From 30c71503d2cde568bc8ca40f3fa7072061ad22bc Mon Sep 17 00:00:00 2001 From: Mauren Berti Date: Thu, 26 Jan 2023 18:52:34 -0500 Subject: [PATCH 1/2] Add user-friendly error message + standardize PSP flag. * Substitute global.rbac.psp.enabled and global.psp.enabled uses for global.cattle.psp.enabled. * Remove previous usages of the capabilities check to determine if PSPs and PSP-related resources are applied. * Add a new validation file (validate-psp-install.yaml) to make the capabilities check when PSP installation is requested and issue a user-friendly message if unable to install PSP. * Update app-readme.md to include details of this change. * Bump chart version to 102.0.0. * Change default value for PSP installation from true to false. --- .../generated-changes/overlay/app-readme.md | 22 +++++++++++-- .../overlay/templates/_generic_logging.yaml | 6 ++-- .../templates/loggings/k3s/daemonset.yaml | 2 +- .../templates/loggings/rke/daemonset.yaml | 2 +- .../templates/loggings/rke2/daemonset.yaml | 2 +- .../templates/validate-psp-install.yaml | 7 +++++ .../patch/templates/psp.yaml.patch | 8 +++++ .../generated-changes/patch/values.yaml.patch | 31 ++++++++++--------- packages/rancher-logging/package.yaml | 2 +- release.yaml | 2 ++ 10 files changed, 61 insertions(+), 23 deletions(-) create mode 100644 packages/rancher-logging/generated-changes/overlay/templates/validate-psp-install.yaml create mode 100644 packages/rancher-logging/generated-changes/patch/templates/psp.yaml.patch diff --git a/packages/rancher-logging/generated-changes/overlay/app-readme.md b/packages/rancher-logging/generated-changes/overlay/app-readme.md index 3b4d49310..994c597ee 100644 --- a/packages/rancher-logging/generated-changes/overlay/app-readme.md +++ b/packages/rancher-logging/generated-changes/overlay/app-readme.md @@ -2,7 +2,25 @@ This chart is based off of the upstream [Banzai Logging Operator](https://banzaicloud.com/docs/one-eye/logging-operator/) chart. The chart deploys a logging operator and CRDs, which allows users to configure complex logging pipelines with a few simple custom resources. There are two levels of logging, which allow you to collect all logs in a cluster or from a single namespace. -For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/logging/v2.5/). +For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/logging/v2.7/). + +## Upgrading to Kubernetes v1.25+ + +Starting in Kubernetes v1.25, [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) have been removed from the Kubernetes API. + +As a result, **before upgrading to Kubernetes v1.25** (or on a fresh install in a Kubernetes v1.25+ cluster), users are expected to perform an in-place upgrade of this chart with `global.cattle.psp.enabled` set to `false` if it has been previously set to `true`. + +> **Note:** +> In this chart release, any previous field that was associated with any PSP resources have been removed in favor of a single global field: `global.cattle.psp.enabled`. + +> **Note:** +> If you upgrade your cluster to Kubernetes v1.25+ before removing PSPs via a `helm upgrade` (even if you manually clean up resources), **it will leave the Helm release in a broken state within the cluster such that further Helm operations will not work (`helm uninstall`, `helm upgrade`, etc.).** +> +> If your charts get stuck in this state, please consult the Rancher docs on how to clean up your Helm release secrets. + +Upon setting `global.cattle.psp.enabled` to false, the chart will remove any PSP resources deployed on its behalf from the cluster. This is the default setting for this chart. + +As a replacement for PSPs, [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) should be used. Please consult the Rancher docs for more details on how to configure your chart release namespaces to work with the new Pod Security Admission and apply Pod Security Standards. ## Namespace-level logging @@ -22,6 +40,6 @@ To collect logs from an entire cluster, users create cluster flows and cluster o For more information on how to configure the Helm chart, refer to the Helm README. ## Systemd Configuration -Some kubernetes distributions log to journald. In order to collect these logs the `systemdLogPath` needs to be defined. While the `/run/log/journal` directory is used by default, some Linux distributions do not default to this path. For example Ubuntu defaults to `/var/log/journal`. To determine your `systemdLogPath` run `cat /etc/systemd/journald.conf | grep -E ^\#?Storage | cut -d"=" -f2` on one of your nodes. If `persistent` is returned your `systemdLogPath` should be `/var/log/journal`. If `volatile` is returned `systemdLogPath` should be `/run/log/journal`. If `auto` is returned check if `/var/log/journal` exists, and if it does then use `/var/log/journal`, otherwise use `/run/log/journal`. +Some Kubernetes distributions log to journald. In order to collect these logs the `systemdLogPath` needs to be defined. While the `/run/log/journal` directory is used by default, some Linux distributions do not default to this path. For example Ubuntu defaults to `/var/log/journal`. To determine your `systemdLogPath` run `cat /etc/systemd/journald.conf | grep -E ^\#?Storage | cut -d"=" -f2` on one of your nodes. If `persistent` is returned your `systemdLogPath` should be `/var/log/journal`. If `volatile` is returned `systemdLogPath` should be `/run/log/journal`. If `auto` is returned check if `/var/log/journal` exists, and if it does then use `/var/log/journal`, otherwise use `/run/log/journal`. If any value not described here is returned, Rancher Logging will not be able to collect control plane logs. To address this issue set `Storage=volatile` in journald.conf, reboot your machine, and set `systemdLogPath` to `/run/log/journal`. diff --git a/packages/rancher-logging/generated-changes/overlay/templates/_generic_logging.yaml b/packages/rancher-logging/generated-changes/overlay/templates/_generic_logging.yaml index 8d3461f15..47669aaed 100644 --- a/packages/rancher-logging/generated-changes/overlay/templates/_generic_logging.yaml +++ b/packages/rancher-logging/generated-changes/overlay/templates/_generic_logging.yaml @@ -19,10 +19,10 @@ spec: bufferStorageVolume: {{- toYaml . | nindent 6 }} {{- end }} {{- end }} - {{- if or (and .Values.global.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy")) .Values.global.seLinux.enabled }} + {{- if or .Values.global.cattle.psp.enabled .Values.global.seLinux.enabled }} security: {{- end }} - {{- if and .Values.global.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} + {{- if .Values.global.cattle.psp.enabled }} podSecurityPolicyCreate: true roleBasedAccessControlCreate: true {{- end }} @@ -73,7 +73,7 @@ spec: scaling: replicas: {{ .Values.fluentd.replicas }} {{- end }} - {{- if and .Values.global.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} + {{- if .Values.global.cattle.psp.enabled }} security: podSecurityPolicyCreate: true roleBasedAccessControlCreate: true diff --git a/packages/rancher-logging/generated-changes/overlay/templates/loggings/k3s/daemonset.yaml b/packages/rancher-logging/generated-changes/overlay/templates/loggings/k3s/daemonset.yaml index e79cbaa29..e80c2b1c8 100644 --- a/packages/rancher-logging/generated-changes/overlay/templates/loggings/k3s/daemonset.yaml +++ b/packages/rancher-logging/generated-changes/overlay/templates/loggings/k3s/daemonset.yaml @@ -57,7 +57,7 @@ kind: ServiceAccount metadata: name: "{{ .Release.Name }}-k3s-journald-aggregator" namespace: "{{ .Release.Namespace }}" -{{- if and .Values.global.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} +{{- if .Values.global.cattle.psp.enabled }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role diff --git a/packages/rancher-logging/generated-changes/overlay/templates/loggings/rke/daemonset.yaml b/packages/rancher-logging/generated-changes/overlay/templates/loggings/rke/daemonset.yaml index 0302d8750..cc39a5cc4 100644 --- a/packages/rancher-logging/generated-changes/overlay/templates/loggings/rke/daemonset.yaml +++ b/packages/rancher-logging/generated-changes/overlay/templates/loggings/rke/daemonset.yaml @@ -62,7 +62,7 @@ kind: ServiceAccount metadata: name: "{{ .Release.Name }}-rke-aggregator" namespace: "{{ .Release.Namespace }}" -{{- if and .Values.global.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} +{{- if .Values.global.cattle.psp.enabled }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role diff --git a/packages/rancher-logging/generated-changes/overlay/templates/loggings/rke2/daemonset.yaml b/packages/rancher-logging/generated-changes/overlay/templates/loggings/rke2/daemonset.yaml index 4d1d4f4df..ddc30f889 100644 --- a/packages/rancher-logging/generated-changes/overlay/templates/loggings/rke2/daemonset.yaml +++ b/packages/rancher-logging/generated-changes/overlay/templates/loggings/rke2/daemonset.yaml @@ -63,7 +63,7 @@ kind: ServiceAccount metadata: name: "{{ .Release.Name }}-rke2-journald-aggregator" namespace: "{{ .Release.Namespace }}" -{{- if and .Values.global.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} +{{- if .Values.global.cattle.psp.enabled }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role diff --git a/packages/rancher-logging/generated-changes/overlay/templates/validate-psp-install.yaml b/packages/rancher-logging/generated-changes/overlay/templates/validate-psp-install.yaml new file mode 100644 index 000000000..a30c59d3b --- /dev/null +++ b/packages/rancher-logging/generated-changes/overlay/templates/validate-psp-install.yaml @@ -0,0 +1,7 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +#{{- if .Values.global.cattle.psp.enabled }} +#{{- if not (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} +#{{- fail "The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding." -}} +#{{- end }} +#{{- end }} +#{{- end }} diff --git a/packages/rancher-logging/generated-changes/patch/templates/psp.yaml.patch b/packages/rancher-logging/generated-changes/patch/templates/psp.yaml.patch new file mode 100644 index 000000000..aaf6f41e9 --- /dev/null +++ b/packages/rancher-logging/generated-changes/patch/templates/psp.yaml.patch @@ -0,0 +1,8 @@ +--- charts-original/templates/psp.yaml ++++ charts/templates/psp.yaml +@@ -1,4 +1,4 @@ +-{{ if and .Values.rbac.enabled .Values.rbac.psp.enabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} ++{{ if and .Values.global.cattle.psp.enabled }} + apiVersion: policy/v1beta1 + kind: PodSecurityPolicy + metadata: diff --git a/packages/rancher-logging/generated-changes/patch/values.yaml.patch b/packages/rancher-logging/generated-changes/patch/values.yaml.patch index 106d7c57b..7ecae1013 100644 --- a/packages/rancher-logging/generated-changes/patch/values.yaml.patch +++ b/packages/rancher-logging/generated-changes/patch/values.yaml.patch @@ -26,17 +26,24 @@ affinity: {} -@@ -60,6 +65,9 @@ - # Labels to query http service - labels: {} - -+# These "rbac" settings match the upstream defaults. For only using psp in the overlay files, which -+# include the default Logging CRs created, see the "global.psp" setting. To enable psp for the entire -+# chart, enable both "rbac.psp" and "global.psp" (this may require further changes to the chart). +@@ -63,7 +68,6 @@ rbac: enabled: true psp: -@@ -102,3 +110,139 @@ +- enabled: true + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' +@@ -75,7 +79,7 @@ + + + ## SecurityContext holds pod-level security attributes and common container settings. +-## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false ++## This defaults to non-root user with uid 1000 and gid 2000. *v1.PodSecurityContext false + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## + podSecurityContext: {} +@@ -102,3 +106,135 @@ serviceAccount: annotations: {} @@ -63,16 +70,12 @@ + # set the value below to "false". + # windows: + # enabled: true ++ psp: ++ enabled: false + + # Change the "dockerRootDirectory" if the default Docker directory has changed. + dockerRootDirectory: "" + -+ # This psp setting differs from the upstream "rbac.psp" by only enabling psp settings for the -+ # overlay files, which include the Logging CRs created, whereas the upstream "rbac.psp" affects the -+ # logging operator. -+ psp: -+ enabled: true -+ + rkeWindowsPathPrefix: "c:\\" + + seLinux: diff --git a/packages/rancher-logging/package.yaml b/packages/rancher-logging/package.yaml index 76cfb3051..1a088c616 100644 --- a/packages/rancher-logging/package.yaml +++ b/packages/rancher-logging/package.yaml @@ -1,5 +1,5 @@ url: https://kubernetes-charts.banzaicloud.com/charts/logging-operator-3.17.10.tgz -version: 101.1.0 +version: 102.0.0 additionalCharts: - workingDir: charts-crd crdOptions: diff --git a/release.yaml b/release.yaml index 36bf566e0..2d95b9a1f 100644 --- a/release.yaml +++ b/release.yaml @@ -52,8 +52,10 @@ rancher-istio: - 101.1.0+up1.15.3 rancher-logging: - 101.1.0+up3.17.10 +- 102.0.0+up3.17.10 rancher-logging-crd: - 101.1.0+up3.17.10 +- 102.0.0+up3.17.10 rancher-monitoring: - 100.2.0+up40.1.2 - 101.1.0+up40.1.2 From 1f5cce45f61644569489ed7157040b9271910a3e Mon Sep 17 00:00:00 2001 From: Mauren Berti Date: Thu, 26 Jan 2023 18:53:25 -0500 Subject: [PATCH 2/2] make charts --- .../rancher-logging-crd-102.0.0+up3.17.10.tgz | Bin 0 -> 83284 bytes .../rancher-logging-102.0.0+up3.17.10.tgz | Bin 0 -> 14295 bytes .../102.0.0+up3.17.10/Chart.yaml | 10 + .../102.0.0+up3.17.10/README.md | 2 + ...xtensions.banzaicloud.io_eventtailers.yaml | 2123 +++ ...extensions.banzaicloud.io_hosttailers.yaml | 2305 +++ .../logging.banzaicloud.io_clusterflows.yaml | 2056 +++ ...logging.banzaicloud.io_clusteroutputs.yaml | 11820 ++++++++++++++++ .../logging.banzaicloud.io_flows.yaml | 2048 +++ .../logging.banzaicloud.io_loggings.yaml | 9771 +++++++++++++ .../logging.banzaicloud.io_outputs.yaml | 11808 +++++++++++++++ .../102.0.0+up3.17.10/.helmignore | 22 + .../102.0.0+up3.17.10/Chart.yaml | 25 + .../102.0.0+up3.17.10/README.md | 132 + .../102.0.0+up3.17.10/app-readme.md | 45 + .../102.0.0+up3.17.10/templates/NOTES.txt | 0 .../templates/_generic_logging.yaml | 116 + .../102.0.0+up3.17.10/templates/_helpers.tpl | 179 + .../templates/clusterrole.yaml | 318 + .../templates/clusterrolebinding.yaml | 18 + .../102.0.0+up3.17.10/templates/crds.yaml | 6 + .../templates/deployment.yaml | 77 + .../templates/loggings/aks/logging.yaml | 18 + .../templates/loggings/eks/logging.yaml | 19 + .../templates/loggings/gke/logging.yaml | 18 + .../templates/loggings/k3s/configmap.yaml | 57 + .../templates/loggings/k3s/daemonset.yaml | 110 + .../loggings/k3s/logging-k3s-openrc.yaml | 19 + .../loggings/kube-audit/logging.yaml | 24 + .../templates/loggings/rke/configmap.yaml | 29 + .../templates/loggings/rke/daemonset.yaml | 122 + .../templates/loggings/rke2/configmap.yaml | 69 + .../templates/loggings/rke2/daemonset.yaml | 116 + .../templates/loggings/root/logging.yaml | 82 + .../102.0.0+up3.17.10/templates/psp.yaml | 34 + .../102.0.0+up3.17.10/templates/service.yaml | 20 + .../templates/serviceMonitor.yaml | 30 + .../templates/serviceaccount.yaml | 14 + .../templates/userroles.yaml | 35 + .../templates/validate-install-crd.yaml | 20 + .../templates/validate-install.yaml | 5 + .../templates/validate-psp-install.yaml | 7 + .../102.0.0+up3.17.10/values.yaml | 240 + index.yaml | 43 + 44 files changed, 44012 insertions(+) create mode 100644 assets/rancher-logging-crd/rancher-logging-crd-102.0.0+up3.17.10.tgz create mode 100644 assets/rancher-logging/rancher-logging-102.0.0+up3.17.10.tgz create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/Chart.yaml create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/README.md create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/templates/logging-extensions.banzaicloud.io_eventtailers.yaml create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/templates/logging-extensions.banzaicloud.io_hosttailers.yaml create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/templates/logging.banzaicloud.io_clusterflows.yaml create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/templates/logging.banzaicloud.io_clusteroutputs.yaml create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/templates/logging.banzaicloud.io_flows.yaml create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/templates/logging.banzaicloud.io_loggings.yaml create mode 100644 charts/rancher-logging-crd/102.0.0+up3.17.10/templates/logging.banzaicloud.io_outputs.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/.helmignore create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/Chart.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/README.md create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/app-readme.md create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/NOTES.txt create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/_generic_logging.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/_helpers.tpl create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/clusterrole.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/clusterrolebinding.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/crds.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/deployment.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/aks/logging.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/eks/logging.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/gke/logging.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/configmap.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/daemonset.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/logging-k3s-openrc.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/kube-audit/logging.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke/configmap.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke/daemonset.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke2/configmap.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke2/daemonset.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/root/logging.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/psp.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/service.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/serviceMonitor.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/serviceaccount.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/userroles.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/validate-install-crd.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/validate-install.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/templates/validate-psp-install.yaml create mode 100644 charts/rancher-logging/102.0.0+up3.17.10/values.yaml diff --git a/assets/rancher-logging-crd/rancher-logging-crd-102.0.0+up3.17.10.tgz b/assets/rancher-logging-crd/rancher-logging-crd-102.0.0+up3.17.10.tgz new file mode 100644 index 0000000000000000000000000000000000000000..15765517abce35b90f4dba8a5c1b8d660e3d607b GIT binary patch literal 83284 zcmb5Vb8ux**Y4Y~Z9D0pV{6B@ZQJhHPRF)w+eXK>ZRe)n`<<`8bL*Zz&a7IsYR^@B zuTeGksPW9-cqTyvB zg}#lEyOO*ukC?HQ^^fxp&3N4A+Mm#8soi;fH$2N*;khQHX^%S*0qK914Ahda@+uy- zFBJW%#x8@w;Szo*O~XE|etigSc$5{l`+`FA{M|R|63Y-Fvk4P2A*M?kHGq2+C|L*} zUl7h6uimOmZKAtc7V%01rKO{z)9vhgYgJv}{LSWrz? z_37yF`cQUBE%IcWA7cDiI5_XZm$_sDA}_3)a3GsZ$52%q)BN6)^T`n23ox( z3%QkE{5v*lVyTlvxMkE`-xj=uXHC2UE;R`47Vqq{j+EKTgw84om?QMXYBA&8jM9^; zq*EL80kUrSV_SEz5P>X}>u$W})15rTNF-&l6x;cB!WI83(L40uAi{kAvC5wftDLGg z!X;71Dx|B5w%gtP<@OeEdb;)ir|Ri5~%{rouRmO@8ZJY^0uBupj|BgFzij zSA7OXV?ir1^Xqowq|@u=^}x6voVg+UYl2OWW=+YKQ61)nc)TsXP1H#T`?o&T&osY^ zhO%{sgJH{Yac8GNo<@B+ykc!I+*xpnaT)N-WB;3O*GJ3K5lwkR88$rc zL{Y$OaLi|#F6&ro})R|3tMwB(Rq zTDq>7tT>N$*dTT=>G`@Ghp#n2f73SbUNUW$p`-U6_0YXwkRxAm77Ty`Jg4A#F8Y<> z-+1pTH-1d9;P$j9y}=bPI;|i2Rt?n{Y0YDM>sZoTlHn?