0FR$C+b{{KuM>Ib5|gt%*u(*sRU~8 z>WiWm>qkO(;^M8TqnKfp1sF^_!qne7xRBw35hFl z*DGLY{7+T?+wO1ee2V{n`6!0M z{r*_c?rl=>8W&(e+lwGh?{wkaXPgVKxK)Nnf5=&>0lGar7?=7=g@(oI!Yp|2!(Kc~ z_Cpo zCGk)e0psU`mFkG2Zs;yJxeclN_^O$XUdvRD!Rv)q%7$d6hNrN5=J~q}7i15g`P})a zeBu0Kjk}xasG0?T(z==M+1B=h^pCp)HLf(A`qQfosD|riKEsI`UKO+HW--j;tSo}f zU(511Eyd&BC2dddYgwo>Sx!WUU+7xEc(|N9>#zaEL~idqFJ{w*JRv^;O}&eYGET=A z;Aiw7b_0W-ZZR%+ex<=w(sgW?IHlFQTy+WBXs`iGZ!sZ%`Y(J)YFu?-Ew8LHH0HkM z6NDYqn1}akZC({u&Q~u*zt?|yOIMC-6_tRFY#24)!8gbkj7UA z32SiQS2D#6*A5;)4ymVcxu6x%p=LVbH{Qq9XsE6%hgZeQs&(sGFk8Hr#IjHxy?I}* zEF~-`aN+kHu?!xr{UBA2WFBi+;zSmOOY0VpXI=TJ=~`@mlisWte`}b;!qL$yn8y_r zc5vl9tBuWT>?~J>D%%Fx-||^KFsd?s*l~Cb-exRD3R`&~AhInSiQgO!gYapt)O>|! zuhg8#pjhE)e6Ve9s}Zkh_M!%T=zseVL>%<;Q0KnXiOQ?@qxa=Q4BYSIp~hWIWUkJz z6j2RyM2N1fFHPg|~^ zrm2`qyP>uiHuUf#4%@%&K%2+&{n{ASyG-Y$I6pi%x_G;P z{O02F@cixG$;s)Pll{ZDM`vc}aaR2J*p9zG_@IrG(}Tkce(QhLAFf_1e21lR8ImB; z%#S~cj_bT5UcMBatxh|EG)`#${BZB`^!#OKu8Qh_T3$InJUc$x-@AC(v>j~CH7mZ1 zf*SdqfB6KoNmjhg&;_T`GM@wPf3KLV@2>v7pxDk^SQ#l?)UN_~H#c3CL=^7U_}iH*C%e|i z0$RYM>hj$2`gY?Ex9;HYCws4t_TL_zT{KN(e^+!;-Kho*an<|zI8DcglBa-a=9F;upHX*rp<^Dvzvi~Iknf^p z**iWy{o(E5>$A(hFI=2mQNKW1x(ru*@ATE%!;`(Qj}Kegtr?tVh1xrPb;b#g)hcUk z9bFz@EbRywYd*)h057zCmx*JwE&Wv}f8T#&>B!Db&o5V;e2)s;+eU+CDWZlrscZYw!S1--yr)fTWckgGf zWj+lw6iv=#E~kZIpJ`y4Z5`Rcw{Oq(&i7tl+d4`4|Snr|~6SIsqxtzur>Z@rKG*9(5EhjW04TffSduGIeP`o`Kc^~Sre z)!coL1>JvLS<(lhgQj&dGsK(qqfL*7ar-GYep$h!6${EP^CviScRogLHPRA-2Q|OWS zMNbE@5*a!fRnZIjpeFqB$|&kD9CY|jb=1WS)Z5ERu8N6HqNQt4eWBXme@Mp3ELW>H zSbd?|pnB&5rW{?P3#7&^x+1VW@R!|T!JHEjQZXuywctS z9Pvtvzmqd=N44OP-(qc-f1UF4ps9t2;la*%rOyXH=tU{>a+WPP=Kd4m=9R00v@oyHER^tr8upWRf1nn*43JoWAK~wiWszGZHa8QHx79Z1PFwd+kIw-=xwj{ zENxS_h}l=T3*>mB6KJ#PiMv_SLnHWtF5B(sx3S`qzg3p9y(=FJ&zWs|nJg!DgLg3- zEPRW8ZyOJJekmK~R?}~GAGZx}$&=ywl+&!+(Ae_v+|$5Jc0HAs@hBe3QZ1sv`UuR6 z)i)Sea#xi3tnRS9f0gy+d++3YC{tX}$Gz-vzphj^NVL}b6hSO!oAH&Ky?sz;@aAoU zJO3adlE06jzs6Om96%caS^2)A4%FjrZpZd3F&gZnd)axs_NC}N{zV}>+k;CxFgo=Qoz<09r{P3r*r+DE}2TAqaPfx=G$&7G+wiL ze{$0QZbK@Te~xx#H~8WIK07_XJUmC=DmbV=urIg0-w)}kZt8XKo;@ydC$HdDtWwm{ zy=zx_e%DINA5wt6t#7YVIo|(N+-_d!dC{z7FGw+Wx^tVrv|NNHQ%@YJVZ|B$0Mfs0 zc7+VCmOQn`sZvpa8pN5(r!kh1GXjr)uU%IksHO6+f1Wz!4rg2E+-5N^hGlXDVoS9@ zT!A=^%YB=Q=K2V~uN5Y4>$pL|!I^h6_f(^<(~`GVU$@&UJuPi4RexNvQU@gU;Y8o0 zoek0Ho}2&rkI8E3vSbfM;fof2K{@hc$^s=Y zF4eSF8og_^!i7yPRtkaSJd<;6P7Tzx)EfREdq}OX!eQHZ#R7f+Wsc0eAJtc4(|>fq z{9CQ>TtH`6{JP{!dPd}jmQaJH?k6=PYA2%6#!Jjfo#kYff$ThKVd3 zW{=leRA1TZ#&@s;WcH$jM*Cg^Y!ons=zM6|KBnHuGD{fzTN+X|NJpN zi(vi#kd<02P6qO?u6^q6qFbfOmEoAX%_IChfkm%W8lb5r!2MUVMZ{Tx7~Qg(e|N10 z@Zlh>%Xy}nApa2&(4UEKSLTO^As?NIHT83I6PR+ z&iaA}PjsZtbYAkX7`@;!m!nZUY_RC^`;AYAB45+6%>u4I?o^jz4V1z90rwug0I~HP z3dF9{Oxk{LoJ`xpA9)@}XHBDTf1!~YxX_Zr$L|#=eeDHUsFg1pJ8XRM4n6LJaig){ zeTyi4?>Z(ez22f$i08y>OU%ov`ElHN)|7x(%6zQKv&N|PEZ3zT>SR}3?w^IuCLpzi z$K5-{tJ36RqD-kln!>sl^1(kfPP_76#h^(+;43i6rtZ>Nk~Et~TgVRVe>X6iTi)CY z$;xYWF)dYwSu6x;Z8Cg3uD01G|2IR--%Z9`BL6>sy7i(~|MB^!`Y#{l(Bhe7x z8;`_~;?JV{i|9NK8}A50S!-!JeEM%<6#uPG2w)J+bXusFkJtDLr(Df$A)boIeer+j zduGkC{YHrHM8HN&bWw``Q?2{l<_XBe;}CboZ?Rh@Mez4f<>kupe{R8>S89Hn2)(dZ zxk|r#LC;Om*>18l(FUWmA#M0$-R*hj@qctgSN$wH{q1LVujv&8^}CFxDiV5Da!{mt z7ncI#sR-$gn&M6Fh(Es+owL)EZ<q>=YaR1oHApz7;*q6d?=)72Qm4pvnrx=Z z8eOg)ceju>>(qH4fBL*1h2E7$+j0nMblMW@KsbKl=;YO@_)Uy+m9e7#77D8&z+^WP zPk!9RYxbun^ge@4E+_C-5)Vky19WU8^k7`O`l_v$8rfHRQLfyJ5T%|CCyjI*j)~5T zQ?(kQ6jr#tKHWy2ZliyV+lY7fRh$>)4?2%t5l2%OHKUyzXw0suJEbj)4hYERUUl3XSm$K=?^D&x+(wJYSbV0)2jcwQf~L| zV_E(0?dMOc{=e=1^H2K!$N1bPXDh52xW1??xOw0Y=|22qHMpDA0Nq`unf!UCtO+5E zUR)GSX4B1Jf0G8!pQ&`{JAQusU$dCXGt0whTpZVko1c3-Ym+6q&vbfk*?)o|hQja+Md)_n8G%SDej#AD@w z#d}TjyX+Z@%wsM+y8CZYhf2!A-yJubbp(*d*Wa4ge~eoASafVt9lzQ3+wVTnGXa); zx40gzau?p=GOT%m1XiPfF2Y%Q*Cg!7gWr|ytv*CFOGE1q6E3o(;X4Gige@*E1oR+5 zId|=FWtVp?9OgDX)yN<6Oc(N#l#YWmb zNOunxe+hA$;eau0h46?)n8l56dA~OgY%z}U1NiC%;@6dGG)tgf>};U&RF$ge#d7>-pd;eCL|6g1Wdmyp; zW3Ml6xPI%twEGaP)JD^^Aa@_t-CFBd%%hIzSf@nCBMwVkc}aA85sy<9?W?@>9!rfn ze_^-65V0ZjyI8tb3X>V;ws_FBBY7J#zV9p+Qu0GB{0A6!Yx{Q?z7Mw$j49NoEesSY4izYh=V5Y7<5C#4 zW-p0l;lna`U*0d#skxu!>rvaxc8(vUdI9Zv31Sa1a@)g-!wy2W>|k7YmX7uoj*wo7 z5eLqpO&Beqjo7Hcvs@Kn^|y9}e-EJ1GJg26c#Ym>JgJV<%7X#_+|tqbP2y0<8h!;q zdaFEtrRGE$#fop>!)^0iov=;Q7i8oWL9W@wLeuZ<2|VcOAT>jU6xt)j66aO{_)npo6Wne}1o>g3)+?H&q7dg%IOhLNJL3sVaN5;)Csv>!SYjXX0x) zytm0<+qcahwf-*h;eL#Z00(k4tz?-U@L+bhH%$yj*`G>Po zbR%JQd)xi_liB>fSpS=dbZuu>P5Hym%_L5gA*aV{F14sT5uL|4_KxUgHtUHqg*ucV zL}@{saRmhxxSGOyO8xPF9wh1kFZ%XhAaei1XlE1$!NYI4B5x&7)V1Vi8+}9<1I@q1_~eR^?KDJLFQ8= zN@ZfF_DiJGDu*x+%WL&=txE8~Jl57Y7m9Kk-<}_y9UtxQU5Kw<8h@%<7yth6=Bbdr z#lJ0j^Dp?~`g$w7fg%0nlm%9T;nH9IOgkAKDe zf4}QLXejM{2iO2cyxlF>&1l9=?LPh$*7V2!_0#)1o|xuETQsc?F{Rr~XYoo9 zmFW4%4D!AA_t|?Wi+`%34UwxdpU3I=-Uo1Pt#W$)@>2BItE3LEF20l&Qu?AT%hdoE z_XAV>hazRiCT4}|0+vyCD$N%~11+=@_G)YNA*lBbGiat|q~vou*yYsPMyt1DqfJXT zir@V)3F=n7ux;iafJ|0rYHi%2c@m$AbT%ERTjSX3A4Ggzd| zXslR9KUFs(=QqoVv{m;9O30#sATuLp={z3CsZ5qH0bD*Xhr={F)5Tq9{}-{g)+RW0 z@3buI>*90qxPNhr8kUMR5!6Ep^|N@qw$}g4ttYa+-Za>he{H;?{Yw|t55!{8HMe1% z_U)D2q9b-z*8D2h{q0r8PP5MVfch2B^fmSMW};G9 z9=z7{2-iy85XUG4*iXudOvOK{4DlcT@Bj1vH;>CGQh$+sK{6XgF1#A=z0=Uf5Eh@~ z=yWdB&oh~rei}zA(@4andCyRa6w_H!##y3F%l}xQ*#2Wf+-j1kx=H5r_@Wu!Mi(~^ z`otu@6pyQOG*AEbTjSGTy=;CQ8xNmdP0#;>X!}-i{lGG-uT3^8{EvV2ETI29-Mv1@ zB?J5;X@BCYSeaMn-ghuFFW}dIgj=QI?)aCmP%J-tAKBQj_^ka7?FPTsbM=R?XDlVZ zhcQhoB&r9nGOSb`S*6#_WhcKrx;)u?ef0L=@as3ILr%IRUX zc0MJwJ!m=~l>+>YuQk!U8}Mzi+ZRw*)8IZ4&i@3$X+$4DZFdp9)Ef_nR8_=QCSYq3 zU5yv|pmU1`#0aNN<9LlJrehC z+Lo31-Yc6PHrHNI{r30y!VQ1>M}A zr3GK+swib%a=`a#`bx&hEa%0!2Yq-eQYqTL8ZA6{Dd<~n0-zjty)I+~tEYQ3uh4^2 zODmx~Uoz-A+|ut4yEMdq=uK2IjmN3Z)dTji1pjGkr@vFde|WaNwe<=A;bVM06Mtv2 zG^!?eC~@o20XCS$Nff7Jk;&ne9IK-D=reISi3?H8GC*$=#Y82E7$2@ z26A{c%fu*7RPpHZUU8E>`n)%gSC2mLmDB9e=l}Q7XX1OA$9h(Xql3fZQ7_B&f2(2n zs24{{ZsK#f{_o%4>0bT`&;R-1-ofj`-ZXm9J{F$;?X71|UsUTqKYjXi`+w8<{}`Vy z|J?0%h0HR-4m>yX@b9@A|4r=Mz~!$VJ^D<1jWQv#0|;?|r`OKc`PoO0>^E^CWGZx~ zQh@^XhA4(IF|x^qh~lEmK>Vna-1F;T?^V5$`xqEKaluj<_NZ~pE* zdi3MzwaTw!bz|PGufk7jld{ZqH!1TZ*6WWR9mK^jk?~aJv~KL5AIIhuGt^v0YAW+9 z+o(7$qn_AH=OT~Cld>>F&Q+WWnJXhfn(4q4D^Je~B?fc532_1Ilz*#{%2is%G7;G< z&vc;*p$!`~6O6RNkb^jlK=2YWoeLM1K8{A!#QrGHEkF`ah_0Zs&}2{SI!(RZzUZDx%z__5Ycf-Oc7~i?sUte^9>reqMp>%rM3t&aIc{s7Dt~~q<*8CtsW0)lZAsj5J+ zr0~j-TS(v-aBY;J_{$wxNwt+aYQQLnlw4%lx>zT$B8sAbfwtf#JQO_V0Tk1W#RfqI zM+*=*Seg+)I8S~fq!AGShCB&oMOPk#%czJa{QkRp!q8ty%O$LXwXqi0f3$GgZV~BG z5P#D+7z?tL`}-q)e;uX31Fr!vPcP&k2g{r^PYaM&sno#DZ-G{$9X?d0CL1b7qtisA ze-(}g4vsCSd75P)C)q2Kg5YFKkh5WSLNjKL;swrWM4LdAAXwx`Y+7VpC9Euq(63~Z z;5~)@Daj^WKveG*R{BIAe__}*iH5eRlod{PH?Q1NEI~*y9}-UzQ592ZMW42l)ZEYj zH0+c@ilgihE&a6c0S@^e5rBtSd=h;L595AIf(}IyB#jD9z~tn}d}8d#XH=^Ef|86x ziNY;V0F->a9OO8b^9YwkAF{G+DN=rntleRQ0t7T;?~cMdHz5C546{3!w6tdbL^_AU-;p2X|^TKkfa*vH-6msU7vXUickhaf8{gta?Z1|l9n z@jPp!DM3;s+>}k|f6azFC%=hBm}iwLG;Es#|95S4t+>a4CCw%Xe^i8i{jZ^30;E+~DltSITaR6PJ}qGAQDeQOMXXXv8EJoumHPj=$Bl&s zSA}@ zSh5Ge(0`a|0A#B`27V9Ry?~uHK@g6X(!sF?$P<5o0kz@DX))6H1ce4EH4wR!2{L~V zTf{FZ8}Eln`omC!A|QroB9sE_W}^r@cWF1b1thz@+WA3i7>eWAL%o*LABGfX39=m# zm0I|Je-(NXhBQN}XL=xsF(d)foKklVHkPj=uNA6wJ3nZhur{utSwCwiVd!9aT3}ni zF(`)82KdXEe}IG3Z|vZw3g~mp`K*8o*fN6uedtiy zn!&~@c0eO-b^-a2qa`!6V=xRR4;85xt&#YmJS6Kz5;(9x{3o9lBWZ}Q ze?p%HDI)p7x2}zZY1UR;-R?mor5*;Ae_bi5y}>!X&Z*YH17Zy7P2NkNLGPNmh(Y} z1PB3x3xO$KG=Xt&V%|ir)&}vV zBqZj#LtNu6Xl;S(qocKLz>sq?sr)z|f0>XzW1*k_We8pZhP;b63Vyw(RiIchk&vol0%FsD z7U7onVLHuoPOK1)a+)kq2qy7!X*(^(0k{kMVZ1~YK+N>S?ooH#rdXbcgTTaAFo37+ zPMbh6kahAl7g24?S(}p)D9!~;GCZxDtrp~=on}(YDH;cxw!-I~M>F22e_`P5SkD$j zPbejg2q-hD{R9Clr;Y8yTU*d+>{R7AhH52_RUnV5^oyYsOUQIAa;?FzrTZ@Qo@0s9 z!hJKy;D1f`tnk@Gq^((G`~*^yfiq5`7Be!vVz+_EOIh#tN_IWhGhW9 zvK_y23Os_Zp(1U)HG1hde;&F+Cn%?2MT&Pvsb>M93a-<%8oj_VA|&s|1ZXpWl{7EV zj73ZVU>PCof8NIFUpPh(QYO5< zOgYW53_e>cr#KqPm-f`f6>dzvNAmz7$_c^fRT1s zTag{p9vCWXzKNy0f>Eg=`jTX9N^X3N&_DB30eyT-!tg-yP{NR5O|Y;fEUN&nyDqCT z1j&E;Y2_N?SVN3r(0!PJLlQ~Kn7{&9>0o&%#d=BW8P2er9cu#a98jDNlKLXIuR;cN`9R8EsaY32R(pu$QUt-wyXh?Rl0JX3r6I9hkQ zrm?jqhPDc%y0H>Zu8HEU+>#yrv=T$X&Vo-h8R<+J&+E7|Cy(iyi_XwT0$&z|AC5b45j9>MgPx)C5li< z`_KnoC5AlYd75RUtM~&+{9@7!NbNAUQ7Ag%aFNnMMrc0Ez))oRhY~MBPGM*}V2Hlb zl1}4=e_K45jBA#yC*+_(~*=a*6oe7pJeT*dPjb$Jxe;kh~Ku*vXDXMKes|8-_fuTv5h^s+~o9~}~s(^l2 z0Tz=$)fX8JREjaosB~~du=%1{1-zU58&GZmLqchVlW^52e}xrto&_>Whw(tKh$29e zMQ;}WK?xc zdMPryq`GCeKBqo7hJJIsT92VXS=t{pH-=iRGObG+ErK2tL%+FRt;et<6TMo<>R?G|v61ZOlCWsOG?$i+q6#5JSCZrbS=j3N4`o04+4@}U(K@x*X zGfEFZxmKgo0+s_dN`PFXN2nvs;MZ~TYbAyO<)Ke4e;Zz)1Z33lQ21MgY&y1*jcbB2RYU7KEwBAb_$4tR{&5BlFC_}#6=*7l}q1~K&8!qfzTI%wmv~2Ce`ta z1&$J+f5jE}v;afQf(a~FYQ_mE${oUs-O1^}-+!urzKF#|*2ZD*^g$rzlnphw&=A^c zdhDeV{{cuJH=LLKsRH_FKPsqLaf>zO$)#C?WT;nxV#TBuvK|#(iMA36XaQ4&boq24 z#ZfjJ$(=PoKr-_c#rCi~5l=j3vWl`jRX{KGf7SayY-M>N)kY&zqy_st-CeB0!I}W- z2q@C?^31IAV?pQ`eOOGDZUN$K1frPbN;4LPBqlqN<`E`hWDl-i$P0scsfRl;q!k`a zUy-AvV;-g!WEQ$j>44`t3Tf)(AxJIA1d47X@BK1G##I5m%X7^=__6OrWd7}8j|8vw ze~nb|4MzwJvB4S83xi~Y!O5d`ibO)zfV-RUu{L7?+UV%$XtWN*Za2}mg9eOpNp^ao z*k&j|P=O?%#eaH1tn~z00kMrXL!--RgV`)w8uZjXSJ@KBxj;dA{O(a76d0hHA|b@vZWQIH+M(!8P+sA4Yf!+Qr-Ya| z{Jr76Y`S_-h>cEOVC}hdIbX~i>vPx5RC?}M=F)Kp3Ng*lf;%}XMi{Rk zbnNM#Y^NOcW_&R*uk1wRdv*3=LHCuylhWUUJ=9*>orIRdSzP)v5#ZbFT@?#O2@pF;$R`i8X*w?*xdCO8zr54;toi1;4X?X zPc#E4VohHThy&ZwHl=3VnhGQy9sWLWfgtuu9193B(#&YemJV%{s~D3(+7y3wB&vWu zE}$376JiJCXza9Cz$y(=h~Kp@sBMQ>ydc64$W@?3ygZ@_`Nq3NMHQG7G=FqP>6SyDbn0WETE;MLU7q7CH{dECTV0c7eGqa~zOa1mYF# z1##dxR=Rjv6#?eq6Kba?s3znAaga!EcMP}D3XP?Be%lTBDxi;Q-5dv2go1Ln%MN)J z(8oka2RH}uoa2CskbmyhUXzT=_5{@El@JG3gaUB4b^UILVO8U(o#0+bKp5XeAvG9Nxb@HBM99wajKn^;`ejqOO zS5?RtVp5*E6k=y5sR7*@a9i`V6=H(AzI70b(bE#pt()XlllR*nf3X;(AKc@eFHfvL zSozBYY|9V}tPOH4UjT(ECE9Z1tnV;NrHDBAaYx(dezNv#2on**b} z{pCD)@&~bag|u{6G6}Al$r>&xRI<~DEz!)gZ zfN*(Dqp(9&A_59905$h}}N1_{yX(5S3nFa~i0RDp2{f90+v%U>ZD{!F<>L_9vEXOU1~ zv1XIP6DBQlTgLZ_%ye|m_OP9>=`-jlE#axMvav5<+e&6DeUKIH+fR0NL{HEKnve3=+1@q~?a6F^(Q z3IeX@(R(m(Tdu%a1xloHn~GwvJgEWet`$q>y0Gm|+$!&4kF5dM!Eym3tqY|>z3m0A zpS-vhzztj*vkIhQj|6K5Hm}N)|M%wWzOt#w&MXV(JC~Q$&}wZ4qOFBv8)YJ49=7k zi>T0M;9{Mif+Dw^A`HmVx-ZOfIxHO3ihHGla|RJyqm$zxBM_EaU=9MhlJAPWY%b9m ze*jJ1MB8@a2ref4gIg3>c(fi|S%|b1+#q5?1ebyGZPPi0EvKTA@~Vgz$XUMfr8hDG z%gIErLY!$YCz4;0=Vz-CEi(@a9Bt&~ytYeLF+2Rw%s&v`>6f5N5v~a5+IQYbO(P=ro)FVNf^1AchXW=eiKKiAi(?Vu_pq%=S!lX^;h$>?q%OJ7i zPf4f(IcCwB6e)(|@PGn^Zq1;;0Xa%wImr?f2Ls`hjc286Q+Pj`2#M7pV+W5#X{}Z+ z;Drw3n+9413LN6vxD!6fJueEBXdZA*1|MY89eSm5P;_WUfLu9c^Kg@AvlWv<;Uoyb zQlqv-23;bPZs8j;+65ioL#rwenqqi?VvO#p(H#>PbE&Mr&mBWm-aEVl!+ZWNI(}S2 zKIr@t74|O?otcxn;V4E4`R|vwcQ}Y)r5TH2b&AN3B>suGFdPn%#Zh*L4f0ZbFw7hf zOS{}pYgJG$bjZ&|N~9zewDm~Qj0N(S*HO}1blfCR3nMn)aTuI8?jdt{?c)J^$zgJAWI;%dYfXk7kI)iS7bGNyKQxHHB#-$SG8wdD|dW4uQc& zF{PJ=PMcPzwFh24hoJaIC?d2j0n9d_(-tKsV#xiLfsAW}lw|O<`>l^{MJMo8kN=AM z9fJ}ZIRPqm@kYT0a)>{(ZO1>Cbm$ZKkft?fG?#QT6SxyuRUXd)o&vvzDefo^#^*{M zw98Di*#*WRMya@9uZ8Pwl;8B1pi~8uq2nKa;nEw=Z~7jBwD3*;SKG934UO`f{!S`_ zelyS!MGF_hD8K3NI3ega1DzwZa8--id_ohE>FIL5hsD^ zqj>bz%-Y23&-GF0cQx-)0@~`m;xDlDk|Ii5x~|yoH{F4vmlPoy?3*f;v{*O{NM^-< zfMomO%eU2P9txlox{|OeJ0(*7>omQ5W`O6|3T<}cm$KRP8jy)yI#}P0RH^iOy@BGb zs)0b+4A@<24%#5aLoihZ0Qs1M;`s`eGbIs{k^YHW0N{CKC`v;#zDk9rhcd9`Zsx^9 zf%lHGA@^R$U%{|@eo3!Usggl{K}kjfA}C;!!Q>_Z=9B2;9|jxR>>5y_lMUq^1BK)H zlP%>ae>s{C*2V+c4CL!+G%8i9Sly8>hc;IvpunWmyj)6J z@z+&wlkepv0Y{S+<}DI2glo_9hpMLT?WwBLirQj=8XE;>`hD_Ow!Vvu9EJIO2w zlttk@FtJ8nBO-)hbLX{1S=kD;z(zS46XbY-VoYlB>J~K`L#=2Tp;F~wlf3340mPHv z<~ji)lN#qYASid*7|2lu+C~eAmB31x7c^uYag|vG)CzhPKdVxe$dhsBGcQ3i(ST6X zDdPTRjaX>AOND!H4AINadoWwHGpuZdM0qk-i}UEqk4%NL8f@fOfKc*c&KZSyX|Dc7v55Obe`2;As;PgbJsg2r0fJ zT}n~#Kd#3pF4jrbMZD#ug#?KtlCVMve@Zro#G?k}h^sB0FNld7W}4##Pu7oRVLVW} z?POn9B)-xjPy{`CYgEE)g#dbl+nPx~$-9I@u$3g}fE?P6$V!sJuaQznc0J2OJc=Yg zTM=(>P`D?t*`*=svP>@$8E}v?sWImAE13hMkMPQye#jJ|nUD~nc`?x41i~w zR16K6fPkPxg@YUxVL8unbh#MHEN=*j4W*U4P+C^d}-!iM$+6gN-(7 zRH_^XU-PV>EMVj)-YRV^)(ntXRRTm*eLE|VX(YV}Kjv+$fOI96Q!p?*f1F7gT^d4p zQ>K#u^jlTP#8xokM?{>k*u)AHpez*4 zV55#IXK52|j5w5JR(hC}q6j4O<(4}>Nf1~fd#C0}tIPQ2v0=qu0+%Eci|HzeJ;_t2 z98@8q6qKK+QmMT@oHSeyf5P3u$6<5wKm{Ll$n8?-D~Q1nsEso2AxQ~pOC3BT3#LR*OB$*CiFT-?liN6kRvZIc1QZ!W+txvJ z%0b8&y0(rH<2y!7TgQm?9V51_W5oH65!co+;-@7Af8;+%swQE98r+MVV|TEefP_5e zEMA6!=LeNi&Nn|3+8qK80z}&y?+*shj0si($Z;&EQK?dSPys!Xe%;$P61_tETs&9y z*6I?7LRle&rHEg%LhnuJ4Ok@LSzm=siKLO`u*JbLP^0>%SZk^v-GEFpqMqT_8GTq0 zE<-CTe=i)weoC4FdTbWtvaDkiWh^Z)oAupje+i^Mi=Ikka=VN8c$;mbC8LTmnRum& zg*Gw6R(P{)KRiVoNyz~aC&b<|v&hP6fpBw$JuJH?f`a9?d;@xOvAZKOus2NayWp|` zT5P0jqBq6U>|_D&`O5dhkqVQHhkzHLgHKech|(#$SpmaxcFHERI^{%qyHl_S!d;xw zf3IzZ-OQqSilndsNlWbNrWjmzLh{K-$2&#{3{a?mka3%9-sYavMf{{Y+8PgyG~F^M zWy1!%Z?z*qT1XDs*>Z%N!ikAB1VMIbiO0$0#19+3sWzUK!W|$q`8qNc7PLHX?sy7M zAE}ih-)FHui()`L!7!2}ocUX8^hRvef39X@d??VkgGu~bSQRW+ir_anISEyo^yWE6q?g7l1Hy`+dK zJo`LEV~eCNyJlEM3O=ZS_~UlA9GWy>0(RHSM1V;&CtW^@5X+F@SP?5*0rX~yf41p0 zAV+ks$({(={h)vv6Bu!~60b~xg19tU0TvaNKMx!$5Vhl#JnbMj~ z@v$-S!%VTUaYn6axWP1>f`;L`_*ktrI?kK`w9y*$zl7+-_?U#@cWTjp$*zmUCCt=7 z8y_1N9}}aE86F)U4bcBYzdbbJe@|iJ%wdRAQ^JX;*HWCO=N!muQ3M?}$_Pa-RC>mY zoOFPHvEo3vwxFI_P?VKXB8?)$L>%X^oMv&255?RQ7DS(c4uOY!+A(X?ql*d(?c zn$|7?0hh!9VDE_RyQ6JTCAt_X&!4@olTe;Gi3f?46ym5TT&?7cc<&EEf17_uA|SyX zv~2QWS|&D%4Y~~)83w5omyxm|;uQ~yWCp8Jr4r%5NbX@zt46U^6>*q|PsxTPnQ$Y^ z@T?80oIEU)cqUR%ls{zBHb{QNF%>jpAyJ@7o!3u40xvl&5;!AeQCn-Ww{E=dkX5Ij~ly>Czd$+y5?i^q6LSA_pYHPl(^7Q6m6)sYFs|T;R1>JiJ@SwaWm6tjV&?v~E0AhFSjHitrz14z^ z7YQ1u)ktip(RfLkDAY>hfOdaBqnYsfnL=%44TFi4V+H+@peM8n8cGU9yC_uUOC3p} z0l+4Wl}k>VB6!^Ie-x`KzAl9>_iOi}C4~}HLKRz?RP-W>Dh@YymwlHV$g&p&k}Ka7 zcfWfUfajbHUP$GUvlvXM;KSkgQgDhNN!w&`!w9d0-gosG({MO zSdNU>it z=EaG4TrsQ({eXj=@jsQX+`kse5&wxG6<15e?+~7NSoBCkqaWol0dT`r$Z|p=(CT7h z$ubtxcG^a9HkW&z+&5WxSLs&r+f6I|cZgK~s@I)0dI(dP$lUXJyPP~F#B{re=yn=+tB5bis^Q>&3oMoas zO~_6y$rztegeL@BvWesmG7Daz*~+g|ipxWAWMZ)wxAluVKC{JpEz&;@X?eJ4zt8W| zwIE`&v`6tk(K^GzpA{>x*j(g5TdX=~_s)t%b3etMf5sai+c$#f19ET1gx$a(9831$ zTAemR8RH}|C+WCJ%EcA66;fwJEUKtrW}XHVkH3%qMz)`1Kbml=o5B5^DUwdDND3Eg znRoN5f&``I5UC-X*Cv1I1;(8VoC(uSGS|pl5YJ-~x@~oYzM7EmbAwpu% zMDvuvChE5g@1U?}$LhqHj}}DN?(LzB$#6Qve^^@D1}&HX6wK4T<&-%?vg9H=CXxi$ zNZJzG-HOJDF^IZEB0k<%0ievSl7AE}H^NudAj&{9QM^_Bm)a=)rAjR_Sn>&=t^f=a zG)9(#8hKulw9(Pg(PBerw6cJK<&Xo(Ku*t!B1;lww?`@FYX+JxG+j|5$bNYhLRUdk ze_D-JH`FuE#epv=cH+EvmJwj3pds+`da*c=6?rfYO0W`1BwpV{^KwZIA~Z}c)Y2%umlJ(x#zL^lhXUeYL{Y-7a?xC6 z$O|d?)6=mLDJ`063MI9~t7UUq@Y+%WK-w@Qr2@V9xW_lK&Kq=g1d1=^qoj;6f5^!Z z|0Za(Q5;l@0H_J514w|W+QmB6256y~h)9)~ea=FzX)+sogf{GmIQ;NI}iD)$<&|cIaVx3={M+ru&RHp|+e@|2t!3sI| zyz<`B(&TDd91Is|vOOc|82@uPim{IcOVhSsD;>3xHTdR<`#5QU;AE5!6 zG-L8jgrW?rQ}6;pR>s|%%`>N}brQj=eh?15Ry$ae8VS0n0n*ph6k}3*T;~=+;&+f~ z?pA<2O*JXBpWLhF@g<_nDDSb0^t~}IQao2yUee}{nis{@6zS|7f2oK8Y!0~zS}{IK z;2@NY4bR>ZzBJ?`q?BE^W-KLb;T80~t1r_1!uNtaoE3=Q`(CQ1^bixNS;DbSq&Znx z7BhNPFuD-a;Y^US5jIG0AyHO5;2=o^6IdXoLk{MNGDfBY5z-V=_003Dz~ZD$Fi7Sc zVYN0XpH$ghZG|?we;R*4O)_9fZk(t9Vw}(hD`7!`CR!6MZYeu8ljY>NOAeA$bROyF zlzg|GN3J7Dg)o_TV5do9k{MEhlS7t=QfD-vnX@6AN|qEHB!`L=kMr}z{UoJ~ij(8c zXw;}w#k8D;FJ)7TNB6w9QHP_f%uX8*1y4XEWfHS|`IJh|f2&rW=!og^Uc&*_FcV1x zv80|Nv|QuYt1OP99ATv5ANiCWCi@St!fvqS0JRRpGi@T2*6zdpJQ}Vr$o%k^+@f-=;`A%(L{}m z*XYD}9vnkM60gM$SXbvr3=YGJANC?l_pT9eTOxp&!2$`DcL4(jsZue|Ug}5-I9maI z+xNW@GFTJhSSM10v4=y9fJFZ{Kr4laT!w@w8{W(;e-b#PT`wjJPf<)yyhbOp1%?%r zW%4+xLPL1HlZTuU*}9B?`4gs1@xSpJT~u_mx+o(zBeggKXFo)^mn)Vm*OUSV`bK3^C;(kFy)i;=iy9$t2G^P6mha1t^MRR>JQjRhMRrEazZ3>3GVW$}O=< z#6XFDOHhrGqT0!!qhx8yoD;VaF#xo{Lz`L5gOrpUY05GRay2T|kRcQBxu6I*4zi#b z0oMpnB(Hl+LduXKI8(-lL*nV6dCy~I2=tVLe;!ZTB!Y6S9)wGFzgR-TzzSB%)zY=%T=z?5u{iu7plHM~_cGFboIed26J(4okG?XG93qktHk@(sk0BBP4Iz=o zfA}|*8l+gp&)C)1>l1eDa##u`h9kjMd=SK48ofe82rO-{1+NOh9Mp(m7h zV3is>A{4|+3L!7_3dm=tC% z?o(y{8DimPV*9&Dr4qjNpLEyv0p&VzU+_lAP#n!lkz*qJgC=q?py+L4A&)*UF-U3m zQ;Z8yu^S9G79PtjjiW$~>`??Z9}I5K$?%pS*gjy*X4*(oHqtDBiR5pumg{Def5*(Q z(-zS<8X*5w?c|}_Nb$%@AiGk0h15^9coGf*3(8{bORz*mr;z@8ch5&H`rK96lnoTr~uaB%XMmj75^F&CCkeg zg?i&vS47k=Oq4@(%o!z-g#KY?e|e-cB9%ejR|ceqJ2=WH;PRc=mnKk*iQ-JW2IR54 z;OCM$WlRkcCs_ZIOA%n1FCE&+`dYYDEPbZ#wIni{P9~9S6}vUp!Mx~9O|wz7y#(4Fe>O_;x|?Xc z%Smpka#y$uOnH1(M?Pz&E1{Skf{}5@(GtT62^vH$5;R2_sp)wc8avTvK`w2C3=dVR zG}htbXp2<5%}^*qsO~k$}We zD6}2xiyBoigdQK4E9gqqe{B?FaUw&+!j?l0OKu0`uz`(49mSYbxYD2~`h3vQg#6!w zAI}OxwB6!qL#w3%e?b}tW4Y9CL`O$Q$H&IvKcl0gz5dk2>k^_vw6SqfwGVWnb8zAE5=kDADcGGI?-4dH@sB*swi7XGp$ZDT%*;JH-gIn z$El}EGA6^Jxmu(i@?rEHQUp*w99PK#<3L4v9bv>$RG@57Y8Y%EKsc_ zgT#%u<{O6d73qc1+CqDL1($BEoM|toIETqHA*PUp*0KC7>ma-3tE-qaF-(^^%EHBE4v(Fc#&P*YX~vB4x){T# z2?b;0D#w(iXB0D;yrEo}8KxVRZW@Y*F=d$( zf5v5(kDHZezK(@w#||6gv{j1B3GDh6t80$!(_UInUs*pm>iZ# zV;nKMNoD1+h6#`xJBtzw6N^kd%S_JZTnW%Pvyfq9t@fG5iB1=jIb2&nrKV4U(c{Oa z87;$Sj>(FS(UsB}m8nb-H)hhfY{QtDf0@O3Ii}IE8O4=j!*rQ2ev)=V^yn~MX2rOY zG;?urW>J_f6TvYW=4gu?6UxGLqjY1-jcKzcB9fb#?Ho168k=RA98Z;%CZL5&k292H zW>b`PjGeW|6cr7pbcGJ*#LNV<%~3faCO&5(EpT+HGc6`QHU>JKX)$T8*fIm0e`PBu z9&ZhDjf-F%&-FU!~(%o$Z6x)VH1Z>j2@TkbQQ+t zmX67EC76qySj!-K zrhUO<>KuJ%KvQYg?Tn7%sDO%!bQP6Rnn>@jqA-YniZp2g(jlRT7S1RjDgr7>hlnV> zM+gK$l-?sXloWb^goKuaRBpceBl(kh&QsRfd+leh>rQAs5`%{jH_L#szFA&28?L=+ zllUqDpO=?cEQdiEK9y@&`lV0huzbkL`jHnTFdhFf7Ss2>wWM|yqTElia%3&bNeXW7>sntBE8@=hZ@$MeTBlc1&sdt03l zWlFkf|RcWMF!nwpZj(+zeOIr8YJYn4vafi5TS zCj}H-+&1Q=Copo>Dn84dvqM*@1+h)&pzb$GwGZYlNJ_=-ifuEx`$c78*uAZv>W&t# zgf{^CuKbaHC)o|yYMHg(iK8NvPZ=4zk*wN5YfEIIJ~R$zp{~WmH+T(})?-WYkWNNp zBSg5oo&M9XIjkEpSlC+IRMJ8kl@TShhOY;W`^cPt%gnwHai50@X}5SZf$%ZQ)AcH~ zGBNXXtY^AmXi(?narP(inpz9m?$|dhP!kWHTCc_^-7h>~%yp)1E57RLCFW{yhLU^k znTKHtDh+z9QRSl!@cn1#9`RZy9dPLKo+Scpuu?4}gq4zWZIAnx-a#6pwicnSAY$wg zTCQ5a#voE7znMN{ZM%l{!H7s{>@rt-#LUn+P!A4y&!~5OX(?^HL$o#XBv8$zr>Yu3 z^_Gx*>v`8)*9yGL%F6<%sIqmkkzgJv?&oFl~ip|p7>%qh% zxwv4`Y%YlQ&IJ)&QxB|KdJfYgh9AsCS5Gw;lUsI4<()Kpnu`?3Snz3M8ql8H!Z(kg zbH64uPLj1S-~C4d{R*Gvv|b)9k2&BmD?MbL%L{)Ljk`eb5mYQf&}L#^i8^GB&~6)$ zuF`BDp7ebsdh0?etXkU}DtP})<0}gC9&cj|d389tcn?S!ZM07JD{}*aduoLOQfWg~ zqgPI{r=@r6S&cS^niIW)KbRO8T1Pji6Y`SYAkr|J~;CXdLU5XFs9Z@)I-un5-bnV$8J~^L3aG+Y?_M;b*jiW}oOl zktHzzztQKYs_#?S$K3(KESS6+sEtE~EWI}7bHgleOF;9yH-N&Z#W(m#^j;tiGMs~4 zeL;Iyku!%dBaIXQ#<7upJ1AA@xz<%AYnN1811TG+vh;J%s3YlL_e)vzGMWw;9MU$$ zmdHkh_kXn2O+PssATiYv;)YgtOp)7n1C(vE_=6->SQXhm!zE7=5r!!|Xs1s(mBtY2 zP^^iUCCNfYVLc5tl`HKSs$sqb`Zqo4o!|-(AUqOD2-(bO)LfGy+cX*Ks4fKCrjtSA z2Dx#x5ME}io~lJnJo5==XLFc?(C|^^Q|=7$y@ZH)1;Gn@stJ{~Ms><1K>RXFfdC#t z|BfhbU)8Zy-zuh*6t3dlsHOwZ)fX&E-B+A>Moc_Q&+tnOwJ@P^P?Rw^np(rc;Ps81 zOEj%`)$va{xQA7(Zn_#kLTgv%1scxj{KHl*VXfD(&+84;z0198SBl7$6_r^ULFNJf zlz|*Hwpa(l$1Gx>5%7S$%PyW;Hk^Kq7!d2by%<{UACDvn&n40n+c)mnRZs>!_Uw5n|)d z$4-W_jpj8#d+@jIuGR1Tn0MeZKxzT*zq_+_Iw79>eC4G{tz*wbVO(X~!u+{tPVRw2 zE4csTRbt^mIivkv3UU}`jK-EfPMP8E*;qq=V?*Px<(`}=GQv4p$$OQtn$UO{Goc9^ zF!(n4*hybAZkO=sglM2^gU3B=8`R7y-(jy;4glKfTB0EntNP4tJEU_6NiRUgj7ll^ zhmzmU*iW-B2|CN4Ei(DhX0$Rio9J?aG)b>qFBl8o_+Vog;L7#n_#?3$@z=+#f%+%v zK~wf8jB;6~Wv06W+hU?B&e`VUrw^h%dI&ZEHv|I@UxCG*>9Hz!O1Hhgxs(pk-SIRA zc%#K;G?cBOBj9^Du9dPjS={?hm*uryNi5+;v^&|_PMQp6iL#38>xi1#d;BlW7q3_8 z?XD#7B;{CjtY@3r3-U+lD6({;hr`T2F9#13L9Mj4K`<0fZ{0jmbF3xeHfeQr^-XQg zu85KjW3V!hWMm;4CjIwJoqK1gsx@F9kI_J5lZ;3(_jF1_{1Zuf2{ z6{%B2qa58#mW$t?u(3|!PKJN=J}2-J;2l+C3K&6AkUCY>lF%NZE_yNtSsqGhc}uh2 zlXygkSb6=n_xDF-{{giLjk9&>jP+3jm{>rkTV$j+Fb+_7=x=!!0cHRg!^TEl(f&Ev-^g=H*qx8v;R{z(*-JVo1hUrrlFuH;nR%V}wG*$v33#mq4|FaB1y3!0ta zl(J`$f@xB-Pwa*&FsOK`Gam8Pq<~dJRc9T}ToJa$+{#KM{arphdUy3Qg9J(R)J}bH z|EbLZPWh|v3`D33u)vaGdXwEPMHFA}(vbpt6pyjl-``KN0@OTFbolQI8<^LnCQip5 zZWz!^&z`F$?v3Bn1rt*ZW1Q)WFIa<_%CYWYZCksgsyN2_%QB`yp%E@3h`NNcziu;< z46XAU|978X^0y+o97@jqa}h;(|Rt(SFN4~y=Q-mu@Ym)4b7#QrJt0w(T`lqc`KWm9_Z(NQd8VcQ^_gwXS}EJw&nEb zK#v=0hcW~u-w2cfVaF_dWIW|@(@8x>OZ&WkH|n#O4uUqKg%|sMu2pe6qrCd|2Eh7r z?J?@KJ6K_-c-(HH-G0k&6OkM$Hq*txK9b61<RGbUA-nQ|*oQBhgq&QfI_znxRFtd#T+WFZ_(h%~?5r(Q8pc9?9 z`fO9_igk+rDq};9Ljg0_t zX-Hws327|$B)4yNBBNipC2X)!P|bc+`-49AH0-PhYXY8zHmqZ=E-?8&BOB_-A= zad_#*X*HIqQauOLnveD+o?tAUU}MkAB=$$cEDZ<4OsE29Ki7r*?SzV2S$pRv;h6N; z!V5N>&0*mqn#Z(6$~7eVM0 zmO+~nT;H+z!Vq<^?31nM&*?b(Dd0Qz?&L%u*!2-){?I`h0kRbGo>GV=e$RUKAjiu5#jUN42pCn~0^Hla-p>&wf%uwyH`3_TTQx+@~EZ zkj+8NdG&)-&erbEBrxBAv66Vh`Voxrt)$HJ8)uEs?)tXMb;Pi874c zxHFaNkB`1eTA7fn4FaO*h=fKh%~*P6Ykfq z^WMUS@nhkPt;@}v`uwM!0y{yX$ds%LI=Z;N|OltCMIT2(sUfY~Pt zwgv*KR(4J-}Zf zJ4G59%rBf%3T8G$A zprM{vKEUHRF^#cM5VnvRx9_fJz>Vqedc(xzjQ{-x*-)$xvaXRl57s~S={z18J847s zOWur8*i>(@lwx1vw~jhonTt8ls49sbzpe+uQt@-Eu7Fwi3}jvYU|M&cgeh#frlGM{ z)SY5d8QYztA=2mPaJHdtu;(<6iIqJ0iiifBPSL{&V%rFX;|s;6sc)O&#-tp-MV#Pl z^=633=zS`Hp*_2U`8|1{JF^rrqZTCdp7m2`7c9a4{qd?X1%?Xa{fgIpm1}?g0s_?U zrbeOC(AwX9yo4`kQ5c`)Z>$<^cgYB#&{-$eV|1ioMou-omD;_n3g&TFu6vQFWeI zscp5ybcv}i*Tkms;k07?8e_Y}OB zqPF|Li{=E=;+fK-P6gx-t%F!$sqkGIameU}($@jFn|;;wH9(31Xq zQSQy9YJ{)g;M@Zp*jQXc9xiaF?skX8Uc12LBf@{g34B#R?}L;C-5bSwgi{*<$Iwfe zt%ooesWcpnsQ^gVAS=Fnc{cy$wtYL4Uw-P#WF)ZDuYhscUzw~EblR2-I64v#!#7$g zquS;iu2=8~vZTrGrgtT-&R@z+Q&FTmnKSJDZ&rqEudT3$J3OO(Y2(Iz!1R|qgu|G) z=RotrQkRIJo&UNoY(uY~XnoElh>dP9CNvIvwJb0vh{nJv&oKYd1L($q5&eK)$_Ab} zh<^OYj-#K?^Mc>YCBx!^QS~ERzkr(8@divL+y}mKp24D6az0^$l0ocE1aTyYU#YgT znJNW)(JBXzrR&mT zxv2)(JQurJVOv=RLr=gfkWT|}C#?`RQ$OXK3gHS2RbB-tZ}R8F$-Iu=;y( z+p5-7Y6i!vae-DTX&HrybF8CyrDIMVU00;bp9!C zB$I7OmnIOV zmcaaOR_O&Pks8d%pwq|vM!fK)cZ&^Pq7V!hZyfmR zIYlm_;ICBON{NLL>?E5`;!6B<#9)cKTjo>aSmbW?qjC94aYnD?Xa{nYcwP&NFI6$D zvB**}ra8@R<_#2MJ3Cv5X5P=AE2SWq$eoHxS=T0|wix$=h<|B%HrTj0cbjqLhys4t z574OkIY6Pk<$%vgpHPu=J9YkiWDo-67{jySXc3v{tpxR^YHOB1Z?&Z-7eQ!m4$PT~ zqIai=W9ySM($5*Qy}RG6cWm=qT;UVOnfa$j9|~4WPgBJ8RJP=B-))wnm_8<3ZAp-@ zi`#Kn{-*f*7v zyAwLDI6M_m6Kf{A8(=tGdx@tv%iZ2wmyi%JoL5>Cts=68^+qeD4cfV-BSV`LHRj7d{O0nItLIJ5eJ0zxz?9rmvDA;kGVp^&HU+Vs={zzdWZka+4h%VU_NwrbzYE zo2m}^pVcauPJU;t53m3(ZuH*uN-}JNF5sIW-bUqhaU{W~tmVIV05pDkL5#xL<;UWKiUVv4$a_vTL)Dgrkws)vM8Bpw zVj+)7^+g7=KP<@}MjK}Z}BU1lwfLWm{)9^ciC8Ex|#1Yulc^TLYAuY9az ztJMpQ;(wO*BO^vDu{AO_c~ALkJ1e^aRpnsTQ>~YzLBBhwwH)64%puEa{Pf_`eIZ*n zL+(hizO0hTeb1qx&0*1t99HHD)seYpT&iN^E(5!fk!i2QfWu#gdt!;{tioV z{Ja4#d~JeR8ROqLYwcMJX>slxXea;h8!zeTxbu+L5he&1X^a%HT_?Ja>Qfi2}~h6)JC;f&qFHT9v>kKc#0A5jv_ z9bjYdg|08^0i4aJI<)q92;N8s=r-xcJTS{!S-Jjqt&?$UC=(bfLxK@_?MOkkJVik_LHH)+&EiC2 zDX4;y77oxY^R!Sm`IO?*-AUu6MEc}Q&(gF_DZ2<2z2&~`!>X6b8QM?y@@45jRzC^?AU zd-Mw)d|t^%b=q*`?F!{3O1zHeI``2s;lDK&3ku+kKT)ipt2w1@q?{agDT3Q9Gx`>l zog<_wg*Ki4$e()qQ?xyWrON5^6mOAB3sjzb}W)7p4{H6QiSP z&%3hligs&C5oatNmzxm1Ioj&L%Qqab~oZ)06z5C!w>=C_j!CJ*I8lFRF(iHlwV!YG;d%4zK)r znY=QXWp7NoAufx8K0lhT(y0%>-Uk0Lve=!n1fs~y+qwAN@*DV+us!F%V@F77`hOa1 z#_&op*?*olvnV9)UD&q2Ka5>QZmD1AYWw>c zPB>!j(nc)i{kQ+Ag29839C7hLX_Tr|wN6+-6Nlt>3vkN zZ)%B0j^!A7a6e=(R>qD5S_92pB3#tL?~RNv9S^MGO8 z*roR6shoscsAnL;C)POd$t(F3PYff9x9oqmaFuAdj+2U2x1I7P7$BcC*`8wjMO=1CMR=lcoypg#q9MFkdq59c=eRubvLcJ(I@Vy**%Pjis?0K0^T4{TUSc=8EVco z1NR@7N?5{-pl=7q3-lrJNT0gus`L&>ftE|F6|lQ@Mn#D6E;)At=~b zqcX{AH&fXV8duUrJ!7=QWo^BL20(NTMOdLT(-;+R+$ZX01js1*7J0Vuv?v9;-c#tf z`eAa`m+ttcd#KQ9jra@obej1R>0r$eIA z&tY9a*CN*CrD$Ay0o|{ryuWq&zLk8z%a@1#ek+@cYuMd*fA@BG&WafJSmZn24|1c| z)(1>2AfK6hFw$x}d)Fr(L@mlta610iOJIuX0OiN+PbFIXnq=qqUMe_txb&wXwvPAm z2O_<+z;#3VJw#E%htSqQf21W!sV5rIHTiWw>`rNWG?efpF%%eGKiBLF5Mbv@D&xFm z+G68ef6buv+pE_O_Gd~4qiZ8iO7%uk?+xi5MlgTEoSM!i2HVw2YUl&Y)NgBNws)|Z zts(%`XlXo&Vht6q0h~T`^6rs_XotP)%&3w!nKT~eX{VTw0-}vhnF;){_|DBW9_Uzt z=MNUwf+JNw<2VMFuiuP|iDZ15feRCiRJ8l^`4~b42VXaUmO>$cn8L4KvnbTae)Q@k z)>bNN*r`#kL3v?p18%}iKItblUCE=ZTXR&%DeNZ@ZAI@yVcgRnX$R$O%P=UfldQd2 z5Pu7M?IPIr&UlHXc+34*do&RJDalE`j1PvXT!2n5^0jWTw&9j4s708ZuXkJ+Ex9y# zMEsTTo3y6BAwm@5>&sY=_LVeMnDN;YgPXEn*yBbn+U)-rKwds~f5s-ub$g#&y_G6k zd34w)=9vflB|M0T%h??9sE>~h^^#KgWV@s!OK4M{Tm#^ zI$zVJkF;70u$jx3$gdl2-gS|{p`c^lYtKu~9UUvr zs03BDHB?*Iez}@4f&|uGL$p+}K?&CW{x?);u}4(%^vcZqGye3e1?W5eXCx(&de1*o zFW`;@wZaZx6CI#ZPhTiAzOj_VwELy&f~lG!w6_n_V8BxYHQ(~_>cMW@yy2<Q-_5_y6~%;Un|v;OPf+v()`#Y7;vNci%M2$qc#j4I5RXb(0pw;xB8Ca$iEN6 z7efd?1*6iqIp#I{TRCp)&ZDjsmocO2RJ?bg-nl3y)#c|*OPHSt((Z2`STQ0ajh7D4y~UCT#DDIXnURj1J^*0+ zDGgJz(l^lwy$4}K6hn&4|2R@k$w4rc}kDY-(%0OIQ!~H9h25na@70l&4mk^PyWi8VQnQ98F@z@?o5Ez z-Ic5T^7CfzL*jDXAMwxb2ZsMVb>$zRU!?JHLGrbuy5C}A68~4^d#7&m%a<$a`f{#c zatf^HpBc~9-F}U(MGKvg@&l6>G@o2tC#y~9%ch-=?I`Mh82s1yc^^4RxwGqHy1@<| zzl)lrvzMNUKldidOK10Fy?rS?&OPdJee9BRe3>}5S7E~E;p2A+w1+QJQp7P>(FP#p zU#YdrFAZg0nIflS65r&vy*e^|@8}z8d9@GWuWuR!)%_eA@u>?VemPtI`_avRG_Px3 znaPp*x!t&Q?4p8t>x&{;??|H%72Nx~weQ#3Kd2Rzn2~pLoH|df_MV$Iv*eS8ONw>vfY??sc`*1sOJRZDw~8 zAs&Gaac!udbJ{=qyXW+$hDOZZ&A#yn{PhI=-*VBf!WWV8g|`pOKq>C^7qiKm!)owd ziI;C){=O9XTKufO(zUBvH$#tI7I|YT^mg%sJK=QXi%X~TAGW*w_gZY+{?sYz*{rp* zn=(lNq*Lumm;AY~4<4Nc`~8=UMEoLO1i$aQdbZ1jz)IYtGly8ci$crO1@hx7!dmCK+a?s& z*zKe=k<+~qYTk)^HEHSmkmqcyb``=VdNvr^E8MC=ggS?JTR z@&IAySpIfE+OS(Re~30T%}w0e(sqe}f%oZ6UQbl9b4N;7N4BNUo%*Z~zR#-b?wm^P z=WEumDs+r~ME2xHB(RSp&dB-ujg~%;qc_H#gVg?vO!<2Z5slGpVdsBwo0B9o>N`cK zUn5~I@aJrn3Waq}fXfaAZej@B!Jj>R;Grm5dYqIzm%InK$4t_)nu0jq;`^~Vxk?m# zBz0)*vZ`upc1L7Tx^>Xctdfj@BqMWkD|73b2Zb8t{pALbrG|!EIM5U}h->1l`}e7H&YEb{qPNm zcDm#9*X^UCa)iK#n6KJo#?m^IRHv>2G+uCLZ zGa~>ltq>$Y-xPvD$>;+)F#tAW=q)H}N|C~N_NHn6Ad!j2@VFi>OGYnz?Kd}!k)PDP z5O2P+vNAfis4rVEsVuO9kQevY-$QqI2OG@`%z}{Pxbu>TcSuQP3cOGj1Qf+?!|xf)T@v z+YS6O01}%eudau2X?Pw(dUQS22pXmR4@MboS!!i70uxnL+(n7IbSVm2QRT$?pH`r< zReE0(7KVj|UORh^uA&(Kt}Xh)rMC7;PfVd9DZ6Pt(_7BZJO9t-$QyxTb^m*9&_1La zx4%^zfWhBLAJzv#y`zn3xBJ42*(XAFzxHS>s;qq`t<@&c}BKkQ2>Sc>VJ58phZ~;$Hwa8!2 zWz1eSHa?&g_)_HLBVT#oO_T*Hemwt18+a->%DPv%9`H$bb&y+e(R&^bD@)Zr5o#uk zE7*G;W_s>%=GqBU@dDAir&_O9rLh7~UmDhb=ZOVr^vkhpYQTk6~0>1soE$ZjRGMz6%Qs z4gU}&9Op^nU`cn{EUrTTI`pDwGkg2mg3Qg+aX0rmR@DbN`0_p}Y`^bU zKnI|2T*E@l=cFv1wc5Y<{u{eH->FLd6q8jG3~P;JRgo}Py`=j43uf+nZkJMk{n?D|X`C zIc@ifQUw14>gHl-IM*qn^v+m|c#8r+`+0=9p7{GGoT-v8)=3)2U*8-Z9}gHW5uUG@ zgB;Aj;dz_?j5|6ktHUdcU0qk_x&`;G7mVNd{ml_BF(X^;d3*`5v}rYWf>Qzqv1i?C7p2%q`V6hZ58WH z;|(lT*Jv!~2n6Byg~e{}m+w|AobF}_EOh0*=z{}H&!4Bw2u7`Htv}3SE|#P}a9GcY z;Ea|)3*KEbBFITTGHCH4eFf$YQx%Lkh|g{#(~vAv^Y3GyvU-Q@U1RpTlts>^%qUnD zwrMy1K7;}`{+H(XpZ)dU;IOE~tpU4VD`#|S$AWPog#~75eqt^zrF%00g`1o)`Q8c7 z&6b@H>h`Q5J%=X$->CI_uhwaWgaG4G=7-;}7rhN1hl8HCJGuJl)YJhtaYNvX$7*A3!Og8Y4-!Rzi&{Q&t=ID7w98Mcu`Mp>496#VTyy$yeb3RTeMm)0D`hiPfzc^4q*r}X$Q7Z(Yr6)?-i@NYG~5+qsR}Z1TlG4J*?ta zSinmHaZpBhzcB!h_u?l0jc$t%@BbqUc5&JU`=xh?NwWzy1BhAHS|#y9@KpA&W8Iha z!bkAoL+4Gw$NSWHo>AuH5v^jqIE{+?H$`0;WH`W#%D4+~JJl;A9^Ic}DcDOyUCtTV7#HzPwSh+6pnyc-h=P*C}TGRxvLoS{)|b^SIaEWpGd?DfA5 z5qVml?NAl}#&M#`M!u_BRI&H`%GG;{6ovSRgJNw%=PP=Cu`%J4>H3!T`28dXwT1FQ z%o|ha;s^8vG}ZaW2oR~%>tGo9^pNPse*;sdYTcsOM^j9WQauL_5+4_CMl-o1flT*5 z!BeZLhWq^P0%4AkkieAr!0761#rVS5*aFqcJiSE3ZoAIP`ivRgmT9uxk1GE)YRQQ}xsjRL!%a^;jyHlqt2TE$3 zd<3o_fdS5QeU`=EhH)3rRjL)7RpAfbPuOB+Je5exr;Yv*vj-g)=JK!^;3yw&5uI*? zF}%%fsz@opmg_ zLk@zY(sL?7Ebx(gYQs+2yHUM<{8 ztHlT;(|A2jJF_#PNW2FO5CRq3+E0jA${zE8bPA4lhd;76Um+Tz+EArlvD3<-r+y4l z30W(Gy*Tdnqq+Bgg7uoAF*0^Nx>IFtV@tfOlorDG|G^i7d%44Tb8&pGE=<34oBZR? zUuY&Gd~#F2@k^OPa_6@2Ny;;g?d{cX3Y{WyhHotxYDwGbg614RA6aU~%c6z9Hd<`1 zd9xBc5cczb++;k3ubPL@3e}95G&Cyz(pQXjx0~HPr(!RXRQTVrK7Dqx!Hxcxc5V^tbXE#O1@W zjo6^c$q8GC&+dOGs$XX64NLwI&LL~pVpBet)R2Xoj{&#T)mtMBJk#nM0Vt zJXFXsHCwRZ?br|JJd%#*g|afIn}TNFC0nWFXBL1Z-VZWl)sO1H+h8q~t|`1C@8opp z?dkCK5k66pRQnWi6|y(&XL$5m>h(e9h?^$KzVfx(>#{`?o2SvHW>V+Ros0e~;uyS` zh%Rae0S6cwt@#Vn#}1h-c~r^aal6H=kASvgz?ixg-VULktAD=pu?=U(S~Vw*{4n!P zj)a%2i!qTl<0e+y!FkuTWi7hLD0E)GWvFp0biji%JvYNEq^iDkpxMrb-E!EsCe#IO z%RsIg4;mR^;+UnNgXfF80jm#cEu_rOm!g0-sup`L5-#C|^gyCGLRJD}=xW^Ro*(SD zv@EX{l$w?ou{l+p4Is&61$%v|lTr90&cc6J|XRky69Byy@tw_VhGmWu@`*6-@OG?&)EE`91V-WF<(D zeX50zW@z&N{ImOOrPYgQkSUFCi5Q*KmIf%h`O#cRUe;*+H8gvHn#?b=VtSRMih>-i2QUxmH{}PsA!H-kcl(}}Q zZtc?bR|3dYhYse;wzjVArdiL{cY2L|GuHtd0lb*87iyf+CQZNb`laQ80Uey`(~Xmy zEf(t3S(#fNT|@c#k-Oqb4lUlPRK9j4m89ZO7b>89W`g4UNcImv8%7-bn-B5csN~GQ zVP)EsS{v&$R=){a466O~>FghWgxl3P>qhjvd(#_zSWGMhY!slfcBbyxnVL3N+;!zN z0hOB=qD*P*5_^5TG^Ok=gI2P3nJRvF?mwOVC1A)U-|+?dzUHgtVWg%{ZuhOtCBm4~ z&Tha#0$TK6SVkU@r|I<;l(YLXfc@tQJzPtc{%onnobUQLOT05v?@eHf89hQp;v~B5 zn(un*kR#kjDy~LP-wF)2QLTLa``)AC$9XEWtTw3oZSyx_{0dtOb!(!b5p60%;j6Wa zS-LC_OWH6Kn{9+B32V0AyOC5yl+;d%j^F*mXuc#~EHn(z=L~5)Fks#%PFKgK%Nnj` zHwkv4-v7(6ULo|w3B^~$cZ!JU5)GgI`qthYTkmh{_~S0XY<`QibpfQoeq zaH;ksm?D$Kh!#)~%+|{THo5lK>C+k31;ohvuDs7?nj@;cM=-XK)> zwQuU^M41i-#S6YGYNXSs7fpg0ZkPURNfFl=?m>g&rmbEIS7 z1NXGg`?&zz&c#xl{aUFz??Hh$gG#19Yrc39P{Rk3R=1Y8R_eJ%$RF1?VwOJ(+=bE* zjc;G8QtfuE-KS^2Ub!rUdFD>D&Xk%zM3%Qce=^T?p4Rq^iX)y^zNK`XDQCpX1Umhz?iOB*Tqai%4jfU}*q9$)zjLN?JJ8S6*d)c+KuiV+BRvFj6>r zFGg?|XVC8P%zWK2hM4L#=ehbXWF@(f7k(DoC3D>i@;)L6T)F+3?l&qPG~!JnnK75# zS#@~`Y{uru#e^2!K=#!LP;yOKsz(&@BhcxL?Vslhn`6T}xgfnH<@;YBrvRO)3~)9& zVr-JmD^B^iSdk8!xe1W>D#^z8#2wM?NcVQmhb7aGdqJjuf&;HWha$b)EOlDs%Yys; zj8wHUWBr!?6+k>suF`d3gzB7eTc~&XP*YRT(Qjz_fLA&<7VI4(h#d<`TVa;{1OC?t zysp1vx2$cro}@^#jqeTtJjTK5a?A++)`z0RQ{>{*sAg&~+@@5kSS6#Pd~;967Sj$*Of7 zF3<*FF3j%qn`_9J+;3>^{OnaZ8@Zv;Z659=hy{=0iq%C0DWQ?!{+yfc9jZd0AH#A5 zYfVaDpuaw@4Eo%w5_oNF{#(`N9C#~u{-;{gt2`Umt}2y(nm>CP*j?TioUO?2#YQ&4 zMrXVS1luO$3P51B-W-Y(Y^I4Q3F&;9Eq^O^!8@4~u|k20DxkRl!uCeu(vp;BlV!8- z=k4u#*Qv5mpQ$SOqcg8o)}}{SYf0!Q=vb{eWw>Nr!r<dazVWp3W}L>(2rrKYys zg{&O{sA|vH$cXdP;{h)0yFrv^pC;Y8mEzFjBhS0{(b11Xm)2f=1WL2OZ&15i9c%#` zP!P1Pi{V@UH+&x_I+s@uAM1Wnx;PSO@nP;8F6!C^kB2{;j-0$LSs)QUb|y6M$3@w{ zVy#ALw-%<=h##5Irwmju-{7YQZ*gJam#lUrK(fNWHSye4G=QEEB+sw{WdzfH=~BNa zp$leov)*xr{ZF1vG_|;1L^nv$AakXr!T zGw6;Qc-%=JR+Y?T;5YT~uZR6C^zcK|AMhl8kctmAFd(mcX zc6?m1x??)Kq*XaZX%W2cvHX^I<2*PnUrJ*H>4pXg0u6NZ?loYNc>4^ZvyXQ&>*dyX z90$#yNSu+FA&;V@PsetN6uf``9zc~O{7-yIO#7fL7p}lv?$2muMbQa3eKdDxaK6Yy z*(CyqZ5%tHn@4Y+zb}9uLD;rJnZXx-{hB*7J^d*pS5^JypgCm8(e2Cprz9qSPsYpJ z+b%k!bL_s!c9p%N*+rj*#3MBVnH|}hE~D1Xtg(%bjt)DVFk+fqC58u9lLM=AZB7~K z?OG;I_PLP2Glbz|4!#l39Ni`=pN#qB{L0gHMo=jya^wgvX)vO{p+xg11~Tw>%85tC zrC!91We@I_mDei^9csTSK>AJ{6gUng3QJV&7@{*+Hr zun(g!!2k4x#k0ton}Ip#D*2Y!FJa0Jp-mw9_L6hxN z6si6jU+12{e5^3KG;S2b1moGl2s@nxxNEg^3-5{D!(TNaZaoYjHYaa5z-F4I6bQX39gVf_XgMP#Gvp%1I_PqNuzYAMZsIy?~0XEGN zS9Kjy3wreM;j__JX5xHfVR^Z}B33vq6bb?Ld1nFT;p7UYwpMcsXU26Re7#>#%_9mN z{Y${QQ{|D1zl*|rNO;oMYP}rBhGwAigY^&ciU=@mV%SmXK?TmJ7;ZV#%T!eg3_NQ7 zJ*~J0`jNf*;1*`kH!C-H;7qOV#O!pCcjorA?*rpStDe_yOKX4DbpWIA!%8ts(+63F zZ9wqCA?o8^ms#JlEq)VKHl>F;J3EW-#qj8Z!kot$ue zQIp5RG%tU>S6(e8Zzf6q7Z}Q!nS4|$V9=v;f|dY*7JV_cA(1^b1?IdnU~ThQ=BF!l zDck#wN9^rlv{HieGFXdE%wAFL_6L8v0<9~%+!g4ktEime(-@ai`J`8fJ3a?V^hfy< zS#6!)zgNC}yEn$zi`tt1wdz~>X>NQ7MjW^`;)bY+PFt_;U2zKUv9~XUws~^Bwosz_ zrnHWy%`Gh}Vc3Z3?EQ+-m9@*FqUn^@%^k?*Ms9$542OgVc$28Qy5Kawl#ULdW87K> zXN&>?;Z167$z-#ODtcKv*OWtF#R_78Md%sl?kPLN)6%(PH{9Arcexx@vgML-yj8eV zQ~ms4`&I1@i!Lm^Cshio8_ z4@wM^cE{Vk;{dnF%*8voYMlqeqVxJ(Z>eZ5+9K3R-dIRz==8ACc&Z z@z{}4sUuFy%+V{0ii$dod^@>if9EkyOQDmG;?v(fJ@V?TyA8n`pWpv^UEn6{eZhN1 zC-C3DQnPs`lhf|Za(;esI6N(TW&AROCx1ft_r}dykGZ@V#J_i?K^4YC+?H@ja?-lQ zC1+NLBI%=xaYA7SBhL#i##f+|8J9EqUzj?zIS+!$m(J>7VPevFUaz2be@33|U5u}A zA7xw~QIv4;j{~nCoO?3W#~*U&I(N<-z;#M5iQCrFi&dLaUZ>V4<1zQ?mTW@ zrYxsUn@*jkY#3g0Wy!1#7Jd6Jh6`BsXR?wm+Z!h>c(~Ftt4+s_(79CK#l3=-Ofngi zJvDo!e|cEAHavA}m+A}IM*VD)9!HmP9HzZmIri(KB#G!*~#YNcEDnXE$vY0qzZMD$p8Y59Pc$4p$Xf66(`k9yC?bdNtc zaqNyB6`lj`E;1PE-%;n_p+j@$&Aapb-keuF0;icEA(hyM@J1_!mxwJaE$8AoF!szc zkJ&v2c$G>LmKog3LEU)P5jxLbz8pAm9OR>y>rhN2lmqM>fp<;Bt{kK*ov+=^w?JF z-79Fx;biZKE@!eH?TB$35n8nW&ATT1UY+STWbojduOA_Uf2yjgDz9wo<0QIb>Z(`% z+pAk6HZC*BUC>)+*?{y;jT$wI-Y#4mu<`6jtC71p{Px>#F3C@qRa)HDIg^F%NOK!8 ztSIRA?b|CZJxaW}zfta}O&2q&?&VgNt!mcEdYGxJ-tnogdKwIQ)pK=tqnme+&oguq z8Xi1&aBxJ#f4!HFqP8f*K6jfeGx#v=cLT8C3Jb{=WOKyyvaqO5c_T);( z^--HT$&J|C{@ad!c(!kLGvkalpFX@Ry|OIECmrYgbIoYo%9V|-mcXTxTC~RE zISJQV*-2pq1qGM4i@L1|$;(cEwx@GrUHxBqJkx*v`NwOJNvqo#Q&(LH-Bb4BPH9_X zNRU_AD-5pe|WmqlzP`=V z-aTy<5)xvluRGI_^UIJSLvZbMal`Pe5Vxu(ix)3GcKWn;Vj{=i-+ypq)7q_|YSebUn1-5q;$u@!ECU)?ThOGb_6duFw+ zyttv;$B!TXE`di+%F4QfXAugmKEK&Cf3BycWedE(QKNcv?b_7~_ihv2?%r`K@b|i_ zXBEL>btw*?HkEfc)QpwWHekV2U!Mkh$+M359k(EUzuWhd@x?AXj(mAg^gyTPph?B} zKkD)a@_Hs4`9%d^7h_g){GTny*4bV;{?F0D`Dgs!_ju&jFcO!|aX}1qb&2eJe>XDZ)6PHZ80v8>@5m+iA?&cw{ z029Ko0xl2(VaX6Artfj0uC`+90RZD3JL-}L^43%OeiQO;7q(s;EP`Btuen)GPr$`n zP8Y$v@PG#=i-j=ALv4g`ER53Mf2>6ylE9XTWAzfC)MOapp{{z?RLAtJfjCGgfe<}w z0Hcn`*RuxrQZaGTzn(SSS3MCZkl*!AUwKO(Sq}hGM5sl-^vG;f-6$+YxDZiX?K$OX zl9Q7a?s?F|QYDZpAS6dpFG*>@|7+I$`82>&ll-S{l>cf4P>cMxnIzO)KwbPGXI^N>^O?^-;U#C_w)XT@A9Ol z+w=yK1R_`B?pVG+2;oY9e}D)l3pWmO1$x_LX6otT$@D@Y;=XT?xH1M{-VzJ&Ad){| zF`$>84hY0tp_B&!ERvJh4E7~H+fkNZ7!3KHIM+Mx&rCx06PIn1u`>bUjP7> zKnRGz2yRd_UX$H)WxN3ZyjKV)j)ed=buE-aNq9YY6+i}%D1|Xd`753s67%TS$&es6 z4s!)Kdh`ct)q#uye-WOhfz)ao@dCc>IFdEsS!jKv{V?Jsgh4`xi@``Zgor4DTmLVO zWeubE6$2+5GkmtQ02Vo0zR3uZgGcsBzz3j2fQ?s5*Gcu9_^O@MU^5DYgeas~D#q;rU_806<|utTAco> zgQDCbQ&PYY!j8(PRvf8ROx$@c0lAQZ+{EP>MKyLPc@Z)@m`kB7x~Z9L^_*&2Pc)?} zRVP^;rOhF4Pa?7bYa688jLAjo1O8U{XZ@Je=aBiV+6wbApkY| z{~V5;ql1$FZ^yB>|LOmKkEb5~KNbf87>L9|7!V*6EA*AV8t1A42jSv~T0fF2IRRg$ zM`ML>e+(#8m|V&qnPo5&){x4Yk&KwnjNi0^WP38(86eNirc0qK&{#5aQd6}wObuGO zCiv)p5(xrJ5CMqcf71(h#QK{A=J5n5A|=-8Vx+uS2xDtEW)fH^;HI+W}nf<^0vOf>JO@On@2M(Ti%RKpe|Xa3QRMh9n&qfyMD~jFv>BQ-4q1 ziowk_?MOu@Z8-9fYuF-4tnK7uWYC&O9Eb1DRG>tHHYlM``L**}Qi_@5dy}9g(CK z;;LlOMAlj}Yd;()fFV*sRp8?yMIjy;`$+)R~re+e2= zCxc|Pr$CG$Fi*;bcz{%l352o)_H28$Es!k0;*>mUycmkgRzPx`fEx$kqy`0I6ad8l z$m0>nB`5?~>6w`<0FVW_vh}EFQ@mLMlvy{30w91uu}}&D^8x}fia{U`fcZdrIx%vZ z+5lu`0x=L5l%fz>vOpY5uqWQ{e*}mOkfqZK#6W+0wmq(Wq(TgD0RRFlff$1jKFEa# zitu5nn8yMj1c7l*?i~&TF%W=2A~*@+0m*R?IWf2(1`6R=a}*E>!~&62tZp=V_tw&= zmP#Zrf}xDID$EB4WmxGJNyBZe`;N5iJ$zK=$ljTmrYyihfjmG4fWcuHe}Yqj!tL>L z2==Lo+x}~;?El9{OZ=DMw)(_=>C_(oWzTU?iT|?Y{5=2nyFA+Azl4|%k3(Q-Y#b?h zNI@fCRMpT|-Z|Cd~qlYl5ngu_#zF#r|^VgOzwA;4lFG96n_F9HQ)Ay;zQG6@t4 zc!V+FjaOi63%CwYSyPcGe?qCi8a7_B5MmQW%GR2QZvn&-lLW-#*ci;FTV-p@0$3=- zMIcP}M=&UYSOAMJfP_3E3z^i~)|MsL&nhkCe5)36>d-=ttc5B~p(ZUkNRX^}RJA3{ zZpqf+)QpHK2`m+txN(~xl#UywD+DAU0+PX3)_`(tfHgp=0&9TIf5`>{@dm(rMrvG5 z3&gP~Za5J74!1e1aOEQ)qLoS36JS6xEH=jgEDnK_X(fr*OSKZP20Ued$?F>oB9IuP z6KOUOYa^+AZBLn0#4>z5ED#gR_Nr81u3Um*o|^nBOTT_-1lbOS^#@a;jTB8?2LP-Q z;=vwaVNoHWUSWWDe`sh(s4FlOmXh;Pg1|`v9t5PqQUu^i5rPWx`KvU^ak~PcDrae~ zbO2>aD!gQk5Ch6jFpNQ@aDb8^F#z&02mufXH?BaTkm$P=01J5l7lC+?7!!a(6cB-_ zI0J|wh({V`SR9l}zfFK7xXlPia3cl9@ZKcBLa7J>xI$1Me?l9i**;PPi-QnAAm+n} zh~!Q#D8}oDV~DLhJOIRG+iG|)7gg9-6AOtU1QgoD!O7MbY=a@NG)4%aaWITo$3a37 z86t_>@*5kO2us^Tm!OY zb+YMC%)}BH6=1N2M|~gze-)cRmO!_N4h2)~!T=39G)5gT z{uc0+3S)vje1K(!+L)oPL?E0(GG)3D-PQ~n5hc;Z)R0jdNRMJJFPNJEA%Gvj5VAgp z5!Nt3M7;qPJV=5-To8kJt^fhBDDVXWiFpt*SSl2fxlkImv8;hzCGzA-Oe-^tHS#UT zO7k~6e@i)6E5@j3!{Q39Vi=i>_c&7$&BJM`%xg>zr1m8+S&B&`YgtU9N(}=5P$I#{ zP2nwDEh8%a(o?9K?36+_>Wkz%HAKJ%ESPbmjAAT_@lYmrI+WU> z(2R!Te+YLXK@1lSrxz}LJArnJFW-{umCobe)Kwl<&QGWzI%6mpvn4Qn`;gJXlwsd z@f`JX0BW`WId;nUFURpG{`*~?y2SquB5(@~0%AaJ0zM-kF|Lvb07ro0#+L-d1TjL0 ze_WOWg+gY4u*YCOdi4oqLcgjyisCh@7MV0b$t7+I38lVLzo>76VFZ(ZqkbvllY<#( zB%@3j5XmOAD**EWPz*pR0+dj&R7$$<%-ncAvfMU)VvG$CuW%6qSilG%mWpB^#1bzO zSMXFeHsFT=$pWDeh=BkM0mUdj*?0g3e*-)LpV)nj0jZ!!2=E|W3gfMi!JQz5hXOEy zH&Yh!`1$HY0q;~?2*dJ&SI<}z~v7HbATRR%}q7co}fT?f>%60R-=P3?j> zi~tr;qC(;7qLnOFQ)vz@A}e5wJgEkltRVl652V6(Vq}&5AnF^j=U7vL03gB3e_}d< z_*C;l0TwxwER{OweL!j(pb*JUk%}%*AjT9+vy^}13tc9+ zHG6e~$&dmJ!OZ|FG60tYxXBovDuDoEJp<=wYK0l%X(1Ts)#$-gDJ)Wl*T%A{*%*vw zp(aAcrOpvDDj_m_P>4b`2WybTf2m)T1=TfAA&8=cwD~G}`YDxGN4lzJuQ>pz?&SUE z)RhsJ3n7@b2o!^{#EJy9pv5>WjgX$Avm6%Xd3Hd1`tY$zhzn8*gynpsTkgNv6PL>7&!0SLw9f4&~0Bn@aB zEvFeBui2lgp;mg8k`z^OAQ}Lr0t!X5lnFuErQ}iwf{S^rvdNM& z_nYAV9FB_pZ|iLD@YDYP9#0+ce}*lOVxX7@B0O^YH>yz_P;5gdCuM-@mTZ}gqb$UT zP0(zHE{cPMA~qUFGHMN3e~9l?9@YAY1!ggqva6Uosnw?^MGMb5CRH&96?Cf}(WAD4 zV=#eC!(wXF4;z(0TsBJWm}l;QCzk!uB(7qL+Gwk=h5l>FTUS#3l%N0WkCyVEl;TEl!0!WBJW8#!(jbe%^e`BoWNvN&RL|#Ig z(B>zeG9(E?5CIPYGH|m^%mtk6i9ZFRFe#reNC8;Zsy02@NKXU;F{)8yGx0XlQO_Vs zhMLEu%9~E=u-ZC6DHPR3Pir&Wc4l^j{F??MG5`dU2th6cu==n7)@WA!I|a%J$CnC) zsX(F>6bkqP+%b_ze~8Yq^`aoMbRs>5*MYYjm4%?Aun1zJa&oVcbX$Z1k$?iBus8t< zSWu+$3J$~55=fW?;##ux{P=V%7+Huc$euxafgIo>=uU*ui(*3epRAdns>*;cck#$6N!}ws^dA-rQ*rH* z3;}Uq65fp@2myu4G(~aA&O9CGTd!v;@~DalQ@hw#ShbevP&EWnD0+ahexXbq)qHjI z7Okl*(aL-;*Y89mmCDMqd~J=)FJ{_Ubeq}ge-*c?@ux82=7wZ@JhSQin9=4 zQ9BlSk&0)=D(|7?sM%L*$Fc-iLP#8o#jya6Eir~LK88dbfua|$@OO;?WYpwW;aI?0 zfo09fku;Z`ECeLSK?p=feA6@*pa6=&e>l6>G#8XgRx=sM8!VWF0<4KWwf)J$+!RYw z7EAO_KRT{ljaae*Aa<-PZibS?6ao?fHv!-a5ELW#{z4dpP(gvz{N#~^ zkxeDX1h6JzjO6kXZ!`IY>S-*+n>+vk#XMLfBOF-_Ih=qsFc5}?5GYnGDk=^le|BwR zFzz}6XsRd%CfDb*C|ZtSs4;Yu#)AZM2+>UJpG83dPkx0RY248G6Dp0N@blXCCVyEw=v(HfUD8BFinAGKUJkAv$O$adLn>TK3MdOdJ^-p=VZ1I_ zD&_%FG2RN<(g4kSGd+D0mRf)BR{`|V0MC$)tn+t+gNIj zTnLvN*dthG=m-|TgCX*aD@we{lsWl*gqOcz0U0U`AjZi75_6e%3o!f5*k`D;c?uGP zF+zx^Kv>y?8o-=Ins)t|(qWf_8J7ZL0VxDl9h*p(FJb{6f5Q-2Pb`FRGK2sYxQ_4; zO5#9(V`)kL43>%@M8E|&mVkv+B2i71L7k&Anx$#p66sN{K%gRnHD!Qep_EW^q25C% z3>07lI>j0>B8ou^fb}a2$iR&@6hi<kN+gzn6p~mf z!OFA_XQm-HJ&s_FV3(C+0U-#sPPQuXAC7jHzGDG00m+x~V*wL?lVlLeP*5baRG<3? zI#)!?`A>p>-)R4bt*!F;&$dqXKlgupm!}T%pWMtZ5R>QS6FYA)7>LFFdD^?C*7P(> z0FsZWWy)9xqvn0hZasbIG4+$Ocsy<#DFN|m_+ zjUEb7sp zf-)j73=$^^5LirZn;?R-HQzu%(FQ_L`VtC%B7l!Lr^TA8#Tu{0nvqhEfnEGmA^)E| z+R1-LSc}bQE{LL_n1_JcDuY_&zoRY3NlE_OJOAAO_kEr^$bTvl2m(B529TeOC%-ZX zM96CjRj&BbCRR$$TCxH)fkX7cud-k+I*4D`WIrK8N$MW(Z5f$8#^=uLAVD$ffeI9b_%7wPr6lKs`FBef+i!v|H` z`l808k(WRfsj{s~p*$)CP^*H-v`QuLVj@ro8H_-DL5fzzBtWTbGLuqCbi^PtmQd~+ z$@ecP)u|ZPMwk^aLK+UH%KLtZ6KIux_mB~5td{ggiXh~nl!`lrR3iIOW$>ylQIRU$ z)ff_~hIv`FHB63!seV%*-zZ;zsa*yTXB~pDBNnDD)h-AHHfSKKy1|7Yz2UgEpH-&W0XUGf#qeA zb4z)T9gTM@MIzKxq}ByB)WB0SSKgJnjXf>h)DOD$gF%<0#V9bLLd_#WcdQ25D`1Ye zZpIe#c55em2j zi)iYOY6{g-e^8fLd6YD|#R>^EyT%lcSmQ(7z}~S!3lw`pG?K|E_1TE4!f@(5WW~Tp z<_&8KZLm}gaBpZ3f~K@8ksB0-P>#1}cAvaJh$($ojJd$7fe0EVm1gc!lU@rZl;`>e zWK!3rnkn{w1<27x12!0cmeYX7fHv)}2be<_tERmA06AI~)4(te-HAGkdp#i>O{IJ# zfI}DigTpsWaaxx-reM^4L-6JsPB(=ve9b&#YNWbMEDiY@7?{K7ZyiQfZf5^aj;g%* zwTviJN~#+%=KKE^hN}<$1B+wfhQoh2whs38D)^7X&;1|Y<*65c{)01s*T7x~6x*-i zK_H5|ejE^p*;~y>5ZUan#DbVreIr0fmArKWgsA)t0thLVr2!DC8OBj8LIaFbE2yN@ zDb1kLj|K>NffyJAqRRPs)a&mBD1|}vJ`YtWiTqY;Ngh%x&RfnajB;drp#g>>UVCe1 zv%26V%vRLmi+%%t^oztGm`(U0VKGY7{U3nE$PCO$_BFN2%BdZU!#PW-%Svte_L!WK zM*E>KITXUQfaK(2sWvcG(FNMa`JKl>~ z%Fk%8pV3}_svbTuqyGD!A+Jiu~#D8&roK)~12fLs9|Gv*tAN*%9$pGI1 z1Y+>k4}%2B+oTx|lBfAPOo&m}w*iLK6Sz+35Tl5%JO)NhNopY?nRh8m&vd_PFBO;e z^jlO8bktG@!&j;yx=4L(YJnBDqO$o9(G=BWYALJP%~wsX*{@YIHyY@O8P!%O!YdSo z7z0^~)uAvS%(k;0kW2~esv%(te$)uh)nUYbvwEKc3~Pq&u5fma}= zT1~4kB_Xa+snpy9MRQuoiP3PUlG;>^dKm0~NpcEtLw>Efs3W?WV1weQ|7TcJ?HaUh zNJQ=BF%%t1D2>x`(fmSsX^p(gJbFhAF_=*NQR7}D;4uJ-<@*9F74eK6g-J@?JJ>*FvWDBCTOAx|; zR#u&wHSjIKoMRFdlTqqNUKy3apeSv2+|;4B!r+EAUcJ@7+Kg!WF8iI7m{WS8^bM3 zBo(lb2fqnzLyIPw#FlDeT%mqtMC-6!MT_adjV0iiK-$qZEY(*QuF51e(vdxlm4_uZbj7ptfcN zRn~XB{dCoo-KPlIG2+jZxUGiRIc7@D*tVhw)>v_!m z4&o-DvQ-#@-bDL}63tPXq9|$4(E^;DlYj+fGXQP_0FHyD)+3?T?Dz`)S6dzf>|$yj zTBs|kFN-?ZT$ZFRWNEOy@CvAFLF=hIlv`V~`61wIs-8JxarUldGXB?p{?q^ZQxE^2 zso=Ci0c!F89h~fy{eK60dxxL?|Mz(6lch&qd#si=>bjtM1+vmG z01}3>r+cX$O0VA>KPS}l&HiV}z!779BR6bTh}JIb9s4S0&&tk8(3sIM0V zVj(evfEdKH(SDmHbqjoL^^?h{zEO?gff%U13e9m3TG;h+RYl$y&6c5K3Jz24+=B|l zu`2F@oQK)6f!633QFr94xn5d3^H#=X^p*29&i2~-q_Hn7*M)B!DsWOEmu@L4dMG#0V2NhW? zW#9%B^JJ2Pk{C*V_z7K;CaMvc!eMW5QY45lgCsRHL+-->;c|DGOC}*%+jWF^gqV&- zG($&-)p$B&lrHBBK#haU<=Bi>%c0n`9;{oQ@*0@=OyITWH@#K^g zz*_-|d2HMZle30=^cnAH0;*8r$M9=vvj5p}kWeIu6~hRB^i_4#V*lGZ+9}=t%lUuo zz59FHHnu2wf97AYj+EK4GZtmpX*%QCIp;V|X6mnL;%mFfH>d5bAQF;LQv?fua?~d0 zZ@(X2B>0jjS$<@1^M}?EL11A$fQ5zic=7EwFCO*(yLh^AhJ;+Hxa4h3Y`N{kFiJ@j z%2hl;!4;Z+VD5WexSSFWJWUeH1P4CFQKWocV1`66CGlhr7>vW{LOg z|9V~cfEb}Ehtt<@xaTK~{)PkL`6R@suiG*Do9EAYKttUBimVdL_5u?ojhH5MMR8d#7e_kGGbC|Igza3dB^b6cQ~3AfBt1>Dn!DM z`hB^7L->5!4{5;rf+i&3{YW?c)i6_6w%Jwo?+K%6B9|1+U=Yy>31Ec9HI@sG0Yrc2 zdtSE-mv8^^`rPw|!=coyy$~lj4sje1Y_xZ|w;q}P)IM)asYfvIKlz`m*A3-FP_{S% z3%D7?jOhn-);E94!PJN&#HZd9kl;f$@B-3*MCz$oD+L!y$Ok*_eBfP?I6MM*f+v$7 zP~y$7KvH{_AZvhYj!g0e_s3}zXK&LUmJQrDiv#g z%?%a$@7hfQW++Az%zV##RUl_!0JY-(^nE(QC`owU+m-o6kwddgh?9seW>Ptn%Bt>O z{gaMCapsBcpTuBRG4AVaO1;%+m?91%$zuX@dB#weHHqxvCkv*8hQ(N54rduI;XI86 znc*Uc38SG;Xnz-WUVVRdzU#wl1trLTf7x3glnOdi2b#;b7Z6}3$e093V7@2$ej<^n zW<+Djn)07=z6+W%KuP8%X5`?EVP#9;L}2cDJr~@8KluA!y`G-$p?~1-|5bk@54l(( zM6v{iF^wX6Ee8^46k&CLtglEcE1)?dk$PuNenylHk0}3_fF@X-3_~&=W2Lo!a~$NL zcHwwDCNU920{U4(CAV=B;#gt;GjN~J@EY@g5p_(2*3V~n^C`iB#O`UFq+<04-sj%( zXVv>{efHV=3_~OGD8rN=(@>sW=~xWmGn`|QvKSD^A3(k{NL}ayFsVb=XBfKv)&G3| zzGDn6+}a&Gua3_<^1uJ5vpa-;rJzg^3k#sgAMP5IgoYL=6|5vQw2<`W-?1QdkY%6* zbe7N<$07qLHxdnttkMXIMoI-Mw+D(6s1uZ+5s6xgRE@A~BxCKLI%!-ja5opFZ4BU2 zJ8BI7L4fW*;DG-yZy|WzK>*XE2VFnSAYov`oB4e=b2F?h7K)5nOa4dFx z$tV6$?`vQf0~+BB7>$3UBR^L`hIMeFBw;jRM45E6rfSQvJ#0YtHQ>xQ@-nDx;dFYq zML4-Y0*}*(<1(Oa;dFbrJvd3Mf^=>`ciY2y$XpjrHbOxSkZZts{_6My80Iu(0bU2( zHRUL*2eUPtC+Dv>K<2uCa3(Y&!J-b-ws6Xw3i1W}3eH|&+zEc6$B#HpXJXHZEwed3(GRLvD!(U_d zi|$fc4YX0ihtn|(^9xYT;zO%S>Wf8UMiWy;uK~rN091wt^*a|d(PF3}2BePietuRd z4^Vbtu`e74mh7j0!7db!HbxpxXK1qeD05e~fsLP4GICcYg^eGVbBUsf{$H&oDfbnu zS!bL^5vZ2RoLQxS;T_fFoKn%r4n5ZUN=&gH3pzGB{K;?+IL7ePsr~Giovv!bC>6Vz z2Q?QgRe2D7sF^^LMv)G%;KSMpyr#hwW|{}#98U-rYyl>JCgUBNVGcVXP8bf5z~PbH zprAMe!*Ph&Sw0YumzQWmV{`v%6pH*Q2&6e!k5F)h<8W9*0{EBl-2!9< z)37|4uK>q?QZV(!lic>H7UScy(@axdkL*@zxjw8|uR2OQ*>7i5dC!dy>zKt@4*8P> z%`S^_?3fA?lrBcJ17i{@`zYl#rhDHSdwQH|Pys^qpmW5exJw zyH*G=hdQL%^Tinw)5}GIht34g7>Nb9VKL@_k(h>m)~7A=U%=rOWU1!J@xY&DNHv5$ zi4f;<4BsT5rjiSDp!@^$MS$TCo&&1#Pu|X}fmc_hb%@TGeNL9MPTQtJaZJidHhTh;x zW4pV5)~d^jNMXfBk%dKzm2(|o8-V^`EgUR2`xpq6hnJ?2TrTuqAgEHDX$(VcxA%F1 z1E1pv2ZFNVSMp3TfyFHWAkgSZE?mbp3p8Ndf~2tU7}eo53%Ek zodtPHY7OmjAX~hjW5!5W>}nNH6rEU#R>~89hPA?D@4{rW1^k|(ND?jtlq3qarDoK2 z5UBqqD8PmLhT|xr*Ct+6JNahqOpZ*dCmrG?jItgMTu>YwG|e4QsI)!3$#Q|BNG-un zxdUrE2oz~6cbEDrHB=I%d^25gnPi&N=W^M+p-g^-r>-@h9W|7E9Z zJLD#{NR3%+8{Ahx-xXeD7daXFOzg-NUgLu9M(E2@Bdg={> zw}Z|ubRry2#Iys0edut(XgtZYZOQfD3{&_!XW~83-|vC`R_S`W?Xf*J>hlZD0@3QY zPf?T)3)hG?0R)1C;kok9&qCrXYAyQo_dcvdU%e;R*YwzZSWt#0czZsW_p|ALZqIY` zes;YAGi#FgL4>$#o_Fo@hHRirD>=6&QcdFm#{sTiD4hm1S1M=u+h2CNPTPiS6~#f9 ziO#XREnV&bYi(Onw;r%!KJ91f`&Bmk6X)hBe*6 zG|Sc{5LjoEuTG;BfSj4j)zO{l7!saEgjk(KCq!7A7gi`Pc6R1hHAv5Y{#d+XEl;Bq z`mR+}k*@_~MrWCEXb5!l8xDja2oYQ-(??>u)- zIzzLY?U}1zd9Kg$Ulh;tr!fSGD_h$l_io&CLJzew;w1Npn9^&zZ8}@24;S(<^TExN z^~+Az=8jSG+=UhND<*9k*3r*4Y0h*8rvjMSTM+Omk_xQ$tyBenl9kJ4mKA6n`fVpw z*svX{9^|u%ex-a-++2OCm|vHjnmlY3g?^B|ynasWKb7L@o~b8cctEtPs~$UCn|4n9;H?m_N;{|E<^2-Ssa87*M+%L(TRMK}Nb1mo=AkI-7GE|`5x^z3Sy=-aStkN%o^PXv# z!Esk~T(#%XctUTkv&ddvzuJQ2!7?HmVDEeD(@@;)=BG@5F&`0&NjzC?hiPGRxsh39 zr6Hlkq5VeZdY7xO4OV{Ur{i~2oH5LCES_q3jH6h84iI7tEj$1suujgq98#NGHd+9; zK*zchpyM2T8>F?97r-vWGx?qu;!*0Ld!#F6R8XVmVxyPUa-~+ch+HWLLdo6ulVAu) zJf>`>BPDdAGwu>e*U*r>eH?2yzc|3Avk^Y>x*1!#9M>&mGAr^+SK_~c`dx6y4=yFV zF6gO$8;DFku`W3G#kpje`Y0>$WQ&UE_Tbz$`z{hB9zD<8iL2}GRlNDHDdjp3aSot> z4>U?=xOj2C2d87pd!1fq58PqisT6FTj!A135-#E75H2J_1D!OD6Dk+B0>qtO$MaAS zV9tM_AzlUUv1$o38s>F48{sYtbdFK@kr9D^-zx%e^2f@-F32BvjS>F#FXDL#64O=v zo|)v=qnwaop{Fcw-ZFN!tfPtEEs#UwwF?enO9<$K!hiz0t8SW{VKbgBdV%F^t1|Ab zn5CPX+B%O}UqE-VvxVvX3NL;@NkU?^Y!v!3zh`+3b)QBHxWWtL=Ud~9Enkwj2?z~; zzrK81ifo-?Faxy zrD3|6`beBzcJ2YEGYo>vFqa)%qgV;$M1HM<1em_pPblX^rIA?ZVT~I!VZ4kD?&s9) z<|}#M;7a}8>-Fl>G8(LGo|6$wD23jCp-_^v|5TIkeS&^ZahBULr^cUuI{p+!@&62? z7te7V*vj-OLAX2VFp2UR`@V0oZ{v7=3!ezFC4U*V8u3pWfu<*;uadiAkvLK390Lbi^wsVSC#F?FDpJ@9)bOg+H%<>t^#; zXe~)pQTSI$6BLZ_M!?>^zkGAyi%)u;3TVt}gl|$eWqzh;WdzswfPYGoLoNit|*||zb zI1rKg*p{;B<#8!CuqWpR=u!BM(^!J{vh$}e*F4|h!!I4Vz#)!bJcnMm>(!xPun`Id zE(!+QLBZe_P%tQ?z~=P*(I$K`&X^Pi{=UEOc|X06;T@gh*$6Wj9PYt?!T!Pip2?wf zU;}XB8mXAknK~eiNlf?@hk3mAgotT6Qkixo^O}UnT`rJFd5?~JVv2hv(fRHkh$-PP zL%&hx=4sNQR9sHjs4#gP>lDQk%ylkXom5!9&r|jqDN{!TLFKYQSwgd*j6A*U7$cD~ z*;N?o)U$f3hgyeHy+}!aG)k{>>&b>PGXNquj>hs>g;*9~Wl{F#{afGjo;~}hd>#$p z*O*}-Cb2R$#Zbyf_+QVSd0r3BtpBvUVB~-ew0|ydXUL3JgmSpKlBS=jnVJ@u4&y5NWrj3wo- z(V}2#wRxqT9MzJ4#ZDxnhM1YCY?a|DPwk|Hgk)@_nd{V;8jR*_Gc}dkY9~D>6hg(1 zXhyIpw~gHFss6P4ZTwWgST0;BUI5`d#k~EHT1PihWcZW^I7W=nETw6d4*>Dv*CEAR z4sRDMD~%{#NIK?V12_g3Xt~T||c2Nf;h~V`i7BpXhi@l+jT&3u%zb zlZ~R!Ym2b|Iv3XllD2Cn%U= z+ru8%oQ4PfKJ3T_9rLQQ`wvg@%M2|P>!r%)h;S{@_)~xrCGi2BB@xlbX1iIKE`0Cb zrUN<>NC~-w((Z1i6(FIt1c{HMe*gOV+D8gXpR!4RKhmvu|Ly6?n|Bv)dIxgb{xOa) z=lKRXTG%}ADj7Sv2Dy4n7}l#giQ$?Np-QK4Iu_T6VJ{?HFfvL-0YMfj!oh7I7vmT@ z#}{yV(ScXT7pE6{-pA9+@817-2_KKo&yU|-p1!$&_vdi({@v@-%hUJoF5vw?;rQLZ z;rr8ncdz#V6K%-*l&E|XlmVHk?cDb+OmY}IcxJs$wbGWhBB!;yG!?-^~irceSx_S%=B;>XWcXJKtbsSL?@_s}o zl-qZ`8Ddv{5>LDbzc7E8gqbxq351RFD;B>T_*svil)G z%AywYfAR`-a7?P~BWK5M{xWYPw=s9xUO`Rw<|TsPH|st=TX>eO|Be;(Mq{k1|2KG1 zuK)M#{{G|oe?N7D za(BC)`)|86>C^k;((z!PcJ=>%bqe9MD*0b{e^$ut zP4ISAsp{@{Y71QzD=e=p5~XjDnhHTTj37Trlx2tE@O8>aJh=#_I7}lFPfk@iQ1kPf zPdG@G@~Y|z>W^?7V0-(iGSe9~rEAch8p6E@E`N^W(Efal$z&>yU{F)sy;V)GR& z6THOCI+gXlCR#3`-VF$s(M(Ev2Rd3>ZiRww4R$gH{5$w^P&=kuki6Zh;k%`?l`pZ| ztLB$=devX}D++SgErIRozOA4~R^u+Ce@V4GoN_AsAy1jef?96wy%TZ)<(dVh}71k>26dFe?8I`G!17j+@7N0i1aEwGXmvDMUHmg7oTciXZj^=-e=PiVG^-RI zEl`f**&MSII!h44(D~1Se=z9ncd9#oGavZ5PqNy*p`(ZF&j%wc(4bR9Yg60K)^JrU zK-vyVO=VA4AnV&3;|hNgI9A4tcK9-Yl6c}@{Y_~F+eDqMDcuff)f(2f&s!s@uC+sz zZMr@5IHj!HVW_rx_6j5of1cktQ=uf`TSb&xOS>JW>g#vkKB~;r?*mD;U{5;)RSSpL zZo#J6l2=X-S*sRJtR{Uw3|l|&-)}r{-Ez8>RrnEWcfEI&>dm*4s#2NzRqM^o_j^5H zDyEc?KeV&^Iw)NB`Swt$O5(TG0m3!#cXQT53CY=hEz~u9xjn2oe+A{+;jXrZ{VEjh zZv%xUO~Ly7*ZA%B(AZe-z9m+R757(Zq=)OGGqZNOJFLXqK?PR^auQGa^8?jn1#&AN zG@*6n$L-0{vaG-F9jjOwK_Qsp;HshZHPYUmP5@RK3le1w4*f%aU;FPDPt>v-gXKMw z;UP<7k789{%cLjjfBgC7O9z~MGoJA_m0%I>j*U1VV0eN*DKoDv_zZNcqLRnWFu<2D zFv0;+X{lt-D%`_3%U@ybAZy!_82IF=QIka3^M2%L zf{zMm2ndbef5-uJ(t{Ss0^EGuoh4ZdEL1m6l#oF0$SRPy z)8ggy3Jyi8D5$1Z@XjmA3lqeUcE0LCc{J#O*$R4Kzx3fP(Ipu2)+TX}P0pZ`9qy_0 zW6E1uvmOy}P2;Bm#FWu%yGhD%ZNZoxoMeCH zD&Z2%vAR0Xebk@Q>z<%}!Du>)FrQK?bkM90aW_%A-F)&r&3?V>DT#0|ql;;8D8o0H z;$KQ18SjZgvnoS=hA|@1!@AFYeAatf>VGPkf8s6af6t$P^KD80+yC~P7mxbiT|8^( ze~#6~)GBlmnbxQuhG*3OIppiD>N(PMNPZeY@~X!-7NXAjY-cim&wnoGWLKuIF$R`}JgWyIpYyu#3WQiadVo8*oF zA!FEa{Yaf|b`?F!XgMlDS{PW3(#!KA`cQ(S0LJ$C-y}4ai;g*IyNQjLFnL8Xw$AFM zL*WYcu7PJYlbg5pU?L@7Ykxl8C=PO*GS!61uNGLLMCo=X>l{72{5(_-R6;tPHi8$BJd8tyM zn$p_l5;CjpZPf`HHyc1J#L3P@&h7ir%M~}_bv|gd7vhw`4*tE+d7Zb?e{Qu^vulwa zz@fa}23%Ii-%COk-Yd$M&q3y0A(wc$Lx4o~S(#cFoS<)=Db4BJ!dQ*n_|Wi^&NYiQ(b=4D}~rphR&)#gU{ zJT3LMCSI$bFLyv%AHBDZ-3++_W}-JkF`B3w33H+4Bui7P=jGcA;A9fx(32mKF$tu) zq-t|*bCnS1Of-GnI7f8zlF;89{q)H>-&&fBXJHcP+O8%te0I zb9!p9#@Th+nfUVa+>%l4Eu~(nrig!!7f|TBQ$~c*OZ8OJ_SQf2!lzsySNCaU-eg+v}wz?2Q)1FO1V|y+zN2g6kSLKw}g1*qaT-Mn_&r4t854OhNfI?#-}{Jl@2b6!V@Sw(=7O$D7&$w6 zernXm7L}6Sf0k<@9Ci$KVvUhM#as!vbyK-jr28wF_+awsD1RZc#vOO{%IjR-2}+P6cuq zpJdlzfA}fSk=S;Fsl!BxAu4vtN`24WrZ!IJ{_a}ba|ilgOa0&0*}R4O-@)_!=VkxT z!Qh+6{LgpttfBvB*T1Ihq24x^?3-(qgLTc$8j<#C4mUG>Qb1y|RIh4}@%s-djw0RNT5V|uf?C|x^$J+i`T zg&=MePmW1lM?lS=#?eCVF4q{QXfCHQ#|%YfoN~FcyV-GW`#!tKqZJiq^|D{Mwa)g? ze;Nc8x_(*SUyQ0#{cg?EV$Xy`m-#;5-<2m-<>ooRThrgiu8w74_Ukw9s`A&^)CDxh zfSrE5Do|c`uJEGOveTv}^s-e)XQ;fw%8$A8xU}5O(sG3t^&x@p>I>!D`uM8^Tv0RQ zQrW@LOP%ArAh(OG*o^B#Z!FY@1+i8M))fn3%vr%KGl?bf0|_$ zg6k<}x`twgW5R(8D%pLRER=e#5e8ks!bKGHR7~xE>dyXWvA6QFWF!5oUwO^4vdE@8?={om((!6rB=10$c6b zWaHq7gn0=&t=w4q6HiCRe!eP38G4lah^#Ss*Yxy~2y7!w8!oMRT^T(_Pw$bCI+*Lybxt?s@c7mVVBcf^sVU?1gP=J2tDB(|)iIzL|d3*zkbmtnamoQr<^XK_c!? zu=pM?{>kV}uIg?D9^L`JwDdb0Sbkh-8uo+DYTr1pY9WXI-chjCe>Pn^hoz%y^1Ma@ zsnb?O=~bFQXD+vItE)d*lJnlsch?VP7f#Hh)3K|<8TT>wwOi+>$PQK+t8e{hO%`dZ zW7VWwxXcyopF4lyKX+99bEQ+7a_*FRjt5$pU(9~{c#k%B|=%JIzRvX(ZL0D{&xpHOQnqq2H&*pJU@A8t|Yk}m6=`3pzJ#AVoK_w;L{W+O-#o)en#sAJnQFwadQ-0Xtn?q^HaNi8@>r-gFNsgOV6b)#cOQwPJ_0|U`j*f$2;>v!KjSB zPUn8%Wv`mKrEJYLNdYRKxmCQ1Bfebz(b6jtwN_WZe=@Ij@bBsxsL*7$WLCC&xZ6et zJ^tMJx#Q+paP^8+-)cps9fr?`gUI=P4dG*a23o|NAfYEB+tf91I@U|GRkB zTL0q^v&@>PjkTF+)-ua7N6MN+AyCW|QnM9kqeNT3$m$TK6})nPH_r_u`N}7f$i8ut z%G6a4e{(@o1Xo#<+{)?aCX9;BW8Vm z>S0#nUD7x4`~zaPj3@q-P$o=WSKYyvFE5|$e_W*_9EeCE#~L0Sx81gNTul}Rb5@5Q zh2J=h<>L6V^QSU-`?7@&`v3CfO9wu~2yy)4IrLPLyRwnyRZ5}|a6E@OV*2__yO$vC zcfXQyB`j#NSyIdvz3d`*H7!bAIc8AxM!7&G5m8nTF8@$Dp{2fSChUBn%!DV1<9}8@ ze^u7TUO6{bc?@@xXzVRdht5Sp74%T{ia8;Flrtt#{1m%x;#Nf-5Pv z^x`ISmC*lMOQtFv=T<8@8*`22P|)w>em6$;%#~Be`B-f{;{E71Rbjbwy^u9C)XYYz z`0F_R^lC0@676=+@SI@niH~DJm~n@oe`9$17yi`PDS^abD-}Okej}5o08cTzgdKa4 zlmk=b5a-29`&peiE;Go^CH?ZdNBxQF5ti6y^=+@kp>yk7@W}wmOiN=CRU)L^eIkfy z+%v7)uw3&cWyx>n3NHplK2+X1>vCdYyt22KnZCM!&)zXS$Bg6e<&Q@%!Ti&-e=2gB z+q6vN%`Qy++KZ>%!j+}N4kcGHzj}AJ)Piq>4jzW)`S?79r=|XXjaW?L$!14@mG)dPG*_tSf}F-I0?OXO-|8rfA;Rr`Y!mNBo3j|V?X~K{`JXcK1B!Lyg2IUbfX`S z&)=QC`_~bi=d*_p3mga>!j4qQoy6f^z8uM4WScKvcK5)j9C23rLMQaoSLV?I7?#t- zv2mY6b4tQ0woPrYL=`Agj$t^S6GmelHlduen=4Ql++fCS5entNr}DJ)f6OR7IZDrI z={dHG$1UW)$kT59cidX~zXphN6o(A8-3(T&|KIEnUX<4V!*3ts|L*2lWBoUtKp0Le z1LT?U@{&P_=`w|t5?^h6rE=EFI&3ly*~G7zGnaMZFP<3MxquX-OH4cM_K{E4rdVg# z_3TpEoBm|KD^eaz9T)~#yzqva-B11 zDfFf0M3eVmx~zm%75XzSfUP>xZA(3bqaQhDXAF6X{)RZ zWHJ@jyEZXcq6&_RMw-te_h?`iQb+Vwx1SMa7~5H6tNRqg8PEaQLcOquHJPP@0;S?dcVevl0C`qkD?f0nTx%-PRQwDIJpqMvVef9kVi+|HS=2BmAA`0V$l zJCus)#)rOAU-d^m#DXaiI1nkTy;Lg$Mt8mr*te#H}z~-3htq80l76E5NW@b#ULd5yE1+isY@DA?jQw{p}Jbm96O0M=)R!|r>U148gOj458Qm?E~o3re^^1OyG7&8Es9%V3OA86cSl-B zuo}MGvSCij?;4cN)$Fg5syX;8DC(|~brf@dzh5)lCiWj1Pw4jSKZE_}hldsW&-2Il zk2`rbvj0d1c>U@>7@quN`$izcT@S|yXr;bRrIcB5HjCy#UNDd ztHB_&f82~y?4rSpv(l(knpCq<>7f~fUL%12>=a$D)^|l-{BR&H(agduyv~ zY|r+ll&{fNj*Ttg-oz$gy8XIsZ)Or}(0xBixdiuZ+y~jC|_rt(f@So;LLO zDgd*wzn9y~qqoGa`lz_ zbJeTSUmZ2un+UVj@L~ILZTf6r|4Aqp6NcLxfmZl`4PI32KhF;yHrWxQi zj6e==Js3++4pXx^C~tE!n~*cs?HGpY5xkal$m!ySX<%x4sx=X1r^~Fpd;D76f2&;W z?XNsHbgUS|IV&ykE~+1`*0ACiH=BF3rc|5NVz&91Uv1ueuC0-cEv1;LLQyoY7z{at zT#E}`D(2KH+7W7oDAQvJvez{zEM?AC6u4dU!t$9tBtyey>T`$#65_1J9hQK}9nlmE zGH@>2^Qz32a_rj*M}?f+S9sB*f8(Bgw`^Z)ESj$}i<`Rt7Fu0_m&68YyM>h&@y1PM z`3#EcbmBqcF-fB9iqyZf;pZ(#pbpKQ_p@5SN%e#QUqvHs)TJl-Y-;B(0V zw-f%Wnd`yWeib;)W?wBmH?sKZ5pKuWTR~Rq5ZT!H>#^QP}u&R?_NVsc!Tnkm132`-&+@`J3Q-JbEj*n9@U7wzYg;&Fv za(uQHm=D65?^G_#F?178!UDFNEvVVtCH!`1qxTg}c8>p9iQAU=&bcj{ZQI2qxN+dM z{p8%yzkb8@Dl?Q`e_)sG)%Bagdd8>vK5lq2)15v@lat=@bS+7H5Yw}7jcH|(F&pPC zp0T#3g*0#b&1BZ!xHMai`jaURu6T9}qwuZZS3N%E7NcD2b9MpOG6_3IXMq3t5(dwA zTT`M|?YIH|*Y@WayWE|}F6zbYYiA9eYgg}uod(@Y4q(cHe{Q&Ul%ZX&evom~@UFy4 z_Ff^3_kDi)+Mf;1|Lz9Y$_lXJ{QvyLVfp<3{P6JkQIUH4`$kP}7;UiK(FWOQZB)J{O;49S zuEkB=6sjeVe@kS5#M$iaEbEONms3;LT2QNrD5&F!>59aThT<>KEGk4h=7+rodrGcW zG}=?@$K^1=F=j~Mu-`t+(o}(8HNI|U=4OBikwEoBH2XcY(ChQ9N>_~bGwWF4z_gls zIEg2f<3i5Een#lVbCIc$UsGPXoqC&bnJqcLRN7b1f2naUopOnSl_EJ?^xU?&HthWQ zC^UB~G^L|PrFZBRr)Qh00=Uln97D34VWLhTV}Bi?EXq#VX1Qsh_FUqcf-AL3Z71f~ zs5%|j?&Np!!_Te_!gPMA-geI`_uNnBD2o`C;$XJ2LX!y=Cn;k%&W(zlPT6pS;xJn| z%!*O6f1lWqny{umx}md@-qxv=EvngH_@zp^mF`kY`qcx!heoyPC9yU z4Y{P8!GOQp;OJGf0O;N~$#1XeKdFwQm0^nZVfqZygRl;InVu|ogffB)v7RR4GI;@fXtJnH{<@pRz~3As{n z$=jOPa@&bvl#(cvt9XKfD>T8}_quR7B^-E~B$Npbe2Sw;`MkgkiC{|N$sRBqAwlM5 z+suDQap-j+#uM!&y`xPN#v2v>$F2|W<7fdiR$oexAi)eG5@X-r?vKTIcm`5*gFK9Bo(MuitRbPZ<3T2g377h*4j+WAr!ApYwo*xc?PdC6>wm z`J3a{KfLj0;SI-FF8?nE2Zztg@;}&rf0X|_dAjh5h#1X?m4>%u#H7}8B3Z%nj^U^8 za5O9a{L9W%h=d>Y`*Mfy`LrL>fcFJWNWlA%Zu+ZXrmk$WtL)zsM$<$tDVo6`q7xFp z2#aeh7aRkK{?7NjZWk`!{^Rwz=M9HLsabm=PH-IJI3U<)?{aTFGX1H2-k4I4e_-H$ z@;_Ox8_J2GY;gn@a5IP*(+}vZZ~m5psS!trPrWA~!G~<%1*D18Q?phIE|icDcHH^E zyCQLT1o8w=CO@FWn_+>Z_AEix0M{Iu>IE@9PVXCenJWnmsS`kSYf1Q&Mb3hj7)~F}vm0-rNtB zz~BF?{ze{hu|$Yu2@GQze?|0K4kXYh!s`B5Uy)c=KyySQ_0F99j3^r(QT{IhO|Uu{ zhGaa(N^9ph$U*JG@pw#PB8UX^vxG`+<0Qnf!~kaCKA+(=<^dz>mO`R>JPlnz2(oU_uKmHv-cT>M&wb3DLC3-kLFypOKndt9p)rm{22gG!8Wvfl5fqJ-3RZ3p6eUn6C_y6KJf8g1d3%%LXhvn%S>dO^UASPFPXF0al%R73*3?d@eNE?4d#$eqI zoDqOV{Gs00z%T|h!Wl3c|3*iCu7V8f;6zEnXu^mx>1IvUmScO^fbMI+ znQ!D}P}{=k^l*!Ca)AUMrxC|xK-RXhecV9jI;Llsg#?QbxqWbaoqX##mfa zc6C+-w=JBehxK4w8%~sv3(V#uz?-g1$7iRuhg+okG(k7y&+jNBf6!Q<2+n8-$Elz^ zK+!7oVcqr9e;5blX`~3Og_CQ)9-^;;)PYbPUFP{-c<3Mgbv;}*!>LrLH;hrXmhyD# zTGO_kwa-HBdR;?*yLH8FThHwP>WTtZeCDUggrN}Up%?l(Qm%cc0#D1ByWbs0wN}qLUqZtoN0eVm%ggY;^dO;T~{|;ipsk z*)Ka?f7OOjDt0puYA#r+@*w(9Gl3+HA{}7ChqV)UO@k}UG!Mc#o)9kB0!&QCJ2b-_ zc0!ym93X+iBe_9AaR`Rv5VNyWe42?Ncqr$7iRRro0~6t<-XTSg~Gply(MkVcfAIJI{X5({p_V$1;}F%7LxTjsxj!!5{C z&5`4QKg*D62z?SE&gITNY(gq2HQXw4|BE0sz)bw0uS3uA?&CUVxtDd<< z1r*0rn7Ab=Czo$8fRjmV+SwaLeKUuJf4#P|^6Gw`iNEt>gIZ=Si+RJECG1X+s&s+3 zXoRENIxRE}y}^~nc6Y5+mlcu1ij5)*ixw;AI>I&p{lQu|SZ?+)5GW5XO(VHn=)XWv zr8v_VhT3lL^8^Pz#}N($WyP=LnPSN2L9xwnnL$Tss_oRnZE?ot*Ie7;j8#0Le_crQ z!d(NqM6+BTV#gCZ3-XlI8rtPRws=3sjFGU|)heDSIpg~#57$z}`qJw=fu zTnH#h6l_b)sO=z7|4mSU3-=AjQADpzyr_2a&Dxn9nN&|Y#7h`uJsh~8I5=pUJD^Z$ zdwP@Q0!5Kpf}e5+)^-pm(pK&+fAv>ts3c1HX1e4u$uy_W<+6E0nfwY*U28te7nU0? zC|}|EYR$)$1|22fu8Yp`tGphXkb>p3v8q%h?|F?jRZjY07C*UvU8G|boZXo%vOis0 zh%$z~DSZFSPSKF%m!(Elf5+GR#L==D zI_S%<0JKs+tU+HE@%SSM@ORF{d!WDH1O2Vi^>o`~ zdu-I_7n%j4)p4JqC?6KCe-Uj02m}ekbLF3(g~VCZTJ-7feOQUUdQYsc>9PB;pbSm$ z_Ixn!XVcxD=jQ$FdIe_IB=Lg?ao0TW+UE_~K$%u@ZcU_`#s!W8T)$8{4Qj4b&hodv z>~x*B4c97)gDw-DV|QD++ymCywxn)7V8zPiLy<&ThQK()OtYf=e~V}F-YPOzE{2H2 z`Rz~PUN~)FMIGN*+y%0r`tm2pR;Pb;u60mmMm`4F8_uSVRl^aZosP44(|; zt|?C=hHHNmWVN;Ec5jQe#^^1~3%AH}TkG28y_&FLy{o@UNfZK(=Y-LCrlWxwQPBuW zLDw!3NUIEMx`Sz!f2~U(u+Ao5okl4DIWw25qdU_vBs_}aqc*R7#GeIB*ZET37L!np_wXWrmZ;-DrH%zf8i0tH165f?lh`O^%Y(W zijz~SblvpKs`VjHWUzsY|NXnGJ>b3luAdD;AMRgsxbN{F(Bm#FEAorDm(MLS=G-RJ z74))JnXdf!CV6#+W;fe2SHJRHpXI+Op65?v2oP7cwngsUxaWi(YG=er?h`Sk*LK@< zwo)H1AmCFZ6os~vd`_4;vlnIUq;~~U>f5s+V)PklO0V&5|pfIN^f_>4voi6@t6B6og+EI=cg3X>zqv;cu7YLU<4 zd4}u9_juhdTqHOkC<3A|$b%`KA?`$y$*%HTe@x88v>bT=Vv*n@*&&H19zd9r>&OPe z*yc{IRUMZ^I7C#%0C@oT6PhIvK7vqvPuJk{_RN3k3r#28w507PJ& zoOd~-Hn(iF0B(Vfbtgc_Iruh6YbP&&U5ID$Juk$g)Is-1SIVfMM$g4YFRSHBt!@#y zQVxWYyYVN%5RiCG*-S@D=tO7SC6cb8e<6AMIM!}{aez%{BYfm_Gq!X&u3N}tR^*qi z#D4?zyWo%?TuOLd&{H=MnS5ehaPEt9$ujj(R^rJP718a%xo!4cBuG4Zp1BiO*WIgl z^IucSbspjzKmi|Ul+JMR;(QNI$Cmdxz0MxE!@N@|*g74P)+!`i!pR|ANQ4GDe`y*g zR4!}ej%C*5>}**_6TMp?hsJ9c9K@Co&;^A71$0;4G&#d& zJX`bv%h^_C+*>hAH#xO+9<#oHf9_;w3)A}*Ui^TPgv4suDD-81&+;1TK8+S|g%`%p zx5gP;z9exI5E_1c`L-0lfHY8PB!y8xM1DI3{}Q{Ur7hDwP`HDL)@Dp#tHCK6pG z8V8PJPE?LpC5uYKbTjplIJ@lJ15Rfc1eswjJGe%%63U7ES_cU*eXpNTf6j?YBeBrK z8aHUdco`eq&#BwZSMt8WmHNHc>(!@aG+5a@CnK0p3cW+2Bx(PtCgJ-8{hs11w_{F? zKmT<6DU9O(8AdOj<2bOD=~aSochX@Jd3Jnp@$vonYcE$a z=l0_F$a8g1jY?IAZCre_e*|5wr)`!$y~)e7v0UL3lTh7#uJB^%h*wU+_O=7s3+Sxg z-9bd4MNY)PI#-l+xBWr{4E6xx=3l z$^Qp7L&0Dp6bxJxe+;&Rg264IU{FSZ&FTB2P55G*F)0lEeShEcetI9nJ37a+5oRzr z+=GMtgZ({|L+QW<;KDUhF{3keKpK;n@F@=Sc(u{UE zO2wVh8J*x5OUhrPMZwf+^GZ88swIn^NJb4YGf~+p!&9ExNeKzb*hn+isWCMe&DmyZ zDz(*4dQK>WiXYL8U{h`zx!F_wY4_XsserLuxKO+R!g-2$`ysWCZluWYDGzXr7@=88 z(<~nVf8xcjLyEZ^-Y!^H8d1EEbj-oXXQBP%i?ZfUP0Ne~n=gaAhzzrnFg(W0E>l0z z@t7#1qiPn?AeAQ@MYZL!Ge7use)#K*Of-r6-R#d^%5g719P?cxCFWH;(ZsWJ5ESNz zl39M_c$`KMk@$*hUa%v}5ev!dMJgyGDB^vFe>sijxF>--Q2#ybC6tR^4v406-|4T- zOlq2|G#|PJ?#Vf*@p|)vo}lK>!@kv@+5gelZCF1`yT;K7XOgD*MXH5&ok{p zNaN7dc0Eo|FvYfqJ+L_q5Bz=DkqtWLRcH4fp5&JqS}4{_mCq63TB7l%04GY~13F70 zf1;1gcC#>D_};%w2XrKm5^@Qp-Q7$pKtgK?5+6tX{`K{>j}(+XWs`oSTk-ze(~~#v zF5dJG{R?_HSWFm~|Fdaq2eB!CFTlN3!b zOz0fzOM(Qm8R2?^L~-avWJYX$ipq5Suc(U300960Z?$qc1OVCx E0H~-62><{9 delta 99126 zcmV(*K;FNI`v#sq#H`{b-99h5z%}@X_#_tyB~uPeqye%MNdPD)uAcyw<2-#*`AQZt@2RfwEvRh5b8GoA2^PczYHsnn*F)5?gH z$$YRBOI5B|!jpwyGgWRe#)~482~N?F9T}GJoJ|F*v`CpzOdC}S#`BbEQCJR- znL!9kre@6ck8E|uCN+EWa9QLkz70vsWOzd1ZNc0VW;@bALs|`=CG`8B6%Q>}&$Ad?YMjswM zeljfb`PP+K-Ka8!C5CUd2JA|#u6b68tpN-h=w-=eZn(^UMG2qcdcVMqw-~F+Y=e<) zVY7HFxOxEf766V&Qk7hZa^O(4E%tVCbVI3jw><59Gki9Dvh~m2i2tOYF8-gXh&J%04K#s8l^`w##BEq1b;%a#3<4(mmFDG}m@NVn5^B4sXl$^hW?f;D-^E&Iu~%<(jr(mvM8~kZE`g>{v4n5-cxE z-T^Vh*Fn1opUqUs&McGG#?ID{Dyx=aTko_%p>R}it*xYo67>Hn#r%IW|7_c>sAlio z!}k`{7Q(QCdNeIO?7;(eIGhjhx8@{&?BQc8;xAXO;SXYkuTS_=zy}U=*pmI} zf3{e(X4D~!#R6s?d3duGQhYGNePn@bAI`Oy#6udeD{|_n`U2#7OQQuZjpSLjs!1MC z$RRA@a8_lR{f!y1EHZ8c+lCF|q-7xRQovS%K44D6&H(!w4+pRV7yD{sJZv{jSdFfK z=yW(x7FqT~H5FwpjL?40@QsBOeY)pbT8WZpAw)oFQtO^9{M{(VQ`q@D%PeQe)JmjG zP5&Yi1MAUhzsG+0*n)q|ry|pg{@D~Ne%=5mKA4gpKpQr(`_O82@X!IUfDtIWk!BIC z=eDps%gQjYmHphq8V8_(nr*L#Ik2;TRPuSQw2=v0s#G|w61!Q7+}QT@M{iUrXe$xg z@w=e_u<1JR+je4#QcVSM@2UMpV;jpFZRd89?C) z&jONE)w-|MTTw>^^|hhE?;1YWy8#6Pu%SO6f^KM&tv`BPQzy#b*4Ta1YHs*^ zeLMSdTP~NC0m8DlGhSMFc6IE*p6;|D7FCv=sZ1ufAY{K`1$@-m-kqWsg-GOV#k|tL z`7w&XQZcROZew8I_{i=IyUpN#*&ZA$?qH+Uld7R8bz5S9B-c`j;dA^VqLB^F8xM3< z6ktCZ*r^}zJROum7xt997WAoA-v*h?ue76O!{=nf8>C_?c|I7A2j#bjhnrDepSieL z`1(N1c$FdBdpOB%_)0%yau(2o)a;>Ua@suXGm&Y*v@r1b(dvN%FpR@zv$x8!*RFp^SmG#&!S07@%(B8Hm{%y4~Wm1&Z92Zc%po)7KXk>KD4 zMJcbj5uUVn5xyACiRBl6pCV5cEm0~seQNrrui=Sf>kl5V6Jc&tdBx6}8#Kok_`G@S zoP;meHsV>PZVo>fQRX~jmkU9?074lY<3*9JhU`G)4-G5DUn^M(mSoZjxtTr0LGn#h zo};v<*Y+jzc`39$xp>1(vLJb3Vi5?NvstN@Oqqo!>t)t@$o|`Z(u5`Mx>x_648!5O zLZzB*D$Gnx*C0f{C`Qz z%JMurH;rD5B6tYsXlB)WAO}lSgss%HG#o)m&AhdaRT|WPk%eGwor5q&W24g#yOHH< zlmxqz_PN$PPfI^Xj9U5SY-k9#^-~$Ow7K>xO9V|Tl<>nY;=#blqAg1jM{(?h8;fud`pC;MVpR+-T39RBMUAN*Z2 zWjBRJjYegEf{sn{i8+AK-h*cY#tZqXR8@n|%*^yv`vPaZsAZ*$Zj40ND{F_x=Lg*}^%Vluac zO7_8Am|>zyG1O|wKiG4DY=sR;iO>$DBxFSG_FJA>0MH)mjYp%=sOPqrgG6LfPvC*n zWd$dH{EI4`3&W1(QX1Std9|F1((+w6N{RoL0^Q73)vi6xXiv4ORH|-rrscBA49|tC zbhg6d?pkG4Zg{z}x;k~LTiRxa=$WY89-w;H9?qHKsou2+?Z#lXI!4nljx1$9@g~?e zGH;F$#sGq|He@xZO}2bywLLon;#$HnZaWQsK{l*WOa9?)Ublb4KXmrzy!82 z!VhBQyS)-CM_{&d-;+^xYnH;4Qe2CF6!{qJ%NWl#3PCRoY=VV&DJ@?Bam{rJ#-EwA z!i~(e5j=%y$**OpayVYDc_}Sb>jv3bV71C?JG?x;@D3_ZsP%b5_?S#Lxqxj*mKxZ< zj^zWNFZpaHlMPI$7O-8aeNeVEJC8J9q~>}h1+&_yGJ!yjc*TUSN z)F3B!qF8_32{2up+26GX341bs-~|V-(Z#0Ow#=C-Q+qNizda6KvnkgiWr-{nqSW5E z&;;zbKyU^)U9c!sVMifQK-GrlDbG|cz=ULvOQ)cBYUV?Wh(@1i==6e~yvAog^2RjV z0Cf!XKC)+zzaew#iAwQf*r4J=q1XtGM~F=yARB&5QAKQrNSfB9FBc? z77WQ_1hWI9@_M=ZG#X5|o<0Qs6@1MO!6DWdrL&B>8QacPxdbKx5tQCI^IpqTB)oi& zvUcrF^6+a5WdnuKMsQZDYjEh~E5_4QqLnSQ1hAWhOcrd(S9l5m`%KARd%2Lh72zpR z`#4rSeZe!HC!+Mju@jGfnh2RHRi3RjH2!Y3v<~vX%IJeBA#e{9$B@i{lX^Pn37$d$ zJv*pbXya-Fgh5|~GhiX5C{T4kw2GrabC3kmh^Er6gtydd5T=0>?#ezkDUoO z5ooG_Gt}~rBoTfwDL}-YSI$8K*rIcayw^u(Y@0CO0g*1m&AUo}R)yHBTXarJ;^DcO zasF}FKn&-@J!dMVkN4P#%4^nIKVGxlvH-iIGeDO4sW>{b^6C3AYBNN*VPt#IpZM&=IcDh2HBvVyt*{|J*Wgl(TH&P3h34Sfu zG~@Y|r?hB18x8w^0xUY`Jf92g=NcxW-koSpx{nVAtin?A554qP8G9|K1oAW51J%CQ4n!GSD)f^(of0KX?Y$E=0cQst8w z`svvP{>}UY%S(czo!a%?0noEsvu7pf9?Hx|XFb1p>PHZ-rbSX2dF?$=w0puxic%y7 zPZT&0typxX(l2>bT+7l_JR8UYoxt?M66^jL9RJfVqy+^fxPMlOY_%!No)p6WgJcr;prJi#K16lq$83wKKd`5{^XaBM&0a=DSA zEO0)1z-Dj_U?4_gE9ftlC4(2kf|~_9v;Q%Qp*O)!7{X!P^j)kY`u5PL-HH^@-nn4m z?XgDKNXiXgi-E4D(7)BPbTvhaROQNPTZBrDp6XkFgl1J{g}78)hZ-}w7p*vb_9LwR zvdWAsGB4@Xe}N%la%= ztp7M|Z?Xb}vOFO?PjbP$1hx5RJgYLGebVq6_>4eZ=tEL#|u6(5rL7)1OLd z#A%+0^+YBACfJ4jkD6g#7E-vM68Sf=$NuntO0I>l4BYN*WVOg(1JOcm#J+JAx){j= z2hO3lYkU&Efkv!A*KFe7-Sg9|(5`%piJjQ_x{B;ig@Da)2QV0@j@wr7Li-J9NBc>DTrH};8t0dMS+L*DM8aD8IXTc|*>j=(o|cj%jU@^^;6 zd1svu9;k(RyU8Ia2z;SZ4p zJ#>TK>I&C5{J@t*5MF}Fh4B_iQGs`G89c*m>peDp^oKVxTo-DNhhEr04bowM|H*xL z0Hivc)j_;wgnZxU+{&gdqqYfF2ql?yM)o8tB#}l7i^AF!%0k* zo7#Ir$pcNR31Z?>1uE2ce3%OX@%_sg%Y_KQLY6=`%&JJa5f`T9M$A`edYhDU#eP!d z)eHiy!b#KgAy^>qX)37WI_wTERhEeo68;_Z-3N%xfO-i`1TmU^leq_fmxvAWOEi{{ z(sQmLB>OG2w`6phABaqti0`5~HTtv}nASB}W!PW{DOW&nXZ|;A;AhPN{X(uKPt-{=( zI>}dRbSK>`M9xyd?Z!eEA(3&H+~sR}7*)tb?*_W@16~v&PX{W`R)d+$x>#tlxhq*? zDx*rtvj^y4%I9EzQU!D3fDhWqJ(g=WCuxuMRzmkWPdO5*LZ56D8`|*Wb~c+D?qzr!6ZA zVg?>&w2L?&HrZr?q|xqlz_95WrVxArF-dV3Xa#9@)RMScK-P4YRNAQJvAhx>3tVdKWgi~7<;Q1W)v43c zLmN%#S#1G-Thpt|r3s=xaj|5>2zD1;#6Z?876m-GKIqT;bmJhb>7Y>Q@oldEI28S! z(xsj8YbkDa>4d|Rld_?Av6tOI4p?KzBuq=GAjs64$OGKoK!Ga|0$Shs4w^4oCT`C^ zXL7#eMK~p4`f0>=oW!4dbMzfY2eb}YCib-k7ueK)hxzr7mIfxyBtvVC$>rS{m6ViVyO|_+| z;}}SP79y=OQ3Bty`T)-v&mh{t>ay;2AL55tPa9QU_3o8l%+saJB^F|A#k4rT?ZEd` zlW2t7nk}UlycB1pN(6FV%r+$t47`M3An@ze*{CvS95kS&dlnRsIwY&l1Wy)$c^~2_ z$||=Iw6KVnzy{r?=(9Te^z7*1`MA{!<}F%(n%gb7)jd2|uJN>YDEnd;rQijG75+^v zrxE}|CC3L3fPRS=_k$G3>56d@JisD_l925MVqi0s&(SLdbAiH46!<`B(_Dgj1Ua~J z)+Mf4@wihqlNw_g?N9>bAqtKsNwuspP;iEu*#~Yn-@}RzX!ZtvVQP}`;sjV&=so*jsc zuZS$b<0W~lLS-p? zi4U0ZPwo#CVnnsBfnHRUn0^OP&?iHG^$56oGZ_kn|Hg{#v8U*83Mbq>Yz8~w()aRmotx*r05{k^_XWA(2D&fU4YyDS zSdi%=-TznGMB`7}M6qNOSPPo87{0r!X%zXFEJSkUGEz1MaX(VN7jk!z@qK`QZ9u~J z0kBAAvnanWg1>X z3X*%j&bRXk#b7Lbx~>M;)gb7KEXbD&fm;k>uWonAt{s-Ie(M9tT>d0Q_54LmJL)ob zeB`z-lyZQ_|E;ERsF{B}e^sk{qC`6lTPgF-KA0otmNNPU%XwdZt%C3YTcZvJ5}p{_vyM-y$)vMUtGPemtmcXeaBcjRP4`O z+Pl>3TT!+Obra(|RP9^P{dLssTL(Z|b@v!Z zZ=72AlVFv`oJ}8X59*pxJ{7bM*LA^IbP)^I>VcRO(BrMvpGZ{^ddWh`M0h>dVl%|* zSv=EqVO|Y?`PK>kTN(`^HY$$`NkEieCXK1%^9h+g(^ayt2)vQGw6ic|M>Dok6-yPn z;dwNcpjj2w4aO4IzIuaIxOJcL^e>f$50+5egu1=@V!?Eeo_6+s@aXBYTY~92twmwlRLfe_apPBL zEh2MHY%6lNSb;X-W3hyD@5#SmurO6QX!j6m7h%!O+Q!tdnmdD$yQInia7U6ex?x_U zQHEzh4P=B+U#%BZm)1k}M(~`Tmck!Cj~U(~43z)aeUAMgylt-CV}@4*puk{J9kZ!t zB>e_|TEnZ3G;O!D9PI5H)x$%9TTj66&KH zgU%cY6HOFcYc#D6{N>snVwm1DNHSS}6W!*2FlI}^b1Ia5Ban}Bzfdi_8W#(=?!32o zKMI<+O15*UcWno{N2M~_T?`o{CpQwRT+uHq3)9p{+$6_eH6u0RYe!t6OV3a`eE30G z(2Y8b>gZj%a)?3EOYLh(QcX;pUabB_T}1#zBHnMAwaT&X?ZjDA7=r%}0o z@Lsq>CD1ch4)lJwyPQ{5njjnO9-TLe8u}advPN}7+A};^G+E}59gBQ!7QR}AFR{jT z%nh1YHwzGg5ctX1->WtuyHB}{->g0%Yn0ePx!{&Mg@F#(tW~&nraNjD-fPa+T?-Ri z`0ga(TMz9B`A&;I9KlZh;B-xja*9lU1F+-7K!x57R0V0{?a|}gAx~30^Ij;G37&^S zuS9X!$-;K@c(m2m9aP1<#V^j?aV51czZ-I7H`=;U{er=aZhdM?Hgek zj`nGdZCU)RR7+tNqOy3xxmL1W*AA}cz+Yo&oF4j99#T3PrcVx_qZ+IruwI;4Uwg}e zU4PG}19n@DttOPND>oZ(yy>8S8%E>a%|_#9wXC>p_YIp35bLU9wL$%pYGI)?8!V+O zhBbWhcsL3RVm-#d%Ky~E`l9u)8uU<`8Qc!{1oc}OwIVA<)6VF5!v|AxxZ@Z7fV@@1 zXDV}EuKqVGl-AN}31lz-lT}{-XS?I-7M00sQI1B>kRabhyoLE5>#DYY3z1w6uEa|3 zv8A2z{&IC{)yf~lDspf_t92u3gb4fz9q|7XW-m93qqmmD#s9S92yoFozqHGslahlk z#YzRejt@}E?|nOdH14fK`PQuSJMe1;5`@WbDC;~dT~*(XWlB^jl-{jz9;iZ;JSeM4 zhu#~NTSn8Ayxb__ul#9$b2MY`?aaLI)3(=)hX>gyb>?J$YR|U8DoWChX73xP*n86M z5%$g<`stn6)@hcG*#()GSmZXqS!$n>DD&uuuha8do~boGgKzYjXY94QVKd+ZAoo~- z6)4L!WZRV%k=_*tABa4Ks%BkmJVJJljYpAu*m%3~3^)f-xcs>` zRwwf{Ve5dQTLQ z%zWLBz|G)M_U4H@$BB>6gVDYTpKLH@na_oeu2ual2i?MdKPZZdS?o32IIpnQ9Jnc< z4*KSyz6 zc_%8h+z?8C5Tb04*GvE1Hxl2`58gk#k5fq(&WM!#37*#ic`S>9&QL$vwZx@OGwdT1 zrIGpk9e~>1=~D_ON&IkwbM7dyzFi?gZ*96?bEQ19?v$M_7s9gIQZVp5Q=b|y8}73L zNu8&>Ah)zpR^TnM=%d#s-|#EJG~_|5An+f3Kkf#9XL4MZ7+kH*ycGJcnZMb?pQr-{ z6SRjWf&+Dv2X0vLp(rWo_L7lN{D+AWvR;G9dD{JzDc!Q@^ZBo-JIb>oL_!n7Wd!# z2OmFw_SnadaJy~;?ZUWqeXnx|wtU%ew-HL~w-4rj zHVc-8=*$?6ixZ>Jf%dI|w{>~P{eez79{L^9zC*BfA2sd~TyxJ}x1Jejw~Fo(iEe@njCLX5qzmcyH9LU^=gM2>}^CzYRjuClxjgJW{tnSm%;zLi${XRJRvullxfK z-Ntf@@9EP#PoL^{`nA1I(Iu7*kJFw0COoNb@im1D4XI+Ul{ObEO}Dzcdg<(c{jOf= z_iUyzx>u{eY4EmKjEI2ct?JIfN(dw|5V(pgM@$gpP%(VQ5pMPrwZuZ zlhez?i=p{ozCa(N(P;GS$rJc@G#WMj9X}a8d;Giclc!Igd^3Lf*nT&D`gAn<9UFat zzVH00wBhCNMxWhRb8!DAKl`tLC+C;!Wb)>4&uTSjVjY6w@$uspzWwp={Nm{JB>dn< zQNm5SA3ttQ&d$2Nm=s0u(bg}&4A}3rKLps`bBa(GtQXPXu>Qzuo`a7c!?tH!>l;<3 zKZwV$D_)+;!w( zs%uf+l+qZHLjuj-RwzsYwr+MvuQx@8HqT)x@>G;Pww=nvupT_^ts9!_xo6J`@xk=i z?|0bWSuXR`&fXI{W>@up;R|*Pbti7?bL$n|%b!VYto#H?W78E0*fO8Pl-SeS>Kk)m z@QXoRlosffJPgCScJarLY>+Wt6vOzacP4@7&1Qhkqz-zwDtZ`{nTlyOk5CISgVMm8 zVPz!y&TdwA`jTC~K4fR72j8>7fK9nxY;7IoOqC=FQBa{PQ{rWR9V%kS&@gX?yO1+w{>AVDOfr%gBR|3 zS>-4k*rpA7tBlMv@qpo67$P$wI(*)Xm{D&gMV9uum`p@~#EV3pdY%^GeMdHeZE*?a z`dlQ&TlT}t(%}AovUYlePvHQ!MU>CRWNvk8(4%41?76+ijtpD!6*K%wFwSP;##y4g z+!tjQpiO2fYUAUOqMjN136h|}hGMv>Fj;SpJq)*%zTT96Z`h^=$A?IRKigg8Yk6~) z${E~tWa=yHkIrt%3UEBae=Q4~;P?JM`u9v%vzh!LQg0@I+GFn<<9m-Y(zu`p54_vg zKT5E$M1W*FaHVrLY~HZ0eMIT`G*3ipJ&(??v^Ufn>H{On1=(OQGk|g)^VAz zWHA6VCG_dIN3Rjy8U|SZ1n$)+J3|%&32WN5*8V=i=_=$GLr-bIXa__xYq%EJ!rV7U zCofO;KzF>m;uTpTg5L5Jg)RG_gX5*#@TnES)-t+(`b-L09UV@Zh!gGM?BekJ$D{qj zcSmQ>f4}`nOleb�G=1(p^ z$g*R9&LGuLl!on^WwD!NR%jl=gTdfRtfI&E@4+D9_4oS|_||t9(TO`oy(nP$J+OK& zGV`t!Ld;@?~cxYB; zgrE+Kf5LMYmBkrO?OtmD@lx4&b@X3W`In`C{Q=^@27^+71o`~oiMST!LpB(Q{F=q2 z^}Io9Y=D-;xVuhb2`Uhz;q@=VdWew%wdPQuZk7U?&a|Xv(zPLAnW?TheDAM z>t-Y=Hk**$f}6#zQ4yKnbC&j+`{YX?VmH?3;Bf^}=bw%SZR1bFff~b#xC<{^j2(P` zJH}WsZrv)9rew^D4dlIv_s?7P@dsrS-A1Cqfpo7jZK)l$9g1i1H<0V+(w{769}LiI zb`Os_Vg-UvkNr8|h>UG0O_SaiGSJ_G11#$$X!CS`R#xDL`9~S=x%XM$&7OWZ_ zfscl4pUw>mKxyQp9v|(|joE>Suqo<)w=c-Qj$lBP^QG5%3(GiNNUJNIgx_L}KY;9` z903L*EJtJMW9yTsW6KE%^?l4DlO&)Z?*e~SQ-3v zu9T@y66~)x&(xG>^<(@yGSv@m89?Gfv^&{^Pd*h+=!VbQaR_^A7bddy>h)LSV@W5ev=nZYa zHx33pV_Gb)MY*q*1uq4E>wW)xJbW@3_1Smh;WvX(j}7;E!KX5lMhZRrp_&SUGJGYC z!^XiYN|_th6CaGofn;~D$5UbWxbD(h;Dhh$>k5Wfe*pjTb=aa?JGgb4UX`jUFz*a* z7OP5WR%h!bs%U-VK-@J|<0qdwN4RRY&r3az_nD2d5}-+dNst16Ke1RsM?Tse`vpI{ z%&3rlG##O;5~{@EGhP|>%HIMUDKXHbp~$p82rZiKqrh+uW4#xh=+=z_aB{cIr*}<^ zaZ`ffIgQ{P7ub_1o(Y|ZTLyi{aKi}?frmaUpq3fy{g>rQrpTfXLk*_s{HhxclG60p zc9RLV6#Vt-P&eOyrkftYZy-t(t2#DdYi{>N857&~I@P{OphLFPImRd=17Pf0jP$OZ zwH{1<*kx<3oT|ur`}HEhcrZ!4F5rcAt1Usv+!M z-*)=1L>D)_efoc(VSU;X{2*4p*(&T$?zsUbzx5VK_$Tdufc?p5tib-{H(P*%*O;iI zH(r8+*HCd*M~e`SAYI@Gehks^eb-1fg0y~^`?W_ltZ(6JS?~m7H?XF~of1E`nqZ^& zNDBrXe@28C(1IYjEL| zll#RKI-SL}Y$+DaP%aib&Nl@AX_1W^Bh{L3whsZaaz-WSAqEniP|WbTPtHb52D@vf zTkf-UMw44TUT7fsq^7YkaLs|JmW9j&<5}iYVwud1f{Lj59O?*Y&F2DdwMaNsufLP0 zHQkMWUfCmf+NyeB3+jBs3n<}JKU*ir#r;qnTVM5FN8J63^k6dmD}!GT^hTP6s!Z^( z*PdDX;a`-@S?|wzFZgs2cuf7bt}*lM{m=Q2ljFCC7wpH$@zKHL^62zr@6WkCH+-YN z0}0&C!Pt*9HdibszN^AT;|(Y@o$6lKso{5j?Xf%8e$6Smt~~ZOgHnsXGK<<_+xOwJ zJ3E2T_+I$}cX0LYlFzoUXqNXHrJ9ku{;Vp@C=Nox8y|*A`(X^EiwFm02jf+Ics&MY zwu6C#K;(@F)>+!SV|ZQPZLJ++C)8l1JdX!x5!`r?pD-+6F8uD1ori_OHyPY{a52b# z7a89=Zt>}y!(_Uy_i#UU(O~2o7-?IU*2q%3(+oKKB8J*T^?UBQ}WqNCTq+PKEP?{5+60`K^;a}SgO{#HmJE}%G+Ro`xFFghnH+_ zNW2~S2#I^49-6>5#2$+_w+3)^w<+#_?m>j;+-n?xA!);5>`%Hzakn+=?m+~&bdTXv zS;e63%yPQZz1hVVVG>`=pVL^c00&IM39>oyxm^p)=Ynd|jifHB=ffO2YZyr@WS%N< zQ5SZwgSmHJggeB`=06zWmGxuv_E59zFf$**8yroAF=Y zJo-=lhu`FYS_UY_y*XzChv%ySQdES!&~N`q+yQ7*dukW!U?qCNv`3{ynS@Fq{sNKuN-hE=jWamHCAW}UL|2+>c-%-W zvQ=vX%0w^)_2*cRAobXd${!l^fVomK)0NN1>+PSOygYiv&JTZoIzPHRq$<|vBjf23 z_A(9mLgYr~A{$bg4L+q?RVyuYT@|$`RU)+ZGm=@!oolN8u4Z`Ebifc&S&GEc6NtVK zQ#KU_>Y!G}&55H~jylOy%q8Au0{&r%-tW40q${0+$%jA;$pSLDxnX6M8@X(7u%j6i zh_xIG#BV6oZ$ycIW!0oJgE@3;SGJQfK7+{%zT9*M zPYy4CIz9j4elz$YxEBYMf7YAIJngO98gMzRE1K_4&rE6~+_fTLGonN^ER74>nAkDJ zq9Rex@SbyDh+5^rstw(aXsrcyXMcm@_Kxqm)xkSiV7K@_VAnX#xDa;?vQIg~Sm`3< z>qlpdr)g<_*-B%<8?^=LsqKc1zkM_uKl{UQJRFZkY&;s;|Ba(B9({uk+1}nb0`QN2 z{Db{8IX^i%c?G`{VN>nL(%+|q3n4WPB3sc7r0!xxzf%pAE9gVNSb^NHO)y^;kmXaQ zs<1{S><+rrGz3SbtBt~|PNynexn*>H4cUbX?q6bmHzK|?-;<3?(}pPt76WgOhTE`J z>3M!l2#`=IbEARczb>bfBZB#xwOBWv!j!X%gM?9A-gcyb9}ygWTVKK;p3(DBj9 z;jpHxFY*K6Vk&mb<*ZZ&x8hQzz&bd~_zJHo)nsY2=d{7O?MGre9-(&eBVEAJoMxGr z8Kw%LfQaHy08H@o2l5pkicCpgJ;u%ZPgd%GE?QWs92&`4Lss5_njP_>;`Wj4K_-%} zAmd=Rv@(X{7InTgL1WBuAy4XVX&&vc6II6#1qx7e00BNgmPoF;&3_%Kx)=G}U(V`i z(C!#J?4z^mXZ6;p2T(I9`_AH-=9@~ zO9u)PD9 z>Sb!);BPrw$oayT%N?L9k|?`1^J`hE9B<9^CB!(jAaI^B)Y=WQ2c4;#7I8yznbwui z!@wi}6|H1mePCBmb)7)Ln6=F4`oOZv!BruR3vKoK!miaQcJ)f{=EA@QP`g@xE%^uA zE%PGXGQ2aV* zxT$(N_6!)dWw>^3L0lnoAI9q(eL;)h+;vw!)o1R^U8`Y*f3+k9$IbrGGNuxZ7^)U9 zwd$rbr>j_Ms{#bP+t}0TuxSy0_&}dRp$D|G*e9(I3Q;cEH=~i8nf;6;nE-9NpwZPq zve?Ts6EHU?49Qiq?GY5(M8fl@JBbYOY@Izg*>mzll=yL94hpefPuR z;o0Q)=*L5_?T9=D0F(V6kZ}=p%bfA47J1?|^BHK+RZbjh*fcJ{qTYai0Zi97p46w= zfv`-6rB>T4geY}z09{%#ZqAP#PJO92l;gBmTuX6d|0UtRKH$V(D_MY?M+T~;Ow*>( z?li}3*>7+)+$`HNcT>M(hXx&sQmWLGB+QtdtzpXy2-DZG(y)(I1xg1>)OHPPqua2? z4UZ9I8BzCmcbsR(_(iOLQp5wD&_Zy34KQsxD{>U>%y~Q-xdHd-vQQd!E^Z=8$T57- zdhHGbdnLYmJbW}9*Sx_KqXoaAM#(OZFLp03jz3+YbO1mt(R8|BdMBeaxa2*P>47~} zdYvYWTK5cZp@U+#;EcUIz8D}Mv2%dM>VjS_k1uG696Tq1z^Pe(X%X)WJRRLRLzqS9 z-M*6w7-#?Y@agE=$j1%EF7YA*7x`_sIo$ph2pEwpNFrP@7u0BaT5rb`pNy%MYN<&{`<4c;YvU4;UWrCvtqUOlPE=j-EneFikQLix^|?08#9HNS}LUa&CZy-Lqgy2 z1?~i_?}~96f$$YhD+;#|1mTWOsI(co^rJ(tWz%tjenSR#aD>!FG#$^tIL_LmxFFHx(_@ch5zJe03MkOlidrIvX zPkZY+#uOlWSSvy94jS9pH9CPove8vhfW37>);5aE>GJV7^~&ny&RcnTd~rSQ_34*k z@av=c*T+4!eOidz9z@?iXXD{`INo7ieC0X#A*M2a=ZzUcjg#O(#{{tB(13G-rcQe# zT!UT*3!@PyvREMNxez3!;FImK*4YkQ^1R@4JU*6qaj&n#?M5)QvL`Z?-0%9^BX} zX*t4wrbG66h9CG{Lq_)NRCTz*$O0oQ9QzM(SvN#@Ya71Xe?8fMJ$W>GcXoRG^Z4=T z>AQ>9lSfaVZH1Gpzu@$ zh}l-az_Z(XKhR}rM9C9_N5o21j=kur5aqRm5*4NtVn}y$Ib{s4p2SZ?YL#X98Q9-{ z!ln*>z3ZcP4!Hr-a-Q?dKbWpqQGu)1TThK*7e}uyE>F+E^40~823Ui052h>T+?nTx zlY^h1k1ebC{mJR&(aWFTU7YU!aCq4TkXJ_GxKdO(+q21*!YowErrb6NhS~Y^_Uz(v za(?;lzfWIS7!d-YMTuSWQd(xN8~o3I%FW>fWADWNXw*IOAY-U1PglcUgw^FjtXQgm zlFNIt+=r!|w)^ufcf<=9XG_u6?1w zxmk*(y2kIhVd8@{9oF!Gzm!#O_i4Cm`j#+5ocz^rVAimY9N~LhNcE4U+*W6Q;Bl(E z0X>`gaR-1#&9AoDns7>p$B<8}*X97dc(jn=jl4P>&{Sx{#B2taF34H!SPMPK6c+3q zJGn9o@LchfEg+vuN1PgMj6m_Q5LM1{dzfV|exi^mAkdN0?hRY-tPW}ivejY4qmHgc zIaOMk70bl6$Q<7UyAWy5;Ldb^o(;M%W}CB2kv-d=vi;DElv;2KY&p9|0A)a$zd+dU z4uQZv1>0U)S*qlvKs^V-Tk@IeLwpKMAEXGfOp<8{I|od6>Y0>@g{4vm49->#exKdA zqUB)gm*BZcD>Ud7rJC|-wsLSNMUid8hQ1c%%4%V%G`8t3ODq>lc*cCr8;6?^f97+M zB8W`Q0Wrd;YtA!;u{{uYXoXmf24lrft3q(Q*phUS6Su;41?);X|>Xpvad_bO@hrsWIf9?l7NYyt}QWBp9h&DEC9hwwCN06p{H9d=a3brGM zo>Q*<#o!l*$A|lu?7MU-)9>-{aQt8@Q*_i4Zf=w#SiXlI&xeCCNl^5Fji0TR`1Hcc zsXS+si~XY`X8B;I<_b?+5X@Z2CGCbNXrZwu$T!=yT@drj%b$nr1=l3{*PebS3ftY} z_%Gv#3fd@(jITiafQW)xf9$%pyN1dHMyJSYbtB;TYFRWeRsqZFiNTZMh)u5-=uz#m37q{0?%*l9+yAAO}@B<5e0Khhu^4Z17E-3o z$*a3Rk7nb7U*nJuUN8u#(O0pa%$T;Hd`AZE@7Z@~4AkE@KKltyf6M@!oYii$xfQK~ z&Es4%?g~42??Khyp{C&PgVv1Cxz)iu$_b=3Hms$PAcI#sL5L5VicH;5{2#1nRbSU( zITrU861x!KQ~DN-`fPg)ceU?8T9C6Jj=?U96OlF=K6VYe+Kuok`0kd^uwmR_H0o;O zTcULASd6pDX?{(&e&U$rzwhWKqj@Z4OB2+lps2cUC_3N2BHWFsP%pl(M7Z|>AK?) z{;7mS5u~f>>77%3wy7 zK1x_b(c6J+L^CP!1S62)YCV6mBW*^EG8WuaCB(fqtRc?0g?cFLF^IS1nvw&Y_Ec9c zv7&P(mUJC~T{mg8C7EWbWxklV2OY`mgOOqCki%|Rv?bZA)&!b z@ACymf1c&Rh+3IW{Wr0t9|PRUUe2CEw(7wP#@YV){<9}o2}4&)kUKJ-pw0L!)vjEaB1IB&sYclqjZXWi2Uok23pt9fGjHDJuAiZFAgvNs6RJ|mD#T^yvV^%C$8g5^W%f|I8aZr~=V&lbeZYR(XbW;wkYUfT63 zf5p7YNRCpaQ{h}tXQJ{%l$LMQ19A8T<~=wlrYrB`4&$9>0xpur!V-Nj6&h7SYu~O6 z3suD7QV``2*H4BO$t74b^JGz4&6w;Qb=}@nSP3Wf^7!N|jv%Y2?)2pNXZF+S`41QI zV!(%Zy|NWoC#Nq14sYioSfya{>mw3xf5&x_mYnCRC6P{Y#xp3P0RqpqJ28!13YX)t zV~=Y{51AV78QfA(*jR0-qxb|nqnYK>A(>egU`K(=LqXbHI4XmPIKz_)gTqwz^>8&38&WX?e20%xcBq7Lt+nJc!Aud8_Aq*fAp?oe^svf zaf%=8M{iPe>o&F9u@2yTSnu73>k?XE`!;{a4{)gX``_7MF!&zdxUt*EL7VMTBm&eH5Tte-n7=c&Ek5wXz_53M zHuuJjT8?+x2$KIg6&Goss2N8K-c$e`f7X#rsGyPV zQiJ0yz232oAS^K&0qPOXC|}<&T<{VYeJL8O-f#E1R~i@DlbUfEc78G|Q$qL_D@6t@ zH(N2iv`Q;qLK#?3loSk#G3=rEUQcDS8yB_J zcd}pI6_E(0pq&oupBE)vz)>@3YAR-RY=e*BY!XM4eo3PZ<%M8qe}O1likXW%C_U4K z;QM$Iv8Bb#O`WgT`hBOaYZkRTOysJXFPy$(_ae?BZqmvAvBv9Q@Nd#&2;MU*(9Pl8 zD|hGL^K{n>qwXGOis>b(H8^>|t_Pkm zD|eZPjtc86*^mRme=*B5M2(~-Ak6?~7v}}akXr`;Ak(3{N{hj@_~ND|(=>2Tcet1JP*&$XHD5 z+3^>0IH3ts&ivj(d9}2nU(6rkz5Qt8G3V-Gn`m%U7V(fdGqmsY?B>H!Ilfx2QZLLZ zy^?5-aJ#Vve+JeC1$V&rUDu~C`#^4ec6M~~s?RQ7zr8#-{pq9+a_9c($;&=FKRrI| zGprfVufbiseQ~jWe)Qt7&)%K{f1HKC$8X-gI6k^~4ZmExeG$OgKYjCNa&pjTXQvmJ zefIkF;&KnR_VMKM@MQnzaH7{va9|bqxkI9IlN~0}e^Rb%;P5^F0 zuvCN2=2?}2;lgUnXy_8fLM%neGbFO@sYo~|epdD;<(_mU6>epxNC~cGwsIOWIT`Sv zZtm=zz+7fg0yPJF^TtLws{^o0;lqlIvWKa|P0hTVv6T9jIO(t$#G~P}Fx@zk6-&X> zfyz6|e^!V+tP=ySzo?Bpf>NR7JV*cJRD`+JRc^{k2Lb!F6+BLYJ~9tAZfPE*yiz`_ z0M7M|=x7&YEKtpO%qOqW{4ejA$4%=3xoiv%7m8!UXh!r|QNb?I=7( zeK*KScf%M)ThK3Wxc5S77q}Jx6!X;{nvqo5nId;0ZUQ<0p)^RI^>08GcVrUW!%OCO zKbBCcbAAb+2Gsx1pfRJ+P2Kl3_fmy%FCeC5ncaB=u{W!-mNBb0WRu+6+~BY%d9Igs ze`BY0>Xz5$+8FA#@q$30h1xDUdSNy^cMqh#g5*Sz?g2O|xr8X7=>q}|#EqXBw9FzG z1dj>XP1^y1Fif%t4%sm`Xu*t!KNDq%MpR6AEJGh){NpiD;fbi3%#%_qMQ-Y#EjVEh z$f$L{q4_Ee^%%SG@#_d$6Xj`OVs+n}e|?Rrl7*ApfTB6<{zh=0bMDYm#8T_c0(x19 zh;)2)#=dhCMAlXcZTf2^DoV45BQU6&<$+l-SE0CT>gvJhYH`jc2N z+F36kBX{GCR{nmZ%yB4pRqG3o9@DTlK-OZEB8hrstWkQ*$uzrA1=$c?(Ub-YAg#ep zjPRz({=SJo{_d+d6w}f1^o7#$AQAFq9LPC3H0Cg5MAkfaefh1vFWneX(ol z_HJ!>4>?Se?V_k(2Q6w4an{o`jt4yQVWl{WHNotp`hJ||O|U-AfQq$d%%BN5ibXe+!|gK0Fb9 zm7`X;P}jx=*UuVK8z8Dr9lf>fv7hndXc%k$?7`%FS_Yq%CE^c-C?%dot`eFgV+IBw z1eE2BR?e;`mrIdKjIBlefTP4frznt;729k5!0PjwrBzu+dCa)X)HS3owNd=q9fVYx z%XYiqc?vhA9POThY^c3%f8fs(+n~6--SE%>=??~QQnVzf!T2NzNf8ntlsHUS5oT?;m?tR$;_u@o|T z_U&1xTcSy80bJb*i|JCpP&w4QTGSD2MzL8|>4nRQFrWgv3^0-+eAq9Y<{;2oX}?UT zc7YnJGK2^j*!@^xf57$G87JD1(0k4a-D8lUa{#3pBbP8x=5|d?77Hhq`c(#llncM_ zseAxtt3f*Lu>tJ27+f9tiw9TW^VWRkRo?@1_aOvS|0P1QslL;6Ck-+-SLY~6Zf5O5@gCSle$m=;fJ$=Kj zq!ZfXGY96&tx`j))mZ)F?C9i`_UAnadYl!dz!C{m3h&w;7GQ=5Bm~EMu`DH880q7h zZCZTZ6*8Z{qkZ>|YG9D#K8#r>far^onvMN|+jid!EKHZ_JRq3kQ4~wljB?h(=oUkC z6Y&nNr+TgsVG2Z6FjzFptjT}?IHMmsO$fbFzha2tSf zp)uRe0Lmu&Kg0kX`!%t|=v?VojL4I(Um5bg)La?wQ=n7COJUA!(z#f*AF3XUlO-|N z&j(UKfk0%|KBf!;sp(!3muV2_Ku$u7S0W@J*XJ`&e>4XaOm?|{_U`2L;P80zvoprU zDl{E=mJ0q)Jde0rF~frORzml}c-;yH3;thG2Hxt+{WDf@P|hvl1PnNyS9pB68sIp! zRXO-h# zw!X#Af7+OuT=i;Q3G>A6L@)H9KtbTNN<<3I08kX_xr$0pHJx`6S}&sNl9o|G*<(zI zx`8n0JXv9IgUm4<49bf++OsnRu4`|;4O~-Q(N9)J1X*XH3eETpU-g-(%G{T$Fp4N= z>9xqIrJK1@DU+$-F{igAJ1|Kx$Q4dzkkLfRe?sem29W#uLTOeHLpg?QlSxu7D~JS- zwR~JF7-cl96fEr&t1$!X=o0HA^?krGwBikTH$2Bud$off?Am>%W(M4YD8r!7K-N(P zRvm{L*3J|Z#c!b2uB!QhQq2mky)b5Z9o1t&(rf8GO9@pVQ4|Qr)>c6&es|4e_bD_q ze|O(FRu=gqr$O9$J&hpR0<)doD`2Gq$9kQy;$xPngkw-;5^z?Z8&G?4){GoTkiZTg z3T3?X(Wn&c;r76SLq#{5gnE3QfEx5-YK)yNhc@-B6i^MS>xlP;7(D2`(aUS@K~Yd= zCl?tnw53pI`0^*JUnZz;?TJ5Fo_>SJf4Vt#+ep<2x7)M2K3MbY35~e?9gTySIe`Zrdt|{bZpVz|& zUSUXK?TK3(PFXKyMh+xr-8!k4HDG27%DZ40pJNkMGV#}nXDI5w=~l?>f9^X8Ihl8N z%iJpTnaoAc@>kPgy|rD1=34SDU;xW^&rzL@OFQ<-rUe)jJJordOJCvoLn9rBD9mH7X(8xY`3r^{UEr3@_&|+-pf2y zptM1NKvg;sRC{NpGiL_je{&758icgElK6d}a_{G^mG&AB@ugjBN>l|=3~Uv(IPkc^ z36M&@dmiZN?ebPjnLEW#4~)X3FZQ_W?UH{OScsGd`JfhJF;^6e=^LN)4;Fb6fGM&G zliSwry>4XcXr>X{cKLD6XtEP1WS!X7t;ZuD(>96Sx%MCmZXlrGe+n!o59xcVG|nc) zjp50{tG@LzYV&B(6=hh9*w!xsxhUm{;BJK;3TD%1V7 zOfNhHK`_FzJdQ5%5yTUUyoanam*eEHfobwLI@ISfCFtY)IOE>=>G5ID2XDfaEM0bG zU@(|DbaaM(S(j`@K{c97(s#&QN`-&ha0BN^+n36~5u+FU zimFt~U>2Q5RTs<-W|G1~>jZ$h6m(Skxl;fDg%Lo{RC&Woe~eEr*$KstPiU?$OP*^? zD`VRylgphtQK|NjJESPwjVGoeBH+matLw_JBnAEO&oe-?)9xxVV8GwgoA^ITPVA_lTxPlxcobzcD3@uSC2Hp($#KOFvi!7k4y z`#&6=yxKg+h|~bfNU@ka*}}P|tV1d{i3A(gDdiYHqh|3Whfa8e=_~nzMnc!Vg8i9t zvq2SH3VTB9est^1_!(N`D2qd93SxL{3l|4z$r+P|e?cdWPb(}fDP7!VJ$nwM#fb`+K@APC0jiXO?je#gf~3*YCsMKx)-p)<+Q5Al zRGZ28nvQjTrPDVp!=y+6g0~R-8iI2b1|CtqFt?JpyFt-v_;8CAdi-gP$pzZJUICT^ zx`VOKgh@!PM9kAWt=_O@TS7jwIT3 ze^_r8%AscYS)I(or&#<-%^JbcFfYL3sGX|`A>AdIYupZ|_EUkVkFhFfgYsH(u5i(b z6k5eGsB5l~lyNWnETOdv?@LMG2R*9^>mHomPC~ECbIl~M;I5LjUV$Tcx04%`Y6OKA zvm=+v9zo>%hB2MbghH0sInsB_Ye|xD?NDlV9AHR!5WOq}fU3?H%aI={jaMqFy zT+ahQ9keSL9o_u7@l|#ghx>2Ok1l_{&o!JsVa2~aGOzl&jYTPpSz-Jk&#fK;L&97v zoUl5FT%kh>T17$1qbR5Rwd6e+=tS{w^OQ(NGO>^EQQ?Mp_;l z4u^~<87m>uZ8%(Oj_Cws&vH?+um1=pg|Gh@q|5!|FKVjyzG5n8-_K_J+ef3v$&+s% zbN=nOE$ukWO@t~2Jvt?Oo(b5qH5WJWH9bd^RA$>bS%PA;d%404SUWISf9Sl~-p_Lw zQW)kM`WgxZ(j$dqcLD4W5GK$7kguZj+-qrhvQ_75xd74;$!IWSr*-9wSywOQXPjkx zK6kO{Zft?-(;5~E1rjeHiUx%?(BO^-GO~r}ZIc%D`tbPp)LS^<73yR=k;Fa~jV@|g z(F-RK{N7r5OUp=lm{=fme^Sb+K+S^ZHJ?irc>@9xZ;+(QS^aaElTL%Ya<4<0i_=PV zO-e%#aW<9d zceH-rGlo|cKqumZNGj)ihRLVTT)RQo&JKR_reFW@JB#yNm8Bc1f7jL2O@XJo(5zIy2EJL#5uKfdKfW-QXQGW7N8oZp z#(5_&cgF)r&~wbx15z45F5%xV4qw475ux8?{SU@8q$%C&9^Gu!`?}}niD#Lodp5}= zg&uru*ElMgOt0JKMV1%?N>fX$zJc>xKi5=0O05&p+lxKK6eqebZw zF95Xtc7g-tah|E^K$}(OzpZO{V>xlK*>!Kl_FX@&Jc7TmnSknWbzuhJr=G!oeC0l{ zThX{rUix@ye_%Ms8i6L^ix%|n>-q&a^<>Z@se`O94i@rC|JG&3M8{n86FPLhU#@IR z@+77y>*0f5*vmQ=7G8S9k__wVgp!$+X|QArgo*h0QubXqLMkX157N6*yN9U*Vuk^@ zrO1f)nLs-tPX`tag;XEgVOrY(0_n0vT~03JF0R^cfA_q;{dOIl{q?gR*tZJy4ojPETX#!|2!LSsL| z5FC&*3~A8~Z4+;I(R=k2_iHxSw~}!V_uMXLp!wFobA63bMgUliwBz;B4rx$DQsu7J$Fq4p~ ziQ)(eLiPy$-V#u3E(u*tR1?q&dOd*Aa}K?htnc}T_y7SzPL*&IfnCz)F60o=;i;8j ze_9Y7y$Bz~&?pswqe@Vx><1yO*w+nkaNzur$KnR8nxZuIEE7Q6&5epQSSUpcVcaf< zz&UYmpJK3(lz&f}H7s z5aRJTLLTMekW`9C43sf!#KCx*e?4tff5e%tyU)bT42&9-|1W$0zTU=>Mf^F>;e3$gz(|Zf=lM#`p zIso87YP(0+9k&Qn~#F`D1GE{jpNgATJ0Cda)PE~MbPBl;$?BYCZxDV)R;Q&ha<7Ke@s%XY1oxR1{Vet z{Z&&b%SKwI`CI2$15|yLbdihT(Mv{JW8=>lqe$ta>b{-V|VoW z?DYI{@8pu5oL(O8w$_S%UV}VLEKX4*XE`quRGJOt0bmi78_CTw0AAewu~CF!p(xCf z;D!yiGs*a6nB?0~uY7TMf57(1CF)t|niXh$^Q))-a2p*8LIv!9C+Ms8)4wcy@lczjt|fP|NLm z*z9u$FTk&568mL#4Kn!HIZrHS&?f^>9c|@~+8yZB%1~i~z$diyf6r`j9T29$+=wT~ z`OK)i8bp7D5Kwtlh0oXuntEl8F<2M6j@UGCu8Kr50eazOsbEZO{Ny-($r-O9!J!l zv^~V*uubd@@x08ue@0(C+Zsn(+wso!v#n=4&$j>amuJH$8t#mD{vw_YqtT0zcpmL+ zx2%1mPK=iweuWrlrZWh1q2r@(q|Ayc`oi;yzpOIkUN3kE1Ef5S1L(klWD+Gf3EDt` zVI4W#LCxAp;?kuiap(CYg}10YM6my9KgpB8v^d_yp)9s&LC9huJQI$!w~G^ zQIL`!qZFmmf71i&j#!1dtVj8P()pyetu$3?{z)AQ_?>xRxN5Wpdwux&^!#t^_1?+e zH;1nePcD}i4D%?D8^O0yeB$kBxQ{OXZ!~wHTCRd9wXtaREb=s%La)T!Dz#B0F&LS; zg%B{%e`K0ObC)m#cGekxhrRXj=XwVI*wqAnQu^IBe>=hkKqjHnKs~w=surEq4C+aH z*qTFXHTXECtZVP+q6(t`4Lk)H^DhoBH`wvnn~QHP{G-7$Mgk;EL#NMJ*jop?=sYF5 z$!`uXyYp|ntR2$NKneE|qyc!59iP9^i*)?z4MvM0YOeGaiRx1YbO6GGE6m{oeESQ^ zTKCb4e@91NDIb?4P01a=d%P|P4VNfHub#(zAQX?pWy*yhv>6k4W=fuvQxPU)8-tb= zE3A|SdINPA=|kco%PlCo0bJdroX{W?PT&4zfoad2rBddU&tU^xVWo^QpF$SBNmxk& zGG%?_3#}(sDS?O_93I;+X49nU*g_YIR0L@*e@LV*rqg(tS(TLu@mFrHO=VFI27{nPQ*&SG2CF6$0fFPT+y)XGU>O;0$P$~|c(Vo8;0%&3B^9`mEko9_lwbR(X1Qu$c@n7%#Z{px*r^iS8f7{hJbiiXU ze8NgM;cLHKcM)Tl|8^A0TDF})5(07JCShH468))0xVWy;GW75%iRSpO?_2vNBd z6_)3Pe3#6?d2)RIW&_m;pexL0%d~cvKq$5KtdT!4Y>;9|Ij-XTA-vqoov7f?VO`$c4~S(3?u zU0xo$BG2}g?SDmpQ^G6*s5=`58yDD(m1ktusNoqBy1pyWS$GWDj^`qRfDZP?#kcB< z#DC@$z_r(&GUisT*#nvBw=@$9Rzfq#mgEp`_l&v$OAGOnJe|lQDW@~l8pMlae`CR| zu=)@j@mR~nuxOf^;F-6}M9 z?*gM#qRigu|B8122a|7Ueo^&=6RI?S`_>beHAC;e=+_Szxaj6G5bXiWE8r>e(~P=#cOn`$1%l;O=s{2 zzRl==^n7Y!O3VtXG5x5Ki1s#1I z2hxkiiIthNI0PU-A(s0Yfs8<2@tnH=e9vT~Fct$OFee4tYslKLRxIUZ1}?{Jhfs@! zLR=r4(XFbqR0B5LVtZ~)6~=UfCTD%GWl;%WTM&RIRjE+y**|+TU{67c!i+*=tbsOg zDeH;&j!JOK%3+jV1h6Q$f95+I0bYEF_>YC>D5cR#Hi6-Gt;(>R8`{en=q2Py<`ydy z?5{inp?@84IT~fT0~O2&jDhhOa710wtA&9eZ?5kGJ#Kh6J(LM2iW>JGjansfW7iYq zs&|V_5i|`iElx`S4y8&yN9Yb!V&)p=*^<6Pty;X%8?K+32E}9xe?Rk9b6P|LkcF45 z(||fEr73mka$m!p!=V_EQ$Q#%CItd0AixbjkuF#`O%t)0WtPdZ~s@*wytelpPD4V~69>uf=nKJ+&aVA~VMX|tlP(N9e7?EkIea+pK zCL_}b<+S%6vKJs*f7b!eV8gJcOIcJ=33Q`J<*GH7{3_7KtqI5JJL>~>;Y0bsa$`~9 zfK-qQeaJsCw|3)eVYri-yus|5CV2RHs#TA^9QUn8Nzp$Z45{Tb2nUrA7Nb|KyTL8m z(}$72^xe}z#RfF1fp1iiFd4fN3=&wUs+`TN_k^ zUqO|9S2=n^|5>ZI;NcZeR0&D9S7P2nUze7FRn8+}ux`^i>C2^{P?U7eRKzofM372( zMOh}{3|-RThHv4oxgJ7ArO*by&Z&IS8gLX!nfrX(olEQ{XWYc@0e-I406wx%JU=hSlE>T$VSB+L= z-Ct^%rcm|)MJtm_(Xvq#5pUKl3lC;Sj%s~qobh~p5AaP`A z3|iLge+NmfPVR9MkIA(xWv+~q1L9!8%pcfseIeXLkC-dm5WJ0yu~rD|nhv@v_h}>% zJ|CDWiJFy}8c&I8wnc?6u|bTV04*P_QZ0it5l#9@Pb6ariNjP#6Jlv*IWLUo2THj^ zPJ?litPR)oeR{f<%E{Z4^}z88+t2Pl)7B|JxR zj(`p8ph8b?PL7XGzGG{_YX^tN>o!_@4~is78&vq}_|3()d&kFKP8xi5@U<8F)<%{N ze_Oy^u=>7~su^2YnB*o5tF98UTie~RQKS$M$oH&dB<)^#mfVkS6+^T;s)OEnB} z?1B=MU|Vny*p2eC{4x3#jcx$@L}`iyi{Qmc8C$W6M8=CmHtS2BW>#a|@GHlW%h!_v z++Sox33Ptt#aH{}3<7l_<;;F$8z#J_f9#hZ?DfB3nx zsq)NcUWjBWSqfF(RY38KvBUp;c65Gdj@G(`-!tqSRQ~{8fjtdI(b!`bW`X)wDYXIv z3XL@5tf@kfJ!K?@M3qf|v-87~z1N39*bC7iP;v?)hHH&5{rwZ6bqF3gZce0_i2=Jv zW=YD6bj~i`oE)8=TwI=>AG*e5f59$J&oA*s_{|(`Zx}Fcy{9fk>f-RSo}$ULq$bj_ z&1(RwZ5rDF8vrot$A;S|;FB;7zd>h7cdudiirKMe>+ApnGiwFBg8Hku$uS5pm+O_V zgQ-|cO6dwym^swgLE-|Zn{Zf+g_TTP@TXUbt>Kxo)e7OZ^9qQ#dOuDOfAi2noY1AE zm<{WdyMlCZEpI?Q6A;!Me{2>w7aS62m0kGAv()&TMkU59(yhDXxW0<}{&4I#@IJB9 zmKo4Sn>n(}5NRTTQvSzEf5%fBdj^C~_bhyGi%N4f-#`H{rXtFg3akx|=x#zzrsgp!3HTrK_SWwL+()tKP!%4U&SB#hkKej8S^ z;RVuLVl}%y5-=T?9l<#Jxk^f?G+>Nid;+r9{@EMC%&+J1`+1949VW^Ai0xLq+zZ)2 z1h)Y%oQ-8w;HtBce5co*>}z_A+j?J~Hi>eh*2ouT-@JF9yOVj;kPHyj&p*G+fEO*j z{X(ffk$uy`f3tAfCLPl~P)asLjS+;9$`%H*jM7UH2x1HUfr5gXInoCz!M3PQn=FWD zSyXD@gF@BT$j!30z0TBJMaJ@Bs}q$LnaQ~tf_jTok;>XR+F7hH*e&MdQaNV7FpWuH zu(i!@A&Y?HFmwiD;O1PYuAS<~vX5gRapN<4o+|>ee>0=S$6_fI)XTERIJ{v_FAv#p z7oBq*fri@fdJB)T7HGeG$TM*r{e(uP8x{Yo!Z<(lN6}6zHyw1TF+HF+$)nYobq~ zDMS%h1)-_bQd=A!v94KOayEuqK4^HM<{Wf|vDD#=KxbTcq0|gw-+_IjrxuX-+#)5e ze-=?(@EI?Y2(v^{{^!OD=I;QwX1S572}6F|NVvHHw7!nbrK5(`(1{>Ci*7bC4jUKJ z4StiN%CbepK~7&GaOJ_*!L}G+Jp#vVWIY-g(4~%$>V|@zZq~!rm6VHL<$ef`Ro(Ya zUxnp8T)wDVjs_{PNyQ7Em74gaeL?gJ?+08-ldfLDUe`Hka z%sXU~0nsg%`u=t`k3S1ECBn^CR7u8*Es=5kzR%!@p36Yr z^PywFimE<#UWM<(T9La4%Kv%FIPNIWdK{F2>^*{xN*dA{{DPqVF za{yO`MX3S`bhV^SVWZ%lXuX4;D5f%=tEmKWbKThZqz$$KrwcFU8z7MPe~@Z==4IU3 zRNmly%|=NHD_!_O31%n5{eBH+P?S7LmBB+W5aSqqj_0svuLKovhZ}ktbI-fUz?X&-l!GKH&=vz zPkTvmR2)newn>Vi@w{thf2&cAH@D=P{|E{yvVg9j#+v)75M;dZiarp%Q9UDBnmXVP z*-4n9<&;s3wJk%>PQcC}&ldc)r9|jSLr6YfuYo984Sbxu3#!Fw3B@P~zy`qU>kS*% z6YRr|bNY@<7>gn5s_^~uPFsu|cAPVsI~P?_CKJRuK=DN1|A?+xf5T^}Q7%gUzK!OF z0y{u_G7AEpBeZ5v+=C67OftLCSYpvgVqbrAvG@I<-s-QvIY0d2{OIzKBoKUM(kv}e zM^UB*$-fg#lN7=RkiO7S;fWqrRdJfPhrQ4XNk0=kFj3?Xo)vL@j~6r0-NP{?o+j_F zC5WWRq@TLVNpcKCe@&}%BMVhp&m~(ktkGQ2#P*P4Nu6#K_4RBnCVa`}bWt*vS8mkD z!%YQNnr1d&+T9K$)G4?lG03{R1hFUTBg@ES-&@YU%=&nCg~wF(s#2mTZhq?!%?5RY zH+K-Q*a8)Ip-Uf1%}oesV`hOI^ixi54`}Yj=WnKLDw`DYe@2-wV&`siX1NyPOcW$Y zC1?UryEasjYJRYKs-I2zM(M?EJ``jv?X1?4vF0x3&nZ`=R%qSM3ws5TeZ%j@qjgXm zN-NeAut-B6OcVn*o~aIiaW^8a=RRX`*`smeOLrn{#Z(HUZCgfDv&YuyqP#y557=I6 z3mE$KX$(Rnf47MY%GC1>78PSUvFTD|czTWa;^Y2c+@QT+!dARe4!%*=ME$w;Oky#J zJ(weC;^4}XBAIGtSUZu>+WU(rWWDN^#YVPtuZKttndP&_UcBk6QuetVo8#B_dKqqQ zwLddUGA#4@{FzthHFN7hKoox1Y*|zp0aH_qz7|?tf1N4c{%y#Qu7!>8_<;yG5v2uF z9br+4Qr1Ef@G^jsIQks8R!k5iT*{VdkWOt}G6h#tp*8}~5V*(z1?d?~)GFr;63i){ zfDp+&HR>hok}%co*_!jb*;H?TkTfPR4usMo!Co2R9Aw~ef2D+S08~ym?`)Z19|32`b2?~AHP|a> znCqb`0=kUm4Lw$sC`6e^e`)R-Uz9=!@6fvKkd|wdVGBKbY(&#@m6x9Un8a}^8h!Y1 zHciqV1ULeS7@Z@=v!}kcp+E50v#VHn#}3(~SdrBiQl+iQ%bN`Wt~F`W%VGEd>#Db1 ze>fXWQ3rg38Cv`b!DoPY?gzrzG3q;zGQxLT#9SQ}Q8^mcl6ehTvDJ2BaC4vwn>1jsNUXR*&>*HlTX=w*f7C&N z)5bDRBNOi;A!vs?CJD#iofF&x_T3Rh=w5vL=JMe5hZA;k3hHQx%4u+~=yFQ5x)v1i zhYV9&o7oHtD{UlL9A_>{qZFfv<`CGS3IXh!lOchV>oF4qv6@yTi{(vFbjf%_AoezF z)=PgiahBkKvI&tiMk8OqC3t=k5do zf^6Y<6R&}y+(;OJea7jL{j|~?_pgk+4zXy&MZp0;9Pe^hv_cZjhz z(xTUZ^W_Wsy(wf_Wf;v;HXQdpi>9~w#_{7_Qiqg~>~%MVSa0)H=vN1A9WP&VSvc=+ zl9eKhZOw2ICsc=U3Kb?Weh`uU(B@s`u_;xEO9AUO2!<9cKMv3cI)OcH!FVmJb!m}W zTCtmMSdK|w0=#S##ba<}e}nDCT%6aUNO=xr$-DamPgKCF%^u*heT3~CC1u8E2|;&i znPd}}KtE+MBK^7RGonuq@ev1%UWDL>FdO3}$ManA$#$K5=3c@?ft^ykAWeuuV}>E2IV1 z1`>!T2~LK`*Bp%of3<9H&(W*AY6M>7Ig{hDR!7!a+Y$k1u}C>sN;RiUB#^B1S`X=9dz}~##RHfH(6TT@ zWRxb)je1Hsls2OD-UadW#4pKrZ(q%+{xTRYK&2%XSMv0# zzU#$sJtZ!3IJ^Att_)1ths_See`ku;`>cHyXtP={M} z!7zY|w8_)S1Ty$b$z+jFc?Q5709CW$03zrcJ7xo4EXJi%)MRnxWt%Cw&nT)>1vBLV zP(0cY6D)&GawTATx)4&H)raSFFsjbroi->Je~p=nModMHLDhg7L#^4&4aRc!+SuTK zCwdXuyh%wgG9?ycc0sZz9oI)-bnK)6E)qxt_-<$z=;7D^a)lQ~B8uLC?XkwUz+-(c zHLoE70nM3-hLcK^o6WF&+@v6=klFf>G@#F!NT))KQ^>~)}gM3Mk_ zK!?8}jDHQ0Q7s?a#aj*8T2bFbZ*ECpx3Lfqn1DtnnyfW_T3)z5V3*GG<`&u1C?Fk) zV+avmAix*~_EvE$(-uP#XnS$)M|5-p;@PO0OpNW)0?0e+Mli7^6o6q0c8GmL2gAr1`sLHUuwJe0Rvp&SQ^o~E51WLj6@`7;0M$< zFjax5GH3WRhSahVZGcs@-2Av=N=hgjZ+d|NVdfnz34|qun`dq>mx3Q4c&TdSms~P; z27g??de!h`ZaAK5?hRB+^^V%@G!{K$zA6J~A`|xk9L-P`jyp6^#gZwx;f{efus&H| z`r|51`|viOSmTIIBgkaet=96kZ;e>oGD zAIh=Cf#wDZ9e3Va0Bd_Qb=)zA+-x{i_4njZT>qq{)Dh)bR7wO(5QbKgGXz4uXTmBQ zlxFE*1R-=Ba!)b#!MGyGylu7@!he22(ts>kNDdjWz3?zo4h_)3P_N%Mwp=sC0A~?oiU>iRi)MOBWG`@^;*lEwmId&Dt4y<6Ey?HA zC`}@}Hi@Y^08UD4P4TVNNcqZO8=2BvT7ZaTPX2XX)G~8FcjTF6vdSXSPx9{Hatngo z_Uoup-V??#q-U382&n1U9hNZ!Zv@V9!z9w`7AP9PkUkp6slidD;C~tP*ZQRqQ7g-E z@zm6XtxN@vT|f{tz@sZ+g$@JTh=hP-S*!QxV!POkBglZ+9M6M7?a=^?n=iM!d{;o|}%$(t;U`5^*Wm z1EV#_BxC(21`YyV`hPRlp$XunZDeRR$A_Q>6w!$*>S~oe2-gK2X9DmNI652EYTqRA z5p*_m3=V4<1xwP%95+PTRwk?EWU%4ZU^o~KcDf#c!99Qa;xAnf*cm*3`o)S)^UpqG z7ssbRK#|Gi&wl1-z9Gq6r1Hj;!{o+U3Ni6cwM72|#Bblt_n)GAP=ElE2Q9Fo~`_K>TLo08i5xe{o}p%-lw zPmuWOZb%BS67TW?p>!LIp{V-V))qYYbCq24)WM~e(tk^4_Op$=SQ;{>k%>wLn@Bzf z>xrwva3-9izfD2sJL^1{Bs#%sTiyMx;S@U)o|2y8hJUrR|8+(0va&&om zzT|}_2Y)n~I0VBDA#2shL~s-MzSH#^49i2I2ysDEaQ}eLR)~}np1yVHC|SY2+B?Y% z#0yqx2lV+q;jpM?<__2oUI~OAC-9eE!D_64Xj3NhBFRcNDR@35)Tj~2=Y;^lxka7C z)iG(h%EzTb0Ydl@5vbl_cJ9v=PaTwk?^j(E2Y=&|QLb_F;hObn^8f}zO$oZMwFU(8 z7%g1lDZ?0ScaZgw+aT{&Ko~CaR!b9|5KArO)9@Tv?}o8;Q}|1a`N;rklu8~C*fDl(w01Wu zNPk&CB&!g~z?=pbqaMO7_8dgZg8lo_-~X?AVCzCP2b$@AaTUpl9e#g^b(D`@9qsR3 z9-W@7$TwWNMkY%wy`EL0&5LT}s%wJsLdH!@*YHBptO+-;ryF=0O(>+a<5G5@D?rx< zyd)sRS2duhD=|llF%8In(?gIj`M)>`!+#YV@Z`bau{+{g6xZ|Ujiu~)HPrR|4h*j3 z)`k{J4AoEslNGp~7N(CgEnz5OpS}6|_~_zW_V%rr!~fcP`*wFM0XnknA($dO6pNIN zWe82wtOQI2&1@bBu`VyZnzoqFz#!-G2`IqH6<8Nd;3Y?0Jc&hyY2f1ABs7}!~>xt^rkW;&zQh=sPtiH zJ01XV;wmKu^#yH{rCBJ!XN_^s%;xrIiBh&htTJ|F6<$)U>{)!W_XNq(_Ob^J?WGC1 zvnP*JHT~tC@M=wh>w53I!=A~_K+m*slVRVcJ^ZX4z600QRc(Oi_(C{v8h;rG>Uvyp zCF&s^=2K}z8;h6K-4o+b*-9uqop=HPZGa0iip^ua@)@fqSv z)L2aWaVJ7_nhffMn932=NJT|5B9C1(+3h^C^Y{1MVQW?VO07_`qi8ulCvS+0*B2O$#$>cXRXR=4OzHay*d5 zWV0AY`v3G3gYsS30(e&I3t|d^L+3KDQf@PBv_#0B{AEj-1ceY4%}MzB;Tth>ri$7e zN3xvS6wl056-PHLL4VQ08+MXBK>x!RHN}7lYPhw<(j-G9IDk(MAgE2(e!4rkQtGKy z;F}{-!~2|;CX+Wj=5zI*><5vi_FHfle~x%kpR+h2G0)SSFx`p*iP(&w{Tc=z(;~!$ zPZLq_BATMx1hK`PMaX6w!rb!|kU7P>(#o~UCi<%ijOHRH0Dmm-B63<=7bm7SP+w4B zPg2Gs>{fjS;4#3X%)@Zt0bXDF$3Z;f^=8?f?PcluX?w}bE7K4Y}z)~-7B)duw zzK>qEHce**;J5@ynu-ZecOl~fZd7{Kh|~o*0_aOqq`)PQ_BMNd6}L=UW<^4(qOyqA z-Jwr0U}Q6uay4Ba*j%y0i?i)b{oki^t%T8-0E`PXfb8gL+4VF}6AmmL$R^U4p z^gnMz1N{f@51E6w=tc6EW{x09Ql}p5A8d;NO17p$5>r4r?`>)gZ6k~q1bI|n$T9tH z;4g5np?Re?(Qej$Z3cWh!vjETA8^e8Ud@)h<~j`5nJWjnC!)PoJ6n%VWmrp*kZEgjHCkT5iU+xWMz>EFDnH= zg#cE*EIiO<@+@(Ty|ybzCOjZh!sCW7Y|fR3lG_Gx?HAb4ZBDtGf=A((B-g4|pT@^_ zhTH8ApiTJsGh2x{F?Rz%G@E6^;%gY`XMeN55lWqa?P^9o(Oe{(eV_Zen4l3t6od&v zt~pyl06?d<$s0lRr~*=0@EfnQ)W9_}YancUAAt$`J9^OpF{3}+0A<%PSk~X!)$hRb zyX^Th_T7lFFZ+GiQZG&ni!0$>dn1c0fOar#JoDRly4}@=dHkvW`0%-XJTK&kkAKK| z-tykI|K1ny8ocM#-|7$jXP&h_b0$^dx$h884sD)<826Uyle{IPKx5^dHPvmdPZ-l= zG6mo^hcoD)K8)bd-)3tt3q4pUo!1|-wP*Gl-}7y%4*S7=XjIu?Jhpyu15&3cDiivO z;>M*1N5MZ9Kwh!8GkuX&D8ek8y1VaoErD9Tb`e*B)WnHp-w2a2AJpP zf=AQOQRNC?(NfAm`J7BjpX2kU`$T3G?m2~G0GbQ&B(?cUi4`~TNJAnIFnQzpHJB_c zuheuim$_dSjhUhZ%8Qm_Te~*#Ky$;C44P&@^we;dR>CBE^w0)@NzeBAY=6S4tV~iu z>ljijenuC+ZrrPFhV{x|2?#yPgfu|{DNoX#d-y``vLE$tKlQ(Yj6(YFU@$QM{Luq^ z(f`56HyD0jPk-_k?yoG#vM@l({AkOhx$b|=#Jh6AF!DlN|I{4LHUlvh*3V!Qn_ld! z_5b$2(jAyJ=zpc#Gk3uXJ#Zc=5%bS){F|*axnuA|;5^a+aW#k<-Glo7= zi1pQ92=F1ny<%<~xPr)|WMS0xF}D@xAl;>5>NGkzDhSF{aRI0^RLS)nG|@aR$ymYT zXRbow$ zZi_I0zCO2q%2pnU9U>mZ$2dEUxkjj{pYv|$@r*=@F>!%xI!j6dcKXGvKwSVDZhz7K zKwSX(cAkskSWb@R1b^!HD2ThlV!>oCn?rE}D2NDKZ*~+IwDR_H_?#Zbm`fAxlLehP zxvsstsE|r|wTKex+a%0JGP@Q9;*!}yomr!udQLIUI|xS@KBsseNTk4>N+B8*o%o!r z6lkLNv0$6sp}XH!hIfK?OKb&JVzPB?6UF{7dkRDG&H-=*gnx6$#5gHccu$fy(Teky z>P$quG9oj;6_KHgoxR#SI4}&-CN7<>ovi!S3}IXBNrORC$z2p#3!Wg>5;gRHO}M4r z?)|ej#$g4# z2Wi^JxxfKH%71+7MM|MJPRlt_Aqj_t#6`Brl2XhJE)<#{Ybp~MTY!(6eJKPmw^1_j zafgtJc$LOZ_R)q{+l2{EHW^ z;~K48SPdM*l4l~|`h?vfHa`+nNSO55kHK(2ZM}O!k6WbCBC*!r91Thw=@&WE`u<8v;r< zl~WRUL9g|aX#9vBj6ltyfViC50?QtrOC7^-J3KLfIuXvXbxL!gdMz<};A?>C1=AW; zfq%oOlvv-~*7xUm+akC0=|`@ToiwcXK?q*N;0@d%L=V>>f*^b;@r)A|F9NM82(K9; zKoR|eZcL!6n%4r2V?}$m#@#JFlbQKCvA_mltQ_G(xR_!J67%Z1d+ryCWWtU?qa3OE$d9slyvoqnGob~aSalKe$|3e z1yAJFNL3^KyRD&0p%s*~;71YA!xU|ywc4DQr6{tdBstGY{>}>)hsOIzHGQNSf@ySR z_DqSWcJIo9CccCP{EB^vM_hmR75h@jaT)$$LON>#IMD>)k<3J#pnKZUEtI(;B!4H@ zg9nTXm|0061lzuS{8WVK0=KdK&d`L5VX*R#W&g+|)+lEm%FtOu+@l~E$S5~KXJdar zxR@#&zK7h4mHXtiC;-SIue{_mW#QC8SAU4u75axElDc` zQa7i_(KPX37mDSCYt6e&z&$p)fVt47Z|VQH>{&DG?Vabd5mZKC&zHVLtM+tzHez4k z8^(~0)U73lxjiyGimF)!AxB=a66%9m^P}? zE8D)q%i3^uHEXB=y%RKLb3)KmxmRAL2ngs!$HJoHrc`PT}2w|myd7em&(u6UEs+MP2;xnP8%FTDWlsd=ZsBd!|5aBINMd15V*Xx)M%gmI*W0Oh(- zqJXqRswdkl>Y1iKN&qRMDwmmpa(h$H7jE%l^{&F|!&XpH^`K$0;o#O$Q8cqhSfQU5 z89K}h5hbd@$uEtS9}-x}12Tk`ceb`Rm?@NEvlI0nLo|>YFMp*2qanpDi3J}Z<}k+H z5@v~s*)Z#mIFoP-@x*Ak;9oT&(bkqNNAH6u(5;H7Uh>9ElrmZvU7^!oJiNUVbC#1b ztSw|9fxrE4v**SJ+5$#sPJy+QnR8?Xq(KX65ODg9KwRALv~lG|GjAN;Ugp*TKK7u;QaAt~ps0?5WuZ(v2ltl}MZz z;i9~DP?j|X-(1}c9`hU&5z}{IjYf!JG0SDai#bt?ah~`m#tEskhAo8(;(5krNu+!7 zQ=wp7kR|TNn|%A<0bGEU|DbB35^0jru{VZX3;qx`;(zgyk+9k5&fXBCKOWN6C05TY zL_i20c^y%0kQ+XS>%kRZu|k36T6jj1vP^}u3>vJ{QKja!cPtC3u_;_gTD$)Amqw)& zPUZb=vt0~7T1!}bzls+ ziMleCihm=t-(b{c7UStLhP!0adXD_cTwV)(EL7MmC=+7=M4`M&C;z&uQ^cdbp6%kL z!JF~;)f-Hh0#R29;ZmlI{;(dvMLQV`SvvQFc%XW%#h16@hGA&V*I-H+TKP@PNC8Z; zYoVYpr;9KKI1*{#Q!!h|FR81WBghiG!1b)CX@5l6g}WOVn;B{7tw=I0#grx}mz{q7 zUx)jb?A7_<|1Zq^4>9l|ZU08rmHLxwO~fm`L!Jip6)e1{6a=~6l2MN&>@jBsm> z>B2k^i-^w&`s0W!IQp(cbEn~KuI%xR3EdA-D=@T*980iFMoVl8DzK8&eL{&AU$7CN zBY%lPul5Fp_ZxSXb)|0a?0^pMUsMDwh9PB1ny4~~9FZfz*i}d(SK5qy1JJQnM6?$l zBdiKD$cVIu2CvS28|2(v2uczqk=@`Gkb3JEYva@dA zMmnwlv4W@zkjfpG;^an>V|$jYhEO9^JX)qck!RU;5*n>LJ!7AshWtIo(bP=9f9})A z{^QPnP>a8rL-iYoxKmBR4F52H!5`nbKVF-s;1~PXZy#`sTa20ho-t?SCI1 zaEwDc#xI!b{MldF?`e!%b{)N81p^*F+x};daSQu%qtf3FyB2l$?CHlHqtW3`FAsNt zksw4GvWXk62)qQ1jiw?{Sqn)+b6q__0!t~5L>5hFytrch%)$O-QQ72QL^pbkWFSunef!zNq;+m_yv_*GI2xg0zl~0!}CC_U}JsMr@zTtn^&{( z>v(8SSp}AUFzP^oA*^>{2Se={--y1tOuHB`7$?_BOc*~mlC1$Qws(J7KzANok5ED2 z%a?4p)#AD{w}LA@1`dL8)rYzC&0OI2yPz0A54xN3v&}xy0(eW}W%nm00DsaXC8~&L zSv_yNc0Ucbyzjj+4VR{Fu)Y1uqwf#d!Qrd(y>DJ0o?I>j9;xZ87|MWtVZBNPpIEW& zKk2Fd;!n^bg_f*INZebmH)*had6?FU>OsyUKi~}lw-nYIFaii>hUi9YN_G~rSoq%< z$o3W*dsiuQNFH0M|w0jW-o=YFhVi zDcLx!l+hOW4VF4_v2rjZ^gJacA((r(*gU&Z7Ve93+l}U7^Z-21r+)>{*xsbT`T@0E2-=IJA?{o=%W_4)?KUWOT;E+P3}sdy z;*n5K^z|1%?${t`Ld5L45AtHlU7CeMe@>oQ0}i!^0Zvf4LS|($sbr;$2c-}bY#qQt zQi+9P&G1a>tR*DFS$}Z{6u2Kk})PEn0jxEjfpoWRB zH!|j;vh)R$Lm;EsWOgGM;Xxb!1|Ys62!Khh_DXJDdf1cZ8iaR`ldO8jMpcs5-QwE= z0N+DLjH$S9t4#W{ZGTsJVwHyMFZ%RS!(UuL&^#gl)w4 zGB%7kS}pwO4bSxfj9r*WZQ4`Cs;rb%G}VFzy>nTojSW41XqS)`?>FQr8|4-Bztw-SyWMDew4lA=#?xKvJCe4c;l|TOGo8!VX!MJXzibS*Hikpf zG?(MI^s4RRi~exf9BRwTw~QGYH^YWkynm4ow{*+D{@T}q*Wh~;T@l3-32w%7_WnIS zL5S!*jG7*ld3tSL(6Vfgt!b9Ydhl(pv$-C?al9*g?D0DLjb%v|>%;ZT^dquZ|MTDO z|1qX7fUn;y#Vk*GDbyx-8v1$(26H}3@72fF*4EbZXV3l(&2L-v|J@os-}$%UvwxkP zXD^03PxW)d7hBsq|Hif+V17$Km6mY+ZR_5B)hG7{`DkjwP$5H$u=58{%|+8#zu$lK z>#w(`?2v{ZoNhmT9_G_^{-=UNdDyh8a%R` zld;xII%v@2Zme-do34o6bqsAU%VbIBb9jooFWT4PmP7SBSTbI3v|19?8-HHTbFpj6 z5FMR8Vy4K=(b+CLk(qeJOeWWfEYAgx=X<7h*Dfmy@DV}H0TkQ%L_%eh_Z?^(K7y1{ z7lyD**BO*8K!KLlma&o-6H%VQt6_tUZu+C@c3q9CWgStI2s$o{g+x2!Wi&;iX`$PH z_VMrJ|1(h*Nu>IDA!nkTihoMo{T5il|97^Y*7*PS*3OHkpZNdB_z-7;f=T97(B2Qo z+_K*MMd1bU8VfeK2j9Pc3*2qE%qa0IX!^Vcd|C44g&jmTnvBLY(Blkh^# z++x)s&+M9~X2$04RYq5T_fFfcqJrn*5>uMYtHGD645hV|JB_ChaNfbmOfPz0-Ba>j zq0bKE-WT_p6n=f)oPS#5hYvHsX8*UErWK`e%uZ&$n{55u3Gge@DD_`^?~dl&Wu0^^ zO>NX34KT*@d~j8b0Fzok{V0IX%0yP~vL1EV^QDZ7=8}S_VYIPM8N~G6|2^m@pFSV< zvrPYc0Q286{crol&Q{(2H+=EQ{`XNn9qiF~+G`5kLs|%(B!BZyG7#3dbVJX0usiZ@ z`o-^DcU$>Fs_8VVX*B;d>*rD`X(%xdNhr5aT{ZF@Z!bBndx z*Vl{z`Y*%nVSkHxd0Lja#}yyIy1atRwd?-RM0q2Nt6Zi@G{2_=u;l)Kw)4Dk|382B z$^ZXRJ~eJf+kS@I?nwc7?VtER2a-W>?T4+n$H-cHFGKHr#emg>jowD4W>IPJexNX#NoJ4-VUH!$- zH!8!PYddT{_qOH?iL8>WWe1Y1v0}f6wHX(3=K7`+o5`|+(?WvW;X6VEt98D@x&}Y6 z)s-;BqJPH8_7rHsmF$knYjR)?+`e0fX=1yyMCgaZKx*K`jaiO{g@`2ZCxtW7`JjDe)ke>oe zZ2Pi&CwsBNy*Gm2ap+^0{GZD>PE=7rs^zGPCx7DZfxye+|DJCTYw;h$Pw~GW=~Fux zxr`6&wto%VUbg|Z*gGPgBmPVRO|(n>s6m`HJGh@d@F}|R52+7)D2E?Barn*@Z1cqM zU$4Y`m;FPI`dC~aYfs2xmz~J+DBGZ{~{CfMr;+G@8HD1SW;7 z@|pu&h_&Zjo{(o?v&ih~G_fPz!&(iphr_XBspPikjFFxJ> zALFCX(&Jp^d)GWk0cd6SC0kQsb}fp1Im>w=Sntc>V0)*()njW5HNUHBB%IE-z77#& zo`4bd!@GyIZ|Am8v{C+jk??Uyz$M{POJRzL&XV0+nIk4;s%0l`kc@x+K@;y!@0_>}{sphW#r&UEg5yfu z^$J)T|5Mlhwuf6gpW=T$%BRLmLelTL3F>Kp=5#IL>?@wKPfWfQU4NvuHM|98WQD7s zd4DWu_cp0`tqZWA?L`o$ce?QIGtPxq+$zJPKX_G2fNl>D#-+Rxp<%JUFbm%Muouq~ z{$KJ^jH^`LBl>e0|KEA~Z2M_l{(rXhiT{6;51lP%cL|v^UH}(F1{b32u|WgoYnfu; zQ&ES0;Pudci_|;#q<+a?6}&<+xUHNk|SpPO>ZIA{e@tw_SQkW_%*fsx(C!Ul}B< z#eHAP6w_QgcmO%1oF(OgR#=ak>9OC;KCVVXO=UT}DppplJI{jN;=MHCN_h0D?7Myo;SwkHFj1ACCaWr4!3+(4~(iz9(EjFgSQ!rmcmvZ z2#9P8N8&e!!ytT`D=}Z;*()(8GEgf#jSqIsZ8hT6&0aL15B+Z+f{24&9_rkeG8IMr ze)PV4h<}0meLU2-)sz?F3`-F;Kt~vB{kes2Eoo-Ou|!i5SE(pM#ut3u)_3q)BP)B= z{mW%4C-aNE5Io+OnJNpOWM#0M9go~oV_i0YC7B4VbF^3xK}z^-%@^hag3F>C9v*0a zP0KqiS|I#3$nB5q+4K$L0nKWuIK);GiMrZbEPogcx0{2k=?{&O#|fWgQk6;cTE?P% zyb)DTyBDXZbrhNUrybW%+f?+W-BMc&8+!N=hwa~XpzY)N@yX^W$u>t^O`mMAC;f=R zn;v$s`QpkB-O7@uJmf{c{UNX$CEMp6Z`Q;)*rJ?nU|ZRq|Ep%LFdAzD5FhR_>TSb(_dL> zY72*-C|~$~pUN>{J4<`2budn9U*s}=tJnD5%eBXABAQCpdwh0!@b+Zy^&#-5g7x}6 z*84wMZ+*S<-QMG0?H@n(hd;gV)fXpMu786T3t?@~Izb5akfN$&{g~;M-gbZfq!)hJ z7^8TX%c5lGhX+R&Z}*SiTwETWzuh}IIel}ofB5$3ObI+^@=Z}pjLjTKLKr$6>l?i!HKLa=79S@P}5ajD5`9rrb}7%@A!Db z5!gRH``gjUH|*8X@nJg)_?SH4RwVne7{;fQ@en7Y-n+=I>*oT+cC&@Gk-|m&Du8!$ z(-mn<;cl(Jo$+$IYke%B1w5)R&wm}SZ#V96>kj^QviJIE|LxJ)McYJnSuc~l#vq#f zquxF+{f-uY{gpii)1waw7J9yZV@alu(yzZ7B(Y?JJ-*g2R9Ts%rU7_jnfCOUy?@`= zohI!4`@t&lf{%S4npTsLELs+#NvyR^s+2h6O5Mm}@s8{tAHCgsbNTJ+EF$H%8XyghtnnL1Y6(O-@7{Wq45?CkXXa>e<# zB9ty!08kDA03`tc5v+F3&E>$x({HXx9NHR@ceSY$zDLvzRDa}5!z%<)AvV(8mp6#9Qy??&A^8gRN#ZDiN zlMsXbFm%4!<&5n@N%O<(`g>k9Kt~_Ik{mSOWjwB%YZhC@ytvx& zl`UPV{nyQnwQ1_DcVDNu`yLCr|GKuM4@3uT>!fFhH|s~69u4F6Q*8aRhDpm7lwCHT z;LP0t9lNy;ujcX{`+o_*v{`!u(<&z8Rys(NYmo`1&I&o|crSP)Tv6}`^YlQZe10J! znZ>GQK4Bj%@6;DD7exXQBP%r+JY8?;hX1~bUC=o12C!b0(y9=vH&}n6-k^Br0;U{YqYI?LE&435J(w^1QOlRsfRQKJq-#_gyU9P(SN?XpvT9yGP^Fg(~ful4!h2VIrCD64$I zG54PcH?NHH3mILBvc9JX;@>VTt;QLGVLbp}2-;i767sId8O)iH2wAvlYgmobl-`rdS4TEPMs?mNS%5E z_nM;X?LMFME&IzGS_} zzqUA5-}lzrg0fm8F@QGTVi%(Lb!n+DdnokL+keAQNY?M0QeN-hzjPJ6-oIa6Sm=z) z`1jwwtosC0|$~WDhc?GXxouZcRUAM~fyH;BMkOK5=eS5Xa@&2dgcJoTlvvwtWL5jK4ox234lCEV|%8yXp*VYkw7E zS?we@mu~r)Ud7t=doT$t=RIx5r-j1xS?S}mw^HNrm0J)rS&~?<*E+;y^t|e(`)#hW z-3wL?w)0!5%8R+WEsad2f@NKBo3=dCdKI?l-%I9gY!2PCUU=;Max0B1y!A}3dJ}dr z>;)h+wO4L)y9HkaB}mvp+qDh*3V)a7R_V?CHiI`E0j+EAvaJ_8J6)@_K&o6SQ4)+% z(6LkR76Yj)Py&-u%o?T9`&KJl*yLiR5J=85IXC9iLS0L(;SaKh)cPtMwu@IR;0I9V zNYDFGb0s$YM;FY$)B0`-=k!;4;okN^C~K2RT4=RZNGZh6l~8p-L6x#FGFGe1m;BP2 z_|dlJ)Yc$MxpJ62UTdw(&VPE7RE~J+e#E~Q9?sCN;t$v(x$fV+TIGJrAtdDz%Je%5 zw#tXHTr4bgHMdOD@2_@t7EQIgX#1*T^&7tJfd7Zrlnpax8~D%H(F0V0U4s9=qyJs2 z|Mq-)_zC~{V|*6D`u`y-wOE`C$q) zh_eJSx??r(S`FaCL0XsdT(m*{BO;(b6W^|E9wLT(bjH@i&+Se0_RTXr@}An4TKjcP zcCM)`7Ib&)0nhZ-7d&_(V{s;n(hSR>7hD#6JWiq(i>`UU^~q4=Ya6y+z}3f{$&#&s zGT1!e-lG>Fww^znf3Qklf`UzN1EC$`>hWX{OnKQMW<+2B}kKo@J z?sRdvclie4D1TmVma}{l`S)AmHE*Hh!=tvH>+tm$FUVV7y?gohh?lHA*7fi3v>zjD zpqE}g_S<;GS^|8NG5eAIiS>VBy~knWJw_;N9ZiQ%|CNoCzcvX045GQrlz91g&0OJ> ztJzoVDSJF*|A)RetU0mYFxHXuaGK{Apq&sTLY;uqN=_Tu(ot}Kt-lBW3wZ&hXmguII_O)JwEBC@! zDXVDOO2^@t=)5>ps})LNh3o6nZS?6j`q#LP%zy5_N(xo}AdC1V;nUg!$bMr}!DH6X zhU_=SZ?4#rU#Z;I@UQQmtS`OP*nj*-@T2VtpE^F>J2+b9!Pk45%N?BlaB`=c@}I3n z{b4_y`oAmXcJDrx)&Jgp{E!>{k@>c7bj?17gx&g5 zSi=9GzIai$|88%;_{9G|%BRj_mYNqJNlJ5TDE_tka<$S{m|7)cq4rn9g~vAvDe+nT z%_A=tJ=tK7g$EYzHErHCp0QXz=F+44|9>9$sH80X-E*^9M*w+z{jGjYtA&qQ&ogW+w|B7mATE!ZLth3ArMeW-920+#BGKH#;_H_BNky6x4z~5-afF!IK~g)t7nK`SBi0!LcQ2( zB#KOwLJbnRnaj9uubGg6_xt@v9kI?`@?V*%{zKUSmdJnGFP_%qzu}9m?N9#ykMbc# zwbr4RMTOv{xHP#wrc^sfND{@6ID7X_4C2M zEB*h~bu<8p)gOCval`dn_ody3Xr(clwgtKSsP5KU&te|+SkF2odLD6D;(sbiqT7pP zl8Ja<6s7lArqv0%6`F`Oq2I;QwNjW&RFt2LU4KktS9txFsj_yjhz}woAw+xt6xL?d zVysM+_h?Zrd)6cu!?WLs`9fpaDz>t&`@hO#UJ82;+)D;neE&avv9r^-|6dG0<^Oz? zPmBHE>^YLafXDF(m}b@>KYyU@$qsALo%E@7wsxC<7YrlzdGkoi(3_S+|Cb!y!x3R6 z8eEJ|th&X_!dP!A(%C>wH>Xlw^>$emQ#JNS+%!(yXmcZ z7k%s`qgJ~LkILj)9B7#-$wV9UySF55&(hsOhXMDqo_T*~YHmxGUVlWIJmxC5S!5$ZZcR4m$|hvV(Eq zSu);RI6`_QK^!=THh-bDgf3#E2G0ti!s>6`2p>SBW%BT2@fy9&crqD_l?MaF77K${iy$EWlF9$oTKOMk2b*}n~n4=FwJGI{KKt53m4yyGA70F~G3NQYC zDWvJ`0Zi{ytzmUM+12Q*tG&h4c9$YXe~>y8zqZtra%5*3d-zc|`*@Jr6zs<*wjRZk z4fdoTJ^ASaY=7MEqdG^sq=~gC9(1s^*6+1bFdFagw#p!b5Mtbv5KNO%Cdxsh_+ayHk4K^T z>ZO>L_f+e^CMdZt3RRxSSR9?be7tr5i$HY0!;|vuSQc;NOuc_irM#;0)op=WgOwjO zPAoRu-eNoJwK3f~=q`Lc6E}K75bh?5ms|B2%L2sCqcfIdj50m~cn~9r4>iOtQ zpBT;gqpD>6nCac#c7Oh)H-E_1|H@+7*x6N6{_t}%O;VxB>G7INE$UBM?=g<5oc<$k|Tgmsn|GwzWKjVw*>z(WdhV9qlx{Pf z#Yb_^jQoG`uSCyBdXVqEzt7%7SyT~kutJo@Jjo{aK7ea$wbS$Gmu$FRCv|vr@ujqo z(id%6Ax5~kADH4l6e&A4Q7O>}ETjI6>n~IbEp!w1YHRc%sP_&tXs2bQQ=n4Yvvz-Ojc)VUEHF55}$vuteTBP!Q_}lRZ)nnOy?{Xc`D~3 z#u+jsN0dQo@6$W4;R%R5IH_hYdym)FShoyIFP%Wor{fbst!A6-Hm{wFJWV1FZ(6~k zzEGdRBIR0R#WMPtxM78Pvz&5Ub$=unR|lU>vmC-~{4^iT0_IPb=_~%BMRcV>zsn9L|eSu>8_YHQdNoL|Eozvrs zW_TN2TtDa&6Z?`quFp|F{o8M?Pk;5Y{c&tOe0DWG{|}<=TgCMQ%dEaO*{bkA{?&i8 zfd2Dz_vRp%4DgSniLYX1UY&d2!OXmXU;hzqm6p5XU&2DM{Oo;XW5eRJ_B*s2{9e!1 zAHtrol>8pXG_jDV9>B`5QgvjJUALE={QBtfWbgIS+k?Ze-+WVR-mkPxCGyLn5DYTNA==Q3Mu0CM|z+aTAM+ zzIJR!XV@hajX2D%zpvHNXAhPY5%jQPsMF%eGVeNV?`Hq?k_RwvqH*^(w|=E{+kf38 zHd`mRm0mityYIKW`>(?Ven8r2TQNOPq{)vtNgBzmC%Q_kqU+I>I1iq8g-Cs%n?Y?9>Si2YE zLAhDb&HY(g@MR%X$&1nie4l2oc#>9yS)6;&hqofNqV22E!h@HBzU3wW%7NGGLPoH9 zx<~s8Jvg;=63X)>gKokt{r<2^L;Q!qRHU{5HpSE^}J2ij&hiBVcTc7YB zKE~%WcE(GsYJ!Inw;ml}qbf<`B%83DM^}6z)Zo!)>~fkYrm7s!+nAb)G-Z=ij>Y>?SFv>`&_hrtcFbGk8-EiRGeT zX_AS-qrt(&+lx{b;?aL+Y#+`v`+om|#Yv$a4JJvs3IE06KN^gFDK_E1=8NfMQ~$^O zsjjn4*U*SZS5?l&Nh;K%&j;!zfAsla#IGKGJ}77TqtE~EqtDp)yhvoF*wMkEdNjxj z`4175j|NFB_$EGA$bbC)PWSRpc>d21_YPhk4rcL#_ObB%Z*PA+d-|eY|M}_Dr`w;- z|Ht@z`KNxr&v>2_cHp_DhyN(VDXwifh4QUUHV8(|#~%sY>M}PnO-$z_cA3bJToM45>CF60-NULCaCDrccW;Eph zk%?aqA~}CEiideM$yCYHl+EUSLV#m|YGN3d?(&fy!BJKgGOi*$fk%(vwt`;RNXk-` z1<&;k{pj`=_f?N(l9bcx|6}h>;F~Dg$MLG55>Z6FK#rkMXt7C~^rYC<(i?iwmix*k znIub--E?=;HqcrRUKCJJ6hQCI zq}AX5^WFFJ3S?(ypJ(Qo=bGnv#-M~k`crLUjb)G{Wk4guP)0OmfMw8Vqvb+i?$JDo zgGER;HUTG(Bq}1)$vKk=$tO`2Q4yF_6i_4DAj1 z(abC9fou+UKRl=(=HYIkQcYx?7x zxDjEdHXB<>GnOQks#-a2Tb^ovfVAhSR#mGn^10}aJ_D($L5Y(A$`*e}h?HDp*}7OK zup)}0fPuE)COi~8=K++^jKu~)B}WSoI9QqyKsZl+Bcu@#0ET=CW<^&Xgv+RiC;a}q zd%`eKNz0|IgSD|1*VJ&@ZV~BG5P#D+7z?tL2l^v^e;uX31Fr!vPcPyi2g{u_PYaM& zsno#DZ-G{$9e%q?O*Vg2j7F!4M*k`r2OJz*LGv`rKu)q(Bn83Am>_4v?1W~_9K{Qq z(}*^KC_%8uk=V4zx=LAD7NK9sCc%3O{Zo=nxPYkMEv)oOKEkkl5)ExrDJz`pZeF>k zSb~sZJ|vzbqAI4+iau>8skxy6XxPa`6i3-1TKcKsgB{fknAGQeq>G5grpA%}1d26tL13E9B4?i^QYBDhdrj7C_}O^=h>=KzwvG5A3csEJO+z zHmsC(3>%gN@@Rivz_GnzH(nF~di)VIX+#wn%g}*H$tk^xGC__?dzh>(=ooXbDF`p{54@EuoC_)G6It~?@fx{^YZfWl@J#c`AijXQa&*SN?MqAU=X ztI-1wcuN$o@SZ4w9FHs$MgYXK8BVyqKX{3mBVEg+_m<`k`GPRE0&*N}f;`a6ts}hW zfe?xxSs;J9VA@JMmxi7?r61W22(RAPuawjH~Ud|JWK zqsDq`i&(9cGSdDQEA{_#j~fdOt_ttQf?()fx-x$lmeoL6BvK$w4fKa>dqERm4Ktuo z2x=Ex+NT=mXVnB*Lq$c@Hta*O22>q$r)%UkoJ8H+y*v1AW`q5m+`0LWH@O#B|WdjUIZf*>3%rGsM)kSG2E z18RT6lhb0P@d*kIQfeS_DHCM=9=3>IQa0WXlk|t72t_~)(?uu+*3Cu{cJ9({ZVO0u zdv)-G)-V*uv4?ssr9TWQ&JtuhA}Y1;|0?t(3~7c`&-6eNV@Lv|Ii>C#Y%E_#UK>>F z4t~%&VQpMPvwqf4!qCC;w7|B4V^9pG5juYwAwN**{hGOYC58fJX`Pb>#ZaIuAe^?_ zodRY>0%hUF6ArYsA!CB3OUFHZFpSseGzn@GG|&{I)@s$+;($il>;m#3M{8zi=U^C29x75X+9L5qc}RcO zjU;ejf%s28t;j!Rb{Pe&sOA#-$b~xFZ zayV=*4ai`bp#s1zVh#eMjYiTCUrT_!9!8d7h)45M>#fy5FK|wOcAp;%X~x1qo-ZiL zci-`++_@kPO@RlrW{$N3R`^R5lz?;&`2eVK6G?43x2z-KQMOcOMpyOiOp?0CfH?Y#W9gYl9ljX@jk} zYN|moYUJK-I7o^d){7@LtPOwSOG!w~b*H$-ThZDA*T?s}4@I3udFa5JfHVS-%9VHO z(~89RgQ1zv=2)l0FNXLH$jy+CKe43#XP;`I*G5Nc+kqkHWYYMtJTf7D#zH^;%MiQ> z40#uC6#RNmt3iomA|X}91jMHQEW)kt!wj0|oLC_o=`>lO5KQ9d(RP1Yj012N_QQCI zDu9^jiQS{_xJ|J<5eI>Ztz-aC+nqLnVj%0}Z7!nPR1$byPtHr9HXnmEL)g6hP2vzG;+E#w*>rM1#AVf(eEQpvO9glD; zoW_4Hd%#GAjLf3q%=EO<%nS{d{=O3=^PEn5+K3@yq``mP!6X*LJsFsZGVO}q?3kyG z7>jet5^-v)Bb(S*ai$uRve4Yw~AvmKuwg&Ohyg~I_5z* z%>b4&A)}X-Wo1SVFi<=+0VD0Owjn#FBQR9fd=pD~1*1|$^d-sIl-&3jp?~J72KxAz zgyDhYp@e@S!S`E z)-#-8IXl(_+&Q2)frO_`&`5E5QVs1=k!&m8LIshlQ<(#rem zL8X;8T7jK%5i0|0d8Ur^akTApO=D|I3~ei+>rZQVF^CZEv6WY*O94v4Kb!tdmtSE|1(b;d8t(V zwUmEY=>7v0-55&EWsClw2}=~AlJ=nwyh;pt$n!MINLTR(lK3U08IamxZlh3i#Ni^P zgN)DumVu$j^baLogxsRg4!{t7r8S+#3&V7rE9<+43TeSZ0a=Ca!$YqjE;S+npH`%W zLrNn=x+x`CTd@y|D5RgTq{bk|i`1|Kln{T3es}Uvj0(d6njQ(xTQ8tHz;; z5-7bt40)%aC@7M|i@`e$CYpmr9Mmm(GekVyxU-Q6TeH)KR5}x^Q2H22)Emn{P&5ux zfSjN&QdIkRRx7;J14Ew_QlGKJR8nBXxumQa*UUm@RMEKfc7b&XpLSr_s%~2Cn;U-% z(rpxN_fSkb`)S8Mq;Q$=eAW~wa>yTsq_#M~y*e5f{}0Y6DTb73JVy(#kTF6jt;Cl~ z>6xu&Skg1GClObJ5;xyJ{Zs>eVm9sfoW&bMyWhZIkFk8$kcT$RbpAO@xE)lAG0d!T za73{AqFD{RoBSJ4ZUsX^X+@B;(*%=%)g*tV6>^>hGRhKppjSi@AjzUPi~k^nP=SfX z$0L<2R~FHlSKk-IAh}-EAlDN$(p&9;O{XV%wUXHt7(+j~UhToK^Af!jnO#!dGF+ci z9~?u!xn6C@P@pUwkD41ptyY=VrHvLr4~n7RT(7oc*qMo5tz>ou!_X(!>;K8jE?<8P z<(O@a4F@86tYIl;iIPoE8u$iCbp~EasM;wl+!%7O+zELFjuM9WXMB0GgzGUb#ptwJ`PTgk?^Kux;~({yfS8sCqJ zi4)?*H^C|fDA87|9ApH}MQZ7hYO$m=np6XU46VjBSvl+vg;mfvWT9kvF zYIvXF`!YKP#K9{7CmfU zOa4>?eY77HRIIqgn)2n+tU)r=t3iokQj1uRimpUki3GHOsY1GZx`^T^n~mho8XzE< z`HEtDSe}R{9y3@)*`8{km->I|eIT~7ypU$2ktx!OeV*YiR^ebx0CfZu>3L~pR{60Y zbc{YMrb@R0aSj4e%yOj}i$W5Uok;Tt6EU&}*DvISp}f??ofy&v52mlkQPMFF(+abS z+@^HEa~*{=b@C9T6=nfNHfs!baXUY2V%FIXxu>qM!Fi+EL#@z)ICqx634kfL3#Y{Q6Cf-pqb?$DF=>t0lwD8>Ck{o z|87MMM9T=33#b~Bhbz})*v3u9sWLWfgtuu9193B(#&YemH};) zs{|TZ#w3w7In$yk8!(}lfG2M;6<=~Bs)0T(pcl&%Vh7}C?6ga@TCBm4m#MwV9OXfZ{#0K#*Q`9L(*2n0J5T@FTwvmymaz z1hFYyj6CgcHekVtNK z47bq=jb(U#I}G@0ppSoQ+Z+d0go1LnOAdK8(8oka2RH}uoa2CskbmyhQIm|z_5{@E zl@JG3gaUB44gxtSuke64up$(YyLAZ6)j%KLHi!c&LIJs3M?oBzyE#~sl!t&w>F7sDa$QNQ#p1KTTXD6uv-4<}$^0XIXg1WwK z5R1{%63}g%EBZ97xkmXBl4LDBAaYf4UmS21%^}kDCLd zyZxm+dGZIbc!jidS278%n!y?_Dpa!5@A{LYB-=ZbIz!)gZfN*(n?t(Arx259909$h}}N1_{yX)TpdrFa~i0RD-b!f90+<%U>ZD{!E`lpYg?OCBzHe5#wylE9!;4c=U>> zL_9vEXOd80v1XIP6DBQld&c*Q%=`f8LX@0&*@1da;m+ zvE7sFdp_j>u2ck%6g6r?seG9jDDi}ibrV2)zzPDc=h1sGa9gjySq)01a+```uso>& z>#h|`=DMi;PTXqmVvlVB*THfDBdv?1LcJXYuAjWPR=^Eh8?zduVUGlB1~#wCm?8~R zMyvOckOt&I#v)kBe??IS!d7_1`zaoH?0R3%czeP1EOgn?)h#ay+`#@l&r3Bujn>vF zqjk>gbGG9FF3~D9l*v@kHV#}3MzX98QVh>; z7u+CXLIjtA@@><(MXjfzlJcsE7sy$@@})O20n5omuu`09FDH^;k>_Wt5iK(x3LI_Z z<-E3wRxvyM(9Ay&-sMKzuiB-8cKZ2RJAokNW+#i+CN%`7kphyysKzVJv34j}p_9kV zkZY%&bP-SBO?o$;=maVICXb}7uOdO;$@Sg>7kl%Mj-MKDZ9u2fZpctnb|V#OBtZ23 z(D7T)tqtgOS|vBcpf#~EnrLMyw;1AA^hL*S^|m&k(`l1Y;3|JQ%!^T12^^Ic ztR$0k21EH&V=~YT#kocR2g~y`vM5Ct^JFXJ;M8!dAUOD>s3;39Se-cJA&Rxp6_AUL zjwc&>dYjpNThVDfz0@N?n)15y-e=)1T|WB7qSH!deW0BB&cdW!=!hy~KFc7n<4;Mb z2DxU@nG`986;T8=dhKNPT?d7p;DvvMFw3YlX~GBGCBku-$Scv51L|lfntpA zs?nVj7jvIxpz2-VWk<1 zVs(nilmFotKh#fKRZuT<$j`+}q$Cxz?MTs#1@f2HQPNg)+$2!!wE0aTM0-adWd{Wo zAPKIB*7fX8v>yc{WF>v!5}?y2lU3p$3<}6W6OyzFT-%9G+mnFe78jjlZ7VDALWe`} z>AgluCxk^j;50OW$&;<(AAi&FP*D+)Vos@OGMTYJ0I&-0N=-ZVPHTm%{8*zMR>3OZ z(@sVm^f*vazHGK8K+AMkpe*E&|MUpwk{DCpO6amVu0Ggp_3P zboi~0?L{Z>RgeFQ`yGQ48#w_gaq&jM26Bl%vwg=u7j@_p_>iV8XEYaelY!$K5k@0M zskmUTmFsSl-}INDR1K4@;~#(J(i_ij`W}L`@=gC&+q7~Gjq;oRPAYr}mbW`O6|3T<}cm$KRP8jyuuI#}P0RH^iOy@BGbs=+|n4A@<24%#5aLoh`J z0Qs1M;`vIJGbIy}k^YHW0N{CKC`v;#zDk9rhcd7gldt3z2~t2oVQFR(C}fk(Xv)S%0^Vt~qV3@1AxHKG>xPYw6qh0g+Uy!os*@Sz9Ro$<_>(#1C>;fw z4%Ws4+6?6DX*4QTnpoYDu7EaIB%r{=wER4ie&rZtl~x*Ge}idDqF{_l`^iyl7C)?U zQFdD}s!IXGhLzHeVZ)NZMAnIclIBRtlAWv=YHGOR9}%Q`0V|LYNHlk4PU0ircr;`> z2_*s*XxWg~&6?e$`CP=xylH1XF}a+CYzB>_v5A?7U-350G$X`XjNFj+f% zc(mVx$1;;(<}M+V#Vc9BxDt?Sw>!x!36w?QJTS3FULzueVRPrTMOoQOldt9&0b-NL z<{|;qlk4U>0VI-iU9LN}9q*9LXUP%`q8N`dXpn7LF zfMlT613RP`KGKZ=Y8oSbLj+p(I!lqNN)-U@Wcjc+P`I+F0uk*7D?ykRSf{|#CL#zG zPCXG)d`G&JqTqjAk5OE#ldOw)%S$T>63HZCg%W?1Yz~P>4agN&TRdM76F1B>#|xgU zAIrjcpmf{GzOG1orA43!di2()gxLxK^a!^#lYWwS35Q@SNzef~v>lO^B!yoirI74; zmWOy0Nq)8=-rk^aPhzu6L)2xNUL-Q$AZ1cx%;i@y2Sy*^l{fv6DMB+LAwu(Fpt}i# zS6Y7|gDJz!t>j4%SKiK=V1x$iO=L}2hJi+b2q>eC7HtdCl?*F>DH3rQiZj{JFlhRu znZt#ESdOR|8ZaIKL5T_nIV{3*p5y2WF_c-}5E36i><8%~BBM}3;o#61N{-;ET8g;p zB@RaG{j4p~S4I2Es0U^nMJmrIy9q2ZU~PYhb zIh+O?ZPch#xeUJMSwUIA$Wgpi+FGm`AhD_hh^YE@Rv^fV0eEx zlQg0xE_CmyM>R#=H!9SD}~Pel?Y{jsZp{{uTmA^{UXu0 zXbxgK-_NXLek*+w6LzHXE0Ky;ZderdzJj@VC1gsogf$3ON{OTyz;dFSNlv|l0YzmX zVS}j*n@^C(YO%w~A$~`A8?nm76dlnV$I0MCGPtjLL0b<~lWhG;S(4&zm*#&;;t3w2 zl;DYQBd#%`R1LzXB#cGW%W=s8&(serN;u5?DIERbK~?hQqJ%Y4K<{9AK`jEW2UdJ{ zo7{uKJP*MqrkS`ui#H24d<4SP#Peo}q4KQVLuD1A6u*Qiw20!d_faqVdPJv!=nQh} z^w3io5OoKVEoGuj%KK4~+ADtzpy1i4KSyja-kn#2$gD&oRN=L>h}x(HB3lJbk~EM; zr52+ikZQ)$h_QL=o0Q2|;~*}liILdMXwcZ?X{F=E;~My&4`vF#lr&UcKs_Kp!hH93DE|3OkU84J|lUgTW6 zgXIJyyjVmBxcg=#lj6-nNnG z724;#rQ(+V$1E=uv-BP#KBW!pvt1gU zXC}N%3u=##237Fzp`6GH9Udkq+C{lVel=;Y1bkwkV*h_mAoW@FR3ekxUBt)RY#SvR zRg}rZD^)DCi5a%in`QgqDdI><4uCiz_LiANR!$3qn=9;L**y^yEVtzw(3^|h9g%^( zVS3*MmkrPoBV`l4DV}C03wY00z8{WMm}EQzyZ{}1l1fFCPT9>07?!hBHks8aC(_%U zf;|xK;*@`WZ8Pj<7R^&6g$+nrVpliC;JOo%PewZ4F+yN~LM4QZ+g$TD_oOc3C*9H3 zcxa^QmOCjMHsF1$9SPDxa?s9JAlwvAOspXYvP(-mP9`UQ*zirW@vIc?0HMj(k*Tnt z<#}_*Q+WDFtrYn_i~U&?1L6sWktE^F-&&(LVyk}+H5=nYfyNz7;@`rmWVtc~zsbo- zsETFzC?42Y#uC)N`nPN>9M~ecXhj0!#A4@>vSY$V^Mc}l%X3W>OP!uKwxl$(7!(v{ zWR~b9MNHw@=OG$fBz4&}!!lCvK_$c=x3d+{qygixyIv*&Orp6N@==6Xh6KloSlLRT zH&cJKO|JpDqI*sDM9A(31=N_ph`W_|WfBy`r6I&6`{99_0)stC26*7AQfV|Al|dI{ zFq+Mj)@+K8jfqb*#m2@NwWi?)({KtJhU?;Ewc6-7a{|ytYta7^qLbod5{BQYMgJwc zE)th8Qv+>$Y+QUyj5cO?bbK^G{}cW8(1d?Kg^4qlAx=#RC!$_UahjfUAg@I+bl4~( z6unRxnbUJK0RF{_1LfL-dRAd^c4nzGiVPERoWly5#Wg+@b5CI4K_zBcHkK{J=c7c^ zru|@()P88%x(EbZ5(j|2BeL&~wn3HXVx&BO_P$O+dEz7y z8Y; zIm&FNjUuF_c_k`UXBf-XN^hzt4_{0dG#a?Jp zM3D0%_ij;iQDieo$1f6NbwJMMQYvgpP(8UMIT%6kNO9gtQf#-PlLll+XZ&veyWG)Z zn)OK}OkU)L;(C$n7n>1D~IcbXEale04tg86B47%K}-HVnSN>B+^Y-Li>izuo%+}vIEU3MVL zUKB{Kd{f;0?pXkyb24}#l}FBEFrk7EhvQ4ZDMmStl)A%mz{XlEL=PajaS`s*a1#r7 z7F5s_VHjdLGF~rkc4ZV*32k@aT5e{Vfnsce`+gLok>!YK$oj;($gO`6e1#RK9ZmS|msOCxJ9vEfv2*c;aEvBMpsyl*a_X4ObD% z2}wY!i-{%6SVG%r8^zgN?s;7^q33uRv zch$sTcT|Ksd1!XpM1p^>Kqk4#9gM;gRmkY%1=dbxnWQ-J3UZa$gx>QC5+aMR#V*aW zvVn4ziSjf)C#^JdTxKzz5NydNkw3^Rc!g#wzfLJG55bX%C0^XtFYfrv7Vou4|2U-Q z#REm_3=4l&tiWP(kppe9>YUv>D;CZDWOsiWZ-8vy2%-ioevoSBur!@zq^qb%;nX2JWwatDFR<9m7XzHI^%aThSx}rn8=Yv8Xa=bbZXU?9cB%^5 zYLbTti9r+1QwE!;-!i;|!k!(g6K6hJ5M8^shcYI^=@5ToX=xj@U;Jmx#cwYs8GPg?pQMB9$UsZ!B1I0tQw<4x|7%Ju8YVNtE3lrI@ejXui;NMTsE$ z1xi+&5CJ1l zWsHA8PLB9DL8Fc0pjre#O+Xz)0!-B|)~Pl?3(Z7Cs>CEepl6hy_NWR+=vcHK6~I<# zHF01F`Xiq3UhHGRW#$AYhm#;Y@iE9Z(5evLqQRa48JD6$io19MGF}Ckq}Z{LF|(Wz zDrbH=WwT8u@j2qwk%vlBVRj(dsN%qi2J(MC4n>^A00m0pImw>Wmpp4qD9u3>GF8qeQNvqTHdZ zQWUbA?8N*ej~C?%r&kIaO_w2wwGraOkz#!J5=a&_xZBzNV%aliK4t zw+IrygG_U`0_16`NumAZUNw&|5oJbsk6onijd79Uxw7(-Hh0v#D6S?;XXk%NMGRnb z$W73S@lgT?p=4}$_LlIaAs->7?7B5$DQOF@pzmFMk?t417v$lrK>XhKQZ=QAm`Kf1 zj&&l<$;z^r(W`>dg_sU!f|QN0L4pg3vf=>;Ng|lQ0x=zOC{L6zG98GJCX=dXo?itP zCvAd3GUo`ZwMqG;%I<0_wAp{v_ycN^0ZVe@L_y3lcQZnrLxL*{K;UC&yiK zkffsXNI$3KyX8D`9Z4#L$;1OYO%jvLkP@66vOJVJqXEsF4cSz(q~IVqRHS&EpD*qw zDP>fg9Ct>eMx`pD z4zPw9NFsp(oyCPGO**uKN_Y%Imi zN=sP~FRip&KlZvNY6fc{u2}Kuu|VOa6QUWDo1H3Du+1TZsHAffUuVBjECCg#~o z9cck)E1+-tzBfV!YeF3BL~1bhaEK9*=>G<2r4W(JkPv0Vo0)$_0*AEg#bn{his^~h z=w!CQu!6Eo9!FJb2(NeYkTW7%mk}_3!n7&=H(sNQijGznXXa(5m1N@VhY0s_#ggTk zT*!a|wgTdS7i~-=&_(N_BMGyt(8(ujl_YJ*j=g;(Sqqx{3LdnrM5!|fQKyqvvu3qm zg=z=KqFo#jN!WjhCyj_9rX1vPcB5JR7j_|;} z6amLU7BnN^8Uc#rb&p9%9X1SS%J^_dJRLOed8`b9o^pTC<4Bt%P@&a>aLMi$OGp@4 z!Ad&mNCvVr_lkkg%1T8A&}Q=(Q|CJ-?iz#5kO&Q!oa0fE9xc9xw~9t4>!6X|MKq8> zhy*AHEh44H%5a3NJeh+?d(4>JaOsI6tx>5#K3jqFry*m4jM3%MSLTt!L^8sLGcNuy zOd_CRB=Ub4|E5xdG;H5UCBsQw9mVKmn)H!?k~-R0W7#kgIY9GDJIpf>0Ux2sN%kJ8 zPO>=kgc1*|Qe#Jif_RAm;UE>Fq#=|@5Lm1fPna|o!O#RKo5M;Opj=mi0Ti&Zb{0X5 zK3+)?qgaYck~9K0o$!dH)6vE-$%iL6&DbevH)MZK-FgBc=3LKPu4KQGXIpm-193K3 zM$Q70!py~es?0w_EZj_Ne;27#!nggC?)pBULMQGE-Uu0rqgg3(Ok{u1L=FZNy-h6S z(dQ)wDeZoWaUm*pgW<-)W4Wbq6sVCsiooWB!R2hKkR=jk90<)GRXVNfb?(&M;QfNz7zY>1d1_H zoQctAvy0xa{TLpxbt3zw=~DG&G}r7OUAVs7#*V3`OU@sEnqt~L}^hCUf>8HfWByz11x8^#O7oDl;Hj1{FLc4#% zMoC_G6ODH{$xT)63U`4ikI(AJXU%jK6w^a6GVVB9VmKi|gUCgKrZ_V#BR^APC;BYN zqm7W^p-Pp`I$RuWu?k>_k#)F6AoWNmEu%^$wle`-SO|}l=AevLD2)&aM4^S|2!x{s zq2jC1h!HC6{G?oBtp?G~!YmwC8KHjzvv?zGci3or<$$b>h(l;p6U6~YMh>6=f>NR# zu@#^M;?P7JASo)Uva(V`VJI~$XNj_rR(w=mZhB@xNv2wd)^aR^Lz`s{%;1tL@gP0G zMpfdIXbUIWZ8Rg5zKR4qYZfXg4ysHvFL1Phq#(-^Btb><0t&N0TERpxI=3Jr5v7?TQD8WcsJ z4?3EV|9kM`SwV=lTRd%OwN!r~NaJ8E7yFIq=;-M9*jW5$bab@WpSpNmLUf2WHZCqU zK^qr?+G!IK65>KY^rc1B|KsEZiVKPU+u!m=?*EZzZc#z@wW>a+wNSFCS<^;iBg&18(SWG(kTbM4|%JM>3Oh$j0PDeQ$8WT-f zILgjz7$}74bYZ$^To#OmCej93s_N)iwKk?y8yyyt7MmCrlNO`X#OrjENPEfx8F9ck zO>~$pIy|2;(u~0J)(Fx93Y3L3$cm<@nK7o4_}KJ`)(OU>KHp@J6q9buqR$^vho^{-~Nr^UHiGhE!jLk~0j1AL`%qy)* zOc*nEq}?)ZW|%H(eBl_rESH{<&RWVQ&ZJ7m=qe{p2-9Vav~Y1*!((Trb6i1jx-oN{ zF2*o&eBqe5s?p^cnI%jXZ>SJvgy}|Rn8qd;%PeEEE9o(1X4Vp>8<}4&6x%b+Y=PNg zIaieKrd}W$8Zid4=IsqXwi3`(Z zO~@KmSXw@6OnjIw%V^Dr3Db=%=1gI_tg&fDX3n0U?+DXnna$DJvFS{{#hjfuQ{YVF z98^IX&1efN$Cg$VO{mhAj-TJ4N-V|jn9;1~(DHak^OI#E}WHX(~o zFl84M!+3h^$TBv#)cIXPJq;Ut4mm{ArjjIq0_gsky7xp}!3-aM`-p0^YfPjFbr zPhblsRu-je?Ip~Zv^X|8AuGBpag@VV5t~usiZi%|kK$b;b4M53tnvAAqtnZ%c*+

m)1iWoN5YM)`8;B+xr!?lG}TE;{e zJ#I|8(K39-=j|$Ue zRgNu9H4_PxaZdA0z9KKX%8`)HBo>+{6bhyyP8-K2P8dERdTgH4 zRTP_7Hag3dU@mcHN9)X0MPswI6=Aw8d(6m!FkMz+T3Aeam@Z4&m3WJy*M#rHWFGn@ zZG1=w2+7SzE3I1o>({f27N7cZ`-%FDZS;SL-h=zEt4{A>C7rO`|7 zv_3!j#KVj8f4yVnb8*X-_3nS?6N7bmd1Lr8IBD6z$GgNEp8tMedS0)h8*je%rC*x2 zUiR6;cRSy%JM`Ks4c%)SD-J%?P`P_b`Zb@$=3kL|c5{!re!p+Pg~Rt>JD|@44?KVH zK%aY!_df8z1GX*Nw2X|5_-~hj(9qB)9eLOH?Dk|N6i~4{d8a_?ot&aYFZ7qeF%~+O4If<>v$I z27URaeg5O>$y>huy5Bt%U3Wmz+ZTVmhP_O!XJu*XYua$6rnr4&Wo2q*=9bLV%so*N zzAwuxXJ)xjNzIi5H!32zGevTuvfNux5fBjk@#7EvfqS{Yy`OVFpL6ax9P&(YSsxW( zHSlUcYbnuPdkr1z?ema7FphQq|p$D8N~<=NGVY+VNx6Zf3PCtIA+Bcjovx-^=`+0=zgc zA#6L@lpd}Por3U%4%M#2ir`pT;AA*c3u1h#&aF2!nYO#$juyT4Nr(BO!J^2)s|-hP z_aPNqrb;Ej13BeYqbsI`MF4xSBfVyUAQx(2;9oKtHkWrhPQkhACd{Sdr{%Tlk+>G@ z6$N0qWWPUgX83j8laVQCMN^9(jh+O*&L<;{B@T(NG?mQl#9in%<^hZO_@q)LQ)2xS zHN4!QpnjXKW*Oo7t^H_r;1nk~rRQ_lcVn4wJ?OyeCUA>GQ|JSCcjE0NBi=M061m|W zn$&#!9>^SJG*CC!hKx4d%{r5{tvbY>TcJ2pwquqlzh=apGn&p^*JgJq&8)>eR?yQ% zbCX+(YGjlomzd0aAo?;wQ6ZiF@~+X|15)%)2n0X06V+>B(VVIu;=O7%1Y*&e!nx&cl2Js+%*~;uVVR0@!Xjs|gIE#iC%OcnLQs8>!C{j=m~!XZr)T^u zazc0}Gi|fF9)zdzb4BFeFUp*PpZz-&M^sMNzZ^KxPh;z0i2=)FWBJYN?fso- z8vzgKl0h1!gqzRSCP?>l%t6CXN6}kOV>=XaJo2hLi-D*>g^Z%Ft9nyusFEf2e#*^d8OfhULOj$E$|j52i*8!w z-$`g{0e1H*M*1&gPAD+q?J%B+Rcv!tV6Bd&@_?&bKH7lgj|VLjn=pv0cGAAaqS3|- zzMoo9yVY`Lc&FI%t5M%flaU-MS)<^JU-&00mXOb|={BgnX&3-Y!_b>nR#ATP_SV~W zk@{0KM$aGe8A!&vlX6bdT?GhxrrT^ zUA{9yg%Q|NX|EEj;9e&)uKDf8%_PY5=Zv}PUc+#42m5a*p_)cMdsN%z$YXESbZ@TL zjc94bAwWf-6QkEvPw&un&85r$f4ZTKBMYEZ6q_d%kUgMb19?y+T=sOrlBQ@DafITj z=7yzCYnfDqusHcj*bN-XtHPim+-A5?4ArpQl+~pEC_&gh0D~Z&wSbTnQ7nU@tOsN z-WFeTb%CXa+7-jl=4T60jZpTn?o?O~q(vXXVaNFD|KEtPZP|D)I?Qb7E7?Vd1RSm3yu`RbbWb*GEv zBAZ&~UX0!-Pn{Sn*g$YDA_4!Q>A7Ca0>dzJXS>Za|M6MtHf^mG7r;_%(< z(B-%bnI)RI%-w-_&`qsOn?!lwWowjjW?}=sX9;Q{+~~#<2CM%5?qwZ67_&L&aTkk^sshJqt_#72dYkr6312kq6Q!n{2;PDIX| zPi?c6nPq8GhhIi)wWsb4p}kEyIk;OiZfR-Z4=^p2U2ku6nV0FCaB`IEDmV$$<#S7XCy~|{S z>Noi_f;&%w!RmRN0ktp05kV4l3DK*rf(RCa2AG<(fBJl`OaShjdtnG@CY*^9{$wg5X@ zU*te+K}l|faMCNaR|s)oY>1%#?b~$liXbzbBfdb`30o3& z)S?9Byb{VcOnC88?J8Dc)MJqaSRz;F9l`MPrDnv6t28)&^z-M>HAOAyE&V*Zm#iK_ z^-&Vc#hzM-v%k}~r2cH;a{4D6hv$r~2n*P4E-*`Lsl4pG%^i~QgH8@k`328up^X|M)bJ3ULAAr%?b}`7LNwV@`cU@jl*(@7MaOa~Th#H0-MrB? z9(RJW-d@}6BJ=m)aZ(;>%rDe0Sh&d*N3X*2SH*960LfM~ta`@=C5H0dvBD3c+9LSz z?$-=^$rAs{h}C&tRIE|P;)QXTLz|!99eEyW(#r<69_ZHfpZ@m>FgAkafY*wKWG&`p z@O+m_uG$!i3U(z);xlyTNhsr|gT!=o*E`lkT`%9}xzuyer%BHGOLHGFy)9vG-a%`P zK?{EaSAi9|aHc9B9B$lft;0qY4%Ps+tH*J0E;30$Ua!fwZ>{JmRLiibF=Mhow z@+h`8Evg{{-;?VCT(4{vdN-AVg((|xfE9fOx?N(2D{ylcF1%oX4%d;;b+gKkwHO4Q zVyyBk$qy$FeNP|>*Q?!_T?U9R4j}iJt|rHy2kla>pFJD?vmxywSrbkC{V2rqc;U7Z zlp0D})3UodTBwlwN^GIRm+LdqQ{bg^OYh3nqumsdg+=*|dgh?R;*b3K+|>`*nTxY| zB!10*((SDhc<5M={B%zO>Z0J`u8Uca6@iL9_i-l--dB@IlPZ!=&}Ad%sWxYFA|rNU zjpNf|9+dLxOV>(4OacUq<91UlUqvJ13}!zr?eXD8*UWhkvU|(T;&ufcAMlEXdch&0 z(!4`nkAJ7Zp&pt zP-fn})$t0Nr&RDOy4T)Kxbh}i73~mE&G0i2i}cD`osc0As2olQ8eQ-`eA?Gn1R{D? zd3pR8Q!x1PNU9rdccWYMiw1nyNus2@Mc%+?ZH1KJ--#wMq>(Xa)n@xmV`gO%+naw0di@t@H* z@XZ6~u86iCAi~{YHE@}#vSMh2xzw%SWWc_uNb;{6Q20cxr*6Kfab~rOH!Fx>s2O6? zsnEOk$y!7Q3#T}`(;s7oq;WC}ezWmi9~LlbcD0e*H$zlJh68#tv+G@um}H5ZT)#Qj zZ~2oE_GVs*ij%#9nZks=Z&!lJA!KY>2J_d%FcK)9nD9~QUEv@XXamkC0;fAZe5ZlH zte>&RMQ-n2{sltw22qVR#;ahaSw|zIvxS~FXG)JJNURh#CpUfbLmlZ}>iW<&VCb|! zD|7x_UB2j!|6J&ak-i|FVFW05M6PlVS z0Qy+{soz5)27$i*8n*nR<5C%qoiP--{=M*=naRym+Ei0+;Zktnh^+9}u!PC06UPV$ zkR=K_&Dq_Mpuu-;_2nSj7PPxrJ`v?$E4%5XUtY_a({S$eh&NW@L8-1*=r8_=G=Y;X zDu%x;CgPTxIKA%J8XN9V zA8+tW+@+*s@BN%!5;=1I_sxct4YHoA#mojxa#-FD?fIsvzS>#e-H6QE{*_rcguY0K z$5!mhPicwgC_aSddWcARIk7tlzmi`Ud?<4G15Ub1=#xtt2buyf1F#=FFR( zwe-MktUX>ClDKS65tBR(yrgg<3Az+0O=RXzt^ZyrkiKYe4H_zQe)(6DH%_ZSPn{b2 z$0e1fI!=ia?k{>nK4Vzocm}vx!`h5-%8?RCFY1^`O;B2D5SekG?4UKDfjOERd80e= zhNyMcs&#H|u9TYnG5aAU)o-2;eP`M}?x$$SPqyGDo?Y7!Qg(o1k4J0CUoffKoly?jm|`tbR5`PDm5`b8NQq|J9*dcgd4o4kIYk@E=%K5oXD zy2+Bf^+4L%*ga<1e&^3cY~oj@OXw+!Z1Ua(W!T zHqh4Dw)f>d&t0}=}HWivm|e%E7$%q_RQMnAJO z0eX(JYSh3dY(m|HR7-H?$)MU7ro@nvI3w?I&g;+%zz$YZkk(1E=0c5O*{b2u3-6{{ zKm8qZ5al1&O`EgbczM_pYlj(Z0CpOOQ>6`O-BUy_strJqe8FtbxF7b*5d^X&cbaGk zJ_&`E33>;aRbFn^)0> z`#Xl*F#f6Ppj8()V(nL{)d7{Z_Y8BV-zrQF^?jm@e6iPMf;bL6^}6*WfJhPFWmxTU zN_IKMTI+k;^*&~i8KvkkZ-mMqd41SqC7$(8ir%8k`_N1yWc5^le>48Cmx0mp%~NO^ zTpzQ9DjY_Gyu(h=BgniF#PYY;JLj{~<|UTkUco;_(oBK)&9c^)jy6M2Tr@Ir-~!el z^MZ@u+CNz62%!Z9aFd)K>E_?@39p3ou|QNE%(L5r^C%qM^wIGD^)6%W?te)76{|ro zK@?m+bai{O#-pY;X)SJB7^C>K!U-zCGcoW={)yPU10tTGnCQws%ezQuu7WVAVj_s+ z(J_pV*KC_eWUS@t$W@z)TDb5rV>wf{+_Rgds5SyPCnFG;nG{Q3-zCuRsNC>{ru~#V z@v6#YU@6FLlH@Jg24Bp^5k?6KGScvA^rsU{PpC9OB7B&_-5jn+(qLf}Y}Cxl&3ohq zz546W_*0zCZ?8XmKub2Ptp1yAfsS-fngZpQ`1q$T$cG6tJXCiV^OL$PL?oP$gFWO4 z{PBo^#5UK@kuy^&8X%<>Z@WmiEJJu^=?YQqN)0Z|?G?cYHa};43h9s*atOt#$>*_~ z*t4c4D_i;s3fpW;OZ?3!?~(7VR@zTyk-*X~hl%n#C*P_%`hVQ(}dFPHDW6Ci9^9IzKGT zW$AJG#xHRh)iO7!g3~JDtN33tLvLOAO;~r&FoO%4c~xiTer%O{Ss}LSGWFjbE4#a_ z2jgvVkYmE0nPh1-OLKFqKksTNArr~JzCp1}vV7_N+X4s|TSAFIkI((lbmMe)`IX@c zy~nuqpTGEgKkjBi^$4|z?t|?^v9xjTwpLy;yV341+~-Hjo3T}`A(OvFPMPr++<=DL z9p^Mvr!6qnlja)Euj*F7Y|Ijn1xSXGHJE=7CT=nU-yFL1tpt^Qgv)2(Xr9`}5RIGC z$yoqd#11{D9z8O9tbw_180++SCP{n8m;Bt8(@F$$^dWR|j+P$|j#tT)3T03Q?ffDI zZ=;C))r&=C56rrahs;5reSmb)fLSge8k<|u5Tj}mV_}8%_u4j zgvuw_!Tp#63g&MDYv5kCUXfkg-USaJN%?`($a*l60qg|y+JMcCXacy&TKJ2s#2W_& z%G(=T#d(ra<&A;B%Rr3@0aW>eQzpAG&+l|GKa?M1S{39I`)#dWZ7;GKo;{s>;^kESRHUb4Sizey5(0{xvc zHiFGSmGngT`79rWtxb}BRMbBA^+8vwx^qGW+!=-5cER+bq0>Kab8-le#1~YZBD|>8 zV`L_UXbhdci`^Km5*V3}RwOvrx#Jg`YGb=oRS=vXdu;&41YK=RBgnqqrRYjb8}D#t zqU{MAZIM?$1yL9mKGc0I>+0_96@Fx#0Llge=n*pza228+JNhvYYCZ}BQNqsMHP42( z@P}QY#I3MhRI1(Ml_>#2JN_T}!#DvWyP&6rYB0_po=Gx>&;7S2L|@902B1dN1tr12d{t5jea* zq0qbpDbl8dnuNC&;kYLB(^A28wtZUf7h9oInuw8{IDY(frc4g9DR=s1uSsRq)Y{&V zt~vx&-oyYS@KXB>)@elhC%MrUqoSe&0I}?Hf8VO!dA}t}Z<^ZfD|>2#jNcVCHASfT z{l|}yBc(Q$V-Gh(1je6@@nI&rrnJ-2TS@|6`Cskx1s_&bcrli#DD_GrhGRp&&|F2o4 z|0R7fi{}+tUSG%^mJv-09SMOkPJ`(4kZfFEfJiVvbEFzp=oid>b zAJW3yq<&ae!`PJlwp+fG*>J}{ymT__X9PZB0~{~uF6(`tqGqcRGH}*JzDRCKazlon zNRB?<<#vni1Z-`&4xbQ~F}-F;i~zZsg*z|!=;V7PGn_&pwuCriZrMJ_Q6TsZsH4C0 z@c9nMk7uZXTbg;{HjV2)*V^s;GY>QR3fKGZ=!w+XL~Ir0t5--t&uod6RELkNNcHpC zS{&$~F_ubC{<8ms>Af6Uup-wcaQsbkom^WUT~i(SK}BXuI%BjoLVKQQ?nXB-h?h&3 zMC(2W9BRBq*5KfCVY}=r!9V80!T#sz<_5co;YOaO__@=HTis_KM`cHv=ZMF7Ua@LmAo(z!)j}5 z1KQZind+`x^WQvnohc-4JHpIWgLp8j>X)|Of2CehHa5gh@ssESzKR!YKq^kPKc^EW zV;4T3$Ef)F;R9G$kC)H?D@se7!^FplYbSE`<;rznUiG8}@ct;V{FYTLOg~~)wd{5W zFH!H4l1+VMWYb`VVPMI2bVzQ)epD`Jw8!mI1#`bbx>TK`Kaqo$i&uSGB%`Cuosg*ekM0JtATkU_IcUYt>5v9Fz>&me4*3# zEH>Bj8XdoU`DS64=5ltA4A39OT>M*Ad7&>u^YyXRLtovt(g?^xe3mXPWN@ZxfhZAT z0dJWONdt))5whNj_e!n2`L2@?T(%owq~49c-|O&SIWLduXM7%-~1 ztXPKE-{cO(L}?-%TAbpp#$+ropDK7(PnW#*i%R2|{$2^FJX)auYLL$wxmgt6o2o#i zT7e;d_38meWs?k`4s%*j3~2OT^^!A$zv8gAB71gdb>*?Hh7!bkzrUgXF&ls&m_?!yfX0FiQ&rJcF zzF)KlGLQ)9ddG*Wv0@ujSdKB6yc#s3mt;4Mjl29-*u0VgEd_*2}MH3;x0>+Y3p;U)5n+cB7B) zRWK$2!Mco*#HpEa3+#Jck4c`wc2I9>)U*C&>o*lC$zuX@M%LiY===PRt4SnY2QJ)hPs#XyH+g3JdYPM>NlZ3bE~2bpnl&j zG)JfgCbKKx%uCYfI}ZgkBd2S;%FZ>P7lSh%h%9KQA&u6zJx`Ugl*&;%EH8T;a7#|c zZus8b&)JUbl?NLEmrkUTjQ(X60ZqPJd*s)(FE4G>6!l}L*NF~Oa)wVOa$qlZzq#-C zm}qI#Bqek{7i`Y{(ssO5+GS_Z9PUw1N@ln2g+oPX#-VQPN5uH)cu@(xy``QVijQ#S z>0dR!F4GMZ6_L6X-F>n5de{J`0ueXr)}K|vSemQT@Gm*%`)s}sL0qQ1cKQnvEZ<2i ztkc?XKH6gRJUQsk-qHSw$-`bX4*gSvmD2%`QiF@Aq7u&(J12R`zNIB~kAb|9q%_rG zukk>7mag>EvOiWkiHD`!Wj|Z^jQFrJcBT*k3mA=JD8B>$`-4S_rY2z137)VGcXL2G zzc#yw4B!u9ryn?1tQ=r`{(Q`l$~k1O?c<;H`QlzH@b2=``1$kaUxch*p;R@9PlPIp zJ&?_!Pz?Y17YOEwqspU#niMk1v5}FPG~>pw$D%{)kQUc?1KP*uFhWmy1cr zzQy24w{7yJ%)R8SPXm-Kg7NMX{~OtAmVSOl9^=&+U%phCXKFb_Kg~-0y7%F7LTp);%$?+mjK74CT z9b$x&$?5@8hcd*vvix9vc)~(KDA_%w5xm_*);X{8>2g&HVuN(W7^`oy}gnX_9^0wXCeH zcv1tN#WDm_j6+29=FYXlI8=rEp8q5dM!nnn$!C+vL?Y?Chmpa8l$?k=w}Sr$lLnYp zE*4&YN@eH*0$kEPal}YeJj!dH4c}cYnK5cw+q~i!B&yTsAi7-BO}zRuXy$8`^zKT- z(k@uRd}CMQD96&cu49*^r>k?Rb60<2d_ow%yQ`4&Y6r;omzU3$xwQjKI1Ig%&%QV> zp|DF(uL(lefJ9GqZk(Xm;d4Uc;nw>)`yQ|)SiroAE01OJZbC_1*uD)Ey`S3L1_FW~ zzc;DArmJ;mro$}d|44`wCv>T^M3q@{ssu*Wb;Cd-vXy zzZv=IrhvPrNBxn|B>BfJhv5^!vZ+U2BB!Sm4o838xS{=KuQc8p8@|WAp1Q{*(&whw zIk*uVpx=G)Hah{caP9RsB>x&pN9X?Po|yADZcL@)P)>IppS^{2e4W~8e>d*`ED`JT zHKQEu|L_X<%Aw%9Ecv$=%wht$XL20<7)Kbb9|qV)?fd%sa|{&0KeY`)KGqy$S1O*E z@}5z+61a7m?k9KjQsDa^w+3_D8ivpOsp-HtV<7VEBf9m1-bfp~$>-g^74z+|-13pd&;K0z_N=|ZRBbQqK(t2>nw{ z5is>oL!AUP9sJZ^U5%~ZV-+b#dAC1&-xx1qpJd>A{hQ9He=5>sy8A|Q}Al=nF%Js9&d8$Orn8w7mgehzgs;O6fOD_a@$2;6W9fQ9!g|}*cZQk|iQTKZ&b+Q=H-=dwXFR%{lT$ws zy*2?TAV&XFGgnFz$4X1fOCudKG{OT@Qo?<^+}zw6C}k+pc3M|LZ+*u;SE+t&SYX}x znr|JRqR>r44Ts$`Vl8Z3{k5qwkGt-Bc;e*5KMjB_lEt#sQN))UQ!t^NWCC2_NOW7P>O3(*C-Ht%)_)t1`9l8o>vw zVv2|XUO{9X;@3G_mmV^kW=Dxs)!KX!<*~rh!oAL z;$n#1hU+Z8-G7SZBrghm>vq@fM_=drYt97!D6n#o+ueV2cEhbd*CYn+1f@R>e?XlY z>g7Wv?zo?1S?)V`&`sS*InxEH;>t6E@1l4bQR7+4QBD1nP{-J9} zJ<#LesA0!*7skp0stq8>?qMu7T$t}m7GF7sy&u!hkZ#;?zd>KTfssafTcB?K`aAMR zaUOHe!RPvQbp!Fh&wKp5=+8TcK+kWk(|A?#!7sy_flV#7&3-5iA8HKa}7YP%$ zQJuL*E<=2NZ;Cotc7>0TH&4m)$&qaD`i<=*lPbxzi^l*1$Ds-*3?SOzkVUfYRec)d z*XPUn3O;14?o=XV{C9p#er$)S>zY)@1mS1Ph^P6F=?`gYre6XQEk0cN8}-_66}HQB zth6clmh|sG*J@Ac=MJu`mijeFFE-SA7ns&yI1JG^>^eck;b{)^+KaxEUNTs?(~erL zeQ+!?3rMYBPBQ+pQu2aG$G&cEVGi>=L94qy+m@K7mVB|PNwb=goeA<2Ufp;6i7ZuX zP0r}5@aCiLmh9>)5>@vwp^fK@zC9p>O6eU5bYU*d2^ddi6BsY9-^;>9gruxszO5x( zR6#s^c)b=I{ySF&avyu&rUCEN5;@9T_@t32g#-M;N{2x*XXC2G&bVcTn9H!`wW|~( z0Q-83Pp}KQ2YX7*77PYw-xT#{Noa%A;w|9{3c9)h{@NFA3<9ap$X%?ogZYNrPcannOOSglQ=TA+r?e&?q z&N%LCGkIoX(8P?<+^;Y6bRjZ9&@P38g}R1%Ce{A&Kry3X@Ent!Zw^2-GPlCOcf&S5 zr)J0bN;M<5R%uULbZ4kevMOKhr+^hS!Qo2-(nQ-Q%I=EB0n^mlo8nu5ut%WlF3c(T zcNgz6)ppfkf1253^ZoXX?y!2gZlQT_i2RT{DxA$pQ_wA>dl9}QWj6kTj=rw8e#5|D z(s%&nY&r9Fu~IQ_Wk4&*WkKg=D4U|u(a|pMEpPtypF`-w&Vmk|i`8?}$~J=WI?ZdU ztLs@qBIWLb^~r?^}q+ z%7DC)taT?sOoh)H$3dI#o)u0dk2hV?W$vVuUJ&b^AeSjSuy!bz)>EhUf?Fa#Sgxrd za}sbTHGpgR6I2naNw%0R9Ef2kAc&)5VeH1bRt4Q#=f|7O5%)`-t(QUM_aCn2_Zl7L55iu^h%%+!6I(a*a9DmX8Sg-K9Uv%;zirXtG@E(ouNYWB9Gnn zCi_37Qtx`lj-vj*1LEEs@OACoeftTy7R~{7`n}OpLch`Z1pRekXSM_Yun8GELRjDv znnlcgGt&m$i$;mD$Q9o5H%jMVW%^L>FU8&CFMq!hwng9OsKMw@!$fE8Z(o;zybFmk zBJ|ATh3YkqRoDdtY#1j|b(F}ye}7)MQhf+)t?fh6i!;rea&RTx@s>4QnQCuv0|XB# zAiww5^M`VD79mwWgWs)7t>7|U6XfQc;P$KMTqp0fP(-+*DI#&FkLgv=PS)2{7S{mV zQ%p6P&gc_*dV1BoEzb;By*^uF6rS3$J{8&fdx4YICYBesN2#b^w{UXmlzetKEV#=t zerIPVI9PPnLrX*infdc5!xZ3$!}RN#8(ePH80LGRSNoi+V9=uQ`Bv)RAIu#c9c^Dc ziuiXsr#O%5b)qXWptOl()N<{tLF8OIuKV`dt-j!=We!BLTlmV)gmWAQa@c#R=qeJN zQ`sf9+@A8ubErt1+6C~+12nUfMk1um4|t%)T3}Fa!E1(}#l&mFpFp@K_T_jrJ;-lS z73ORtG!J%p^!eeoDPzEErdq)$UanDG|LL0ESp$Qe>5Tp2C&*3p(sgzb%fm}Ss9i_e z8sqEJ19plsjC)WB=KEQcW+%hhF8lOgy&5ILBXtPJzw-my=NQ}zT)hH=dD zKZb_c?ykHi)nDE@_tA%FXJlmLbC)~pXVz$RxZUlvqA2TeSMY=lL&b>QRDCekJbot( zCZqb4ak(pCJ1}~wR@+FBo_ffb9cBwMi7e`V#(e&aK&d!c_csk8;>j{V`ij}{BC_Y zID`LS`A$(Ua9`T0tN4uQij>bsqFP>WYM?-*cYb{J>?v+`;lJ10Ql#;{&f0!Hv(K0F zpx%KulKFoC?R~=wSF=#34>wlQxk2|Dl1bs`-giUk564&!e@5e{Mdj`B&L<;JHv-kY zE59_P9w>6%Tn3Uwsgt6_%mXew40-Qf2d8n><(WJZDjL|%rowo&TGwm+2e2(?m&S1` z+PmO01CjRw&;fJAWzuWt^UZF_eOH1PD{qsT@`~9jRSz2Lo z8bpXQN+$oEGm(Qk^3vU1q~Gm&;O=bC}$?X7R6BuO=l12--!yuFeYin(RE5Aji z)e<^BNF!QAooKn#S$oWhmWoPHK z3I@aP+`ZK?+!?BluHhR~Y>u^1YibvcRjzwe*L?!yAr}mLjkF1ooFZQj&2_F;P~k#B zLVm0jt>epu?XvhQdV~lzM~0}dM4*6;F)pV8&zaBd13n3fB8hXfJRSHBtgI;6=*u0B zq+Il%8lYOsE|c4`{@r(DB6wvqurFPGPj429ow*RFjpY%HrE?rrrWDf2e}ZI3_bs@A zG1}E-W8H^Ao)ToEdb`Fzx7FypL{sTJGx{a1m8AkfH?_3On;k6ZeEy++hgK zYeq*vS^itagypEHrEx0O%%tyE0=X*$*qFY(Ddm^$4@|G$kW&0hc9exQ$(hd zF*YSC82us(gv7xO!*|DELlc>`OJf1|-Q1MvGAbcaSniJV!B|Oo-9UE>3k+BMM44mF z9S99!%?XlGwrv#oeC;t(iiRP-;s}hngS+~gb0e^Ik+SHi>3%wWbhP8*RJ})FpvE76 z=!x<(vQocj0ZS+S9^SmUf%m}gciNG8(Dj8Fr(e*i?h%omnL)|)74qNq^|`m3b(BX2 z3CAxaSX!7H`itn_@GvGwOsz*JoK8;NH1q7~ab+lEugok!CONM?MbTKzB8w4~AbWpv z8gL^r)CQ^h8$d$GOW5Uf4AR@Qu$$3X@! z9?dR(F6`wi`G9R7KA!%Jdo?l`ZzU3rF|64Si&jJtsO+#Bc>^7xYx4I^`h1h`pJAfA z@OelYIZ3Lagwa7J_fs_`r2DahpwKmHzG;$fp-RNoV%3Z&Y3(nN2K6=aJFW6f6am5k zz}FfT>CR>L)=!U7m7bNjmb$dRTf2*@##UQjTbh1%v~*Gq+Fb+}@_UOs!dgY?Q^b$! z>z9=*5A0KhETy|n)Yzy|2EEVK_I>vVG2PvNPBAq;>{^{Q`obwFvE0jf)9;mHpWBlY z{0E+%H5-Z*)Q<)R;GZB#$%762QNQ2wK&7ku^qRO(;^3h}zg{)s(bq{YeVwV>K^}h( z_ML5v)?F}iejj!c;>a#-l%L{N9s~YWFnbKB)FBU2T~smRZ{jZ5f?4+qh^| z6piJF8=X9}Zh2Re)Tq095@+>v$TUs+wsTU$-+`hz>S66Ov6wGeDuCxXJ!NiDyPC!jknEJ*< z;(jNO@Hp`Y4zVDLs-&D&(Azl+?5DdHPmV%q@3=W=n$c-0h`bZ}7D;PWlKGw&>&;g( zN}Q;6X*+1vTYn+>__L`EjHz}XqtI$B@4QBVPTxz>I0q%Llkq>_FR9n_#+D?Q=>CQ# zq1BV*k(E-pd5pY~`}un$zMxpG`Or9NEPH+x^>xq5?{I6MuYIbU>#mmZz)4JP_01?!^6DA#zX; z2(sm6@>Fhnj7TpSe+ijRxpCu0`ONeT*7t2yYAQ)K&CzmI``HiRj~>j*Ju#64!=8P0 z?>4Uvym0&p5CLiL=qtNyA24Bdw(1^?S$X+zyGX2WL|yImZt9PnIJ2~Lso7wPM?Wte z#B{f|w(cK{k>A-7h{TnNmu8JZ{PLXKCKI@P>Cz7xE|T?%-W;B?-f`N3l$y=6xD;pj z#IF9kPmzU{{B6L7ovrKo!%!n=w=R2;oR#%KT1i;Fdxx~6{#Qls4oODYt|jv6Ht*p2 zMB>|Dy`2}|9FUOpa&6G%-rf>{u|r1J%=svqA1x6c>EppK>mRk^BvH`kruvPebLUf( zEHAF&zkc=JwFw%ee`DB=kpPE)0FpB^(Yjj^@w>Rn9N6h>SyBXlo~FO{SfaOyCQufO zNgM?XcMEuwn(>NLBmdG`c%r;PZt1*2a)ZL5ztoQH@@-`3$r|Q&O^rhK9N)AlaB_uQSXrH?t2VeU>~I+oXGlQ|^xpUYoNWI-z2JQqSxU zvZWn%qE@+e0pu|=(<>pV7Pc)i=+)UT;}<4dFJ8Q;V9WV3Zg`;I7Ty0RG@{%L`7=R2 zUPJ#u7%R`Rb*b+q4rF=X_w@L~O-B5t3ZM>AaJEGP-P7AqM#%&M&jHmTsKhSmU(GfT zxkB%&Kh|i`pWqsG=D=-?^^YUp29{ctl+O@*#HatQTzDc-l}=J%T@I%ex#2`NVfHGE z%A(Qfs~a^D^x<+H9aUUgd(pZ`JIgi(gsal0v$iJ9$t8l6%rE6hwMH2W+6PvEk3;os z`KCg_oBjJsqzDczsPEO0i;{M?kDG!7+e<@n`ZW~y7gDcaniSn2Sm%x6XFa085?nDo z73bPLCzeKcTdDKT@b`T3ci6(uvK{N7_^bp=n!fXe4V6{BUXp(*XJP<S=n zGx#m}aTr}O@}YmhK7|x#fv70&Z~E4bFooK!nAt(3fQLF-`_h^+V{r6vz zl2k9flfl|XaAwkXU1*y{mdwJK(PCSz%Brek`kcor*Nd$M^MJQS-I6_q>$DdNp@kgv9i0ql&2 zYn}{xWV9l59f|Z+K>U;{{qSTb}jaS+{U&3OY&eQG+B? zeRs+rFGY)MTdqe6Ub#JFFFi>5Q)V$NMszuv=W~(?N%~!PLq5TvUsuk!8FF2)S)3;d zhHCp!Bbn!nX{w6G@CT#n*Kl82RQ(87ua#Uw{OM$2olXXr8ywEZyV^Fgs=80KI#kN1 zC%ZoWn4D}qSM#7-&ia%IVGzj7>W_qucaEupR1IN&?9QIOHm3f<$z^e3(Q?FZ zv#|>IBnS7>-R*CD6p*r|VNUVul84evZT?I>OC(tZF{keJt9)XbvO znpkqa<^FB%SbN=9{GPraQBE_sc)4}91_(iHSw!JdwT1-bv2!)7DKpnDhsFmg_x&jm z&s|35+ba84lUEXP4#D%=8z1sPt(e%|@c*24_`nBi2K5cq5DOP*`r98M91hUQ&an0M zT5Xt|dfM8EUzZ@Z0(8fxs#^;BC;X3r5urN`w4c}|C+Frc_3ql+H*UPX&7exZ8IAb% zZMDo1wAjO6#dAbMm(NKYsUMSsQ`qYuJItNhVVk|7CKRY`V8MjOV zdTMP@Q#1KyQi{%vBIfOD@!aM499x8g1Bx_UWo5mB@)x~$h24A0DVpO3YFMZH_Yavh z&p-2WC1!}QH}9HYU4QA^)tr_;O~iL^6AsrdQsmT~BBtA-#T(4zp`Q7VItmABEOHKu zazx?+>_PTC+((L1}F4)??0A7$8dhpD%9d zK^Gy6abG;MaK28=(?bqPz39aU#T6EUuo<=iBP_PxL*_^`M>sl>E5MYPV7X=^4GmOx*;ts`X$%b#&i1c2p^FEwER1_9py!! z@ctJvK+V5c^=jS5jZ@2oN9LLgmb|#_m3t#-a6+iGJKpvk`?*DCe`aQLOk4Dc_~X~W zz*Z;uc6&cp$NS_=&iL@wVfVR!#kNi1y;Z&Xc4~>B=!S~M<33&R$}xR><8R}AZ}J|x zEN^{vyQr~F_x_3cIi@|`+{RpfvaPeRtn@8kbe>mLImaRX;)>$pvedPOfBbQ1 z|DT3%fz|yis>Ylyj@o)E5-CxSj-3^`SG}P%_&-Ax95|$a9 zZZ?)%c;v{DqNmd2z>TAJPem(E->S$P?=2ENF&;NcDs{kVnK5Q%QBhH+QE#WT>^#vnF`s^ZP%q3tWZ0FL-5j0{{IhC7Wk5e+f zc=9KNe{bBZ_1MdsLHv7H8dPCS#BK4HBqyv&oO5P%D3U(97%LQZF!H$IYV^>|SC-7`V9~GNVz_{1 zcRDlivYm0_f`=kn62y3)rM2XnK(sC}Y17l7vbD!N~pl7Khewo3&9MqL(6|VFA<;y{% zMlBcS4$fX*Sm=IryU42)khsqGd5UY_J|uX9Yv0s&PiH-R7$;Y-*5NwqHf)%(cC9&k zi+&lMdaX>HquJ%3*OJa19j*aMweUELWUcCaB97^&E?{Yfx(T-@>ks(F<-n?t_ z_p8(WhYlHX^YtTSa8*@R<&|xH97R`5UG&O-dv$B%#$^V%3wrA;8<^IqQKLpt+l7n$ ze>a{P)pyjc4!`~On{(3BWtA3pbxvoZJ5pUo4lfG4ef#!`OOFz6?rW4gdeg=9s(ZPW zWviNXvKnscqIYcCtDXi!U-eua*68NlWAh9hg@y+X92gQFe(&X@$SumS&)p`=3_eW% z-2g1O!o#gvJ-q{2)_bR&$hB^HVx{iAe|z^9ImCCGYG9l_e}0FugriNJjjh(suWB>8 zDDdBu3ZrY|K0Lt_^zPl;vvlbEKmW8nxvXFNq-zPyA~p;+b7|dTU)6iA-%^9a^W)}) zua8)n_U`GT0V#i8{k!M&k{jc)jvn>Fo?Pj;K5|nhxe%s9Qxf2R-c zO0R5-2aBUT2P4yu9P$2R*cRQ44{r~97z~_z_b#t&E^Q_+jGMP?S@%OnjvTmjsdIbt zpvlL0XRjHpTe-5))e^XLa*Ou3qY#kiYP56b&V24%J&Ei5!7mC@SE&Pr_J7a>3>j8< zbO{SDa=Nk;HD|F{|Evu*e*NHFe=|G&$$f*3GbZC&D?2f?prGLLc2T!A!Fkzf&-Qd~ ztgHVkk7s)J>{-vjCarF#Pg`{*WKY?PJEd)njc3RFo}#;V?_S)G806tmJa+#ttJkc# zeQ0`n_NmYzLv-dHo7}WzC&1pm!~XsIE6*0R>=m$RfD zzNe*S3%tP5qkDAi+SL>HZWCPZ-f=AO^SrCqH=M=lQXDpY8t+hue;F&Mt^a~)KHd%X zl4lkEJ8nVzez)HzI}@{0<-F2=0p_&*ztjgy^n z{GWrp)6e+7@A1g5VI(e_5L3Iewe4G`A_RD)Ow8k z)=@SlsjD=oW&S%l+Hw@4iYVecvE)WemW)B^Ka8B!9qSKrbx~e-MbdLMaadSR^O08SFz`PtV3n zU;!390T%;U@lXm2V0i}zvj7&Ub69|dP=I0pYmj>g3;%aG%hD3C%E-_onv<4hMb=nr z4R{s_aoZLG@jQt;kwUq#5Kk%;h+}+X#IWqOS2Dzv62_|@09XNJCP>VM$UB$;@=9ti z^0FG*e_SRXDRKp;lJI))Du8q#K?-A#@>e`NB<9htlORD%Ean1m^ym*(sskAdB0Nn4sns~*1$^6a zBx}I4(E3RGVZ=)ag@h0ngOM-@5m5xU`d=E$e;P*bD+W$BX83Gp0W5O1e3KC*2aoKN zfDb?k02{BAu9NCH@l`vi!DbW)2~kL~RFYrnQYx84p;U_AHPD_Afs7lrt(7j-)_y!B zFi%Mya$%7K7DHl8HWtKnaEyE5SpYkNG|rX3;JL*Zl#HUMiJvSePVDel*fX| zh_Xcr&X)1mr>r zaub(l6xG-vKV%kiw8m3f(&8F{TYLGQGe}JXI z(1i_WXfUR9ZFa_Y_W!i>|GA(9j1~y%hXB;<|8qFD4)#j^zb(hk?x+9%J)U~_|5z*p zU?36$VSv9(tk75bYMiSI9E6J_YW+yAK zh?H2Ti;DCj1mYM3LQyRVM5oq399sEM$!hq-C_$D= zizKuq{ogRG`ilE~b;at$e`$kA;h$9d-nuJfkh=$fKvWQoma__p2Dx>RH(#&s$qJ=d zEQ|3hUCAj!JDD05r<|<{t*Dj@#4*;1wnUOzh^vx86IpA`to?AH0ES2jRe_I-6oq(X z>?Z{b00I=SW83v%>$w9-U9HwCp9P#qW~xdKpu}kEqf9LtX-{sK`|0TqHSS$idV`53kLkb$HBnAO__&k=P_`l?;oCHKsA{?Fy zjRCM&5CiZc2>})jk?Giadf_M-1G$jPmWiNHz$1(SFT4U98^C3t%9@Hi5lRKtuc#$YzxDjORXz(OG|0%5X0e}X^}!~$4+0VL!RS;(YTHa0A| zepYEA=UcUqQ->CEWGz%_3N>lTL4st(qpB@oc1yMnr)ES{NnokC#EshoA#~g@T_GR= z5s(bNvI3NA1FQf_6<7guPBsvLHvr}{QsZh`AdW$C!-3FuxXsZQS3UwFTA5@$0R|+& zVsi|@e_|0hiB^($y;Lg!E5Jkcm%P3qAOeXoI+11ru{M&**Y=c2MJ&U|!2&U{Y_CcM z=E@}~=BdfAvh?eVhLi13Sbs1j+DOsVWgx&BDIVe;8X6fK;u#8fg@go$xB$aoDLEe{ z2%IS3K|l&DMF6f8A*djqzegq{2(qNHL)N1i=_Y3I`|=5(6L~ zgAf3LaN`OT3W>h=1z;f$;35zY5@P~Thyo%o1!n*;1o24242y+Q=(q8Z1h*Lh32vmI z7~Y#iSSS@i09ObKL}-IF+gplYu@C|X#C#YLk=)4z#d!U2G_jS32Y{GtTMZB9q6+(J ze_|jpgn&ZpSUAZFgRLM!_1L;xB$)>6*ZiZLqMu((327)B=JJUPw4XN664KP7eRs}GLe~^L($c`(5 z0xW>dq#wObVELm=v+v%WA84}v*XCM-Kib;=R6Iw$9DrKwe~zs({>yRriT{3=r!Mio zg9+RMgMes|8;{QjNQ|o_0>BZVxbY^{VoUVTED(66eFqIiv} zMJ7#9a*3NlLaDFRFY4P6e;C2!->6^8_~Z}<8p$YA21K$6?Fztr02BjIvH&F%ER~Y( zJ2N+4k1V&fuNY$k#4B9H02VL;h^3-v2(iSA#1%Z1jScu>K$1Wx1fn4TLqIW#Pc|Na z!2nOdCw3oWKnf@l0z3$p!gwoWa3@INp#Y5F%@l|+C+tc0tJK~uXR4kLgCl%P^as{AOJ}4vY3t_KGl3tfJF`^OQjBaACTGxC`7VTq@oKH zh%v>|Eal($LKwsxf9;jO)725Is#;+>&SGjbWzAmQ5Hh3yLvS;IiVVQz0B$mdrAQ!v zSkJ)unOb3ncv=VsdNq0oRSJvL;kB`>YBmO=S*VGSajtWOj7o?M9~7cc&A}QZaq1Uk zL3PbT2%;z z)+Vw6wPF@i`{3eb2a-kOY5+npxv$44Ndp>3%V|c(Yxd`AsFhx&Bt=y$i26e*fI`tM zWkOJPDY+Daf8b(Xt8B9540-i4x{*7uB2Nc`T$w?WYx+Pm?<0uO;ViPo*p^IW6p@@yfl8jnI7UDaVN3}j; zfmzI@>?-C?YW3+!(ZaKePEpK31>LGg^r)@i7)&73f3TR^^utCa5SNWoJLZ`?;E82_ zG?A;AqBhzpY@z>J^4679Kjr8D`lF@%Cpo2l;=fk>$I;F~S^hizjQ{&SPaWjHSF!|` zP`E`arT`Km(3m(STBDd^$`~to5^5_nk(ZDrwE2mr3{Hd)M8Jc9blhwca{)&?;!lAn zRLbWIf06-~m8wloHqrxuK#Xb>*-X66bksA5lA-3&De|V1I;^%1PzptL(bLKdx1E_C zA^)a0C!9z5~8zgy-0{Gok)-2 zb>J;WWg+M&EP|M*oZM?9-4>xhB%nYjELMO5e-;#}JcB~ULXg!2)Ywt^myZ`*49jOJfVssN%IN)QN}A)N?Qwko`>a|4yRP@y!k-nuYb%^q^COh}@XkeHkDKgo-lU1^dV<=ta2CVfT} ze_jm*Ma$Dsad~7)GED?^(hbc$%89jJIIW>g%*n#2w1yc|W2y$2HZt-kR;BIKQFr7K zqw(s#e)UvRTWUj3DR-d|PGUyY%1?cw!kl4}JUocp(k7A$F@cplk^EQyVy_Sv7DW@$ zr}X*xwJT+!9JK;g_En>V)to|sv}%s3f2xDD(WL5#ja*brGBaS<9F-GMTLq(z5=soA zf>SE1D7K}hG>pR8mUZHu?_mFFY5$X(5WdO!FUQ`-UOE1g!*Td|{_}Tv>R|uNmVZfR zpwwm!dXr`v1yxBesD@JeThzhMifM3_N+=Rsevq?;1+YXZvOjBD;8iNh3h+{Re_<`# zdlD=mcZHH`qIgoWwZYghiYK8}BP@p4 z0HFrR6$JrC3x0BSklq_(5hq14YVlY`d`lurG{}ul0ui2k0bU>!U@2^(1$_i!KKym} zqL|SACu=6CsxlzVT|9D1lJ^J@fBlEW!W3M)Btbwdn22{H5kf$rGEGrjvNKP|`PS>% ziae@f!qhJI6;`cfI#dmT6p9|GtY0WoM>Ss^y+tc(OSCfI%k?`ENu{##EMHqA^NX1_ z7TspHdd013{Ao<}kReudN_PpFKCh&X1}e^1f!eMCz< zl%jr1U=Ray!V}RFgUDL@1SdvQ#-(@xE(6Ik-W4XUnt7vm@T|(rQOuzj)~H${USl9A zk|{B)l3HR1`8&k04rio?EtbcSH;ql#S*>KkB%!>BbNFCe-Jyy1vkUc1fh(= zEH)4+5DEc_fEy3+1qh0fdw(GeLa3lXYJT#_!pNqQV**$aF-CHEiMN^jLiIF;;!Pfa zfMOmjk`az9h8#}73K#^#LI@Nq78Mx_5xX`q784r{0WstQ}}spdz1kyl}*Ze__)CckJySz9d$wgW%Mm`)GleF zBE{K^GcN~M599=v=^+&^B?Xj)FCPHaurOX1EEV$rsTgmCY-xbzJ({}aD3w#r4K%1H zYb&|70AgyYk)Pi}Fgw9W^1472m2CtD%;TYy8mqzR15!xNeZ`6)K|IR5H&|-M5Pj{?X(>m2qC71FoiK&l*mQ(*c}i5SPSu zs4ke3AIueGm-=7<6#``-ml0tB8&@^}o9ezSF~tKkXZe#Rin1P+Vgez`j)5?LD8(Cr zMYvRF-oS&h0Jf6oXDBeayP~Pu2>MiejTI9q@T&b81~#Fl)%Kyr+R5SZ1Tm2CwuCSo zFO>kSM3;kM0VpBVoFYxzSZa=32$LJwBUxtXNEX0@A@YnXO1#OGIr)90m&{=S87g!j z+R+{obD4JwF#FBeXQ;G!3KE0SLWrk8SlNUc$ecx*cKw*rVV6S~mk(kADFjj-n+TUY zVgVk1#SmFfEQD|pga8(}j&K)BVnKjoX-WPJl8PWizy&y#fQ3{dQB9Rjoue{_rD@(0 z=~1pgpdy1cWq@L!l0gfA^(zZV$Bi}=LjVVD3zvIdgzrUB zLY_il!lAKJK3@o_oqFnpj!MUILIp`hD$T1Gp-Ayj%1BwG0$0G+7-3sB@G$%Ez{VWpUULNd$g4Q@*^JVp#f@<|2B>`D)Ao@= zHjZ|eF=PQ2f5H8E+PkLK^fXHVl8>lm$`}Zv=6%g>J$>jg^_IwEMZeTiE@-G&=3ys- z2p#jIzRg5^VX&7tF#<&BYdoQ335;OWy{=>d85sjjE#jro5El~?#G!!)M%b>l_qbB0 zFi^faU<3Ls#0eQ3W6y&D=jEoExkPbwHEGXn?4_Fb0+$n=JgQNl>4}ipp zKq82c%V%VG2}s7>*E(`aR3L|q9tu&4m6!5l0V4_z5QV%|vJz;cm6so70azcw(Q(8L z%Sy`&vSid~%4$-H*I|@nrDmZ5U`*ZlH`q1BGR78jk-CfnlsBX|J|4CT0qXd4PosnPAaD$1H$xptmJ;rl|7i-Rb07 zu(v?W16Wqb$dSB0rs-%bXzSqU!Xl3wjdTwQ@(mh)>;il{o z85u748$3-$hGk!XGC9PuyD!KC{m3PAVG4jicsC(26+Q1!@9^=!0Kn!CZ6@zoN&WT?mNc?h+~;8TKLXEPcc}0#UIabPT+#)iU@4 zwW3-})=Nj3sf$c!%L3EoHPM^qKvbR=MsTu!vH?%h>vJLdt5HX4OI(Hzs{SYV6D(@j9)>tj+j}$@3Ln#$^3aLc)p~~P@U7{jYx~nlHQVsKe zvTAFX90ybVrarz=z5r9Z3?R-pkf_|3N0+N6gpwJPs5T_Ah7%a1$pWDOL{b!kzBbXDHf~QbyO+` zSG0Hr4Q^uy3}YHxM}+Z-rBJJya&YxahnX#d&X;mUOC=8(-Z_n&Ld4Uj9`mh*tfmH($G)yYZ+@~hJ7ECD5^$p0Ru1z&l z?Eeaoqm2e^Ff6A5jR9@iT@NsaE>=x>^#O9UET(~B9J&*A825TYIGRd-`APtXF7^k9 zZ5*0M9|a5Gba9!-GH+cl|gZ z5VNjnr>`5OcfQY=dYAXGDqqgaFn7^hZHNvTtsL8TuJ z5b^{uFd9Ua^Yf_J-wRL*h3I`As!$U7t=5v9F~QkRu~+Vbr&IVFwuLt%0# zglPfE$;DD_U>ucF3#KR2TcHqUB|B2O0TDQ=AwRJH*VyQ%JNX zm*jtUXucj7rHAZ)+vB4DH8k^Gp8DW_#F77X*a%u%{Fj5u{l9h`r=R;jzsplE{4XVR zXh6dQe+oBA{P(aQ(aCQb`9;+5jbJ`yV%81hBXTzg#K$bDo)KRPjj4CM7qgU~(Oy5J zy;MDXVn+WT0JZ+>ST6<1`9q;f|8b-j$$&rOy#5=ksaBnT*KkNvLn;2++gu+HizxJe z8)G86p!I0i7hh6a#@C`tM4>-8wxl(Pq1kl%mJr6bnO|Q`y&3&KH=5c* zgfeOPW5;pT_o)Z|BY{yY27$B(foh5W;y9|{KlZji_y2vLr#|@45Rw7D1qj68tse#n zlDA1S93)SF^L3aIqpoiQ45=q@ozNjh5np)>jGB_vLPRp}QkI_Se$`$oF74^Js2u31 zr4EL#R6}%;`r6b2D{Mt&^B#$+R6I zYbmOMIX|*5QSx}xl}Vi32M7WLxY;&c8zwmHgRCeV6plrFx4PIo&aTnk98uI3_`4( zNX(>KlSiSI;V9%T#bWC|o)in$-bN{Z3Js}KGk*v)pK)`coI+m{NvJ?=%?PTj?|A#^ zswulq5wc^%pDA%$4Y6~~l$x<^MG>sA;yTC4F>C+d2d-;_p-2H+lde{;6zT>(sW0Oz zJu|Y<9};pRH6D4FB<+Ziz1N!31R_Hz&Tr^rHJBBmS?y~cW-GKU2YJg#y&# z|Jys-Df|ESc6RnZ{r~Ur)W`jQr`%yY4dLiVL#n<$X}c5YiHYq2i}^M-xNxyhHu+?i z{t~ZPntXj(Fau>GS=rc7X0nFbI1O7HM^>9QCZ8rtkG%F+Ep60wLG=n`rC|Uh3}sLE zQa#8K7E4`gjlr}fLbO^OLlq?uGb|K#3MdjP>~@qpdm8W*xmlqRPf=fgFABs!Vh8~- zh-a<+HcRRj_}c0xlTm%68p8uIP<<7e;~uoI>*cD7yfKxrrNm&6^LV0+yyxg zvt+MTGf&TX0q%65$6(}7ZD3Q1xh%tMMGkXQ~XvRKN%4JhWx zBnKril<*U}CQVc$GKIlj;=~9LVFpQRXolQ}0m9_&GM7w3vbM{ANbyK99gS#)jufl$ zbjZrdmg6HwQGji!A<#<^0U(PvH$%-;#hUDbW{}4N%&n|&vj}&$2Abl@DJg)r0u=Mu zxECg84f*IZ-q8e9p~R2j*VJVHvtuElNDw225$LPxsKx%baj;do|Ci(F&Hm-KWK=l7(@7kN%$hG|c{VC4csSRXs8^cugUZ$qD2ykaylK=%I zsk^DEvD|%ZE3~B^No~_Jnf>frdiBE?Kfpk;HT?&1Y_)WB9@3F?&QBRlVm*qdB)TR; zlwr_>s}YqTvoz&GNsuE<5)<qqolX&)`W{j zh5y(N;fy6YaAw}rBteP-63Q?P!sE-|F7+fAG~vi-Cww@%gqR8$ghQ&@=C36`2>XAC zw)yM77!BL{kN>Znuy$EdpG4PLYSun7cooWN8oUboY12>PghrlxiU+PiTx1 zi08TA)YJV+QAn7MXf%R|Fzo`F?SGT#Fu{bUz;Np10hxBJtv1|}|F)kbU`!Ypq6mZF zO--D&2F!^6>6fgJBu!;m+qL_~h{LK(jA_Du^RadgwX!%FdC?-QY zO_^UU8%9JzU+b7csn;0huqM@2eDY*!Y6L@t63z==!bQdu9b=uuRPZ>YyuA%uZ+?Pzm~f{uGF0ijU2L=IZSwL?{#;(1<9MJ6i9Dnwh3YoN3k6|JD7?c_x6QMVOd> zvx9SiW-mcfg)#_QRdPFF=bzsNE!*Gya4+2b&c34;xu_YURRUqalY~!oLyGhhH0Q_m zh{US`nGl+o-`vX2nX=On6aNzN6wS&orh@?*uU%qPlG=pB!GJQVs3!D_rb432K&!u=4W-PHs|+G*-L zyYhkR!56qdl?es}^cSFib4<9jk zAt@sw;uD?f<*{eVEv}?I_LQ{sXQt>p$_i2k(2B zp-215aO{tlx9o%&B~*`*KL3agz=s=DS^z4|CWJ(_9cn!Zdv;y}rx?I@m4=E`&)T^!$ond{P- z@`OhDJW^MsQ_o}=WrC{QRrVNkGE`G8uFr3iyDFWohV^J%n@*C_OB54-8sUA%rNi^C zui+8pK1#_0_48*g=pURZlE68S;V@HNMkHD0KCC-_y3Iko8mSZO>6A9EhuWhcvmi7} zmq|Gn?uYx|t;fr|=`=3Xi4a_@V-Xy)MH;)!IUO{2_Tc1Nidn4KQp8gWOg5Zisl2hb}IK&^`R zyenxB7O87ZjRc?wBGM zoU2B$=<(54YJ|2eX!z{#7rh;ji14ZFU;A~dY03!B)pijL6U;kV++Ta5)*LWQ-EFVoU`_L}7fOCn%^lA&|u=&dY{?GO3Wn+cRA+ zjOEVWcXsanZEw4O*_dQZfnfWG*ePg-#PR<)4?Am0#-Hzv&vY&3W z+1Rt**35HE?%#|zibgXBBX$QYq`civ z_^`dV+xcgE_rKbmf3!(TTa~wEi?UXy)p^~n4C^^lmlJjGt6 zgXe-WC4E|qTVSNFppR)Q;ukR9fGy2ga(v~_BBnY)A0tCv&L$v7NWq z>g$F1SH8T%E%Q5zWx+W^*po2T_yTW9ACt#gE!@@gJ&rUsJ8LaFtVj%3d=^<;-?6G3 zNB9C@Us#I=i?@9o1t!AF%193v_7f;>9B0m;XZP)YLz!X}N=z_PT-4vvYl@znMD;Sg zMH@QCQ(etH+>~bA|Cno2nz2kLYzT=RxaZKW*{p{LR*A$el03DvdVV<2CC(-&1dZ!e zEz^m55KDcR@<^a{c>GzIE|$aZ8A-I@VjyX1Xj{0Ax*7%MZ%QJpoi`jN37@)rQ5)o2 zlyew=ncQ|d#s!M99uKOdRCsV#-+{!&+q09bR3u5v5d2bBXkCp0BidVMm-a2wRGMV+ ze!k=)%XF*H#kToCoBRe>U28sz2bKp8DBs}vYR#u=4K_=lIxbe0U$f((ODR|^8}CZp z!abkkP0fOSxWP})UzgdyBxg6qdGWEj7h*Pl!%k}N|GL%m6-oy!GG|+C6WVu+eb<;5 z2RQ}%T<*v?|^;R_ zs;Y-7O$vlS7NfALs6WXf-`iy7>cNmuR-XRU&V{o(RMF-))@OktX}L(2207wc5`!hd zq7M0Hc8W#CK;Z8gGL_{1<*2sk=)LIaSyQh@oYuZqbop-4kL=fvTtQihwRdybLz&exs?QYB@AQ#)^ zX6Y_$4v8!>LcC960TI^Lg(Z%Q@16VBG}7{4){j_cyD^jcZe3JWjs*k3$HnGQ4|xAG zM#>34K)%WFZlUC=k1@ za^cFl^`LQY)ur9F{Q=BR=)hW@Rc3;ZiSVK2&kCe%)$%>=@I}ZCE0|I%rdG zp8R}~yOGYIt3bH9g@7Cp?ZDdDN^?Q73Arp#f!2}VW}w1)tFh{?1}{pwqfe9b zTUDpKB5aL>-sxJ7-^_r2)!$#Nx4kn*XREZj1-Pxf(sqhS3U5Gm%gn5m`eCKg&fw+2R z>1i6iBH7KmJ+`;D>?-#MZ$yB%WmmcI@_7YVxx3~`q_{+WGZ#XC+|%|d*MB@nez)aj z(P*AmWECjsr?I&e`5FN44J@r{Co_6vxTQMJrV3ZA)@58LH=klO!k)<06D=gX{w63pe_0(}C z6g){N8(xv2p7|Yrvw-w@rW{6)D*=iO%^+Xo^Yqrw?+KbsxJ)skBmrtTD5DXMiL7Lj z>8eUBCgE~g4gvs`r+A<%q-+=f#HF|nd?Ji5Ucp+mc}Y}4!c7iP0Dw1SoF;exv3V<` zJP0bVQcIe;C`uYdE;Fa9H9PpJHXBlQ69kG3msM-)QDj(ut)>%pUWc7ljD1R2tFzk@ zulIu>&632XVlS)IFnf>#vDKd!FBVrom<{chhsl)W@+HtgNr&dyOOqs|Uhde-93(1J zygNAM>Rg~ire0clT%cG<5D|jp0RUBK!Fd-`>ak^$9Hb|j*-C&9O7eY@)>e4|b}gSN z41yT@S%uwyeS1^JE!Nn+`0QmfT$#}=q1PsWP-{2dC_#X-0T*MNDPe)mWK~G^4h^l_ zhs=igu?SsdeLM)7g<4iMu31AetLsZs^ZyR%H=!bas7fMeg6+Da$l-}Kp>keaT9&&X zWhtNhr6RUGR8E`2DibsxgTS4Mo8#_fy7|+HON&E)ToS0@15dIs)(_5ipgZuo*Jw3% zpxVr-fnaMi9IRDLrKVFtoNI8>?&fh7JYsKPTN07?H?+Sn!i1J`KbA3xC`NQoLPtM}Z2U-wHv#{Z7K zy;&1~hvjP%DvX_BKoblH4AD(<(o|`-(AjzvSgE!Kac@a4tKif=c+AHFRy#Y+UG3MH zzawc%nHe@}b-C{gTti!@^8&6hcX7URg0c0Fl-)&yrQaUDEo8QZ7%WI_LY3GiK;c#D zLjK07UobCNsd;HStO?8XNcGWWq8p%bkjNx|H5jkP7LA8lMe3uhIPBa3$;Swaj#26g zri2-z9O}1il7O)1`YD%^8W@S(HtWKmsgSeWkYOp^W;v3#9k0yytyXJ3ETiMf{V^HA zrBc`#ilpi4uUZkFrR4Vv3v9Bc@;nhyZX;St$3`2*1 zzKv{h5O`10<7A#6US57YyEqO?Cv)Nteh-4G?`c_S?qM6$e_6n;YNTy}pMF=A=bhIT zzHor*)#n=Xg)LrJ0NYn>&>uh-_x=6#m*HQ~tfKiFw$4~o-T0ST6Vx{0oq?U6U7cKp z>c);!5oeMo_>g;3c6Xol=9JyeJ?>6_S@H6erT67M_!bo-o9;l5NCPe+J#%tdocGx2 z&LU{&G0PxjAljjfBq)@uiOqq;x_k`-G796|U4~!~+go%4+^`(o0JO$m1=%`v2~sGF;ampqKAJq^Z-XBzWyFs@pdqe1)Y1bpi^Z*XEQA5JOT?kvn=qKzVAKY ziwnl&&e|#N>>Q%>rpa8I>c9%Y5x2 zRimtLkao55IzZ&6R77R6#Rn~aHNutyI^W&_HKG#6H@`cS48ZHdn5HDNtP zQ?3U5@1xQL=r))6UwpsT^glV0MVayGe%GIvj2-4i`RpH8P)Lzhn z_nHgV4|3?jy<0R*_QM)~Sp)KWyXi`|3~?=|T#tj7}Z+Ejm zos5ytLXE6)b=_8j^PD|W(@a?#q*qCWF!>`^5j^C!vzr}LpAEl%WiJ&B^uR?}4phnv zAhP~;%u(v*{eb1Ik+59Lu_UAHg^iQ1+gi12)@C%> zauMBiX1JL|-~fdmratk(fSOH5Q!M6DrdKvbYKv`WviI9$|FpNyW90JCD90d4Ljg54fn!b*wO`m8t$jY_78#9modqW>SZS8 zh)QeGcoSi2EI#7nG@*9c>?aFXMHu|sRlxg-7$etI`q|Bu0-~&!p!spoZcnGvkQgdM zE{5&ImXhta-J_G!%ahigp0?k!1f?t|$bRl|-VGQ#nSvfYh63%VP8m!ERp#mx$p>mm z1O_pcO3;3PrfLlGR8a}l0(vlJ&^Ww=?qvhs9A0)WcY=@ItDn!_U%|)2i;Kh4tM17q zoL#`t+39ijs(W^N31|O;!_$AmFWuAQ9YAU~@@`UtC&2~Kv6;@p;L?G^_{NLfd$Scw zBS;7vW@LykOV diff --git a/rds/base/charts/common/.helmignore b/rds/base/charts/common/.helmignore deleted file mode 100644 index 0e8a0eb..0000000 --- a/rds/base/charts/common/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/rds/base/charts/common/Chart.yaml b/rds/base/charts/common/Chart.yaml deleted file mode 100644 index ffc4965..0000000 --- a/rds/base/charts/common/Chart.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v2 -name: common -description: A Helm chart for Kubernetes -type: library -version: 0.1.2 -appVersion: "1.16.0" -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS \ No newline at end of file diff --git a/rds/base/charts/common/templates/_deployment.tpl b/rds/base/charts/common/templates/_deployment.tpl deleted file mode 100644 index 753c34f..0000000 --- a/rds/base/charts/common/templates/_deployment.tpl +++ /dev/null @@ -1,65 +0,0 @@ - -{{/* -Return the proper image name -{{ include "common.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} -*/}} -{{- define "common.image" -}} -{{- $registryName := .imageRoot.registry -}} -{{- $repositoryName := .imageRoot.repository -}} -{{- if .repository -}} -{{- $repositoryName = .repository -}} -{{- end -}} -{{- $tag := .imageRoot.tag | toString -}} -{{- if .global }} - {{- if .global.image }} - {{- if .global.image.registry }} - {{- $registryName = .global.image.registry -}} - {{- end -}} - {{- if .global.image.tag -}} - {{- $tag = .global.image.tag | toString -}} - {{- end -}} - {{- end -}} -{{- end -}} -{{- if $registryName }} -{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} -{{- else -}} -{{- printf "%s:%s" $repositoryName $tag -}} -{{- end -}} -{{- end -}} - -{{- define "common.ingressAnnotations" -}} -{{- $annotations := dict -}} -{{- with .Values.ingress.annotations }} - {{- $annotations = . -}} -{{- end -}} -{{- if .Values.global }} - {{- if .Values.global.ingress }} - {{- if .Values.global.ingress.annotations }} - {{- $annotations = mustMergeOverwrite .Values.global.ingress.annotations $annotations -}} - {{- end -}} - {{- end -}} -{{- end -}} -{{- toYaml $annotations -}} -{{- end -}} - - -{{- define "common.tlsSecretName" -}} -{{- $secretName := "" -}} -{{- if .Values.ingress }} - {{- if .Values.ingress.tls }} - {{- if .Values.ingress.tls.secretName }} - {{- $secretName = .Values.ingress.tls.secretName -}} - {{- end -}} - {{- end -}} -{{- end -}} -{{- if .Values.global }} - {{- if .Values.global.ingress }} - {{- if .Values.global.ingress.tls }} - {{- if .Values.global.ingress.tls.secretName }} - {{- $secretName = .Values.global.ingress.tls.secretName -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- end -}} -{{- printf "%s" $secretName -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/.helmignore b/rds/base/charts/jaeger/.helmignore deleted file mode 100644 index f0c1319..0000000 --- a/rds/base/charts/jaeger/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/rds/base/charts/jaeger/Chart.yaml b/rds/base/charts/jaeger/Chart.yaml deleted file mode 100644 index d3c301c..0000000 --- a/rds/base/charts/jaeger/Chart.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v1 -appVersion: 1.18.0 -description: A Jaeger Helm chart for Kubernetes -home: https://jaegertracing.io -icon: https://camo.githubusercontent.com/afa87494e0753b4b1f5719a2f35aa5263859dffb/687474703a2f2f6a61656765722e72656164746865646f63732e696f2f656e2f6c61746573742f696d616765732f6a61656765722d766563746f722e737667 -keywords: -- jaeger -- opentracing -- tracing -- instrumentation -maintainers: -- email: david.vonthenen@dell.com - name: dvonthenen -- email: michael.lorant@fairfaxmedia.com.au - name: mikelorant -- email: naseem@transit.app - name: naseemkullah -- email: pavel.nikolov@fairfaxmedia.com.au - name: pavelnikolov -name: jaeger -sources: -- https://hub.docker.com/u/jaegertracing/ -version: 0.34.1 diff --git a/rds/base/charts/jaeger/OWNERS b/rds/base/charts/jaeger/OWNERS deleted file mode 100644 index 49eb268..0000000 --- a/rds/base/charts/jaeger/OWNERS +++ /dev/null @@ -1,10 +0,0 @@ -approvers: -- dvonthenen -- mikelorant -- naseemkullah -- pavelnikolov -reviewers: -- dvonthenen -- mikelorant -- naseemkullah -- pavelnikolov diff --git a/rds/base/charts/jaeger/README.md b/rds/base/charts/jaeger/README.md deleted file mode 100644 index fb67c52..0000000 --- a/rds/base/charts/jaeger/README.md +++ /dev/null @@ -1,380 +0,0 @@ -# Jaeger - -[Jaeger](https://www.jaegertracing.io/) is a distributed tracing system. - -## Introduction - -This chart adds all components required to run Jaeger as described in the [jaeger-kubernetes](https://github.com/jaegertracing/jaeger-kubernetes) GitHub page for a production-like deployment. The chart default will deploy a new Cassandra cluster (using the [cassandra chart](https://github.com/kubernetes/charts/tree/master/incubator/cassandra)), but also supports using an existing Cassandra cluster, deploying a new ElasticSearch cluster (using the [elasticsearch chart](https://github.com/elastic/helm-charts/tree/master/elasticsearch)), or connecting to an existing ElasticSearch cluster. Once the storage backend is available, the chart will deploy jaeger-agent as a DaemonSet and deploy the jaeger-collector and jaeger-query components as Deployments. - -## Installing the Chart - -Add the Jaeger Tracing Helm repository: - -```bash -helm repo add jaegertracing https://jaegertracing.github.io/helm-charts -``` - -To install the chart with the release name `jaeger`, run the following command: - -```bash -helm install jaeger jaegertracing/jaeger -``` - -By default, the chart deploys the following: - -- Jaeger Agent DaemonSet -- Jaeger Collector Deployment -- Jaeger Query (UI) Deployment -- Cassandra StatefulSet - -![Jaeger with Default components](https://www.jaegertracing.io/img/architecture-v1.png) - -IMPORTANT NOTE: For testing purposes, the footprint for Cassandra can be reduced significantly in the event resources become constrained (such as running on your local laptop or in a Vagrant environment). You can override the resources required run running this command: - -```bash -helm install jaeger jaegertracing/jaeger \ - --set cassandra.config.max_heap_size=1024M \ - --set cassandra.config.heap_new_size=256M \ - --set cassandra.resources.requests.memory=2048Mi \ - --set cassandra.resources.requests.cpu=0.4 \ - --set cassandra.resources.limits.memory=2048Mi \ - --set cassandra.resources.limits.cpu=0.4 -``` - -## Installing the Chart using an Existing Cassandra Cluster - -If you already have an existing running Cassandra cluster, you can configure the chart as follows to use it as your backing store (make sure you replace ``, ``, etc with your values): - -```bash -helm install jaeger jaegertracing/jaeger \ - --set provisionDataStore.cassandra=false \ - --set storage.cassandra.host= \ - --set storage.cassandra.port= \ - --set storage.cassandra.user= \ - --set storage.cassandra.password= -``` - -## Installing the Chart using an Existing Cassandra Cluster with TLS - -If you already have an existing running Cassandra cluster with TLS, you can configure the chart as follows to use it as your backing store: - -Content of the `values.yaml` file: - -```YAML -storage: - type: cassandra - cassandra: - host: - port: - user: - password: - tls: - enabled: true - secretName: cassandra-tls-secret - -provisionDataStore: - cassandra: false -``` - -Content of the `jaeger-tls-cassandra-secret.yaml` file: - -```YAML -apiVersion: v1 -kind: Secret -metadata: - name: cassandra-tls-secret -data: - commonName: - ca-cert.pem: | - -----BEGIN CERTIFICATE----- - - -----END CERTIFICATE----- - client-cert.pem: | - -----BEGIN CERTIFICATE----- - - -----END CERTIFICATE----- - client-key.pem: | - -----BEGIN RSA PRIVATE KEY----- - -----END RSA PRIVATE KEY----- - cqlshrc: | - [ssl] - certfile = ~/.cassandra/ca-cert.pem - userkey = ~/.cassandra/client-key.pem - usercert = ~/.cassandra/client-cert.pem - -``` - -```bash -kubectl apply -f jaeger-tls-cassandra-secret.yaml -helm install jaeger jaegertracing/jaeger --values values.yaml -``` - -## Installing the Chart using a New ElasticSearch Cluster - -To install the chart with the release name `jaeger` using a new ElasticSearch cluster instead of Cassandra (default), run the following command: - -```bash -helm install jaeger jaegertracing/jaeger \ - --set provisionDataStore.cassandra=false \ - --set provisionDataStore.elasticsearch=true \ - --set storage.type=elasticsearch -``` - -## Installing the Chart using an Existing Elasticsearch Cluster - -A release can be configured as follows to use an existing ElasticSearch cluster as it as the storage backend: - -```bash -helm install jaeger jaegertracing/jaeger \ - --set provisionDataStore.cassandra=false \ - --set storage.type=elasticsearch \ - --set storage.elasticsearch.host= \ - --set storage.elasticsearch.port= \ - --set storage.elasticsearch.user= \ - --set storage.elasticsearch.password= -``` - -## Installing the Chart using an Existing ElasticSearch Cluster with TLS - -If you already have an existing running ElasticSearch cluster with TLS, you can configure the chart as follows to use it as your backing store: - -Content of the `jaeger-values.yaml` file: - -```YAML -storage: - type: elasticsearch - elasticsearch: - host: - port: - scheme: https - user: - password: -provisionDataStore: - cassandra: false - elasticsearch: false -query: - cmdlineParams: - es.tls.ca: "/tls/es.pem" - extraConfigmapMounts: - - name: jaeger-tls - mountPath: /tls - subPath: "" - configMap: jaeger-tls - readOnly: true -collector: - cmdlineParams: - es.tls.ca: "/tls/es.pem" - extraConfigmapMounts: - - name: jaeger-tls - mountPath: /tls - subPath: "" - configMap: jaeger-tls - readOnly: true -spark: - enabled: true - cmdlineParams: - java.opts: "-Djavax.net.ssl.trustStore=/tls/trust.store -Djavax.net.ssl.trustStorePassword=changeit" - extraConfigmapMounts: - - name: jaeger-tls - mountPath: /tls - subPath: "" - configMap: jaeger-tls - readOnly: true - -``` - -Generate configmap jaeger-tls: - -```bash -keytool -import -trustcacerts -keystore trust.store -storepass changeit -alias es-root -file es.pem -kubectl create configmap jaeger-tls --from-file=trust.store --from-file=es.pem -``` - -```bash -helm install jaeger jaegertracing/jaeger --values jaeger-values.yaml -``` - -## Installing the Chart with Ingester enabled - -The architecture illustrated below can be achieved by enabling the ingester component. When enabled, Cassandra or Elasticsearch (depending on the configured values) now becomes the ingester's storage backend, whereas Kafka becomes the storage backend of the collector service. - -![Jaeger with Ingester](https://www.jaegertracing.io/img/architecture-v2.png) - -## Installing the Chart with Ingester enabled using a New Kafka Cluster - -To provision a new Kafka cluster along with jaeger-ingester: - -```bash -helm install jaeger jaegertracing/jaeger \ - --set provisionDataStore.kafka=true \ - --set ingester.enabled=true -``` - -## Installing the Chart with Ingester using an existing Kafka Cluster - -You can use an exisiting Kafka cluster with jaeger too - -```bash -helm install jaeger jaegertracing/jaeger \ - --set ingester.enabled=true \ - --set storage.kafka.brokers={,} \ - --set storage.kafka.topic= -``` - -## Configuration - -The following table lists the configurable parameters of the Jaeger chart and their default values. - -| Parameter | Description | Default | -|-----------|-------------|---------| -| `.cmdlineParams` | Additional command line parameters | `nil` | -| `.extraEnv` | Additional environment variables | [] | -| `.nodeSelector` | Node selector | {} | -| `.tolerations` | Node tolerations | [] | -| `.affinity` | Affinity | {} | -| `.podAnnotations` | Pod annotations | `nil` | -| `.podSecurityContext` | Pod security context | {} | -| `.securityContext` | Container security context | {} | -| `.serviceAccount.create` | Create service account | `true` | -| `.serviceAccount.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `nil` | -| `.serviceMonitor.enabled` | Create serviceMonitor | `false` | -| `.serviceMonitor.additionalLabels` | Add additional labels to serviceMonitor | {} | -| `agent.annotations` | Annotations for Agent | `nil` | -| `agent.dnsPolicy` | Configure DNS policy for agents | `ClusterFirst` | -| `agent.service.annotations` | Annotations for Agent SVC | `nil` | -| `agent.service.binaryPort` | jaeger.thrift over binary thrift | `6832` | -| `agent.service.compactPort` | jaeger.thrift over compact thrift| `6831` | -| `agent.image` | Image for Jaeger Agent | `jaegertracing/jaeger-agent` | -| `agent.imagePullSecrets` | Secret to pull the Image for Jaeger Agent | `[]` | -| `agent.pullPolicy` | Agent image pullPolicy | `IfNotPresent` | -| `agent.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `agent.service.annotations` | Annotations for Agent SVC | `nil` | -| `agent.service.binaryPort` | jaeger.thrift over binary thrift | `6832` | -| `agent.service.compactPort` | jaeger.thrift over compact thrift | `6831` | -| `agent.service.zipkinThriftPort` | zipkin.thrift over compact thrift | `5775` | -| `agent.extraConfigmapMounts` | Additional agent configMap mounts | `[]` | -| `agent.extraSecretMounts` | Additional agent secret mounts | `[]` | -| `agent.useHostNetwork` | Enable hostNetwork for agents | `false` | -| `agent.priorityClassName` | Priority class name for the agent pods | `nil` | -| `collector.autoscaling.enabled` | Enable horizontal pod autoscaling | `false` | -| `collector.autoscaling.minReplicas` | Minimum replicas | 2 | -| `collector.autoscaling.maxReplicas` | Maximum replicas | 10 | -| `collector.autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization | 80 | -| `collector.autoscaling.targetMemoryUtilizationPercentage` | Target memory utilization | `nil` | -| `collector.image` | Image for jaeger collector | `jaegertracing/jaeger-collector` | -| `collector.imagePullSecrets` | Secret to pull the Image for Jaeger Collector | `[]` | -| `collector.pullPolicy` | Collector image pullPolicy | `IfNotPresent` | -| `collector.service.annotations` | Annotations for Collector SVC | `nil` | -| `collector.service.grpc.port` | Jaeger Agent port for model.proto | `14250` | -| `collector.service.http.port` | Client port for HTTP thrift | `14268` | -| `collector.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `collector.service.type` | Service type | `ClusterIP` | -| `collector.service.zipkin.port` | Zipkin port for JSON/thrift HTTP | `nil` | -| `collector.extraConfigmapMounts` | Additional collector configMap mounts | `[]` | -| `collector.extraSecretMounts` | Additional collector secret mounts | `[]` | -| `collector.samplingConfig` | [Sampling strategies json file](https://www.jaegertracing.io/docs/latest/sampling/#collector-sampling-configuration) | `nil` | -| `collector.priorityClassName` | Priority class name for the collector pods | `nil` | -| `ingester.enabled` | Enable ingester component, collectors will write to Kafka | `false` | -| `ingester.autoscaling.enabled` | Enable horizontal pod autoscaling | `false` | -| `ingester.autoscaling.minReplicas` | Minimum replicas | 2 | -| `ingester.autoscaling.maxReplicas` | Maximum replicas | 10 | -| `ingester.autoscaling.targetCPUUtilizationPercentage` | Target CPU utilization | 80 | -| `ingester.autoscaling.targetMemoryUtilizationPercentage` | Target memory utilization | `nil` | -| `ingester.service.annotations` | Annotations for Ingester SVC | `nil` | -| `ingester.image` | Image for jaeger Ingester | `jaegertracing/jaeger-ingester` | -| `ingester.imagePullSecrets` | Secret to pull the Image for Jaeger Ingester | `[]` | -| `ingester.pullPolicy` | Ingester image pullPolicy | `IfNotPresent` | -| `ingester.service.annotations` | Annotations for Ingester SVC | `nil` | -| `ingester.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `ingester.service.type` | Service type | `ClusterIP` | -| `ingester.extraConfigmapMounts` | Additional Ingester configMap mounts | `[]` | -| `ingester.extraSecretMounts` | Additional Ingester secret mounts | `[]` | -| `fullnameOverride` | Override full name | `nil` | -| `hotrod.enabled` | Enables the Hotrod demo app | `false` | -| `hotrod.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `hotrod.image.pullSecrets` | Secret to pull the Image for the Hotrod demo app | `[]` | -| `nameOverride` | Override name| `nil` | -| `provisionDataStore.cassandra` | Provision Cassandra Data Store| `true` | -| `provisionDataStore.elasticsearch` | Provision Elasticsearch Data Store | `false` | -| `provisionDataStore.kafka` | Provision Kafka Data Store | `false` | -| `query.agentSidecar.enabled` | Enable agent sidecare for query deployment | `true` | -| `query.config` | [UI Config json file](https://www.jaegertracing.io/docs/latest/frontend-ui/) | `nil` | -| `query.service.annotations` | Annotations for Query SVC | `nil` | -| `query.image` | Image for Jaeger Query UI | `jaegertracing/jaeger-query` | -| `query.imagePullSecrets` | Secret to pull the Image for Jaeger Query UI | `[]` | -| `query.ingress.enabled` | Allow external traffic access | `false` | -| `query.ingress.annotations` | Configure annotations for Ingress | `{}` | -| `query.ingress.hosts` | Configure host for Ingress | `nil` | -| `query.ingress.tls` | Configure tls for Ingress | `nil` | -| `query.pullPolicy` | Query UI image pullPolicy | `IfNotPresent` | -| `query.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` | -| `query.service.nodePort` | Specific node port to use when type is NodePort | `nil` | -| `query.service.port` | External accessible port | `80` | -| `query.service.type` | Service type | `ClusterIP` | -| `query.basePath` | Base path of Query UI, used for ingress as well (if it is enabled) | `/` | -| `query.extraConfigmapMounts` | Additional query configMap mounts | `[]` | -| `query.priorityClassName` | Priority class name for the Query UI pods | `nil` | -| `schema.annotations` | Annotations for the schema job| `nil` | -| `schema.extraConfigmapMounts` | Additional cassandra schema job configMap mounts | `[]` | -| `schema.image` | Image to setup cassandra schema | `jaegertracing/jaeger-cassandra-schema` | -| `schema.imagePullSecrets` | Secret to pull the Image for the Cassandra schema setup job | `[]` | -| `schema.pullPolicy` | Schema image pullPolicy | `IfNotPresent` | -| `schema.activeDeadlineSeconds` | Deadline in seconds for cassandra schema creation job to complete | `120` | -| `schema.keyspace` | Set explicit keyspace name | `nil` | -| `spark.enabled` | Enables the dependencies job| `false` | -| `spark.image` | Image for the dependencies job| `jaegertracing/spark-dependencies` | -| `spark.imagePullSecrets` | Secret to pull the Image for the Spark dependencies job | `[]` | -| `spark.pullPolicy` | Image pull policy of the deps image | `Always` | -| `spark.schedule` | Schedule of the cron job | `"49 23 * * *"` | -| `spark.successfulJobsHistoryLimit` | Cron job successfulJobsHistoryLimit | `5` | -| `spark.failedJobsHistoryLimit` | Cron job failedJobsHistoryLimit | `5` | -| `spark.tag` | Tag of the dependencies job image | `latest` | -| `spark.extraConfigmapMounts` | Additional spark configMap mounts | `[]` | -| `spark.extraSecretMounts` | Additional spark secret mounts | `[]` | -| `esIndexCleaner.enabled` | Enables the ElasticSearch indices cleanup job| `false` | -| `esIndexCleaner.image` | Image for the ElasticSearch indices cleanup job| `jaegertracing/jaeger-es-index-cleaner` | -| `esIndexCleaner.imagePullSecrets` | Secret to pull the Image for the ElasticSearch indices cleanup job | `[]` | -| `esIndexCleaner.pullPolicy` | Image pull policy of the ES cleanup image | `Always` | -| `esIndexCleaner.numberOfDays` | ElasticSearch indices older than this number (Number of days) would be deleted by the CronJob | `7` -| `esIndexCleaner.schedule` | Schedule of the cron job | `"55 23 * * *"` | -| `esIndexCleaner.successfulJobsHistoryLimit` | successfulJobsHistoryLimit for ElasticSearch indices cleanup CronJob | `5` | -| `esIndexCleaner.failedJobsHistoryLimit` | failedJobsHistoryLimit for ElasticSearch indices cleanup CronJob | `5` | -| `esIndexCleaner.tag` | Tag of the dependencies job image | `latest` | -| `esIndexCleaner.extraConfigmapMounts` | Additional esIndexCleaner configMap mounts | `[]` | -| `esIndexCleaner.extraSecretMounts` | Additional esIndexCleaner secret mounts | `[]` | -| `storage.cassandra.env` | Extra cassandra related env vars to be configured on components that talk to cassandra | `cassandra` | -| `storage.cassandra.cmdlineParams` | Extra cassandra related command line options to be configured on components that talk to cassandra | `cassandra` | -| `storage.cassandra.existingSecret` | Name of existing password secret object (for password authentication | `nil` -| `storage.cassandra.host` | Provisioned cassandra host | `cassandra` | -| `storage.cassandra.keyspace` | Schema name for cassandra | `jaeger_v1_test` | -| `storage.cassandra.password` | Provisioned cassandra password (ignored if storage.cassandra.existingSecret set) | `password` | -| `storage.cassandra.port` | Provisioned cassandra port | `9042` | -| `storage.cassandra.tls.enabled` | Provisioned cassandra TLS connection enabled | `false` | -| `storage.cassandra.tls.secretName` | Provisioned cassandra TLS connection existing secret name (possible keys in secret: `ca-cert.pem`, `client-key.pem`, `client-cert.pem`, `cqlshrc`, `commonName`) | `` | -| `storage.cassandra.usePassword` | Use password | `true` | -| `storage.cassandra.user` | Provisioned cassandra username | `user` | -| `storage.elasticsearch.env` | Extra ES related env vars to be configured on components that talk to ES | `nil` | -| `storage.elasticsearch.cmdlineParams` | Extra ES related command line options to be configured on components that talk to ES | `nil` | -| `storage.elasticsearch.existingSecret` | Name of existing password secret object (for password authentication | `nil` | -| `storage.elasticsearch.existingSecretKey` | Key of the declared password secret | `password` | -| `storage.elasticsearch.host` | Provisioned elasticsearch host| `elasticsearch` | -| `storage.elasticsearch.password` | Provisioned elasticsearch password (ignored if storage.elasticsearch.existingSecret set | `changeme` | -| `storage.elasticsearch.port` | Provisioned elasticsearch port| `9200` | -| `storage.elasticsearch.scheme` | Provisioned elasticsearch scheme | `http` | -| `storage.elasticsearch.usePassword` | Use password | `true` | -| `storage.elasticsearch.user` | Provisioned elasticsearch user| `elastic` | -| `storage.elasticsearch.indexPrefix` | Index Prefix for elasticsearch | `nil` | -| `storage.elasticsearch.nodesWanOnly` | Only access specified es host | `false` | -| `storage.kafka.authentication` | Authentication type used to authenticate with kafka cluster. e.g. none, kerberos, tls | `none` | -| `storage.kafka.brokers` | Broker List for Kafka with port | `kafka:9092` | -| `storage.kafka.topic` | Topic name for Kafka | `jaeger_v1_test` | -| `storage.type` | Storage type (ES or Cassandra)| `cassandra` | -| `tag` | Image tag/version | `1.18.0` | - -For more information about some of the tunable parameters that Cassandra provides, please visit the helm chart for [cassandra](https://github.com/kubernetes/charts/tree/master/incubator/cassandra) and the official [website](http://cassandra.apache.org/) at apache.org. - -For more information about some of the tunable parameters that Jaeger provides, please visit the official [Jaeger repo](https://github.com/uber/jaeger) at GitHub.com. - -### Pending enhancements - -- [ ] Sidecar deployment support diff --git a/rds/base/charts/jaeger/charts/cassandra-0.15.2.tgz b/rds/base/charts/jaeger/charts/cassandra-0.15.2.tgz deleted file mode 100644 index 7bd13bcbee38875e48afd146e0df3ac4e5f3bc7f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11697 zcmV;iEl$!OiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYccic9TC_aDlQ`E2J-Pl=?{m{c!pP%koMN&MP#FAE$lbua+ z)o2pk4U0`M04TY~)_(STPyk7g&3@=H&djcvb7D0K6bgkxp{h_og+xk{M1r&rCq$@V zMyBzfp84r?I-T9^ZTz>>>D2%2cDvhu>Td7sY`^aAY;EuUsngx+Zg2ewI?s(r)00U> z#Gg7(ZmZt8f0Bo!>?bND<4GTGyBz_f$ryf8; zbSHn{$@ss@f>XjpFcOSLQtJ7z;c#Ha@mJe2K_Cm~H0{$b@~8!?pa z4QZNS$=JtN8X;*~@pa92sNX;9XD7fWuHl<$i#`KydWEj(^4@zXzjB>$52F`g2 z;wJF`xQ8*3mNQO95YZ7!XtW8^e8#Vc8~p$7tN&BfkW^_bTYjslQmeHIcM}#) zv}U7`ln~7lGG(FBJoKC~%7=lLB^CpCsU}pTL$X-C0xt4~k}QrlQ75T22AVm6*}i}- zzX{=lbFI991FdYCiU8o{IPC#X;Na&=-2;+DL`1-o9M0PxjyLs3_*XbfX>zGZc=HNB zBB#4(^fehY&xIkC@*R(8A1)|~eils8vn14GBiY|*AG)2l3`hGgXA%(9>VSg&o>8eJ zDu*$fG9@22GeSO1Ge!LzA~GAiV+osPQ<%~z7c&$J5xu1`Pqk*Lb<*v(-(j0QI6Qw3 zAs19GsF(^KWucx_y51XGZ@XI0MOdR4Xik)hd_+k|lQt3Igx%7}k%hgWoKNAt%5karRV4|k6SM<0KpYCyZa$@%J7uZhpVf!t!Z^AU|Ll1u#Vy`TU z<2E75m^#xepY14WASHrKsiH!{kjDJ3zZOBto^Ms?P=RfKmFllnK1}yFHsFG49hxQ) zjbKVX!i16(c}@>hx82j)yEP$9|LT>nLPGDHO53_p1=y2%!&7Q{BHKKbS6M>;^3yxh z0n;@-09J@zM_lXa{rqwlXO!{D@nm9mp}vsHcq&p5jI_7(k)QwA_QGB zlQh!sqR`Uj=um&uh3t!q1AJ3Mu@9GQn&udJpa=X~4|qcd`lw}UT``~?2;(>pjATUo>s zNMnK$6MLrL_hGlY+v}S7SDSb+VtR4mw^RrgQE6G}EdPxHp<2-+O$3z_9!Gu9tZLm2&f6`oK<5u>9e_lUpt$6}_;h}D zbbWGu->R+X36Cg98q-j55x{Z86omR6E(y4hk|@&JNnS|HiBxOqYYd>X;OmBb14Azm zTCcPK&040vUpjB}yD;Wi6pT3^#}qkkd_#R*Fy%b%gZ{rC4Y5ZDQN%Q05^LmKjd~qC z3wuJ(lUqjb+IL*sXcOX&sfo{rA84p#+kx8lQXU<+db{QQ8X_?n()c-XFaWXnAMwux zE&H)noV1`dN6*F{4!Z3@*RB4=#n6xjy!*_+! zG$kM3C)N=dQ!@)TV9Jt%@?Fo;dE^n}scmtGnTD6L9pV4FY; z9428*6HN^o*~z8hj-m?+bFVvTZi7)-cSkWi&12M$`P4H%IPf8`lWGpQgY zQli!gv9{z{qPSI40{vFnnXhKR3IiIutlKy>P2_B@nc+JU-ef6+f+rvNuxe_|G0T`K ztxIT;Zd}mqkg&uXB8-N4WX8+-Av7i;OW*?^$^hQ!&J3wm#&p|8aE-W_5_CCL+tno$ z83yA_WNp2eT9CR)A8zPOrX-~O;;*hz4Fym7(CWZz_*VbdT2Q*@mfmuT*IYbybvyn@ zv@&bf*i22hV1F}~nc`^7UvAma*K@1K$kbLmM8A;ay4w*?s4Yd4TP8Tp&QgiPDvV46 zG9`cG3AvNT$H!wdNm!zhE1Y}Ay(gJMqtYE3REo*C51n8)=$HX<791kRnQqvK3R`2X zLEp$E8EaOiAC({nVr-|sZ2+|o+sL90YSq(oDcV#Jt!$?46OExJZzyO)6RnO(2qy+* z-)@W?{Cs(Ras2k=>=b*BI%^*?=~E(=-}TTDn%nV~aHSCsj%D6O%N%mc+;CKB#4jz1 zojP?yi}7QE)q!)t;C7@aXk3=W3L$NA!Egp|&(7Zdczk_ue*WXh;lb6(+3EG+#qrVc z>D9@>kC&T3BoG%~@Imqf?H0tvsA4$-SB0u^rS=WdM^q}i?4!Ag#tgALeetO?Zpw!65>%Z|j^YO)qzH@UI=n1zhMIw*vg3V_Tm5!>n1we~m8Me7N~0h1uGb}| zSkPc7n4-J{cx^!lFaM)a6S2g6#}ihl*mH%znQxAIX}EGjuL)DVRA#cDdn)I}M;{D^ zB5K015G1{z6ZEVN-iMtX^m2T-ot~x2c){H%mLsuInK~QQS+&tHmo{n>b43*orI2wy z8$sl}c!#^z_;v%_g1DH^6$BE;{7$0ZMRCAAZ{VnC7#F!-k8_cwSMNh2Y2TKUGKP@q zS;9i1uxJG}Ph*}-tB^=v7nb-IteEKAUyu)#arSQaI>iT5@N^Eye5aSThbW&DHR(g! zeXs4`vm~D7S{Q;oEVgV6B`dSD+|SV@8&WexbBvs--iC{fVKQH`h=xR9>xL=kKlZie zBo&sqUD!j(r_{%8HFQybY^Ov`{*gDvOV>=UF3R@l+12r7pgyW+YGXzG&(2PFtG55U zy}Pshb^rHEJmm^=_#Z#wYB!{I(}zZI%Locy`1A>apNvP&YX9gH4Z`1JxW5Ozd~4H# zYf+~4jib{`W2B4(pJMC{OSFU&xm%#`l`UVP7xm$d8}I95+xJ{Yxv^>z8X5y;qV>Qj z*G5+&6-h#B;)f6d`t6}cxR?cS#kDqYM?{1W4$e;u{)(GA+9c}lb+&tGmsAk$dp@e~ zp^CANp9AuJ-3_!GkPa6#rbN=HB!a-|)TF~u(^9cf`=v4mF`7M}IMIxdMAh`eL75dHl%UNmFuvE$3 zK*vv?d~J%_6+%Mmlt=WO3)L!`wJJ`aW~uIh=UeScgS${ z(=kno#Nu$@DwI`NK=s^wHMefgMmv!Vc=yiv?iefQPQW2HOz`B7czOz5>TN;D# z_gGHgMUH{_OB2dNa?@DSD$Rf7B>IlTdg6%1bO+EYO&?AaOvwxsxuHN{MDJkAl1x!! zCF=2Y;lasyzUb#JyufOn06!DlqSB@fb_%C$AHH!ZCU3(v>2AbnE~(&h2RPbY`R z*C*$-VOqPaDBAwYGhKm0N_orx`hmr{R$O*Qx7G(e@32+fn zv%x3mElq5ISIni{^pJLUERNCbh|w5KVuVrzS*jJaa;qnRBd35ysaOZJ@q|v=O^_TF zf+-tMl$koYZa|_BnZ)ktW?jfI)&pcVOY^WTCLzp(poxlSxvScl*v`&Zuyi|051BN7 z23|hD@9+PSt-Qrgll^x+p|NJFK&8(T3cSMp>+SSj*X%$2_gDMxOFW-GwZDa1Htpk# z7_pe@#eILO$r4UzAHHqh-+Q{0cl5eXJ1A4SBYlZ{sfK#h_n)$I!*V95_ND zn9o67GLJfe&!9w>gs{7Xf3oRiHX5;y(DF-QdS%sr8w?N4Mj0vE&|1?Be$PnEMvO*U zRwM3#_cJxnvAoi4=zd5T(vW1*%AX&K%}Q%bG8#uFiV6LTCP)fB!Y_w2q=q#-F%lxB z;j2K~GgkN;Accm7gtJ?Dst}pzf=Bx|iv@P?+rKxC{ZF3?K6}ZMFwUYyR?@3Q5REQXW0V@~mi=SS^l1drzzu)2 zSYP{TTK~=FTifo@KmA0|O8@Wc`uU&NonGhb`u`=K+Uzq!@0t-PEcm>Dz{s)}EQ#pHO?Z(Li=;fAEzc|CV(y#IY?(comtpDj#iB6EmZMfp}x`iSWC5H*MGy8@l zO&2!hG*iS%plDxM!wUWvU?r3thCZ}3f}-Zrz#f}HF=SC5EzOeg5hYQ~5?X}pb$cBT-~%6C*^U_k<&ES1 zZsm&!aVUo^f967B@<$Vm|CLPRf?J%TImzm68Zsi*MVMdmy$OqTip(!o3kRubU3=j+ z56*U_i^lxMr0GVblXia+2h;WvUjfF7#(#`UssiA!CHXu4bzZ>dDQZ-byly-tR z>UFhvL-$Hvwg_7?!Y}9C06v43e~E%_uL+2C9lEbEj>*dH9J~#FZVI)T@0MY^dt4&qdw#OvfrqOmi4yffdB0f)&5f>y7nnAWT62layL zS%vyD)hf*K$5c@CfXe1l7)09Fx<%t>0CNnDi$0tr3yK&8tQo!)Ypd0xW!PDH{ddK% zz9=-5RXpV}AJ2Z!IJK(L<`XUzcBWB=SQXWcXRoy2MxH-dXf^-&M=Sr!?LRRj;j>%^ zvC{v$Q}_Sw_FjLr|Gvnxmi@QVJ#&BW)h-e;=2-QN!}?ZPlTIBx#@Y(<8M&6B6*L-J zbDPHvhE`F=HMF$BI=?#Sl*H-POh5coiS-X|-k=C8D0{(U`WP!WD6QOoE@Fx-rg*y% zNg1A%lG=_z8^($M{iT)iNVYZs|82*7j3sWV7~@*Z(i_)E1@MRRfx3tz#8Gyd!CSpeLrN{kDchaZmH?M8HoX=ORh=#xaR9<&pt}(kGplz%p z%XG0~)1~4MLjTW?4rv}loE80;7d=g*+bn+msrInHK97Hz}-F%|MQDH%iK1PwNKZTiC@}&eY7g)xQXjWA?CK6=eDbLRmWGHSaG{u0=D{IzC?ui z!HYhe@`M&Q%{Z~j^CxMXE6Qq1dVZwZb?TM-J5#Cz3(frxl_S;wiij~)=R9A4>+tZv zOA$Ne?APS5S)%Y7yBzZCPNy>m*}lx{s908Oben2)of;peAKe;Vyg;W`!@Mju+<%Xq z8cx_3p3Pf+&|{7)52#!85zj3yK%u+aS#jENDHdy0Z#4RBIlP{(iZ8yZqPwco$ol4$XQG54W* zM~J(yxax%EAC`=RkPFJql|pqT!vguLYdGfVq7}SG_xc?y%|_qawF^sdyJ1z&m6H#A zh{e|*0alsYU2n>?s*Nprld*#2}(I`Y|a!6kjb#{K_r;rs`9@rqdFr9sGZ zbQd&@Sx97)^6g$Lo?DL%*Pm9;#@4@^iu1RkHdw3GLXOc|4FInPf5#PyK9Hs>eWP`^ z_p&9l{9LS&ZyNS^s{jw0g3&A9fyRd1Y71L~T2y;INXJdZQ8r%9&|$Xf7u0BZb0KWz zMdeyg2Y~awF>1(O3f)NF;%m|0-NqQuIiQt$b*ugjFd?Y*i+9aa+_qbBsZ^oaG8K+0 zZ{=N5u_#qVyqQn(kXDC7idfcpLKUUgWy8i`#zldQ4RzLSr(xUJw58EKoICwcIAXAx zAM%vZ@+^Qo@-WQgY{)+ruglX5@Qs{&vkBk$q5glELK(5(lp9yIOn1o!EaA@EOhc#PJ`83`^!)7 zuFuY|F4u)<@9t~@>Nv5hZMY_5DGw|stmmOF+7MjvkjH(vIy`S^Dt9L@Xl7?;XQ%i+ zmo*}PRG41!@TPt$V$OZK5YzdT5cxAvDt$W#*i6MHGOgd{g0vI8j@z+Xs)_BL`N{4- z&_u9p&rh?3v#WVhu{>E^g92-6lu766XH6<=Sv6&fi)66|Rg~)a@=F$cH?N8d8js(( zaOX-k$m*qXsR@lssZ-72oEAF()wUt0}G%U@e&7Z2~U=OgDjDRY@U=BjX8WzxOWzSTsD zMoDIMzF5*m#9Qw1=S_Hl^v)8+Vs{Mg?^mD7v7|N;F)tY0-v&pRZ>AUja=RmwsLy>^Xi6roz8qamE2Ox+Hn@^)1&jVlhdo~%hQvq z!#^)?)Xi`;*LXc;*ILaV{`me9 zw4Zx#RCaq?WXdB4;A->6p4Y7-R$4F(Qm~|fh1XE3VY)9=tmwz;QT~cq*lG`1(w39f zCbaxe|G##zU<-a*rR_Kia0Q8=p>(yYwai=#0j0IOP4%7 z=97gj1XM4&o+|sa!GzB+7BmI_7=CU2-}k4#{wn{?L9p6vexEJe-~ZZr7#q|8J%JBu zkRHbfH6V}Xgc_VDutE*eGG3?|c=LfmIU7`Lt|D&8t&;}|EvnI-t5LP=>NWDXA-6^z zDAZWvp>abMQo8iQW5Mo$F-g`miFspTq83okv~B+Pp(hTK#$c_|h?5%Pc?7 zo{ipvIXLr{J{L`6F5#v7rOvl6R}Ahew46M5T3J`>B9Euj@+y9mi#J}L;Pm#bd;cA& zuv{{i<+$FpxQzb^CN!R!>r7dKo@n9OtINstp7$1slh z(8R#7WW1?G2T_Ko+OdC0SO(O3)5bvf{xfn8X1r5|Mx0@vm~AYPq3y&Nt;p- zvxEj-aCCWnskort1|0I~lqc}h;Uz>&NG}*O)yDrD^vfdlx=Gv<^}Y?{UFv-s49Si6 zZJ?&9_w9ds8}JhmjAs%~j*g`lq=J8-q4EM2QPMW$1pnZj{d{_Sarr+mP_Uf;7sm%j z?~a3M^z3acpa0vPUavm?dpn)4`M1^M<%Y%MTK{|n(xjt*<#~g_U`XV| z(~D)%fSW3$)T>(HCzYQp39}(lTsU^-U@-8!gAr!tFwl&6M1Ks8r0H`=5==}&a^Dvp z*#W2`WWPF%ng(h)wIa+|ZUzRyY(ge&j(2PPRpHtS;QMJN#&o`cjSYC8js?MMZ8TS8 z_$zOtU<<2PZh~afG{#gnwJzip*CO1;#s+kPZZGI~9&%HD)4E<+WK&jD-9{T3LbjQd z8I|qVZ#r9;c85;+EhZt!6s7_;IyA5Z2AIz4r+Ia}OwnQr4?uF0bA>5j()PyWsPf+9 z2A^{9+|U)N52@W>g;l2b8}|Ta`N{JdcG)f;aDI}U^n=FNMuMNx{sR@ zFrE3O0hC|nheXE2_Rj3UG)A=}IQkyg}ESaC=fp_Ih<{B`bR5JE% z&Zqq;St##ter@~+BqmO6n-{*F`Tp1*Z?^L4D<9sq>$uVgX5V3haj6sOgAGBAA!l*gqbczOkg^BrdXb`qnZf_ z^9&Ho#T0l)G^KcDR-WmR*fhB#!&8_zI?@u9Mb)fYINO};a(5FJ(`piB*ub- zdV+Wk;+rNNRL<~P3{Nplwap+8Oa*YcF8A~u_9^{aeQ%|Ytox?ZDP(PB5jG06mQZZO z!ZM#2`y2JXa~4lkF1I)Y1veJ+-ay(iIRyi#bMFKlL6w|k+R%>h7S+n~RjyikT^abk zH0j9e(dYZ0kT&;&A~SpdX98%%RDIHY&jnDE1-b8Oa#wIr9Cn_zI4{O=r)m9ZuQe9A zKjZO(ad`e7dT^`%AxQ+=Z<%I#lZ(2{Yb7&gmMoKv{FcT%#kBTLiu<50jfy3|)b&!q zqbxKdcmj7kiz5&?F=-N+B`V6ZfoPNzhwT!%?(SO_z(FjvQm8v5O~*CHgG%7V0Lu?5 zK@x+&=nX{!(oT-eMt)d9dCkJ!C7)89rggnBqG`-$HX&?5aK)?j(Ih5u%rQ$);hPHJ zuMTtTg2j0dtwtDR%@ndr!oFS+2Jbw`cA$bg7B?(` z%81D$G{9W>`Mt|p1sdN_UzgR8`v~8Uh6B%ATZWY)EXjR-)wQpFKt>m(?m}WJ(nkGS6L8>QN>GkIibuM6nBDd+T|h;XJPnbI)fu zqB0Z=uhW_T-0A>u}fRnsn zWsOHrX;1`+E~(yxmm=e3pkc5Tbi2XMgORG@RfeH90s0Ilh>I>|@7h`g8U_dP9hu1i zu#s)#O81>f7??cvgH7Xl9-NF$xjGkA(nJj!@Uk0R4Tx3nvX{`W#4BO(V~CaG)fi|v zsJC)e&q!xA15-R`!pjy3F!AMsFl@q0H$DesAzt$cIe0yd?;F&YMR;Y?Ar%@kv(m9- zF^Zb+A32Iuyoxx`X1=fDr3+i+Fln0NFyvfGB}fVhy@N1jG*J>haE2DcIwZE;=?&)a zYGQc@FLaCelIqn&(WriiRLNg zBAR5=YsGJ9vS5NHOhrRDu)6e$>1imjv-=Da)J9}BLwXcmM~B^Kz^jPjTp(y4j@QM( zV-a)lss-o{o{pCr5BxCvT)b*ZdcBp$@Ko03L%^cenFgcwy++JTN0@@l=vsF#qz?J2=2NvzK^B&Fs}2UeBXo z6cO0ZHje02eJbA^<-c? zFwcUQtoZKTRxT^MkbHyz2wL0Is5aw;^m>^|DuKl5q`s3`-WTy|C0=D9D zM8X9nkqNaB`1j9(DO$&?_;8kl4y%s9`m)1FmLuV0O3K|C8&Rh0`aV(s8OC1A; z=kMF^jElAK;O22?ZOr^FYc)*iJ`A?svcaYX&_^p{UA){2Jr^4yI1lY@G>SG}7$f=$%=OSN(?V2E5LB1QC*=UKuz+#QflcC=6IbYN4V$xaO@DTm1n;O#+e(F zS-#nwSAkU50Va#x&B(!P?~z(`BVLsgM1!)GKl3}_BSjOtK90DUBFPMD^Ppj{^_+NB z4rTO70TFwHCG>0MX zFi3`yA}=_~VjvjDGa(p7G9oOdQBdtpchH1a{m9fZylmN(Xqo1#DA}N*Dpt9F&#sTF z4!aHNd|y;q%=k~|`(;PxO8)xte82QG-XL$~%k%w;(|yMC{|E5>inD@C@cN>BZ%>QX z_2>h8h}3SLYfQokH7Y*tzD|g7N7JaX5ur_9CUK_Bmbj)r!{EgybI$ud$E!>dxR4<} z!=>4^rg(t`8fO>Z9UPWB)*vUim9Hs>pZdh)0M!`THl}OXR>(Z#{B|6(+@U7I&!|L zvI&%g6BBe13Z9s7sG`Ob9v81=W(RzR?+l^pYU^Uqz{oTpQ}Q>SkUMi9wcs)B!yugB zSX_cvJq7=u5wCUjx^0cYlyET;?bT?kf!Bh4?;2jq_qubuI>B!6xFxc}_j&gFX1orH ztEh`OFeB$RIhyf$qF=5|LBA|;!P3hKqFU~s`wRy^UtV7vzdboS?ZY6GJ|$B5>ungh zcrA5P6nL%erf~cdUB^H1aJ(Wam5otsnvX~2XAGuNT0gYXj0nX>B&>K&w7}l#x7))k zyrHW7u+485uO(UKwZ3Ze%iELfdbJJ(jcB5ETM29gZx1gqT3ec!DW{tcmu1H9Tf1?v zc^s|0FXNH&YKuTWS>D$#gP&Hf@E=t0s@~9#6S5h>r}$TwqE)}6eo&DWHa=hDmEX~v z<66P(i9U*k+a4QqisPIzYfAmkFbD-xl#8fj{Oi1}6$m%s)hPAn@LDPLKf|CGbb`li zLRRt8|18{FDDc7!zcoO^U}xvC!3tHp>rWZg|Ne8WQ1L@mgAFJZhrXllRn|n+q2E${jgj4={W|yvz+BjWIgMx>UZ| zF*P@VEJN%W_D1ck(aV5*b`R*GDO=n%y|Bhp`OCRzdWmgY$IHE*dI4Tfp%(@lUxp;6 z&K(u#zgg!f1RvF6%Bu$`X$rx3c7P9K6-_%Uu{e9_anmIZ;>( zfiHSv4iXM$#c3ZkDbSriZiTnP_)Jv}Ta-{=yvz&gCXvgV3;HpTG~IV@;wV3H_#kK@D!ov`%pNH0N_VXa^J=kM)27m zXLpH&mvl6up<=i66~LdlRB&>%f>kd_c;mf41?YByH$gY(cJ-fcg6$pnfqe(i+u1D( z@9qZOf2ma8?smd(FCzY%y}d1eI|_ULUZ=O~ccWr;-_azTOo_Ph z-18g1l*}fT9<1_&T*N~eXx@^Fd_-pfO`H=zTS3S9rCCmz{~ul=pkSh=@hd=HRJ=H~ zILy(=&$8unZaAwQzxbz^Zguh*avz&hEqL;$UZOng<$(_uSpq|@Cg>eSPw5@TBcNx= z2zuD-cXiRTR7-xnR&qsR=)#o6vHpHTXVO&25{6EH++AhE3{Q)Ij}Z|6@&4@M{X1N2 zbz5z0M}K^4<8xuB18Snb$;xX%Wfm)735*3vCpkQONAML-dCbSNVtdkHZt|~yHhH;# zUO9+$a=;XC!N9Km`Vx`a?`~==_V<2$1<8Kb+$aEHyl=bUr#!_j?!P}h`Tp$U-LEgZ zL14@M`U?E1UMUlE4M+HUyam26r>d}X`#T-*V{XF5_W!$$2wam)ab4**yYB*B z!p9z)f{IGjL#77Blzjn$-ZIH}Vm^Z}!wH=dXjua20eC4bY4#V8Y}1lyzxT?VC;y{w zMfl(Ilmcw|LFuQovFiSxUbj=v|Jdn$z5nNnJbA9KGNi4N!_l%qaPtOFiQje`Qi0*| z1{Qj$;6@Z^t*Uyud>m3gjlA+GUcbm{oJPKs(bpOO_4)dIeZD?l`1yYU00960iP&h} H0Nelo#yJ+5 diff --git a/rds/base/charts/jaeger/charts/cassandra/.helmignore b/rds/base/charts/jaeger/charts/cassandra/.helmignore deleted file mode 100644 index 5e03def..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/.helmignore +++ /dev/null @@ -1,17 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -OWNERS diff --git a/rds/base/charts/jaeger/charts/cassandra/Chart.yaml b/rds/base/charts/jaeger/charts/cassandra/Chart.yaml deleted file mode 100644 index 2099552..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/Chart.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -appVersion: 3.11.6 -description: Apache Cassandra is a free and open-source distributed database management - system designed to handle large amounts of data across many commodity servers, providing - high availability with no single point of failure. -engine: gotpl -home: http://cassandra.apache.org -icon: https://upload.wikimedia.org/wikipedia/commons/thumb/5/5e/Cassandra_logo.svg/330px-Cassandra_logo.svg.png -keywords: -- cassandra -- database -- nosql -maintainers: -- email: goonohc@gmail.com - name: KongZ -- email: maor.friedman@redhat.com - name: maorfr -name: cassandra -version: 0.15.2 diff --git a/rds/base/charts/jaeger/charts/cassandra/README.md b/rds/base/charts/jaeger/charts/cassandra/README.md deleted file mode 100644 index c6e4605..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/README.md +++ /dev/null @@ -1,218 +0,0 @@ -# Cassandra -A Cassandra Chart for Kubernetes - -## Install Chart -To install the Cassandra Chart into your Kubernetes cluster (This Chart requires persistent volume by default, you may need to create a storage class before install chart. To create storage class, see [Persist data](#persist_data) section) - -```bash -helm install --namespace "cassandra" -n "cassandra" incubator/cassandra -``` - -After installation succeeds, you can get a status of Chart - -```bash -helm status "cassandra" -``` - -If you want to delete your Chart, use this command -```bash -helm delete --purge "cassandra" -``` - -## Upgrading - -To upgrade your Cassandra release, simply run - -```bash -helm upgrade "cassandra" incubator/cassandra -``` - -### 0.12.0 - -This version fixes https://github.com/helm/charts/issues/7803 by removing mutable labels in `spec.VolumeClaimTemplate.metadata.labels` so that it is upgradable. - -Until this version, in order to upgrade, you have to delete the Cassandra StatefulSet before upgrading: -```bash -$ kubectl delete statefulset --cascade=false my-cassandra-release -``` - - -## Persist data -You need to create `StorageClass` before able to persist data in persistent volume. -To create a `StorageClass` on Google Cloud, run the following - -```bash -kubectl create -f sample/create-storage-gce.yaml -``` - -And set the following values in `values.yaml` - -```yaml -persistence: - enabled: true -``` - -If you want to create a `StorageClass` on other platform, please see documentation here [https://kubernetes.io/docs/user-guide/persistent-volumes/](https://kubernetes.io/docs/user-guide/persistent-volumes/) - -When running a cluster without persistence, the termination of a pod will first initiate a decommissioning of that pod. -Depending on the amount of data stored inside the cluster this may take a while. In order to complete a graceful -termination, pods need to get more time for it. Set the following values in `values.yaml`: - -```yaml -podSettings: - terminationGracePeriodSeconds: 1800 -``` - -## Install Chart with specific cluster size -By default, this Chart will create a cassandra with 3 nodes. If you want to change the cluster size during installation, you can use `--set config.cluster_size={value}` argument. Or edit `values.yaml` - -For example: -Set cluster size to 5 - -```bash -helm install --namespace "cassandra" -n "cassandra" --set config.cluster_size=5 incubator/cassandra/ -``` - -## Install Chart with specific resource size -By default, this Chart will create a cassandra with CPU 2 vCPU and 4Gi of memory which is suitable for development environment. -If you want to use this Chart for production, I would recommend to update the CPU to 4 vCPU and 16Gi. Also increase size of `max_heap_size` and `heap_new_size`. -To update the settings, edit `values.yaml` - -## Install Chart with specific node -Sometime you may need to deploy your cassandra to specific nodes to allocate resources. You can use node selector by edit `nodes.enabled=true` in `values.yaml` -For example, you have 6 vms in node pools and you want to deploy cassandra to node which labeled as `cloud.google.com/gke-nodepool: pool-db` - -Set the following values in `values.yaml` - -```yaml -nodes: - enabled: true - selector: - nodeSelector: - cloud.google.com/gke-nodepool: pool-db -``` - -## Configuration - -The following table lists the configurable parameters of the Cassandra chart and their default values. - -| Parameter | Description | Default | -| ----------------------- | --------------------------------------------- | ---------------------------------------------------------- | -| `image.repo` | `cassandra` image repository | `cassandra` | -| `image.tag` | `cassandra` image tag | `3.11.5` | -| `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | -| `image.pullSecrets` | Image pull secrets | `nil` | -| `config.cluster_domain` | The name of the cluster domain. | `cluster.local` | -| `config.cluster_name` | The name of the cluster. | `cassandra` | -| `config.cluster_size` | The number of nodes in the cluster. | `3` | -| `config.seed_size` | The number of seed nodes used to bootstrap new clients joining the cluster. | `2` | -| `config.seeds` | The comma-separated list of seed nodes. | Automatically generated according to `.Release.Name` and `config.seed_size` | -| `config.num_tokens` | Initdb Arguments | `256` | -| `config.dc_name` | Initdb Arguments | `DC1` | -| `config.rack_name` | Initdb Arguments | `RAC1` | -| `config.endpoint_snitch` | Initdb Arguments | `SimpleSnitch` | -| `config.max_heap_size` | Initdb Arguments | `2048M` | -| `config.heap_new_size` | Initdb Arguments | `512M` | -| `config.ports.cql` | Initdb Arguments | `9042` | -| `config.ports.thrift` | Initdb Arguments | `9160` | -| `config.ports.agent` | The port of the JVM Agent (if any) | `nil` | -| `config.start_rpc` | Initdb Arguments | `false` | -| `configOverrides` | Overrides config files in /etc/cassandra dir | `{}` | -| `commandOverrides` | Overrides default docker command | `[]` | -| `argsOverrides` | Overrides default docker args | `[]` | -| `env` | Custom env variables | `{}` | -| `schedulerName` | Name of k8s scheduler (other than the default) | `nil` | -| `persistence.enabled` | Use a PVC to persist data | `true` | -| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | -| `persistence.size` | Size of data volume | `10Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `4Gi`, CPU: `2` | -| `service.type` | k8s service type exposing ports, e.g. `NodePort`| `ClusterIP` | -| `service.annotations` | Annotations to apply to cassandra service | `""` | -| `podManagementPolicy` | podManagementPolicy of the StatefulSet | `OrderedReady` | -| `podDisruptionBudget` | Pod distruption budget | `{}` | -| `podAnnotations` | pod annotations for the StatefulSet | `{}` | -| `updateStrategy.type` | UpdateStrategy of the StatefulSet | `OnDelete` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `90` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `30` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` | -| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `90` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `30` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` | -| `readinessProbe.address` | Address to use for checking node has joined the cluster and is ready. | `${POD_IP}` | -| `rbac.create` | Specifies whether RBAC resources should be created | `true` | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `serviceAccount.name` | The name of the ServiceAccount to use | | -| `backup.enabled` | Enable backup on chart installation | `false` | -| `backup.schedule` | Keyspaces to backup, each with cron time | | -| `backup.annotations` | Backup pod annotations | iam.amazonaws.com/role: `cain` | -| `backup.image.repository` | Backup image repository | `maorfr/cain` | -| `backup.image.tag` | Backup image tag | `0.6.0` | -| `backup.extraArgs` | Additional arguments for cain | `[]` | -| `backup.env` | Backup environment variables | AWS_REGION: `us-east-1` | -| `backup.resources` | Backup CPU/Memory resource requests/limits | Memory: `1Gi`, CPU: `1` | -| `backup.destination` | Destination to store backup artifacts | `s3://bucket/cassandra` | -| `backup.google.serviceAccountSecret` | Secret containing credentials if GCS is used as destination | | -| `exporter.enabled` | Enable Cassandra exporter | `false` | -| `exporter.servicemonitor.enabled` | Enable ServiceMonitor for exporter | `true` | -| `exporter.servicemonitor.additionalLabels`| Additional labels for Service Monitor | `{}` | -| `exporter.image.repo` | Exporter image repository | `criteord/cassandra_exporter` | -| `exporter.image.tag` | Exporter image tag | `2.0.2` | -| `exporter.port` | Exporter port | `5556` | -| `exporter.jvmOpts` | Exporter additional JVM options | | -| `exporter.resources` | Exporter CPU/Memory resource requests/limits | `{}` | -| `extraContainers` | Sidecar containers for the pods | `[]` | -| `extraVolumes` | Additional volumes for the pods | `[]` | -| `extraVolumeMounts` | Extra volume mounts for the pods | `[]` | -| `affinity` | Kubernetes node affinity | `{}` | -| `tolerations` | Kubernetes node tolerations | `[]` | - - -## Scale cassandra -When you want to change the cluster size of your cassandra, you can use the helm upgrade command. - -```bash -helm upgrade --set config.cluster_size=5 cassandra incubator/cassandra -``` - -## Get cassandra status -You can get your cassandra cluster status by running the command - -```bash -kubectl exec -it --namespace cassandra $(kubectl get pods --namespace cassandra -l app=cassandra-cassandra -o jsonpath='{.items[0].metadata.name}') nodetool status -``` - -Output -```bash -Datacenter: asia-east1 -====================== -Status=Up/Down -|/ State=Normal/Leaving/Joining/Moving --- Address Load Tokens Owns (effective) Host ID Rack -UN 10.8.1.11 108.45 KiB 256 66.1% 410cc9da-8993-4dc2-9026-1dd381874c54 a -UN 10.8.4.12 84.08 KiB 256 68.7% 96e159e1-ef94-406e-a0be-e58fbd32a830 c -UN 10.8.3.6 103.07 KiB 256 65.2% 1a42b953-8728-4139-b070-b855b8fff326 b -``` - -## Benchmark -You can use [cassandra-stress](https://docs.datastax.com/en/cassandra/3.0/cassandra/tools/toolsCStress.html) tool to run the benchmark on the cluster by the following command - -```bash -kubectl exec -it --namespace cassandra $(kubectl get pods --namespace cassandra -l app=cassandra-cassandra -o jsonpath='{.items[0].metadata.name}') cassandra-stress -``` - -Example of `cassandra-stress` argument - - Run both read and write with ration 9:1 - - Operator total 1 million keys with uniform distribution - - Use QUORUM for read/write - - Generate 50 threads - - Generate result in graph - - Use NetworkTopologyStrategy with replica factor 2 - -```bash -cassandra-stress mixed ratio\(write=1,read=9\) n=1000000 cl=QUORUM -pop dist=UNIFORM\(1..1000000\) -mode native cql3 -rate threads=50 -log file=~/mixed_autorate_r9w1_1M.log -graph file=test2.html title=test revision=test2 -schema "replication(strategy=NetworkTopologyStrategy, factor=2)" -``` diff --git a/rds/base/charts/jaeger/charts/cassandra/sample/create-storage-gce.yaml b/rds/base/charts/jaeger/charts/cassandra/sample/create-storage-gce.yaml deleted file mode 100644 index 2467b95..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/sample/create-storage-gce.yaml +++ /dev/null @@ -1,7 +0,0 @@ -kind: StorageClass -apiVersion: storage.k8s.io/v1 -metadata: - name: generic -provisioner: kubernetes.io/gce-pd -parameters: - type: pd-ssd diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/NOTES.txt b/rds/base/charts/jaeger/charts/cassandra/templates/NOTES.txt deleted file mode 100644 index 9ecb004..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/NOTES.txt +++ /dev/null @@ -1,35 +0,0 @@ -Cassandra CQL can be accessed via port {{ .Values.config.ports.cql }} on the following DNS name from within your cluster: -Cassandra Thrift can be accessed via port {{ .Values.config.ports.thrift }} on the following DNS name from within your cluster: - -If you want to connect to the remote instance with your local Cassandra CQL cli. To forward the API port to localhost:9042 run the following: -- kubectl port-forward --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "cassandra.name" . }},release={{ .Release.Name }} -o jsonpath='{ .items[0].metadata.name }') 9042:{{ .Values.config.ports.cql }} - -If you want to connect to the Cassandra CQL run the following: -{{- if contains "NodePort" .Values.service.type }} -- export CQL_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "cassandra.fullname" . }}) -- export CQL_HOST=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") -- cqlsh $CQL_HOST $CQL_PORT - -{{- else if contains "LoadBalancer" .Values.service.type }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "cassandra.fullname" . }}' -- export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "cassandra.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') -- echo cqlsh $SERVICE_IP -{{- else if contains "ClusterIP" .Values.service.type }} -- kubectl port-forward --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "cassandra.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") 9042:{{ .Values.config.ports.cql }} - echo cqlsh 127.0.0.1 9042 -{{- end }} - -You can also see the cluster status by run the following: -- kubectl exec -it --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "cassandra.name" . }},release={{ .Release.Name }} -o jsonpath='{.items[0].metadata.name}') nodetool status - -To tail the logs for the Cassandra pod run the following: -- kubectl logs -f --namespace {{ .Release.Namespace }} $(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "cassandra.name" . }},release={{ .Release.Name }} -o jsonpath='{ .items[0].metadata.name }') - -{{- if not .Values.persistence.enabled }} - -Note that the cluster is running with node-local storage instead of PersistentVolumes. In order to prevent data loss, -pods will be decommissioned upon termination. Decommissioning may take some time, so you might also want to adjust the -pod termination gace period, which is currently set to {{ .Values.podSettings.terminationGracePeriodSeconds }} seconds. - -{{- end}} diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/_helpers.tpl b/rds/base/charts/jaeger/charts/cassandra/templates/_helpers.tpl deleted file mode 100644 index b870420..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/_helpers.tpl +++ /dev/null @@ -1,43 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "cassandra.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "cassandra.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "cassandra.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "cassandra.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "cassandra.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/backup/cronjob.yaml b/rds/base/charts/jaeger/charts/cassandra/templates/backup/cronjob.yaml deleted file mode 100644 index 3ee3210..