From 9801ce7e67acca213e3b0dd3fed5a0d39cc8df56 Mon Sep 17 00:00:00 2001 From: Alexandre Lamarre Date: Mon, 25 Mar 2024 19:58:56 +0100 Subject: [PATCH] [dev-v2.9] Forward-port 2.8.1 chart rancher-monitoring-crd (#3694) Signed-off-by: Alexandre Lamarre --- ...ncher-monitoring-crd-103.0.3+up45.31.1.tgz | Bin 0 -> 407204 bytes .../103.0.3+up45.31.1/Chart.yaml | 10 + .../103.0.3+up45.31.1/README.md | 24 + .../crd-manifest/crd-alertmanagerconfigs.yaml | 4481 ++++++++ .../crd-manifest/crd-alertmanagers.yaml | 7112 +++++++++++++ .../crd-manifest/crd-podmonitors.yaml | 666 ++ .../crd-manifest/crd-probes.yaml | 705 ++ .../crd-manifest/crd-prometheuses.yaml | 9177 +++++++++++++++++ .../crd-manifest/crd-prometheusrules.yaml | 120 + .../crd-manifest/crd-servicemonitors.yaml | 696 ++ .../crd-manifest/crd-thanosrulers.yaml | 6675 ++++++++++++ .../103.0.3+up45.31.1/files/crd-manifest.tgz | Bin 0 -> 201592 bytes .../103.0.3+up45.31.1/templates/_helpers.tpl | 50 + .../103.0.3+up45.31.1/templates/jobs.yaml | 152 + .../103.0.3+up45.31.1/templates/manifest.yaml | 8 + .../103.0.3+up45.31.1/templates/rbac.yaml | 76 + .../templates/validate-psp-install.yaml | 7 + .../103.0.3+up45.31.1/values.yaml | 17 + index.yaml | 14 + release.yaml | 1 + 20 files changed, 29991 insertions(+) create mode 100644 assets/rancher-monitoring-crd/rancher-monitoring-crd-103.0.3+up45.31.1.tgz create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/Chart.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/README.md create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-alertmanagerconfigs.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-alertmanagers.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-podmonitors.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-probes.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-prometheuses.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-prometheusrules.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-servicemonitors.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-thanosrulers.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/files/crd-manifest.tgz create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/templates/_helpers.tpl create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/templates/jobs.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/templates/manifest.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/templates/rbac.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/templates/validate-psp-install.yaml create mode 100644 charts/rancher-monitoring-crd/103.0.3+up45.31.1/values.yaml diff --git a/assets/rancher-monitoring-crd/rancher-monitoring-crd-103.0.3+up45.31.1.tgz b/assets/rancher-monitoring-crd/rancher-monitoring-crd-103.0.3+up45.31.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..4fd954a112ca0621d2e81f9ae3de856cb3d062da GIT binary patch literal 407204 zcmb5VV|Zji*Dl;KXJXs7ZQIF26Wg|J+qNdQZQGb&V(ZJy^IYF~-+$-ykLq1_@4k0+ zt*To0TGfRY0f`Lw`}(8+Q0a*)(i@1&uu8jeu;??X(i zbW>Ka;So2ov;v%Wy18Jn)w6T@oGI;;9NzWa1ATOj81 z0m8Y}*A79D0v*AJ-Tm0E%H<*lU>ZVEO=NOw3y=>)k$tkn)+<6}EPf*=6r80Xxu&qU zC~92I9AeNbF;xr8Ja1yvV<%zkN8k{77=Ou6kSY^jd&$Iy>Wz=QyCp%Of^mj0xq~1i zK0HUJk#*K5BobgU`rtKD+$D|^pM-L^e^$lY}7{g%^-agDDbEB36cCU!G4O^7e-9^HCDKAPJ^ToI?ac&bRC-F%O0jA4!eV zV_&BjiWVV`EB$J3ZxB-AW?}~&ZCT(^PtJG|pOT0_$1lA4`o+=1Wcvx-=jZge2~_d1 z;&yi7-p@`ZV%LF?!|1bTIe#XDzXwLY>rPG0PCLXK3Xjx{u^NGayngl;K*VHxy)m0iaHmKn`VT5UNxL&8e>C2~(qttHWoQ3Lc^^W~ z=-x{2&qrE5u6EmJp0kQo1i=1Y(KU!Bkw6pX-Zd*ud->y&87bF=j&qrRjg+|yB~zL& z9Nj%mHejZ^?<0T6i^+|YfAvI~1K%5J{7}qP;%rN;5k_2WWK-~<;bZ^&Oa4!#;L=G3 zs)jHnw?t`XLdz`O5Xu^wq3Bju4`q76=I5$Ul-MUP*83;l`|tawlD%6zxR1MMT1>na zu{iwCu`+yywHnlV)DTRZrCT8bnM5~37c>-PG;QM9%z{m*G=(AZj66;0i__ObG-lE6 zk5faVsFQ2gj@QHQy&nAU(QK$c`Z*U35cn59sv^hTyzM=42t??K0Qp*X*jxp zh1Suyo~=j@qFs(iB)8;*in6!F8cTJ{BbVx#-7IR4Ap*~za=dQ3T)Da*IozI4t}36O zw`e~_v5za`v82V$& z$MkcoA+3kO&Ic-+7zul`l8+}`LJ%3lh&ylA{t;PbBoT&@u{&)_e(HPN^L#A;F=6GM zXONlTI(kC9@Hb^sSWz9XIwm-Tw2&9OdkARWUeys30t{wc1Nk0@5*^o8qJFT+kbyx? zn7zQ_4U|cEhsq+C$kfz<)D$g;niE#V+l7b300pPBuA*qtkRJt6zUa%yy*eVx80ai< zyuy?p$%g&05uxr6_qKuDJ_Ln9{z-i~7HOWL zyq_3Z-a#`TPgv>j93NtRWFse(?)4{$;!bzNe3-%Q9y7!ngs)msuk$sLJKJoZuO0j% ziC$3dA;tbBpF#5nfD6GP`gpk&F(y#=$r>ErD?YGYr=j45hqu}0**J~mpz zTW8jR%>?#mn@eqk_e)tZ^a8=W^if5pt}~1OrqbQGHC4QJ^LL+jr^|5`?C3oo8~!?n z)zRf)zNp5z>^*P$04QGJ_CYRZx!E(_^VFRD&B4(>1ZymCLybd}2^oeGN@i3fHW zj5hGyLXq{U^g*&8^=*|_Y#G|R@9pxdV`2rkO~$KDsxb#-13jwAg9+m$_44Ud;x_t} zci4CcC^#a7)*sxx@!TK4QTmTuCQ6)K<+mMm>F*xgZf{`jA;_qvcMsbz%iKEZ)bWxz}!Zozzm~!d0SVb%f`XLdMEFj&BPv57WEVuxH*Xt zbB9T}{J3A9x^UPI)IoP}n|W{zurpP^B9V{a*Q& zYMzOvJ}Gy`Wm@8@m_c8@175SjmP*=6Zd=*XIM#bCBIcH2Xc#r&x z?R;PZeJuF6Ghi!tdLrha4XGw(&z+0U|Dq#BX^U&s`ABD{vWveBHt6Q}tm&@?FsVsQ zUc5C$q(b-WVdL;c$XD%jeg8sF0a2wfTftA6fs(@34G@ZhJeJFM#k|=UAC{!G4*E5( zj2CRu?Jji^OL+y+?yQcp`B@ykXJV(jlD12{jA&~z&?r&IA!ZX3t*BydlWR5iH8scE zZBH{l%KLV;B5#Y3S26H_W4^;b+i$R@A zrB>2-?fLx6q(AN+)5#VV$~VhCT1Z2kXStZatf`0K9)fMa@MFS;C-)H+{INTA=R|h; zOFd=3J zy@bD*44wN#zm@W-g+AModsnbdn;4=cM@b8<3Rk{!pKfD%@HU4x>575r-)7DeP8W@) z{#Ns7FM%nCd1ThU#AC=JV!o(`%v#}7LS1a>9Fj1OWG_+NX2oF4!~6&TSJzcAMSLsA zCu772ug{|GoU7BASZdXGXO2RuOBk#vtJY)5#Po^Sd#%fO?Fq4n1So};lP$2AnhnXO zp*fq){yu^fsJ2|Fw8elyyZEd1h`kUK#=eK0VsnOL#ZKbWINSa4y`1pg?reAG7(+$)F6nfBPC>2y0T_Z(|laJ@ksgtKe3X-c7 zoD@|#$lW|5UxL;B$rK{5?3agy)CqLPOT2?oBGW!^S#Z8yOVo^xS>^@Gwm2eG{=;eI zX)~%fp#LQY%6u?9k}(YhNX_qMC-(jE$@TDKI{+f4%lE1KOB{04(JPtq5x`!MWo{o} ztX(K!InP?l;9llyzi;;fakARg<^+kSPoDy9*+cD%{OqdB_s`AQpV99=&*$gABTV+0w}!aDA3o9GaNpeSKQ5u3 ze0X6!mz>t`D_hVHP+QXtR02B}tmls62TbcNJ7wB$S4~bdy)7QKth!BE&d##3&Q3Fs zVK~@A?c(uyX|6IXf)LZ_b5{Ov`fn|G3E0R>2ib+uT^tH(xz%7#*5hXkgsziFpdOv_(uq{6Jqr#M3Z|1eC*A7X1AL8PwQ8#>+ehyAG9N?^kCKV#? z^IsU@7Nkwp@Il`2Wb2)s)bm0g)kHj$Qu3t2X^OI!ty$3!$OtB6m(CQTCE4rUYk#m^uRJ~B$8E2D?*vN>F8(Tv(jwh34wVAh=++iVQVVB_jqWm zLpsWS+6+ZlvV!0_n${0Y8DW3=AG3M5V3AuB67i}HZ%4IDYn_B~w5N=RFo-oy4MP=F zr(?j$=q~J zy64r+21HrRT%}zU?4crIld$I!`#y}w$~MbP(+)w9OnX6)4tSH~Rjv5$1A)o#ea@GS zd561lTkny=+$$ngn3^5N&*KGc_=nUQn9HDOV`DGw9Th_*x-Oxlt>wt(%UjHJ&Ko~CU-KLdJ9O69ddyKpq`Nm7iXQS`=48Pj$s6ddBm73>;2?%M~i zpRW6_uMylL=BWv+tS0u#S0NG50;S%QbJ|r`(qlS>A}FR9BRO4uyI#*LrdhC;F8ixm zjIBn}Bf;{Gn&rFIit4mI#tf5@?ISt3TLmc9m`N7)nK_56TO&rOAG>JU{CL%NuQqug zFYJuFP36+BBV?jAJ+!vMFuRSwiEqH9kt???36#9o77I9D09!MZptYS_!^48)Iu`64 zU|FV>2=YTCbB8#?;4HPNxd1xnehjRP z623I<)2!2jR?K&4Z7d`h-I%k(qGQoT>|)Ns25a z)N#HTZ&W}Sv4FYvkY|`12+Qf0VIrZLWHKJ!8Lmaru&k5h6e??Eq>EQgTr;>UGLaZ` zCJ&!v=8>_Jj3QBwX36>DnsLm5oUwsb^uFB>IWL&=EfC#m9$9$B=o%5*Bc;ZL%4*v; z3tB{n74}^fb4rh3(~+ZzR2+SGS>JY_oZU_-y`jLaX3_24a9uIqBR$NVEHpwdlbLhk zDw*AA)014f9m4&J4g|tRzCvMStVYW%(M|);qR)1}iY%2hms*Z2c_%X=wi#&VV*YVd z3#)W7M>d&(VRW;C0ncBgdaKVy32BA-uS?X|8z>WrEJmM5*sxT zjXTC*Rveu$iS13NccG@YmCX8U&|L6UO%-wEH4DX>M=W4h{5(RG(cToe|?q+pq-+$3XdiY~4P2v4Fpnq+p8`_pmzs zR`xZ4VoTvUX`1$7h_sC` zx3%qSgtb>b-HUI`&*mqOpE#bwpAX&r2DQc4w0?@KBozP3G3F-Ck@~zr+c>BatC(hcP^o=d^zVib8*uocKIEb{9i@{;Kg{BSF&REyNt> z%7jYqkh;Fv~XFLEc7C>G}=*u#lIUjAh4s?{AJuE*2KiIl~CbFBTm z|NZgtd$ap^=QhA42hM3@-tuZw`$uB1B`p$6T{U21aEbDIN%rQO2@5Oztg~$nu6$Q& z9)#`$SiO^F6V)zrScZ73MZw_co^SKa>1p5t7FP7y8tICUm*>s=+5W7q52tJM=g$50 z$*vp(L`hAISjLFej%Kgmhy#JUn?9@+_snRykNgRW)^caJCusEbko3`93s>BoXy8PG4X`biN1=yX}WHN1vDFb$@;=vlL&s%Ny?u~`!Xg17pbn9uIP6>cwL=QBmuE4aW$>$Gws0W3M79cO z(u!56_at9q?h32tb^}~y#j~4qYQ8x}KBYO+5|42;q=Y^&7BlC2RgnXXtcuhwSn^GB z1W-*sW)Q8BpD>%DSxocB1H>Vt*(KDrXL9Hp87ln4sTw{SXos+8Y(^4q$1B0;%Rv!Q{!nYEk^WE!iIU55 zh$wOX>FlF`6Pa~x16J2%M;?1(Z z0p*YGQ#7?qd|^78$7e7#oR#e;kfK|%BlrLc{9ejKJl&aaG6Fd7U2d#68H@m~QH*U? zvd)U#_X{zAp10O$2;Fbi;sm@U1#U8lK9JRsOeqz5c8h7bltGq)3bbXkVs>Z@`54dV z2uTRTRZO>Soo?4?Qf^wb+C%#L_imKAjSXGCZfN3}$l3eb3Sc2~=8P1rRtu5O9n#*u z*snp<9m~{5ST}*p;KGU#Hr96NUx-=fW@6_w6LAj*V?-lM8+I_NZwm4YoY-FPCATFj zoum&bd;Luuvj9eR3$cs>RkCJXrdX2C#1cH^RPf4^)rHM{VhuB$k~;ES#o*488;i(A z#T)zj?oOcF>!1}m<1nzpy%_HqzFnAP4pW!lj;GuFMZDS2RD@lg#ykHyeHVYENJLpG z<6~lgk~Xw9F9KI_kWmC#g&blrgPvhq0lUAs!U&kqWKfA!h(UFwtWF2LBEtM(%3lml z!ImzrThbtJ(UCUFh!0Vrv`@cx`pSyLaR%@p8o}F9rsdl`itW3AzMNg`0E9J>)lH$@ zlPjUUxN;>DX8zz(>!j`5ouutsqhrx4)?THw=ftkJYef^aO+L6fQq~w=!hEyW)}K8I zoIY>TiFYv}-@q|F+l@9++aH5oD`|l{Eb|@)2FL(oU5EL|9{1e>j@gVI2JetP>&nAy zk+4--PG|A3U$w79#C7N%G+d0d z!%)7Hn5G|ia2jmPhkoglEBLXHG(aJFzJTnY#xf>V@ja~qtNsp3UX#d4+gq7}X;Ls_ zZb{m$0=`l{WE9S3)h>kKr|B&{J@S;po6%s_NZ7Wp=!U=*`ptKIpD~C$8NaoW{7aQej%#v6yl}KzHFWJ-xNZe{%+bkDn-3^3VE~S4;yQP zzcj!{_L4H_!fke`Jz&x{SjVmuHzF`o%Dtvey6qK-iH0TA(oxW|R1c$NOV1sfT!n4E zeMg!;h@_WfZN z0t?WR^p%3LrP%G)mK-^GOqmAJ*!wD_s!9{8f>mOpwsE3HUGWE4MP|oSOd(wczzoiAL!k;| z|Clvq3J_yYX_8Kc&yFB41%imYD}-Rcr*FeIDU_BBuXcL{#Q>F+ z*^<2v9iJnLbEI4tZ*URE1N3rmaM5LU!Wh`|0RkOo`1~DI1MTiTm%Lj}V+n!VI`OH{ zot40DZ)}q#7A&vkAeRpG2G1>23}$BaA@*?FT_X8C-J4vnS`m>Demvez#dws{U(qAS zpvFmJ>B!l_ghV4(*Vs=A9v`_JbUIn=`5_fk-Q%;&N?7dsb;dKtcB@Aojs z;`J~@Ly+KI{p=jU^6>-1?TXR|8fIv`^+uSu^heV$=tZXtBkaSj-=Ss#OR{nU-Uqua z+_K7%m71QubYIUx7yT@w1n8}uX#2O9il&5u5r(-cwMD&z%~%pHpI z6GDc`(+&KHL;dR#X;d6c5wxuG-3w|!&!~sX24t? zFJ#I$35LSK1klJrPWE~U+FV^jX}j2&A0Oy&t%?l%Mk?8d3MDzFvL5^vv5BzNHKn9f-B+8@9(0HCAjJYIEs%#`S+T>!Y)btg_Drx7e~+Y~}P| zeU>8+U6G8RftWm)8P--GnylCxKvw*9F&G<+CG-~t9gO9_2{?cl{S1@vCJ+7v-4o|W z1oE}oZsdZ76MT#PHW-_WuE@vFP$=N5FD?&jhVoTakI6$vL>9UMj1=yH*|v58w`jqo zDgPOLcmE5-N)!S0oKpde|6(8|A^PGtfMIsqNRYq9{9jrXz&}=`+`lZR7GJITB4zUx z+l1*ERRm(!=qd1)d;6N!kHA-@Y=BfRu%7eY0&hHa9%La*V0!irAlPVVe(8|^Xhvv=nT;^#vSc>_d1K~{Op=FY$NLhZ%kfB#pEf`A|kL0hJxa12c=aT9@r zEzndFE6^yuDMjUucv|k2OSgTBe(d@EX+0mBd>gzsXX%^{DWU5!{q3nx#J~1k0xzIk zbdP@>J}exGu1K#)F-fAfD#f~Yf*F?(UDZ)Q`Wsb^h{g$wF?^Fwfidj}bBm2p&-9n7 z=oT)M*iwxTtyPW8$ErGZbE3~XH$HohCxrg9loUFKeNaq>l&`|`sgDso^&|cA!r5Zn zEL|%4HnTqCQIDO}k34hP#Pf<8f6*7MF!-6mO1H@r9f)@$@v~O4K8-%EYm5n1?Mk`$WA@z)mCP! z?YP4XQT?oZb?quT5O%M*8%N?zjGm38c$0=et`DxQajoutVlJ%oW1x(|X>2&Ae!dPn zFNiYxx5(eVaSv?S{fhgpm>GFP_1$sjCfIOTgV~<1yeKtP8fP{{oZ+yU75W9ViqfNH zo8cjUaAB`g(qqfQ;v}V;BI1Aw{Z==*J--2^ZK@880QBJ*!TCpgV>N=d<6<>pdtSEG z{={)nq$a~{uAQ}2l@uA-=_xQR(#SVNjU~2bo^`e==t(}FYcCX8#x80m*ITZ$N2FqK(1s!|=rr>Pb4Z0&GP)CC zZ_;~b#JY-lg0}lC4#QH3fO3g^Hgtc!xZW-2d^px}KefGiYQADG^G;jj%&(bfeCptO zzCW`%KWG&ZXtv86VBIP#tQR4AdA#qn9<6Hl|DIW0s;wAF;S)k>mi48ymLIf2$6o*u z~Sl}@jd@6CUSQJo2{>_8|{C@zLGKlZ08ejtV3xkk_ zQ`z7IMBDA4L;NjD{?b+e{;`ts|7BTPM*df`2E??X`6d(r+t&Mvy=OmtP1-+TI|?=c z`d4V*)c~<~UR(FlJyy`4wyq%P*eJfRKSE-p!2Nn>B~Z|@|GMhlUAUfeJ_Tbqa4{|w zy!Kw8zwO2P>sbGJ*LVo<(mm9b84~et;<7LGB;BW~j2tHZH$4+`Xn*2_h|i#cB0vWs zONlaPr=cg-a~0u91jXNyw+VSw26Xo6l$h6pD6O{GBvxkrRNDg275e*2Mnp| zPYa+t7hn`-QWGsq<;*n#ZiO}8K+p>~N)-5{?lSpARO%Vv7~yP!K+;Z{E>MXPzW$R( zs4wriPc5Yt^I*A2DI`N@G7e4xiwyT0f*cokP$<`R1cC||QMGb^BD6WMFpz>;I+QNn z!FwEDmOW!s(9uc>YEr}=hdgqs5|oj&53@JKS!H{!*CEvBRDzaLP|?hzEs0iwut~>M zDmK*Eu_d@viAtIUX7ZDpI38jdt2AweHV*tsaB|=~APf}I48@xa(F_JG!_dDVPk*6m zF}?aOz(v0NcR68cw`_u$tBXkbM2}^OAW}5!q5va@8EixUPcRJB^dv^3`Y||aZT|u{ ze(j>Gv8~`PCLtZKHv0I)NyNEaAJ>fEf6O-XPPAd(qs#^|a5BO$#kd>iPk)ug(Fjzj zU_7UJy-z2Dd{@jHtR99TZB=xa^(+S~3Sx&ZTh`Ma8BM})ihE&?l1DVM5X} zTdh>V?G8XviX$gg4C7XG6c}3^0~@QAXC6bMjwcB(Tfm|%nX6%LA!W~>+exQJNM`#3 z&#=fDc-H)p0c~i~4`Y@%b27wUF!75#J-$~(B#jU_<4;sL*w5s7)8zS7Pt?VsS(hvV zv^u0V_8D-o42C3%q?`1P`)CDdUf(@7mv9|0e7LUhHYlEc=cS<)q3^#$jSaam!Ly8? zvq2!7q|1x8V}r6N+-M_vL=e2I@3H3TPqJ13$G~LIO(qjAb{;h6ac;LWzm--bw1)| zLq_ZvI0>sGHLb(xm2O94?WKK;?J#Am3`;N1;p$niWB*t@of%p3hawpl3hX4>h6U~% zqKL3!rf=NXRy3Oa87LTd?aBJss*#6*kfhk;) zZ^@mHzv^DV_s5yMg%?WhlKYniS>jyy@dyxKI0uVuZvYHke_1Xqp#RnWZ#2ll54`^e4f40WIR8_FEc}486epU>E_%yx zq*|3_Y3ddKuB%0n9cM)#MczJJq0b-t{3la+W1#um6W^&^%`)-v{B=;!$R9RE_S*B< ztNbVLv7py}9Ke0Vn9Z!&p;--xgg>JX*a~BA=ms!CnZR8ewzW zLU!(02wjcmDQ@<=Yf;9Q-k}hw_GZ7e(Nx3LE@_bc-AcB0<~nDe0VAykVH)P8^ z0fa&3o{vMY%^~~V@7O!;9Lx_zt(zFQsy-Eu1c`esPq+I!t^^|oK!w!r`XqM*bqWEp zR!l^$3}Hc!@ulZtW zIDSu?`ajkmar|G_XUzJte%chlyc-{X@vVTb^l|KOPZa!lH}x2Tc@9I)M?eedZ!lYj zV&E1IkY(b_(L;=XfK2^=t^b96Szr42e_Nk1OAYXk6$$?@%a`^4)&6g+Z^-%oV*S7E z#r~hxH{^t~JekV|C#|N5FEXDk42s*=P@}8C)bMPMr)AA>5Y;*Q9T*Crq`OlJO&f;K zN=8-+(~qA4Lm(D~35NiGI~_#HhvmV_;rNz}(1ROgJ4N@UDV@%r?{Ri`+qa-{->nqR8}aeVwT@M%v#W z!`j%OYAG$-0os6tw_A=!YAFC_Qnob!LtUznu$}qtdVjl`KsH@n?fvm*)#u&wHujLTj_}6yP*3Nl0B(^yLHY> z>G48%qOH|VxvRAbRxM<68N3#chyC+;TQOS4wcWOaJoFk+qQ3y32$1OSw4z0E`ds%A6_-j2n{SjE-F_s8aC*HhcXM+-p9OUDzMPHb$mvpx4S6xotP`NAj+=h} zY1vk54$@*pw}dL0M-d;J*7KY6ex`b}fl6fdD_5t8a?vKB>SOjR|6+4dlnQ(lMf}Wj z8fQt2YPhXY9CPZV1>b&Rkh+8Mhh7`Zo76;=-SwA6C);`P-Fg0ax$G|#4|4eDve-C`GD)Z4Gxu{syaTEZ!hUzyB*Hw! zLJ0nJ4m#fnAr$^20&yl6xp+8%zW}qtH-ND&5WUA2_7z+zho1x3hx`n%{}!3xB=QvX zz@^AgNrV|+RC$Vqx=R0Q?Lge8Isn;Z=$=tv+lIqKeWA92qL0eyl|7~GH!*KFPb}+4PXv~UQSJKw;6Q2;bR~6D*0<52i z&0?IN*?H8nk=sl;J{-CXVz+u2xd4>T9;=<;TB7Ta~%rhbrp< z{!?T8o*}(7$^~lAY99~KU^X33T=j3g$msPE{DhGYHX}DP$vB++l+*FOm6Zgt&~lFh zlyP7V*ZB}ZA^s2=0Aovk54~ZIUw8udQt#5@c>8vSTpWcAfoXz5&5)2v$}~BOX(X;3 zmIBq;*P32pM`qz7tv@4gMD;sG$)JAIoE`A2V5ua|aF?j6=*tOeLzPk~052o~j+xkV z+5wrsC0)NZ6&`_GO4NZilmexGKOU45{sR)X0AD#-KtsqE<~J{- z9roS#KSS(moSFTlrTlv87c101mOGZ9e>JRs;gn$+;BR`fo6H;as?-C>bpZ=7(FOeT z;R}Mx#66XS1wzN(0)UHw;Rh`3?#B!Kv~^Sj10Uwmul;HJ1VaBRm$(|xJ1e_5Y;F6m zy+HpRV(=jcen6*^psbE6=+zKP`7B`N&jy0w9=8r1xmwKiW%=)9DaXsla#PuGR(E*Q zw7S{dZ^HzfKF^aC0aXV&P81sC8QKoG>9?)!=wBNIRMCm5s2e{CI0xXPAlF32K&MfR z8fvvZO@cj;(fE}z7mY>i0^xehu_qF^$bUW5|c_?^LZLDdu}n83+0C*j>PNK#j8 zvyD%8{J`ou2l_P0*Z!lGSt(X`aXSP2arl5kYAh9|y~rcTK{)PThSq#FAbXLJdvtpd zp=wh&-w0zJfD0U@Z##tT?0L2p-#-9t67xR>`og~A-w~8ep#SE*zLH;mX&u4-v9f(p z300qT75}TbfVeJnei<6YHv#M`jXf|8jO#=Ph;jdKSpEfljhpHd0zg1NR?ki;z;K4s zQ;QK2Hd?m4XQxFB78Ulp55V{{jM0OheXZy*#ZAv&ebN(5;cZbJ z3TOK?#NOFsW0qbLdiXmq6?T@jtfsxr+S45aK}2WCkGBKGJ@tzf^dHMhy5PUsx4&6e+j?by?AMC3 zjl>7@cW82-{?}1{L0=i7MU7wp>~|YLKml;9z}c1E=+~|aXBlw7J}!egJ^LF_>O0xk zdGC&C$*BPw`@i=3u@i?1`Ts3$dH{P|c@xYDObVVAf`nhI~gFf90XJndCaEV!Xg*F$%m#QHF$TU^85c$!!k5}P+dmzwR{ zWUkdeP4rAyE|6HV$$6R3PPpuV3mnn-iPmBeVpuRqXY1K6wh|7numr=5xLPm&~+Gv)^ zZumgXPtP7u5q6EM7@EczAB;@=W~b;tx%s4)WJ>LHkOc%k6+D9b=pt`0!e|23>K0s|{`(fi*i4_w>hBFPP?;39+jnBGRixwn)MuI#2U9 zMwS%QRoIq3#_ts}%m)Y2&m^P|taOj2XTyYB|}+p+@%KEb}&Tif%7Fb4}xP2rSyz@ZR)(Pyz7p%U6K4% zmn~*gRXwk~lyz61a3qQEvAe**tI?Fk>+Pfujp0u8qH^Obg^LcnR+S4c<{eoHenK>s z^)aaB2DD+D$nIDKV}*n*&HM#9qisDBDe>!!uFn3GOgi)D3_e29)v^`v&npG*FN$sY z1+GvERuLr^?`^QsSZO8KN<+y(cc5cKvZ{zRagc;XoLJ%l9;%gNN-%lZXeEz7J+s2ef3YC`?~T z!zYyZL6J{5HXnp*UGcL-`JPg4?N`h*O#(CN8Z(Vk$mIB4O1se|!kMCm-=JxXX+HQY4K@9Hm?J0uqbN3)ZEG8O{ z*YoXUI_AUnZKt;&Vc3U%*k$z^*uJdxssGxe+oI9o5tNq-1>k2htO_+#Za$DkD2?Hj zTTaJC346A5i8{PL3^zP1Hc%hi#Ac-yBYF zMtQUKHkjE)C+loY9w9fI@O7w6hjaRUUeZV^tnUZf%qtSpP!+w4r-+O46)}N6Gm&Mb z#u#zQ*V#$|oep<9Ze9)yi&s*_0qz=-Hf8onS%mQf!{Jr6($$!yu0N)Ka&>LE6-!Dx z;~Yx482_GEkR106{2{vhrVn9I1)7tbyZGn+9Q#$dz>t!t|=fZ<7Lw61Bj2G?T zu}cFUo9=b1qIT@C<*rn#DZzK&X!>>eS|oE7D!!(B>(ggg)aLV)>X(ZI;S^zdtn1|t z*|O`Qib%j8zXzX9joGT`=A>?q&dQ%4`;9mo!kiZQ^GCw#!td%4LKM+3jZGFWa#bY} zl8Jf_*W0*SF0#2+i@E#xA1b7!qlEIU>PyeMM`0+#Tkgo$lY& z`Lcg?OGjQh9_}!X77;e?7dqGIMcJ__mlktYmDzi=+iI7acPF&ex<;|&MTGE*`O~l5WHVD7ZX71X^T)avn zt#4$$i!2xXDZ(w|Ai8)nGJ?xFih_1SP6`u`Ey0PUhcH=27&ivS(T9P9F_*TAzt8+p zscvOoBf_SwG#MdhMU*q;cm!dEb|nIAz)N!$ZS+aDkqW|HIa)O#t* zs0k{gSEHf?+0QcQvBA}r#GF`Er418L0%jhrdBZ6z;)q|4Dv|DUgKU%`3ZUMGe1GVA;ka z5?$>FADB;wL@;D5u6HRQyGP5R%~>ozW36mIQ{`Z(v>r$GFk+l8GMV^V$Br}M-AW9C z9&Uk<31>-=GMLyfDu0CvMU5U+CC0HD=A;~m@TvdJmyH@jCIS}(X5QIsEi0V|1 zd$p(;{iyJ|dyBfezcjOxNUGf7+_}`CrKM^VP8jMQ1JUZlXIXFfp^Jw^tfvzUM@^

N$ot-yM~OH%F-hjHaL&pOgHB32|!FMW4u4VpQT#3SM)GinruxTzkLk551< zfFY(Z+P9*f;dE4_?V9r;y!4pkEO%D#@Kaq?ybO98Hbq8_hKExaTBK3)P<4(amzri4 z-q%Ip&RutKh^IojD_|W zBG*eZe?1xK$muC>Nv1i)jJ6WJtIe@3rW`napHbkivFa4u-h+gKSUw6t&>3ef-FuBM z(+nz_tW|i1ah)k5xtzn2X+6|9bBGLWHj>XEjbYg3)#@%muUdUTn&3IV=gCUyBqlqr z&+q1Rbq&?%D#zkWPQ)XuE{Uh$v~^LhNW+qvi+i8n_Akzpy%KtZ{KmVua+p%SaneQg z&>z_XFOLx>#D0m8z}xutb195FE416!z$j$m&h3dj857U0sLYk$vskG*EN{2AJGlVUgxpPj?R>7oQc9=+ zh*G=sI56eC~wxUpOV@ns|&!USR$ZAZ9-4Fq=MTH=>N%hnU znpdy6q0wS+}sCye_YztfpgIBQ05q)xe z4RY8w0pegF4d_~=uur~n!A)!4B-;ieMj~3T;Mxre#6+GAM9ox)C>frHm;^hFTP=^0 zfQV`1p}c7{#sNmb=Y0F2}03T@9RIAR^El>9l20NEz*5-e}dm!@@#+ zzHG8f344#KU%8^5L*nsxoj=VPuUpDG7NzE3ZYW2IT{)KnxzSkKm@4-)rtOI%r2P;@ z?$uH?8`ym}E%ETeNf518(Cs->*@l zANP60XgD`>O|gty`TkriKCb2`ZE{9T)N4?W2co0z$r)H;^DwuQ{)K_doox93M5A?U zY!%Y6lb7%9B`UWRSi|Wvyf2b*R*2Y&Hn}%35s5odI5HH`S|7_Wf_v&;y7w1ISkLAv zd^%S2|5d)|fE~MYWV(9q4y)G(`)v;q8dmN39t+dhaLz1rP}5g`sF3B;g}Mb5n>_Ja z8kbG?j#FZ2UO!SLnBK566YO+YR6>^@r!ftYw2Y?ZOarU@TUoce6i$l|{o0Zu94T`U zhV4uPk`MV)IA^CkB>ysT4kYuVj3Bx6&(!9qQ1Di%fo@4HST!_11hoaqyVkf$vQ zq1M@8>){i({r-YOAcxNCmbM8}p-a)9MeS4cYV9=G$I4#kQDyP!Gp$uyT(SMw^6nYz z>XI_Gy-#@xaTSZy(7k)YO93i;oSGnLN34|2||)+yg9tsIA_0 zG0!cYBj0x9SRKCOvz8rIRfIXV7pM)}117K!y>uK&MVzlec`ysq`av>OC+H&8gyg8J zAa$hBSK%o8r3XKpos$p7~ z)+Y3+(E4_tpi_IiWWxBNF(y;#(P#K9 zsL>jNJr7;nt=-u9Wqqi^H|z#I;$UG|YjE3|$rA@2*2@ouIq)yJ6Zbtk*Si5pc|V|| zf>YfDM?LB}GA`hoC>6Br;tdu=dR`&C7>Z@g%}imDjO8ANWdMBQPZLv9g(j{~)asH- zRiadJC6fMtj>t@!53?EF{RDFP$r0Ol_omv)4zoAAs2;1{w~#yopi*F;j{M0~@XMK9 zggj;IaTh}-1fk}$b5u^cjw-SIPsQnyG24sLKS1hjH4bdhsPxvlH3IaJ>lG)1s-d5) zMrDj02h}+EL7<~S`?;x51H4A<20lhn_z^0T5IaMd-_+pad|8y+Tw?M`c!7o@sFUVB z(j{S9hq(T3b}i-5yqC*I8hbi6`hvYZI!9#U5Lxe8zxp3kYYe7s-Kk?GHRjUCYRvHZ zT2Pw;^iVVx(3eXSp38;Jj$3P5HDo?%^dJ=?FFm|RYFt^;XC=KAl|v zHf2)orJ$d(@vhz{!zX!!DS~9GfD3q0T_qTgjrWd)Kq9_dq6_9f2M>WKTX+{f)Q05dtrcx^zJi}#0ZK-gY*jc*##dtTe)m{Yh}y<6++ zkuU9$JaTt`|9IxKyLH~OtL*@(K7qGa;NnEOu{(qbFow;D;tF42`>JOryUm@Wd#*)M z;|OzMxVHJQ9r!w~pgFzr-UaE0qXML?0r-)!!RUwklY*sSs2kG$YM}f`TY&V#zrJbe z>$Kkn6>MRZre>|z?z8LsKlE+lt#rwhw2ZanmNp1x{w`Wk7}_9Qnq19qKX5&WR-f*8D_A{;xg(VO4rzX+xw|2R6fCR4XYjN{i4|>VqHGXsyhJNL zX!rXF$os@wXocI}i^GkfY;z0fdk?!BLtf?K(*KE8NTE*srXf($2Op99twkJl7!9Voy7>KUiH4i@ML^&DdzZ^OV+st>Zc?BYfxp< zA}~e?!2wEGx(C27D==oP0BGFcCyf?24#cFvPZsI(D+5mxCJtlqlR=Le&%?$kAvi(_ z$_msCK>MS)s*kXzG|YK1_Zz+Ayy7G|s5h zMo68VnIn=Zn;kN_*33QidDw+fxEve#4VF0$LdlN^r2OuB+)NWvxJxex9*XlteW`z1&PSU0As813gokVRv=3g!kE-baJ(C)7@N7|m3WSt-Aj%Kwd z__sVI`$OoK99w>P>PaQOC-}%)51m|KyEzl~vW4eG_Omc(hi=#y^)gSJWtWw^9iPyR zxW+1Ai%jV0MV=M^di#uE&LOWF7?`ka8JiS_(Up#Y<8rfVE5&N4)B{`3OTZ}U&aP$o z+CyeGmNL~mO&2)uGF34C<_i${YJ@V?{6~LF(28Z;3f1<$>sE7YYJ=PLAJ@C9`_JLV z)K#-txz70|IK<6#gC+CnQdrzc1_f6j$FMR%s9l6`CIKQOWHdx%;*AsN9OOqb#|lG| zFb^dVMO`((j24v0_9PjN{TMV7LUkmL9cbliQ^?%Cp~|J$r=m=&_!Gh;1AnE0s6v-* z)UA3SEaFxRot$>X^lXM%tHoViJ-s}Nd=EJf`8}~Y|Q;a1ir<~6=MnakQs4^31s zaenIq_+2My5h@q3(A#46Mki=51Xsp9xYAe@?Oq`6OX1q}K}#cZOF$$*K`Y6PY^mB} zphO#>LNR2`gM7LpAEEj9+E&Xq;D(HZnsZQXK`hO%{r&b(sD0ucMH= zg_v#Ty{JhpP44I{u}o5!oW6=e^oaK)D-t+alZ*t%LSM5DGn?t?(km^ z{X@E}EgjA<`31_3zF4}&t}W9DeH!(^fA(Fi=L70!gMOA&C-W+K9D#+(a5WZP0&1C%%P-){2VbrmpMN%fd% zj%m^HpnHYdey>I{R763FvlMJ9KSo#b(Z;poOag(ipk354{Ex1|qZ4=#LU0 zdb1w|ILrjl>}7Ms{GH%{>}B_|F6%f>A61T`EgYupAR3hr^5#6-d}!VYi?w>Uahp#Y z+OYJ}z-@3=4nty$6n^WA|BTorvCcmQ(9Ki3 zYS+;c4@e+y~h_V4s{{g{DT zz4{Q~hu6zK2cJkRy!h;!03V)DDl_Lzs~nI_8Q3nWON-Cv11HT;iH0 z*|$ThM(m(ng!ocDL4-=E1Qd@3fn!LVD+yN>oFY9UcAb<#o7*a!5tCpqpD6Py*+dh>@)SBhV$=rN1oH#tH-`y z^IO&EULCav_E7#;va-EY-c1Vh=Ti+3=Q|Jp&e#66cJQN4Zop8nc($XN8s3~!m}!9jG!U8?lfR(=@TK_a@zRpa)oBgQERF;c<-qUcgXfR zoW5t5x~sJ{O){hv3~jllS5S%4CmL=v>4i%=te)C;FPp|51|IH3`yr4S?g=ZMn(%4oMJ@QieP zmTG?1jJ31d`!9ZLXoa*z`S`WLhD_W5hD;seOj+QUDt>IQxu!-R6gN(D$r%y zNvY3`1xe)IK=4a(!F`Je8BM3hhDXJ8(2+sImT%}ThVr4aUbI+|2NS_j|Kv{*nZQkU zh8cOB&ME9xF$FhgS5z(&y)emKCWvTCL8cG@THXybS#VkJ!>(c;bInB_^ho=_9a&E# zvLWz+P+$>4Y%=jDJ>m}=sr})pFLEf5)&?`@(S!ikCVi(HiA@?$@E~$HyuIy*W_oH-96QHih0JBcX5podJ=D`#AneRpmjyKC zLG=vN5xy`AVP3QUwe?Jb?o=a(By&dgB)6GFd#aY3%8zb3tZ+?wBjBvZ0 zYraU3B`B$RU+jW)j;G?j8Klv@Hrj`^;jL(;_3wGWDQMoc7>3R{ZsvYu$2QAQgf)_4 z$y=Out$Ih+1UVlqG)-ivXqe3Mc==2^^=2?gID`&@|MR%BB#{Vu5vzbFjay2(pza8yu515z;GHdj zZ!0icRX{Q=v|d(qo$Xm!icIj_`^x5@Okv9Y8s{X5kdoY0^EFE_Ur*TClr${;Ys}cu zGSQ-9A3;MF@{swFjkt0(%BmGJ31{qPrOUO{hl8_xV>(-b(dDyE=~oX?bQJg{jY>5& zW^C?>VEbiH8rGCRi>%U0=IdrjQ#48k)(fy5m3Jw%Gu;1 z#`A+B#95f1ZrTgtlC%`Js6ee>TvqV*PGT`Ek7xpZ0qN}KU(q7k%Yq%EWOKn2HvxA# z>HX4hf>$sD6RMre!~6mM`Acph+NWGjkrhcqX|30(6&GjdDl99Z*@V-x6KYqDxHikWv^S3amzg1&)?|L%S`z8-;&#^?RcVRt#_^791UX%9T3Y_bA{$JI z5fzK4sCjsGd1CIYP7)#{@1CE*_2XIkSzT_fGvOLF9`{UxlIAk)6a`XHcTZ1`ZrZXv z8dlk~hjIth^;Q?pCB{ZE_hZ6cgY9(WWD8TuNk^3=_a&8XU$c<_v%tEvGZIT)pZE{6V3X!I)bmhgrVIb)Sh~yhyY@6NpuQ0MGlv3(U zH6v#d9CpWymAR`j2JXbMRoa-t>iY^dwRjpY^Arab5gObBwyseVCVwA)*#`@)*#=Cg zCq&&yPDvy>xGjLwfw^(4g*1S0XniujHQGmMM;JZEQHg%9kE|3_9Pt-RZEr2PJo#sJ zb@jeihbtdaR|B{5ke>ij|LucqQeN#M78SUO4yq2=Zfb~@9jxJh-qwh4S+fgl!}t=ISdXw3!$im%S=3}5pNFg-(=|XaXeo~RCT09gE9T-%+m9HFb z6P38;78@!Nut_MwEK(e^@2uKq1!NLnf}eCLJQc7g_@BGxL(lb1%UX;J#JbxqL=KpB z4>k6VYSwFO^$Cv!BRuT|*5KcZOxR`T_e?RwcfTY4;MRAphAxuDy-u)jiHz7t1Ym9G zAuQo1LV6gGosM66WP#Tqp^r;Ol^h+<+)UkEapztQo_#O#T0`NMzOGFr%vd?-+v3>{ z+3}!(WcXQ`pp2-D5B$DvEwl!^;F%Z>kMJm_Wg#gIx0>+mrQ;To4V9e%))Iu$I?|NZxeK z8I;>G)y7&}y>3Tcw{P&l+XZXRtNHm}>{LK)YW~?Zdf1Nz*Te6k{(fET@BjY3yw&|Y zd_P#1d)(W$N-1T3u66yW9dFF#j>p0A+VJwa6!!hBWM6TkLmFkeoQiF$v4xyZ6&ZfHRliYRQ zTe3Rtg3cy|ESO@F4s84L2XW})jI1kzu;GjghNYY~^Hf-wsJu=-X?o;L?5i_b=LR8z zDd|6{Te(Nc^42fC=be!D_{}lwAF48$i}<9lEge0&AgR@UzE&=acOCa#QzZ`4gxzyes2Gt+b-N#`LvNwJCQjScC2(V8Tj3aBLNO^f1HhBNN= zRXox36)OG*hu}awq0Q(;g&={n&MFlytpn* zzf|KN7Z>?_32eg2>4O%=9DHpNyOL2ssRBY;(EMuF1K!;O5O z&x0){O9SIz*Q8DEVGB`ZdmbN8{s=b+3{XX-hTOGQw}7d%v@+N;Z+fRnYaP3h*@czwbmLq3+GJWw@+Y!45U+>AG_GEys z&IoCCG!3rmCgE>NMvI^*J>V|hu3G9Ak9>?#80Zz;>l8em0#n}RS7?))@v3nmmqvWJwKy<@9ex&0Dca`4Gwx&nlL#zrzl5P@U zN^^zAq>-b@OG7Goc|D&`vz!GD^{|>QinhXpJ}rwD%u*v^vXbMi(t3If-C4oLTc^@6 zgPXb5Gi7GH6?viKJ7FG)DiraNJamw(UglrSc>rcU#p>U%FC>i4Rrh+1L1wz!9s^c9 z8L5}PP|H{~hvyz!9n5KpEOk=?i1;W5R_(nY7--{>of6kKH{n=lr_#NxDj9Ux+ACi8 zv-3CwrbIq$utb|U?<54Sf zwQ5Y(-ugZ>s8r1QaY7b$9c8s94qOVpmww=guiVRc_owaryTQf)R0D_NdGiP55 z9WYTI-jkNs)D37&ZQZ3ZkR^YXz51zhDhi3z&2|~Yxlx(Sp94;(xTxo4n~cWf3686y zqhLhKjSNVLkbElW0JCqR48adjzeoP0pp`J>>>wHme zxMt}IpBs8q*{?Jwy@p;BsXzO}#9aDQ7Q_p^QY}x3NKGbj7FL#v+2c*lE~JZ2)5MyG zH#nF#;WJ7n#DQ-f4kTRY|(jj|Eh>$=hm8rEPutuclJRULx^< z+9ZHKpB+VdLh*mw8&7{Y_hLei~D!P5yPnYIZZHK8&bB&aw?TF6P!nGgT; zW4SyJ`8YRb|I^TB)M%Wi1w*GQ9Da9TEG<0j_Kb;nDLni-bK~ROiT#i0eai7)X{#R( z_m)`iS8X&qe|M7`JI?Op+!gvO`#5*uS z>8gvhYCk(R#%s^z89D>$7*tJ)x7=LK`17W1;>zL7yy$cQfj@Pny#8>`n(Q?QFPcg- z96|ijd*0joOlaR_p67Z&?H&pD8mBlWUMIqQMRUB^PT;p6T1i_$t@n)e&88J)9EM(f zU@TH+JPX{sqdP4XrTsAOwx*o}rQ2T~Yb0wJu8(}#uD~i;X^70K-+FZ)2iR>y8>pGY zAoV^72p_wMBZxZ4U}Q0eK+t0X*eK}MFRbKMo#Q@MSwsdfo&_CD`J>GLqz0;=rN@_WNq78k3vYINiXuR zx3KpRNzaLxm}5nJZ*)rDEF~yxvqe>v@rKFIDzJXkz!eTXML(lf;SiZ~g3`Lrg`l*_ zb4VeKnV=+0(|}AA86YL19j!MH>+hbAh0065Dul##)tIl=gR4GDAz0V0RJD2A0Rxvt zFxHk-wduA-x)ZX`!WJI>Xem41c?l((M$cykM<7d(J>rOj4li1wK42)cz%1 zJLL9b^IvL5ynX`dhsQCoRbx#EKXXSQC*Wvnk4#TjVn38}mpf8q7LaYX|8V$ywt zm@5*$`0c?~TJ@~CR`gBYYC_EEfvP6t_r^lb)Yc@3u=_ZAp?vtlEmW#sRhPBd&u%%Iu< z_&_R`-=UShbM}QIJCa=(g~+BJYhM(&iU?yqVDCoR&-W^WKXG`)j<6{{0tqzBh#oo! zg}Gl9MH!l!B%b^Z7h?~JlmNfWC!FHvj9OXHFQrVLdS~aJTIX1rAn6)}%^y3a+-nXB2dpcfk+4V%QViyf@ z4Idx{1xoy?)EBu#DJ(#LJgo|)N^?v}(h{TX(w4gN0QX4dykCQ-@!}!?E&t_&kdC@Q zX%Em|JmgIZa2{UP?rIBVm~8V~keOoko&E~}jT|S~j4+p_8$$C95(}qRbSTEuo>*}@ z1Ja(=o!b8y2~=sK!7em>AE>v*-(C)sq|j6D7lbGwd@)SA(bCvJ^_zt7Dsgk7-j<(M z?IOTlslq5Pr&}==YAuSBSzJL>nVyQWBP#!(JWiAHMMm{TWZTO!xS{ zAI9f>n+?PJBmwx;>Dsz7Toc`{roO4=5JxmH;F2_R_MZjYzYSppH1AA&oUyJS6$R4? z9y6h8Gv=7zS=~9Q^LD$Sv-OqLjpK`lKa$fQ`sA%?J_6rxy5_Mi<1q04Hk56DLv8N@ ziiHvjPOF2@U=?kzzx<0(=KN3qY)5c1r$>j3y$0Q2W@`{YVq2$B+nXfW+Zb9H%eB>Q zWkezoV0e3lX(DhQbB9VvdIYWiyp}-@lo@JPXbTpr?Shqk|-O$usshb$WJ@T zp?hnpZ$h3jMGhH3+}bOn^~@{2_s2;v!Z@@b7q1mq91(GVp>X%lQi+w;1-JCjRM4)cfK6VhaHn|z`KF!k{e z@xql`Otcd)=u@i&x4Z8?g#95i>&p=5Dg^EW6iZafr%&54)#3PDR5_7Hq}l-6eN=L3 z0f&@qLesHOCn)`-Q27w^Y*hNesN{`t@iWcBXNrZ-Gy|V``f$?u|3tBz|BiBh<1kN; z{zpC(b^Gtw=IMVO@PB3)7r8|rbJ_e4(kyy@e$8UjPdsOTmG_?yN+u1$NOH=_Cl5Ue&=gSuZIG^Z9>A-+sjgta5$m%3iJubb7|^R+f=|e zb@Zqh1@+iL&6$t$8L9`qeM`p+<{sd4ZbrwN!e?9-bfyZDNQnaJX z897Mxi4(7y71^yD)p-!QbsJrUG}1XUzbDA)cGxu?(3-8fBr-ze&=AwWZ|9;Heif<_ zCY=F?3Y1v-%+xC7Nit>C)WmaFHi+cj`@`Mm%RAL1^EcwGy1q z#Rq~$Q4ZG0cmVU8kl56D1nIq2Of|K1?pyxasfHhf7+*(~6m>%D>0MC{tw&|4TQ{US*0j_o(c?rV*p=S#{)xnjFx zRg*vAT39n(EixQ$B{g|+L|O6aQh-2Khj}3*vwzVN^%Sbiv1?jui{`Ed%jlbD=~ut- zHN4f=ahN`%#;_8-jB4@-j(uo1D}p}XRQ)Ew+e8_oeNg3%`QbO*-zaQOAq7fjceQ-P zsL7o9&!MiawlS8b32Ru`Rd`{6+&ROfz@Dp4^g%1*(>r;?Uj0l zeHaA+{}#t5GgXvu5IU4!br}}r1yoU>t0QZ24M6GG{l5Rv#K^U`Wv-!`D0>M;M0YNr_}@yK;aw3L2DUne z;&i|Ge#DlO!h|O(>|`DZBlZ9hsUc`JrE{vp)`=&j*gm`fR_gIXLp&?o+FKr1e;VrM z6OXDk5XIG3!%u^X5NOcxA(^HxpUq^3yCK&BuT;t5rh{J|K5Z##pLP-{wdZBx>yr@E zmoCTsX3bTGwzs$Un{R1Xx_SwB)>C@!Ka)RB3mrYJA_k+$-d<1Py&Crq#5=78@X_=0 z1lSr49PJYk!B4)J$~221h!0Nr9M11>kI}+MK$h(uq&xZlG#4bJ#nUO4cY^=vQznu> zOmDxfs6(u8?)wTzk`=XN6uM(4^|Ch*m^+fJ%$PJk88=?j-3s%n*$UKdX(6MN(659v zV4=NbBO2~(F=$H0Q?ON*>lzhIhE!;&9^hN&O>o)t_nwBhC35=A@IhO`mt6a;uBvPO zQmct^c;K{>NM%{PHJ7#A7BA&~2o77%yg^$QamhN#CsNGiq;LBPq3ZSIeY{-8C=rcb zn`!keIap~r0$FSVo_iS3$klbNbC&aNpdVGD147(#bqOv|90o64S`Wsm69ju_oC?Ty0jnPvB3Zz~J$4v?Qm0cSaORnX zw=w<6)`7!*0d4Uh59UZ)k8(K&`nG+~?+XeGYj!h)-~>s4-ovv-wPNTju)w@o$=w94 zoPxTqaO9!TVCoIBJBvW9;0d*qNRziQVvn#=lw4V6QxfTE_rfK83&_e~%mK6$xRj)2 zbaGf-(c-+9XhZu$Bg{tOHWMBv+&s*A)qIX5X#Ll!0`X*~eUe*CA)#|82hxn%<;qp! zHoJOIe9{iZiVSkn4vvOKD0$|eo8CJ?qitFV>GEA-0MN>daCY6cgp#xH)JO}LBr~n4 zn6SkFj9mD-o^BG=Gb;Ku_!MH+30S)iFdu2K7U7zP<|?X~SD??1nR7XvXO|;y!AyWx zei}+2l4D1HK~iS70G3GF(;WCIk3iC(hZyMIc@{rvrx7G~u?~dj12i*K>oR|UvU5LG zW7sbFazzJ%tYL4*$IeV78AJ<+4Cug=;J6$DVxK~&GfkT z$`?m}^xNGO<)lQhy26-@_p-Q=rECZAm0TwPR?4l6G%E1=I=OHr0eYGxN(CL^>yPmT z3jyR`dgPZ7-KlB$X8fVh3`$;C5#z0BC;mH1XidO8BM;{Bn~1h9@nF1QayC@PtTIw~iT! zK`LpSR`Po^n+{}s(~kubozZFAd2OshT+CPREVQnv2R$c|9PeW`3c$UWB*RZk@#`4o zIdJz$5sQcN!Ekc3W5hrOtE@yjz*putpxlI8&^u)E#wea`gJl$IGD@P#9x>7-_dQdG zRI7wC?4z6TS5bi6bcflf=uUT`BgUOP|Dru)Vv@41`35yhEuhMtP9=7S;rlxTr zC`SeN8dCZbP}j)S264f;pw=J-wmLl8(ciG)SV6BNL0Aci-1 zFsyq-NaMQWI89P>n+Wtxn>f>0J-lH}iRr`4CaMABhj{ClSMem++%x zN?hKYLAmg~2#qY_PpFa^my3qDv^qRsAPtd=L{u>g9Y*z`xssZw#zk}ywdw6Yu%&iv zx1kz)^Ha2yv#d}0F!0>$O9b5-ZVhKyVY4Nm{pin<3TkmsMoN&s?owxb+2>_Uk-Ls$bV zD)DtTKfx+Y+E(V`a<&n;!K5DtAMon@KLN`X{huzq=ThCd-h?{Upb7bnCHd>!YNtTBbxyr$A@95W3N zixLcIy)3|U@;7aV!7QEvOfmJm#J%$guBeg&SLvn_zn@&r@{~qteZ$R=cJ$O&31cj- z8gkFEHH-<7()_KCl&tvU0ZJ!aUn0n0=H&njX$(CA63^PWPbrClUirJbv(l~{797ya zOZq`?9s6wbQfxDHIB2wCPu!sfp+zenX0}*RPh0&s7GM-T9O9m%!#PTI2+uoxlC+ro z^kGC6qMN#@H$ugX8;_(YcIxYGO2+2FX~-WEN1PV^(`ClTJb=D z=u7In#$R_8@`}<+TYGL@y-vHf6&N-Qf=ME-sbO1zdkH?P$S#*5u7Z;o1d|}D4qG%> zGpUB7ID1e^>C-S0q4}>o6f6DDl`8v(FbG&Kf$gS(ypBbp{JB{AaVW*Ys(`Ofbl*=N z4eRM^PRV(SXiZDaH<79|^>iK}1*4mM2FRUi2L7E<^u1&9*2tcVe_h6|vw_~3Dvqr9 z=9)}@)5)hl0nw6C>030UFZ2_~G;wrjKDKK2fk^Z*4wv8x;s6n6|%=jiBzjMbB|_# z+m&bckvba|W22;B9X|5B`m`sibQ;vIFS>k< z1C)ptDMiK9rHa?*yG##5G4Ek}#12MpxbhGF<5G4v1CTv>D~PwhqQXy8dm(PUV*O+< z(Uc1~B+`)y$tB)lG>zU18qpz6pV@Ve5Vs2WT8E$dXRn>1f7H2@DUAS9+3tPOY(l-=8lsv<^s0OW(+=1tQ0>wENfTBG=*p z-M8#cE54fdQy~OUntR+nxPJnU3b2ohf#DQwfr_4Ky~RJy^Yb0qm?VrhaB{QX9!98!{(q5aT3&>!}skV6``6T19$#?CQ_A~9ULYR3oB%14rir|a2O9`k4&%0Sd5tA{Ecch&RD62pAintaP|)=) zIEcWXW3$;YN}mUi$x^`28vi`{!&l2@KE$lVuZ*a>eE9Y$xun`%h`_=X^^u5eg^0B2qkmJ+C~#%{d|B%_o4fNm zkvFTavh}~YlK|CS7T~xXPt5I`&7;g0y?!ih<*NBL`zrqdP$=+qqYx2J|CWNsHZpC* zey9=@o0b!Vnl$}r##iWd3^0aUCE#6Lg2_~_Ku7<=lNm~`HR3_-_1ayXL5~|dW#h<{ z2Ff*T06}+^X355rY8vpRu$>EU-dAF1qMCQ1zw!sbjntU5EWHmkEF_>ZV(-<_)-8ds z=PXqau5SF;4S7!&A^zAZ6P1pe%rjUG2JhK4f>bqofiyLt(o=)d zwT!=lVUa(>+(^#VA1y&&?^M9IrDS;>9Nu|Ji&wH*LdCmoQ7}L}=*y7o&Ah}o$ z4W)F*y_$qXcCl|lFSa=J*ZexsR9_^D9IZ#qg5Zn6dE^b{tO&SYZ$4G~?HfsDH%STR z{sCx%3{2wUKpP{+gQ~#vc*s5y#2^>_tD&SkGBwD)wv?^$KU?{w$*od|3oi*NMIErq-9bB`daNzb+W4$1n@O$J!hsTD7J}F={8_5EMb%Te8oX z3ibopwQ)PB#O7al45$X6m<(Iiq{#IQk*l`)RvuR4vCp(PxC2;t6OSiI# z1A%AL^y^n{a&$wheE86j2zAA@VHg))w`+y@T&9aM)Ix~qOQv8j3Qbio;o(sMsdnnA zU!F&_$-Wc*Tf2JDbBL2D=U-fO4LjX8gB{kUnE6hfrIc|cSGv5oHIdsbkvI0l2PJ7m zwb%t@6pOC41SO!TC{Z5*SrDjxH=1;T%~*)-c!9xVioDGUlXFPjFqEJXRJnUUn4|3d z(N*y5OJzUBLwAP5twE6K5ZqjzMJP`j@Bd@%o`PfxyLCaAZLYFy+gN4Wu3BZSvTfVO zD%-YgTUoYG?SJ>#aU!~}y8CYC%$bpq7dhjb<9psQuvI36LVrtH&YLBhXJ+ZJR=9vl zQaMx8dPfN46OsUypwl;wGqEOgW?|i9`^_|Tl9^@If6qPAFjSFb#xMl7g~ zw&D)l_wRIfz5l9F*Vpgvkdz8koQI~0CxIX4`lBLMRNO~7$Mm0}Thx-O;j;%GNU5Z*1zfwaCtdw$^vL%}xU;_TW{K<`4|Y`xxDZ5zt#Q zN!qYVS_qBn1j?9kAPK8hJr>SphFR^IVfQo z-KY6Jep~Ah=+l@uz+-;=o@>lcb|};eyz?{<)Ug9QL6S~*R1~gHJ4GBU7YLqn>3Yl8 z&$DDAKT!_J(6TBtmP+97*CcMYi|p^b+*SAQTqIF03W1*ofC1IVt+BD(uaD!J@4t?B z1F>AZ+n@MFyb!^jqDT-zqX}5IaU!Tb29ITt1#wlgH_F;E?E2Eh3^gADR+@TxrgQM! zH3_St%HSRpMELfkJ(orsr^|W`@ByY?w!a87C{}%2&&MUf7l*K>iej_h0avE=?_~U_ z!SnO*Pr%YZ(3vh@qmN$+6AMmT3#ME;I=bzZ{uF6fXyuKQ+e5js>{yxor*63dTH;(% zo=cisIzZ_+F#-Mil1GL*Y4Z_T`vfOqTgSLg@0ai!qh_90Ut{NN8^4qdN*b*RCx*HR zQ)|EZ6RzMLbA8%Zz=w$NfaMCXJ#{C51JhPX zu0VN>f@MS-%4VW0prqMiQN&IDh@nXz3Q50lc##2(zxXEiya|-b476%d9ZfTi->5|< zc*=)pg!Vmlxe7_80`u~+{KsZBSbFFy*YkZT|5LA)lkf3ldOtwy;rsMK_`c0-n3?u* z{C>GyTRS^*_4Rolnp(;vcv+L*33qXd{NeKtJWt1=GQ{TQxu4utZm|KoLnCyvBGVI| zt{l$&b3118z30l+#2k6CC*=J%-}$sInKDRbr)C+Qc__XrX5H5-z{=+j`KBZs%^=M8 ziwwWqFlh9+En8^UvY>Jc?+IT&GI5nz= zqd>V;1%k4%qEe!MXSoIj%Ne*_dbKx#c6xJ!m#xTkM(PM6@}Q*&wp#gxbGOq#wnc)2 z^4 zad}V`_t&K$#fw#nh%pNu1^*MsxQm6`S4m`iaM=)T@F&HcrHiv_kl4^`Z*xG zB*>D*X4l8pUUi>1--1jDov?2Qlc85R6s?Z;)f>?2HeYN!eFC`&CPZ_cR&3u=Q{7+q z9*;}#+IJGw$lTGM6P|D4rw%mre7*A6^WB6r&-6bYAWDt@!oe zF$qL&UsI%kreWpn55JvG5%Yp$(1i9`jzQGD$>ULf4&4n_Zk8o}bNh+w9_iFcBqB_m~lC|Juf~zN3 z$u@Bbt;odwo=WJ(dTfBOTIz~+@E@=Z0t`d z%W8B2!6#;l${^|-3wh}-O8v^|^a(@xD%Gv1?(PW7JM6x^ufKY{)m~BQ;3bKKI|V!| zdI>`>F`z;hY~&4~7Qk-IUj$nqJQ1%bo?jWB9S?2paTEZ4G1F451Uxbb+S_J?^IKRL za5zM6Opazm)EmJY6l&d9ng4pjCvv!rcA!`>i^2%DmfARrwu;5v%Kp_#&0GX?1~b%d z2<%Y=Q(M0BQ#%v3J%@S0T;=ITLNxqD2;R9Lo9xu&Lj-!;`yYqaNW!re>S8n`2dTSp zCn?Q|NVRf~#^6|hYwR3X(;o88efq8M&{rGGpJZX;z7@c%)AKRf>nSLx_^@&VJp#sg zqGajlarbd(J=2$X)K9@@eVOUU4JlaJzTTfDKkn3D2-Ur3Oscd1(*n{QbCg9X=`12` zYv=qz0|a2DgPEp1FQpL3&O$ATWN~B|3J*ETO2nxoerDJh$7qK;s;XF9Z{G)BS;9E{ z6;Ee$hocztm-C0sRojTmV5qi{GSp@Rxj>b`cyz4EZU2J9RGO?6lEI%+Th%`SBWCu5 zPdwYc*?g)&RoROw**qM>c1jGtBP%uD{IX!la5j(h{}A8OBn=E%Z<}f#Q)y10ZOr5? zb8uaj$xprk&2&xt6M9aS;ggMn?jHGKu4uF+w>5rrF4R5q5gVe9HoOCg! z)7sZogp5NZEGhTs{xQ&u;1k_?rOQQ{BUU(yg%>XMGE&cw1gd_b3V6mf-PM&!TMd5* z-xZ8Bn!BruO!^j*hJ0=49*PE^t^dMV(E^cVtKCFJ9IJtWkcLP0!vz_|5t{;ZqjgS>-r? zO9f9_1jxUA`uPg!?i5?UiH#U8to{yEH{lMwlD_k+{@+X&ta&m_*}Xk^J)CZK_ycZ0 z*UQRuI#HU^j7{R3kM^+>i&L||X7)+(?0SgK4QL7Mg9Nw|61Vy)S^E4^iA9-~u?W?Z zzg2KhjY-=^J3@xUhWK1~e6w)son9QcwnP4AGa)&}6@i;~+g&UDt;kKcI=T(&GVEHm zTL;1k>M{HZEP$f74HCWy)a3KiG;AI&H7u(cL|msn!j|b08XIuyTPvQ;S4V)y!)1YQ z=iRk&UdiEOfi4;Ocwi*=d&Kh@7w`J_$dAbSZ=UsYIQ`?bexO!cARqVk@9v+|BRPc! zTLJ`$cE_h~h`Ik;eSO~F!u%Hj%U!+A`G~mJ)5ikmXK49?=?v+tjj?S59GQ`{xrZ9_ zaQjy?E}N2SySkhR5=>skP#_4j3W(87Ogmw<(#|zvp~7*2FdS9zX5})gf0(^d@H=zqSRLra2z*cNjGUWY+9}6kZDv7@e{#GN?mlm@zX95Yu_aa7oxZz`9ZG1`qwB z8y>Ic|1;mBwis;P_t>I84&LPDh>H2PQyd$*hgbcf7*2JLPHMlXbt;cDndb_(d3Rtd zi7wW2z)T~|ysB{*T`Hum*{}CJ)6S-pd+pK_IDd!AozG|rbCayzv-;<3He?y&$Rk{t zoGHEfXEWv{6h0k+{jI+SK=);x`Qxr$H}c=t63Uf4-J$hmhC8{ z1QAZOUM8yc`oh91=n4NaNeYU2tYa zKkZQ$Iqx_LHVZ%O-2Icwh0x*BNK5(H^6uvTh|F%MsMTnSwX9Ue6+}tB;{76+iG=aB zq?__VImj5k{&fP}2wgNCZBau3<+Dra)bTG~Msy~S6L_p|N_TQHs~t;!+>VOoHBfhdPnnvaw^x=xL&x%n{7N)OPN0-Q{91$_o&;Q*@=b(?u@SH;V&;0*egTj zwn-57H~dm&t~@dnHCVTWMPD_(Gi+O-kkra}cSjU&A?)yYkqLmBElHTqu?g)H z8%G8&v}O=7h`|+TWTp3%d#Tu#bQ?)AqPfS?4-4^Mgpn}nI!&vBmubqN#6uD$`Di~B zBuG+fJ=IIWdIDP&uNebbOWpSRao@_!7+b^C*)2>>k%r-KH!rMrg@*oFI%;t-?b4Ay zR~1#(I2_Y$t{g61Z*G5cpvwtNd#k~VnO81W5P0ZvZjhsf`nJk}zE|1&$s?Vbmz~=A8Y;k0D%m^VSGWHVb{N;r z1J@*0KO3dp86OTlh&Hm}x>HjQ^Blhz>?q0Xn$jp78$TV)n_ckw2uH3TJ1%;>|K9G{ zbw{w`mkx0c9-{^Y$N+2BmAFPJ%)@*=FN>$j@l8oEQsC?`mb(jq_Dbfx-@s<_5u$@G z?()G)$6TPb25B#z2&D!(53lI=w1u!vwENG?Ofvh;?7_ogBnma7&t>U^(S1S1qNo?` zOR=;jRh`U&x8`)E4SYvKR#<4Viw`{n8*lNqS3o8!be9DLBgu$d4N-2j)Hl)qr6T|A z*d432=Vw&839(mdGASwRR*r?(N)lz3RFVA4NXJ@omg7%_Uu$);jY(1Ds16N`+yX}Y zPNZ34e*8F!6!5ysMdo{v1bXRkYg-$tjc(Ug-_&=CBku2aNt!+d$%XIVfwuygb)h)R zUNee~hHHn3pHQ(Mb1dkp>6$Wpzgg7X{L1Pi^d%-3&Fu|)_13W(Lu@=*_gqzQ>VNxb z=jnJ)1Mg#%1zEU$^m!!Ayo~f=Le$}YiF!LvN zv4dck;cSFt@!BmW$^{hawZ)pp!~Y20?wEt?eTZ`v9`6a3H7e!9ukDcjV0VOCb_JbOG+lG=}^1_ie>6|`7q1u|8T1R18|L`p8apj70de{Y~}vJWtI`k_j5cF zee<99T7H1mkND#M$~G=>k2)2w0U2Ui@cRC_?1z6n|2QxA!`BmKyO{K2k^jE(e{9%) zf204ks4d&dIt4?=+hOwNVwKrp*L!-8mm^av{S^8_+WWX1F z?3gqa_4q;csgE-N-HX7nt>fj_A@ECncE_s1M;R>d$(6ap3oZ-%Bpc+3XMY50l(YL8 zIaJm8UtTRM@*5AD(-2JC4u*eH7-#Gv-q0u8k=M+itJYewnCOwiL(Kg^T}!?M)#zqe z%!ZsQFyd*mQ_Hj$$+R_7<4@h$P?Cr5Pxl{h@AMP&&rO(Wk0diUc}~FPIiS`DfFK%8 z>?&w%UDHR|Tbz)$!D6g^I!Z_t&lvKDn7eU+*)pN4G}^qHSaV$xCfXeqh$&S@a!f$0Yf2CTCW{Tbv3g){{VlE5uSW)wAKHQ&$Qf?zgO!%E1qaps|d6H zOy7j~0O5t$n$WP4=k!NsabjIHhr|IG9Cs2n15J%5fAfD*>?vo~G>nw1ZTL`@a{obi zs`rId7qx9=$7p4$42&eTJ#^ffxUV&boi8sR=8x@;*G&CJZDGxFx5;$8lhqZ<73Cyh zNd*C09u|U+&b_21?w070*WgI;wkXdi8a{YjlS>WANWf2X)UjT#`A+tcz9qb76eH;=x$K~y(F+-ddCwqwhb z#aQT#i{Dim)YpjMp%4zI6`~s3XN0EN$WBFwX1ByE^3x~?1RzC1W2z$SB)qS*=KfRV z2iH`juO)AE2|{n*o;0lbW9-t~Hdo->x2++exu)}Kxe-0FtN``O(RcN2wp}z@UqEw{ zBUVoT>rnX8CFqpb(>OB0@#2@ew8dZfmVftF5KF7)%6E5gZkg2kXCtzs^3$Uk)OY9m z=XNW;U0)kR7cHsRqdetU5uJJ9(tA}7L;I3+jO?|HMHzwd{pf8c1xe4;*eODiM(jai zQiCvB%BS>+ty9lRG5rJqtn?EnrX*Ilwf91<0ZcT_7oL@^U<#}6rr)L&Auv!ABeIQO zKIes|i55nvY<3bEIlI5{Sx!(MzdmuZy1lN_H2 zJDon@o#KR#f-gEgN_C3tH5Dae$1^Mb>w?|uQzDl?&g{6asza)88TbxJl98}s`+d(& z>1$^qGmGAa!ZqtSk6ba2kEH`Rl)BqX==pjDuT(Ti&h*g0xEXcN5A)zyrFUhf}u;3$_i-^a(09HMr#aY^-*d#{I()+EWB(3Rtas;+~ zWi5oDP7vmubtW*+4YGD{h;$ws_w?@oj2g2d>0iMa6bDm#?hah`D_HACIT$C#2CR#D z@QSY5Lu?6PMDuEVQwRH4D)gupudJ`Y$omq4e6;Fhv z1jhXJVOzA7qNK_So014Gr&n&NJ8&*GV_wkhfaPQ@qvQSRsut(NM0+}WjWBD4n=DkK zaLdTQt5yqSL92je6_Uwpr&Ram0#es5KGbQo^VREwZ658=_>>*WWf_!|9b65K5bEr` z+wKP;vn@th>3;_l;NX?l;oOEDi6y6DY0);WNoHD;F=6vTSUD&SJ)M-Q02=yr#55Al zDR{?E2p=h!7U9~4#%h|F7l_Z!nNua*C$}Rn(QNQnVJ0d+vO{MPF)9wvK-LJxi+sds z&j8BM#~7I21ulPTmk|^%6F##ocn`x<&;FJx`MdOw}0`& zi&@T)tGO<~th76sY19z)4f0{^LiCJFlq$NyH{WB6e*{qgdgNE|U1^#5mI7gjY|36& z5u>d*Cw}|N7>yu;BM)W?Tku<-4yh#3@hmUea{NR>(dhvf{akRtw3o0lTB

^_B@8J1`Jz&|QA86{CQ?^vm_``)R2`V~?|j?pdD+h`zumV+EDoR04< z(lrA*Up2HeFhuh$5j6z-*i|Ue z9a-tfs?u3~2+>V8ZSUGlGvA7B)1n%R=8NnmLD$*71XKbY78N~2$nc;HmA*w*i6VxM zo%jU9OY}fd;`Y>_6ej}C7IrTGc?;<`(g(i>81i`zYt@=FxG8Ir62WS&Y%{vx#z!u3 z)VTgy%k>YYJMh4O+Ele1Na@>uum&4$MhT}scXP_R#qJ8A>D!zOHorgBnhc!jrPZu5 zLLU-H%dGWvTq@J>wltd6CeYAYk_q$H7wACSkW6m~FgSN;@a7Fi3FzW1vI%flP&I)I z2zW~+COBp-3L7|IMCM6EON^Pl1tAE&UhEWy%ygW(0gr8acX0_5Y71uJprX&b#zYV7 zIDfnUu*kcPE6WSpeVQ;q=y|@242a9QV?FGjSWij#?An@X?quc~_dRxfQpNfp3=!>| zk?52j{@E%u84Z4Ga5tNWo(mIW2A2Hbei1Vmd<{EIrX>=}A5aQEjMT^?{z5FBb~&$) zORL2PfzT8^PxvMMM~6{sWUiz-s(ukiQhjoJ55CNa<0edZZ+4ola*pd&9|@74XN9O! z$G!eED@-Q@938(?Uizehm`q=oEU#Il@{b6|F^c*i{cS)Mr%6~$!jpP`IB|E$Gj0u5 z^;k&Fa@im%Oc?N>STv2~h&r%bt@S9M4ZC<^-Vk>GvPxXN4N$NKilNY1jZtMKKFkaFTVd|2!6Cy{{IQQ{s(aNx)!8Mkr4#H zPYB7@nWE_4GH5nVm}{+W&R9}24K|p5*~dm1#fX9?wlW(~ zPNJk&`?SBO)3klqh1548iw4PvlgQ zU53ZyG?VheSG3|OQA9X^yx6GP>X+lWDO7m&AaSmj@tS>j6Tuj$ap8T~ykvn$*NQh^ z2iScYsoU=$_c~KAw$Jo1U~^KaIU@>5{T0DFSbm0$m@R^=3&ei~Bl5fT;k~9%iKzpq z_x}*E==H5_+d$Mx2ZKjnF%&ic?*7TC$ggbex^;HD?ATXfSu+Zzh`FRiZUr1B`YdC( zUxc}ePT>)aL#aA%(PB@hn2Zta!6>CoBTI%9ybDn+_r6qV?j0i|W4i>j{}B`VTPh}; zPoSTGUL>vw{_e`~_2OB-nz8XWsX!6CX|eGxQiG|E*%Pc_cvHj>rBmC`uQQgRcS7D4 z(|c*pee5a+@}0fn(2{?)(FDLOpYaMxOHHF^-H^7}M;_nQ`TMj37(sePX}R8(<^kK+ zmJ>&3klJGWc04~j&osQ^I>7OQj+NP32aU_~$w^BUR%>&6wB}ICn{Jym z+WO77rY!#aLTwX;3qfZAz9NC9kZ-xlWo$$QHsWaI2_<}d@2hAHayz}SSrA+{@22ZO zc$K+Ub6H;R;|kGDCd_)2Ku<8Focp&w81s@&8jhCg@VFGWW>Zi!fe`@mzG>Qc&pP?; z__#*g4mUMItIpCrh7ECBiN|01bWnl+0EL?Xi)K&7e687LW@*nJ0a}s<~GvI-Haz)%~wVtyK z^5y{kWHNI6d|adM!(;6AB^4%-!P#8bU#ztJ?BfJp2v^sGK~~a%$#^Otey#=v({x3u zdM5QYphV9<3po;P#pyYb-7PjdSBOtJm}Ac{va+X*L4T4I*gMCc5E%oJmLV%o!DBXN zm76UBGd-jguc5VFyaVW>(UraYp8PPBiEd=ZV0&(Wlu6@wUdDqplnk$N`fc^MPPQ3ERF?5PN+59+5%ZA+dR4BK0ERThqBV+Nzc2o4pyjD_QG90UyzA^l!q z(l4oS6#{)Z8@QT#3Og{iYHqXt_5K37ss3Df6yoi$d#lck`VZW4sH~G5Ng$yv)z=8E$vID?YappNvPXw{fBa4(eLxh*qZj6eY zxn0av9Ur-d4^gbh)Y;u2g{rs1yd1NPDNf~@f5(Qq#QSg}8Sac((-jInD zLwaBvmB><9QeYi5%|*T3yU2;$7JBA-*LC(~tJw8Aq4f0y`Ihi)NhrjgfmjHi)-pS} zEj62+gr!ZiUCy{~eL#Qyg(aZuM%GT_412LJYhWiO(7Va$O$%T}SQ}TKAAKb5tR>^v zihEa;n@u#go4wiiHb7VmM@k&jJ!u5#jwa|fz+9Dkh}#&k!OSJ7%J2k*`nM{`*sj!jSs^>3EOeZAuR$}3br-;@8K&F@ zw;fVVujZT!Iq@*oRUw9jIM$~e^^)#ip{#d#XcT75gL9NyUNySHl|=u{TKxq_cx1P> zT(V$oA)AzP@T-y?d8P#xlFmScZ}Z$pdKGdCTZpEhxYD{vmz@>`*)q+Rv%@%u9kv>0 z-I|Xa1x&p;XW?tR-V8Pc@-S+IaUE$4qcH&kaYIv8BO zSheeG7pM_IRA8x9%hd+JCXLPJ8R*S(Ps4k-^q+yQit?$`LM7v%wP@`G2GmMz$38jK zzEW$sG;N8`nDv98`Wwq2Y2maj+yAqn3~1J}Ejtdb%NnU9g~Zk5@Djn%v+;fcS*e4wfbAu?1=iND(G>-=WsXjep(D!`a;wd>iQt;JjsOf7V zs*bBG+W<1;$G)?CzBh8s%yYAIe4dS-MhJX7-#&4_4mf_!d>($?ZZtG3EL?wmJVjFVfAAd?!DwZoN@;$=0JH@DJ4GsAOy_n)mu)_4f zbd5`WWX#RzVcxu0`Sqm_d?S&b$NKCSC_=dc656gD+wm(tl6s!k4>5SQ4LK`(wm8Wt z`NYPDem8>)=sO zS<|?dAZV{+FS11Wt<%`a=M|bGb=%~}Cgk-1+Ap7Aa27lJ{}kWrO4))FP$iatpSP6Q z>+12VN5kC@pqK3c7O3#rP3Sh0!)zLn!aj|aJ&FS5x$FW}Gd{R^9_@RoL)j-gpVuLg zY9cXm8)g1k{=2o^FJswt4S!v?r`h{_D{ijO0SyhGB$y3xCKYR{11TRO!q*(l@LrjV zH;-Qd9M(hVdE}tGvp>KAJA^}fyo9FI8eO{?J#X}9lRohIfzYDb5Mi><8%-;L> z@V+mP^j&ZY8NzU$+Ic6AV2X;)Ik@4|VKSGmH8=tt9;ZF(jh)^H)=ERyvF^L@bRENu z0R<~4XDzaPAJ{eCiPudxMI!b7*O!GKeOmY-Jl(R33gdh|AnKd26V=VSR(aS$kDyVN zNMIj(>dWMN<>Rr(XOP#k1tP8+8R2c@Lzn2N;sTM-T03B1<TsJzm9u08j1`dZ&L4I+u3M$aB&3fc-Cp5&a|BFLlIAz^kopwe8sR5iNYMg&D zK11z-)xVmL!?2KWWod`ofA&O>a52iJqDRtMslYE-7g!!6mFWie&n;#d5exe z%sX87Hvois>oZF- z?GArE=+ZCCOo4p!FVK#o-wwj$Y?zJl#Qzq)Mj>6Wqn>BHJ1aq#-6;0pOc+OweAKgJ z(0h>{;MaoC8pLCmJu5T<|K7*_>2U>KOEGr4HL4*0her{u{V7w{Z20~f@1n7z(@oAW zN@YR;8c9o4!zdjPBdmQ{R7sDw*VdyJZmsjDCyugEXQFYgHK^mkds^=4PgrB2$ITy! z=4lW6iYXPcKs&Y+s?2V#G;0{;m$%D-`O7|W3Axq2aJs&nB4mviUeAI^K=@(0(d<9| zbu-u4VjbW2ex_zPEqLt?a_c;vYIH!;(iUW1odkC`eaBBE(>S=OgM{UMAZm*MFmsFI zy-Ai4Q>Qi%zIAm*;TDMMN7M876y49ORM(RWqkWP}dM46-T%+{E2TYro5%e*TL*NU1 z1mA9VTVQ0ijSrXS!SVZOcsoY#kEbz5i@q)#~5MNs%FXfx4FKG2OrSRh-qX>DzET+n_S(_qsv{ zx{N(;?ft!z|0>VXJ(Mx|T1Y;??OZ;iW`DNmBsDjZIR#7$)_R29>$akb;yh8k>LCdT zF<)p<2scaLj2mV@mo*hJei1hEmtApY?%eK7!xE$QAopULRk9eXT`Jqtuxw*fw>8{; z5KLma#l^v89qqc0&51F1)k1GxP^$>>B=K1-rJ>`uEWJtXa{-#Cng~IAvD2tJ$$kpf zF>PVl9oI>a@D4MK_F>5W@Ef$VkY)4bL7+`}{LjrtrbX}fW$YWuy}@uOG9MZ2m66Gc zb=d`fhmSegGe}1`WG-m4L0_BOn_3Cc0|M`rWz9w z03rdMs^~Uib<@j1#A@q?>`n%B-lu^H+RIRCf42&%y!oz%JTfZPMID6awKtOJN@P!f zU`R8)9u}^?lYz#tc%x z00;`Kal;!y4Mi-O8RNb|DK;J1$)6(S>54!6S^p*wm>f{Cz>DL!&Sl;nFpF@$y+a+N zb{}Xs6sB4A#N3-iz#m%*>IZoLYa`ifja2`WzX$e_B&>>!IWEzUHtU^+(s?ptA-;?x zu$m>Knkp-nJ};r>PQvs&ByjVb_aV4~L$EJnJSEqrPLUJH++TE!g6GylibGz!wgI(% zty!PpYhJE_h{I>Z%6J?vde?{jj|YDp5H)!dIMDdV#%eEeLbtvZSDo$%@pi*?y5kXT zxBy~`qiTmL>w4Fp2B%VIzE%c<%ig#*E2<^cWlQpnr@st8VuD;`s$b=+#=DAc%fd?L%J* z+f|^AcVrDncPAFw*(|hE@H3)*#`F3Y@-Z&9Phm!KZa+d+7SK{6>W&u1rmmF~Qp}exKK$01`YY?-0AvL`Zc4Z`jTqUwiw9MH?8Sf^O;h(3pS&AD7Z(S6c~%GE2lEZEe$(7ejItd`pjIL9w> z7_3%;l zMw)BWIb_XIhgcF3-+@9@TQAFG8IH%z2b0!=YvyPIyc7X-KZWIBs5!+E#&~%97zP}+ z-H6sifbxtTZjk7ao`rK)8n!+t!f<~Io{fPvU*aYhTYJ?-m;X-qY$L@0;?=fTZ9lP$ z3IvAC4$DT$?Ru3mp!S6Zt&_AmNV*B9A+D%=f?rpo(I^+0W7)3KxFn=RB+mxEHMFj>L>HeM^$^j(Bu=p$0-|6 z9`fNa_6M1QB5(jcOcWFwEd4lERguBr`G)%KB$0&zjJS}xq0xdksdY6d1P6*sSn~cz zjtvGJakU{6I$EULXq=sXHY&fl(=)@1AMRv!fZ$5JC z2IVzB6NbN^6wAphrV`0snl_T<(-e2MZ~>LtP7W#^ne#0l=tmZ;&?;ngZ+55^cHek& zAEdRet@PWJf{WFiJ%10f(l@!0Lon!H0alm0>_db}++B2{rLg2~HA`uBoj)EpLr6W% z#Q(JAg84a47Z$8QSG)Fpe!9ce5mIhHgAg)Dm3YMHY2)~yc1Dmgn7a631)Ia?^6xS~YBFG;q27Xmv}% z<#(JK*#8>`%{M5D;7$Rx?(dmoNdY9uz07hgLIQO0(Gzy6*6dfZ7CxSJ1r$F0P$naP zZn>|kfx*52T~d*6rg)Y@w@ZE!9m^oxp`^2|MhN?i$t{GOn38q{6MM;LBAWTkx7lhS zwY|IwbJa(+9<7Yx3Sph_(s-YSs|VKwzcbGKxupBZ@ltN=b@HxkAh3^_paQ+-ws`7O z6U)}+*&4IfgyEENSYt29;wcWN?g+*`?%xu(R}^|9rSN^vFprd&6FYt zn-0Hr@qKEb6`3(NVdp^wt)c`*tD;GfR}dmj+4P&SC6lq|6BMBEeNk>pef&C=Bks)Y z#y(vuZU4_73Hs5YkceY9-m!HW*rY_0GE*z1;r3#72O*wukRHSd7Oav3AFN|0@3fJo z@)IL49Ql*O3~7jIO-^H14^vxba0R#!EJYVW*0xH*=@SBQJhBe_yuusOi_4Ff{cIhM zRof+SsW_8&wnGquQaz7<)+R4Kndw=hvi0;2q0Xvx{0x49&%;g>&rGy6qR&5xCdO8t)CUY z+rs5l9Vt+V6wy2hyMrh!evt&nyaj%$=f?$4pO_ptp#huiHj)$$6Fsw@zi8(ZQae~c zZKbk~+duoMn);c^K!l6Qj`b|(GgyGk6G>RcC|Wb3-=hD&^G!7uX|hv4vVJ{zW&Gz` zAMB7i3kiUgn12%!ZzLIj_ZiLQ22aBRzk86hj8-{8Lwbj0m@B0g?(kJ}a@sJhcgtKT za>H{y2}X&c{211@#4V;>rR*gv5j8tm{1~6!g{{Y+{g727lP{WaB*i|XY~uJrwrA&~ zkG2Vo%LC?WW4LAW+O<@SY{(WUCu_39O5YP#Bj+ktbDY|C^acP*2L+iabPG{f5GSzB zDE=~>Caq!-E2;^^iwU7i0q??s&G|mUT_J zwWbnX%dU+(y5{6$bgikH{_UOBsCu98Zv2%N@IZ1gDzaDw*IsH$Qm5X%x6!cW-Z3o< zglSQJY_Y6R9EPU`l!)wpl|#H_<>#{aNEPQX#2X%wHNpXop*TThrhe zN%nP)dN?W(iR{R?6ACV5uyv8((x?{PD}W9r8Qo zs88KD(9?!rX8(kw?RrUoMJ-AcM|sSY=XSix${CwKPLk9wEh5}rIGaxc@D*r_J(wOP z9oQI(E}v}Ml|)5Ql|LUcep;36IIJC4`c1jmuvtQdIoBDOOsQM_uFhklYaL#UE16`Q z6@r~pY5Av2AoT1<_yHW)=re*?MK8qT*b=Q5GVg?R z?b#^gmPI5_ymInluDP)1UF*K1TBCfCxvXw^mr0vyyz=ajuf*B8VktIW-?lqo6ZoWP z0kL>dPh16%RIZ*1ApYA~^(J@yo?z>M@BsTV+5&RT4G-nrrn7(M$_e(3ZirjTzF{gg ztkgE7pNh{38Q6k#%4S;QL%2tohhqHeGBY3(LC`gsc4In3O-Yht@!FBQ=3);t{_&i` zrfmdpwi-6a`kcRsQQX5eAj|ZPTiz=<+sq^Hx!uAfFcQB?ICbq0BpW>>=yA)x22!5( z+y=`y+F+a+>R4&(t_aoE!F0(D4asHTfXc@UM%vSBDMaKk_ED^+-v674*M?c*_FCH{x+uyy(vu{zEzq5LqlMMT2aC^PJ3$@k{r^9ejh z)F3GFj|(xer8MwXKM(_i#~kg}6^YRUE6o}L{8n)4epYAV`o|1T85roc2VJ@c1>48b z7$#2X-EMJnc6X%{G&LP?gwg!3c83?hpPpcycxfRM;55sLZNKyyc#z7kSGGIS@oyIrl$XQd&e}z(8xzL@=VhE%Mbki)P*f% zM2FJNdYyHapPAO7@8Bw7HF>Q!XVGnAJgqgCy9$bPYYL~NZ{O(^Siio%XV|yh3Xcze zTC1y}!&0^Oir&=A6qvCNOT2haTw4s)%B8{dE6hNq#o~F>J$voc6bonfb^Bnr)#n`5Kfbcm zWo(i|csFqqaDv*0laBCseFJp+F2H6|E=6EQ+!GYPL1S^;Y313P%S*l|mIIgBhIL%%X|T>Lp;Pt~3gX42{TM z1Pc7!as5MEfG7eW2sl)*2hgLFt8m)?YOqv|7F^$SHeIv+c&S;G*Cpk>pnZ*A)|UMJYwHCbyY~ z35eT0ZQbFv|DvymyUER_|6cjo8c)qT)eSbTP?ofa{4y#S^eJ^+M13U-)JqVff zrs@V1&Tk^30fo!;__lVmibflgvDA&m<)aFV5@BKpTI7{d7P<`T0j+PWwhKC~J+;a0 z`YIUS4ZUXx5*kiI~|?hz`v0S zI!e`oMk13eO=kG`RBL5v_+ivq>tAN@3KLsmISweBru@kroX+-|j>~2GeKE(3TKm1` z_Qtp|R*-o+8eI7$mwDL{Y&I78nghwlV#Gr;nd~V%vpOJzIt^o1Yq;}R^PkY)0e^as zO*VLCi7+WHs2J<{#l0#k<9bCyg~s7?B10e1G&FjE5SCToDv^o^i}8vQPC1t z)kQ|tpfemcD`-_J25~&Z{-uYhjR{?ou#wGHqM$v;H6jF=u%QpZF#cm+-8FzxLp6YF zpz+Hsd3(M|?vYn~jG=Lw%*pzDLpLoT9McrhF-Wg#piX}*P+Q;vjE zma2_8U@s|jHi@u1b|)!x`e(Bl*lz~Sq+~ILXsA@s)B{GeghJ3bBWw`u^iz_DHM;+y zOcv+2!TN~$I7&6uLopR2;_Ik%H=|ENv@_>oF(e5+-eqNB_TR<^$B~S1;|JDX;;1)~ zR@UcbNP;%YKO=TQxAk1WC@UGf~aa^W7l$9eE?CuXmU zvO=34fnsu90&KZ@<$BAwaMjJJ%Hs6Hd_rl0%9FJTz8I*90~1gQc1puL;n&yZ!G7%JG4(O;5wggT-2b00Mwa}3VhbTwMW6>P#015A{0g<7#iswT?bC{(f|BiIlHnli(# zm}bxu!VQ?Adrl&^Ad-=+@vPcqHgYQ|STX#`jIlDISpTjub1KUeEnOYV9)X`4jk5%2 zFk_p9D_Y`}%He8d`+0a>u=r$7tTFK(WpuyI(#KFId%ii{o8SeICiiZU?T>S$WPr_x z8;;9pHAmW{h2tb6qxrL#O%F(65Qb&wHb>}6xe4`%ZVD_0a$?Ou(0-cODA7TaZVxzo znysJm79UTKxBK@!h-#gssin~X$WOv&x!H^qR$9x3GRS_4RAbOU^Kqj_Pzyj!I-JTo z9LYNz__bcIi*?