*(8Syc7bu3}uk9-W`BuATyVYsFfE zbg1{#%}7UC_g?7q$jqjR_%cz}x4F#dAZ*Kh>z8_x!Z=w}0P0RN8?Kuo7l`ujL*in4 z!8YFU#%T3tr1QIgEvd~9!xI|^Ki<_RYa|?J&sj(_4Sz7l-oj3~*SxoL=|wYFTJ$+F zf@~NFb758TE|A_!UV&Vr6LzbUst{;q)dLb2v(vmEhWHQg4Z;udXiKI8+1(>3Png34 z{+o6yr-omp>OchkCr=OM?hONMITmkb6hrmof0rsvyUR5~5hSj6X-^&DD)tNDV>#&! zJC+$t3*cLZ1x|asDhlA&NnVkIP!u4<@Gw_nIr&a|l1t%_KYv*nkb2jld-Ycu;#bhD zQLvKp=0t}k+uSHc6s?4-!)SDker|1jU41=gM*!Xrp1Qx54hFyOzCV9_d9QpEg9xrYs#~WQ`}yT9u5WfK&h=dkTx^wDt>ChSrVWG zl9FklQX53qvSY*Ap_Nz3%Dl`nE>u})je_olEYr`&lMG+kk|^K3DocXT1!Z7?t9TDV zbp=owe~p1TMJwNl6j{D3zMGzL-as~cuC2vLuri6!U;1Fr#4uQa0PNJaKJ&5NJ8?nQ zfzWEe;)Es^BnoD_Uri_x7pCy|Nd$1EL4DZO(8OumYwh)9V;~ zB$x+Ucc)dtJU}k+m>C3*z#>HbtG#vHw^jg30V=LMw?Ypq{h8o`9%VTgAQAFvD$cb=WZaBba%#l%c?Dikg3c$>!z z?G)Rjg-9D;b?u?RTmk5Ce!5?vZDypKJX1XT*|rEK+#YADRiczSX5|iH720}?G`7;* zo-6@7MsVF*O~v(=NCO{J5nPH}%f=D5AsMB1K7}#~^y7 z8h~tWpPin=$WZt>*D%*r`L2!UEJx5EpQ4sxOu#e$2dtB|KHQTAa{TefH4XCjHD^ANxmlZ5Ku{kU%!Q%hrpo3>Tz3 zVB-t;q{$%(_=so1uJZWD#k9YBEw*pdN5qPYkst^#bUC++I(NVdy=DU|1pScpFWetw z@Ii2S0hZU0xlf2<2G%o$CY#3Tv;1ds!5L;f*do#3)F$x04_D)DFlhAbbS@FmX1G0g zf`^L=PY6~(yMYtTX0CtkK+2gld%1ce#fwnj9}gJG+UjdExx72%Up0QJeB#kWz-#k{ z76Z%>`HVInt}BA<5I^^#Kx+4I#yhR*v8C2=K4HYlkT*H)x38Tl^`JBaU$i%9=7$a7 zjDNLgb?S;YzTG`F%guM0#-g;Ox#okMF#QZPoXRT*g$KUsozZtjBvf@mwBIm6VjQZN z>f4Wk2Uhi5d=?;!g%{Y5g|C?#nc?IkKOq!j#PadacK7u79OG~CGJ5iZhsVoc;2sV@ zneTc{AGC6qrk(xPl{YCQ#KXMqwa!EUqcNswQEHkou z8ANkwGeWFNa=dVcZ?M&k56|khm0vySE9-(a8TJw7yPORY`hoZ5zntw@b2RzMtBH|F zQ(vYaPTsr_jne>Wsb6RxI2A0Z%3_E^POY3=AvrrD2?ee*PK4jU zX--ai&^@DbJBM-g=)_-Q59+rtT6ONiPwgP)BY<_K*>Cak)eciXT)qzB1@dUTQZc#M zNic!cz20Ej8{nVP{AIty;HTJJ9l;B<`qK@6iPCDPw&^HSYGY~|Kd5AWxqZ%|EeCf5FXKo_ zT+W&80Qt;0U5pEsck2it>;1;vU;o7%!d&O?1kv&*Y7Z&51XW$}RS$Ml2HN7`4=QE3 z1rhJhUKpWNMxjn7nKFVZj#BS}*SOOoOo~$PFb~27+sOEVZgawg7$tzhN7mj7#e%Kb zi+hQ839;RBKp^!GjHjd+ZjxLI(rd2_`;Y2W2#nv0HDFt2>3}_J5f&!7`LwlmR|$<4 z=S?Ry_`X0nHUj1?2O#R_O;jnjv+J#xCDq$zKYwMbUa;X)R0RZQgDJ{!H`Clc(0ada+B*zST*_p@+F0O!1$m{-&@;~D7Y+6aDLmAsfm8`*?f93oeGQwh}h~E()qSu4^Y2Tem zNZL-IN`C~jMciny;5aU#!15H|n z+i$#j`hi8Din-vjuR>|g?b+!QJ1-t?U z`sYj2FFLb&Ui2=7$eOQ4!~tb=4s#T;QGxBkS=jrf{8`xbo`kYd3^E>-nc%ncgtBnA z^KQ|m+1xC_N!cOA;2b9*+hbx6?Y6RI1f|}8ulJMbO1+^x|If?3Um&}=_A5626Ef?A zH9p>Zq=d;~4gj)-#&Kf${Y>T+i{s>b8dSkyZhA!gOI(JSmFhN@|sX8IHvFR<&7~s^vG`4a`4}`9ZjG zY`^*=*q)Ht*QtMK?5!molxUBnHBPq*A#7L7Z-lNpACbrnUqwUoQam>Bv!(pB+n$?| z-Gt?=47mo#Jk_k#&#h+z&@;}749sU8QA0M*SH zws$v70?qCgeMM5pT9Vu(d}{&2DlRgMMnHe~43LH<_UD=T%v)3EuW%9QX!Pj{evRrObZE9^mbGp`fP`uy^-JA z47sf3(=1VDH@1TrKqBRKTwZ9f>Ja&Bhnbc`4F_mbVCLfV?F#>)4VN?1lc-L%G5D&b zRfeAujCxV4>a%LhX%tWLSywn+H&iUcaqo9}c?|fQ!~ax* zk%TK0#va4af}@A_1=hg-A_s@)W^CHeYUpSq2_|fUre^;u;(qe3gNVE4zaUS{I&%qeOQrS1D=9Mxz)=TZaSbFOjKw}M}*z? zcjWVDU`^@yhAVeiswoIrbsRq*rX=APDBv3I34A+e%4fM0f%DANv(Gfc68A>Qa@p7A zEI{q_#OT%4|7LQ!rWCYZJV2dQPkof8pPFAxL@$;BD_51)vR;Y#mi09n9@1%I_tKyo+EPc0m`F^(sJza7e~3Qwetd!$t@^2Qy3QQ z8jXDA;tE05a}wd+h#t8)kZJ>1^Hk z6iSw5;l@RSY56GRxzz1ii|jLA=fL8nl+3qaZ$oxKx=4)Cyk`RGF|7CU3(r zq)c6E`tiYSVw+qN1(r$f4Q-@Oc`0t36qI?!6z%$r32fxoL#8i~{a43X2?9)eYcx}x zcC0y7VvLNTRN~Wxq7Mhtlx;2BKcmwHtbxWo<;=4^=LxuQ%sB_bs*kGHLzRD;@^de4 zDcEm#H*bvxqcL_n_PtP_CC(+iSi8y=tH$r{Re#N>Q zCc{yb?*9Bc!e;s_%IPE=pQCBnaaQNvFijG4LFViIV3V4DbYq?H71*hHgWII~UPGO1 zT6c?%fFr5(#O`sG%Gx$T#w?QOjqi1u^Ri>E>}6wP!xV)s=`2T94y4eyWPKbNyI&KvBPKh-g@0@i{J^PlY|))E$0Jo#5c_&^kN_AX`j)-Ovn2E zrBAU;1+V_BL6o0ywKKlMqOU)C_cl%}n0Te16r(Ei?C>XR&ugGBApMGH?jph_5GoWV z4j;~C$S({wy(>iBl$<@`6`xqEiz{XCxif~yVJVyO#?Rp}#AHVke%TfAtA* zlzfkLz%k(&nCs;HU|L#&IO-fTRzw7QC5*Z5gBTi6Zpn8FjT9Dt`X_+fyf2O>U@biV z4EbD83~MRG5SD8}|A@m4P2g`;j;tY~H5jwZvCM~NCA#aS7OL8qw*KyD_KZih{$P~! zF^wsIU7&I?N|6G778U+VRJEq=faQ=@*+K+qHD>9DKdV(@4L<eh8q%RSFbY6EyX!{?;ZEauP!YE-spX`{BiuRglROfL27?kxISiGDit?o$lG zL8r^;_z}%PZS!yU21+_?%H&E@{aQUHgO2rwsg8(-tH?I_;43TfIB$Man^-& zsYQW~W3oUiDJLD|-wZ}WmsvcFUl7`Co~G~J3AKP`o+cmE_2q7!=N$-}b9@ras5(O$ zttyM&`{(3fCe$*0aV{6tu93Qn9ts`Uj2G#q|H65ywZW6LVJ&5RT_4w<$+m#Y5BF1- z?Axr2mKJyv5LssKtTnH2LxO$kY;@tA#*KH-U)nuB)W3fzk<4^$Sy`;T&$rEYYBIS` zR9qojBx~_C{}$cP7SCLwVE%P_fb67GVd0bx%q^*LaYs4<64t0^h`YraBS70X$rL#7o-Y3v`S3p_$=^boH*Q))!a z%=KZV`iJOVchcfdMgK|TX!}2>$t4g9A4BZo@9E$QA7T$A3s)RjzZE|IDe2RYGW&2I zu@;RYdt=pDQ_}lD(5x7yDI&(Z?YwF1rp2GuccvYa%Q+Dmj-F34;xNtPd2}g=r-uQD znzVXgTj~B#!Ia1TPYJaD0cWrr!H|d*?^YH3>M9mN5`FIQ`NB*^7KG`6^2UiOgImg( z^cugfKfc5%-&AP{N%3LPDs{)3!IkqqnH^-;zP^#!og{a;5Am+ee{Xm|R8?sMts$3z zsbnS9*#97xHePkvTNI?Io$?ht(<}XiZYKrrk_RM?cJH0(xbah(+pr< zz+bmhFT-*4k8fPXe3TJ{nsXrM#eZ&Y1OLx{r{)E>KXMt52u)AUl_9I##Bj>PKerf_ zHN;}1vA70Pz^GSow&(;tS^Hbta8_t2TLmH81jO#?VEI1-)2cBII5y6X!2%S1`~KN3^5+MDQK+m=MEc2J*t*xq=r#~OFdTf|rUO{Vy@ z9xBr&XdU>En@4YB#YBjaH?Ow>{;sW=!y3P`LxoG^lmt?`c|2rkDUPrNX(_(Ljj{~F z?5E8U{q~;zyPqadMM;4R)>@QtvqG_ykb7{nlO`Y!MbyHm@Nv2JZ}GR7xnB+>%XItj z#U60>NN;Sh|1EutQumSDqxb`khBtm0fiPKYy9W$vBE7$9_atf}BI9Xf9`aO=i?BQt zmN1!|l7NUj)c3SsLLM?>xP;rEcrke>s5nI>U|}*nq{$eG<(jpt!iDJkeT=#++Pd7Q zt1oH{7Y%5Re7C^#t{($iy^Ny!zUkd~sFWOLhCJ~PoKMd*f4u1fV$EN5z`&L14@&&r`EiR1DPEaKbv9#AeN(0QW{Qt46 zJ}DEBKn{MRW6px7$`EM*ALL`?IN^y79v$l)4sAqKI~!x{(Dl*)0V4y)XOFJ4zm0 ztLrXN-E^Srkz7R1+HNGoH^(2f-Fv#Ib6_{+Itm z_Ec|H^Gp2l7G&rLhwt*%4c+%0!gKRHM#l%2uNvU_eJOrlVZjSPsVbg?f2mScL_xR# zf2nGJ(jZ2p0eJtt`S^jtgf#o>ET*`(YT#;smXj@|>{H=;W9~@xv9C=<^&wQ4t)SbY z^g0Tn^ja$T`aaezcS1q+;nXKDcT&v6`=<12{!Mujyz|Ps|1VQR`2&t?cDfUnM)~76 z`dXxgh_cTxNpV@X(nIoh2n)JpuQ>h*WuKP_>1Cg7zGa_z_KFKz;yGpA`d)rzpWeC3 zJ{vzZ=q?c&5eaf<=$%hZJgX_}cvHCKM=!V>=3-7GGVVteNp@`FioxA2VvC2)@kbO5 zBja@}i~YD+Mic|MS^hyP*{FY+UCJ->`hOYzH_do*f!Qwr{LAe90)p?%&bXic&g}n1 zIz;}V4FbP}jQej8;`5!^GOti^@$tMICx%F^@?y#!RGEP#&zldAkxg@2jblZ6LsEBC zvTQ#S7p4i4c%g78f(<}ty2@QG$yK-Ss`(IEL;zxJ9vQ5@`nZsAgc~)rx4f6+{3Fj| zHv7qEf_dx;gty~YKZPK(LJ}9_JdsIr0heX3wzx5{(dv_JWuR7k8sr)_+iJh6#e$UE z?4g^#447PtYO0_Cn@EPje38sSNu+Y0SZXr9u@W71!CP0rWD(D7u;m9kO=L>-g0$w5 ztRX^Ci`zBCPQHst!CxNO_g&Vu5qWX``GZX5pk{}Je^zS$)MyFpFiYhvjw?bU1c4~- z!#BIPD+_k879T9=Bn7ARNU;<$!DfW(EJwZQ&>OnnbO%yZ0W=EZ*-7apry)`BUoA>g zns5yz*`p-k7e#!V5uMs!Kifq+X+va=bVAP+D|fhTsublUdc#?g%e%`N@mdqswG7XH z^Fw~U{CzWeMka`{ynI?f@a~lqK4)LWZJJm+&IWYK3UvECmAfRr85&#ex$Md zjYTA}k-ehWwPA&|x$Huht4tQZ&x`uAPSvf*Gv`P6EZuv>?rVSOT}J|#skw>-gR2vK zL2=tC7SNfk;fE=9%O322qu_}FQJ&^C)k?a|1;nMeQE`6yhhEmBbHk7&dp)=w-hcF7 z3PDM#z(gQ%%jPTR&?4-^p`cdOk5o5_C6=A1k>eHZNLq zl~nqC+UvZZECH92HYadCEhn6cY|?9YeQYzE&G4KCkwM54PZ`2qg8!$>F2}0`0;;pJ zLJybGuHZzM+q=-t0H(EbTykPcSiBz6_3xjM z0rVnx^>+fXm)sG!oCZw2u4G+f9bt=dFJQCgY`hXCd2ptFX6kv}FVm-r(kZ>EnH2@NR`NA5*%2vJb3rGwZolu7eKA5t-@ z4(n7Ny_(qgh(_o_kXV^AB6p64&~_9vG%_^u@V7w*kW&a^KR(+8y7fE>WrbLP9xCQdz_JyWN}@oD*mb~q+0=RM>^n5TDj3=M{Yr8<6Jh3c zOf;Fn85FlJC=VDY@cOAbejis~pEr>_Hnuh`fY}2@I0Vr_U>hIvn78CB)_glG*Qvp; z058?)F<}!*CHu^w!B(TB)PWsbo++PCrc?qt3uP7SL;e0JFmuI0pWo_n{>rIN`Pt;? z<>>=f7CVm=B}#vo2AnO8`KmxH^r?;A3=%Y>?H43Y)qMalD{EvHhWy20*}&>5;hqYq z#`;IEk$ahTo{gHQPdkq7fjN(Llf&EU^yez%+HUF53nc35{tNr$ary4GCJSq;Ro#0< za+*E2_)4os_z%NVB5CmUyJxM`YzAm!>WDE9%}QF$TNh7t`au&{8Frsz9)%6Y-fJ6w zPZkQEpU-?64&x9mWO%9G_PbkEUh{G-j;{9nrj7f>%h<=5Zzt6yNwnMYM5BK_YBgYd zq#PpiH~t0qv_3&gIk2&XcKz6}W{X*&?o?43y<2)37mYTy;mqi4l32qjM8P(k=8gTV zkLIdwu<&+ueOeh9C*oO^L1qXE-;NQ+r#~GzyxAl|>LQwrMtHt%@`OZi@?@XE^r7{- zUhCiVPbM46Cz;O%!J2VIkoU&j(ZQvln~Z?_@>zyz3KvB0QW^PqhzX}qYu0*P#_wRX|G4zUv#Cvm31O+aY3plzQ}HqDN7e7kA)xDE6TQDNv|2eV(sdD$IaCupXD`uH!V zkS0(RN}J-BO8H(jSX_q$ z+ML{;AvX(fO94?+tXy@@%@#|BtXsDlwY)e8aAmO9SSITq4pbloGKW6?e^l6`XKri~ z2M(UjdCt4ok%(S8Sw+mtoM!P#u&kvU!Qo8LZd*~DK%7zI0A6ke5QZ2v0XakY(g>f+oFB>gN2giXuifh;Cc;38L9Ev;SEZBQ zsUMfF7XYenbIz*|x`c~5&P4jT?w9wheo);L;Pmqut@nhVNxgz!7qU^qzP0VA(@W!p zB6E86TX&Zh{Y%)5KuMd|sItzz-;lsYO0ugJ$@*_C9UYx-8&=uJ)xp8Rr%(6G-U6G? z>*4>7Hzv2LbbJ!Ed53`ir!~tD<9pDFWcgr~v#)E!UT}E1f0*9=DX(r;rE9ByuVPiP z_CC$z>EkGsKTfzY5mFHJQ7mXocwJO>#%AG z2!6cFegTg(PCu0ro*Ko!R(PxCAE_7Xb9K2otLopbb z*>v9cQZ7kbE_XVzP=X5^6TJ$WKNM%M% z@(p&Z=-8)JfH#f0fA6e4lZ~p9Z21;gF|2?>9S?g|a7L1~aMIT{$avohSj12Wn5)rM z1WHYA29a+SR&+B@1DWZ9;;;U82}8x(*Pf zsw|ounBW65c}8URo4T7$TpY(UreN4r#%=BfGmF8=qp4X-kQtWYF!$^qAUnhauG|m| z;BXp)OdxJ0`u}W^?=~0nS`enxcF^}Y)lR7rzL0kJWHhl@qBlx8a5S`346B9p4Hy%h z)~(^uI)YH9?7~xS@o`pQLl>?+2xg>-w!fuI*0er4lNhjpNI6zN#v7B5?!K67SEbTy z+xlcV=hlQDRr>pgocjPt1x!`8fv3{7ruY~^9}Wi4?k)XX^H~@>YeT&4o9EH|fV+&n zam}6D2GYmx-JB-UdG8$&i1hu9V9{Nz+Wb- z9OSSJNzR+zTkyE7iH6x2qok;%H=42XB&s?GP>GB8xX>wZ3!z)PS#D*!A*3DRaZp--|+3F;_m1UKipK@7pKKe5w1iA6pPC3=E7 zn9DosQv^$fs!z9Y&ZNV_Xnd3y-U-DCj>WgMxWy*|i&yCOUOdLTLikniZps4eF19FI0rm6w&rQ0I{|L71Oc&b|jSoW}pDr48HwfrM@=eTj2px2c5dOz;%uQ2Z(h5`F12(DSU5lK{`pd1%Bfs6}GLt$xafSwcyE2>wLj zJ=pf%rU3X|_ObkBHxTV#d2dinbQ2e63>DY@L9lhm;TV^}#;1ZvC+q;bXRMG; z86jKIhBasfri&AEg)_wrP%`eA#L>r(l>Wj2DjMq9fMjNv!x}w~gte0~CCy=Y{a`a& z^XJL)uNh8b6%->HD8Qn3s<=dpM7|FgI{ z{a?43I1XNtS{)JwZ<4qylDKRz4>RFQoxo)DO#bhGuuzYCcJH?A;j`VK6<-N~DyVa& z8bQR}QTWBriDK%eWW}>lq%Lj0P3;@fbbTF$OCtl1O3y@wl#66J8qEc5kct4-D1 zGPkhPGBKpas2kQj7CPKn6nlBJRlP+#)nu6We!@gjlUW}^GyGDy{yn*%8_Dd(PbVn= z*1x8LgjwX1N<7kO`aJOYPsFE8QZ`DX$zD2#V+NB>@O5&9qT2iy5{0=2*bY~Qz|d=V zRA2T!t;Ihx<~EOGhL>db5t7qTp3ZJTxsSd5xZys`!`{TX(X}@#TETjwr1{g-7EM^< zi{!fx?b%c`7pO$Qm}Ge1DSZ8nV1QbyFhZ?Hd5tPlqsB<_%pX&{6#As|I3+=vgkBmt zsZFd(PsQ_wGT@ch%9<$49$z3dZ4>0Ec_~ZsjnK$IQB_X3)!R-y6U>E@x*kP!ewt$? z=WxY4GImI+*!5m$8#GuNTNxxgvEcsQtyD_I&OekW*8Qt-t7J(v53L^|l*?GQ2(}Ma zU!wpOj?CMWd}+ihl<`ykL$D#>qTFcc#0%5EgF~9qo=kUszGV(>#zMueb?m$0RVRWg z-gpCY=sA_))U&*I5>Eu~C2nTMxA>Aqp)-OPARAn(a3`r5X?Ng7%UP{vxI&dYIR(R8 z?=MFD*rng3c9b;9a`0^0wK%51(E5_XQT^?0?_h#Dvc?Vcng8~A`wi_>@Hr|ULh=BG zG|iWd1!)i=zD~J^&InDiWbQH&^>AQsC-UG>#dE+-gIUbu?%b3Cbb zY$$uNS{|}N^5wgt++=yP3v~>qO%iU7L`d-LqAg_7I@1Uvxzr=^5UBfy5kwk4=8_EF zW0?jWtdU@(OV*V&XoTiRqn%r;1UBv? zzLN3JzGW@KMAeoNT|2yvOZO9?nab(W<-NFH+GA!V=D`GrQ*nGlLgultdEQgod-?0$ zZnoWItsG3vW#N~`cYAOOMqHV2%iHa1yqVzXlUq2cVz=9u*J~>yC)bizQmG$K&E*)E z#W|enXN{@ZXb?|Y9*xE(O#)33i_&@2q;aK1d^7Kgx2+Ybq;B|X#a+@!^Q9Vd#_eC; z31unGDNq?fL7oRV%oy7jhK4NnVmbUPynX(pQdZLSGyEWxCZ%}3cDPl|>|x0m>dCt} zzi@LC24TbB|3kx8^i-Ewo62NFRkF?)lijK^P0dhL@~1uLxCbpGORz-HCB-I>9U@0M zbN$)=-_$FNneDUsXWf5`*UX+d@)WHFD`(zQVNPo6fD=~T^%YdDTK>e)UYnj25hH2W zxWLUDo$i>$kbyeoI@iIZt*qA)KfR&bz8`-FId%Oqym!BKYEun6UAz|juPV?gQuQI@ zC*RF;_~ceUR4MzA1Y1J9#ZAp$VRQ;@?cJ@Q>6W^Jj7vq}#sGDbKQvj{iw9|=z@Lvt z>KM@FZkt^u8AxxsKmO)8mRIo~O7eb$246Po>2Ry*>Nq78#HM`ANYU)Pz{_HAc+8Q8 zyqi`AN&Kgv^vjOfd>EXZ+xprEmLRid1iX(#zoyzs+l$*;czq zfr#}TW!Iu_r;gRnxC#-sU=n6VMi!~6(nIHB#lm0#4>461 zsMdl45l;5UzaPzI-mlnwX>zn@CsF)16iFH@;|CSIC`17+Nn5S@(WWfrmL7l`Kw-$M zAKo#Nqh$}sWUm{n2QH(U)tI7ZTz?OHz@*V#IT#|MWSTGP`0d6cY+zn?=nb-rFk*P+ zs{2EBx$wQPSw|OvG2O{(gwQi^=FU4y-`t9(w<6SicjPu}ER=#b7a1O|4XBvFk{+RwVCzB!q~tRP z=9^)Di;fXPLj=v&!XPsPr{`OWfLD6UMTv2OP+SI1@%FC!w*IlR}?{yjwioEn^3sp?ntN# z&lmx^3tx4Q9ssZ#{qCEdRf7=?Z%MnM$X%1|v3-HYv1H}^w!Kszad0UW`@0qVZ1Lwg z?5ZyYg`xCETEC6EmY?K3pFfPoE(TkNFPX=@tVgpDCZs{zs6Z50ZKhE@^vQ7YYz$Q% zLE(-QqAH({NXX6Lo#A{r{4VrSNb)3tQcE5{0Ecjh2lPTEmLU&>(@>Gm)Czg(Arj0R z(UcR@HAwe1HqB6-9WPT30lE=*z}3GIa^T5M;y3e%!VJ*r0#O9(xroy6bRNfl>&CDW zQb2X}a7|yx;_sOApXydrV*Ci`n zk0!!K)*oW$6pR{=ld?gW?#AE-A`6?-{^B2?LyJH1hD1L=S8Qq_8H^AEkpye><76n~ z3hR|gLXjkce*&N54jpo~>;$d;R5VVRz%|Q*#TeO}Ah#!v*K-svI3Qk^LSB*2a3__C zgJO#aOcj!`UV)@%0lyT<35%N&6EQXNb>t)gikiLZ=3hfUM?wqaS!}=(fF>fJ^vyMN zuGUL%LntNO-+7#s+jna>`+2AstCNFwAGo7~)HH3U;x^a8R}4oTQD;B&U_Z9pE|+ei z2ch5VDvNJ|CH6=J8go+#t+C1XRYt!K1ilz6%=e}aR?|cnJ`gWZ0mrV#j?}ajI~ZO2 zO=Uh|ZA#4$D%dkA`e3LxO-VK-jiR%~3W`T)mZH>b#>h56=pU|7v@N=3&Wx|Ok%b`yHhc6H2J^d04 zH7No|?q1?h!Z{q8v3u+jq{j@nLZD6kBhzrW8{`O~=q|5-+WgMJzL>r+sZo9*f*SnX zMRRTiTz61|K_n;0x&8bBB%2>1sI|MJsNy-8bLZtm2%}9kD?RUn_SC)5%VhLS*P3v3 ze57}`hO9Zwv3q6hhP5w7;IOP$RZ1GxJyp3`$_q`u5A6S#y196eQsy7qfT-N<-f&}K zINQUqUbz42%|W1n*0*>(r|^e2fJOs_Cp+#Mplp{Ney>gC#R0xyHZM9gpMyQK$Lz$A z&(?Rym+0ERV^l@AEOLwuqT)G)wos*lL;D-+Nq{1^oTd5_^ES>Syp!-K;=|qLP3+S$ zpV6Y5OtH=X1ha2`EGxM#yIXsFYclx@(#8sUZlI2}Je4`>l_jRVcC}1}fhxuR)Sev( zl~faQ#JQ8tNb-@$a?(nP{6wsNct0N526;gpyM}D6_(Ge(P*PbIndQ)_WL2e6TE1}_ zuKyh z-%-7jf^J(lHjl}o%K4GD_@`JyF;@jrlN35pzLA!YE+r^YLN4JNsLP4sj%ZgX?35r6 z&q|k!N#>{@aevZWB8>VauV^UI##g1@e_VO0Kq-l3SF9|GfPTyIumEHTUp5<-VOvr_ z5TtHuiTg(264Q$@GBHhe)gX}i$Z^(v5PMvu)yhTZIu%U_x%LUJevq@-s)}+LaM!4^ z7(O~VJmFrbtbLFv&ThL$_?~|_*9XlEZ~A>Igi-VuioKywMVWRU+Hb~niYt(E?9wTP z8MCI<1bt5WDcF1^qYxRiJw0YoP;n}|7_C214u<@5wu}+bdpq)z!dds|R_5vFyv5+b zX^CPjh_NR#h{zEae->i^dys_}MwWDM5sjryHxu?$YxnL&)o#5yQ#bz)?9TMir~7`Q zU7kfN@EZ{wrBkHpl1ryjL(1@)^r+*P5oD=%J(_w1Jj$YJc50d}{MKcyKgxv*0=U`( z^Ojuq_c9B^{=bUIa`P=6uZI^03%%miwOwVoho~l1=szVpXJ$&b+QS~GGd{Av-gdof z|6`?lzscg)aa8Xb^?qu9BuFe_LHPi{ka3OC+t&Gfya_KcBy{_-wgbF{V}CHm4`Sa7 z(~0T)bJFz{Ay4?fw0)h8gT-fK(gl`{Cu6Dda&Lhx|j)XSX|mEct@tcP-F3_;j0R zfV$5N&W+grnKnmv|D(;Wg~pl$cNm>Ga*w{B(TXQ9iu`W_f2m?^>%vq%3bzm%mxOWTREoe7>kbCsCKX~pq|Dw^qli}H%^WJ}c+^m%z=ThsN(`Y4yb1*tz{TN#fw z?LPOu^0{36xOkQgVcQP4^sZoonMu{StSTMtdc3Udqy?P&c(~;|Pd2GaDOrAta4LxE=d?vo-F=)?-yW>&~uUf6fcddg&O zvz^=0)m5g#7!M8{4;8x zzvhda88U(jSRMpZ{~?UATR8TNNV}h{=ADOaqqJ)F+FZo+48ys@#~V^?N&i^4DJ$FA z>i3bCoz`&CrLh3brB=}jwGfN^qNq0@GweB2+ba34e%gsR?7mj@O%i5vEeKok8@$^i?m9P26)|4!08 z7L*+@>e4gCz;n$@7V4jkIfif;;g!L)OAAsw9b=2I#izQCFvl0J5;lP_$%6#_A^YnZ zMq2}K30<^l=-?5ZH@i;1G!7Wj^lQ!9XMlVL&tN3O7uCTT$s{UB`5=g$)J?;W6m?9CfP;M`mii#X^g(}F zV4!gsK)KS>3;UICKp&0gx>*7}0UuAb7{s|Blvzlrhrf!vZVYbL40ZQNGCx#gBET>yU(K$q%1eZJSsqySdU=<4h!EaCgz`z;x|qYwK!dQ1=V+J{wC6)dSs+bb&~G&y z4f=+CA-!M+0ttT19z$l)MG<40t4&7PoQMAE_Q@ql`VD)`9_gp{_+Rgl7a}p71TkNk z>ir#*i`GiE%jl32f9BFrzFKhMVb`m<{Xn8DFz`Z9}}W) zqn5@Iip~FxiMAzXJGM{H#Uxz(>bTS&dF!yoIU$_)>_ZA_8!h>Liq+uZ3P@DFQ&-aMD&zu zqqCZ)9o+;%MqeG{$| zy|4}{G(Fx(Fy(}hax5yHs^E-zy(`?q!jSCwi>{adXi$#MGJ8%e7jytFCeTj=`g1X~$IY1lF|V=@t?b;@?d>Ws070E7yhL4^a0SDqm=OQI?E>nD%C3-+c|vAN>; zZ0r(tBzgP&n?RzvlU?-52B&I>hmu8F1!AtJY5BYIMhfdOm|o9w-gTTc-R)?}S@|G; zYw@_c&?%&54uuWBi34ohO0STP$QEMzOP~=D#0b$tVl4Ydms2%cc-2h@De_%sciwtH zCVRsDoykNFoC8y+t$}Pga|iXgkcNo<-ZBWqJ~ll&;NeFA)N^6CM1Y4UL~%3?>P#G8bs zGB(jo%H`m`2G*DXkZZw0EX(em)(c1(DX90CDy!-?Gx6vH19;K02ou3X2b4g&{+OSoSC z!%GyGk#(sRzS1oL^_zsGkqh#jjJy&-(2Mlz?ed2E zSoGI6_>iYI{n)5J!3ds=U+CN%Di@{Xy{L?`pni~z7UQ8QuQeAzUS3lsKGoe~957AC z{j@rK$GySbA_E9)$Gs#W;M56NWK*Uz(ysU+a3g|paWU0x13mL9iCSU{KtLFIY0?5b z0ej~(hM3k&QPgd5`J>`}@vqoqtFht1KFM!drR`Fv>xPYC(nd#PJKUCRARPxW^>NJJ z^@y%_R7M4)c&BHA`X;Q`!RY;K&`XPx)yyAQny5vN@r-f(ZSV00ZS+Y zfC`EDGlylxg!51EMr6epogj{c^fSTAOFz@7u@QVAW|U_Tbgfft z0|Sxy5e%cjMY^Ey;w0c^MC@!k>>bw^tkVo{$uSc22o23@MZPbG48rZSn~XmS&ZCx+ z>x@=QX;{Gr0~28(CJ_Mw=ZRG#a#Jh#6R8_9iO8SNH6ck-wm9YUVcoz(Kow>rlot8T z7Ut8X#n!4@P2F>+DwVOzn4hs!AlWBrDg}CY__*g0B7dWO;7`?P3pzuKyNi7ccytEB zAQ*0JWHA_f|fUOf8CO;e7qO8Wq*WK7c z!vcUUeel`ss;|~SV_*F6s|p!aQkgB^-p+H45Ba3OkoH2OQ0LnC=VH)0G=okfqYJ0Z zf!$$P1xbdo-PmA34nmeM!Y|zF>J4k~^p~IkNi$ky9$ymzJwyU+8Ini(ggwkDKsoXH zBqv#(;+jB5?Wu3oL|XbuZX~}HEtCZ6MnU)nQPw0k7j<4o~80~BvB?NwTUi5M{ z@&bzM`i(o)CNjo>V>oT(A!SF$WE+o5h*C80Av7fiy(N)?eEo?w6 z64V+Qc6P(-huschXabx1>ae6Am!B6Scg->f!q;2jfKtbN$yMWv&`BtkmrhIx&4ikz zD>+Gq+L-$fed;PP8aR3Ljp_093o9<_m6&{$7=oQzhn5X-}ncg70K9 z*j?n$wYp#dI)nX`P=mpXjxLegE4$lv%#q(rI>YBTU#|9EtIC)!iD?vLwoK4U-Y=#Z zVLRIBBaD@NzRg82&y@Hu#MI9P57J>&4WIl!@Iph)0mC3w3X;jXgBqu>{`&t1F6=@9 z7L4WJjvppU|A0$F2uhQ=`glyjD;0V4V<#&F(3o#|!sXzU;rQVoy`}!vu2r+f<^q&{R@P&0#6}dJ1zjJ6mHufIK39PwV~ip0%qd0e>DjslL0x6PW!9fxV__3` zyd+Uzy-dgRHL6ox;|NQ#ARlPF?YN$kH`ILiSkxA_mp{}Tsy)9sc2_*qTsZU$hB3cc znviI~vDKIIyzag`{i}Q8?7rGU?RbOQ&*37r=8ERP_8!G*y$g?H)T)iKk+YKuhJ$}Ys>|y9{cwPzH_uR5!XNqlt~=w2T*?(3IuG8BW%2&o11W$AM1>*h;5vKG49ez7gA89BNe!3 zWHiCZx{DrTVg|x)+@Q_vFfn$qWnaT{R>Iu&+;5`|Vn@F(2onT*u>XbN6^mJhhW5~<-F6(P!6sIUJQy0GKo!t#J0&`y$&?UQw5Tq zqy_G!-Eobs}XX zjH+-2ZHwIki?QJdhwh1glJP_vzQ&ymW9Lq;<^{rc6?OOi#0%G`6v>QTOvoxk1HKx`W>J!OCxmGP#GoJzDFYb1|52A8 zHYR#?g1xv1X`X+T;i=`m1Q6?RD>4r}C;Om{pqCH;)4OuZoL!T&K1n4ZfQ6xmJ%73l_6Zr=n-GhG)R z_NNiLGV{iEZX~(GF-%9UsnFKxQ})Gj-c41&SX`9@#v&sDn8wvO#u?4k*l<6C2?W;F z7%&!Bt0`(GhC0|M(9xXHtxO>nKC<&vhQrg+$Ra-E#6O@^VZ!1qB}tY}9plyqJ}X6kTr za_yAT<9IY#qCH9$3Y8tQyky&dNEJ{udm0rfH?0vhsx{nf?oJLKf~+zFNog!oDMy(Y4@ifKkqwW0dq?^llePw>r;Sh<+F`>8YRDEt3A=R0-z3* z$zs{YEjblNY8I2c*|qMu+P>@&avKEH=7k6URhU_qh2+SBVXCKy&koi(&Rx>48xJ84 zAVmB={k{Zbb6eOrhHcrd;IRuJIUPXGwELYizXXh>te2W+ql@PD4|&Q6--6bd&|Us7b)h&+|STA*dcH zX|2hb#aBP>0e0Eg=gd*eBGbYMYfCP49Gcz9D@`jjqH*vpc4p~fMe@GeugaV+tkq`x zL$@9xSl$3uum|7EkL3+u1=n$dGFaZiSibbPAY zZA4a|DpGafXOJ?3U_$KB$UKARc&=iyRvGKfSapbR>I7g5&6y*!A%p-mPbkG8Q6@-C z+!7K#6;UQJ-y{X(?^2>nBcez>)u&gwBK4ZCVCE) zWDu<7%_tsm3LhIM>KT}O(g@gwxwdii z8RG3N4tYF#V7VrjF};`&rB^U#OsM`8;2JWCLfzO^Ja;FXGyzGL3uVf$4CFV@fjuRt`%n{KRmP9`c%!$<3 z!VzODzF|3{{~QHpo;ws#&Kc^ z4G1C|-*C5zOLvkb(M3E0JZnt=g?7}kaOnU6TXcX#ZVtnzLUE1(rWw$bT?ZY|G(d5t z1A!gT1W4rOuoJLL98!T6e@&!5RT>>o^D?yP4IhVAeXiIIpFerTqjS=70SeFwOqgX3 zS_58X8c7&mb6*``ElSD*I6Vq@S#!@v@Iu^?{$#8ucPEX=%*6i>y_w_tf9lPB->waH zv%C+eW&U({ce#Ixv(RS52T)&L|J@=QxbD5v(Mj8 zJo+Mb>=NvYY!?t`JfbQitjBbrFI_;C9qx3RY`B>%og5XOOmc~H+T;TqDI$^1pLFQ%5 zJpI3!nfx$t3uyiMZp-7*c1DqgjXzNbA5H>ilxf?8q%!pINU?Q4GfN8OA zAK3j*bgDgylAz~_Oh*lpM!JFL8f+f(H$+l9R)^JC+bjTTo3DV{rYB|*Sw?Bkyc&x; zw{e>q4_9O8tJ*?^3UV7%p^8Ahq$Mw}Zo(uqpn{n+5qHQ(8%vW0!sRR}%;-m|EleR( zSgCfVpjArPHAD5?bv4Hn%gvY}0z3yo+Bi|CHKv~fHuPJPh8=bbg?n-C5CewZ@LE)U zI-rCZOY*OTiJKMH+3$og|GS}JRWsJp2nchd3E|FAOrCcJ)U5drYNn6LUjXx&8T!Z=~(a#8Y~==za2AURA;RL%9~fO%dI-&Y{xMB zz)I!K0x3TW#j=@W{M;Ofaoqc;F}xHU5BC9wbV$iEg#imTZwcI zWMivxBFXoe-W(F@&E#7uyld&)&(vHlSVo&K{z z4X)rRfC%^vX!gGWO=jZAtn7wgfJm0+bk|M1_*QD`*SCVsoOza42=aT_g3c5=esNFa z@PzMMvZrY_lFsojhXioqp8kByQ8t{h<~4!4Zi(Zoy2tFnebW#q8FA6ncF_^-NI?*Q zJ%I33U3%}q_RzCcRS%J@3OxsD_pEh91sGq0*+#$&E@T~P=oQx%^Ll3XmGcUjn!_Yj z>KxxRSiLur6$e7iMZ%aE%!j5tNBWg2cveogRJ-;gJo22GPi5E& zQ0rT<9JUg0N((<{W|)rNFhasyu`I-vJk2~HOu9GPal%XI9yd5&2EybRge{D~tx;ub zX3Tyi*16VwM=6(v!>hy_2?_p_+&E!(`v#HK@$YLRKvR(8^)l$b$TQedML#ny^DFlc zWYFrL!tSd<4nxBl7EuV3R#BZ%|IAi)I2`#2*tc1NgrvhX#)aam3!Tiq*;0_yfeaL% z-b=fyRpjo#A@>=2+aHc|2odxQBptUMF~YW1-{MCi2JP$rR(Zmnb{Qi`@;7v^*Rbc- z%i@Kz$ZSeQesi3^MNVp90BuJ11<+=~XkeNai0H6SEf5C#gtQ>AEfA7~fKw-6nbUAe z*G9YIPLQs-79q>{i15JP;lqr;a%qcqxG5gv-%wuyjzdqj%&MQ8Cna*kf6g`?eZQzy zvH-m;G3_o~km{T*tvt-bIT%R|D4IAsEe*yEJnBCZwk%y`j%7z#D%|W}+2R0yqYhd? za+nMS7W6wE%ATW2#%)m3H zx-(9G#5YsmA2xu9a((bKI2H5fKtYWp^Ez)?ppSgJd=qN;TaHff%tiIHKw0#%OF~_3 zy5&NOQ#CK4P3KUqjSE~_>?dc8sW8)r(9k^l=9K|7$?4Mv>MEwFTefGXNC(r-31gv; zRO{RSmgnkqT{$^eQ7hkCR_dZs;wLlB$rf&d)mmO^hcP{220xg|U#d#6fD< zi&Gt*+YuBdZihXnZjN&$ipxnx*k;Rd24$XeC8o)7hB*>uhdqFTHZHZ{p$!8$zz?(0 zNG|tm}9P_d<+>aDNK6IF)7m%$5pYshhwBeGwyq0ZoP$cMlwD zk(p3IA7n11xWBacOPqW*^l-(fdD~mv8Q-cLqK|4)Qk5}BB2NFj`Zr36P0ML;nu!S} z$=JFJxZxG2^=>)2?BP7*3#KnaN6}`Tji*>7nKELGD6GVxiSa^-47tk#!O8!^)#0@t|HEU9$0Ng^N&)jMeEuuexI`zAX>+Wt*n=AtHK~`C zE(Ilv+t=Up(tfyo+8;^HEJV_}85ujF^U8Sb2} zXkU#Z9F+}NqjXYvWe1FxA4eW#)#B+vrZPtW4<6)_}vWL~^* z5gg*bKbSzQe2AVw{F*g z@RCKh?_6Jjtl^J;6KY_*|MVub%PUNjgDPR)9v4#C|H#UGYIr~m+QY7J?`&0t%)azY z0K6CAozVP8ypC~WJ24@ScIBsH0v%F zfT`L}6Dw5u0%4&G0iGtF_Fo5UQSRQExf)8>+L0OEko0YbwSr9RK7eI|=PG-B{z`nl z+(v))3I#N}!iZ`UhPtYE<9(tk#{d+L_}?gkC@K1(m#YT2IJ??qz+vLHNQ3JVES&(_ zosOv*MI(;vL`x@_Cc}+cRrMY@@E@+=F12 zW|ag;8<^5y0wbR6Pnl@-Wd*;L;q=P!+I1CJi#TVX8EVEzU}7Rp4U63`TmSXDgfx1a z_loTrKt1zX+W!T^ELP*w_HNcNot&LHxljGS%sd*c|Ib7{@k)Wo(k{ z9Ff$KpJgG@X7sr;D*XWG3Sva^-@1z=hlY0W8q!y1-t~vS?hzCGCMKQmwKX=PMhW5$ z5WTkl@w=>C!cy63`PHv)9w=%0JGh)0_WOpkI`iT@{g3ek5ru>%zCK)H+BGNVJXct< zl8<(*iB^-5jEF??b0>&i@4q)gj9@H36lQViPu%L7MjYb?bHEworF#9JH;Sn_^sPTP z+Ua))$>zW>eEk$GEb`OC6lJD((SBCYh1~}rBL|!d8?P&#Vr^q6Q<8LYsx>O@X#KZz zxc3jqbj*;ekIPmYhn+JcA!VVBz72a!jJuuM1nm520+PfAxH!SY1rG)3X+h@Hj(=T; zxSVR<=JpeS@?S|IC+WyzpwOD@(V#}q^e=p-oh);ok2DO7$Qj`J9;z=+ZBpTJL<4 zZA9o!Rx6lOmQ2SYE@J};6|fEhB@al|Inn>6YE6A}dYOVKmK&%-N7St$hEV)oB!^0` z30RZK&%YQGaAuoyv7o+wMQNO|;WK}HKjP)+ z@t23k|sUoHOP3Vpj5oOPBuy>~|; zSAAYKzJorf3D;}hT=g}wYjhv?B~LQ#Vz%TU!;Kq_Ztg4mVwg9dfD^`?Z)rNit}I