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/backup/cronjob.yaml +++ /dev/null @@ -1,90 +0,0 @@ -{{- if .Values.backup.enabled }} -{{- $release := .Release }} -{{- $values := .Values }} -{{- $backup := $values.backup }} -{{- range $index, $schedule := $backup.schedule }} ---- -apiVersion: batch/v1beta1 -kind: CronJob -metadata: - name: {{ template "cassandra.fullname" $ }}-backup-{{ $schedule.keyspace | replace "_" "-" }} - labels: - app: {{ template "cassandra.name" $ }}-cain - chart: {{ template "cassandra.chart" $ }} - release: "{{ $release.Name }}" - heritage: "{{ $release.Service }}" -spec: - schedule: {{ $schedule.cron | quote }} - concurrencyPolicy: Forbid - startingDeadlineSeconds: 120 - jobTemplate: - spec: - template: - metadata: - annotations: - {{ toYaml $backup.annotations }} - spec: - restartPolicy: OnFailure - serviceAccountName: {{ template "cassandra.serviceAccountName" $ }} - containers: - - name: cassandra-backup - image: "{{ $backup.image.repository }}:{{ $backup.image.tag }}" - command: ["cain"] - args: - - backup - - --namespace - - {{ $release.Namespace }} - - --selector - - release={{ $release.Name }},app={{ template "cassandra.name" $ }} - - --keyspace - - {{ $schedule.keyspace }} - - --dst - - {{ $backup.destination }} - {{- with $backup.extraArgs }} -{{ toYaml . | indent 12 }} - {{- end }} - env: -{{- if $backup.google.serviceAccountSecret }} - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/etc/secrets/google/credentials.json" -{{- end }} - {{- with $backup.env }} -{{ toYaml . | indent 12 }} - {{- end }} - {{- with $backup.resources }} - resources: -{{ toYaml . | indent 14 }} - {{- end }} -{{- if $backup.google.serviceAccountSecret }} - volumeMounts: - - name: google-service-account - mountPath: /etc/secrets/google/ -{{- end }} -{{- if $backup.google.serviceAccountSecret }} - volumes: - - name: google-service-account - secret: - secretName: {{ $backup.google.serviceAccountSecret | quote }} -{{- end }} - affinity: - podAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 1 - podAffinityTerm: - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - {{ template "cassandra.fullname" $ }} - - key: release - operator: In - values: - - {{ $release.Name }} - topologyKey: "kubernetes.io/hostname" - {{- with $values.tolerations }} - tolerations: -{{ toYaml . | indent 12 }} - {{- end }} -{{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/backup/rbac.yaml b/rds/base/charts/jaeger/charts/cassandra/templates/backup/rbac.yaml deleted file mode 100644 index 12b0f27..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/backup/rbac.yaml +++ /dev/null @@ -1,50 +0,0 @@ -{{- if .Values.backup.enabled }} -{{- if .Values.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "cassandra.serviceAccountName" . }} - labels: - app: {{ template "cassandra.name" . }} - chart: {{ template "cassandra.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" ---- -{{- end }} -{{- if .Values.rbac.create }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "cassandra.fullname" . }}-backup - labels: - app: {{ template "cassandra.name" . }} - chart: {{ template "cassandra.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -rules: -- apiGroups: [""] - resources: ["pods", "pods/log"] - verbs: ["get", "list"] -- apiGroups: [""] - resources: ["pods/exec"] - verbs: ["create"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "cassandra.fullname" . }}-backup - labels: - app: {{ template "cassandra.name" . }} - chart: {{ template "cassandra.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "cassandra.fullname" . }}-backup -subjects: -- kind: ServiceAccount - name: {{ template "cassandra.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/configmap.yaml b/rds/base/charts/jaeger/charts/cassandra/templates/configmap.yaml deleted file mode 100644 index 4e5ab76..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/configmap.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.configOverrides }} -kind: ConfigMap -apiVersion: v1 -metadata: - name: {{ template "cassandra.name" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "cassandra.name" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: -{{ toYaml .Values.configOverrides | indent 2 }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/pdb.yaml b/rds/base/charts/jaeger/charts/cassandra/templates/pdb.yaml deleted file mode 100644 index 717666d..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/pdb.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.podDisruptionBudget -}} -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - labels: - app: {{ template "cassandra.name" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} - name: {{ template "cassandra.fullname" . }} - namespace: {{ .Release.Namespace }} -spec: - selector: - matchLabels: - app: {{ template "cassandra.name" . }} - release: {{ .Release.Name }} -{{ toYaml .Values.podDisruptionBudget | indent 2 }} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/service.yaml b/rds/base/charts/jaeger/charts/cassandra/templates/service.yaml deleted file mode 100644 index 3d08e03..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/service.yaml +++ /dev/null @@ -1,46 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ template "cassandra.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "cassandra.name" . }} - chart: {{ template "cassandra.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- with .Values.service.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - clusterIP: None - type: {{ .Values.service.type }} - ports: - {{- if .Values.exporter.enabled }} - - name: metrics - port: 5556 - targetPort: {{ .Values.exporter.port }} - {{- end }} - - name: intra - port: 7000 - targetPort: 7000 - - name: tls - port: 7001 - targetPort: 7001 - - name: jmx - port: 7199 - targetPort: 7199 - - name: cql - port: {{ default 9042 .Values.config.ports.cql }} - targetPort: {{ default 9042 .Values.config.ports.cql }} - - name: thrift - port: {{ default 9160 .Values.config.ports.thrift }} - targetPort: {{ default 9160 .Values.config.ports.thrift }} - {{- if .Values.config.ports.agent }} - - name: agent - port: {{ .Values.config.ports.agent }} - targetPort: {{ .Values.config.ports.agent }} - {{- end }} - selector: - app: {{ template "cassandra.name" . }} - release: {{ .Release.Name }} diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/servicemonitor.yaml b/rds/base/charts/jaeger/charts/cassandra/templates/servicemonitor.yaml deleted file mode 100644 index 38f9db6..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/servicemonitor.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if and .Values.exporter.enabled .Values.exporter.serviceMonitor.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "cassandra.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "cassandra.name" . }} - chart: {{ template "cassandra.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.exporter.serviceMonitor.additionalLabels }} -{{ toYaml .Values.exporter.serviceMonitor.additionalLabels | indent 4 }} - {{- end }} -spec: - jobLabel: {{ template "cassandra.name" . }} - endpoints: - - port: metrics - interval: 10s - selector: - matchLabels: - app: {{ template "cassandra.name" . }} - namespaceSelector: - any: true -{{- end }} diff --git a/rds/base/charts/jaeger/charts/cassandra/templates/statefulset.yaml b/rds/base/charts/jaeger/charts/cassandra/templates/statefulset.yaml deleted file mode 100644 index 286d99c..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/templates/statefulset.yaml +++ /dev/null @@ -1,230 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ template "cassandra.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "cassandra.name" . }} - chart: {{ template "cassandra.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - selector: - matchLabels: - app: {{ template "cassandra.name" . }} - release: {{ .Release.Name }} - serviceName: {{ template "cassandra.fullname" . }} - replicas: {{ .Values.config.cluster_size }} - podManagementPolicy: {{ .Values.podManagementPolicy }} - updateStrategy: - type: {{ .Values.updateStrategy.type }} - template: - metadata: - labels: - app: {{ template "cassandra.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.podAnnotations }} - annotations: -{{ toYaml .Values.podAnnotations | indent 8 }} -{{- end }} - spec: - {{- if .Values.schedulerName }} - schedulerName: "{{ .Values.schedulerName }}" - {{- end }} - hostNetwork: {{ .Values.hostNetwork }} -{{- if .Values.selector }} -{{ toYaml .Values.selector | indent 6 }} -{{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: - fsGroup: {{ .Values.securityContext.fsGroup }} - runAsUser: {{ .Values.securityContext.runAsUser }} - {{- end }} -{{- if .Values.affinity }} - affinity: -{{ toYaml .Values.affinity | indent 8 }} -{{- end }} -{{- if .Values.tolerations }} - tolerations: -{{ toYaml .Values.tolerations | indent 8 }} -{{- end }} -{{- if .Values.configOverrides }} - initContainers: - - name: config-copier - image: busybox - command: [ 'sh', '-c', 'cp /configmap-files/* /cassandra-configs/ && chown 999:999 /cassandra-configs/*'] - volumeMounts: -{{- range $key, $value := .Values.configOverrides }} - - name: cassandra-config-{{ $key | replace "." "-" | replace "_" "--" }} - mountPath: /configmap-files/{{ $key }} - subPath: {{ $key }} -{{- end }} - - name: cassandra-configs - mountPath: /cassandra-configs/ -{{- end }} - containers: -{{- if .Values.extraContainers }} -{{ tpl (toYaml .Values.extraContainers) . | indent 6}} -{{- end }} -{{- if .Values.exporter.enabled }} - - name: cassandra-exporter - image: "{{ .Values.exporter.image.repo }}:{{ .Values.exporter.image.tag }}" - resources: -{{ toYaml .Values.exporter.resources | indent 10 }} - env: - - name: CASSANDRA_EXPORTER_CONFIG_listenPort - value: {{ .Values.exporter.port | quote }} - - name: JVM_OPTS - value: {{ .Values.exporter.jvmOpts | quote }} - ports: - - name: metrics - containerPort: {{ .Values.exporter.port }} - protocol: TCP - - name: jmx - containerPort: 5555 - livenessProbe: - tcpSocket: - port: {{ .Values.exporter.port }} - readinessProbe: - httpGet: - path: /metrics - port: {{ .Values.exporter.port }} - initialDelaySeconds: 20 - timeoutSeconds: 45 -{{- end }} - - name: {{ template "cassandra.fullname" . }} - image: "{{ .Values.image.repo }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} -{{- if .Values.commandOverrides }} - command: {{ .Values.commandOverrides }} -{{- end }} -{{- if .Values.argsOverrides }} - args: {{ .Values.argsOverrides }} -{{- end }} - resources: -{{ toYaml .Values.resources | indent 10 }} - env: - {{- $seed_size := default 1 .Values.config.seed_size | int -}} - {{- $global := . }} - - name: CASSANDRA_SEEDS - {{- if .Values.hostNetwork }} - value: {{ required "You must fill \".Values.config.seeds\" with list of Cassandra seeds when hostNetwork is set to true" .Values.config.seeds | quote }} - {{- else }} - value: "{{- range $i, $e := until $seed_size }}{{ template "cassandra.fullname" $global }}-{{ $i }}.{{ template "cassandra.fullname" $global }}.{{ $global.Release.Namespace }}.svc.{{ $global.Values.config.cluster_domain }}{{- if (lt ( add1 $i ) $seed_size ) }},{{- end }}{{- end }}" - {{- end }} - - name: MAX_HEAP_SIZE - value: {{ default "8192M" .Values.config.max_heap_size | quote }} - - name: HEAP_NEWSIZE - value: {{ default "200M" .Values.config.heap_new_size | quote }} - - name: CASSANDRA_ENDPOINT_SNITCH - value: {{ default "SimpleSnitch" .Values.config.endpoint_snitch | quote }} - - name: CASSANDRA_CLUSTER_NAME - value: {{ default "Cassandra" .Values.config.cluster_name | quote }} - - name: CASSANDRA_DC - value: {{ default "DC1" .Values.config.dc_name | quote }} - - name: CASSANDRA_RACK - value: {{ default "RAC1" .Values.config.rack_name | quote }} - - name: CASSANDRA_START_RPC - value: {{ default "false" .Values.config.start_rpc | quote }} - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - {{- range $key, $value := .Values.env }} - - name: {{ $key | quote }} - value: {{ $value | quote }} - {{- end }} - livenessProbe: - exec: - command: [ "/bin/sh", "-c", "nodetool status" ] - initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.livenessProbe.failureThreshold }} - readinessProbe: - exec: - command: [ "/bin/sh", "-c", "nodetool status | grep -E \"^UN\\s+{{ .Values.readinessProbe.address }}\"" ] - initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.readinessProbe.failureThreshold }} - ports: - - name: intra - containerPort: 7000 - - name: tls - containerPort: 7001 - - name: jmx - containerPort: 7199 - - name: cql - containerPort: {{ default 9042 .Values.config.ports.cql }} - - name: thrift - containerPort: {{ default 9160 .Values.config.ports.thrift }} - {{- if .Values.config.ports.agent }} - - name: agent - containerPort: {{ .Values.config.ports.agent }} - {{- end }} - volumeMounts: - - name: data - mountPath: /var/lib/cassandra - {{- if .Values.configOverrides }} - - name: cassandra-configs - mountPath: /etc/cassandra - {{- end }} - {{- if .Values.extraVolumeMounts }} -{{ toYaml .Values.extraVolumeMounts | indent 8 }} - {{- end }} - {{- if not .Values.persistence.enabled }} - lifecycle: - preStop: - exec: - command: ["/bin/sh", "-c", "exec nodetool decommission"] - {{- end }} - terminationGracePeriodSeconds: {{ default 30 .Values.podSettings.terminationGracePeriodSeconds }} - {{- if .Values.image.pullSecrets }} - imagePullSecrets: - - name: {{ .Values.image.pullSecrets }} - {{- end }} -{{- if or .Values.extraVolumes ( or .Values.configOverrides (not .Values.persistence.enabled) ) }} - volumes: -{{- end }} -{{- if .Values.extraVolumes }} -{{ toYaml .Values.extraVolumes | indent 6 }} -{{- end }} -{{- range $key, $value := .Values.configOverrides }} - - configMap: - name: cassandra - name: cassandra-config-{{ $key | replace "." "-" | replace "_" "--" }} -{{- end }} -{{- if .Values.configOverrides }} - - name: cassandra-configs - emptyDir: {} -{{- end }} -{{- if not .Values.persistence.enabled }} - - name: data - emptyDir: {} -{{- else }} - volumeClaimTemplates: - - metadata: - name: data - labels: - app: {{ template "cassandra.name" . }} - release: {{ .Release.Name }} - spec: - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - {{- if .Values.persistence.storageClass }} - {{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" - {{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" - {{- end }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/cassandra/values.yaml b/rds/base/charts/jaeger/charts/cassandra/values.yaml deleted file mode 100644 index c993e77..0000000 --- a/rds/base/charts/jaeger/charts/cassandra/values.yaml +++ /dev/null @@ -1,254 +0,0 @@ -## Cassandra image version -## ref: https://hub.docker.com/r/library/cassandra/ -image: - repo: cassandra - tag: 3.11.6 - pullPolicy: IfNotPresent - ## Specify ImagePullSecrets for Pods - ## ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod - # pullSecrets: myregistrykey - -## Specify a service type -## ref: http://kubernetes.io/docs/user-guide/services/ -service: - type: ClusterIP - annotations: "" - -## Use an alternate scheduler, e.g. "stork". -## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ -## -# schedulerName: - -## Persist data to a persistent volume -persistence: - enabled: true - ## cassandra data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClass: "-" - accessMode: ReadWriteOnce - size: 10Gi - -## Configure resource requests and limits -## ref: http://kubernetes.io/docs/user-guide/compute-resources/ -## Minimum memory for development is 4GB and 2 CPU cores -## Minimum memory for production is 8GB and 4 CPU cores -## ref: http://docs.datastax.com/en/archived/cassandra/2.0/cassandra/architecture/architecturePlanningHardware_c.html -resources: {} - # requests: - # memory: 4Gi - # cpu: 2 - # limits: - # memory: 4Gi - # cpu: 2 - -## Change cassandra configuration parameters below: -## ref: http://docs.datastax.com/en/cassandra/3.0/cassandra/configuration/configCassandra_yaml.html -## Recommended max heap size is 1/2 of system memory -## Recommended heap new size is 1/4 of max heap size -## ref: http://docs.datastax.com/en/cassandra/3.0/cassandra/operations/opsTuneJVM.html -config: - cluster_domain: cluster.local - cluster_name: cassandra - cluster_size: 3 - seed_size: 2 - num_tokens: 256 - # If you want Cassandra to use this datacenter and rack name, - # you need to set endpoint_snitch to GossipingPropertyFileSnitch. - # Otherwise, these values are ignored and datacenter1 and rack1 - # are used. - dc_name: DC1 - rack_name: RAC1 - endpoint_snitch: SimpleSnitch - max_heap_size: 2048M - heap_new_size: 512M - start_rpc: false - ports: - cql: 9042 - thrift: 9160 - # If a JVM Agent is in place - # agent: 61621 - -## Cassandra config files overrides -configOverrides: {} - -## Cassandra docker command overrides -commandOverrides: [] - -## Cassandra docker args overrides -argsOverrides: [] - -## Custom env variables. -## ref: https://hub.docker.com/_/cassandra/ -env: {} - -## Liveness and Readiness probe values. -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ -livenessProbe: - initialDelaySeconds: 90 - periodSeconds: 30 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 3 -readinessProbe: - initialDelaySeconds: 90 - periodSeconds: 30 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 3 - address: "${POD_IP}" - -## Configure node selector. Edit code below for adding selector to pods -## ref: https://kubernetes.io/docs/user-guide/node-selection/ -# selector: - # nodeSelector: - # cloud.google.com/gke-nodepool: pool-db - -## Additional pod annotations -## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ -podAnnotations: {} - -## Additional pod labels -## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ -podLabels: {} - -## Additional pod-level settings -podSettings: - # Change this to give pods more time to properly leave the cluster when not using persistent storage. - terminationGracePeriodSeconds: 30 - -## Pod distruption budget -podDisruptionBudget: {} - # maxUnavailable: 1 - # minAvailable: 2 - -podManagementPolicy: OrderedReady -updateStrategy: - type: OnDelete - -## Pod Security Context -securityContext: - enabled: false - fsGroup: 999 - runAsUser: 999 - -## Affinity for pod assignment -## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity -affinity: {} - -## Node tolerations for pod assignment -## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ -tolerations: [] - -rbac: - # Specifies whether RBAC resources should be created - create: true - -serviceAccount: - # Specifies whether a ServiceAccount should be created - create: true - # The name of the ServiceAccount to use. - # If not set and create is true, a name is generated using the fullname template - # name: - -# Use host network for Cassandra pods -# You must pass seed list into config.seeds property if set to true -hostNetwork: false - -## Backup cronjob configuration -## Ref: https://github.com/maorfr/cain -backup: - enabled: false - - # Schedule to run jobs. Must be in cron time format - # Ref: https://crontab.guru/ - schedule: - - keyspace: keyspace1 - cron: "0 7 * * *" - - keyspace: keyspace2 - cron: "30 7 * * *" - - annotations: - # Example for authorization to AWS S3 using kube2iam - # Can also be done using environment variables - iam.amazonaws.com/role: cain - - image: - repository: maorfr/cain - tag: 0.6.0 - - # Additional arguments for cain - # Ref: https://github.com/maorfr/cain#usage - extraArgs: [] - - # Add additional environment variables - env: - # Example environment variable required for AWS credentials chain - - name: AWS_REGION - value: us-east-1 - - resources: - requests: - memory: 1Gi - cpu: 1 - limits: - memory: 1Gi - cpu: 1 - - # Name of the secret containing the credentials of the service account used by GOOGLE_APPLICATION_CREDENTIALS, as a credentials.json file - # google: - # serviceAccountSecret: - - # Destination to store the backup artifacts - # Supported cloud storage services: AWS S3, Minio S3, Azure Blob Storage, Google Cloud Storage - # Additional support can added. Visit this repository for details - # Ref: https://github.com/maorfr/skbn - destination: s3://bucket/cassandra - -## Cassandra exported configuration -## ref: https://github.com/criteo/cassandra_exporter -exporter: - enabled: false - serviceMonitor: - enabled: false - additionalLabels: {} - # prometheus: default - image: - repo: criteord/cassandra_exporter - tag: 2.0.2 - port: 5556 - jvmOpts: "" - resources: {} - # limits: - # cpu: 1 - # memory: 1Gi - # requests: - # cpu: 1 - # memory: 1Gi - -extraVolumes: [] -extraVolumeMounts: [] -# extraVolumes and extraVolumeMounts allows you to mount other volumes -# Example Use Case: mount ssl certificates -# extraVolumes: -# - name: cas-certs -# secret: -# defaultMode: 420 -# secretName: cas-certs -# extraVolumeMounts: -# - name: cas-certs -# mountPath: /certs -# readOnly: true - -extraContainers: [] -## Additional containers to be added -# extraContainers: -# - name: cassandra-sidecar -# image: cassandra-sidecar:latest -# volumeMounts: -# - name: some-mount -# mountPath: /some/path diff --git a/rds/base/charts/jaeger/charts/elasticsearch-7.8.1.tgz b/rds/base/charts/jaeger/charts/elasticsearch-7.8.1.tgz deleted file mode 100644 index 7e33f803407bacb345c4d1a147b02fadd3a58187..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 25704 zcmV)jK%u`MiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKDJTiiI3@c#Pxuc&QuOEMSt2LzbwJN8~CVKUqV!V6?(?qT!L zYFpi{!EJdh8PXf_zrT-4k}bR4A2fs{GkEuz(6&BHs!~;{K4?UQWPzY04Mwe(Ba+JI zgp8xV+~d=3x7*t0`2=8#H=S1 zlB9oW-?^{qB>B&s=J(Bx7g7$VI*ZDx~yrFLp;9kdqI>5Nz)@lhel~f zG`yIH^mWR!qzjEPQRNz*w+3e;3WBCrETAAqL_*AC(BEOGiVL`AQ3NubfaDPHIHrMA ze_oGh48L<0vv>${M8R~AjWPjZ#Iq=bzG@#UIKzW~hlbyPe}{ZjNOmSXOG}-5`p2mr zU>6!V<`Q*+lt)zPvExYl6iAXpjE1UHsfLpGq9-h9UQ!K>2%zy5OL;t|v4ksgoqDc{JzmlQl8LMGAcYOUSi!YeEj6C!F0VY+^F{e zmvqwAe*wf)NE)g)fP_fBpK9B!3A?7CTHFsZCG`t}lTQ*F&std~+$})k(Cz^WL6)Yf zv2_|>b=Os=P557)K|o^21Vw=I0T#W?`ZSHHq_{5>)F!bcA7DgN>QObk{rF0B;rzXt zfNu_?!~eb5KlGyclvSF0iesm5n$FXH0#N^07NI zL4%Y^;HljPW0H6@zWOocV>2}06gr^;yENvcjIVtC2}|h)4oNaqP=E1N(`u{`F(DO{ zbY+2?Mvf>;At7>v>oewAEP=&>g%qKg@X)Re6AILWEJ9?*l8SZ&YC{ZIK-9d{7eRw8 zWpaY;yG6YS^V-^L$0L-2nai_Q=!Th4C*r1YN|6%zjj2$HM|jZVAW z9yjpCn2vd>2EXx|sW%ZDvn30AEN1c~@5|1wXkjgHV`B?jP%qYsRyrHsA2R*k9c68` zY9&u?>42nPtpAwGYo1>I#PNt}H}QWB&%5GLHl{Bl!p3KGoJ2%Y)hG!9D#W2aTF#+y zLP_{*$|QXo2ebk2aiyGPt1cXXkUYh$yV-utJTL8&Kz#~Qs=9yyi3Ih)vJZPfpippn z1D3xV?nLj_Q-kSdL)SDO+u{Hsp@AM+lCmon(IE}HfJd@=IS`t?F@sMtwZ%`ecu(xb z6Foomp^b1L2`Ae~` zo|nH4aB*p@j)h|S22-(>HP{P7ONh)DB%_LU)@&9S=p*t}5~-;3sTp71hg}O&Sz3J< z{$i%6D6i@~C%x*UFq@f<6FGUs(y4k5*`8S$$^Y>bC3cIXl!R~NXkq}Odw9unnX=k` z$bG@bRF2fCqMI;ex}S+jpMS7e$;V?7hg~>d5Bd6YSkG&%zc;-c#7utno{AGxt<-VK zxI&wk5fO?Nkm_(0im?mnfW+Y~JjO{0 zB^M}u&Rc_*BN7j_T){Nk2Pqvg9>X;X6-2R3mTMA;T7BIx2~sYEDJ(n^OSU%{sAFSt z#uFa#;pAtb4Un2FoI5Kc;H5#3JG*D;Hhks zrrd?bh@@eox_?y5Kun?g+&@GJHjI6>jZ`14HT7TL_T=}eB>sRBnWYp3(qf>BENE%e z!dg!^q)EglYQZ(|1x*==qDfQjHBo_0LQ)b%G%AX#wGfh|l7>K};U5vYl8vdBVf&m* zAybkhRY^AC;US615UG96bRC;sa{0NQV`uU2G*JEaC%J?jvG`ICD&|r#!{Kx2XA-55 zNNr-Zz-nukMO-yP9I(I<>uH#sHdd00X&=QvSK3i~S|lW(O>Yej28c2ALqb!g4ieo} z!b1%rCF`pKNy_`AA5Gwz#3;C<{BA(p!^5E0^z`XqB=a|FUY7PIDVIFpk=6ow>OaRk zm0kFcjdt6UDTzhGQ)%99w%eX(#@{VYGR->ZA3sqNMpW3Ba+1(4ywq!SaIBaF9#Y*L zG78mm3c!v*(<&SmKxriUOa4mr%}MwJiAWr%UQE;O%Twf?PKXlvk?ea}5)w&IWlAI+ zPP%Zyqlm@Bclf%Bgk$mnvY1>E7AZ*Po7tY!YF$Dm(hNy3^s{h?0-K8?C{ZejtTRPw z6_Ih|#cQOvnr@D{E)YYT~&}+xr^)#IGUZ3hOys6Q-5lB{>ZDzvKxFQxYidD4KYZrehZ4279gE z9@CWZunV0HHKmCNWc17UkbF2K$xFq$bYWwAqx0g0l9NctVk*RO%KNz82ZTjgO3y|q z6(b&nUD!lL5|fNXuV_Rjr!?SkDAb@mQ0yT?SUc}ThOB<24Mi__Ci9|Oo;uM1#v?EZBucrReT3r8NGV8T4*PDC)Wf?@%=ZB$70Z6|ZW~+q9`Zr*zPrcT7nl zE=7xkV-_f zVt97NM__yQBxCU~RTR`)g00swL>ZcE-2>gLv2AB37-TAF{=bMIuu2Qc`jZ0 z`nJiZAILa~XfxsgiPWx*3KlvSm-G^pD)=(8ynoT`S}s=Aw2jw9Z?9;YvQRIm!se-$ z4wB5j>1r_{GAdfzn?_50R*;1s*#`?>FJc24OaetHjlLjB>8aE-4P~PbTCUZjFXVtm ztIy(=7&V?l!w=MdX)xmO6OAIS^?~}B5b{(V-!LL^7||5|?n+5xDg+tQhK6Wfcz)jn zD8Yw55u?%zKPdgYaee`;{S`-Dsbqyx0@4bdsL1|36B6QV+@~q(6&1HCT2@b9YT#`D z@c7N%+5W}R-r@f4cyeJ|DwR4odbR)C#qr+R+5XAVZX@DDA&D6I-!)3bPJh}vd3Evf z?YpD1-S10ZPWF%A9K75!-#Vpl`==N0PTuUQ?a^(ua963V*G0a@EqFa*5ry+}Xgqlu zWN8Gx0G~rEq*tvtiz4u^Vg27es)jBC9@0<$h}YqXZvI&V{<;f|jdr^M@8AEY;_^jA zX#ySfcU+#XZv407cW2Nr^;a~tm8==OaBa+D7+{MH1Gbq;PE>6;rho0 zi$nV1A|X;yUD4>Cum7Xbcv6CG;~$On_s<(vc4%}zHuO4P@WF*%$3}Pki38~M=S~T` z#HvgQ0CBInUB)d`maL<%8R90ns{od$xbtlpo|h^s&hPWAjDz{ui%=AMbx3;OR8s zS0aNEioWL5hcQ+7CKO$#kR?qI;0d1Bfs9~CjXuNob1`xE<40(oP(+>Pk$nrFK7k)8 zVxhk06uf-H+{{pc0!=J^?QJySj0%~LMRSdi3B?EfM58fCDx@CL$o_1IY<&k;Y}`d{&45Kz zP7=C1R$vK6vP2plU=6mxoleRX%2hm@_Eq%4*LX#AV-|4lS1R8cp3OQ6mgbyglS8|d4be0Wtc zX?Dq)Qu#O6`sdRp-}zG50NF7|Vyb$n=|%O;oM*K)HKDqCi{VzXO_~G0Qn?2Pv+jFo zsJg}P1Bf;C%FtL1@-z+;&SEJXM6(iwLN*plcq;j+MAhX}+qEt7?3wNNNoMi$DT{+B z3ukgQSOq{;N=ZDV@Ps{wCs;L$C5uiaO`z=zqhlv-`p|p!34>3co|}elJL{5dSZTxA z8J3GwL0|bgy+}ShF*dL{6j2l`KxmCp;08nzG5LlG35{ms8ML2aBYI|RfHz%F11-IY z+Zw+>slR9NH0BbX(tj4?Yd?FI1Nf?#kO8cn(#{-6PaioaRA#BZKp{zz@+4(=q~xa6 z+B(TxlMA}|v~FB|m>hLm^o3EKHudg{P zph1#Ew5~dRD#=Ep4hgFzr;mwMfnxQ8ivVKFEe(v$i&ddPKS&y@4;Ch!`7kl&H7p)B zFTY1!=5)0hD1B+h&pfmEf34^qljI(Z!57K@JDsZk$M(*~#v}j#5YN;>pbd8wO{}JCVnM5lXw}#~kZs4C8 zmsD2+NcHFG)~f|kgy}*#)PoK0gAxRSbaf#VAJPi})z)y%AJ%=a8-nP423v6}X z=%VoHQx|UVfHGBXK%J(sgctWuQD))4CAjzD3bFwIJ3CwLDfxf%QT~6Br-J`>+3kH` z&fh7v{mAgV3s~Nwk}=OX=Bae|y|t<+3Yu<@)%JG^+R-3d_!W{g2OsOW1%;f3h8^h7 z^%Sg_DPrXcGz!VZ6e(FikxYU4^v!_ln#s`=jGWt8-I#kltEh?O|4YUZG+lDyP>@fb zJZ&gDV@Jryv@7*I3j#N@B!KT;-InU$ds|EwRWmN$IOEbU+$&vGwD|2X@VY{&Zkidl zo7p2S4MvZ-TNw^s-sOWuw}s*-+TY@BHHvD^W_Bj1o<0dKslF(6AA=`HGxlIjQEj!P zin=&92M)9Fe-`~ucvu(_X&a)I&w|DNzZL!OMyI{?$p1aaat#!&muk`9WKpO;gt;StvgV`;BEuuQl$k+Lo0xN7eZ#G%}Vq+FOLkVD!cz;kV`a zmO!+x^qGVI);LJ7_#HUGMf_j8vr)nS_STC>{C|+Ag8NgxHBIeUvpOTV4DBd)S@9AmE>cCB$FeavVWm8T4>450dT@2x=0rP zlMwSL7uOK{{Nu2 z+T$^xdHSsXI}M~c2{e>WOVJR#dIFBno{pQ~Q1C@Sou=SwCo zP}Y?f@wmTSV%zn1TNzW!rj6{~{EIc?F?L}}3mZ50hrrA%?{SB2QD zo5D&v?hRx44$&&%wTHcPRM@KOL!ILN%fJ#K;i)}cr;ax}X4m&0ZgTx&L%q+B(;{ZU z*~?@7#@@_L-F8o#UD~c}9D@9;%;OT&jLR)tTE;nZnF?9pPALC)n^~1woHMm@Gz5cs zl?Vwn1D>u{xz;S*f!Eb?qby8!TZ+N3-0k>RLn-}{iED8Ol38iPZlOOCQMA!NmLZOL z*_o?fp_0y3e3L}Uh%_ti?An>1`dOS(5>EWw^gMTPw?s3r0ZF=W#A6CYw2zq5kcL&` zVX#4m1VrqTmcvf?ZIB$*J<*kR`8ED9dH+Bn!A;O1wQNLEjDZA9#Oo3RWK0x=%=!@% zqa!X))SJC9OsNo5Hp@V|M$Z@N~&4Xs(O}Fnqyh*hJszy zKjaUq!hwBtFOHz0m0B@>mdkLeOOqi_g=vPaQ#1sR2HIoOOy*(rtU9l385l1+s-6|IX*NZjppa{R5 z`&3}Lns~}a9&+)fbpNs(?#vy6-dyF8s3$5d#4WMuRv5JeR;`9vt6js-Fai%HEgYP;=aR-op;Msc-%_2-byt@d$}Q$^ETYi zP}Hl|cUlKE;Aubw2GPbyzgBIOI|svv2(08=9^#qTVdsD|})6-t#F zjX54n<*2oDt#(bR8fs88Y8#EtDUk=HbAxZ>#lQ`Fr{e)XcVpkp9*}Kh_7<9>Q*dBW zlicBUNSX`zYydXS!(s)(v-xAVy`94h0F({`C$?)*$_@BhPye@X(}x>SwkTE#GrQoF znZ1-eEkW0f6>mbtKbuoP@PSl#>I^jhIBU~Pr3xrY)?^WIS-RO3r^&7jBfnt!^QZ12 z9a3Z`kbeF_XGvix4PRkk>{CrNSUfx!#yo$$|A7V>=2~=W`ub2kEiur=gRJ!aha{y! zlur;_9aCzNB&mD=;ECFSJnh0kJoQm01FW{D+FJ%u-NRJxb|;O3vtBb&E!0?)&RYoF zVoNSWg5jxGT#0MSh9lX9PHA$gH#-NKj;kD5Z2g~k+c}HR` z6`LjwnvNBVSxd({?K!AkAA3Cya_-*i)Rrt-s-)(r^DA~Ui@B3QV_g-DA4Ch5o z&&6Zur;|vmTBMX?Otm(rY%O0{`)UD~muKb?dE5{C&9lk zIm0L=9-6(<%e3mxTR5}mP~Op2;osSqu>c=G&SkmW1WQGsHF&A>dqfi*+YpOEKjOiq zz`S3H1cAZNL|#QF@02XgsK(Sj2`;Zm8e(|Zgh+<*l_n;*ynsGs@enR)BJ(z`M=TOj z-#lX~37fA%aquR0gks5cfJVuAbL#wU=y5fSXfS}rznwK|=ljfF_$N_4Jm#=I=E`WA zFE2H)H0LyLiKhxVS@_!e z;=OoC4{4hc)> zfUwAOkCu|bP7Wb0A-e@JKptl3mE)vk3mS}Xeb@T#KOy9$qw|tZcAq@$6G4%^c*35Q zK4Tt;#$FgA{bi9Vp~!DOhD$m@y-}HUpD|z(hCVjZz$(yq!rXe8bijoeW^#}tS|rYb zga~oX(+~uU0}5P@XnM^|=>2j|6B^5Of+kELQ>K&p+Dv9Vwwb7${@4J{;jiHT3!Z%3 zf3tUbcJT7zc<=P|*S9CH{{6!zc>kZOmv|aL>jpq-U7u8ImcT^>LM)$8)6QqT2JBN! zHQ;6rXu3@s)5HmA1>M*!EUnEey$GiGA%BVcn7W&cCA7|Bmdd$|SYPCXo=$z1Q<)Ei z65j%?a++Jnl@4d9p6vG3&6J9x=9CAYP8WlNL6IPn34I!=y__XQemEyXq}keNYzt3K zGBikRjDk`N*~O0sZ}xYQKsBkjz?Lu6>F-UIA4!?O(`WFpMq`A@k1$r+ZsWm$*XYti*Lk3Pp2;MWZl0-2-D#twSl3P= z3fo()&c+TV67O{DZLgnvREu0Qluy&+&;T5$`4xL@E@(8LR!Mp%fJ7Rj(kzZyJbVt3 z5{>P~FVIuxl$os8wEWZA+4058x3BhhpFG8l+-NnFgavNet;RIs0i3+tee&Nkw#PX< z`FQg36ZkQOHm2vAx#pT#oU<@?&rc--TZex<`S`=$>A}m3y?19neS(!2uZ8I)X{gWj zlb3q*b=yi&VJ7wW`dv5ua?Q{^Hb7{D8a!;Y+s|REy{XgpMl{7(ZEOJhr(ol>GXdMp z4|71AFWx8Eb#tN32DTb}yKaL;Guqs0Z#EQ0-`0u>D{rqp95H?Bz*o6jiY0YnH)rp3 zmZVlQV4z9CuY~1EaLajEOD8TSw7T=DTSqt801Uafu(?7tmHF>wn{D{Mf@1^bY!Jz_ zU<4&Hd7m3;-6Tgw=OZp*LgnXy*8HWfc{RGR^2rrd>WmASgNbiUqA%jh+-C+2`xf0lrWH+d+TdsPV2C^V55YQAXc)S8D? z+pTfm;8C8j#kjjo%dKnxLkdq#wvgp0>9c3BQ!i|rJ=ioEkS}!S7nn$Y8V2*FC?`!! zS(K^^Z{!XlWFp{KG@Ug6MdRj}#cZ67ml{eQt5nxH#41OsM%@6)mvD1lvH?W$-e6pw zUc%yGGmBY3gwzp~Zwu#nzOAbOT~HcceEyMC0bSjK^=Ma1GN+6c9SqiKMG&%!S~F#T z;zG`7ZU6M*fA)UayLfwicDkrFD*lIDk++Gg+k3_!QDOLVcw#SL9GgVM{dxc)QTq5% z*RHC;oPj(k?saAWzfQS@8p+vO8KbZ)5z#p<8Z~8&QnRjuT&X#$`Fxf$bd$@PjaNZ> zYr9scXdGuLj1{4usc2kqt$qtt>q`3SQfngX>$YZ;t?EVLRu&tJY&J@>QALuPsPA@h z%}}eK^BJI~x4z8n$o}mTk5p$`W2tegMRO9F%$#RU0oNz63c2Z9`01ruL5Y1oYV12H zvRATk(34+a=wKi;!$9g51`np8dCe>^6#7^VFh8C4exA+cTz1lgOAsui0ZHMSMG+(^ zy;36;5x)jgFQq=(&oLh7HE*4;zk(>G%RAkVKTJtL2U+Ahc4WRuvHxW?={0xV4KZps zKkszgU4Pj9_wq+Et8T18#1N`l|7) zZuQUMi9y}n-PIC`)Gf%eui7H5Lgzbx{2i8X_!Vgm51Q2zM|(_|oAB9-jw(X2t)I zR7m`fU*>Z4rN-?-f-H*v^rBPE|FyBR{o*nH$3r~T_#anJTAmpxysC){{f{3ZC2_bH zB_je`a03y)rm6a(Hc+E3C`CibS4}Z$jX1w-bOCpo$bx_h;RKwxlfSHqmQ=Q+^6xg0 z)kU|J#I}maRub5JX!t?#qY&2?7%jQ7hn70lms29ny8d15!gGB(SVp}|#NFH>%qA$E zdB&UFF2oVNqUoRY5ArC&CR$!InW(=m z0uqd9>(7b|f5NAX|A*v~4p?-b$iEE!Z&vfaY;J8n=6`&U$65t6o2?Oz5}JyZVmf%- z9A7??fj|CJ#{ZN3y;q0(&2f0IeayxG&c?=z&1(Mt&CRW?NBni{K0x!bQ!Wtqr97!Do1Fp%$Xy3HAEs!{bG>d^}De%F71&l=AdAWyIJh-H(X6xUd zzi)b;_g{bYeeGrdArB-EU`S((pB}>5+m|*j(Iuq`ibRUBAJLSm&QV(jB$M0(?E~Nc zyKeE-+oSa}*nf3!24_DVoWkk;%d>;GN6+El==5xV?-iWv`zP;?Y@cUu;ob48y|aC6 z!Sj4LKhZH;REOgI)3wz3`AmI3h=n9k#Ny%mr)w<#f#2RG!<2;jQ)d6xUxbnuV=k#` zG*iEP{Dog%8fc=p{Ql`$;QoGwBJ6n)y6OGXwJ`sI^?%&^fA62J4ah%D*`N3|`byFy z;zkFmmy^dptWq<8pT9qakO`TxK88K{@ApsFM*P~B+}BloRaIY!`aJfDZ>##3-wWTZ zTHA3*L#BgGp&=YbQxwykkOoA7h{ zu-ajn8bWK1t;PYKl1z?hEY(<;0#qEr*_+d6#_v6x9=L7DR}J~LA-~)Xj!H(tH_eoX zG-gA!=V6fYF(^r_r7xgCNVJB>Urx`aysygps=O}l>*9K;$~~AZ3U5yft9m{tlK`g! zQ{3l5_@=ne2W5?5eFsUD4OuK|+A?3t)iUGqYpr&idYPcU9MRl2Hs1?B5WxbVAILa~ z==-N@ef8Tnzw=UuStMB!>89U5T^pO<*j}-(G9mdGucHO7wJ9CodmrE9+Syvg(Dh1! zh)E(wTuK%Xozd&BzWcRYy`Y`B?iCU)q}f)A)Hux*aSig)exlRNgSpm zBrP*Q-`5rzhA^+KflHV@?>jhG$JG1t_we`Kjpp~wHZJ0SZ8qD@w)Y+Uoag3%zwdUM z-+SM|p*FP5-2+_Go;!A^Eji%!I!JOHyhA}1s(UtPgrK;*q6vFZq_9eksG#|4ASumP zTWyM_2k;%7jZ#Y80UGLvNjwr7XlK15_XP$VvvJGv#<8i+>mO9NCwqsvyW#)*atI?z z63;uO6wXDKBpf{gONWY3fKye*JXL*3!XnYsfG$or!w=-FfTTiNr;nZH_sx!_C{48> z*4N*V7Ke=xkkW*Ay`G|2_&2({8={iiP%{=>=s-p>a| zuP^l1Q}eA)2Rx--e*Pm8K}@d=91DxHAw!}T310ua4^LlnK8&d6?EL+B$YT1ei8D8+ojIn}*qzwo2=e|U zM+-Fi3OSJ28GOq1wl&0v4`8C$Qfs9R2NFWAP)!ZHKgo?Ss;;_Pt6lgHdBc>_7|1|< zq$C*Wori9>!jQhO2?yAp2{z{t#W9I95=9gI8j#o%R6_4<{E9|Y(jJ_bqe>%({GA#s z6Trp_eMyXVAy+hIgGu4gYjGU}`xjMf*((gWdk8Vf6~XXS;g`qnT8DJZ(+Tu)!;K!6 z;A1LB3J@Y=n(x4Sa2IxJg*XT{P9ik~y;7=&F=4T!F#-cYqbA1(+U#YB>8#Z}^rF%b z)TZc4S+P+juI{e>+5z>ih#>aucc=qy(w6hwqFx|$VsniD@#m=WTJkK z$tA@;+}24LdPrV1eMhRP34!8j6xw6&idlp(B?c9F6atT_z}n#NV^2d!(<&-}rzW(oPz(Mmg%P<@$Ae(Q zSYdvF?%F;=@z{{XK2KQ8c#KF$`U>=;3a{gp7*3oV{g7}$5r)ESRG{${OL>eO$Q4PM z+Kie#Lu+IcJ56{j7A&OZ$Sv;sn((Sv@_bRoSug@h1f!`zb!Qr$IU&KaiIzZ{6+`zN z5*2VkvR#tcJnshZl1o9qYJOBaH}HyzAY}=P7k{ot&0Q1jrE7RM{u0kph5n$=?dN{u z-9T?f2-2RrTIw`DR|S2`cq$TXgPJN?2`QpIjWsQF?XYufDr&>iD1!{fC8#p!Rhn1NWXAd+sA=hOs$kQysvtXc4FeH+A zWDlfzgD~$?Gy;W2p9%?dFyN_dG~ulr(bR-;%?s+A-tcomuy*b}HQAXUtf`@ZI?I-z z=QNBvb-&jC+puv$5}66(#*Euo@lO^Y$OiW(MbH^ISEnr195&iwd>)wG`MH6fVqh-@ zJiX9!+(kb1Z<38E&*W}LQ~>S*^=S5%zR_Yx2|`5F1ZX>V{U5DdBt|@oLaZ3Ge`d&D zB$K>jdfg7hO~yG?40NL769NOA$m z1l2w*2@h?=J5UQOkbzUsR03U!QpUu#BrKqfNLB#6`Pm>h4@A(DX*QdJ*3{5IMa$ufQG%#d#A^ z!KvnC9BJ{i7xCeX-#3~`$`hJOMn$g)sJGI`78;#eRTYVI8PM?k1D=kFK2z`Mxq;rt zPpbg65W8nJe6ETBPfF^yid1CN0AC|kEBG5~>gbHsZvOphTnPTEt*`pIfu8@{_(Nw1 z{%>Q^nX~os8XBl>n1Z@WH}KBjxMGXOs&szGk>7Ha)MUAmMp4X6;H?s9mA}58#BCXK znX{*^F1CF7*`8E$NIGI#494-bsz zS@ocr4y;*aXP4NitkS?AWw+jCr@B7gQ%x)b)T>ehe-x132T*5FfaQVuhk_?QD*|

    gt0u3YK+3VbZ)7Cr=g*&)YecY;+uHRLladT3#L-cG+Z4CN zKHgdOtr;9@>`b#Ba+WJ_{4yh$6P!auoRD{nC(pX_v#ErxkgbB-IsWFP&W_}s%qJmt z*68S5|2A?sI~z}@uitaVzm50v=e`T{#J^q`x%l~|^x)X1PD%ECQ3)6r7}&pZlW#!x z&7i92f%*0h4r6aaZ}j74CZ$tSQjUNV{3&o&kyxTw>qazFXX3Act31{S^Z5WvqP%;8 zRA3x!@p~>={SD~@*D62Me{9N}gIbv>4iVJ*7S*vcbLjhxnzRda8yg$XpFfY95st75=?aFC9}wq0 zF)@LdjmM0RV|#f>r?%h2M3;$#Pa{fO)5_jR(9T%&W!y0{L3|lv0qAhQ-1KmF^PQ#ZP>O;1`%Dz!7D2~MQU ziWTB2Dk_SwVr4}3^O^Dya_Y^8?nk&h01c(e<# zn#xC@6l4*7aQx)S269E;yL${|OE<2}jM=QQ;)KaRrkkog^P>D`le>${Uf8$b)1Kp> zs|yMWF0X0_-=xd4u&0Y3+CqaAK$nqa%A?fkq#lyJoui-Hen2>X}amW4T zsHl&Pl3-Q+5SF_hB#eanpW7uIe*?#A_w<-e)@q~SyPJD|z&6%iOR!QgO3a%bavc#AD>^6l_mA0H!azv|NZlSo-Y>{7yA@;9CP`qRRbUn%6+e)_JqE@(-#Tj($SLZ+CP~bsy z^z=kD2pv1Nx#8&8SRE{FDJOU-zYL2!Y4}F2TC*4mHh4*NbaWfddEQmOd&^+c{tSn~ z1k|3gva*{asc|0Qw8G!sK8kJ7>0&1%@zj--rXaiP*RVBWzVhzUM4V8cKhnFInYN=G zH(rj*4J;8!8EBy5Shg7(^gc>&AhW&&K%fp5%101T+q}K=U2!!ZR+L`2pe;1(yhCD5 zwZLA;2r!@WQK-ns$WLFsz)Bk!GrmY|iT$d|OtY-O3CYmGMWK8=bZ|_=(b>~egE`;B z&DC`utbzl(e>s=PLdF(@$Qo;F>;K4_clR(EnVF@3${I-&7|nq*XIAU@RjD#F9Ja!- z1gAUx{SAmEZGM?Fa-d@lh@@~DD8%M>?%ZkX;BXAvqz+>)+VLR1jdqa4x`}xGPujwJ zjrkWlZqbNgA0GNlNuA6sD9GCRDA|r(xQNS{?CRYFpMIBcClzE-x)A0>$IUe54MLV{ z5YKI7rd=<`4U$-_CQ(64=M>`}9L2G*vBc3jiKCFeFf-JY%#xS?czdS-j34BuI)Bic zdm|o%rQaRgNkv&y6rbx8JJcqgxpGr3w#j*=j^6?ni&d~S!D(vw4hk!~PV_BJXp*+! z*WgV`k!x(MK7_Aw8b^7^?KuC1QSW&W@?d1=cj}_1HTsUh>3@C-(>ADeNNAuaxTPcrHRdNQYOyka!)+4~pt_Se?%`LR z;xnbVV}q7fEhKKOH~ewy)Ya|Slm*-y!(D7)Ma_K*%o**nUm81s`t?3R<$}}M49N5# zO;E?-RNO8Q>V&^~b0AxTn{2rwaMM6V%>xSL3uu>2xLgQhlQT=!U!rWP1^I{yYZ~lH zCiu;Dr4yU|b(q->0jx?`SqgmC)WAIw&;orf@uOty$OokjUf03z=V70$*Vfi9CpRq= z6BFxuqRFa7_Xe7xHZ?Q6iq)$~_dm)_vy2nS?9xW&ct6KH?@M@!S2w7Qj z=(&&|);AuKJ$mZYdgjW#!lRHK-s#T|KF`4lq}0^Zf;%qCq)Ex|YizU%>b>pm?R_vc zRSXGr(F4tL*c4;KurAeqW_0EIH*LSGYHF$oXUzJ|^&Mz>+qx9d`YfxIVcpv04@u z7P_>TibzHZ0gUm@th>A0*2$^4z=W}M*)l}U-VX0sxfY*Qo3UcUk-WUm9lIV^fIX2} z*E1>gbxsAwdp~^&w6d{TYiukBsv-@H2jbq;uaTU`k8PiyHdu7U^IHAuYulqIMoAFE z)@W)<+`D%Vl!lF+oh0gfNr@P^e{hY~PEJeofU`lfu=n>@z+N=MaRRq@2)rNV)8nJT z@2b%EV~6$~IkFUaoQa9NiHS*l&Du`{aQhXwH+5(=#3Ug)*1bHtRYpZ6C+V**r214z zInzX4$S#&HU5fJe_fOoltD&J`-itFv$e}!K6uCrNS{k|d=FO@(bLK2qw5Xx4Za)P6 z0|_6JB*5sp?lCk$heZuEFCHT1#U4bGY#KpPcA?gW4GpmOE{Mljcuy6aXct?-SY!Dp z3!^+du-4Tf9pP_A2VlmeeOgNzIH%HHIGOnLW(iBYVtfv6^)iTckbN8)b|_e zoVEKYtaXQkm(nQ~GAVfY2Jx!TxY1AzKg z4W8SD1hSHnb$$=x9jC6&zn46&{rZM~PG4U@@aeQd%k+=!L|h&=GXz-6GC}dyXhKH= z2RD-ik+|;JvqhU9@s`~U>t4gmwFDg}4-1F*+3qmBukUG|ofzK+)Lv&ArD)0Pt3LZd z-u1WIs95{?74S@)R;*r~3HkcRiWX(dl$3`&lRqTHrj?s_W*^34BcsF5WXY98Q$y+qe39R*cE(Z(E%W;ALmX4_goK$fL!PTdlU!K_L zGZ#S${GQ0RvabpPh7{k+h|59y-9z+iMMVWtafpeDDIuauU^oMX>B{wQ?}V2ATkEct z1-3xFh3IQt>T@|OYirQg8@QaLu3rBN++g$_kzWV_bX-8s-S9SA)$!xUm-D{1T24vr z2w=Sg{!3!L9JEK2I^=1iqodoX)C;`zI_trjLECF>-h2{kEhacNi=@1UIHQz$az!l| z8)%lcvZ~uaCu?84c=5SCkAqGC7kmLkoDB}^lYD!N{7&jB&RM& zLL_Grvo2fFWDTItH85H@m+%ZR2)7Vtv%1**&5dUws}CJmvmB zGtS1^z4OMP90a2@w6(J{cXmF)lV1!SAerA&p@-{k0=K79n$nUDi8{9rS~df41@yU! zPg8_JTD8h3G71pC{{UNtA{1TRzuwRQ1S%=35%6pHJ^Yjj1%R3w-0SN*GK-4VKt?7H z+!zW;Nl8h@(I3T-s)4h!D)aJ1NHvB;hl3ET%cg*faQRJkm08o#)4X;fbmidWztg>;!#64Q4Gor0j7EW=${<=D*66b5 zujA|8puV!ZCvyl$p>fKDE~*bq0LeZf$BO##)&K#p0HJ_%O}wcQ9Y9h)n8zMKySw-s zXZgX*^dPPxyvOhfvCXxg%sc?h3$;R^(_K(P3*UU9 zmo=l*kS={AxsHB14URAhG(H6XjehrIFNH9@s`H1Z0V^NwC<~Q+g!6yY>m|$gN=Rl^ zC)eE2fUMg+rTS^MrFP;Z-c2n#cY!_uVPeiZze#uwRB7j-`Ucr7 z1d%86&I~B~qfip>kaqztb`AD8{~L0y=zSrD@@I~B`d2Tngq+?T{yoYEXi*LkuBUpH z0H|_0bQSw`DM}TKRR+*p$t3cnann&fH_kwO9H+mvI*@?5h2v`?1mF>%Lx?i#e=%R@ zUH7lahQrdIgA+lKduYc@^~aB7Sa?aW0Ti5oJ6nWrkqTQAxuWOM%e$d(bO`56eWtQ} zAwti*<#NWldf&6c`I?qc=!pDa3fZy)Qd5EY%4(=&UH>3%Ritcc}65Wn3V;U zGj2e~MHl15QJ{w7^`fl(h_e)2ahe3|wfW)bzFeGAc0@N6uhW(&X@lDYn22!P7*?JX zS_5i1OF&7$Q0K$m87KWL`6GbnHRhxCfFD-V(Sg!n$ez3nUTd_q?Wd&9l;h%{m%vmJ zYTjW<6sS6P{@L>DPstVMK}`bn6c@P7#^Y}sX9^jr!V9FNkWys-P#L=!m_#Y3d=bA4 zshnkXunU{T&JRo5MO)*iN!DDV5)vM-K@C$91wg?Pk52;}n%U9eURqOj-w@Jegh-NE zX+Y}we*8ELCNYG$IG^^iz#NJ$PzKfFm-!=I+`%_M==-;pa)8z>^u1K?EVY%s@=l- zy!B2{l-)a99)1PoVKEd^t^nOjr_({?$m#Ja;%i|Y6XALlsj?* z>f2SmNb!5t=79F8f=nm{tq1iagrj;_Mx5oXzuzcQ%oKKJ3r$X3;Sc6QhcC~WWrCv& zXf3jCE0cQ)RgQir2!ajTv5P`MK6d%PFUPe+eHQt}6WlYhv(uo|$me#iWoEQhPkvbq zRiQcH$&UT0Oko%H9MdEgMfO%NSiHCiiXkN&7kd{M8Aw*3GGGEM3_qo)KC5{Der=#X z{~{HX6C8=gD>te$AQ(BYi$kGmp1&nd8(e8RqDB}}dyzL1z;k#dz?_lSAL=Aj`lBCJ~vZaRd#_rNgaC%{d^a1(O*c4V(IEKPIWeu+|! z%s41R;Cpis01Q##f4*n&tq)o>%MwlZf?K7)8x|0Q+B8i-h>9Z>i#>Z#rjwtJ+1lD3 z!9G!kDkObY&CdG<*>PCB)+SAnpzcWopr+1YmyVP=wr>GG+}yaX!FnYg^j|U!I@Z5A*1U%+~3V zCPXPnD)TY4C4fAUv>D!~AU7VA@vb0?g9P~_1vT!1n$8ix_3$2(n1nwesZB`Vk~c;^CATva2ZRgf1zp?(eu{DL2oO*VOmYB7 zBSIoS4h$fnf{?E}XTO9r-rHMl?%cV3-@h+{@KL~<7Y!45Ic+v z^)Lto6Ar$AW@U!Y=x^d~2*j3yWE7t4A3^l?BOoM{bpL#lP?Yxy3?WM>=}9Omx&{Tw zdU(5f2D|!)$OaI|a0%}F2YPrDy$K$F+9=8^${&_jKCGaGRZx&n(pFN24@E^;byWqs zKkZ#T2?2ixRFRd30S=kEx_bwZ14Fzd|Fj^GT|NJdW~Fl2&%!mz$V#6`a8_3jwp5Pr z{?jIm5FFwi81Sc=0*o&UkNX`DIWmaw=duSO%-fy7xT=JLH~JeoJkk4au+G{41$dfjkSY4t(D}p^=!R^ z)U|CKrYmJoGw(?iivqLLdoBFF*ll?<2 z{d}S{4I;xL&BN8)(F%r&3f=@&csYzVH1I;Yo0Ig+@#@xYm`Gbo z6;m~mpLZnL*4@I=+EvXe#N5m`(AL<@!_3GsBE%yyGAcA&UeVCaP}fffP1ZH`@bDwr zhD2D}kpm6o6;)Mze6)RWD3Yg@kB^c!$`GxJM4>$4F##cp{%-QFkw)lnTQgk~MI&8P z9Tk10zyNPEcN7YiN#By}ZyI8$7_3L|v~!E_G_ke}4lu`u==l2t+o5oZCgwN=4ABVf zui&QcjmD~akyP<08^&v>n44=yl98cgJ8fdPxxR9gqDi2sKN3SAn}o{~-Th!}D@b7- zBK+@V8i5Z|Ggr5W#Ca+Q!5y+WQr{-X&)36BG1AnE5r%G*B_;-qhuCJ z3XxYc5B0Jokc_ z1Ak8sy+8wFWt6*~nwd6M)r1rorlJ;Lr9cdJSMxSgQB?OfRkKvnLmDd)4PlJ%D3S^z zavWp#D8Z=u|LmCG+Xw#siwR1ok~bZf5C~C(k)Ad-qG*2D7mHoyXI?BnJ}PN*Kx35p zB0Edh32l>qHgUl2g57l&%5g8&D_%rGS=zPh21n3VO3m93Nq4b_7)maAO;F`;?+;dI z-ItZmu3&nclXqOPbM=E;&Mi0Mw-@mX$2tScS4HKOIzK$%kW*?FHp&rSe6q*<=x6aE zqfMNg>J+N6p7{PeDbDP4JY7#u(T%p7vpxBL@S=FafS-O?m}=Pk;F*MkEia0-M7p}V zc-4c&*_k(Q+Pt~zwx>CH=JnS3p_-(c8nsiWPJNi4&-gY!bOoI+J3VmwAhdCn=amm0 zH+=HsiKwjX&TZSa_22d72@Vdnu(y|9yOvYvO3Uev{k8tx(8%cV+qw`=LBVvVhN#Cw zLjofsBfQ6=l+*S1@0E2(-XWms^8M5B)An}lxHwI-iyCKMzs6v(*hW9q&9zRg+}zxU z4j*ozS(RlK7iSg~34VOnAdr%hg0FI6f)VsHg)^$E+^rb`NfeiQbaZvIb8=46=~7+QAA^@?ael-1x%chcmnFW9`5+-`|sGz2%raXVf(`V0i3#DLBQH>AZa&2a2=T~O^{ytu7 z_ntkdHWCdMm|YOL>og08J_eIBjl3EpgIlwDo-b!G)p3ziNGKycoxO{cpb_=;P-$uD ztGW=+n+|mtvLNPAp49N0p}>*sdv4gE+APmW+f;m@<~!-shs{^TtOj?H z3|;Z`HzvWsiitagQf-_fQFqNX>Wm2l31a7^jLVlr{RVEKU_915DJBHl_U#HDPj~6* z>wl@t^21tLolZ_>-LiFS-A|R;t4C#UO^_=i3k#WFzmmHwvGX4upPufy!86%eET_S? z?FlB-z0B<5sp4XhVsiFCD!23pXetu_(~``!`vi6N+V0)EUqSA2@$jTkN{!B(Ia51V zQC~$G)9 zYeYmwrckuanlL?8u(o4U#qoQEP6w1;y}D)ie&`;d(?ut!bjv*l&7OQ7YeThN*2=zk zF=KHts7t|+D1+M(wcKMT8s+r`Ah^x8yOs<60_c?`zhDLm8KUmT?H?Qdx5)dH!?D_MFWZI#S$rq1v zB+wAf5s2Dv@Q!zXOEuAN&0x^rX?S5=J_%t|iN3u&ey6>3h?*0=V^7W~8OvepuYS zvHk<{P1I<&Q|vMhYh$B!B)(gK|5{m@Ze`yU$NDe^tnu^n1LmgXJ4J2#wb~hfxo<8z zJA2>w50|v&B#yC>B$0n!H2PB=3kroQb^j@GwmkvTY3y#FQ}dUJ=S&XqN==Q8$Nl=N z9^28KV?J*cH)DPl{V#bM3xnx-yaP3}NgPM4mWxYSY)bJ`M(cy1MRT<`7O_ zS&2B8pFj5K*SZ{Z1c=Sb&E4AIlqrGE!&jnn#BbWy?BtPi;`%AH>U+?v==j3B21pOa zB;M3b+DVT{dILn$>>~eRy6ei~_wNR=vB$oA`NG)Rzt$Jxdojmi*OV2Nl$a1Ul};_= z?PobfL^8X}%yo0bV>VW&u2)vJtu9TGzJ0Vs^!+N3k(S<$a8c%02z+;RZdn)^gotVo z1{PsuXUF#J(aM)~Je8T53HibT`LcEE))dMsv7wqkgPC?Jo;qch5&8iSAKyzjefpBwFgiTI=#4{#8O>d{c3I*NgCZ^R;=lN7vkDzJ4lIuE4zn=j{mtZ1sLs$wt;IpVe=%!g!U@8!+H#$KE(3~X|%7FAQ@$q{#L zN##by{X~*Agp7@i5eV4Hd~3^dNv*B=bB{e__HOSjw`YMB+|DC=`QE*~XAhd|!~FR8 z_+V}5F($YMJYDKqp64&E)$u*PG;18L#Q9MizAjh-arydnR*j20Z7LidKR(S;xIVZ6 z`9qfC6LR8|XW>^5JwXc_wE$g%13l{hqmSaUg!# zjYh}&`Q4OqD)UK$IdQm8ZeP>1$Ki0jow>QWBR~`Kg)d)rbbq~dL*S9w4vw^+7aF3! zkFHJ?GeCl|u~BJzRif_|-WkhKd)EjYCZWMRaFR-QW7#R#SmoLb`}iQQq6h2i?(Vw38r1=E|{@#%l6Kh&4Fnyf}Txn9EYy_yX2aTKPy=i-Trn`)RLyG(v zhK7c_{@|1P?E&_{z(9ao{Y#fFy`)T{W&z(%fKUONXTYj9kmY-06sQ9Jpy^lp^iU|^ z0LAml-n%J+>SBPj0Q#Kf$CkM?*S}f;8ZsRT``FlD?GE9vRAW_2tEzTwY-|9`ZT=c{ z%pwhLE@+L(sUPcZ!V|uOw&fy*U)$7l$KXAGX$WZ>8aE~-EzQZxdq{(M z_%cB3^@<9BqoM@rEVGZV@5szd3Zz&vWwaNvnZ+n4Xns%ys5%8Gx%A;fVU3HFHYaZJ z{rfiq)&V~_0LK%VcM2wh{7I&aSeqQ!!@PqZ0ZFKg)XGhCnc65)a zgoMOM$B_j+ZS9lOhYHStf~;_?cLO{ty^@tyjUDbExb4ZgYu5?F^Sl&FsU)adl#7cf z#BvbSMk7YzNlS}%W#3ri$<3u#t`Fur$E64#i*o5IMM3}LGPq5MqN9k1!n+e z_e)6pl}E#Gjx0Pl4U$XfHu0qn3Uy{0nToNtPQ0MxIZ8S5sgaJmq1U$Wj4SPRu^k}) z{qO}!``Lr_>jJN18T%_eU9Ydgu{vtm2Q*m;XfiP%BTeC$MeVN(??rt3D$caHaSF9d zKwei9U-EyQAL8LS_H|dz*|R7Eu`}+p98=Kmy95NbLynjfAvq76H451}^y<|KfM@rn zgl!DbaLv4!^7gGmSGA!8L(+0+{oGYjQsM=YrZt`K^kMsZ*T1!wr>3%rA3V4piR2X) z7UtE8J9^K5=)fO6>rovtWu~X6ciFsHbGo~XgZSe7NsuS3Q=PDH=dT%~(bfJ#swTyn zLf_v-%Q3U_o_PAy@G6y>LeZCM!$=GWX~hYC{`@&&@`C4wxw*7z_ck$QWv=aeWsdv! zNSPHOM_wNVP?x`8!YB|xWi#pyS;zY>5I+7kaR=~nUIjc z$j!yCUlSg?G$wQI-^I;+W_sF-Q5O}e1?m%t2ZBRFEFB!ub8>c{%grqT!P2;VWilVW zf=+8`X?gncB??-p2EI#=T$*%!c1|)mHMI#wk|&Moff5lF6-B@_C8wpGZuih3k*Yr| zuzK^Ma}yZk1x#G+*(odzxtenD(ut%b7Q31N&?2wyhx&q?YM!r!%8uyc zuo|8;&yf(ILG zbEkIiQGtmc`9lgxfZlG4A09InT-@kXem;+WIxneviCsif5Y`&X7x=9Gwef=l3dePQ zZCTdL{EZ;Is5+y(xN@b7j*~ViRNY}~Yg-$$st6kDG*HbIkl*o98z3MS7z00e@W29x zJM-d&38+x+9Pxbz4lu(jg>)U>x5kamb(pQOpGn*yP!RhN*rw)Plr&kxF-^9!t&JuA z$I$zr**7$zh`EW$_%~ynDr~z%z`fjeCT3=4Y1{7_!7$my#qr&pq-Y5n$oTG`J=U{6 zZ=Kq?@pSR}^z`(-{?yW-XbDd@T8>P>TVoc0ml$b($$(06wLB?xy%~FNG<2~9y^?ivgWfk=c}B{*6FA%m-FDSxA0+prtm z^D;;}bVoqtr!+v&f_txje5%j1ry<@t4R1%|n&awoi9}*5WxThx;XddaW|A~cGoW&? z1=Ev!tsI*p9zd09n#V;0eYcfkkJL8!fHpo;o9iP`V-pHWg|!Cry?GuNi>I@NL)jTX zeKL#_phZ?zR%7`&!5sMK_k~k$ zYjgQC^aH5k+XE^`tFeyh_L6mMH8u)(x-2x*8~rwGCxbgUYHe)XJm0g5rz--(;cu6p zu$PqNtg)GLr9B&OEk7rKplz$MiLAy7L8m(jLpP4%>0w@L?H%w}>d=jKJpJ(3q4IND zE$u=<(RYQ=%W^@|689-XzRzn-X$3EdP$akmBmy%x{#;#R6ua5`4Vql!Mdjsp9gF^^ z2Ws%u!`Nsj;l@7IFC@a&3#gx0Wmq4KyFdlthv-uTQ()163ZOn`f}&T)%xou+7wSD$ ztZ+b4q-How;ONn#LEneNo59@xtelE@d;BbQZT(KuMOI#>eqi_xITRU!GkQTtEHg~dIyyQo^1M~xbpWnHeGnJqeQ9*m?c>|JJs|260Rn4DW3Omd2LTs<>rFE= z3VJCkdMu_kPYQjvx*CX~ea*N11k+}D-(H!RpP$f>Muwe6qm^FCZVl3e(v24I?g1Y}sy)|R&dJZ83RVpkhfARl@^9Ewy1_-(ZQD+Y z8}S|qlhIuHuo-x!1u63E@(RXZgEz&jtoe4QW*Q(CUtGk&nc_tTi8AVxt5?N=7*E1@7dcvTXMu>j!0pg8FxbC; zzb;v@gd%(_6|^|{(_22M#<+x%xK1p6mZo+jxfw6d*Sv2nuX&dWf?;g7=LRtNvs`JL z#n))L5=I^NFs2Tu9x*kRDe147kni(vGlYX)|9_Yv!Au-sF>I$ZEbDY_>6sZ%u~&ArBk|wG!P{`p!p2V&BJGweO`jP?z&+k2NdN@ z=E~um(iJY9Y^GA9X5UDztgcGVY7-9QtKGK#TwnhTHB2f+XXl3)WYUePW&*V!E9(Rh zM`>+s|4iQm1soYtpJTY|SZfBT8X=@e$HcSMAR`)VU)~J;GA9;CHNrElKUz}tLrg72 zda`+jI#?6v9J4l4W>z1w)&K?oJFon4GP@5`N79^nv}Tbtop_s1NP~PlAfV!7zG?j7 zBS!?FE`X}0^vWw!$b{g@7$g<@lBo2cp~2GH`oP>oj=!u!EyCQ~{GqskE3DCno2yw3 zSRg-!d>op{9^15OlZCAu4ajB++Su5z$jQldDX7P_fSLuh;v5nU$7R4FWaZ%C5o$h6 z(mZEgv6@B2Izz=R<9Pqgi2QgAI#1>?6lHqg4i#}MXSr(%%J#(m_~yE@II{DMXkXOV zE`!fKHqI&FDN=`B<6Z?!;)(_jq=xYc{#Oz!Vrzt z4GIEprQpe`g;w-ba|OoK+}wanzVp&X|Jl;pkj|0Ck>*l&FSaS&BOfnt)HBLQQ3;8b zYfD**{sXtRa&mJ1_iiEj?jINCu8M%&y?==bKj{lmCfs zt#LEQhx&zwA>xJ4xp{c(7eq}#J}dYSDucg}>*=2i0xT(o|>K{kpItU_V5C|MX{qks>ED zsDof~;xw~jKaZk*{&@c@(X8zD#<`2?AqQsX<_d?s!K+|IfoKE|SRwL@2iPB1=yW!) zR%T{qs_-%qqbUa$flEq3k>!Ywd>puqII*@C^>a+*m&L@7TIc)ZZQxaxx?ks?I=#fy zkEa8^QO0+d-oMYEFXw!3qyE7IL7)j(5cqugNm*z>w3k-!Fbqu-7TqOUmNyjq|z zNO_NS?;>by79U8MmPx^Gr~-4OTrxk1vjtDydRRPY{K6EMscA0PjwuTSkqEzl$Y zJ-h;(7J$EfvxWra8@?e*1;MaFfKS_^7aEeFG>4UhLj#7-4pIT?)WiY5R!|E;FeCZz z%?wCZp@NLqYahGQ0ZkxMY3rNEq1FW}=HbSgFRU*>f=Ye2$pyu&fe%*?fMABIp?qp{ z+aN`v(R5N#qXKd5PhsHEh!sD_6FzTY0MP8JgL>j}^ITB>#Li~07R zRK(H2;^IzgZEdB03XL#@sy7jI$OyopzQ6yxNSq^NC1WmQolBr@-Rt-bTu>L)Lc;So zA8;yLmO8cMes8{wm0QE!ntoC}V5Ydfdk{&19UcXS%3`m5U<#$gr-)w@netuj+x;;pdLBjKx{+OdZa0uW*APf{{ za2?khGuHi;s2zGJ@RaVc@$($E#@vXe z=4OzFV~Z16OCG;{no~i4NUR*oblJWp;E<$bHiHAfpw!M3J_ao2Tf{Mu69OEGLo9yz zqT}dz(J$YCa)U}y z|MqaEnTt3GLA?x;KRLHhalLyc!p{h7GR0SSeQmlFraAspoDzB)_hX*XKuSsqJf(BDZYjPfQr{E)mc(LRZYQC!b6ex; zio0JunJ}i!|Hdq&O z5Dtc3m6?mcerHi4zGyTMiA`Xz7A4FIxVrzIzW~F60?g*w%*+l)KjN=nzt%I@zhg8e z`N|-sp$ps;#`%EfrAX$74<9n>2ylU_T^?_`dhOcilaxKOFRd&r5Mcal-M&{8tfR+| zA5XugZa-jh{siEysGM9UHIh<^>4V=Bg))8%@U(%X=>SF4nmwGI0JnmNqYDSaupM@Q zR%M(P^D1nDl8wPmU}YqkYp!m&aNz>O5h9Tkz+JZh1FxWfAJLb|<^*5CLIUNmAGilv zt&E>FXE?PF0KotMj!{=7h;wQ?rr`omD@a$t=x-mjF__(up9$XG*G6W_iuIu&TKhJ? zT}w-gJlDH}p}=8Fb8>MdfCX0yx(ZaV0LaQ$Am5=B9b -- bash - -In order to replicate the container startup scripts execute this command: - - /opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh - -{{- else }} - -{{ if .Values.usePassword }} -To get your password run: - {{ include "common.utils.secret.getvalue" (dict "secret" $secretName "field" $secretPasswordKey "context" $) }} -{{- end }} - -{{- if .Values.cluster.externalAccess.enabled }} - -To connect to your Redis® server from outside the cluster check the following information: - - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "common.names.fullname" . }}' - - You will have a different external IP for each Redis® node. Get the external ip from `-external` suffixed services: `kubectl get svc`. - Redis® port: {{ .Values.cluster.externalAccess.service.port }} - - {{- if not .Values.cluster.externalAccess.service.loadBalancerIP }} - Once the LoadBalancerIPs are ready, you need to provide them and perform a Helm Upgrade: - - helm upgrade --namespace {{ .Release.Namespace }} {{ .Release.Name }} --set "cluster.externalAccess.enabled=true,cluster.externalAccess.service.type=LoadBalancer{{- $root := . }}{{ $count := .Values.cluster.nodes | int }}{{ range $i, $v := until $count }},cluster.externalAccess.service.loadBalancerIP[{{ $i }}]=load-balancerip-{{- $i }}{{- end }}" bitnami/redis-cluster - Where loadbalancer-ip-i are the LoadBalancerIPs provided by the cluster. - {{- else -}} - {{- if .Values.cluster.init -}} - INFO: The Job to create the cluster will be created. - {{- end -}} - - To connect to your database from outside the cluster execute the following commands: - - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") - redis-cli -c -h $SERVICE_IP -p {{ .Values.service.ports.redis }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - {{- end }} - -{{- else }} - -You have deployed a Redis® Cluster accessible only from within you Kubernetes Cluster. - -{{- if .Values.cluster.init -}} -INFO: The Job to create the cluster will be created. -{{- end -}} - -To connect to your Redis® cluster: - -1. Run a Redis® pod that you can use as a client: - -{{- if .Values.tls.enabled }} - kubectl run --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }}-client --restart='Never' --env REDIS_PASSWORD=$REDIS_PASSWORD --image {{ template "redis-cluster.image" . }} --command -- sleep infinity - - Copy your TLS certificates to the pod: - - kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.cert {{ template "common.names.fullname" . }}-client:/tmp/client.cert - kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.key {{ template "common.names.fullname" . }}-client:/tmp/client.key - kubectl cp --namespace {{ .Release.Namespace }} /path/to/CA.cert {{ template "common.names.fullname" . }}-client:/tmp/CA.cert - - Use the following command to attach to the pod: - - kubectl exec --tty -i {{ template "common.names.fullname" . }}-client \ - {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "common.names.fullname" . }}-client=true" \{{- end }} - --namespace {{ .Release.Namespace }} -- bash -{{- else }} -kubectl run --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }}-client --rm --tty -i --restart='Never' \ -{{ if .Values.usePassword }} --env REDIS_PASSWORD=$REDIS_PASSWORD \{{ end }} -{{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "common.names.fullname" . }}-client=true" \{{- end }} ---image {{ template "redis-cluster.image" . }} -- bash -{{- end }} - -2. Connect using the Redis® CLI: - -redis-cli -c -h {{ template "common.names.fullname" . }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label -{{ template "common.names.fullname" . }}-client=true" -will be able to connect to redis. -{{- end -}} -{{- end -}} - -{{- include "redis-cluster.validateValues" . }} -{{- include "redis-cluster.checkRollingTags" . }} -{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }} -{{- include "common.warnings.rollingTag" .Values.sysctlImage }} - -{{- if and .Values.usePassword (not .Values.existingSecret) -}} - - {{- $requiredPassword := dict "valueKey" "password" "secret" $secretName "field" $secretPasswordKey "context" $ -}} - {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} - - {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $requiredPasswordError) "context" $) -}} -{{- end -}} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/_helpers.tpl b/rds/base/charts/redis-cluster/templates/_helpers.tpl deleted file mode 100644 index 2c137aa..0000000 --- a/rds/base/charts/redis-cluster/templates/_helpers.tpl +++ /dev/null @@ -1,254 +0,0 @@ -{{/* vim: set filetype=mustache: */}} - -{{/* -Return the proper Redis® image name -*/}} -{{- define "redis-cluster.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper image name (for the metrics image) -*/}} -{{- define "redis-cluster.metrics.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper image name (for the init container volume-permissions image) -*/}} -{{- define "redis-cluster.volumePermissions.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return sysctl image -*/}} -{{- define "redis-cluster.sysctl.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.sysctlImage "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "redis-cluster.imagePullSecrets" -}} -{{- include "common.images.pullSecrets" (dict "images" (list .Values.image .Values.metrics.image) "global" .Values.global) -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "networkPolicy.apiVersion" -}} -{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiGroup for PodSecurityPolicy. -*/}} -{{- define "podSecurityPolicy.apiGroup" -}} -{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "policy" -}} -{{- else -}} -{{- print "extensions" -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a TLS secret object should be created -*/}} -{{- define "redis-cluster.createTlsSecret" -}} -{{- if and .Values.tls.enabled .Values.tls.autoGenerated (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) }} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Return the secret containing Redis TLS certificates -*/}} -{{- define "redis-cluster.tlsSecretName" -}} -{{- $secretName := coalesce .Values.tls.existingSecret .Values.tls.certificatesSecret -}} -{{- if $secretName -}} - {{- printf "%s" (tpl $secretName $) -}} -{{- else -}} - {{- printf "%s-crt" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert file. -*/}} -{{- define "redis-cluster.tlsCert" -}} -{{- if (include "redis-cluster.createTlsSecret" . ) -}} - {{- printf "/opt/bitnami/redis/certs/%s" "tls.crt" -}} -{{- else -}} - {{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/redis/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert key file. -*/}} -{{- define "redis-cluster.tlsCertKey" -}} -{{- if (include "redis-cluster.createTlsSecret" . ) -}} - {{- printf "/opt/bitnami/redis/certs/%s" "tls.key" -}} -{{- else -}} - {{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/redis/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the CA cert file. -*/}} -{{- define "redis-cluster.tlsCACert" -}} -{{- if (include "redis-cluster.createTlsSecret" . ) -}} - {{- printf "/opt/bitnami/redis/certs/%s" "ca.crt" -}} -{{- else -}} - {{- required "Certificate CA filename is required when TLS in enabled" .Values.tls.certCAFilename | printf "/opt/bitnami/redis/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the DH params file. -*/}} -{{- define "redis-cluster.tlsDHParams" -}} -{{- if .Values.tls.dhParamsFilename -}} -{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.dhParamsFilename -}} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "redis-cluster.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Get the password secret. -*/}} -{{- define "redis-cluster.secretName" -}} -{{- if .Values.existingSecret -}} -{{- printf "%s" .Values.existingSecret -}} -{{- else -}} -{{- printf "%s" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Get the password key to be retrieved from Redis® secret. -*/}} -{{- define "redis-cluster.secretPasswordKey" -}} -{{- if and .Values.existingSecret .Values.existingSecretPasswordKey -}} -{{- printf "%s" .Values.existingSecretPasswordKey -}} -{{- else -}} -{{- printf "redis-password" -}} -{{- end -}} -{{- end -}} - -{{/* -Return Redis® password -*/}} -{{- define "redis-cluster.password" -}} -{{- if not (empty .Values.global.redis.password) }} - {{- .Values.global.redis.password -}} -{{- else if not (empty .Values.password) -}} - {{- .Values.password -}} -{{- else -}} - {{- randAlphaNum 10 -}} -{{- end -}} -{{- end -}} - -{{/* -Determines whether or not to create the Statefulset -*/}} -{{- define "redis-cluster.createStatefulSet" -}} - {{- if not .Values.cluster.externalAccess.enabled -}} - {{- true -}} - {{- end -}} - {{- if and .Values.cluster.externalAccess.enabled .Values.cluster.externalAccess.service.loadBalancerIP -}} - {{- true -}} - {{- end -}} -{{- end -}} - -{{/* Check if there are rolling tags in the images */}} -{{- define "redis-cluster.checkRollingTags" -}} -{{- include "common.warnings.rollingTag" .Values.image -}} -{{- include "common.warnings.rollingTag" .Values.metrics.image -}} -{{- end -}} - -{{/* -Compile all warnings into a single message, and call fail. -*/}} -{{- define "redis-cluster.validateValues" -}} -{{- $messages := list -}} -{{- $messages := append $messages (include "redis-cluster.validateValues.updateParameters" .) -}} -{{- $messages := append $messages (include "redis-cluster.validateValues.tlsParameters" .) -}} -{{- $messages := append $messages (include "redis-cluster.validateValues.tls" .) -}} -{{- $messages := without $messages "" -}} -{{- $message := join "\n" $messages -}} - -{{- if $message -}} -{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} -{{- end -}} -{{- end -}} - -{{/* Validate values of Redis® Cluster - check update parameters */}} -{{- define "redis-cluster.validateValues.updateParameters" -}} -{{- if and .Values.cluster.update.addNodes ( or (and .Values.cluster.externalAccess.enabled .Values.cluster.externalAccess.service.loadBalancerIP) ( not .Values.cluster.externalAccess.enabled )) -}} - {{- if .Values.cluster.externalAccess.enabled }} - {{- if not .Values.cluster.update.newExternalIPs -}} -redis-cluster: newExternalIPs - You must provide the newExternalIPs to perform the cluster upgrade when using external access. - {{- end -}} - {{- else }} - {{- if not .Values.cluster.update.currentNumberOfNodes -}} -redis-cluster: currentNumberOfNodes - You must provide the currentNumberOfNodes to perform an upgrade when not using external access. - {{- end -}} - {{- if not .Values.cluster.update.currentNumberOfReplicas -}} -redis-cluster: currentNumberOfReplicas - You must provide the currentNumberOfReplicas to perform an upgrade when not using external access. - {{- end -}} - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* Validate values of Redis® Cluster - tls settings */}} -{{- define "redis-cluster.validateValues.tlsParameters" -}} -{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated) }} -{{- if and (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) -}} -redis-cluster: TLSSecretMissingSecret - A secret containing the certificates for the TLS traffic is required when TLS is enabled. Please set the tls.existingSecret value -{{- end -}} -{{- if not .Values.tls.certFilename -}} -redis-cluster: TLSSecretMissingCert - A certificate filename is required when TLS is enabled. Please set the tls.certFilename value -{{- end -}} -{{- if not .Values.tls.certKeyFilename -}} -redis-cluster: TLSSecretMissingCertKey - A certificate key filename is required when TLS is enabled. Please set the tls.certKeyFilename value -{{- end -}} -{{- if not .Values.tls.certCAFilename -}} -redis-cluster: TLSSecretMissingCertCA - A certificate CA filename is required when TLS is enabled. Please set the tls.certCAFilename value -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* Validate values of Redis® - PodSecurityPolicy create */}} -{{- define "redis-cluster.validateValues.tls" -}} -{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated) (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) }} -redis-cluster: tls.enabled - In order to enable TLS, you also need to provide - an existing secret containing the TLS certificates or - enable auto-generated certificates. -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/templates/configmap.yaml b/rds/base/charts/redis-cluster/templates/configmap.yaml deleted file mode 100644 index 375e8f6..0000000 --- a/rds/base/charts/redis-cluster/templates/configmap.yaml +++ /dev/null @@ -1,1829 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "common.names.fullname" . }}-default - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - redis-default.conf: |- - # Redis configuration file example. - # - # Note that in order to read the configuration file, Redis must be - # started with the file path as first argument: - # - # ./redis-server /path/to/redis.conf - - # Note on units: when memory size is needed, it is possible to specify - # it in the usual form of 1k 5GB 4M and so forth: - # - # 1k => 1000 bytes - # 1kb => 1024 bytes - # 1m => 1000000 bytes - # 1mb => 1024*1024 bytes - # 1g => 1000000000 bytes - # 1gb => 1024*1024*1024 bytes - # - # units are case insensitive so 1GB 1Gb 1gB are all the same. - - ################################## INCLUDES ################################### - - # Include one or more other config files here. This is useful if you - # have a standard template that goes to all Redis servers but also need - # to customize a few per-server settings. Include files can include - # other files, so use this wisely. - # - # Notice option "include" won't be rewritten by command "CONFIG REWRITE" - # from admin or Redis Sentinel. Since Redis always uses the last processed - # line as value of a configuration directive, you'd better put includes - # at the beginning of this file to avoid overwriting config change at runtime. - # - # If instead you are interested in using includes to override configuration - # options, it is better to use include as the last line. - # - # include /path/to/local.conf - # include /path/to/other.conf - - ################################## MODULES ##################################### - - # Load modules at startup. If the server is not able to load modules - # it will abort. It is possible to use multiple loadmodule directives. - # - # loadmodule /path/to/my_module.so - # loadmodule /path/to/other_module.so - - ################################## NETWORK ##################################### - - # By default, if no "bind" configuration directive is specified, Redis listens - # for connections from all the network interfaces available on the server. - # It is possible to listen to just one or multiple selected interfaces using - # the "bind" configuration directive, followed by one or more IP addresses. - # - # Examples: - # - # bind 192.168.1.100 10.0.0.1 - # bind 127.0.0.1 ::1 - # - # ~~~ WARNING ~~~ If the computer running Redis is directly exposed to the - # internet, binding to all the interfaces is dangerous and will expose the - # instance to everybody on the internet. So by default we uncomment the - # following bind directive, that will force Redis to listen only into - # the IPv4 loopback interface address (this means Redis will be able to - # accept connections only from clients running into the same computer it - # is running). - # - # IF YOU ARE SURE YOU WANT YOUR INSTANCE TO LISTEN TO ALL THE INTERFACES - # JUST COMMENT THE FOLLOWING LINE. - # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - bind 127.0.0.1 - - # Protected mode is a layer of security protection, in order to avoid that - # Redis instances left open on the internet are accessed and exploited. - # - # When protected mode is on and if: - # - # 1) The server is not binding explicitly to a set of addresses using the - # "bind" directive. - # 2) No password is configured. - # - # The server only accepts connections from clients connecting from the - # IPv4 and IPv6 loopback addresses 127.0.0.1 and ::1, and from Unix domain - # sockets. - # - # By default protected mode is enabled. You should disable it only if - # you are sure you want clients from other hosts to connect to Redis - # even if no authentication is configured, nor a specific set of interfaces - # are explicitly listed using the "bind" directive. - protected-mode yes - - # Accept connections on the specified port, default is 6379 (IANA #815344). - # If port 0 is specified Redis will not listen on a TCP socket. - port 6379 - - # TCP listen() backlog. - # - # In high requests-per-second environments you need an high backlog in order - # to avoid slow clients connections issues. Note that the Linux kernel - # will silently truncate it to the value of /proc/sys/net/core/somaxconn so - # make sure to raise both the value of somaxconn and tcp_max_syn_backlog - # in order to get the desired effect. - tcp-backlog 511 - - # Unix socket. - # - # Specify the path for the Unix socket that will be used to listen for - # incoming connections. There is no default, so Redis will not listen - # on a unix socket when not specified. - # - # unixsocket /tmp/redis.sock - # unixsocketperm 700 - - # Close the connection after a client is idle for N seconds (0 to disable) - timeout 0 - - # TCP keepalive. - # - # If non-zero, use SO_KEEPALIVE to send TCP ACKs to clients in absence - # of communication. This is useful for two reasons: - # - # 1) Detect dead peers. - # 2) Take the connection alive from the point of view of network - # equipment in the middle. - # - # On Linux, the specified value (in seconds) is the period used to send ACKs. - # Note that to close the connection the double of the time is needed. - # On other kernels the period depends on the kernel configuration. - # - # A reasonable value for this option is 300 seconds, which is the new - # Redis default starting with Redis 3.2.1. - tcp-keepalive 300 - - ################################# TLS/SSL ##################################### - - # By default, TLS/SSL is disabled. To enable it, the "tls-port" configuration - # directive can be used to define TLS-listening ports. To enable TLS on the - # default port, use: - # - # port 0 - # tls-port 6379 - - # Configure a X.509 certificate and private key to use for authenticating the - # server to connected clients, masters or cluster peers. These files should be - # PEM formatted. - # - # tls-cert-file redis.crt - # tls-key-file redis.key - - # Configure a DH parameters file to enable Diffie-Hellman (DH) key exchange: - # - # tls-dh-params-file redis.dh - - # Configure a CA certificate(s) bundle or directory to authenticate TLS/SSL - # clients and peers. Redis requires an explicit configuration of at least one - # of these, and will not implicitly use the system wide configuration. - # - # tls-ca-cert-file ca.crt - # tls-ca-cert-dir /etc/ssl/certs - - # By default, clients (including replica servers) on a TLS port are required - # to authenticate using valid client side certificates. - # - # It is possible to disable authentication using this directive. - # - # tls-auth-clients no - - # By default, a Redis replica does not attempt to establish a TLS connection - # with its master. - # - # Use the following directive to enable TLS on replication links. - # - # tls-replication yes - - # By default, the Redis Cluster bus uses a plain TCP connection. To enable - # TLS for the bus protocol, use the following directive: - # - # tls-cluster yes - - # Explicitly specify TLS versions to support. Allowed values are case insensitive - # and include "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" (OpenSSL >= 1.1.1) or - # any combination. To enable only TLSv1.2 and TLSv1.3, use: - # - # tls-protocols "TLSv1.2 TLSv1.3" - - # Configure allowed ciphers. See the ciphers(1ssl) manpage for more information - # about the syntax of this string. - # - # Note: this configuration applies only to <= TLSv1.2. - # - # tls-ciphers DEFAULT:!MEDIUM - - # Configure allowed TLSv1.3 ciphersuites. See the ciphers(1ssl) manpage for more - # information about the syntax of this string, and specifically for TLSv1.3 - # ciphersuites. - # - # tls-ciphersuites TLS_CHACHA20_POLY1305_SHA256 - - # When choosing a cipher, use the server's preference instead of the client - # preference. By default, the server follows the client's preference. - # - # tls-prefer-server-ciphers yes - - ################################# GENERAL ##################################### - - # By default Redis does not run as a daemon. Use 'yes' if you need it. - # Note that Redis will write a pid file in /var/run/redis.pid when daemonized. - daemonize no - - # If you run Redis from upstart or systemd, Redis can interact with your - # supervision tree. Options: - # supervised no - no supervision interaction - # supervised upstart - signal upstart by putting Redis into SIGSTOP mode - # supervised systemd - signal systemd by writing READY=1 to $NOTIFY_SOCKET - # supervised auto - detect upstart or systemd method based on - # UPSTART_JOB or NOTIFY_SOCKET environment variables - # Note: these supervision methods only signal "process is ready." - # They do not enable continuous liveness pings back to your supervisor. - supervised no - - # If a pid file is specified, Redis writes it where specified at startup - # and removes it at exit. - # - # When the server runs non daemonized, no pid file is created if none is - # specified in the configuration. When the server is daemonized, the pid file - # is used even if not specified, defaulting to "/var/run/redis.pid". - # - # Creating a pid file is best effort: if Redis is not able to create it - # nothing bad happens, the server will start and run normally. - pidfile /opt/bitnami/redis/tmp/redis_6379.pid - - # Specify the server verbosity level. - # This can be one of: - # debug (a lot of information, useful for development/testing) - # verbose (many rarely useful info, but not a mess like the debug level) - # notice (moderately verbose, what you want in production probably) - # warning (only very important / critical messages are logged) - loglevel notice - - # Specify the log file name. Also the empty string can be used to force - # Redis to log on the standard output. Note that if you use standard - # output for logging but daemonize, logs will be sent to /dev/null - logfile "" - - # To enable logging to the system logger, just set 'syslog-enabled' to yes, - # and optionally update the other syslog parameters to suit your needs. - # syslog-enabled no - - # Specify the syslog identity. - # syslog-ident redis - - # Specify the syslog facility. Must be USER or between LOCAL0-LOCAL7. - # syslog-facility local0 - - # Set the number of databases. The default database is DB 0, you can select - # a different one on a per-connection basis using SELECT where - # dbid is a number between 0 and 'databases'-1 - databases 16 - - # By default Redis shows an ASCII art logo only when started to log to the - # standard output and if the standard output is a TTY. Basically this means - # that normally a logo is displayed only in interactive sessions. - # - # However it is possible to force the pre-4.0 behavior and always show a - # ASCII art logo in startup logs by setting the following option to yes. - always-show-logo yes - - ################################ SNAPSHOTTING ################################ - # - # Save the DB on disk: - # - # save - # - # Will save the DB if both the given number of seconds and the given - # number of write operations against the DB occurred. - # - # In the example below the behaviour will be to save: - # after 900 sec (15 min) if at least 1 key changed - # after 300 sec (5 min) if at least 10 keys changed - # after 60 sec if at least 10000 keys changed - # - # Note: you can disable saving completely by commenting out all "save" lines. - # - # It is also possible to remove all the previously configured save - # points by adding a save directive with a single empty string argument - # like in the following example: - # - # save "" - - save 900 1 - save 300 10 - save 60 10000 - - # By default Redis will stop accepting writes if RDB snapshots are enabled - # (at least one save point) and the latest background save failed. - # This will make the user aware (in a hard way) that data is not persisting - # on disk properly, otherwise chances are that no one will notice and some - # disaster will happen. - # - # If the background saving process will start working again Redis will - # automatically allow writes again. - # - # However if you have setup your proper monitoring of the Redis server - # and persistence, you may want to disable this feature so that Redis will - # continue to work as usual even if there are problems with disk, - # permissions, and so forth. - stop-writes-on-bgsave-error yes - - # Compress string objects using LZF when dump .rdb databases? - # For default that's set to 'yes' as it's almost always a win. - # If you want to save some CPU in the saving child set it to 'no' but - # the dataset will likely be bigger if you have compressible values or keys. - rdbcompression yes - - # Since version 5 of RDB a CRC64 checksum is placed at the end of the file. - # This makes the format more resistant to corruption but there is a performance - # hit to pay (around 10%) when saving and loading RDB files, so you can disable it - # for maximum performances. - # - # RDB files created with checksum disabled have a checksum of zero that will - # tell the loading code to skip the check. - rdbchecksum yes - - # The filename where to dump the DB - dbfilename dump.rdb - - # Remove RDB files used by replication in instances without persistence - # enabled. By default this option is disabled, however there are environments - # where for regulations or other security concerns, RDB files persisted on - # disk by masters in order to feed replicas, or stored on disk by replicas - # in order to load them for the initial synchronization, should be deleted - # ASAP. Note that this option ONLY WORKS in instances that have both AOF - # and RDB persistence disabled, otherwise is completely ignored. - # - # An alternative (and sometimes better) way to obtain the same effect is - # to use diskless replication on both master and replicas instances. However - # in the case of replicas, diskless is not always an option. - rdb-del-sync-files no - - # The working directory. - # - # The DB will be written inside this directory, with the filename specified - # above using the 'dbfilename' configuration directive. - # - # The Append Only File will also be created inside this directory. - # - # Note that you must specify a directory here, not a file name. - dir /bitnami/redis/data - - ################################# REPLICATION ################################# - - # Master-Replica replication. Use replicaof to make a Redis instance a copy of - # another Redis server. A few things to understand ASAP about Redis replication. - # - # +------------------+ +---------------+ - # | Master | ---> | Replica | - # | (receive writes) | | (exact copy) | - # +------------------+ +---------------+ - # - # 1) Redis replication is asynchronous, but you can configure a master to - # stop accepting writes if it appears to be not connected with at least - # a given number of replicas. - # 2) Redis replicas are able to perform a partial resynchronization with the - # master if the replication link is lost for a relatively small amount of - # time. You may want to configure the replication backlog size (see the next - # sections of this file) with a sensible value depending on your needs. - # 3) Replication is automatic and does not need user intervention. After a - # network partition replicas automatically try to reconnect to masters - # and resynchronize with them. - # - # replicaof - - # If the master is password protected (using the "requirepass" configuration - # directive below) it is possible to tell the replica to authenticate before - # starting the replication synchronization process, otherwise the master will - # refuse the replica request. - # - # masterauth - # - # However this is not enough if you are using Redis ACLs (for Redis version - # 6 or greater), and the default user is not capable of running the PSYNC - # command and/or other commands needed for replication. In this case it's - # better to configure a special user to use with replication, and specify the - # masteruser configuration as such: - # - # masteruser - # - # When masteruser is specified, the replica will authenticate against its - # master using the new AUTH form: AUTH . - - # When a replica loses its connection with the master, or when the replication - # is still in progress, the replica can act in two different ways: - # - # 1) if replica-serve-stale-data is set to 'yes' (the default) the replica will - # still reply to client requests, possibly with out of date data, or the - # data set may just be empty if this is the first synchronization. - # - # 2) if replica-serve-stale-data is set to 'no' the replica will reply with - # an error "SYNC with master in progress" to all the kind of commands - # but to INFO, replicaOF, AUTH, PING, SHUTDOWN, REPLCONF, ROLE, CONFIG, - # SUBSCRIBE, UNSUBSCRIBE, PSUBSCRIBE, PUNSUBSCRIBE, PUBLISH, PUBSUB, - # COMMAND, POST, HOST: and LATENCY. - # - replica-serve-stale-data yes - - # You can configure a replica instance to accept writes or not. Writing against - # a replica instance may be useful to store some ephemeral data (because data - # written on a replica will be easily deleted after resync with the master) but - # may also cause problems if clients are writing to it because of a - # misconfiguration. - # - # Since Redis 2.6 by default replicas are read-only. - # - # Note: read only replicas are not designed to be exposed to untrusted clients - # on the internet. It's just a protection layer against misuse of the instance. - # Still a read only replica exports by default all the administrative commands - # such as CONFIG, DEBUG, and so forth. To a limited extent you can improve - # security of read only replicas using 'rename-command' to shadow all the - # administrative / dangerous commands. - replica-read-only yes - - # Replication SYNC strategy: disk or socket. - # - # New replicas and reconnecting replicas that are not able to continue the - # replication process just receiving differences, need to do what is called a - # "full synchronization". An RDB file is transmitted from the master to the - # replicas. - # - # The transmission can happen in two different ways: - # - # 1) Disk-backed: The Redis master creates a new process that writes the RDB - # file on disk. Later the file is transferred by the parent - # process to the replicas incrementally. - # 2) Diskless: The Redis master creates a new process that directly writes the - # RDB file to replica sockets, without touching the disk at all. - # - # With disk-backed replication, while the RDB file is generated, more replicas - # can be queued and served with the RDB file as soon as the current child - # producing the RDB file finishes its work. With diskless replication instead - # once the transfer starts, new replicas arriving will be queued and a new - # transfer will start when the current one terminates. - # - # When diskless replication is used, the master waits a configurable amount of - # time (in seconds) before starting the transfer in the hope that multiple - # replicas will arrive and the transfer can be parallelized. - # - # With slow disks and fast (large bandwidth) networks, diskless replication - # works better. - repl-diskless-sync no - - # When diskless replication is enabled, it is possible to configure the delay - # the server waits in order to spawn the child that transfers the RDB via socket - # to the replicas. - # - # This is important since once the transfer starts, it is not possible to serve - # new replicas arriving, that will be queued for the next RDB transfer, so the - # server waits a delay in order to let more replicas arrive. - # - # The delay is specified in seconds, and by default is 5 seconds. To disable - # it entirely just set it to 0 seconds and the transfer will start ASAP. - repl-diskless-sync-delay 5 - - # ----------------------------------------------------------------------------- - # WARNING: RDB diskless load is experimental. Since in this setup the replica - # does not immediately store an RDB on disk, it may cause data loss during - # failovers. RDB diskless load + Redis modules not handling I/O reads may also - # cause Redis to abort in case of I/O errors during the initial synchronization - # stage with the master. Use only if your do what you are doing. - # ----------------------------------------------------------------------------- - # - # Replica can load the RDB it reads from the replication link directly from the - # socket, or store the RDB to a file and read that file after it was completely - # received from the master. - # - # In many cases the disk is slower than the network, and storing and loading - # the RDB file may increase replication time (and even increase the master's - # Copy on Write memory and salve buffers). - # However, parsing the RDB file directly from the socket may mean that we have - # to flush the contents of the current database before the full rdb was - # received. For this reason we have the following options: - # - # "disabled" - Don't use diskless load (store the rdb file to the disk first) - # "on-empty-db" - Use diskless load only when it is completely safe. - # "swapdb" - Keep a copy of the current db contents in RAM while parsing - # the data directly from the socket. note that this requires - # sufficient memory, if you don't have it, you risk an OOM kill. - repl-diskless-load disabled - - # Replicas send PINGs to server in a predefined interval. It's possible to - # change this interval with the repl_ping_replica_period option. The default - # value is 10 seconds. - # - # repl-ping-replica-period 10 - - # The following option sets the replication timeout for: - # - # 1) Bulk transfer I/O during SYNC, from the point of view of replica. - # 2) Master timeout from the point of view of replicas (data, pings). - # 3) Replica timeout from the point of view of masters (REPLCONF ACK pings). - # - # It is important to make sure that this value is greater than the value - # specified for repl-ping-replica-period otherwise a timeout will be detected - # every time there is low traffic between the master and the replica. - # - # repl-timeout 60 - - # Disable TCP_NODELAY on the replica socket after SYNC? - # - # If you select "yes" Redis will use a smaller number of TCP packets and - # less bandwidth to send data to replicas. But this can add a delay for - # the data to appear on the replica side, up to 40 milliseconds with - # Linux kernels using a default configuration. - # - # If you select "no" the delay for data to appear on the replica side will - # be reduced but more bandwidth will be used for replication. - # - # By default we optimize for low latency, but in very high traffic conditions - # or when the master and replicas are many hops away, turning this to "yes" may - # be a good idea. - repl-disable-tcp-nodelay no - - # Set the replication backlog size. The backlog is a buffer that accumulates - # replica data when replicas are disconnected for some time, so that when a - # replica wants to reconnect again, often a full resync is not needed, but a - # partial resync is enough, just passing the portion of data the replica - # missed while disconnected. - # - # The bigger the replication backlog, the longer the time the replica can be - # disconnected and later be able to perform a partial resynchronization. - # - # The backlog is only allocated once there is at least a replica connected. - # - # repl-backlog-size 1mb - - # After a master has no longer connected replicas for some time, the backlog - # will be freed. The following option configures the amount of seconds that - # need to elapse, starting from the time the last replica disconnected, for - # the backlog buffer to be freed. - # - # Note that replicas never free the backlog for timeout, since they may be - # promoted to masters later, and should be able to correctly "partially - # resynchronize" with the replicas: hence they should always accumulate backlog. - # - # A value of 0 means to never release the backlog. - # - # repl-backlog-ttl 3600 - - # The replica priority is an integer number published by Redis in the INFO - # output. It is used by Redis Sentinel in order to select a replica to promote - # into a master if the master is no longer working correctly. - # - # A replica with a low priority number is considered better for promotion, so - # for instance if there are three replicas with priority 10, 100, 25 Sentinel - # will pick the one with priority 10, that is the lowest. - # - # However a special priority of 0 marks the replica as not able to perform the - # role of master, so a replica with priority of 0 will never be selected by - # Redis Sentinel for promotion. - # - # By default the priority is 100. - replica-priority 100 - - # It is possible for a master to stop accepting writes if there are less than - # N replicas connected, having a lag less or equal than M seconds. - # - # The N replicas need to be in "online" state. - # - # The lag in seconds, that must be <= the specified value, is calculated from - # the last ping received from the replica, that is usually sent every second. - # - # This option does not GUARANTEE that N replicas will accept the write, but - # will limit the window of exposure for lost writes in case not enough replicas - # are available, to the specified number of seconds. - # - # For example to require at least 3 replicas with a lag <= 10 seconds use: - # - # min-replicas-to-write 3 - # min-replicas-max-lag 10 - # - # Setting one or the other to 0 disables the feature. - # - # By default min-replicas-to-write is set to 0 (feature disabled) and - # min-replicas-max-lag is set to 10. - - # A Redis master is able to list the address and port of the attached - # replicas in different ways. For example the "INFO replication" section - # offers this information, which is used, among other tools, by - # Redis Sentinel in order to discover replica instances. - # Another place where this info is available is in the output of the - # "ROLE" command of a master. - # - # The listed IP and address normally reported by a replica is obtained - # in the following way: - # - # IP: The address is auto detected by checking the peer address - # of the socket used by the replica to connect with the master. - # - # Port: The port is communicated by the replica during the replication - # handshake, and is normally the port that the replica is using to - # listen for connections. - # - # However when port forwarding or Network Address Translation (NAT) is - # used, the replica may be actually reachable via different IP and port - # pairs. The following two options can be used by a replica in order to - # report to its master a specific set of IP and port, so that both INFO - # and ROLE will report those values. - # - # There is no need to use both the options if you need to override just - # the port or the IP address. - # - # replica-announce-ip 5.5.5.5 - # replica-announce-port 1234 - - ############################### KEYS TRACKING ################################# - - # Redis implements server assisted support for client side caching of values. - # This is implemented using an invalidation table that remembers, using - # 16 millions of slots, what clients may have certain subsets of keys. In turn - # this is used in order to send invalidation messages to clients. Please - # to understand more about the feature check this page: - # - # https://redis.io/topics/client-side-caching - # - # When tracking is enabled for a client, all the read only queries are assumed - # to be cached: this will force Redis to store information in the invalidation - # table. When keys are modified, such information is flushed away, and - # invalidation messages are sent to the clients. However if the workload is - # heavily dominated by reads, Redis could use more and more memory in order - # to track the keys fetched by many clients. - # - # For this reason it is possible to configure a maximum fill value for the - # invalidation table. By default it is set to 1M of keys, and once this limit - # is reached, Redis will start to evict keys in the invalidation table - # even if they were not modified, just to reclaim memory: this will in turn - # force the clients to invalidate the cached values. Basically the table - # maximum size is a trade off between the memory you want to spend server - # side to track information about who cached what, and the ability of clients - # to retain cached objects in memory. - # - # If you set the value to 0, it means there are no limits, and Redis will - # retain as many keys as needed in the invalidation table. - # In the "stats" INFO section, you can find information about the number of - # keys in the invalidation table at every given moment. - # - # Note: when key tracking is used in broadcasting mode, no memory is used - # in the server side so this setting is useless. - # - # tracking-table-max-keys 1000000 - - ################################## SECURITY ################################### - - # Warning: since Redis is pretty fast an outside user can try up to - # 1 million passwords per second against a modern box. This means that you - # should use very strong passwords, otherwise they will be very easy to break. - # Note that because the password is really a shared secret between the client - # and the server, and should not be memorized by any human, the password - # can be easily a long string from /dev/urandom or whatever, so by using a - # long and unguessable password no brute force attack will be possible. - - # Redis ACL users are defined in the following format: - # - # user ... acl rules ... - # - # For example: - # - # user worker +@list +@connection ~jobs:* on >ffa9203c493aa99 - # - # The special username "default" is used for new connections. If this user - # has the "nopass" rule, then new connections will be immediately authenticated - # as the "default" user without the need of any password provided via the - # AUTH command. Otherwise if the "default" user is not flagged with "nopass" - # the connections will start in not authenticated state, and will require - # AUTH (or the HELLO command AUTH option) in order to be authenticated and - # start to work. - # - # The ACL rules that describe what an user can do are the following: - # - # on Enable the user: it is possible to authenticate as this user. - # off Disable the user: it's no longer possible to authenticate - # with this user, however the already authenticated connections - # will still work. - # + Allow the execution of that command - # - Disallow the execution of that command - # +@ Allow the execution of all the commands in such category - # with valid categories are like @admin, @set, @sortedset, ... - # and so forth, see the full list in the server.c file where - # the Redis command table is described and defined. - # The special category @all means all the commands, but currently - # present in the server, and that will be loaded in the future - # via modules. - # +|subcommand Allow a specific subcommand of an otherwise - # disabled command. Note that this form is not - # allowed as negative like -DEBUG|SEGFAULT, but - # only additive starting with "+". - # allcommands Alias for +@all. Note that it implies the ability to execute - # all the future commands loaded via the modules system. - # nocommands Alias for -@all. - # ~ Add a pattern of keys that can be mentioned as part of - # commands. For instance ~* allows all the keys. The pattern - # is a glob-style pattern like the one of KEYS. - # It is possible to specify multiple patterns. - # allkeys Alias for ~* - # resetkeys Flush the list of allowed keys patterns. - # > Add this password to the list of valid password for the user. - # For example >mypass will add "mypass" to the list. - # This directive clears the "nopass" flag (see later). - # < Remove this password from the list of valid passwords. - # nopass All the set passwords of the user are removed, and the user - # is flagged as requiring no password: it means that every - # password will work against this user. If this directive is - # used for the default user, every new connection will be - # immediately authenticated with the default user without - # any explicit AUTH command required. Note that the "resetpass" - # directive will clear this condition. - # resetpass Flush the list of allowed passwords. Moreover removes the - # "nopass" status. After "resetpass" the user has no associated - # passwords and there is no way to authenticate without adding - # some password (or setting it as "nopass" later). - # reset Performs the following actions: resetpass, resetkeys, off, - # -@all. The user returns to the same state it has immediately - # after its creation. - # - # ACL rules can be specified in any order: for instance you can start with - # passwords, then flags, or key patterns. However note that the additive - # and subtractive rules will CHANGE MEANING depending on the ordering. - # For instance see the following example: - # - # user alice on +@all -DEBUG ~* >somepassword - # - # This will allow "alice" to use all the commands with the exception of the - # DEBUG command, since +@all added all the commands to the set of the commands - # alice can use, and later DEBUG was removed. However if we invert the order - # of two ACL rules the result will be different: - # - # user alice on -DEBUG +@all ~* >somepassword - # - # Now DEBUG was removed when alice had yet no commands in the set of allowed - # commands, later all the commands are added, so the user will be able to - # execute everything. - # - # Basically ACL rules are processed left-to-right. - # - # For more information about ACL configuration please refer to - # the Redis web site at https://redis.io/topics/acl - - # ACL LOG - # - # The ACL Log tracks failed commands and authentication events associated - # with ACLs. The ACL Log is useful to troubleshoot failed commands blocked - # by ACLs. The ACL Log is stored in and consumes memory. There is no limit - # to its length.You can reclaim memory with ACL LOG RESET or set a maximum - # length below. - acllog-max-len 128 - - # Using an external ACL file - # - # Instead of configuring users here in this file, it is possible to use - # a stand-alone file just listing users. The two methods cannot be mixed: - # if you configure users here and at the same time you activate the exteranl - # ACL file, the server will refuse to start. - # - # The format of the external ACL user file is exactly the same as the - # format that is used inside redis.conf to describe users. - # - # aclfile /etc/redis/users.acl - - # IMPORTANT NOTE: starting with Redis 6 "requirepass" is just a compatibility - # layer on top of the new ACL system. The option effect will be just setting - # the password for the default user. Clients will still authenticate using - # AUTH as usually, or more explicitly with AUTH default - # if they follow the new protocol: both will work. - # - # requirepass foobared - - # Command renaming (DEPRECATED). - # - # ------------------------------------------------------------------------ - # WARNING: avoid using this option if possible. Instead use ACLs to remove - # commands from the default user, and put them only in some admin user you - # create for administrative purposes. - # ------------------------------------------------------------------------ - # - # It is possible to change the name of dangerous commands in a shared - # environment. For instance the CONFIG command may be renamed into something - # hard to guess so that it will still be available for internal-use tools - # but not available for general clients. - # - # Example: - # - # rename-command CONFIG b840fc02d524045429941cc15f59e41cb7be6c52 - # - # It is also possible to completely kill a command by renaming it into - # an empty string: - # - # rename-command CONFIG "" - # - # Please note that changing the name of commands that are logged into the - # AOF file or transmitted to replicas may cause problems. - - ################################### CLIENTS #################################### - - # Set the max number of connected clients at the same time. By default - # this limit is set to 10000 clients, however if the Redis server is not - # able to configure the process file limit to allow for the specified limit - # the max number of allowed clients is set to the current file limit - # minus 32 (as Redis reserves a few file descriptors for internal uses). - # - # Once the limit is reached Redis will close all the new connections sending - # an error 'max number of clients reached'. - # - # maxclients 10000 - - ############################## MEMORY MANAGEMENT ################################ - - # Set a memory usage limit to the specified amount of bytes. - # When the memory limit is reached Redis will try to remove keys - # according to the eviction policy selected (see maxmemory-policy). - # - # If Redis can't remove keys according to the policy, or if the policy is - # set to 'noeviction', Redis will start to reply with errors to commands - # that would use more memory, like SET, LPUSH, and so on, and will continue - # to reply to read-only commands like GET. - # - # This option is usually useful when using Redis as an LRU or LFU cache, or to - # set a hard memory limit for an instance (using the 'noeviction' policy). - # - # WARNING: If you have replicas attached to an instance with maxmemory on, - # the size of the output buffers needed to feed the replicas are subtracted - # from the used memory count, so that network problems / resyncs will - # not trigger a loop where keys are evicted, and in turn the output - # buffer of replicas is full with DELs of keys evicted triggering the deletion - # of more keys, and so forth until the database is completely emptied. - # - # In short... if you have replicas attached it is suggested that you set a lower - # limit for maxmemory so that there is some free RAM on the system for replica - # output buffers (but this is not needed if the policy is 'noeviction'). - # - # maxmemory - - # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory - # is reached. You can select one from the following behaviors: - # - # volatile-lru -> Evict using approximated LRU, only keys with an expire set. - # allkeys-lru -> Evict any key using approximated LRU. - # volatile-lfu -> Evict using approximated LFU, only keys with an expire set. - # allkeys-lfu -> Evict any key using approximated LFU. - # volatile-random -> Remove a random key having an expire set. - # allkeys-random -> Remove a random key, any key. - # volatile-ttl -> Remove the key with the nearest expire time (minor TTL) - # noeviction -> Don't evict anything, just return an error on write operations. - # - # LRU means Least Recently Used - # LFU means Least Frequently Used - # - # Both LRU, LFU and volatile-ttl are implemented using approximated - # randomized algorithms. - # - # Note: with any of the above policies, Redis will return an error on write - # operations, when there are no suitable keys for eviction. - # - # At the date of writing these commands are: set setnx setex append - # incr decr rpush lpush rpushx lpushx linsert lset rpoplpush sadd - # sinter sinterstore sunion sunionstore sdiff sdiffstore zadd zincrby - # zunionstore zinterstore hset hsetnx hmset hincrby incrby decrby - # getset mset msetnx exec sort - # - # The default is: - # - # maxmemory-policy noeviction - - # LRU, LFU and minimal TTL algorithms are not precise algorithms but approximated - # algorithms (in order to save memory), so you can tune it for speed or - # accuracy. For default Redis will check five keys and pick the one that was - # used less recently, you can change the sample size using the following - # configuration directive. - # - # The default of 5 produces good enough results. 10 Approximates very closely - # true LRU but costs more CPU. 3 is faster but not very accurate. - # - # maxmemory-samples 5 - - # Starting from Redis 5, by default a replica will ignore its maxmemory setting - # (unless it is promoted to master after a failover or manually). It means - # that the eviction of keys will be just handled by the master, sending the - # DEL commands to the replica as keys evict in the master side. - # - # This behavior ensures that masters and replicas stay consistent, and is usually - # what you want, however if your replica is writable, or you want the replica - # to have a different memory setting, and you are sure all the writes performed - # to the replica are idempotent, then you may change this default (but be sure - # to understand what you are doing). - # - # Note that since the replica by default does not evict, it may end using more - # memory than the one set via maxmemory (there are certain buffers that may - # be larger on the replica, or data structures may sometimes take more memory - # and so forth). So make sure you monitor your replicas and make sure they - # have enough memory to never hit a real out-of-memory condition before the - # master hits the configured maxmemory setting. - # - # replica-ignore-maxmemory yes - - # Redis reclaims expired keys in two ways: upon access when those keys are - # found to be expired, and also in background, in what is called the - # "active expire key". The key space is slowly and interactively scanned - # looking for expired keys to reclaim, so that it is possible to free memory - # of keys that are expired and will never be accessed again in a short time. - # - # The default effort of the expire cycle will try to avoid having more than - # ten percent of expired keys still in memory, and will try to avoid consuming - # more than 25% of total memory and to add latency to the system. However - # it is possible to increase the expire "effort" that is normally set to - # "1", to a greater value, up to the value "10". At its maximum value the - # system will use more CPU, longer cycles (and technically may introduce - # more latency), and will tollerate less already expired keys still present - # in the system. It's a tradeoff between memory, CPU and latecy. - # - # active-expire-effort 1 - - ############################# LAZY FREEING #################################### - - # Redis has two primitives to delete keys. One is called DEL and is a blocking - # deletion of the object. It means that the server stops processing new commands - # in order to reclaim all the memory associated with an object in a synchronous - # way. If the key deleted is associated with a small object, the time needed - # in order to execute the DEL command is very small and comparable to most other - # O(1) or O(log_N) commands in Redis. However if the key is associated with an - # aggregated value containing millions of elements, the server can block for - # a long time (even seconds) in order to complete the operation. - # - # For the above reasons Redis also offers non blocking deletion primitives - # such as UNLINK (non blocking DEL) and the ASYNC option of FLUSHALL and - # FLUSHDB commands, in order to reclaim memory in background. Those commands - # are executed in constant time. Another thread will incrementally free the - # object in the background as fast as possible. - # - # DEL, UNLINK and ASYNC option of FLUSHALL and FLUSHDB are user-controlled. - # It's up to the design of the application to understand when it is a good - # idea to use one or the other. However the Redis server sometimes has to - # delete keys or flush the whole database as a side effect of other operations. - # Specifically Redis deletes objects independently of a user call in the - # following scenarios: - # - # 1) On eviction, because of the maxmemory and maxmemory policy configurations, - # in order to make room for new data, without going over the specified - # memory limit. - # 2) Because of expire: when a key with an associated time to live (see the - # EXPIRE command) must be deleted from memory. - # 3) Because of a side effect of a command that stores data on a key that may - # already exist. For example the RENAME command may delete the old key - # content when it is replaced with another one. Similarly SUNIONSTORE - # or SORT with STORE option may delete existing keys. The SET command - # itself removes any old content of the specified key in order to replace - # it with the specified string. - # 4) During replication, when a replica performs a full resynchronization with - # its master, the content of the whole database is removed in order to - # load the RDB file just transferred. - # - # In all the above cases the default is to delete objects in a blocking way, - # like if DEL was called. However you can configure each case specifically - # in order to instead release memory in a non-blocking way like if UNLINK - # was called, using the following configuration directives. - - lazyfree-lazy-eviction no - lazyfree-lazy-expire no - lazyfree-lazy-server-del no - replica-lazy-flush no - - # It is also possible, for the case when to replace the user code DEL calls - # with UNLINK calls is not easy, to modify the default behavior of the DEL - # command to act exactly like UNLINK, using the following configuration - # directive: - - lazyfree-lazy-user-del no - - ################################ THREADED I/O ################################# - - # Redis is mostly single threaded, however there are certain threaded - # operations such as UNLINK, slow I/O accesses and other things that are - # performed on side threads. - # - # Now it is also possible to handle Redis clients socket reads and writes - # in different I/O threads. Since especially writing is so slow, normally - # Redis users use pipelining in order to speedup the Redis performances per - # core, and spawn multiple instances in order to scale more. Using I/O - # threads it is possible to easily speedup two times Redis without resorting - # to pipelining nor sharding of the instance. - # - # By default threading is disabled, we suggest enabling it only in machines - # that have at least 4 or more cores, leaving at least one spare core. - # Using more than 8 threads is unlikely to help much. We also recommend using - # threaded I/O only if you actually have performance problems, with Redis - # instances being able to use a quite big percentage of CPU time, otherwise - # there is no point in using this feature. - # - # So for instance if you have a four cores boxes, try to use 2 or 3 I/O - # threads, if you have a 8 cores, try to use 6 threads. In order to - # enable I/O threads use the following configuration directive: - # - # io-threads 4 - # - # Setting io-threads to 1 will just use the main thread as usually. - # When I/O threads are enabled, we only use threads for writes, that is - # to thread the write(2) syscall and transfer the client buffers to the - # socket. However it is also possible to enable threading of reads and - # protocol parsing using the following configuration directive, by setting - # it to yes: - # - # io-threads-do-reads no - # - # Usually threading reads doesn't help much. - # - # NOTE 1: This configuration directive cannot be changed at runtime via - # CONFIG SET. Aso this feature currently does not work when SSL is - # enabled. - # - # NOTE 2: If you want to test the Redis speedup using redis-benchmark, make - # sure you also run the benchmark itself in threaded mode, using the - # --threads option to match the number of Redis theads, otherwise you'll not - # be able to notice the improvements. - - ############################## APPEND ONLY MODE ############################### - - # By default Redis asynchronously dumps the dataset on disk. This mode is - # good enough in many applications, but an issue with the Redis process or - # a power outage may result into a few minutes of writes lost (depending on - # the configured save points). - # - # The Append Only File is an alternative persistence mode that provides - # much better durability. For instance using the default data fsync policy - # (see later in the config file) Redis can lose just one second of writes in a - # dramatic event like a server power outage, or a single write if something - # wrong with the Redis process itself happens, but the operating system is - # still running correctly. - # - # AOF and RDB persistence can be enabled at the same time without problems. - # If the AOF is enabled on startup Redis will load the AOF, that is the file - # with the better durability guarantees. - # - # Please check http://redis.io/topics/persistence for more information. - - appendonly no - - # The name of the append only file (default: "appendonly.aof") - - appendfilename "appendonly.aof" - - # The fsync() call tells the Operating System to actually write data on disk - # instead of waiting for more data in the output buffer. Some OS will really flush - # data on disk, some other OS will just try to do it ASAP. - # - # Redis supports three different modes: - # - # no: don't fsync, just let the OS flush the data when it wants. Faster. - # always: fsync after every write to the append only log. Slow, Safest. - # everysec: fsync only one time every second. Compromise. - # - # The default is "everysec", as that's usually the right compromise between - # speed and data safety. It's up to you to understand if you can relax this to - # "no" that will let the operating system flush the output buffer when - # it wants, for better performances (but if you can live with the idea of - # some data loss consider the default persistence mode that's snapshotting), - # or on the contrary, use "always" that's very slow but a bit safer than - # everysec. - # - # More details please check the following article: - # http://antirez.com/post/redis-persistence-demystified.html - # - # If unsure, use "everysec". - - # appendfsync always - appendfsync everysec - # appendfsync no - - # When the AOF fsync policy is set to always or everysec, and a background - # saving process (a background save or AOF log background rewriting) is - # performing a lot of I/O against the disk, in some Linux configurations - # Redis may block too long on the fsync() call. Note that there is no fix for - # this currently, as even performing fsync in a different thread will block - # our synchronous write(2) call. - # - # In order to mitigate this problem it's possible to use the following option - # that will prevent fsync() from being called in the main process while a - # BGSAVE or BGREWRITEAOF is in progress. - # - # This means that while another child is saving, the durability of Redis is - # the same as "appendfsync none". In practical terms, this means that it is - # possible to lose up to 30 seconds of log in the worst scenario (with the - # default Linux settings). - # - # If you have latency problems turn this to "yes". Otherwise leave it as - # "no" that is the safest pick from the point of view of durability. - - no-appendfsync-on-rewrite no - - # Automatic rewrite of the append only file. - # Redis is able to automatically rewrite the log file implicitly calling - # BGREWRITEAOF when the AOF log size grows by the specified percentage. - # - # This is how it works: Redis remembers the size of the AOF file after the - # latest rewrite (if no rewrite has happened since the restart, the size of - # the AOF at startup is used). - # - # This base size is compared to the current size. If the current size is - # bigger than the specified percentage, the rewrite is triggered. Also - # you need to specify a minimal size for the AOF file to be rewritten, this - # is useful to avoid rewriting the AOF file even if the percentage increase - # is reached but it is still pretty small. - # - # Specify a percentage of zero in order to disable the automatic AOF - # rewrite feature. - - auto-aof-rewrite-percentage 100 - auto-aof-rewrite-min-size 64mb - - # An AOF file may be found to be truncated at the end during the Redis - # startup process, when the AOF data gets loaded back into memory. - # This may happen when the system where Redis is running - # crashes, especially when an ext4 filesystem is mounted without the - # data=ordered option (however this can't happen when Redis itself - # crashes or aborts but the operating system still works correctly). - # - # Redis can either exit with an error when this happens, or load as much - # data as possible (the default now) and start if the AOF file is found - # to be truncated at the end. The following option controls this behavior. - # - # If aof-load-truncated is set to yes, a truncated AOF file is loaded and - # the Redis server starts emitting a log to inform the user of the event. - # Otherwise if the option is set to no, the server aborts with an error - # and refuses to start. When the option is set to no, the user requires - # to fix the AOF file using the "redis-check-aof" utility before to restart - # the server. - # - # Note that if the AOF file will be found to be corrupted in the middle - # the server will still exit with an error. This option only applies when - # Redis will try to read more data from the AOF file but not enough bytes - # will be found. - aof-load-truncated yes - - # When rewriting the AOF file, Redis is able to use an RDB preamble in the - # AOF file for faster rewrites and recoveries. When this option is turned - # on the rewritten AOF file is composed of two different stanzas: - # - # [RDB file][AOF tail] - # - # When loading Redis recognizes that the AOF file starts with the "REDIS" - # string and loads the prefixed RDB file, and continues loading the AOF - # tail. - aof-use-rdb-preamble yes - - ################################ LUA SCRIPTING ############################### - - # Max execution time of a Lua script in milliseconds. - # - # If the maximum execution time is reached Redis will log that a script is - # still in execution after the maximum allowed time and will start to - # reply to queries with an error. - # - # When a long running script exceeds the maximum execution time only the - # SCRIPT KILL and SHUTDOWN NOSAVE commands are available. The first can be - # used to stop a script that did not yet called write commands. The second - # is the only way to shut down the server in the case a write command was - # already issued by the script but the user doesn't want to wait for the natural - # termination of the script. - # - # Set it to 0 or a negative value for unlimited execution without warnings. - lua-time-limit 5000 - - ################################ REDIS CLUSTER ############################### - - # Normal Redis instances can't be part of a Redis Cluster; only nodes that are - # started as cluster nodes can. In order to start a Redis instance as a - # cluster node enable the cluster support uncommenting the following: - # - cluster-enabled yes - - # Every cluster node has a cluster configuration file. This file is not - # intended to be edited by hand. It is created and updated by Redis nodes. - # Every Redis Cluster node requires a different cluster configuration file. - # Make sure that instances running in the same system do not have - # overlapping cluster configuration file names. - # - cluster-config-file /bitnami/redis/data/nodes.conf - - # Cluster node timeout is the amount of milliseconds a node must be unreachable - # for it to be considered in failure state. - # Most other internal time limits are multiple of the node timeout. - # - # cluster-node-timeout 15000 - - # A replica of a failing master will avoid to start a failover if its data - # looks too old. - # - # There is no simple way for a replica to actually have an exact measure of - # its "data age", so the following two checks are performed: - # - # 1) If there are multiple replicas able to failover, they exchange messages - # in order to try to give an advantage to the replica with the best - # replication offset (more data from the master processed). - # Replicas will try to get their rank by offset, and apply to the start - # of the failover a delay proportional to their rank. - # - # 2) Every single replica computes the time of the last interaction with - # its master. This can be the last ping or command received (if the master - # is still in the "connected" state), or the time that elapsed since the - # disconnection with the master (if the replication link is currently down). - # If the last interaction is too old, the replica will not try to failover - # at all. - # - # The point "2" can be tuned by user. Specifically a replica will not perform - # the failover if, since the last interaction with the master, the time - # elapsed is greater than: - # - # (node-timeout * replica-validity-factor) + repl-ping-replica-period - # - # So for example if node-timeout is 30 seconds, and the replica-validity-factor - # is 10, and assuming a default repl-ping-replica-period of 10 seconds, the - # replica will not try to failover if it was not able to talk with the master - # for longer than 310 seconds. - # - # A large replica-validity-factor may allow replicas with too old data to failover - # a master, while a too small value may prevent the cluster from being able to - # elect a replica at all. - # - # For maximum availability, it is possible to set the replica-validity-factor - # to a value of 0, which means, that replicas will always try to failover the - # master regardless of the last time they interacted with the master. - # (However they'll always try to apply a delay proportional to their - # offset rank). - # - # Zero is the only value able to guarantee that when all the partitions heal - # the cluster will always be able to continue. - # - # cluster-replica-validity-factor 10 - - # Cluster replicas are able to migrate to orphaned masters, that are masters - # that are left without working replicas. This improves the cluster ability - # to resist to failures as otherwise an orphaned master can't be failed over - # in case of failure if it has no working replicas. - # - # Replicas migrate to orphaned masters only if there are still at least a - # given number of other working replicas for their old master. This number - # is the "migration barrier". A migration barrier of 1 means that a replica - # will migrate only if there is at least 1 other working replica for its master - # and so forth. It usually reflects the number of replicas you want for every - # master in your cluster. - # - # Default is 1 (replicas migrate only if their masters remain with at least - # one replica). To disable migration just set it to a very large value. - # A value of 0 can be set but is useful only for debugging and dangerous - # in production. - # - # cluster-migration-barrier 1 - - # By default Redis Cluster nodes stop accepting queries if they detect there - # is at least an hash slot uncovered (no available node is serving it). - # This way if the cluster is partially down (for example a range of hash slots - # are no longer covered) all the cluster becomes, eventually, unavailable. - # It automatically returns available as soon as all the slots are covered again. - # - # However sometimes you want the subset of the cluster which is working, - # to continue to accept queries for the part of the key space that is still - # covered. In order to do so, just set the cluster-require-full-coverage - # option to no. - # - # cluster-require-full-coverage yes - - # This option, when set to yes, prevents replicas from trying to failover its - # master during master failures. However the master can still perform a - # manual failover, if forced to do so. - # - # This is useful in different scenarios, especially in the case of multiple - # data center operations, where we want one side to never be promoted if not - # in the case of a total DC failure. - # - # cluster-replica-no-failover no - - # This option, when set to yes, allows nodes to serve read traffic while the - # the cluster is in a down state, as long as it believes it owns the slots. - # - # This is useful for two cases. The first case is for when an application - # doesn't require consistency of data during node failures or network partitions. - # One example of this is a cache, where as long as the node has the data it - # should be able to serve it. - # - # The second use case is for configurations that don't meet the recommended - # three shards but want to enable cluster mode and scale later. A - # master outage in a 1 or 2 shard configuration causes a read/write outage to the - # entire cluster without this option set, with it set there is only a write outage. - # Without a quorum of masters, slot ownership will not change automatically. - # - # cluster-allow-reads-when-down no - - # In order to setup your cluster make sure to read the documentation - # available at http://redis.io web site. - - ########################## CLUSTER DOCKER/NAT support ######################## - - # In certain deployments, Redis Cluster nodes address discovery fails, because - # addresses are NAT-ted or because ports are forwarded (the typical case is - # Docker and other containers). - # - # In order to make Redis Cluster working in such environments, a static - # configuration where each node knows its public address is needed. The - # following two options are used for this scope, and are: - # - # * cluster-announce-ip - # * cluster-announce-port - # * cluster-announce-bus-port - # - # Each instruct the node about its address, client port, and cluster message - # bus port. The information is then published in the header of the bus packets - # so that other nodes will be able to correctly map the address of the node - # publishing the information. - # - # If the above options are not used, the normal Redis Cluster auto-detection - # will be used instead. - # - # Note that when remapped, the bus port may not be at the fixed offset of - # clients port + 10000, so you can specify any port and bus-port depending - # on how they get remapped. If the bus-port is not set, a fixed offset of - # 10000 will be used as usually. - # - # Example: - # - # cluster-announce-ip 10.1.1.5 - # cluster-announce-port 6379 - # cluster-announce-bus-port 6380 - - ################################## SLOW LOG ################################### - - # The Redis Slow Log is a system to log queries that exceeded a specified - # execution time. The execution time does not include the I/O operations - # like talking with the client, sending the reply and so forth, - # but just the time needed to actually execute the command (this is the only - # stage of command execution where the thread is blocked and can not serve - # other requests in the meantime). - # - # You can configure the slow log with two parameters: one tells Redis - # what is the execution time, in microseconds, to exceed in order for the - # command to get logged, and the other parameter is the length of the - # slow log. When a new command is logged the oldest one is removed from the - # queue of logged commands. - - # The following time is expressed in microseconds, so 1000000 is equivalent - # to one second. Note that a negative number disables the slow log, while - # a value of zero forces the logging of every command. - slowlog-log-slower-than 10000 - - # There is no limit to this length. Just be aware that it will consume memory. - # You can reclaim memory used by the slow log with SLOWLOG RESET. - slowlog-max-len 128 - - ################################ LATENCY MONITOR ############################## - - # The Redis latency monitoring subsystem samples different operations - # at runtime in order to collect data related to possible sources of - # latency of a Redis instance. - # - # Via the LATENCY command this information is available to the user that can - # print graphs and obtain reports. - # - # The system only logs operations that were performed in a time equal or - # greater than the amount of milliseconds specified via the - # latency-monitor-threshold configuration directive. When its value is set - # to zero, the latency monitor is turned off. - # - # By default latency monitoring is disabled since it is mostly not needed - # if you don't have latency issues, and collecting data has a performance - # impact, that while very small, can be measured under big load. Latency - # monitoring can easily be enabled at runtime using the command - # "CONFIG SET latency-monitor-threshold " if needed. - latency-monitor-threshold 0 - - ############################# EVENT NOTIFICATION ############################## - - # Redis can notify Pub/Sub clients about events happening in the key space. - # This feature is documented at http://redis.io/topics/notifications - # - # For instance if keyspace events notification is enabled, and a client - # performs a DEL operation on key "foo" stored in the Database 0, two - # messages will be published via Pub/Sub: - # - # PUBLISH __keyspace@0__:foo del - # PUBLISH __keyevent@0__:del foo - # - # It is possible to select the events that Redis will notify among a set - # of classes. Every class is identified by a single character: - # - # K Keyspace events, published with __keyspace@__ prefix. - # E Keyevent events, published with __keyevent@__ prefix. - # g Generic commands (non-type specific) like DEL, EXPIRE, RENAME, ... - # $ String commands - # l List commands - # s Set commands - # h Hash commands - # z Sorted set commands - # x Expired events (events generated every time a key expires) - # e Evicted events (events generated when a key is evicted for maxmemory) - # t Stream commands - # m Key-miss events (Note: It is not included in the 'A' class) - # A Alias for g$lshzxet, so that the "AKE" string means all the events - # (Except key-miss events which are excluded from 'A' due to their - # unique nature). - # - # The "notify-keyspace-events" takes as argument a string that is composed - # of zero or multiple characters. The empty string means that notifications - # are disabled. - # - # Example: to enable list and generic events, from the point of view of the - # event name, use: - # - # notify-keyspace-events Elg - # - # Example 2: to get the stream of the expired keys subscribing to channel - # name __keyevent@0__:expired use: - # - # notify-keyspace-events Ex - # - # By default all notifications are disabled because most users don't need - # this feature and the feature has some overhead. Note that if you don't - # specify at least one of K or E, no events will be delivered. - notify-keyspace-events "" - - ############################### GOPHER SERVER ################################# - - # Redis contains an implementation of the Gopher protocol, as specified in - # the RFC 1436 (https://www.ietf.org/rfc/rfc1436.txt). - # - # The Gopher protocol was very popular in the late '90s. It is an alternative - # to the web, and the implementation both server and client side is so simple - # that the Redis server has just 100 lines of code in order to implement this - # support. - # - # What do you do with Gopher nowadays? Well Gopher never *really* died, and - # lately there is a movement in order for the Gopher more hierarchical content - # composed of just plain text documents to be resurrected. Some want a simpler - # internet, others believe that the mainstream internet became too much - # controlled, and it's cool to create an alternative space for people that - # want a bit of fresh air. - # - # Anyway for the 10nth birthday of the Redis, we gave it the Gopher protocol - # as a gift. - # - # --- HOW IT WORKS? --- - # - # The Redis Gopher support uses the inline protocol of Redis, and specifically - # two kind of inline requests that were anyway illegal: an empty request - # or any request that starts with "/" (there are no Redis commands starting - # with such a slash). Normal RESP2/RESP3 requests are completely out of the - # path of the Gopher protocol implementation and are served as usually as well. - # - # If you open a connection to Redis when Gopher is enabled and send it - # a string like "/foo", if there is a key named "/foo" it is served via the - # Gopher protocol. - # - # In order to create a real Gopher "hole" (the name of a Gopher site in Gopher - # talking), you likely need a script like the following: - # - # https://github.com/antirez/gopher2redis - # - # --- SECURITY WARNING --- - # - # If you plan to put Redis on the internet in a publicly accessible address - # to server Gopher pages MAKE SURE TO SET A PASSWORD to the instance. - # Once a password is set: - # - # 1. The Gopher server (when enabled, not by default) will still serve - # content via Gopher. - # 2. However other commands cannot be called before the client will - # authenticate. - # - # So use the 'requirepass' option to protect your instance. - # - # To enable Gopher support uncomment the following line and set - # the option from no (the default) to yes. - # - # gopher-enabled no - - ############################### ADVANCED CONFIG ############################### - - # Hashes are encoded using a memory efficient data structure when they have a - # small number of entries, and the biggest entry does not exceed a given - # threshold. These thresholds can be configured using the following directives. - hash-max-ziplist-entries 512 - hash-max-ziplist-value 64 - - # Lists are also encoded in a special way to save a lot of space. - # The number of entries allowed per internal list node can be specified - # as a fixed maximum size or a maximum number of elements. - # For a fixed maximum size, use -5 through -1, meaning: - # -5: max size: 64 Kb <-- not recommended for normal workloads - # -4: max size: 32 Kb <-- not recommended - # -3: max size: 16 Kb <-- probably not recommended - # -2: max size: 8 Kb <-- good - # -1: max size: 4 Kb <-- good - # Positive numbers mean store up to _exactly_ that number of elements - # per list node. - # The highest performing option is usually -2 (8 Kb size) or -1 (4 Kb size), - # but if your use case is unique, adjust the settings as necessary. - list-max-ziplist-size -2 - - # Lists may also be compressed. - # Compress depth is the number of quicklist ziplist nodes from *each* side of - # the list to *exclude* from compression. The head and tail of the list - # are always uncompressed for fast push/pop operations. Settings are: - # 0: disable all list compression - # 1: depth 1 means "don't start compressing until after 1 node into the list, - # going from either the head or tail" - # So: [head]->node->node->...->node->[tail] - # [head], [tail] will always be uncompressed; inner nodes will compress. - # 2: [head]->[next]->node->node->...->node->[prev]->[tail] - # 2 here means: don't compress head or head->next or tail->prev or tail, - # but compress all nodes between them. - # 3: [head]->[next]->[next]->node->node->...->node->[prev]->[prev]->[tail] - # etc. - list-compress-depth 0 - - # Sets have a special encoding in just one case: when a set is composed - # of just strings that happen to be integers in radix 10 in the range - # of 64 bit signed integers. - # The following configuration setting sets the limit in the size of the - # set in order to use this special memory saving encoding. - set-max-intset-entries 512 - - # Similarly to hashes and lists, sorted sets are also specially encoded in - # order to save a lot of space. This encoding is only used when the length and - # elements of a sorted set are below the following limits: - zset-max-ziplist-entries 128 - zset-max-ziplist-value 64 - - # HyperLogLog sparse representation bytes limit. The limit includes the - # 16 bytes header. When an HyperLogLog using the sparse representation crosses - # this limit, it is converted into the dense representation. - # - # A value greater than 16000 is totally useless, since at that point the - # dense representation is more memory efficient. - # - # The suggested value is ~ 3000 in order to have the benefits of - # the space efficient encoding without slowing down too much PFADD, - # which is O(N) with the sparse encoding. The value can be raised to - # ~ 10000 when CPU is not a concern, but space is, and the data set is - # composed of many HyperLogLogs with cardinality in the 0 - 15000 range. - hll-sparse-max-bytes 3000 - - # Streams macro node max size / items. The stream data structure is a radix - # tree of big nodes that encode multiple items inside. Using this configuration - # it is possible to configure how big a single node can be in bytes, and the - # maximum number of items it may contain before switching to a new node when - # appending new stream entries. If any of the following settings are set to - # zero, the limit is ignored, so for instance it is possible to set just a - # max entries limit by setting max-bytes to 0 and max-entries to the desired - # value. - stream-node-max-bytes 4096 - stream-node-max-entries 100 - - # Active rehashing uses 1 millisecond every 100 milliseconds of CPU time in - # order to help rehashing the main Redis hash table (the one mapping top-level - # keys to values). The hash table implementation Redis uses (see dict.c) - # performs a lazy rehashing: the more operation you run into a hash table - # that is rehashing, the more rehashing "steps" are performed, so if the - # server is idle the rehashing is never complete and some more memory is used - # by the hash table. - # - # The default is to use this millisecond 10 times every second in order to - # actively rehash the main dictionaries, freeing memory when possible. - # - # If unsure: - # use "activerehashing no" if you have hard latency requirements and it is - # not a good thing in your environment that Redis can reply from time to time - # to queries with 2 milliseconds delay. - # - # use "activerehashing yes" if you don't have such hard requirements but - # want to free memory asap when possible. - activerehashing yes - - # The client output buffer limits can be used to force disconnection of clients - # that are not reading data from the server fast enough for some reason (a - # common reason is that a Pub/Sub client can't consume messages as fast as the - # publisher can produce them). - # - # The limit can be set differently for the three different classes of clients: - # - # normal -> normal clients including MONITOR clients - # replica -> replica clients - # pubsub -> clients subscribed to at least one pubsub channel or pattern - # - # The syntax of every client-output-buffer-limit directive is the following: - # - # client-output-buffer-limit - # - # A client is immediately disconnected once the hard limit is reached, or if - # the soft limit is reached and remains reached for the specified number of - # seconds (continuously). - # So for instance if the hard limit is 32 megabytes and the soft limit is - # 16 megabytes / 10 seconds, the client will get disconnected immediately - # if the size of the output buffers reach 32 megabytes, but will also get - # disconnected if the client reaches 16 megabytes and continuously overcomes - # the limit for 10 seconds. - # - # By default normal clients are not limited because they don't receive data - # without asking (in a push way), but just after a request, so only - # asynchronous clients may create a scenario where data is requested faster - # than it can read. - # - # Instead there is a default limit for pubsub and replica clients, since - # subscribers and replicas receive data in a push fashion. - # - # Both the hard or the soft limit can be disabled by setting them to zero. - client-output-buffer-limit normal 0 0 0 - client-output-buffer-limit replica 256mb 64mb 60 - client-output-buffer-limit pubsub 32mb 8mb 60 - - # Client query buffers accumulate new commands. They are limited to a fixed - # amount by default in order to avoid that a protocol desynchronization (for - # instance due to a bug in the client) will lead to unbound memory usage in - # the query buffer. However you can configure it here if you have very special - # needs, such us huge multi/exec requests or alike. - # - # client-query-buffer-limit 1gb - - # In the Redis protocol, bulk requests, that are, elements representing single - # strings, are normally limited to 512 mb. However you can change this limit - # here. - # - # proto-max-bulk-len 512mb - - # Redis calls an internal function to perform many background tasks, like - # closing connections of clients in timeout, purging expired keys that are - # never requested, and so forth. - # - # Not all tasks are performed with the same frequency, but Redis checks for - # tasks to perform according to the specified "hz" value. - # - # By default "hz" is set to 10. Raising the value will use more CPU when - # Redis is idle, but at the same time will make Redis more responsive when - # there are many keys expiring at the same time, and timeouts may be - # handled with more precision. - # - # The range is between 1 and 500, however a value over 100 is usually not - # a good idea. Most users should use the default of 10 and raise this up to - # 100 only in environments where very low latency is required. - hz 10 - - # Normally it is useful to have an HZ value which is proportional to the - # number of clients connected. This is useful in order, for instance, to - # avoid too many clients are processed for each background task invocation - # in order to avoid latency spikes. - # - # Since the default HZ value by default is conservatively set to 10, Redis - # offers, and enables by default, the ability to use an adaptive HZ value - # which will temporary raise when there are many connected clients. - # - # When dynamic HZ is enabled, the actual configured HZ will be used - # as a baseline, but multiples of the configured HZ value will be actually - # used as needed once more clients are connected. In this way an idle - # instance will use very little CPU time while a busy instance will be - # more responsive. - dynamic-hz yes - - # When a child rewrites the AOF file, if the following option is enabled - # the file will be fsync-ed every 32 MB of data generated. This is useful - # in order to commit the file to the disk more incrementally and avoid - # big latency spikes. - aof-rewrite-incremental-fsync yes - - # When redis saves RDB file, if the following option is enabled - # the file will be fsync-ed every 32 MB of data generated. This is useful - # in order to commit the file to the disk more incrementally and avoid - # big latency spikes. - rdb-save-incremental-fsync yes - - # Redis LFU eviction (see maxmemory setting) can be tuned. However it is a good - # idea to start with the default settings and only change them after investigating - # how to improve the performances and how the keys LFU change over time, which - # is possible to inspect via the OBJECT FREQ command. - # - # There are two tunable parameters in the Redis LFU implementation: the - # counter logarithm factor and the counter decay time. It is important to - # understand what the two parameters mean before changing them. - # - # The LFU counter is just 8 bits per key, it's maximum value is 255, so Redis - # uses a probabilistic increment with logarithmic behavior. Given the value - # of the old counter, when a key is accessed, the counter is incremented in - # this way: - # - # 1. A random number R between 0 and 1 is extracted. - # 2. A probability P is calculated as 1/(old_value*lfu_log_factor+1). - # 3. The counter is incremented only if R < P. - # - # The default lfu-log-factor is 10. This is a table of how the frequency - # counter changes with a different number of accesses with different - # logarithmic factors: - # - # +--------+------------+------------+------------+------------+------------+ - # | factor | 100 hits | 1000 hits | 100K hits | 1M hits | 10M hits | - # +--------+------------+------------+------------+------------+------------+ - # | 0 | 104 | 255 | 255 | 255 | 255 | - # +--------+------------+------------+------------+------------+------------+ - # | 1 | 18 | 49 | 255 | 255 | 255 | - # +--------+------------+------------+------------+------------+------------+ - # | 10 | 10 | 18 | 142 | 255 | 255 | - # +--------+------------+------------+------------+------------+------------+ - # | 100 | 8 | 11 | 49 | 143 | 255 | - # +--------+------------+------------+------------+------------+------------+ - # - # NOTE: The above table was obtained by running the following commands: - # - # redis-benchmark -n 1000000 incr foo - # redis-cli object freq foo - # - # NOTE 2: The counter initial value is 5 in order to give new objects a chance - # to accumulate hits. - # - # The counter decay time is the time, in minutes, that must elapse in order - # for the key counter to be divided by two (or decremented if it has a value - # less <= 10). - # - # The default value for the lfu-decay-time is 1. A Special value of 0 means to - # decay the counter every time it happens to be scanned. - # - # lfu-log-factor 10 - # lfu-decay-time 1 - - ########################### ACTIVE DEFRAGMENTATION ####################### - # - # What is active defragmentation? - # ------------------------------- - # - # Active (online) defragmentation allows a Redis server to compact the - # spaces left between small allocations and deallocations of data in memory, - # thus allowing to reclaim back memory. - # - # Fragmentation is a natural process that happens with every allocator (but - # less so with Jemalloc, fortunately) and certain workloads. Normally a server - # restart is needed in order to lower the fragmentation, or at least to flush - # away all the data and create it again. However thanks to this feature - # implemented by Oran Agra for Redis 4.0 this process can happen at runtime - # in an "hot" way, while the server is running. - # - # Basically when the fragmentation is over a certain level (see the - # configuration options below) Redis will start to create new copies of the - # values in contiguous memory regions by exploiting certain specific Jemalloc - # features (in order to understand if an allocation is causing fragmentation - # and to allocate it in a better place), and at the same time, will release the - # old copies of the data. This process, repeated incrementally for all the keys - # will cause the fragmentation to drop back to normal values. - # - # Important things to understand: - # - # 1. This feature is disabled by default, and only works if you compiled Redis - # to use the copy of Jemalloc we ship with the source code of Redis. - # This is the default with Linux builds. - # - # 2. You never need to enable this feature if you don't have fragmentation - # issues. - # - # 3. Once you experience fragmentation, you can enable this feature when - # needed with the command "CONFIG SET activedefrag yes". - # - # The configuration parameters are able to fine tune the behavior of the - # defragmentation process. If you are not sure about what they mean it is - # a good idea to leave the defaults untouched. - - # Enabled active defragmentation - # activedefrag no - - # Minimum amount of fragmentation waste to start active defrag - # active-defrag-ignore-bytes 100mb - - # Minimum percentage of fragmentation to start active defrag - # active-defrag-threshold-lower 10 - - # Maximum percentage of fragmentation at which we use maximum effort - # active-defrag-threshold-upper 100 - - # Minimal effort for defrag in CPU percentage, to be used when the lower - # threshold is reached - # active-defrag-cycle-min 1 - - # Maximal effort for defrag in CPU percentage, to be used when the upper - # threshold is reached - # active-defrag-cycle-max 25 - - # Maximum number of set/hash/zset/list fields that will be processed from - # the main dictionary scan - # active-defrag-max-scan-fields 1000 - - # Jemalloc background thread for purging will be enabled by default - jemalloc-bg-thread yes - - # It is possible to pin different threads and processes of Redis to specific - # CPUs in your system, in order to maximize the performances of the server. - # This is useful both in order to pin different Redis threads in different - # CPUs, but also in order to make sure that multiple Redis instances running - # in the same host will be pinned to different CPUs. - # - # Normally you can do this using the "taskset" command, however it is also - # possible to this via Redis configuration directly, both in Linux and FreeBSD. - # - # You can pin the server/IO threads, bio threads, aof rewrite child process, and - # the bgsave child process. The syntax to specify the cpu list is the same as - # the taskset command: - # - # Set redis server/io threads to cpu affinity 0,2,4,6: - # server_cpulist 0-7:2 - # - # Set bio threads to cpu affinity 1,3: - # bio_cpulist 1,3 - # - # Set aof rewrite child process to cpu affinity 8,9,10,11: - # aof_rewrite_cpulist 8-11 - # - # Set bgsave child process to cpu affinity 1,10,11 - # bgsave_cpulist 1,10-11 -{{- if .Values.redis.configmap }} -{{- include "common.tplvalues.render" (dict "value" .Values.redis.configmap "context" $) | nindent 4 }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/extra-list.yaml b/rds/base/charts/redis-cluster/templates/extra-list.yaml deleted file mode 100644 index 9ac65f9..0000000 --- a/rds/base/charts/redis-cluster/templates/extra-list.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- range .Values.extraDeploy }} ---- -{{ include "common.tplvalues.render" (dict "value" . "context" $) }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/headless-svc.yaml b/rds/base/charts/redis-cluster/templates/headless-svc.yaml deleted file mode 100644 index e95badc..0000000 --- a/rds/base/charts/redis-cluster/templates/headless-svc.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" . }}-headless - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - type: ClusterIP - clusterIP: None - publishNotReadyAddresses: true - ports: - - name: tcp-redis - port: {{ .Values.redis.containerPorts.redis }} - targetPort: tcp-redis - - name: tcp-redis-bus - port: {{ .Values.redis.containerPorts.bus }} - targetPort: tcp-redis-bus - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} diff --git a/rds/base/charts/redis-cluster/templates/metrics-prometheus.yaml b/rds/base/charts/redis-cluster/templates/metrics-prometheus.yaml deleted file mode 100644 index 540cf3d..0000000 --- a/rds/base/charts/redis-cluster/templates/metrics-prometheus.yaml +++ /dev/null @@ -1,54 +0,0 @@ -{{- if and (.Values.metrics.enabled) (.Values.metrics.serviceMonitor.enabled) }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "common.names.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace | default .Release.Namespace | quote }} - {{- else}} - namespace: {{ .Release.Namespace }} - {{- end }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.labels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.labels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.commonAnnotations .Values.metrics.serviceMonitor.annotations }} - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.annotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -spec: - {{- if .Values.metrics.serviceMonitor.jobLabel }} - jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }} - {{- end }} - endpoints: - - port: metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelings }} - relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }} - {{- end }} - selector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} - {{- if .Values.metrics.serviceMonitor.selector }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }} - {{- end }} - app.kubernetes.io/component: "metrics" - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/templates/metrics-svc.yaml b/rds/base/charts/redis-cluster/templates/metrics-svc.yaml deleted file mode 100644 index 14305dd..0000000 --- a/rds/base/charts/redis-cluster/templates/metrics-svc.yaml +++ /dev/null @@ -1,35 +0,0 @@ -{{- if .Values.metrics.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" . }}-metrics - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.metrics.service.labels }} - {{ include "common.tplvalues.render" ( dict "value" .Values.metrics.service.labels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - app.kubernetes.io/component: "metrics" - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.metrics.service.annotations }} - {{ include "common.tplvalues.render" ( dict "value" .Values.metrics.service.annotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.metrics.service.type }} - {{- if and .Values.metrics.service.clusterIP (eq .Values.metrics.service.type "ClusterIP") }} - clusterIP: {{ .Values.metrics.service.clusterIP }} - {{- end }} - {{- if and (eq .Values.metrics.service.type "LoadBalancer") .Values.metrics.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }} - {{- end }} - ports: - - name: metrics - port: 9121 - targetPort: http-metrics - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/networkpolicy.yaml b/rds/base/charts/redis-cluster/templates/networkpolicy.yaml deleted file mode 100644 index d7b4f16..0000000 --- a/rds/base/charts/redis-cluster/templates/networkpolicy.yaml +++ /dev/null @@ -1,66 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ template "networkPolicy.apiVersion" . }} -metadata: - name: {{ template "common.names.fullname" . }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - namespace: {{ .Release.Namespace }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - podSelector: - matchLabels: - app.kubernetes.io/name: {{ template "common.names.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - policyTypes: - - Ingress - - Egress - egress: - # Allow dns resolution - - ports: - - port: 53 - protocol: UDP - # Allow outbound connections to other cluster pods - - ports: - - port: {{ .Values.redis.containerPorts.redis }} - - port: {{ .Values.redis.containerPorts.bus }} - to: - - podSelector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} - ingress: - # Allow inbound connections - - ports: - - port: {{ .Values.redis.containerPorts.redis }} - - port: {{ .Values.redis.containerPorts.bus }} - from: - {{- if not .Values.networkPolicy.allowExternal }} - - podSelector: - matchLabels: - {{ template "common.names.fullname" . }}-client: "true" - - podSelector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} - {{- end }} - {{- if .Values.networkPolicy.ingressNSMatchLabels }} - - namespaceSelector: - matchLabels: - {{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }} - {{ $key | quote }}: {{ $value | quote }} - {{- end }} - {{- end }} - {{- if .Values.networkPolicy.ingressNSPodMatchLabels }} - - podSelector: - matchLabels: - {{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }} - {{ $key | quote }}: {{ $value | quote }} - {{- end }} - {{- end }} - {{- if .Values.metrics.enabled }} - # Allow prometheus scrapes for metrics - - ports: - - port: 9121 - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/poddisruptionbudget.yaml b/rds/base/charts/redis-cluster/templates/poddisruptionbudget.yaml deleted file mode 100644 index abef667..0000000 --- a/rds/base/charts/redis-cluster/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if .Values.podDisruptionBudget }} -apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} -kind: PodDisruptionBudget -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - selector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} - matchExpressions: - - {key: job-name, operator: NotIn, values: [{{ template "common.names.fullname" . }}-cluster-update]} - {{- toYaml .Values.podDisruptionBudget | nindent 2 }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/prometheusrule.yaml b/rds/base/charts/redis-cluster/templates/prometheusrule.yaml deleted file mode 100644 index d781ee1..0000000 --- a/rds/base/charts/redis-cluster/templates/prometheusrule.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ template "common.names.fullname" . }} - {{- if .Values.metrics.prometheusRule.namespace }} - namespace: {{ .Values.metrics.prometheusRule.namespace }} - {{- else }} - namespace: {{ .Release.Namespace }} - {{- end }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.metrics.prometheusRule.additionalLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- with .Values.metrics.prometheusRule.rules }} - groups: - - name: {{ template "common.names.name" $ }} - rules: {{- include "common.tplvalues.render" ( dict "value" . "context" $ ) | nindent 8 }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/psp.yaml b/rds/base/charts/redis-cluster/templates/psp.yaml deleted file mode 100644 index e048bce..0000000 --- a/rds/base/charts/redis-cluster/templates/psp.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} -{{- if and $pspAvailable .Values.podSecurityPolicy.create }} -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - allowPrivilegeEscalation: false - fsGroup: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.podSecurityContext.fsGroup }} - max: {{ .Values.podSecurityContext.fsGroup }} - hostIPC: false - hostNetwork: false - hostPID: false - privileged: false - readOnlyRootFilesystem: false - requiredDropCapabilities: - - ALL - runAsUser: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.podSecurityContext.runAsUser }} - max: {{ .Values.podSecurityContext.runAsUser }} - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.podSecurityContext.runAsUser }} - max: {{ .Values.podSecurityContext.runAsUser }} - volumes: - - 'configMap' - - 'secret' - - 'emptyDir' - - 'persistentVolumeClaim' -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/redis-role.yaml b/rds/base/charts/redis-cluster/templates/redis-role.yaml deleted file mode 100644 index f951f23..0000000 --- a/rds/base/charts/redis-cluster/templates/redis-role.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: Role -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -rules: - {{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} - {{- if and $pspAvailable .Values.podSecurityPolicy.create }} - - apiGroups: ['{{ template "podSecurityPolicy.apiGroup" . }}'] - resources: ['podsecuritypolicies'] - verbs: ['use'] - resourceNames: [{{ template "common.names.fullname" . }}] -{{- end -}} -{{- if .Values.rbac.role.rules }} -{{- toYaml .Values.rbac.role.rules | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/templates/redis-rolebinding.yaml b/rds/base/charts/redis-cluster/templates/redis-rolebinding.yaml deleted file mode 100644 index 2b7f431..0000000 --- a/rds/base/charts/redis-cluster/templates/redis-rolebinding.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: RoleBinding -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "common.names.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "redis-cluster.serviceAccountName" . }} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/templates/redis-serviceaccount.yaml b/rds/base/charts/redis-cluster/templates/redis-serviceaccount.yaml deleted file mode 100644 index 6fdb831..0000000 --- a/rds/base/charts/redis-cluster/templates/redis-serviceaccount.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "redis-cluster.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} - annotations: - {{- if .Values.serviceAccount.annotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.annotations "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} - {{- end }} - {{- end }} -automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/templates/redis-statefulset.yaml b/rds/base/charts/redis-cluster/templates/redis-statefulset.yaml deleted file mode 100644 index 3ff181d..0000000 --- a/rds/base/charts/redis-cluster/templates/redis-statefulset.yaml +++ /dev/null @@ -1,449 +0,0 @@ -{{- if (include "redis-cluster.createStatefulSet" .) }} -apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ include "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.redis.updateStrategy }} - updateStrategy: {{- toYaml .Values.redis.updateStrategy | nindent 4 }} - {{- end }} - selector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} - replicas: {{ .Values.cluster.nodes }} - serviceName: {{ include "common.names.fullname" . }}-headless - podManagementPolicy: {{ .Values.redis.podManagementPolicy }} - template: - metadata: - labels: {{- include "common.labels.standard" . | nindent 8 }} - {{- if .Values.redis.podLabels }} - {{- toYaml .Values.redis.podLabels | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} - {{- toYaml .Values.metrics.podLabels | nindent 8 }} - {{- end }} - annotations: - checksum/scripts: {{ include (print $.Template.BasePath "/scripts-configmap.yaml") . | sha256sum }} - {{- if not .Values.existingSecret }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- end }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - {{- if .Values.redis.podAnnotations }} - {{- toYaml .Values.redis.podAnnotations | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} - {{- toYaml .Values.metrics.podAnnotations | nindent 8 }} - {{- end }} - spec: - hostNetwork: {{ .Values.redis.hostNetwork }} - {{- if semverCompare ">= 1.13" (include "common.capabilities.kubeVersion" .) }} - enableServiceLinks: false - {{- end }} - {{- include "redis-cluster.imagePullSecrets" . | nindent 6 }} - {{- if .Values.podSecurityContext.enabled }} - securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "redis-cluster.serviceAccountName" . }} - {{- if .Values.redis.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.redis.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.redis.priorityClassName }} - priorityClassName: {{ .Values.redis.priorityClassName }} - {{- end }} - {{- if .Values.redis.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.redis.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.redis.podAffinityPreset "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.redis.podAntiAffinityPreset "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.redis.nodeAffinityPreset.type "key" .Values.redis.nodeAffinityPreset.key "values" .Values.redis.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.redis.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.redis.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.redis.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.redis.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.redis.shareProcessNamespace }} - shareProcessNamespace: {{ .Values.redis.shareProcessNamespace }} - {{- end }} - {{- if .Values.redis.schedulerName }} - schedulerName: {{ .Values.redis.schedulerName | quote }} - {{- end }} - {{- if .Values.redis.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" ( dict "value" .Values.redis.topologySpreadConstraints "context" $ ) | nindent 8 }} - {{- end }} - containers: - - name: {{ include "common.names.fullname" . }} - image: {{ include "redis-cluster.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.redis.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.redis.command "context" $) | nindent 12 }} - {{- else }} - command: ['/bin/bash', '-c'] - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.redis.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.redis.args "context" $) | nindent 12 }} - {{- else if .Values.cluster.externalAccess.enabled }} - args: - - | - # Backwards compatibility change - if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then - cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf - fi - pod_index=($(echo "$POD_NAME" | tr "-" "\n")) - pod_index="${pod_index[-1]}" - ips=($(echo "{{ .Values.cluster.externalAccess.service.loadBalancerIP }}" | cut -d [ -f2 | cut -d ] -f 1)) - export REDIS_CLUSTER_ANNOUNCE_IP="${ips[$pod_index]}" - export REDIS_NODES="${ips[@]}" - {{- if .Values.cluster.init }} - if [[ "$pod_index" == "0" ]]; then - export REDIS_CLUSTER_CREATOR="yes" - export REDIS_CLUSTER_REPLICAS="{{ .Values.cluster.replicas }}" - fi - {{- end }} - /opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh - {{- else }} - args: - - | - # Backwards compatibility change - if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then - echo COPYING FILE - cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf - fi - {{- if .Values.cluster.init }} - pod_index=($(echo "$POD_NAME" | tr "-" "\n")) - pod_index="${pod_index[-1]}" - if [[ "$pod_index" == "0" ]]; then - export REDIS_CLUSTER_CREATOR="yes" - export REDIS_CLUSTER_REPLICAS="{{ .Values.cluster.replicas }}" - fi - {{- end }} - /opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh - {{- end }} - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - {{- if .Values.cluster.externalAccess.enabled }} - - name: REDIS_CLUSTER_DYNAMIC_IPS - value: "no" - {{- else }} - - name: REDIS_NODES - value: "{{ $count := .Values.cluster.nodes | int }}{{ range $i, $v := until $count }}{{ include "common.names.fullname" $ }}-{{ $i }}.{{ template "common.names.fullname" $ }}-headless {{ end }}" - {{- end }} - {{- if .Values.usePassword }} - - name: REDISCLI_AUTH - valueFrom: - secretKeyRef: - name: {{ template "redis-cluster.secretName" . }} - key: {{ template "redis-cluster.secretPasswordKey" . }} - {{- if .Values.usePasswordFile }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis-cluster.secretName" . }} - key: {{ template "redis-cluster.secretPasswordKey" . }} - {{- end }} - {{- else }} - - name: ALLOW_EMPTY_PASSWORD - value: "yes" - {{- end }} - - name: REDIS_AOF_ENABLED - value: {{ .Values.redis.useAOFPersistence | quote }} - - name: REDIS_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_PORT - value: {{ .Values.redis.containerPorts.redis | quote }} - - name: REDIS_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis-cluster.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis-cluster.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis-cluster.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_TLS_DH_PARAMS_FILE - value: {{ template "redis-cluster.tlsDHParams" . }} - {{- end }} - {{- else }} - - name: REDIS_PORT - value: {{ .Values.redis.containerPorts.redis | quote }} - {{- end }} - {{- if .Values.redis.extraEnvVars }} - {{- include "common.tplvalues.render" ( dict "value" .Values.redis.extraEnvVars "context" $ ) | nindent 12 }} - {{- end }} - {{- if or .Values.redis.extraEnvVarsCM .Values.redis.extraEnvVarsSecret }} - envFrom: - {{- if .Values.redis.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.redis.extraEnvVarsCM "context" $ ) }} - {{- end }} - {{- if .Values.redis.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" ( dict "value" .Values.redis.extraEnvVarsSecret "context" $ ) }} - {{- end }} - {{- end }} - ports: - - name: tcp-redis - containerPort: {{ .Values.redis.containerPorts.redis }} - - name: tcp-redis-bus - containerPort: {{ .Values.redis.containerPorts.bus }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.redis.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.redis.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.redis.livenessProbe.periodSeconds }} - # One second longer than command timeout should prevent generation of zombie processes. - timeoutSeconds: {{ add1 .Values.redis.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.redis.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.redis.livenessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /scripts/ping_liveness_local.sh {{ .Values.redis.livenessProbe.timeoutSeconds }} - {{- else if .Values.redis.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.redis.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.redis.readinessProbe.enabled }} - readinessProbe: - initialDelaySeconds: {{ .Values.redis.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.redis.readinessProbe.periodSeconds }} - # One second longer than command timeout should prevent generation of zombie processes. - timeoutSeconds: {{ add1 .Values.redis.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.redis.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.redis.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /scripts/ping_readiness_local.sh {{ .Values.redis.readinessProbe.timeoutSeconds }} - {{- else if .Values.redis.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.redis.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.redis.startupProbe.enabled }} - startupProbe: - tcpSocket: - port: tcp-redis - initialDelaySeconds: {{ .Values.redis.startupProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.redis.startupProbe.periodSeconds }} - timeoutSeconds: {{ .Values.redis.startupProbe.timeoutSeconds }} - successThreshold: {{ .Values.redis.startupProbe.successThreshold }} - failureThreshold: {{ .Values.redis.startupProbe.failureThreshold }} - {{- else if .Values.redis.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.redis.customStartupProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.redis.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.redis.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.redis.resources }} - resources: - {{- include "common.tplvalues.render" (dict "value" .Values.redis.resources "context" $) | nindent 12 }} - {{- end }} - volumeMounts: - - name: scripts - mountPath: /scripts - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: {{ .Values.persistence.path }} - subPath: {{ .Values.persistence.subPath }} - - name: default-config - mountPath: /opt/bitnami/redis/etc/redis-default.conf - subPath: redis-default.conf - - name: redis-tmp-conf - mountPath: /opt/bitnami/redis/etc/ - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.redis.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.redis.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ template "redis-cluster.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else }} - command: - - /bin/bash - - -c - - | - {{- if .Values.usePasswordFile }} - export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" - {{- end }} - redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - - name: REDIS_ALIAS - value: {{ template "common.names.fullname" . }} - - name: REDIS_ADDR - value: {{ printf "%s://127.0.0.1:%g" (ternary "rediss" "redis" .Values.tls.enabled) .Values.redis.containerPorts.redis | quote }} - {{- if and .Values.usePassword (not .Values.usePasswordFile) }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis-cluster.secretName" . }} - key: {{ template "redis-cluster.secretPasswordKey" . }} - {{- end }} - {{- if .Values.usePasswordFile }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- end }} - {{- if .Values.tls.enabled }} - - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE - value: {{ template "redis-cluster.tlsCertKey" . }} - - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE - value: {{ template "redis-cluster.tlsCert" . }} - - name: REDIS_EXPORTER_TLS_CA_CERT_FILE - value: {{ template "redis-cluster.tlsCACert" . }} - {{- end }} - {{- if or .Values.usePasswordFile .Values.tls.enabled }} - volumeMounts: - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- end }} - ports: - - name: http-metrics - containerPort: 9121 - resources: - {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- end }} - {{- if .Values.redis.sidecars }} - {{- include "common.tplvalues.render" ( dict "value" .Values.redis.sidecars "context" $ ) | nindent 8 }} - {{- end }} - {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.containerSecurityContext.enabled }} - {{- if or $needsVolumePermissions .Values.sysctlImage.enabled .Values.redis.initContainers }} - initContainers: - {{- if $needsVolumePermissions }} - - name: volume-permissions - image: {{ include "redis-cluster.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: ["/bin/chown", "-R", "{{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }}", "{{ .Values.persistence.path }}"] - securityContext: - runAsUser: 0 - resources: - {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - volumeMounts: - - name: redis-data - mountPath: {{ .Values.persistence.path }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - {{- if .Values.sysctlImage.enabled }} - - name: init-sysctl - image: {{ template "redis-cluster.sysctl.image" . }} - imagePullPolicy: {{ default "" .Values.sysctlImage.pullPolicy | quote }} - resources: - {{- toYaml .Values.sysctlImage.resources | nindent 12 }} - {{- if .Values.sysctlImage.mountHostSys }} - volumeMounts: - - name: host-sys - mountPath: /host-sys - {{- end }} - command: - {{- toYaml .Values.sysctlImage.command | nindent 12 }} - securityContext: - privileged: true - runAsUser: 0 - {{- end }} - {{- if .Values.redis.initContainers }} - {{- toYaml .Values.redis.initContainers | nindent 8 }} - {{- end }} - {{- end }} - volumes: - - name: scripts - configMap: - name: {{ include "common.names.fullname" . }}-scripts - defaultMode: 0755 - {{- if .Values.usePasswordFile }} - - name: redis-password - secret: - secretName: {{ include "redis-cluster.secretName" . }} - items: - - key: {{ include "redis-cluster.secretPasswordKey" . }} - path: redis-password - {{- end }} - - name: default-config - configMap: - name: {{ include "common.names.fullname" . }}-default - {{- if .Values.sysctlImage.mountHostSys }} - - name: host-sys - hostPath: - path: /sys - {{- end }} - - name: redis-tmp-conf - emptyDir: {} - {{- if .Values.redis.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.redis.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - secret: - secretName: {{ include "redis-cluster.tlsSecretName" . }} - defaultMode: 256 - {{- end }} - volumeClaimTemplates: - - metadata: - name: redis-data - labels: {{- include "common.labels.matchLabels" . | nindent 10 }} - {{- if .Values.persistence.annotations }} - annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }} - {{- end }} - spec: - accessModes: - {{- range .Values.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }} - {{- if or .Values.persistence.matchLabels .Values.persistence.matchExpressions }} - selector: - {{- if .Values.persistence.matchLabels }} - matchLabels: - {{- toYaml .Values.persistence.matchLabels | nindent 12 }} - {{- end -}} - {{- if .Values.persistence.matchExpressions }} - matchExpressions: - {{- toYaml .Values.persistence.matchExpressions | nindent 12 }} - {{- end -}} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/redis-svc.yaml b/rds/base/charts/redis-cluster/templates/redis-svc.yaml deleted file mode 100644 index 22c0017..0000000 --- a/rds/base/charts/redis-cluster/templates/redis-svc.yaml +++ /dev/null @@ -1,53 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.service.labels -}} - {{ include "common.tplvalues.render" ( dict "value" .Values.service.labels "context" $ ) | nindent 4 }} - {{- end -}} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.service.annotations }} - {{ include "common.tplvalues.render" ( dict "value" .Values.service.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - type: {{ .Values.service.type }} - {{- if and .Values.service.clusterIP (eq .Values.service.type "ClusterIP") }} - clusterIP: {{ .Values.service.clusterIP }} - {{- end }} - {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }} - externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerSourceRanges)) }} - loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }} - {{- end }} - {{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }} - loadBalancerIP: {{ .Values.service.loadBalancerIP }} - {{- end }} - {{- if .Values.service.sessionAffinity }} - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- end }} - {{- if .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - ports: - - name: tcp-redis - port: {{ .Values.service.ports.redis }} - targetPort: tcp-redis - protocol: TCP - {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.redis)) }} - nodePort: {{ .Values.service.nodePorts.redis }} - {{- else if eq .Values.service.type "ClusterIP" }} - nodePort: null - {{- end }} - {{- if .Values.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - selector: {{- include "common.labels.matchLabels" $ | nindent 4 }} diff --git a/rds/base/charts/redis-cluster/templates/scripts-configmap.yaml b/rds/base/charts/redis-cluster/templates/scripts-configmap.yaml deleted file mode 100644 index 7cd2a4c..0000000 --- a/rds/base/charts/redis-cluster/templates/scripts-configmap.yaml +++ /dev/null @@ -1,111 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "common.names.fullname" . }}-scripts - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - ping_readiness_local.sh: |- - #!/bin/sh - set -e - - REDIS_STATUS_FILE=/tmp/.redis_cluster_check - - {{- if .Values.usePasswordFile }} - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDISCLI_AUTH=$password_aux - {{- else }} - if [ ! -z "$REDIS_PASSWORD" ]; then export REDISCLI_AUTH=$REDIS_PASSWORD; fi; - {{- end }} - response=$( - timeout -s 3 $1 \ - redis-cli \ - -h localhost \ -{{- if .Values.tls.enabled }} - -p $REDIS_TLS_PORT \ - --tls \ - --cert {{ template "redis-cluster.tlsCert" . }} \ - --key {{ template "redis-cluster.tlsCertKey" . }} \ - --cacert {{ template "redis-cluster.tlsCACert" . }} \ -{{- else }} - -p $REDIS_PORT \ -{{- end }} - ping - ) - if [ "$?" -eq "124" ]; then - echo "Timed out" - exit 1 - fi - if [ "$response" != "PONG" ]; then - echo "$response" - exit 1 - fi -{{- if not .Values.cluster.externalAccess.enabled }} - if [ ! -f "$REDIS_STATUS_FILE" ]; then - response=$( - timeout -s 3 $1 \ - redis-cli \ - -h localhost \ - {{- if .Values.tls.enabled }} - -p $REDIS_TLS_PORT \ - --tls \ - --cert {{ template "redis-cluster.tlsCert" . }} \ - --key {{ template "redis-cluster.tlsCertKey" . }} \ - --cacert {{ template "redis-cluster.tlsCACert" . }} \ - {{- else }} - -p $REDIS_PORT \ - {{- end }} - CLUSTER INFO | grep cluster_state | tr -d '[:space:]' - ) - if [ "$?" -eq "124" ]; then - echo "Timed out" - exit 1 - fi - if [ "$response" != "cluster_state:ok" ]; then - echo "$response" - exit 1 - else - touch "$REDIS_STATUS_FILE" - fi - fi -{{- end }} - ping_liveness_local.sh: |- - #!/bin/sh - set -e - - {{- if .Values.usePasswordFile }} - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDISCLI_AUTH=$password_aux - {{- else }} - if [ ! -z "$REDIS_PASSWORD" ]; then export REDISCLI_AUTH=$REDIS_PASSWORD; fi; - {{- end }} - response=$( - timeout -s 3 $1 \ - redis-cli \ - -h localhost \ -{{- if .Values.tls.enabled }} - -p $REDIS_TLS_PORT \ - --tls \ - --cert {{ template "redis-cluster.tlsCert" . }} \ - --key {{ template "redis-cluster.tlsCertKey" . }} \ - --cacert {{ template "redis-cluster.tlsCACert" . }} \ -{{- else }} - -p $REDIS_PORT \ -{{- end }} - ping - ) - if [ "$?" -eq "124" ]; then - echo "Timed out" - exit 1 - fi - responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') - if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then - echo "$response" - exit 1 - fi diff --git a/rds/base/charts/redis-cluster/templates/secret.yaml b/rds/base/charts/redis-cluster/templates/secret.yaml deleted file mode 100644 index 9b95aef..0000000 --- a/rds/base/charts/redis-cluster/templates/secret.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if and .Values.usePassword (not .Values.existingSecret) -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: Opaque -data: - redis-password: {{ include "redis-cluster.password" . | b64enc | quote }} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/templates/svc-cluster-external-access.yaml b/rds/base/charts/redis-cluster/templates/svc-cluster-external-access.yaml deleted file mode 100644 index 9778040..0000000 --- a/rds/base/charts/redis-cluster/templates/svc-cluster-external-access.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if .Values.cluster.externalAccess.enabled }} -{{- $fullName := include "common.names.fullname" . }} -{{- $nodesCount := .Values.cluster.nodes | int }} -{{- $root := . }} - -{{- range $i, $e := until $nodesCount }} -{{- $targetPod := printf "%s-%d" (printf "%s" $fullName) $i }} -{{- $_ := set $ "targetPod" $targetPod }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" $ }}-{{ $i }}-svc - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" $ | nindent 4 }} - pod: {{ $targetPod }} - {{- if $root.Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" $root.Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if $root.Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" $root.Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if $root.Values.cluster.externalAccess.service.annotations }} - {{ include "common.tplvalues.render" ( dict "value" $root.Values.cluster.externalAccess.service.annotations "context" $) | nindent 4 }} - {{- end }} -spec: - type: {{ $root.Values.cluster.externalAccess.service.type }} - {{- if $root.Values.cluster.externalAccess.service.loadBalancerIP }} - loadBalancerIP: {{ index $root.Values.cluster.externalAccess.service.loadBalancerIP $i }} - {{- end }} - {{- if and (eq $root.Values.cluster.externalAccess.service.type "LoadBalancer") $root.Values.cluster.externalAccess.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{- toYaml $root.Values.cluster.externalAccess.service.loadBalancerSourceRanges | nindent 4 }} - {{- end }} - ports: - - name: tcp-redis - port: {{ $root.Values.cluster.externalAccess.service.port }} - targetPort: tcp-redis - - name: tcp-redis-bus - targetPort: tcp-redis-bus - port: {{ $root.Values.redis.containerPorts.bus }} - selector: {{- include "common.labels.matchLabels" $ | nindent 4 }} - statefulset.kubernetes.io/pod-name: {{ $targetPod }} ---- -{{- end }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/tls-secret.yaml b/rds/base/charts/redis-cluster/templates/tls-secret.yaml deleted file mode 100644 index 5cf2afa..0000000 --- a/rds/base/charts/redis-cluster/templates/tls-secret.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if (include "redis-cluster.createTlsSecret" .) }} -{{- $ca := genCA "redis-cluster-ca" 365 }} -{{- $releaseNamespace := .Release.Namespace }} -{{- $clusterDomain := .Values.clusterDomain }} -{{- $fullname := include "common.names.fullname" . }} -{{- $serviceName := include "common.names.fullname" . }} -{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) }} -{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) "127.0.0.1" "localhost" $fullname }} -{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "common.names.fullname" . }}-crt - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: kubernetes.io/tls -data: - ca.crt: {{ $ca.Cert | b64enc | quote }} - tls.crt: {{ $crt.Cert | b64enc | quote }} - tls.key: {{ $crt.Key | b64enc | quote }} -{{- end }} diff --git a/rds/base/charts/redis-cluster/templates/update-cluster.yaml b/rds/base/charts/redis-cluster/templates/update-cluster.yaml deleted file mode 100644 index a0b3fc6..0000000 --- a/rds/base/charts/redis-cluster/templates/update-cluster.yaml +++ /dev/null @@ -1,266 +0,0 @@ -{{- if and .Values.cluster.update.addNodes ( or (and .Values.cluster.externalAccess.enabled .Values.cluster.externalAccess.service.loadBalancerIP) ( not .Values.cluster.externalAccess.enabled )) }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "common.names.fullname" . }}-cluster-update - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - "helm.sh/hook": post-upgrade - {{- if .Values.updateJob.annotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.updateJob.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - activeDeadlineSeconds: {{ .Values.updateJob.activeDeadlineSeconds }} - template: - metadata: - labels: {{- include "common.labels.standard" . | nindent 8 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.updateJob.podLabels }} - {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.podLabels "context" $) | nindent 8 }} - {{- end }} - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.updateJob.podAnnotations }} - {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.podAnnotations "context" $) | nindent 8 }} - {{- end }} - spec: - {{- include "redis-cluster.imagePullSecrets" . | nindent 6 }} - {{- if .Values.updateJob.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.updateJob.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.updateJob.podAffinityPreset "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.updateJob.podAntiAffinityPreset "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.updateJob.nodeAffinityPreset.type "key" .Values.updateJob.nodeAffinityPreset.key "values" .Values.updateJob.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.updateJob.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.updateJob.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.updateJob.priorityClassName }} - priorityClassName: {{ .Values.updateJob.priorityClassName }} - {{- end }} - {{- if .Values.podSecurityContext.enabled }} - securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "redis-cluster.serviceAccountName" . }} - {{- if .Values.updateJob.initContainers }} - initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.initContainers "context" $) | nindent 8 }} - {{- end }} - containers: - - name: trigger - image: {{ include "redis-cluster.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.updateJob.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.command "context" $) | nindent 12 }} - {{- else }} - command: ['/bin/bash', '-c'] - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.updateJob.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.args "context" $) | nindent 12 }} - {{- else }} - args: - - | - . /opt/bitnami/scripts/libnet.sh - . /opt/bitnami/scripts/libos.sh - # Backwards compatibility change - if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then - cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf - fi - firstNodeIP=$(wait_for_dns_lookup {{ template "common.names.fullname" . }}-0.{{ template "common.names.fullname" . }}-headless 120 5) - {{- if .Values.cluster.externalAccess.enabled }} - newNodeCounter=0 - for nodeIP in $(echo "{{ .Values.cluster.update.newExternalIPs }}" | cut -d [ -f2 | cut -d ] -f 1 ); do - {{- if .Values.tls.enabled }} - while [[ $(redis-cli -h "$nodeIP" -p "$REDIS_TLS_PORT" --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} ping) != 'PONG' ]]; do - {{- else }} - while [[ $(redis-cli -h "$nodeIP" -p "$REDIS_PORT" ping) != 'PONG' ]]; do - {{- end }} - echo "Node $nodeIP not ready, waiting for all the nodes to be ready..." - sleep 5 - done - slave=() - if (( $REDIS_CLUSTER_REPLICAS >= 1 )) && (( newNodeCounter % (( $REDIS_CLUSTER_REPLICAS + 1 )) )); then - slave+=("--cluster-slave") - fi - {{- if .Values.tls.enabled }} - while ! redis-cli --cluster --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} add-node "${nodeIP}:${REDIS_TLS_PORT}" "{{ index .Values.cluster.externalAccess.service.loadBalancerIP 0 }}:${REDIS_TLS_PORT}" ${slave[@]}; do - {{- else }} - while ! redis-cli --cluster add-node "${nodeIP}:${REDIS_PORT}" "{{ index .Values.cluster.externalAccess.service.loadBalancerIP 0 }}:${REDIS_PORT}" ${slave[@]}; do - {{- end }} - echo "Add-node ${newNodeIndex} ${newNodeIP} failed, retrying" - sleep 5 - done - ((newNodeCounter += 1)) - done - - {{- if .Values.tls.enabled }} - while ! redis-cli --cluster rebalance --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} "{{ index .Values.cluster.externalAccess.service.loadBalancerIP 0 }}:${REDIS_TLS_PORT}" --cluster-use-empty-masters; do - {{- else }} - while ! redis-cli --cluster rebalance "{{ index .Values.cluster.externalAccess.service.loadBalancerIP 0 }}:${REDIS_PORT}" --cluster-use-empty-masters; do - {{- end }} - echo "Rebalance failed, retrying" - sleep 5 - {{- if .Values.tls.enabled }} - redis-cli --cluster fix --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} "{{ index .Values.cluster.externalAccess.service.loadBalancerIP 0 }}:${REDIS_TLS_PORT}" - {{- else }} - redis-cli --cluster fix "{{ index .Values.cluster.externalAccess.service.loadBalancerIP 0 }}:${REDIS_PORT}" - {{- end }} - done - - {{- else }} - # number of currently deployed redis master nodes - currentMasterNodesNum="$(( {{ .Values.cluster.update.currentNumberOfNodes }} / (( {{ .Values.cluster.update.currentNumberOfReplicas }} + 1 )) ))" - # end postion of new replicas that should be assigned to original redis master nodes - slaveNodesEndPos="$(( {{ .Values.cluster.update.currentNumberOfNodes }} + (($REDIS_CLUSTER_REPLICAS - {{ .Values.cluster.update.currentNumberOfReplicas }})) * $currentMasterNodesNum ))" - for node in $(seq $((1+{{ .Values.cluster.update.currentNumberOfNodes }})) {{ .Values.cluster.nodes }}); do - newNodeIndex="$(($node - 1))" - newNodeIP=$(wait_for_dns_lookup "{{ template "common.names.fullname" . }}-${newNodeIndex}.