$1h8p@}<+ikTrr`xQ8o#4`y*dj=YS8uR`Ud;hMw&uQn&oZ0DB}$$@O@q7Gs2_U3N#48ie(Ct<{j6)Pk$qWp;5Es0&f!WYbEEmq45Z z9VHUhdCC0;OUfuB#g)2ro}}WaQdy*SZ)33g`FBE4vsUtt%}Q+SWAhtjRI8m67&wVsZdaxQxtXH?bjH^V5u5h1=|(6G1H z+&+HtyTj}BtT!yw@`hJgr3J5Q00yCo>{u$r%nnhut&D}R>sAbb{VFxLN>J^}L^SBC z{}j=%ZbOewBVNkaUmL3k89%*{3{j$X%!U<>_0%bcmcpnv%1TNzW+$QHZYWuq+bm-9 z*@V0vjvpjm)G3?E19j005VVZN##k%k6u7PAM&-?KH#o!bhG z)>yQJjB|cjEp|HpRE=b6+~gBi()DSaQ>+cT^s0;^ONp6>bMw%#9{Q(e=JyI7noDIT ze`EQ`akQ#C>R%%kRrXLe=F!1~)IaH%mqVzq;E?KDf6M1p^c+uL*YpEtDzj-Nn)3#J zP9LB$S^2_mUnhuqd_p+74-d5Q9OruxXudtD@I~qKvu|=ezG3lo2YcM+J|>My&M{lc zYXof-tkKj>0-*zF%;num2#>ESS5;&kcLra_eA3_c*W`W=A8xf5XPBJfp09kt4G5-o zW!Cow{sg<48D9YPB38PVv1{7s?qEN)LxhL4NiCH*60*CFFmTt3?^1;!<-4IcHMHnU zYv$m(q}fC?kWvkQ``LVj)a7zyyuWLR`#ixWBC_gUH!1Bd_z0_qDbi5^EdI5~ogu=5 z>|*5oRBit|_=de-6;vvU*Z$SXuN88Ke>%J$o_!s-;d`f<@ro#xn6f^-dcqMzf2`cE zz|R?ooSOr51yy|fyUTLTaWOSGBbrcHLDXu)!u)pMzR&Y#MWDvbm5ArME`y0a2<%7Abo?#=I*cDiAcZIPA8IGdhf!rOK*%L1`gGH${jIHnZg( zZ|ENYNcbmXQD8YEXG2}qCJ4~?-X8N?YsF~CVB0@0veMfxn{^(F<|#%3T$M!yp_8vG zI^^j^XQF8@E!BdUW_78k^H#u9F?zgOo_ScNo}$i)mFhrN%sC1mP08Cku@Z7%Dz`vzE0&!B*xB#upN$KfW|<+!=Yc=X*|bt%c<%(OBpFEa#I zCMb*?F<_FYs0405RCE1G{+THWFja5Fu6e78)@j7(pG;vWjLJz8_NeL0jRv3MtkG!T zYIG#VB3^70s8$V4U%|`=$5b5eN061%;@s6F$u}ETIMmdJ5leyaG!wU>x)GtjSrR^u zZ;(kJyKmC-Pmy2?<_+sIpTbQm@OQ%WSR}1%6Ub1WQp1*L%0;7_%T9 zM+0(`xhyO-cA|XfKX92OU@CsT5KT&ySvEB-Fx4D63Q9NpYo$p~_R-BYQaFetTPy!t ziKzt*i}v`06BBmQ8?lD+sjdZhQf=IF;Bf-2e zjX$Xo(TiE8b>_F^EH<{?u{_qN2}7BLorIB^L=i4e>2o9}!O)Nv%Gf(06CWPgs?-)$=`Mpjam zBnQ4PLp_M8tQWp3^>L3q*iK9yc=MJk&E-%&>nUGLh{$teWpLNA##nWm|F=P-DNX|*~ z2H3eMwWy|4NhBwimz&MA+{UW;P-!@f%Usyy!%5cnro70@Nz~upB|q6MKT?07CQLs{ zdi%NXAFnehfn0Z?Wyvxhvn9(r7p~iZL4^asIhK5l8P z@wv8BPq@mmBS`+`5p)V>c4`GzR}?!4y^`7QvY#$J$&|*O)1^JW13Y&q{@Iy9FLpxI z)uEuD#L5XpFy5Ij2_pXs4)9XRnDGkh4{E%Ues-i;n$NesLDl2H%@KLbZ|By13R;S* zGs%>)^L?D=*v_Q?wFQ+aFwY^y6V33)hE{In=`lkmYD?1$I?L>@q?8!7==XQ~4E^^v zmJht#3R}d1?14BG?T%eEX|flJ;5~&b;T&y;leG_E6xfL#=+zLy4yA*U$dDbGZi`bj zfhK5{OwsGpRA$z3pZX4YJM>Sa=t+nBERFox>AQOY?8fQ15KvCZzk+t5G>vTUYnhz3 z?GwZ?)@~}To1=AM8W6&7=nND38;Edf7t?GUbV_9^>o$vkM`d7!P4(K6ixr1N2WNw0 zw;*@7?or&_!tz`e2oh)V7zXAMq44Wy4JTAVdgd{oeBwk)%6%>>+Y$HmG>S6%;raVq?$|iABECbKF zClC;&$>?}#%%^6>{6O*8{SK0>2TY%ap;LZX%u(Kf`W zCVdI&M3nkkI$o5S9P_wzd=sI)`GJ6T+11J7$07(V-fJP^R-7!I$oy2fLZiDA4Sa6V z$QG|}-D56!!P!y#1`C0krf26{KZt$VemL?Qv8}a!uNmD{%({h$yex@2?pDNjwV+{0vT78SJ0d%iui>aLw(9MCiH?$>qEN| z6b1o-3|>)#T9}H8St8VHPk|)X#0l|p0QtS#=lImjm$$qQUsdfdTw9Q3uA2x=OR+q? z9`OSuP%t=_NYo7D7y;Fi#`IQ#DGC)zAzg8~v@26rd>V=}mbI-hm_5qz2KK$}|0i%L z3OOo9mCkzS-DJAE4%+Wm#a832##l(K`QDYTwpRS61g&%7pCr1q!*5XHm_K@+?Wi>? z3j|Q!#mXlNRx5uE&W7*Sde-d{)yVPj57qq{72tQ&K_@M$STR-8kIgo}x()NCn9J<( zHaC)BiwY{%%fFD&vTh$K1vp{NtmKQHVcHJ8Y_iqDwN3~1Cd1XfNYSZbKqHOfj~za% zMV!A+1UhUpFZ1IOg7_E@wVOi0Yy%Sy4J@;<`&NP&Ci=ri=Q*jjvh47vn}1vm2l z0)S|mjW~!sx3b2^BAU1RCbWgJfS{?guNiXm}>G%C(Rd>F<8L#V; z!F+DYS&6L?u0CsEqKX&DtZzN6rYy{oCom#)TQ%)=sy!Drb+I!78yYEMTzSksxNjA; zw_8I0AZlXL&6hv>jA3QsMRYEHY^sVEJZeMEKoh%kn3%?q zQR*DgqKFZf=1xTDa>Y`2m`>fER5TTqYP+u&ci|lA!m&V z=uNrH4t(I%Fe>d(U|hoFca^O0NLnu-Y85aW&rwt->Xnsf&f(Oom39I8RzdTMgxVR~1i+}^c`%`kYZ16LqL<(o@Tyf* z@3^|iRHC|BKoJ4I>>F+M>R6v*A+^}_sw&FnMhi0no9@@o0Yks3WLncSCRe-&8`&Xf zR%`ETv?et?8NN1-uq2}2p$m~4&Bi<~(|rlpz)rl`K}u?zA>J=UfvivhshDq5`|R6wdM2APo~_b znp4omb5>>iGZ#<&aLciy1@iltp?unDCnGoIIrF&~>SqJe>UL_CGGo zg)1_rbl2b|HGACXuCvn)xFIU|ETR_5f97qDSlj?^U9djO_0m*Oy}zmwGGXt$jSS1I zW!L7Vop^s$KLS^0ceKz@maGcR7ohEq-~$WvG7!wuae?-3L!+{BYB6r2J!lNp>{W*A z;$GMWpHJ@%){r__R?!u|i`y8AoztFrX%=*7+q;9eN1SIN?m=PgC_a-0%3~s1^?8r! zrctHUOb%c1A(L5ZmRXr9O;82pL2NQ}aG1=TAt$3>FhP-Y_n6*M&FAGKi{F(^{VuOA zySUHLq0yma)sxFiY1bl~?nWw^DDNeDAc!V<`?|E(^Ld0@KGGquBIsIajF+S=;g0fb zsv2=gFe1Z{ro`A1h6t2J0RfShA^|4$KT{E415|jA&?(=FNxw&6>|SUTU@B`5-L4HQ z7vDxvzbYggnV9y~a@My&5sIvSx+FDiqNXl28CwKZ3gE3P`0-Z~#n0izPo%Dd#C`d7 zod%(m3w4GCWd1xca-yMVr7R?&#q9h#q-V-PA3er@)(Vp_LV}Ql876=(hh9`n#oMiy z{M*RJcUqZ%-IU>dC*k0NRuzzW*JwKGQ3sbtk}DIjR79s&5})h~8uuq4MuJXH1LC&u z>sV(S3~~}imsd#(1wW7ejJ}A3zOR#MhU+61f_B`~DAJ#py-X0EJ3&;`zmjyxOERhG zFi%h2?#cHdNDa;P_nrVDbu(&&mTx8y15oz?B_;P6Dt7&sX7z!Lca0~#X4;qf_TZ@p zK9w#HvAxK|;KYbM_DtkX$JpEHYmz$6cx;kLg5E)c6+;ceI;M^Jjz?;k6R+|IFmd$Y zU=b2(^r}C8&)duONP(Qs-)1>a$XIT2c@aYR3K>o5AX^IK}liQo6JR>ntL`T&N_f{XN``{HQ z2-ZujCdk~6LwE!(+~)l~eF7q`PC&CNXH+*Zmw;gBNA+Ku2%YtnK;a^9%LzfD=SA5KkX?>R~Y32_+d&EeSdWi-hT7%5SGm1(p}5V6;5 zc$iN`9M0dc;2e-Uq+&SXb+Yq7o(DMphG~^DLGHH z`iZbTY|Z8{o_c4YO_t;Tcvjss`pBU@J-VbWH}w7A8i3gUQ;XP5_RSXPqEX6MR04bh>*xe zxNYcMo$bC+?7Py5&&@kHSPdo;0}8REBGJQU>P_1~6)eb6iJoly`4rC7&L{{O>pK<1 z+S(cRLYwUtTitQZ(`OhK{0pn5ic{<$_;{rPG*>uQL96d;t&Hd*lt`>oe6`IbL$Mk{ z`*pZREpB~#A~%7(J16$WgB2ee|18ojh3g&dJF^FFEVf9|4mdm%_40LvJ&67~sw7yKq@vh)_shRI>6+G6OzLESYg%pYo8#JcHT& zY0xgHGuBKs1^6JQfBaU|XSN({vISqf-0l;p*2)f_YJn!pQFY`wu z`}sCcXW#!g{2sF{)>#u6#+#-v=XDI0ac&qTYCucBoqZJB34VDM%=?>sbb>IHS$1e! z7tZ42NlB2sR8T9X%6Oy(xB==wP+0`8%CJdrVNy&hdl_MuR?|~u>4NqWefby=ufxCE zyK9+(K$Vd-(?X>P!#Qi)itTII#R!JgUoy=io#5*!gKgi0G7KH4mTmx>9@!!6N4r+= zP@UXiG*3d~MVOOIgUEn2!KhB3XK0c8)PL>IB zxA!kCEh&dQd^}9iM<#?M<(T?3d>bS%D7}4N*~omazF(>%eYaPmWky)p_5Q)PKt=#! zJHPDH_kAn_7PahyE*E3ZsX^LzVD5XnYGU*pAT2p@4AwRvX0ml~prjH4CV*Kkxm$OO z%M3yXk}wnk%AcW5=Bib$p(J!e;hZmy@ z8-lR>rNLz*(u9FtwPXBSY58B9D1G;oC1&wZg7daYdYlC2G#43p959bKO<)NNh&ev$ zFlJ_x@T44>s|Op5J6gnWW)4R;O|i>?h-o#A z&ThBqc|fl%?c6Gefs!!<{q?VP*_GpSttXNE-(tIUpB z8AcH~m<3a1=Zv{%f82PSUJ*eZ4*17@p{u!on%|y!0}y=w2BaC0Afl?0#anl~YrYb- z>QaeBtVi9T5Gn{XES$_Llq}WQS8jz|7HVd@W4#|FDnjGVa%Esx^1!YwW!lYU(nKk$ z%Ak++7lb|Vswc{%8&81YkX3|7UnUr-aHqXBGiUv-SIE>8mjs+l;Wts@q2a8@c9YJi zwe)$6`k$ClYFVX2^vApXm0Dz*EuS^tA*DoSx$Oed7$`I<9WNOZ89kh`nCxh|6p9O& z$a0#nRolEB3*XifU zU?UUz≷3pb>PFQ4^FiYl-%T22-5c4A=qOEdvQ`r?zraTLExpG9bi;w^U@$Iy`-y z1RY0hGE`1)suYsj0kzLw-^tUccco7PrXE|3CySd-vP})?Ya?sOE1DXkUOj?bWc7pp z9L4TE*C#O*I_auDl=QNrsfgBP@C8dC1tXCNxx>%xFn?{g>wFX^2Kx#xCU$x0T2XQ6-VnRyg!hr%}mqMyl0mu?;zQ49IPGif4W|1bH)j)8g=FB;eWuPaAPXU77TjQ1W;DX3hfsLO!vmP{< zuYc)yIk0%q*-oUDS%npp$N|j`lgx0J?0k#p}Gfqh59C7FyVfiKrr`fW0MBXo=NLdm~0$N() zz$@`8W z^E1Sd)J!OhWXoD>i((b@3e{N3N%y>exzLauqz%6JqznQ3+BrpaZ7NZ}RL2SNG7-2F zhD~zEl@v<$U=j9!H6&vzr4og^IcL*cVdfa*>DPqDR~m?m_3al}<)1LqZRsdjm8B;p z|7h?Q%pQx;rA_bXTuWMRnHumt6I|i0X(?$y-RorD(NWt^(56!D7&Gb2Ouo~q6Ipgx zM7DpB88)DV%;WbTZQPQu``NKm^`tfb$)L$k z{BeGJ-TmR>`gq*mM=USq|2}*T_s1W?@8kY>T&R2D_w#pg@pv2B)%!XAcsS;NTd3nt zc|L&nxm+E>Uz_qLLE-%O)Sra4uJr!C@fS4bV4**RhAXtl6_9O{{x8DgjEtp4e1l3v z#fIX&nrjT6_ORSveGlJ7%0(glrY}L{WegkTn~|{S+BBghPNGi6zqH}|`|f}k+#tS! zUygNdl1ADMIO{M$16cMv{Y7qoN&o@78yPS@G*`o{cgHMU1IkG_vy5l5dU@A}W21<@ z1}tWLV_pKrIvb2x%oeHQgR?0e35)Z$YLm>0{lHfr4{SE7y<4|41MoLUN zZDi6StfBo|Guf0%Q5V%ZYWVdPhYpb6}NOxQD+y%oYCv{~kdrv(Mi(<{C)FnHWU_ z!!CXCsI=m+$-pc4#wnpF+uL!!D07N9!^v(q68*4i1_IcjTr7eW+1ljaY%5cfi8p1P z4!z7kRvy_@ZVZ=Z!MjRR3tr;cPq8ARY($4$UeB6{S|}e*)cal%_PVM4BED@@H6zgW zK#}2L15Jl935d~Ayg8|sC$ou4r25(vT?z_rnFyZH9H5fWHAJYxA2P!@P^+8lOFz;M z#RK^DO+R55iq|wNm`(~arx_c?sADJqO1a3AiE(h&B18)nJN{wq%yn=e8Ae4KXB8Jg~ zp)b%GcYQgzhgr0#VAa1sov~f-6Q{ZBKd&sbkI1x7ja{ENo-`u;*UM^f|3DzZ z3I^NauZ;p;DF@*Ck&xpKbt4EH3U|^pMZk~a`}U*p;Fyig54FT%QiD+e3Nu`-dk0?q zULkB=A*Y0Ld~)gECI5@KOZFd@5Ba+3fqcJ36!8m46szD2_Rj!2_5AB{=|p{6O*S@D z55GZFMnh9l;(4ufkfIuoIBoC^n)Nw0n?V(KRvm_7bn4>7NjCUaH1woVtwsj2a09Yt zRZVKbfLkDXxJ4d%Xzwv}fr7oY!DWRQCU=;q?-D&|jC-A|XQ)k7gpcI(m2rsc_RtX?3|NQIyz!F?m7GRt09&T z>9LWNO0H#Ldy0+8O5xhUtx*L8tp%mbTj%#;j*-MFQ@k5q6>qwkbSmMW; z8?cEJcng7%$q?AW%zh3RsWisY3LQg7b-i^13%FAFHr2WQpfn8v877)|9dicd6q%BC z!_q0q`Nci15-=1TgaBq^VRb??;RGAGDQs(}c1)IV)(3WXkcdpiE1UUBK)omU64L@q zq_gW+kBdRsnI6KeDsxEp89I+iK(NsORn}4z0?dS;tnLI2>IDesNoaowsdZ;^fQHjJ z`8@>O3HB(IK*}FRPhu3^YOF~3KTK#!!VXNYtR`tR&}uvcP~G(Q`b}ZHwtwOgUgK1&A|}N=%TbGFOyfpi zL&znhQmNR~qQ3?K$rT}q(pn#*T>QiA;h}qa(L6JWZE8(5o*fgN{ndEjZnQoG6T9_5 zR4ZQC+Dzqbo7ovS*RDrW(*nt2cO46wQS>B)Df4=ux;B)Ne_j@OE~wV=n<3s0cUY@; zz--zR3PL(nUW{~_3e1n(X~D-RhHgaSGdaRvBKX-*jRcD~;>$h$Ol&|3GGFqQX2le; z&=;+Iwvf>cq}e%>J_n^0QDh8HUU_`TYeUe!p-{90@zoide>;k&Ha1CooR~f{|3MO4 zgdho6p9&-1urKq3%XTw_Hz{z`t94+|_lSmo=aW=1@6`SnS6-AX1n+En)A8PPqPLX^ z6+frV{v{pjUnR>QX+`X<{iOKT8WFDxW{qN4yzVWKNETlM9rApwV%Y$@B39)Cl{1@1 z65<30e-ePC1qCMU?G=lYtFPBT^`gTO{8PWkx6W--2fcJv5GWNC_|nJ7!G>7(g7=Ms zcEy0lt{$q(^i^t-G{3~S3|VqKDRQdnO!v5uG-(yemSw#9VKV5~YjPkR94u(W8uD4i zy361KP&NCkqN4ydqwmO{q2X7dS59KSUb!gMcOKHx;hWbhgR};+fkf>8^%qgh`Sfd) zOw9EPgHv{++X=HrvPo+tEqZu)59h6(TGOcAm+;|Z_OtGJlh4Cr5z(UhFQ>PR;Ydc{e zOhSm=Stnvlaulx5;HGwfn1E_I(yX|}Xl2(Kq(VYkYBy(^>D69l`jsPQ?=H5UcgA@g zx#*AR+}D{QEk*!RHRhwt4SYiub?~@Nu{@PV0|l!|Baul1_*MdmaXqbManFp`-pdg5x0v& zPF9ML+@n<72Q_;X{z_-pR_=>kcwBQBoLN09$(v$O6WmaMbQt%n-fAeG`3wK%Hu@Jz zoi`^Xb9p+MMJB5@V@NmRl=+9^yv471#~TVXu}wx0En(&bdd2jv4x2i&1f7Eq-i16L zrE_5!ptj~k@M#(#XU1I$%Gttx9R`wt`V3Q_&Fn$! z?ZwVF$&Tw6cg`>`UaPBmt{Z@j&MSAv3pAO%h$#@JKvS7%8bXRq&JxYz6jwJ^S`C|k z>Jrt%y6-QhB=Ondw`rW|&S;a)fRL%}!i7|UgzW+A-WRAT5!lmhf)!6hWJe-yGPPOs z@msDPWFYAh;5WB9`f;e0$+>IWryLoV00siKnmpe3rgobS#FoR9O0vcUIRD?ox0^td zaMkq9XCtYdMwu<9NZ7sOE>c=_%;VJ*%t}1ME|p*9NXr%0W8`p8LR?{XW!{Dm{Q-WK zS!4_@lWeF3RKjPm(@XM0SV}TgS}lTVOi&i>;+SpO zf5YcF3R@!QYR9Yxk(Gd}SX-<@t_yv2t=+KLMNNW-uDkyIckz zPH5Yc8&@mPDxyKKSxA$B$U0Z&yA4_ZysluZPe=u`lY<3YJR>&}v+)$Xhqfi?I>NJt zUaW@zsMQ+pA&1pk#Kz%lEG8RZ(HPk6gJ1@NJ#E~@|LOgESQ84PwMpnPE}gHFp55Ca ztR-;y;w?PQZ8T67wH|}r#!RrxC_ilROh1I$j~P$Nbd_7RdbOU^Z{a-#3hjHTPD()S z&@k-8Ro^E5f@SD451%hV_E+&PSumbhPUe?`qV>QACcF=IZhg>albMs~a7|T4o<&lC z*O->$FpoIudSVeQ!peuBtpB?mCAJWeool-;`Jz~TXrY9jq8*m+B?K8p^A&C-A=U?% z|09uZ%kD9phuuj}6)Gs2Cl;SLs79bPqeGsq(~#OZ2B=Yziwv))G)B{s7Apf}Ld;=r zTitbBi6kq+S5@5(;Ve8FjdT^+slG<|kPLKx%$XtT?Y@uLR?am8oZW_Y05ZD`df?Y? zH`0efiq&j->nQh?bJMSJ_vSrewZvUvmKeR1v7^|ECw_XuO^3bC)}yktUS zHnIl40#q>R(IsKGyAu%JHV8K6OOb>|)U_Hkg%s@mYB6wvLM_l#iWxb>rzm>ZcGR{p zj@p>3M5#*J@Y`a}gqwtch@PR7jP&LgUt&0SR(2Q$D_&~Mm!5F_s8eIs2Y&Ac1XHD3 z$;?I`99J9g!C!(r@TJSBwMpQId}}^xYcWjwmX}h)QI+9*m~*xDOYLcqI+*Q^vD-Yq zdF0ZQD*OC%Ww#S3(&iaIcR>1i!Sa(HZYL+Ja@PgNE8E~Z>abjO0Y6;w)>CllL41X+ zQ$DLG%V3dH$IJaUA1a`+;h;&DxH($}^C)W$*%pKYJ|ByMT(2rNK?iEnj;OhZXx@Q0+cWF*xuSCx38cnAf|!%JvTQVmX3S2#aqf_OgV@J%P!wFG3VUr)ARA_Oc0V{T`a5<|a0f!7^rHKkY``wf*Rp1{Aj;}LMw%SG=cJKR z^TZf7uRXVBs-e%EVBH8to`8W@A)sZ#-lds2>v27eEfR`~Gl8WQrN5W|ZiQ6Sj7N+p7v9$U?Dz$Lyq(y&X2-88L7J*>eKf1;Il2 zIB_H-9X`mA8JKZ1bw?e*Q>YPIuK{FD@P|{;M-da9HnT#t0fw&pl@r==U#s4|9eFXN z+Pj<9hLADR+-b|8SYOU)1cKidpnwz>RIh$4;L!cI!WI34%W_azu!_F>WVio@u%>DGuSa6z&MWfvErj^NL@=FZ0_BO{;B5F5@3RQMmrb z8X;Ak43q_7X5*G_Dg527^)8rn4QP2#-F$vpwLXEY9KATNiVNCY%XTo9l@Atp`+M+# z@9y{&UTeb#F0s)Z#c{IE8XeYQnL;zCv|vAT)?kpqYh6+aZry~>(C!3$LuTJ0t4h*H zH}x$ktu$jHie6=O(%$L^=q~OE?-QSv*T~~1XBlLI>!iZ|nyBzJjh*7^`&Qq(P82r)vE6xDa;2vyjaSfO{ zqsua_X3Xr}yCAC>TpqQ)u6a&BrH|~$_Ha6HMID6;{W1{^j_fsVDb^hQbt*EuGDD|Y z)ymFWn~!N@8(Q`z>CjUnB6|ZD(#lz`^LWhs(5TX4BHNSQGB*rxIH(Nm7GZIHp3ajG z3W3aGSe;1`+<5Kz6@)L{m|nXnVq6{*-jGgLS-sbu+RL#`ordnkKB=pII9jgJ#x zs6IZyhsI~Zox(yJ`icJ5QpF=A=j7&H~npL$F;eyHJ`#A=Aqk$u&#v-CLdMX*@}Y!3(}IOQQu1++AMm(A_BVb$03 z68bR>ptrQhja0SStmBY0lu7OnS-w;5kE``fC6D z(~YeEjB4>7t}t48y&-=&Us3}XC0zbd9V5$i!Aza`M?d*V+8_R4ctPgM&-kKADhfMN z=H!M!MIP_Tpg-Tg8Nel$KpuitMWAm%O%W&(XJ?JRp+{}N+RKcyvz?MvH{4g|S1b*3 z+Wuj7^C2A7?zdBw{~XP75@+_ao`-R76=k21%rmlg-Z0+VRPSm7bw3PH%OFxKgU{5U zso$C03iK)!k$| zNNJ1^7c0qa7t8JT_540~p1LR64Ha!*(udItV-{bP64_M0+Gt?!)>4Hqq^M@@aI79y zLNfyB>Us1F_(X-Gh`E%Ad%POUvf?`xRi3yBWaV+%_GXcf34EX6_L-MD__7#%$3hRq zf}`L4=}t)z4^1CY6fHpmw} zq|%ahAA)9t!umPs&GF-l$loZ(9?2lTri1;yD(>Peum zW5o=VxIQ&6r#&4-dd*M%f>>Qk<*6Ro(diH>oN4=r8CDsIGC#gVmK8k9qs7y5=}hs{ z;D+xU=0080ax}NJa@WjjCmyC438c*_7pX-DrL)Us=2bE<1jL--Uwx#;gf)4tmJZ2L z8<^kd!#6So3u@jr^=Yvg2JwCleIAa@cSVeT9aAau#O@Ck)7oh#MOXcs zf7$kpr`<0>11}GNI_2w^$Y%)I--xTvoVa-EsXt=s08blq1~uN7r3VMLIK;9CIq=R8 zgl^1xe6K!A3t97ep~n+7l!jKVrRf=(0rv2+Ufs^}OYe|+x_0m0)9|T{Jj+)w{Hhsb zml_BBs_TC)ctZ|uDJ%`df2!VUJtnB-s0kt8;kE2JQKf3A8v1b|%>IS+wfcgNc1NF+ z4L}V2o)us?!7SxV9WIF6yq_B@F>x=G-RhP9Udli(%oDvYH=h9S%r^3AEvsxmH!Y&k z#Gr=FW+VNPG57w=Kh7#e>-ylg(%QT0=|E)G_kLT_UiF$`Yt9T~pVd>Ul4!=Hm7SxK zlrBB3xu)l2kedZ{(lDJW@W0)0Hi+tcT0yrtWtAJFP6tJ`TIA&hHdHOwZk~R$^ZR_! zAGAM0S4YZ1t!hU=bT);_4?1zHM9lShC!TSBhcmrfwoqcK=tEYwh8(1*!TejVMJvmi ze|efNAezYU;|PxIKqb`*Nr2X?-bErYPqINF4jUF)6A zG5)-()!tvUyhg@#Bh~t*GpYOiA67Q zote{5VpFGJ=!o4({5%h}T3y$<>tcFsa)+DgXESw@t_zO3#G!Lq^>&(CGj|^=P-gmk}WJ*(WtZH| zj-s;2%A}YAs9biVysj7j$z8m-T`K9jRMR~HMOl9ua+{{t!-8KjE23-~ml&iX&ZfQ| zAocRQH@b|aG;t+ALQ05xp|(b5Ica+)S^Qoa4{v#`HMp%&O}X3*HjG`v)q=DesK+0E z-v+eqg||GnrY9k*K#;Qq_pHOD8lFBv(!B%ojP)A8VS63?iW45NIKD0oKOt&m)pkaq ze6s(_w_ry8%kt~C!A(r@OcS|OKX(X-`YC+V*f0`Y*Qn4rDZ1++Zjwg`a zWfX9hesBo9U#%Xo9mm*FD5l@(=7$AqJRp=pRP@Xxih5p+hb3nKB<^l~D{T#6UA>3= zsm)Mcpu1+YV~|1WGbV|0Hpoc%22ZREKGHJOL4qNw!BndH9h26n`c`P>N{InR*r{)B zBD4Z%4Ij5L(+(O~25SgB8iysyCLEYp{r5{Rj#@GRGWj(s468V603iBC{^woauw{B* zn}!@O>s1PCVpL}-g#FhoB*k}bY=h8+=wecgVeeM4G2#bEfrmqAfjw;H9t%iq7l9q< zejXqn2VK0LvsJ$Wr6G)>8ba2F5slf|R72FPw{m+5Di*u8b_&=C8s?|Jj;1PxDpLXz zd01>(%;=;+imE}xIAO!El`8RSNK7qrCz@h)Y*~*M`BPgb>k)r4AohE;^fi|75PB^f z$*eR(GN8OQE*evUX2kTvJ2U^tyDI4Zszl(jQQpnIJO+~jM z22dJCP7r{+xDj#`N#gj$dAWu2`h3`!0Eyn@a2#nNRdVH#f}14@s7@#AYCRE&=`xLxE!Ye!-I!Pw++{0b z)QQAahk%JBOw9;iIfV8^S*IU-Ne^Guo1)j@r%|A9^zZY{L7*ob41zjQ7J_iV>cFcN z>JjbPSf^z{l@7DKc!bJLL9)Q}3xQv4n{C7a(uLa$!;U|<{m#9z$OOLNG#wMP26`u( z_XX@WG9FOm5QqWZ$8jB9ro9WV=$|D2w27a`mi5wtks2FLrD^kqss(MVW*1@)x|buf zFzNwR?AZ^BJs%HNQm3D-IxP5+NKLU51;}_(J0!J%a`=XeZd+(X(-6_dHP&4R7Cntf zR4Z`xYG7V`L_%1^ZL6x1=6PpmPBXDifQRRnqRMUp$E`L$zqICMP8aLxPVWALMMS~$ zA2Sb6116=dJ2>2I0zQ7Z+vv17S#~omFYI|r`dl!B7QZq&+Yk3Z)}9S2%lx99-S+;K zwy!GK5_cZvRA0nXu|~e$5mwma)->*-VN~sEI!_Zy!#JjPjqTMAqxs(j){M6Uzumly zlQ;qqcGGab4tx<-+wdD8Rj>p!EyE=LglvWc|I{E_Wer8R5$tQD@4JVFG0)4m)NG21 zd24>(d|zWpCK*2$$-CVT+dPhW5^5bpkcR^+9x-e>ZYZ5`thF;M?pr`3Gx9fPmtEWM zHHn%Mb~d2hB5<3MEn>JXU9RzsgjT zuPWX`1YZnV6FEqnYW{yq&+S}x(~KYg$Il0_{?=MsA9J0y=|mcg%CCw}t*{5TLJaVX z*I;@7y{6^rU`tdN6BX#{s;Dy6#nxo?pn|Vz!jiOe$Lo4rG)VgJam7Gj-R}N>h3RlM z7MD8xQ&uELP~}h9l_pNVVf5VE-8WZb&+G}B!*G$HextB-`OD+DcOB|CJ4xyP^-Esb zb#R{wKM=we_$}-Vxsf5e(qi}6_|90a+TL1Vc@b`=`AuuIf@DUVc)_P|O^l$@#dHkO zvmW%;L})7;p)~Z?BvMqVXtj4Br}y!fqUEh6UTIUj^166AY<}y1&lg3jfA=ZY_@%A! zN?qX;tUS%G!+%KKW(_FV0-XkqPAQGglF;#PFfigTJ z>XE3*$|Us<)7)&~2F~9%^Cl|cAvKd`(iYM$P50vEOg>jXEvs2-%SdnymxJ|Ti=^yt z28aXYYh9%2^=ow+WRpHPLn{!mVx}PO8jX>pb%}5$uZuya-C7+H49bAqgYRE#jHiDx zorTh+DJ|H{C#^lZ7xkU7Gmz5*be5U*4hn%NtZ5rGkSVFONb3q_=sv0@{gnJk{yF&C zr0M{Nq%q9gj|O_<5N_i0`H}q!pB~GGkmD z!}9NV$H!oUmbM*i5e%#lHQaPXr<6<-=lJCO6?C_a+yt620?7=ZjE};K^_?&u>i)1$U(*K~jJ8BlcVF;tgw>#JV{JnboUrfXTZ|3eg}-aG~2yjw-;$CTl6I442~0&rJw)1sucIKob!%!+mwOJ8MIUJLhr;NVs!1!c(M+T- z!h6lxUZt|oc-D1YpBvymhBGJuIz)7ackW= zXL@L>6tUn}rwe|#o5cAwxC$SEzHQ<-XnCy$QSUJ5Lu1YDV=2N`dD7;vY>BLLT!yhZ zGY9>AgQ>t1H#>;jo#fCr{PGz#(LaqGD&Uy3_>e<$8fUC83G%w_=ceU-Q6cmZhy(on z?77*Wv$di#h=`1TcIAa3vPXC=@`JYfX*>ArJHid8vE1zqlJAO9E7<9^^}LSOfni8d zc-n!`CM}W6G@Si=k-8s$EFSH~(CH; z5pcmn`KCst)W(xg5rbxRh)ukN@xkgt&&Alr1N}YDP)rvmq^E62P$KSy6Y7}-d!3BX zc8RF*vs%DYgvv#9!MNFdyJoUcC1$KTUJvbeTXIx4cJaE2xUf|2%ZmUtu_Pr<+sD4^ zRK~)T76-=w!d*DL#7pJEv4TVPJNWhsi*jxRc&A5lOL2zQR1qfqyo6!_T3|$&5n)JT zs1NdVsNRuMK&)M|`Zg1j`l@wvsA|>)oEYL4i|@2|c=&5;#&E-%8yUS9-aq#;gYdk4fvdER z6X}LHHyAI7x5-6n%fjRk)&-6GaNppc-?TQR*5$|8uVEZpYue(YsyJ&}6itr)%!D)Z{rkgWh@bgk*$UBpO zF*2&U|J;ZlI46JB)%RW$lZ-Yrhy|(mhM3xsn3@(6{>InW-%z1>@~v8HY&$zNKLHSr z>qR@uZaV?3d7=!var=r5TZZZlTb(4@N9hYUJ7yx0!^I8Z+aj55HwX<|mQWw-w@nDf z1I!}=#5W{__?m+`#I$?*^dlS?TQ-?;08uTi z(D2};GIEvPTRC==C*^pWT6)1{p#nV+QfJg#DJ&fgcIx- ztPQjBNM_qote(+y5X)rLDra>$tbg|r1Wps<`?LxCh z0Y67Cj7)~qz2<4OeiwsD-dD>qR@P0=?%MhO&}}N9*Ng<-(LU&J+6;>FAJ*6OWT#+} z;DL&X8Xdf|B%tMj2($}aGu@4T_|7%%Dtl`PF!7xzHatD_YXZlG@ftPra=0<~HaIoE zK0s6~QFYXKLT+2Mw<#N(FmO=js_p2$;BI>Vw$oPvv4$N|rxDVO9P<=l5MbEoZ=4K0 z6VJ2+|CC56=)VE6#fY#D=?qzDQYz4Dk~r>0`nZ)%Zq(&#+?`o89~VzgB z7C{?cz70^!*whB)XOYx-ar)@1Nv$)+RjP*@3Uv|@q2l}#8MVF=Tz9A7_2(M%3g&5M zn(e}-HNNwsaSmOqTTxlFtfcl`9f$RLN(}Y6Y#PC$t??<-l{25aB?6xiRgyrIAgV5; zvx-2?Q4n)s$gWVydH6xO9BqjPedQb#Nsj+^+mdLTF!>Jl;8H`Q|DuVZ(U{Zc!-qO|e&CfL?FeR(R_Vx@CeZ5&b6jJ1Rqq?q1*mm!X zIeMP9f~;E4qjLyFTBU9J;i%`7T)@B(cxkE{)pzKb1i@CSXmj6 z7q5}e4M&whbT6WH7QHpG_^)bckTwAdgw>QOt?d9MTbkMVuyW8BxoaixutAMy)y8q- ze04zf99m^q%RtqmJa^}X@#*K`yjDSbWo@5o( z*)fN>To`>5-t*uvjC($M3`-s(7VZIBRc{r#4B(m_=Kk(|X(`pK=4tvuRkf619iW(0 z?tL{DKDH?tDZxILNZ!RVGksK3Gsv!igT{1^9!8>&9I6U>Wg=50ilZvti`9_P$tao= zhfq-o#iACh%G34h+(J7HZuGV_Je>i9FT;XmATiu>J#XhoQ7qL?-IRfE!Kes>>KT6Z zr+U0cwSKejQA1T4o4qdIVYnZ+Bn0-e-G;Ec_H(%l%&UkX(q~mC3%n0Tb^scWe*TPo z4=3nzogZszUS#kl@Y*T>GCLalpY9#=7(&*@eppE&q2>Z%ZwHnM0Ulg}8F(LiG9ZAg zVZ25R8X+OT?}xixzi-p5^V#Y|H{;4m2}A63riXh*96#soD08eLU3D*!!iPz1!ni<> z2qoVa#*VZqVQU`UAL6f@T7wL(xqg`gT_nwRrhR)eh(CK9`c-Yc1 zdh$=w!QGQ;&0uz!ZrJc5h0>VbZEWgH%QA9ksvHzoE=`b4VQY{ll~A6mhg!slCWV4w z_X-kVYw&NVe`hGzFk7CPVMDeoJlTQ6v0Sf}f^*fYN%>gOq1%BTMW5@^>0X(5@p#L= zderso`YhPvpzz=*RX=fNfd@}%Y8gN=Q!xs=c9Ye%q%trR`yh227qV=jq0?N%*Rjn1nopsep4%I0`6TM~H9*o_9?hST5ywn67`9+Q|Ot zr{T$NM0G!kFH}^io-nZw!Akg^Do4Iao(2WZk0lO+sNEo$;0c#R>veEmm%UND$JiY; zpy>vp(w3c*S$p-#O@P{ZFp`a@BwXQPebs0@VaaVDuP;9W3FBj<(?B>914*hbUtytG z+S7zG@%QML_WR($I6c^pBu@s0U9XWP1;xOjE+?%9T`6%dt_@j6Uw$lfw-!2XHBFVQ z++;-NG$xuxZrg-QBf+9`m{U$NA<{T0y87JQd8W!-y7aNl7+Q3>YHIx?pwx(O+?BeE z>3EY+G>Ssnoey+qAxrC4CTePIQH1L}`4^Misu@C6To4zy1j0}LH2F50s6Y5`(vrfj z88)TbNq(<$%UZ9_lXI4-zTxL4p_KnE4>?9ZP&s;dq2%N3zDbZ3+bZJ4J^({iWA3kr zZQj%h7ej=_14{-fpsw^;E@baSdc6MhXX} zK9~nkm~2veAwH38Bcx*QF(a1RyWydjUJ0b3aN`;lwAxiPyE^q%SGFCvn%jBdUG{Fc zW2F*WptgJRc&cC9E2b%r*XC2ok_H{aR$ph7dgm6<5H$c=Odm+aFU>}$iQDxkdrIZf z|JL8oqxDZ@-ygL5-8zgan}AjOltD|Xv6|0Q`?G6o<9p$0Pd&UhNR}|IggknzSAU(^ zW*vmhR9JQ`A{ULPjR1`Y# zerdp|F#ZaAo*kJ9&zQpP>*YH4hJFe#weuapN^Q8@DI=4yZV8N%Bl>yy;eJ2NqZOa9 znm!y&B-=l-N*wznPIxopm*g=n_y17~-%JA4niFO?#QH_dOLV=SF+M##Jl4NoE*~38 zba}oGFB@ifdA;8sBW8L&KNA+nWV5;6?vWhc^}3#`HI$Y9IkZ2tEOWlZY32N#2q<(l zY~)!C7f*184h}8i#EC{o;UAs$Y$-XQ%Z`?{wy&->)w5@@w9bSa3tTQitykSVC3Q3ayL@;>8dbOhjRLxCY_x3 zr&iB_+3-lM0y!ZajU$0?^WXckla~uCkEhY@XB27?WxE;=k+C*%Ok{=sYuD-J3DFeg z<47Lz57Yb?LVQD1AxZ|I82k52s8b~Mr~mKX^Zkk#ijBq5sjVe%=l*bH54DAOgi1#o z-c%6CXzy_bv?HTpXXdY@)wg5}1kfj!C4w$=lN>*s;~#{>NZ^(l6+` z!`)@ErIX+({Sg(y?>-PxOw0}wPBGdmqTq~0**Szl|8Zu5ahKxhE>vtu&Bo0?m0fY{ zyWyOSqR4kB{NrLh(dqF0ijXNcSo|Fdt_u`dc*wHo{*9HFAFvAbayf=z=V_SpV- zs=scWb2MjDKD^ml6gC%D9{^|HZXfQajFk%5<)%rp!Js__+vr^0?d|S-b*Zc^5i@6x zi6q1X>d^~;KkQ2`SqG3_Iho?0l5_&4MpS-2=C2C12viKPVJnplTmm@5S&nAtARm9? z)E9oz2+sJxL&g`=hy(Ezsx7?dODvC`t&^Z zdUj$6(p8LPzo8!ri6t|kBXy^;K|rIFH=%P8H}a1NUkmcl4W6iTrWHRlJBaPetx%s# zwio8MA+>Y9q#tC1BNNw}%YY=*DCuw#Tj(DuQXpqQZeTX5Q@W_{B~|w>4j`8GUjLz( zaXc*s#pA*I=#xsa$6XqAn zJ-ef0zB05aJT+9$S-bdZm5wT>z?UjwDtcX0vDxNgiW69fb!dwq=9 z&EvLW(QP{esyD3v$}phek%H5(L({S=V&lsYCKTP|lx||_k{|bQs!lwslPi@+V!Vb* zjTkc@f0s~Pg2L%b~{KB`XDtqUKSbkl6jLP%I7kpkL!~w7c6peV5XDns904Ltw5~8 z@zzl1Pgi;C(Am9BXj~mpJ36o(Pj&03$w z6%M0?{XkH)FbFS!S!7NFtq1Mafowy$d6raB5BM!!BS#6 z$xK{qj|dM~u;0^EfetXI8_{&R%It@v!yU9BcHnV7PBncd00vg*{;f>jiScP4G&Y6Ui25&Y9^KHP08Owo?@ z1*$CPUL~xAmIB*Mv>y-7TgpW|3henzf>LMuX|*?+)f6t{RZtRs$y+{fvOe5gpLjsVR$JY_h%M+$sF7=YKn#n9BLa~uaz(Us zH<%K1p9bqyv^x$y8UcY#mfx@HKHO^z;>J4>qsUW9j>vKgY4LVEbgb2ygraoSR25Pr zjuul}HHKaX)<%t35eBT80trxT@C<%5ugRmCC$&8~mHvaN6fOQC=JYD(W1^)z4hJe` zLeKUVcrgmNp#oislnFBRI|s#J))$@BcGxU4X6lT=&!g_)?}rm@Z@DlrTMVP@k9)@B zBCO$sx#C64C(XAQt?*?W+MVdJ(i9q@S14Xwj{=JijyKfuor%QiyCMFCt|%U`1!NY8 z10*-72c#hUBjWH*)iiq7;K}BC4A+bGykl5!VbJJBK5q(AO|w%!8$Mk8cB^28j_5Tp z97A8+RJcQLpcr_Lw0PbVCyqqn5VYEoFHes#LV)cY4>Ncn)3~HD3ju`AKUHzeP}%wv zsw$Am_@e_r)-RFqi?2S_cTbqm5≶^KTGW`dNO9aGP?R1j8<@P#;WOf9E zdrrd}LT0A+N{cc20$|_)t$B4%@}GlC9WaGD63~ui{7=~jI6wXQc6;X$bfHq?MuXJ9 z>|QzSgO*!8KQ4B>&bPTJd%&8aXf<0RE#Se(l4igqMd+Ol=XK_)l z0$2u-=9p$}k50H+4BRB#8z~$kb12DtY}GUl|DHbg{gI_|Di`Y@CsjrQhr0+}E6E|0 zQ#-2|2@Z-X(vdddogOFNPJMn};U7lMPGf$PR9(GC=sZb2r1sqc1~KM6fzG}x9Tgho ztU&yY%4y3J-CUIWk1qR`G7rPnP#^zB>X9u zSmFJbm$;@(-lp3AEnW@U?sQ8)99>&`axnnZ6pl)Y>9(&@GK+`}q@Y@3du$0`+S_Hr za=oYN+pG9Ne zs4yuuTW)LY!MwquLHEcfn-=uQw3mZOAO2nqO2-iMjlmJo{CBm@4J3obLI@Y4HxziV z5F<0!oxIjJxi5>+Dy6eVg7oUhDwTRz`^?-nywH}HJj~quR{D#1)E1_BE@RAu$CHE= zNr1!xtJ;_w$?Ss5=-`)R;$#r|y@*wWhO=FCO82&XoJv}K06$V{w?&*KB|m#=qoCf|=dic6IN&gr6zyue2GwOS3rR!OfS)S+ENsb(@6DRo z7f;b;g)WIw<5=mKN5*%lqdG4TIOncDO#VY%3Jy+bb*VoIeAs7#!a(!q)v!tJdldxc z>$M^Ev-IpU@ES{r?;~v6kz9cjtV}j-b0p$P=fjQRX3x8Gl}E=4kFJ^D_P2;Z+Zc%m zs{a2PW6+>`>SNF}JHEFLh5%YP>uy(`o{HSJW8g#Au=YvfdhzY1(4-d4k0~Fh^A^Iz zZBbSq+308aC~+u+dt+@B&!Sfr?tY%;&oHsHYOY$eyqT`pbW2V>3lfbxk{c(JMd09)1ysPn<**~?yf#Zz8?i+?D@6pNZ##7A;-lorkujC$lh-OLn(g~(KR5vz zSueVSy1Nw@4Z*?OWGAvMH57$-nP$_Lpu9O}n>9(_kjr`VrkF-8>Vwr{tF8uciB@Z&(~X>dTEjh`Y-+Zz-cEG7hg%D!ZkKIaODD^Z-BDxlZ( zU(991G$=x=Y_V1CBUj~?I8`V`Q*=NMz~_UYqUAj~=2f= z)~ybv+6y1lxMj`N8157fn&=K@W1^wS?q~Vh3X~+(J^p}{&5gNHpR7^Lp9X+Mg`O@$ zO%$xAIRR!t4{UVrpId!;=}+MyT~iE4^;>4s=Dl(z6(M@73k-SbL;45^G+{LKF_uD% zq0k{!e+&ZOkL-*Ny$x?H>-v%?5~@drmLP>#24O&l&qIVQNnD24TMCjlz1SwDogFem zfu%6~Zc{mQ<0U{gt|@mn+&XUfyz39`zqJ21Yh~vS0h5iv@lAmKNkr-PaXKJCS`rr% zDY_)ZDXbGIHC+`NS8>olq7KWTdQ`Y<36=>=ZU&Fn|M1Gb68Q)Mai;$-*}o29ybxud z0X&W$#XSOB7T^rN>XS{@SSl=zq=e33Ki~7$MuUdXEz`ck$he|o$2^^`nZrfxbL7a) zTHBK3!F6yT0%VQ9#BEG}4KnIS$r*cR(45Ltzkil4F;M4zh$P30FcTc}-8iV;mwSGK z%i8ymR-D=hJy31T`=n@k<7woGpa^?TXlgeU$&(X>AP(T3|_sWbaONJ1a|FAOIMg`*C( z?SAv@^f|O}cLwPRUNZjwgA(R--{v&+V?+w(3WnXDB46lwU!amLZgIYlW@tLcKLp7Nl;uph6^c|WFkJp*(|DT8gNYKQd zx2nVu2E|3bn-NUdpi^#xYYcPA{7z8plWE}xL7~w`i8BX57ApfG&H-f4F1gnE%z)3u z!ud|RXH9Ee5lw`~d_OBP$G+C+x%7klR~+PbzvL(hLkuq?00o2vK+<|+XWeVj`&Ar9 zi00s@Z>$TNCslGKS5N2b^_lX;GwGl&(>aB0tWJHdK?TVSesh7C4!cv_$tj3?QM^!OxkH<^EvH=P1gQP8~U&j1-ylMr~ zDw>zV#lXJ!w2iub{;QRcG3yD+M7c&iQu`s1nMas9R>Y^GdGn6Ovun&Sv?MD%u*VxF zRJwv$M%R4E zU>aCVV-DPSjW>m>z_qTqn2O33@in5cq22e&OPQc~#rr1BxpCH-E4XQaRt$of9*`=* zwL~|9&U;%8548H3`*0mJ+Rl4x(Hv*{*KM_ar8`{6Oz9*qM+d)6tt zu!!GOBxLv>x}VKJyPw`z^DpQ+!S{ z=DR{DT$^2JJX#U5!k%|_W>yueB^O(^w7i;0FJ<%3T^=f#st4`CjE%hW4J9lEQLk7z(SO#j^Jie0mCJMJ z)M7`orRh4X4Zsluji&NNbt$9C;zkd65Rz@8E{GT@^jK@zK_D2ysp5}Jp*F{Mw$*Fj z{ReUJ2g@+hMQagb^s={&*jQXio|OFG8M#Fu%WE?R^Efr_eKfzY&1zX7<&bGnpCZfA zhPD37*f>zAwF~zwR49bxU573hFoiUNc?nyWp?}m0P^Uhm@GfF_mo=WRy4om>kjah< zHI&;17IZ3u4`2KAhe>ENb}Vf;Jgd;oTz>ZrgTP4;Rw3=#Bu_Gbf7B~0NaGgR#$%3b z@0txl0^8|xaN!leL!{y&MQQM_wxqB9^``;!`WrB?T{I5wK<-qS-IOK}i)MnwO`j2h zkRv#RBi$YZyCXz02iPcffB~F8J@{TqK<@>E)aqq}FlA=K#B7PbNX@Qk<{l5{w^ zPB8vWTe(f#bT={MSSNOaO+7%QGXVU3eZGMWK^U?Uo97ZUVgM*xcoHc$ADL?x{Qf`4 z&(^yEL;6lN|=e{LRiQ0fh`uvegsGFB3r%=VBZ_eCZ5jTA!1#{4P2S|E{dYfy)Z*?&zy zbZNf9%lh%y#)SO){aIdGYMOU&Qq5|z|9;q`82~}8sk|EAAwMv)hm)fZ(V7{Ay;<3> zhQiNP=+%J#YFc8qFt>*Gz3M`yvIx#P&({*}i~Z5h3?)tswWcRDDAj@YJ9&!Lbah2e zqoFr?j@&iW1JTSI{^YdtgIIIpe*LHh>4DdNm&54eaVlH7kHL4MsQUXc;D>0X8^O(p zkoSJ^qUz3Vh8mvY3ArxbkFxAqU4>g!j%)RgytcR{*rU+HBiF`5ub$zO1XX2aoV?*7 zqQ*s?pOD{~bg@`@1)E>VPH7m-jz4a)=q^nUcRR^lxz=3RBUax)9Nb%YE-U7-aK^Wx z4yDe(gA@wEn^go%I5)@S9x49QyyCRYF7Ec4^1fN+RRs?QWd>8}Zv{7)MyU-Okh8*x zE@wuej!E++CvE4)R?Sl_>`M(C4H~V}vig1{O6)3pm>*pPRu$4h`@R)A^DB%L)w5g)AL)N!vG&P@h!oF5p;X+v3|yZpCxFXagI!6 z2olzD6K<3f0}1aQc`o-gnOzo&gqm~*U5WiwRrt0UE|L1MgNh0Fcgic^e9(~Y6OgnE z-13UYOhL+coZPm(gY~Wpi~pQM=$}g}uISW^+>=#D1RAKCzCQ)vNvHsEeiy(9V5R+) z(jYB~QjWfpKvdKUFh=%#+P7eyw}j$d|BQQCGo-*@Ex#i1h*Oo~Susx8qxDjZCd^$D z!UCk4&_MFZuv#UJr2YOeH*2AFs{Pp&4<;Z=PLK5(Zh|v?6*FTw;jn`1da43W+H`=* zc|RM$s~EZ;8OC`nAb2fszbXMRK1F2rWYPdC4)$Z12Dk|M>BqdH6ursbc?K{hiu6HE z2mnUv%3S@-89EgG@)GF4BUWj^DO|G+46FX4889Bu9MlaF>^BKe0uNej9xx4X;;o$3 z@GK&{4-vG!NZ_R&+>_frZnG1!eb6FqY;mVY-0u)!C>yAY-C;==U-$zJ_-rNu zxNWP^~dM`sT_AG%rZx&kL)eNVM+Z=)@m>lxL zL=f24P!S-Iw(wp)tQp8GD&CQXjj)bQvJU6HO)|KqBObD4Es$M69EOIRh5eq%=WJ%z z*wqXl-@M}6Z%?5D7>~+jU2_#sT7YwKl-#%Y(r0lKazq?7F=$%UgB;amKw|!vy1WAu zY(ZkliPcVQEPYg{5o#TVR@<^0Ih722GD)jnGy!jJE9A`NUUpOjPoP zIU8Nxw3P;LzOmOO3$a7>R$ySuU22n=ByHLyqkbQ0gvd1%7&OV0QGY9}pw~;PB8%KA=bGI=Y`3bMHW_ z$!)7VZU^+Lp(8Uy}N)CO((SmGHv#lf$3Un@obAB2M=C?r{>dp%gevD zE?t+KlpxESl&ufr72M4aSxMnx0LE|U{(2$V8bWxUlb}Ij6-M@D8pxh zk~V3~wMKFw9Wj8WuxZ&WU7}SI^y)W#7Cct9>D(4exJ?!@8cn7ko{Qzy@)fC4{1qP2 zdP>K($SzI4vR_j9yMZzTAtK1@JXCk zbzGV>KjgJsbIj}7_z9IUJ1tPhkJYV|{zb%K4V+k|U*yS^!-xtxE3p{_Qmiee&2 zlY6J)wW<7{eNv*PY;(xrZRN_q&49ZpJigfNZ0`B_OAL3oQ8`--5&F(qMxg#0JQ_9O zCqU^2N&wfPL54#ufFROv|FOBqB*UpLG8Q@qQoq)($E&l~ODnJE&{!!(x1V&n)bdk< zx5z}6MJLcIzsB~twFS|1+4GtJ$!CnSf1`ZsX)5#KQ-MwrE5942G@t&4b*MI)cFJGY zS0SpK?J71A+pDeC`35A0T#RT)6NZRQ$BkD-_?NH|uvkFwbI7}xusr6ql$iE6Txkt~tQaorZh zr?Yn%A{iFH6nsOKNycQu9$m2COt~2wE0Ll`v>z^=gABsvEGEUC6aP}**yX)g^BFT9 z!i|+_)*!X-|1ftA^5qDBmuZ_@nnQ8FbB+4;!kEeH)t`3>?V99PdGB6LR9u+EU5u&W zd8511ad)HvaqD$v_RH+yHrB(6-@zbQ3Mq4|pEl(3--RSP-TySa&`sKJsO7VNE6Zgs zCN-Yftc^{7x_Xze7L7XO`+T0(Cmza>tf5QichnIA!U0O0Ywg^8Q(*%TuSx^yRUEM+ z8I+UO3*qkD+ik}@v{QO2msX@r&yon9u#>HEpl-Pvgm3{gEf|!uvR*@Ir5S$g;h;>6 z1ACt=RR`Hx!6tLijAH)sx7K%FOxB6jNr)*vn#Y@OEFV=(S2mlyJ+E^$4v`z2%FT5> z(LSOiqI&I;;}p7wVQLZ=XA|_Ag)O}3HWDdIdr}h zJIko62cC0Rz{)zT8}Y6Ix(KDjgQ3J(H;Tq~F!St#zkj^uKDOX;^|I9uG_`$E9AaxZ z6%$-1QzX-8pQj7C${Zv|J1%iTB=7qzR2{o2SZ5k6A2?$q8=E!BsHn2UN`4~znfUuk zf5j!z53u}&iW=a{W`oBtJO)VSia4wW8}h?J1g(k*lMlOh{T~a>QMDl2b1{;3le7~- zc5=(rlGsV|X|OhSXf^s*W##6@cHCA5C+WFP~CdlNB46G^z}Y6F8h zJeL8Nw}w#IH!e6hbq6KQ56K&1qlL73>e^OjKLLoC`ngSp*nu5;&DL$zzLBHG!I{ay zpNDM4ws%4=Sx`Qv2D`tpw6*#zF>wu0xA)zy4p05CZK)dG`pev)yDwQA0Q-~9g5^qUd&WX(hWnvLJ#}$|;LwWcG5xT2MnOh&6Ybb&blB&}8 zCEV>W9550t6H3tj^cEXQ5e~Y5b*c zHnjw7B)m`-W|k@*M{5!(%apxIZ7w47teHk9VGMu@c=4)lh?1`}?L zb~ind*c(tds^%PCw;H|1$J<^ueq49orX@QPOgNIhk{9H0;FDik(@8Ua^NN{UA2eAh zb#=ufCsgsHTR#(8*CW9M=bTbzHa|Xm#`nD8INVRq8{u|HbKLpObvm>M%()sOl7MqM zu`zoYpb+RtYt&?h8(-Sq^~qfL-!5K7JivfR{`k_#HH3CmQ7ZmlBBrWe%014i40lo{ z0%X00^fpeUW5o&X1~~w{+CfduqN@*9%3t_NRp;PQBNs;gaB~%ftZJF zcvULJVJfBsSS83N@S3C+WaJ()52PG5c{%S<G8Ng@{jb0J39V0~}qUz-Ryb30^i z;St|LC0xi>BSoFeSI6;b{B}mJUsa(s+X2x|IqRDJRE|NFAL_``IFR@a7Y$v2;H50O z#e7l-=sqMU(mV*Mxq_%)H+A^6JOj0e`01kcaPBLTjzUr((o$Wh{WDFbQ0X3|1vA5W8zcYjI3(GW*XldU@~<%U+1r6o+o1dr)`|=B0Ds!A zq{fzGoD~>j2+EfCgvS;k41js-Y(%q2MgWVBAPLoxWLqPv7F2GXCl?DqRZi9~8ZbWQ z{@uY>h)M$7$vI(hVs`O;aT-SbJ}QN2fiFEU-_3Juq#cyuN%HKXv$_#uta&n#m{l7F zkHN>tI$5}Oz_~BO&5;8YNdH;M+5;~r#@IUYD8^ZG;QtoR(ehxJ#<}uf0tGP0|F}$& zfB|k4qa@+2`!J29KIAtrTB=N&siv!wSX-$iZtHM-Yxr;BYxP##y8Z$PwxX?CYqg8X3QU%Q63{&a(KROWp zNv3gRni9XFT0B%bA@QJXX*wGl5ZGQ_r%Y5N>wLAaKmpSymdL|Qe`TV(x|U2 zmcG39;JdIZZX_%QE|h8GnzKa1A`q|6fJ(f@Yl5ubeD!uaOr}@gqu#)Gkd%hEW+51b zDN^|0!PB6&{b+_WFZi0qKdDp|O@J~ut*2_k#RZY___$_BHx7^tOc^$B;2a~jh4ud` z|46xMo?PVV+ceKA%ZBXlJO-V4wK&KIo&~c5UvtS6Q-UTM7;S8?u!`e%4dyi5D_G^~X?f|Rwb1M^>*neVxGcSdOw#JKN zNGhG^F`UC}eI5QjYO=Vp2X(pPpqW_a3&nZ3sI$SbC?D>3zKVgo!2CMS8$M-1IMg8} zY>Y{RxQbaBm=ZRt9fN>n#LC+%CSu<73Vc@MfDov`4<&Qiv$4$F+q92i+Dh7d3~XAA zI}ni1`l$$nZsq%-%kD7LfFe1yT&RW~SU1d^5e`sh$_JwGY9GQ_JPx=ODrhWUvzf@b zTimyq0%fS8Pco1M^>7eml_lM9qQKlwkbD;M{BkjqqZzPIww^_L)wB)j+?pc+f=9A` zVayfb?d~y0PNS5ag>?o<`^==b*983`jD=22iM$q;3t zAkq{Ore-Us8%EbmsRmzL{IwMXm>JfG0!e4>r+3$Xiaq>Ee`O z+iq5zgv-TVp?rpO>e>l1n+e>A;u9Rtt}|7W1Q9 z%)=-S6Nd&!aMBPo2ZDvl9wtz)nC7GM%8eGR5Ujww3?=GxwNz+cmbC6MfpDdv0`o>< zXNpse<3k}?x$>Fnnt#Ww#7XQv?%Z$bMFcdvHb6||XwbGxRg~7zZ6hB=AP~Apnw|yS zWHj|ZuQ`{>dlSO;!}C3>>tA!~%@$^g;I`1;#OXvGR{5O4t3(!Y%3M-|7mTUH4aT_g zK)+2dj{ojQ#|@Ppi(KtTKOMO~R(287gFmmmr%Y%ZP1lp*?vm1kNG3&Oe?G3j*f;9( z_LkzM7ncA;-V~bNr(PJM<3gyC=MN!R7#Py(2CyN=+`zPpG#oNx3c?OwQa?W-;qKVf z%($@$OA>O{ZAcHoi$Lm`)fd`lzcW^4zU#k6)Fh4D_eZm%kq`=n^l^3D_HoY>fqKo+===aQEeLDZcUR{^OTzS4V0(1BWPS?3Jq4;49 z*8Aw@HjKQQO2!+7yxRAj`sK|4JaZxMMIW>4iowD_({OR{`-!|b@UMAKaagiUZ&K9=;VZ}t`>$Q zecuU~RFKh0ATMf^zk!H`@9;T-_sr6Z}E*1{ojhAbKov|1<`L$CglILFdV?k ziT(2;b1KZa#wY$|nT z!%8Ctm3nk4^~faZVF}dl-wFg5k4pV2h9OBrUA*uQ`u|?>KcoErj_&Uezx`*-aq(E{ zvVI4-fOMI6INje+n%_0@zxOwk?lbwUvw-sW4rL-~tzEhn`0LLtCqZ1CHh-kj8t9Ai z@qOL>zGUr2Hv&^5wkD{yt^#%P2AwRR7svMyes^RYgB)@*ch~7e zYamdDgj^uEdYk$WD?F|n6XHFwl32mE?hUa$6IwfDQV{y_{tG&aDP-6Gn@?gdDq>?D z?V+=4?3y*N;jO3`eyYvA#*oB!hKOIyLWM;z1(76`!sGk!c@0T8J7@FXp0S?1E2gT$ zl;k_svnZgAq2C88;_+aLUcCZiScAunL>Pz9j9}eyMIkYTe*AtdYJ(;IZ zMQ{K!@6Z=G-P0-Tw0OgZqyi$T=_yMHL_dj7^s)l#{@a;(0oEirue3X%4AL~Bf|&id zt+>17*wz^ioh`YhG|Ehl#X7MJKQ+e}^e34`PxVf>+Xr@5QCS(dCS?8p!`M3oX%cm9 z+GX3eZChQoZFbqV{giFnwr#V^R+rKB*ZcnSMa;oW#2h8|+B@>a=6$obK-?g``45X>nw8raBFKF; zaEybvG-1;#Bh{9{;s`Yn#aV1MFV*fqqqMONYG71*#@B@2@x*A)G#;mhYi1{A_s>7= zn>$&Zq(;B~2SdRk9dCS+W$*YtMn^WVgpAxf?%&7jdHCUBUatK2-?TXe4oZU+!98xlve`MC)6?xY zt@b`lN`oAq=l!1PVQveV%|C+|TQeFOl6}VUSY(FojHt8e94Fpwl&fU%kda@fFefN< ztgH0IoYuJ&0)0Bli^miaJjxeA+H#Tchxt)P8n$tdKtZv~F3bw9s&T zWnU&tdX6V``iy0M8)vnbL6Q9O2}h=DL+Tzh2zLw*wnv1I zel>rj>4h6RXze%T5)gwzp*Nu?w?L+5#ZGk0j7bSBv^3Uq8!sKeDnV{|WQuH}3i5e~ zYHD7DVmMk37E|10|A{PhS`G#_Hl_q3NljP`K^8j>H@mOrOC*uH@;+EZ4U!BEP$lo^ zEEqvF93yPr#Z(PYS%3A{eFCB~Pj(@U59Bm;jv!sg=*l~b+)kKLL$g41c&dFGrD6hI zWed}Djb*-?$(bilJ=FvZ98@`%E1z%7``8_aq6 zw}6Sp8)}%5D+p0`IyHQq_u8Cu-}%?wKFV(Nc6S%RG9)g%ad8<#$%&6=NXy@HNsg*Q zvFs?5xexcBy4|ey6$7`1V8ztMc@Rf3H{Z7EYyk+gR1@6K3!2PEDSH67P#b+xdhH}e zj&`oFI{zn#MG~woD&#b(CY6j-(*-Q+&5o6!ycf|ok@&hN(?FkF;S#(BU%OLg$iV_;RFas1#U~*jf0)T+({-#PqCzf(4qp7afC7zLQHB$wsMgg1& z3?u-Ol@o>HW;Z?;6@d%PC!FCR(_9lNpWMhJYP225s*!u*c#SHcm&5>jLO`k#NU3L! z7-?l@Bl7IOFm*nEie-mnf6$Z4f|mw|wAvHj+TPLj@2-Shf?%gqm7rVVlcaGo#BeDw zA;<@R0l;4pKuEQuG#@^a&3X$K^+U)oJM0}7w;Vd)O&ggwh9!SHHfn21|DCc>0&EDd zWH|SH!MNBY=?Gu1?_#(vQBc+W-pceI0XeIgGlxUhp3UOUH-Sp*8e?9-^iQ3|*fq?b@Q0o_6LGm#Ukl zA{HGBaJ*In9-=W;>perZ1&xL|avCvp9I>+x*%?b}X))-UG@waVkQg9f`%RLbbKs<)yS8knG#K8!3 z`L~_l(-;(H{uKjaW{F=Ugq^vQ7uOgMa!jQd2XZXwCK33sRL0E=V#f4+U1Tn%HO4*EhQYD_?(4?m_=vC&E$eNZdRdFWzfsA z_1n)wUcz?VEKUPIVuK>pz(g2HO`+AN_Qp#^+0-Wq6x~-i3LwNfSPNaX79R(+xsZsW zNj7lKK>wG>!8QSgSh1$kzU9i@-~J$J`S^hx$*AE+o-IRJ8eO1yNT-5Ee~P}8BNlsi zkfMB|yYK>=U5(!rlxdS`O#(EmW?b<)fS#CXsGQTjv{U?@YLTKP8?}4cqg;G(I}?9l z|NW%@qU8DvlJ@k-yFVBtA1Nyz?Im8uF6-C{zh`%?^w$G(tdeo^CiLuj@|4`}D^mNZ zOvJ<4MPJaWDTqp?3?3N5_1gl{(ETeVyNm)P-%h=oMD|Ne`P3{)%4~B>E$nkByo-r> z1s`j}P19BB;Um^A`!?TdKxHJAoHIjRZ>xjCQh4<>^#LVFINiOM_2_r}ZksseXf-rZ z@@6oStXN=>-7-IolrK4N00{0d-AcgBCi_ikHnNM1qdo0&ZrrStT5A6IO49;-grih$ z(F^>0Z{GR`+kfia(vvSqxt|>`PO;dSD#9v&{f95Oo*r^DDHT+2lb3jy;<$RU4TyVb zkx7j<7$Ow?fN?L250caLRRcGo!!+O8Q3+?xh=&How+;OZCfRu7$a{XKN) z1Xa80-p_&87wtr1&~TI!jGvuUE7|hK1<0n;aU$*2Rg?#hXEr>^e4f@Bl&gf>AZXSl zQDLW954N$9pTm6x$iTd}FUX;g%v+2JX7_wN&1_so|NDe@g&+3~%rGWQDMy#%?I|J+ zwQp-alKp!zMQ&;OZqs9kI=%dfVJ#43(MFcjo~fc-b(D;r(oAd)L+LF{BR$3@C2esA zUbk#5_yMP`2xyjuLvL<>$T)7!BzhTC13)7~GhA)v*oqntk@fn=oyAPgC(UIG^54(3 zQgvhkC}h1{u~UkNf9yC#G74ayYymuwYp`fHbfoi^HQcR{R!v#dR%o@}Mdsj$QQIoS zp;r3*qNh(CYT}htcGXd|4eiKfndfpUboa|0Rb|>XSrmM8%ra%`+i_O0=4JlOIay`x zeo>9oxl!yBjRGU=^R|2(oD)k78`I=Biw4W?x}wv2>hAkn5uVUNXK{h@r8c<=G;pM3h1FyHqQyS`$`@h>nYyI-R7mzC1>G3cR`W(`YU221vq2vRzQVX(+M3}C0{>P9$%5o; z10sYtB{9AEVoCvAPdv~RTmnWU5uJx%0=;z@4pk7=0~Vlta#-pu=($+H+i5aB;;r@I z6Y&zHVYZ01*j4`~X*o_@>;~0}ytmIz+b6t{CMsUC%rSR6eu97R_IRPq#&rQUxEddh z+hxGjY^tfYahBN_PL;`DA7|;avi7Uu?Y&FY$2a-H>Hg^$B5$Eyx-MRc!y}_?veckZ`_b0yj51Z55ARsA&<}qbriQ!o3cR`6ovn~~M9_Y}K zX5{8J3`fV^|11WUraaMfPd$+hYb=?B?Wu+dG#0zH#^T6q04A^ZB_aXbsh8_I)bn~$ zC1h~LqRJ=IEE(ln8&DW+b9~ZmybvfQB{^3FIzWlC=3h9MS@RiG+-nGW8F2tK>)xG< z9N&;*gaYZQGnG%vW~p;D=~3@DLmV^W74g?4^1K;--@i>v+}|tg_53^evE_y3f4f7idcggvLmU%Kj5Z(%%+B^Xwu#(| z>B%DI9I~4icsb5FhKF~o?${vBe@9X`rF=Yh_(9RVsA7Bcl%OZuBr3amE5~PE)2;s% zNY4o7uYX$dMPT_m9S#V{8B0tJhzg>jPF`1l5k93r5$4a;Z=XXp7xo^N?~A7xZ5+~{ zzi`>}!qN|*wJ4N9^UiN`B6{?+e(IgkO(B_O8iE*Ja#2U7E)dry6FXfxLx{|JZYh9; z?mJRb>&(o@U)*N8V^gx3QPr_X!74mT)3;f1imD@rgziI+aO{Kp0~irsKNvlu>^*|g zO9K*;>qDmJ5n;@m(mJD7z`IuJnWbs3dntB#Rs5U4KN_~%VBlky2Ja6*UaC`6$njol zZD~*50{yl&QIXNC-MIWsqHUc&LEj`tyH|7XsZU!txR47?8RkV#n*_XWyp;gtPs2C` zIYe4z-2|aQyD~7?WH742SenSt@*-iJ;z95_R=R%jVJ*2Ms{2x3eVM=y3w7ed%SzHTKMJfl*HpwWmL6ZHdLt@acXYvaRR5|RyYtE%} zOeE~2%*7yzyNHejI+UGknpC7Q*Qil>@0*C^DsfXBtCJ+9bItU=Qm)3&;Ds44@Yrp` z-5)C7d(4Hm!?9piGp`?h}vT(WHntO*bjsC5VsX)=T9Bu zGMs8(TvE>2ImAK)oT2b*;6x-y9-vE}uKKbCTGt}%>$eM8+?1c8*%QX-`U6Ww(Omf7 z`hsEW0Zfw~*Dx%dSH;TUCMe=Z4@zcE(QNe1ej2Xl!=;F!WkWLsa!_f{Nn9!#2UsHw zEx<4wr6@Q1khR9zI)A_fu{F_=QWtv4E0<`R;fAEmYtvMs;BXly0W8tlmp>h2wK5Y? z=$U6?-dC03$f=zt9o&tLSey5tnBg$ zoQBriz5l2|Hep{fwSCqxbWbGHP0MN!8~p3_Y-j-tIU_rtcQ%gf_bHs-<>URk39de| zgfV^bg=KUMg{nDjzDb0Ja@moQ)q}(Q2!9F%2?Y#|L19^dRAwnLouY*O#ChhvY;6l` zwj;+^Y%-slJ+1j}oTC`nmGBLgB|Kte+LnSu#9-8>FKfNkL)+TgU;Bt{5?UBQEDKOe zYO;*}Nq8~i*T{o!)3L|}oyp8f#-cd6J$F*kgwTMB3wK_D|DE)VPax(->8uU9SRv(w zv%(ZTWQ>uZc$5yF)#RNwrjS%{GXWEE=H+>y3#=J zeVLZvDz7J3>n=q=VpqN7uY@BxORgnYWh$g|Z`_ku@!-#-@~MA?YvwLIb>3#)aB<%e z(ixF?bU@zS8>3yDitFqver$dx!Jp2eRDxjLVxjDAsTQni&ax?ZLQV!Bv9($f1mXi< zH1YTgf8>XPb0ETbTutj!N)@D0-*qR=Ne{_V@frW%!Y^h{(hXc!yfpCUR$zZ#*ZF@v z)Uoo*!9ugTcs`$8tyK}u5|2=ws1o88fC&!{d4CuT*w}@V4E4mqVB<=a7Kgd@0z@uB z51oCAJQbE6p4~|!f@Pyw9%qqQ;Wq$Y^_+usF918;!C_c083ayG;E!*m4ufhz`5TFVBm~fv+ zD+rFfsB>+qePD&C&F4Sb>wfOU&u29)Lobs}iH%Cmuy~#v6mF*q65H@fYmURDjon)l?HHN4pr1Ivi?WBJtv`!l}ASMIK4kCM4ok;O^+Gf8RTCVw>?cweRuJ2Ujpg!n z!8^*7E&H8w3Gmssim2WzhoObRsi|L_@yF|>-|$6Y8w+LEO%}}F9^V32(xN(RqrXwQ zZOp{80-i!RId`vyO#3?nd-^>u4$sPMO)Mft@;pHRUnz3+q6ZgMDz4-<74t^$m_lLdgldgL4Yk>IZ{{F(N4r5~u zv+MmmVs7Igj~KlR&KB9gL9&tFgbV6r@w-jXfos>z3KehIYT)UcJymARv_dUQU=T_4 zPNa2mXoK2h!oJw|f%$h5=rurTP_9{Sv4wN=ZYP1?X=)WK6|K-VF)oK0ihUGeqm?<# zo$Yt&d)Pif4FTJ8J~>LzAy zLs?jECP^gWCxsQm3IinvjkY<+Mp`i;{6mzTX{nGy6VF4BRDu%c8_Zr{uc~?Ey~#_b zrGp3`Pca5{;hSe_tW6?(p$JN_% z^$Laj5id2QiD2K#f>f}Us;`y~Qr9F1DIbf-v{ea5IoOo`fN_)8m~RHrzAJQvcBpm0 z078nUqQcQiu!5BuVsF>ReK?w2Hss`+P4Texe1^jHO#D-7f_Qb-CbT}gM%LkJfd@Jk zl%OrErPNW2(G+r82D9+=P0!NHHPet#tO|%O$XXH;F8IwpwUoq!`jK&t*I0TTnN(VS zVzDG_8{EhQYQOTLIF%I&(Z9Li$ukju;X)+xr0Z@mMRTxNvVO*dRR zW*zfzIr3x!G@E+}pW9*A$kSYqQoi`{0c$qv3!if+o5Ne(X=_i5b-tguU&@&Za;8Yl zEM~JvGkhAzLbjTeViek06H@k3eGE!g$*sePqeJ+)eIO14Ekajx3*NHZtsU4H&nq4N zM)APzQ-kae-IMZL4T}If1I$8snyQ}HR{LpLa9&vASNP)@Zm1j0rp_Pf~ z9chKI)ze8+8OHpr4G>Tgcyqa6fZhm@ce>FCke0gER(l~l!+mOsg(QNq{^j zra~AR;k6H|Yd4}7V(Z#kao+#3x`@ltdd&>7&Z>8kcK^fbV3aJ}r@$VlrWyRJ`e{8> zwK(gno`svG@5`1Ymb&~xVz?BfO!fS}x+?z{(ud2r;rJ#*<$IkYP$F8+H)LL75*F>4Nk;BY1RJfT*O!=_*UznRi0~!rs_>rN0Gs=!##mz~v{5r`3^I?RjgYroEc8Khv zv7S`&1Fstk?*7bO5ZLLc>#0%84vuIEM$d~Mo5QB3hAdJY(0&Au|Hn&sG!GkPHvn=e z(dA`{;z)Sl6dX&x;f-Nr`-Ndmp-yE?}GyglsP@kDHm6HZ!x9>_s)!PjF*4ADV2-}){t zWaPsPrY97aelC~}@=pxouD-5tx|x!Qb!i++K;IB1#_+FTS=vHu9uwRzK(DlFehiFM z05$GZfvW?*Cr|MA6K|D6W~%gXHR@QVb941C*aDYCZrp*0ko9Q&_Bu~%H=uOnby@aP zjK*O=wPlc#axD~1z3eL07;f@iV>L{Cd8v9Bd2T^kw^&Ed>4i15<6-4i$GWb=%P$%+ z@!|8PvhVv51AeEwBD8(`&*KZU9gYh(gQvI3=p$l`(jpfz%-1uL&zWWjv`ssz9yOim zmOt_u#4gxQ4A`=4pPj4RvV^&X_gf0{Dv$0i@&6E{r}sXUWx9*_)%TX**&(my;xAIG z+UAe(=x9`7haUc1;r<^{rEGO%4_1i$|q@hJ=t2EVTQThCas^7QZBhu};ex8*(kS(5(W z{9G}ieu3YVQ*kkFd4j(vM-LpGo!8QPLXluKW!9lxmync$G$NLa9cis~JHdkKFGX6Z zS$nC<5;oY#`sRIADNMU!PexULuy-sg0g24`#1oU^xBof)XNyBRGbZ_$d9m9f=077H z{yzs_lNdJtb-4fD-;QBk^oe1+^*4`Udjb9$f>8Vk==upDB%N^|#j?7=_UF6*8N0># z-~D+?K6s5gB!OO_7%`ap5*r=r22iDA-MT1AGg~* zi%MZ3)Nsc!M1!UsN?Saq=P8>Tt4qLXV%@fav$cITjlYczbnI5VPLMHNCW)4tKy9mY znNBMJnfVK9s(Z=r{mp!i6{Q}agTSfm5~M!SR;BW+)_^T)7^4~zZLKJ07%?s|h?NF- z?AP!yVTl6qZ$ez-sH+r?4v*Vri~<=EJdS<-vf<=Y73Kg+NkByRhTceZZIAD}7Xt=I9vT z!8swAf?W43LMe`ww}EWSGT!6yJFY5Gu1W=)Ly0DD%y8Y2@NEOT zs3e49?z1h1`fzoRG|g?cGMQ58;OaFG>oy2K@tfmdG+aZ_zkuDvnCkIRNe75^w7Q18 zC!qipYEO#f@(R0%JQ|%UENLcDTG@E`yacFl}=W@KsjEW$-}F^6NOHShG5N6%liMaeL(1n>z_MH#tgN9ll?4 z@<443LhL?$FmEH!+9rXsb0>ZJUxycKO_+6zd-^mbsJ0F>A^Rq>MSna^#8>5XZcBr`jN*Dn3&LDqW#`n_*9doXo3v3&!~E3g@xH57}&@JWw?R;0mW8fa>zXeUHv%v9#28al$*~#aJ12k7UV;$ky6GkB!3#8;BJi=3U{up_)mW)p@w&%op!;dTbK)# zPlAG-@9i^1;F zO9oazvlg5I_Mn7<4|SLeMXk}z+jcVm33Ug@I;6w(mgF`S^Qg7OqJIZQ@56SU*Zq=d z`N3OwQh4~`0~A$8qgaJ&w^RT}%bCP6s^q)W5=7@k4Buf}SgkpH`aNz7mQ~i=ThdAh z9x-uaFE1J9A*%60e+&wNHCR`#zly4X7mPAGnxv?+SD5!^sY@-5UN_@0qDjc09s!03 zm`Bez^})viAdN&(a}nHxK^!IAqXgu^N2>T!v&zq1bc2?73d;=Tw+0Gi`SE{`Gz3nL ziTj8{z=%LZ-`}V=EqCW5<)NErkPdt;UIjx$&`MH9-Le58e^=2~LErD;wNak#?4j6C z&zsFGj8P3DgPx1_oJgtUj(|+pz=h0|-^0bCfoN`mhf0&DV@k~|-wfFQMyFl^B40PB zc!s6V%L=mox1VQC_O?xt=*Kz>JVB}800E9a6du`%=<@M{I%s>(?z=PJhe*myW65H! z8jgENR7Jan!$v|e-&iQ(?nv}gQ$ndr{|S(P#r{(WYhWp4OM!%+}4qQ=)*gWm=3=c(qD=?Fho!WrL6o)5dJcsr! z^EZajVPiABB`*z2#CcCngV8#sM{024zFUFHt6!%c8Gsaofm`*C{?iieuwt$*n$J-D z1$m>!H4TgFHQ^j)r75s~aSoX(#3GL9*4v3AnSXIzuIOn5&|S#o;TsiJU(+q58oVjh%G^kIaWO&mNy%a)+;<1GQrC=`Qu9JH$* zl`Fr+O9N`PGR$YNIp4UYQTAmEtTn%s9>saV|IoqnySE;6I~wBp8zY^u4ADw9B)e(= z_l)w=tSQPm%W2O}a54ia;!Pn6_sU2M-Xk8@Q)DX&!_FLQQt6G|drpeR#O)oqSL)!gH zZK-)<#?jr{By2nz6S`{55$ONvHM8au)hSy}IKzU95V6`K389M8=d|mP+`dW5^Yg4! zY%QvM_avo1y=7*inqu3h+YvO~VIeZ2mZ_C9l?9F1!iu`blk1l=rIMz1mvNC$c^%{R zjjD388YNI41%(JM&UAJDnCSLc6}ww4_2y#1Jgh;`i?>%1Mn$G_}-;b&j)!;amM7@V|xP&v}rhC~xZAFqT^XI00D#{1*zf8Th#hp-6mO zDL?b6BU-N$iJd?~wch6lM83WIGp|gks@8@h^t*kvOr-lx?58?BUe+*Epq#y?-tleu zv$j(Pjh}fY+V3>#=5Z6NnN5ai3{*vcHiD4CJcMJsVMv8HXh@-CB9mMND_)V6p&ubQ z8}d##MN+{|Ibb-)RQ*Bz6dx6S&;N%_E*Fdg3v}?CA-#+ZUI$Ppx)gpN@Uk@V-K<`M zusec~>;Dz8bE(d%fYFAD1jL{yD3;|GFwjEn{Rn_UGtgn1OjCo%^d$qkQ?N3j&lHN1 zVT$l0p$8XH1i60vs~jG`63H@^&Nt3}?aXn7l4T`yy*EA?)WFqUL^D~9baFPPRe;B< z{LvlJPY9rj*{0d1fL1aFw%Z$j5B4_T3;)$iA+nF2;Z1k#J4uVRl{Ez9GT|ap^d)yo zlhs~Hx&Ux>=FijC@1m_p21CG-PW6;eZ@dmUDso%K@Uji$6heWRcQqIH!JvPL6x3f{j)5S{S;hT!`+FkisHmsfG}zR2EUJFL?BwFD3_ zCs6&%tC(!TwjoAbL7x?}`YE5*d)Z&_z+g5IO|ztamS)NLkrr+|7CYrz&fG+1 zDj*fzA(}94li%C@JWjPxlh;qs!P#Q3cnWK2G*uN6E*Bq7!cEQ;l(wJ9D!o(?Gl~-8 z62FDh2}I*&fSFY10qGrf_v+ODLNKKA38%Y_2tsviwS-?Eo8(F*(7Z*@LQ5BzURavS=1)}+l)9^PE?XFlK4QlA5uW9XqXW@ar0*iTF0_% z7Tc5H0m50#;^q<3>e;CFZe2BsFFTu`{~1z{$8%WdAf%UMqR=UYL4t|BVGLA6A8TSaXq5P9ShhTrMI0k-+6hYIlE? zVRUHCkDmF0f{^wP;y;9w+x{R}(BNXZ3NWhO0(@sT(%8GfU|U?I&LP|o8T|&AQhKnK zj+3X=;ynk63j$-{@@o!9!-x_%{w#j)ckcxC^cf5*UzH?vUwZ@=Mx9lU{%w7mVb@9w z6`dC}zmjC3#pZJ8s}JS~G3iQ|Mk$5PsK{S*oY|GMl_Q|`eZ40*8Cg@eiaY&5GavXN z{dx~clxLcPp2bULAV$ZDW45XOjs{@XS+*s8=$hvb+Clf%;)*d=f6M;$yk=J4(+7ev zX8vJG$0z6RT(l95mL?grvzpM7PZw)zFIJT4Kc9NtxJR_O?f->0d9*lDY5tW`PyKa6 zlN~P(k)EGR+G?YC3d*)nD>Xw>XBz5D-R_m}K~@FU!w=>gkyv0I_s$!oNFj3%em!zg zQ$2BV=Z1nez_l?uahB(mHt{LB{DxcWyi7I4W739M7-!!2H0=h4Fg_rdy?MpEx2y6u zSL0i%M73PUWA?8IB>J^qv#TWI<6r53@svsZb1{dnn;S1*IH5HZZkZpI;7MBGErH(I zBq>F+c$xFh-bNyLGLZ4vZ@=@ND+wG<`5SUCMA@q^xG#_Ao0;P*``jYfwhdeOWiD@C zy*N*DS0&^@<#I@3iVI%qi3l>ox4Zxo?qhejnM*C3HsRSRdBDDGFibdFnY0JUmQrDP ze9AnH&M`|*3C~UsD22RAnF7gRiY_WeMXfjF_YwJ*-1lXwv0mx5-x3<{Z2&YN%uOc( zCuE|{9)vn{W_s1OM>!5GuOKbQEqj~Ccxrn%m}|pereMu(?L?ytJ5_9a=|2i9#a5mX zaQ?4ov~yz^NbV8v>$|ov$H$WACHHbB+pzA~!WpA2Z}pGQ5jfwT2DFOkWM+NA%8ne{ zF(s2x1j%{{7Acv=hcuh(fMw4LX<^LimjLjr_Hl9DXE;Ai2ehUJdN+qhTTerpVK<< z-%ZCcUgF+#;zr#?FuZhW>?0YmjVLIhSdde3375QhgmhKyOm(X^6vix`KH+K|rjfb#OIbB-GC3p8wbI&n@F7BqP>atIrW`Gv|5DE8a9AYsU&LX^vMkSddj zNII*+b;DF-{4^VU2R*25*H8k9{YPROaC__fqC-~cf@Svl{7HpileS_o3*L9*=i{`d zvd&GQ4pOsl!6^m0v~F3+cXkC%jYm!pezhU0y?f;<@bYU1x-^>4oarDDwIp5T6u0;X3n$aN2Tv+ z2<(|1JO3tpg{5J3tXQXnDRh#%Kz|n=%C91!Ov~ss{o*WQHNI~I?5AIfwjtyrfcV`L z0)tg&Q4)T?EFpFt-}im7eH$j^3OA;AUafT_AKBP?HG(z-1iCaf!O8R{N1;@aMS+;N%U^Kt!?oP zae9O<26E-?MG=?3VVcvpk7tzTU~4rsi)^g&d$-lt@)ycl_$IIl{#oAjE0O+d|7qEA z);kby>#!L@52R*zbR6ZnbI`?2BnTx~9E*dC0t3%p<%i3bZQX?VCVo2^_j^Wx1*>6{ zG;*$X;uRNjR>yk&OR3?6%?#$A!u$uf!gXIK1Dni(cf_ur{WOgT=jFRG#PMVk+`r$? zZ+a>0a|I?&bqN(VjW$8;fZzQ@>DH}py_N&Wm?!p(GPzlDUWgr$->d9%G08+G-;5=A zcPKE&X)tip&wI^qW^Th6Yza0ZGUTAi6!VRsclX{;FE5m=RJXe%MsfwKq(&bbeb#%4 zHx69p@ttlhS*VM=;c+QKBHSvNh6DB!Qojb0p-z0k(>TNYbgz1qVDqYC7#&szR=P|* z+D9tXTspCPk^3``V942d3~rX;$!H`aH`k**Jgu#*Gxsz@B^SWYEo1eX?TW6oMR45= zzZ@`b2qfd|pr{RNVODSlhN|yW6B@g0q(_ud+pFSVShVg$TV);EF{fSVD;#JCX*ty7BcvwXB&JO%4ak)DKZVP1) zdtHowA>uoi8Q+7SZ6VC2qqCPU0562o-K5bq%03$4Zl9T7(*MpNl1oRI6(K&TrqJw5 z1Sp`{E+Yhjxogw7j8|3+uZ_y&*p#eeiZKrowgl7)>zMDDsUfjH;G-3+;PqcPOpsCA zJ5tI(=*&Am9xv@oZL6=)BQ+B}#38LtqT2VaB(wX)?fSo|cE3S1-5=ipr|Zfnm~M2( z>BSOU%q6tcB|K8B^p9R=20bTQ5P9_{j)7c+pZ_xAYuJMG^6{lUa-xUJ&9816R0TJ} z_MHaVRYWM+pXSxNIOAEi9W7b|{mPS3+`Gz7?$)~7OFxOGiu0DjrB&oouWnE_OAUeG zueoQvo}I(;kv>+$TRLCHBO6uxc_ptr)>S#1(W~&Wr90N%Nn1p>(HEsXtDc#j+>(JC zFDHcuk|Dj6&sG_e%Tt#owvzO9JDJW?BdH7BL4fH`Q7X}ur;yPMRRR&kXa{I`794s) zW;}xFd^*f*!yKzi@oSlT>_y|TjbQutSU2{Z5UJ(r2WZk_r=7f$3UL=CXbf}C1;Q3Q zyHhn)3K59X#&7~w$xAh)>9rClcVZe9XxbeP>lf}}G8%<5%5&X^K$G5Ec@sl$`5lq-$`dZ*D#-xWIq4V8{cQ4Q6|3#Fwk=+eoZcw|hOCPOCu@LBa%;HDGP& z=KOK8irF~d@TAblAZh!s+Q_Bq(u#vq05WA?ITyaI5_dWsl}7H>?Zwq6fs z@a0{(iwalD3owkTVcl8bPxU+q z>s{Y5U1tQd?;;uhv)_`IV25Nvn3_xEUc=m!_cG^tfH`_0x;x)Tm${`^7PQRNef_%dCe@t9LPOg2Ir4pN#m%mr9 zy^&_3r$f?&3De-~F5br_67nS=&jK#!#D4U;F=Magt`R7SRAwS&lQj9K|8cJ|SX3S- ztkBJJQ`N(9C-;mamvcyU%}-;T4y?sul&V42O@tFs6-B#gJY{cTjvK7eDD4Y$%e`qu zvKc^tY6Y0Ruh`gFYA!#A)@Hf(P~euC;Hi?flbfOLok3*XYCh)Fx%VT?Qc{fcd-HJX zyN<_Q7X{>MEn9_yfiq`9C>sun!O}tT@d!6I{l!DW*EJz8q?7fkPcNVa>TE#%H3|$_ z(XOn)duB22T7KNxeuv@pb%(OUHe`AfG7^(qBb=y<6o%U#|`?%ptMRfYvyio1aOpmrvzXSwCW;}=zCHVrD86U* zI*N?^T-xL}{x&x2wex_*g4re-PF#wsm^+!5C~|hxfOU95uzT>LBH>8l@RLs$l4f+F zsrU*@WI5X*keYSV!F}1bgSUI<@{#ciq#b9?-k{qz zZgz2*t+onGOFiRRG#Yyl{7YD67@CbYFF&f(;93hnn(%KCWh|M>B1CY)ITJ1c4jumY zW@(r)IirrkRxOOQT=-yAjUY#gGOv;cGZYH5>QW#?sfJqrb&pc+kiRlhz}gC(d%YCxU+ zB49m&8qqe`0z3VfT5q-KxnRBc5>5E~BD>6`L&@e(YLAYYKcCNIv5VH!-bF@o6GK!@5`Ty)q5cBcaj~wjQHW^`Z4#LpG(74`c6K) z1?+dDIk5%9s57@XDzW#C=4JhQIo25fRPN3u)wP$KI!|GBd9e|b?>)2^Rp*q8q$`go zqeqGQ$A-nGq{1Q%aacLF?%Om4y*0!`ukKuw)l+haRCE7KiAQbqeXTA+t>EsreigRAvvw zqg)v1Rnt*34JUK5r=OiMD(yP1J+=`Pg`6(0$|B#=(zj!@tgVIm(51fg$uSjOLGhGn zXj_tx;-oRo8SwW^J4&mc9;L)09`Z}{?WF>pPiB2UYf=RBKe)R4cY0rsk28Mp4<8Sz zN)m?i_|q*U1xh7YKi~JimxtnlDG`MbUrpBqDEG_xn2!u8SQ7B>oI?dD!R5k?!-9k< zL{}V9BI}CfwJ?ZVHHRdX5d6|lMX+ukpkY2jw$jYASwGaZczn&sTWz7+X*i8PTRmKC zRlNI5pB>-;JaQSvugAyn{^b4P_;{o%Sd}Hx5_9c@PV~&pkQ-i&QM%C7J<;~!U)D~< zIkl`!>J9_li1Iwp@8Bi*`~rXkD0V~#J8*uu8L9cTH%k)Gdcyw3fHDYD(TGBL1DFs3 znh3l%G*HWQnVu5W{D}E~srlV;TK-Mn9T&|s_BnSW=bT++%}mky*w@v^W<`Lp{HsqFlSh%?R9fa=Q&)I^8FQVQF8LC4&b$E zFA!b#vHsCqZw>-@oZup%(I+LYfQfegFq{O^f%oa@Yv#L{YF_hrXBPQ!jF!rKJn_fc z)nIAhcFT`8EH@s*hCc`PUT{`NUZNt$tq@NZ_|~)bi2b>LT+Ygg#X5V9c7|wu?P}7P zJ#tVZQ+k>J~QsHPO7qH_wRrk_8>Z^z(Yj&xbSdKsjES|VS6FRtcQHc#Yp(Jfzv9Dx_ zwK1d;ZM_)`(_UQrr`YP>=Ucc{ zlCkIKUs;V^?*HfAc)JJlH4jBX7k-gQ#p{J$##=gj%LtR183N#y@Ol!31En=M0T9YX zC9?3vb@pcUY2V_>t+eVD0z#FUwu5|qWl}`?pNxm)F|o~0xW6%dVOgY$7`Q4Lzv!Nb z>)+8RD86WvN2F!4e$?X#7Cj{5yR2-*?HI$M+;(XMO$EXI(e-1c7i(>l~4=e$u+WJT_<{@&~jQk zw~d(A^lj`TMjXQ{fvjK8NRb>Xcm5E(Ry&jF>-_?*Tj8oT=u;8=He3 z)+bJ#dcrB+s`+^?dOSu3hdFI-wZXvK%?C3R$m_9QF5vuUF|g1~{Mo&A<1M^zAprmv z#Ftf=C+8uurX5}ve!unM#udC7%dZpA|+1u zf&i$PNcLCtp`vbl6!&p}Ad97gkESg=B{Xk`3Z(*6M{TPo<6 z5%`A5dPt?wV@1{Sb_DfA+q_U!QK!@{&fLyt)-H3KAElZ~m0@fn1713d3D(R#pXL<7h#%n=M84_a%0nzOa^xYu}1ceQxY(!7$JY zQCJbW?l^6U<=fV9=Q>AQoe-jLwi%f?+niJ-TGj91J7vJ4t?hY97)%(0p-tu~YV#=F zj3o3(R_uR>dRy9aptn^&%B2j#Kf@T$DR{;#(|MV=pw%QnmH8B)wHX-Acj)ED0P|83 zu)e@v`Tqx&-lHo_U0DUD#{7apBH=B>K1kS6w0iu1X!_r*CZG^Ffx)WPDr|+-cJgkH zJzqG1?wt*uIu2b!IZ2tM%cwj8Jp4Qx%y(iLcZpkkYez}TxI~uvrns7a6Kku_tcq?B z#1ki@Ht?A|=}^hI0OYl}<^%Qx4l4gQg8u0B|47hxhDDGZ^B_X%ZL3(37#HS0kbA+T zFE8iMozZjap=M9CxP`5a*pt4r8lPNa{eRT`RZt{B!v<>Nu7f)aKDfKPySux)JA>Qc zHn_XHySvlC0FAr*@_qmQD{)S2#9o|>bJI~(nN@YsRn=XYPrfN3+DCX07qoJn;Mx9R z8cJ1Fw#_j#=`$x^UvhT#!Xav(hygh+j>DO=h$LmOq6=Zs!J|W8WaSU4n?tRqdYj6^ zm5G4PE0%VL^9o&?M@*`3n#EnKh7y@uHp>S)dXNPvrR6K*2$wPF*WAZr&J1Cf?SMcz zm6E_KVZ$=)4j039#<`O{fP?2@kR)s%2maKTW(}?JaH=ysfaYP87)M;%!)fL%1jx+3 zV4A{Fud}K6uza6_emM$P^oQ|` zgtOT~v{v2dxqP#P`v6Z8p%zo{UVEe^jW5{sPZ^Cnb}ZfNmk$xi;bvZwZWRG>j8JCB z!=bD{_k`WCOjuDhhov{K30hvs=mt^1J0$L>e!kjGdWw+T?)E35%yn`$O&|m1I2}`|K;=g2?b=4>d&>a zN4UX1GIqMU?TvXt-oUGQ4YZ1%bWE5P|2-g5o8}}o_l-{z(5q}4Yb`)dTT;cto$$UT z3GPzwa}&c%a^H5bt6THUPmu@*9&n6^^bE0rXT?(!SM%*kDQ)uW!f#&D4-s}ZyFcrD zu`9D%bI7sX+RC2K{EcbDE3iKWj~(jvc_%bwIIS-r(@1(!zZC2IKOyvDu91%aKM6h5 zwnB7LLRTHzAgQqBa+2#HGvl>obg~F!zC^=%5?x^>k$vQ_cA7BdlPVmd=geYZp}7yb zm_Z6BNf|NuMb#Z}rpdSi{3E!E3hhzTwV&P3-|(ThpyupfFT|C$);xtF-`;dA#~UL~ zoxLH0V=l%_gIox#{qXv>-SvQLD-3}Kf_Zilf`jYYViI%q{Ej5GJmGp=O&r=M5KDHY z=qaKf~nEWgTo%(g$t*Ua9&CWmyrWJ8AJQsHp z!K;{yM`)z0ZO_78E0cCt*;MW36H){w2nN$i-s~La)OYa>N}@q_t~q)f@-5L#GCdy? zgdN0n(pKA8BPo&%%#$^o5Ji*o1UozvPl-YHF}pY8nDm22fssv2QaNJqHvMdM9I@2c zohxs>AN9bDr?}=fc@-$XQnVR}d$Nw|oCrBA_5Z*4{KN^<$01g~9%3X*WkW=1{!Ulc zUmjL;78zmc&O@AYkQHQV^K%J~%^U1O$iy|&mNO{eoQP__DvC`D2Xb!mg>BEkEwLz{ z_|lejyzT^Du^%K)DUGEzD4pkg2Lz`ECp<`m7&>|^EzClZ5o!qgL8KL#wO2OH&BpCH zD*Jc4klZNY+Pp(hT~4i(^W6+5R9x7ifwS0QhxXKu+`qp>SHD`vp8v6q3MVN`(TCg1 zqd|r>EYm9RY{WRk|IL^ovDwJww2HF!XD3*?FM<2ZZufr|GvAE$f3=wpL-}1_iEW6? zQiV-C`O5}Rqp6=9&~RHtjrE8CR51}Sr)E|<{7wN2dvQXhn0VO0EVS0J854K$yTlq4 z0cJ_4wEo;mXa-`KkA~nbKLo2s&*iXend%cg$fIyD27nFXj_US$+5IuWWg~B zO$=Jto;(CGgIC6!Sc{NN_A;9fQ^(E2in>UEe|SxVl~}Eo=g7LWN9ZaM=@X1g`j)L6$5WzBiaE>r z@_3XDNv|N`oc&Bp#+j0sD#i%Ra7pXzrJXq>`c&b={RI4}X!U|ky5;TcC0HFYZgYGm z82Jk9l&l0P?JAl`W&crmbMUV3k-)oKZI`@NEjlJ;O9fAWcqnri7$EpcM-E?~ zj!M6Qp&GY_+)0=I8=<^Z&;IYb%jyt2EZ_|)oL^}g$-%nQ7Ln(60b6C&auSRYH$FGO z({HR~V9<5TN;o>cQ9V710+k8YWE|@NJ5XkP|2O4^o?w-cZzlWrHC$*M9v1}ZR|m2~ z`Y|Xyj4C1^vCgwsHow)e@X#yakU0Bhcr%&?rjb@!a(YP#>e}OZAo$rb!Agu(#KN}F zU_m1iE?J2LmeI_Fs|l%wQo-W7*WUs|eo;9x-R+;IOI+%MB}phjV=-4M%tQW{n3ldc{exxKC% z4^|fZ<)>s=Sp=uwW2kO45Rcn7VA)VNt=#pMaW-+YPB9 zu99Y+!&sA#ztBlFC!3R?rebFQIvI#%y$U;x7yJh9{}u4x`u%?ww|eFNm$pCskBfhb z|EBW}-y|M6Ywy3PK8xwU#{OgWdmDdVz#2%@x1aa;Uisc}2Ag!6Z$F+A@V%<{KZO4O z`wVdwyt>mZkCD+e{M<)gN>agq^;K(N*#kk9DMo>#=7{ksVYw4#EYv7g9i<;*=_Ypqou8i7^b8vfQ5C{J8dX=RB$ z!d{i;TX(ZHC<8mf5o`UZU#b}|Y%7kn3g?^N2OV1wZ!MX=>ChQgv?F+v`&Uk<2KPh) zV_1GRs_1uog|*HRZ?`hfrZ@L)Qbg;;==y_)T&mo;&1ALqEbn)&2u`TCdtU4^8jx2_ z8I83g>NHE4C_R;uei_|Ckh8C0#4^-@X?n>@T+W$CjHF6Ult#u$J_zP_UmkZ03HaAF z=UAB*QmnJ6A}dGfhZU`d2)Bh_4>u6R$R-uQR|MTSJULfG* z{rL#z{o3I_*;jR6&+i8Z&(Eb-`T;I{z0YB}zR!_rFR`DizxV%+4KpMP%FFk>PVrPj zAJ^Ndzro2*I$2ckWbgYV7&*?+P`K?xiq&IHKBr6YeuV6nN3O2- ztCHGXMVF^$hV2XfMRcmfA6EvOQK6`E_H1tKQ8n z$7Q8&I!B3mIkprI64c_PD7Ig?J-kaAOr|Dv2+U@Yy7aLtxASec?lnCyGBO^!-$7w; zO{kqkKM38b^-3v55inq4d;wX3`Pr-o34xOk(!vjb-_#avnm_uB(LIb~v=GD!?Y9Z} zI0tw2BRUJ{I<9J!@PMmuvC>yN*6o{M3~pMc=fCaNHJF5N_#-mG-T$!rDe2-T?ODX0=b%8i*q2o7tO5 z}@5#7`nUo2oFA|&4>PtEa8V6FHs zj%$vP3!S=AP`kdmAH)V8fjPHpQv>L4wExN8E8;LLVT!C}O$^QZ4)Yk$AdLe+IZO^rTSO*F%m{t=<+b8W%k$lIx^ix{| znKpt=HY2%?*SC?Be}*}!E{p5bU9D5=|E~GlJR7`LIOyJYTG>R0tPq77M;QJcuV9hg zW3~Y$ zLm#P$)X?vHcFVoUBtan(09}W`~(s`_=%lLyaqSQ?=B_pSPmGA;L)+7k&@o( zD4Y+453l}1ZtWY9l7s>JsmOhF2RK?Kc9Q1F)dU-?Hx7vq;i5HEps2mBtu`= z>6<8GS{sBEd{l~x1$^`rs>7mjyAd$IfR_RITWW4~7hce<;FXl5v$0`2JqN3P=*i|j zGoh}fP>Wz}i2~^r`&v0X6ypLNkyysoOTB~b+u*I1M}#(=e4AcG?<0GHaBY7ENv;S@ z{{TbdlPFiX(aj|ZQX6?P`TF}EbUDMb+%oVup0cRN1g#w>AEWSbTV!g)vON;!x3@pa zLi$ST+h^GQM&=2X@SYgt?!R|Uos>*fS2-+4{k&UG8^UP*5ISKV!>%9%$bj;My5UJ?UXm%d6LZCHAdcIu(M{+Sm?uMSH zqng{WAsySy9J1o`Vm{dH{4ByUyu@Mz%eL?`$}cDqYgNC}Fh!f7tXH`jp*;7bO^$y) zP@W|~J~eLlw{~Jp3kCsejC2qri5n6T=%;xx|D{@OAuc5i8ReEAHT=QgNFJ-SJH-i_ zRaG|HS8x}g+*iQKXN++EV&dbcZHbhRV|)gch6R%6?O#~WU8<7_=oT7by>+A;)UuDS zr&S-^Wh@ld8GSpb@-DwbscM8{c^Wib{6pfp#fD3RYlg~&9?P|b+KPzHv z<*~^!murAR=T}~Zmk*bO&jFzHoHPg?`Z=dBmAWHg43P0x@d|_N)u7?&yIf|QuD#om zB(;;IBe2zfoNNO5l7Hm*h!H2iTtVayUxVAMh)X2k+6fZ1VM3!E z8)a1^HOYlTS(7Xp_!U8-oZ7|8q`HD&&#VRH4FjnrmaK_$LxQ{_Ao5dz!~2JhVgBbZ ziA$ znqnD~2V;9b8FF=_YUrgQs%x7>hR?bBA!Hm|^I|$0F1G4=!D=|3D>L`G?_#W>g-t*_ z#75^$1oHzsLa${JI$eH#KT|;|4fdf>%X|QIz5{bSQ2L+73|`z14WDm78wL_qk{U&+ zKeR+$(5vOtf|`c23VLSWPpp#2EhepUN*Ocan2eS2BUPKlDrr5-8{F8K@^YTWw%J8x z#WMI4dQ5~M$A+eB%BF6EbI&Lo*4*uef4sUHuGkeeBXB{szK?tc0}X4;_U5})Ml|9v zxJGLrQP55PO0*H@my*1O4c!na0tWc^Z?Ogb(-qj3p?(36E>JqDZya}PB|X3CS3X=l z8Rxca*pMH4eJ9)mBF1{)J4(?yw z;>G$)pD%=O5C2`3^FKb`gO7W~Pr_u|<3APuyURDC|4?!_{jZAO!TBzkecq4c_%5pX z{}lEATeW*1$Dv4B+Gp}(SXGY6>U%UBgSP7A;nygj*L~E^Us#V&p5;FU>&VFEJ(w7N$`D7K z^<3>BWuuCq>{aUQK_e1xlt_f1z=AYBKYi!Cy0k3fWh<;& zFH*zE3DSY^TSNXEJ5+kinVnQy+0O3}`BKy=0gJc47Q4y>Uvk)^KQe%o4xty`@;N zB*HYv^&;8fgtdgVaGCoMGCQD}$F^G_2?7Tr4l1ifU=b|IR`~LC64SmM}@b15?>+OdimGvdBCL-MZYfAw{WSV-@gX1g~Crm zK*Qa3=xVh6SAnD^u`=z%+uY@D;9QMk%P5!%>7E`v9eOZmzl6!tbr0^S5*2nM6%#HXGDsi~71siNi?#@O z=F6x>^mur*3>Bwin?4nrO4rQf15-A6R^)*JR5Jz z$zPr