TVznuG+E7TMq}+#oz-Ab!rLHkgHlunbXBe`?KeMkQas3oe|CzfjCED2}8Z zu2+}6ZtDX>HwRkZVU|7FA=ZG;7PwZn%)s}Pqwmy5>ym$Xt68t;-onLKQqODY8=r*T2$J8>_0G73iwj+Q5o5+3;reGdA`%Y}cuhg`p{pdZsL~6FU zG_q$&Yola#Htw!&aYqZE*to^zUnoD@RGZ%Up>jLKrcum7&n4~FWSxF@S>5L`%W=gq zqiUa&+;xF3rs`H&r;FV$ep)Ey0Y0Cq*4T$LJ7_)eovPx5gRVH@7Ke*HtcZ4`3jIrV zEYtQ7f+|A|tt>pFURom&CRx+$D{}aL6jncVGtfoGad+t19$X_-PbGLhZX2}NvRpcN zVv4Yb=9P%?(LJ{-pxU%u;ii=-ZKlDBfdmsyqnP4Y-ygS#+99@o7kH9MoU6?TZ zw0QIz+N9qX2dcb)+1!|s-(Hv4%+EyzBx!uX4|e4FX^nIj>p0o@ZCe5};K(ODuL9eh z*7->jHKZdkqJGjfXQ3NV_C&R3p{D1qZB$rc4m#TKhEC^a1Uc1JMW3l(-Ika7Ix|B( zxiD$Z&r(43wWmCSe5#CNf5gw^24IU)D$FzL8K%oLhA>Ci6gD{?R+*pZnp&j37nsgg z9F7<|hbpLICf_`Oi8m4xY4MJKXkpV8LS@pgeI>06JFv-WO84!M3#pd}I9<$zZj=oQ zNH-Uj#Dp8hP+ZV05vjmFV{gc6MU#TtQYU=N-Z)Zb zg<3>YFF|Gn`hPRD_DoGN%8tJkIin&2@a;Fm{peks1bq7!2Ii#d9F&btM%~p7_GsZ1 z8MnB=(l<^W@Q&+C)?>BL^RW_iHS|mzgp}uh<9l3)5w)~Lcd~jy<5Er^O7gg0Bhr+L zbJw*Q=T$5Dld-S?$=?~6lahYCpDy6T28bdBKoqh47e(^+?0N6qr-v6IbZuH!?JL2k z!(bL_8tb2Pyg+Np2+}{#iPAVv8S{;uvFYnukiy$4q+R>Hlgk>bp-Q9j{}}zY;t{O2 zPkCD=$5I{bc{Y%@U0tqM1xuw?+)=~dC|)RcEGXSKTJ()^eSy|4HT#h}ur|6BRX7Zc zb6)G@K$mYXKH%-kv%Yn4Ro6CAYXlL1H!p*C$=Q z^SZ~4=J)J5PO?(5NHs+XOR8Wl%tB8-5_pbnb$jydYlxI|YjhcIG%|GYuuYPHezZ_Y z9?1%ZLDHgL7;Oe6sjI-g*yLnKKQW`7xhW24Xw>p|yzw_+X^-odhHCscq73yq2d&nH zW_-*7@&{I1n0|ws#RCMQIM7QihV`(oPyT7d$mb^)F`rq;Hkt~2+ zom3goPNFq_7R%#~7g>hCv)-IiM30U20+-YNLVzoet$1Nd@3QvlqnZ~sFMiLq@M+k2 zrTj66wF1%dGbH76)2FqS{{G!#!EiKxsD(Ab6o<41N;b;%o~xjiJIy$^cRZodVd2Jz zFVI3#!gLze7rYE?Yh1z_qeNmgwEq{h?9UtDLm>s+)LyYPsKJb9TNT)!g!K--tn|qu{t|A(a2EQg;J&1@S^Yq{SG{B- z`@8@DMimkJ-tlrrA0f%eu|v`pprw%)3|KPww7h&@40$!mEc%{3U}fSok-1>$mjs)4 zLOon~1)9s&VDkvd?rV-`QlB^J%&igQ@#w9QIJxHx&aSv3qK#XQ=OTl)jxQP9L!GBqY>JZ4Q<5s(HiGlK^eo9y-(3 zy00y%VZBws7 zi_lvv5h@TsEhiM%+B8aPybyCiHes4~#Zu_p!%mm{ENO3s9^=P^8kyFTP>;e0}-(y*w-tNJ(h>wwSo7>?1I}s_9^-7z=eB zSdI#;D*a!>)id~t!YnE5-%74cQ_RP&{Uc0W3h7|;+BW>uDr*DYmi;s$7K>7Ngpb%9 zSs$nhC~yP!)k#V6&P-?>%t~?~6}*GxCVg1m+>%pE4Jp&VbbK1QdU0~Oy>#^gdM~~{ zoBtvG2AujkiI!;dUOlC2->02TmbU0nQgxl=!kRPWCq49()ZanW4t=cY zA3|~U5Il7IlgTms&d9j}JNdVn(1oWq3tgZ@$_RaDk)1D)_`klpy+Xo22Q%n*3czbN z0p(A9AT3uLdhYiRY_@>q9UCk2KWqlC_S(Q|J>Fv>S)N{RO-lQIS^RD^1aB@z_Ez2a znVP5kAgBTGY&WO@llHCJ2`&7~;-qu1VkBO$xe{l1#_>1dMUa|Reg-;u(hoXy{)hwaP4>4uK1(z8O6=pzM>*TIq}IF50o4XDe;8z<}4an zu%0>>QEi7;)@5hJA-8H8~TPZ(r0%mHuss|AlLq1bq zc$}9yb6FmX)3&F+RE@!Bgb>tCkugt8tb({v)*q4=afmO&UmDGSozoCtbJmLxr~QPK ztaQwjrSAi0W@MUsC-}Lr!?@S{GwR7VdX-FO*(~wbBGFd@uBn;|J2iD;=4MQ~WSQcG_hA zp>T3&@D-(!7%3hqrVPVU-JIvv@`=|n!L~!vgaviPEt@mRR@kzSb_%2MQFVfz185O0 z?ws#rd7sXNrds(p*{o3n*JgCyNBt35gXy6YC5Af!x?ZoiPy;}QBlL^ zk$;W|RJU0|6{}E`XRD=Wc2nG$=^pX8Jrs2-R~+bh?hC0>8PBs%g}PZzurHK%<) z*gBv=2ISR=Z`(Pbi5S~DC=JZ0V$$MdFhLK_sNUl0sb(ptt#?aDeix4NMPT5-TX@43T z@Exp@2-+cQ_S_?D?t`lvH-hwX$8WSKViIGcq$ba_N)1*~sav6FrQso8=q_Zy>!qu^ zE#tU|(V!M_y?WU!It1~6spl#wQL(u?U{ar1>2(M7EZ)$ESXnB|4c<)$md z&DJO6FVlFL1+-fRsoczjw^D!p2d0k&9&dYrvZQ$wW^Q)|F=gwo021_KY11FSz+)=x z{~tjx<7vNd zLM+9(8fD=QV0O_iq@6eRh6t}$!b-Qh>Hu~9AxjkXmVU;9UvA2W6JIK2I4Wg*fI&*v zp*;*e5yZixfp}rT%7RqHP*HlDYdUlv!+gax1F_q9eXui!CKUE{a!ZQ!?x?RMf0*QE z5%MdGD-buxFxI8KpY7m81u!_8AIYo z6w?{WK?37QCj4w?^Pl1BZm5hqS6C)J?3Z;vQj9;s+|12vDt}D5LOb#spE~`BPpGYy zlmOyFMXR#Jk*pC^=Yp_POxb6FgP~`D6y+F+nPld zb@)}fxG;Mb9Y;HZ1jX4%9*!t_8erM1!FAe zD3{%$m+{TyI{-<282lr;2bR-jpc~G=1v`4fD*1zxs=312SDomcO{>g>Tp;%js~5T= zG~X(L71>UnUhi3$X`2PaJITURUdkh~LgLqjr64|w>tVTXQilx^;!+1(G>Q8|7%~UL zbPudPV+05rC{6tN93gg<<>WNE$*dL01Kqf>?1F}y<)%bWXHYegPJ*ov`aSRHj|u$%t$t*j|dRqbTzX9&utO`b}4%jZ!877 z01k9EiiyICv*sr?iusQ|NS2`|XW`-(~6!q>nqsOmY zw?QL8b+wWCj$KhdZGd*Q6+dkVfx&dOC4=rcqu=88vPnA~z&(h;)N$%G;FO_NZ}>R2 z>J!y&`21z~1ME?Xl*++sMIz(Z~>jJos!|#ii`S|I4Qvi2r4b2jb)~EG2 znHHhqYtdbZLcPLQtj*`L>`-xM8hHnXR%_ki^7AMRyPEntJ41AnYhL>&^9WRE{Q+UN zqPy?K*|tnSbDx2%Jhn)-!FsP?`K$7rox-Ba*#5V~^m=06bCMu&>a4{&9L9v+y7&6L zWoZR@tmFo-R-UguQA3CoXfrKF*^y$qDP&@8*sCb(&m+mfq;IsO`^s08@(K?WxIwFC zl2@fJUp1$sz%yEQm>zb?jUCueuXMK&4!sqT=-Fodpawa z9(_hYKNfm zE;ky@AhsfSMQWH&$h%A9u;jTP#wAsC@0$Q?wRq#{Qp>02*-L63F1#oq1$-=$P2_h$das$M!| zaDI1jRPewQp1~p9Yl0JwA2EH3ir@l2LCENZmVF6}C>^WrO*K@sHed_)usEYdoc%HfqptTFpEkn9VJ@w}9n1dXe8+0X;QUc5 zVbxGOKALi>3|dkk=0kOSkY8kR#su>iB!E z(H|@_z#S4O^X}R*xe}|*EVYVxy|ocDyvs}=I(Zgu$Jeo1tTYuejzt?3-U#Y2PSFF% zF<{a}fnlPPJQvWFjy?>j`h4GFoF{85!7<%fALbNCzY}d84+$HT#QeJz)@?`o9K7)( z05ZJ}=ULKUNb~~%FT+PmtXc12 zaZfS@V|0HQWZ-Z<^Z{60yz6|f1!I_|@_VQ;Tw0gJ5g12+C>cUrzL%!)-bMlm*QgEe%rXaW@bHVQveuURfz^*N=5 zUNB?QS~LNQeQgsSL8=>dEoiM<8bSWxNAL{T91jr@xIwsw5x6C)Z1GMyO=8`%S@*a4 zj&MIAB8K?{|B+vTm%8g-G|@JUEx&zE@#`LzFZS9_{*xzoi*5eo-^CgZj%kj1SAHTdfC1G=}H%{wO#MGRs>{?3W(HFcKtvUK4ravLkb zL%V;M2NDD!YcxavOpF4D2*}_Bz&M261i+{O3sbjEa5oi35X881Fy}>d1{U}FF*$)u z>^H<$QDR^OZz6j5=?5!DPg0UE&=LW*1g&uoSzIo*Dn|v(u!1KXb|uoq85;cDOc> zEvORaFVtUd@MV&R9$z9?3s>kLosjqBPJHNXz_T z2D4H!REkQu^XAFgnDvEC5$BPiVSTQ;{`>2Qhb;C*h1hMWG_Ai?+_OEwnT~V|M1MRS zHLCyJE+qnD!t=I-=}`e*vo8|}P|{ENDAe#>nI43?wY-5WC4w0RQiC}Ib;m;xs_0LA z-c(RTcFW;l%|n7(<8{jO9Id>`nr1zp%`Y#7tQFP9M~>KL3tlx0I^Gfb zCIF|)V@q|lBr3wXxSEOhPd^L&sYn{bKnFqTFnNh@p4LEd9S&YAp2=b7FeEa4} zgA`qK-mo_ zw|30{@lC6`QBI6q1qSz8ZQ(l5>XZLLz*g;_BSu7F^Qd2i-0b+jQLUqpmb0~Gwi1RXzbgG{zyZC8?)`ND_?&Apir_zExhV6}r1)cC>4CHQqZ)$`OHiSs( zly@|<8%kI}KxG1x1+P0@L@Hy|+bUNE)8>3gl^b=1OXP`VMj?YFk5p70o_A(>4d)vt z(QF%P!>N*vyk43BUpGgN!=X&x^wYUDko5V7SXE=+2#l&7MC9-+`Co!{(meu`0!&0i zpQQhf!9B&G8#=uWhyCb{Y8T(WA)@ixABbwF@Y+uR>WgYO>UoM;0x;y_*plMWVKQWW zaWFbEjR4ZippvytpdG_$wJ$fuk~tXiZk_#tSaSz)=}>f}eUfte?>rgDmZ@7kV+G3; z(2pgQh_$kh*mJ1`gvQm;6Z>$sT2_9TgUxuHXCgA6RC)B?$@Bxuzr@J>ei|Iv|1!e> zvlykN#RDbIUvseauI5uI6^9kh_!SE!V%5iK^thhbT|HhFq3eb=DFM49c2>=G95?py zF55Ro4QUShazI#rF{U-^)*VwiV3d1bB;ws2P_zje|8Ej;?=Mo>&r-qjOofx+S%-v^ zqlBzYh&5|+pDWGJ_RTJ*e_Fj8l3Cj#RTqNy%EI$ovkp(*bSYA0a!%~q$F#VmBn>2J`lr$OSMtg6&POrSji;vc_KKV0hervuMI)^8xtWSLz>#k{LANPsR|3TiDZH_ zwUJ^AGedbw+z_dXDca@vmz%=HAPvX##JC9jI-=T~h<}K!J@-!05@r z@a6lG)M3gDL%bt}(%>_{Y#up1wjnxtaVoG*29qNuaa-}PJ8SQcFM2Fo;{!O{Ad_pI z4;=wU=KK?x`cIWdRo0G%rB|0MX|EPWc(IX9f{sefY34=D%Dq1@8dz+ zMIvan0MmM#?!Rg6^O(F-Lp^5T;vs0{_%8(u%tV7*7dX+eG5kE+bT#?BbiV_Fh!K-Q z{cnO*!-|HgA{=&cbkus&7VOkG1lDEI-+~_%TxCrkb6$+DmZcHRqpJB#rk*{R6u(-0 z_OKBvthaGJN(z{%l+BVuh*5Xj*s0f?)Qx%ZI6#4nvc7aqAaiLlPfLn zhvzQOmzAs1r2=mHdAFm2_l>jjnoO^C@LBGb*47t6Co>5RZKYayo1>;EL#>Km=UU{q zLuoQRDZ}>@PY8z_iHBW*0kcE}UbR3p*e3^~=W5tA?|tTJt0vY`YknPSeqIfiRXeT9 zmLN`_w_rVQUly{oIz9~2RQNF8Z$DPt3SJxE4cxJnkl%4hCuIT!xL`OA8J=oWPnh^F z4q1dCuh{k%E|rz-a2%agx-2Iyp0X-m@Fi-JL^+o~2;;PYk!jIo{W7;>{VV zQ)1v9Y6B1B-aYBzyzYy!hB0n#2kYO3uZk9Z$||sEu4&4yG!B$${j6J_yR28HdD3UB z!TCDfm}+vA=eC->Gtq9!`n=sH@3UYYZZ7t+xQ}+_o6=+q z*DCgl<|q~^mjN5JGT|OqZT>I9-YGoNc3Z$oLc0&x3Zr%cDollDiMI~tS zDz}nILa_Z%(<@yfm`daI>KiVcUpw)f9t%&j4MnMRw)dpaDiYGr=+`AIMx%;1B9V05 zwOC)c$Zj-d)fYt`k!p!W{ObZ;8FectM(t5V-L^S6_>9R)japnFlS^(@TDy9i!4 z0BnhqHw{Ek7D}>0Wj6vc1zRc5$F$>ceqqn*J--rfx5N3PR&_!Saz*Cd!w(8;9vg?7 z!ZR6D*n-e`&*oBq4x-bc(h~OW30?F1!9huJ8(ZKgQ^(l+ z^VGGqnQ%F59$z~~?aY)R)o>We+ues#Yk`}&CW5~)`tII}e-+)ZGrALH`LP>Z9XIbA z(~7NzTwi3c=ZJ*=--e5{3t4A$bgN=WI8eub)b_K|$Etq>*F4Em@{XCScIDTl;Um{j z+i=Az9VU^HPYJQI6}31i`%oYAtiTQxOO|Z{xCKKE%sXB~WgJ=`=xlP=liSo=2xxTU zha%_O^`vwM9{r}<6-`Qt3xhERKWc=uYE^vFnIsv!My#=h`nU-YyE(88#BSne>u4%_ zOsv2uMiv~p6Ga_52@V}VqBu;gICIAr_HvSe7aeajgVjp+W%-r#{Vg19#k*g2WCu>{ zfHld0SbOcxml@4Erw0;FN0O?9UAGR_9f$9{a1*azQrd!`th^V8a2mqfhShcda|6;s zR}*8y)^JwFls>~|w%9k!$~&L-b8Zv3@?}&$d;l|{%~elDlhl&Vkhf?=V#&BumXOnD z{kf8$tnozlhhd`DQd!*4`y^*!mvU?y`v zEC5}iEuA@=kDzi&b(RvgFme^vIfbohkL&Ah?(V*HI7ciu4nI0ZsOr zXQvo3(%fla$W=JUl)&xCG!#6fe|`U9+lZ8Pdg#NKh?7j@|F{3Iso zjPHs?l8|U~Zb`gf7el|3J;hV!Gb$s2Cqz(NAa)eI6`;A?&-nr(Wj)n4(0*WPp&n15dn5ER zmjJ^^85}4h<>Fg}v?Mm}1hL`vV<_G_M0X3$sYEDZNW-FSDaF~D;r%dYl@JTuYm_Itx{7gu3BF#uG9o?9;Vis;1|p;h#MogMwh^3WaT}4 zgq>Tr>RM(V^%TT9-?yvykI^3f`X8fxm=%O10k}1iB*AXd3+0$HBb#%nNV3fe**bi2 z%COS3(LUKvEz($#W`=_p7kC=psf##X#7+Jf1o1L}J)~@!vJ3uSqkY`Z++u5jn2;@p z`mO8-F=ss9Q)_7oY)pjXGO8p;9zb;&@dy}AG?&}ok- z0!bAlGb7KSJpJO4u}V5+BFvsjszrZd zmM|Cqm?W``fZe1OW(m()s~2KqLv{7i@@_vQI3OE>zDblQ?8u*fUz9cVI;hI16yj1PGGCI%D zkxbe<#D?-1l7=O>f-tI@=cKr2lB9f=q*0-y+KISTqvTQEDG~`66G@p836&#BcsxnC z0ExH-*@d2P5_+zX>^@7FMXC?vn7~;0uJkI16|VZ1zczcB$YW`|F!cFk?(wqwgWwf< zBWLw?Xdb41n(WuCsf=vI(_~&Xqek^D_v0IZLQx+w_>?`gydhuH4Vsmwng%R{G9?2l z;{(w^GDIOGR*i&HHYVb8WA-HE`~mtIRGDyO8E^^xZWCwcM$C80tkEP{V$Xh0#j1IC zMO+U=B}Z^MP&$4Y++AcurNIaa7197B$sgKq9;r4knQ*jvxGmPEaIfHI@E@x|)ktHV zd!z8@a9{tb?6qXgdh^8GiW(AbfO608>ti z`zz9M{=|Cn%`Ek?OdNSilLt)`&O#0E1-X~K_)uvIed)+9xZ>c zKC_fWdv>CNRV&?hbIVXQ%3N3Hp)7k@0hxugc|*_b`)<+2?kAJiXv-<(sc&bLnnR8M zpgh{mJ1`ThcvJ0Hkp*$DGS-!`107g5BI`wJKYdJB(<}zqXT^a!T08R$K$seqwy&I5 zm2{P*b;@5I>3I6q5}_5a#p)X>nRlQ%P-G85pH%umbw2&DD2V~fU+9leQbwwFEk+lu zY8SXQu60@z2h4p?j)e=umvID~Kjxr~W6foMuI!@y`h~ZGYOUu^^a$IHX=HvQqm63- zoeYD4X5FdtjqlvMf|(`^)#wuE^mp?DJ6(8<2k_)?#i84VqUq zhLUOEnn9_hixb{~WE}!Jlz)e4_yui`fdPW-QO}>S1)uHa<#U8@-$Mpa;bgd)7DYFin z-+^b?jx0k|RUL5g5}I$bX))AU4;3mi6Xtq%=C=@*I(RyYs&vaY`9Zsk;A)6O0uL&xZv+-;!F_*u^lO$Atkje{ACG4g#z@a89F7W4pA{FsNdxryBfljm0t;XzX9d z)b~2;oS^m9U{>4z2;48DlZ&~2ny!;oe>{FZ7nWD!+ukx_y#kY~83wcfS85eDLBF@A z&oOmRpw(Q)`k%eeSM+;=>5~>fO?Rc999U<@NB8?}X{4Gy-pBl{oG0^&!ut`njVbzT zau(k2Ipu$cSN*%P^{JBOox_s({6(6T^8pW8sF#YC?f0AKSBXzviIjSk9)F(;%B)|% zngDR+`;eX9_@=CG5!|J9<`%!S{8*RO>v2_abZ06&SJstIx9;Sl`lhaH%}^Ee8@sf_ z<45iLW7{3H22Xa+3h$+xIaQ$!S=Nd0w{MJV<1gudh46`H1Oa2~S3Yk%hzf~vsyy<9 z2X=Js`XTE5P)8ua=PQ1(g8gq`HA;4pyQJvQVb{7ekiJA=fYJG-um+;_lqUu;42hjM zgn@$?eJvbxyBh|(fo-!ZJ%_ya%D3>5*?~Qb!%uVNY-j^F|Hr{rs2V1%QmZVrOGht( zU2S}Wi*Pgix0ik(4ZLCq<~d{*j_8sT2K0SQETm#oAEq9CB-e?!uh&@tWR3lo-V(cM8fzN>`gZXUSGMo>9ilE~&yA2jGQDz`_3)E$RE z+LY)dtb%p|YVE|47$q)U3GF{GKeJqZ0W;nlorBQ%Cw3tOO{ZoMIt<%ov~aBU1SLE> zC3?19*v(UR1|T?x^U7I)Q6YmaE+YcmO^X1V4h5fn>T7?X^hJd9evqE7b36Y338Mbt z>k(tCu{(p&jaE^7)DY(jHDMLdp@%-86FQsJvw8~#K|~ndi*nJcgF5>a^ebsU&9VQs z>!helG-qhuFQiQ#V>g@`7-Q#H{u6KO2u(@`r%?ACgo^9MJvGP6y|0>SQW{=63Civ; zAN@4{okSh-Tb}V#!xh5C(Hv|$Trc;l)Rl?uHdpGpK`YQ7`?&@~%`%!&4Hha3a0aq# zOuHaA!_;)OHFu~sIEk)T)6P${+TRk{LD7F&M{7R5UAiNJnLtuol~kXaZOh>O){ z8{yOfI1L+LzV9n0i7?0NSCs0jf|ano!W+UpHE8#iU=riaxj5WXas=$roJn@H(olbE zyr?lO@7>=EcuIrY9IXy2{?1=_y4c5AMrD6Dgh^3Avo4jHt_#LKemSpwsSJw^x@43u zYAjyEWaL&pT!JL53R-Jw!m2N?o=>a^EaZMVqR;7p6fH zN{jU!8Z9~jQi=*y;+{km8qJ*&VplQ{vW}4Xo zCM4N|angpbNSQj!bP&0%2c!<(L@dahA9nqj{-dd~8*d`S*1SR^-WO=5TqRk+*&-2d zP4Tz?l^8v=iX`tuN0W)JBV}s9!*lKu%{OQ z)N|&rX?h|2VqF{0cXhFn0+chM?=*rhgc^~8FJDU*B&1RT%YKRAm75IM38z0(rx#=m4a>kbN#axd zBK6wRIIitifhnbc7j22%4^k?>%LGL!{+>N@@RI|yaJS@iE!6lIM^>d6@7xX2_ z)`TM&5;XiuLd0|RDAtfp(jex1xgjekC>T1C*cB}{L7qcd3bM)`4%!Q46gTDb!n_uC>VcS&EPu&rJHCHt_JpkJ3wdsoDnk^BwagA zHXF_r%?WVZQH)*=p$DL0oZw*$X)5k_T6jq53YE z_3iYpvYz1|Wj)lFaAz!jHh^i`k_V;_szs)ulQDLaqDMN-@8rfW&bAq0?SX5_)4~*V zVWljfArFqppYE+2GN|%c_IJ0}_b5XH$w!0hE*_xxceR4?G1rZQ>#>{|x?9yrp=wXeGeTuR=rrL#haXk{#kaEvP}1NU7w_$Y@}D51t(RC8}KK~TY13t7q<*g zqwsTM0nL%O@r&l)Wk>U`)sJN54?`5|_OjL~R%(h8W7NgAzaEAoj82OQ2q(g5*VhR0 z+1F%>`sB%vjap$eE7YD}`)g_Ty$wf0v13dfdFGSE8^>2}tkm;DL|2HF6sPZ+ zA(dnhWK{AfcTqZ>C~m17eu>^I7`iprh_@SD5kYu!%8}JYFj!euI-%UDElD$kEUdY6 zg^?7o`-Z;trbo(Sdhr@F55m`ch5OT6tZ~~9(`J4(gvgVqzqSV=Q>xQisZfCmA&1or>(vk2 z@1|RQd!w}GF55dd)3Kb8)md)6hsvjibCgFQ2cs}w8zS*mC3QuzAl=-b^<+az%dxB1 zVKSzH*PHum{IJq&DC4Ikw?Zh=#3LN$CS53GnZ|9twJ?#GKvVtXTc5{it~lvrE`_F- z%a35gP|>8nMEQg`MQ?pm(q7i@e6hb%($U#A=Y1cO2H>sfv98dKd>oxD!}*r_vDRNW zav@;T(ZBflA&|>U+gxdV!pkba$5_w=m`Yvjd7F45&|TMFwfk&f_soZVG`-LLydPs_ zWbN^HdG&kSv~SQX`;E3zQ8nnKx_%Uk&#p_u*D7H5dB51S&?BwdQf#kBMbZp}yPFeo zI0XCmzn5!1?}jk;Kf8V3U*yq_u5 z=ph`>^*`O_K8mS~oSZ5&gVHbNe8kKjQ&b1d*)ma!yV$#A9>`A|y?1|BK=YBSOlAkmWp|U=t?K$mBMUh`5~DCcny=5tmR%VSnh#o% zT$}!8z7vh*YX5J~%zH~!o6ko_t#5;3RqhlX)_43kPZd0NlKkJt*ng5Q z^2OFWk}(T;yioiEqZ+hSJ4z$uwQ5YX+uN5wZ>~j{p<*>+6UIyk^!Nhor0qA#U^Jr_ ze!}whA%dr)BPMPb<~xz+Dd9N-qzS4qYzY+xDdowYs}rVKN?is+LQynvtPkQ_e?xcz4?;Bz#T22*R&N5c{GF^32>-fMN8v#h8e$)zXFy^``w$;odWZVVc3ueR z7m_;agi^<$jO~W&pw|*=?&M|B*$JXF21RPnjyDbZLoBK8?C5wbUQ<}T`znCZ_5=*K z7FF##zfb=g#0jK?b42Kr+>^3c3Ks$vOxUR`#{u8+v%80vG|Tgf3h@Sh1cr*&9E2z^ z{M`E%zByO+CRw2%y*XmOGZ=J*MG0t1xwmS4!a(o8-bRyx@&Ko?D^x9jD!&7fe~;*7 zzfRl2XdGUu`tnB%jy*#xq-Nj2SnbZRp13;(EPAF_!V&Un`Px~Za5S(c(qX^g#tdwR!utS0LGgNA{D{IJst#U3@9 z8gprP%?DSciyQmN6&7oN+pf2KsLKJq4J2fPK!%YT^CX~)uKGWb982C_Q7OecEAPoh z*2IHOw@rl?H1}&Wo7v__B5Zsd(%4VxH?Ho+q)-jB-KBDrfrESHsIu0H7ZS(NVc~cd zl3Ykg0sGO-!ZGLg$3iI<$@GzhX(DZMR2NCi<0N5%CIe6<$w7kNGNqem76>K?Q-5Q_ zc%46_xM*?#q8Wrrc+fZsmYmoFD$CH#{P?GXk0JR zdVX1>LbU$P>aM2_2qCrLweh-8aP2Qxr%el-V`XL&L)hg?728rcqps>mDLBBmJ~4f+ z?1ux4>jlG1;!{ijzw%`Csx*~3*{cEW=v4-oo{e781yax$FEv0}jz(uTHDX+3bBQEw zSxCN0q$mYyn0$g$`C$L-SWppqu>7^HT6joanONRfph~}j<*+xHL9V*9lLwpvBOZRIYywStbZi5rPF;H6o3rf703Y z9Vn&h{^>~xv5Zr)dmvW0uNbM?PX)tYjU7b0YJ{2P$itH5Ai3P~{V8!!zf`>`5QIBe zEQ{LPQ=Dxn+YcM&!GDOsrgExb^Dl0uHUOqt*I zdY<|qv3t+xqC?bJ_RK*w!jRm&mRh8560b#Cg}o%D5<;F%?3$L@p&Z$hlT#NhTPs4C zo2^`ny9xY|^>-+#@yxE|!6qq=Z}G5s65uH+VJ*}_9K|=uE`p&5@AWonm`G=nEd zFU?4E3@6ISbPVSd_l0Nmg_#W~>`gYURHz@3rOQ^yUbM?aR8C^kOPDGiOgp~ooVDfB z1S@_Pwg}Kr-Kq+PJFS?uhAc`~0swEm6mVmth@(ighjuMQgPamJ_Z&K7*Y6@dO*8q% z!{H{^bF(}_`q^?Ag)hw~x@LA&V#cB24hKbqyrLzWdsO`EOhm+ok$K-ukEjGEUWwuc zWr>VgK@~t#ivqqVo>@c4TS6&rwrs{KgG`lxHxnp$c2UZkEW!U=k$8nB-K(ep)4v`+gHskP9pp zLr8#524aZ)TQSsas$LzXT{ zixrsDfc-Hl zP&_}v(jAISww$Z*Q46Dzc&>onx|Ks%sU!kSE8JLZC_sw+K7OOt59Iix8Ver#uPPTzg!7;v4^ zOMB#_#m{G{*6Dp1&&MR(P%?561;+`Xj9ED6QZ__snS8&8>mCq81-sZH;)v7`dG&b;O~mtudGkmmhvGs z$#o^#w|W%->#Ynj0DtsP=i(N&FfC7wjKHDN+?^DGYXvAuosA=^x9RCsNenpHVt8iY z>Is7!n>mFLP2c|i;$Nl;)?er1?yW@fH=s$zvGL)qtzwq;P~2ToTyw&g3|V`l*;MMT zzd=+=m1`;ErzVPK!I~P&6(Jh?)u+W@Jjps~O;ZM{#>cTQ*9qqgmW?gtw!_D=35VU( zTN#wr29Rm-JHRSrN#b76@Vo1ZQK~eF1DM`SzR+vNI0!fH^uo~aCF%bJb|^ZC<5(Q} zaJhr?iFX7iUzu80o4&Rvk$FQ!rl&*wL721sI@8;^vJy~~IVo|O*G$OwreM5W6+g9o z=awmV87kmYk!QPAS*VA<3r3_x5XpD3>~+y1(PIGwuN>kG3pYT_e!n~p$HL`A5*a^`|EGx{Pt=wZid(;;Lo1I@aDSN@#RQ*z(Z4RXA(cYQ9%p2o`sG z0S4WGj#dA00K2P3efF*jFmai(cK-RC$y4e@z_wNp<%R0k$I2sn0*=MYI6%r}|waCBnTBXyD+7xd*+ zpFbzZUP&z8EgAuyAZy@(2_F{#(vp`#^L^uw8Xg|$^^Aas0$2h1PRr@pPIruJHa}dE zE+INh3seUJ718gV^m)SSuFx@*TNaJUbWs9bbdR(j$5XLf9Fe>$!%)Yg2+upHcpwCp zL7Jl#$1M!PF=6Rb``O&{-lXUmp$K?tkEqNOC!FiHL=PK>O0h@PJPH1*-?1&xY&1{0*l+n?frE0XItbCSY5p7%9^l25BQSzi+*zi7`bIH&8B6 zAeN>*WheQNSg{7D?})i|qN{wzm+G0@1H~JeD-RHP5SizI|d?dBe&&H_a4C zf5&4r^9vY0zkFf<-p5gRt)9nr2?Pvp{WI+nQE(zo{W7HELF^r z{p@B+&$q_tL$ncH0#q!|S6u?}@CeTjX3g=!8*?GivPbRuw7uPr!{f%`e$)$9`^C9E z?J4)|Y!m7@D}zpcL|=_UwQBP8I{0_gi2Xw%mr?vTy5LDa=-TOe(wcK+GBLNa>T4QY zwCCgX@e_Lc4FmZA!SCtulZLaZqvBtK8*W97JUGYpOEPSeP*xFJ zpVh1Q)fG#iKaok_TNlN@kRm;a9u83^JN&d4aTZYpB`LK*NOEA^Kb#*PjDvjxMGOi# zeGxjWD+CVV3K6lr<9dA+p7gaq4S0R7kt9!rLF*^bs^|1w3Hw>JE9h@rZ%{A!`+Qap z5xYV9)<2H+hH5MJN79zUwHGOz=%WXzJ8wO40Ob~Zc}>vXDd8*Es2=>wCK8xz$8o6NsYC{WWR~OZJmme) zOy400gt*s&y5en@M$CA^xsAcP;dFLL#PcpHSN-*cF1sVR&}a%xuR(8gw|~mRK~4hQ z32bi`jo-dWI#-tMNmTDX?Pd(=OjD>@7lTtBK=8rqeD(bYjh{^I#5eCdVxDQRDMd z|8}1|Taa{`8fNubFEA+%+J7oxn7!?_YA>ZuMcbrjPtn=%7Z1@&ti^Liu9}^VlMunu zgYS-0#IQ`=8PUYhi{CTc^A3APRES2nPV6QaCvv_2W>o%F4arhhR<_(C$5C_5MkDt2 zRf)Ju*BOOy3?$9qwg0sX8H#a})JYktZxG=edkQs_V-Tsz%5LEy9ocM6LIgT^y6H_V z1ZEjuI6tN1XWT`%_2khw{M8&HM?;(Bs|961|55MDUX;8gl#BiDyOv82aKt{pE}Vo6 zJ@*#-Vw)ru;m=84?3C%Cm{KhCpRl<6YD9@3)LaAmUcJK4s`Ab?|I;6OO`?!x(QKDp zmCKilH7qcQZuo<;I4(dfgKUQ338NT)aeOV)T0m?&{`7NBS-Mr2Ur%iBvsx3rStVhe z%G^obmuSj4Iu1r9=NJSOv17;I{ew*WjOJ(TXNUDV4S(;WeyMWK)4tD=@n>`a#*UazT0{N_>+t^v8Z4N%QI4+JWSs$QZzM%=^mb z6!nwzH>^@_ist_87AKtF=AL{Qo9T3T>^q$RX7seH-qMe!GkuXsFfsWw z^={6aaF(dd(=$H}#gW_+J9j`p04} zZ+#K&&4q!T>D5GD%(1=01SWk|QMZQVu|i6j!{M1}VNuXWO=sesh}1h>1F|Q@6)fu9 zPQk?_HwG`#d{n_2dprH_BbZBcN4DvbSse9x0Z$!Z*G*;1219Ohs<3-L@AF>Q@SSja z1d>^wRLK|u6`XZH<6owZ^xnSmBN_zxKYz?z*7!31ZP8TU-dMCH@Wd4v^rETCY$!0= z1>wF98uO4;R0Z>hJFs#W2uyV zx;xJi1PLXoh1r{I$$?>*qWLhee+Tgs|3b{T7uvSdpXZQ2Z5AqNpB^;5)qOwX zo&D5EXBX`3$vl?HK({|s57vcOvtLdFb%jl@-_}c`KmLh7&e+vZ=21vj7o*O#V6ghm zsr5PAV$$7J{l=^#WkA1nOxazo<LFL8JOMuP@``zf6=rRl%(j+d?2=G?(h`ca$l8K zjSZfNbPrQJ1&p`#)_PNa&uWRkW#>O->>!nP>-y9z$0`x=Mrc72wpZ)YJ05|yo%2m{ zd)CnZlsKBve>Zkgij-p%ql2$tyVp8Bk^jlHxco`9b&N(=QEm&O#`%XHPQshVuYx=e z?JMKTPx(U$NV)sAq3tzt9w%y`@R#JHKp(Yr$nRXcMyu$y*)LYv;1tTGN3Gx>CHwF(`x-ES*_TeS zQmsni%jikvtH{k#$g16#EOSk7BPf(-<2rJyiovCGOnlgtm5AAR z2Fc3#$VO|j{lY<0x;!!xftP^?(6+9grwQ8%q3+%#y zx7Y3J)@p~h7|vU`t#eCe-L%G?6N<~Xdxc9KfvbIBAfFvk)dR3n=}b>^+0hd`>ChUY zm#!g;pI{RD4C`jXs4eLd@zzD*p&ZVRgRFQxLxp6zRb5P#|0GxURy`!$IXv??v8XWZ zZlFv1`G<=$3@}c!>I+xZ>4(rXC%03JM*9k)mVOik*6vHY;JL&zyS(`-RMUg|@s`Q! zc+5$Te{S~b`oy5Nbd@686OeU5sg;4;lKp3J@W89#4b<+4IbPzydjP@-K6LjB*GOHf zAUwt>G+T95eAHAETh86PqLsBn051Pv$8hMA)HcE);*WqVqaCzmm?!@;2#3S4e-4@1 zbeIF#=y04l`oPxoDY3r?6Ds=%gwsQs4xzb?4q-{HE!zGGmrFoa^l4LWtaVhcHL#eN z4pttD6|rsnx%P?sI_h*0IYRPbkg~0j`J3FLaRPqZuF=cd5cHwr;wbX`v=hvHEprlc zi%pP18_g3VGJP8VsG~T9<>JnFgWzzJr}XmoY?tC}oxoaow-q)FJ%tmSlTDN54qv0< z%-Z@imLAqOt7rqaVh`)&y7BEE%c38*-kjeKhA+{kT&Q^h<&H0V;172PH?MFkz7x>u z1a(Vgy`T}>!Zi z&(TtK$5@Qv@OMojjbrUH_7F02ov~06#i*Eod4_8IZc6?38tUbc{x=$c@&uEfLmUgz zIN2JgH~{2&x<=gd8DDcIw3u~5{(UF|-*SQ`7p1KfVTl%n=iANG;Vo$kAUgN|2xMc>ufyTqA^tkcjJt_9^4$E!zC0+v?+oWp5f(hB!MX%;xyFm}vRaSkQJP4(! z?2>%JF6EsHhS}w)gulNNgvt*gpItx9Ntdo$#Mhj0d)tarptAvnN5WCE&bzQ0rn>#W z9~(491j`4{Q`bhxI{&P@N-yB%1(q6w@Nr-c;YuNZTYVj~!?~)D=T~Hapn5VMe^JFy z&ZPgY|KW5L&OLsdud`aF-^(p}O?yX7i`ppnR7Q`4bX)ihPVK5v-k>`1`Y{5W$;inp zbt_pfS*xEIm--8{>cq=$n^Gy0^7)zVX~?ueFcc%tiOOpXq|b^&7n}r?_y;@~e%f%t zhxw|)kfYaGlo(2BjjOITAA4l1G<2I2V3ZSrMF<}Ha+Y@!#f=s(!AJ=^NrHhoJ5Vl0 z;(S%kD<2=rjey^XB@_o986m+d-ZmlOU_i z=Lss5wU@5+@S7?b^5@mH19mGf`jcdS=qvY{%L{7~TcLsN+o_23D7X8Ovj*mwd2Jd? zIDb3s4dd~2CczIobdTC-gz0#Kn?5RT5Oi#uv+MH*u~8&3VpRcTn5ltK_zJIY>85v- zp)}S<2+F2kB~-DGrS|VtzxC8Ot>{p1&)~9#e5#kZ2_|zaH+JMnwGU^AJ&o}<2K@gbmcFN)N=>Ed*~MLNeoyOrxPyI=MypGPl}iaM5rPhgGa;RDsbX65xqVcj#!?8=+R8-~pXto%d$RPN*lJa$8m zpz(v-8^+{EU}Bfe!^l>ypz-BQ0T8mZ0UzP{4D3v`mT0*O8!f)Hox^msbTLDmhSIlZ zrbyry*vd^x_kP;Sl?=7Om-yx=fx*t4{@b?>x2ehW5r4v2{!~yVU$RCqsXeQ9S>g^1ayz5L=XbCIV`lFc`9C z5|{0k$ovv@J-o-Eus`%V&A?q7~l`Xci@?ZC1pr}Jr{^n zbLzd4M$7-Lp3vFV;s;N(W>NZ@RPi<{3(wqWj)|%~Q!NFYC`UC#+ERnCJf)dSxl*=~ zG6l}U*pV|3Q^=iiMP+sdQS7rNKHtdEWYbhDY)6UD3Aylso{KHj2&YF;XkV+la*5Cj z#rQXB%_zO^!gjBZw%L3*@=xEF{Y-zf&HjdG7>ZQNW6i#!KHE{ls5;7+G6Xg1=7Yn{hFNP% z)JYJnCIlKDb3c3%@-2?E-gW)sFPUJ_$E^B4Tw)(0Ij4iewaPs!zjD7XUWH_g4QKw& zHZ~#ss>l=JIAGBk_)}i}bgX%zr8xj;w3v(Xf4D?iMBVo_&fons%DnjL2uuWfW!FT$ zfJYIo!D>ArS+qWC;;P7SDYPjTe99CV2^^%6=Xc8ZE&6uoI1>=rTA$r_y>PHJJ7li1 zpdD&gg=n*g0i3-swWcy73YC7@zu;lEEoHl0Lun|Yd4nz3`BB%HUES3`_UC`|A=DCv zxwAA75W`$9m%l<(YN1BU;ZoH-Wi2~=;(K^oNI?16(38+dc*H4aIB;72%D}6?L3u!`ryE_`#Qbdx?<=HUZXg>!Rqx)%x4K+T;YIv|Hz2;lk^i| z3mxE>lDuBamFtD2zO1jU^Xw0#WAOd;cctXfHW5WH0`rr^@`nIjvvr64iFRx}N$ncp z3WprN==dJjUogDP5VHfT&vSGi477+h}O0xLp@+A;fnsqsi# zxF^|HK^If@;um)HeR#D>bY2&%WB^fM0@qh-Q{n(+T3OUrWd20SjppEHS~}ptwws-l z{Q^+{@4qj_}uAiD=pNh>M0@kem|aqH*0rW)xgGLHJK1 z)Sy9A>&_j>NAoJ&AL`4LIKq;~Y^+k%5rPtSZLFxcxGbQni&L(ylT6gHf@b%K5+S8V zlLDkdntn$~hq19471D62tSzLKrj-gu$2r%W`<+X)w;1_UMpv4jb@q_Uc@xS$_W)DjnHl%~$vEfXLGwzadqX9Jc(q zu*g$J%>(BnBko@*CN#hoDSA-)ViXG<+0e*SL>}6xuH@!tdAF{a2~omKarZVng0eGyBiJTGXcEqzcKDXF|J|jdciTMw(6pq4q0vo8`GoCSsGO)SIaBMS6+x|33wW6SnYt&3;Nd%wm+dg1 zP{00nx}W@}92eR(Na``5e;iHmuSw@J5A5{Ub02LF40?Cuq@}PI14mr+;3)yu`+g#P zgA4#N>FGx?8NLZA+_VoI%xa78qyldKhX;L|h^O_G%MFu%N1O^K6-U~X`0$1bWhA;1 z6N0uQqPYo?>bmxmhiPAxEY4G~lM8EV^Mu}YZDVLIgX{F7h}`54h!V`qWPYDRpU2cV z>_F`kp>S%aOoZEKno)A!4ywc8N?CWs1+q@@^Mi)m#Hvy zlUE676&!Bx@cE55(#`rJG?&{Vw$3P=HV_lEL8`@E`~KAg#%*{cRb@e}6OkUs?6vgHMCawbO;o)PCX3t<7ld2z4=g&W300i&@5T~)m zjzXSEa7i$L5y!Ta`~Bgj%G|%GK=X%?=l@0pLN9+&!STEQ*{xI2(SJ|@K;i$33Qix> zbmDw%bmF@IjS7T3ZL!@6ybs-{Ijg2w?W>r9J)EOFrK6I!7jdmLq-Ldcgg7CQ36N*KC<3B8o7A7Gg4rOdq zUI7CQYnKOs&?8EtzwZM&hYW>U+beRfJMi1&DfIWNzCqAzDZF|F4=Yt?^nvW)V80=L zC&eV@EeJm-`x9YKRHzO>{sF$*IKnhS&ff<#Ld^M0_O@WbiAx+ObeO}oiN^I0p7YG)1({x4a8j35J->Tqeb$(_#JS5T zAx(n4o1w5LHw>rMoFf(7w>)RR#};@Ziakvio=@MKXHv(FX;kP8sPQ(hc4m0P4aj+W4lt|y`s?P*!_x)T0)r*|ITiqXCPc-r%*Y=NzY49!!Q{<;UO zTW1A(!TwdZrqPLO5()UW{`wT*w&=!wmkOE$_U(RIO-2hEksbbT;mWQENMxR~@&?R} zSud79ArUW}Ss~U{GUyddU=O~=0ZZ2<|9X-b;iZA;j2DUdk*zVK`y5-Y4x!g4wWghm zY^d)piiP<7+^Sn8weqUp;#|sOMM{jI@7-T5$QEpCPt{%Uy4ed*BC##^_X*3J@3w3p z{U2j@eA%tPN+zeh@8K@1#89kC5{zzL;W&qd*6Zp|^D0R^>mQDZkveb3N{nT)-1>T!=YL{zUVtUORsph9q9h+oB z3p(5P25lbv*<|SeqK9xyfA7M+C@5d0 z7Hc&|P2c|AV<`gYHR$N<09VSMoViv*r{A__+!Rhhc8l_9n+$7aptvTZ_50PKVjOQbUl;L=;XGC1qM>`&^ zTgB=DI}J*>G@I9TJBLv^G3#h2J=PRmPB3g6!|7p630-S+%jeq&-FD404Vt+}{VVDR zaH2j=LUgDwPhsDz{*)Fke@s~!o5cvrCiSqn^1YUGaR^E8z@${QrTl3rzn756C7Z*v zToPXf?uZ>mbhT|%Z|CSjsR9rV-*pIuVn+;O*j}m;>k)xWWG{ncpZp!zs*`TxT)!b1 zY+byFiWn=l@51H)b5^ku!57RMO-aMG4Na}S z7m6N;LB}kP^Emok$~X*xmLmpj`u~VmR~!6CFK}yOGYJRFL&yy@gVTNy+-WJ{xBB05 z0l1H}`Q`*5XcnUnMWR8s3lLUrw|g~P!z&62LY8$zC}&rMUlg`IZ}kmR`O)0r*9snL zy$w(Nz}Uz9c=ljiL{snXsI^Q}X8rUrqlpo5o}?kJPm-1Tt{>EB5W-rf zokV!