{{ template "common.names.fullname" . }}-headless" 120 5) - {{- if .Values.tls.enabled }} - while [[ $(redis-cli -h "$newNodeIP" -p "$REDIS_TLS_PORT" --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} ping) != 'PONG' ]]; do - {{- else }} - while [[ $(redis-cli -h "$newNodeIP" -p "$REDIS_PORT" ping) != 'PONG' ]]; do - {{- end }} - echo "Node $newNodeIP not ready, waiting for all the nodes to be ready..." - newNodeIP=$(wait_for_dns_lookup "{{ template "common.names.fullname" . }}-${newNodeIndex}.{{ template "common.names.fullname" . }}-headless" 120 5) - sleep 5 - done - slave=() - # when the index of the new node is less than `slaveNodesEndPos`，the added node is a replica that assigned to original redis master node - # when the index of the new node is greater than or equal to `slaveNodesEndPos`，and it is not a multiple of `$REDIS_CLUSTER_REPLICAS + 1`, the added node is a replica that assigned to newly added master node - if (( $REDIS_CLUSTER_REPLICAS >= 1 )) && (( (( $newNodeIndex < $slaveNodesEndPos )) || (( (( $newNodeIndex >= $slaveNodesEndPos )) && (( $newNodeIndex % (( $REDIS_CLUSTER_REPLICAS + 1 )) )) )) )); then - slave+=("--cluster-slave") - fi - {{- if .Values.tls.enabled }} - while ! redis-cli --cluster add-node --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} "${newNodeIP}:${REDIS_TLS_PORT}" "${firstNodeIP}:${REDIS_TLS_PORT}" ${slave[@]}; do - {{- else }} - while ! redis-cli --cluster add-node "${newNodeIP}:${REDIS_PORT}" "${firstNodeIP}:${REDIS_PORT}" ${slave[@]}; do - {{- end }} - echo "Add-node ${newNodeIndex} ${newNodeIP} failed, retrying" - sleep 5 - firstNodeIP=$(wait_for_dns_lookup "{{ template "common.names.fullname" . }}-0.{{ template "common.names.fullname" . }}-headless" 120 5) - newNodeIP=$(wait_for_dns_lookup "{{ template "common.names.fullname" . }}-${newNodeIndex}.{{ template "common.names.fullname" . }}-headless" 120 5) - done - done - - {{- if .Values.tls.enabled }} - while ! redis-cli --cluster rebalance --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} "${firstNodeIP}:${REDIS_TLS_PORT}" --cluster-use-empty-masters; do - {{- else }} - while ! redis-cli --cluster rebalance "${firstNodeIP}:${REDIS_PORT}" --cluster-use-empty-masters; do - {{- end }} - echo "Rebalance failed, retrying" - sleep 5 - firstNodeIP=$(wait_for_dns_lookup "{{ template "common.names.fullname" . }}-0.{{ template "common.names.fullname" . }}-headless" 120 5) - {{- if .Values.tls.enabled }} - redis-cli --cluster fix --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} "${firstNodeIP}:${REDIS_TLS_PORT}" - {{- else }} - redis-cli --cluster fix "${firstNodeIP}:${REDIS_PORT}" - {{- end }} - done - - {{- end }} - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - {{- if .Values.cluster.externalAccess.enabled }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis-cluster.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis-cluster.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis-cluster.tlsCACert" . }} - - name: REDIS_TLS_PORT - {{- else }} - - name: REDIS_PORT - {{- end }} - value: {{ .Values.cluster.externalAccess.service.port | quote }} - {{- else }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis-cluster.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis-cluster.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis-cluster.tlsCACert" . }} - - name: REDIS_TLS_PORT - {{- else }} - - name: REDIS_PORT - {{- end }} - value: {{ .Values.redis.containerPorts.redis | quote }} - {{- end }} - - name: REDIS_CLUSTER_REPLICAS - value: {{ .Values.cluster.replicas | quote }} - {{- if .Values.usePassword }} - - name: REDISCLI_AUTH - valueFrom: - secretKeyRef: - name: {{ template "redis-cluster.secretName" . }} - key: {{ template "redis-cluster.secretPasswordKey" . }} - {{- end }} - {{- if .Values.updateJob.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.updateJob.extraEnvVarsCM .Values.updateJob.extraEnvVarsSecret }} - envFrom: - {{- if .Values.updateJob.extraEnvVarsCM }} - - configMapRef: - name: {{ include "common.tplvalues.render" (dict "value" .Values.updateJob.extraEnvVarsCM "context" $) }} - {{- end }} - {{- if .Values.updateJob.extraEnvVarsSecret }} - - secretRef: - name: {{ include "common.tplvalues.render" (dict "value" .Values.updateJob.extraEnvVarsSecret "context" $) }} - {{- end }} - {{- end }} - {{- if .Values.updateJob.resources }} - resources: {{- toYaml .Values.updateJob.resources | nindent 12 }} - {{- end }} - {{- if or .Values.tls.enabled .Values.updateJob.extraVolumeMounts }} - volumeMounts: - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.updateJob.extraVolumeMounts }} - {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.extraVolumeMounts "context" $) | nindent 12 }} - {{- end }} - {{- end }} - restartPolicy: OnFailure - {{- if or .Values.tls.enabled .Values.updateJob.extraVolumes }} - volumes: - {{- if .Values.tls.enabled }} - - name: redis-certificates - secret: - secretName: {{ include "common.tplvalues.render" (dict "value" .Values.tls.certificatesSecret "context" $) }} - {{- end }} - {{- if .Values.updateJob.extraVolumes }} - {{- include "common.tplvalues.render" (dict "value" .Values.updateJob.extraVolumes "context" $) | nindent 6 }} - {{- end }} - {{- end }} -{{- end }} - diff --git a/rds/base/charts/redis-cluster/values.yaml b/rds/base/charts/redis-cluster/values.yaml deleted file mode 100644 index ab68adc..0000000 --- a/rds/base/charts/redis-cluster/values.yaml +++ /dev/null @@ -1,980 +0,0 @@ -## @section Global parameters -## Global Docker image parameters -## Please, note that this will override the image parameters, including dependencies, configured to use the global value -## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass -## - -## @param global.imageRegistry Global Docker image registry -## @param global.imagePullSecrets Global Docker registry secret names as an array -## @param global.storageClass Global StorageClass for Persistent Volume(s) -## @param global.redis.password Redis® password (overrides `password`) -## -global: - imageRegistry: "" - ## E.g. - ## imagePullSecrets: - ## - myRegistryKeySecretName - ## - imagePullSecrets: [] - storageClass: "" - redis: - password: "" - -## @section Redis® Cluster Common parameters -## - -## @param nameOverride String to partially override common.names.fullname template (will maintain the release name) -## -nameOverride: "" -## @param fullnameOverride String to fully override common.names.fullname template -## -fullnameOverride: "" -## @param clusterDomain Kubernetes Cluster Domain -## -clusterDomain: cluster.local -## @param commonAnnotations Annotations to add to all deployed objects -## -commonAnnotations: {} -## @param commonLabels Labels to add to all deployed objects -## -commonLabels: {} -## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template) -## -extraDeploy: [] - -## Enable diagnostic mode in the deployment -## -diagnosticMode: - ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) - ## - enabled: false - ## @param diagnosticMode.command Command to override all containers in the deployment - ## - command: - - sleep - ## @param diagnosticMode.args Args to override all containers in the deployment - ## - args: - - infinity - -## Bitnami Redis® image version -## ref: https://hub.docker.com/r/bitnami/redis/tags/ -## @param image.registry Redis® cluster image registry -## @param image.repository Redis® cluster image repository -## @param image.tag Redis® cluster image tag (immutable tags are recommended) -## @param image.pullPolicy Redis® cluster image pull policy -## @param image.pullSecrets Specify docker-registry secret names as an array -## @param image.debug Enable image debug mode -## -image: - registry: docker.io - repository: bitnami/redis-cluster - ## Bitnami Redis® image tag - ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links - ## - tag: 6.2.7-debian-11-r9 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Enable debug mode - ## - debug: false -## Network Policy -## @param networkPolicy.enabled Enable NetworkPolicy -## @param networkPolicy.allowExternal The Policy model to apply. Don't require client label for connections -## @param networkPolicy.ingressNSMatchLabels Allow connections from other namespacess. Just set label for namespace and set label for pods (optional). -## @param networkPolicy.ingressNSPodMatchLabels For other namespaces match by pod labels and namespace labels -## -networkPolicy: - enabled: false - ## When set to false, only pods with the correct - ## client label will have network access to the port Redis® is listening - ## on. When true, Redis® will accept connections from any source - ## (with the correct destination port). - ## - allowExternal: true - ingressNSMatchLabels: {} - ingressNSPodMatchLabels: {} - -serviceAccount: - ## @param serviceAccount.create Specifies whether a ServiceAccount should be created - ## - create: false - ## @param serviceAccount.name The name of the ServiceAccount to create - ## If not set and create is true, a name is generated using the fullname template - ## - name: "" - ## @param serviceAccount.annotations Annotations for Cassandra Service Account - ## - annotations: {} - ## @param serviceAccount.automountServiceAccountToken Automount API credentials for a service account. - ## - automountServiceAccountToken: false - -rbac: - ## @param rbac.create Specifies whether RBAC resources should be created - ## - create: false - role: - ## @param rbac.role.rules Rules to create. It follows the role specification - ## rules: - ## - apiGroups: - ## - extensions - ## resources: - ## - podsecuritypolicies - ## verbs: - ## - use - ## resourceNames: - ## - gce.unprivileged - ## - rules: [] -## Redis® pod Security Context -## @param podSecurityContext.enabled Enable Redis® pod Security Context -## @param podSecurityContext.fsGroup Group ID for the pods -## @param podSecurityContext.runAsUser User ID for the pods -## @param podSecurityContext.sysctls Set namespaced sysctls for the pods -## -podSecurityContext: - enabled: true - fsGroup: 1001 - runAsUser: 1001 - ## Uncomment the setting below to increase the net.core.somaxconn value - ## e.g: - ## sysctls: - ## - name: net.core.somaxconn - ## value: "10000" - ## - sysctls: [] -## @param podDisruptionBudget Limits the number of pods of the replicated application that are down simultaneously from voluntary disruptions -## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions -## -podDisruptionBudget: {} -## @param minAvailable Min number of pods that must still be available after the eviction -## -minAvailable: "" -## @param maxUnavailable Max number of pods that can be unavailable after the eviction -## -maxUnavailable: "" -## Containers Security Context -## @param containerSecurityContext.enabled Enable Containers' Security Context -## @param containerSecurityContext.runAsUser User ID for the containers. -## @param containerSecurityContext.runAsNonRoot Run container as non root -## -containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true -## @param usePassword Use password authentication -## -usePassword: true -## @param password Redis® password (ignored if existingSecret set) -## Defaults to a random 10-character alphanumeric string if not set and usePassword is true -## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run -## -password: "" -## @param existingSecret Name of existing secret object (for password authentication) -## -existingSecret: "" -## @param existingSecretPasswordKey Name of key containing password to be retrieved from the existing secret -## -existingSecretPasswordKey: "" -## @param usePasswordFile Mount passwords as files instead of environment variables -## -usePasswordFile: false -## -## TLS configuration -## -tls: - ## @param tls.enabled Enable TLS support for replication traffic - ## - enabled: false - ## @param tls.authClients Require clients to authenticate or not - ## - authClients: true - ## @param tls.autoGenerated Generate automatically self-signed TLS certificates - ## - autoGenerated: false - ## @param tls.existingSecret The name of the existing secret that contains the TLS certificates - ## - existingSecret: "" - ## @param tls.certificatesSecret DEPRECATED. Use tls.existingSecret instead - ## - certificatesSecret: "" - ## @param tls.certFilename Certificate filename - ## - certFilename: "" - ## @param tls.certKeyFilename Certificate key filename - ## - certKeyFilename: "" - ## @param tls.certCAFilename CA Certificate filename - ## - certCAFilename: "" - ## @param tls.dhParamsFilename File containing DH params (in order to support DH based ciphers) - ## - dhParamsFilename: "" -## Redis® Service properties for standalone mode. -## -service: - ## @param service.ports.redis Kubernetes Redis service port - ## - ports: - redis: 6379 - ## Node ports to expose - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## @param service.nodePorts.redis Node port for Redis - ## - nodePorts: - redis: "" - ## @param service.extraPorts Extra ports to expose in the service (normally used with the `sidecar` value) - ## - extraPorts: [] - ## @param service.annotations Provide any additional annotations which may be required. - ## This can be used to set the LoadBalancer service type to internal only. - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer - ## - annotations: {} - ## @param service.labels Additional labels for redis service - ## - labels: {} - ## @param service.type Service type for default redis service - ## Setting this to LoadBalancer may require corresponding service annotations for loadbalancer creation to succeed. - ## Currently supported types are ClusterIP (default) and LoadBalancer - ## - type: ClusterIP - ## @param service.clusterIP Service Cluster IP - ## e.g.: - ## clusterIP: None - ## - clusterIP: "" - ## @param service.loadBalancerIP Load balancer IP if `service.type` is `LoadBalancer` - ## If service.type is LoadBalancer, request a specific static IP address if supported by the cloud provider, otherwise leave blank - ## - loadBalancerIP: "" - ## @param service.loadBalancerSourceRanges Service Load Balancer sources - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## e.g: - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param service.externalTrafficPolicy Service external traffic policy - ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" - ## If "ClientIP", consecutive client requests will be directed to the same Pod - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - ## - sessionAffinity: None - ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity - ## sessionAffinityConfig: - ## clientIP: - ## timeoutSeconds: 300 - ## - sessionAffinityConfig: {} -## Enable persistence using Persistent Volume Claims -## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/ -## -persistence: - ## @param persistence.path Path to mount the volume at, to use other images Redis® images. - ## - path: /bitnami/redis/data - ## @param persistence.subPath The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services - ## - subPath: "" - ## @param persistence.storageClass Storage class of backing PVC - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - storageClass: "" - ## @param persistence.annotations Persistent Volume Claim annotations - ## - annotations: {} - ## @param persistence.accessModes Persistent Volume Access Modes - ## - accessModes: - - ReadWriteOnce - ## @param persistence.size Size of data volume - ## - size: 8Gi - ## @param persistence.matchLabels Persistent Volume selectors - ## https://kubernetes.io/docs/concepts/storage/persistent-volumes/#selector - ## - matchLabels: {} - ## @param persistence.matchExpressions matchExpressions Persistent Volume selectors - ## - matchExpressions: {} - -## Init containers parameters: -## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup -## -volumePermissions: - ## @param volumePermissions.enabled Enable init container that changes volume permissions in the registry (for cases where the default k8s `runAsUser` and `fsUser` values do not work) - ## - enabled: false - ## @param volumePermissions.image.registry Init container volume-permissions image registry - ## @param volumePermissions.image.repository Init container volume-permissions image repository - ## @param volumePermissions.image.tag Init container volume-permissions image tag - ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy - ## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array - ## - image: - registry: docker.io - repository: bitnami/bitnami-shell - tag: 11-debian-11-r10 - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Container resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param volumePermissions.resources.limits The resources limits for the container - ## @param volumePermissions.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 100m - ## memory: 128Mi - ## - limits: {} - ## Examples: - ## requests: - ## cpu: 100m - ## memory: 128Mi - ## - requests: {} -## PodSecurityPolicy configuration -## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ -## @param podSecurityPolicy.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later -## -podSecurityPolicy: - create: false - -## @section Redis® statefulset parameters -## - -redis: - ## @param redis.command Redis® entrypoint string. The command `redis-server` is executed if this is not provided - ## - command: [] - ## @param redis.args Arguments for the provided command if needed - ## - args: [] - ## @param redis.updateStrategy.type Argo Workflows statefulset strategy type - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - ## - updateStrategy: - ## StrategyType - ## Can be set to RollingUpdate or OnDelete - ## - type: RollingUpdate - ## @param redis.updateStrategy.rollingUpdate.partition Partition update strategy - ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions - ## - rollingUpdate: - partition: 0 - - ## @param redis.podManagementPolicy Statefulset Pod management policy, it needs to be Parallel to be able to complete the cluster join - ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies - ## - podManagementPolicy: Parallel - ## @param redis.hostAliases Deployment pod host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param redis.hostNetwork Host networking requested for this pod. Use the host's network namespace. - ## https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podspec-v1-core - ## - hostNetwork: false - ## @param redis.useAOFPersistence Whether to use AOF Persistence mode or not - ## It is strongly recommended to use this type when dealing with clusters - ## ref: https://redis.io/topics/persistence#append-only-file - ## ref: https://redis.io/topics/cluster-tutorial#creating-and-using-a-redis-cluster - ## - useAOFPersistence: "yes" - ## @param redis.containerPorts.redis Redis® port - ## @param redis.containerPorts.bus The busPort should be obtained adding 10000 to the redisPort. By default: 10000 + 6379 = 16379 - ## - containerPorts: - redis: 6379 - bus: 16379 - ## @param redis.lifecycleHooks LifecycleHook to set additional configuration before or after startup. Evaluated as a template - ## - lifecycleHooks: {} - ## @param redis.extraVolumes Extra volumes to add to the deployment - ## - extraVolumes: [] - ## @param redis.extraVolumeMounts Extra volume mounts to add to the container - ## - extraVolumeMounts: [] - ## @param redis.customLivenessProbe Override default liveness probe - ## - customLivenessProbe: {} - ## @param redis.customReadinessProbe Override default readiness probe - ## - customReadinessProbe: {} - ## @param redis.customStartupProbe Custom startupProbe that overrides the default one - ## - customStartupProbe: {} - ## @param redis.initContainers Extra init containers to add to the deployment - ## - initContainers: [] - ## @param redis.sidecars Extra sidecar containers to add to the deployment - ## - sidecars: [] - ## @param redis.podLabels Additional labels for Redis® pod - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param redis.priorityClassName Redis® Master pod priorityClassName - ## - priorityClassName: "" - ## @param redis.configmap Additional Redis® configuration for the nodes - ## ref: https://redis.io/topics/config - ## - configmap: "" - ## @param redis.extraEnvVars An array to add extra environment variables - ## For example: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param redis.extraEnvVarsCM ConfigMap with extra environment variables - ## - extraEnvVarsCM: "" - ## @param redis.extraEnvVarsSecret Secret with extra environment variables - ## - extraEnvVarsSecret: "" - ## @param redis.podAnnotations Redis® additional annotations - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podAnnotations: {} - ## Redis® resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param redis.resources.limits The resources limits for the container - ## @param redis.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 100m - ## memory: 128Mi - ## - limits: {} - ## Examples: - ## requests: - ## cpu: 100m - ## memory: 128Mi - ## - requests: {} - ## @param redis.schedulerName Use an alternate scheduler, e.g. "stork". - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param redis.shareProcessNamespace Enable shared process namespace in a pod. - ## If set to false (default), each container will run in separate namespace, redis will have PID=1. - ## If set to true, the /pause will run as init process and will reap any zombie PIDs, - ## for example, generated by a custom exec probe running longer than a probe timeoutSeconds. - ## Enable this only if customLivenessProbe or customReadinessProbe is used and zombie PIDs are accumulating. - ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ - ## - shareProcessNamespace: false - ## Configure extra options for Redis® liveness probes - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) - ## @param redis.livenessProbe.enabled Enable livenessProbe - ## @param redis.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param redis.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param redis.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param redis.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param redis.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 5 - periodSeconds: 5 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 5 - ## Configure extra options for Redis® readiness probes - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) - ## @param redis.readinessProbe.enabled Enable readinessProbe - ## @param redis.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param redis.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param redis.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param redis.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param redis.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 5 - periodSeconds: 5 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 5 - ## @param redis.startupProbe.enabled Enable startupProbe - ## @param redis.startupProbe.path Path to check for startupProbe - ## @param redis.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe - ## @param redis.startupProbe.periodSeconds Period seconds for startupProbe - ## @param redis.startupProbe.timeoutSeconds Timeout seconds for startupProbe - ## @param redis.startupProbe.failureThreshold Failure threshold for startupProbe - ## @param redis.startupProbe.successThreshold Success threshold for startupProbe - ## - startupProbe: - enabled: false - path: / - initialDelaySeconds: 300 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## @param redis.podAffinityPreset Redis® pod affinity preset. Ignored if `redis.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param redis.podAntiAffinityPreset Redis® pod anti-affinity preset. Ignored if `redis.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Redis® node affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param redis.nodeAffinityPreset.type Redis® node affinity preset type. Ignored if `redis.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param redis.nodeAffinityPreset.key Redis® node label key to match Ignored if `redis.affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param redis.nodeAffinityPreset.values Redis® node label values to match. Ignored if `redis.affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param redis.affinity Affinity settings for Redis® pod assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: redis.podAffinityPreset, redis.podAntiAffinityPreset, and redis.nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param redis.nodeSelector Node labels for Redis® pods assignment - ## ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param redis.tolerations Tolerations for Redis® pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param redis.topologySpreadConstraints Pod topology spread constraints for Redis® pod - ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## The value is evaluated as a template - ## - topologySpreadConstraints: [] - -## @section Cluster update job parameters -## - -## Cluster update job settings -## -updateJob: - ## @param updateJob.activeDeadlineSeconds Number of seconds the Job to create the cluster will be waiting for the Nodes to be ready. - ## - activeDeadlineSeconds: 600 - ## @param updateJob.command Container command (using container default if not set) - ## - command: [] - ## @param updateJob.args Container args (using container default if not set) - ## - args: [] - ## @param updateJob.hostAliases Deployment pod host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param updateJob.annotations Job annotations - ## - annotations: {} - ## @param updateJob.podAnnotations Job pod annotations - ## - podAnnotations: {} - ## @param updateJob.podLabels Pod extra labels - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param updateJob.extraEnvVars An array to add extra environment variables - ## For example: - ## - name: BEARER_AUTH - ## value: true - ## - extraEnvVars: [] - ## @param updateJob.extraEnvVarsCM ConfigMap containing extra environment variables - ## - extraEnvVarsCM: "" - ## @param updateJob.extraEnvVarsSecret Secret containing extra environment variables - ## - extraEnvVarsSecret: "" - ## @param updateJob.extraVolumes Extra volumes to add to the deployment - ## - extraVolumes: [] - ## @param updateJob.extraVolumeMounts Extra volume mounts to add to the container - ## - extraVolumeMounts: [] - ## @param updateJob.initContainers Extra init containers to add to the deployment - ## - initContainers: [] - ## @param updateJob.podAffinityPreset Update job pod affinity preset. Ignored if `updateJob.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param updateJob.podAntiAffinityPreset Update job pod anti-affinity preset. Ignored if `updateJob.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Update job node affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param updateJob.nodeAffinityPreset.type Update job node affinity preset type. Ignored if `updateJob.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param updateJob.nodeAffinityPreset.key Update job node label key to match Ignored if `updateJob.affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param updateJob.nodeAffinityPreset.values Update job node label values to match. Ignored if `updateJob.affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param updateJob.affinity Affinity for update job pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: updateJob.podAffinityPreset, updateJob.podAntiAffinityPreset, and updateJob.nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param updateJob.nodeSelector Node labels for update job pods assignment - ## ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param updateJob.tolerations Tolerations for update job pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param updateJob.priorityClassName Priority class name - ## - priorityClassName: "" - ## Container resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## We usually recommend not to specify default resources and to leave this as a conscious - ## choice for the user. This also increases chances charts run on environments with little - ## resources, such as Minikube. If you do want to specify resources, uncomment the following - ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. - ## @param updateJob.resources.limits The resources limits for the container - ## @param updateJob.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 500m - ## memory: 1Gi - ## - limits: {} - ## Examples: - ## requests: - ## cpu: 250m - ## memory: 256Mi - ## - requests: {} - -## @section Cluster management parameters -## - -## Redis® Cluster settings -## -cluster: - ## @param cluster.init Enable the initialization of the Redis® Cluster - ## - init: true - ## Number of Redis® nodes to be deployed - ## - ## Note: - ## This is total number of nodes including the replicas. Meaning there will be 3 master and 3 replica - ## nodes (as replica count is set to 1 by default, there will be 1 replica per master node). - ## Hence, nodes = numberOfMasterNodes + numberOfMasterNodes * replicas - ## - ## @param cluster.nodes The number of master nodes should always be >= 3, otherwise cluster creation will fail - ## - nodes: 6 - ## @param cluster.replicas Number of replicas for every master in the cluster - ## Parameter to be passed as --cluster-replicas to the redis-cli --cluster create - ## 1 means that we want a replica for every master created - ## - replicas: 1 - ## Configuration to access the Redis® Cluster from outside the Kubernetes cluster - ## - externalAccess: - ## @param cluster.externalAccess.enabled Enable access to the Redis - ## - enabled: false - service: - ## @param cluster.externalAccess.service.type Type for the services used to expose every Pod - ## At this moment only LoadBalancer is supported - ## - type: LoadBalancer - ## @param cluster.externalAccess.service.port Port for the services used to expose every Pod - ## - port: 6379 - ## @param cluster.externalAccess.service.loadBalancerIP Array of load balancer IPs for each Redis® node. Length must be the same as cluster.nodes - ## - loadBalancerIP: [] - ## @param cluster.externalAccess.service.loadBalancerSourceRanges Service Load Balancer sources - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## e.g: - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param cluster.externalAccess.service.annotations Annotations to add to the services used to expose every Pod of the Redis® Cluster - ## - annotations: {} - ## This section allows to update the Redis® cluster nodes. - ## - update: - ## @param cluster.update.addNodes Boolean to specify if you want to add nodes after the upgrade - ## Setting this to true a hook will add nodes to the Redis® cluster after the upgrade. currentNumberOfNodes and currentNumberOfReplicas is required - ## - addNodes: false - ## @param cluster.update.currentNumberOfNodes Number of currently deployed Redis® nodes - ## - currentNumberOfNodes: 6 - ## @param cluster.update.currentNumberOfReplicas Number of currently deployed Redis® replicas - ## - currentNumberOfReplicas: 1 - ## @param cluster.update.newExternalIPs External IPs obtained from the services for the new nodes to add to the cluster - ## - newExternalIPs: [] - -## @section Metrics sidecar parameters -## - -## Prometheus Exporter / Metrics -## -metrics: - ## @param metrics.enabled Start a side-car prometheus exporter - ## - enabled: false - ## @param metrics.image.registry Redis® exporter image registry - ## @param metrics.image.repository Redis® exporter image name - ## @param metrics.image.tag Redis® exporter image tag - ## @param metrics.image.pullPolicy Redis® exporter image pull policy - ## @param metrics.image.pullSecrets Specify docker-registry secret names as an array - ## - image: - registry: docker.io - repository: bitnami/redis-exporter - tag: 1.43.0-debian-11-r3 - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## @param metrics.resources Metrics exporter resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## - resources: {} - ## @param metrics.extraArgs Extra arguments for the binary; possible values [here](https://github.com/oliver006/redis_exporter - ## extraArgs: - ## check-keys: myKey,myOtherKey - ## - extraArgs: {} - ## @param metrics.podAnnotations [object] Additional annotations for Metrics exporter pod - ## - podAnnotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9121" - ## @param metrics.podLabels Additional labels for Metrics exporter pod - ## - podLabels: {} - ## Enable this if you're using https://github.com/coreos/prometheus-operator - ## - serviceMonitor: - ## @param metrics.serviceMonitor.enabled If `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) - ## - enabled: false - ## @param metrics.serviceMonitor.namespace Optional namespace which Prometheus is running in - ## - namespace: "" - ## @param metrics.serviceMonitor.interval How frequently to scrape metrics (use by default, falling back to Prometheus' default) - ## - interval: "" - ## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended - ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint - ## e.g: - ## scrapeTimeout: 10s - ## - scrapeTimeout: "" - ## @param metrics.serviceMonitor.selector Prometheus instance selector labels - ## ref: https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-configuration - ## e.g: - ## selector: - ## prometheus: my-prometheus - ## - selector: {} - ## @param metrics.serviceMonitor.labels ServiceMonitor extra labels - ## - labels: {} - ## @param metrics.serviceMonitor.annotations ServiceMonitor annotations - ## - annotations: {} - ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus. - ## - jobLabel: "" - ## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping - ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig - ## - relabelings: [] - ## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion - ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig - ## - metricRelabelings: [] - ## Custom PrometheusRule to be defined - ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart - ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions - ## @param metrics.prometheusRule.enabled Set this to true to create prometheusRules for Prometheus operator - ## @param metrics.prometheusRule.additionalLabels Additional labels that can be used so prometheusRules will be discovered by Prometheus - ## @param metrics.prometheusRule.namespace namespace where prometheusRules resource should be created - ## @param metrics.prometheusRule.rules Create specified [rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/), check values for an example. - ## - prometheusRule: - enabled: false - additionalLabels: {} - namespace: "" - ## These are just examples rules, please adapt them to your needs. - ## Make sure to constraint the rules to the current postgresql service. - ## - alert: RedisDown - ## expr: redis_up{service="{{ template "common.names.fullname" . }}-metrics"} == 0 - ## for: 2m - ## labels: - ## severity: error - ## annotations: - ## summary: Redis® instance {{ "{{ $instance }}" }} down - ## description: Redis® instance {{ "{{ $instance }}" }} is down. - ## - alert: RedisMemoryHigh - ## expr: > - ## redis_memory_used_bytes{service="{{ template "common.names.fullname" . }}-metrics"} * 100 - ## / - ## redis_memory_max_bytes{service="{{ template "common.names.fullname" . }}-metrics"} - ## > 90 - ## for: 2m - ## labels: - ## severity: error - ## annotations: - ## summary: Redis® instance {{ "{{ $instance }}" }} is using too much memory - ## description: Redis® instance {{ "{{ $instance }}" }} is using {{ "{{ $value }}" }}% of its available memory. - ## - alert: RedisKeyEviction - ## expr: increase(redis_evicted_keys_total{service="{{ template "common.names.fullname" . }}-metrics"}[5m]) > 0 - ## for: 1s - ## labels: - ## severity: error - ## annotations: - ## summary: Redis® instance {{ "{{ $instance }}" }} has evicted keys - ## description: Redis® instance {{ "{{ $instance }}" }} has evicted {{ "{{ $value }}" }} keys in the last 5 minutes. - ## - rules: [] - ## @param metrics.priorityClassName Metrics exporter pod priorityClassName - ## - priorityClassName: "" - ## @param metrics.service.type Kubernetes Service type (redis metrics) - ## @param metrics.service.loadBalancerIP Use serviceLoadBalancerIP to request a specific static IP, otherwise leave blank - ## @param metrics.service.annotations Annotations for the services to monitor. - ## @param metrics.service.labels Additional labels for the metrics service - ## - service: - type: ClusterIP - ## @param metrics.service.clusterIP Service Cluster IP - ## e.g.: - ## clusterIP: None - ## - clusterIP: "" - loadBalancerIP: "" - annotations: {} - labels: {} - -## @section Sysctl Image parameters -## - -## Sysctl InitContainer -## Used to perform sysctl operation to modify Kernel settings (needed sometimes to avoid warnings) -## -sysctlImage: - ## @param sysctlImage.enabled Enable an init container to modify Kernel settings - ## - enabled: false - ## @param sysctlImage.command sysctlImage command to execute - ## - command: [] - ## @param sysctlImage.registry sysctlImage Init container registry - ## @param sysctlImage.repository sysctlImage Init container repository - ## @param sysctlImage.tag sysctlImage Init container tag - ## @param sysctlImage.pullPolicy sysctlImage Init container pull policy - ## @param sysctlImage.pullSecrets Specify docker-registry secret names as an array - ## - registry: docker.io - repository: bitnami/bitnami-shell - tag: 11-debian-11-r10 - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## @param sysctlImage.mountHostSys Mount the host `/sys` folder to `/host-sys` - ## - mountHostSys: false - ## Container resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param sysctlImage.resources.limits The resources limits for the container - ## @param sysctlImage.resources.requests The requested resources for the container - ## - resources: - ## Example: - ## limits: - ## cpu: 100m - ## memory: 128Mi - ## - limits: {} - ## Examples: - ## requests: - ## cpu: 100m - ## memory: 128Mi - ## - requests: {} diff --git a/rds/base/charts/redis/.helmignore b/rds/base/charts/redis/.helmignore deleted file mode 100644 index f0c1319..0000000 --- a/rds/base/charts/redis/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/rds/base/charts/redis/Chart.lock b/rds/base/charts/redis/Chart.lock deleted file mode 100644 index 863ab5d..0000000 --- a/rds/base/charts/redis/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://charts/common - version: 1.16.0 -digest: sha256:4ada3eb952477c2d0cedb8b58c4dd4351576124c08e2b597bb8d7a85a821d0b3 -generated: "2023-02-07T10:50:01.265240461+01:00" diff --git a/rds/base/charts/redis/Chart.yaml b/rds/base/charts/redis/Chart.yaml deleted file mode 100644 index 19c84bb..0000000 --- a/rds/base/charts/redis/Chart.yaml +++ /dev/null @@ -1,29 +0,0 @@ -annotations: - category: Database -apiVersion: v2 -appVersion: 6.2.7 -dependencies: -- name: common - repository: file://charts/common - tags: - - bitnami-common - alias: redis-common - version: 1.x.x -description: Redis(R) is an open source, advanced key-value store. It is often referred - to as a data structure server since keys can contain strings, hashes, lists, sets - and sorted sets. -home: https://github.com/bitnami/charts/tree/master/bitnami/redis -icon: https://bitnami.com/assets/stacks/redis/img/redis-stack-220x234.png -keywords: -- redis -- keyvalue -- database -maintainers: -- name: Bitnami - url: https://github.com/bitnami/charts -- email: cedric@desaintmartin.fr - name: desaintmartin -name: redis -sources: -- https://github.com/bitnami/bitnami-docker-redis -version: 16.13.2 diff --git a/rds/base/charts/redis/README.md b/rds/base/charts/redis/README.md deleted file mode 100644 index 5113c05..0000000 --- a/rds/base/charts/redis/README.md +++ /dev/null @@ -1,898 +0,0 @@ - - -# Bitnami package for Redis(R) - -Redis(R) is an open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. - -[Overview of Redis®](http://redis.io) - -Disclaimer: Redis is a registered trademark of Redis Ltd. Any rights therein are reserved to Redis Ltd. Any use by Bitnami is for referential purposes only and does not indicate any sponsorship, endorsement, or affiliation between Redis Ltd. - -## TL;DR - -```bash -$ helm repo add bitnami https://charts.bitnami.com/bitnami -$ helm install my-release bitnami/redis -``` - -## Introduction - -This chart bootstraps a [Redis®](https://github.com/bitnami/bitnami-docker-redis) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. - -### Choose between Redis® Helm Chart and Redis® Cluster Helm Chart - -You can choose any of the two Redis® Helm charts for deploying a Redis® cluster. - -1. [Redis® Helm Chart](https://github.com/bitnami/charts/tree/master/bitnami/redis) will deploy a master-replica cluster, with the [option](https://github.com/bitnami/charts/tree/master/bitnami/redis#redis-sentinel-configuration-parameters) of enabling using Redis® Sentinel. -2. [Redis® Cluster Helm Chart](https://github.com/bitnami/charts/tree/master/bitnami/redis-cluster) will deploy a Redis® Cluster topology with sharding. - -The main features of each chart are the following: - -| Redis® | Redis® Cluster | -|--------------------------------------------------------|------------------------------------------------------------------------| -| Supports multiple databases | Supports only one database. Better if you have a big dataset | -| Single write point (single master) | Multiple write points (multiple masters) | -| ![Redis® Topology](img/redis-topology.png) | ![Redis® Cluster Topology](img/redis-cluster-topology.png) | - -## Prerequisites - -- Kubernetes 1.19+ -- Helm 3.2.0+ -- PV provisioner support in the underlying infrastructure - -## Installing the Chart - -To install the chart with the release name `my-release`: - -```bash -$ helm install my-release bitnami/redis -``` - -The command deploys Redis® on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. - -> **Tip**: List all releases using `helm list` - -## Uninstalling the Chart - -To uninstall/delete the `my-release` deployment: - -```bash -$ helm delete my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -## Parameters - -### Global parameters - -| Name | Description | Value | -| ------------------------- | ------------------------------------------------------ | ----- | -| `global.imageRegistry` | Global Docker image registry | `""` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | -| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | -| `global.redis.password` | Global Redis® password (overrides `auth.password`) | `""` | - - -### Common parameters - -| Name | Description | Value | -| ------------------------ | --------------------------------------------------------------------------------------- | --------------- | -| `kubeVersion` | Override Kubernetes version | `""` | -| `nameOverride` | String to partially override common.names.fullname | `""` | -| `fullnameOverride` | String to fully override common.names.fullname | `""` | -| `commonLabels` | Labels to add to all deployed objects | `{}` | -| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | -| `secretAnnotations` | Annotations to add to secret | `{}` | -| `clusterDomain` | Kubernetes cluster domain name | `cluster.local` | -| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | - - -### Redis® Image parameters - -| Name | Description | Value | -| ------------------- | ----------------------------------------------------- | --------------------- | -| `image.registry` | Redis® image registry | `docker.io` | -| `image.repository` | Redis® image repository | `bitnami/redis` | -| `image.tag` | Redis® image tag (immutable tags are recommended) | `6.2.7-debian-11-r11` | -| `image.pullPolicy` | Redis® image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Redis® image pull secrets | `[]` | -| `image.debug` | Enable image debug mode | `false` | - - -### Redis® common configuration parameters - -| Name | Description | Value | -| -------------------------------- | ------------------------------------------------------------------------------------- | ------------- | -| `architecture` | Redis® architecture. Allowed values: `standalone` or `replication` | `replication` | -| `auth.enabled` | Enable password authentication | `true` | -| `auth.sentinel` | Enable password authentication on sentinels too | `true` | -| `auth.password` | Redis® password | `""` | -| `auth.existingSecret` | The name of an existing secret with Redis® credentials | `""` | -| `auth.existingSecretPasswordKey` | Password key to be retrieved from existing secret | `""` | -| `auth.usePasswordFiles` | Mount credentials as files instead of using an environment variable | `false` | -| `commonConfiguration` | Common configuration to be added into the ConfigMap | `""` | -| `existingConfigmap` | The name of an existing ConfigMap with your custom configuration for Redis® nodes | `""` | - - -### Redis® master configuration parameters - -| Name | Description | Value | -| ------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------ | -| `master.count` | Number of Redis® master instances to deploy (experimental, requires additional configuration) | `1` | -| `master.configuration` | Configuration for Redis® master nodes | `""` | -| `master.disableCommands` | Array with Redis® commands to disable on master nodes | `["FLUSHDB","FLUSHALL"]` | -| `master.command` | Override default container command (useful when using custom images) | `[]` | -| `master.args` | Override default container args (useful when using custom images) | `[]` | -| `master.preExecCmds` | Additional commands to run prior to starting Redis® master | `[]` | -| `master.extraFlags` | Array with additional command line flags for Redis® master | `[]` | -| `master.extraEnvVars` | Array with extra environment variables to add to Redis® master nodes | `[]` | -| `master.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Redis® master nodes | `""` | -| `master.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Redis® master nodes | `""` | -| `master.containerPorts.redis` | Container port to open on Redis® master nodes | `6379` | -| `master.startupProbe.enabled` | Enable startupProbe on Redis® master nodes | `false` | -| `master.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `20` | -| `master.startupProbe.periodSeconds` | Period seconds for startupProbe | `5` | -| `master.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `master.startupProbe.failureThreshold` | Failure threshold for startupProbe | `5` | -| `master.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `master.livenessProbe.enabled` | Enable livenessProbe on Redis® master nodes | `true` | -| `master.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `master.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `master.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `master.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | -| `master.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `master.readinessProbe.enabled` | Enable readinessProbe on Redis® master nodes | `true` | -| `master.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `master.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `master.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `master.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | -| `master.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `master.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | -| `master.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | -| `master.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | -| `master.resources.limits` | The resources limits for the Redis® master containers | `{}` | -| `master.resources.requests` | The requested resources for the Redis® master containers | `{}` | -| `master.podSecurityContext.enabled` | Enabled Redis® master pods' Security Context | `true` | -| `master.podSecurityContext.fsGroup` | Set Redis® master pod's Security Context fsGroup | `1001` | -| `master.containerSecurityContext.enabled` | Enabled Redis® master containers' Security Context | `true` | -| `master.containerSecurityContext.runAsUser` | Set Redis® master containers' Security Context runAsUser | `1001` | -| `master.kind` | Use either Deployment or StatefulSet (default) | `StatefulSet` | -| `master.schedulerName` | Alternate scheduler for Redis® master pods | `""` | -| `master.updateStrategy.type` | Redis® master statefulset strategy type | `RollingUpdate` | -| `master.priorityClassName` | Redis® master pods' priorityClassName | `""` | -| `master.hostAliases` | Redis® master pods host aliases | `[]` | -| `master.podLabels` | Extra labels for Redis® master pods | `{}` | -| `master.podAnnotations` | Annotations for Redis® master pods | `{}` | -| `master.shareProcessNamespace` | Share a single process namespace between all of the containers in Redis® master pods | `false` | -| `master.podAffinityPreset` | Pod affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `master.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `master.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `master.nodeAffinityPreset.key` | Node label key to match. Ignored if `master.affinity` is set | `""` | -| `master.nodeAffinityPreset.values` | Node label values to match. Ignored if `master.affinity` is set | `[]` | -| `master.affinity` | Affinity for Redis® master pods assignment | `{}` | -| `master.nodeSelector` | Node labels for Redis® master pods assignment | `{}` | -| `master.tolerations` | Tolerations for Redis® master pods assignment | `[]` | -| `master.topologySpreadConstraints` | Spread Constraints for Redis® master pod assignment | `[]` | -| `master.dnsPolicy` | DNS Policy for Redis® master pod | `""` | -| `master.dnsConfig` | DNS Configuration for Redis® master pod | `{}` | -| `master.lifecycleHooks` | for the Redis® master container(s) to automate configuration before or after startup | `{}` | -| `master.extraVolumes` | Optionally specify extra list of additional volumes for the Redis® master pod(s) | `[]` | -| `master.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Redis® master container(s) | `[]` | -| `master.sidecars` | Add additional sidecar containers to the Redis® master pod(s) | `[]` | -| `master.initContainers` | Add additional init containers to the Redis® master pod(s) | `[]` | -| `master.persistence.enabled` | Enable persistence on Redis® master nodes using Persistent Volume Claims | `true` | -| `master.persistence.medium` | Provide a medium for `emptyDir` volumes. | `""` | -| `master.persistence.sizeLimit` | Set this to enable a size limit for `emptyDir` volumes. | `""` | -| `master.persistence.path` | The path the volume will be mounted at on Redis® master containers | `/data` | -| `master.persistence.subPath` | The subdirectory of the volume to mount on Redis® master containers | `""` | -| `master.persistence.storageClass` | Persistent Volume storage class | `""` | -| `master.persistence.accessModes` | Persistent Volume access modes | `["ReadWriteOnce"]` | -| `master.persistence.size` | Persistent Volume size | `8Gi` | -| `master.persistence.annotations` | Additional custom annotations for the PVC | `{}` | -| `master.persistence.selector` | Additional labels to match for the PVC | `{}` | -| `master.persistence.dataSource` | Custom PVC data source | `{}` | -| `master.persistence.existingClaim` | Use a existing PVC which must be created manually before bound | `""` | -| `master.service.type` | Redis® master service type | `ClusterIP` | -| `master.service.ports.redis` | Redis® master service port | `6379` | -| `master.service.nodePorts.redis` | Node port for Redis® master | `""` | -| `master.service.externalTrafficPolicy` | Redis® master service external traffic policy | `Cluster` | -| `master.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | -| `master.service.internalTrafficPolicy` | Redis® master service internal traffic policy (requires Kubernetes v1.22 or greater to be usable) | `Cluster` | -| `master.service.clusterIP` | Redis® master service Cluster IP | `""` | -| `master.service.loadBalancerIP` | Redis® master service Load Balancer IP | `""` | -| `master.service.loadBalancerSourceRanges` | Redis® master service Load Balancer sources | `[]` | -| `master.service.annotations` | Additional custom annotations for Redis® master service | `{}` | -| `master.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | -| `master.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `master.terminationGracePeriodSeconds` | Integer setting the termination grace period for the redis-master pods | `30` | - - -### Redis® replicas configuration parameters - -| Name | Description | Value | -| -------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------ | -| `replica.replicaCount` | Number of Redis® replicas to deploy | `3` | -| `replica.configuration` | Configuration for Redis® replicas nodes | `""` | -| `replica.disableCommands` | Array with Redis® commands to disable on replicas nodes | `["FLUSHDB","FLUSHALL"]` | -| `replica.command` | Override default container command (useful when using custom images) | `[]` | -| `replica.args` | Override default container args (useful when using custom images) | `[]` | -| `replica.preExecCmds` | Additional commands to run prior to starting Redis® replicas | `[]` | -| `replica.extraFlags` | Array with additional command line flags for Redis® replicas | `[]` | -| `replica.extraEnvVars` | Array with extra environment variables to add to Redis® replicas nodes | `[]` | -| `replica.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Redis® replicas nodes | `""` | -| `replica.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Redis® replicas nodes | `""` | -| `replica.externalMaster.enabled` | Use external master for bootstrapping | `false` | -| `replica.externalMaster.host` | External master host to bootstrap from | `""` | -| `replica.externalMaster.port` | Port for Redis service external master host | `6379` | -| `replica.containerPorts.redis` | Container port to open on Redis® replicas nodes | `6379` | -| `replica.startupProbe.enabled` | Enable startupProbe on Redis® replicas nodes | `true` | -| `replica.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | -| `replica.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `replica.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `replica.startupProbe.failureThreshold` | Failure threshold for startupProbe | `22` | -| `replica.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `replica.livenessProbe.enabled` | Enable livenessProbe on Redis® replicas nodes | `true` | -| `replica.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `replica.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `replica.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `replica.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | -| `replica.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `replica.readinessProbe.enabled` | Enable readinessProbe on Redis® replicas nodes | `true` | -| `replica.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `replica.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `replica.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `replica.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | -| `replica.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `replica.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | -| `replica.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | -| `replica.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | -| `replica.resources.limits` | The resources limits for the Redis® replicas containers | `{}` | -| `replica.resources.requests` | The requested resources for the Redis® replicas containers | `{}` | -| `replica.podSecurityContext.enabled` | Enabled Redis® replicas pods' Security Context | `true` | -| `replica.podSecurityContext.fsGroup` | Set Redis® replicas pod's Security Context fsGroup | `1001` | -| `replica.containerSecurityContext.enabled` | Enabled Redis® replicas containers' Security Context | `true` | -| `replica.containerSecurityContext.runAsUser` | Set Redis® replicas containers' Security Context runAsUser | `1001` | -| `replica.schedulerName` | Alternate scheduler for Redis® replicas pods | `""` | -| `replica.updateStrategy.type` | Redis® replicas statefulset strategy type | `RollingUpdate` | -| `replica.priorityClassName` | Redis® replicas pods' priorityClassName | `""` | -| `replica.podManagementPolicy` | podManagementPolicy to manage scaling operation of %%MAIN_CONTAINER_NAME%% pods | `""` | -| `replica.hostAliases` | Redis® replicas pods host aliases | `[]` | -| `replica.podLabels` | Extra labels for Redis® replicas pods | `{}` | -| `replica.podAnnotations` | Annotations for Redis® replicas pods | `{}` | -| `replica.shareProcessNamespace` | Share a single process namespace between all of the containers in Redis® replicas pods | `false` | -| `replica.podAffinityPreset` | Pod affinity preset. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `replica.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `replica.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `replica.nodeAffinityPreset.key` | Node label key to match. Ignored if `replica.affinity` is set | `""` | -| `replica.nodeAffinityPreset.values` | Node label values to match. Ignored if `replica.affinity` is set | `[]` | -| `replica.affinity` | Affinity for Redis® replicas pods assignment | `{}` | -| `replica.nodeSelector` | Node labels for Redis® replicas pods assignment | `{}` | -| `replica.tolerations` | Tolerations for Redis® replicas pods assignment | `[]` | -| `replica.topologySpreadConstraints` | Spread Constraints for Redis® replicas pod assignment | `[]` | -| `replica.dnsPolicy` | DNS Policy for Redis® replica pods | `""` | -| `replica.dnsConfig` | DNS Configuration for Redis® replica pods | `{}` | -| `replica.lifecycleHooks` | for the Redis® replica container(s) to automate configuration before or after startup | `{}` | -| `replica.extraVolumes` | Optionally specify extra list of additional volumes for the Redis® replicas pod(s) | `[]` | -| `replica.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Redis® replicas container(s) | `[]` | -| `replica.sidecars` | Add additional sidecar containers to the Redis® replicas pod(s) | `[]` | -| `replica.initContainers` | Add additional init containers to the Redis® replicas pod(s) | `[]` | -| `replica.persistence.enabled` | Enable persistence on Redis® replicas nodes using Persistent Volume Claims | `true` | -| `replica.persistence.medium` | Provide a medium for `emptyDir` volumes. | `""` | -| `replica.persistence.sizeLimit` | Set this to enable a size limit for `emptyDir` volumes. | `""` | -| `replica.persistence.path` | The path the volume will be mounted at on Redis® replicas containers | `/data` | -| `replica.persistence.subPath` | The subdirectory of the volume to mount on Redis® replicas containers | `""` | -| `replica.persistence.storageClass` | Persistent Volume storage class | `""` | -| `replica.persistence.accessModes` | Persistent Volume access modes | `["ReadWriteOnce"]` | -| `replica.persistence.size` | Persistent Volume size | `8Gi` | -| `replica.persistence.annotations` | Additional custom annotations for the PVC | `{}` | -| `replica.persistence.selector` | Additional labels to match for the PVC | `{}` | -| `replica.persistence.dataSource` | Custom PVC data source | `{}` | -| `replica.persistence.existingClaim` | Use a existing PVC which must be created manually before bound | `""` | -| `replica.service.type` | Redis® replicas service type | `ClusterIP` | -| `replica.service.ports.redis` | Redis® replicas service port | `6379` | -| `replica.service.nodePorts.redis` | Node port for Redis® replicas | `""` | -| `replica.service.externalTrafficPolicy` | Redis® replicas service external traffic policy | `Cluster` | -| `replica.service.internalTrafficPolicy` | Redis® replicas service internal traffic policy (requires Kubernetes v1.22 or greater to be usable) | `Cluster` | -| `replica.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | -| `replica.service.clusterIP` | Redis® replicas service Cluster IP | `""` | -| `replica.service.loadBalancerIP` | Redis® replicas service Load Balancer IP | `""` | -| `replica.service.loadBalancerSourceRanges` | Redis® replicas service Load Balancer sources | `[]` | -| `replica.service.annotations` | Additional custom annotations for Redis® replicas service | `{}` | -| `replica.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | -| `replica.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `replica.terminationGracePeriodSeconds` | Integer setting the termination grace period for the redis-replicas pods | `30` | -| `replica.autoscaling.enabled` | Enable replica autoscaling settings | `false` | -| `replica.autoscaling.minReplicas` | Minimum replicas for the pod autoscaling | `1` | -| `replica.autoscaling.maxReplicas` | Maximum replicas for the pod autoscaling | `11` | -| `replica.autoscaling.targetCPU` | Percentage of CPU to consider when autoscaling | `""` | -| `replica.autoscaling.targetMemory` | Percentage of Memory to consider when autoscaling | `""` | - - -### Redis® Sentinel configuration parameters - -| Name | Description | Value | -| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | -| `sentinel.enabled` | Use Redis® Sentinel on Redis® pods. | `false` | -| `sentinel.image.registry` | Redis® Sentinel image registry | `docker.io` | -| `sentinel.image.repository` | Redis® Sentinel image repository | `bitnami/redis-sentinel` | -| `sentinel.image.tag` | Redis® Sentinel image tag (immutable tags are recommended) | `6.2.7-debian-11-r12` | -| `sentinel.image.pullPolicy` | Redis® Sentinel image pull policy | `IfNotPresent` | -| `sentinel.image.pullSecrets` | Redis® Sentinel image pull secrets | `[]` | -| `sentinel.image.debug` | Enable image debug mode | `false` | -| `sentinel.masterSet` | Master set name | `mymaster` | -| `sentinel.quorum` | Sentinel Quorum | `2` | -| `sentinel.getMasterTimeout` | Amount of time to allow before get_sentinel_master_info() times out. | `220` | -| `sentinel.automateClusterRecovery` | Automate cluster recovery in cases where the last replica is not considered a good replica and Sentinel won't automatically failover to it. | `false` | -| `sentinel.downAfterMilliseconds` | Timeout for detecting a Redis® node is down | `60000` | -| `sentinel.failoverTimeout` | Timeout for performing a election failover | `18000` | -| `sentinel.parallelSyncs` | Number of replicas that can be reconfigured in parallel to use the new master after a failover | `1` | -| `sentinel.configuration` | Configuration for Redis® Sentinel nodes | `""` | -| `sentinel.command` | Override default container command (useful when using custom images) | `[]` | -| `sentinel.args` | Override default container args (useful when using custom images) | `[]` | -| `sentinel.preExecCmds` | Additional commands to run prior to starting Redis® Sentinel | `[]` | -| `sentinel.extraEnvVars` | Array with extra environment variables to add to Redis® Sentinel nodes | `[]` | -| `sentinel.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Redis® Sentinel nodes | `""` | -| `sentinel.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Redis® Sentinel nodes | `""` | -| `sentinel.externalMaster.enabled` | Use external master for bootstrapping | `false` | -| `sentinel.externalMaster.host` | External master host to bootstrap from | `""` | -| `sentinel.externalMaster.port` | Port for Redis service external master host | `6379` | -| `sentinel.containerPorts.sentinel` | Container port to open on Redis® Sentinel nodes | `26379` | -| `sentinel.startupProbe.enabled` | Enable startupProbe on Redis® Sentinel nodes | `true` | -| `sentinel.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | -| `sentinel.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `sentinel.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `sentinel.startupProbe.failureThreshold` | Failure threshold for startupProbe | `22` | -| `sentinel.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `sentinel.livenessProbe.enabled` | Enable livenessProbe on Redis® Sentinel nodes | `true` | -| `sentinel.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `20` | -| `sentinel.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `sentinel.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `sentinel.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | -| `sentinel.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `sentinel.readinessProbe.enabled` | Enable readinessProbe on Redis® Sentinel nodes | `true` | -| `sentinel.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `20` | -| `sentinel.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `sentinel.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `sentinel.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | -| `sentinel.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `sentinel.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | -| `sentinel.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | -| `sentinel.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | -| `sentinel.persistence.enabled` | Enable persistence on Redis® sentinel nodes using Persistent Volume Claims (Experimental) | `false` | -| `sentinel.persistence.storageClass` | Persistent Volume storage class | `""` | -| `sentinel.persistence.accessModes` | Persistent Volume access modes | `["ReadWriteOnce"]` | -| `sentinel.persistence.size` | Persistent Volume size | `100Mi` | -| `sentinel.persistence.annotations` | Additional custom annotations for the PVC | `{}` | -| `sentinel.persistence.selector` | Additional labels to match for the PVC | `{}` | -| `sentinel.persistence.dataSource` | Custom PVC data source | `{}` | -| `sentinel.persistence.medium` | Provide a medium for `emptyDir` volumes. | `""` | -| `sentinel.resources.limits` | The resources limits for the Redis® Sentinel containers | `{}` | -| `sentinel.resources.requests` | The requested resources for the Redis® Sentinel containers | `{}` | -| `sentinel.containerSecurityContext.enabled` | Enabled Redis® Sentinel containers' Security Context | `true` | -| `sentinel.containerSecurityContext.runAsUser` | Set Redis® Sentinel containers' Security Context runAsUser | `1001` | -| `sentinel.lifecycleHooks` | for the Redis® sentinel container(s) to automate configuration before or after startup | `{}` | -| `sentinel.extraVolumes` | Optionally specify extra list of additional volumes for the Redis® Sentinel | `[]` | -| `sentinel.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Redis® Sentinel container(s) | `[]` | -| `sentinel.service.type` | Redis® Sentinel service type | `ClusterIP` | -| `sentinel.service.ports.redis` | Redis® service port for Redis® | `6379` | -| `sentinel.service.ports.sentinel` | Redis® service port for Redis® Sentinel | `26379` | -| `sentinel.service.nodePorts.redis` | Node port for Redis® | `""` | -| `sentinel.service.nodePorts.sentinel` | Node port for Sentinel | `""` | -| `sentinel.service.externalTrafficPolicy` | Redis® Sentinel service external traffic policy | `Cluster` | -| `sentinel.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | -| `sentinel.service.clusterIP` | Redis® Sentinel service Cluster IP | `""` | -| `sentinel.service.loadBalancerIP` | Redis® Sentinel service Load Balancer IP | `""` | -| `sentinel.service.loadBalancerSourceRanges` | Redis® Sentinel service Load Balancer sources | `[]` | -| `sentinel.service.annotations` | Additional custom annotations for Redis® Sentinel service | `{}` | -| `sentinel.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | -| `sentinel.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `sentinel.terminationGracePeriodSeconds` | Integer setting the termination grace period for the redis-node pods | `30` | - - -### Other Parameters - -| Name | Description | Value | -| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------- | -| `networkPolicy.enabled` | Enable creation of NetworkPolicy resources | `false` | -| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | -| `networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | -| `networkPolicy.extraEgress` | Add extra egress rules to the NetworkPolicy | `[]` | -| `networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | -| `networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | -| `podSecurityPolicy.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | -| `podSecurityPolicy.enabled` | Enable PodSecurityPolicy's RBAC rules | `false` | -| `rbac.create` | Specifies whether RBAC resources should be created | `false` | -| `rbac.rules` | Custom RBAC rules to set | `[]` | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` | -| `serviceAccount.automountServiceAccountToken` | Whether to auto mount the service account token | `true` | -| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | -| `pdb.create` | Specifies whether a PodDisruptionBudget should be created | `false` | -| `pdb.minAvailable` | Min number of pods that must still be available after the eviction | `1` | -| `pdb.maxUnavailable` | Max number of pods that can be unavailable after the eviction | `""` | -| `tls.enabled` | Enable TLS traffic | `false` | -| `tls.authClients` | Require clients to authenticate | `true` | -| `tls.autoGenerated` | Enable autogenerated certificates | `false` | -| `tls.existingSecret` | The name of the existing secret that contains the TLS certificates | `""` | -| `tls.certificatesSecret` | DEPRECATED. Use existingSecret instead. | `""` | -| `tls.certFilename` | Certificate filename | `""` | -| `tls.certKeyFilename` | Certificate Key filename | `""` | -| `tls.certCAFilename` | CA Certificate filename | `""` | -| `tls.dhParamsFilename` | File containing DH params (in order to support DH based ciphers) | `""` | - - -### Metrics Parameters - -| Name | Description | Value | -| -------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------ | -| `metrics.enabled` | Start a sidecar prometheus exporter to expose Redis® metrics | `false` | -| `metrics.image.registry` | Redis® Exporter image registry | `docker.io` | -| `metrics.image.repository` | Redis® Exporter image repository | `bitnami/redis-exporter` | -| `metrics.image.tag` | Redis® Redis® Exporter image tag (immutable tags are recommended) | `1.43.0-debian-11-r4` | -| `metrics.image.pullPolicy` | Redis® Exporter image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Redis® Exporter image pull secrets | `[]` | -| `metrics.command` | Override default metrics container init command (useful when using custom images) | `[]` | -| `metrics.redisTargetHost` | A way to specify an alternative Redis® hostname | `localhost` | -| `metrics.extraArgs` | Extra arguments for Redis® exporter, for example: | `{}` | -| `metrics.extraEnvVars` | Array with extra environment variables to add to Redis® exporter | `[]` | -| `metrics.containerSecurityContext.enabled` | Enabled Redis® exporter containers' Security Context | `true` | -| `metrics.containerSecurityContext.runAsUser` | Set Redis® exporter containers' Security Context runAsUser | `1001` | -| `metrics.extraVolumes` | Optionally specify extra list of additional volumes for the Redis® metrics sidecar | `[]` | -| `metrics.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Redis® metrics sidecar | `[]` | -| `metrics.resources.limits` | The resources limits for the Redis® exporter container | `{}` | -| `metrics.resources.requests` | The requested resources for the Redis® exporter container | `{}` | -| `metrics.podLabels` | Extra labels for Redis® exporter pods | `{}` | -| `metrics.podAnnotations` | Annotations for Redis® exporter pods | `{}` | -| `metrics.service.type` | Redis® exporter service type | `ClusterIP` | -| `metrics.service.port` | Redis® exporter service port | `9121` | -| `metrics.service.externalTrafficPolicy` | Redis® exporter service external traffic policy | `Cluster` | -| `metrics.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | -| `metrics.service.loadBalancerIP` | Redis® exporter service Load Balancer IP | `""` | -| `metrics.service.loadBalancerSourceRanges` | Redis® exporter service Load Balancer sources | `[]` | -| `metrics.service.annotations` | Additional custom annotations for Redis® exporter service | `{}` | -| `metrics.serviceMonitor.enabled` | Create ServiceMonitor resource(s) for scraping metrics using PrometheusOperator | `false` | -| `metrics.serviceMonitor.namespace` | The namespace in which the ServiceMonitor will be created | `""` | -| `metrics.serviceMonitor.interval` | The interval at which metrics should be scraped | `30s` | -| `metrics.serviceMonitor.scrapeTimeout` | The timeout after which the scrape is ended | `""` | -| `metrics.serviceMonitor.relabellings` | Metrics RelabelConfigs to apply to samples before scraping. | `[]` | -| `metrics.serviceMonitor.metricRelabelings` | Metrics RelabelConfigs to apply to samples before ingestion. | `[]` | -| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` | -| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor resource(s) can be discovered by Prometheus | `{}` | -| `metrics.prometheusRule.enabled` | Create a custom prometheusRule Resource for scraping metrics using PrometheusOperator | `false` | -| `metrics.prometheusRule.namespace` | The namespace in which the prometheusRule will be created | `""` | -| `metrics.prometheusRule.additionalLabels` | Additional labels for the prometheusRule | `{}` | -| `metrics.prometheusRule.rules` | Custom Prometheus rules | `[]` | - - -### Init Container Parameters - -| Name | Description | Value | -| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | ----------------------- | -| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | -| `volumePermissions.image.registry` | Bitnami Shell image registry | `docker.io` | -| `volumePermissions.image.repository` | Bitnami Shell image repository | `bitnami/bitnami-shell` | -| `volumePermissions.image.tag` | Bitnami Shell image tag (immutable tags are recommended) | `11-debian-11-r11` | -| `volumePermissions.image.pullPolicy` | Bitnami Shell image pull policy | `IfNotPresent` | -| `volumePermissions.image.pullSecrets` | Bitnami Shell image pull secrets | `[]` | -| `volumePermissions.resources.limits` | The resources limits for the init container | `{}` | -| `volumePermissions.resources.requests` | The requested resources for the init container | `{}` | -| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | -| `sysctl.enabled` | Enable init container to modify Kernel settings | `false` | -| `sysctl.image.registry` | Bitnami Shell image registry | `docker.io` | -| `sysctl.image.repository` | Bitnami Shell image repository | `bitnami/bitnami-shell` | -| `sysctl.image.tag` | Bitnami Shell image tag (immutable tags are recommended) | `11-debian-11-r11` | -| `sysctl.image.pullPolicy` | Bitnami Shell image pull policy | `IfNotPresent` | -| `sysctl.image.pullSecrets` | Bitnami Shell image pull secrets | `[]` | -| `sysctl.command` | Override default init-sysctl container command (useful when using custom images) | `[]` | -| `sysctl.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | -| `sysctl.resources.limits` | The resources limits for the init container | `{}` | -| `sysctl.resources.requests` | The requested resources for the init container | `{}` | - - -### useExternalDNS Parameters - -| Name | Description | Value | -| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | -| `useExternalDNS.enabled` | Enable various syntax that would enable external-dns to work. Note this requires a working installation of `external-dns` to be usable. | `false` | -| `useExternalDNS.additionalAnnotations` | Extra annotations to be utilized when `external-dns` is enabled. | `{}` | -| `useExternalDNS.annotationKey` | The annotation key utilized when `external-dns` is enabled. | `external-dns.alpha.kubernetes.io/` | -| `useExternalDNS.suffix` | The DNS suffix utilized when `external-dns` is enabled. Note that we prepend the suffix with the full name of the release. | `""` | - - -Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```bash -$ helm install my-release \ - --set auth.password=secretpassword \ - bitnami/redis -``` - -The above command sets the Redis® server password to `secretpassword`. - -> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. - -Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, - -```bash -$ helm install my-release -f values.yaml bitnami/redis -``` - -> **Tip**: You can use the default [values.yaml](values.yaml) - -## Configuration and installation details - -### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) - -It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. - -Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. - -### Use a different Redis® version - -To modify the application version used in this chart, specify a different version of the image using the `image.tag` parameter and/or a different repository using the `image.repository` parameter. Refer to the [chart documentation for more information on these parameters and how to use them with images from a private registry](https://docs.bitnami.com/kubernetes/infrastructure/redis/configuration/change-image-version/). - -### Bootstrapping with an External Cluster - -This chart is equipped with the ability to bring online a set of Pods that connect to an existing Redis deployment that lies outside of Kubernetes. This effectively creates a hybrid Redis Deployment where both Pods in Kubernetes and Instances such as Virtual Machines can partake in a single Redis Deployment. This is helpful in situations where one may be migrating Redis from Virtual Machines into Kubernetes, for example. To take advantage of this, use the following as an example configuration: - -```yaml -replica: - externalMaster: - enabled: true - host: external-redis-0.internal -sentinel: - externalMaster: - enabled: true - host: external-redis-0.internal -``` - -:warning: This is currently limited to clusters in which Sentinel and Redis run on the same node! :warning: - -Please also note that the external sentinel must be listening on port `26379`, and this is currently not configurable. - -Once the Kubernetes Redis Deployment is online and confirmed to be working with the existing cluster, the configuration can then be removed and the cluster will remain connected. - -### External DNS - -This chart is equipped to allow leveraging the ExternalDNS project. Doing so will enable ExternalDNS to publish the FQDN for each instance, in the format of `..`. -Example, when using the following configuration: - -```yaml -useExternalDNS: - enabled: true - suffix: prod.example.org - additionalAnnotations: - ttl: 10 -``` - -On a cluster where the name of the Helm release is `a`, the hostname of a Pod is generated as: `a-redis-node-0.a-redis.prod.example.org`. The IP of that FQDN will match that of the associated Pod. This modifies the following parameters of the Redis/Sentinel configuration using this new FQDN: - -* `replica-announce-ip` -* `known-sentinel` -* `known-replica` -* `announce-ip` - -:warning: This requires a working installation of `external-dns` to be fully functional. :warning: - -See the [official ExternalDNS documentation](https://github.com/kubernetes-sigs/external-dns) for additional configuration options. - -### Cluster topologies - -#### Default: Master-Replicas - -When installing the chart with `architecture=replication`, it will deploy a Redis® master StatefulSet and a Redis® replicas StatefulSet. The replicas will be read-replicas of the master. Two services will be exposed: - -- Redis® Master service: Points to the master, where read-write operations can be performed -- Redis® Replicas service: Points to the replicas, where only read operations are allowed by default. - -In case the master crashes, the replicas will wait until the master node is respawned again by the Kubernetes Controller Manager. - -#### Standalone - -When installing the chart with `architecture=standalone`, it will deploy a standalone Redis® StatefulSet. A single service will be exposed: - -- Redis® Master service: Points to the master, where read-write operations can be performed - -#### Master-Replicas with Sentinel - -When installing the chart with `architecture=replication` and `sentinel.enabled=true`, it will deploy a Redis® master StatefulSet (only one master allowed) and a Redis® replicas StatefulSet. In this case, the pods will contain an extra container with Redis® Sentinel. This container will form a cluster of Redis® Sentinel nodes, which will promote a new master in case the actual one fails. In addition to this, only one service is exposed: - -- Redis® service: Exposes port 6379 for Redis® read-only operations and port 26379 for accessing Redis® Sentinel. - -For read-only operations, access the service using port 6379. For write operations, it's necessary to access the Redis® Sentinel cluster and query the current master using the command below (using redis-cli or similar): - -``` -SENTINEL get-master-addr-by-name -``` - -This command will return the address of the current master, which can be accessed from inside the cluster. - -In case the current master crashes, the Sentinel containers will elect a new master node. - -`master.count` greater than `1` is not designed for use when `sentinel.enabled=true`. - -### Multiple masters (experimental) - -When `master.count` is greater than `1`, special care must be taken to create a consistent setup. - -An example of use case is the creation of a redundant set of standalone masters or master-replicas per Kubernetes node where you must ensure: -- No more than `1` master can be deployed per Kubernetes node -- Replicas and writers can only see the single master of their own Kubernetes node - -One way of achieving this is by setting `master.service.internalTrafficPolicy=Local` in combination with a `master.affinity.podAntiAffinity` spec to never schedule more than one master per Kubernetes node. - -It's recommended to only change `master.count` if you know what you are doing. -`master.count` greater than `1` is not designed for use when `sentinel.enabled=true`. - -### Using a password file - -To use a password file for Redis® you need to create a secret containing the password and then deploy the chart using that secret. - -Refer to the chart documentation for more information on [using a password file for Redis®](https://docs.bitnami.com/kubernetes/infrastructure/redis/administration/use-password-file/). - -### Securing traffic using TLS - -TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the chart: - -- `tls.enabled`: Enable TLS support. Defaults to `false` -- `tls.existingSecret`: Name of the secret that contains the certificates. No defaults. -- `tls.certFilename`: Certificate filename. No defaults. -- `tls.certKeyFilename`: Certificate key filename. No defaults. -- `tls.certCAFilename`: CA Certificate filename. No defaults. - -Refer to the chart documentation for more information on [creating the secret and a TLS deployment example](https://docs.bitnami.com/kubernetes/infrastructure/redis/administration/enable-tls/). - -### Metrics - -The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). The metrics endpoint (port 9121) is exposed in the service. Metrics can be scraped from within the cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). If metrics are to be scraped from outside the cluster, the Kubernetes API proxy can be utilized to access the endpoint. - -If you have enabled TLS by specifying `tls.enabled=true` you also need to specify TLS option to the metrics exporter. You can do that via `metrics.extraArgs`. You can find the metrics exporter CLI flags for TLS [here](https://github.com/oliver006/redis_exporter#command-line-flags). For example: - -You can either specify `metrics.extraArgs.skip-tls-verification=true` to skip TLS verification or providing the following values under `metrics.extraArgs` for TLS client authentication: - -```console -tls-client-key-file -tls-client-cert-file -tls-ca-cert-file -``` - -### Host Kernel Settings - -Redis® may require some changes in the kernel of the host machine to work as expected, in particular increasing the `somaxconn` value and disabling transparent huge pages. - -Refer to the chart documentation for more information on [configuring host kernel settings with an example](https://docs.bitnami.com/kubernetes/infrastructure/redis/administration/configure-kernel-settings/). - -## Persistence - -By default, the chart mounts a [Persistent Volume](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) at the `/data` path. The volume is created using dynamic volume provisioning. If a Persistent Volume Claim already exists, specify it during installation. - -### Existing PersistentVolumeClaim - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. Install the chart - -```bash -$ helm install my-release --set master.persistence.existingClaim=PVC_NAME bitnami/redis -``` - -## Backup and restore - -Refer to the chart documentation for more information on [backing up and restoring Redis® deployments](https://docs.bitnami.com/kubernetes/infrastructure/redis/administration/backup-restore/). - -## NetworkPolicy - -To enable network policy for Redis®, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), and set `networkPolicy.enabled` to `true`. - -Refer to the chart documenation for more information on [enabling the network policy in Redis® deployments](https://docs.bitnami.com/kubernetes/infrastructure/redis/administration/enable-network-policy/). - -### Setting Pod's affinity - -This chart allows you to set your custom affinity using the `XXX.affinity` parameter(s). Find more information about Pod's affinity in the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). - -As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. - -## Troubleshooting - -Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). - -## Upgrading - -A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an incompatible breaking change needing manual actions. - -### To 16.0.0 - -This major release renames several values in this chart and adds missing features, in order to be inline with the rest of assets in the Bitnami charts repository. - -Affected values: -- `master.service.port` renamed as `master.service.ports.redis`. -- `master.service.nodePort` renamed as `master.service.nodePorts.redis`. -- `replica.service.port` renamed as `replica.service.ports.redis`. -- `replica.service.nodePort` renamed as `replica.service.nodePorts.redis`. -- `sentinel.service.port` renamed as `sentinel.service.ports.redis`. -- `sentinel.service.sentinelPort` renamed as `sentinel.service.ports.sentinel`. -- `master.containerPort` renamed as `master.containerPorts.redis`. -- `replica.containerPort` renamed as `replica.containerPorts.redis`. -- `sentinel.containerPort` renamed as `sentinel.containerPorts.sentinel`. -- `master.spreadConstraints` renamed as `master.topologySpreadConstraints` -- `replica.spreadConstraints` renamed as `replica.topologySpreadConstraints` - -### To 15.0.0 - -The parameter to enable the usage of StaticIDs was removed. The behavior is to [always use StaticIDs](https://github.com/bitnami/charts/pull/7278). - -### To 14.8.0 - -The Redis® sentinel exporter was removed in this version because the upstream project was deprecated. The regular Redis® exporter is included in the sentinel scenario as usual. - -### To 14.0.0 - -- Several parameters were renamed or disappeared in favor of new ones on this major version: - - The term *slave* has been replaced by the term *replica*. Therefore, parameters prefixed with `slave` are now prefixed with `replicas`. - - Credentials parameter are reorganized under the `auth` parameter. - - `cluster.enabled` parameter is deprecated in favor of `architecture` parameter that accepts two values: `standalone` and `replication`. - - `securityContext.*` is deprecated in favor of `XXX.podSecurityContext` and `XXX.containerSecurityContext`. - - `sentinel.metrics.*` parameters are deprecated in favor of `metrics.sentinel.*` ones. -- New parameters to add custom command, environment variables, sidecars, init containers, etc. were added. -- Chart labels were adapted to follow the [Helm charts standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels). -- values.yaml metadata was adapted to follow the format supported by [Readme Generator for Helm](https://github.com/bitnami-labs/readme-generator-for-helm). - -Consequences: - -Backwards compatibility is not guaranteed. To upgrade to `14.0.0`, install a new release of the Redis® chart, and migrate the data from your previous release. You have 2 alternatives to do so: - -- Create a backup of the database, and restore it on the new release as explained in the [Backup and restore](#backup-and-restore) section. -- Reuse the PVC used to hold the master data on your previous release. To do so, use the `master.persistence.existingClaim` parameter. The following example assumes that the release name is `redis`: - -```bash -$ helm install redis bitnami/redis --set auth.password=[PASSWORD] --set master.persistence.existingClaim=[EXISTING_PVC] -``` - -| Note: you need to substitute the placeholder _[EXISTING_PVC]_ with the name of the PVC used on your previous release, and _[PASSWORD]_ with the password used in your previous release. - -### To 13.0.0 - -This major version updates the Redis® docker image version used from `6.0` to `6.2`, the new stable version. There are no major changes in the chart and there shouldn't be any breaking changes in it as `6.2` is basically a stricter superset of `6.0`. For more information, please refer to [Redis® 6.2 release notes](https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES). - -### To 12.3.0 - -This version also introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/master/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade. - -### To 12.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -**What changes were introduced in this major version?** - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts - -**Considerations when upgrading to this version** - -- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 - -**Useful links** - -- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ -- https://helm.sh/docs/topics/v2_v3_migration/ -- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ - -### To 11.0.0 - -When deployed with sentinel enabled, only a group of nodes is deployed and the master/slave role is handled in the group. To avoid breaking the compatibility, the settings for this nodes are given through the `slave.xxxx` parameters in `values.yaml` - -### To 9.0.0 - -The metrics exporter has been changed from a separate deployment to a sidecar container, due to the latest changes in the Redis® exporter code. Check the [official page](https://github.com/oliver006/redis_exporter/) for more information. The metrics container image was changed from oliver006/redis_exporter to bitnami/redis-exporter (Bitnami's maintained package of oliver006/redis_exporter). - -### To 7.0.0 - -In order to improve the performance in case of slave failure, we added persistence to the read-only slaves. That means that we moved from Deployment to StatefulSets. This should not affect upgrades from previous versions of the chart, as the deployments did not contain any persistence at all. - -This version also allows enabling Redis® Sentinel containers inside of the Redis® Pods (feature disabled by default). In case the master crashes, a new Redis® node will be elected as master. In order to query the current master (no redis master service is exposed), you need to query first the Sentinel cluster. Find more information [in this section](#master-slave-with-sentinel). - -### To 11.0.0 - -When using sentinel, a new statefulset called `-node` was introduced. This will break upgrading from a previous version where the statefulsets are called master and slave. Hence the PVC will not match the new naming and won't be reused. If you want to keep your data, you will need to perform a backup and then a restore the data in this new version. - -### To 10.0.0 - -For releases with `usePassword: true`, the value `sentinel.usePassword` controls whether the password authentication also applies to the sentinel port. This defaults to `true` for a secure configuration, however it is possible to disable to account for the following cases: - -- Using a version of redis-sentinel prior to `5.0.1` where the authentication feature was introduced. -- Where redis clients need to be updated to support sentinel authentication. - -If using a master/slave topology, or with `usePassword: false`, no action is required. - -### To 8.0.18 - -For releases with `metrics.enabled: true` the default tag for the exporter image is now `v1.x.x`. This introduces many changes including metrics names. You'll want to use [this dashboard](https://github.com/oliver006/redis_exporter/blob/master/contrib/grafana_prometheus_redis_dashboard.json) now. Please see the [redis_exporter github page](https://github.com/oliver006/redis_exporter#upgrading-from-0x-to-1x) for more details. - -### To 7.0.0 - -This version causes a change in the Redis® Master StatefulSet definition, so the command helm upgrade would not work out of the box. As an alternative, one of the following could be done: - -- Recommended: Create a clone of the Redis® Master PVC (for example, using projects like [this one](https://github.com/edseymour/pvc-transfer)). Then launch a fresh release reusing this cloned PVC. - - ``` - helm install my-release bitnami/redis --set persistence.existingClaim= - ``` - -- Alternative (not recommended, do at your own risk): `helm delete --purge` does not remove the PVC assigned to the Redis® Master StatefulSet. As a consequence, the following commands can be done to upgrade the release - - ``` - helm delete --purge - helm install bitnami/redis - ``` - -Previous versions of the chart were not using persistence in the slaves, so this upgrade would add it to them. Another important change is that no values are inherited from master to slaves. For example, in 6.0.0 `slaves.readinessProbe.periodSeconds`, if empty, would be set to `master.readinessProbe.periodSeconds`. This approach lacked transparency and was difficult to maintain. From now on, all the slave parameters must be configured just as it is done with the masters. - -Some values have changed as well: - -- `master.port` and `slave.port` have been changed to `redisPort` (same value for both master and slaves) -- `master.securityContext` and `slave.securityContext` have been changed to `securityContext`(same values for both master and slaves) - -By default, the upgrade will not change the cluster topology. In case you want to use Redis® Sentinel, you must explicitly set `sentinel.enabled` to `true`. - -### To 6.0.0 - -Previous versions of the chart were using an init-container to change the permissions of the volumes. This was done in case the `securityContext` directive in the template was not enough for that (for example, with cephFS). In this new version of the chart, this container is disabled by default (which should not affect most of the deployments). If your installation still requires that init container, execute `helm upgrade` with the `--set volumePermissions.enabled=true`. - -### To 5.0.0 - -The default image in this release may be switched out for any image containing the `redis-server` -and `redis-cli` binaries. If `redis-server` is not the default image ENTRYPOINT, `master.command` -must be specified. - -#### Breaking changes - -- `master.args` and `slave.args` are removed. Use `master.command` or `slave.command` instead in order to override the image entrypoint, or `master.extraFlags` to pass additional flags to `redis-server`. -- `disableCommands` is now interpreted as an array of strings instead of a string of comma separated values. -- `master.persistence.path` now defaults to `/data`. - -### To 4.0.0 - -This version removes the `chart` label from the `spec.selector.matchLabels` -which is immutable since `StatefulSet apps/v1beta2`. It has been inadvertently -added, causing any subsequent upgrade to fail. See https://github.com/helm/charts/issues/7726. - -It also fixes https://github.com/helm/charts/issues/7726 where a deployment `extensions/v1beta1` can not be upgraded if `spec.selector` is not explicitly set. - -Finally, it fixes https://github.com/helm/charts/issues/7803 by removing mutable labels in `spec.VolumeClaimTemplate.metadata.labels` so that it is upgradable. - -In order to upgrade, delete the Redis® StatefulSet before upgrading: - -```bash -kubectl delete statefulsets.apps --cascade=false my-release-redis-master -``` - -And edit the Redis® slave (and metrics if enabled) deployment: - -```bash -kubectl patch deployments my-release-redis-slave --type=json -p='[{"op": "remove", "path": "/spec/selector/matchLabels/chart"}]' -kubectl patch deployments my-release-redis-metrics --type=json -p='[{"op": "remove", "path": "/spec/selector/matchLabels/chart"}]' -``` - -## License - -Copyright © 2022 Bitnami - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. \ No newline at end of file diff --git a/rds/base/charts/redis/charts/common-1.16.0.tgz b/rds/base/charts/redis/charts/common-1.16.0.tgz deleted file mode 100644 index 4d06e76ceb93f2d38ed42d25ab1865e90c30a959..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 14693 zcmV-rIhw{FiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBhciT9U=zP|%s7t3eb|#`EJ8@<_o4xBenHit%PJHcja%Q{d zwjmOd(53)30LsxMxxf7$yh!k+hb=#{Yko*%5-1c3RfR&KP>9%c%4qLsg18LlXqxw<8OI%zk`I^*!sr3ab~`9d^FIgS zU_b14Vk{y~QmNk^!VhG~5ud}~aWVzXUNB-D#++p-p<^(N2MHUK2!>c*VoYI3Bt=sK zkt#334#4{f5#~=I0w|LZ<1}G&G)yoI=Rl;u$tdhh*c2bYM9Neg^m=0=C)qHJ*tBOs z_6*3LB0mjDdwFnNIXpwBypz;ql`w1LY=PbYiEiGm55Nxb#;nVM_$>F02xnK=vT*7 zvuz8O@d#^h%WD>8E-x=bzuO%-Pw@dHW+Xea%7EWB>pnaic&z@Pp(MlNh9-a|`oBNe z->>Tb7kdx-|5l!@EvTr$tt~j#%9i8bGs1DK)a=o5@8~s1#u5RD#*lIrVIi;xRr&uE z7bFGz2~E=ke^9K{+1l#(e>>IG)k^0l*VH#oew|b^XMw2(6QjUdi=CXOZaDnFs@cA=@7kCa|zvf>6 zSc*B4j4OlMdu_UT;JpD*z2b>C8oSq*n2aa#00tfR zp<5rw3F2|vK&~{73c$^dqiI1^ar4pY!>Ayf;RHvL@%NZdEy26r(pWASy=x3yK4wbV z0|<gf}{v-o~3oD6mf23u&AdO&;jM z-L8&>t|-E3iM*DIJMaZ4p|R@jpkEeK%g~fb*v8XT&OM^-REt8&36&!VP@0Ap*${Jz zB^DuJy}Z%^d?x~*^0nqX{a)2Gk1p{1DLm3rtLR@JlqyD#jDpk3&em&GN4172nqrZn z2$%Gx(r1=x;VDiq5;%P8O4cDuma>G6=ie)JTPDba3AG}@YtCbvlg84lb~n;kOnbK{ zjq6Xa-DauVoXq{nXT_BT?)u`^AZ%9@wUq^}(qvu8))cW-1Z;swZA_YO$J8(_ZNSp- z=EBVx8lFfmvomga{a0WAM<_)@l5Efeuz3AH80$ynui6v(#Q!sond~&rYYhWf`1=`yMt~&sL%ZEd=T#B0QKw*foZZg8w{~TgP=^- zwz9#-XhpHSWc&3Ncg+ED5wKHQidRasX9fucx(pJGHNf&WOe`CWH ziRMb*CT|UuxwaaqT+z*u$LwKGFCB&^&Xd~;=%Bv5D z0Le2wRj6^v1ddJYr*#Yf5wI8T{W0tu!X=u6WDreobkS1!5}9aELM3N$7U38&DoK(T z*bDcTb5~CQ{2tI$-BiDuleEkYT9HC5L1DVjVW>3}c3v2>pU0Fim-}k~j zHTz_VR2Tq)fKZ9~2t`;^WW+KW2Y@+eij$wbXE4OT@s!PQ43`sZ1S3KcC2agyz?4uj z&1lnTJbALBQJtkJ<5GCImgK>sOz?So_H)1c=YQ@z`T75T{pXXfUmpdqT_O*B0m;rJ zSCp`Rdj&_c&mwNSYhT%a$EWW9)r_^V*snhn)}f$w??#=&^i1MCv5i zDQ|Hro8Z*N4Z8**MI4#nt1eVqgD%*qpbM^M2tOzU*vKobrfEXQLKzNvzEd{GQ#JVz z9j$Cwk4U&=^sxjv;q1~)lB!*cC3N8^|5dbif;gtq6>2vSmyxvC+pCgFZ^Qq_2-Vy6 zbt?Efmx#s<^=n(d$Kof0M`{1zk;c)|^x!1~ztEGzv$K!yPG6tFo72;Grw8y4mKk|W zIh&Cf!<=OtqKs=Q6!KdUa%ER=+j!94=u2x#mR<(GP^dm{nZ!mp;2EZXMiO)2SQ%F+ zNp#_y z!?WH~xBti#jW-wj|A*!F-?L}WU)1cs{__X>?>3$_>_5-zl5&bAz$~b^ic8Nj*J~DCU=GKcA@V+-X=@mC)EjKaIORA(62}Li z9V{ij;F!jkpJYj5Y6<7I*;&A@X;Hkww7Fs2%D023?ca8H3a&24sI0=`C9FIn(|fO& zQlqD6TIDsL1MRs4pQU^nb@Q0SS_>}$rKuXX(%Z0+5zBvdN==(im8#h<=`A5bMzHP2 zk$PZu^mtUsa!|pv)Ua;F9o^RFIx2XS(AXURW3`AxQYjs~(pKiMo5~k3c}+4l&gzv# z;S%<4z-Kv=+plh6r*yLWT^eXtqCL3G4ryb#4G2hWS3stTbq$z~mz@Fugg*V;KEcj? z5wlzG&OH*=yEfN0{xsPCHgsci3xK8e|6sRz{&&!S@c-V*vrhc)-?ZOCVi=<6LP-Rs zYD&@$93qtQl_E)o2{zkuC`tSP;lq<-xBDb~*Kd7}vJ7Zj$+d|vTin(YYQNgQ?6(uf zW%14aRrODvc-}}4X6}d#_3R341c(CuM1-DTZAsU6zqV>8uiZPQG6elfsTkO19B4Kj zV!oq5stMj!3*lJ8B}oz(VvrnBp(HQ{$si^pefn6!98D95vC_f{i`?CbtUnYOS7;I{ z@fg=!ov#()d_U*=3C=&eO-LvExjDgTy92Z~IQhEB+kHQHxnw82DF&@^L!5Eg#=n<< zH$^M$)JwI87MTXTkvG$T&kDtNHISw6dSt8XAp1?9Ic@_8kSbXILQsj?v4Fq~Wl(Fw zodaq_pcKh&N#y_%D$CGzif^NYA-Vso`rS3BS+(Ba7sX-?Gv(q{-H8b)kX)GoHZnlz z0cA42pQjk~eum;_yTgp*6%>QpjXtqZ0yBp%W7&E&kI}XpB4qxwc7#kVL}r8%ffomB z7~)(l%EET-C_zGKZF4Pp9#^2PN!NPy#Q{j`llR7{n-e#}Tz033qOsnQup3%lvNWwd z-~Vt1f{ZDSJE{U1kx1E4pt`80Q(_i$mN0(x&M6)hX}$c`l%|SVBzl<|x1J?(Zz~_r zt`BDU;40WZ8qjJQz(N*lJr7cgH_qv4uj7l?a|>E^yOc&%O_2B=&!Gf5s1hPdG9fWH zTOnMj`IV~W#XWuX5M9#v)a`$JH23!W|ARrz{(rW=zxQDO-^R0s|KGFag+w$)JT}L_ zMXNfnyyS`-9Z)}#o!dB7C8iHShu&N?!O1if6O+4eK^6Vo)~UCrH<)Q;?JEByb#r;6 zTH@|-Uanz-Zks)N_9(by+B40lJ@gZb6i1=3C+7VV@Os-{%%XCMWwb3Fp}#J9*Co}1 z{`}UTy8bszu|f5})c>=;_q?kApFhO^-OjUy{(ti+RT@fJwA4CCbfB?L9o?#?d>zv* zirAyjx~|qH&iqs*-_0=RB*ySXnQb(J{XPAYOwY2>hx7aMB4FE+>h;?* zRaSe#QXK7so#T;<1v5bMAbXGYq;PO)y6Z4{g}lXfG0j!M+CtLtiTjxIO1E+Zu~uLu zy8BDWN7P0Htjw<-o;f)Tl=9S><63&VHiA_yEI~8vuET7LSIA45(0C~^jppAZFSakG z4L26u^BB|Rh*Hg1S9DR%#^srkrpyPM>BezSweZRtrwefMg~e-hfy68 zRncimdE_DA^!3`J)ChIcB6XM~?9z{_EwVn@FlT1S6Jv9vZJH&Lbc;eoS^#}kC}Pv0 zjy`qy^OsM`8cw5v&A+y4*!B`7(l(^3T0`5kO?CPpmyJpG1BM@qf{3e5Fin)GFhtEy zS)HQ7owhO_@Nj1>?zsi~uWtXF^9HxK|2ufre^!nEd_L$u5g6TZ}xoCs80;&sdN-ui(*^_svITdR5 zNEJ55?!f*Qu!|zp@4Y({U`%G1x@AQsFt;iAa%;moFsh2UsgY3}f}RGiaUyPqBBruVbUJX$khmaF~Ju5~_#HV~);`ek)~ zv8GPF-kPh$u00Z6<@;iO*O64Uo#$e2&D5v9jpc9-nwdE-P}MsZ zc)pU_(HSPMp><4#$_uRHn1ct^ayzQ!0?(U|1itlrPO6a87`p0m0oS9MbEyJw@Y3XX zF9~jg+>{f~)+DD~qa4;)hp1Zo5v8d+DBwk2DqLOyp)vlnsMez#>Gt5srQ+s5ESI+Y z5GUinvE&5Lu;ML!PBGya#dCLbt@SkIhIv&NB@1XYEkAf8f~ zg}4fbv?EVhRu|&0V?VWk<|2!H72ul=ilh@{D`fa-wcpsvXiijHu(8v7A)IQ_Namij zRLEs}d->H-k2!Wc{GzG5#boi@A3Sv zoK2Nh_ix}40fZIR?@eIEa;2@=4=$^HYs0#PYWjQ6z}C}rV;>f_ZieSIl1Q(%62>mF z6oQ$WzMZZ9XhF_VaX4vGovg$3L%+2>-XyCeMT3vkH-bMkpjHh>)s_0!yS??(87Z~n8!!+{m z7V!J+oinT)p28Fj6C9Tan+w!SUy9mJ{XBAEmnWWhR&%E`bDT3J9r;|^6ivp!p%Hi( zH881v0@W3Rb?amEp&@mMNy*ZTh__1FR0^1OTpH!Md|E5CmRM!*&m_-# zvYoI?%wb#25r;`SK`_|aF@L_zrkIlm20O5wrD?s?7n?`r*Pu;qb$JmHQq#e074R5; zIyD>hhe`4Sk=i>I{PN33j}{R8X8>Q6(IzB^=c@uQR$hATWhqgVC<&aHWTR1n8%3{K z>C`%|2=z9b*3er3vN@Q)v}8Mi-v9Ev|Kef)?^d4m^S}5x z3eF6#fIjonsJ|^UMXEq?@FY*qr8mVJeDPj^Rg=L~nktre_JhVzJAFOiVd-PHp1Gy! z&9zAZYSsK(yvi-UTwH147Kzr?^;-7RHvV021C@&GRNTsL4)@ELLyx}%zXX1s1>de% zR@WFZ&6u_J=3z3qe@|Wi7ug&(H3KZs|NZ@bE&k)#^ZtYWzl~=t{ZC`eb8n(?*5
    }tZ=! z&@|a;u6>X4iqz%b`1x-0{71iE%m4g*|Ka?{tvqYUzd6iLsL7YFPu@xfW3`@lt82Tb z*RBB!bJ=amF_u>D7cc8w(qsEp*Xg>KE9!-ohVvEn3~?9p(~Prj?>&1%XCDxE*LdPj zDdW=K>uLae{rd9J_C+?tkxVpkoa4a@+gj3hB&I)fSFX8X*9mmm{&zjWj(R4~KlhGIJJ<{QDw z$D#ttbA#$HIs__Bi1vC2^+V@`R`#y#uvbI736GG#f2~#3-o|bipc=RZAt49)gq+BeG;IIc5UfZSgw7OvJ$s*f#-uVAL?kG zbvd!rUNzdwc3*G6=ifMgB;puz%W8WiIoJRtNcN8>V67#?ww|%hF?qN~l;^ z-#c6A!M8#O_rvmhc<#efxBo8@r-Y6-xCB`0|LxcOzq`*L?*G1(XAS%RqhSm{LzYQ< z;R|O;qEBI=@glQ7=P6tMJsK}a|9#4sT%_$Aq4_>jL}S>_JrjWoIu5`~=)GfeidM6C ze=&Q(e&{cKCI`*$zAy>>%$9jF2aZ)YF}2}yXvRofr?$NtEY%m3>A)~dXM{6q zj!o#`?DiWdENw6s?h*nKt6$tV0 zCxQ71$0PD-B`_Cw9-2xONG@W~k0mVDM#cGsN}J`dHf>fgZVZP<)pI{O18wyTncidF zaUU%~Oj647NugR~pQt*o)`^O&b+V_K73}@wskU)DlT)#0(ErE0G9`K&}jEQv+`$x9G}xWAC(E^PsOj7!J+~qu{#= z+egH8Yys^{K1ZebT0*^>Jl@x(yNif7GM0WWX!8l)-;^u zFArg!56_bI-xP6z;^8%2flJnZFZOq<`5#~GJ%3pL-O6*7_1}+*D_+0a`0CGb+r3%) zxsJB3{PgMP>#h1+8#lA&Yar=bD?V4>fQL|LlDIlbt;^z4!S~dr+}BWk1tu(N-2j=Ia9T{U z|0#}~Rc64A`EoXB46K6p6`VN^Yy-TjIC545vtc)m>%rs=Kp!|aQ@>~o-6r(6j!`{^=}-H|FU@}kY&01;{@`1+wKW6 zXkXJ8 zy>yFNRrf!@EoLhCLUx^2b2!VLaf-7lU9RAA^FF!CjCQYlasta0Tylk4TIP(iC0Ag2 zQ@$&(?B*$@H|T-0h&=e-Ry8&@=X=w}*Ki}t#uf0sici3T{kDB?wi9cN`&E5!El{rO zd$VBgx$kXd4^5i|eUl!V4X<-r`>@PS;|bIi+%z}p5?!<;`F4lq`hHP2WH;{@y=&LZ ztvpNoe>%JWbq|6ri~o9FyZ`saVE5tt=dCrHH@>E&bKd4WO`Dqdm*aeu6_y72ZTpyX7giqatNNE3VO-a{q=DXZ-_puX zjCRxQCS4deBVO0`To}3f#^bq~&FF7#G*@>K=GyRn$8lZtS?vEwnUG_SujvF@68|;W zulj#>`-6w`f4B2o#s70+xZ)<9Kpw;08&6PyQ@cB;D04lZkk{7DIEI=Dyq0&!198nX zFb$9zT}1inGB58hzm`K)+TOhtg`;Ch8{S%JL3B}bYmJVTusqq^p*N*otdX+q%lvxr z_H}K8Y-}jSOdX4|d&N@78_2b|&>zKO^vZsOh9;`xv4Gg?IusT%=Sm}Rv+jk(J-bhi zhO3#+F^))#^E>XaLQKtw_Oc+0=b|~U&TN^$p}XOzl#}}c&%12Yb>9}vYps{&>&)Wz z-hYR!xq+8Zi?y4=DoVU{Qd!)CvN>H@#I)S0)L6=E$74^!Df))|rL}B|Zr|BZ9`!r( zH7%b(*YiXyhv!XnhET27{I0>E)kc;F%r>u-T_W@C>X>@CH2aWt%H3J8o^EYpUBDZ5 zRe4=plVh&tv|0e@nw~3vurA-Y_H zXj{21nhW?Ad>Kn?CS&08vlC+hzYqL;ui#MQ2d}H-$s-$f0e#2bc*q_a5H=odJ zYPu@aC7?E}@BG%%tE;@mwe2^|F0Fl9!ZIx^kygaq=Z8h*?#6$-*#FCMOs;v?=l3peBJtr2rIx2&nQ znn$)Z;I0JZ0?$R5>arC;`pOB!$-i*?0dvvfqALOOs)RFBCop#*wfnH8vM~7^wu|65 zeI-(*A3;+P#m>@N^$Pg+#;!TnV4J(W)vjJ84y@`dZjJ)02MNYR_|C_*NR_(~mlMe^ zx-xl6SpFpNVJ0W*kEdnfDQ1Ub>vj zjA!nWbPF-l`;{rJJu-IUyumfr#;lO`X}^7#O&x#C7L)#Hf};zO@4{$$Yy36D$HGxm z7<*jzhiE(}_1FV%p( z7W9g9M-|(}<_8(IHSbHTV(%rwc-QNvZ~a-k{`cpyt9t>KtpA_w@Aa$kU%UHz59|Ni zc&@Vix65HwMlbY-xW3jmw!1E`1^bB6QNOR0%XZb|%P;-auY$I6vSf8)?(jh58l9m0^I?o9taLo1Gl*C-z!v$($vkv8H1Sicrr& z3Fl~zL=G3IgBn6b8lOXU84F^xo8WyJxk1?ng6}pBPo*V5hQDkujD> z8RwW5PQ@UoI&Kh+bIoBjM#X>PT56-3uJoS0p|cN&`$3W|XcTK0cwa1+BU8k%_Q5ao z7wV!BzZ1XEhLw(K++eOo&Qc)UX$kZydjJgh$KQ#^b+wjX(2U|39(TLSEKg%zw(jK25I5wJ#y`?0RE_J26R$&`#K<9PFJEV2Ll&v&c$|L(r%KYy_Q zZ{yj56C{!Z0IAth9KFq6;*}BJ6Cz`w0;svNUB}3J?>VBs%5=rbtE; zLdQ>m;{-`Ev(skr9?`h71r(1>l=QZ7P1tBu_+L9Ayran+7}YfuN|0g>386Ubgs;zj zJyVlhXA6!r%fg4FGl&Tnop4NKPycJs?}WpD@t*$Iy_k%9>L2%~n9*JVXo#YVEY)it z(RmVz%e3<(9HNWPlTc36&XfPw*@6#<6P5`$e*H#t!j!Y$a3nh+i81P#a-99v31=c= zG46dsUI{Dzr*95l|M(`H#y8Q%V)@@6?Cw3Q%71_FLH=*$*@9O@QZyw_8h#){uB?_L zHIa2Xhw$^?aWXBx{^#~Y%2XWmdTQDT#iSRrNc1F2NhErSDf+9P3Po>AmD$n$?=fdt zs#J>MI!M@ni5-Wvc5i#|`PG@Ti-v98I*QcG%`T4oBtUEDIF^w^e2)5R{np+Pn zJU!1_SLy)_!cXBR7j?q~k&Mp|z#(oMv2BJCoA&H))tGK^h{UAx2o(B|H#~1#sZL|x%2d?ex;ZTxSWt^0uiFh z1k&z*eb8Zs6P5zSmv%fLQ--zShT8b=xJd%0h@vs(VW;z|G@PXdw8sDW`)r6&nu-G2 zg?*!k!>~+@(}c~Z$~aWUssXS6WFyd=d1T-d3Q>{?iMa^PG^M{9GE9(wq2e)#g<50i z&6-q!_}QVUu;CO-EZ`)kC7fndk|{2um~s|}g!Oh{`_=a+r#m6M)>wl2%k2W8OtPt7 z(7gZQ3?j@W8IcG{ES@U9A1h+&9xJ7*aOl;&Y#Rt`=$*1iNmBo>`c*GG2{ z4*vYdPS^BzFWe3Le>8Q}A{Q%yD3-u5VoAa-RYMXD6Rh`-%@&Dc1vEn>(ckRK&x*3; z5gq>$u@vi-VN6CNtgUu|qXN|}I2?@#C6XvazbLHKG)`hn6$LN{|M>#1v4}X)%S2fD z`2ue~r8rX5J*H_UmsjX~=`Mbjecx2IFP$%NZbcsDlnN<})!LPfYF9%+$?}e6S=;?xgTHs*LUv%>u3?q?-;x~JPp*p{}t?=HBv^_;VDd94>4OodO@g{F0*1T+za>qxE?Lr@zf^N8_pSD z%XqqRt7%iu+H0ZJpsr!R-MHblspn=8^+f?|J`1yS%u$SsqZej7Qt7^936~^E08^3a z1162KV*SQ|)LsMQ)Cl2t1n0#DsA2JQXG)rlMPgf%6V5IHQP2o#$Af+^ zBukAL8jJzyrF>YdRjLhCLs;AgFMuU~HQ0gj(#A^T@f3}hFJ*4aH*n==nT*_)OX13o z&$&d8iTSV5l2r2wHmozsk_2=~?ar)^faM)s;3rlP72T$9-?d}w`DQ7u3Z|Zmr ztE+e4Wr`_IzKPs#EH>ZCCJkZMChK`S?qbTmJ#DkGXFb=miCR zFpbX}h5-I%W48b~!L%$7wiaNj1k-FhscD}XF+Myw&MoEjhTTc6FpCuzRmWJ6zdK<% zdTxk#V3o0I@@I#dQ;Vu?$|Q*@8zaU8782GQCT!f>?GOIk>%Zs?{?tP$>3X$Am(cE@ zJJ|1eYJE;6`jl@gL|8x*QQi9D1j)(!d5X`y4xVsArEte$>;faT1zk*A9>0L&4aic% zlH;B~i->9m`Y1s{sG0q|ji{tjaHGWiZ$i`vbNQp$4n4)cXIRL>uBs6=Uk9jKUAv14 zh*Bo)xg{kh?|(Q0LB`aUb32M=XAVoZZRh0Gubzv)_p-$-bDqVbV1o*~6{2ce;0H9s z$xW>m+M2$?md0jht!0}PiKdD>MHZJmR^E1mD*&d#S~OVf_OTe~2rn~6N?n*=AelCt z8HID>w+}^%qfp=kN0RY!Ew!dN7qh5b=6sPuM_a0^nTMO=jH_>RZHhCN@q`H>F^anZ zcSUBU9;g?Iogea4qjm1ofhzHChB+s38PqbKCwSf2$%L74wHmk+Vi3&$Tu%%b7V5p=@>6yl=W!fqvFw^t?z(hZS9#! zR!Ed2S_MBA9RR(ztXQt8P`<(S z)tZkl4d#@9uNS@LS5+U{BL$1c#+g#Jyyp$pR5j^`ReoyzI?G1-aCR`A=RbX4h<1j( zDb@ey_Lc)EY-*7Px7a4QuSUKLJkK|Ba`M@;BNup$4Z3TQFHeoEm#=q8qeVUR$X9Fu z7^D8YfqeOqC&qze$qAle9SBcGfD(>TJcmfn9C7Hc<4dRHx;BMonL-fQ5YYHTIsD2I z*|j|g>hE@g9S9Ok$8r+DpbvqNoY8TSZAqw!)8{0m60R{OlO2MIyI+(Ink#Pw1I9yB9Ji| z)(i(TEZdYoV4X?6-i^uuI;%}$Yq`tXr1xf zOscT+)kt+OpJn4$$rmN;)~7!6>$6i^gsmQ-9~G3>uPVvvuRg4G>&)WWEu?Ni-q!O% zcJfFHCqTw!rq@bCY+~mXKH3FGq>T^~z^F|ZHD{S2KqfF)EbOYu?Eo4w-H<+7Hh!hF zSR(f+uQ`7DTIfxUUgP-b6jygVdJ2boGr(Q zxt3dGsUu;9MfPwdl^to?9m*M0e_NL%&&mZ4(-Q>$t9YL z$3R8}9*Sm<^&uho_^G+fL13wiACKNLdBU;4R6aKN*g&xYA;dYFcL0dQCOPk7OkHl- zWDde1O$`uWqXK<*NNc;e0K0UaDeQD&Jj^_D56w*(HPV>AxYNs8U1{x>kP96^sJI({ zk{kh{BgUuZq=ZRyCj3D%cW5ZyKBOkhk4D%68{&h`R?e0_$8D7|nU(ovOVPh&^tZqp ze(*=4vjwK>79*QaYzw^o;zF|Q{U}T6O_(rw zhzkTId|*j7#pR9jr*J%SyccwXr{Fj9R;OSK0-M$Exps^HJkHnISQ;` zTb*%lNiY56)Gm0;#RB@Boz5-v3q1c3r759WZIocy_jz7J1Jhao7kF;td>ewX)ki|x zkTCe0&9{ZbHYo;kRJXuKb_*c4DpetOJ(mMKm3(Vj%tiN---Du~YU zs%24In0}@{Li5eery$rAgCtWd6o5-awNQ>#ZF5L~n|=M12|;ukiMeUkhCvf9s?-o+ zF}hoYChu8V>G$1kw>d4NrOMTFGJ-uyVP+_lrmI&qL-;O5zh^kl?O2S)=g(d|g*E)Y zz;OQ=rjfguUMC3mI~}J<(c>@-ZT4+UX9pc;NxD3lCx>TeAK#t6?i5Dm%x(N0bbQ;> zkW$~nHY$HvKrTPhHqW2l7UkJ`UEw2}P~Cqn@O)v57hb~lRU330(D{9TU%zVlb+-I$ z{+g^6i7E^KGHHU66W$8g+jsBZoQ3j}(Nhtlf+hGm_onpww|jF+e{hAnQ&zk@W$Ar+ z*SphqBLwaNvu7up_7clbZ#$0 z&>7?_L-jHUo>r*&G6*!!KduyAF-3i~fk#f%e^nqVY3til?{{*!!=F;dC3s+7KH9#> zhB%UmuI#R|=oaTv+`*oL8=%YJH^Hbv?`7~gR5~y8`0#6>6dV$G{~2`SolX-823I1% zz$d|AGb9+?00{c2HW-t^Anb?zPUq)$6yCBKo(?gG!QNBY?eF%V+8j!| z?f@=aB7J6bsuxHjLW!8*xHzvpCUTMub*5d#yfz{7mXJthqRU2IIl*0<=zQlX$O#cJ zMZYob=V>xWsf6mVHDQW#tP@1XSeRV4CaJLcUZm``Ql^&(k}0*oc*^oa8AW>85k@lO z3RE1M)U&3md&Y*+P?RKEqgRLZ$iIuUv45dnh|NZ1ir_+TK7k_SF3quZhA41+IxW1$eJwFy8C6AyLFf*F)%Qi%y&Zg`R|zH#TmR^=5ECTC?&R2CYWqTuX`gz z6;H)5WtvLGYS%b|6m`%2bY&)LuhWH}6cvmeWU~vO*KnHcg(b8`==a{1E#1|~buE`K z!A3RszRXPKz(H!(zs}lzq6w?#`zQJ$fFffw<2E`qNhfHCC5f~^X%lzCrfiHURwI9j z<|S9F%PZ~Ws8%d?q!=~E+@8wT8J>#NPFhGv&PIm0j;*V~TFx$0Q>Cm4(({f&=<_3n z5nRe`D>qLyJQIFPA4?c1#f9h`h!7bTt2b$EbSp)cPep_&;)LZXP4j#JNR(^G3=7q~ zQ&>(K5uK}XEYK)=VdCV=vgUWq$c#c;EW*1?3_Fu>Ji^?msh`O6_v@65%@Fst@}J#I;BJHj7CTl->?b-lgXj7n8O-(+v-~9RC`%wA^gZNi5liQPQM1>sla@}$mWv^yvAx^%Fh$V>I|xs~ z?GF1ol&~^Oug|mnoWS*2{Fv5fMhB@uvuwR6d-A=1VxX7UhneqGDI57knwRZF{MQBhvTC+Z_nOzch$806HTxX#RNH= zyFBkY89TZJr9H+R8?8<#Tyi4y)hU9FMnF?|ym@9}iDY58u8&esc!zPT}a?+t - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. - - length - int - Optional - Length of the generated random password. - - strong - Boolean - Optional - Whether to add symbols to the generated random password. - - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. - - context - Context - Required - Parent context. - -The order in which this function returns a secret password: - 1. Already existing 'Secret' resource - (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) - 2. Password provided via the values.yaml - (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) - 3. Randomly generated secret password - (A new random secret password with the length specified in the 'length' parameter will be generated and returned) - -*/}} -{{- define "common.secrets.passwords.manage" -}} - -{{- $password := "" }} -{{- $subchart := "" }} -{{- $chartName := default "" .chartName }} -{{- $passwordLength := default 10 .length }} -{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} -{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} -{{- $secretData := (lookup "v1" "Secret" $.context.Release.Namespace .secret).data }} -{{- if $secretData }} - {{- if hasKey $secretData .key }} - {{- $password = index $secretData .key }} - {{- else }} - {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} - {{- end -}} -{{- else if $providedPasswordValue }} - {{- $password = $providedPasswordValue | toString | b64enc | quote }} -{{- else }} - - {{- if .context.Values.enabled }} - {{- $subchart = $chartName }} - {{- end -}} - - {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} - {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} - {{- $passwordValidationErrors := list $requiredPasswordError -}} - {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} - - {{- if .strong }} - {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} - {{- $password = randAscii $passwordLength }} - {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} - {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }} - {{- else }} - {{- $password = randAlphaNum $passwordLength | b64enc | quote }} - {{- end }} -{{- end -}} -{{- printf "%s" $password -}} -{{- end -}} - -{{/* -Returns whether a previous generated secret already exists - -Usage: -{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} - -Params: - - secret - String - Required - Name of the 'Secret' resource where the password is stored. - - context - Context - Required - Parent context. -*/}} -{{- define "common.secrets.exists" -}} -{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} -{{- if $secret }} - {{- true -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/_storage.tpl b/rds/base/charts/redis/charts/common/templates/_storage.tpl deleted file mode 100644 index 60e2a84..0000000 --- a/rds/base/charts/redis/charts/common/templates/_storage.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Return the proper Storage Class -{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} -*/}} -{{- define "common.storage.class" -}} - -{{- $storageClass := .persistence.storageClass -}} -{{- if .global -}} - {{- if .global.storageClass -}} - {{- $storageClass = .global.storageClass -}} - {{- end -}} -{{- end -}} - -{{- if $storageClass -}} - {{- if (eq "-" $storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" $storageClass -}} - {{- end -}} -{{- end -}} - -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/_tplvalues.tpl b/rds/base/charts/redis/charts/common/templates/_tplvalues.tpl deleted file mode 100644 index 2db1668..0000000 --- a/rds/base/charts/redis/charts/common/templates/_tplvalues.tpl +++ /dev/null @@ -1,13 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Renders a value that contains template. -Usage: -{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }} -*/}} -{{- define "common.tplvalues.render" -}} - {{- if typeIs "string" .value }} - {{- tpl .value .context }} - {{- else }} - {{- tpl (.value | toYaml) .context }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/_utils.tpl b/rds/base/charts/redis/charts/common/templates/_utils.tpl deleted file mode 100644 index 8c22b2a..0000000 --- a/rds/base/charts/redis/charts/common/templates/_utils.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Print instructions to get a secret value. -Usage: -{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} -*/}} -{{- define "common.utils.secret.getvalue" -}} -{{- $varname := include "common.utils.fieldToEnvVar" . -}} -export {{ $varname }}=$(kubectl get secret --namespace {{ .context.Release.Namespace | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d) -{{- end -}} - -{{/* -Build env var name given a field -Usage: -{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} -*/}} -{{- define "common.utils.fieldToEnvVar" -}} - {{- $fieldNameSplit := splitList "-" .field -}} - {{- $upperCaseFieldNameSplit := list -}} - - {{- range $fieldNameSplit -}} - {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} - {{- end -}} - - {{ join "_" $upperCaseFieldNameSplit }} -{{- end -}} - -{{/* -Gets a value from .Values given -Usage: -{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} -*/}} -{{- define "common.utils.getValueFromKey" -}} -{{- $splitKey := splitList "." .key -}} -{{- $value := "" -}} -{{- $latestObj := $.context.Values -}} -{{- range $splitKey -}} - {{- if not $latestObj -}} - {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} - {{- end -}} - {{- $value = ( index $latestObj . ) -}} - {{- $latestObj = $value -}} -{{- end -}} -{{- printf "%v" (default "" $value) -}} -{{- end -}} - -{{/* -Returns first .Values key with a defined value or first of the list if all non-defined -Usage: -{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} -*/}} -{{- define "common.utils.getKeyFromList" -}} -{{- $key := first .keys -}} -{{- $reverseKeys := reverse .keys }} -{{- range $reverseKeys }} - {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} - {{- if $value -}} - {{- $key = . }} - {{- end -}} -{{- end -}} -{{- printf "%s" $key -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/_warnings.tpl b/rds/base/charts/redis/charts/common/templates/_warnings.tpl deleted file mode 100644 index ae10fa4..0000000 --- a/rds/base/charts/redis/charts/common/templates/_warnings.tpl +++ /dev/null @@ -1,14 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Warning about using rolling tag. -Usage: -{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} -*/}} -{{- define "common.warnings.rollingTag" -}} - -{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} -WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. -+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ -{{- end }} - -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/validations/_cassandra.tpl b/rds/base/charts/redis/charts/common/templates/validations/_cassandra.tpl deleted file mode 100644 index ded1ae3..0000000 --- a/rds/base/charts/redis/charts/common/templates/validations/_cassandra.tpl +++ /dev/null @@ -1,72 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate Cassandra required passwords are not empty. - -Usage: -{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.cassandra.passwords" -}} - {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} - {{- $enabled := include "common.cassandra.values.enabled" . -}} - {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} - {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.cassandra.values.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.dbUser.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled cassandra. - -Usage: -{{ include "common.cassandra.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.cassandra.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.cassandra.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key dbUser - -Usage: -{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.cassandra.values.key.dbUser" -}} - {{- if .subchart -}} - cassandra.dbUser - {{- else -}} - dbUser - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/validations/_mariadb.tpl b/rds/base/charts/redis/charts/common/templates/validations/_mariadb.tpl deleted file mode 100644 index b6906ff..0000000 --- a/rds/base/charts/redis/charts/common/templates/validations/_mariadb.tpl +++ /dev/null @@ -1,103 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MariaDB required passwords are not empty. - -Usage: -{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mariadb.passwords" -}} - {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mariadb.values.enabled" . -}} - {{- $architecture := include "common.mariadb.values.architecture" . -}} - {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- if not (empty $valueUsername) -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replication") -}} - {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mariadb.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mariadb. - -Usage: -{{ include "common.mariadb.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mariadb.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mariadb.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mariadb.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.key.auth" -}} - {{- if .subchart -}} - mariadb.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/validations/_mongodb.tpl b/rds/base/charts/redis/charts/common/templates/validations/_mongodb.tpl deleted file mode 100644 index f820ec1..0000000 --- a/rds/base/charts/redis/charts/common/templates/validations/_mongodb.tpl +++ /dev/null @@ -1,108 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MongoDB® required passwords are not empty. - -Usage: -{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mongodb.passwords" -}} - {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mongodb.values.enabled" . -}} - {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} - {{- $architecture := include "common.mongodb.values.architecture" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} - {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} - - {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} - {{- if and $valueUsername $valueDatabase -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replicaset") -}} - {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mongodb.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mongodb. - -Usage: -{{ include "common.mongodb.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mongodb.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mongodb.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.key.auth" -}} - {{- if .subchart -}} - mongodb.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mongodb.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/validations/_mysql.tpl b/rds/base/charts/redis/charts/common/templates/validations/_mysql.tpl deleted file mode 100644 index 74472a0..0000000 --- a/rds/base/charts/redis/charts/common/templates/validations/_mysql.tpl +++ /dev/null @@ -1,103 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MySQL required passwords are not empty. - -Usage: -{{ include "common.validations.values.mysql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MySQL values are stored, e.g: "mysql-passwords-secret" - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mysql.passwords" -}} - {{- $existingSecret := include "common.mysql.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mysql.values.enabled" . -}} - {{- $architecture := include "common.mysql.values.architecture" . -}} - {{- $authPrefix := include "common.mysql.values.key.auth" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mysql-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- if not (empty $valueUsername) -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mysql-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replication") -}} - {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mysql-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mysql.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mysql. - -Usage: -{{ include "common.mysql.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mysql.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mysql.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mysql.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.key.auth" -}} - {{- if .subchart -}} - mysql.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/validations/_postgresql.tpl b/rds/base/charts/redis/charts/common/templates/validations/_postgresql.tpl deleted file mode 100644 index 164ec0d..0000000 --- a/rds/base/charts/redis/charts/common/templates/validations/_postgresql.tpl +++ /dev/null @@ -1,129 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate PostgreSQL required passwords are not empty. - -Usage: -{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.postgresql.passwords" -}} - {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} - {{- $enabled := include "common.postgresql.values.enabled" . -}} - {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} - {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} - - {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} - {{- if (eq $enabledReplication "true") -}} - {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to decide whether evaluate global values. - -Usage: -{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} -Params: - - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" -*/}} -{{- define "common.postgresql.values.use.global" -}} - {{- if .context.Values.global -}} - {{- if .context.Values.global.postgresql -}} - {{- index .context.Values.global.postgresql .key | quote -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} -*/}} -{{- define "common.postgresql.values.existingSecret" -}} - {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} - - {{- if .subchart -}} - {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} - {{- else -}} - {{- default (.context.Values.existingSecret | quote) $globalValue -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled postgresql. - -Usage: -{{ include "common.postgresql.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.postgresql.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.postgresql.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key postgressPassword. - -Usage: -{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.key.postgressPassword" -}} - {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} - - {{- if not $globalValue -}} - {{- if .subchart -}} - postgresql.postgresqlPassword - {{- else -}} - postgresqlPassword - {{- end -}} - {{- else -}} - global.postgresql.postgresqlPassword - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled.replication. - -Usage: -{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.enabled.replication" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.postgresql.replication.enabled -}} - {{- else -}} - {{- printf "%v" .context.Values.replication.enabled -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key replication.password. - -Usage: -{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.key.replicationPassword" -}} - {{- if .subchart -}} - postgresql.replication.password - {{- else -}} - replication.password - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/validations/_redis.tpl b/rds/base/charts/redis/charts/common/templates/validations/_redis.tpl deleted file mode 100644 index dcccfc1..0000000 --- a/rds/base/charts/redis/charts/common/templates/validations/_redis.tpl +++ /dev/null @@ -1,76 +0,0 @@ - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate Redis® required passwords are not empty. - -Usage: -{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" - - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.redis.passwords" -}} - {{- $enabled := include "common.redis.values.enabled" . -}} - {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} - {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} - - {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} - {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} - - {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} - {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} - {{- if eq $useAuth "true" -}} - {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled redis. - -Usage: -{{ include "common.redis.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.redis.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.redis.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right prefix path for the values - -Usage: -{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false -*/}} -{{- define "common.redis.values.keys.prefix" -}} - {{- if .subchart -}}redis.{{- else -}}{{- end -}} -{{- end -}} - -{{/* -Checks whether the redis chart's includes the standarizations (version >= 14) - -Usage: -{{ include "common.redis.values.standarized.version" (dict "context" $) }} -*/}} -{{- define "common.redis.values.standarized.version" -}} - - {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} - {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} - - {{- if $standarizedAuthValues -}} - {{- true -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/templates/validations/_validations.tpl b/rds/base/charts/redis/charts/common/templates/validations/_validations.tpl deleted file mode 100644 index 9a814cf..0000000 --- a/rds/base/charts/redis/charts/common/templates/validations/_validations.tpl +++ /dev/null @@ -1,46 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate values must not be empty. - -Usage: -{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} -{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} -{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} - -Validate value params: - - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" - - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" - - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" -*/}} -{{- define "common.validations.values.multiple.empty" -}} - {{- range .required -}} - {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} - {{- end -}} -{{- end -}} - -{{/* -Validate a value must not be empty. - -Usage: -{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} - -Validate value params: - - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" - - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" - - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" - - subchart - String - Optional - Name of the subchart that the validated password is part of. -*/}} -{{- define "common.validations.values.single.empty" -}} - {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} - {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} - - {{- if not $value -}} - {{- $varname := "my-value" -}} - {{- $getCurrentValue := "" -}} - {{- if and .secret .field -}} - {{- $varname = include "common.utils.fieldToEnvVar" . -}} - {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} - {{- end -}} - {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis/charts/common/values.yaml b/rds/base/charts/redis/charts/common/values.yaml deleted file mode 100644 index f2df68e..0000000 --- a/rds/base/charts/redis/charts/common/values.yaml +++ /dev/null @@ -1,5 +0,0 @@ -## bitnami/common -## It is required by CI/CD tools and processes. -## @skip exampleValue -## -exampleValue: common-chart diff --git a/rds/base/charts/redis/img/redis-cluster-topology.png b/rds/base/charts/redis/img/redis-cluster-topology.png deleted file mode 100644 index f0a02a9f8835381302731c9cb000b2835a45e7c9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11448 zcmeI2cUx22x9_8Zh@yyC0I4cPR3wC|kVp$H5PB1ZB#;m~gf1}_1O)^|QB*Y2#4gyt zMlbeAQxFvp712m>hX{m(GZyaOx!ZkSz`gf*j(>!>GS^(QjWNFCGu9zzC!56!6&9jU zsKs`+R<0=2Tv-%qj{Ji8aAni0vR)KQEHl>HJ2pI#N)HP{sbegEe^b}f4US~Qs$;Cw z_4G(lQ96Ni5-o-l&d`YniiJz?dw66Zok|Z1{M|-RS5J47uKp%8#vQGzjxpCah7XLM zj-j5O@9*{`T2RE_9UAE9LI+xoBnmwuHj)v%{&$O@SQ71bZ+Kl2DH#*!W~guJ6YNcK zHZTeO`>F9kF${WS#P4QkJslGrH2U}5u}M)uzb^*{#nUN4$W@Fr%;@i-!xQO$57ytD z8g7NACsAo=gGf@4U2vq4|L;yBNa25X;tb>6G}|@C+Q2i|iEP41uyWQ#JBJ%4#8?F< zhJ?qHVxj_RUKr=dpkNn9ac?y zjjf4Zb6GNz?1!C-z2!T|`I6FNrJxgzEdNh&X5<(5KrG*81T6sFq zW4#j0(FP$=R0ktuGQKhJ>5aE1x<}i)7{Yf-uoVV+b&Uyx|9F@?Q)9v%9i!kom8xr_ zZyDi8quLlJ$HoMDMv5Etu;N25ccDbf0|Q5Hey zuy9hmyN{lmxi_9+6lmk*8e~ZKun3K`af^yY(`;?=K0&@@N^D4|ZmdgqQerIL%hrxy zM`KVuoedc@Cs*&NU@z}TC!YjoOLVwfgp0XBq^=QOH`LfZDk)yy$}P!&oMd9pNV2eV za19GKbTn|V3?&(oC>TsM-pj)_-XqzO!f>`XcTI{5(F-#P4|eb+*@i_q#RWz9Cb}lU zY#Dly5oBMwdxVb>J|ZxR=Hn2B(esIp*C%@g#keGsV#(gFfsDuqU)z`@qaaF%b3~+m zaCivCJ1!{#Z-OS0%&mNabUj@xDKwK12OC|CUMSr<(LBO6#=*zKmh2FMcXPB0wAZ(G zOLT#y3^MdVd+FN4H&{DMs+$|$6}}_mun)3ByGD6M!*@NGc#37RH*(}cY~w5(g7s}^ zzJ{deP$OjHtPIHRcv})F*daVJ9OLS0Leg`Niu1-BQNyAVy)cG$-t^cQdT5*_#!w#< z6bFATlk}s>LCIl6HxqO;(KpT^F4{I2o&%lvSS5MJQIi?*1e?StBg+V5BGsE18|WMZ zW@PMb;;rjJh)Z(TCxklSlZ>ctaW=Yo)I?_w8+1I}9FDPYfEk{Rp z-ILpbFFK4J$#eW+T6n?W^l5qJZKu}h5eQ&HLB6NEPly?kFMd+9B*;21U%BtZEs%?pK-aOJA&_a1j0}?4#_1KVkJ~ zb1N$=!~T5LHEY(Ki6ShOkvZyUtN}kg)=-p%p8{pGCE=%=k}YB~GBVw%{}0_J=Dl%c zNm&_1!2faZ@ZlzI_bqfh*IP+9=vgI}rUzo0%pyLDCQ>#KFyN?VT{J-WBp zCg)?vCAY`Vo>`JeY8zKB+H+FMc}Q(BfZHZ_r67MSRsc_F7C zywt+dvh}JDW@2iJ{P>7kKAJK=H#hgl*|VFbw_3cM9SuWCQ8xa>xpUb;&rXoK%1McR zdnJ}CDoP!Dk~;a<;97Nc@fy+86}OQmPoC7l)OA^+lzf7Q)M`ViYrc0ZqM~%M)1#Jw zfq};3$}t=HHo0Bw?;rEaU97FebB`UnQf>OC*hZRgcFPL?lreG9^k2lGzd~ZiK3a#p zy)Aj;;m?Kl6GpPH?|86AUw`=-!|+_};cth8N7wOf@{BbUz8)iD>yD^dMsdu3sjgcm zW@l$t760Qj&u4MW_&1NM{x!;Vb#<@w7h9$;X)0sy)@H8k+&6o3!pHoJ>1>urexUjA z{*xzH?Mxn059_{ZJ+&^q>tPZG7Orn-Nb**9*6rK+L&p|ya{?=HmlwBKDP8rsHUCla zcztmWHlwP_c!*J;ZD_dCY!|w?1!4%~4*Dqs@kWrCfWZ=WDk*3@9_9&Rg z5F_^U)4UCdKkmGFRb;&gdi0)Bv?Q|{S_2<>6TK>ZjGG z9{XfuWax&!)fbyTe+?S#0yhM(;#x%99AT%DK(HZO64jEUVl(pL5m;Fr&fwZPdwct( z%F5ZbwcE;A()V1-YtksJyA;;q7Ewg>BpOX=mYSHHB=uG^+sd@U;l8gOmt?7&bDNkM zu3c;-9?ml75dN@2UC14Kwt46Ayu3oYV;XHVV{t*d3K&7wJ2t7s>ig?!V=XEy zTei8u;}z>#O<*5YkYo515Ix`}TT?sxu@^5d`*D}*ybg@r&so3e+v-a$5 zZUo2RH_Wjx%ILh}MVX!$Yom3g3NIn!T+5S?3nT>6XvGdEb=qi07N;DkD{zvz0b5=XcjZ z%dB}4OKjOLo4Fig7=&v@&9~z!vfyUH!r>W8>ohdhn40=cWhIkX&B#nMgdSzQe698C z&HwuHqLib$HKeUX^6As3C7g@0e3~gTl8)Z9$CYK#Xmq|lJ(njRXfx1~)AFtJO6k9w zkVqt3A`$kLt7TxY0_>xW)*>D8sh7e;aXnntiCP%~e12HDO9BW)FCB@FA<~X*CewMZ8<>mEH4zkm8a-`u%DeyvRRBF-r^R>#fZ%=tc?G*uabB8b?O`
      gt0u3YK+3VbZ)7Cr=g*&)YecY;+uHRLladT3#L-cG+Z4CN zKHgdOtr;9@>`b#Ba+WJ_{4yh$6P!auoRD{nC(pX_v#ErxkgbB-IsWFP&W_}s%qJmt z*68S5|2A?sI~z}@uitaVzm50v=e`T{#J^q`x%l~|^x)X1PD%ECQ3)6r7}&pZlW#!x z&7i92f%*0h4r6aaZ}j74CZ$tSQjUNV{3&o&kyxTw>qazFXX3Act31{S^Z5WvqP%;8 zRA3x!@p~>={SD~@*D62Me{9N}gIbv>4iVJ*7S*vcbLjhxnzRda8yg$XpFfY95st75=?aFC9}wq0 zF)@LdjmM0RV|#f>r?%h2M3;$#Pa{fO)5_jR(9T%&W!y0{L3|lv0qAhQ-1KmF^PQ#ZP>O;1`%Dz!7D2~MQU ziWTB2Dk_SwVr4}3^O^Dya_Y^8?nk&h01c(e<# zn#xC@6l4*7aQx)S269E;yL${|OE<2}jM=QQ;)KaRrkkog^P>D`le>${Uf8$b)1Kp> zs|yMWF0X0_-=xd4u&0Y3+CqaAK$nqa%A?fkq#lyJoui-Hen2>X}amW4T zsHl&Pl3-Q+5SF_hB#eanpW7uIe*?#A_w<-e)@q~SyPJD|z&6%iOR!QgO3a%bavc#AD>^6l_mA0H!azv|NZlSo-Y>{7yA@;9CP`qRRbUn%6+e)_JqE@(-#Tj($SLZ+CP~bsy z^z=kD2pv1Nx#8&8SRE{FDJOU-zYL2!Y4}F2TC*4mHh4*NbaWfddEQmOd&^+c{tSn~ z1k|3gva*{asc|0Qw8G!sK8kJ7>0&1%@zj--rXaiP*RVBWzVhzUM4V8cKhnFInYN=G zH(rj*4J;8!8EBy5Shg7(^gc>&AhW&&K%fp5%101T+q}K=U2!!ZR+L`2pe;1(yhCD5 zwZLA;2r!@WQK-ns$WLFsz)Bk!GrmY|iT$d|OtY-O3CYmGMWK8=bZ|_=(b>~egE`;B z&DC`utbzl(e>s=PLdF(@$Qo;F>;K4_clR(EnVF@3${I-&7|nq*XIAU@RjD#F9Ja!- z1gAUx{SAmEZGM?Fa-d@lh@@~DD8%M>?%ZkX;BXAvqz+>)+VLR1jdqa4x`}xGPujwJ zjrkWlZqbNgA0GNlNuA6sD9GCRDA|r(xQNS{?CRYFpMIBcClzE-x)A0>$IUe54MLV{ z5YKI7rd=<`4U$-_CQ(64=M>`}9L2G*vBc3jiKCFeFf-JY%#xS?czdS-j34BuI)Bic zdm|o%rQaRgNkv&y6rbx8JJcqgxpGr3w#j*=j^6?ni&d~S!D(vw4hk!~PV_BJXp*+! z*WgV`k!x(MK7_Aw8b^7^?KuC1QSW&W@?d1=cj}_1HTsUh>3@C-(>ADeNNAuaxTPcrHRdNQYOyka!)+4~pt_Se?%`LR z;xnbVV}q7fEhKKOH~ewy)Ya|Slm*-y!(D7)Ma_K*%o**nUm81s`t?3R<$}}M49N5# zO;E?-RNO8Q>V&^~b0AxTn{2rwaMM6V%>xSL3uu>2xLgQhlQT=!U!rWP1^I{yYZ~lH zCiu;Dr4yU|b(q->0jx?`SqgmC)WAIw&;orf@uOty$OokjUf03z=V70$*Vfi9CpRq= z6BFxuqRFa7_Xe7xHZ?Q6iq)$~_dm)_vy2nS?9xW&ct6KH?@M@!S2w7Qj z=(&&|);AuKJ$mZYdgjW#!lRHK-s#T|KF`4lq}0^Zf;%qCq)Ex|YizU%>b>pm?R_vc zRSXGr(F4tL*c4;KurAeqW_0EIH*LSGYHF$oXUzJ|^&Mz>+qx9d`YfxIVcpv04@u z7P_>TibzHZ0gUm@th>A0*2$^4z=W}M*)l}U-VX0sxfY*Qo3UcUk-WUm9lIV^fIX2} z*E1>gbxsAwdp~^&w6d{TYiukBsv-@H2jbq;uaTU`k8PiyHdu7U^IHAuYulqIMoAFE z)@W)<+`D%Vl!lF+oh0gfNr@P^e{hY~PEJeofU`lfu=n>@z+N=MaRRq@2)rNV)8nJT z@2b%EV~6$~IkFUaoQa9NiHS*l&Du`{aQhXwH+5(=#3Ug)*1bHtRYpZ6C+V**r214z zInzX4$S#&HU5fJe_fOoltD&J`-itFv$e}!K6uCrNS{k|d=FO@(bLK2qw5Xx4Za)P6 z0|_6JB*5sp?lCk$heZuEFCHT1#U4bGY#KpPcA?gW4GpmOE{Mljcuy6aXct?-SY!Dp z3!^+du-4Tf9pP_A2VlmeeOgNzIH%HHIGOnLW(iBYVtfv6^)iTckbN8)b|_e zoVEKYtaXQkm(nQ~GAVfY2Jx!TxY1AzKg z4W8SD1hSHnb$$=x9jC6&zn46&{rZM~PG4U@@aeQd%k+=!L|h&=GXz-6GC}dyXhKH= z2RD-ik+|;JvqhU9@s`~U>t4gmwFDg}4-1F*+3qmBukUG|ofzK+)Lv&ArD)0Pt3LZd z-u1WIs95{?74S@)R;*r~3HkcRiWX(dl$3`&lRqTHrj?s_W*^34BcsF5WXY98Q$y+qe39R*cE(Z(E%W;ALmX4_goK$fL!PTdlU!K_L zGZ#S${GQ0RvabpPh7{k+h|59y-9z+iMMVWtafpeDDIuauU^oMX>B{wQ?}V2ATkEct z1-3xFh3IQt>T@|OYirQg8@QaLu3rBN++g$_kzWV_bX-8s-S9SA)$!xUm-D{1T24vr z2w=Sg{!3!L9JEK2I^=1iqodoX)C;`zI_trjLECF>-h2{kEhacNi=@1UIHQz$az!l| z8)%lcvZ~uaCu?84c=5SCkAqGC7kmLkoDB}^lYD!N{7&jB&RM& zLL_Grvo2fFWDTItH85H@m+%ZR2)7Vtv%1**&5dUws}CJmvmB zGtS1^z4OMP90a2@w6(J{cXmF)lV1!SAerA&p@-{k0=K79n$nUDi8{9rS~df41@yU! zPg8_JTD8h3G71pC{{UNtA{1TRzuwRQ1S%=35%6pHJ^Yjj1%R3w-0SN*GK-4VKt?7H z+!zW;Nl8h@(I3T-s)4h!D)aJ1NHvB;hl3ET%cg*faQRJkm08o#)4X;fbmidWztg>;!#64Q4Gor0j7EW=${<=D*66b5 zujA|8puV!ZCvyl$p>fKDE~*bq0LeZf$BO##)&K#p0HJ_%O}wcQ9Y9h)n8zMKySw-s zXZgX*^dPPxyvOhfvCXxg%sc?h3$;R^(_K(P3*UU9 zmo=l*kS={AxsHB14URAhG(H6XjehrIFNH9@s`H1Z0V^NwC<~Q+g!6yY>m|$gN=Rl^ zC)eE2fUMg+rTS^MrFP;Z-c2n#cY!_uVPeiZze#uwRB7j-`Ucr7 z1d%86&I~B~qfip>kaqztb`AD8{~L0y=zSrD@@I~B`d2Tngq+?T{yoYEXi*LkuBUpH z0H|_0bQSw`DM}TKRR+*p$t3cnann&fH_kwO9H+mvI*@?5h2v`?1mF>%Lx?i#e=%R@ zUH7lahQrdIgA+lKduYc@^~aB7Sa?aW0Ti5oJ6nWrkqTQAxuWOM%e$d(bO`56eWtQ} zAwti*<#NWldf&6c`I?qc=!pDa3fZy)Qd5EY%4(=&UH>3%Ritcc}65Wn3V;U zGj2e~MHl15QJ{w7^`fl(h_e)2ahe3|wfW)bzFeGAc0@N6uhW(&X@lDYn22!P7*?JX zS_5i1OF&7$Q0K$m87KWL`6GbnHRhxCfFD-V(Sg!n$ez3nUTd_q?Wd&9l;h%{m%vmJ zYTjW<6sS6P{@L>DPstVMK}`bn6c@P7#^Y}sX9^jr!V9FNkWys-P#L=!m_#Y3d=bA4 zshnkXunU{T&JRo5MO)*iN!DDV5)vM-K@C$91wg?Pk52;}n%U9eURqOj-w@Jegh-NE zX+Y}we*8ELCNYG$IG^^iz#NJ$PzKfFm-!=I+`%_M==-;pa)8z>^u1K?EVY%s@=l- zy!B2{l-)a99)1PoVKEd^t^nOjr_({?$m#Ja;%i|Y6XALlsj?* z>f2SmNb!5t=79F8f=nm{tq1iagrj;_Mx5oXzuzcQ%oKKJ3r$X3;Sc6QhcC~WWrCv& zXf3jCE0cQ)RgQir2!ajTv5P`MK6d%PFUPe+eHQt}6WlYhv(uo|$me#iWoEQhPkvbq zRiQcH$&UT0Oko%H9MdEgMfO%NSiHCiiXkN&7kd{M8Aw*3GGGEM3_qo)KC5{Der=#X z{~{HX6C8=gD>te$AQ(BYi$kGmp1&nd8(e8RqDB}}dyzL1z;k#dz?_lSAL=Aj`lBCJ~vZaRd#_rNgaC%{d^a1(O*c4V(IEKPIWeu+|! z%s41R;Cpis01Q##f4*n&tq)o>%MwlZf?K7)8x|0Q+B8i-h>9Z>i#>Z#rjwtJ+1lD3 z!9G!kDkObY&CdG<*>PCB)+SAnpzcWopr+1YmyVP=wr>GG+}yaX!FnYg^j|U!I@Z5A*1U%+~3V zCPXPnD)TY4C4fAUv>D!~AU7VA@vb0?g9P~_1vT!1n$8ix_3$2(n1nwesZB`Vk~c;^CATva2ZRgf1zp?(eu{DL2oO*VOmYB7 zBSIoS4h$fnf{?E}XTO9r-rHMl?%cV3-@h+{@KL~<7Y!45Ic+v z^)Lto6Ar$AW@U!Y=x^d~2*j3yWE7t4A3^l?BOoM{bpL#lP?Yxy3?WM>=}9Omx&{Tw zdU(5f2D|!)$OaI|a0%}F2YPrDy$K$F+9=8^${&_jKCGaGRZx&n(pFN24@E^;byWqs zKkZ#T2?2ixRFRd30S=kEx_bwZ14Fzd|Fj^GT|NJdW~Fl2&%!mz$V#6`a8_3jwp5Pr z{?jIm5FFwi81Sc=0*o&UkNX`DIWmaw=duSO%-fy7xT=JLH~JeoJkk4au+G{41$dfjkSY4t(D}p^=!R^ z)U|CKrYmJoGw(?iivqLLdoBFF*ll?<2 z{d}S{4I;xL&BN8)(F%r&3f=@&csYzVH1I;Yo0Ig+@#@xYm`Gbo z6;m~mpLZnL*4@I=+EvXe#N5m`(AL<@!_3GsBE%yyGAcA&UeVCaP}fffP1ZH`@bDwr zhD2D}kpm6o6;)Mze6)RWD3Yg@kB^c!$`GxJM4>$4F##cp{%-QFkw)lnTQgk~MI&8P z9Tk10zyNPEcN7YiN#By}ZyI8$7_3L|v~!E_G_ke}4lu`u==l2t+o5oZCgwN=4ABVf zui&QcjmD~akyP<08^&v>n44=yl98cgJ8fdPxxR9gqDi2sKN3SAn}o{~-Th!}D@b7- zBK+@V8i5Z|Ggr5W#Ca+Q!5y+WQr{-X&)36BG1AnE5r%G*B_;-qhuCJ z3XxYc5B0Jokc_ z1Ak8sy+8wFWt6*~nwd6M)r1rorlJ;Lr9cdJSMxSgQB?OfRkKvnLmDd)4PlJ%D3S^z zavWp#D8Z=u|LmCG+Xw#siwR1ok~bZf5C~C(k)Ad-qG*2D7mHoyXI?BnJ}PN*Kx35p zB0Edh32l>qHgUl2g57l&%5g8&D_%rGS=zPh21n3VO3m93Nq4b_7)maAO;F`;?+;dI z-ItZmu3&nclXqOPbM=E;&Mi0Mw-@mX$2tScS4HKOIzK$%kW*?FHp&rSe6q*<=x6aE zqfMNg>J+N6p7{PeDbDP4JY7#u(T%p7vpxBL@S=FafS-O?m}=Pk;F*MkEia0-M7p}V zc-4c&*_k(Q+Pt~zwx>CH=JnS3p_-(c8nsiWPJNi4&-gY!bOoI+J3VmwAhdCn=amm0 zH+=HsiKwjX&TZSa_22d72@Vdnu(y|9yOvYvO3Uev{k8tx(8%cV+qw`=LBVvVhN#Cw zLjofsBfQ6=l+*S1@0E2(-XWms^8M5B)An}lxHwI-iyCKMzs6v(*hW9q&9zRg+}zxU z4j*ozS(RlK7iSg~34VOnAdr%hg0FI6f)VsHg)^$E+^rb`NfeiQbaZvIb8=46=~7+QAA^@?ael-1x%chcmnFW9`5+-`|sGz2%raXVf(`V0i3#DLBQH>AZa&2a2=T~O^{ytu7 z_ntkdHWCdMm|YOL>og08J_eIBjl3EpgIlwDo-b!G)p3ziNGKycoxO{cpb_=;P-$uD ztGW=+n+|mtvLNPAp49N0p}>*sdv4gE+APmW+f;m@<~!-shs{^TtOj?H z3|;Z`HzvWsiitagQf-_fQFqNX>Wm2l31a7^jLVlr{RVEKU_915DJBHl_U#HDPj~6* z>wl@t^21tLolZ_>-LiFS-A|R;t4C#UO^_=i3k#WFzmmHwvGX4upPufy!86%eET_S? z?FlB-z0B<5sp4XhVsiFCD!23pXetu_(~``!`vi6N+V0)EUqSA2@$jTkN{!B(Ia51V zQC~$G)9 zYeYmwrckuanlL?8u(o4U#qoQEP6w1;y}D)ie&`;d(?ut!bjv*l&7OQ7YeThN*2=zk zF=KHts7t|+D1+M(wcKMT8s+r`Ah^x8yOs<60_c?`zhDLm8KUmT?H?Qdx5)dH!?D_MFWZI#S$rq1v zB+wAf5s2Dv@Q!zXOEuAN&0x^rX?S5=J_%t|iN3u&ey6>3h?*0=V^7W~8OvepuYS zvHk<{P1I<&Q|vMhYh$B!B)(gK|5{m@Ze`yU$NDe^tnu^n1LmgXJ4J2#wb~hfxo<8z zJA2>w50|v&B#yC>B$0n!H2PB=3kroQb^j@GwmkvTY3y#FQ}dUJ=S&XqN==Q8$Nl=N z9^28KV?J*cH)DPl{V#bM3xnx-yaP3}NgPM4mWxYSY)bJ`M(cy1MRT<`7O_ zS&2B8pFj5K*SZ{Z1c=Sb&E4AIlqrGE!&jnn#BbWy?BtPi;`%AH>U+?v==j3B21pOa zB;M3b+DVT{dILn$>>~eRy6ei~_wNR=vB$oA`NG)Rzt$Jxdojmi*OV2Nl$a1Ul};_= z?PobfL^8X}%yo0bV>VW&u2)vJtu9TGzJ0Vs^!+N3k(S<$a8c%02z+;RZdn)^gotVo z1{PsuXUF#J(aM)~Je8T53HibT`LcEE))dMsv7wqkgPC?Jo;qch5&8iSAKyzjefpBwFgiTI=#4{#8O>d{c3I*NgCZ^R;=lN7vkDzJ4lIuE4zn=j{mtZ1sLs$wt;IpVe=%!g!U@8!+H#$KE(3~X|%7FAQ@$q{#L zN##by{X~*Agp7@i5eV4Hd~3^dNv*B=bB{e__HOSjw`YMB+|DC=`QE*~XAhd|!~FR8 z_+V}5F($YMJYDKqp64&E)$u*PG;18L#Q9MizAjh-arydnR*j20Z7LidKR(S;xIVZ6 z`9qfC6LR8|XW>^5JwXc_wE$g%13l{hqmSaUg!# zjYh}&`Q4OqD)UK$IdQm8ZeP>1$Ki0jow>QWBR~`Kg)d)rbbq~dL*S9w4vw^+7aF3! zkFHJ?GeCl|u~BJzRif_|-WkhKd)EjYCZWMRaFR-QW7#R#SmoLb`}iQQq6h2i?(Vw38r1=E|{@#%l6Kh&4Fnyf}Txn9EYy_yX2aTKPy=i-Trn`)RLyG(v zhK7c_{@|1P?E&_{z(9ao{Y#fFy`)T{W&z(%fKUONXTYj9kmY-06sQ9Jpy^lp^iU|^ z0LAml-n%J+>SBPj0Q#Kf$CkM?*S}f;8ZsRT``FlD?GE9vRAW_2tEzTwY-|9`ZT=c{ z%pwhLE@+L(sUPcZ!V|uOw&fy*U)$7l$KXAGX$WZ>8aE~-EzQZxdq{(M z_%cB3^@<9BqoM@rEVGZV@5szd3Zz&vWwaNvnZ+n4Xns%ys5%8Gx%A;fVU3HFHYaZJ z{rfiq)&V~_0LK%VcM2wh{7I&aSeqQ!!@PqZ0ZFKg)XGhCnc65)a zgoMOM$B_j+ZS9lOhYHStf~;_?cLO{ty^@tyjUDbExb4ZgYu5?F^Sl&FsU)adl#7cf z#BvbSMk7YzNlS}%W#3ri$<3u#t`Fur$E64#i*o5IMM3}LGPq5MqN9k1!n+e z_e)6pl}E#Gjx0Pl4U$XfHu0qn3Uy{0nToNtPQ0MxIZ8S5sgaJmq1U$Wj4SPRu^k}) z{qO}!``Lr_>jJN18T%_eU9Ydgu{vtm2Q*m;XfiP%BTeC$MeVN(??rt3D$caHaSF9d zKwei9U-EyQAL8LS_H|dz*|R7Eu`}+p98=Kmy95NbLynjfAvq76H451}^y<|KfM@rn zgl!DbaLv4!^7gGmSGA!8L(+0+{oGYjQsM=YrZt`K^kMsZ*T1!wr>3%rA3V4piR2X) z7UtE8J9^K5=)fO6>rovtWu~X6ciFsHbGo~XgZSe7NsuS3Q=PDH=dT%~(bfJ#swTyn zLf_v-%Q3U_o_PAy@G6y>LeZCM!$=GWX~hYC{`@&&@`C4wxw*7z_ck$QWv=aeWsdv! zNSPHOM_wNVP?x`8!YB|xWi#pyS;zY>5I+7kaR=~nUIjc z$j!yCUlSg?G$wQI-^I;+W_sF-Q5O}e1?m%t2ZBRFEFB!ub8>c{%grqT!P2;VWilVW zf=+8`X?gncB??-p2EI#=T$*%!c1|)mHMI#wk|&Moff5lF6-B@_C8wpGZuih3k*Yr| zuzK^Ma}yZk1x#G+*(odzxtenD(ut%b7Q31N&?2wyhx&q?YM!r!%8uyc zuo|8;&yf(ILG zbEkIiQGtmc`9lgxfZlG4A09InT-@kXem;+WIxneviCsif5Y`&X7x=9Gwef=l3dePQ zZCTdL{EZ;Is5+y(xN@b7j*~ViRNY}~Yg-$$st6kDG*HbIkl*o98z3MS7z00e@W29x zJM-d&38+x+9Pxbz4lu(jg>)U>x5kamb(pQOpGn*yP!RhN*rw)Plr&kxF-^9!t&JuA z$I$zr**7$zh`EW$_%~ynDr~z%z`fjeCT3=4Y1{7_!7$my#qr&pq-Y5n$oTG`J=U{6 zZ=Kq?@pSR}^z`(-{?yW-XbDd@T8>P>TVoc0ml$b($$(06wLB?xy%~FNG<2~9y^?ivgWfk=c}B{*6FA%m-FDSxA0+prtm z^D;;}bVoqtr!+v&f_txje5%j1ry<@t4R1%|n&awoi9}*5WxThx;XddaW|A~cGoW&? z1=Ev!tsI*p9zd09n#V;0eYcfkkJL8!fHpo;o9iP`V-pHWg|!Cry?GuNi>I@NL)jTX zeKL#_phZ?zR%7`&!5sMK_k~k$ zYjgQC^aH5k+XE^`tFeyh_L6mMH8u)(x-2x*8~rwGCxbgUYHe)XJm0g5rz--(;cu6p zu$PqNtg)GLr9B&OEk7rKplz$MiLAy7L8m(jLpP4%>0w@L?H%w}>d=jKJpJ(3q4IND zE$u=<(RYQ=%W^@|689-XzRzn-X$3EdP$akmBmy%x{#;#R6ua5`4Vql!Mdjsp9gF^^ z2Ws%u!`Nsj;l@7IFC@a&3#gx0Wmq4KyFdlthv-uTQ()163ZOn`f}&T)%xou+7wSD$ ztZ+b4q-How;ONn#LEneNo59@xtelE@d;BbQZT(KuMOI#>eqi_xITRU!GkQTtEHg~dIyyQo^1M~xbpWnHeGnJqeQ9*m?c>|JJs|260Rn4DW3Omd2LTs<>rFE= z3VJCkdMu_kPYQjvx*CX~ea*N11k+}D-(H!RpP$f>Muwe6qm^FCZVl3e(v24I?g1Y}sy)|R&dJZ83RVpkhfARl@^9Ewy1_-(ZQD+Y z8}S|qlhIuHuo-x!1u63E@(RXZgEz&jtoe4QW*Q(CUtGk&nc_tTi8AVxt5?N=7*E1@7dcvTXMu>j!0pg8FxbC; zzb;v@gd%(_6|^|{(_22M#<+x%xK1p6mZo+jxfw6d*Sv2nuX&dWf?;g7=LRtNvs`JL z#n))L5=I^NFs2Tu9x*kRDe147kni(vGlYX)|9_Yv!Au-sF>I$ZEbDY_>6sZ%u~&ArBk|wG!P{`p!p2V&BJGweO`jP?z&+k2NdN@ z=E~um(iJY9Y^GA9X5UDztgcGVY7-9QtKGK#TwnhTHB2f+XXl3)WYUePW&*V!E9(Rh zM`>+s|4iQm1soYtpJTY|SZfBT8X=@e$HcSMAR`)VU)~J;GA9;CHNrElKUz}tLrg72 zda`+jI#?6v9J4l4W>z1w)&K?oJFon4GP@5`N79^nv}Tbtop_s1NP~PlAfV!7zG?j7 zBS!?FE`X}0^vWw!$b{g@7$g<@lBo2cp~2GH`oP>oj=!u!EyCQ~{GqskE3DCno2yw3 zSRg-!d>op{9^15OlZCAu4ajB++Su5z$jQldDX7P_fSLuh;v5nU$7R4FWaZ%C5o$h6 z(mZEgv6@B2Izz=R<9Pqgi2QgAI#1>?6lHqg4i#}MXSr(%%J#(m_~yE@II{DMXkXOV zE`!fKHqI&FDN=`B<6Z?!;)(_jq=xYc{#Oz!Vrzt z4GIEprQpe`g;w-ba|OoK+}wanzVp&X|Jl;pkj|0Ck>*l&FSaS&BOfnt)HBLQQ3;8b zYfD**{sXtRa&mJ1_iiEj?jINCu8M%&y?==bKj{lmCfs zt#LEQhx&zwA>xJ4xp{c(7eq}#J}dYSDucg}>*=2i0xT(o|>K{kpItU_V5C|MX{qks>ED zsDof~;xw~jKaZk*{&@c@(X8zD#<`2?AqQsX<_d?s!K+|IfoKE|SRwL@2iPB1=yW!) zR%T{qs_-%qqbUa$flEq3k>!Ywd>puqII*@C^>a+*m&L@7TIc)ZZQxaxx?ks?I=#fy zkEa8^QO0+d-oMYEFXw!3qyE7IL7)j(5cqugNm*z>w3k-!Fbqu-7TqOUmNyjq|z zNO_NS?;>by79U8MmPx^Gr~-4OTrxk1vjtDydRRPY{K6EMscA0PjwuTSkqEzl$Y zJ-h;(7J$EfvxWra8@?e*1;MaFfKS_^7aEeFG>4UhLj#7-4pIT?)WiY5R!|E;FeCZz z%?wCZp@NLqYahGQ0ZkxMY3rNEq1FW}=HbSgFRU*>f=Ye2$pyu&fe%*?fMABIp?qp{ z+aN`v(R5N#qXKd5PhsHEh!sD_6FzTY0MP8JgL>j}^ITB>#Li~07R zRK(H2;^IzgZEdB03XL#@sy7jI$OyopzQ6yxNSq^NC1WmQolBr@-Rt-bTu>L)Lc;So zA8;yLmO8cMes8{wm0QE!ntoC}V5Ydfdk{&19UcXS%3`m5U<#$gr-)w@netuj+x;;pdLBjKx{+OdZa0uW*APf{{ za2?khGuHi;s2zGJ@RaVc@$($E#@vXe z=4OzFV~Z16OCG;{no~i4NUR*oblJWp;E<$bHiHAfpw!M3J_ao2Tf{Mu69OEGLo9yz zqT}dz(J$YCa)U}y z|MqaEnTt3GLA?x;KRLHhalLyc!p{h7GR0SSeQmlFraAspoDzB)_hX*XKuSsqJf(BDZYjPfQr{E)mc(LRZYQC!b6ex; zio0JunJ}i!|Hdq&O z5Dtc3m6?mcerHi4zGyTMiA`Xz7A4FIxVrzIzW~F60?g*w%*+l)KjN=nzt%I@zhg8e z`N|-sp$ps;#`%EfrAX$74<9n>2ylU_T^?_`dhOcilaxKOFRd&r5Mcal-M&{8tfR+| zA5XugZa-jh{siEysGM9UHIh<^>4V=Bg))8%@U(%X=>SF4nmwGI0JnmNqYDSaupM@Q zR%M(P^D1nDl8wPmU}YqkYp!m&aNz>O5h9Tkz+JZh1FxWfAJLb|<^*5CLIUNmAGilv zt&E>FXE?PF0KotMj!{=7h;wQ?rr`omD@a$t=x-mjF__(up9$XG*G6W_iuIu&TKhJ? zT}w-gJlDH}p}=8Fb8>MdfCX0yx(ZaV0LaQ$Am5=B9b -- bash - -In order to replicate the container startup scripts execute this command: - -For Redis: - - /opt/bitnami/scripts/redis/entrypoint.sh /opt/bitnami/scripts/redis/run.sh - -{{- if .Values.sentinel.enabled }} - -For Redis Sentinel: - - /opt/bitnami/scripts/redis-sentinel/entrypoint.sh /opt/bitnami/scripts/redis-sentinel/run.sh - -{{- end }} -{{- else }} - -{{- if contains .Values.master.service.type "LoadBalancer" }} -{{- if not .Values.auth.enabled }} -{{ if and (not .Values.networkPolicy.enabled) (.Values.networkPolicy.allowExternal) }} - -------------------------------------------------------------------------------- - WARNING - - By specifying "master.service.type=LoadBalancer" and "auth.enabled=false" you have - most likely exposed the Redis® service externally without any authentication - mechanism. - - For security reasons, we strongly suggest that you switch to "ClusterIP" or - "NodePort". As alternative, you can also switch to "auth.enabled=true" - providing a valid password on "password" parameter. - -------------------------------------------------------------------------------- -{{- end }} -{{- end }} -{{- end }} - -{{- if eq .Values.architecture "replication" }} -{{- if .Values.sentinel.enabled }} - -Redis® can be accessed via port {{ .Values.sentinel.service.ports.redis }} on the following DNS name from within your cluster: - - {{ template "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} for read only operations - -For read/write operations, first access the Redis® Sentinel cluster, which is available in port {{ .Values.sentinel.service.ports.sentinel }} using the same domain name above. - -{{- else }} - -Redis® can be accessed on the following DNS names from within your cluster: - - {{ printf "%s-master.%s.svc.%s" (include "common.names.fullname" .) .Release.Namespace .Values.clusterDomain }} for read/write operations (port {{ .Values.master.service.ports.redis }}) - {{ printf "%s-replicas.%s.svc.%s" (include "common.names.fullname" .) .Release.Namespace .Values.clusterDomain }} for read-only operations (port {{ .Values.replica.service.ports.redis }}) - -{{- end }} -{{- else }} - -Redis® can be accessed via port {{ .Values.master.service.ports.redis }} on the following DNS name from within your cluster: - - {{ template "common.names.fullname" . }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} - -{{- end }} - -{{ if .Values.auth.enabled }} - -To get your password run: - - export REDIS_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "redis.secretName" . }} -o jsonpath="{.data.redis-password}" | base64 -d) - -{{- end }} - -To connect to your Redis® server: - -1. Run a Redis® pod that you can use as a client: - - kubectl run --namespace {{ .Release.Namespace }} redis-client --restart='Never' {{ if .Values.auth.enabled }} --env REDIS_PASSWORD=$REDIS_PASSWORD {{ end }} --image {{ template "redis.image" . }} --command -- sleep infinity - -{{- if .Values.tls.enabled }} - - Copy your TLS certificates to the pod: - - kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.cert redis-client:/tmp/client.cert - kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.key redis-client:/tmp/client.key - kubectl cp --namespace {{ .Release.Namespace }} /path/to/CA.cert redis-client:/tmp/CA.cert - -{{- end }} - - Use the following command to attach to the pod: - - kubectl exec --tty -i redis-client \ - {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "common.names.fullname" . }}-client=true" \{{- end }} - --namespace {{ .Release.Namespace }} -- bash - -2. Connect using the Redis® CLI: - -{{- if eq .Values.architecture "replication" }} - {{- if .Values.sentinel.enabled }} - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h {{ template "common.names.fullname" . }} -p {{ .Values.sentinel.service.ports.redis }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Read only operations - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h {{ template "common.names.fullname" . }} -p {{ .Values.sentinel.service.ports.sentinel }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Sentinel access - {{- else }} - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h {{ printf "%s-master" (include "common.names.fullname" .) }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h {{ printf "%s-replicas" (include "common.names.fullname" .) }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - {{- end }} -{{- else }} - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h {{ template "common.names.fullname" . }}-master{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} -{{- end }} - -{{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} - -Note: Since NetworkPolicy is enabled, only pods with label {{ template "common.names.fullname" . }}-client=true" will be able to connect to redis. - -{{- else }} - -To connect to your database from outside the cluster execute the following commands: - -{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled }} -{{- if contains "NodePort" .Values.sentinel.service.type }} - - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "common.names.fullname" . }}) - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - -{{- else if contains "LoadBalancer" .Values.sentinel.service.type }} - - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "common.names.fullname" . }}' - - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h $SERVICE_IP -p {{ .Values.sentinel.service.ports.redis }} {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - -{{- else if contains "ClusterIP" .Values.sentinel.service.type }} - - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "common.names.fullname" . }} {{ .Values.sentinel.service.ports.redis }}:{{ .Values.sentinel.service.ports.redis }} & - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h 127.0.0.1 -p {{ .Values.sentinel.service.ports.redis }} {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - -{{- end }} -{{- else }} -{{- if contains "NodePort" .Values.master.service.type }} - - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ printf "%s-master" (include "common.names.fullname" .) }}) - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - -{{- else if contains "LoadBalancer" .Values.master.service.type }} - - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "common.names.fullname" . }}' - - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ printf "%s-master" (include "common.names.fullname" .) }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h $SERVICE_IP -p {{ .Values.master.service.ports.redis }} {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - -{{- else if contains "ClusterIP" .Values.master.service.type }} - - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ printf "%s-master" (include "common.names.fullname" .) }} {{ .Values.master.service.ports.redis }}:{{ .Values.master.service.ports.redis }} & - {{ if .Values.auth.enabled }}REDISCLI_AUTH="$REDIS_PASSWORD" {{ end }}redis-cli -h 127.0.0.1 -p {{ .Values.master.service.ports.redis }} {{- if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - -{{- end }} -{{- end }} - -{{- end }} -{{- end }} -{{- include "redis.checkRollingTags" . }} -{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }} -{{- include "common.warnings.rollingTag" .Values.sysctl.image }} -{{- include "redis.validateValues" . }} - -{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled (eq .Values.sentinel.service.type "NodePort") (not .Release.IsUpgrade ) }} -{{- if $.Values.sentinel.service.nodePorts.sentinel }} -No need to upgrade, ports and nodeports have been set from values -{{- else }} -#!#!#!#!#!#!#!# IMPORTANT #!#!#!#!#!#!#!# -YOU NEED TO PERFORM AN UPGRADE FOR THE SERVICES AND WORKLOAD TO BE CREATED -{{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/_helpers.tpl b/rds/base/charts/redis/templates/_helpers.tpl deleted file mode 100644 index f6f47d9..0000000 --- a/rds/base/charts/redis/templates/_helpers.tpl +++ /dev/null @@ -1,291 +0,0 @@ -{{/* vim: set filetype=mustache: */}} - -{{/* -Return the proper Redis image name -*/}} -{{- define "redis.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper Redis Sentinel image name -*/}} -{{- define "redis.sentinel.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.sentinel.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper image name (for the metrics image) -*/}} -{{- define "redis.metrics.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper image name (for the init container volume-permissions image) -*/}} -{{- define "redis.volumePermissions.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return sysctl image -*/}} -{{- define "redis.sysctl.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.sysctl.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "redis.imagePullSecrets" -}} -{{- include "common.images.pullSecrets" (dict "images" (list .Values.image .Values.sentinel.image .Values.metrics.image .Values.volumePermissions.image .Values.sysctl.image) "global" .Values.global) -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "networkPolicy.apiVersion" -}} -{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiGroup for PodSecurityPolicy. -*/}} -{{- define "podSecurityPolicy.apiGroup" -}} -{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "policy" -}} -{{- else -}} -{{- print "extensions" -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a TLS secret object should be created -*/}} -{{- define "redis.createTlsSecret" -}} -{{- if and .Values.tls.enabled .Values.tls.autoGenerated (and (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret)) }} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Return the secret containing Redis TLS certificates -*/}} -{{- define "redis.tlsSecretName" -}} -{{- $secretName := coalesce .Values.tls.existingSecret .Values.tls.certificatesSecret -}} -{{- if $secretName -}} - {{- printf "%s" (tpl $secretName $) -}} -{{- else -}} - {{- printf "%s-crt" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert file. -*/}} -{{- define "redis.tlsCert" -}} -{{- if (include "redis.createTlsSecret" . ) -}} - {{- printf "/opt/bitnami/redis/certs/%s" "tls.crt" -}} -{{- else -}} - {{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/redis/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert key file. -*/}} -{{- define "redis.tlsCertKey" -}} -{{- if (include "redis.createTlsSecret" . ) -}} - {{- printf "/opt/bitnami/redis/certs/%s" "tls.key" -}} -{{- else -}} - {{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/redis/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the CA cert file. -*/}} -{{- define "redis.tlsCACert" -}} -{{- if (include "redis.createTlsSecret" . ) -}} - {{- printf "/opt/bitnami/redis/certs/%s" "ca.crt" -}} -{{- else -}} - {{- required "Certificate CA filename is required when TLS in enabled" .Values.tls.certCAFilename | printf "/opt/bitnami/redis/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the DH params file. -*/}} -{{- define "redis.tlsDHParams" -}} -{{- if .Values.tls.dhParamsFilename -}} -{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.dhParamsFilename -}} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "redis.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Return the configuration configmap name -*/}} -{{- define "redis.configmapName" -}} -{{- if .Values.existingConfigmap -}} - {{- printf "%s" (tpl .Values.existingConfigmap $) -}} -{{- else -}} - {{- printf "%s-configuration" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a configmap object should be created -*/}} -{{- define "redis.createConfigmap" -}} -{{- if empty .Values.existingConfigmap }} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Get the password secret. -*/}} -{{- define "redis.secretName" -}} -{{- if .Values.auth.existingSecret -}} -{{- printf "%s" .Values.auth.existingSecret -}} -{{- else -}} -{{- printf "%s" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Get the password key to be retrieved from Redis® secret. -*/}} -{{- define "redis.secretPasswordKey" -}} -{{- if and .Values.auth.existingSecret .Values.auth.existingSecretPasswordKey -}} -{{- printf "%s" .Values.auth.existingSecretPasswordKey -}} -{{- else -}} -{{- printf "redis-password" -}} -{{- end -}} -{{- end -}} - - -{{/* -Returns the available value for certain key in an existing secret (if it exists), -otherwise it generates a random value. -*/}} -{{- define "getValueFromSecret" }} - {{- $len := (default 16 .Length) | int -}} - {{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}} - {{- if $obj }} - {{- index $obj .Key | b64dec -}} - {{- else -}} - {{- randAlphaNum $len -}} - {{- end -}} -{{- end }} - -{{/* -Return Redis® password -*/}} -{{- define "redis.password" -}} -{{- if not (empty .Values.global.redis.password) }} - {{- .Values.global.redis.password -}} -{{- else if not (empty .Values.auth.password) -}} - {{- .Values.auth.password -}} -{{- else -}} - {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "common.names.fullname" .) "Length" 10 "Key" "redis-password") -}} -{{- end -}} -{{- end -}} - -{{/* Check if there are rolling tags in the images */}} -{{- define "redis.checkRollingTags" -}} -{{- include "common.warnings.rollingTag" .Values.image }} -{{- include "common.warnings.rollingTag" .Values.sentinel.image }} -{{- include "common.warnings.rollingTag" .Values.metrics.image }} -{{- end -}} - -{{/* -Compile all warnings into a single message, and call fail. -*/}} -{{- define "redis.validateValues" -}} -{{- $messages := list -}} -{{- $messages := append $messages (include "redis.validateValues.topologySpreadConstraints" .) -}} -{{- $messages := append $messages (include "redis.validateValues.architecture" .) -}} -{{- $messages := append $messages (include "redis.validateValues.podSecurityPolicy.create" .) -}} -{{- $messages := append $messages (include "redis.validateValues.tls" .) -}} -{{- $messages := without $messages "" -}} -{{- $message := join "\n" $messages -}} - -{{- if $message -}} -{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} -{{- end -}} -{{- end -}} - -{{/* Validate values of Redis® - spreadConstrainsts K8s version */}} -{{- define "redis.validateValues.topologySpreadConstraints" -}} -{{- if and (semverCompare "<1.16-0" .Capabilities.KubeVersion.GitVersion) .Values.replica.topologySpreadConstraints -}} -redis: topologySpreadConstraints - Pod Topology Spread Constraints are only available on K8s >= 1.16 - Find more information at https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ -{{- end -}} -{{- end -}} - -{{/* Validate values of Redis® - must provide a valid architecture */}} -{{- define "redis.validateValues.architecture" -}} -{{- if and (ne .Values.architecture "standalone") (ne .Values.architecture "replication") -}} -redis: architecture - Invalid architecture selected. Valid values are "standalone" and - "replication". Please set a valid architecture (--set architecture="xxxx") -{{- end -}} -{{- if and .Values.sentinel.enabled (not (eq .Values.architecture "replication")) }} -redis: architecture - Using redis sentinel on standalone mode is not supported. - To deploy redis sentinel, please select the "replication" mode - (--set "architecture=replication,sentinel.enabled=true") -{{- end -}} -{{- end -}} - -{{/* Validate values of Redis® - PodSecurityPolicy create */}} -{{- define "redis.validateValues.podSecurityPolicy.create" -}} -{{- if and .Values.podSecurityPolicy.create (not .Values.podSecurityPolicy.enabled) }} -redis: podSecurityPolicy.create - In order to create PodSecurityPolicy, you also need to enable - podSecurityPolicy.enabled field -{{- end -}} -{{- end -}} - -{{/* Validate values of Redis® - TLS enabled */}} -{{- define "redis.validateValues.tls" -}} -{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated) (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) }} -redis: tls.enabled - In order to enable TLS, you also need to provide - an existing secret containing the TLS certificates or - enable auto-generated certificates. -{{- end -}} -{{- end -}} - -{{/* Define the suffix utilized for external-dns */}} -{{- define "redis.externalDNS.suffix" -}} -{{ printf "%s.%s" (include "common.names.fullname" .) .Values.useExternalDNS.suffix }} -{{- end -}} - -{{/* Compile all annotations utilized for external-dns */}} -{{- define "redis.externalDNS.annotations" -}} -{{- if .Values.useExternalDNS.enabled }} -{{ .Values.useExternalDNS.annotationKey }}hostname: {{ include "redis.externalDNS.suffix" . }} -{{- range $key, $val := .Values.useExternalDNS.additionalAnnotations }} -{{ $.Values.useExternalDNS.annotationKey }}{{ $key }}: {{ $val | quote }} -{{- end }} -{{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/configmap.yaml b/rds/base/charts/redis/templates/configmap.yaml deleted file mode 100644 index 274e75b..0000000 --- a/rds/base/charts/redis/templates/configmap.yaml +++ /dev/null @@ -1,59 +0,0 @@ -{{- if (include "redis.createConfigmap" .) }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ printf "%s-configuration" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - redis.conf: |- - # User-supplied common configuration: - {{- if .Values.commonConfiguration }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonConfiguration "context" $ ) | nindent 4 }} - {{- end }} - # End of common configuration - master.conf: |- - dir {{ .Values.master.persistence.path }} - # User-supplied master configuration: - {{- if .Values.master.configuration }} - {{- include "common.tplvalues.render" ( dict "value" .Values.master.configuration "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.master.disableCommands }} - {{- range .Values.master.disableCommands }} - rename-command {{ . }} "" - {{- end }} - {{- end }} - # End of master configuration - replica.conf: |- - dir {{ .Values.replica.persistence.path }} - # User-supplied replica configuration: - {{- if .Values.replica.configuration }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.configuration "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.replica.disableCommands }} - {{- range .Values.replica.disableCommands }} - rename-command {{ . }} "" - {{- end }} - {{- end }} - # End of replica configuration - {{- if .Values.sentinel.enabled }} - sentinel.conf: |- - dir "/tmp" - port {{ .Values.sentinel.containerPorts.sentinel }} - sentinel monitor {{ .Values.sentinel.masterSet }} {{ template "common.names.fullname" . }}-node-0.{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} {{ .Values.sentinel.service.ports.redis }} {{ .Values.sentinel.quorum }} - sentinel down-after-milliseconds {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.downAfterMilliseconds }} - sentinel failover-timeout {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.failoverTimeout }} - sentinel parallel-syncs {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.parallelSyncs }} - # User-supplied sentinel configuration: - {{- if .Values.sentinel.configuration }} - {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.configuration "context" $ ) | nindent 4 }} - {{- end }} - # End of sentinel configuration - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/extra-list.yaml b/rds/base/charts/redis/templates/extra-list.yaml deleted file mode 100644 index 9ac65f9..0000000 --- a/rds/base/charts/redis/templates/extra-list.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- range .Values.extraDeploy }} ---- -{{ include "common.tplvalues.render" (dict "value" . "context" $) }} -{{- end }} diff --git a/rds/base/charts/redis/templates/headless-svc.yaml b/rds/base/charts/redis/templates/headless-svc.yaml deleted file mode 100644 index e164fea..0000000 --- a/rds/base/charts/redis/templates/headless-svc.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-headless" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- include "redis.externalDNS.annotations" . | nindent 4 }} -spec: - type: ClusterIP - clusterIP: None - {{- if .Values.sentinel.enabled }} - publishNotReadyAddresses: true - {{- end }} - ports: - - name: tcp-redis - port: {{ if .Values.sentinel.enabled }}{{ .Values.sentinel.service.ports.redis }}{{ else }}{{ .Values.master.service.ports.redis }}{{ end }} - targetPort: redis - {{- if .Values.sentinel.enabled }} - - name: tcp-sentinel - port: {{ .Values.sentinel.service.ports.sentinel }} - targetPort: redis-sentinel - {{- end }} - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} diff --git a/rds/base/charts/redis/templates/health-configmap.yaml b/rds/base/charts/redis/templates/health-configmap.yaml deleted file mode 100644 index 47cb3fd..0000000 --- a/rds/base/charts/redis/templates/health-configmap.yaml +++ /dev/null @@ -1,192 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ printf "%s-health" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - ping_readiness_local.sh: |- - #!/bin/bash - - [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" - [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" - response=$( - timeout -s 3 $1 \ - redis-cli \ - -h localhost \ -{{- if .Values.tls.enabled }} - -p $REDIS_TLS_PORT \ - --tls \ - --cacert {{ template "redis.tlsCACert" . }} \ - {{- if .Values.tls.authClients }} - --cert {{ template "redis.tlsCert" . }} \ - --key {{ template "redis.tlsCertKey" . }} \ - {{- end }} -{{- else }} - -p $REDIS_PORT \ -{{- end }} - ping - ) - if [ "$?" -eq "124" ]; then - echo "Timed out" - exit 1 - fi - if [ "$response" != "PONG" ]; then - echo "$response" - exit 1 - fi - ping_liveness_local.sh: |- - #!/bin/bash - - [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" - [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" - response=$( - timeout -s 3 $1 \ - redis-cli \ - -h localhost \ -{{- if .Values.tls.enabled }} - -p $REDIS_TLS_PORT \ - --tls \ - --cacert {{ template "redis.tlsCACert" . }} \ - {{- if .Values.tls.authClients }} - --cert {{ template "redis.tlsCert" . }} \ - --key {{ template "redis.tlsCertKey" . }} \ - {{- end }} -{{- else }} - -p $REDIS_PORT \ -{{- end }} - ping - ) - if [ "$?" -eq "124" ]; then - echo "Timed out" - exit 1 - fi - responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') - if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then - echo "$response" - exit 1 - fi -{{- if .Values.sentinel.enabled }} - ping_sentinel.sh: |- - #!/bin/bash - -{{- if .Values.auth.sentinel }} - [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" - [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" -{{- end }} - response=$( - timeout -s 3 $1 \ - redis-cli \ - -h localhost \ -{{- if .Values.tls.enabled }} - -p $REDIS_SENTINEL_TLS_PORT_NUMBER \ - --tls \ - --cacert "$REDIS_SENTINEL_TLS_CA_FILE" \ - {{- if .Values.tls.authClients }} - --cert "$REDIS_SENTINEL_TLS_CERT_FILE" \ - --key "$REDIS_SENTINEL_TLS_KEY_FILE" \ - {{- end }} -{{- else }} - -p $REDIS_SENTINEL_PORT \ -{{- end }} - ping - ) - if [ "$?" -eq "124" ]; then - echo "Timed out" - exit 1 - fi - if [ "$response" != "PONG" ]; then - echo "$response" - exit 1 - fi - parse_sentinels.awk: |- - /ip/ {FOUND_IP=1} - /port/ {FOUND_PORT=1} - /runid/ {FOUND_RUNID=1} - !/ip|port|runid/ { - if (FOUND_IP==1) { - IP=$1; FOUND_IP=0; - } - else if (FOUND_PORT==1) { - PORT=$1; - FOUND_PORT=0; - } else if (FOUND_RUNID==1) { - printf "\nsentinel known-sentinel {{ .Values.sentinel.masterSet }} %s %s %s", IP, PORT, $0; FOUND_RUNID=0; - } - } -{{- end }} - ping_readiness_master.sh: |- - #!/bin/bash - - [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" - [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" - response=$( - timeout -s 3 $1 \ - redis-cli \ - -h $REDIS_MASTER_HOST \ - -p $REDIS_MASTER_PORT_NUMBER \ -{{- if .Values.tls.enabled }} - --tls \ - --cacert {{ template "redis.tlsCACert" . }} \ - {{- if .Values.tls.authClients }} - --cert {{ template "redis.tlsCert" . }} \ - --key {{ template "redis.tlsCertKey" . }} \ - {{- end }} -{{- end }} - ping - ) - if [ "$?" -eq "124" ]; then - echo "Timed out" - exit 1 - fi - if [ "$response" != "PONG" ]; then - echo "$response" - exit 1 - fi - ping_liveness_master.sh: |- - #!/bin/bash - - [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" - [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" - response=$( - timeout -s 3 $1 \ - redis-cli \ - -h $REDIS_MASTER_HOST \ - -p $REDIS_MASTER_PORT_NUMBER \ -{{- if .Values.tls.enabled }} - --tls \ - --cacert {{ template "redis.tlsCACert" . }} \ - {{- if .Values.tls.authClients }} - --cert {{ template "redis.tlsCert" . }} \ - --key {{ template "redis.tlsCertKey" . }} \ - {{- end }} -{{- end }} - ping - ) - if [ "$?" -eq "124" ]; then - echo "Timed out" - exit 1 - fi - responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') - if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then - echo "$response" - exit 1 - fi - ping_readiness_local_and_master.sh: |- - script_dir="$(dirname "$0")" - exit_status=0 - "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? - "$script_dir/ping_readiness_master.sh" $1 || exit_status=$? - exit $exit_status - ping_liveness_local_and_master.sh: |- - script_dir="$(dirname "$0")" - exit_status=0 - "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? - "$script_dir/ping_liveness_master.sh" $1 || exit_status=$? - exit $exit_status diff --git a/rds/base/charts/redis/templates/master/application.yaml b/rds/base/charts/redis/templates/master/application.yaml deleted file mode 100644 index 3643b43..0000000 --- a/rds/base/charts/redis/templates/master/application.yaml +++ /dev/null @@ -1,473 +0,0 @@ -{{- if or (not (eq .Values.architecture "replication")) (not .Values.sentinel.enabled) }} -apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} -kind: {{ .Values.master.kind }} -metadata: - name: {{ printf "%s-master" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: master - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - replicas: {{ .Values.master.count }} - selector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} - app.kubernetes.io/component: master - {{- if (eq .Values.master.kind "StatefulSet") }} - serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }} - {{- end }} - {{- if .Values.master.updateStrategy }} - {{- if (eq .Values.master.kind "Deployment") }} - strategy: {{- toYaml .Values.master.updateStrategy | nindent 4 }} - {{- else }} - updateStrategy: {{- toYaml .Values.master.updateStrategy | nindent 4 }} - {{- end }} - {{- end }} - template: - metadata: - labels: {{- include "common.labels.standard" . | nindent 8 }} - app.kubernetes.io/component: master - {{- if .Values.master.podLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.master.podLabels "context" $ ) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podLabels "context" $ ) | nindent 8 }} - {{- end }} - annotations: - {{- if (include "redis.createConfigmap" .) }} - checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - {{- end }} - checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} - checksum/scripts: {{ include (print $.Template.BasePath "/scripts-configmap.yaml") . | sha256sum }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- if .Values.master.podAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.master.podAnnotations "context" $ ) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podAnnotations "context" $ ) | nindent 8 }} - {{- end }} - spec: - {{- include "redis.imagePullSecrets" . | nindent 6 }} - {{- if .Values.master.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.master.podSecurityContext.enabled }} - securityContext: {{- omit .Values.master.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - serviceAccountName: {{ template "redis.serviceAccountName" . }} - {{- if .Values.master.priorityClassName }} - priorityClassName: {{ .Values.master.priorityClassName | quote }} - {{- end }} - {{- if .Values.master.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.master.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAffinityPreset "component" "master" "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAntiAffinityPreset "component" "master" "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.master.nodeAffinityPreset.type "key" .Values.master.nodeAffinityPreset.key "values" .Values.master.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.master.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.master.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.master.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.master.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.master.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.master.topologySpreadConstraints "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.master.shareProcessNamespace }} - shareProcessNamespace: {{ .Values.master.shareProcessNamespace }} - {{- end }} - {{- if .Values.master.schedulerName }} - schedulerName: {{ .Values.master.schedulerName | quote }} - {{- end }} - {{- if .Values.master.dnsPolicy }} - dnsPolicy: {{ .Values.master.dnsPolicy }} - {{- end }} - {{- if .Values.master.dnsConfig }} - dnsConfig: {{- include "common.tplvalues.render" (dict "value" .Values.master.dnsConfig "context" $) | nindent 8 }} - {{- end }} - terminationGracePeriodSeconds: {{ .Values.master.terminationGracePeriodSeconds }} - containers: - - name: redis - image: {{ template "redis.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - {{- if .Values.master.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.master.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.master.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.master.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.master.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.master.command "context" $) | nindent 12 }} - {{- else }} - command: - - /bin/bash - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.master.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.master.args "context" $) | nindent 12 }} - {{- else }} - args: - - -c - - /opt/bitnami/scripts/start-scripts/start-master.sh - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - - name: REDIS_REPLICATION_MODE - value: master - - name: ALLOW_EMPTY_PASSWORD - value: {{ ternary "no" "yes" .Values.auth.enabled | quote }} - {{- if .Values.auth.enabled }} - {{- if .Values.auth.usePasswordFiles }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- end }} - - name: REDIS_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_PORT - value: {{ .Values.master.containerPorts.redis | quote }} - - name: REDIS_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_TLS_DH_PARAMS_FILE - value: {{ template "redis.tlsDHParams" . }} - {{- end }} - {{- else }} - - name: REDIS_PORT - value: {{ .Values.master.containerPorts.redis | quote }} - {{- end }} - {{- if .Values.master.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.master.extraEnvVarsCM .Values.master.extraEnvVarsSecret }} - envFrom: - {{- if .Values.master.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.master.extraEnvVarsCM }} - {{- end }} - {{- if .Values.master.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.master.extraEnvVarsSecret }} - {{- end }} - {{- end }} - ports: - - name: redis - containerPort: {{ .Values.master.containerPorts.redis }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.master.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.master.startupProbe "enabled") "context" $) | nindent 12 }} - tcpSocket: - port: redis - {{- else if .Values.master.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customStartupProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.master.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.master.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.master.livenessProbe.periodSeconds }} - # One second longer than command timeout should prevent generation of zombie processes. - timeoutSeconds: {{ add1 .Values.master.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.master.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.master.livenessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_liveness_local.sh {{ .Values.master.livenessProbe.timeoutSeconds }} - {{- else if .Values.master.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.master.readinessProbe.enabled }} - readinessProbe: - initialDelaySeconds: {{ .Values.master.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.master.readinessProbe.periodSeconds }} - timeoutSeconds: {{ add1 .Values.master.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.master.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.master.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_readiness_local.sh {{ .Values.master.readinessProbe.timeoutSeconds }} - {{- else if .Values.master.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.master.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.master.resources }} - resources: {{- toYaml .Values.master.resources | nindent 12 }} - {{- end }} - volumeMounts: - - name: start-scripts - mountPath: /opt/bitnami/scripts/start-scripts - - name: health - mountPath: /health - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: {{ .Values.master.persistence.path }} - subPath: {{ .Values.master.persistence.subPath }} - - name: config - mountPath: /opt/bitnami/redis/mounted-etc - - name: redis-tmp-conf - mountPath: /opt/bitnami/redis/etc/ - - name: tmp - mountPath: /tmp - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.master.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.master.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ include "redis.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.metrics.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else }} - command: - - /bin/bash - - -c - - | - if [[ -f '/secrets/redis-password' ]]; then - export REDIS_PASSWORD=$(cat /secrets/redis-password) - fi - redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- end }} - env: - - name: REDIS_ALIAS - value: {{ template "common.names.fullname" . }} - {{- if .Values.auth.enabled }} - - name: REDIS_USER - value: default - {{- if (not .Values.auth.usePasswordFiles) }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: REDIS_ADDR - value: rediss://{{ .Values.metrics.redisTargetHost }}:{{ .Values.master.containerPorts.redis }} - {{- if .Values.tls.authClients }} - - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE - value: {{ template "redis.tlsCert" . }} - {{- end }} - - name: REDIS_EXPORTER_TLS_CA_CERT_FILE - value: {{ template "redis.tlsCACert" . }} - {{- end }} - {{- if .Values.metrics.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - ports: - - name: metrics - containerPort: 9121 - {{- if .Values.metrics.resources }} - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- end }} - volumeMounts: - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - mountPath: /secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.metrics.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.master.sidecars }} - {{- include "common.tplvalues.render" (dict "value" .Values.master.sidecars "context" $) | nindent 8 }} - {{- end }} - {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.master.persistence.enabled .Values.master.podSecurityContext.enabled .Values.master.containerSecurityContext.enabled }} - {{- if or .Values.master.initContainers $needsVolumePermissions .Values.sysctl.enabled }} - initContainers: - {{- if .Values.master.initContainers }} - {{- include "common.tplvalues.render" (dict "value" .Values.master.initContainers "context" $) | nindent 8 }} - {{- end }} - {{- if $needsVolumePermissions }} - - name: volume-permissions - image: {{ include "redis.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/bash - - -ec - - | - {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.master.persistence.path }} - {{- else }} - chown -R {{ .Values.master.containerSecurityContext.runAsUser }}:{{ .Values.master.podSecurityContext.fsGroup }} {{ .Values.master.persistence.path }} - {{- end }} - {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} - securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.volumePermissions.resources }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - {{- end }} - volumeMounts: - - name: redis-data - mountPath: {{ .Values.master.persistence.path }} - subPath: {{ .Values.master.persistence.subPath }} - {{- end }} - {{- if .Values.sysctl.enabled }} - - name: init-sysctl - image: {{ include "redis.sysctl.image" . }} - imagePullPolicy: {{ default "" .Values.sysctl.image.pullPolicy | quote }} - securityContext: - privileged: true - runAsUser: 0 - {{- if .Values.sysctl.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.sysctl.