d=lB){c7Zg|EbEsOR_UZR@J+H+4x_g(vnlLV)BQCH8W11ZOAd4W2ujx6I* z{>nFygC)>Dg_5G!p|Y4D$%h5sb>lgv64G31m3oL*gjg5h4P1iKKc!?22a7;qoBW-{yL;F|?a8>{=i+ z6GD!PWoE~C$Bmgx;r1gUW{Lld?HwffnS&E0_(CiVr~a!3f%=Qk9UBe|QMQq3ozIth z5Oc%ICLSy{xF3H$gXc33p$jB17uTbd!PMFySSC86kxy7#*VK;{me8fV*8#ZHy$IxZ zC>~J{s`h`cL;%P3`m=|$neWPFD>&2SqWeq0a+Ji9wS+=dtudXRb8sr+ub*eqAX&@S(c2jVSPY+FdLb`~h z31tbGc^50x`zLsrZ3xQyA~h0Rgcj@I<@}}5Af#!)l3ntwGqdSmw^ykMsbuo+yUh)`&O8qk ztUhnyp`m+n>H*x5I534mcI!qtDjQbr(sCSBCQmKx#vraopc{hdMv(%GqH^O!W1{%J z)nfit(=-tF#a}gOeEg>t+c!_v!6H z*JkjUGa-lra$R#V>n6mTmFl*vK*f}Rx7@AFez5i^Swx(XJe*C@>c>-j!0!B*9i2Q! zekjaVerdrcR6x>_G=8XY%#N2Hr>p&i`<$F z@CHZe=udKc*{V6eiNVKUu8!2$f#=gx5lc=Eqz|=PV+5KQY+EGY;O?+{@%zjld5UW+ z+^t75oKHNgM)fSHHj1U_G5G$>(tL@iF4e4G@q`4VO&0g zHLP@LQ@Yqb`*S9icM`E>W^umskgE-<)q)hVu2z@@SG@f}07bb z(m#PZWLTQlP>#kJ>PgLjL-;fXwaDa@b=-3U$Ey)}nUW(+e=9?KEV;>WNSa^?Z1>A0 z$prLLGcV;@x>B=VCzAQ;U<~Gq4B@pO5?RPk@Mk7)w8+*>cqt+}f5cN&wLFm%6z$hH z#H|mTh^1u&x@u!@s%YjzA~F_n$31!|&O^+L^Kj;s&DkSFQfYT>X*1}#I!!`TU20^s zYi!!+t~aZLs_;M`OQTY36s<`JNFcs`6OR)!mtyy4P9`&OmpY;qmkOL$DOY9F)8sb% zS)q9JDS%Gym>N_aTfF?@q7x(xc{K05q3_Gx^h}~p{&UpWpsU;;FtV&rW-gZkOa=zBcpE0d!pJrjo+6`p8V@)5~DSP6NCGPc(0lZ=}H4Z zu>tI-%ChrfhPzud`bro-Dw!m6Bg+N4QR;QDQv_SXLsB~tD^^E zHS6@~N2UKDGIH=sHd?9HzP~;*tC>9ewG|;^R*5f}uik|{p_5mG-mLe5TS(M7dgnnw zagehF3~=CgWHUtI@OjZ@evr4e{Ma4t&lh8eJ^Wk|RZ4Z;PD0&coej?~IwJ>uKVu6= z*VxL?bdoQ6atgtO^g=L{P@H;Bh|-pQ3%i{!6vEQFSP<~RaILQy47)*xik9|-lpBAF zFYHOxon@!Uz_`Iex=Vo8#0acqv!gP3(3d!&PfGg0~b_IR#{Dnc@^_VCnn5 zW;~EF+Kr{gS&alMDRs(-HG?Eeak8M1^0F3iVhqpC1T5yj-f3iRIQV-%%CQg-h zr$qy+He45!OnHC--})%|GfZ5Gy#$~r0pJ`QY?YzT1w$`Zg6x|_hq!CO*K=rIvzbXA1VbZG%gQ7f z1ARLwI>m8|56+fwpK2a5~`?rvTZrRT3hMC2%m1X+l?U9haXNxBv zD6!zFn*3#QI{llhQaROMZQ?yvbF2Z`sl_I|2m3ro)~3D|rrOL3(29%MxNR7W8xn^< zp_rNZ*SfPQmiUS%R$%OQCD*y9uDh zKuf^~3}wlz3M@)z*>ep`16n@ZkGHHMh$+xiJKzDjdCdmp<^i~!EM@S94RqjS1PF+g ze6*)9s+OL^vQLsIyYcwQz&iP& zl%eT)ba<;#=T6xeyDuivxQ{H3_I79ESxOj9L-8E0;~BI0i(NSkVaLMo@_4??Hgqv) z>&=vv41zd1#TKz}^nQ`$f~arx!c5l_X0aqmdGVBvU)ZERkUQBUzT+}}eUFKoz{2c- zy345I8wVm}!W$`cT_xwWO<0!)F%A+c_QNt+Tq%v6{MJzZo*hE`Pzl?|W}Ft`rSFL` zCDFljCnbeg6^;5e$ypLz-!F~|fnofvZ|Pm|k?X@z?C$4XVg&s^@Q=F4=fEp=#iPeE zB_U=hzj3?3y|hMrMN5E`U97o%Sl~1R)hw;%dFB>4zi8g5E-t+ZvMo51MVzQC%$POHDXjzF!pz)|&IwYR6!=h@LO=Fd|| z81kw6YF+=~MiQ;_UTry!C@PPe5ya-V+SW_#M}*Y~<_ukW8&i*SP|iKLpf06b+A@7P zm@GPr0~B%Y$%ETE?VxPWdZIhOVzm90tv5>zGv&75%|yJmFOMR4`smMd^Y zuPDBVSTiFv?DyRQACz89KA&&vjW{pTsglYnCDgM^p;RN`XyD2jRL%!*9ZkHj^zc|e z94|65GecTprLl-%$R~@<(_)ZF^jQ%(67y~t93?yG69~tN<+IwVdYj4J-TY|v*2?^i zshmv39V^z6%Dk6ivm=`lbniDLe-HU-pQO;f%nHRU)xhU{gtz~Ckky8N0eSOLW|kZ& z;osMoO|R+S$W4|dsu+PXz;iI%%d#JY+6;5672@{Iv$CZg1q~3s(w#!Lw#0S>6V`i< zA;*0LfE^*Z!arjrZv`;{9$hA(&L>DuxkgmguKI<`G_XazyHlzJRG*~)^|x`2Z)ora zoNTK8*7X$ff=4|4WS{*H?fze{A2QCFB{1vOs_$Yc`8Z0`Fm%sPl30`nsnM>&zj8lc z=1+~JH6Bc-aP>jIbn)1#YjjNsh6DY=j|Ad*2_!QIBKB`U8lA#OMCiMYqpnP7^QISn zf_(@Z-??Ib(9ocPk(XT3XJm1f=S$&T&+l3XOWs!CKy!f^`-@>!iD-$eRVh&-;10{9 zOfrJij7}g-!TlW@?E7hMkjh(Xs#hG z@9p$`Lm71vO6f>5^CdYBw^<&j9|m;+G5l%BWKB1P+2|r7)M;p;Kvc+mlUsbDrTx`t zVFhsDLzSsaR+1eoeZ(r@wx{x`2${`2JujEviSfTvwb1+lPJN>dXyD8OlTH!M!eW<$ z<&oVtBPbIE&rSVoXk;4zugw8`$Xj7jEv zLR_LF-q(rMINO`fclQV*l;v{rJ-dMKxkgM$)jj=Cx@Rd>$2?tRAn5Rpu7N>Y(9-;w zFj}Tmy=ZsrykJKBW3cw!e2ninOm`_gMAzl^`yiyy)JJPutPukFlcex4$?r`CkqC9GR@w~jWM#Cd_gf8 z7kQ9-Eb-wQOU^oeb~?rxr5jPC$S5 zvmbt1@9p53J&8$dKFs71mV5kSFlYFrGlx>5Fc2i++mv!iE#6Mc#+1i*8++#5Cst?y zDdQb#H-S{eALXJGA1A5Z(z%%Dsq+vyxd=y;Cc&)pmHZW(gBXd{-U{3wy40Q{#6`g& zJx!E!^0LwVn>{A$j*?Z#9gA8$zQz`hQ7;vfzK!pd+*DX{SajoQl@*iFCRMZ~_mj-w z2ZP_AoCklfy7h2~xJB;->u{;*QgLZQkr2vG>l;&r+|Ti`#Z(MpYki*$)<-ldA3ek$ zOn;A8X)d@Tkv7k#(0qmWIful${$4VX5+*?%VBVXB#6J+Ka#xCAtWC3aJs~G&>z1mDH3F~ z!_BWq>r5!-d}K$r%F;eeVBr$+weQ_4Su9~&I%51&S@d>tXPd+*ey>BKwSPL+3>K%~ zr3>I3a=b(;JRz4!zh-{a-)!-cYnJ)Bh@SEz4GM%Z0~+o$Rh3pxI4pW$I`0`>Z)G@D z<327?6eu>rDgtRq0&VL^avDi7b*32l2}B)fS*Zkhs-FoxXPbJfvguWi@n6E}qj8pZ zYj|Cbc`GddF1igdyp`+4B z`Dnh;O;Gf3KHcQQa~^l0s#Hk;=;ob> zDHNEmO)zEx#0Vr=aGzd0BkuSHQxlOJh>$yYRyoaiPq*hBnmD#!s^t=qi?4Y`=LD!#$ zXcD&gzY$|zwdPVqKa}SrmmqHqWP5yBpdbZS2d~@%#9e^Yy6y=c(qCy24Qy0Fv4= zng%E5s^IphI@%cSQvp6p8Os3K5~_e~cxp8G3O%4K9KG%UD{BQ&p|I&%m7Ww~FDp|?h>wGnl%o({SuE|% z3<4QPNy0V4JJTu~c6y?dQRGfL#8vkS`@aAc-WB7E_ z<8#{-{}lG0Z}XAU*yrvR(6!YX?sLb?>x0kKFpAn}_r3Yck<-|a1kVWatG0wsJxW7V zV?ev-4KW1pL31kef|9kAeQN49Ec%)`&$|B;kob8B%%ZR2yuy4Q!3ONog=m)hO!Sir z)MCQ-=ERCp&MyX2=#E;DbT=@xS=nl+tS%tYb7lmmh*n!>bZ7&gVyNU~JO(OK89Cr#!r4TSUJ;RMIUqJuGZSxtBfj@-*N!d(>t; zt&UPH=qdY#M?{bM<=-$7!uT@CK~e*WQ)H9o6}ndKoxzIO>H6>B6kZGA#TZ)bWi=e2 zm1+^$(PRq6cvO^G4s%D@R3-Am9TJ?VLhwtZ&7BU^2kX%7G;}H!&cp9K*VMyU#ww9! z5%lyk5HOa40%I62iw!~A2p_*w-7og7L9G>RUncUDh6Z6l1y;J=fkn#)*CNgb7&}K9 z zMOsnQ0qg!ZAbS}UuqvmUb%#}1{6K)?(DVIo8fR}OC@2Q!7UH{@sLk;_(&R`UeQBd( z)b>Jh=o=vL`zS;T2HoB+ZV&sd4xewMjjJ5=RE9)>xYlj0DEzh`kC?*WkAN{@&17dL zxJj_h)egF8Ex4vp_fRNSx=p7uRN;xfb*gpd1dUF%F&RrhNz7V5lu=VJqCFc~N=6Gc zg+sH-PK@BlFtJulR{qqQ6_;_;+9wtOnk>WQc`3!mFIRkB*!XU zT(gCSkNfvW7R&2&W2Heul%OK~W*RDX_5#1O3lY@AECy6_{DQ5(8 zXGtJiCFjmD>L8wWrL&wtQ)a&VpjfA_3*!_Vz7L(k8FIxE8@X|9BX3@3)1}Q=z$QoM z9OrnPboX`Ox{< z|9WDKUs=RB&&br2sKOvMPW;m|&xvwOZF2$%k_M|`YCJo$5>e?@<}v6%m6C=&RpfmB zrvqBeSU$n8K+ zovgrbgNQ@kny-R`9!4Q0I#3m|70qGicdP=q3Ff?aB*qE<+fE2~$Criv_e=cqnoaeutHz6J!m zXMOB_zcmYdUNoXC(cqX+M+DtEiqmKwpss>$hzvJok|fKj;ZTXOjkik9ikPZ^ z`KWd~O1~J;=TAFLWF}#A**U>!YcJkr76l&cdL_a;FP0?>Y{=W2AIKe<@O6V7kHia~ z67{=hl(?-m@I=7H=F>9VZ(LGwb#QUEaRKx8W0PWd5XtEe00< zVvZcm40m(2%?SC|-1wYEQXp4H*DS%?(KwF-wh&Nvv;@7X$v!;V3QbI6~&h%?nsV+q?*LQyHT z=e!9jpZ)O1kw{MkQpWre^4xjB@Muskqc&3iMqPC|=3PxNyl2+k3^R1DN>hoIb?{Yl zBcIW4BND!LUfRt{!ZFi~Ii1Uv31lqET0MTyKa6JJu4_S%4%wRr#`zx6s9VUXiTuM;uNGAoQQr*;em;>IQxTG<+8VT=8iMlO8FfXr1 z*r%MtXsWI!8^EmN(EmVq-U_q~g&$TCw>-1to9g3@$-+SC4!<*lGEI&f25iYNZtgTR zTXcdKu3y3l037;-78bt}nH1ert9E>tbV`(dy|bEUX)9s`d8(3TqT8swp ze;$9{1jNP1$9>*jysWNbIed=93w(;HzR-Q1?av#mW%Y`=JNv#{{B7INvZudSO;yS6 zm-!BA!PQ)a`obI+_;jA>SmU(=N$V@e!Rn*l%5Q#2 zsuzsk5f*=R^KY}kU6mepyUBi&R%m|pBCt5sPH1FKPLi?4=O}7yi%P7ez(l0PPe?_V zhX!VB@=-p}Ez&yr=+8~)neFz{LVBLfYp&09i8gLf@R1nQ3Ipe+3gt%N*1OgApFSd) zl8oagFuQ)R#3i*edn*=eF&4q$0$oGw1L4%>%mo(pnz6lT2KC?Oc&D`nH-CjzQIrdN zk!>0Ega#a3tk$*c&-uodB_5c*+FsNByT01^dq^a>W|?a=e~MYV;=TvWh!y)p0;JW8 ze^TqwIM1$C|FjX8SuVVN|HUaG#8=r|0^aG}GmNZUV-K6mR~2^QMe%2of4E=n{rHRT zEn@%UoT0Io;A`E!f4-GyR>1$`=5;?S9&7Y{b~NDA`9RdPcwKB9vupIT$IKvfr6>@1 zai`Tlt`Vpez1&kK$#TcwBJI<%4eDp4J28Z>+(gbT_WJ!==EzAM9Glq^E3xTY5HFKa zAM{I9lEBvfClZ9*@HU(CI|Sp8K)l z^C2Wcwla6BPUrpnz??Qk5kURj{}UE%FTWp!CBj*SUiI5qiKn;+8aecgaCRpnJ;6gc z>#O^vZ&~nH^!ns#Qn`n+$Qd*P5)z%aRn_bSZc5B8;#!6!mfIpP9-N)^bG5YSj%r6y zCLMHxgR?q)1}b@ynx%R#nfP1X{D{JLVtj)@tP(V~@Yol(_#uIAy`6sOUvcl;#ewYi zFQx+=r1`I;;9KSCvGQh4pPo(s!SJ5e?;arB<@3_0o%t!u?4n@Cr54_tiDAsv?1Z-z z)v1wu9hSX*IvpZeZjK=bc79GY=-8r__W$$))&Ki{_5<h3XX&d`(2XCveCu+z7ka%ToB$!9Fb+)^}-+q1c7kz)w!aw`9aOjD?hNo&dZ z)K`vP2Y$1)|35AEYAFZ^=t=p2=*$`%EL`v@u{!tj<|@fw`OAD4-C$I-o8uQ^i`|x| z265e%aI^ZX58plP$>(B=_4}LAB|h`_N@9!o*J*!F&@;dPCy+!=x%^t7Mkg*fY`BfU zHPVM;whBF03Bb|64(M$yHFEDsI9w%{TZ5!&M<{x(8|n60xLPCY(zzO zC7FCmDUorfV^LR5gcwj~&mrcdr;7~t=vM`3hU9DDiCU>M$__gf)P)+}{3g9khzv^j z(_@Zh_?tK^N4~*_kji`V#G{(@8u?D)3wx~6$ zwMBF1gL8WAr!5pT8O2fP%sJ-gNKUG^FZjCMs`od-q~wzGVAqPWHuR|zw;Qgc zEt_W7x?`>;C?@1tVXqy@DbOmlc%wd1iHxkI6~A;tWx}aJ*neQrffK)(_h{$H4Z#7a zz7L#8lfmMHV&sE9lG1P5TMeWIuh>8PhH62cz7E{%(mhS}yfrF}AsGUjoJQvS=O$SJ z7zbRrj$X*S5ajyP;m+N~i^C{)vH166i{rGydcR2v1cX*rZjBoDi9hZK>I ze80`=`sNKB(puP*=fA|J4r9?-8@8Ul?CN8Jv_9j#-Pc3f9p%nI3m@~UrEo!*a}kmh z4M2<26c%uz`QNVk9ybsT0Mwo%uv|*-0i5L*d9Z$2kr* zVPv-ThLIG?DC$+3Gt!xE(8U#|VrAY|FHb|(cwBT{a8;7?D9N`AS`XGA>4_mv|CFWu zW-zD@q31q#SvyN@+;;!i%wl3^u896=&tk$KkbCQU?GBgx|3cvBbP6v?#ZVO zzs7N@{ejshnr0KqSpU0jPfLs%t)y$^^a@?2glLZQ6kYW@I^iI@26j5x)#b?ePw&i> zHFN|GmMQ&%bu?X;-IjSWok&5gLTf3XNl=rUSX2@@t=Uf}5LQ*>QkZjLuuZ%#(I%w0 z5gu3%;(w0Wk?7G%tc1Zps=)Q-Y#bEEF!V)bZ)Bfh&BzrC80$@ALCkDK9ERE03Att- zDSmniShQWq!9YMN$28JeXXEMt4j1!2cQ|Q79=|L20|h4%8h7L;21PJL?f(=WfmpMhoU+P0bOkS7mDdb{$IHn{{Jp zCWm#j-skCN>QGh%#srviEo6{J>OR-10m_cq9>QnvkaG^>{U{o99(kN$?9g7uZ^-n8 zJ<3Map4CeZHpHnDzvca@q+V_j`97KsrvS7fc{>{J!IGuJG$d4N+H ztyGsp73@iIJe2NjLGpSOJp_o@%=qBCyN5?n_+4)B7ivJF@4%$(l0u!a<@8B z`8jGBbtJ2wN!L*GN!?@t7)80n8SE02b9N!^C@!w_O4c_=SM3(3s2}=`Bu#ir4>NuJ9=T0_x&wPidn`@6Ok#M1;ss|wuC0dQ*UI?;K z+(#kyddAN%bOwFG(VP=a)lS1lP@@j9mVv?fj!bhggIbS!*sRU!k&nZF-EzFweq?*m zDL7m#%jp@UL*W6`QItUtVepw!>Q-*m86>iT;|tUH(-daXX!LX{nYANLG3a0+o0>+~ zr*fOC^oYLynkm=Cpf?q9g-8;WR=gHG`C9Jc#fY83enKxWP>ZggU$smQ=Q;_o}9efv-83xMt*wCk@6Tgbwm zygv6yOoUzY?8g5G(yn%q0iMX@8;ZhaAMSAy2;qy2SI8C&n!4ivSP_Ck@up}L-(1y z`%GT%a_lpC;n`>MdY^qJFWG1Ejve1VlXsuV`)HZGT~RAi!aC@RP`y}yHc2fgU11`` z4cNN+2XZs9e=cOY`6o{nk8NMdIcqg784*>MO*UoI4zMc(iwn%5?A?{?jkK{2bWJXUT(%^@^<7wYTgLmmYS^mt6f~Ed> zBO;|~-YQcuThlz7Eq}i0>G_s9>R)G4K!TJ}ejuTywx7%y)U~{8d~%}Sj+@iJ%aYt- zdD&X??Be*evgTYFm69bg&zVSjwN9&-;F)OX;uYj#+B%&#gbSq^?ekmjrTM)yznA9Q z&t97MK6`1N?4|j!2zB%0}c(xfMg~B|R=4#b6?S)a;EOKVW zx0@Nc;yKSK2&j~3x60(uyI3#H%*jcrFF`;&JcM2k4{KQvB`aK!lrNd;JEjR0p!n2Y0jfwr%R2Q5U;pm% zZBL$P$o>tL&W3jK&Hw-6&E?ton|IfzZ#$47SSL+OqkLJ&16Ps1XAV+mxm)!$TWhVa z&yDJ9t-vUiP^jjW%6s8Dtux$92EXY$6I4?es?jDW2RHz;Ra8LXGOlZ8mQzvDEL#&$ zI%ecdm{F*His%^tevWayVx`l?pp7|&TvYCo)U~O4x`wK$wO_Oz>x^7W@>9jiHCbkI z4kI-u@OnjsR7CNVCA9SDwziRZotxb%LATNjs!=i=HC(ua30=~x6_kBt=GDIlMst&* zjyrZmTkRRX`SC}ZriKFl_~VUJ>vN{*6vW`3lf8RsJ*8zymxDelY*mLZ;PqRRmArR7 zG#D zq+G6SxRmQMkvSuk5G-Lz(Q-W_ueS&9V_8||oWh`?L-cKT;9R(Le*l&V=ezs;*dSoO z<}oRyhi`1#@8P>wsQ2S_Yw8Pjuyg{!X01>&c$o_<;|!q=H6R95x4UL}kpZyUc|VpC zZcA*%AbSu`@C)kXcMkKQe+7rN)tsfg$|C~+4zYDx*}Df-bzLx2Zt$95vw(2zg8ON5 zi^nhJB`CUUl#E(ctPc)c5n@I~Nd0imVw>Y|cvwU0*zvRyT12O?X`s_1+r_b=isvkc z5ss|#w6SLcTSnqk6vcmLP}$1Ab;06hvE|Jo3!H5plzMnw*4|*#L1vUYFo6wlN|wzS zFgmKe$u;Z@B%bk~8CD>~U@R3fH-IrE0r}7Ln!~o%hvd3dG7rg>6t+#EPkS@!!QH#; zm3B=ulxQ9P9MBuLPNB9h=0<)F;q=xyOwz#h!vBAFV5rj08nc-FpijX5eC z7%9gpM35`7bxrzjNu^jhT~<6Db3Z=0a(X)!)EiLpYjB(>2Im?-oWnT?P->2uQ478h#1^NfOw@^FM%S-Cv9MYbIF9la1+kI_(zX-H|TW z%RH^Q>JkSr-TKq6Y_>-th|M$np%sO0_7k-qFq~15PHAR@?2GSTg-xvB&H>G~L6@>A zqY^gPm8CZnw(lr~uRY7>46BH@fYbmes;=Ps{i_M#Gd6Sof~J99!CH_p4YOV{P@3Qn z)yX$7{B}TDT(38OG*bqY!s#Ea9E!k)HU|A>gnIVB1em+9^8azDM=>9@)*il zp9*vtnmdVW>Xr71OFV#4xC)zQD4TeEIG@ji)StQIJTOrAqR~C?Bu{NoJ}O8h(4&*q zIB9E=bEWBRAUu*7+E>=`$*`OX<87hZAxlXG1xUaRT7Ti<`&Z$!Zyk}CAp*cI&ZyT} zX3MNw0o|W2NboMz8e;8S>4taZzO$7+%{>Amv=?vPuGsf`B_{Udmf0NRm}bw~DB0~a?qfI$Y;lzAfGY7XiW~J#uv(n7OEcu*y^Xdp@J)kA(uL3I8 z8cB76HY1yQBX|}_T#oT3k~*e2?AO?Ux2`SEE?N~Gqe5ckS}WBJP)mZloXCQA0Ba3R zFgpwL2csF}oMH`K+@r9k2rb(#D!=R2|2u|zSO-xFYH}{q;ijA7Z|l{@<$`d!3iL;8FxV?0IrP!O z;Iy=GMelZ(F^hUBoh11?9MBX#H+>#L=Eo<(wTVxpgR|W@Eue${pwf!Q7doFJPUv2ds(P#br_9%gscDkO`sUUH4@4(c$sFD_1Jy$K8b=*nX7*XTQYOi9ejmL)H ze&QJc0V^F3fZ1+7-59frGej`4#zzG7aGcwP{YCXlEcS9OV&n3*ztF`9j_kF2bH3%S z^8K7OAR{F+-@(xjNfz$;3W&+tN@9A&%XC^$fFM{GOikJ&kL=Q!VB>}`iu(`%Oxj_G zVZoef*?J%9a8B5<=*hW#eTvx)!B;fTHju?e!rUh}yP@!>=9$7SM>GrIS8NV)P|(L` zOqk2&)1iO6%RGj7x|@z$Y6TP{s7GvzHOxs;$fC*|R&rfaK(An+6U=h2L;vELJ49H6 zjBI1|tOgHMq#0>2hub~%=NrOBjs#S{DBZllmF7_{B0hng)Y3!SB+zopI>Chxf!5Wl zTxaF0DoGftO>K_4bP0Ck@w0(=Oc5nrxJH&WW-Gg;5@f)1E$Hy6BwgWg8|&XjSYlFt zB@&GC<55S#&T~s(2it*#<>w1bfR0iniPiM$gE2w)s-7HwaE{Fk1B>W$PLtbv2(n3J zUQlh57$zu7wFMt>c&MXN$lb%mrsUU}E;(wg&6Y$Mqf0nR)MfH_rcY?4Wll9uz+T1| zM2Z+W1@|pSOT4*$&Pj-300=2ACKzr`B=6dm9($Ij`Dc`{iW|~D`<4_G5x|VkHF`xM zN2X+q@Z6|NRA`d&g=K%LcDjxl?A8Vw&GUy9fOa;=0F96k^%5gm-^&K_2&-Mlg{3EI zvLSRw_iBi>+2R(RotPVY&$7(?|6$Zt&HCnzVUY^LkE|gtB1RmaqqLMoVNLP*@#efC zyrjItQb8`mBXYyQcZU$G7M}!JVOukbaI4`xQ)uU}kbluj+trx>8+%s}?niZ?ocUzigOwTYxx!72b&X`}7QmGn& z;ct1i|KL5yiYfG}(af-E6)HSlTCcEPmZ3VQ097{(LQi8U?mKH>T-rdvn zOdyyP7fWXazjR;yx}-t0ruJj?L2$p?xIBC7?IiT*5hKVWlmn!#w-1%|ZJWO*2`hA@ zVV$&(&x~9#R57~KC8iE=0`PFJ7-O2gJniM6op?*-gyC~Tmm%Wv0Hy<1ATG=ETM7f?bvf|5?>n@=MO}NI; zkg`A9e)Dk!c{SCQYQ#s7J-`Y7h)&vi#~)itgpo$I+>8eV)eUjJTO6p(eWFw)(k&7I zPzJ68{KTX=00RL_?PqQyh+0UQE_TPJLL0(~+ZNd+ma*>(7JZE-vr9Yf)68Wi#gg<+ z{ODGUQJp6k2;pfz(Jp$jRg8$5akL}YUnbzpU?c-r_q0O*wqj*BQTR^3-RJTs}b46Tf zOogAGUdPG7WE4NgCz4&a#}jQU9}|s&PshDuC?fcHZrM8W=#H4p_NQ>LIV~dI$MlT2 zL5)ex-+DKk^V5A|Gl2Tv8g_Y|1el6NoD08kI#vJWbRMIXp4uZt-PRAN!7Ii{IgG|x3&w#P>o&&^j^r0p^cQvQX z;!d3qZ~dnYHHhr-lcyOY8Y?f-;O5ggo;A!C!lnTZ7lJ7mJ>9DDQA)owXUB+eB^)Ii ze=sb=jgz_K5aNPUjzElyJU{)oa=i$0kv#?gZ#JLZHLd|1x@f6;1FtTGOBdhg0DfHr zPTl6Si&8g$W4HOlz7Djd*hiq757>=;WMJ;9qWb5 zwR&kB_pUbSW4p`}^O=~0#t~N<`#zWH*cEJEtSgmv5UcJ&=pyZhdsnV5_xTmim|80h zakw#E<_Lp`AF7u^}Ox^3gEiZf#LN6DiQ539el;1>He z77Xw7;>@ANI@$s}5r4;0qLLNMDbnd6MW~fTgctx6!8+09ij}5I7e$gtamPvx0TWBX ze-1k4aRfEI1sD-D*tj9n7+5rBw&ry0ux2U|)wffZdN{|DYZqpg$ULtE*Xt8VYv%LH zsGcV&yJOjj;>#&5lNHx2(N)P#Xu+p2K>)5p zmv64FgPUr-yNIuek#mhXpxIcn^js`3>@`@=(;*BokwT3{%Z9j-5mhw@ca!t45G`lq zRjA@SL2wTXDKj%l?kk$J>=jl0KnIVxtq|2aHQVyAjUC2D>1^&Bi&J&(%0$*eYh5_9 zWEs0dte(KaQBn8hqAdI@E6(`V0%r*`=Uw!uXl}Vd<63|*Xkn==fKO#4A){A>>WaI^ zC^$xBtdWb_w}aN8L5gX^yBre2(3GUaB8pf(4@+Hj7R^{l#MY4r%hQn>O%|c8|AMFM9JO#uW^dVA zwJh7U>@ke2;DAJAxuk||K`#l_Y$;3g&m)z{!tNzV8prjP4D@_X*ET50i72XtW)9rC zf$LEA3s7=uxa*N;0r&1vj=^xWR(GG804>8W1pldGOB)>5Im=uu7JBB7aH z$!fX6gxT1D+nm}oEJ7VW1pH}Wg_uf%Sz(QMMGHffOFkT04a#;$@}1S04n@gxTJmfS zLX}9Z3mIoN7>3AGmKRck@&re=Q$DL*mFkrf!G~^wW9DN|7l-QY3(iXQJJ`{fgEnyC zBTi!&j%%aFgwb-^lD30(N>;R_iDo5NnkNGxezj_2PY0??0EBBcc_quoG=?<4!rx%n zZvfdgPEv@)$$AQmtWOaiE6OD>(qJ%T29L$VdI~J8UjYYeECyB^q+m!qiow6?W*!do zIEa1Khio;_XBhV?3e{@h3!Nm@NJOi_L2n~94WL;K^tgqj^+-roV^ORCqblMUJQ{-4 z2pGfY4B)59{(bz+->1m>9h31pBA0iBF+47ZcVzzVnB3J7V~tC&7@3XxBx8+pfk$Kq zMg-?aJMwmQ;*G$7dJ6ofC&7Lii~AJa@snUaJpta+Q(!%f$9d|YI1Th3jq$XN;4~z2 z4B$KUp*IaJMF`u;i`+DL6N0!-9@M6o$q!*VZ6G!cDH+3fPFrYAL*m2$mXk+98j`mH zI8GjvrXjlG!ElO0Xd38z8^0+IooR@=v;cg@ATteZ8TR-Ts7z0R$n*qgOe2w)T5|uO z9y*M|^q@`iBQR~_D@764A@rp&Fc0y_OLb!WC>`nXP?vT_T-xhddp&EfXT^>+636Ii zFpNgv7mbD>kH;>Gk8qB{E$Si?Mf5s=S=56@6wzr2uc#M^D56gfR?(B9>-|I96(W&_ zo(N^=i4cZHq6@{+i)dt_1~({1&x}JA>S6{(No~I}qENgP6pJMEBq&0o5QNA)CaokI zJ*a~V6wz@Ua!?l&D5Bd3p$0|gGCc)a(1VbI#wL`GK?sUP2Z}_;#wP+9$f5m2_c@FT z)J6J>TS71b!5ogFZCh8=9<@pa-Q)$zDGV=;B=Wr!EZ0(d&H3DUc183PD8E##Xh zfpiERXAAWvs@I1hZdIJBE+q??g&P-F<@rUma1e=Pk7H=Eyz?$d*A(~npa-D@ARO)pwabdL{0 zwHb+MvjdvVIAoV`rhqsEn^EXBPh>V2g;=wz;xcM?#-h|%{F#VhL?YB|W6#7)aS)wm z6L%)gITu2v>BXFh=(Zn~=0W1rV@uP!ho_Fiml=&M(?O1j^Y8r1xH6HKFBVT`2P~Ok z<~9mP#-YRv^!XqRnNf>2@|eZp#zZ*9AB-9EXeo=}LyS&Z#405luHK|7A?Uzdj50?J zf6zB67le}LVz~2WkIyBe>D17;f4=lZn&^sVwp+|kjCY+k$B02z+luyMn*4)iF;aAV zHYgTPfDRC4${lCM9c9A(WX-n^GTnAA$M!Zla%<0KtP9en^`CC{r%RgLTJq)ME9%b< z9a^KmUwr?{`b8nnB%|fh1#Gl#vFkgA;nlg^%!RmExzYT@Rg>Z!Q&!q7)K8VvbYg8a zFhmSU!DN`Nbs0SSDNMZMa8@lp@nU?RF0z#ANnhVIlY+S~fSDAgG-Ow$SyG{C21m8M zwym%lSl8iULU<2UBJ4e%Ad=fQHV0=gJPGqr`gR;bwu@3OjTQn6Z_|44WDWG|xT%{X z>O?dnvTR2w=~W9kU~oyXuUSk0OC6pv&}lHV%LT8*NJ4{Zi5vc&A^ZjzLhG(}Bu`6a zV`B`h9$1N#mDw8XjBxNC=YUCpXJ?EU*u3O8oD-&BxxbiEH=6NCXX6a#gU84lV&T92$7&U`IF**XL*hU)@I+v9O z6$n(-;%*25cZ`Q6qe@?ta?Y-KT&!4Us-3s%+yV3RJ%CZnV~YtxmW5rR7)u+fa4$(p zHJh3bKDLq2%27-`UUW@HQ_8X2L(*5m~HAh^#ziS^5w zQgk_f(d>I}rB+o=#k6EJg}^-f*Qj;lA_cfGvD~;xW?x!s8M9m?%k@$fLNxWv9A85t zG~#_t(9Tjr;YCfGn)aohkentfE-W8WnhIP(>$(C*=#t+>x|&b~g8>58mOGP&YHK-T zYb$U-=9HyY44=g?*qt@2YaEGXl{T#&ch)3V@A^X&h-9qEB=P1m6uGdB6^)cu0 z4*b1$&Pp2YdKTIDh$V=1icRCP3{YT=GWJA!8itHL#fqvi##?Cbvt8mJeLL|e7U$Ak z#lZu;LA{#S5FAuF&V>05{AbpvjYAjkvfW#wdXxFu#hpQoYcNRETIsNAoXEV$7)Hl+ z`nQ51_@^C(oUd)OA&s+v&XOfDx=~)WPpIkEjl~DQnGuH`ZZ-!p_rYRe zzK+Mh^jnk+>?VE3zfz1G9>RzY4*_(9(R7BjH0(I((gDmhX~k5Lf|j~JHC)&4es}q{ zCsRAHd3r^K?764i#G`9ywE=Z$Q}5j`F`lJ_Y%ppD-n+8k4{2=@U=);)w@>U>n7HGm z6gd;RNhDG%@nCaep+;76i1N%Jwlt?}lB}p$GNSlW@C8q((AgR+rACBH?H=`aDWv8J zb6^4`%NU?*x00ILU#y|n`@Y!IyBmW8Rq0}?Y<_h+9Vx7xHKv`@a_J$!-H5@?3vO2x z(;)da-4R+YA)VDnc3d)kb68w9m^s_^+h7bVs8VpMr#uio+Si+fSAzAX<}z`mAixTY z9&6~Gi@QLDHCZA%K!`$A_(75t?ql}01G;)*874$;;S@amnv0O}M3W;nTh7`q*fASo zo*7kS?RZf;Xu{Jg*NSBez+wV!1pq|gi>1O%wD}N<*@+Yh&v*#U7AzVI$}<dI(kJEy4I15}<%ZQzFT~U69=R+Kx))=L7|K%H&P=o8aLYC!uww@*DQUrGDObQR z*VB?^lBQFry>LgfU}2=3i?>WH_39;g9%vTDNP+Q0PpMvJTN(l;^Z7Fc2*h>RoVlMt z7H^huim)v8UB#n3ojMd!trbFU+FzG8&+VIKObE?=`?lm!N zNEb*L%sZCT@|^*=7AMlmPPUwg!s2Ip;^Q{&K6*ip0p{e;wejL z3Ad0z$Q8QLq$~`F@{uKTB^Cf#W6A#V^5Rupvm{ue<2qBXKr)Hh-mfn&UfI{)Ug2xCTw~+Zuisu78b))bSvkZ4 zVJ)m^(-3SIoW)Kr&Sn6+@shkk#mrkW2ks*nqffu$8Jmz-tkn3EA>7}xwfRRI_pRn@ zK4NuFi@LbX;o)>@)@+J{o$5?YKRY}muil;+Dxf^DKf_cxi7oD7<^$4_W){lZ2tnWl z1%7wON-Wo4*E8grXu1kSTgDl;are*Z08UYND()R8t$^u}YU(N{+2b)}KcMB34OKaa zH_=C>KXm4CZPPNev{??13M{k(SkGabX*=+j(E&e(rQdOOe`0}YrbZB-TI8@3fKoU? z82tzv)b;z^pmfh( zpxjgTp-%S#f%Z zv7{>5)h#c+2m52>yk2t!F>*MFj;IN=Xh4#TIXSmz@!fr)F}?efSm#@|z8c_W1DvdH zUc*B1;Mn8%+#rv8BL21mZ;Pb1JJp!|Wcb-wUKYWrBG)aBLyhN7F#su%oGFeg4RfS0 zH;Up!yKo_N{)F?`JL~(Mt<8!4Ba8)?N&`^B3C?rxxT*m)jhO4(&c{U zyzEU3oEdCUvV^68KmZVQwHMzfnQFSU_24Ngg1=`eq~E;RZUr*|=jjofr(m13Z03c2|dJhC(#_$32tFuP{|+co*Kfwy<;? zyMWQF&8dJe!v3SdM3wh{Zb}aN;mxOJpo_epW>3lAl_!vF=oHH3TXx4{j^JC{^w*es z%H~x+eV>9H-0g+BjfOw+I<{2R3$>ePG_3V8KGF$n<$?I(xDD;$L%z3^>qf zCAbYB&DDgc3CSm9H6iJQ+)s!{1Rhv$mO9@b+%RUPJ$^_Pfs z8rEBO)LFv2J*2M;>ndSA#jm3b>L+7$lOFQnH_r@_5D4Y#mK`prUfI*>+ruuc>E>uG zc;?F6Lr5LXq*y|23Ufex9ASH86Yp?0CAgi4Fa*ULZYHZ3LFuy9+$H)tM1SB-8~pH| zXFep6d&*JVYRT`0era0j8F{lL&!6=d_iVvYJp1TSB#ze&qQvoi>*uuf^Q!f8-uhX! zf3J@JeB2K_F}RdLNT}YDG^)nNYZp`OLM?`^YTX3~NCqLbjeTY5#3-4r{J;rT+HkoB zUWLE^f<}a%4%Ai}UsEZPTH+9(jdmg$Vy1NRXK|F zPR4ld##A$^$2{m78m?lrRh?+C&w=ViJynSYyNs?{6rB=0?B^P+?-ONOj7h29r3%r& z=*Cwa8mcxl7NKbnohcrfDH@gOlSE|N8I5Ul)u2|jl;GL_6siS9T%O_TK>IWK>z>J| zDnDaSt=c^yA!wkg&rr>t5cLmK^Z6BP^*jvmfDpCv)&(4mVc~a5jbC_&W8vxZ zDObIu2^Y&~WA1gkeJAe||6sHcXQ?&1k$;t_=psW{)oK%y!a_V$MIv)Vl>)2>uSbng zGA|hg$m@H$x9i4CVQ<&n+jU#dSi5eAhD2I)yL7~B$F0dqM*#6GTG)Ww{p6(kPcv$t z2=Ew2Tgy)(7RK?LuH3p65@AEqcN>hY^HB+(2Gbo;tNA975p{61E$o|id*7YI@CaGy zqSE9_Q*Cbf71MYvEVg0i!!-l+8K*583oQyJQjBLp64L3$267^l)6|L&KI3TEv=fi* z(i%Z)Unv14#GGzGda`9d5TM?#SPom9Vr+Zx=?kh?(UwREkG1Ie7DCpFT-1T~G*u^p zwy+vw6GvghaAc1{)&Z;J@MRDyI7-FENtUvpOE{>}bKQKAq)f9i2ebc5-s9iFxgMNo zVS8{0vM#U={QS-G*}6}7TJHynKG9NEBDG|$M#(?l81TCmLVi#X!>2Z2&zYv?jy#_| zfA-+zAB8mphV%`)u@g(&-FWbbN=DQ7A`6BhcLPW8fWnK2_rqQE7yRnJ7r<-E+;`Q$08!N7(XE zky1*1{NU}i(|+@z2$uEiOdTK|4ZkRc)*v|Njr9qv!Ix}B@0d|t!G7R15ZHbtxx!h2 zd7*{(2LOU#HE4N-{^jWV)5{;Yc;DDK=9&690y78M` z0b1wg1EEQku4p!}2JAzURf^v|^!^VcXw_WN+v2G(wnBiOGIIq$2Cyg37Hv}@h|)4W zRP7$Nm(VN5Y-zcLOwrkPUH1oyyw)^Xp~PjsWTYG6(LN{#>^*7;y%lhE$%~AUKi0Jz zCm3h_r`G9&_P*_{>nZ-x{q(24<1!>0;a8)ix;Hiu9HGzMJYae@MqEoA^NhU7i$KL6 zMBhffN3*QciL$J|wXxPYGE}|R+^=`?%4|)Qu?e{VI??JT89`tMdMbi$JJD z;T=%AY`*I4)Yb76DGUyVwd*1eRjcksOGQ?v9;!=dT?Ku0s9Qy)-~3e3tjpT*SKfZ@ z%blXE=CymCr3o$3jbiZ`m9$|YhWdDWOsJ?yPjeEKttd!K&66slB{BDODNCeSKWZ_-ynUxDicj`+W<1fthEoi-k#j2gH@~;6nfYi{K#&`DufYrCrMb zcqBSx6P*+rN5QhvAkFM4h>kb0RcyQ^unv(-cd*Fc&H1CGWJ|bXczbrdVG*F`ee#o* zh0Nq~eN`B(?3ENsmp}n_7MQRJ^T!@{7N9&sY}r0n@*eyK_|2fSQ^-^inoBDg zAtJLI^)7NxM&~TM0*^%`mwDTMqprqhbXYE$(Zfh*Y}$u(nl7-{Uk|nAwvm8w)jASz$c3|#i;Y<}Y|YHuRz!(8toZcs^)o?a zX;-LW?rN}pj(eO)DWsT!91xHmNYs&Sul)9q>JQqF4H~TR!FQn!ZjsT1K~5aN{hL)Z zvOZ5p&dMeD6ccY+U-Lv2AS64LmWo*X$HKUo4i!ph4{Hz#Cua1(#6ThlM>&qJr5d@; z+Z+`KgFGmwg}GV(QyZ85mlTwj1GnpxC@z*6>%3=;!|hL)-aESNkdc%M!Z0+?jB1nr z8+_b_?E)19Vf$uRF=V2n6|`cSLX!8gloebzW@x=r0b-ZJ z+pR-LXwPy+V6Q-gN~Ji|_)T|7T~lwL%|g{9vG$J{IVGaXpg1;G1Ob5@%^2opgef7R zOLM<;cL9AjWq|2KkicOQ?aR6dUZM|Ix9mRZ_8gvL+YG={D@r#3eEBUc7S|mhmr+i@@ zXk^axJ+mc^QHAsyKo(skw+<~qJhNK0bQE}*$vMqj1iGJUUT?LnM{fVw=(e2!_~$N= z4#ma0W7L!he2zQ}Rv2g!=t?wa-Mi)O(OOfeA}>x}oIHPNWMj1IQ)Mw+wpaW4 zjC}O=XlC-9e1!kMu>b#@d?X(UxgZy${eSa6@{vr<@3>b{flwbUZdl$lUHIc&h@cam-a7^yO=9kl3v@4!M33W5rqtB<${f=ZQ zy4~DyX=u2c>CyA!S!e2IiZ3Q{WZ4Cq*RzIEQ?Z6m`sslq1*c+tPuGJ4!LigOzhh*@ zmn$ejQ^O{KM-%Qbce#T2F+T<4dPdIl;h_SPD9ZCF$JIU(Yiczc4rlwBHJJOEzs-j7 z#ksbu(x1QB*(#maH#myqA2c_<`0Y6>$9;A?5B!mMq?*SaFdi7I<4pK-8`47|fvbHl?2-qL zso^!>H|X_#XpourFzpwU)+&TX zYTN&76pwFsd6?n7v`jgYN#p;6@>p|Bdr#-T9yPN)2A{Pf5`HzICLVwg*!V1GwSc0y zu7H3{h+y}?6$3yd#J6Y(73Ms&nd!vH4Nwr&WoNCV8yL$@=iG0K!g!!x^qjl1^lfBJ<#p5E8HsEvD(n{8 zHfJygRA0TbH3BT5*34~XFs^FXIZv^=Q`VMJjRee7=FdfU4AfFV5KihK74k#V17S2- zVel`0;7|UGW485RUM06oJO4%r<&p}h6Q5C$n2WL*|KTm1PVnQ{Ba8}DGYNH;GWcXG zijV{7XTm~?9c@kYG*fb7$c^iG+ZYF*z@PnE4Ja#?DKh2?n74c~cHcJ`KNbG{*(9tp zEQo!!*gRSX-OOJH4}RcR7-3b-$-|rItd17oqP03Aoj^)`^TCkDa8SS59gz_y4<`84 zpKbP2>#G4_v@@DB-DkPk^*(Rer{aw1+iF{vb3qgowfEEyQDx{pUjWjGWJ(+!*48V$ zj+?PE$OD9k@n7-|)8-4HZ!YhQ z-LY~_3aJ#34j}PVDZYdxodM4o)u=(j?3}W7V709Su;R!Ld45cLK+A|9wp$G;{^awM z=O@p%6nt-|ZN>ir{%frA?*C_t9y>|E=WgfJxhau``=C$Z1=!I)KW^;$}a}8+Iw2<8qKWI`9R?E z>ox{yB>>2^WSOL?!x8GH=YwOC=S;D(KeZ;Mn$D?WB zmu8n??nczuxo@LTh$T}RlzOXmL-$k>(9@`DR$0@$@CzN5$k}fH^q;uqvvc|ZK+|$L;_eHjyV3XtNvm#-Pp<3%ao*;6@8n!!PlU0NdyQY6SG; zXrPTQm_|U*4}xqAn?wWP8jl97F*u4LK#eB>(|9nD#xRJ+0D#65foD86aK_;FMF3{( z2$m5v*X{_E5mKOb1jz_O`0N6Zfg9vMy1Rg5374l;~qS z?AL^&rJhZJr!C&}_3H#4_w~AR!7nGgbhE9@E~V}+fl&s*Iv}yK-`HlRm?TWuS_@RH z+bF8S8QOM{Yv{dtlToF4@?|EITQm1a%V*!4otX-9`ok4@&DCv<%N#cCZUB@}a$C(= z#=yz|;z3T66}S&ULil8N>8kGI+&5OyawCmV!_H1 zPs^Oy7lM8AMOzSgl0y;vK4PXCF*%jw-bl#o&hS1ctXC^yt=%q&dwb-Q4X3t83!0YBQa19Buw z7*Rq6$r!z3PGdKOW{rt2$6nJbiHve0QISq$7kIuy_l85oC@UM(v5;lLtcMhv1Xo8f ztu1*Ba^)*li%(rDha)FG zI?d_NQjj-aUfE$C|4NJYK`W)2`LYdClVn0%X68I5Gq2`0ny-)Fi&U zJacm}Kgz|{@L`ByLisquA1SCda_UzbGHS!hhXM8pp<6O;q;whV_05ObFCkYxbj@$M z2qFt~Z?S0&?xRGrPHw{0iW)*n@+#B32n2}`cjV0hgA|v#@FqlA?ai)`H_1*J~pm9M3uhdlW3ggQ?MIk*Ah; zwyd4x$o%aDtfZ+EoTmHh39RY@|(7t-8NX8c|0NEK=i9v8J%Xq-JL-&T+-AlI@6Sa8fB&&hXQp%Hj?&IvDIF3)VsHTiQ#u=v!I)>)P`hCO9a8 z(Mqo{)deiCRvhSEYQ(Dh_1E^vN_l@mW#RC7U-b=>CbaDekoI@h2~+!+ zL)lhNdXU0-p}Ril-n+HA{P|k_luhyL(;{uw|I=|Cca3sk0}*>Nqnz`^jWW#*4Hi3# zarr)Y-^ec@{e6;pe-z(*z;edPc)QCX4P7oIq)S^^<3Ujjsg<)kKr#_6Y0fk&8>p&8 z3So=Oyf2uz(logZdPVl~!EatZc!0y#9UIKxwyB>@pcr1DU-LHp%6?l6E?phi?&Pm&PsY|kQ^P4%>HNgqH1DQr3OG@j-e=M{jbE#MMtENGx;{YO>dH#P_@831KRNXg0Ypj>E6CxZQ=I_7wVn$x` z5^`U;1qN{unJze3NKGgpuz{Eq)@@gqimL&k4HE+Ra-}UcgE_q!Pc)|BBI%R^_$9%=PoW%`jNUvd{)HUM>;=Unm!B)?+&!+5{-;`ERo@P~Tw+X^9&77Im zSaviDb4}Ha(Ge|0o=4}nm^5TnlbBwP!bvy1w=;CgjA+UVc) zG6r9Hm3^pgDe>Nh4%@$GLUWKy40kcI6E`Bfgl!nY&-R6pkkeN%+kDyl=}j~LZ--Mn zu~~f1z7b{k4#{Xy=WWK;5eVHtslvA(9PLEWLG^zr902H{ z@4nMi28hpAF?#`G$8K`AeDcng{iCRxR?ajia?&ba5M94xM2=zYAC5OBkMOLrZMHsw z){WaU0=dSh?m)(77QtC?%@Qos{^ITu#zrUrc>sTmRA_+-%dCcqYCw<8o;C3b!(Cew zj&4GN1k7_^u{M`?;*P5P?4mb+tSyo?&xb;(`HgZFu2A`!!he2c z@YYjHt7~vgj4)R*EM~&gS`)cAZpGz2xqUjIySp)}DY-o`u`+kLXHS0-CxvQ$>K0G*>&kr#0qfr>@YBBpa z!bB#c-I|(l1#?uo0_9AB3>-$&@; z{rn$;fTMJA@$m3H!22_PJ)PcnEI!~aw_=U`tsWn~-AE1#Is!d$_@Te$D zl2v$_KUm8ZN&qM5rIQ{m`9Wk_`Xb(8c|2l0cvO3f*~0~jo7L}RShO4#1SEX}CNE>? zJkO4tPQ^x7N^~Xcc$K9MQ}Kt0BEa#s$e*D&_=4k()xvI(n}w z1KNk?W~B9G%F-=ZD@pte=eUeu?qw4B@|Qj{mkErBG7Ff{L=L78w*W_Z+B>>#1(bX1 z#V#4DC!Enxu|2*d9mv4Xq#hHNi>ij1?{ytP*}YdE-FnH|8N&1- zKIBj<`n~j(NA0F&>Ekz6`^nRvl?-cjDmZz zsxZDXb@4hj2K)x+V%4jH$q)?qlxB#q;5I2b$g~!f>P;Zo;Ix)w)e_DMqRrTkR2-KE zUgIR(O^!1MZLQAURjEnOP5KVS-`6z-n}+Skb*k~Klk7q8XIDl7xu=U=z6N+9Nih1( zn7FcYFn`vL6_~~Jx`<=_J7cCMEy7f;2^cT9MWARv&=igc&AV%R>>1`cCyD)QxPG?% zaZtbvI?F(0j+r3OIl4L43bE|D(+<&#qUlRC!b01!u&v$#0#-ZQdFm|#ae&D8U>^Rh zU_mESs;u3{`-`GxyYpD=l70UQB>bmX95Vi3z0JcST$^1$K%Z_1OsLsR28h|po2)?v znC89fm54=wS$Aw`;aZ3Hbcm7P@)OgKlc+ML^*ig8G ze5Pdk>-cA&GO&mnV)1Zx+I^dY%Nu0wO?LmTe`TDoHqcio>XtK52dh8a8$z)V43s}~|KrN{8j8}s=t6kmF z*$lPGx2Z4`qap_<{-J|Yn}8NHZZ;d3B+P))-8zzzD&Q7?DQ1`hGra8#`%Mv{y^a;7 zc&aDBn9o8!sM-^WuVNWLPajg_cM#tfjRzJf{M(DV(^}V5A^=Dl00ezSr*A)zbs4qW zz}d+HB974a%Rq1DLQ&&D1IvY<0~LcQIbO+QO7)tB0Xv*hl9oSr3<#A218W} zr_Zjhr3iaL^*A_c%}jI2w8@i(@JsYOZH z=;YU0f<{x$F{{K893!q11X;F8tP4AIvAXP-|7yq@2wj)SjA4B#@Px=HsxvrT11~>8 z7n(=I76pEr1a?-hNvd5DQ(`{mkVPrFbrZ1JuPp}1R4r=JcB6poiqaG5uuphezZiRX z?7`kN&n#m5YIE&Jr)1YaO4SuW zA@WHoq?>7qA0WMSF~ab0`1tqO_N0d^VF`LoVXP~m{H=!NgEsGW(R@t$X!o7*2eZJ| zrCtOJC9=m?!G^-zs#?}Vt<2R7p>k$ZNkW`r;7$V&wIIQyy}hEba&>ctr{w5$hWK&X z@%3Agl&7;qoZ0a`-qfxbx-M7^#c{h{`3i)po`0m`c>zi3^m}1+;n>Ofvwd zrn(LM8TGixyY_`}zet6mGG`WFXR)c>yXOsCC>0XPHZ%+2%&>#_yE)oLJ`^MZO%U>B zk+^S&v6qdV4w2A14}J}x4JH&`(ilgoPiDalqfNlUG@NTLQE4;E zw#abZgg6vZYoW*{+j#?#NaU=hqd*r~lJH1$x1-HB6|9Q1R)~f%#`SE*M9yw0q6}0O zE=Y}|pG#WQz*v&3;F2^<+a^TU=}c)Vq}XB()|+Ti9I?*W-BkQxRbeYY9apm*r)UiY zN#o#<=q{RJb8e(H4~yor`A&0_Z8u#ervJ1$&Gu)NkO0+Ecao*f3j|M~2f5wcY%g~Z zM6pyy5kW#syE5D0-k_}|%lotyfhdP*CmRslr1Ru4gcG5T-+L>6A#`gk(nyD5gyk)7pDQWjAd`fTAg^`YZx=-UWIKaAJ zv@vB{7T6XBa~MCZ+iNUh_`xq;2Q9mu`1`J8pvAv7%VODV1@BBc#iXjhWDc|$P7Rb9tMI$#taZ{Au=OyOF0g8`n7JO%5R z%I?rrK>8cuW9;4U{e6hsdK0`&xLkZmx3u| zucBucTMXf7OOUZQHT<7*$|DPHHP%9zf0WdE-e>@<>9YuL~djTjh5X$Qo(eQeZc)vsK8mAiE0@<`uc1yclnstI;AfdMkX5 z_d=R|=~@lJPetY?qUR-d8F>~-!CoU04&&T{m|Mw2ka4LW;*x$JJ?d~$gg0gTmcS;e z4KV5?`JZCO7CQqY!KvLutRTa&jcoLbB7m>U0CV@PZZrnr1n373ECD#*=zzD|B-~bs zHf)6KVk6)fS7Tbv`gs5c*s0^j+xx0KiR_sJR$RYdcpKY7BW+cd4re`l_+J$=CZk0% zz5qY5-`q_gME`Yd5E8o$v%-tNyTOGpH36-Q8xj6(lVEec98qXoU8~VlNWsp# zCR0lYYJsLw+=yB1fda=n@6tDh@e?yOtc#>A-!1&qm`OO0;0Zd(h(G3U*LdEIlpTj* z3fF22i^^GltOGFmxxW}imCgkxCvjG^>7WqCEI5h}9cE2tqGHIm;-j_}!?bVt5IaO_ zH10cdu9gA01MzPU=DTF+4LkrK2CJ`ETRQktYcG-2!C%7f9V=Wc^kFcHb@@1 z7GIg(i@po!)$-S#f^#qYTlC$q`2|@UsaJ$hb_JgFf=*QJ9@R7hGeQdwGXn&KLh;~dwaf#|1)~p8 ze3M!L#RMt6BK@ZP^D%UdHv;6R+v*70*G}Yq>z<@ z2b;eI;A=4XzL~AmsliZ+*t<5}hZs7AUVFPduhcp>DvL)%*Rt^R;Y7p?4 z6)~l2kDB@j2fB{vIo5E2HxNEcd}c+L1s^s84YN@{)#LmJYeh{P4QhgD(n6Y9b5&Fv zG^vf2ed6$)ki{^o1NV+cCybr^7~h&k`YSV94<$7I7MbXE zwAWSvyy-?D=rq@$jYAq8t2Irq8s1Wi7URzyd)b0%BG?O7L?qXdtQ-`E1b!i-K|Gy@ z0e*4WEbSQ-K09ZHT`0AQKi}X7X(-kDHcAqVy_j9NQHB?&`=OY4yVd%vxbXw7^WGIJ zgaJ>k;={H&vOZ02r3*rD%FY1!?#^#xcQ$NG`h5XyAwY!ixEu-0I} z>`UPUo~Og3duIG^UHH5AfYPwj(rEP9W-9^O_oK&j=Z9ETQyOitDzjDlSr(pqLZoaL z*IPqEiG{Nx9s}vMy=TrZ49Ms$F*Rg@{*}HGNOs0So?{ku~<-GF0NTbsBC_jcUR1v{c?^V;myG35Uklx(-aHT+Fh0* zyHZ%@^KcgGbK_)pjEtop63JD|T`J=?9!C$efLX8od+E^BwzH75w`mpn+9t}rB)NOI z@5IG=cU}EC2Wo#5p}9_`<_4dsQ{TAv=MVa`6!pP5cDvc>&`p$KzIKiQ_O$tLXbMV1uHS3C1jF@sQj!;&r zr)8fO>A1l6IgGzSp#wIy@OP|r7&;8szG`*BoXX^Kmhp&_v{uZeL~qjZ5#d{(P)WZL zz{t!$_+606f?`qh*rEM(m3N0MsMLsgPv3M92I9FAxBmKdCu(f@h{ky~F5DhHyH=qu zWf8CL7+%ekHcEEs@2r;i`ET!hic3mL)czB2?J?NEfAku`+=_;el-h|^w&Q-bAFC#3 zZ{T5o$Kx|Xn7r9v>rO%va=9BX~IWcX;j5ytfbiyB7lVbVGVlgSW-cgUZwWb%eC;7EYD zo@bDiKSI`&Yndn3V5qqEvRcC9)LHtOZU02x{Sp-LvLblr9R1?Bj3FxmakUw>R^H0W zU+^^rGX`CO4NvBY!2!LFRcyfyL6@fjHio>Pi>sjdO@sQw;MDcSA=PaedPZjJC+KVM zSB?DOJB(`Y^}F{peCvS+xoX}o4aW>OvtodT(36mt7fete{XyPMp0ul)CL z7HVO>=zX{OBwSavnNMALWh<(w5@Z@&YpCp2l7C4u?>9oDDdlMCx4A5g$X<3h!(;10 zK415$wcWpyX3zagk`{u9x1yoC8YNZBMtfWT@cQ+Hfs>d%iqJ+aI~%IIPiNwf)m(viFD<%jg9#pHZ{`r!b2%OcSGp}JKpIN zhGoCL-M_42i|m2nqJ?}hK3)i-_=NI~Y_(%UA>TF_J^{ zdOE+pS2pnV`apUNU8F~dG;3>A`sBBbKWeYL^@F#_lycpSrgX_Cvg_%z^SW^3b^5_g zx0K!WS0rh?81E!rW(#P{q$OD;0$rA#cg0c|Fx1Ag@H$V|5_t8 zbkT57G-hHzxbq}$&iD)-5yyP6hvZ-4Dm9vZsr*!wU+snMWA2Xgo%GpQVPK3Ma_x)y z@x1uRVR@o=sN=IG+U>Vp3eea^oPx0YV~3h6f>PxRJ|hYN9BDEv;nK0d;8 zfukhpt{_q2uCpFq8=^TGFPMHEWA$X|x}JQ|hiDclmbh5{#1lKiF2nquzLLdMYf3VT zpU$d7-;(=;@i^o>O+jUZiTV|EKed|*mg_<*pEAUmx=B~+y}gjHqy-Spdb;&io$?VO z%Jy78`1%S>WzZ$dY737c$zf{pUc}2SK0Bj->B~@3bytd|TwL%or4AbVw&jj&(Z_!8 zxY;G$?yZe;@^xpRL-HzF9O@MqM-f zN3zm3E^tns7{ z<3gX1w-D8gN2zj-=DL~Fbe?IC=Ipw*0T}fXE{BPL$^ZO__b=mzJwt) zkh(N?U|n(HX-pkK#6F!)v~4q()NcX+?SIH1-Sw58K?do!xHFQ55M!k~Y%w&fEbDP+ zNgY(f(H5k4W~%9$JK>p&MH;P;bHm(3C|&I>JRBVp@z2SSY!^Rd#wF zm2C)Zfigm#mINcHZnk~=M8gK8DPOePGMu~h68A0vqL(bPmPUJViO$y{E$$G#sV*lZ z*tb`~28|zJse6Jjh&_z8abuCj54R5BhVV8YCmDe!2Epn^@Y#(I9Er83d-V{Q$LGqR># zz~zoAiO{pP?T|MtT-#L#+93PbKC%_QP)4d58*pA1ADtkzcd@r~=GFE?ED@ zcx9mb%zRCibPioeVCD)_EmSx_Q`vP`2be{xsCTyzg8{Hkz9y0glw4$cAT#_Ow0}I?$wK`s{L)w3-AO|?T~|B69#bd(`3haNsFrX7%OKaOs8G~E;zH~IWG7D z%mk>=9Yuj+ASYs!I4~U8`6D=D@~p^-B7<=6xFgbe@pf8?_#kY_4e+EF%6bM$AE{-0 z5O(4pT*qE}c(!nS6L8Nmf69oj+euSH*y!QzbCTE64q|zDmL~?Z z&|FWJR9;VWI1CKyHel7T9SE@PxV$#fNXwWFKmU3_Ft#BtW$?);=0Ch(?D$*iyp}%A zJ|BSqeyhI*4g)*Jz(LD^W&h@iFh2Hl0lCNfJl1n9t@NQ%kWP}9EZ{ zh|_pU(Ch%X91ix&qm!Bg@pg0ITgpQ2UNw?~$@?^+g*vxTgv?m#vrK)s#k?igEZo-f zT+3Wj4^v?ys4{IqvbQ9y)@(EEl?6C6iJ%_=hnymzG6nD>CiL;Tbw_}{5~t7ipw=>8 zG>;MLLOOiIX16O6lCUkTj<2h`i7as%b)rh-3SPxP^Mn+ei~~OYCI#@vT$64HHH98D zlr*DiFD*EwVd`h*b~YTIRBe!Vx+4g)-mXu z{;AN7(lm<8U1wJ7{P&XMYKk-c%Ypx9K*mWt4usPrGO!m5+;ROkvX;77V4Q|gl5bWw zL$Xg!F|CrLH0<4cFH78=GtkE0H=DJtgOc_gy~jwP97{9Huu4&EB(act8PD^$V% z$>d{KarN}ZD{Wm`)8DZSiIX@8-I?uJoRY*P>}&z^Mc^ijTV7*(7&?0y;5VaMy35n* zuV@+Aj2r4^mDUT2g$DA(5jkg{AKaY zk<`fA+&CX6fH!AVno$w;k9IlD`>n)18CKj|*!MxBHPHjhrsb#eW_9qj$ zt|DrD)jhU5t#@GIcPb@(Iux7HB~7>HC5;Vb_6;Z6BBoSWQ5_FjAu zAlALzhlVZ%X@HT%y(IQu$n%noevALKCF&KeMH#S8GsQ1fgO#=+5yAytpC@Eeq-w_se)W(zlN9Y6G^~3POQK{h^M?#iXqd zgLuL6_0J?~j;nN+=}fzq zocSh|Bs1!=;7kPf59=^m=0oI!Xs=0dDsZ3;iOA6~3e5$ocd%xYrleBII2^`J3#9qV#|U~q5w#{Y zuRr5#xr*ci%C1Oq(o#LO5V(i(%Vrlh*E7i!9HZY51x z@JhKVLiky1x0)^J?S>lbFGZwOAF!xYx+8L_t4R>)!{FhfFM;$32^o4OP!uPbyJ0O=@+a2&}esU`bBc4KI|&7|Y{4y3DjQ;*$b+b{~yb z3#q8?L(op#Z^X?%7!vdMJ*u{oZmiX16nzUq`KeK4@BON);(gQIdL-RpEvQ+i$vJLe z;6<*{Gd)eWt`Z)3U$`H$gZ~0N#9>KY4(G7 z5h4!+YWaa-J!%NgO8C^<{}81?ekKnhOW~`l#!eK1IbMOa@CppOVLiOx^NzH3?1#B1GyvngHSyy$d+lh zUq7byWUD%CNXmQPhGW1rw; zkZ-R?{R(QQ;^6qprSs;7JI%MHHcfXOF9-(!W-Y0YAI=9H5DJ|F;({u}g|&&H z<#^N5`stVS7Nd3+T=H!55xALcpN*Z$NxDXwqn#hb!CZgzeoLuQ`1K`N|5@6auJ5z$qx+$mJf{_^)XF{9_ zIo$_?HPRGF33@Zh#}6=4-DdifqU&^67Sy7D4SKNP-IRp?I6fh$jZP2JLwA(7{uKCB zpHK(a{SEQMG1WfQy}?lA(09>;@fH9fVE?gGrG~ zOta#q>1~VJdwB2vDh;mH&Yxt0;!bPS;tm>5?cNW3 zL&9c(VnXc@SlHlmM%`yd?KNdui|9l;iTqhk9;R+*($mx4 zEVGudz28{L{W6^&21e{mmuqM@w(G2W9q_ny^5=xVX~d&idf2)@wk)HyUf@kk+o`8F zg#VhFeUs`}#^6Pgq#x`CBON=uriK5aQ}HVRoo6ej9|NB`;Fj~I*taL(J@+f{FEGg@$kXPD83$kW-`cX@gw>c-nqi&5JFFwE<64|wKt*j;%!aAx(a^Q zvr)GJBp6i37Ux<*0{XQ__l*5jd%{6MfcX*tX>$d`ydE9LFJkzz6>?*7uTuxdd1E)e zx(N@vGK9kCGZ=YXP(E`WwUC42WXZW-T41_?2@L}>T2zn_6P9~zM@bLFgI>pt0k)?{ z(P_34wUYI9xz5(|3FJC^DX*@MUQ!ZOr#Xs}bvMIfESeXVnY%%YCY@kCbCPz&%B zCfbLTr5XmMhpw_cqUlg1XO1^fMJ*c2rn5KW5yCnF==J3U7QgpDw z%tY2cCWT4BJviiAi}`89Fcg-UR(J=dZbzb!XUPGUl#*mdnCW1fyCQRG z5t7S=qX1O-TCoc3+tPz_3>HK}SO2J=g#saH4lh*|phDh>5?dT#9@zlY*nr|JX> zx!Im>LE;|W&DV$^?+fa7P4bqHZ^Y5tzCHv=Z()mTZ00&{^C!16+jM`LrXaja?HG2u zkj7rh7qSvup9T-%Vuw1)FD{Y`3)afxCAouxm)QQeRC7Jp=2|^WcH3MTc;Lp44A~v$ zen-SuZWb(TJENNnRUh88XUE=N8^-%f)^~6uVd-|!2DRo>uU68e|y_(d5yV)FAKG*%)CSYdz6S8dAOwCLFzN7Coz>)*yzXTWIF?LAJuO^ zUcH{~?3iBcZ;zL2bkkjV ziA#`DpTkm8T_);1R9;u`v@UvvTA|vtiXzjOB}}*CeY@U_)k5)Vk<)s5y(j$MQ|JjtN64h%R(E99f-rqPvc;lE?&aaPV7f29rj}>AICamO zimfJ&+%3Wu+k)enQh~$L$2#FTsww_7AtdplCt)VPn_X4Djzb?W= zm);#^OwRPPudZ0eBsAva^G-Isa>o^^KIu*59r=eMin z`O_)SajRKtw;`%rO^X^!A3gNt9tKnsOc*mshL|j%$LD`vp5C~klz55SYdC%yx+ota zk;=@9@Qm`Mpe-0FaHFi7glN;}`h7UAE^D`b>J;z_f2V5>V7Iw3to;tYdP&r{#d<)p~;xwaz8#Gi^RcR*sodC1Zd}Jt` zvsPuqjbCfa!Q$*BNNdvpXElfXLj*OqI}V@RvBv2iU}~IreIIAqp6wwIt#N;^KmO8P zsM_V?w%vW$w8=4A4}Zd%&)-`6w@*9dY${q!O-$eID)ZXnxZ0PJ*88W0d6KOG2Xi&9 z$W+fvx)RpQuPy_zT~#T4b=8$DVvx8Ny*r7iwjH8QRcSRMYdvU^jn*a>mCir9es|Jo zvK15MA53p;m+4R66~5SGhK#vwH?=tsQfq+$Gs{-^Q98$FZc==|nN?cT!Pc?0b>1qD z=M{Snm9jhTKo=OA60)CS+~TczP{`2Cj>?3-T0n9ys;E&DI}8*W;F=S$jq1I-W?LM% z4Eb=#Y(w!?Vx%=K3#ZEaIw>(oR!(RRsA;w8matwFBx^O(66ca>MFW((eK-5ApaMe# zbuXENt?MDM#6c1jxu%DUsv6nc?F)rXnmhs zKIrU<^FMw)tzdPLHG`a%!$gIs)r89{tH3wlTV3CF7sBJ*tEOHZB`HQK3ho2 zIh7z>@G7^l{8CuT3 zk$(u%ZDBNUt1nZ`Ck$JSbP|K~nuU^CYnikK;aDguw9V*zQlpbGq7zr4A9*B*Je@~`a{ z;>(+zYs+-4C%6>fxTk}dZC1YXhlv{B!TWL)7JlM!ZaKaBZn_`rw40yr{+ri#JR6^} zV)c>SUoLnux|Q>Sj`*y8qWvwJ8_iH@8evgImziUC(Jk>idir;<_kW;%{ajpJtp4x=9-h?Y z{a>Ec`@f$r()GVj*ZKj^b8`J}4;L5q{$g_Y?iU{JT!;9wXUy_h z`S#62(sFw1GXmb6_hOze%-MC0=O!NiiI#xXU2O?VFxPKp^Gzo9OlU&Jsv*5A*j^oQ zt)=&+^2hT04K(RhsRHUQx_l%>^ilIwbon;*#m?P1*hnU1 z4Jys_If++c$VJ%{H5;fI?YlkZ#X!S1n4;nX3VZ8pL934UeD3eJC~enr8Y|K0Tvh^E z9Z7K0T`C8{x8fyqnNp@zdm7_9W)@I)@F?EpD2W;)NL<;*G(peSBGC) z^z_>N_KpWHUNzpj$fHb^PIPGs2!Uv@FmQuK3LBSb3^{@GKg+c#5a!LJ6`OX9%-&Ot zj|6k8MgtS04NS{U9d=j!x@CIBUC>iAr(nL_o35E4@@XLWIXcka@(5e6%`_IHZYtWu za1;k#m^hzi1W}pw30h!x4YMNVBNIvLH*#$7oxHgYd7pSL5U zR+>H$iteM0jzN$7fw52bnu>7AP62$6`}@xJI;*zIk|B7u4c^jEO1P}R5h8DDh*Uq5 z8Hlwk8qV-EBM9x_LZe;OCcN$XC<=_qVGAE=g>7~{Tyj=n!!WDn7&kFG3QAgEm!(+K zw0h`=FVutgRm!GR-O-Yr1Tah%*umANupgSSN zAwA%tzDZDvc<@Qjh6!hTYgdDsC^NqeSKdvVV@yH(xT411QK<%K&K(@vSlJ@c*44R?6 z^eaGZBd3=Z*l=e8a@Gl~Tga(lN?&Kx=suQ@VYp}U#YLuxr~gf{4bS}|>%M7B0A07V zZ{NUokv3Pd$YTcAH5W8b0O`)R86ec2XSnJh zc*GOvYB=d81qICc_LDb!cnfikd$YRZHHKxZ7U|KG13~AkM`_0%e+=`%7`vkUzJhq= z$5;+(F2nZ<7{D)|pO@!%Uv2v{cVXY3^Tm&EPv?kNkMxlC zQw|u%{h3?E^7`WUvfV+By)6eEhTj8P)((AX;G}BH#hI;*LdQX$t(|UUW^*SykvD=6 z4!0ZE)*(ck)8T;&l}XOHn7MY^CU%+#%e#CVus1JfMX#q{VYSN*L3QJyoKLoMG;XRv z65HE&eZrNHGNkPLGyLDTIN7So*B;u0rDL@rXLPz+Yge}m=R3!;z{PU-;mLuy2u9Mt zeF2{>^pewbJr}oxICD<16e>5+aGeLUJ@M21fiuXOaupEz;p9!WaSirV2h#4HxQ68- z=22;|L#Tk2Uw(^!^_C+ERQ6sUrWd-jBu9TT^Hkl?`UG7(@?rh9w?DTDpjNXAFzu%4 znvyLIy6uf?!LHm;(#T*3#IAqy#Uoc(9WN{^=|F{c;MKye>4|nE!I>&+?|&Z9x7Ms4 zEkjGzp(W`lP?zScDlpcHU#HkXQuDI@~$elypcW#-s z{NgN+_tk3yS;9%OwGX?Y^Yso5-QDP!r~DUNZtxMrEpFOzS&)`V_u=M<2a&N6&+G8s zh=*7Ivqa3lz#v@iCW46TwhCEQuyGL=^2&wQ0=c|vn5l4rcKtCNvi^OanvwRWAs$P+ zGGmrDPze)aKu!QE=ycJ&(Q2?cS%y~6vAO!7{MsLXk32wB5OX)Uiv~lQ^_ENiFJ5zA z!m*bQz>`OIP;esMRL1I8mqEtR2DH!D=7*kFaXPZa0}!ttiWW~6Jo!R`;@4wwQ7?j= zd-7eXkUf6zD%rvY3KsWvSATvR+5E~qORC`GJpbrstey5GQsQDCGyvXP+8+MMWH36a zvb_~i=gCEXyYCl$3XN@D2NHOt(R{KB;lHNsuc(KhlkwxGS*9_kH239bN6_wap@81& zHs%kh%xo2jtV?8O%18d@AbO3qNoco+&Uf?9B0%616i3p(@W*ab4z;uNQis-OZke&Q zav~($)9%)4G|?9ioBsC$z`F=%9^mdv8mdxXWSDsERmSy&K{#7`xpmPZQ({XojbH>3y5|!Oh!w49>;Qv`^*-$jsu`~ z=vN`vPV7XPQ=k2DjC;2}EqC4Bv)R@$kL{C3V_W4Xm=e-k8p73OZ!a8b!grQKAv&iG z4xSigx`yn9-y0fZ$5_-(17{Nr8X%Ib+YqYq1CEO(U1AjV)M=98z;9`{O0oyjeT<=S zE9W4arGem*0Y)j(bhVMr%QVd_ZfI^W06yj!8_Csw*zqSA>R0DjyG>;HyVv`#;Xu*@&w}^tz@!W9yu@pS-gV9?e>PmHM%oc{(vAjyX9s(cunMXU%;*0UXr9J{5 z#QbkGsQuq+(09KT5bl28-O8UK_Kci;ZQy&{WS5-%zSgnMTod)@RKc;m39%QTfa|@N zs^%2eLk^#B3Y?1a84%kP&6lkd!lv`$@P?6CiD2zFMO?)svt1xP5#pAFG}_-)k21R- zV;d<&#p?Q1l63NjM$41)b9gR@<*gCaYGx$!_jv1+mV4nvsFL)N@)*$y<5Q|Mg!^&~ zo(>5Kk+sd__LqTKOO2Ij^BAM}%-W(=@xz%sK3HN_D$11>@w~^yE@1!}F}AvU3?`hI zNsEyNvh5e|y{_@h$M@P`a7p$d%^|e*`0x5JQFrJp*6srpMz)mRvo5Tgbu&~}&}3?( z;G4n@w}?8eZbY^EJNO;ees{KQbh;e=MO%d%6Zinw*;;C4Tl!%}2Dca*HlHa;+Iw9r z8*x#t9!B0ty=%i~j;=u|h}B22S-SlE{Ny0a87cg&BEOFemo&@m zpoyp;h1lnKSF#mER|M9M+w-e@^X8x1&;E@cj$FX!tN*7ckGyk;w0Va)`u&)Tz(d3( z&>VKz`oAu67hM%u61KGw3rW;y_xIp3>SbIi?}!+P5FX*^-kLHrViYJMC_&y2nm zZ}+;qi6!}Hp6jJaFCY3#f6L93C#aO(Fsz@KXusUWyySBi|7c+x<@FvVD_LDX37ps}??sqGiHKqh7cHO7;iS(#(HW<2BH{hptH`zC^%ATKbJ(_jy^ zH5`_rT^ULbz$U=BwTar4rX?7v?Nz*3wotX`VT;hGpGTSq3!tS8o?=6wD)p`^<1Nu}`;czuSNh$2x}SY& zxxa^DV@#JUJxz87Gqh^j$|(nxTA|yK_9#3&^NsMXwP7Pbl$t)x*^mU>eHuEcE; zMc-y>Yi zb65LO9&$jJBz1B)hDaLYBy~5jk_It!u0-;i#z-22_Yw0YEP*NIR`v<3)?iR`6D5il{uu>J4m=#NIJeP6O#7$vefZU=SZgv`_(?fwV2)8WjW{^g=j_>a zdJa6|FW^{b@8qRBT$f4+nrIT~(`pU#ONz?SOShlc40@P!_iwIXxpeCEm)E$^gge3) z3J;h2w&*F_m^Gp4s$yHo1ujQpXztC=_hpiG#rMaMY?igqBM$uN%2Q_)itwTlM7N_X zOW=$E%}7TTn}a_(;EwZn6Gs_?&2(Nl_%90-)4W@M_*?VSN{Y%%aG343jRJ@YmxQV# zh0lWX2NyiM%s#6ABOKjMsziF`x zX%NY-?lBUCi#otvDnoP}XaVtpF}#HRuET0 zN-tAx8uo6dz227NPdS14wXJ=LCW&-okroP5zvYlTxaRmC3w~KD(a^A}wUXt5m3(h^ z!bf*qa5;`I6-ES3uTAdP1JcMOKOX{62|}T?=_J1E+Gr-G&5=B5i-z^EzdSdDkP$ms zejXotW&LYe@ao6K@S5`N44btE$?euEdLTs9A_T!e4Q2)USiKFh)!WVjd^0;;XHoPq zI~~{G=iQ6_mY==pvN!An?R25(oenZ(^BD|@xlly9LQL5x!vyWfc2d901@xnfS$G{0 zsq?~~W#VssM;5DfWql!=Z8dn(tad|yC%(ebpOI-riSzAQ zy5Wr%iDo^Z83Tc%kM4A_*vkT! z3e-d+h5PSs6!RaE)B++d8HA|WaPB>5GdG(QvAEE+RKRPRp76nrn&Dl4u5*T+fWr`` z;|x7YCYhS=&m&P>;B zD+X=k9R)Q6Wk|xybE+StjT_&VvNDU=UD>$%&A83MX|Ta=r)AoSi9t@_}k- z>9DnR3UlfxiN5$uhXPct6BgG)SS_7&+FmCx#}~wq|^9E7I;f0y%%F@LZ5?Z9=q~ zzETF!w#N0f>2Jw0oA&t#-TBytB*?uE+U3&dj5m*8dCmdFuJr@` z@%QrD`1mR9{doQjLw=mk=6qkQ_VRr_Oz!^sXzl%8KS$U9ck$H9Ph1+;X2<{kiAjF4 z{Kh2dJ)0|Pt*4V^sdLSpa8)icIK#HyH?PnCvFp#s%U9tSU1D0T&tM}}3 z8s<)$HO^w;pE3(c&+Mqn1e`JSzOy^@?C^bEg+=|t^whhQs@Y|dY4kV502N>$?ux zv(}saRR}hV4v%@J@qJ*!UWR<#PiN{ukXofV$X^?6|B)Ea&2Psv6M_g#Yk7$L;65&opoXmLKf= z+MK44Xw=(4li`>N+I}S%Yl|8SqcH0eHbd-jGK+{ij3=tcwwXG0*MQctkqeZ*x#~(5 z%R9MEMj}tAF;_I8)@rCNNB*5loHe)rg2t(OoZZ&kq)J{P&H}#wa}_{HxT1uCp^PQc z8DG*$PhXp9Y{zDd{TcAu=dx@QD2Ra$-A2u$pyPu%NoHoX>7b)u>sjo3X|6QR=?RB| z|L?Q7J^MX78~P!;M)N+~>g5dEfT7wPtlm-^fvNI3+#N+~RN~_WI@r;sC&D>{8_R22 z?I~3{SGRYXIWqyZxhDN$aJixfj4@x)8n{Up{o%tzcKY+PV6MtZOq5UfVO7kySGCQM z*}S4s%zTq=$Lp69dZ{Xic{_keh1R-h@)evXL}YFhzax_*OhUjiDpUo;YIvdQpcRF$ z>A-VG^Ug$ZuGmer*v8sJH?3F&wZ(Jv?