%1?p`gMO!}oVuB;c7Lmdhcd0P#!lnm=Kw!XT_x*dmi~7YN=*$0|?;4c$xKia{ zGeh|iUDN(QV_e#Lc&k=siz>#~A|D#!691e`jM&?lAeSt_H$38Wss;FOqx{1^f zzPa@+1mv?!g~*)|wUwUyKg_*jlqCJqFFNgM%=ENv+qSK0+qP}nwr$(CZClgU?Pu?O z*8ASG&N=I@yY7ekA*v!XGP7z`{o@yrkpauDVZ%N7ywq_FabLU3tzq?QKS;jX;a8)I zc;XBJ50fHQcSzw$_BOhW7qunxnMjkx#>8Dh=aNHA5<+f-e!2D}>aPMRpTJ!;{UuN3 zp?P{Xdb`$*aUS}9EQ4mHOjP3XWd0{h^$`+85(j8i2kg=e{}sHB3J~XfXIii1Y)a2# zvcn3^*R%PZZ2muOYm==NGlGy?(GZnVkz{+SZ&Cn3zNm;DW}#M$u(+S@5k=UH#LU&g z5lS`+02_+_S@iEpFA??>>TNkmxaeZ{R%eBbhUYN$IqIvhFyP8J^FKBqYwa$$+(rT{ zb>}&$z*G{Q?5N+_a0LV?`WX>b79^IqQW)g^y~3`!e!G{<3i~vskj|#enn$c) zWx~&oA=Ca-_GRH#T5<+Neni9z6zMM42dDZ^N5qw^-IB>9U`@IA422!?UgZROVWD`a zGQ`mw{MV>Bh}_qhGEg3X5TY=-A1^=-?3dn?d;t>4vls<8hzI!1J=-7}ud}62g*KYZ zde~M0R~|1^yNQ8~mSq8i+|!cZW4ud<|F8x71;P$u`rRX!r)tZot68~2D{4$3lX-1r z6;6EAX%C11Y4pFk3TTsqz&ntF9p=iZqGz!nw9=1K@(*AqgE}Y7-O40-nf>@$9GEr( zW+jS5So+_!6rc-#e!e~A_V{{l`4f*ngZVv;yOdcJ0c{^lXa2>V?t!|wh2XD&C#h#| z$H``#4z4I#Q64%p0HPE=u_)t~ybYMCk?@zXnSvp?dk^B^nT>3k8xvDm91~MmnIo$} z!~c_Fv8@Q3km#cSWwltW-B%Hs(`b`_X`yXG{fbLyF7oJp%q4WIer7+EOg#r7?0*%D zB}2SX60>wb;{M{1TIR-t?%Xx#q#(J@|(Etl-u?CHqNy1Q&!c>ttM6@>503&#|MniucGr}wI*?|$`f<1;h z^JE9%pP93t+H*~@1bLz-rA1OuWU`WJ0j2uigDnZU`NKe^o1+1}w@z~8cVwc`CJs@$=i+tV3Mrk!CX;F3pj!x{gWvI0me{-#9!C5_EsjU5n; zt(b{iFo~VunI>#CgXd^e5H< zEwEOBp0U?*Cm~NKvj3qfqHs)*KOcpx)f_mfazJp>3s7c%VoPV@z?-9Rtr#$=?zo*g z^cD?$7009;q~Hzz7;90kxz#pizy{>^0ER|FK_zhg225%Q=gsv5SB5P}i3Ec+v&fR* ziIRRsb$N`QoS4wP%CW|hr3(HHc*s#JzRh91!_C|KnFg%pk;K|Zgqs(FBvT{`JQ#D- zgnmc8ip-3m(!pxAJcj-VIf40J51~mA=Qb0V* zDL?U}J;=>C*TJ@XTudWMM%br|VN~jt}_b7zk1ppM%pJM(t8r!j} zaXN2{qG?}Ve9a)4NC&hcM{Hpnur;HUjTB)j1+AkoH=@cPn(4%ORXI+D^)q77_-B&5 zxte#y~_xrIzS$3zeTe+>~UE>1)F*KpS7n*d1#+Q$}~*kDSlcQ?NT<+}{J0m3>zN zW|*`TY&`f=H#H$_8TT88gD6|UCb@Ka4qd&-ZLJrpzG`j~S8h1t_hw6*EnC}TAj&#r z!-6~=X~}o-nVL9hCNrga>#0bBt6-AiHLQ}^VT-JeTf9AU2Z9z9*@l2o1B0ceQ9?8q z=KWr!VyjUDSh1)3H#Bx1yt=L~Gxv8$b!!zPRbIx-H>yu(rO}!GtObraPwq{Q$Z)GP)YU zx&9=B^+8atalgv>-z8-AmK0GT6hw2(Z2CnnS2B2x5Cgqy=&La_d(OoK1h4zl*{RXq zXq@{g`TX>>2V&i&L%slIssw+s6xIwT)LaVWT#|v@%807eh54TWx%OKG6SGdm!v;Nm z`av8cPi@W{C6APfxGw_iYd@r1y|I;G3bUjG)39M~A1<=zkUBE`*bl-{6_Nx5JAVv& zR#mlFwVkJ5`)vv*UoJuYzTJH9HMAf-rdai{Ywp*eC=+vGNcCy8UAr+&>Jn)Zd3a4q zwl6KNMydIEzoZvIWy~eO=5J?}u0#4|GC&u~n;*Ldfuu@EJPo({Qp01u`W!g9GQBR8 z-1)?EjN@N@vZ6%PmtBi`ZrZR%;DI6FDm46v?G++E*Amvz_m~|LrK|?Afb{iN@BO*k zT(0c>aZ#_mrSUQC{jpo`-F5YO?A`HtUcSBb_1s^sobCBI&a(aSF?>$*MWprd7;c7q z|Eb;W`3UXtoj^xet@ZKHEkb$qX|}cDC%4n11$kK2(5eQ8fjq_N)!g&*$-3C(=qe34 zeUD`;KNH2&g3ubJn`6B7aJgY$YovYuf!>8AV)bH+5Wb!vU*3=iCHy*C)vEVLwU_Lj z3DEYwIHbiEOWGJd0k7pRx!e+coL&VZPOu9?)-|g{{FQx(X?kJNF0cc2h34|3N*nbFn>`l z<;I7d+3!mn1TCJAkb_i+PT+>h1>UCd>$?95oCOFPnqmmco7S=$=!8ZD`HY;PMys6Y zt3{1sbBN3*r{@gGA+iH*2B~X<<(s9=mPbV_ypqJ)cZdWF;RljW@N_Hp7vq>R%5>)! zj|igNU>pT@obow5w}p!mIr(1~{ob!gcHKHlKQa%NuonS!7ZER&W!?v5QP0Q(PRy$W4?X=7(fC%Ns)9=9n5kc#C)%)e zCD2#I&7XyG4y5YyLPm(jmJPf`?QsyOYdQQD6ZqS0$vy?UIix>P;@T zxhO$XIh7b{XwJ6iLVsvBU0~eOx)bLI@k5=NVt0BX)|&{eOI7NKo!DgPk2qrCA7Tjl zJ_Vt)_yGGLAJqAuxI>KKA#{OonVOSg>cV3rU2DlYv-I3%&@<6XZTQ*apJ#EN)Y0o} zfc{pdxT#Th272!AI4yZyxtP#YI%%;2;2>Ty>|NPF3$l=P2>4!%Tu96Gn_E9hPz#HQ zlZX{_BeN5y6_O?^8fkkP(FpC2!M3wUtpiva+0vuU76Aw~J!W}PaIjDI#{J@`yF_!s zVPR?Z_u4^0teY~Y1ahU9)y_`)SxQmllb*zn<&@X01?j+1{^-}3zvS}z%M6z!kA?~J zfy423b^Jqg-$a{7$p_As;G<9aBUNZ_Kx*2DFuyRIy7*_#xGCt&AtU&S9TY*{I2raV zn5HzOdc4P7{e>C(gJCT zZUlrK>M#gf#B^lHcSs#X)59evoCaF_yX}H6H8*ERMEEs4Cn6%*Ay8Pt+7BUdOZ{BY z(th4pfH|(Q156Bq8)ggxJN5_~7tBEfHxYbT0u+d*w6PkhrnJ5fbule|TgD!o=FFjB zEC7*gvDZF4fuCy#qZp-4?h1SYkZ{vPx$gZ@a!fmRH!I^+-UwQim+gM>i_NGi{t^Dj zD2#P(x_s2?4G$UmJFE1vwUe~u5K^1ImGM5rszwGc^~(wV*46lH%)~)f@3&Oh#cQY6 z@VWKQE=a^hb+$K~5OyJT`b83d)+$Q=xz^BReNHXQD))hGEMPI8vhP9Ar-C}*)s@N% zTtC(-)pA7GdGj$qO+DL2$o0hPUg@}q8$^kvD4?1;1d2uPJjLo#ASUt;MJ*!pX5G+Y zKde~0#@{vNx^Q2^yf?PcGWkE*H3%7+CT7oJp_O6YJ1E6x;?9| z_EP`ahppD~d|aj3_IP^2sqTJHc6nI;?t4D*=Kb-#_vWx0Keof|Vfibo<>sy2)gD^d z7sQZ|v{fZG!dKRBs z!cZ$;yCXlqBKd5$8L=Fhu&fpak7rCYK{W_E77W1OV!iBGSZl)={zYHI{!!D%m2ezI z%>O3av^y_hG=j@Bl~Mln8&dAgmHS3=J%9=Egw@MvTYUv&3fOXa)57;iFyV zrY9LJEfnV%np3C0w|``w>9VesdVPwJ!SPw{44tMeFaqX(@8L34;xbXe6ch;omzv@U z78F_ffU<+eq&0y9=9_$_8*!G2vd@ma6X;twK;NrmLVnOzb}zWR4hB%mxX&Os`U^H{Y{(K|0_MlKOtM7LHH} zS(Q@ZHY2tc#z5mXFCcu=j~I2cUk6FA3%?Q$lJNf#HSN4#^I4JYy+-p|m0k{yQaPed zO*X=JowrF+>`l(AWFkWQ-pU}QrjrxhmUC{9Lsz>w6(&aasWB*UfJqp%`Uj5Obr_`H z)CAVi^>KB~kM(l#mr3m3YKVI}TMht3Q~Hvd4&wCJ-HMgxC|xJ50}-F~Q>i!Z&j#P} z!}91?$VmrD>Y+y)4U~eR#H34&OPSl=rCFd#Nr{JwMs`@MlvOgh;wy)O0Q-?st>DB8^1y6#cq4m3~j$m~)6O}YE` z(jZe{I(YrLFliEas~?c#=R2*$Ty&-sK@f)>SDnM4L@ri-ciZAzGMugK{FT+yo>O=% zxE=1)YfNDLn_R3rd}!7!z<#Z)RtCsDw`NaO6{HA%o6LDxVQx z=C2q4sAR@?E(ru>wYs(+8C|Bo!B7Ayc0(dNaH3ZOW$m$vo4iWx?`fe6fkfyJ@Nm)Q zK(a$%Qgg`>wl42GFj;bvSPP#rJl);?x43`*lGgs;aesckN%P#O!>WK&U?v9iGG0q&ml5{{XAAry5nieJo`k%g5k3x7G@0VclVW5#ZXOW=Iu+r$3*qx-(`#WQlR2@Mf!d_b)@?-;VH5gD4@Z zLzNhd4Xq%YHYO^Mc1o2)Kc^s!-ui=_-~+TSR6{}74HhUdw#YBf-G#a~hxD8M=Kwe8 zsW0sBb6P$LWYJD9hf5>=>awydi$7PfDiZHnG!DFFgjHI>zf~iw=>0~JX4kf`PO7e+ zPU=~FNc4F8{}t4pkFLLo*8V~LQh@F#6Vy(?Q&bD^kE7vwT_pv_>fL3`9-_=ca)pOI{aBMCW-9@`K2r2P$ zl^nslOc;wkZHK@dNT*tTz@-LNkz-scRY)Z|OR6KYeqJO`@D8^f)IsY>s*2o-$tsjp z)@b&yk)BGIh;Oel*bkic-8qAk%Szk0$`>p2jPpvojf3Jt|~YVN1B_3&0#_pzycD8g-or0giOB~J0Qfu7f@1h`yb!*>zgkfK9~JR4oEmc z&iLZ`hU9-%Ov2IQK4PKkKh`cT!atE$aI#>Tg`s(w)gUYWDc%bdr+#5V135vod$1d( zsV}R%W!yi|TlzmkFW2k8pjZ7L=xzA#(7W<~hF<%kN_Psd=KW`uy|x~0#7p#bF3!Wo zB!{?L2dY1ET_=TEDHB~?UMxq4HYnm8vrju}pEhZuRo!0RX`w^n5Ttc~!j-Tr3Oan} zdRY1H3OIKM4y9#W6awI*A4A7Ker!l;|KJf8iRNlX0c-RS7T;H8DlCu<=dAZOWTeL; zlX;dXT@;k;-hW`ZxdDn}$2|%gN(E7K)D&pa$p{aFnRCo$$TH?LOEv@G z2hqb9{3UF#2MC)i{F<}TH?nSv98ht}sc(SA0+UY{`xY5Gc5jZa2IZ1v!ue&5o{jnhZ$E}8! zKPC8&TU{Ib_cRzO+cn$x6JG?}E0*BAeuNCR*!aOP7AO8LG~5D*l}fpAB+)*@RgsOcA7A9tHkJsYb;Qt&jNZ0#!Q%jb`&fEhmf|kO!5-a# zA?K_)o1QbGF;~Rcd7O&~ED6d0@o)B@1GfC` zyCD+0iL1VTexLMaOYZIY9}h7!TodT zX?mDnvjnp!-3zaJrGr<;Nux^4X_0FYVFP>JU}qB@b2jI~nGD$0#HdAtFS;qDYLz_k zN>dZ7KVa%c0_;Q^w%JUVqg+RmhmGl!=OAWJP!lf4sbY~6vK3|(uAS7GgJjZs@>>XO zi#+=;T~Xlma;rd$7%7%==%PO?eQutBi_IM``?RqOfF6R+kr(a4AuA{WXcWn4ZT0Y z<}^TrOuf!-+5aU+ENlfk_J$3cBm7=2-y0vSLZ;Y3_V$&8`#MB_6%v28=B^BPGl~!l@f9I?RGznH%BO zLTuU5mbQEdIv$|5#jGyHSeJ_GHnv+aobloM7_}m(8_!;bqf11m;dj=!XNq(jse38GMT)x4j`Pt2e4{EBbW3g%t&;ez#AjX0_Kw8oHLY&+-w{*KE^T zg@pGziV6)`ACg*C%cS~LmU!7lG?-BalWtp}h6l!MMvr8TtGca~*M@@6k+|-mm8;e(g z$7<-orN4Xe`t9bsUWi%7)28x<{@j<;`C-p$i7VgEqkJT@X& zk1aZeNDy;6h@Pf^V^b_OauhOY6&`Xv{um$+SFN_k&(lr}Md)_`I?(WO-qPPp<=y7v zRyf^sHRQLwJ+VtI#>-oPK&U#Q)O^B1f_!*ol;Z_R;?O1W+t#}nB6%vR=Dr>&ZgO%t zhEB~qcF)AXhSlw zNbl@VPG?>wqSIxe(`?BwLqfOm?b zX-?9;%jWj*OlqATSvmq%zo2Au-SfC04J4=tMSMAt!Rg{=qj`Zsl8+sdm~vlNA^jEM zbjz8EBek9hdn8$3JoC8Uq>HW9{g>>tJ;05b&GmhNpJJD>iCi_Vmoi=##QdOFIoWM! zc`z+|=h-CIH``&}`-eejf~CvX*6u}0J{1BHXA*M#ZckX(GnL|bK3LO1#d?cV zSIq^cDlH*fucyDOdRva09F5a>h6NhvN*V8Mw0f?{VjmTNk~t&|mS(`p>aWlM(@VSQ z>s`0=47ldW5h&2;n^VwULbO#5X&Z4TvFVX22l^j%oPCJDFdaT`Dy0Lo1bFJgWjl{VAB6ul;vFZ$F4>Ht>HF8;h%K93Ve{rd{Pr_zU5Tr zkm@_ADcJ-m>od`#{h^R2cJ>(c1RWlIQ>pUP;5ZVrE7M=ycxQGxg2DKBm~6N(s}~q% zh&t6t%Z+1{V{~v&L}ekaz25Or%V!_SnRD?Vap1xdfN{bJOn$va>sef`z{Vm#uOs}z z%!OAIn8a^IAHv@15IQC4QwG!mi&kjhL3kUBoRGh3Gz50|N0#F$Q&tf_Y(OhDRT5{N zghEcLxZm*%Y<3r&-rA%IPyU*2( z#8Ti9tY}$bEy#j#PT;Y5($Gj%09&prI6-GwlQXn2wFxiZA=dsn{+z|KzcwJTV!_?^ zDRVwZ#@5p?2syDs@tnKRRF^z8*&eSw{(VzEy=@(R40L$^bUa<^PgRt0x;7~WIdTA0 zq0@$B???65!w2+4O?Nv&%4^SHz1JmT6#nk#@f9G)AyHnk($*8-?b)FYV`>tg%>8|^ zph&WS`nZ^8Le_Tp5-psx^62Zdxc=ao#G~4DIld3-oVV3};WnQ<)up$&YD)NKx)EQi z+mM7yx6ji@Ejxn%YW{^Fu1gl!bzv=xLAo39d7z&!guual&F?`98G#hk1ULx7KaeXXleqE{zCU3-*Y`LHGjS?5H<{Mq3vOPR5< zZJXwu7?~i3bMa)VAH9|Zn`>Dx_OHg-OZgPA?q~66F}6bE>W36rNS?+E6k&)!hc#>w4QiU}FgNf78#M$_Ket{;L zY$edIQ@5G`vqrcN1ok@315?kfMk(VDpKORTsraF7PmVFE&rl+%9H16hW> zltPf!;{cYi@5dxD2HyybSY8TR5^l-}K(x_@?pFtH@dZ#=v<8W+>~(p6;*YBz?XFHc6s*vH5J_llJ~&6GR7L$)giCokk2ay8AJl)ie|Lc z8kZH<2@a7H$z&$2t;s{OpB*J&4s2v`t{r8x%0Y8;O;6anoJ^P{<}J1{5UU4jxMonlKqpCy6?^8`XXkwXxc>G2f>w%1fQ0H8FNJvu;Vf zc)Z0GyS?9qBpJ8i%3nol70r^+B;DxU^NK-==^+>=3N{xvKe(Dn5M6A~EiusE?7?@l zgry@M_N&s@WLNA?9E8izvDu@ulgog5>e!qMF`^1r*>rR;+U3dhr?>6>w#wN3T_opx zuHvQFkiakHeMTJiL5f<`xbwskiFS;OnF;JGW5-)eXApj;ee;%$sBMS$QdwZh4wEm_ zh+)eU<a6l2Z2{*o9obuAx`P@P*Z@TH(`?Bgz#r+?$h=1G|6Zu~r5 zp5!5wGvyorM3&{LsFNwnS=HRHKQ`yx@hQL>X#(0fNTIBcSh~`XtKX@dL2A?Z0rx#6 zu+C37Q?MJA_H=4;8A^w^gHzv{3e zq$*0QKkE^7s0i2m(qPK3J-RRRIx>iWE`rY|9u+mF;?|Ua=_E5!|nIk&-9!5VC#E)4WIoA zW?ZIfl~vndaf5>DBVUDlvD)wvM|cXPu&$2T@DfI_tjQrl3nWQZ0M8 zq7A973lJ%No>m2yM9*JmLxRtYBD)%~9?TiiYs*L*%r8I723tT0h+9j@q%YzkAF%6J zWCL0K7X{NftjciuF5UDEJ77EG#$4Ep!7VBiCrN9Y>yL@ir$;rOCTSKMg=6#}TunH6kvV z5M0RD*M`*BTzb;R`{WLwr4MlmfWTj(%6iyn7^y4c!SPYPpvXtL!0BO73+3q<@X2%p zj#M>LpyD z$b0~&QK;evY`*>U0A>z2MTfCXDxyxj-iA%cHKg}f6%T7Tkz|3nuVY7;GjtjmOf zu!DnhCWq1agT;R+>d|7rW>n-a4m#SnOWs0PSHQfpXWM1%P1pIFNkC0BWaOSA(d+Xo z>;BOd!!m(?O%%!|0Fj}xA=Eq6c6aMz^y^36Ak6}!Ss0wF;C}w93mOVs9k}4c0>5&k zh48@g?wG0WUXSF&;JZVZ9F28OQbzz-1lg#6$}s=rujm~#(|QLvvfJYP;Mq`{k{(XM z7W3tc2KRJ=D|GS_<|`%`I(V8t1bD*y5rlh87Hs}43Gs5}PIE({X<&Yb3B5Zglt;kp zroYpH0!0^uhpP7H-e%%;s`YUJ?ow#0H2)HC z%RuU4OrwXuSp#8Zk?=;On4JF6Af<{l9?;p4Q>~Rn9vkYJ)L7sV863WpW;&Xm*xfC; zrVkEImlHv%CH|V7tcAV$P+QxM&L4cl-qDFC9 zXrOT3m%0WX+jaa_CL~zn?1($u!MD?}a7XM>C#&%V-hLzbXhv(tIFf742$V*MIpF_&{y0 zdq}CX7uBm#u-rW()W*FgsaOIW9{=D-RtKNf{P zkhFiIjWW>q@5N28o)zLmH5A*0zjVcKMCo*dphfj~G|z53d=|oLNM$30F4R74+H$oz zdRjKjAEvM`{cJSMFbYW30ad;LQnp0ir;UP)1yXbTE57v*zY-8=0Y(4-RVcAY`O#|jK8)Vus68ug2PA42Pp05tQfj0RWMvFD>6R>%j^FlIM@mo} zZ(8lJJ>|j8iiSOFtXUk=uC=(i5irv&f<*N$ZS$AGI7AStHA*HAPV{i%E$@Ca2=5{h zIx)Zr;qd{q&*38O2zj$)O?T`;fq5=c2RA7P{=o5HF~#6nz|O^yEL?bx?a69nq?^&U z#6$a_Th~>)>RcalDH*;OiFK;-92ADtza)D+G-gHC-|Ez%W#pJQxYRRvLZ(3(bz+RO zZD(k4(T7Sfy14&#q$H&GUIexWa$5(wJ~}vyzBQr%713#BfG#wM)gAghFQydsUhRGJ z#7KdWY^;R^#Y|yftq>dqkKZexEDs{uB#4fk_art?xIrF24?pkD*Y`6ok{A|-&+%bP zSoQp-XzN!{Z6ymJ&6==byTu0S6t1pOo-e4aIT(gAcJ|L7G_3tty3bPJO`p-kdYWtV zd3Q5mInq1|nyy-`G7y@yobWu&mDON-{s@<|cQ z2h_8mo=aip*P)`T;}*4;?GHkY>S_mM!SSI~dwpHYtiycaoNvx%XKGG{*)10>23J3BZ-wfH z%+B=#B;Rx-P)Jm;nSOqr^qyueISil;4S|WQOIE)YM&~5t5B%ANR6ONyAHcBquQ;OM z>lM_*@LKj+iTFSmSuz})bh~}TDDt)_$Fz9-3f!f8=u@U|NYLIb#=;o2_dar2bLM)} zB2Gk7t8wkHyi7~N>(yFFVGL~`jpeAJf%fifYFo!qGk@5M0LPlGme9IA^^C5SL&Nax zoD$EOUdeI+@US-nwsX_zhkNdz*r)ti3L17U~}1?ys!5=Hgnkw z_&nX8l5W6W>~jd5HD;x^O_cfr!5OLew+zE^^wt?#4I@@gvd)@0_oak-y~Q@0qN~bI z&~pj}GwfF#Ll{m&B8AbpH8lm2icR1bQ?N=7GvZJ8jI}Vc{y5sl}4pAapFYMhDUiZ^8h$O5_U$_qj`)kS;tB6 zbY^Dwt9j!AKmjMn|H$*N{jet6o7W@;EGMVSlk2vL$!Ku*r=r{=^6MnO7fvnPlI>H2 z;_S`ndH9BN;XAjFrHScj}wz~d1cSO;?DY`cG`L;X6T|7;@9!l z=clc{iz@$R&e>xl&g$mIp!b{gCXd-FDz)+#W#gIl_GjVqp?3E*NsyW2cc-EE&3cf2 zMK%z7q6Y`^g}-Hti{7l?5e$x+uiDr1bM-22J2~-9h3Y_~He1L2i*tys7&!Y5*ZZT% z?C$5hx9fBkYp2h*m+a4bne4AqneMmuaGuYXa31f^m*ekY!0jwwFN4R~U&q&BEF>;p z+e}Ng_w6jB_FSH=#=za(-y?uOk}5XGHf^qX9R)w!KD8ekXTECR-=98uU6xgfQOu2A zvD<)!_{+Dg%fsBsx57NdXqDwEA4||qu)pLed)T{5 zz5pe{W82jS+j>&o!K3$2=Y-3q$8n_K!j%SFi%_lprOX&XPK{n?VG^x_s9q;VSD(0n zj@uR=x9Yl^zn4`i>x{+tr7%V(U#qF!NFB%5m^nK;CzH*M?%tdr*Wa7U&0eL)jdGbK zDteNH9gGIM5w+L*CUpY4&I6kRx~o#QtCh;H;%KyJS5+;cdG`?>FqAMtZD#LhS%o_lX$<|c>t zkLrMxBWlP{%ugOqbZD3zM=GJ!P-qJmXAlmzbxC3Y=}p?&gnHr0)q>c#)_;<^=IWi{ zaGFI{3UwGj3YojwLg|Q8Ed!K1BsppdwH7|-4B$k`W8Q(tmCl6POLXMpP!sy@)FCUp zSJkzqJb}pQhIIq!p6NbRi0f(@hOp}EhrY9S^gkm+mPh?1wp*iDYOxpl(#Mb@i-

k7I)G&KC&*TMlMMsiAdT=Ju%I8ZqIwQ#6p?&)wtq3!uphuLFh)#uYhrbk z@kl#?-rwjm?M#69zp0gT2jy^-y3y-4ZxqeyM!V(xatYTO!mPty^xHnpjTdpC%9k)W z;-c?YEJT6JCO8tZRL)3F50*qxiDrV3*Verof)L7Y-S0Aspfj?%I=9F1=cVkSkRRID zi3D3>l_`;#c+w`2*iJ*ri&iW2B>%qqXf;R_?1LQ1YL3jP2U8g@?ok?)<|iSgH6C59 z$qqn##KJX%q6lBpb_)|VStY( zKwl3Y&#N^d9zN@J${aX#@+tX47s84)o8mpBZ_i$-F@6?w8H(4gg~B>))I&iF0ty$% z?*ZEMdqyy~v}J#S9mJ#emDLU>ZI`AsQe*^d>*W(s?y~eQn1Apu{6r?)=dW=0c}nZn zPcO)o*Q92cCjb7GxnwPbp_ODQBMqpi{F$tbwaj5l#*(rny^%?bqhe2#IBD!#B9KA4 zqo1XO*s64AN2tNgsPadypz}0Qsn*Ee`H1;eiFyiS-Ws+CB^X8nJt2MOvF&Jhi->~x zDg!jh!UW*9=ILOx`9!opqo>LN6f%k3n@5C@q3_c|}-8|0rztKRX# z*$}>^Rg$^7>_CKhBEKu&lq&>W^i98HiF`PJ^mqU% z-)TS^ea(3bUsKhjT;GgHh>$i*l|Wah!-S8T-7#-1T62AFKhtlBdfEG`*-qH?9h7jg z0R;Zp#{nM2rr5Jvuh-U!GY% z3Dd zVPqP>6%Qmtzn^wFP#D=|PsH0IHA7ue|NfzV_1 z>1K1&Gbr~D?12C!Zf2wp4@XLWRttSe2?nz4_Hy6R;+EpZgvzPr=oPkNw{EFN{&3^ko{kRnXa)!G-4DG#qZxwwpJ>sW6jx;97*}LM?^X~Y z$Z-B4+i;OD#++o`^&5|l&>{P9OxS6$tk||_-yEh(X{_~6 zAf~%Q;jR&s?-yH>l2~gSMVjy3ei&d_ztibzEL8-%-OhT^F>eRR+gPUR{R9L?B*7Rz?C_w!B);7E1K+UArmpwWR?3VkObONL2hkjbqw5^!+!=xb{ye zi?OZlh{*KL$2}59R`kyCt?jt>&cNvO&an6d_D?rIv{}yU=)e=YahGmvA6d?RQAUSt zS^9hvEGo6zvBsoX{&nobdQ(`!u0&>Iw(n$186iEa=vmyj)3277!mPT|S*c02M%$Ep z2<2PEU+nI;a7bz(TSBo7@E}wVyn{-H95W#Rj!vFlU$0W73qK-KW7S_lo7he@NN^Wz zgAGQ`+>jh0$FYWcA=OqI#}^u%OKSI*g&9|81DTN|E(Eu(X5d(TER<%TTWiYhT+b%T zGsOG3oBb(*`RXfnG4D{BK+9(;YIM0OgR_Q#QGQ_Bpd`jb=}I9^9%C(+JOo!87P`Id z+n%!!T&LF`JFV9gS1yjEL~MV=WTEXeW7Ty{gzYrpA}{+5XH|55ytoZjM0s%K*Thtl zKxo}P#8d}+aDlzJ!Oz508~;IjaSMWQ@!;wtBy7-wPx3KWP*AiesuWlkEDuxNOrgI$ zjpIl$^RMq#K-w~kvTBbn92Xx?P-gkF7Ka%NMEBe=S3!Zaq1+^ZQV+dogVU7Zs|rPU zc~FUCNhHuM1aRGR^u}TgN+!AAkS#jrNGhbxub;5=+u` zPH~O(xaP*d=yguN@d?b2Z+=9_YfQ1^Mx}pRiZN%$$x{#miolHt12au5aHzwF_^I={ z~b=r(o$o)jd0Vdv1t(1T~JZx`=6E99`1cV1w4d5s|t7vhx8j zkHsNoRDs?&%nEk~Y|6Eru>9a5yo-{Z&g^ccu5k zLUKT2*CAqSr>7P-k0Ao@b3&l78p(^qF?2BK2RixiVb}N61&DU`=?Lw*964Q=b21s#R8ty7{Ec=$_P>UBVq_wu{Fwr?O9WX%e594hO8 zhMuo!aIi~V2cHMVL4HVz{`S~*Ao zwKPWU!1}+kDTkRg;>j0NHU*E(eDl9yyb^Ue#UPtD8rB4>fr;@?wLl{EEj#jZBV*;{WIal?tZ=|d5UM1bmhIy$`b)O^HC-(nyG9de zRTkv{f73!U!lK8K+9U!9^FEl1#$X}LBro7Xrn0cbjmZ>CVj%g(;zS!wh5Waw-tZ6|##caL6#jI~a(zbs~FV&!#EE^=2vaswXQ% zNh_j6LAB?-%Np}CL+x)>O(LZ4@Q=ErT-d>lo|5#rj<*g@kaV)aIusT_DCoQTB3EL= zW>w5yygWG2s-oFcV#4i}X;du7T@r41@*)D`h7dtG&y*5%D80tx#GS^wW^(aL9X4{c z12*VQO*V96%un_AQ5Q5sI3Igx=m5I3;-;1+t{OR_3sT@fc48ws0-8E9oEqD2T{?15 zE6yu?X3VPKl3$xaEi8U`MChQp_yk`QpUc83Z*u8-vh z*iYG5qjut>cC3KU+C%M&4bBdRHg>fnJWhc-7=kfBv(Fgdf*C&QzQH2`DcCtSSaeX? z@a%P3zi8soIW9ySy$n#8KtUOO0Gqu6K|z#6?gVGfrhtFSM{GZ-dIv5DwX}k~J#rGTq^uA7ozSo+b={=I1O>jsKB2}HU;&h!#WakmF)-wuK=?4xj zG6%Wug(_sIJC)|um8|(Wy4?dt4%1(#wG2^pr@!8XF`Js(2$F=lKLME#u50_%qfU&1pp35g=YH;}~4;n7mR zb(Xalm`X-i&jLeB25<828VK+qVv=%ZZPOcH(;cRDmY?1+Xw#C@k9k>D%0#KEqwl+p zP$kCLeG)KByII71vMKxAs677|y4CYprKYp_ixinmdN^UZp*B32i0h6%I>Wn!)8Iy9zqS*xkAo+*B?K}tbSG6i+)ug zt&HZeNWW*tKT@IaH2BIh);RYThM1pV(yr~q)eC`UGK*J#0_o8RO13mO-MtM%GV48I zdLcGre%yo&Ug`=)_7aAeX&47r5IMDFg zzz>Srioy=!K*QIVqu>r>A|hX5p1J9~pV_7lz!g$y9$Az)=JmAWQFWMb7B z1;V}23hkbC(S=u4?7(xRaOq_LZ_gUze zg#^UY2znhb^RyXWEWQUf;_DwtwQOD@$wHK{yMr46EavlDWI=RlCHuoA58PA?KZ2?D zRE0FZnqN{)YfU{F`@SipS7x=$F%|D-_l#wyd+)rMwxH;|NKKECoea(>Zl>srC2ocZ zeDM!0XoN}t4qf@bU!V$z!dIVA6sdfRVz?~}Rj16f6XQ&eGmQ~ZdN>kMR6%Pcr?3R} z1iUtIUAgK5xjLj0eg46jHUgXxiDuXjB@WEHT5R8Trh<#}D|2c%TW}1>R(}2X6}kRu zq@l=jshA242kC3)7m?+m<6)Uu{?`IA$S6(TtI@koV#!i*uRDX*dltx9VbMe|u6JI{@YT>l#Lf~2Gu-1!ZlnZBa` zN;_EQYh&IQmxZ~$sY^apGwI4AyM&*pHui)K)i~7|x>{VDyMojb;@*>44hTYVPdfWb zUulie!E>xmoRLt2^iM1-?>f@`Nb;#e>Uv%p9MZCmv!EH`j3_~#lJZXa6J`w`4^_c* zx%UD)CQ%rOvJxH%|0Fmu`))yc(QO+@C={ensI6qb5?nCb)Y3vvIp;6ioEG$TE*L9f z_={!jb8fT*iX2^U{Cr#tH+hAi;hDqJIDh#&g)DYZ7k!LAI47IPIq8QY0hsqA zxZBV$?D6|%HjN;rO%N>$6<8A=D@U&0DiloXNx@Hrc`fOpIx=PPqP?pwrk*db=zQ6s zWXLTOHB`Gk_&JX?ghiXxt6O(@bY84)jP7fez8%#Bl8ZG?Km^sx3=769B!|Zw4gvbx zpjzD3q%`X<^hHfw11%65db8{JYY2Kba6k_@F#7@Iczj%B*MD;-c!aitnyh-)aebXs zxMP|Sv^l?r1jN#1Xa~jFBGk&l0%;)Cn=JxTJ##cn`GNvzNKAPdAyM%p;PIO++5ru^ zp;zfy0RcWlOj(ENIf{19u#1OR+_mosfkHzDXyXT{k~Xxy^Fpk3i7FIy(@e)laZxJk zgCY~ndctJ%Qj5bWyK_=(J|c(9+a9JUhDonpPl2p2^D;5DsoL;&4%^@SW3k<1*?uxt zlEwI8V9h-`ZBxYLviZ(E!p}XT&%}=ihDWpg+yNal5g=2NhN_2Whdk}8lVODV5M$&( z?lP$7HAUL-F{?yr`ifb!l8LT*w~z5Oj!UUA9gdyeb1}f_$Yw z&8jh^wesMpN2HX#)$CoOk;u%m%s>jrW;MU`v&e<+l+rZh%4#TTVzmuC$;#^3VoIGz zLvzfCObZ9F8x?D5;U_S*;_a-C$@nxxH~Uc{21l&?`|k*qRq^gDM#|1y!qDz-KsB_} zlpkth?mL`fz=1@fPkP1*ZTJdIe#X^lRDm;ilWKtjyUshU?*X?@b_{!Eu?vc?pLhc^Hp40<0rjcrWhk%FjCYBJ^i8*#ylY#$3mZ55w!FP#z;mX$Kek z4Cn%u2tXGQb+ffWE~bHlc8R-F6;lgq#O-9O?<1i+0sT4Zw_(Lm-jHyk-&TBttJ6x5 zlzAgmWiN#V^tm6V$;V1uAKjQuU4RW7{DBVe9C%=VbQAW#hCI+A&&%(M5;g`7@%8EL z8E;(Ze;8sK2UoqRu>xH|lq%(ABU=I9g?zu$U`~&5y6#eKA4;cXwTAr!J} zJo|sS$7v%JRzOn81RbU680J)@_G|b*o6Vh0(YMZXDJiwR72$#!F(0H{tqZABEu%r# z-K(G~d_vVp-5Sw{{pk&^=X$qlyW_+jRwvgMFGr^u5H#0(S#s_ zM55=nPEbbShJ=ynz>9AvzGu$_&(69274%5Q|K4Yj%W|sCCUz>@lO& zUipQbtPTo|Ae+>M0_o%B1%Vt_nW78zNo>1KCh+y|xVKlKQvA)aYZ|RouwUEp`3wk9 zqso6lP^%)I1QDHG+YfYDypXNKa}KTBWG$uM1kG(3__c^Mk6b3oNn?C`WaTFR9y}(3 zDD2&s0w|hLQvF}nWjd@5%6T?q=vTdTNU}Bz;xMpn5#mXq^5np|W=+vj8iQ-8DY_A= z&%KHLQ|ct@)s*D1P}l{SRxbG?d0K?lj%Qlh@;U}~TR~|vsSdG=<>(m_}#IrO*!WPemCMRk|rA{?23fIZVt%7HFP||7je~^p+lw@=AnP-?* zr-64c;nO^nJTKED2jECz^zVE^TW?BquNA%?7o*;Z?`#Ny>&|H=2`zY$`h=U2KyLA0 z2)yFHqiE^ROVz)KzKYTzYUv&bVzp|y!OQ_1N>lsXVZ8SKRDJhTd%&nv=N7AL(25%q zq7i|rF~BHMH2D!BtNXbR%Fz~V3~%9tNtQ{6W&31<$a3FpYj}~$s3fnkk6g~<3B_ap zpE6*C6!P0ha`$myrrUV&F-D3?v_!DZJYZzXxAN=$F*4m&v+cF&hxIiz2qMZ4*s8k2 zAMGu3-D>%>6p7(1VfVRj8>~%^@0TCcXryDD3xQx>B=O&s?7E2N6Ac}?`kMnalt+T! zHI&=-5erp3bI6mmk}PCcm;5DULD^!vvb(9bBD6lD#dc__QpI)>M#XcS%HK`-N}y?d zZZV*fdm@BWB)CAwo3n(u-z92zA-q6vAyf;^Lc^vf23Q_o5|F-EsfKL04xWZa$IA2g zW$q6$8!?~S8R&#kKZSdYLn-emy41pLw7o6pXWdt;3}bJr6yfQ-d)D^!(^-bG-iCX_%ZbW7HiLrsXBpQ_AXIivQPUf@jt8WkaTvFfbjl06W5ag|B z3^B2P8t$>_dJ;>D^{b<>Qle58=aJE|JRiRCE7z)s+U|`)Tk{lH+ANy7Mc#>uxbyX= zim&L%s*wsA2*?je(YuaJ861D4jaZGX-{bq2B4(+x3fr9ALWugO>F*1s{XMy@se#-B zd%GZE(pR5Z`muGY^MvOj`-B~qoU;+9rAX2LXta>W^K6?-723jg|LXz6Bjlk30M;~0 zfTB9J*c)hFIMh58P&ia-;0q{X2n+%#aA*fK;0uy&)ctVt3H(i-bws^1DJaAaL4pB9 zLw)vFd=2kOM$FKVjjI z`30A6E<;3NM`K44j3*<_i98>j*68i;9|S;pYYo^z2i-LShp_WcL|i}BSPe&OJZ#6E zmy(wT?)rL4@gsg1Og^20E>`_)o~70-Ie)?t5yz_QY4r*6{oTQK9hZcOw+Cqf8hTG~ zLu_RVKF$W3J(8fyQa^PT99De?VvD_{3OR=&tFFqpYW5CDloW)npEX8opTRubHVNg8 zVOqDu!K}x?SsfyJbdR5Y3~F0il3U|tN&F#|91cqPfWvoxnYe9Ll_BnBS0FA0p z9jk5Lr+)av7=Ejsk2rIvTnwsmm~JrvX(z>lYbosRpTJJFm|944vnH1AXVZHmlL^FGlt)lU94lyDw3z=Cqaz5(2IcKr4e7d8Cet#C5dXM4+ zxs`7O)xhv>oDfOL1edP-4ZOOi>xDq`c!l~s!i6zFWPVi##z6BZ%my849NGxqoQNWj zBK@w*E)&#Tif~vfQ@jQIg8)D$9Q^hVLMIekNKv=@qKEeXM(v?}wluV~`6`E`*BkC4 zenQZ;Tk$6-fl)Dkf}4e#3bYsK4x~Bl3WLNz8&0AAmNjrbLP(j=w@pg|(X}KC0_S%G zQ0t}S8D}6m_~F9j87RLJng;Vgv+7mPFD-q81&Q&C2IR{}g7KFAy6p|`IiS*-H>=_d zMAE^(oZoG_Pwb3h1Jq|Hli{6gmA!Kn8ES+HdLcGK%61$Zu`fxn3KbSBc=J95y%6`} zbfl)5=Vi{Sd8w?i>U1&t^lS``1CQt{wZP{NFM{fNK7kyRuM8SAC%8Cr){TrX?hGH1 zp1;7xc=dX4)xQ90jaPXxo*eoznmqfzbQY7991dYp3NX2U+uvZ|)Z|cb7o5xup#PKMjyx05>*jy+;(7p7|5(B_Ypj3p8EWZ z7QiTEoDQQen$;6HRtl%VG;P2;eYMdrviF4^EwwJD=hJr^Fw3{a(mW~0(diFV>*gKe z>A6zHDfGQ6BIXyC`i}Zl5|)nq#hgubE>21iFD~M)ke{H4I9pHfMn)w6Tu*RHD7j+* zitJkmlm-P>Ueyeonz3ETF!m550fNdw?54CWg5W-qv@CyFULlsT$6(BI**CtK2d77^ z@3Q%c$R5yRy;1drh5`uetDY4b%7il`SlGnSlKbO)=VXPUcY4qx?d~`4QSKj ze(A!kdFAoq?IX&%X}(78UQDB94MW&5X4MHD+2A)H;XbSK-M)8PTCES2(_`QDiv`}8 zL(x|?6l=pf4pgO8go{iXTT*;DMGyY9vl@UK|H6Yum#zuyh|tqDAME4Hzde^Mj%vCn zrzAzc31UsmkNI~)RORK)gIwy4xpkL>eog3H6shO;i|`(@KR^F^iNNX^4f# zP=PXTo;4woGgbQe^zQZBYu&dS!?&idxOJb|imeco>Ci22@Lt^bRf<2oxsv;-v$HEc zySVPMgG!LwkKJDpqwct*;jb}OU2SIio}U8L4*K{;9Dx)x?w6sL0NJGzD%nAwumgA+ z3;*Q3&|*BaSz7}M_x!E15utMQ_wO?SSCdk5ssEiis5A-uz?Ih??+-6oJR({%u18vM zLG@9c+hB<>i_}yFdgS-1cHowUb_f0MANpb3FH`OWi6XuArtdE7yN2sF_P00BUg}TX z^j?a)A3a$YDiU7xB4JZqzm*;?3K7e;cr-3xVgI74dS0y8hJWxPzwk0-4)aWJSCj$l z&t3OjRISa9>HFi6g%~ZHS3Na%zh+IHR!+O?j@;ef>`yE*hF$Ax(`$N;+=EYJ8{~)M zaZ^UOi~&Pj1-Y|yd> zYQ~_ja|0zte3vi_WTFYPK;CWajMRmJE1xinfvW?20mF-oCK8iKm>mS?YtBCKMyFqt znbOxOC@kLB@y4P#E0QD3NB|&}-$hY)gk>2jlDCo=?&cD|41nJj>FB}Og9ro{6B+Zr z(y6JV&OM9+Pr-mFD_ZGaZUyCkDp%iBbj|wcv`2T@;jU5Bg2WlxMN_N~Vp&fSt{_iu zvwh6@Uc_6jVA}h5w{l4OOb=$cc8`9zhbz%GUK#FfU-E)5kNd`=FvHxpG!UYIRX{28zk4N+QKG(cE2!S+Vb zzl*G=P`5+xw*2EqV)t9Hs=i6`Vh_1S6mbe!Kl~#{609GPY}3nxxOa%s=AGW>NOcEt zF)2Pkg@X%%7R)lZx3l3f!^lj?R1;vsA1Ki@`C@_912Xp~1zhLwZaU{#D?=e<)+7 zF(Cy*@AHA(IP{WT3wHJX{|b6E;GMDf#;2US=CJo}kaqX_>cWIWpc60!h8 zk^n}m58+h7q}8JD|6hPgpy&Ku{3pm62Gdo*<>_WUI*C2%o3~6$fDsF^y<+%X{M!uk z3K}ZAsg}CQuiJG;h^RjnNp2|jhgIq4M~_6@E2a)JP=SH7#Z&Pt!P^N{% zkMRy?