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.sysctl.resources }} - resources: {{- toYaml .Values.sysctl.resources | nindent 12 }} - {{- end }} - {{- if .Values.sysctl.mountHostSys }} - volumeMounts: - - name: host-sys - mountPath: /host-sys - {{- end }} - {{- end }} - {{- end }} - volumes: - - name: start-scripts - configMap: - name: {{ printf "%s-scripts" (include "common.names.fullname" .) }} - defaultMode: 0755 - - name: health - configMap: - name: {{ printf "%s-health" (include "common.names.fullname" .) }} - defaultMode: 0755 - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - secret: - secretName: {{ template "redis.secretName" . }} - items: - - key: {{ template "redis.secretPasswordKey" . }} - path: redis-password - {{- end }} - - name: config - configMap: - name: {{ include "redis.configmapName" . }} - {{- if .Values.sysctl.mountHostSys }} - - name: host-sys - hostPath: - path: /sys - {{- end }} - - name: redis-tmp-conf - {{- if .Values.master.persistence.medium }} - emptyDir: - medium: {{ .Values.master.persistence.medium | quote }} - {{- if .Values.master.persistence.sizeLimit }} - sizeLimit: {{ .Values.master.persistence.sizeLimit | quote }} - {{- end }} - {{- else }} - emptyDir: {} - {{- end }} - - name: tmp - {{- if .Values.master.persistence.medium }} - emptyDir: - medium: {{ .Values.master.persistence.medium | quote }} - {{- if .Values.master.persistence.sizeLimit }} - sizeLimit: {{ .Values.master.persistence.sizeLimit | quote }} - {{- end }} - {{- else }} - emptyDir: {} - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - secret: - secretName: {{ include "redis.tlsSecretName" . }} - defaultMode: 256 - {{- end }} - {{- if .Values.master.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.master.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.metrics.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if not .Values.master.persistence.enabled }} - - name: redis-data - {{- if .Values.master.persistence.medium }} - emptyDir: { - medium: {{ .Values.master.persistence.medium | quote }} - } - {{- else }} - emptyDir: {} - {{- end }} - {{- else if .Values.master.persistence.existingClaim }} - - name: redis-data - persistentVolumeClaim: - claimName: {{ printf "%s" (tpl .Values.master.persistence.existingClaim .) }} - {{- else if (eq .Values.master.kind "Deployment") }} - - name: redis-data - persistentVolumeClaim: - claimName: {{ printf "redis-data-%s-master" (include "common.names.fullname" .) }} - {{- else }} - volumeClaimTemplates: - - metadata: - name: redis-data - labels: {{- include "common.labels.matchLabels" . | nindent 10 }} - app.kubernetes.io/component: master - {{- if .Values.master.persistence.annotations }} - annotations: {{- toYaml .Values.master.persistence.annotations | nindent 10 }} - {{- end }} - spec: - accessModes: - {{- range .Values.master.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.master.persistence.size | quote }} - {{- if .Values.master.persistence.selector }} - selector: {{- include "common.tplvalues.render" (dict "value" .Values.master.persistence.selector "context" $) | nindent 10 }} - {{- end }} - {{- if .Values.master.persistence.dataSource }} - dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.master.persistence.dataSource "context" $) | nindent 10 }} - {{- end }} - {{- include "common.storage.class" (dict "persistence" .Values.master.persistence "global" .Values.global) | nindent 8 }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/master/psp.yaml b/rds/base/charts/redis/templates/master/psp.yaml deleted file mode 100644 index fc1ebf0..0000000 --- a/rds/base/charts/redis/templates/master/psp.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} -{{- if and $pspAvailable .Values.podSecurityPolicy.create }} -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ printf "%s-master" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - allowPrivilegeEscalation: false - fsGroup: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.master.podSecurityContext.fsGroup }} - max: {{ .Values.master.podSecurityContext.fsGroup }} - hostIPC: false - hostNetwork: false - hostPID: false - privileged: false - readOnlyRootFilesystem: false - requiredDropCapabilities: - - ALL - runAsUser: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.master.containerSecurityContext.runAsUser }} - max: {{ .Values.master.containerSecurityContext.runAsUser }} - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.master.containerSecurityContext.runAsUser }} - max: {{ .Values.master.containerSecurityContext.runAsUser }} - volumes: - - 'configMap' - - 'secret' - - 'emptyDir' - - 'persistentVolumeClaim' -{{- end }} diff --git a/rds/base/charts/redis/templates/master/pvc.yaml b/rds/base/charts/redis/templates/master/pvc.yaml deleted file mode 100644 index ad45562..0000000 --- a/rds/base/charts/redis/templates/master/pvc.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if and (eq .Values.architecture "standalone") (eq .Values.master.kind "Deployment") (.Values.master.persistence.enabled) (not .Values.master.persistence.existingClaim) }} -kind: PersistentVolumeClaim -apiVersion: v1 -metadata: - name: {{ printf "redis-data-%s-master" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.matchLabels" . | nindent 4 }} - app.kubernetes.io/component: master - {{- if .Values.master.persistence.annotations }} - annotations: {{- toYaml .Values.master.persistence.annotations | nindent 4 }} - {{- end }} -spec: - accessModes: - {{- range .Values.master.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.master.persistence.size | quote }} - {{- if .Values.master.persistence.selector }} - selector: {{- include "common.tplvalues.render" (dict "value" .Values.master.persistence.selector "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.master.persistence.dataSource }} - dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.master.persistence.dataSource "context" $) | nindent 4 }} - {{- end }} - {{- include "common.storage.class" (dict "persistence" .Values.master.persistence "global" .Values.global) | nindent 2 }} -{{- end }} diff --git a/rds/base/charts/redis/templates/master/service.yaml b/rds/base/charts/redis/templates/master/service.yaml deleted file mode 100644 index e7e4898..0000000 --- a/rds/base/charts/redis/templates/master/service.yaml +++ /dev/null @@ -1,58 +0,0 @@ -{{- if not .Values.sentinel.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-master" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: master - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.master.service.annotations .Values.commonAnnotations }} - annotations: - {{- if .Values.master.service.annotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.master.service.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -spec: - type: {{ .Values.master.service.type }} - {{- if or (eq .Values.master.service.type "LoadBalancer") (eq .Values.master.service.type "NodePort") }} - externalTrafficPolicy: {{ .Values.master.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if (semverCompare ">=1.22-0" (include "common.capabilities.kubeVersion" .)) }} - internalTrafficPolicy: {{ .Values.master.service.internalTrafficPolicy }} - {{- end }} - {{- if and (eq .Values.master.service.type "LoadBalancer") (not (empty .Values.master.service.loadBalancerIP)) }} - loadBalancerIP: {{ .Values.master.service.loadBalancerIP }} - {{- end }} - {{- if and (eq .Values.master.service.type "LoadBalancer") (not (empty .Values.master.service.loadBalancerSourceRanges)) }} - loadBalancerSourceRanges: {{ .Values.master.service.loadBalancerSourceRanges }} - {{- end }} - {{- if and .Values.master.service.clusterIP (eq .Values.master.service.type "ClusterIP") }} - clusterIP: {{ .Values.master.service.clusterIP }} - {{- end }} - {{- if .Values.master.service.sessionAffinity }} - sessionAffinity: {{ .Values.master.service.sessionAffinity }} - {{- end }} - {{- if .Values.master.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.master.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - ports: - - name: tcp-redis - port: {{ .Values.master.service.ports.redis }} - targetPort: redis - {{- if and (or (eq .Values.master.service.type "NodePort") (eq .Values.master.service.type "LoadBalancer")) .Values.master.service.nodePorts.redis}} - nodePort: {{ .Values.master.service.nodePorts.redis}} - {{- else if eq .Values.master.service.type "ClusterIP" }} - nodePort: null - {{- end }} - {{- if .Values.master.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.master.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} - app.kubernetes.io/component: master -{{- end }} diff --git a/rds/base/charts/redis/templates/metrics-svc.yaml b/rds/base/charts/redis/templates/metrics-svc.yaml deleted file mode 100644 index 5b72494..0000000 --- a/rds/base/charts/redis/templates/metrics-svc.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if .Values.metrics.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-metrics" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: metrics - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.metrics.service.annotations .Values.commonAnnotations }} - annotations: - {{- if .Values.metrics.service.annotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.service.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -spec: - type: {{ .Values.metrics.service.type }} - {{- if eq .Values.metrics.service.type "LoadBalancer" }} - externalTrafficPolicy: {{ .Values.metrics.service.externalTrafficPolicy }} - {{- end }} - {{- if and (eq .Values.metrics.service.type "LoadBalancer") .Values.metrics.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }} - {{- end }} - {{- if and (eq .Values.metrics.service.type "LoadBalancer") .Values.metrics.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: {{- toYaml .Values.metrics.service.loadBalancerSourceRanges | nindent 4 }} - {{- end }} - ports: - - name: http-metrics - port: {{ .Values.metrics.service.port }} - protocol: TCP - targetPort: metrics - {{- if .Values.metrics.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} -{{- end }} diff --git a/rds/base/charts/redis/templates/networkpolicy.yaml b/rds/base/charts/redis/templates/networkpolicy.yaml deleted file mode 100644 index f45cc69..0000000 --- a/rds/base/charts/redis/templates/networkpolicy.yaml +++ /dev/null @@ -1,78 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ template "networkPolicy.apiVersion" . }} -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - podSelector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} - policyTypes: - - Ingress - {{- if or (eq .Values.architecture "replication") .Values.networkPolicy.extraEgress }} - - Egress - egress: - {{- if eq .Values.architecture "replication" }} - # Allow dns resolution - - ports: - - port: 53 - protocol: UDP - # Allow outbound connections to other cluster pods - - ports: - - port: {{ .Values.master.containerPorts.redis }} - {{- if .Values.sentinel.enabled }} - - port: {{ .Values.sentinel.containerPorts.sentinel }} - {{- end }} - to: - - podSelector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} - {{- end }} - {{- if .Values.networkPolicy.extraEgress }} - {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} - ingress: - # Allow inbound connections - - ports: - - port: {{ .Values.master.containerPorts.redis }} - {{- if .Values.sentinel.enabled }} - - port: {{ .Values.sentinel.containerPorts.sentinel }} - {{- end }} - {{- if not .Values.networkPolicy.allowExternal }} - from: - - podSelector: - matchLabels: - {{ template "common.names.fullname" . }}-client: "true" - - podSelector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} - {{- if .Values.networkPolicy.ingressNSMatchLabels }} - - namespaceSelector: - matchLabels: - {{- range $key, $value := .Values.networkPolicy.ingressNSMatchLabels }} - {{ $key | quote }}: {{ $value | quote }} - {{- end }} - {{- if .Values.networkPolicy.ingressNSPodMatchLabels }} - podSelector: - matchLabels: - {{- range $key, $value := .Values.networkPolicy.ingressNSPodMatchLabels }} - {{ $key | quote }}: {{ $value | quote }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.metrics.enabled }} - # Allow prometheus scrapes for metrics - - ports: - - port: 9121 - {{- end }} - {{- if .Values.networkPolicy.extraIngress }} - {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/pdb.yaml b/rds/base/charts/redis/templates/pdb.yaml deleted file mode 100644 index bd6e917..0000000 --- a/rds/base/charts/redis/templates/pdb.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if .Values.pdb.create }} -apiVersion: {{ include "common.capabilities.policy.apiVersion" . }} -kind: PodDisruptionBudget -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if .Values.pdb.minAvailable }} - minAvailable: {{ .Values.pdb.minAvailable }} - {{- end }} - {{- if .Values.pdb.maxUnavailable }} - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - {{- end }} - selector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} -{{- end }} diff --git a/rds/base/charts/redis/templates/prometheusrule.yaml b/rds/base/charts/redis/templates/prometheusrule.yaml deleted file mode 100644 index 2d82ecc..0000000 --- a/rds/base/charts/redis/templates/prometheusrule.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace .Values.metrics.prometheusRule.namespace | quote }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.metrics.prometheusRule.additionalLabels }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- with .Values.metrics.prometheusRule.rules }} - groups: - - name: {{ template "common.names.name" $ }} - rules: {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/replicas/hpa.yaml b/rds/base/charts/redis/templates/replicas/hpa.yaml deleted file mode 100644 index 543a322..0000000 --- a/rds/base/charts/redis/templates/replicas/hpa.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{- if and .Values.replica.autoscaling.enabled (not .Values.sentinel.enabled) }} -apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }} -kind: HorizontalPodAutoscaler -metadata: - name: {{ printf "%s-replicas" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: replica - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - scaleTargetRef: - apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} - kind: StatefulSet - name: {{ printf "%s-replicas" (include "common.names.fullname" .) }} - minReplicas: {{ .Values.replica.autoscaling.minReplicas }} - maxReplicas: {{ .Values.replica.autoscaling.maxReplicas }} - metrics: - {{- if .Values.replica.autoscaling.targetCPU }} - - type: Resource - resource: - name: cpu - {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} - targetAverageUtilization: {{ .Values.replica.autoscaling.targetCPU }} - {{- else }} - target: - type: Utilization - averageUtilization: {{ .Values.replica.autoscaling.targetCPU }} - {{- end }} - {{- end }} - {{- if .Values.replica.autoscaling.targetMemory }} - - type: Resource - resource: - name: memory - {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} - targetAverageUtilization: {{ .Values.replica.autoscaling.targetMemory }} - {{- else }} - target: - type: Utilization - averageUtilization: {{ .Values.replica.autoscaling.targetMemory }} - {{- end }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/replicas/service.yaml b/rds/base/charts/redis/templates/replicas/service.yaml deleted file mode 100644 index 10221b1..0000000 --- a/rds/base/charts/redis/templates/replicas/service.yaml +++ /dev/null @@ -1,58 +0,0 @@ -{{- if and (eq .Values.architecture "replication") (not .Values.sentinel.enabled) }} -apiVersion: v1 -kind: Service -metadata: - name: {{ printf "%s-replicas" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: replica - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.replica.service.annotations .Values.commonAnnotations }} - annotations: - {{- if .Values.replica.service.annotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.service.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -spec: - type: {{ .Values.replica.service.type }} - {{- if or (eq .Values.replica.service.type "LoadBalancer") (eq .Values.replica.service.type "NodePort") }} - externalTrafficPolicy: {{ .Values.replica.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if (semverCompare ">=1.22-0" (include "common.capabilities.kubeVersion" .)) }} - internalTrafficPolicy: {{ .Values.replica.service.internalTrafficPolicy }} - {{- end }} - {{- if and (eq .Values.replica.service.type "LoadBalancer") (not (empty .Values.replica.service.loadBalancerIP)) }} - loadBalancerIP: {{ .Values.replica.service.loadBalancerIP }} - {{- end }} - {{- if and (eq .Values.replica.service.type "LoadBalancer") (not (empty .Values.replica.service.loadBalancerSourceRanges)) }} - loadBalancerSourceRanges: {{ .Values.replica.service.loadBalancerSourceRanges }} - {{- end }} - {{- if and .Values.replica.service.clusterIP (eq .Values.replica.service.type "ClusterIP") }} - clusterIP: {{ .Values.replica.service.clusterIP }} - {{- end }} - {{- if .Values.replica.service.sessionAffinity }} - sessionAffinity: {{ .Values.replica.service.sessionAffinity }} - {{- end }} - {{- if .Values.replica.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.replica.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - ports: - - name: tcp-redis - port: {{ .Values.replica.service.ports.redis }} - targetPort: redis - {{- if and (or (eq .Values.replica.service.type "NodePort") (eq .Values.replica.service.type "LoadBalancer")) .Values.replica.service.nodePorts.redis}} - nodePort: {{ .Values.replica.service.nodePorts.redis}} - {{- else if eq .Values.replica.service.type "ClusterIP" }} - nodePort: null - {{- end }} - {{- if .Values.replica.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.replica.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} - app.kubernetes.io/component: replica -{{- end }} diff --git a/rds/base/charts/redis/templates/replicas/statefulset.yaml b/rds/base/charts/redis/templates/replicas/statefulset.yaml deleted file mode 100644 index aa706d9..0000000 --- a/rds/base/charts/redis/templates/replicas/statefulset.yaml +++ /dev/null @@ -1,471 +0,0 @@ -{{- if and (eq .Values.architecture "replication") (not .Values.sentinel.enabled) }} -apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ printf "%s-replicas" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: replica - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - {{- if not .Values.replica.autoscaling.enabled }} - replicas: {{ .Values.replica.replicaCount }} - {{- end }} - selector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} - app.kubernetes.io/component: replica - serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }} - {{- if .Values.replica.updateStrategy }} - updateStrategy: {{- toYaml .Values.replica.updateStrategy | nindent 4 }} - {{- end }} - {{- if .Values.replica.podManagementPolicy }} - podManagementPolicy: {{ .Values.replica.podManagementPolicy | quote }} - {{- end }} - template: - metadata: - labels: {{- include "common.labels.standard" . | nindent 8 }} - app.kubernetes.io/component: replica - {{- if .Values.replica.podLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.podLabels "context" $ ) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podLabels "context" $ ) | nindent 8 }} - {{- end }} - annotations: - {{- if (include "redis.createConfigmap" .) }} - checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - {{- end }} - checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} - checksum/scripts: {{ include (print $.Template.BasePath "/scripts-configmap.yaml") . | sha256sum }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- if .Values.replica.podAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.podAnnotations "context" $ ) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podAnnotations "context" $ ) | nindent 8 }} - {{- end }} - spec: - {{- include "redis.imagePullSecrets" . | nindent 6 }} - {{- if .Values.replica.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.replica.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.replica.podSecurityContext.enabled }} - securityContext: {{- omit .Values.replica.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - serviceAccountName: {{ template "redis.serviceAccountName" . }} - {{- if .Values.replica.priorityClassName }} - priorityClassName: {{ .Values.replica.priorityClassName | quote }} - {{- end }} - {{- if .Values.replica.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.replica.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAffinityPreset "component" "replica" "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAntiAffinityPreset "component" "replica" "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.replica.nodeAffinityPreset.type "key" .Values.replica.nodeAffinityPreset.key "values" .Values.replica.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.replica.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.replica.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.replica.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.replica.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.replica.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.replica.topologySpreadConstraints "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.replica.shareProcessNamespace }} - shareProcessNamespace: {{ .Values.replica.shareProcessNamespace }} - {{- end }} - {{- if .Values.replica.schedulerName }} - schedulerName: {{ .Values.replica.schedulerName | quote }} - {{- end }} - {{- if .Values.replica.dnsPolicy }} - dnsPolicy: {{ .Values.replica.dnsPolicy }} - {{- end }} - {{- if .Values.replica.dnsConfig }} - dnsConfig: {{- include "common.tplvalues.render" (dict "value" .Values.replica.dnsConfig "context" $) | nindent 8 }} - {{- end }} - terminationGracePeriodSeconds: {{ .Values.replica.terminationGracePeriodSeconds }} - containers: - - name: redis - image: {{ template "redis.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.replica.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.replica.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.replica.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.replica.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.replica.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.replica.command "context" $) | nindent 12 }} - {{- else }} - command: - - /bin/bash - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.replica.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.replica.args "context" $) | nindent 12 }} - {{- else }} - args: - - -c - - /opt/bitnami/scripts/start-scripts/start-replica.sh - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - - name: REDIS_REPLICATION_MODE - value: slave - - name: REDIS_MASTER_HOST - {{- if and (eq (int64 .Values.master.count) 1) (ne .Values.master.kind "Deployment") }} - value: {{ template "common.names.fullname" . }}-master-0.{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} - {{- else }} - value: {{ template "common.names.fullname" . }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} - {{- end }} - - name: REDIS_MASTER_PORT_NUMBER - value: {{ .Values.master.containerPorts.redis | quote }} - - name: ALLOW_EMPTY_PASSWORD - value: {{ ternary "no" "yes" .Values.auth.enabled | quote }} - {{- if .Values.auth.enabled }} - {{- if .Values.auth.usePasswordFiles }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - - name: REDIS_MASTER_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - - name: REDIS_MASTER_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- end }} - - name: REDIS_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_PORT - value: {{ .Values.replica.containerPorts.redis | quote }} - - name: REDIS_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_TLS_DH_PARAMS_FILE - value: {{ template "redis.tlsDHParams" . }} - {{- end }} - {{- else }} - - name: REDIS_PORT - value: {{ .Values.replica.containerPorts.redis | quote }} - {{- end }} - {{- if .Values.replica.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.replica.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.replica.extraEnvVarsCM .Values.replica.extraEnvVarsSecret }} - envFrom: - {{- if .Values.replica.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.replica.extraEnvVarsCM }} - {{- end }} - {{- if .Values.replica.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.replica.extraEnvVarsSecret }} - {{- end }} - {{- end }} - ports: - - name: redis - containerPort: {{ .Values.replica.containerPorts.redis }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.replica.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.replica.startupProbe "enabled") "context" $) | nindent 12 }} - tcpSocket: - port: redis - {{- else if .Values.replica.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customStartupProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.replica.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.replica.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.replica.livenessProbe.periodSeconds }} - timeoutSeconds: {{ add1 .Values.replica.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.replica.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.replica.livenessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_liveness_local_and_master.sh {{ .Values.replica.livenessProbe.timeoutSeconds }} - {{- else if .Values.replica.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.replica.readinessProbe.enabled }} - readinessProbe: - initialDelaySeconds: {{ .Values.replica.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.replica.readinessProbe.periodSeconds }} - timeoutSeconds: {{ add1 .Values.replica.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.replica.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.replica.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_readiness_local_and_master.sh {{ .Values.replica.readinessProbe.timeoutSeconds }} - {{- else if .Values.replica.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.replica.resources }} - resources: {{- toYaml .Values.replica.resources | nindent 12 }} - {{- end }} - volumeMounts: - - name: start-scripts - mountPath: /opt/bitnami/scripts/start-scripts - - name: health - mountPath: /health - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: /data - subPath: {{ .Values.replica.persistence.subPath }} - - name: config - mountPath: /opt/bitnami/redis/mounted-etc - - name: redis-tmp-conf - mountPath: /opt/bitnami/redis/etc - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.replica.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ include "redis.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.metrics.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.metrics.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.command "context" $) | nindent 12 }} - {{- else }} - command: - - /bin/bash - - -c - - | - if [[ -f '/secrets/redis-password' ]]; then - export REDIS_PASSWORD=$(cat /secrets/redis-password) - fi - redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- end }} - env: - - name: REDIS_ALIAS - value: {{ template "common.names.fullname" . }} - {{- if .Values.auth.enabled }} - - name: REDIS_USER - value: default - {{- if (not .Values.auth.usePasswordFiles) }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: REDIS_ADDR - value: rediss://{{ .Values.metrics.redisTargetHost }}:{{ .Values.replica.containerPorts.redis }} - {{- if .Values.tls.authClients }} - - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE - value: {{ template "redis.tlsCert" . }} - {{- end }} - - name: REDIS_EXPORTER_TLS_CA_CERT_FILE - value: {{ template "redis.tlsCACert" . }} - {{- end }} - ports: - - name: metrics - containerPort: 9121 - {{- if .Values.metrics.resources }} - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- end }} - volumeMounts: - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - mountPath: /secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.metrics.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.replica.sidecars }} - {{- include "common.tplvalues.render" (dict "value" .Values.replica.sidecars "context" $) | nindent 8 }} - {{- end }} - {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.replica.persistence.enabled .Values.replica.podSecurityContext.enabled .Values.replica.containerSecurityContext.enabled }} - {{- if or .Values.replica.initContainers $needsVolumePermissions .Values.sysctl.enabled }} - initContainers: - {{- if .Values.replica.initContainers }} - {{- include "common.tplvalues.render" (dict "value" .Values.replica.initContainers "context" $) | nindent 8 }} - {{- end }} - {{- if $needsVolumePermissions }} - - name: volume-permissions - image: {{ include "redis.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/bash - - -ec - - | - {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.replica.persistence.path }} - {{- else }} - chown -R {{ .Values.replica.containerSecurityContext.runAsUser }}:{{ .Values.replica.podSecurityContext.fsGroup }} {{ .Values.replica.persistence.path }} - {{- end }} - {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} - securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.volumePermissions.resources }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - {{- end }} - volumeMounts: - - name: redis-data - mountPath: {{ .Values.replica.persistence.path }} - subPath: {{ .Values.replica.persistence.subPath }} - {{- end }} - {{- if .Values.sysctl.enabled }} - - name: init-sysctl - image: {{ include "redis.sysctl.image" . }} - imagePullPolicy: {{ default "" .Values.sysctl.image.pullPolicy | quote }} - securityContext: - privileged: true - runAsUser: 0 - {{- if .Values.sysctl.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.sysctl.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.sysctl.resources }} - resources: {{- toYaml .Values.sysctl.resources | nindent 12 }} - {{- end }} - {{- if .Values.sysctl.mountHostSys }} - volumeMounts: - - name: host-sys - mountPath: /host-sys - {{- end }} - {{- end }} - {{- end }} - volumes: - - name: start-scripts - configMap: - name: {{ printf "%s-scripts" (include "common.names.fullname" .) }} - defaultMode: 0755 - - name: health - configMap: - name: {{ printf "%s-health" (include "common.names.fullname" .) }} - defaultMode: 0755 - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - secret: - secretName: {{ template "redis.secretName" . }} - items: - - key: {{ template "redis.secretPasswordKey" . }} - path: redis-password - {{- end }} - - name: config - configMap: - name: {{ include "redis.configmapName" . }} - {{- if .Values.sysctl.mountHostSys }} - - name: host-sys - hostPath: - path: /sys - {{- end }} - - name: redis-tmp-conf - {{- if .Values.replica.persistence.medium }} - emptyDir: - medium: {{ .Values.replica.persistence.medium | quote }} - {{- if .Values.replica.persistence.sizeLimit }} - sizeLimit: {{ .Values.replica.persistence.sizeLimit | quote }} - {{- end }} - {{- else }} - emptyDir: {} - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - secret: - secretName: {{ include "redis.tlsSecretName" . }} - defaultMode: 256 - {{- end }} - {{- if .Values.replica.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.metrics.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if not .Values.replica.persistence.enabled }} - - name: redis-data - {{- if .Values.replica.persistence.medium }} - emptyDir: { - medium: {{ .Values.replica.persistence.medium | quote }} - } - {{- else }} - emptyDir: {} - {{- end }} - {{- else if .Values.replica.persistence.existingClaim }} - - name: redis-data - persistentVolumeClaim: - claimName: {{ printf "%s" (tpl .Values.replica.persistence.existingClaim .) }} - {{- else }} - volumeClaimTemplates: - - metadata: - name: redis-data - labels: {{- include "common.labels.matchLabels" . | nindent 10 }} - app.kubernetes.io/component: replica - {{- if .Values.replica.persistence.annotations }} - annotations: {{- toYaml .Values.replica.persistence.annotations | nindent 10 }} - {{- end }} - spec: - accessModes: - {{- range .Values.replica.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.replica.persistence.size | quote }} - {{- if .Values.replica.persistence.selector }} - selector: {{- include "common.tplvalues.render" (dict "value" .Values.replica.persistence.selector "context" $) | nindent 10 }} - {{- end }} - {{- if .Values.replica.persistence.dataSource }} - dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.replica.persistence.dataSource "context" $) | nindent 10 }} - {{- end }} - {{- include "common.storage.class" (dict "persistence" .Values.replica.persistence "global" .Values.global) | nindent 8 }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/role.yaml b/rds/base/charts/redis/templates/role.yaml deleted file mode 100644 index 0cd806a..0000000 --- a/rds/base/charts/redis/templates/role.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.rbac.create }} -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: Role -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -rules: - {{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} - {{- if and $pspAvailable .Values.podSecurityPolicy.enabled }} - - apiGroups: - - '{{ template "podSecurityPolicy.apiGroup" . }}' - resources: - - 'podsecuritypolicies' - verbs: - - 'use' - resourceNames: [{{ printf "%s-master" (include "common.names.fullname" .) }}] - {{- end }} - {{- if .Values.rbac.rules }} - {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/rolebinding.yaml b/rds/base/charts/redis/templates/rolebinding.yaml deleted file mode 100644 index 79a5987..0000000 --- a/rds/base/charts/redis/templates/rolebinding.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.rbac.create }} -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: RoleBinding -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "common.names.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ template "redis.serviceAccountName" . }} -{{- end }} diff --git a/rds/base/charts/redis/templates/scripts-configmap.yaml b/rds/base/charts/redis/templates/scripts-configmap.yaml deleted file mode 100644 index cab9291..0000000 --- a/rds/base/charts/redis/templates/scripts-configmap.yaml +++ /dev/null @@ -1,627 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ printf "%s-scripts" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: -{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled }} - start-node.sh: | - #!/bin/bash - - . /opt/bitnami/scripts/libos.sh - . /opt/bitnami/scripts/liblog.sh - . /opt/bitnami/scripts/libvalidations.sh - - get_port() { - hostname="$1" - type="$2" - - port_var=$(echo "${hostname^^}_SERVICE_PORT_$type" | sed "s/-/_/g") - port=${!port_var} - - if [ -z "$port" ]; then - case $type in - "SENTINEL") - echo {{ .Values.sentinel.containerPorts.sentinel }} - ;; - "REDIS") - echo {{ .Values.master.containerPorts.redis }} - ;; - esac - else - echo $port - fi - } - - get_full_hostname() { - hostname="$1" - - {{- if .Values.useExternalDNS.enabled }} - echo "${hostname}.{{- include "redis.externalDNS.suffix" . }}" - {{- else if eq .Values.sentinel.service.type "NodePort" }} - echo "${hostname}.{{- .Release.Namespace }}" - {{- else }} - echo "${hostname}.${HEADLESS_SERVICE}" - {{- end }} - } - - REDISPORT=$(get_port "$HOSTNAME" "REDIS") - - HEADLESS_SERVICE="{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - - if [ -n "$REDIS_EXTERNAL_MASTER_HOST" ]; then - REDIS_SERVICE="$REDIS_EXTERNAL_MASTER_HOST" - else - REDIS_SERVICE="{{ template "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - fi - - SENTINEL_SERVICE_PORT=$(get_port "{{ include "common.names.fullname" . }}" "TCP_SENTINEL") - validate_quorum() { - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - quorum_info_command="{{- if and .Values.auth.enabled .Values.auth.sentinel }}REDISCLI_AUTH="\$REDIS_PASSWORD" {{ end }}redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel master {{ .Values.sentinel.masterSet }}" - else - quorum_info_command="{{- if and .Values.auth.enabled .Values.auth.sentinel }}REDISCLI_AUTH="\$REDIS_PASSWORD" {{ end }}redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT sentinel master {{ .Values.sentinel.masterSet }}" - fi - info "about to run the command: $quorum_info_command" - eval $quorum_info_command | grep -Fq "s_down" - } - - trigger_manual_failover() { - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - failover_command="{{- if and .Values.auth.enabled .Values.auth.sentinel }}REDISCLI_AUTH="\$REDIS_PASSWORD" {{ end }}redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel failover {{ .Values.sentinel.masterSet }}" - else - failover_command="{{- if and .Values.auth.enabled .Values.auth.sentinel }}REDISCLI_AUTH="\$REDIS_PASSWORD" {{ end }}redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT sentinel failover {{ .Values.sentinel.masterSet }}" - fi - - info "about to run the command: $failover_command" - eval $failover_command - } - - get_sentinel_master_info() { - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - sentinel_info_command="{{- if and .Values.auth.enabled .Values.auth.sentinel }}REDISCLI_AUTH="\$REDIS_PASSWORD" {{ end }}timeout {{ .Values.sentinel.getMasterTimeout }} redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - else - sentinel_info_command="{{- if and .Values.auth.enabled .Values.auth.sentinel }}REDISCLI_AUTH="\$REDIS_PASSWORD" {{ end }}timeout {{ .Values.sentinel.getMasterTimeout }} redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - fi - - info "about to run the command: $sentinel_info_command" - eval $sentinel_info_command - } - - {{- if and .Values.replica.containerSecurityContext.runAsUser (eq (.Values.replica.containerSecurityContext.runAsUser | int) 0) }} - useradd redis - chown -R redis {{ .Values.replica.persistence.path }} - {{- end }} - - [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" - [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" - - # check if there is a master - master_in_persisted_conf="$(get_full_hostname "$HOSTNAME")" - master_port_in_persisted_conf="$REDIS_MASTER_PORT_NUMBER" - master_in_sentinel="$(get_sentinel_master_info)" - redisRetVal=$? - - {{- if .Values.sentinel.persistence.enabled }} - if [[ -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then - master_in_persisted_conf="$(awk '/monitor/ {print $4}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)" - master_port_in_persisted_conf="$(awk '/monitor/ {print $5}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)" - info "Found previous master ${master_in_persisted_conf}:${master_port_in_persisted_conf} in /opt/bitnami/redis-sentinel/etc/sentinel.conf" - debug "$(cat /opt/bitnami/redis-sentinel/etc/sentinel.conf | grep monitor)" - touch /opt/bitnami/redis-sentinel/etc/.node_read - fi - {{- end }} - - if [[ $redisRetVal -ne 0 ]]; then - if [[ "$master_in_persisted_conf" == "$(get_full_hostname "$HOSTNAME")" ]]; then - # Case 1: No active sentinel and in previous sentinel.conf we were the master --> MASTER - info "Configuring the node as master" - export REDIS_REPLICATION_MODE="master" - else - # Case 2: No active sentinel and in previous sentinel.conf we were not master --> REPLICA - info "Configuring the node as replica" - export REDIS_REPLICATION_MODE="slave" - REDIS_MASTER_HOST=${master_in_persisted_conf} - REDIS_MASTER_PORT_NUMBER=${master_port_in_persisted_conf} - fi - else - # Fetches current master's host and port - REDIS_SENTINEL_INFO=($(get_sentinel_master_info)) - info "Current master: REDIS_SENTINEL_INFO=(${REDIS_SENTINEL_INFO[0]},${REDIS_SENTINEL_INFO[1]})" - REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} - REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]} - - if [[ "$REDIS_MASTER_HOST" == "$(get_full_hostname "$HOSTNAME")" ]]; then - # Case 3: Active sentinel and master it is this node --> MASTER - info "Configuring the node as master" - export REDIS_REPLICATION_MODE="master" - else - # Case 4: Active sentinel and master is not this node --> REPLICA - info "Configuring the node as replica" - export REDIS_REPLICATION_MODE="slave" - - {{- if and .Values.sentinel.automateClusterRecovery (le (int .Values.sentinel.downAfterMilliseconds) 2000) }} - retry_count=1 - while validate_quorum - do - info "sleeping, waiting for Redis master to come up" - sleep 1s - if ! ((retry_count % 11)); then - info "Trying to manually failover" - failover_result=$(trigger_manual_failover) - - debug "Failover result: $failover_result" - fi - - ((retry_count+=1)) - done - info "Redis master is up now" - {{- end }} - fi - fi - - if [[ -n "$REDIS_EXTERNAL_MASTER_HOST" ]]; then - REDIS_MASTER_HOST="$REDIS_EXTERNAL_MASTER_HOST" - REDIS_MASTER_PORT_NUMBER="${REDIS_EXTERNAL_MASTER_PORT}" - fi - - if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then - cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf - fi - - if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then - cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf - fi - - echo "" >> /opt/bitnami/redis/etc/replica.conf - echo "replica-announce-port $REDISPORT" >> /opt/bitnami/redis/etc/replica.conf - echo "replica-announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis/etc/replica.conf - - {{- if .Values.tls.enabled }} - ARGS=("--port" "0") - ARGS+=("--tls-port" "${REDIS_TLS_PORT}") - ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") - ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") - ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") - ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") - ARGS+=("--tls-replication" "yes") - {{- if .Values.tls.dhParamsFilename }} - ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") - {{- end }} - {{- else }} - ARGS=("--port" "${REDIS_PORT}") - {{- end }} - - if [[ "$REDIS_REPLICATION_MODE" = "slave" ]]; then - ARGS+=("--replicaof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") - fi - - {{- if .Values.auth.enabled }} - ARGS+=("--requirepass" "${REDIS_PASSWORD}") - ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") - {{- else }} - ARGS+=("--protected-mode" "no") - {{- end }} - ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") - ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") - {{- if .Values.replica.extraFlags }} - {{- range .Values.replica.extraFlags }} - ARGS+=({{ . | quote }}) - {{- end }} - {{- end }} - - {{- if .Values.replica.preExecCmds }} - {{- .Values.replica.preExecCmds | nindent 4 }} - {{- end }} - - {{- if .Values.replica.command }} - exec {{ .Values.replica.command }} "${ARGS[@]}" - {{- else }} - exec redis-server "${ARGS[@]}" - {{- end }} - - start-sentinel.sh: | - #!/bin/bash - - . /opt/bitnami/scripts/libos.sh - . /opt/bitnami/scripts/libvalidations.sh - . /opt/bitnami/scripts/libfile.sh - - HEADLESS_SERVICE="{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - REDIS_SERVICE="{{ template "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - - get_port() { - hostname="$1" - type="$2" - - port_var=$(echo "${hostname^^}_SERVICE_PORT_$type" | sed "s/-/_/g") - port=${!port_var} - - if [ -z "$port" ]; then - case $type in - "SENTINEL") - echo {{ .Values.sentinel.containerPorts.sentinel }} - ;; - "REDIS") - echo {{ .Values.master.containerPorts.redis }} - ;; - esac - else - echo $port - fi - } - - get_full_hostname() { - hostname="$1" - - {{- if .Values.useExternalDNS.enabled }} - echo "${hostname}.{{- include "redis.externalDNS.suffix" . }}" - {{- else if eq .Values.sentinel.service.type "NodePort" }} - echo "${hostname}.{{- .Release.Namespace }}" - {{- else }} - echo "${hostname}.${HEADLESS_SERVICE}" - {{- end }} - } - - SERVPORT=$(get_port "$HOSTNAME" "SENTINEL") - REDISPORT=$(get_port "$HOSTNAME" "REDIS") - SENTINEL_SERVICE_PORT=$(get_port "{{ include "common.names.fullname" . }}" "TCP_SENTINEL") - - sentinel_conf_set() { - local -r key="${1:?missing key}" - local value="${2:-}" - - # Sanitize inputs - value="${value//\\/\\\\}" - value="${value//&/\\&}" - value="${value//\?/\\?}" - [[ "$value" = "" ]] && value="\"$value\"" - - replace_in_file "/opt/bitnami/redis-sentinel/etc/sentinel.conf" "^#*\s*${key} .*" "${key} ${value}" false - } - sentinel_conf_add() { - echo $'\n'"$@" >> "/opt/bitnami/redis-sentinel/etc/sentinel.conf" - } - host_id() { - echo "$1" | openssl sha1 | awk '{print $2}' - } - get_sentinel_master_info() { - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - sentinel_info_command="{{- if and .Values.auth.enabled .Values.auth.sentinel }}REDISCLI_AUTH="\$REDIS_PASSWORD" {{ end }}redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - else - sentinel_info_command="{{- if and .Values.auth.enabled .Values.auth.sentinel }}REDISCLI_AUTH="\$REDIS_PASSWORD" {{ end }}redis-cli -h $REDIS_SERVICE -p $SENTINEL_SERVICE_PORT sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - fi - info "about to run the command: $sentinel_info_command" - eval $sentinel_info_command - } - - [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" - - master_in_persisted_conf="$(get_full_hostname "$HOSTNAME")" - - {{- if .Values.sentinel.persistence.enabled }} - if [[ -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then - check_lock_file() { - [[ -f /opt/bitnami/redis-sentinel/etc/.node_read ]] - } - retry_while "check_lock_file" - rm -f /opt/bitnami/redis-sentinel/etc/.node_read - master_in_persisted_conf="$(awk '/monitor/ {print $4}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)" - info "Found previous master $master_in_persisted_conf in /opt/bitnami/redis-sentinel/etc/sentinel.conf" - debug "$(cat /opt/bitnami/redis-sentinel/etc/sentinel.conf | grep monitor)" - fi - {{- end }} - if ! get_sentinel_master_info && [[ "$master_in_persisted_conf" == "$(get_full_hostname "$HOSTNAME")" ]]; then - # No master found, lets create a master node - export REDIS_REPLICATION_MODE="master" - - REDIS_MASTER_HOST=$(get_full_hostname "$HOSTNAME") - REDIS_MASTER_PORT_NUMBER="$REDISPORT" - else - export REDIS_REPLICATION_MODE="slave" - - # Fetches current master's host and port - REDIS_SENTINEL_INFO=($(get_sentinel_master_info)) - info "printing REDIS_SENTINEL_INFO=(${REDIS_SENTINEL_INFO[0]},${REDIS_SENTINEL_INFO[1]})" - REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} - REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]} - fi - - if [[ -n "$REDIS_EXTERNAL_MASTER_HOST" ]]; then - REDIS_MASTER_HOST="$REDIS_EXTERNAL_MASTER_HOST" - REDIS_MASTER_PORT_NUMBER="${REDIS_EXTERNAL_MASTER_PORT}" - fi - - cp /opt/bitnami/redis-sentinel/mounted-etc/sentinel.conf /opt/bitnami/redis-sentinel/etc/sentinel.conf - {{- if .Values.auth.enabled }} - printf "\nsentinel auth-pass %s %s" "{{ .Values.sentinel.masterSet }}" "$REDIS_PASSWORD" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - {{- if and .Values.auth.enabled .Values.auth.sentinel }} - printf "\nrequirepass %s" "$REDIS_PASSWORD" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - {{- end }} - {{- end }} - printf "\nsentinel myid %s" "$(host_id "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - - sentinel_conf_set "sentinel monitor" "{{ .Values.sentinel.masterSet }} "$REDIS_MASTER_HOST" "$REDIS_MASTER_PORT_NUMBER" {{ .Values.sentinel.quorum }}" - - add_known_sentinel() { - hostname="$1" - ip="$2" - - if [[ -n "$hostname" && -n "$ip" && "$hostname" != "$HOSTNAME" ]]; then - sentinel_conf_add "sentinel known-sentinel {{ .Values.sentinel.masterSet }} $(get_full_hostname "$hostname") $(get_port "$hostname" "SENTINEL") $(host_id "$hostname")" - fi - } - add_known_replica() { - hostname="$1" - ip="$2" - - if [[ -n "$ip" && "$(get_full_hostname "$hostname")" != "$REDIS_MASTER_HOST" ]]; then - sentinel_conf_add "sentinel known-replica {{ .Values.sentinel.masterSet }} $(get_full_hostname "$hostname") $(get_port "$hostname" "REDIS")" - fi - } - - # Add available hosts on the network as known replicas & sentinels - for node in $(seq 0 $(({{ .Values.replica.replicaCount }}-1))); do - hostname="{{ template "common.names.fullname" . }}-node-$node" - ip="$(getent hosts "$hostname.$HEADLESS_SERVICE" | awk '{ print $1 }')" - add_known_sentinel "$hostname" "$ip" - add_known_replica "$hostname" "$ip" - done - - echo "" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - echo "sentinel announce-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - echo "sentinel resolve-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - echo "sentinel announce-port $SERVPORT" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - echo "sentinel announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - - {{- if .Values.tls.enabled }} - ARGS=("--port" "0") - ARGS+=("--tls-port" "${REDIS_SENTINEL_TLS_PORT_NUMBER}") - ARGS+=("--tls-cert-file" "${REDIS_SENTINEL_TLS_CERT_FILE}") - ARGS+=("--tls-key-file" "${REDIS_SENTINEL_TLS_KEY_FILE}") - ARGS+=("--tls-ca-cert-file" "${REDIS_SENTINEL_TLS_CA_FILE}") - ARGS+=("--tls-replication" "yes") - ARGS+=("--tls-auth-clients" "${REDIS_SENTINEL_TLS_AUTH_CLIENTS}") - {{- if .Values.tls.dhParamsFilename }} - ARGS+=("--tls-dh-params-file" "${REDIS_SENTINEL_TLS_DH_PARAMS_FILE}") - {{- end }} - {{- end }} - {{- if .Values.sentinel.preExecCmds }} - {{ .Values.sentinel.preExecCmds | nindent 4 }} - {{- end }} - exec redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel {{- if .Values.tls.enabled }} "${ARGS[@]}" {{- end }} - prestop-sentinel.sh: | - #!/bin/bash - - . /opt/bitnami/scripts/libvalidations.sh - . /opt/bitnami/scripts/libos.sh - - HEADLESS_SERVICE="{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - SENTINEL_SERVICE_ENV_NAME={{ printf "%s%s" (upper (include "common.names.fullname" .)| replace "-" "_") "_SERVICE_PORT_TCP_SENTINEL" }} - SENTINEL_SERVICE_PORT=${!SENTINEL_SERVICE_ENV_NAME} - - get_full_hostname() { - hostname="$1" - - {{- if .Values.useExternalDNS.enabled }} - echo "${hostname}.{{- include "redis.externalDNS.suffix" . }}" - {{- else if eq .Values.sentinel.service.type "NodePort" }} - echo "${hostname}.{{- .Release.Namespace }}" - {{- else }} - echo "${hostname}.${HEADLESS_SERVICE}" - {{- end }} - } - run_sentinel_command() { - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - redis-cli -h "$REDIS_SERVICE" -p "$SENTINEL_SERVICE_PORT" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@" - else - redis-cli -h "$REDIS_SERVICE" -p "$SENTINEL_SERVICE_PORT" sentinel "$@" - fi - } - failover_finished() { - REDIS_SENTINEL_INFO=($(run_sentinel_command get-master-addr-by-name "{{ .Values.sentinel.masterSet }}")) - REDIS_MASTER_HOST="${REDIS_SENTINEL_INFO[0]}" - [[ "$REDIS_MASTER_HOST" != "$(get_full_hostname $HOSTNAME)" ]] - } - - REDIS_SERVICE="{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - - {{ if .Values.auth.sentinel -}} - # redis-cli automatically consumes credentials from the REDISCLI_AUTH variable - [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" - [[ -f "$REDIS_PASSWORD_FILE" ]] && export REDISCLI_AUTH="$(< "${REDIS_PASSWORD_FILE}")" - {{- end }} - - if ! failover_finished; then - echo "I am the master pod and you are stopping me. Starting sentinel failover" - # if I am the master, issue a command to failover once and then wait for the failover to finish - run_sentinel_command failover "{{ .Values.sentinel.masterSet }}" - if retry_while "failover_finished" "{{ sub .Values.sentinel.terminationGracePeriodSeconds 10 }}" 1; then - echo "Master has been successfuly failed over to a different pod." - exit 0 - else - echo "Master failover failed" - exit 1 - fi - else - exit 0 - fi - prestop-redis.sh: | - #!/bin/bash - - . /opt/bitnami/scripts/libvalidations.sh - . /opt/bitnami/scripts/libos.sh - - run_redis_command() { - if is_boolean_yes "$REDIS_TLS_ENABLED"; then - redis-cli -h 127.0.0.1 -p "$REDIS_TLS_PORT" --tls --cert "$REDIS_TLS_CERT_FILE" --key "$REDIS_TLS_KEY_FILE" --cacert "$REDIS_TLS_CA_FILE" "$@" - else - redis-cli -h 127.0.0.1 -p ${REDIS_PORT} "$@" - fi - } - failover_finished() { - REDIS_ROLE=$(run_redis_command role | head -1) - [[ "$REDIS_ROLE" != "master" ]] - } - - # redis-cli automatically consumes credentials from the REDISCLI_AUTH variable - [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" - [[ -f "$REDIS_PASSWORD_FILE" ]] && export REDISCLI_AUTH="$(< "${REDIS_PASSWORD_FILE}")" - - if ! failover_finished; then - echo "Waiting for sentinel to run failover for up to {{ sub .Values.sentinel.terminationGracePeriodSeconds 10 }}s" - retry_while "failover_finished" "{{ sub .Values.sentinel.terminationGracePeriodSeconds 10 }}" 1 - else - exit 0 - fi - -{{- else }} - start-master.sh: | - #!/bin/bash - - [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" - {{- if and .Values.master.containerSecurityContext.runAsUser (eq (.Values.master.containerSecurityContext.runAsUser | int) 0) }} - useradd redis - chown -R redis {{ .Values.master.persistence.path }} - {{- end }} - if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then - cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf - fi - if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then - cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf - fi - {{- if .Values.tls.enabled }} - ARGS=("--port" "0") - ARGS+=("--tls-port" "${REDIS_TLS_PORT}") - ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") - ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") - ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") - ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") - {{- if .Values.tls.dhParamsFilename }} - ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") - {{- end }} - {{- else }} - ARGS=("--port" "${REDIS_PORT}") - {{- end }} - {{- if .Values.auth.enabled }} - ARGS+=("--requirepass" "${REDIS_PASSWORD}") - ARGS+=("--masterauth" "${REDIS_PASSWORD}") - {{- else }} - ARGS+=("--protected-mode" "no") - {{- end }} - ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") - ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") - {{- if .Values.master.extraFlags }} - {{- range .Values.master.extraFlags }} - ARGS+=({{ . | quote }}) - {{- end }} - {{- end }} - {{- if .Values.master.preExecCmds }} - {{ .Values.master.preExecCmds | nindent 4 }} - {{- end }} - {{- if .Values.master.command }} - exec {{ .Values.master.command }} "${ARGS[@]}" - {{- else }} - exec redis-server "${ARGS[@]}" - {{- end }} - {{- if eq .Values.architecture "replication" }} - start-replica.sh: | - #!/bin/bash - - get_port() { - hostname="$1" - type="$2" - - port_var=$(echo "${hostname^^}_SERVICE_PORT_$type" | sed "s/-/_/g") - port=${!port_var} - - if [ -z "$port" ]; then - case $type in - "SENTINEL") - echo {{ .Values.sentinel.containerPorts.sentinel }} - ;; - "REDIS") - echo {{ .Values.master.containerPorts.redis }} - ;; - esac - else - echo $port - fi - } - - get_full_hostname() { - hostname="$1" - - {{- if .Values.useExternalDNS.enabled }} - echo "${hostname}.{{- include "redis.externalDNS.suffix" . }}" - {{- else if eq .Values.sentinel.service.type "NodePort" }} - echo "${hostname}.{{- .Release.Namespace }}" - {{- else }} - echo "${hostname}.${HEADLESS_SERVICE}" - {{- end }} - } - - REDISPORT=$(get_port "$HOSTNAME" "REDIS") - - [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" - [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" - {{- if and .Values.replica.containerSecurityContext.runAsUser (eq (.Values.replica.containerSecurityContext.runAsUser | int) 0) }} - useradd redis - chown -R redis {{ .Values.replica.persistence.path }} - {{- end }} - if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then - cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf - fi - if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then - cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf - fi - - echo "" >> /opt/bitnami/redis/etc/replica.conf - echo "replica-announce-port $REDISPORT" >> /opt/bitnami/redis/etc/replica.conf - echo "replica-announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis/etc/replica.conf - - {{- if .Values.tls.enabled }} - ARGS=("--port" "0") - ARGS+=("--tls-port" "${REDIS_TLS_PORT}") - ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") - ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") - ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") - ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") - ARGS+=("--tls-replication" "yes") - {{- if .Values.tls.dhParamsFilename }} - ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") - {{- end }} - {{- else }} - ARGS=("--port" "${REDIS_PORT}") - {{- end }} - ARGS+=("--replicaof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") - {{- if .Values.auth.enabled }} - ARGS+=("--requirepass" "${REDIS_PASSWORD}") - ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") - {{- else }} - ARGS+=("--protected-mode" "no") - {{- end }} - ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") - ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") - {{- if .Values.replica.extraFlags }} - {{- range .Values.replica.extraFlags }} - ARGS+=({{ . | quote }}) - {{- end }} - {{- end }} - {{- if .Values.replica.preExecCmds }} - {{ .Values.replica.preExecCmds | nindent 4 }} - {{- end }} - {{- if .Values.replica.command }} - exec {{ .Values.replica.command }} "${ARGS[@]}" - {{- else }} - exec redis-server "${ARGS[@]}" - {{- end }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/secret.yaml b/rds/base/charts/redis/templates/secret.yaml deleted file mode 100644 index e97a727..0000000 --- a/rds/base/charts/redis/templates/secret.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if and .Values.auth.enabled (not .Values.auth.existingSecret) -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.secretAnnotations .Values.commonAnnotations }} - annotations: - {{- if .Values.secretAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.secretAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -type: Opaque -data: - redis-password: {{ include "redis.password" . | b64enc | quote }} -{{- end -}} diff --git a/rds/base/charts/redis/templates/sentinel/hpa.yaml b/rds/base/charts/redis/templates/sentinel/hpa.yaml deleted file mode 100644 index ef57b5a..0000000 --- a/rds/base/charts/redis/templates/sentinel/hpa.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{- if and .Values.replica.autoscaling.enabled .Values.sentinel.enabled }} -apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }} -kind: HorizontalPodAutoscaler -metadata: - name: {{ printf "%s-node" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: replica - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - scaleTargetRef: - apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} - kind: StatefulSet - name: {{ printf "%s-node" (include "common.names.fullname" .) }} - minReplicas: {{ .Values.replica.autoscaling.minReplicas }} - maxReplicas: {{ .Values.replica.autoscaling.maxReplicas }} - metrics: - {{- if .Values.replica.autoscaling.targetCPU }} - - type: Resource - resource: - name: cpu - {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} - targetAverageUtilization: {{ .Values.replica.autoscaling.targetCPU }} - {{- else }} - target: - type: Utilization - averageUtilization: {{ .Values.replica.autoscaling.targetCPU }} - {{- end }} - {{- end }} - {{- if .Values.replica.autoscaling.targetMemory }} - - type: Resource - resource: - name: memory - {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }} - targetAverageUtilization: {{ .Values.replica.autoscaling.targetMemory }} - {{- else }} - target: - type: Utilization - averageUtilization: {{ .Values.replica.autoscaling.targetMemory }} - {{- end }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/sentinel/node-services.yaml b/rds/base/charts/redis/templates/sentinel/node-services.yaml deleted file mode 100644 index d3e635e..0000000 --- a/rds/base/charts/redis/templates/sentinel/node-services.yaml +++ /dev/null @@ -1,70 +0,0 @@ -{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled (eq .Values.sentinel.service.type "NodePort") (or .Release.IsUpgrade .Values.sentinel.service.nodePorts.redis ) }} - -{{- range $i := until (int .Values.replica.replicaCount) }} - -{{ $portsmap := (lookup "v1" "ConfigMap" $.Release.Namespace (printf "%s-%s" ( include "common.names.fullname" $ ) "ports-configmap")).data }} - -{{ $sentinelport := 0}} -{{ $redisport := 0}} -{{- if $portsmap }} -{{ $sentinelport = index $portsmap (printf "%s-node-%s-%s" (include "common.names.fullname" $) (toString $i) "sentinel") }} -{{ $redisport = index $portsmap (printf "%s-node-%s-%s" (include "common.names.fullname" $) (toString $i) "redis") }} -{{- else }} -{{- end }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" $ }}-node-{{ $i }} - namespace: {{ $.Release.Namespace | quote }} - labels: {{- include "common.labels.standard" $ | nindent 4 }} - app.kubernetes.io/component: node - {{- if $.Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or $.Values.sentinel.service.annotations $.Values.commonAnnotations }} - annotations: - {{- if $.Values.sentinel.service.annotations }} - {{- include "common.tplvalues.render" ( dict "value" $.Values.sentinel.service.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if $.Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -spec: - type: NodePort - ports: - - name: sentinel - {{- if $.Values.sentinel.service.nodePorts.sentinel }} - nodePort: {{ (add $.Values.sentinel.service.nodePorts.sentinel $i 1) }} - port: {{ (add $.Values.sentinel.service.nodePorts.sentinel $i 1) }} - {{- else }} - nodePort: {{ $sentinelport }} - port: {{ $sentinelport }} - {{- end }} - protocol: TCP - targetPort: {{ $.Values.sentinel.containerPorts.sentinel }} - - name: redis - {{- if $.Values.sentinel.service.nodePorts.redis }} - nodePort: {{ (add $.Values.sentinel.service.nodePorts.redis $i 1) }} - port: {{ (add $.Values.sentinel.service.nodePorts.redis $i 1) }} - {{- else }} - nodePort: {{ $redisport }} - port: {{ $redisport }} - {{- end }} - protocol: TCP - targetPort: {{ $.Values.replica.containerPorts.redis }} - - name: sentinel-internal - nodePort: null - port: {{ $.Values.sentinel.containerPorts.sentinel }} - protocol: TCP - targetPort: {{ $.Values.sentinel.containerPorts.sentinel }} - - name: redis-internal - nodePort: null - port: {{ $.Values.replica.containerPorts.redis }} - protocol: TCP - targetPort: {{ $.Values.replica.containerPorts.redis }} - selector: - statefulset.kubernetes.io/pod-name: {{ template "common.names.fullname" $ }}-node-{{ $i }} ---- -{{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/sentinel/ports-configmap.yaml b/rds/base/charts/redis/templates/sentinel/ports-configmap.yaml deleted file mode 100644 index 5d032db..0000000 --- a/rds/base/charts/redis/templates/sentinel/ports-configmap.yaml +++ /dev/null @@ -1,100 +0,0 @@ -{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled (eq .Values.sentinel.service.type "NodePort") (not .Values.sentinel.service.nodePorts.redis ) }} -{{- /* create a list to keep track of ports we choose to use */}} -{{ $chosenports := (list ) }} - -{{- /* Get list of all used nodeports */}} -{{ $usedports := (list ) }} -{{- range $index, $service := (lookup "v1" "Service" "" "").items }} - {{- range.spec.ports }} - {{- if .nodePort }} - {{- $usedports = (append $usedports .nodePort) }} - {{- end }} - {{- end }} -{{- end }} - -{{- /* -comments that start with # are rendered in the output when you debug, so you can less and search for them -Vars in the comment will be rendered out, so you can check their value this way. -https://helm.sh/docs/chart_best_practices/templates/#comments-yaml-comments-vs-template-comments - -remove the template comments and leave the yaml comments to help debug -*/}} - -{{- /* Sort the list */}} -{{ $usedports = $usedports | sortAlpha }} -#usedports {{ $usedports }} - -{{- /* How many nodeports per service do we want to create, except for the main service which is always two */}} -{{ $numberofPortsPerNodeService := 2 }} - -{{- /* for every nodeport we want, loop though the used ports to get an unused port */}} -{{- range $j := until (int (add (mul (int .Values.replica.replicaCount) $numberofPortsPerNodeService) 2)) }} - {{- /* #j={{ $j }} */}} - {{- $nodeport := (add $j 30000) }} - {{- $nodeportfound := false }} - {{- range $i := $usedports }} - {{- /* #i={{ $i }} - #nodeport={{ $nodeport }} - #usedports={{ $usedports }} */}} - {{- if and (has (toString $nodeport) $usedports) (eq $nodeportfound false) }} - {{- /* nodeport conflicts with in use */}} - {{- $nodeport = (add $nodeport 1) }} - {{- else if and ( has $nodeport $chosenports) (eq $nodeportfound false) }} - {{- /* nodeport already chosen, try another */}} - {{- $nodeport = (add $nodeport 1) }} - {{- else if (eq $nodeportfound false) }} - {{- /* nodeport free to use: not already claimed and not in use */}} - {{- /* select nodeport, and place into usedports */}} - {{- $chosenports = (append $chosenports $nodeport) }} - {{- $nodeportfound = true }} - {{- else }} - {{- /* nodeport has already been chosen and locked in, just work through the rest of the list to get to the next nodeport selection */}} - {{- end }} - {{- end }} - {{- if (eq $nodeportfound false) }} - {{- $chosenports = (append $chosenports $nodeport) }} - {{- end }} - -{{- end }} - -{{- /* print the usedports and chosenports for debugging */}} -#usedports {{ $usedports }} -#chosenports {{ $chosenports }}}} - ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "common.names.fullname" . }}-ports-configmap - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: -{{ $portsmap := (lookup "v1" "ConfigMap" $.Release.Namespace (printf "%s-%s" ( include "common.names.fullname" . ) "ports-configmap")).data }} -{{- if $portsmap }} -{{- /* configmap already exists, do not install again */ -}} - {{- range $name, $value := $portsmap }} - "{{ $name }}": "{{ $value }}" - {{- end }} -{{- else }} -{{- /* configmap being set for first time */ -}} - {{- range $index, $port := $chosenports }} - {{- $nodenumber := (floor (div $index 2)) }} - {{- if (eq $index 0) }} - "{{ template "common.names.fullname" $ }}-sentinel": "{{ $port }}" - {{- else if (eq $index 1) }} - "{{ template "common.names.fullname" $ }}-redis": "{{ $port }}" - {{- else if (eq (mod $index 2) 0) }} - "{{ template "common.names.fullname" $ }}-node-{{ (sub $nodenumber 1) }}-sentinel": "{{ $port }}" - {{- else if (eq (mod $index 2) 1) }} - "{{ template "common.names.fullname" $ }}-node-{{ (sub $nodenumber 1) }}-redis": "{{ $port }}" - {{- end }} - {{- end }} -{{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/sentinel/service.yaml b/rds/base/charts/redis/templates/sentinel/service.yaml deleted file mode 100644 index f193730..0000000 --- a/rds/base/charts/redis/templates/sentinel/service.yaml +++ /dev/null @@ -1,103 +0,0 @@ -{{- if or .Release.IsUpgrade (ne .Values.sentinel.service.type "NodePort") .Values.sentinel.service.nodePorts.redis -}} -{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled }} -{{ $portsmap := (lookup "v1" "ConfigMap" $.Release.Namespace (printf "%s-%s" ( include "common.names.fullname" . ) "ports-configmap")).data }} - -{{ $sentinelport := 0}} -{{ $redisport := 0}} -{{- if $portsmap }} -{{ $sentinelport = index $portsmap (printf "%s-%s" (include "common.names.fullname" $) "sentinel") }} -{{ $redisport = index $portsmap (printf "%s-%s" (include "common.names.fullname" $) "redis") }} -{{- else }} -{{- end }} - -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: node - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.sentinel.service.annotations .Values.commonAnnotations }} - annotations: - {{- if .Values.sentinel.service.annotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.service.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -spec: - type: {{ .Values.sentinel.service.type }} - {{- if or (eq .Values.sentinel.service.type "LoadBalancer") (eq .Values.sentinel.service.type "NodePort") }} - externalTrafficPolicy: {{ .Values.sentinel.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if and (eq .Values.sentinel.service.type "LoadBalancer") (not (empty .Values.sentinel.service.loadBalancerIP)) }} - loadBalancerIP: {{ .Values.sentinel.service.loadBalancerIP }} - {{- end }} - {{- if and (eq .Values.sentinel.service.type "LoadBalancer") (not (empty .Values.sentinel.service.loadBalancerSourceRanges)) }} - loadBalancerSourceRanges: {{ .Values.sentinel.service.loadBalancerSourceRanges }} - {{- end }} - {{- if and .Values.sentinel.service.clusterIP (eq .Values.sentinel.service.type "ClusterIP") }} - clusterIP: {{ .Values.sentinel.service.clusterIP }} - {{- end }} - {{- if .Values.sentinel.service.sessionAffinity }} - sessionAffinity: {{ .Values.sentinel.service.sessionAffinity }} - {{- end }} - {{- if .Values.sentinel.service.sessionAffinityConfig }} - sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.service.sessionAffinityConfig "context" $) | nindent 4 }} - {{- end }} - ports: - - name: tcp-redis - {{- if and (or (eq .Values.sentinel.service.type "NodePort") (eq .Values.sentinel.service.type "LoadBalancer")) .Values.sentinel.service.nodePorts.redis }} - port: {{ .Values.sentinel.service.nodePorts.redis }} - {{- else if eq .Values.sentinel.service.type "NodePort" }} - port: {{ $redisport }} - {{- else}} - port: {{ .Values.sentinel.service.ports.redis }} - {{- end }} - targetPort: {{ .Values.replica.containerPorts.redis }} - {{- if and (or (eq .Values.sentinel.service.type "NodePort") (eq .Values.sentinel.service.type "LoadBalancer")) .Values.sentinel.service.nodePorts.redis }} - nodePort: {{ .Values.sentinel.service.nodePorts.redis }} - {{- else if eq .Values.sentinel.service.type "ClusterIP" }} - nodePort: null - {{- else if eq .Values.sentinel.service.type "NodePort" }} - nodePort: {{ $redisport }} - {{- end }} - - name: tcp-sentinel - {{- if and (or (eq .Values.sentinel.service.type "NodePort") (eq .Values.sentinel.service.type "LoadBalancer")) .Values.sentinel.service.nodePorts.sentinel }} - port: {{ .Values.sentinel.service.nodePorts.sentinel }} - {{- else if eq .Values.sentinel.service.type "NodePort" }} - port: {{ $sentinelport }} - {{- else }} - port: {{ .Values.sentinel.service.ports.sentinel }} - {{- end }} - targetPort: {{ .Values.sentinel.containerPorts.sentinel }} - {{- if and (or (eq .Values.sentinel.service.type "NodePort") (eq .Values.sentinel.service.type "LoadBalancer")) .Values.sentinel.service.nodePorts.sentinel }} - nodePort: {{ .Values.sentinel.service.nodePorts.sentinel }} - {{- else if eq .Values.sentinel.service.type "ClusterIP" }} - nodePort: null - {{- else if eq .Values.sentinel.service.type "NodePort" }} - nodePort: {{ $sentinelport }} - {{- end }} - {{- if eq .Values.sentinel.service.type "NodePort" }} - - name: sentinel-internal - nodePort: null - port: {{ .Values.sentinel.containerPorts.sentinel }} - protocol: TCP - targetPort: {{ .Values.sentinel.containerPorts.sentinel }} - - name: redis-internal - nodePort: null - port: {{ .Values.replica.containerPorts.redis }} - protocol: TCP - targetPort: {{ .Values.replica.containerPorts.redis }} - {{- end }} - {{- if .Values.sentinel.service.extraPorts }} - {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.service.extraPorts "context" $) | nindent 4 }} - {{- end }} - selector: {{- include "common.labels.matchLabels" . | nindent 4 }} - app.kubernetes.io/component: node -{{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/sentinel/statefulset.yaml b/rds/base/charts/redis/templates/sentinel/statefulset.yaml deleted file mode 100644 index 6b301c1..0000000 --- a/rds/base/charts/redis/templates/sentinel/statefulset.yaml +++ /dev/null @@ -1,688 +0,0 @@ -{{- if or .Release.IsUpgrade (ne .Values.sentinel.service.type "NodePort") .Values.sentinel.service.nodePorts.redis -}} -{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled }} -apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ printf "%s-node" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: node - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - replicas: {{ .Values.replica.replicaCount }} - selector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} - app.kubernetes.io/component: node - serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }} - {{- if .Values.replica.updateStrategy }} - updateStrategy: {{- toYaml .Values.replica.updateStrategy | nindent 4 }} - {{- end }} - {{- if .Values.replica.podManagementPolicy }} - podManagementPolicy: {{ .Values.replica.podManagementPolicy | quote }} - {{- end }} - template: - metadata: - labels: {{- include "common.labels.standard" . | nindent 8 }} - app.kubernetes.io/component: node - {{- if .Values.replica.podLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.podLabels "context" $ ) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podLabels "context" $ ) | nindent 8 }} - {{- end }} - annotations: - {{- if (include "redis.createConfigmap" .) }} - checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - {{- end }} - checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} - checksum/scripts: {{ include (print $.Template.BasePath "/scripts-configmap.yaml") . | sha256sum }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- if .Values.replica.podAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.podAnnotations "context" $ ) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podAnnotations "context" $ ) | nindent 8 }} - {{- end }} - spec: - {{- include "redis.imagePullSecrets" . | nindent 6 }} - {{- if .Values.replica.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.replica.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.replica.podSecurityContext.enabled }} - securityContext: {{- omit .Values.replica.podSecurityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - serviceAccountName: {{ template "redis.serviceAccountName" . }} - {{- if .Values.replica.priorityClassName }} - priorityClassName: {{ .Values.replica.priorityClassName | quote }} - {{- end }} - {{- if .Values.replica.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.replica.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAffinityPreset "component" "node" "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAntiAffinityPreset "component" "node" "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.replica.nodeAffinityPreset.type "key" .Values.replica.nodeAffinityPreset.key "values" .Values.replica.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.replica.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.replica.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.replica.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.replica.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.replica.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.replica.topologySpreadConstraints "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.replica.shareProcessNamespace }} - shareProcessNamespace: {{ .Values.replica.shareProcessNamespace }} - {{- end }} - {{- if .Values.replica.schedulerName }} - schedulerName: {{ .Values.replica.schedulerName | quote }} - {{- end }} - {{- if .Values.replica.dnsPolicy }} - dnsPolicy: {{ .Values.replica.dnsPolicy }} - {{- end }} - {{- if .Values.replica.dnsConfig }} - dnsConfig: {{- include "common.tplvalues.render" (dict "value" .Values.replica.dnsConfig "context" $) | nindent 8 }} - {{- end }} - terminationGracePeriodSeconds: {{ .Values.sentinel.terminationGracePeriodSeconds }} - containers: - - name: redis - image: {{ template "redis.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.replica.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.replica.lifecycleHooks "context" $) | nindent 12 }} - {{- else }} - lifecycle: - preStop: - exec: - command: - - /bin/bash - - -c - - /opt/bitnami/scripts/start-scripts/prestop-redis.sh - {{- end }} - {{- end }} - {{- if .Values.replica.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.replica.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.replica.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.replica.command "context" $) | nindent 12 }} - {{- else }} - command: - - /bin/bash - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.replica.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.replica.args "context" $) | nindent 12 }} - {{- else }} - args: - - -c - - /opt/bitnami/scripts/start-scripts/start-node.sh - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - - name: REDIS_MASTER_PORT_NUMBER - value: {{ .Values.replica.containerPorts.redis | quote }} - - name: ALLOW_EMPTY_PASSWORD - value: {{ ternary "no" "yes" .Values.auth.enabled | quote }} - {{- if .Values.auth.enabled }} - {{- if .Values.auth.usePasswordFiles }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - - name: REDIS_MASTER_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - - name: REDIS_MASTER_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- end }} - - name: REDIS_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_PORT - value: {{ .Values.replica.containerPorts.redis | quote }} - - name: REDIS_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_TLS_DH_PARAMS_FILE - value: {{ template "redis.tlsDHParams" . }} - {{- end }} - {{- else }} - - name: REDIS_PORT - value: {{ .Values.replica.containerPorts.redis | quote }} - {{- end }} - - name: REDIS_DATA_DIR - value: {{ .Values.replica.persistence.path }} - {{- if .Values.replica.externalMaster.enabled }} - - name: REDIS_EXTERNAL_MASTER_HOST - value: {{ .Values.replica.externalMaster.host | quote }} - - name: REDIS_EXTERNAL_MASTER_PORT - value: {{ .Values.replica.externalMaster.port | quote }} - {{- end }} - {{- if .Values.replica.extraEnvVars }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraEnvVars "context" $ ) | nindent 12 }} - {{- end }} - {{- if or .Values.replica.extraEnvVarsCM .Values.replica.extraEnvVarsSecret }} - envFrom: - {{- if .Values.replica.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.replica.extraEnvVarsCM }} - {{- end }} - {{- if .Values.replica.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.replica.extraEnvVarsSecret }} - {{- end }} - {{- end }} - ports: - - name: redis - containerPort: {{ .Values.replica.containerPorts.redis }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.replica.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.replica.startupProbe "enabled") "context" $) | nindent 12 }} - tcpSocket: - port: redis - {{- else if .Values.replica.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customStartupProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.replica.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.replica.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.replica.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.replica.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.replica.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.replica.livenessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_liveness_local.sh {{ .Values.replica.livenessProbe.timeoutSeconds }} - {{- else if .Values.replica.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.replica.readinessProbe.enabled }} - readinessProbe: - initialDelaySeconds: {{ .Values.replica.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.replica.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.replica.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.replica.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.replica.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_readiness_local.sh {{ .Values.replica.readinessProbe.timeoutSeconds }} - {{- else if .Values.replica.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.replica.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.replica.resources }} - resources: {{- toYaml .Values.replica.resources | nindent 12 }} - {{- end }} - volumeMounts: - - name: start-scripts - mountPath: /opt/bitnami/scripts/start-scripts - - name: health - mountPath: /health - {{- if .Values.sentinel.persistence.enabled }} - - name: sentinel-data - mountPath: /opt/bitnami/redis-sentinel/etc - {{- end }} - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: {{ .Values.replica.persistence.path }} - subPath: {{ .Values.replica.persistence.subPath }} - - name: config - mountPath: /opt/bitnami/redis/mounted-etc - - name: redis-tmp-conf - mountPath: /opt/bitnami/redis/etc - - name: tmp - mountPath: /tmp - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.replica.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - - name: sentinel - image: {{ template "redis.sentinel.image" . }} - imagePullPolicy: {{ .Values.sentinel.image.pullPolicy | quote }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.sentinel.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.lifecycleHooks "context" $) | nindent 12 }} - {{- else }} - lifecycle: - preStop: - exec: - command: - - /bin/bash - - -c - - /opt/bitnami/scripts/start-scripts/prestop-sentinel.sh - {{- end }} - {{- end }} - {{- if .Values.sentinel.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.sentinel.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else if .Values.sentinel.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.command "context" $) | nindent 12 }} - {{- else }} - command: - - /bin/bash - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- else if .Values.sentinel.args }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.args "context" $) | nindent 12 }} - {{- else }} - args: - - -c - - /opt/bitnami/scripts/start-scripts/start-sentinel.sh - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.sentinel.image.debug .Values.diagnosticMode.enabled) | quote }} - {{- if .Values.auth.enabled }} - {{- if .Values.auth.usePasswordFiles }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- else }} - - name: ALLOW_EMPTY_PASSWORD - value: "yes" - {{- end }} - - name: REDIS_SENTINEL_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_SENTINEL_TLS_PORT_NUMBER - value: {{ .Values.sentinel.containerPorts.sentinel | quote }} - - name: REDIS_SENTINEL_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_SENTINEL_TLS_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_SENTINEL_TLS_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_SENTINEL_TLS_CA_FILE - value: {{ template "redis.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_SENTINEL_TLS_DH_PARAMS_FILE - value: {{ template "redis.tls.dhParamsFilename" . }} - {{- end }} - {{- else }} - - name: REDIS_SENTINEL_PORT - value: {{ .Values.sentinel.containerPorts.sentinel | quote }} - {{- end }} - {{- if .Values.sentinel.externalMaster.enabled }} - - name: REDIS_EXTERNAL_MASTER_HOST - value: {{ .Values.sentinel.externalMaster.host | quote }} - - name: REDIS_EXTERNAL_MASTER_PORT - value: {{ .Values.sentinel.externalMaster.port | quote }} - {{- end }} - {{- if .Values.sentinel.extraEnvVars }} - {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.extraEnvVars "context" $ ) | nindent 12 }} - {{- end }} - {{- if or .Values.sentinel.extraEnvVarsCM .Values.sentinel.extraEnvVarsSecret }} - envFrom: - {{- if .Values.sentinel.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.sentinel.extraEnvVarsCM }} - {{- end }} - {{- if .Values.sentinel.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.sentinel.extraEnvVarsSecret }} - {{- end }} - {{- end }} - ports: - - name: redis-sentinel - containerPort: {{ .Values.sentinel.containerPorts.sentinel }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.sentinel.startupProbe.enabled }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.sentinel.startupProbe "enabled") "context" $) | nindent 12 }} - tcpSocket: - port: redis-sentinel - {{- else if .Values.sentinel.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.customStartupProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.sentinel.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.sentinel.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.sentinel.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.sentinel.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.sentinel.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.sentinel.livenessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_sentinel.sh {{ .Values.sentinel.livenessProbe.timeoutSeconds }} - {{- else if .Values.sentinel.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- end }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.sentinel.readinessProbe.enabled }} - readinessProbe: - initialDelaySeconds: {{ .Values.sentinel.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.sentinel.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.sentinel.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.sentinel.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.sentinel.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_sentinel.sh {{ .Values.sentinel.livenessProbe.timeoutSeconds }} - {{- else if .Values.sentinel.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.sentinel.resources }} - resources: {{- toYaml .Values.sentinel.resources | nindent 12 }} - {{- end }} - volumeMounts: - - name: start-scripts - mountPath: /opt/bitnami/scripts/start-scripts - - name: health - mountPath: /health - - name: sentinel-data - mountPath: /opt/bitnami/redis-sentinel/etc - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: {{ .Values.replica.persistence.path }} - subPath: {{ .Values.replica.persistence.subPath }} - - name: config - mountPath: /opt/bitnami/redis-sentinel/mounted-etc - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.sentinel.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ template "redis.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.metrics.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - {{- else }} - command: - - /bin/bash - - -c - - | - if [[ -f '/secrets/redis-password' ]]; then - export REDIS_PASSWORD=$(cat /secrets/redis-password) - fi - redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- end }} - env: - - name: REDIS_ALIAS - value: {{ template "common.names.fullname" . }} - {{- if .Values.auth.enabled }} - - name: REDIS_USER - value: default - {{- if (not .Values.auth.usePasswordFiles) }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: REDIS_ADDR - value: rediss://{{ .Values.metrics.redisTargetHost }}:{{ .Values.replica.containerPorts.redis }} - {{- if .Values.tls.authClients }} - - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE - value: {{ template "redis.tlsCert" . }} - {{- end }} - - name: REDIS_EXPORTER_TLS_CA_CERT_FILE - value: {{ template "redis.tlsCACert" . }} - {{- end }} - {{- if .Values.metrics.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - ports: - - name: metrics - containerPort: 9121 - {{- if .Values.metrics.resources }} - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- end }} - volumeMounts: - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - mountPath: /secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.metrics.extraVolumeMounts }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.extraVolumeMounts "context" $ ) | nindent 12 }} - {{- end }} - {{- end }} - {{- if .Values.replica.sidecars }} - {{- include "common.tplvalues.render" (dict "value" .Values.replica.sidecars "context" $) | nindent 8 }} - {{- end }} - {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.replica.persistence.enabled .Values.replica.podSecurityContext.enabled .Values.replica.containerSecurityContext.enabled }} - {{- if or .Values.replica.initContainers $needsVolumePermissions .Values.sysctl.enabled }} - initContainers: - {{- if .Values.replica.initContainers }} - {{- include "common.tplvalues.render" (dict "value" .Values.replica.initContainers "context" $) | nindent 8 }} - {{- end }} - {{- if $needsVolumePermissions }} - - name: volume-permissions - image: {{ include "redis.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/bash - - -ec - - | - {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.replica.persistence.path }} - {{- else }} - chown -R {{ .Values.replica.containerSecurityContext.runAsUser }}:{{ .Values.replica.podSecurityContext.fsGroup }} {{ .Values.replica.persistence.path }} - {{- end }} - {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} - securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.volumePermissions.resources }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - {{- end }} - volumeMounts: - - name: redis-data - mountPath: {{ .Values.replica.persistence.path }} - subPath: {{ .Values.replica.persistence.subPath }} - {{- end }} - {{- if .Values.sysctl.enabled }} - - name: init-sysctl - image: {{ include "redis.sysctl.image" . }} - imagePullPolicy: {{ default "" .Values.sysctl.image.pullPolicy | quote }} - securityContext: - privileged: true - runAsUser: 0 - {{- if .Values.sysctl.command }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.sysctl.command "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.sysctl.resources }} - resources: {{- toYaml .Values.sysctl.resources | nindent 12 }} - {{- end }} - {{- if .Values.sysctl.mountHostSys }} - volumeMounts: - - name: host-sys - mountPath: /host-sys - {{- end }} - {{- end }} - {{- end }} - volumes: - - name: start-scripts - configMap: - name: {{ printf "%s-scripts" (include "common.names.fullname" .) }} - defaultMode: 0755 - - name: health - configMap: - name: {{ printf "%s-health" (include "common.names.fullname" .) }} - defaultMode: 0755 - {{- if .Values.auth.usePasswordFiles }} - - name: redis-password - secret: - secretName: {{ template "redis.secretName" . }} - items: - - key: {{ template "redis.secretPasswordKey" . }} - path: redis-password - {{- end }} - - name: config - configMap: - name: {{ include "redis.configmapName" . }} - {{- if .Values.sysctl.mountHostSys }} - - name: host-sys - hostPath: - path: /sys - {{- end }} - {{- if not .Values.sentinel.persistence.enabled }} - - name: sentinel-data - {{- if .Values.sentinel.persistence.medium }} - emptyDir: { - medium: {{ .Values.sentinel.persistence.medium | quote }} - } - {{- else }} - emptyDir: {} - {{- end }} - {{- end }} - - name: redis-tmp-conf - {{- if .Values.replica.persistence.medium }} - emptyDir: { - medium: {{ .Values.replica.persistence.medium | quote }} - } - {{- else }} - emptyDir: {} - {{- end }} - - name: tmp - {{- if .Values.replica.persistence.medium }} - emptyDir: { - medium: {{ .Values.replica.persistence.medium | quote }} - } - {{- else }} - emptyDir: {} - {{- end }} - {{- if .Values.replica.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.metrics.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.sentinel.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - secret: - secretName: {{ include "redis.tlsSecretName" . }} - defaultMode: 256 - {{- end }} - {{- if not .Values.replica.persistence.enabled }} - - name: redis-data - {{- if .Values.replica.persistence.medium }} - emptyDir: { - medium: {{ .Values.replica.persistence.medium | quote }} - } - {{- else }} - emptyDir: {} - {{- end }} - {{- else }} - volumeClaimTemplates: - - metadata: - name: redis-data - labels: {{- include "common.labels.matchLabels" . | nindent 10 }} - app.kubernetes.io/component: node - {{- if .Values.replica.persistence.annotations }} - annotations: {{- toYaml .Values.replica.persistence.annotations | nindent 10 }} - {{- end }} - spec: - accessModes: - {{- range .Values.replica.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.replica.persistence.size | quote }} - {{- if .Values.replica.persistence.selector }} - selector: {{- include "common.tplvalues.render" ( dict "value" .Values.replica.persistence.selector "context" $) | nindent 10 }} - {{- end }} - {{- include "common.storage.class" (dict "persistence" .Values.replica.persistence "global" .Values.global) | nindent 8 }} - {{- if .Values.sentinel.persistence.enabled }} - - metadata: - name: sentinel-data - labels: {{- include "common.labels.matchLabels" . | nindent 10 }} - app.kubernetes.io/component: node - {{- if .Values.sentinel.persistence.annotations }} - annotations: {{- toYaml .Values.sentinel.persistence.annotations | nindent 10 }} - {{- end }} - spec: - accessModes: - {{- range .Values.sentinel.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.sentinel.persistence.size | quote }} - {{- if .Values.sentinel.persistence.selector }} - selector: {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.persistence.selector "context" $) | nindent 10 }} - {{- end }} - {{- if .Values.sentinel.persistence.dataSource }} - dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.persistence.dataSource "context" $) | nindent 10 }} - {{- end }} - {{- include "common.storage.class" (dict "persistence" .Values.sentinel.persistence "global" .Values.global) | nindent 8 }} - {{- end }} - {{- end }} -{{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/serviceaccount.yaml b/rds/base/charts/redis/templates/serviceaccount.yaml deleted file mode 100644 index b3e59d9..0000000 --- a/rds/base/charts/redis/templates/serviceaccount.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.serviceAccount.create }} -apiVersion: v1 -kind: ServiceAccount -automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} -metadata: - name: {{ template "redis.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if or .Values.commonAnnotations .Values.serviceAccount.annotations }} - annotations: - {{- if or .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.serviceAccount.annotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.serviceAccount.annotations "context" $ ) | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/redis/templates/servicemonitor.yaml b/rds/base/charts/redis/templates/servicemonitor.yaml deleted file mode 100644 index c3bf13d..0000000 --- a/rds/base/charts/redis/templates/servicemonitor.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace .Values.metrics.serviceMonitor.namespace | quote }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.additionalLabels "context" $) | nindent 4 }} - {{- end }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - endpoints: - - port: http-metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.honorLabels }} - honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabellings }} - relabelings: {{- toYaml .Values.metrics.serviceMonitor.relabellings | nindent 6 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{- toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 6 }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - selector: - matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} - app.kubernetes.io/component: metrics -{{- end }} diff --git a/rds/base/charts/redis/templates/tls-secret.yaml b/rds/base/charts/redis/templates/tls-secret.yaml deleted file mode 100644 index 5afd4ef..0000000 --- a/rds/base/charts/redis/templates/tls-secret.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if (include "redis.createTlsSecret" .) }} -{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }} -{{- $existingCerts := (lookup "v1" "Secret" .Release.Namespace $secretName).data | default dict }} -{{- $ca := genCA "redis-ca" 365 }} -{{- $releaseNamespace := .Release.Namespace }} -{{- $clusterDomain := .Values.clusterDomain }} -{{- $fullname := include "common.names.fullname" . }} -{{- $serviceName := include "common.names.fullname" . }} -{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) }} -{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) "127.0.0.1" "localhost" $fullname }} -{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ $secretName }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: kubernetes.io/tls -data: - ca.crt: {{ (get $existingCerts "ca.crt") | default ($ca.Cert | b64enc | quote ) }} - tls.crt: {{ (get $existingCerts "tls.crt") | default ($crt.Cert | b64enc | quote) }} - tls.key: {{ (get $existingCerts "tls.key") | default ($crt.Key | b64enc | quote) }} -{{- end }} diff --git a/rds/base/charts/redis/values.schema.json b/rds/base/charts/redis/values.schema.json deleted file mode 100644 index d6e226b..0000000 --- a/rds/base/charts/redis/values.schema.json +++ /dev/null @@ -1,156 +0,0 @@ -{ - "$schema": "http://json-schema.org/schema#", - "type": "object", - "properties": { - "architecture": { - "type": "string", - "title": "Redis architecture", - "form": true, - "description": "Allowed values: `standalone` or `replication`", - "enum": ["standalone", "replication"] - }, - "auth": { - "type": "object", - "title": "Authentication configuration", - "form": true, - "properties": { - "enabled": { - "type": "boolean", - "form": true, - "title": "Use password authentication" - }, - "password": { - "type": "string", - "title": "Redis password", - "form": true, - "description": "Defaults to a random 10-character alphanumeric string if not set", - "hidden": { - "value": false, - "path": "auth/enabled" - } - } - } - }, - "master": { - "type": "object", - "title": "Master replicas settings", - "form": true, - "properties": { - "kind": { - "type": "string", - "title": "Workload Kind", - "form": true, - "description": "Allowed values: `Deployment` or `StatefulSet`", - "enum": ["Deployment", "StatefulSet"] - }, - "persistence": { - "type": "object", - "title": "Persistence for master replicas", - "form": true, - "properties": { - "enabled": { - "type": "boolean", - "form": true, - "title": "Enable persistence", - "description": "Enable persistence using Persistent Volume Claims" - }, - "size": { - "type": "string", - "title": "Persistent Volume Size", - "form": true, - "render": "slider", - "sliderMin": 1, - "sliderMax": 100, - "sliderUnit": "Gi", - "hidden": { - "value": false, - "path": "master/persistence/enabled" - } - } - } - } - } - }, - "replica": { - "type": "object", - "title": "Redis replicas settings", - "form": true, - "hidden": { - "value": "standalone", - "path": "architecture" - }, - "properties": { - "replicaCount": { - "type": "integer", - "form": true, - "title": "Number of Redis replicas" - }, - "persistence": { - "type": "object", - "title": "Persistence for Redis replicas", - "form": true, - "properties": { - "enabled": { - "type": "boolean", - "form": true, - "title": "Enable persistence", - "description": "Enable persistence using Persistent Volume Claims" - }, - "size": { - "type": "string", - "title": "Persistent Volume Size", - "form": true, - "render": "slider", - "sliderMin": 1, - "sliderMax": 100, - "sliderUnit": "Gi", - "hidden": { - "value": false, - "path": "replica/persistence/enabled" - } - } - } - } - } - }, - "volumePermissions": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "form": true, - "title": "Enable Init Containers", - "description": "Use an init container to set required folder permissions on the data volume before mounting it in the final destination" - } - } - }, - "metrics": { - "type": "object", - "form": true, - "title": "Prometheus metrics details", - "properties": { - "enabled": { - "type": "boolean", - "title": "Create Prometheus metrics exporter", - "description": "Create a side-car container to expose Prometheus metrics", - "form": true - }, - "serviceMonitor": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "title": "Create Prometheus Operator ServiceMonitor", - "description": "Create a ServiceMonitor to track metrics using Prometheus Operator", - "form": true, - "hidden": { - "value": false, - "path": "metrics/enabled" - } - } - } - } - } - } - } -} diff --git a/rds/base/charts/redis/values.yaml b/rds/base/charts/redis/values.yaml deleted file mode 100644 index c25a3b2..0000000 --- a/rds/base/charts/redis/values.yaml +++ /dev/null @@ -1,1621 +0,0 @@ -## @section Global parameters -## Global Docker image parameters -## Please, note that this will override the image parameters, including dependencies, configured to use the global value -## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass -## - -## @param global.imageRegistry Global Docker image registry -## @param global.imagePullSecrets Global Docker registry secret names as an array -## @param global.storageClass Global StorageClass for Persistent Volume(s) -## @param global.redis.password Global Redis® password (overrides `auth.password`) -## -global: - imageRegistry: "" - ## E.g. - ## imagePullSecrets: - ## - myRegistryKeySecretName - ## - imagePullSecrets: [] - storageClass: "" - redis: - password: "" - -## @section Common parameters -## - -## @param kubeVersion Override Kubernetes version -## -kubeVersion: "" -## @param nameOverride String to partially override common.names.fullname -## -nameOverride: "" -## @param fullnameOverride String to fully override common.names.fullname -## -fullnameOverride: "" -## @param commonLabels Labels to add to all deployed objects -## -commonLabels: {} -## @param commonAnnotations Annotations to add to all deployed objects -## -commonAnnotations: {} -## @param secretAnnotations Annotations to add to secret -## -secretAnnotations: {} -## @param clusterDomain Kubernetes cluster domain name -## -clusterDomain: cluster.local -## @param extraDeploy Array of extra objects to deploy with the release -## -extraDeploy: [] - -## Enable diagnostic mode in the deployment -## -diagnosticMode: - ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) - ## - enabled: false - ## @param diagnosticMode.command Command to override all containers in the deployment - ## - command: - - sleep - ## @param diagnosticMode.args Args to override all containers in the deployment - ## - args: - - infinity - -## @section Redis® Image parameters -## - -## Bitnami Redis® image -## ref: https://hub.docker.com/r/bitnami/redis/tags/ -## @param image.registry Redis® image registry -## @param image.repository Redis® image repository -## @param image.tag Redis® image tag (immutable tags are recommended) -## @param image.pullPolicy Redis® image pull policy -## @param image.pullSecrets Redis® image pull secrets -## @param image.debug Enable image debug mode -## -image: - registry: docker.io - repository: bitnami/redis - tag: 6.2.7-debian-11-r11 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Enable debug mode - ## - debug: false - -## @section Redis® common configuration parameters -## https://github.com/bitnami/bitnami-docker-redis#configuration -## - -## @param architecture Redis® architecture. Allowed values: `standalone` or `replication` -## -architecture: replication -## Redis® Authentication parameters -## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run -## -auth: - ## @param auth.enabled Enable password authentication - ## - enabled: true - ## @param auth.sentinel Enable password authentication on sentinels too - ## - sentinel: true - ## @param auth.password Redis® password - ## Defaults to a random 10-character alphanumeric string if not set - ## - password: "" - ## @param auth.existingSecret The name of an existing secret with Redis® credentials - ## NOTE: When it's set, the previous `auth.password` parameter is ignored - ## - existingSecret: "" - ## @param auth.existingSecretPasswordKey Password key to be retrieved from existing secret - ## NOTE: ignored unless `auth.existingSecret` parameter is set - ## - existingSecretPasswordKey: "" - ## @param auth.usePasswordFiles Mount credentials as files instead of using an environment variable - ## - usePasswordFiles: false - -## @param commonConfiguration [string] Common configuration to be added into the ConfigMap -## ref: https://redis.io/topics/config -## -commonConfiguration: |- - # Enable AOF https://redis.io/topics/persistence#append-only-file - appendonly yes - # Disable RDB persistence, AOF persistence already enabled. - save "" -## @param existingConfigmap The name of an existing ConfigMap with your custom configuration for Redis® nodes -## -existingConfigmap: "" - -## @section Redis® master configuration parameters -## - -master: - ## @param master.count Number of Redis® master instances to deploy (experimental, requires additional configuration) - ## - count: 1 - ## @param master.configuration Configuration for Redis® master nodes - ## ref: https://redis.io/topics/config - ## - configuration: "" - ## @param master.disableCommands Array with Redis® commands to disable on master nodes - ## Commands will be completely disabled by renaming each to an empty string. - ## ref: https://redis.io/topics/security#disabling-of-specific-commands - ## - disableCommands: - - FLUSHDB - - FLUSHALL - ## @param master.command Override default container command (useful when using custom images) - ## - command: [] - ## @param master.args Override default container args (useful when using custom images) - ## - args: [] - ## @param master.preExecCmds Additional commands to run prior to starting Redis® master - ## - preExecCmds: [] - ## @param master.extraFlags Array with additional command line flags for Redis® master - ## e.g: - ## extraFlags: - ## - "--maxmemory-policy volatile-ttl" - ## - "--repl-backlog-size 1024mb" - ## - extraFlags: [] - ## @param master.extraEnvVars Array with extra environment variables to add to Redis® master nodes - ## e.g: - ## extraEnvVars: - ## - name: FOO - ## value: "bar" - ## - extraEnvVars: [] - ## @param master.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Redis® master nodes - ## - extraEnvVarsCM: "" - ## @param master.extraEnvVarsSecret Name of existing Secret containing extra env vars for Redis® master nodes - ## - extraEnvVarsSecret: "" - ## @param master.containerPorts.redis Container port to open on Redis® master nodes - ## - containerPorts: - redis: 6379 - ## Configure extra options for Redis® containers' liveness and readiness probes - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes - ## @param master.startupProbe.enabled Enable startupProbe on Redis® master nodes - ## @param master.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe - ## @param master.startupProbe.periodSeconds Period seconds for startupProbe - ## @param master.startupProbe.timeoutSeconds Timeout seconds for startupProbe - ## @param master.startupProbe.failureThreshold Failure threshold for startupProbe - ## @param master.startupProbe.successThreshold Success threshold for startupProbe - ## - startupProbe: - enabled: false - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 5 - ## @param master.livenessProbe.enabled Enable livenessProbe on Redis® master nodes - ## @param master.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param master.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param master.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param master.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param master.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 5 - ## @param master.readinessProbe.enabled Enable readinessProbe on Redis® master nodes - ## @param master.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param master.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param master.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param master.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param master.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 5 - ## @param master.customStartupProbe Custom startupProbe that overrides the default one - ## - customStartupProbe: {} - ## @param master.customLivenessProbe Custom livenessProbe that overrides the default one - ## - customLivenessProbe: {} - ## @param master.customReadinessProbe Custom readinessProbe that overrides the default one - ## - customReadinessProbe: {} - ## Redis® master resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param master.resources.limits The resources limits for the Redis® master containers - ## @param master.resources.requests The requested resources for the Redis® master containers - ## - resources: - limits: {} - requests: {} - ## Configure Pods Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param master.podSecurityContext.enabled Enabled Redis® master pods' Security Context - ## @param master.podSecurityContext.fsGroup Set Redis® master pod's Security Context fsGroup - ## - podSecurityContext: - enabled: true - fsGroup: 1001 - ## Configure Container Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param master.containerSecurityContext.enabled Enabled Redis® master containers' Security Context - ## @param master.containerSecurityContext.runAsUser Set Redis® master containers' Security Context runAsUser - ## - containerSecurityContext: - enabled: true - runAsUser: 1001 - ## @param master.kind Use either Deployment or StatefulSet (default) - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ - ## - kind: StatefulSet - ## @param master.schedulerName Alternate scheduler for Redis® master pods - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param master.updateStrategy.type Redis® master statefulset strategy type - ## @skip master.updateStrategy.rollingUpdate - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - ## - updateStrategy: - ## StrategyType - ## Can be set to RollingUpdate or OnDelete - ## - type: RollingUpdate - rollingUpdate: {} - ## @param master.priorityClassName Redis® master pods' priorityClassName - ## - priorityClassName: "" - ## @param master.hostAliases Redis® master pods host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param master.podLabels Extra labels for Redis® master pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param master.podAnnotations Annotations for Redis® master pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param master.shareProcessNamespace Share a single process namespace between all of the containers in Redis® master pods - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ - ## - shareProcessNamespace: false - ## @param master.podAffinityPreset Pod affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param master.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Node master.affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param master.nodeAffinityPreset.type Node affinity preset type. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param master.nodeAffinityPreset.key Node label key to match. Ignored if `master.affinity` is set - ## - key: "" - ## @param master.nodeAffinityPreset.values Node label values to match. Ignored if `master.affinity` is set - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param master.affinity Affinity for Redis® master pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## NOTE: `master.podAffinityPreset`, `master.podAntiAffinityPreset`, and `master.nodeAffinityPreset` will be ignored when it's set - ## - affinity: {} - ## @param master.nodeSelector Node labels for Redis® master pods assignment - ## ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param master.tolerations Tolerations for Redis® master pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param master.topologySpreadConstraints Spread Constraints for Redis® master pod assignment - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## E.g. - ## topologySpreadConstraints: - ## - maxSkew: 1 - ## topologyKey: node - ## whenUnsatisfiable: DoNotSchedule - ## - topologySpreadConstraints: [] - ## @param master.dnsPolicy DNS Policy for Redis® master pod - ## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/ - ## E.g. - ## dnsPolicy: ClusterFirst - dnsPolicy: "" - ## @param master.dnsConfig DNS Configuration for Redis® master pod - ## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/ - ## E.g. - ## dnsConfig: - ## options: - ## - name: ndots - ## value: "4" - ## - name: single-request-reopen - dnsConfig: {} - ## @param master.lifecycleHooks for the Redis® master container(s) to automate configuration before or after startup - ## - lifecycleHooks: {} - ## @param master.extraVolumes Optionally specify extra list of additional volumes for the Redis® master pod(s) - ## - extraVolumes: [] - ## @param master.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Redis® master container(s) - ## - extraVolumeMounts: [] - ## @param master.sidecars Add additional sidecar containers to the Redis® master pod(s) - ## e.g: - ## sidecars: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## ports: - ## - name: portname - ## containerPort: 1234 - ## - sidecars: [] - ## @param master.initContainers Add additional init containers to the Redis® master pod(s) - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ - ## e.g: - ## initContainers: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## command: ['sh', '-c', 'echo "hello world"'] - ## - initContainers: [] - ## Persistence parameters - ## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/ - ## - persistence: - ## @param master.persistence.enabled Enable persistence on Redis® master nodes using Persistent Volume Claims - ## - enabled: true - ## @param master.persistence.medium Provide a medium for `emptyDir` volumes. - ## - medium: "" - ## @param master.persistence.sizeLimit Set this to enable a size limit for `emptyDir` volumes. - ## - sizeLimit: "" - ## @param master.persistence.path The path the volume will be mounted at on Redis® master containers - ## NOTE: Useful when using different Redis® images - ## - path: /data - ## @param master.persistence.subPath The subdirectory of the volume to mount on Redis® master containers - ## NOTE: Useful in dev environments - ## - subPath: "" - ## @param master.persistence.storageClass Persistent Volume storage class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner - ## - storageClass: "" - ## @param master.persistence.accessModes Persistent Volume access modes - ## - accessModes: - - ReadWriteOnce - ## @param master.persistence.size Persistent Volume size - ## - size: 8Gi - ## @param master.persistence.annotations Additional custom annotations for the PVC - ## - annotations: {} - ## @param master.persistence.selector Additional labels to match for the PVC - ## e.g: - ## selector: - ## matchLabels: - ## app: my-app - ## - selector: {} - ## @param master.persistence.dataSource Custom PVC data source - ## - dataSource: {} - ## @param master.persistence.existingClaim Use a existing PVC which must be created manually before bound - ## NOTE: requires master.persistence.enabled: true - ## - existingClaim: "" - ## Redis® master service parameters - ## - service: - ## @param master.service.type Redis® master service type - ## - type: ClusterIP - ## @param master.service.ports.redis Redis® master service port - ## - ports: - redis: 6379 - ## @param master.service.nodePorts.redis Node port for Redis® master - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## NOTE: choose port between <30000-32767> - ## - nodePorts: - redis: "" - ## @param master.service.externalTrafficPolicy Redis® master service external traffic policy - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param master.service.extraPorts Extra ports to expose (normally used with the `sidecar` value) - ## - extraPorts: [] - ## @param master.service.internalTrafficPolicy Redis® master service internal traffic policy (requires Kubernetes v1.22 or greater to be usable) - ## ref: https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy/ - ## - internalTrafficPolicy: Cluster - ## @param master.service.clusterIP Redis® master service Cluster IP - ## - clusterIP: "" - ## @param master.service.loadBalancerIP Redis® master service Load Balancer IP - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer - ## - loadBalancerIP: "" - ## @param master.service.loadBalancerSourceRanges Redis® master service Load Balancer sources - ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## e.g. - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param master.service.annotations Additional custom annotations for Redis® master service - ## - annotations: {} - ## @param master.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" - ## If "ClientIP", consecutive client requests will be directed to the same Pod - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - ## - sessionAffinity: None - ## @param master.service.sessionAffinityConfig Additional settings for the sessionAffinity - ## sessionAffinityConfig: - ## clientIP: - ## timeoutSeconds: 300 - ## - sessionAffinityConfig: {} - ## @param master.terminationGracePeriodSeconds Integer setting the termination grace period for the redis-master pods - ## - terminationGracePeriodSeconds: 30 - -## @section Redis® replicas configuration parameters -## - -replica: - ## @param replica.replicaCount Number of Redis® replicas to deploy - ## - replicaCount: 3 - ## @param replica.configuration Configuration for Redis® replicas nodes - ## ref: https://redis.io/topics/config - ## - configuration: "" - ## @param replica.disableCommands Array with Redis® commands to disable on replicas nodes - ## Commands will be completely disabled by renaming each to an empty string. - ## ref: https://redis.io/topics/security#disabling-of-specific-commands - ## - disableCommands: - - FLUSHDB - - FLUSHALL - ## @param replica.command Override default container command (useful when using custom images) - ## - command: [] - ## @param replica.args Override default container args (useful when using custom images) - ## - args: [] - ## @param replica.preExecCmds Additional commands to run prior to starting Redis® replicas - ## - preExecCmds: [] - ## @param replica.extraFlags Array with additional command line flags for Redis® replicas - ## e.g: - ## extraFlags: - ## - "--maxmemory-policy volatile-ttl" - ## - "--repl-backlog-size 1024mb" - ## - extraFlags: [] - ## @param replica.extraEnvVars Array with extra environment variables to add to Redis® replicas nodes - ## e.g: - ## extraEnvVars: - ## - name: FOO - ## value: "bar" - ## - extraEnvVars: [] - ## @param replica.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Redis® replicas nodes - ## - extraEnvVarsCM: "" - ## @param replica.extraEnvVarsSecret Name of existing Secret containing extra env vars for Redis® replicas nodes - ## - extraEnvVarsSecret: "" - ## @param replica.externalMaster.enabled Use external master for bootstrapping - ## @param replica.externalMaster.host External master host to bootstrap from - ## @param replica.externalMaster.port Port for Redis service external master host - ## - externalMaster: - enabled: false - host: "" - port: 6379 - ## @param replica.containerPorts.redis Container port to open on Redis® replicas nodes - ## - containerPorts: - redis: 6379 - ## Configure extra options for Redis® containers' liveness and readiness probes - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes - ## @param replica.startupProbe.enabled Enable startupProbe on Redis® replicas nodes - ## @param replica.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe - ## @param replica.startupProbe.periodSeconds Period seconds for startupProbe - ## @param replica.startupProbe.timeoutSeconds Timeout seconds for startupProbe - ## @param replica.startupProbe.failureThreshold Failure threshold for startupProbe - ## @param replica.startupProbe.successThreshold Success threshold for startupProbe - ## - startupProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 22 - ## @param replica.livenessProbe.enabled Enable livenessProbe on Redis® replicas nodes - ## @param replica.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param replica.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param replica.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param replica.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param replica.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 5 - ## @param replica.readinessProbe.enabled Enable readinessProbe on Redis® replicas nodes - ## @param replica.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param replica.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param replica.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param replica.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param replica.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 5 - ## @param replica.customStartupProbe Custom startupProbe that overrides the default one - ## - customStartupProbe: {} - ## @param replica.customLivenessProbe Custom livenessProbe that overrides the default one - ## - customLivenessProbe: {} - ## @param replica.customReadinessProbe Custom readinessProbe that overrides the default one - ## - customReadinessProbe: {} - ## Redis® replicas resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param replica.resources.limits The resources limits for the Redis® replicas containers - ## @param replica.resources.requests The requested resources for the Redis® replicas containers - ## - resources: - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - limits: {} - # cpu: 250m - # memory: 256Mi - requests: {} - # cpu: 250m - # memory: 256Mi - ## Configure Pods Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param replica.podSecurityContext.enabled Enabled Redis® replicas pods' Security Context - ## @param replica.podSecurityContext.fsGroup Set Redis® replicas pod's Security Context fsGroup - ## - podSecurityContext: - enabled: true - fsGroup: 1001 - ## Configure Container Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param replica.containerSecurityContext.enabled Enabled Redis® replicas containers' Security Context - ## @param replica.containerSecurityContext.runAsUser Set Redis® replicas containers' Security Context runAsUser - ## - containerSecurityContext: - enabled: true - runAsUser: 1001 - ## @param replica.schedulerName Alternate scheduler for Redis® replicas pods - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ - ## - schedulerName: "" - ## @param replica.updateStrategy.type Redis® replicas statefulset strategy type - ## @skip replica.updateStrategy.rollingUpdate - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies - ## - updateStrategy: - ## StrategyType - ## Can be set to RollingUpdate or OnDelete - ## - type: RollingUpdate - rollingUpdate: {} - ## @param replica.priorityClassName Redis® replicas pods' priorityClassName - ## - priorityClassName: "" - ## @param replica.podManagementPolicy podManagementPolicy to manage scaling operation of %%MAIN_CONTAINER_NAME%% pods - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies - ## - podManagementPolicy: "" - ## @param replica.hostAliases Redis® replicas pods host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ - ## - hostAliases: [] - ## @param replica.podLabels Extra labels for Redis® replicas pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param replica.podAnnotations Annotations for Redis® replicas pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: {} - ## @param replica.shareProcessNamespace Share a single process namespace between all of the containers in Redis® replicas pods - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ - ## - shareProcessNamespace: false - ## @param replica.podAffinityPreset Pod affinity preset. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param replica.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## Node affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param replica.nodeAffinityPreset.type Node affinity preset type. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param replica.nodeAffinityPreset.key Node label key to match. Ignored if `replica.affinity` is set - ## - key: "" - ## @param replica.nodeAffinityPreset.values Node label values to match. Ignored if `replica.affinity` is set - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param replica.affinity Affinity for Redis® replicas pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## NOTE: `replica.podAffinityPreset`, `replica.podAntiAffinityPreset`, and `replica.nodeAffinityPreset` will be ignored when it's set - ## - affinity: {} - ## @param replica.nodeSelector Node labels for Redis® replicas pods assignment - ## ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param replica.tolerations Tolerations for Redis® replicas pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param replica.topologySpreadConstraints Spread Constraints for Redis® replicas pod assignment - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## E.g. - ## topologySpreadConstraints: - ## - maxSkew: 1 - ## topologyKey: node - ## whenUnsatisfiable: DoNotSchedule - ## - topologySpreadConstraints: [] - ## @param replica.dnsPolicy DNS Policy for Redis® replica pods - ## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/ - ## E.g. - ## dnsPolicy: ClusterFirst - dnsPolicy: "" - ## @param replica.dnsConfig DNS Configuration for Redis® replica pods - ## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/ - ## E.g. - ## dnsConfig: - ## options: - ## - name: ndots - ## value: "4" - ## - name: single-request-reopen - dnsConfig: {} - ## @param replica.lifecycleHooks for the Redis® replica container(s) to automate configuration before or after startup - ## - lifecycleHooks: {} - ## @param replica.extraVolumes Optionally specify extra list of additional volumes for the Redis® replicas pod(s) - ## - extraVolumes: [] - ## @param replica.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Redis® replicas container(s) - ## - extraVolumeMounts: [] - ## @param replica.sidecars Add additional sidecar containers to the Redis® replicas pod(s) - ## e.g: - ## sidecars: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## ports: - ## - name: portname - ## containerPort: 1234 - ## - sidecars: [] - ## @param replica.initContainers Add additional init containers to the Redis® replicas pod(s) - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ - ## e.g: - ## initContainers: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## command: ['sh', '-c', 'echo "hello world"'] - ## - initContainers: [] - ## Persistence Parameters - ## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/ - ## - persistence: - ## @param replica.persistence.enabled Enable persistence on Redis® replicas nodes using Persistent Volume Claims - ## - enabled: true - ## @param replica.persistence.medium Provide a medium for `emptyDir` volumes. - ## - medium: "" - ## @param replica.persistence.sizeLimit Set this to enable a size limit for `emptyDir` volumes. - ## - sizeLimit: "" - ## @param replica.persistence.path The path the volume will be mounted at on Redis® replicas containers - ## NOTE: Useful when using different Redis® images - ## - path: /data - ## @param replica.persistence.subPath The subdirectory of the volume to mount on Redis® replicas containers - ## NOTE: Useful in dev environments - ## - subPath: "" - ## @param replica.persistence.storageClass Persistent Volume storage class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner - ## - storageClass: "" - ## @param replica.persistence.accessModes Persistent Volume access modes - ## - accessModes: - - ReadWriteOnce - ## @param replica.persistence.size Persistent Volume size - ## - size: 8Gi - ## @param replica.persistence.annotations Additional custom annotations for the PVC - ## - annotations: {} - ## @param replica.persistence.selector Additional labels to match for the PVC - ## e.g: - ## selector: - ## matchLabels: - ## app: my-app - ## - selector: {} - ## @param replica.persistence.dataSource Custom PVC data source - ## - dataSource: {} - ## @param replica.persistence.existingClaim Use a existing PVC which must be created manually before bound - ## NOTE: requires replica.persistence.enabled: true - ## - existingClaim: "" - ## Redis® replicas service parameters - ## - service: - ## @param replica.service.type Redis® replicas service type - ## - type: ClusterIP - ## @param replica.service.ports.redis Redis® replicas service port - ## - ports: - redis: 6379 - ## @param replica.service.nodePorts.redis Node port for Redis® replicas - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## NOTE: choose port between <30000-32767> - ## - nodePorts: - redis: "" - ## @param replica.service.externalTrafficPolicy Redis® replicas service external traffic policy - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param replica.service.internalTrafficPolicy Redis® replicas service internal traffic policy (requires Kubernetes v1.22 or greater to be usable) - ## ref: https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy/ - ## - internalTrafficPolicy: Cluster - ## @param replica.service.extraPorts Extra ports to expose (normally used with the `sidecar` value) - ## - extraPorts: [] - ## @param replica.service.clusterIP Redis® replicas service Cluster IP - ## - clusterIP: "" - ## @param replica.service.loadBalancerIP Redis® replicas service Load Balancer IP - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer - ## - loadBalancerIP: "" - ## @param replica.service.loadBalancerSourceRanges Redis® replicas service Load Balancer sources - ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## e.g. - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param replica.service.annotations Additional custom annotations for Redis® replicas service - ## - annotations: {} - ## @param replica.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" - ## If "ClientIP", consecutive client requests will be directed to the same Pod - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - ## - sessionAffinity: None - ## @param replica.service.sessionAffinityConfig Additional settings for the sessionAffinity - ## sessionAffinityConfig: - ## clientIP: - ## timeoutSeconds: 300 - ## - sessionAffinityConfig: {} - ## @param replica.terminationGracePeriodSeconds Integer setting the termination grace period for the redis-replicas pods - ## - terminationGracePeriodSeconds: 30 - ## Autoscaling configuration - ## - autoscaling: - ## @param replica.autoscaling.enabled Enable replica autoscaling settings - ## - enabled: false - ## @param replica.autoscaling.minReplicas Minimum replicas for the pod autoscaling - ## - minReplicas: 1 - ## @param replica.autoscaling.maxReplicas Maximum replicas for the pod autoscaling - ## - maxReplicas: 11 - ## @param replica.autoscaling.targetCPU Percentage of CPU to consider when autoscaling - ## - targetCPU: "" - ## @param replica.autoscaling.targetMemory Percentage of Memory to consider when autoscaling - ## - targetMemory: "" - -## @section Redis® Sentinel configuration parameters -## - -sentinel: - ## @param sentinel.enabled Use Redis® Sentinel on Redis® pods. - ## IMPORTANT: this will disable the master and replicas services and - ## create a single Redis® service exposing both the Redis and Sentinel ports - ## - enabled: false - ## Bitnami Redis® Sentinel image version - ## ref: https://hub.docker.com/r/bitnami/redis-sentinel/tags/ - ## @param sentinel.image.registry Redis® Sentinel image registry - ## @param sentinel.image.repository Redis® Sentinel image repository - ## @param sentinel.image.tag Redis® Sentinel image tag (immutable tags are recommended) - ## @param sentinel.image.pullPolicy Redis® Sentinel image pull policy - ## @param sentinel.image.pullSecrets Redis® Sentinel image pull secrets - ## @param sentinel.image.debug Enable image debug mode - ## - image: - registry: docker.io - repository: bitnami/redis-sentinel - tag: 6.2.7-debian-11-r12 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Enable debug mode - ## - debug: false - ## @param sentinel.masterSet Master set name - ## - masterSet: mymaster - ## @param sentinel.quorum Sentinel Quorum - ## - quorum: 2 - ## @param sentinel.getMasterTimeout Amount of time to allow before get_sentinel_master_info() times out. - ## NOTE: This is directly related to the startupProbes which are configured to run every 10 seconds for a total of 22 failures. If adjusting this value, also adjust the startupProbes. - getMasterTimeout: 220 - ## @param sentinel.automateClusterRecovery Automate cluster recovery in cases where the last replica is not considered a good replica and Sentinel won't automatically failover to it. - ## This also prevents any new replica from starting until the last remaining replica is elected as master to guarantee that it is the one to be elected by Sentinel, and not a newly started replica with no data. - ## NOTE: This feature requires a "downAfterMilliseconds" value less or equal to 2000. - ## - automateClusterRecovery: false - ## Sentinel timing restrictions - ## @param sentinel.downAfterMilliseconds Timeout for detecting a Redis® node is down - ## @param sentinel.failoverTimeout Timeout for performing a election failover - ## - downAfterMilliseconds: 60000 - failoverTimeout: 18000 - ## @param sentinel.parallelSyncs Number of replicas that can be reconfigured in parallel to use the new master after a failover - ## - parallelSyncs: 1 - ## @param sentinel.configuration Configuration for Redis® Sentinel nodes - ## ref: https://redis.io/topics/sentinel - ## - configuration: "" - ## @param sentinel.command Override default container command (useful when using custom images) - ## - command: [] - ## @param sentinel.args Override default container args (useful when using custom images) - ## - args: [] - ## @param sentinel.preExecCmds Additional commands to run prior to starting Redis® Sentinel - ## - preExecCmds: [] - ## @param sentinel.extraEnvVars Array with extra environment variables to add to Redis® Sentinel nodes - ## e.g: - ## extraEnvVars: - ## - name: FOO - ## value: "bar" - ## - extraEnvVars: [] - ## @param sentinel.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Redis® Sentinel nodes - ## - extraEnvVarsCM: "" - ## @param sentinel.extraEnvVarsSecret Name of existing Secret containing extra env vars for Redis® Sentinel nodes - ## - extraEnvVarsSecret: "" - ## @param sentinel.externalMaster.enabled Use external master for bootstrapping - ## @param sentinel.externalMaster.host External master host to bootstrap from - ## @param sentinel.externalMaster.port Port for Redis service external master host - ## - externalMaster: - enabled: false - host: "" - port: 6379 - ## @param sentinel.containerPorts.sentinel Container port to open on Redis® Sentinel nodes - ## - containerPorts: - sentinel: 26379 - ## Configure extra options for Redis® containers' liveness and readiness probes - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes - ## @param sentinel.startupProbe.enabled Enable startupProbe on Redis® Sentinel nodes - ## @param sentinel.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe - ## @param sentinel.startupProbe.periodSeconds Period seconds for startupProbe - ## @param sentinel.startupProbe.timeoutSeconds Timeout seconds for startupProbe - ## @param sentinel.startupProbe.failureThreshold Failure threshold for startupProbe - ## @param sentinel.startupProbe.successThreshold Success threshold for startupProbe - ## - startupProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 22 - ## @param sentinel.livenessProbe.enabled Enable livenessProbe on Redis® Sentinel nodes - ## @param sentinel.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param sentinel.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param sentinel.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param sentinel.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param sentinel.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 5 - ## @param sentinel.readinessProbe.enabled Enable readinessProbe on Redis® Sentinel nodes - ## @param sentinel.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param sentinel.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param sentinel.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param sentinel.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param sentinel.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 5 - ## @param sentinel.customStartupProbe Custom startupProbe that overrides the default one - ## - customStartupProbe: {} - ## @param sentinel.customLivenessProbe Custom livenessProbe that overrides the default one - ## - customLivenessProbe: {} - ## @param sentinel.customReadinessProbe Custom readinessProbe that overrides the default one - ## - customReadinessProbe: {} - ## Persistence parameters - ## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/ - ## - persistence: - ## @param sentinel.persistence.enabled Enable persistence on Redis® sentinel nodes using Persistent Volume Claims (Experimental) - ## - enabled: false - ## @param sentinel.persistence.storageClass Persistent Volume storage class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner - ## - storageClass: "" - ## @param sentinel.persistence.accessModes Persistent Volume access modes - ## - accessModes: - - ReadWriteOnce - ## @param sentinel.persistence.size Persistent Volume size - ## - size: 100Mi - ## @param sentinel.persistence.annotations Additional custom annotations for the PVC - ## - annotations: {} - ## @param sentinel.persistence.selector Additional labels to match for the PVC - ## e.g: - ## selector: - ## matchLabels: - ## app: my-app - ## - selector: {} - ## @param sentinel.persistence.dataSource Custom PVC data source - ## - dataSource: {} - ## @param sentinel.persistence.medium Provide a medium for `emptyDir` volumes. - ## - medium: "" - ## Redis® Sentinel resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param sentinel.resources.limits The resources limits for the Redis® Sentinel containers - ## @param sentinel.resources.requests The requested resources for the Redis® Sentinel containers - ## - resources: - limits: {} - requests: {} - ## Configure Container Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param sentinel.containerSecurityContext.enabled Enabled Redis® Sentinel containers' Security Context - ## @param sentinel.containerSecurityContext.runAsUser Set Redis® Sentinel containers' Security Context runAsUser - ## - containerSecurityContext: - enabled: true - runAsUser: 1001 - ## @param sentinel.lifecycleHooks for the Redis® sentinel container(s) to automate configuration before or after startup - ## - lifecycleHooks: {} - ## @param sentinel.extraVolumes Optionally specify extra list of additional volumes for the Redis® Sentinel - ## - extraVolumes: [] - ## @param sentinel.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Redis® Sentinel container(s) - ## - extraVolumeMounts: [] - ## Redis® Sentinel service parameters - ## - service: - ## @param sentinel.service.type Redis® Sentinel service type - ## - type: ClusterIP - ## @param sentinel.service.ports.redis Redis® service port for Redis® - ## @param sentinel.service.ports.sentinel Redis® service port for Redis® Sentinel - ## - ports: - redis: 6379 - sentinel: 26379 - ## @param sentinel.service.nodePorts.redis Node port for Redis® - ## @param sentinel.service.nodePorts.sentinel Node port for Sentinel - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## NOTE: choose port between <30000-32767> - ## NOTE: By leaving these values blank, they will be generated by ports-configmap - ## If setting manually, please leave at least replica.replicaCount + 1 in between sentinel.service.nodePorts.redis and sentinel.service.nodePorts.sentinel to take into account the ports that will be created while incrementing that base port - ## - nodePorts: - redis: "" - sentinel: "" - ## @param sentinel.service.externalTrafficPolicy Redis® Sentinel service external traffic policy - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param sentinel.service.extraPorts Extra ports to expose (normally used with the `sidecar` value) - ## - extraPorts: [] - ## @param sentinel.service.clusterIP Redis® Sentinel service Cluster IP - ## - clusterIP: "" - ## @param sentinel.service.loadBalancerIP Redis® Sentinel service Load Balancer IP - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer - ## - loadBalancerIP: "" - ## @param sentinel.service.loadBalancerSourceRanges Redis® Sentinel service Load Balancer sources - ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## e.g. - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param sentinel.service.annotations Additional custom annotations for Redis® Sentinel service - ## - annotations: {} - ## @param sentinel.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" - ## If "ClientIP", consecutive client requests will be directed to the same Pod - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - ## - sessionAffinity: None - ## @param sentinel.service.sessionAffinityConfig Additional settings for the sessionAffinity - ## sessionAffinityConfig: - ## clientIP: - ## timeoutSeconds: 300 - ## - sessionAffinityConfig: {} - ## @param sentinel.terminationGracePeriodSeconds Integer setting the termination grace period for the redis-node pods - ## - terminationGracePeriodSeconds: 30 - -## @section Other Parameters -## - -## Network Policy configuration -## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ -## -networkPolicy: - ## @param networkPolicy.enabled Enable creation of NetworkPolicy resources - ## - enabled: false - ## @param networkPolicy.allowExternal Don't require client label for connections - ## When set to false, only pods with the correct client label will have network access to the ports - ## Redis® is listening on. When true, Redis® will accept connections from any source - ## (with the correct destination port). - ## - allowExternal: true - ## @param networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy - ## e.g: - ## extraIngress: - ## - ports: - ## - port: 1234 - ## from: - ## - podSelector: - ## - matchLabels: - ## - role: frontend - ## - podSelector: - ## - matchExpressions: - ## - key: role - ## operator: In - ## values: - ## - frontend - ## - extraIngress: [] - ## @param networkPolicy.extraEgress Add extra egress rules to the NetworkPolicy - ## e.g: - ## extraEgress: - ## - ports: - ## - port: 1234 - ## to: - ## - podSelector: - ## - matchLabels: - ## - role: frontend - ## - podSelector: - ## - matchExpressions: - ## - key: role - ## operator: In - ## values: - ## - frontend - ## - extraEgress: [] - ## @param networkPolicy.ingressNSMatchLabels Labels to match to allow traffic from other namespaces - ## @param networkPolicy.ingressNSPodMatchLabels Pod labels to match to allow traffic from other namespaces - ## - ingressNSMatchLabels: {} - ingressNSPodMatchLabels: {} -## PodSecurityPolicy configuration -## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ -## -podSecurityPolicy: - ## @param podSecurityPolicy.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later - ## - create: false - ## @param podSecurityPolicy.enabled Enable PodSecurityPolicy's RBAC rules - ## - enabled: false -## RBAC configuration -## -rbac: - ## @param rbac.create Specifies whether RBAC resources should be created - ## - create: false - ## @param rbac.rules Custom RBAC rules to set - ## e.g: - ## rules: - ## - apiGroups: - ## - "" - ## resources: - ## - pods - ## verbs: - ## - get - ## - list - ## - rules: [] -## ServiceAccount configuration -## -serviceAccount: - ## @param serviceAccount.create Specifies whether a ServiceAccount should be created - ## - create: true - ## @param serviceAccount.name The name of the ServiceAccount to use. - ## If not set and create is true, a name is generated using the common.names.fullname template - ## - name: "" - ## @param serviceAccount.automountServiceAccountToken Whether to auto mount the service account token - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server - ## - automountServiceAccountToken: true - ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount - ## - annotations: {} -## Redis® Pod Disruption Budget configuration -## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ -## -pdb: - ## @param pdb.create Specifies whether a PodDisruptionBudget should be created - ## - create: false - ## @param pdb.minAvailable Min number of pods that must still be available after the eviction - ## - minAvailable: 1 - ## @param pdb.maxUnavailable Max number of pods that can be unavailable after the eviction - ## - maxUnavailable: "" -## TLS configuration -## -tls: - ## @param tls.enabled Enable TLS traffic - ## - enabled: false - ## @param tls.authClients Require clients to authenticate - ## - authClients: true - ## @param tls.autoGenerated Enable autogenerated certificates - ## - autoGenerated: false - ## @param tls.existingSecret The name of the existing secret that contains the TLS certificates - ## - existingSecret: "" - ## @param tls.certificatesSecret DEPRECATED. Use existingSecret instead. - ## - certificatesSecret: "" - ## @param tls.certFilename Certificate filename - ## - certFilename: "" - ## @param tls.certKeyFilename Certificate Key filename - ## - certKeyFilename: "" - ## @param tls.certCAFilename CA Certificate filename - ## - certCAFilename: "" - ## @param tls.dhParamsFilename File containing DH params (in order to support DH based ciphers) - ## - dhParamsFilename: "" - -## @section Metrics Parameters -## - -metrics: - ## @param metrics.enabled Start a sidecar prometheus exporter to expose Redis® metrics - ## - enabled: false - ## Bitnami Redis® Exporter image - ## ref: https://hub.docker.com/r/bitnami/redis-exporter/tags/ - ## @param metrics.image.registry Redis® Exporter image registry - ## @param metrics.image.repository Redis® Exporter image repository - ## @param metrics.image.tag Redis® Redis® Exporter image tag (immutable tags are recommended) - ## @param metrics.image.pullPolicy Redis® Exporter image pull policy - ## @param metrics.image.pullSecrets Redis® Exporter image pull secrets - ## - image: - registry: docker.io - repository: bitnami/redis-exporter - tag: 1.43.0-debian-11-r4 - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## @param metrics.command Override default metrics container init command (useful when using custom images) - ## - command: [] - ## @param metrics.redisTargetHost A way to specify an alternative Redis® hostname - ## Useful for certificate CN/SAN matching - ## - redisTargetHost: "localhost" - ## @param metrics.extraArgs Extra arguments for Redis® exporter, for example: - ## e.g.: - ## extraArgs: - ## check-keys: myKey,myOtherKey - ## - extraArgs: {} - ## @param metrics.extraEnvVars Array with extra environment variables to add to Redis® exporter - ## e.g: - ## extraEnvVars: - ## - name: FOO - ## value: "bar" - ## - extraEnvVars: [] - ## Configure Container Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod - ## @param metrics.containerSecurityContext.enabled Enabled Redis® exporter containers' Security Context - ## @param metrics.containerSecurityContext.runAsUser Set Redis® exporter containers' Security Context runAsUser - ## - containerSecurityContext: - enabled: true - runAsUser: 1001 - ## @param metrics.extraVolumes Optionally specify extra list of additional volumes for the Redis® metrics sidecar - ## - extraVolumes: [] - ## @param metrics.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Redis® metrics sidecar - ## - extraVolumeMounts: [] - ## Redis® exporter resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param metrics.resources.limits The resources limits for the Redis® exporter container - ## @param metrics.resources.requests The requested resources for the Redis® exporter container - ## - resources: - limits: {} - requests: {} - ## @param metrics.podLabels Extra labels for Redis® exporter pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - ## - podLabels: {} - ## @param metrics.podAnnotations [object] Annotations for Redis® exporter pods - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - ## - podAnnotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9121" - ## Redis® exporter service parameters - ## - service: - ## @param metrics.service.type Redis® exporter service type - ## - type: ClusterIP - ## @param metrics.service.port Redis® exporter service port - ## - port: 9121 - ## @param metrics.service.externalTrafficPolicy Redis® exporter service external traffic policy - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param metrics.service.extraPorts Extra ports to expose (normally used with the `sidecar` value) - ## - extraPorts: [] - ## @param metrics.service.loadBalancerIP Redis® exporter service Load Balancer IP - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer - ## - loadBalancerIP: "" - ## @param metrics.service.loadBalancerSourceRanges Redis® exporter service Load Balancer sources - ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## e.g. - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] - ## @param metrics.service.annotations Additional custom annotations for Redis® exporter service - ## - annotations: {} - ## Prometheus Service Monitor - ## ref: https://github.com/coreos/prometheus-operator - ## https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint - ## - serviceMonitor: - ## @param metrics.serviceMonitor.enabled Create ServiceMonitor resource(s) for scraping metrics using PrometheusOperator - ## - enabled: false - ## @param metrics.serviceMonitor.namespace The namespace in which the ServiceMonitor will be created - ## - namespace: "" - ## @param metrics.serviceMonitor.interval The interval at which metrics should be scraped - ## - interval: 30s - ## @param metrics.serviceMonitor.scrapeTimeout The timeout after which the scrape is ended - ## - scrapeTimeout: "" - ## @param metrics.serviceMonitor.relabellings Metrics RelabelConfigs to apply to samples before scraping. - ## - relabellings: [] - ## @param metrics.serviceMonitor.metricRelabelings Metrics RelabelConfigs to apply to samples before ingestion. - ## - metricRelabelings: [] - ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint - ## - honorLabels: false - ## @param metrics.serviceMonitor.additionalLabels Additional labels that can be used so ServiceMonitor resource(s) can be discovered by Prometheus - ## - additionalLabels: {} - ## Custom PrometheusRule to be defined - ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions - ## - prometheusRule: - ## @param metrics.prometheusRule.enabled Create a custom prometheusRule Resource for scraping metrics using PrometheusOperator - ## - enabled: false - ## @param metrics.prometheusRule.namespace The namespace in which the prometheusRule will be created - ## - namespace: "" - ## @param metrics.prometheusRule.additionalLabels Additional labels for the prometheusRule - ## - additionalLabels: {} - ## @param metrics.prometheusRule.rules Custom Prometheus rules - ## e.g: - ## rules: - ## - alert: RedisDown - ## expr: redis_up{service="{{ template "common.names.fullname" . }}-metrics"} == 0 - ## for: 2m - ## labels: - ## severity: error - ## annotations: - ## summary: Redis® instance {{ "{{ $labels.instance }}" }} down - ## description: Redis® instance {{ "{{ $labels.instance }}" }} is down - ## - alert: RedisMemoryHigh - ## expr: > - ## redis_memory_used_bytes{service="{{ template "common.names.fullname" . }}-metrics"} * 100 - ## / - ## redis_memory_max_bytes{service="{{ template "common.names.fullname" . }}-metrics"} - ## > 90 - ## for: 2m - ## labels: - ## severity: error - ## annotations: - ## summary: Redis® instance {{ "{{ $labels.instance }}" }} is using too much memory - ## description: | - ## Redis® instance {{ "{{ $labels.instance }}" }} is using {{ "{{ $value }}" }}% of its available memory. - ## - alert: RedisKeyEviction - ## expr: | - ## increase(redis_evicted_keys_total{service="{{ template "common.names.fullname" . }}-metrics"}[5m]) > 0 - ## for: 1s - ## labels: - ## severity: error - ## annotations: - ## summary: Redis® instance {{ "{{ $labels.instance }}" }} has evicted keys - ## description: | - ## Redis® instance {{ "{{ $labels.instance }}" }} has evicted {{ "{{ $value }}" }} keys in the last 5 minutes. - ## - rules: [] - -## @section Init Container Parameters -## - -## 'volumePermissions' init container parameters -## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values -## based on the *podSecurityContext/*containerSecurityContext parameters -## -volumePermissions: - ## @param volumePermissions.enabled Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` - ## - enabled: false - ## Bitnami Shell image - ## ref: https://hub.docker.com/r/bitnami/bitnami-shell/tags/ - ## @param volumePermissions.image.registry Bitnami Shell image registry - ## @param volumePermissions.image.repository Bitnami Shell image repository - ## @param volumePermissions.image.tag Bitnami Shell image tag (immutable tags are recommended) - ## @param volumePermissions.image.pullPolicy Bitnami Shell image pull policy - ## @param volumePermissions.image.pullSecrets Bitnami Shell image pull secrets - ## - image: - registry: docker.io - repository: bitnami/bitnami-shell - tag: 11-debian-11-r11 - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Init container's resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param volumePermissions.resources.limits The resources limits for the init container - ## @param volumePermissions.resources.requests The requested resources for the init container - ## - resources: - limits: {} - requests: {} - ## Init container Container Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container - ## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser - ## NOTE: when runAsUser is set to special value "auto", init container will try to chown the - ## data folder to auto-determined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` - ## "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed) - ## - containerSecurityContext: - runAsUser: 0 - -## init-sysctl container parameters -## used to perform sysctl operation to modify Kernel settings (needed sometimes to avoid warnings) -## -sysctl: - ## @param sysctl.enabled Enable init container to modify Kernel settings - ## - enabled: false - ## Bitnami Shell image - ## ref: https://hub.docker.com/r/bitnami/bitnami-shell/tags/ - ## @param sysctl.image.registry Bitnami Shell image registry - ## @param sysctl.image.repository Bitnami Shell image repository - ## @param sysctl.image.tag Bitnami Shell image tag (immutable tags are recommended) - ## @param sysctl.image.pullPolicy Bitnami Shell image pull policy - ## @param sysctl.image.pullSecrets Bitnami Shell image pull secrets - ## - image: - registry: docker.io - repository: bitnami/bitnami-shell - tag: 11-debian-11-r11 - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## e.g: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## @param sysctl.command Override default init-sysctl container command (useful when using custom images) - ## - command: [] - ## @param sysctl.mountHostSys Mount the host `/sys` folder to `/host-sys` - ## - mountHostSys: false - ## Init container's resource requests and limits - ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ - ## @param sysctl.resources.limits The resources limits for the init container - ## @param sysctl.resources.requests The requested resources for the init container - ## - resources: - limits: {} - requests: {} - -## @section useExternalDNS Parameters -## -## @param useExternalDNS.enabled Enable various syntax that would enable external-dns to work. Note this requires a working installation of `external-dns` to be usable. -## @param useExternalDNS.additionalAnnotations Extra annotations to be utilized when `external-dns` is enabled. -## @param useExternalDNS.annotationKey The annotation key utilized when `external-dns` is enabled. -## @param useExternalDNS.suffix The DNS suffix utilized when `external-dns` is enabled. Note that we prepend the suffix with the full name of the release. -## -useExternalDNS: - enabled: false - suffix: "" - annotationKey: external-dns.alpha.kubernetes.io/ - additionalAnnotations: {}