=+zc^RCp_s6Y*!@MxH-1%hR&XongKJe=DzL^CdOSqKO<-wy~p5;D=E=ataHo-}m zNTP$!hcx&o@maGKJmy*#KVEbvwXrL+erUI*-3glstf(fbBidQZ|2st zk=EE27xzOzKkmv3r(9U#m%uP_`5 zn#^i}P5XoA!N}-ffH+*1TtF)m-J{g&$Tiz!ckmIU4XVmpw8;=U&*gLHX>2>I+LLq3yWSwQWUGgA~g;tZ9@b0w&N_G_CD zeY~xFzK2ar!1ja5ludKu)&T4(SEmo$g5aAuHg3dJLyxh2$+C1Ua)W?9!G=JGI=&t{ z=$!kB97QK7xc&Ht3xPq>tnr3cLBLpM276ffXo&M(So{bfP)+H{BF-YShGaHVV(heM z$1w7$2wy`hU!0Ld@@y2G>%(vg|FMvjrn{muC0zq0?{UbRxtF#bfDqtQeVK6!S*q=I z&hwq|0Y<4HiH&+$U`Ck;g2DtjNJQCd#uJh~2^oixdSVQbpq#`&By>Dh1fXTS!Ur42 zq7d=sQMddPjp(I6&q6LY4ns>2f4J*aN3ZuNA4Z{Ojv?Y}6R8Z=Kx1~J_Z_NU*34YL z2sMq_jHm-D$OWvY6mKApH{e#W0GTN3tm{T@Ue=%`F)jB zR(ltW?9KX@!(1#dYIKj%i$57(ky- z-IM(h-8blx0Ck*)8RAhYwIO~|whdkYyASuMAu^(-wi+h)VAG?qxjspMFh;U8F7Ee= zmMqP6`Kb1k=lUvIl;`pteN$gOC+{600e)v37fATMBA_!(2)O_EXQy~M8YKkwMd%fq za0x@?-DGux(>MW7W%UyTHjvJ^O#xA!;7J4y9yy0eOw?)d9$lK^Wecck6aI#QiA!F=^bQ|wXpRdnSLRLT# zzWZJcxHRBiJpndbN`>Fyo$~j&VVII|ZfDk;Y$te0q%aLLA2in+@HTwnhO*rYQ;0;cZ4G5P3Q`9=Y*C z%adZp2@9e8qXe};#u18!G{MMdR;h%epvgjk#F>YwLK_tmeOp_6ZB$IfHct|wmIv{h3SV4o z?r&UfcIX~>6=t|GuLRa_XMlFc`xc=BlMsiDTrBTQ#*DpPu421k%Esev?XgHL|7N?5 z#$SXAX?M0NY^Zs`lYyv#J>T^3KDikUx>7OjLwB9Q-}VC$?v| zdhN}0IhIt+JfC17)Ad|PA^%Uao&LY}mtP^=`(L2T@jc*X{)puvZ(RdlwMS~r zv@7dnjOCOimXmfR-duW;K-h)@wO9Y;WZ=%<5^VcT$`klJ9B))_a4#KuIRL((uNabe zV+cRfM&Y0Al3W{5)wMjjP4dG`R!0L)P8UMZdWCSawToL?fPw>N_+m&F3ez07F)ddx zt$koVxan{;)>7h_yPfKEtLilC&2W$bT~*qU_XZTU2P(v}{G&Co!5!+QSA*-kC)UrD zSRiqbJc=G!h17v(cm!;GDpY&v9XtfWp)aY^Bhsw~gP@aIGx>a9A*?`r#|7ok#&w8n zQsyXLE5j{b58CMJw_N!u6fvjlWfgefQ5E>XST|l657=^(E(S3WBV{JyW(Kf#Y4=5V zb}9pSv&R1xR#*gaI(mU>L7=fAaXg=7VJ_G-`}*1tr$kc1qHKxHEEMz|pdGbT+ zEWFn3Q9h44ahKXT)#rD6-AFvE?;YELihsPy^?d!GIOK2+DzN#BvS0z_LwIa` z$pM~4Blu0n&|m}bLpXO|;`5xwn)JcXA!NDCbnGNDHU=_T8xNVxwW0{w|1_@AlE|A_ zNn|aoWU^QK^2pfg)czb3)y0v;<*@MC$ZYZOE2!H>rl_eB%07fPZ~ck*qV8NdYO93gRe{3bOkjQJJ*AhEWyi zs)}SS677nX97Efrk3u{dIa**yD0uJ~#JdzPuv?kfQAD;MVoj~NUy&7*SRl(PxX=np zjPbGpHny7b_v^vcVXG=L04=LyXInwZv4WOn1_2vaP;#g?Sd6HQ8&#Mvsy3ukY09L~ z92oy9cW=K&^Ixq*3hnDZe#J@GssCpDuUpvv zGl1=Iv4RrgotQSgLXSf8Wt`VmTkz9zkRILV_eD$JgDc+bF!f;jGX0K~xINJ{BKgHi zG<3;69}Zt;3|n|2$b1RNPrcuGm-=z*^~L^{D?pf%Uu$bVX6GXwwC7Qd-ZKg>{F^uM z_MiFm(h0UI%-$1})V-<49xX7pao%DB|DL(9GmWQyO!k zONc3~(7JqSk2%K86Edq1jDiB+!48T&%{M7*SGFJsQ0tgh61$pa0P-!z_^> zg&_RpAU|qu)_7VsvF~Rv+wC#r)r{0+GR3znKpJB6!nv_%K7ngM@GIQl3sd2c5sGFGd4D1OHUS@C%uV8e58WS zy1tTElZu);*O~}&O`rZ8j<@@iR*}Leq#dx;Ru)W?vFu_8R)HQAZ5?k=IYIAlm=Nm? z3pfq&p^c>T4Bt`Go4XuH%Le81^yc#S;^GhOgjSV+4T-<*wwCpdbv{od;A-D-nJxAH zPU<-wY`6;SKHlx}ExuQY+Jefn?X^?o3}yp01Jr3U@DF`5IIY^4v~a*4Y3^NU$5m0U%2^gP-?iDO z-~h8BQfd4Z`w1-Uf@r8lc=*Lebhts9mTA-Jzp;W)!n=9MS;>IhEwz=~jwXbMI0=j( zOKTVVKYHznYng5Gn zI;K5e`yP2E7zoV5TMJuf5N101mV!$}WgGX~pkxrV#Ms5qhr%bYf^NFrcmUkoO0zI- z0Ew22syR@Hwy6{3)J-<+iU4Wv@!vCaD>ff|+Pq;u-*c&mzI{7ThZJfp0i z-`n;2=Iw5Fx8J&b5Nl~pH~nwsuAJ32iOR+~E>8NR+hhugHG78TFC=UplJ{d%fYCguL}&@$>=WgdaN5QX!@f=||Q z|Hv~?C^z*Qt@567>!zCwindY;x{NgmKui%!o8r{xztF0aqxN0)sb4Cy;dgCBWG*B9K|0LbY`waYBiK?rjxu$lKwd!lgDOf z$<8PGFI@3I&cp=kRnl24FiYSoOZKFs zlz*WiZK-r0bGeb{0y+~DPj_>BJ>E|){#8Dv*&ohKi>#7ygox7|8^CPiX~+pLOAkl0 z)JDa)8@c08$=wQDuhYhc-j8AzWON*BvOj!`LP#%R!k4zhm+3mx^Zzmh z!1aMv8_CKJ_OrGtcU7bVoFhoFjt|$j|BW$l{A8(zxRfYpa!A?+21OUdK+E|U@%~G4 z+A$A;@SkEl?V&4T8h02~Et1;<@Iu*|=y~agSA1$~Eo2UehZ|wz1p%n(ao`g-}y2q^PF(nLhMfVVfX;Z2OJv1 z7uIa=GFd4~RTBt^l}7oBGIJ58(>yL~F*VSX3qD&$O?WVH_#F=gshJoZZIh1odU7%K zHeu)v1K=4xQb6zxrs}rN!CeacNF{$OR`XQjT8nlMyRK!YpDFzVphO`ORU%r+ zXCIzEkbv*2lQk5A9I)U|RhyYjP=hUX{Geh3ghaVkEgwggeu#XXt0QUN$SjpMlpOK* zO*5WsI);j5I2(~PDyaPX9PM9N0(uqA(Z~uG5@&mrg{j>fY2`<^S+F_2nagkfc_@v? ziZzPm?F#3Wq9!^h<$g2gyB0t@XD}7a=n-tE=|y@r{m$40P;rmn0}j|K0l)zI5vEyS zQe+ErLoBSFa9_7W;LMieHs#LFr-LtCJdEm)|7|xYsD7PIlB=rhnZUPZ7^YBih5;(1N+`>-N2aANI#cI-5gIDJ1ESJS{BPtKXoeo=mV@Yp^W&S}{5yMU zD(!jvbUJr097A6Y)pyN1HHHf4`GI$`W#W%Q8-4t{h&@>F!H7lz_yVIB`TH*s(z6jQ zhLQuI`h1B6iRO0O9i=vKQ*;tIxc413pn*Lf|s?D27%ykySyw(KPTF|k)4LGnj&#U_Sg*lY%`Lg6@kBx5IBe}k%eEA}Hmzw9(uxyx6UN$3ZHsRP zrSti6yqGqqh|^~M6>LxK6`K(3Bs`6Ij-)4`>)u&_>J|Ec zb5dqr5C?f4HVdKa#c!){{S$!gnr?wefqlt6Ue-RZ>Z0OJH8;sPO zX~fr5?n42iE`n%_PsGm2mRCeBpxU9w9_y$Yo@D1LDnbJK zt*Bh7#AVwWsFYd~HhD?N>_Jz}%n=oRsz%EvoX)y;>8sN8yHuWUG&nt5C zW){{`Wil!?L{8pS17oVScOjeftLad5(sanXef3>TrVP45;s?F{t+GI_%Nc(e%JSsE zWwdM4>!SL!BVW^~?Qq8mV)>#Z8jT6SJFUvohVj;N5`_MyS1V5vZz;Sy4(SaAMOIEN zu#e~unXqW_OP{r5>T0!R>XHw89lztl+#w(QH1XKAOxpKl>MC_}W9owE`LzoFdUU>U zuA7k!cJ7k>$0Zl$w#K(->euTh683gpyz2Qw3Hr{m{yEKn^(ceUWzv+K4SU>^lo||t zj%;M(kBRY&9qd_m{q}y}zRPB@tb>BQbi~i979DRAX$6~bG-2reuuV$%FZpA`uE^(+ z@fw-<25C}AmPuBTy}eAkyYb5yuC}p`l0=KBm)i)%G77iJ>Ig>ed>gFOYEL>5S?E>V zdCRc8>IY{8Eq3qjbBB=?ZPXs-Wp*vQ&Yf)I{HE%8;gJ1bWJOL)q;y3Mq*M(JEH)AV zTSdLPt)slEbK0dU%Z6yivJj)?K#Y0*DP4G6sN2UmDZ(KX2rBExwbDpQm z*R)f=c6UQf3iQ^70L;9%_@3y&&Fc-7=sc5ts|(1@lM(e0$c})DlFWk67rH{~W|Jm6 zDlxStJ_u!bMAps{INBlClo!+~93l%XKw7W44-gK0jwl3)Z3+_4Mg)nZFu~}|cye{H z;9tV>o+0b~b!3|(Q^CzhUWUS50Ap_b#;cQVM;ILHk?iz_gXa#-Ddu+13U;pV-Gcb2 zQtS#VHOukgyJ^jma)qoQ9UGh_sTjPxD1VTi%8@(4GF*xxuW_fL%DP z0UjcLa>jEI^VvfVFQr+hNIRa5_9PPNVs1B|aH+_(w1XwdoC|QfKtRi#p*QJ%KE=v#< zoC-z<9PM4uiJ8UfM%(|EDotiWI!%S@#v#kI*xEwu%UZQG`8~cfOP?)b0rZ*VFBx7@ zg{=+3P=}2*Pj^?0(lQuo82v(&!1@=Sof+tcijv|;@K4`=DiA>1*6^we04(A~O1uNMkFloXsu zaPRlox%6w`9Y@=ifE`iOWEHF>mJDrt+Q!0$#SRkh1Me^3_T4QncB;8hQb(|h#21v; zUKox9mldR!L0*&SQ1mP)7jSw_K^=-3zTpB+NNbw#xm?kJa}yB!+$31KIeK+48m?T%V@wT@2F za=01X?4v&2h8PY43LwAu_Z|n2?)nxsUc#3i8?r3F84oVY-^Fjzh}{3W6@P^~^K*?_ zd{&LtAOe@lZ@0YCLWD8&*6rc_ym;C8BqT}v#*cld z%jL!bJdXMAF&j(+z8_7$)7=%sFxe2a zBooaP&^w5ZMl%#FLs`JdiLC7d8Hc1^v{zx~K#4t>@9Mzo$rk3CSN+rEb9@RO@k9#&pDoBMSf#SeP4Cl0u0|8?wz`o(nN zrswGUEC|H_t*pqE59PxI;lEjpD6mOe+G-WW$+l2QB|>L3L)wTu?R)J4ryO2t^Yv1C zg!xYWF7OQ{HI+N4B;8TStGYWFlu3MYdi#-l**Z2%s-eOGH5B4ordb?{&1?@ID7A{u zbq8bw^EJ%W5P(bWeSjn;aR6j}|AAe8(R$+G;uyYZZ_7d+p>UPWOG{JMvHcc#gmeJP z;AJyS{7WKZU(<$O-{^!sxv#maxKb#Vu(dOfCnP}m$fTFJ87=k7IcbhVWp&=5_}peYrD5 z>+}#_--x|ok6wl`{SIh6Zab7xh>alo0@565dqg{_DAkz!AH?QnmwoX}cqLfzJo$tZ z<)U{KOFq%e|109@L#)Z7SVL6#N)pCuMJ^d z-xgpP#jzn|ba%N(dZo%$jfRl~=Xmeo*>>1nU; zoJRiuUZWJGiI10=C|Q3*?JUSUjK#{#o|>V)dras^sVV5WhO+$}`*-jWVRHLplmM>J z^?K}=}W+rNfkA|A3^xY!^hqGRL2vOD=bC1-tR5iw1q z!gVL^FA*XFlw+nDTV8u=x z`Iq@4U!A!;sgn}Qv6@IzQ_2~Ngabrue{BTj-{B!ak{2i2L;`@tO&EOXJOa!fJED48 zgg2icKVBhj++2*b)@l`!e&Ub&zrkDn8Mz)VzVGk#t6sl z`}wt|s9<+cQ3^1+>zy~Hn)S6WG4jgisc$_V{&KGu6KZ|-G@&DZVn)U4p1tDb(; z1Z+KPSRLw>9Z@7TC(rGOM+S4~fpW_jS3F(9Mz(MADoc&$4V2@ftcC!t2nR7UHV}xW zm|!Zb-Zjl=z5@CkyMN$Y$i}o!dL5c6waYp zb|4wPI%|~5`5K@gm@z?aeEcF?T0)Dbck@Ae%YKn-#SRePP4X9okk`zLEH~G68S8kv zX!+}64d|?E4NHiDYAVt( zkT*4jpl0qo8PZx7tM_Hj2e}CDYDj3NYrGq6zDyn|K)fdzxbvUWQ#R0?K~sW$q&Vo)cADU1#dCwR|M<@CSCwqB=eeQXQd_o5-Sa@^}6_zra`L z|J&{1e4pBt!YZ74nqn}X%~qqqQ3m<}h83pbtf16J%PPp$GR0Hl7jRoPhJZO7PX4h$)yt z%;e5iQ9YO?>*_iA(B6RTW!a0>PT<+HlB~)QE+TC+9@mER}; z<;60`OYR=cARV6+>5%6-NEiemV%%3(Qk-4J(-jOMigfWf-D*8?KtvP>3}} zlR_^^r-7|CgX-aW_!kS-{7B>V9^?frxu%L#jPB;bOIn%_Y85CvbPNh}mJ%_sjO_QQ zfz4LnPlR0z>cAGKdxSZ)gwyH<^MTE9>=)g6ccUwY-FvmsGKJaubznv@{lYo#&M{w` zCVN#0XZ0XCC}ve<1eZ~JVZ|9h7A&oMyjk`%T;0MSEIi}J+?*7um&~XW;1P&e=3t%f z5Oqm2a|pH6RMURM-8}49%|B#-4N&cR_c3JL95xXRu!B2yzk%Mr8(Fjo|!v&PSb6j3d|Iyqb@83Q_Ex zYJ29(<|*zaYfFVRnQygZl2AwkqEjQ#)EZ@_dLZD@>4+}Dzc&zUjqeu8HQUo}3pN;q z=a_50RVZCDjrz`_IbAK#D1dj~GHl-qIL)6UxDJ{#|XiSR@q6n0B?(j zK>CUJAdbM~jUlYt>lO9Y7{!0IpLwD3SAf`|vvdkYY{}i_hgyMNGHzaFF4wkC3rxD( z|A{IZ5P5T)<1zW%@pX*t-m6kmn15I->r^Gz#?Ad1+-9GAr6h4v=aRYf&F39B{qo7E z8(=6x5&7zQRW$X#$F7}gSRlOVTo#*ul!7ljX=(NhUJ6{ikwB!FE9PgXn%q@h!4_1p|gTi(Nyddus$<65d(w{JnM9{ zt9M1|SPb~n=~WKzws=Lqycu%$Jm%ERiggCZrQx#I?Ho36xlfRwkT{W!1s?Gv`-wM> zd7{S%K~mr?XhHcJ$ZDNLED^(26z2miL2gLoH;8teIioPWVgvP-nPR!3B$1R`ND4^# zq!v@jpV^zIjIgqB=WI_kqYd72Pc9Zg2i*~bGP$9O+Q+za?*(g+X}#hoR}w*us=UXK z6r!3^B?FVf8k{AQDxD!5pq5;;H0cEy@R}3X6FLyaA==%z?ljIsn;|Cofeld`e29j- z9Aa`gZI{=={!dtn-nYV!B~TFd`sZ;xJ3flzunBOb)GO^X*``UWx^zw0MP3=r$GQ>i zw36)JWt8T5sC6aI%-Eoro&LhsBs5Kr+HYb3W(fR7EY-F8of1oDbpyZgtW@Eu@h@MW zixl3fkJN`uS#P>286HB61_^QeP;D1G59y4j2)!vBAQWw?6oKB*9?HGHreh0gTIf)K zD?Y;*fzqjnwbWqrJVq>=X?|$2ocxB#3!1&a-;G%CC#WblJA)Xx@gD$hhxvB2{o{oM z(L<3vrl~TAJ>TZ07OKQYQWKz+k|@&ZGco;x$aG4*I@EB8dBKGnDGsHf8E!Wzu!R%X>jEoyEU;qUNQ zZVA}+kWatfop{Js-vQsanX`~jzNe+%X1_z z zGWSaqXTuMC73YpZx%6CjEt} z^RkUTn{=<;lEYm2N1H9};3upYF<0ttv^LMiFz!o9V^-5BRKef{DksuXBE(SXbB_fy zh87J;ByF~(oJ>Kd21?viW7&ddhUy=#0+hYS_Okd-Y#Fr>8#}Z!ABSJiLQRsj%Ob0! z%=4U24kg&ZuZwtlNYF+So5Cy7ACfi$Gw12PLqL`X^v|lSraj}zbY75J1({~QCP5jp z_n*3;yDw$x3J7K+(=ZyR_@POy1Og=CO~8LF1Z$d@}4dSK8wCllO}!6b%-5N?&PY?J9|&=#*E9q>D! zd!Ft`*d-{s^^*a`z7n3G#@?M6b-GY87EQgFIHuU@u0>o8H(;NKN6np)tE|DGU}Ft^ zP|o#P@jgp28$|Xr_o-z)#3FckktJE8!|RDOoFF=a5Q~&V;|eVN6vI?!y^7RV96&OI zFm*Lp3G*E(M1=Ek^y5%Mh0y_Dqvk))<_&8Xo38N%Xjs;oivzMo{X-L@b7|m zZef5Ad^~`&y=|HvU4cx^`8enc=XFM3u8W1)}wN z>(k9XwCWdsJv3DtE?&CxGAnDb9fgk=9Ar1Eg=(6fG}xM9`EIflWO~`sB;w)S!KeA| z)NolLsmg%fcX7=I%z!T~zYf;%e}YCs#v=b6V~V6#D4R(1DL;p{=ZoeySCu6+r`Fy1 zVt?*@cF1iGj1wI{Kl3+jaZI6F4@VwTp73zUUPI936Ax|^jGN$>-tN3kR?}p{diUFT zS}hmNV6RLlIe-QzLQpfR^%S_TZRh!c zvpo5Q)7*meMX+eIAi?P#^B!91H!SK6^fE4aq2QofIx}ry+{ey4gOIb>U`eukj|hu! z5u*e?2qq_2Dd||MedAU!pnyceG_tPq`fxZxUr%Wl_6heJ#2!uk-Oq#J0SL&+bSt4Z zwbKg{j{4KcE2O1m;>!e$=UmonJ-WoZ_`!aoaHt$u%=b?*3@(~y+#yU>y@TCGT%tE7 zCM;lkmWT(V+*@vLzHGG*flOQ<5BG@Y(12QVLA7aUU?$yN|2ZkH`3~G4{L$T{uQtH7?ral#s}0YJv9+!Aj=CD8p+!X2WG7CLWI?GoP1b7x zoGgc7%cG*k3Jsp;%VWxsxix(Eup(v`0kpGBWevFaNGvr)3q3&Vmm~GJiJwMtY z>$<2nMdk8=qCez>h-$>;wsgP!&Az3i6$YuxL+}@4LWOo5H8zGOGn2t_lA4lDX6YzZ z4W|yIt0TIX_xt9G_wA2yhE95w)yOVI*1~Pvz^8^$03@b{5jR*jUmx;yx(hv%;Q6A7=ktm&Hh0 z<3CkWcC%fJRGf9g+8ElQP8=&qI_h@A=SnfSpao&qDB~Kz5}&Ew$1ilHK)O?{yd;(y5o=9RYg+ialMdsg6K?O$Nt;c?=%L*B zRPvs>(2Q z4^w74ncZCfbSNL+nDbp)!KE4M^t%0<7kvaUPlJ09Egd!MNq-R9J!=SC;PnZ1d;DQ5 z-MdSKs0!ZALEke_(i?)sU{QGNMQ-*s+lYcpWhk|5S^c#b`>C|76&n_uYQA$WJX^wP z^lw}yMn+XyS4x75`%*&^(d}yu7Q`W0Dl4XH2%@e!6ix}g#7b_?{&S*mlCrA)CPmF& zX}7{tnU}^ZEF8EMee=Uobx_3w2#PvsQmo473qw!_H2=^`aw=OKr(RDA{M`67Iy}7!^$Acem(ldIk2XrXji{rHjV9BODI(54wP^XxAM&i`V4ihI#4*f*#zw0mE$EX z-7Pj&8D4Yc(f*^FFA#0q%91=ia2j>BS{2;e&mzqvyG=BrEdDok%dpO=k${ZV=Ai~= z+z0*FpnitDKk!dPhQV&P2Y3n(td2(ES_9>jWyUYc&kt30MgoWZ z!pKh1>^ADyA8liYc&N{Nez&|oARwtPQQQc@Qta<-=I4DR|= z>>SvxVhy!Wq{NOzXn6k>@m0fk0r_pgu*ne*SE8s|dY2)nW)(XP5DQBqkX|q`12_9g z(7o(Y_rYFX^gr>_XO;b2sNEhQ6xM-0hB3v}hy#sTaAwB;hr54@jx1XHfZw=dvt!$~ zZQFJ_wr$(CZJV8rZQH5fWbb|6G0xrjuD_eAG3T12R#jcpSoN&m{68d4N#hWIc_k9c z7%rES!Vu|^Veo<^QluGR2ZNYtofs7#X#9IQBIHoUK9-!OC7m-x%6=X&2S~WK)Sa19 zOA`i_m!V0>X1z5ce`8J)4wJ+4jYaBi-QIK8Q<6p>fU9c|gYa!4RjzXl7hJ>M1YN zP7i`SQt$p3ObkBE(D}u;09Q*b`L$(#xoAguCbZ3jsh+DY12=h_;Q#afaiY2o0tn#v zN5@^3m_)*X!n(lCUK9scgsAz5yAi~Xa_x3<4s;z@oCeN`KU z6mwR+*Z%e~iF3`nKsD{Y&+imgw*bs4W5#*DW53?Wyf}yQUY+@01H|-~Ijbn?J>fO| z2u7lL*2K4S6PO|4FW-i=mrvMo5~7Z@HT4S(Z}omU?^#6C=Rvt?b~X3gQQ$<%O)?2A z;iImPc6hi#@D5QZ54sMYu@i#YjJSMf5TQHu_~BxYRIXL-aWYT6U`NlcTUkQ-7WEl% zaV8mwnfsg>TfRUgr*6f>Fk?#~k(o4U1wE?SmQ#NJo$7#A6HY)#k~xp?$C|PwDOYy} zx9aSm?4HX>#5s9d8!!2lB1McLD#C+Jo(;DHn%U7(0%godgOO84>(~)tah-TS59!r* zi|n9LlAd(YqGHpAhn7`$Y%*cx&pohM9Y;RN`Pm|)%SEV1iut~Xv?fzs1!usd7~tec z)>?{gq_5u4jyjkrnB0Jh$Vt*kET&m)fNK4ubsCQsX+|y_F%q_v*{Gh>L+i=+Tyw68 z&6}bkpaMHl&Qu`}xoGq#mkt1)3OlA|ti$@}F#E z=%wA!Eb}V&vZ2ONk?m_e{wplKhHdrRII~%+WMWs`e5rB`h$@5=-BxzAqe5~CsU;S~ z(%{5i@72MQ?=%^_H!JDpI-?m?R(*X&y;CDF0j!TrqLubijgd4;Tf2PtX*TkgPO_{m zCgbH_!Ng4d2picEXvZCsB5}aR&LAXJDtku7qV3D1y)6hF)1+W${8j;z)_Q~2qS!yR ze~&|H!EC{Is<>iAh^fAaz;|x`$jyTC5Bym`7g<4i?k~h z81d#wm?HW&wS-fl1_Yg|(#F4l3VKC~1j%KUEsNB0`*2M;Yp#dcb7hw1X&J&+EY`B3 zqg;7EV+9WLf4n0tHV~v!p>}s;KffBR&z)gkCEN!RNJIh~lPR$P1FTjv zo$rJDt&xoj3U*8q+&yHgdmE?@Q4Th2;`Ryh z!OygbyN(emJ7)1~-WX|myX-z9n_D&ghI?DIB1qs!5y78s)V7_4NR??YEUY9mc~56f z1Do64s*bIW)UMsIGW z?9{3>w8g*ORIRn>I^UzP{v?@(Zh~?m@b59Stt-+j5Os|AAdF>XLXY(;;aC7(`XtD; z^xZY55)lfrsJ!hFWI|3QNY)kU;PM{t&QtV+NN8jD?J6mFvSz~zE^J2a+4WL@>q7!C zd7Q0PoFVpI&4~I+;(lp0F{9)e>81|s$cay@e7{VMc1|mj+Z_?i0rZTh z@Svv`2UF!@Yl7(UwI&$76^krUM(CMOy#m9==x;5QiBZro8|)4-%K($sm`EB~oOQWj zK_#0E+X?}Z)lpQmXz}6LN;LOA36%|lm*^8=aav-bYFc%9vhTm^%*xMCp-ZTVOizLw zS6`5P$;$Ul08#?_@|(EWulKgJ@7Eo1asIFD#<7i;fGJ{Vu`tMGQA8&5Oy1)8V2o%S zmsHb6B-U=LTgwycit{Mx7h}qYs40@p?FXNX{4QG@VSCPD-q>P~#SlkR>(+sDthz@C zNRVGH*y^;s%|Q7&v>DD(XFu(<@Dw^f*%B#fZOv~O!4ZipM&r7AV@#wIoot=jQ4cTg z12^}l`34=v97;^@slJT5Cyt-`JQ?CDUF*@Zm697_fL2BZObId@9bI(OE73Sd^=F$J zB{`3e&)_!3t-P%KOpY>bo2eL-TdGf?9bRuiD}uKkBsv!-eBK##!!Y?pj+u@&XkLUL z$l8d83LLv?x>jqZkW7TzUIYahD5@%m5~7NML=`u!LWne6OKgeP6n`jbqT~icLoQD1 zAJwDI8xpr(b&IB_4LBOkP>pn_G>*?pVW=bW&5Vr>?A$S_ed7m*8sFE?G0iARmyaQw zue+|KIyt^|d|y9DNAHi%oo#O)pSOE)-}^hS1sl8DvbeFGrZj#sWKPaEEBvdg~BizCMvsQhj z89#T3blaD4uqIn3Jdq8*_PhL~ka&*P3CG*{xnh%DUbbQyls3X4$2$D^$ai1dOg;OF z`Z13cO$)42N4^}kOCb9l4Xx?ezNl<8@I4SLGQ`%{q{xD3yG1-Z;aLH7=oaNYn83$& z4Xj;(?yhK*Oc-@9+xW_)4J-AsBq~y73dXn)8=VYXX75uUS$mMBP^#31?1<=@1~Cin zv?$ttKqzgkX4c#JfK2eYXn7WRLDXfw?F18kVx2C+_u<;qof729Vfu3=sr`D=^FV(ro+HS61Z*UgeT zynv8v7;AjSfD@Tj4Y4`|U8xBOahD~klYWzdQ%y4+KQ{Fp=6`jlIlQ`0Xa6u(_w!G@ z=X5A0wX`2w*cXt}sX!xsE1@tM82}jeV)d#sjfS10-L3~`timc{fXQS=-4hqabqbo8 zDIN~Z89e`T$caq%CrYJb|F-L{i9mM!5$@Ia2ZzEL!J_=9>7rhJWBf);MBvnfs;sq7 zV66u4C2Q36r$wsCj@1>Z^y~yT@FfH@xI81{ZFABuj_KUb-QOevuZi9jtca>fzoX7P z>yI0u$uZZDD_?mClD*xXJ|QSNM0y34J)EI*79NTx_=Aecm(Z82Uq}b6EL(|W73y{a zRb*0>D3)o>jy!|7l7AQcF5a{#QF%&HYZjtu?b@KbqE?v8K>tCYJ2o1%XjMkml`f0J zj=`CsH8Fn-?>j2SVbla0REm0CP=&RZSq6I-ZcHjgP%=#$18v&1gk(bBl)a30DE0*?$nk6)mm^Q1MC4vNae$-N+QNl^ICP&ay?%bm*ORnfIEACS?13YDt>XWXDf08ZyE{v1tSf`8jG-Lz=$?EP7e{%^WUzE43j9PNZ-S{BHyzJp;5lldUcvLm#>_{ z{zU$KjZkH9wZ$;lmvImgJrnfBG>482Pi>K-h#1aX^}-t>8C?ja>*(wI&Ya`67E-QJ zfGSvPwj`_OD^a#Gewfm#HkSc^`O+a1fP77B% zyVXXl?nV5rC3(npV9RT#>@jCFOLirge$(1Wj{g5uoBd%{_I3NG+#%M?eg+Y-1l8yv z1$!XBP-$HL+8%T_m?ZlpKCbCI*oc+EbgH{*mhRM4C^Xyi7$Hb zP4cscJ_z?qD`^{l>p!;rdrW9#lhAxJIL~ z6w0UW!ku7=Je8YvOPknS$~5Irp;2;Gd(!#K?`tvd>$Z&3by2A>P$#>G7jSmo=Dcp#t`BNevNDCgcfJ?>?K|fczw~7zPHcw2g`ImUs_h!>4hyN%<^4XBo-T(cUDud4fDDAFcAGi zzgmer&PIG?3d#=#hRm9+eb_+A6cu`sum6MvYkPz3|0_3tSmuA}=1uc|HK#H+H`ewq zyr0>EpB1`*Y#ZjJy)FCyE|Cv)TjA3`{?VO&BcU&+#LJ#O72vPUtMAhFzwf6pJC7Ps zvSJR8X=AT;f!2pLuoG;i*J^-!*ju@AIJ|G(QA?(^r%KElMV8FM8H*XZ(`)V>TqjkY zvn=wwVK)vXx=a!sl5CP5uVN@)?56QLjIE=kp(k1;=4LTVGL6D6*D(*6f42!U?&*$cGKjM=V*mU`LbA~({`Li~^5 zggA&M8+3vY&`!pnVdtc<_Jm=z&ZIGhr7F;HArN~+a9R-#8wBt)D?u`X2TtPmhR<5b zWNWILav^-ae;##=30Kt9Bu8m$_QNW8OX!d8UAfv)i77N1us#LbIvr3Cg6Rt2vdJ#! zdZjI-XfbKAqY+bU;Rjcgg=cb$3RiiGTj~!?69$%|%@_Wvk@tTHX@U&+7bBF&4#SA1 z=YbPc#Y`w)3k%WJao`=XGT21EIzAQHisoe?)(1T5+H1Bp<8^?^p{5rwf>yUOW0X5F zqujG__l+K+!?UHJ+9V}S7ivGtBpVX7476If37LF5F^g*mS|GpJQjPSAc+J}%I2DIdxkWh zbr*-PcGJo2$U`Al^z?u|nfb(JKgec#5pnG5YceYiFb+;SR)EhG7dDm2EK&)ZhBTL{ zBqkeya?kPWt~Xh|^JfvbQICQw$^eNO5-6%u1klu#qy7)>4YHlamdT3qCFw zAz0cCXh>cDMr)y@nq(VMFtW6_G7Jl$Fw&@ytU1Y{;8jXK;`o%2IvOKn&kc-%-ZbS- zw1L!Gi(^_(%1)@I#bs!2ZUT*Y2C`qRZ_R&hR#ikbG!F6GPp&F@V$y2Ko(V_Ekr?#Mgq+-7K;H% zX%<*R5sn@zxt}|1pC2TB=D+asF(X-5za=szgbXzx8MFJuW|pXSQA+kB z(8(W=wxbCo9qe>o=+stf7}cx>IuPtZ>$2U5QDLBga?2l1`1y4H?O~H;y&G^LtMS_k zz`dx2Y!=wrPzcb839Gt7>mV8Xz9L>|ZU(*UfzajxGfD{$$qp z*zgHb+@kKHS$j@FlE&L)=JeIBJyk zQ*IXWAT;6xGxxf`+(Qr2OhGF#Gfo11!Ru?(BO)-BgdZQu*xZrwNd0svsmdHEv7rfD z9(X!j!}(&rtSvqV}XjcvKGsKY}QdMmso6RQ7hL=SP+o6wN~+#cO;7RlaLNv+j{ zHa8xsN-ZX(Wp3SApq)5TX*KCzUMenT%|%{kBFgrheNj|05>w@SV&v8T>E~GTyEK>2 z?>UYB3pG9nAKbt1DeXe_ajJa7W8`V+7iB+W!qaVC9?OE)ziVp&eRcv}*--UAR4iQG0 zf#MzoBFb}tSqi${bT=*-m9F1uKTJ5|BgWJ?h->y`gfu2$1WfhFg?(}5PUg_U2(DdU z%R)AZP=nKRbAA4~>j8D5bT~%;X#;B<2OC0P$G+b1?4&MDn7NO*X54R4M=xUFK%PO;S7FCWW2ecAlkSAVI)6&$aZKN>3kOU$jb@>~9|_kK)-+25(7z zoC4o5$Kn!ff$^WR-~bFwjTdv<_yqpwter)lZoU!A$**YAHYD{}I{}t8lz&vM32iju zlru_3MD(O9e?#ys`6O6z0{+ic{{J9O5BJRfS^BP`Q(AFWXdu|95s01747mC17^Dy;dxTF3L?S!4sw#U@ zI#%~IPG_mxB;_snwR4Bi_szlmcK-Sb_=($ozk358qv3@isWEZnLOwf`O$%98%DU{~95TKBnpaAR*Q8(LoyNky7KmpZ*2+AUpUEw>nj0AX%Rm|ezeV76-L^& zuC!ZUGG(q2>}2F?Q3mZZ!ax5-$>sp3qxO-CVKbsv8I4|_^_TUz2^hMbDupH)o%IO{ z%E{CkjTj5fM6{znd;Tx7nuX_LSW9t=94f-Tu!bADMtiS&p3OdYTp)0ju3tBJXBxL3b3twrAKjLkbE!LiEtLHzr(7>MAREHN3s^ayt z<5^V?KQ8afep)SkIzR8vjA-AhEyHT&st1xft+yNP<)fcsTVN{92ukinZvIJ_;zo0x zA|PLY83ds;!lI>ANsHJ#_97Jjit3Mf_^{NQK<2iwou@UHxxecCP0a>`y6n65xmsBW zvUzWaR@0SRYBIyqh+~*VS~WEF2dE5xW{k8y`-pRj`vJuRz?a~AlKRmq+eMakQ%m=C zlTMG)M2S%5Q~JyMEQixdZzrp`-qH*|*Js}@_3<_QCFWGfxS3^K?AS(*F3H<)i@hh> zREx1tAA>baYA3fF=}t$0PMv&Y!(2~Vs~ngPrFgvq@p{JeuX}GV_l^Y|p$F$CHi@~= zvY6vP{h-GeDKjwD*zwJ^@>Y0zwxuK5sgp^$(~?iC!@$EeEoHS&nm$#b$24j&rys;& zMq0CidD>WT9(wc&b5QOmrd@xtMyEFxo7XZIxEf^0ZSb_TuC^;Dg%pd|s$EDq%i>2K zdF4fUp-!jB=yCFaOZpeLh%;Og)ne|^s=okQK2QAi3`0-dYos z?to{o>N!WY9HaiN~>ia=bR(j{-ktb3AF?MdTKProG6+q5YE~}G_bKdbYV|`!B$V| z5We&Y?2AFJkE>gsP$)d4qPt*3XGk!Ne%@6IHA837B?g_EK2{jDQ>;T#Lu-Xb3vZ~M zc{Ji?SMKK2V5lV(vjTTn$BFe#v&!){4EjKlyaeN|F_cwph0exQ%#QY|3tHMY3LO|6 zbRudKo-z@M!c3d1mGx#|Lb6U)HAttEP14*Nf(c#gx$q`5?&q%Jm)T{*_M^5))uQyH zwqItcy%J?F?rDHsv#t8f<7W6gRFnEzvh(nx*vdjs8@A?6!OTBw-2GC-R_@U=zMg88 ztJZXx2$;kiv#^d&$ahSLW~stqOZ=PqIB$D zIsXC~F7gp(xuYpeFJwXb53mBDU8jiLrMeKK-{H1ky8a0SqB;*iqYQv(GjU#Xb7~Oq zstBMTBo=H>1sZDP<0g~cX~sa|;V_fckhzY5Nj;vhl#)5VT*pZ2FK;mp#Js&lQ%*>f zXrxZadT2`4SjBdNPFK}{!Y#gtg+>D3Tp|~yV8F;&n^dw9y!w$&vh+i_(xU)EV&`O) zS^Xg0SQC7%8^`OhPW&&G&6PiH4nclP&6H&?hBeJ8=G&Kd8gYlO1MI469oLJ!3&AwB`N#Zx{GuXTjX<}8Y~37%wj>;g$0QS zNm3bG;gI}gzw#n6Pxl%jh!4L8FDTjkwOlP5OTfAw&v#EtkP{s73a6cH%_YpL-9))- ztyZcjO(^Rdn+jGuugzNfW$_g#C#WGkG}lwXVUN2ynukf+`9t!RXsp#$fyUg&E?E67 zYcGstRHWCFe=5Y<#0nHW`;VeObS>3&qCmSUn3{RJt|win+!IyCk^>eH;*6zNp6 z$#2p#dxCEGSZ!w&l*AhLu7LIJTLj9U$BOp_FbLM>?>TZOA-etOMF@?&bKPs@#s#aE zTqA@9URllCni;L^y3FB4+@^mhJ6imiF#${4-Q{fwXnLMCuawfvi1_W;n#(Q6Wfl&) z)_&84c|r|yuJ1sLlpZ<{lxNHZUq-1J?gA`E3DE+`efQh9$s8w0J;|J46wMk`0q#ga z%ERBLBWr3p=*XbUKK%qi5;-U}lyJ;q#vJR(A?T@Gyp~C8+TFk|R@`{=)HLfI0jyl4 z-=LQRq9tv3(+_jY{1I)NqJIeo1yw z?@1t~E&k;0!q!cM)-6*Eqd;qj}~3la_!Vy?N96V>8QqTqVkWW*rd7 z|7$h>qceXD=FZP@?hJ<=+aKxqzXO9le#uxrGe4uAAGP_vt5Am>!2188(EoesAJ6%7 z6-u1q$Ork77MN-Dmt_4=ztJLfsvmCw7OA%r!*?E}@XFIf!w0&bX2=?$;2YFL)|ILM zyoIrley7Kg+f?JB&4F&<4NjC)C~rH$P<*4G6&M{>Ibe8ltbXgs{8}Cs(Q4Y4eE8M;|ExQCh5{`p>1a2 zaS4D!5q9wHF4h_4R|BbS{wd`bX|su$``@t(5Y{_X0zG!qo)Hc9AZV?MOcQYPfPA@2 z!a?Z47x|iUqUrDytj2LcWO{4SKnYmeU$=`SCzBT9=gITyO#B+|+&A@)LkT4AiiY;L zir>t5@g~@gC-57$3sk3*xWS8Z)n3$ISTydL)Hf9HiNP^Mt2NsjG{#yq`CBMweC{_v zCtC^j=}OKcbfBrvghy!6S64>;u9OS~3twgq$+kL63FqUT*q3ohE7w$dE3oL81XCc? z(<635_loRRQQZy0+J*12h#vk_nRe)C=F*Lahz{U{GG*Z;!V4eys8#vjVm0*#kPL9l z{hd}KVi#(W!6N*hrb3k zupq_(w_rTq`(_JhxVgud&lPQUO+vNDyrR;fbPwg3J58dd15LJn$y(|qO=xcr-)qgo zMw}?6HQB(mV)V~);Fy;wTJskEdF2W*TS?wH;G^K0cTvbXcQl||;jv9eR`UTO(MJN! z*jMgbbSm8TO;sl$OAQ)@Z?Y3Ep*7 zp_;^HuR$$6fCeN)3!SkQzxmMsFSOmP>WA!4NwkL=#Cr**WMiS}*f0qB8o6!g7W9rg zKM%ld>_!11|7)`#!Qq_p5?$ppA?F44J*se_=%7NwV;Yjev9( ztpGOpOHrv&>Q9O0n_K;$0wM*|^s>pz?cOkLGqZgR2m*KzXCkv(Xb{sa5Rj+UdPZ+@ zhX)iqEz#^Vq@`uT(*%wCbir3GuJX^WgPnHa7I=v)+{W8JOY(fngZLk~(>n>kX`v8P z+T~zCHv(hXITFO(;}&ZWLf1c+a#CzWc|{@p8P?mEKY_TY(@Tg^3RkHSpu#j5hi@Nm zP4WX;1?=3_Pc_Ch?so8h>0zvS3hnJ34m`_8HurM}>za|r*O6HhJoq6JB&1XH*v=&J z)7=Lh4k|h;HF<6y4;aU0Ht~GpF2o>gwr>o{*(HuObu?_O#PTb$k?P}zzA=sfCNnXJxWasV2a<0#{@b(4;vy_e z*}l3OR&9aW#|!2skx;N1^A06SkyP>;h;V(LQ$68&_l%4)z_B(nfqCtjH}N6S@d3BP zX_ag`y^32Lz954>XCuGskMl89F;nn_tJAXU30H@@OYl5yR`K*0D0~*^KbW@e!J_w= zsT!z7GoR=<&C;%?Ot=InJx!yX+tgC4rg0aW0r0QfZp)|m-jP4FB8>3g6Z%K*`6MkIGk+f z9pF8^3Sz6A&lRS)Xcdo*C@ljT{$Wh=J(*{AwCsQrQ?W1cClPsYHZMZ;I>4VlFQH-O zJblBbj;$8Y@<*_no4kF!MN41l<`xAw%ox~o+sv5=za(BDaw2)>`f`a5XOkga)omn0 z-xfhjA?r@_zPg7H3yrEK?$_CA&Cpb>!v#}zk*;E3&%_!!J4ba3Zm~G&Os_cvcVK*? z#gIrz`}qugc^=4|`Ryys5zKNhBS{E%*{GM8=EP}Qq_7j>)g zGWQNQ9HNCNm;}eObsIpgU-b7uJb^3H&GfdVus5A4onSGQ*D{Y}fv@)!y?^_8s7^)J zu5xDYj_3NdeT#WLrVvV?e(CNIj8l5n4T9JyM1`#jzoF4%zL&#z{1PnUggqDrHA?dVgu?aXiVRm6lKPQ9jz<-< zN=fqmrWD<7{7>d$nOIQxT<`?`}g8bzaK=X_viHpH$}GjyvOengi1 zHb?;@uE1fuQChlxsrKzKGSUC-Y&~#t0vCE&R=X9!3#7zkH@!zx$`TtTa8g=a^=xz$DlZJvCX z3su#wmlM=egd9Uzm?hj|8&i0UnSN_*0(PTM_~I^Btj?_Yo!eBlO%$pDAYjM(dp>bc z`;Dy?_yIq6aWonPWNimB)R}GrnwPQ^3H?Q%{TaP%LrVR5&@gFYxeRs~j$$8qhF)_I z%94`6LKrxr0by0g<6@Y=1m_tc1qmgmC9MC9@jPP6D^ z*lf;rf4=D%nltI4JQQs+U5ge9Df=|_WFN5igwQtJqyt%LLn`gp*iR1$6o_v4Z1TW) zrH7Wt#r5_oOXVrJ8V|83BgB)*K$tYNo%u)%ZH&E8k4Xk(O31mj(&U!jBM0TTmCO7; zj!+TJN{<=OVtJPE0;AHiR3RX{yuq#gzLch_FGJbSKv-v*LBywyT!K)@oSK%v=*TWO z%?m)Ig>k8lW9UUDzlyxFF;ps&<+4sBOZ5pI*xzBri+I7A=YC5bY3Tx&9Ga2Efy!R>3JIA5 zHoLfAZ-yQzFAW<$;l7YMojCYmC9)-3iH%3s6;ZteI0X`bIvpy@$KQu4dQh>8I*j4> zzZdFyQ8^8C+S)J6-7>+9$c7St)0!2G^POCwg}kPz;FS z+#1qQZ$Z57&6z)l4`BzkZQ!s0VTQMk@`z!8)e6O1qldd?;jsHlx>()wf&78<_*jH8 zUQy4NZA(qpf?I#=tnf8QY>6p<9jWo1iwqH3f-WHFtWh{I_M*g!vUt^bvx&zPXh^4( z>U?hs#Fi)=Xu>h*;RAH;f8|GVJ2o&uaAyysQ^(KXBpz1hoNCiiQ8&pPB>drsCLg^U zHTXShZto*%^Kf&QzjM%9{WpQG>}uQ2#Ie`M*|SO^c8vIiEEuNS+*bOtUl&xB(hJdA z$AfYQW*39j)F>6Z8#E?;+*<<(p5*wYGv>Tfxo&aQ?GBWVYvq#pmr7gJuZTzq^pPrl zowXK5N@7Sv`pZF|M}|0q2elLyXf+7b%=#3~k?L@<+i=%!25es@4aV79;0r-G=7eof z2Cec~rt?T@@Q~J6t3}XHd~<*8z2KXZ>*M14ecL?i^M8H4hH-uzxRLAUcsKKZd>tPC z6qWmW-rnEukK#TK4_*q_Hh1Om%oT{)D3iN2mWy>+AZMQHD)*8acB$W@bxvvgnnebS27u)gs@q0$cd9 zZO2R~;MHXtudOvOelHtuhvQNkzIofp1|b(GivS*T-)TI@Vh+;CPsu^G5s1h~u$bGLXypweciZlB zy4kV5*}=Zqnf&hIdOJ7yE{DLBCe6y!RkNAk7eS4)<_&qbR2n?UNvT|oq%Kbd6Bx3l zx-Z0E_NKJm5(@gZO|G`5k1qJ<+&A zfaHIWno;l6H))f{DulYx3SnSfS?r5SH=6@>2|^IMhgx3W4A=Ehvaw1@wQ@}jX>Iz6 z5^@K*d+G9TlCa|0v!}?{D(9z^A5{?l;(T>PGmm@O3WzeB2~ui<85cNtpe*=lvz4H! zU?^pdMWmsyxhd*1`g=pm{8<>aM3CEL&Uv%GMj9c^W1-K%a?FmZKF|@C5Uw&ulm_eZ}f$(nfG z5zNFtZOx%Ygj}3Ut^0rJ`H;qr^OYGGT!vvDNc1TerRmg;gyGefIPHhvrsDuiZy+rs zInhoABx^jMY_(4~zvB=2kh1PYxXZu}{9SrPFgP?rN9~)~bF2bZ?W;B3F596>G?DcX z|Eff2spv{Ltii{)s>h*fv*XgwKPtZMh<8$noERWxdmso5I-}sCE$A>nn zg%w%fp^}Yv5!Rhr4&VQYi!c;YC?|k5y#p?E>~Pc0P3&q>IYo06D<)^R0US0v35CW) z%F_*_gds2UCST`*Q0_y0Tupf21mgY`9a_2eG5!352T2=DI;rQ?=5?VioHrzYDOt#sE>hC@bVDq( zB-i5Im?~NenJ*_?+E5~9p{wo4xRobXbut2(ZllF{H9Z0*h zl43KNd>g>b(!Us3UfLY`6j=QTAOixrv0KdvGWf=0p$MKxW6DdS?)Y;{>FE=FgbV>_ zGaGH7^T~QzhWxLHGtFAM&)PYQ;(7<`h^TGTi&-Kf01ZS4p*Ztb_l-^hH=UzL8H5n~e*ZgTUI8cWN&SFOf4#1~_MA0c;`nks zxOtYZ!K)))rWLli;d69_c&mYDQ6qvWQ0{uLyv{lCNytDy7wF0|xqB6Y^a)L9eKZSw zysB+kBu%-I$Hvn^j;AVPH*}dO5M(u*Z&|t3)Fcy5l_+jEB0X9f>;m4%h&&W zUh?+kqX&eeN-Uey$$LhV<)Es>7s1f@KldWU{vb3is;XmQF1AHd{wlJkXHdrn{W}iC zy&RnrwFPjgHRtZv=@4Yx?n!-Oy4Fw5E$9D%rIzyg&r0sHLI^bn36d{{0bhgs$aO(A zcWQ%J6011q0Ie1-?=Ca}#=l;nRt*}~mMJ)!moY|Y=V3sZZEnDVB5fn}5X0m`)?G=V zc8rqg3XrbNL6ydxPgf%__t7|@^O!aXq(|UnO@9ZdRJl);rKR1kYgKC$e<%AACWvQz zA&664m#C2Eg>E}2+Pv_=UG?IZ;&8(eV)tm{SjPbp_$~Dvr8Lc+D`X>#*Q6z>Pp%Y}{5-r{5zL z+4@$%ZUKJE+&pE?g+Pgi{#XqO&|)g3hz-)HD|9GlZWs|u}#FHT2x#d_@0kVURqkAi3{GVZo3qGaoFlh2AUw^ew_oF$GyuV z^^9@(-DlnDL0DML?fxM7bhdyMueMULga|Swg!#bz+!ZSu)emjA+$|UR^DXhl5bc_m zehm@64o0wu&0w+$;}8*+M}2?Tl5;9(`Zb?@3gx>|L*BV=-#!kvZnO`C8%;GySTlzx zk65#scKAzh6KJA(i%XC^SN2J2jq66yDk9|~hybAXXYBmL_4~@3K;TXr7$EfGQo2;> z1MO<|4i`W|smXVGI5-{P#V9$a0iT+Ns`)q_!s73t`$lA;%`j)d>KPj5(o!4m4qaud zV^mxw1_9D(GqHj}FGOZ!ef<*~qc+MdIEUy7#%9wbfSn&nj`rNo#T}j;dNKsPRnM}4 z)F1Nr;cq8LZAK6=kkg7w>=HW4!IIg(Dr_uL9;fvH#1eV0?JBiOixP|g*ZVBk($3Hh zcPtjt^Au&}Bxvp;^||5hD8DLQ-AYvz#xty2hQ|jr%R}EdE}C|dnmTj`MMDiq>F)#` zn=XcF-64MDu72C_;W&N->VGz?r8+NWa$zD#kzayq#^`nYw}X$O!!QM?`7Y8<IHf4?x^n0RTBOfg*ZBdu14_IS=4<+)hytq4lr*n- z2zUkne9Zmp>ipyH`~a+;AO0Uv^j7LKM87|hmQy(?c&Hdy82@08YneHW$a@dhs9O%z z-`2mH4`ez+q80WLn9u??Oy0OEpEz$1r94R!1{UfucxsOatASm0W#X z&j;SH;Y0BB1uwRu$~MJ~!Z<&^Lqk7(;ND*#n3;F^h#((D5GRHBXd|@WwV|}Fdgj}y zv7v7mICESpt^vZ|ERZZf&t5uTW+K#Yp7)_mCY7ne6DkC?=?g>tI9R7yYPDk9%To8b zvKPkvh_>p+#3g8P5BrOD*x=A61SXi%ZxhlC*q8GmQqS8f=;i$kL>O1?Rqt|m(B;#` z5Jqz~Y2}1ZGNRsk#!yMX6+}(UuAP{%$?z9);PI_^$yHA8(#>}l zn~h&LG19i!tkbA#@eiHNCI41FU)|H-0mDGS`mG5G{C2t2gX1?=CnL4U4u5}s$|`+z=eO3W_TJ@k1){+vi>>3 z8DH|ZVkYT6~S85Y#L8YV4>8!^J5fH!_w;{XqThv zmLuw)y%zhk)r28HYpvy;&$3I@giTftwES);Gp2*&m8ko{=uYs~he>2mpi(PTtHQuy zLSSZHiLIg5CRxinPG+L6lx_~f@>7S->1wir#ZUTG_X%EggEz-eKQWF_iA1n13^Q?dju^N>c8O4Q||Tt_IkOSeGPSr z+R)cQaaIg7%lC1MJ)0ssM6@8bhIV*NuRwkEMu~$>L=(mdrZJT;`0&j| z+KtyA_>l>vc4uSGA?zCpk9f%Y)|hpi(WR=s8nL#WckMOvECE&lf70i5ECHkyMuRfW zTTGOG>TnJz1>LrgBk3uf*eT`%>AQ85=$o+%C(w5HOQDq~8XoF3)OGZmU^A9jdH1imW&znMQKz zZ#KMJjn!fncmbtp&P-}+T%RvwVCWMQz<l^!QK3b2fA`nK3E`n8;MFp*eo zedi1x>r1?u?d-FIE$z9bwDDheuP_UAIZ5SI!JYIy!!ldPSBKJ$3G9q9{4F%U9`%iC zm+30CeExk<#mZnC9ae3pHcY+t(zcg0MrrmGwZsoNR||-|EM9yyR~u=8u>RC=q&dVL;_0wt? zrdr|UE?#-Hb>~V_WUR;hfCL;FJS%CeAe=#?*amL2H5^YSIf7nF^R?wh8ORM%=%=B= z`MaD4;w4=`VM;9nu*Re3SeL#GL8K2;i3V#3bHj+F_ns}Pe3NwkL=1XGoxXinM{g_m zh%{bh>Ss zU6Uul>gDhwMtk!J+`34Xy0kB-Cr%Q*wFktkku_1H=UA1GnsT_%R=QN~GnYKkxqVl1 zF0RuDQe<|=IK*(U+H%buUxyJxqv3F1&BZ5rVPqe3qZNOl{ebiHQVb(X+GYb*jdQO- zfZ)K6yeN>bl~F>lt7ho?n*PD!c#YP`4lFq!P@!uEEu6}94VBGuJ7DUc_30^PC^zS0 z^Wzk5eK;z}cTl7)i~BB-t$fe`Pix0qTXYl-jK5&zW&1!1TfPp7H%J7>*#J9~yPYO= z`>n=vVwNdJZpn}MpUzmPaXVwW9KJHIpH3fC>QjKJqR?te(NuzBGKf`;ABBnoKvEd<65#K!&e_D7yJ<{fV@} zt#JgubNWdauMKmLY)qzq4KFIP+<$vX}R>O5Q5B8tQu=!a=LmHoF~-HZ(Y1H6cB)8Op{Vy@^Ja($|@Z>vqEK z;!e?N4w%HOc7xL2TtE+oKfMuSy0&Cc{CR7rx*stY;`vHGrER~VAvk(UYx~6}6*<1_ z)fQ3iYu2G&U2>O!ZMg%Q>*6+$H_9F6Chjy9YkO`yGtHq*PYZRfr^U|JM1w++AIC2|F1&o&oZ zHeX5+jNQvI`_Xe3S1z7if#CH>1w^VYdZ@@bITuo9M-(e>B$8T}9k| z)ziv=D_TC|zdAkT0@4R}KLPR@?K@%VhyvuF=q~Sx8xgbr4*+#QiofCETf|F%r`~CUg~Insf+vzZ zT;cHD_P|2oyDiy8PsSG-Pozr57bM?p<2Ew3bb%3DY60^RBuP@S^RYDRB|Wr8!XIzQ34#sxc97BNlL%edq<0K6>KFFe-M}9#>w1iMK*&&PAIyWxPSUfbM_YDOr#j78MfQ* zuW?06c_vHUJ0(9ur9IPWMoNGtl=|Fl_fhI1r9gLEdTG#6s?u&5(MYM#-FA-)I<1uG zZc8mKI%@DcWk?4~jgHfj!(~ZFl^)$~_nPc@Y0}-6T&i@`#B|G=4wfz*Z9a&UIUR<( z9VVGj_Vh5_+$)1Rifp)KYHC^3J*s1Pz8T+r_T_kU#C^;up^DDC&qiu_?zTrZzeLNl z?zV?0bE8*qY+2W2<*ifvHB#m^k!YkCY;W1uMAB)+VO<&65f=G9p3z?{Hj(1kn(e#o zu{4T@g^(N1(s@DA%{$g3x%++(oLa){TzOPl$GruqKD5g$)1OI6XdH2*k@g#zkDbBx zMF&~kL9DtBp^Ny956+y!eSXCYrnahvINTJH8^k-tkmVgvcOZ^lxx-K7J+@-|qTPc= zw{4wOX-15`+-V5sb}@@tN+$J)Q74`D_{BYg)foJ9B9`{x1IY+6J6i1JcjpeWFaY&~ zspnL2rUr4Z>DGd%QCF80R9c59-3?D~(-4L<5C9p`2aeqWOa)a^oWKUM-`P>ZX(7c5 zTwoS7Vt}$k*Vx%g_b&BAOa2{V8Kr{Zon2m-Hym$)I}v}!a-y;|+fd}wL5|>*M1&Xs z6hW8ha>Xi5(ngVFQrxnthJcBc;QtCb=CKD3-U5sWHQ2Zz(-^L3%xvAzt;L#YL=tVQ zF7@0TD_+|$vrKL_jo|h6DWo;?MWa>Er#ZW2#Z$#sGg@V9UbC!jD)y9?dbY2A*lQ5j z*&+-vkz-LzyoR`z5mmDQca!z6kXp{kd8qUUL2wTPDKpnf?m6AC;+(2}po2p$D@66q z^s+o`VdK~+oyC1=aH`%|ykIA^It1a073>zVdIA$ig`;JoEQYVFG~=5G&Jw0%L<3h%fMZ*wz&Nij2L3x5L>$_P|sN`4$@!X2w zv6Emg^Rc^&Lm7`HXO;R5tZ2$ciyZib-57@B>h40Q7~@OY7TPIW(~4#_tGKFp776il zs*Twls4f8zu3qG|tPW`mX@7;k!LZ)|vTd5AkcyM_7#LZfBR*D=OJJnIAZ7+n#lw0G zEUZs}gEbZd%LgfliAO2;SKZ9R2*oJ&RUfidgk~7`Dhbsp@`X;4Y9gXlwA1@YO%XJ! z2*o`ltpg!hjYY8njH-lfa4-a`5io|y8NiQ|{d@S#-^a-M9h31pBA0iBF+44YcVzzV znB3J7eN9WS7@3XxD1A+HfhS}KCIsgvJM!-9#2bMD^%(e1kAnR)7WXNc@S|WpJp$g- zV_-dv$9d|YI7O%@V?6C6IK^a+2))uZcKDkAq<}0>5Z91bI4kQF?@P5^hl!ktl&`1hc3IjVOU=2(PFY zi70{Q09MhXqU-%z+Z7U#h8_uJ=#dbHMxqO)@{43-p%ynNMbAt_73yLJB}r|c7*Qx) z3Q9#1dK46)Q3yh0k&;%Dj2_g%1xg^Ch8)zz1WF+LAk?7bT&BlB3wjVz(Ab31F$h7a z=s=0+*w_+~fh^ijGR-(DP#5VZneZVHfkviGjY(Zg#?84$T25N}*+YQFZX!2R3nLHTDUdn8v6wn;8qx)_ z0G>{2g7p2gj0i%GhkTPHkjBt)_E2wL22k(%+Er$_qcE6QOa{%3@ zAF(ExY9F#qFIr79#Rs9~WHuOuSaV;+Wz_17MX53P zGYQ>DM5x)vo=F*E6rE-lcP7m_7ec1##hghX+mA}~AaUx@()9hqQ^(=UjK-GfAjhQn zcRn$$Oyc27#gn-QmQ4I|8-*kD|FL)F@ljLT-}jU!;0A~yE_f+uTj)$%c2LpM7AR|N z3#cHNPVUTvW|ASvv`j%zTycAfh>9Qx0*VR>A_yoh&wb&E3W$QDJRTx0D6Rs3R>)1Y}=W^8q17@Xqut{Kx{DT~O5$egr@ zQA!eAy@8m5f)4bJp+xWr-__C@0>jL*6)TK)W9I=qnhMNyuK$SENjuwmK7ls1dNGjh2h4RIlQ zqyCqmnkn8au+ns(#>Hff%OSQJ)I=PRf|FtDjEn2q=TXOP4rkTkCk}e2Nh3?4mXnM& zC(06}UqEJ3)Fn5&DklbF*ffJ%Rd;MHVKr!6-J6NRdk_*~()Ec{a`Ftx!Ep^w!ucr4 zW*miVM-@4wpF+^Ule8YZvRvp=X-fNu&qSOEWW^e#q=hY&16+p`)AF+fuo&SfE<_ze zyJ+wVizeiHETPRmDiHpH0>QFZZJHvyHWKPRt59@CuQw^}!LgID zjSwp)gE20;Hb{u+I)<(q=}HH|nHBQ1qNL*LQ5gHPz8C^|S1w#!)wYKP*%v9?PCo8ssfGTs!il%}L8$-?@ z^$8(IYz?M#U?QAaf>0UJ;8X5qpGuP~df4kaauz=o@hIc=(br)$^7mF#E2%SSKO=1q zL%`}3^RZ**u(5;a5MHq!<_2Hc#ED-WxK>brkaTcu{bMqE4nV|1nyzhAe1b~L4mZX;cRiD8*qVbDW!q-k6rj8m-0mrw$I@_nswxC}I>85Ky7Ql|(}5rPX1 z*KZCC24O(!4Pr*7IC?(S6d3N;3+Z3IlTE6dc8|ZBYU|o7GoweTrbPRJx`(Og1A^M@ z2gQz6GqAA6$s(L6+K8y6WQJv887n1l3Is#sa(!xIBFq7$$bV(tLAz;)Ts$5IVyP2{ zT-Uxsgqb}-+Kec}{j)`snM;($ilyFYG8xYl<5mUZCMFh%W5cyzQj#(52_JFKENs10!%9Xt1`*R)45MdiUCeCSdY09RN{c-6io=kL{6a< zmg8y9gSkx0p{~ZK6!LcFnfO+sh7yH}Ama>9r_*G@M#;j(w&W_TkSQ{mKu}f?(nc091E<3Ouv!Rc*?w>Z zRAjX5BpBi}q1uS9p;ju5z-(|T$OBpEwbbp5L?AD48WiK%G`0c9F{D}`^yDu{TDLBa zi^$0cjGD}}a)#4tGvUvn`o&V@5VBXT!XRt`s08CLuilT z-IL}HW6+V39T_w^DvNR`ULI8-#}~?ysws#Aq^&SvdO$@4Q3yYwn6?6yqKTGDdttc- zr>UcFI%+#nnO6Z9k%?v$5~`tOv^pKV2L*YTyCg~2IyA`ohT*)^WDrC}U`XpxOZ}i! z<{cKNp$uYXl!&mSKoF2)l19p(LJcYrL2|YMO0h_#ex?ZGp~7K=f&v1vqChn&hnykt{& zuotmsP#mt@2@hEl?AW$x=Sz4&sbkEMI2_p#?0FIFK&dPl5oV?X14V{hh=d#mmVJ;i z3nJa@2Ijm5@0MtW!DlWQ4!?Qrn6DB8Ko7WBV=j=NYH-BrK?Wk zln`==k)tK$z#&ntb^@@s_Ae%7m1262YnrM_SMP~1OYLoYEVf%O>`NVUd4PY z!_WvLo@CT3x9zQz6p1y3Q$eTPPPzHLbln(R^*I&hB$*lg+xdPlF(pO4C;4C^`hO?# z|IT0{m;D52flnV~(lw{i%+Iki@qm8l)we<=M8LTE8b=ZUe-hQL49E@! zW4+6rE}-w~WCab#5}}Zvg}RUpYLLw@!c}3rVgZV{)Ek@C*_WTXPNyu{$y5t6LVO@S z&C1XA+q$lIu~QBkTP7e=X0K7JIVp}lnVKI^R!|_tYq+>8L!crxBvcy(8KVjeK;Fpn z!uwdDh0*ZGQgbjt^MevCGgCz-QIa=@^f<#uV%8APM{7He7|c@(e^P2GRWgpnD&4tL z+E(d^v4fddeulZ@Ej~~#374V_C1wA3$~X)ts?^*FGXY2AD6m+BvC3xSRAxVOK&i|d zmRW#Jv#CickkeE!D#Ok%Mr9yhgQ04Zs@G<6f>T9vx-Ftm(I*ip9ufhYOp`0y#wTGM zP<{ZaO%OtE5~a?FIJ=4P!VPmON@&2&CRwuZ7e6S#3tvS(q8cZ}E0=jrIcJn7q~`fG zNEf8ffryMs9_nNWBP!LU3G#mGCoN<7ImF%>TUHXp92#*;P56~C%ptG=RK>}QOI-$AYLY${=A4vBr7~}Kz_CGC z*eZjAEc%BTNSB?mVs698WJ%^>K@g$p#!F>U2(ZQ4WDKeEo<&B7HM6Ui1V{KtjWGd>2)=EW=n@X;tX&xHIsWF@adjTKlFH5r03v0a+N}M)CS;}TO z8cnR_1rh|as;j3Z=)m7AUFwFp03kK<2LE>Y=%~~(5n0&{L2DH^NX7`*v}X^S(SJq5 z=AcmPE5M(ypL`;$hN7_%XlSTqkvnZ-eT9|i-Bblx!b{9)n*~KKlya}QS~&EPtw8Q~ zubaU7meUqMpGeIIa5$0Ua!TwAc_4i25za;|CpWWCVaO z(H^MlY@8)xB*(T+Q(GhK8-xx7!_rSpa+H+rGEcp2P+QVk=c!FmI3DPTu5-GU1~SG} zR+!IIBT*GZ@)yk(wr%=RA5`ZGg$VtQR=FfPn4lW2a}2f~;6$sIN();$3?dew6w5$Y zPK+QGFv6q&AQuSZ;9vZK-l;c^KCKy*u|O5nsDDF=BgDy=1}Zs`L%1$=;y)b9bfS-A zil|k%Ru15(r3`)25=Dr>5+#H^le(FfjuwcjoTIZFO1Q2u4t)auo%&RR4l6_`LZ}&; z-G)zw%zJ|1=N!;Q5*e!>Kz|51dlQychP|3dSXMQOi@=Q32Szli`pUyQky;%|m0Qc` zNIZfAwS3U&#E@aUX>XCPPG;obuhx=s0+z2jD5JL4lxWE;H|g%@I`%0xV|v|Vn_Y6D zC@7BX)6``WbiOYHQMq9m5`08#y&|w(39)UuI%GQ+rlg!j)nA}NQ6yzM=&>9fKQ-Ar ze+!7R-7=SYK9Uf$5+lAf3U)_9FmfE>S3*LyE(no(!RiI z4ZvU^gfoH++eBvIYS5`SxlL#bLB!vXGAslEtcFS)L}gV)tOK!lPF01F6mjx82Wi9< zIzgh|(Zf~-Ic;SiD~@bq&kbo0uo&^3?N)9Ff6zHMKR3V50Y4>C>%qSi{byR`>HkZD zN$eyJK6lb5+fHFL+&lUdIw3oH=WNri4?5>|%FWNx``js8@4dw`-^rJs4II+8Y!pe) zplY+tmq-L+uSQmQ5(P{qF(p~OX9j|i5TWuGZ9mJ7t&tJCK`sSB105o=0z0H$^ah=j zw)0e`ZxQ+J7AuCP7}Xa#ms{0KRG zBv29NBw4j4)g@^w93O>>fQrQ%x-zoPM7THzggGe$DbI~X$x>IK2sstsPeQU%fgGw- zR>LKUNp_C3Oc`BSCo7F8yf}n1py16(;uM049PtA%m>4}%iAtQPOWv-6Dbhn+mRf4K zAiHoMVyRY1vHU#OZ7JRf4Xe#RUH1?Wws!^4L1Zee5MV$+olm3d!_Ahuv+*fwaHiLWxhhz%`j{TLXlGqSjFaYaSmdu_I1zGAWF!Z!rUryAEZxR2EXs z)E4fo^BUf$7$M<&J(}5(T-(>Xh-yt@W1}uv42TeFGKk7a4_|Ik`dp1#EOM$Q1p0__ zpi1vMj={l#b(`82byH0<8lnt zaM)UiK!5z8LWuSP#gZCRpqXi5e#V(5X_*>}MrB1a%O9gzBh?tB5X~3_#rRO<640Ch z$7@|OazMuTpsN2*(t>J+ACyE4Kp#O0LPf!=r4o`C9BB$c5R*(i`opm(9KVm1iLhJ) zcp2BOg4IycFoM1j7-yMXT`zN_7?2}TMUDuT+<&x5oXXKMg^D9Ho|aVTn3sKx8n4i0 zYPlg<3-h`{z$96qB|(ZLl|v#Xv2|KdjfWgbR>tYqbq;JRgrQ@^erV z2oA2xhO+jPQ$a?4h98s*5kce>F`i@XxAB}K#h|Ph4MB#yybO>fE2u^KsZxYoH8JmC zMia-8x7m*9`z&r&z~pKLxcC%5R1zH%yArXH@f$QPSBVj?QczX`kXC*|k2sEw3N?)! z*M^g-?J<` zaJ8}oiu;t4W@Z0DgXYM2+){gd#+W)9IvnyOxZ0Qkb-jd1(J`J*RBrV9por5rtm7aK zh^om7EsfRuhKx{wchI?RNYnGQN%kHnYun^xz_11fVA+iLW(+A5S z#{+%m=HNd^D1rtZxe=2H(wDd!CV{O(^aa`(s|A7AXG(v7$RcN9A0AI+6ab(I zV#gZai)Q<|u0XV0lM)+@ATN2sT>(bG*sV zs5dwAtnwHdkG0}YkP}r1vh?3_Yjif5jqyEP^&SLAo}e(%7gH)l_0(V7WijQrjt>kg zE2)>PPHz9hS6x}HKb=%oqaVtlQY{3a%Yi|b4zsvUe=+fY)x`ve-@ubZH(#Oh&;YTb zJ`8I;498C6RY1&ppn&iqL|dO@r*H~J7J)d8xBk&LX!kHfM7M#%#$s%e`vx`#IQ1j6 zjp=UU0E~u%Y`HS}qkYTm7Slo)4THYrhK6l!O-DNdYPO2)tC=bgg&=gO8OBt(MwSFk zR@f`nWYRbE*)5}U0R~&{av&g!A`G}%1>_(e2!mvjqZ^4fQ2kXs(BX|7({k|yf zP-DxWBhpK{`j$Ft(lcNLL$}Z z{yAbL%&P&TCd|u|q;aj*lO8auzE{~7z5X;p!?KDfh3a|=$IB?QT0t}JETt^Vnd2jZ z^rztl?m8w_S<==Y1&L2R>Io)I^sHThB=?9D#_%yag?m%&L6)c&+U|o+y0;RCKN45R zi9Y;wUz9h;|Igz%wj1S~4Mgy;8Re)a&XZ}*t+ALGi_5p(^9GK9_V=ee_cO`OdJHF< zj+ee3V)EsvjPkWeT}4+_409`LcR*?OTJCGH?0Uic~NaBNzgfWG#`T2fudBNa8DEu+1si0EU z!sM&^12)1AC0X=qK>5%iX4wP#o9NVN45tmE!MT~;x^(e_B0)jPHv-8_rV*K(7ABCk z8sJa~7^EgSpKZf97f3@TVo)AJLqwInp2CeV*P;rwBN&I|YM-?2CG>QHMo2Ot%>s{6PEdeD zb}1mS94Pby*B!MB)&S%|p}}TokaAR!$D$?R>`0b~b%P#ORHAg#q*jZofTkSlN{CxA zRq_e}Dydt|Ulde*b)wowX|~vm%hp%Eiq}$1szVvqSaCL>VSY`(s!26)OWZfg+$ZIG z$g?anW=x7LC{Kl2j7$>>!_?ahRTbAgbEFyJlq&sKlOr46s!&m0hYNdFczELJD%BjSfh+O5WDhC8d)Bydm zOdCF8A??TpBWAcESyKaLgu&$Kd}kVKN#kh! z#*(sqXB}N9iH@)oc?cCYmFb9}&<(6r82Cq?ohYiM{ID!h0tm#He#e+C=RxHZNH&1e zvODT*`O7<7(vPAxD@1VUrVr&5xK)KPFDi(rz)C+H&r2R*fktpX{sh=ji7ldN{FsgT z$N&c{+l;|NZEW1SjL}pIkUoHKW;zq)OuTipEEOF!5ub^Vd*j?NT7D6tJd;z zja0)ad_if-{4u*qWmB2s!;LV^oEV&|a60~wWF%zF4j$__$1 zz?If>3=}+xW|y9Gn}Hf2^(x3bi;M>me5H3B!B;wNL>K+Ts$(#1Z_|C4V_0JC?n9eu z!Lke8m5)RPgM})S3Sw6?7|61?4=v6?7UvOz`_Q6UFga&g+=mwZf{9HqX&^Q&gMsW{ z+I?sdnx({(Sl5-vFbG!rHX3JK9D=C(M7yWXMB+(g*{h1peVCc)_h;h35A(nf(}KPp z07?Pb5iY{KDo`60RYPi(X^OHsPb0Lwp4^hSeeO%Z1H-3viu$Ih6q%}!QSpd$*eH_7 ztP@cRDiDQ;K(O$2#sgJN1zGr}KM;+v@C@>F1V&^fo@0>FU$@aEPo##AG%o}u5mOW> zX=3~^>RiUixh1okmwi%9cNsFDT8dN~#nza@LV(4UiQa`$HK^tk)xF2SyPCxd)q*NB zEf-xP#)mR2R)C9Sdth?*cbFTWv_vqiflF$uV$SRaJ7&K~kxg@NB90`{m~)&;_Qj^A04x^v$94G9Ne#>wD?LPd*Vnb z7OBGjnwT{b7GKFoBs=@!_Ds#QX?%jD`DDe1hrSo8RmVVt4p2J##S~Ho6En2*!?4u7 zsMxN>TkS14>>4&}{K}DwPH`oKTxLZAV+tdE+Mc+e!AMkAI3*5vVj7EksDEK8fKl(F zf2e)DpwuUeF#>rZ7V%I>13hmYks4H_mK49GF%|eRXD2SUX;*TADtt;ZhSQJqCQF`e zMh5YNBQ$$AKW7& z+!#sI6ofKL>G4vHp~D900oH#VDat|Q-Z#`u)u@PGXEREI$i5qC0c&FtViE~NtFwKQ z@1B?n6<;VO@ZR>#pHj(5Q?+rIYBbc14P?@I+%DHFC7~_Ra4EY}83!B<;4;`g^$=GW zRvIGj0`UMT*&;BNiO0>rO9f?s_zc)x^Q;dlVGu{Eq~0z%Ep)IZc`!T_p$08@a5*Vgp4{K__Ot2T=vTbRhDgl6nkjIHJ7T_->CaF1~GMmN*rY4Nw@RW!J zqyd?a6sQj{Dqy3?5ui$3R1M1rVkE#txqzTKppz+F072RyXB}!@4hUqExMu6L*>iie zup-AosTDWQcsn3+DjnUVbjk5p1${k3iB!W*f^Y>CdT`gMtFED5wCG zc-a!rQBYcn}q zP1hokHC&%s)d`QWZXXeHoLM2dG$-*sPSlrO>F`3g5CLPS+G4OOOu$2m?W=2Op7tof3jjtcACCjwC4=Dh4z;goEpiTo1J1F@(NpXm+Hjj}xVP)rES;^*4L_F0{ZL z^u9`$IEwxN12zbG!y3?y7{C6nt4d|QJPHGT0>g6^J`n>bX^Kl}tx}oCz+rf+pf)RT zEDf6=_>F`M1~?5$u93<#4OWshf=PzZBGH&+Au}PxUDRY5@ttf(G;#eZkN_MnsHg-A z9$Pdu9F8(K6cqiF`bu!c{RTu0K>h6?$yx_v>C@;zjEW7oYFXex3_*D4EI>k*dY2&} zvs@Vm5kb|sD(DC0y24?NS->+X0aTnH@*pN@f^*oB{-*JLGz?ZHr6dT{SU?wwQ3d*_ zI^?$alQC3MEhs9J@OAx5VGf6MMS0iGV?0-hY{|qRZq#>K3Ye-8npl@gHbamGB*sa& z5H=GKhmHgTP*pi4j^P^#*dOjpFy=g@Nac%gQVbDSAO=8<1<*`!pi+^mpk(AE=+dCV zNeKir901P@4P8Ys8#2KkG;_Ek9FNw>K;s19X2zhi!3A{;Em_kz3CK|a<&#(j3}fEw zV}yz*X?`$7W^}RQNNl7kBOox{{b_+ z7L7$RUDMrbsS|{fCSbU9q`)A2U^LJ%2`_B>kh@!?b)Fr9nrcR6VtJ-BMxwnClMNDf zXc}Cpa>PoJ{9u45QI&~Y(xtCk=e_vmFc92enP+q4C1AFhFPm8xIIBlRb}jq>lfNNC zpz_T+3YcStx$5*y%%=A0GazPAlYHoNzI+y62tz0#y*#?uSQ1s~rSqtAW`9sZ$sglg z!seTU(kvyicrDW%lP!qwhV0LOAyow_Ic$P<{#szA|-`Eu6t4a zj8kzLNg9xV%w9Ack$#iSV`#REK$Ge;3Zyt5%p%L8!3G~Dsv*5w`jJQCDn(tOTNa^4QEkSgW0iEp|bx z(<*BToTNQr2<7k^%z;8^Q6L!G(+S+DptJMA4tRU;??%^q_<%~?KNy<|zwq?fIiR?H1*aru+>l08@h zmF*B5${JfAbj_W&HkL7}qkfUoz|Je{qc`cS){X+s+yj6Q3B-gbTeIH`T^HFO^snUr zA+?3pdT~IKB_GMsH=H*_@1~){*rvcqY?>WW+E8n)y>Mp?%Oqa#jgzsmDasBSGSId4R+sGGwT+KmamsC1N(TLLi$WfDBKB(*j|r0##;O z?f?jqs&S%df^?GwAR~>F_>!!OC>sm6q}>w>XjJ5gi7FVA0yxG|(BfXA^XeQFkX1v) zRyrYwJqf0DfsLiog@i0~aV$l{6mk|Flt~%EzA{@VVlZ`>r5n@me2u=Kt6N}C2U?5MY%==T8(U2y|DJjHeEr&jntfk z;{c(ntC#vz2HXI|4T^|dj=tAxpeXA9cjDMCrf-Md3n2-o^$RLBO_HpdEMAeLQC3As zU+dY4y+>gnN;Onb6cEk!al&P=ULhz!h0~DZla%fhf`F^jRNGcadmyaK06UrKlzQaU zmT4yxkU3Fb0d(^+P8X^Ol?{dw>~}-H7zx=a>;r5{5Vj#;`vCUb5EFqPWEF_fu;t5) zg2muXM$W2zRIKf0qFAWNsyc*{O=Sk5U0^jZ&~6?*i61?QC+ptPlX$Z0f8iu<;bCca z)zHrD#zjk~)84>fh^&!71*BPXz?%&e)H$VbhOP( zj%AjON4Wwmm6b-TH5rRkGhPF|pQ(}v0sVKBYV3)L86)cl<&c8qSUYVG0%NAFb8H@J zoFJ;EEUic`znO`8kcD1`)gll7=dD{t2Ap@xl$ls+34XRl;u{YzJFJqqT}y(X3$VT99LG z<3REkVj9*kRE?a~!$Qb_bfuxnDD+0**-yhbq?prUs=dfc00lHOpo`m>`@^AeqSi7# zn;5T&j*u!U>tm5uR$0ZI#0zL8V0~oumE)%*@JDjY#Sl}Ol|3hYXVtfml6O6f$9@WgG6m~8Benyjm3>GFRCZL>MEd!e;`}2vCutH#6}(o znqv`_d4H0H?wu-%c9MA#$*b9x3oCAc^(xUjT15l*4bIF}bApJn&;&^pc(2{(EL+gi ztDbdm;8AP97qd!WZIuV7k+E|6Sexd( z45{sH_UZ~C%?b-3y($af&zk3FzZ#&R0jQ(K4#HJY@XbnMVWioqIHQ*RAQ(jMpqK_N zWmkxL=~=t7RqoA=a1s}SK7*{!OfYps@V8!`82~Nka&&+E@9vK>S}G`Ehu}jV`{WwA z>2-IAt+$Y@(5I3)BX zUYd-u0wYljr-Sykj~*k458C7t%w+!({KV7axK0dP;Ue3Dr7x25tz0D(!MGSy;y|u8 z5Yrh=5(w{DR~&JkBZ=%_(FMI~{YXtO9v@X8E{T}d;Wm+oy@D+o3g#7M45QV$ffEaC z_72t%4E-t?QpB#>*XImaK;}JJCp;+fX!r~oh!q$q28L%BRKYmA#Q=~b9fBuM$>QuZ z8wREalJ0fi?N@q7QYMT;>y--c5YG()EMr5HvtAg7gG>o3GolZhd<4#Cz?ido41+Q4 zwt^8=Fz!ps2r2Wc9?B3;_i*f7gSIp0a+oVo5mI(jl|8P zu4prI%B%ULZu`iD%ZhCV8?32Dyp&5?Xx$6bLB2K=ZD^zrBE(ltgCT~XT>BM)N(hw@ z4KQIOnwLizg|9T%bvnkF^o&YwD2eu`>7w~FnW2y(GzcZd9+{(S8gp7#bHfeBT1SM7 z>Re}nu3VrEbhU?rs-UQTPykdx3W?B4gSvn$pJOJgw@5z-jf)A@oCtC5J0}^ypmMN| z{>jcQFcP?~5*TLSj4Bw<$Vuc&%oH<9qzto2w2cQDIvk3B%Rs*|*0={Gt2a>v_NLk% z&T~_J(-nwMuTbQ$>)pFwIFUjUG)1OyD!0%v11m_Cg*pyPCX)4ZYNGN?Yze!b7y_p6 z1|CGOB#>38a62vWWve2|P$Gq1LdsDdj$G1m5cFk3NVHHCBD#i7iiAnB1_UV}#(3;A zMdY#P^zaO6S_{~Gm9AWx(P20fS*-`jY6qay0VBFKz*b4XQ|}r11&eCnL$l-X0K>Oj z9|@)`(_qIM4cHG&eT7N|g2FH-Nl>)Z7{(U6lx^lTjSGZvxCaMxP9Q=pQw3oec}oLf zK{Bd8N=BtVR*X5K{n%$%j7j?Rnjk8D3xUQdA*ktefE0^V zLdUY54GW*;8I>~AfTgtcB7ICr0Lmyu6f=NQn1Zqrph1ij1ruYU=`%l^$i|qYsg9BF zY$XXbvLL???oCM{VD#jg`(~+D6ci}3+@pvP!30dQDyRb!xNkV{5m}^`&^_!VF zrF^a-d5yAga6Al$R2?Ohxspou|?Q@?KvNkskW`UsDaJNQ%4; zco>C}OT{W#0)5SOiU*|LV^1Ke{&*DPObV7|lNgp5xv(tqDuClPg>(FPK#oLoMb@Af z1f1l|x|og*4W$h5e_>@n^$ggbsaj$B%~7!3W;~f zagg zHn{%bMm7(klC*4yION#`iw3z#lq`#-BDFOmg$0A`St3nou{QbvQdiD_yD8NIO;rR+ zOp;Ph8k1_qX`Bi*H*=g_KQrIaxrcR+ke@I-KMyz;mO-kk0$*>U=1DdxL0K^dh9c=W z^IsYigubnhu>u1w^?jLEKWWjhVI@Ughe>~jDuU>5`%p1>S`ng%FfL|2f}tYz#^4ZI z_3NeUE(!&pX)-Mm)G9WFsXDLOw^qNxVnFUPo?MdK3Ed2ZsmaP_P4s%A9fbnWbWZSs zT2&v^s`O2diRT51tzd$mIIg$290N6^gf=;+R0z>tpjc943N-O<58HdMS8s!uX9k7KwfB=#K}LRtACwCb zLF5z>m%K9Se$nTgP2#d*Gz7Wg^D;n|te_SJI0=Z5md+v^CXP=9E@!qQ#r8mho4=#H zC)FhrKW`DKR`XJ6k?E{*IhOP*EcSz8N%d~atVIg2S&pXS2 zgtLBKpTi$9V9xdg_mc@;QEBT`f>s8jDT5>uG%5UWg8f&}^c%7&Ae2r{0~}^1ftbiS z`Hisk*AI${OUsH23o43>dVzlA3xZX7_Ja!9G#5J@c#K2^0-0g7EeA7Uz)2=VAgZm; zNuWd$Gy}ldS@#QwvP43$b*jW#9TK!0tm)y8=s(-O;y@JTy6UQInf^?wh=~FbmX1V;Y%&{TMJTc_ zJU;+KY0iza#wG-Fhk}2mLx`2)~h+laEMJ6CpDy?`#L|U%VsNAyRf}+92{s>9TvBJZt2r@CKy$q&%jp+3L-@Hsi~|@?YossQxCPwQ9B-fTZ|`! z^0Acmpe1*3RaQ}qn^1SeI>Lo8_K89~B~eAF7DO0wG6aSNDP*Y=WvxC%Dze!P`GfU; znc2B138VcnWM~C~rbYhZdLMN3hBzz<0DL|lGAU(^)pcfG%myPM`M!*>b`>F@fts*v z0D+>uxz8xtsuQ z)H@fA{SWRr!_mGTJXcTys=&r@(W5qQD}j>o!txTkUnI@=X@&r5#{+UIzep-!ih9#9 zx@sWIMGInDxJXb@nL&01rOum{91M(wOS}<4&xKbEuq>Ij75*HhA<9sU2s zcO^)ICUBapc=8+A-ZD%mF;$Zzc!wb~rr?@wI|Lc?N`iF>nl;SP83>JeiKL%O+)5MM zkeC$_o`u-E7c)S&3C2e;O^K~2AWISqxWU4*P02WRwkM2}5-g>- ztCz+&5f9&xhA{Klho8N5w%2Gw&1o27*h^xnOSBg!k)CM^C#m|p+5IJ%#L1Znva~?d z(ZAQ=IWS^OvZ^b%ofUXG1{papPEBfHCm>qY>=rHZyfHu4_LrjHz#u_Ip*e1d>*!%Y zCBUahb1T&kokDaB$MZ@rEQ5nYlTsY@H(+4xpfF16#m>^=QG(`EQCNzosGvu;Jfz8W z?$j;Maq^FB-ic>R(h>D8)?1zN9$RdSA=dkZw5)O*UaRv`vdPinb72U)DK*&jw4<@H zfAQE@n%;&P6Z68ezJ$`f>oPf<>4E=t-ddjcn}vrtQf(Oi)*uIcVO*-F`gCEJ@;B=s zr)wy1+IaR2XAM;$X-&v4jFW_lhLn#PRM4k*5E?fe-Qr-8)WSq7Pbcn?eb=ViU#`<8 zu{!Of1b3YThV(7BdFtwTPw_@Sz@RE$Yn zb${r}s+YmnNBWU2n~x>~Ol0G5Nngc(mQ$P)lm9tvE0V#6?Ze3t9BCX47qQ?)rC#3+ z2TNk!!gnx|NWHAbIt6dhp~fqT$;T;%%k4l?cPIg;QmISA*Q{B}hl4ZMd#u4>NqG#&wUMZ=5yy6#+pf+GlXSLmeRKOtgiI6)43@@#4k(qqr4{w79!Nad!_;q`14g7mB;PySsa^5JE_Ddd_b+7xT>3 z%+;P}X75>hy^;&`|EZ=`sE^;MRgF@@jOD7Gz9$C;wA!YC6UNHK6-K*Cep_dJAyA}` ze$Q3&pNdy0g=geU`p434?w``tiG-ZeLRWR4rREZLKO}!w&zFH4_|<*7?naer*YKOu zrQ^e?rED!|q#C;Iq_^)EUtN(mmg~^?$u(4F?zB)fp#pqBH@c_v#t8@}`R_53M-V3> zMk}q`y{#R?L2)BTDiO4+1{j!;I$K=xj{nOerJ7Hu+fd||Fz~K&@S3|`Dm2=xz^!kR zR}H)T7RPx^!3M{hrXzK@iBTv6i1#rNRzLksh1r@!_xH zv;5Hs(+_1BlGB++LYaub;qHGkUKbbo17;8qOEP$lE}eEOTwNQ#IPj+pFR2FUA4H2a zftK>a%vY>9j6$xkwUyNjrnaSC>64H4#AUor&KdMCaWp?vh+Tu2G$ime@Y`D4I52Bz zYrbk~Lr`)`THgW23=CP^*(8_hXTHB((&~)(ZEyLm|0|b-HMQUg+P{C!{&6d)Wu*k6 zG72-b`G1s3DW!N>yu^s#_Sk$OU5Ufw@g3gwYl$3O1msiPeQTR^C1-vsdcr}~DduFc zCVjn~Ny8v26=q5i$v;lsgLk(oH9M4!K|{X`#mA8nutFsWW1x6;CPh*5$?DP4i95RF z7`14i&bh$~Br>SIzCP34Y|_(kr4+tJ>2H=Kc_LQq{+|+sYcKsFTO$REF&gq07NzIH z`1e9C&5oQTm1F_DgMRLm3PUam4gQ0Z-bEV`OjB}UpONy41vt{a7S-c9Z}!T3)09e4 zDPir;xcaoxC;XsRNECf=^3MmUyH!OqIOv3NfLSwv=iZ07C`fLSSWUyA1i$e9x zV9k$&E9aBUKmY?#?2iwOnbzKt+4TPMS2RixT?je*&9&mBym6&aBD?l(kTfd{J&QUuE;=`*#5S5gfxwD> zRmDPd-a^e+RQ1b83u5{;0#(_t^`eh{w6>}R@*%%7KPzfHNiF)`6sn=_Gi~zPD1Tws zYmK(Nj;u*0$}6z(E4nO5Z9E`F#=Br*bj&U+< zkr&97fgutf9kJ+PqDf?)l~|V5ax_GIL4uauzx}PM>eaX0m_4L}#OGophgYesk7I1jktDN}}H#yNIfV3B>vo)h#S&$gm_R zCR<$<)V#@+Egr`fEE`oFApDl`uEZgWA8){@xvRM8#%~erku>7h1oQ0N?$-F>82oB5d7Ptj{XD#v2Gqd^_ z9Wj@DlR^21qkas%PA92Fg5k>66V$>G;v%qkW=l%TUmpUx5zY@K!c%B2c)TVz%Z; zXW?L0*f&KU%fK(+u1pW4a|FXxWwh+2@pyP(a0Sjr^QCl}(UuINN6;IUcVi+(SH7Ku z@v%#(?u&0tnyqR0Y}S0cfFxVuoD>T3O$!y7Js_>>hUd%qHs$GCozn~*IPQq zP_ZV}fEtu5R0D|g$KF#+HNr{0RE1RwmI=!AVwKveOf$!EKaKxsO0_epAktXpK4e@U z{&82B*YdW{C&7l>6S`^R{+}uBWMov(^^L1S^vD<5Y7u36Q;#N@q`$&$F%L;rNiPtV zUBRWMoBuZf0VTPuFfm5bNirc--h$Cr^^8N6Tj_|-z<(f4m?b8=6FO=T4yI72xFk7$ z_hCM(t6bF+jHX;1c#|d`jWvwo@+s?bendfKH7PrNJYJ++&>SnN48G1b36QEG<7n*v z4ze!TFcwg$&FRC|v&0(C_pxF9mO>UMZvJ_KtTfzUYf2trostFh_#$_0ow6~{#LM|5 zUZ#>FR!x|!)bop6?6J`Q&9z8HOSgsWKWfO#PrqYJ^Qc@S)N{y!eK;^sk1|R$$21dY z-q81_sYD>Npk!FxwI@1ZzjOGqxq)382PH*A&eB5YNf~P^zGK85}p@p_K?ZONBK8gR)$sjk7U}1g` z`$#>}k;XIgRY<8;5H z^V8io>(?DI5@FNK3N|kd^vyFaSHa?mzFBzw%>W);Dd-ShG!gsBD zd;joND#5JdVnAxn)#7|*c#zLRyr!N?U5!$uh$Jy8M~&-Wcl1ypC>;Ot12X^bv-=*6 z&x&I2KSdjkS}m<*5)zG|Z)^H!OCFlJ{xmRWEtkq`URCW#*{V@L;QiTo8N!`KXr$gX zR8$@MQSd}3rEi7!@rx*pdb}j{8_mz(q7}wm$Jb>e&)SscO<5&VY69_c6UFgvW<9=c zY51dsqiQ~&UPc+$b1G>jNRp6qejwnbVIeC%T#NiqF6R4>YOm17j2%G(7*_groNEZr z!}Na}Z|JeV{blZ;j&pry^&arA<|DvME^PXS*f~+MB(Ri&m{949Z2t$S+U{_rL}c=( zfbu7~(=!+9)$bo!-yXs?wCPQ_NJ0C^nkom}e}u_CiE+5#tL1Ec?F;uuc1ZuOYo9eD z?QU(zQ=_%)Rbo~ZQPlG?