^$-b>r>w`Xi-QUEff_=|ZRzXZ%#G|i%uV#9+-3c92jaC3>dwKP`v4ayR#FS& z8W-B-24t^Z1o{VitzB8thEh^^IGw5L?s-#x+4r>jNbfW73{i?j(0+wfSNQ7w{{c>@ z?znya{NLaKGzA$y8%}tXZ({$9a7@7$jq_#mVJ*m4V_k3ej)Qh*u}j z4p*&OSet#JLZrWIm?v`BefpnrV19C(yttqq;lvxHHJtf5xlczImijj|7ZwaAmCkpx z;5YE6B}p-LyesTBeLizlHdR$es{#+}JNaIm}lB`fFLDsYH?py)j4SE9LKK^+^*i*k`yFu|Cj(%aCr)L>Eb* z{B@ayJQ1T2L&cI#@Q@YUZ9+u(8uj=I4DxUH%G&E^PRY%M>m`lzFw6tqoPZH~cPLhe zHbcy-plWnaipD%M#fV3)#n62)KA=b~_`s{WFiQ$SZ^tXd?6G`5>o{7qH)258=Qc34 zT#`+frdlCkXc$|gIg&eg_j1PWV+nuv)BYXJt{bmV z6HrBe{#`|ve#$;*snrr9h%39Ei5|NCZydyX0?IDzH$Vvx?+GZ}$9RjvlqE2---!26 zv){ysipF>cReDOtc%!dVAKNcS2iOdfeqZ>2yto}sr8?W~kV8mcY+J#5@d+Fs^|Jib z%jnI9vs((R385NA-Rg0K`S57=4fJOOxSu4t8-@?xKE9b4M~YXC!VybB|D^#&TQIj) zR6UDeKnnWuaU&-F1~`ONCytpGN(}C15j5K&lz=jopJ2(jp}k<~ougH;lN$gq(asC4 z`wK70oZNs+?*xp=b}tm%^v*Eo#}19u80NfZ$okN@#$H7`eGlb3TX5jx)n`A;dt|AK z?-N(G)uK{_pm$RBf?z$OLXqGhq?D@NV%0ar`0b;7jIHHjMa&=pe_Ld!`OHdGT-glX z)!WFTWE}HyXxbLqwE&5at6yJWk?v%h4YBEkxhE`{&hG1is>Ah{7)sbXZ>5)o`Qqr& zCB1=R!|dp!c`?I|@xWP)3gFcG@gt@`upXoI7$}lmE%vOQ_DgmKa^NDL6OEALZ49IY z?W-Llw5g8HMZyl##=fO<#-M*B<>IDWX%cDL`!HhjitBJ>3J<^eauFqPEbVs*J?*3C zFj^@}Gaeuns2P76xeh1Fns^%dPX~-Gv6{NL9cW3n~m*Z3tH>HB}~owVos1rLOlY<7d4TS6rz&Ij?2Y>!@m$ zbae#Gr0j!r+;t8}#9BBT%OqaFM|$wRu2YF$=TX$$hDx{*3zcCZ1#-_&nSVj` zH)}f%>rTa^!3*5_s%+raH?u|`6B zK4xh$C$O+{k6yL_jo_T@FUM(`Q8;S-@Wt`ihj zwxW417Lh2Bv03SgVV}?{aVxCRAHe^*tYELM)VKski6&EuxTj=K5OTl&<$}+)aHl6Y zcHX`FfrK9YE%|(;%66W!h z#%`fx&Ao^juKHJ%2z$~pbq6I2l%AMOsL~I3<^)!In2_0t;hbz_<*5Hm&-e?66@4kT z@|x@I;H9*J-Tp8#dS_n(c1|qMYzPMG`*4JhU<@c?I@^O3w91tR4E@dml?xMmU&fH< z)r;CT+E~O@bycK6TOx-eQ0n-`c)r@M=>SZ4EPmLx;SE?$qtEsxTFH2FbSh-b&62Ur z1l;QAruwz~^t*L;=+xDUDpiNJBi5|2X%+m{!KXaiM+L6dADezc0A$IBInMz&8Vesb zRT<6FqHot}MAQ~9G)OXP2+WQDkbfB4Wa%q_FBa2QJrhX;4ud60!$*Q|=~latlortCRYiXO7OdwC6;) zjGfSyqu@ua8Ad9RhhaB5YC``2|H0(kLB6JX98b&gF$NV$XE$_0A>)H4KfSY2x4f3& z;(V>N0@#L8B$utJ*}6YfIun|_Q9sjW@PX)-*He&9jq8@D`Q)Jw)A~}N%)Tntq$AUV z4wpK@oU|PIqJ725{R!BtQhr}0HTln~s)e+%<%aN?PYy6qiX`@X4%qcO_WWWt#~ec; zBP0o^;}gg|8yS$y~n3&YGeAT)+yKq0s*3T%OB> z;a}-B#*l5sRLp$v9+}%d`+{(W60eR`8AvH;F5>I(2IXUZfJ`pM6b*OO^gf?IpA#FW zXso#f%S$?2d<@;V{TSN?{*g8kN9^m^@3K{PY}cWa?IOLc6+)_G7k73;KW;?Q-yV-Zb-AKrGvufOQe_pUI6bK!O>x~r_@)Ek z`8R+2M%rC*srdB&!{?Yj7-9YfnxQo(xryldgGx zsxQdOLV6BD^B68{EJpgPOl?etRyN0XS8ZFruwIU_1yzQzb?+}+klFttvw2Uens4Qa zggm%m2xfJ*l(HJEA7TO;tG0eU$d$0ot*Wog=TU8h5)uygmtE-R^5QG)m?#A`h4m7xh5B+AAmoYQYzUt>Mn~VbZd}H8= zF|QB>_;IDqwqJmicFmsM&@@cGNKZ7?u5bY>gTc!#3Fjoc3O^q2==%<;w5}OR832M& z%e9Y~Rh@@oa%ixaYd830jG)^c)<@fRzHPGPxT^#e%!`?})Pj81;YscqPnelDmF8^{ zjSMdiGZQH?qa!Do(^a^H;-C5{T&XB}CI#9>!1CF@2>|`V`Dp%D8gAQ1>~SMFu>eH^ zG<=OY238~;U~KJ1QrCp@6H3TeDvC z^^saF^Vj%hHB_ZPpvJ!T@b~RGA1&xJ#LRQMd2YdL`Da>WH8#F{ta5_fi;b-jrnom? z`c8yRHy_a??c~O3TqNgIm>y^}tC1dKJuUq?y4O6N`B-ISDE+#g9L!OEX_9gcxKEp_(SxFcQO zsDMx|!$?tM7{RW)F=42Bk@OPu*tGmibqkJblAob?%SLxnJ?m7Z5m3+w@V*6&5(fFl zRRr!dJW&OW)I61W$5jw)7}@OM(FKj6(7_b~u-fZ=nz3k_E&(XudMy6Mfv|Q(M*Z$3 zQhdPTO5`dk8b*#CSYvKzEx_uv*`)on@rJMrW=Dqaao}fp)>9kG^ZdH6CPGkM?7}2P z747l!sN2p#gC;mv--fz(Y^nmSSF(X;Sl&G_-XyC6sX) z>=Ulq01`oPU#9UpGYyl%nFZm|?=#WPF8`9UKCD!&m0V!eA6xBZ?Ggl^x-N4Q{A zPzcp4Z4^*lI0jT|C8m;lKJ0`y>_9%9R-)f-g7T;X&UIJB$WOofnqo;uE#B$XUJ?7n zy}P1Oqe0$5j(GXNKF|hOut53jiUL`2OQ{NC^z~QYd`T6xW-%pF6;>AqL0hQ#0)d9I z!opjD9n9KKT|w1l-@mj)&;gvvv50UOWsS;J3~TBtRv?0-58=1&}H zNhioZCYdA>-+*~*#`AZ(=Q2YCM1fLfGr1{h=gJYyI!D=J1 zVd-91+H+52ZKCtV=ko z3WvT#4$;UWiK~Gk(k^Z-*3@NePZ_TTujS{_-4`%_mUV@W@k51U`^j#fe=WKfHlioA zH|-xVatRqUa+$l$c*{+eJQVeIA*G6JP{!w~1aEqH>?G9hE@SFg>Bfcj+oN8iF{bGZ zEoBV>@vg{}DcyqWoDSi#VR5ToN`>fq`IIxHig8kmGD@p$5%vH}u!SOj%S2G{g&}yT zg(1OyV(lg6Am!x4bocIDeuu)M)x*4yg(Tb_n)6D2PP1>ev4Uxyn^=(^!V9UZh z6ZTQ>=@V@Bg^p`qBEppjcG#_buA(=e_^BPWN(I&&am+2@`xc`u3CIvHWpX- zHYivJ6*BI=a)_~Nqq2R@3sx(W7^S6!RcLut-)dr+#M&lG(ZDLG+J+m=+J+2ad9|m# z8d2WlkZxA0P$4Z?*=I)GeVDHFB&a*!&YLc$b{^5G41oa((Ro!B{tnID zn$I?BgcRL2I=t&%dzr&j<^;I`$kH$Vi51Lrul(eCT!A z=mOpV&Kx$0{{y`f`8?|C0!nr00hEn{s8!skA2uK=G6zBBL(CQn?Y_T>E<(K10C}C< zuZyTmg=!tbV@2)L8hY1|82AwpXS1J_5o(On08O3zSEt}iqRp(xKxjo+FFZ{#awMZP z3^8gj*O8v(tdx5j64Vt%(J8t)Op39uQxy=^1;4NJ=CVL&QydE6=53e$Sm)I{m?bXm z7G5q)=E)m>*i9D({|ykHjW3aP`2K$`2kU>>6n^-V&%qYM9hc7G4&UQMl@mXTk`hp_ zb&|GG{b?A(^~NJddxiiIe!9T%Kdo-fkz~aFz>U}U^(|BxlK~nR;jhzPK=<>~v#k87 zdM9PUd{$7eK)f95E=^hNFpetXOLBPpUTwXYdro%ss>JbZA$OW+d|B#rQfT8a$T>QC zHq@rc0NSEjS&K4gWI;&cmQEW$Q;rh`o}lv2jte(P_bp@dt=p>7RIA7(2bz23*Y*5LuqmURyr$u6Oh)&_QpK%{ z4xOi;$;tR1g3(9Q>eE+eBm|CZibluy4#540)X!4Zab@5Afa@vfKG>7atZau}jW1{= zE5svh^b;>L$*aF^W5A1&yBggcb}y_dPwat7Tb|maWUWUQ`!Pj2c&9g+n9!A|=M8FK z4{a)CUM$t7YIV$3tehotn|K`qe>voZ1KwAcnZ|{;@yq25!An{{+5Tv>WytQ5{{36F zn9NU{+F723c$;X8T#wItC%bo#9Ot$h&W7?QH0t$*V(F_&;sX|gV#C$)sZ(mzLHfz- zO^nVLIo1nsIgUwXd@CgvRUfLp1oGqNl<{TjuSU%3?Tx1A!+fWcwV#*S?S>lW#4j(B zbAak;M z>JH<13`{U}x!|yKra*;BRh%t?)GKzH#O$<9Umw|`-8IRw^CX>D9}(!eC&t)ORQ+R&ZiR+kGOot zDdiVUR9`5|zU)rA9~1#U(?y?NK;<{Nob}SWryffE0~0a~&$_jYC?EZi*fpK)n;Dk+52v;F7iY&FkD-tu$;;3HmNIS+ zY6@T}@|Ftg>95%4R_P26I(^DC^UoUTx;y()(+Y{7zkfTGh~~BlzZR=C?uNtn*_Cjy z@XQX)tV8cTKYR&(wX&RR-*DgceC^I?vwsGQehaB|UsyBmF2RkudJ zLU_gz^xA34^|0844n3V4;3>~jOH2_cwlsMJ9&{8u=iR(}J^1SG!i^&)sq-t&g>uQ1) zu;GL!haucD7!1!fy?|JEe)6WHsl9685)y?IYWoLP2X z$BG$#JWsOet)wnQhP$hVc?FF^?ei13th}^E5N8-nc z1$Tr`W%p(5TS@}#gtO7UhFXQ0Jj6Fu3aVHNYD?^2P`z+JCvV~Vl;JPQoRHtQa2Ks? z{Q!CH30(+9*b{l5tQ%Ybzk;f>6iL{4K|!zFb-ACRK>aJMN(i{t7AgqKYQGnNCBH4mU9S|PeZb30D;G2TID)_0<7@-n!aPFPpQ3icUN3e6Dn!js)JScu=TP~8kn>zWS=KUHA)Q~_hvz`u=?AxM1Ph`^|kf8D4Yu#;-mfT2g@m2Z{-a=6W;j@k4SNL4o zaU4^H0QFRbNCJJj~=&R3H$}4Waf$@eHD@fxe!t8Nf@n9P=4}m?xHt&_5VpH z8h;UqJD_{Gmvphut{NVp-?f}P?1 z^&1RU2uKN4h}6H0VGNeo1>6E@-Kh8R`^`{q6T9N~L&$5vq;+wbq;75kNydSDK&&#y zsqz)a#86I}4l1PcYUqWjz*5FA7P|TyiJt^<jBI z5fW@Q2y3`Y^GC#obZ{Tb*d6S`VRfBtkStz{)(zl%?-v#H1c!Nn`K~yEluyhc5#kH+ zV$O|rSBMIAS7=vD3`vo{d`*05S`_^DLr}tZk)W!N&`PS7$*RV7La>n6vXVU&>y7Uc z@dr!SNj%D-DO|oJs&8JAb69rA-M!oiPT12ZKgKgcJ$u0>ZHq$vzE8;Qb8A^F6X)mY zvqKwdq(<$-wxDX0_I?d2cV|EEP}UFg01zeHbb(J3DanoL zi<$z$5;7zxadBjXteGTd2Odj9&$7%rm<&{Ss|BT+V#~p*^$OgOGy}_!@^6T5!fgO?T>~SE|1W@tQkL8g^YGje)LP|z zEU`2D4?}6#jLdGar6~K1ksjk14gc`~PQQ89kdV9)HP`p~iOO|-GYi@2kr1Fz2G~PC z^#^Bkk6yJBsg$dtxO3!AG`Y_jTV2#&N#W&6GX|>QKaJ^_fts?nwrt|odcuKT8gB1p zGQolo{Z1VryJSP5b+CYU*O00c{yQ;ML=OPE#!q4ecjH`C9G_W&W)#yGXVUpIMvGG- zfJ!sN2fn(My4@qEuw~Jj9ly}zz%M#1b>%Axo;&XB??JePAmwp<&(A<`d64LXjw|Zr z!hG`8{@VK09lm$N_{Lho@9g_VYHt&9&!!wZ+l}C>?5%zoG6nBT-A-`S>+70ZZP-*u z-m2nL?(_bKEm@VHO5U$N54jzd2(_WFaMj;EU++_Q{a!CS^I!d*1o>6I`FV#qSPj}! zxEgP&d3GjS{?JXk(R+Q~TiSZviz7xlkg;0d*x2y-{#gIx;o{=ryw{ER=lOgmGV!IL z&-2~RU|1aS=7!IsyWi`4=dNw>x1hrM*i1LK6|3$Shu1fI03!qUc(JrQ{j)Y?* literal 0 HcmV?d00001 diff --git a/assets/rancher-logging/rancher-logging-102.0.0+up3.17.10.tgz b/assets/rancher-logging/rancher-logging-102.0.0+up3.17.10.tgz new file mode 100644 index 0000000000000000000000000000000000000000..97f006692658134df387019c4b4099cd189e9aea GIT binary patch literal 14295 zcmV;|Hz>#-iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYMbK^GBFuGqK{fa(va$-9p%CbG4JUTnO<;-O>mASZVPf}a6 zd2NV0q~JPA)RCVwaxJ zf~OG@{a@5Ly>LwK#Rs4aPw zj&N^=87DLz!Z-hT3IlI&}NPu~7GGjw9;Jp!we@Da*X&QKhdVZL4f!R2u*ZtXGgasPZ0<(is z=wgK42KwTYzSH!-r5>so=C!I+)I{LL_|H z@B30-a?cP>O&HFx;Qf$JsQSMeSw5R|uJHVtvVadey^J0`h-gd%W%>ule#(fLcj|{D zBhX-P-`n%{zD*NLhjr(FS^m#Zm}0)!1z@rK9~|x<9hK$(7<4)$LK7@kB8C&n<;<98^PnFQ#wf!<&k>Zp zGO`^2fhM_x07%j>JfR`+=RXZL+Exp<1`E_ zFSBK*@V2wH1t&BBKjnf(5TX$dd1q^@lhEL``Z0u0e{?$TLattH$sv&otCDe$axLGg z0&Q!n<1>r|ex{l@#hj*0E`DPaaxBM4ztC_2w%}(BDNj)t&VgZ{MiGt!h^dex&J*mD z@f-rfR#|N&lm&$lqZtMv*$GK@@@dR{LQ}3l`%_AMthi82Wiyz0n)gu1DUevA$}tCj zieg{?%LE6O#z14h@r*DUM>rN7u8EjJNaQ-BU}va20-pL)+58(46R9b9@M0t6=F@ zcs$0w7{Xh6=1*~uhPcx~<1vYem}~Zx3#{&i{0lt=WS#&kK!nDMkA6!rn`0#U6T$n567T(l20e>h&%E10NrG6U7KY6MHKf=q%sKZ(*y$+QeP+Hs zqp`pr1x#rea7m|Lh-Wy=R7F5SFfvMok+4!g(O61Vfk=!Qa4ZCgCtM18ElJHFC{~PV z++&mqC26(9Oi3U`#-0KV zCr%idkq}St3+|&3=^cgXom59q@GcJLvcZ=m#Cj)~P0KCtQG!M!B!b{f`UZ?9L-^1= ze*L=piyBqC>O#T@RhWc`b2&*=f6FhmEXcPA8t^leTbW8YV5U8gD# zJ6p@2&K8_%y|1FPz)xCN-D(A=vjs0yMq7JwM>y8iG#|54vLek~QcT2Z3+LE5CKxc7qLkjnki z(8!DhySraW6p>)gY24G5Bb4-XeXXv^?cHq8JM^U9r|0pAh!&8|oX@9z4sYQ7ulKkE zAXQ>C!Lhg~0hZcu*9>5{v8j5{-+BM*VtSz^%kA;)DL@(Mpan>G>uhQ{L>+j8L+_}E z!i2=Q_qfw>)&o5W&ddfyGf3k)QX(G6Idq{kmmzdXJf>aqKElz3mYf%AvonP5<2T=T zHTeBT_*^iOypIFSxKEkXVePl81KwCG(>E?~JRz~%lo-L;T>=$dH9^IVUnY(8k?PTL z8d&Ne`KQz>wAs&y-WvQ9cOrHh34JcdQW?M%Wb>i4hm()l$4Q>=F&g5MDlf^!Xqbe^ zY=GR|oD#m-+nNnst0u7UgVvy5e8he#)PkC=iClpOHD!S&dTS<^V>4Bq&s^Utd` z)@3cB8b+$iywY60RC*m}%Io=aCMZJ_{F72ijNTTK8ICdMCyb8lX4g;7q|nb8M(?8c z5BCrE)El*TM&WZDqWKy2X&mq&9O!QeW<)9F`t86<%*=?On=PA+T-K9s3QSAlBo*g~ zgc_mmwJ>-#P2;PJGxB>rA_*Sq#)p5HQ}4A2TpRLn$`F7q98Wp`Cei@gtts zygg?mD!o2IOl`50aT1=tgSYR_;q1jZod59Z4Bo$e{o?El{{8Mf{P_0W&+zjP$LH$T z@#zbA{_fS=e@T8n(=!Xk1j}tLjkRj0cPrqd7)A`EE4zH<8W;l~N$ow2@y7)F0tYa{ zQ#2z~s&`VU1QH7z2RJbHXJz=*YF=jxVyr*pI`ue>eLXMbZaSs{@W+H2YiX%{+l28X zWyVh&C@s>TV*g61UzaG6DhmoC>_x$4XDhR47Mqi`6iOpJrVK+w12Ud#L6FhIlXQ0J zqx9hshDeS_pm*(BRD`*x&^BGwi(KjU;5eRJsw-7kZaYYTH4yVb?LNd*ZhUhQIHEJ0 zwM?~%I>2!|h*CW!u_l1rJ?U9@xPeh7&GEuSlPF>Pk4#{ zcQ80OD31UB-r?gX595Cy&!$ytno>{Gl{gZGP;0`ean>S_D<0E_iSQBo5>j;80fQ3HFWc zL26}hTeVo)NoAhs@|OD3r_6<2gHi_Nm8^f7)ssm6@rT`t$qm{naL&=h0U!sBjFqn9 zX;Y||8y($3Y6-SQGKgMbzhKK3UJg}tLH~`SP*FEFKI~VcF8w(RQ}9fvpTgyRK*BQnLY;Qfnn(Hz4SlU~(&v!7UBZ zDrjajFC&@n#oM8n0ooLT#evRhmP`UmkShY&7-}WX%8@HuCYGUB0^}fg1HYwI;M*bE zz}7XUk|l_i0j+>&({i%y)7VD>wr#tPVP+?Pn`7gC-?89|_NQB}Y_7e_7Ao1mHnw)= z(Nm_ZYo}VJm4btyoob^k;}^!0bis^kQ0pNMCumoXK|1hqcvXF;p^8A+RMU2uQ{yap zbr*=198#+wT(0UM-Y|&4U8_H?x7k6sULULo0ySJA@lnQL+()5_G%!S0pKIoRweBr- zqoSg9*P4@7P41^p{arYx37AkM<@Zr0VQbA)aRQfiA9<+)r7lgsE@8KC z(D+Kw1cpyxOc)p7S(N&_Ad(OWSLV=6jOlPw;>+gb2W!eDQ4-<^$2xw-g`R{8I-`-I z%(mSpZ%gug1P=x~3WpuI$>IUF1L6zVad7#UHuG3~_!Kc5R1EJN3u6dY#^K9a>yX=b z^L+`1`)x2Zk?Dxx%rXs5o`Tb;DLH(qpju8V8jzcsGT}n->667hA1+B38^z3w-5nU2 zOofhU9t(&tik00yAKEFIOfeUbFdqjv_OW6VgQF=E(rZ~H>w@9(ZQX<#W7{i>){f!Q zwtQYO5K#$MoA(Y@|GBgDrkLf)7Hb&;#pw-o#HUTjLX5jT^q~tfA)?BCHw!; z(ZPfL_g)??U`aGoF1j%Zv6v_LX(Y+wPw~)7rv7f{#m7XYa7?i>;Q}>rcgnBW$s|~# z9FmoCA(W{+I^+1QgqW#6PHK$YM6xvY;pjm9NuslKJSHEZ+w0Z|!v1b2i;uN!jMFfj z!*3}HRW>T1BvD=PIzM9#U6mKI4cQ$IBdp!boJJUOFS_oy(E{X3phA|kM_D;px0SaQ z!}GUivaDJ;6YTGJomXQpxt1D;2}QEOkm?=DUAxL_t@2|e@&?=GG`5LFj<9!B{!-Ra zR;IB)E82%VhxC=|$M9+U;dSuLNTQ(>?DRRVg|{msm@pEHF?7G?y{~z<1WmWQ3d1%1 ztr_veWcg-uMtd8wS(A-+9sx^YldP(OZBr5o64!Vv9(5>F!K)^bICumIA{6VSEIPyN znh_yz>@=&?h_(||RjK8oN}8G}w6s8BBpSRhjr1(cY-h?SjY_+uOVn zRq<{kqquym|2Cd5xKW#A*@5o2UFcqP*AZDdYr|ysEl1WmzO+*=Da8xvFv5kNGc6>P zM`?<~$m3I;%DkkSA(ELzfPz5lE*46K9+{9xoedFmok5AIfbA<1 z2d_AENjyU#37U{IPOQI#`CKP?sUrQVg3Fl*Qh;q|oA0{*dpj;F5|bjj zUFdo(F?(g*0V;($$7_Z5pJ@c@Mdg{vv~VLXfm>tQ2+0+I#!f0L1akV2Q7Qa70`r@kWW3w_g$27S@n+(uYP{<@|T_MfBs#N2y=m=u zRWjleRpzU8d-d}C>mP<+zZrggwya}WVn?-CQaIcm0q^VA3#6mbkL3KbnNvD_bgqnB zS&l?dWpp!HUzXBL3SzQ0`m3Cn;$^ueD-~80XFY+a-ZD-j%R()MKa>Ud?VG7YPL2mjxFJS7>)M#y&!ZJl1PSIGKM1yCxcl#$=ne$Ko4P8)1(&WAZi>y(DL zkoTdKWLg8+5OuX!6!A#ma8zqz|ZZ8235RPcfu_3<=AGN=^Kmw1`kl)AjFc|g#e-t?8=G3`G2!9Fq zr~^Htg+p|&2;J+DjZE1R4!_dT-M8&i$^sI*D_#{7{mjPtEjv$}r`gPoo-PlbxZdwiJ3*)2f+)aQF0X+*CD^ zT<*$8Bn}K~eBtO7-W%PoT*7|(61%c-yqw6C&%FO{W&be)wXPXx+4(O|o|Nu?*dGk` z9^$|6mXJ>&17-Fr3tFl z1}qxlQ#@9uBO4jDfV>@ms&Q>CoI7r|+`{?Kf(_jRvuytF@9&rMKL+~`_TPJXO7p+& zB9P3R#njQmUnNLPAHi3nxzMS0o;nZR`&URu(3M=%-&K5L;!EKxTL24P*$S5WP|eRx zk^iozdH(0NrrSz^CG-FA$>Ec-|L5Sz!NdH&kH=lyQIha{9eQ!@d z$EW2Lmvypyn^@jp<({#Xx?4CQC_5D00n*FoxtsY^7(#uD40P9z5-NrU4J)5@R87}u z6Pa7s+|FvX#MaC%YbzovyCmV4xv)fw0%`4?aTUDs3+0M63l@Z8D|SRO>0{3m$VX_f zUxb!WCQ6X(uuO$W3Ll(NJfW<3;*~7ysf)8JeJ?N@j%URZ>UO;PiCV_BmXM|CQ#x<1 zShjjI&!;lY%Jo;mrqWyYn!jT0;sty;{ks)G_9$= zSY$MHuVM7pe`c9SSNT1*YwZM<=>LPg^8SB+u>WBHyPs!qma!Ribmatge--LGrsUQ? z&xAt1rwprns1S>u_T1=n5?QZy15wr>d+3U1I(z9bUUQsTIqT6m;Y+RiKe?j2W7kZ3 zpXsMhIr5J54lozSv)@?8UjODaSUL4m-MZ41v@$RBO$rZk1`9IjJ`2U|AKFI(3cv{K-$rWBE z|5ZA-${1Kx>z`cVKmRHqDYR*=f8rb>ut{+*aeWZ?5083U$p5PYdu@A!l66*qCG!7Z ze{fiq|A&ts^#6N#j4(p+ipLdg53AsApxAhg< zM)Iqc)nWfbxKU#L!`X||pI$wC@k_Qg=&Lx~XOMmS7ejvWq=(1Zx92LQ$o=+iJkGwp zrjv`;c!tC5D~ZQ6`}~YDdT}O@Z?1U(*gt&yGI9R*}u=uU%YvK@&4_r z^QV$`j1jzGXm7J}s=B4CoC|HsZx`;zcX6{brxmU}b;EFmv8MFPSFg|Q;UD#+*29w( zc!PvrB<61R?MFPnC<1u%;_U4BUoT3dUl=EQq710hQPfFL7tfJE`pvueOF`5<;pI!m zwQyzi0z}`vKVLG@#*|$n7PP|j2g*gUcAX?-l-ld!1Fz|nRgcg7ynmFH;N~|$>kbMw zH#Z~c=cT!h+!ZZSPA-(Y**QpM!TX?te%7a@{+A`f-huviG^o-4o(vxJzx#N;B>k@x zf2dgQ4A+Gpb{n+7-mf%eF$#konoJm;NYT?R1|U|dTB+F0tPo2B0T*hbbvP^y;;Ri@ zQ`d>}G%~xdLIA+FI_4F=^3Dxh?|a0tQnI>>wr<@WC4u=A?LR)^Y2?IetVLOXw$#;S z%h8JKkkSp&TO7WY*^`!qtt~xy$twk-)t^}0c-JN@x^EK}-nj`2@7>I?sf1t6YRqDm zJdu2>Emi$|%hSig@0Xg^gw#yb45V4*zo|Jk)eLL59HM7iGv7kUu3c z?vbFjg~rddjjSFUw0exwdNEb&v{M&aw9d4*A#9adS78?4?&phaxLD$JD{!l9F{NA& zdI4^-A(redVwOcsmpQPUMVGB{r8KnrTId!Yw_duKZ;cGV%E?db^u-+T1W?N1EgT$? zhuo?T+V87#b18DS=?n@d4cML~u_k?*QzKU-(|T!yh5W(QT3jieay8IpTIz8wT`7N3 zz7_J`^+Obf^!kL6842+Ozu-O!jUQ=jw#H+wM?&*f8sZ_GrtvX9j`eXTdW|`yR2^Nc z#Z$K8Fj?|F$E=~cQ5BlLrir~TFmz{4rJy6ed%1+xCx%3cm_H}X9ERXCliF@&-b3cz zU*>7K|F` z%+XgDMuCax#gBMC1be=EU0}d{+G5P8?rbu?z~PpMFoQ4sX(Ru$n;O;(16wBlpFA#~ z|FZvh@4^0iFHbx9?_6`Uf?&^TW%9kX12?`(4=KuK}rG7rCQ_CpR$G z-bds$E=XNx*7elQJ*zKDtC1%^%RZ!&bA6n>yP%a3>eqKKzc0tDMn7kFT4biKZJ)+I z60lukS=-6qItT67eqX77E{I#-+RI8b5{<@e?`>I#uE_tRy$AV!AJ3Zd zUs-^1=>Ws0?zP7Ghr%7Y+5FW~sB)dIetk-*$gY&!bc_hQ!k;TNq}cS*h>(>!0e2RK zQNj942)<|=+0e9J)P@9*I3R3cgoDfQ4Ur3Zi3MnxCAJoTIuD7^xb%5p#70T^X&b-+ zz|)b2*bLzdk8^2^K`4*rLU(;DKGC>klIb0LW{-g`wp_~sO9B-Za8}!9YZ=En@`muK z8rHCZFb$Tcy|s=ish3`AK@n7-@WKtQ89s$uSqQ4ZH8qX=i6VG597(e7a`*)Wkd(Wy z@wkyXe*MzJMJhzOt0<9jL$?nODMP&5n2_7*gUdrfR0$mXU={#->qKS+Zj%4Gnb$%p z)>^!1tz6sg{~BsP1ho7`pLYBI{aYD;m*xK+?Umy{21gI^ANTXDu>aq`3j^@}L*g#n zW8$u%xNY=KGIwPgJ(U&7DjB@3>K0RJbKF+o)Jz48TzM?>1xmnGT zijIZ*juT+rl;J;dM)98p(TCLMWte_xPME(^>T_HD?=}vgrT(A2%K2YM2M_-LdwDjY z|J~jvv;Wx>cbky-T$#Hyo36D|cNY;C?$T@2M9nY3fAobrHQ>KEdAGZYLfoxIz!X>$ zfrsqj4P_56lRS5sJ}le*a`K0(47sS?HD|z=nyh^L)&0wIHZ^qSF5FHFrq7?i0o6pP zJ9I@gG`SI{R0HfgcTa6dHGarh{;zfMEPUGR|0!KJ^GiQV_Ww@?ht>1H_8;#5xtFI^ z{+HwcC-XPkw7t$#fbTB)v#qF-+g^AYnzm?uH!O1WCl8ZKLF8{b^Z z3cWl#V-0o~E09L1(slLa=FoDH(Zz3+9V$Fpe~8#icyJu06I!`=?y4G4NB7>OsV-%q)q zg*WJ9Gs5;`TXZvEn?|;nkyEH$__P$!BA|_OwOXICV-cunKU#cLAdQj~7#<5Hx{z}7&zG5;6}Imors`;|pR)oee-%Q?!Mh23DF z`<$!jEv`1+^fFpDb?WDS*U^jx7p2bETWe~RI}5of$D$N@((zMe@h9&FG~x3u530d0gV!}XmMiHAgU3sa__u(&&~;GoB0GlvqJ!Ymrw4m~ z{nIS}jiY}9Yrr!3zxQ}hmj6cw5BVSW@+|W7*Jp7w%erwIhJ~}g)|coTk*zxL>RFg_ zf!V8*juRx43H_-MiA^=|d|Ol_k^R*B=9;~4LYZ(}@T_QBQ?TV*C&~x02^J@+r2L$l zlLhr@IE3?OCmnZhZweJ78&Q&|W4?^SPiViz=#)-ntHK~L7by1YL;4;B=U?+#D*xZm zm`L`y#WJu={vYj?&;QxmA3W&)_ws1{-%6}V54PODmxjM#58zbrDZ`X|K8^b2g~R~) zv#uwV(8^{qIsQcj%(b@E1X`9i6)ghUSM7m0v=YZbLP>0cppxPWWFi40EEw^5hH=YI zn`)<6HBaJ6)@}X8`QX|+Tb{7FA~LLs1#8{@VQu>vJDpXBr4Y!s5>tK|K}bvGKhhC$ zcPRh&9zU+i|NRH~e=kp+wPZm&ZTn#0B^erDs%S5Ux0j7Z6;qQdL>grJmod+qp62(s*m5%)eC%6hA5SuA8;E*QBL=pU1pJw?#Lm>$y6DYe- z81{S?thW>_lmAbS4$AT05BvXndbW%LI1#WN;uy9=O0Uucx{IV;7rKt5>q1xlx3dF# z%H6-E4|5#TG!9_+6awN4=L5&We#`_S{wQ!Pr7SPWj{avj0Ckc*y^`muG9GcuiZHGT5FX zewL2Mb87*rQOX6xR4A5L`+Kfh8^SmJZzT5LI4FOU&md>7 zzV&7A+c)*JnEwe+ZYKkl&Htn7`9J#y5BERZ%X1g{-zo|Fwy>P6+l}gg_XFb4Ee4$R zE1_oHTuO`)388yF#m3`qH;xcc%vEDkG{b7qt$=~!lULbxHCw06m2hx!cEW+g&I)Xo z=Y&xoW4UyDi^a*8BwEVz-<#qvB9oXhysg;+VN;i{nc*jc^{T2J7~txi+9mD zZ@2V8l=9Id7aL=qcl(|xL_#ZfFL9FyY)#O;3TB; zNYazW5@wzfq@fjh?-9C_DMcyQHU$hHe!yXrH!i#F@#&6T10Yi4X@=p1VYM6ML}1?O z^dN5$2HtnyYRUdR7D%d8+-4yfx;VBBY+3G{7VRO5QVNRv$#h7f@}|ILH1C-gmsM7< zP@OFSG}X4 z>uM9wn9)de=F(>Yzl1Rj1I#q%t50_S1xToJT;eZCggwbVSk9VAme#|~VRyGYO?P)C z1IW70c-W!Nh-tGtb&!0jkDl{DHu0hG?w9SY!tWj6Sh2HmuW$t{K@3G$U?zVe0X~Xh zgfrMUfFM=oI5RG~F~tb)W75P5sr}RsaEOIg*WGb1~bljm{MqVkX98%J;`dnsD z2LUm~gk?iH)BCMX=LTw@6AQZjb3-kF=a~D9sKYHADn2(D-0r#Q+(2*j2iB^kDy~xZ>qx>NB|;U$iJJMZrN_ph*ji8xa?kgYTOV zKkx=myun`k#%kf@h$m?n>W%w~6qglE5?d?8Uya{Val$aiu~-{>g}7Xk-pw#$B)}~p z-GHs2mp?iNlq9VxUfzz>7LG*RhHb5Yyo0!`-5&dmBA$hfwa2_faebuTy(4~|1)0kB zTfx17{0Klnb=(7tDYJ_HyG+kNeSUX{yOD&gd0gLZs6tchL9<{2P}O>;;?e3VUJ91B zol0#GcdV4Hc>GPuh17UbZZ(Ax0VIANyc(-N9vPL8!~ZL5a5(+`_*otyllwS`*5eAw z+lLbxfVEh{i8<^u*V&6nJpuLAiEKVj1n(OQYC?maJuS3n-tAcR+%pt4%IyXynlM7u z+1VlDT=HhC$!EE=QhQ0o%TIr7fQuF4Xgnq{5p5Qhy#2Q{z;JA8u2OM>h-a*{(vp7i zzW)YCQuna+6(?dYcwb%5UNiMJjJR_Oc3Y5!;^)qx+HEUde)wfmh`Z-%w-$HL^}&nR zQ{qomFSzwc=vV>nPjQfjH~_gda}nPh#S(`rk1;=XPbWyKD^PfB4fJJnvksrzJ}i4xqWvR z_UQ6cmpR7~bcbeX>}IDIbcZn5+uM5tU2{-DcL@7?dwcFkD2nnG$ywS6+&5iS-uv0GXck?DRSJHmf}?%^<8clc96MXoSTSr#xT%4G;s? z+pJ>Job1sEzP$)3X2@(-gw)?yvJm|PZ`yds6YP^QG3{%kmLhS< z(rAo~38OO-NVR(^L6oeCIz|p&QU>@VijokoVl3{Btx;``q7@AP|A5`ybCT@t4&mQ4 zRhXt67woPd9KgS9J3n^H_VJgFcjRU69hnhinNC|66NYEXNvZ9FD$-$hH>P5DH|yf1 zsd1UBc!C-;YEwgw_XUau`UnzDC)>G-AH%ZO%KnVLU>Nr!B%AGPPfewabz1J2QT~(o zhAi5dkLXUV#l6hkw!~`uK)dy6_ouSB|GCWUdRv$uP}*MCH)p-W`Rg;~@kwLi>)4YK z7S|ZZuA|4Tr~<~SZ3s?V%y47T!(EdPx0pX*53UY zyjsc)P(TAu7h*e+s;*4UOA;|4BADW8w%$2HJhgzX}hXn}1#V{DES z^nT?OhZF^vEo6rR-|JIyPhiwBptcI<_4mWW5D~Tc!%sGwo3zBYTGzmZC71!#_Kf*B`V;Mm88he20_NU6J( zikBZwF$#W`TKK!z$E$e97Gay&7Cq}v^thl5P4MMnY&rS8ac#YU%l*N>$a*H#Mc5kD zYQ5EqvDFoQS+NG&ZnwLp{rBeX5(>)k|0t1j2?Y_}Tn@nE`2WFR@8F=E|8w;CA^-1Q zo-H`l9AGWAg&=jpVT3pifR4x3NR}pCFpMJj@V!#XpgDHEWCGLxtKeQU;5 zG04V-ZGxOLOLx9IM6ph)w?+o#Pveks6@*Ol*kfho3Gv4aL_!iAs(Y7IJPm>|z6MTY zA?wl31(rmHVdae%*AzlL!=bVl8fb;)VNO%sb{Jw`sJP;gPE@`i%A$BE)1lr7IEg2r z6JF+ZIxi`M$T}KXq_@m8hAF+4kgcJ8jFCtgegq7UF_T|t%HV?}a87=EAzVg!>!q3P zdmsBawnHF)Kk4t7cwc96%?J9r$Qyz)AoW63fM^E4EXV0YIfXr_z0wz~`4lRVZPH zbLWxaImsgUV}gBw1KB`=nH)htF_5^IgvhrTU_F(xS*GK~8q;Ji)yWouW+7I=X3OwB1?fe5?6|z>1kLwYjc%J)?#sr6f_QPGHYW%w_dvbQ- z#Hv+?g~TvMGfB&F&f~gw8vJlkXRBC`)wHstn@dKwQ>l(cZ91+(M-H~i*qsps2riYs z!GOAiZ9K!VB&Td3LUD@1a1MTmQ4DF4cXCHE5fR!>8Dg6`{Dbyq*mFDp!HCf-90M0f zU`4P}03T2NsV43?WkO0_1w#up<&jlQ#8kjFWmm9m5VnaBmyb$acm!DZ-i{|JmC?#% z2ymES0bHd1RhF=G`v&8UU~&k5l}#cV8?+vuZ7095n;#z>F)ra(liWgsA!g5-Z&CtyB-8sAQBdaCR^e1F)!pusWn9{ zhKiZ81eO?ILwzsRs)~{%oEHn62^0s21zfKYS$uI%t%r^qI$!(Ly4SGIS&?ZHqtp>^ z*1N{D-)iZO<4mBML*L~3nJuOIl}WnMFWcc11C9k@83UD2vJK>@)i-(iTqVAJFm1!j zkY2B=|M)E6+2IDx>30`mo?zbJfgT(e5R>eVR2292rE>(;<&G9H`dViW*Ybzzx}%z8 z6R1cAqkOrIL?*O3n~6rIDSLfxqet9zq2_T@E_L)_P@ANW9*tTG=}$E@(pZ$Klus(j zaq`bhU(^96j02~#k8>5zA-4^}l2aCw6fTm_U~o$UYLGOZ;h3o1CLNoEO;poY)hA5U z+JcG$NzK0sdmINDPlzey*y*Me6f_kO>(eZBgop}yGNCzsHWx_@82MAD8&Y7YSF$ZN z`Wu@QmB~<^1gmp@j<>2r6b+q$QXSYJ+gABCu3^+$aj5F6iH+iNZBrwhkMHtLM!v9Q zT8>&=oZUwD!JHSMq~V#0PYg;i8D}&qXy^gqf{{_G^_`F^{`!@sEJk7Afz(nd3v@Gf zy!5)DM{$bbQb$4t=Gx9n#i?q5)ijgj3Ox9Eszb^!T=rS2b~}C3&LsrdSy6=Rtc}s! z>J5*8OPp1tTnXKPD&@>77>W{vtD`OoL1yrNl*S^p1r=_W`W{>d3lHF2&MkpiB&U~J z$19y641xO@0+jvjAC-M;07iPC(wHV|K~qj|2)%%D7XPX70?U1PrJ|??