uG7pz4MC6*sMZ+8)6tR!*k&!mX&`^ zb^Uri4;^ z{%9qOPU)wwoJQ1&p*gpumFJo%%E5z|8!pduuDWfiZq*86;Jp!Xje?e=ZO z)QTrhJxetzDL2n6b<})yzQ#Y?a|6AD!4a3oDHSxHv-64?C7>Gjo;vg|UBcjoJg-($ zfE8TtVsrb7yO&^+4jyGXRSXqi>tj8x&!0^sd(I)taA;>g{O1E^Xk72bE5=J+EFB{dEllPLf1A zVh4~Ys-S{S}xLt{UZ@+=M!PBfgpQGx%0o#uvuNp6>-0cUIibXcH> z3ke~n0Jebw1e~vJZ+>00)IK-R!#m_#@~LC;;ayCw2#XZOtiMh{V~TRYLNv9crqJ8@VUN{sNQQ7Ri|$} z-0BWc4JUVNpq^qhWIm&2Ribih)TvP=NrzMxb{598*J@GgO)|gIXT_cB#O$9*Q}<)z z!{E4?n4ADL{3=E#g_qiiOB)E9t!$hG)e4|!fR{_>7$>_h9|(E8F0Esu+o5Xro?x{+ zh*r~5B|O|KV#n3&r$0sNi$_6 ziqKb06JuLUj_6p?*o34cifEM64LPC{Bpj9j*3?;xs9*NEf!?th?vkLjK&?a~oM!%K z=u<0k4qdIPl79XO&+6!JfjZ+pweI3iXHr*0mWM@1heU@~EctOIG#xXcr6Je7+X;Gt z<$JoxE`~ktHDNCj-1V;2{)5K1Rx7?FO=H!=tReJF97 z{`EYn0$q*sNfTZ=MiWZ@M>qMNQ32}nzxN>_!DXJz8Dn%dg@|khp&nA4FY*{`liM0o zqbFZi2)>qWu=w0-TXVsmmgv13FDtj;@VuaVzNV3q1 z&x-bin3-SwFILigE6<8R6~TyxSv1Fy@&=Avc8Wwu?j?o1>K}@XmYx+^DmN$JEG?CT z{*(w7O-yJAVvH#;!U%e)fr%1PAp}i$C)A(jiZhFma|mcE)n>ITl=a1#DNA`%BQg^HGHp<#7ysa7~+7hZr7 zCn5B0(`---NKO*1Iqtc=KQNVEQA=g#V9nI0N$a$jT9~SRC~uvOv`q zQa_m#$GuX+Z}6M(JRzZRJhSPL|Cr#^&mDK_Y(uqKK#h6q|Iq<^SD-qC>)^P&Q&0Jr zLJ;vRge2uxETpM0F)HohgBSHto%6(jHzht`QekN@+HFw}T7#;RzVo;&Q93?VK>2nkC#RP0=uFg_T1N9UI zr4tNj)iX5p;8^DnHg`-qOkl*X%|!~P>A6kk-^Q~tOQnITq@a3#sv9r?X3uRIwfzd0 zDx*tMoEEEkq?gWeokM-T)7Dq^+;OMMl*B?oYKjGzKK=8ue|Q!EW2l(PE(hB(P?0UH zZ@3cF$LJ&BY?9DFreR9{+(6G5!j{jOIW-WdmDHwn=zkk6mCa;bgjM*KeJO6>tJk9Fq?hW0G8;N*0YMFhpmpCI2y% zqp#;GHjgnCnmdWbH432qGCm|94oUJ-O>_#Vc%iSw{n?KR3|Z*xu;8cyT*h zDkshR>y!lan5K+}Wj+-xsp|_G=Vn0z9*4qlFPG`W#IF*PC*P_uzzy^|8@F+yHbCVO zO=sKu)R_G^HU8MA)ara{iItk;ol;?=me)<)&cDCXO(`?-rnE89Ibnf zBgIr$@49QL<_xNqlU9-%zMB6%~` zD<%&Ry%bPSbQtz`IQ=CLDs2(@G9qkjLZwt|*4_K#sZ~=IKe`5MXi)LLc4uCjck+NJ1iwqLUzJj-KR^h^=QhGt4~BM`CyS_R0w#Q@D=?)I#rr1sX<)}Y85 zR1Q-8(6OkC_|N6I&JP{F`KBBSc_7Rkrp8$O0SB+(>Fa}6&$PQv%@v4a(O6-IFb=yC z?NdrZ?dgQ4_>|>uAtK-CfZ{*y{Xe~8tLAR1=ISVdwre9d9z&AyFw+5qL_nfaM3Pcc zBrlKNj8@0bA>vXfk$bH32Pl+q=45ty6MjULBvMUZ@EDlYb9e;$OoB{Va5*W=?&vsA z5E1c!MDBo`Kxx9pk@U_FS7Afx)r6_s7gFlItOsIrG7cz^z0z5My$=#}}? znWO$0r2OaaPtDJ_35`!jY@l{x-HxeGy5)I$QB<>G(HuI@&495yi)h^SkrT~{?oIV~ z?sTZoec zCslS8LyFq;ydSNzh?|h&dG3N}W~Kce6sz8+Iu;)dt+&wKi?7t4M@NuCh`7zI%s=twXLx~k2Bn# z6vlV*ntQ$66}pI3h}w(-wVwlzX<=o8>b%|)*Xia-VO@eVw<5VJ8qO@6U#s+*-rG2u zK<|W-aMIJ892MG*(chdt?d&iTbA)!+TWk%*57#Hr`Ey*B+UfGc` zrp?)qypb+gzaQLzHkS-?FeD5yv4~0ak^4HCoFl~sbM1BvV>3aX$TL}V%Qqpz>} z)076*ciIwyv^wxB>UQP1T^ScGIwM$W)r($ouL8<(?qI81MB;A~1{Kb=)rOeJtu+&# zWQsNPdSwUPgvG;V7PEi|iJp$42Q~zEUG9Qh7LwdUeO(S1Q$T@rz|%31B6-f)h^Ckp z>Ukbex$2fCxi%$XI=Pam`rPWRylEJjeIi(@kRt!!s>f3rAuxj zPGirfTf_VYnDo^iyqak-S(k7qYNdx63+dEQm&z*Xd9QFJ3NG^sT3BHci++)3$%fX_ z_$_%gt*mOZl3MmQOXUt}_G)qM`%pW3oAOc~@u})BBqi);fXR%FU zf@GX&*upfTYep* z>6N`*EY{e|*H~ZaD*{i6)Je*C>MW3U198UFgng7d@Z@E&n;=gIg4dP+F;B-NLdrxx zBs7plA5R=xJgplV^DE7xTgC}J_?28n;!w$?49VI?6Am+309;6uHIL*W%1dGDp7tkD zWIVQ;`WXy46`mF3Fb7SNl0YJVs6`}utEI-y#^X%WGZqh0B4nBcGD~S0#ir838h*Bv z0@m|hYMjwJNp&1Nx3%;+sJIMkg5x%aB@!Y>O*qgFV4kHK*Txe(cPTSwrAU>HVJV*R z`gg=6O-W>e`ZhJG)(Tg=TltE4}JhkXWmPWhldBRT4 zFNLWR@NvsZ1uY^%{r~(g^T)bI_%qD}$Y&N@PU{ zBjlR!HnV2)$eIY`NU+1Dw!ZGRvhVG#)gOZqiDMe=uCM7l*3o)>IW_is*s;G-4H;(@ z>mgL36zarPJHqR&hHSlsB(MZ4%xtc9jOdyq=a+O+qJvr&uZGlx)rO=2^1nu6z~z@U zNn58wR%(Q>@_5Ppl6uqWhZC02h{YAApf2$`vT-&`G%|(f_PgOw^vxn>VXk4U-E7|@ z>e;ZGRnEN-gEpF&>6*k78)zfUiH&we&81k~Yc&{`T~4pm^W1=**n894Z02`hCN^k3 z)q<@?=~Z9DYK~FuTy+37y%%_PS!m~Q6qV4}lJiI-?Rk);M8|(IRD;4GQ{0+YBpyp5 z5}SO6S5^J;7=unYDVmEu@uK1U)K1_{9%ix#R52xZEt5LG*q&-OJ@xril2rEULRs3o zh=7L_WXgs^s@79qs}iqZteLRdg{J5IgiN`pgu8URLT;;mz#6G1WE^?af+j5T=(?N5c;eIiEAPd{*e+<3*s+uC1SN;E4K2UycvI3JXA8CoP87bB8}qGkPD zo$6=%hsSUB&h{^k_73-V$CC@&j#K8~=+*vj7sq>NXZt5dyN!qsg(PC+f7fsdo&L0U z^6KK{+jmE2yWczSPxg=B9K75!Upmg0{nLwgCvSEYP4Bi^cx$ADo9=&XwA)TGt++iu zhsKkqL6%0~3-CF#LVDGTGbN5*!}`B{RLxwdwg2>wcpaYT#-BCdue;FLXtx{i{{4SK z$U#JuCeZm$R8ctH=%#-=es=~9Q@fP|qxGZ&rv~^x!8%?e#?n7S(_V)qY5gvEybgZ2 z{;|R0kbbyGh?F#qMWcJZ{*OlENeQBje>B$LKX2IhVU6y`hF-Y~KDf{;*XXW4aR9vj z+$mufRh20Ld;QZVbLyEi$L6NYNsVuF;=esQJ308_-Pys>>r(1_n=G!lW8A5Z?EV4yh+hoGd!{L&L8m9Pk1Q2Qk15-y$3uFXd*?6 zUnvfaUbn7!ddcFUuZ|3#_kX8>6fLK{mRCufyIlLFJHwWC=um^jxNfaA+nP_}&@Z*` zl@p&9y#AiRL5Q|i(!GOdA`t9 zrrvGEjNVi=zjhH^=nmMwXn29GdwIw#VJwhDDP-1in^W!ih?5Xs$&^QkVor;#HMLd8 zIkV(rs3As$w@irHJ3_#A;M)U8L!+)M?>sCF9>yfNzkQ_JMG`Y6fp<=q&jNifDC_H{ z_0*LtK!x;m2i3uRp50gNg$psSr)hnEI#1*8bD`!@dqcLw@xfw6r~Qyf;=6o~wwv&s zc75BfpYz+THPq$QmJ+`9>-YJ4`Tl$L|v3EzUNDSH(!C-VfMtOp?}G@qt8< ze*p?4_1j4&K2kJ4AuLs6^hr_LC!%Pwepbbu)BRzHS2YZ|x0bQF$~D=&HLf?_)P3o_ zwQpPW&WD#SlAwELbIAEHqS$z`S$rA~Sxh~=Np-5IpG`6H>TXzT$Lo~S<1}2Gu2UKD z0(HdwaRMWL?Mv>PZp_`C@Mh{H?!D(sP+yLypDRb4WN>$*mt(G2QQ>2I`pmY6mN%7$ zZE42Q+-SA*4Q^}A-dy_ng*Tmv><%O-$)ZR%?3=V@zD--!TGMI?pI{w1B2vLpXv(Pd zQeK`MX}RfH#i(xrfU|hmGA*>c^WWVx)^}T)->=5LX~~>t<;2!^YhAVDt9DG=mn^=8 zM74;9IHW-}?44guTeqwthUmI2&t|l_4^c@srP{10z;3J(=H@ZdDc98PR@9&W%uq}G$pM#NUdF5mWv^Lqn-N=#KfuTq< zask|n_5y|ZT!qo6lK3XFgzndO?d$F;51FB;y)7dn3r=<76`>IB0b5mDiX3<)v-A65 z6;zAP66I0w?`>g(Y0*3935^As^WPu$Y@77XOL2c!8onC0ZN*PgO2j*O|pK(#7IxUlrw+$*ojx%W)^%(q2HR1Am!CC z7XX{zzu4}0Q}@BQU0Wj!;mQ{Gtae>%ZeZ_c^W;~hwkOU1(6Hj{vI6BO#IL+jzv4kN zGZ?_#CU-UV$K-=QCW)`j4DhU|zV&9g&fivdnsEJ})|%6x&j;pC!gV2E1v3@;NYtGd zEw#M)e$Mx^Ir1)yNSpt5gxiY$@qOu?y^1 z(|zdfqGO7$d8PpydY;i4cD?_jzSvL!;QJW7!1pB^Q=ZA)?RFb{t6_vEPfe50!1s-L zf72xfW6EuyS4 zdRH)1TSe2~3w9Cm_(BFGr59)lvy15HssDDJyxZk zVz35VvBsb=zt(=Hm?SF2usYWyMfZ+>W;CsKw0C^a^*n%Hujc_+ih>GgTT@&G25Wrd z0c@-gwOL?hDNQ%0^R;G+t&4!j7K=kgM@)|hxHD}BSFyKFvlz}5JpdLN{n&LjPQ zkOzs72Q!J0vGvr(P1@#M8&7q?8d)2j9$)A;eI8D%eYy|p7@cgr`0bb;qyD?m?bLq_ zi6l;uS;Jg$SPe6|3&mYGpbHJX>l>xPl)o9;?zi1SiX#6U^Xun2(io!By5~8D`i-(J zRqhiMF(Dh)#Ggsu&Y^8)6sig29pz4kg3>U5+vi*gnUbVwMTz{=if%niS4T%L`(tJU z^&I;nvHmKar4QFT^s$it-{@57|K{e-BmIAf$M=2DbE4}MRM4|-AzkQrULJ{4`yJ}! zrTcI8PR|ZrUL5b8p8opwLH+BzXyRSafJw zwbys2`zJ?xhx?zQSF3aJytO>LypF8|VKyF5wBtX<%2aZS_P`_3TPwSKnm{7xdP_s= z5Q&k;)am4{>GV`aRw|)lb25%RDztE>#y|D7Yh1f9aDh50yU@x++QJZL6{cBz_U3ud z*C}5XmQrWIqC$>BWv)wVacnHKa0{~@08{om>rfTo>$ zxB;|ReJK^%0lwN0rcbH02-)pybXMp|-?Ds;+m)~XS%CldasjkZ|F^v}egD7li2o1q ztl3!Xvo3%(O-RzZ%b!vRMen?P|59`3^G#ghlvQ;#cR7E!3mc2<)f=12dfumT*O%V* zkB@m4Y>8B7@3=6hZ&Qp`=wlK8xBX(XD*v^&9_jysJZpbNr4dGKjju405cnUwJSf+5n^ZK?|;LHIr^?6 z7;$K*V*973aBvDI?~aZRj$Z3%Kx|;{%>4mj5v)($`F!7QcUmN2t*cH8$JdIcY!fwLqK8K#L1z?=xwK{fT0}OYAD9FkwrIfg z#g2|3Ql0 za~&X;x@;aW9XM|86+nK|ETqtxBk{$UhqMcgjh&q>O||%SOw%r;oJ;&Y)F~%Q4H|kD zQJt4KWGOnaO+0UG_swm`;$?!SQ+FLR2A#363mv;K!~EBmMyPM>St^>&9o2w~_`l7~ zY5M=7{Yd{G;;HEW>NI=hz)DLi`2M4$cFXPhU90{@x;WE?dgtoh{xr(D2Y8ml|GTLH z7x8}^)%(BB&d&BD{y)gG2IUNNcTofKxGtZaNv>mz99-St5tq~^Ph_H!J+DaQgF&J( znVzBpIxKk{0u%ANbn~ous!WmA@XxD!tibv+h1e@QYt9Vo7xF;ZU~{VDN+X5WX6un; ze}U)LOT9uLi}=4O|Idx~_RgdI$Adh+?|W--Ow%!w5O8177fC}+^Wwl{TN6BDlB5%` zQGMWwr7|OtLiQ1hsc3p6mTb?2nCU`8@PTZ2-Wr^aQWjt4r1gJ(ImDn|O^=HIAy?#W zqQts}|J(ROXXE=Z_`i*X`UC6kMS46S#w3bp3c)CgFWv032~9D@wU@{5Q1YUQziAB3 zf+XugqtkAWwRo$mcA>G=**H|MA~t4Ig=duZ*5E|9o)2m&qpxUsHO}j*eVuadP#vXR zIETgwCE>3rlk{yI&<4Es0IHd#yUi&O~fM$0S02k{2 ztM(ro?H5~*_8$-OESCQ;pxtMd`fR9412q`&L#Q@h$cAUK7GN4qNTc6>vXnu z6i^221Lh5j^~i8sCVl5MPcKP|c}CTQN+Z{KKrNjalQ<($H1W<)G>wBdm?Zz0$PpYD zG|r~0#dJ3XG3r^y05C+G>dh-Js^MJVsh||j?Rl@$CF!(`jK|_xRjU5c4*T!BdfeUn z5VW0k|7+Q1XV13MyhEe^@FG2?0$DzAZCR$T#K=`Yn`(PEFTckaOP-5LwL_}I3mcE^ z`^~mD2XU5fFUg{)rRsR+=KR+n)d~2V^S{2$`8?3*|NjSh7VH1=VEd1jAAi7S5&qwY1K0xm?`*!9ivPE>`KbSU zkY^1J)l&cb{pnqGfVQ2lz~6~sZzWd0Rx z_6^~L0f_|FVv>+43v|$NJObo|d~@ACMRpM^={?m+>tNdDhyPsM-TeDwc#nCJLp|Hp&h z%JRNhde75-TDJ=1;^c2owH0-SCr@=R&oKXUF7O*S!Ij(B^(#FX#@6WBw)odg#6w+KF?mWt&oGl^Sz7&xMq^LQ#(7ycUA7X(Q=0Im=XILMLSlGg zUHH_dSCbqF3{ooc%>Ld+6W*{Z3Ps-3{seyKELOD%#PmAXR!ENBqD!gzYTh@E?x40y zqa9(wWGu)v5U7_(FfUh1Lj#s3oGF=~Ut?~1U5iLy60TVkc`Ux-(G^t!KE|z5jNY|k zkFbg&N)TcKP0cUc88zWx027|Uh+ySwG6BgwNyiCKNy?&$Vuupl6j~2Wc$OB^R*bfE zW})lDkT>%nrz8^GBM@;3f+M|fS(j0`u%QNB?8W>#i zq71HO$Of3$Oy&*gthcB$T3f3ut>+yKoL+FD2;^NcZLyVbA(+~#VMgtmSD=g_AzoD8 zI0g=R15G%B~;iH@bN&krN)>m zijtHo-WdTo$f9WCWpPMTC8mUMjk`#|h$IPBJG*K2rLCp5mtCgH?iW;|K!FG3bHJlm zwP{W>lQ@-oB%Z|Zs=$;hqoq#op~%9-2)tgUZ=Am>kE67@N4=HG@q{)0nrbAaUY@cuw2&Gn zMB*k_$lRv`o>IWLdDGNGYeH*x3W1dRViE^9X96bd511HyY9fj;;sZS*3@3~m1_@oN zyJfgFOZZ{rcMv0zhN=l(q=-?pZ@^Q;+({hJ&>KXV7(v7?HHySMRg&ifu2Cy&C?djD zj%b<>(#9r&Q;HakSzFyNA}1#Lw8Fv0s&5OJ?=-zO>x9Ym&B`-jG`UQ8J>$maq-m_M zPwuZCT#r~V0+U!(xZBVRnUE>#X9x^Fs2q|ysScd?iC_UlETFMKS_p^5{@|cfI^vXj zIOZP0RsVfPhP`~padRf8DGj9c_|(%>HA=mES4z%D9Md}xf-F^}IhyDlZqXm%_L9d} zG&MWb6m*fPqTy$;mW5gLEF~~>az)N+fMx+OWTSpB;kvp{+4LF{rnc+&1^yJvB=5JGI z2z|t>t-)eEC+ylMJQU9sLXF544x)CLB_4?h5K;lGSX9B`nie-RNDtK}4oIXq39kg# z0{%_d6CxWkvjY(T?omXv)j1!yYxZ>GnRiXGE4yWNPfTKG>P4sKzDE~wQ=`Io;+qr7 zFJJy(cfN1q`|oxNxcsW*VnzANoTI{jUu`>t^6AtS-YL{5BYuAh3-o^nf zZ3c@?7UBhvr~15)iMMMe?hZ#^2|9CbszLwUgkSXvX+AuP+yzXt7@01EZ;ss2gfrwh zx#fHi*EByS6a$1TfMVhUg2$I$Z*_*7GKdA6s)dav{6OWk8W<(P2!x~wqN8UIhwGUW zsxIVn%?2VyC=~O0^RcK`oD71}(#cY6X+31iB)qcHjLWJTHjPBrWFlP7hr=bMi6Ta7 z5hZMtT2lgv-VGHh1JM8K6C*!&lbn~9RZvRIXrO@%6= z2Q-%HL}O|%Pny!xOuq$=i}*(NMpP(pKoJ#ZAEk5-UBP^dstEcoA&)FIRnRA?+H3i^ z7p==lK3TZiWIcDXE`h9MO`#L0j@{1BOn*MZ@v7*=m1L`x^tYngJIy;Qe!~zXYLqmn z=OWRi(M?pCCP!9A8Ac6TF#uy*RxeCZtZ7dr`zB&0;g*UGo$HWe$L7lFu!O zD2cNKB07+26BQSEdcPopQ5NAV^3KfM_#*3zAZ1zs=@q=`y*cO<+Hc#oS5k1)cH|V$ zRxHNbSSOY*cU3wLKEtq!*1cslZ8M>bpIbDp^okl!8V9ts-P~@Cd6-31_*OU*&5;~O zYZrOv7m{C)i@bBo6V8;??=~FMsBas^(R|}KHJ|5MxRr_nui%Km4k^BDj2 zK_1NiR%CkHs3wCe$1Ft-{I!k-+R!_r;dxXXlHYmyi`E-;VcYXk9%+jWbIA)0G{R|k z04yG&rFZd0Coi+V@7JaT_2wiEZ)HmIn!y^p%(Y%Ir6COg^#aLNp!u;e3GF2qi99bi zjtOXuHPn}0<=M~DC*U3WSm^(;J%#_9FCODRJ;*bS|25cLoBVN+bl?V#Zp>E6*j5_1 zpgd|%HdZ4tGR5&l1b|K~=#)1LDG+X{fJUlawbkRh(6pphu@RA;se1v|9}XiZ94* z)GBe>PR#|_DV5L7HH{|WHi#vLJTsO+=9L@Js^{e})UKK^&V+PaUz?uS>rI!^U!ktE zS!HW__ww|Je@5@w&*l?rh;_*)*1j$I#Ohb2C~oMr`*>*nNuOJ6sg?U!DF0XEzjtR=?ks@T>QV6?Ej17e{Ahc$^V-h zkLUk`JZo@>s9P`m$8)9rfR7WdWM)2q4acwueLRiEU35JgLa9m)dbt&>y%aE-2BSSN z?{e+IbUO-h+*TYbL(>MnDO#u#JXO_=$~^PIKfI*rLZ~ER`k4)U($zj@V_KigwpRFD zTZ1$0m*{zR2I%CNW-**AY6dKp)S3h;Vuy}=8jczY>LtptE>!PNibaxB7~IVm(>?cB zPH^p2Hr+jU=9uMuX}q`3Qj2lNJ{IwRohkdT?XC8s{nvv$c>i0z`^2?h+2F$7fj-(> zd=t--^y*H1EX4n~2PFs(W=awz*Ilh-6q3kHbV17|VDE47g?`iL;lwH=eOO0d)Aiza!?b!4lQC^{ z4Z(2>#M!t{(+fVhKxwYg-LC(tNQ^DAx&BCFZvV`{f1c1-jMzXvMEt)O)Av7{TaWhN z5Au}tzssqA9W`&+s|`a@>8lQFzomb>dREsAtdjrpmU>~wh-^Xox76MKiA>2B;{Rul z|JUwpwx{hsAML*$=2?Tc35`$HQs318EN^JO1=yd`_UB&Jub;_`sKEJ>9nt63!xr6E zb+P%EiZ^in9{cSGcAx82^V=6~LL^#6I7=ZnaHQ{vs`QsUjLVXinV z(@_Ju(7@BIF;hl`DVLzqfNP7GlfrMiWfkrJIp){T@z(Mb3w}|#^)_e0s(mcN|Bd!` z7602ikM=(g@}T}#&>%~hoV?_*q#q<&&}H$ScqeGug*b~M&r5iCI$dlajEWcw)l^$9 zTgaD&!k_nHG8dU?NF>i%K6Z#MhweDWNBDA!Y|g z3;A^%aT1D(!b*|J&#%N0qN=|6(mVU{S>{=KJ@3%RBK~h{d&>T2bMw*u`$3*Z{m-)c zA1*|_)~7fszH(hp-7^RO@5A*IpGElJnTr3iy}k2z|MwtIjs2h6=pH5q=|baHDNlT? z`lYAz_}t=|f&W$`_z>}*Hg`6r?0+^kAMO7hAFoFMq!HW&h;#;O)_~d+;2!12it4Q{ktqBFRdGA&sb{AZUi(ly){U?t(4>t<8om*fNLw8tA077y*h4d`r7MgS(tyTrF6p z)*A=irVLM0-1I#Zs`xGy4lhuM4UnR-F_!Y0i>TjfZ4TfWpfBLIS~*FdKD<6U`p?1P zzg#$hAASH54mnKcYG`@ZrX@CIfRGr$X)13{`R88X{S1 zGFfHB%!iHI`~F0zRM7-N3<&X58K{0Ea}m;9g?2l~cs48|lqJGWm`N~=h{=YpAzr9u zU9j|H3gP;&a;w}8$FsTGyAu$2eyyYCjQgyxv4F}1#uuT~gk&dSh62h!|LJK$D4RVo z43V>DN41sDJDs0Rc@q&Y(u{3}Z0gPgtfyB7*orapc9s=ma7GvrG;Ee!2*rYrkY4Tk zGiiDtbRz=iG*Dv8{o#jZ;NA`Y-rOn4dJ8pc`y8S*f4o(#}v&pGR+X7l2D|@;RjtIVMn9R@>qPM@PTc(W-b+?bHk-WaQ45ByXLUkTw&?U9}h|i;}CvYPk$=4mD9fT$+TIcq90zcz4mLd+*52A&Kob$RRZBCyNpnq z&UStM-(J7}w3<}*|Iqu3+Ai=*7C3nR4UaQt=`Dup!m-|;N=MLCB|G%HMr{4eQto6Uuq-FX4TBgd2$HIhGML^y--G#b?wpr143DJX~bD_Gr9Ri)%yC^a?_mozmz**bLM}r z)1A8i`J%hN|Fx3z9FFbGt(bqWX_C}!z;y#=`34wZW@5r-R?Yn4*WVpAB&=}Oqb9Cw zo|jpWJ>4uRSzq(AS&Vf(?Mc*gkVO(=!ACH7>2V zY1`{Glz!FM#bL9_I=c&|mPW>5T$vZ|v7)DjL28)S2Mu7W64vZ63vOGp;_CV%%%YsT z9AYZuM5O7Q%&u+)W@Z!b!QlK-V@@StYj8HE?d<7$Dj_qGVsS=P9*%A~23HNN%I<|t zk@gLJU*R*q48qB~;-QeXz0TuXfvo_n8-dR+OKs@U$rH@HyfMoC^UJ68AkiH1r&sU? zv@!4eFW9NS{}FV$>-T?FlAb>^yTVh-e8R5a6w9IGNTL9dl*5>gNsMXYIH{Ivn_KYJ z0SK{z-CeYI@W$CVK6?GzUeDP8XmwyP(e8F_#BGL0Uo;W;#Vg*1cbE0 z={Oq)AO3iIuzzGA&w{G+0QT{S0FR9m&A+u8XbUSoi6(6Q_hz-9fvPS6cAZchQb~-g zt;lO%2KUc;9zj$GINTguq|`t>=Kw6m;O^#EH0LY%+bf z6}XP!uvU;S$PG|tw)q)fw(>2%=?wG#FTdp3InlO6fk~_DT3gYO#tORCYMLjuPKM*1 z6@Ij36MhEnF%u-@XN-O!5nyqa>NTkcZH;)_ZN`;I96AwadZ!S>vtmU=S8#p_uQCs8 z^K^_>9dw0o$f13HsTaS(*DCK4v-D*ms$CQvXT2W|Nq8|wQrj!jerc=#&0uAn8dJx4 z-srehQVn3PYCvP%<>(8vG?R6g=hVGB{^#DO_iy(P4((lserwaZXxRaXIGjt);8wE; zA%U+EPt`cp+a!%A%1%?E?MWi8h>f1_jVR-y4Ywdk1a0XL{@X!6pZw_iXYDOL$~0Es zwx)4#0VN887bYHEj;S3V<(1qumU~Gm+1p-6e~+nQ-Y}byV-7fqtgW!<7M)x2ozlF1 z%c!C_DJI!iP^MyV-)6tHe$vz(f0G}X3$Ed>>)hv#h}+61i)+!V>I8tSl(66dAuS@UnsTd%TZ*&aGYJ037Nb%ls)!g-X4ItL1P;ju zA}EjgK{se-L$>pO3@X3(YPU}HbT9Syfo;q?|J!*PO! - - - -- [Requirements](#requirements) -- [Installing](#installing) -- [Upgrading](#upgrading) -- [Usage notes](#usage-notes) -- [Configuration](#configuration) - - [Deprecated](#deprecated) -- [FAQ](#faq) - - [How to deploy this chart on a specific K8S distribution?](#how-to-deploy-this-chart-on-a-specific-k8s-distribution) - - [How to deploy dedicated nodes types?](#how-to-deploy-dedicated-nodes-types) - - [Clustering and Node Discovery](#clustering-and-node-discovery) - - [How to deploy clusters with security (authentication and TLS) enabled?](#how-to-deploy-clusters-with-security-authentication-and-tls-enabled) - - [How to migrate from helm/charts stable chart?](#how-to-migrate-from-helmcharts-stable-chart) - - [How to install OSS version of Elasticsearch?](#how-to-install-oss-version-of-elasticsearch) - - [How to install plugins?](#how-to-install-plugins) - - [How to use the keystore?](#how-to-use-the-keystore) - - [Basic example](#basic-example) - - [Multiple keys](#multiple-keys) - - [Custom paths and keys](#custom-paths-and-keys) - - [How to enable snapshotting?](#how-to-enable-snapshotting) - - [How to configure templates post-deployment?](#how-to-configure-templates-post-deployment) -- [Contributing](#contributing) - - - - - - -## Requirements - -* [Helm][] >=2.8.0 and <3.0.0 -* Kubernetes >=1.8 -* Minimum cluster requirements include the following to run this chart with -default settings. All of these settings are configurable. - * Three Kubernetes nodes to respect the default "hard" affinity settings - * 1GB of RAM for the JVM heap - -See [supported configurations][] for more details. - - -## Installing - -This chart is tested with 7.8.1 version. - -* Add the Elastic Helm charts repo: -`helm repo add elastic https://helm.elastic.co` - -* Install 7.8.1 release: -`helm install --name elasticsearch --version 7.8.1 elastic/elasticsearch` - - -## Upgrading - -Please always check [CHANGELOG.md][] and [BREAKING_CHANGES.md][] before -upgrading to a new chart version. - - -## Usage notes - -* This repo includes a number of [examples][] configurations which can be used -as a reference. They are also used in the automated testing of this chart. -* Automated testing of this chart is currently only run against GKE (Google -Kubernetes Engine). -* The chart deploys a StatefulSet and by default will do an automated rolling -update of your cluster. It does this by waiting for the cluster health to become -green after each instance is updated. If you prefer to update manually you can -set `OnDelete` [updateStrategy][]. -* It is important to verify that the JVM heap size in `esJavaOpts` and to set -the CPU/Memory `resources` to something suitable for your cluster. -* To simplify chart and maintenance each set of node groups is deployed as a -separate Helm release. Take a look at the [multi][] example to get an idea for -how this works. Without doing this it isn't possible to resize persistent -volumes in a StatefulSet. By setting it up this way it makes it possible to add -more nodes with a new storage size then drain the old ones. It also solves the -problem of allowing the user to determine which node groups to update first when -doing upgrades or changes. -* We have designed this chart to be very un-opinionated about how to configure -Elasticsearch. It exposes ways to set environment variables and mount secrets -inside of the container. Doing this makes it much easier for this chart to -support multiple versions with minimal changes. - - -## Configuration - -| Parameter | Description | Default | -|------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------| -| `antiAffinityTopologyKey` | The [anti-affinity][] topology key. By default this will prevent multiple Elasticsearch nodes from running on the same Kubernetes node | `kubernetes.io/hostname` | -| `antiAffinity` | Setting this to hard enforces the [anti-affinity][] rules. If it is set to soft it will be done "best effort". Other values will be ignored | `hard` | -| `clusterHealthCheckParams` | The [Elasticsearch cluster health status params][] that will be used by readiness [probe][] command | `wait_for_status=green&timeout=1s` | -| `clusterName` | This will be used as the Elasticsearch [cluster.name][] and should be unique per cluster in the namespace | `elasticsearch` | -| `enableServiceLinks` | Set to false to disabling service links, which can cause slow pod startup times when there are many services in the current namespace. | `true` | -| `envFrom` | Templatable string to be passed to the [environment from variables][] which will be appended to the `envFrom:` definition for the container | `[]` | -| `esConfig` | Allows you to add any config files in `/usr/share/elasticsearch/config/` such as `elasticsearch.yml` and `log4j2.properties`. See [values.yaml][] for an example of the formatting | `{}` | -| `esJavaOpts` | [Java options][] for Elasticsearch. This is where you should configure the [jvm heap size][] | `-Xmx1g -Xms1g` | -| `esMajorVersion` | Used to set major version specific configuration. If you are using a custom image and not running the default Elasticsearch version you will need to set this to the version you are running (e.g. `esMajorVersion: 6`) | `""` | -| `extraContainers` | Templatable string of additional `containers` to be passed to the `tpl` function | `""` | -| `extraEnvs` | Extra [environment variables][] which will be appended to the `env:` definition for the container | `[]` | -| `extraInitContainers` | Templatable string of additional `initContainers` to be passed to the `tpl` function | `""` | -| `extraVolumeMounts` | Templatable string of additional `volumeMounts` to be passed to the `tpl` function | `""` | -| `extraVolumes` | Templatable string of additional `volumes` to be passed to the `tpl` function | `""` | -| `fullnameOverride` | Overrides the `clusterName` and `nodeGroup` when used in the naming of resources. This should only be used when using a single `nodeGroup`, otherwise you will have name conflicts | `""` | -| `httpPort` | The http port that Kubernetes will use for the healthchecks and the service. If you change this you will also need to set [http.port][] in `extraEnvs` | `9200` | -| `imagePullPolicy` | The Kubernetes [imagePullPolicy][] value | `IfNotPresent` | -| `imagePullSecrets` | Configuration for [imagePullSecrets][] so that you can use a private registry for your image | `[]` | -| `imageTag` | The Elasticsearch Docker image tag | `7.8.1` | -| `image` | The Elasticsearch Docker image | `docker.elastic.co/elasticsearch/elasticsearch` | -| `ingress` | Configurable [ingress][] to expose the Elasticsearch service. See [values.yaml][] for an example | see [values.yaml][] | -| `initResources` | Allows you to set the [resources][] for the `initContainer` in the StatefulSet | `{}` | -| `keystore` | Allows you map Kubernetes secrets into the keystore. See the [config example][] and [how to use the keystore][] | `[]` | -| `labels` | Configurable [labels][] applied to all Elasticsearch pods | `{}` | -| `lifecycle` | Allows you to add [lifecycle hooks][]. See [values.yaml][] for an example of the formatting | `{}` | -| `masterService` | The service name used to connect to the masters. You only need to set this if your master `nodeGroup` is set to something other than `master`. See [Clustering and Node Discovery][] for more information | `""` | -| `masterTerminationFix` | A workaround needed for Elasticsearch < 7.2 to prevent master status being lost during restarts [#63][] | `false` | -| `maxUnavailable` | The [maxUnavailable][] value for the pod disruption budget. By default this will prevent Kubernetes from having more than 1 unhealthy pod in the node group | `1` | -| `minimumMasterNodes` | The value for [discovery.zen.minimum_master_nodes][]. Should be set to `(master_eligible_nodes / 2) + 1`. Ignored in Elasticsearch versions >= 7 | `2` | -| `nameOverride` | Overrides the `clusterName` when used in the naming of resources | `""` | -| `networkHost` | Value for the [network.host Elasticsearch setting][] | `0.0.0.0` | -| `nodeAffinity` | Value for the [node affinity settings][] | `{}` | -| `nodeGroup` | This is the name that will be used for each group of nodes in the cluster. The name will be `clusterName-nodeGroup-X` , `nameOverride-nodeGroup-X` if a `nameOverride` is specified, and `fullnameOverride-X` if a `fullnameOverride` is specified | `master` | -| `nodeSelector` | Configurable [nodeSelector][] so that you can target specific nodes for your Elasticsearch cluster | `{}` | -| `persistence` | Enables a persistent volume for Elasticsearch data. Can be disabled for nodes that only have [roles][] which don't require persistent data | see [values.yaml][] | -| `podAnnotations` | Configurable [annotations][] applied to all Elasticsearch pods | `{}` | -| `podManagementPolicy` | By default Kubernetes [deploys StatefulSets serially][]. This deploys them in parallel so that they can discover each other | `Parallel` | -| `podSecurityContext` | Allows you to set the [securityContext][] for the pod | see [values.yaml][] | -| `podSecurityPolicy` | Configuration for create a pod security policy with minimal permissions to run this Helm chart with `create: true`. Also can be used to reference an external pod security policy with `name: "externalPodSecurityPolicy"` | see [values.yaml][] | -| `priorityClassName` | The name of the [PriorityClass][]. No default is supplied as the PriorityClass must be created first | `""` | -| `protocol` | The protocol that will be used for the readiness [probe][]. Change this to `https` if you have `xpack.security.http.ssl.enabled` set | `http` | -| `rbac` | Configuration for creating a role, role binding and ServiceAccount as part of this Helm chart with `create: true`. Also can be used to reference an external ServiceAccount with `serviceAccountName: "externalServiceAccountName"` | see [values.yaml][] | -| `readinessProbe` | Configuration fields for the readiness [probe][] | see [values.yaml][] | -| `replicas` | Kubernetes replica count for the StatefulSet (i.e. how many pods) | `3` | -| `resources` | Allows you to set the [resources][] for the StatefulSet | see [values.yaml][] | -| `roles` | A hash map with the specific [roles][] for the `nodeGroup` | see [values.yaml][] | -| `schedulerName` | Name of the [alternate scheduler][] | `""` | -| `secretMounts` | Allows you easily mount a secret as a file inside the StatefulSet. Useful for mounting certificates and other secrets. See [values.yaml][] for an example | `[]` | -| `securityContext` | Allows you to set the [securityContext][] for the container | see [values.yaml][] | -| `service.annotations` | [LoadBalancer annotations][] that Kubernetes will use for the service. This will configure load balancer if `service.type` is `LoadBalancer` | `{}` | -| `service.httpPortName` | The name of the http port within the service | `http` | -| `service.labelsHeadless` | Labels to be added to headless service | `{}` | -| `service.labels` | Labels to be added to non-headless service | `{}` | -| `service.loadBalancerIP` | Some cloud providers allow you to specify the [loadBalancer][] IP. If the `loadBalancerIP` field is not specified, the IP is dynamically assigned. If you specify a `loadBalancerIP` but your cloud provider does not support the feature, it is ignored. | `""` | -| `service.loadBalancerSourceRanges` | The IP ranges that are allowed to access | `[]` | -| `service.nodePort` | Custom [nodePort][] port that can be set if you are using `service.type: nodePort` | `""` | -| `service.transportPortName` | The name of the transport port within the service | `transport` | -| `service.type` | Elasticsearch [Service Types][] | `ClusterIP` | -| `sidecarResources` | Allows you to set the [resources][] for the sidecar containers in the StatefulSet | {} | -| `sysctlInitContainer` | Allows you to disable the `sysctlInitContainer` if you are setting [sysctl vm.max_map_count][] with another method | `enabled: true` | -| `sysctlVmMaxMapCount` | Sets the [sysctl vm.max_map_count][] needed for Elasticsearch | `262144` | -| `terminationGracePeriod` | The [terminationGracePeriod][] in seconds used when trying to stop the pod | `120` | -| `tolerations` | Configurable [tolerations][] | `[]` | -| `transportPort` | The transport port that Kubernetes will use for the service. If you change this you will also need to set [transport port configuration][] in `extraEnvs` | `9300` | -| `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` | -| `volumeClaimTemplate` | Configuration for the [volumeClaimTemplate for StatefulSets][]. You will want to adjust the storage (default `30Gi` ) and the `storageClassName` if you are using a different storage class | see [values.yaml][] | - -### Deprecated - -| Parameter | Description | Default | -|-----------|---------------------------------------------------------------------------------------------------------------|---------| -| `fsGroup` | The Group ID (GID) for [securityContext][] so that the Elasticsearch user can read from the persistent volume | `""` | - - -## FAQ - -### How to deploy this chart on a specific K8S distribution? - -This chart is designed to run on production scale Kubernetes clusters with -multiple nodes, lots of memory and persistent storage. For that reason it can be -a bit tricky to run them against local Kubernetes environments such as -[Minikube][]. - -This chart is highly tested with [GKE][], but some K8S distribution also -requires specific configurations. - -We provide examples of configuration for the following K8S providers: - -- [Docker for Mac][] -- [KIND][] -- [Minikube][] -- [MicroK8S][] -- [OpenShift][] - -### How to deploy dedicated nodes types? - -All the Elasticsearch pods deployed share the same configuration. If you need to -deploy dedicated [nodes types][] (for example dedicated master and data nodes), -you can deploy multiple releases of this chart with different configurations -while they share the same `clusterName` value. - -For each Helm release, the nodes types can then be defined using `roles` value. - -An example of Elasticsearch cluster using 2 different Helm releases for master -and data nodes can be found in [examples/multi][]. - -#### Clustering and Node Discovery - -This chart facilitates Elasticsearch node discovery and services by creating two -`Service` definitions in Kubernetes, one with the name `$clusterName-$nodeGroup` -and another named `$clusterName-$nodeGroup-headless`. -Only `Ready` pods are a part of the `$clusterName-$nodeGroup` service, while all -pods ( `Ready` or not) are a part of `$clusterName-$nodeGroup-headless`. - -If your group of master nodes has the default `nodeGroup: master` then you can -just add new groups of nodes with a different `nodeGroup` and they will -automatically discover the correct master. If your master nodes have a different -`nodeGroup` name then you will need to set `masterService` to -`$clusterName-$masterNodeGroup`. - -The chart value for `masterService` is used to populate -`discovery.zen.ping.unicast.hosts` , which Elasticsearch nodes will use to -contact master nodes and form a cluster. -Therefore, to add a group of nodes to an existing cluster, setting -`masterService` to the desired `Service` name of the related cluster is -sufficient. - -### How to deploy clusters with security (authentication and TLS) enabled? - -This Helm chart can use existing [Kubernetes secrets][] to setup -credentials or certificates for examples. These secrets should be created -outside of this chart and accessed using [environment variables][] and volumes. - -An example of Elasticsearch cluster using security can be found in -[examples/security][]. - -### How to migrate from helm/charts stable chart? - -If you currently have a cluster deployed with the [helm/charts stable][] chart -you can follow the [migration guide][]. - -### How to install OSS version of Elasticsearch? - -Deploying OSS version of Elasticsearch can be done by setting `image` value to -[Elasticsearch OSS Docker image][] - -An example of Elasticsearch cluster using OSS version can be found in -[examples/oss][]. - -### How to install plugins? - -The recommended way to install plugins into our Docker images is to create a -[custom Docker image][]. - -The Dockerfile would look something like: - -``` -ARG elasticsearch_version -FROM docker.elastic.co/elasticsearch/elasticsearch:${elasticsearch_version} - -RUN bin/elasticsearch-plugin install --batch repository-gcs -``` - -And then updating the `image` in values to point to your custom image. - -There are a couple reasons we recommend this. - -1. Tying the availability of Elasticsearch to the download service to install -plugins is not a great idea or something that we recommend. Especially in -Kubernetes where it is normal and expected for a container to be moved to -another host at random times. -2. Mutating the state of a running Docker image (by installing plugins) goes -against best practices of containers and immutable infrastructure. - -### How to use the keystore? - -#### Basic example - -Create the secret, the key name needs to be the keystore key path. In this -example we will create a secret from a file and from a literal string. - -``` -kubectl create secret generic encryption_key --from-file=xpack.watcher.encryption_key=./watcher_encryption_key -kubectl create secret generic slack_hook --from-literal=xpack.notification.slack.account.monitoring.secure_url='https://hooks.slack.com/services/asdasdasd/asdasdas/asdasd' -``` - -To add these secrets to the keystore: - -``` -keystore: - - secretName: encryption_key - - secretName: slack_hook -``` - -#### Multiple keys - -All keys in the secret will be added to the keystore. To create the previous -example in one secret you could also do: - -``` -kubectl create secret generic keystore_secrets --from-file=xpack.watcher.encryption_key=./watcher_encryption_key --from-literal=xpack.notification.slack.account.monitoring.secure_url='https://hooks.slack.com/services/asdasdasd/asdasdas/asdasd' -``` - -``` -keystore: - - secretName: keystore_secrets -``` - -#### Custom paths and keys - -If you are using these secrets for other applications (besides the Elasticsearch -keystore) then it is also possible to specify the keystore path and which keys -you want to add. Everything specified under each `keystore` item will be passed -through to the `volumeMounts` section for mounting the [secret][]. In this -example we will only add the `slack_hook` key from a secret that also has other -keys. Our secret looks like this: - -``` -kubectl create secret generic slack_secrets --from-literal=slack_channel='#general' --from-literal=slack_hook='https://hooks.slack.com/services/asdasdasd/asdasdas/asdasd' -``` - -We only want to add the `slack_hook` key to the keystore at path -`xpack.notification.slack.account.monitoring.secure_url`: - -``` -keystore: - - secretName: slack_secrets - items: - - key: slack_hook - path: xpack.notification.slack.account.monitoring.secure_url -``` - -You can also take a look at the [config example][] which is used as part of the -automated testing pipeline. - -### How to enable snapshotting? - -1. Install your [snapshot plugin][] into a custom Docker image following the -[how to install plugins guide][]. -2. Add any required secrets or credentials into an Elasticsearch keystore -following the [how to use the keystore][] guide. -3. Configure the [snapshot repository][] as you normally would. -4. To automate snapshots you can use a tool like [curator][]. In the future -there are plans to have Elasticsearch manage automated snapshots with -[Snapshot Lifecycle Management][]. - -### How to configure templates post-deployment? - -You can use `postStart` [lifecycle hooks][] to run code triggered after a -container is created. - -Here is an example of `postStart` hook to configure templates: - -```yaml -lifecycle: - postStart: - exec: - command: - - bash - - -c - - | - #!/bin/bash - # Add a template to adjust number of shards/replicas - TEMPLATE_NAME=my_template - INDEX_PATTERN="logstash-*" - SHARD_COUNT=8 - REPLICA_COUNT=1 - ES_URL=http://localhost:9200 - while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done - curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}' -``` - - -## Contributing - -Please check [CONTRIBUTING.md][] before any contribution or for any questions -about our development and testing process. - - -[#63]: https://github.com/elastic/helm-charts/issues/63 -[BREAKING_CHANGES.md]: https://github.com/elastic/helm-charts/blob/master/BREAKING_CHANGES.md -[CHANGELOG.md]: https://github.com/elastic/helm-charts/blob/master/CHANGELOG.md -[CONTRIBUTING.md]: https://github.com/elastic/helm-charts/blob/master/CONTRIBUTING.md -[alternate scheduler]: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/#specify-schedulers-for-pods -[annotations]: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ -[anti-affinity]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity -[cluster.name]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/cluster.name.html -[clustering and node discovery]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/README.md#clustering-and-node-discovery -[config example]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/config/values.yaml -[curator]: https://www.elastic.co/guide/en/elasticsearch/client/curator/7.8/snapshot.html -[custom docker image]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/docker.html#_c_customized_image -[deploys statefulsets serially]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies -[discovery.zen.minimum_master_nodes]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/discovery-settings.html#minimum_master_nodes -[docker for mac]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/docker-for-mac -[elasticsearch cluster health status params]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/cluster-health.html#request-params -[elasticsearch docker image]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/docker.html -[elasticsearch oss docker image]: https://www.docker.elastic.co/r/elasticsearch/elasticsearch-oss -[environment variables]: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#using-environment-variables-inside-of-your-config -[environment from variables]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables -[examples]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/ -[examples/multi]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/multi -[examples/oss]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/oss -[examples/security]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/security -[gke]: https://cloud.google.com/kubernetes-engine -[helm]: https://helm.sh -[helm/charts stable]: https://github.com/helm/charts/tree/master/stable/elasticsearch/ -[how to install plugins guide]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/README.md#how-to-install-plugins -[how to use the keystore]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/README.md#how-to-use-the-keystore -[http.port]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/modules-http.html#_settings -[imagePullPolicy]: https://kubernetes.io/docs/concepts/containers/images/#updating-images -[imagePullSecrets]: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret -[ingress]: https://kubernetes.io/docs/concepts/services-networking/ingress/ -[java options]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/jvm-options.html -[jvm heap size]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/heap-size.html -[kind]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/kubernetes-kind -[kubernetes secrets]: https://kubernetes.io/docs/concepts/configuration/secret/ -[labels]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ -[lifecycle hooks]: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/ -[loadBalancer annotations]: https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws -[loadBalancer]: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer -[maxUnavailable]: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget -[migration guide]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/migration/README.md -[minikube]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/minikube -[microk8s]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/microk8s -[multi]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/multi/ -[network.host elasticsearch setting]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/network.host.html -[node affinity settings]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature -[node-certificates]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/configuring-tls.html#node-certificates -[nodePort]: https://kubernetes.io/docs/concepts/services-networking/service/#nodeport -[nodes types]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/modules-node.html -[nodeSelector]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector -[openshift]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/openshift -[priorityClass]: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass -[probe]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ -[resources]: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ -[roles]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/modules-node.html -[secret]: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets -[securityContext]: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ -[service types]: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types -[snapshot lifecycle management]: https://github.com/elastic/elasticsearch/issues/38461 -[snapshot plugin]: https://www.elastic.co/guide/en/elasticsearch/plugins/7.8/repository.html -[snapshot repository]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/modules-snapshots.html -[supported configurations]: https://github.com/elastic/helm-charts/tree/7.8/README.md#supported-configurations -[sysctl vm.max_map_count]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/vm-max-map-count.html#vm-max-map-count -[terminationGracePeriod]: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods -[tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ -[transport port configuration]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/modules-transport.html#_transport_settings -[updateStrategy]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ -[values.yaml]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/values.yaml -[volumeClaimTemplate for statefulsets]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#stable-storage diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/config/Makefile deleted file mode 100644 index a3f9617..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/Makefile +++ /dev/null @@ -1,19 +0,0 @@ -default: test -include ../../../helpers/examples.mk - -RELEASE := helm-es-config - -install: - helm upgrade --wait --timeout=600 --install $(RELEASE) --values ./values.yaml ../../ - -secrets: - kubectl delete secret elastic-config-credentials elastic-config-secret elastic-config-slack elastic-config-custom-path || true - kubectl create secret generic elastic-config-credentials --from-literal=password=changeme --from-literal=username=elastic - kubectl create secret generic elastic-config-slack --from-literal=xpack.notification.slack.account.monitoring.secure_url='https://hooks.slack.com/services/asdasdasd/asdasdas/asdasd' - kubectl create secret generic elastic-config-secret --from-file=xpack.watcher.encryption_key=./watcher_encryption_key - kubectl create secret generic elastic-config-custom-path --from-literal=slack_url='https://hooks.slack.com/services/asdasdasd/asdasdas/asdasd' --from-literal=thing_i_don_tcare_about=test - -test: secrets install goss - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/config/README.md deleted file mode 100644 index 4fb0a28..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/README.md +++ /dev/null @@ -1,27 +0,0 @@ -# Config - -This example deploy a single node Elasticsearch 7.8.1 with authentication and -custom [values][]. - - -## Usage - -* Create the required secrets: `make secrets` - -* Deploy Elasticsearch chart with the default values: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/config-master 9200 - curl -u elastic:changeme http://localhost:9200/_cat/indices - ``` - - -## Testing - -You can also run [goss integration tests][] using `make test` - - -[goss integration tests]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/config/test/goss.yaml -[values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/config/values.yaml diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/test/goss.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/config/test/goss.yaml deleted file mode 100644 index 8487013..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/test/goss.yaml +++ /dev/null @@ -1,26 +0,0 @@ -http: - http://localhost:9200/_cluster/health: - status: 200 - timeout: 2000 - body: - - 'green' - - '"number_of_nodes":1' - - '"number_of_data_nodes":1' - - http://localhost:9200: - status: 200 - timeout: 2000 - body: - - '"cluster_name" : "config"' - - '"name" : "config-master-0"' - - 'You Know, for Search' - -command: - "elasticsearch-keystore list": - exit-status: 0 - stdout: - - keystore.seed - - bootstrap.password - - xpack.notification.slack.account.monitoring.secure_url - - xpack.notification.slack.account.otheraccount.secure_url - - xpack.watcher.encryption_key diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/values.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/config/values.yaml deleted file mode 100644 index ebde4f4..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/values.yaml +++ /dev/null @@ -1,31 +0,0 @@ ---- - -clusterName: "config" -replicas: 1 - -extraEnvs: - - name: ELASTIC_PASSWORD - valueFrom: - secretKeyRef: - name: elastic-credentials - key: password - - name: ELASTIC_USERNAME - valueFrom: - secretKeyRef: - name: elastic-credentials - key: username - -# This is just a dummy file to make sure that -# the keystore can be mounted at the same time -# as a custom elasticsearch.yml -esConfig: - elasticsearch.yml: | - path.data: /usr/share/elasticsearch/data - -keystore: - - secretName: elastic-config-secret - - secretName: elastic-config-slack - - secretName: elastic-config-custom-path - items: - - key: slack_url - path: xpack.notification.slack.account.otheraccount.secure_url diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/watcher_encryption_key b/rds/base/charts/jaeger/charts/elasticsearch/examples/config/watcher_encryption_key deleted file mode 100644 index b5f9078..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/config/watcher_encryption_key +++ /dev/null @@ -1 +0,0 @@ -supersecret diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/default/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/default/Makefile deleted file mode 100644 index 5f5215c..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/default/Makefile +++ /dev/null @@ -1,16 +0,0 @@ -default: test - -include ../../../helpers/examples.mk - -RELEASE := helm-es-default - -install: - helm upgrade --wait --timeout=600 --install $(RELEASE) ../../ - -restart: - helm upgrade --set terminationGracePeriod=121 --wait --timeout=600 --install $(RELEASE) ../../ - -test: install goss - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/default/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/default/README.md deleted file mode 100644 index 23a7d69..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/default/README.md +++ /dev/null @@ -1,25 +0,0 @@ -# Default - -This example deploy a 3 nodes Elasticsearch 7.8.1 cluster using -[default values][]. - - -## Usage - -* Deploy Elasticsearch chart with the default values: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/elasticsearch-master 9200 - curl localhost:9200/_cat/indices - ``` - - -## Testing - -You can also run [goss integration tests][] using `make test` - - -[goss integration tests]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/default/test/goss.yaml -[default values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/values.yaml diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/default/rolling_upgrade.sh b/rds/base/charts/jaeger/charts/elasticsearch/examples/default/rolling_upgrade.sh deleted file mode 100644 index c5a2a88..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/default/rolling_upgrade.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env bash -x - -kubectl proxy || true & - -make & -PROC_ID=$! - -while kill -0 "$PROC_ID" >/dev/null 2>&1; do - echo "PROCESS IS RUNNING" - if curl --fail 'http://localhost:8001/api/v1/proxy/namespaces/default/services/elasticsearch-master:9200/_search' ; then - echo "cluster is healthy" - else - echo "cluster not healthy!" - exit 1 - fi - sleep 1 -done -echo "PROCESS TERMINATED" -exit 0 diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/default/test/goss.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/default/test/goss.yaml deleted file mode 100644 index 781ccaf..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/default/test/goss.yaml +++ /dev/null @@ -1,39 +0,0 @@ -kernel-param: - vm.max_map_count: - value: '262144' - -http: - http://elasticsearch-master:9200/_cluster/health: - status: 200 - timeout: 2000 - body: - - 'green' - - '"number_of_nodes":3' - - '"number_of_data_nodes":3' - - http://localhost:9200: - status: 200 - timeout: 2000 - body: - - '"number" : "7.8.1"' - - '"cluster_name" : "elasticsearch"' - - '"name" : "elasticsearch-master-0"' - - 'You Know, for Search' - -file: - /usr/share/elasticsearch/data: - exists: true - mode: "2775" - owner: root - group: elasticsearch - filetype: directory - -mount: - /usr/share/elasticsearch/data: - exists: true - -user: - elasticsearch: - exists: true - uid: 1000 - gid: 1000 diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/Makefile deleted file mode 100644 index 398545e..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/Makefile +++ /dev/null @@ -1,12 +0,0 @@ -default: test - -RELEASE := helm-es-docker-for-mac - -install: - helm upgrade --wait --timeout=900 --install --values values.yaml $(RELEASE) ../../ - -test: install - helm test $(RELEASE) - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/README.md deleted file mode 100644 index 4892917..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# Docker for Mac - -This example deploy a 3 nodes Elasticsearch 7.8.1 cluster on [Docker for Mac][] -using [custom values][]. - -Note that this configuration should be used for test only and isn't recommended -for production. - - -## Usage - -* Deploy Elasticsearch chart with the default values: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/elasticsearch-master 9200 - curl localhost:9200/_cat/indices - ``` - - -[custom values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/docker-for-mac/values.yaml -[docker for mac]: https://docs.docker.com/docker-for-mac/kubernetes/ diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/values.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/values.yaml deleted file mode 100644 index f7deba6..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/docker-for-mac/values.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# Permit co-located instances for solitary minikube virtual machines. -antiAffinity: "soft" - -# Shrink default JVM heap. -esJavaOpts: "-Xmx128m -Xms128m" - -# Allocate smaller chunks of memory per pod. -resources: - requests: - cpu: "100m" - memory: "512M" - limits: - cpu: "1000m" - memory: "512M" - -# Request smaller persistent volumes. -volumeClaimTemplate: - accessModes: [ "ReadWriteOnce" ] - storageClassName: "hostpath" - resources: - requests: - storage: 100M diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/Makefile deleted file mode 100644 index af816a9..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/Makefile +++ /dev/null @@ -1,16 +0,0 @@ -default: test - -RELEASE := helm-es-kind - -install: - helm upgrade --wait --timeout=900 --install --values values.yaml $(RELEASE) ../../ - -install-local-path: - kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml - helm upgrade --wait --timeout=900 --install --values values-local-path.yaml $(RELEASE) ../../ - -test: install - helm test $(RELEASE) - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/README.md deleted file mode 100644 index e48c2b1..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/README.md +++ /dev/null @@ -1,36 +0,0 @@ -# KIND - -This example deploy a 3 nodes Elasticsearch 7.8.1 cluster on [Kind][] -using [custom values][]. - -Note that this configuration should be used for test only and isn't recommended -for production. - -Note that Kind < 0.7.0 are affected by a [kind issue][] with mount points -created from PVCs not writable by non-root users. [kubernetes-sigs/kind#1157][] -fix it in Kind 0.7.0. - -The workaround for Kind < 0.7.0 is to install manually -[Rancher Local Path Provisioner][] and use `local-path` storage class for -Elasticsearch volumes (see [Makefile][] instructions). - - -## Usage - -* For Kind >= 0.7.0: Deploy Elasticsearch chart with the default values: `make install` -* For Kind < 0.7.0: Deploy Elasticsearch chart with `local-path` storage class: `make install-local-path` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/elasticsearch-master 9200 - curl localhost:9200/_cat/indices - ``` - - -[custom values]: https://github.com/elastic/helm-charts/blob/7.8/elasticsearch/examples/kubernetes-kind/values.yaml -[kind]: https://kind.sigs.k8s.io/ -[kind issue]: https://github.com/kubernetes-sigs/kind/issues/830 -[kubernetes-sigs/kind#1157]: https://github.com/kubernetes-sigs/kind/pull/1157 -[rancher local path provisioner]: https://github.com/rancher/local-path-provisioner -[Makefile]: https://github.com/elastic/helm-charts/blob/7.8/elasticsearch/examples/kubernetes-kind/Makefile#L5 diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/values-local-path.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/values-local-path.yaml deleted file mode 100644 index 500ad4b..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/values-local-path.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# Permit co-located instances for solitary minikube virtual machines. -antiAffinity: "soft" - -# Shrink default JVM heap. -esJavaOpts: "-Xmx128m -Xms128m" - -# Allocate smaller chunks of memory per pod. -resources: - requests: - cpu: "100m" - memory: "512M" - limits: - cpu: "1000m" - memory: "512M" - -# Request smaller persistent volumes. -volumeClaimTemplate: - accessModes: [ "ReadWriteOnce" ] - storageClassName: "local-path" - resources: - requests: - storage: 100M diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/values.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/values.yaml deleted file mode 100644 index 500ad4b..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/kubernetes-kind/values.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# Permit co-located instances for solitary minikube virtual machines. -antiAffinity: "soft" - -# Shrink default JVM heap. -esJavaOpts: "-Xmx128m -Xms128m" - -# Allocate smaller chunks of memory per pod. -resources: - requests: - cpu: "100m" - memory: "512M" - limits: - cpu: "1000m" - memory: "512M" - -# Request smaller persistent volumes. -volumeClaimTemplate: - accessModes: [ "ReadWriteOnce" ] - storageClassName: "local-path" - resources: - requests: - storage: 100M diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/Makefile deleted file mode 100644 index 2c7d3d3..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/Makefile +++ /dev/null @@ -1,12 +0,0 @@ -default: test - -RELEASE := helm-es-microk8s - -install: - helm upgrade --wait --timeout=900 --install --values values.yaml $(RELEASE) ../../ - -test: install - helm test $(RELEASE) - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/README.md deleted file mode 100644 index 75adcd8..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/README.md +++ /dev/null @@ -1,32 +0,0 @@ -# MicroK8S - -This example deploy a 3 nodes Elasticsearch 7.8.1 cluster on [MicroK8S][] -using [custom values][]. - -Note that this configuration should be used for test only and isn't recommended -for production. - - -## Requirements - -The following MicroK8S [addons][] need to be enabled: -- `dns` -- `helm` -- `storage` - - -## Usage - -* Deploy Elasticsearch chart with the default values: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/elasticsearch-master 9200 - curl localhost:9200/_cat/indices - ``` - - -[addons]: https://microk8s.io/docs/addons -[custom values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/microk8s/values.yaml -[MicroK8S]: https://microk8s.io diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/values.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/values.yaml deleted file mode 100644 index 2627ecb..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/microk8s/values.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -# Disable privileged init Container creation. -sysctlInitContainer: - enabled: false - -# Restrict the use of the memory-mapping when sysctlInitContainer is disabled. -esConfig: - elasticsearch.yml: | - node.store.allow_mmap: false - -# Permit co-located instances for solitary minikube virtual machines. -antiAffinity: "soft" - -# Shrink default JVM heap. -esJavaOpts: "-Xmx128m -Xms128m" - -# Allocate smaller chunks of memory per pod. -resources: - requests: - cpu: "100m" - memory: "512M" - limits: - cpu: "1000m" - memory: "512M" - -# Request smaller persistent volumes. -volumeClaimTemplate: - accessModes: [ "ReadWriteOnce" ] - storageClassName: "microk8s-hostpath" - resources: - requests: - storage: 100M diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/Makefile deleted file mode 100644 index 3b1dac1..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/Makefile +++ /dev/null @@ -1,10 +0,0 @@ -PREFIX := helm-es-migration - -data: - helm upgrade --wait --timeout=600 --install --values ./data.yml $(PREFIX)-data ../../ - -master: - helm upgrade --wait --timeout=600 --install --values ./master.yml $(PREFIX)-master ../../ - -client: - helm upgrade --wait --timeout=600 --install --values ./client.yml $(PREFIX)-client ../../ diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/README.md deleted file mode 100644 index ef53664..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/README.md +++ /dev/null @@ -1,167 +0,0 @@ -# Migration Guide from helm/charts - -There are two viable options for migrating from the community Elasticsearch Helm -chart from the [helm/charts][] repo. - -1. Restoring from Snapshot to a fresh cluster -2. Live migration by joining a new cluster to the existing cluster. - -## Restoring from Snapshot - -This is the recommended and preferred option. The downside is that it will -involve a period of write downtime during the migration. If you have a way to -temporarily stop writes to your cluster then this is the way to go. This is also -a lot simpler as it just involves launching a fresh cluster and restoring a -snapshot following the [restoring to a different cluster guide][]. - -## Live migration - -If restoring from a snapshot is not possible due to the write downtime then a -live migration is also possible. It is very important to first test this in a -testing environment to make sure you are comfortable with the process and fully -understand what is happening. - -This process will involve joining a new set of master, data and client nodes to -an existing cluster that has been deployed using the [helm/charts][] community -chart. Nodes will then be replaced one by one in a controlled fashion to -decommission the old cluster. - -This example will be using the default values for the existing helm/charts -release and for the Elastic helm-charts release. If you have changed any of the -default values then you will need to first make sure that your values are -configured in a compatible way before starting the migration. - -The process will involve a re-sync and a rolling restart of all of your data -nodes. Therefore it is important to disable shard allocation and perform a synced -flush like you normally would during any other rolling upgrade. See the -[rolling upgrades guide][] for more information. - -* The default image for this chart is -`docker.elastic.co/elasticsearch/elasticsearch` which contains the default -distribution of Elasticsearch with a [basic license][]. Make sure to update the -`image` and `imageTag` values to the correct Docker image and Elasticsearch -version that you currently have deployed. - -* Convert your current helm/charts configuration into something that is -compatible with this chart. - -* Take a fresh snapshot of your cluster. If something goes wrong you want to be -able to restore your data no matter what. - -* Check that your clusters health is green. If not abort and make sure your -cluster is healthy before continuing: - - ``` - curl localhost:9200/_cluster/health - ``` - -* Deploy new data nodes which will join the existing cluster. Take a look at the -configuration in [data.yml][]: - - ``` - make data - ``` - -* Check that the new nodes have joined the cluster (run this and any other curl -commands from within one of your pods): - - ``` - curl localhost:9200/_cat/nodes - ``` - -* Check that your cluster is still green. If so we can now start to scale down -the existing data nodes. Assuming you have the default amount of data nodes (2) -we now want to scale it down to 1: - - ``` - kubectl scale statefulsets my-release-elasticsearch-data --replicas=1 - ``` - -* Wait for your cluster to become green again: - - ``` - watch 'curl -s localhost:9200/_cluster/health' - ``` - -* Once the cluster is green we can scale down again: - - ``` - kubectl scale statefulsets my-release-elasticsearch-data --replicas=0 - ``` - -* Wait for the cluster to be green again. -* OK. We now have all data nodes running in the new cluster. Time to replace the -masters by firstly scaling down the masters from 3 to 2. Between each step make -sure to wait for the cluster to become green again, and check with -`curl localhost:9200/_cat/nodes` that you see the correct amount of master -nodes. During this process we will always make sure to keep at least 2 master -nodes as to not lose quorum: - - ``` - kubectl scale statefulsets my-release-elasticsearch-master --replicas=2 - ``` - -* Now deploy a single new master so that we have 3 masters again. See -[master.yml][] for the configuration: - - ``` - make master - ``` - -* Scale down old masters to 1: - - ``` - kubectl scale statefulsets my-release-elasticsearch-master --replicas=1 - ``` - -* Edit the masters in [masters.yml][] to 2 and redeploy: - - ``` - make master - ``` - -* Scale down the old masters to 0: - - ``` - kubectl scale statefulsets my-release-elasticsearch-master --replicas=0 - ``` - -* Edit the [masters.yml][] to have 3 replicas and remove the -`discovery.zen.ping.unicast.hosts` entry from `extraEnvs` then redeploy the -masters. This will make sure all 3 masters are running in the new cluster and -are pointing at each other for discovery: - - ``` - make master - ``` - -* Remove the `discovery.zen.ping.unicast.hosts` entry from `extraEnvs` then -redeploy the data nodes to make sure they are pointing at the new masters: - - ``` - make data - ``` - -* Deploy the client nodes: - - ``` - make client - ``` - -* Update any processes that are talking to the existing client nodes and point -them to the new client nodes. Once this is done you can scale down the old -client nodes: - - ``` - kubectl scale deployment my-release-elasticsearch-client --replicas=0 - ``` - -* The migration should now be complete. After verifying that everything is -working correctly you can cleanup leftover resources from your old cluster. - -[basic license]: https://www.elastic.co/subscriptions -[data.yml]: https://github.com/elastic/helm-charts/blob/7.8/elasticsearch/examples/migration/data.yml -[helm/charts]: https://github.com/helm/charts/tree/master/stable/elasticsearch -[master.yml]: https://github.com/elastic/helm-charts/blob/7.8/elasticsearch/examples/migration/master.yml -[restoring to a different cluster guide]: https://www.elastic.co/guide/en/elasticsearch/reference/6.6/modules-snapshots.html#_restoring_to_a_different_cluster -[rolling upgrades guide]: https://www.elastic.co/guide/en/elasticsearch/reference/6.6/rolling-upgrades.html diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/client.yml b/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/client.yml deleted file mode 100644 index 30ee700..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/client.yml +++ /dev/null @@ -1,23 +0,0 @@ ---- - -replicas: 2 - -clusterName: "elasticsearch" -nodeGroup: "client" - -esMajorVersion: 6 - -roles: - master: "false" - ingest: "false" - data: "false" - -volumeClaimTemplate: - accessModes: [ "ReadWriteOnce" ] - storageClassName: "standard" - resources: - requests: - storage: 1Gi # Currently needed till pvcs are made optional - -persistence: - enabled: false diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/data.yml b/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/data.yml deleted file mode 100644 index eedcbb0..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/data.yml +++ /dev/null @@ -1,17 +0,0 @@ ---- - -replicas: 2 - -esMajorVersion: 6 - -extraEnvs: - - name: discovery.zen.ping.unicast.hosts - value: "my-release-elasticsearch-discovery" - -clusterName: "elasticsearch" -nodeGroup: "data" - -roles: - master: "false" - ingest: "false" - data: "true" diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/master.yml b/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/master.yml deleted file mode 100644 index 3e3a2f1..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/migration/master.yml +++ /dev/null @@ -1,26 +0,0 @@ ---- - -# Temporarily set to 3 so we can scale up/down the old a new cluster -# one at a time whilst always keeping 3 masters running -replicas: 1 - -esMajorVersion: 6 - -extraEnvs: - - name: discovery.zen.ping.unicast.hosts - value: "my-release-elasticsearch-discovery" - -clusterName: "elasticsearch" -nodeGroup: "master" - -roles: - master: "true" - ingest: "false" - data: "false" - -volumeClaimTemplate: - accessModes: [ "ReadWriteOnce" ] - storageClassName: "standard" - resources: - requests: - storage: 4Gi diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/Makefile deleted file mode 100644 index 97109ce..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/Makefile +++ /dev/null @@ -1,12 +0,0 @@ -default: test - -RELEASE := helm-es-minikube - -install: - helm upgrade --wait --timeout=900 --install --values values.yaml $(RELEASE) ../../ - -test: install - helm test $(RELEASE) - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/README.md deleted file mode 100644 index e016987..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/README.md +++ /dev/null @@ -1,38 +0,0 @@ -# Minikube - -This example deploy a 3 nodes Elasticsearch 7.8.1 cluster on [Minikube][] -using [custom values][]. - -If helm or kubectl timeouts occur, you may consider creating a minikube VM with -more CPU cores or memory allocated. - -Note that this configuration should be used for test only and isn't recommended -for production. - - -## Requirements - -In order to properly support the required persistent volume claims for the -Elasticsearch StatefulSet, the `default-storageclass` and `storage-provisioner` -minikube addons must be enabled. - -``` -minikube addons enable default-storageclass -minikube addons enable storage-provisioner -``` - - -## Usage - -* Deploy Elasticsearch chart with the default values: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/elasticsearch-master 9200 - curl localhost:9200/_cat/indices - ``` - - -[custom values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/minikube/values.yaml -[minikube]: https://minikube.sigs.k8s.io/docs/ diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/values.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/values.yaml deleted file mode 100644 index ccceb3a..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/minikube/values.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -# Permit co-located instances for solitary minikube virtual machines. -antiAffinity: "soft" - -# Shrink default JVM heap. -esJavaOpts: "-Xmx128m -Xms128m" - -# Allocate smaller chunks of memory per pod. -resources: - requests: - cpu: "100m" - memory: "512M" - limits: - cpu: "1000m" - memory: "512M" - -# Request smaller persistent volumes. -volumeClaimTemplate: - accessModes: [ "ReadWriteOnce" ] - storageClassName: "standard" - resources: - requests: - storage: 100M diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/Makefile deleted file mode 100644 index 836ec2e..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/Makefile +++ /dev/null @@ -1,16 +0,0 @@ -default: test - -include ../../../helpers/examples.mk - -PREFIX := helm-es-multi -RELEASE := helm-es-multi-master - -install: - helm upgrade --wait --timeout=600 --install --values ./master.yml $(PREFIX)-master ../../ - helm upgrade --wait --timeout=600 --install --values ./data.yml $(PREFIX)-data ../../ - -test: install goss - -purge: - helm del --purge $(PREFIX)-master - helm del --purge $(PREFIX)-data diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/README.md deleted file mode 100644 index f27cade..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/README.md +++ /dev/null @@ -1,27 +0,0 @@ -# Multi - -This example deploy an Elasticsearch 7.8.1 cluster composed of 2 different Helm -releases: - -- `helm-es-multi-master` for the 3 master nodes using [master values][] -- `helm-es-multi-data` for the 3 data nodes using [data values][] - -## Usage - -* Deploy the 2 Elasticsearch releases: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/multi-master 9200 - curl -u elastic:changeme http://localhost:9200/_cat/indices - ``` - -## Testing - -You can also run [goss integration tests][] using `make test` - - -[data values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/multi/data.yml -[goss integration tests]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/multi/test/goss.yaml -[master values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/multi/master.yml diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/data.yml b/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/data.yml deleted file mode 100644 index ecc6893..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/data.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- - -clusterName: "multi" -nodeGroup: "data" - -roles: - master: "false" - ingest: "true" - data: "true" diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/master.yml b/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/master.yml deleted file mode 100644 index 2ca4cca..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/master.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- - -clusterName: "multi" -nodeGroup: "master" - -roles: - master: "true" - ingest: "false" - data: "false" diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/test/goss.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/test/goss.yaml deleted file mode 100644 index 18cb250..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/multi/test/goss.yaml +++ /dev/null @@ -1,9 +0,0 @@ -http: - http://localhost:9200/_cluster/health: - status: 200 - timeout: 2000 - body: - - 'green' - - '"cluster_name":"multi"' - - '"number_of_nodes":6' - - '"number_of_data_nodes":3' diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/Makefile deleted file mode 100644 index 6e49591..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/Makefile +++ /dev/null @@ -1,15 +0,0 @@ -default: test -include ../../../helpers/examples.mk - -RELEASE := elasticsearch - -template: - helm template --values ./values.yaml ../../ - -install: - helm upgrade --wait --timeout=600 --install $(RELEASE) --values ./values.yaml ../../ - -test: install goss - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/README.md deleted file mode 100644 index 73a3760..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/README.md +++ /dev/null @@ -1,24 +0,0 @@ -# OpenShift - -This example deploy a 3 nodes Elasticsearch 7.8.1 cluster on [OpenShift][] -using [custom values][]. - -## Usage - -* Deploy Elasticsearch chart with the default values: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/elasticsearch-master 9200 - curl localhost:9200/_cat/indices - ``` - -## Testing - -You can also run [goss integration tests][] using `make test` - - -[custom values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/openshift/values.yaml -[goss integration tests]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/openshift/test/goss.yaml -[openshift]: https://www.openshift.com/ diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/test/goss.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/test/goss.yaml deleted file mode 100644 index dd3dc71..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/test/goss.yaml +++ /dev/null @@ -1,17 +0,0 @@ -http: - http://localhost:9200/_cluster/health: - status: 200 - timeout: 2000 - body: - - 'green' - - '"number_of_nodes":3' - - '"number_of_data_nodes":3' - - http://localhost:9200: - status: 200 - timeout: 2000 - body: - - '"number" : "7.8.1"' - - '"cluster_name" : "elasticsearch"' - - '"name" : "elasticsearch-master-0"' - - 'You Know, for Search' diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/values.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/values.yaml deleted file mode 100644 index 8a21126..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/openshift/values.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- - -securityContext: - runAsUser: null - -podSecurityContext: - fsGroup: null - runAsUser: null - -sysctlInitContainer: - enabled: false diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/Makefile deleted file mode 100644 index e274659..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/Makefile +++ /dev/null @@ -1,12 +0,0 @@ -default: test -include ../../../helpers/examples.mk - -RELEASE := helm-es-oss - -install: - helm upgrade --wait --timeout=600 --install $(RELEASE) --values ./values.yaml ../../ - -test: install goss - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/README.md deleted file mode 100644 index fd2aad9..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# OSS - -This example deploy a 3 nodes Elasticsearch 7.8.1 cluster using -[Elasticsearch OSS][] version. - -## Usage - -* Deploy Elasticsearch chart with the default values: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/oss-master 9200 - curl localhost:9200/_cat/indices - ``` - -## Testing - -You can also run [goss integration tests][] using `make test` - - -[elasticsearch oss]: https://www.elastic.co/downloads/elasticsearch-oss -[goss integration tests]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/oss/test/goss.yaml diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/test/goss.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/test/goss.yaml deleted file mode 100644 index e0f10c4..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/test/goss.yaml +++ /dev/null @@ -1,17 +0,0 @@ -http: - http://localhost:9200/_cluster/health: - status: 200 - timeout: 2000 - body: - - 'green' - - '"number_of_nodes":3' - - '"number_of_data_nodes":3' - - http://localhost:9200: - status: 200 - timeout: 2000 - body: - - '"number" : "7.8.1"' - - '"cluster_name" : "oss"' - - '"name" : "oss-master-0"' - - 'You Know, for Search' diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/values.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/values.yaml deleted file mode 100644 index adcb7df..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/oss/values.yaml +++ /dev/null @@ -1,4 +0,0 @@ ---- - -clusterName: "oss" -image: "docker.elastic.co/elasticsearch/elasticsearch-oss" diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/security/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/security/Makefile deleted file mode 100644 index 46f0ee7..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/security/Makefile +++ /dev/null @@ -1,37 +0,0 @@ -default: test - -include ../../../helpers/examples.mk - -RELEASE := helm-es-security -ELASTICSEARCH_IMAGE := docker.elastic.co/elasticsearch/elasticsearch:$(STACK_VERSION) - -install: - helm upgrade --wait --timeout=600 --install --values ./security.yml $(RELEASE) ../../ - -purge: - kubectl delete secrets elastic-credentials elastic-certificates elastic-certificate-pem || true - helm del --purge $(RELEASE) - -test: secrets install goss - -pull-elasticsearch-image: - docker pull $(ELASTICSEARCH_IMAGE) - -secrets: - docker rm -f elastic-helm-charts-certs || true - rm -f elastic-certificates.p12 elastic-certificate.pem elastic-certificate.crt elastic-stack-ca.p12 || true - password=$$([ ! -z "$$ELASTIC_PASSWORD" ] && echo $$ELASTIC_PASSWORD || echo $$(docker run --rm busybox:1.31.1 /bin/sh -c "< /dev/urandom tr -cd '[:alnum:]' | head -c20")) && \ - docker run --name elastic-helm-charts-certs -i -w /app \ - $(ELASTICSEARCH_IMAGE) \ - /bin/sh -c " \ - elasticsearch-certutil ca --out /app/elastic-stack-ca.p12 --pass '' && \ - elasticsearch-certutil cert --name security-master --dns security-master --ca /app/elastic-stack-ca.p12 --pass '' --ca-pass '' --out /app/elastic-certificates.p12" && \ - docker cp elastic-helm-charts-certs:/app/elastic-certificates.p12 ./ && \ - docker rm -f elastic-helm-charts-certs && \ - openssl pkcs12 -nodes -passin pass:'' -in elastic-certificates.p12 -out elastic-certificate.pem && \ - openssl x509 -outform der -in elastic-certificate.pem -out elastic-certificate.crt && \ - kubectl create secret generic elastic-certificates --from-file=elastic-certificates.p12 && \ - kubectl create secret generic elastic-certificate-pem --from-file=elastic-certificate.pem && \ - kubectl create secret generic elastic-certificate-crt --from-file=elastic-certificate.crt && \ - kubectl create secret generic elastic-credentials --from-literal=password=$$password --from-literal=username=elastic && \ - rm -f elastic-certificates.p12 elastic-certificate.pem elastic-certificate.crt elastic-stack-ca.p12 diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/security/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/security/README.md deleted file mode 100644 index 0b94139..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/security/README.md +++ /dev/null @@ -1,29 +0,0 @@ -# Security - -This example deploy a 3 nodes Elasticsearch 7.8.1 with authentication and -autogenerated certificates for TLS (see [values][]). - -Note that this configuration should be used for test only. For a production -deployment you should generate SSL certificates following the [official docs][]. - -## Usage - -* Create the required secrets: `make secrets` - -* Deploy Elasticsearch chart with the default values: `make install` - -* You can now setup a port forward to query Elasticsearch API: - - ``` - kubectl port-forward svc/security-master 9200 - curl -u elastic:changeme https://localhost:9200/_cat/indices - ``` - -## Testing - -You can also run [goss integration tests][] using `make test` - - -[goss integration tests]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/security/test/goss.yaml -[official docs]: https://www.elastic.co/guide/en/elasticsearch/reference/7.8/configuring-tls.html#node-certificates -[values]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/security/security.yaml diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/security/security.yml b/rds/base/charts/jaeger/charts/elasticsearch/examples/security/security.yml deleted file mode 100644 index 04d932c..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/security/security.yml +++ /dev/null @@ -1,38 +0,0 @@ ---- -clusterName: "security" -nodeGroup: "master" - -roles: - master: "true" - ingest: "true" - data: "true" - -protocol: https - -esConfig: - elasticsearch.yml: | - xpack.security.enabled: true - xpack.security.transport.ssl.enabled: true - xpack.security.transport.ssl.verification_mode: certificate - xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12 - xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12 - xpack.security.http.ssl.enabled: true - xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12 - xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12 - -extraEnvs: - - name: ELASTIC_PASSWORD - valueFrom: - secretKeyRef: - name: elastic-credentials - key: password - - name: ELASTIC_USERNAME - valueFrom: - secretKeyRef: - name: elastic-credentials - key: username - -secretMounts: - - name: elastic-certificates - secretName: elastic-certificates - path: /usr/share/elasticsearch/config/certs diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/security/test/goss.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/security/test/goss.yaml deleted file mode 100644 index c6d4b98..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/security/test/goss.yaml +++ /dev/null @@ -1,45 +0,0 @@ -http: - https://security-master:9200/_cluster/health: - status: 200 - timeout: 2000 - allow-insecure: true - username: '{{ .Env.ELASTIC_USERNAME }}' - password: '{{ .Env.ELASTIC_PASSWORD }}' - body: - - 'green' - - '"number_of_nodes":3' - - '"number_of_data_nodes":3' - - https://localhost:9200/: - status: 200 - timeout: 2000 - allow-insecure: true - username: '{{ .Env.ELASTIC_USERNAME }}' - password: '{{ .Env.ELASTIC_PASSWORD }}' - body: - - '"cluster_name" : "security"' - - '"name" : "security-master-0"' - - 'You Know, for Search' - - https://localhost:9200/_xpack/license: - status: 200 - timeout: 2000 - allow-insecure: true - username: '{{ .Env.ELASTIC_USERNAME }}' - password: '{{ .Env.ELASTIC_PASSWORD }}' - body: - - 'active' - - 'basic' - -file: - /usr/share/elasticsearch/config/elasticsearch.yml: - exists: true - contains: - - 'xpack.security.enabled: true' - - 'xpack.security.transport.ssl.enabled: true' - - 'xpack.security.transport.ssl.verification_mode: certificate' - - 'xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12' - - 'xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12' - - 'xpack.security.http.ssl.enabled: true' - - 'xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12' - - 'xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12' diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/Makefile b/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/Makefile deleted file mode 100644 index f890d50..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/Makefile +++ /dev/null @@ -1,16 +0,0 @@ -default: test - -include ../../../helpers/examples.mk - -RELEASE := helm-es-upgrade - -install: - ./scripts/upgrade.sh --release $(RELEASE) - -init: - helm init --client-only - -test: init install goss - -purge: - helm del --purge $(RELEASE) diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/README.md b/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/README.md deleted file mode 100644 index def17dd..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/README.md +++ /dev/null @@ -1,27 +0,0 @@ -# Upgrade - -This example will deploy a 3 node Elasticsearch cluster using an old chart version, -then upgrade it to version 7.8.1. - -The following upgrades are tested: -- Upgrade from [7.0.0-alpha1][] version on K8S <1.16 -- Upgrade from [7.4.0][] version on K8S >=1.16 (Elasticsearch chart < 7.4.0 are -not compatible with K8S >= 1.16) - - -## Usage - -Running `make install` command will do first install and 7.8.1 upgrade. - -Note: [jq][] is a requirement for this make target. - - -## Testing - -You can also run [goss integration tests][] using `make test`. - - -[7.0.0-alpha1]: https://github.com/elastic/helm-charts/releases/tag/7.0.0-alpha1 -[7.4.0]: https://github.com/elastic/helm-charts/releases/tag/7.4.0 -[goss integration tests]: https://github.com/elastic/helm-charts/tree/7.8/elasticsearch/examples/upgrade/test/goss.yaml -[jq]: https://stedolan.github.io/jq/ diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/scripts/upgrade.sh b/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/scripts/upgrade.sh deleted file mode 100644 index 6d0aa9f..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/scripts/upgrade.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/usr/bin/env bash - -set -euo pipefail - -usage() { - cat <<-EOF - USAGE: - $0 [--release ] [--from ] - $0 --help - - OPTIONS: - --release - Name of the Helm release to install - --from - Elasticsearch version to use for first install - EOF - exit 1 -} - -RELEASE="helm-es-upgrade" -FROM="" - -while [[ $# -gt 0 ]] -do - key="$1" - - case $key in - --help) - usage - ;; - --release) - RELEASE="$2" - shift 2 - ;; - --from) - FROM="$2" - shift 2 - ;; - *) - log "Unrecognized argument: '$key'" - usage - ;; - esac -done - -if ! command -v jq > /dev/null -then - echo 'jq is required to use this script' - echo 'please check https://stedolan.github.io/jq/download/ to install it' - exit 1 -fi - -# Elasticsearch chart < 7.4.0 are not compatible with K8S >= 1.16) -if [[ -z $FROM ]] -then - KUBE_MINOR_VERSION=$(kubectl version -o json | jq --raw-output --exit-status '.serverVersion.minor' | sed 's/[^0-9]*//g') - - if [ "$KUBE_MINOR_VERSION" -lt 16 ] - then - FROM="7.0.0-alpha1" - else - FROM="7.4.0" - fi -fi - -helm repo add elastic https://helm.elastic.co - -# Initial install -printf "Installing Elasticsearch chart %s\n" "$FROM" -helm upgrade --wait --timeout=600 --install "$RELEASE" elastic/elasticsearch --version "$FROM" --set clusterName=upgrade -kubectl rollout status sts/upgrade-master --timeout=600s - -# Upgrade -printf "Upgrading Elasticsearch chart\n" -helm upgrade --wait --timeout=600 --set terminationGracePeriod=121 --install "$RELEASE" ../../ --set clusterName=upgrade -kubectl rollout status sts/upgrade-master --timeout=600s diff --git a/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/test/goss.yaml b/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/test/goss.yaml deleted file mode 100644 index c060b8b..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/examples/upgrade/test/goss.yaml +++ /dev/null @@ -1,17 +0,0 @@ -http: - http://localhost:9200/_cluster/health: - status: 200 - timeout: 2000 - body: - - 'green' - - '"number_of_nodes":3' - - '"number_of_data_nodes":3' - - http://localhost:9200: - status: 200 - timeout: 2000 - body: - - '"number" : "7.8.1"' - - '"cluster_name" : "upgrade"' - - '"name" : "upgrade-master-0"' - - 'You Know, for Search' diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/NOTES.txt b/rds/base/charts/jaeger/charts/elasticsearch/templates/NOTES.txt deleted file mode 100644 index 3841ada..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/NOTES.txt +++ /dev/null @@ -1,4 +0,0 @@ -1. Watch all cluster members come up. - $ kubectl get pods --namespace={{ .Release.Namespace }} -l app={{ template "elasticsearch.uname" . }} -w -2. Test cluster health using Helm test. - $ helm test {{ .Release.Name }} --cleanup diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/_helpers.tpl b/rds/base/charts/jaeger/charts/elasticsearch/templates/_helpers.tpl deleted file mode 100644 index 87783da..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/_helpers.tpl +++ /dev/null @@ -1,87 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "elasticsearch.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "elasticsearch.fullname" -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{- define "elasticsearch.uname" -}} -{{- if empty .Values.fullnameOverride -}} -{{- if empty .Values.nameOverride -}} -{{ .Values.clusterName }}-{{ .Values.nodeGroup }} -{{- else -}} -{{ .Values.nameOverride }}-{{ .Values.nodeGroup }} -{{- end -}} -{{- else -}} -{{ .Values.fullnameOverride }} -{{- end -}} -{{- end -}} - -{{- define "elasticsearch.masterService" -}} -{{- if empty .Values.masterService -}} -{{- if empty .Values.fullnameOverride -}} -{{- if empty .Values.nameOverride -}} -{{ .Values.clusterName }}-master -{{- else -}} -{{ .Values.nameOverride }}-master -{{- end -}} -{{- else -}} -{{ .Values.fullnameOverride }} -{{- end -}} -{{- else -}} -{{ .Values.masterService }} -{{- end -}} -{{- end -}} - -{{- define "elasticsearch.endpoints" -}} -{{- $replicas := int (toString (.Values.replicas)) }} -{{- $uname := (include "elasticsearch.uname" .) }} - {{- range $i, $e := untilStep 0 $replicas 1 -}} -{{ $uname }}-{{ $i }}, - {{- end -}} -{{- end -}} - -{{- define "elasticsearch.esMajorVersion" -}} -{{- if .Values.esMajorVersion -}} -{{ .Values.esMajorVersion }} -{{- else -}} -{{- $version := int (index (.Values.imageTag | splitList ".") 0) -}} - {{- if and (contains "docker.elastic.co/elasticsearch/elasticsearch" .Values.image) (not (eq $version 0)) -}} -{{ $version }} - {{- else -}} -7 - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for statefulset. -*/}} -{{- define "elasticsearch.statefulset.apiVersion" -}} -{{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "elasticsearch.ingress.apiVersion" -}} -{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/configmap.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/configmap.yaml deleted file mode 100644 index 93285a0..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/configmap.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if .Values.esConfig }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "elasticsearch.uname" . }}-config - namespace: {{ .Release.Namespace }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}" - app: "{{ template "elasticsearch.uname" . }}" -data: -{{- range $path, $config := .Values.esConfig }} - {{ $path }}: | -{{ $config | indent 4 -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/ingress.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/ingress.yaml deleted file mode 100644 index ddb84fc..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/ingress.yaml +++ /dev/null @@ -1,39 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "elasticsearch.uname" . -}} -{{- $servicePort := .Values.httpPort -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: {{ template "elasticsearch.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ $fullName }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ .Chart.Name }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- with .Values.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ . }} - http: - paths: - - path: {{ $ingressPath }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $servicePort }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/poddisruptionbudget.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/poddisruptionbudget.yaml deleted file mode 100644 index a4dfe0f..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -{{- if .Values.maxUnavailable }} -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: "{{ template "elasticsearch.uname" . }}-pdb" - namespace: {{ .Release.Namespace }} -spec: - maxUnavailable: {{ .Values.maxUnavailable }} - selector: - matchLabels: - app: "{{ template "elasticsearch.uname" . }}" -{{- end }} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/podsecuritypolicy.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/podsecuritypolicy.yaml deleted file mode 100644 index f570c90..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/podsecuritypolicy.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if .Values.podSecurityPolicy.create -}} -{{- $fullName := include "elasticsearch.uname" . -}} -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ default $fullName .Values.podSecurityPolicy.name | quote }} - namespace: {{ .Release.Namespace }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - app: {{ $fullName | quote }} -spec: -{{ toYaml .Values.podSecurityPolicy.spec | indent 2 }} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/role.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/role.yaml deleted file mode 100644 index 1d51d3f..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/role.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if .Values.rbac.create -}} -{{- $fullName := include "elasticsearch.uname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $fullName | quote }} - namespace: {{ .Release.Namespace }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - app: {{ $fullName | quote }} -rules: - - apiGroups: - - extensions - resources: - - podsecuritypolicies - resourceNames: - {{- if eq .Values.podSecurityPolicy.name "" }} - - {{ $fullName | quote }} - {{- else }} - - {{ .Values.podSecurityPolicy.name | quote }} - {{- end }} - verbs: - - use -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/rolebinding.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/rolebinding.yaml deleted file mode 100644 index ad8304c..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/rolebinding.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.rbac.create -}} -{{- $fullName := include "elasticsearch.uname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $fullName | quote }} - namespace: {{ .Release.Namespace }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - app: {{ $fullName | quote }} -subjects: - - kind: ServiceAccount - {{- if eq .Values.rbac.serviceAccountName "" }} - name: {{ $fullName | quote }} - {{- else }} - name: {{ .Values.rbac.serviceAccountName | quote }} - {{- end }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: Role - name: {{ $fullName | quote }} - apiGroup: rbac.authorization.k8s.io -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/service.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/service.yaml deleted file mode 100644 index d022a63..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/service.yaml +++ /dev/null @@ -1,73 +0,0 @@ ---- -kind: Service -apiVersion: v1 -metadata: -{{- if eq .Values.nodeGroup "master" }} - name: {{ template "elasticsearch.masterService" . }} -{{- else }} - name: {{ template "elasticsearch.uname" . }} -{{- end }} - namespace: {{ .Release.Namespace }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}" - app: "{{ template "elasticsearch.uname" . }}" -{{- if .Values.service.labels }} -{{ toYaml .Values.service.labels | indent 4}} -{{- end }} - annotations: -{{ toYaml .Values.service.annotations | indent 4 }} -spec: - type: {{ .Values.service.type }} - selector: - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}" - app: "{{ template "elasticsearch.uname" . }}" - ports: - - name: {{ .Values.service.httpPortName | default "http" }} - protocol: TCP - port: {{ .Values.httpPort }} -{{- if .Values.service.nodePort }} - nodePort: {{ .Values.service.nodePort }} -{{- end }} - - name: {{ .Values.service.transportPortName | default "transport" }} - protocol: TCP - port: {{ .Values.transportPort }} -{{- if .Values.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.service.loadBalancerIP }} -{{- end }} -{{- with .Values.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: -{{ toYaml . | indent 4 }} -{{- end }} ---- -kind: Service -apiVersion: v1 -metadata: -{{- if eq .Values.nodeGroup "master" }} - name: {{ template "elasticsearch.masterService" . }}-headless -{{- else }} - name: {{ template "elasticsearch.uname" . }}-headless -{{- end }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}" - app: "{{ template "elasticsearch.uname" . }}" -{{- if .Values.service.labelsHeadless }} -{{ toYaml .Values.service.labelsHeadless | indent 4 }} -{{- end }} - annotations: - service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" -spec: - clusterIP: None # This is needed for statefulset hostnames like elasticsearch-0 to resolve - # Create endpoints also if the related pod isn't ready - publishNotReadyAddresses: true - selector: - app: "{{ template "elasticsearch.uname" . }}" - ports: - - name: {{ .Values.service.httpPortName | default "http" }} - port: {{ .Values.httpPort }} - - name: {{ .Values.service.transportPortName | default "transport" }} - port: {{ .Values.transportPort }} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/serviceaccount.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/serviceaccount.yaml deleted file mode 100644 index 0d74077..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/serviceaccount.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.rbac.create -}} -{{- $fullName := include "elasticsearch.uname" . -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - {{- if eq .Values.rbac.serviceAccountName "" }} - name: {{ $fullName | quote }} - {{- else }} - name: {{ .Values.rbac.serviceAccountName | quote }} - {{- end }} - namespace: {{ .Release.Namespace }} - annotations: - {{- with .Values.rbac.serviceAccountAnnotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - app: {{ $fullName | quote }} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/statefulset.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/statefulset.yaml deleted file mode 100644 index 2277e16..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/statefulset.yaml +++ /dev/null @@ -1,430 +0,0 @@ ---- -apiVersion: {{ template "elasticsearch.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ template "elasticsearch.uname" . }} - namespace: {{ .Release.Namespace }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}" - app: "{{ template "elasticsearch.uname" . }}" - {{- range $key, $value := .Values.labels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - annotations: - esMajorVersion: "{{ include "elasticsearch.esMajorVersion" . }}" -spec: - serviceName: {{ template "elasticsearch.uname" . }}-headless - selector: - matchLabels: - app: "{{ template "elasticsearch.uname" . }}" - replicas: {{ .Values.replicas }} - podManagementPolicy: {{ .Values.podManagementPolicy }} - updateStrategy: - type: {{ .Values.updateStrategy }} - {{- if .Values.persistence.enabled }} - volumeClaimTemplates: - - metadata: - name: {{ template "elasticsearch.uname" . }} - {{- if .Values.persistence.labels.enabled }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}" - app: "{{ template "elasticsearch.uname" . }}" - {{- range $key, $value := .Values.labels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - {{- end }} - {{- with .Values.persistence.annotations }} - annotations: -{{ toYaml . | indent 8 }} - {{- end }} - spec: -{{ toYaml .Values.volumeClaimTemplate | indent 6 }} - {{- end }} - template: - metadata: - name: "{{ template "elasticsearch.uname" . }}" - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}" - app: "{{ template "elasticsearch.uname" . }}" - {{- range $key, $value := .Values.labels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - annotations: - {{- range $key, $value := .Values.podAnnotations }} - {{ $key }}: {{ $value | quote }} - {{- end }} - {{/* This forces a restart if the configmap has changed */}} - {{- if .Values.esConfig }} - configchecksum: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }} - {{- end }} - spec: - {{- if .Values.schedulerName }} - schedulerName: "{{ .Values.schedulerName }}" - {{- end }} - securityContext: -{{ toYaml .Values.podSecurityContext | indent 8 }} - {{- if .Values.fsGroup }} - fsGroup: {{ .Values.fsGroup }} # Deprecated value, please use .Values.podSecurityContext.fsGroup - {{- end }} - {{- if .Values.rbac.create }} - serviceAccountName: "{{ template "elasticsearch.uname" . }}" - {{- else if not (eq .Values.rbac.serviceAccountName "") }} - serviceAccountName: {{ .Values.rbac.serviceAccountName | quote }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 6 }} - {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} - {{- if or (eq .Values.antiAffinity "hard") (eq .Values.antiAffinity "soft") .Values.nodeAffinity }} - {{- if .Values.priorityClassName }} - priorityClassName: {{ .Values.priorityClassName }} - {{- end }} - affinity: - {{- end }} - {{- if eq .Values.antiAffinity "hard" }} - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - "{{ template "elasticsearch.uname" .}}" - topologyKey: {{ .Values.antiAffinityTopologyKey }} - {{- else if eq .Values.antiAffinity "soft" }} - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 1 - podAffinityTerm: - topologyKey: {{ .Values.antiAffinityTopologyKey }} - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - "{{ template "elasticsearch.uname" . }}" - {{- end }} - {{- with .Values.nodeAffinity }} - nodeAffinity: -{{ toYaml . | indent 10 }} - {{- end }} - terminationGracePeriodSeconds: {{ .Values.terminationGracePeriod }} - volumes: - {{- range .Values.secretMounts }} - - name: {{ .name }} - secret: - secretName: {{ .secretName }} - {{- if .defaultMode }} - defaultMode: {{ .defaultMode }} - {{- end }} - {{- end }} - {{- if .Values.esConfig }} - - name: esconfig - configMap: - name: {{ template "elasticsearch.uname" . }}-config - {{- end }} -{{- if .Values.keystore }} - - name: keystore - emptyDir: {} - {{- range .Values.keystore }} - - name: keystore-{{ .secretName }} - secret: {{ toYaml . | nindent 12 }} - {{- end }} -{{ end }} - {{- if .Values.extraVolumes }} - # Currently some extra blocks accept strings - # to continue with backwards compatibility this is being kept - # whilst also allowing for yaml to be specified too. - {{- if eq "string" (printf "%T" .Values.extraVolumes) }} -{{ tpl .Values.extraVolumes . | indent 8 }} - {{- else }} -{{ toYaml .Values.extraVolumes | indent 8 }} - {{- end }} - {{- end }} - {{- if .Values.imagePullSecrets }} - imagePullSecrets: -{{ toYaml .Values.imagePullSecrets | indent 8 }} - {{- end }} - {{- if semverCompare ">1.13" .Capabilities.KubeVersion.GitVersion }} - enableServiceLinks: {{ .Values.enableServiceLinks }} - {{- end }} - initContainers: - {{- if .Values.sysctlInitContainer.enabled }} - - name: configure-sysctl - securityContext: - runAsUser: 0 - privileged: true - image: "{{ .Values.image }}:{{ .Values.imageTag }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - command: ["sysctl", "-w", "vm.max_map_count={{ .Values.sysctlVmMaxMapCount}}"] - resources: -{{ toYaml .Values.initResources | indent 10 }} - {{- end }} -{{ if .Values.keystore }} - - name: keystore - image: "{{ .Values.image }}:{{ .Values.imageTag }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - command: - - sh - - -c - - | - #!/usr/bin/env bash - set -euo pipefail - - elasticsearch-keystore create - - for i in /tmp/keystoreSecrets/*/*; do - key=$(basename $i) - echo "Adding file $i to keystore key $key" - elasticsearch-keystore add-file "$key" "$i" - done - - # Add the bootstrap password since otherwise the Elasticsearch entrypoint tries to do this on startup - if [ ! -z ${ELASTIC_PASSWORD+x} ]; then - echo 'Adding env $ELASTIC_PASSWORD to keystore as key bootstrap.password' - echo "$ELASTIC_PASSWORD" | elasticsearch-keystore add -x bootstrap.password - fi - - cp -a /usr/share/elasticsearch/config/elasticsearch.keystore /tmp/keystore/ - env: {{ toYaml .Values.extraEnvs | nindent 10 }} - envFrom: {{ toYaml .Values.envFrom | nindent 10 }} - resources: {{ toYaml .Values.initResources | nindent 10 }} - volumeMounts: - - name: keystore - mountPath: /tmp/keystore - {{- range .Values.keystore }} - - name: keystore-{{ .secretName }} - mountPath: /tmp/keystoreSecrets/{{ .secretName }} - {{- end }} -{{ end }} - {{- if .Values.extraInitContainers }} - # Currently some extra blocks accept strings - # to continue with backwards compatibility this is being kept - # whilst also allowing for yaml to be specified too. - {{- if eq "string" (printf "%T" .Values.extraInitContainers) }} -{{ tpl .Values.extraInitContainers . | indent 6 }} - {{- else }} -{{ toYaml .Values.extraInitContainers | indent 6 }} - {{- end }} - {{- end }} - containers: - - name: "{{ template "elasticsearch.name" . }}" - securityContext: -{{ toYaml .Values.securityContext | indent 10 }} - image: "{{ .Values.image }}:{{ .Values.imageTag }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - readinessProbe: - exec: - command: - - sh - - -c - - | - #!/usr/bin/env bash -e - # If the node is starting up wait for the cluster to be ready (request params: "{{ .Values.clusterHealthCheckParams }}" ) - # Once it has started only check that the node itself is responding - START_FILE=/tmp/.es_start_file - - http () { - local path="${1}" - local args="${2}" - set -- -XGET -s - - if [ "$args" != "" ]; then - set -- "$@" $args - fi - - if [ -n "${ELASTIC_USERNAME}" ] && [ -n "${ELASTIC_PASSWORD}" ]; then - set -- "$@" -u "${ELASTIC_USERNAME}:${ELASTIC_PASSWORD}" - fi - - curl --output /dev/null -k "$@" "{{ .Values.protocol }}://127.0.0.1:{{ .Values.httpPort }}${path}" - } - - if [ -f "${START_FILE}" ]; then - echo 'Elasticsearch is already running, lets check the node is healthy' - HTTP_CODE=$(http "/" "-w %{http_code}") - RC=$? - if [[ ${RC} -ne 0 ]]; then - echo "curl --output /dev/null -k -XGET -s -w '%{http_code}' \${BASIC_AUTH} {{ .Values.protocol }}://127.0.0.1:{{ .Values.httpPort }}/ failed with RC ${RC}" - exit ${RC} - fi - # ready if HTTP code 200, 503 is tolerable if ES version is 6.x - if [[ ${HTTP_CODE} == "200" ]]; then - exit 0 - elif [[ ${HTTP_CODE} == "503" && "{{ include "elasticsearch.esMajorVersion" . }}" == "6" ]]; then - exit 0 - else - echo "curl --output /dev/null -k -XGET -s -w '%{http_code}' \${BASIC_AUTH} {{ .Values.protocol }}://127.0.0.1:{{ .Values.httpPort }}/ failed with HTTP code ${HTTP_CODE}" - exit 1 - fi - - else - echo 'Waiting for elasticsearch cluster to become ready (request params: "{{ .Values.clusterHealthCheckParams }}" )' - if http "/_cluster/health?{{ .Values.clusterHealthCheckParams }}" "--fail" ; then - touch ${START_FILE} - exit 0 - else - echo 'Cluster is not yet ready (request params: "{{ .Values.clusterHealthCheckParams }}" )' - exit 1 - fi - fi -{{ toYaml .Values.readinessProbe | indent 10 }} - ports: - - name: http - containerPort: {{ .Values.httpPort }} - - name: transport - containerPort: {{ .Values.transportPort }} - resources: -{{ toYaml .Values.resources | indent 10 }} - env: - - name: node.name - valueFrom: - fieldRef: - fieldPath: metadata.name - {{- if eq .Values.roles.master "true" }} - {{- if ge (int (include "elasticsearch.esMajorVersion" .)) 7 }} - - name: cluster.initial_master_nodes - value: "{{ template "elasticsearch.endpoints" . }}" - {{- else }} - - name: discovery.zen.minimum_master_nodes - value: "{{ .Values.minimumMasterNodes }}" - {{- end }} - {{- end }} - {{- if lt (int (include "elasticsearch.esMajorVersion" .)) 7 }} - - name: discovery.zen.ping.unicast.hosts - value: "{{ template "elasticsearch.masterService" . }}-headless" - {{- else }} - - name: discovery.seed_hosts - value: "{{ template "elasticsearch.masterService" . }}-headless" - {{- end }} - - name: cluster.name - value: "{{ .Values.clusterName }}" - - name: network.host - value: "{{ .Values.networkHost }}" - - name: ES_JAVA_OPTS - value: "{{ .Values.esJavaOpts }}" - {{- range $role, $enabled := .Values.roles }} - - name: node.{{ $role }} - value: "{{ $enabled }}" - {{- end }} -{{- if .Values.extraEnvs }} -{{ toYaml .Values.extraEnvs | indent 10 }} -{{- end }} -{{- if .Values.envFrom }} - envFrom: -{{ toYaml .Values.envFrom | indent 10 }} -{{- end }} - volumeMounts: - {{- if .Values.persistence.enabled }} - - name: "{{ template "elasticsearch.uname" . }}" - mountPath: /usr/share/elasticsearch/data - {{- end }} -{{ if .Values.keystore }} - - name: keystore - mountPath: /usr/share/elasticsearch/config/elasticsearch.keystore - subPath: elasticsearch.keystore -{{ end }} - {{- range .Values.secretMounts }} - - name: {{ .name }} - mountPath: {{ .path }} - {{- if .subPath }} - subPath: {{ .subPath }} - {{- end }} - {{- end }} - {{- range $path, $config := .Values.esConfig }} - - name: esconfig - mountPath: /usr/share/elasticsearch/config/{{ $path }} - subPath: {{ $path }} - {{- end -}} - {{- if .Values.extraVolumeMounts }} - # Currently some extra blocks accept strings - # to continue with backwards compatibility this is being kept - # whilst also allowing for yaml to be specified too. - {{- if eq "string" (printf "%T" .Values.extraVolumeMounts) }} -{{ tpl .Values.extraVolumeMounts . | indent 10 }} - {{- else }} -{{ toYaml .Values.extraVolumeMounts | indent 10 }} - {{- end }} - {{- end }} - {{- if .Values.masterTerminationFix }} - {{- if eq .Values.roles.master "true" }} - # This sidecar will prevent slow master re-election - # https://github.com/elastic/helm-charts/issues/63 - - name: elasticsearch-master-graceful-termination-handler - image: "{{ .Values.image }}:{{ .Values.imageTag }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - command: - - "sh" - - -c - - | - #!/usr/bin/env bash - set -eo pipefail - - http () { - local path="${1}" - if [ -n "${ELASTIC_USERNAME}" ] && [ -n "${ELASTIC_PASSWORD}" ]; then - BASIC_AUTH="-u ${ELASTIC_USERNAME}:${ELASTIC_PASSWORD}" - else - BASIC_AUTH='' - fi - curl -XGET -s -k --fail ${BASIC_AUTH} {{ .Values.protocol }}://{{ template "elasticsearch.masterService" . }}:{{ .Values.httpPort }}${path} - } - - cleanup () { - while true ; do - local master="$(http "/_cat/master?h=node" || echo "")" - if [[ $master == "{{ template "elasticsearch.masterService" . }}"* && $master != "${NODE_NAME}" ]]; then - echo "This node is not master." - break - fi - echo "This node is still master, waiting gracefully for it to step down" - sleep 1 - done - - exit 0 - } - - trap cleanup SIGTERM - - sleep infinity & - wait $! - resources: -{{ toYaml .Values.sidecarResources | indent 10 }} - env: - - name: NODE_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - {{- if .Values.extraEnvs }} -{{ toYaml .Values.extraEnvs | indent 10 }} - {{- end }} - {{- if .Values.envFrom }} - envFrom: -{{ toYaml .Values.envFrom | indent 10 }} - {{- end }} - {{- end }} - {{- end }} -{{- if .Values.lifecycle }} - lifecycle: -{{ toYaml .Values.lifecycle | indent 10 }} -{{- end }} - {{- if .Values.extraContainers }} - # Currently some extra blocks accept strings - # to continue with backwards compatibility this is being kept - # whilst also allowing for yaml to be specified too. - {{- if eq "string" (printf "%T" .Values.extraContainers) }} -{{ tpl .Values.extraContainers . | indent 6 }} - {{- else }} -{{ toYaml .Values.extraContainers | indent 6 }} - {{- end }} - {{- end }} diff --git a/rds/base/charts/jaeger/charts/elasticsearch/templates/test/test-elasticsearch-health.yaml b/rds/base/charts/jaeger/charts/elasticsearch/templates/test/test-elasticsearch-health.yaml deleted file mode 100644 index a278b14..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/templates/test/test-elasticsearch-health.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -apiVersion: v1 -kind: Pod -metadata: - name: "{{ .Release.Name }}-{{ randAlpha 5 | lower }}-test" - annotations: - "helm.sh/hook": test-success -spec: - securityContext: -{{ toYaml .Values.podSecurityContext | indent 4 }} - containers: - - name: "{{ .Release.Name }}-{{ randAlpha 5 | lower }}-test" - image: "{{ .Values.image }}:{{ .Values.imageTag }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - command: - - "sh" - - "-c" - - | - #!/usr/bin/env bash -e - curl -XGET --fail '{{ template "elasticsearch.uname" . }}:{{ .Values.httpPort }}/_cluster/health?{{ .Values.clusterHealthCheckParams }}' - {{- if .Values.imagePullSecrets }} - imagePullSecrets: -{{ toYaml .Values.imagePullSecrets | indent 4 }} - {{- end }} - restartPolicy: Never diff --git a/rds/base/charts/jaeger/charts/elasticsearch/values.yaml b/rds/base/charts/jaeger/charts/elasticsearch/values.yaml deleted file mode 100644 index 284ea67..0000000 --- a/rds/base/charts/jaeger/charts/elasticsearch/values.yaml +++ /dev/null @@ -1,277 +0,0 @@ ---- -clusterName: "elasticsearch" -nodeGroup: "master" - -# The service that non master groups will try to connect to when joining the cluster -# This should be set to clusterName + "-" + nodeGroup for your master group -masterService: "" - -# Elasticsearch roles that will be applied to this nodeGroup -# These will be set as environment variables. E.g. node.master=true -roles: - master: "true" - ingest: "true" - data: "true" - -replicas: 3 -minimumMasterNodes: 2 - -esMajorVersion: "" - -# Allows you to add any config files in /usr/share/elasticsearch/config/ -# such as elasticsearch.yml and log4j2.properties -esConfig: {} -# elasticsearch.yml: | -# key: -# nestedkey: value -# log4j2.properties: | -# key = value - -# Extra environment variables to append to this nodeGroup -# This will be appended to the current 'env:' key. You can use any of the kubernetes env -# syntax here -extraEnvs: [] -# - name: MY_ENVIRONMENT_VAR -# value: the_value_goes_here - -# Allows you to load environment variables from kubernetes secret or config map -envFrom: [] -# - secretRef: -# name: env-secret -# - configMapRef: -# name: config-map - -# A list of secrets and their paths to mount inside the pod -# This is useful for mounting certificates for security and for mounting -# the X-Pack license -secretMounts: [] -# - name: elastic-certificates -# secretName: elastic-certificates -# path: /usr/share/elasticsearch/config/certs -# defaultMode: 0755 - -image: "docker.elastic.co/elasticsearch/elasticsearch" -imageTag: "7.8.1" -imagePullPolicy: "IfNotPresent" - -podAnnotations: {} - # iam.amazonaws.com/role: es-cluster - -# additionals labels -labels: {} - -esJavaOpts: "-Xmx1g -Xms1g" - -resources: - requests: - cpu: "1000m" - memory: "2Gi" - limits: - cpu: "1000m" - memory: "2Gi" - -initResources: {} - # limits: - # cpu: "25m" - # # memory: "128Mi" - # requests: - # cpu: "25m" - # memory: "128Mi" - -sidecarResources: {} - # limits: - # cpu: "25m" - # # memory: "128Mi" - # requests: - # cpu: "25m" - # memory: "128Mi" - -networkHost: "0.0.0.0" - -volumeClaimTemplate: - accessModes: [ "ReadWriteOnce" ] - resources: - requests: - storage: 30Gi - -rbac: - create: false - serviceAccountAnnotations: {} - serviceAccountName: "" - -podSecurityPolicy: - create: false - name: "" - spec: - privileged: true - fsGroup: - rule: RunAsAny - runAsUser: - rule: RunAsAny - seLinux: - rule: RunAsAny - supplementalGroups: - rule: RunAsAny - volumes: - - secret - - configMap - - persistentVolumeClaim - -persistence: - enabled: true - labels: - # Add default labels for the volumeClaimTemplate fo the StatefulSet - enabled: false - annotations: {} - -extraVolumes: [] - # - name: extras - # emptyDir: {} - -extraVolumeMounts: [] - # - name: extras - # mountPath: /usr/share/extras - # readOnly: true - -extraContainers: [] - # - name: do-something - # image: busybox - # command: ['do', 'something'] - -extraInitContainers: [] - # - name: do-something - # image: busybox - # command: ['do', 'something'] - -# This is the PriorityClass settings as defined in -# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass -priorityClassName: "" - -# By default this will make sure two pods don't end up on the same node -# Changing this to a region would allow you to spread pods across regions -antiAffinityTopologyKey: "kubernetes.io/hostname" - -# Hard means that by default pods will only be scheduled if there are enough nodes for them -# and that they will never end up on the same node. Setting this to soft will do this "best effort" -antiAffinity: "hard" - -# This is the node affinity settings as defined in -# https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature -nodeAffinity: {} - -# The default is to deploy all pods serially. By setting this to parallel all pods are started at -# the same time when bootstrapping the cluster -podManagementPolicy: "Parallel" - -# The environment variables injected by service links are not used, but can lead to slow Elasticsearch boot times when -# there are many services in the current namespace. -# If you experience slow pod startups you probably want to set this to `false`. -enableServiceLinks: true - -protocol: http -httpPort: 9200 -transportPort: 9300 - -service: - labels: {} - labelsHeadless: {} - type: ClusterIP - nodePort: "" - annotations: {} - httpPortName: http - transportPortName: transport - loadBalancerIP: "" - loadBalancerSourceRanges: [] - -updateStrategy: RollingUpdate - -# This is the max unavailable setting for the pod disruption budget -# The default value of 1 will make sure that kubernetes won't allow more than 1 -# of your pods to be unavailable during maintenance -maxUnavailable: 1 - -podSecurityContext: - fsGroup: 1000 - runAsUser: 1000 - -securityContext: - capabilities: - drop: - - ALL - # readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - -# How long to wait for elasticsearch to stop gracefully -terminationGracePeriod: 120 - -sysctlVmMaxMapCount: 262144 - -readinessProbe: - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 3 - timeoutSeconds: 5 - -# https://www.elastic.co/guide/en/elasticsearch/reference/7.8/cluster-health.html#request-params wait_for_status -clusterHealthCheckParams: "wait_for_status=green&timeout=1s" - -## Use an alternate scheduler. -## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ -## -schedulerName: "" - -imagePullSecrets: [] -nodeSelector: {} -tolerations: [] - -# Enabling this will publically expose your Elasticsearch instance. -# Only enable this if you have security enabled on your cluster -ingress: - enabled: false - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - path: / - hosts: - - chart-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -nameOverride: "" -fullnameOverride: "" - -# https://github.com/elastic/helm-charts/issues/63 -masterTerminationFix: false - -lifecycle: {} - # preStop: - # exec: - # command: ["/bin/sh", "-c", "echo Hello from the postStart handler > /usr/share/message"] - # postStart: - # exec: - # command: - # - bash - # - -c - # - | - # #!/bin/bash - # # Add a template to adjust number of shards/replicas - # TEMPLATE_NAME=my_template - # INDEX_PATTERN="logstash-*" - # SHARD_COUNT=8 - # REPLICA_COUNT=1 - # ES_URL=http://localhost:9200 - # while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done - # curl -XPUT "$ES_URL/_template/$TEMPLATE_NAME" -H 'Content-Type: application/json' -d'{"index_patterns":['\""$INDEX_PATTERN"\"'],"settings":{"number_of_shards":'$SHARD_COUNT',"number_of_replicas":'$REPLICA_COUNT'}}' - -sysctlInitContainer: - enabled: true - -keystore: [] - -# Deprecated -# please use the above podSecurityContext.fsGroup instead -fsGroup: "" diff --git a/rds/base/charts/jaeger/charts/kafka-0.20.6.tgz b/rds/base/charts/jaeger/charts/kafka-0.20.6.tgz deleted file mode 100644 index 6a0de445add8e78e8a4751e4d92e542709dcf38f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 32345 zcmV)bK&ihUiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYcd)qehFuH&1Q_N4!{$e*GCHa;_?{?q1iQDz&VxQQ(Y`Z-+ zL_!i`l3)qYwi@Ss&eu3!?|hQ;U;vOHMah!wT=v)SdD>VcE`z~fFf*7LoRiTx={}o~ zO!`w2M}PSMPp{YO?QU=5zr9|s{%?PCbN4U(?VX+N$NinH?cKlNo1MQv??V7ne{vy7 z_LttB`>GG_Kja}P`;lgX@nirO{T4~n;^&Uv^ZTukiXdaD#8-PM2__U?D53!-AkBvn z6BAG5Lse=>A*Mo*F-yjfQ90rHcp`xaAP_PkGd9d64O;*Kk7Fhw;$y!x;V~V+M9NeQ zx?LnlpI}Em&&J&r3sl#0zq6Q(spv+0%>6VOx6bMGl4qe9v^>DVEf4%P{`e*%YUm_le^4g%=4r z{0kOEB;c7O-;C93Kj3juYtoZLmW5@NAx*v!DVGzP@k+@dP2RFGkHR6%#x4C$k4Nx4 z3n;>Bu`*_Ik`Gn=?s-0>SwbZh-9RmC(Ulpc-IxeTvo1@5d`KkEx-L!{n)w%xC`p{w zJd4bR!U0c4QBD)dlAs%;UdV%Unt6I^nycs;)YI9zur$~6H+%kW>r=0aKhLB2{{@M1 zDn8T(u$cdE@AP}yb^gDzx%-9xe~f1hynB6GYkGGWwC=s-*4i4JOeh>1)_qJRutZ1_ zMFO@U<)MJ#6hb;8c_dpIO(PZ%F@UY2s^D!mSn7} zosjVW+PGJ?0oLG|ZNn5C@yzU(n|{ylVPnTB4cKT3rm>?uijH{1f~oqL(UIQm)Mi(3 zU!U=A$OF;M1r$ zQXr$h=Tt}mBncs6F_U67kOCg3xul+LQFL3yp96UJzNJv48y?`_0704$V6)eY&F`4T zJev-nzq7Ubis4HOR;5b6p-OLa`xR^9JpF@`^bo}sF@U!Bb9~kR9=xAp(f?i#UwG5)4tNsKREq8;&(0%GLVP7N9z`@0T}PbhuH^`gCp0vS zik5z3!Bc3I(^OIXVe*_tR8ozSV@WcJb1x)M^@?H%9FdGf5siRnaF~TOqv0D$!YQot zgnGlN#}n#r0KDdsf(Oq?0tuI9s6a-NW-wxzkdV=c5UZkd5Ew81+wmt z2o`w7CmeXnLoX%?8Pk|1(o6N4N_qIIcxl&zI}RNC4??vAYy`Pb;wwp}5adGg7)UNB zJY#>*OcgvL0}O<#My!jcNEXNVrKPC%oKCTX zdOX!krb-qsQX+&BXz|4w#5_;r5s{Mtba^VZ0M!+?xw4yI&KLGkX&-;oTP_4d+j>Fz zA|IwiPT-Qs2}?j0DnVeE(nA49KPrmPs1ovpUIjy{2rDxre==c0DG>pWhb*BXHV0>^ zk_CmNNkIJqq_d7fagb3WX~*I66(od25~T--R>a50`B0Cgt=_cl90N&!L{i~cQV_v} zhIvG@4p4vWLtBA&-d>JAi8vQs62>f1;AUPB_fwOSixXNqYNwZI|G7)KTt5g}e{ z!kc+FfC(END_J^k<7DiR4?C_AYM`kdGb(#P*|~L>>tSV z*VbUqObolA(X<0nQLmh)EFclkD-x#>RV}haX=ZC{pnBXhZNR$Z8WVb*AU@pTs}~!( zR#7}3YaL)nC@&n7Tp63}$#>d5! z9*h%SyxzZ}L5@a%f^kG-NTXvK(LnOdzE)36WH8ykN;4`1?!V4APqCtb+WMTA06e9c z(n<$#kW@Zs&16t{XZ3pfPV$sTd^~-jT5eY6Oqq9h}fCuE0GPUpJs^KGqf?ZVv8DbEWd{d|VEXib`Mekm~UW6mS(I(d$p`vG=)% zkuMmWwbYLSfmRk%Tew5E~x6k%WPjB_NBRb@$yK$ zQ^J*+e@3F`G$PYu8t^1kT1c-2kkX9tuz1&3?<9*U&t>s)rv)JLAfQ5=Ofo7aJPHTU zZvl)5i}H**Z?$T3gsm#Ba7mcN85w5$oMtf2NPv5WnB+3#mkF#3HkLGtH(*FdJVVx_ zcHwgtMKr|E>d%b@`13CM-nMUSISoocn(;6X)O;$8itbv(Ml_fP5%ngVp9^Hj3I>+o zta}NUETFSJ)=ho=p6V-CG=>%ZiHxH)Jybng0t%@(^zE4auUbxT-z$_HRp((>>1A-j zBdY08Q#H~a$O(}!As0&LV~Iq*EhjYgTdvSJ;Gi4a$S(dNtFjW`QNcXz%}?lSscsRxyA!{;OZn(TE0e z0PWY@Fh#TY|3OI@sr6=r3$@f*6Z2B5Xe3Fvv_PmAl4N5lk9a24?^OK@PkT={vBCW- z+*uS`ZgXUfqL?20ROK#ZVGVT+_N@E?vDoefSs8K}>iag=+mI z5R+8>fvpy;@DZvLhJC62ClvO7KG}csdhaD19Kl%eVx07ky|mCO~j03xUJgCksi)tAR; z_jrQ}zxk|o20f+L<`iA>XoP$qkkM&K(}+)L)-KCv15?l6cHS+t?7&_@+jS}|MaUKk zgXJ2~yXhR_tya@z3Tuu*=fKRFUY?Z10|@B_jTFBTEmiM16IqT%mv8fMOl8qROs;-N z$OU1MTIU1k<1#`c5lr|c#7Y-;q~DlK6?l1B2f~~xKreWdCz51SHSMM|;a99(8ZUg{)*AIhq0?xtRNY_Tf|1H*pyxsVZpcI$k!knE-ghtdx-Slnynb)%uUmVMjGW<-mHHDHirHNJ_+ea_=4ql(^|9mp&b|1VuI(&Y5aP)ql zxM8Q=0h)+BqqqRH?GOoAb3)zU!D!C@!UQ5WHGBQq9Eb*R?HTi}W$y*nE1Y)lV0|4~ zF+73??+{z3-@Z9~vH#}u;Q9NFjhn%l+3||~O{wr%PHzdP_h5a!38EVOc8j?Sl(<+| z2lK(Zmxp`LPru!Jx%c{+0`KVkz;0`6Yw$x7@L18bmRc3Fs_wUTLsY7j zE&|_v_hXW}u#{9*{M9MoD_$XkR@{|d$&A4M>mP-+T9)DvO)g3vhualeWzY&jQQJ_$ z0|`TB?D~oVg_gZiuFXw)l?qtbOj=T6A`kQ~iz3a8}>j&2{V*H|jzV^IL& zSkBuud$fg2w}g{Yq7e)pk4=|oZ!I{5ksdl0BF7s0H}}=wiyCSPDc%U-DNT-*PPS2Of)y|Z zt=8N4%IxZI@<=Pv}e zf`}4@8?8YpZV+~KXHxIA83iFVY2lwlGb5}AdFoW`0J{H}Lz0AE&Rv`{)#x7_Gln540b#=o$UXfIuV)+@91&hnWoxpVYn52qOB?aPQLO?=kh#qMTEYNM-=mf^5 zs*o~PJD}ox*j`LhTjNA?#Y^@70-<&zSidA$f+sgpsnO(*DbOn=m9h)E0d_m)xzsv0 zoN=?~Y5nC)pUzTgJ3G6aFiF*hd^mhd13cnEW%CS6RBIcJ3#-E0`09r&8Wj4QS}j@3 z2HkG=Z4$Ds{=2{V*zfs0zdzX7+1cs7jjytp6>UWPl4b!B^e~rcuFsdOkZ zrJN8I%LbnMt3^8~etM9q9Xm?~(DuJ-7ZY?as_SWzgVK7UskR63%fx7Zue5rGtKCdY z#}-vIqli*(cBDXXS(Bi>qnHpiiZhg}{R*lrvo(w#g$dR8+xV)W21V*-b*q)7PnEEQ zT~cbvu*79i`b%LwQ`2F(P{aAjk^yKs5FN`646im?l-U6s47kAf0EbD0{tLP_TpDX@ zmh9~*u7zD`QZ?3ztSZih1QH2eFN};>l`5n%XOZZx7OfDZeyMsO8BHEaDCIb0P^AC{ zLQW&P0qgyZ#cM?MxLK?`8sgd`Lw-SL)}ET@=B8jxn|I8~lwZ1L48C$+Ye~nvQUakL zkz`ycl2Cccv-8Tkh^sOv4VL4xC>PL$R|bDdtSd^Gt#8gIHz@hLV*BJR9_%XOM@dCE zb7Hp989Qvj?+U5dctNNo=58iNLPycBFnkFf3BePiNtIxGZ{sVE8YsUJ6SBFp+td{q zuh1RZ(8%UiZ+CO+>2472kWrrm;pp-1PJeTEYctsFQL;Ovk9VIu*$GF%W-kbzjz-(P z(QtF?$@cEf&SUzdkNRaWtFRCFr2!@4~;oq!)h8H zK))x-LF@CO#@@`?k?j_;JXxtnUCs1R?G_oAI~fJV%rK>Lm*b|zmOczMjLJ-4-4o30 z5QR6G{$2G5v+oKQukXv<$8`&<)a}oy+v~kzt(j$^Mf2H(5%4&T7@B;tsXIh>9koC& z(hsmgLXt2V{Vv{`HDc%CepbUp-{16me@2?FVzZcTg*X=qOUe!>EKaVrdL=h_W1T0B zzvL{XnpG;3Tx<9FM6&I*NA6mf; z%G6ot&}2F3BG0Ds@Mpu!Qt8=bXRYGfV_)9Fzo)EP_3?4uH~9HfzRvji)V?fcA!vhVrDm}g_@;@(HZXu#7tuzyg83GVB5}Gx zld&mfzP~OTa^S{sKi5kem(%5hNTD}P!_r3_%@fafMh}nSR|hQzW*F+xk_Z_mya~360`48HL$K37gxWoj`r=ylPLwh!5SKoI+hm<1`|Yx-~JrY3=3i zjtk9;d|0sr-ZMywOx%u>o1w~YNg=SoZCI_`v^h}q(l~z3{$FvuQ?ubz5 z{@>ov*I(%R!_c)p&gL;K zpahlj1-ikXBCziahyS`APj#f1X9%$UenaUO>!!d4{0+S?kwjgaqz5FTN*_S+*NgA?DQ*5tc)(0=!>4e#H>1HJ9~o4Psq>~N5z#hFyv%#H-Ku>gmM|Y}0Ni_r5iHqN*x1N0jy`UKi$U(*=(|%#I zr18qcfqXUuGDg>&>Lpj*u|xqUG;mHoFv5f<#G_G{_+F;+b{e0ASYDl!O-SsVRr&a&I+x{#;7W-wnXK12f9 z(a82QDrtfvi^bQwz3nHMm!Z9=n>RCqFkP0kK7c3Y-3&%_#} z(@U)M6O)q)Zk7ae%Y3R3?f}|?j*;MpQ%Oa~{)$EWL!f>yh?X5W011jXi6Vq~pb#Cl zN*h+WI0x`628O|Jjde~*5}saWOw#7sE!QsQVN11FKUFH*wuyEWYXoO6ir_aL?}9pb z*LY#+{c1uowMr#b`v=TKqdN{eI-3$rX%f;Tm;xW^xKZ>WvSpGGSh0wrWz9Ej=i(VZVh9>{mTyK0pqUB9!$*yO89Uj7X$Z<@}EDxf(a$5b|$Skjk*;9etB{FkNv%))8m6*_R+Ny z?aeh`)rN?$qA#KyIr#{Vek@%%i_-+_rCJG@$GKCS~PyS1ub`cQ*KW)XH>Na{+DiWV)2+c95^B5pE`%tm*@76R(MLQ z^6SHs{bOHV$$RYMhWwwqn>#zT{BK*2AAiaJ_EDZSEoCUKZ=^tNm_kjJC0gJqSV^n( zFJrwkJ4IPxI4#6V0)nC4-q~AUJP|g4);Q^ElYyKR9@#cFv-pf2-n9g!0Ou?T2Wk^) z0mM|2kVxZwr4riAcrhlOgowpdDC)t8A20RfwqWEtf z(@c+c$hj0UBdModl~ork38Flt(ALh#qdbaGk^o=P@zdVZ&6#m4=HU(Lm?2@|$S|Rt zB0(EF2tvEQ7$QVZm;pSKS@h_csi8Gl?LlacJPcM$_*mJ>;QldVyD*r+z!s#w8kj6+YWHFNwBh@d_}Mk(FZB&}j#Fro9bW6zSNfEaREq zYAIZg3RY=@XHA%Rs95I09gOF)aSKC^Xd6+`)nmj*l*rr~n62%_Z?(Sq>ZiRouMb{- zKlth^SB=0zwi3}XLni7FsZ2D00+P38_E9%DeO+v*={PF_WzYOp>qt+6pwxlvp@290 zd(U6(`>~FB$Dp&2s%=3V2$Zgg;ray;Trx3nl)gEbGjm=fL(&$Z0$th|V#g>sq?{$_ z*Q>CqJu=j^n8;fn4EQEO3P$u2VwU96c;J#KY7rrLz))W=Y!TWqFyJwT2_=!7OqCY( z?j67bwfK<;POcE1#z}zO;Ximi<)cpN>wc^r@C2|Dq zzY6cKq5oGg_-oiUH7m>g0h`wzCJLw`Pa!8%{C3j?iAI9X^t!0ah5a?6Y);2XSWb)i z;rv-+JdU%?+xW_5KPMb67`?=xfT|q3p5{?xt#n8MA`J4^&t5#_is(3I_T zulg*)7JWC;OpjritxqTNFA}81By|PTn|gTnu9&L3bhmilEIsX;C*@NsOaB9(y8eGU zp;4+BwM_3V75rlTzu)U^^=tb7_U_K+7ybWZJn!Chzk&-E577QOVi8s1=GU=8OE94W z_^OL*u=`bO|0*@%mrkH8wUUu3=h-|WW`*n3?UmoOdaW;5}$EvInca(s=;VVhYb$Yc%1ACN* z@9gRRkZNaEJl|8m8))Yswq%_aAI^SZKNk43W#$%G3gK!4usME7S zc0-4aaD6}m(3Ach&*IvN+YfJEq90E=-AveHWxcj-9*k0V>tNjG`I91{CWK4`N(7sB zT8Ncg|Cf1~EhVI(>SuOhOMK*6)V8wIgS4i)l*Ljl9!q{K(P41W^jnd47P|w5-SwJe z*F;|ah5@E=#)}$8nO7j!I+=wk&!TFZGtCraf!bk6uWTziN#3lPqupo~scm4h(9ZAp zMmlfa}s$_NWc* z)AsEJn>^7Qi4$>mZn9d%DNkr3%@jAm&*PXUzH_RpJ0odY%XF*HFlH4s$A~gp3He)M zPgrUO!TN~i!A2! z*os>XFgMJDzdS6F1IGNu9YmV8>m{3pwhS01v-)jNqO0B`N(?Obg_5SBEdz!LPPi3L zOx=4#iiPIBu+liX#eh`9X3GQCM&Z)2s@X_0zt%uKCeV(l`GB@2RjkrcGSg1;eq9c= z8h?37t>2YQw~r=c7Dz`(I(LH7xr+?u5L-|L5`6X0K-d+uh#kf3g34 zjHkw?jIT$jl$}>j)oL21Z??LMhmQ8oDbnV(Tpyh>Iu847+=HWHpSgy_oZM{dbB97Y zwe&jY93ikF5jE$ZSw^bbwZLV0B3W#bz4>A?fNSjr{9ouDFeJtYM^Fi#b~+A1=;k6* z-|@FT&T~Z`QTHKHD1HAPJdY-l$*HGL_YK;;;?(5&8rIhVqYxiGg1>(ayRe~SszYu= z`GX0E_D_UK>t^~3=P&g1_#Xi+VI4oUBP{1|(yYSaqE4p@5P!Hf&=yjmqflc_WD64(C`i=EL zHEf-zQJGEXWyBI%lpJR?1&_nSUwhuu-~RpRVXYlZqZpH^_Jt@>pgpxo67pEv7K%DT zn~N%qsCh)U9=rr;tP?a^s=;K5xX{WrXb2BQ7ruJX?bacBV{~OR674#Il;;#W!SF_r zM-rnuNsUHJPNnwX7u^lr1oIOSflMO<%fEJ zn{75A68`o#*gyOZ{*FsRS4fO^kPRwqaDnsR3Z59$y=xn5O?%MqK)ZyjJ@~blO>NvP zAsBqES|Kdz0SaMzDL#I?<4WLsVp_hOC=GJ4Tp6jPrt69N9<<)QckNv~% z@L!us!vQ4m==1r1*1VQR~Nri=G6Lp9`Alzslg?>e#RW&nxeo_H6GVLRwWq(}VHOEZ=PEF}^AAZUhLO#z4A4$M#rcyKT?5Q0~xK0x%9zuv!hW@*8) zEZ^WYFGnOJu~@jXG*Is%x4kcBtJR;<5Mwk7X|Js9oGK>$lu=V}c#f zoQoNh!laEw|895w-EJ?_Ui&xOzq4aF>H3`OL+W=l{0&_m*UP+Y&n6^EX!HsXk+Y2s zlHb?s|5r|Pdd&Wy8}_0bkA+{a|2urN@%O*|eH~%kaI#^Vp4_x!5BjGMHcuaHn^N^` zVY<~*77n2OV5@y!fS+(lq7wQQf!$gX479A3uoS)fE2C%G9?Q;-C6S`u<1?No@=iVK zC^*yG8?E7dM`bXfSslmzqm7P<^*IP{9<*-xCVJ5A&7lVvRPPKiU>;>WphEBxw1Y6B zM>Gp)BGo%xx+r!ttft0Iz}jM|ZFvB7yv_mnjgFBp*O(M=o7duqX2&$x=-60_n{c7Xy&6tXKbI&dbcgn0=7Al;w1~f)|?BMVw;srOM*8m=D zx4y*od`3@Q|0}Z|dev(^?w||ap#N?4Hg~J~-)3)XbL)%#_c5ONZc3VW%+c>inu>0r z&L@g&o!0_B@)mI!1psn<|_MAdG16Z? zW-2=OI+eXwE_+&{cejzE|0gxtya|%x-l77GGC|xDFcj5q4S;*eO$kKh>YHT%sWh_? zm@mTEpX{m2e{cEl9z8$xbA$ZXf4p1I|F*Na{l)(OQJx$8KShwSRQ`jAiR%ZtjuBAs zz&|l`<9|y8JtA@f?Pd?+_6F|g`Z`yU$3+~}lNlG%p^~Ob+47%!*dSE4mvsX5-o2}g zLT~8zA!gp>u4;vq>a7RPep}q{;JZbZ5gBikrkcZ9Zjh)liYd2jirK^DJAHwJ`Fz2n zJf^};N~h<-AXJ7V7KmL-2Tm}sWJG9=Sfv)yBXC;B&wcTg9DiDxIOQXyw3kq9x{>T zsgj(Ac{rx>?)$(E{J*!mxmDx;kNZ2@U-)~|GO9cA(g~( z>7&_tw>a>L)SJ(KPBPVMLe}h2YfYoYNs!t|-&#eDKchHxv-G>l(ll(X9 z|FOHh`z8O+M|n#Bv?UBls{|R|q6$)6o!ykzfBE`;LcCz15D%-DQr-v8DN4@|W%UTkd@kIE!pa+S` zaBOO+*Ca|OWG4BIE~o7UbtJxj@2j_qlGc{igGT@No8a8Ps={f%d-DLcSHavrz;$=k z4~yu67XJfqd@r!hiREc*%UK~+mGtJ~RTt!$jtil&AvyE=_nwVqECh!Sqtk0PJR>s$ zq&zgxRk@;bIDG@^OoFW?ux3iu5$2%FO5Jjrx=5=xgn>#}*Ez7Y@_9jQCaqM3Y?b1+ zPJdt2Zu_OfZQC2#YhW>_bQ}hXv;T&@wi>5XS@>nOnT>nVD!k2bmL7^E*_g_sB_MM` zH9shF>kzGk;(Fyq$>K(g-!MFT6G6Lr`h4qN(~L_V@Mr)h&yHGmns-%vR_=IECY;br zrBcFZyCJ<=PBKAO2CatBv-#}9Y2g?hAl@kPP|Skkel5iqBTU|+ZN)Maf3>{shN!u^ z{c}lk=UmR~+@4t54e?&Sa@)9pF@Nz!_?XWP`u|6<|32QH$^W#q)%&9Ve~f2oo$Iqa z!70QgD=axOk`_S(I^V7!g5sxE@{eb14Q8Y1*&04_Uj&E?>? zIIcomD$RQpx6>t&anFS1qVs;de`jc?!LxITX&yVul_cFC~^N}`!23w$^;6}TQ@d~D1o@A7SQ;#MgURWjy z7x&6FiR|6M z3=>kg_2+IjrN{`*lL zbl)N210e+GSzi-sSIH&DMMk*hYQ3tL6_lHbi&)Cyp8@ z3>U9gHngNX)Y+(FniSz%?(Q)AUH7Q(q&}7zk#yV`(_Aevtg0xg$$ajE=nt)uZnyY5h1EQ&3vk7&zP;bXi&FF z-Ef;s4XY()SUC^F?b0qRmt{e>H5;+ISXr)|GJ@kBR;EbR&*Bs)sG~1VfKn8xN4DCy zRwu&NT!^E8c=Rf8eqKA_sWKxewCNR-&}+lV{+n0-%enXi(||@42LB5}UU~nPT#(8O z@8_QfkA6rZ9-QxAr8Hw|M+g8>4@%OR!mr5H zo4r@xWhB5fX#H9NG2xfTR7#eN#o!{Yetk=_D(LamX^GX-iIk~M1mo9BF3sO7wYpRW z-6BzKcV5a``0pyB36t>Pzu@}X+)lDporsV-7s%9-$1IsTrhbgAA5E;zF}D4%Y)%=~ z?A(kpwz1{_YWGlnCf3`Dny#XBo(J3fuqj74tGH_3Eub7<9_3MF1-qG6%8!+b5xbxX z72+u4L+XZ;)2lM(Uq3TT+YZ%P;P#bAgPC{s4y^9mRLu?ksjnaU9gg!9Z6)Cg2dhvr zJXe;gfLtXY#lRVfFxllX4R{iY0c`bLCZmlV#mAjmUsdnPxotYwt$^b%TfIut zHEv#QNii-S+BPcnDxVerv!IC?ifuy9+=iBwF%QnEtS(8%1i1nkSG#GX<0WaZ z*3tqZTtIKNMrs7NJgL;$SxhSn=eE|;qRG8!Ppsu|a~zB2X*taicW&XO1L>-js&Q)W zwT zDGe2Fl9g^0j%ac*xC{O?KK}XY=hLIZHzy9FE>s&;xx~R}d(nt&t4D{=PY;gjZGM;W zxXJ)Wj7H%bI;u-5_+CqKLK2yy0l;a{?dSF0tNnZF$y%^b@SEG!@zLJ1571xrRz=(C zi@on&?4AB&fA8q@@aW`tc9NVqLawCrAgeny%!_XC@VoDh_fL*bPY#a`o}IqgKYDra zZ13dY@b&3;d(Tb|-!yhp6ONth!F+vpSi6i=XjoB7EL@)u@q$iour0f{(wbY5+8gr+ z^ULAki~aqh{Wqu24qw0Cf7U?BF7z`u-p&EJnJ=s|iinT>kY!>K@GlR)KYf1irg>t^ zXx;8#9gBQQGl48Qpnjq4lyVIpALm1SwfxA;269fP9e98MxLebl0X7WE0a}j_1C-C{ z6t2;9eHJXEAq;6iazXKC-sk)> zxg=Q#dq)Qlaw?E~rc{E^syQ$vE#Rfjc%K^|IZdZLgd~rLG-JsaSmK6x2_H@-x#++p z1(MOSd&$wF&PG!p*0=zd6BbOImhpZ%0Xbg6j5ops5&>3S9z4ejn{z?N6o|n0`sU_u z_4UUG&wZz@V@d~rHnu^xJ7#i{57B?7^!|1KWJ2UrbhrAO{U=2ucQ9|}iJ;PO2*n-X zzpGX^?JZ&oeEa6`#r~VqgXdpAcxPpVwY9Ij_w`z3faWp*kyT1EJ-$5Ldw%-u-pjq$ z&s3L3Uq4vK+lL=I%xZp8hKK083||3%d2oEP|9bz;@z+N$_YPj4?Eic+=yo-h4~}$x zZSBN$&XVvzKwC&f)$PRx;CRulUD_R7+cy?BcOf=mVa5t|o8c&;!At_noe}$GEfh!J z`{E+-jSshvc_Kd(?9^$5UeQ1sW|dSCt=bfq~TWy%^}O0t-h`myHQe_ z!-Q|OaWA!LJLT#-^-TB6@9c9a<$+DxFn8arVykHk-NqeRXu)#Mew|Sg9wyP$xl8T_ zVrX7LA8U-ufqrWlq?TT{!8-1e=iKwaI<3<?*BZUBq;9ZI+4EMAUVP6Y z!eX1!+<5)gQ*Y0%GB<@bK^ycd9^y5Y(0)Tn_*2FtJxl`H2Ak~JG2~ganXBk3d7p*k z86F(Y*`oyeV>Z`PV?o^zdU4EDSf{_EUUySP$1LH#HclgzoJEzz*HC!gc&cD7Oxe_w z(c)A4QvN4Cb^l+fh!FpOigy8=1{o!io(4P-c}!2!jE8wZSMm+MA^vN#_qdk-VRLJ1 z>r4K}kMh(VxYYFT8`fCAnc>38_C4oLhM9a|szH4tyr(J2GnC{RN@_R7@U|y3ihVKZ zPB=er4***+Cwzq?Zq_o9G4c%Ea2_p}`zU$c>yaOu%2CZupR zvtlR&Vk!g~TXFZ*{_*kN_xoSB&qC}dKWkU(9T`{%&YrCelFwiTZ4&JVro}c~8$78| z@u(P82A*-O@ggSVjj|l7w5wvSI&}T9K7>)m<2h4nK{m}I$ec?dGm?7R0c?5K?pqDO z^AvdAkd9fBuw<<2>mznA7O>gt^}zFDa^;!PD6+T)^wue-pfz(F$ZL8*GslndQ}eAa z&;2}l|MwMfv2nsP`T_d5VgK*#%;f*r+tPY^^~;$NH3EJ;jWu zG=xhgC-7ezJ{%^|6nH|5OODmf7_o%9OP)Z7HrC$2@@_pB+QUGSTwKOm^}A z8vK?&{3Gk)|Lu#(xU2qWe~OEwTQ)Q#!Fis-h(%PizVgLo+WN{LlJnMAzKqk>SO2HA z20xOF@m#>c^L^3s(~Q5Rfo%CKq@=6MW&G`bq5`7V|KU%s_um|Us6K95|GnMX{lESG zRr&|)9?8`Z%8Ha`)6>W?I8*aN^C}N2iMt84Z3lU zP%m^|B^H79qqId)549ArC}1;7LGJDY}V0j z&NUtaBD|ueZPNnlVg6^ZAeCKoH3Lv!v<^mQW(kBeWC4*hEF=5ZGaB$XR*Ng#P~%A; zCg&7Ho@qN<=@o0NSPCy6bcpI}AR{ogwnP|D{~HFcf9t#i3((=L9AhpLK;Re7Ul_{8 zPl|3`ren-&I@rq6CQE=x0cQ>eLI!jO!>J_;A5IF23P=J&3IPUMvp;BPCPq$Zt5~^E z_<5=om6D9aRHC%lx`reB6P9|e;W^b8l`6*iSw9L?9T9bxMq1b2iqFawKHYOKpkBAG z;S4SCXDiQ;=DpAC`G7X}Yqt1#J=btn_%*R4=mx3f*{d{CVCsa7SF1S(Q<98V9?A!P zuHkIQ?vVQMCu)-sJYV(N&8aOAe;FJ;cFL}uc(ToxoR%_xnL^>x?m zOEjRaGRS+wl+D<+qU8CUj#xs4O$MgOKnVyWk<4@6jd%tr4+RjR)*wr02rL=g0)<2f zHcmXe;Eac~yJi9RND_K(zf(vvI-;3kn&KY!J|}zH^6g#2OD3eEDFwBgpsg@&D*W7r zsFc(par9-Y-Mb7D&VK#vUNF^kO~;K5mzZ)d_pnH^O%`{KEQK&@^Ys!cFL`#(lCgc) zU9(Mkg=P2?Vye6VM@ysV6EDDPID6WAx_J-sR6Whjk}~?i2u`w`b}&j(P*D-uYiB9zMVzE#*8W(+ z)is=rNF-J^R#qFSV5)XM_QIAOOp!2zGLb9Nmc2R~p1(e}v~?Fa@AP~)OxbI??|>=W zRBa1{#MJdiYYlwSFk0RJ73^rnto7m=+4hIoLRcPJ+G?Kl({T@ISu)_DUDp4CNi^H z9wouV9M6Za2N?}`_E8K`b3wiLy>B&bX0OOS*Qn6cIs2zW)%|J6Wr7n-2)`_!axkSU zeuhXgpx!^GDyd)=w~d%WM=2J-!BG+4HBBkJ!kPpw%O+^6L=Fc?a7c8V1CV{bc zE6j}T*Wb?O!sgzA-vp(G?chj9#|w}XA~91D<{r|Cigd^}0#pO{CX^MhRc}sMaw@J} z(NpV!T4a#i`i}AN^EigMKME_ZWmxU>&s^p3C&JQmCbAsOvESz5m@Z|1(bi8OP*w(A zyXLZZ^qHXS9yynjoNeg_HFqepvBG|G!7`qpoO&{r4y_Nz9Y=#Szz;6+xu z6-Rp42Qk$y{GWW|MD3dtECy@s0iejV5NGzlJfm{O!@p}dB0>O3reKq%m>ulAU@t!G zD>>4ndMZveiBMV_It~MMNawU{`IRZ_;!?cf^z!7qW2Bu!wQB^Fy~SxRZ9xRRA1ho4ydzJ{~@2f_Su|RXCVQ4q}o^ z2>E3KW7WkdkD_U(vRs)|o4`4X8g$`14ie6G?}txSuY_D$+jT>!bQ2)#wUUxUEH?c$hq=5tU0w?Da;B9#_A2a~VDESQ2vpAS6$S(uzQWZ6h}{>Wui?xE<{!IL*(dehj)VIgFR~R`<~s4w_UTB>P_8a z5@D@@ect%GhO;hDr4AYFDnM_6wON{SaxmU-j(+UMSu11>NpP-YBDEktr|16seX1#F zm*iB}pcCr3KELqHwt`Z^KVSWPH|Xx^xj#PDoUB)mdV$`zr!NK2H8CZR5yeXj$8d_K z7e#33DTelj5}hCExj$RN{ItdkJq`?}j8(6QfL7}e1I7!4IDTfIHcIw;ca~7`e&&1Cge1th1rQ@))b}h5~l-&MxigZP~w!nvD@19jtcwKJvx{v4S8qh zj!JTYsmlqIG-5&?4&TxMje$3D^cqc-xZ>D^fGN-6k|feG@kx$ecp9TbTmRILeZ1CS z*#PiW2MOzfQaIBLK*zGLJQ0W~_tNGSP7Yr4khN)^`5;Ao=#e4cwem6~%I?`kwv zgz%ZDJ%v2AIIZ=z2wb}($g4je3{%UA3D@w`gkpRU&yeAiOH3^%%cmrFc+VYyz3p>< zUMx-bjxXWGQsFN_EqMKNdamJ2@JI-rbnCZsdvD__kD5VzBPL{XXLpW0ZXTv?4EMhQ zQ=e0q|23SE&8^<<=GN2QAlxCNJ_*9nrV>fBi<{i{uHnFx(@rAJ8q*uUsH{Rf!_qlXoRWvB5>fdF zW?gvVaK{kGMoj5}p6GLj1v0uR@#jU`U0DET+oy##jo%U{(xfT&Cdtf`ZT7N+5BwK`hURYcMWGD zNf?cO7jMnxXXkE(K*jl(x?%IX5mTSf=64Ne7kz)zzti!|984{-`7N>aX;glCp8i2N zy2jKpo8Qe_-=6?c%WQr#i|_N@{I22b=~nN_huHd-(U6zYkE`4hZ4IB``5^kS#?&(5 z{(s8o{uxXy6Yl?~jP7?Z#SMeKS@yifKu}<#GQVXLr|tl{?b`boKgsh!1kVCfCX(e9 zPnh~yYv}^MxdOj*mi5VmN^%8^u>(6*b50Amk{@a0J zET%3!hpRQ(ySh(lnJvHQlC&K{KwywpT3a!!f1S zWdl7sbixf1r_p`pYg_KQKN($1$p7R+e@KFJJ{rALn%j+rywYz!qdH*S#DZ9-b44S? zrGg_ihPQmEbQj+WuV#~SawT(PZEn=#jBmb>78mw8EibbHkSR8wSN z9VlXUzg~Xz{qW|c5)vGQnagk1^CY2Etv@!h>|V)MHHQDuvM}GDKWvGq6})0i_Q^(6 zeP)kZef=kQ427&=YK6?gf65bw5>qR9#{T*IVOz&W)hO@1GG_>9o~QKub2|MRHHcq3 z#h<^O0m;TWVnlK{b8iVdYqj4NcB#)xDM*m?FP;|$i zkPEHpmEh~uH{=)8Vzz@t75bG{3Tn7G3ACta~&EMc$}&Qrx1jJ zG&;h88?L6!$%^cqa6Ed6r zw%%|>YPnZ*^^JpFnNiw}iCO^NawUptTN~g3>_L%C2h0`anspdnAkdvI!@LC%nbHgg zg*djW!H0uN@i+U&C!;*l8H7i~954uNw8qU)Td%Oqy^D;422ALQn#&+~E@wD|;wVM_ zQ=7}Tk_EHXdV_aTW5@Qw%xGGqFhZaCGS<%676EU)!5ueC?0xe^5$o z9nI%Pl*n8a&4&>a6RL0HwdtHQo+qJ~@gYkv^`*{l=^SR4mo+9NX34mPvqN<{qB;s} zUr6}nt*t~Gk1XO4exAVIPsgUCQACo2Mo^}+_ge=e9V^7d#F>vseUs?Bci_Jms4?|#&@Q%i~q@81`9n>HmkMOGwrq?sr(mlheO zGCE>c7V-LqS0p5xOqgdjy95j8!{`0&+c$?V_TQWyJpcPLu;TjDJ&0;jY=bb2B_z^u zsZ{H+OkJE&$P@OvKC#p(SWD+iy{kLfApF)31-;tn*oA4B&ESm);M`J&>sOKQ+16R7 zO8>29SW8^3l%ST(seg(3wcX1xr| zNH+XdOR<7E3Brlg9oGrKCPv4!-y+A{X!=c&1DxT0j9I`Xza&}MQeY4~F3~{hF3c>N zIgN=7Cdde+0JX)c&EtYP`Gqy>!WF3yU*b_OB|LI#877VQN(3^;Jwl^I@nqcHo#c@X zBnf*uCES=@(4@?BquT(Us68j4EgU*xl}I3%7N=8*$klKvG+xkbT6SvDLj+fxaSDQr zXjPiU4HRV^y@}b)DUPZ{YB7%qS1melQXfI2wbzW697LyH32k$@;)})xEf1hbR)}Y= ztw+uqndMZ;r)#=5qiIlvzWW7r@(eSn+C-|Vf=;JWK!;5@`G*IsZ@vMq|G3xbZ^I+= z?>FB-a|T2doY&U$|KZr6yIo`v5B(xF)shKcDQsdA;{? z(AC1UUr9MWc(A^Xyayh^gLg0XzI(BETJZAs8yjkJ7WDB5?%u=AV|M2nnXBF2P?*nh zs^@DFpwNsA@4@Gn1TE!eX8CDqiKTAPaD z&a1asmg_Gn*DuTU7M1I@pl4totbl+c@Fa@WeehD~wPG>u_07I+={L=ImTVN&kh}&6Rjv%0=sJksQ9^!+bd%8AN9uKukcMXt_8klj5OluLmOX7$wt1 zf~~4LE9Lv3baEzu#R^j<`$EE{u?sG2GUQa>ucggImq!GXLb@OOu)7CGvS=h@rnpddOUNpD$;a{bd zMNVh}F-g@Qy4j)`ljf#Ou2|Vf4~~rJKAaYr{fp7CM4K1v6;Cwt)%2CbRnSC@-k_K! zHNgWY1do}8HvqjisAf@i96*IZW8>z7u~PW~k5yaMyB7xV>u>5UOPDkUV`E@$N0&Sr zb&bLHG^A<7r!;FDQF^P>?<-Ln|Ghz!zJ+M^DWu3-iqtDfk+%@2=eF-mY(+->pDqSI zm_0=pQwicCXuaNhwLj-f?c`ra?x$xje>gtbf8!k->EE`a;>FS7o0Ik9Ij8n}-|x3{ z&y9~c@3u|#d;Zo_e{;LnnNW| z{l~q=-ZuMB`m6Qkj&jwp+1@%^Po5y1bT-W&MQ<&&!xcNGu`UlRsk;2BELEe%larUQ z+Y>afBsafSNmcbqn+v-##8FmiJ%F@yey+gTIy!j$ebWb6uL8a?fSp~Py>mFl)1?Nb zsoI3*(JSkwO^qz0n^v(>Y!EZLX%*%5a;0wC1jkLfX)^*)HyxkT6Dnk>H*RW;05wGO zafLRYE#0PdF8J^|gckF@C=s_-BI>AIT|S0+@^O zFT(NNgkz+Yk0u=3-ad|ST=e!uIQ|I2aaDGy658tL6ixMS5CbdoUob&e0Ibksy+qGx zqtfjHsjqpIw-)%Cn_F4dgBJQA}kiLZhV+xE+n4b!`@HF8?CQE?{bP^7S?QgVQ_J^+Xc}ZteHq%a70*y zx4PhU9rjkUjOw#}yIChBrXidm*3OF43KCbMtbd|#$+L4H=+LFTuZ9%zr1T{q(gJdZ zuN}D0{8p=Wsh{I}t`qE}B$!a2XX9?j1N1=F4(Dr?dN>(QQ1Y=P(m3WhZ!bhshJjY= zSdt_pSy%~c78SpqGT_}zq&a4=-e$%jNVW}Z_Zx#TgCEI{uN6!vS0y3~yCMKqJ3Z*j?L4jN#b+(<@SC{$|-!^_Q! zD3duUWgyj|_JV5h=GP*8Jmo^6sM$L-;2Gtj>tvC&!Pylz(Fu*>4Mc6s6+tFCt(L+! z&srHJVR4z!Hhaf(u4a!l!{k_*4sBIdMbI3kdy*jH3-rO>SmPeS8>` zw;X-__{g})2t}eo+T`qoKfBE~j*%FS^OSmzqj7+B`)NdI31|0he06GbY+1jkN(N6{ z*ZLlU2+};m+{{jtdvTw!xy#9MEml*J3!_|;WD5Tz7X(OJ1SR|Mt?~Ub-j^L<(w@zV z(m{%kT)bdMt(Z*lh;N9MEhYMJ!eK(AR1suG%gIz!S2m$fPFRKx))yp^=mX6Ynn(ec zRI}KEAwrPrOBjme@^IFiXWkwkDhyhz`Yl}DWnBe1UV<6w!(7Z76!QybHcgyE-8Je2 zy*GIrb9B;CFcZm!4A*y|!aI~;(#>^T*H&|tpi-7dB8oMF-r^a#bQ9V7@Lid#pkudS za{;Gf*;*?cVNOUOA)zk97b9#?ZK|MWLMW9A_$`Bun&~ zCPSV}BqhsR>w_>|>Y*0HH+%=DwFn^6>qg@kkK1URMnuvjJ=BL0AI^HH>w9TzQ@Fmo zq6>7g-q5GTwPb;M<^5WH*$7E3zi7F7^-@(t5#iliB%2ob28%R$20!i+*Up8t+=Zn# ze7T=E3y3GC!ZV(TJf<0ZkKW3D>o5NakDeuS(X7IiP|E%Jz4p=T^?JM8+xTy<*Q@{A z+uD5mm;Uz7&i3Q}&erzsUwZwm$6LF9f!@7BG3UvZ{PvgLo%^Z}?my%S@lJl41b8%H z!F%@zEI}_s( zy(eD($w_}_u=RMbx$W=vc6PS5ws#)&HV3_4`#)pteGX5<`d6&^Ui-Ld{cmpV%&h==EQpzb>XkxGzp{ z!}{;{9@p3Z&d$!4_5V?xT6{D~)8glrzvJ(;LMnocrFtblqlwH&#QvaR#pO083|(xM z4pWWEc5DwF6NK1lff1@z@sJ6bv0<*XN-<4>NyZcQhpC`ctFkDD0os0r-z9#)L%!h)6Jr zNaE8Anh2hJ6SE-Wf{&ze?bEDPm16YCR#}f<(nOqpGv<6;xB;4|a(=m$h*q5^o9s=h z>jtezkIdo4jip>IjwfmcDi$QiIn!n9wY}g|6YrPj&d(hF?}S3%y^qEGe{*wpt5@Uy zyS@JQ7ykb-p0zdD6L3k{c%nG)?>W!%Sd_P3YV$h{JLYbB7Na?rU6|+tk^m1w$2@7n zaa(I^c$PBZf+jw^;u+-^G}Cdpv&EgjdgCS2@4!|Eb~?Z_cMlb9S!b{ovqo| zo}jX2AbG~~L=IpJU=5yA!7{`ONu)7O|HAnTeHyBh=<9qE8h8?2k|`eDtoJ)x9RvGD ztCjNbITKlq+vvA>IHu^D5|gVR5^_OUq{QC=^i`)Xbwa%fzl4}1Q~1T6zGASdF`4FN zH3)T}^#zY|ZR!e(u7uxeNt(qh!438Mj0E(EW{ii&R0-%}0R1Pu9*(u#u|epMKq{SM z%)PcNnkFfXRg0rMil%<6r9GyO&8_}wfZBKI4ac*PAMkU_Orsd6KkjjFTA?-9VA7q0p_=AXJr!Sb^0Vpth03xhA(h38Xe3`Dh>VS(RX-D-ZBdf(qNdU! zquc=8RBRaRfem2dxFBPaW{k{ls%0dsasr*>_cb((3M!nsJON_;w+i<%I5<*Jxn64U z?mfnEWJ4x1g2C&F$3pu5v-kCFZR5(L|NB$SFVJ71i=8+?OVdrCn-j7vyFj=k?Y?yT zfMP3&i(~s(4v@B-&wd}hT7F4FD9iTj#ecL!mPVtoG&9nSW`e{U&ZvSn(T(jXeCgK4 zoVh5&`n9KGdt@vt8HWqqT}m`nzEq|g5DWRyIPWGm4oQ+zx2%F^8mukyv_n@U>sn`0 zHISH}!vO0qykKN1f5FuGZdKrt-Wm*MFy*dqJYtUwHN>taGv^4}jl9DbrSTpZIaLs$ zII%>-1jQqqaL+yQS_8n}ayWAUNUx~|FdvLu=kjf_HC@$jr5}iz2WxAFbPj10=NM(T zf&lvPGl2(EDxBm-U$P{M11b#XL?6K|K(M%KRFf`4ZF_HT@3yE(K;ML10SLbqRZh1R zkmF#!3AGFeLq)EYyri230g}O=nc$o{V`!heV;jf`o=`5laoRfCRwnN`fXa@myFd-@kOewvPxoW-Pr@F$_Jb zp`1i%@Iq6Vo5guJ`=FHc>4afQpJ8Z8l^XEjqk_T`B&m2*BsZ-^V;RCx_TQEwc`y^c z1613}Ams75UJhpQwcIK5Ehz&|;YFd_3KFj+yW#XvgW8|QUNGt@I0vI3RK=ZZ>`WzR zT4TK11R0;|7d&e~rCefGRDIy6D=KR*fJb;aWPu{HFF=NP(@#1KHk5DIAT-*fc@4a< z%JcSVqBCD1Ldm!Rm8!5FmsVkHvGUU1u`3K=F*of7=7d(4?4jV1shiSw_7b1AmSd&z07;7pT&4`giM4b3HT6T(<_6ij`83xcrF z8JmLOiLn3=bmff0un;&+^~~Z%Y>cA1aCN045bl{_AmP0ErL)C$Q~wLy2nW3cITxFT z2(Gl2L8C#*Ky_^v0qiJr>AoH#_g5;rx`9K#4e>tX2JF7^M37GIKttf)Qyk9#MG=>W z(i4a2W{8Ds4GB(*)xpLvjB^gDRBd4_+cKmd4`~<%z^BPI*H&|PvOwMbF{F@5xA25G zhzdaFnxuIwO3-TaGipH1+7{tk=kK(ox;*qovO7P#!ZBT`-Dwg{6FzfN)Yx~JccwMR zH!*X1A-2J1!hu&aaIomNV$4%t+*?x1F`=Bj0hKTwNmGbA*b-Z_AL$~mHBUw66zukx zDt_j<8-M=k{;>J_$JZNw{(1GoX2nQlIA;v0XgXW3SMIxGW=FzyQ%2QX37u{IwXgIL zT?=7Q59p@+!I0;r^(G&|Er+sm*P$>y4AY%kpB?X1bgDeyIQg&b6-RxxzWWypoO$u@ zV;{}b$>?@XaFk1Ss=xtj`%k{3<+4mLFJ6=$zc9vh9i`aiHq$S6YCGy(W^>F+eeV(n zn2?h=94HP(ImH{Cq%ccR0Cm{I`WIy^UOng=E1=-{#AP2p6H0tcJo3s%=s`1(g(MOH6BRTtBjwq;xOyU6L$A>C*-n8SkVpWvh$ z^zxg;Z{-PU2#Yv_y<`8ioI%6lds$BR!5_ZEVck2ISX;{{Th2S(u-&1$Lcn+2WtX-*fu=PL&`&=7xPJPkj*(z*Yso! zDL>M|%cP$9TOkZk;9wpA5XC(BFx_{E#vf$r&$2sQ66!}NyPYt`{v>llVz`T5?Ak;7 z#ZLYC_RAOc5DneBjWOQA+q*mVbNBgkyNNM zOuY1NyeD%jdfa@Zt@T#zbqCtlz&)1NSushl?0oJ{@1 zi+pUVen^#B^3#slmdLnw+rB|rw84c~SKJwmv5&;TPWD>T!fjaIpDMHe8hAnV^99#^ zEizs^+PpC%Py=NyP* zA}vL#D-KOr*{PTk-IkD;j=c4*-#vME`lfTn{yjMEcTV584jWJ_ROlVIPEI@h*1>VR z`|h~kfNfEw*KZx~w+_350cqq`&^%8|H*~7;wzXr~wY0)X9FAf% znc$ePE23-8_>3+o!V|mzIO8}BrS?=JLJ*4)zmJjYdjZxYJeSydR$e+Gxw18hd@O7V zc8Na7Z#>HAi@?Q<3Dq>uk1CqV+_FMyFx^nJi%?AEl<$#As^jF<#Tc{Ar_@xB@gJ6h+Euvgr|jQSLn~ zUaFRrLb}8-w?5s++u-+7)5aq5)sO`?K*?fHY|0-5=dZGiVX?;ffg~(&fbg~R!|;OL z*QW zvaB?}8na?ei7>)*@hM%QZq@&7yXE<^R5CZ(wK};^zrPHy`*+Xt$EW;R%Ky*C*pH}e zPNKWIf-m9!_2>2HS^i(I*}ISa-w*P9`BHrbm)@kojF3am$H^?h%?TxoGsX>gR=v3~ zXf3029mxpwGC!XRFkl&?o+*R2Y5axr7BhX%cGMQXW5(>8lHbspGSVJ=g(RK^4m{sx ze|nSNbU5^`p<<@MaNx4PIfiYfwE;=gXDo=>{gj90Sc)zR6w0VDLW}x5>uGrs!v7pI6KkUW-TkSoDcmy~^AH z>GbA*iz{pJm07}&gQ4<61uAEiJFKaGZn>x47vq9o?t(GM%B90dUv7AT<4@gr>dEH4 z4nS-y;ZrzRLVs4T6m|9PUNL_-{=ZcI3wN$hlWS#gS@l}jvi)DZZs+8GeaGH@l>ZO$ z0X)okW)Q7+lAo8{NJ|i0{^$`yN~?;K_1gI@5I}epCkR_ z7`!wbu;7Rdak8b@K0tWUfUnZ6^M9CWP-XVV&Nzg48eYIx2%J<5!1@=vVb<+E`^Hc% z5VLQC^Yp1;`9T2=bJv$H1vmjy+A>bN-F|a@gMk+oPc0JjvrXCPk6+H-^*X1`^)KSD zhN;~{xJhdrcHf*GcHVamc~$kZVO9=~f9mR0_gnqe+5Uk5Dt|T1N|n;KP?Lhn))pnQ zMb!^SdaHK#_@}gm{6%Y1-j=D!4TMw>i^^$%q^_#m>zuytoNAS|f`(b&+uPGBcMd!4 z{z3OxtDY%pnA_O~%9zJ1r?x$_UaQr#imA1g*VL@9rma^@t&#%W)JkdYYW3cBS|?|{ zgFi&i>Sx2OztO7Y4XV6$!OUtt*Ks&HI6mujdObR9I-2e~flSGZh6(E%8~WIv)i*bD z7?cAmz9<7$%RuWLw@%Ku@$-yXKLwTY#SL>?YsKxR(x%FrWXl?+BEZ4^*-rz;! zI>&0M3pwG0q?*#wU zMa(+G9$vqObunuV{dI+#g6N)xfB%$ER#>C#M9ws&EPCIIn>uQ@YIGQmGVKJ~OWP)% zbJ6!En6*^ve`zx>@Dk=Uz}ls3b!kH~3!JoJ%4U}~oS^GAqiZ|34hUu2tA_0m{ae};ng<0VQ%5&Hi;IV%Xgd-(`mSw(6 zLGAcgmbleOEESl#`K+{|TxMYm8yny??N{La$a+2PoE#psTfJA{{qO^*weE(6l`ia| z>t1u6@)&b{W5YA;%}r~abKu5$PLo*As|pLo^X0CYB$L zMwqWKrLb*5yL;U09*PB1fL9LA2?G-P*h-`?Y!>KBu>5dzZ*bhX3}gi$L(j*}Owr09 zCg_?%A>L=)tnWTQ`qy0`43Kj%jl96c*G;>&5(Fw_@VyX3LCR9)jFsP#He6SsQ}B?_ zz(3c&lupf?TLVK8i)$KNV)iz*yG*=Bn@`b}sCZ|{mh$(`qFq=5cSqjx(Tp=UfZKfHemUrM_nz168~8vK)y9+GzR>?~K7t8P%-sk+JV_c)+F$IO z|MTRK6;7T6b1>1AF)#zDtfx+~6_Ad0IYo?VrP{bt`U+0UBbHhJm;HBwaeRclpj_8t zuqx)h6HY8L4Xg=E>oLJWVttxi$9NJZ7#6=~&M(b%d0M-qGMduSBm7o*pN{v_ClCJ&KWX+Xsk_m8vhUF_oon-TNkt~7uZvKwL8WfztH zJ5RakCuL=y!a+lNOc*4>4vV~2?t1^_3!55N>1*Ce)+=8&&`Wu}jHkY=rWNv989#ej zODp8HBmwz1&}Sc%TqIxN8{LZX^9WlYE|bQBz)-v&AcvPJhNACRAplm2NLg$w&2C%P zvZC8)x73C(xPN$J&*b81dUkVIY=kk#oj`j^wzIVc}9B~ zyeNILVT|;0Gt3o4UWA9p^Yiua)L|azCag2hXpJ8(a-YtDd7b$UKzxiNuyTZj6EvmJ5p6=J~CcJaS_5@U+={&8Q7GH%|*_i5j$y@_}Q0 zdqZ$TOj!IpeC?6MDm4Cl(e^!yjKLK5x$ZP9mPc3M2ldzgYs2fRi!ZCe)c4^ljA9(Y zQ|FIs&wZNf|LfQLLO~EvVo|9qq!T52JduQA#3A1Sbr#}W#I?W|KwN^-ernV00?)Q! zokv7#H2L(y!DVqpD2;$Nfv+O!mFCiDahJxzY-O-{OWw^_`1dr-&+AgO)5}=~r84(| zk=$0qc~nj@b{+mUx4nCNmg@ge=%(?c2P|~;ef$5_>h-+;-}9RNsQ*92qpRp#cdcI9 z1DqhKsGk%=mp^)hEc6JGx*O2~U={*jt~jz=>6b-RQYNN!yW;0eIa>YE0q_5}XDR;| zI;`^1zr!KWGXB54y_5IWin^t1p)5GrVu0;A&mX9txRl`G7Ih2Qq?UR(bS&u#htx1@qvcK^5jJn#Qqvv(i$ z{|9;QhyVY>_52+FmrEkc{!943$#XO;Zl^2h^BI4M4B)wWN}@H;7vfx8h8>)L08@Ha zxj;T>=OXfSC3{IIhxBbOmzCg`7hBo3--{3{j1~v(qHz~8-mX0Q6vB5-gGZtMU-8^l z{)@PZck%&PX8*74=I#IXi=D^)--A4YRiVIL!lqN>pb9pb4Hr7^ws0De({jQXhlE8{ z%F55$c<1oNrB{IaJaKgNG} zkVhBLD2j+CkHv@YJsSLPZSZFmk5{sk$prWrWkb(JzoO9i>zoMy@(JFH3QD#{P8s>m zJaE;p0E)_@OyjAyU0Z`T&seGQv!*V*%THKKVWt|?5|6clzuNqB)@;($v_-)mzBnkY z%4#Dk?eK2H%Z*fbg-&oh@dDP(n;1FxB%8cNTR{tJmYwPA`6#lwUz(;O09;!k;oslSdmES%GS5q)xg+v%Ltf*j0sw=UIQ<}Rnj zBIUbr3D-~+xuP>hQ=XwZ*I{;e%*~zGv@Y;$(X!uQk!4kF7W0J;h=SQv11=xlPjNUY z&Qp~<`VCBnqWv`8u<#;}#bBmNuRjN|v(AU#W z7hd1x3oC_Dl1=qcM!P%DhxI}T)umrb8>&`UN3S~P8&cjdNL!ZHp!}>G_%oG{yExFo z7hmvVPO+o_XQm6jWtQ6-#tI$>*`9KdY2{O*-ef^8QFh8IucrExL6~>LZN9h13MQYj zS$I2TWX|WzsUyWjpG789eLfq=3-V=Pv-Ri0ohtx)ozwRR?G6jUvs40>(AQ##YjX}5 zbHz|bqs`Caf@EAEP9I!|-kU7Qf4_T>3?;G57ciGFO0tR9)5y;A_@-7v8}Q2hKv}Hk zX1s-E94ZBWYd)24a#wDZhcl07p?FmISmwYBTobu&++2nvUs_tu*LfaJ3bx1^Yepy; zH@6)fl-@&=pcU_l0?TdbK7?rI(|4ZeSC@iWw@vq-#k%q2`HAX*bD=c+p%s5 zFq7o?+vUj|gJFJ7KcrOA;%42yY|+A0-A%&WVk=b2F20lP(JfiHPNpRnX>UX%JFIM?R3mxW9ndf!G=Um%I-lQ+>!+h9g z!IlF>Wb}i4VCi`Yq0=ZM|ILigjfP2Dzl=L+Y$$~#^C0J@P7=n-##ho2@jjPyv4BPb zAUj$w`GOnx-z>+^vZkAQTm6MN&97uXp7Jo7+hE@KvglUkPr||^c}&sqk9+3$e^_Je zPrOkO#`xR&SmOU(E5v`ZcV9ezy#Mte&l-qWpDgJ(|Ke~p#sLhbp6`0W2qNTMpb;jP zu?GFIM}SNtuH2I`_I()n;edN2c)@6kXW92IG4ln~%2D7NYY^ZO(|BMbit*69#x7Ts z{%6yIZs5-#3|LEw5>WNk_X2Dg)_(7-mxM7k)}S3uCSd^Y+dXi-m>AZ`ORDT&j=o_H zKF3w|uPhjks`MZElUxSX6c7)i%W_{5E|~LCg-URD3a7tCgHi501CjHL_P~z%>}tgtD2^K z|Dbt}e%u%*Nz|xTFH|aJ%L}V+=&;Ok4vrF1MFYZ;o_JxvN|QMBeH>?ek4beChT$}D z!3*@f%xzlT8^DJ@R9e?U_oPv+j=W?%WsyTQRCs6Jpqj)OS0{)hIL>yeNU~`e#@ZU3 z#F*|XJ>n%)SU8l52&v``5 z@Gu_HPg0F(#og*A8!AgBOm!sgFG={E;M0L6t9C<%)iCt^@X8BD4a0Z_Dg`&!?bv2I zMFa-~PX<1QDWT&>f7x8IbW}c+#4t;#QPNw2$c4;&IE}Fxg|4X%@^j^Ba6FSo$E$7v z34ua&5+B?cc>$+aj7fx@gb|HLW9Q@%3rNx?i~3ucWLbD2FT`6>Nq8a?Gr-AJ7+-k7 zNS0MMsiH3^$2xYy3B|Fnj!O}e&d`bot^gOXq46n!E|KRW`khl~EX;D?V7Ux50Nhl< z%nh`!E~6&${TZMrqW`il2(2LT%$7Kiy&WB7CyY~75h30vU|%f=U0hvb7l_zzdCqI1 zz%>!=NR)cR zVN$wzF4ihVp_>Qn$glG$9KhAsbH<{GXzgTN?hR~>EI6++$#0);&VzNL?waMU<}rSR zkuwH)I*1E+GY)dVBWu%@PKm`Bit&3m1&2xz{!&YX&X^bdnMs#_uDI1XAOZvIhgX(i zoS&bI1RKUW7gRBhLO`yY3N#S>M4Wh8qc9x#7)2h*$pMq=Kc;FaVM-)Tli`x44lfg$ z=jZ2!aWI5gIHkNX2orYX=?&=&rtP;lP{s_nKfidvC^`$LOvWg>VOQtAl5SIi;aqZ; z5l+tOl%z^JP(;Nd_7nu=?@lsA`|>14S2xBwXpk5H)2E9r&EsMmw~jgu0L}aNu+{6s ze&^({`+H}<0l#7wT2TzP4fcyh?PX(U59&30kG1TbwA!79G#VJaeyjhk*HEnu=n| zJAHT3Kjg>A?^g#!B2Cx*bYDud)`XsM_F`-v=TAHM7LJE!Ks z3H#akt=~C4ZXL4UC*9NjMsKsMqb#;6`W`@AM*ad8`Aci@V-N=TwM5k3v#b5~$=3GX z-X8m-F8*MH(CDBZ4YFOcUhY};is^1GL|ro_3D= zg>SPh0dD6Z&$~oi&0QZZ`zj@bEgM16-$HxI7P)P~dAXW+4jy4EP#d{msV)p=DYvs2 zkSI)>nm^XQ+F$Fh&jH1l>wBR~@{KjP7IY{RrlN6-2q2(3m5);<4DmDwxSo{?Dv=e2 zkKxj(7U!56LtgiwyvNOJ4?@GZg%(lhk#&@+6v-GRjKvK^PlK6I4M8K)8>n3)KrdQ_b$sYsoAu^v%?CUByvSLJA%xrXv)i38oOZ z+D*ZqnIhTqoN&T6 z%JB@)Ae=JYpCSt%G@L$eXg|b0b06af_PtBY6{!gtVc5qB@_f1v!`umruM$pKwKeky z3=l0318Dh?7hu@7URpH{_viOV88|tDPZ5J`8bP$N9G_>XLx zgeLekt6}{pzp*JJ0<)J5st(8m0!N{XH($xz6|Y!6O8)QDSBCNV!mI=L8{uaLIHqN_ zk}_MA@vm6gl96+tCEekIlCHNaqk+uRa{tuCT!PgwVGl4+UmF8c1{}&!4R?Axun_#)2SQ1S>Uv}vPT=wBHTC@ zR^f3YnEJjkK&jB~IfycSBb6moHqg!Y00Tio?9YHWi0*~GK#CN?@5@qNz|KY)B$jnb z+_` (All upper case) | `{}` | -| `additionalPorts` | Additional ports to expose on brokers. Useful when the image exposes metrics (like prometheus, etc.) through a javaagent instead of a sidecar | `{}` | -| `readinessProbe.initialDelaySeconds` | Number of seconds before probe is initiated. | `30` | -| `readinessProbe.periodSeconds` | How often (in seconds) to perform the probe. | `10` | -| `readinessProbe.timeoutSeconds` | Number of seconds after which the probe times out. | `5` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `readinessProbe.failureThreshold` | After the probe fails this many times, pod will be marked Unready. | `3` | -| `terminationGracePeriodSeconds` | Wait up to this many seconds for a broker to shut down gracefully, after which it is killed | `60` | -| `updateStrategy` | StatefulSet update strategy to use. | `{ type: "OnDelete" }` | -| `podManagementPolicy` | Start and stop pods in Parallel or OrderedReady (one-by-one.) Can not change after first release. | `OrderedReady` | -| `persistence.enabled` | Use a PVC to persist data | `true` | -| `persistence.size` | Size of data volume | `1Gi` | -| `persistence.mountPath` | Mount path of data volume | `/opt/kafka/data` | -| `persistence.storageClass` | Storage class of backing PVC | `nil` | -| `jmx.configMap.enabled` | Enable the default ConfigMap for JMX | `true` | -| `jmx.configMap.overrideConfig` | Allows config file to be generated by passing values to ConfigMap | `{}` | -| `jmx.configMap.overrideName` | Allows setting the name of the ConfigMap to be used | `""` | -| `jmx.port` | The jmx port which JMX style metrics are exposed (note: these are not scrapeable by Prometheus) | `5555` | -| `jmx.whitelistObjectNames` | Allows setting which JMX objects you want to expose to via JMX stats to JMX Exporter | (see `values.yaml`) | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `prometheus.jmx.resources` | Allows setting resource limits for jmx sidecar container | `{}` | -| `prometheus.jmx.enabled` | Whether or not to expose JMX metrics to Prometheus | `false` | -| `prometheus.jmx.image` | JMX Exporter container image | `solsson/kafka-prometheus-jmx-exporter@sha256` | -| `prometheus.jmx.imageTag` | JMX Exporter container image tag | `a23062396cd5af1acdf76512632c20ea6be76885dfc20cd9ff40fb23846557e8` | -| `prometheus.jmx.interval` | Interval that Prometheus scrapes JMX metrics when using Prometheus Operator | `10s` | -| `prometheus.jmx.scrapeTimeout` | Timeout that Prometheus scrapes JMX metrics when using Prometheus Operator | `10s` | -| `prometheus.jmx.port` | JMX Exporter Port which exposes metrics in Prometheus format for scraping | `5556` | -| `prometheus.kafka.enabled` | Whether or not to create a separate Kafka exporter | `false` | -| `prometheus.kafka.image` | Kafka Exporter container image | `danielqsj/kafka-exporter` | -| `prometheus.kafka.imageTag` | Kafka Exporter container image tag | `v1.2.0` | -| `prometheus.kafka.interval` | Interval that Prometheus scrapes Kafka metrics when using Prometheus Operator | `10s` | -| `prometheus.kafka.scrapeTimeout` | Timeout that Prometheus scrapes Kafka metrics when using Prometheus Operator | `10s` | -| `prometheus.kafka.port` | Kafka Exporter Port which exposes metrics in Prometheus format for scraping | `9308` | -| `prometheus.kafka.resources` | Allows setting resource limits for kafka-exporter pod | `{}` | -| `prometheus.kafka.affinity` | Defines affinities and anti-affinities for pods as defined in: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity preferences | `{}` | -| `prometheus.kafka.tolerations` | List of node tolerations for the pods. https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ | `[]` | -| `prometheus.operator.enabled` | True if using the Prometheus Operator, False if not | `false` | -| `prometheus.operator.serviceMonitor.namespace` | Namespace in which to install the ServiceMonitor resource. Default to kube-prometheus install. | `monitoring` | -| `prometheus.operator.serviceMonitor.releaseNamespace` | Set namespace to release namespace. Default false | `false` | -| `prometheus.operator.serviceMonitor.selector` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install | `{ prometheus: kube-prometheus }` | -| `prometheus.operator.prometheusRule.enabled` | True to create a PrometheusRule resource for Prometheus Operator, False if not | `false` | -| `prometheus.operator.prometheusRule.namespace` | Namespace in which to install the PrometheusRule resource. Default to kube-prometheus install. | `monitoring` | -| `prometheus.operator.prometheusRule.releaseNamespace` | Set namespace to release namespace. Default false | `false` | -| `prometheus.operator.prometheusRule.selector` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install | `{ prometheus: kube-prometheus }` | -| `prometheus.operator.prometheusRule.rules` | Define the prometheus rules. See values file for examples | `{}` | -| `configJob.backoffLimit` | Number of retries before considering kafka-config job as failed | `6` | -| `topics` | List of topics to create & configure. Can specify name, partitions, replicationFactor, reassignPartitions, config. See values.yaml | `[]` (Empty list) | -| `testsEnabled` | Enable/disable the chart's tests | `true` | -| `zookeeper.enabled` | If True, installs Zookeeper Chart | `true` | -| `zookeeper.resources` | Zookeeper resource requests and limits | `{}` | -| `zookeeper.env` | Environmental variables provided to Zookeeper Zookeeper | `{ZK_HEAP_SIZE: "1G"}` | -| `zookeeper.storage` | Zookeeper Persistent volume size | `2Gi` | -| `zookeeper.image.PullPolicy` | Zookeeper Container pull policy | `IfNotPresent` | -| `zookeeper.url` | URL of Zookeeper Cluster (unneeded if installing Zookeeper Chart) | `""` | -| `zookeeper.port` | Port of Zookeeper Cluster | `2181` | -| `zookeeper.affinity` | Defines affinities and anti-affinities for pods as defined in: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity preferences | `{}` | -| `zookeeper.nodeSelector` | Node labels for pod assignment | `{}` | - -Specify parameters using `--set key=value[,key=value]` argument to `helm install` - -Alternatively a YAML file that specifies the values for the parameters can be provided like this: - -```bash -$ helm install --name my-kafka -f values.yaml incubator/kafka -``` - -### Connecting to Kafka from inside Kubernetes - -You can connect to Kafka by running a simple pod in the K8s cluster like this with a configuration like this: - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: testclient - namespace: kafka -spec: - containers: - - name: kafka - image: solsson/kafka:0.11.0.0 - command: - - sh - - -c - - "exec tail -f /dev/null" -``` - -Once you have the testclient pod above running, you can list all kafka -topics with: - -` kubectl -n kafka exec -ti testclient -- ./bin/kafka-topics.sh --zookeeper -my-release-zookeeper:2181 --list` - -Where `my-release` is the name of your helm release. - -## Extensions - -Kafka has a rich ecosystem, with lots of tools. This sections is intended to compile all of those tools for which a corresponding Helm chart has already been created. - -- [Schema-registry](https://github.com/kubernetes/charts/tree/master/incubator/schema-registry) - A confluent project that provides a serving layer for your metadata. It provides a RESTful interface for storing and retrieving Avro schemas. - -## Connecting to Kafka from outside Kubernetes - -### NodePort External Service Type - -Review and optionally override to enable the example text concerned with external access in `values.yaml`. - -Once configured, you should be able to reach Kafka via NodePorts, one per replica. In kops where private, -topology is enabled, this feature publishes an internal round-robin DNS record using the following naming -scheme. The external access feature of this chart was tested with kops on AWS using flannel networking. -If you wish to enable external access to Kafka running in kops, your security groups will likely need to -be adjusted to allow non-Kubernetes nodes (e.g. bastion) to access the Kafka external listener port range. - -``` -{{ .Release.Name }}.{{ .Values.external.domain }} -``` - -If `external.distinct` is set theses entries will be prefixed with the replica number or broker id. - -``` -{{ .Release.Name }}-.{{ .Values.external.domain }} -``` - -Port numbers for external access used at container and NodePort are unique to each container in the StatefulSet. -Using the default `external.firstListenerPort` number with a `replicas` value of `3`, the following -container and NodePorts will be opened for external access: `31090`, `31091`, `31092`. All of these ports should -be reachable from any host to NodePorts are exposed because Kubernetes routes each NodePort from entry node -to pod/container listening on the same port (e.g. `31091`). - -The `external.servicePort` at each external access service (one such service per pod) is a relay toward -the a `containerPort` with a number matching its respective `NodePort`. The range of NodePorts is set, but -should not actually listen, on all Kafka pods in the StatefulSet. As any given pod will listen only one -such port at a time, setting the range at every Kafka pod is a reasonably safe configuration. - -#### Example values.yml for external service type NodePort -The + lines are with the updated values. -``` - external: -- enabled: false -+ enabled: true - # type can be either NodePort or LoadBalancer - type: NodePort - # annotations: -@@ -170,14 +170,14 @@ configurationOverrides: - ## - ## Setting "advertised.listeners" here appends to "PLAINTEXT://${POD_IP}:9092,", ensure you update the domain - ## If external service type is Nodeport: -- # "advertised.listeners": |- -- # EXTERNAL://kafka.cluster.local:$((31090 + ${KAFKA_BROKER_ID})) -+ "advertised.listeners": |- -+ EXTERNAL://kafka.cluster.local:$((31090 + ${KAFKA_BROKER_ID})) - ## If external service type is LoadBalancer and distinct is true: - # "advertised.listeners": |- - # EXTERNAL://kafka-$((${KAFKA_BROKER_ID})).cluster.local:19092 - ## If external service type is LoadBalancer and distinct is false: - # "advertised.listeners": |- - # EXTERNAL://EXTERNAL://${LOAD_BALANCER_IP}:31090 - ## Uncomment to define the EXTERNAL Listener protocol -- # "listener.security.protocol.map": |- -- # PLAINTEXT:PLAINTEXT,EXTERNAL:PLAINTEXT -+ "listener.security.protocol.map": |- -+ PLAINTEXT:PLAINTEXT,EXTERNAL:PLAINTEXT - - -$ kafkacat -b kafka.cluster.local:31090 -L -Metadata for all topics (from broker 0: kafka.cluster.local:31090/0): - 3 brokers: - broker 2 at kafka.cluster.local:31092 - broker 1 at kafka.cluster.local:31091 - broker 0 at kafka.cluster.local:31090 - 0 topics: - -$ kafkacat -b kafka.cluster.local:31090 -P -t test1 -p 0 -msg01 from external producer to topic test1 - -$ kafkacat -b kafka.cluster.local:31090 -C -t test1 -p 0 -msg01 from external producer to topic test1 -``` -### LoadBalancer External Service Type - -The load balancer external service type differs from the node port type by routing to the `external.servicePort` specified in the service for each statefulset container (if `external.distinct` is set). If `external.distinct` is false, `external.servicePort` is unused and will be set to the sum of `external.firstListenerPort` and the replica number. It is important to note that `external.firstListenerPort` does not have to be within the configured node port range for the cluster, however a node port will be allocated. - -#### Example values.yml and DNS setup for external service type LoadBalancer with external.distinct: true -The + lines are with the updated values. -``` - external: -- enabled: false -+ enabled: true - # type can be either NodePort or LoadBalancer -- type: NodePort -+ type: LoadBalancer - # annotations: - # service.beta.kubernetes.io/openstack-internal-load-balancer: "true" - dns: -@@ -138,10 +138,10 @@ external: - # If using external service type LoadBalancer and external dns, set distinct to true below. - # This creates an A record for each statefulset pod/broker. You should then map the - # A record of the broker to the EXTERNAL IP given by the LoadBalancer in your DNS server. -- distinct: false -+ distinct: true - servicePort: 19092 - firstListenerPort: 31090 -- domain: cluster.local -+ domain: example.com - loadBalancerIP: [] - init: - image: "lwolf/kubectl_deployer" -@@ -173,11 +173,11 @@ configurationOverrides: - # "advertised.listeners": |- - # EXTERNAL://kafka.cluster.local:$((31090 + ${KAFKA_BROKER_ID})) - ## If external service type is LoadBalancer and distinct is true: -- # "advertised.listeners": |- -- # EXTERNAL://kafka-$((${KAFKA_BROKER_ID})).cluster.local:19092 -+ "advertised.listeners": |- -+ EXTERNAL://kafka-$((${KAFKA_BROKER_ID})).example.com:19092 - ## Uncomment to define the EXTERNAL Listener protocol -- # "listener.security.protocol.map": |- -- # PLAINTEXT:PLAINTEXT,EXTERNAL:PLAINTEXT -+ "listener.security.protocol.map": |- -+ PLAINTEXT:PLAINTEXT,EXTERNAL:PLAINTEXT - -$ kubectl -n kafka get svc -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -kafka ClusterIP 10.39.241.217 9092/TCP 2m39s -kafka-0-external LoadBalancer 10.39.242.45 35.200.238.174 19092:30108/TCP 2m39s -kafka-1-external LoadBalancer 10.39.241.90 35.244.44.162 19092:30582/TCP 2m39s -kafka-2-external LoadBalancer 10.39.243.160 35.200.149.80 19092:30539/TCP 2m39s -kafka-headless ClusterIP None 9092/TCP 2m39s -kafka-zookeeper ClusterIP 10.39.249.70 2181/TCP 2m39s -kafka-zookeeper-headless ClusterIP None 2181/TCP,3888/TCP,2888/TCP 2m39s - -DNS A record entries: -kafka-0.example.com A record 35.200.238.174 TTL 60sec -kafka-1.example.com A record 35.244.44.162 TTL 60sec -kafka-2.example.com A record 35.200.149.80 TTL 60sec - -$ ping kafka-0.example.com -PING kafka-0.example.com (35.200.238.174): 56 data bytes - -$ kafkacat -b kafka-0.example.com:19092 -L -Metadata for all topics (from broker 0: kafka-0.example.com:19092/0): - 3 brokers: - broker 2 at kafka-2.example.com:19092 - broker 1 at kafka-1.example.com:19092 - broker 0 at kafka-0.example.com:19092 - 0 topics: - -$ kafkacat -b kafka-0.example.com:19092 -P -t gkeTest -p 0 -msg02 for topic gkeTest - -$ kafkacat -b kafka-0.example.com:19092 -C -t gkeTest -p 0 -msg02 for topic gkeTest -``` - -#### Example values.yml and DNS setup for external service type LoadBalancer with external.distinct: false -The + lines are with the updated values. -``` - external: -- enabled: false -+ enabled: true - # type can be either NodePort or LoadBalancer -- type: NodePort -+ type: LoadBalancer - # annotations: - # service.beta.kubernetes.io/openstack-internal-load-balancer: "true" - dns: -@@ -138,10 +138,10 @@ external: - distinct: false - servicePort: 19092 - firstListenerPort: 31090 - domain: cluster.local - loadBalancerIP: [35.200.238.174,35.244.44.162,35.200.149.80] - init: - image: "lwolf/kubectl_deployer" -@@ -173,11 +173,11 @@ configurationOverrides: - # "advertised.listeners": |- - # EXTERNAL://kafka.cluster.local:$((31090 + ${KAFKA_BROKER_ID})) - ## If external service type is LoadBalancer and distinct is true: -- # "advertised.listeners": |- -- # EXTERNAL://kafka-$((${KAFKA_BROKER_ID})).cluster.local:19092 -+ "advertised.listeners": |- -+ EXTERNAL://${LOAD_BALANCER_IP}:31090 - ## Uncomment to define the EXTERNAL Listener protocol -- # "listener.security.protocol.map": |- -- # PLAINTEXT:PLAINTEXT,EXTERNAL:PLAINTEXT -+ "listener.security.protocol.map": |- -+ PLAINTEXT:PLAINTEXT,EXTERNAL:PLAINTEXT - -$ kubectl -n kafka get svc -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -kafka ClusterIP 10.39.241.217 9092/TCP 2m39s -kafka-0-external LoadBalancer 10.39.242.45 35.200.238.174 31090:30108/TCP 2m39s -kafka-1-external LoadBalancer 10.39.241.90 35.244.44.162 31090:30582/TCP 2m39s -kafka-2-external LoadBalancer 10.39.243.160 35.200.149.80 31090:30539/TCP 2m39s -kafka-headless ClusterIP None 9092/TCP 2m39s -kafka-zookeeper ClusterIP 10.39.249.70 2181/TCP 2m39s -kafka-zookeeper-headless ClusterIP None 2181/TCP,3888/TCP,2888/TCP 2m39s - -$ kafkacat -b 35.200.238.174:31090 -L -Metadata for all topics (from broker 0: 35.200.238.174:31090/0): - 3 brokers: - broker 2 at 35.200.149.80:31090 - broker 1 at 35.244.44.162:31090 - broker 0 at 35.200.238.174:31090 - 0 topics: - -$ kafkacat -b 35.200.238.174:31090 -P -t gkeTest -p 0 -msg02 for topic gkeTest - -$ kafkacat -b 35.200.238.174:31090 -C -t gkeTest -p 0 -msg02 for topic gkeTest -``` - -## Known Limitations - -* Only supports storage options that have backends for persistent volume claims (tested mostly on AWS) -* KAFKA_PORT will be created as an envvar and brokers will fail to start when there is a service named `kafka` in the same namespace. We work around this be unsetting that envvar `unset KAFKA_PORT`. - -[brokerconfigs]: https://kafka.apache.org/documentation/#brokerconfigs - -## Prometheus Stats - -### Prometheus vs Prometheus Operator - -Standard Prometheus is the default monitoring option for this chart. This chart also supports the CoreOS Prometheus Operator, -which can provide additional functionality like automatically updating Prometheus and Alert Manager configuration. If you are -interested in installing the Prometheus Operator please see the [CoreOS repository](https://github.com/coreos/prometheus-operator/tree/master/helm) for more information or -read through the [CoreOS blog post introducing the Prometheus Operator](https://coreos.com/blog/the-prometheus-operator.html) - -### JMX Exporter - -The majority of Kafka statistics are provided via JMX and are exposed via the [Prometheus JMX Exporter](https://github.com/prometheus/jmx_exporter). - -The JMX Exporter is a general purpose prometheus provider which is intended for use with any Java application. Because of this, it produces a number of statistics which -may not be of interest. To help in reducing these statistics to their relevant components we have created a curated whitelist `whitelistObjectNames` for the JMX exporter. -This whitelist may be modified or removed via the values configuration. - -To accommodate compatibility with the Prometheus metrics, this chart performs transformations of raw JMX metrics. For example, broker names and topics names are incorporated -into the metric name instead of becoming a label. If you are curious to learn more about any default transformations to the chart metrics, please have reference the [configmap template](https://github.com/kubernetes/charts/blob/master/incubator/kafka/templates/jmx-configmap.yaml). - -### Kafka Exporter - -The [Kafka Exporter](https://github.com/danielqsj/kafka_exporter) is a complementary metrics exporter to the JMX Exporter. The Kafka Exporter provides additional statistics on Kafka Consumer Groups. diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/.helmignore b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/.helmignore deleted file mode 100644 index f0c1319..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/Chart.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/Chart.yaml deleted file mode 100644 index 6e00654..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/Chart.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -appVersion: 3.5.5 -description: Centralized service for maintaining configuration information, naming, - providing distributed synchronization, and providing group services. -home: https://zookeeper.apache.org/ -icon: https://zookeeper.apache.org/images/zookeeper_small.gif -kubeVersion: ^1.10.0-0 -maintainers: -- email: lachlan.evenson@microsoft.com - name: lachie83 -- email: owensk@google.com - name: kow3ns -name: zookeeper -sources: -- https://github.com/apache/zookeeper -- https://github.com/kubernetes/contrib/tree/master/statefulsets/zookeeper -version: 2.1.0 diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/OWNERS b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/OWNERS deleted file mode 100644 index dd9facd..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/OWNERS +++ /dev/null @@ -1,6 +0,0 @@ -approvers: -- lachie83 -- kow3ns -reviewers: -- lachie83 -- kow3ns diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/README.md b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/README.md deleted file mode 100644 index c0f060e..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/README.md +++ /dev/null @@ -1,145 +0,0 @@ -# incubator/zookeeper - -This helm chart provides an implementation of the ZooKeeper [StatefulSet](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/) found in Kubernetes Contrib [Zookeeper StatefulSet](https://github.com/kubernetes/contrib/tree/master/statefulsets/zookeeper). - -## Prerequisites -* Kubernetes 1.10+ -* PersistentVolume support on the underlying infrastructure -* A dynamic provisioner for the PersistentVolumes -* A familiarity with [Apache ZooKeeper 3.5.x](https://zookeeper.apache.org/doc/r3.5.5/) - -## Chart Components -This chart will do the following: - -* Create a fixed size ZooKeeper ensemble using a [StatefulSet](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/). -* Create a [PodDisruptionBudget](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-disruption-budget/) so kubectl drain will respect the Quorum size of the ensemble. -* Create a [Headless Service](https://kubernetes.io/docs/concepts/services-networking/service/) to control the domain of the ZooKeeper ensemble. -* Create a Service configured to connect to the available ZooKeeper instance on the configured client port. -* Optionally apply a [Pod Anti-Affinity](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity-beta-feature) to spread the ZooKeeper ensemble across nodes. -* Optionally start JMX Exporter and Zookeeper Exporter containers inside Zookeeper pods. -* Optionally create a job which creates Zookeeper chroots (e.g. `/kafka1`). -* Optionally create a Prometheus ServiceMonitor for each enabled exporter container - -## Installing the Chart -You can install the chart with the release name `zookeeper` as below. - -```console -$ helm repo add incubator http://storage.googleapis.com/kubernetes-charts-incubator -$ helm install --name zookeeper incubator/zookeeper -``` - -If you do not specify a name, helm will select a name for you. - -### Installed Components -You can use `kubectl get` to view all of the installed components. - -```console{%raw} -$ kubectl get all -l app=zookeeper -NAME: zookeeper -LAST DEPLOYED: Wed Apr 11 17:09:48 2018 -NAMESPACE: default -STATUS: DEPLOYED - -RESOURCES: -==> v1beta1/PodDisruptionBudget -NAME MIN AVAILABLE MAX UNAVAILABLE ALLOWED DISRUPTIONS AGE -zookeeper N/A 1 1 2m - -==> v1/Service -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -zookeeper-headless ClusterIP None 2181/TCP,3888/TCP,2888/TCP 2m -zookeeper ClusterIP 10.98.179.165 2181/TCP 2m - -==> v1beta1/StatefulSet -NAME DESIRED CURRENT AGE -zookeeper 3 3 2m - -==> monitoring.coreos.com/v1/ServiceMonitor -NAME AGE -zookeeper 2m -zookeeper-exporter 2m -``` - -1. `statefulsets/zookeeper` is the StatefulSet created by the chart. -1. `po/zookeeper-<0|1|2>` are the Pods created by the StatefulSet. Each Pod has a single container running a ZooKeeper server. -1. `svc/zookeeper-headless` is the Headless Service used to control the network domain of the ZooKeeper ensemble. -1. `svc/zookeeper` is a Service that can be used by clients to connect to an available ZooKeeper server. -1. `servicemonitor/zookeeper` is a Prometheus ServiceMonitor which scrapes the jmx-exporter metrics endpoint -1. `servicemonitor/zookeeper-exporter` is a Prometheus ServiceMonitor which scrapes the zookeeper-exporter metrics endpoint - -## Configuration -You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. - -Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, - -```console -$ helm install --name my-release -f values.yaml incubator/zookeeper -``` - -## Default Values - -- You can find all user-configurable settings, their defaults and commentary about them in [values.yaml](values.yaml). - -## Deep Dive - -## Image Details -The image used for this chart is based on Alpine 3.9.0. - -## JVM Details -The Java Virtual Machine used for this chart is the OpenJDK JVM 8u192 JRE (headless). - -## ZooKeeper Details -The chart defaults to ZooKeeper 3.5 (latest released version). - -## Failover -You can test failover by killing the leader. Insert a key: -```console -$ kubectl exec zookeeper-0 -- bin/zkCli.sh create /foo bar; -$ kubectl exec zookeeper-2 -- bin/zkCli.sh get /foo; -``` - -Watch existing members: -```console -$ kubectl run --attach bbox --image=busybox --restart=Never -- sh -c 'while true; do for i in 0 1 2; do echo zk-${i} $(echo stats | nc -${i}.:2181 | grep Mode); sleep 1; done; done'; - -zk-2 Mode: follower -zk-0 Mode: follower -zk-1 Mode: leader -zk-2 Mode: follower -``` - -Delete Pods and wait for the StatefulSet controller to bring them back up: -```console -$ kubectl delete po -l app=zookeeper -$ kubectl get po --watch-only -NAME READY STATUS RESTARTS AGE -zookeeper-0 0/1 Running 0 35s -zookeeper-0 1/1 Running 0 50s -zookeeper-1 0/1 Pending 0 0s -zookeeper-1 0/1 Pending 0 0s -zookeeper-1 0/1 ContainerCreating 0 0s -zookeeper-1 0/1 Running 0 19s -zookeeper-1 1/1 Running 0 40s -zookeeper-2 0/1 Pending 0 0s -zookeeper-2 0/1 Pending 0 0s -zookeeper-2 0/1 ContainerCreating 0 0s -zookeeper-2 0/1 Running 0 19s -zookeeper-2 1/1 Running 0 41s -``` - -Check the previously inserted key: -```console -$ kubectl exec zookeeper-1 -- bin/zkCli.sh get /foo -ionid = 0x354887858e80035, negotiated timeout = 30000 - -WATCHER:: - -WatchedEvent state:SyncConnected type:None path:null -bar -``` - -## Scaling -ZooKeeper can not be safely scaled in versions prior to 3.5.x - -## Limitations -* Only supports storage options that have backends for persistent volume claims. diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/NOTES.txt b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/NOTES.txt deleted file mode 100644 index 6c5da85..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/NOTES.txt +++ /dev/null @@ -1,7 +0,0 @@ -Thank you for installing ZooKeeper on your Kubernetes cluster. More information -about ZooKeeper can be found at https://zookeeper.apache.org/doc/current/ - -Your connection string should look like: - {{ template "zookeeper.fullname" . }}-0.{{ template "zookeeper.fullname" . }}-headless:{{ .Values.service.ports.client.port }},{{ template "zookeeper.fullname" . }}-1.{{ template "zookeeper.fullname" . }}-headless:{{ .Values.service.ports.client.port }},... - -You can also use the client service {{ template "zookeeper.fullname" . }}:{{ .Values.service.ports.client.port }} to connect to an available ZooKeeper server. diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/_helpers.tpl b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/_helpers.tpl deleted file mode 100644 index 0e15107..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/_helpers.tpl +++ /dev/null @@ -1,46 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "zookeeper.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "zookeeper.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "zookeeper.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -The name of the zookeeper headless service. -*/}} -{{- define "zookeeper.headless" -}} -{{- printf "%s-headless" (include "zookeeper.fullname" .) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -The name of the zookeeper chroots job. -*/}} -{{- define "zookeeper.chroots" -}} -{{- printf "%s-chroots" (include "zookeeper.fullname" .) | trunc 63 | trimSuffix "-" -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/config-jmx-exporter.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/config-jmx-exporter.yaml deleted file mode 100644 index 47c3f9b..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/config-jmx-exporter.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if .Values.exporters.jmx.enabled }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ .Release.Name }}-jmx-exporter - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "zookeeper.name" . }} - chart: {{ template "zookeeper.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: - config.yml: |- - hostPort: 127.0.0.1:{{ .Values.env.JMXPORT }} - lowercaseOutputName: {{ .Values.exporters.jmx.config.lowercaseOutputName }} - rules: -{{ .Values.exporters.jmx.config.rules | toYaml | indent 6 }} - ssl: false - startDelaySeconds: {{ .Values.exporters.jmx.config.startDelaySeconds }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/config-script.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/config-script.yaml deleted file mode 100644 index 3afae07..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/config-script.yaml +++ /dev/null @@ -1,113 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "zookeeper.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "zookeeper.name" . }} - chart: {{ template "zookeeper.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - component: server -data: - ok: | - #!/bin/sh - echo ruok | nc 127.0.0.1 ${1:-2181} - - ready: | - #!/bin/sh - echo ruok | nc 127.0.0.1 ${1:-2181} -'' - run: | - #!/bin/bash - - set -a - ROOT=$(echo /apache-zookeeper-*) - - ZK_USER=${ZK_USER:-"zookeeper"} - ZK_LOG_LEVEL=${ZK_LOG_LEVEL:-"INFO"} - ZK_DATA_DIR=${ZK_DATA_DIR:-"/data"} - ZK_DATA_LOG_DIR=${ZK_DATA_LOG_DIR:-"/data/log"} - ZK_CONF_DIR=${ZK_CONF_DIR:-"/conf"} - ZK_CLIENT_PORT=${ZK_CLIENT_PORT:-2181} - ZK_SERVER_PORT=${ZK_SERVER_PORT:-2888} - ZK_ELECTION_PORT=${ZK_ELECTION_PORT:-3888} - ZK_TICK_TIME=${ZK_TICK_TIME:-2000} - ZK_INIT_LIMIT=${ZK_INIT_LIMIT:-10} - ZK_SYNC_LIMIT=${ZK_SYNC_LIMIT:-5} - ZK_HEAP_SIZE=${ZK_HEAP_SIZE:-2G} - ZK_MAX_CLIENT_CNXNS=${ZK_MAX_CLIENT_CNXNS:-60} - ZK_MIN_SESSION_TIMEOUT=${ZK_MIN_SESSION_TIMEOUT:- $((ZK_TICK_TIME*2))} - ZK_MAX_SESSION_TIMEOUT=${ZK_MAX_SESSION_TIMEOUT:- $((ZK_TICK_TIME*20))} - ZK_SNAP_RETAIN_COUNT=${ZK_SNAP_RETAIN_COUNT:-3} - ZK_PURGE_INTERVAL=${ZK_PURGE_INTERVAL:-0} - ID_FILE="$ZK_DATA_DIR/myid" - ZK_CONFIG_FILE="$ZK_CONF_DIR/zoo.cfg" - LOG4J_PROPERTIES="$ZK_CONF_DIR/log4j.properties" - HOST=$(hostname) - DOMAIN=`hostname -d` - ZOOCFG=zoo.cfg - ZOOCFGDIR=$ZK_CONF_DIR - JVMFLAGS="-Xmx$ZK_HEAP_SIZE -Xms$ZK_HEAP_SIZE" - - APPJAR=$(echo $ROOT/*jar) - CLASSPATH="${ROOT}/lib/*:${APPJAR}:${ZK_CONF_DIR}:" - - if [[ $HOST =~ (.*)-([0-9]+)$ ]]; then - NAME=${BASH_REMATCH[1]} - ORD=${BASH_REMATCH[2]} - MY_ID=$((ORD+1)) - else - echo "Failed to extract ordinal from hostname $HOST" - exit 1 - fi - - mkdir -p $ZK_DATA_DIR - mkdir -p $ZK_DATA_LOG_DIR - echo $MY_ID >> $ID_FILE - - echo "clientPort=$ZK_CLIENT_PORT" >> $ZK_CONFIG_FILE - echo "dataDir=$ZK_DATA_DIR" >> $ZK_CONFIG_FILE - echo "dataLogDir=$ZK_DATA_LOG_DIR" >> $ZK_CONFIG_FILE - echo "tickTime=$ZK_TICK_TIME" >> $ZK_CONFIG_FILE - echo "initLimit=$ZK_INIT_LIMIT" >> $ZK_CONFIG_FILE - echo "syncLimit=$ZK_SYNC_LIMIT" >> $ZK_CONFIG_FILE - echo "maxClientCnxns=$ZK_MAX_CLIENT_CNXNS" >> $ZK_CONFIG_FILE - echo "minSessionTimeout=$ZK_MIN_SESSION_TIMEOUT" >> $ZK_CONFIG_FILE - echo "maxSessionTimeout=$ZK_MAX_SESSION_TIMEOUT" >> $ZK_CONFIG_FILE - echo "autopurge.snapRetainCount=$ZK_SNAP_RETAIN_COUNT" >> $ZK_CONFIG_FILE - echo "autopurge.purgeInterval=$ZK_PURGE_INTERVAL" >> $ZK_CONFIG_FILE - echo "4lw.commands.whitelist=*" >> $ZK_CONFIG_FILE - - for (( i=1; i<=$ZK_REPLICAS; i++ )) - do - echo "server.$i=$NAME-$((i-1)).$DOMAIN:$ZK_SERVER_PORT:$ZK_ELECTION_PORT" >> $ZK_CONFIG_FILE - done - - rm -f $LOG4J_PROPERTIES - - echo "zookeeper.root.logger=$ZK_LOG_LEVEL, CONSOLE" >> $LOG4J_PROPERTIES - echo "zookeeper.console.threshold=$ZK_LOG_LEVEL" >> $LOG4J_PROPERTIES - echo "zookeeper.log.threshold=$ZK_LOG_LEVEL" >> $LOG4J_PROPERTIES - echo "zookeeper.log.dir=$ZK_DATA_LOG_DIR" >> $LOG4J_PROPERTIES - echo "zookeeper.log.file=zookeeper.log" >> $LOG4J_PROPERTIES - echo "zookeeper.log.maxfilesize=256MB" >> $LOG4J_PROPERTIES - echo "zookeeper.log.maxbackupindex=10" >> $LOG4J_PROPERTIES - echo "zookeeper.tracelog.dir=$ZK_DATA_LOG_DIR" >> $LOG4J_PROPERTIES - echo "zookeeper.tracelog.file=zookeeper_trace.log" >> $LOG4J_PROPERTIES - echo "log4j.rootLogger=\${zookeeper.root.logger}" >> $LOG4J_PROPERTIES - echo "log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender" >> $LOG4J_PROPERTIES - echo "log4j.appender.CONSOLE.Threshold=\${zookeeper.console.threshold}" >> $LOG4J_PROPERTIES - echo "log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout" >> $LOG4J_PROPERTIES - echo "log4j.appender.CONSOLE.layout.ConversionPattern=%d{ISO8601} [myid:%X{myid}] - %-5p [%t:%C{1}@%L] - %m%n" >> $LOG4J_PROPERTIES - - if [ -n "$JMXDISABLE" ] - then - MAIN=org.apache.zookeeper.server.quorum.QuorumPeerMain - else - MAIN="-Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=$JMXPORT -Dcom.sun.management.jmxremote.authenticate=$JMXAUTH -Dcom.sun.management.jmxremote.ssl=$JMXSSL -Dzookeeper.jmx.log4j.disable=$JMXLOG4J org.apache.zookeeper.server.quorum.QuorumPeerMain" - fi - - set -x - exec java -cp "$CLASSPATH" $JVMFLAGS $MAIN $ZK_CONFIG_FILE diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/job-chroots.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/job-chroots.yaml deleted file mode 100644 index 6c132c5..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/job-chroots.yaml +++ /dev/null @@ -1,66 +0,0 @@ -{{- if .Values.jobs.chroots.enabled }} -{{- $root := . }} -{{- $job := .Values.jobs.chroots }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "zookeeper.chroots" . }} - namespace: {{ .Release.Namespace }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "-5" - "helm.sh/hook-delete-policy": hook-succeeded - labels: - app: {{ template "zookeeper.name" . }} - chart: {{ template "zookeeper.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - component: jobs - job: chroots -spec: - activeDeadlineSeconds: {{ $job.activeDeadlineSeconds }} - backoffLimit: {{ $job.backoffLimit }} - completions: {{ $job.completions }} - parallelism: {{ $job.parallelism }} - template: - metadata: - labels: - app: {{ template "zookeeper.name" . }} - release: {{ .Release.Name }} - component: jobs - job: chroots - spec: - restartPolicy: {{ $job.restartPolicy }} -{{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" -{{- end }} - containers: - - name: main - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - command: - - /bin/bash - - -o - - pipefail - - -euc - {{- $port := .Values.service.ports.client.port }} - - > - sleep 15; - export SERVER={{ template "zookeeper.fullname" $root }}:{{ $port }}; - {{- range $job.config.create }} - echo '==> {{ . }}'; - echo '====> Create chroot if does not exist.'; - zkCli.sh -server {{ template "zookeeper.fullname" $root }}:{{ $port }} get {{ . }} 2>&1 >/dev/null | grep 'cZxid' - || zkCli.sh -server {{ template "zookeeper.fullname" $root }}:{{ $port }} create {{ . }} ""; - echo '====> Confirm chroot exists.'; - zkCli.sh -server {{ template "zookeeper.fullname" $root }}:{{ $port }} get {{ . }} 2>&1 >/dev/null | grep 'cZxid'; - echo '====> Chroot exists.'; - {{- end }} - env: - {{- range $key, $value := $job.env }} - - name: {{ $key | upper | replace "." "_" }} - value: {{ $value | quote }} - {{- end }} - resources: -{{ toYaml $job.resources | indent 12 }} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/poddisruptionbudget.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/poddisruptionbudget.yaml deleted file mode 100644 index ff1d2c0..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: {{ template "zookeeper.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "zookeeper.name" . }} - chart: {{ template "zookeeper.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - component: server -spec: - selector: - matchLabels: - app: {{ template "zookeeper.name" . }} - release: {{ .Release.Name }} - component: server -{{ toYaml .Values.podDisruptionBudget | indent 2 }} diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/service-headless.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/service-headless.yaml deleted file mode 100644 index 57dd9db..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/service-headless.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ template "zookeeper.headless" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "zookeeper.name" . }} - chart: {{ template "zookeeper.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- if .Values.headless.annotations }} - annotations: -{{ .Values.headless.annotations | toYaml | trimSuffix "\n" | indent 4 }} -{{- end }} -spec: - clusterIP: None - ports: -{{- range $key, $port := .Values.ports }} - - name: {{ $key }} - port: {{ $port.containerPort }} - targetPort: {{ $key }} - protocol: {{ $port.protocol }} -{{- end }} - selector: - app: {{ template "zookeeper.name" . }} - release: {{ .Release.Name }} diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/service.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/service.yaml deleted file mode 100644 index 6e8287c..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/service.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ template "zookeeper.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "zookeeper.name" . }} - chart: {{ template "zookeeper.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- if .Values.service.annotations }}} - annotations: -{{- with .Values.service.annotations }} -{{ toYaml . | indent 4 }} -{{- end }} -{{- end }} -spec: - type: {{ .Values.service.type }} - ports: - {{- range $key, $value := .Values.service.ports }} - - name: {{ $key }} -{{ toYaml $value | indent 6 }} - {{- end }} -{{- if .Values.exporters.jmx.enabled }} - {{- range $key, $port := .Values.exporters.jmx.ports }} - - name: {{ $key }} - port: {{ $port.containerPort }} - targetPort: {{ $key }} - protocol: {{ $port.protocol }} - {{- end }} -{{- end}} -{{- if .Values.exporters.zookeeper.enabled }} - {{- range $key, $port := .Values.exporters.zookeeper.ports }} - - name: {{ $key }} - port: {{ $port.containerPort }} - targetPort: {{ $key }} - protocol: {{ $port.protocol }} - {{- end }} -{{- end}} - selector: - app: {{ template "zookeeper.name" . }} - release: {{ .Release.Name }} diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/servicemonitors.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/servicemonitors.yaml deleted file mode 100644 index 20621b9..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/servicemonitors.yaml +++ /dev/null @@ -1,60 +0,0 @@ -{{- if and .Values.exporters.jmx.enabled .Values.prometheus.serviceMonitor.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "zookeeper.fullname" . }} - {{- if .Values.prometheus.serviceMonitor.namespace }} - namespace: {{ .Values.prometheus.serviceMonitor.namespace }} - {{- else }} - namespace: {{ .Release.Namespace }} - {{- end }} - labels: -{{ toYaml .Values.prometheus.serviceMonitor.selector | indent 4 }} -spec: - endpoints: - {{- range $key, $port := .Values.exporters.jmx.ports }} - - port: {{ $key }} - path: {{ $.Values.exporters.jmx.path }} - interval: {{ $.Values.exporters.jmx.serviceMonitor.interval }} - scrapeTimeout: {{ $.Values.exporters.jmx.serviceMonitor.scrapeTimeout }} - scheme: {{ $.Values.exporters.jmx.serviceMonitor.scheme }} - {{- end }} - selector: - matchLabels: - app: {{ include "zookeeper.name" . }} - release: {{ .Release.Name }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} -{{- end }} ---- - -{{- if and .Values.exporters.zookeeper.enabled .Values.prometheus.serviceMonitor.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "zookeeper.fullname" . }}-exporter - {{- if .Values.prometheus.serviceMonitor.namespace }} - namespace: {{ .Values.prometheus.serviceMonitor.namespace }} - {{- else }} - namespace: {{ .Release.Namespace }} - {{- end }} - labels: -{{ toYaml .Values.prometheus.serviceMonitor.selector | indent 4 }} -spec: - endpoints: - {{- range $key, $port := .Values.exporters.zookeeper.ports }} - - port: {{ $key }} - path: {{ $.Values.exporters.zookeeper.path }} - interval: {{ $.Values.exporters.zookeeper.serviceMonitor.interval }} - scrapeTimeout: {{ $.Values.exporters.zookeeper.serviceMonitor.scrapeTimeout }} - scheme: {{ $.Values.exporters.zookeeper.serviceMonitor.scheme }} - {{- end }} - selector: - matchLabels: - app: {{ include "zookeeper.name" . }} - release: {{ .Release.Name }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} -{{- end }} \ No newline at end of file diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/statefulset.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/statefulset.yaml deleted file mode 100644 index a2fede1..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/templates/statefulset.yaml +++ /dev/null @@ -1,227 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ template "zookeeper.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ template "zookeeper.name" . }} - chart: {{ template "zookeeper.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - component: server -spec: - serviceName: {{ template "zookeeper.headless" . }} - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: - app: {{ template "zookeeper.name" . }} - release: {{ .Release.Name }} - component: server - updateStrategy: -{{ toYaml .Values.updateStrategy | indent 4 }} - template: - metadata: - labels: - app: {{ template "zookeeper.name" . }} - release: {{ .Release.Name }} - component: server - {{- if .Values.podLabels }} - ## Custom pod labels - {{- range $key, $value := .Values.podLabels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - {{- end }} -{{- if .Values.podAnnotations }} - annotations: - ## Custom pod annotations - {{- range $key, $value := .Values.podAnnotations }} - {{ $key }}: {{ $value | quote }} - {{- end }} -{{- end }} - spec: - terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} -{{- if .Values.schedulerName }} - schedulerName: "{{ .Values.schedulerName }}" -{{- end }} - securityContext: -{{ toYaml .Values.securityContext | indent 8 }} -{{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" -{{- end }} - containers: - - - name: zookeeper - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- with .Values.command }} - command: {{ range . }} - - {{ . | quote }} - {{- end }} - {{- end }} - ports: -{{- range $key, $port := .Values.ports }} - - name: {{ $key }} -{{ toYaml $port | indent 14 }} -{{- end }} - livenessProbe: - exec: - command: - - sh - - /config-scripts/ok - initialDelaySeconds: 20 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 2 - successThreshold: 1 - readinessProbe: - exec: - command: - - sh - - /config-scripts/ready - initialDelaySeconds: 20 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 2 - successThreshold: 1 - env: - - name: ZK_REPLICAS - value: {{ .Values.replicaCount | quote }} - {{- range $key, $value := .Values.env }} - - name: {{ $key | upper | replace "." "_" }} - value: {{ $value | quote }} - {{- end }} - {{- range $secret := .Values.secrets }} - {{- range $key := $secret.keys }} - - name: {{ (print $secret.name "_" $key) | upper }} - valueFrom: - secretKeyRef: - name: {{ $secret.name }} - key: {{ $key }} - {{- end }} - {{- end }} - resources: -{{ toYaml .Values.resources | indent 12 }} - volumeMounts: - - name: data - mountPath: /data - {{- range $secret := .Values.secrets }} - {{- if $secret.mountPath }} - {{- range $key := $secret.keys }} - - name: {{ $.Release.Name }}-{{ $secret.name }} - mountPath: {{ $secret.mountPath }}/{{ $key }} - subPath: {{ $key }} - readOnly: true - {{- end }} - {{- end }} - {{- end }} - - name: config - mountPath: /config-scripts - - -{{- if .Values.exporters.jmx.enabled }} - - name: jmx-exporter - image: "{{ .Values.exporters.jmx.image.repository }}:{{ .Values.exporters.jmx.image.tag }}" - imagePullPolicy: {{ .Values.exporters.jmx.image.pullPolicy }} - ports: - {{- range $key, $port := .Values.exporters.jmx.ports }} - - name: {{ $key }} -{{ toYaml $port | indent 14 }} - {{- end }} - livenessProbe: -{{ toYaml .Values.exporters.jmx.livenessProbe | indent 12 }} - readinessProbe: -{{ toYaml .Values.exporters.jmx.readinessProbe | indent 12 }} - env: - - name: SERVICE_PORT - value: {{ .Values.exporters.jmx.ports.jmxxp.containerPort | quote }} - {{- with .Values.exporters.jmx.env }} - {{- range $key, $value := . }} - - name: {{ $key | upper | replace "." "_" }} - value: {{ $value | quote }} - {{- end }} - {{- end }} - resources: -{{ toYaml .Values.exporters.jmx.resources | indent 12 }} - volumeMounts: - - name: config-jmx-exporter - mountPath: /opt/jmx_exporter/config.yml - subPath: config.yml -{{- end }} - -{{- if .Values.exporters.zookeeper.enabled }} - - name: zookeeper-exporter - image: "{{ .Values.exporters.zookeeper.image.repository }}:{{ .Values.exporters.zookeeper.image.tag }}" - imagePullPolicy: {{ .Values.exporters.zookeeper.image.pullPolicy }} - args: - - -bind-addr=:{{ .Values.exporters.zookeeper.ports.zookeeperxp.containerPort }} - - -metrics-path={{ .Values.exporters.zookeeper.path }} - - -zookeeper=localhost:{{ .Values.ports.client.containerPort }} - - -log-level={{ .Values.exporters.zookeeper.config.logLevel }} - - -reset-on-scrape={{ .Values.exporters.zookeeper.config.resetOnScrape }} - ports: - {{- range $key, $port := .Values.exporters.zookeeper.ports }} - - name: {{ $key }} -{{ toYaml $port | indent 14 }} - {{- end }} - livenessProbe: -{{ toYaml .Values.exporters.zookeeper.livenessProbe | indent 12 }} - readinessProbe: -{{ toYaml .Values.exporters.zookeeper.readinessProbe | indent 12 }} - env: - {{- range $key, $value := .Values.exporters.zookeeper.env }} - - name: {{ $key | upper | replace "." "_" }} - value: {{ $value | quote }} - {{- end }} - resources: -{{ toYaml .Values.exporters.zookeeper.resources | indent 12 }} -{{- end }} - - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} - volumes: - - name: config - configMap: - name: {{ template "zookeeper.fullname" . }} - defaultMode: 0555 - {{- range .Values.secrets }} - - name: {{ $.Release.Name }}-{{ .name }} - secret: - secretName: {{ .name }} - {{- end }} - {{- if .Values.exporters.jmx.enabled }} - - name: config-jmx-exporter - configMap: - name: {{ .Release.Name }}-jmx-exporter - {{- end }} - {{- if not .Values.persistence.enabled }} - - name: data - emptyDir: {} - {{- end }} - {{- if .Values.persistence.enabled }} - volumeClaimTemplates: - - metadata: - name: data - spec: - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - {{- if .Values.persistence.storageClass }} - {{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" - {{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" - {{- end }} - {{- end }} - {{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/values.yaml b/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/values.yaml deleted file mode 100644 index 2fa6286..0000000 --- a/rds/base/charts/jaeger/charts/kafka/charts/zookeeper/values.yaml +++ /dev/null @@ -1,295 +0,0 @@ -## As weighted quorums are not supported, it is imperative that an odd number of replicas -## be chosen. Moreover, the number of replicas should be either 1, 3, 5, or 7. -## -## ref: https://github.com/kubernetes/contrib/tree/master/statefulsets/zookeeper#stateful-set -replicaCount: 3 # Desired quantity of ZooKeeper pods. This should always be (1,3,5, or 7) - -podDisruptionBudget: - maxUnavailable: 1 # Limits how many Zokeeper pods may be unavailable due to voluntary disruptions. - -terminationGracePeriodSeconds: 1800 # Duration in seconds a Zokeeper pod needs to terminate gracefully. - -updateStrategy: - type: RollingUpdate - -## refs: -## - https://github.com/kubernetes/contrib/tree/master/statefulsets/zookeeper -## - https://github.com/kubernetes/contrib/blob/master/statefulsets/zookeeper/Makefile#L1 -image: - repository: zookeeper # Container image repository for zookeeper container. - tag: 3.5.5 # Container image tag for zookeeper container. - pullPolicy: IfNotPresent # Image pull criteria for zookeeper container. - -service: - type: ClusterIP # Exposes zookeeper on a cluster-internal IP. - annotations: {} # Arbitrary non-identifying metadata for zookeeper service. - ## AWS example for use with LoadBalancer service type. - # external-dns.alpha.kubernetes.io/hostname: zookeeper.cluster.local - # service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true" - # service.beta.kubernetes.io/aws-load-balancer-internal: "true" - ports: - client: - port: 2181 # Service port number for client port. - targetPort: client # Service target port for client port. - protocol: TCP # Service port protocol for client port. - -## Headless service. -## -headless: - annotations: {} - -ports: - client: - containerPort: 2181 # Port number for zookeeper container client port. - protocol: TCP # Protocol for zookeeper container client port. - election: - containerPort: 3888 # Port number for zookeeper container election port. - protocol: TCP # Protocol for zookeeper container election port. - server: - containerPort: 2888 # Port number for zookeeper container server port. - protocol: TCP # Protocol for zookeeper container server port. - -resources: {} # Optionally specify how much CPU and memory (RAM) each zookeeper container needs. - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -priorityClassName: "" - -nodeSelector: {} # Node label-values required to run zookeeper pods. - -tolerations: [] # Node taint overrides for zookeeper pods. - -affinity: {} # Criteria by which pod label-values influence scheduling for zookeeper pods. - # podAntiAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # - topologyKey: "kubernetes.io/hostname" - # labelSelector: - # matchLabels: - # release: zookeeper - -podAnnotations: {} # Arbitrary non-identifying metadata for zookeeper pods. - # prometheus.io/scrape: "true" - # prometheus.io/path: "/metrics" - # prometheus.io/port: "9141" - -podLabels: {} # Key/value pairs that are attached to zookeeper pods. - # team: "developers" - # service: "zookeeper" - -securityContext: - fsGroup: 1000 - runAsUser: 1000 - -## Useful, if you want to use an alternate image. -command: - - /bin/bash - - -xec - - /config-scripts/run - -## Useful if using any custom authorizer. -## Pass any secrets to the kafka pods. Each secret will be passed as an -## environment variable by default. The secret can also be mounted to a -## specific path (in addition to environment variable) if required. Environment -## variable names are generated as: `_` (All upper case) -# secrets: -# - name: myKafkaSecret -# keys: -# - username -# - password -# # mountPath: /opt/kafka/secret -# - name: myZkSecret -# keys: -# - user -# - pass -# mountPath: /opt/zookeeper/secret - -persistence: - enabled: true - ## zookeeper data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClass: "-" - accessMode: ReadWriteOnce - size: 5Gi - -## Exporters query apps for metrics and make those metrics available for -## Prometheus to scrape. -exporters: - - jmx: - enabled: false - image: - repository: sscaling/jmx-prometheus-exporter - tag: 0.3.0 - pullPolicy: IfNotPresent - config: - lowercaseOutputName: false - ## ref: https://github.com/prometheus/jmx_exporter/blob/master/example_configs/zookeeper.yaml - rules: - - pattern: "org.apache.ZooKeeperService<>(\\w+)" - name: "zookeeper_$2" - - pattern: "org.apache.ZooKeeperService<>(\\w+)" - name: "zookeeper_$3" - labels: - replicaId: "$2" - - pattern: "org.apache.ZooKeeperService<>(\\w+)" - name: "zookeeper_$4" - labels: - replicaId: "$2" - memberType: "$3" - - pattern: "org.apache.ZooKeeperService<>(\\w+)" - name: "zookeeper_$4_$5" - labels: - replicaId: "$2" - memberType: "$3" - startDelaySeconds: 30 - env: {} - resources: {} - path: /metrics - ports: - jmxxp: - containerPort: 9404 - protocol: TCP - livenessProbe: - httpGet: - path: /metrics - port: jmxxp - initialDelaySeconds: 30 - periodSeconds: 15 - timeoutSeconds: 60 - failureThreshold: 8 - successThreshold: 1 - readinessProbe: - httpGet: - path: /metrics - port: jmxxp - initialDelaySeconds: 30 - periodSeconds: 15 - timeoutSeconds: 60 - failureThreshold: 8 - successThreshold: 1 - serviceMonitor: - interval: 30s - scrapeTimeout: 30s - scheme: http - - zookeeper: - ## refs: - ## - https://github.com/carlpett/zookeeper_exporter - ## - https://hub.docker.com/r/josdotso/zookeeper-exporter/ - ## - https://www.datadoghq.com/blog/monitoring-kafka-performance-metrics/#zookeeper-metrics - enabled: false - image: - repository: josdotso/zookeeper-exporter - tag: v1.1.2 - pullPolicy: IfNotPresent - config: - logLevel: info - resetOnScrape: "true" - env: {} - resources: {} - path: /metrics - ports: - zookeeperxp: - containerPort: 9141 - protocol: TCP - livenessProbe: - httpGet: - path: /metrics - port: zookeeperxp - initialDelaySeconds: 30 - periodSeconds: 15 - timeoutSeconds: 60 - failureThreshold: 8 - successThreshold: 1 - readinessProbe: - httpGet: - path: /metrics - port: zookeeperxp - initialDelaySeconds: 30 - periodSeconds: 15 - timeoutSeconds: 60 - failureThreshold: 8 - successThreshold: 1 - serviceMonitor: - interval: 30s - scrapeTimeout: 30s - scheme: http - -## ServiceMonitor configuration in case you are using Prometheus Operator -prometheus: - serviceMonitor: - ## If true a ServiceMonitor for each enabled exporter will be installed - enabled: false - ## The namespace where the ServiceMonitor(s) will be installed - # namespace: monitoring - ## The selector the Prometheus instance is searching for - ## [Default Prometheus Operator selector] (https://github.com/helm/charts/blob/f5a751f174263971fafd21eee4e35416d6612a3d/stable/prometheus-operator/templates/prometheus/prometheus.yaml#L74) - selector: {} - -## Use an alternate scheduler, e.g. "stork". -## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ -## -# schedulerName: - -## ref: https://github.com/kubernetes/contrib/tree/master/statefulsets/zookeeper -env: - - ## Options related to JMX exporter. - ## ref: https://github.com/apache/zookeeper/blob/master/bin/zkServer.sh#L36 - JMXAUTH: "false" - JMXDISABLE: "false" - JMXPORT: 1099 - JMXSSL: "false" - - ## The port on which the server will accept client requests. - ZOO_PORT: 2181 - - ## The number of Ticks that an ensemble member is allowed to perform leader - ## election. - ZOO_INIT_LIMIT: 5 - - ZOO_TICK_TIME: 2000 - - ## The maximum number of concurrent client connections that - ## a server in the ensemble will accept. - ZOO_MAX_CLIENT_CNXNS: 60 - - ## The number of Tick by which a follower may lag behind the ensembles leader. - ZK_SYNC_LIMIT: 10 - - ## The number of wall clock ms that corresponds to a Tick for the ensembles - ## internal time. - ZK_TICK_TIME: 2000 - - ZOO_AUTOPURGE_PURGEINTERVAL: 0 - ZOO_AUTOPURGE_SNAPRETAINCOUNT: 3 - ZOO_STANDALONE_ENABLED: false - -jobs: - ## ref: http://zookeeper.apache.org/doc/r3.4.10/zookeeperProgrammers.html#ch_zkSessions - chroots: - enabled: false - activeDeadlineSeconds: 300 - backoffLimit: 5 - completions: 1 - config: - create: [] - # - /kafka - # - /ureplicator - env: [] - parallelism: 1 - resources: {} - restartPolicy: Never diff --git a/rds/base/charts/jaeger/charts/kafka/requirements.lock b/rds/base/charts/jaeger/charts/kafka/requirements.lock deleted file mode 100644 index 35c0583..0000000 --- a/rds/base/charts/jaeger/charts/kafka/requirements.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: zookeeper - repository: file://charts/zookeeper - version: 2.1.0 -digest: sha256:15b2dd453a6aeb0ecc8193bbde64cb23af32b98605e67240286eb4e7b84e361d -generated: "2022-08-18T15:37:24.60553345+02:00" diff --git a/rds/base/charts/jaeger/charts/kafka/requirements.yaml b/rds/base/charts/jaeger/charts/kafka/requirements.yaml deleted file mode 100644 index ef02ce4..0000000 --- a/rds/base/charts/jaeger/charts/kafka/requirements.yaml +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: zookeeper - version: 2.1.0 - repository: file://charts/zookeeper - condition: kafka.zookeeper.enabled,zookeeper.enabled -version: 0.20.6 \ No newline at end of file diff --git a/rds/base/charts/jaeger/charts/kafka/templates/NOTES.txt b/rds/base/charts/jaeger/charts/kafka/templates/NOTES.txt deleted file mode 100644 index 9609f39..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/NOTES.txt +++ /dev/null @@ -1,76 +0,0 @@ -### Connecting to Kafka from inside Kubernetes - -You can connect to Kafka by running a simple pod in the K8s cluster like this with a configuration like this: - - apiVersion: v1 - kind: Pod - metadata: - name: testclient - namespace: {{ .Values.global.namespace.name | default .Release.Namespace }} - spec: - containers: - - name: kafka - image: {{ .Values.image }}:{{ .Values.imageTag }} - command: - - sh - - -c - - "exec tail -f /dev/null" - -Once you have the testclient pod above running, you can list all kafka -topics with: - - kubectl -n {{ .Release.Namespace }} exec testclient -- ./bin/kafka-topics.sh --zookeeper {{ .Release.Name }}-zookeeper:2181 --list - -To create a new topic: - - kubectl -n {{ .Release.Namespace }} exec testclient -- ./bin/kafka-topics.sh --zookeeper {{ .Release.Name }}-zookeeper:2181 --topic test1 --create --partitions 1 --replication-factor 1 - -To listen for messages on a topic: - - kubectl -n {{ .Release.Namespace }} exec -ti testclient -- ./bin/kafka-console-consumer.sh --bootstrap-server {{ include "kafka.fullname" . }}:9092 --topic test1 --from-beginning - -To stop the listener session above press: Ctrl+C - -To start an interactive message producer session: - kubectl -n {{ .Release.Namespace }} exec -ti testclient -- ./bin/kafka-console-producer.sh --broker-list {{ include "kafka.fullname" . }}-headless:9092 --topic test1 - -To create a message in the above session, simply type the message and press "enter" -To end the producer session try: Ctrl+C - -If you specify "zookeeper.connect" in configurationOverrides, please replace "{{ .Release.Name }}-zookeeper:2181" with the value of "zookeeper.connect", or you will get error. - -{{ if .Values.external.enabled }} -### Connecting to Kafka from outside Kubernetes - -You have enabled the external access feature of this chart. - -**WARNING:** By default this feature allows Kafka clients outside Kubernetes to -connect to Kafka via NodePort(s) in `PLAINTEXT`. - -Please see this chart's README.md for more details and guidance. - -If you wish to connect to Kafka from outside please configure your external Kafka -clients to point at the following brokers. Please allow a few minutes for all -associated resources to become healthy. - {{ $fullName := include "kafka.fullname" . }} - {{- $replicas := .Values.replicas | int }} - {{- $servicePort := .Values.external.servicePort | int}} - {{- $root := . }} - {{- range $i, $e := until $replicas }} - {{- $externalListenerPort := add $root.Values.external.firstListenerPort $i }} - {{- if $root.Values.external.distinct }} -{{ printf "%s-%d.%s:%d" $root.Release.Name $i $root.Values.external.domain $servicePort | indent 2 }} - {{- else }} -{{ printf "%s.%s:%d" $root.Release.Name $root.Values.external.domain $externalListenerPort | indent 2 }} - {{- end }} - {{- end }} -{{- end }} - -{{ if .Values.prometheus.jmx.enabled }} -To view JMX configuration (pull request/updates to improve defaults are encouraged): - {{ if .Values.jmx.configMap.overrideName }} - kubectl -n {{ .Release.Namespace }} describe configmap {{ .Values.jmx.configMap.overrideName }} - {{ else }} - kubectl -n {{ .Release.Namespace }} describe configmap {{ include "kafka.fullname" . }}-metrics - {{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/_helpers.tpl b/rds/base/charts/jaeger/charts/kafka/templates/_helpers.tpl deleted file mode 100644 index 03bfc0a..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/_helpers.tpl +++ /dev/null @@ -1,128 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "kafka.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "kafka.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create a default fully qualified zookeeper name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "kafka.zookeeper.fullname" -}} -{{- if .Values.zookeeper.fullnameOverride -}} -{{- .Values.zookeeper.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default "zookeeper" .Values.zookeeper.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} - -{{/* -Form the Zookeeper URL. If zookeeper is installed as part of this chart, use k8s service discovery, -else use user-provided URL -*/}} -{{- define "zookeeper.url" }} -{{- $port := .Values.zookeeper.port | toString }} -{{- if .Values.zookeeper.enabled -}} -{{- printf "%s:%s" (include "kafka.zookeeper.fullname" .) $port }} -{{- else -}} -{{- $zookeeperConnect := printf "%s:%s" .Values.zookeeper.url $port }} -{{- $zookeeperConnectOverride := index .Values "configurationOverrides" "zookeeper.connect" }} -{{- default $zookeeperConnect $zookeeperConnectOverride }} -{{- end -}} -{{- end -}} - -{{/* -Derive offsets.topic.replication.factor in following priority order: configurationOverrides, replicas -*/}} -{{- define "kafka.replication.factor" }} -{{- $replicationFactorOverride := index .Values "configurationOverrides" "offsets.topic.replication.factor" }} -{{- default .Values.replicas $replicationFactorOverride }} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "kafka.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create unified labels for kafka components -*/}} - -{{- define "kafka.common.matchLabels" -}} -app.kubernetes.io/name: {{ include "kafka.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} - -{{- define "kafka.common.metaLabels" -}} -helm.sh/chart: {{ include "kafka.chart" . }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{- define "kafka.broker.matchLabels" -}} -app.kubernetes.io/component: kafka-broker -{{ include "kafka.common.matchLabels" . }} -{{- end -}} - -{{- define "kafka.broker.labels" -}} -{{ include "kafka.common.metaLabels" . }} -{{ include "kafka.broker.matchLabels" . }} -{{- end -}} - -{{- define "kafka.config.matchLabels" -}} -app.kubernetes.io/component: kafka-config -{{ include "kafka.common.matchLabels" . }} -{{- end -}} - -{{- define "kafka.config.labels" -}} -{{ include "kafka.common.metaLabels" . }} -{{ include "kafka.config.matchLabels" . }} -{{- end -}} - -{{- define "kafka.monitor.matchLabels" -}} -app.kubernetes.io/component: kafka-monitor -{{ include "kafka.common.matchLabels" . }} -{{- end -}} - -{{- define "kafka.monitor.labels" -}} -{{ include "kafka.common.metaLabels" . }} -{{ include "kafka.monitor.matchLabels" . }} -{{- end -}} - -{{- define "serviceMonitor.namespace" -}} -{{- if .Values.prometheus.operator.serviceMonitor.releaseNamespace -}} -{{ .Release.Namespace }} -{{- else -}} -{{ .Values.prometheus.operator.serviceMonitor.namespace }} -{{- end -}} -{{- end -}} - -{{- define "prometheusRule.namespace" -}} -{{- if .Values.prometheus.operator.prometheusRule.releaseNamespace -}} -{{ .Release.Namespace }} -{{- else -}} -{{ .Values.prometheus.operator.prometheusRule.namespace }} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/configmap-config.yaml b/rds/base/charts/jaeger/charts/kafka/templates/configmap-config.yaml deleted file mode 100644 index 78194c5..