==dr-Tn3P?!1+pKs8O!FtE3^EwpzW2EtH#P82sG150>Wb z6I8WgojK*!6J;?i)EFU0X30X^A#uu0!4+sw*A}eSXwW2|)L`)u#$`S9)!Ep zqE_2LVCubAaK8qrO2JSJsD$$unmNXu*p8QnYw@VBiNNRs4Dzg=FnMd zsPpH}rh&6eGJlT*In&iClh9p1nEQ#x8z?1crt@;f6R`dVs9bnqQwYPe|iSx zD8Ou>Es|che;U|6l`i}}yG$e*5l7}LF6?iOTjSyt`K?`sJv^E9#v)>$wj?*cnrH=0 zF63FG{~P7lvWhAyWmVsv@(Hc`XJ*WUM3U{|?`8m>&)mwV!wT*uP2Atz%W-}kJ^$WI zqJov1B)%6g=`c#Y*JjaJ6iuu|QVOO2mZ|jfNEg~)le5*dH0LE4UNYc9V$DWLJ??KS z+pqc_9U3{-aN%MDd3kq@SKdz+XK0yxT05qI>8;?ND&YC|-!JmxV97;1ec>3HmU#3L z24nr;7(-76M#tbrrrIwY>QFZ7VF{X#i?g*yA`tX6U|sPCn8yTo6&<`}mR`*Kmf?kY z@{zXCTC&lYszZ>lwC($*zhzb7zxB}AqRk734vtm7{v06wDM zHHXb2t3T$7);^&*bRoY)8DM;Uj5jb+0U>_f-%E@oe@Nb<@%eEeyx%J$!)*Buv|F7q z?}Kbr--Uu2x!U4vuGc-AG*7xToj_) zW&xQA)OUTOC(@jn7-uTn70^sYK|Up-4qZWRaLqJ}ku|Gwy*-r`Rq0Yc-WoMEoJO!#i*Z<)mL(%58egLcKZp&7Z8rYsw#v{jYS-xDnf% zQXfZCddZQ6K?F)WnBc*9b4mOE+~h;dDR${@=>JjMT)!{~p%pF%Yt=*`kN~}6juq}I zZvWLr3XV5+X0RC3kDr+J&$yI~tDUiEhNRK$hYo0AtJXwS3J?y@n7$Vozg#JeW?fLC z&59G&cb47wk)(Kh6Jhan<1R@w)v`rnQ1ZIXmpI9yAYH(+U~$Ve{mx=S7@QHE``_l4 zX#7^@AKuX}iN;aUqZs|hehQlgi>TFUB(K~*8jyXC%-xyS**wA>u8Pm+W{KX?L9VlB zmQzcX$`>XR6OI)I_PD04_CBjq>noHjszN6^_=AE7E zQ2ld(7CHJwzRIp)1_k%woTR>1-HRL%ti(eG5b| zO0-=b4y!vf^Hy@>aO0Mgji<65_{Rx`W>Nwc)ieh3~!btlH;T zo>Eto7dgD{FC*x7=$M^i)Uuf}5g1x#vRorkj?U39ro1<8E;u#T=|xwH$syf(gklvg zMNF#|f2Nz>xd!Zj;EC?{au~EBMPu*oPINl=zY|F3ot;Wm>=h?U9uQ0v%A{fF1!lb$ zz+@zAUw>z9!gL`9BGew>(q@>0$iB#(vSkuemSr&$v)pH5 zaq`nPz_^!a=ph+X#a7XPX0yn!?P7QwrFN!kVHcr%BWhNW??PnefRoL8h|A6?l(6jq_{u|3#oAEi*(%D zCE2lwDA$h`(}VH|+HhvpGlNi8DSA=)B-Wf;%#OK9>W34?RjPNh~WCNwWiONXe{p z&XU=LQcI5jJu0?MXvoNv#EGd!%AwF{#Uy>s^sds$4O4k_K1Vk@j|Zl0?2_hJj)Ke? zDh#s^xPFi_Q%8k4fOI zjoHt|&fZ$KY!jDmiI(|fo|1{q@7Pvjz;lar;bnGdKKjE)NB2H)G_Z zy+VP&rVw&i4)WR@F?KZMJG66o-4@^RTaAPAEeCo%ETXpr-W?Kxe>mkoCw&30wewGZ z0)hJLP7PL_44px`oKlUB6k=D~mFtr$HE>54@bKb{a6sR$Yn~h3R)*G5X<|e7J(%C< zmDmz=4+`dZd6~Nfu5|HP9@HTq_cv4A+K7(B6=f@M-Xo0j+v%r&2%NSp*Ws;mMW=tT z^I!S9El)L=K=|u}&h7q@8@YJ5%T(b%hB2Y2tLJGmwRxvNNovE(vNx#v-a+}(%K>ba z0nq}D*y1&&cmYic;wrs@LITiEfubJ&mYs4kb?y&f`SKx3eL-7)(|d)#t_gHN2Er6q za2;NXgq%hO7nLctuQnF-L|Yw?u4pc8g$>4&|rzv*>$nwJ^EE~5j)RK)zV#Do1WV_pXd%MA;A2jV0>$)fuXn0^*?J# zrcEgHhgYq``sW?5(?|Jeznj@{`;N1Q>&aDqzw;Is{?|75{{AVk=IXLgJ^tQKd@vkE zZg$I{Cs}xRo!e9Ky_U*?FqsIBJ1BB=d3YFN75LhaW(~wi{-?NcLfcJF^lDK2Q z{@Ru-i>Fx1{NMS`<~lT-7a#>_>~}J4xe)?|)9`(Rtddi}%kupZIq=h$p1p11!`Ys> zlB0ux)m@*Cg3Y#jD?2BBBSFwsV&hImi}^zd!A6{;mMC)%__&kG&&%ckNgbWyG&>Ly zRo5!6ad(YLI-L(OwFfE#@<2YTNUP}an{c^&VRCFI&y1=1q08(`$J%M-2VzvL<7 z@NiNXQ73%ZHQA_a2Zv`KZro%;tR0kh7ncco^?bBCvETvQ6NOYnY1nM!TYoGrhg!O! zvFw6%!-LaNdZ?YsVq$9O7&DBv_+2jsafjiqe2(=^@$B%2m*^4{u; z(1wxq+%>t_5y7vg)25Z*hdJqpU0-=Rr7I$e?4patV{d$3!$HKBY#Sa%)rTC{PrEAG zpr{4YMzA4b_nAE2fcvy(Ah-}MAMA5$+T*=mNnfipo$0w#|CG-0CbRk^Pj9XIp{Ux5 zLvQsW?xxPz>z=?ozarCE6}nHD{O}S6k%4ACRzA1D;KQdMy#j%)_|40k90si&z=-Ib z%8$DNaCp8K5g^6w`j?N>4cmr+$Ym({Y?cQsL?-&}ws?EM<%1N6f9;`GmfzpQ8P){H z;*0G*?&ksMHK}#K?r&@r0(n_J2|126NT(}ibDd;F?`WU=^d!i(&*a@lzX_>g#n43jxa8+70)6;#p_bp88{JIT5c-h^cBrk^RzIzs`8$Hu*nU zbJtHiz7Ey7-Zd}A&vlde=bbFoi$Se^o;|f@MzdO-Rq{7Rw+G6zsGLch-P}v?L##SG zm(?RuQA%N-tKhp+xcBIeDe+KC*Yp0%u#?xW$o00Y?c^^iW%zSLFI48H)5~sj1Nu^P zsnum;a(q;jYPgdHIauH&(1vyUUFHq$>a4JOZ>$`qH}6yicpM+VH{W@|4-2(`TV5y4 zoSx7I;96yQw>zZT6$}vDK1-FC^QArg z!Oy2S(_h`Dvdc$UTSeL8s=E-`Npoeoy-uB%>H5SR-8TE4&ySkRD7e$-EtLv49Bjz# zSTFAlvQ>p0W@9H;ch+ru(rs_3lr5X=w(lPaPOf$RcK7J>wYnQ!H?exRFodQnZMQ*L zRo3=)*J2=e9aMDP{&nRanfT$P@AOGY_jx2N{wbz1`thVOerd}afmZh=9<1L^ z=YJ(ZgXoR77ibYI=g{SX-bb{i8|+js=DEl@%v+kSTY(YJuXXY7Va^-nJSYzgyF2EP z$3|!`XeJKOD&)K(tNxBb#HFs~uy9AQwPiOKW;-g8%jsWzcY$UemM6SR28%z<{v;$o zyWnupZwwB=Tldo%DRqE?nf)p!nTxZHJFjPC?y{9Qz_6YoPo?bVWO84v8L}UaCMpX+r1?TsPzAGk}G1P5@UfS@x4blO!jaLp9;^U0x;N<{d$IVDhrxQdW zyY1yN$IGwAY3roM4mjcMRDc@c7U-u}ALV5^iUr(R>hKl|ftoXTK z=MsCYYcM?8@k6pkI^9l`Y+fzfZ=IoDWnzyyu}i)~QBKAP-qykJ3r1t_>z;+|K&pB3 z^A$>dqXy{m>oVX{UlcgSUDs+eZ&%=-=!_V<7N3S-+IQ`-!d1#WCpXwOcg#=vv36by zj~5XBpvyil@eJYX!2#top#MSk6LF6L=mCBMh8P7r^{ce*a=@Q8E5X9kCgZnA)jTh| z;B)XSW$#(eT2yE1Olwn5*W+@)K<|z{*dkw=905;!I=gFy&AFM3Zg0cqFS4#yd$8ko zNH=&j#STIGp)lwMkc@wSKj0L2sk7X66i)7FGO+$ZX?l0x!4$K zvrzF$Z77%=6y+!eiEHf*u+uus%DM4%P&XjUL<=D+%HdN2~neWEniy;+!X7 zGV!}|ihPG2(CBPl)~#!={GV<{^NFhn98kwCIMV^AOXNHorE#YRzS@$_vH2vO4*<5m z#3}Alb~G)5(PzVE6<$vDhu5i;m~8Z311?W?M^0;nGN96pX z_;FA7C1;-K(H>B|s}*q!O7@%Xxm`8(y549!gYn8S(DOsN(VF@7NZ|BF zbMGj^bGI5-YgYWnZ@_K+04N83V&f*y2Nbl^f)*il?{xUcOlMLJuHRkC){!F4IeF?3 z7oZ!2o>iO==1SCjEBeVySUq`aHFCq#eysUKeJ z=!1yftqXXLY;nljdAUkyEf0|pzj<$;y(4%SBTp4rJl;o%0u^s69?v*Yp5DA$j3aH$ z1D%|E#T$qmF7Yy6XS}GEPkC(P^0qt8YiF;-=RM5f8k&h#6Ez_U)eD78bcYiX2eRvO z#qEni^=>7*A^sBC%`AwIZWvwq+HAZ~<8w61|=McBeUy~D- zQQGb`FEB+hk*aUdr&ZjJD^OrzJ3VfIJNU{D$KBU0@%1Kyrq~a-JJavxjskri!6LQ@CM4EdaJrm$J=(c<*%yteN_OlYNFTj}6 z6F3HSD*2bVM39cM``)}d6kL}t8h>~I7`2)8GhRMj=XFD_^bzntV6bvty}Oj^VJ440 zY(cu{4thH<`rW5#h}CZU5o|`0QwOm`%>OHAQ)uUQ z+XvmzuKTb|XL2iv)DP;V-%@P97728O>__NaA~?9JFqr=c~%fcqMh|aip4Cv|VniPId1)3mw3jKzD=t@hG3mrSpk}9?sf} zMz-?G-k%XGTT7FA+pfE4xLYfMhr|zlP1e2VCte-mPir1%@qjGh0O@#dQz&RKU;Jqo zcMI}@U0Vn3(py{ehCR!oFN;Ag{@8dS48AE^?3D%JL!wx9&EDyu@>48Kg{ky zyjmYUU>W(IgXRsRS2;U)^-1sYr4?7|fB`oX0C>Q0SBw)Yl>O6#U8A(L^I)d=Jy^8W z7VHEAoD80Vm>v}My1Y)(3xL?h3c6ip&o>R|l=`W63z7)&m;5KKNqPRM?bbGE+r+6h z7*;D?-BLcrSXW`#e)Vvb=%(+v_0VtWyeT|v$QZg|15c`Q<{2!@k#QX~{)rFN^!A0PY2)tP zO(n&}YI9t!JrA<%g7#Ark<`m_d|z7nc{n@vVqGAIBVu=1XzF&b~L82sT? zuy)kbZrL2ctge^;D*xcQJfLq}<9l^b4i8+uCk}ya1QxZ-^d2;pb36w=Okal8ZbwjU zb|*F+M;-SU%KvFIUz0y}$b)?MH`5w-piu5@u>p>_l^Za|^;)j)vJ{na8U-jsP%0b! z+pUkAVuZ?Vr~M%tr@c4e$I~TM-cfc+>vc7p|8?gjFDzA^YO}%Rd6Ti$?!Nz^Z)BTa z%xLZ4m(`0?uFK6H|66u|)9E7XWJ|8`(%mnY-PX>Um*lUDJS_(93z2oNT&%v3HiP2_ zd@o)EWCqJA$Mxc}v^O6zLB3jdkS!R9<)pq5mr93_sCi-T9D~?|mB5*b#37u`!(qRlk9h_}+Q_ z)OX5lcez`3y6W&YS+}`1f>u1j7jJUA?|upI1RU94XC8VB_E_7pmhQzoti*J5KTWKz z253H9KV3wT`(9_L-5usl^NR_)KDGQ^WJsMdc!DlZkF@&Q?K??Z%^JAxzr5Pu_TH*Z z))52L;XddzBA`6k{kS}69m&HOW_E<4KcuCalk#uXxl?0=XU}nar+k3Cb4fv{Q)#H5w8h!Ms&|M^# z^U8Jkp_Oh|mg}1T#pznQR@mOr|K(z*e0Ilc+#^w+va7lr0I}lSx`l8++6ex;@uuy1 z%_CN(;N3fXK;L;C5T4dD*yPX=?iy!=_2&7#ptG)w!w?>?k*=o6hWmWSdV#$&@|IVx zmMf#^8#kF?6?dPL>RE)9!SVF9cWt5 zfLDRA)kUvX#}>eG&IqL7(gu!wKjf8ez+(tI%ht}va<^T$I?CGwzMQq$&1USj+cZ+x z*&?1`sSe`TzEdSsfrdq57y!h1Ns=rA<`Q93rx=L1;HBa)-tchRwA1eeZKSrQz3+mS z@N-5X{O^~_A{YX)i9sG0u-Qg%U@0Y&aCxy#4O@@>YK`oMRqQt8HZ6LjkFh)+e$+js zP1Pw_f4yFIdX?vW+_YIfb80lX(ejkm?B`hbsC<on zN7KB@jPG{_W|aVS+u@XojR5`m%K6dxEt5@lpa-*FqlS(!=)|cfYsGx><-kRG7dA2d zkaxEE;VH-K_z;#S7O0f1zhdM%DuOVqtM#o?9P!ZaoEp=C4Dt*_eNWf!={=7bKZT2W zPi)Q_3m4v(j_Or_IN;2}QdVL%*NNRz|xGesjrSej~bF4Zm?ab$?QEK+{1+U8{)S zR5NU*-5E?Qy}BK+=KA6lpQE-?F&#gOxU3>RZ54!si4q%=iIh&qCli7Hz^ok3 zj{r@t?tzY~bHK5D;HYDo6VSRBo zyZJau*6X^v)8BVSol{}jyYj({^R@ON$)}U37co-tijR&H=a>^Vk0v5yS2fp$HW;9Y|)FXDdcl)Z#y2O4$ z9GHbxJT5-GCrLW;10Pi7H-Xc zJr55sK3x^_oaj$XJX{f*e~f4r*NS`bcX{mKY`FsX!}l&{<|JpIsjfC2!_jZrt%tUf zWrv{fmh)t-fp1tFHM(7Pycq#X*<$5x_0wRitP~0_b!eJ?9A}M=5HIv<@hP}7s|)(n z$hZn3*yt>=dt8+d0yfMDC@i|Bz4+u+N;*ZrW!nL#=@xl%?^6j z2Ap2lUseg1oF-AWVjC}1j1PGP2n{us=ei&YZyLq+%bjYy4-Yp+t=_KM zM;?i9v%t^1=2wYY*8>g_s`v5pi2<_*;yal-1e;lr4x23wn@S8>Yb_4s1jXi?o(%B1 zOfVDDXE2}Lf>zhhL`L=}US_XT$C6z^ zrr?ED0g&K#U>T>zo+8Wf+OBBP&=hN*ebVp3?mrGmb13Q!blF8oiu4-vigW%z5=9fA zw;H`p!wM40Ba%TS1ejcj_jkBOABf4{B%};c4n$qxKnSRTPxcZeH5u`ZM5K=;bEo}dlZb(xWjVG`n4--kp}H&%&M~jaKHy zxP|z_I0K1#gkWC05M!uk$M{NguT{ngNo=iUfG`M7H~^skeg)&SrAo;Y#Y5#F3!xgY zG|6DA@FH)-d&}`MJGC1gvILl-aSD3RGR7RgzV^gVm>>MBCzf97Sy<)G*UT{5E<1U4 zI?&TLS{q<$QKy(i<3|s(^l_S>{%)FlYrsSgxstJ6=hb=-u%o2}CI4xJ`;l_LLzxhh z^EGx5mFRb{*Gl5RH?qHt&3z5rOUKf+MBmiyQ9lb*c^(|7q-GvW_&GCJ*Rh7Z)iC$Z zvz*B-*5>QL4du?vK5^gQV;CIraHAA*1F#YBafW=Yr)5(B02`q@NSQ}!pTsBi6WF(^e; zgi{G@I)Gp7FNt!L89D#PVI39VETevpQP)$!X=oSo1@!msF=!Mn*I%41+nv z9+^MfCa7+)AH8twulW6Ewrf`Xr@SLd5>J_J&e0VC1NE)d3d4V;y0ypBu!#uz&mx4k z%$Y*eLeh8r{u1ArI8Uz?o|y>lua50yWMt|zMNC)^~|bL)Q^?5CdE`;I3iBWb=u z!KY@fx$u%#{<#jt@amw%k)5+JEn;LuPS1Ao!1Md0tchMgQ3`H#cIo4|rM7|>tx@+` z*1>^$(-gN+gqiTR4<=e>M3%@x&U11aPn)T=lt|hz;|-+Wv+LKh=ev^uAu1U-#S`;E4yrjA-~V?YSi@;AivmS<`b| zm8*hLzGM9C^9(rVT;n#EtWqb7{8rP~ohg`I-re_PU1+3|GhDC7_T5n+O;d}+n_SRV zJ}GJ_RzZ{q?2R<#0NUKsid6`n-exAv^V3RDz?f?2vvNvkYbFhO3LuJBV2h8&+A5+` z=UKeP?&_7q-u>Sg?VO(D`Szvd7XZ5-DH6_QEN5zoG_i*?c8?MEr~*JeqQ?4n9&dxf zRV;i$g9K?}i0}}A6P5~z6YYk~LY9O>LyTO|Q}3>wL;D`*d&;E%F^q&C*ueZZGXYUt z0x&d0Fdp6^=6UbH+l;x$LF}%+OHhQiNDLAQWp%C=aMJ+QplnepNx(!ze75y(u;FKFV(55e#c2cjnqT z|Io4?Z=T0c3~Ovb5$}Ks<1_UW{{Hs%I?u*4S87IAY$J@EPtJ-s;6q6M&+U}2ZazCU z(^VhBN?nlUj->6@UuR?{=LUJA8yt-A==&k>%DIGMNi*0x2Lw7^$-nrVP5(Gl{CM?H zQfOKxD*raM@fxk-IS{8M|%ICv9r-viyb!7V^47Mk9-mlPJGG4Fntx1BY|W`k~#EINo8fT zFU(XAwq@7kKd0(cANd*yHf-st&KE{fNWP5b{j!wQs)i3+dxZ6opr5Pp)eW}e%rVI?DgJIIyrqV+#Kh}CcnpLUQ3mPk`vQd1 z>3Xw+!*N?UnSInA-jMO}@akpID*eYTk}r2Bm#QVUC)*>HC1H>nVu4>Ls+%OCNhMF^ z{$VJ|L&Kr`S6{&sY0>q|WZHkG=q*9sl1Kb4#ySk+w0#O*{9lqWm@e^J{?kGbuA|~( zmTs;}re$<#x3!Gb9FM=zX391@{&vh=t*__F{Z6SbVVho08&$kVISMQMH2d;ksbQX2 z@goBR9;#~M+x~7Nv^i9H5iJ7r@S+{2627Qy(P>H<@9paTx+~i&4Q0b{A5w!88CL>k zvA(30g^=n%qm6}f$5y$*K$l`0-%Zua`O^wMmRFRk^3zFCgObWH2c(QMF47mTihl!zVQ z31OP#_2pIjiu_F(j)4oNKa&`5OZB-0IvuEf1XvnV3@lVdd%qB0uV+sZUmR4;sf-Xs z6jD!j{OuDlPf60Q1+j1XMvVlXqhr0@6|!vR4(AJ| zvQ%3p_)Y81E*avjg}K~z3xWsP#Y%_NGa{Grp47QOK4ttJfL23*7lVxxH{#W}+dQu? zUGy`4ipXP!W%9R&Wp#$p_SAWrgQ^*T_f&7-A<4)=3>=>j%WRN^)1aa1J@F8#a|47H zRq5=%m&2%H7ozy(w#E#_o&AK}$Lt9H)2|R726L*4KP;O>d;=Bw@tKE#^Or}vEn~c{ zS{3rnt$NJ2@7d%p70<1G9B{UEsES*OqNFC4nGD>-JcS&UayEl67!e91#*?MdM&#A4wJndXi!Tu6U# zTE!}gi2hs6gf+X0#d4sJ;)Ti!MpK@g{rf>)`RT%@er2at4XsUtU6z?-ntL^J!OG=e zS1#&5{7T{{AXAy6?;5(^r^UL}-iJAg@JFWdu4z)uHGU6r`TGixyRVpK>T>>Lu3Sq# z@p*8i+>CXK4|!JUcdEq}&wwcA8cak~m2`4jR1oy;(sY1q*8xb#Vi36a6fOaW1 zkDh;0(5VkE#m{8QUndyhG>ieP8t#lJzrzQI&8(Vs5poQG29BYsDN+`nCiL%F7s#I# zkEg`|hnyXD(l2(uaqH7fLpQ`y-Zp!MRHW_2QdqsPe&>htBWcRthK$pGR+K<~Sw{rC z=0v_qd*QV=ewxV9HikFEnxP{4y!TrO@p{%)c~IarpCNb<6T}hUjk-wCIZ@EgWk(8- za{~PhjSO%X9W~}?ObZLKYB7aZK5_6vp zNPziD+6RKs#~S&Ur+5D$Za@EPnp`kHW<+H&uPkX=|l1w3wP4qF14zVts9;!UES1Xg@5q%=Lp_;$(SbK_3^l41jC@t#=E zWV*ikZBuKj@|Os(h^?E5*=StwuVWe4evV;H`ddCHMRWGkrN5xJaHg=D`sH1q@8N@k z8$b%3_5gH&Z;mzhb^dPgYibA`l5ZX_{`LvA2{g;oS;pgxqiODnsA)~tnfM{2!seI0 zqhY@rZ1g_S=-5oUiZyyN^-NB5H=l%kZ}$lJq=l;f&KLm=Tdf7^I`hBXFY zK-1a8d#u3iWjmFsVoOSIhJyLTkjpQ>rP>=P^e6YKL!&L-{WNZ&auI63cyKfYDFXWn zkc-V|t8|xH<&)O#5B7D0uThkc?rLq&wux{Y`5VRHLIb)KF9Sq&j}*?e0EpwpcuiiI zc`!4IxElJm<%`M1;khb2!bS{pQCg@Le!p#Ux<1nIg+iUFUr*d7MvGwzOMJR9alOF+ zejriNDDw%0_lBnp0TuG3E@9fa4zVX;WtL3zi6F6kiaPJls$8P^p?YmtbT+deemPZ$ z>mEHQ31AK>>q=`q>T`GX`PCpEdZ9^u@GIgzGy0xiEmXCNMq<1xzjIQ!=N?5AE8g_3 zZ-4@d%rDC4DeY=K+|zGUO-VN3uYjD%GSXB%-X9(N5DOyTih3r~>S@Bo3Ur`oRJ;2P z1?NG`zNXV(*^|tRq}?KmGB%)7U~F@%WqYwU{2l!*6}Dbd!I^&hqU@_ud> zcOsX(50!1e{7?O(Tu}+qQ*Q@mo|WVFJ;WpyBSe`ERZKRlN3|a=96H7mb9?mln6+(^8T8iri zq-H5g+(P7VgLv?;=NJBJlJR} zzj{V-_gCfevo!0&xgsk@-noxNQAOKUe2X9PrL4Arod(V=XlsTkxn7RILXqDtpViKV{M_TTWwuDD$ zc!-+rmoiLep4a01!z?~m6?#uAhV}6cMpIJiPM6&T{GFs*3v@BAHR#U%5Cf!A2B(7zI=OkgRHMORa~?xndFk!JXjI|I+`#1K?8NC?<^_{ z4;YAFAfdG{8OeCVWH`a?9#Ix=^IWc`hZxj)sQPWl^dZr1HxZ|pM5p$IxNyWXP}^Bl zl|Sr17K}y(GAUf%!==;_`%MDadBRW8Ulf!l(OL~}8|Yf%M%|4 z-W-o6pOI2}BQ8}+4k4SXhjdA2_AXE)|%Mkh6x>NX+QhP{etojmc zBU%4OkpduDV>Cd1%Zjy?0W|OsIb8mTr<`(M1oo{LC}#MEB+4MlQzF!ynO4K&YOfA+ z3ABnjq3%<3R3%gw0poprXU!{%-UygLvjHKSC>+F#{HwXVVMSmwk|YBLA{lN0;RKpi zDn2as^7#A-y;nkid%0c_iURYfaH@eH%w+!Ra0CXU<|ti)l9T$zcjc$v^0v;mbyFU= zgGqUG>ZU={rMwg#EjxL8-&usJ7ArTXBR+ECe8|WVDY`mL>7RVsF42&?n|F=K6nA0G z2wfB*ZB*w;iJE*4mHT=#wD21|hKhN#`DCSDulpe}I()j$*S)iIv)T#$M)WwyE^1`F z*bsLKT;{+QhR#iyPh4SGR@AE4EJd)hw3w?WK!_^Ld8pR3r2L_ZK=kLJXl(`;VfF`=i*Ksv$Bs0 zPhraE?+Sv={lyh$iE@__6FgoMit2PqOV%Mbi=8T`$4SeaACJX`9ZxTJI@L~IzYt`2 z{A}?S3=C*r`n-~yeP6n@i^4CkZ3x-M9%i4*f=VrU@4x=n=6q{j{*5M(!P?PY!|*`o zjea?C*3z34JhBg8JLqJPusOZz^t-1>Imyiu1J+98mh|4o-qBeu;AE6Dj%~4DNiy*y z{|w2PM7y;2L?N?RCW%1~UZV8K1={QAO3C z_R*%Co=AjFz^Dhvlu2;&S<+WdDv~B1~$J6HFvM5MT zsONeNxyc+OXxGvES7>ylc!V^~P?=>QNmxA-!s{8>n_VYdneYb1&cc4T?g(Dj|6T)N zoL}U`?O=^cU)FeFOfD+j_kT0t^l||0)fr!=<5PLunVVJ#rl=k7%{jAp z1w-BI5RC&aN*$8(0@pmLK-pF8gC^9N$xa-qpiV8AOsXVA9i8kp&_jW!-oIt6 z4y!rsK^pw7X?jGkmQ1O|T2fDmCYx*u$f`G;Q}gP@A0pkbqv1v+jkeQd&M|lMCu;fk zvkv`N``usv7yF-ZO+;QFUynpYr)CQ1?!?|hBFx4n6FSUzR4+SJjPvg5(^!pRg;<5)4D4E zQ1kI_^YFvs^DTxkH7YwgS<#A0ym7z9^Jo=*IP19l$lW|4q_q%EGKZ&DCPNFQ;B4Lo z)OyE2W_8@(7Uc6oZH-dj)AF#ZhhPV%%kh|=>;)lx4KHf9&}oo8Beqk%Ae*Xx%-gyb z#reADgY%F#Ew?B7^TCgM`O^%}EB4owQ?^S{+sf7gI(9~SZw8hCX}S}Jw2=u~Gn=PR zB*GDU!afuht$yl7p+R$j*RFhpx|q^^<))A(&(YnKtj*Q0HL@G9rrI)I&9dks(ntAY zqhRuch;1N5l)<+%7&9SB+v)ukaMmj@8mHcuXIz~iRU()=vEhdz?*UP0WXYOVVzWhc z33uB>UTst?vUN5bV4o-c=3@uTtkm_?c5uJ*aH)IS5QGJ=ioBo5{mDZ{fXiOQJSbQ86l$+cwm z(Uob&SD1G^#w#{H;v_YYJ#H6{J|9b_V?tQRV!&u_B3jo0R!kJcn2X6dM3SErdBhZV zN!hj)`bWx9lya+$a?dmg%w(&~RW6}dV^|El4PY71_8{LYCU8DiA}gQuNi-Y!*%i=< zR2I*hkfJ`l9$u1I6)XF$%6IKF`-POaEqS?wR=nph{XMUmr4K2zqt~b=!*t z36E>EV>|M=OsTNV8tOTHvtkk5lLjW|#&rq-VahcxL3y$!+dQ<0lI<>t@R;l%A#I{& zd{Q;gl}xaVm$BOsR;Yg)wq>a3FR}%{^Xkk}yTn}S>$~M+9i~R0r6rz++-R}Z5!Es6 z(S~nc1l5;5A*>nN8Ag!!vi?pcVzEK`j)vhbux{u3v_q(2n71!Mta#^#vhJubc7lDh zveDz<>FN1WLf13@>GM`XC%5*={vi9HH$bC{*>^ z`OOpGOU+y-_0Em0o3`g>?>egZx^k%yvnBmN8EjI28c3G0A5n9`wON~X=o_61- zRn+P?0rn1OR#P&>gN$Y=WCfb8ea0FX%^onCcR4Q~R-w*VG2TM=&ylS_oy*N!PqSV9 zn#OO1j@-0}D~~cNC(MM8<%)$ZKdMcn)Tm$yy^awsai$(1|&-8$OIPvz$Gm(XmVtgH;Y`iKw z^xVLm9Il!Wmg}aMD*=Lv`__0f!!W{%%Er4isL5j$ zQ7zpZVLf!FDooxW3@iGnvR7^6vqt3uT4Epv$0avfcf)Bd)czLG!L8>v4hu1jS z&IJbi)Jl9ac_zDt$Z1)}%B?MzuMhO!Q;Sf>K|1c(aYM~5z813G&L5a>lpswp`cfg8 zcuvX4qe>WhGsAD<8`bgr4ADXjhQjHT$DM2&K@yc}S9kR!w!0aHfv8$l81P)y9dar- zeH=XIN^oGPk$Nm)l~%pJ=f|c^P5#C}v?EO!KyfynhmG)+Av^v~K(IN?L-i-dyCF|7 zD?|Q7*nJ@cx_9r@UW_r?FC9wpm&*A&9~HmfhJEhuXGd4!iseAw%{3Jo8p;Nd`U#&A zQmqa?^ZJ9|I>ZUYhC0E>RFpcujCtguf=Vq0W20Nr>MB#>sd-qlEz9BbWRo+c0&8`k z?uO6~MA3<-M%*23sy#yYSZLylRimnq6vG{9RhW)Q$jhA5Flo8XGxs%(NEC@Q4qu#F zf@zZ_@kuzzlo~{!@Gk~tV&hTr;YdoIcC@&rI2|2nI%f>X&O~Q8%bc}4{8^tAuL7eE zOi_}gW1-L>ZaNb~vVQmwLC%C3F;y!Y)H}bg4Q=GtxO!F5wjSMz^Z)7py=HH@^pG82J z>P*8QKFZ1q?}IS;pNrOWyt{fcFQH?q*v8~5Ih(Ums6fu*))&g~n_;LBzpmaG7 z8`I|2(3U53yU7-!DH6~wWZRGq$P~W=MD=C#14F`Y;|k8^h!?F32qR0Iy0c8}7bQ7G zF*jnHSV{xwE*HXiAc_c8r77GxBnli^)e*Z9d_cz!;TA4#&Sj{%#QMY)s04j#)T+wM zHXSKx0opz36{)B49VU#@wK_sIRp9jtQws6eeX9(Ml3U$ycX(WFb=E(r>~}L?Ic~jzf(Y z8}1BKITHAd{JWum{LVPnYA$&(G2`k(zPGl?{%gk$TR0a;9L5(TQ47>OJ8S88l9_<@ zA8IoJ{E%Pppqz7c0eDc(gfjt%$NV3|LZVm!?oXVsi$Q1y(yzc5EVeGQhxa)ex+*u- z#$Bfal9=A?sjRZ{wS*% z!(XWzZ&D^@12WQ1_(>zd)ZxeM#Gx7d{adH82#U&d!Kh#E*e~8tImJ}VZVyeKcmpAU zrVJ-e^8$(}pxbhjt{pxz*U3Xh9XUJEDJMx{zLLKMqCE3I>`{{T&Hzh<%#sY7v)80oE@LfDB)- z-eSlM-yqxClfGiejBZHZGgh8K7JkTb5a(PZ03NwLe=aD;zYpP8_8Yr%E&}or6wxpr zFu}&GWSHp+OZCm4+Z;Cg(iysV`(y+U^DI;LH|ZWUekFpD_8xZJ&qeV}t?5^W7Ywug z<#n1F>wfo9oA=*=C84+Ggc!J&GxyUB>v;iO%m!}e$?nodj9kkw_ot%6k4fq1VnDd7 zPj^Ac3^yCz?I`RnosD8fHp+~Poe0%7c@_z}4kPR&+(ly6!Zpq{a3qutG>&wolLB_cCyTyJD9Du=kL|IZ{fP|U>fntac=5{upQ?Sg z2zMj7aSwGP7(}B;#;yz___6jP1$z`xgm@@RV4dHU6v!2ZGnx`&U^a?ObSi6LY-EKh zaPN!vC>@DcZL1BAR7hu|E3DQ6(Awx&oVj%g4C4%a)Xkm3Gb@7A9hq?Ot48|RK57(d z7Qc$=ujS0$Sc@2*=h^jkG|?$$g`RnGf3HLc*$|4F`;L4dOH17NGXv_PyJl}g}b*0U%T=wvEFKaLEN9WZQDv^6J(v743i#n_DB zkKGgKz>U0}`|wvvx6l#FUD)Rg58|HJ3a*2;O1=!2HFI&u2NCpWS#`CO4D!m*RWz>r zcK*RqWQEKzBF;^k6Y!a;ZVWKbS{7n4}2(ojw`c9JZBH4e|biFtGuk3*KPMSxj` z*aiI!*r?#D(VphHsy}(G+Sckj0&R-SQ_kIZQEeDgEJG1r>VLEI`Fd5bY8Tv4DT28? zrcV`Abq-mZ1n*x3*Ub3mS`F~eryGd%!8=d)cP$QHgAN;qc5ei&Cv2+pU@a$`p!SV% zixI=G4Y3`nO~Zy?1y`CwxK?1By4LGE2CVmF_=cPjemU3}+8GeEWPrwsh4qL-U=3U+ zb>O||r25pyDeuI$r}L`2;HyV`tw;>K`Ids#dijh8CJmH`Dw1F(|E;eyN9%kF=R6B} z%H7D>RK9{|5V>@(Vx1sWbcU=yt0OX+`oU;Mdq;^_cDUa>(#55=xXEP1CaTwFMnW-%wX2n zZy2hH+2U36qb~0Au2<3k>_|g^2M$&qVL+e-Kg46warCAilLRv(9xLw$!%U16qi6x+ zt^l2?u4x3iM#6-}=y+wQ{v~68kX&~$;`i~%J)>@8TW#@yKAl7ADMqa~LolNQ#V2N%%?69t0XW zK&%{s#?8@gVl^a%3i||~r;gqM1@cz7P9t+W`e;<;`;q{zp;+FxtnIi~pqMwu@_FF~ zF+age@l|#{?`zC&Fk!FtCD$-x&&xMa1aI~+rC}Rl`)FbJZ5Zp31cG6-H z6e{RkChDi!47FpCvq`S?=%`?^sTaquSMhRC$?D+x;T`~L20ni>h-6H4L;dgvfVv?L zAbA&Pb8)D=GHZtJE=ey83z=n>_$ zF~Ph1E~{kC?XO>@0%69b*Q8vP_#OC*k1xT$ta16~N^S!#+=nb8A{5(h&5)A5K+^m6 zKY((L&u9tTgINp@U@8gQgOwz6$qUaY3EP`5AbOA3$)l#;d%$RjBu!`%Y}T)-gZ z@j%K+f=L2Sq4r3EPoe%^x`ULH@Vf+~2mGV#4JwTWB!T6{6DlLaeW^|AQ@#B1&wRxN z|1);}9pRcCF?v-uxAx>EY9Vv~+}j990;BSm43w8Zq=bG1QAR$mB3&Lu$EE(x&N`Bu z8%h41JrIbFeV>AYOX>smq#89CmL5oA&b0thUB(H>M2_q;YfWR*!P-+YWDA)T-qRWqdq150f`|02>iJm>27e9o~PX=3R z%mDXach?S50;J%m8EOZ6kwK-baeI;PxW6VZqyKrp%k+Ox6w45$6i_VSdBysm2o=TK zBLohj!D9>qu*BJptR+8FOo@h)77V<;Zm7anI}v0t}S}m zv9X|=hK7q}i9MQ!+o~EQAYM*QJa$H3m2qJFS`tkX4orzq=Sr<7%fjkfT>P1t-%`U) zVwXYN%#Mc~_5#MH=^)bLEJC<|+>o4DnU;Cr2}<4~#v(F(9&wzok+%NPAfwJ9FJiN+ zGYjp>qO9nUs345js^(kcW@go8sr)6wLCs03tB_}nu!wPoirAB`PiF$DV5M%sJ%LQZ z7O}^MOlt_gkp8<>rIt&t31_W^AzoR*s!V1>;~4~=@zLHT&|&z9P_ajdc@X^6!84?T zqa`y1pT|y`88Z9;@#sMIa_r`%hI~Yz?ZOpT3~MJIE*-aLjbRzsy2Fc$HymqqGo|J_ zKzH2C%ffr0Te3ZcVGX+B52C7?>x-R@&UfF&0GYjHa-?E0d~(ORYp89viS^T^#-@D= zqMPed{*GfDBKEOu=F5f=C?-{jMx_w-{+Pem`K4vUAV+gES~Wk9l~%&3N-L_{u$G*@ zVK$W)`~xemkx-B&c=^J%v%jSYK)FHyumBTai6%u*s+z00QDCV8v+nn^xdG*C_U9*E zPEVWr^V`D1^UnqY<|;x%J|<~SxjPTBVMghB5&mc-74e<_YBonUbQFH|?vo1K{3fd+ z4W?jMAv|{WO<=CskRhd>qGBBwXbdJrTml(azCpallnLJSQkU)QL^InN3`1=%o9NJJ z+Yt!)C}(!)dNJOhTwV){?r!t4c6KI}Xsnzw3V`V^o$;4y+7JA&(tmrAf+PHX}e_i8;Jk*QUQY1J%0ny+0Q)C5J^~8OaE>> zVRH~IP{*0&`|(UL4DRI)VN86Fq<|V)*l+Eo!dP<1&&p{vc`hvw4AF++hUe*A<<&_y zXyO53=58CMfKU~!db*QdtsqLnR>354Y=Wg83z1fvgpR;mRl5<}o9+@fDhzi78c;2B zTz{^{{(Vw&BAkBhos11*?ueUNN2USJ!_{#XDvjdcJB8f7M8Ae044E9Wmac-Mm*e;l zyvfgSUJeutWNwDI@Pw_5PcYy6mxqQWvtw=<9n$hdV_nngxoOnDFAYilJ$xKe&&+&P zS9r3t7TJwJyfgyA9J=54&3W-;Onic+T?ZM%nPdcpp{g@xiOoD{b2F*?(%5`Z+$__K zlyH)ZyM&%Phn|w-npUMRWMIhVxEijmxC31!{gq6$(_Gp`oXOY)Rm_h>9nr!1M>zb% zx7Nf#@-{&*QVejrkzTAU6+;@qN7nqA@MQs_Q>>|wu!|Ar0Kl-De*a}kNlKI9C#+vzRGr{E?^2e(+S7*C^IjjlYyrC8Q#DZni%y3uoNS5rPThg zq*L0JxUlehjQe=67KF_i_orcSp$cZt++wF}$q?gwsAfQxGLF71GBH_}Ng?rz;JktBd*g0#^pFA38L`p3w|ORPv_Gtw-VhAjE2r{I&i1aW)R z?8ZyKGV2g6ddh9m;Fp+L zB-*TH;}Im+{?Fz6wm(y1P^I zuU%m-x0VvO?->|T8C6(q=)}6l942&7TBQeAo}GL-E~Q2-j^p4wt_LYw37*(bJ9M;Q zek~s#lRq)dN{u=nb-EadbTvM^iltv1pIgM+d>s~YX!MG1FUFf9NLtR7qTFOrD#cyc z_^U2}T{_4is=_nRoYFHA#Hzx%g#uXm)y}gQwr5i}=NkHmp@! z)iaVEb4VSuaf-TEPe9M;6}HhtF^(~n3PPKblSzbtTljn#w>&QUU{x^>zhE;9j|)pi=c$J}9{T!=poZy&O1W7v;F_Ex7LUdDQ<8JK(e z|2&&3;B#kP9ASMp?=*;OB1_Vcl6+`X0RB{u2wrwo0R@{olw1v@Cyv~50^Jfl5pvFh zYr*YZzMi>;9k=ED72&?L;B(f^8$8*Dk1uLxwQr|$V=<{?osbKX*i{wene$)@>Y=I~ z*GVtZ0jm07L4h{?a9mk#1!Jpnwbi8GmK0edviHuy^GljC!#RHbH&3lFrU&ECR&!i! zrTZuaTItd93&D7|GJgF1gXmkEVW@2R2TuOF?hHLn^~WFNodi!0cj^x;;tcTFJ@O{Z z>#sOYHQch0@C&>Ho}W>37^PO1#U?NB%?_KZF$eBf1BRQUst~R>Gs{D&@DU8~6#;Tl zYU^cby(8mH)T1KN7(AhQ9q*qZWCF^37C*t8=8qClvGg*&)(#ifmNb8&US5E_Mxq9$ zR=1diSm5DeWA_15!2!{yIx91p6!tl#5Jz3cHO0*h>)S;1j(yEp z-r>>uq6bUQxy1RFf@)M%O-4N=6OrVmj;6AeAjhGGS$Og)O)Ybzo0LPb_ZB}ttJj#u z!-3RXS3noHq{IDVaOr;Gg*R6ja4expPFcx&#$x+iK zwVTN52*7gT4yGgje%7b8?8)}MGk21sJkz;}!(XG_#}KmR_gZ$$vZ97|WkuE|*67+| z_hLiwQoy3;8R5Yc3{EPl5_OiO#EN0TKr0YknyH}sgrCENd3a^HJuUq-v#nW2JT`a+ z4e2;`;)qniS;P~zu_O@VhsC~0=C%z+CU-h-#Qv3Q{~M+HyYa!#2E0Xhyvb$@M9nQv z0<#42@5@cmj6*Z`uh{TwmD_eTJ1gi)_=~#N&Jmiznx|%@B2tE!Hs$bXt||Sdev86S z3S2GGK5dnP2rNzxIGi@7TdMs_RPFi8b7oZ=I+M89g{b{5S9SC1UyB{GZEWv9zOu=_ zNrR2D%Z9siiPWeGLs=HLXkgFv|D>Q4Zx-!TjxRP2OZe7F|Mt{;8k1_IxySI;Rs$Uz z$RcBfX$!4JgR;{JypSSR`a3m60yJ~NV-nUxTst0rQAxsVBH)iqU z)sRYuH?_H4x=PD*HH?O2AsF$G45eKR~ViMxjiM^a#%}C zm^U${ppsN+@|gE>L_Cm&6K&9fg z$XY--<4q^!o@S8xzMK^;(KRXSODFk@Tua*i9n}PdJ5DOzL@1kC?!X@anNcI@UqE&~ z!&fuiI>atg(<-=+Cm~5wZh2|+i}_sV!VKZ~x#EoN)8YALccCc-2QL57J{-}OzB2)$ zEjR}Uju>wjnP^?#T@TJFoY0nD`T~#wbp#Pq+R`SB%Z8a9iJlU+3lW6L$3rWyOc^HB zX`h|6s8Dva2{Do(ic8|^3%)kqumk_^vT~ZX#7F1 zXhwK}sYviXcWN2%y)*zgr$?L3PZx~xM9*< ztz_}S_U*w0&-JmwilV1lYxJJ@0UUz_e597I4E`03#P*yE1_ePgXLp4}ksC8;VLDm= zCO1-9Fw6ahuqt@EA^GV7Sb)D)2hRX`h0}KzHsEG5w^knJw`I#4i{46i9KpkY@OF`=@X>1rMef4xNE!U= z1ua__Z``?WgV*l!jKDycb&!W!F-&&0%I0{iPZr9LrY?pB$eq?#ITUkFQM)s}^nKmu zxxPNVZm$o5Phb1%yR}%J%}%@4&Id}j*wnWriaiS8IT2WiN8gFUkwm{#@kE6uoEjSLq}t$I=pR=)K6EvfShSuK#HV^#Sg zD5g~+q_#!rXfA^;v5H|5Q8ygowAoH#*HDU?8kN14j_%P@*jXp4Qq9f68K_n z3~q8qq(_E6+V2UdQt?(w`ow4$?gG(g2*JeFIW47J!nS))E1abf0&C=&&DHE&5>HbZ zr)ba}<{=?LWvXnIPu&cN)}rBXD&drqL)a14Mer~lbexKkYRb2{Hero7ADr8Wgj$aa zh=OUvAIbh3Zp4@OPvka<%aI7W<^A814%FM6FxcPsb^3}Jd^Xb7V&P+2_HKM;Bu`(a z`MPtMCA306Iav7Kt_o^mHq}0V?*V~3J91lHZ?6vrcR44(*Btej%0N2XG6+w$f6jcSxhdX}cTl@LA z;gzc^tve@jmjz+x9@9KHCZs*Sx8oFODeMgF(|Ya-UvoG|WH#pZvDz0yf1~JwO?LgF zQ>thf-9#)^P+8Gtp3ap?~$StE%Bj%`X*#j$%>4;=tZ6bGGt7I#^ z-)OD!!ZrK@%oZF84VZ+uq%`j}0=5}b3R6PJ@60M{+sN73kebosw6dO+J|DdutuA<- znS8V%me~eY*(OJNS8J}5Pq)am#W<)M#Rjrx96f8b-75;wFHwz<+eWs98|Tmj->pbC z+(0k9?7VfL7)wanM9rxrl36~$EI9?H%d#1jbXzTngs=6ZqG6_gDK4Kw>}!d}nP{iZ{G5j4p!dUUM~M&c~&u+L=Bx^yyrLVt%CzpiFp zNVjGV8VgZcz>r9G&Rb$2p^E270$Jfgc}~@}s1{zUSJNi6t&z4qn8vnI%qfjD@-h>? zrY12=U60&Eyr0l+p3*_rUhURp$7Q*@^brD@q?x2}7mVgA6?SMIZn85jNx|N&qIQ{v zY-DECs|+8bX&^a7(jL~dwl`{S(RiT?kQWb~V|)KE9|} z>?M-~tJB)<9~&k!wGahMH%jNYt1`l*Bz7FL|9oGCuwEZkk6ZmJgG@W&Lop;H8}h2; zWEfcrwM{va&aYE%iX~@DN|~0QR>3%8C*OZZ%=EfseRUJQY;v~5CwuC{2-Hjd-edP+ z?91>iMM#C~$!umov}y~!*pOOvP2 zvCMSRJIwL8g@@TrS1QvsGq@6omFXaEF$b6u(TTkeEQ)tpPDPrD$qo<(eBADS_K{(d z(K9q=kYmzEs5)z&QV+w6ox+j9p5h)ldZb!7ydlzUsJ0qyU7+PR^FD z@dp-AQi(t`4h`hYvLg5prm1hA#DSqxHlyonL;+#jA!WeL>#*Xoyz<&ZSHGvF_DkF) zyP6uhPuY10EnsRnHK@@dGQ$z^)^|S*N38jkJSm!#F`homrnKPW5$d%-LZBFD4 zHT`wX(4oWo?6TWSaEf!Fv-^{GY4c+_o{x{6j^$)2Pi-%MY?ZOG(m)zs?Bu6nF~j&Nku z(HzjnHoK*3BH^@1u3!7s(!O3yF&FsrwpnOpv54cGHp~Wfy&qI{nPE0pd(En_$qtKd z7lFh%8rtN2`OdEtfb$A$b)3I$=+7PdPQM5zHK?q@F6I5yWnD*8b7a2iXa#sA*OZwV zVd~fhd;@llJbh2cHKGDl@%r}oGDEZ)oMnnG2z1$Vx3|rb@zn|G`AYDfc1pya^ZQ7t z?$YkGT5$Yk?X1h%Fo=-B5hw;+(e8Q6v+v&0rdP#S(QZpC14tZEw;JmI5NmurL_TeZ z>{RkXGX`)`c%5RHUnf+>Duo1?Toc^dH}(~dBZ$^xqBh_Lx!4-x-d4^6bM2iluhkq4 zN@*BnHElun#azigTPx?Xa|@(X7P`FbxXJf_c$BAx@yUJ{q=yoMl2f@Q;;h_JVqhMDOqkhh5iN?Sp-_N z1C};Y*l81Xx*Uot?|2Q&=^loecjC9@?)00KwbZ@5cTU6!k5;JabeaSw9*}089LyOF+jQK?K?g85SbgLfziFDhn3cS5&3JiFsygg2c23jKI4y&d3$H~ZeO<9^5_ z%s8e+V97f^*9%=3ZFSi!PZmqDGA#e^H^O`t|(^)6Nv%apK z!|0KN{;7-5Fag@muYoc54L4oAC95dba2A1r2DhNVNtI`Uvw~jKJ&RIfHkmH?XW90z zcrv%O)5Pst&UelT6Jv|1xwBFHzmb>kxL@oSFQQKGIO5Bttl#FH&aCs$=wwgBwUean zmwyA--kKwZVzM7FesE{ZGh%NJKfoG_&McAsg7^%sn<)2aW%9e zPMmRW>gX}C4KqN6bRd~k&PdxY~Azd_Px+ z;=Y_7E_QZL*8by;s5vatv!rG_!34c(+e2~Oy;3K65I0GIR#c!NY_O}YOc%*OjJPNF zc#Jq3b4$JZD4)TwAbnzvn`t7l;M4UugCtXpzxlniYv6hWJVKx6N+sX&#lwPuFp>61 zz;%uvdk4gDQrqz{&bTTWaIeu9cR)JhI&1zf8W+^6AwxWP3=M0H8XV)aK5dE7<( zESzj#Zc|s4={5cI6oYR^V-Cj-Irtvy; zqqASHTsCbFOxYAA2qN+;Zx^vWHGCY@y&8Tk$qp||RL7!+Bzq*i+rWLlOOz&V5dKDlCD~mr)kTV4bDOokcIye}FYSq_i4fF$c&)lf;?lwTD+Eg>m zKThn*XV_SRxQ(-tS&5JI&=ePV^|vxFRg2LrHR#O3n;!_Z!0V+e)E@>8Ot6&Hi!`U- z|LU|Pq@Oj((d1dyMVm-uZ^w%EGW%Ru4Z@KhvbUw^(}iH^&O;qbFu>6@%4N`u+o!pZ zO`1t)E|HHQC@*ju6!!9+zT4P(999c=t`puqCu&Tl08_^+zMtPR$$fA8F!!DR9{XZ# zIWE`uw1H|+7vWl5h{_`nPaK)c z7M~)YdxNS55Wu08E3|s;hZlb{o)37lpvVMe zwi|qq&Lk{RQ`~vd0J@6bhRdI4Ry9Lotg|7MmB>2(!oQ?tdlf%TgDOBUuY^wQ*TYVN z9V&amJp!vh1?a1qihnwC6`-%DC3$79&BBGqR_P01q$ydz3&ImYK6%|v7Q!31g&@t~ zFfeC1mhjV5-XY=R3nFws?V2^Sce1nkE}@c2KL$X`Yn;4nXNyHOycnupXV}U<1KX5f zT_|48YXSJ*PHYpK-XLCm3vP|Jxm)F%^(+DR9?; zcj4A~(etbi2o_+*%D1%OV8Z?Zb2j}i=hl%FKg z=`1|mFmToE;AYHkx&pWdL*=uiT4}M~((oLnRBl_fz&C_`Qmn$6zQDi%{2?eIG|{}V z3D?fD^5qPR+U_mh@1P5fFKa9m5fLG+PNpX?LJj4a@40AF4&!0=*Z{shiB@L*kL40|iZ>Pe<|4x@bZwC_lg?x>_4ilxNBO`?a zUhZ$!GUtNIrEh}FECbEIpZ?ua-+!KpP)JJ~f19S&@~<};s(uXDYSHIb&ABA(;Ss@{ z_F7C*<>N&%*Kc_oqzrpW1k$alk3ZwXzYdbBU{Mpji51MGWOpEt{SNCf0COwfi4aSTBB?EUG>a+laIf3PrJtReO)O~nAQu`ah`EOB@%n-JO- zFR@sJrq+7y03AezM+6P0R@L6I-7MGqE`v9Ro%!Qy6_$U9x+byr|E-wH6DSR>x`Fb z#v(!>CA*NO zkO;CBq&Uoapde0Hul7(Qk{o&;8H38tjD-|2uWX=Wf2!M&Fx(=~+}yof29F6S%n90D z&0+0HrwP8W@g??pDgz7aM+Rz+&CVAGqrFw~72F4dF41m+G~D}wzXABPPku{pi%@dK z%fzFf?S%7Yv%TBX^ZWgGoDVyz!khQ1weN7|$+RlyeHJrr)83?`X<{{S`aL`s5fuF=CTAhbz>P(wT z_3*Uwrl$`#v2~D7%8Sv=1txYQ@dp_tPG zG+*Gn)u9#d8L$H6(P+8oZTp5LGC4In7{-mWMAF?iLxbi}?x;LJYlE?>Zc1whTq0s7avvD&O7)f8RZ?l@^DlOS#j%Wp8a`fXGSnf) zudMY4*IjGyUF-X6EiigRJTYsTnT>6Q7Vv3sC5r30R8o4w1To!9ONu{@3XqN2pw2tB|7u1h5ms*hUYV*AG z3NVO`7H+#>M;81`=vh$s44UP4?&58j-x^v>Z z%;1jK)C(R(20c;vQ~e@w@2Fe~ z0Vb0@yn?Q3kAyw0#fcR-LC9H;t8J4jX7^NZRF7{B$yNErPBl0DIVkzc*PLOV@mJ&7 zAHOxE^tJIY2{A=Fb2~zcMeQqh3Tqv|QPSk7Yl@<>ZP?X1#e^b`%_N~`LDIa?=vQR@ zGP`wux-5#HBWYVy@rD5r_2v6&1N=Uja6hPI^B8;6nH(=6g6iM7TB&I>pM0A z!96CYb<1d|r5<~H$|D|JLs%*{(MqX>y%o30mi<3g%QPWP;he$3-_PG~zodYc1}>XW zpy(5~f|MDpnkRI>sB7D?&>P3q3;z|0{OhcW{MX(01v8}H=M&KxDJ`G#r@s{rGa`Ze zo>sbRIR$1z9(`Y|iGc{CLVM?s1{FuPI~ApK5$`QNR)66aq9oZMWIs3khS~obNIc4& zBo)q^RYBcLA}OJLFI2bGbu&;<)qVtv!X)!iZ>r&A$BntRG9lJ6ct|Z`w{&Pl7fQ0T{gO~4~{33B~K;x*`_O9_5<2l`{`01pfw;?t)eLF&h(7`#$-|E zw@^kREr>2&%kgOaS$R~t1srhdJ{%*Ydy9dy2CrATlAYhu4Z>$&byckB*`ssli>?C@ zQn;}Sf2_rwnVV|{#ZRt73UM&??+9%{g2#xBXrqA?Ys#v7ToVog}mwP zfAl}_?)SqAefwU_fWP$JxDN&h@As4ZFA)5t@05Q?p)415_^Yh2Jc}*5{WWtsXY}VF zxgP1TzSknEo=EFe6jBW}*fd-3OVYcr$f^c4WUWySx$oUG;yCR{#z2HSe7!RbJ=)l# z782|x40cyT_-L(%mJF6u!(aqZO9Rd-p4mtoVk4JT)M7%xI|hApwAmzlm2*aGr1-Bs z4do!Tle_SYvxXsSce`$<{p1~1xK+BwNKU&`3?TFRSb|mNbew;Yk?<&^HM$t%Q{HB3 z`mr=|4ch826sgggW#5nicNl_R6~F@8I;2#IkZc%X_=8$Y6U}ODQbG5qFgmmCrzpj5 zPq0_J6nD#7a!#_=_F+`6-Fkk9FBd9!BMlz>&+2b{RGDVQF84^sR~xKf=P1Lasi55p zBN)W|07pQ$zmrM+m@tYERj8h&-Wj&?6^Kp2DQ#&GG6IP`#^wl5tOiw;}twNiYNAB@50L^u+j1E#v(rx^wgezt|CY z^;vheb}l0@RD2k#ltuA}?C;_aQCh8`*LYpiQ?wuWR-qm%QE{tv*zgg7{-PO4_?DQL zdx9S$L8)(2d-Y+MZHqcn0Bk2TM5+wmM3Ln)KcI4G2R%~K%K^0azm2Qj8ou1)%j@Z_ z4qLL!mi%%`@l2oP=^Im3-CKv$Kc(1Q(X~f{VtY?6I=vaqX_o4RYp;ki8;xf1W<6Mn zeW$do#TkzokE|Q6o>7YynFP*78Kxt}z|9up`Qogl%V()T^3036&PqC6k8vXv#ue@O zPD(f2&T=9xvP?ZchMY|*k{3pr4C5Sm3Yy5CR4Wo6`vd?47DveE3kss?$e^#Tu-|jf z-XSYl^Ur}G7`$@3PzZR7>VB5BR+`pyERW_@bguryrk4{CUwlNW=44LJfL))f4&7=D zRxJFg0FV3?E>n>?`A#9w0;j_H=Hplidj`;F<|WW(uXYL#vZU>V5UKPbYtc{15ndGq z=Cp&9Ay_0S^2}Vq^CV(88ReNWvcQcO{0N=q`yufGdqtD{;4VLBaN@(owSDG#HzO~b zGjE+0+K8dYB{u;`+|s?~kN89I$URc%c>{Nt$+Jk3g#kY(DQhsb_0ocZiGKeUNw#fg z>WNgQzAno1^}~EsW637(a@5NABm zE#I{{o#C8q)6CR(BFHVp^QaZ3a!xbs7A zLh6Y9@duCB45&_YAUU*)*bJ?Dhs$+8>Nr%OKrrZ8K1vIBCc`G+P=Y=`M;b3Pf|HoF zeGS-2Y{%NsS#eA62-Vy!sc5mIEJC@cSEjA#y9rB`&$8oPRd08KD)8k!ot(WjawEF~ z44-)r3>_@EUqIs>awax^)1asmaP66SWERRmb7-l%??|!JC+5tW*OOSuy8hzm#SSv1 z_Z=@BjKyh<(UM+CF*w`?_Ey1Tc=e{3%}6L-+l+$C4}zv%L8+*xH>6U8HAll{n(W_F z8!3T7*t=8c7z)5a>@D82FYs)e(^Basr;FdeUU$rak(fl2JCy^42$t2D z#&@FiyVU>(Zs&?YwA|DkK-@vmOV@N_dd=Q#Sjm{qSj>)SOxBFW-LxkrO65?HKnri{ zKv)ma)hU2hIjn^TBXM7zNDgJf1ZI z6Q-^pA1Ak3NZ)J=Q+@p3i)@AX?(9ey*Rs;ik9l%>-J|voDqr!F+J0+=q$&DN(#M*j zCHDb!2T6UhKcm7diBN{1dd8+H2yinSj^``m=|MMf*_0vU4d)&QWxh-=q?7bh&B7VI zKPZZw>t<{4B$p}+PrrML^t@1Tx%TTLRsztg2siI&4+73b{p2oPk;DD=@^SUB?n1czt_9X5y~J#TAZ=-Ly$i@wBePhA^TD3_W)|$pLat)7n&o6xIF>6Mnj-?Nk zj*JK`YSsgx-%3y36+FB7;AeOu`s2APX*hyn5z*xp@pEZ}SJ?AP6TB9`9zPF|dq5jQ zv|R?h$xm2Z99#CM^}1S3LgOYKUwJISX{|210dw0SF>;0G(ES%{S0asR9H8a>Gb|W| z?Tk9I!@`o!!Td)@urpDIi6@RWQS0ZPpdNzJ>htCUUiO|(`eUVI%)k;@^AomoGr5X@ z*}tv!*ufTip&I_yYm@io?H3j;2BO7UZRIeRW!i-}wJ)C!8=O8P0Qn#-LpP{sXYc*lh;c#Lh6$a1HlFR zFa5VxX_o}XHI8RVwl>3zu#H4k(lIv`k_$Dw<|{-xj2iJ%a&G5A>Twsw!fsWF#J^Tt zjMGQME~nX+?tG+XN5@1+p5w8aN?Bs@F8psdON#j|msJs^&;V;z2u~^;wMbDhs9_n+ z+F5;?zKj|9GaBXKR7E-NUx^(MZ0~WTltemY`1;>9UUm>_j_{6P9{&XGkp9e2ohZecXr5ed+)tHh*?~gR|d!TwK6Wl z^Ln=#tqqOy>oxQiFDJRg*e{3=A+f!-lsH9}J7NQ?*9wafn5=9m#q`)ihHu90lvJ4+ z!sFcGSlmXgcO20~e$)4B`%J1S(IDrtdGT}k6h{FwW&N9|A<9E&pTj)@LDv0D{V4J-8IEK#^MIy1BzF)!$F%>WVqE)tOEXa*OIezokuyI`S~bLHEf&^#TJV?CL@`?Lv>ZK1SHsaiL@QmCx*-R0139b@E0`ynw>cvW&58SNy6cSEyjCF#n5RA9V$>)_F7QfI!X)x}?J}5a1H1~)|zVAS>1OLunU!8?ZZ@oVR zWPFeiyrM{vLX&ux{*pyd379-qJ}{)lS01RUCvfS@Y8o4Lk;rEo8&NJi^*0o+OPE9Z z(vv;&q>yZ`b9J|AJH(sd8QZ|Xoxpnv8?+slLR|c9wOSmV73}sSz6y*kNEWj-h3y$f z7a1mOw3TiP?mR5i^&wM z;4Lp|dROYk!lbYgle^Dst-Dc5=>BlUsXt}M-Xz@YHoCfrnN_W)m2_-ooFum%KqBh} z(P5kVv+FSW)URLw6VYIXCe#@MY`!ewvzkldt%F+p(ALFB}&1dGa_{A-q8n=;!O} zcE7XMFwoo8{YoJGbwH&Hpww@U6C_XJ=KFqXOpSaa`lI)?39)s~$H)5Sw-!(L z)+M}7z_g|X?Bn^i1n$2ehS(hnj90wwXe#E)KLu&oH}4*UX?g)RsuOKh!3qLT?lAeI zp{E&}jImtQ!*fGEKfXRA`B7OmQh+hH6g_GCLp^N>kb0VX zk$LCw8A#H(9bpk#Chb@Lo2`(&0c**XYg)arx#Fn&m{}s7j=|A<-HfnZh|rKk_qMR} zh$)YqIsiV0-X4V?07Td}E}4~cN5)5LO*yMznnY+p6wPr35-H=QEwE0Ntz0ZJQU1E* zN>ZG^v)G8o$iEwOZ>KxGJZ*$EU$t6_;Pt#!4LSw$T;<4#JdcZ?!cg3e0TBB?(NxQ< zPEVWznsx}jlg%h>aULtOQFj9K_a_y5oTLrf&etyCzWo(a-XxalS03p(-`=-gF6imo z_d^WG(X03Oc`@4Blj$$1rsb$u+H$1iFWca_*5nB8-TRR8NeLj@ZtsQNQgEVVt9gb`cFlyFar} zzA=+@22nP`D6Oa9RYxP!PxOUHbZ;<*#|w-uxTmtQK~4a#HAl<%WBJg18|+{z8*LX+ zx^g*MOpuv&*Fqt3nN$`GEw>)6WN?M^Qz{o@jz? zD=96FBj_41f|V?1qLKM0IQUrSIQ|VTbB-yC^c*GUUQh3ZtLTuLpQ6=C?JBiI*oD$` zs5!or$BYw4-3-A&A$=o=O{ky_n$HB~^7omGX~?rkr=tn%J5|Mf#p)e(ao`nBp zft?ym0&)ophzhQGyi*KbOT+2{4pmRVqBOAyvL0N8$ONMHK|!q&)%d2`gUd|{Q7NVM zHnTJFCC z+L%>F01F)>)aHt9F0TdsN`n126tvnd0PZdH9>QO!92H+`ux0U0$RBl!x&9ATtB}%i z{HD4}MTaoex6iO(5#zmR=l4%D=5u??(RzE{s0Ufkfa=%5U}=w8Y&H3kUzv8GpOik3 z*69e94~AU^RexEO##g%gFavWLyHq^&f23l(p!W6~ z@ET;^l6kLH#c;ucvK^Frbt5ODd`6xiKHy!hjl>;Mb%VU{LOH%De^SQ>qn*|k5-9kE z!uWkkYgH{#KbM$OM*<@Cjh#FAKyf5`l8X*cjaf@Wce{Zo2`^!XU;Ey|JiDm>CkBAr zU3y6fZ>qusd3Is@16_I}gRp6+cE2NtZWbDJ zZl2P$_Ltm14TJVT_QSJ`SS2T}l$@PDl*ireYnQ*byI-_&*&X@v zbC%KNGf5^gXx^;G$A@pU>Z8uZLHD%&spMZNvXhF<%4}7lJzo^B9J|3w3?Ig4z zr_D+my3X&~;78Nd2HY@BExi2Fk`_A!n4_vu0EYr~0BIBI$v--Z8GbKjcx}2C~$~qFs%8E*W{)|SA@05-4@FZDix#oN^Y@Kq* zLwXBbh=vr|#I#tU0zMV1ooGTmGE7g`p@00^a0~S-a4NK&$j?M_0AlFbZM1pIi;Bgi zxK}Dp-lzfa#*hkPpE-LCdJvnPTh&;pT?E7?=PW6xADHp#pC%JOy+8B~;y1TnMQfK= zj$2QODt1)AIz6EDN9OM`zy~les{L7l){uwynY8s zM{8#+r$YTUON=&+M*qcMMt-VgzW8J52lund$tObpSgQV_3+0 ztgDbV=rVN#3kJ$RJ_l9HJvGUrqw*8~LQy0-U7J~*tk1m4?P7FQW|LAItbg%5X)LWq z{;*OTS$v;3ont66UIhnZLM$U5Z!n7zoNh9UVgM9_3`8U4yRDCX5OJOf#|}FSVsf); z@9RcU7e9Ttsc0WJHA@UCIZsNueDJhJ%&&8(**nmOlVu^nt|4DO+04SC&V(hAbJn0aG{*?Zt z23?Rm{k~Fb)l8O@cfaA(IKDImr@d7)F)=uc@g))cs&N;YKHzgiW2 z<{w8s$#UwD`cHpbG`Rh9cBYYZZcCzeYy5JxZ*M0WA|1b3$pH-nx&O~ zdV?w=RTt5!JtHDd;|Tq3VO=Q0kY@ieEjz{?XJ<4I=7M=9Bw*SMTWS`J-&--6=%^4=Y;f>-L z3_9CD`o~RJTkKJh!`)F$uh&93 z2Lx!!OUdb3(>IqBq)b%XO$Jw&TT9vVksAYJYOi?Lq~&V}*1m>DpMyWXkK{NN@&tpP zKj!|?7s3j|g9Q;Vul1aDsCIy2K59_aM0Bze7U2!|Q$=65Oyj{eohbV_^{1PXjkL+! z@DQ2slsI16T6h&m@|)wgl!5H`()Y=qXmMHJDE5r!AScyf_<$jQ`BzHXImQMOH7?jrfkd>%=@ z?Cg`!>In(=*5SbJ9a4tue8I*0Hp;WkdG&&*5qI*5=04##mR>@jqUed)7E^ajG^Hxv zl9mOOpJ?+uum+&2AzK%cu+5-mpF}D=h?l>SEqx~01_C)ynV0@2lDrcB2OP|iE%~3h z137}$;r`>@A9yVQBy2O01MWZ$RJ5;5#X=qnz)c{^e`R@dWJ?0KZ)@t#DA^|g1^=sC z_`fUE>=VH~_-(uPHf24}r#tyBrW`=B*E6fvTe1H>9cA{@K^1K_CSpGa&NAL}Wp;O$ zLf=0o)Cu_sgvpWmGpApdl>Q`cU0biXN8p`BiVhAm{>#w$?jN}5`6lHd{U`hWi8`*K z$xPHcP(_km2-5aXP)3eWh7Z$DFFvY3hFz;l`h!cqJ40VEkcaw`&rqmqQ#gx=_0!&) zeT43B1sjy~P&BFwyOPW&xsx?tOa8rtaEir%58J>m!%WMZk4^ZR?qq83`L1A%IpX#v z&*AjxwpFP3`jq$bPGs?bziOy=*lCb@{0UT#3HM?*R*R$^@|b_MB%7PkurX!e;Npgx z;(1@kPerNX-5fH=!RNO*NtjB=vId>m>g&;cgocEO&505l*HY1^pN^@7O`_=STdW zcO4QxD=LEidAR7HHk$WnUvW3;8}Xik-YjzN{aTE z4`=wXl z^V&{ioKUR-3f{kXAbP65cs(ieaUf;R&&ba=so*KtPN^pRFS*db%98Tn*qoJiM&=DJD4%p}Ew+MA60;p8i+g`H0@4+)c1Y3G{hrA8Tea zOV|BqIZ#28lbhu z>ZTRM`%g^o9J;?}k&3`MrHL52`}@y}o3)_6e;;o(YnjeK0$p}YA0xz!Y2Cw^h*Uij z2NP2nPDt_ydbc@ArW;KbhOiU~XE?;PD9hH;c|$6vp&k=}hy`z64judn}8*nC$3NnI%aDLenRjMsg+yPsXsG%`KF`zg9dckzLIm$Mi# zeqoW+KD!04OD-nDqu`M)!*(<(&|sO6FTn3zioy-N%^(lm+1Q)WrU<4~A<6DkY+Zk{ zbizNttA7<+?B27JT4px9HvXh?59atLeHsoxnB3N)>qxZW&^@J}JeO`bPyewBgq~IU=DiU|ed^ouEHIfCe8X837A%mzhfY^VOQ_~#i*gv%5Ntrfo9`zjHcbD)1;)yHXr zt{)rNES}rdQn@wE^czslg+$PxsVQxMaw`l1OmbxnavH^r3F;`}c_q!j8np#Tq4hxS z9^eGWn5M8G8?PL+g~|S0@bAH3wZ>v35tlT=5P-oe%|M3fs0%uTgokq*lQ*wo6yRIRJ zm;MpqzPM44MweqCyx}|rO^+X?j?z?&Gkt@`DAl03y*-=m{@=Z3(h<8`@whiaFLWKf zeROv0R{QR7O5$+apeb3i*bqCJ82X9@{lHqeA{^^RU6WLn{wdR)1GKD@pPy82-Fnj= zRiAr1v9w;lb}c?7!=7++~q4F}?77?c;>>mf4o-mF> zGf$B;sp;FStgmCqDziP81^+*UL#|FqAVlvp3(p7>Yg=7x!aL+{pMs&X?#tUr3z0nN zH!)V)V9BFjl9Eho{9(&6ETBTvS-w!3h$j?;!6n`h1kdrG-f~+%;@;r}5qefcLNR~M zBBTyMFl6VxPR!=!LZW}9@4rkpnJuKpi6ei! zMb3fl^0IRu026&I7irs9(<*(`Ys`$nh5I`$)Mnd@ME%)%;0~dVUT`d+!+`$1d2y+d zm$80|rICCCoXRgCU^jqp8ZWhNdjBT;#J*mGp+PL@dc&Xcn2{GgG)5WAxSDYVoDD}U2BB%nF^Di zfg{+*F-i;5t7ZsCfE8OUH5v7S5>9Yhj+(I<5=LVd8aO}Oqpl82<}I-HXlkiwCWP*A z^r=k`tU=!02VZCt0R1YwQh60UmiiB2^l;7eS_PDJkFXrM4Ek*GP_4AmkPOnGIFilwsXD@Z60%?%GH zmutwkxNEz@qGiRd?+IcU11K&)xb>m6*3)<^G!_T0VbpF@7Ow-|?6a-0bIz;pg>91jj! zUkWb;O{)%Fh(B7G`k$cI3x^se#AtYskV%qg>1=d++HdF*SHij}F?#vDpmE8^FjFklehlw6E|;4Eb6qUVJ<hnmE>G67bzb`oXO`!(!3*?8=HU=Ru-n3M}=?ZX-gX%CUS zrZ;7^&%;uSSfFy2_=ArA%vNlr~s#Q&;JETimg&`f)7<&6JT2nJTyNOL5o7d*AWu45A=prJpe!!6d z9!N$JuCDGjEWQJTqA#2)8;XOK05fngFb0|8pnkn=N+6^MZP*>ga(>j^(VaOITG4f% z@RwB91as(`!?`8Swk_CGxzz7q7j~|P+?c)WEX5F7;7WXqo@Z-o2F#PTv2fv^l}m=B z(Mr?BS+_l5;?mkRz0n#H7cS`(1poA?r|7*aw|#7H`yc({_k`)>poE7zq3sYIe(UT)JTdIkr*dYmP+A4e|XLPyWO+sU+4gl zO4f0#HkU`}{|SvQ+a>?O`A&SFx_^ZLc@*Fco*(4Ne^ZTO&D+EO@a(7uJg%*I z=6vwe(ZCkiqF}9xQ2a^nlQ{1sNQm7~#$dUDdB*uq%$=)Nr)1qpQvJpUp{|m$k1{~P zGnc5CW8-*CztVEOk*4|i5~r2sgrlb~c@J3TOV3m-r?u0BqapvKN$wO)2vctxsR=Aw zC7vp8pBN87j5%IAL5H6_xGvq0-UXDDi$E)qe)o-tt+O;5tcM{4838Xdj!qIie%zN|y{CdHpvhL? z5}Hycn<-AE#8O%fYCjT3613g~|32}myjKFtm3fdPKbY6tWp8*U>$#--Bv7xD9&$}? zry7|-yTR>~auFM;PnI}!7LY7u7e})pk&vCB8%@VPCNYUDB2%#d)Jp&^r9oMe2 z4tRJj3A}64`nP|x|1UwIlY>KNSBw(O8y4o|QVjoCQfiCqhnq5YxK=aT874ak!54ZlmQ)L+-X70F%;|~hn5AjFblepuTYaS7G~+ex zryM~@t)nW2?hA%WbgS06W@`R(NHnzqw^4Ns;0;n)nAqLo1KvBGF2gyWu}X4W&Bls;T^Xu7l{e?`;3xk4E13qtM3bx*By>rUz8pOZN&QUYh?v zVX!rhdZPFSiBN6wo~zd8bQcw&8+Mqa(zTn=INk+PHUocmSWz&sn`zO_OR8wuu zY|*+vomzBInR}lFFg=(bUvPi!SF&a_nRzAsv|`s4Xd#M#w7Vslb3nPe*{_FwvG=Y( zV1WVawSVz2{4w{OQxBphKZUNbyX4WzE;ScVl@Udto#LHw`goR`Fuc6v#o;ZIpNz1J z-C=GZq@aTd-S-4}L0lr8e;q^7hzBHV#AK>eZo=gwrzu5V*NQO>3}zWv)EzBC-H-xT z@RH>dS}vh>COpqr7akv3vrXa?iGM1ZX{fuKUKTOsf1`4`?F8TLnkW zS~hy%`|^#95FeFFJ#M@CIYn2kl_XC~*1VQ;Fh4W)>&vHSa)#YaZE{<7ydTzAMqM&3 z4a_*)W0&P*sc3AmFs*gS{oems*Vuxt-Z?-~Ak#Fdn6_{mwt}l6tGd8EX*WC6@ zY~ur>zML#&-ZP1?yM(r{?$@Zsbis|Pnp^E1y=mjIZVUzkNcmf~G3hjGS`t;uVGLH2 zi09gcgBGx+4sLb6A?#z#DnScUOIesmyR29sB2=-u;_QwQTFrS~(Q4x`ks!FTah&$g zhE*G|JRoO0gwcjbwxHGIm}a<^IbQ&48wTEiQt8hPY80!c%ZBId%-h8NaA8FA2IT6W zfB#?867DqkzTR#;4Y21X=-CCZbB3 zu^G8+8zc{%JI%nLdFUN&#ZmPH$M;jU8>vdCuN!JfB5{wdVwU+hP#COh0VK6T(Mx?ZQb5@2VVOndF`FmJGQvZcwTq7ZBSbJij0<<5M6TA zxgv7S>)Pnho|qnrIq|xqGMh62$)gmUqAi}J4=NUm#@A9S6ntG4Y|R8Z4W?GL0n7W- zIwyfYR;<=0QeU=n}Sw)<0`C0AwL+_U#p+gPwSsnr$6*iJz4Xj;MVhR|GVa*sUb(FsZ>wS zfOlA*{bbMB>8d?%r)%%u%KyDO{qyPWkqcQ!vZ>is#TNWyMDN$O4SbuF@b&J3S8T}@ zpe6(0(29z@=!Z93$f_-;Y!q8G1)#`d-2TG&`rg0$21{nNy7+N}p@jR2*ZndMUJ9dA zCKnZtudBu(G}A^{hdx(C)!IaZ#F)N7iD@}tBAM_X&)xyoHlZGbw7)(x@Bn73;f+^6^t~`TjSpg?|2>??36K>*9UD?$Pc(i(?6R3 z>fiq92h6j#YXIpR{-A$2V|8}soBn5Jsn5D}`osw?=&}FwaY(@*G|3XYM18ur>VoFS znWNKiXeEnW5hzuKxUQu}XkAx)4#%wD`<}`5x?5jo`Z}32zlEykvM_qu42<*{EJA(j zyH101ymo0pR8!jPv>;3Ue5VU!xCxb4PXzu~ZC;XVxpp~MdV7>{n$}*s@j-WZwgPYs z$g;fGgjc*o3zXK5C`85dpZ(hVAszC2L7pR@%X@G$eR=uH1$FhaUtGhok2zw~S)q)5NDZsE8@vlyn~=@c3hO(feX$y@3!-9U=9k=;x6@{8*i~d(O7=T!;??*u zOTnCum%w15YO=15-Se37rYQ$}3o5q$!m#-33Tnb z@f!u%&PMtKZ}eg5oW)QAq?QG;s_jydIaMrghkmlfC8yx_ffugmV3QvqO&=g41!3ii ztyx8j?x0L9ig!}huekyh_6WXzbPkp7 zgPkaMGV0tDt)DBv^TR>YXz%nr!Xu`ePpZV%lI6?fw)+l}WnfP4mDU2g?IT-IjlQ<| zBYNiV*)2ba6Edo~potXGI_{6$v(sR>f9}I&9k9k531=XIIWBj*>a?r?hM;T6CZw2F za*){@#VV|uhfMpO3&^w_!;2SNHPPB~(y-Ofgla0bn;&V0_5Sh|c}7kkI~iDHL3x2$ z5_AySYAa=RVF}ONwMt}VOZ$aH8D(3h4aOzxrSEcfl21dR9o62aA=)}??^c_!N(R?z zEKxSSe>B9ra*c8%XacUUXfX{);nKx2?}TwQiWMJ|U5Nw-I)_lIe_-`k(VCHk;SG#+Cu`V+hD zr<>pnP5`dl)}dDb@}0Krw-G zcIf5)%Z*3vY9 zvry6$CdEV^uF@=Ny_%4U6^LGG+?lti?qhFY`#Q@fX1D>OHtolZ#uiCCpDS|o zja}$LWB#!v(GkAe?I$|>Z@I`#X-nb+t$|?l5bL|JCx}+;1^HeOH$gIOStmfYP4G%# zop-3U#4!FKwBD=kSexJS-_{EP6yFQr3q97UHmi0i*p(S>4HezlaQ+YG3+yE%J!d(1 zUQ%??a~Es^_qy^`&=zISST%Zuhi$d4k~o3gHn|q02Ur6$g*W8O%U2;6v32*IaIYcm zDFzNPBCuxbIr;!qJe9Dg7S!e5Harh>e;(9kI|{gvUV@2R(~7mRGAcG>w9e2Rhh`I) zduWbWkOU!D*BpHU39^I_O}_T4HMq!%CbvW5nD_a!T64kF$rRAscuG$=!A@;dRu5Ht zbc1^MO$g?BF<%$o%`GjLARgFOP*R|%3<5EYFy3;H%E`9kW98*g$Oro(TW?iC8}An{>;-jEX|AVA{& zyj|Zb$bvzdqdg{tHbeKdiI!_cUseoCduVZ8hB}jXd+NTvKJPvVa>?Y9Gx$59xd|(V zbZ0hSNqI|7dYYel$&`vO)tTYZsUCF*J%tMZiQEPCv;)iB$YD86KFvJX?b$rroivCm z*s2HFEW6v#UsYs3k*%;*W%X9mTK&zy6t`CeE&m5i%-GFZO-h{2SM3u%@)uuppqPUt ztprse7vDODo;-%ApRcr4U;U$Jtc64yke@TMl0sIP4WjKuDS+MJBttn29ta~U zz3DkDm{6&Pt%+F_bP4@BupynF8-TzGp!9oRj+v`1G(2ENC=@O>7G^4VAQ9nQ&vh|a zA4xFH?O6G~A@E(S=pAb_@SJY!Z*hPoiq@01vA#*0*K7%tDOvN6dSpJ!WGRbkTg~@B zcse8GvNggWjWcb?9#p)5N8YgdURJlb9KPe!S`w_7p@zx3wy}Ik-Wa}NlJ!Y``PdQ55k_4y>x&la`^`SXv$&FvrIN3rPB6# z=YhT}rTeX(5gYfh$6r^KT(f$`8Z}Tw8OjP?#lS6&ufICigX?7TZX5e(*5s@#_ZCXol-xabjX;Igk+!Ki}79B2jt%VS7pa?MC1 z1k<9KR+|}lwLAEMcbISunA3ZT7PKm6@Yqo|Fjw~zN+Ox=(ku(EI z@gEtK(hYB2q$y`=JI=&LoLxq7!?Pk7yOFe2h!7pM3=`M@>-aKJ1FncY$u9N$#zIIG z_Jvy43#suX;9$&6+0h!d)iKG9SEJk5-W&Lx08Mi;+~DqQ1j{eNL}g&k>U(C|GG5zt z3LO@Ag@TvFmT;+Ntryaa-XKkA0n~Au#Ujh4%y*8Q;DvwY+C*)Ko*hU@L_$OXCmJzx?(pJ01wdCw|hv|2U6{Mum&0f7>v z@ca)G!s`L>k1v^E70)N>ch)$<`6U}1*4#?FfnN(5;oTYgKG)f$4cR2&(?DW5m&#M3W`M> zWXOk?6T)X~W`BaOhCOizYp7?v#1=TfL@oda!}pEKG^#)R5jqFcHT%=_k46v0(naHk z{$cC4c!dRs!WdkyfFCRX3@)Gg0b?iVADLk2uCc0y_?p^NV+;OCqR!ai~Z?mS%609LjMK49x|Q_`=8vR#vh z^ZAXC^=|?emp@SZpth6mB)4GZ0IvwCMl5%=QX8`7s;0L=4Do9tqT1zD=yQWUJ)Jgy z?HjH>ybSX`nmHy)1jS3Ftk~2R0_p|i3a--HlgA+*b!#?pY`vnGQHLmOu0s|cF^5DH zR*&thwE%QKz(%VXc_XVez;b~IFbeu`$^gN$dliKXlY7?KJ^{DQPI1jY=j z-IUBLdCP=D7u!X3YI`}LSJqUEh7_K*1yK$h^K}cgYZ28xyxi>r8jgG*DBkx1ATqS3 zIzg|k3BL(m1d^8$JHQOWv-+Pd;4*btF9sA7@dG@dQaGy-X-O@PTb&v@i#6%8x zCkWbsdlYLY07*K=Gw(tp0PFk@M0Cp=K+|kRWlDE|NN0Lfrbl%(aV{(an`s5pRbR8H zc*_=Wlk>{O7olA#E^i}{g}VzKp@>OKtZoaB%{`<=oAW)~*kDT9)|d+J-YJ@mQxbOu zY?AP_)0iAy4809s%RK(oZS~iC)H1&H{VA{?@e5I^gsdHEbhp>Xir($7W45iutS0#@ z9MBYAH+>#zb&a1$GpqKK*jUB?@-Ti``_U2zRl%`)(>~c|C-@pI9`?dXv2H5*^P3%w=%n{-oMM;YSOX#A>*HEO zuD~N@ah*NLOubMhwJc@hSH8a;B4LPK1m+e9SZ6#4cAr4eYFAkMEqW6px^GM%ieoaJ zu)w`8Hn@ndJVx;>y9AotSdser_1MjgwFT}kc?f~o|Fm@8u?1$pc7C-(J%OfszduU2 zN;{-yE-f)_?wwL~)2rIYuHh=BH%$AfcSh7=M)<4feP^)0Z~IBV2ncxTc%Yzt`_s*` zzPiLLX5)Osq+WY-CjnBnAH-j9DmE^!|AxfQJKazBGzSNXK0kcPM^nVR?`PbBGp;F7*S>h>W}G_l7H!-84YvWY%8(0tgjbud z0&x`g^#Pqn3r~B}aZ8PYq80UoZ846ytw!MvSEydWKqr{#CZw2#n{KxsLjqu^6e2xh z6Gyb*L5j2^4d!v#k9&P9xX6hB1gy%=8$xLV#zn#_kciVBe3yV1mbHotj}@-DRd$(q z&|#f9SDTeCU4fm*egshynZot~kUCHlt=r0MsRSJ`N7(Ce%HuBHPsK164T*h?$gnns zC$WT?=Z?Y-z5@fz!xxwYm1Ig1W9d7_m|zJ@PoAH_?CggL-2TjIc6(2&TtVt2t@)hm zDNazA@)aL(d|W4`k=YLy+nS#@U2@{B&5lNxVoO*})MoQ_rr&M;pqE;T6g>s^ZS7j_ zce~S~l43RhPfp_9wW~e$EKmDmlCp{$(m#7o3&O!BP`tsYDCCb#JDI8$)_RLQIXlrO z_MR1m{_n%2t(x`C8}r8$q#qea9-?j~&^^g3iM{eQ0BS&$zu%s2&)aqu0=Pg!HAS?J=m=W zyS4lIceYzS&1TOjI<2VdWb-Dw=MnX)eL;_ zw|-gCV8w?2G4>#Dy93x$ZzfTX9x)br0wgf?o<3G4wypo3L8Hqw$2#%ZXGX3Wni$>b zl3ZquYa5VA6&r2VlozVK^KSZY*+i1zdu^-}oZxbLciVrY*C)`rYx~pn+4#LLT!OQo zzZq-L(i!kT01=vLWb%%gRP>9FB^BD1|AO+O8B7uPKb9@ppa&F7sZLCNR9wvoX|uiS zwiHp*#8kg}MTOSP@3?GIR={MtHZ^Jph;%V$WW|>&OD>}&&3KKeAyuAgpo11t)4EZu z`UtuQ1mPbsNb7d|v9-idPq*#Q_#SVG!oq_#iT8X zU^41H$4}yQ?T;tfS3V{i1wUiE>urBV%w}Boz3oq^8{hV4OvkjHXTvo=-A`%-Q2$e- z*z6Om*yw)ts^8fDjPCxIYIgPX2>ivm0d9Xr9`bOv!0pfBEc|<%g{1C;4>=7(-3n7_ z4)iqa?_QYdj7jcsn3j-6fT@#v9wt)! z8J}eIOU*l4g{y#-O#VS!ha0DJgPMHdx-afyMsAbncEW=tNaP>4c)srdQ_efy1e)aA z(4X@+uTp(i`&(S+W}o|ppDs5Dp)Ca;;a=IOC7>g2CIb!P251VR*?~HuSc`-*^Oj+F zAL&1(QFqG*x?=TzI?Jm^X*}e(&iWU&ka(1-qBZ)C0ia{-lLz+0~*Q*UGqzj^Y-#;NSR z)TYyyaV|lnB|uS(8bdn{mp$#akSlU2h^)*yjdmZnR%Ci;HdyNA;|wAl50muAX0}aM zon3pRVVWU=TP)oyw;zZTK{lEz=c0ONXw8;9BWqSInO29h)fgrlCG*Yv_TkI%?udQd zDYq<@_S9|rr{R7972+ExE_`}pZuAcBYCAYoRCLx9I*I;&`f3Ko|NoPXH(se3IVXyX zWx;$3HZbA6ERm=ljW!bg+3-7BFsu`%f-uzc0p?>%UrRmT_baJTXK-%Iqg%E)n(WAt zqf2p=O4X(pc4UUrd>||82>upm$>NpT7cWZ$!8gwsNbC4|5%Xv6?zhpw^3N_%&Cq9r%5nWQ!+3TBtbY`v%9Z0N0S zLtS48f_oT9nVB|nU(z)zUQ*Q$bnuwl3R%5Vy)6&h*f=&yXLBzMPStA*744K(2OeFq zg54ojPhjDwaI|ce#qgDt=6v(OS;Cj|K6X^{ZMh}mJir+Aurvn12YR__yCT$E#D27a zqg6(ST;!h)>Og}OtM%Pwkq}~2lCn_P*;yJ~#ER7wXLpRyYR>D50<0tME8KuFv(|Q2 z0_Q&@WN4~wJ2G3BVwASE%=uyy*ScI4%~(i8k0rwTbfQI5Bv|V|BX_+abyJxBqFON)z=nK$!N`%veG}Es7#h-FG15dbz2gl{F-h|Qj%3sOr{+mh{A2% z!gVO~20%8ClOD+nxOb1j2JvjI?mo2%TKc{a{GSbLd+WHA?bw7bJrk;n9@Qo;5?a(N z*(_IBFq@iiyQZcLi%@$X0{%2yg;+|1Rbj1qMN2J}D;`g+24lOU`OaLW19sKp#Rilr zk(&@Q&McaS$aA(XWevs?u&f_u^-#<0MV@dH>}5WdyEt@kS#VaVU%`&1Fk0lmCvamJ zj%y2`Ut2l8rfs2}vK6gpR#lGr8 zwu;aU<6b49T1DQ_DN;>Dw2BUT7pWBR>M28es@gm>WHzX6d6>Sy9iD(og;$p)Q8>_ zTZ$02(;#wF^dtmvod!^wQYIh6blO5}iWwPkJf|JBrkFYr!EzeVkYf5)0LN(nr70#? z1~8n`5Sk*yck!Fj(3xV=#RKpegUl4$GNkwvs7z0R$n*qgOe2w)JiR|^hsIHu9<*u0 z2u!>9N=d>shQ2fg<{=$<$rZ+rvXLGSb!l(JrGuSyu(J+!R_a(2ag3e@!)OG4(P#+r zbnK$^4Cf@=qAns)0@Vm+Q4bnX0?`m&Q7;lv0?h%eq9;Yy`?vNhBq9wx5z5dLAq!=M6-nqxP=rPy2$6Y8SxGW_PzM(%fp8jf zP!|&@f$W1&gOY2Ro&qiCK}bPk3rfcz1f`+_C8A^FCjlAAqWvV(jH3c|k$#d1KL#Su z$daisrEAH!IeV1lq?MmN1oY^I|49C-X+i^m@esb>^QkHz0fu{DzrdOYl%6wNS-&NGa=lR$n4ndj3z*{NMr zlW=zSz}Sfg*v8}Qq-(0bPY{SI7c*I;jQH`&k(ggd7j~CP^WUq2uhJ-Xu|d z7&6XSBW465PC6RSxMd^|_!x_XGa5c&ECNm{`b`JXCV9ex$Tz!aHpw&}2lZz3!j40` zNk+OE2?s@DC^sIwLpoayBiwAiE1Bj1x=lY~O)}L!WSd^Jnq-O(LbVx*XtM{J%{XM2 zajt+g1e;OlHBaO=7=>7~ui-LkcgCXB82p)pVI(5d>|)QPOfia1vyD5G7Mu$q)AVA_ zB#`Y#rFoD#_1N0<{^_aX@MT70%XE-q(&9V6Fs@AE;Y-Dn*#k=^ez}dpk+CQ-5t{`1NgX;wG1Fl4blF+FtNvJr!-wiWHiH2F8JVx$=OY*8$p039I7l{?Oj zJIaOo$+~YJE$x&G&((4>o8n^hM*T0Y+7j=Sw$gT?{@KWyPK>VxhKLC%SPZkXE>Ygk zVd9;Dv-0A^i}5sVW+|&DeY9yI1+#AeHz`ah=2xXf)}U(!N42}QURn*TYkZiH-UFQo zd-)Soa`PQigA+|p!g`dx9fy?dvXV<}g}}m_vL58D2wi)d+Bu?4L<=G-KTD}zdB_3L zB}H1Zlmr%+o)RG%OzpDCD=C^#)GV>XKU@g^f)|2!Ry&%fk+P{dhQa8$p2ZL&K0#32XHYRi~n;J|YFjdRD7y|B?2und# zeO1XhyWwfMVx6gWo_4hZ`rr2eMlnxqCJa>;W`$BbZD_*1AUUnsRKM`CorHR3Hm=!Y@zyeBxkk3@r7DDIIxus544u%3_ccL3i-W>Tnl{zn zuj&a|(`?0sxkpq@1umfpT|ppp$?pu^5n7FS z2A_~o<7;Sdha|$oH;BC>9(~JW{;565!k5SLQTY0~*_4ULNAuww#Cz|omo!XzmPmWV z5~K#jrfF3MsIVqEdy*p!F=tP?qH2uu7QR2^yTm^Z?Zl&aoGW`2qYS+zz1qhR98}qx z3F{m9kE}HtV+Zh^Ppvh*$$Vq;&Y;INI3%1^8aItIxh@Na*>N5EMlpo=w3U$ajrm&4 z;%uR_WJRtn_$x0d(Zww_-5(4>_zyE;@x%4@KGCx*6h21qBG=DmzZ;%-3D>sfF@PA#?Y=z}(=1l-j&@VIfe%BVC7|~roVXk;t zF!DziR-drNf@SreNaL#T;rm1E?LymswEy~3AOFNGCw%LWSnQ%+!