_Yu% zW+g#XQ_ATrNj`?l%$_AKB}o_-DT{H?fK#r<)b>gOoY4>o65=Ab#h}W=q%vkMQ7UK= zia*6tsU6p}4*FC+b>4{CDXB;}F~vFvuUh31P$@63iHT&Z!K2f8HCEcGiuf@+z= 1.16.0-0 < 1.26.0-0' + catalog.cattle.io/namespace: cattle-logging-system + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: logging.banzaicloud.io.clusterflow/v1beta1 + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: rancher-logging + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: logging + catalog.cattle.io/upstream-version: 3.17.10 +apiVersion: v1 +appVersion: 3.17.10 +description: Collects and filter logs using highly configurable CRDs. Powered by Banzai + Cloud Logging Operator. +icon: https://charts.rancher.io/assets/logos/logging.svg +keywords: +- logging +- monitoring +- security +name: rancher-logging +version: 102.0.0+up3.17.10 diff --git a/charts/rancher-logging/102.0.0+up3.17.10/README.md b/charts/rancher-logging/102.0.0+up3.17.10/README.md new file mode 100644 index 000000000..48a1a6a05 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/README.md @@ -0,0 +1,132 @@ + +# Logging operator Chart + +[Logging operator](https://github.com/banzaicloud/logging-operator) Managed centralized logging component fluentd and fluent-bit instance on cluster. + +## tl;dr: + +```bash +$ helm repo add banzaicloud-stable https://kubernetes-charts.banzaicloud.com +$ helm repo update +$ helm install banzaicloud-stable/logging-operator +``` + +## Introduction + +This chart bootstraps a [Logging Operator](https://github.com/banzaicloud/logging-operator) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes 1.8+ with Beta APIs enabled + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```bash +$ helm install --name my-release banzaicloud-stable/logging-operator +``` + +### CRDs +Use `createCustomResource=false` with Helm v3 to avoid trying to create CRDs from the `crds` folder and from templates at the same time. + +The command deploys **Logging operator** on the Kubernetes cluster with the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```bash +$ helm delete my-release +``` + +The command removes all Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following tables lists the configurable parameters of the logging-operator chart and their default values. + +| Parameter | Description | Default | +| --------------------------------------------------- | ------------------------------------------------------ |-----------------------------------------------------------------------| +| `image.repository` | Container image repository | `ghcr.io/banzaicloud/logging-operator` | +| `image.tag` | Container image tag | `3.17.10` | +| `image.pullPolicy` | Container pull policy | `IfNotPresent` | +| `nameOverride` | Override name of app | `` | +| `fullnameOverride` | Override full name of app | `` | +| `namespaceOverride` | Override namespace of app | `` | +| `watchNamespace` | Namespace to watch for LoggingOperator CRD | `` | +| `rbac.enabled` | Create rbac service account and roles | `true` | +| `rbac.psp.enabled` | Must be used with `rbac.enabled` true. If true, creates & uses RBAC resources required in the cluster with [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) enabled. | `false` | +| `priorityClassName` | Operator priorityClassName | `{}` | +| `affinity` | Node Affinity | `{}` | +| `resources` | CPU/Memory resource requests/limits | `{}` | +| `tolerations` | Node Tolerations | `[]` | +| `nodeSelector` | Define which Nodes the Pods are scheduled on. | `{}` | +| `podLabels` | Define custom labels for logging-operator pods | `{}` | +| `annotations` | Define annotations for logging-operator pods | `{}` | +| `podSecurityContext` | Pod SecurityContext for Logging operator. [More info](https://kubernetes.io/docs/concepts/policy/security-context/) | `{"runAsNonRoot": true, "runAsUser": 1000, "fsGroup": 2000}` | +| `securityContext` | Container SecurityContext for Logging operator. [More info](https://kubernetes.io/docs/concepts/policy/security-context/) | `{"allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true}` | +| `createCustomResource` | Create CRDs. | `true` | +| `monitoring.serviceMonitor.enabled` | Create Prometheus Operator servicemonitor. | `false` | +| `serviceAccount.annotations` | Define annotations for logging-operator ServiceAccount | `{}` | +| `global.seLinux.enabled` | Add seLinuxOptions to Logging resources, requires the [rke2-selinux RPM](https://github.com/rancher/rke2-selinux/releases) | `false` | + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example: + +```bash +$ helm install --name my-release -f values.yaml banzaicloud-stable/logging-operator +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +## Installing Fluentd and Fluent-bit via logging + +The previous chart does **not** install `logging` resource to deploy Fluentd and Fluent-bit on cluster. To install them please use the [Logging Operator Logging](https://github.com/banzaicloud/logging-operator/tree/master/charts/logging-operator-logging) chart. + +## tl;dr: + +```bash +$ helm repo add banzaicloud-stable https://kubernetes-charts.banzaicloud.com +$ helm repo update +$ helm install banzaicloud-stable/logging-operator-logging +``` + +## Configuration + +The following tables lists the configurable parameters of the logging-operator-logging chart and their default values. +## tl;dr: + +```bash +$ helm repo add banzaicloud-stable https://kubernetes-charts.banzaicloud.com +$ helm repo update +$ helm install banzaicloud-stable/logging-operator-logging +``` + +## Configuration + +The following tables lists the configurable parameters of the logging-operator-logging chart and their default values. + +| Parameter | Description | Default | +| --------------------------------------------------- | ------------------------------------------------------ |------------------------------------------------------------| +| `tls.enabled` | Enabled TLS communication between components | true | +| `tls.fluentdSecretName` | Specified secret name, which contain tls certs | This will overwrite automatic Helm certificate generation. | +| `tls.fluentbitSecretName` | Specified secret name, which contain tls certs | This will overwrite automatic Helm certificate generation. | +| `tls.sharedKey` | Shared key between nodes (fluentd-fluentbit) | [autogenerated] | +| `fluentbit.enabled` | Install fluent-bit | true | +| `fluentbit.namespace` | Specified fluentbit installation namespace | same as operator namespace | +| `fluentbit.image.tag` | Fluentbit container image tag | `1.9.5` | +| `fluentbit.image.repository` | Fluentbit container image repository | `fluent/fluent-bit` | +| `fluentbit.image.pullPolicy` | Fluentbit container pull policy | `IfNotPresent` | +| `fluentd.enabled` | Install fluentd | true | +| `fluentd.image.tag` | Fluentd container image tag | `v1.14.6-alpine-5` | +| `fluentd.image.repository` | Fluentd container image repository | `ghcr.io/banzaicloud/fluentd` | +| `fluentd.image.pullPolicy` | Fluentd container pull policy | `IfNotPresent` | +| `fluentd.volumeModImage.tag` | Fluentd volumeModImage container image tag | `latest` | +| `fluentd.volumeModImage.repository` | Fluentd volumeModImage container image repository | `busybox` | +| `fluentd.volumeModImage.pullPolicy` | Fluentd volumeModImage container pull policy | `IfNotPresent` | +| `fluentd.configReloaderImage.tag` | Fluentd configReloaderImage container image tag | `v0.2.2` | +| `fluentd.configReloaderImage.repository` | Fluentd configReloaderImage container image repository | `jimmidyson/configmap-reload` | +| `fluentd.configReloaderImage.pullPolicy` | Fluentd configReloaderImage container pull policy | `IfNotPresent` | +| `fluentd.fluentdPvcSpec.accessModes` | Fluentd persistence volume access modes | `[ReadWriteOnce]` | +| `fluentd.fluentdPvcSpec.resources.requests.storage` | Fluentd persistence volume size | `21Gi` | +| `fluentd.fluentdPvcSpec.storageClassName` | Fluentd persistence volume storageclass | `"""` | diff --git a/charts/rancher-logging/102.0.0+up3.17.10/app-readme.md b/charts/rancher-logging/102.0.0+up3.17.10/app-readme.md new file mode 100644 index 000000000..994c597ee --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/app-readme.md @@ -0,0 +1,45 @@ +# Rancher Logging + +This chart is based off of the upstream [Banzai Logging Operator](https://banzaicloud.com/docs/one-eye/logging-operator/) chart. The chart deploys a logging operator and CRDs, which allows users to configure complex logging pipelines with a few simple custom resources. There are two levels of logging, which allow you to collect all logs in a cluster or from a single namespace. + +For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/logging/v2.7/). + +## Upgrading to Kubernetes v1.25+ + +Starting in Kubernetes v1.25, [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) have been removed from the Kubernetes API. + +As a result, **before upgrading to Kubernetes v1.25** (or on a fresh install in a Kubernetes v1.25+ cluster), users are expected to perform an in-place upgrade of this chart with `global.cattle.psp.enabled` set to `false` if it has been previously set to `true`. + +> **Note:** +> In this chart release, any previous field that was associated with any PSP resources have been removed in favor of a single global field: `global.cattle.psp.enabled`. + +> **Note:** +> If you upgrade your cluster to Kubernetes v1.25+ before removing PSPs via a `helm upgrade` (even if you manually clean up resources), **it will leave the Helm release in a broken state within the cluster such that further Helm operations will not work (`helm uninstall`, `helm upgrade`, etc.).** +> +> If your charts get stuck in this state, please consult the Rancher docs on how to clean up your Helm release secrets. + +Upon setting `global.cattle.psp.enabled` to false, the chart will remove any PSP resources deployed on its behalf from the cluster. This is the default setting for this chart. + +As a replacement for PSPs, [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) should be used. Please consult the Rancher docs for more details on how to configure your chart release namespaces to work with the new Pod Security Admission and apply Pod Security Standards. + +## Namespace-level logging + +To collect logs from a single namespace, users create flows and these flows are connected to outputs or cluster outputs. + +## Cluster-level logging + +To collect logs from an entire cluster, users create cluster flows and cluster outputs. + +## CRDs + +- [Cluster Flow](https://banzaicloud.com/docs/one-eye/logging-operator/crds/v1beta1/clusterflow_types/) - A cluster flow is a CRD (`ClusterFlow`) that defines what logs to collect from the entire cluster. The cluster flow must be deployed in the same namespace as the logging operator. +- [Cluster Output](https://banzaicloud.com/docs/one-eye/logging-operator/crds/v1beta1/clusteroutput_types/) - A cluster output is a CRD (`ClusterOutput`) that defines how to connect to logging providers so they can start collecting logs. The cluster output must be deployed in the same namespace as the logging operator. The convenience of using a cluster output is that either a cluster flow or flow can send logs to those providers without needing to define specific outputs in each namespace for each flow. +- [Flow](https://banzaicloud.com/docs/one-eye/logging-operator/crds/v1beta1/flow_types/) - A flow is a CRD (`Flow`) that defines what logs to collect from the namespace that it is deployed in. +- [Output](https://banzaicloud.com/docs/one-eye/logging-operator/crds/v1beta1/output_types/) - An output is a CRD (`Output`) that defines how to connect to logging providers so logs can be sent to the provider. + +For more information on how to configure the Helm chart, refer to the Helm README. + +## Systemd Configuration +Some Kubernetes distributions log to journald. In order to collect these logs the `systemdLogPath` needs to be defined. While the `/run/log/journal` directory is used by default, some Linux distributions do not default to this path. For example Ubuntu defaults to `/var/log/journal`. To determine your `systemdLogPath` run `cat /etc/systemd/journald.conf | grep -E ^\#?Storage | cut -d"=" -f2` on one of your nodes. If `persistent` is returned your `systemdLogPath` should be `/var/log/journal`. If `volatile` is returned `systemdLogPath` should be `/run/log/journal`. If `auto` is returned check if `/var/log/journal` exists, and if it does then use `/var/log/journal`, otherwise use `/run/log/journal`. + +If any value not described here is returned, Rancher Logging will not be able to collect control plane logs. To address this issue set `Storage=volatile` in journald.conf, reboot your machine, and set `systemdLogPath` to `/run/log/journal`. diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/NOTES.txt b/charts/rancher-logging/102.0.0+up3.17.10/templates/NOTES.txt new file mode 100644 index 000000000..e69de29bb diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/_generic_logging.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/_generic_logging.yaml new file mode 100644 index 000000000..47669aaed --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/_generic_logging.yaml @@ -0,0 +1,116 @@ +{{- define "logging-operator.logging.tpl" -}} +apiVersion: logging.banzaicloud.io/v1beta1 +kind: Logging +metadata: + namespace: {{ .Release.Namespace }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +spec: + controlNamespace: {{ .Release.Namespace }} + fluentbit: + image: + repository: {{ template "logging-operator.fluentbitImageRepository" . }} + tag: {{ template "logging-operator.fluentbitImageTag" . }} + {{- if not .Values.disablePvc }} + {{- with .Values.fluentbit.bufferStorage }} + bufferStorage: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.fluentbit.bufferStorageVolume }} + bufferStorageVolume: {{- toYaml . | nindent 6 }} + {{- end }} + {{- end }} + {{- if or .Values.global.cattle.psp.enabled .Values.global.seLinux.enabled }} + security: + {{- end }} + {{- if .Values.global.cattle.psp.enabled }} + podSecurityPolicyCreate: true + roleBasedAccessControlCreate: true + {{- end }} + {{- if .Values.global.seLinux.enabled }} + securityContext: + seLinuxOptions: + type: rke_logreader_t + {{- end }} + {{- if or .Values.fluentbit.inputTail.Buffer_Chunk_Size .Values.fluentbit.inputTail.Buffer_Max_Size .Values.fluentbit.inputTail.Mem_Buf_Limit .Values.fluentbit.inputTail.Multiline_Flush .Values.fluentbit.inputTail.Skip_Long_Lines }} + inputTail: + {{- if .Values.fluentbit.inputTail.Buffer_Chunk_Size }} + Buffer_Chunk_Size: {{ .Values.fluentbit.inputTail.Buffer_Chunk_Size | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Buffer_Max_Size }} + Buffer_Max_Size: {{ .Values.fluentbit.inputTail.Buffer_Max_Size | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Mem_Buf_Limit }} + Mem_Buf_Limit: {{ .Values.fluentbit.inputTail.Mem_Buf_Limit | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Multiline_Flush }} + Multiline_Flush: {{ .Values.fluentbit.inputTail.Multiline_Flush | toString | quote }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Skip_Long_Lines }} + Skip_Long_Lines: {{ .Values.fluentbit.inputTail.Skip_Long_Lines | toString | quote }} + {{- end }} + {{- end }} + {{- with (concat (.Values.tolerations) (.Values.fluentbit.tolerations)) }} + tolerations: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.fluentbit.resources }} + resources: {{- toYaml . | nindent 6 }} + {{- end }} + fluentd: + image: + repository: {{ template "system_default_registry" . }}{{ .Values.images.fluentd.repository }} + tag: {{ .Values.images.fluentd.tag }} + configReloaderImage: + repository: {{ template "system_default_registry" . }}{{ .Values.images.config_reloader.repository }} + tag: {{ .Values.images.config_reloader.tag }} + {{- with .Values.fluentd.bufferStorageVolume }} + bufferStorageVolume: {{- toYaml . | nindent 6 }} + {{- end }} + disablePvc: {{ .Values.disablePvc }} + {{- if .Values.fluentd.replicas }} + scaling: + replicas: {{ .Values.fluentd.replicas }} + {{- end }} + {{- if .Values.global.cattle.psp.enabled }} + security: + podSecurityPolicyCreate: true + roleBasedAccessControlCreate: true + {{- end }} + {{- with (default .Values.tolerations .Values.fluentd.tolerations) }} + tolerations: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with (default .Values.nodeSelector .Values.fluentd.nodeSelector) }} + nodeSelector: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.fluentd.resources }} + resources: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.fluentd.livenessProbe }} + livenessProbe: {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} + +{{- define "logging-operator.util.merge.logging" -}} +{{/* Top context to expose fields like `.Release` and `.Values` */}} +{{- $top := first . -}} + +{{/* tpl is the template specific to the logging implementation */}} +{{- $tpl := fromYaml (include (index . 1) $top) | default (dict ) -}} + +{{/* Generic is the shared rancher logging setttings from `_generic_logging.yaml` */}} +{{- $generic := fromYaml (include (index . 2) $top) | default (dict ) -}} + +{{/* values are from the values.yaml */}} +{{- $values := $top.Values.loggingOverlay | default (dict ) -}} + +####### {{$generic}} + +{{/* the sources are merge right to left meaning tpl is the highest prcedence and values is the lowest */}} +{{- toYaml (merge $tpl $values $generic) -}} +{{- end -}} + +{{- define "logging-operator.logging" -}} +{{- include "logging-operator.util.merge.logging" (append . "logging-operator.logging.tpl") -}} +{{- end -}} \ No newline at end of file diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/_helpers.tpl b/charts/rancher-logging/102.0.0+up3.17.10/templates/_helpers.tpl new file mode 100644 index 000000000..7f070904c --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/_helpers.tpl @@ -0,0 +1,179 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "logging-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "logging-operator.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Provides the namespace the chart will be installed in using the builtin .Release.Namespace, +or, if provided, a manually overwritten namespace value. +*/}} +{{- define "logging-operator.namespace" -}} +{{- if .Values.namespaceOverride -}} +{{ .Values.namespaceOverride -}} +{{- else -}} +{{ .Release.Namespace }} +{{- end -}} +{{- end -}} + + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "logging-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "logging-operator.labels" -}} +app.kubernetes.io/name: {{ include "logging-operator.name" . }} +helm.sh/chart: {{ include "logging-operator.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{- define "windowsEnabled" }} +{{- if not (kindIs "invalid" .Values.global.cattle.windows) }} +{{- if not (kindIs "invalid" .Values.global.cattle.windows.enabled) }} +{{- if .Values.global.cattle.windows.enabled }} +true +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "windowsPathPrefix" -}} +{{- trimSuffix "/" (default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "\\" "/" | replace "//" "/" | replace "c:" "C:") -}} +{{- end -}} + +{{- define "windowsKubernetesFilter" -}} +{{- printf "kubernetes.%s" ((include "windowsPathPrefix" .) | replace ":" "" | replace "/" ".") -}} +{{- end -}} + +{{- define "windowsInputTailMount" -}} +{{- (include "windowsPathPrefix" .) | replace "C:" "" -}} +{{- end -}} + +{{/* +Set the controlplane selector based on kubernetes distribution +*/}} +{{- define "controlplaneSelector" -}} +{{- $master := or .Values.additionalLoggingSources.rke2.enabled .Values.additionalLoggingSources.k3s.enabled -}} +{{- $defaultSelector := $master | ternary (dict "node-role.kubernetes.io/master" "true") (dict "node-role.kubernetes.io/controlplane" "true") -}} +{{ default $defaultSelector .Values.additionalLoggingSources.kubeAudit.nodeSelector | toYaml }} +{{- end -}} + +{{/* +Set kube-audit file path prefix based on distribution +*/}} +{{- define "kubeAuditPathPrefix" -}} +{{- if .Values.additionalLoggingSources.rke.enabled -}} +{{ default "/var/log/kube-audit" .Values.additionalLoggingSources.kubeAudit.pathPrefix }} +{{- else if .Values.additionalLoggingSources.rke2.enabled -}} +{{ default "/var/lib/rancher/rke2/server/logs" .Values.additionalLoggingSources.kubeAudit.pathPrefix }} +{{- else -}} +{{ required "Directory PathPrefix of the kube-audit location is required" .Values.additionalLoggingSources.kubeAudit.pathPrefix }} +{{- end -}} +{{- end -}} + +{{/* +Set kube-audit file name based on distribution +*/}} +{{- define "kubeAuditFilename" -}} +{{- if .Values.additionalLoggingSources.rke.enabled -}} +{{ default "audit-log.json" .Values.additionalLoggingSources.kubeAudit.auditFilename }} +{{- else if .Values.additionalLoggingSources.rke2.enabled -}} +{{ default "audit.log" .Values.additionalLoggingSources.kubeAudit.auditFilename }} +{{- else -}} +{{ required "Filename of the kube-audit log is required" .Values.additionalLoggingSources.kubeAudit.auditFilename }} +{{- end -}} +{{- end -}} + +{{/* +A shared list of custom parsers for the vairous fluentbit pods rancher creates +*/}} +{{- define "logging-operator.parsers" -}} +[PARSER] + Name klog + Format regex + Regex ^(?