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/configmap-config.yaml +++ /dev/null @@ -1,80 +0,0 @@ -{{- if .Values.topics -}} -{{- $zk := include "zookeeper.url" . -}} -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - {{- include "kafka.config.labels" . | nindent 4 }} - name: {{ template "kafka.fullname" . }}-config - namespace: {{ .Release.Namespace }} -data: - runtimeConfig.sh: | - #!/bin/bash - set -e - cd /usr/bin - until kafka-configs --zookeeper {{ $zk }} --entity-type topics --describe || (( count++ >= 6 )) - do - echo "Waiting for ZooKeeper..." - sleep 20 - done - - # expected='0,1,2,3,...,n,' - # the trailing comma is significant - expected='{{ until (int .Values.replicas) | join "," | trim }},' - connected_brokers='' - until [[ "$connected_brokers" == "$expected" ]] - do - echo "Waiting for all Kafka brokers to be connected to ZooKeeper..." - connected_brokers=$(zookeeper-shell {{ $zk }} ls /brokers/ids | \ - # brokers formatted as: [ 0, 1, 2 ] - tail -1 | \ - # broker ids separated by newline - grep -o '[0-9]\+' | \ - # they may have connected in a random order - sort | \ - # trim the leading and trailing whitespace - sed 's/ *$//' | \ - # Replace newline with comma - # The result has a trailing comma - tr '\n' ',' - ) - echo "Currently available brokers: $connected_brokers" - echo "Expected brokers: $expected" - sleep 20 - done - - echo "Applying runtime configuration using {{ .Values.image }}:{{ .Values.imageTag }}" - {{- range $n, $topic := .Values.topics }} - {{- if and $topic.partitions $topic.replicationFactor $topic.reassignPartitions }} - cat << EOF > {{ $topic.name }}-increase-replication-factor.json - {"version":1, "partitions":[ - {{- $partitions := (int $topic.partitions) }} - {{- $replicas := (int $topic.replicationFactor) }} - {{- range $i := until $partitions }} - {"topic":"{{ $topic.name }}","partition":{{ $i }},"replicas":[{{- range $j := until $replicas }}{{ $j }}{{- if ne $j (sub $replicas 1) }},{{- end }}{{- end }}]}{{- if ne $i (sub $partitions 1) }},{{- end }} - {{- end }} - ]} - EOF - kafka-reassign-partitions --zookeeper {{ $zk }} --reassignment-json-file {{ $topic.name }}-increase-replication-factor.json --execute - kafka-reassign-partitions --zookeeper {{ $zk }} --reassignment-json-file {{ $topic.name }}-increase-replication-factor.json --verify - {{- else if and $topic.partitions $topic.replicationFactor }} - kafka-topics --zookeeper {{ $zk }} --create --if-not-exists --force --topic {{ $topic.name }} --partitions {{ $topic.partitions }} --replication-factor {{ $topic.replicationFactor }} - {{- else if $topic.partitions }} - kafka-topics --zookeeper {{ $zk }} --alter --force --topic {{ $topic.name }} --partitions {{ $topic.partitions }} || true - {{- end }} - {{- if $topic.defaultConfig }} - kafka-configs --zookeeper {{ $zk }} --entity-type topics --entity-name {{ $topic.name }} --alter --force --delete-config {{ nospace $topic.defaultConfig }} || true - {{- end }} - {{- if $topic.config }} - kafka-configs --zookeeper {{ $zk }} --entity-type topics --entity-name {{ $topic.name }} --alter --force --add-config {{ nospace $topic.config }} - {{- end }} - kafka-configs --zookeeper {{ $zk }} --entity-type topics --entity-name {{ $topic.name }} --describe - {{- if $topic.acls }} - {{- range $a, $acl := $topic.acls }} - {{ if and $acl.user $acl.operations }} - kafka-acls --authorizer-properties zookeeper.connect={{ $zk }} --force --add --allow-principal User:{{ $acl.user }}{{- range $operation := $acl.operations }} --operation {{ $operation }} {{- end }} --topic {{ $topic.name }} {{ $topic.extraParams }} - {{- end }} - {{- end }} - {{- end }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/configmap-jmx.yaml b/rds/base/charts/jaeger/charts/kafka/templates/configmap-jmx.yaml deleted file mode 100644 index 5b8deb2..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/configmap-jmx.yaml +++ /dev/null @@ -1,65 +0,0 @@ -{{- if and .Values.prometheus.jmx.enabled .Values.jmx.configMap.enabled }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "kafka.fullname" . }}-metrics - namespace: {{ .Release.Namespace }} - labels: - {{- include "kafka.monitor.labels" . | nindent 4 }} -data: - jmx-kafka-prometheus.yml: |+ -{{- if .Values.jmx.configMap.overrideConfig }} -{{ toYaml .Values.jmx.configMap.overrideConfig | indent 4 }} -{{- else }} - jmxUrl: service:jmx:rmi:///jndi/rmi://127.0.0.1:{{ .Values.jmx.port }}/jmxrmi - lowercaseOutputName: true - lowercaseOutputLabelNames: true - ssl: false - {{ if .Values.jmx.whitelistObjectNames }} - whitelistObjectNames: ["{{ join "\",\"" .Values.jmx.whitelistObjectNames }}"] - {{ end }} - rules: - - pattern: kafka.controller<>(Value) - name: kafka_controller_$1_$2_$4 - labels: - broker_id: "$3" - - pattern: kafka.controller<>(Value) - name: kafka_controller_$1_$2_$3 - - pattern: kafka.controller<>(Value) - name: kafka_controller_$1_$2_$3 - - pattern: kafka.controller<>(Count) - name: kafka_controller_$1_$2_$3 - - pattern: kafka.server<>(Value) - name: kafka_server_$1_$2_$4 - labels: - client_id: "$3" - - pattern : kafka.network<>(Value) - name: kafka_network_$1_$2_$4 - labels: - network_processor: $3 - - pattern : kafka.network<>(Count) - name: kafka_network_$1_$2_$4 - labels: - request: $3 - - pattern: kafka.server<>(Count|OneMinuteRate) - name: kafka_server_$1_$2_$4 - labels: - topic: $3 - - pattern: kafka.server<>(Value) - name: kafka_server_$1_$2_$3_$4 - - pattern: kafka.server<>(Count|Value|OneMinuteRate) - name: kafka_server_$1_total_$2_$3 - - pattern: kafka.server<>(queue-size) - name: kafka_server_$1_$2 - - pattern: java.lang<(.+)>(\w+) - name: java_lang_$1_$4_$3_$2 - - pattern: java.lang<>(\w+) - name: java_lang_$1_$3_$2 - - pattern : java.lang - - pattern: kafka.log<>Value - name: kafka_log_$1_$2 - labels: - topic: $3 - partition: $4 -{{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/deployment-kafka-exporter.yaml b/rds/base/charts/jaeger/charts/kafka/templates/deployment-kafka-exporter.yaml deleted file mode 100644 index 2c5cad4..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/deployment-kafka-exporter.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- if .Values.prometheus.kafka.enabled }} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ template "kafka.fullname" . }}-exporter - namespace: {{ .Release.Namespace }} - labels: - {{- include "kafka.monitor.labels" . | nindent 4 }} -spec: - replicas: 1 - selector: - matchLabels: - {{- include "kafka.monitor.matchLabels" . | nindent 6 }} - template: - metadata: - annotations: -{{- if and .Values.prometheus.kafka.enabled (not .Values.prometheus.operator.enabled) }} - prometheus.io/scrape: "true" - prometheus.io/port: {{ .Values.prometheus.kafka.port | quote }} -{{- end }} - labels: - {{- include "kafka.monitor.labels" . | nindent 8 }} - spec: - containers: - - image: "{{ .Values.prometheus.kafka.image }}:{{ .Values.prometheus.kafka.imageTag }}" - name: kafka-exporter - args: - - --kafka.server={{ template "kafka.fullname" . }}:9092 - - --web.listen-address=:{{ .Values.prometheus.kafka.port }} - ports: - - containerPort: {{ .Values.prometheus.kafka.port }} - resources: -{{ toYaml .Values.prometheus.kafka.resources | indent 10 }} -{{- if .Values.prometheus.kafka.tolerations }} - tolerations: -{{ toYaml .Values.prometheus.kafka.tolerations | indent 8 }} -{{- end }} -{{- if .Values.prometheus.kafka.affinity }} - affinity: -{{ toYaml .Values.prometheus.kafka.affinity | indent 8 }} -{{- end }} -{{- if .Values.prometheus.kafka.nodeSelector }} - nodeSelector: -{{ toYaml .Values.prometheus.kafka.nodeSelector | indent 8 }} -{{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/job-config.yaml b/rds/base/charts/jaeger/charts/kafka/templates/job-config.yaml deleted file mode 100644 index c049422..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/job-config.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- if .Values.topics -}} -{{- $scriptHash := include (print $.Template.BasePath "/configmap-config.yaml") . | sha256sum | trunc 8 -}} -apiVersion: batch/v1 -kind: Job -metadata: - name: "{{ template "kafka.fullname" . }}-config-{{ $scriptHash }}" - namespace: {{ .Release.Namespace }} - labels: - {{- include "kafka.config.labels" . | nindent 4 }} -spec: - backoffLimit: {{ .Values.configJob.backoffLimit }} - template: - metadata: - labels: - {{- include "kafka.config.matchLabels" . | nindent 8 }} - spec: - restartPolicy: OnFailure - volumes: - - name: config-volume - configMap: - name: {{ template "kafka.fullname" . }}-config - defaultMode: 0744 - containers: - - name: {{ template "kafka.fullname" . }}-config - image: "{{ .Values.image }}:{{ .Values.imageTag }}" - command: ["/usr/local/script/runtimeConfig.sh"] - volumeMounts: - - name: config-volume - mountPath: "/usr/local/script" -{{- end -}} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/podisruptionbudget.yaml b/rds/base/charts/jaeger/charts/kafka/templates/podisruptionbudget.yaml deleted file mode 100644 index 6406ea5..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/podisruptionbudget.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if .Values.podDisruptionBudget }} -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: {{ include "kafka.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "kafka.broker.labels" . | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "kafka.broker.matchLabels" . | nindent 6 }} -{{ toYaml .Values.podDisruptionBudget | indent 2 }} - -{{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/prometheusrules.yaml b/rds/base/charts/jaeger/charts/kafka/templates/prometheusrules.yaml deleted file mode 100644 index a119c18..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/prometheusrules.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{ if and .Values.prometheus.operator.enabled .Values.prometheus.operator.prometheusRule.enabled .Values.prometheus.operator.prometheusRule.rules }} -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ include "kafka.fullname" . }} - namespace: {{ include "serviceMonitor.namespace" . | default .Release.Namespace }} - labels: - {{- include "kafka.monitor.labels" . | nindent 4 }} - {{- toYaml .Values.prometheus.operator.prometheusRule.selector | nindent 4 }} -spec: - groups: - - name: {{ include "kafka.fullname" . }} - rules: - {{- toYaml .Values.prometheus.operator.prometheusRule.rules | nindent 6 }} -{{- end }} - diff --git a/rds/base/charts/jaeger/charts/kafka/templates/service-brokers-external.yaml b/rds/base/charts/jaeger/charts/kafka/templates/service-brokers-external.yaml deleted file mode 100644 index 3991e57..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/service-brokers-external.yaml +++ /dev/null @@ -1,78 +0,0 @@ -{{- if .Values.external.enabled }} - {{- $fullName := include "kafka.fullname" . }} - {{- $replicas := .Values.replicas | int }} - {{- $servicePort := .Values.external.servicePort }} - {{- $firstListenerPort := .Values.external.firstListenerPort }} - {{- $dnsPrefix := printf "%s" .Release.Name }} - {{- $root := . }} - {{- range $i, $e := until $replicas }} - {{- $externalListenerPort := add $root.Values.external.firstListenerPort $i }} - {{- $responsiblePod := printf "%s-%d" (printf "%s" $fullName) $i }} - {{- $distinctPrefix := printf "%s-%d" $dnsPrefix $i }} - {{- $loadBalancerIPLen := len $root.Values.external.loadBalancerIP }} - ---- -apiVersion: v1 -kind: Service -metadata: - annotations: - {{- if $root.Values.external.distinct }} - {{- if $root.Values.external.dns.useInternal }} - dns.alpha.kubernetes.io/internal: "{{ $distinctPrefix }}.{{ $root.Values.external.domain }}" - {{- end }} - {{- if $root.Values.external.dns.useExternal }} - external-dns.alpha.kubernetes.io/hostname: "{{ $distinctPrefix }}.{{ $root.Values.external.domain }}" - {{- end }} - {{- else }} - {{- if $root.Values.external.dns.useInternal }} - dns.alpha.kubernetes.io/internal: "{{ $dnsPrefix }}.{{ $root.Values.external.domain }}" - {{- end }} - {{- if $root.Values.external.dns.useExternal }} - external-dns.alpha.kubernetes.io/hostname: "{{ $dnsPrefix }}.{{ $root.Values.external.domain }}" - {{- end }} - {{- end }} - {{- if $root.Values.external.annotations }} -{{ toYaml $root.Values.external.annotations | indent 4 }} - {{- end }} - name: {{ $root.Release.Name }}-{{ $i }}-external - namespace: {{ .Release.Namespace }} - labels: - {{- include "kafka.broker.labels" $root | nindent 4 }} - pod: {{ $responsiblePod | quote }} - {{- if $root.Values.external.labels }} -{{ toYaml $root.Values.external.labels | indent 4 }} - {{- end }} -spec: - type: {{ $root.Values.external.type }} - ports: - - name: external-broker - {{- if and (eq $root.Values.external.type "LoadBalancer") (not $root.Values.external.distinct) }} - port: {{ $firstListenerPort }} - {{- else }} - port: {{ $servicePort }} - {{- end }} - {{- if and (eq $root.Values.external.type "LoadBalancer") ($root.Values.external.distinct) }} - targetPort: {{ $servicePort }} - {{- else if and (eq $root.Values.external.type "LoadBalancer") (not $root.Values.external.distinct) }} - targetPort: {{ $firstListenerPort }} - {{- else }} - targetPort: {{ $externalListenerPort }} - {{- end }} - {{- if eq $root.Values.external.type "NodePort" }} - nodePort: {{ $externalListenerPort }} - {{- end }} - protocol: TCP - {{- if and (eq $root.Values.external.type "LoadBalancer") (eq $loadBalancerIPLen $replicas) }} - loadBalancerIP: {{ index $root.Values.external.loadBalancerIP $i }} - {{- end }} - {{- if $root.Values.external.loadBalancerSourceRanges }} - loadBalancerSourceRanges: - {{- range $root.Values.external.loadBalancerSourceRanges }} - - {{ . | quote}} - {{- end }} - {{- end }} - selector: - {{- include "kafka.broker.matchLabels" $root | nindent 4 }} - statefulset.kubernetes.io/pod-name: {{ $responsiblePod | quote }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/service-brokers.yaml b/rds/base/charts/jaeger/charts/kafka/templates/service-brokers.yaml deleted file mode 100644 index 6f64024..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/service-brokers.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "kafka.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "kafka.broker.labels" . | nindent 4 }} -spec: - ports: - - name: broker - port: 9092 - targetPort: kafka -{{- if and .Values.prometheus.jmx.enabled .Values.prometheus.operator.enabled }} - - name: jmx-exporter - protocol: TCP - port: {{ .Values.jmx.port }} - targetPort: prometheus -{{- end }} - selector: - {{- include "kafka.broker.matchLabels" . | nindent 4 }} ---- -{{- if and .Values.prometheus.kafka.enabled .Values.prometheus.operator.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ include "kafka.fullname" . }}-exporter - labels: - {{- include "kafka.monitor.labels" . | nindent 4 }} -spec: - ports: - - name: kafka-exporter - protocol: TCP - port: {{ .Values.prometheus.kafka.port }} - targetPort: {{ .Values.prometheus.kafka.port }} - selector: - {{- include "kafka.monitor.matchLabels" . | nindent 4 }} -{{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/service-headless.yaml b/rds/base/charts/jaeger/charts/kafka/templates/service-headless.yaml deleted file mode 100644 index 4a6b99e..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/service-headless.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "kafka.fullname" . }}-headless - namespace: {{ .Release.Namespace }} - labels: - {{- include "kafka.broker.labels" . | nindent 4 }} - annotations: - service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" -{{- if .Values.headless.annotations }} -{{ .Values.headless.annotations | toYaml | trimSuffix "\n" | indent 4 }} -{{- end }} -spec: - ports: - - name: broker - port: {{ .Values.headless.port }} -{{- if .Values.headless.targetPort }} - targetPort: {{ .Values.headless.targetPort }} -{{- end }} - clusterIP: None - selector: - {{- include "kafka.broker.matchLabels" . | nindent 4 }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/servicemonitors.yaml b/rds/base/charts/jaeger/charts/kafka/templates/servicemonitors.yaml deleted file mode 100644 index 4d63960..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/servicemonitors.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{ if and .Values.prometheus.jmx.enabled .Values.prometheus.operator.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "kafka.fullname" . }} - namespace: {{ include "serviceMonitor.namespace" . | default .Release.Namespace }} - labels: - {{- include "kafka.monitor.labels" . | nindent 4 }} - {{- toYaml .Values.prometheus.operator.serviceMonitor.selector | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "kafka.broker.matchLabels" . | nindent 6 }} - endpoints: - - port: jmx-exporter - interval: {{ .Values.prometheus.jmx.interval }} - {{- if .Values.prometheus.jmx.scrapeTimeout }} - scrapeTimeout: {{ .Values.prometheus.jmx.scrapeTimeout }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} -{{ end }} ---- -{{ if and .Values.prometheus.kafka.enabled .Values.prometheus.operator.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "kafka.fullname" . }}-exporter - namespace: {{ include "serviceMonitor.namespace" . }} - labels: - {{- include "kafka.monitor.labels" . | nindent 4 }} - {{ toYaml .Values.prometheus.operator.serviceMonitor.selector | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "kafka.monitor.matchLabels" . | nindent 6 }} - endpoints: - - port: kafka-exporter - interval: {{ .Values.prometheus.kafka.interval }} - {{- if .Values.prometheus.kafka.scrapeTimeout }} - scrapeTimeout: {{ .Values.prometheus.kafka.scrapeTimeout }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} -{{ end }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/statefulset.yaml b/rds/base/charts/jaeger/charts/kafka/templates/statefulset.yaml deleted file mode 100644 index de3a284..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/statefulset.yaml +++ /dev/null @@ -1,273 +0,0 @@ -{{- $advertisedListenersOverride := first (pluck "advertised.listeners" .Values.configurationOverrides) }} -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ include "kafka.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "kafka.broker.labels" . | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "kafka.broker.matchLabels" . | nindent 6 }} - serviceName: {{ include "kafka.fullname" . }}-headless - podManagementPolicy: {{ .Values.podManagementPolicy }} - updateStrategy: -{{ toYaml .Values.updateStrategy | indent 4 }} - replicas: {{ default 3 .Values.replicas }} - template: - metadata: -{{- if or .Values.podAnnotations (and .Values.prometheus.jmx.enabled (not .Values.prometheus.operator.enabled)) }} - annotations: -{{- if and .Values.prometheus.jmx.enabled (not .Values.prometheus.operator.enabled) }} - prometheus.io/scrape: "true" - prometheus.io/port: {{ .Values.prometheus.jmx.port | quote }} -{{- end }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | indent 8 }} -{{- end }} -{{- end }} - labels: - {{- include "kafka.broker.labels" . | nindent 8 }} - {{- if .Values.podLabels }} - ## Custom pod labels -{{ toYaml .Values.podLabels | indent 8 }} - {{- end }} - spec: -{{- if .Values.schedulerName }} - schedulerName: "{{ .Values.schedulerName }}" -{{- end }} -{{- if .Values.serviceAccountName }} - serviceAccountName: {{ .Values.serviceAccountName }} -{{- end }} -{{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" -{{- end }} -{{- if .Values.tolerations }} - tolerations: -{{ toYaml .Values.tolerations | indent 8 }} -{{- end }} -{{- if .Values.affinity }} - affinity: -{{ toYaml .Values.affinity | indent 8 }} -{{- end }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} - containers: - {{- if .Values.prometheus.jmx.enabled }} - - name: metrics - image: "{{ .Values.prometheus.jmx.image }}:{{ .Values.prometheus.jmx.imageTag }}" - command: - - sh - - -exc - - | - trap "exit 0" TERM; \ - while :; do \ - java \ - -XX:+UnlockExperimentalVMOptions \ - -XX:+UseCGroupMemoryLimitForHeap \ - -XX:MaxRAMFraction=1 \ - -XshowSettings:vm \ - -jar \ - jmx_prometheus_httpserver.jar \ - {{ .Values.prometheus.jmx.port | quote }} \ - /etc/jmx-kafka/jmx-kafka-prometheus.yml & \ - wait $! || sleep 3; \ - done - ports: - - containerPort: {{ .Values.prometheus.jmx.port }} - name: prometheus - resources: -{{ toYaml .Values.prometheus.jmx.resources | indent 10 }} - volumeMounts: - - name: jmx-config - mountPath: /etc/jmx-kafka - {{- end }} - - name: {{ include "kafka.name" . }}-broker - image: "{{ .Values.image }}:{{ .Values.imageTag }}" - imagePullPolicy: "{{ .Values.imagePullPolicy }}" - livenessProbe: - exec: - command: - - sh - - -ec - - /usr/bin/jps | /bin/grep -q SupportedKafka - {{- if not .Values.livenessProbe }} - initialDelaySeconds: 30 - timeoutSeconds: 5 - {{- else }} - initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds | default 30}} - {{- if .Values.livenessProbe.periodSeconds }} - periodSeconds: {{ .Values.livenessProbe.periodSeconds }} - {{- end }} - timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds | default 5}} - {{- if .Values.livenessProbe.successThreshold }} - successThreshold: {{ .Values.livenessProbe.successThreshold }} - {{- end }} - {{- if .Values.livenessProbe.failureThreshold }} - failureThreshold: {{ .Values.livenessProbe.failureThreshold }} - {{- end }} - {{- end }} - readinessProbe: - tcpSocket: - port: kafka - initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.readinessProbe.failureThreshold }} - ports: - - containerPort: 9092 - name: kafka - {{- if .Values.external.enabled }} - {{- $replicas := .Values.replicas | int }} - {{- $root := . }} - {{- range $i, $e := until $replicas }} - - containerPort: {{ add $root.Values.external.firstListenerPort $i }} - name: external-{{ $i }} - {{- end }} - {{- end }} - {{- if .Values.prometheus.jmx.enabled }} - - containerPort: {{ .Values.jmx.port }} - name: jmx - {{- end }} - {{- if .Values.additionalPorts }} -{{ toYaml .Values.additionalPorts | indent 8 }} - {{- end }} - resources: -{{ toYaml .Values.resources | indent 10 }} - env: - {{- if .Values.prometheus.jmx.enabled }} - - name: JMX_PORT - value: "{{ .Values.jmx.port }}" - {{- end }} - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: KAFKA_HEAP_OPTS - value: {{ .Values.kafkaHeapOptions }} - - name: KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR - value: {{ include "kafka.replication.factor" . | quote }} - {{- if not (hasKey .Values.configurationOverrides "zookeeper.connect") }} - - name: KAFKA_ZOOKEEPER_CONNECT - value: {{ include "zookeeper.url" . | quote }} - {{- end }} - {{- if not (hasKey .Values.configurationOverrides "log.dirs") }} - - name: KAFKA_LOG_DIRS - value: {{ printf "%s/%s" .Values.persistence.mountPath .Values.logSubPath | quote }} - {{- end }} - {{- range $key, $value := .Values.configurationOverrides }} - - name: {{ printf "KAFKA_%s" $key | replace "." "_" | upper | quote }} - value: {{ $value | quote }} - {{- end }} - {{- if .Values.jmx.port }} - - name: KAFKA_JMX_PORT - value: "{{ .Values.jmx.port }}" - {{- end }} - {{- range $secret := .Values.secrets }} - {{- if not $secret.mountPath }} - {{- range $key := $secret.keys }} - - name: {{ (print ($secret.name | replace "-" "_") "_" $key) | upper }} - valueFrom: - secretKeyRef: - name: {{ $secret.name }} - key: {{ $key }} - {{- end }} - {{- end }} - {{- end }} - {{- range $key, $value := .Values.envOverrides }} - - name: {{ printf "%s" $key | replace "." "_" | upper | quote }} - value: {{ $value | quote }} - {{- end }} - # This is required because the Downward API does not yet support identification of - # pod numbering in statefulsets. Thus, we are required to specify a command which - # allows us to extract the pod ID for usage as the Kafka Broker ID. - # See: https://github.com/kubernetes/kubernetes/issues/31218 - command: - - sh - - -exc - - | - unset KAFKA_PORT && \ - export KAFKA_BROKER_ID=${POD_NAME##*-} && \ - {{- if eq .Values.external.type "LoadBalancer" }} - export LOAD_BALANCER_IP=$(echo '{{ .Values.external.loadBalancerIP }}' | tr -d '[]' | cut -d ' ' -f "$(($KAFKA_BROKER_ID + 1))") && \ - {{- end }} - {{- if eq .Values.external.type "NodePort" }} - export KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://${POD_IP}:9092{{ if kindIs "string" $advertisedListenersOverride }}{{ printf ",%s" $advertisedListenersOverride }}{{ end }} && \ - {{- else }} - export KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://${POD_NAME}.{{ include "kafka.fullname" . }}-headless.${POD_NAMESPACE}.svc.cluster.local:9092{{ if kindIs "string" $advertisedListenersOverride }}{{ printf ",%s" $advertisedListenersOverride }}{{ end }} && \ - {{- end }} - exec /etc/confluent/docker/run - volumeMounts: - - name: datadir - mountPath: {{ .Values.persistence.mountPath | quote }} - {{- range $secret := .Values.secrets }} - {{- if $secret.mountPath }} - {{- if $secret.keys }} - {{- range $key := $secret.keys }} - - name: {{ include "kafka.fullname" $ }}-{{ $secret.name }} - mountPath: {{ $secret.mountPath }}/{{ $key }} - subPath: {{ $key }} - readOnly: true - {{- end }} - {{- else }} - - name: {{ include "kafka.fullname" $ }}-{{ $secret.name }} - mountPath: {{ $secret.mountPath }} - readOnly: true - {{- end }} - {{- end }} - {{- end }} - volumes: - {{- if not .Values.persistence.enabled }} - - name: datadir - emptyDir: {} - {{- end }} - {{- if .Values.prometheus.jmx.enabled }} - - name: jmx-config - configMap: - {{- if .Values.jmx.configMap.overrideName }} - name: {{ .Values.jmx.configMap.overrideName }} - {{- else }} - name: {{ include "kafka.fullname" . }}-metrics - {{- end }} - {{- end }} - {{- if .Values.securityContext }} - securityContext: -{{ toYaml .Values.securityContext | indent 8 }} - {{- end }} - {{- range .Values.secrets }} - {{- if .mountPath }} - - name: {{ include "kafka.fullname" $ }}-{{ .name }} - secret: - secretName: {{ .name }} - {{- end }} - {{- end }} - terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} - {{- if .Values.persistence.enabled }} - volumeClaimTemplates: - - metadata: - name: datadir - spec: - accessModes: [ "ReadWriteOnce" ] - resources: - requests: - storage: {{ .Values.persistence.size }} - {{- if .Values.persistence.storageClass }} - {{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" - {{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" - {{- end }} - {{- end }} - {{- end }} diff --git a/rds/base/charts/jaeger/charts/kafka/templates/tests/test_topic_create_consume_produce.yaml b/rds/base/charts/jaeger/charts/kafka/templates/tests/test_topic_create_consume_produce.yaml deleted file mode 100644 index e7dd5c9..0000000 --- a/rds/base/charts/jaeger/charts/kafka/templates/tests/test_topic_create_consume_produce.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.testsEnabled -}} -apiVersion: v1 -kind: Pod -metadata: - name: "{{ .Release.Name }}-test-topic-create-consume-produce" - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: {{ .Release.Name }}-test-consume - image: {{ .Values.image }}:{{ .Values.imageTag }} - command: - - sh - - -c - - | - # Create the topic - kafka-topics --zookeeper {{ include "zookeeper.url" . }} --topic helm-test-topic-create-consume-produce --create --partitions 1 --replication-factor 1 --if-not-exists && \ - # Create a message - MESSAGE="`date -u`" && \ - # Produce a test message to the topic - echo "$MESSAGE" | kafka-console-producer --broker-list {{ include "kafka.fullname" . }}:9092 --topic helm-test-topic-create-consume-produce && \ - # Consume a test message from the topic - kafka-console-consumer --bootstrap-server {{ include "kafka.fullname" . }}-headless:9092 --topic helm-test-topic-create-consume-produce --from-beginning --timeout-ms 2000 --max-messages 1 | grep "$MESSAGE" - restartPolicy: Never -{{- end }} \ No newline at end of file diff --git a/rds/base/charts/jaeger/charts/kafka/values.yaml b/rds/base/charts/jaeger/charts/kafka/values.yaml deleted file mode 100644 index c9e608c..0000000 --- a/rds/base/charts/jaeger/charts/kafka/values.yaml +++ /dev/null @@ -1,511 +0,0 @@ -# ------------------------------------------------------------------------------ -# Kafka: -# ------------------------------------------------------------------------------ - -## The StatefulSet installs 3 pods by default -replicas: 3 - -## The kafka image repository -image: "confluentinc/cp-kafka" - -## The kafka image tag -imageTag: "5.0.1" # Confluent image for Kafka 2.0.0 - -## Specify a imagePullPolicy -## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images -imagePullPolicy: "IfNotPresent" - -## Configure resource requests and limits -## ref: http://kubernetes.io/docs/user-guide/compute-resources/ -resources: {} - # limits: - # cpu: 200m - # memory: 1536Mi - # requests: - # cpu: 100m - # memory: 1024Mi -kafkaHeapOptions: "-Xmx1G -Xms1G" - -## Optional Container Security context -securityContext: {} - -## The StatefulSet Update Strategy which Kafka will use when changes are applied. -## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies -updateStrategy: - type: "OnDelete" - -## Start and stop pods in Parallel or OrderedReady (one-by-one.) Note - Can not change after first release. -## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy -podManagementPolicy: OrderedReady - -## Useful if using any custom authorizer -## Pass in some secrets to use (if required) -# secrets: -# - name: myKafkaSecret -# keys: -# - username -# - password -# # mountPath: /opt/kafka/secret -# - name: myZkSecret -# keys: -# - user -# - pass -# mountPath: /opt/zookeeper/secret - - -## The subpath within the Kafka container's PV where logs will be stored. -## This is combined with `persistence.mountPath`, to create, by default: /opt/kafka/data/logs -logSubPath: "logs" - -## Use an alternate scheduler, e.g. "stork". -## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ -## -# schedulerName: - -## Use an alternate serviceAccount -## Useful when using images in custom repositories -# serviceAccountName: - -## Set a pod priorityClassName -# priorityClassName: high-priority - -## Pod scheduling preferences (by default keep pods within a release on separate nodes). -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity -## By default we don't set affinity -affinity: {} -## Alternatively, this typical example defines: -## antiAffinity (to keep Kafka pods on separate pods) -## and affinity (to encourage Kafka pods to be collocated with Zookeeper pods) -# affinity: -# podAntiAffinity: -# requiredDuringSchedulingIgnoredDuringExecution: -# - labelSelector: -# matchExpressions: -# - key: app -# operator: In -# values: -# - kafka -# topologyKey: "kubernetes.io/hostname" -# podAffinity: -# preferredDuringSchedulingIgnoredDuringExecution: -# - weight: 50 -# podAffinityTerm: -# labelSelector: -# matchExpressions: -# - key: app -# operator: In -# values: -# - zookeeper -# topologyKey: "kubernetes.io/hostname" - -## Node labels for pod assignment -## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector -nodeSelector: {} - -## Readiness probe config. -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ -## -readinessProbe: - initialDelaySeconds: 30 - periodSeconds: 10 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 3 - -## Period to wait for broker graceful shutdown (sigterm) before pod is killed (sigkill) -## ref: https://kubernetes-v1-4.github.io/docs/user-guide/production-pods/#lifecycle-hooks-and-termination-notice -## ref: https://kafka.apache.org/10/documentation.html#brokerconfigs controlled.shutdown.* -terminationGracePeriodSeconds: 60 - -# Tolerations for nodes that have taints on them. -# Useful if you want to dedicate nodes to just run kafka -# https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ -tolerations: [] -# tolerations: -# - key: "key" -# operator: "Equal" -# value: "value" -# effect: "NoSchedule" - -## Headless service. -## -headless: - # annotations: - # targetPort: - port: 9092 - -## External access. -## -external: - enabled: false - # type can be either NodePort or LoadBalancer - type: NodePort - # annotations: - # service.beta.kubernetes.io/openstack-internal-load-balancer: "true" - # Labels to be added to external services - # labels: - # aLabel: "value" - dns: - useInternal: false - useExternal: true - # If using external service type LoadBalancer and external dns, set distinct to true below. - # This creates an A record for each statefulset pod/broker. You should then map the - # A record of the broker to the EXTERNAL IP given by the LoadBalancer in your DNS server. - distinct: false - servicePort: 19092 - firstListenerPort: 31090 - domain: cluster.local - loadBalancerIP: [] - loadBalancerSourceRanges: [] - init: - image: "lwolf/kubectl_deployer" - imageTag: "0.4" - imagePullPolicy: "IfNotPresent" - -# Annotation to be added to Kafka pods -podAnnotations: {} - -# Labels to be added to Kafka pods -podLabels: {} - # service: broker - # team: developers - -podDisruptionBudget: {} - # maxUnavailable: 1 # Limits how many Kafka pods may be unavailable due to voluntary disruptions. - -## Configuration Overrides. Specify any Kafka settings you would like set on the StatefulSet -## here in map format, as defined in the official docs. -## ref: https://kafka.apache.org/documentation/#brokerconfigs -## -configurationOverrides: - "confluent.support.metrics.enable": false # Disables confluent metric submission - # "auto.leader.rebalance.enable": true - # "auto.create.topics.enable": true - # "controlled.shutdown.enable": true - # "controlled.shutdown.max.retries": 100 - - ## Options required for external access via NodePort - ## ref: - ## - http://kafka.apache.org/documentation/#security_configbroker - ## - https://cwiki.apache.org/confluence/display/KAFKA/KIP-103%3A+Separation+of+Internal+and+External+traffic - ## - ## Setting "advertised.listeners" here appends to "PLAINTEXT://${POD_IP}:9092,", ensure you update the domain - ## If external service type is Nodeport: - # "advertised.listeners": |- - # EXTERNAL://kafka.cluster.local:$((31090 + ${KAFKA_BROKER_ID})) - ## If external service type is LoadBalancer and distinct is true: - # "advertised.listeners": |- - # EXTERNAL://kafka-$((${KAFKA_BROKER_ID})).cluster.local:19092 - ## If external service type is LoadBalancer and distinct is false: - # "advertised.listeners": |- - # EXTERNAL://${LOAD_BALANCER_IP}:31090 - ## Uncomment to define the EXTERNAL Listener protocol - # "listener.security.protocol.map": |- - # PLAINTEXT:PLAINTEXT,EXTERNAL:PLAINTEXT - -## set extra ENVs -# key: "value" -envOverrides: {} - - -## A collection of additional ports to expose on brokers (formatted as normal containerPort yaml) -# Useful when the image exposes metrics (like prometheus, etc.) through a javaagent instead of a sidecar -additionalPorts: {} - -## Persistence configuration. Specify if and how to persist data to a persistent volume. -## -persistence: - enabled: true - - ## The size of the PersistentVolume to allocate to each Kafka Pod in the StatefulSet. For - ## production servers this number should likely be much larger. - ## - size: "1Gi" - - ## The location within the Kafka container where the PV will mount its storage and Kafka will - ## store its logs. - ## - mountPath: "/opt/kafka/data" - - ## Kafka data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClass: - -jmx: - ## Rules to apply to the Prometheus JMX Exporter. Note while lots of stats have been cleaned and exposed, - ## there are still more stats to clean up and expose, others will never get exposed. They keep lots of duplicates - ## that can be derived easily. The configMap in this chart cleans up the metrics it exposes to be in a Prometheus - ## format, eg topic, broker are labels and not part of metric name. Improvements are gladly accepted and encouraged. - configMap: - - ## Allows disabling the default configmap, note a configMap is needed - enabled: true - - ## Allows setting values to generate confimap - ## To allow all metrics through (warning its crazy excessive) comment out below `overrideConfig` and set - ## `whitelistObjectNames: []` - overrideConfig: {} - # jmxUrl: service:jmx:rmi:///jndi/rmi://127.0.0.1:5555/jmxrmi - # lowercaseOutputName: true - # lowercaseOutputLabelNames: true - # ssl: false - # rules: - # - pattern: ".*" - - ## If you would like to supply your own ConfigMap for JMX metrics, supply the name of that - ## ConfigMap as an `overrideName` here. - overrideName: "" - - ## Port the jmx metrics are exposed in native jmx format, not in Prometheus format - port: 5555 - - ## JMX Whitelist Objects, can be set to control which JMX metrics are exposed. Only whitelisted - ## values will be exposed via JMX Exporter. They must also be exposed via Rules. To expose all metrics - ## (warning its crazy excessive and they aren't formatted in a prometheus style) (1) `whitelistObjectNames: []` - ## (2) commented out above `overrideConfig`. - whitelistObjectNames: # [] - - kafka.controller:* - - kafka.server:* - - java.lang:* - - kafka.network:* - - kafka.log:* - -## Prometheus Exporters / Metrics -## -prometheus: - ## Prometheus JMX Exporter: exposes the majority of Kafkas metrics - jmx: - enabled: false - - ## The image to use for the metrics collector - image: solsson/kafka-prometheus-jmx-exporter@sha256 - - ## The image tag to use for the metrics collector - imageTag: a23062396cd5af1acdf76512632c20ea6be76885dfc20cd9ff40fb23846557e8 - - ## Interval at which Prometheus scrapes metrics, note: only used by Prometheus Operator - interval: 10s - - ## Timeout at which Prometheus timeouts scrape run, note: only used by Prometheus Operator - scrapeTimeout: 10s - - ## Port jmx-exporter exposes Prometheus format metrics to scrape - port: 5556 - - resources: {} - # limits: - # cpu: 200m - # memory: 1Gi - # requests: - # cpu: 100m - # memory: 100Mi - - ## Prometheus Kafka Exporter: exposes complimentary metrics to JMX Exporter - kafka: - enabled: false - - ## The image to use for the metrics collector - image: danielqsj/kafka-exporter - - ## The image tag to use for the metrics collector - imageTag: v1.2.0 - - ## Interval at which Prometheus scrapes metrics, note: only used by Prometheus Operator - interval: 10s - - ## Timeout at which Prometheus timeouts scrape run, note: only used by Prometheus Operator - scrapeTimeout: 10s - - ## Port kafka-exporter exposes for Prometheus to scrape metrics - port: 9308 - - ## Resource limits - resources: {} -# limits: -# cpu: 200m -# memory: 1Gi -# requests: -# cpu: 100m -# memory: 100Mi - - # Tolerations for nodes that have taints on them. - # Useful if you want to dedicate nodes to just run kafka-exporter - # https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - tolerations: [] - # tolerations: - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - - ## Pod scheduling preferences (by default keep pods within a release on separate nodes). - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## By default we don't set affinity - affinity: {} - ## Alternatively, this typical example defines: - ## affinity (to encourage Kafka Exporter pods to be collocated with Kafka pods) - # affinity: - # podAffinity: - # preferredDuringSchedulingIgnoredDuringExecution: - # - weight: 50 - # podAffinityTerm: - # labelSelector: - # matchExpressions: - # - key: app - # operator: In - # values: - # - kafka - # topologyKey: "kubernetes.io/hostname" - - ## Node labels for pod assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector - nodeSelector: {} - - operator: - ## Are you using Prometheus Operator? - enabled: false - - serviceMonitor: - # Namespace in which to install the ServiceMonitor resource. - namespace: monitoring - # Use release namespace instead - releaseNamespace: false - - ## Defaults to whats used if you follow CoreOS [Prometheus Install Instructions](https://github.com/coreos/prometheus-operator/tree/master/helm#tldr) - ## [Prometheus Selector Label](https://github.com/coreos/prometheus-operator/blob/master/helm/prometheus/templates/prometheus.yaml#L65) - ## [Kube Prometheus Selector Label](https://github.com/coreos/prometheus-operator/blob/master/helm/kube-prometheus/values.yaml#L298) - selector: - prometheus: kube-prometheus - - prometheusRule: - ## Add Prometheus Rules? - enabled: false - - ## Namespace in which to install the PrometheusRule resource. - namespace: monitoring - # Use release namespace instead - releaseNamespace: false - - ## Defaults to whats used if you follow CoreOS [Prometheus Install Instructions](https://github.com/coreos/prometheus-operator/tree/master/helm#tldr) - ## [Prometheus Selector Label](https://github.com/coreos/prometheus-operator/blob/master/helm/prometheus/templates/prometheus.yaml#L65) - ## [Kube Prometheus Selector Label](https://github.com/coreos/prometheus-operator/blob/master/helm/kube-prometheus/values.yaml#L298) - selector: - prometheus: kube-prometheus - - ## Some example rules. - ## e.g. max(kafka_controller_kafkacontroller_activecontrollercount_value{service="my-kafka-release"}) by (service) < 1 - rules: - - alert: KafkaNoActiveControllers - annotations: - message: The number of active controllers in {{ "{{" }} $labels.namespace {{ "}}" }} is less than 1. This usually means that some of the Kafka nodes aren't communicating properly. If it doesn't resolve itself you can try killing the pods (one by one whilst monitoring the under-replicated partitions graph). - expr: max(kafka_controller_kafkacontroller_activecontrollercount_value) by (namespace) < 1 - for: 5m - labels: - severity: critical - - alert: KafkaMultipleActiveControllers - annotations: - message: The number of active controllers in {{ "{{" }} $labels.namespace {{ "}}" }} is greater than 1. This usually means that some of the Kafka nodes aren't communicating properly. If it doesn't resolve itself you can try killing the pods (one by one whilst monitoring the under-replicated partitions graph). - expr: max(kafka_controller_kafkacontroller_activecontrollercount_value) by (namespace) > 1 - for: 5m - labels: - severity: critical - -## Kafka Config job configuration -## -configJob: - ## Specify the number of retries before considering kafka-config job as failed. - ## https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/#pod-backoff-failure-policy - backoffLimit: 6 - -## Topic creation and configuration. -## The job will be run on a deployment only when the config has been changed. -## - If 'partitions' and 'replicationFactor' are specified we create the topic (with --if-not-exists.) -## - If 'partitions', 'replicationFactor' and 'reassignPartitions' are specified we reassign the partitions to -## increase the replication factor of an existing topic. -## - If 'partitions' is specified we 'alter' the number of partitions. This will -## silently and safely fail if the new setting isn’t strictly larger than the old (i.e. a NOOP.) Do be aware of the -## implications for keyed topics (ref: https://docs.confluent.io/current/kafka/post-deployment.html#admin-operations) -## - If 'defaultConfig' is specified it's deleted from the topic configuration. If it isn't present, -## it will silently and safely fail. -## - If 'config' is specified it's added to the topic configuration. -## -## Note: To increase the 'replicationFactor' of a topic, 'reassignPartitions' must be set to true (see above). -## -topics: [] - # - name: myExistingTopicConfig - # config: "cleanup.policy=compact,delete.retention.ms=604800000" - # - name: myExistingTopicReassignPartitions - # partitions: 8 - # replicationFactor: 5 - # reassignPartitions: true - # - name: myExistingTopicPartitions - # partitions: 8 - # - name: myNewTopicWithConfig - # partitions: 8 - # replicationFactor: 3 - # defaultConfig: "segment.bytes,segment.ms" - # config: "cleanup.policy=compact,delete.retention.ms=604800000" - # - name: myAclTopicPartitions - # partitions: 8 - # acls: - # - user: read - # operations: [ Read ] - # - user: read_and_write - # operations: - # - Read - # - Write - # - user: all - # operations: [ All ] - -## Enable/disable the chart's tests. Useful if using this chart as a dependency of -## another chart and you don't want these tests running when trying to develop and -## test your own chart. -testsEnabled: true - -# ------------------------------------------------------------------------------ -# Zookeeper: -# ------------------------------------------------------------------------------ - -zookeeper: - ## If true, install the Zookeeper chart alongside Kafka - ## ref: https://github.com/kubernetes/charts/tree/master/incubator/zookeeper - enabled: true - - ## Configure Zookeeper resource requests and limits - ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ - resources: ~ - - ## Environmental variables to set in Zookeeper - env: - ## The JVM heap size to allocate to Zookeeper - ZK_HEAP_SIZE: "1G" - - persistence: - enabled: false - ## The amount of PV storage allocated to each Zookeeper pod in the statefulset - # size: "2Gi" - - ## Specify a Zookeeper imagePullPolicy - ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images - image: - PullPolicy: "IfNotPresent" - - ## If the Zookeeper Chart is disabled a URL and port are required to connect - url: "" - port: 2181 - - ## Pod scheduling preferences (by default keep pods within a release on separate nodes). - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## By default we don't set affinity: - affinity: {} # Criteria by which pod label-values influence scheduling for zookeeper pods. - # podAntiAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # - topologyKey: "kubernetes.io/hostname" - # labelSelector: - # matchLabels: - # release: zookeeper diff --git a/rds/base/charts/jaeger/requirements.lock b/rds/base/charts/jaeger/requirements.lock deleted file mode 100644 index 3df5f5b..0000000 --- a/rds/base/charts/jaeger/requirements.lock +++ /dev/null @@ -1,12 +0,0 @@ -dependencies: -- name: cassandra - repository: file://charts/cassandra - version: 0.15.2 -- name: elasticsearch - repository: file://charts/elasticsearch - version: 7.8.1 -- name: kafka - repository: file://charts/kafka - version: 0.20.6 -digest: sha256:c83f2652150b6feb9e1637810bcb9ac271917958b7776792f28d3eb210eb7c2b -generated: "2022-08-18T15:36:39.919682019+02:00" diff --git a/rds/base/charts/jaeger/requirements.yaml b/rds/base/charts/jaeger/requirements.yaml deleted file mode 100644 index c6bdaaa..0000000 --- a/rds/base/charts/jaeger/requirements.yaml +++ /dev/null @@ -1,14 +0,0 @@ -dependencies: - - name: cassandra - version: ^0.15.0 - repository: file://charts/cassandra - condition: provisionDataStore.cassandra - - name: elasticsearch - version: ^7.5.1 - repository: file://charts/elasticsearch - condition: provisionDataStore.elasticsearch - - name: kafka - version: ^0.20.6 - repository: file://charts/kafka - condition: provisionDataStore.kafka -version: 0.34.0 diff --git a/rds/base/charts/jaeger/templates/NOTES.txt b/rds/base/charts/jaeger/templates/NOTES.txt deleted file mode 100644 index f9664d2..0000000 --- a/rds/base/charts/jaeger/templates/NOTES.txt +++ /dev/null @@ -1,27 +0,0 @@ - -################################################################### -### IMPORTANT: The use of .env: {...} is deprecated. ### -### Please use .extraEnv: [] instead. ### -################################################################### - -You can log into the Jaeger Query UI here: - -{{- if contains "NodePort" .Values.query.service.type }} - - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "jaeger.fullname" . }}-query) - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo http://$NODE_IP:$NODE_PORT/ - -{{- else if contains "LoadBalancer" .Values.query.service.type }} - - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "jaeger.fullname" . }}-query' - - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "jaeger.fullname" . }}-query -o jsonpath='{.status.loadBalancer.ingress[0].ip}') - echo http://$SERVICE_IP/ -{{- else if contains "ClusterIP" .Values.query.service.type }} - - export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=query" -o jsonpath="{.items[0].metadata.name}") - echo http://127.0.0.1:8080/ - kubectl port-forward --namespace {{ .Release.Namespace }} $POD_NAME 8080:16686 -{{- end }} diff --git a/rds/base/charts/jaeger/templates/_helpers.tpl b/rds/base/charts/jaeger/templates/_helpers.tpl deleted file mode 100644 index 96cba36..0000000 --- a/rds/base/charts/jaeger/templates/_helpers.tpl +++ /dev/null @@ -1,370 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "jaeger.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "jaeger.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "jaeger.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "jaeger.labels" -}} -helm.sh/chart: {{ include "jaeger.chart" . }} -{{ include "jaeger.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Selector labels -*/}} -{{- define "jaeger.selectorLabels" -}} -app.kubernetes.io/name: {{ include "jaeger.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} - -{{/* -Create the name of the cassandra schema service account to use -*/}} -{{- define "jaeger.cassandraSchema.serviceAccountName" -}} -{{- if .Values.schema.serviceAccount.create -}} - {{ default (printf "%s-cassandra-schema" (include "jaeger.fullname" .)) .Values.schema.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.schema.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the spark service account to use -*/}} -{{- define "jaeger.spark.serviceAccountName" -}} -{{- if .Values.spark.serviceAccount.create -}} - {{ default (printf "%s-spark" (include "jaeger.fullname" .)) .Values.spark.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.spark.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the esIndexCleaner service account to use -*/}} -{{- define "jaeger.esIndexCleaner.serviceAccountName" -}} -{{- if .Values.esIndexCleaner.serviceAccount.create -}} - {{ default (printf "%s-es-index-cleaner" (include "jaeger.fullname" .)) .Values.esIndexCleaner.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.esIndexCleaner.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the hotrod service account to use -*/}} -{{- define "jaeger.hotrod.serviceAccountName" -}} -{{- if .Values.hotrod.serviceAccount.create -}} - {{ default (printf "%s-hotrod" (include "jaeger.fullname" .)) .Values.hotrod.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.hotrod.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the query service account to use -*/}} -{{- define "jaeger.query.serviceAccountName" -}} -{{- if .Values.query.serviceAccount.create -}} - {{ default (include "jaeger.query.name" .) .Values.query.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.query.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the agent service account to use -*/}} -{{- define "jaeger.agent.serviceAccountName" -}} -{{- if .Values.agent.serviceAccount.create -}} - {{ default (include "jaeger.agent.name" .) .Values.agent.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.agent.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the collector service account to use -*/}} -{{- define "jaeger.collector.serviceAccountName" -}} -{{- if .Values.collector.serviceAccount.create -}} - {{ default (include "jaeger.collector.name" .) .Values.collector.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.collector.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create the name of the ingester service account to use -*/}} -{{- define "jaeger.ingester.serviceAccountName" -}} -{{- if .Values.ingester.serviceAccount.create -}} - {{ default (include "jaeger.ingester.name" .) .Values.ingester.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.ingester.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create a fully qualified query name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "jaeger.query.name" -}} -{{- $nameGlobalOverride := printf "%s-query" (include "jaeger.fullname" .) -}} -{{- if .Values.query.fullnameOverride -}} -{{- printf "%s" .Values.query.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s" $nameGlobalOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} - -{{/* -Create a fully qualified agent name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "jaeger.agent.name" -}} -{{- $nameGlobalOverride := printf "%s-agent" (include "jaeger.fullname" .) -}} -{{- if .Values.agent.fullnameOverride -}} -{{- printf "%s" .Values.agent.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s" $nameGlobalOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} - -{{/* -Create a fully qualified collector name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "jaeger.collector.name" -}} -{{- $nameGlobalOverride := printf "%s-collector" (include "jaeger.fullname" .) -}} -{{- if .Values.collector.fullnameOverride -}} -{{- printf "%s" .Values.collector.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s" $nameGlobalOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} - -{{/* -Create a fully qualified ingester name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "jaeger.ingester.name" -}} -{{- $nameGlobalOverride := printf "%s-ingester" (include "jaeger.fullname" .) -}} -{{- if .Values.ingester.fullnameOverride -}} -{{- printf "%s" .Values.ingester.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s" $nameGlobalOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} - -{{- define "cassandra.host" -}} -{{- if .Values.provisionDataStore.cassandra -}} -{{- if .Values.storage.cassandra.nameOverride }} -{{- printf "%s" .Values.storage.cassandra.nameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name "cassandra" | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- else }} -{{- .Values.storage.cassandra.host }} -{{- end -}} -{{- end -}} - -{{- define "cassandra.contact_points" -}} -{{- $port := .Values.storage.cassandra.port | toString }} -{{- if .Values.provisionDataStore.cassandra -}} -{{- if .Values.storage.cassandra.nameOverride }} -{{- $host := printf "%s" .Values.storage.cassandra.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- printf "%s:%s" $host $port }} -{{- else }} -{{- $host := printf "%s-%s" .Release.Name "cassandra" | trunc 63 | trimSuffix "-" -}} -{{- printf "%s:%s" $host $port }} -{{- end -}} -{{- else }} -{{- printf "%s:%s" .Values.storage.cassandra.host $port }} -{{- end -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "elasticsearch.client.url" -}} -{{- $port := .Values.storage.elasticsearch.port | toString -}} -{{- printf "%s://%s:%s" .Values.storage.elasticsearch.scheme .Values.storage.elasticsearch.host $port }} -{{- end -}} - -{{- define "jaeger.hotrod.tracing.host" -}} -{{- default (include "jaeger.agent.name" .) .Values.hotrod.tracing.host -}} -{{- end -}} - - -{{/* -Configure list of IP CIDRs allowed access to load balancer (if supported) -*/}} -{{- define "loadBalancerSourceRanges" -}} -{{- if .service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: - {{- range $cidr := .service.loadBalancerSourceRanges }} - - {{ $cidr }} - {{- end }} -{{- end }} -{{- end -}} - -{{- define "helm-toolkit.utils.joinListWithComma" -}} -{{- $local := dict "first" true -}} -{{- range $k, $v := . -}}{{- if not $local.first -}},{{- end -}}{{- $v -}}{{- $_ := set $local "first" false -}}{{- end -}} -{{- end -}} - - -{{/* -Cassandra related environment variables -*/}} -{{- define "cassandra.env" -}} -- name: CASSANDRA_SERVERS - value: {{ include "cassandra.host" . }} -- name: CASSANDRA_PORT - value: {{ .Values.storage.cassandra.port | quote }} -{{ if .Values.storage.cassandra.tls.enabled }} -- name: CASSANDRA_TLS_ENABLED - value: "true" -- name: CASSANDRA_TLS_SERVER_NAME - valueFrom: - secretKeyRef: - name: {{ .Values.storage.cassandra.tls.secretName }} - key: commonName -- name: CASSANDRA_TLS_KEY - value: "/cassandra-tls/client-key.pem" -- name: CASSANDRA_TLS_CERT - value: "/cassandra-tls/client-cert.pem" -- name: CASSANDRA_TLS_CA - value: "/cassandra-tls/ca-cert.pem" -{{- end }} -{{- if .Values.storage.cassandra.keyspace }} -- name: CASSANDRA_KEYSPACE - value: {{ .Values.storage.cassandra.keyspace }} -{{- end }} -- name: CASSANDRA_USERNAME - value: {{ .Values.storage.cassandra.user }} -- name: CASSANDRA_PASSWORD - valueFrom: - secretKeyRef: - name: {{ if .Values.storage.cassandra.existingSecret }}{{ .Values.storage.cassandra.existingSecret }}{{- else }}{{ include "jaeger.fullname" . }}-cassandra{{- end }} - key: password -{{- range $key, $value := .Values.storage.cassandra.env }} -- name: {{ $key | quote }} - value: {{ $value | quote }} -{{ end -}} -{{- if .Values.storage.cassandra.extraEnv }} -{{ toYaml .Values.storage.cassandra.extraEnv }} -{{- end }} -{{- end -}} - -{{/* -Elasticsearch related environment variables -*/}} -{{- define "elasticsearch.env" -}} -- name: ES_SERVER_URLS - value: {{ include "elasticsearch.client.url" . }} -- name: ES_USERNAME - value: {{ .Values.storage.elasticsearch.user }} -{{- if .Values.storage.elasticsearch.usePassword }} -- name: ES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ if .Values.storage.elasticsearch.existingSecret }}{{ .Values.storage.elasticsearch.existingSecret }}{{- else }}{{ include "jaeger.fullname" . }}-elasticsearch{{- end }} - key: {{ default "password" .Values.storage.elasticsearch.existingSecretKey }} -{{- end }} -{{- if .Values.storage.elasticsearch.indexPrefix }} -- name: ES_INDEX_PREFIX - value: {{ .Values.storage.elasticsearch.indexPrefix }} -{{- end }} -{{- range $key, $value := .Values.storage.elasticsearch.env }} -- name: {{ $key | quote }} - value: {{ $value | quote }} -{{ end -}} -{{- if .Values.storage.elasticsearch.extraEnv }} -{{ toYaml .Values.storage.elasticsearch.extraEnv }} -{{- end }} -{{- end -}} - -{{/* -Cassandra or Elasticsearch related environment variables depending on which is used -*/}} -{{- define "storage.env" -}} -{{- if eq .Values.storage.type "cassandra" -}} -{{ include "cassandra.env" . }} -{{- else if eq .Values.storage.type "elasticsearch" -}} -{{ include "elasticsearch.env" . }} -{{- end -}} -{{- end -}} - -{{/* -Cassandra related command line options -*/}} -{{- define "cassandra.cmdArgs" -}} -{{- range $key, $value := .Values.storage.cassandra.cmdlineParams -}} -{{- if $value -}} -- --{{ $key }}={{ $value }} -{{- else }} -- --{{ $key }} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Elasticsearch related command line options -*/}} -{{- define "elasticsearch.cmdArgs" -}} -{{- range $key, $value := .Values.storage.elasticsearch.cmdlineParams -}} -{{- if $value -}} -- --{{ $key }}={{ $value }} -{{- else }} -- --{{ $key }} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Cassandra or Elasticsearch related command line options depending on which is used -*/}} -{{- define "storage.cmdArgs" -}} -{{- if eq .Values.storage.type "cassandra" -}} -{{- include "cassandra.cmdArgs" . -}} -{{- else if eq .Values.storage.type "elasticsearch" -}} -{{- include "elasticsearch.cmdArgs" . -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/agent-ds.yaml b/rds/base/charts/jaeger/templates/agent-ds.yaml deleted file mode 100644 index 2b4f8b7..0000000 --- a/rds/base/charts/jaeger/templates/agent-ds.yaml +++ /dev/null @@ -1,142 +0,0 @@ -{{- if .Values.agent.enabled -}} -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: {{ template "jaeger.agent.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: agent -{{- if .Values.agent.annotations }} - annotations: - {{- toYaml .Values.agent.annotations | nindent 4 }} -{{- end }} -spec: - selector: - matchLabels: - {{- include "jaeger.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: agent - template: - metadata: -{{- if .Values.agent.podAnnotations }} - annotations: - {{- toYaml .Values.agent.podAnnotations | nindent 8 }} -{{- end }} - labels: - {{- include "jaeger.selectorLabels" . | nindent 8 }} - app.kubernetes.io/component: agent -{{- if .Values.agent.podLabels }} - {{- toYaml .Values.agent.podLabels | nindent 8 }} -{{- end }} - spec: - securityContext: - {{- toYaml .Values.agent.podSecurityContext | nindent 8 }} - {{- if .Values.agent.useHostNetwork }} - hostNetwork: true - {{- end }} - dnsPolicy: {{ .Values.agent.dnsPolicy }} - {{- with .Values.agent.priorityClassName }} - priorityClassName: {{ . }} - {{- end }} - serviceAccountName: {{ template "jaeger.agent.serviceAccountName" . }} - {{- with .Values.agent.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ template "jaeger.agent.name" . }} - securityContext: - {{- toYaml .Values.agent.securityContext | nindent 10 }} - image: {{ .Values.agent.image }}:{{ .Values.tag }} - imagePullPolicy: {{ .Values.agent.pullPolicy }} - args: - {{- range $key, $value := .Values.agent.cmdlineParams }} - {{- if $value }} - - --{{ $key }}={{ $value }} - {{- else }} - - --{{ $key }} - {{- end }} - {{- end }} - env: - {{- if .Values.agent.extraEnv }} - {{- toYaml .Values.agent.extraEnv | nindent 10 }} - {{- end }} - {{- if not (hasKey .Values.agent.cmdlineParams "reporter.grpc.host-port") }} - - name: REPORTER_GRPC_HOST_PORT - value: {{ include "jaeger.collector.name" . }}:{{ .Values.collector.service.grpc.port }} - {{- end }} - ports: - - name: zipkin-compact - containerPort: {{ .Values.agent.service.zipkinThriftPort }} - protocol: UDP - {{- if .Values.agent.daemonset.useHostPort }} - hostPort: {{ .Values.agent.service.zipkinThriftPort }} - {{- end }} - - name: jaeger-compact - containerPort: {{ .Values.agent.service.compactPort }} - protocol: UDP - {{- if .Values.agent.daemonset.useHostPort }} - hostPort: {{ .Values.agent.service.compactPort }} - {{- end }} - - name: jaeger-binary - containerPort: {{ .Values.agent.service.binaryPort }} - protocol: UDP - {{- if .Values.agent.daemonset.useHostPort }} - hostPort: {{ .Values.agent.service.binaryPort }} - {{- end }} - - name: http - containerPort: {{ .Values.agent.service.samplingPort }} - protocol: TCP - {{- if .Values.agent.daemonset.useHostPort }} - hostPort: {{ .Values.agent.service.samplingPort }} - {{- end }} - - name: admin - containerPort: 14271 - protocol: TCP - livenessProbe: - httpGet: - path: / - port: admin - readinessProbe: - httpGet: - path: / - port: admin - resources: - {{- toYaml .Values.agent.resources | nindent 10 }} - volumeMounts: - {{- range .Values.agent.extraConfigmapMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- range .Values.agent.extraSecretMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - volumes: - {{- range .Values.agent.extraConfigmapMounts }} - - name: {{ .name }} - configMap: - name: {{ .configMap }} - {{- end }} - {{- range .Values.agent.extraSecretMounts }} - - name: {{ .name }} - secret: - secretName: {{ .secretName }} - {{- end }} - {{- with .Values.agent.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.agent.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.agent.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/agent-sa.yaml b/rds/base/charts/jaeger/templates/agent-sa.yaml deleted file mode 100644 index 211119f..0000000 --- a/rds/base/charts/jaeger/templates/agent-sa.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if and .Values.agent.enabled .Values.agent.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "jaeger.agent.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: agent -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/agent-servicemonitor.yaml b/rds/base/charts/jaeger/templates/agent-servicemonitor.yaml deleted file mode 100644 index 10be1e8..0000000 --- a/rds/base/charts/jaeger/templates/agent-servicemonitor.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if and (.Values.agent.enabled) (.Values.agent.serviceMonitor.enabled)}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "jaeger.agent.name" . }} - {{- if .Values.agent.serviceMonitor.namespace }} - namespace: {{ .Values.agent.serviceMonitor.namespace }} - {{- else }} - namespace: {{ .Release.Namespace }} - {{- end }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: agent - {{- if .Values.agent.serviceMonitor.additionalLabels }} - {{- toYaml .Values.agent.serviceMonitor.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.agent.serviceMonitor.annotations }} - annotations: - {{- toYaml .Values.agent.serviceMonitor.annotations | nindent 4 }} - {{- end }} -spec: - endpoints: - - port: admin - path: /metrics - {{- if .Values.agent.serviceMonitor.interval }} - interval: {{ .Values.agent.serviceMonitor.interval }} - {{- end }} - {{- if .Values.agent.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.agent.serviceMonitor.scrapeTimeout }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - selector: - matchLabels: - app.kubernetes.io/component: agent - app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/agent-svc.yaml b/rds/base/charts/jaeger/templates/agent-svc.yaml deleted file mode 100644 index 1bb71fe..0000000 --- a/rds/base/charts/jaeger/templates/agent-svc.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if .Values.agent.enabled -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "jaeger.agent.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: agent -{{- if .Values.agent.service.annotations }} - annotations: - {{- toYaml .Values.agent.service.annotations | nindent 4 }} -{{- end }} -spec: - ports: - - name: zipkin-compact - port: {{ .Values.agent.service.zipkinThriftPort }} - protocol: UDP - targetPort: zipkin-compact - - name: jaeger-compact - port: {{ .Values.agent.service.compactPort }} - protocol: UDP - targetPort: jaeger-compact - - name: jaeger-binary - port: {{ .Values.agent.service.binaryPort }} - protocol: UDP - targetPort: jaeger-binary - - name: http - port: {{ .Values.agent.service.samplingPort }} - protocol: TCP - targetPort: http - - name: admin - port: 14271 - protocol: TCP - targetPort: admin - type: {{ .Values.agent.service.type }} - selector: - {{- include "jaeger.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: agent -{{- template "loadBalancerSourceRanges" .Values.agent }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/cassandra-schema-job.yaml b/rds/base/charts/jaeger/templates/cassandra-schema-job.yaml deleted file mode 100644 index 95487cf..0000000 --- a/rds/base/charts/jaeger/templates/cassandra-schema-job.yaml +++ /dev/null @@ -1,98 +0,0 @@ -{{- if .Values.collector.enabled -}} -{{- if eq .Values.storage.type "cassandra" -}} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "jaeger.fullname" . }}-cassandra-schema - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: cassandra-schema -{{- if .Values.schema.annotations }} - annotations: - {{- toYaml .Values.schema.annotations | nindent 4 }} -{{- end }} -spec: - activeDeadlineSeconds: {{ .Values.schema.activeDeadlineSeconds }} - template: - metadata: - name: {{ include "jaeger.fullname" . }}-cassandra-schema -{{- if .Values.schema.podAnnotations }} - annotations: - {{- toYaml .Values.schema.podAnnotations | nindent 8 }} -{{- end }} -{{- if .Values.schema.podLabels }} - labels: - {{- toYaml .Values.schema.podLabels | nindent 8 }} -{{- end }} - spec: - securityContext: - {{- toYaml .Values.schema.podSecurityContext | nindent 8 }} - serviceAccountName: {{ template "jaeger.cassandraSchema.serviceAccountName" . }} - {{- with .Values.schema.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ include "jaeger.fullname" . }}-cassandra-schema - image: {{ .Values.schema.image }}:{{ .Values.tag }} - imagePullPolicy: {{ .Values.schema.pullPolicy }} - securityContext: - {{- toYaml .Values.schema.securityContext | nindent 10 }} - env: - {{- if .Values.schema.extraEnv }} - {{- toYaml .Values.schema.extraEnv | nindent 10 }} - {{- end }} - {{ range $key, $value := .Values.schema.env }} - - name: {{ $key | quote }} - value: {{ $value | quote }} - {{ end }} - {{- include "cassandra.env" . | nindent 10 }} - - name: CQLSH_HOST - value: {{ template "cassandra.host" . }} - {{ if .Values.storage.cassandra.tls.enabled }} - - name: CQLSH_SSL - value: "--ssl" - {{- end }} - - name: DATACENTER - value: {{ .Values.cassandra.config.dc_name | quote }} - {{- if .Values.storage.cassandra.keyspace }} - - name: KEYSPACE - value: {{ .Values.storage.cassandra.keyspace }} - {{- end }} - resources: - {{- toYaml .Values.schema.resources | nindent 10 }} - volumeMounts: - {{- range .Values.schema.extraConfigmapMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- if .Values.storage.cassandra.tls.enabled }} - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/root/.cassandra/ca-cert.pem" - subPath: "ca-cert.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/root/.cassandra/client-cert.pem" - subPath: "client-cert.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/root/.cassandra/client-key.pem" - subPath: "client-key.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/root/.cassandra/cqlshrc" - subPath: "cqlshrc" - readOnly: true - {{- end }} - restartPolicy: OnFailure - volumes: - {{- range .Values.schema.extraConfigmapMounts }} - - name: {{ .name }} - configMap: - name: {{ .configMap }} - {{- end }} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/cassandra-schema-sa.yaml b/rds/base/charts/jaeger/templates/cassandra-schema-sa.yaml deleted file mode 100644 index 2b3a2fd..0000000 --- a/rds/base/charts/jaeger/templates/cassandra-schema-sa.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if and (eq .Values.storage.type "cassandra") .Values.schema.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "jaeger.cassandraSchema.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: cassandra-schema -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/cassandra-secret.yaml b/rds/base/charts/jaeger/templates/cassandra-secret.yaml deleted file mode 100644 index 4fb7573..0000000 --- a/rds/base/charts/jaeger/templates/cassandra-secret.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{ if and (eq .Values.storage.type "cassandra") .Values.storage.cassandra.usePassword (not .Values.storage.cassandra.existingSecret) -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "jaeger.fullname" . }}-cassandra - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} -type: Opaque -data: - password: {{ .Values.storage.cassandra.password | b64enc | quote }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/collector-configmap.yaml b/rds/base/charts/jaeger/templates/collector-configmap.yaml deleted file mode 100644 index ab88378..0000000 --- a/rds/base/charts/jaeger/templates/collector-configmap.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if .Values.collector.samplingConfig }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "jaeger.fullname" . }}-sampling-strategies - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: collector -data: - strategies.json: |- -{{ tpl .Values.collector.samplingConfig . | indent 4 }} -{{- end }} - diff --git a/rds/base/charts/jaeger/templates/collector-deploy.yaml b/rds/base/charts/jaeger/templates/collector-deploy.yaml deleted file mode 100644 index 26bc400..0000000 --- a/rds/base/charts/jaeger/templates/collector-deploy.yaml +++ /dev/null @@ -1,181 +0,0 @@ -{{- if .Values.collector.enabled -}} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ template "jaeger.collector.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: collector -{{- if .Values.collector.annotations }} - annotations: - {{- toYaml .Values.collector.annotations | nindent 4 }} -{{- end }} -spec: -{{- if not .Values.collector.autoscaling.enabled }} - replicas: {{ .Values.collector.replicaCount }} -{{- end }} - selector: - matchLabels: - {{- include "jaeger.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: collector - strategy: - type: Recreate - template: - metadata: - annotations: - checksum/config-env: {{ include (print $.Template.BasePath "/collector-configmap.yaml") . | sha256sum }} -{{- if .Values.collector.podAnnotations }} - {{- toYaml .Values.collector.podAnnotations | nindent 8 }} -{{- end }} - labels: - {{- include "jaeger.selectorLabels" . | nindent 8 }} - app.kubernetes.io/component: collector -{{- if .Values.collector.podLabels }} - {{- toYaml .Values.collector.podLabels | nindent 8 }} -{{- end }} - spec: - {{- with .Values.collector.priorityClassName }} - priorityClassName: {{ . }} - {{- end }} - securityContext: - {{- toYaml .Values.collector.podSecurityContext | nindent 8 }} - serviceAccountName: {{ template "jaeger.collector.serviceAccountName" . }} - {{- with .Values.collector.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ template "jaeger.collector.name" . }} - securityContext: - {{- toYaml .Values.collector.securityContext | nindent 10 }} - image: {{ .Values.collector.image }}:{{ .Values.tag }} - imagePullPolicy: {{ .Values.collector.pullPolicy }} - args: - {{- range $key, $value := .Values.collector.cmdlineParams -}} - {{- if $value }} - - --{{ $key }}={{ $value }} - {{- else }} - - --{{ $key }} - {{- end }} - {{- end -}} - {{- if not .Values.ingester.enabled -}} - {{- include "storage.cmdArgs" . | nindent 10 }} - {{- end }} - env: - {{- if .Values.collector.service.zipkin }} - - name: COLLECTOR_ZIPKIN_HTTP_PORT - value: {{ .Values.collector.service.zipkin.port | quote }} - {{- end }} - {{- if .Values.ingester.enabled }} - - name: SPAN_STORAGE_TYPE - value: kafka - {{- range $key, $value := .Values.storage.kafka.env }} - - name: {{ $key | quote }} - value: {{ $value | quote }} - {{- end }} - {{- if .Values.storage.kafka.extraEnv }} - {{- toYaml .Values.storage.kafka.extraEnv | nindent 10 }} - {{- end }} - - name: KAFKA_PRODUCER_BROKERS - value: {{ include "helm-toolkit.utils.joinListWithComma" .Values.storage.kafka.brokers }} - - name: KAFKA_PRODUCER_TOPIC - value: {{ .Values.storage.kafka.topic }} - - name: KAFKA_PRODUCER_AUTHENTICATION - value: {{ .Values.storage.kafka.authentication }} - {{ else }} - - name: SPAN_STORAGE_TYPE - value: {{ .Values.storage.type }} - {{- include "storage.env" . | nindent 10 }} - {{- end }} - {{- if .Values.collector.samplingConfig}} - - name: SAMPLING_STRATEGIES_FILE - value: /etc/conf/strategies.json - {{- end }} - ports: - - containerPort: {{ .Values.collector.service.grpc.port }} - name: grpc - protocol: TCP - - containerPort: {{ .Values.collector.service.http.port }} - name: http - protocol: TCP - - containerPort: 14269 - name: admin - protocol: TCP - {{- if .Values.collector.service.zipkin }} - - containerPort: {{ .Values.collector.service.zipkin.port }} - name: zipkin - protocol: TCP - {{- end }} - readinessProbe: - httpGet: - path: / - port: admin - livenessProbe: - httpGet: - path: / - port: admin - resources: - {{- toYaml .Values.collector.resources | nindent 10 }} - volumeMounts: - {{- range .Values.collector.extraConfigmapMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- range .Values.collector.extraSecretMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- if .Values.storage.cassandra.tls.enabled }} - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/ca-cert.pem" - subPath: "ca-cert.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/client-cert.pem" - subPath: "client-cert.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/client-key.pem" - subPath: "client-key.pem" - readOnly: true - {{- end }} - {{- if .Values.collector.samplingConfig}} - - name: strategies - mountPath: /etc/conf/ - {{- end }} - dnsPolicy: {{ .Values.collector.dnsPolicy }} - restartPolicy: Always - volumes: - {{- range .Values.collector.extraConfigmapMounts }} - - name: {{ .name }} - configMap: - name: {{ .configMap }} - {{- end }} - {{- range .Values.collector.extraSecretMounts }} - - name: {{ .name }} - secret: - secretName: {{ .secretName }} - {{- end }} - {{- if .Values.collector.samplingConfig}} - - name: strategies - configMap: - name: {{ include "jaeger.fullname" . }}-sampling-strategies - {{- end }} - {{- with .Values.collector.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.collector.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.collector.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/collector-hpa.yaml b/rds/base/charts/jaeger/templates/collector-hpa.yaml deleted file mode 100644 index c73f44a..0000000 --- a/rds/base/charts/jaeger/templates/collector-hpa.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.collector.autoscaling.enabled }} -apiVersion: autoscaling/v2beta1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ template "jaeger.collector.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: collector -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ template "jaeger.collector.name" . }} - minReplicas: {{ .Values.collector.autoscaling.minReplicas }} - maxReplicas: {{ .Values.collector.autoscaling.maxReplicas }} - metrics: - - type: Resource - resource: - name: cpu - targetAverageUtilization: {{ .Values.collector.autoscaling.targetCPUUtilizationPercentage | default 80 }} - {{- if .Values.collector.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - targetAverageUtilization: {{ .Values.collector.autoscaling.targetMemoryUtilizationPercentage }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/collector-sa.yaml b/rds/base/charts/jaeger/templates/collector-sa.yaml deleted file mode 100644 index 98b2f06..0000000 --- a/rds/base/charts/jaeger/templates/collector-sa.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if and .Values.collector.enabled .Values.collector.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "jaeger.collector.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: collector -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/collector-servicemonitor.yaml b/rds/base/charts/jaeger/templates/collector-servicemonitor.yaml deleted file mode 100644 index 8e01db1..0000000 --- a/rds/base/charts/jaeger/templates/collector-servicemonitor.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if and (.Values.collector.enabled) (.Values.collector.serviceMonitor.enabled)}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "jaeger.collector.name" . }} - {{- if .Values.collector.serviceMonitor.namespace }} - namespace: {{ .Values.collector.serviceMonitor.namespace }} - {{- else }} - namespace: {{ .Release.Namespace }} - {{- end }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: collector - {{- if .Values.collector.serviceMonitor.additionalLabels }} - {{- toYaml .Values.collector.serviceMonitor.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.collector.serviceMonitor.annotations }} - annotations: - {{- toYaml .Values.collector.serviceMonitor.annotations | nindent 4 }} - {{- end }} -spec: - endpoints: - - port: admin - path: /metrics - {{- if .Values.collector.serviceMonitor.interval }} - interval: {{ .Values.collector.serviceMonitor.interval }} - {{- end }} - {{- if .Values.collector.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.collector.serviceMonitor.scrapeTimeout }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - selector: - matchLabels: - app.kubernetes.io/component: collector - app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/collector-svc.yaml b/rds/base/charts/jaeger/templates/collector-svc.yaml deleted file mode 100644 index 165124a..0000000 --- a/rds/base/charts/jaeger/templates/collector-svc.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{- if .Values.collector.enabled -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "jaeger.collector.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: collector -{{- if .Values.collector.service.annotations }} - annotations: - {{- toYaml .Values.collector.service.annotations | nindent 4 }} -{{- end }} -spec: - ports: - - name: grpc - port: {{ .Values.collector.service.grpc.port }} -{{- if and (eq .Values.collector.service.type "NodePort") (.Values.collector.service.grpc.nodePort) }} - nodePort: {{ .Values.collector.service.grpc.nodePort }} -{{- end }} - protocol: TCP - targetPort: grpc - - name: http - port: {{ .Values.collector.service.http.port }} -{{- if and (eq .Values.collector.service.type "NodePort") (.Values.collector.service.http.nodePort) }} - nodePort: {{ .Values.collector.service.http.nodePort }} -{{- end }} - protocol: TCP - targetPort: http -{{- if .Values.collector.service.zipkin }} - - name: zipkin - port: {{ .Values.collector.service.zipkin.port }} -{{- if and (eq .Values.collector.service.type "NodePort") (.Values.collector.service.zipkin.nodePort) }} - nodePort: {{ .Values.collector.service.zipkin.nodePort }} -{{- end }} - protocol: TCP - targetPort: zipkin -{{- end }} - - name: admin - port: 14269 - targetPort: admin - selector: - {{- include "jaeger.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: collector - type: {{ .Values.collector.service.type }} -{{- template "loadBalancerSourceRanges" .Values.collector }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/elasticsearch-secret.yaml b/rds/base/charts/jaeger/templates/elasticsearch-secret.yaml deleted file mode 100644 index 14eb7bb..0000000 --- a/rds/base/charts/jaeger/templates/elasticsearch-secret.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{ if and (eq .Values.storage.type "elasticsearch") .Values.storage.elasticsearch.usePassword (not .Values.storage.elasticsearch.existingSecret) -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "jaeger.fullname" . }}-elasticsearch - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} -type: Opaque -data: - password: {{ .Values.storage.elasticsearch.password | b64enc | quote }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/es-index-cleaner-cronjob.yaml b/rds/base/charts/jaeger/templates/es-index-cleaner-cronjob.yaml deleted file mode 100644 index 10da669..0000000 --- a/rds/base/charts/jaeger/templates/es-index-cleaner-cronjob.yaml +++ /dev/null @@ -1,84 +0,0 @@ -{{- if .Values.esIndexCleaner.enabled -}} -apiVersion: batch/v1beta1 -kind: CronJob -metadata: - name: {{ include "jaeger.fullname" . }}-es-index-cleaner - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: es-index-cleaner -{{- if .Values.esIndexCleaner.annotations }} - annotations: - {{- toYaml .Values.esIndexCleaner.annotations | nindent 4 }} -{{- end }} -spec: - concurrencyPolicy: "Forbid" - schedule: {{ .Values.esIndexCleaner.schedule | quote }} - successfulJobsHistoryLimit: {{ .Values.esIndexCleaner.successfulJobsHistoryLimit }} - failedJobsHistoryLimit: {{ .Values.esIndexCleaner.failedJobsHistoryLimit }} - suspend: false - jobTemplate: - spec: - template: - metadata: - {{- if .Values.esIndexCleaner.podAnnotations }} - annotations: - {{- toYaml .Values.esIndexCleaner.podAnnotations | nindent 12 }} - {{- end }} - labels: - {{- include "jaeger.selectorLabels" . | nindent 12 }} - app.kubernetes.io/component: es-index-cleaner - {{- if .Values.esIndexCleaner.podLabels }} - {{- toYaml .Values.esIndexCleaner.podLabels | nindent 12 }} - {{- end }} - spec: - serviceAccountName: {{ template "jaeger.esIndexCleaner.serviceAccountName" . }} - {{- with .Values.esIndexCleaner.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 12 }} - {{- end }} - securityContext: - {{- toYaml .Values.esIndexCleaner.podSecurityContext | nindent 12 }} - containers: - - name: {{ include "jaeger.fullname" . }}-es-index-cleaner - securityContext: - {{- toYaml .Values.esIndexCleaner.securityContext | nindent 14 }} - image: "{{ .Values.esIndexCleaner.image }}:{{ .Values.esIndexCleaner.tag }}" - imagePullPolicy: {{ .Values.esIndexCleaner.pullPolicy }} - args: - - {{ .Values.esIndexCleaner.numberOfDays | quote }} - - {{ include "elasticsearch.client.url" . }} - env: - {{- if .Values.esIndexCleaner.extraEnv }} - {{- toYaml .Values.esIndexCleaner.extraEnv | nindent 14 }} - {{- end }} - {{ include "elasticsearch.env" . | nindent 14 }} - resources: - {{- toYaml .Values.esIndexCleaner.resources | nindent 14 }} - volumeMounts: - {{- range .Values.esIndexCleaner.extraConfigmapMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- range .Values.esIndexCleaner.extraSecretMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - restartPolicy: OnFailure - {{- with .Values.esIndexCleaner.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.esIndexCleaner.affinity }} - affinity: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.esIndexCleaner.tolerations }} - tolerations: - {{- toYaml . | nindent 12 }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/es-index-cleaner-sa.yaml b/rds/base/charts/jaeger/templates/es-index-cleaner-sa.yaml deleted file mode 100644 index cd26fa7..0000000 --- a/rds/base/charts/jaeger/templates/es-index-cleaner-sa.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if and .Values.esIndexCleaner.enabled .Values.esIndexCleaner.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "jaeger.esIndexCleaner.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: es-index-cleaner -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/hotrod-deploy.yaml b/rds/base/charts/jaeger/templates/hotrod-deploy.yaml deleted file mode 100644 index 9dbb9ff..0000000 --- a/rds/base/charts/jaeger/templates/hotrod-deploy.yaml +++ /dev/null @@ -1,66 +0,0 @@ -{{- if .Values.hotrod.enabled -}} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "jaeger.fullname" . }}-hotrod - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: hotrod -spec: - replicas: {{ .Values.hotrod.replicaCount }} - selector: - matchLabels: - {{- include "jaeger.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: hotrod - template: - metadata: - labels: - {{- include "jaeger.selectorLabels" . | nindent 8 }} - app.kubernetes.io/component: hotrod - spec: - securityContext: - {{- toYaml .Values.hotrod.podSecurityContext | nindent 8 }} - serviceAccountName: {{ template "jaeger.hotrod.serviceAccountName" . }} - {{- with .Values.hotrod.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ include "jaeger.fullname" . }}-hotrod - securityContext: - {{- toYaml .Values.hotrod.securityContext | nindent 12 }} - image: {{ .Values.hotrod.image.repository }}:{{ .Values.tag }} - imagePullPolicy: {{ .Values.hotrod.image.pullPolicy }} - env: - - name: JAEGER_AGENT_HOST - value: {{ template "jaeger.hotrod.tracing.host" . }} - - name: JAEGER_AGENT_PORT - value: {{ .Values.hotrod.tracing.port | quote }} - ports: - - name: http - containerPort: 8080 - protocol: TCP - livenessProbe: - httpGet: - path: / - port: http - readinessProbe: - httpGet: - path: / - port: http - resources: - {{- toYaml .Values.hotrod.resources | nindent 12 }} - {{- with .Values.hotrod.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.hotrod.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.hotrod.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/hotrod-ing.yaml b/rds/base/charts/jaeger/templates/hotrod-ing.yaml deleted file mode 100644 index f9a9009..0000000 --- a/rds/base/charts/jaeger/templates/hotrod-ing.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{- if .Values.hotrod.enabled -}} -{{- if .Values.hotrod.ingress.enabled -}} -{{- $serviceName := include "jaeger.fullname" . -}} -{{- $servicePort := .Values.hotrod.service.port -}} -apiVersion: networking.k8s.io/v1beta1 -kind: Ingress -metadata: - name: {{ include "jaeger.fullname" . }}-hotrod - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: hotrod -{{- if .Values.hotrod.ingress.annotations }} - annotations: - {{- toYaml .Values.hotrod.ingress.annotations | nindent 4 }} -{{- end }} -spec: - rules: - {{- range $host := .Values.hotrod.ingress.hosts }} - - host: {{ $host }} - http: - paths: - - path: / - backend: - serviceName: {{ $serviceName }}-hotrod - servicePort: {{ $servicePort }} - {{- end -}} - {{- if .Values.hotrod.ingress.tls }} - tls: - {{- toYaml .Values.hotrod.ingress.tls | nindent 4 }} - {{- end -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/hotrod-sa.yaml b/rds/base/charts/jaeger/templates/hotrod-sa.yaml deleted file mode 100644 index 1674e6d..0000000 --- a/rds/base/charts/jaeger/templates/hotrod-sa.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if and .Values.hotrod.enabled .Values.hotrod.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "jaeger.hotrod.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: hotrod -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/hotrod-svc.yaml b/rds/base/charts/jaeger/templates/hotrod-svc.yaml deleted file mode 100644 index 41fdef9..0000000 --- a/rds/base/charts/jaeger/templates/hotrod-svc.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.hotrod.enabled -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ include "jaeger.fullname" . }}-hotrod - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: hotrod -{{- if .Values.hotrod.service.annotations }} - annotations: - {{- toYaml .Values.hotrod.service.annotations | nindent 4 }} -{{- end }} -spec: - type: {{ .Values.hotrod.service.type }} - ports: - - name: http - port: {{ .Values.hotrod.service.port }} - protocol: TCP - targetPort: http - selector: - {{- include "jaeger.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: hotrod -{{- template "loadBalancerSourceRanges" .Values.hotrod }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/ingester-deploy.yaml b/rds/base/charts/jaeger/templates/ingester-deploy.yaml deleted file mode 100644 index 6532f09..0000000 --- a/rds/base/charts/jaeger/templates/ingester-deploy.yaml +++ /dev/null @@ -1,131 +0,0 @@ -{{- if .Values.ingester.enabled -}} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "jaeger.fullname" . }}-ingester - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: ingester -{{- if .Values.ingester.annotations }} - annotations: - {{- toYaml .Values.ingester.annotations | nindent 4 }} -{{- end }} -spec: -{{- if not .Values.ingester.autoscaling.enabled }} - replicas: {{ .Values.ingester.replicaCount }} -{{- end }} - selector: - matchLabels: - {{- include "jaeger.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: ingester - strategy: - type: Recreate - template: - metadata: - annotations: -{{- if .Values.ingester.podAnnotations }} - {{- toYaml .Values.ingester.podAnnotations | nindent 8 }} -{{- end }} - labels: - {{- include "jaeger.selectorLabels" . | nindent 8 }} - app.kubernetes.io/component: ingester -{{- if .Values.ingester.podLabels }} - {{- toYaml .Values.ingester.podLabels | nindent 8 }} -{{- end }} - spec: - securityContext: - {{- toYaml .Values.ingester.podSecurityContext | nindent 8 }} - {{- with .Values.ingester.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - nodeSelector: - {{- toYaml .Values.ingester.nodeSelector | nindent 8 }} -{{- if .Values.ingester.tolerations }} - tolerations: - {{- toYaml .Values.ingester.tolerations | nindent 8 }} -{{- end }} - containers: - - name: {{ include "jaeger.fullname" . }}-ingester - securityContext: - {{- toYaml .Values.ingester.securityContext | nindent 10 }} - image: {{ .Values.ingester.image }}:{{ .Values.tag }} - imagePullPolicy: {{ .Values.ingester.pullPolicy }} - args: - {{- range $key, $value := .Values.ingester.cmdlineParams }} - {{- if $value }} - - --{{ $key }}={{ $value }} - {{- else }} - - --{{ $key }} - {{- end }} - {{- end }} - {{- include "storage.cmdArgs" . | nindent 10 }} - env: - {{- if .Values.ingester.extraEnv }} - {{- toYaml .Values.ingester.extraEnv | nindent 10 }} - {{- end }} - - name: SPAN_STORAGE_TYPE - value: {{ .Values.storage.type }} - {{- include "storage.env" . | nindent 10 }} - - name: KAFKA_CONSUMER_BROKERS - value: {{ include "helm-toolkit.utils.joinListWithComma" .Values.storage.kafka.brokers }} - - name: KAFKA_CONSUMER_TOPIC - value: {{ .Values.storage.kafka.topic }} - - name: KAFKA_CONSUMER_AUTHENTICATION - value: {{ .Values.storage.kafka.authentication }} - ports: - - containerPort: 14270 - name: admin - protocol: TCP - readinessProbe: - httpGet: - path: / - port: admin - livenessProbe: - httpGet: - path: / - port: admin - resources: - {{- toYaml .Values.ingester.resources | nindent 10 }} - volumeMounts: - {{- range .Values.ingester.extraConfigmapMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- range .Values.ingester.extraSecretMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- if .Values.storage.cassandra.tls.enabled }} - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/ca-cert.pem" - subPath: "ca-cert.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/client-cert.pem" - subPath: "client-cert.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/client-key.pem" - subPath: "client-key.pem" - readOnly: true - {{- end }} - dnsPolicy: {{ .Values.ingester.dnsPolicy }} - restartPolicy: Always - volumes: - {{- range .Values.ingester.extraConfigmapMounts }} - - name: {{ .name }} - configMap: - name: {{ .configMap }} - {{- end }} - {{- range .Values.ingester.extraSecretMounts }} - - name: {{ .name }} - secret: - secretName: {{ .secretName }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/ingester-hpa.yaml b/rds/base/charts/jaeger/templates/ingester-hpa.yaml deleted file mode 100644 index 8cd9298..0000000 --- a/rds/base/charts/jaeger/templates/ingester-hpa.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.ingester.autoscaling.enabled }} -apiVersion: autoscaling/v2beta1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ template "jaeger.ingester.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: ingester -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ template "jaeger.ingester.name" . }} - minReplicas: {{ .Values.ingester.autoscaling.minReplicas }} - maxReplicas: {{ .Values.ingester.autoscaling.maxReplicas }} - metrics: - - type: Resource - resource: - name: cpu - targetAverageUtilization: {{ .Values.ingester.autoscaling.targetCPUUtilizationPercentage | default 80 }} - {{- if .Values.ingester.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - targetAverageUtilization: {{ .Values.ingester.autoscaling.targetMemoryUtilizationPercentage }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/ingester-sa.yaml b/rds/base/charts/jaeger/templates/ingester-sa.yaml deleted file mode 100644 index 9ea02b5..0000000 --- a/rds/base/charts/jaeger/templates/ingester-sa.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if and .Values.ingester.enabled .Values.ingester.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "jaeger.ingester.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: ingester -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/ingester-servicemonitor.yaml b/rds/base/charts/jaeger/templates/ingester-servicemonitor.yaml deleted file mode 100644 index 1897c1e..0000000 --- a/rds/base/charts/jaeger/templates/ingester-servicemonitor.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if and (.Values.ingester.enabled) (.Values.ingester.serviceMonitor.enabled)}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "jaeger.ingester.name" . }} - {{- if .Values.ingester.serviceMonitor.namespace }} - namespace: {{ .Values.ingester.serviceMonitor.namespace }} - {{- else }} - namespace: {{ .Release.Namespace }} - {{- end }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: ingester - {{- if .Values.ingester.serviceMonitor.additionalLabels }} - {{- toYaml .Values.ingester.serviceMonitor.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.ingester.serviceMonitor.annotations }} - annotations: - {{- toYaml .Values.ingester.serviceMonitor.annotations | nindent 4 }} - {{- end }} -spec: - endpoints: - - port: admin - path: /metrics - {{- if .Values.ingester.serviceMonitor.interval }} - interval: {{ .Values.ingester.serviceMonitor.interval }} - {{- end }} - {{- if .Values.ingester.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.ingester.serviceMonitor.scrapeTimeout }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - selector: - matchLabels: - app.kubernetes.io/component: ingester - app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/ingester-svc.yaml b/rds/base/charts/jaeger/templates/ingester-svc.yaml deleted file mode 100644 index 659f07b..0000000 --- a/rds/base/charts/jaeger/templates/ingester-svc.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- if .Values.ingester.enabled -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "jaeger.ingester.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: ingester -{{- if .Values.ingester.service.annotations }} - annotations: - {{- toYaml .Values.ingester.service.annotations | nindent 4 }} -{{- end }} -spec: - ports: - - name: admin - port: 14270 - targetPort: admin - selector: - {{- include "jaeger.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: ingester - type: {{ .Values.ingester.service.type }} -{{- template "loadBalancerSourceRanges" .Values.ingester }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/query-configmap.yaml b/rds/base/charts/jaeger/templates/query-configmap.yaml deleted file mode 100644 index 3643c73..0000000 --- a/rds/base/charts/jaeger/templates/query-configmap.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.query.config }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "jaeger.fullname" . }}-ui-configuration - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: query -data: - query-ui-config.json: |- -{{ tpl .Values.query.config . | indent 4 }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/query-deploy.yaml b/rds/base/charts/jaeger/templates/query-deploy.yaml deleted file mode 100644 index 90f53e2..0000000 --- a/rds/base/charts/jaeger/templates/query-deploy.yaml +++ /dev/null @@ -1,212 +0,0 @@ -{{- if .Values.query.enabled -}} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ template "jaeger.query.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: query -{{- if .Values.query.annotations }} - annotations: - {{- toYaml .Values.query.annotations | nindent 4 }} -{{- end }} -spec: - replicas: {{ .Values.query.replicaCount }} - selector: - matchLabels: - {{- include "jaeger.selectorLabels" . | nindent 6 }} - app.kubernetes.io/component: query - strategy: - type: Recreate - template: - metadata: -{{- if .Values.query.podAnnotations }} - annotations: - {{- toYaml .Values.query.podAnnotations | nindent 8 }} -{{- end }} - labels: - {{- include "jaeger.selectorLabels" . | nindent 8 }} - app.kubernetes.io/component: query -{{- if .Values.query.podLabels }} - {{- toYaml .Values.query.podLabels | nindent 8 }} -{{- end }} - spec: - {{- with .Values.query.priorityClassName }} - priorityClassName: {{ . }} - {{- end }} - securityContext: - {{- toYaml .Values.query.podSecurityContext | nindent 8 }} - serviceAccountName: {{ template "jaeger.query.serviceAccountName" . }} - {{- with .Values.query.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ template "jaeger.query.name" . }} - securityContext: - {{- toYaml .Values.query.securityContext | nindent 10 }} - image: {{ .Values.query.image }}:{{ .Values.tag }} - imagePullPolicy: {{ .Values.query.pullPolicy }} - args: - {{- range $key, $value := .Values.query.cmdlineParams }} - {{- if $value }} - - --{{ $key }}={{ $value }} - {{- else }} - - --{{ $key }} - {{- end }} - {{- end }} - {{- include "storage.cmdArgs" . | nindent 10 }} - env: - {{- if .Values.query.extraEnv }} - {{- toYaml .Values.query.extraEnv | nindent 10 }} - {{- end }} - - name: SPAN_STORAGE_TYPE - value: {{ .Values.storage.type }} - {{- include "storage.env" . | nindent 10 }} - {{- if .Values.query.basePath }} - - name: QUERY_BASE_PATH - value: {{ .Values.query.basePath | quote }} - {{- end }} - - name: JAEGER_AGENT_PORT - value: "6831" - {{- if .Values.query.config}} - - name: QUERY_UI_CONFIG - value: /etc/conf/query-ui-config.json - {{- end }} - ports: - - name: query - containerPort: 16686 - protocol: TCP - - name: admin - containerPort: 16687 - protocol: TCP - resources: - {{- toYaml .Values.query.resources | nindent 10 }} - volumeMounts: - {{- range .Values.query.extraSecretMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- range .Values.query.extraConfigmapMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- if .Values.storage.cassandra.tls.enabled }} - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/ca-cert.pem" - subPath: "ca-cert.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/client-cert.pem" - subPath: "client-cert.pem" - readOnly: true - - name: {{ .Values.storage.cassandra.tls.secretName }} - mountPath: "/cassandra-tls/client-key.pem" - subPath: "client-key.pem" - readOnly: true - {{- end }} - {{- if .Values.query.config}} - - name: ui-configuration - mountPath: /etc/conf/ - {{- end }} - livenessProbe: - httpGet: - path: / - port: admin - readinessProbe: - httpGet: - path: / - port: admin -{{- if .Values.query.agentSidecar.enabled }} - - name: {{ template "jaeger.agent.name" . }}-sidecar - securityContext: - {{- toYaml .Values.query.securityContext | nindent 10 }} - image: {{ .Values.agent.image }}:{{ .Values.tag }} - imagePullPolicy: {{ .Values.agent.pullPolicy }} - args: - {{- range $key, $value := .Values.agent.cmdlineParams }} - {{- if $value }} - - --{{ $key }}={{ $value }} - {{- else }} - - --{{ $key }} - {{- end }} - {{- end }} - env: - {{- if not (hasKey .Values.agent.cmdlineParams "reporter.grpc.host-port") }} - - name: REPORTER_GRPC_HOST_PORT - value: {{ include "jaeger.collector.name" . }}:{{ .Values.collector.service.grpc.port }} - {{- end }} - ports: - - name: admin - containerPort: 14271 - protocol: TCP - volumeMounts: - {{- range .Values.agent.extraConfigmapMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- range .Values.agent.extraSecretMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - livenessProbe: - httpGet: - path: / - port: admin - readinessProbe: - httpGet: - path: / - port: admin -{{- end }} - dnsPolicy: {{ .Values.query.dnsPolicy }} - restartPolicy: Always - volumes: - {{- range .Values.query.extraConfigmapMounts }} - - name: {{ .name }} - configMap: - name: {{ .configMap }} - {{- end }} - {{- range .Values.query.extraSecretMounts }} - - name: {{ .name }} - secret: - secretName: {{ .secretName }} - {{- end }} - {{- if .Values.query.config}} - - name: ui-configuration - configMap: - name: {{ include "jaeger.fullname" . }}-ui-configuration - {{- end }} -{{- if .Values.query.agentSidecar.enabled }} - {{- range .Values.agent.extraSecretMounts }} - - name: {{ .name }} - secret: - secretName: {{ .secretName }} - {{- end }} - {{- range .Values.agent.extraConfigmapMounts }} - - name: {{ .name }} - configMap: - name: {{ .configMap }} - {{- end }} -{{- end }} - {{- with .Values.query.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.query.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.query.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/query-ing.yaml b/rds/base/charts/jaeger/templates/query-ing.yaml deleted file mode 100644 index 88ba4eb..0000000 --- a/rds/base/charts/jaeger/templates/query-ing.yaml +++ /dev/null @@ -1,31 +0,0 @@ -{{- if .Values.query.ingress.enabled -}} -{{- $servicePort := .Values.query.service.port -}} -{{- $basePath := .Values.query.basePath -}} -apiVersion: networking.k8s.io/v1beta1 -kind: Ingress -metadata: - name: {{ template "jaeger.query.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: query - {{- if .Values.query.ingress.annotations }} - annotations: - {{- toYaml .Values.query.ingress.annotations | nindent 4 }} - {{- end }} -spec: - rules: - {{- range $host := .Values.query.ingress.hosts }} - - host: {{ $host }} - http: - paths: - - path: {{ $basePath }} - backend: - serviceName: {{ template "jaeger.query.name" $ }} - servicePort: {{ $servicePort }} - {{- end -}} - {{- if .Values.query.ingress.tls }} - tls: - {{- toYaml .Values.query.ingress.tls | nindent 4 }} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/query-sa.yaml b/rds/base/charts/jaeger/templates/query-sa.yaml deleted file mode 100644 index 32171bc..0000000 --- a/rds/base/charts/jaeger/templates/query-sa.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if and .Values.query.enabled .Values.query.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "jaeger.query.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: query -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/query-servicemonitor.yaml b/rds/base/charts/jaeger/templates/query-servicemonitor.yaml deleted file mode 100644 index 12c8cfe..0000000 --- a/rds/base/charts/jaeger/templates/query-servicemonitor.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{- if and (.Values.query.enabled) (.Values.query.serviceMonitor.enabled)}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "jaeger.query.name" . }} - {{- if .Values.query.serviceMonitor.namespace }} - namespace: {{ .Values.query.serviceMonitor.namespace }} - {{- else }} - {{- end }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: query - {{- if .Values.query.serviceMonitor.additionalLabels }} - {{- toYaml .Values.query.serviceMonitor.additionalLabels | nindent 4 }} - {{- end }} - {{- if .Values.query.serviceMonitor.annotations }} - annotations: - {{- toYaml .Values.query.serviceMonitor.annotations | nindent 4 }} - {{- end }} -spec: - endpoints: - - port: admin - path: /metrics - {{- if .Values.query.serviceMonitor.interval }} - interval: {{ .Values.query.serviceMonitor.interval }} - {{- end }} - {{- if .Values.query.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.query.serviceMonitor.scrapeTimeout }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - selector: - matchLabels: - app.kubernetes.io/component: query - app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} diff --git a/rds/base/charts/jaeger/templates/query-svc.yaml b/rds/base/charts/jaeger/templates/query-svc.yaml deleted file mode 100644 index 6a5095f..0000000 --- a/rds/base/charts/jaeger/templates/query-svc.yaml +++ /dev/null @@ -1,32 +0,0 @@ -{{- if .Values.query.enabled -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "jaeger.query.name" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: query -{{- if .Values.query.service.annotations }} - annotations: - {{- toYaml .Values.query.service.annotations | nindent 4 }} -{{- end }} -spec: - ports: - - name: query - port: {{ .Values.query.service.port }} - protocol: TCP - targetPort: query -{{- if and (eq .Values.query.service.type "NodePort") (.Values.query.service.nodePort) }} - nodePort: {{ .Values.query.service.nodePort }} -{{- end }} - - name: admin - port: 16687 - protocol: TCP - targetPort: admin - selector: - {{- include "jaeger.selectorLabels" . | nindent 4 }} - app.kubernetes.io/component: query - type: {{ .Values.query.service.type }} -{{- template "loadBalancerSourceRanges" .Values.query }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/spark-cronjob.yaml b/rds/base/charts/jaeger/templates/spark-cronjob.yaml deleted file mode 100644 index 1b99725..0000000 --- a/rds/base/charts/jaeger/templates/spark-cronjob.yaml +++ /dev/null @@ -1,98 +0,0 @@ -{{- if .Values.spark.enabled -}} -apiVersion: batch/v1beta1 -kind: CronJob -metadata: - name: {{ include "jaeger.fullname" . }}-spark - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: spark -{{- if .Values.spark.annotations }} - annotations: - {{- toYaml .Values.spark.annotations | nindent 4 }} -{{- end }} -spec: - schedule: {{ .Values.spark.schedule | quote }} - successfulJobsHistoryLimit: {{ .Values.spark.successfulJobsHistoryLimit }} - failedJobsHistoryLimit: {{ .Values.spark.failedJobsHistoryLimit }} - jobTemplate: - spec: - template: - metadata: - labels: - {{- include "jaeger.selectorLabels" . | nindent 12 }} - app.kubernetes.io/component: spark - {{- if .Values.spark.podLabels }} - {{- toYaml .Values.spark.podLabels | nindent 12 }} - {{- end }} - spec: - serviceAccountName: {{ template "jaeger.spark.serviceAccountName" . }} - {{- with .Values.spark.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 12 }} - {{- end }} - containers: - - name: {{ include "jaeger.fullname" . }}-spark - image: {{ .Values.spark.image }}:{{ .Values.spark.tag }} - imagePullPolicy: {{ .Values.spark.pullPolicy }} - args: - {{- range $key, $value := .Values.spark.cmdlineParams }} - {{- if $value }} - - --{{ $key }}={{ $value }} - {{- else }} - - --{{ $key }} - {{- end }} - {{- end }} - env: - - name: STORAGE - value: {{ .Values.storage.type }} - {{- include "storage.env" . | nindent 14 }} - {{- if .Values.spark.extraEnv }} - {{- toYaml .Values.spark.extraEnv | nindent 14 }} - {{- end }} - - name: CASSANDRA_CONTACT_POINTS - value: {{ include "cassandra.contact_points" . }} - - name: ES_NODES - value: {{ include "elasticsearch.client.url" . }} - - name: ES_NODES_WAN_ONLY - value: {{ .Values.storage.elasticsearch.nodesWanOnly | quote }} - resources: - {{- toYaml .Values.spark.resources | nindent 14 }} - volumeMounts: - {{- range .Values.spark.extraConfigmapMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - {{- range .Values.spark.extraSecretMounts }} - - name: {{ .name }} - mountPath: {{ .mountPath }} - subPath: {{ .subPath }} - readOnly: {{ .readOnly }} - {{- end }} - restartPolicy: OnFailure - volumes: - {{- range .Values.spark.extraConfigmapMounts }} - - name: {{ .name }} - configMap: - name: {{ .configMap }} - {{- end }} - {{- range .Values.spark.extraSecretMounts }} - - name: {{ .name }} - secret: - secretName: {{ .secretName }} - {{- end }} - {{- with .Values.spark.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.spark.affinity }} - affinity: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.spark.tolerations }} - tolerations: - {{- toYaml . | nindent 12 }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/jaeger/templates/spark-sa.yaml b/rds/base/charts/jaeger/templates/spark-sa.yaml deleted file mode 100644 index 6ac0732..0000000 --- a/rds/base/charts/jaeger/templates/spark-sa.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- if and .Values.spark.enabled .Values.spark.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "jaeger.spark.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "jaeger.labels" . | nindent 4 }} - app.kubernetes.io/component: spark -{{- end -}} diff --git a/rds/base/charts/jaeger/values.yaml b/rds/base/charts/jaeger/values.yaml deleted file mode 100644 index 4f70601..0000000 --- a/rds/base/charts/jaeger/values.yaml +++ /dev/null @@ -1,538 +0,0 @@ -# Default values for jaeger. -# This is a YAML-formatted file. -# Jaeger values are grouped by component. Cassandra values override subchart values - -provisionDataStore: - cassandra: true - elasticsearch: false - kafka: false - -tag: 1.18.0 - -nameOverride: "" -fullnameOverride: "" - -storage: - # allowed values (cassandra, elasticsearch) - type: cassandra - cassandra: - host: cassandra - port: 9042 - tls: - enabled: false - secretName: cassandra-tls-secret - user: user - usePassword: true - password: password - keyspace: jaeger_v1_test - ## Use existing secret (ignores previous password) - # existingSecret: - ## Cassandra related env vars to be configured on the concerned components - extraEnv: [] - # - name: CASSANDRA_SERVERS - # value: cassandra - # - name: CASSANDRA_PORT - # value: 9042 - # - name: CASSANDRA_KEYSPACE - # value: jaeger_v1_test - # - name: CASSANDRA_TLS_ENABLED - # value: false - ## Cassandra related cmd line opts to be configured on the concerned components - cmdlineParams: {} - # cassandra.servers: cassandra - # cassandra.port: 9042 - # cassandra.keyspace: jaeger_v1_test - # cassandra.tls.enabled: false - elasticsearch: - scheme: http - host: elasticsearch-master - port: 9200 - user: elastic - usePassword: true - password: changeme - # indexPrefix: test - ## Use existing secret (ignores previous password) - # existingSecret: - # existingSecretKey: - nodesWanOnly: false - extraEnv: [] - ## ES related env vars to be configured on the concerned components - # - name: ES_SERVER_URLS - # value: http://elasticsearch-master:9200 - # - name: ES_USERNAME - # value: elastic - # - name: ES_INDEX_PREFIX - # value: test - ## ES related cmd line opts to be configured on the concerned components - cmdlineParams: {} - # es.server-urls: http://elasticsearch-master:9200 - # es.username: elastic - # es.index-prefix: test - kafka: - brokers: - - kafka:9092 - topic: jaeger_v1_test - authentication: none - extraEnv: [] - -# Begin: Override values on the Cassandra subchart to customize for Jaeger -cassandra: - persistence: - # To enable persistence, please see the documentation for the Cassandra chart - enabled: false - config: - cluster_name: jaeger - seed_size: 1 - dc_name: dc1 - rack_name: rack1 - endpoint_snitch: GossipingPropertyFileSnitch -# End: Override values on the Cassandra subchart to customize for Jaeger - -# Begin: Override values on the Kafka subchart to customize for Jaeger -kafka: - replicas: 1 - configurationOverrides: - "auto.create.topics.enable": true - zookeeper: - replicaCount: 1 -# End: Override values on the Kafka subchart to customize for Jaeger - -# Begin: Default values for the various components of Jaeger -# This chart has been based on the Kubernetes integration found in the following repo: -# https://github.com/jaegertracing/jaeger-kubernetes/blob/master/production/jaeger-production-template.yml -# -# This is the jaeger-cassandra-schema Job which sets up the Cassandra schema for -# use by Jaeger -schema: - annotations: {} - image: jaegertracing/jaeger-cassandra-schema - imagePullSecrets: [] - pullPolicy: IfNotPresent - resources: {} - # limits: - # cpu: 500m - # memory: 512Mi - # requests: - # cpu: 256m - # memory: 128Mi - serviceAccount: - create: true - name: - podAnnotations: {} - podLabels: {} - securityContext: {} - podSecurityContext: {} - ## Deadline for cassandra schema creation job - activeDeadlineSeconds: 300 - extraEnv: [] - # - name: MODE - # value: prod - # - name: TRACE_TTL - # value: 172800 - # - name: DEPENDENCIES_TTL - # value: 0 - -# For configurable values of the elasticsearch if provisioned, please see: -# https://github.com/elastic/helm-charts/tree/master/elasticsearch#configuration -elasticsearch: {} - -ingester: - enabled: false - podSecurityContext: {} - securityContext: {} - annotations: {} - image: jaegertracing/jaeger-ingester - imagePullSecrets: [] - pullPolicy: IfNotPresent - dnsPolicy: ClusterFirst - cmdlineParams: {} - replicaCount: 1 - autoscaling: - enabled: false - minReplicas: 2 - maxReplicas: 10 - # targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 - service: - annotations: {} - # List of IP ranges that are allowed to access the load balancer (if supported) - loadBalancerSourceRanges: [] - type: ClusterIP - resources: {} - # limits: - # cpu: 1 - # memory: 1Gi - # requests: - # cpu: 500m - # memory: 512Mi - serviceAccount: - create: true - name: - nodeSelector: {} - tolerations: [] - affinity: {} - podAnnotations: {} - ## Additional pod labels - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - podLabels: {} - extraSecretMounts: [] - extraConfigmapMounts: [] - - serviceMonitor: - enabled: false - additionalLabels: {} - -agent: - podSecurityContext: {} - securityContext: {} - enabled: true - annotations: {} - image: jaegertracing/jaeger-agent - imagePullSecrets: [] - pullPolicy: IfNotPresent - cmdlineParams: {} - extraEnv: [] - daemonset: - useHostPort: false - service: - annotations: {} - # List of IP ranges that are allowed to access the load balancer (if supported) - loadBalancerSourceRanges: [] - type: ClusterIP - # zipkinThriftPort :accept zipkin.thrift over compact thrift protocol - zipkinThriftPort: 5775 - # compactPort: accept jaeger.thrift over compact thrift protocol - compactPort: 6831 - # binaryPort: accept jaeger.thrift over binary thrift protocol - binaryPort: 6832 - # samplingPort: (HTTP) serve configs, sampling strategies - samplingPort: 5778 - resources: {} - # limits: - # cpu: 500m - # memory: 512Mi - # requests: - # cpu: 256m - # memory: 128Mi - serviceAccount: - create: true - name: - nodeSelector: {} - tolerations: [] - affinity: {} - podAnnotations: {} - ## Additional pod labels - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - podLabels: {} - extraSecretMounts: [] - # - name: jaeger-tls - # mountPath: /tls - # subPath: "" - # secretName: jaeger-tls - # readOnly: true - extraConfigmapMounts: [] - # - name: jaeger-config - # mountPath: /config - # subPath: "" - # configMap: jaeger-config - # readOnly: true - useHostNetwork: false - dnsPolicy: ClusterFirst - priorityClassName: "" - - serviceMonitor: - enabled: false - additionalLabels: {} - -collector: - podSecurityContext: {} - securityContext: {} - enabled: true - annotations: {} - image: jaegertracing/jaeger-collector - imagePullSecrets: [] - pullPolicy: IfNotPresent - dnsPolicy: ClusterFirst - cmdlineParams: {} - replicaCount: 1 - autoscaling: - enabled: false - minReplicas: 2 - maxReplicas: 10 - # targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 - service: - annotations: {} - # List of IP ranges that are allowed to access the load balancer (if supported) - loadBalancerSourceRanges: [] - type: ClusterIP - grpc: - port: 14250 - # nodePort: - # httpPort: can accept spans directly from clients in jaeger.thrift format - http: - port: 14268 - # nodePort: - # can accept Zipkin spans in JSON or Thrift - zipkin: {} - # port: 9411 - # nodePort: - resources: {} - # limits: - # cpu: 1 - # memory: 1Gi - # requests: - # cpu: 500m - # memory: 512Mi - serviceAccount: - create: true - name: - nodeSelector: {} - tolerations: [] - affinity: {} - podAnnotations: {} - ## Additional pod labels - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - podLabels: {} - extraSecretMounts: [] - # - name: jaeger-tls - # mountPath: /tls - # subPath: "" - # secretName: jaeger-tls - # readOnly: true - extraConfigmapMounts: [] - # - name: jaeger-config - # mountPath: /config - # subPath: "" - # configMap: jaeger-config - # readOnly: true - # samplingConfig: |- - # { - # "service_strategies": [ - # { - # "service": "foo", - # "type": "probabilistic", - # "param": 0.8, - # "operation_strategies": [ - # { - # "operation": "op1", - # "type": "probabilistic", - # "param": 0.2 - # }, - # { - # "operation": "op2", - # "type": "probabilistic", - # "param": 0.4 - # } - # ] - # }, - # { - # "service": "bar", - # "type": "ratelimiting", - # "param": 5 - # } - # ], - # "default_strategy": { - # "type": "probabilistic", - # "param": 1 - # } - # } - priorityClassName: "" - serviceMonitor: - enabled: false - additionalLabels: {} - -query: - enabled: true - podSecurityContext: {} - securityContext: {} - agentSidecar: - enabled: true - annotations: {} - image: jaegertracing/jaeger-query - imagePullSecrets: [] - pullPolicy: IfNotPresent - dnsPolicy: ClusterFirst - cmdlineParams: {} - extraEnv: [] - replicaCount: 1 - service: - annotations: {} - type: ClusterIP - # List of IP ranges that are allowed to access the load balancer (if supported) - loadBalancerSourceRanges: [] - port: 80 - # Specify a specific node port when type is NodePort - # nodePort: 32500 - ingress: - enabled: false - annotations: {} - # Used to create an Ingress record. - # hosts: - # - chart-example.local - # annotations: - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # tls: - # Secrets must be manually created in the namespace. - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - resources: {} - # limits: - # cpu: 500m - # memory: 512Mi - # requests: - # cpu: 256m - # memory: 128Mi - serviceAccount: - create: true - name: - nodeSelector: {} - tolerations: [] - affinity: {} - podAnnotations: {} - ## Additional pod labels - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - podLabels: {} - extraConfigmapMounts: [] - # - name: jaeger-config - # mountPath: /config - # subPath: "" - # configMap: jaeger-config - # readOnly: true - priorityClassName: "" - serviceMonitor: - enabled: false - additionalLabels: {} - # config: |- - # { - # "dependencies": { - # "dagMaxNumServices": 200, - # "menuEnabled": true - # }, - # "archiveEnabled": true, - # "tracking": { - # "gaID": "UA-000000-2", - # "trackErrors": true - # } - # } - -spark: - enabled: false - annotations: {} - image: jaegertracing/spark-dependencies - imagePullSecrets: [] - tag: latest - pullPolicy: Always - cmdlineParams: {} - extraEnv: [] - schedule: "49 23 * * *" - successfulJobsHistoryLimit: 5 - failedJobsHistoryLimit: 5 - resources: {} - # limits: - # cpu: 500m - # memory: 512Mi - # requests: - # cpu: 256m - # memory: 128Mi - serviceAccount: - create: true - name: - nodeSelector: {} - tolerations: [] - affinity: {} - extraSecretMounts: [] - extraConfigmapMounts: [] - ## Additional pod labels - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - podLabels: {} - -esIndexCleaner: - enabled: false - securityContext: - runAsUser: 1000 - podSecurityContext: - runAsUser: 1000 - annotations: {} - image: jaegertracing/jaeger-es-index-cleaner - imagePullSecrets: [] - tag: latest - pullPolicy: Always - cmdlineParams: {} - extraEnv: [] - schedule: "55 23 * * *" - successfulJobsHistoryLimit: 3 - failedJobsHistoryLimit: 3 - resources: {} - # limits: - # cpu: 500m - # memory: 512Mi - # requests: - # cpu: 256m - # memory: 128Mi - numberOfDays: 7 - serviceAccount: - create: true - name: - nodeSelector: {} - tolerations: [] - affinity: {} - extraSecretMounts: [] - extraConfigmapMounts: [] - podAnnotations: {} - ## Additional pod labels - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - podLabels: {} -# End: Default values for the various components of Jaeger - -hotrod: - enabled: false - podSecurityContext: {} - securityContext: {} - replicaCount: 1 - image: - repository: jaegertracing/example-hotrod - pullPolicy: Always - pullSecrets: [] - service: - annotations: {} - name: hotrod - type: ClusterIP - # List of IP ranges that are allowed to access the load balancer (if supported) - loadBalancerSourceRanges: [] - port: 80 - ingress: - enabled: false - # Used to create Ingress record (should be used with service.type: ClusterIP). - hosts: - - chart-example.local - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - tls: - # Secrets must be manually created in the namespace. - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - serviceAccount: - create: true - name: - nodeSelector: {} - tolerations: [] - affinity: {} - tracing: - host: null - port: 6831 diff --git a/rds/base/charts/layer0_describo/.helmignore b/rds/base/charts/layer0_describo/.helmignore deleted file mode 100644 index 50af031..0000000 --- a/rds/base/charts/layer0_describo/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/rds/base/charts/layer0_describo/Chart.lock b/rds/base/charts/layer0_describo/Chart.lock deleted file mode 100644 index 0a9e907..0000000 --- a/rds/base/charts/layer0_describo/Chart.lock +++ /dev/null @@ -1,9 +0,0 @@ -dependencies: -- name: postgresql - repository: file://../postgresql - version: 10.14.3 -- name: common - repository: file://../common - version: 0.1.2 -digest: sha256:812d36067d088cad7eeb94005e23171d9532f1dc2b8f23bd633db1b795c4a577 -generated: "2023-02-07T10:30:53.443729026+01:00" diff --git a/rds/base/charts/layer0_describo/Chart.yaml b/rds/base/charts/layer0_describo/Chart.yaml deleted file mode 100644 index ded3346..0000000 --- a/rds/base/charts/layer0_describo/Chart.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v2 -appVersion: "1.0" -description: A Helm chart for Kubernetes -name: layer0-describo -version: 0.2.9 -home: https://www.research-data-services.org/ -type: application -keywords: - - research - - data - - services - - describo -maintainers: - - email: peter.heiss@uni-muenster.de - name: Heiss -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS -icon: https://www.research-data-services.org/img/sciebo.png -dependencies: - - name: postgresql - version: 10.14.3 - repository: file://../postgresql - tags: - - storage - - name: common - version: ^0.1.0 - repository: file://../common - alias: layer0-describo-common - diff --git a/rds/base/charts/layer0_describo/charts/common-0.1.2.tgz b/rds/base/charts/layer0_describo/charts/common-0.1.2.tgz deleted file mode 100644 index 45c8bc2be2ba0722f4c15080e9c016990f4461c8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 995 zcmV<9104JxiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%*a=`DhecALMbT~%7Xf-&(9&4q zMj{Dv7`Vwyo%lnczXh41qzT7`s;DUsnARt3eJ&TWWp%=(ZJ z88`O*SW=Qtd8jjg5=xxv{_V}A_Q_~ra15!OT45J#UgZ(+0Y77ZH&FjkTK7L;W>P`u z{7(^@R4+1A#L2wMcJNI9pI@8@t^OZf49*Vy{}#lSOTWi%k#ehm5(HzlK?^byF+$PO zY`Fxf!ZeQ%yj8jIQtH7wh-66MmBU-D$pd~T(i|N(f)Y-eQ-UjP@ZwZYMe4!Hdw6_g zJ^%5MEth?Wa3<9g*ZsBh#9}NR*~O0{Ll|EH-vr~8sIF|Zlcaa3SHg{foIw}6?dPgf z3stnWAQ8916`bFJ^n|QbaU^hpzMXqbu~KegcD2j0--=PqXK&nM zR{gG+g`gd(1A<)v+kn=;<*YTOHQ!jNXa?S?^H1IQ)Ojtn_A;JS$(I3AhnvCHQ{`rl zVMmsog{)$W&V5iylPFG4SF38Vs zDr8p)b}Dw|)+mi;j#=*L2edJMoTGiPlJF&d8&3XeA(8$?Wa(31jiu~bOG@1YLyJ_D zLv0z|hFPql=XF8eg0ov%MA!p(O^erJc7a_JUp;641r7OC3#tXiiwySQvLBoMuDbTR zu8s1g&~0}buaQq%_pQ$V_5F`0m}W9o+T!cSc<%pibUteT|6K-`hx^}K&@ucZh|nqr zq+wM7@Q|Q_X)e>KIJS)l??sG`vt#%=>@g zl7+kL2}II5#$!o-`CO&X`1CjHm(Plk#D4LphHkF>t)r<3?{fn)nWAGo?j8*5@u|3H zJx*Eit*wk%?+axQtNvD|M?sGd_2rj?h2+vmWR`2l^+| Rp8)^>|NlA_9oYaD008UA=SKhl diff --git a/rds/base/charts/layer0_describo/charts/postgresql-10.14.3.tgz b/rds/base/charts/layer0_describo/charts/postgresql-10.14.3.tgz deleted file mode 100644 index db34359a1aa7e3d4f60da2de47748bd2541093af..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 53727 zcmV)eK&HPRiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POvJciXnID2(@SeF|J9y|H^u$#QI`Tfdw0JBsb5UbP(^%Sq3E zdb%8lgd}WJ1Pg$6)HKg$e-_?IfN!E?J1^bh+PjfSU}i7?27|$1CMJweDPn(w-J=<# zyt9Dw@Vke7c6WDo5BK-wzq`A;`G0%+2fN?(_74vBU-S;1?;n1*+k3v>+xrgeJ}@1n zPr^8)-|gNTSH5xI$OEH@aL6%_6=y6A&r$l(|=)Pga7hbY4&>Vw<87L4Qc z&t9+7+wbhQ0u-YtK#`9T>$f}rLkw9TWMj+o$$UlR=J5E z1&{_zG%XG>jC|B-&4_5-jPscFyWJ_~vt-=y$-FzpJc4s<8pkO@-8p0&(ezWstrqr0 z;|v&GK*E8HA{~zz-8aacd57#37ClmC(=};!yOddHJ6f#c7wnQtzztD4^K?&j2w2 zZVoBOQD;Ka3eJa?dS?;NNJ4!z+-mr(|Mddm-yrHa4L8;9?(RC-hYq3BZYvvfyJCnx zZ++=``dCjv{)fcBd0-q%U2vJb42ClObQM@Zfbw z#xMjiq;QTnqOA4giFtV}7f^ubaEfvzh9QCs?SP1I1o#Ycz-O3&I~<09+#*VGAl{=w zDRP_MCGLXCsB5QlIarX?zf?W;GJ zXo?x9iyignFbTsE@+sm>DtC+%3a98OgiJKAB{2P`1fs!r94Ms>qWWV+T^pra-Bbij zewN~x0VpT~kWyFz(Wcix8`}DPo!D(c3s^f0F~04;%@EQ<)&6AqJ^kc%MoA4rbNb2RQTnc=jq+Q|7TQNr z4|7GbEwcn&Z;TWkaVmxvC!##ZFbo%&h*lb1M~a-zBnd+~(m9&PA>;^bNr7(meo`P) zBt^f(A;pP}Op=<>VE~rUB0e>yL!imS%ArCZIEBY34#@%xgwRxTi&LoW0!&~HQ~|l; zw;QvC!~!D}PAPX&#Ik`FXeq@qq>Ab@I7T4@gCGE*`pF4^VJI;uj3@vU>D{XUX;R zzjcrV8&rYc66D5|jFHw5#-a>Ub;R;3kPD*4Z&N@IjQ~aIJk@CWU;;yi>IgExj`Y8r zWJ665li4jw+ODx_7)m5~fQ1OfbvPlNGB6PTSqGb_ZBXH8f+Nfq?xc5CgZ#wTmKM8^ z(n|DBO_ZT%k{Ot0$+)8oB+_#6Z-2!WYarkJ5VAEOCOLM0%d4Z=IPV9x~68NV?D&xAN+{MimbA(NEL;-`}f z!iN+w6!B*YoHNXBk};wY;)r!H=?27SU9n1g(*y^oD>1O{lb9k;Fce2qPrXZ*=9Jbx zuyH9=Z(?QW4Htl!Hfo(&i2u9}s+C&Pq4R`s(F=1JB@%{Dkz4}wB$bO%41LsT)-Vp) z4eO@c7%wJ)mrnhzXo+f^7gKx-Ir2<*ceUF60nX#lNZNQEtvfC#+_Js0uQ*MR=+*^E zz?~d{A-+N43qwdRl{lIZI#=2hi9krEswcoH2Rxw>1Fr_7pM}is5(+K`=cj6DPsOUP z*(Td)2$Eloz!q>K%x!sSZPdi)Te(jeB09&6sg>(!2BWFk3zEACQPHvDk67()bQLfs zNyKA(NO74?uq5MYXY zDgU;FV(&vHmckjLNG}I+27;R(g|2F7e=pa@_Y?hxmL35Sn{IGN=uMM_vDm7d6nA?> zm-n28xWc^|^i<$Cho7zkO)vN61eo<_mB{B91=rB{PBP;<|Jvm54z8=k!=wN90=L;89>N2uFRjrI?Ys z$gCGq4o^rJAS#AjKq9^NRp3&%h66HWrLl+JO40%;8S-&3*n?SO=d^;vIdSRcH{ z0q~OdefjTe@E7nC4!ocZ+Q6IaX)}x>NYINkrQt$Aog|^;|C<;^qZyuXa5uyL49p+{ z%=gviI#>uX;!7%Uz`&MZVT!t0lY+(@)@ zj3cGQ2x7E8MS?vi*`TsD;9cxEGR%{Z<2XcKibrnf zS`Jk?OG=0*$Y1y&`k9a$mQFQm-(=}PYS_(1Qw&zc_%WIgiU6SiPB@}~aY(t+!(0T$ z{4pd!QBK@j7@DqZ)Yn;gHiX)XW(bVRMgZ;CQ$#i^T1IA~2k!$UQuq>&X2d|zx4 z?$5mJy|&+aP=Qu6OTE+B+#QDdtvKEkp&A<4QVUs*etpCig$tom=*fqDSFxC+c6EbG zo=_O^%Mfp}btnOmo?1vDMiC4a_5p^|fR5OB$`4AG%T-RB{g~|Pl=?#3WlOMhHIP(V zhW1MO1hjKmdysJA$qk`IlLyYp4T_BRC1$8G!5IM7e$|mm!_-K$Yy|lv@=?rLS84uT zF@n-br{7uABxZ3(b)L``_)JMw{RRpm3=N8e4)}F&d2xF2x?lVzl^YaOVJo9LX09P!g)Ms*%$fqR1usBf%5} z>L_b8wAxF@&^HZMkiew?BvxSY;}wqN0r3{i!4PawJKrZyS^`QbaR!TZ=#!gkwvStR z1$mZ~KU}IP8!tVKs;DR?kgmhPMKT{N^M-hB%CYoE1q`-`{23(?N!SsY&oP(w9_y{t z`!JWL_zoB-)k|9w`rti@-tU0-6wL`o*D#L5h4uFx#T<#hL*m0w8zjhN^1gzYD4CBk z%%x4!ucY-v%CZ@}MGn0-K&{Om$@32(@usq~rS&Cp&-H9(zVB2JC>p4LOHp>DR3>1( zm%^qa)+M9q!r&H0J_>9|LWm0CR@p5$nuf>-Z#~Gxp2J8ZpF|PzxjqhqVJN%ZThiM} zg#SnkSZ3ftpx&pz1=R@pGk_!GWWgQya{gp+`(-OZBG*z;>N-)onK(U>lyB3~4S>!3 zKIoMgOiMg2rKtQz=deqYh~qi()Y9tR!LT#q^YF>*w@2QugEQ~!^#Q zWTMxGi#Jy%eQ?TwpAMP-aHva{l+vLply?Afqofb!i)-thAj0n6R0VN+rznxEvta$J z$w7R=Pyp`4F0#z+z%1(NxA$TXsrO_)WGMR}ipq6YA~1dp+l2*f6`$JfI3#1^)_i#~ zI6gn=%!4Ot0gt90^o*B=CoMB1@+O!v?$IOyTMQxTLiE3+K(A&`Zi}+qVFPT*?PwAs zssu5`w>U&o#DsQ~x^!U6x#9hzFhYw7kI#@t3E`gUSBDdB>oeDa)K9x~43&(X!m9H% zw5OsMAI2d@0KAe~o-8f8UFc3E^H{h+3ufO-NN1LsBYIM#Zv~=~0VXFP<^W5K0iH~d zbVMVQwDgXHMgPpBb6w<$OxkHlV?_$blG62{N;ML(U|Yb#0LGLeuanVrE@z)hW>!xs$2F;n{9{b> z)Pn$1Z8dy^Migm0#a&( zcG_u#c`%kq32$Z=_%QTRk2Yj|d3=yBqWkrxsepun3@GWR4x zkMJ3yp4h-jElM}Y0wgGM`D=5|u-EV$0o_~XuHG{y)ZICh9_92_8I#7!(?DKf9H$=y zOQpF?inlP?D%tUXS_p+3HlP@t}WVe_XOz!V`|JdvF4u9CKQ1!97%H; z$lNm+U?^f(^rY=Mxt*h4^zI#@Hvoo2x=Gr@jL-^>6&hB$S5_tD8LAnOIXyeIb%}-T z1M(A&Qr8)0M7J_nrASh9Qw5^btk4iq@p?<{%vdZS%u-LwT@YeIxpP!3tM%P$J>X#f z`JSA7Nr1UyyI)V!6JT&8b}cRW+db%&uR0-_id9iE|BOt{`Zm+=QcJW|uIv~#1$LxQ z49uMn4KE~9Pv~(mqS*xz!T69&rRcEmSRiUq9b@KKV(pQ`s?sO9Gb* zTfkLYCuyfsMNNc`?2I^rQ8+2iBRPT`3aGMI^lybhmnp*3Rh+X12fE_VIgZW|V{nQX z&_5*oA-YAObovq-z3c)~V%)@902Cnf0iu-9@-8~V5gJl7!5_etxvnKtA&Ct~2*m2+ zmf0}jN#XF{0aL-XkW8=e9Q{cm1kxX7KQEAp%^Txz9@_)jl&suokK~4TNRikdo#8Qs z6e9-IYeBns55n}rmh@ip7!rUu5}z2)of?$G?1OeZm2D}fxd(3``_u3`sahU&x6?k{sxK`Rb83osHoonv+}f6Aq<4<)~x|DVsSL zDybB+@CzLPUF?lq!4D>;^%I$T6N^)C|8cFQtH2^&__c=vGi>r zQNV!tSG(*;1ANw0LCVi4V4BT}x^oJl_>f zUs6c5{p@%!EN-)mBW3{OyyJ?jz>-*NJx1}Z|wJe zw=2|;-}(a1?_IIG45IgWfZDckIs`BXC}L7ujkFzHz*N-8Qk{I|Sl#@l97NjtBg)s& z79b%_04D_iYW=dVFH`BtVAKt{70!<4MEi`6aC{-vcpL?VCM6RWs4_9$3#Q=S@ddaP zy98ZIFkkzgLF&&^=_=vlLMIET#}}e9QHRq8mH1aMtgJ%negTH|(PfHe2?#~mHRPOv z0p}EtrNU0Y9CCjK;8bjIc#bPht12K)csrAF_9?Kdxgp5`fhe?ior|G~plhBybKsc(^M{?H#v-BCMy5hL44 z&^RrL_eP}?zx&2p>U3BN$2VW)8isw4y&x1^7`<_ZU=RvnqU-4!hEll7Uum_ztdyz8 z>FaVwP$P1jU=vx42hnYE8(3B~B7urkVQ+5Jm+I8p%&s#6gI6$wk&mdfa9x;k%;Fqt zc4;(ShYUBo2yw9{;b>~!b)N`;o*>6=k|D2>A9m0HJD@<$l|mO!-C%QZ1Ii$W77I>? zk|SVjSaLcPdkvcx($B_b+k5L~YM!G`MNX887(wOq{E$pFfaMX5XUNYsF?JIxc`UY} z0>~AGlL_{<53cc%S9@j^nnCa-rbtxGe49m68r<>leZ-h&xu9itJ)~*dGi11Jkyqa& zrP^ah5#%X?JRGN9;AO2y=ljwjFp}^t)m7Mm(iM>Q@f6!#ecwlke$&60IsLAX+=~^d zW4<4fB=Gdf6!j*UqB|Id-6s?=PO;BD4Q4{93K^cz-DtWM{`2ef!eD@dLF8b zR1#Eb3JcV|tC%o`$Kk@9@T9ggeXc9RLMcq(eK$b2T{fG`CG-8^{`q_5rYEl_@tNEJ z{HBp%#uD`VR*4Bso6OYyeUZ9-bY%_J-R~W4o5&v$pha>u(5#UCQ-gedc(A`Mou{fl4}`N7tq5Hh0;PRHc2xCZ*eHu+e&YP6FokZ9iIut_XRYnOE^uC{H1OQm+Dg~3Gd~1@Z!Y_kc}G>0Vu7$*%hWOJdFs|S5qo4+Dix3_fr4L zf-^}B>WWc*VCZMR#oiPe@@(yR~p(Pn+p*303$qvf6JK-7MCM zFw{r+Fv^@T-)B+e6o+Ne_dAj;%e?{BZQzNJQaD1vjvz6;5pC`(r8lGXr9nN6O(dW( zNg{Pgr;!Wd4q#+QdB7{Tu$}apwLFSZ4)LP-ri)#>G~Xsqb1VWAVuP>c^9$q-nf3^SG} zVv7UIhN7JI|F8Y(Khhfd_I2B9msM)Fck}|1UR5)9nWa7<1Qw2_DYPWg6o4%&lE=0f zQW{Z|gy9Z|NCBC=01hxS(OnqgJHVe2lAd*#wLQg*Xa|6;X}l+f@8H+bP8yRO7=;pm z*T0zfZt2^2p`dO%u+5n7puP6=aoCHX9%0T`N#EY6P5&MU%q6uhqiD2+6#T>nf z{Ayt&1+Lxym*|fKv3#ue96C{}4}R2wwX`KQ+aP&{nMuvMy^ljG3gr|6Bl9COoLIuM z5P?$+lJqWQwFuK%fWeZ+|B)DU)Hw4_-d5>@`9kQ#*$s7F(>Oh*p;%1CoX4C=#f8~lik_&=46b4Ur6iQM(wPRw5br)wGH)fhv#Byt`dfACdFqo(iY%&&zYg91sNC2QNrS^5a15Pb9 z$3QcM-s{j0C3o-`neg{QWW1k28oXb1ldCTCi#;B?Ro*CF$QYhR^5$|x0<+nbe;ax{ z7zG}TI8NVWwvt@?i-N-9RK#&ZZrQm0hAb;Eq7MX>g+<+rNP#6kgdU?E;=cug#mgME zCh$wHkBcRh;3(2A)x~Ux!U?MD`6@R8lP?cLGr&mE?^`P9y55n91_@ z4O;X;+wC{BhdlVFC$!ME-3nE9g+}NwVD;_Lg-lZ#vcIe?x+mwmHlHAlCA>H_mP~AY`?zvl*r^wUJK90IsxQ;+f!Q7F zJ7&*hcceOru2WP0q&!g?hG42KQAW1jQAR5#Vd~m*W&QpP zoiFz4Ty}IuL`u9xSLKkE*KdX-7zwq#Br2G?o}&v`mesUUC0BHRox@mc$*ds4L3%Q2 z=|^D8@`=+RGMAn#rf})BYjz}H^S_a9oK1tX{KEc^eLJBj#+`&xZWBE@)Vu;;^I-`!t&YegWlfr{cKyW2~WB5#!f3zdeUv1*vmO- zpLk1MlW7wiv~F}e2arucrf0>KVAB#!L1xG2l`yj+d7!N{y+FUHE$2>-^JnYsc1503 z$beJ&up+mWc0zwR4YI$~Z>lpK|JK{;0>f(e);XqacGo$seC7LVr?VSuvg;f6xwqNN zsL$=SbHsmLyX|FdDQ>w-oAdQ(`K-1|oAOJ#DY)<9lw!3(%YF z$M4DKd+x{`k{fQzA7^B&y)n-bBH6>0Vn0BIEvQG^&QbY(R}BQJo~v451ds@e!rlzI2Dgj6A~ zGl#eo+}9>jPQg;cNO8z zezJC_N`2na62-Vj1yZD@ugGcQl45DlKAFdf%#@>V7QV>NE#MEtosZ|TbmT4*@^<$NlH=+{xyg+g#)7qnUg z-UwyqG@8o$eO&qfi@mA3d!$2eN93;PHe9^S?@}YZ{!jGH0&q;CXB_B&-f1)exp9^$ zv8;>Mz_@y9YUdW<2&qP^=R5j)nVB)wYi6H1Y%!<0f~BAY(gayTi?r znVTC4AH>|lGFy*KF2vFu>A=40B{fXjiOp0L>b`uPZKo4Z zLkVU;x`0Ph%U$y0C*7O6%Z4PdZjzXsNp@qOv5ZEAR^2RsT$`5kwFinhq8KW7U=o=N zDsmvmRO5u`46ZxUQJ6|)Ro?x4r9GKnC0xbA!E?lRz#Y=j$z&NFI!28pEMt`s-3rY* zMM%cb9n~HgBSwtkJLREl^4}<&g)Y+l!e@vf2Uz6zuUGQOB%p*LlLT8`4uilFy@i~F z)qT0dMUfI2YL&{6U4c{f3C$n)GaKC@b^ukK| z3X6x%4IF3Nz!2Y}NQ`Njs1`O!s(;(Z}$ zi1n?iir4^Q7#^b#F3dgpQ}qr6;w51Et>8ivh_Q1wU)^k98Hf&VV4#@z2dje7)|jgq zMQldG0Q{t00G_^S3W_Ci>SmxuiC!1#K(*|@OK%dFbbyQ!AT={PC_wL^1%S(!J`nHn zjqHQouJo>V3GRd5w>rp8?b1>1e5|ar+Bk0pbLmKL2ByJSZw9F0Xm19r;dsvjYdJ5< zQZY3j@Vku%{NZ}zJspgnWxzKW=xO27k?wx2uD04(ZwhtkXm1Lr!FX>9s^N%l3a;Up zFMw;gZyJyKgU1^5CR(11yEC$upv=x=t`BK3oX&t&u~P1$h$?Vq&+{VK!cx*Isa6X3 z(&1$ha&gkO$|`EuGG_7Fs2KHvhdGB79u|^1i;89sW8&&8-{=ZJFyZ7iijaz>WPasR zvN04+Jcg$c3KWfqay*fV6|&O>8&DOtn4$@yBN>V02*)!-nQb0YTLz>`)4(T)Ew{40Pl8J5?3!L%!4?IS2x*PHde+KzU0y$I8rcv;sjc%uDW1 zJOLC1n5A$VgnTJCo!fDR+|$;UI_JpxP-tn)r%+nlg_jwO&qKhR;tM@}7eqMVHtW4vgB4yJvlPm!(8G$+YYkisa9zQ;(O0OQIM zVCIusX~P{aERvc~k{OH4`M+g9O4Ex~@t_F?6ZsL0WN)UCAUi@R>OiH+RA(_W)o9#0 zVz3EjG{LK?rqLD^Agzt9f?HQv1vN#o6LB9s`B-8S@`!y5#c++EAioZ4SZ4t_7 znR3tIG%F-+__Pn=>9v)q~}{sZ)ER1-q`pf|T)h3UzKsBtM6~SU zyaSFI&C=VYL(vp7P91OX6Qh92BES@>g%T5nWzd>BIHphyBo3!FAjH=#JfA0AB^!cM zCeIxy5?v%yh-}vYk5k{C8XTe!P)Wd-fKq#4mIkG?>Z^Tqx-uxIBfV}aZuWIZxDF=z zz2QzDaX+M_+WVv28}bOTX5?55uN**U2E z+v*)h#LX9%y6P`zp$c56-F`Z0?5b5$M`;4*dS7)c)fa0mGtstn@p^^hj*_paS?;i;ggRDI|IXgMJ0zoH$ zDhtM7Bs*^h91TV%;Mbo|E(8RffuS>lEQNNRChXlxtM7nkM{h1JPL8ggZG)>^Ws8z) zhX1sxZG)4u(FxcECl|+p0`c{FybwF>pDy2=R{#NlUhNI-Vq1VCu=UJH?cHZPApN5! z{xJM~w%yK{G0(Bga_Vz^`2a|m^c-xT4PKp`wew${)uer4h2b_dw_O}rLn|@89=v^h zvINt}ii4MO2S-3cZl^XJXM9wdJnSr(+9k6zW2WU5S|*}oY$UYuXtz*#S#r(_$4@8! zr+H_*F^8|OPyT!O=JM*~^7{C6GgHpN*6N~h}$ z0Nm@Gy#f4HPuv@TT>b350nqhM;Tr&6?>s&|W67V%egSX8jwsF-F%o6fF{64HQxYS} zF=FjL_$VhsI~!YXb>hkNn+1i*{5ukgdXIT1KMc~;W7)?Eq4TyipFi#7QJDldE1^m& zEk~5ypDDv&u|yRwvPHfZ`!VNDHI+F^3t?o%p3E(5(eAvbC<+jjC_)@qY*i%5cjq{2 z_d&1h3;fWQ>U7Dsw-M$7?rYpmKYnW2{~G?KN8wGlm$v#+T@?wyWm-KgWbIHz(V8nk zrMGsa@u5}ryK2&;=J_VmrfhUuQzc(fiWQ=f>DLY(h9eQxKdnYeAuxkV0M47iUJ&QG|fx2lmdA@G6m5{R?ct` zpr|-|rIOUvwuanLjv=2ZbZJYwhI1?Qb|ELmeHNN^dajBm`5qOUACTQYcY)-^@(e~( z<(EkAB1DZ9QLm@YHFTNL9B=|IQ!~zly{06Im#r@5li_#2{r_`3M?ViPufWCN{G<;)e$-wo z9eJYg=~GL6eRpy>I(>6t7kDS8Er~>#!EjhsVi3nxq1F#SfT8k@8Ozit@;>L?42Mc4 z_@WNL42+S?f`a0ZEKmS`_@UMM_|XG+0y^*1{xraF8WF~^e@=qTtn=wp>na5_g8~wY zGC(*2Sw(q^ScX1Rb}ObXeySQO)kk1bQkiHR8BB7E=pDtJqe$K`?zdW2%nnIy*ym<7scM?R+}2k1Hh8)X{sIw>0>Qm~(PjW3ow5f-D*)EwY`xaG z`qHGqB#>UnD%C%ZrjjK$$r$-O1XILS3D3*iXT(6!-cp_PiYEB<33wrZaoln3hB#sz zMm~C(uO`VE7%P#=2fQGOzKTmgfX2zxAtylhAn$Kd~pSpwet1g?HQ0mC=P{{cJ? zj3Jw~TBi{pG*IsMX7xw8;|z22LM@9-Q-t)LUp;(UQuudC%+sVky1bR#r;8#^7jl*C zu-VemG>JNbNHIiE$P~{kmjvx%rS2-D0Ni4zuDv^MDVDdm_P!Ys%C%n#F?of)YTjAat>` zIw7i>c|)aE_Z07dr$~HAB96lxnicq@5NKX`A3uVpSogjBazD;llM@)wd2SYe8YV}C zgDvz2*h;0WH6s#Z-vXWO>_dASNC;O%%0MZf?DWi8K|qs8PY9(jg5jId)$7ZX(e>c? z{Pf~_I2et7eRFyI^68c>R`rdVMk1_wHXF|rJ()cM{>4Znb~7*AA3Fi$(7G$)rHAmQ zEuY%pFPY`|a36SHfP505ZHI-G45*^X;-~aEt7gyF#F$!s2qt6+&Xp)kT_|Xh7ohHf zV45b%HI_FzXoly}Iq*Er7r?{fFCCB+bRqX1rGHc? z*Ab3tb={3lSC(Op=IpoK-#d&$ zp0ExyiJQec{l};Fc7cT9o6D;l5$m95G4f@~c8Sk~P5abNb4WJs`)#9Z;7R#XZKSj) zF4t#EPPNMgl^zQA^na>50C=8c#?zD=U(tlORDNfu*;nyuhug)QtCK!BNkBVo` z>G(46HaS)TlR2A{73g_`;(c3 zjYs&p13Y7r8RN~jgJ1s?NN<@g5w~V^2nKi)Lhm3AnhgvtOulg6y=H}8c1{aMCI zZ|_BCx3k;neMOzVvZ7PH?<-;3Eevr0Ia2fqAfDNZ=j?BHkVZI~vJO>gNw45E8*WOU zUaM*`X}SXTX^rE8Qv3h)423bGti$8*0c_0m_W!*XyZd`N`~Tr?Z{z>-S)Pv{yFY+i zJnzexixV6oA^%>^1zY?X>VqG;YBF?xXq|kBjZr+Zt{g~{d#5D}im|M2*gA7Yi8?PU zAa76GhYjiW0nSkx1LiNlX%hM1@VWen=c8mY!5=`|%YcdL>ZK&=3z9I!Aq4FL{E@&= zU6_P%EQ#;5enkqpEYAfF(GUj4$cG6-GPa`~ia|Dcf>9W#YhW_AEDF+n#MXGBfJ(URiFPpO~t!aSSwYOr5BR&D`@0s_#5L=EJ{i(VgW55~! z1<*^(r>0mAS4L1GK!)*Cio5zZ|ruAsNFkd#(Q72CGwV4xk&h!ntsG@76fb?%k@a31G`?IowG8 z+I_%_vo%rG+OBPM#X@@T=2tDy_hrPfyu=Ak=PDzds&(6PSvzC9sNGue zr#$;}M{jxWFJa2|T3k`5ed!KUM`Mt|qY)KjLWXR@QCa+{Ej$63tJiFMrzIot-eIvt z;9#nQZ!rMHRxKcN1-nFwPZ5^{|3t}Lv8kONl!Pb}!gtF^-`*kUoS|sSXWRNnB^B0W z{4ZHFB;+QELHoAX25ke++Ed7%+tTW6i(^?o)gr~FQoiZ@f)?N}Fh1N5kY6rPMe_z> zJcAd>Tv1#lF!Mvw&JL@Gm-N$3t^4&$p8jcVKuVSuH3&K-_5KJoerDWuvm+*Nz4{J+ zN_QuvRq{BSVzBF`bFXYT=}DIkf_B+vv#pLOw(_&Mu+!WIZ8ZklptlR!zo13i?wI1q zPJ0_PUqtOe(P$W~-TUkI`U<_>u$RB7-o0n1+A$&;b+D}vB#<^Z%MB@ z17xM8jL8$Yp2R1V*RsK}yESUPRijzU?FvgoqX;g+)=Y?hS zTxnjU^_H)7PSNUFQ-oN_tk-#852bk58$xVvi$+W`YQ5h6Sj5|wf-N40&4E1Ku4GuQ zq}K%B66lpM8VLU8whfxdcHE^g$r6U_ZPBPf=OhfBIK`blBD6V&8?aMSymI@X+1@Ef z|B?V~bq!QyO4=sfzA9Y4@+{HavSK^TY;m)%shb4n&{!*LiMMMWotMrZw@eDW%(&(Z z;fi`?Lpf*ob80@+pf=1xAGi#_bq}r?5JwHTXO~@pdF9m_@Xl0x93~cKj>0mBu{CSt zO&k;`{~LSVb0VwPniK_uI_?q*wmLuI5V6kdkc>flB7S#sBfGs_UTS(h8$(l~xL!Gk zv+vWN$FTfU#YkU&LhD!q_)mq$_}Q`QWUm*I;ytnx1aXLr?4q zrs-v3MULg=c{5&=tk$KZ8Vma>9jfctU1>4aTwhy@r!H~1$SlV7Y{^!|4xw?RYA8ZI z@Ru2PrK@44;C8eZro3AbPp>f(U>DjwV2SfI_zV1z5N>=0+QC?Scv(@=LaLkwoOxj< zc=+@QFc$iV@+w$7WJf6VonS1yL5n42<#xMcyb+Xt4)A8SOGIpYGB^oZZBYg6`Svi( ztLKGa?IZG|{n2v8xDP*^TMn7?j=AfSJ3X@lgGw&`2E2)TJI3~Qn8)2tDs4~zeg}X3 zrK^+_cZ)6&W=CWm<51>51jdsC;D{5UrOG=bV2&7rQ?w%;Y<(zGqT;Y#c;r1#(jx>7 zjDh}3btkLz3yfu)>g-+VOm>lU!T`q3dU-ArLpT!X{#arbKQKfdvTBGzry&WqUbc(e z6b1i9a0J@_6Sb|Po^>fCEt?nS{}a6%oV`66fp>$m)8oO_>6?rG|3vcW+En>V_IQJ( z@ttm&&UOgM#OPzv4-1@5fas-8Let>)VhNDftw11Ctwu<_(^)4O;#`hN8Idf2@e0GP zdPG>di5S!!t9&YawxmC~x=S;U`NA!g&~SUZ`m;)Cv%M`>n2f-F+WZ}0m6K}QKS=_7 z8I@W3w~Ps&f%m5Pdr9YetIm6%6J|0vS7H5?@2bAKs`Ik|2-Ni|a0eIKrCeY8K06)^ zRh4rUL4QI7$Yp6)bO>#gdPUMB^RC=`TntA;%dH+WQhGm zHzt9X2F%p&o`_B&6#t2%sd|SIyH{6TosEE}atMo`_B{wj(h$h+^5^HP^qCZg6@6wa z2TrFIPwdkxAGt2HKaaC2omB zD!_O;5uwe>l5dDf6imuHnMveTmFRmByX zRRU=ROP@>yNKt?yv6*2HU^Bl83ucy*^~D_{&MH%$KyZ5v!`nlQ^-=vXRHO0!J@e#< zUdf8%j(SVV3`{3ksr2&cBP%2htCl#qbd5E<{n8%lo98i~()%Cjc|d0Y=l8z>vLycN z-oZgW{_ElM-X{LjXL+n!-e1LWOzt*$`Js$l9AJ!ffT=#X?X_-j6!bG&d~1$43?PU7 z7SM?rnqMDxj<}q3UFFyP)FP1Oi~3k{qf345Fb<;ts!Ml;P)>z2TTxTzN6QK{t$MWf*?*SltAI|F@ECY`t? z3436vhmAY-CB-?&eSN&5!|B|h#g0k2WnJNs%xVNa?K3eePFWg8HOu2=^bCOu`~_G9 zZ;-EVU%mv-?37>6Qh?b3MNM71YF4u@#7NgrtpA_mvG!|K3V`VSPSE|KdT~Fo z{9JMic&Q7__M@WUw|97u-~aD#*8k7*WCG1vu_-*3ag&8y@I0^Vity6d z!fpiNjjZ`fpVIm7I$_>d{a>p8_j>yU{r~x9{(qLIf&Q;jM|)Y&X-~P!O6BV#o9(ba zLh=93^v_S$_Q3I}&Fu=xeUBg6tY^C|Z*~LU)NY_|A5c3y)v%PigE5XET^y(T3a!S+ zkk59&Q;n`>0>oM%w;AiI#idFf5LgVWH^8=yY+-EzcQEi00BfcBU{0AX+JwczkWtIzc z6I#V;RvsLSkuRFc7qRa23K%9BH*oTWpg-y>xDoERD+}9U*H4FflsWHei7Tt_ut{b# zP^suWJw0Ze$JWpnk0{j#|LFbrLcidUP7xo<*SYcxg~;cGE|~>$$o-ibiKP<(07^pC z2Ra(-W~u$ReM;AVox??4c)Gs^ux$N*v7cZ6U+f)j{69a-lUr;`GyDj#pq70nVUMF3 zlpGQHFot6sVvdVxfzq0Kr?0or&Ed<3bSU2C!L8|1Bx5}#-LNnc5lx`lhZ}lW!pL< ztheuylIc=f(0hXTs zzR2bO-rMaR>~7Zo&+&+n@-$}gAPuG7e+jl2n%^RNMCLK12(!8O(j7KR!B?OZG*IDe)q&z$ z9HJ=-`d|V>hFU;J3`qCd&wO+G@XWkXmnhReV=>4WM-f+X6^=rP=jm4&eB>C@tT-kA zLOw@XbkhTbp#$VTYj}lroue|cSCYbdvqD|h8^4k1!CC44 z)(VGnv7&;TFbJ?v5MY?6+3XYlMw*S%S(>s&NLx+*)LP!XC2kXHGCa*TrV@@SABSMe z@O2wJwTS(3a~EXul&}AkJiw}-JQ?zm?Uj**;yZKDy?k+Lj!zfF{-@v6jLZ>%BAhtu5~g%kY5h-_XpZrG~?18Q3fXO_u=@qDwRpePyW;YxKDh*nJfp*o5Cz8Ov^dWF1UeERhimY`tT2 zB|+OR9NU`M#>BRr2`0&oZQJ&aZO#Of?AV!D6Wg|J=j3_Ld(L-$d~01ls&@CP)w@>p zs_y$j?+;xC?*8Jr@=KCvH=CfLy5L}Vm_hS13N-ZMs1V8%Q^S~Hkfse;zx3< zIOO%Lg&LZ{hoB`HO2{uXsYK|8sn_W`(zLF|nM?;O2dCj&C9Spojho0iFUTQ`xEym? zmt}6J^5W&Bi=B6I;WpiJM3aB7oli}leQ?4wdx#dsKJEJHTA<-d{QOqE$j~3)ckS!) zd3!7H&#BpfdsM^f93h%KsLkhlu8zMV(fJS- zJ`-eq3OKWS2*}^p>iZOrk8=^^Te$tiBJ9!n(@IXSJ`hDgH9do;Mq z;`+O`x|3&Ptfni!kW5Xm&)gLkAV2DSLJ?gg5{@P(D6>9G6d z_G@Rk-8xJ&8$%q_v_|7U(J^wUlq<2!azL&IcJ*^&Ab!klT(->|&25In4RJ{)=ab!$ zkWyDTs-zy?oHT0w4Kx!Cw1Z&;cumYqc;0lyTG7nt*?_gEk2xF+nX$sgwF(yhOB$2# znYrKvxwbR%B8T*^I;fys*r_=#n!Kr2vGzKFn!99kw!#Bvr^>RH$A_xK7Jz88>!621 zFlUtBcLBDg3c9F!b~b8J*}LMLwc4syi^qlA?+?z^MTZ9P`5D6Eq8Q}fMqX)=>#_IR zOh)RQEBkf~{3`t}Jd%BsNb}nrc^U&+>Wk@)Y(3})h|x4Jin|@%H%f|$9A~NwYT=SU z`0^zj7BK!)7-r&A8q&r3qA$kqL%PVIi|azD&9)-1sHT>YcQxCLLh~;0_+ue3wLJc2 zBL}xuD5719lp-i6SC+m_YR$;jXca{i%mduYmHVoPXeK#8c(d|^zdwKD&*xx%W*WB>TkPYTpTYO}{!t0BNwtb}&E#++AU%viQf zm69U=(oAda!AL5ty8K%y+Gu@JpB<^|bN-w7@E9H8E~2+W5SkV*lXA3J5p1#9YejMp_0Q3 zec8CV;!s`sg0Ypo!^jyI=R%BiV{bylGLrDclj%ryHog5&!#=RsMlqZEM#o-g#J0qy)8 zVDExwf!1GxGS?hqP(GYyl;>~NF#|oHhf9p+gv>XL3?u8GUHBvRD>-6ufJ3&oX4JFh z2N7Q#T!lQ_@xN8cb<$XS-9Sj{6g!L^xeB=hpiH}gffV*|%&%g`fXxWhd1GU7ag{f5vh z3Mo?aiUUDD6v*52@DVSARi>Eqt1m)h!^5f^r+FnD!uo|7Lx1qa2G?9ddrQ}b_1I~l zt>1bd+R2TlZ!o!PeA(9=Pi;t&u-x00d7}o#5gx-~Ue|zG3?qZRwfX}^I($Cq%#7++ zCyLgm%EX2|v2eRf!Ze~`zuEa;eeeJ-ksM`{H-|}s+@FSYYJiAPXa1f5^34JCCr%ZZnl1 zRzaSemxcF?+LvfQ`ViFd8CjNHMt_9%75^G1bNe3##rJ*oSWEr3;wJ*pcER60A^X2e zoK&kNQa{tspOP`3HwA!A22*0vlS9JyJz(nR(RIc10^F9<2JV<%m8@Q_5ALpR&R&AJ zDAmj`huFEQ+uxyf@0u%|evmDXdN?z9oI*Yx2=ZSO9R2l?>HXyUE7XeH&d1-{ z$w$DnxP%kgD9TTMKI7+IpW4tfu~Bq!V(Ti{F7SN3cjN8q{Cx36;UBp^-45@s^bcYw z_8$aqkb8&jW-gs^X_7(nO4Foka)!7>6;}t*E_(X&J|DhVjvxc6^tLHR;$e)ba|n*`{Q!17!ofXeej%;dkq%$6+f( zT<;EccJ^dwJ?Gg=0#9j21sciQc4w!xapPHU(<#Q0BN`s?;-(Uc;6J7k#_DIIG3hjv zKL7H@;-t+tNvN9|Z1cV(ODKBzxOw~Ee73g&jK+S$5eIH~@}Yg^C0ao`M^wW)#Q&&< zT1NiU*uCk{b!^-vgs+RdP`CrrqUU~p z_&M8yMy$BAd^Lizw^h!@*^0^zzm>!XFON_*F14fZz2j_c2!(!O?~L}J&vXR3v8~K- zOHsI5za8C6!usF{zQ&F_0=?dkAa`M=cF^rPB58!lPy&2~Hq=+p&h;HWJJ7HOY-5!k z)1-A?&l?unJGk{qG80RD5-ejja8ewXoqA$RZ#`rkkS2;dE#( zdo0l1ax(!$r2pPkTSQ!iQ?swU7VO2sc{pz_|8H#%F-`Gg(#CH&)J++kpfU zY&)Yb0sT+&s0bG~rNV_5?r(rgQ#x8~q3{ zy>V0>YSGkaKC2hOjrgJ{x@T%De3Wm|?aRY3Ff=*uS;M&)SPiguxvo*2N#+S8jO7U< zRCG(AOC=gsZC@9oFG+;4Q0PBGo$8dJ-_-b9Wz1(u3olNnxH&@ZhelgYBK)F*_~9^R3@ebT zhxEdHnbmQyu?^R+ zO2-v$fBA9V(sG@|#yQJp-bp^{?+Cx@ndLC^*WyEUEc!S#?sza$dEur=eP_R3bmBJY zYxk7_aD`@J@$HLy%mXvDXUozI2J`>AWOv@ouJcI*KOKIUgH0R;_}0D}V}3rn2;_6V zIHz{vsR=~5s$^o-xpoSRT$#l_W=D0|KHV7>rn`WBRu+BFZVCtiPxmqSd-CihCTKDH z$PoXKL!-%%G%leQRdk2k@5@zh^X@o#kHHY~_j_$|Z-Ff6kRDtm_KG0>IY(|p8sSkl z@KasVyD36S@yS&0?Dn6Rd$_${8ac&|Blo{e1kpnDZvKv&HK*Vez7BVFL( zhfxsn(!bbU-EcF^8BffaCt|YLbdLz4Y0da9MV{UNi{RHA>YVHU1E+e_Y{$X>i$@fT zw{f4~00N)LqtS+c_`IVR^3I#KQ&DN zVPY=l7LxR*y}&eOt+3*4(kFzz&~yfMNUj|g1bwC~DL6YU-Bye!|7&(5d6Q=lhQ1e` z5ZUg6NqRB`d$de$^D}6Cd(tR;**|fe|4|*w>o4+{zDqx1Z8vgoM{$bGUPp=;*E87N2V?&{xjg`Lcb+pHTGYZ zb<%TehcJjUP)Et$@4hV7l^;Elb=A?fRiuzcaLH{!b@Lrz!^j~*4IizH%hT{`s?zo$kD?zm`Eu7B*(8pf?KuTpU^*Xq&kp)wc z6)`J`a(7_j6gJbT_q+f)H9D;^XgxlZ4&nmXv>^K`dXDy9o{I1g$cW;Y@k4|5o5`15{ zU+mzz@zl6q zGNT>EE;rl9YRYxCsny9crMwOGDfjRU*MHHeT-N}!r3SxtK)YA&KPIQ<*~x2*Bxld@ zHLWLlkf#0E%=~yBmUAyci1h`UOw_qj7w1>R@B&#e^8fvuUPE%VH`T;!3%?#FQy$3E z4N~~=oC1=zlU*k+1&xc;T;_SAN^WMZN()pR zLlGRam*5N>Y@t+6{;&ppahI7MaB5hA4^~ic$Y{_xU;{?%RXxF!q++ya`G6Q-0WB~% zRTiE7=DdCGQ@N@U!nxYpFsu=WW=(FQ5iVAo30czYl(zVjrmtt@ZUv6Awc|$Jx+=3l zdOh?wSj~{r>FnloX_|Y@$Nw$bz%zO?GcN+de^r`LMS9Wvo&_P>{=AenWcjkzbQ)}6Jc0Mt!~&m{$bv?wVEEI)&w7A?N4>rTd$wqtaDkeqEiBYNp9|(ZjEt z6R-h``X@TIw`Gw7sH#a@M2&?{SLF!nrW%e zo$tR-T%2`Ky$4mhe7vpQagx;F?eLxVr|z+c(|R0JVWAf)vsN5If3<$PEwQz+e7LC# zvWOHt&sS)TP}PhBRVg?~`AxJ)gJ27}SA7xPUgz#c>U|J@Sk=z7lJ|EHh}Fj$m4pF> zcoxNjHs==@&8-m6m&f~?bEb!?jd=#{2WIMqki77h`}wC1Ek9(PPstf${oN|;7*AZu zmoNEtM(Qt3u9aSuHreTY^tf%PxO;=A*Y+9@_z(HGq!^M|J54QTL!If+q$q7}nuz~C zdVmQpE$0X68aa%Zkuq%$)S+yao2IQ(tmOD+-yf#R`c;QFY08ix0dp#ez{7seoD5Tq zPk^c5Dx!OOhv4vU{V^pw>SEmBO`_^9{o#Cc$(dIm)$kc-SsaO2+CF__VB;uD zU=v@U^&!gdrqczU>~66WWd{C-_X7>QG^sy&is_zJOV9SVZ+`{T{tSL8T}JKSIj-9| zbkuv_{#Wa zQ=;d)$Hx_R4mm#um82@OVpHsyf8SL9Z6+%d^w7^iTtT&)!Cm2*4sK{J&<36(_b|)ggqC^w|dQ4cp zAHQW&{wGP6 z(Q~dt7I9ga)db#nJ%j`m^--Ht-efK4ON5jQGKEd9QnH9`r%Y zU<~inQ2MSCNh+R;c&mN2POIyS{!54l0do*tkf^C&NaXV(1Q7$CS^&I@+!2-n#Sk|* z14`jaq~@m-R|e%aoYS;4yC;KI?4KjPdAgEjWiaYcIm;sI5N;V3r8jEda9UjR^khl| z*JyGUDNHe{u>p4A?{%MANL-wkcu%@*x(28i^aOh$7UjH&9=KSWSK-36VU<+Hqx9$=?t&V~$@r%in8rnp41MQsZ zx1Uv?MUw*IPZoer1A)!S>dy#RpX~cDr88ApN*flg(nC1hXCi4O!*BoQABs{QHkl{? zQ|NX^IZ;e_RiX!0%KdpS+sj^RrnMD2PpCb9WkzIg;?T(k6=xUjlt;$8%ih{T^ca9u zlrfj{kqNBlH-p~!H^6^T(aH8ZW%QX?6VPEr1`k4>`;?fkJ&F?8nlZ0xAvX7@F&cX2 zEo$r8jN;xOC-+k78&eUae>W`$lnlXxgW|R-7k*kBLu3D7z0y&+CH$o*RbtzZvF^YW zoDQZhF3yylTrqW+qzM7)JyMoR;$QfwqdAwOp@xxV1#c}Qlvkq6x(8lBDdG2rjIQ{n zjkoc>oBB)!ls;E(u9YSW5jXeYT-7IP%|k%5@B8NFrQp}h{DsYa|FrPBsQq9kR1~lO z2zc1vlyYy3RB>SxE5Pa=P4{ZCfP$$ugrhK!$veOmYt|>$yl^2}NaRR1KsYys77ABK zJE3(#IIxl%aBv}?dH)i(K2XIU1VgD3bN|E0#P^~+h7H=S1?g(re%dkVw%(ST!&Ea{ z?!KJd=Teu)0XFP<%$pU4juDOk>6AY=n}@Nyt?qSK^u9zzY^q-iBS15g6+&A6b@XQ zOEAxkz}fRg=!vu_l^ifu`bFF?mOk71x&A}A;_eex^?koy;d66!^z;+9^I<9%U@uqWRM+Y=$ zz7asJknE}GsCLpr>59363PhCJyT>bfnZhnnTv;T=!uUGB*yvoCAoMk@JP`4%>NJTc_#oaJ~SYe2(A=( z;^)XMj*d&igXG8o&3fmsg;lF`3g41t1OvbrJx4NR#|k&ZPhw4w6N)S04=h4+_Kh|j zBRmz130}ZNEBxb(ys6r{qf+pF`n~!b#S=3OQG{GeEdk0{LNt;r; zS`{VGLz)83a6~(o?m+L^K+?a0{Uh0ZKVUq1xq;!s*c1b{F%jik|X@_}o6<10JlW9+wp07tR08=EEQl zDQ@xy-|beR)7->o$9rF2U;BH&<-qpfe<-#eV}60t0lAIZU1kAqoo4nLYwPRFJ>2lQ z?#)5%;t)fCF~}c^UKl+rh!?yO=s6>{F@a3D(k?ak2RBdi&z3rhp19x~@fHb2Ffx?q z+UR{>Qijfia6Am~Uj(d^G`BqcEH^5p^Dj}#SGR_+{i??hNMu*p?ek(P3T$na1Z31K ziNYZ%_1{b3+zyp#3#nM6+ws=y8}kIfH7!27c1JZ%-(MevqHy6=PU+BWe)mHfqJio0 zc7zsfdED6$H2win3>x7EKljc8S!q>CmE{nWD3oLqhSvU6reSqrK;vTe;+3+Pg9Xp% zGgx(eEY7k@u=%c%ia5#O)HTacikN@1V@rs8X|RhiBsDTl-C~FGf5i*C1+`l`MvOO& zBNY9EI&aXf=GevR3q+-0ks>uR=S_GrB0Q{#=B|@nH54mTY{X?c!=o2VzkMPrQS?wWLHbIxmg>|%QX2)66U(%V|5s8$ zF3m<$+v<3`T44~LZjWdz2T|y2?_mmyO84@)r2nn?H5v*Q4N!X321P;X5kVOnU&^GytMVS|b zwCbZ0#~IVB=OC$Lu!krH`nWe5+G|^o56He_971m`251vPw^rnn*#$IP8-N1WEZUec zsqxZP_)_2woO;)mYnIGO@0TN~gUDM+Wxeh2o?R78_{_X(19W^aiUUBHQCg9rJn2&k z52Nx0j6=O917`v_zmP?8i_uMyU%Xsm5f~!;x4Zo`kxk%;f$zE8f+8EYGNyPLy zKfS>*Uae*=z}1eV4kwyIj#Dum%FQ@Ok_p8h)Md}a{;DyQB*JNxQF`tX1*`?o!>6hu z@v6H^n-2xavjW9U-mz+ zjsiv;J{Z{uiy5i@f7faD3khjN1KY^72o;@Zk4cs3;#NpvB{(QK;;j0n^^!hHHxa~H zS?L}i>E-)|koV{4;377i@H4^Yeh}bY+jmBY<*bCAL<7%sP3j5E9<6LYMj})*TiN|$1Mh= z8W<)J?n?y}d@3@t8*YkPwb-x@mFh0%oJ1E0f&5@Tl0^F_9G+=N1J_DJCHqM^rq$qD z@gCH;ZuND6$+@jc8YYHd}lwI0>6H0}ir?uiv;E z$%SvqjFJyvRie#%*2ZLbHEyx(&6k0WY}#Z|4r8J{9m4v|b|3S*r2;l-5HT%NCRJ{h zVQj3l2?;lPC6Z4)r0^Q|n;gXzU}Hk&%+Ql(hfLE&kXSy;rSwuA*M0S)a^}oNkSaL; zb48cDtZ*6iNK1gLUu4V~dl8Y~xzz=2FZ_30w)dSq1YZAc5t0UBUL*5IRdIHPkSf3C*Y zK&tf~+o4NG>tirUE?;4fNfzp6uj-~Xr?K3NW=f*9VKc)oE9yUF&Gct^<5;63rVPoajH^zI@oa&oa6<}_ICD2Z@CsDCAwQ1{Ul zi<8IY#Hf-dOe5&NDxUmsthU+2aBj)~#b%#wj&R|xFz_xjncu!i|BMGeTe3zYPi)+% z$FCc9(-jS`R4=;$MG$AuxW)Q3z>i zGmOVzh(pxJU64qBn%5kyKw=Il9BFy}z`EDT~! zl}&gvs(Baz$c71o^6a+4FtZIS8a%#~R#kC7Lx>`Y@qM}K!hgU~6{{k#(L=0ujv*ss zL0OQ#*AS)0GST*$Oc%Rg5m*gfvV(i|kRWe(Mx{263xa76FcZE%UnUUe@gU`?^6|>Z z28+*OGh-xZky!4xj-7rZ59{RcV8N_7rYFeZg$B4iCg9iBEl@4XryPl73C2k4;{K{D z%)899f2;Gjxj0(?@ps<=pW6>- zz&4VWu+5yWKCgLxw$xE1^*|{pVS*MlW(X+>ln z!jQEy%{(Gv^m5k32H-(6(nwvCCcehBQXS64+i36f#30Dfo3-~Nqx?ZGeINCJwZ^v! zrU=R=1y5?OQPTm}aWg)w5kC?GWN+Dy&-eB{69oYJL8P~|Q#ao>K+B@2AXp0(#! z@&n*;7bNTNplK}Nv?W!2Dj^7wKHU&G`Pd3ZdH~^YaUMiTs}Lj}9Ql5s&=QMjTKTZO zp?j-hLV8@_i2Q9!Q%$xd2z2pKXtD8DmA1xghi15g1znHw!)4?bW#Df33p+kaWNv&x}l1oS5H!PNieF4yi+>`4#jBBH7} z-qxDOFwzvk7e?VTsXUMBBMV(h5pVUn+ft;*K*wX%yD!NWg;B(9!U_O@Rj1{C+MP~- zc)i~@Ore}^N$CgCZ_v|Vd^Hb=qZ!p-3#ORW+|LJ^La~mka7%E=SisIiXcwG-{ZClq zTud@QH4r(5tNMXVpgDHOxCmx2`e)uq8sE9E;vb-$wENT&_CH|_+!Q(?O4WE&l=tB%C&G(Ba94QoNq zdTQ7`MeP2^>R>|@hJuUI#>^1Cl99~@!5PE$6}l4=5guk(GbYK<2X{S%UhDUyKSH6q=&c(Zx zLFt6S#9l<(O>}%mcxOMhF z^62qjgvY+oW4gQ;nOD^&@hor*c{U5Bav|h>+4J80SYVytBz^IX;{;EU7>v>2?V%Qm z+a=I7Zg(!l(s&2uulncn3CE!dYQiSV-fpkfhG$K?7P`H4_iI9H#B%x_Fcz*iVH?1; z*v?xU=(e`J^UL57Q=wlrXf+@KE+*m`n=@H9ZdbW1R8zGF;EDTEY1+jb# zopW@7dW>D8n_fvy3rFEc7I@pB_*7QnSc4+Qu-Gt}CpM}ydEN%D+BEJ0>ZtvZDgaqn zcgt6eDeHi>v&P6cn01XTi95V8NI#Y_m{Yx0&=R2bi)frorngDDFS2C{TdVu{bUGLz z_qY5C%ZMDv{97)i%TyjLcdeAKZYa3r+=8@*0U}qq2@+YwU9fB~{q&>2;Xft?c`b41 zYAGuKWyj%csYm3$lG+z+pwxKDv0da;%Q4A=mEQ-`1g~BGT0VEZ89F z>a&Ki9fas;a27L3^IG1F_lr3=-v!Loz(2pggh!m=LfC!Z$)2#C3r>tgHzZ~Y2Im{j zns2z8wsueEzUCO*7KxdBN_p1_m7gHgp;src_QcL-`*Xz6Ho0p-CAjlvP~wxvJgDG< zKq%5`3~|U;wkAPeMh^(pgsT+-22M0gjvrEN)V)tsMZeJ%XS7e>S|9*&I8HaSIHU5C z@4B*LqmrY=M>|Yt^D|5nV5qEUBpU+r??dEL!UKIz$vhV3aun{jYV_etaK{m8Lt0P{ z%^e%u{=PLDZwC#S44uE7r;ZmJ*ug^v*5sX&B;Ph*ZI>+Rfz|J|!hrneiG1)h zKC6~DRt`^UE;Ltq(hVg?A7QUS?gzBxr0wNG;*zS8ZOpRTa471D0%#(dC4IZYfq5ch zV4+SI-ohJmW*4>Us_^kzR$g>fzm@sq>(zrmxdY}l z+P0w5I<9}+grfYUo#l<}?kN!e{6e+0ncl=B(WBU5Y6Sj&% z2~$73N`IID(uXRwe3bgTanC|4f$&RW01K9id0e}DHrUH8>%fR+>%wK+h~(*!nj-c7 z5b#D;P?kGkyA8x?6xv9fz8cN0sLbv*WhywBz5k*|O{~#=;U>~Th({I9yNSG{h6E=@EkO*q>kNi0Qt{+|pW*B<9RoczHW6dGHvIkZ!g5-5#iKg2Srwb^Xq zH{cI7fO^f`&)xuTGN@cnwK{J%ra^YYTfbB;I>cZ)ph{!tN*U5sfq>cI1AiF+;X&NGM7vmI3Kh; zU|0?MArTq<(B+Qi;%O{t%_|PM=k7dU05LFyc~#j?j>Bp>3e+X6&Cb%6p!a6|fH1Hb zE&djZbXHD8gef$_^sQy0mBHsPgtxtI>|!Guv!B+c>F!$r9=O!S0;x3XEYtcgL0_o| zo6D;5h52!HgO<`&@nR_Us#T8g?xn3_l$>Nelkc~$4@!o52l*5Dzj;COyUxX5^QX4W94%`8Ol_<2 z8En0`KblTgoT=2Oi%_A^Q}1_w%I{*~xHh+$$-u14;|LBok#6Z|w({$Fbl zhF&sMTlu``@xJ=3B_-<{7`cG&lw>Ry3c?m=ltOXw9R9^0N;NL*>$Qe8u!UmpfNXh- zC9r5ULU(ICmyF%`SNRB+iXS0v<2}}do{x|trJN6uwHcznKUiEI&n;Rb&?IXJ#S z@N|>1<}kTS4D_7z$YADK)swvmp6a89wGkajjq0Ls3);dZ?JVIfQ=nwBowogi@M}E> zLZK^qw6`%=szcPNLnISQ>b%*8AgHrDEV?yBr?x%M zU=j17I#l*vWUGVnT~qiv>>;w%O^^CCWuGwl=t`r|^5N_Lc3n(`7IDH^lFQE`j~kie z^^=Rb9LmBZsQuV#B@>P_tD#Q(fz7YZs%|S_P~_f5`Me`}2W?HJw;|n2Gxt++S;=c}XxrcJ zTN4^fhjKaAkUTK)1QR{^BlP<{JzdYr6b+UkGPVJdgCMAIC-)WlX+}dA#fH{54YmOy zpTTIJGa3<*5BL|_JzJP)0LoZ|?%9x=k)15k3=_Z+|jnNwBC#F+=?1(A+%D|~R5Qr((yB`w;Com>m_+2Uuh|Mws(!WN49jhDZ?e(4az9<(onAjjy z>K;4FsHmH zv_+{I;#QbD3jtt{F7<(E0teZT-4`P?<$zEY_Y(*YMJ*SrAWq4lSIGgFI)4{Ln$tqu zGJ`8&7GMkYblmjP>6UPMyf;@G2?9Aw4RugX->nw$bECm{%HMoRzHf zzI~l}vT%X7_I1%EhB{?Be**xTy+%~z=#kfN95dCAlC?@_xDyg-{`X zHd?B*qCS9(>;d^OM8M1+xPPV+UJ3o6-DtY~!n+}(`^x?CzBYx-r`S_;mzwWt)LaV` z2WI@u@j94S8ewjkY)*y5wKWEpFIw0OW+VOB_mLiTdCN;0;ckU&*Yw`~e<3{00O_=t znhO*g+apyY6kkK=tHgV1Hdx)WTLiIP%X#dLuZURucb0XK|1*w*ZhS_BTNIlU zwqVif)w!6}zb1S;?Ggpsa_M#(o?%YI%Ku);24oGx=|UP0-_QLrTIZt7q zfy)9&o3SYyP@eRf@JG!vj-ITo5ymf~+BK*{4B7se0oKRSRSoaGZ^Tfh5+Q~n5rSb8?8*HTRwXoXxACxJBe!yf-?#~99 zIihGVbvfb_)&x#e^p5H!Q80@7>V?W+S}Fay^a}})eObMijTxr-csgGj_}&3Cf? z)UQsE!oMcht^*@IvB-+!t3I$MaH5I6wotUi>Fo%xbE@Mm0Q>?~XiFT5Fd86z+K5U1 zwj`9NxbIoJ8MYhYhj<5+gIwgd>FrmTt{#7;?zRjx&6%$b8_}vNpKhQVD_K=ZA1dV1 z{NjI_zxq(YS72OQz)p?DbfqIm;6S5CEG4r-ZW)hZ-u;gnB-XPKcun~dkBSKdM}}w% z+!x@jLtMY1Dg?DJiIxUy^7axO6E6+X7qI*;36@}L%0;+PF7vN3EF6^7sJ0;CZ#PAn zON@%6FobIpL|38)K3tn{r`<|^UX!i3)f&zv`Vz8{92gB54@mpU%;!SC*uvRh)uTuM zAhUfJilU)mn@mG1Yjb@DuhQrmA`RE$gzda3A&(X zRPgYT-N-zHwl~F!dUhZy(axI1DQFv=w@dQr?|z{`U8>_K+)FyM=!?jqLt}mw6=3Lo zVgHI@<3>H@%@!v0)C_bBsO}ljPkQf&Xlqb3iVcyX1w9)P|4s*4N^J%E_nP-ghz9iS zuM>+S8|JcM-x~F?6xe*4{;2JV;3{^ zJ`aBb@UIkc7Q+3LHeGG+$U%tX#bngX(hN^IdX+e53i8X|o0Uwf*b8n(zQ^)Op9)Wr z{bPr0(03ok3e_UnW2BqF1P1iQgmT}U6-E~33?NJNdTXA~e7X zSW%_oixN>uBv2F1K?x}%xPwUt6j=={6-pOpg~ZJ0S<4M42zHYsY^o{YB7!D>IIT~@ z^Ft%XkB(n~?o2*B;Tf~J3C%+>DfcLPK1=+?!O1?j<)*=)KD&2%WQPQIrEEBGjm<7! zQiDH#LSL}*mfQ?^>}D8?XDdw{ckBI$>D$HJi%ue+yvqQVuPIxq(oKn1lNgB?T(&&K z?~T7Cx7ZD={(*pIkkowf3WIj*IJTDy^=<&Z5YrwAMv1H$0E9;{frb-|{wZvWng6l#% z3@;(h2gyIcb{%Xmi^*I6wq`c&I@KOW7rN@(!TeTN@jD17sPEe1$n_Su z!NhQ;DO7B7Fkm}Y3_K-VaOr%GNc$I2-mlTIB2)eORSIMdKV*Dp0gxX802E}LWL4qr zte~b7JrNDgCV$pFzkfj8cX|Le5p&|ajgh*m!orhl7HtcjvMVDQviw-MF`rrC71B9}C^-Vk%kfdSCfWqj8>QzrH~WKOAQejICz$zLAGLq3M_? zfMh}PZGf!4GlVhc8ej+r!;5X*D6CpEjpA9u54~8@*ougNZ{dhmu4OLIk{vsHSG1ZU zt7E1wb!^MGpz4qyUf}sp4LDO1Ll5IUoRH|}6Y)BCgW>ILC41&j&&p8T6G1acRe0l| z?|INFDs#O<`G4F0_s9R=#>B-j{t|k??n57EjRxk9!Yc^3K(S<7jc^X~F?zeEj zDJFhAX2Mwt={r1PNoa)XH0hDgo-{h<19TNQmv*IpmoQc#7PyU{^jeZB-(^3e;ZL?3 zn`pE%=I8e4)N2{qCq>hthM8gy&u?G`e_hwUjBpcM*-9N`nY6s!XkkV2-g3K!==R=gQU2a5IL2r*cG$I%sdoynO^D8ui`GpzpX}XAMj9vDd^y5n8Lk$ABWArM*IysKyJ&}O}@Dk=L{3s zIgv~#p1Pki>$D;+W78_MNGryLhg6A!gHov|)4@lqfRFp&FN;a{VPQ##kUAGrW@TaC z^S7phx7rPBK`*ffJu0D+;=buE#C*CD$Uo6SWcdmRyf@b=g!^|D%i}@J;WO-g_uH%^?A*JEBm-Icw5Q!Qf;IUv{8cL!f7eM3T(-lurFczw8Xs@nC^Wpye}3XG`WkJ>yPUoyI!o6&ad>POv*`68nWYb zEBYgqNLo=yAo*K}n=$gR_{J$HwzVSbv7=e5;w$4rz%?aK0{V@AQSX0-vn~-^jUf>6 zjrTq<^_Cx?gB{)CJz{pOz^Ku}L}f)wQ0U-u4UxeMjD_eysRJ2_-2WJe3-p&!gEB&k z0`;)3|4=R~K)T4rpFyiGZ6k5!9jh2v_LqfgWmNTmjWyK=HFC6tBQ@iOlI5F9iYR6y z(?nYl4cL}!DznY4YW=E&B?H=`XTxqX=Hc0peF)Qqn%)5A;X~B!bQev<{dSJx*>RY4 z;X-am3_s0&dDM^WDA_blKxHBr+zN-WQ?JK3D)d~PXSOH8%)99@+v>NEIJVFp0vUGe zERP(3Jd1HIHk#$<`Y+qTwo!7GV#{^s8a2({UWOx%6A5 zWJV(XgERs1z(cYad2$TzvzOPM&OuxBcv-u&4fm-i6a$kB<%|yqZNqHLDD8=k>P!yY zT-HI>8l$s~L)1}&`81HgfManz>kk+mUwMl06Q`(%DkJv01J)0*z_GNtE%UAnxQ09T z37K_}Ii>GrXz(Bdfhif3m3VV@SYadQipVu0dcMh5E(mBffw0U#PWb|9<9oS_wjs`P z15QCHJQg%$6YZ`c|I1VgUSX>dN!jJ!M-`>1`|WSg5se4T&H$7*W)k{Q zeU#%A=+~ch$i3~g(jS(i@UfYn;zb@owwFl{O3kki5f7S*C(b4s5EE2<{R12BFTSbu@_|O=d$9z zk6~L1iM=@C09HuR|oF+QrWhLIo9M6$f|3 z5J>IimYumiAmXk&G{#A>unI{q^Wi%qXFl*o^go&CIdKI|H zE(|P#kfvlK;%*W_{=y5=9JnsGOD*Sxb z{9gc#Kyts(2g(aSz45>MW^*#i0dz-qHH;gM^YoH3RsV-~BqJcS^uy7;YLRHvRJ$6)59uZXfvw1rMSO54MQZtRydY6AJ z!m*nV1P$?KWyX1B1+`$9kuKyv)>5jK$1S-IY6FG(Esq?aaXi)1WoIn(gn!~vCam%_ zc4R|WOw{G&=FZFSx3<@{h)HA3c#*6~ZnPR$y~KK{#RxcRodNJmu3Um>U(HVRKT0 zE;<|voPNU)J3gdYDNXx5P;<}eG-y2myFSwv{3Ex1r--VyHVf`v?F&q1_h}ACXZEZiV9<~jV-f|UH4{-26 z2Q(%c3shtZ@N^bgJ}6-FjC*&<4|XJC@+mX=ukj67#{)a99s0n9k~KJbzwfEVKLXd#3{oG+Se=nRHh;9^+xQ&iUNaz6QI`tWP(81nZYs0yuz?@ zCN5%;Fd4ESRdju})t{hj+zHu5$Beo&0*12LdMW+DuN z1QZ_%J^C+14p~TJF60KeU}Q??WI|`f175`p)$A6|dG~5miYUeRD9TsFzwisEOVjFcwJ$ED#rF zo0!W0%@#1cUW}DRWsm$_Txb?(gUDoHD))evY{4e9w?`&df&S^t43*@91wmdJ0_;gu zd$z6fP+Sy`;=Cb)AX@0hqYWqv-tK~a*-DMZl)&!ERF0_;2lPBS8np@&6vd>{|F!JM zd)|r_wwhL`ES6fj_=DcEF;teV={{E$(B%m4vBG3JV6jV2m0q=uSvDT(BTF*5QE3N( zGhQ;G7>X&gRXJSs`+PLw!z551*$WBHlvCuwuBCH5>8ehU87Q6|8tZV8?Yd%#rjx&@ zba}2o4Rt~18>P`%6?1Bi0$1xnV6O?&4FE?WInEOC+>%~XDiO1ios&-$wah`r4@qKJ zwEkw<7^P1lswNhWlq2<8t>et%2Zd0wA5cC;4iE0D^!{cnLT(MZ#x$#$eTJjk)06=8 zh+6d0)A!T<;Rf0J<#Yo^Jmn$R{FT?ToY1G^6yJVZdy*mFI+2)3#n39$C*f3l+$WfX z#OD&0$xXDB%5*f)LV)2qVBkCiJEim@eMETxm^u%KMlufl0Vak<%LKjnLouClB{wV| z1luCEx455%!mpN>m##AMrLSIY?TlE@f9Y>`*?_(Bzo)$y?EBu!9lyIXdP)87w_bFI z-*0bz@4eVG{)*pk#zLr(+zj}@!FoA)@@A*^s`F-N=f%2Je5OPiwJSp6WNeTKjb6Y5 zT;b)ho`Zh{C;&`BKtOA;ysaP^@sP`jk*4#>e&CYci0LNZjP-uZ=Ri$K5cx!HNg(k- zG6qS2Dm{jP0fH5U*?fW_Ezo95;PCI(HCj=5E;p_98H+ncIN9{sFrYE(m;rQfs828o zLT4_L&VY@1xQ^JXDOz22q%^>dQPnwvo%OsO@*n!27mh9iH0mme;c7n*PeC_sbe#t* zoI6hNS)3%)jPE*HaTbn5JY??7f2Kk38S@<)K`U))w_x&S6@sP*r(}AS)ef2R224>e zKim0veEr9-ZIl1!*Y>XdLkcuo`?bCMYukbA*Y?-1Z6wdX=tC$!A7+v_Qk}OY)Q~j{ zvHN#Dr+~6M&$qYCB7i&+#car>os5mDRm|mmdX4I2L(}kYC6x%Rg2>`a}qOh{QmUpr<23e&mT??Pd2hY4}Ng| zINm!w{pJ11f%EF<-O<^>51;o=emX6`{bldX!O;oK`SDK&duMwd*)tboF`Jrrgw;a_ z`#3aj9a;@u-J*JCRcaRH}6dG0{ zJcLpEL44V&Un8kCdKiO-#}k z8z9SQS&DJE={L$)SYoTThGC85Pq9d%OfMVE!3b2vbA%lAD|5YqLn9sSR$OY-diuU@ z(?p5(MvdDulCq6jC40V@oJ^4g^oEnE@bh0$`E!6GnlX_DW_|%#I70IAV=SySm$kcl z?sdJcHIaAC^84eC=uyNvjFtsj`=nr$oGY=-Q@R(6c_;2MIC?Ff+BG4?TziD8lH zPEAvw0XKaz0j;V>exMSqk~iua(Cniok^@8-r?zQc*X4>#s5LOrr@+9mih*;oXk+-= zQtei1yZE}-^PLd{No@0@a%iIduG7;ugP_f{K&PmV2vQnWjq~-L>0!6s*Rls zryA{O1!FiA;gCg27DMGo$;V+Q5`IU^0-H~4Zyg%?9U3a$v2WJBR%=hftxqNg=dA(^ zZH!{3XQd#tY2FO3l1zIW_?O!SGM{=N8Pu7GYAEF=D{g3UrA8;576Bo4Q^kx~wRpa^ zg_mn4!1zdRaUz69 zzg8=c7I6+Qj3unkXn=GBVIeGzMXZm!fEr%WoSFaM|MUM!aGoKleuR9&$YJ?@$vEMz zkXJIBMK&<7{u6HXjuxFz0n@>|QnZaFAEI$geSqpnJ(VP6n$e>%hGR39J!s!$>=ja@ z6Jwkau~^Rmm}i6}f%cel5t`WqAZwwiPR=ochcg;*pTsou#Wa{Z>}=YXM^4z3fm*3< zT*ivrpn1QnsWFx;E<2cdVdZU3n1v&!m_h+%K;^_bM}tlR&5 zlX7{#}I23UtVrwLm+3t@RRp4zzeIJD{ z1a%v^17S__jCL%YbSPyYAY4fnj2yd%w8U(S9KL_!wOY@f{Q?$7X5bg#dlM?~gL1qT za+C0XJbR|au48M=W?svbWp>~N!)Y4vk631x%zAyYW>;KK!(fgsHc)8`z}vQS?=+-W z*3t(h3T* zT0rB0z+~g<6R4{>^tWQhvRlM?t}bi~UG=`?s|5$GAr0lsT>$R6mu;v@ud z4fS76>o`sQ4MJ_jKn%~Hp}{nlu3jJuLZ6zBq+S({zlvi_n;#`KY=k`rc{SV;d5SPK zp>u)2v1l%Gz?iwrVLqWjG@%2Q`p$)fl8KlKJ!0MY1)ZmwPgnlT@B~nLU%+j@3IJ<{?wnU{S;wc9%(e`Y+N)%1sgTL|U`626_63vS(@X_nw;~Pa8l|#f z7+hw4e(r5Mu-miBJ`7tf8n;tpJ5{d6IcFbXr57kx!=+YjoY~gr+4kot9~=JkN&2&s zNY)ursTnogBIZ*#MzpsuC_!f1dgVSyHcA2#@bFyX!ql=gDp4ZlG?1GylOmWgU}m=9 z|J$I*?qmZohG0&6O(3Z#J_y8k6H72O8w3_=w$)L>{M_Dz)9VTOA!ZcR#)i6DU6o?- zl=P9e?Pr_7IHOn%hcRw4?1>EMjP=bY*M6u^)Fc+kcw#A#;fPN}V05E+$ADunr*PW2 z+qR~v`A&5|eGjze4r2B3Ozwjqn3>gr;dIP05$gEkzDzG^Ae2Fs&?$_AMT+E^DR0Wt zqmm`%6;l2IubtQO*RZL9ij?3Yo~mmsF9vxI-u}bWBXMprJC+0e+9sDoPtS|zq|@=)Q21=U zdNd#R3j>K}L(&N}_f*i_TQ`W;S%(|32-s`H&H)QpR@`*kMaMx)&==!R>3l(#L%q@;~jpCE8I5I}bTw%(dYZ zezphLg*#usqX=_Ur@K%W5+PeW>$=s-dG2&^m_PCm6=3?9HN;Dr+ui{D%8{t>u;6%R z%u@p~E-i!|gZ@Se7%hC+9Hq;pz)ZV{^wuf6G1hyY=V;nU_tkE9XScWI?R-y;-u?KV zkk_yOX0)e;RYIc+g9$#6AKjS#FIB&t3GzJ(X-8q6>u`)WsFq}CWVm;SpaTnlcTRcL z`39`Zr{fc{-QDUnQ5i)^5NztgU{*>MnKEjeCNv4Zps^43e^hY@Y%sSR+c=>y4HaXx zLVn6nMlY{w|KM<-+3RNedYTbd0!TRU_D(zitnm^gOPP6JpfV z=w?F+YEtwtM}fEiHx{ETryuEJUgrU3uNov-rGa8So^d7d3wCJfB5H>16NVko>rJ^yctj*WNuuR1GJjT?tkjDbl%?!cWa^I%R6t z{R2qRcspRiF=AF zvZvVGsnWv2c>WYN^T_sQC*R>loIY1&E(#>1`VefnJkG*dGUUdNv63IT`ugA54qv{% zx2yN}^R3ecfl`}=#Z=WW^DZKmuO2ITjgr;gB8QGP|nX9>T#i1X3k zs#m(x&DQ#1kfq-DhAdezEKD71_0~`IY^5_3l!!Lk%bGi@dbT6sufzUJ=XU@m4`OC~ zN^;dx>ld@wgpRcgmugx2F0%J++_#h+dWG!Jam+^ii?v74(hmxIwi&LaUZKQL1n9CM zzo=ZxT8i!hWeHKdE#C;$T>b440L z+$l5smtIc~f6w<*gB75DZw~g3^EZTU9RL~C&v^BtIio-bEjrr>XePRm77qact|S?Q z5yF}#N9!9IBQon5yEdTpYX_-4=emhmgvOjyLL*?wVDzp(bIpf|nEdqdXOHY_;4G*0 z)5o6)nsk7EP%mtOBOJtxp0gO$B$1=x%mPEQ|MZG#GJBmG-EGKZ<& z!O(Ts0Tqu&4rv^47UxvwMq}-BALH`jEaGX5(>N3{-ocwtSQ9FVs7C;#V+) zPOxEaQ6P?4ShWrq4ehLa3o}Tjkqu(TWHlDQ@OHeHC7EO+XHgyma6wTNcv8&(c$pa= zcw&NY7$dJ-P$#H$oSk|0W3RhGdgzbP+tQe4Tix<@JaVKm<)4P02ezraM$2_S0^S{{ z#vmCvKRd%#2c$vxF=j&I$KTWW*r}A!a6XHIvbYWgvpWcb9y!SbA}B;abd#c)SS;$j#oX@1JjG z5@CbF>u6@Uw1&BMn^G0?FHO40S6H{Eoq(-IFDLW!wqf*`CQJor^rR9o9W%VT#K?sS zlFBqFr>>SrJR{)NHyqmo$cgiyMP@0c%-R)zu~>epHA`>izpTvog$3YIQLyiG*tt{{ z(mG8B=pAXoD8P6v2R)dR3r&S|k5@52*R4;%{z)drjLu9o+_o~Qz@^|ymhISP>r|hj ziHYYpV$2`V;W^2|EwEVrw{zjpYGt~TXU{OPabc^#!AqV!Yo!H0YC(gVfDR@w4-Z`} z=rh8?8JW>odY;om8m6Yug;hR#xzfc*W^lWPY6FF?_028}G#E<`nZ`KE^Q|eTSD9VpD-^{aT<;Ao%1ph-X z>v9Zu_N+z7r`~Vm$Gx+?H@hUeEHL5Z;NsXGb%8k@F{+xWd2o2PcciPHS(lc~uumVh zS(G45j8_Up2&WD*2u8nE>@TOJ>-D^Cqs_Bt!w?v6M?-2ZyfQDF^wL@czN;Z)R$6fg z4h;#7qFB)3B=xUWCcb6P!5Yn*jAzY4+Kc9Kc>S@Ns_VRong&l$t8n!0r_RTtz0UDZ z2Or)Z@4b1m?u^;qbmlHObLNq$@RhEguUQUj18;%eAXmfp8>0auLDI&g02*Qo<%8i6P8NY!`95(a4VAX|`e zVlQ5b%lrWKMx*|Wo4Yitm*CSW^Ep*4m}|E9?eY7Qv%Pm`yCe-p2OFkj29UPvsJ25# z!qRoq7)#Ddlx8n=ZX@s2gvA%!?leG!vCR$&$2Z#2YBErDOH*Z~4`C6ek(z7q$K=NK zOwLhOU1RUfoA`i<|e6YGVN`e3)B#{XVB0Vcc^9PeI1`N(bTk5?D1LiHT3+ThB z)jVepfbre6RAu_j43e{p`|KsgamoN*+*Yoj)13PrT6AZ3ag+IyPMf(88A04iMUs>l z*d3P=>wee!hxd;@8N@Wi{N4Q?yvZF<&V>@*-$}(H6qcO(cN^OmECAN}r-vsWkM<8g zzuS9z*hdK=4avXOfB)tnqhsrK13PNGj3vhVmy#ruvsF;SSVE%K#`a_We)s2O6rR|$5w_R2|%pMe;UfxU1K zb$yltr<W_zv?Bri~Plqd0ccDCtayi-e@}A+1Ud z_RjWx*gG{}{zf*{G}=T{6fd3R)Dp0efx_7um}X!KSFd0@mm;6JCCqS9=Apn7uXalq ze?iPk4T&6}KZvmnGN|HHYxRhNXUadq1WW#JO%lyI=@F+PSd7JuUZPC4bvP^&Ip0E? zO1Tibk>M3*e!}5yvUYa=t9o|J{4lT;;PmLku?obHy7!_RCU#~vb=gw5Eb>~;s1zB; zln|_E3SY~O*a^tZqPw%bez9c)-9OZFv-_1HxWaRE5^9p=_VgHh`#l;+DrZT(IWl2eRR9s?u+No;ookzTl}}%+kWw< z-t(QE=P!FZ+s|M8soQ(;d}r%VqY@?Y@e@eIrk4#dlkTSi9$m5a+w3 z{cAglS;ugJ8=6(<7>@GScDqo#bHOwf+a>KzuYI$q`uNT8Ss=L09BIfvq=@%Khp9B=1ub@T1H4zFjeO-;Gvt0?1m4m z$LGeL{Qj4dDTWZ}m^fDcO^||R`@g&WJiq_9y4|hE^Z!nsG{S~H_f2?>U4mW-_dT}9 z=k_0G|6_KLlf%7(w};-;zqvk^p8s3hh4cS;_xa=gzmsQQi}8>O5gqahHU%cZTscLW z&8Mj_HH?W0Kc&&*QU6UnrTuS`VBI7cShoLPJ}>eATfG;L`~NPUhWXg8n}ltcCo|Ql z*u2&mqGjV+Kz?k}I(TN^hbjSE$4q(*SpT`hL&lN`Vp zF@HHRF75yN>|j@>3Cs5X^X^uG|L<+}wjcNZT|ED+-k`?tE}#5M#98hyqyaWv9F3XH zPv;XqOCpMwO#>lRF0busyW)!5fjh>O9SW%>to!Y{6L`2BieYuW;YWX)1DB=ZqnGbqI;H&_=M4}yw*fa z+3q6C@TCz3TYRWTZkuqU&iLXY)I5OP48&N-l;})peC|czxOL9vUKMRU9b+Zd z>ZEpJtqvI_A(#fWIu_Q}lyYl%uB)>t<-u;9IXW@*|L@{?@`Mz~;FBlh zND-bl$=E;I+&>^n2ouC8ip7vgsb#h&Pso4Ea~|0+6dyI>w4OX^xqn+4g<(e@X~=_l zYWKfAwB+XJEcC9YqAO5?CHw!yi>+Qs{(Jt&|J}*+#~+)|$c#^SA%?OR>h$UVda9>o zIAOcw+2+@;t(GporT-h)kY?L6FJD(=D{gn$L%d zw9nbRP1--cf8Qo;Ja*b-E#Oj-_78g}ZTsKcSAR5YwSToelYXoyQmn=|271MCch-aec=33JI=q|`5`Bx$oD}L40S?Jr> z)()rFvL8C-g@l9yH4E8j9d!e@yN=j{u42!l=F8}MAe^yynkGg4hSqYy>Rn^u(lyh& zy-nJrHJp9)y##yFJ^D)2z!~SlqSZ zT0lkVO>@(0W^tWdl8|HC!d^GOO$|baLXkBzn#v|^y;zh)F%Q*iAV%uJpWmf+x&z~gv^pvH$TU2Za3ymwfotP*|B$byK(gcwo|?9Zf?)La#6AI zhP(cDtJrK;+-i+CTA|DGCR=ffHQ8Vbw$zR7rn_M^u%{c~G@P^W<`@lUOE2Ry?pXe7 zBL5F*L?J@c6*T}$(DMgJ-aot|cA(19W z=Kd%<3rcXJg#x^1`x7nJHa#b7@>f7=7n+jqzLb5`54t=JA~TXr|K>E&j6 zXe63o(6uNQQOv>dIlZ{EiM@O-;{@*M28lmr%4@b}kx5LNwwGHu$)+5)^4H^mx1Kf#r#ES1mz%TRfGOH*=cl!OH@6q%v_JZ*HR8*u~9eDj)6m?xxCsejk%$5?VK$AX~a-a_r$_iY@r$w2+o+P{eZ5 z_k*z29e;oAj;qM&jZopoS-b1A>*R;M{VdjP!(9~*=x_ykbN%xkJ51C>#3r)aN>jL~ z`pr${{>eep2^_}$3iEe;)T0s4(0-+r3XFoM>65jBRiGuU=~p za^FETST;PbDSbiFF3w5dn1qUF@rbv*ZLfc~O|mS3o{eXyhXu(M(!Rk;KW1b01r%a#7~wzufK#My4CL!qGGIfRNQNy#I5iVL zp)Jcp@?YEDwuvS!F>7EO0_=|H5JR$!L=yUK46En0o;^Fu#eavaFA(OADjJCK zQ%R;g=JJ0N{SSr}zMAdFpO))?wtLTu_8;Bn+mHT#ck(pT{{Zni z!<2)#pNdJ7(7y(?@>y1BbN3CdHM&V+(#%6Suhse>>6q=}wZ+UtO%@?!is^RA?(33H zH7g{|#k!|E4wwf`rn+YM_A{uMBdR8z5^1*NZnsU^nEfvO@s3Veo3tU*3sk|Poo=_C z9UP?*_HJv0y%k2-OGj85irKd&R*RR#>MV`K1uNCVSFA{R3fA*iT>7Ltv37%LC@$~_ zlXziN?2UAYA#fdHYkK639)K7*rS;+CxMam}l5S{{ib2j0^|&Gz;L4^ZvAD3LU-xT9 zNgzU@`IYr|Od+PIyGa(Hs`{$v-TR>FR?o_@L1l5SS_Qf4%psk2?*>1)F&>67zCAaw%+frDieNwsG7Ko6 z${QK>k4X&fe{MqOV!Tc#O#St8^KU-MfbSssbs*V(CtVj)-p0?p0*HSpR5G`xxngC6 zyo8Kk59>bb@mcL@!vBHK-tF;!&!6wSEb@QbFCYEC@8ns5|8qosjNXpUoWxiXl-Li0 zHt=vd!Z>onxHj?65t!7a)0QXWTfd7lgtk z=v^_M(>A%P-|`t{(9QIcQWKLO#b`p!SM!(ob}V9*eKUU*^^?brHqvP` zRYZDlx)L!WG<4GVo9ry6ZMU}WC#}7C6e^D#+XTI2O~fQjrUMqI>10eb$OUSnT&b9b zGO!6%vn)q*It`q38mYRI8ht24#}6U1>^^a#{QLSyvkZ(y;x7`7%mOH%EC{}S&E|%(!@y1-mnhh}b-I@+)mho&JG0d%xsZZhFl=%$^gS}%t zHm$Vr3}1$_WghSR-fKmnce$7f$#Te!v7g(t=rQ7_IkY%|F^yK=>Ksi&kFiqhnJIzhCYpbbpMmJ zB*I{hEsh(p?2?zBaYbSPPH>(>i)^Y9Ot4m81-_d)<^F6OKs@GLPrB;zQyS7S^E-oi zzQ(EH2`lNfaRoGil0|5YzCFm!FOA2f>j8=RDQClciDh$}bD_NM^sYKpk971~f11#L zM3XC%|E2Q(&WqCh-`4hH{GU5{R-pffUm}}#Ff;;knj*PgV039rr{oF;b%B~#t*e_m zmt1OYHyn}|+whZ5Pm|GzeS)MK``oK&I#?O^U?cLqYb3;=VW zlrOzHf06AxAo$w~qL+~Eo(>sl|FuoppW9alil!4cN`hcc{*};xk2v!QjUoWnYyHBo zbttcNAA006HLQgkoz6*~Ne!5%9&*p25&}{Jt(mDhcz3GHf+i$l!*#E9G_tlpCS$EN z9d_oPX9^COcQ6jtgEymHJm)r*a;1MtG0$?z1*KG=(Y(7N#CM^&5pImH&N$QQz*h1{ zXFAs0+m#1c#KK%_*zYRHwpjjLiiD`8V&QQ9P2ys`oQ&9*f#)EmjS-@|F{;R{oUzNo zl33=WiF9DGr&zf0#o2-}xtqo5bis~USn3A0O*%dKu9|M0s*o4X;H$n~dn;A8dUIRq zzK{L%X~O@Z1@dj(|Ma%DO7S1NJCE_d@8(&7|4Xlb5FZTLTtGK1-sDK7y-+zd_U%f%?@07$Y^HDL3dmX!!Fwk{ zG8yw33oTojNEVwAJn3oUxIwuILqy0tvWH1Wz?D~-N&;^OtZn?-?};jGlT+KZg!C!ee64#51{=~wMJ;SV)7R0sU&t?+i2m}0(DTa^81;d2zlFe95 zgW{Y@irM2+@A%uk&&uOy=?E*Sr;D6v{?;lzcPl0+*YxY+fn$!ka=jI$g^qFbE8=~2 zx`HJ|>Edz3MZqeE8QEbqAWwfCayr@hsAvb2e{8b|AvkHK-0os5)n0 z$Jl-(Eq6m&&e^=$CFq@_bI^q>#ek~IH#n?jilw@N-Pai7HMemq_Dw$UTxsXzYvj$E z$}Q?1-_j_uhQf~Jl^)A$!b6{ZSyb!0bkOz2Q%kp-ZDRRuOP#nxOk$>D&Sp&G7WgRz zF{A#R3_|})>WeTXIENu|xjdwL0CjS+rGu-ybFIvWq`0(5$ ze@e5#8KWSxKYeTrhl*=LI$&dv(MvsM{9+&-8{G6sOhaEx(}}}oa5+hb{2)ZYXqa#6 zmkGn9ZGuqWCvrX=2)v(Z&~zrjRxmn+^*})$NHh4)Ny_~!g$*({R{tQAfzh8X^HC(7 z#!ia$TP-C9-=!$G`?f-6*OMN^@6_cH& zjb}U_aCv4XvJ$y1Cnw2h6tK$8R~;m?1h}54cgeIgyai2Gn+@ie)5t~HdPBGibD&ca z#cak!BArv*>`2R@0y{06@TXXE8CQC5Ea45a2o~DTT^&w07`o>1xq+vV{$Gihj@fPb zfAo4UoKquvE>B;-ByF_2NnkRir>c%eAb{I{O!>fpbOH3u+~Mvbtr^ z>EYM*uWi@Q(mm~$)kXHAdStcGJd*f__cWpZnSbZiPJku!zx$$FwEye%p7$Q<|6M#Q z(f`nAu_V+e1;OtxwbiirvdEC8!cmyyJ%uZd0#p_>wTmftQJ~-@{rxOcTx66_MS=a| zI+a&t4{)ojd9zft@lQGp)~jnjAiv@!`yaJnw`TwQyj$A;-K`go{=awftg!#lnU9AU z1(u5tl;>kDWm}oo==AF;0HTsnHIA7w`+l*oZG#?~w@{~JUpAx*H63@d*p9Ki^RFH= z^mir>!`Vj~+cZAxOC(}t@;YGyU%$ToZtXl7u%QZIa;!R_lV)^koX5#{VHydVbOiZb zick~B*X=(*Q|svx==AsX>(@59Bm*khi|3@%@!3%LY`sE(@{LCaU9(3GR3gfCzS5d|DH5>o$w$dH=rHDEh6K!vwYCHt{d z6*PgR2pPpb+@qqlwJaz`U5Pb<%0!Q>*9Eo6^oq5u)ZEUh>;N9cVrq{}T*0L)x9}<> zy)ebUR@zymhBJ+lhQ?g%I4kJ2v)gyG1I;B&+o=pEka|D(9rCOdl>cclvzlp7rCWQa zolZH-VLL+8;h4=hyFkN?Q1RGYii#0=`WN}s=nx4HiOpArSMjxB5VJs_2_vt`n!Rbs z29w7S=fi7Ttx8pvDoba2{j%FQtO6~P1$tAwm$h@KA*i~UB_cK@jkXfD5M25PBotxC zlx~7@_1AWV+xv4i@8$6j?(A2^#9V(xn-2rN?mzn$vl)ve`&qx-eND`trc@rw+@i%r zzS*Yyozn2j)veT@Nq@FF{ylbC5RS?HtZ z6P*d}muK5#yoey}21KA{;f%*3M6+oy&a96>ZRUo>(gvYUK)0i4=yyyn9o{~}KV`tR79YO7YRehAG3Yw81*%kPZBn8d+H*-n^{P%rGNwU2e*uF-8Wg4Y3+CW07HP zVAD~jiVxW_qs4x$^;eZ;s+St3W<6P_87i~7BG%LDkpqpe8|I(-YmWl~XQzg+0E zle0YpwnD_nIDA*M`-cd0MIRElV_ml&&4gf3s=TK_$>L5H)mE!mE0(~mHC3!Y-uAMA zWg4*Zw`#k?+8pT>XgW;-#iLTb9NTV%X`^c^Sn$VMcq6^}thJYX;Q^=doQ#qX`6#2) zhFm9nJW*EJCgOs}&qCt1bgNj;@df1S9>~VhVdqq9UN%HG19!nhH)|93R?)}C>bnb; z2#cC*+|W%eyxF-KD66f#rEb-W-h44^I}KLBRT9>(hy`rH+~>57n)20{U{~q7uRHJ7 zy#?2Mr8#$x0?R?9yn+b}_~3V+3&fH&FYdCc<;;J1G`@U%R+j&!H0IPFtfUHDBLBU7 zv9(i_|GLi~<-a?5t|I@v)i`kQ!;MRS7PlUZ>}LV3mHfc_@p@99?c;W2zKSVbN#e8h zO>;C+lPe2-g|@0iJ{k`vTrtQp++;vb@nTDfn$(Mqg?98ot1HxqjVD5=8qqO!KDBeb zRU{RY}Ns!$>#7N^T76Wdrw{RzldBE>H4}sv(N@_AdCCK)|Iw zZD%jE7feFUrmDxjit-JRFspS7(^NI4#WVK5iz27V33y|=oEu~YnvDAj${gElMSE9K z;nsBxAml?p)BE0rFaLg;`hI-s&x-#4%CN}+VhtcOQgm4x4xwzQY1$zg^o zPCF@H)Tp80^LA=9JV>>eA$9*7sKu~?yUDK8Yue6oWt_&W z0?382+`dk(aH2gZot$Kc2&x?ffIR@2ILb#JEG2d;Z-tf8snpl?${bHj2@Eey-l zG|q;)f|}-5RicYTl5a$Lwg`mlkiXkkiQczX=I)+V^?zCU<|@D?`oG?b?UMc1i%0vf zyLqmn|2sw;IQ^e*Ze084px1*@0A^#VSN~;YuBQQX`nnzcU-bm9qyluBxTYIWMN5@B zz*K5Y%ezAE@>VrNVBgA2H@Bn@$0lNdcB#6zN;4`if9l<%?Nqr~<;>Qr56Z>sMdymW zaYHUf-Brw1FRz`b=%TnD3nqJ2)1igP*=PlB*NkW}WDiNHaW$^q zXG89@H1fDfFvf@p7Hh`2=*%l4TOyffBi!bqF`ct{M~pi5+oE%=Hfa*Xlrnjr>}Y+6 z_rpUoYI}qghWrmYPqm&0XMr$S+sCR6->^E&0dYl) zxtdaJK||Nni@A&SZK%ddEa8evP{UTEW-3s-{ihf9MyO&cC;FZf;a{=BG zcaKFSmN6gGx2jUPWLS&ZrBkT7$6KHzF0**1fQo3TROPac2 zdgt~QU7h4r%C_Gyy41q71Z8SaA}VZi7atatyB{_5s`}rU`FzztfJ^*;Uu<``3i{uz zoyYipck{Haq5wY8NbnyjrarrQ15m`U2c!Lk;nXXB;q&!$zSzUt%{4B(RIl>gq#bHT6?<8`qT0u+aypbixx4^9Wc` z454p4)1Z?v2j?wHSvSUo)F1ox%Zzp0HCsIO`x7=i&oaQme8c#m#i!EFs6>9w5^&s; zWX?n?Q zG5dk34Xe6$cWjz2_R&`BcAiz`fA?%_ss&gg|381R-7VUGz1(^9|GbmuD&oHphIJVb z^9QUf=_BV3e!M?X8#g)`a1! zbaR z562~8A;V!WUFce=$Ye*WNG#NhxlOUmCL3G0+n2*s3ro8gqHgJy%q5s}d12@08; z>*TdF(P!NTTyx%(Z@Xuudu}&drQQzaD9aTYGqs<@F$*)5V!MEltov zeV;t-bTnI}g{{}$>Eeb8=uyzn_p}U_p+>g)&O1ASrI~mbQcW%Y?@d@R<>OGq?7Dp{ z;s3ik#rQA17uzpiJo5i{@jM~NRB1{D$$W9W^|2F@LBa!HQ}Kun&*_*+ul0nSO}Hd7 zi6RjzN#ukD0oc5dDOJM>562rMW&u@vW{%D5Jq`WV6B4p9T1l^=V!~LXlK-*pk@sOR zCnAKJdPpQFo7p=x>DXLJ+G#p3stHe7wMRbvodwhU>)+OFW;uOGcya<6<~Egx_)u;J zSoE{Orzg71I%vPgu}C6KQV_>TAjW)1225QrO>oRWu%6dyJ$XXT-u&mmNvqZG_cdqT z@>#?}pM^ut4EL_j)?L#cobyJJx=Xs=7w?O;x-rT4cGHx2rV}?Qp82gigB}M|PFmj) zJ$#aOJSRz{`P8%&jEhG6qwROrYn}7Z-z8dt=i|3DYE7AE$QqIM-&qg{@{5QAzm0=<@`N0PDoq5~Y5|c(MkI>GjQdOyYUkYQ^)y@& zizT_3@Zp3EX{cEsQ2v9X!;A$YA|bml>tRw50ydP^f88DuWJ*IiX0g|5{g7METn9k$ zKmD8x7>y#CwRUdaz;YnU_$&&^7>sF&vN@4Om86pTPWs&!JbZ|< z1w zG2WzEA|8TPP5n>Z-x;q3kjkftSv$B86xR|YQ&dJ#9FjXo2FHJkV$G z@K1D%OEo{VMo`FkQScjcedMSx_c@#W5vK{{ny>=j*}%_QvQ-gGeo1*nF)++no>O$% zB~2Sj`*51)tYnI5I&U>mdKPCHEj0tEfbhA6H&mvAVU!3PKezDqOJ#1`JS(eOt^Xjp zjaNVG-tX$O+vpaC*5ZlhR8sPcCX(lB2)AG^>IMS(2hgu9PiH3lWnJ95g<+Uo{om*3 zJ-f`(T(kY->19v<_kVl)Ls&)0govy~iT>fSDXDm7S+c;Bif4|HL;ZKDSQlZQl9W#? zUeZ!|dYT2IVOvj@QDRuKz>|lg1dZu6smO>G8=6yxq1?&7Hh;P-alNtK-;8$AKq%}q z;B%tKcsrdB=eujAuSZ8kgdXUFk=X4k@0qzWEtno3-O(eK`zw!w7Jx}ye~?t|Ct6RE zp_$UaT?D_B&Q$R74?ap7?_=0SC#fpIE5UFz*B8av#?^2Kxo<&dGl$QUx+$GO4G&1C zR7BCdE+m~NbW=LR8Xk^LR^s`bd&u3@upKkErBjSZ+Ck(NbYA{=`Wgh4ycQ|lhTJXf zDC;J3V>(}7zPST4x23b<1xsgLq;5)Q#WP9MS}--Ul|2NVB~>?ETwN@ZyD6QvhV5wF znohTlr5)!sM;)EgB%m;}Yk{!~dfC^_*nN_m{B292FQpTw{I^1IvDIY%;IsU$o~`}% z&1&7k-*|9GV^`0^5E_~SMLkREYAi@bn==At=SxaIW@! zs;^X{M!dNMIyz9*MPW_?$YEy(-thE_3ZsK?NykhoF#~&e;2oJ#340l>1Wk#e*(*Ik zLAwb-%Z!SPrXgUZRFq`6bX= z?mO8vLKt6qyXbsJQ}*KxAUk`uTOHWZ0Q22U`_0ob8yl{TNP0!fY}mn7_{k;%0deMI z6%*`NKuc{tW+y{W&fFN=>BX7%XT7;dDy~^dUFH?%J^$MU#|*0x5j{H!>RLXz*4%ic zt1G!;>D=PESt>~wKO7Z&e0Y2`_|LZ7G`lk(RfS|MuHS6d7?N!j(v-zcRYl#b zv~MJ`rMhCh&(&6bPgm_bbkVkaR*ziwbiKYq&uz;mRD6@r+BRzM*v*@@&3;`i8|Tn1 zK=gJ*IrFE}tzqjC^?jY=DZ<`#=Kl<1AqvRXq&Y*DL{=G@D@u`+Rmj7a*t-j9ydB*OTuuXb)X}*Xm4!}LC@N(S1 z!szkeHq-jMQQ`wI-yeYa7T1qV*;D80nk7%}&rEb_A4*gXTiXckq_Pgq=ryL2`qLYZ zwT^w}`vlgquRC+#dwSeFthgX!y1RU#rS)Aj?JtV0Ut@UK4c?t8`UdN|52$iGt2)%ZjuUQX zR{ybPMFzCIW`dVfb8t;C%$!9B-E4^x<1%cSzF<_g>#XZGll)>g=FZCbB|h8`5+>bQ z`s8KjlbEx+TkFCa$Hn!|{)&yn?#K2P%X~NHPH7q!RW)NlF8I{1aSVZv{-CL{0%1xT z+-IUDTXo~A1sq`hwT<)D*^PhFneN2TOokb*5^^S_3c8>v#)Nrd55H!%t6bQ!HXcN0 z8Qt&#N?yjUbl8nWr}~P{2JOzFE8W#SJ8J#foVmS2O6t?6t9-+A`(rx4piDIlzAI!y5Uu@kNGR@^eL&gYv+c z0%7MC0&+sM18Z`t@Ip#Vx$*!O+sJP>s5ZmRSoKXl>*O~FZ6fV%1|Clf)oEFV9ZJYu z$=OC#zPnf#y)#Q^+*sWTfWcv7JAU`q8IV~r!&qrVP429w2bbWOvbhHmcxjPMX1q2G zs3iqUg^ilrMwVgI1C2*(CaH{xYHj7^dE^RSvg)G&2JF7-z&IY8;))e`rR+( zCeZ2|%aug%qG09t0~zbN-!coxh}X)3BG?k3$QTECpA|mbK1)36_u+j-Q$`A4$U&J- z=#}_Yg`t6ep=j+nS2f`Z|KlGdyc8*>iL1e zu9j3`@w5CLR~LdxTB_%U9-D5|5JZF^vj~7GYS0K*Q|iF5um3V!89J*DmK*8@1qo$mGG z-T{QoyhF^HUe5w~WK3#0C1f+r(A1#BNXGTR)}pu<_o9fTDV6eHJfrK#J;jnRZl9kJdF!Y-(oR!Qrm`a}1K7_>f0lZhK z3%Lt6{z+$^m715>VNF=AN2-tZJR>5jf~2Kn2x^D6h#qDLO~gvSWp)6PPbnxirBYXL zLrOHtvHn_dUAr*5!xfj3;bG*NX%=0G31vdgb3-PLbo^!@vf=a+Ay#>u>P+lQ~B(DyW~#A|2r_L~*#3iCBRVC=G7!KJq| zJ+lb1;d4c2D_gt@5NbDV&~0P->y5sCMgB$o5WX1MI%iRB<6mb@&|1p12KMg!!`t_X z`eMeZl$Vkh^gclGM@Nqf6@N6i16cfqXz^>W2f8_E4m>j z?|cK#oT>k=tC+*-U5+&zdAp-uDlQZR)%@^m@2VcrR2BHK!|ui`23e7m`lAnxHbBhb z56MeS-VeP$6Fuf7fgXPC=>d*N`tt7(#~Dp|M)#vGMhx!6h(XAR!EP8acmPHWx*6dB z4S#VE0ye#m!yq|Ij-u$(c?s|MHJy&AfWgTD93LGY9avP3V|NS4cPHDh-gIK~&W58@xhmaTqQru7?OND(=(#8*sgx5>*RbRhAjxJ=4__<4<8N+A6IB zjEN$?Dcb{JO41_NAr=vt^)fum-k$%QMA3^EA2Ey05`IGk1!hqtsYQaHXTpEIco9W0 zT)2#8`?ECca0ra1zj*Yh?Vb!_&ki8ShS3a0TusbJ$Jo6S$NQinEm;G>iQRA4dAwMs zK}7^!7PI{XKK&0BbTxdbgDur6Kq_WCWzv)OF$PXasdXxYDMv0fk*`@4(%c<}us0?T zEQ;Y5%?0BVS!~7O0!`N^NsFwUd_L^k(lHVjTPdu3u_=Xt+C#^T)n z0#T3~xJ)i=zGG2M$cQSIqCug%JK7)5Y+qt*0%(GhkBI zRBqm+@z<>tSv{30Es0>4nL>ZrfVeHDfcH zY`Kc=HZ$yeB4|#98>T+-JZHE7iN!LW);h{Tsjar1>*L?APkx`Wu@UiM-~SoclEx{K zRPI|Vv9HRp5uWRV;&6SUmE{*n^SXe7l~>Z}f@@i~*h21Awc>)2LLLe#d2vl+P24g5 z_av^kRB=Oyk@I0t-zGijD30gXO$i$7K45$C^>M7Y{qy8|f&%~R`Rn=X`G5BOUjP6A N|NkMwV=w?j1purzI{5$q diff --git a/rds/base/charts/layer0_describo/defaults/nginx.conf b/rds/base/charts/layer0_describo/defaults/nginx.conf deleted file mode 100644 index 68e4d86..0000000 --- a/rds/base/charts/layer0_describo/defaults/nginx.conf +++ /dev/null @@ -1,82 +0,0 @@ -upstream api_socket_nodes { - ip_hash; - server 127.0.0.1:8080; -} - -server { - listen 80; - listen [::]:80; - server_name 127.0.0.1; - - proxy_buffering off; - - #charset koi8-r; - #access_log /var/log/nginx/host.access.log main; - - location / { - root /usr/share/nginx/html; - try_files $uri $uri/ /index.html; - } - - location ~ ^/api/(.*) { - #resolver 127.0.0.11 valid=30s; - set $api 127.0.0.1; - add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0'; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header Host $host; - #proxy_set_header Authorization $http_authorization; - # auth_request_set $token $upstream_http_x_auth_request_access_token; - # add_header 'Authorization' $token; - proxy_redirect off; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_send_timeout 120; - proxy_read_timeout 120; - send_timeout 120; - proxy_pass http://$api:8080/$1$is_args$args; - } - - location /socket.io/ { - proxy_http_version 1.1; - proxy_redirect off; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass http://api_socket_nodes/socket.io/; - } - #error_page 404 /404.html; - - # redirect server error pages to the static page /50x.html - # - error_page 500 502 503 504 /50x.html; - location = /50x.html { - root /usr/share/nginx/html; - } - - # proxy the PHP scripts to Apache listening on 127.0.0.1:80 - # - #location ~ \.php$ { - # proxy_pass http://127.0.0.1; - #} - - # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 - # - #location ~ \.php$ { - # root html; - # fastcgi_pass 127.0.0.1:9000; - # fastcgi_index index.php; - # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; - # include fastcgi_params; - #} - - # deny access to .htaccess files, if Apache's document root - # concurs with nginx's one - # - #location ~ /\.ht { - # deny all; - #} -} diff --git a/rds/base/charts/layer0_describo/defaults/type-definitions-lookup.json b/rds/base/charts/layer0_describo/defaults/type-definitions-lookup.json deleted file mode 100644 index d3a628c..0000000 --- a/rds/base/charts/layer0_describo/defaults/type-definitions-lookup.json +++ /dev/null @@ -1,16 +0,0 @@ -[ - { "name": "Person", "help": "A person (alive, dead, undead, or fictional)." }, - { "name": "Thing", "help": "The most generic type of item." }, - { - "name": "Organization", - "help": "An organization such as a school, NGO, corporation, club, etc." - }, - { - "name": "CreativeWork", - "help": "The most generic kind of creative work, including books, movies, photographs, software programs, etc." - }, - { - "name": "Dataset", - "help": "A body of structured information describing some topic(s) of interest." - } -] diff --git a/rds/base/charts/layer0_describo/defaults/type-definitions.json b/rds/base/charts/layer0_describo/defaults/type-definitions.json deleted file mode 100644 index 5fa4d81..0000000 --- a/rds/base/charts/layer0_describo/defaults/type-definitions.json +++ /dev/null @@ -1,200 +0,0 @@ -{ - "Person": { - "id": "http://schema.org/Person", - "name": "Person", - "help": "A person (alive, dead, undead, or fictional).", - "subClassOf": [ - "Thing" - ], - "allowAdditionalProperties": false, - "inputs": [ - { - "id": "http://schema.org/address", - "name": "address", - "help": "Physical address of the item.", - "multiple": false, - "type": [ - "Text" - ] - }, - { - "id": "http://schema.org/affiliation", - "name": "affiliation", - "help": "An organization that this person is affiliated with. For example, a school/university, a club, or a team.", - "multiple": false, - "type": [ - "Organization" - ] - }, - { - "id": "http://schema.org/email", - "name": "email", - "help": "Email address.", - "multiple": false, - "type": [ - "Text" - ] - }, - { - "id": "http://schema.org/familyName", - "name": "familyName", - "help": "Family name. In the U.S., the last name of a Person.", - "multiple": false, - "type": [ - "Text" - ] - }, - { - "id": "http://schema.org/givenName", - "name": "givenName", - "help": "Given name. In the U.S., the first name of a Person.", - "multiple": false, - "type": [ - "Text" - ] - } - ], - "linksTo": [ - "Organization" - ], - "hierarchy": [ - "Person", - "Thing" - ] - }, - "Thing": { - "id": "http://schema.org/Thing", - "name": "Thing", - "help": "The most generic type of item.", - "subClassOf": [], - "allowAdditionalProperties": false, - "inputs": [ - { - "id": "http://schema.org/description", - "name": "description", - "help": "A description of the item.", - "multiple": false, - "type": [ - "Text" - ] - }, - { - "id": "http://schema.org/name", - "name": "name", - "help": "The name of the item.", - "multiple": false, - "type": [ - "Text" - ] - } - ], - "linksTo": [ - "CreativeWork", - "Organization", - "Person" - ], - "hierarchy": [ - "Thing" - ] - }, - "Organization": { - "id": "http://schema.org/Organization", - "name": "Organization", - "help": "An organization such as a school, NGO, corporation, club, etc.", - "subClassOf": [ - "Thing" - ], - "allowAdditionalProperties": false, - "inputs": [ - { - "id": "http://schema.org/address", - "name": "address", - "help": "Physical address of the item.", - "multiple": false, - "type": [ - "Text" - ] - } - ], - "linksTo": [], - "hierarchy": [ - "Organization", - "Thing" - ] - }, - "CreativeWork": { - "id": "http://schema.org/CreativeWork", - "name": "CreativeWork", - "help": "The most generic kind of creative work, including books, movies, photographs, software programs, etc.", - "subClassOf": [ - "Thing" - ], - "allowAdditionalProperties": false, - "inputs": [ - { - "id": "http://schema.org/author", - "name": "creator", - "help": "The author of this content or rating. Please note that author is special in that HTML 5 provides a special mechanism for indicating authorship via the rel tag. That is equivalent to this and may be used interchangeably. ", - "multiple": false, - "type": [ - "Person", - "Organization" - ] - } - ], - "linksTo": [ - "Organization", - "Person" - ], - "hierarchy": [ - "CreativeWork", - "Thing" - ] - }, - "Dataset": { - "id": "http://schema.org/Dataset", - "name": "Dataset", - "help": "A body of structured information describing some topic(s) of interest.", - "subClassOf": [ - "CreativeWork" - ], - "allowAdditionalProperties": false, - "inputs": [ - { - "id": "http://schema.org/datePublished", - "name": "datePublished", - "help": "Date of first broadcast/publication.", - "multiple": false, - "type": [ - "Date" - ] - }, - { - "id": "http://schema.org/zenodocategory", - "name": "zenodocategory", - "help": "The Zenodo Category: [ 'publication/book', 'publication section', '...', 'dataset', 'image/plot', '...' ]", - "multiple": false, - "type": [ - "Text" - ] - }, - { - "id": "http://schema.org/osfcategory", - "name": "osfcategory", - "help": "The OSF Category: [ 'analysis', 'communication', '...', 'procedure', 'instrumentation', '...' ]", - "multiple": false, - "type": [ - "Text" - ] - } - ], - "linksTo": [ - "CreativeWork" - ], - "hierarchy": [ - "Dataset", - "CreativeWork", - "Thing" - ] - } -} \ No newline at end of file diff --git a/rds/base/charts/layer0_describo/templates/NOTES.txt b/rds/base/charts/layer0_describo/templates/NOTES.txt deleted file mode 100644 index e670bfc..0000000 --- a/rds/base/charts/layer0_describo/templates/NOTES.txt +++ /dev/null @@ -1,21 +0,0 @@ -1. Get the application URL by running these commands: -{{- if .Values.ingress.enabled }} -{{- range $host := .Values.ingress.hosts }} - {{- range .paths }} - http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }} - {{- end }} -{{- end }} -{{- else if contains "NodePort" .Values.service.type }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "layer0_describo.fullname" . }}) - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo http://$NODE_IP:$NODE_PORT -{{- else if contains "LoadBalancer" .Values.service.type }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "layer0_describo.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "layer0_describo.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') - echo http://$SERVICE_IP:{{ .Values.service.port }} -{{- else if contains "ClusterIP" .Values.service.type }} - export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "layer0_describo.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - echo "Visit http://127.0.0.1:8080 to use your application" - kubectl port-forward $POD_NAME 8080:80 -{{- end }} diff --git a/rds/base/charts/layer0_describo/templates/_helpers.tpl b/rds/base/charts/layer0_describo/templates/_helpers.tpl deleted file mode 100644 index 8b726c2..0000000 --- a/rds/base/charts/layer0_describo/templates/_helpers.tpl +++ /dev/null @@ -1,91 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "layer0_describo.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "layer0_describo.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "layer0_describo.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Return the proper describo image name -*/}} -{{- define "image" -}} -{{- $registryName := .imageRoot.registry -}} -{{- $repositoryName := .imageRoot.repository -}} -{{- if .repository -}} -{{- $repositoryName = .repository -}} -{{- end -}} -{{- $tag := .imageRoot.tag | toString -}} -{{- if .global }} - {{- if .global.image }} - {{- if .global.image.registry }} - {{- $registryName = .global.image.registry -}} - {{- end -}} - {{- end -}} -{{- end -}} -{{- if $registryName }} -{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} -{{- else -}} -{{- printf "%s:%s" $repositoryName $tag -}} -{{- end -}} -{{- end -}} - -{{/* -Return the proper describo image name -*/}} -{{- define "layer0_describo.apiImage" -}} -{{- include "image" (dict "imageRoot" .Values.image "global" .Values.global "repository" .Values.image.apiRepository) -}} -{{- end -}} - -{{- define "layer0_describo.uiImage" -}} -{{ include "image" (dict "imageRoot" .Values.image "global" .Values.global "repository" .Values.image.uiRepository ) }} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "layer0_describo.labels" -}} -app.kubernetes.io/name: {{ include "layer0_describo.name" . }} -helm.sh/chart: {{ include "layer0_describo.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.labels }} -{{ toYaml .Values.labels }} -{{- end -}} -{{- end -}} - -{{- define "layer0_describo.domain" -}} -{{- if .Values.global }} -{{- .Values.global.domain }} -{{- else if hasKey .Values "domain" }} -{{- .Values.domain }} -{{- else }}localhost{{- end -}} -{{- end -}} diff --git a/rds/base/charts/layer0_describo/templates/configmap.yaml b/rds/base/charts/layer0_describo/templates/configmap.yaml deleted file mode 100644 index 7d08a0d..0000000 --- a/rds/base/charts/layer0_describo/templates/configmap.yaml +++ /dev/null @@ -1,59 +0,0 @@ -{{- $domains := .Values.domains -}} - {{- if .Values.global }} - {{- if .Values.global.domains }} - {{- $domains = .Values.global.domains -}} - {{- end -}} - {{- end -}} -apiVersion: v1 -kind: ConfigMap -metadata: - name: describoconfig - namespace: {{ .Release.Namespace }} -data: - DB_HOST: {{ .Values.postgresql.fullnameOverride | quote }} - DB_PORT: {{ .Values.postgresql.service.port | quote }} - DB_USER: {{ .Values.postgresql.postgresqlUsername | quote }} - DB_PASSWORD: {{ .Values.postgresql.postgresqlPassword | quote }} - DB_DATABASE: {{ .Values.postgresql.postgresqlDatabase | quote }} - NODE_ENV: "production" - LOG_LEVEL: {{ .Values.environment.LOG_LEVEL | quote }} - ADMIN_PASSWORD: {{ .Values.environment.ADMIN_PASSWORD | quote }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: describo-configuration-file - namespace: {{ .Release.Namespace }} -data: - {{- $files := .Files }} - {{- range tuple "nginx.conf" "type-definitions-lookup.json" "type-definitions.json" }} - {{ . }}: |- -{{ printf "defaults/%s" . | $files.Get | indent 4 }} - {{- end }} - configuration.json: |- - { - "ui": { - "siteName": "Sciebo - Describo Online", - "logo": "http://www.researchobject.org/ro-crate/assets/img/ro-crate.svg", - "login": "", - "services": { - "owncloud": false, - "reva": false, - "s3": false, - "onedrive": false - }, - "basePath": "/", - "maxSessionLifetime": "86400", - "maxEntitiesPerTemplate": "100" - }, - "api": { - "port": 8080, - "periodicProcessInterval": 300, - "applications": [ - { - "name": "Owncloud ScieboRDS", - "secret": "{{ .Values.global.describo.api_secret }}" - } - ] - } - } diff --git a/rds/base/charts/layer0_describo/templates/deployment.yaml b/rds/base/charts/layer0_describo/templates/deployment.yaml deleted file mode 100644 index 1fe67c4..0000000 --- a/rds/base/charts/layer0_describo/templates/deployment.yaml +++ /dev/null @@ -1,121 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "layer0_describo.