&j{qYUcsdLn?Yf zV9Yae5kw?GMFCC<900ZEPY61+5r)Bd_(=GzFWGD~JuYzX3`0MqYemSut$H0wFAZntdH_8T)ff{3#-NYXKnO|!xTssC-u z=GJpAaBxOvmF-&xiQ1G3k;C9%So@|w49(!aFLC&IW}gCS|PBI6?8E<$t4LjRbY2Kt50X-|7Dc~wi9egYkuc4 zm#hb{HZ4r3BG1SPJT^Se^_u0J)~wi^+Po3W5gB3->s8^R{_o!fnJDC7hao3%&IgO+ z)2tDq7|mZwq3Q}Gz}^ZI(jy88LV1LtxVHi|Fhmc5<@Pz3Ysv?W))aU9m@1d2sc(6V%9ey! z$kSA_jILv`H7ZfM<0@FvBP&T&D^F9eGNw{xgfA|=I_0VAQbtsyr1uTpyB1|k2f)Po zlc%UWNv}CcZ$g_=ZPHeeBv4GKGuf&iNjV3D6(;*ujwIKNjQ8>Ok-%XIUm0J=(QePz0ql|v z)4c9HVs)3=XprrNjlI#}t`6GipmstLHd?@_)obD8dOeujK!gg14G%l>tb$!gdE1nB zOI`m$E;6|`D!1uLrny1}Z2w!fnWEi?-*0ynanL(fK|ArF=8eFga?!Rm8M73FWG#}Y zKg$_`y#f^~m*Tj_ciKa0zdA^>T_`saLh!MWJn(@j($*ei9(?;O}= zS+R`eu7(cJF}I*|__ARM#_JimtdEZsxI|4&BIt20M$+Q5KL_4^W*p|jm%o9r8Y*=1 zywab4wzpS$?M`r#$UkaNycYwdJyOaFl)?GsR&cmBU&GP}g+S0bN<5D+s%#xe)y{K5 zu4L{!vjknU!z3$4Yel|4>dK4nk093IRBeMO-WGm@(Bkc}C|RX95fl$$8hP$1l{@RR zwGL2w0k{uK2$NJhD-sS9A>*#7f?^R2Hc8>hml-)n##ay{x({^|i|q5@o>`eNEc5R{ z7qs6aYYA|Ynv4-dSNb-A=%=={9Qy_G8r_i?&DS39Pxm@5ef=%>Q z6KIOC2wI5PuSV~PYWqlTDGyzQVy&0c2`SjjyC;|8O6J`FTv~gO4(d8NvHxh3 z6i)}yh#%)p7BXk&3+Pz9xsnCX(sFH%-t0W*-O(#~Pwp8mJFwp1{I4Jy>JQ>f|KNBF z8&2D+&SAI!%1&hOLWPY4!9H z4E`7UQg`kG=z^I$`5k)c_rrH0c-h@W>t8o;$8dD*b<<|_Ut!q-3bp2d+17cQ7VM4{ z?jYE-TaU>@hgfsirJknZQXq?kj@hE1%fYh}^>FBwy@Bxi*hAny6*>a&ieWi`=|n+x z?`7){^LXrzoTH_?Y-;ni36vZ!&4s9c#d7>&&_`yP8*cjpwa!MpjFCx)Plvq`-2-A5 zB7yaXNq#T(W%J=<17q2X&xc)6m=E-`^10=uuM=}BZ`$u$C($i~`xkZ#eVa3wg9@WR zLT5pXAZm0lu3YFG8`)>H@U>J68X8zcyg+TA2(6sBBo*>)OMx(&tuXl)U+|~lgQK_g zXx?PEthVuuY6IOoo0`mNL7`{PPX0##0u^446k$||Lqw?cl))>#EJA2RDWI><@G!lJ zo)=0^w79W^cb#$Y3jFu5RRhL~xfB_zUDdpc$(ViLy7+0JbIZ11oe?%$La=v>wT`+- zEi0*NLD%eP*kFWJ)trYX(Rv*Xg0QzbB8OJ1-U~w(!;yQkJ0h)49!>DAKN_e8@2vr4 zv@@E^y3cd7?|I(wPo+82cg?o$%>`Ld)SS~{2nsFt`2wJvB{RJz(R+o*aXYt7t3w^T zaFFteRewp%io!smShF0=&sw(jHwVgH&)o2S^bquknb?|bBxoCqOoFX#mi$g%gh>uQ zbcU{2QId+~O#s^k1_`(Qx$h0YMk_`#lB3Q>9wE~9@FDM9+I#`>4U}QNAncA+8&XQ8 zKy-kJr%LgqScjs{3!5N0# z2Z{QI{}ueN^~&4-UM_n4B!QT_nN#PaBs%VcF@?{-kN){->(?irpM7@r{6x?Bvr|2L z&olqo^!X_Xl*Dx?nwc@x@y%Zf)4uRtR=LRnHk&v|R?p0JhvI8{-@@_pPVBt|aRVU* zUX$OfWyO9o%=C`VpznOh^&Jtxp^TcTbqDtTtqxvC(_PWt^Q}FznN1~IBzM_Xxp}+h zWpDRYUUARP_&i8xP$jm@CwbtLRYg)5KQ(UtewIx$= z-g#-;%TwELJv8Tx(6VGAN0$^bd5472NNH~|VxLaqT5j3)yE*D?=;_u|HmIK0CCgkp z;T=M0x#HeXy?{C;&?Q347^rLc&^D|e&>AD{jbgd3@VYBnuadMD{Y49OX8hx(wi6mx zTC23vTQ8Icu*Q_{86mG5RfAGtNRs0hgODy!l?*3U$&xOCTa)It{ZN~Pjtbe@oQ4W8 zQQ%vlR2G}DqqS(wpx#n-x{}}14WX56gh_x1sPU%S=JnP<-*}*9v#pM5+BOd53_PDb zf428BhZ>V@6_#?f-H7as0n4>KzV|4!*6>yoX~y(xQ)5tB%uh&-s2VoGU)@){W(fsV zCkt9AMr1`A;Y8JGw?YoS5}wvv%7P7OimI9KeJ;%b1SV{crDMV4Va2E07SlhX{?v|+ z$O(S)SdmJ~`gHH@Gt<2ISf-VvK;^s^`en+ThjpBGEdq1?iwXKEzUBq3icLtryT+M- zmc+yzuO#T~T5bkF_Y`El56fEgTNsP0f8qKl7N#xWEGGd9(9jcHuZkd zQ9h#0w|W@#a$$S;O-w#D#;&+>UkZ|(Z|vK(1ooH^QgqFq&T@8lrgHjx0z)tz$Rh{J zpC?u1==sr%Tw6_O;?LWCFGz7AD>o2u^FKQxC$fSOWmJ%Y(L3Y(MM1N{y!_Ka&k#vW z!XQbB7$m`(AU$2_@d;bBUo|G?ypUDKEao13CAd0@)gVl`=(sU{Rsm0vEED3isLNOB z>tvq*Qx%XA$>l36;61dzoU7a5LfK1Kuav%tPtMo$M=8j~U#`utPJf|A3re0?;osD) zX;8xsR8i3%n~G_@BuUY6-`-Yk^zX?lT2s_dPE}0pJl&NqK-ik%8D> z#yZY)dChysitMlS2w&pwq0_|+@u+mQh-EeFq)uP2 zs1~GT-4r!112Jr3Sza?3WZ=7I6*L395kg)u47=wqY%Oq<1A$$8iM@t6LvExi!LUOP zOdh9rf(}XH9;0`Z7j(`GUT?I1a60QWY*w%g50*xwRUW7D?07rLiT>Lecu`NWvr<&= zS+QzIVX_YnDn$>}U*dPMmAJt#ynlE3pu1X2lJvV;f4ldthCf`h>W*hDVlbFU+|ymx z`!iGiugXkXbAktpsMgBa;S#lJij4BXCodoD;qW!v z1`|wmW?CI6h6m`EJdMAw-xh-l-_UiOCCNP9k_GI~2w{c6tZT6b%*Ea*z!Ys?cvZ~V z)jWKdlh%2u$+A}Jml-cD!|}TVS&2A*8d_cCB+*zaaH%^;9@azW%g$3xB&A7%ws3)G zXJ=;!<@NQ~UlUOfN>Y~aRr^6NVWjZv{CrCO@5P(f5dOF>C7FqGslTcoXb|=QHmUZ% zuD^R*gQ7Iw1g+6dXCp+|-_5VS{BlZO@&Z!xxW+9o5t$}9I2R?M01yRYl3%x7Vy0jT z08*F`z!%F>r;e-LoAIQ?3_)a_A^@*IY|4(V#H7VQ81Mlz~$!(qKN zH7p%=qTY*=l^-w;DQKT;oF#a=B@ya8=^FlZO?g2)x#vX3azN+@W{@;5)`X?xg=I4) zNO@g|pJ5C59m%;V=BAYusfBKn^6t0_3?P9LLPAi>`W0QqXuH-&#--YwfQ+_dkL$Q> zweuzJr7GW|j0jAA0~+#c=qNR{0-U&SNL$e0Ui#UX6|;-d2+EVJtn@NL7^dnolM+!8 zy);*}xK%o$=EzgXFOe2k3<3Y|(7Uvv8#iw&*w>@!^axpqD2Oa+q0hYf{g72F-q5u~ zjCdu)LKOx95D#_M2#qSq{(-7R=pO35dC1* zg-y6K0YsO1$%;8m*b~>nz}8E)Vuc6p)C5DCoVO*-Qw=hhumTtfdtb6bt;LJ$OOh7+ zjuny|f8$G1*Pv^?p8qKG1bitzP#GRKtT}g%T-|LPB@Qv9qFM{fRP8rN#{^cm5mljm zUZ(N|l&(w4zLeLxQArB6P%22_Ku{t?$lhVPyM;#AE|>mjWbc?z{81}<$5SKQU}X*q zBDkhfTNA-mE~QAg7l=VMXW3B20_mtxWYD@HV^aeKRA}=$-=pR_7b&}{W*L{u>%m6< zu9q?R%Bt)kSVdyJ4IQ?B$#Tg-E>X9OlAQpJM!+(J=BIsNL|wVx{ON7o{~y9Bo>Tpj2V2qYZYVNC%u;NJb`QrJl1F$^>MB4VL1npi zk3g7aB8L1}tyvwf5H2biv2`O7 zB%q(WinXb@&+loGUR?F&k2OWI`gvC} zy44O?IMz6`4=~&~12qBhY976ck%|bm-P93mySNbp@`o#9L>=$ieRyImu}$}3L$ruF zg<;{NEnvh@jS@kcVnzhn826#$9E@=uMYsKo%pS1hX zxiqh|Cvn@A7%>U1eH-Q(!6CG`Kdq5@)lt))#F(>MG~9qK{`mMWXOsW<+i#EmI)(rE&6D3h`KS4x-#&SAeEgR`z4^n<)vLepC;$9QUafBN z|NeRW7xwCJkwl(6`Tf5|b*~}u@w}XfVuDlu9I)ylh?oi5<-F9Flx1R8N`HW@K19S0 zg10t%@Zb`5Z2ZcHi%tm=0+-oK9+|>uo^B>Clx(#Y1uZrt)uyq{0Q?IF0Ap{^Kj>e| zi+!>fS1je#Y5vRLm-4mnVN4y2>aA9|Dp>u;;h!ir9?sAfSB;$%SWO?0Qf)HYbE1&ol&7%GX8Fi zz7bmqf2NxzQl%82XKFZ^In>R{BH;2!Q;LDj^U9o6;|Nq+NPQ8dKQN1C(r@sl>vhHx zfW8M!6_(jdR&4Gk=qTzanGusea*Lc!w-*|{`td&OJcgZHv zkS#n4CLX(iTLm&eCblSdt?QE+n`5L(|8Y^YK(W?&Fe%Ge38^d0;`L+L%u3v;UHR9X zd@s?%+V7W{KPU7_BP~?w^3aT>m>A=f1uUvuo{-rS6C2o17>Z>UE2l^Un2!pkCKv#0 z3b7(Gr)#+sCD<(JnkKyT)GjP&a;shiXB~9!gd|UNT(i4u&D@@HS%_-UFSt?rc9KzP zX19~BR*xk~H#rUG>|#KjF}h+psy zJ`?%E1=^}lsJaJosO)*i(~4$z17PQSNxrzgM6!IbEGPF2T)KFf*SyAblD8vM`%jsK z8>Z9-J~YEaHB7nzz&srY*@!I(Xw-T~cI^Nd=7lYlsH8}+hO4EOzG|)8V}!brHA1-k z8Sg?YIjj_bK7~C-aKEef&kb9xGg`(6aXkLBV=i~xuIfzFJe|-?ZM&-`86J zVBOT^P)%VYC7}&EqXahqTg_OSIwfYnhH{@{8D;f9S3kTsA$-cF=Ks7T4Hc%P50}-`B^c!wKx2@0i)0IfC z*DRUpGCV(_Mod^<76E9jD*@3~JjJ5|eJpYP6uW(BbRqOG}C&UF$SBc&zrE>m%6?;)bz{ zJgG$?Sl9rP&0COwvW*TGLNkGO=;SP6Qqp3B#a(%6f}t^#*56mP0xOzhfv|#MdE_dA zm7-);h+CH1oCI|n-1vk*V!{D%WlZQQ#B2zXENQ-Abq@E6rm#o;WHo@08N;jwohu2O zm#{1|C6HKG*I#oBW{U1*|5?>j$g|#yhYWB~tXN4?TGBxw*>9*VnWaNrV8Wabn7Cw3 zs|koThkO!e!eE_YjsQfdoRYU9(#49A*dQuHAvFXivtL7I$x@P5AdT0|G~^77HpwdK zZqSV0)EWOt9bOA_(Isn!y_Sj~%S&D`189KN!(pPU95;4z%EK0E#j_Wzlyy`l-e-z2 zYUxFrY~ZqkWe8HG+Dg%_7~mpGq3D}%o=3084*b+0)r3rj)avtLgi3lY$ZJ>)SCQ;Qi#iOpH{Xs3r zAN#Im^*Ug~h6F{_r813i#e$xb-!udqEeuiQ^mzDlv}-W zA#gfJ5)sNVG?)WIXdw_R?&%gcy12T8myKSyfd4VKeYAJjv>8+EpoU6s5ZJQN|=^n${SlTXVx$Tt3oK#s_NvYzOzi8oLh$ zbLZX8Mn-k)7dcIuymBA8NwHeljDU(A0cq4m7jE{Om36`XpuToOc)x|#ZIt99pXe-o z>%7r&w+S6an*z<_Bs(p%L2q617gv{>NgwATN4AI0#tCj{N$XT@kc^c+Od@&g4eQ`B z8S#kcsk#r~S_DIetdfL99wluybW0%DSAd?L6)lq`lSGQB?M?{KWl6KFF4C(NkY4_R!y3VLJQO&D7!5BwgZiYnXZ7B+1)sSeV<8$;R)YgSKmTEQ12 zJEmPd(rT9sl&OP+uQkk1|O+RB!vFhLY?M-)U65SH{}=`-0atw!$q z_Cz|n3zx>3gSb_)^Mn|PS{~CKzQNcL@T38pcRs-6ttfS%0!Y@B46}ifEiH`#@4Tm* zY0gRwL}h#e@631qP|yJSxZAW^<{Ui36%16?4!te~Ua57w2E2bHb%cQWJER&9Vq$h? zr{tQMVma=hn?YdFv=zrrSxI>&>$~)(`~Hq5I^ZrGGOf;i_^Y>W*$lYhmZ>_i)Cqoe zBk}D6(GIIFx9jDcykm*DV+C%2SMS#}mt5rEQl7$uaYAn+pKZr$f(j`C*2lT8+`B3|iI*58U^TO9=S&R={K!eY87dile-jKO zBb25fuf0oM{WA$xg+L+IU594(_0; zWDe|#7B2@&R}JLe(-qC>f=w*hNu6Not>Evr!3@B_xs2!I*LyzR8K|Jv2|*<GG^?_fKbOY5~I~^nkRrS9#dr4dt0yBu_b}g_MUqZ`r54& zkQKOEV>ul-+Y_TkXdiUVC!)!I68vP)9qIZ;?M%TK5i3JUNM{Ed& zY8P)`#*6m*=zte`-Ma=cK#+&&vowGe*c1cn*(JAZ6K^pfI!Q;@lQ(2BJFQUza{$RO z?t8QCrjkb0ICNWIy+d3ZC|DL(P0nptheIz3z>KJA6CXf7BX-U9mi+#`CK$v)gz?{{k`IMG-H_iPIFrrRLr;J&v)w z6gsLYM$OZ;L#Ga`&?pOA4$CN#dpb1%o+&P2cMwBB`k~@MrgfC80^oK7@zp?)jDScn zjrY#-58#p(bMkFmg+zxUUnvP)gM{UxBs@>DDn*|ukVnty!%XQ;8@PVe>|B%4VV#Mw z)`KqW07xCM(XB}wlE9$RNAimp(O?3r<9Q(BTfs->y)X^UTBAu*Y5JDW3PxTmX`Zvp z!5Bu1U2mUhS<+;Q;U1JIPLQ$kNRp)hZ)vjRxkZ1>EmCwKLtrg>nSYG3J+SKPkuJNc zw`X0q6pwvfjrC0k$OI~dwcoD`%4s$LQ-hZ-o{hPMG4lKD`SyL*{=d37jdS^_( z;HAswq{^L)W~>9b6!#<*Q42f|Rsauu{<>d9|7`FKp*w%V!O)N_k|Da%WBxC_6me+<-~kXIZ*=YTd; z9$C$JULzRR3lOqhsdHt_6Oxq(iv_R-qFfTmS5;QhoQX6_4?^4} zYaef3wvd>_6SH8!xNhS&t8+@zQ+xATSUC2cB^pj-omC6o3;y&$OTE`st1Aik)&8Y) zioEZ8MeJ66{nHc!ZaOQkla#Gl9zd)TIr+BUr#K;d&%G{D^~+ZwJ~G9!8aIX$BexV; zDhYdE7S#LkM66aykhS#Ygyw$M6{R{HN*G8#VPQZHF4%u0-7@|4EHr+O(=biS_MqDR zA&P4%r3IS=W~@(^Y(hCWwer0ro4sq~t2XQDw`=BmsfOz5%Z`HEI2wOv^+>%y_+xSX zPrJDOLsvGR10-!+MI8NX%c7xw)IyeHspz+6^jI+Tnbo(c0c$fK(719Q?pEA!ld4FH zD$n~DElM<_C6%lUnd6%BS^bXU9_|^@f5P(oDWL(Dq0v>zu>jSQ5bZjoSUXN8f*c`EuwqsdtPZ2>;!jst8XjR21QVuUr)jK39C(}FS)#pt1z|oTJvcA;l(SWe~r{!y6uD^Lt#HzQDdU-S?y?%u-ZA1a(TN? z)vDc1k8ORy)K;jApLqA%MpWcpLuhL~<%X}HlUKQ{3Rc&hkW1Nc{w+6#wQwJ z*cNg!5BZgBi;|{pA$JFUYb%eC)0Ewv%9Ng;Ko?^2QJdqWk~}_tJSEqB#WPxD2zh03 zzsz%flej2sN5B<-_Lv-t0(z9toMg;EXK4JD{cOZ~Gj6i3#)D z6T+Ga?x>w*Dqg;0>)s%VmL!D_x9q>XR6hvGp-Lw$2}Nd-R2lX8jnMi#B`;rHy?gcI z;^x)M=j0Fi3)~f+r{qS|=3icz}BZZxy*TK3po2_za$g6 z4#iefwY7S|%M+CJ@FVKajjwo!LawV49qV+`eMB}}-7{WEu;o<^^bR_o>fiB73L1)Y zVeK?T6j%;US5co%kERewdNe&Uf>_4&W$7iV@20vlZiS-e#+wrIoyocJOKg1ZCh9bB zPV4H79bX9X7O-1YGq<+;AtGt3thxY_aPCh z71mo>T2QYz2uI5~_8UW(vj&$w%w4h0&Aj)>w)m@gyrrSqpLM33KXd`q8sJxhiX!VG zQqmwE=_~EjcIx!qtBaR!UQJi&J}ipm>00pIpE=qp5p7;Ed&m6X)T+`5Lw=db&SNRo zA`^@5^1=fq;&UvNFrgDQ!~3f><#LEdQ!dSf)FZRfe7TH{f&9e>eqf=nJsTna#*E>? zf(m%$(y24GX2ptQ#BxJg^y^5ylH|ip@V-K%J!1W0W`BYCARAO1>B_UYn`>*HZZg4j z!6vr8%A98m@TtvR+wZ&0Yg3Q0%o#f#zMXAap?opW9tLs;QCYKWQCnqvvYe1!})mo-3^qc1%L70ijL}tXG;(= znM}Z>bo{fDnbYhE`7_hs7f@@r;7LjDm%S2M%ql?N%yucH}gs7?9!fl*r90A+qc7B zJ790_UkRDvJdmde&yDr9OYMN?WQ6lo3 zC84sgaZB>|c(%v?p0_NeIMn}L(F~{W?IFy3&FPQtUE?*=(Rvx)T6;+)1JPbI*CQ(n znoG5AO@GOec5)t(<1$%${d)(`fyt`e6<4sIH@FT{oV- zXL62pVL^L?)_5H3$|L2hf%+K8AbY&MzK*VRJ zr&7nbt{+mn=*aE+dh9$dTX~$m(2`rr?DSVC^Im5Afj78uHKs!oE6G47^H7(X$XrAF}qcRuj_myBK`gsP=Vx|jc;hFM;8vI6HGm;s@8LxF; zqHd~tV0w{xV|6z^JF5(gaKf&dP+>(3QFq`2SO%{zslCZ1K0sAg)ahSs)ePQv!5z2;aw8G3Cup7Vk< z3wI?imOtQ%9z#4scbK`ILrW+`dxgzp*P>+0zEFAYft)9q@<2zB23}3CqynWn-{nv` z9I04!rM$8i^p&-~2xZ?t@K#*82ohv@ZB9QQN>UkQ$ugI-qDB5PHTEpweTvD`>)&`Y zh$`+z89_*hKc=XG#C&UWM>OkWzqQZqvS#5;;$`i zeWk+WGp$=MacAZzU_P(%J50gvbDo0Qjw?W`JL5o!QJ>N9vY<2eY-A*%2z}N3Aj^^& z<%%8guFj4#wNMecS23&%=1_s3uaj@XcKE#IC~ zeM)V}VP@PTQAZhO>t0-L`l?Inag(BAE7A!2jWk4^h>(!Z$lQxn@7$Jnxw(b5jy2Ww zeP;^nBqo!3uaF7dRhXZhDL?qp@4gDXN6H592(t(x#T#{Db zJFnn1EOC<3=iG6xt%^^X*3*g5NeP`fZwHhf7M#L>IRw+EmJYXW8e_um?*(##UJrsj zf(_9ea6gj;5N5|m?=dl@Dd=qFNgF8yLzAV9=gsRpLGi2H(oJ*|h=jR{iK*Dy{t5qQ z$VQ6cB8z}55!+4RfI*b)9b>PjS=kPQB~WU{!-D(&YleHbKCIp; zK=vFemfT=3CXw-?Q;jQRUPvVi0{qP@fp(7%5D9Kh@j6=1g$LY!nRNi>z{_%yggj`` zNYZA*47iFQidrxcGjdphWm5!Eqx|$S;;%_e_T16XMsPnT`BA6@9oT>Zn84#+&GPF{ z2sWY~5&DT1%_6GMvokHJNE%lX)v=2sO02}S#@#LQsPB!f+I}02e*^g|4AGP*L*B2f zJT?MJqV+)H;%h5Tim-w*BUc~ggM{s&&OR||6|)nOX;6JsIp2H5R5F@jygoarjC z%*j$9R+6`Iz{o%fJlM%N#5PyPZNMS8jF2pOal22SN(xNi^O2Pk0qej=vpC)X&%>k^ z3Y|jH0b03_M!Z#c;o&@s7+?1j%PQ-=%Bsd^1yOzMo4{0|tdy&%HZX_SQVSy<{{^0W zA+UeIfEU-Tx}rFC{7$eV+6!37d)79C!2o4*4IbDt&H9ABl zQrNn~qpnB5ljr(t9TsQ1(8jf8Jx>yetUuhUgqGRi}uTC1qSPx^nnNU@;_JX0A zLB`SyE`Bbe=lY#y<}oZ&kp%!j9Vf4)q?lqPJWRf1H2RY=&rX{ zm|!c~gH{xTg*&=xN3E2PI;@`5%q5IiB5w}4nm(3{(uMljx5CnOYpLl(i5I*4ej;RCP5_sOUUnmxiuG{-~E?UmwwMq7IndaVq@O<$hmsItRrj=rGx-U1{t~G zpC8zf{eo7LySUn;FZ_aaZ}X<1O9mWfWO2`r(Nx#HVxzy}FKzy}hPJHxwN5kDCsK_y zXd|M83%tU2Akbp1Yd5b+8_titxE4;q8qFU?f`wfIMt5^w!!K45vV~E?CRP!nXeDeB zt7v7My!qdGq?u95Hd={WAQ_9w7PrAFA!rFB(lvjxPboW-?$JAeq;PTy+i{8rNI|PL zm=+2Ec)gW&cpa(#y(p?boe_r?(IT{req1zLBS~r!;Ef)ZBT9O9 zHX@lc*D{aZP}=E`>b30or%nVGO{R-~JUSP3zs}iVG6M6Jz_W4`08>&@Gi;^s#MA|D z3$O5-TBbY|{D|UkB5h3@03qq~8;-~RoFD{yEhJ5={j{GinTx&%zU#|aK!I_kcp5%C zfgL&LHuV^J?|V|s$jbPov>|V)5`wckvdrXYU){uLMa{%V=Eg(M5|K2Dz}U%$l{Da3 z!|q0;y3&7C6xP)eB`qk&Tn(Wd>-HKAwW#d{b+rfDr1T@e4%Hr*{7Ob~Xc|QLFi{VJ zLVk6_Hp-&|lo#e%98y2pKkcCRn_IWnM$xQ;)^pN~jgy54Dd@@hjA$O47UQEu@gy>X zxbKa0nzkGlqB5<_A=fp1oNI^Lx8~GHTe<}exU}%@H}uQwdwvi zJ$Yd=VRst7R8}J^gVd&%XMNhqSO_RHCw0<`G!hVXdj#7Jj2LH%IVC$i2Gypgoft@g zgyZ>!*Y>fZ74Z(pCVp~x)EJ=msLYO0p6<@C!#Be6i)h3Qqw9SdD80B7?T*D#?cN5- zH^Zcp-K?wSs*ci`RjiWGlp4mRhRS7liyJuqcc~6 zxx6f6oPth^jWHoeJV^{fo{umERD?QAvh@XsRP~+uYu&KlaR4Xe)p3^Wb#Ecgd7hLO zR6MPB;*$EtTQdV|t53LR<|2skIcGUp^3LAT>kFHkOa-5Iyb^Jn`Lh|VWCHb(r)uI7 z6v@nSi;!Dp1tG(Bck~Z=z`)gN$(~`|Vsv~ak-SYk_E7}ovTgf~axHQt@(j0fT zX3CkF-3uP<1aEI`X0#N16v-Mp2=Rn(pf zoEpG`cScWi#m%+h1q%P2YP=lFipTSwn?_#))|%J|)0s`X#b&G_sF^U2aRwg7cVXOY zL1cpWCNx~9jPTI7drBY)=l}`0xIG{+$lA+2xaB&6jKs!bD*ilyb;bX}z)uY7kKE>i_WNAFb+vbrNDdGOpAr-I>dlS6KcfCYzh|R?H zX|UoB%%OJf$Gsn7y$R+3huTz+@6lAYC{!&d6#M0~rwrJ4qI7Dyu=3={^B5ZsMG2v< zXB@*0N+1)+rQ}UOE5$-$<=f3lc8Ti0qy#NuBg6=`10Z2S4zTs_qiHX2(NzPIr3LY> z_<7abPsCmidSXmF1CPPDvl@+O{@R5zFqI8roRa)Q3aq`E^Cd)WZi^u(PG9DNDs7l4Ix#d5aIDI&|O9%9x+vZyw zg)ZNlU{?WK-^b2e0>#3Nt*h(xd=$AxsmIgpweiZ=wS?xsbNgu?T}6TE^l97m_P68^ zI4$ky6Dq0TvYV}9GXMnx$FRY%)R36I_H2`~f5DdEpvb>@vV&QD34yE@9mDTt`LGpw zv1$FvFyj+OkK^!+d7nFh$C(7DY z*4AY1*WJ-UWc^>OKmeHCiZVWk(kqn)Qzn!CyG9XxovW_+7n+@-EnBH&jp3?bwh1_uhmJZWo{;}4xiC0)d(=+m}u zXey;6MR<}ESwZKD8GjY+lfcsBN(5>(I!)4=N8l&5PBkL{*f4Gb zBCbgthpzH0Fyc%9;%c*3KO_nG5 z=Bym5$TGj-N7v1+*syiG+ouGDLfm(vFphv3wGVz|=SGyA2r`#)V^O+(&GAJn2x4@m zv&Xj~**`Dg-Fe2IC$K3h?3>1Y^_+zEBQ03#f~n8iuCjld$^{I(Sc@{a*?z1FD~L@w z!HUb9$e?;5PJ*u6T4MruKMQ+JJjY4hYEq#_ed0@g_}A84m8RsZfBb6e$mR58dR|$k z-1I+u&}ue{zRD;ETgy8?M2j_o2fiHGu9Le_OTaGX{SJ^|y!a6ND~BBTce{IY z6Zxq-9#5ZGrJ~9FE8vp(7LIvMVopTNaf&69cPz`u9#+K&w@oA;L-=8W5`|1M5<{w7 zrKUEs)zG{f3_|2h;ka>uq*ctE>OpG6+#laNX+^wl?&`xc>wj}BSI$G}P}N_Ad#29f z84R0dh5SnwgqYR-;yZlXrudbabc9^6)@Cv|7)eHfK6+*2vE5yj#=Z_dXoJJPMhav6 zwD)kq2V&xdq4OD(9ytzjL%p#Ev0c{0gzq5^ZGa;4;K6??+_Nko<2iRLhsBl$v!!WgWM5q^mS|?)gb15G0)Rl3N~$Q2QJdNX;q}d zryoaH_}xw(ewPh7KkSnS`OvfB@e=|wU6qqXe4SMuxHSUJ1lG=LFI5IeIMO+r1aW58jGMZZ}n6{SmpNDjMaV z90EYx%mc7?BnQJJb$Y$;`xN_T7WtFJ-A3f6!A-Z|a3a%@SVOh`-;SPD%h)jd0 znyIwDZY!rLwzYsRc86Q6tG>=tIO`{Py*7B4l^cf{F{bakr*}sE8u)l#L{59hw3E9i zq}qWyyYLPYW9qA5I`N+o3|Gn*beocEt8SQ0O0+%0PwpJJ>dQ-$dWMhA=*HC5j`{_Yr>TRnm`-{bn3vWuW|P5 zl=zYxxdkSg+<34s{=}LvpH`wU7$Frj)GB99nt}I7K0*{Ib~Ksyp!_FU81_!1G_DsM zD&6+c737vy-yzdijE}fGkZLDhzs5A%vpr&?0PgSgM{v!>MyuaiF|GD)=wrw=7RbE;I=U1?}Nx~dHpMC!9hu9f}xlT(+}h>eR#s=>=aDrmkc zDMg9sO3oB-#sbmCV^ZnKN`tar2}s2FZ88q66Q^!T-W01e8H+sm`pc=$61{~2@k@^} zg7k*tZ02DIg{9bo73&bM*&exdf|QK6DB$>NuFk#A%&gd&l+R+rrA0o&29b`KtS3bF zAh=k;pFuB`U|L723Mf*?{#t{aETESiH*l|!HMY6I+4c_6bdUq@dIJb(3So*wwuPaH zEL72^p->HUa0tl~%oL0n7@yvQ1WlE#x{PKBio#0qirmEj@vmt}+n1Y0l|`2>bs^R) z(S%%&NglAc46!vU;R(IQ%P^m4Yq`7q0&EM0Omb)5-NnTXcM~kF}YF3HFL-K;?rFA2`<$N#S zC*{8?i&?nIw&EY@<;JTA=e}7+a9L_H2KB$$c5<=lFMc>IVFRRzsP1Gh3AiY%E81N) zHv4-_u*ddbc$<5CP`!rkctDGooY1?2#C3I^f^O$(x4O#M*J7}@+jW2D`VR9C^p9k}#T4vdO%+N!NcGyraU>B^+V^zlE%7D{RaQ#UT2R8})lV8gi`tMyXFhU%vat?Duh;c}tL zL4pNNY)I5RMB`ZCTV>AJQF3d@;z^D2R%$dFah7-oDX6B^b&akS&LkW=NxTm<>P=c4#ct-}R(=`RVUc9Xn?G4NNh8L9lZ zRN~sM@9J1J(O$Cn!i9Ia8Y}$Rh}~KAE#!PM)OGCILQYQ?@3AlNzQaNB_ylxL-O;bi zK;42h^r=YrdA}9U<5iJPZKgP}R4TrUo6st5{oD(!Z4~xC`ulrbna?fv&Gq@ZoqqqO z&3yiyD%0ox`ujO$J~x}o_jS3kM98Wy-KzwoXgsdiqi%^*@;4DB16IP#Y)_D&Wi<822Z8z@f@VC^K-8WXQ~H#NZ%~}&I6B+oSsS}N|pONjNmAE zICot1d7T{UFYYKu?lX?W0%TU5PNTu6N;Fb^s5uEmV8`d<&c@51m&?EC@U0b@NUB?t zm()GkD88vGxUJ|C`P}`NMhP3o(%)x0px^K!Wq*C&Xoj_8q9~NV>=_f$FO= zxR9syTf*9c>6fDlI)n8k=G%+{Dgd^+r(-!I^Wd#$+U%hJM+9O2%roY-5ThBgRE34? zPw35Tf>fgkHTE9)uk*6K^Yh@s_2_K1NBu?L3!|9X$3hCoRAKr6uG+rRPB^5ggU5`2 zh1Tb*L=G$imfZ7g`TJu3CRIMa>zt?qmWq z2FP_^7Jug8{3EvLrZp912A z;JL_-6rwtjN>w1cX+VPF#N;WF?S>kw=cX9rjO@|P3P8;Z*)#vv_dfv)G7zJd=7PBF zOXR7W`5X^&!m{q;i?N_jH&GW$=E@*FrOb|NhT-?va*ukyq|P28txDmP-b4bq9XWvx z=He-!3mj-Y~& zJUrJ7vA{E{{(Y=}%<0KsWP}V{@rRLrQFTwLzghYHK?{a0j~A))uCBCwW^aW$H(cnL-PhBggL9n7i;VDQk#5=X zbdm6EqWtCBC;iUB>?t|LvG*Jw=frs=(Er?PX1D?%nc_GJMKuD31YuOnKT>*)N*c0V zVapBZ#BWZ4d~2m1bN9=|%K8NH%KWk^7X~+ho2IWjFOlG?)>dK_eoO(y>;x&o52b_v zRnTc${~2tBd|n!uI)k{}mdiXS$9P9b6xA5i$qDWDcXC{L#G$S`+gFRei{1Z-Z0;a- zPB=P^Y)9H)O(vBDOEs2?T8jSDid$bn^lDk*ufkCX)B&81Qu9XHsi#{WK@@!}Z&$`1 z>Y2P3?&2`8RHYLg_(8mF=yKR2SWH=2p3b=c7as|!>>`j=1o&WQ<9&!2T0nS{p7nGR z|D-_L5{FalI#<-735UoD2cLRSuk0)AGW`Xi-?R5QVn)LwgJI@EVCG#bBvUFxA%7sK z*yGcyu^8sQJo~a;tyvU{{}#Fsi27ZeW?y~`2{j0*iUl*%z@*_o^*lt8TX9QOiaW9s z*UK1pv;)!8j0Sfg2MX-nwYxjy-p0(*D*wl}vYC7*@FN!shS=llpYu|R50q(bMe<8w zc-@TmQf)w>yTf3#Z9{5iH@Cru6qBxCM=z)9(a4eI(MZ$YXAHXhZ5!VCVFd}bP}eiC zBkod4!j%Db$LzRkr`W#<=bU;Q2&b!jW({NW4@ML!}4JQ5itUF_(uNx7b@{Q`-JJyxYTW*erB2Zsc z1})E}u%Tza2v{QOZ6(i{C%lu*2TnK5uvVCg5T&>7XSo2DvePH+38u9CxN8bYbP3Hh zggYy2Kp-K7GI0njpVB3XX<+GtimTL@apFCvG@In89KZTcm!8r_lpq45IMLMb7kBD| zP|jkx=6ma#9ITv9n6kBg24vEC4$&viVKl$bPcBO6`OPnH)j`n@kISCPzdDy>LK(cA zOVvCqyb1IvdrX3;Ir`=Am~I-90QY*BOWe?44lJhJXKb{4nc_$%ljFX~kC7BoV!5LF z@9Di1fV%kufH3`{Ht&p0%&h{SY`Gn+rEXY6WhVW4)s(;1x5%oP8C%>WAp&z|dX?1& znslVrQnQiBPwso~euFkC`>2dk?I{9pK@k^8U{W;!q zdm1|c=`pTH^z04a60+ZJLuiH$=IGQjhd2l0vz9coq2p;0@aQ#IEQUVQ*)sK&4#+ome0&&3R3*-2XUnsh0 z7`CJdnaEq{@Q=4{H@IC;uC2ZF*D9C&zI4IA(8H0HY|(2XDlk}(mn6HH`7wNu^Dj;9 z*FpQ}`jPBS=lh!6%SvBFW@Kh1ye-V_G_B5ITk$=XKM-FO3dZxq^fi$@aU%Vc`V9U| zm^{haSFVq1Qy$!m8_@kBd&N+Q!XSx{!l0awO8=9O&iLcz9(pdyXa3^5-*H=%8^uCW zBcf&c)selP*@oN;=otTRm8!-HUsD#xC=fUd^%fA9=-P*kEMyh8`PaRUU0(@k>^nvP zwwLci0Vjc;e6}bdgwXxjOH)qHH^HK<1*t(QT?VV?!Sgkf6y%R&8QNm>hOj^B{-oVm zG!vjSb85U!NMf+XB0U)6YHUsCNJMb#KClaJLFS^X209cC2Lsb2X+Bf&+4dMDQ*2@l z{+y2uDx0B^c5VA$oxB@Yajy|XB*WM&Q~!S%6v zynZ$00EEt68eHx*B|-bG3MF)rQ1dE;Y!q#YWzpecg161cOUj!id*$d7L^|JM9i^kw z*WOKnshpX@vkIO_hOPfI_5Mv7zz@nGzP_ zHkwEE1GB+9a}I>DmTtM|nZ) z#yW<-pJIy4jblTdg}`@OK^9RA;Y?l8+{bZKdo%6Tr_64#;3LIa+|ms`DCZcTrE zK46*eMB6I4|Xpo-w-taiHF2Spi%yUlWcwes1CV=R|-qu6T z(*=I=vjIIXaP(LMX0e!lU_1;*|McagBUX4%w)ssjrO=#2c-4vGjvUsck#_2qzpe@Y zcF0M8i?Vwwazj6`gKU=#nKI_&B4)xBA|`{aG3P)wx#Bil7)kkatP1&`#4bR~+-cvX zd)Y@%c8{zR2BT(pth#p*na^ca)mWz9k$SX>1ThAFg+`dejE^a4NZXhWG77tD@PhRsk!6IFfi6!P;eJb zigrFm24mZug{qXQEhdm#>LcML+TyV8jAw5?>`M|)DQT6^$@|B3*%bx@=sont%D-sL z#KjkHtqv9ekNS>K8fyGL8+2;?s)0j&KQ*U)Ra|_9USOf}zeM11BA25DFOkW{JQ{Y{ zMx!|4e)o2KlU+=Mzw6#@#?`ibP+@Q?QH8@ zob9~&$M+EGAVI_L>-9SkOW_SwKVqH)hFsoo{%`{cUBVc7b`3!ru7vnQaxM}64<4BTC2PLEQOZ|#d$zL$DG-Z{TnVwb?V;C2}7RnpzC@P0Ngf~_{R`Wak3FB%kbNiilo+Iu{ z+v~+w>64Ra86k@>aWi0bm&5IV2KA{>_=hYKCk`A@#qaGp{Tj2|XAon!)YZb$xn{Vq(znVHL=yg?Vo=-j zYe_Y-ul8ZKUf5|{(orWL3*i_{Mudpdd|;&vX}fI&>Wygo030S4#(UW_^%dHURQkGF z@wyQ{BKt$D4@I^YiIltRMj(PNxfT(Q*zy zOyYryfmvw0t0K>Z3R-(ZPF613yNvWBEcLb%{;s$x+W897nVuhN_T`zK48iKP{DpQt zRf*hAHnlJxy43H@#wO1vmBvzWa;aG206)o<&`d^--6aM0FZO>jfAsmiO22)+pPHCo z_RP)C%=P^oeZM!}(&ln=czxbin#%Nj-Q2!c(9QL|e}RNmVEO+8NFb~F1rpG^b<~=q z8imXmWRM%25{1Y^1Kj@?N%))G176d3l_9BAZ1br+&0&vB6WQBpyVdGj_q+V>Jv#BC zZ+%9>{c%`PR@O=F%yq zo}gy8u`QBpQh6X<4Y-rO3~?P$Zr?;$5e-UWz&DjG5lj?C90-R|u@HXWZya)9s9cOm z+T!;y_BcEG*w%JN52CU;uWtQNtX!BmTE)Sp1d`jo!HHL5BT3J4u#!ET75_Tiv>j}0 z_;u(||M*)OP`(jR48L2KE1IHTlD8%UT_YO{bspWU0mPUSE@ThuM~c6su*Vx)H2kQD z69u3`kSYL~HHA0Yb~sgaw~bI+Q0MQVE(2ewTAABAd;8^lHiW!Y&wo`CtXb%6_)_WG zaJqh18*}_k(@7F8JQ;mGbr|XdF;PW?RFBdb|JZ8mXJb!Ua@g4Eudf?JVA4QplfwS5FG;ZN<{?;V1dr_#A9g zo1wMW-eU=Epl-@1VkVo1R>bpOG=KU88{4E}luj62BOGu2sKZ5e-SZ!!RZLdFz$<)8 z8`cPG2DN~BcdHN-@k{);mZ<+wt`xe!zo$k!mu`THH+7E(nL{2>N6JV zbo#x{tZ%=eWy^UMN3mnh3&}iYT~M%4ssHq9h~0g9g|jwNH7IpE0*B-&UzRVH7HBGN zWbznQcX8>DmCY0~z^4^mX6!oh-c{w_zMFRq^5(bK>E@{OEw{%-6?Dz^4nX)^uj#-fkv8`(w@i)7)Asqh92`yfZL{TB4*+v zh9w5D=FK(cLBPs>*wD9Dw0mMi9T%k7$<jvTGWFc;#=mdP4nx3JvW#9~a-c}BSsR>&lIE*o?c*Jg(Iqld| z^vm1;NE11Tlx+Io(rAU|uSgKfZ9F@bQAm2H#GCceAYZ1$K zC;h_aE^FyaR6@DLQ*6Vr%HrR3VYlh}07xy*oRf3Na0{_pZ+U~Lv>(*7zkFkXwUcRu+yz_p?he3NE)bG7Xt(>NYyk6&N>lhzjRtle0ixY_L&&2C5;Yv-oouI=BxT90f~`L8b%`1%h?r-vW_5TajCPtlvWt0|gxf zM{oh7-i2`RZ@!_6^He|~Aw5raGMONFrZ|d6g3|ZlN;pi(IYN^UDNmEk1`UOeA)p_?_}}%%`_&6$XcZ5C zmkbMmARMBFimcAa-;BmO002CRy7MCtG|a3ANV%igJJZBo9ra)oRs`5Vkm=jx7W`Wa zcv#&i*9djh-cBwLRWxzUmDJI+vwIRzW^p9msWB@J6#C=3O($KylD?sYK?IH+0FT{J zENG@BCfjo8KH}hDm}yi5p8Mgb&H5mo|G+1bN=T5m>-O%|^{@#VP2;S(5PT~|k%{kz zJRL_ig@LXDf>`c=D-xQ@7>0)R7`p(hItgt+^O4 zqeI}08y-&adI&k7j6S;brpn@bEk8buLV@n@fgAl~(gF{%?y>KQuLeDcFLkDjTLWKY z{Pr0GQ-G|=`eB_1zu001L658R^5H3Bu*=*K!@Er;glhX1INl;0V6}6+dexO#?8AtqB1rt zMh`egBI}r-FTU`W82=GzxrZfPOhro$Q<{pNz#za&KlBMmdB0WtFMEgl<|g#AK;&8% z><7~lOgg105%#Z=;}lqRV|QO!u4=cX)}I;ME#BlVvkttw613F!;8|DEqk1UD8z%B0 z+TKdJwGyqkt<}@jB^2?iKV@NB+?UdZ72V+#{x}5wLTb>AZz(6X@9cYjkGyu31t7%# z;oWXQlo$PI>>XCzKFxWj;dG2IIMjPN3-ZidAbO%%JdUGV$Oh4n6ueC#N>9<9Xg(40 z#wU*s8{dz^CvxS+oVFqFbT3pisE@$ZiF2~9dwLqVzK%i_p92SYH<}bl@F#C&GZxm^LL0^G$Ks_>MyD10PZF{t^2nX@RMwn}OrG ze%O6ot!fS*ZNuiWKCL!~vJ0x59Tl-0*YuU&7dhNgb&Kcks;;{WzCj%Dh2}Kmf2qI|$HkPjhxC4D?GY0R|2z9Z1CXd-RB^L*RJeY|$;y2OcCA z7zD$(U`VY}($H?f78o>7qun}jpZ)QWrUAL7Ee&D{CWg3Q_m&qJc948cxAs#GTHrJhsg*pW)m5l zC`8sgh_Wf^o<)?tj`$lsiI}W7j>0FF^%a)^9*M&#tk{e=UJV38cc;QQPE=`)mmVo% zTz7gzQlM0JVRJp(IEAyFxOJm+HW<$BA}iiZI!+|(y47fg#EFssO=kBr(@4Smj^8dV zLbfe4`$??$&#?J*oyA&ut#gnQ`x=fw`S!wwB(?>c@Bq^bcE{;MzU0>VL*^3{443FT zRGFXPw3ebjfkl5DWbK~<#c~bbFQ$Un2o#qX*5D+AP77w4b?4D1*~Lvs zcWqD(PbXyFW<7pw(Lc3w$_>3(r$3-I9vu8JqJL_97<;jy|83`y8TqW8S+@TieW#7= zZ5D;8%>bAHV8Gf4YECP$FLs|H#u&oOTe1@Q7)U)}UUTBEEgAbU%Kb)UGv6pMVOBGo z4qL>cjP%b_`*ADxB?zq*8IDl|on13PL6X8AZaxPbl&5?2_6pb(V6mLS>fGDRBqStPS*hYw$vZxn`hv&-VCz?a_l8Yp$fn=vRwYkgW{i6ah_%j_b)f)wd zRdyE#hJ_!70Lp>}48tc)qKaAG^6?5%*Mi+60co5cjwZO+%5BG_PQ1Z!ZG4V)&ZD#QaXQVnc&gkSt9Eb)VF`d`3h) zbdw$26=!K>WmP$Kr22mJ@v%Mr+G$;wcm3qUtGM*&{Kad@#GEws=+n_FF*P-D|G{Zl zc|^hSWzyBs`*ezo^A zc*$r*Q|s;YTZybMKnbMXkHU#MR&Y#t6;P(jP5V6@#zy~yl4KPEFLXgb&(yk8WG-IO zx)q)2om_Kx#kIh<#;SU1&4L?qR)VUuzuV-a{3(`ANP+*aHyqmWE@^9E)7%wpa(zD% zgEmy$|52t0S+&CL6Q;B??P^C9`P)jwSG-g%2U9(jOZ~LwH72_ooyVpou$DjCAcZl5 z1S>$s0atL>TT_3g=eD?K3(s{!%)AFS08KZ#*OsKT)WrJX$8F`%l^XK#?{!LP$WeL3 zS8jLA*ORJ;nD^Y5fzSA%)|8K9PhC!BaE)E$+rh>oUH!w#-Uvj zZ8(Xgv{X&&_(um;9VDM2WiCGlZycv&b>Th^3X+S0M*;D%CLg}+x5oMUo_g)utu5-} zb7$xPa6W72U$F+cg|)@E4zHVT_hEz!|DrmFsX~7hA$n+Wq@qc{~#(q!k z6*Ucg@fD)9$M3~m36E|UKn+-T$FPz({jBUlQXKsR^Jr{lt0YS))ZWO6r!H%0`gInE zvmDZkoV;MGm3?4xyALc73vcFH4paojZ2`-2^sk-LF$}y=e?1%7w%e9rET)*+(7G&( zvU{(k%o9{FeMry}rtQ3`bp{vdALRdAK3v4O4jJBLTB)V@mD zN_QmvF%~bZPLePJ0B)D;d(Fx}BjFh!<^=%!xDCjAJCJ>5qFi-!XD3S(s%JFsYQC{cpBeh9_pz!^w*hz=R*P<8HNttVarMlR}6N~@SjDk0#cLN$fYUG6jx(XBxGBB z3g~sbGI0u52Do7;Yn5I1)4m57Ou|12hACwhWE)Sgf~6^ncEDW1s1OQA6>`_E!`ktM z7_U)ERJSVhTj}n7&inVRmd)b}_v!J#XGvvy&hDl;#D(swDFHPbm8y_4pBb6t40&O5 z0!1vMfKvYZF=z~SD6wh~ID7X>g@e(+0Kp1Y(KZtLr!fMrI&!94$7ZG_5Ui_2W80Wd zJcZE4d&HRNJTjY~#sWCl!^XnpfmgYMH=#0*s}!tlI#%h`(BHUsdOBFs$iaVHA_}`{ z|HxG_=NP*v!!>tXd03-4@=`n%r#%5H+G|a1CQ7^p3kX3O-?@$g-5?HIQ?srL(b4Aw zr3BZv(f;=seG9XmqSLfJ_@m7j;H*EcYGni>@AjRBs*p(w=FOwW(7px0CJMBzfO}Y?;yZ!_LD?NyEN)kE zZtsjUjRW#_9!(feB|8@FonU$HC%SIiY*CCWfw(HDx-*?3TfmZ|pmos9#rg$gGrpLc+>9{^atE|l{{?_O>|k!6+O;$G1^o`L!kbVJ?^ zSVe<2x$9s0`@|_PPfeo`s5zy~muD?#469YhsQ_Zc>GacjFok{Rml2^DnnDGh4^X!loF_D52hNZFFq;D;!xM)j`6s)3e2$2@3Zhx!A#AiR~P^Gyf&R@41qh3Ej0 zN2NrM`4A`;<=kZvFq$Db3W^MH-ZsRIVr7@3E{HPx3b$GY$V7UifIs65zthSF_QheN z4BpoxxXDoT7HA6pe*jNFu)jrefGDQ<|De1nhH0JxIED!U(>Kj>Mtnxxq}J?kSZFv9VC2mGCe=TOI(3b& zMrhK!Zz;=Zv#Ka1((t^Vx&sd{IOln%D~uu)mJU(Dyllpmyr`QMRo~gwStiFwMBK}YM5o~7C-__F_!`6! znqWb(I$d^NGwNBL?;-*e-^sl5%ze55)5-kM(L8mToN)k-4Fe^8p&>`{$R1_n{#UHu zWq!8h!yl8?vg=X?l=JT8m0@LaL1kvK>NLHZ9o%v_T_dNIhSW+`+MXJU>C9u3k%$?( zwK{n+exF+PI)cMkq-Ix>eJ>;H z8sx5lHj#cL7X_o?v3!mnIz5I3e5VYELTHQ$MXM`st1Pl&Se9eBWVG${_!xNPeooaM zYq)_VUJNrmtb*tO0xBCLECJ^*hKMVZctU|F<)SVUD-|s?%Z*Zycw#846*)HQhKknK zh^olul73pxI+HeRHpJTWid{FBc(cLfCYwI&c3LGXjV``nLg;3_xK~7Tg)r_fZPaT2 zz}hQ)or+Z$alOr)g?cNP;`O;+oXeHG&I(#Bwx6`R+7&zeifCQ{i5nAQg3h$C@tY6t zwze=>R`fVQ6C$Q97tzp+m~mJ_5WzE6pt~XXZR#kdFZciV@6{gKxKBcq1Nkytb+AV9 zj=bqIt1l7Lgm22YGXdG~gUKyRR9;$X{YIUlzDnYy(*~6zY15AXk4N=XVjdYs|1@^~ zvUT`RH5A#Sl`!tWt_Q+nt40b0k8JbSSRlsN+ii(rfkIB6_cFc`9m?iBkL~#=bxHB(L{OJamUgsy48gc&o~DE%o`v#W{VQRToby> zV-t?Iroxm*T^M64azQ(BY*f&T#EL4ej1^^qAnf76@8=EKioH}Q^S?dD3;*dav=H~xRQq3!!65hyG2t6P2uz6IU*Ne03^RH zLQWC2tvoP+%i_V~sE|x37`~MtJ3-B1A`8Bvw~{IN5WxY)uU|F>WtIf!gyy4h?H}Uc zXHOHY`aMSu7J`Ut#(HR=kNv>lY;|bRZ#7Q((~p4{$!aW0!vOZ-TR&#^j7SbXB)d5S{9M571AqL& z**!)+xK-5G8br<<|HSRS|D%g{)rKjsbaa5Jq;Hh_&7r6d{$=F)HUgtv2mUa?ASGjpAx`rAHP zO9(Ye2^%gO8EqW=DpEU2F{6`ci$}rgU*=Aw8igUPxNBQ@>o~OqfKimmG%(RR9+{_& z{;_8ET$b}^kB@@Yxgi`mEhRI4%x42r7Dp zYy5dBgnfVaaThR1CwDJ6X?@wz zkkSq}akxH!aJ}7%D9ONY3RVJ$7|8%`sH7;#fH?Ggcx?Vwcq~I9@h~#x0^&C@&H|#S zb1)(<;rf5qz{URm$u`RY;Ti}d;rypA|F0*vt^e!GqFSEv|Jv2AML`YEX9Yt5oy<<$~0%Qc$^5S8qQ zQE(VRfo+CSa1v-P*@!fv#nFfpN5YL6i8S7~!i^E#y@easE&rny_C%%suY{FxNmRyq zdHDar^q!~;&Ha0MgiXtTpZS-~5Gpo3&=#8!RP29}dfPm-()_bH7NtO`-gP{2v3hU` z4GE7@=MGR>0{xNhKHfTC7wlcFg={+Yg(3A!Rj9KMH4mr&kwk4&!;wkSs$$MlCtU`T z-7%;O!JT_vuH3Xa5oZdQK*MFURX6EASP>~bR#0tH;)r$1RXw6KH6({|o^F7!JACtO z&fwY)`0DuG_V(58^RpQV*Rlw0Z5<-N^0gT+9BRlno&*}Xm-5o%MiR&wRDM5iw_o*! zvoSY4cl!ErW|=BSN~mA>%QztGJD@jOqL;|I0pk*5B(vw;1g4(f+%Ur#HHiVm)U@o- zmUJ5q=~R?zp2U`pNy%Y^3C*O~9!8eKL%^E$1ksL~h6=)sD-l>^w^XhYgl~4zV;R(p ze+)*!m03w;p{uk}l8iXT9~E1E_wsSOi>Os*ezQ=iX-bcx0w4$4Jmgc2+EZs`Wi7T0 zCx~LPb6>0wHrS-40|+b6dPlqRi8_=; zutcLYB_VC+h_k`t>hrC5_y+j5ci;*l2LpuB*O>*anxE(MBhJ&C$Obq6K=H~mUc-5O!{0{M*z3N*ns9#3B{!fQ<||E2!-56<|th73;lP zpxdYk9s5t}NISYz71C`I=~jcb&=rJg9_ECa!V%ESX_m1;?y}KX_C^=RL!$YApxd@{ z`XW@S+A6K@1MWlRC5${~jX2wNtvtbRM*U&~%iHoTrlmc}aOVVt1KKo#qcWxWqYR|E zNq%^IKkn}DKT98eKkpw4ujf;jPclbNoA2Eg-m}B)Q&nF9JZ@N>`ees4P+}i3s zRUe;$`^3Ic|A1_3O^8ASjDGhYhck~aC>s7kLOOt^qTQs@YjDjXzuaa}^lXfZiL2<= zHvr({hY#eLSt6+#U~UL zH3Ss(nL~20U`4MnD&$?0J1i_rI8iSeL_wpeSPZjpwn@0kmXOfl}qN{bkqg}rjoqi=+*+X&v$tm#y zL}HTej2Z2tZt)GL>Yv_{cM_{vdm)Z&0BiSH^)f1&<+Coik{*CXK9ggg+Yf+}1g41)IZdge zPGPLz4wwp+WuW2A3F#S&d)3U&(P6nA1%5%HY0+F5!GogFQ_qC1FSxx`F(%HF7-+5; z`45U=YGKk`Fj&dvSqZk#Iq?KnUTf0QvB**DrWlv7!F+)TNh(gd0C94WpP9u%nR82K zD6O|wNAYZwNzHh#1Ong0oU3d{i0h=2F+M^8%nhC7YI&8dBPkc2p-d)N48Ly`n_a9NMp%P_b5r$%5~tTZ@wFE?<)hT zBZ&9(SS`|$tiHl0<9yYRBh6a(BoTaV^?_b zsMZX4(>9!14q>?*PQduL2CF#1Le>MPTv8R)D<5BHSCgbFkxbR3IQ%F84pAYR^j;&{ z04G5mJB}DTjL_Ky@0bx-UD|&-=ppH!t0W*t*8H)~6i+I2s_GBpZPJe~! z#@_plc;N7x)Jo!wZDE{Q;WR8h_>L+NCMFc{xj{ZgxG{}(U<|>Hn!g?D>t7D-BI1hFFbDM<1%6egjOfK+{ z1~M^s?&F-~gG^2m;Dk&@-pBx%l*>CEhDaXxP8yrw=@1GP0y&JCVD=b?Ny3`= zM4 z>qDW2-uk);+~Vib@0=Wpjd#XOfzYZ(|6+W>)nb?KR3h^}SjX%lFyqv5BQVWU z|BbN}ZSQG1ak80ZHxVIglMT5!~Wx+b{{PWwlBqOJMqE14uSRI5Lh zSt<_V-;QNT!{4qC21zzHoO4U|v&KZdW32cHxHg$s*|&;+WB2z1_*Krf8dz!hj%#lq zI5tf(Cc;{D1Xaqn8*-QSn%~%a4&=9tk5;a{ookO}z}Q4$lTLzZG?r^fXNPk%c&jKa+jxl?~BII%^`Hfxt} zL8vs98snUysx#GLU_8P0oGAr5KwxO!4ZWz2r`={kK5C6YkgOAgAUzlmXnVt{Sk0A) zD-Zyym_Ve@?l!!m3?*92d1EuOyR^VbnF1tIiv`O@P#Vcgj&J$=!|-%wQL9d7F}WP3 zA@{ot-c%rX*>OrKRsLB|a95k5$m7z$?)%eD<_e8E)he6{rr6u50+2HfB)p2fht65n z9SEH8&`Cpp1m4)*I!m5^5^Zg=5h4+RYUGn=Qp<~!48`=68o59%2upH`naey*A74T! zh?QGE^6PNR+hEgsyQL?1XByV?ayaDP+DO8VGIZAUbi}X|pyjGNJ_}Yys1si4qP;X1 zgxo^c(9=ddA&t=z^6pz)2rDc)x=R1h=l-;K%Z20A?<#9sFEf&Ge6zZD2I#V4slnd$2e4vw~0+mQ(5@v;HM!sM+*za9+5 z-CKeim%70!WhOI2S)uGm7rFS3z#Ns-LqJ=CES|Us>Om>Ry*0-dgh`Q_8c`I8r^fe` zjRxsRuT7o7kTX9x*VAAvY!_0{HV3I!59;x#aa2Y=R79KHEF?G>+%(m05NUcWfjk+Q zz3JA}+~Ck7a4-!87PES3lhwi2m60NP(7tA=YG1TYyC&Lox&r-JxY^byPCF8#;sCp% z_KA_P%Tp3Mi*5FT(bDQc^pqXxEW2}&u4eA~&Ary)AzRhep1#zvTTgSPqz$|?YUGpz zwn^I6FpT@TbQw)N4C+A*YtTkRNqbjW4nJL?hkQi_fBbxN^5vJ^$L-~XSq#>b53EcS ziuG)yNS^|s6r`K)^WWo<2!Bd=A=ppRO##xwaz6SqUkZj8>?eBBKT=VJAl>jjUaEm% z7nBh9o8^g7g^JZ(*818*8L(v>zZ<)`9o2l+Q6+~TS`}eNblO5jb_c(HzHH-u6!7I+ z5qBa7w(|tEt;zK zl%~e6+1B04&7kz07EaA2TL+qQU&7XunQCP7aem&!fOaKhfX{mC;hCS=%8yZiLCz5MGbA(0Ygwzq`D%g?%lF(YW+EP zE@ydUBLDq4Wx}PiT~ExQHBRQ`OKfN_1k)S-fgomL{7QP}PUDQ<-~IhMKmMOFKYX0; zcS5kStFwT~qKpnu5ULQ`VCf7}ct(Z;KytAh{R$fQWOE^z3Uus>nGKH@Gs2~&CyMr% zFBkuo#08L^QUo`S#M=ofSCWnT?7=ZLG{D)4jp1BL8Cw+gP{??=jL8~frlztcG@9Bx zSc;t)D-s3GkAYnSNP@(P8T^J`xSWVYr=O6N3l6D*(=FE8Yhr0P7!^&CyF+@>tZG>U zlWw)QQUyFkmEbvQ5k_?ak=7al^Tdbjpx2zwPTNeJ!?dVk3ZvMLE^f09<*kgrBvkBF zEfxLR7-i=f(-mk#K(#mG^HqYkgD_{@!*7Jynp7KJ6SIq;rBX{VL#q74m7@!hjru_! zd4&0tS|gD{DqK7i5eFO8NZGu%U)DsNlJ86_%#ct-TK_BRUd;PnX5z>XHwc?-1OE`3 z7?n#k#gpZBC-jc*-VA$}Q&;z)CUOOTtQkAM_wS=_TWzoRAt1i*-}9-WxZk+BxL7#& zzQ3=mI=VSIzhg1{K6De`5I-ND@7$bU49Mg2^QnT=_7|5k)A5%R^mDqilb$nJR)^~L z4dVPy4Ao=s=L>tHXa^sPm>wMk$jLU*%5EW*gsZDGD4C?F;bd!rp}9c##Z+r6bylH;y|lXx@S46uB}uZh_k@ z@NQl1UpmJ`lVE6)bbxhkSrj2m+(SuFgEgU9fpJc|uZVmE9+l9jmq2ebKe64D?0N0@ z?r9i$utGJe4%i(SjR}YqO|tAyf9QA8qRsb

x=tOK?q!)cWLzVA}CEG}E3`^^r?u zZDMQ5MWmfI>-%ZtJL>^onztGep|fUlcZUEk)yWD}xX@S|>eG*0->pexL=?+c4nLbH z8>esZ#{_AQ8s4?C>^03J;qXM(06u5FtD>`B^vIfbfojAJ=tP_3wIlg?uMxta;XtZ% z0BWKliSc_=iFzaImZ`c0hlhb8LU|~BIUKr9=YR+%mfAfG6MKjUcZush-$xH|sFR%y z4fhvJCPsxRq7`%J8f4^HKuLa8!BHqr=Js03lsPRz?B3R|^aiU`&V&Gc^kQ%ET9(DF z>*_^PMiWDNU$kNguRd7<1tD&4;=0N`E3{!Bj0KMjlQX6x zi8_Vi9<6v+u}G#Valkm*ac;olQ{{-TEidA=JAlNJ$oIFLHi9GSRO_VQO(2`uO#R9D ziYId(-A`}Xo&=LrxGPj`gb`=L5HMu(n8Fov`LIP|Oxjw!>x7KTYSQJ z(^L~0Ql2>tOVlcBsdFezDG?PxU@_}LjKY4*$1zw`i%}E}gF3o_}B&R zarAc_eY9)J-wX#pv4s+IVT~Q_v=%f=0wC^)m}2dQVeyt2%PYyscMY5*+@i$A_@SVq zpdwyixn#&Z{ZWp1vOHT=TK`iIz?%Sd$M{)@HZvZm(h~7X6kkwnys2n&iReO=SZZ%* zi_J>mK}^t}`~9PVXoe)51Z+w;7@D&{ZNpFZm&O{J2>k{$#jX~SQDoaj+IdDIsUS*^ z<#rw%N6)F4sPKqDDz#%ueWXPeLDq?PR_StR{}5qgzz!dvmUKc<=I8dsH*Ml2$8fOjdHV3kar0 zI9PNJ!YH7G-ZqC_b*4#viOy?!4)(Go*iJRqx`hXP1xn_JAW;1{_Dy#+Y{;(C&9>1v z?_@t)n3FL7wDS7V*+=VI%h;+!U~#@>-y*Bz1TBSegOoA7g#+26pd8UKE*Il^$~E#5 zI3Lwg-EocxlR2q(w11vT8RYG}FMO|cX09N9ze{<)_hq1POG1T#**V?39~XyP=<$Xq zO;vBP@__^g4?REh`wgZcL}NWUP?*>frX``Sy@?`M;G<{nqEEmwQ(Jd21aM@ObjFUX zioR7>oV4R7QBJ}7BByP4bXV)M`=9bt;(A^sZ&qeZ^@lI0)Y2&lEyWWnuqu?V6ztv; z%y^SUMCoRA7$CV&8|4}iXVpxqg}LXW2!sNY)Mtcx3b_F@Whm;0@hCulGWdEX+gP@=+DoHmOJK=^@l4w7geWO^HuouR&jt zxqZ~q_lm(iYbn=mIO&h!0 z=_Vcc{3p2lbdLBkcK>5%>jt-bSiN$h?jIXj%?nzIC!d|CRjXOI23b2dSl|xeVq6s? z;dXMh5x9%K!GptzZPWP#0r$}s|JJkVuui8@Xt^MUVFaN!uJY#KHlg{5X_n&)wQ(%g zVUlc*Xq8~QiDC3+H;&tGU=1Y=G1oF4n#BmlG77Wa!Wg2)YW;V+iEcDpO!#HgZNs<- z!W4KlVv(X?yz%iv#~yhRGYvMUe&yYB5O`){yP&dFG+akbURY}^P9Qpz$bex+gOJNa z(JbOIs+bnkSgLei8(VmJ~4KR{L!;B}|Cbh;Gm`KXpOlZv=TL+2koS~79W;pUX8^qmW zxSSlBz{(0QxNIam(^@eEfv}`Sy#o_)IZ9?2C{tq}s-7QB1k{@Zl`Kmrpa@ul2%v{ft&H zXqS-8AsPxdIj11ZHMsG_5u3Z-gj0ka=XxtVq4*G+Qz}F%dL89(Dg1PeIGg+SSadSJHnE)1xD4QAPIM1W0GFr|W=`tQ|KRV21Xqe3a zf8`&cdx;T1IZ4MpOU6El$G*8B2$W!D+y*$4k82x@A$DsP)Rp!_JKMmtS`i4BwBJ0& zrOd}^0fB|LbWJ*S{u)TCSRAD6TNW)B5`~5Dl4;5v?jRKA5#0vR37}{v>U<5Ejn6T; zUTaCxSa=qM0XPv<)rFD4>B`)j$}U_BgM1th-G?s*yU^T92t!;UWbt*}RE9TSX9WO| z1lnBg2hbG>?8-kB3EW84)an2VOZSkPV&>9OZ^n=d^;IDr5k5akNV**fDkWB+XW0W54dVODt??>=5k`c%h^lz>wP5x#dEM zJQC+Hf$*AMivlyAFzQS&VRMRo!N(?DM9DcJwKOqQ5hsFwcOuonl(iHaOO@rTq9g0F z)|T%3CuoO$Eh=y0y>uk2Yw%cF!&V?Enr$K@)g%#*>{MNAqq1*y)a17M+vU*)O=Iyd z0njQfMT<$@o%c=ifq&enx_1ZnPPyN8mO#=;>!zSNF)IYhC5~FNfH)(%wamX}dtoF8 zq`d$*x&*(O@yIyCw71@&M-HTz^CO9}N~7Pyc42k=K>G;T!i zxt#GigCBm~g(%0CLaF1suVXEnnrAiyAm=U}dpxFyUq-meT|D4KPYJnLH9jfk;zLdG@5JB}F^9~;>!*Klk1QnVzI{MWg>RMqE8 zMZIMdAs>J+cv}wu$4-Zc)z+idH#?eC{wnV%uKpE?UwSwf2?`J{fi}8v*Ef?%y`}*S z%~-VQ2ryJ`IlkAXDp^0Sa87>=yP{=+qj%k*GP^C;?@@;OvYjD9pwa^B*81-cDWzun{q za{ySGH{E4t@m>bab^5~q$~7nsFmbZ)6|3g>C#NQ|15%*Tfcd(*3E903mH9Mm_a>1# zL9%UHE_3kh^`PSl;Gv7vIlZ2*M>7aJule&f(=tdQL`D-TIRJqyYID<=JM}zRYkhU= zFGaN5if^{I$F8y3P)FNl$@&NZ&4rF|xe>soE60&mk&>CeprX8&Y&j&K%h4p%4Rqk2 z2~`ByQ_9oSg~>X;gA!7&idaK4!U;-*15|Xm9t!h)bVN`j%E>mFAh58V{Z_Vs0JHCg zsCJgXfnR_hw-76KJ_^bjO8Joe{d6BT$3Gj_%fs{id-2`p`~7_%2I~F(vydi+|AU{0 zkBf`v`}fAKr<0raJ08d9OF#Jy_4n!i&ddG7h%~;ikd_AvcZKI^owd>%x?|bSe1kcA zK|9XCl2*ci;SPnvY0t#d29|bRH)tnuJ>bZ93Muy|bH6-tb!||Y)Or_Lk((LRtKAc1 zMdV~#4Q7ja1xAdi>eyj1;?dp&da%5#pEp*Spn?0xTy5e0vdMaK?2+&R(xUrvLk5EaT_}G_tiYDa! zL(zW%yk3+!$Q2dASO9L*!-L-14)R~oT%V+`3^SQD@FM5=mW=*e&An}TZ>3w>ObwXE z%)>f8toMlROb-gSKJZzj-cxkVMun_7*g8sGL*BE1zm5XalIn6Zxp6v`R~3dtIf2zA z=xHz-UcKm27H>7EiYs_GrVRq!IkprfGdgvi&6Pt34iupu()B6%7nzJIrcTg{HNs`$ zKbmD*vGC2twKfXErr46UU{iMIDyuG2Vr(sb^0`=mwhA)TZv)iFDB{L~%x(_Ozl%eB zbpD)fZ>QJP?vzl%39Dv(2`U@yrh|Mm3~X}@MS1~=gUoIFgh_1P^VENmhU~$x#o?sQ z`SUtt{WEWZv6=8dtg=f-$`e4~*EaL42GNfaF^x-uucgk9S|% z@RY*k#|~+T47JzqRZ?W*(5P4!y+|jEC~VLXlL@pV-Z8Wl-};z(NhIQD8v_oP5BpJ! z|0$4TyC&t1%t3QO#!Ws`kh~Vm{){qN?1|RS`-mmP{H6l0fFfCuLt>#1c2O^N27)pt zkkx77hGx^cOWG^RU#s4{)1PWUu<@jrkg84z-|FBsc4|>2N}zF5P*!Xh=kf9$LrUL$ z9F>%Lv@0*)@U;BH)9Xfp7yUIjb)V`M*1jae;KEM>DTd*Ul3U>xANpbs6;diuqZv1f zgd2=$0qFt&FIzWYxaGSC)(*ekDn^sNwr@jd3@+OW6!H&h(n$fhCUSirmzRZuh!lPS zLL^ZeLQ;>~7x}UH*uV$&m*A`Hhz%WyojKb4j8sOZ^2YPq3Pai7Mn3xDbzy4XAymb+ zFitCu;Y%PX?PwsIK7ZYRZc8K-z^W9CG%&GZX<^TwK$_ht19(&BLtKw=eth3#{UCAS zi|(ORX9y5<0DsgiOBgx?Q()XKZ;umATtPij-|>=ZF!TnTI!uEzp@d>cq|X%FV-7-# z5|`Vjm6Pmdbm0QMCE>0y;s9FnT#6Gg+S@8Gt9jn^+tD~^gsDh)n2AW{O&Tm-Hl6?p z={i`KAe>IOL~^SI;yYJz5zVNbuiOM~bE?DgQ+LfvL=h+L@Y2=UM7W|3Z7zbwGMR;x zEJNj>kk%^5FT$_kDhhawUClee4MNAQ;VEIu_6eCjFOw9fb)6J;45Rlrn8$`Gc_fi~ z1?w7{D41fOVK*H921&WB45VnpaX>$X7|H`c&sm6wP(5}FXbPk^SHRP022+4NlL7AC zNAqKLng)1Ec9LRTBfFybRsw>IpCy{m1%k>maouopsT2HB<~Kb|%-@-eHc-#|n+$p{ zF%4;p!%SXD)^Z9W`BchM%GBredSaa6;w9V1$d|(@f?3WYg_MDQDygaBgaU6Lw*to^ zy^D=W1=iFE8(tww!@w%8?8ATe8RuI4g+YzHc!s187;NVlSYo{2cj1cT#7{s86D0nBgux14al`Sm4>N`@sS*u zxBE(0aYa9K&qPhl3(~7~n%N`oiWRzeRe(WvCH?}H)ZNZu!3TE{9i?e{$DMC6(+oGP zvUV9t%dV)KFxX#k;55DZu}1j0HAA4S7#~#?sR^W_noc!`1(u=Q=pWN}(P>~=Uro@I z21tFgQSHkh+t{mOM?A0!y!pIhk;lEF3>weyJFlsF$=e=iZtg)GiU)bMV{Y@C<3o}HwdCn_cdgL%& zS~MB_5v5@|064E6Wh_j3A2osuOIq^~o;!&GgmR%t1$<9bBa8UE9@W^~MneKt#SRVD z9=SwWpQ*@a;2c`mHC9!(ge8$PrMrqf$IN#J*gc@e?Pd~VdgK?tqdecFXIKW#7M*t3&| zAV;ALL$G6&EwRxHWgl2f#IAg-nwU2ZwzZ-h-=r)bvc`~Ud%7WSl!6;d`1}0^rzpg< z?9;nxKBoNYQ}KzXJzsv~wX37F{aSwWsr=gQA>*>UxvKo?bNX>al_Tr2`zgk;?DO}c z=l0)>*J`!Wwj0y3&+F@H3-pwx)##rQ@zcs(qII2NGYh95bd$xau(hfHk3enenKL7(7 zOO1vkfdl;WTl%@6zVp7v z>VAY>!m88w2q@+C_W^3;#giF8he_J}Y4>TSA-0lhj#h(x^j`U4Bj#X)VNIVxgRO2* z`-+SNzp1cg3>&@+%+e!R96Yb!+_aoSD*-jkpBlm-(|{B+@&vp(Bk-QPd0^Ja-@FYH zOC>TmQ!_GHn6HP(3L?f4=mr1p&+6ZCN2_)#dSPl7EDLj0TEmf{jT^*xtjVxUfji%j z{G;zXAfC?y%XKu|SS44Vt+iGUvel^A5>lTjp0X3Sys|0xh8RIbJ+=tzBiPiQ%f32$ zIupVuCZWoE>ZtWP!(!7mRpK*Nt_BcdSZHeL(YNh_Bn z(y~0LC2u=EL{|vwwCAW&zb|M!WFpk}Nu_XxWo8m_ekIz$DT`DMT55A+RwT9_==$5} zRWi7cLXnBdNk8@W`oC0I(+$foPIy!@*8u5r0fn~l#tnLXU`r}z0mvX`ek^CGYw-8zZD4euVbSoHuwP&z!Zt}gr7-+kM zliUS+!r8P~fbjJXu^!9t?uYn2`Z5 z0?8=S7B#e#zi6%)SU{j98d+C2d^vR?t~+am0a;){oCVBoA3;oa0Q}EOZOlG&O0Nhw znpGT|ghj(5D`H7|jA0*}p0d}>HofI=tUIiA%kX~51^~ozOxXtP$!uXZkmsxU>j-t9 z?@;iv7rF?}EE~M`{^R|RLExOT92%t19dIq`YZ;F>h0{ky)L;F#`af{eZT1Z6nrV{$ z2e@bHkI?7A=$O`<{9~}&NEODE3!s`1R8G@bIRd>YfhxR1K=PY52Ym>WpdKymFHfrk z)eM=q3m+{+)$X=<#@anq_u=*30z)>+v?o0`l-?#O{Hm>GkX4_A;lipF*2YPAE~v9!myYH5>RxxPFn;Zx81cJkYO!P}3x!Fim=WeBHD_&C{+6 zyHJ)c9?ANlD?}6{P47y-nqM(CXRJXW^tlSCQ?X2m+Iw4L4J^SCRy9Rq84O36RB+88 zSU#A1++Qz8yl>$`8QSSp7bkj_e;0PMMGj380LhBXqP}siegI^ioEi$pq?8u&QM9|( zY!Xv4_4q)1!V~hTVn3)O<>{pENpFWQa;nBXA77Ag`Z?BT#?SCQ)5gE})!wmXPRo>1 z8I4-eiA0&-Jx#rUz>oI$vNw2|db>N>+VsA;QygvN_MtP-F_fEr7gor+hd!$T60}mf zhlK6DUHy85U;wNlvWqy;$xqD!Uh%RGj}g%~0?)U6LD;P!N&P`MIr*@8u4J*?WN%R4 z0i>@61HIiIey-OyYjcwpO&d3%%A8(YJ8&Ks^c4`v6wAQ#&0csZC({k|-~R>}ai*{b zW~&v7whGXxkV}}u1YLqr%2wZjv=k00;?w7+^h}s|PBU(I1Cz-tivATAlxj2>u&?q0 z_mdp<8|kg#9A>g<-RxNN0GEzunX}2KMxfj6fh$`2!;HP@S)6FzPEgBr&C%{QRIxQ2 z#M01vAyd0m^Q<NHnbLPw$7L&ag==P>H$ngR7{e(*;oke(C zVBWp{ldbZ{ubaSc(=&2OWFolAR>byn(?L1C9vrDEVZeTvYdwKRCPl6WIbvJEwhNND zw9AHim2^l3AdBo2p;Lew;?zU>{8&5|I*SjuhjPAuLVVgVNy|tJ0n|xgO2WUD&Wv64>N%UWz|rA`pt_UbqO>j3$av&Z33POsdRv7{%}|BZ=kkfv#DsO*rKiA z=>a&Pr73<{AYeOLJE_%KL_iwp68B$#VNb_=wPc}u2o9Xt@y1fQ-7i=WoitV+C*OeV zPR_Z4v6dRy61m1dH!YJViuS}h&-5^?nk=2)jhlg#aN8ElvjV2v$(_K~fez%@5Rj=* zRxkR@T;yoAlEAU;f1ED?Hu(GKe~|e5Dm)(c`TqJ2rH=Og`raSTr`3Gk@9*;UyuU4v zPR5nu&&Iu_iRt}ZoA+Md1L(Ype`V5Xpau1xN>6W-9m-0~k8uTY9d=;DdO@JMEFm!f zj)}#XdHL5vu)Cg67u^_^iszj~_7iJYnf3T$s-gPsDF1j&%@uEun>q7)OFD{%6!&l( z|4iH3T>ma^Z1A=X0)`7Q+E(*=Njbe>5dq$Gc+th?=^9IGm|Gj9*yMm__SDsV3riC0aK)Kyzv*#ndkpL!ssPSo(gE z9N(f{03Vb2@>%6zF5w^f;Zx;|hk`n$h6WS;^h(a(ihK(MGaYPeVDfhiNX7Ms=Udz5 z!=cUV@`?&x4$*{fx;6Xl@Dc48+z;Npm{`7Xg;0yd(F_QdGJx+>)NL$`4WvYz`UHZr zgZbvz_A5a8vznp3P!&|^HhyOxsZ@LB%zdVkrYH8iouEfqzq#xN-pC;~dWog-A z*Cl9t9%x}6qtj#?Ry#`ag(VSxim~$D(zH> z&4s0sMtNGfGU;EmLm+ak2_jq(DY!sQ_EA~1^*1t~ivi3FOHO%B==Bbqi1C9XL`Ne` z2y8h4^jt9Qq_QKS5c=&;$J3q^x$Dzh{fRtJ4}j0+ASQbu7AqG49HG>s44#JRn^g?< zwsm(1EpuS-`hYPG(F|4KGqaMTsRc0?2-1c{d0)JWT10J3TDq0VI=V39KpaILvH5IO zXBAY3U=O&6IX74xS2pC}66>|`xIVO}?9ZL^FGH(}3w$t5M!SJ@)5FlE+pR6~Bamt^8`IGG%A?u>J$6yWt^uMRlC%-a-!h{>Ir~-B zhDO1iCv66Y+q`0mucuToe!O~_rdbPwq?XPZ2QzyWU1}B5{BfYTHQ`x#YGQ*M^X=<( zNfa5&(Ic*)Q?1lgn)bTG4@+z_9T;5thW8rsG59bK#s7Wj8=CaRxdL{k-8rtUKvvy4s;a(C?; zGddT2wPB_3UyqTFwDUZ_vUxf$ufDOwWPZ9kJ?t*r1bZ}>0db38|Cnt*nNIn-Gr{gM zE4N?o%)I@%;I2(=Uu|UB(3!Q>&^2zVOx(4#upo9)UhrA~Zg?mQ$fiIY?<4KX2kLc@mAGai zH~8+DRpOxa;`np}m|v?#9WV!z?lq#mP!D+QhsEX*@KOQn7SR^u3H%=Q3U+|MvJ8+J zbg_{z&P@X7G)@}-)2E*amCEUw}Dnd%hS=9(Rg0R5{Zuqy2$d?!M)&Q4{#-4Tp@ zAo@K0xyn7GIVVmrCX|x0m-$dNngAK8blr{=2{qDYyF@yWLBV3)R2 zZwWhos$OYDZy^}r9&YRN{sL5{v+L+$`zvbcl;}_qRF8bhvOPo&5ekx-i74k3U|=z!z%xH!@R}&^TLf}F`gvN*hI0kNfWeQ}(s!VUhPs3%r)_?Iwl3;r-b{6us z;>=O3rdw%|;&5ZiNpq@pt;Oh@d$$`NKrd}^+l$==x}-1TbELiO8W}uQzE21iyE=+M zFP{A=5;3N$JB~}kF}34kcdaMvu4_!&9rMXyeWIZv?g|9*#@QdPEG8l^0A#>DI{;ol zp}!7GC^?<5d@h~JDxhaf(k9(=IE8K3q0!;Gtb^rdVJsUfcaG+gzc!x%ya!FOUXr*? zA2YZtlwwO`*2vWW3yOUPW>?_l=B5RqP#+v*bAsvnqM4nAhWb-*b-ZJ%&Zf`^N13?I zv?A8d8Z7Hp;|bgD)*lx~PCBxG@8-yPn~=Mu70A={UX+`JB3ywz9tfFCLvea<1(Pu+ z=QQtZFH{rJR>J(gQtO4Heuz|$vB+ccd#I5>P!4#9?UjLK#dEUx5oavE2wCxE;5$6SgvgMB?D@_!^C$zk&lmTbo2?l4=)5b8{_$X&qAA5J*Nk-Q1UI?dOShVn zBha%Mm#_O|2T<$Dk@d4`rW4FV+hUJSop5~(%gD+|4#esobZ<1B5}6qLuByUL;(4pc zxiSoEH4HBIRSMW=1*}Al*jDHO1r!r2+tP7oREE{=?L8pfG#(S%G{4eHWX>?VEB!6) z6UC|XF6v+^*@57e)y@&wFtb#%amQ|p;o28vg2{BimouboY}eGHmsmC|L4n?J%i>!i z6H)9NxDHx3c)M4wADvzR+uBJt`dwafa*GSB)s)QY37GFWPXY7(UXe(SAk$N3#fPU! z?$jfQqTZ$a$*u8Dd5YN@_hC2#+B`!%0QLH{5r$S(GEpRa;Vxo(IymC zxnu;D&5M*#v`bJ8M&RP~ySYuJ=u9~`6swdA?;UAai!=KfHwB9e^JATO32)3 zQzBlk*9mW^#Y_J+3X7m&i56851#ad3BIP-T`PlM=*P{V}j+E|-_US(P)cbhlYu0!`P5qStZV zyLPBgWwKbGY-N$vNJ$k-8iwf7a@O(&?wA(IaeCuYIg%lmGR;v9Y&hAajw!;;QQX%K z_?p2KSIw<{{)_7wOZv9Ks%t(t2ollBu zOJ`lKg93^eBL<&)NOz46YK9^%o%pndrpE6pW|oD-dfoti# zK-=dW1!VVhd;i8gx|!M02QB5HJNrux$p`sLUlb!5Sk6H=#r^ZybykX`u$1T5#H&n{ zi}e(^Q;Kw0Ch%*>QZ__kIR|~;Dn^>#7F&Su2c@ENV9@rmExbY?PVxIpS=&#F5FbH? za>ip(A+g}BzL{mms(d>tjLMIt0Y*j%{}#({nZyKvq@MZh{Ob68bFxv*tn?PYC{aSV zvyIIRQ>YbqvAo1|z~1~8sDM1E8kh@bb-LJbAVxgOK$PM2~W+apA+vlctl z#pBT%olWf=H=vvqq6K;PA{R|naS9swOa*V34LJtN&ivl3#b-8<*29$?HkU<)qTNsn z#>RagFcf<;+Umw*7znkCOU%63n44`cQ$x=G@`tsd{uCEG4lJf$f#C3ig2#Wn%_oMH zKr9fKiMh2l!Ru(7(QS?VG}v095^7dL_|~$kZQehs$1lpLl$Z>g?k99LU9?7xM%mU% z*>9!(1Be19Dt)d*j zi9Kv?=){R$!A{m2%~MAK1PyO&ps%{f_yG=&R~s+b>i-;ltotu)cZnhur{G`VrUF!) zw7(Ots7cew&OEE(wmCTZo&Xc#8FUzxEl_!)`!Q}D0nh1eXNi{QkoZedM)m_i5LY~K zF+j_zbvLE6{THjp7V0$nkyEu+w^a%7K)txsLx67U*cFLk2XBYxE4oBD4YU7gw7#VL z=^&w_MlACfHp@42 zi848ekEZT%`oA{y-$&Cmm%2W4_fVvQ&9yHc9=9GsGC0(>FA!yaLQ!E!@LXc{(D#Hf zL>}a^xCO0-x5O&Ce8x4eFVmDCyE(#@DvtA065FYT@I5ZlU}&N+<#?N@(ds(hteEgX zYIoc20gS{Wl!L|2i$UN=j5*s@tqdi7_*^mV$ZEo1CUboG=`Yy5{9HVxK6qz3X9VRK zT#gsZ2jSvBPXKFIV|$~rjWPFuAjtq;Vv&dCMPDIxSA}N!D!!d7D~W{h9qU~&Z^k;a zku#$zc1`G)ByB4%8x^Zf1}v6&sw{0zO5h9GpDgnRwNm!#`g*3GHR%Xp?v=Gaxza2m zZmihcO)K15^!ZXhR|@i-G+DaZ`gp02m!QCfMpbJpxy|`rh9Ln`$cZSHt{i?g&^Axr z;E#wSjOPBDrn~v@0!_vkwGyk_@MPf{{DoI&Ae-Z8!J1VpT;J8v(92(ogdf66$R9$< zWiqIWt*QeDpib`#cfq=HGW?g@&yGs+h_Zl4?jJ@BilosoD1?qYV;91}5spkO{GH18 z1E6douSKr?BSgj%Yyv$}aH(6Pe|xmSJ3%EGqSA2;yMEWaJsPdkI28c{qO|is*p8$b zu3wK>UP0vFdEZDN^U;O!rZ7%p)IDquG5&^1Os|nJZgW$xr|4) zQJ~Y=oJQY4a0?QTEuEZgpnFu60=6!fo7K+>;eUtf5u5TD(GPYK^P!~(d#d(Pd6DfJ zC;#Ak^nuG?frR2EbKFlm_7+LHNfO0PMP5T0^$)1;kfiE)p32kh7twL)UFNUDg1wOU z47NlVoQEo(4pC_e-5g@8zuw{l;(fA6txvw=F)LT8YM{-h9#n2@J|JdWj^l9qz)%ijGW*AOC8u{lcm6TAmOG}8loC35W zV{Hh6>F=2e1BGogD(C+=`fNMXt3G~W`}jyk5#ou9l`*=SRD4ADTI@}I=$n&eoFrW0 zC1frhjz1h5%y+^WcM^>rHIwA!X#9^|V=WA)z*SWobE4fI8j(ek`)Ym1^;6-gLll~< zQ-OB*_DNI;_M!rOJa6s{#8V_xC3M?uN`%@|HP|!W8yt8Q>Oe470(q!puHCiX64vY`~MHlf9Hu- zUK{O-sh#1+<497%6@^{LGC5L1aaKLNQFCosc-JkS$(P2$uq|I90N@B_coH6xr1H}5 zYk{20nB?v$*2fOk{BQ6)#l>6;;egTfhg7T=H!2fb;*=!pwKr+h3Vifzy|4)!#Dn}o zmP90UhIUNyu5N>1JqYU0B>E{tf8>FXW zS=tbhT8!5Ta~yfNqiV3p%L{~BN8^b zO0Lzx!0?zSSjr2WC0wN%kDhVCs3~;!E1q4YV#oN;nt0mF)5jH`S&1NvLY26i<+PrN zO9kMbrCCphyle)7ZrcC$T}-;DteU(bblI7RboxIFuaNIl4_Xg(1$6iMrm{@7u#&M* z&)m=t5=@;SB@8O|g)61b(}wa^x8-5}W>ES(jk!8^=G<-8={Fd3Yr&8yi{?L$^LooB z?RWS5~x+V8BWZ=x5jSyHDiJp&esN>A+2d>I%(fGD%amzppymcUI?yt!14goInDRv1 z_8c;jN|~Aqt<_+q3&ATuFA7$z?ReOidYe7|hs@`^j7?loTwAGgR^^?8Hth*qBJE`k zXaMlj6vUew6ULLlCSf!a$Y~QR%pPVU)zZ)684%MmX}VnnpnhXPY(~LK)$DMO_T}3? zrD;1gQl>=-pNyi--}_BU)5SSez$&RaIygJ!s#9oJp?hr1n|i-~2j~N#<(`c^B-ZY+we1+hhYR;;u~geY z42oaKZ~S?`DhGeM!~*Cu&VL?UQ^BeG#8kzJSIKCOp*FXVXszO@oDAU&x>sJ46Oq(b zexEsjANVq1C!2WQKr5tDvlB6;ThurgI9?9iuyRUF|`0)9YMHA%IR&=8-Wsqde2Xft`^ zS3ZZ+f4jiYq3uACBnra_KKrO-vm6O3E6897Zb71B(c2`gN8vRNu@E+30SAg#QzZ4y zuo(|ERhib6tO@nB+Jx5YB|x8QE)YY@m8c(yy?bMF)v6mBkYN%P(Fh*3cwbgcorrT% z$iTkT_2J19NnOGh?&|<8Zn=8Ssm)=-xtqs`qIWCBevb1&HgDKc)q=1o0t*n#IgCVu zpgakzrVK}m6(^EC;GXLzRV?$yNenWXmvrttS(_fesS_&@B8&*$D^j#?gv}^=E@2@_ zVLvcu9LQpXK+48W%gI`HwTe#Bw7(9U&zqm=M9GAO0)SOGo%QSLEgN(qlX}$WLUQG+ z7Q&EIb4%D_8Lt5YbX;am@jMYate0{hcmaCQfasBYjyXTN$ zo8Isal+UB&r)GP~M3j{5|5f3-T`&N3>dQdZ*=3;c5CHB|5P98)MCT=74XWt(LQ1_# zqqK)?rI-z(0pE|N-_6nGPdCXYU_~y3*>iIrOoW{$SdBCnkR3w9A1EAR9dBcUNpEPx z@dRH@DusTl-PI6TRMtRjl*Flgoo~cL5qxK|q6yXqGo<(2?@1`v0@N4PXBL^MjwuMO z{^!aOjj}|7ow!IVQKV?XNKmn!p&*2Ql%h=Xdb)*2OKq#|%#D5tyz@2IOqcP;_vMLR z@5_Q8&Nmt8tGRdU#;`G_Lr-l>&nq4*JmiuBcOLXl2ZSGQ6=Fz>mE`R*nwzz8VI=}5 zG-nzP8JDllIZh3{oWkd|*%9SCbvvmaDCx=UprTY)A+PH0U}z@s$|<+k#I@4V6%Gv* z4yfUPEv%Aio5SS`LGi+M6rMXUW9W}H>RMlF60ajPFo8o*wflGT(n&Qp&UMG&bEl(} z1Q3Fj*(?iUe<*tuh3KaR>j4 zEqLmR@%Rst|JvZU&YGi15J+?*ISHgIg=R;=JCx98suq48(pt$_k`jf5F%huI39gk7 zUejVTt~VUpR44zE6ZZ4;7tM$)edvf%vV9&SpL66)1~5%lndVf;P-z^_l%PNY2CK}TfJoxO@G!V6qsvInCzb1+U2w*6BYhgN7{Og z>h^sjOzM1&62RqQZA^WJhQ@XDIo;q3^)W}Y)LFyLyoRHapPg5fWf8DYvkmTOatEYo z2{`4xUH=(p$_UI5I6-A4?0@QnbOC zKsIv?S0liYS2AG9Urjc1WiJG4&niGzp(;oz<|yS47SdP7-HZ?L^Tsh=q8JtBM54&d zdi-I*3IzP3JGkIMIwgKOWZbxi*lzpJJ6Jz=@1yVYX<=czd^x|XaewiD>ipq*`92=b z3V#nD3kwGaZ-0MIDkmQo@!#i1Z$&cn_Vw`Ld(BGuM1eTDJ{}tT4Yq~iY#KLK>$G6q zN_Yo3yFoESPa06bfaL;+!DT~FSN0OWRo-YLc-3b{dG^nHA#*$2b9kj)7G881mzA96 z(kk8TWsGNHmiwv=xAjQ|CF$6!IpEz|2(mM=t{&A{nJN$cLRn#JbvsM4dFYwWk|4~C zZ-o5$H{In$4$--z`n6c3B!{P8LQq1tUp5ps-yG+C$HoUYhU53`gwZgLxQ(GKgSYIA zGl~)T^q?5t0anaS=W2igVa5cw>2E`>X$j4r-qpryEk=SZ__@G+Iw7xmPZm16HzG4%f?`;jz zQH^EV`?BW-fLF{t8^fCOCT{%M3t}GZnTNfBeJYvvjB#L9K*l?DBjDTT*Tx0%Exu0rbq zQ0jxxP&y_-+TL}?6dncgMl3wDsWkTdyJ0)Xq7{0!D@G&X0YbXW_ES5zjqn!$lxgP zWj~|g-x|_6Ep>J~i|Q;)ZvXlyI;6h6g})Y?r;U^u#A}yW3(ORH8(foPV@@hF8seje z3YFf5b|Kzr^V6wO4|hs*sj@8cDw`r$MiFjhObpF?Pjc_7!xDOOSCETO1hdFGHrWL| zxsf6VQi2v31@&pG}Ontu#eZKAbgq*n^TDptXJik1_jV@ zF00WD(`Oe}Fl_|-%);L@Ie&Hepbg={Yywu+F1LWWD@NNp^I1cda4bIMjJ4brv(#1y z51UWD!;voF7IKD5pyGp`e-lnmZz~Hp%Spy1<%A_0!