[IWEF])(?\d{4} \d{2}:\d{2}:\d{2}).\d{6} +?(?\d+) (?.+):(?\d+)] (?.+) + Time_Key timestamp + Time_Format %m%d %T + +[PARSER] + Name rancher + Format regex + Regex ^time="(?.+)" level=(?.+) msg="(?.+)"$ + Time_Key timestamp + Time_Format %FT%H:%M:%S +[PARSER] + Name etcd + Format json + Time_Key timestamp + Time_Format %FT%H:%M:%S.%L +{{- end -}} + +{{/* +Set kubernetes log options if they are configured +*/}} +{{- define "requireFilterKubernetes" -}} +{{- if or .Values.fluentbit.filterKubernetes.Merge_Log .Values.fluentbit.filterKubernetes.Merge_Log_Key .Values.fluentbit.filterKubernetes.Merge_Trim .Values.fluentbit.filterKubernetes.Merge_Parser -}} +true +{{- end -}} +{{- end -}} + +{{/*Fluent Bit Image Repository */}} +{{- define "logging-operator.fluentbitImageRepository" -}} +{{- if .Values.debug -}} +{{ template "system_default_registry" . }}{{ .Values.images.fluentbit_debug.repository }} +{{- else -}} +{{ template "system_default_registry" . }}{{ .Values.images.fluentbit.repository }} +{{- end -}} +{{- end -}} + +{{/*Fluent Bit Image Tag */}} +{{- define "logging-operator.fluentbitImageTag" -}} +{{- if .Values.debug -}} +{{ .Values.images.fluentbit_debug.tag }} +{{- else -}} +{{ .Values.images.fluentbit.tag }} +{{- end -}} +{{- end -}} + +{{/*Fluent Bit Image */}} +{{- define "logging-operator.fluentbitImage" -}} +{{ template "logging-operator.fluentbitImageRepository" . }}:{{ template "logging-operator.fluentbitImageTag" . }} +{{- end -}} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/clusterrole.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/clusterrole.yaml new file mode 100644 index 000000000..a5d7a85c2 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/clusterrole.yaml @@ -0,0 +1,318 @@ +{{- if .Values.rbac.enabled }} + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: {{ template "logging-operator.fullname" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - endpoints + - namespaces + - nodes + - nodes/proxy + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - watch +- apiGroups: + - "" + resources: + - persistentvolumeclaims + - pods + - serviceaccounts + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + - events.k8s.io + resources: + - events + verbs: + - create + - get + - list + - watch +- apiGroups: + - apps + resources: + - daemonsets + - replicasets + - statefulsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + - extensions + resources: + - daemonsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + - extensions + resources: + - deployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + - extensions + resources: + - statefulsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - batch + resources: + - jobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - '*' +- apiGroups: + - events.k8s.io + resources: + - events + verbs: + - get + - list + - watch +- apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - extensions + - policy + resources: + - podsecuritypolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - use + - watch +- apiGroups: + - logging-extensions.banzaicloud.io + resources: + - eventtailers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - logging-extensions.banzaicloud.io + resources: + - eventtailers/status + verbs: + - get + - patch + - update +- apiGroups: + - logging-extensions.banzaicloud.io + resources: + - hosttailers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - logging-extensions.banzaicloud.io + resources: + - hosttailers/status + verbs: + - get + - patch + - update +- apiGroups: + - logging.banzaicloud.io + resources: + - clusterflows + - clusteroutputs + - flows + - loggings + - outputs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - logging.banzaicloud.io + resources: + - clusterflows/status + - clusteroutputs/status + - flows/status + - loggings/status + - outputs/status + verbs: + - get + - patch + - update +- apiGroups: + - monitoring.coreos.com + resources: + - prometheusrules + - servicemonitors + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - clusterroles + - rolebindings + - roles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/clusterrolebinding.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..89d17d094 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/clusterrolebinding.yaml @@ -0,0 +1,18 @@ +{{- if .Values.rbac.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "logging-operator.fullname" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +subjects: + - kind: ServiceAccount + name: {{ template "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "logging-operator.fullname" . }} + + {{- end }} \ No newline at end of file diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/crds.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/crds.yaml new file mode 100644 index 000000000..f573652d0 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/crds.yaml @@ -0,0 +1,6 @@ +{{- if .Values.createCustomResource -}} +{{- range $path, $bytes := .Files.Glob "crds/*.yaml" }} +{{ $.Files.Get $path }} +--- +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/deployment.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/deployment.yaml new file mode 100644 index 000000000..e1ec64f6d --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/deployment.yaml @@ -0,0 +1,77 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app.kubernetes.io/name: {{ include "logging-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + labels: + app.kubernetes.io/name: {{ include "logging-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- with .Values.podLabels }} + {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}" + args: + {{- range .Values.extraArgs }} + - {{ . }} + {{- end }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + ports: + - name: http + containerPort: {{ .Values.http.port }} + {{- with .Values.env }} + env: {{ toYaml . | nindent 12 }} + {{- end }} + {{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | nindent 12 }} + {{- end }} + {{- with .Values.volumeMounts }} + volumeMounts: {{ toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.volumes }} + volumes: {{ toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.podSecurityContext }} + securityContext: {{ toYaml .Values.podSecurityContext | nindent 8 }} + {{- end }} + + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.rbac.enabled }} + serviceAccountName: {{ include "logging-operator.fullname" . }} + {{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/aks/logging.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/aks/logging.yaml new file mode 100644 index 000000000..54bb73250 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/aks/logging.yaml @@ -0,0 +1,18 @@ +{{- define "logging-operator.logging.aks" -}} +{{- $logPath := "/var/log/azure/kubelet-status.log" -}} +metadata: + name: {{ .Release.Name }}-aks +spec: + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ $logPath }} + destination: {{ $logPath }} + readOnly: true + inputTail: + Tag: "aks" + Path: {{ $logPath }} +{{- end -}} +{{- if .Values.additionalLoggingSources.aks.enabled }} +{{- include "logging-operator.logging" (list . "logging-operator.logging.aks") -}} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/eks/logging.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/eks/logging.yaml new file mode 100644 index 000000000..2ba7860b1 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/eks/logging.yaml @@ -0,0 +1,19 @@ +{{- define "logging-operator.logging.eks" -}} +{{- $logPath := "/var/log/messages" -}} +metadata: + name: {{ .Release.Name }}-eks +spec: + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ $logPath }} + destination: {{ $logPath }} + readOnly: true + inputTail: + Tag: "eks" + Path: {{ $logPath }} + Parser: "syslog" +{{- end -}} +{{- if .Values.additionalLoggingSources.eks.enabled }} +{{- include "logging-operator.logging" (list . "logging-operator.logging.eks") -}} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/gke/logging.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/gke/logging.yaml new file mode 100644 index 000000000..6c834b12e --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/gke/logging.yaml @@ -0,0 +1,18 @@ +{{- define "logging-operator.logging.gke" -}} +{{- $logPath := "/var/log/kube-proxy.log" -}} +metadata: + name: {{ .Release.Name }}-gke +spec: + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ $logPath }} + destination: {{ $logPath }} + readOnly: true + inputTail: + Tag: "gke" + Path: {{ $logPath }} +{{- end -}} +{{- if .Values.additionalLoggingSources.gke.enabled }} +{{- include "logging-operator.logging" (list . "logging-operator.logging.gke") -}} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/configmap.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/configmap.yaml new file mode 100644 index 000000000..aa454c8ad --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/configmap.yaml @@ -0,0 +1,57 @@ +{{- if and .Values.additionalLoggingSources.k3s.enabled (eq .Values.additionalLoggingSources.k3s.container_engine "systemd") }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Release.Name }}-k3s + labels: +{{ include "logging-operator.labels" . | indent 4 }} +data: + fluent-bit.conf: | + [SERVICE] + Flush 1 + Grace 5 + Daemon Off + Log_Level info + Coro_Stack_Size 24576 + Parsers_File parsers.conf + + [INPUT] + Name systemd + Tag k3s + Path {{ .Values.systemdLogPath }} + Systemd_Filter _SYSTEMD_UNIT=k3s.service + {{- if .Values.additionalLoggingSources.k3s.stripUnderscores }} + Strip_Underscores On + {{- end }} + Systemd_Filter _SYSTEMD_UNIT=k3s-agent.service + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser klog + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser rancher + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser etcd + Reserve_Data On + + [OUTPUT] + Name forward + Match * + Host {{ .Release.Name }}-root-fluentd.{{ .Release.Namespace }}.svc + Port 24240 + Retry_Limit False + parsers.conf: | +{{ include "logging-operator.parsers" . | indent 4 }} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/daemonset.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/daemonset.yaml new file mode 100644 index 000000000..e80c2b1c8 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/daemonset.yaml @@ -0,0 +1,110 @@ +{{- if and .Values.additionalLoggingSources.k3s.enabled (eq .Values.additionalLoggingSources.k3s.container_engine "systemd") }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + selector: + matchLabels: + name: {{ .Release.Name }}-k3s-journald-aggregator + template: + metadata: + annotations: + checksum/config: {{ include (print $.Template.BasePath "/loggings/k3s/configmap.yaml") . | sha256sum }} + name: "{{ .Release.Name }}-k3s-journald-aggregator" + namespace: "{{ .Release.Namespace }}" + labels: + name: {{ .Release.Name }}-k3s-journald-aggregator + spec: + containers: + - name: fluentbit + image: "{{ template "logging-operator.fluentbitImage" . }}" + {{- if .Values.global.seLinux.enabled }} + securityContext: + seLinuxOptions: + type: rke_logreader_t + {{- end }} + volumeMounts: + - mountPath: /fluent-bit/etc/ + name: config + - mountPath: {{ .Values.systemdLogPath | default "/var/log/journal" }} + name: journal + readOnly: true + - mountPath: /etc/machine-id + name: machine-id + readOnly: true + {{- with .Values.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: "{{ .Release.Name }}-k3s-journald-aggregator" + volumes: + - name: config + configMap: + name: "{{ .Release.Name }}-k3s" + - name: journal + hostPath: + path: {{ .Values.systemdLogPath | default "/var/log/journal" }} + - name: machine-id + hostPath: + path: /etc/machine-id +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +{{- if .Values.global.cattle.psp.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" +rules: + - apiGroups: + - policy + resourceNames: + - "{{ .Release.Name }}-k3s-journald-aggregator" + resources: + - podsecuritypolicies + verbs: + - use +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ .Release.Name }}-k3s-journald-aggregator" +subjects: + - kind: ServiceAccount + name: "{{ .Release.Name }}-k3s-journald-aggregator" +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + allowPrivilegeEscalation: false + fsGroup: + rule: RunAsAny + readOnlyRootFilesystem: true + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - configMap + - emptyDir + - secret + - hostPath +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/logging-k3s-openrc.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/logging-k3s-openrc.yaml new file mode 100644 index 000000000..963cf3ac4 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/k3s/logging-k3s-openrc.yaml @@ -0,0 +1,19 @@ +{{- define "logging-operator.logging.k3s-openrc" -}} +{{- $logPath := "/var/log/k3s.log" -}} +metadata: + name: {{ .Release.Name }}-k3s +spec: + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ $logPath }} + destination: {{ $logPath }} + readOnly: true + inputTail: + Tag: "k3s" + Path: {{ $logPath }} + Path_Key: filename +{{- end -}} +{{- if and .Values.additionalLoggingSources.k3s.enabled (eq .Values.additionalLoggingSources.k3s.container_engine "openrc")}} +{{- include "logging-operator.logging" (list . "logging-operator.logging.k3s-openrc") -}} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/kube-audit/logging.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/kube-audit/logging.yaml new file mode 100644 index 000000000..3edf96b79 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/kube-audit/logging.yaml @@ -0,0 +1,24 @@ +{{- define "logging-operator.logging.kube-audit" -}} +metadata: + name: {{ .Release.Name }}-kube-audit +spec: + {{- if .Values.additionalLoggingSources.kubeAudit.loggingRef }} + loggingRef: {{ .Values.additionalLoggingSources.kubeAudit.loggingRef }} + {{- end }} + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ template "kubeAuditPathPrefix" . }} + destination: "/kube-audit-logs" + readOnly: true + inputTail: + Tag: {{ .Values.additionalLoggingSources.kubeAudit.fluentbit.logTag }} + Path: /kube-audit-logs/{{ template "kubeAuditFilename" . }} + Parser: json + {{- with (concat (.Values.tolerations) (.Values.fluentbit.tolerations) (.Values.additionalLoggingSources.kubeAudit.fluentbit.tolerations)) }} + tolerations: {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} +{{- if .Values.additionalLoggingSources.kubeAudit.enabled }} +{{- include "logging-operator.logging" (list . "logging-operator.logging.kube-audit") -}} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke/configmap.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke/configmap.yaml new file mode 100644 index 000000000..252572a4e --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke/configmap.yaml @@ -0,0 +1,29 @@ +{{- if .Values.additionalLoggingSources.rke.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Release.Name }}-rke + labels: +{{ include "logging-operator.labels" . | indent 4 }} +data: + fluent-bit.conf: | + [SERVICE] + Log_Level {{ .Values.additionalLoggingSources.rke.fluentbit.log_level }} + Parsers_File parsers.conf + + [INPUT] + Tag rke + Name tail + Path_Key filename + Parser docker + DB /tail-db/tail-containers-state.db + Mem_Buf_Limit {{ .Values.additionalLoggingSources.rke.fluentbit.mem_buffer_limit }} + Path /var/lib/rancher/rke/log/*.log + + [OUTPUT] + Name forward + Match * + Host {{ .Release.Name }}-root-fluentd.{{ .Release.Namespace }}.svc + Port 24240 + Retry_Limit False +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke/daemonset.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke/daemonset.yaml new file mode 100644 index 000000000..cc39a5cc4 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke/daemonset.yaml @@ -0,0 +1,122 @@ +{{- if .Values.additionalLoggingSources.rke.enabled }} +{{- $containers := printf "%s/containers/" (default "/var/lib/docker" .Values.global.dockerRootDirectory) }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: "{{ .Release.Name }}-rke-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + selector: + matchLabels: + name: {{ .Release.Name }}-rke-aggregator + template: + metadata: + name: "{{ .Release.Name }}-rke-aggregator" + namespace: "{{ .Release.Namespace }}" + labels: + name: {{ .Release.Name }}-rke-aggregator + spec: + containers: + - name: fluentbit + image: "{{ template "logging-operator.fluentbitImage" . }}" + volumeMounts: + - mountPath: /var/lib/rancher/rke/log/ + name: indir + - mountPath: {{ $containers }} + name: containers + - mountPath: /tail-db + name: positiondb + - mountPath: /fluent-bit/etc/fluent-bit.conf + name: config + subPath: fluent-bit.conf + {{- if .Values.global.seLinux.enabled }} + securityContext: + seLinuxOptions: + type: rke_logreader_t + {{- end }} + volumes: + - name: indir + hostPath: + path: /var/lib/rancher/rke/log/ + type: DirectoryOrCreate + - name: containers + hostPath: + path: {{ $containers }} + type: DirectoryOrCreate + - name: positiondb + emptyDir: {} + - name: config + configMap: + name: "{{ .Release.Name }}-rke" + serviceAccountName: "{{ .Release.Name }}-rke-aggregator" + {{- $total_tolerations := concat (.Values.tolerations) (.Values.fluentbit.tolerations) }} + {{- with $total_tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "{{ .Release.Name }}-rke-aggregator" + namespace: "{{ .Release.Namespace }}" +{{- if .Values.global.cattle.psp.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: "{{ .Release.Name }}-rke-aggregator" +rules: + - apiGroups: + - policy + resourceNames: + - "{{ .Release.Name }}-rke-aggregator" + resources: + - podsecuritypolicies + verbs: + - use +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ .Release.Name }}-rke-aggregator" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ .Release.Name }}-rke-aggregator" +subjects: + - kind: ServiceAccount + name: "{{ .Release.Name }}-rke-aggregator" +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: "{{ .Release.Name }}-rke-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + allowPrivilegeEscalation: false + allowedHostPaths: + - pathPrefix: {{ $containers }} + readOnly: false + - pathPrefix: /var/lib/rancher/rke/log/ + readOnly: false + - pathPrefix: /var/lib/rancher/logging/ + readOnly: false + fsGroup: + rule: RunAsAny + readOnlyRootFilesystem: true + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - configMap + - emptyDir + - secret + - hostPath +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke2/configmap.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke2/configmap.yaml new file mode 100644 index 000000000..3ca20be22 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke2/configmap.yaml @@ -0,0 +1,69 @@ +{{- if .Values.additionalLoggingSources.rke2.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Release.Name }}-rke2 + labels: +{{ include "logging-operator.labels" . | indent 4 }} +data: + fluent-bit.conf: | + [SERVICE] + Flush 1 + Grace 5 + Daemon Off + Log_Level info + Coro_Stack_Size 24576 + Parsers_File parsers.conf + + [INPUT] + Name systemd + Tag rke2 + Path {{ .Values.systemdLogPath }} + Systemd_Filter _SYSTEMD_UNIT=rke2-server.service + Systemd_Filter _SYSTEMD_UNIT=rke2-agent.service + {{- if .Values.additionalLoggingSources.rke2.stripUnderscores }} + Strip_Underscores On + {{- end }} + + [INPUT] + Name tail + Tag rke2 + Path /var/lib/rancher/rke2/agent/logs/kubelet.log + + [FILTER] + Name parser + Match * + Key_Name log + Parser klog + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser klog + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser rancher + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser etcd + Reserve_Data On + + [OUTPUT] + Name forward + Match * + Host {{ .Release.Name }}-root-fluentd.