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer0_describo.labels" . | indent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: -{{ include "layer0_describo.labels" . | indent 6 }} - template: - metadata: - labels: -{{ include "layer0_describo.labels" . | indent 8 }} - spec: - volumes: - - name: describo-configuration - configMap: - name: describo-configuration-file - items: - - key: configuration.json - path: configuration.json - - key: type-definitions-lookup.json - path: type-definitions-lookup.json - - key: type-definitions.json - path: type-definitions.json - - key: nginx.conf - path: nginx.conf - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: "api" - image: {{ template "layer0_describo.apiImage" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - volumeMounts: - - name: describo-configuration - mountPath: /srv/api/configuration.json - subPath: configuration.json - readOnly: true - - name: describo-configuration - mountPath: /srv/profiles/type-definitions-lookup.json - subPath: type-definitions-lookup.json - readOnly: true - - name: describo-configuration - mountPath: /srv/profiles/type-definitions.json - subPath: type-definitions.json - readOnly: true - env: - - name: DB_PASSWORD - valueFrom: - secretKeyRef: - name: describo-pg-passwd - key: postgresql-password - - name: ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: admin-passwd - key: passwd - envFrom: - - configMapRef: - name: mservice - - configMapRef: - name: proxy - - configMapRef: - name: globalenvvar - - configMapRef: - name: describoconfig - resources: - {{- toYaml .Values.resources | nindent 12 }} - - name: "ui" - image: {{ template "layer0_describo.uiImage" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - volumeMounts: - - name: describo-configuration - mountPath: /etc/nginx/conf.d/default.conf - subPath: nginx.conf - readOnly: true - env: - - name: "VUE_APP_BASE_URL" - value: "{{ .Values.ingress.path }}" - - name: "NODE_ENV" - value: "production" - envFrom: - - configMapRef: - name: mservice - - configMapRef: - name: proxy - - configMapRef: - name: globalenvvar - ports: - - name: http - containerPort: {{ .Values.service.targetPort }} - protocol: TCP - livenessProbe: - httpGet: - path: / - port: http - periodSeconds: 10 - readinessProbe: - httpGet: - path: / - port: http - periodSeconds: 10 - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/rds/base/charts/layer0_describo/templates/ingress.yaml b/rds/base/charts/layer0_describo/templates/ingress.yaml deleted file mode 100644 index 1e679a0..0000000 --- a/rds/base/charts/layer0_describo/templates/ingress.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- $fullName := include "layer0_describo.fullname" . -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }} - labels: -{{ include "layer0_describo.labels" . | indent 4 }} - annotations: -{{- include "common.ingressAnnotations" . | nindent 4 }} -spec: - {{- if (include "common.tlsSecretName" .) }} - tls: - - hosts: - - {{ .Values.global.describo.domain }} - secretName: {{ include "common.tlsSecretName" . }} - {{- end }} - rules: - - host: {{ .Values.global.describo.domain }} - http: - paths: - - path: {{ .Values.ingress.path }} - pathType: Prefix - backend: - service: - name: {{ $fullName }} - port: - # number: 80 - name: http \ No newline at end of file diff --git a/rds/base/charts/layer0_describo/templates/service.yaml b/rds/base/charts/layer0_describo/templates/service.yaml deleted file mode 100644 index c730fe2..0000000 --- a/rds/base/charts/layer0_describo/templates/service.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - {{- with .Values.service.annotations }} - annotations: - {{ toYaml . | indent 4 }} - {{- end }} - name: {{ include "layer0_describo.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer0_describo.labels" . | indent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - app.kubernetes.io/name: {{ include "layer0_describo.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/rds/base/charts/layer0_describo/templates/tests/test-connection.yaml b/rds/base/charts/layer0_describo/templates/tests/test-connection.yaml deleted file mode 100644 index c21eae5..0000000 --- a/rds/base/charts/layer0_describo/templates/tests/test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "layer0_describo.fullname" . }}-test-research" - labels: -{{ include "layer0_describo.labels" . | indent 4 }} - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['{{ include "layer0_describo.fullname" . }}:{{ .Values.service.port }}'] - restartPolicy: Never diff --git a/rds/base/charts/layer0_describo/values.yaml b/rds/base/charts/layer0_describo/values.yaml deleted file mode 100644 index 8fb3036..0000000 --- a/rds/base/charts/layer0_describo/values.yaml +++ /dev/null @@ -1,87 +0,0 @@ -# Default values for layer3_token_storage. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. -replicaCount: 1 - -image: - tag: 0.26.6 - pullPolicy: Always - registry: docker.io - uiRepository: arkisto/describo-online-ui - apiRepository: arkisto/describo-online-api - -labels: - app.kubernetes.io/component: research-data-services.org - app.kubernetes.io/part-of: service - research-data-services.org/layer: layer0 - -fullnameOverride: layer0-describo - -service: - type: ClusterIP - port: 80 - targetPort: 80 - -ingress: - path: / - annotations: - nginx.org/server-snippets: | - location /socket.io/ { - proxy_http_version 1.1; - proxy_redirect off; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass http://layer0-describo/socket.io/; - } -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -persistence: - enabled: true - accessModes: - - ReadWriteOnce - size: 1Gi - annotations: {} - -environment: - LOG_LEVEL: info - ADMIN_PASSWORD: adminpass - -# domains for webdav addresses (currently owncloud only) -domains: - - name: owncloud.local - ADDRESS: https://owncloud.local/owncloud - OAUTH_CLIENT_ID: ABC - OAUTH_CLIENT_SECRET: XYZ - -postgresql: - image: - tag: 14.1.0 - service: - port: "5432" - fullnameOverride: postgresql - postgresqlDatabase: "describo" - postgresqlUsername: "admin" - postgresqlPassword: "admin" - -global: - describo: - domain: "" diff --git a/rds/base/charts/layer0_helper_describo_token_updater/.helmignore b/rds/base/charts/layer0_helper_describo_token_updater/.helmignore deleted file mode 100644 index 50af031..0000000 --- a/rds/base/charts/layer0_helper_describo_token_updater/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/rds/base/charts/layer0_helper_describo_token_updater/Chart.lock b/rds/base/charts/layer0_helper_describo_token_updater/Chart.lock deleted file mode 100644 index 0b92850..0000000 --- a/rds/base/charts/layer0_helper_describo_token_updater/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://../common - version: 0.1.2 -digest: sha256:907f03fdcae7108b8137782291baf28aad5dff00fe221ee3bb3bebd8d1101c9c -generated: "2023-02-07T10:30:53.980764318+01:00" diff --git a/rds/base/charts/layer0_helper_describo_token_updater/Chart.yaml b/rds/base/charts/layer0_helper_describo_token_updater/Chart.yaml deleted file mode 100644 index ab3a0d5..0000000 --- a/rds/base/charts/layer0_helper_describo_token_updater/Chart.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: v2 -appVersion: "1.0" -description: A Helm chart for Kubernetes -name: layer0-helper-describo-token-updater -version: 0.2.1 -home: https://www.research-data-services.org/ -type: application -keywords: - - research - - data - - services - - describo - - describo-online - - updater - - layer3-token-storage -maintainers: - - email: peter.heiss@uni-muenster.de - name: Heiss -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS -icon: https://www.research-data-services.org/img/sciebo.png -dependencies: - - name: common - version: ^0.1.0 - repository: file://../common - alias: layer0-helper-describo-token-updater-common - diff --git a/rds/base/charts/layer0_helper_describo_token_updater/charts/common-0.1.2.tgz b/rds/base/charts/layer0_helper_describo_token_updater/charts/common-0.1.2.tgz deleted file mode 100644 index 45c8bc2be2ba0722f4c15080e9c016990f4461c8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 995 zcmV<9104JxiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%*a=`DhecALMbT~%7Xf-&(9&4q zMj{Dv7`Vwyo%lnczXh41qzT7`s;DUsnARt3eJ&TWWp%=(ZJ z88`O*SW=Qtd8jjg5=xxv{_V}A_Q_~ra15!OT45J#UgZ(+0Y77ZH&FjkTK7L;W>P`u z{7(^@R4+1A#L2wMcJNI9pI@8@t^OZf49*Vy{}#lSOTWi%k#ehm5(HzlK?^byF+$PO zY`Fxf!ZeQ%yj8jIQtH7wh-66MmBU-D$pd~T(i|N(f)Y-eQ-UjP@ZwZYMe4!Hdw6_g zJ^%5MEth?Wa3<9g*ZsBh#9}NR*~O0{Ll|EH-vr~8sIF|Zlcaa3SHg{foIw}6?dPgf z3stnWAQ8916`bFJ^n|QbaU^hpzMXqbu~KegcD2j0--=PqXK&nM zR{gG+g`gd(1A<)v+kn=;<*YTOHQ!jNXa?S?^H1IQ)Ojtn_A;JS$(I3AhnvCHQ{`rl zVMmsog{)$W&V5iylPFG4SF38Vs zDr8p)b}Dw|)+mi;j#=*L2edJMoTGiPlJF&d8&3XeA(8$?Wa(31jiu~bOG@1YLyJ_D zLv0z|hFPql=XF8eg0ov%MA!p(O^erJc7a_JUp;641r7OC3#tXiiwySQvLBoMuDbTR zu8s1g&~0}buaQq%_pQ$V_5F`0m}W9o+T!cSc<%pibUteT|6K-`hx^}K&@ucZh|nqr zq+wM7@Q|Q_X)e>KIJS)l??sG`vt#%=>@g zl7+kL2}II5#$!o-`CO&X`1CjHm(Plk#D4LphHkF>t)r<3?{fn)nWAGo?j8*5@u|3H zJx*Eit*wk%?+axQtNvD|M?sGd_2rj?h2+vmWR`2l^+| Rp8)^>|NlA_9oYaD008UA=SKhl diff --git a/rds/base/charts/layer0_helper_describo_token_updater/templates/_helpers.tpl b/rds/base/charts/layer0_helper_describo_token_updater/templates/_helpers.tpl deleted file mode 100644 index 3c91063..0000000 --- a/rds/base/charts/layer0_helper_describo_token_updater/templates/_helpers.tpl +++ /dev/null @@ -1,70 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "layer0_helper_describo_token_updater.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{- define "layer0_helper_describo_token_updater.image" -}} -{{ include "common.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} - - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "layer0_helper_describo_token_updater.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "layer0_helper_describo_token_updater.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "layer0_helper_describo_token_updater.labels" -}} -app.kubernetes.io/name: {{ include "layer0_helper_describo_token_updater.name" . }} -helm.sh/chart: {{ include "layer0_helper_describo_token_updater.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.labels }} -{{ toYaml .Values.labels }} -{{- end -}} -{{- end -}} - - -{{- define "layer0_helper_describo_token_updater.domain" -}} -{{- if .Values.global }} -{{- .Values.global.domain -}} -{{- else if hasKey .Values "domain" }} -{{- .Values.domain -}} -{{- else }}"localhost"{{- end -}} -{{- end -}} - -{{- define "layer0_helper_describo_token_updater.secretName" -}} -{{- if .Values.global}} -{{ .Values.global.ingress.tls.secretName }} -{{- else }} -{{ .Values.ingress.tls.secretName }} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/rds/base/charts/layer0_helper_describo_token_updater/templates/configmap.yaml b/rds/base/charts/layer0_helper_describo_token_updater/templates/configmap.yaml deleted file mode 100644 index 19e35e5..0000000 --- a/rds/base/charts/layer0_helper_describo_token_updater/templates/configmap.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: describohelperconfig - namespace: {{ .Release.Namespace }} -data: - {{- with (mustMergeOverwrite (.Values.global | default dict) .Values.environment) }} - REDIS_HELPER_HOST: {{ .REDIS_HELPER_HOST | default "redis" | quote }} - REDIS_HELPER_PORT: {{ .REDIS_HELPER_PORT | default "6379" | quote }} - REDIS_CHANNEL: {{ .REDIS_CHANNEL | default "TokenStorage_Refresh_Token" | quote }} - {{- end }} - DESCRIBO_API_ENDPOINT: {{ .Values.environment.DESCRIBO_API_ENDPOINT | quote }} - DESCRIBO_API_SECRET: {{ .Values.global.describo.api_secret }} diff --git a/rds/base/charts/layer0_helper_describo_token_updater/templates/deployment.yaml b/rds/base/charts/layer0_helper_describo_token_updater/templates/deployment.yaml deleted file mode 100644 index 2e5d16e..0000000 --- a/rds/base/charts/layer0_helper_describo_token_updater/templates/deployment.yaml +++ /dev/null @@ -1,48 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "layer0_helper_describo_token_updater.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer0_helper_describo_token_updater.labels" . | indent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: -{{ include "layer0_helper_describo_token_updater.labels" . | indent 6 }} - template: - metadata: - labels: -{{ include "layer0_helper_describo_token_updater.labels" . | indent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ template "layer0_helper_describo_token_updater.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - envFrom: - - configMapRef: - name: mservice - - configMapRef: - name: proxy - - configMapRef: - name: globalenvvar - - configMapRef: - name: describohelperconfig - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/rds/base/charts/layer0_helper_describo_token_updater/values.yaml b/rds/base/charts/layer0_helper_describo_token_updater/values.yaml deleted file mode 100644 index af62849..0000000 --- a/rds/base/charts/layer0_helper_describo_token_updater/values.yaml +++ /dev/null @@ -1,44 +0,0 @@ -# Default values for layer3_token_storage. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - registry: zivgitlab.wwu.io - repository: sciebo-rds/sciebo-rds/port_helper_describo_token_updater - tag: release - pullPolicy: Always - -labels: - app.kubernetes.io/component: research-data-services.org - app.kubernetes.io/part-of: service - research-data-services.org/layer: layer0 - -fullnameOverride: layer0-helper-describo-token-updater - -resources: - {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -environment: - DESCRIBO_API_ENDPOINT: http://layer0-describo:80/api/session/application - -global: - describo: - api_secret: "" diff --git a/rds/base/charts/layer0_web/.helmignore b/rds/base/charts/layer0_web/.helmignore deleted file mode 100644 index 50af031..0000000 --- a/rds/base/charts/layer0_web/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/rds/base/charts/layer0_web/Chart.lock b/rds/base/charts/layer0_web/Chart.lock deleted file mode 100644 index 3e310b8..0000000 --- a/rds/base/charts/layer0_web/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://../common - version: 0.1.2 -digest: sha256:9f1061b59aef21bbca3bc05796009e900a75e94f1b37107e92b756f2c0a6e1d7 -generated: "2023-02-07T10:30:54.433292998+01:00" diff --git a/rds/base/charts/layer0_web/Chart.yaml b/rds/base/charts/layer0_web/Chart.yaml deleted file mode 100644 index 254ecf8..0000000 --- a/rds/base/charts/layer0_web/Chart.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v2 -appVersion: "1.0" -description: A Helm chart for Kubernetes -name: layer0-web -version: 0.3.3 -home: https://www.research-data-services.org/ -type: application -keywords: - - research - - data - - services -maintainers: - - email: peter.heiss@uni-muenster.de - name: Heiss -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS -icon: https://www.research-data-services.org/img/sciebo.png -dependencies: - - name: common - version: ^0.1.0 - repository: file://../common - alias: layer0-web-common - diff --git a/rds/base/charts/layer0_web/charts/common-0.1.2.tgz b/rds/base/charts/layer0_web/charts/common-0.1.2.tgz deleted file mode 100644 index ba152bcbea12d27b91356615ef5b9f4df9972011..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 995 zcmV<9104JxiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%*a=`DhecALMbT~%7Xf-&(9&4q zMj{DvNM%3*YBcvVX|g=rokc&l>ZrPPCW5Xq3hD~GpQlL!1xq&Yfn1SOm_rvz8p;Kiw)iqwOX_we}0 zdj8`hTQ2($;Y_M0uKR20iN#ntvWp)@hA_SYz6r)FQC-<+CrR&6uY?-|IfE{C+s{>} z7OH4#K_YI2D>%Oc=?Ph>;zr075(NqX08Q>1t+i~Id^`7=Vx`=~>}r=~zZIjJ&)&Gj ztomIs3qdLY@{RT^tx+1y9JAcf4`^fjI7j;k(czIx973mWpP7E}w27a8oqWj{9iU3Kks zT^r>~q1)~>UL&8j?pvMz>-!&1FwJDFw8htt@!bF4=zP@v|GOLnhx^}K&@ucZh|nqr zq+wM7@Q|Q_X)e>KIJS)l??sG`vt#%=>@g zl7+kL2}II5#$!o-`CO&X`1CjHm(Plk#D4LphHkF>t)r<3?{fn)nWAGo?j8*5@u|3H zJx*Eit*wk%?+axQtNvD|M?sGd_2rj?h2+vmWR`2l^+| Rp8)^>|NopcJf diff --git a/rds/base/charts/layer0_web/templates/NOTES.txt b/rds/base/charts/layer0_web/templates/NOTES.txt deleted file mode 100644 index afe8df8..0000000 --- a/rds/base/charts/layer0_web/templates/NOTES.txt +++ /dev/null @@ -1,21 +0,0 @@ -1. Get the application URL by running these commands: -{{- if .Values.ingress.enabled }} -{{- range $host := .Values.ingress.hosts }} - {{- range .paths }} - http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }} - {{- end }} -{{- end }} -{{- else if contains "NodePort" .Values.service.type }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "layer0_web.fullname" . }}) - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo http://$NODE_IP:$NODE_PORT -{{- else if contains "LoadBalancer" .Values.service.type }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "layer0_web.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "layer0_web.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') - echo http://$SERVICE_IP:{{ .Values.service.port }} -{{- else if contains "ClusterIP" .Values.service.type }} - export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "layer0_web.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - echo "Visit http://127.0.0.1:8080 to use your application" - kubectl port-forward $POD_NAME 8080:80 -{{- end }} diff --git a/rds/base/charts/layer0_web/templates/_helpers.tpl b/rds/base/charts/layer0_web/templates/_helpers.tpl deleted file mode 100644 index d24cdf2..0000000 --- a/rds/base/charts/layer0_web/templates/_helpers.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "layer0_web.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "layer0_web.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "layer0_web.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "layer0_web.labels" -}} -app.kubernetes.io/name: {{ include "layer0_web.name" . }} -helm.sh/chart: {{ include "layer0_web.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.labels }} -{{ toYaml .Values.labels }} -{{- end -}} -{{- end -}} - - -{{- define "layer0_web.domain" -}} -{{- if .Values.global }} -{{- .Values.global.domain -}} -{{- else if hasKey .Values "domain" }} -{{- .Values.domain -}} -{{- else }}"localhost"{{- end -}} -{{- end -}} - -{{- define "layer0_web.image" -}} -{{ include "common.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} \ No newline at end of file diff --git a/rds/base/charts/layer0_web/templates/configmap.yaml b/rds/base/charts/layer0_web/templates/configmap.yaml deleted file mode 100644 index 44a05c6..0000000 --- a/rds/base/charts/layer0_web/templates/configmap.yaml +++ /dev/null @@ -1,49 +0,0 @@ -{{- $domains := .Values.domains -}} -{{- if .Values.global }} - {{- if .Values.global.domains }} - {{- $domains = .Values.global.domains -}} - {{- end -}} -{{- end -}} - -{{- if not $domains -}} - {{- if .Values.environment.ADRESS -}} - {{- $name := dict "name" (.Values.environment.ADRESS | trimPrefix "https://" | trimPrefix "http://") -}} - {{- $domains = (list (merge .Values.environment $name)) -}} - {{- else -}} - {{- $domains = list (merge .Values.environment) -}} - {{- end -}} -{{- end -}} - -apiVersion: v1 -kind: ConfigMap -metadata: - name: webconfig - namespace: {{ .Release.Namespace }} -data: - EMBED_MODE: "{{ .Values.environment.EMBED_MODE }}" - FLASK_ORIGINS: {{ (append (append .Values.environment.FLASK_ORIGINS (printf "https://%s" .Values.global.rds.domain)) (printf "http://%s" .Values.global.rds.domain)) | toJson | squote }} - SECRET_KEY: "{{ .Values.environment.SECRET_KEY }}" - DESCRIBO_API_ENDPOINT: "{{ .Values.environment.DESCRIBO_API_ENDPOINT }}" - DESCRIBO_API_SECRET: {{ .Values.global.describo.api_secret | quote }} - VUE_APP_DESCRIBO_URL: https://{{ .Values.global.describo.domain }}/application - VUE_APP_FRONTENDHOST: https://{{ .Values.global.rds.domain }} - VUE_APP_SOCKETIO_HOST: https://{{ .Values.global.rds.domain }} - SOCKETIO_HOST: https://{{ .Values.global.rds.domain }} - SOCKETIO_PATH: "{{ .Values.environment.SOCKETIO_PATH }}" - VUE_APP_BASE_URL: "{{ .Values.environment.VUE_APP_BASE_URL }}" - {{- with (mustMergeOverwrite (.Values.global | default dict) .Values.environment) }} - REDIS_HELPER_HOST: {{ .REDIS_HELPER_HOST | default "redis-helper" | quote }} - REDIS_HELPER_PORT: {{ .REDIS_HELPER_PORT | default "6379" | quote }} - REDIS_HOST: {{ .REDIS_HOST | default "redis" | quote }} - REDIS_PORT: {{ .REDIS_PORT | default "6379" | quote }} - {{- end }} - PROMETHEUS_MULTIPROC_DIR: "/tmp" ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: domainsconfig - namespace: {{ .Release.Namespace }} -data: - domains.json: |- -{{- $domains | toJson | nindent 4 }} diff --git a/rds/base/charts/layer0_web/templates/deployment.yaml b/rds/base/charts/layer0_web/templates/deployment.yaml deleted file mode 100644 index 0ef5e2d..0000000 --- a/rds/base/charts/layer0_web/templates/deployment.yaml +++ /dev/null @@ -1,97 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "layer0_web.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer0_web.labels" . | indent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: -{{ include "layer0_web.labels" . | indent 6 }} - template: - metadata: - labels: -{{ include "layer0_web.labels" . | indent 8 }} - spec: - volumes: - - name: domainsconfig - configMap: - name: domainsconfig - items: - - key: domains.json - path: domains.json - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ template "layer0_web.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - volumeMounts: - - name: domainsconfig - mountPath: /srv/domains.json - subPath: domains.json - readOnly: true -{{- if.Values.global.domains }} - env: - {{- range $domain := .Values.global.domains }} - {{- $name := $domain.name -}} - {{- $upper_name := regexReplaceAll "\\W+" $name "_" | upper -}} - {{- $lower_name := regexReplaceAll "\\W+" $name "-" | lower -}} - {{- $client_id := printf "%s_%s" $upper_name "OAUTH_CLIENT_ID" }} - {{- $client_secret := printf "%s_%s" $upper_name "OAUTH_CLIENT_SECRET" }} - - name: {{ $client_id }} - valueFrom: - secretKeyRef: - name: layer1-port-owncloud-{{ $lower_name }} - key: oauth-client-id - - name: {{ $client_secret }} - valueFrom: - secretKeyRef: - name: layer1-port-owncloud-{{ $lower_name }} - key: oauth-client-secret - {{- end }} -{{- end }} - envFrom: - - configMapRef: - name: mservice - - configMapRef: - name: proxy - - configMapRef: - name: globalenvvar - - configMapRef: - name: webconfig - ports: - - name: http - containerPort: {{ .Values.service.targetPort }} - protocol: TCP - - name: metrics - containerPort: 9999 - protocol: TCP - livenessProbe: - httpGet: - path: /metrics - port: metrics - periodSeconds: 10 - readinessProbe: - httpGet: - path: /metrics - port: metrics - periodSeconds: 10 - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/rds/base/charts/layer0_web/templates/ingress.yaml b/rds/base/charts/layer0_web/templates/ingress.yaml deleted file mode 100644 index 913be76..0000000 --- a/rds/base/charts/layer0_web/templates/ingress.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- $fullName := include "layer0_web.fullname" . -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }} - labels: -{{ include "layer0_web.labels" . | indent 4 }} - annotations: -{{- include "common.ingressAnnotations" . | nindent 4 }} -spec: - {{- if (include "common.tlsSecretName" .) }} - tls: - - hosts: - - {{ .Values.global.rds.domain }} - secretName: {{ include "common.tlsSecretName" . }} - {{- end }} - rules: - - host: {{ .Values.global.rds.domain }} - http: - paths: - - path: {{ .Values.ingress.path }} - pathType: Prefix - backend: - service: - name: {{ $fullName }} - port: - # number: 80 - name: http \ No newline at end of file diff --git a/rds/base/charts/layer0_web/templates/service.yaml b/rds/base/charts/layer0_web/templates/service.yaml deleted file mode 100644 index eea2890..0000000 --- a/rds/base/charts/layer0_web/templates/service.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - {{- with .Values.service.annotations }} - annotations: -{{ toYaml . | indent 4 }} - {{- end }} - name: {{ include "layer0_web.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer0_web.labels" . | indent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - - port: 9999 - targetPort: metrics - protocol: TCP - name: metrics - selector: - app.kubernetes.io/name: {{ include "layer0_web.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/rds/base/charts/layer0_web/templates/tests/test-connection.yaml b/rds/base/charts/layer0_web/templates/tests/test-connection.yaml deleted file mode 100644 index cc5462a..0000000 --- a/rds/base/charts/layer0_web/templates/tests/test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "layer0_web.fullname" . }}-test-research" - labels: -{{ include "layer0_web.labels" . | indent 4 }} - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['{{ include "layer0_web.fullname" . }}:{{ .Values.service.port }}'] - restartPolicy: Never diff --git a/rds/base/charts/layer0_web/values.yaml b/rds/base/charts/layer0_web/values.yaml deleted file mode 100644 index 226979a..0000000 --- a/rds/base/charts/layer0_web/values.yaml +++ /dev/null @@ -1,92 +0,0 @@ -# Default values for layer3_token_storage. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 -image: - registry: zivgitlab.wwu.io - repository: sciebo-rds/sciebo-rds/rds_web - tag: release - pullPolicy: Always - -labels: - app.kubernetes.io/component: research-data-services.org - app.kubernetes.io/part-of: rds-ingress - research-data-services.org/layer: layer0 - -fullnameOverride: layer0-web - -service: - type: ClusterIP - port: 80 - targetPort: 80 - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9999" - -ingress: - path: / - annotations: - nginx.org/server-snippets: | - location /socket.io/ { - proxy_http_version 1.1; - proxy_redirect off; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass http://layer0-web/socket.io/; - } -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -environment: - EMBED_MODE: true - FLASK_ORIGINS: - - "http://localhost:8080" - - "http://localhost:8085" - - "http://localhost:8000" - - "http://localhost:9100" - SECRET_KEY: 1234 - DESCRIBO_API_ENDPOINT: http://layer0-describo/api/session/application - #SOCKETIO_HOST: https:// - SOCKETIO_PATH: /socket.io/ - VUE_APP_BASE_URL: / - -global: - rds: - domain: hey - describo: - domain: hej - api_secret: asd - -# domains: -# - name: owncloud.local # have to be equal to the second part of cloudID in owncloud -# ADDRESS: https://owncloud.local/owncloud -# OAUTH_CLIENT_ID: ABC -# OAUTH_CLIENT_SECRET: XYZ -# # filter settings for services for this domain. This is very usable, if you want to connect a single RDS instance to multiple installations. -# # So you can show some specific services only for some ownclouds and show other services to others. Domainname in only and except have to be the same as in domains -# filters: -# # example! -# only: # only this services will be shown to users of this domain -# - "layer1-port-zenodo" -# except: # all other services will be shown to users of this domain -# - "layer1-port-openscienceframework" -# # if only and except are used at the same time, the system will filter for only first and then for except. So except should be a subset of only, otherwise it is doing nothing. diff --git a/rds/base/charts/layer1_port_openscienceframework/.helmignore b/rds/base/charts/layer1_port_openscienceframework/.helmignore deleted file mode 100644 index 50af031..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/rds/base/charts/layer1_port_openscienceframework/Chart.lock b/rds/base/charts/layer1_port_openscienceframework/Chart.lock deleted file mode 100644 index 9fd77bc..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://../common - version: 0.1.2 -digest: sha256:7aaa9dc5d2b77fe20b6c86434b0c1b5ec1755a923fca94ab95b35f07eec006e8 -generated: "2023-02-07T10:30:54.931573465+01:00" diff --git a/rds/base/charts/layer1_port_openscienceframework/Chart.yaml b/rds/base/charts/layer1_port_openscienceframework/Chart.yaml deleted file mode 100644 index 2df521a..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/Chart.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: v2 -appVersion: "1.0" -description: A Helm chart for Kubernetes -name: layer1-port-openscienceframework -version: 0.2.3 -home: https://www.research-data-services.org/ -type: application -keywords: - - research - - data - - services - - openscienceframework -maintainers: - - email: peter.heiss@uni-muenster.de - name: Heiss -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS -icon: https://www.research-data-services.org/img/sciebo.png -dependencies: - - name: common - version: ^0.1.0 - repository: file://../common - alias: layer1-port-openscienceframewor-common - - diff --git a/rds/base/charts/layer1_port_openscienceframework/charts/common-0.1.2.tgz b/rds/base/charts/layer1_port_openscienceframework/charts/common-0.1.2.tgz deleted file mode 100644 index ba152bcbea12d27b91356615ef5b9f4df9972011..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 995 zcmV<9104JxiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%*a=`DhecALMbT~%7Xf-&(9&4q zMj{DvNM%3*YBcvVX|g=rokc&l>ZrPPCW5Xq3hD~GpQlL!1xq&Yfn1SOm_rvz8p;Kiw)iqwOX_we}0 zdj8`hTQ2($;Y_M0uKR20iN#ntvWp)@hA_SYz6r)FQC-<+CrR&6uY?-|IfE{C+s{>} z7OH4#K_YI2D>%Oc=?Ph>;zr075(NqX08Q>1t+i~Id^`7=Vx`=~>}r=~zZIjJ&)&Gj ztomIs3qdLY@{RT^tx+1y9JAcf4`^fjI7j;k(czIx973mWpP7E}w27a8oqWj{9iU3Kks zT^r>~q1)~>UL&8j?pvMz>-!&1FwJDFw8htt@!bF4=zP@v|GOLnhx^}K&@ucZh|nqr zq+wM7@Q|Q_X)e>KIJS)l??sG`vt#%=>@g zl7+kL2}II5#$!o-`CO&X`1CjHm(Plk#D4LphHkF>t)r<3?{fn)nWAGo?j8*5@u|3H zJx*Eit*wk%?+axQtNvD|M?sGd_2rj?h2+vmWR`2l^+| Rp8)^>|NopcJf diff --git a/rds/base/charts/layer1_port_openscienceframework/templates/_helpers.tpl b/rds/base/charts/layer1_port_openscienceframework/templates/_helpers.tpl deleted file mode 100644 index 9ba1fb6..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/templates/_helpers.tpl +++ /dev/null @@ -1,69 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "layer1_port_openscienceframework.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{- define "layer1_port_openscienceframework.image" -}} -{{ include "common.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "layer1_port_openscienceframework.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "layer1_port_openscienceframework.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "layer1_port_openscienceframework.labels" -}} -app.kubernetes.io/name: {{ include "layer1_port_openscienceframework.name" . }} -helm.sh/chart: {{ include "layer1_port_openscienceframework.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.labels }} -{{ toYaml .Values.labels }} -{{- end -}} -{{- end -}} - - -{{- define "layer1_port_openscienceframework.domain" -}} -{{- if .Values.global }} -{{- .Values.global.domain -}} -{{- else if hasKey .Values "domain" }} -{{- .Values.domain -}} -{{- else }}"localhost"{{- end -}} -{{- end -}} - -{{- define "layer1_port_openscienceframework.secretName" -}} -{{- if .Values.global}} -{{ .Values.global.ingress.tls.secretName }} -{{- else }} -{{ .Values.ingress.tls.secretName }} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/rds/base/charts/layer1_port_openscienceframework/templates/configmap.yaml b/rds/base/charts/layer1_port_openscienceframework/templates/configmap.yaml deleted file mode 100644 index 639830b..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/templates/configmap.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: portosfconfig - namespace: {{ .Release.Namespace }} -data: - OPENSCIENCEFRAMEWORK_OAUTH_CLIENT_ID: {{ .Values.environment.OAUTH_CLIENT_ID | quote }} - OPENSCIENCEFRAMEWORK_ADDRESS: {{ .Values.environment.ADDRESS | quote }} - OPENSCIENCEFRAMEWORK_API_ADDRESS: {{ .Values.environment.API_ADDRESS | quote }} - OPENSCIENCEFRAMEWORK_OAUTH_CLIENT_SECRET: {{ .Values.environment.OAUTH_CLIENT_SECRET | quote }} - OPENSCIENCEFRAMEWORK_DISPLAYNAME: {{ .Values.environment.DISPLAYNAME | quote }} - OPENSCIENCEFRAMEWORK_INFO_URL: {{ .Values.environment.INFO_URL | quote }} - OPENSCIENCEFRAMEWORK_HELP_URL: {{ .Values.environment.HELP_URL | quote }} - OPENSCIENCEFRAMEWORK_ICON: {{ .Values.environment.ICON | quote }} - OPENSCIENCEFRAMEWORK_METADATA_PROFILE: {{ .Values.environment.METADATA_PROFILE | quote }} - OPENSCIENCEFRAMEWORK_PROJECT_LINK_TEMPLATE: {{ .Values.environment.PROJECT_LINK_TEMPLATE | quote }} - \ No newline at end of file diff --git a/rds/base/charts/layer1_port_openscienceframework/templates/deployment.yaml b/rds/base/charts/layer1_port_openscienceframework/templates/deployment.yaml deleted file mode 100644 index 8af8deb..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/templates/deployment.yaml +++ /dev/null @@ -1,73 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "layer1_port_openscienceframework.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer1_port_openscienceframework.labels" . | indent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: -{{ include "layer1_port_openscienceframework.labels" . | indent 6 }} - template: - metadata: - labels: -{{ include "layer1_port_openscienceframework.labels" . | indent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ template "layer1_port_openscienceframework.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - env: - - name: OAUTH_CLIENT_ID - valueFrom: - secretKeyRef: - name: osf-client - key: osf-client-id - - name: OAUTH_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: osf-client - key: osf-client-secret - envFrom: - - configMapRef: - name: mservice - - configMapRef: - name: proxy - - configMapRef: - name: globalenvvar - - configMapRef: - name: portosfconfig - ports: - - name: http - containerPort: 8080 - protocol: TCP - livenessProbe: - httpGet: - path: /metrics - port: http - periodSeconds: 10 - readinessProbe: - httpGet: - path: /metrics - port: http - periodSeconds: 10 - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/rds/base/charts/layer1_port_openscienceframework/templates/service.yaml b/rds/base/charts/layer1_port_openscienceframework/templates/service.yaml deleted file mode 100644 index 61b3ffc..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/templates/service.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - {{- with .Values.service.annotations }} - annotations: - {{ toYaml . | indent 4 }} - {{- end }} - name: {{ include "layer1_port_openscienceframework.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer1_port_openscienceframework.labels" . | indent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - app.kubernetes.io/name: {{ include "layer1_port_openscienceframework.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/rds/base/charts/layer1_port_openscienceframework/templates/tests/test-connection.yaml b/rds/base/charts/layer1_port_openscienceframework/templates/tests/test-connection.yaml deleted file mode 100644 index f82564f..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/templates/tests/test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "layer1_port_openscienceframework.fullname" . }}-test-research" - labels: -{{ include "layer1_port_openscienceframework.labels" . | indent 4 }} - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['{{ include "layer1_port_openscienceframework.fullname" . }}:{{ .Values.service.port }}'] - restartPolicy: Never diff --git a/rds/base/charts/layer1_port_openscienceframework/values.yaml b/rds/base/charts/layer1_port_openscienceframework/values.yaml deleted file mode 100644 index 93427b3..0000000 --- a/rds/base/charts/layer1_port_openscienceframework/values.yaml +++ /dev/null @@ -1,60 +0,0 @@ -# Default values for layer3_token_storage. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - registry: zivgitlab.wwu.io - repository: sciebo-rds/sciebo-rds/port_openscienceframework - tag: release - pullPolicy: Always - -labels: - app.kubernetes.io/component: research-data-services.org - app.kubernetes.io/part-of: connector - research-data-services.org/layer: layer1 - -fullnameOverride: layer1-port-openscienceframework - -service: - type: ClusterIP - port: 80 - targetPort: 8080 - annotations: - prometheus.io/scrape: "true" - -domain: localhost -ingress: - tls: - secretName: sciebords-tls-public - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -environment: - ADDRESS: https://accounts.test.osf.io - API_ADDRESS: https://api.test.osf.io/v2 - OAUTH_CLIENT_ID: "" - OAUTH_CLIENT_SECRET: "" - DISPLAYNAME: "" - INFO_URL: "" - HELP_URL: "" - ICON: "" - METADATA_PROFILE: "" - PROJECT_LINK_TEMPLATE: "" diff --git a/rds/base/charts/layer1_port_owncloud/.helmignore b/rds/base/charts/layer1_port_owncloud/.helmignore deleted file mode 100644 index 50af031..0000000 --- a/rds/base/charts/layer1_port_owncloud/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/rds/base/charts/layer1_port_owncloud/Chart.lock b/rds/base/charts/layer1_port_owncloud/Chart.lock deleted file mode 100644 index dd11068..0000000 --- a/rds/base/charts/layer1_port_owncloud/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://../common - version: 0.1.2 -digest: sha256:f9388dc66957a72d1d42857c8c87b9e4c2c81fb5fcdc5829b366219fa64c77bd -generated: "2023-02-07T10:30:55.413462484+01:00" diff --git a/rds/base/charts/layer1_port_owncloud/Chart.yaml b/rds/base/charts/layer1_port_owncloud/Chart.yaml deleted file mode 100644 index 64c53b3..0000000 --- a/rds/base/charts/layer1_port_owncloud/Chart.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v2 -appVersion: "1.0" -description: A Helm chart for Kubernetes -name: layer1-port-owncloud -version: 0.3.3 -home: https://www.research-data-services.org/ -type: application -keywords: - - research - - data - - services - - zenodo -maintainers: - - email: peter.heiss@uni-muenster.de - name: Heiss -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS -icon: https://www.research-data-services.org/img/sciebo.png -dependencies: - - name: common - version: ^0.1.0 - repository: file://../common - alias: layer1-port-owncloud-common - diff --git a/rds/base/charts/layer1_port_owncloud/charts/common-0.1.2.tgz b/rds/base/charts/layer1_port_owncloud/charts/common-0.1.2.tgz deleted file mode 100644 index c21df60f59862732e4e6e8904480517a8b14a678..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 994 zcmV<810DPyiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%#0g*^hecALMbT~%7Xf-&(9&4q zh9U`a`;97~*-{>}Bc@yTdzaRf?EoN#kCtMiEXfS<6x8>s&%t@@uZw@MKD z@Kb_TnR$+yIN4X(4xZ`%)AQ4))&IluXt?kHw;;AyggthHR5%TkAy{WDI*_?Y5z3Zk ziv>s>t0F-NmgT}LX#npakugC~4R4I00Qjv?1$u4;WtW$3gGBHJUp;o z`0&6Mi#{YcmHLtE{z`h}FqNL%{6~=^j4pw%gYjC_RJO)TGEb=2!nJ{%LKnO3=dx1^ zb+WM_k+#B>oZo@Wn4Hw&n1B?&D_CZUny^Ke7@>KxkaXr|0s@?1` z?8vgSkagYi7BMLC^(x3(jt78DR(D4K3b?*#&k(eEFRH7c}HoEvOb4FEZGH%WiCTyXxBO zx;Dy}Lbuszf~|box^H#|IPkwV@^{g3L8kUcG=w~|IIGTv~uCOqb3O(y_e{WfjPsAPT zamveY<7CQuf3QQi6;7JM!*|!;c*dDc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%#0g*^hecALMbT~%7Xf-&(9&4q zh9U`a`;97~*-{>}Bc@yTdzaRf?EoN#kCtMiEXfS<6x8>s&%t@@uZw@MKD z@Kb_TnR$+yIN4X(4xZ`%)AQ4))&IluXt?kHw;;AyggthHR5%TkAy{WDI*_?Y5z3Zk ziv>s>t0F-NmgT}LX#npakugC~4R4I00Qjv?1$u4;WtW$3gGBHJUp;o z`0&6Mi#{YcmHLtE{z`h}FqNL%{6~=^j4pw%gYjC_RJO)TGEb=2!nJ{%LKnO3=dx1^ zb+WM_k+#B>oZo@Wn4Hw&n1B?&D_CZUny^Ke7@>KxkaXr|0s@?1` z?8vgSkagYi7BMLC^(x3(jt78DR(D4K3b?*#&k(eEFRH7c}HoEvOb4FEZGH%WiCTyXxBO zx;Dy}Lbuszf~|box^H#|IPkwV@^{g3L8kUcG=w~|IIGTv~uCOqb3O(y_e{WfjPsAPT zamveY<7CQuf3QQi6;7JM!*|!;c*dDc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%#0g*^hecALMbT~%7Xf-&(9&4q zh9U`a`;97~*-{>}Bc@yTdzaRf?EoN#kCtMiEXfS<6x8>s&%t@@uZw@MKD z@Kb_TnR$+yIN4X(4xZ`%)AQ4))&IluXt?kHw;;AyggthHR5%TkAy{WDI*_?Y5z3Zk ziv>s>t0F-NmgT}LX#npakugC~4R4I00Qjv?1$u4;WtW$3gGBHJUp;o z`0&6Mi#{YcmHLtE{z`h}FqNL%{6~=^j4pw%gYjC_RJO)TGEb=2!nJ{%LKnO3=dx1^ zb+WM_k+#B>oZo@Wn4Hw&n1B?&D_CZUny^Ke7@>KxkaXr|0s@?1` z?8vgSkagYi7BMLC^(x3(jt78DR(D4K3b?*#&k(eEFRH7c}HoEvOb4FEZGH%WiCTyXxBO zx;Dy}Lbuszf~|box^H#|IPkwV@^{g3L8kUcG=w~|IIGTv~uCOqb3O(y_e{WfjPsAPT zamveY<7CQuf3QQi6;7JM!*|!;c*dDc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%#0g*^hecALMbT~%7Xf-&(9&4q zh9U`a*0V8&UwTV^s$qcD&7b97F7;$SuQX&4!$oY=rj^~rbUh;SQZrXrf@O(5$i)n zWc?@%Q%PAd;jziXaV&9S`Zw3(#wVk>#Sthual*~ntj;6i1AfB(ZlM07wCaDt+$urn z!%qoXW#&0*;$&ZCJ9wu5PtQ-IR{syrqw{_LzXh?yBJ8mnq{3;S48b~M(SgiGicq#R zTP#58SQQCEuq+o|NdtHXiHr$?YItJ|1;B5GD$sK)DC1-}Ww_LaAXR1}Q~*cs;o*Vx z!iNX8So9&msnm~L_gB&*hpF`B=0A!YVRQ+69gNqarm{6&l6gYC7OoBC6uQ`LKbM_a zsFRHaiL@227P_;g)4nwNWj+mz1shXyt`B4H}SbIl2V?6n?e4?#kN| z)*-t}uv4)sx2@9H&M_}M{eUjTk27@lP7=Pv@0OFlT1aGm5xIKoYilXH){>MTW9*R1 za%e20Uo*>941zAmTX1$u%LqFFZ)ovG%r3AS;>+jkzn~$%YC*NYc#**lTy|r#+f~)*441e1=Lv*+7sBiZiLx|ARv%NX`(- zD`0~!bixinV_I#z@Xk7%%3m>Ao_GIy&*7t1b1=HHEK`E=BC4cD&iM8C)0m7yb_iEh z$-?c`7!v6`*5)AkMtb5wip8m=7 RX8-^I|NpbqeZ~M5006Sb?6Cj< diff --git a/rds/base/charts/layer2_exporter_service/templates/_helpers.tpl b/rds/base/charts/layer2_exporter_service/templates/_helpers.tpl deleted file mode 100644 index c4e308f..0000000 --- a/rds/base/charts/layer2_exporter_service/templates/_helpers.tpl +++ /dev/null @@ -1,69 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "layer2_exporter_service.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - - -{{- define "layer2_exporter_service.image" -}} -{{ include "common.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "layer2_exporter_service.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "layer2_exporter_service.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "layer2_exporter_service.labels" -}} -app.kubernetes.io/name: {{ include "layer2_exporter_service.name" . }} -helm.sh/chart: {{ include "layer2_exporter_service.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.labels }} -{{ toYaml .Values.labels }} -{{- end -}} -{{- end -}} - -{{- define "layer2_exporter_service.domain" -}} -{{- if .Values.global }} -{{- .Values.global.domain }} -{{- else if hasKey .Values "domain" }} -{{- .Values.domain }} -{{- else }}localhost{{- end -}} -{{- end -}} - -{{- define "layer2_exporter_service.secretName" -}} -{{- if .Values.global }} -{{- .Values.global.ingress.tls.secretName }} -{{- else }} -{{- .Values.ingress.tls.secretName }} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/rds/base/charts/layer2_exporter_service/templates/configmap.yaml b/rds/base/charts/layer2_exporter_service/templates/configmap.yaml deleted file mode 100644 index afdec7a..0000000 --- a/rds/base/charts/layer2_exporter_service/templates/configmap.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: serviceexporterconfig - namespace: {{ .Release.Namespace }} -data: - \ No newline at end of file diff --git a/rds/base/charts/layer2_exporter_service/templates/deployment.yaml b/rds/base/charts/layer2_exporter_service/templates/deployment.yaml deleted file mode 100644 index 9c20f82..0000000 --- a/rds/base/charts/layer2_exporter_service/templates/deployment.yaml +++ /dev/null @@ -1,62 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "layer2_exporter_service.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer2_exporter_service.labels" . | indent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: -{{ include "layer2_exporter_service.labels" . | indent 6 }} - template: - metadata: - labels: -{{ include "layer2_exporter_service.labels" . | indent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ template "layer2_exporter_service.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - envFrom: - - configMapRef: - name: mservice - - configMapRef: - name: proxy - - configMapRef: - name: globalenvvar - - configMapRef: - name: serviceexporterconfig - ports: - - name: http - containerPort: 8080 - protocol: TCP - livenessProbe: - httpGet: - path: /metrics - port: http - periodSeconds: 10 - readinessProbe: - httpGet: - path: /metrics - port: http - periodSeconds: 10 - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/rds/base/charts/layer2_exporter_service/templates/service.yaml b/rds/base/charts/layer2_exporter_service/templates/service.yaml deleted file mode 100644 index 086f645..0000000 --- a/rds/base/charts/layer2_exporter_service/templates/service.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - {{- with .Values.service.annotations }} - annotations: - {{ toYaml . | indent 4 }} - {{- end }} - name: {{ include "layer2_exporter_service.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer2_exporter_service.labels" . | indent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - app.kubernetes.io/name: {{ include "layer2_exporter_service.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/rds/base/charts/layer2_exporter_service/templates/tests/test-connection.yaml b/rds/base/charts/layer2_exporter_service/templates/tests/test-connection.yaml deleted file mode 100644 index 23a384f..0000000 --- a/rds/base/charts/layer2_exporter_service/templates/tests/test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "layer2_exporter_service.fullname" . }}-test-research" - labels: -{{ include "layer2_exporter_service.labels" . | indent 4 }} - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['{{ include "layer2_exporter_service.fullname" . }}:{{ .Values.service.port }}'] - restartPolicy: Never diff --git a/rds/base/charts/layer2_exporter_service/values.yaml b/rds/base/charts/layer2_exporter_service/values.yaml deleted file mode 100644 index 529a0d1..0000000 --- a/rds/base/charts/layer2_exporter_service/values.yaml +++ /dev/null @@ -1,43 +0,0 @@ -# Default values for layer3_token_storage. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - registry: zivgitlab.wwu.io - repository: sciebo-rds/sciebo-rds/use_case_exporter - tag: release - pullPolicy: Always - -labels: - app.kubernetes.io/component: research-data-services.org - app.kubernetes.io/part-of: service - research-data-services.org/layer: layer2 - -fullnameOverride: layer2-exporter-service - -service: - type: ClusterIP - port: 80 - targetPort: 8080 - annotations: - prometheus.io/scrape: "true" - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} diff --git a/rds/base/charts/layer2_metadata_service/Chart.lock b/rds/base/charts/layer2_metadata_service/Chart.lock deleted file mode 100644 index ddcb7d3..0000000 --- a/rds/base/charts/layer2_metadata_service/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://../common - version: 0.1.2 -digest: sha256:318af01b93c9de85b7a5c9ebd15321e6eea000ce4d817337cfb8b083a1f6e92e -generated: "2023-02-07T10:30:57.413843137+01:00" diff --git a/rds/base/charts/layer2_metadata_service/Chart.yaml b/rds/base/charts/layer2_metadata_service/Chart.yaml deleted file mode 100644 index c8a61b3..0000000 --- a/rds/base/charts/layer2_metadata_service/Chart.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v2 -appVersion: "1.0" -description: A Helm chart for Kubernetes -name: layer2-metadata-service -version: 0.2.3 -home: https://www.research-data-services.org/ -type: application -keywords: - - research - - data - - services - - zenodo -maintainers: - - email: peter.heiss@uni-muenster.de - name: Heiss -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS -icon: https://www.research-data-services.org/img/sciebo.png -dependencies: - - name: common - version: ^0.1.0 - repository: file://../common - alias: layer2-metadata-service-common - diff --git a/rds/base/charts/layer2_metadata_service/charts/common-0.1.2.tgz b/rds/base/charts/layer2_metadata_service/charts/common-0.1.2.tgz deleted file mode 100644 index 742e1e954635dbfcd25888d529847c389333b148..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 995 zcmV<9104JxiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%#0g*^hecALMbT~%7Xf-&(9&4q zh9U`a*0V8&UwTV^s$qcD&7b97F7;$SuQX&4!$oY=rj^~rbUh;SQZrXrf@O(5$i)n zWc?@%Q%PAd;jziXaV&9S`Zw3(#wVk>#Sthual*~ntj;6i1AfB(ZlM07wCaDt+$urn z!%qoXW#&0*;$&ZCJ9wu5PtQ-IR{syrqw{_LzXh?yBJ8mnq{3;S48b~M(SgiGicq#R zTP#58SQQCEuq+o|NdtHXiHr$?YItJ|1;B5GD$sK)DC1-}Ww_LaAXR1}Q~*cs;o*Vx z!iNX8So9&msnm~L_gB&*hpF`B=0A!YVRQ+69gNqarm{6&l6gYC7OoBC6uQ`LKbM_a zsFRHaiL@227P_;g)4nwNWj+mz1shXyt`B4H}SbIl2V?6n?e4?#kN| z)*-t}uv4)sx2@9H&M_}M{eUjTk27@lP7=Pv@0OFlT1aGm5xIKoYilXH){>MTW9*R1 za%e20Uo*>941zAmTX1$u%LqFFZ)ovG%r3AS;>+jkzn~$%YC*NYc#**lTy|r#+f~)*441e1=Lv*+7sBiZiLx|ARv%NX`(- zD`0~!bixinV_I#z@Xk7%%3m>Ao_GIy&*7t1b1=HHEK`E=BC4cD&iM8C)0m7yb_iEh z$-?c`7!v6`*5)AkMtb5wip8m=7 RX8-^I|NpbqeZ~M5006Sb?6Cj< diff --git a/rds/base/charts/layer2_metadata_service/templates/_helpers.tpl b/rds/base/charts/layer2_metadata_service/templates/_helpers.tpl deleted file mode 100644 index 6c0d03f..0000000 --- a/rds/base/charts/layer2_metadata_service/templates/_helpers.tpl +++ /dev/null @@ -1,70 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "layer2_metadata_service.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - - -{{- define "layer2_metadata_service.image" -}} -{{ include "common.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "layer2_metadata_service.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "layer2_metadata_service.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "layer2_metadata_service.labels" -}} -app.kubernetes.io/name: {{ include "layer2_metadata_service.name" . }} -helm.sh/chart: {{ include "layer2_metadata_service.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.labels }} -{{ toYaml .Values.labels }} -{{- end -}} -{{- end -}} - - -{{- define "layer2_metadata_service.domain" -}} -{{- if .Values.global }} -{{- .Values.global.domain -}} -{{- else if hasKey .Values "domain" }} -{{- .Values.domain -}} -{{- else }}"localhost"{{- end -}} -{{- end -}} - -{{- define "layer2_metadata_service.secretName" -}} -{{- if .Values.global}} -{{ .Values.global.ingress.tls.secretName }} -{{- else }} -{{ .Values.ingress.tls.secretName }} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/rds/base/charts/layer2_metadata_service/templates/configmap.yaml b/rds/base/charts/layer2_metadata_service/templates/configmap.yaml deleted file mode 100644 index 43cce4b..0000000 --- a/rds/base/charts/layer2_metadata_service/templates/configmap.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: servicemetadataconfig - namespace: {{ .Release.Namespace }} -data: {} \ No newline at end of file diff --git a/rds/base/charts/layer2_metadata_service/templates/deployment.yaml b/rds/base/charts/layer2_metadata_service/templates/deployment.yaml deleted file mode 100644 index 7ce1e79..0000000 --- a/rds/base/charts/layer2_metadata_service/templates/deployment.yaml +++ /dev/null @@ -1,62 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "layer2_metadata_service.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer2_metadata_service.labels" . | indent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: -{{ include "layer2_metadata_service.labels" . | indent 6 }} - template: - metadata: - labels: -{{ include "layer2_metadata_service.labels" . | indent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ template "layer2_metadata_service.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - envFrom: - - configMapRef: - name: mservice - - configMapRef: - name: proxy - - configMapRef: - name: globalenvvar - - configMapRef: - name: servicemetadataconfig - ports: - - name: http - containerPort: 8080 - protocol: TCP - livenessProbe: - httpGet: - path: /metrics - port: http - periodSeconds: 10 - readinessProbe: - httpGet: - path: /metrics - port: http - periodSeconds: 10 - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/rds/base/charts/layer2_metadata_service/templates/service.yaml b/rds/base/charts/layer2_metadata_service/templates/service.yaml deleted file mode 100644 index d6d37c1..0000000 --- a/rds/base/charts/layer2_metadata_service/templates/service.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - {{- with .Values.service.annotations }} - annotations: - {{ toYaml . | indent 4 }} - {{- end }} - name: {{ include "layer2_metadata_service.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer2_metadata_service.labels" . | indent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - app.kubernetes.io/name: {{ include "layer2_metadata_service.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/rds/base/charts/layer2_metadata_service/templates/tests/test-connection.yaml b/rds/base/charts/layer2_metadata_service/templates/tests/test-connection.yaml deleted file mode 100644 index 479f2e2..0000000 --- a/rds/base/charts/layer2_metadata_service/templates/tests/test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "layer2_metadata_service.fullname" . }}-test-research" - labels: -{{ include "layer2_metadata_service.labels" . | indent 4 }} - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['{{ include "layer2_metadata_service.fullname" . }}:{{ .Values.service.port }}'] - restartPolicy: Never diff --git a/rds/base/charts/layer2_metadata_service/values.yaml b/rds/base/charts/layer2_metadata_service/values.yaml deleted file mode 100644 index 928e4f5..0000000 --- a/rds/base/charts/layer2_metadata_service/values.yaml +++ /dev/null @@ -1,43 +0,0 @@ -# Default values for layer3_token_storage. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - registry: zivgitlab.wwu.io - repository: sciebo-rds/sciebo-rds/use_case_metadata - tag: release - pullPolicy: Always - -labels: - app.kubernetes.io/component: research-data-services.org - app.kubernetes.io/part-of: service - research-data-services.org/layer: layer2 - -fullnameOverride: layer2-metadata-service - -service: - type: ClusterIP - port: 80 - targetPort: 8080 - annotations: - prometheus.io/scrape: "true" - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} diff --git a/rds/base/charts/layer2_port_service/.helmignore b/rds/base/charts/layer2_port_service/.helmignore deleted file mode 100644 index 50af031..0000000 --- a/rds/base/charts/layer2_port_service/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/rds/base/charts/layer2_port_service/Chart.lock b/rds/base/charts/layer2_port_service/Chart.lock deleted file mode 100644 index 1f085fb..0000000 --- a/rds/base/charts/layer2_port_service/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://../common - version: 0.1.2 -digest: sha256:dca3d3ef6fede10aab2defdabecdff2205a5bd66c7b36d1441f98635d4b84e37 -generated: "2023-02-07T10:30:57.939050904+01:00" diff --git a/rds/base/charts/layer2_port_service/Chart.yaml b/rds/base/charts/layer2_port_service/Chart.yaml deleted file mode 100644 index 4a2139d..0000000 --- a/rds/base/charts/layer2_port_service/Chart.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v2 -appVersion: "1.0" -description: A Helm chart for Kubernetes -name: layer2-port-service -version: 0.2.5 -home: https://www.research-data-services.org/ -type: application -keywords: - - research - - data - - services - - zenodo -maintainers: - - email: peter.heiss@uni-muenster.de - name: Heiss -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS -icon: https://www.research-data-services.org/img/sciebo.png -dependencies: - - name: common - version: ^0.1.0 - repository: file://../common - alias: layer2-port-service-common - diff --git a/rds/base/charts/layer2_port_service/charts/common-0.1.2.tgz b/rds/base/charts/layer2_port_service/charts/common-0.1.2.tgz deleted file mode 100644 index 742e1e954635dbfcd25888d529847c389333b148..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 995 zcmV<9104JxiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|Z%#0g*^hecALMbT~%7Xf-&(9&4q zh9U`a*0V8&UwTV^s$qcD&7b97F7;$SuQX&4!$oY=rj^~rbUh;SQZrXrf@O(5$i)n zWc?@%Q%PAd;jziXaV&9S`Zw3(#wVk>#Sthual*~ntj;6i1AfB(ZlM07wCaDt+$urn z!%qoXW#&0*;$&ZCJ9wu5PtQ-IR{syrqw{_LzXh?yBJ8mnq{3;S48b~M(SgiGicq#R zTP#58SQQCEuq+o|NdtHXiHr$?YItJ|1;B5GD$sK)DC1-}Ww_LaAXR1}Q~*cs;o*Vx z!iNX8So9&msnm~L_gB&*hpF`B=0A!YVRQ+69gNqarm{6&l6gYC7OoBC6uQ`LKbM_a zsFRHaiL@227P_;g)4nwNWj+mz1shXyt`B4H}SbIl2V?6n?e4?#kN| z)*-t}uv4)sx2@9H&M_}M{eUjTk27@lP7=Pv@0OFlT1aGm5xIKoYilXH){>MTW9*R1 za%e20Uo*>941zAmTX1$u%LqFFZ)ovG%r3AS;>+jkzn~$%YC*NYc#**lTy|r#+f~)*441e1=Lv*+7sBiZiLx|ARv%NX`(- zD`0~!bixinV_I#z@Xk7%%3m>Ao_GIy&*7t1b1=HHEK`E=BC4cD&iM8C)0m7yb_iEh z$-?c`7!v6`*5)AkMtb5wip8m=7 RX8-^I|NpbqeZ~M5006Sb?6Cj< diff --git a/rds/base/charts/layer2_port_service/templates/_helpers.tpl b/rds/base/charts/layer2_port_service/templates/_helpers.tpl deleted file mode 100644 index 64f2ee6..0000000 --- a/rds/base/charts/layer2_port_service/templates/_helpers.tpl +++ /dev/null @@ -1,71 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "layer2_port_service.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - - -{{- define "layer2_port_service.image" -}} -{{ include "common.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "layer2_port_service.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "layer2_port_service.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "layer2_port_service.labels" -}} -app.kubernetes.io/name: {{ include "layer2_port_service.name" . }} -helm.sh/chart: {{ include "layer2_port_service.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- if .Values.labels }} -{{ toYaml .Values.labels }} -{{- end -}} -{{- end -}} - - - -{{- define "layer2_port_service.domain" -}} -{{- if .Values.global }} -{{- .Values.global.domain -}} -{{- else if hasKey .Values "domain" }} -{{- .Values.domain -}} -{{- else }}"localhost"{{- end -}} -{{- end -}} - -{{- define "layer2_port_service.secretName" -}} -{{- if .Values.global}} -{{ .Values.global.ingress.tls.secretName }} -{{- else }} -{{ .Values.ingress.tls.secretName }} -{{- end -}} -{{- end -}} \ No newline at end of file diff --git a/rds/base/charts/layer2_port_service/templates/configmap.yaml b/rds/base/charts/layer2_port_service/templates/configmap.yaml deleted file mode 100644 index 9261ff7..0000000 --- a/rds/base/charts/layer2_port_service/templates/configmap.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: serviceportconfig - namespace: {{ .Release.Namespace }} -data: - IGNORE_PROJECTS: {{ .Values.environment.IGNORE_PROJECTS | quote }} \ No newline at end of file diff --git a/rds/base/charts/layer2_port_service/templates/deployment.yaml b/rds/base/charts/layer2_port_service/templates/deployment.yaml deleted file mode 100644 index 5220825..0000000 --- a/rds/base/charts/layer2_port_service/templates/deployment.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "layer2_port_service.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer2_port_service.labels" . | indent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: -{{ include "layer2_port_service.labels" . | indent 6 }} - template: - metadata: - labels: -{{ include "layer2_port_service.labels" . | indent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ template "layer2_port_service.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - envFrom: - - configMapRef: - name: mservice - - configMapRef: - name: proxy - - configMapRef: - name: globalenvvar - - configMapRef: - name: serviceportconfig - {{- if .Values.environment.TOKENSERVICE_STATE_SECRET }} - env: - - name: TOKENSERVICE_STATE_SECRET - value: {{ .Values.environment.TOKENSERVICE_STATE_SECRET }} - {{- end }} - ports: - - name: http - containerPort: 8080 - protocol: TCP - livenessProbe: - httpGet: - path: /metrics - port: http - periodSeconds: 10 - readinessProbe: - httpGet: - path: /metrics - port: http - periodSeconds: 10 - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/rds/base/charts/layer2_port_service/templates/service.yaml b/rds/base/charts/layer2_port_service/templates/service.yaml deleted file mode 100644 index b2d67a6..0000000 --- a/rds/base/charts/layer2_port_service/templates/service.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - {{- with .Values.service.annotations }} - annotations: - {{ toYaml . | indent 4 }} - {{- end }} - name: {{ include "layer2_port_service.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "layer2_port_service.labels" . | indent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - app.kubernetes.io/name: {{ include "layer2_port_service.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/rds/base/charts/layer2_port_service/templates/tests/test-connection.yaml b/rds/base/charts/layer2_port_service/templates/tests/test-connection.yaml deleted file mode 100644 index 7c12901..0000000 --- a/rds/base/charts/layer2_port_service/templates/tests/test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "layer2_port_service.fullname" . }}-test-research" - labels: -{{ include "layer2_port_service.labels" . | indent 4 }} - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['{{ include "layer2_port_service.fullname" . }}:{{ .Values.service.port }}'] - restartPolicy: Never diff --git a/rds/base/charts/layer2_port_service/values.yaml b/rds/base/charts/layer2_port_service/values.yaml deleted file mode 100644 index b61b2a5..0000000 --- a/rds/base/charts/layer2_port_service/values.yaml +++ /dev/null @@ -1,47 +0,0 @@ -# Default values for layer3_token_storage. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - registry: zivgitlab.wwu.io - repository: sciebo-rds/sciebo-rds/use_case_port_service - tag: release - pullPolicy: Always - -labels: - app.kubernetes.io/component: research-data-services.org - app.kubernetes.io/part-of: service - research-data-services.org/layer: layer2 - -fullnameOverride: layer2-port-service - -service: - type: ClusterIP - port: 80 - targetPort: 8080 - annotations: - prometheus.io/scrape: "true" - -environment: - IGNORE_PROJECTS: "True" - TOKENSERVICE_STATE_SECRET: "" - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -nodeSelector: {} - -tolerations: [] - -affinity: {} diff --git a/rds/base/charts/layer3_research_manager/Chart.lock b/rds/base/charts/layer3_research_manager/Chart.lock deleted file mode 100644 index 00336e4..0000000 --- a/rds/base/charts/layer3_research_manager/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://../common - version: 0.1.2 -digest: sha256:96a625dec9b5cc24195264a79968fd43a4a7199bfd0b4e22c994e9e48736a6c2 -generated: "2023-02-07T10:30:58.462751504+01:00" diff --git a/rds/base/charts/layer3_research_manager/Chart.yaml b/rds/base/charts/layer3_research_manager/Chart.yaml deleted file mode 100644 index 76d0512..0000000 --- a/rds/base/charts/layer3_research_manager/Chart.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v2 -appVersion: "1.0" -description: The project manager to manage projects within RDS -name: layer3-research-manager -version: 0.3.4 -home: https://www.research-data-services.org/ -type: application -keywords: - - research - - data - - services - - zenodo -maintainers: - - email: peter.heiss@uni-muenster.de - name: Heiss -sources: - - https://github.com/Sciebo-RDS/Sciebo-RDS -icon: https://www.research-data-services.org/img/sciebo.png -dependencies: - - name: common - version: ^0.1.0 - repository: file://../common - alias: layer3-research-manager-common - diff --git a/rds/base/charts/layer3_research_manager/charts/common-0.1.2.tgz b/rds/base/charts/layer3_research_manager/charts/common-0.1.2.tgz deleted file mode 100644 index 67a16064e4ac93ed2db3083d8858648277185d27..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 995 zcmV<9104JxiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|ay*a=`DhecALMbT~%7Xf-&(9&4q zMj{Dv)-=gVA_Ax)_Yl#>1mvFdSVBk0AI8xjdrWk+4U>7sqN(?q5Q}$Xm2dYBhny zkO^b9!vPTV5*bclT~N&F+=l2TtPcs1 zaTDKgS6?VxMRUQE!@FDxVf%=cqrvC{ulL|uT ze~QqgdYPdjPUcm%gJ=5x?EEZf_5b)hxH$CxTM%2V{2seO%B=!Q5RBCZEyzs72t`Y? z)e58v(>y}(*5$%WsR!>Mk|BXt4sWz35BRM}b9CGYN;qjw39hxli&H%lsRt+T;o*Vx z{D%j&TJ<5qxm1r__cziLi?MWMmp_UOVR8w48;n z*pX#tA** z6|$=YI~BWfYm`Pa$1HdB1KJorF3{dvN%#`K4JUuKkVyX`vh=a9#!_~zC8chPp+zdn zp|*@}%PdyW^SU5!!PzY>BJ2UYrp0S9yTGoAFQ2pjf``&Q@w=KjYMOfwlPZSnPEJoo=MJ{!0H|1N^j;r{m)bPPWUBDBf@ zX;@bP+$X4Dmdi9Mj%_2tI}xMf>==Gdqyv{5qb)gb38pC&4Fs8>Fp(<$KUho!$pu1j z1+4Lfir6tIjLVG|-WiK?`71{2^X`A|Ieb*<60|BUiDc zVQyr3R8em|NM&qo0PI&yZ{s!-&Y8brUL^r`jn|ay*a=`DhecALMbT~%7Xf-&(9&4q zMj{Dv)-=gVA_Ax)_Yl#>1mvFdSVBk0AI8xjdrWk+4U>7sqN(?q5Q}$Xm2dYBhny zkO^b9!vPTV5*bclT~N&F+=l2TtPcs1 zaTDKgS6?VxMRUQE!@FDxVf%=cqrvC{ulL|uT ze~QqgdYPdjPUcm%gJ=5x?EEZf_5b)hxH$CxTM%2V{2seO%B=!Q5RBCZEyzs72t`Y? z)e58v(>y}(*5$%WsR!>Mk|BXt4sWz35BRM}b9CGYN;qjw39hxli&H%lsRt+T;o*Vx z{D%j&TJ<5qxm1r__cziLi?MWMmp_UOVR8w48;n z*pX#tA** z6|$=YI~BWfYm`Pa$1HdB1KJorF3{dvN%#`K4JUuKkVyX`vh=a9#!_~zC8chPp+zdn zp|*@}%PdyW^SU5!!PzY>BJ2UYrp0S9yTGoAFQ2pjf``&Q@w=KjYMOfwlPZSnPEJoo=MJ{!0H|1N^j;r{m)bPPWUBDBf@ zX;@bP+$X4Dmdi9Mj%_2tI}xMf>==Gdqyv{5qb)gb38pC&4Fs8>Fp(<$KUho!$pu1j z1+4Lfir6tIjLVG|-WiK?`71{2^X`A|Ieb*<60|BUi **Tip**: List all releases using `helm list` - -## Uninstalling the Chart - -To uninstall/delete the `my-release` deployment: - -```console -$ helm delete my-release -``` - -The command removes all the Kubernetes components but PVC's associated with the chart and deletes the release. - -To delete the PVC's associated with `my-release`: - -```console -$ kubectl delete pvc -l release=my-release -``` - -> **Note**: Deleting the PVC's will delete postgresql data as well. Please be cautious before doing it. - -## Parameters - -### Global parameters - -| Name | Description | Value | -| --------------------------------------- | ------------------------------------------------------------------------------------ | ----- | -| `global.imageRegistry` | Global Docker image registry | `""` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | -| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | -| `global.postgresql.postgresqlDatabase` | PostgreSQL database (overrides `postgresqlDatabase`) | `""` | -| `global.postgresql.postgresqlUsername` | PostgreSQL username (overrides `postgresqlUsername`) | `""` | -| `global.postgresql.existingSecret` | Name of existing secret to use for PostgreSQL passwords (overrides `existingSecret`) | `""` | -| `global.postgresql.postgresqlPassword` | PostgreSQL admin password (overrides `postgresqlPassword`) | `""` | -| `global.postgresql.servicePort` | PostgreSQL port (overrides `service.port` | `""` | -| `global.postgresql.replicationPassword` | Replication user password (overrides `replication.password`) | `""` | - - -### Common parameters - -| Name | Description | Value | -| ------------------------ | -------------------------------------------------------------------------------------------- | -------------- | -| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override common.names.fullname template | `""` | -| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | -| `commonLabels` | Add labels to all the deployed resources | `{}` | -| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | - - -### PostgreSQL parameters - -| Name | Description | Value | -| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | -| `image.registry` | PostgreSQL image registry | `docker.io` | -| `image.repository` | PostgreSQL image repository | `bitnami/postgresql` | -| `image.tag` | PostgreSQL image tag (immutable tags are recommended) | `11.14.0-debian-10-r17` | -| `image.pullPolicy` | PostgreSQL image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify image pull secrets | `[]` | -| `image.debug` | Specify if debug values should be set | `false` | -| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | -| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` | -| `volumePermissions.image.tag` | Init container volume-permissions image tag (immutable tags are recommended) | `10-debian-10-r265` | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | -| `volumePermissions.image.pullSecrets` | Init container volume-permissions image pull secrets | `[]` | -| `volumePermissions.securityContext.runAsUser` | User ID for the init container | `0` | -| `schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | -| `lifecycleHooks` | for the PostgreSQL container to automate configuration before or after startup | `{}` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the pod | `1001` | -| `containerSecurityContext.enabled` | Enable container security context | `true` | -| `containerSecurityContext.runAsUser` | User ID for the container | `1001` | -| `serviceAccount.enabled` | Enable service account (Note: Service Account will only be automatically created if `serviceAccount.name` is not set) | `false` | -| `serviceAccount.name` | Name of an already existing service account. Setting this value disables the automatic service account creation | `""` | -| `serviceAccount.autoMount` | Auto-mount the service account token in the pod | `false` | -| `psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | -| `rbac.create` | Create Role and RoleBinding (required for PSP to work) | `false` | -| `replication.enabled` | Enable replication | `false` | -| `replication.user` | Replication user | `repl_user` | -| `replication.password` | Replication user password | `repl_password` | -| `replication.readReplicas` | Number of read replicas replicas | `1` | -| `replication.synchronousCommit` | Set synchronous commit mode. Allowed values: `on`, `remote_apply`, `remote_write`, `local` and `off` | `off` | -| `replication.numSynchronousReplicas` | Number of replicas that will have synchronous replication. Note: Cannot be greater than `replication.readReplicas`. | `0` | -| `replication.applicationName` | Cluster application name. Useful for advanced replication settings | `my_application` | -| `replication.singleService` | Create one service connecting to all read-replicas | `true` | -| `replication.uniqueServices` | Create a unique service for each independent read-replica | `false` | -| `postgresqlPostgresPassword` | PostgreSQL admin password (used when `postgresqlUsername` is not `postgres`, in which case`postgres` is the admin username) | `""` | -| `postgresqlUsername` | PostgreSQL user (has superuser privileges if username is `postgres`) | `postgres` | -| `postgresqlPassword` | PostgreSQL user password | `""` | -| `existingSecret` | Name of existing secret to use for PostgreSQL passwords | `""` | -| `usePasswordFile` | Mount PostgreSQL secret as a file instead of passing environment variable | `false` | -| `postgresqlDatabase` | PostgreSQL database | `""` | -| `postgresqlDataDir` | PostgreSQL data dir folder | `/bitnami/postgresql/data` | -| `extraEnv` | An array to add extra environment variables | `[]` | -| `extraEnvVarsCM` | Name of a Config Map containing extra environment variables | `""` | -| `postgresqlInitdbArgs` | PostgreSQL initdb extra arguments | `""` | -| `postgresqlInitdbWalDir` | Specify a custom location for the PostgreSQL transaction log | `""` | -| `postgresqlConfiguration` | PostgreSQL configuration | `{}` | -| `postgresqlExtendedConf` | Extended Runtime Config Parameters (appended to main or default configuration) | `{}` | -| `primaryAsStandBy.enabled` | Whether to enable current cluster's primary as standby server of another cluster or not | `false` | -| `primaryAsStandBy.primaryHost` | The Host of replication primary in the other cluster | `""` | -| `primaryAsStandBy.primaryPort` | The Port of replication primary in the other cluster | `""` | -| `pgHbaConfiguration` | PostgreSQL client authentication configuration | `""` | -| `configurationConfigMap` | ConfigMap with PostgreSQL configuration | `""` | -| `extendedConfConfigMap` | ConfigMap with PostgreSQL extended configuration | `""` | -| `initdbScripts` | Dictionary of initdb scripts | `{}` | -| `initdbScriptsConfigMap` | ConfigMap with scripts to be run at first boot | `""` | -| `initdbScriptsSecret` | Secret with scripts to be run at first boot (in case it contains sensitive information) | `""` | -| `initdbUser` | Specify the PostgreSQL username to execute the initdb scripts | `""` | -| `initdbPassword` | Specify the PostgreSQL password to execute the initdb scripts | `""` | -| `containerPorts.postgresql` | PostgreSQL container port | `5432` | -| `audit.logHostname` | Log client hostnames | `false` | -| `audit.logConnections` | Add client log-in operations to the log file | `false` | -| `audit.logDisconnections` | Add client log-outs operations to the log file | `false` | -| `audit.pgAuditLog` | Add operations to log using the pgAudit extension | `""` | -| `audit.pgAuditLogCatalog` | Log catalog using pgAudit | `off` | -| `audit.clientMinMessages` | Message log level to share with the user | `error` | -| `audit.logLinePrefix` | Template for log line prefix (default if not set) | `""` | -| `audit.logTimezone` | Timezone for the log timestamps | `""` | -| `postgresqlSharedPreloadLibraries` | Shared preload libraries (comma-separated list) | `pgaudit` | -| `postgresqlMaxConnections` | Maximum total connections | `""` | -| `postgresqlPostgresConnectionLimit` | Maximum connections for the postgres user | `""` | -| `postgresqlDbUserConnectionLimit` | Maximum connections for the non-admin user | `""` | -| `postgresqlTcpKeepalivesInterval` | TCP keepalives interval | `""` | -| `postgresqlTcpKeepalivesIdle` | TCP keepalives idle | `""` | -| `postgresqlTcpKeepalivesCount` | TCP keepalives count | `""` | -| `postgresqlStatementTimeout` | Statement timeout | `""` | -| `postgresqlPghbaRemoveFilters` | Comma-separated list of patterns to remove from the pg_hba.conf file | `""` | -| `terminationGracePeriodSeconds` | Seconds the pod needs to terminate gracefully | `""` | -| `ldap.enabled` | Enable LDAP support | `false` | -| `ldap.url` | LDAP URL beginning in the form `ldap[s]://host[:port]/basedn` | `""` | -| `ldap.server` | IP address or name of the LDAP server. | `""` | -| `ldap.port` | Port number on the LDAP server to connect to | `""` | -| `ldap.prefix` | String to prepend to the user name when forming the DN to bind | `""` | -| `ldap.suffix` | String to append to the user name when forming the DN to bind | `""` | -| `ldap.baseDN` | Root DN to begin the search for the user in | `""` | -| `ldap.bindDN` | DN of user to bind to LDAP | `""` | -| `ldap.bind_password` | Password for the user to bind to LDAP | `""` | -| `ldap.search_attr` | Attribute to match against the user name in the search | `""` | -| `ldap.search_filter` | The search filter to use when doing search+bind authentication | `""` | -| `ldap.scheme` | Set to `ldaps` to use LDAPS | `""` | -| `ldap.tls` | Set to `1` to use TLS encryption | `""` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.clusterIP` | Static clusterIP or None for headless services | `""` | -| `service.port` | PostgreSQL port | `5432` | -| `service.nodePort` | Specify the nodePort value for the LoadBalancer and NodePort service types | `""` | -| `service.annotations` | Annotations for PostgreSQL service | `{}` | -| `service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | -| `shmVolume.enabled` | Enable emptyDir volume for /dev/shm for primary and read replica(s) Pod(s) | `true` | -| `shmVolume.chmod.enabled` | Set to `true` to `chmod 777 /dev/shm` on a initContainer (ignored if `volumePermissions.enabled` is `false`) | `true` | -| `shmVolume.sizeLimit` | Set this to enable a size limit on the shm tmpfs. Note that the size of the tmpfs counts against container's memory limit | `""` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `""` | -| `persistence.mountPath` | The path the volume will be mounted at, useful when using different | `/bitnami/postgresql` | -| `persistence.subPath` | The subdirectory of the volume to mount to | `""` | -| `persistence.storageClass` | PVC Storage Class for PostgreSQL volume | `""` | -| `persistence.accessModes` | PVC Access Mode for PostgreSQL volume | `["ReadWriteOnce"]` | -| `persistence.size` | PVC Storage Request for PostgreSQL volume | `8Gi` | -| `persistence.annotations` | Annotations for the PVC | `{}` | -| `persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | -| `updateStrategy.type` | updateStrategy for PostgreSQL StatefulSet and its reads StatefulSets | `RollingUpdate` | -| `primary.podAffinityPreset` | PostgreSQL primary pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `primary.podAntiAffinityPreset` | PostgreSQL primary pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `primary.nodeAffinityPreset.type` | PostgreSQL primary node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `primary.nodeAffinityPreset.key` | PostgreSQL primary node label key to match Ignored if `primary.affinity` is set. | `""` | -| `primary.nodeAffinityPreset.values` | PostgreSQL primary node label values to match. Ignored if `primary.affinity` is set. | `[]` | -| `primary.affinity` | Affinity for PostgreSQL primary pods assignment | `{}` | -| `primary.nodeSelector` | Node labels for PostgreSQL primary pods assignment | `{}` | -| `primary.tolerations` | Tolerations for PostgreSQL primary pods assignment | `[]` | -| `primary.extraPodSpec` | Optionally specify extra PodSpec | `{}` | -| `primary.labels` | Map of labels to add to the statefulset (postgresql primary) | `{}` | -| `primary.annotations` | Annotations for PostgreSQL primary pods | `{}` | -| `primary.podLabels` | Map of labels to add to the pods (postgresql primary) | `{}` | -| `primary.podAnnotations` | Map of annotations to add to the pods (postgresql primary) | `{}` | -| `primary.priorityClassName` | Priority Class to use for each pod (postgresql primary) | `""` | -| `primary.extraInitContainers` | Extra init containers to add to the pods (postgresql primary) | `[]` | -| `primary.extraVolumeMounts` | Extra volume mounts to add to the pods (postgresql primary) | `[]` | -| `primary.extraVolumes` | Extra volumes to add to the pods (postgresql primary) | `[]` | -| `primary.sidecars` | Extra containers to the pod | `[]` | -| `primary.service.type` | Allows using a different service type for primary | `""` | -| `primary.service.nodePort` | Allows using a different nodePort for primary | `""` | -| `primary.service.clusterIP` | Allows using a different clusterIP for primary | `""` | -| `readReplicas.podAffinityPreset` | PostgreSQL read only pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `readReplicas.podAntiAffinityPreset` | PostgreSQL read only pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `readReplicas.nodeAffinityPreset.type` | PostgreSQL read only node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `readReplicas.nodeAffinityPreset.key` | PostgreSQL read only node label key to match Ignored if `primary.affinity` is set. | `""` | -| `readReplicas.nodeAffinityPreset.values` | PostgreSQL read only node label values to match. Ignored if `primary.affinity` is set. | `[]` | -| `readReplicas.affinity` | Affinity for PostgreSQL read only pods assignment | `{}` | -| `readReplicas.nodeSelector` | Node labels for PostgreSQL read only pods assignment | `{}` | -| `readReplicas.tolerations` | Tolerations for PostgreSQL read only pods assignment | `[]` | -| `readReplicas.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | -| `readReplicas.extraPodSpec` | Optionally specify extra PodSpec | `{}` | -| `readReplicas.labels` | Map of labels to add to the statefulsets (postgresql readReplicas) | `{}` | -| `readReplicas.annotations` | Annotations for PostgreSQL read only pods | `{}` | -| `readReplicas.podLabels` | Map of labels to add to the pods (postgresql readReplicas) | `{}` | -| `readReplicas.podAnnotations` | Map of annotations to add to the pods (postgresql readReplicas) | `{}` | -| `readReplicas.priorityClassName` | Priority Class to use for each pod (postgresql readReplicas) | `""` | -| `readReplicas.extraInitContainers` | Extra init containers to add to the pods (postgresql readReplicas) | `[]` | -| `readReplicas.extraVolumeMounts` | Extra volume mounts to add to the pods (postgresql readReplicas) | `[]` | -| `readReplicas.extraVolumes` | Extra volumes to add to the pods (postgresql readReplicas) | `[]` | -| `readReplicas.sidecars` | Extra containers to the pod | `[]` | -| `readReplicas.service.type` | Allows using a different service type for readReplicas | `""` | -| `readReplicas.service.nodePort` | Allows using a different nodePort for readReplicas | `""` | -| `readReplicas.service.clusterIP` | Allows using a different clusterIP for readReplicas | `""` | -| `readReplicas.persistence.enabled` | Whether to enable PostgreSQL read replicas replicas persistence | `true` | -| `readReplicas.resources` | CPU/Memory resource requests/limits override for readReplicass. Will fallback to `values.resources` if not defined. | `{}` | -| `resources.requests` | The requested resources for the container | `{}` | -| `networkPolicy.enabled` | Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now. | `false` | -| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | -| `networkPolicy.explicitNamespacesSelector` | A Kubernetes LabelSelector to explicitly select namespaces from which ingress traffic could be allowed | `{}` | -| `startupProbe.enabled` | Enable startupProbe | `false` | -| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` | -| `startupProbe.periodSeconds` | Period seconds for startupProbe | `15` | -| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `10` | -| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `livenessProbe.enabled` | Enable livenessProbe | `true` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | -| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `readinessProbe.enabled` | Enable readinessProbe | `true` | -| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `customStartupProbe` | Override default startup probe | `{}` | -| `customLivenessProbe` | Override default liveness probe | `{}` | -| `customReadinessProbe` | Override default readiness probe | `{}` | -| `tls.enabled` | Enable TLS traffic support | `false` | -| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | -| `tls.preferServerCiphers` | Whether to use the server's TLS cipher preferences rather than the client's | `true` | -| `tls.certificatesSecret` | Name of an existing secret that contains the certificates | `""` | -| `tls.certFilename` | Certificate filename | `""` | -| `tls.certKeyFilename` | Certificate key filename | `""` | -| `tls.certCAFilename` | CA Certificate filename | `""` | -| `tls.crlFilename` | File containing a Certificate Revocation List | `""` | -| `metrics.enabled` | Start a prometheus exporter | `false` | -| `metrics.resources` | Prometheus exporter container resources | `{}` | -| `metrics.service.type` | Kubernetes Service type | `ClusterIP` | -| `metrics.service.annotations` | Additional annotations for metrics exporter pod | `{}` | -| `metrics.service.loadBalancerIP` | loadBalancerIP if redis metrics service type is `LoadBalancer` | `""` | -| `metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` | -| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | -| `metrics.serviceMonitor.namespace` | Optional namespace in which to create ServiceMonitor | `""` | -| `metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `""` | -| `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout. If not set, the Prometheus default scrape timeout is used | `""` | -| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` | -| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` | -| `metrics.prometheusRule.enabled` | Set this to true to create prometheusRules for Prometheus operator | `false` | -| `metrics.prometheusRule.additionalLabels` | Additional labels that can be used so prometheusRules will be discovered by Prometheus | `{}` | -| `metrics.prometheusRule.namespace` | namespace where prometheusRules resource should be created | `""` | -| `metrics.prometheusRule.rules` | Create specified [Rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) | `[]` | -| `metrics.image.registry` | PostgreSQL Exporter image registry | `docker.io` | -| `metrics.image.repository` | PostgreSQL Exporter image repository | `bitnami/postgres-exporter` | -| `metrics.image.tag` | PostgreSQL Exporter image tag (immutable tags are recommended) | `0.10.0-debian-10-r133` | -| `metrics.image.pullPolicy` | PostgreSQL Exporter image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify image pull secrets | `[]` | -| `metrics.customMetrics` | Define additional custom metrics | `{}` | -| `metrics.extraEnvVars` | Extra environment variables to add to postgres-exporter | `[]` | -| `metrics.securityContext.enabled` | Enable security context for metrics | `false` | -| `metrics.securityContext.runAsUser` | User ID for the container for metrics | `1001` | -| `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | -| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | -| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | -| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | -| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | -| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | - - -Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```console -$ helm install my-release \ - --set postgresqlPassword=secretpassword,postgresqlDatabase=my-database \ - bitnami/postgresql -``` - -The above command sets the PostgreSQL `postgres` account password to `secretpassword`. Additionally it creates a database named `my-database`. - -> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. - -Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, - -```console -$ helm install my-release -f values.yaml bitnami/postgresql -``` - -> **Tip**: You can use the default [values.yaml](values.yaml) - -## Configuration and installation details - -### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) - -It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. - -Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. - -### Customizing primary and read replica services in a replicated configuration - -At the top level, there is a service object which defines the services for both primary and readReplicas. For deeper customization, there are service objects for both the primary and read types individually. This allows you to override the values in the top level service object so that the primary and read can be of different service types and with different clusterIPs / nodePorts. Also in the case you want the primary and read to be of type nodePort, you will need to set the nodePorts to different values to prevent a collision. The values that are deeper in the primary.service or readReplicas.service objects will take precedence over the top level service object. - -### Use a different PostgreSQL version - -To modify the application version used in this chart, specify a different version of the image using the `image.tag` parameter and/or a different repository using the `image.repository` parameter. Refer to the [chart documentation for more information on these parameters and how to use them with images from a private registry](https://docs.bitnami.com/kubernetes/infrastructure/postgresql/configuration/change-image-version/). - -### postgresql.conf / pg_hba.conf files as configMap - -This helm chart also supports to customize the whole configuration file. - -Add your custom file to "files/postgresql.conf" in your working directory. This file will be mounted as configMap to the containers and it will be used for configuring the PostgreSQL server. - -Alternatively, you can add additional PostgreSQL configuration parameters using the `postgresqlExtendedConf` parameter as a dict, using camelCase, e.g. {"sharedBuffers": "500MB"}. Alternatively, to replace the entire default configuration use `postgresqlConfiguration`. - -In addition to these options, you can also set an external ConfigMap with all the configuration files. This is done by setting the `configurationConfigMap` parameter. Note that this will override the two previous options. - -### Allow settings to be loaded from files other than the default `postgresql.conf` - -If you don't want to provide the whole PostgreSQL configuration file and only specify certain parameters, you can add your extended `.conf` files to "files/conf.d/" in your working directory. -Those files will be mounted as configMap to the containers adding/overwriting the default configuration using the `include_dir` directive that allows settings to be loaded from files other than the default `postgresql.conf`. - -Alternatively, you can also set an external ConfigMap with all the extra configuration files. This is done by setting the `extendedConfConfigMap` parameter. Note that this will override the previous option. - -### Initialize a fresh instance - -The [Bitnami PostgreSQL](https://github.com/bitnami/bitnami-docker-postgresql) image allows you to use your custom scripts to initialize a fresh instance. In order to execute the scripts, they must be located inside the chart folder `files/docker-entrypoint-initdb.d` so they can be consumed as a ConfigMap. - -Alternatively, you can specify custom scripts using the `initdbScripts` parameter as dict. - -In addition to these options, you can also set an external ConfigMap with all the initialization scripts. This is done by setting the `initdbScriptsConfigMap` parameter. Note that this will override the two previous options. If your initialization scripts contain sensitive information such as credentials or passwords, you can use the `initdbScriptsSecret` parameter. - -The allowed extensions are `.sh`, `.sql` and `.sql.gz`. - -### Securing traffic using TLS - -TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the chart: - -- `tls.enabled`: Enable TLS support. Defaults to `false` -- `tls.certificatesSecret`: Name of an existing secret that contains the certificates. No defaults. -- `tls.certFilename`: Certificate filename. No defaults. -- `tls.certKeyFilename`: Certificate key filename. No defaults. - -For example: - -* First, create the secret with the cetificates files: - - ```console - kubectl create secret generic certificates-tls-secret --from-file=./cert.crt --from-file=./cert.key --from-file=./ca.crt - ``` - -* Then, use the following parameters: - - ```console - volumePermissions.enabled=true - tls.enabled=true - tls.certificatesSecret="certificates-tls-secret" - tls.certFilename="cert.crt" - tls.certKeyFilename="cert.key" - ``` - - > Note TLS and VolumePermissions: PostgreSQL requires certain permissions on sensitive files (such as certificate keys) to start up. Due to an on-going [issue](https://github.com/kubernetes/kubernetes/issues/57923) regarding kubernetes permissions and the use of `containerSecurityContext.runAsUser`, you must enable `volumePermissions` to ensure everything works as expected. - -### Sidecars - -If you need additional containers to run within the same pod as PostgreSQL (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. - -```yaml -# For the PostgreSQL primary -primary: - sidecars: - - name: your-image-name - image: your-image - imagePullPolicy: Always - ports: - - name: portname - containerPort: 1234 -# For the PostgreSQL replicas -readReplicas: - sidecars: - - name: your-image-name - image: your-image - imagePullPolicy: Always - ports: - - name: portname - containerPort: 1234 -``` - -### Metrics - -The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). The metrics endpoint (port 9187) is not exposed and it is expected that the metrics are collected from inside the k8s cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). - -The exporter allows to create custom metrics from additional SQL queries. See the Chart's `values.yaml` for an example and consult the [exporters documentation](https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file) for more details. - -### Use of global variables - -In more complex scenarios, we may have the following tree of dependencies - -``` - +--------------+ - | | - +------------+ Chart 1 +-----------+ - | | | | - | --------+------+ | - | | | - | | | - | | | - | | | - v v v -+-------+------+ +--------+------+ +--------+------+ -| | | | | | -| PostgreSQL | | Sub-chart 1 | | Sub-chart 2 | -| | | | | | -+--------------+ +---------------+ +---------------+ -``` - -The three charts below depend on the parent chart Chart 1. However, subcharts 1 and 2 may need to connect to PostgreSQL as well. In order to do so, subcharts 1 and 2 need to know the PostgreSQL credentials, so one option for deploying could be deploy Chart 1 with the following parameters: - -``` -postgresql.postgresqlPassword=testtest -subchart1.postgresql.postgresqlPassword=testtest -subchart2.postgresql.postgresqlPassword=testtest -postgresql.postgresqlDatabase=db1 -subchart1.postgresql.postgresqlDatabase=db1 -subchart2.postgresql.postgresqlDatabase=db1 -``` - -If the number of dependent sub-charts increases, installing the chart with parameters can become increasingly difficult. An alternative would be to set the credentials using global variables as follows: - -``` -global.postgresql.postgresqlPassword=testtest -global.postgresql.postgresqlDatabase=db1 -``` - -This way, the credentials will be available in all of the subcharts. - -## Persistence - -The [Bitnami PostgreSQL](https://github.com/bitnami/bitnami-docker-postgresql) image stores the PostgreSQL data and configurations at the `/bitnami/postgresql` path of the container. - -Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. -See the [Parameters](#parameters) section to configure the PVC or to disable persistence. - -If you already have data in it, you will fail to sync to standby nodes for all commits, details can refer to [code](https://github.com/bitnami/bitnami-docker-postgresql/blob/8725fe1d7d30ebe8d9a16e9175d05f7ad9260c93/9.6/debian-9/rootfs/libpostgresql.sh#L518-L556). If you need to use those data, please covert them to sql and import after `helm install` finished. - -## NetworkPolicy - -To enable network policy for PostgreSQL, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), and set `networkPolicy.enabled` to `true`. - -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: - -```console -$ kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" -``` - -With NetworkPolicy enabled, traffic will be limited to just port 5432. - -For more precise policy, set `networkPolicy.allowExternal=false`. This will only allow pods with the generated client label to connect to PostgreSQL. -This label will be displayed in the output of a successful install. - -## Differences between Bitnami PostgreSQL image and [Docker Official](https://hub.docker.com/_/postgres) image - -- The Docker Official PostgreSQL image does not support replication. If you pass any replication environment variable, this would be ignored. The only environment variables supported by the Docker Official image are POSTGRES_USER, POSTGRES_DB, POSTGRES_PASSWORD, POSTGRES_INITDB_ARGS, POSTGRES_INITDB_WALDIR and PGDATA. All the remaining environment variables are specific to the Bitnami PostgreSQL image. -- The Bitnami PostgreSQL image is non-root by default. This requires that you run the pod with `securityContext` and updates the permissions of the volume with an `initContainer`. A key benefit of this configuration is that the pod follows security best practices and is prepared to run on Kubernetes distributions with hard security constraints like OpenShift. -- For OpenShift, one may either define the runAsUser and fsGroup accordingly, or try this more dynamic option: volumePermissions.securityContext.runAsUser="auto",securityContext.enabled=false,containerSecurityContext.enabled=false,shmVolume.chmod.enabled=false - -### Deploy chart using Docker Official PostgreSQL Image - -From chart version 4.0.0, it is possible to use this chart with the Docker Official PostgreSQL image. -Besides specifying the new Docker repository and tag, it is important to modify the PostgreSQL data directory and volume mount point. Basically, the PostgreSQL data dir cannot be the mount point directly, it has to be a subdirectory. - -``` -image.repository=postgres -image.tag=10.6 -postgresqlDataDir=/data/pgdata -persistence.mountPath=/data/ -``` - -### Setting Pod's affinity - -This chart allows you to set your custom affinity using the `XXX.affinity` paremeter(s). Find more infomation about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). - -As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. - -## Troubleshooting - -Find more information about how to deal with common errors related to Bitnami’s Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). - -## Upgrading - -It's necessary to specify the existing passwords while performing an upgrade to ensure the secrets are not updated with invalid randomly generated passwords. Remember to specify the existing values of the `postgresqlPassword` and `replication.password` parameters when upgrading the chart: - -```bash -$ helm upgrade my-release bitnami/postgresql \ - --set postgresqlPassword=[POSTGRESQL_PASSWORD] \ - --set replication.password=[REPLICATION_PASSWORD] -``` - -> Note: you need to substitute the placeholders _[POSTGRESQL_PASSWORD]_, and _[REPLICATION_PASSWORD]_ with the values obtained from instructions in the installation notes. - -### To 10.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -**What changes were introduced in this major version?** - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- Move dependency information from the *requirements.yaml* to the *Chart.yaml* -- After running `helm dependency update`, a *Chart.lock* file is generated containing the same structure used in the previous *requirements.lock* -- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Chart. - -**Considerations when upgrading to this version** - -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 - -**Useful links** - -- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ -- https://helm.sh/docs/topics/v2_v3_migration/ -- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ - -#### Breaking changes - -- The term `master` has been replaced with `primary` and `slave` with `readReplicas` throughout the chart. Role names have changed from `master` and `slave` to `primary` and `read`. - -To upgrade to `10.0.0`, it should be done reusing the PVCs used to hold the PostgreSQL data on your previous release. To do so, follow the instructions below (the following example assumes that the release name is `postgresql`): - -> NOTE: Please, create a backup of your database before running any of those actions. - -Obtain the credentials and the names of the PVCs used to hold the PostgreSQL data on your current release: - -```console -$ export POSTGRESQL_PASSWORD=$(kubectl get secret --namespace default postgresql -o jsonpath="{.data.postgresql-password}" | base64 --decode) -$ export POSTGRESQL_PVC=$(kubectl get pvc -l app.kubernetes.io/instance=postgresql,role=master -o jsonpath="{.items[0].metadata.name}") -``` - -Delete the PostgreSQL statefulset. Notice the option `--cascade=false`: - -```console -$ kubectl delete statefulsets.apps postgresql-postgresql --cascade=false -``` - -Now the upgrade works: - -```console -$ helm upgrade postgresql bitnami/postgresql --set postgresqlPassword=$POSTGRESQL_PASSWORD --set persistence.existingClaim=$POSTGRESQL_PVC -``` - -You will have to delete the existing PostgreSQL pod and the new statefulset is going to create a new one - -```console -$ kubectl delete pod postgresql-postgresql-0 -``` - -Finally, you should see the lines below in PostgreSQL container logs: - -```console -$ kubectl logs $(kubectl get pods -l app.kubernetes.io/instance=postgresql,app.kubernetes.io/name=postgresql,role=primary -o jsonpath="{.items[0].metadata.name}") -... -postgresql 08:05:12.59 INFO ==> Deploying PostgreSQL with persisted data... -... -``` - -### To 9.0.0 - -In this version the chart was adapted to follow the Helm label best practices, see [PR 3021](https://github.com/bitnami/charts/pull/3021). That means the backward compatibility is not guarantee when upgrading the chart to this major version. - -As a workaround, you can delete the existing statefulset (using the `--cascade=false` flag pods are not deleted) before upgrade the chart. For example, this can be a valid workflow: - -- Deploy an old version (8.X.X) - -```console -$ helm install postgresql bitnami/postgresql --version 8.10.14 -``` - -- Old version is up and running - -```console -$ helm ls -NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION -postgresql default 1 2020-08-04 13:39:54.783480286 +0000 UTC deployed postgresql-8.10.14 11.8.0 - -$ kubectl get pods -NAME READY STATUS RESTARTS AGE -postgresql-postgresql-0 1/1 Running 0 76s -``` - -- The upgrade to the latest one (9.X.X) is going to fail - -```console -$ helm upgrade postgresql bitnami/postgresql -Error: UPGRADE FAILED: cannot patch "postgresql-postgresql" with kind StatefulSet: StatefulSet.apps "postgresql-postgresql" is invalid: spec: Forbidden: updates to statefulset spec for fields other than 'replicas', 'template', and 'updateStrategy' are forbidden -``` - -- Delete the statefulset - -```console -$ kubectl delete statefulsets.apps --cascade=false postgresql-postgresql -statefulset.apps "postgresql-postgresql" deleted -``` - -- Now the upgrade works - -```console -$ helm upgrade postgresql bitnami/postgresql -$ helm ls -NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION -postgresql default 3 2020-08-04 13:42:08.020385884 +0000 UTC deployed postgresql-9.1.2 11.8.0 -``` - -- We can kill the existing pod and the new statefulset is going to create a new one: - -```console -$ kubectl delete pod postgresql-postgresql-0 -pod "postgresql-postgresql-0" deleted - -$ kubectl get pods -NAME READY STATUS RESTARTS AGE -postgresql-postgresql-0 1/1 Running 0 19s -``` - -Please, note that without the `--cascade=false` both objects (statefulset and pod) are going to be removed and both objects will be deployed again with the `helm upgrade` command - -### To 8.0.0 - -Prefixes the port names with their protocols to comply with Istio conventions. - -If you depend on the port names in your setup, make sure to update them to reflect this change. - -### To 7.1.0 - -Adds support for LDAP configuration. - -### To 7.0.0 - -Helm performs a lookup for the object based on its group (apps), version (v1), and kind (Deployment). Also known as its GroupVersionKind, or GVK. Changing the GVK is considered a compatibility breaker from Kubernetes' point of view, so you cannot "upgrade" those objects to the new GVK in-place. Earlier versions of Helm 3 did not perform the lookup correctly which has since been fixed to match the spec. - -In https://github.com/helm/charts/pull/17281 the `apiVersion` of the statefulset resources was updated to `apps/v1` in tune with the api's deprecated, resulting in compatibility breakage. - -This major version bump signifies this change. - -### To 6.5.7 - -In this version, the chart will use PostgreSQL with the Postgis extension included. The version used with Postgresql version 10, 11 and 12 is Postgis 2.5. It has been compiled with the following dependencies: - -- protobuf -- protobuf-c -- json-c -- geos -- proj - -### To 5.0.0 - -In this version, the **chart is using PostgreSQL 11 instead of PostgreSQL 10**. You can find the main difference and notable changes in the following links: [https://www.postgresql.org/about/news/1894/](https://www.postgresql.org/about/news/1894/) and [https://www.postgresql.org/about/featurematrix/](https://www.postgresql.org/about/featurematrix/). - -For major releases of PostgreSQL, the internal data storage format is subject to change, thus complicating upgrades, you can see some errors like the following one in the logs: - -```console -Welcome to the Bitnami postgresql container -Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-postgresql -Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-postgresql/issues -Send us your feedback at containers@bitnami.com - -INFO ==> ** Starting PostgreSQL setup ** -NFO ==> Validating settings in POSTGRESQL_* env vars.. -INFO ==> Initializing PostgreSQL database... -INFO ==> postgresql.conf file not detected. Generating it... -INFO ==> pg_hba.conf file not detected. Generating it... -INFO ==> Deploying PostgreSQL with persisted data... -INFO ==> Configuring replication parameters -INFO ==> Loading custom scripts... -INFO ==> Enabling remote connections -INFO ==> Stopping PostgreSQL... -INFO ==> ** PostgreSQL setup finished! ** - -INFO ==> ** Starting PostgreSQL ** - [1] FATAL: database files are incompatible with server - [1] DETAIL: The data directory was initialized by PostgreSQL version 10, which is not compatible with this version 11.3. -``` - -In this case, you should migrate the data from the old chart to the new one following an approach similar to that described in [this section](https://www.postgresql.org/docs/current/upgrading.html#UPGRADING-VIA-PGDUMPALL) from the official documentation. Basically, create a database dump in the old chart, move and restore it in the new one. - -### To 4.0.0 - -This chart will use by default the Bitnami PostgreSQL container starting from version `10.7.0-r68`. This version moves the initialization logic from node.js to bash. This new version of the chart requires setting the `POSTGRES_PASSWORD` in the slaves as well, in order to properly configure the `pg_hba.conf` file. Users from previous versions of the chart are advised to upgrade immediately. - -IMPORTANT: If you do not want to upgrade the chart version then make sure you use the `10.7.0-r68` version of the container. Otherwise, you will get this error - -``` -The POSTGRESQL_PASSWORD environment variable is empty or not set. Set the environment variable ALLOW_EMPTY_PASSWORD=yes to allow the container to be started with blank passwords. This is recommended only for development -``` - -### To 3.0.0 - -This releases make it possible to specify different nodeSelector, affinity and tolerations for master and slave pods. -It also fixes an issue with `postgresql.master.fullname` helper template not obeying fullnameOverride. - -#### Breaking changes - -- `affinty` has been renamed to `master.affinity` and `slave.affinity`. -- `tolerations` has been renamed to `master.tolerations` and `slave.tolerations`. -- `nodeSelector` has been renamed to `master.nodeSelector` and `slave.nodeSelector`. - -### To 2.0.0 - -In order to upgrade from the `0.X.X` branch to `1.X.X`, you should follow the below steps: - -- Obtain the service name (`SERVICE_NAME`) and password (`OLD_PASSWORD`) of the existing postgresql chart. You can find the instructions to obtain the password in the NOTES.txt, the service name can be obtained by running - -```console -$ kubectl get svc -``` - -- Install (not upgrade) the new version - -```console -$ helm repo update -$ helm install my-release bitnami/postgresql -``` - -- Connect to the new pod (you can obtain the name by running `kubectl get pods`): - -```console -$ kubectl exec -it NAME bash -``` - -- Once logged in, create a dump file from the previous database using `pg_dump`, for that we should connect to the previous postgresql chart: - -```console -$ pg_dump -h SERVICE_NAME -U postgres DATABASE_NAME > /tmp/backup.sql -``` - -After run above command you should be prompted for a password, this password is the previous chart password (`OLD_PASSWORD`). -This operation could take some time depending on the database size. - -- Once you have the backup file, you can restore it with a command like the one below: - -```console -$ psql -U postgres DATABASE_NAME < /tmp/backup.sql -``` - -In this case, you are accessing to the local postgresql, so the password should be the new one (you can find it in NOTES.txt). - -If you want to restore the database and the database schema does not exist, it is necessary to first follow the steps described below. - -```console -$ psql -U postgres -postgres=# drop database DATABASE_NAME; -postgres=# create database DATABASE_NAME; -postgres=# create user USER_NAME; -postgres=# alter role USER_NAME with password 'BITNAMI_USER_PASSWORD'; -postgres=# grant all privileges on database DATABASE_NAME to USER_NAME; -postgres=# alter database DATABASE_NAME owner to USER_NAME; -``` - -## License - -Copyright © 2022 Bitnami - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. diff --git a/rds/base/charts/postgresql/charts/common-1.10.3.tgz b/rds/base/charts/postgresql/charts/common-1.10.3.tgz deleted file mode 100644 index 135da6f91c454384fbbc276052e67de5cc88b389..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 13331 zcmV+uH0;YCiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYMdmA^BD4fsy74^29wdgThq$JC;+V#Hc$etNJNo*a-ah}~I zCjz@c5>XTA0BFh_Tj#f*2e)qYjTec!_^kSaO?3l>LZPZqC=?12n@$I%1-TjyQ-$4HsaH&0+kcfZN zzj0gD&V3~hqLfJ_38Uh$0}vsJ$BfSp;h2s%5|U?;%sB3#lzhZo5JnGSw%b8zn*TWn z2mP?$iLr<{Nu_@G8h#){j`$q@fs-j{_JR@PFy<^v2_1uBJV@A>L@>ni5@QNOA}N{@ zh*WtIb^tz1h%kQw5kQ%Q7^exFqhW$!I0qsHPDWv8!lw8TCQ_#2aA#*sO&E&BPQu1axNp5F;um2`$DIp2zhpcX zhn=47Sf>XQoTQj{dLZ#MO_0Q$9*i;?DGGIZuCJXbB2*$mG1t}c6p`c*BIaKHr-w-g zfFjk=?`&oBmu*t8j7L~QSxN}6%;n`}==ZiG=P5pf#0+3(RvPEM&V6(2i-!^ zGAwRs0$8H|`-6jns{VhuckrnH@8a3of{Gg4+Ja-PY&rfjBOJ#{%^n@^9K8X_SRw$? z7*ft6ECd#zD*vD2f~0^yp=p}nkBXH#TU#CfZ>OVrTKhcekO%Wv`FB&4*!dleMuZYc zun1+k5pA$U{tpgz2Nn5$@#4j!{dXtN=g&LOU`D2gAh3iHNwAvzUriNRq6t2PXFFF{ zosKHjImI&L6c7kDl0aFEUmISTLyQg6FbbW|pMlUQ$zlwFVXx5RDOF8`3PJ$eF^MDu z7kC~(@VEEx0|?AS6u@>ugoNO`*QbH{_rHT~7kXD$9gWWC&pp%P(iT*el;aWR9LH}m zPU!e7n&3D~2pu1fDa&8K{e+`T8?POJ9+*m)Mp*r=o+*;i;i-0nD<7E~2CAFV!&3c?vqa3mT3fcexCy!SPY z<$}?>!NBEXrldW9z(~ujjG!4j(v#wAU&yWwE3Gj`~d{S${lI7FYCP#HJ~un96)C@F&U9kBVu3Ktr5}0K$*PVy}Kt zwW-9PWB^ZA9w!e4*X<`c5^(rRRYh4MAqXHWKICO!iJq#%a;yp&s1r>R9NCBAk}UYpK|UFF*;6Rd)ydvY1+ircA;%o~Cl{5v^M-3MnU4 zjvzp38eU{W%qf;wgoN$nl@8%s5%`p^HRtK~s-Agrf#=WRiI!SL|N5X*F?wPYoK|+W zUZXmyHB8YIixfq;q&Jm5vs4RDae|S+;X7Bd4q394C2TzZUa8wMK_*P76$xH*9^0HW zmS(m4k;Y=$yE|!Ie}e5bOWo#V?yo*8t}Jjj7qq54sh^-=E3q)#T z(sVbbhG}U7mWDSMZqCr~M0%N>amVYw`uaaYDH@VwgC2k->;IQ8cdP!tgZ|6C$MyeR zJl9zN%LxXF_!vw0K36MXw+UKhwZv9R9ohY(Vv-}Hd>$PqY>1MQa8*D0F#LiGO7*;A zTAsbX-2@pP`FMU`)D9gK*FY;|U#M*>n`vRCrHL9Hl%|}eoFJ)wyNx@&|CX{iCW2>r zpKh4NV=Tkf#w=wCiRNJeuQYN3PiL4Pv1y7phTz`^;qIW<59%|2J0FDI9H5@PAuvtu z%mza&(I6<3wXJNhFlbhIa8rD6&od#kVxWD zmWY+rlwad6NoBi!A4DQ_%&`zF63CTqATY_SEOJP3KI6^b}Z`hFO;x#54kal=jO zbR$~$k!p86cb$Is`Up6-(KIVc6(6E#4SjR-`Q9{`$qD1+pE`hREfOxOzBy7JoxWL> zfDw<^px@0|52d7F`?W~dQgd~x36MO~LZ!%;2^^a!IlF`cB497v`%Bn)4VP#Rl0h`V z(M3z?OJw5W2$h`0S%hQAs3b{VU@zPY`*2C*q_Xx(3-^?qW{Ff70D^!}iTMacSW{%gG8zYfIcGfVJbU(m!4Lz- zQ#QjfTu!jz-v~*Ru<=s?Q$oo!qfMjn?AeOuN0z3HOX1;K;$@FA!RPJSFa6%X{?>i= z%m2Rm?b+4UlK{3$>HH+n7$2H#iy2BttY@OPs)2qV4qw%Lszo7TH`YVdaDqb(GWRv>Z{KSdbBg37 zlq_^u_4@$?0!JLn{Kq>q#Q_8(f|FQRF-3d*eo#ytH4F#0h2dZg3CQU0rF?*ws7r7P5KvMeKM z;oGm0N^isc!3fpcc6BQFI~Rz?4fShVKgZ%HgGb5#_(bDqX?pkyf?w&$>$9_;-=DrY zgSV%r?@tfmzgTAEG39JVVhnSZafmXmsZhvoMab1`$!+67d!w(crBr$u{7Rwvykim@ z<$!0H0vbuofn#Mdpd`_Ke-12(A>ug3R1%a3n4-C20E%&J%ndogbNBWFr^*t7R874? zs@}|4l1(v02_jRm5w!o7aXGHh-Q24ijLKTjExMbwP5f8+$4(h!*4J7-d~&Bo;xayyOVF%go_ zmCdAPz%Xw!bf5gfDHBApmg4SXQ9+_{rIdQ(E!2FEY4b*=-J3KJ97Zk_q~3*BEj3zq z9lhUVQ~~DuGDZ-5D|WsWhdL0ZRIExD-R*X-h=%0AEU37OKglxJ8x~z)4#%1y@;;ww zYZ!FY3v9RE-Ycfm=qZ|3dCliQ8<*^}lux5x9+OmS;T51XRpVBA8#Xdx`L9l? zY164vHTxyKBSgpuw*5FV4@_5&N0lsx6--MF>sEU9Xr_+quHaEZV{`nE)glr}rF85{ zTbaXdDqq0lHObgGt5+6be^ARskAwM-N1 z8ZaF%I|Tv=efqhm$nHZCvpet30}|HzHrF=(G}!-k>vnSsfMx#Q{eCt7!;AjQmyh=U zT|Dc=|NUM2EhL5^iY}ByV5+7h?Z6>I8DA-qWSC&H*@TkB4-kBPa_sh0gzx&T&ry~E zZ7aDp5tz?NgsmskezkwuZzqh);+y@e>YqIEypbNv+z}b-*%jCb5C!~+2tC2tlCJN5 zZPiX*d*_(S5cDghVqlwbpxJbYc~^l{6TGb!!m)%)k|Z$1AUUE!Nni|;K}<&a^r3_~ znkEoqrG*t1xw{ite<(1n&?HpiF|N5f-zdWQe$EdQoPTy(YfkoabAr)!2WV|@@^z87 z^?Ueg$=+;J3`!CH@2y=Jhi&|433yYqLbqP3J+#0y;ElYQ27Fd1zN>*Oeb*yfT?g53 zhk1UE27mymg5@s+m8cyH2+U9hwKm*2fJOvLk*t(x9)+inOl`0Lt12DK=I5lRGJ98O?}bG_IB+qI(v38A&kjp%t?fwm@H>(v*>aI8<> zTcPfK&%pQl)a^feH0$pCzk|V`YX9vY96X-?xRYlM|F37u35jTocx;aUiB=V1dC3(w zf>=M2m(OukWuOnig`O^&;A9$#iAiF$po;!(>(txR8;mrv^QwQ6uDSdaQ8dPJZ#Xa4 zII}ikqrSFB0VUI(Nk(nZcPLUEg~Fbg^iM$QZC^2q$|aW3wseH@rsQ3hRF8V}Yk%tc z-!R1n)&J7<|BHj#{@;uJ$NWEc@~ol%-+oG!hEjGXwF_h&KB-fOwyG&#$MkAP;dEWC zO`O+Nm3%+LoRb*C7iI0z2oCo2Pcl8rMkDeGf?nOGGe{nBtd_DSW28n?;p}2LkuU+Y z!+C+anZuTKz)mRjO|Ra!A}Dvn{B{e`FTin{pa?_omjHs_gX?z+<%An$Niv5&Gn9}K z!7-pT)twDHKVt)3mzSyyg}KNBYXzHP-z!tB8U!fIJRwtJoe*+D1Z-PUy?J-0%4$zY zilc7WIUc!KAOj>19rkEX3I~U#yABRk$Xjd|(_9s-EhHSDxQ{unRF9z43amtTe+lt~ z+8yDQ`PIWSCx?Mjo;q_}OK;aku*!ucXr|qDm~HX;b14%VFBPWI{Hx@}_I0x1#-e*3 zW4at6su}BwEXvuqEK|~y`Dim8IPR$yUU}ne0ZzWKc#STQn1!V_AT~L9%1x~*I!!4r zJmj0c-dL0xp>9s3?t9wLpSt~L;*IZa|7WnfThIU4f6V`VH_saOU%vfgIK-;W1$xtQ zQb|?14V5z+-`*5OP%fiXs#YXQ292x*5KQO!&qW(N6;M5RTY9mR$DY4W%~>b2N20JX z^A7g6fLs)je(&W>hB298>deYaU~W_J$Q=d8je?3!x)+v%KhAuK%WGP1V|f_)+`?B~2b- z-G4@txzg>I7$#_@x-r8XB~_XVrC|Nj@wdI7Rp!y!6jpOjS1r@>u2nwoHV~);`c-wp zu~S{W-kPh0o;~PS<@;iG)sYmnou|ULZt7Eij&(SP&2w6P@^3BbBU(_vb-&s0tm>T$ zJYPxe=nPXg&^jhV)dkjZjKQO7xf|7Tf#=Ofg5G&P2UW;v3|)1(fa}rBxl{o-d}VUH zmISv!Zpw-0YLZi~Q4VXWLsTvPh|<&r3VV@P3YS+vXpBECs`VsCx;=Pmskk{1%cU(p z#KkypEIGk5tawYGQ%X2S@f;$(G>li0%HqhB@v3{_9i;UAStEwe;(#OS>HmIfNfWz^jGQ-55 zNlxJ)grC(KJ0;Ntj0hLfoc+TRa~l+7OD3Vo??HeYN{$Cfu^;E2X- zniI}|F~bQx_>QpzBU%Ra^91WtTap2aV-WM{keU6N6+jm&*akzVG9G3juT`@?KPM20 ziz{r5apU|CA{$!&>9RA5&|CSCV!Np2%HT=Pa)+-V2%N%r;_#`wF1lY$Kbn7VMIB%} za$fmCA3{6Qd11?=C$`e}MlDx$Mn<`HBvyQ6;dxhOSp)E|bwq`%N zOrEU`>k_Kz?>(bJtER?2ENtDX3}sy=j9p|Y1T&?soNe-CL5@#5wmC2|%HjDlm6=5B zmoP>WdFjl{^UgC=g0wM3!vx2E zWKzMzuYAsJi!OfR(%znUB2hh~-8{-}%Ce)9AJ5k03mh7OhfxD#_>t~aRP;g1Yn?K$ z_o`PPn~x1gl+DraW<)$|Xj4bc+i_`>A%lU(4p!$^hW||Ryf51cyTlx}m0o|Hq!R># zZrA+zE}LRbA{caGJ4@4gsW0}#_V1-cuRd?<@**Onruo_`;4%JmYPN)4C&>>)>UD7N z>#sk1)PUeW1Nfq*2O&AUSQU6-<7q3;QlcnP5;-x+Mxz8b3SV=Q%v#44q26WF8hQ&r zHir$CjMLO-+4exVOFN+>NI9MnmI-ebw-V_rRBcX+RqRt!a+y_nZzkb}O$685-d#;j z8%$mE_-x>5@c&E3(HP&|`H#WiVE@toe^1Z)=fC|kif4vbK*#(xYE{cjkt$FeGR)I+ zM7Y@(=M`A>FnFb@VyR<4XdJcE#{(XgJ~o`(u6lFqp}<--KZ}34#aD|fEp(A;4O*|| zV%G7W+6`PP(yh3a+|25iF^3+04So&$bC&*WzpSn?FPbrH?aiZ#e|S$_{}-n@H#Gw+ z(f|E}el`B@#r})_qyE2(XD$6tW6T90>lD=I{_ z$^ZU~gU9o~ck-+u|K>0sp(YC~VN^TM$7+@B*1XoI->v}+b6Hp87)vYnix=B2>7jkA z>-5~q747qjU8_U!=TuGw-RVKVFItRo|EMJ z;UD^*wTkmUFJ?zGZ>hFx@4@NS(;Nn=2_5EmM)0Kx%%GBRyD7>>@bp{p)cO#CP;mE^ znXUNNG>Ana&W`E98w)_V) zUXcFtlrgzT&o@HzeWr-Uu$_A*0vB``fS1s-YjcWKvv+3JnPp6}vu^7wz`sp)?&vSjD?2nm5`%+ZY|gC+X^MSoDe|Mlg|{^S1N zojhyke;c8L;mC0X@ak0$=HRAMthFmXR*7LM_$>$6<{WZ~-|`?U7sOj$E36inQI0OR zRbC2dw_BIqtCaj`RjLoo0z7Y3;ro2e%=#(T^3ZoX1+YBfayi z^E&%P5`y>~Mj17Bl=W%ryH3b>BAv61@ydyxh01NIsJN5k3)Iy;sEws)mt1RMfuer{ zcO^u(fN5l_dd9~2yDO0hi$JanXj21kCAa9xdSmajTl1i=J{S(p3ZvjV3EM}+b!-9c zOWsDM`C3A-n|$3jrMo-cV#a$dn)_3MvmkO?!KMX#@Y3gZV#%0SrL1W<%U>RYFCU*J z>%S@D1jWM}x&oK1|6U&KzNoJM_Fg=$|L)|u&ie01#T9S9+xY6waodAg`?-#`uKe`r z$D6JCTpPEu=4&A7S}Q(R--1J#oLqa+SAo^M4~5Q+6I!>b_V6|X|dQreqES}2P3num)2jtd|h1s6sHM^G>f!#r(U8C^?@#l ztE1GqEG`vnUm9B;>8T;!@anjPLAf^?NuN=!b11dOa7`=Za$ux?!%7KV~Ms+xy)&7YO*;C-7t;SU`jpp=#&8hVm;gVNvTA$kc?>Vv7AwapbHr18&Th zvq58E6}+$E%yD2F;9bX&vm%%cyK!76))@C|x^UW{+|YsJz&>#IjjvAEk+G6dcZ<%O zTNJla7j7bF{*1JaV71iSuwzci?;0apnAui-P->D-pj}PKknqYmj6d_#hdT`h2!zRZQcoFS?=LDf&AXKdx8wwH}nPhP2G}1 zs7~JX974AKMjS$ASS=2r#crH3h!!`_Qm0a-Q|(TrhvpD^gCrUvQLP`_*LUSmI>YXS zN8OcVzAc6HI+K&P1+RE;a=vJBL+RIV+u3X#e~FL9lC|h9c)yGf!bjmjy2Y%j`yb#I zGZlOxyGg4#oaN3q#aWduS8%y~pIl`|dr&?(f#nJ=xk4>1bH>?{D=@t&-xFB&@|3b0 z^uSp}9(`}C8XKGQy=miXxRGV!3V2_~Ct$&T-M%;5i8aRky1us-C^z-JS+Eb>_qMW! zrpk zj>VtJOtx2PVMf$qRh=a zfL>d-GMTWbuX z3d^(JJ;qMei#1ZV-F;9m-oA8hkc|x;F{)!x_8D0Uc>}o?7y6@Ej9%G0(a=P7JQfgp z-O!DC+-?}r;+{Pur^fZH`WQzf#(Cy(d%+k6n=IDixoFO-Gg~Hb=rY`vvN2uY zd5?{H?%Seyt@Y9*om0x*`{b~Vb-o`$E!J)dt0?i-No8>l%65Il0&mHw+gQqL$74^! zDf)(_rL}BwCf}h^9`$?kYb~Ea*Yk8Nhv!XnhET0no~*&3)kcX>@C zH2bN#HHfyA>!P`UZ^4(bv}Q7vbNV(_s+Xj#tX-Rhnp?aDP2wA?*Ha~B zbN4Ie;>P}LPP_SpUQ^Rmp)LWnVSVSfmR?`wHLh*HVs>fm(-M|xVTrUN<~~0xDtA9_ z=*9kDj$?B3M1V`q{~ql1cdPNA{m1-&ck^_v;{ZNYZ1FFWqZn^K0Mzi@gYo`qblM%i z`t!|vzNUrSarf4Uxte3vR9np_+Zvl$0&;=pB20DJ3Lu?y5OMNP9Dl@Iv^eQXz`QEq z%+v`?9^7^>wp2DIpTlUoy?49?h$ZHG1L2%DXo1ncH+FnRo2F=koIZ6eV9!hf6Nw>{%C@u zi{b`YO>d3AhWJ!CiV9=TIR$QH61J_)0RQm{2K(KWN21Z}xB>q+!t)O{cm}GZzLewwG$aUI}r{xuc5hV)MgXZP?VjFR}S`v5&D@xAQDs|NAr9^}PT~*8lql zd;Mzs*Y3gN`OiCfuCx5Ni(yqpFY|}EzS1|AyDqQA`iRj{zpw9=t{Qy#buao=(6-Xg zgBh%W)a&=Hk=)YSV6&|a^43-{_}c6|bKy-RZJN4Jzx<{$43K(Lz3XMOi{rz@UT7ql zvqLo2bZkKp>e(mZ98Hr_p0i@9*WyhnjEYuoN^`s3#qB$*Cs?!he=Td@6tjJ^$izsZ z<|f+X9#*jGi;2qI6%^*avC?vBIrj)c$F;>m!NXxb(5g)&%f=Q; z`|>`u_9dvMs9P$Mr3>bKTiE;gC^UB~G?j%$4LbD7-E&3t1t?zsJU6oHVXD_3qi`Le zEXz*SV|m>xx(bPFJG*HNYS%H(Llp$R*C`B&rBBx-T=U-4ce`h`eQy7@N+k|Z z4eOki>pa75OQ2VI{cphQOZ{qUEx(`##W6hX^^{qp7F(~LsNz-&C@c_-L$wAgSfdzy z@0}xHjS>%IRb%b{aDtO58B@mb=G$0e|My?i^1tl9?7w)l|L@}2f)gZ_rqY-B8V*p? z4uxSxl2~c+6h#+kj78Ylf)5iSKxApkxD+5JI7xKO3rvxWCWMZk1IG!HWM-$$;yt2q zXA3AEn<(jRz+65plvY0mpCNicXkv_6Lq+CnPaOJEk0Ge{{l`h**qwz9OH5mH*SXuiyOm zHk`({(Z*u=f3g2!e^8bG{{G|r|9A3i!FT3fI42E1kRexA%aNMMI-S?>%Rg{3Ex-P4 z+ubaurj1Zc^bK=6lBFaPJBca!yPgWg&Xy|E)!y$hXIZLLis3p)*qB5x#PSj=g<}yh z^}uI9$I*Mp0|$FL+FQ}!cQ*h#$LvE zm|ux!8}Tp2v%ghiy2T+9lg<-R=tJJ{9I{l|sd*`l7fQ)T*Y0f4xgaz?1hs-E;~!Dl znPQ2Q^{h}f2sbR5^!4E3C`%F(3#s?BU9IWdm_`u%11AZCpBYc$z#y@;1;Q{=nfXfMqCJ-U2Od#$2*9RSDIAJMJd}+tSUO}k2p*H?q zH%Y)0Q8dOp>~y{>4QHtVt?_^PJ{w|`rlNp$Vc+QCFf0?}G-30pG7gooYQXD1*$6ae z9vS$ALX>1eVlF~6P3fUK1`+0xj7Wqe7S9#mkM&KOROdrb ztf~G~{hhOn14{ESF)Ifr9BW^KAQFpCr{|+P2nV}=>GVv0_rgKgH&xUc7b|)wj=(Tt zNy0A8^^wEG+~;ieM;s@h86t`PW*2@|k}Zqq;FpM{ST77?G8$oRv=4;ezo{fmh~=0>Y??BPsm$>y97N}3 zK54_mkfcVF+rvZ)(-BJ1kR&ULQ-h#fOTJcrnj~?#u-#mYHqn4T*pWx)Q0aI(ou5~` zYe!#cM~S#n^qwYm`^wv9u8b0*^rJg^L`M0Q$6gCSg!VrOEW4rNlknV3Y2Yq`Z^bj> zjQ+ufVPSooH{prWl(Uo*?aj@L>e4zfoCy?S5aLRPY=Q^;wdDOc$6gqR}ozm zPaneV;Yp}IpL2t8cM#Si=DK+DA&MH1Tm#S3?_M7P$AV=%!t0>BrX0o1Xs(Rs(dnCO z5OZBTQldT(kZT z;dlh+#a^9Z@pEVTm_0CJTay#cE&)-{2$$MB_I~iZ{o8K0piMa;$9Yr7Ygk>s`!15xePBv)>V@t2M zI^WQgeRm3EW6yftfek5`uV&gWo|4$u<=PNM7nsK94OE4{+h8C-PJAq5f~^IZD)BKp z8ESH7M%Z4T9Ow3IE-nJ|8HuoqykacK-<>cWVKqcNuv$<-`Ng&7^pOHbnIuugd2U=K zAz?eigpGH0`-6Yo>A&0={B;MVr03NZJwkhf-r!)z)2DMP(Wl(^9AN=XbaICM36hf! z^Aw+ZbUNXLO5qMpSj#@O1zp@zzQ>K@W+rYh-yit1h)#CwjuIqjtDX2z4o-fVEL>I zEE=~PO}z~xw`kyQH18}MIJ&l=A6V@;1>^G zd3RcsKjPR-H_pGUKF;CK3?+)(F`zWnXw>~Tt2L(4whU>?>Q1FeR(RT18nRYivDW8e zDZinq_7$3FYd(uL*9}dtuh4Q^^YIzq1hkfgIyda9Vr`>e7mtlI=xQl?8&)~h)9F^Q zl}0_wM*0+CFrDW={k4!@48JYa|80BA0TlKOe8aMM6WmuL-vyrMj@+DlHq7|~ui;R> z5&7~gp4y7OPZ}-ip+~;L1!%%-&Kt;=N9QvR97|5{4C|OpG6IxvjN&;&dS-}2e>qV) z(9yHm-pUk$z(y;@AIrf4j>xXBDC=SmiC3R7FIMzamuqme!eb0*9T(4vLptBf=Q3znt7ftDn=atnPDoE zxvLzN79HnL&eg1`RwI^cf0AUmkKuMVcsIuAEBJM9k>xf9+ULE76K-Z!|1Kj*44BRc zXLM=~u5qFxXSIQDwnULJ8P*J6Ff7}2)^(jpzTS<>S-ITBr#FPS33nEG@UpW>%-P+w zd0~m+;(BM_>PC9*WqFIG+KtL7O=F_ULKloUo8~@_b6~?ia3t-35GhRFXCxpIx zIKce1j`7vljqmYXb>asi{0LV8Bf^FBx}Y%D0rSWnevNHc8MkHadQcn7+6+&CGTL*c z{chBa>I*y{lsl(Q>89>kt@W`ub9;@D)cX%tdBAh~T|d_d)xCeq;lA5{K##9jmK=rm z_rO+2?r@t-SF+1iO3D(_o1}m^x3k%EyIrN$_4!fl@_PQ5LWG3&wats@rsv)<854{& zE_Pcd?9xq}-c%aGnOe+z^i#V0w!P)j9O!;_VafQF^NXA}jh`#ho|FfUC2%{pAP^Iz z3|JFer7xt^Ay;_|J6l_Dmg0z@1c;`fh$eW7 zgm)f6fhv+ua2q0Z*a4996dx*pgpNA^aWPznF0RTI_maz*=yoC?VLFn$1AsrFX`0|e zh;^-yuujLzqp_r^)4Zf+>DOI1-J0FoSS#5Dt1V9uh=* zgMN=6>~%V6mL%o?+A^S;*rPch1O6nhm}k7!ZqcW&lS?!gPl1dIJQU5I>QHm}^ts7h zEwI$Zk4NvAJmFYiDxVsBY`9T@5aJxoI{-vtlZ|jOrY@OYG6&(1rUnSGQGvb-_1`XT z{47Pqhn-H0hnYw2p-Bv0BaP{cI|HZHmDX+vxxng+;%@v&as-5q7@wN3Uz6EI_=99p zhAZBFP4zMv(Fj{$LwwlT%GuKAxUEv^mNLI=Df+jJ{uX${5B^AWw!n1VVq_DjY=O7y zSV)#l2fvg~E{D1)58j?-=o3NFvD2|Tt9sLP8E^i5!h}h@SRg3jBTKR=E^og+hvSjs zy`UF72fvwjI_FFf*hC&N5eiQM@mvu!GFf5-VM?);Fb;Y_r-Pyh3-Ke1@iKH@>yj{K zadGijE8eAsPBDsq=0xK6dH@9Z=hDW`$UpHKE&TQGq|-@}oGgQTVzYe?i-C+wkn%)9 zi`dz*jv4f=(r_5MZh=SG3IVo2Q$QoVrS~hmW^7}2I(}f_ph%&#k z)47Fyf#*M>G$mB4jS?*TK2PLiU|K8S0?*B+SW{%G`bcOS5(a;>g|m>@CZ|%4>K6FO zZUN+0r7Gku*!UjLb5bf=>JBT!GNq}0w&xjjW>pZF3Zj$RX<5`3rk|RK(0t46IS4kz zAjuR91>h1D zs4P{kpM(l*(6^bPP@1k@)ePbL6#bduJegH78lOLVyYklX{{q8gKDfPN~yz zniM?_!_cN1#dLO6=brWX|07;bF(OJq;=KwKJpgmj&eV<2Cby zv2C$}t+z8hu^D9j=K{|cws_%Xs9m)|w~d)!Z*+B~>DSrv(-&*9RwSw{{L7>XO0HZh zVDH|4czYJgPexBgj0%?En#;c=DUCE@JW?|! z6Zx)zy&ztn!&W*=pSQ-?s4|pbE=6hBY*sw2jMYjT3klP?&Hk)Y=2nL4RS-O{Q1ev~ zXr6ysDY{}#-f9C+oT&ev7!m0V=PP}Ka){WeJ}DAT8Y!k1<90(U_51cn17L6Z-kM|xB?Z&Ch?x> z>YlNuG!!M3)&SOlB6(A`2SB92$w)1+5Ra{uk(2E0`yawi=h?HLbrhXN{1S5v#AcPm zHWPf62><`HXPr(DPFzH@eJu<*Tn0wdUw!nbY@VFMwpAdS48u7LnVgtPySjUOj`kiP zHL@lJr|y0k=58IP$%+V!Ci89xzx)Gpyf}TSOIxZ~0Hwrs%7iC%^%^)rRPj^{Q>Lj@ ztbC1ANKyCPPkUqHz&btnNm0SrL^ikLc@3x8URXkFg#O&wvZZ?(xt`_nCD^D2Ka`ot zgs`V(E$l4sXPU5j?tiAUAQ$N}8MpC{NjgD8EJ>sVN}IbAHf3W>u^RbHG%vYbT~bXi zL8oG|BgLpO=Jp;goin6J7NUiO)5&-tQGBYe^knvurDvTUY|%XjNtN(TDf_y z;hBI=`c%S5sV_w5K!nJ!SiMPOuUjdyd@3SL5hpB9>Xx61MWS3gW>~1^ox*a`i0E96 zV}VA|3ln)=mNma?MrIV+ViDeDV%YhF;}PagP5r_~BcdIUx>(GjOs#VCs4bSA+3xSN zz2B!~Y=(GeEC1Qc1nxyhV9~WwVn5Nb89dhq$zZmpnB^ydM_B?1p%=pNf@@i|SjyZh zGs!qXiP+&-uw;gN3b|eV?_MuuLiP$o%sB6O@K)(bLvek6-ITyR)d$^PZ?@Z$%>LZ_ dno@y3K9A4i^FQqQzX1RM|Nk_l2Sfl`0RS-zM700_ diff --git a/rds/base/charts/postgresql/charts/common/.helmignore b/rds/base/charts/postgresql/charts/common/.helmignore deleted file mode 100644 index 50af031..0000000 --- a/rds/base/charts/postgresql/charts/common/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/rds/base/charts/postgresql/charts/common/Chart.yaml b/rds/base/charts/postgresql/charts/common/Chart.yaml deleted file mode 100644 index cf934aa..0000000 --- a/rds/base/charts/postgresql/charts/common/Chart.yaml +++ /dev/null @@ -1,23 +0,0 @@ -annotations: - category: Infrastructure -apiVersion: v2 -appVersion: 1.10.0 -description: A Library Helm Chart for grouping common logic between bitnami charts. - This chart is not deployable by itself. -home: https://github.com/bitnami/charts/tree/master/bitnami/common -icon: https://bitnami.com/downloads/logos/bitnami-mark.png -keywords: -- common -- helper -- template -- function -- bitnami -maintainers: -- email: containers@bitnami.com - name: Bitnami -name: common -sources: -- https://github.com/bitnami/charts -- https://www.bitnami.com/ -type: library -version: 1.10.3 diff --git a/rds/base/charts/postgresql/charts/common/README.md b/rds/base/charts/postgresql/charts/common/README.md deleted file mode 100644 index cbbc31d..0000000 --- a/rds/base/charts/postgresql/charts/common/README.md +++ /dev/null @@ -1,328 +0,0 @@ -# Bitnami Common Library Chart - -A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between bitnami charts. - -## TL;DR - -```yaml -dependencies: - - name: common - version: 0.x.x - repository: https://charts.bitnami.com/bitnami -``` - -```bash -$ helm dependency update -``` - -```yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "common.names.fullname" . }} -data: - myvalue: "Hello World" -``` - -## Introduction - -This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. - -Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This Helm chart has been tested on top of [Bitnami Kubernetes Production Runtime](https://kubeprod.io/) (BKPR). Deploy BKPR to get automated TLS certificates, logging and monitoring for your applications. - -## Prerequisites - -- Kubernetes 1.12+ -- Helm 3.1.0 - -## Parameters - -The following table lists the helpers available in the library which are scoped in different sections. - -### Affinities - -| Helper identifier | Description | Expected Input | -|-------------------------------|------------------------------------------------------|------------------------------------------------| -| `common.affinities.node.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | -| `common.affinities.node.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | -| `common.affinities.pod.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | -| `common.affinities.pod.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | - -### Capabilities - -| Helper identifier | Description | Expected Input | -|------------------------------------------------|------------------------------------------------------------------------------------------------|-------------------| -| `common.capabilities.kubeVersion` | Return the target Kubernetes version (using client default if .Values.kubeVersion is not set). | `.` Chart context | -| `common.capabilities.cronjob.apiVersion` | Return the appropriate apiVersion for cronjob. | `.` Chart context | -| `common.capabilities.deployment.apiVersion` | Return the appropriate apiVersion for deployment. | `.` Chart context | -| `common.capabilities.statefulset.apiVersion` | Return the appropriate apiVersion for statefulset. | `.` Chart context | -| `common.capabilities.ingress.apiVersion` | Return the appropriate apiVersion for ingress. | `.` Chart context | -| `common.capabilities.rbac.apiVersion` | Return the appropriate apiVersion for RBAC resources. | `.` Chart context | -| `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context | -| `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for podsecuritypolicy. | `.` Chart context | -| `common.capabilities.networkPolicy.apiVersion` | Return the appropriate apiVersion for networkpolicy. | `.` Chart context | -| `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context | - -### Errors - -| Helper identifier | Description | Expected Input | -|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------| -| `common.errors.upgrade.passwords.empty` | It will ensure required passwords are given when we are upgrading a chart. If `validationErrors` is not empty it will throw an error and will stop the upgrade action. | `dict "validationErrors" (list $validationError00 $validationError01) "context" $` | - -### Images - -| Helper identifier | Description | Expected Input | -|-----------------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------| -| `common.images.image` | Return the proper and full image name | `dict "imageRoot" .Values.path.to.the.image "global" $`, see [ImageRoot](#imageroot) for the structure. | -| `common.images.pullSecrets` | Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global` | -| `common.images.renderPullSecrets` | Return the proper Docker Image Registry Secret Names (evaluates values as templates) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $` | - -### Ingress - -| Helper identifier | Description | Expected Input | -|-------------------------------------------|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences | -| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context | -| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context | - -### Labels - -| Helper identifier | Description | Expected Input | -|-----------------------------|------------------------------------------------------|-------------------| -| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context | -| `common.labels.matchLabels` | Return the proper Docker Image Registry Secret Names | `.` Chart context | - -### Names - -| Helper identifier | Description | Expected Input | -|-------------------------|------------------------------------------------------------|-------------------| -| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context | -| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context | -| `common.names.chart` | Chart name plus version | `.` Chart context | - -### Secrets - -| Helper identifier | Description | Expected Input | -|---------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `common.secrets.name` | Generate the name of the secret. | `dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $` see [ExistingSecret](#existingsecret) for the structure. | -| `common.secrets.key` | Generate secret key. | `dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName"` see [ExistingSecret](#existingsecret) for the structure. | -| `common.passwords.manage` | Generate secret password or retrieve one if already created. | `dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $`, length, strong and chartNAme fields are optional. | -| `common.secrets.exists` | Returns whether a previous generated secret already exists. | `dict "secret" "secret-name" "context" $` | - -### Storage - -| Helper identifier | Description | Expected Input | -|-------------------------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------| -| `common.storage.class` | Return the proper Storage Class | `dict "persistence" .Values.path.to.the.persistence "global" $`, see [Persistence](#persistence) for the structure. | - -### TplValues - -| Helper identifier | Description | Expected Input | -|---------------------------|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------| -| `common.tplvalues.render` | Renders a value that contains template | `dict "value" .Values.path.to.the.Value "context" $`, value is the value should rendered as template, context frequently is the chart context `$` or `.` | - -### Utils - -| Helper identifier | Description | Expected Input | -|--------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------| -| `common.utils.fieldToEnvVar` | Build environment variable name given a field. | `dict "field" "my-password"` | -| `common.utils.secret.getvalue` | Print instructions to get a secret value. | `dict "secret" "secret-name" "field" "secret-value-field" "context" $` | -| `common.utils.getValueFromKey` | Gets a value from `.Values` object given its key path | `dict "key" "path.to.key" "context" $` | -| `common.utils.getKeyFromList` | Returns first `.Values` key with a defined value or first of the list if all non-defined | `dict "keys" (list "path.to.key1" "path.to.key2") "context" $` | - -### Validations - -| Helper identifier | Description | Expected Input | -|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `common.validations.values.single.empty` | Validate a value must not be empty. | `dict "valueKey" "path.to.value" "secret" "secret.name" "field" "my-password" "subchart" "subchart" "context" $` secret, field and subchart are optional. In case they are given, the helper will generate a how to get instruction. See [ValidateValue](#validatevalue) | -| `common.validations.values.multiple.empty` | Validate a multiple values must not be empty. It returns a shared error for all the values. | `dict "required" (list $validateValueConf00 $validateValueConf01) "context" $`. See [ValidateValue](#validatevalue) | -| `common.validations.values.mariadb.passwords` | This helper will ensure required password for MariaDB are not empty. It returns a shared error for all the values. | `dict "secret" "mariadb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mariadb chart and the helper. | -| `common.validations.values.postgresql.passwords` | This helper will ensure required password for PostgreSQL are not empty. It returns a shared error for all the values. | `dict "secret" "postgresql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use postgresql chart and the helper. | -| `common.validations.values.redis.passwords` | This helper will ensure required password for Redis™ are not empty. It returns a shared error for all the values. | `dict "secret" "redis-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use redis chart and the helper. | -| `common.validations.values.cassandra.passwords` | This helper will ensure required password for Cassandra are not empty. It returns a shared error for all the values. | `dict "secret" "cassandra-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use cassandra chart and the helper. | -| `common.validations.values.mongodb.passwords` | This helper will ensure required password for MongoDB® are not empty. It returns a shared error for all the values. | `dict "secret" "mongodb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mongodb chart and the helper. | - -### Warnings - -| Helper identifier | Description | Expected Input | -|------------------------------|----------------------------------|------------------------------------------------------------| -| `common.warnings.rollingTag` | Warning about using rolling tag. | `ImageRoot` see [ImageRoot](#imageroot) for the structure. | - -## Special input schemas - -### ImageRoot - -```yaml -registry: - type: string - description: Docker registry where the image is located - example: docker.io - -repository: - type: string - description: Repository and image name - example: bitnami/nginx - -tag: - type: string - description: image tag - example: 1.16.1-debian-10-r63 - -pullPolicy: - type: string - description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - -pullSecrets: - type: array - items: - type: string - description: Optionally specify an array of imagePullSecrets (evaluated as templates). - -debug: - type: boolean - description: Set to true if you would like to see extra information on logs - example: false - -## An instance would be: -# registry: docker.io -# repository: bitnami/nginx -# tag: 1.16.1-debian-10-r63 -# pullPolicy: IfNotPresent -# debug: false -``` - -### Persistence - -```yaml -enabled: - type: boolean - description: Whether enable persistence. - example: true - -storageClass: - type: string - description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. - example: "-" - -accessMode: - type: string - description: Access mode for the Persistent Volume Storage. - example: ReadWriteOnce - -size: - type: string - description: Size the Persistent Volume Storage. - example: 8Gi - -path: - type: string - description: Path to be persisted. - example: /bitnami - -## An instance would be: -# enabled: true -# storageClass: "-" -# accessMode: ReadWriteOnce -# size: 8Gi -# path: /bitnami -``` - -### ExistingSecret - -```yaml -name: - type: string - description: Name of the existing secret. - example: mySecret -keyMapping: - description: Mapping between the expected key name and the name of the key in the existing secret. - type: object - -## An instance would be: -# name: mySecret -# keyMapping: -# password: myPasswordKey -``` - -#### Example of use - -When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. - -```yaml -# templates/secret.yaml ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "common.names.fullname" . }} - labels: - app: {{ include "common.names.fullname" . }} -type: Opaque -data: - password: {{ .Values.password | b64enc | quote }} - -# templates/dpl.yaml ---- -... - env: - - name: PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} - key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} -... - -# values.yaml ---- -name: mySecret -keyMapping: - password: myPasswordKey -``` - -### ValidateValue - -#### NOTES.txt - -```console -{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} -{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} - -{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} -``` - -If we force those values to be empty we will see some alerts - -```console -$ helm install test mychart --set path.to.value00="",path.to.value01="" - 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: - - export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 --decode) - - 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: - - export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 --decode) -``` - -## Upgrading - -### To 1.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -**What changes were introduced in this major version?** - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. -- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts - -**Considerations when upgrading to this version** - -- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 - -**Useful links** - -- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ -- https://helm.sh/docs/topics/v2_v3_migration/ -- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ diff --git a/rds/base/charts/postgresql/charts/common/templates/_affinities.tpl b/rds/base/charts/postgresql/charts/common/templates/_affinities.tpl deleted file mode 100644 index 189ea40..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_affinities.tpl +++ /dev/null @@ -1,102 +0,0 @@ -{{/* vim: set filetype=mustache: */}} - -{{/* -Return a soft nodeAffinity definition -{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} -*/}} -{{- define "common.affinities.nodes.soft" -}} -preferredDuringSchedulingIgnoredDuringExecution: - - preference: - matchExpressions: - - key: {{ .key }} - operator: In - values: - {{- range .values }} - - {{ . | quote }} - {{- end }} - weight: 1 -{{- end -}} - -{{/* -Return a hard nodeAffinity definition -{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} -*/}} -{{- define "common.affinities.nodes.hard" -}} -requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: {{ .key }} - operator: In - values: - {{- range .values }} - - {{ . | quote }} - {{- end }} -{{- end -}} - -{{/* -Return a nodeAffinity definition -{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} -*/}} -{{- define "common.affinities.nodes" -}} - {{- if eq .type "soft" }} - {{- include "common.affinities.nodes.soft" . -}} - {{- else if eq .type "hard" }} - {{- include "common.affinities.nodes.hard" . -}} - {{- end -}} -{{- end -}} - -{{/* -Return a soft podAffinity/podAntiAffinity definition -{{ include "common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} -*/}} -{{- define "common.affinities.pods.soft" -}} -{{- $component := default "" .component -}} -{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} -preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 10 }} - {{- if not (empty $component) }} - {{ printf "app.kubernetes.io/component: %s" $component }} - {{- end }} - {{- range $key, $value := $extraMatchLabels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - namespaces: - - {{ .context.Release.Namespace | quote }} - topologyKey: kubernetes.io/hostname - weight: 1 -{{- end -}} - -{{/* -Return a hard podAffinity/podAntiAffinity definition -{{ include "common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} -*/}} -{{- define "common.affinities.pods.hard" -}} -{{- $component := default "" .component -}} -{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} -requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 8 }} - {{- if not (empty $component) }} - {{ printf "app.kubernetes.io/component: %s" $component }} - {{- end }} - {{- range $key, $value := $extraMatchLabels }} - {{ $key }}: {{ $value | quote }} - {{- end }} - namespaces: - - {{ .context.Release.Namespace | quote }} - topologyKey: kubernetes.io/hostname -{{- end -}} - -{{/* -Return a podAffinity/podAntiAffinity definition -{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} -*/}} -{{- define "common.affinities.pods" -}} - {{- if eq .type "soft" }} - {{- include "common.affinities.pods.soft" . -}} - {{- else if eq .type "hard" }} - {{- include "common.affinities.pods.hard" . -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_capabilities.tpl b/rds/base/charts/postgresql/charts/common/templates/_capabilities.tpl deleted file mode 100644 index b94212b..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_capabilities.tpl +++ /dev/null @@ -1,128 +0,0 @@ -{{/* vim: set filetype=mustache: */}} - -{{/* -Return the target Kubernetes version -*/}} -{{- define "common.capabilities.kubeVersion" -}} -{{- if .Values.global }} - {{- if .Values.global.kubeVersion }} - {{- .Values.global.kubeVersion -}} - {{- else }} - {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} - {{- end -}} -{{- else }} -{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for poddisruptionbudget. -*/}} -{{- define "common.capabilities.policy.apiVersion" -}} -{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "policy/v1beta1" -}} -{{- else -}} -{{- print "policy/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "common.capabilities.networkPolicy.apiVersion" -}} -{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for cronjob. -*/}} -{{- define "common.capabilities.cronjob.apiVersion" -}} -{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "batch/v1beta1" -}} -{{- else -}} -{{- print "batch/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for deployment. -*/}} -{{- define "common.capabilities.deployment.apiVersion" -}} -{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for statefulset. -*/}} -{{- define "common.capabilities.statefulset.apiVersion" -}} -{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "apps/v1beta1" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "common.capabilities.ingress.apiVersion" -}} -{{- if .Values.ingress -}} -{{- if .Values.ingress.apiVersion -}} -{{- .Values.ingress.apiVersion -}} -{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end }} -{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for RBAC resources. -*/}} -{{- define "common.capabilities.rbac.apiVersion" -}} -{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "rbac.authorization.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "rbac.authorization.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for CRDs. -*/}} -{{- define "common.capabilities.crd.apiVersion" -}} -{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "apiextensions.k8s.io/v1beta1" -}} -{{- else -}} -{{- print "apiextensions.k8s.io/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Returns true if the used Helm version is 3.3+. -A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. -This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. -**To be removed when the catalog's minimun Helm version is 3.3** -*/}} -{{- define "common.capabilities.supportsHelmVersion" -}} -{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} - {{- true -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_errors.tpl b/rds/base/charts/postgresql/charts/common/templates/_errors.tpl deleted file mode 100644 index a79cc2e..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_errors.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Through error when upgrading using empty passwords values that must not be empty. - -Usage: -{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} -{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} -{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} - -Required password params: - - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. - - context - Context - Required. Parent context. -*/}} -{{- define "common.errors.upgrade.passwords.empty" -}} - {{- $validationErrors := join "" .validationErrors -}} - {{- if and $validationErrors .context.Release.IsUpgrade -}} - {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} - {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} - {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} - {{- $errorString = print $errorString "\n%s" -}} - {{- printf $errorString $validationErrors | fail -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_images.tpl b/rds/base/charts/postgresql/charts/common/templates/_images.tpl deleted file mode 100644 index 42ffbc7..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_images.tpl +++ /dev/null @@ -1,75 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Return the proper image name -{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} -*/}} -{{- define "common.images.image" -}} -{{- $registryName := .imageRoot.registry -}} -{{- $repositoryName := .imageRoot.repository -}} -{{- $tag := .imageRoot.tag | toString -}} -{{- if .global }} - {{- if .global.imageRegistry }} - {{- $registryName = .global.imageRegistry -}} - {{- end -}} -{{- end -}} -{{- if $registryName }} -{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} -{{- else -}} -{{- printf "%s:%s" $repositoryName $tag -}} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) -{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} -*/}} -{{- define "common.images.pullSecrets" -}} - {{- $pullSecrets := list }} - - {{- if .global }} - {{- range .global.imagePullSecrets -}} - {{- $pullSecrets = append $pullSecrets . -}} - {{- end -}} - {{- end -}} - - {{- range .images -}} - {{- range .pullSecrets -}} - {{- $pullSecrets = append $pullSecrets . -}} - {{- end -}} - {{- end -}} - - {{- if (not (empty $pullSecrets)) }} -imagePullSecrets: - {{- range $pullSecrets }} - - name: {{ . }} - {{- end }} - {{- end }} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names evaluating values as templates -{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} -*/}} -{{- define "common.images.renderPullSecrets" -}} - {{- $pullSecrets := list }} - {{- $context := .context }} - - {{- if $context.Values.global }} - {{- range $context.Values.global.imagePullSecrets -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} - {{- end -}} - {{- end -}} - - {{- range .images -}} - {{- range .pullSecrets -}} - {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} - {{- end -}} - {{- end -}} - - {{- if (not (empty $pullSecrets)) }} -imagePullSecrets: - {{- range $pullSecrets }} - - name: {{ . }} - {{- end }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_ingress.tpl b/rds/base/charts/postgresql/charts/common/templates/_ingress.tpl deleted file mode 100644 index f905f20..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_ingress.tpl +++ /dev/null @@ -1,55 +0,0 @@ -{{/* vim: set filetype=mustache: */}} - -{{/* -Generate backend entry that is compatible with all Kubernetes API versions. - -Usage: -{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} - -Params: - - serviceName - String. Name of an existing service backend - - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. - - context - Dict - Required. The context for the template evaluation. -*/}} -{{- define "common.ingress.backend" -}} -{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} -{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} -serviceName: {{ .serviceName }} -servicePort: {{ .servicePort }} -{{- else -}} -service: - name: {{ .serviceName }} - port: - {{- if typeIs "string" .servicePort }} - name: {{ .servicePort }} - {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} - number: {{ .servicePort | int }} - {{- end }} -{{- end -}} -{{- end -}} - -{{/* -Print "true" if the API pathType field is supported -Usage: -{{ include "common.ingress.supportsPathType" . }} -*/}} -{{- define "common.ingress.supportsPathType" -}} -{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} -{{- print "false" -}} -{{- else -}} -{{- print "true" -}} -{{- end -}} -{{- end -}} - -{{/* -Returns true if the ingressClassname field is supported -Usage: -{{ include "common.ingress.supportsIngressClassname" . }} -*/}} -{{- define "common.ingress.supportsIngressClassname" -}} -{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} -{{- print "false" -}} -{{- else -}} -{{- print "true" -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_labels.tpl b/rds/base/charts/postgresql/charts/common/templates/_labels.tpl deleted file mode 100644 index 252066c..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_labels.tpl +++ /dev/null @@ -1,18 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Kubernetes standard labels -*/}} -{{- define "common.labels.standard" -}} -app.kubernetes.io/name: {{ include "common.names.name" . }} -helm.sh/chart: {{ include "common.names.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector -*/}} -{{- define "common.labels.matchLabels" -}} -app.kubernetes.io/name: {{ include "common.names.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_names.tpl b/rds/base/charts/postgresql/charts/common/templates/_names.tpl deleted file mode 100644 index cf03231..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_names.tpl +++ /dev/null @@ -1,52 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "common.names.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "common.names.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "common.names.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create a default fully qualified dependency name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -Usage: -{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }} -*/}} -{{- define "common.names.dependency.fullname" -}} -{{- if .chartValues.fullnameOverride -}} -{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .chartName .chartValues.nameOverride -}} -{{- if contains $name .context.Release.Name -}} -{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_secrets.tpl b/rds/base/charts/postgresql/charts/common/templates/_secrets.tpl deleted file mode 100644 index 60b84a7..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_secrets.tpl +++ /dev/null @@ -1,129 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Generate secret name. - -Usage: -{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} - -Params: - - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user - to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. - +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret - - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. - - context - Dict - Required. The context for the template evaluation. -*/}} -{{- define "common.secrets.name" -}} -{{- $name := (include "common.names.fullname" .context) -}} - -{{- if .defaultNameSuffix -}} -{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{- with .existingSecret -}} -{{- if not (typeIs "string" .) -}} -{{- with .name -}} -{{- $name = . -}} -{{- end -}} -{{- else -}} -{{- $name = . -}} -{{- end -}} -{{- end -}} - -{{- printf "%s" $name -}} -{{- end -}} - -{{/* -Generate secret key. - -Usage: -{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} - -Params: - - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user - to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. - +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret - - key - String - Required. Name of the key in the secret. -*/}} -{{- define "common.secrets.key" -}} -{{- $key := .key -}} - -{{- if .existingSecret -}} - {{- if not (typeIs "string" .existingSecret) -}} - {{- if .existingSecret.keyMapping -}} - {{- $key = index .existingSecret.keyMapping $.key -}} - {{- end -}} - {{- end }} -{{- end -}} - -{{- printf "%s" $key -}} -{{- end -}} - -{{/* -Generate secret password or retrieve one if already created. - -Usage: -{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }} - -Params: - - secret - String - Required - Name of the 'Secret' resource where the password is stored. - - key - String - Required - Name of the key in the secret. - - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. - - length - int - Optional - Length of the generated random password. - - strong - Boolean - Optional - Whether to add symbols to the generated random password. - - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. - - context - Context - Required - Parent context. -*/}} -{{- define "common.secrets.passwords.manage" -}} - -{{- $password := "" }} -{{- $subchart := "" }} -{{- $chartName := default "" .chartName }} -{{- $passwordLength := default 10 .length }} -{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} -{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} -{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} -{{- if $secret }} - {{- if index $secret.data .key }} - {{- $password = index $secret.data .key }} - {{- end -}} -{{- else if $providedPasswordValue }} - {{- $password = $providedPasswordValue | toString | b64enc | quote }} -{{- else }} - - {{- if .context.Values.enabled }} - {{- $subchart = $chartName }} - {{- end -}} - - {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} - {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} - {{- $passwordValidationErrors := list $requiredPasswordError -}} - {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} - - {{- if .strong }} - {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} - {{- $password = randAscii $passwordLength }} - {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} - {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }} - {{- else }} - {{- $password = randAlphaNum $passwordLength | b64enc | quote }} - {{- end }} -{{- end -}} -{{- printf "%s" $password -}} -{{- end -}} - -{{/* -Returns whether a previous generated secret already exists - -Usage: -{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} - -Params: - - secret - String - Required - Name of the 'Secret' resource where the password is stored. - - context - Context - Required - Parent context. -*/}} -{{- define "common.secrets.exists" -}} -{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} -{{- if $secret }} - {{- true -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_storage.tpl b/rds/base/charts/postgresql/charts/common/templates/_storage.tpl deleted file mode 100644 index 60e2a84..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_storage.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Return the proper Storage Class -{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} -*/}} -{{- define "common.storage.class" -}} - -{{- $storageClass := .persistence.storageClass -}} -{{- if .global -}} - {{- if .global.storageClass -}} - {{- $storageClass = .global.storageClass -}} - {{- end -}} -{{- end -}} - -{{- if $storageClass -}} - {{- if (eq "-" $storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" $storageClass -}} - {{- end -}} -{{- end -}} - -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_tplvalues.tpl b/rds/base/charts/postgresql/charts/common/templates/_tplvalues.tpl deleted file mode 100644 index 2db1668..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_tplvalues.tpl +++ /dev/null @@ -1,13 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Renders a value that contains template. -Usage: -{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }} -*/}} -{{- define "common.tplvalues.render" -}} - {{- if typeIs "string" .value }} - {{- tpl .value .context }} - {{- else }} - {{- tpl (.value | toYaml) .context }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_utils.tpl b/rds/base/charts/postgresql/charts/common/templates/_utils.tpl deleted file mode 100644 index ea083a2..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_utils.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Print instructions to get a secret value. -Usage: -{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} -*/}} -{{- define "common.utils.secret.getvalue" -}} -{{- $varname := include "common.utils.fieldToEnvVar" . -}} -export {{ $varname }}=$(kubectl get secret --namespace {{ .context.Release.Namespace | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 --decode) -{{- end -}} - -{{/* -Build env var name given a field -Usage: -{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} -*/}} -{{- define "common.utils.fieldToEnvVar" -}} - {{- $fieldNameSplit := splitList "-" .field -}} - {{- $upperCaseFieldNameSplit := list -}} - - {{- range $fieldNameSplit -}} - {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} - {{- end -}} - - {{ join "_" $upperCaseFieldNameSplit }} -{{- end -}} - -{{/* -Gets a value from .Values given -Usage: -{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} -*/}} -{{- define "common.utils.getValueFromKey" -}} -{{- $splitKey := splitList "." .key -}} -{{- $value := "" -}} -{{- $latestObj := $.context.Values -}} -{{- range $splitKey -}} - {{- if not $latestObj -}} - {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} - {{- end -}} - {{- $value = ( index $latestObj . ) -}} - {{- $latestObj = $value -}} -{{- end -}} -{{- printf "%v" (default "" $value) -}} -{{- end -}} - -{{/* -Returns first .Values key with a defined value or first of the list if all non-defined -Usage: -{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} -*/}} -{{- define "common.utils.getKeyFromList" -}} -{{- $key := first .keys -}} -{{- $reverseKeys := reverse .keys }} -{{- range $reverseKeys }} - {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} - {{- if $value -}} - {{- $key = . }} - {{- end -}} -{{- end -}} -{{- printf "%s" $key -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/_warnings.tpl b/rds/base/charts/postgresql/charts/common/templates/_warnings.tpl deleted file mode 100644 index ae10fa4..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/_warnings.tpl +++ /dev/null @@ -1,14 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Warning about using rolling tag. -Usage: -{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} -*/}} -{{- define "common.warnings.rollingTag" -}} - -{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} -WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. -+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ -{{- end }} - -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/validations/_cassandra.tpl b/rds/base/charts/postgresql/charts/common/templates/validations/_cassandra.tpl deleted file mode 100644 index ded1ae3..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/validations/_cassandra.tpl +++ /dev/null @@ -1,72 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate Cassandra required passwords are not empty. - -Usage: -{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.cassandra.passwords" -}} - {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} - {{- $enabled := include "common.cassandra.values.enabled" . -}} - {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} - {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.cassandra.values.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.dbUser.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled cassandra. - -Usage: -{{ include "common.cassandra.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.cassandra.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.cassandra.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key dbUser - -Usage: -{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.cassandra.values.key.dbUser" -}} - {{- if .subchart -}} - cassandra.dbUser - {{- else -}} - dbUser - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/validations/_mariadb.tpl b/rds/base/charts/postgresql/charts/common/templates/validations/_mariadb.tpl deleted file mode 100644 index b6906ff..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/validations/_mariadb.tpl +++ /dev/null @@ -1,103 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MariaDB required passwords are not empty. - -Usage: -{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mariadb.passwords" -}} - {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mariadb.values.enabled" . -}} - {{- $architecture := include "common.mariadb.values.architecture" . -}} - {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- if not (empty $valueUsername) -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replication") -}} - {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mariadb.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mariadb. - -Usage: -{{ include "common.mariadb.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mariadb.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mariadb.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mariadb.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.key.auth" -}} - {{- if .subchart -}} - mariadb.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/validations/_mongodb.tpl b/rds/base/charts/postgresql/charts/common/templates/validations/_mongodb.tpl deleted file mode 100644 index a071ea4..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/validations/_mongodb.tpl +++ /dev/null @@ -1,108 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MongoDB® required passwords are not empty. - -Usage: -{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mongodb.passwords" -}} - {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mongodb.values.enabled" . -}} - {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} - {{- $architecture := include "common.mongodb.values.architecture" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} - {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} - - {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} - {{- if and $valueUsername $valueDatabase -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replicaset") -}} - {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mongodb.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mongodb. - -Usage: -{{ include "common.mongodb.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mongodb.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mongodb.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.key.auth" -}} - {{- if .subchart -}} - mongodb.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mongodb.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/validations/_postgresql.tpl b/rds/base/charts/postgresql/charts/common/templates/validations/_postgresql.tpl deleted file mode 100644 index 164ec0d..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/validations/_postgresql.tpl +++ /dev/null @@ -1,129 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate PostgreSQL required passwords are not empty. - -Usage: -{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.postgresql.passwords" -}} - {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} - {{- $enabled := include "common.postgresql.values.enabled" . -}} - {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} - {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} - - {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} - {{- if (eq $enabledReplication "true") -}} - {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to decide whether evaluate global values. - -Usage: -{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} -Params: - - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" -*/}} -{{- define "common.postgresql.values.use.global" -}} - {{- if .context.Values.global -}} - {{- if .context.Values.global.postgresql -}} - {{- index .context.Values.global.postgresql .key | quote -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} -*/}} -{{- define "common.postgresql.values.existingSecret" -}} - {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} - - {{- if .subchart -}} - {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} - {{- else -}} - {{- default (.context.Values.existingSecret | quote) $globalValue -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled postgresql. - -Usage: -{{ include "common.postgresql.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.postgresql.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.postgresql.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key postgressPassword. - -Usage: -{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.key.postgressPassword" -}} - {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} - - {{- if not $globalValue -}} - {{- if .subchart -}} - postgresql.postgresqlPassword - {{- else -}} - postgresqlPassword - {{- end -}} - {{- else -}} - global.postgresql.postgresqlPassword - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled.replication. - -Usage: -{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.enabled.replication" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.postgresql.replication.enabled -}} - {{- else -}} - {{- printf "%v" .context.Values.replication.enabled -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key replication.password. - -Usage: -{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.key.replicationPassword" -}} - {{- if .subchart -}} - postgresql.replication.password - {{- else -}} - replication.password - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/validations/_redis.tpl b/rds/base/charts/postgresql/charts/common/templates/validations/_redis.tpl deleted file mode 100644 index 5d72959..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/validations/_redis.tpl +++ /dev/null @@ -1,76 +0,0 @@ - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate Redis™ required passwords are not empty. - -Usage: -{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" - - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.redis.passwords" -}} - {{- $enabled := include "common.redis.values.enabled" . -}} - {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} - {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} - - {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} - {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} - - {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} - {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} - {{- if eq $useAuth "true" -}} - {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled redis. - -Usage: -{{ include "common.redis.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.redis.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.redis.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right prefix path for the values - -Usage: -{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false -*/}} -{{- define "common.redis.values.keys.prefix" -}} - {{- if .subchart -}}redis.{{- else -}}{{- end -}} -{{- end -}} - -{{/* -Checks whether the redis chart's includes the standarizations (version >= 14) - -Usage: -{{ include "common.redis.values.standarized.version" (dict "context" $) }} -*/}} -{{- define "common.redis.values.standarized.version" -}} - - {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} - {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} - - {{- if $standarizedAuthValues -}} - {{- true -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/templates/validations/_validations.tpl b/rds/base/charts/postgresql/charts/common/templates/validations/_validations.tpl deleted file mode 100644 index 9a814cf..0000000 --- a/rds/base/charts/postgresql/charts/common/templates/validations/_validations.tpl +++ /dev/null @@ -1,46 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate values must not be empty. - -Usage: -{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} -{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} -{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} - -Validate value params: - - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" - - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" - - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" -*/}} -{{- define "common.validations.values.multiple.empty" -}} - {{- range .required -}} - {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} - {{- end -}} -{{- end -}} - -{{/* -Validate a value must not be empty. - -Usage: -{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} - -Validate value params: - - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" - - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" - - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" - - subchart - String - Optional - Name of the subchart that the validated password is part of. -*/}} -{{- define "common.validations.values.single.empty" -}} - {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} - {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} - - {{- if not $value -}} - {{- $varname := "my-value" -}} - {{- $getCurrentValue := "" -}} - {{- if and .secret .field -}} - {{- $varname = include "common.utils.fieldToEnvVar" . -}} - {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} - {{- end -}} - {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/charts/common/values.yaml b/rds/base/charts/postgresql/charts/common/values.yaml deleted file mode 100644 index f2df68e..0000000 --- a/rds/base/charts/postgresql/charts/common/values.yaml +++ /dev/null @@ -1,5 +0,0 @@ -## bitnami/common -## It is required by CI/CD tools and processes. -## @skip exampleValue -## -exampleValue: common-chart diff --git a/rds/base/charts/postgresql/ci/commonAnnotations.yaml b/rds/base/charts/postgresql/ci/commonAnnotations.yaml deleted file mode 100644 index 97e18a4..0000000 --- a/rds/base/charts/postgresql/ci/commonAnnotations.yaml +++ /dev/null @@ -1,3 +0,0 @@ -commonAnnotations: - helm.sh/hook: "\"pre-install, pre-upgrade\"" - helm.sh/hook-weight: "-1" diff --git a/rds/base/charts/postgresql/ci/default-values.yaml b/rds/base/charts/postgresql/ci/default-values.yaml deleted file mode 100644 index fc2ba60..0000000 --- a/rds/base/charts/postgresql/ci/default-values.yaml +++ /dev/null @@ -1 +0,0 @@ -# Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml. diff --git a/rds/base/charts/postgresql/ci/shmvolume-disabled-values.yaml b/rds/base/charts/postgresql/ci/shmvolume-disabled-values.yaml deleted file mode 100644 index 347d3b4..0000000 --- a/rds/base/charts/postgresql/ci/shmvolume-disabled-values.yaml +++ /dev/null @@ -1,2 +0,0 @@ -shmVolume: - enabled: false diff --git a/rds/base/charts/postgresql/files/README.md b/rds/base/charts/postgresql/files/README.md deleted file mode 100644 index 1813a2f..0000000 --- a/rds/base/charts/postgresql/files/README.md +++ /dev/null @@ -1 +0,0 @@ -Copy here your postgresql.conf and/or pg_hba.conf files to use it as a config map. diff --git a/rds/base/charts/postgresql/files/conf.d/README.md b/rds/base/charts/postgresql/files/conf.d/README.md deleted file mode 100644 index 184c187..0000000 --- a/rds/base/charts/postgresql/files/conf.d/README.md +++ /dev/null @@ -1,4 +0,0 @@ -If you don't want to provide the whole configuration file and only specify certain parameters, you can copy here your extended `.conf` files. -These files will be injected as a config maps and add/overwrite the default configuration using the `include_dir` directive that allows settings to be loaded from files other than the default `postgresql.conf`. - -More info in the [bitnami-docker-postgresql README](https://github.com/bitnami/bitnami-docker-postgresql#configuration-file). diff --git a/rds/base/charts/postgresql/files/docker-entrypoint-initdb.d/README.md b/rds/base/charts/postgresql/files/docker-entrypoint-initdb.d/README.md deleted file mode 100644 index cba3809..0000000 --- a/rds/base/charts/postgresql/files/docker-entrypoint-initdb.d/README.md +++ /dev/null @@ -1,3 +0,0 @@ -You can copy here your custom `.sh`, `.sql` or `.sql.gz` file so they are executed during the first boot of the image. - -More info in the [bitnami-docker-postgresql](https://github.com/bitnami/bitnami-docker-postgresql#initializing-a-new-instance) repository. \ No newline at end of file diff --git a/rds/base/charts/postgresql/templates/NOTES.txt b/rds/base/charts/postgresql/templates/NOTES.txt deleted file mode 100644 index f35ebc5..0000000 --- a/rds/base/charts/postgresql/templates/NOTES.txt +++ /dev/null @@ -1,89 +0,0 @@ -CHART NAME: {{ .Chart.Name }} -CHART VERSION: {{ .Chart.Version }} -APP VERSION: {{ .Chart.AppVersion }} - -** Please be patient while the chart is being deployed ** - -{{- if .Values.diagnosticMode.enabled }} -The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: - - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} - -Get the list of pods by executing: - - kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} - -Access the pod you want to debug by executing - - kubectl exec --namespace {{ .Release.Namespace }} -ti -- bash - -In order to replicate the container startup scripts execute this command: - - /opt/bitnami/scripts/postgresql/entrypoint.sh /opt/bitnami/scripts/postgresql/run.sh - -{{- else }} - -PostgreSQL can be accessed via port {{ template "postgresql.servicePort" . }} on the following DNS names from within your cluster: - - {{ template "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - Read/Write connection -{{- if .Values.replication.enabled }} -{{- if .Values.replication.singleService }} - {{ template "common.names.fullname" . }}-read.{{ .Release.Namespace }}.svc.cluster.local - Read only connection -{{- end }} -{{- if .Values.replication.uniqueServices }} -{{- $replicaCount := .Values.replication.readReplicas | int }} -{{- $root := . }} -{{- range $i, $e := until $replicaCount }} - {{ template "common.names.fullname" $root }}-read-{{ $i }}.{{ $root.Release.Namespace }}.svc.cluster.local - Read only connection to replica {{ $i }} -{{- end }} -{{- end }} -{{- end }} - -{{- if not (eq (include "postgresql.username" .) "postgres") }} - -To get the password for "postgres" run: - - export POSTGRES_ADMIN_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "postgresql.secretName" . }} -o jsonpath="{.data.postgresql-postgres-password}" | base64 --decode) -{{- end }} - -To get the password for "{{ template "postgresql.username" . }}" run: - - export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "postgresql.secretName" . }} -o jsonpath="{.data.postgresql-password}" | base64 --decode) - -To connect to your database run the following command: - - kubectl run {{ template "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ .Release.Namespace }} --image {{ template "postgresql.image" . }} --env="PGPASSWORD=$POSTGRES_PASSWORD" {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} - --labels="{{ template "common.names.fullname" . }}-client=true" {{- end }} --command -- psql --host {{ template "common.names.fullname" . }} -U {{ .Values.postgresqlUsername }} -d {{- if .Values.postgresqlDatabase }} {{ .Values.postgresqlDatabase }}{{- else }} postgres{{- end }} -p {{ template "postgresql.servicePort" . }} - -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label {{ template "common.names.fullname" . }}-client=true" will be able to connect to this PostgreSQL cluster. -{{- end }} - -To connect to your database from outside the cluster execute the following commands: - -{{- if contains "NodePort" .Values.service.type }} - - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "common.names.fullname" . }}) - {{ if (include "postgresql.password" . ) }}PGPASSWORD="$POSTGRES_PASSWORD" {{ end }}psql --host $NODE_IP --port $NODE_PORT -U {{ .Values.postgresqlUsername }} -d {{- if .Values.postgresqlDatabase }} {{ .Values.postgresqlDatabase }}{{- else }} postgres{{- end }} - -{{- else if contains "LoadBalancer" .Values.service.type }} - - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "common.names.fullname" . }}' - - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") - {{ if (include "postgresql.password" . ) }}PGPASSWORD="$POSTGRES_PASSWORD" {{ end }}psql --host $SERVICE_IP --port {{ template "postgresql.servicePort" . }} -U {{ .Values.postgresqlUsername }} -d {{- if .Values.postgresqlDatabase }} {{ .Values.postgresqlDatabase }}{{- else }} postgres{{- end }} - -{{- else if contains "ClusterIP" .Values.service.type }} - - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "common.names.fullname" . }} {{ template "postgresql.servicePort" . }}:{{ template "postgresql.servicePort" . }} & - {{ if (include "postgresql.password" . ) }}PGPASSWORD="$POSTGRES_PASSWORD" {{ end }}psql --host 127.0.0.1 -U {{ .Values.postgresqlUsername }} -d {{- if .Values.postgresqlDatabase }} {{ .Values.postgresqlDatabase }}{{- else }} postgres{{- end }} -p {{ template "postgresql.servicePort" . }} - -{{- end }} -{{- end }} - -{{- include "postgresql.validateValues" . -}} -{{- include "common.warnings.rollingTag" .Values.image -}} -{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }} diff --git a/rds/base/charts/postgresql/templates/_helpers.tpl b/rds/base/charts/postgresql/templates/_helpers.tpl deleted file mode 100644 index 16e4456..0000000 --- a/rds/base/charts/postgresql/templates/_helpers.tpl +++ /dev/null @@ -1,361 +0,0 @@ -{{/* vim: set filetype=mustache: */}} - -{{/* -Expand the name of the chart. -*/}} -{{- define "postgresql.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "postgresql.primary.fullname" -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- $fullname := default (printf "%s-%s" .Release.Name $name) .Values.fullnameOverride -}} -{{- if .Values.replication.enabled -}} -{{- printf "%s-%s" $fullname "primary" | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s" $fullname | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the proper PostgreSQL image name -*/}} -{{- define "postgresql.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper PostgreSQL metrics image name -*/}} -{{- define "postgresql.metrics.