`xP5=js?7cRMpPt zYVy=0QBVjEl+hNE+%DrmVJ;}h|BU3u=P)aDQjcSIkg_Z?iITanee0-9o%_9<7PDlT z5686$LVYrr!Irw~=to2;|3HbHDIhR5YyoCoXSTqTg``CPb*TVxMCeze+l?vGEy* z;N#wUY`SBW(UOOKUP0IXRZSoc1>Gk+F^ol{!(5;q8gO_cteY?E1~7J|ixqrXzfPYC zZ{$o2+!>b^sOIouRWqKn>Kgt*Y5_2MH? z7t{PDQrQP$&k+gF$>ol&bHwev1U(VKs~H;AYvS)9XdEAMD6qlkRbLo@M%YT~n z&NK)m^j8t#>2pUU<$IV@*VLpqY|rgddl7v?cF;ak2W2n>cU;$?fgPRvdQ>3CL17Zc zmz-s~eI>sQ%4@ssSagEgkwabCyXIXJpWFEFCT6e{lw*R5f>hoFloF`sAVHEPS{7ZY6gpy=sy3mQNejT#Oc4Y6!&*8{V+MS6F->9VqMr6k5~9S@(%HIt)rIE@R5MNPiU=z!%NUi0}eX!;!0uk`Bk2>7iS8Y`_wBbK(7W**d8Z6Pe?c8769V0#Wy%9SFNYSi zw2&eHXVZQHwFE9wRiz8^=o$ND^bFKgP2%#T^-E7+&lB)Jd1`N#r!`gc(O>lOVN_hJ zYVMr1eFYAN{+MLS%EO=0Pc2l552(gKSnNZARGC_2H4$0|q*_kl2-l!G^})b071=wO z4Vbp#GppDr2aq9=fJ0s}%o3k!fUF*V@>YRSkm- zN4@yF0+!+>9k*`Suo?gO^&o1lWuMzltN)O8_S*6rug}bjo?Gp|+Qp0IH(tLG{~Gu1 ze>1loE)}1$B^|dvng0dg#WWKBvGzWim;W94cV6+i<1njVq&VR< z`8}*G<6wd0@<6YVTDc4ms~!kpw++o#23>INX`G%RV37LL9X9uiS4YQ)D`D3%xXine09d-8ihyu7;{?A(R;17?3B6Lzs#h{5soJ zMzj^(oYf#MfJ7fn7L0*N;uAS zRKsQcEk<2)r`8~0Kp!VP@1`lL}>mik5!4mw^a4b0|o(>U7%1hL0(BJ zA^vPs%@{UcLALMbaPjwpS;Lmr?K;FfM3fkIxe!i(FE(3h|3l1d(Q?5lp{9=+UA*QQ;!3`G!ZKjyUSi#hs z)z^d(TeWJ*ny;|@kq5TA47^*&N833YzrcC^ct+FQLY;VYzGLcazN(o zHTeKsz;%P~{ZpJ@zmZ@Ok)H6)LOqJ-sh#TQc&i%$vzI~Ip zhsQfSHT#Q_NTEhcrooI*aXBskGMD`lY@+nb<8^GWJx3Py9N_Kdo z2=N}F>JDS=2Vw6OsP~BcrNVKWcutbSG@?he4lzgmU`c}bp&f^C5vvg6+@J8oK+5T6 z(&OC$I3c0DJ{GH_?e9|Lmbn>hFBbbneFib-6InlbFg$>=Tr9VeS(6LAK%pp9Gw$G~ zwy_U$B%Tv_KdsqvpOS0#<@}LOu$GVgI3^hVBZ*MvtI&m$I$FYSE*5McS3bS{eu-`9 zz*x~va5x4|ci%gLQ%v$oV}aFvG-z(89iOHQZ|e}gH{7Y+07!H=FsVyLNck>cTqj?` zoI9c*8*GU7d@aEg8j%iuXaSQNk4EORR>iuCFm(XSP8l2w!*+sMwAtJrtRhs=Mj_2z z)gsi{>7eMzG*&#u7WVMAn2O=8Ro;-=Dx|RsG}ZtYK9Gbl$&?uDg~A%c1H?tx(u)g6 zkJ-hzQJjSKKVPsF*y(j%JwXU8rC&#ooI~933_er{s(9_&wjZUfB6%(AvL9Lk)pT)4 zQ*)Xi!|7~(7kW{>^|0Nh@q5F}6@lvtqKVMi*cz#!3=Y#ND4fWl+DgOusr-fXhh|~B zxn1D+4irhyNh;f4QrAi!S&imhG)#TLPuBH+gSPSWB79|CQ9LXpxsn5;&^u)s6dy0c z^57Ynl!q1kL=Y!TD0_~&)w`2eHSBhD1Bo%nH#srCg>IQL@Xx6H3eRy|CYVgGUId5C z$@FHe<@Wq>zQUBU!d_b4R>58?{YshS!SdW!e=avfcrLjsYyQp|60}x$mFtYv2Z*9tx1xt*3Q|WrN?S>|6;x6V?CA?tbX|l zeb(`sODE&TfSnwT`$o=g#agD^-cDwJ)!u|JVD`mH*XX&e>TPG?s`|ZylBG46w8xD) z-Icg{`v@)nB%hi?U^k+0qTgc5d>-0!8(|OU2Cdg1AOT8(bdI->^s{W^#k9_A&Ght8 zsR#|P1Rj@I^h=^FV?($k@3~*X@SB56sa`v6HjFAcs*g1h>FU5c`YQpod|#Rxw4N>aws?1)ti-nKe**iwD*o zOV+7_SsVKkJM;pJOR`QY>;;MGXREU#i7(_trxY!Y*KFOS~96Ksx>)$7PumgaV(7{6_Df)G$kVo`G^nL{|5ePZdJ|kc_oI7P2z6OX zo8d|X+bV^L2w7_$i~Y4f|2x*j1z+7}FsjZ#md;4BNmb`#$ZQ&w$b@nW=qGx1XZ>R0 zIkuWFB}41u$4n-uRUicnx0@lUc;uoZPx)f%V%_dr{F!GzREDdx!5Wg-CAu5*r4bel zcyoHrOn!_6u@se#2YkGI&Dx5H<#7|i#@Nq858X)Pg)lskscfZW&m^ruYbd1vvtiMc zHbR)Pb>DhfxB~=u_d%5Z4og{%I_f2H~~{BMt|mH za;>I%n^tit_f^%B^zn|)VKVH!1wdt6HB)X=$A)Q7UoLSn z7f~XECA|avO;gOb>U56!q-nA**q|4h`zpT~MoJ*x!tuv3M5OEr)YLpP!+5$HbUB(z1keRT7(dFN_Lec%^2Wd{vV;VetoM=AA8 z@(=FSID+I8PCKA?{S>svhgR?Y_rQa0DD9SCUbnV+5p#6Vf`-6|dy7>G*XyBmh{3IX zV`wC<@J=|`Pt1`qL*Sy8l#UA@w^gT#D_(z{-EEwh#tJf!A4(O^0(Oq`ITgv^|3<9!5B4S-dP2%A3s_TFp`g7ae;P~D>>~U-&wCLIgTh9Mb zB-MGGCB}ZuE63*PKl~Hvi^{GePX;HxJNP$YvR(ogw`z_WaBbDEc;=4%NW(A&{FP>VX`+)H{~rJ;K-RyOwbF$Y zn!B#|y{!tMPIsfGFs4c0koC_TLjU^ajmD-PpdV@*&SFdRY_b0NgFRJ_3HY*eSXQo3 z4CCml^8TG+qKf76y7pNLc56sZ|5qw<&6IX}6nHbSKvrcsX{a$>Lc8-NBr?xYZ*tXP z5GQK#cmX!z7qABULsi>s-;Fd0^^;IP3H8lu66$-eNvJ22P(OBjlTbei^$#i3UxM5n z<%mCT-wjisXJjGQu47Y3Wx9LkbX3QtxpUA|g~A}@ zL8N4DwGgQOQq{}uY248)!F$7&JwxrBN1?ccrZE}SI%d%Bev;S+2-TXeMeR>LmmN_m zgRhrMHr9rIu%qc!&vz<%*!tvt#`Jxxngs7j@SX(k<~0f4z1JjolS%L%JHAQqo&@iQ z6TF+|=COu!ERo!6Lm!r{?q@^q2{5~d4ZUqK?|^+r8~U!ryaV!h8~U!ryh}$JZA0(0 zn0G)PV?*zhmDhpn&NqEdnUE$BAz}q8DiRDJ-|xxpDq^pi(&mQ+Ic>eL11t!X zKM84mf-3l6?uS76s_d|1~pgDNA1|nV*W4 zR9zKk+h*wVAOte6#J*x^EtP%VX;{pG!2~r1fP9sqG_{{9yR?fS@509Kq`Gog&Q}f! zODjwHYbW(pRbdz84ZUInw40^uEP!AKSpmROsqPzBlOA)z8BI1oQY=n*UE#S!tqz!M zf6Y+zbkh31;k}oq?6@hKTjO>HbpcGaWl%{6L&K`1vd&Xo?ME9X?t-T>T-CecHxjcH zyOTd|HaugE&E45jm&(YL!8hd0D4uj~bVvmDdlaP(yl-vsysCg!t$~GhSH9H3pF0l+ zKR?WvhD%2H@eck7!|75=?^aj>a^V7W=YQ-y7X?dPn^e?S;K_E=^i@XJ8i^+qEAC!| z8m-6XjAT+?EopM~l4V^8mDE6( zWe=#}3^C_kRLJS=3n`LP*-`Z>B0$0`iZ z$+Ll}^%t_w>Fov0i>!}Cv@1T)+ue!}_-tM3+@Ts3B$Ko+xeaRg`X<*!CVYoJ>os`Kkw0x~@6alT*x;sxyu= zX3s*K;#xh7*b%5??gyCDEism3yM}g42Kw6)DhYItxuC|%UeC!t51)QKJpBIY{J(zu z{AhdhW%c={@i}dL-ZVbvjnBIIy*~Q#=(F)hZ-7w3Okd0OE1rd9vHxk@y3<6tU2oh{ zyZ?FZ(XeBD_h54x)M)S}3)quv0wd1klYWQ8F-^%}= zy}$o%+s5{V@qY!&=dNYDM^c(}&Rg%CndK&F$KS@OzqZpp_fF?&AQF-=CIJlr+EH)r z|NboO4S=9Tf}m`-=~Uwe##U0d`%7%g=`XAaK7Axkx=Qy{W%?Mx3{LVm?H zVzoF#l{w3(L!Mr@OxO(|m1;88Em~g}PnS{$SfN-hgJm@YtyGLEsE=?~fEuFt9V<4d zR{~gacaXiM*6A}^Afz_ED)K;LNnI5n@ zM6*^P)yLp#xNtUhwWaU<>A%T~+4Fy&eLf>!%L++q&NStPnh?dGYJ;*0rvN- zVvvkY`;1>5W4ZxrdsZ=htQs4~Ch-rh&&_wQzWb7#nN299=BFW2U9OMLu`88dz7G;fLvnHJ| zcqny(ScVaBJyvF5R!}j0v`w{NFMwqnO4|?Jq=i+)xfw2it+_9H>s$jDGV}XIK&gDe*?$vNW3lN|i*L z7q(3adsjsZ1`!kX`vv{^Q;cfC3(cxlC`MZ7r7zwleaXFcG=>5gYKNrQyX8*W4b5KO zf<&$y#B^W;yn8YG;t#XWdwYbS&AIHax-fj~SB&PY>RpI2@lHu}qg@gK1B(B0b93ni z;-lAvCbW=ZiFzBOkuo3Qf?D&@jC{oiy{9e&-1lyNa6u6B{#zVk7(>ZDl2LIC@p*=L z+mfR*@|`F)mOXJXWKlHDn|oi(Ui|y)bJ#+`?)z&@4PN;e58GkOqQ$;7j!*J4teR`3Pom&dAe_6(DI|2ii3D6DWIK z4-&CH(XUh5a}pgsb1*wb+QIDju=P8b9ecm^M9vOpr@EvSjb{puvlx-|ZQrVoThWqf zYcQhgH4`4%3eAS^uHHO!v7oL>dMuPBgZNe(Dh!7-9NP3t=3x>X)w?Qsjdm#PyQ?=) z9htcb(bh^^$ylBJl8ZM?EcL1{G(LH9!|9{Ws4?)sb&O9<{o?FvmRncy!zQx0?W1D} z8o7kG`okfHb9WfcuUN)JFJtetZJXCrSQ44$sFb)g0657!Qc$;|V(AhpT$FAB#i!`f z7h7J@J4P~Dt_!9aDnJW4V1tWMPc&iP#3J;!k1#%Ky$Wz2eI{h5VZP70_G`uHC!GPj zA{SI=t6$ByeD#=RQle5(^j+dsd1<$BvF2Y!EkQZTYE~{)6HY{fxH>)uM1L@5L znqGD!YR0V$qv>7JaWrE}mu1nO97v%Eu!wp9h_ksg6dLvU>Ej2!9t75dzpEb`V&@_8X&3X#y*&^xh(C)`)u!Wn~!TBKWokAbD(|l?#9+Vb`~O z{XN)Eljrw}D>^USP+FoaP_02pHSI**vdu%69YH)lp;fmf+F;K?3@seAa_V?s>9*9I`Aw8Rg0E_Dk~ zDlpFhY}uy?FV#Pp1HM%1Tn?=Lz}kD(@W9%k9q^?N_)^>LfG>5xm+Ec@mUduiT{HS8 zU}*<@sn|phROdi-de-njb)bFH_)=g?`1Am#9yY9hA}l4enEjT(lt!TXM9z1~G|j1| zBT_#uTCX%Us+46;BDY1sR9_{F_NTY9k!%LlL-ZFjhGZ$iWrQJoQ!^^4=Z0qFW^_@i z=yJb|;2{(0hz?OtGmUehS#=j@2(9V-Mc$JIoMWMj&A_ap(@EP8^6Tb?kw?>=LwK%NfqzR-SSwCR8&b}%m=%*$PCcrY(RJK%_s1CE$|=71yiPlqE07P1jm@c)1F zJXVTVMAyPvzPk;Bz5BQJm+~PtsX5iz>Y9oC6{C5pkMSE_Y`@t% z-MB@>o=7-rO!VTWjhm7=w4=5R-{{{lxCSb&FY_6j5sJmw<-#aCSzT33WC`bRa8g{1 zz9Ie=Co+t5b_NhFz4m6o)=aoVRx+B;QJ51TU?CYC-;WmCoVp*eS)R=PFzvV z-tdyAYspuzC-oZdIpcSRx>E9o7yo5Qt_C2NoDGRfBw)Q$WWCOR>5J5}4{KKOk_k-< zvS3u#Rh*|$k&}`ySDIuiDwaNFbWxjEAL{2F6o{S#^Ap$Rw+#Aeh~?`KtXvngKLn+< zEU$%O9V!e_V6FoQ%t(rgA>^%j24X?n>r?0Yx8WYnvc}+xIjNPE6(V|~dGc#KjaE-b zisMIUgIltSuF*9NXOLGB#b{m7j77>vwE{|#oTI}hTJh!GACmUt+C1rnXBkG4oc(Zp ztjq%f7X;GKZ3JfTZ2#~8;hAO`Q|jBe<*c1P=H76``0R&ka&~zR1}}2HAoGHX+sU9K zl!-fDNnz*_xuX>a@#g*657$4Py?pul`ueADU;nS4&R@NEK>>#V)YyXu3*p1o?_eS9 z{nis%2-lTdjKZ?O=e=%AOO^xeu^piSP0KKDJwZqrI2#pPM)GQR26+XKhm;XJ*dmPf zx6!SJq%!ktj>%hL>YEYBxELghX)}}sJF7-a5ug8s_W?=f7(R9F-q_|-*j2D2gK~90 ztGa&u^6K?Xz_AYO>cFlJ>}q>Pzj=1`OI8txYGH>m0)taJL}?zvpnhLrP=_eZupOc_ z`v!Z6(mar-LzE`8-xzH=lo1%7&!LRKr^RIs0_$-5opOYOz#6uLz}h$1gTQ(qPX~b& z+HZ_D9m)tC$_R9{Lm7dC%P)0mpBzU#xcq)kF26$=0SFikQb+dAF#?a~6)WhR6{z~9 z1+L!oA^ca^*C5hAwt*zMHqmJf(*c>hNPNBYSw!%w&j>QC>d4$WUK(l~N!0Xu2y+IQn=YxApT z1=URHXRU6we)^a0!S>U|G*(GrqH$tqBd5M36@!T2frnc`uG&_1ShH#&tCGyAx!Mq= zzhoasNp-g3VmZVfE%G+uiX7Wf9M4F-Ub8Br0IZ#pLf*Td;Il)V$P&)bO8ck(CNE}R z{Cj*fOw?t3!KO(oH6>R`Pu()M9(d&2;YadH4n6W}_>mP=t5U{U*OdH)s@28dQ*e$; zI`qjm=CO;x$Dp@_NkVrCGll*VmLB>`Sbu*yhx$u=&Y%5(=iVhfmnc4!GOvqzK=y9u z9N`6|^1DC+@fje5%@t_!DUA?I7H<%YaA+uX|oSp>0vV^b^v&n9KaAYAR4Ona`~jGCNXH} zuKB&goISj7{z$jGawl`3%i!EP#l>ER2{85ve9G`GC$+?PDFLZsYvp09-db2tXP5|N z9y~EdwHnl2@luy`L!>A+&g4VRu3w&?lY(i@DmAg$q-sLwur1)86$PP+)FNk<%49V} z-NU59ztZW?XVd@v)8FhrKA-;APk;L?2K7qDSPD|0Je<)A7J0;Vfajs&nP&(UQ*{AK zktg{U>3N833ZS!asO%v!8W8dfk(=|pv4OGSGlL5a}E<1J%9lbx@Jpz$!w`1y{U+o3+ z>FDkS$hD=}%ED>DQmqS#$C}1n@v{bLameD-k|(HMM5h%)NkJP8#fdxGVDw(JLNARn5qc0y6ab zY*%JM2rbqtiiT!bA4@wFrcXO@;T2k`uIvcTib6&+hb;yGSyIjXIP6!rBD^eX4b<|e zvx6u{-;%b2HF2hVv*}VW!i26ike)5`YqNr_ryqn2G^(l&P&@G9g8bx)7hJ@g9|eO9=!D>MMjx4GCk0^_BFN*?J4E_h`SKqY*9?&l#b?(R!GHc^Ee7?;fBp92o14qmf8(bg|0?S87JvG9@>lly zZ;73pp8mN{Tx~5k7kVnIDbCu(l2U4U&KS<(###c|rh}a$W0yiS%tnQOJ99 z!A80c+ji`d3c6%d|FNmRXzE$F0zPmF9LGDHwO{kBT{*d9>$F*fp`Fv#OD#h|#?Vbj zF!sH3MPzA|B3se1A=7<9Q(QYM2*}I!PJnfZYK!Mn@QmwX)6~+KplkY`_nJ+$Gy(-L z*9BO=;A~HwXajQdr*%&vf2^2hqT36!0}DiQSFJnHX4HxnfQm)Az%a;#th}1iF;=d~ z@rysKj?FgsuV3?@LDvvcqrVSqFl|Ai-{un7S>D@wP^ypWWBGCQG5>h~adY~foRqvM zxMG97Xl4U`+>h^Z45uPS%csx9x6#lp`YE}aF zUv(F%e_&7}w5j9MTAdmB8nB`I067h9trf%iXYUQs%5;IVeLqg)uM76pRnfc#i*J`@ zd`E+T=bM6T<~>XDn|-~i3#QCz1z5+<2&?l2sYOWDMS;;I%4j6MyeFY*J71?)+%RWD z^rKV6^(mlauRWxUi0C8jjSf@!i;>{_Z)@s?XlO>ciSd*H6zP z!@*(uzZmA*t5^A2s^}Y-5K3;@2CoYh#4Ip%oj?qWw$er{$jQ7McORyx!UJ)It>w6F zFjH_{Ae+aG8SkxK3Jhq8>%IL!LnPJE>Q*gz_`pm-t06s)ju(>s2<)juw)`9`>M;iuwD-WmoD z0XZf91$dzKUgmX$=$lGcRI}wk_D#vEB{QN#wu;T_m&9lvHrn))nyFv*r!ndPLx}lb z$Edu6E4Isv@Y6`oOS(2E|Nj{B42S6dk~QU(nvpYWaqjtU_=XLA4?8#g8rAF{HNT^U zEjUR9VW@5ObSf7++;T$hS5h$>hi=V;N4IQqG-=(CezWn>xj1ShwbrHddC+tI3)aH+;aX-&@j@aFOK6~+p+2^4&=l=$-u97b+K zHt^k!K7E2E%&9$1l3@km#$@5;)cJ;71q<7?!58$F5mi?V3>1=~-iw;985bG@%tf$v z?2W8RF5#(r+Ia;~ShkZph^7b8w0}7cqA9e4XxiHjqA59urenu<5KRxF>7$CKL*Xya zrc-!q_SrL%$+Dy(pF#m5S}p4yQ6tVvK_*R*ef*c+)4 zs|}(wD;THZI8j(au=v9fdC0^-$jM)^f<|P#&a=?Cb=>@*x|U6u!+ztFq3-->NzTka z&@&l{iy55Iz61n|SDXvYs=KZXUZ1G;#pk;hukEjPorIzGiebe>RmI3Q3Rp%b(;XJjpft6|o$pHNGyGl%b!TOLT+9%3q( z*uACA`d^A}|52Ad-sMr6Sd$6*%#FTo?k9vp+GyUWkptp4$!nUeT>iNkB}DAn*RKuL zS=7Zf(->+A0vDkW`!9>SGr9}W=ilS{O#f*AZ+`oy_b4^E`5V!oHRNYZXJIOZPKK7aA!+iU7bvF|D~+D$8s0t=Mjt!E-6|twD^HY!>R9O4dD?dhIygGmM0x z1yS|dMYt500$?L?(J}zCZ_!t)vx!*29EG*aXXILz%pOG89))pbFxhYGIV*tb^!11Z zv_L$*Hys-#U)oq6*D096%%5$XFf$+SW1Bw;@*GdNya(`-Z_Zz#m2i&V`T81`jl7uI zO5A$Mb28`V=JoWcm?kHJ-2?K84-a=I-VW1!!w=Mc=(MNPFYxj>`)PGQold7_Ug-R0x-T*+TyYo;SRiHY5Eq&iHj-oWVbx!gkcy3+-z+F|6$I&K zRG6=TQ{RF~LJY7}vq%^$H&Uj^<-O{Op&rip917mEx8o%ouuEC+tVhynixC~Kd3=F6 zThTi%fyKhX?U%Fqmf8h8+cRUOHUvUoAJ$U!%G)-M`O;juARZm|8654@%Y9ics~X z<=+#lZIpD~tH6pJ4M91toK?^3$BZ0(C$6N_7hHi-egw}SofY?VqmKII+Vcg5rZv$d z?u{n&JaXoHdhNRj;hB$x`}IoMRV~hvDZZgBhVU72uND@-L{}SxFtLZQ;aTfSW=!>3 ztKTW6Oh2G;_!Lx2jb`M6ZU`-ubaUroo4?M?YDb7G7i2E=YKJYGZQNy)fg!Q4Pq(KX zV}Z1FMb;I|Sk6S|0BEQlP7&CL1cn>`M6?c$##;$@AmMPFiyVtlG#-NHD1h13oEZ=> zg%s0D_8#_Hu?nrv5Y)EAfGjv0GG1O9m78jJlKQxqBus!K4Fh@uZ<-y}yYpA%b8=$F zbqYshK{@1JLM`S9b8KeG7p~)(XRAb3WI+qXCWeRsjcUN11J-v;xyUQ)m3 zZD`JYf6qg=A!Z@$$F71C_)f7Nm(MP+(xcI)Fn7`%$M)UFGgmTAA&i-~!Uy}h9I=Ca zdlg}0i96Ww)xMLRK+m3tkv$PTQ|t{F^#?5GpW?U%h4wYPgzy0$v{f4dbSa~sHyTVt zDriNRwhyCYf^hFCCK572Nkv88TZnjjWKhP{X#Bzc9GK|CnCP$t9u)gTW9u6*0&wNG z4y^*{THn%_W6r^#g~EMu^wJ9P-r)a3?mUj7xw4v(ab{bsY?8oPP|wM) zX0%vIrK9VyvnJcG5$+{x>dSr(gM)%C4W5-K4hfkvqE@mlaWpz6P>|4aPHIo{28?C8cO>8vI9dqW)TNL+?RfweH&WRmvq*IrPZ$|@$ z495T$c=@>^M{nFh_bT&`O^J^1+kQXM$bZX4ZXGO%6LboKl|!0{B)mbiVqcOU1@RLk z)8^1n15-0FxsH95=YhfKZ1Q!jj5hdM`aq zjC{?()GZ3SoRMoJuOWpnv{BaR;0qrfQdbeU6cmuEl9lqCrnpn4F9aAxMZAYI6o zu3gIfScSGBuwAU^9c$w5ylfn9aimWqttSw&17fm8vNFdKdZwi0AI!+YBa@{ps@Xyz z#kBjy(-|S>jS>b>B56Z5SFWmI&H`R}%k;ghZgDw6!@p7Ns(SEl#p}p;f7}RS0e(6A zirIX}!8`qQk*W48eA_suZGTqp`s7xeF<{met-EHOI=~nQLj&cNem9 zld-)Ig476JSa6zb#j;x>??t1B9x{0knY_KrameI_cF5%IZHG)=a>(QzJHA6E?;(@- z(K314qE@1Wb<`H2I&VolPMnqi{ zlWp0w1?&pJ;sSFhJ9p(~D{ZU=T@!}7#=dggbs%iU7*yF&fGJ5(C${BB)>0@w=LOfk z5H6@(8vL+#Jny<_@GiY4%b)pr&GPRR44J~`2C$1UmKWkv3=ysXze+c-W!)|@M&Qn5^yB@=n4)@k(;JQEFF zyoOv%Tc`6q;X-LfyZqJ%Y5pM1AEf!P9i;i*c97=DL7E>szJoM>kmesxnqScY(f#=P zFK1f?&$eTvP?*QkTtQ9KP8fylB4<{7dp{%ByyOK10hJO>mnhSMG5IfNL1BlEUh&fk zi#XTP|Yis_ri7RGu$f%zv(&?R8ttL z(IzMdH~_O%R6yY}u01m=siC{#B^>=^)lj&Z$WmD9!G8FLD`sNE&; zwW&I~hN`LFFY3oSBR7)#qh{5HEDJe@k(v{Dv!X&OqIk|STJ`9*_962+H@j7VZlxJi zqhvU0xNsR0x}rr8lznaH)x8KtbCbfy9lN5f_6)!O=_i`!h64Ze(|f1ZmrT$f2*dGC5?FkJR21(0)PHuXZ*LSNVOOR85XfCC{>QTQ6E zl^KoGgl)%gq4H=5H%5ck;OMVd!Ki|yT&`@ml_L2nUr^8f#bF+Fui&t@TC$wiWnuup zF+LqCd-tHKZq^Ky8@wj?SVXvX!TmJ5#p9Rr3KZQ9N=88y>!TxAgqTqgQ$L)u*ycDK zAA4vWJDwn+MYIZ=MmjyQU7Q-Kc)>~-;m9gaTYEOJWh6~SQT%5Hm96@>E?V3ywY*tk zfwS#{;)mB}?F}{^WJb9I6WIW#WZ8@XqodlJ>|tjh@r?h>umT|lW2u@$%*?alCmyLZ_uVNEoYXdV6>&>Oc-vCHD+K!}iZT864iP-bxS zw(u)p4;E>WObtTQ)|C^y2=82Djw%L5%CQO&#Zo_emj#6e7V{74ZN_4S=G21>f&q zP6(f|nfnPIjr0oEf`Vz7^^$?o1c%5c-@x$0fU>k+-~Z7}8BhwRf3$Ka0w3BK^!Ho8 zMHUw66vp5+v-hqZGcKQcZ!JL(8wn{x!>}==3AHuE!Oa<~Sb{QTGy(xmF&E5lG)?F@ z(x#?QWWL}G>r0GE+<#ikAf&@3QVz)E#Mk7H-lui3;O>lMXp`gIPS!bPCM zUNK)7JT4x)SsMcAe?Z^xjJ!4Kby3(d>sCPTPZuP3m%N7Poy#TN*eNdR0t3Un?F3TJ zm9FY6!YBy1gXWdIWrAcyt#nZAy|K?$jOJ6swS$Okixe3XcpPmiX$~jmThAQa>X?W$zCy;3N;9FqZ+Lrrh{&**(7bBwVO+W8tpy(8 z_CgQzhzZL~H=v`I4;j+tZ4WojV3@Ww7QMA|igx3a#GL`1BtGr5Lk=I#3^los`S7FL z;&1S3<8nbbT?P6hJ}}rTAtm$?U~pPmxT1Ia%b07wlunZT7aY(OJ~w?HL*~bp;M&BN z=-><=j=4EqGZY9#!LfVOyxC+Xh7zr{v?fdqZRcN-&srji6;lOWtCbNvfCi8gWq&cV zn=rfmPuQXMp3kHmy8m<5!{6 z2+Z~v;52DG4NiFw>^`AKCtV@#tLRLMY=1GKQykNb{IIe{kTbEtMSK+;lt8mf=#yJ5 z(y-s)xcRX}(@ zTm?4kw3D^j}1R;>5PDYm5xWiY`0rG#_aMO5lpP{5dl3M=XPO#N&OOw zz3fG7T;A{tZH(Z=UfVb4Tka~~&shU9QZe%#9Q}}F;o8?gOg2^$(<@%((=`PMg3X$# zNjUPvE}aQBZ3v^d4*|fWJ$4ut%$b(0_rZsA!j2_R&h6_{%x(z2qG`K87F!8(pWN(* z!k?NpgPF_NwSvfx^P&@ zzNUa)!9XXNIHz zz)rmM5Sj!6x2zLf_z-BFUuB<_uj(vg%$wRAb!ijq#N%fJ@t7h?x^Ru6Xv|i2OC`vF z`9{#;Q%Tyw<1W^}jj+U|{#s-h<;Rnbgq`P(zz((p3(LLo?AzLyQ;5mvj93rkPbWJ~By?$r=$v&8|OotPVY&x*qQ|6$Zt&AR4|VUY^LkE|gt zAx0eANnXkI+M43a)9rafcu94KrGi|BN8*No?+zhWEj|gd#_eII3BZ9?72kS{Xh>hu z?yYuz1p}PfQ+Ek_6H;2M`W4gkl)O`0I4|DQ+M{hJbRFvB){9{k?io2bE7q&vyMgAJ z(lZQEF1FUAHRhLg0{dw3!*^p?&)SG5KM}TrL%%xxvzdx(I{F|*sMMX?pGU^XK%fogdRO&1bKvV zfHZjfSXtk;`FobJwN5mwlkoV=$TdS1qdi@c%M7YD55-`F&CubTY03-L@VuLDE}Ph8 zoUe^Ff)iZMfVcfFtv>D&j`kt?7sCMOFn-fNkm!u*av+{B$Q1+d0^IJ`AJ$YDUH)sz zi@G;NJZ$b*G)@o5+E*=~`Y6AeC(^B)Z>&jCF&pX!mAls!yW_I6QtfuL(XO>kqCu4F zIU_5+T)FNtx~3V|7#dP_XWMT#SCCgzU8_cX1la?e@Q>)E^*jF9QX-5r>B;SQKv3Nf z=R4p)A@@mAl}Nit06-bI4)7C`<^T)?EQM`uBZvZ|Oc%RjQ=tvv#BEFL63f_k1&h8y zli8IW_gUdGlTt}~D}Hn*#>nRhMnZVPmh7S@J2iR2m2dc$B2rjT#l&8T12#1K+3Gb( zgCwI5GPZPq5!iUE~SHzX3RQT!Wb(|bbM)7lOiR?NYPqM9iOf(9%mV3ugMDX$4vQ6UA9Wk5T zPvKxox=wf>(=*ZrH6}HG=iPYDPrIdN0Cm4L>X?0k85`}kSN_I!Ym1X_FeL|nIk%Q9 zmsy0FP^oIy0^A(6Zj3<633{WYofbyZGlZp@`fjI9>d>=cnTL$Ok@G4w%a~R-2jf=c1y>#8>K33W8e+o+-~r+dj;=r?4Bne@+DK?R_8_A!bX9z5M>Ahb)Xh{b1@jRlFN=)UkEmt!_%8Iggy-fKt{}kV|M^kL6sDzaDd!*wv=#MNU;PLm;;UI>Di-eY#pT@ zg?L!~rE6}nUsJ*G&Mwa#TCAfjz!ULzEGH^kv63R4j#31#BqGEBpa}Xzmups;E?pE! zCdD1AGz3g61^+qfn8y)#cndHhXs~fZrZKQ+%xo>`#$nCWBB^huE_HB@CD$&@ER$tf z3$8cMAg!6tYomHT%h??(o+-YZ(kfeV%`#nA>=|A2DNIm+(mN~jln9IjN)Qj%Z11a! z(WEV~_GXh@@WIvV>znANTJJ96YhvVFV-9FG)+{|23k-XW*7I}-LrmmQW6`o9Ze&DN z&%xc~{3}Gu8F?A2_)ZYq!$Qi;jFS73maKS5RX5PVV{R)%^-j&UJZxi!u~Ax^``Y4E zUAQulUTF1&BP&+0JH+aVEF2ZSFBfIe&$7~tZvi+v9#n~Mrw3>5WQGj*C zeFY9Uq}F1pnnvS41Z0?A9a<^#c_~(CD`n0Xn_;QTXVHv>L=28ZT%JzUXo>`F{TDo4 z7pR3>GJDH5DzI#O*<%=4!2yZLYDo>-f?hJJ*-}>K#}k#wwcSgQG*11N4D@_KH#R8A zi6|;SGY4+nz;!751t>W+-1W$_fP42S$6z>GtG!Q6fR^DGg8!ptO1;A*Rw`R#+om(Y2w<6(0_*24%Y?`ObW% z!@A-nt$48kp-SY|g^V*B3`68OE7wwk@&re=RX!`MO7+r-;6pdTG4rvfi$nGH1!tA| z7ueC1gEnyC6Ha3sj%%yNgwb+BN!vj?Wh+|IOtXqB&9i|JKd;)@(}C&|0O6WVUdie) zjUmmi@HZIt8$q^BlN3^MvYrAX>r=$XN^%K|G#Ct-!Bg?Do&pQ&SHQs5C%}7p3aqE`I8QAUr-9y+ zF`jl2oQ7nM0eq(}^roSuh+#YRA~y}*geb044{B4&?$umwaOUC>`nXP?z>bTsr7k2R-Yc zXQhrc5y$9hFpNgv7mbD>Psc7wk8n=HEovhYCGl+bAmuc#A=D51|DtfD7H z*ZZfoDEe>7s<#%4Q^11o|%R!)W!@-lG=V{M4@ykC>2TQNl=7F zAqbIqN?J)WdQb}&D52vt>TQ71bo1ojovih8=9<@paNA)$zDGV=;C7GNcP+5j>sL1nK>> zi~)q40Qn|KARR)-*+IQY>h)pBIAfKV5r{bHXgK4Rk$~f4EE3LW_=K?tIH~A2Ekv8- z3HKu3?4sEu_xU)eH=`GJ9NJAX(#=RXC^Cd{6Tmy9AIpA(o9%BU_t}GP(~Ve@+-n!I zO($ASa*q!}wHb+Mvj>{ZIAoV`rhqgAn^EXBPh>V2g;=w%;xcM?#-h|%{F#JdBqG%8 zV$Y;ZaS)wm8+RtnITu5w>BO8#=(Zb`=0W1rV@uQfho_Fiml=&M(?X6(^Y8r1xH5^C zFBMN_4=kBs<~9mP#-YRv^!XqRnNf>2@|dOJ#w0k!AB-9EXeo=}LrhLu#406QuHLM! zAn3qcjH*Npf6zB67le}LVz~2WkIxmO`P9(3-(UJ7&2&u*+b!lNrn}CYW5gh>FS#nQZV-gFq6WRhU}`e z$Z9mr;HY-jHVCVMbsZiig!e!t!p`#vBDsCW=HLv5Ct*HH*N#KT_PUZwqlLi2+q51$ zSp)q#ZtCWUIuR|1timWIy$X;62A353nxzD=`0$j0PNSh+E_fwH5*k!X-0%+!;Wx+- zg1g$1JS~+?jWM)(U@dZ16&tWK!oho-111HYoiSoy^OECmPMCh_{$fVmh+>KN9;N8> zML5@8VVkR@I<^&4{AULC3M3iL*tY8bA78m2=meZ% z8*NPJT-F*?AW&7;cS8ucV>~PcRr<1$b9TeiV#QihZN2St2h6|k0gPgvT1*(SEbI!U zSlUp9`;z2Tv#I&uV;c$0%x)?}=*^J!UYvFptrbeG$>7(;NQ1UBBV!oR$Os*_CMVbj z!F~QotY68LqRa7%X5VuwwW>=hrWK<(1m@YlCaoJ6IlzU9<Ir>wLhM=gSUWbp|ZwYG+aJ0x}7&p{lIc=RnFvQO>VEj&E-9L3qs z&1Ri=eatz$1Ap(Gvy#TUo+b7@VhK{6V$-xN0~A=3j6KPoh9P6mdPUV3<1IYjXS>8d z_U*)@Sez?&6$cOW7WHagLvT>#I1}bK@Sj=n@5De?K&T!skvrn)>-rLwxjs$R9Ob z?jEJKq4|a`;apd;WO~KwARUG9(ntiDS<^~) zr-p0)?z^iu9husZ&C@F?WXC;iCm!9vQ(I7%Huc{9660Aa$OfZk;GHWA{*Yjk0HdIS zynSN7!o(e~q$rutO(KzESr0ZR7HVV_hbYeiVoOW9A=!$GB_oP21z+%t3SDf#QffrF z-0o3#mqKcuF$X44v4R1*c97H*e$hj*cYU#=cQ*zHs?x?(+5YNoI#OIaYfL+5)v|{G zw<88yFSuP*OoQaxbVq2lgml(Evg4BRo5SL=!OYqAZ-X&#O_hREJ>`+`(XQSsyb`Q8 zHJ6Di1p!uI^w>b}T--$}tjP-50YVg_!Vi+Ha38a`9njS?%P=8&3#ZW2uek^X&ont< zv*j#&!H(Gw^TMbi8^?>npoyMdxmK)L02UK)D*zw@Un~`FqRod;%+939c)??6wqVg% zP+qtwPK5e!hK@ommwjSx)S%HmT5ebk^+G(2_K_o z3zliKV(*J)xbORVRxrlytA;Bwm$G2Ai?o>~!4e%eg?b5+Ny_$qb9MRBzV_xCU-NQ} zjZ?pQb8ToCEtzK35DSF0u%b;vuw8H#JG(re0qn+?}y`I33eNy^EYaTZ?EkjG2A7xo^`g2Gf2z&1(AaHx6y=SMBT zC)X%sja=<(ixG0aVwS$}e(t>NO$?kF?7CtZ%K?D^An3dozfUsNbZP6sQ_dEV!7`>4?Zsu*k}#p_ifx<1zH=}rw?f`qyb0I4T-aUhUt5ec_wMH&KkmTM zEJmHW<0n6MP+Dj=LO=uDas551qc>x?}HKF&Ksi^z@n7oe$BBg=q92 z_d+he##EW%U3lZ3g{9lt1&m&8P6dP!b{`EU>azQDQ*zV|Z$32xU6kE4drJPUdIHIY zPN7`BVRtO$2)?n8{u*=7*}U$i?^BRtdj51ztL{~qVl>@8D^~JIu2^fqF7U|*t`{NS ztud<*L&X54RY9FMNHXJsTz&oWi!Z+TFPrjZq!ai{ZsUM^x<$yqJFv04>;v=O1Pc~Y zMW)Yl)7gvFAO5X$$bbW#)`Hsr(o#)`nvilrRuhs>$o+)$h`<92j=bApCZ$FUeYg8o z7%*f@aXNGY-ZvlIw;4Grpp3R#ua4fEkRQxzmsQ^DYFSqtqG-C;V_3I|>NWf7H1YJa zG5Sn`Odi)`K2;s&k@c5^bsE-N_S9M8yFH|@4C^X!J*8hq8Pre4>LwlJqu)F;L_#2x zuU&R{P4&v2&b~ct)0%dU#)22Fygh`}(L#zP)TS^8w2vd~j%?C9+-(VNFCq*<@rIkp zIz>>r3LbZfz7EkJc+(a?yyrz9lE^*fC~gJvyP;p2R(eKWFUj-IyNi1Ua1@_^bSM(1 zn+8$h^gj4^9{hV1{JRYPt-{}{(?6ef15XStWfT&svm}l3*mz+v#WvJp+^W`IaDZeG zQrp;9mQRe5>B7K8loaVQt%g!!g`~)L zTD6n*tBf>=aWS$I(tcHrQoWNYp1U#CjQp4fT|>iFjCQIM4fZ)uy{Mxq(O{R!Rg02S zf`|QFgY|uqOp7Tg)%#Q-8W`R9szXE7hQ=Z^4WcupBQqtVGJTSWOnaj-jjkFLR7;7T z{ZFAnX)cn7k1-sYNGY&!FPFbmOd$bLL zf{|ix=n^xw5lW%Yr?7zUcK|F5!zuI)l`omnF`R`#R0T3D0CnP4>~62cuGrFA2e!Fq zVy}V=I2yyE-zhbI;T?`ePoGb@>J`nnSSA~DZ^GwWd7t$Ye}qD8k&M|$nJ zo~*P4ke)@08*tm7oV0&5qwW&{9>ZvB`ANdUIDXTXTX#YtY)JZkgRyl!YSE{`v_}*? zz71qV9UN_deG@+4cjquXLe_d+YjUlrHn;qmX}lH|+pzUv&j9<3(-w_|uGdWD7|(M`6TpWRF7nfK_t*WfUtoNyWuUR&q_3a8Q%y zy8R-_nPyc9X8)DE$G?MfJvz~~?ZF|)y1+W{^Eb<9>ptOWy&ow0L@QZ~+>$wul7F!^ z;I{!nepC>{<_*|$rm49j&u7m+fAI2;!WsfY`j*|;i6!oCJa|MEqxpBDh=wA!14rEb>8z!Nz$3%c912ZU_54A1+d{d*p>3|V zKeEU1(`4W7xaQ$hkB-O*K6$K2C8a)n@b=nizy7d}mi25+9UvYJzgQ2gL3GYr>l0an zuh@#-F{8SI{h-%CVEdKi8fOLOg#hml00hBm5O{_D$I16+S3kWyyLcT#o5CU!%+0)3 zK0P3qK?_=Nz)a%D+Oer_{AO2x*17pWXi}|fS`4fK`;Zm2;&%_d|HBAco-6h~@l+UF zF+fjQxB?&p*pugr&{PPbw9JoH*u(A;_KGn(TJBor=xn?3{edE{HO*EiaoH~!=|=Qu zACv?39<_wt3b?xB>w=L#`dW??jI;hza5~}nzU}q(6#wY{^{1}mG9(+}SCgc=*ESFw zq0iksV0t!2TuU7DjJz(_k%~WvzKwj37DcNQWm$c&vDP^Rueb8rY)xIT3AqG1 z(fkH3<6HUq1IudNd$$JfRm4)#TCQ)K645xnR*C55h`Qp>{hG0~>)Eqzw``+)NnTr+ z8c_ZE&GG*5xco(|%KJZE1cDERcR=Z~`D$;cu8yb3VQ?_4eHVGCT6H^GDzQ5CP+dan zD(I?19Tb&*{g0X!ZPt#z>h0IQ+$zdyUc2W-p3w^3C>EblNgEbos84T?85N%NG$%pX zih{J#JgW;@5pz$Mvg$Rg4d<}X#O#E+FNjP?bEinezUNfiv>xzNGMHTs+oWN`S<19;-bE;XfIdu@TSeUf$ zfVff~Tl zIe(N?YzcP^Z_l1LECKYqOMcRFEepBaT(6B*_EHL^E1&>-3ryG_QP3gA`D2fJ3s5~n z3~Zk(c@KUA{AN_zS<74zT1qP!AtJLI^*(Y>LFcTv29HG|mw6Mu;j8f(9hQq`^f1yH zxs-Y2aC%`7i4ly&x=&;U{3f${xR#A6Cd#`+UCvnrC7jGsp-#sulF6!KYAvxuuixif zmX!BqnkPTHIe0mgi zNL2RIzb$hYmJ8Zp?E6b|K|$y>?sbJ&Rn}5Gg-i(ClPH_rGPEDe8Ure6y<vz!swD-fY_DULOM(_K>cXm6j*Liv$c`^Su& z5m6UV92+ZwfIyCB40AK$l#tM+xnH`yfPFV*faxTVz+n>Imvs@nL?5ni*?rROIljP$ zx58F(wyYRLW8%)kNhl+HWX?z}*c~&pC+B9)^BOJ)*udZ4ub6lz6xCcU!1wjvujE^) zokjb7zc|Quk{{Pbi-f4{oG+{cjm(+8XSSp~YHoa~=jC0z~qrqitlBmF8;Fr~1n%LNy& z@c9|}+T5BCv|JZ#f+3k-On;Vwk*uhdj>W~hW7L!he2zQ}Rv2g!=t{I??Yq_6qqU|` zMP596@$C7RMm9#PK2;XOWp}lo&&bE#9?eXilaKKK7xw>OkdNdeA(!Nmg#S1HBOl4s zEV7+iY&D-x+C)4vO0T&Jb4HXswCbnilVt|n609-g1T6i&%K z*!)U*i+05`D4}i!d-BEfdA}oBigq`5TpAkgW_t4cbk>@>nc|B{8d-M1=6=>NYAQDH z$$om^NWq!d+|$h}{1U{S8hc`A5x-4}74sgGxDq(mTK0 z5sn{LE!x{fjgSaLjiV&62&2f>qEyX1Cy+(zEVBenv;AFGjA})GJZjU6ACJJ-;6-g4 z9cLvP43F&X(_M=-tIQ^X;2~@^pFOE^YkjuXf&HVVh0)l_65J%!&Wgm{M0jx9Kxk3~ z^kqiQ@Zc-(5t(^JrR2yy_wJda3H>zx9%MoH94TeRY&Vt=T^eoz-cO@x`QsNUrtPn+ z;Kjtn$~Y7L+=lc}NZ<aK#7^3F%w3j0$reLS{NKasw0uwb_sT zL{FKGb;{8fCtr{$`TW$Ja)H+fHZc@U42zCpu$X}wrNHcnf@~k?eoJ_0Rgk3^mm1IU zZvj1+wP^O_TwKb$?SN|`ImE8#oFQri%gKrRM^hR5v=`{%ad@(jIXhcGNc`qf7CcLf zwK;mb^IpKCSMr|RGhB8!dcE_%1aD|Kh-c;pf3|>6c~)noR>yLNL~;e&jF4(T_P!)j z@)s#&^(9KZ=2NO+Wxd0Q8cn#!iaKYxQ_lj%tc-Yi4hsL5`}Xe51w~=UJN(ff`*|W* z**&8T*$wa*j;6hK*bLxCnq`X!)aC@tw(irkKny{95nQeJ;E=~Iu{mMq0s=Foz#|sB zW{ZL@d+*Aig~P1u4Y=ROUV`wg*cE_J^wR+hCyE~T&SM=rJi&3tljDkAP|%{r5XvC z=d3>$-7!#01wlCRK`P{jrU$}kw!+|F{J@|3FOJ#Pqj{a(GVS~u6_iU_L!J17ip*S; z?f8%0!s!G*jy=MtFg24Un4=Zo#5b=1!Mb@1Rv{R$(jsyTUh6P?x30$c>E zBk~EP)HffDX$(jH&Gv|lIC(U|ul{VapMtMOgwfV$&UKgNX5ag~W1mVhrthk4ZO#Qz zP}JVjeuyeV_xS>lMkG_>_}E*o@H%eCwi$7#r5E=0eB#7kqFGTO;qhuYsGnLk`ZtH3 z+m^Zh{pjd0?9BSs94>&vYyAxUSzb4E34kT5%^Y#mu` z>jOQ+e+mCJR(bdT^F@c9B;s?ob86j` zM8kd5r|<&o=wF;Rc75{2vlq{vpO`tnI5o2mEb}j>&reANtFYChof%Ut+x)q3Ij6G9 zZ4|KG#NKYr%na?2wZ*@VvyDXfLtq9NSZqwp>}#cI3{_?6sx*ZYjUdT zoGM06ZmwT_)sc!B4~&$x{%-MIm9y%Gm+S{Fa@pfJ?kL&`_%VjB$pYg%Ydw{VDZq9= zvp>vbEqaNE0&3)ZM)$L7re|24;ri8AW|v{^M%385Z=+C%B~u!ddaHFq_f!$k)2M1z zS<`aeFLYQUXS@B=f8(0ZF6ajUsh@VP=IM-l*URDL0zuC07+qpsH^NTaQZ`u9>QDbo z?q1Bk_^(+{Linc%?i;y!y;vNbI2>}Z1$P|9m5Pihj=J%bh#L<<+vvlCPDa{Tca%Mz z^y#8Tt6VYxNkTa)Md(U06SjET*K3y9jomvL2Fr2UBYt=Gj+;%x=xx z6D^-zZ?D`LU!8a5s6F_Wdy+js!I1D7OL05~aA3%qEfp!kmcEAE&Ezi0^` zQU9iC9S8J$;jr5$Hemss!(91?qFv56?(2pE2Zs=1;O(EDY;e=SLoLyx2^_dHd(0JuYPB2LgVy&yUE7tYAbL6{KMFjya9p5Sk4pzMS@&UP)q< z6G@76BKyGe9lJLiDn?b?ppJ#CGG;xb_(*hh6w}(GSBFN7UzEU;WOzU9{rpw>I=MGM zRTcanH6!P*9D!f6N(aKiq&HCrE)lO;*+zI{wxJ~{nfP{*6FXbXb*&bb1M{; zup?=T^yj)_MlMMbbo|rX!j1Voc||ov8ON5XhzC&vLp0*c9FRBQl|V>&fIN`_*9Xs@q7%zg>E@}X;f%S9AfpnZ$Y)8IbJG;8H1T(77hq@=71 z&DW725#o-#Ibe|D;tOxm3;=xydBrfUCI8YT+Yg>VIIf+YT|ily+)`J9RcdlLRj^0FGCY_XjTU*l#Is}VBq!!?&%la$Is=+HDEB}Cy)A*s zz1S-hJy3ob=EaWUMjv>0b^ah;-CwAni&sPa)-GNRf4FAV9naW+!eISyPsgtJKTP>= z^)L}zE@c!)Z(ecy(3hxmpPJqN zCn#@LO?!qL@a*dK*{h4!voimemAs#7Ijt3&avkH02`Ed6xIZb_MC&m~_{ZSc;>sp) z(Bez-PN6v;>|oA?DW#5UFBP@rfv7dV)kT48tt-YRp`|HOGw-RSh{kZzn(BZ|F{rLV zkB`j;$S-p!$8ejN?6AAm%{%SYzHa?~NPC2XsU@Uj0La-wR_1J0?X$#m28-~lR;-%g zr$3d&9b$Aa*ee#TgW9#US8UO>vi8^B^BX5PD1p&huQ1gGEU#7^=v->Vs{8fV_Q^_l ze?n#9usw2dIBcUh%^+Cbc&swh%w0`C^yX=(IvcX6%E@{a%_YPmRj}i6E)^VSnwMOB zGSncYRtJhKd&`ep^ABZImidUdHLW0 z4qta{FoWBsel~$(c!7S++xRQ{Z85m;g09mnN$%+_S-}4qG2$?obuHHbYTCO5h=C9b zuS&VQmWGdW(grWJNmgloGw0e9oVYuXX#~==wF{&mnFTWfrXE1$cn@7H{na#?X@@i5 z@i;&K{PWKdEAK!4<3EV32qihoc)9&xv}5ey-=068k^gme@dm;l*IJRe)GPZ{^FXWP z2qKzk|G(?+-Zr^Z?KeSd^vl@_5snY@-~aH38F|Gk$bID&7{ot_FlQObFo1mA2Rn=JXak)0l#bq*D&ymk<~AM{TJyD+a=ZC#2xFj4aeQm8{nd z2sMVoM*Flmd^m{aEGnjd!8oKr`(*1b!P8q3p#>sn@Riq;S0n=NKx`}rgnnQKNt>}| zEVt>BhRnDi<#i?h4o4vFNOlQ}PFYb_=ysSAfvdnFei$KS2+Q2QV(WzM7Sky>X|hJBU8zr^9E%;HJ)4hO8KfLw%N+wdE-hF7Zcna^t%En) zT5kmlnQ_Q)6S{p=mW=HQ7&Epp?D>2V#o!IrwN2#gg%1TPN9!OdFrmjW9C^$W#T(oI=BlWqOAwaDCV?f0dx^3W9kSGt4d^^2VLic#3Yu5ecm%}kVO4*uG73x1J zbH}5bI+AwUtBI*==3a0~59EHutY18koDBEi1I5Kb)N?`*0;$DB$P`Q8la!vx6i>4x zC{9jZ`h+_dKy)rNs}?k4r=f*`tyipMRRmAi1w*==w-pt+Me)p71%!ls(5y0h@$&kd z5oQ^&I!dIv!i!Bcd`wZ zzVRrXYpSd@5nSa;$&5#V7)%Sc4OJ|Vj#^bby&Ez$HBdqc#HjN|nefc`Iq z>i}x#yYDo}0P)dQ%wB-lu{$_he)G8Bl5L#fsGOGbm4d}7ivnF0) zxN2*{(M?E@fN}0C*5>kF+|w#QyX?&$Yl~#f^Py1ceof5p=^T*DF^3`I@Y?l`{hD5| zE(4pEhLr7ivZ6<#)5{ez-w`#y#rANjp`|R^>%pmZaH{<_oNDLjR0~Vtx9E)noQhlN z#`-N@HIxp;+wHWkKoTF4WTd^c%`OJAy+g5%m$V_HJRs25fCAGo=i?@Y1o4*9IT&~# z*K)wDhYf@sC^m$JPA0wxt#H{;AX%3(cb2UK2C z_~+MV-FmRJx*Au+2y>btmc9!9@J(wRuyCz$WuIWWX$EQn;?*K~7ZVi`Z2PGr*!FQF4#*#&jFEJ`8~5SFTVmVp z!W36Pb)wYiimJjImN0#Hz*=6*^B#H{MZhNgUts5g0-69Zu2LdkRI3DC7~3?1Vi? zVzNx+dQha`B?s^T1Yl=MD{_LroMr1eg=W~NOIFHiGx6P+*IWJCC;F>5Hw|hz)m6oW zE;dgnbNQ7UN@j0bds7;B8JJIl8WA3BEh#L71g=bYmx()aM=LcvV=`XM%K05vGU>P& zj=1?Q;jj{{Q89wZwckk|{MHs+dkbfPt%{U+sOo3CS&+@PEJq% z++C7jyR{@fF7#AZQ(XEl0jn;d6SqM7+?R$)c_QYe^d~s#V?^vh@YePSo?OCCjbHiY zqEiMt0+-nO)kCrvOP2Gx908;O z&xb2=4AW$SBW@-9xna6U6)i!} zv~V&DC`?x*z~zy)6a$CnwY#g%5onH(`65bxU=}S@+~7^u>w;$heGi%{Y_mT$H-PE; zftPhjYGn?&6!w{DulC0H0p2^*egH?on&w;j`;bgSb zZJ*NJqqgR!zm;Hhp^>1edRc>`V`?cz^BKbzp;hbFzs8d{8 zw-1biP;%)pm(kJmvY@;qCyFuh+8t^9%XM5%Ml)p94ib~TLX@1eDIb<9SUB z<_)cJgXG(hsr|Q10f*7nz=vjdC^t(t0GMY3AzQH} z0~)nGkzFSMrg`RTks2uytl?&BRjeHH?i`_TYl9H(e~r8lYkC_6pif~>5!~;Z^K-+> zbwPD{5XaFEfw??zyP7*qMLwm4Id+%dzZ?n?@He#;gLTu?8+L__jD$AojuJcotemqv z4@%5{4dq^7opSTT<@YZqgwNQ_{S@ueb>rB8mP-t-_qiT$;9&}Zp*h;8Str-;`#+kA zn>YV7{bNw(;7{)j$EnN%3AI7&8(~1Vug~`WQs&odmd$J#p7*E`6DD*u0IhW?A=--P zcvWD`75lpjo3Q1REfvhDW@0c>*`>h>sj+J;)(mTM0%k&2_E<{^bO&f*w9hj^*axlv z0tMF=wuWMqxff8(C(TK4h&STS(C$E(j3mnw_XDnGGn;ipbH~ma}C=vHv)-wb^Rzjm?^rK<9F3AAuoCv z4;kU0D4C`?)pS%y_67ANvuvmfELac%la{RMH37NiVR>Po7b~|$0HUO48VT-h(*-NHX6P1bl%n(K^y;zeCFgw_W!CtAgQgkZ@xQR+yzGS%X z(B#MX=CBalh0N0&d0RExnwOib3(V?KVAsM2lKc%N^rE-R*pd~!+uy|8NUu|0Vg`mZ zh0jf&r}#n=LJ3_P>0(PsRCUeJsOw~Z&=%y6f7g^`YaC!bM;Fp@4H0nA=59MOF<&12Y%3u_=lA7^5N zi}@-zG-&Wi>UC+RWmFzP=Y?VD!Qu1cZS%dfHI+e6S8QP|HQ}$?{U`O>@ZMJc$b4I! z&wK=HQpZ-Z4}c;1WS8*iyEC>p2N#d zFI>V8j@u`Dhh3X9Lk=3KBv|P18>3_Mu(j{-w@|Rddfa>!_KKM=C3gukok4v-DmFGc zPp^2DPuH~48?@0({OFTA4)Y}wUm6_@GE_q-Y_0utFRj39x&~^K5qcsb-my zoatI?mSN2eXL0#NXPF+X0k9oB0&5&TIG8&h4mL5W<6)80q)jUyA~zXQtJ)DzsWTw0 z+UPROe)F;}*dNT-CWQA}Xv0Q{kYZ}H^u6=O%H1w>7;Oqvq)B#GXoJy)-Je~aTOxfT zq(HKV&!!1(Xi4i-Zm=6KeYiyOR1O>9F*)&wi`?)7V2fbLP<58E#H(b@hG7Zhh6UK= zDXGp@Oc5oMjyoY-C{2r^Dbj5ZfCP!t`jSFHG>wD@Y4_Fwx-O_SQ7vkbVT>c!n=#RO zJBk8WH56Lu_yRo%jddZ7q`HFymbndb(UmJX3yQLZ5&T-Fg)+`*c6(2&TmiBH)f`K; zO;BnJ1uSuVoOVTC02NAd0jr3Ze)IOLnvDo$QuY6VLtjLI$S`wvgK2WX}5O z_Us`Hq`G4YqJUhsPpmFO*p^JNifV9tTIf!`AarM_t*fy2LWIWvoy=}aM^frw+ieeE zPBbULUEaj)0z{}&^3K+N_x!~tWcSzy(u5$iA)tK#JvY`wFe4{t#d;NdIgzn=+T?Rq z+p7|eJE_N)l~n4j>$cAf;--*lU~tnsXyOM=ylZ*~O}wl99yIZQhV4C7FP*iGi@~J# zzQE+I)HYB7Bx_2>*+9vTmPUbg-qX!YFl~XToKN7&efOJ+4xo>R&8lU=#dB1_L1pbR zYAunaHt`zp{;{$V0_N|KYCMXF`IViKYvzjOgp+OufhG5CD0a>?<%Mc^=}kBPPVRIB zFC4S10YCiRTeo}$+<41WlUN!AKZlX{{()qNRhQfKd_k^QChu5<2jKOGH5H0W@ipZ| zsz=BjmBuLqHR{^&2_wCbo}k<9F6{zX&@a=c4GdjZ?2gMiZ5?d>LakB4P}=J1E57t4 zU0tX$gx*wnx;Bg<#Z=d-4YHC!K*J-txc%Ngg~SP?O?-AcUK3PE1+YE=zY2L(auP3b zNWf-g&B>X$F7P9h<}lPMnST=uB;%?{A@LDZkb5HtHRN@KnUYv5kSD@$2V7L$D>VOI z*|DD$Mim@K`~yPVjMYbU@v^M7xpdKBsj!U*cOct4d=>6N0Ix};Naqp+gFwy3x**Y3 zzlqu`+2e3y8zXvR+Z8~8et@mmAM{Z@qLD|iW-Zn-pLHDc@x4N{lgw=-uWlWe)Vc*> zJ2w-(b%FbyGSfTC3&=v_Lh*d;^l5MfN4+{)1}7t>hX0SfcW-Xwwi3njw?74HoGM8h zk&-;NvzeP4mm+CwUC%=+$@cEg@y>wVAc?36bO5w8%zD53uW$hLgX{*-BsGt?u~nNf z)qNU|gY$lv5iJtbXVt@L)Gs>7jE1vJQ(5qs-H~N9`uAGZ`sd7)7dTE~HVJ*PQ|n)b zwDER)bp^Cxg$1-(l?C*%=J_?p4hkBeH8J*usfuELoLCE^%T6^JwegDJ6x>0DBDJzB zR=n&jT{SBA9xX7#Gcqc{j;aJxZwLSS=uH4zIhWyn{C4lhwJR00azl)g7k{{AZuk2Fa@ zzhf;pnmk7v*%2cP_LcfUOuu-S3t~zlZlv6<0%=yTg{_FjsB#-f<11EV77>)&919|5P(n0`>XBHDo;=Eo4e@#t zW6WkorBIi|=F<*oJ|;612tqF)Dfa!St{a@`y5wdiY^06_&NbEfA1z$K1^V9}iYgUy zj82iHY?hHa4Cex>eJ&cTo{?6B{!!3-oDq}zj#=3lluy^>&vRlCq`-!%XsW)w#u3&w7XBjrG_x^t2 zRR}HJ6r=X(rUs`9tguxU)*O~mAh&dCLV2dRgxy{Q!N3nS4|1cWWfc@|cO||WRU{)y zq_{ylclk$fN%JXs9@inU29Ykbgl>z3F|H70NmiuBXA0nr=k#&5bRz_=UUiu3GCE3U zVyyL`t#$yU4wTWYNn9m?UaOC!7crv22u{cIK*YC#k4!tuG&FmSCQYU3Ih_cC&gPgg zlGSPq8;f1%oUu|knVWDAj5H<4h}x5A&cR!n%qc6YKeDn?bRa_@=bgkqM%nJ!b#>3S zUA5?0^({5mzUs#MGE~R}I)$yiUp17oWB|6tFkxs73eWnHw!053x?Gf|RLZ7A2(!Ht zVqfsWrBhU}T1Ku3+Ok>U z?e^0=;jCc#c&jEV&(Dy;Vn&pPgIKYc5O3Me-L}u_-Ia2$Y)jc##pXRF5xRB|A!Yzl zn5JALE{M@}!8AS5^vVBdd1Jwp^hUnN^{X`7|I<&e;`@m0Rqu42<^va5`VfjuFhNTD z8qk4nB@qf~uO_E{mFwYwrad+T9&c`f%RSYbfb=dPni8h;&H-%b zJhGTjR#h;p4j^Q^()Y@lCnQm(EEbeC;A)N}T@;zZjPOEcOD{UT&qD|^*NnU~7a@+x zmX9}?EhHw<#2r{LuG{&|s+`jFsN}q5Svc~JB(|JLo)t6NS^Vj}wtBC+Ru>ZLSNo5$ z*5rL#7O`3P^-og_xNYscj#82n7N}Uo8G2sfso9XN_ujUs`tV(d_gu5A2FIwy$jy0{ zN<`i%fxRD3_+p_2*%ICqVdf`YQL4kPgn{%E76xSRhW&f8-lo6Wg~rcu8m3Fx?$x_L z1Tn`_mc=H47~7jAo249Tz4E;vo3m@=t2X=TulCIMLJjrPmn{vq&1(FUwJY@&!XKLJ zf7;FUAG@>p6iU*@b;PmHu2?kek5ilGPZ17~3|n0ljs9ZAJl23R<)Yje*Gb1u ze_c=zd|U6aAW5LUZxr_18U66X<$2$2((gDy5dPiVst8XjbQGcgDC#O06tOQi$HLlf zmBCvyOGsrhJ*V<6uEW&YYt5_m?b!vgzeZ{#a~VKk?$*k{9T~me96($}P>Gp$jGpL8^W?E1wDBaHQ6PE=)Cb`ON7j zUcfy~n5$+=FYH}ogZE=m_R>|GXh_R=9D8Ywg#vXe9y!Zb94V~*z_!KC%c+YqKC}gf z%SKM_A-|GcR!P%bsE&cp%g!U{C?)qtGQ}r{Fol?W)aE*|L{CnhjL{8U&Sl9YLP#r{i`{((yhT{^Ks*btMX$gt0EWURkqbbfJleQ|br zdvX2@eQUo!>%#LG-SWy@>`{2iL#9Y^DxGv2k*)0R8LuRi?Nwdr9pikeem5*BXeeg9 zw9_CiOglK+MSVQp8$%@N-gwUmVi~o}(hJn`rfM?v4nNM({ zR^1s}z7V1BeFs}*i-i>{^D0jM7u(On+{PZWuuZJ&91^}* zn0_nsvZz;F3CEIhY`2CmWepyEn7W!iH`C55yFy>x<0~3!`LoTG^M@{gS_AZ|S5su$ zL`u4fN0y}>m6JNUzBoO9c`;t3+mI;2(wtM~&m3K85$#@axZ{4P^{TQJhWs*9xsQtH zJma(W_QE|j;&am|VT4C|hqqU2)Vz;Iqvmcys+E<}yqZVHKz{Ir?^q~Y-HnicV?xZu zf)03UUh6ZJ6S1HsV!0tL`gNpEN%HYFcv~T|ykgyAW_N@6AQ{vY>B@uL&9ik+H;G^_ z$f)eEGNl=T`qYlscKdEwW$JO3IcLW+Z)eMuP`;Sb93t%s zrz98jo@Qj`GX%~lo7L(>)vHh0ifm0o{!9H|Rd#MCV7MQzUf)7%TJRTdt?1~9cu)eN z(P#uFrTxEanK{i4&`-pEpF^)*K@)`@=DchK3Tq3WC|p(3(agSmq#V$X$MsE@ld=*^R84%yE8NsQEdSP-ZY*Kv{dUmV;q>;aYD5qI#pf zh+4ro`|k7#;X?18qQOdRap5X%rZ*-ttM>}+dt0o}L3oVS?KXVA;l~PC-m%)ikL8DH zXV%+~<@aB`hfw@2ISt(Ce-+;qWmHkDxaj3KXuMULPztH|!rU-0W71%@?JF?mT~5~l zRyE8)2ZBAnWLhf;l_qY+KOZ7S9_*Z`dmsJTniZj+MfR6x(G9w*W_+%vskId)oH3Gw z+QP;i$v@)B9{mSfv6Pyn{zri`vwg32VdiUYfBftkuepg<$MCAOmlQG(?S+|LnG%>u zeQr&E$)0s`?xB5^Y&U0Y0g4M+pGtXOd952co7~hn3>;wd?j<;yp=gae{&;JVk zhF(w!p*f+B>+mp@w(%)QZdY3Ar1=}1rsA35!BZPR!Y&cD?+c~e7y@8UHtTs>69rZs_I*dz&^zq)zz;`FZNgui&wiJE>Q@7@k>$ae*dg``So!GQ<2Oi1ZSu2a#P*U}#K>IT> zeoWh(XTj(Lxuf*T&2EG|NBtd9VZmbS;JT0>pm!EZDsHs*>!A6=JU3OiE$LJ^;PrF8`tNgqJN%iWi!}}eYm}Yql=@#i(0>^ zZv5U|TaxN0^NZ;uvX%8%L+BSBTE4QHeB7~JA%$dpD-o8C>)P9oIsC(cYxS?05#lt4`Ua_LHf zPP&#Sa^{>$O_$OZcl5WER=-P={&PkSV?>4)8(U!GeD(`BMbi)1JQ%g{QeJvv8E zFV8o=m|Um_F8UPdXuh%%L1X{6nnc>IjeJ~p?*{JPN=Lb_JLs2)OQp5v74-W-O26C6 z75uoa-sW5~P?e!%o8HxIRFz?C{llPq51Qj%u!anMa23VDV6>{;rN^csZZ;cJ62bM~ zxpCvB0@$bdFN~z#gzjJ?)UA(i{vThRR|# z6CJ8|Y!`m5Y^MZGs4|_!Oq`vn>)L)-39Fovnv7_YVZTzdi!sC#g)`T@(e&>3!aY7d zHnzv(KmPHL2>O7e2T}(t57Ga-dHt$t z25A541#Ii*Y8)xIbBxYw;dgagA6D~VUkJt(!qch2K-clmQU+IWgwE!!#kR(=j0Wo8 zf;q+5gIZ%8n|3vMI_X6tyOrBroomS7p(S;KKlu^ z4zT_2ZPAkmyAq5E4-R02>7(P2V)*oU!!ch!(Y6}g!%gn{YR5-Aad^I2eV zM_d6koW-8fmEOFv7Nlvka&KZyyG)B<)^sJyLmWKSR_*OkZ2pM!iTwuJ_f^ z)ZlBmp(T^D=}4O$iQ>@ar6QhV^wKiCp2&l>3@mw8s4`7;W6o&?EX*~VG1Uef$cmfx zUbbb4@l4ph+Mhx6?Znil50lrYygGXKU+UL=DZX=kzd*mp)xGC%Kr{LV1xA962^}<} zCq6oXc!P6tue#DyWhziZl8;;<7f91+P=1`aZJXitSa!%P+7l z3AHyn>OZQHiFV%xT@PI7DS zbMCEM=Vgrg>aY3q*Lazu=3?eTj@HC`ee5e*^_)Wuf3?C@J1{vpls3a|@t3-jjb=@n zgGL_@Zb9VT57CD(IGny;5Jj~yPmKG0pR#E-bx$uy>w+MEECn24Ad{y&*3fCCZ`~G%ydk-sK%N{UW#0b!slx&mvcj-tfg;0$sd5FY+)RWlfM@ATXv{l>sT9UfPEanNcW zULMXBW5Zd+`iV&JM2~NgQGQ=YX8KDj)a^J)5{D620{P_`bkHqWs^VKQs^%g zM8VH7T64nSrKk#jmW-HZKL^gLv+ni2gWcF82)`ND+) zN=~gT%ZXwvW2h?{qlp*zMEHQ};~t9?gSYJ>hG$F(r4arc$%(4Yhz@rDaqp=LBa$|r za-+k_^upAVXzR=VtEo!RhTg0gVOh^FD`jcm$izHmt{2rk_PYKSwAvaS9ek0rtv1$; zBV_lp@#w-(>t{OuXf%xX!xbWCyK@|urZ}^^hhbTla*EcIpsd`vess~jJ7LPZszaP^ zFYjGwMola}odkq;$d~uGga50W>+RIn*UU(v(C2;VXK(Z#(YO2URDbQY(3hiQUGMk9 z3sY}*cgJfm;lFn_I!uq_UcasHbp3y*u!p<5nL968mSRkK^3iSB>14hkNntT!EQ5A0 z?k^ptpBk{$esJL66e5WqFRo5pYTtp`Y8}TfB2B$t*D0~X!Sg@cV5hFE04)Y9>r)fY zu{4@r+kx&CM49GqVnY?_ta$Otp~B5d+{#y=7QCu#%%R+;bQ|%cjBuey2wc2kD8_5c zMWTYm0YI24Ucq7rb+aIID0MT5tlfXv6og#NDPDd>EIUPQ$53w_AKA!(UMbw{U(C(1 zas0+E43PVAG059Cf@m@*A=`}G3l`I^bph$ABRhZp zE1nuy9zI`5P^d;OE$UM72Au>ExP!RdjuclfTa`ebxz6~zYJ0g|HKN+NZ8#~Kd&oeG zb464yu2;|BmA;?rqPKdg1cd`aPoFV=N8Cx#&bMwPPwmh^5t8@=QHEQNi$%Y>zf7Fc zF;pT`dw$?gz@=f#H9fEM@fa;o+S?TgH3ymXkPnVKmqMN?b0q8*Xt73olBif2m4{lvFl z)zi+TxH++mjSV$t#(1 zl_!pns%b2yHYpK8Y zEI`1-mC~zez)^tH0C5&XTU@nK`CCDsPBVP-YN}nl8cIm|ipP4DD^e`kSD$_@_QFkT zcrx{X*`rq0CQ3?1&vhNoS;Ag0gQB5(ALSX`rEpOdi$W$TZ%s`)N@dGdx#%vOVPN%lr*IN1s#4ScDOg%Tl2xvU$U%MCEDP zGwAr-RdAQ0R78-D(rF3wJVb6cUuTo$9R8JYcZigYhP*B$egI&R@mP?ww-kM5nhlbd z|L65wx)^91U?DJzLdX=2XBf0jiDz&X7(C; z4i334<;MQK=fPmB|NZn28m9qoY3Q7+AfYhm@PQ28*TuBy;7Z3)5(7(sx1o~@0ZZO9 zWzE{&Ct_M!kV)kETE6b!sdwjEjpyVJ(fRptVaf)wH%(7N44>r=)7O`1QD@fAty!{T_Gr-(gGL6Wmr8UtNm_lr6b`nV7-wpG)y<3tdFxQS2 z$n`v;i}?8mcYbMP?*sKW@_|)rq4DY7>|&U;wu9`1!$gyXc04rxOykwV)3iL@XBvKr zXR4={TX+vgUds&yNgM0_36GI6?vAAU)9_LWUwvdd?H)0F*>aJmtVQs$UbWyG*u+b1 zxOlGO+n3#Y&hn)*<8a=&AFfMRpX<0Z6gg}nde)z2ZA|21V!`&wU(BY-JFFjpGt@4N z0eVa?=xPoE>mo?+heyOTjqo8<={pPS;-~i*kNksd;=4jIs(yo?JD@^y1Tc^f#7?{BaQ&Ke0b45f^^nRXr%8S*a;EFlS|!zSlZA(bMvwK_al~2nK`@TmX$76g1iWW)-4bJjh6F~bbGHlWPo!yVS1&n7gN!RtWM1f|LmPLELD~N7*2AtE>Z3Nd;J;K$QvaW}m z_SNjQ<2`<7p-r!tH^s&g@588-#{O<*0PFCIOW)s-rDP()(SOeiy+F-Z`;G+L^~fRz z=rTu153>??A5|%J&F32Ddhehu(2;?Zh2Be<_}Ntb^=M|yk4`n9Er_hnjP0Enn0STX zSevgKKZSn+6Xxs5a=QVO#&0&N_VJKY$5iNFVLL z+=rlK$J2gyrfSjW?X2p@Uu$hIZw5JZxuQP$lsWcu2ybaam=)J zsEFJRfB>2lOBgHcxADyY^w3fhyudfw8+4BKOV?Tl&8)Jc8NBB`LZ8x{yYR=}Zw1c1 zZBQf?UNc8F3sM+#n3WIe0?E%Zhu`0dwTvpHFlI;x@-ZrM0(hNUhGm+%uB-%_5%kVS zBMJTCFJpXn?)%7TSn!jQ?@)j7YC#&^e0AgEpwVrOLEZj)Xd1f`Utjrnc73NKf_K>; z+fW~XqQA*{xwrh*9`t}__aNumO~~4CBDVv@FlTI$54Z*{I+!VI4M~+j9T1V3V}_e# z&5S|qOi7{=jIJ_CTitfnJ8Ks+$-VeRxH$Hb^y+I6UIBf?k9V3FX0~ui61@O;gy17S zqr0HVJAtEM<~R%~rOVtLOT+fVulwz3Rs&&YvG&Y{qe)rYFlN@$O`K!NLxN;$ME&3T zHTqvh7g$9^L}AiD=ZE0)M~U-~D4s5i1`-=r^RX7E+u<*$rbMoeE0Xd~9Gb9dJ7&?;joLZ6bQ*le+vrI9Q7p70UzoY?w!7TFD-q<_TD#t(?B1;6Z z>|OkRkKhkZ&lY6Zmy5HRJPN+jx7uM%oy7$?W#B%8p<#$0XUQ1lXK_o+@tQhFtHM;I zgv32LjszfBtT$P6lR;aW$rR|wu2wcR&_4c56t|+}9%Jr&Xxx>~RuqaW(+fyn)ZdwM z{X4wW)^(MiiSei!v=OEm>h&=L2G7dg>!DGe5N?? z8rbKB_JbGYp9navbCOfm@>r0|4fYiNiSBIw-XEkyYlkA)-Q0}Sj5LuSG?C$NOt9lW zZ5I?qlXoXkY1*mML2q|~--$pRLKhZ3QrpMDXcpCf;*?Uj`*R-0egtkg2aK~<+1;qR zo*diDg7)^I*55qNTyldrI>MbDny2WS`Q+8IzRZj`*@{FC3maO8pZF%hT-fRlmsEaE zUO|R;c-?i`_*X7dlr22!KkEE4=7zQqzO8Tpin3|2?Q=`8jBq z&hJ~Ng@JB2ho|2U$0f2GYp0jr563|DiGSrtL>6nu7QIvX92QNVoD$kfPp-XT=#f?O z2#H?C*Ka0M$it%wC1sgGnpogRgwIDFL_78}f* z$Ug7z2c(}A)-ZUzDGP}xlm5I!Jk2BwQ_;3AbQ=Jy^fXu8vC{!Q&|vN}<41xs=~_<1 z9lvox5&d4IeN&a-MvucDb^@fim%+?zy@g!opsX`LS*yA^fqN*(eLJHGu2r`>>~tl5 z{>Hm!`!|aQrFW(HJH3O^W|g%BVLpA83%R%_ToFf!NhhA>!|csG&EacOctSpI*PQNb z(zKzegUZm;S-OX{!SlrU{B$RF%~N?@8cJ{CqZ0tbp^{i)fyKU*CBjMKPRL&BurR4T zmdi8J0ZHb{9uzrUQs!$!M%yy_5Gao3Dp7!kmyXJqbd@?D z@QClM)$dZqJe9XE`Go(APk`+3q!BdUc_#?IlPJ2GSXrT|cgbmJmj2~o`a>I9On?$k zL>|0@oA3L2pjCHLm1o4`P`NiQ6-`9HNIdGoE8Tb0V|W*dc2!C)6WcJ8g!-vG z(aE_P?83BtN(85XowdP8atNksw059b1#L>ef)?6R#c6!*!d6ck&u`rORPQ-65uF)G zY==7}tlMEtc;>1x>0cI~41pF|H2saq`w^0uEaeo zhvS2SdMb!fMdhKj<)h!70X>#C%))2F+h_ zKWcAbs+nmTJi;*CkY7739%1M$~Skqc|;6)|W;jcOyTu4U%9j zjUcZ;K7=`OO>%UvEw-FK^o;jobV-O}mXiV=E7&hE0F&~cS0F?IdiFYMZM$$5&41Eq z)rC&V+0)l0|IuU?Gg2>jH#bfB{?eV^Orz5GLQ9VRftz6AQ$FWOp!1o}+{29}fU%xW zQYE7%L(unSQqTuqVH-c$FBKrkcX4{?;U~SfP*r@0x*jAd?K7_X`KbYQ^+_>(Ez>Adu{lwL0j;$Uv)vlBhPtH^ z>DB$bPP-q2CBBDF$Dflt<4RO|F{jChB4E5Rg<^xzI?BU_D+Fngavbg&vEAZ(WY@|_ zLjW?9bG;uX$v{7DbQpp93&PNOeM`N2-}V&wK65mORVOw4<1!y2AxfvIP__gI?h$CG z@89}}?Df$hA1Wsc8)#0BsXtiwWcY(`WQOy3izPD?YJ!of@vby^WO>O9rMV<{=}alC zXCn~1_A#XKw)DGtVPSb>lCb4V#=j?;$RS0zt-#4#omRQ?dbHsPhOegwX~4%ZK+Bu; zL_4w$?9106o}v`lxJ7(*=&9phPGGUP+3flD?FeU&H3OtEHd|>XT0Rqj%*bd;%~%*I z#cji?#hdmBuqATMlr28WiBnaap8Bu2dEA61WL3&i^EjKO(G)BO^&nb;Oj93iJ;tJN z;{LvIs%Ux^AU?xplk#`fm^m)rEdGTWJ7QXXe=``HBo=pir;$Q!M2k6qJaQO3a@??F zr^TZrlp6~*ofP7#MdKN>l}~4^0=tLNHPaWKEp>W4m}SyDa=6v>{v(aUr=Sy41Tde< zh+)8vYz<&kuiG+KL{wy#DXac+;#!sdIMakjh!cptJc}C*%Xjg)f$Nus^Nn^+;6J|q z9M`_zN?Y8G1I&;Lcm=E^{6XdBj{vawZ+%VxLqk7%#}rAzEa$EL0P|MG@TXIiszn8EY3*fs>wwgA>yTjUX%2tP&NhGh3`pz_5 z#E!z#rx_sn{m`5Hd2M7)?n0l$FDnlB?VwJP7fwp%+%*(wyWxOOL`3v`S6Tb`o%8Rm z^5FgZ++R@O>;BM#%E<3&>29Ia$p7haVu!%r$>)A)VJH7!i+)ZBuDtGb>yBl5lyAo+ zzc+IjKlS?~JZeU6u%qu60HDuAj?y9tv${r?g`Li;qu=!9?$7`Ae)hV`A!p|eObUA( zZJ{i-lKh-kK&NB;6qzYvnj7=Y!18r>{JT3-I5@#z+|-YCtCb^{9*~e-LpUedjY<<0 ztD`QwY=+047S{e+tVvpSZ0s+~uxAnQo~U2Y&8gl3W5605k4h0UH~+R{d$L|i*0JZ5 z1hvu`q|)4)!QS@Y;S_$;o1}iyvsH~|SXUN<_3JbJ9c;h}BYvkVGv@FtnHIMh8jYg$ zprQ-i3{h-L__%JC{$V3aNZfS-!9M*LZF{Mb>-X`IWM^LCMP%m2eD(rmdAe_{&S@pt zEFKicx2+LEKh}@LI`)&K@{CHKC2ci%Om&$!v#=oNDS#_f5FF`3lsLO&Dnj-idix<=^iO2~uO4Z^9C}k&LQJ#X(6Z$QWsP(m z_{$cGio!vZFLv<|HJ^9^kH4@_1x(}Pk_6kihC41|9q|$`-^2o-m}Zgfapz;C_xk4B zhyQ(n$)8)B&`0g-BmeoP>G|gO)lTGkulc9P@7t;V8!isIH}G3rz2&g3h1H*U3(bd+ z=1ee|zsMHyPhPc|RV(Z22Uj4&jPi4+~#08qe< zd#cC+^?B5*D=1I<&P=CQIp)ay9uw;&f7gX<{Hj-f655W+M8>ldODH*jX z>DnS$b$f~DRToR8UuHy9XAHe#8%5-ZRlvDPVVt6+r?VuAB@=iu_FJzJreBDk8EKvdkDh8RD^NM=oG_=|Q4rooowLrs_PyryNR7oS! zUW0z_BuXUN*~7wWW3ujT#xF~LfrW_0?xd@bPM`>< z<2qWwFmVA~J_bM9iU`FxcP6ANv`|(VK=SYmSLk`fS;+{ywxhd1UzkCKI=3rP4p_Dm zl7vlqPaaUy89`=P)}>t1s#iM{52+GJSz_%O#|_~rEl(6 z|Lu`i&woO8X)jjq{+e3%`TvBtfP_qlhZx^V53x31xyc-^ul|Pv9aOYCN)N*?2Om~7 z#gFysde#C03EF6M{Dx}1P$$#7n>bl~Ib@zp(*)kpcEap#XUNFB!K$=q)eF@Tn}~SM zRU0F&V%}>VWzBCn8Ov5B0ru@^@8j(}@l925K{a;Xub9OJK-%ta(|?b#fQ2$brB~m` zl=D{P^Y$hiz36tad>1QgOiQP)IziZ3Fp`$4<&|E!kA3Offy!&bfiHTkSka>zx<{E+??W z4Gc6jBNG@Obc+#vS-xfKhzE?)uWGgDhqx=y^rZ`iok$^G+Qr@HKHLg=E5qHhEWT>5 zod&^7Qi{pPFZ4wEP`7!!U$4)XoAn8^NgqpLfBptbPW$@ zYYWVr1!$ZY_x5{7Q?!?3Gc@Qp*%|ZaurTLbJv$ilXYY8CgVdx+MYTV2%3?Cdh218x z%ch0h)-@l;)UxYrVVo}*ddV(%uB<6qoC)7WeEA^z%OU?Hh5R^#sKPeJe8Or(+LyPp z{z}NTgA_8L`@ZGx#DKJLubeZHl%};?@YTKG(L*&|AZ*PftW|Yno~M9~Pf%nvRprJD zh^?)@DQ5HH38aKRy(^sE-*)AW2zlJkCBnGc;@OH`uf_KIz;5D9sebg+c>fgY*Ndpck3*=%<%i`UA8qo<%noc#M?KG?#)&C<8QM@o}IN^<%?Vij@yQ)a!wtO(CAR zPPza#-Fc3oPlc0gzLfe!E~R{CWL1wsHWh)%G7#c7@*?@P{7-_CA8-lc1nUVFUOKoK z%b1#aKRO;+oK8}GJ}esd9D>p>@Wil>jJ9L4E^6buPQljdj#`|f5$`QE5r(c3w|I3Z zD+Kr)2Q8Fy$juV1c-5ykX|H8x*PJtyYg{C^(*y0<(YIo=q(pbF1^6PnS!nOG!XW+* zl1SkAJANP8Wn6_M_nnhJGks(EviQ9>`*X5gK7$MI>?InP!{>`eP83%Z)eF) z_N0!rr?EC20ND9Aby>X#f{>nFhJ;p6EW1xke`CR#!X&`k!ji$e!m6P?Q9g`JEno}} zT_~=hb3RDU+okzd0!t;94Um?iC_PvmgsBmG=#n*~rHUz$^34M#tY7~`H$4dAsRg(6 zoH{;Z##Ip7^iU!%>nN=cu*s*pCLj;>b*q6>eStVfi!rP_po+__ z1DlDfl+F*`o>H zXu8n(`!^&;Cy|dBubkIMb6pcaY!sOTo`l1ejkNHKHBJ%c^^bTg~^Ewrx!M zZK%bWdH6sm;pN-q=${kw z)yvhp>W?4$^?01>|8QdU?06RB?VdlMhLpK^z}xqbL8FNvf~;d!5iwMPYQ-Rf;-4yH z*%3&fszW}H8@Go;zw~M=`^cFKYtJ61B?PvWlV_Vf7=}C&oH4RSZbg(&uI+`?Y1aTmUXc0{7)yI7+}sZ=lQW&2vGKf#E$f<}UGAvOmH* zO7@{Fq)2r>YPjf&J0;nYvDHK7R+~~>e`O*BY>mf@oh9XLk+Gc-h;=~!;3lZxx=`6F z1=!lotftk}3%rBux2t(;jGhkMs{H(m%(#3jxvupE;!1Zgf3FuMx_uiif6q73oTEuT z!*P6FVSefs3sB9CU1Np<5lmvmRu9}ixPk=S{Vw7Is||8SF)&vhV9$-DXzy1uA;%y2 z!$=2svSH;6fZgFT|MuR8TQVV!koVar8F1Jg(gQP#wV~DEsDvd~*GN6+Kv58l?;=A| zja#@E!P}=aP6G9|FlB#Gu?@%yM6D0^2T*LM%TPS~79z0VPS&RGGD7)blDr*cd-YJo zBMBv$h-BI4)=+iOJc?rln3%SXGf~qypm!FPetvWIbH1~-581l%NSMV}9+}9OiSG?G zXITua^1h6Da!NYH($BVLt9b40cXxF@TUb={V0Bg**_U|XVg5Rz;$3-cP!6Wy|70A4 zlev)*sJe`ZRD4kKiQmK_qUlNn(@QC)lPS>tDZE0AiD?$ZRc84q-TWrl62CmL2T>SUm~Q zHVo&XmvtzrI%>yj5AlFnykG7129r<##XBW;wBn*18h7T`QPgSA7MSQl$W%D0BORJhwoPRrC zX->{GLb??T8)|>c>u;o$g|IMSDyZ007!22AFO+k34S4T%2sog17B z=V*=)*Da4wNoMXtXp%01NNrTZy)9+g8W=l6%s6axx0`2W)5&E>MyCj-{2@N99^a?S zgJ$JzbZa9Ugqs5stnnqc;*VN3YRd1WnlC)e*4WnUve8gES=TPj_B<6M_%-yVWzFoah04`bhrGdiqf z)!zo+s?Vmws`o*nk7~&Sv#c7aWB~lP*$W%ds9*E0P{I!1(^L)wo{Y%T4YYEn4tCtn zS@32bhC*VgYE#AAHSGCGJTjmoueqd$R^(50Z`aF?$QZl0m81tw^)%x<%&fJltn2U3 zjYL>XfA9Sg1&RSH>o|b<`;|mQz7MXGKrnb1XrpQ^>W_5WQN+()&MO9-HQ}C>>NAoa*rYjGAePB2f6&8gIPd?#n z1jVBH6asGnI(dUYa8LZ@nXau zf_S{lBC|?cHDIjEf*&;=tcoCjs12r-n(%beFV7LB4jafZJfG^w$UM9od>+@49!ecA zgUWxfNnOBi=()gRqvukttB&xLWicy*Sn7{>yv~pa5n$^`C_3WY6fGnx^0xI zQTp9`J!BR#>J``N)`}M$b6{o&pwM}PtI;Ls7#g8Jm1wzCR?cx``FDJ>?VlVb#~PMz zfA-%{c1vs8)_5*}BPoNdbK7=^c~_RM-Q{TsTOjX*%J08TB-D$*)g3!cgK`73~E zAuj^U?$g=MimXzuW!d!JNv73(3}ybx?#Ya1YhSi(sWBGCw%YBn9&*DygM)T~>2Ul; z@yDAj!9O_DYB53)-3g0qhk$IJYKlzhVaObmkBOU*yG)!he0Yjj)cApKymB6(egr9* zXiTbS{M9br$jHcu|G#s(&t5A3f9Gvqy(3gceov2QT2#G!Z}*k8F}Z@D@0F!SU)QgP zvHyATIQ4|yL5dNjrT6pjiDJ8-e$hX@8388!&uTKar0>@Oj>dzjsx+ys?i=@Bq;7Fe zJYclCcZ(>t*N<0Fu)!~`#X>S%I@Z?6d>nWX1V2#xHJ-^a`C-eB>#O<3olBCXcCUy6 zRWSH^z0?2Z<$u3MV1CBtswq8;wK7z+mTMF8!+F_ay0qYo3>ZaMh==2B)u|2?j{*io zbJ*mdv&)75*u7qO897Kyyc@F^WfmXTSv$MOF@;>U@85~Sov<`Gv&i7Ss1;MZV_W=+ zYc5;YvF6E+R8_^#Pw5WsP3vw8meIeE>8r&_KL1$i?aEt*&9n&a({VWuVVG=J=2+N+ z2}dnTA&NwZ1li=Sy{AzAMMDV7IO0ug3SqT|>6^W{kFppJOy1Fk=PGOSlqKgFhQ5!Y zG!OjTp|H@>p2{UTFw=W$bb)vC6)fTVV%W z8K5k^qT6Z^qeb_7logwA%y8^o=Dr)0YSc=yzvF2TUom}+t+XbVRwnBYt(`zcoX7MD~(68aDX&B9MCTM}y zOOE>TnCfEk# z6*H9R6PIB`qDkDa_*g0~G&S#zu@ADHRmiR_-!_c8FeX_&*eh}d&rZ2gJncX@H{Z=g*`w9E-AOEQjvB-aD?9FN*ruWN61Yx==KLjFXf zUGb|GCxQ?+@Ol}HFK$je-K&d%_~KV4kIg^|Y~TV#+R#;rrlc-~45z?sqhDGpp(^96 zfC89_cKhf(S;!L?x1cs&Ng8n3V;(#aCSS;M3Kb`JYCQ@yTQZF@p|jkW!Af0%T{BMT zf_W_zpSj0#V%lri-WzGkz|-`S9dI&W6az8FtteGP^Pb3v=PJ%}o5z8%s*}YuWmjze z#Qat|f{LwZ6&T7_(`r7XbA0EUoH~OZOBh`x0IV|O#bFa1_jKke#^G7DH5c@LE3157 z3IX%=gp1IMB&u0c^Y75@qB=Rtf#9KIU>(gkl&1}_s%%`0jfyHgY;qyBN#x;T!51Hh zJVHHBoI8(37y_Pj4Qk`N8yq9s(@T3HO{Ztx52mt#CUTj!6Gp%yE$fCY1$|5bpy`*i>{3pU9OwRTi@)G(iv3*}IoPIM|2Tby z;4#b?#tM&-GshA(lA?=@mPg9_>u8^Y!-h=+Qux8uCM^qc*X|7{n?S)-zf;e_6Eoyu z978!r%wUn9v;0{o3ppxWEiQ`qsNgNpAyGI0ncyt)@x^N)-g+>Q$5(_gcrf5n~p>3zrt+lHA1I$X&$S=yDq`* zCDb7iI`h6lQIJNgV>C2Z2ojb~h&92>c)^?A^PHuqSFGDKf5oW;81&LRVAE$N?*w4{dMxu>OoICdlga6n4_ri&#+oB2n@2NNEW{xW*1i7FlkJ)o zZfXM2XXYnYcN>N=O=~1=_j_GhPn&tgh zmRUxH|01xD3R}hn48)F9-FKsVvtd>lf|_!pvYnQ^j^8({^{oDO7C;iEUUvhwl>BAM7Q06)&KRQT`~Fz8Csq|Fl_1%dAC7F#hqH?KqK*O{+Q#)Ej6;v`kL$G{G1J?^5Atc+E{U-BnMvXx0t(JBX{I^M(^Ppdjq5OUPt zyd+1HZ=y3vtVg2_Ih;s3mu<9dIMd&l*Uo+gbB(DWBo;~&{X(pvdXaB>+gPJT3jZHh2fVvm`cn!jT2 zfGU&!68yupN8s)DN8s(YK;Zq%Td1A%o;`!k_M1J^1NC+&3cYeb;gsS3ML5Lyi-6vq zCj!*~hzo$iv5X7wQS!rQo%O!68Iq^!nk#ezSoEUYJE6g~)l@vw^_ zDd;0j;eU`*_8F&k*|731t65v4OQ3aqqd5{(9j|wdMBzr)V3reew2A&|>{#rmknvj5 zPfT^ej>ayrkGMDyk3yhzW-o4mGjNfx$MW$e%G{gJvSupP*y>y+zO8&?6!A06IR>0` z{=wWZP~@*O*1CQsf<%!Ux(P39>TIBw)c?t{YoeYZ?&7OrIyBnD`%P)c+$6%YZ@Jdg zZR=zcuy2``6A^JySPDaEaM_ld5PC2v=bJPaCORfi4elGIVoCNF{oE!