{{ .Release.Namespace }}.svc + Port 24240 + Retry_Limit False + parsers.conf: | +{{ include "logging-operator.parsers" . | indent 4 }} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke2/daemonset.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke2/daemonset.yaml new file mode 100644 index 000000000..ddc30f889 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/rke2/daemonset.yaml @@ -0,0 +1,116 @@ +{{- if .Values.additionalLoggingSources.rke2.enabled }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + selector: + matchLabels: + name: {{ .Release.Name }}-rke2-journald-aggregator + template: + metadata: + annotations: + checksum/config: {{ include (print $.Template.BasePath "/loggings/rke2/configmap.yaml") . | sha256sum }} + name: "{{ .Release.Name }}-rke2-journald-aggregator" + namespace: "{{ .Release.Namespace }}" + labels: + name: {{ .Release.Name }}-rke2-journald-aggregator + spec: + containers: + - name: fluentbit + image: "{{ template "logging-operator.fluentbitImage" . }}" + {{- if .Values.global.seLinux.enabled }} + securityContext: + seLinuxOptions: + type: rke_logreader_t + {{- end }} + volumeMounts: + - mountPath: /fluent-bit/etc/ + name: config + - mountPath: {{ .Values.systemdLogPath | default "/var/log/journal" }} + name: journal + readOnly: true + - mountPath: "/var/lib/rancher/rke2/agent/logs/kubelet.log" + name: kubelet + readOnly: true + - mountPath: /etc/machine-id + name: machine-id + readOnly: true + {{- with .Values.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: "{{ .Release.Name }}-rke2-journald-aggregator" + volumes: + - name: config + configMap: + name: "{{ .Release.Name }}-rke2" + - name: journal + hostPath: + path: {{ .Values.systemdLogPath | default "/var/log/journal" }} + - name: kubelet + hostPath: + path: "/var/lib/rancher/rke2/agent/logs/kubelet.log" + - name: machine-id + hostPath: + path: /etc/machine-id +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +{{- if .Values.global.cattle.psp.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" +rules: + - apiGroups: + - policy + resourceNames: + - "{{ .Release.Name }}-rke2-journald-aggregator" + resources: + - podsecuritypolicies + verbs: + - use +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ .Release.Name }}-rke2-journald-aggregator" +subjects: + - kind: ServiceAccount + name: "{{ .Release.Name }}-rke2-journald-aggregator" +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + allowPrivilegeEscalation: false + fsGroup: + rule: RunAsAny + readOnlyRootFilesystem: true + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - configMap + - emptyDir + - secret + - hostPath +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/root/logging.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/root/logging.yaml new file mode 100644 index 000000000..d88159106 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/loggings/root/logging.yaml @@ -0,0 +1,82 @@ +{{- define "logging-operator.logging.root" -}} +{{- $containerLogPath := printf "%s/containers/" (default "/var/lib/docker" .Values.global.dockerRootDirectory) }} +metadata: + name: "{{ .Release.Name }}-root" +spec: + {{- if (include "windowsEnabled" .) }} + nodeAgents: + - name: win-agent + profile: windows + nodeAgentFluentbit: + daemonSet: + spec: + template: + spec: + containers: + - image: {{ template "system_default_registry" . }}{{ .Values.images.nodeagent_fluentbit.repository }}:{{ .Values.images.nodeagent_fluentbit.tag }} + name: fluent-bit + tls: + enabled: {{ .Values.nodeAgents.tls.enabled | default false }} + {{- if .Values.additionalLoggingSources.rke.enabled }} + - name: win-agent-rke + profile: windows + nodeAgentFluentbit: + filterKubernetes: + Kube_Tag_Prefix: "{{ template "windowsKubernetesFilter" . }}.var.lib.rancher.rke.log." + inputTail: + Path: "{{ template "windowsPathPrefix" . }}/var/lib/rancher/rke/log" + {{- if .Values.fluentbit.inputTail.Buffer_Chunk_Size }} + Buffer_Chunk_Size: {{ .Values.fluentbit.inputTail.Buffer_Chunk_Size | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Buffer_Max_Size }} + Buffer_Max_Size: {{ .Values.fluentbit.inputTail.Buffer_Max_Size | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Mem_Buf_Limit }} + Mem_Buf_Limit: {{ .Values.fluentbit.inputTail.Mem_Buf_Limit | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Multiline_Flush }} + Multiline_Flush: {{ .Values.fluentbit.inputTail.Multiline_Flush | toString | quote }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Skip_Long_Lines }} + Skip_Long_Lines: {{ .Values.fluentbit.inputTail.Skip_Long_Lines | toString | quote }} + {{- end }} + extraVolumeMounts: + - source: "{{ template "windowsInputTailMount" . }}/var/lib/rancher/rke/log" + destination: "{{ template "windowsInputTailMount" . }}/var/lib/rancher/rke/log" + readOnly: true + daemonSet: + spec: + template: + spec: + containers: + - image: "{{ template "system_default_registry" . }}{{ .Values.images.nodeagent_fluentbit.repository }}:{{ .Values.images.nodeagent_fluentbit.tag }}" + name: fluent-bit + tls: + enabled: {{ .Values.nodeAgents.tls.enabled | default false }} + {{- end }} + {{- end }} + fluentbit: + {{- if .Values.global.dockerRootDirectory }} + mountPath: {{ $containerLogPath }} + extraVolumeMounts: + - source: {{ $containerLogPath }} + destination: {{ $containerLogPath }} + readOnly: true + {{- end }} + {{- if (include "requireFilterKubernetes" .) }} + filterKubernetes: + {{- if .Values.fluentbit.filterKubernetes.Merge_Log }} + Merge_Log: "{{ .Values.fluentbit.filterKubernetes.Merge_Log }}" + {{- end }} + {{- if .Values.fluentbit.filterKubernetes.Merge_Log_Key }} + Merge_Log_Key: "{{ .Values.fluentbit.filterKubernetes.Merge_Log_Key }}" + {{- end }} + {{- if .Values.fluentbit.filterKubernetes.Merge_Log_Trim }} + Merge_Log_Trim: "{{ .Values.fluentbit.filterKubernetes.Merge_Log_Trim }}" + {{- end }} + {{- if .Values.fluentbit.filterKubernetes.Merge_Parser }} + Merge_Parser: "{{ .Values.fluentbit.filterKubernetes.Merge_Parser }}" + {{- end }} + {{- end }} +{{- end -}} +{{- include "logging-operator.logging" (list . "logging-operator.logging.root") -}} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/psp.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/psp.yaml new file mode 100644 index 000000000..e80bbc0dc --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/psp.yaml @@ -0,0 +1,34 @@ +{{ if and .Values.global.cattle.psp.enabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: psp.logging-operator + namespace: {{ include "logging-operator.namespace" . }} + annotations: +{{- if .Values.rbac.psp.annotations }} +{{ toYaml .Values.rbac.psp.annotations | indent 4 }} +{{- end }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +spec: + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + runAsUser: + rule: MustRunAsNonRoot + fsGroup: + rule: MustRunAs + ranges: + - min: 1 + max: 65535 + supplementalGroups: + rule: MustRunAs + ranges: + - min: 1 + max: 65535 + seLinux: + rule: RunAsAny + volumes: + - secret + - configMap +{{ end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/service.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/service.yaml new file mode 100644 index 000000000..f419ae2c4 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/service.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +spec: + type: ClusterIP + {{- with .Values.http.service.clusterIP }} + clusterIP: {{ . }} + {{- end }} + ports: + - port: {{ .Values.http.port }} + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: {{ include "logging-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/serviceMonitor.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/serviceMonitor.yaml new file mode 100644 index 000000000..1bb762cde --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/serviceMonitor.yaml @@ -0,0 +1,30 @@ +{{ if .Values.monitoring.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +{{- with .Values.monitoring.serviceMonitor.additionalLabels }} + {{- toYaml . | nindent 4 }} +{{- end }} +spec: + selector: + matchLabels: +{{ include "logging-operator.labels" . | indent 6 }} + endpoints: + - port: http + path: /metrics + {{- with .Values.monitoring.serviceMonitor.metricsRelabelings }} + metricRelabelings: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.monitoring.serviceMonitor.relabelings }} + relabelings: + {{- toYaml . | nindent 4 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "logging-operator.namespace" . }} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/serviceaccount.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/serviceaccount.yaml new file mode 100644 index 000000000..bb97cf108 --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/serviceaccount.yaml @@ -0,0 +1,14 @@ +{{- if .Values.rbac.enabled }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +{{- with .Values.serviceAccount.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/userroles.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/userroles.yaml new file mode 100644 index 000000000..f4136b09a --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/userroles.yaml @@ -0,0 +1,35 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: "logging-admin" + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - "logging.banzaicloud.io" + resources: + - flows + - outputs + verbs: + - "*" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: "logging-view" + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-view: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" +rules: + - apiGroups: + - "logging.banzaicloud.io" + resources: + - flows + - outputs + - clusterflows + - clusteroutputs + verbs: + - get + - list + - watch diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-install-crd.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-install-crd.yaml new file mode 100644 index 000000000..77fc8047c --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-install-crd.yaml @@ -0,0 +1,20 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "logging-extensions.banzaicloud.io/v1alpha1/EventTailer" false -}} +# {{- set $found "logging-extensions.banzaicloud.io/v1alpha1/HostTailer" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/ClusterFlow" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/ClusterOutput" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/Flow" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/Logging" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/Output" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-install.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-install.yaml new file mode 100644 index 000000000..bd624cc4b --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-install.yaml @@ -0,0 +1,5 @@ +#{{- if .Values.global.dockerRootDirectory }} +#{{- if or (hasSuffix "/containers" .Values.global.dockerRootDirectory) (hasSuffix "/" .Values.global.dockerRootDirectory) }} +#{{- required "global.dockerRootDirectory must not end with suffix: '/' or '/containers'" "" -}} +#{{- end }} +#{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-psp-install.yaml b/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-psp-install.yaml new file mode 100644 index 000000000..a30c59d3b --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/templates/validate-psp-install.yaml @@ -0,0 +1,7 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +#{{- if .Values.global.cattle.psp.enabled }} +#{{- if not (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }} +#{{- fail "The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding." -}} +#{{- end }} +#{{- end }} +#{{- end }} diff --git a/charts/rancher-logging/102.0.0+up3.17.10/values.yaml b/charts/rancher-logging/102.0.0+up3.17.10/values.yaml new file mode 100644 index 000000000..8a607f91f --- /dev/null +++ b/charts/rancher-logging/102.0.0+up3.17.10/values.yaml @@ -0,0 +1,240 @@ +# Default values for logging-operator. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: rancher/mirrored-banzaicloud-logging-operator + tag: 3.17.10 + pullPolicy: IfNotPresent + +env: [] +volumes: [] +volumeMounts: [] + +extraArgs: + - -enable-leader-election=true +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" +namespaceOverride: "" + +## Pod custom labels +## +podLabels: {} + +annotations: {} + +## Deploy CRDs used by Logging Operator. +## +createCustomResource: false + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +nodeSelector: + kubernetes.io/os: linux + +tolerations: + - key: cattle.io/os + operator: "Equal" + value: "linux" + effect: NoSchedule + +affinity: {} + +http: + # http listen port number + port: 8080 + # Service definition for query http service + service: + type: ClusterIP + clusterIP: None + # Annotations to query http service + annotations: {} + # Labels to query http service + labels: {} + +rbac: + enabled: true + psp: + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' + ## Specify pod annotations + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl + + + +## SecurityContext holds pod-level security attributes and common container settings. +## This defaults to non-root user with uid 1000 and gid 2000. *v1.PodSecurityContext false +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +podSecurityContext: {} +# runAsNonRoot: true +# runAsUser: 1000 +# fsGroup: 2000 +securityContext: {} +# allowPrivilegeEscalation: false +# readOnlyRootFilesystem: true + # capabilities: + # drop: ["ALL"] + +## Operator priorityClassName +## +priorityClassName: {} + +monitoring: + # Create a Prometheus Operator ServiceMonitor object + serviceMonitor: + enabled: false + additionalLabels: {} + metricRelabelings: [] + relabelings: [] + +serviceAccount: + annotations: {} + +################################### +# Rancher Logging Operator Values # +################################### + +# Enable debug to use fluent-bit images that allow exec +debug: false + +# Disable persistent volumes for buffers +disablePvc: true + +# If your additional logging sources collect logs from systemd configure the systemd log path here +systemdLogPath: "/run/log/journal" + +global: + cattle: + systemDefaultRegistry: "" + # Uncomment the below two lines to either enable or disable Windows logging. If this chart is + # installed via the Rancher UI, it will set this value to "true" if the cluster is a Windows + # cluster. In that scenario, if you would like to disable Windows logging on Windows clusters, + # set the value below to "false". + # windows: + # enabled: true + psp: + enabled: false + + # Change the "dockerRootDirectory" if the default Docker directory has changed. + dockerRootDirectory: "" + + rkeWindowsPathPrefix: "c:\\" + + seLinux: + enabled: false + +images: + config_reloader: + repository: rancher/mirrored-jimmidyson-configmap-reload + tag: v0.4.0 + fluentbit: + repository: rancher/mirrored-fluent-fluent-bit + tag: 1.9.5 + nodeagent_fluentbit: + os: "windows" + repository: rancher/fluent-bit + tag: 1.8.9 + fluentbit_debug: + repository: rancher/mirrored-fluent-fluent-bit + tag: 1.9.5-debug + fluentd: + repository: rancher/mirrored-banzaicloud-fluentd + tag: v1.14.6-alpine-5 + +additionalLoggingSources: + rke: + enabled: false + fluentbit: + log_level: "info" + mem_buffer_limit: "5MB" + rke2: + enabled: false + stripUnderscores: false + k3s: + enabled: false + container_engine: "systemd" + stripUnderscores: false + aks: + enabled: false + eks: + enabled: false + gke: + enabled: false + kubeAudit: + auditFilename: "" + enabled: false + pathPrefix: "" + fluentbit: + logTag: kube-audit + tolerations: + - key: node-role.kubernetes.io/controlplane + value: "true" + effect: NoSchedule + - key: node-role.kubernetes.io/etcd + value: "true" + effect: NoExecute + +# configures node agent options for windows node agents +nodeAgents: + tls: + enabled: false + +# These settings apply to every Logging CR, including vendor Logging CRs enabled in "additionalLoggingSources". +# Changing these affects every Logging CR installed. +fluentd: + bufferStorageVolume: {} + livenessProbe: + tcpSocket: + port: 24240 + initialDelaySeconds: 30 + periodSeconds: 15 + nodeSelector: {} + resources: {} + tolerations: {} +fluentbit: + inputTail: + Buffer_Chunk_Size: "" + Buffer_Max_Size: "" + Mem_Buf_Limit: "" + Multiline_Flush: "" + Skip_Long_Lines: "" + resources: {} + tolerations: + - key: node-role.kubernetes.io/controlplane + value: "true" + effect: NoSchedule + - key: node-role.kubernetes.io/etcd + value: "true" + effect: NoExecute + filterKubernetes: + Merge_Log: "" + Merge_Log_Key: "" + Merge_Log_Trim: "" + Merge_Parser: "" + +# DO NOT SET THIS UNLESS YOU KNOW WHAT YOU ARE DOING. +# Setting fields on this object can break rancher logging or cause unexpected behavior. It is intended to be used if you +# need to configure functionality not exposed by rancher logging. It is highly recommended you check the `app-readme.md` +# for the functionality you need before modifying this object. + +# this object will be merged with every logging CR created by this chart. Any fields that collide with fields from the +# settings above will be overridden. Any fields that collide with fields set in the files in `templates/loggings` will +# be ignored. +loggingOverlay: {} diff --git a/index.yaml b/index.yaml index 30674a55d..d51f04b4b 100755 --- a/index.yaml +++ b/index.yaml @@ -7863,6 +7863,35 @@ entries: - assets/rancher-kube-state-metrics/rancher-kube-state-metrics-2.13.101.tgz version: 2.13.101 rancher-logging: + - annotations: + catalog.cattle.io/auto-install: rancher-logging-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/deploys-on-os: windows + catalog.cattle.io/display-name: Logging + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.26.0-0' + catalog.cattle.io/namespace: cattle-logging-system + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: logging.banzaicloud.io.clusterflow/v1beta1 + catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0' + catalog.cattle.io/release-name: rancher-logging + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: logging + catalog.cattle.io/upstream-version: 3.17.10 + apiVersion: v1 + appVersion: 3.17.10 + created: "2023-01-27T18:03:33.314633-05:00" + description: Collects and filter logs using highly configurable CRDs. Powered + by Banzai Cloud Logging Operator. + digest: 7fdbd512c1e823a31db096e46e0941c6aaec339530c078d9cd9b622c55ef5173 + icon: https://charts.rancher.io/assets/logos/logging.svg + keywords: + - logging + - monitoring + - security + name: rancher-logging + urls: + - assets/rancher-logging/rancher-logging-102.0.0+up3.17.10.tgz + version: 102.0.0+up3.17.10 - annotations: catalog.cattle.io/auto-install: rancher-logging-crd=match catalog.cattle.io/certified: rancher @@ -8267,6 +8296,20 @@ entries: - assets/rancher-logging/rancher-logging-3.6.000.tgz version: 3.6.000 rancher-logging-crd: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-logging-system + catalog.cattle.io/release-name: rancher-logging-crd + apiVersion: v1 + created: "2023-01-26T18:53:05.800802-05:00" + description: Installs the CRDs for rancher-logging. + digest: f9ec5b88d447f96cf50107f676493296ac2d466030616fb70021971260181d42 + name: rancher-logging-crd + type: application + urls: + - assets/rancher-logging-crd/rancher-logging-crd-102.0.0+up3.17.10.tgz + version: 102.0.0+up3.17.10 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true"