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper image name (for the init container volume-permissions image) -*/}} -{{- define "postgresql.volumePermissions.image" -}} -{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "postgresql.imagePullSecrets" -}} -{{ include "common.images.pullSecrets" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image) "global" .Values.global) }} -{{- end -}} - -{{/* -Returns the available value for certain key in an existing secret (if it exists), -otherwise it generates a random value. -*/}} -{{- define "getValueFromSecret" }} -{{- $len := (default 16 .Length) | int -}} -{{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}} -{{- if $obj }} -{{- index $obj .Key | b64dec -}} -{{- else -}} -{{- randAlphaNum $len -}} -{{- end -}} -{{- end }} - -{{/* -Return PostgreSQL postgres user password -*/}} -{{- define "postgresql.postgres.password" -}} -{{- if .Values.global.postgresql.postgresqlPostgresPassword }} - {{- .Values.global.postgresql.postgresqlPostgresPassword -}} -{{- else if .Values.postgresqlPostgresPassword -}} - {{- .Values.postgresqlPostgresPassword -}} -{{- else -}} - {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "common.names.fullname" .) "Length" 10 "Key" "postgresql-postgres-password") -}} -{{- end -}} -{{- end -}} - -{{/* -Return PostgreSQL password -*/}} -{{- define "postgresql.password" -}} -{{- if .Values.global.postgresql.postgresqlPassword }} - {{- .Values.global.postgresql.postgresqlPassword -}} -{{- else if .Values.postgresqlPassword -}} - {{- .Values.postgresqlPassword -}} -{{- else -}} - {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "common.names.fullname" .) "Length" 10 "Key" "postgresql-password") -}} -{{- end -}} -{{- end -}} - -{{/* -Return PostgreSQL replication password -*/}} -{{- define "postgresql.replication.password" -}} -{{- if .Values.global.postgresql.replicationPassword }} - {{- .Values.global.postgresql.replicationPassword -}} -{{- else if .Values.replication.password -}} - {{- .Values.replication.password -}} -{{- else -}} - {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "common.names.fullname" .) "Length" 10 "Key" "postgresql-replication-password") -}} -{{- end -}} -{{- end -}} - -{{/* -Return PostgreSQL username -*/}} -{{- define "postgresql.username" -}} -{{- if .Values.global.postgresql.postgresqlUsername }} - {{- .Values.global.postgresql.postgresqlUsername -}} -{{- else -}} - {{- .Values.postgresqlUsername -}} -{{- end -}} -{{- end -}} - -{{/* -Return PostgreSQL replication username -*/}} -{{- define "postgresql.replication.username" -}} -{{- if .Values.global.postgresql.replicationUser }} - {{- .Values.global.postgresql.replicationUser -}} -{{- else -}} - {{- .Values.replication.user -}} -{{- end -}} -{{- end -}} - -{{/* -Return PostgreSQL port -*/}} -{{- define "postgresql.servicePort" -}} -{{- if .Values.global.postgresql.servicePort }} - {{- .Values.global.postgresql.servicePort -}} -{{- else -}} - {{- .Values.service.port -}} -{{- end -}} -{{- end -}} - -{{/* -Return PostgreSQL created database -*/}} -{{- define "postgresql.database" -}} -{{- if .Values.global.postgresql.postgresqlDatabase }} - {{- .Values.global.postgresql.postgresqlDatabase -}} -{{- else if .Values.postgresqlDatabase -}} - {{- .Values.postgresqlDatabase -}} -{{- end -}} -{{- end -}} - -{{/* -Get the password secret. -*/}} -{{- define "postgresql.secretName" -}} -{{- if .Values.global.postgresql.existingSecret }} - {{- printf "%s" (tpl .Values.global.postgresql.existingSecret $) -}} -{{- else if .Values.existingSecret -}} - {{- printf "%s" (tpl .Values.existingSecret $) -}} -{{- else -}} - {{- printf "%s" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if we should use an existingSecret. -*/}} -{{- define "postgresql.useExistingSecret" -}} -{{- if or .Values.global.postgresql.existingSecret .Values.existingSecret -}} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a secret object should be created -*/}} -{{- define "postgresql.createSecret" -}} -{{- if not (include "postgresql.useExistingSecret" .) -}} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Get the configuration ConfigMap name. -*/}} -{{- define "postgresql.configurationCM" -}} -{{- if .Values.configurationConfigMap -}} -{{- printf "%s" (tpl .Values.configurationConfigMap $) -}} -{{- else -}} -{{- printf "%s-configuration" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Get the extended configuration ConfigMap name. -*/}} -{{- define "postgresql.extendedConfigurationCM" -}} -{{- if .Values.extendedConfConfigMap -}} -{{- printf "%s" (tpl .Values.extendedConfConfigMap $) -}} -{{- else -}} -{{- printf "%s-extended-configuration" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a configmap should be mounted with PostgreSQL configuration -*/}} -{{- define "postgresql.mountConfigurationCM" -}} -{{- if or (.Files.Glob "files/postgresql.conf") (.Files.Glob "files/pg_hba.conf") .Values.postgresqlConfiguration .Values.pgHbaConfiguration .Values.configurationConfigMap }} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Get the initialization scripts ConfigMap name. -*/}} -{{- define "postgresql.initdbScriptsCM" -}} -{{- if .Values.initdbScriptsConfigMap -}} -{{- printf "%s" (tpl .Values.initdbScriptsConfigMap $) -}} -{{- else -}} -{{- printf "%s-init-scripts" (include "common.names.fullname" .) -}} -{{- end -}} -{{- end -}} - -{{/* -Get the initialization scripts Secret name. -*/}} -{{- define "postgresql.initdbScriptsSecret" -}} -{{- printf "%s" (tpl .Values.initdbScriptsSecret $) -}} -{{- end -}} - -{{/* -Get the metrics ConfigMap name. -*/}} -{{- define "postgresql.metricsCM" -}} -{{- printf "%s-metrics" (include "common.names.fullname" .) -}} -{{- end -}} - -{{/* -Get the readiness probe command -*/}} -{{- define "postgresql.readinessProbeCommand" -}} -- | -{{- if (include "postgresql.database" .) }} - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d "dbname={{ include "postgresql.database" . }} {{- if .Values.tls.enabled }} sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} -{{- else }} - exec pg_isready -U {{ include "postgresql.username" . | quote }} {{- if .Values.tls.enabled }} -d "sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} -{{- end }} -{{- if contains "bitnami/" .Values.image.repository }} - [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ] -{{- end -}} -{{- end -}} - -{{/* -Compile all warnings into a single message, and call fail. -*/}} -{{- define "postgresql.validateValues" -}} -{{- $messages := list -}} -{{- $messages := append $messages (include "postgresql.validateValues.ldapConfigurationMethod" .) -}} -{{- $messages := append $messages (include "postgresql.validateValues.psp" .) -}} -{{- $messages := append $messages (include "postgresql.validateValues.tls" .) -}} -{{- $messages := without $messages "" -}} -{{- $message := join "\n" $messages -}} - -{{- if $message -}} -{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} -{{- end -}} -{{- end -}} - -{{/* -Validate values of Postgresql - If ldap.url is used then you don't need the other settings for ldap -*/}} -{{- define "postgresql.validateValues.ldapConfigurationMethod" -}} -{{- if and .Values.ldap.enabled (and (not (empty .Values.ldap.url)) (not (empty .Values.ldap.server))) }} -postgresql: ldap.url, ldap.server - You cannot set both `ldap.url` and `ldap.server` at the same time. - Please provide a unique way to configure LDAP. - More info at https://www.postgresql.org/docs/current/auth-ldap.html -{{- end -}} -{{- end -}} - -{{/* -Validate values of Postgresql - If PSP is enabled RBAC should be enabled too -*/}} -{{- define "postgresql.validateValues.psp" -}} -{{- if and .Values.psp.create (not .Values.rbac.create) }} -postgresql: psp.create, rbac.create - RBAC should be enabled if PSP is enabled in order for PSP to work. - More info at https://kubernetes.io/docs/concepts/policy/pod-security-policy/#authorizing-policies -{{- end -}} -{{- end -}} - -{{/* -Validate values of Postgresql TLS - When TLS is enabled, so must be VolumePermissions -*/}} -{{- define "postgresql.validateValues.tls" -}} -{{- if and .Values.tls.enabled (not .Values.volumePermissions.enabled) }} -postgresql: tls.enabled, volumePermissions.enabled - When TLS is enabled you must enable volumePermissions as well to ensure certificates files have - the right permissions. -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert file. -*/}} -{{- define "postgresql.tlsCert" -}} -{{- if .Values.tls.autoGenerated }} - {{- printf "/opt/bitnami/postgresql/certs/tls.crt" -}} -{{- else -}} - {{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the cert key file. -*/}} -{{- define "postgresql.tlsCertKey" -}} -{{- if .Values.tls.autoGenerated }} - {{- printf "/opt/bitnami/postgresql/certs/tls.key" -}} -{{- else -}} -{{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the CA cert file. -*/}} -{{- define "postgresql.tlsCACert" -}} -{{- if .Values.tls.autoGenerated }} - {{- printf "/opt/bitnami/postgresql/certs/ca.crt" -}} -{{- else -}} - {{- printf "/opt/bitnami/postgresql/certs/%s" .Values.tls.certCAFilename -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the CRL file. -*/}} -{{- define "postgresql.tlsCRL" -}} -{{- if .Values.tls.crlFilename -}} -{{- printf "/opt/bitnami/postgresql/certs/%s" .Values.tls.crlFilename -}} -{{- end -}} -{{- end -}} - -{{/* -Return true if a TLS credentials secret object should be created -*/}} -{{- define "postgresql.createTlsSecret" -}} -{{- if and .Values.tls.autoGenerated (not .Values.tls.certificatesSecret) }} - {{- true -}} -{{- end -}} -{{- end -}} - -{{/* -Return the path to the CA cert file. -*/}} -{{- define "postgresql.tlsSecretName" -}} -{{- if .Values.tls.autoGenerated }} - {{- printf "%s-crt" (include "common.names.fullname" .) -}} -{{- else -}} - {{ required "A secret containing TLS certificates is required when TLS is enabled" .Values.tls.certificatesSecret }} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/postgresql/templates/configmap.yaml b/rds/base/charts/postgresql/templates/configmap.yaml deleted file mode 100644 index df8f763..0000000 --- a/rds/base/charts/postgresql/templates/configmap.yaml +++ /dev/null @@ -1,34 +0,0 @@ -{{ if and (or (.Files.Glob "files/postgresql.conf") (.Files.Glob "files/pg_hba.conf") .Values.postgresqlConfiguration .Values.pgHbaConfiguration) (not .Values.configurationConfigMap) }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "common.names.fullname" . }}-configuration - namespace: {{ .Release.Namespace }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: -{{- if (.Files.Glob "files/postgresql.conf") }} -{{ (.Files.Glob "files/postgresql.conf").AsConfig | indent 2 }} -{{- else if .Values.postgresqlConfiguration }} - postgresql.conf: | -{{- range $key, $value := default dict .Values.postgresqlConfiguration }} - {{- if kindIs "string" $value }} - {{ $key | snakecase }} = '{{ $value }}' - {{- else }} - {{ $key | snakecase }} = {{ $value }} - {{- end }} -{{- end }} -{{- end }} -{{- if (.Files.Glob "files/pg_hba.conf") }} -{{ (.Files.Glob "files/pg_hba.conf").AsConfig | indent 2 }} -{{- else if .Values.pgHbaConfiguration }} - pg_hba.conf: | -{{ .Values.pgHbaConfiguration | indent 4 }} -{{- end }} -{{ end }} diff --git a/rds/base/charts/postgresql/templates/extended-config-configmap.yaml b/rds/base/charts/postgresql/templates/extended-config-configmap.yaml deleted file mode 100644 index abbbf85..0000000 --- a/rds/base/charts/postgresql/templates/extended-config-configmap.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if and (or (.Files.Glob "files/conf.d/*.conf") .Values.postgresqlExtendedConf) (not .Values.extendedConfConfigMap)}} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "common.names.fullname" . }}-extended-configuration - namespace: {{ .Release.Namespace }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: -{{- with .Files.Glob "files/conf.d/*.conf" }} -{{ .AsConfig | indent 2 }} -{{- end }} -{{ with .Values.postgresqlExtendedConf }} - override.conf: | -{{- range $key, $value := . }} - {{- if kindIs "string" $value }} - {{ $key | snakecase }} = '{{ $value }}' - {{- else }} - {{ $key | snakecase }} = {{ $value }} - {{- end }} -{{- end }} -{{- end }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/extra-list.yaml b/rds/base/charts/postgresql/templates/extra-list.yaml deleted file mode 100644 index 9ac65f9..0000000 --- a/rds/base/charts/postgresql/templates/extra-list.yaml +++ /dev/null @@ -1,4 +0,0 @@ -{{- range .Values.extraDeploy }} ---- -{{ include "common.tplvalues.render" (dict "value" . "context" $) }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/initialization-configmap.yaml b/rds/base/charts/postgresql/templates/initialization-configmap.yaml deleted file mode 100644 index 3e546fe..0000000 --- a/rds/base/charts/postgresql/templates/initialization-configmap.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if and (or (.Files.Glob "files/docker-entrypoint-initdb.d/*.{sh,sql,sql.gz}") .Values.initdbScripts) (not .Values.initdbScriptsConfigMap) }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "common.names.fullname" . }}-init-scripts - namespace: {{ .Release.Namespace }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -{{- with .Files.Glob "files/docker-entrypoint-initdb.d/*.sql.gz" }} -binaryData: -{{- range $path, $bytes := . }} - {{ base $path }}: {{ $.Files.Get $path | b64enc | quote }} -{{- end }} -{{- end }} -data: -{{- with .Files.Glob "files/docker-entrypoint-initdb.d/*.{sh,sql}" }} -{{ .AsConfig | indent 2 }} -{{- end }} -{{- include "common.tplvalues.render" (dict "value" .Values.initdbScripts "context" .) | nindent 2 }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/metrics-configmap.yaml b/rds/base/charts/postgresql/templates/metrics-configmap.yaml deleted file mode 100644 index b711197..0000000 --- a/rds/base/charts/postgresql/templates/metrics-configmap.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "postgresql.metricsCM" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -data: - custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/metrics-svc.yaml b/rds/base/charts/postgresql/templates/metrics-svc.yaml deleted file mode 100644 index 203aab2..0000000 --- a/rds/base/charts/postgresql/templates/metrics-svc.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if .Values.metrics.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" . }}-metrics - namespace: {{ .Release.Namespace }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- toYaml .Values.metrics.service.annotations | nindent 4 }} -spec: - type: {{ .Values.metrics.service.type }} - {{- if and (eq .Values.metrics.service.type "LoadBalancer") .Values.metrics.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }} - {{- end }} - ports: - - name: http-metrics - port: 9187 - targetPort: http-metrics - selector: - {{- include "common.labels.matchLabels" . | nindent 4 }} - role: primary -{{- end }} diff --git a/rds/base/charts/postgresql/templates/networkpolicy.yaml b/rds/base/charts/postgresql/templates/networkpolicy.yaml deleted file mode 100644 index 400351e..0000000 --- a/rds/base/charts/postgresql/templates/networkpolicy.yaml +++ /dev/null @@ -1,42 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} -metadata: - name: {{ template "common.names.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: - podSelector: - matchLabels: - {{- include "common.labels.matchLabels" . | nindent 6 }} - ingress: - # Allow inbound connections - - ports: - - port: {{ template "postgresql.servicePort" . }} - {{- if not .Values.networkPolicy.allowExternal }} - from: - - podSelector: - matchLabels: - {{ template "common.names.fullname" . }}-client: "true" - {{- if .Values.networkPolicy.explicitNamespacesSelector }} - namespaceSelector: -{{ toYaml .Values.networkPolicy.explicitNamespacesSelector | indent 12 }} - {{- end }} - - podSelector: - matchLabels: - {{- include "common.labels.matchLabels" . | nindent 14 }} - role: read - {{- end }} - {{- if .Values.metrics.enabled }} - # Allow prometheus scrapes - - ports: - - port: 9187 - {{- end }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/podsecuritypolicy.yaml b/rds/base/charts/postgresql/templates/podsecuritypolicy.yaml deleted file mode 100644 index 0eefb3b..0000000 --- a/rds/base/charts/postgresql/templates/podsecuritypolicy.yaml +++ /dev/null @@ -1,42 +0,0 @@ -{{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} -{{- if and $pspAvailable .Values.psp.create }} -apiVersion: policy/v1beta1 -kind: PodSecurityPolicy -metadata: - name: {{ template "common.names.fullname" . }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -spec: - privileged: false - volumes: - - 'configMap' - - 'secret' - - 'persistentVolumeClaim' - - 'emptyDir' - - 'projected' - hostNetwork: false - hostIPC: false - hostPID: false - runAsUser: - rule: 'RunAsAny' - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'MustRunAs' - ranges: - - min: 1 - max: 65535 - fsGroup: - rule: 'MustRunAs' - ranges: - - min: 1 - max: 65535 - readOnlyRootFilesystem: false -{{- end }} diff --git a/rds/base/charts/postgresql/templates/prometheusrule.yaml b/rds/base/charts/postgresql/templates/prometheusrule.yaml deleted file mode 100644 index 1eff223..0000000 --- a/rds/base/charts/postgresql/templates/prometheusrule.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: {{ template "common.names.fullname" . }} -{{- if .Values.metrics.prometheusRule.namespace }} - namespace: {{ .Values.metrics.prometheusRule.namespace }} -{{- else }} - namespace: {{ .Release.Namespace }} -{{- end }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- with .Values.metrics.prometheusRule.additionalLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -spec: -{{- with .Values.metrics.prometheusRule.rules }} - groups: - - name: {{ template "postgresql.name" $ }} - rules: {{ tpl (toYaml .) $ | nindent 8 }} -{{- end }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/role.yaml b/rds/base/charts/postgresql/templates/role.yaml deleted file mode 100644 index 1366eda..0000000 --- a/rds/base/charts/postgresql/templates/role.yaml +++ /dev/null @@ -1,24 +0,0 @@ -{{- if .Values.rbac.create }} -kind: Role -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -metadata: - name: {{ template "common.names.fullname" . }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -rules: - {{- $pspAvailable := (semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .)) -}} - {{- if and $pspAvailable .Values.psp.create }} - - apiGroups: ["extensions"] - resources: ["podsecuritypolicies"] - verbs: ["use"] - resourceNames: - - {{ template "common.names.fullname" . }} - {{- end }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/rolebinding.yaml b/rds/base/charts/postgresql/templates/rolebinding.yaml deleted file mode 100644 index 988cb73..0000000 --- a/rds/base/charts/postgresql/templates/rolebinding.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if .Values.rbac.create }} -kind: RoleBinding -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -metadata: - name: {{ template "common.names.fullname" . }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: Role - name: {{ template "common.names.fullname" . }} - apiGroup: rbac.authorization.k8s.io -subjects: - - kind: ServiceAccount - name: {{ default (include "common.names.fullname" . ) .Values.serviceAccount.name }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/secrets.yaml b/rds/base/charts/postgresql/templates/secrets.yaml deleted file mode 100644 index d73bf2f..0000000 --- a/rds/base/charts/postgresql/templates/secrets.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if (include "postgresql.createSecret" .) }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "common.names.fullname" . }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -type: Opaque -data: - {{- if not (eq (include "postgresql.username" .) "postgres") }} - postgresql-postgres-password: {{ include "postgresql.postgres.password" . | b64enc | quote }} - {{- end }} - postgresql-password: {{ include "postgresql.password" . | b64enc | quote }} - {{- if .Values.replication.enabled }} - postgresql-replication-password: {{ include "postgresql.replication.password" . | b64enc | quote }} - {{- end }} - {{- if (and .Values.ldap.enabled .Values.ldap.bind_password)}} - postgresql-ldap-password: {{ .Values.ldap.bind_password | b64enc | quote }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/postgresql/templates/serviceaccount.yaml b/rds/base/charts/postgresql/templates/serviceaccount.yaml deleted file mode 100644 index 8e951b8..0000000 --- a/rds/base/charts/postgresql/templates/serviceaccount.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if and (.Values.serviceAccount.enabled) (not .Values.serviceAccount.name) }} -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - name: {{ template "common.names.fullname" . }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/servicemonitor.yaml b/rds/base/charts/postgresql/templates/servicemonitor.yaml deleted file mode 100644 index 60efc80..0000000 --- a/rds/base/charts/postgresql/templates/servicemonitor.yaml +++ /dev/null @@ -1,44 +0,0 @@ -{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "common.names.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- else }} - namespace: {{ .Release.Namespace }} - {{- end }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.additionalLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - -spec: - endpoints: - - port: http-metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelings }} - relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }} - {{- end }} - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} - selector: - matchLabels: - {{- include "common.labels.matchLabels" . | nindent 6 }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/statefulset-readreplicas.yaml b/rds/base/charts/postgresql/templates/statefulset-readreplicas.yaml deleted file mode 100644 index ad2a06a..0000000 --- a/rds/base/charts/postgresql/templates/statefulset-readreplicas.yaml +++ /dev/null @@ -1,430 +0,0 @@ -{{- if .Values.replication.enabled }} -{{- $readReplicasResources := coalesce .Values.readReplicas.resources .Values.resources -}} -apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: "{{ template "common.names.fullname" . }}-read" - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: read - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.readReplicas.labels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.labels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- with .Values.readReplicas.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -spec: - serviceName: {{ template "common.names.fullname" . }}-headless - replicas: {{ .Values.replication.readReplicas }} - selector: - matchLabels: - {{- include "common.labels.matchLabels" . | nindent 6 }} - role: read - template: - metadata: - name: {{ template "common.names.fullname" . }} - labels: - {{- include "common.labels.standard" . | nindent 8 }} - app.kubernetes.io/component: read - role: read - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.readReplicas.podLabels }} - {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.podLabels "context" $) | nindent 8 }} - {{- end }} -{{- with .Values.readReplicas.podAnnotations }} - annotations: -{{ toYaml . | indent 8 }} -{{- end }} - spec: - {{- if .Values.schedulerName }} - schedulerName: "{{ .Values.schedulerName }}" - {{- end }} -{{- include "postgresql.imagePullSecrets" . | indent 6 }} - {{- if .Values.readReplicas.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAffinityPreset "component" "read" "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAntiAffinityPreset "component" "read" "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.readReplicas.nodeAffinityPreset.type "key" .Values.readReplicas.nodeAffinityPreset.key "values" .Values.readReplicas.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.readReplicas.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.readReplicas.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.readReplicas.topologySpreadConstraints }} - topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.topologySpreadConstraints "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - automountServiceAccountToken: {{ .Values.serviceAccount.autoMount }} - {{- if .Values.serviceAccount.enabled }} - serviceAccountName: {{ default (include "common.names.fullname" . ) .Values.serviceAccount.name}} - {{- end }} - {{- if or .Values.readReplicas.extraInitContainers (and .Values.volumePermissions.enabled (or .Values.persistence.enabled (and .Values.shmVolume.enabled .Values.shmVolume.chmod.enabled))) }} - initContainers: - {{- if and .Values.volumePermissions.enabled (or .Values.persistence.enabled (and .Values.shmVolume.enabled .Values.shmVolume.chmod.enabled) .Values.tls.enabled) }} - - name: init-chmod-data - image: {{ template "postgresql.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - {{- if .Values.resources }} - resources: {{- toYaml .Values.resources | nindent 12 }} - {{- end }} - command: - - /bin/sh - - -cx - - | - {{- if .Values.persistence.enabled }} - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.persistence.mountPath }} - {{- else }} - chown {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} {{ .Values.persistence.mountPath }} - {{- end }} - mkdir -p {{ .Values.persistence.mountPath }}/data {{- if (include "postgresql.mountConfigurationCM" .) }} {{ .Values.persistence.mountPath }}/conf {{- end }} - chmod 700 {{ .Values.persistence.mountPath }}/data {{- if (include "postgresql.mountConfigurationCM" .) }} {{ .Values.persistence.mountPath }}/conf {{- end }} - find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \ - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - xargs chown -R `id -u`:`id -G | cut -d " " -f2` - {{- else }} - xargs chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} - {{- end }} - {{- end }} - {{- if and .Values.shmVolume.enabled .Values.shmVolume.chmod.enabled }} - chmod -R 777 /dev/shm - {{- end }} - {{- if .Values.tls.enabled }} - cp /tmp/certs/* /opt/bitnami/postgresql/certs/ - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ - {{- else }} - chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} /opt/bitnami/postgresql/certs/ - {{- end }} - chmod 600 {{ template "postgresql.tlsCertKey" . }} - {{- end }} - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} - {{- end }} - volumeMounts: - {{ if .Values.persistence.enabled }} - - name: data - mountPath: {{ .Values.persistence.mountPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - {{- if .Values.shmVolume.enabled }} - - name: dshm - mountPath: /dev/shm - {{- end }} - {{- if .Values.tls.enabled }} - - name: raw-certificates - mountPath: /tmp/certs - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - {{- end }} - {{- end }} - {{- if .Values.readReplicas.extraInitContainers }} - {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extraInitContainers "context" $ ) | nindent 8 }} - {{- end }} - {{- end }} - {{- if .Values.readReplicas.priorityClassName }} - priorityClassName: {{ .Values.readReplicas.priorityClassName }} - {{- end }} - containers: - - name: {{ template "common.names.fullname" . }} - image: {{ template "postgresql.image" . }} - imagePullPolicy: "{{ .Values.image.pullPolicy }}" - {{- if $readReplicasResources }} - resources: {{- toYaml $readReplicasResources | nindent 12 }} - {{- end }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - - name: POSTGRESQL_VOLUME_DIR - value: "{{ .Values.persistence.mountPath }}" - - name: POSTGRESQL_PORT_NUMBER - value: {{ .Values.containerPorts.postgresql | quote }} - {{- if .Values.persistence.mountPath }} - - name: PGDATA - value: {{ .Values.postgresqlDataDir | quote }} - {{- end }} - - name: POSTGRES_REPLICATION_MODE - value: "slave" - - name: POSTGRES_REPLICATION_USER - value: {{ include "postgresql.replication.username" . | quote }} - {{- if .Values.usePasswordFile }} - - name: POSTGRES_REPLICATION_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/postgresql-replication-password" - {{- else }} - - name: POSTGRES_REPLICATION_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql.secretName" . }} - key: postgresql-replication-password - {{- end }} - - name: POSTGRES_CLUSTER_APP_NAME - value: {{ .Values.replication.applicationName }} - - name: POSTGRES_MASTER_HOST - value: {{ template "common.names.fullname" . }} - - name: POSTGRES_MASTER_PORT_NUMBER - value: {{ include "postgresql.servicePort" . | quote }} - {{- if not (eq (include "postgresql.username" .) "postgres") }} - {{- if .Values.usePasswordFile }} - - name: POSTGRES_POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/postgresql-postgres-password" - {{- else }} - - name: POSTGRES_POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql.secretName" . }} - key: postgresql-postgres-password - {{- end }} - {{- end }} - {{- if .Values.usePasswordFile }} - - name: POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/postgresql-password" - {{- else }} - - name: POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql.secretName" . }} - key: postgresql-password - {{- end }} - - name: POSTGRESQL_ENABLE_TLS - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS - value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }} - - name: POSTGRESQL_TLS_CERT_FILE - value: {{ template "postgresql.tlsCert" . }} - - name: POSTGRESQL_TLS_KEY_FILE - value: {{ template "postgresql.tlsCertKey" . }} - {{- if .Values.tls.certCAFilename }} - - name: POSTGRESQL_TLS_CA_FILE - value: {{ template "postgresql.tlsCACert" . }} - {{- end }} - {{- if .Values.tls.crlFilename }} - - name: POSTGRESQL_TLS_CRL_FILE - value: {{ template "postgresql.tlsCRL" . }} - {{- end }} - {{- end }} - - name: POSTGRESQL_LOG_HOSTNAME - value: {{ .Values.audit.logHostname | quote }} - - name: POSTGRESQL_LOG_CONNECTIONS - value: {{ .Values.audit.logConnections | quote }} - - name: POSTGRESQL_LOG_DISCONNECTIONS - value: {{ .Values.audit.logDisconnections | quote }} - {{- if .Values.audit.logLinePrefix }} - - name: POSTGRESQL_LOG_LINE_PREFIX - value: {{ .Values.audit.logLinePrefix | quote }} - {{- end }} - {{- if .Values.audit.logTimezone }} - - name: POSTGRESQL_LOG_TIMEZONE - value: {{ .Values.audit.logTimezone | quote }} - {{- end }} - {{- if .Values.audit.pgAuditLog }} - - name: POSTGRESQL_PGAUDIT_LOG - value: {{ .Values.audit.pgAuditLog | quote }} - {{- end }} - - name: POSTGRESQL_PGAUDIT_LOG_CATALOG - value: {{ .Values.audit.pgAuditLogCatalog | quote }} - - name: POSTGRESQL_CLIENT_MIN_MESSAGES - value: {{ .Values.audit.clientMinMessages | quote }} - - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES - value: {{ .Values.postgresqlSharedPreloadLibraries | quote }} - {{- if .Values.postgresqlMaxConnections }} - - name: POSTGRESQL_MAX_CONNECTIONS - value: {{ .Values.postgresqlMaxConnections | quote }} - {{- end }} - {{- if .Values.postgresqlPostgresConnectionLimit }} - - name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT - value: {{ .Values.postgresqlPostgresConnectionLimit | quote }} - {{- end }} - {{- if .Values.postgresqlDbUserConnectionLimit }} - - name: POSTGRESQL_USERNAME_CONNECTION_LIMIT - value: {{ .Values.postgresqlDbUserConnectionLimit | quote }} - {{- end }} - {{- if .Values.postgresqlTcpKeepalivesInterval }} - - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL - value: {{ .Values.postgresqlTcpKeepalivesInterval | quote }} - {{- end }} - {{- if .Values.postgresqlTcpKeepalivesIdle }} - - name: POSTGRESQL_TCP_KEEPALIVES_IDLE - value: {{ .Values.postgresqlTcpKeepalivesIdle | quote }} - {{- end }} - {{- if .Values.postgresqlStatementTimeout }} - - name: POSTGRESQL_STATEMENT_TIMEOUT - value: {{ .Values.postgresqlStatementTimeout | quote }} - {{- end }} - {{- if .Values.postgresqlTcpKeepalivesCount }} - - name: POSTGRESQL_TCP_KEEPALIVES_COUNT - value: {{ .Values.postgresqlTcpKeepalivesCount | quote }} - {{- end }} - {{- if .Values.postgresqlPghbaRemoveFilters }} - - name: POSTGRESQL_PGHBA_REMOVE_FILTERS - value: {{ .Values.postgresqlPghbaRemoveFilters | quote }} - {{- end }} - ports: - - name: tcp-postgresql - containerPort: {{ .Values.containerPorts.postgresql }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.livenessProbe.enabled }} - livenessProbe: - exec: - command: - - /bin/sh - - -c - {{- if (include "postgresql.database" .) }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d "dbname={{ include "postgresql.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} - {{- else }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} - {{- end }} - initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.livenessProbe.failureThreshold }} - {{- else if .Values.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.readinessProbe.enabled }} - readinessProbe: - exec: - command: - - /bin/sh - - -c - - -e - {{- include "postgresql.readinessProbeCommand" . | nindent 16 }} - initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.readinessProbe.failureThreshold }} - {{- else if .Values.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- end }} - volumeMounts: - {{- if .Values.usePasswordFile }} - - name: postgresql-password - mountPath: /opt/bitnami/postgresql/secrets/ - {{- end }} - {{- if .Values.shmVolume.enabled }} - - name: dshm - mountPath: /dev/shm - {{- end }} - {{- if .Values.persistence.enabled }} - - name: data - mountPath: {{ .Values.persistence.mountPath }} - subPath: {{ .Values.persistence.subPath }} - {{ end }} - {{- if or (.Files.Glob "files/conf.d/*.conf") .Values.postgresqlExtendedConf .Values.extendedConfConfigMap }} - - name: postgresql-extended-config - mountPath: /bitnami/postgresql/conf/conf.d/ - {{- end }} - {{- if or (.Files.Glob "files/postgresql.conf") (.Files.Glob "files/pg_hba.conf") .Values.postgresqlConfiguration .Values.pgHbaConfiguration .Values.configurationConfigMap }} - - name: postgresql-config - mountPath: /bitnami/postgresql/conf - {{- end }} - {{- if .Values.tls.enabled }} - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - readOnly: true - {{- end }} - {{- if .Values.readReplicas.extraVolumeMounts }} - {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraVolumeMounts "context" $) | nindent 12 }} - {{- end }} -{{- if .Values.readReplicas.sidecars }} -{{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.sidecars "context" $ ) | nindent 8 }} -{{- end }} - volumes: - {{- if .Values.usePasswordFile }} - - name: postgresql-password - secret: - secretName: {{ template "postgresql.secretName" . }} - {{- end }} - {{- if or (.Files.Glob "files/postgresql.conf") (.Files.Glob "files/pg_hba.conf") .Values.postgresqlConfiguration .Values.pgHbaConfiguration .Values.configurationConfigMap}} - - name: postgresql-config - configMap: - name: {{ template "postgresql.configurationCM" . }} - {{- end }} - {{- if or (.Files.Glob "files/conf.d/*.conf") .Values.postgresqlExtendedConf .Values.extendedConfConfigMap }} - - name: postgresql-extended-config - configMap: - name: {{ template "postgresql.extendedConfigurationCM" . }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: raw-certificates - secret: - secretName: {{ template "postgresql.tlsSecretName" . }} - - name: postgresql-certificates - emptyDir: {} - {{- end }} - {{- if .Values.shmVolume.enabled }} - - name: dshm - emptyDir: - medium: Memory - sizeLimit: 1Gi - {{- end }} - {{- if or (not .Values.persistence.enabled) (not .Values.readReplicas.persistence.enabled) }} - - name: data - emptyDir: {} - {{- end }} - {{- if .Values.readReplicas.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.readReplicas.extraPodSpec }} - {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraPodSpec "context" $) | nindent 6 }} - {{- end }} - updateStrategy: - type: {{ .Values.updateStrategy.type }} - {{- if (eq "Recreate" .Values.updateStrategy.type) }} - rollingUpdate: null - {{- end }} -{{- if and .Values.persistence.enabled .Values.readReplicas.persistence.enabled }} - volumeClaimTemplates: - - metadata: - name: data - {{- with .Values.persistence.annotations }} - annotations: - {{- range $key, $value := . }} - {{ $key }}: {{ $value }} - {{- end }} - {{- end }} - spec: - accessModes: - {{- range .Values.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - {{ include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) }} - - {{- if .Values.persistence.selector }} - selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }} - {{- end -}} -{{- end }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/statefulset.yaml b/rds/base/charts/postgresql/templates/statefulset.yaml deleted file mode 100644 index 49afa54..0000000 --- a/rds/base/charts/postgresql/templates/statefulset.yaml +++ /dev/null @@ -1,636 +0,0 @@ -apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ template "postgresql.primary.fullname" . }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - app.kubernetes.io/component: primary - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.primary.labels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.primary.labels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- with .Values.primary.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -spec: - serviceName: {{ template "common.names.fullname" . }}-headless - replicas: 1 - updateStrategy: - type: {{ .Values.updateStrategy.type }} - {{- if (eq "Recreate" .Values.updateStrategy.type) }} - rollingUpdate: null - {{- end }} - selector: - matchLabels: - {{- include "common.labels.matchLabels" . | nindent 6 }} - role: primary - template: - metadata: - name: {{ template "common.names.fullname" . }} - labels: - {{- include "common.labels.standard" . | nindent 8 }} - role: primary - app.kubernetes.io/component: primary - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 8 }} - {{- end }} - {{- if .Values.primary.podLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.primary.podLabels "context" $ ) | nindent 8 }} - {{- end }} - {{- with .Values.primary.podAnnotations }} - annotations: {{- toYaml . | nindent 8 }} - {{- end }} - spec: - {{- if .Values.schedulerName }} - schedulerName: "{{ .Values.schedulerName }}" - {{- end }} -{{- include "postgresql.imagePullSecrets" . | indent 6 }} - {{- if .Values.primary.affinity }} - affinity: {{- include "common.tplvalues.render" (dict "value" .Values.primary.affinity "context" $) | nindent 8 }} - {{- else }} - affinity: - podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.primary.podAffinityPreset "component" "primary" "context" $) | nindent 10 }} - podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.primary.podAntiAffinityPreset "component" "primary" "context" $) | nindent 10 }} - nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.primary.nodeAffinityPreset.type "key" .Values.primary.nodeAffinityPreset.key "values" .Values.primary.nodeAffinityPreset.values) | nindent 10 }} - {{- end }} - {{- if .Values.primary.nodeSelector }} - nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.primary.nodeSelector "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.primary.tolerations }} - tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.primary.tolerations "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.terminationGracePeriodSeconds }} - terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} - {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - automountServiceAccountToken: {{ .Values.serviceAccount.autoMount }} - {{- if .Values.serviceAccount.enabled }} - serviceAccountName: {{ default (include "common.names.fullname" . ) .Values.serviceAccount.name }} - {{- end }} - {{- if or .Values.primary.extraInitContainers (and .Values.volumePermissions.enabled (or .Values.persistence.enabled (and .Values.shmVolume.enabled .Values.shmVolume.chmod.enabled))) }} - initContainers: - {{- if and .Values.volumePermissions.enabled (or .Values.persistence.enabled (and .Values.shmVolume.enabled .Values.shmVolume.chmod.enabled) .Values.tls.enabled) }} - - name: init-chmod-data - image: {{ template "postgresql.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - {{- if .Values.resources }} - resources: {{- toYaml .Values.resources | nindent 12 }} - {{- end }} - command: - - /bin/sh - - -cx - - | - {{- if .Values.persistence.enabled }} - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.persistence.mountPath }} - {{- else }} - chown {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} {{ .Values.persistence.mountPath }} - {{- end }} - mkdir -p {{ .Values.persistence.mountPath }}/data {{- if (include "postgresql.mountConfigurationCM" .) }} {{ .Values.persistence.mountPath }}/conf {{- end }} - chmod 700 {{ .Values.persistence.mountPath }}/data {{- if (include "postgresql.mountConfigurationCM" .) }} {{ .Values.persistence.mountPath }}/conf {{- end }} - find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \ - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - xargs chown -R `id -u`:`id -G | cut -d " " -f2` - {{- else }} - xargs chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} - {{- end }} - {{- end }} - {{- if and .Values.shmVolume.enabled .Values.shmVolume.chmod.enabled }} - chmod -R 777 /dev/shm - {{- end }} - {{- if .Values.tls.enabled }} - cp /tmp/certs/* /opt/bitnami/postgresql/certs/ - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ - {{- else }} - chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} /opt/bitnami/postgresql/certs/ - {{- end }} - chmod 600 {{ template "postgresql.tlsCertKey" . }} - {{- end }} - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} - {{- end }} - volumeMounts: - {{- if .Values.persistence.enabled }} - - name: data - mountPath: {{ .Values.persistence.mountPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - {{- if .Values.shmVolume.enabled }} - - name: dshm - mountPath: /dev/shm - {{- end }} - {{- if .Values.tls.enabled }} - - name: raw-certificates - mountPath: /tmp/certs - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - {{- end }} - {{- end }} - {{- if .Values.primary.extraInitContainers }} - {{- include "common.tplvalues.render" ( dict "value" .Values.primary.extraInitContainers "context" $ ) | nindent 8 }} - {{- end }} - {{- end }} - {{- if .Values.primary.priorityClassName }} - priorityClassName: {{ .Values.primary.priorityClassName }} - {{- end }} - containers: - - name: {{ template "common.names.fullname" . }} - image: {{ template "postgresql.image" . }} - imagePullPolicy: "{{ .Values.image.pullPolicy }}" - {{- if .Values.resources }} - resources: {{- toYaml .Values.resources | nindent 12 }} - {{- end }} - {{- if .Values.lifecycleHooks }} - lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- end }} - env: - - name: BITNAMI_DEBUG - value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} - - name: POSTGRESQL_PORT_NUMBER - value: {{ .Values.containerPorts.postgresql | quote }} - - name: POSTGRESQL_VOLUME_DIR - value: "{{ .Values.persistence.mountPath }}" - {{- if .Values.postgresqlInitdbArgs }} - - name: POSTGRES_INITDB_ARGS - value: {{ .Values.postgresqlInitdbArgs | quote }} - {{- end }} - {{- if .Values.postgresqlInitdbWalDir }} - - name: POSTGRES_INITDB_WALDIR - value: {{ .Values.postgresqlInitdbWalDir | quote }} - {{- end }} - {{- if .Values.initdbUser }} - - name: POSTGRESQL_INITSCRIPTS_USERNAME - value: {{ .Values.initdbUser }} - {{- end }} - {{- if .Values.initdbPassword }} - - name: POSTGRESQL_INITSCRIPTS_PASSWORD - value: {{ .Values.initdbPassword }} - {{- end }} - {{- if .Values.persistence.mountPath }} - - name: PGDATA - value: {{ .Values.postgresqlDataDir | quote }} - {{- end }} - {{- if .Values.primaryAsStandBy.enabled }} - - name: POSTGRES_MASTER_HOST - value: {{ .Values.primaryAsStandBy.primaryHost }} - - name: POSTGRES_MASTER_PORT_NUMBER - value: {{ .Values.primaryAsStandBy.primaryPort | quote }} - {{- end }} - {{- if or .Values.replication.enabled .Values.primaryAsStandBy.enabled }} - - name: POSTGRES_REPLICATION_MODE - {{- if .Values.primaryAsStandBy.enabled }} - value: "slave" - {{- else }} - value: "master" - {{- end }} - - name: POSTGRES_REPLICATION_USER - value: {{ include "postgresql.replication.username" . | quote }} - {{- if .Values.usePasswordFile }} - - name: POSTGRES_REPLICATION_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/postgresql-replication-password" - {{- else }} - - name: POSTGRES_REPLICATION_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql.secretName" . }} - key: postgresql-replication-password - {{- end }} - {{- if not (eq .Values.replication.synchronousCommit "off")}} - - name: POSTGRES_SYNCHRONOUS_COMMIT_MODE - value: {{ .Values.replication.synchronousCommit | quote }} - - name: POSTGRES_NUM_SYNCHRONOUS_REPLICAS - value: {{ .Values.replication.numSynchronousReplicas | quote }} - {{- end }} - - name: POSTGRES_CLUSTER_APP_NAME - value: {{ .Values.replication.applicationName }} - {{- end }} - {{- if not (eq (include "postgresql.username" .) "postgres") }} - {{- if .Values.usePasswordFile }} - - name: POSTGRES_POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/postgresql-postgres-password" - {{- else }} - - name: POSTGRES_POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql.secretName" . }} - key: postgresql-postgres-password - {{- end }} - {{- end }} - - name: POSTGRES_USER - value: {{ include "postgresql.username" . | quote }} - {{- if .Values.usePasswordFile }} - - name: POSTGRES_PASSWORD_FILE - value: "/opt/bitnami/postgresql/secrets/postgresql-password" - {{- else }} - - name: POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql.secretName" . }} - key: postgresql-password - {{- end }} - {{- if (include "postgresql.database" .) }} - - name: POSTGRES_DB - value: {{ (include "postgresql.database" .) | quote }} - {{- end }} - {{- if .Values.extraEnv }} - {{- include "common.tplvalues.render" (dict "value" .Values.extraEnv "context" $) | nindent 12 }} - {{- end }} - - name: POSTGRESQL_ENABLE_LDAP - value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }} - {{- if .Values.ldap.enabled }} - - name: POSTGRESQL_LDAP_SERVER - value: {{ .Values.ldap.server }} - - name: POSTGRESQL_LDAP_PORT - value: {{ .Values.ldap.port | quote }} - - name: POSTGRESQL_LDAP_SCHEME - value: {{ .Values.ldap.scheme }} - {{- if .Values.ldap.tls }} - - name: POSTGRESQL_LDAP_TLS - value: "1" - {{- end }} - - name: POSTGRESQL_LDAP_PREFIX - value: {{ .Values.ldap.prefix | quote }} - - name: POSTGRESQL_LDAP_SUFFIX - value: {{ .Values.ldap.suffix | quote }} - - name: POSTGRESQL_LDAP_BASE_DN - value: {{ .Values.ldap.baseDN }} - - name: POSTGRESQL_LDAP_BIND_DN - value: {{ .Values.ldap.bindDN }} - {{- if (not (empty .Values.ldap.bind_password)) }} - - name: POSTGRESQL_LDAP_BIND_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "postgresql.secretName" . }} - key: postgresql-ldap-password - {{- end}} - - name: POSTGRESQL_LDAP_SEARCH_ATTR - value: {{ .Values.ldap.search_attr }} - - name: POSTGRESQL_LDAP_SEARCH_FILTER - value: {{ .Values.ldap.search_filter }} - - name: POSTGRESQL_LDAP_URL - value: {{ .Values.ldap.url }} - {{- end}} - - name: POSTGRESQL_ENABLE_TLS - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS - value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }} - - name: POSTGRESQL_TLS_CERT_FILE - value: {{ template "postgresql.tlsCert" . }} - - name: POSTGRESQL_TLS_KEY_FILE - value: {{ template "postgresql.tlsCertKey" . }} - {{- if .Values.tls.certCAFilename }} - - name: POSTGRESQL_TLS_CA_FILE - value: {{ template "postgresql.tlsCACert" . }} - {{- end }} - {{- if .Values.tls.crlFilename }} - - name: POSTGRESQL_TLS_CRL_FILE - value: {{ template "postgresql.tlsCRL" . }} - {{- end }} - {{- end }} - - name: POSTGRESQL_LOG_HOSTNAME - value: {{ .Values.audit.logHostname | quote }} - - name: POSTGRESQL_LOG_CONNECTIONS - value: {{ .Values.audit.logConnections | quote }} - - name: POSTGRESQL_LOG_DISCONNECTIONS - value: {{ .Values.audit.logDisconnections | quote }} - {{- if .Values.audit.logLinePrefix }} - - name: POSTGRESQL_LOG_LINE_PREFIX - value: {{ .Values.audit.logLinePrefix | quote }} - {{- end }} - {{- if .Values.audit.logTimezone }} - - name: POSTGRESQL_LOG_TIMEZONE - value: {{ .Values.audit.logTimezone | quote }} - {{- end }} - {{- if .Values.audit.pgAuditLog }} - - name: POSTGRESQL_PGAUDIT_LOG - value: {{ .Values.audit.pgAuditLog | quote }} - {{- end }} - - name: POSTGRESQL_PGAUDIT_LOG_CATALOG - value: {{ .Values.audit.pgAuditLogCatalog | quote }} - - name: POSTGRESQL_CLIENT_MIN_MESSAGES - value: {{ .Values.audit.clientMinMessages | quote }} - - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES - value: {{ .Values.postgresqlSharedPreloadLibraries | quote }} - {{- if .Values.postgresqlMaxConnections }} - - name: POSTGRESQL_MAX_CONNECTIONS - value: {{ .Values.postgresqlMaxConnections | quote }} - {{- end }} - {{- if .Values.postgresqlPostgresConnectionLimit }} - - name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT - value: {{ .Values.postgresqlPostgresConnectionLimit | quote }} - {{- end }} - {{- if .Values.postgresqlDbUserConnectionLimit }} - - name: POSTGRESQL_USERNAME_CONNECTION_LIMIT - value: {{ .Values.postgresqlDbUserConnectionLimit | quote }} - {{- end }} - {{- if .Values.postgresqlTcpKeepalivesInterval }} - - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL - value: {{ .Values.postgresqlTcpKeepalivesInterval | quote }} - {{- end }} - {{- if .Values.postgresqlTcpKeepalivesIdle }} - - name: POSTGRESQL_TCP_KEEPALIVES_IDLE - value: {{ .Values.postgresqlTcpKeepalivesIdle | quote }} - {{- end }} - {{- if .Values.postgresqlStatementTimeout }} - - name: POSTGRESQL_STATEMENT_TIMEOUT - value: {{ .Values.postgresqlStatementTimeout | quote }} - {{- end }} - {{- if .Values.postgresqlTcpKeepalivesCount }} - - name: POSTGRESQL_TCP_KEEPALIVES_COUNT - value: {{ .Values.postgresqlTcpKeepalivesCount | quote }} - {{- end }} - {{- if .Values.postgresqlPghbaRemoveFilters }} - - name: POSTGRESQL_PGHBA_REMOVE_FILTERS - value: {{ .Values.postgresqlPghbaRemoveFilters | quote }} - {{- end }} - {{- if .Values.extraEnvVarsCM }} - envFrom: - - configMapRef: - name: {{ tpl .Values.extraEnvVarsCM . }} - {{- end }} - ports: - - name: tcp-postgresql - containerPort: {{ .Values.containerPorts.postgresql }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.startupProbe.enabled }} - startupProbe: - exec: - command: - - /bin/sh - - -c - {{- if (include "postgresql.database" .) }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d "dbname={{ include "postgresql.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} - {{- else }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} - {{- end }} - initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.startupProbe.periodSeconds }} - timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }} - successThreshold: {{ .Values.startupProbe.successThreshold }} - failureThreshold: {{ .Values.startupProbe.failureThreshold }} - {{- else if .Values.customStartupProbe }} - startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.livenessProbe.enabled }} - livenessProbe: - exec: - command: - - /bin/sh - - -c - {{- if (include "postgresql.database" .) }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d "dbname={{ include "postgresql.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} - {{- else }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.tlsCert" . }} sslkey={{ include "postgresql.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} - {{- end }} - initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.livenessProbe.failureThreshold }} - {{- else if .Values.customLivenessProbe }} - livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }} - {{- end }} - {{- if .Values.readinessProbe.enabled }} - readinessProbe: - exec: - command: - - /bin/sh - - -c - - -e - {{- include "postgresql.readinessProbeCommand" . | nindent 16 }} - initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.readinessProbe.failureThreshold }} - {{- else if .Values.customReadinessProbe }} - readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }} - {{- end }} - {{- end }} - volumeMounts: - {{- if or (.Files.Glob "files/docker-entrypoint-initdb.d/*.{sh,sql,sql.gz}") .Values.initdbScriptsConfigMap .Values.initdbScripts }} - - name: custom-init-scripts - mountPath: /docker-entrypoint-initdb.d/ - {{- end }} - {{- if .Values.initdbScriptsSecret }} - - name: custom-init-scripts-secret - mountPath: /docker-entrypoint-initdb.d/secret - {{- end }} - {{- if or (.Files.Glob "files/conf.d/*.conf") .Values.postgresqlExtendedConf .Values.extendedConfConfigMap }} - - name: postgresql-extended-config - mountPath: /bitnami/postgresql/conf/conf.d/ - {{- end }} - {{- if .Values.usePasswordFile }} - - name: postgresql-password - mountPath: /opt/bitnami/postgresql/secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - readOnly: true - {{- end }} - {{- if .Values.shmVolume.enabled }} - - name: dshm - mountPath: /dev/shm - {{- end }} - {{- if .Values.persistence.enabled }} - - name: data - mountPath: {{ .Values.persistence.mountPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - {{- if or (.Files.Glob "files/postgresql.conf") (.Files.Glob "files/pg_hba.conf") .Values.postgresqlConfiguration .Values.pgHbaConfiguration .Values.configurationConfigMap }} - - name: postgresql-config - mountPath: /bitnami/postgresql/conf - {{- end }} - {{- if .Values.primary.extraVolumeMounts }} - {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraVolumeMounts "context" $) | nindent 12 }} - {{- end }} -{{- if .Values.primary.sidecars }} -{{- include "common.tplvalues.render" ( dict "value" .Values.primary.sidecars "context" $ ) | nindent 8 }} -{{- end }} -{{- if .Values.metrics.enabled }} - - name: metrics - image: {{ template "postgresql.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.metrics.securityContext.enabled }} - securityContext: {{- omit .Values.metrics.securityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - {{- if .Values.diagnosticMode.enabled }} - command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} - args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} - {{- end }} - env: - {{- $database := required "In order to enable metrics you need to specify a database (.Values.postgresqlDatabase or .Values.global.postgresql.postgresqlDatabase)" (include "postgresql.database" .) }} - {{- $sslmode := ternary "require" "disable" .Values.tls.enabled }} - {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} - - name: DATA_SOURCE_NAME - value: {{ printf "host=127.0.0.1 port=%d user=%s sslmode=%s sslcert=%s sslkey=%s" (int (include "postgresql.servicePort" .)) (include "postgresql.username" .) $sslmode (include "postgresql.tlsCert" .) (include "postgresql.tlsCertKey" .) }} - {{- else }} - - name: DATA_SOURCE_URI - value: {{ printf "127.0.0.1:%d/%s?sslmode=%s" (int (include "postgresql.servicePort" .)) $database $sslmode }} - {{- end }} - {{- if .Values.usePasswordFile }} - - name: DATA_SOURCE_PASS_FILE - value: "/opt/bitnami/postgresql/secrets/postgresql-password" - {{- else }} - - name: DATA_SOURCE_PASS - valueFrom: - secretKeyRef: - name: {{ template "postgresql.secretName" . }} - key: postgresql-password - {{- end }} - - name: DATA_SOURCE_USER - value: {{ template "postgresql.username" . }} - {{- if .Values.metrics.extraEnvVars }} - {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if not .Values.diagnosticMode.enabled }} - {{- if .Values.livenessProbe.enabled }} - livenessProbe: - httpGet: - path: / - port: http-metrics - initialDelaySeconds: {{ .Values.metrics.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.metrics.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.metrics.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.metrics.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.metrics.livenessProbe.failureThreshold }} - {{- end }} - {{- if .Values.readinessProbe.enabled }} - readinessProbe: - httpGet: - path: / - port: http-metrics - initialDelaySeconds: {{ .Values.metrics.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.metrics.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.metrics.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.metrics.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.metrics.readinessProbe.failureThreshold }} - {{- end }} - {{- end }} - volumeMounts: - {{- if .Values.usePasswordFile }} - - name: postgresql-password - mountPath: /opt/bitnami/postgresql/secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: postgresql-certificates - mountPath: /opt/bitnami/postgresql/certs - readOnly: true - {{- end }} - {{- if .Values.metrics.customMetrics }} - - name: custom-metrics - mountPath: /conf - readOnly: true - args: ["--extend.query-path", "/conf/custom-metrics.yaml"] - {{- end }} - ports: - - name: http-metrics - containerPort: 9187 - {{- if .Values.metrics.resources }} - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- end }} -{{- end }} - volumes: - {{- if or (.Files.Glob "files/postgresql.conf") (.Files.Glob "files/pg_hba.conf") .Values.postgresqlConfiguration .Values.pgHbaConfiguration .Values.configurationConfigMap}} - - name: postgresql-config - configMap: - name: {{ template "postgresql.configurationCM" . }} - {{- end }} - {{- if or (.Files.Glob "files/conf.d/*.conf") .Values.postgresqlExtendedConf .Values.extendedConfConfigMap }} - - name: postgresql-extended-config - configMap: - name: {{ template "postgresql.extendedConfigurationCM" . }} - {{- end }} - {{- if .Values.usePasswordFile }} - - name: postgresql-password - secret: - secretName: {{ template "postgresql.secretName" . }} - {{- end }} - {{- if or (.Files.Glob "files/docker-entrypoint-initdb.d/*.{sh,sql,sql.gz}") .Values.initdbScriptsConfigMap .Values.initdbScripts }} - - name: custom-init-scripts - configMap: - name: {{ template "postgresql.initdbScriptsCM" . }} - {{- end }} - {{- if .Values.initdbScriptsSecret }} - - name: custom-init-scripts-secret - secret: - secretName: {{ template "postgresql.initdbScriptsSecret" . }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: raw-certificates - secret: - secretName: {{ template "postgresql.tlsSecretName" . }} - - name: postgresql-certificates - emptyDir: {} - {{- end }} - {{- if .Values.primary.extraVolumes }} - {{- include "common.tplvalues.render" ( dict "value" .Values.primary.extraVolumes "context" $ ) | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} - - name: custom-metrics - configMap: - name: {{ template "postgresql.metricsCM" . }} - {{- end }} - {{- if .Values.shmVolume.enabled }} - - name: dshm - emptyDir: - medium: Memory -{{- with .Values.shmVolume.sizeLimit }} - sizeLimit: {{ . }} -{{- end }} - {{- end }} -{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }} - - name: data - persistentVolumeClaim: -{{- with .Values.persistence.existingClaim }} - claimName: {{ tpl . $ }} -{{- end }} -{{- else if not .Values.persistence.enabled }} - - name: data - emptyDir: {} - {{- if .Values.primary.extraPodSpec }} - {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraPodSpec "context" $) | nindent 6 }} - {{- end }} -{{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} - volumeClaimTemplates: - - metadata: - name: data - {{- with .Values.persistence.annotations }} - annotations: - {{- range $key, $value := . }} - {{ $key }}: {{ $value }} - {{- end }} - {{- end }} - spec: - accessModes: - {{- range .Values.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - {{ include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) }} - {{- if .Values.persistence.selector }} - selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }} - {{- end -}} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/svc-headless.yaml b/rds/base/charts/postgresql/templates/svc-headless.yaml deleted file mode 100644 index fbbfd40..0000000 --- a/rds/base/charts/postgresql/templates/svc-headless.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" . }}-headless - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - # Use this annotation in addition to the actual publishNotReadyAddresses - # field below because the annotation will stop being respected soon but the - # field is broken in some versions of Kubernetes: - # https://github.com/kubernetes/kubernetes/issues/58662 - service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" - namespace: {{ .Release.Namespace }} -spec: - type: ClusterIP - clusterIP: None - # We want all pods in the StatefulSet to have their addresses published for - # the sake of the other Postgresql pods even before they're ready, since they - # have to be able to talk to each other in order to become ready. - publishNotReadyAddresses: true - ports: - - name: tcp-postgresql - port: {{ template "postgresql.servicePort" . }} - targetPort: tcp-postgresql - selector: - {{- include "common.labels.matchLabels" . | nindent 4 }} diff --git a/rds/base/charts/postgresql/templates/svc-read-set.yaml b/rds/base/charts/postgresql/templates/svc-read-set.yaml deleted file mode 100644 index 1808bd1..0000000 --- a/rds/base/charts/postgresql/templates/svc-read-set.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if and .Values.replication.enabled .Values.replication.uniqueServices }} -{{- $serviceAnnotations := coalesce .Values.readReplicas.service.annotations .Values.service.annotations -}} - -{{- $fullName := include "common.names.fullname" . }} -{{- $replicaCount := .Values.replication.readReplicas | int }} -{{- $root := . }} - -{{- range $i, $e := until $replicaCount }} -{{- $targetPod := printf "%s-read-%d" (printf "%s" $fullName) $i }} ---- -apiVersion: v1 -kind: Service -metadata: - name: {{ $fullName }}-read-{{ $i }} - namespace: {{ .Release.Namespace }} - labels: - pod: {{ $targetPod }} - {{- include "common.labels.standard" $root | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - - {{- if $root.Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" $root.Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if $serviceAnnotations }} - {{- include "common.tplvalues.render" (dict "value" $serviceAnnotations "context" $) | nindent 4 }} - {{- end }} - namespace: {{ $root.Release.Namespace }} -spec: - type: ClusterIP - ports: - - name: tcp-postgresql - port: {{ template "postgresql.servicePort" $root }} - targetPort: tcp-postgresql - selector: - {{- include "common.labels.matchLabels" $root | nindent 4 }} - role: read - statefulset.kubernetes.io/pod-name: {{ $targetPod }} - -{{- end }} -{{- end }} diff --git a/rds/base/charts/postgresql/templates/svc-read.yaml b/rds/base/charts/postgresql/templates/svc-read.yaml deleted file mode 100644 index ed1005f..0000000 --- a/rds/base/charts/postgresql/templates/svc-read.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{- if and .Values.replication.enabled .Values.replication.singleService }} -{{- $serviceAnnotations := coalesce .Values.readReplicas.service.annotations .Values.service.annotations -}} -{{- $serviceType := coalesce .Values.readReplicas.service.type .Values.service.type -}} -{{- $serviceLoadBalancerIP := coalesce .Values.readReplicas.service.loadBalancerIP .Values.service.loadBalancerIP -}} -{{- $serviceLoadBalancerSourceRanges := coalesce .Values.readReplicas.service.loadBalancerSourceRanges .Values.service.loadBalancerSourceRanges -}} -{{- $serviceClusterIP := coalesce .Values.readReplicas.service.clusterIP .Values.service.clusterIP -}} -{{- $serviceNodePort := coalesce .Values.readReplicas.service.nodePort .Values.service.nodePort -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" . }}-read - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if $serviceAnnotations }} - {{- include "common.tplvalues.render" (dict "value" $serviceAnnotations "context" $) | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -spec: - type: {{ $serviceType }} - {{- if and $serviceLoadBalancerIP (eq $serviceType "LoadBalancer") }} - loadBalancerIP: {{ $serviceLoadBalancerIP }} - externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if and (eq $serviceType "LoadBalancer") $serviceLoadBalancerSourceRanges }} - loadBalancerSourceRanges: {{- include "common.tplvalues.render" (dict "value" $serviceLoadBalancerSourceRanges "context" $) | nindent 4 }} - {{- end }} - {{- if and (eq $serviceType "ClusterIP") $serviceClusterIP }} - clusterIP: {{ $serviceClusterIP }} - {{- end }} - ports: - - name: tcp-postgresql - port: {{ template "postgresql.servicePort" . }} - targetPort: tcp-postgresql - {{- if $serviceNodePort }} - nodePort: {{ $serviceNodePort }} - {{- end }} - selector: - {{- include "common.labels.matchLabels" . | nindent 4 }} - role: read -{{- end }} diff --git a/rds/base/charts/postgresql/templates/svc.yaml b/rds/base/charts/postgresql/templates/svc.yaml deleted file mode 100644 index a47efb9..0000000 --- a/rds/base/charts/postgresql/templates/svc.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- $serviceAnnotations := coalesce .Values.primary.service.annotations .Values.service.annotations -}} -{{- $serviceType := coalesce .Values.primary.service.type .Values.service.type -}} -{{- $serviceLoadBalancerIP := coalesce .Values.primary.service.loadBalancerIP .Values.service.loadBalancerIP -}} -{{- $serviceLoadBalancerSourceRanges := coalesce .Values.primary.service.loadBalancerSourceRanges .Values.service.loadBalancerSourceRanges -}} -{{- $serviceClusterIP := coalesce .Values.primary.service.clusterIP .Values.service.clusterIP -}} -{{- $serviceNodePort := coalesce .Values.primary.service.nodePort .Values.service.nodePort -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "common.names.fullname" . }} - labels: - {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.commonAnnotations }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} - {{- if $serviceAnnotations }} - {{- include "common.tplvalues.render" (dict "value" $serviceAnnotations "context" $) | nindent 4 }} - {{- end }} - namespace: {{ .Release.Namespace }} -spec: - type: {{ $serviceType }} - {{- if and $serviceLoadBalancerIP (eq $serviceType "LoadBalancer") }} - loadBalancerIP: {{ $serviceLoadBalancerIP }} - externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }} - {{- end }} - {{- if and (eq $serviceType "LoadBalancer") $serviceLoadBalancerSourceRanges }} - loadBalancerSourceRanges: {{- include "common.tplvalues.render" (dict "value" $serviceLoadBalancerSourceRanges "context" $) | nindent 4 }} - {{- end }} - {{- if and (eq $serviceType "ClusterIP") $serviceClusterIP }} - clusterIP: {{ $serviceClusterIP }} - {{- end }} - ports: - - name: tcp-postgresql - port: {{ template "postgresql.servicePort" . }} - targetPort: tcp-postgresql - {{- if $serviceNodePort }} - nodePort: {{ $serviceNodePort }} - {{- end }} - selector: - {{- include "common.labels.matchLabels" . | nindent 4 }} - role: primary diff --git a/rds/base/charts/postgresql/templates/tls-secrets.yaml b/rds/base/charts/postgresql/templates/tls-secrets.yaml deleted file mode 100644 index c1e9ef2..0000000 --- a/rds/base/charts/postgresql/templates/tls-secrets.yaml +++ /dev/null @@ -1,26 +0,0 @@ -{{- if (include "postgresql.createTlsSecret" . )}} -{{- $ca := genCA "postgresql-ca" 365 }} -{{- $fullname := include "common.names.fullname" . }} -{{- $releaseNamespace := .Release.Namespace }} -{{- $clusterDomain := .Values.clusterDomain }} -{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) }} -{{- $altNames := list (printf "*.%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) $fullname }} -{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ printf "%s-crt" (include "common.names.fullname" .) }} - namespace: {{ .Release.Namespace }} - labels: {{- include "common.labels.standard" . | nindent 4 }} - {{- if .Values.commonLabels }} - {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} - {{- end }} - {{- if .Values.commonAnnotations }} - annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} - {{- end }} -type: kubernetes.io/tls -data: - ca.crt: {{ $ca.Cert | b64enc | quote }} - tls.crt: {{ $crt.Cert | b64enc | quote }} - tls.key: {{ $crt.Key | b64enc | quote }} -{{- end }} diff --git a/rds/base/charts/postgresql/values.schema.json b/rds/base/charts/postgresql/values.schema.json deleted file mode 100644 index 66a2a9d..0000000 --- a/rds/base/charts/postgresql/values.schema.json +++ /dev/null @@ -1,103 +0,0 @@ -{ - "$schema": "http://json-schema.org/schema#", - "type": "object", - "properties": { - "postgresqlUsername": { - "type": "string", - "title": "Admin user", - "form": true - }, - "postgresqlPassword": { - "type": "string", - "title": "Password", - "form": true - }, - "persistence": { - "type": "object", - "properties": { - "size": { - "type": "string", - "title": "Persistent Volume Size", - "form": true, - "render": "slider", - "sliderMin": 1, - "sliderMax": 100, - "sliderUnit": "Gi" - } - } - }, - "resources": { - "type": "object", - "title": "Required Resources", - "description": "Configure resource requests", - "form": true, - "properties": { - "requests": { - "type": "object", - "properties": { - "memory": { - "type": "string", - "form": true, - "render": "slider", - "title": "Memory Request", - "sliderMin": 10, - "sliderMax": 2048, - "sliderUnit": "Mi" - }, - "cpu": { - "type": "string", - "form": true, - "render": "slider", - "title": "CPU Request", - "sliderMin": 10, - "sliderMax": 2000, - "sliderUnit": "m" - } - } - } - } - }, - "replication": { - "type": "object", - "form": true, - "title": "Replication Details", - "properties": { - "enabled": { - "type": "boolean", - "title": "Enable Replication", - "form": true - }, - "readReplicas": { - "type": "integer", - "title": "read Replicas", - "form": true, - "hidden": { - "value": false, - "path": "replication/enabled" - } - } - } - }, - "volumePermissions": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "form": true, - "title": "Enable Init Containers", - "description": "Change the owner of the persist volume mountpoint to RunAsUser:fsGroup" - } - } - }, - "metrics": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "title": "Configure metrics exporter", - "form": true - } - } - } - } -} diff --git a/rds/base/charts/postgresql/values.yaml b/rds/base/charts/postgresql/values.yaml deleted file mode 100644 index b6f6d5e..0000000 --- a/rds/base/charts/postgresql/values.yaml +++ /dev/null @@ -1,996 +0,0 @@ -## @section Global parameters -## Global Docker image parameters -## Please, note that this will override the image parameters, including dependencies, configured to use the global value -## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass -## - -## @param global.imageRegistry Global Docker image registry -## @param global.imagePullSecrets Global Docker registry secret names as an array -## @param global.storageClass Global StorageClass for Persistent Volume(s) -## -global: - imageRegistry: "" - ## E.g. - ## imagePullSecrets: - ## - myRegistryKeySecretName - ## - imagePullSecrets: [] - storageClass: "" - ## @param global.postgresql.postgresqlDatabase PostgreSQL database (overrides `postgresqlDatabase`) - ## @param global.postgresql.postgresqlUsername PostgreSQL username (overrides `postgresqlUsername`) - ## @param global.postgresql.existingSecret Name of existing secret to use for PostgreSQL passwords (overrides `existingSecret`) - ## @param global.postgresql.postgresqlPassword PostgreSQL admin password (overrides `postgresqlPassword`) - ## @param global.postgresql.servicePort PostgreSQL port (overrides `service.port` - ## @param global.postgresql.replicationPassword Replication user password (overrides `replication.password`) - ## - postgresql: - postgresqlDatabase: "" - postgresqlUsername: "" - existingSecret: "" - postgresqlPassword: "" - servicePort: "" - replicationPassword: "" - -## @section Common parameters -## - -## @param nameOverride String to partially override common.names.fullname template (will maintain the release name) -## -nameOverride: "" -## @param fullnameOverride String to fully override common.names.fullname template -## -fullnameOverride: "" -## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template) -## -extraDeploy: [] -## @param commonLabels Add labels to all the deployed resources -## -commonLabels: {} -## @param commonAnnotations Add annotations to all the deployed resources -## -commonAnnotations: {} - -## Enable diagnostic mode in the deployment -## -diagnosticMode: - ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) - ## - enabled: false - ## @param diagnosticMode.command Command to override all containers in the deployment - ## - command: - - sleep - ## @param diagnosticMode.args Args to override all containers in the deployment - ## - args: - - infinity - -## @section PostgreSQL parameters -## - -## Bitnami PostgreSQL image version -## ref: https://hub.docker.com/r/bitnami/postgresql/tags/ -## @param image.registry PostgreSQL image registry -## @param image.repository PostgreSQL image repository -## @param image.tag PostgreSQL image tag (immutable tags are recommended) -## @param image.pullPolicy PostgreSQL image pull policy -## @param image.pullSecrets Specify image pull secrets -## @param image.debug Specify if debug values should be set -## -image: - registry: docker.io - repository: bitnami/postgresql - tag: 11.14.0-debian-10-r21 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Set to true if you would like to see extra information on logs - ## It turns BASH and/or NAMI debugging in the image - ## - debug: false -## Init containers parameters: -## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup -## -volumePermissions: - ## @param volumePermissions.enabled Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) - ## - enabled: false - ## @param volumePermissions.image.registry Init container volume-permissions image registry - ## @param volumePermissions.image.repository Init container volume-permissions image repository - ## @param volumePermissions.image.tag Init container volume-permissions image tag (immutable tags are recommended) - ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy - ## @param volumePermissions.image.pullSecrets Init container volume-permissions image pull secrets - ## - image: - registry: docker.io - repository: bitnami/bitnami-shell - tag: 10-debian-10-r299 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## Init container Security Context - ## @param volumePermissions.securityContext.runAsUser User ID for the init container - ## Note: the chown of the data folder is done to securityContext.runAsUser - ## and not the below volumePermissions.securityContext.runAsUser - ## When runAsUser is set to special value "auto", init container will try to chwon the - ## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` - ## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed). - ## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with - ## pod securityContext.enabled=false and shmVolume.chmod.enabled=false - ## - securityContext: - runAsUser: 0 -## @param schedulerName Use an alternate scheduler, e.g. "stork". -## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ -## -schedulerName: "" -## @param lifecycleHooks for the PostgreSQL container to automate configuration before or after startup -## -lifecycleHooks: {} -## Pod Security Context -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ -## @param securityContext.enabled Enable security context -## @param securityContext.fsGroup Group ID for the pod -## -securityContext: - enabled: true - fsGroup: 1001 -## Container Security Context -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ -## @param containerSecurityContext.enabled Enable container security context -## @param containerSecurityContext.runAsUser User ID for the container -## -containerSecurityContext: - enabled: true - runAsUser: 1001 -## Pod Service Account -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ -## -serviceAccount: - ## @param serviceAccount.enabled Enable service account (Note: Service Account will only be automatically created if `serviceAccount.name` is not set) - ## - enabled: false - ## @param serviceAccount.name Name of an already existing service account. Setting this value disables the automatic service account creation - ## - name: "" - ## @param serviceAccount.autoMount Auto-mount the service account token in the pod - ## - autoMount: false -## Pod Security Policy -## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ -## @param psp.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later -## -psp: - create: false -## Creates role for ServiceAccount -## Required for PSP -## @param rbac.create Create Role and RoleBinding (required for PSP to work) -## -rbac: - create: false -## @param replication.enabled Enable replication -## @param replication.user Replication user -## @param replication.password Replication user password -## @param replication.readReplicas Number of read replicas replicas -## @param replication.synchronousCommit Set synchronous commit mode. Allowed values: `on`, `remote_apply`, `remote_write`, `local` and `off` -## @param replication.numSynchronousReplicas Number of replicas that will have synchronous replication. Note: Cannot be greater than `replication.readReplicas`. -## @param replication.applicationName Cluster application name. Useful for advanced replication settings -## @param replication.singleService Create one service connecting to all read-replicas -## @param replication.uniqueServices Create a unique service for each independent read-replica -## -replication: - enabled: false - user: repl_user - password: repl_password - readReplicas: 1 - ## ref: https://www.postgresql.org/docs/9.6/runtime-config-wal.html#GUC-WAL-LEVEL - ## - synchronousCommit: "off" - ## NOTE: It cannot be > readReplicas - ## - numSynchronousReplicas: 0 - applicationName: my_application - singleService: true - uniqueServices: false -## @param postgresqlPostgresPassword PostgreSQL admin password (used when `postgresqlUsername` is not `postgres`, in which case`postgres` is the admin username) -## ref: https://github.com/bitnami/bitnami-docker-postgresql/blob/master/README.md#creating-a-database-user-on-first-run (see note!) -## -postgresqlPostgresPassword: "" -## @param postgresqlUsername PostgreSQL user (has superuser privileges if username is `postgres`) -## ref: https://github.com/bitnami/bitnami-docker-postgresql/blob/master/README.md#setting-the-root-password-on-first-run -## -postgresqlUsername: postgres -## @param postgresqlPassword PostgreSQL user password -## ref: https://github.com/bitnami/bitnami-docker-postgresql/blob/master/README.md#setting-the-root-password-on-first-run -## -postgresqlPassword: "" -## @param existingSecret Name of existing secret to use for PostgreSQL passwords -## The secret has to contain the keys postgresql-password which is the password for postgresqlUsername when it is -## different of postgres, postgresql-postgres-password which will override postgresqlPassword, -## postgresql-replication-password which will override replication.password and postgresql-ldap-password which will be -## used to authenticate on LDAP. The value is evaluated as a template. -## e.g: -## existingSecret: secret -## -existingSecret: "" -## @param usePasswordFile Mount PostgreSQL secret as a file instead of passing environment variable -## -usePasswordFile: false -## @param postgresqlDatabase PostgreSQL database -## ref: https://github.com/bitnami/bitnami-docker-postgresql/blob/master/README.md#creating-a-database-on-first-run -## -postgresqlDatabase: "" -## @param postgresqlDataDir PostgreSQL data dir folder -## ref: https://github.com/bitnami/bitnami-docker-postgresql/blob/master/README.md -## -postgresqlDataDir: /bitnami/postgresql/data -## @param extraEnv An array to add extra environment variables -## For example: -## extraEnv: -## - name: FOO -## value: "bar" -## -extraEnv: [] -## @param extraEnvVarsCM Name of a Config Map containing extra environment variables -## -extraEnvVarsCM: "" -## @param postgresqlInitdbArgs PostgreSQL initdb extra arguments -## ref: https://github.com/bitnami/bitnami-docker-postgresql/blob/master/README.md -## -postgresqlInitdbArgs: "" -## @param postgresqlInitdbWalDir Specify a custom location for the PostgreSQL transaction log -## ref: https://github.com/bitnami/bitnami-docker-postgresql/blob/master/README.md -## -postgresqlInitdbWalDir: "" -## @param postgresqlConfiguration PostgreSQL configuration -## Specify runtime configuration parameters as a dict, using camelCase, e.g. -## {"sharedBuffers": "500MB"} -## Alternatively, you can put your postgresql.conf under the files/ directory -## ref: https://www.postgresql.org/docs/current/static/runtime-config.html -## -postgresqlConfiguration: {} -## @param postgresqlExtendedConf Extended Runtime Config Parameters (appended to main or default configuration) -## Alternatively, you can put your *.conf under the files/conf.d/ directory -## https://github.com/bitnami/bitnami-docker-postgresql#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf -## -postgresqlExtendedConf: {} -## Configure current cluster's primary server to be the standby server in other cluster. -## This will allow cross cluster replication and provide cross cluster high availability. -## You will need to configure pgHbaConfiguration if you want to enable this feature with local cluster replication enabled. -## @param primaryAsStandBy.enabled Whether to enable current cluster's primary as standby server of another cluster or not -## @param primaryAsStandBy.primaryHost The Host of replication primary in the other cluster -## @param primaryAsStandBy.primaryPort The Port of replication primary in the other cluster -## -primaryAsStandBy: - enabled: false - primaryHost: "" - primaryPort: "" -## @param pgHbaConfiguration PostgreSQL client authentication configuration -## Specify content for pg_hba.conf -## Default: do not create pg_hba.conf -## Alternatively, you can put your pg_hba.conf under the files/ directory -## pgHbaConfiguration: |- -## local all all trust -## host all all localhost trust -## host mydatabase mysuser 192.168.0.0/24 md5 -## -pgHbaConfiguration: "" -## @param configurationConfigMap ConfigMap with PostgreSQL configuration -## NOTE: This will override postgresqlConfiguration and pgHbaConfiguration -## -configurationConfigMap: "" -## @param extendedConfConfigMap ConfigMap with PostgreSQL extended configuration -## -extendedConfConfigMap: "" -## @param initdbScripts Dictionary of initdb scripts -## Specify dictionary of scripts to be run at first boot -## Alternatively, you can put your scripts under the files/docker-entrypoint-initdb.d directory -## e.g: -## initdbScripts: -## my_init_script.sh: | -## #!/bin/sh -## echo "Do something." -## -initdbScripts: {} -## @param initdbScriptsConfigMap ConfigMap with scripts to be run at first boot -## NOTE: This will override initdbScripts -## -initdbScriptsConfigMap: "" -## @param initdbScriptsSecret Secret with scripts to be run at first boot (in case it contains sensitive information) -## NOTE: This can work along initdbScripts or initdbScriptsConfigMap -## -initdbScriptsSecret: "" -## @param initdbUser Specify the PostgreSQL username to execute the initdb scripts -## -initdbUser: "" -## @param initdbPassword Specify the PostgreSQL password to execute the initdb scripts -## -initdbPassword: "" - -## @param containerPorts.postgresql PostgreSQL container port -## -containerPorts: - postgresql: 5432 -## Audit settings -## https://github.com/bitnami/bitnami-docker-postgresql#auditing -## -audit: - ## @param audit.logHostname Log client hostnames - ## - logHostname: false - ## @param audit.logConnections Add client log-in operations to the log file - ## - logConnections: false - ## @param audit.logDisconnections Add client log-outs operations to the log file - ## - logDisconnections: false - ## @param audit.pgAuditLog Add operations to log using the pgAudit extension - ## - pgAuditLog: "" - ## @param audit.pgAuditLogCatalog Log catalog using pgAudit - ## - pgAuditLogCatalog: "off" - ## @param audit.clientMinMessages Message log level to share with the user - ## - clientMinMessages: error - ## @param audit.logLinePrefix Template for log line prefix (default if not set) - ## - logLinePrefix: "" - ## @param audit.logTimezone Timezone for the log timestamps - ## - logTimezone: "" -## @param postgresqlSharedPreloadLibraries Shared preload libraries (comma-separated list) -## -postgresqlSharedPreloadLibraries: "pgaudit" -## @param postgresqlMaxConnections Maximum total connections -## -postgresqlMaxConnections: "" -## @param postgresqlPostgresConnectionLimit Maximum connections for the postgres user -## -postgresqlPostgresConnectionLimit: "" -## @param postgresqlDbUserConnectionLimit Maximum connections for the non-admin user -## -postgresqlDbUserConnectionLimit: "" -## @param postgresqlTcpKeepalivesInterval TCP keepalives interval -## -postgresqlTcpKeepalivesInterval: "" -## @param postgresqlTcpKeepalivesIdle TCP keepalives idle -## -postgresqlTcpKeepalivesIdle: "" -## @param postgresqlTcpKeepalivesCount TCP keepalives count -## -postgresqlTcpKeepalivesCount: "" -## @param postgresqlStatementTimeout Statement timeout -## -postgresqlStatementTimeout: "" -## @param postgresqlPghbaRemoveFilters Comma-separated list of patterns to remove from the pg_hba.conf file -## Cannot be used with custom pg_hba.conf -## -postgresqlPghbaRemoveFilters: "" -## @param terminationGracePeriodSeconds Seconds the pod needs to terminate gracefully -## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods -## e.g: -## terminationGracePeriodSeconds: 30 -## -terminationGracePeriodSeconds: "" -## LDAP configuration -## @param ldap.enabled Enable LDAP support -## @param ldap.url LDAP URL beginning in the form `ldap[s]://host[:port]/basedn` -## @param ldap.server IP address or name of the LDAP server. -## @param ldap.port Port number on the LDAP server to connect to -## @param ldap.prefix String to prepend to the user name when forming the DN to bind -## @param ldap.suffix String to append to the user name when forming the DN to bind -## @param ldap.baseDN Root DN to begin the search for the user in -## @param ldap.bindDN DN of user to bind to LDAP -## @param ldap.bind_password Password for the user to bind to LDAP -## @param ldap.search_attr Attribute to match against the user name in the search -## @param ldap.search_filter The search filter to use when doing search+bind authentication -## @param ldap.scheme Set to `ldaps` to use LDAPS -## @param ldap.tls Set to `1` to use TLS encryption -## -ldap: - enabled: false - url: "" - server: "" - port: "" - prefix: "" - suffix: "" - baseDN: "" - bindDN: "" - bind_password: "" - search_attr: "" - search_filter: "" - scheme: "" - tls: "" -## PostgreSQL service configuration -## -service: - ## @param service.type Kubernetes Service type - ## - type: ClusterIP - ## @param service.clusterIP Static clusterIP or None for headless services - ## e.g: - ## clusterIP: None - ## - clusterIP: "" - ## @param service.port PostgreSQL port - ## - port: 5432 - ## @param service.nodePort Specify the nodePort value for the LoadBalancer and NodePort service types - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## - nodePort: "" - ## @param service.annotations Annotations for PostgreSQL service - ## - annotations: {} - ## @param service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` - ## Set the LoadBalancer service type to internal only - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer - ## - loadBalancerIP: "" - ## @param service.externalTrafficPolicy Enable client source IP preservation - ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - ## @param service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer - ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service - ## - ## loadBalancerSourceRanges: - ## - 10.10.10.0/24 - ## - loadBalancerSourceRanges: [] -## Start primary and read(s) pod(s) without limitations on shm memory. -## By default docker and containerd (and possibly other container runtimes) -## limit `/dev/shm` to `64M` (see e.g. the -## [docker issue](https://github.com/docker-library/postgres/issues/416) and the -## [containerd issue](https://github.com/containerd/containerd/issues/3654), -## which could be not enough if PostgreSQL uses parallel workers heavily. -## -shmVolume: - ## @param shmVolume.enabled Enable emptyDir volume for /dev/shm for primary and read replica(s) Pod(s) - ## Set `shmVolume.enabled` to `true` to mount a new tmpfs volume to remove the above limitation. - ## - enabled: true - ## @param shmVolume.chmod.enabled Set to `true` to `chmod 777 /dev/shm` on a initContainer (ignored if `volumePermissions.enabled` is `false`) - ## - chmod: - enabled: true - ## @param shmVolume.sizeLimit Set this to enable a size limit on the shm tmpfs. Note that the size of the tmpfs counts against container's memory limit - ## e.g: - ## sizeLimit: 1Gi - ## - sizeLimit: "" -persistence: - ## @param persistence.enabled Enable persistence using PVC - ## - enabled: true - ## @param persistence.existingClaim Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. - ## If defined, PVC must be created manually before volume will be bound - ## The value is evaluated as a template, so, for example, the name can depend on .Release or .Chart - ## - existingClaim: "" - ## @param persistence.mountPath The path the volume will be mounted at, useful when using different - ## PostgreSQL images. - ## - mountPath: /bitnami/postgresql - ## @param persistence.subPath The subdirectory of the volume to mount to - ## Useful in dev environments and one PV for multiple services - ## - subPath: "" - ## @param persistence.storageClass PVC Storage Class for PostgreSQL volume - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - storageClass: "" - ## @param persistence.accessModes PVC Access Mode for PostgreSQL volume - ## - accessModes: - - ReadWriteOnce - ## @param persistence.size PVC Storage Request for PostgreSQL volume - ## - size: 8Gi - ## @param persistence.annotations Annotations for the PVC - ## - annotations: {} - ## @param persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) - ## selector: - ## matchLabels: - ## app: my-app - ## - selector: {} -## @param updateStrategy.type updateStrategy for PostgreSQL StatefulSet and its reads StatefulSets -## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies -## -updateStrategy: - type: RollingUpdate -## -## PostgreSQL Primary parameters -## -primary: - ## @param primary.podAffinityPreset PostgreSQL primary pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param primary.podAntiAffinityPreset PostgreSQL primary pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## PostgreSQL Primary node affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param primary.nodeAffinityPreset.type PostgreSQL primary node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param primary.nodeAffinityPreset.key PostgreSQL primary node label key to match Ignored if `primary.affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param primary.nodeAffinityPreset.values PostgreSQL primary node label values to match. Ignored if `primary.affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param primary.affinity Affinity for PostgreSQL primary pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: primary.podAffinityPreset, primary.podAntiAffinityPreset, and primary.nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param primary.nodeSelector Node labels for PostgreSQL primary pods assignment - ## ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param primary.tolerations Tolerations for PostgreSQL primary pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param primary.extraPodSpec Optionally specify extra PodSpec - ## - extraPodSpec: {} - ## @param primary.labels Map of labels to add to the statefulset (postgresql primary) - ## - labels: {} - ## @param primary.annotations Annotations for PostgreSQL primary pods - ## - annotations: {} - ## @param primary.podLabels Map of labels to add to the pods (postgresql primary) - ## - podLabels: {} - ## @param primary.podAnnotations Map of annotations to add to the pods (postgresql primary) - ## - podAnnotations: {} - ## @param primary.priorityClassName Priority Class to use for each pod (postgresql primary) - ## - priorityClassName: "" - ## @param primary.extraInitContainers Extra init containers to add to the pods (postgresql primary) - ## Example - ## - ## extraInitContainers: - ## - name: do-something - ## image: busybox - ## command: ['do', 'something'] - ## - extraInitContainers: [] - ## @param primary.extraVolumeMounts Extra volume mounts to add to the pods (postgresql primary) - ## - extraVolumeMounts: [] - ## @param primary.extraVolumes Extra volumes to add to the pods (postgresql primary) - ## - extraVolumes: [] - ## @param primary.sidecars Extra containers to the pod - ## For example: - ## sidecars: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## ports: - ## - name: portname - ## containerPort: 1234 - ## - sidecars: [] - ## Override the service configuration for primary - ## @param primary.service.type Allows using a different service type for primary - ## @param primary.service.nodePort Allows using a different nodePort for primary - ## @param primary.service.clusterIP Allows using a different clusterIP for primary - ## - service: - type: "" - nodePort: "" - clusterIP: "" -## PostgreSQL read only replica parameters -## -readReplicas: - ## @param readReplicas.podAffinityPreset PostgreSQL read only pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAffinityPreset: "" - ## @param readReplicas.podAntiAffinityPreset PostgreSQL read only pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity - ## - podAntiAffinityPreset: soft - ## PostgreSQL read only node affinity preset - ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity - ## - nodeAffinityPreset: - ## @param readReplicas.nodeAffinityPreset.type PostgreSQL read only node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` - ## - type: "" - ## @param readReplicas.nodeAffinityPreset.key PostgreSQL read only node label key to match Ignored if `primary.affinity` is set. - ## E.g. - ## key: "kubernetes.io/e2e-az-name" - ## - key: "" - ## @param readReplicas.nodeAffinityPreset.values PostgreSQL read only node label values to match. Ignored if `primary.affinity` is set. - ## E.g. - ## values: - ## - e2e-az1 - ## - e2e-az2 - ## - values: [] - ## @param readReplicas.affinity Affinity for PostgreSQL read only pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## Note: readReplicas.podAffinityPreset, readReplicas.podAntiAffinityPreset, and readReplicas.nodeAffinityPreset will be ignored when it's set - ## - affinity: {} - ## @param readReplicas.nodeSelector Node labels for PostgreSQL read only pods assignment - ## ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - ## @param readReplicas.tolerations Tolerations for PostgreSQL read only pods assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ - ## - tolerations: [] - ## @param readReplicas.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods - ## - topologySpreadConstraints: [] - ## @param readReplicas.extraPodSpec Optionally specify extra PodSpec - ## - extraPodSpec: {} - ## @param readReplicas.labels Map of labels to add to the statefulsets (postgresql readReplicas) - ## - labels: {} - ## @param readReplicas.annotations Annotations for PostgreSQL read only pods - ## - annotations: {} - ## @param readReplicas.podLabels Map of labels to add to the pods (postgresql readReplicas) - ## - podLabels: {} - ## @param readReplicas.podAnnotations Map of annotations to add to the pods (postgresql readReplicas) - ## - podAnnotations: {} - ## @param readReplicas.priorityClassName Priority Class to use for each pod (postgresql readReplicas) - ## - priorityClassName: "" - ## @param readReplicas.extraInitContainers Extra init containers to add to the pods (postgresql readReplicas) - ## Example - ## - ## extraInitContainers: - ## - name: do-something - ## image: busybox - ## command: ['do', 'something'] - ## - extraInitContainers: [] - ## @param readReplicas.extraVolumeMounts Extra volume mounts to add to the pods (postgresql readReplicas) - ## - extraVolumeMounts: [] - ## @param readReplicas.extraVolumes Extra volumes to add to the pods (postgresql readReplicas) - ## - extraVolumes: [] - ## @param readReplicas.sidecars Extra containers to the pod - ## - ## For example: - ## sidecars: - ## - name: your-image-name - ## image: your-image - ## imagePullPolicy: Always - ## ports: - ## - name: portname - ## containerPort: 1234 - ## - sidecars: [] - ## Override the service configuration for read - ## @param readReplicas.service.type Allows using a different service type for readReplicas - ## @param readReplicas.service.nodePort Allows using a different nodePort for readReplicas - ## @param readReplicas.service.clusterIP Allows using a different clusterIP for readReplicas - ## - service: - type: "" - nodePort: "" - clusterIP: "" - ## @param readReplicas.persistence.enabled Whether to enable PostgreSQL read replicas replicas persistence - ## - persistence: - enabled: true - ## @param readReplicas.resources CPU/Memory resource requests/limits override for readReplicass. Will fallback to `values.resources` if not defined. - ## - resources: {} -## Configure resource requests and limits -## ref: https://kubernetes.io/docs/user-guide/compute-resources/ -## @param resources.requests [object] The requested resources for the container -## -resources: - requests: - memory: 256Mi - cpu: 250m -networkPolicy: - ## @param networkPolicy.enabled Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now. - ## - enabled: false - ## @param networkPolicy.allowExternal Don't require client label for connections - ## The Policy model to apply. When set to false, only pods with the correct - ## client label will have network access to the port PostgreSQL is listening - ## on. When true, PostgreSQL will accept connections from any source - ## (with the correct destination port). - ## - allowExternal: true - ## @param networkPolicy.explicitNamespacesSelector A Kubernetes LabelSelector to explicitly select namespaces from which ingress traffic could be allowed - ## If explicitNamespacesSelector is missing or set to {}, only client Pods that are in the networkPolicy's namespace - ## and that match other criteria, the ones that have the good label, can reach the DB. - ## But sometimes, we want the DB to be accessible to clients from other namespaces, in this case, we can use this - ## LabelSelector to select these namespaces, note that the networkPolicy's namespace should also be explicitly added. - ## - ## Example: - ## explicitNamespacesSelector: - ## matchLabels: - ## role: frontend - ## matchExpressions: - ## - {key: role, operator: In, values: [frontend]} - ## - explicitNamespacesSelector: {} -## Configure extra options for liveness probe -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes -## @param startupProbe.enabled Enable startupProbe -## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe -## @param startupProbe.periodSeconds Period seconds for startupProbe -## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe -## @param startupProbe.failureThreshold Failure threshold for startupProbe -## @param startupProbe.successThreshold Success threshold for startupProbe -## -startupProbe: - enabled: false - initialDelaySeconds: 30 - periodSeconds: 15 - timeoutSeconds: 5 - failureThreshold: 10 - successThreshold: 1 -## Configure extra options for liveness probe -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes -## @param livenessProbe.enabled Enable livenessProbe -## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe -## @param livenessProbe.periodSeconds Period seconds for livenessProbe -## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe -## @param livenessProbe.failureThreshold Failure threshold for livenessProbe -## @param livenessProbe.successThreshold Success threshold for livenessProbe -## -livenessProbe: - enabled: true - initialDelaySeconds: 30 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 -## Configure extra options for readiness probe -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes -## @param readinessProbe.enabled Enable readinessProbe -## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe -## @param readinessProbe.periodSeconds Period seconds for readinessProbe -## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe -## @param readinessProbe.failureThreshold Failure threshold for readinessProbe -## @param readinessProbe.successThreshold Success threshold for readinessProbe -## -readinessProbe: - enabled: true - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 -## @param customStartupProbe Override default startup probe -## -customStartupProbe: {} -## @param customLivenessProbe Override default liveness probe -## -customLivenessProbe: {} -## @param customReadinessProbe Override default readiness probe -## -customReadinessProbe: {} -## -## TLS configuration -## -tls: - ## @param tls.enabled Enable TLS traffic support - ## - enabled: false - ## @param tls.autoGenerated Generate automatically self-signed TLS certificates - ## - autoGenerated: false - ## @param tls.preferServerCiphers Whether to use the server's TLS cipher preferences rather than the client's - ## - preferServerCiphers: true - ## @param tls.certificatesSecret Name of an existing secret that contains the certificates - ## - certificatesSecret: "" - ## @param tls.certFilename Certificate filename - ## - certFilename: "" - ## @param tls.certKeyFilename Certificate key filename - ## - certKeyFilename: "" - ## @param tls.certCAFilename CA Certificate filename - ## If provided, PostgreSQL will authenticate TLS/SSL clients by requesting them a certificate - ## ref: https://www.postgresql.org/docs/9.6/auth-methods.html - ## - certCAFilename: "" - ## @param tls.crlFilename File containing a Certificate Revocation List - ## - crlFilename: "" -## Configure metrics exporter -## -metrics: - ## @param metrics.enabled Start a prometheus exporter - ## - enabled: false - ## @param metrics.resources Prometheus exporter container resources - ## - resources: {} - ## @param metrics.service.type Kubernetes Service type - ## @param metrics.service.annotations [object] Additional annotations for metrics exporter pod - ## @param metrics.service.loadBalancerIP loadBalancerIP if redis metrics service type is `LoadBalancer` - ## - service: - type: ClusterIP - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9187" - loadBalancerIP: "" - ## @param metrics.serviceMonitor.enabled Set this to `true` to create ServiceMonitor for Prometheus operator - ## @param metrics.serviceMonitor.additionalLabels Additional labels that can be used so ServiceMonitor will be discovered by Prometheus - ## @param metrics.serviceMonitor.namespace Optional namespace in which to create ServiceMonitor - ## @param metrics.serviceMonitor.interval Scrape interval. If not set, the Prometheus default scrape interval is used - ## @param metrics.serviceMonitor.scrapeTimeout Scrape timeout. If not set, the Prometheus default scrape timeout is used - ## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping - ## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion - ## - serviceMonitor: - enabled: false - additionalLabels: {} - namespace: "" - interval: "" - scrapeTimeout: "" - relabelings: [] - metricRelabelings: [] - ## Custom PrometheusRule to be defined - ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart - ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions - ## - prometheusRule: - ## @param metrics.prometheusRule.enabled Set this to true to create prometheusRules for Prometheus operator - ## - enabled: false - ## @param metrics.prometheusRule.additionalLabels Additional labels that can be used so prometheusRules will be discovered by Prometheus - ## - additionalLabels: {} - ## @param metrics.prometheusRule.namespace namespace where prometheusRules resource should be created - ## - namespace: "" - ## @param metrics.prometheusRule.rules Create specified [Rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) - ## Make sure to constraint the rules to the current postgresql service. - ## rules: - ## - alert: HugeReplicationLag - ## expr: pg_replication_lag{service="{{ template "common.names.fullname" . }}-metrics"} / 3600 > 1 - ## for: 1m - ## labels: - ## severity: critical - ## annotations: - ## description: replication for {{ template "common.names.fullname" . }} PostgreSQL is lagging by {{ "{{ $value }}" }} hour(s). - ## summary: PostgreSQL replication is lagging by {{ "{{ $value }}" }} hour(s). - ## - rules: [] - ## @param metrics.image.registry PostgreSQL Exporter image registry - ## @param metrics.image.repository PostgreSQL Exporter image repository - ## @param metrics.image.tag PostgreSQL Exporter image tag (immutable tags are recommended) - ## @param metrics.image.pullPolicy PostgreSQL Exporter image pull policy - ## @param metrics.image.pullSecrets Specify image pull secrets - ## - image: - registry: docker.io - repository: bitnami/postgres-exporter - tag: 0.10.0-debian-10-r166 - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## Example: - ## pullSecrets: - ## - myRegistryKeySecretName - ## - pullSecrets: [] - ## @param metrics.customMetrics Define additional custom metrics - ## ref: https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file - ## customMetrics: - ## pg_database: - ## query: "SELECT d.datname AS name, CASE WHEN pg_catalog.has_database_privilege(d.datname, 'CONNECT') THEN pg_catalog.pg_database_size(d.datname) ELSE 0 END AS size_bytes FROM pg_catalog.pg_database d where datname not in ('template0', 'template1', 'postgres')" - ## metrics: - ## - name: - ## usage: "LABEL" - ## description: "Name of the database" - ## - size_bytes: - ## usage: "GAUGE" - ## description: "Size of the database in bytes" - ## - customMetrics: {} - ## @param metrics.extraEnvVars Extra environment variables to add to postgres-exporter - ## see: https://github.com/wrouesnel/postgres_exporter#environment-variables - ## For example: - ## extraEnvVars: - ## - name: PG_EXPORTER_DISABLE_DEFAULT_METRICS - ## value: "true" - ## - extraEnvVars: [] - ## Pod Security Context - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - ## @param metrics.securityContext.enabled Enable security context for metrics - ## @param metrics.securityContext.runAsUser User ID for the container for metrics - ## - securityContext: - enabled: false - runAsUser: 1001 - ## Configure extra options for liveness probe - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes - ## @param metrics.livenessProbe.enabled Enable livenessProbe - ## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe - ## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe - ## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe - ## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe - ## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe - ## - livenessProbe: - enabled: true - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 - ## Configure extra options for readiness probe - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes - ## @param metrics.readinessProbe.enabled Enable readinessProbe - ## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe - ## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe - ## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe - ## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe - ## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe - ## - readinessProbe: - enabled: true - initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 6 - successThreshold: 1 diff --git a/rds/base/charts/redis-cluster/.helmignore b/rds/base/charts/redis-cluster/.helmignore deleted file mode 100644 index f0c1319..0000000 --- a/rds/base/charts/redis-cluster/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/rds/base/charts/redis-cluster/Chart.lock b/rds/base/charts/redis-cluster/Chart.lock deleted file mode 100644 index cfa9923..0000000 --- a/rds/base/charts/redis-cluster/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: common - repository: file://charts/common - version: 1.16.0 -digest: sha256:8cbf195631894434137a5801072c21fbcff43915de298ab2664725c5492fa7d0 -generated: "2023-02-07T10:31:00.441718631+01:00" diff --git a/rds/base/charts/redis-cluster/Chart.yaml b/rds/base/charts/redis-cluster/Chart.yaml deleted file mode 100644 index 0eda7ff..0000000 --- a/rds/base/charts/redis-cluster/Chart.yaml +++ /dev/null @@ -1,28 +0,0 @@ -annotations: - category: Database -apiVersion: v2 -appVersion: 6.2.7 -dependencies: -- name: common - repository: file://charts/common - tags: - - bitnami-common - alias: redis-cluster-common - version: 1.x.x -description: Redis(R) is an open source, scalable, distributed in-memory cache for - applications. It can be used to store and serve data in the form of strings, hashes, - lists, sets and sorted sets. -home: https://github.com/bitnami/charts/tree/master/bitnami/redis-cluster -icon: https://bitnami.com/assets/stacks/redis/img/redis-stack-220x234.png -keywords: -- redis -- keyvalue -- database -maintainers: -- name: Bitnami - url: https://github.com/bitnami/charts -name: redis-cluster -sources: -- https://github.com/bitnami/bitnami-docker-redis -- http://redis.io/ -version: 7.6.4 diff --git a/rds/base/charts/redis-cluster/README.md b/rds/base/charts/redis-cluster/README.md deleted file mode 100644 index f4d7a8d..0000000 --- a/rds/base/charts/redis-cluster/README.md +++ /dev/null @@ -1,682 +0,0 @@ - - -# Bitnami package for Redis(R) Cluster - -Redis(R) is an open source, scalable, distributed in-memory cache for applications. It can be used to store and serve data in the form of strings, hashes, lists, sets and sorted sets. - -[Overview of Redis® Cluster](http://redis.io) - -Disclaimer: Redis is a registered trademark of Redis Ltd. Any rights therein are reserved to Redis Ltd. Any use by Bitnami is for referential purposes only and does not indicate any sponsorship, endorsement, or affiliation between Redis Ltd. - -## TL;DR - -```bash -$ helm repo add bitnami https://charts.bitnami.com/bitnami -$ helm install my-release bitnami/redis-cluster -``` - -## Introduction - -This chart bootstraps a [Redis®](https://github.com/bitnami/bitnami-docker-redis) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. - -### Choose between Redis® Helm Chart and Redis® Cluster Helm Chart - -You can choose any of the two Redis® Helm charts for deploying a Redis® cluster. -While [Redis® Helm Chart](https://github.com/bitnami/charts/tree/master/bitnami/redis) will deploy a master-slave cluster using Redis® Sentinel, the [Redis® Cluster Helm Chart](https://github.com/bitnami/charts/tree/master/bitnami/redis-cluster) will deploy a Redis® Cluster with sharding. -The main features of each chart are the following: - -| Redis® | Redis® Cluster | -|--------------------------------------------------------|------------------------------------------------------------------------| -| Supports multiple databases | Supports only one database. Better if you have a big dataset | -| Single write point (single master) | Multiple write points (multiple masters) | -| ![Redis® Topology](img/redis-topology.png) | ![Redis® Cluster Topology](img/redis-cluster-topology.png) | - -## Prerequisites - -- Kubernetes 1.19+ -- Helm 3.2.0+ -- PV provisioner support in the underlying infrastructure - -## Installing the Chart - -To install the chart with the release name `my-release`: - -```bash -$ helm install my-release bitnami/redis-cluster -``` - -The command deploys Redis® on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. - -NOTE: if you get a timeout error waiting for the hook to complete increase the default timeout (300s) to a higher one, for example: - -``` -helm install --timeout 600s myrelease bitnami/redis-cluster -``` - -> **Tip**: List all releases using `helm list` - -## Uninstalling the Chart - -To uninstall/delete the `my-release` deployment: - -```bash -$ helm delete my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -## Parameters - -### Global parameters - -| Name | Description | Value | -| ------------------------- | ----------------------------------------------- | ----- | -| `global.imageRegistry` | Global Docker image registry | `""` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | -| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | -| `global.redis.password` | Redis® password (overrides `password`) | `""` | - - -### Redis® Cluster Common parameters - -| Name | Description | Value | -| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override common.names.fullname template | `""` | -| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | -| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | -| `commonLabels` | Labels to add to all deployed objects | `{}` | -| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | -| `image.registry` | Redis® cluster image registry | `docker.io` | -| `image.repository` | Redis® cluster image repository | `bitnami/redis-cluster` | -| `image.tag` | Redis® cluster image tag (immutable tags are recommended) | `6.2.7-debian-11-r9` | -| `image.pullPolicy` | Redis® cluster image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `image.debug` | Enable image debug mode | `false` | -| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | -| `networkPolicy.allowExternal` | The Policy model to apply. Don't require client label for connections | `true` | -| `networkPolicy.ingressNSMatchLabels` | Allow connections from other namespacess. Just set label for namespace and set label for pods (optional). | `{}` | -| `networkPolicy.ingressNSPodMatchLabels` | For other namespaces match by pod labels and namespace labels | `{}` | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | -| `serviceAccount.name` | The name of the ServiceAccount to create | `""` | -| `serviceAccount.annotations` | Annotations for Cassandra Service Account | `{}` | -| `serviceAccount.automountServiceAccountToken` | Automount API credentials for a service account. | `false` | -| `rbac.create` | Specifies whether RBAC resources should be created | `false` | -| `rbac.role.rules` | Rules to create. It follows the role specification | `[]` | -| `podSecurityContext.enabled` | Enable Redis® pod Security Context | `true` | -| `podSecurityContext.fsGroup` | Group ID for the pods | `1001` | -| `podSecurityContext.runAsUser` | User ID for the pods | `1001` | -| `podSecurityContext.sysctls` | Set namespaced sysctls for the pods | `[]` | -| `podDisruptionBudget` | Limits the number of pods of the replicated application that are down simultaneously from voluntary disruptions | `{}` | -| `minAvailable` | Min number of pods that must still be available after the eviction | `""` | -| `maxUnavailable` | Max number of pods that can be unavailable after the eviction | `""` | -| `containerSecurityContext.enabled` | Enable Containers' Security Context | `true` | -| `containerSecurityContext.runAsUser` | User ID for the containers. | `1001` | -| `containerSecurityContext.runAsNonRoot` | Run container as non root | `true` | -| `usePassword` | Use password authentication | `true` | -| `password` | Redis® password (ignored if existingSecret set) | `""` | -| `existingSecret` | Name of existing secret object (for password authentication) | `""` | -| `existingSecretPasswordKey` | Name of key containing password to be retrieved from the existing secret | `""` | -| `usePasswordFile` | Mount passwords as files instead of environment variables | `false` | -| `tls.enabled` | Enable TLS support for replication traffic | `false` | -| `tls.authClients` | Require clients to authenticate or not | `true` | -| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | -| `tls.existingSecret` | The name of the existing secret that contains the TLS certificates | `""` | -| `tls.certificatesSecret` | DEPRECATED. Use tls.existingSecret instead | `""` | -| `tls.certFilename` | Certificate filename | `""` | -| `tls.certKeyFilename` | Certificate key filename | `""` | -| `tls.certCAFilename` | CA Certificate filename | `""` | -| `tls.dhParamsFilename` | File containing DH params (in order to support DH based ciphers) | `""` | -| `service.ports.redis` | Kubernetes Redis service port | `6379` | -| `service.nodePorts.redis` | Node port for Redis | `""` | -| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `[]` | -| `service.annotations` | Provide any additional annotations which may be required. | `{}` | -| `service.labels` | Additional labels for redis service | `{}` | -| `service.type` | Service type for default redis service | `ClusterIP` | -| `service.clusterIP` | Service Cluster IP | `""` | -| `service.loadBalancerIP` | Load balancer IP if `service.type` is `LoadBalancer` | `""` | -| `service.loadBalancerSourceRanges` | Service Load Balancer sources | `[]` | -| `service.externalTrafficPolicy` | Service external traffic policy | `Cluster` | -| `service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | -| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `persistence.path` | Path to mount the volume at, to use other images Redis® images. | `/bitnami/redis/data` | -| `persistence.subPath` | The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services | `""` | -| `persistence.storageClass` | Storage class of backing PVC | `""` | -| `persistence.annotations` | Persistent Volume Claim annotations | `{}` | -| `persistence.accessModes` | Persistent Volume Access Modes | `["ReadWriteOnce"]` | -| `persistence.size` | Size of data volume | `8Gi` | -| `persistence.matchLabels` | Persistent Volume selectors | `{}` | -| `persistence.matchExpressions` | matchExpressions Persistent Volume selectors | `{}` | -| `volumePermissions.enabled` | Enable init container that changes volume permissions in the registry (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | -| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` | -| `volumePermissions.image.tag` | Init container volume-permissions image tag | `11-debian-11-r10` | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | -| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `volumePermissions.resources.limits` | The resources limits for the container | `{}` | -| `volumePermissions.resources.requests` | The requested resources for the container | `{}` | -| `podSecurityPolicy.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | - - -### Redis® statefulset parameters - -| Name | Description | Value | -| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | --------------- | -| `redis.command` | Redis® entrypoint string. The command `redis-server` is executed if this is not provided | `[]` | -| `redis.args` | Arguments for the provided command if needed | `[]` | -| `redis.updateStrategy.type` | Argo Workflows statefulset strategy type | `RollingUpdate` | -| `redis.updateStrategy.rollingUpdate.partition` | Partition update strategy | `0` | -| `redis.podManagementPolicy` | Statefulset Pod management policy, it needs to be Parallel to be able to complete the cluster join | `Parallel` | -| `redis.hostAliases` | Deployment pod host aliases | `[]` | -| `redis.hostNetwork` | Host networking requested for this pod. Use the host's network namespace. | `false` | -| `redis.useAOFPersistence` | Whether to use AOF Persistence mode or not | `yes` | -| `redis.containerPorts.redis` | Redis® port | `6379` | -| `redis.containerPorts.bus` | The busPort should be obtained adding 10000 to the redisPort. By default: 10000 + 6379 = 16379 | `16379` | -| `redis.lifecycleHooks` | LifecycleHook to set additional configuration before or after startup. Evaluated as a template | `{}` | -| `redis.extraVolumes` | Extra volumes to add to the deployment | `[]` | -| `redis.extraVolumeMounts` | Extra volume mounts to add to the container | `[]` | -| `redis.customLivenessProbe` | Override default liveness probe | `{}` | -| `redis.customReadinessProbe` | Override default readiness probe | `{}` | -| `redis.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | -| `redis.initContainers` | Extra init containers to add to the deployment | `[]` | -| `redis.sidecars` | Extra sidecar containers to add to the deployment | `[]` | -| `redis.podLabels` | Additional labels for Redis® pod | `{}` | -| `redis.priorityClassName` | Redis® Master pod priorityClassName | `""` | -| `redis.configmap` | Additional Redis® configuration for the nodes | `""` | -| `redis.extraEnvVars` | An array to add extra environment variables | `[]` | -| `redis.extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | -| `redis.extraEnvVarsSecret` | Secret with extra environment variables | `""` | -| `redis.podAnnotations` | Redis® additional annotations | `{}` | -| `redis.resources.limits` | The resources limits for the container | `{}` | -| `redis.resources.requests` | The requested resources for the container | `{}` | -| `redis.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | -| `redis.shareProcessNamespace` | Enable shared process namespace in a pod. | `false` | -| `redis.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `redis.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `redis.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | -| `redis.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `redis.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | -| `redis.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `redis.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `redis.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `redis.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | -| `redis.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `redis.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | -| `redis.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `redis.startupProbe.enabled` | Enable startupProbe | `false` | -| `redis.startupProbe.path` | Path to check for startupProbe | `/` | -| `redis.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` | -| `redis.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `redis.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `redis.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` | -| `redis.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `redis.podAffinityPreset` | Redis® pod affinity preset. Ignored if `redis.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `redis.podAntiAffinityPreset` | Redis® pod anti-affinity preset. Ignored if `redis.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `redis.nodeAffinityPreset.type` | Redis® node affinity preset type. Ignored if `redis.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `redis.nodeAffinityPreset.key` | Redis® node label key to match Ignored if `redis.affinity` is set. | `""` | -| `redis.nodeAffinityPreset.values` | Redis® node label values to match. Ignored if `redis.affinity` is set. | `[]` | -| `redis.affinity` | Affinity settings for Redis® pod assignment | `{}` | -| `redis.nodeSelector` | Node labels for Redis® pods assignment | `{}` | -| `redis.tolerations` | Tolerations for Redis® pods assignment | `[]` | -| `redis.topologySpreadConstraints` | Pod topology spread constraints for Redis® pod | `[]` | - - -### Cluster update job parameters - -| Name | Description | Value | -| ------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------ | -| `updateJob.activeDeadlineSeconds` | Number of seconds the Job to create the cluster will be waiting for the Nodes to be ready. | `600` | -| `updateJob.command` | Container command (using container default if not set) | `[]` | -| `updateJob.args` | Container args (using container default if not set) | `[]` | -| `updateJob.hostAliases` | Deployment pod host aliases | `[]` | -| `updateJob.annotations` | Job annotations | `{}` | -| `updateJob.podAnnotations` | Job pod annotations | `{}` | -| `updateJob.podLabels` | Pod extra labels | `{}` | -| `updateJob.extraEnvVars` | An array to add extra environment variables | `[]` | -| `updateJob.extraEnvVarsCM` | ConfigMap containing extra environment variables | `""` | -| `updateJob.extraEnvVarsSecret` | Secret containing extra environment variables | `""` | -| `updateJob.extraVolumes` | Extra volumes to add to the deployment | `[]` | -| `updateJob.extraVolumeMounts` | Extra volume mounts to add to the container | `[]` | -| `updateJob.initContainers` | Extra init containers to add to the deployment | `[]` | -| `updateJob.podAffinityPreset` | Update job pod affinity preset. Ignored if `updateJob.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `updateJob.podAntiAffinityPreset` | Update job pod anti-affinity preset. Ignored if `updateJob.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `updateJob.nodeAffinityPreset.type` | Update job node affinity preset type. Ignored if `updateJob.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `updateJob.nodeAffinityPreset.key` | Update job node label key to match Ignored if `updateJob.affinity` is set. | `""` | -| `updateJob.nodeAffinityPreset.values` | Update job node label values to match. Ignored if `updateJob.affinity` is set. | `[]` | -| `updateJob.affinity` | Affinity for update job pods assignment | `{}` | -| `updateJob.nodeSelector` | Node labels for update job pods assignment | `{}` | -| `updateJob.tolerations` | Tolerations for update job pods assignment | `[]` | -| `updateJob.priorityClassName` | Priority class name | `""` | -| `updateJob.resources.limits` | The resources limits for the container | `{}` | -| `updateJob.resources.requests` | The requested resources for the container | `{}` | - - -### Cluster management parameters - -| Name | Description | Value | -| --------------------------------------------------------- | --------------------------------------------------------------------------------------------- | -------------- | -| `cluster.init` | Enable the initialization of the Redis® Cluster | `true` | -| `cluster.nodes` | The number of master nodes should always be >= 3, otherwise cluster creation will fail | `6` | -| `cluster.replicas` | Number of replicas for every master in the cluster | `1` | -| `cluster.externalAccess.enabled` | Enable access to the Redis | `false` | -| `cluster.externalAccess.service.type` | Type for the services used to expose every Pod | `LoadBalancer` | -| `cluster.externalAccess.service.port` | Port for the services used to expose every Pod | `6379` | -| `cluster.externalAccess.service.loadBalancerIP` | Array of load balancer IPs for each Redis® node. Length must be the same as cluster.nodes | `[]` | -| `cluster.externalAccess.service.loadBalancerSourceRanges` | Service Load Balancer sources | `[]` | -| `cluster.externalAccess.service.annotations` | Annotations to add to the services used to expose every Pod of the Redis® Cluster | `{}` | -| `cluster.update.addNodes` | Boolean to specify if you want to add nodes after the upgrade | `false` | -| `cluster.update.currentNumberOfNodes` | Number of currently deployed Redis® nodes | `6` | -| `cluster.update.currentNumberOfReplicas` | Number of currently deployed Redis® replicas | `1` | -| `cluster.update.newExternalIPs` | External IPs obtained from the services for the new nodes to add to the cluster | `[]` | - - -### Metrics sidecar parameters - -| Name | Description | Value | -| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Redis® exporter image registry | `docker.io` | -| `metrics.image.repository` | Redis® exporter image name | `bitnami/redis-exporter` | -| `metrics.image.tag` | Redis® exporter image tag | `1.43.0-debian-11-r3` | -| `metrics.image.pullPolicy` | Redis® exporter image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `metrics.resources` | Metrics exporter resource requests and limits | `{}` | -| `metrics.extraArgs` | Extra arguments for the binary; possible values [here](https://github.com/oliver006/redis_exporter | `{}` | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{}` | -| `metrics.podLabels` | Additional labels for Metrics exporter pod | `{}` | -| `metrics.serviceMonitor.enabled` | If `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | -| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `""` | -| `metrics.serviceMonitor.interval` | How frequently to scrape metrics (use by default, falling back to Prometheus' default) | `""` | -| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | -| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | -| `metrics.serviceMonitor.labels` | ServiceMonitor extra labels | `{}` | -| `metrics.serviceMonitor.annotations` | ServiceMonitor annotations | `{}` | -| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` | -| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` | -| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` | -| `metrics.prometheusRule.enabled` | Set this to true to create prometheusRules for Prometheus operator | `false` | -| `metrics.prometheusRule.additionalLabels` | Additional labels that can be used so prometheusRules will be discovered by Prometheus | `{}` | -| `metrics.prometheusRule.namespace` | namespace where prometheusRules resource should be created | `""` | -| `metrics.prometheusRule.rules` | Create specified [rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/), check values for an example. | `[]` | -| `metrics.priorityClassName` | Metrics exporter pod priorityClassName | `""` | -| `metrics.service.type` | Kubernetes Service type (redis metrics) | `ClusterIP` | -| `metrics.service.loadBalancerIP` | Use serviceLoadBalancerIP to request a specific static IP, otherwise leave blank | `""` | -| `metrics.service.annotations` | Annotations for the services to monitor. | `{}` | -| `metrics.service.labels` | Additional labels for the metrics service | `{}` | -| `metrics.service.clusterIP` | Service Cluster IP | `""` | - - -### Sysctl Image parameters - -| Name | Description | Value | -| -------------------------------- | -------------------------------------------------- | ----------------------- | -| `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` | -| `sysctlImage.command` | sysctlImage command to execute | `[]` | -| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` | -| `sysctlImage.repository` | sysctlImage Init container repository | `bitnami/bitnami-shell` | -| `sysctlImage.tag` | sysctlImage Init container tag | `11-debian-11-r10` | -| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `IfNotPresent` | -| `sysctlImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `sysctlImage.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | -| `sysctlImage.resources.limits` | The resources limits for the container | `{}` | -| `sysctlImage.resources.requests` | The requested resources for the container | `{}` | - - -Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```bash -$ helm install my-release \ - --set password=secretpassword \ - bitnami/redis-cluster -``` - -The above command sets the Redis® server password to `secretpassword`. - -> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. - -Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, - -```bash -$ helm install my-release -f values.yaml bitnami/redis-cluster -``` - -> **Tip**: You can use the default [values.yaml](values.yaml) - -> **Note for minikube users**: Current versions of minikube (v0.24.1 at the time of writing) provision `hostPath` persistent volumes that are only writable by root. Using chart defaults cause pod failure for the Redis® pod as it attempts to write to the `/bitnami` directory. See minikube issue [1990](https://github.com/kubernetes/minikube/issues/1990) for more information. - -## Configuration and installation details - -### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) - -It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. - -Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. - -### Use a different Redis® version - -To modify the application version used in this chart, specify a different version of the image using the `image.tag` parameter and/or a different repository using the `image.repository` parameter. Refer to the [chart documentation for more information on these parameters and how to use them with images from a private registry](https://docs.bitnami.com/kubernetes/infrastructure/redis-cluster/configuration/change-image-version/). - -### Cluster topology - -To successfully set the cluster up, it will need to have at least 3 master nodes. The total number of nodes is calculated like- `nodes = numOfMasterNodes + numOfMasterNodes * replicas`. Hence, the defaults `cluster.nodes = 6` and `cluster.replicas = 1` means, 3 master and 3 replica nodes will be deployed by the chart. - -By default the Redis® Cluster is not accessible from outside the Kubernetes cluster, to access the Redis® Cluster from outside you have to set `cluster.externalAccess.enabled=true` at deployment time. It will create in the first installation only 6 LoadBalancer services, one for each Redis® node, once you have the external IPs of each service you will need to perform an upgrade passing those IPs to the `cluster.externalAccess.service.loadbalancerIP` array. - -The replicas will be read-only replicas of the masters. By default only one service is exposed (when not using the external access mode). You will connect your client to the exposed service, regardless you need to read or write. When a write operation arrives to a replica it will redirect the client to the proper master node. For example, using `redis-cli` you will need to provide the `-c` flag for `redis-cli` to follow the redirection automatically. - -Using the external access mode, you can connect to any of the pods and the slaves will redirect the client in the same way as explained before, but the all the IPs will be public. - -In case the master crashes, one of his slaves will be promoted to master. The slots stored by the crashed master will be unavailable until the slave finish the promotion. If a master and all his slaves crash, the cluster will be down until one of them is up again. To avoid downtime, it is possible to configure the number of Redis® nodes with `cluster.nodes` and the number of replicas that will be assigned to each master with `cluster.replicas`. For example: - -- `cluster.nodes=9` ( 3 master plus 2 replicas for each master) -- `cluster.replicas=2` - -Providing the values above, the cluster will have 3 masters and, each master, will have 2 replicas. - -> NOTE: By default `cluster.init` will be set to `true` in order to initialize the Redis® Cluster in the first installation. If for testing purposes you only want to deploy or upgrade the nodes but avoiding the creation of the cluster you can set `cluster.init` to `false`. - -#### Adding a new node to the cluster - -There is a job that will be executed using a `post-upgrade` hook that will allow you to add a new node. To use it, you should provide some parameters to the upgrade: - -- Pass as `password` the password used in the installation time. If you did not provide a password follow the instructions from the NOTES.txt to get the generated password. -- Set the desired number of nodes at `cluster.nodes`. -- Set the number of current nodes at `cluster.update.currentNumberOfNodes`. -- Set to true `cluster.update.addNodes`. - -The following will be an example to add one more node: - -``` -helm upgrade --timeout 600s --set "password=${REDIS_PASSWORD},cluster.nodes=7,cluster.update.addNodes=true,cluster.update.currentNumberOfNodes=6" bitnami/redis-cluster -``` - -Where `REDIS_PASSWORD` is the password obtained with the command that appears after the first installation of the Helm Chart. -The cluster will continue up while restarting pods one by one as the quorum is not lost. - -##### External Access - -If you are using external access, to add a new node you will need to perform two upgrades. First upgrade the release to add a new Redis® node and to get a LoadBalancerIP service. For example: - -``` -helm upgrade --set "password=${REDIS_PASSWORD},cluster.externalAccess.enabled=true,cluster.externalAccess.service.type=LoadBalancer,cluster.externalAccess.service.loadBalancerIP[0]=,cluster.externalAccess.service.loadBalancerIP[1]=,cluster.externalAccess.service.loadBalancerIP[2]=,cluster.externalAccess.service.loadBalancerIP[3]=,cluster.externalAccess.service.loadBalancerIP[4]=,cluster.externalAccess.service.loadBalancerIP[5]=,cluster.externalAccess.service.loadBalancerIP[6]=,cluster.nodes=7,cluster.init=false bitnami/redis-cluster -``` - -> Important here to provide the loadBalancerIP parameters for the new nodes empty to not get an index error. - -As we want to add a new node, we are setting `cluster.nodes=7` and we leave empty the LoadBalancerIP for the new node, so the cluster will provide the correct one. -`REDIS_PASSWORD` is the password obtained with the command that appears after the first installation of the Helm Chart. -At this point, you will have a new Redis® Pod that will remain in `crashLoopBackOff` state until we provide the LoadBalancerIP for the new service. -Now, wait until the cluster provides the new LoadBalancerIP for the new service and perform the second upgrade: - -``` -helm upgrade --set "password=${REDIS_PASSWORD},cluster.externalAccess.enabled=true,cluster.externalAccess.service.type=LoadBalancer,cluster.externalAccess.service.loadBalancerIP[0]=,cluster.externalAccess.service.loadBalancerIP[1]=,cluster.externalAccess.service.loadBalancerIP[2]=,cluster.externalAccess.service.loadBalancerIP[3]=,cluster.externalAccess.service.loadBalancerIP[4]=,cluster.externalAccess.service.loadBalancerIP[5]=,cluster.externalAccess.service.loadBalancerIP[6]=,cluster.nodes=7,cluster.init=false,cluster.update.addNodes=true,cluster.update.newExternalIPs[0]=" bitnami/redis-cluster -``` - -Note we are providing the new IPs at `cluster.update.newExternalIPs`, the flag `cluster.update.addNodes=true` to enable the creation of the Job that adds a new node and now we are setting the LoadBalancerIP of the new service instead of leave it empty. - -> NOTE: To avoid the creation of the Job that initializes the Redis® Cluster again, you will need to provide `cluster.init=false`. - -#### Scale down the cluster - -To scale down the Redis® Cluster, follow these steps: - -First perform a normal upgrade setting the `cluster.nodes` value to the desired number of nodes. It should not be less than `6` and the difference between current number of nodes and the desired should be less or equal to `cluster.replicas` to avoid removing master node an its slaves at the same time. Also it is needed to provide the password using the `password`. For example, having more than 6 nodes, to scale down the cluster to 6 nodes: - -``` -helm upgrade --timeout 600s --set "password=${REDIS_PASSWORD},cluster.nodes=6" . -``` - -The cluster will continue working during the update as long as the quorum is not lost. - -> NOTE: To avoid the creation of the Job that initializes the Redis® Cluster again, you will need to provide `cluster.init=false`. - -Once all the nodes are ready, get the list of nodes in the cluster using the `CLUSTER NODES` command. You will see references to the ones that were removed. Write down the node IDs of the nodes that show `fail`. In the following example the cluster scaled down from 7 to 6 nodes. - -``` -redis-cli -a $REDIS_PASSWORD CLUSTER NODES - -... -b23bcffa1fd64368d445c1d9bd9aeb92641105f7 10.0.0.70:6379@16379 slave,fail - 1645633139060 0 0 connected -... -``` - -In each cluster node, execute the following command. Replace the NODE_ID placeholder. - -``` -redis-cli -a $REDIS_PASSWORD CLUSTER FORGET NODE_ID -``` - -In the previous example the commands would look like this in each cluster node: - -``` -redis-cli -a $REDIS_PASSWORD CLUSTER FORGET b23bcffa1fd64368d445c1d9bd9aeb92641105f7 -``` - -### Using password file -To use a password file for Redis® you need to create a secret containing the password. - -> *NOTE*: It is important that the file with the password must be called `redis-password` - -And then deploy the Helm Chart using the secret name as parameter: - -```console -usePassword=true -usePasswordFile=true -existingSecret=redis-password-secret -metrics.enabled=true -``` - -### Securing traffic using TLS - -TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the cluster: - -- `tls.enabled`: Enable TLS support. Defaults to `false` -- `tls.existingSecret`: Name of the secret that contains the certificates. No defaults. -- `tls.certFilename`: Certificate filename. No defaults. -- `tls.certKeyFilename`: Certificate key filename. No defaults. -- `tls.certCAFilename`: CA Certificate filename. No defaults. - -For example: - -First, create the secret with the certificates files: - -```console -kubectl create secret generic certificates-tls-secret --from-file=./cert.pem --from-file=./cert.key --from-file=./ca.pem -``` - -Then, use the following parameters: - -```console -tls.enabled="true" -tls.existingSecret="certificates-tls-secret" -tls.certFilename="cert.pem" -tls.certKeyFilename="cert.key" -tls.certCAFilename="ca.pem" -``` - -### Sidecars and Init Containers - -If you have a need for additional containers to run within the same pod as Redis® (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. - -```yaml -sidecars: - - name: your-image-name - image: your-image - imagePullPolicy: Always - ports: - - name: portname - containerPort: 1234 -``` - -Similarly, you can add extra init containers using the `initContainers` parameter. - -```yaml -initContainers: - - name: your-image-name - image: your-image - imagePullPolicy: Always - ports: - - name: portname - containerPort: 1234 -``` - -### Adding extra environment variables - -In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `extraEnvVars` property. - -```yaml -extraEnvVars: - - name: REDIS_WHATEVER - value: value -``` - -Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values. - -### Metrics - -The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). The metrics endpoint (port 9121) is exposed in the service. Metrics can be scraped from within the cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). If metrics are to be scraped from outside the cluster, the Kubernetes API proxy can be utilized to access the endpoint. - -### Host Kernel Settings -Redis® may require some changes in the kernel of the host machine to work as expected, in particular increasing the `somaxconn` value and disabling transparent huge pages. -To do so, you can set up a privileged initContainer with the `sysctlImage` config values, for example: -``` -sysctlImage: - enabled: true - mountHostSys: true - command: - - /bin/sh - - -c - - |- - sysctl -w net.core.somaxconn=10000 - echo never > /host-sys/kernel/mm/transparent_hugepage/enabled -``` - -Alternatively, for Kubernetes 1.12+ you can set `podSecurityContext.sysctls` which will configure sysctls for master and slave pods. Example: - -```yaml -podSecurityContext: - sysctls: - - name: net.core.somaxconn - value: "10000" -``` - -Note that this will not disable transparent huge tables. - -## Helm Upgrade - -By default `cluster.init` will be set to `true` in order to initialize the Redis® Cluster in the first installation. If for testing purposes you only want to deploy or upgrade the nodes but avoiding the creation of the cluster you can set `cluster.init` to `false`. - -## Persistence - -By default, the chart mounts a [Persistent Volume](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) at the `/bitnami` path. The volume is created using dynamic volume provisioning. - -## NetworkPolicy - -To enable network policy for Redis®, install -[a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), -and set `networkPolicy.enabled` to `true`. - -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting -the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: - - kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" - -With NetworkPolicy enabled, only pods with the generated client label will be -able to connect to Redis®. This label will be displayed in the output -after a successful install. - -With `networkPolicy.ingressNSMatchLabels` pods from other namespaces can connect to redis. Set `networkPolicy.ingressNSPodMatchLabels` to match pod labels in matched namespace. For example, for a namespace labeled `redis=external` and pods in that namespace labeled `redis-client=true` the fields should be set: - -```yaml -networkPolicy: - enabled: true - ingressNSMatchLabels: - redis: external - ingressNSPodMatchLabels: - redis-client: true -``` - -### Setting Pod's affinity - -This chart allows you to set your custom affinity using the `XXX.affinity` paremeter(s). Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). - -As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. - -## Troubleshooting - -Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). - -## Upgrading - -### To 7.0.0 - -This major release renames several values in this chart and adds missing features, in order to be inline with the rest of assets in the Bitnami charts repository. - -Since this version performs changes in the statefulset, in order to upgrade from previous versions you need to delete the statefulset object before the upgrade. - -```console -kubectl delete statefulset -helm upgrade bitnami/redis-cluster --set redis.password= -``` - -### To 6.0.0 - -The cluster initialization job have been removed. Instead, the pod with index 0 from the statefulset will handle the initialization of the cluster. - -As consequence, the `initJob` configuration section have been removed. - -### To 5.0.0 - -This major version updates the Redis® docker image version used from `6.0` to `6.2`, the new stable version. There are no major changes in the chart and there shouldn't be any breaking changes in it as `6.2` breaking changes center around some command and behaviour changes. For more information, please refer to [Redis® 6.2 release notes](https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES). - -### To 4.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -**What changes were introduced in this major version?** - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- Move dependency information from the *requirements.yaml* to the *Chart.yaml* -- After running `helm dependency update`, a *Chart.lock* file is generated containing the same structure used in the previous *requirements.lock* -- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts - -**Considerations when upgrading to this version** - -- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 - -**Useful links** - -- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ -- https://helm.sh/docs/topics/v2_v3_migration/ -- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ - -### To 3.0.0 - -This version of the chart adapts the chart to the most recent Bitnami best practices and standards. Most of the Redis® parameters were moved to the `redis` values section (such as extraEnvVars, sidecars, and so on). No major issues are expected during the upgrade. - -### To 2.0.0 - -The version `1.0.0` was using a label in the Statefulset's volumeClaimTemplate that didn't allow to upgrade the chart. The version `2.0.0` fixed that issue. Also it adds more docs in the README.md. - -## License - -Copyright © 2022 Bitnami - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. \ No newline at end of file diff --git a/rds/base/charts/redis-cluster/charts/common-1.16.0.tgz b/rds/base/charts/redis-cluster/charts/common-1.16.0.tgz deleted file mode 100644 index 4d06e76ceb93f2d38ed42d25ab1865e90c30a959..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 14693 zcmV-rIhw{FiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBhciT9U=zP|%s7t3eb|#`EJ8@<_o4xBenHit%PJHcja%Q{d zwjmOd(53)30LsxMxxf7$yh!k+hb=#{Yko*%5-1c3RfR&KP>9%c%4qLsg18LlXqxw<8OI%zk`I^*!sr3ab~`9d^FIgS zU_b14Vk{y~QmNk^!VhG~5ud}~aWVzXUNB-D#++p-p<^(N2MHUK2!>c*VoYI3Bt=sK zkt#334#4{f5#~=I0w|LZ<1}G&G)yoI=Rl;u$tdhh*c2bYM9Neg^m=0=C)qHJ*tBOs z_6*3LB0mjDdwFnNIXpwBypz;ql`w1LY=PbYiEiGm55Nxb#;nVM_$>F02xnK=vT*7 zvuz8O@d#^h%WD>8E-x=bzuO%-Pw@dHW+Xea%7EWB>pnaic&z@Pp(MlNh9-a|`oBNe z->>Tb7kdx-|5l!@EvTr$tt~j#%9i8bGs1DK)a=o5@8~s1#u5RD#*lIrVIi;xRr&uE z7bFGz2~E=ke^9K{+1l#(e>>IG)k^0l*VH#oew|b^XMw2(6QjUdi=CXOZaDnFs@cA=@7kCa|zvf>6 zSc*B4j4OlMdu_UT;JpD*z2b>C8oSq*n2aa#00tfR zp<5rw3F2|vK&~{73c$^dqiI1^ar4pY!>Ayf;RHvL@%NZdEy26r(pWASy=x3yK4wbV z0|<gf}{v-o~3oD6mf23u&AdO&;jM z-L8&>t|-E3iM*DIJMaZ4p|R@jpkEeK%g~fb*v8XT&OM^-REt8&36&!VP@0Ap*${Jz zB^DuJy}Z%^d?x~*^0nqX{a)2Gk1p{1DLm3rtLR@JlqyD#jDpk3&em&GN4172nqrZn z2$%Gx(r1=x;VDiq5;%P8O4cDuma>G6=ie)JTPDba3AG}@YtCbvlg84lb~n;kOnbK{ zjq6Xa-DauVoXq{nXT_BT?)u`^AZ%9@wUq^}(qvu8))cW-1Z;swZA_YO$J8(_ZNSp- z=EBVx8lFfmvomga{a0WAM<_)@l5Efeuz3AH80$ynui6v(#Q!sond~&rYYhWf`1=`yMt~&sL%ZEd=T#B0QKw*foZZg8w{~TgP=^- zwz9#-XhpHSWc&3Ncg+ED5wKHQidRasX9fucx(pJGHNf&WOe`CWH ziRMb*CT|UuxwaaqT+z*u$LwKGFCB&^&Xd~;=%Bv5D z0Le2wRj6^v1ddJYr*#Yf5wI8T{W0tu!X=u6WDreobkS1!5}9aELM3N$7U38&DoK(T z*bDcTb5~CQ{2tI$-BiDuleEkYT9HC5L1DVjVW>3}c3v2>pU0Fim-}k~j zHTz_VR2Tq)fKZ9~2t`;^WW+KW2Y@+eij$wbXE4OT@s!PQ43`sZ1S3KcC2agyz?4uj z&1lnTJbALBQJtkJ<5GCImgK>sOz?So_H)1c=YQ@z`T75T{pXXfUmpdqT_O*B0m;rJ zSCp`Rdj&_c&mwNSYhT%a$EWW9)r_^V*snhn)}f$w??#=&^i1MCv5i zDQ|Hro8Z*N4Z8**MI4#nt1eVqgD%*qpbM^M2tOzU*vKobrfEXQLKzNvzEd{GQ#JVz z9j$Cwk4U&=^sxjv;q1~)lB!*cC3N8^|5dbif;gtq6>2vSmyxvC+pCgFZ^Qq_2-Vy6 zbt?Efmx#s<^=n(d$Kof0M`{1zk;c)|^x!1~ztEGzv$K!yPG6tFo72;Grw8y4mKk|W zIh&Cf!<=OtqKs=Q6!KdUa%ER=+j!94=u2x#mR<(GP^dm{nZ!mp;2EZXMiO)2SQ%F+ zNp#_y z!?WH~xBti#jW-wj|A*!F-?L}WU)1cs{__X>?>3$_>_5-zl5&bAz$~b^ic8Nj*J~DCU=GKcA@V+-X=@mC)EjKaIORA(62}Li z9V{ij;F!jkpJYj5Y6<7I*;&A@X;Hkww7Fs2%D023?ca8H3a&24sI0=`C9FIn(|fO& zQlqD6TIDsL1MRs4pQU^nb@Q0SS_>}$rKuXX(%Z0+5zBvdN==(im8#h<=`A5bMzHP2 zk$PZu^mtUsa!|pv)Ua;F9o^RFIx2XS(AXURW3`AxQYjs~(pKiMo5~k3c}+4l&gzv# z;S%<4z-Kv=+plh6r*yLWT^eXtqCL3G4ryb#4G2hWS3stTbq$z~mz@Fugg*V;KEcj? z5wlzG&OH*=yEfN0{xsPCHgsci3xK8e|6sRz{&&!S@c-V*vrhc)-?ZOCVi=<6LP-Rs zYD&@$93qtQl_E)o2{zkuC`tSP;lq<-xBDb~*Kd7}vJ7Zj$+d|vTin(YYQNgQ?6(uf zW%14aRrODvc-}}4X6}d#_3R341c(CuM1-DTZAsU6zqV>8uiZPQG6elfsTkO19B4Kj zV!oq5stMj!3*lJ8B}oz(VvrnBp(HQ{$si^pefn6!98D95vC_f{i`?CbtUnYOS7;I{ z@fg=!ov#()d_U*=3C=&eO-LvExjDgTy92Z~IQhEB+kHQHxnw82DF&@^L!5Eg#=n<< zH$^M$)JwI87MTXTkvG$T&kDtNHISw6dSt8XAp1?9Ic@_8kSbXILQsj?v4Fq~Wl(Fw zodaq_pcKh&N#y_%D$CGzif^NYA-Vso`rS3BS+(Ba7sX-?Gv(q{-H8b)kX)GoHZnlz z0cA42pQjk~eum;_yTgp*6%>QpjXtqZ0yBp%W7&E&kI}XpB4qxwc7#kVL}r8%ffomB z7~)(l%EET-C_zGKZF4Pp9#^2PN!NPy#Q{j`llR7{n-e#}Tz033qOsnQup3%lvNWwd z-~Vt1f{ZDSJE{U1kx1E4pt`80Q(_i$mN0(x&M6)hX}$c`l%|SVBzl<|x1J?(Zz~_r zt`BDU;40WZ8qjJQz(N*lJr7cgH_qv4uj7l?a|>E^yOc&%O_2B=&!Gf5s1hPdG9fWH zTOnMj`IV~W#XWuX5M9#v)a`$JH23!W|ARrz{(rW=zxQDO-^R0s|KGFag+w$)JT}L_ zMXNfnyyS`-9Z)}#o!dB7C8iHShu&N?!O1if6O+4eK^6Vo)~UCrH<)Q;?JEByb#r;6 zTH@|-Uanz-Zks)N_9(by+B40lJ@gZb6i1=3C+7VV@Os-{%%XCMWwb3Fp}#J9*Co}1 z{`}UTy8bszu|f5})c>=;_q?kApFhO^-OjUy{(ti+RT@fJwA4CCbfB?L9o?#?d>zv* zirAyjx~|qH&iqs*-_0=RB*ySXnQb(J{XPAYOwY2>hx7aMB4FE+>h;?* zRaSe#QXK7so#T;<1v5bMAbXGYq;PO)y6Z4{g}lXfG0j!M+CtLtiTjxIO1E+Zu~uLu zy8BDWN7P0Htjw<-o;f)Tl=9S><63&VHiA_yEI~8vuET7LSIA45(0C~^jppAZFSakG z4L26u^BB|Rh*Hg1S9DR%#^srkrpyPM>BezSweZRtrwefMg~e-hfy68 zRncimdE_DA^!3`J)ChIcB6XM~?9z{_EwVn@FlT1S6Jv9vZJH&Lbc;eoS^#}kC}Pv0 zjy`qy^OsM`8cw5v&A+y4*!B`7(l(^3T0`5kO?CPpmyJpG1BM@qf{3e5Fin)GFhtEy zS)HQ7owhO_@Nj1>?zsi~uWtXF^9HxK|2ufre^!nEd_L$u5g6TZ}xoCs80;&sdN-ui(*^_svITdR5 zNEJ55?!f*Qu!|zp@4Y({U`%G1x@AQsFt;iAa%;moFsh2UsgY3}f}RGiaUyPqBBruVbUJX$khmaF~Ju5~_#HV~);`ek)~ zv8GPF-kPh$u00Z6<@;iO*O64Uo#$e2&D5v9jpc9-nwdE-P}MsZ zc)pU_(HSPMp><4#$_uRHn1ct^ayzQ!0?(U|1itlrPO6a87`p0m0oS9MbEyJw@Y3XX zF9~jg+>{f~)+DD~qa4;)hp1Zo5v8d+DBwk2DqLOyp)vlnsMez#>Gt5srQ+s5ESI+Y z5GUinvE&5Lu;ML!PBGya#dCLbt@SkIhIv&NB@1XYEkAf8f~ zg}4fbv?EVhRu|&0V?VWk<|2!H72ul=ilh@{D`fa-wcpsvXiijHu(8v7A)IQ_Namij zRLEs}d->H-k2!Wc{GzG5#boi@A3Sv zoK2Nh_ix}40fZIR?@eIEa;2@=4=$^HYs0#PYWjQ6z}C}rV;>f_ZieSIl1Q(%62>mF z6oQ$WzMZZ9XhF_VaX4vGovg$3L%+2>-XyCeMT3vkH-bMkpjHh>)s_0!yS??(87Z~n8!!+{m z7V!J+oinT)p28Fj6C9Tan+w!SUy9mJ{XBAEmnWWhR&%E`bDT3J9r;|^6ivp!p%Hi( zH881v0@W3Rb?amEp&@mMNy*ZTh__1FR0^1OTpH!Md|E5CmRM!*&m_-# zvYoI?%wb#25r;`SK`_|aF@L_zrkIlm20O5wrD?s?7n?`r*Pu;qb$JmHQq#e074R5; zIyD>hhe`4Sk=i>I{PN33j}{R8X8>Q6(IzB^=c@uQR$hATWhqgVC<&aHWTR1n8%3{K z>C`%|2=z9b*3er3vN@Q)v}8Mi-v9Ev|Kef)?^d4m^S}5x z3eF6#fIjonsJ|^UMXEq?@FY*qr8mVJeDPj^Rg=L~nktre_JhVzJAFOiVd-PHp1Gy! z&9zAZYSsK(yvi-UTwH147Kzr?^;-7RHvV021C@&GRNTsL4)@ELLyx}%zXX1s1>de% zR@WFZ&6u_J=3z3qe@|Wi7ug&(H3KZs|NZ@bE&k)#^ZtYWzl~=t{ZC`eb8n(?*5
}tZ=! z&@|a;u6>X4iqz%b`1x-0{71iE%m4g*|Ka?{tvqYUzd6iLsL7YFPu@xfW3`@lt82Tb z*RBB!bJ=amF_u>D7cc8w(qsEp*Xg>KE9!-ohVvEn3~?9p(~Prj?>&1%XCDxE*LdPj zDdW=K>uLae{rd9J_C+?tkxVpkoa4a@+gj3hB&I)fSFX8X*9mmm{&zjWj(R4~KlhGIJJ<{QDw z$D#ttbA#$HIs__Bi1vC2^+V@`R`#y#uvbI736GG#f2~#3-o|bipc=RZAt49)gq+BeG;IIc5UfZSgw7OvJ$s*f#-uVAL?kG zbvd!rUNzdwc3*G6=ifMgB;puz%W8WiIoJRtNcN8>V67#?ww|%hF?qN~l;^ z-#c6A!M8#O_rvmhc<#efxBo8@r-Y6-xCB`0|LxcOzq`*L?*G1(XAS%RqhSm{LzYQ< z;R|O;qEBI=@glQ7=P6tMJsK}a|9#4sT%_$Aq4_>jL}S>_JrjWoIu5`~=)GfeidM6C ze=&Q(e&{cKCI`*$zAy>>%$9jF2aZ)YF}2}yXvRofr?$NtEY%m3>A)~dXM{6q zj!o#`?DiWdENw6s?h*nKt6$tV0 zCxQ71$0PD-B`_Cw9-2xONG@W~k0mVDM#cGsN}J`dHf>fgZVZP<)pI{O18wyTncidF zaUU%~Oj647NugR~pQt*o)`^O&b+V_K73}@wskU)DlT)#0(ErE0G9`K&}jEQv+`$x9G}xWAC(E^PsOj7!J+~qu{#= z+egH8Yys^{K1ZebT0*^>Jl@x(yNif7GM0WWX!8l)-;^u zFArg!56_bI-xP6z;^8%2flJnZFZOq<`5#~GJ%3pL-O6*7_1}+*D_+0a`0CGb+r3%) zxsJB3{PgMP>#h1+8#lA&Yar=bD?V4>fQL|LlDIlbt;^z4!S~dr+}BWk1tu(N-2j=Ia9T{U z|0#}~Rc64A`EoXB46K6p6`VN^Yy-TjIC545vtc)m>%rs=Kp!|aQ@>~o-6r(6j!`{^=}-H|FU@}kY&01;{@`1+wKW6 zXkXJ8 zy>yFNRrf!@EoLhCLUx^2b2!VLaf-7lU9RAA^FF!CjCQYlasta0Tylk4TIP(iC0Ag2 zQ@$&(?B*$@H|T-0h&=e-Ry8&@=X=w}*Ki}t#uf0sici3T{kDB?wi9cN`&E5!El{rO zd$VBgx$kXd4^5i|eUl!V4X<-r`>@PS;|bIi+%z}p5?!<;`F4lq`hHP2WH;{@y=&LZ ztvpNoe>%JWbq|6ri~o9FyZ`saVE5tt=dCrHH@>E&bKd4WO`Dqdm*aeu6_y72ZTpyX7giqatNNE3VO-a{q=DXZ-_puX zjCRxQCS4deBVO0`To}3f#^bq~&FF7#G*@>K=GyRn$8lZtS?vEwnUG_SujvF@68|;W zulj#>`-6w`f4B2o#s70+xZ)<9Kpw;08&6PyQ@cB;D04lZkk{7DIEI=Dyq0&!198nX zFb$9zT}1inGB58hzm`K)+TOhtg`;Ch8{S%JL3B}bYmJVTusqq^p*N*otdX+q%lvxr z_H}K8Y-}jSOdX4|d&N@78_2b|&>zKO^vZsOh9;`xv4Gg?IusT%=Sm}Rv+jk(J-bhi zhO3#+F^))#^E>XaLQKtw_Oc+0=b|~U&TN^$p}XOzl#}}c&%12Yb>9}vYps{&>&)Wz z-hYR!xq+8Zi?y4=DoVU{Qd!)CvN>H@#I)S0)L6=E$74^!Df))|rL}B|Zr|BZ9`!r( zH7%b(*YiXyhv!XnhET27{I0>E)kc;F%r>u-T_W@C>X>@CH2aWt%H3J8o^EYpUBDZ5 zRe4=plVh&tv|0e@nw~3vurA-Y_H zXj{21nhW?Ad>Kn?CS&08vlC+hzYqL;ui#MQ2d}H-$s-$f0e#2bc*q_a5H=odJ zYPu@aC7?E}@BG%%tE;@mwe2^|F0Fl9!ZIx^kygaq=Z8h*?#6$-*#FCMOs;v?=l3peBJtr2rIx2&nQ znn$)Z;I0JZ0?$R5>arC;`pOB!$-i*?0dvvfqALOOs)RFBCop#*wfnH8vM~7^wu|65 zeI-(*A3;+P#m>@N^$Pg+#;!TnV4J(W)vjJ84y@`dZjJ)02MNYR_|C_*NR_(~mlMe^ zx-xl6SpFpNVJ0W*kEdnfDQ1Ub>vj zjA!nWbPF-l`;{rJJu-IUyumfr#;lO`X}^7#O&x#C7L)#Hf};zO@4{$$Yy36D$HGxm z7<*jzhiE(}_1FV%p( z7W9g9M-|(}<_8(IHSbHTV(%rwc-QNvZ~a-k{`cpyt9t>KtpA_w@Aa$kU%UHz59|Ni zc&@Vix65HwMlbY-xW3jmw!1E`1^bB6QNOR0%XZb|%P;-auY$I6vSf8)?(jh58l9m0^I?o9taLo1Gl*C-z!v$($vkv8H1Sicrr& z3Fl~zL=G3IgBn6b8lOXU84F^xo8WyJxk1?ng6}pBPo*V5hQDkujD> z8RwW5PQ@UoI&Kh+bIoBjM#X>PT56-3uJoS0p|cN&`$3W|XcTK0cwa1+BU8k%_Q5ao z7wV!BzZ1XEhLw(K++eOo&Qc)UX$kZydjJgh$KQ#^b+wjX(2U|39(TLSEKg%zw(jK25I5wJ#y`?0RE_J26R$&`#K<9PFJEV2Ll&v&c$|L(r%KYy_Q zZ{yj56C{!Z0IAth9KFq6;*}BJ6Cz`w0;svNUB}3J?>VBs%5=rbtE; zLdQ>m;{-`Ev(skr9?`h71r(1>l=QZ7P1tBu_+L9Ayran+7}YfuN|0g>386Ubgs;zj zJyVlhXA6!r%fg4FGl&Tnop4NKPycJs?}WpD@t*$Iy_k%9>L2%~n9*JVXo#YVEY)it z(RmVz%e3<(9HNWPlTc36&XfPw*@6#<6P5`$e*H#t!j!Y$a3nh+i81P#a-99v31=c= zG46dsUI{Dzr*95l|M(`H#y8Q%V)@@6?Cw3Q%71_FLH=*$*@9O@QZyw_8h#){uB?_L zHIa2Xhw$^?aWXBx{^#~Y%2XWmdTQDT#iSRrNc1F2NhErSDf+9P3Po>AmD$n$?=fdt zs#J>MI!M@ni5-Wvc5i#|`PG@Ti-v98I*QcG%`T4oBtUEDIF^w^e2)5R{np+Pn zJU!1_SLy)_!cXBR7j?q~k&Mp|z#(oMv2BJCoA&H))tGK^h{UAx2o(B|H#~1#sZL|x%2d?ex;ZTxSWt^0uiFh z1k&z*eb8Zs6P5zSmv%fLQ--zShT8b=xJd%0h@vs(VW;z|G@PXdw8sDW`)r6&nu-G2 zg?*!k!>~+@(}c~Z$~aWUssXS6WFyd=d1T-d3Q>{?iMa^PG^M{9GE9(wq2e)#g<50i z&6-q!_}QVUu;CO-EZ`)kC7fndk|{2um~s|}g!Oh{`_=a+r#m6M)>wl2%k2W8OtPt7 z(7gZQ3?j@W8IcG{ES@U9A1h+&9xJ7*aOl;&Y#Rt`=$*1iNmBo>`c*GG2{ z4*vYdPS^BzFWe3Le>8Q}A{Q%yD3-u5VoAa-RYMXD6Rh`-%@&Dc1vEn>(ckRK&x*3; z5gq>$u@vi-VN6CNtgUu|qXN|}I2?@#C6XvazbLHKG)`hn6$LN{|M>#1v4}X)%S2fD z`2ue~r8rX5J*H_UmsjX~=`Mbjecx2IFP$%NZbcsDlnN<})!LPfYF9%+$?}e6S=;?xgTHs*LUv%>u3?q?-;x~JPp*p{}t?=HBv^_;VDd94>4OodO@g{F0*1T+za>qxE?Lr@zf^N8_pSD z%XqqRt7%iu+H0ZJpsr!R-MHblspn=8^+f?|J`1yS%u$SsqZej7Qt7^936~^E08^3a z1162KV*SQ|)LsMQ)Cl2t1n0#DsA2JQXG)rlMPgf%6V5IHQP2o#$Af+^ zBukAL8jJzyrF>YdRjLhCLs;AgFMuU~HQ0gj(#A^T@f3}hFJ*4aH*n==nT*_)OX13o z&$&d8iTSV5l2r2wHmozsk_2=~?ar)^faM)s;3rlP72T$9-?d}w`DQ7u3Z|Zmr ztE+e4Wr`_IzKPs#EH>ZCCJkZMChK`S?qbTmJ#DkGXFb=miCR zFpbX}h5-I%W48b~!L%$7wiaNj1k-FhscD}XF+Myw&MoEjhTTc6FpCuzRmWJ6zdK<% zdTxk#V3o0I@@I#dQ;Vu?$|Q*@8zaU8782GQCT!f>?GOIk>%Zs?{?tP$>3X$Am(cE@ zJJ|1eYJE;6`jl@gL|8x*QQi9D1j)(!d5X`y4xVsArEte$>;faT1zk*A9>0L&4aic% zlH;B~i->9m`Y1s{sG0q|ji{tjaHGWiZ$i`vbNQp$4n4)cXIRL>uBs6=Uk9jKUAv14 zh*Bo)xg{kh?|(Q0LB`aUb32M=XAVoZZRh0Gubzv)_p-$-bDqVbV1o*~6{2ce;0H9s z$xW>m+M2$?md0jht!0}PiKdD>MHZJmR^E1mD*&d#S~OVf_OTe~2rn~6N?n*=AelCt z8HID>w+}^%qfp=kN0RY!Ew!dN7qh5b=6sPuM_a0^nTMO=jH_>RZHhCN@q`H>F^anZ zcSUBU9;g?Iogea4qjm1ofhzHChB+s38PqbKCwSf2$%L74wHmk+Vi3&$Tu%%b7V5p=@>6yl=W!fqvFw^t?z(hZS9#! zR!Ed2S_MBA9RR(ztXQt8P`<(S z)tZkl4d#@9uNS@LS5+U{BL$1c#+g#Jyyp$pR5j^`ReoyzI?G1-aCR`A=RbX4h<1j( zDb@ey_Lc)EY-*7Px7a4QuSUKLJkK|Ba`M@;BNup$4Z3TQFHeoEm#=q8qeVUR$X9Fu z7^D8YfqeOqC&qze$qAle9SBcGfD(>TJcmfn9C7Hc<4dRHx;BMonL-fQ5YYHTIsD2I z*|j|g>hE@g9S9Ok$8r+DpbvqNoY8TSZAqw!)8{0m60R{OlO2MIyI+(Ink#Pw1I9yB9Ji| z)(i(TEZdYoV4X?6-i^uuI;%}$Yq`tXr1xf zOscT+)kt+OpJn4$$rmN;)~7!6>$6i^gsmQ-9~G3>uPVvvuRg4G>&)WWEu?Ni-q!O% zcJfFHCqTw!rq@bCY+~mXKH3FGq>T^~z^F|ZHD{S2KqfF)EbOYu?Eo4w-H<+7Hh!hF zSR(f+uQ`7DTIfxUUgP-b6jygVdJ2boGr(Q zxt3dGsUu;9MfPwdl^to?9m*M0e_NL%&&mZ4(-Q>$t9YL z$3R8}9*Sm<^&uho_^G+fL13wiACKNLdBU;4R6aKN*g&xYA;dYFcL0dQCOPk7OkHl- zWDde1O$`uWqXK<*NNc;e0K0UaDeQD&Jj^_D56w*(HPV>AxYNs8U1{x>kP96^sJI({ zk{kh{BgUuZq=ZRyCj3D%cW5ZyKBOkhk4D%68{&h`R?e0_$8D7|nU(ovOVPh&^tZqp ze(*=4vjwK>79*QaYzw^o;zF|Q{U}T6O_(rw zhzkTId|*j7#pR9jr*J%SyccwXr{Fj9R;OSK0-M$Exps^HJkHnISQ;` zTb*%lNiY56)Gm0;#RB@Boz5-v3q1c3r759WZIocy_jz7J1Jhao7kF;td>ewX)ki|x zkTCe0&9{ZbHYo;kRJXuKb_*c4DpetOJ(mMKm3(Vj%tiN---Du~YU zs%24In0}@{Li5eery$rAgCtWd6o5-awNQ>#ZF5L~n|=M12|;ukiMeUkhCvf9s?-o+ zF}hoYChu8V>G$1kw>d4NrOMTFGJ-uyVP+_lrmI&qL-;O5zh^kl?O2S)=g(d|g*E)Y zz;OQ=rjfguUMC3mI~}J<(c>@-ZT4+UX9pc;NxD3lCx>TeAK#t6?i5Dm%x(N0bbQ;> zkW$~nHY$HvKrTPhHqW2l7UkJ`UEw2}P~Cqn@O)v57hb~lRU330(D{9TU%zVlb+-I$ z{+g^6i7E^KGHHU66W$8g+jsBZoQ3j}(Nhtlf+hGm_onpww|jF+e{hAnQ&zk@W$Ar+ z*SphqBLwaNvu7up_7clbZ#$0 z&>7?_L-jHUo>r*&G6*!!KduyAF-3i~fk#f%e^nqVY3til?{{*!!=F;dC3s+7KH9#> zhB%UmuI#R|=oaTv+`*oL8=%YJH^Hbv?`7~gR5~y8`0#6>6dV$G{~2`SolX-823I1% zz$d|AGb9+?00{c2HW-t^Anb?zPUq)$6yCBKo(?gG!QNBY?eF%V+8j!| z?f@=aB7J6bsuxHjLW!8*xHzvpCUTMub*5d#yfz{7mXJthqRU2IIl*0<=zQlX$O#cJ zMZYob=V>xWsf6mVHDQW#tP@1XSeRV4CaJLcUZm``Ql^&(k}0*oc*^oa8AW>85k@lO z3RE1M)U&3md&Y*+P?RKEqgRLZ$iIuUv45dnh|NZ1ir_+TK7k_SF3quZhA41+IxW1$eJwFy8C6AyLFf*F)%Qi%y&Zg`R|zH#TmR^=5ECTC?&R2CYWqTuX`gz z6;H)5WtvLGYS%b|6m`%2bY&)LuhWH}6cvmeWU~vO*KnHcg(b8`==a{1E#1|~buE`K z!A3RszRXPKz(H!(zs}lzq6w?#`zQJ$fFffw<2E`qNhfHCC5f~^X%lzCrfiHURwI9j z<|S9F%PZ~Ws8%d?q!=~E+@8wT8J>#NPFhGv&PIm0j;*V~TFx$0Q>Cm4(({f&=<_3n z5nRe`D>qLyJQIFPA4?c1#f9h`h!7bTt2b$EbSp)cPep_&;)LZXP4j#JNR(^G3=7q~ zQ&>(K5uK}XEYK)=VdCV=vgUWq$c#c;EW*1?3_Fu>Ji^?msh`O6_v@65%@Fst@}J#I;BJHj7CTl->?b-lgXj7n8O-(+v-~9RC`%wA^gZNi5liQPQM1>sla@}$mWv^yvAx^%Fh$V>I|xs~ z?GF1ol&~^Oug|mnoWS*2{Fv5fMhB@uvuwR6d-A=1VxX7UhneqGDI57knwRZF{MQBhvTC+Z_nOzch$806HTxX#RNH= zyFBkY89TZJr9H+R8?8<#Tyi4y)hU9FMnF?|ym@9}iDY58u8&esc!zPT}a?+t - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. - - length - int - Optional - Length of the generated random password. - - strong - Boolean - Optional - Whether to add symbols to the generated random password. - - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. - - context - Context - Required - Parent context. - -The order in which this function returns a secret password: - 1. Already existing 'Secret' resource - (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) - 2. Password provided via the values.yaml - (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) - 3. Randomly generated secret password - (A new random secret password with the length specified in the 'length' parameter will be generated and returned) - -*/}} -{{- define "common.secrets.passwords.manage" -}} - -{{- $password := "" }} -{{- $subchart := "" }} -{{- $chartName := default "" .chartName }} -{{- $passwordLength := default 10 .length }} -{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} -{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} -{{- $secretData := (lookup "v1" "Secret" $.context.Release.Namespace .secret).data }} -{{- if $secretData }} - {{- if hasKey $secretData .key }} - {{- $password = index $secretData .key }} - {{- else }} - {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} - {{- end -}} -{{- else if $providedPasswordValue }} - {{- $password = $providedPasswordValue | toString | b64enc | quote }} -{{- else }} - - {{- if .context.Values.enabled }} - {{- $subchart = $chartName }} - {{- end -}} - - {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} - {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} - {{- $passwordValidationErrors := list $requiredPasswordError -}} - {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} - - {{- if .strong }} - {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} - {{- $password = randAscii $passwordLength }} - {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} - {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }} - {{- else }} - {{- $password = randAlphaNum $passwordLength | b64enc | quote }} - {{- end }} -{{- end -}} -{{- printf "%s" $password -}} -{{- end -}} - -{{/* -Returns whether a previous generated secret already exists - -Usage: -{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} - -Params: - - secret - String - Required - Name of the 'Secret' resource where the password is stored. - - context - Context - Required - Parent context. -*/}} -{{- define "common.secrets.exists" -}} -{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} -{{- if $secret }} - {{- true -}} -{{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/_storage.tpl b/rds/base/charts/redis-cluster/charts/common/templates/_storage.tpl deleted file mode 100644 index 60e2a84..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/_storage.tpl +++ /dev/null @@ -1,23 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Return the proper Storage Class -{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} -*/}} -{{- define "common.storage.class" -}} - -{{- $storageClass := .persistence.storageClass -}} -{{- if .global -}} - {{- if .global.storageClass -}} - {{- $storageClass = .global.storageClass -}} - {{- end -}} -{{- end -}} - -{{- if $storageClass -}} - {{- if (eq "-" $storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" $storageClass -}} - {{- end -}} -{{- end -}} - -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/_tplvalues.tpl b/rds/base/charts/redis-cluster/charts/common/templates/_tplvalues.tpl deleted file mode 100644 index 2db1668..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/_tplvalues.tpl +++ /dev/null @@ -1,13 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Renders a value that contains template. -Usage: -{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }} -*/}} -{{- define "common.tplvalues.render" -}} - {{- if typeIs "string" .value }} - {{- tpl .value .context }} - {{- else }} - {{- tpl (.value | toYaml) .context }} - {{- end }} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/_utils.tpl b/rds/base/charts/redis-cluster/charts/common/templates/_utils.tpl deleted file mode 100644 index 8c22b2a..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/_utils.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Print instructions to get a secret value. -Usage: -{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} -*/}} -{{- define "common.utils.secret.getvalue" -}} -{{- $varname := include "common.utils.fieldToEnvVar" . -}} -export {{ $varname }}=$(kubectl get secret --namespace {{ .context.Release.Namespace | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d) -{{- end -}} - -{{/* -Build env var name given a field -Usage: -{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} -*/}} -{{- define "common.utils.fieldToEnvVar" -}} - {{- $fieldNameSplit := splitList "-" .field -}} - {{- $upperCaseFieldNameSplit := list -}} - - {{- range $fieldNameSplit -}} - {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} - {{- end -}} - - {{ join "_" $upperCaseFieldNameSplit }} -{{- end -}} - -{{/* -Gets a value from .Values given -Usage: -{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} -*/}} -{{- define "common.utils.getValueFromKey" -}} -{{- $splitKey := splitList "." .key -}} -{{- $value := "" -}} -{{- $latestObj := $.context.Values -}} -{{- range $splitKey -}} - {{- if not $latestObj -}} - {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} - {{- end -}} - {{- $value = ( index $latestObj . ) -}} - {{- $latestObj = $value -}} -{{- end -}} -{{- printf "%v" (default "" $value) -}} -{{- end -}} - -{{/* -Returns first .Values key with a defined value or first of the list if all non-defined -Usage: -{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} -*/}} -{{- define "common.utils.getKeyFromList" -}} -{{- $key := first .keys -}} -{{- $reverseKeys := reverse .keys }} -{{- range $reverseKeys }} - {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} - {{- if $value -}} - {{- $key = . }} - {{- end -}} -{{- end -}} -{{- printf "%s" $key -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/_warnings.tpl b/rds/base/charts/redis-cluster/charts/common/templates/_warnings.tpl deleted file mode 100644 index ae10fa4..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/_warnings.tpl +++ /dev/null @@ -1,14 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Warning about using rolling tag. -Usage: -{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} -*/}} -{{- define "common.warnings.rollingTag" -}} - -{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} -WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. -+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ -{{- end }} - -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/validations/_cassandra.tpl b/rds/base/charts/redis-cluster/charts/common/templates/validations/_cassandra.tpl deleted file mode 100644 index ded1ae3..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/validations/_cassandra.tpl +++ /dev/null @@ -1,72 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate Cassandra required passwords are not empty. - -Usage: -{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.cassandra.passwords" -}} - {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} - {{- $enabled := include "common.cassandra.values.enabled" . -}} - {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} - {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.cassandra.values.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.dbUser.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled cassandra. - -Usage: -{{ include "common.cassandra.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.cassandra.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.cassandra.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key dbUser - -Usage: -{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false -*/}} -{{- define "common.cassandra.values.key.dbUser" -}} - {{- if .subchart -}} - cassandra.dbUser - {{- else -}} - dbUser - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/validations/_mariadb.tpl b/rds/base/charts/redis-cluster/charts/common/templates/validations/_mariadb.tpl deleted file mode 100644 index b6906ff..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/validations/_mariadb.tpl +++ /dev/null @@ -1,103 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MariaDB required passwords are not empty. - -Usage: -{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mariadb.passwords" -}} - {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mariadb.values.enabled" . -}} - {{- $architecture := include "common.mariadb.values.architecture" . -}} - {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- if not (empty $valueUsername) -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replication") -}} - {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mariadb.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mariadb. - -Usage: -{{ include "common.mariadb.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mariadb.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mariadb.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mariadb.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false -*/}} -{{- define "common.mariadb.values.key.auth" -}} - {{- if .subchart -}} - mariadb.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/validations/_mongodb.tpl b/rds/base/charts/redis-cluster/charts/common/templates/validations/_mongodb.tpl deleted file mode 100644 index f820ec1..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/validations/_mongodb.tpl +++ /dev/null @@ -1,108 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MongoDB® required passwords are not empty. - -Usage: -{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mongodb.passwords" -}} - {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mongodb.values.enabled" . -}} - {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} - {{- $architecture := include "common.mongodb.values.architecture" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} - {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} - - {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} - {{- if and $valueUsername $valueDatabase -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replicaset") -}} - {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mongodb.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mongodb. - -Usage: -{{ include "common.mongodb.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mongodb.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mongodb.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.key.auth" -}} - {{- if .subchart -}} - mongodb.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false -*/}} -{{- define "common.mongodb.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mongodb.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/validations/_mysql.tpl b/rds/base/charts/redis-cluster/charts/common/templates/validations/_mysql.tpl deleted file mode 100644 index 74472a0..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/validations/_mysql.tpl +++ /dev/null @@ -1,103 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate MySQL required passwords are not empty. - -Usage: -{{ include "common.validations.values.mysql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where MySQL values are stored, e.g: "mysql-passwords-secret" - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.mysql.passwords" -}} - {{- $existingSecret := include "common.mysql.values.auth.existingSecret" . -}} - {{- $enabled := include "common.mysql.values.enabled" . -}} - {{- $architecture := include "common.mysql.values.architecture" . -}} - {{- $authPrefix := include "common.mysql.values.key.auth" . -}} - {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} - {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} - {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} - {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mysql-root-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} - - {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} - {{- if not (empty $valueUsername) -}} - {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mysql-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} - {{- end -}} - - {{- if (eq $architecture "replication") -}} - {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mysql-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.auth.existingSecret" -}} - {{- if .subchart -}} - {{- .context.Values.mysql.auth.existingSecret | quote -}} - {{- else -}} - {{- .context.Values.auth.existingSecret | quote -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled mysql. - -Usage: -{{ include "common.mysql.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.mysql.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.mysql.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for architecture - -Usage: -{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.architecture" -}} - {{- if .subchart -}} - {{- .context.Values.mysql.architecture -}} - {{- else -}} - {{- .context.Values.architecture -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key auth - -Usage: -{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false -*/}} -{{- define "common.mysql.values.key.auth" -}} - {{- if .subchart -}} - mysql.auth - {{- else -}} - auth - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/validations/_postgresql.tpl b/rds/base/charts/redis-cluster/charts/common/templates/validations/_postgresql.tpl deleted file mode 100644 index 164ec0d..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/validations/_postgresql.tpl +++ /dev/null @@ -1,129 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate PostgreSQL required passwords are not empty. - -Usage: -{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.postgresql.passwords" -}} - {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} - {{- $enabled := include "common.postgresql.values.enabled" . -}} - {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} - {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} - - {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} - {{- if (eq $enabledReplication "true") -}} - {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to decide whether evaluate global values. - -Usage: -{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} -Params: - - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" -*/}} -{{- define "common.postgresql.values.use.global" -}} - {{- if .context.Values.global -}} - {{- if .context.Values.global.postgresql -}} - {{- index .context.Values.global.postgresql .key | quote -}} - {{- end -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for existingSecret. - -Usage: -{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} -*/}} -{{- define "common.postgresql.values.existingSecret" -}} - {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} - - {{- if .subchart -}} - {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} - {{- else -}} - {{- default (.context.Values.existingSecret | quote) $globalValue -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled postgresql. - -Usage: -{{ include "common.postgresql.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.postgresql.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.postgresql.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key postgressPassword. - -Usage: -{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.key.postgressPassword" -}} - {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} - - {{- if not $globalValue -}} - {{- if .subchart -}} - postgresql.postgresqlPassword - {{- else -}} - postgresqlPassword - {{- end -}} - {{- else -}} - global.postgresql.postgresqlPassword - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled.replication. - -Usage: -{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.enabled.replication" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.postgresql.replication.enabled -}} - {{- else -}} - {{- printf "%v" .context.Values.replication.enabled -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for the key replication.password. - -Usage: -{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false -*/}} -{{- define "common.postgresql.values.key.replicationPassword" -}} - {{- if .subchart -}} - postgresql.replication.password - {{- else -}} - replication.password - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/validations/_redis.tpl b/rds/base/charts/redis-cluster/charts/common/templates/validations/_redis.tpl deleted file mode 100644 index dcccfc1..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/validations/_redis.tpl +++ /dev/null @@ -1,76 +0,0 @@ - -{{/* vim: set filetype=mustache: */}} -{{/* -Validate Redis® required passwords are not empty. - -Usage: -{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} -Params: - - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" - - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false -*/}} -{{- define "common.validations.values.redis.passwords" -}} - {{- $enabled := include "common.redis.values.enabled" . -}} - {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} - {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} - - {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} - {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} - - {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} - {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} - - {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} - {{- $requiredPasswords := list -}} - - {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} - {{- if eq $useAuth "true" -}} - {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} - {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} - {{- end -}} - - {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right value for enabled redis. - -Usage: -{{ include "common.redis.values.enabled" (dict "context" $) }} -*/}} -{{- define "common.redis.values.enabled" -}} - {{- if .subchart -}} - {{- printf "%v" .context.Values.redis.enabled -}} - {{- else -}} - {{- printf "%v" (not .context.Values.enabled) -}} - {{- end -}} -{{- end -}} - -{{/* -Auxiliary function to get the right prefix path for the values - -Usage: -{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} -Params: - - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false -*/}} -{{- define "common.redis.values.keys.prefix" -}} - {{- if .subchart -}}redis.{{- else -}}{{- end -}} -{{- end -}} - -{{/* -Checks whether the redis chart's includes the standarizations (version >= 14) - -Usage: -{{ include "common.redis.values.standarized.version" (dict "context" $) }} -*/}} -{{- define "common.redis.values.standarized.version" -}} - - {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} - {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} - - {{- if $standarizedAuthValues -}} - {{- true -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/templates/validations/_validations.tpl b/rds/base/charts/redis-cluster/charts/common/templates/validations/_validations.tpl deleted file mode 100644 index 9a814cf..0000000 --- a/rds/base/charts/redis-cluster/charts/common/templates/validations/_validations.tpl +++ /dev/null @@ -1,46 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Validate values must not be empty. - -Usage: -{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} -{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} -{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} - -Validate value params: - - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" - - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" - - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" -*/}} -{{- define "common.validations.values.multiple.empty" -}} - {{- range .required -}} - {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} - {{- end -}} -{{- end -}} - -{{/* -Validate a value must not be empty. - -Usage: -{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} - -Validate value params: - - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" - - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" - - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" - - subchart - String - Optional - Name of the subchart that the validated password is part of. -*/}} -{{- define "common.validations.values.single.empty" -}} - {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} - {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} - - {{- if not $value -}} - {{- $varname := "my-value" -}} - {{- $getCurrentValue := "" -}} - {{- if and .secret .field -}} - {{- $varname = include "common.utils.fieldToEnvVar" . -}} - {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} - {{- end -}} - {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} - {{- end -}} -{{- end -}} diff --git a/rds/base/charts/redis-cluster/charts/common/values.yaml b/rds/base/charts/redis-cluster/charts/common/values.yaml deleted file mode 100644 index f2df68e..0000000 --- a/rds/base/charts/redis-cluster/charts/common/values.yaml +++ /dev/null @@ -1,5 +0,0 @@ -## bitnami/common -## It is required by CI/CD tools and processes. -## @skip exampleValue -## -exampleValue: common-chart diff --git a/rds/base/charts/redis-cluster/img/redis-cluster-topology.png b/rds/base/charts/redis-cluster/img/redis-cluster-topology.png deleted file mode 100644 index f0a02a9f8835381302731c9cb000b2835a45e7c9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11448 zcmeI2cUx22x9_8Zh@yyC0I4cPR3wC|kVp$H5PB1ZB#;m~gf1}_1O)^|QB*Y2#4gyt zMlbeAQxFvp712m>hX{m(GZyaOx!ZkSz`gf*j(>!>GS^(QjWNFCGu9zzC!56!6&9jU zsKs`+R<0=2Tv-%qj{Ji8aAni0vR)KQEHl>HJ2pI#N)HP{sbegEe^b}f4US~Qs$;Cw z_4G(lQ96Ni5-o-l&d`YniiJz?dw66Zok|Z1{M|-RS5J47uKp%8#vQGzjxpCah7XLM zj-j5O@9*{`T2RE_9UAE9LI+xoBnmwuHj)v%{&$O@SQ71bZ+Kl2DH#*!W~guJ6YNcK zHZTeO`>F9kF${WS#P4QkJslGrH2U}5u}M)uzb^*{#nUN4$W@Fr%;@i-!xQO$57ytD z8g7NACsAo=gGf@4U2vq4|L;yBNa25X;tb>6G}|@C+Q2i|iEP41uyWQ#JBJ%4#8?F< zhJ?qHVxj_RUKr=dpkNn9ac?y zjjf4Zb6GNz?1!C-z2!T|`I6FNrJxgzEdNh&X5<(5KrG*81T6sFq zW4#j0(FP$=R0ktuGQKhJ>5aE1x<}i)7{Yf-uoVV+b&Uyx|9F@?Q)9v%9i!kom8xr_ zZyDi8quLlJ$HoMDMv5Etu;N25ccDbf0|Q5Hey zuy9hmyN{lmxi_9+6lmk*8e~ZKun3K`af^yY(`;?=K0&@@N^D4|ZmdgqQerIL%hrxy zM`KVuoedc@Cs*&NU@z}TC!YjoOLVwfgp0XBq^=QOH`LfZDk)yy$}P!&oMd9pNV2eV za19GKbTn|V3?&(oC>TsM-pj)_-XqzO!f>`XcTI{5(F-#P4|eb+*@i_q#RWz9Cb}lU zY#Dly5oBMwdxVb>J|ZxR=Hn2B(esIp*C%@g#keGsV#(gFfsDuqU)z`@qaaF%b3~+m zaCivCJ1!{#Z-OS0%&mNabUj@xDKwK12OC|CUMSr<(LBO6#=*zKmh2FMcXPB0wAZ(G zOLT#y3^MdVd+FN4H&{DMs+$|$6}}_mun)3ByGD6M!*@NGc#37RH*(}cY~w5(g7s}^ zzJ{deP$OjHtPIHRcv})F*daVJ9OLS0Leg`Niu1-BQNyAVy)cG$-t^cQdT5*_#!w#< z6bFATlk}s>LCIl6HxqO;(KpT^F4{I2o&%lvSS5MJQIi?*1e?StBg+V5BGsE18|WMZ zW@PMb;;rjJh)Z(TCxklSlZ>ctaW=Yo)I?_w8+1I}9FDPYfEk{Rp z-ILpbFFK4J$#eW+T6n?W^l5qJZKu}h5eQ&HLB6NEPly?kFMd+9B*;21U%BtZEs%?pK-aOJA&_a1j0}?4#_1KVkJ~ zb1N$=!~T5LHEY(Ki6ShOkvZyUtN}kg)=-p%p8{pGCE=%=k}YB~GBVw%{}0_J=Dl%c zNm&_1!2faZ@ZlzI_bqfh*IP+9=vgI}rUzo0%pyLDCQ>#KFyN?VT{J-WBp zCg)?vCAY`Vo>`JeY8zKB+H+FMc}Q(BfZHZ_r67MSRsc_F7C zywt+dvh}JDW@2iJ{P>7kKAJK=H#hgl*|VFbw_3cM9SuWCQ8xa>xpUb;&rXoK%1McR zdnJ}CDoP!Dk~;a<;97Nc@fy+86}OQmPoC7l)OA^+lzf7Q)M`ViYrc0ZqM~%M)1#Jw zfq};3$}t=HHo0Bw?;rEaU97FebB`UnQf>OC*hZRgcFPL?lreG9^k2lGzd~ZiK3a#p zy)Aj;;m?Kl6GpPH?|86AUw`=-!|+_};cth8N7wOf@{BbUz8)iD>yD^dMsdu3sjgcm zW@l$t760Qj&u4MW_&1NM{x!;Vb#<@w7h9$;X)0sy)@H8k+&6o3!pHoJ>1>urexUjA z{*xzH?Mxn059_{ZJ+&^q>tPZG7Orn-Nb**9*6rK+L&p|ya{?=HmlwBKDP8rsHUCla zcztmWHlwP_c!*J;ZD_dCY!|w?1!4%~4*Dqs@kWrCfWZ=WDk*3@9_9&Rg z5F_^U)4UCdKkmGFRb;&gdi0)Bv?Q|{S_2<>6TK>ZjGG z9{XfuWax&!)fbyTe+?S#0yhM(;#x%99AT%DK(HZO64jEUVl(pL5m;Fr&fwZPdwct( z%F5ZbwcE;A()V1-YtksJyA;;q7Ewg>BpOX=mYSHHB=uG^+sd@U;l8gOmt?7&bDNkM zu3c;-9?ml75dN@2UC14Kwt46Ayu3oYV;XHVV{t*d3K&7wJ2t7s>ig?!V=XEy zTei8u;}z>#O<*5YkYo515Ix`}TT?sxu@^5d`*D}*ybg@r&so3e+v-a$5 zZUo2RH_Wjx%ILh}MVX!$Yom3g3NIn!T+5S?3nT>6XvGdEb=qi07N;DkD{zvz0b5=XcjZ z%dB}4OKjOLo4Fig7=&v@&9~z!vfyUH!r>W8>ohdhn40=cWhIkX&B#nMgdSzQe698C z&HwuHqLib$HKeUX^6As3C7g@0e3~gTl8)Z9$CYK#Xmq|lJ(njRXfx1~)AFtJO6k9w zkVqt3A`$kLt7TxY0_>xW)*>D8sh7e;aXnntiCP%~e12HDO9BW)FCB@FA<~X*CewMZ8<>mEH4zkm8a-`u%DeyvRRBF-r^R>#fZ%=tc?G*uabB8b?O`