=bPh7rJ3zep zDBXLlY_?>5ow9{?vCz?FCR&^3Vbi4R9F|@AwVlfF97PY#%h%RZ+Sg9IObP5PC(2U~qdUtR|gsoz*IlEGJcnFV-E&yz&=Q zZM;0P?7OT>v2TQV7&R_APW`%hz&(FGuOtdTle~@tL;Z+KbE_aUR`VD)r~slB+;!+z zopInsWnvt*PcKkEN>0myR3UK>`J=@eB(nn~Uxjf(HA6HtR#BupiH^nDm*tAD#K8Az z3XJ9b)7kKTW5BAbIWI^KZqpUs^skGYRZi3S!Q-R+DR|`+NoQLT`ol1xOyjS2fBXlA zM7PE@ig7n(iL&gwVg`MkY6#_(FpZEdE86Q)hrMw%4-+&vZDUe3^zCC>%v^9#72<^r zM0jGpv|Jwivx1QPhy}V8u95`~VSzAzCLY-~*y0C4EZ zAyGW8Tp8h1RS}oY+vRk|v`DA%+Y302f}=!8zh*qX@3Q>~w6p1BdFCjbVt2OGJSodf zeXMeE0Q7WHDWY;9n#f}IF#Y-`8j2BqFqG;xHw53QV9OJQj@9)?PK8ud{?#S=^9CXFv*t{sQ#!VlPLb&I0dh}30DG)XiR5e6}&Fu#NuduN?C=fvAM2|6sEzdTD+ z<6yZUTlx&?ZcX8D2PrqLR}}K>kBf^}R7>PT_S@qXV}|!Ti6}e8Tk(b4M^Gb;qHlEx z8xtJxRY15;670BS6m%)K{L_h*4In`FAAI_WH!`a$KKrxD#N<*Lw0_cabB45 zN;zUOM5mH<89BE)>ZWnIWf?iP6&P*>*(!^=6m|vK&`+ESvR5tc{{q4iN+6&thFM*z zOu_NL9)^=E?iQ4vu&XTNSVoS`0rj7>W&-{L`>Xf8o{FQGqPS5qv2jeM~KQV*;O7Z zz!js2%ug6r9y2X7V^MFojm=Mx*uBe77+%Mw)j>$6?-==iC-B)>xS$klXNUe*CWW9B z=x<;1!mFeI``_0ri|F{)aLfPSKozJ|Lv8j!Dhnll8gi!dFsGzC@2%-LRgIUQH@bwNQSS-ibjBF zH4Gl@9P3&)9*pN|qiO;}_%Y`r#dI;i&$|%iA3v1dSsC&gA+NX78aP^HirmQ>#t(0W z-J$6pd^rnILwQT92Atf$I9R0_CO4wcU^@0~6SPpC{t*mV@ zYn1XdSnZ7PRbOMIli(BLlIn^mm@8L8f*JP=Cu}P-sS$_XHQ61s@gVuDd*?TK@kBUB zUXBx#+Ee<^@1mQgvY_W@U1iZC*jy=I1Iu`5$Yp=4TE1atHcuvxA2k*hcKMjfzp0F) z>3p2QT>71tvD7AizvF9uf*ALr-vF8Ht{MFrE_>!zWfqr78744860#8EkVkM7s^6x#=E= zWEDh&BS9?zol=A<57X2lwW^Aa4=QlWN!J{r^iu8TB!m`1GhS0?MnC%E<7iUE{z=96 zMfzT-KipV3sm;w_U~eu4!poFM04up;P^Qmf#VrjUkhfG)2nzyBcB+U>hk9-|Ek97a zU4Etl%FQ{`lC}%*TxfMC)liW()^e+oj?)){9-^AkraFh?+&?0^9%A25)Ezz(-z^1 zW?yyN$$Q%#&r^ytId|{n{CfGvjhLvQ|th2sgoK-@Qoz;c07Ok+>7kwotiD0`08h1yf+t54^{N zVFO+iJ)^8Y64%Gy?NTvCzosaIjMs6ujxz zB}ja3sxS%-HjON_yqJgSY86s>>b=2Cy&OJH2EPr36puF;>rcHO1@W*)A z1O^l)bZYGqAm26=pGk187@((gMq0{<91D zlSP20D^F@4ut?6Sdh-GAQd3QAqF@T$Ae#CheFlI>`Q8=y%xDf(-^t}syP%txcj+;8 z)i49rznl_sfV>x?Dy*-BzDrE_J_si=QuQS;vm2sn?FcyH3aQv28|WLVZg(y6edkRR#^s<(O4 zXAc(o(Q`V#?J3ciqmxB3QatWQncGz&FbJ2f&*M=hBw>x{ndPKbw_{Yofl|484-YV@ zN-CTKWIR+l%Zvah14@*TG0$uHaV%|3#*ba&dHy(;PeK?N@p zmSM?0{)}8fEnd@i#kJMV*#l%RM9(>sTi#-`VX1d(hE6Z1j^2hVHzrO}u~z&}fJHWF z_yYnd4J)Dc&?#yvPx{CVQxmp2y!9I>jY}W1+U|b=>8}SA3F4azMZOPz?}h|$q+3U7 z1l=bjFW0%uD8cGT`Wu6bA&4a-b2&h$Ki1S>nlCASEVAUfuntQA*~_SubX`Z@PhIYE z;0aIP7TJXZN3f>uzU+q<^iUE8*8+qT_zZQHhO+qQL*&+q?D&fT-} z%)I7)C6j50O1@gh{6bV*g=#_Dl?Df)?iEpcPKc>Q|jU<5af$0UQ5x;-S~TPb_o#{ePGPvBHA;*=37*!1aMuG`n=>ej|1Q=g`SU7)T) zIDAc!PvcIcbHIM?EGvk%!LgO4CV_GRq(I7FxFR8n<)PBB4_DQ|;cp3Jq?H_Diwm;O zest~SfjYPqwVg`}&ea$y|FfqHvHP(o_B|=BatcARyq2yz^LQ=Pr1a|aluLu;_|jWW=C~jLUjB0 zF5vC-Bd)J>!4l2=2Hhs>a|&(=H`&Yy6p!Y7W49Ii`+w991gODYIcQO9l4U7JhNvR0 zwP-N!6ikYex8>2(oWs`dTnEU6DE@dF+m7Ga_~XvBf|*eo#~}-n-IQY%w>n2JNp75J zc^@52rZPMB4y| zK%)h09rd(@j?YpZs5>@_@jvrcQ50l)_(0qSpk&xL>R4Q{xldy!A6AIx;g=iTDow|Q zpG0*%qkyCir=RsKGh!kH9Ao)6RbI5V*+^B%yv&=B~Q`fozmU!w9RX# zA$}^9&~fwP3}6_7b+ywsN=6^?k?C?P`7#B4F>1GC#nvnpnT~?pYE+iZ--$XsxVJEY zydLS{0M2_71`7eO&giWhX5#vZ@g{OWd^3h#td0`bZE?761}%>?uH(PFBa&8v#u!!J z)35@*Z6-b(1xl7stb$hpjWtZ<@+b`?FUJsDvSAZZQadJI19bd5G^^T|52fsefkty0qM!Q?yYA6h1$ z3mOWP>EwpV2=k-2($43{j^5lq$*FIwT{X`S$V?1rebI{~d zAyjZ-XK3x@2Z%bddJZloMLo6;+6Xm_K#17|W@NCqlv`6{TuWYBkXz6gXH%dl)d$xr zW6zxY3(E6fuOnjd^OO>)5?af_sndKi(xLJiB;^BAo5Z8VV;;{i6Y&;8Mjvm=6q++5 zXYvhUmWYG%j&#d0s!au-Ggmt8YKTQCCRh?kIyB-HXqDCxcgg|;@s9AimSqM|hVp%> zLRm(srowrYB^fHa*pc~v4Fxpnl%nss1JKK#=ScPkp5O8%JNQ)CA=E{{R0LH1i-^b+%ew1UVPi@jC?APE7qJ2cvX6X_nTp{;hL5Rg>r zi#b?Dking}^&i#$BpiuDYo9a?)W(z0zzA^^=H1?YcesUzOa7SyHS>aLaf-HWPt~l9 zqxA^DjA)L(D4b>n$fwW-#1iRJBqfHWOb-fR+?F*UF)GNvqvC;*VF5zxgt5BG#he0} zS=ndoN7m1Bh40q7Y14f^mCpUKX<@7^Uun-*AMQIhH!JNTG>NFO6Qh`bnp49mF`{%9 z(m2!lGiqj2rA!hd;nmDEF;u$trDMrJIpyY$modLF=%1#@-4kgiyHq7mJq!3=NpO?w zFp89a@cJo@|7>=BoAZPVXKt{6pqvO&_3%4!51Yb7|GVVa%^JbNaHAKuttkolOmE(P zcALJKly)sAE&LexiziUhURYhPk6xrexbV8t`{LQhEd+JhK6)Pj4`qTlx}lqHSJyXL4>m=%3R?l0oS2C1_ZTEMsU;cQd;Tr%kuX9pg}CFu zEsC7ix^e&p7fl5U(=h;hI8&J##bSLdTOcP)DZyiV2@7g=UI=}B3yT>u;Q=bTRKzwJ zG0!Z7FwFDV7`T!v8a97f>hDw+zp^2XA}bYC^X_$O6{gO&J$R}U$T8Iz_XU-v-o3M3 z?FPQgycq~N*s-wu%_&#BLCOPUD4DTnhVy8_>Cp^ARgZG2i_TZtUPl6&4d@Dr?zVd; zLfF3*_^aX-lindPjLTxp)_&N=9uf0ieTKtiV|R;zoRZ}I=$|AgkGnBfXP>M)_FjF% zO~ocW#&mgT*^|xpEQmobR*1n*eRl%5+n{|PhAxEA*Azy~9mqkiD`Ut(uhGMx{cU!L zK`%~Tvdt-d_u9DrJKp~^C$H`SFXj%P!JyY2l391p0*JS^^*5S2yoDkBw)aN(G~1pf zEj1U0Jn2YBxUtnt4cu9E{q|4azWZjelzqGyC;M-0gZ7Gas%Z21UpPiEdgIEi>};mg zFVPKhfHk;^uJorsQwd*KG z!^GJiOgpVF`Rd%lv4-c*?HTX{ryP%4^+Vt8qG-Cv5K*=ATI6o}?C^$Uq5#ZyQUhCT zDNsSdd|GMd#0}hJ&YrLwR*^(RkZk!ZE<}(IXYHA~ssXP9Zb~IX7_gL5Juo*`l9?%C zd^w@s?jEknRxh*IU`5wi<~3kz{DrBtINR11BQQ~v0(+UY7F@l*19xB@0LyUF%}$t{ zrDS~-s6bQo>)^7{aDa?b82SM~@)OQ=MtRN|MDwno8QR`up9Y8!T|u6uflxdtROD$R zo}9e}qVw3nC1N$jEUqr$6sv~or7zYOGWgnBHnG#{5_2srIN5OG|7~JA6d`SY^-7G8 zi^0;MA!$0+J3A$tQzTE1L_HBs4gHKr|It`}DM~FVJ3UO?M?8tHbmgh$0_s28n74lsMQKY4OH>hlOY&X~^P zNLZLO;;>_L+j?@^uvQ5vYVw!NDFFfSpL ztRUjxD$CT>MFeeDo;FdNd{61108pzgS%)*sGUAJKK2#5@p(#=S% zzORM3N}X`=uNAghbU*1%gQH>!EO)?r@>-lmq_y(<#EF+d&u&nJV>jDy*}^h*!~9mx z`|w@-`^o%LH59vXxkt#l13ku3Z=E~JzU3EuB>Sx#Vwnk)H?_TB4cmd>jb&aF;+pQc zB8PqW43tDra{a`Tzjug5f{B#!QOT=sijk4v=swbK2*n~^-`z4(r=;^ZI6LkD?EH&b z^>Q?%f(UX6qAiKGIMe7IhPn3O# zt(2XH=g``eYalZ&!HrXbWs8J39nHf%2cSpmLA1p)THIcLu`Jd&IF|UK3s$8mFFCEN z*STTw;~%%7t=-P8QR#OD;4d6+;1M(@J_d(ziIvjqr3+1(HW`>G^T=QV64iqFN`dM@fo)LX_)Sww z4%D7Di@37((=M-85n~9y=k{}XJQ+UMqt|uEjyp8gt(_i4gaCjv8OGj150vRY5rjO` zU8gbpo5?!+2o)HI#Rhtz>OintI|HVJR)*J2s&j9ZHfXW8IP!=;Cd|73dLD)k);IxC zWR^(={=(~FAmYU~)Hl z3TbY5Mqe5LYR$1u9LE5(fLn)N+k2?k-H=wO;nw!CBB+!IG&HikI1s3eb|97P7>>a( zZ{&n+Z+(N`KA<}^GOi=r>EPX^D`MV3PhWIV*9yg3Ae0znS2JZ~!`9 z`jc%p=C_>DetN?S`ZgzwZO#Vy+Bq6ae0WY(jw8e|dFpFdt=spWxDPI~<&bNNB{yIb z3P7FlS@o8Z)32vM%`qOj#E7y7WpVxO=usn^h-Zk&&q5MTN0#cYR^#cO=iYSZ+Di;? zy&heEUX@8zxw0Cp)|}xP2$aPN_H4J1`yD7wbor`g*LPfg5`ndh>{oY@l?`Qw~{c!m;bG(-#i4O|0^S#YpLHD#yTJG^*tY~L`#?#$% zBOKfVr%z`JDD6uCWgm2~vLE+F^o=s4Pkm-YaQ}$dE00;#7*wXVv5PE^1qAhI`vyr4 zVJKU`Yg4bViXNyrmRk;ataXC#FR5qn#+eW|QvHn9T5vpXupJjg@dWWk*o%qMfk8FJ zWK&_^UeiGkB#=;osZ27@pn9xYNZA}r$~=-%BS_&0nf`>j+Xj03l;mlSeP>~4z}!EA zgC-&9$B;~{sqn`GbDAF?X4hqt4q^KI-;Ie9%lI1p-5Su%mVwTJhZ-&&rUh){_7UP% z);koB(iTN)e|T+ZPdR2LVhpB!EPbV}5#J49U|EqnX-fsAT|_<=S5?Mj{ZP|%rX&;q zci%$#&XdV>{T%t;l(}wOo}DzutaX)lOVx>q69uN<;MgF}H)%u(R!+e46s(INA-ZKV zv9QVd$*3s^v;E|!O4EtQMk?!JpTnC? zs_=W95u_|%){B%sr;Jh}+Y9;K3t57%*`Kcl$xczVT06Sm#@Vz4k%?`K+Y-X?P z%VrrE99P%RtE9xnp;0kyj4BQ6!oUD@9#SJ`v}0JS9*s%$kwC(4E+tehpVgxn|5Fgh zc5KQWmjl+}jH^5*-7@&lI>wZU!gqjM&l0xalS8syUNS>X)lpe5#QAL?`B)ilK(~{E z4g7|6=OlNcT=C`{_3JWFP|>)yQ0g^FucF{n8hAgYS%7gPZe=^PvxdHhnBrrQi*kyn zR^4qoY1nEXwfRE(>u4xS`_KKaP^o` zH33Kgd*Hi%L1cphYGHvX3m-jc@e;Rq(~L_2iNJeO=KwP>0~N!vgK!27C@*>C{NyC6 zRxGKf!Q*y}BgTzYCmx`!z?GE9%&}n=9lMJ@$jRnD69H|^0jF?Gu?F#zXWdLX!XeSt zP;7&mtvM-z!Btf$Uzm~Wt`;qc z9hnW;TpzF8=uU!i^3Q#@YinD(h0*|VaX}ei8i9?m$trUp?ouR|1Y&d zDX>JHPsSR%v!N}Z;$6tSEaJdPOE`3!1A&6qL=+atIoghFeP`~PzLj$UlQU?y_y`4g zDV?&7u4+(zEXyNbN&2B_GbWRO) zxq3jv;fe50o{SsZl(jB)u~qvz9YDs2g&4FqZaEOc;>W6HY~HF<012pf6!lPyuvu${ zpWp}{qkX*eg&aRSMF>u`+Ch{T=&qC;JSTww%mIabG5FuM;W8$*DCOVE9x>7-&%F|Z zG^^w?yrY+hH&vkAa|gNRnC)-vQRBchLrw9>8BtZj4k^OyQgkgz(m~*0(DK@X;~L9E(x-wB9_u2VZzUXZ`=`_RV^k7@_aT)Q}SnDNAoyivMA2NXb)tO5(84N zL6oCNskx~YBe>)A1q(H0QTgmVz#kQ$a(EJ#N{@*e+|BZ^r4@N<1GG7WQYef8t|J&> za@_&5hkNVZ4Z<*ub_qtlxReq}8BPE_P$8*G7B)HKAsl^;m z(3Y*S@_bUNZm(nKH&vJ`SU>CLiLgrPq5VpE?v(#yos;1%$YPif&5zvs(6f)_K=;>^ z(n(z2yj~gP{Vzmm_^V`t?>Hw#*nGKTq40cGR8Y`B;I|UwbT5WsbWZO-((t@plj^U@PXKL{;Z%dIymy zH|wpa`)*wK-Ifrh$K(GKPJERQd_*UJK7%DWaQSoWi=}_pqkKH z27EjdMn2q1^l@5wxoKtO&tUSefiGk=5%*rtEjzYjpAX+&kC@t%|0nNLIq1zN@awn# z=M5j^*6WQ^pUMpU>^*8Sra1uKn({(|-X3_PYpe zw{Z=BA-7&ZZ$4+7`g{<0emyUyfnU3CIsfPXPyRPy=P^USL~#ak|3^_?NjgJV>r3in z+7M|Ei579cn)@7*mT<#WICL2W$P{bGOZ=OF(5fN{ShaQ<$>;qh*eF@CFQdgSGA;G$Sb$mdc!+n7{>M>jLwFwg zhqTGW)N^6<5`@_S1hMwAVMo6vQvkeLS*9VdkzbKK7SRBF{~M*U0*cwlq=d$CZfH_7 zfe=}U8_1h=yq#$!0f4BfwGWA7w~E)|%aH^|PlXHbyW|%GNwQwD)jr7P-2~I&3~8`1 z?qcUc9|SJvbc{DFkl05NxNW&(inVA7e4QiyI?#=f<0jT)AURLk3Fp2M7OiIA(wYf; zrKm4Z_&vQxv)NT)v^?*!%7I^6yRFhygJsRYp9=1p9(5gfbZEPR?qL+sD*TK`^Z=yd zygfxdgKpeUv=5`0P8LogH2*RW~ zDSlEzZZR=`lE?DowXTfDy+y)M5jIm;_2EzcttSVKu9U_^1Ld66m!uP0m3rZtt%%aC z2TXMtX*a2lv}+b#0n7UFh*p`&S{+5h%N4aIsuN&advevWd?zAJg|zZ!4Ys2AqXLOt z_z&o6(;(H6qE(!U(&o`&5BTtdl~V-RvAx^E6|vp4f>K@}S^V#g0g*MPI{hVvobRg` z51Fv)QJfs%pt6iSVSw~9#t8sDq@|%ic13ew zV?O}WtQ>EU)Y-ZS2Q}mB;OW|@cWa_RqY>jOwbWJS!h6tD1EvND(NcHpD)i_i&IR$I zMXsU43<5wj4IIf1amIMr|p`Z0liSU!=wF`#<# z=4Ua&%e-_4ADkCe`b4~D3rlvQ4;1LE+`{Zb@#I9x-WwVL*R>zRqnhtQy+NPcO#2IS`W~<;Kzn$Y>5Z@!$rxBRoBU&V+lZRu zqDRb6h#YRynbiWlDS_?yhDa6LYz}+j$ALWA|9l>#!c{S+Q_X!Yg{gBgA+gdzSn(NK z*vH!NEg4(eO7Ey`z#3XaWQ@1v_(>Nui`8U2Hz3J!7`ENZYb;M*dA{AJ5;8UiZzZAb9qJ{%EdK34qP+Od%x60>!w>Kb|oupJeKqYt&miVI$js=G`}*c z&uD`{=ym6)H1SlV97CLlA4|xjw;m)TSy5Qqi_suyfNSXwYvp*edc!assuE$NRHnah zOr$=(HQec?q#1}nwX9F`ULlPOvXk(KJIZmesrrY*e5N8r?>EEZ5h%HmI~Du{&?b~A zd-j5~yH!}%ZFgh?h&jkRS+NF%Zk;j+sMUJ+A;n_qqtQBpP#H7F4>GPPaOH!3?MOEci*l6_{&}h5wvR;D~VJ8K3R@x2R9xK0q?u;Hr#n zM;O0l=j`Z&rz^BJI>Ybe!`u!(>M{oLLpNOLHS^A+HZG^;(;>ySu5wV&r8Y{dN>^x*h4H{` zD=N$E#AV8{Mk=;=aM4OzWSTl6urTjj8LXvut=S$Z|>S-{(`poC!eu%xzwul?g!lkD-uobTA`WyMgZ*X`Fl z`Q^_wBj!WAaL`}~`@`t?s4Zkm;2Yrm`NMj(^Bf6N9-f+uwq&M=IPnLYb?&YUsXfT< zFcK=2vDmzM{=s4#tkS$%WnA*I{lll?wDF(uyP=gl8(&FBGcTSscne{2m%A5u6t85y zhN_7xxQg*=i07XTJLB`%USGfWE$`!JG~eRoOqEv492JI%obr4@ThmuRY*h!n#f4ox{i!sz zXGy^@?Qn3SIlRg@L(nrchN=LetY%|~gDZzyTH9M3>@)mko1^{H>US_z{OWQ&T?isI zOu|*h*LvgcMk{s zab?Z<7?tFCXhZ;-H*>BnF%p?81;t8Jb~;;ql64lMr&wJz1SYX#5|-enDz0XbFd(5L z2rexq;zF2BPwy-o&9Z!}4r*>e0P%|&3S_Xm8r9zk|1{LkixQD2b6zdThsyIFN`4jO zdw@$yi#+(09j|IcJe3RyVu4tEzLep5Wibqq9vKHeNHRsr9&P}#RP)rZ;6ww+=RS`M zkL0AcYlx>z7IOJKj|&g1U%+KU&4nqaBw<2ng^Gl1)>}OaJAF#1Ob*vD7Ok^m{}}R) zl62}2Ty2dQM0ZP}VuN=me;>|i0N(TBMN4|RsdrCvr*2whuP1y9&F4`ZTji?-*?*x{WZ^?T5fkLq!B!ppf7!3|~o zh6hH4>nz5NvL!ys&o2TwJ=1s6qrd!u`)QN&@?!0`3wG5%dFS0x6MImP=3hf%2ryH< z2{Bvl@d2_Sy{o_n0*vwT8X*qGFMl6=l|b+dwXVfLJ&0ktPOqG65RRmx_bdI&qAm5g z_6}3JT8^4D{KZ{D@OQ8i?qug-00}(b=otJmjPMvxSSPsZtHQ#nAU7{*7lN3{Y~Ah3 zJzZPHe)Mjg%5QtXC)=Q=N}Efzr)G6*MIHg#yLqKU%vKfFJUuf$A=H9tLWz$ z+g5Y-!LgGjPX}~XYG~>*VZths8bIWq$wOK^Y;$r2Y8ft)`(oR^$V~ic+wu97h74<7 zZ;cAoS#{WW%uGLhL)JBLs^R1A16`pfHt4tae?A;g(N@`gKQ9^eTup6rSl1_kx_o z-N~gClmnH(az4D2>7$MfFtQ{x4&qZoBTu3ic(hC@qADz7EGgg&p#pBBrC}J+dbQe+ zKj-=899Wt(JGHCH-GD2b`Nsx3mD!!M;v$d+Lvhg*N*}>=bR)Nc4Fq@IChc;M;Yj!d zneE76=~R2!TkG>%zysY#@HifJ+rLvB6iG#7?mt9=(W~97&S~aU4J9~CwV2&RO)F04 z+=4*MYzQg>rRkB%Bdj{Ht+ph{{;UTZtmwJdoj&O%T>fyxZqNNdi|V)Af%lH$!hF%V!hXy%_}x(TXgE48v@HB zdv6l1x72G5C)3#46e6>8RpQ$#ur(tM^%Vz^Gyf2z1DA=QC+;w0lj8E{QHZ9WoD?S&PQ{UVooc@N6_BdWu8%!I-Mu0aTg@ z#duS&Jj!?Bj}u%EAtF5Eg&$ov$uv0&RCF=D#$O|a*&}_9HdsxGT-h%rgL@)=HMLV$}a;eNE&!N|$^ht+wGbQ{lG{;_T`~J+E94zNOqo z68;+dw`5aiKlQU&4@Sz?x)ajx>h}I#9(P8yt}0kCh;#iVRV?afAcvQXXk)=7;Uf9( zsRt(&L1MwcvjI$*KnD*YaVr_&u%PeG$V15}i4CXtHJgMiy+tMgrNzCXX4ADjLIK== zpb*cY8@Y+l^cRg;LUg2fT?t?34+l=ytEI*3SAHIcD8zXZeuU?n? z`^(3{^6=yAA66YFw%epT8 zJZ9I(80=6M0BSz0TXbscwM+W1u~DSiYzlIIdX=vyhE(v8IO&o$JyOBT!+C+0Fc(!c zr+Y0Gr}|u|9Q#`Mvf~Q-_UQB|L>AA;QcfS+g;rE;4ePLrhL~gGf>v8Q?u^~q$-k(U zu(gOs4Ea838};lKEVp|y*hB1T5v2i7F%G86MPA~}sq1wx`U@7BzZs$D-}>eHFIbo6 zG9);1xQ(-8|0JbI8fVL<7KX}gOmIn#Q`gDS!l7~*Wxx-y>I*%=Z_*+x3HEaC9nad( zgu|PUKgN${tN55hYFDdD3=_VM@RiW8AC=l zZ-bJ>P^14KT}2TZ&osG<=R@l;crJOQj*BkcsRYS!Ye}f+X?OUgGWE7e7hL-E)FL~7 zVv)~jLD!Eau1e^X!xZIR(A^Eq;`zI|hOHVgmOM6``{RXqVNqlEGSB7o9<45f^Rbd&uC6GB% zu?@&x2Ui=SfRcK3HKbfK0p;tMhB`CZ$d?OBKyS|wXyrd!(O$X!;K@VX{ z-6v1t4V+_|@6-wr*`I`V$@i9t?|hS_&4hjB_UqElb(=9HXQ9zgeL~FSW#yDH6Gi`g z3fpD@B#Nm68PS=3#Ol~IO>kl^$e$U4)5!u$QyEP z%&ji$JTc8fqoae(AN#GjCA4JA;|R=e`|PE9*}e_GZ`bGN z_y%Qy_kY70)?}Chaw7od4}T2yoO5#*r+WRs(|umbz#3=!JrI3<2D2fvse*^v@pvF# zePkrTcZ`H4m>h5%Xw_5JaFkuUWF*<>aKS6;VM^T3POKe z8yjg}XIu=MUwtB*vneygn#>qmgYyb*vEtn2M__QU@@hGO53SX>n`(1&HRn@(Q*F$L z)^u0UZu^(*P>~WeSDzBKg1|N9V*%qIB`ll*$j}h)NiX{pbXJa5=aM}?BhONWR*imy^8D0?T6kZ zq16NIS7oeFClGBQ2;)0A2CIth*vO_~&)HsKQ7t!zRvA`ks<0EMD)Dl?B3pkH-GxGE zTc>Cr7!r^qi?>(j{*q)B53~>aAgx7MLB`6q_^dx|f=0*C6nA;x6sP=PaPomB?-=48 zRP%6#-d1ud5#{$sM6SZ7V)cQv-`1jqSZ1zfFHl)JMUi5~#`IV;h%Fi00J~_*yjb}; zg{?{OZ_A`j+6(pEYz8{`B(z?wMh$$Wp;3p+;*e`FAoM!M!Qi63d<<4qpi$YV#|2Jk zbA{z^595t-hcF7jq#@9MB2WxwNC3}WXT4%Hg+lJ6%y@4h{mm6MZ~n|Isc zj->rgqICVGSu9&9tg2zHFDtIzKqRlY_SZZ@nRTGXzuYJTkyJuwJ}VOk&lgtyNhK(d zIpSmdzVr~k?|3f&mW9!auAFqPt+mTQY)Q<)kj9EPH_pJ9r$&ZcO(T`Ab#zdwY(Sm*F@ zKr-3t3F_l&-Rb*lxE@Jmt-pu(ObiV`UGgRPW ziSy=0QcS5fU2f4BQ!y3CfT}6PPErQb+C@VrfSL7<&#)v9AoK>5paM^Kc-;+q)%0fw z8B}167Dj0hT$W<(qUbX^Y9vwNUSi?YufH8DlMYjN-BH4O_2mG6fhGtUiRYm2C|u`d&#^q&AZe6${9N`hDOsh%@ zMVRH1vvOnUw89pHNycbB0=Y*daYe-xoDOZ0<;Jr@>@IBg_h)i<);>KI8SUuc>-v4S zmX{|CxiDF$+btBC1e#nTtOfz8=L8fnV{l*-&YomN{Pw;zW#Fu zY+v5&IAzLK^umr_U88=AWzgF<0<~%4>t)*|a}!I4pn`s3b>-|k$^py#`6D!?xpEA! zcy$u1%9(!9bmF9Yr;dl#&-EE8a8MqP4@8s0d|D;UJs(XZ5RlAHCfJkL1(b{6>cNV1 zSLNJ;usiq?MO{C7TSee2pDVKzv!S$i-bmTb{cA9=4dpUL%nS7zaGHkbB|$(QQ8Od%`6od4c71}28BFN{E~``~ zLKJGOvBVJNpHoYyhRlMZ`Ezo5AAKE{P+T%Ocu3WDqBW<^pfh!aD%>8`nwTy%i8tlr z;i0QXldzsDi&2p=+U>B=qu53`SDIVk)OsSUNh`QQyTfna}$~B_kY-$^B>9KUG?Ad-rWZs{(Hj3 zy}fzQ@@9q{?fk{Xy@ee8?7zRsnN@2ez`gw)h={q+9Va;^TPHvN#8JB0PUmx+T*X{PP4r2~$z_ye9Y$DxW*kvtxe3~Op)VEoWfUJZ^Xd0lMRoUBBK%DInmO7k7f`!laG*Da#qtl zc_vGXS)Cb~Kw3>8Tvl2J(2^0V^qe%;8<-#pEK!*&fUK4acuZ-83Q!g$8lMuB4pYM) z-MgR}n@{Q2XLrl0z1MVq0VD9xm}@aYs5;Z*uluK0e|6Fg4VOhx+kcR_T4~BVdGsO8 z%=NR|75~`Cs=`{?bYggP!m_B`rarUsZt;cuDWDIpvH3DYt+aI5c$`prwcCW&zM2AqQ0Oix;tH|R3aKeh;uK@eo(KK0FIwhsh z>t)S<+_)H;*GWsOTNh|sqfRD*pZuW3z#EH!=DVy8*d`f4gWqLb0X0V!ug00zmP7pN zQz&s&A&v;oK{x;-L9o3sG(B0Hev9fNc2r;%kZr5`bhs!lsYW20Dhe%rX3yoV5BAl7 z1Zty6_QdRsBy!~&jU;L?kF0S5$D=#XNhzh(UQ@!1JM^V;G;Ek?MduTLJl#$&nzK@i zam-&yk30GBP=}9ex5J;_l7tfCnxyu{i-QsP!Kq}2&L8>Ze?B=?0_%basHFzfPj=f9 zd9jGwYOS}XB^WvPtK+9c+Z01AQPThl*5XT&3$%=a$`9`n?gH$O|Lnb8VChtLB&Q7F z{1u;nQhR1N6i`u+UJ7=Fp+nWXAe~44cM@{n!0;6SbR1H}#7oa+ECL(0E;TMw*4pBG z_sr}#EbZjkH2_PQx`u?WH^Q4rv*_Fys4$;=?{M*HNt`(m>vXaeV^hnkD~(L_90a%4 zlBfLP>0?&EH~>wsqfWDx{csm&gJRCK+eRDArYKP0?{sAx5N}AemKbPh5KQtw(gO;r z{TK4+Fdd&}QZ|2+cGOnZGmI7`8%lzNgq$^SH8WjGvl;+6dXUYU5fx?*Bq3^Z*zVNW zt{YLW24Cf!g3#r@6{SE|2I5gUMdo zZ=|87m>!}5edF#jm=R9P7p``V>7e1>a)=$)()cs;DuaPURuCQl-VBw8*X=1K5g_ zRaQ`fRseFas?Vdl645j^ooeDzRoQDkf}*a0U;U0GS*5f8`8SM_LdU~B|A?FR}&Gc!6gp=v&p>Tz5mj$UG3P{74gX71gW0ms$q3w{yuxNYAu z8x4;FAfx9fi6Y#n)9~iLA>}@gF*5QI)=CHCl++rN(xUn&)5{+;7p0dFZ*Vs0ZV^>x zY!{mtX(%#qh)uOQqehh3HLt6)^u*g1Nv63A_~lM~aC!@`Vr9DzxE9wCh!1vargtDx zI6F%=jt@}|bygd<7-g8#@1Q4%o6*!_?0JAI3QIJtNv+hvR8vaEgtSDf>w#Gof+Fl0 zem-LW0n;=>#z~m;qfp5^(c)LU1-@>{|B&|%_dmOT8gIe-gv&I2%Rca*+v54ZhC8!A z87D*qzYWl+VbYJ=r|}lPV=TKKe=<%2PW9xvIgJ6Y|Nei`zGE!^H_?k1rES^TD!1wC z;_%c_hmDo^_Ih>eIO-vwGTC_Lv$Vumk>+hdTi$G~(DdSj>G`8`i=3X6ngXG-pmV0#!|AR{ zW9nU?-h6i^AxXH|lzY6q?V#D*T9s8_j^XJKngK8Je5s3RMxisQX(lswPFZ3fw!yqW z!SD=c&%>SDaA3)AO~&wKPl9OIDL`zcN{lIP%HtR0*GG-Dnd;}`MPRZ>HfqF$_CKk4 zx5t9-2lGvGaLE{ZgnqflymSw?(O&2r0fIXw#7^#$bkx;Q?3C!PC!U$>I;P3?v4 zX8F2&jQR+RA9=kz*hL7-%JqJ@*sH(R8Fi{% zTdmR3XO++10er#mLTgNjEv0!va5x>Au593m*7c5hNXsE7htd(eKj;Ta$@I*^lww-C z=}R>&{=77JL8=MYcvREc+o*eCNUV(=yO7TgX3>h5max8fILAzFeC5^^8%$d*CMVTS zf_#t+U}bEe64tTdFU`HJ&lo-tN1DhCUrswwTD~~UrEMIiRoOTqDCR&gEO_ew1kKgqCAh5B55-6MN$M%(qF1>_bELGR)WB4lK zUR&N_;g%-T41Rv%Zkh(+JIuTC%4EHV-B$HROTU)bt&BzMpSeK$@(2u5N1Z~GtjhWf z4J~DIiAIctW-QU(2bfzxRz34v3~Me**#W*3gy;H8Q z4nZ2RgNROnG-)o8-zj~>wkyH;&bDSN9rqGntBp zhM0*3kmfx@2w3y<&o3a)ySJ*cbjznx|O)wWU_knu)RF| z`|o6Wh~aopBljFy55O!|ed(oy>Z-o}sg~Q8N&1iPz=ybF4wDwXA(b;TVX{bF{WVi} zn5i0bUJrvcOm;V?2Ps0EpH{7OXcI#hRL~DNT~bN)`)@C+;8P~Gs1xPi zVN=p-we+)wl8eyeH&~Q1M_H}A+jSz{(b(MQ*}#n;3+}z=Jg!@d|?`~cl_1O}=daB3T-NCyO@r$&ABv9z%Q-dw$~Iu`CM9RkiPc#9`> z2ygm$w2J}gkLyQIUvPMMy}KY37g!?f9=AQFFs;#e^14$}o*O>GsC5w+Q}GmscJ(A;N0 z)F9Z;OeBcBY)sv|S|S6*xL#c^nyz(9cW(_YVe923npM44zf0Eb)PgUn>07DJDyi=K z**CDDcFq##R*b-O30P(+b$Khw^LP2DAZG2hgo=mQn1B6eAv$UuSOJ@H(8%y54Wl@+ z`{e%vK|sF0qWOq9g5%sES1;kKB(p07J4?&5;D~R~&HD^4)kTL_CIjj$$QO!90W2b? zD=Koi-WjA;gjolDaMlq-DXe!;03Oc?RIpnX!Bg6XVAS8xqp({IBuGK$tS}iYz>>*% z-^s}W>8S#;7*`DSUKR|~0_~(UiO*_I@WC;2(q>|JPGCfTPIGD^ckj-e^kv>tf0MIeMnPhuIx4+!xNMqy-ewUI@NKj*@;JUC5 zLm_kKg-$Wa>l$-y_2;4#ZF;x9&1}>%?@+I$L0vNSTTzk}7J!MIizRrvCZu8oCXSmE zd4o3HF)*`vX_T(zX1i!MjnRw@{61C-UZnZ2xgtle?FK~v{2o(`AA!_vIRkx=H(cZ< zpW2^zbXE>A7`4V3`2fJ5o)maSeh|b>oJ#@GnoEBGQ7}$~Q z0F%ABI`4iR%o&rl%;4{Y=4-B0EU!X8cWl0r@`juQLB*$vFV&f0_Nksh98!>r!euRi zDJyE1XbpqR+$>-t5Pdf;EjErqcNq|IS8w%$-88#f^)?}WJ+fVIjRm@e4i=qw@0y|V z`f!j)s7Yl^je|t`OZz>NGpxO0kVr&#lF(A_1MAi%$50w=NFVzikWRrw{Dv*c6`i7) zt;H0`HLKICq>!dQM{5F7XjYAzKU%(EP!RUg$a8Ngp0@#P6Hkm1T@-W)C6=}8Du8pm zoJ>jpQKESEBe1g$7ZskikK0PnpReG7#Rd5W5| z*AjHE4QZ}A4y#11@QS6H-j z18X!P{{ZpevU4rM%cUcW&WXTfm{H-t`)X-@RV3#Ns06Id5KCIowZ6m^F-tsWOAZ;L zgQVS+aIA={>7C#;!)vnU%M~i|gaTp!u~Fkf(&1Hr6D%uoN2|5gBxtsRur(DVZz@0` zt{KfYQ&rPi8#@eB{)hP;w1(_}`@Y|3$N~5LfcqX@(F5-L(5DW#?+4uX1Ma*39B|*e z&jI&+>-p@EP7k>6!y`Q4z8`Skcb)_8`vLd8@1qCYcXGgex6c9h{eb&^zZSgOeH;YApN3=kMx9+4Lw18;a5gArb0GMTX?;-VnfUK!b23Wl|NA%^pSB_JL zEq@E=5?tRkB35!|ltdJ^AA`bZxV6*OcQc2+b;~hBs~96g4m1%ZXx;&X0Gb zTR6xqX%j^!_?OU@ndwO%uM5n?2|&EA%X)*kZUz;!QZ>m6&H_oDI6{OKg!fOZsv^vc zm6@{0K@%@)MS@5S?EvuAB2zIM^n`KO^1+;r2-3#|Vc-|fPhABmt>@whK zA2MFS+1_pjuuFjjjrKQ#vuyLKj#Wq3UE_G1zIIpfx@NG!09h8;VJ@}{l8?JtTjY%; z-V)V!gvbL_(RDMgI9refhlDFgVVWS43`O^YQmlgU8?(aBBOo-)1na618Le9_5(@qJ zf-E65$|%^sd-7j@AoGpBT?Z*@rLmSZE!-j&Of2;tfvC~u^R~R7g!wc~Ai<@~@ zbvVn}?U}c4(?Tw1Jxxo7F7v3F-@~G^;MpdLNiA#=S;;$uzU$$zcr9fq%celD@hi>Q zuwsp3yA@5n=P9(Jmh_hNG1+l;h|*-28*ibOVZ)-x+Ow}{QOs#}b1h%XrFth`R+X%} zV=t(d>Z?ZF5IGE7(+;bUORYVYO>L8p`xX?-ugxVAl*8RgvyZ$rM@@kWnn3=0hlQ|V zV7;tgJo()p@t6=G(c#RO{}oTYXQm(a11Zct>hi_^FF{cMcSGSH%Gi<^cukl4ZB7XoxkxEk33hOPQN5!J$RO*&Zb=EwesZ z1dln?AKE!}&$RxHJJk58z*ax}QHBAGJjrl|%}}~GY)47Ijm?ID-_IgE7_ECoFwm&? zzz`+#lqH{x4-HaA8X|g{toW%$b?HngXJw$0)Tg5V9qY2QC?)U zZ37{9bVFz*8gRtn~Nh()M&+r)t*mJ9N9_VmdwAzEQHTcY)?6Rmh| z9%Nh=)_BC&-XP<8sKwmkp2DxR5y;vWHIa2c0hLH=m0mUJX&;z)!gS-Mx~iGq^Yr5} zM`mshzbADg6E@%P5d{8}kB-O*e)1U0ry^E2JnYw>5cqPGkRym&#YXmwOA$ra9x%$u4pamy!xmKs00@u_Ax6O#cv-%KBVYS z?neCuRVY)X_<|2|^;XqnyLmeWj^Lc^)?^G1z0YNStX%zu9~?EtGFI#kQp9W~i)Xf@ za6k?I!D76yPBC=w_+?^nz3Af`G!C+I2Kh^qN(IS}f3#a;!ACUQr>{ z`=;pEEzjLvR;(;|M$Pwstl@iquk;uHZvOUT3t@(l9|~P*NN=8{r3CJoHumijZ1Q7; z))bVww!D;AQrmnz6b-k~f>m{oJ2S9v1sG}othT%K-L-8$={mA9vxo#1!w@4c+oyfmlB9zXQ2zFO&NQU*(1Fi_K>7RbR!w{lk zqsj8xcP(ZWRV&Crl@Jl_%?#;gvAVv-U8V2|IVolCBthR7`UH(4N=krz!uog^^XX7S zZcyghqyzGF_C;St0LJ*9&c67aS-Jiu-d8oP*`g_~SpBBESv@qv#kb)cg-~XKkU6_z z1>EmH#|88PN-@p4yp=Y&=~CvHFs8B<%bNni#iQgj{_?7p6+4}w70Wpl#@tkRwGuN$^$ zD}u9%nX*W|;lR$;$1)$ri3h|k`|TSx0Cx~kr-qIEt<)nglhzm|^=PCNdCRI>&hE~P z20PV4Xo?%E&Y=7M*{|R~15>_!_u?Hi&NJvdjnW6zv>BZdTJjI9QUJtt!$m$J4bQ*o zk2^-zMcUAId~L2k>E755o+v|bS3r6y*le5R7s4M7djy6x->H7Xm_xahN4%z`>4#2h zx#n5?2*2vZW{w?Wh@5t7pTRsgd^KoK*|Xkh+cr-4R;WE*&`td>;ppK$dvTC=6B^gmBjCQGv?phui~OH4QDl^>v~jHU@0EXFfXd+n(U zi5EmHqjqCcbb90%F;XNTF6fb zEwnAQToEPL%xlWO27Jjv-VN$-Ca1BME&j)fktGubybgjVg3waSwTjc)gsW*&%QdZe zMvGz)=gNW$mla>riWeJ~;f8g}FcT>V&)K?^wZ7$$sr+kp&^ft)LRu;MTzjL>GzTE# z1!t8)1#l0gEx<3Otm=N4(;grry=rg-T}>w#K_Vwht-wN|j)OKDz*zLrQtsG%lAXF*76m0`5ZNZIuyZXu6_&rX-vkAv z1Gh`w&>Kdenc+b5K0QcB08@+2Z%hrB*R-poydp1{)++Tmd8YZSha}rwGSmqT_|5L& z7)*57VikX9%*GfC8^Nm~@Qhw&XL9$RM7JGXnz#uzHqNVdQ|vzSr5IFg?p9j!ZufR; zM`0b&Rg4{ewaSw9?sF`&!fsJg?B#uDho>%K$gP23I<;3~V=Q;9LHs}Zt1m?k7}qT>JK9}_ z$F=Y%`{bGt%|F8XXE@j&$@AA2gjUN2gR<|mjB-9w8*+hR-#(c=eL8#6Yv1H##h0tT zz|g^Sb?{vMr+Kda**T>V*|Bw`ak|O|3N6vzU5@~2b$ zBh(B5Z?=w&-NP_=xhJT@ed5#@c(L_(>!Cw=eitV$^<>at^^k!NXFWwm_ug4qcBAls z8=r__xiyq!KrJQI@AWLAR*+o+g)QR-r<*a!)EQJ2v{f>FtpdW*H7h6|N<{4Nn zyGQ4RZ6G&5yIbpR#?huW^7Xo@A-33$5E@ML?d2L+6F<933e&X0HhIu1*!lEewN*+M zZ!DK`7oKe(Nxd`9Qs%Rstq#1$wcEIqx$6_YlLAtG~V#)=QGN6-^ zx?(9^!DOvys#Yvft8?Gza|xHu4ciQCcVINTr10fy+J}&VQs@4D${;pR8YWK?7Eej* znpNT%`Ja;?e*0;9`qjzF_fMw(^|#-i{4j$beslWO=_mV--=3bHoP7Vyo3F1gU;d4s ze)?WC>l^&nr<3p5%fBTOIX(UA*8>CE3oECqJibQB-_`@@v$LijAt{4m8G~FvyN{;! zTz^Abfz69XtDhZv=4?#`U9zcr*|e?XJlo5aYA?D2ulMpVv7F{IOy+6aD2XX62rdFMhY{J?t9S(0Oe7{zo)Ti~Q)u;T^-KWjzk3FPM*1RaV%|f&P zU31aYP-oLrisW>o$Q@%hifkCIR8Jv*cYvRKvght})1JZ8JMZV*`+4R4y!L)p{_oZ4 zSEsv2H6U0j+0^W^VhjE;Vt8EZCDflLC49WIQx#is1>KSWXm~|MUi8D7FQn~TXz;&{ zk@f9`ag>^xz69d7)p6hw_eTz!@*&@zi81ssCB!93=BR`2qiacgTjIe(>lu#!G_}IF6wjE z*ryF<-^WlI^h5S6#|_)K@^Dxe{R>xi?3MyMD91no?`fkDw`$45cgtKcNRj|n(Q`Of zri;52YQ@VKE*pgylU&%QTva)O7iWih2?_=-*Xhpab>B3~JdGv8v^*j8P z^IsKS^3E`D2XuJdvd9$y)M=x$38iP>Kyk;(PC3zf@itzIc3RJIxcv=wE zl-99ckfr{12r!if@S#<-(Rw7&C%UH=SGKp0BJy$zxV#wfL&I1 z)9P+IolZ@sRY0U43dr~?ju^qRHkCD7E3Ab;`(iZ=@kzzT%x|V|bY`_ammARb$=8bn zr4W#MAk{1oedmhYagobAHITXy2iA|p49)3y4h$9ohV4e%dcNi|iEIyB2)5}D3}4Pe zOKtNk49}Q;WOJq&m3=G&@YE)K;!+! z+o7LqamgtpfWQk^^mb@#g(PgT(AKFGgq16{W)&^EgEFwl&rGi8#3bgf`_p2H(UU<{ z%Xww>Zg+z*a`aBTm$H7t6?$6tw!zFsZOEm8CF8ZOy?9+uD11A7i zZtKu1fX?qNdpYEuOF@`V%XOB0z$(3Ce=o7e0(FDeU;YKh4j)My`}L;W8oU1TFF5vQ z@JibmyT1LpV~6YLml}J-H>+5d$#r>I$we<_&(8GFR{~!$wPg0n-RY&E&@(dVP64;k zo>E{?54)dikQpsjQq{rr*jbb9ueDtm3Ds|f--YVq@Bv>MeAeLcK!2YWnGa3TYwY6( zpEJ>m08K5KTURw(SZ{VNy)w;aEdS>(#`>%MdpW0+p!lA1fb*(ejBIZh)vQ z05YQiM~1xs7kK!&B1f<7LJu1A4=ss~@ZD}dG1Pv;MQ+d*6DR0kR8bFUV}^KwXvLn9 z9|Um|B-564fXpJe?@?=swd;c<`(Aa&+WeOPwq6jR_^klG&|{ryvuc-uU73DI zAW15g4+goga$qkZ={d{6^OB;Ap1YI=aIY(01#KJV8LLLG@UX4cRT3w#+a@GNdU|9a zpv#7QeeojXBDU_n6TWD5yi<$}VMJif)^qd$s(4Xh53I9;NNIRJY|ssBvmFIoNG}fP z*0f>UkYeE4l?O`^vXDwamgOVFo2|ydK=$h3Ie0kW5^*Hsf z*pLZHZ!i@u-j_ZlXC`?VA1t`}1CQfg<*d`7C4bL64Z~97+%ezbm+TFbxw!blxMZvX zwcA(eSS9++y8Yh6{=6Y4NiqSatMl#`K`xo9at41VG&f zDQ>R{TK@N%n6aC+nv^)3zqH@*n|Sd>r>k-hd6b|kf8=PbWR)e)SqSBk5YwHq9WwhuRi-Im^BFCi?J zKPdg)hhyey+vOeF7$_7jHWp^EJRlL_T+eke2;If?>~C>^ zCW_V*>;a&Kpedl&YzdSpS@Vy2WIoGeDT}JNP)ITD|KjP4kc-v`n`quk8?x8+UBFk~ zvieR|H@F24~i>+L^ZoDq+Aqz+H z`obqE8FuZn-~As+jNV5FcqEr^;Ex8i^gPRCBT@iSuXeuBccpYc)iYw_KKA&_fNEjk z?`1ENcVHC^9(-)@1~uN^W6GeNt>m3Ul*h{YLHAZzdCIxcq8*wGUWJ{9VF1D}+ssHnSGs2FvH+N>H*&C(XgXqrVZ<}j9QW*3Hu@TMn&rH&3sV0o z;-~$3nLDsPHYLOQ5IiRMv4H%uUS68rAp3c}>8`zGXs*c7k?ktSs0iJpR%#e$_p#Tc z4#(p~HU#ocypZC=kT@l>B5&9lMmQ2>WNXhNTSn5fWW|4CfUGjSbwO~QRCt|4fSqkd zal^A0KrL%pc%U>8BC`w=*Z}MOFs@^+h&{{W{3nJ8Sg4h&P$(4~4H>A}n(7+1 z)iKGn2ib(;N(%Ft08Mi;+~DqP7{kZp!E1lc>O02pV!N{I6gn(UO#oBb7HX(w4fP;6 zdV@Kr1yIL#5(_VuGT%9Jf*1aoYqJ51$Vj<@mLcFY9}nuDem*`sIHx@Uog)4>mnEHa z!PyVr|AupI)38ajF?I#H`6Kj7dpdz*gAK555r$SxFv)UQLV&j%DLnnJ3E}ks7Ub7V zu!?6}(;130bbuiDl*?|Jr|wo=;vl9wf7HQ1J2)h?nnSyhbj}OJ)|O^(n1PG zEm&+d3x@Ao7HL#}{F9!t{@#C2|77$~_}7od8TsSZZ}AEX5QQ>L@W z{bDT%y_MWHr-oKYSQMYTf|(6jbER$OkS%{@L{z(+3LP)=LS{ECH!UBr^_6|Y<%j2C z-bXXXgbJX7MVswYTMecckSn-KYfm1Bc+{=g#If~?Vp7p4t!Ct{tk$$B49u@l(1+v31kaMQ5GT--oV&(S2Cy8PI8gy@y#ZCiG_eY+-IUBL zdBX(BibmBQ*l_E4ZF}>hYtEDmh7=wvo7OZ3j`^l-0cyLSe0WaiqGr&=R4@6Q4F*^V zy1%i3%?|<)6Sbx~LD!v$!3bUiGFVb#p~N}2!lmKeMzC%1u4!*#uqE22VsKU?(vsM| zttEP?yk+WkH{y_dV8H4Tr9MIyGBu2Q*7?Vw-RwUQLC)0Jx1uto+k3FbIx))hh;;

0ZeUJ-bNq`cNaQB5i?g<-BzEPdq|5m z=Xl8?2~{Fflnevg#Y0XQiOf91VUAC z?B2BBY(vz(Mr%B+2~%TS3z%o*HystlsHuXMYNZtq1cp3O<`*-w3A39&!VYym9tsNE z=QleV(Mj*wI8A{>!N=+2&_ozKQnm+U+e8l*%H$WNZ2ZcPDL^;`p=>9vyS_6X1iMS1 zXtgUW02aN`@$MTFh~k(`D^^Y6Tx@U=UwDk-S#}9Dxv?Vk_3N>l8*AH8yyT&7iT=~l zdCwM@2HE-54)p|@?*0BK;VSKro{2zLq@KBV>Xj`pj|ZR16$!$wZa?+Th+5zPe-*vY z4EXTrTwebT-D2@Xs@;?G z4Y#<;dw4{)WwkesK_#;mw>2Sf5K0oUAA&@!0 z#}31SS=X|OKDcHsuw%)Sv-|oOvy0_1w$E-x<5uMKvzuKkFR^{5u*(S_3nVgb4>GFg z<1+>+X#45Nzx{O{Ej+tT%#DIF&=6|-aSftMSvG|&ns?wb^$G?$!E`5wo|b;O0~V1& z;D0c&jRg-!e&F`*5+X`FYbNC*IoZXoM-Ygx3|!dY#(ocN;b9rIsQ^Pr-d# zqbFV;KN}=OH2{BR+w+F>lIj*Q<19#S z;)a=S=m5-ziK=)tZVxj}0rsq_@YZ8SL;8~TZ?*j^INmscK)^-AE-yXLuw$b38k(2YHTzT*HEYB3mFhsf7T93|{pH~u_n*-5@9sa>?J=m=W zyS4lLJKL?EX0zuMomSL!vU!u;^N4ySpPAD&S&iz2NWd zTfeSoFm2y|+MY`;FVCEM+bVnXh_TuaaAB$U?PFzP+xqWW#>zU;u}*yUnUO1oCPsI< zB$rv^y2vF`)p9szHRXkB@4V~&TQ-qo_+A_91Shzh-re>e>GcV;gx-F-J{!LkqDyf0 z^EYGtIy(a%2p~dlMQDhI+x_xmNrkrMUr}B(gDK+vW7(n&dO*dD>crGX#nt-zV7m^` znCe%rsL-1EEtgHo3YcuyrbZ0`;ST1EtoU+e$z`;p8Lu~{;Yg~14q8Y}>qfQeBj_Fw zgnz&wt=sX3))GT4zPF$8Ex!|mg@miK81X#|)$xdnbA#m`=5jQFq`Y@NCNblB5%D#Xr{fXw^PhE*G)?Q~GDqtm(e-PK<#_8N?O*Vs5PH4KB$Upt9IeVLMCQ=Oa4BLM8x40s$Jd?HVt(Kpm z)}HA!BP~D^T77Om`xteRR-oHYdTY>8rqXsB(MYS%?Pre*I<1xH_LJILbkyXx+K>*k z8XadPhue~lYCXFB?6uhO)}-4{a;wr&3)5|DI@r2&wEG~^=5!eDc9>*B+tY^`=1v>b zQDnm{Q&Zcb?ob^g^UeJB;mh&vh<)5Cp^nbmpN;hL+a!=W81nW z8*iQFuaP#di9{pKV0+uXCX!BT4(r;$j_}Cu$c+AGv56GN_H5sN9?PP*UkbU2EIltM zhIz+EB)7lc1E-d-I#(W*HgIo2svkOJmg(1|6f}-F(n$M_%*U=^`$Y#?-9fCn4WWzp z4 z=XN=ZSxP1Kh*>9{_V~p;h20qZb0U`Z;0KZsVz#W<%MZ^TWMKg62TRYX;!F+VUek>Q zQKPOeE10wnQM#L+-j*Q@Ss(y1q7NLq1(*t|q&NizvhUe4!f7GJ5<*}WG-80VL)X}1 zrM+AI(2{>ZETdE~yz|Qo^9?6k;7-Kfv7D%E#nu$%bWkEVBM~7607cLhx?HhJleAeR znH0CIsv%)wDfmypz&wt?!CQb6p#~o}R2st-jg_ryy0KU@jYy(x&8423W65iqW|qnI zx)HqIoIzPLpEug{Jj>ZFE6x;OPHB~`c+Il9sn{7U`4lE7!04T=^OOvX1W6E1*X-`A z&C#TWq)B9Pn`Dy@-oL!M4sNQ6?jpV>X3n+lfOcc`(sQxEwAUc8vqczUBFCnfcnxu_ zBdTT&;U*hjA+?;5=b_dg1i?KFq|8hkxzFjE70;>a2ReAjZH27fsos|RZEPGHrL(y& z4Nlb?ix=#aR)-*5v4Y(qR!?BzsBpAwmc{UumF9f&z*)kV^FDS|@@=^#<2=9^^sqDr zzy}(7X}coSV8TAyz|ktBLoV`92X&x9iq-n=vPcNADM?uwxng5;8Q^wkMUXOEF3t_Rx=OU9O5|EF_}G5@CHh(V{65to5If zyWXG`Zp7>j+bGYo?R1YgvVsK?k=2swYYV7kv}Q|L>3^Q6OqOOZLDM*OTN0uChHgw! zl2uVmrX3)N!foBcbtv-&fVYm59?1*1cMrk_@ocT`KD7y2`o0kSpABmpthkiz*n}@U z6RL|I)g~?yTGT7qELT`Co0@RDrlt&wPLSW1IcVXb;aOD&Zv9#5?XW4ojI z&RnGfwpQcC29zq1n-DV2ESiSMbG9yJ4aO6&tRH4YrIKS8#OGE8kDUa2nUCcz4sARZ zoK@;qu%juA7CG<<+!%)A>T)4;jPW&X3+u@L&j5BVY`ZD}W!T`uE{0e;=djcTC0ah+5te&hWGv-jVgYV`^7Nj5V#mVq`V$ zql`5z1fEbGn2?;G9LU=@h&KWQ>M`)29tHbpEbdb>;YY!IdIY?u$H00TkMq<)af(n+ z#(3IAaEj?15qzgU^rqNSgs`0kk(;6?A&BcVfZCKY`530t7GhJ($cW=P?VvTq)QJd| z(}0E))3*XRP6H@SF}X5;;gp8Z6d}Hg-;{>V6q7C2@WO&dmF+QnB&60R}yr7Bvj2Fn*Mc^l+$4dm}C#?5u;Gb+EHi z$C`*^^f(wsBk+qxLy)Iq7o}%7C*c-#5s4D0Mlg$d(1;R7HV;WQtZq$RG}_rP?Fa63nL1pYeA_ zFz!wQ`5k1Q&-Y}fc2P~j+1UeQCmvuMkFS%isgB3h8H=gomLXjs3*hOb7D(@BWke8i zJmi}sg*1kavx9n*MD>2iIAe{N5r{bHXgK4RkwD;MEE3LW_=K?tIH~A29YmYt2@fLQ z?4sEu(|j1zo6!q94(%ox>1HGx6p5kSc<>JCY&nc@v;D4Qngi%I{fITmRQr%^deLf< zDc%d!W+bA`9%we>kX^>P0@4s{Mxoa{lG|VuV$HsW%c$KMi&A6oXA*{yh)}bOJ(DuU zC_2qH?o3*6E`&_ei#d}(wjY(|Uh33CYt#Fur;fvy8I3K|L5@j_@BG5JGKq&T6;Eal zESdP_HVQ|^qQpdK-U~x!)S``Kvoze8grNAnF=HOAWD#PB$wiCUrDQAAn>7_A9q5Bm zt(&t-?WO6 zV&Jnyv3LY@fFxJ$I5+Mn7w%{4zP*?0wsSakx6z7Q!<(rgNK@8-zDuvJXm(@7m(8zm zuZ=OSw%;#5JU4Mss52>OwX_Kv-YK@UQ!YGL%gt4kW@lZZyr09wI{|0q#fcZ=Y1+(ER!{n9(?SYn-vDk>m{QEIN{g&P*9?wo zcWu428d%r(Fd@AMIuZ8rC#dA+Go}V7nx2I9D1AE)DcfZwm)Z(}g*RnA$XOA(_BOS1 zM4N~fL{@&5QoZt!1ENccv}P#@EG|7ILNu7#Ws_G@G@+zbq>c2=vm!l)e#s?iBJ#U|UB(79}C zFoD2SEpKB8xMLzL1y%KBCFks#r{#)urrPX}_vTF~nu?Y%f%5}g%F?aAQQMQekGnAS10YNVA8(~}eYgAhLdEY@$$ zl%mV=i)OxOS8CO)shC!b=8%|Y{+hIIT;u>3CYD<#N$-odmMP0MvRyA#Aw<)Gnd8^c z35|GP6ZEqU;Q~mj>o{%-oR$Q2SMAcN_5}MEz1VWemHZjzMDi{n9u(m8u9;=<@ zOzo|}0hv=)wIW9yfqZ1}2^lrMhW2(yB0PM9*gN9Ew>;*b+LJ7Ncq|`&|A{0{ThOUDtj|weFOiAwPs`N0KWIBwWc?jZ*1Nf^tc9xgtJQHrg0|MWx+5z zu0!7_h7g~&5^}yVAB$O>Ep(Qwh_)pP#Qwf-{e-KXcrf$xzK;0d2LgYrWnujVyDZgV zql?8B+!QHgeyn^7yAvH$(L1ECkr>{o*Nz_SQC-t)g(X(zO;AAJf39naFwnGi2qd7? zRlF=1`I8I%PS|3>viiSC<0{4B^Fv$U!mod_KmB*#rpB~;eCyEB?IJV7N3Eu0=K<40 zDtbX+%ro*bh?;?yH5QA|qUaD&1~S9j*hHiRS~2ogUg@oA3N|5^5Wi}F1E=Y&eEE@O z&2ZsRl=lM}X59kmHlqyZ*U2brS=8o=4IeaV)^lLpZrG;niDmNG5DR9Iq+=eN3WP~K z|J#;!t>;|e;EY}++qVu9wPAme!{A_8`z~@UxvjI(?-G;QVqr{^1>Bdm=H;Nh{AWXp z8F}GlG~=%Z>6$O^^bfk@MV`?LJ-`O(UrAGur=`yz#f%CkdRk6UCICsRnrBTxD~qta z*?S*aHoan6jUT+^yTWt(TiY5+$to_ff-_`IZXJ{p1lzJaD;HMoxI^uwga?RrN&x|o zB|r5fxjV5l@@J<(Ob8#=?|gT^8KXHiW{X-Ou#gpW+BnH22?77JTb|XYGxGniN&?#n zwxl(`b=fu6OI4dT8&r`eT14-Ujks^uCgkJmKaKXD;k_CXkn9;*XXXH}m0p@hdAPS@H4m%Yi znQTOD;7?i2sx=p3AE0Q~b8S;BaH%kjkXIy=RmD^(F{8)rb1v7E4;oe}F5xki7>`qf z@etJ)3I6)Wskj(jYhmjsqIAbqS)_aalPW77r>0^|HN^;jQF;Z%W7STKsG3OcZM%29 z#F#F1i8T_BQ5}(97m?m5HKih=t#nABm{1F`RpXFy4hE|r_N{J6u4@?YiB4GjWWbX*x+j?Wn zQVf!{XqWyhX9V^NRH$5v;~L*-52^j=AkB86+(?Z7V@A%2XbQ-s!?*@0;*Rd*L~=%hq0odgjW7tuq|Fu_Cg@#==%C7qt*H~8T#42GO7D+c8fxbwgX>%ct% z-MZK<)3PV$3i~wb?EoM6k9R93z7>krTrD`A7wrFfA>Yc{dbEEWRtI@)Rd0)aQfe!* z)<$KE>Fhw8p{xi@$YBS_qHE+@uB&Oagn*baEv*Dz7IIDt3rjI9HLrI*>qc(=+1j?9 z0SwPw;FZIdd|ohP>uS#aiB;03oVG-_J{X{@NWqlCG}AX+yui;RYC8K!*JZ&b@OJX$ z^d~78$%;nRtQy`X%SLTf@hRS6u)-jd9A0_nYz2>Mm`Nv)H8WXKEZ##F#r9Md?KF+xg?jw|F8ZJ`9!9AkHoCf7|bBvb-iz7z$5MU<#+?4t#!VdV_w&bI7>VgFX3j z`g9nlQ;IH`TP~sFgPG~c)6-dJ>UxS_Owz=%X)@K$8b(dU23|QV53DFS7n?h}i3$XJ zr7roc17s{Kma*K`dEq(c78ng*HY~w-JtG(O@v#DzsHvL+JQxjhyotMn#<;vr14 z$vvfVXMMKT0qO$)n_vlHl4@r~!eJt0+!a+&(15`vDLnZyBj?EY3SvZep^jIPeIDF1 zD-(ug{vGIo_H$${0rF6jF@oq)-zE_K)RvZGzd-JtJFTc5$b3nrVi%swi#`)d0d~}YMj@|^2rJ;JG;AP%(X@4>C zRv|P}^ZDN=-SO>R9=`CNnM*nGlE(iA^|6*sd%5%XC+%!cA!cob#ITv*gojq{yqM+8 zDJY894G544^#9YhqF$WfdFolT%r;_eFVl(E8)&1L1w0!TdP;AsHIBYK`I1b@lT*#* z0*?`FqOY0&aQ`A`A!1Jzy(6mab-1NGbWwD*UQQ#p44u*>y%z1BT!>4VcLQ)~Ei5|7 z;N-;q&?eHI4kG40%$+P`&dwLmRd;hK3!bIr+8n*z`JQ)2ujC!MW4P?VdV}-7glMQg zh%@~U$6MGG*1D9G-;Y#m}AkKK`Tv~-tEZQeG4ve>1$5cRKEjvoyA$V>yiZGWKF*{GK>GU@Q? zus5Q6KLT~AH=?FK74FoEPL_!uqz7lfqqs#x4iUCVov3C`+4gmx?ynt!fv5& za|UxzVT3~HerHiGjSj|@3!P)L^^6w2mTG}51B-|ksO@E-l@phwLcVJ$5Js~VCja6K z{(Jb~=xsfkH`xuVZG5BJK*!0ZCUaU)=5Sk?l z=shz$OmCv+g_093ZY<$lXB@l&e;&4Kz*sStB4f3y>~=93v+r9MKMiyj*%qub!e&bd z_HMD(Q5Q{QB~>lxnjH-rjIgSj^YA2EucJY^^;SpZ&<@mlVaQ@Qa^LKZNUM`a6MXAW z22Q|xYd{(8jOL>5^W5xvo_G9HY0mUrv#on`K^7D>=X4k*LCbx<0JvevOn*f5UYWLC zTe)po9qQPHgOpFK`b%n76b81#n&n`A*0Qy~IZ*C;=7#s9hoDc)#MW%HJKF?f5^TS+ zkWwlIq60)cRf;dgIuvzY*o-N#AYpda*g7)S))9DdWJf$dq(8uO;)nfKF~gsH zdG_?|>5hRvNYpp{FX4Z!SKj{jV$tI#3B=sZoH{2Z(QzM)DSQEb^e<0azdrf$?2EIf zCwk6boa)(op7}4PPftmpY^y`j%#5jyZ~j7<7JGNH%1suq*~CGzdSlGDJ`9*a-V`U#pR&fA}ce*loXV!E>vK19eW@T^G9qq|U4rf{pW>@Z1r5S}6Qz)|v52wjfSX6R7Bjk;7dJbKc zSg32heZvOILn5p;+%Bklxxe+$Ds3;n(fDohmQ}Z$-JO{}gHtU%r=}6?8Fa=v`xX3W zV9M9;Uc7ro&hy-efJU)JQ<(nJGeS%LfmI4F)*G%hw1($j^&i5>y2uhUz7p2v$~0)Z zTQSr6laVXj6>SmLXpdMIcBq{Jj%hAs!FsrTSSs}A)&^t_?)*dP7cLQ)|ogs;0F* zVppt2&NX-s_El{YUF&V9WywU|%iy&%$JRBWuwCnH2kRV7N({v5Asb*^eZ*Wx?j6c$ zr7Q-{w3F_wWlio7BLvp#*~*T7ZC_6juqM&jsBae6BE-53O4)0C#j^D2oqAbNRrBo6 zh0JdB+!IZ&zHfGBD#-bFSL6j(H*tVM)6b<-Ax&+OyH<0w8SS7(T>O}QETsxNRqWdA zi~H%oKJOI6>CW|Z0eWCa)k-OiSg7j=>PC0D@$=SqwP`g*nJ)xs@&#!`+mHS+m?HRoR3=vcKYMTg97k^4 zjemcB{tA@*RFSl~D=A;cc2p_5c%pP+e3BSacUSD$({d$@0$}0Twr!gocWm3XZQHi( z?5Jbg>DW#>Hg+%5o+=H~xuy~U~qpqpAY>1DAGY=emHQf2;p(Yk@-%=8%r?NCyl zL>b<+=3NZhdY0}9J`|*(*=jcPQ*n@;0|z>d+~W z6g`(Dg}M3+?TfII%xjb$ErR($Aw0u_NNoixppf4JwH!X zUU?i82?N0H9c=YC6SwSph(0)_B~nlsWUC){SODjyZJ%#AOg%o^j^ z$kYOLf4vfpANp>{Yj`Q>#yUrXy!<66-nOQ?*Kl6dOVgoIVRd_vlaO1bFHzn1ZvBDd zbJFJ;FfGo}=Ij+SyKI!sz=01TX~0}%Tvm2NH=7%k8Pmz=$b~bq{*iLg8WaN-mdEZ^ zm)@w?zITokcHNb{&L7mn!01UC6{I~xMO^6>=RkB|2#DJ3IrOo93QfHL;ZhsqxSEY` zQ73A=55o*RZB>aQ$n6*C=eB!*xEGLkCJG`qRLN8D5!{z^}TvCfe22wb04z*O>rD zXQV1L!>+MTW+|PLHs1-$IEO|26HoXf%{+q<;1t0AP%r8#xISn{TBadG*x%dw_hW$p zYNDr>F3)y{%>z#-r^IU;xm5fqB6Uzn(k*835>M$@D-KB_fY!B4Ud~gi@bWwVz|Igk zfVf*=XzVYVUz3u#Ig>7cd+Wf!q$^0;YnOIa;eNSr`ZxiW@B9igmaNwx znTU^L$x{`)sKCs!ip9{VLAcJdqQ!8wJa2C^TX&6$wq^197?pm$1zJk=kwIxKQTu!a zHDfbp^HIUA2#%*gQ=(IO+18qtq`fl~GhVLNly9x=dcWZm>P)y?&A@+|sF${7=|5Tq zJCB4Z1{S!eK>z$GqXoYI_z{eYmFjH^j}Xn! zoc(gvuK3eDN7jsydAoZlK_mhMGTeSiySOG^$SvP{tcm&bZA(q8wYXzSs+$G#IXO~$J`+?jx?sj<%olN*W)*DTM|pB{e9YaNso%TUiXw9xa7 zK=*`Zi%;*dyEmhiGOnc!QbKlluJk8(i;}NdU|L+nhVZ>V9EE3CeFX0P6ij3&skDTw z)gnv4l7|QSy}QVKe_icxqkOMhiCd^JUun*QgAXOAFjRb9K1aU#Z-gG?I@vxg^9ET( zc|Lmfe_f~LJz}LecFxLqpk}KvGnCa+VaN;wCs-j~*O0jH5Yl2z!RaNeFB~JfcYIw*SLZS~FmvY!2&|dxS$HrVv#EImv zDJ00F^zsoWZ_Q5f4<3(r$oSnN8y$ZVw18a4&xcV5Nk3^jZ=sjuvOLv4j1|S765i&} zIUUm?(;;hvs0Yb(vQ9&4I;wU}k5y&Xn-e&izLBp4v>GRRb>6Tzqu-Xz*D8(U)HsCV zI9|i5+tdI@KI|iP-OIRbp0B9OGE5UuDlq8+OhXuFRm{uL*7;(UYcId7Zlf|v7Np3s zI~95aQ}*62bgL~>x~UTv(f=I1)JqQgyzL2{ctk=6r{!$ro|bb@DwZ9we@eX;$^Y@ z!Ew5WXz>r=W;lmETv&XFqadr3Ad?;4dpuKZ()x!jT<+IpXUg zh1JxG`~?v%U!IE!vm;zTbVO{(cIbKbNsn zS_Ond#R$j~Rv6S$kLu$UIfhuhIq>534zt`m^z(ySSFROsvHF}Cqw)xe-Or-bs`?t# zw~Xsm0r>#=_QIgnnJNht6&OgI&3V3uJ8E)<)#WA?0sHt#Vr-aOGnAy{<%g zS%{pj^2*NIzl@uvFiH>+HEg@X|3ceql#5`egQwAcIvL{-9dFQ(^`20LO4}Z)ipXfL zT%)MaMqRm?d7#!UT&WW^%D>OO`j5|~eEL~8?==r;WoxCiQ5cU^@|RwtCzkM zx3OBWf?;Jr#joC8ij3Mc9o4tJ4vSr;afU4aqZk}>1$G9Dp-mlBULnGf z6M=4DUKdYKMtIB>hpcIeEne;Xkm=y+ZM%%VD??E_zdavl1_Il>4QL#PoZy@wA5KMs z(UDk~_MHaubq{CqgmdEJgk-lK-`9icjuE7tNbnW16O06U;#xQfxD^UavnmUUBzb3I zsJTImGvyE<%K}469)R{{Sh!!x1YH_$LU>w=1SsB(3|{PQEf9U#FcKyWbG^kfuSGCa z1JvmDocnz#Eyr7XJ>c)<#*t5Cye}DOeE#J306p}ZwA2aJ9|+@bmk!ld!z~^@x4ikx zJ(gDT^0!vB?=YFLi8&>!4xJY+My=-*3x1DJhPa=XmsjxnVE(r6+w1+b@$>kM__yZXVSj+&cX02!Em?AEs?gV7*$pCxAk)+D zcJ#atO{H3<;Hcap{W)3YvR~+rIv?P6&jgshtzMT+(8vwOm1B*+4BVz@NS(6tA4f1G zUY}T;MF3sNjP{vjtrgAY5?`@JAY;4YKShC*j<1s@b=s5Ne5FZHzli511Td=GMjiF# zAO*2J4@=~IC1Q1ZDBmygLUu8ZHw1kxzV?GGgign=G4PVY7_ze+C1HRZEI%dioCkF; zcdRXxx5DyXcPHeN;vjE<&5m&i=J9bgDZCbGhV4;Xzb`bLkiWdtAie6yFNj@=W3WR5B|C zIC~-^fb0Vz_l4zQATUe8>Dsb|8&X7~y4#=zi3#5WqUuM2c8a(2wYRIhS?n~?c&Zq~B;_^N6%PL>nmD3Sx&l z4}h|mDQFtte@6O!UeBSii#a`%VRs;He%OrPsZIiJc4+Jg>=w*!=9Q?i6Jmv3?>4mfj#)?*(Wz*qKn2+SUpph3~W~@~R;1Y;u${ zY>t2WaxPBaoqHXF|Llm3sqWyxz0|g5Dn3Og!BU3|Q>rY9k}d>QkQ zLqI<^f!|Sn&%EX=fIFLX%_23E!49ZCJk2b?PvqUQKk;V=$LIGx>{uBSa@<2=gfQY& z0;Q6{g>cK$H>kS9b0l59gI^rfRM`#-Z~s8IISvB3>f<-?XcdJG%HNZDcz%XVIpKyE z_+z=hByPO>h_@!)hnL;;l}4MyvWfS$fPn1f=>`k=Xh(8P(r$JvVeffdK?pMZ>(R(c zA{N57Q(Fgf*i?_0oMikNbLeZH1|C)IuO3Ld{<{S|OPkEm0B zHoKxEZ(+)=d-~QOF&ySCl`m@WV;!7`&(5&4*gRi31V3nnT_Xc@1Yuq21`@11Cr~fo z^&{<$Hn%HKT$+zf0l~^Ubnsbl4V>$j==p2JDUCe4V#3Yd_Xfgt&-?hK5Ht&P;Ad_! zPrWw@DE>$vDwG@e5%Ryji>zJ?ql!u;Nygk09bwUl+etTvew4iV-6`{5EVl} z=}8FWid>uoT{njoY1=3Tc&k)aswoRP-?lg-4)J#}Lg8ce4#h-0Pa?KSN;sZ3#3gX6^$2r0f!CSfnv17{fEUs*$F5I|Zj^&Tb3s zA1*ja96%5~Eeyt)CFMof>3tLVW5ti4oLE(v-c0mAIC6~K4Ea1hj`nwMRyAG5s$?#| z9Y1Rk*0Ne!N$5nch9RQK6%q%WZVd58xWSW>FlLLGo0B)~Hr0vR`jAL79vYhpYiZ6| zxXA!X0kaH5_h49fQKO|4&M$dkE`kT?5LmGpUv^2Q-_nYczS-v{qf&NC>7Y`Gv8nHk zqyRHYTKc-Lm>HG)?iybw971gDFl0T4kJIX7x2 zQ{+m&Z8CeW7sTb7#Hruj7C5CV26dBAVT26BH0n0>7`e<)ol!D6f6U5m*Y{ohTwx$y z6*8<7dN60&zfS}&!2muO>uqiwG#1X>|IG@0*N|}yku-8w7Al9EQ|JqWW%cUulmIPq#+z<4!>Kqq=0?z{AAhZL zSlvmN_?SkRH~b2jqa$Akojn8cr}@^NUQm7@E0Wxc?$deBiBlW z(VZ2f!LWW@{}5hZP)Nt>E?V=!%oy0qC%23pgqHq!G`2)9<$H{ zX84M`@iOFV(C<3!?iy>eNtvuHYn{RWwx`*r1D;SK7Yx%nCtrQDsDtz!FbzLlmKcsP z@p8ApF^b4&jnB+2HD*i9l>AG52V8`*h^Y9TT({Zx+NI;JQLcTG+S&Tj^;WvM{!skudR%jYFtG*V(fDmwhqbcZ~sPOHm#=t7?y63_*TGUTZeU ziU%PyO9?bpWJL@cqb-&$fcBiuTTN=Vb^T6`L4vaSltSvdV5?`=t%F1yez1b43`(N8 zO}&3K`+IZxtT4B1hAVF=r5sPRh1oyoJX26uNS43B~+C;Xz+4MuCKN~DY(6%f~w z4bYoADkf~TFh0^fohwgfLqE|METC`>S{N5ZD{|4WjkO`k)#$}QoBy#)$)m>PH}{^_#(=LJ=twU;9Iz5I2i6FRcj`kdJF=Eg!N4ua1a zxZJL+JvgQ?pn_r^N@mr;8pG>MKwklJxg90_5mxWdZNSb_^1mZvz*@`xK5xUmjQRC~ zEu(VT%RS!RcXA6V*y(MOP2T9p=ZwN6r>ha~K~bcL(PS&)I8$~-k4i7YSEqIWHTrB) zIPWsv#IRwH`?Tf2iEhQm$P&pLZ`{Z$G6jDf*B^c6)8iP-hlI9H(B03!O2wTRju!U0q7%Fum5(Pg^Vz7^*wf#>wemV0cL9hcC82D0tLQT=yF*UhM7-t6#Jkc+a3E~3 zRw1L2&Z%}SCXsUSbrb$Y+v|fueuK7~^e+NvN|Gg;0+{f$6}au5{Ay6HDP-{{YoWI& zF*``?uq}!@n4I=pEqo-sA+@daXbet~3ZW!fE?4Xb^UQ1z*HhF(nly10N_);p?7%Iv z4_fwFyUnMMuM0VAp687-ZF4+~$HMylHk@RV687X9=m%eE83$i!m|)t2lhvfCQFZB%C|=LVqWh4NP|GthLKtW4Wo+bI2c^_GY1HAYwTSfb97K>Zxf zm<7?}&8&R9pB5n2Y*1U6f*q7K_&EI7etJe{qiMbA%QW3h=3LA96NekfM)J2=u5J;J zYZ`q3JCT;{iaK$PU_E8P%6Fa|*1uL>b^@*rKWsS|AmF?Pa~XQ`{+n%sIi%1`Ai>>a z2@V^PtIl^Z!?B!QBbk_gl_|RCG3p|k3U+{>D~9}(cXJ{EL!U+S5}NaCR#ASsiQ-Tp zb4#6U7_OZKbCQ2b(bQ^ZU?e2Cmz)z~xE1hvc2V;s=sCdNeUl57Ts$%SwF!+gq8U%yNbF-4yxC~U2)1$8HB7uR;jR|kfgROM;$E>A7@|5h!bo|z8l;t%a z4jF;&%=W{QuS1x^sT9qN{SKhp?&r}pm6<{-*o`v(LAD4^bnMO(73d2UC|l>OXs2;o z1D991DR|s#z2^pbx$LX2?ACh*4A-Q!6IPYWsk{tQAl5RjWvJt2NR_&|_#5^hXARq} zjR1O)7!3WV9kc}wuA>{xFqAF@mQqFUNZ0b6-${C!*E=^N2}kL;ZE?XqnT3?|pron` z&A&pJNT3p#y`0~E|69GoRbL{~ld3`onQH|p=r1Voj!v06+610IS-+GrB2^P#GBjEr z=f{MfZFU6dsugPwNAC$BBY6#;4x%;$Z`i7NYtyoZlMxH&MkM+G0&`h1hJnIMHWm`Q z@1yiCy+o1?0`E`yd!=4GyRv2?!&S{rfq(-o5s)bUc}I&BT^LT+zaKgcU-cND3cI4vc8~A#` zVRN(;jI6IQznj@AOpp0HNEUB?< zRNLV0C?x)YIT~s+5jqf<~xLFK!ASp)lx##E-x92mlCHw))*rHZsGH2bhF2QZK3P zAnxgWUMLsu`u_c=AoBI^O$CbN78nz?v#{1L$GLwbaqOq!{yp}2rzbhPg?zeOLij?3g6qDZM_)P%3iV+|Fwo0!XP-))DX&wzRp07)< zXwb?92G!GJA2?hSdRE7jU5BmrSxML6uBfpJSR~;8v;5+Z@C~yZ`G!4smlc)Nil}dp zp$crZDZo+6o?caq6I+UYG{nY$*yD2DZZRqAb6mRV5cqi6ihbO+X1nDPNBIuqQHL$i z5XLwV@;Jamh*<|tHn+aupPbWn(P}xe37q}oLNvCyZaY}~_;|)Q36$^oW7m$JfD6}= zn(i^VI2M=(G+e@Fwln&uA`rV-IWZtN1>Vt9cx+q(AM` zlbb#tcYQFT3-2Ae@^^*aQz#m3j>EVihqkm8xfj2LShgjzVe|L611_>Dv%OXAL05Vo z?-zXnCX`T=zvtQL_9$-QCfG31#H0X5zZsCuS^_Sd|E^w=h;&}o<5e&H>4esel#&quYr&4=D z30BfAgmWS7d;ytr-f65VYbsuksA<#KbMlYLAqp7z^u9}nQJ!$;tT8QA=t`VAT@+Ym zh9xpsN#7MYQ~lwODN`0}PTExvGmCX{!V>rA6UY&zxLACepf$nl7-Ez8J5|xgPAa4rl^k-JD14ZP7N z{^foFgDY7}v9U&`UW$|4Dhn1cY0OO7G00~TAJf7ltx$mpw-9v^uNA%ok zKY-b^*hr>^)9nzdzxE(Wu-^EWCbf;|-3tt)7PDrG(fTXD`KF5RR#d--6SJ zRyJ@R9cOTe7=#CwV?iuyjO}MxO}vX3$8M!`IVU4?_x;nQ0!P|wv$sG`B{zx=q%xCd z1@v@ZpORp?7<0Y+(s>(k{#JUlcy!-tJXH``X1jX)^6S=V2zw|`dvT)lY@)MOXY{S& zwxR+8-x{8Mc7 zq==CS&bK`w6qX=%dvEaZj6|@hz16FMb2VWNhm&;lm{w)3@9exa{4`U}2tE<@9=g@f zSbA@_tA5e6hP0jwykwwf$4Q&z1!9j=*)>UeWe2_>NN|@l2OcI<>s`O@|Ix#Ysbtmj zavQLR{L>lW@6Y-adxayEk0MOiOXBz#YlmLJk~4f>GaABWnQxHi3TY0tjG5NP9ZG;O zGSs#UGc@~KlG{e{=(#^nA8j*xW7)42O;@Kg=JJBm!ooapp|4~7jUYS{XUBN>3_73= zb((*L|E>9u!+yTyOUwCZg*@!=mezXz_mAVfzVjewrB1tcKh(32NPd)=_i&bul;)+8;kPqYvi06;bkEz=z;+Aq0YKIF8y#*@H}sKf zR>i7@niQ!PD-?WgJB3gMK;XMnt2ymZ>8HLFQ(+G%mh~R7T)5jkXxmWw#n$uslA;j* z+gI6GvOS4{4-}A1hlW|R-Ht1R_-KP8%?^Q<#Q|e}L zW!h`UkTXBNmMJWrEcAH;Y31_sBlLMA?siYieM_;G@>I1u+Pjkdxqc{u(2R?2rM-q@ zVCz*aaNP7Rfg`#h8}BA?P0RHHpBV3cVLy?T!fo(|R_5Et&O7ro@RLYf&+v_P*F>{2 zeAf}G_w=5))y2m;U<<=z|UF?N$3 zA*;sLpx>jsVg35+z;9SOO{J3WVKS;uJpt@k16SP1k#y*WG+$BexLuK+>6jY;-{22z z$qJRN$;Jp0vaLk6&W%OL@+0$1!{wbD%Q~akL*;DHx+2ue;k;7y(wJrc$h!VQVoo7Aa&fUf9}~vx-LETPc*mS+F23r z#_gXUT3He9i`(z*MTSyd1P&RZNSiTVHWw#h6aF*QmKWS*(>KLVd9J2VAT)|c`em0S(M)Jy5*nAcg(YV69BMVYDqDUB4u;t8W8YZGap2+WvOb6 zGSC#jj4}IaqLEzaWYdJZ(jn^0_~tDds_1-?%6|ZfRw`zs%-E5;dHZ=f@G7Q%t9qm+ zhv`eKdTxfwK0O@zorTis`ZI6kkr57SYLHo7?P;V+b?iw9HUc~mEgd119ky`eY)8JA za=amq0#I%}b$LSy*A}<*WfIiP?@ZYFa`J1~uKa%n7z+nox8YZljIkQdcrfBL2DN>x zm=1ja?9|rf?^`d52-#7-c=4}M`O4}R>SZvCymrRn*9R{!49d$;!E@5Ix1$2~(=Y@s zDmmZ|Bh4*Y!@ncH31f#GnYJj&*&9%`5st3hyw(!BWq#kLaoCMCApp|{n5d!{IO++! z$W2})FZ#Uh!R!;61Ac&e=mU(j+Jl$sWDtcP)bZS@-?xhv%U=Di-8rg*3MRMjUWW`*WkaeyZ+ z7Ne+}mZce(&Ef6N`=a`gZ5@nF;HWqqgS*Lw{2LV) z3cq>D@}4OdHBp{#36ibZlLK@t0EhHs7vA<7g)cSV0~O)zRk=m$2UO;MA0fUkIr1o3 zxh??50p!rQsxS{tA{O$G`7~@(1VxQj&bBtg+^i8aNh|2T*ULCVlvJuXGTJZ^pE_RYSvqei_ZI0~2^q0nq z`XQ8hfCbC)5<^Zqv{SBBS!(SfKQ1*#ZzP7+=0l(&4{vA0m!kEPf5*%lLekTXak;L#w-tr zv==w<PV2g^$vss30Jys8aN9Ge2TJDP}GwUps^RpiH<)9tLebfr6w;k%uK5$@oK@ zFWNKA_eWFTnywIzW8oMbnnu^ei$gCUugiYWi9JHV0*gp6zw`c8MA-#u0WcjaXDfPl zisdVMH-c@e+$kI@3Zvk=i+tHl@J#(K(GNVauD5lJueuUYn=~QUQ(~;w{)64;4|--6 z!!!ntGYf7o5%eu3{9&Uji3)uo*#O#uSdpKngG>1xG zFMNq$V!1gWmQ~Jw6HzM*_MQ|=$(v;+J3O00hgDax;gezQI6I}M^Zd|vqQhQSG_k3J z$~zwpN(tV02tNvloh;fs%~_G?>+^%%Hjc`&+O*tv-WxR7da4fxI7}SDJmC zFhj;`5gpt%Rl?&C4O>sIT}GafWmb5~H%mcm*)C4!5KSr`5c#spa#*xzM(2in|JIBG z9%XL_Xc!iwQR?n$YM_aeA20Z}bZb{tc84$hOmEH=J;2Q9tm|}ILfijO;=gLIS^Hqh zVTJ6eCw2nzVCzM<%8d0^i#EH=%7UVI(+Z%j%%v7SP4daYIn_YJDJtt5P3EKGip%<99e_p;*^l#Q z=HBNo-uLDEdt_#+pQp7wf**6ZpU2Boq5RLQ@B7@;)T1Nf@6Vgd#7xKUDaC+q5w~Z? z@5{3z;`Q8qDl}f+_vN42tMh$>f$)L}j}Y09m~$>(B*@&{o3A-{<_{p6jyE<0SSG~q z4e`bPjmH*yFuE1BmxkszDv(5k|N%;%JCycT%!rIN0b;?0( zLACAS7`k9u#H*76b};zYG7b&*{8y~6Hd;ZNX?0J5QrjjOxmN6(w7leu^j^d9pFt_Y zcl&T>yrL70;g6m>;v@fc|y6abKbx9@LqfTuSrJC6Tgc)`wwEPs{8@;WElxwoYs20XM zv;~bl;k>F}Ip~`l^<|?W)kSAVQi1*ea|u5%mz5o-;7qV0yVemKX`Sk7gtnos4F{J2LakS4UIj&IAq(Of_Zo(h*dgTTWyz zp5GyHfGk#v?aI@y`N}d%Z&=3?>B*f&&T1U>oE|?B8z#QeE(%nH28Mp1{TQoUe_ffO zYP*3F-tV%O4vb^I>Ij~7$0)51v`%Aj&2J4<9YK(BnYDX#&KI+A%KJfQ^?o+iwa<(lr*eRi{(bntshZw4375f+dJcDbVg5Nu z0|6^NrPwVDqTDS;ZJ_bSb;JYDqri*5ktjKat}TSKnC`#I{v>z#6<9uF7)FV*qf5i;$SATQ{u>0wU@M1D-mZ5g_4>Oo|cPM+{bnTw2s6QmQHwWWBw! zOJdOM6y_#*a*I{Y7#Uwf18$8va89j~E#@O9a{Mh(bUASP7A~VC7B2^gbjYM*;AoHI zz#FOx`nd!2FNWf&N6?Ml8`pcTN{?sLB?6=4gWSbQoLhx1xpGsRYX`L2m`YyP5j-@} z>&S@r)tEWU&f(Hr7lOTY=BGynC;Nht0u4b#SLY62ub5#&>MFQ#w@`^*C7^k7-_V_^ z#e(IK6}B3&9s){E%2e%!N}C;}!TZc*VIbs)TKtWjUYF70dhWWFxf=TTel+4Y;=$TJ zc$Y^XLpWp4GCpo*&IguNWe3~r*ikli@M$37wbk2ma`RHx>a@L5HYOmTiGGes6ggEY zz>f*CDrR)XA< zV|jP!WHivc$2T)FLon^mwRMLrugn*@++OHVARYXC zW1u#bzbEh z+VF;UN-J^LMvQj8-_12;hiXXt)U0>MqqhOTE#riC6$nhET$mxQNDg@=!dq>9E%u}d@iki+srLn@%2 zolaT8wXWk>o;pdOie>BtgbY_V!D!6xEX|v+7L#|zS)nM4JXU0vYT;MY@3D4GELVdY z7X>t79WY@R4;Ka2Su2GHp8{vFQN-+t(v4AAvtCjX`bwVc#qtxZI7>uoGa>?pY!b$0 z4)*@md4hOb?)N)r-mxbJu`%VJIf=)(T71qLgLSW&zOt^22x!5(>#VZtWoLY_0Cfj- zPOgm$LA^#E<*#}ELnonk1@de7!Tuld5U1OtQPt4RoH-om8SuXxys{z_AUBuudmAT^ zv^r4P!>uZ+EyV@#`8PD`wTyiE2{yC;B*r}_Q_*i@Jr4;-NSn@W=%`L1Lh+fCY8G*| zFv(O+=ILTInm$Ej@Q2naF{Dd-)dY(gAyLk;^r$-=W(jNx29HoT!)N*TZzZoWol&N#^qthAKSU^4IN=>W)i zCT;Iqs@iL@_v53*&6K-E{DB2V)AvfuF=x_e{tVz9<=e#7eKF;jaQy;1z!#gnzrp)% zt=+Y%B`|`jl%;yd=rYxFBmgXYmpn_{0vo-WdwAv(aR*-Wo|FX*20j(~N^HUq`$|K0 zi;@rCJ|1d4sVyplp3e{cR=^2ubl-wsft8#Mav~W|`o52#6$c>Mxe5XCBC7UDd6~74 z^ej9BD`UzD;bl_u-CaF9jwDASp#F`XrcKSvaz>0?pQJLbx$;)ivNEbW^>-7+eBX0- zB^kzqnYe%P=&o%QWPdt~L~CjrOc-fv6fU0YTIe-PjbwIZK)tC@R`o zh*mlI#08wh+7JF!3V{r#F>c2;iT)k)9Y$P>b>Lz&Bh(`;*xG0B^%JZ;zVeozWtj;V z?eJT*-l#dF>^5C-9d)E?WyI10h4r;hnaXM5ty0mJ-x6#^f zn=&X*aL+i!Y$6M^^aYSyaR%XCneECE>-ev>a0=T>574{086 zv+t72Q``#^g2!!ox)IS<0hEAlw}^?cK8^MrZwR!Te&gCg+1y!Gm1142tN#O13=!Ma z#fLA^;oUpYY{0Us!yv7qs;}kB3&Jt+a-2lJ8ST&QDs22XG3@M+6&|@!t*@HXw(cw! zsjq~R0Pl0=z%>sMx0*8DYtz(s99Kl zEH8Cw4!~wGYxTnW-PjW?A7egWe?AL;ZmR{_DqsE<=&XMmf`EYh{0IQn+(8oXLH_ff W|NQ6wxBn9W0RR7%aAvUp>K*{wyiE)M literal 0 HcmV?d00001 diff --git a/charts/rancher-monitoring-crd/103.0.3+up45.31.1/Chart.yaml b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/Chart.yaml new file mode 100644 index 000000000..256a9e824 --- /dev/null +++ b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/Chart.yaml @@ -0,0 +1,10 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-monitoring-system + catalog.cattle.io/release-name: rancher-monitoring-crd +apiVersion: v1 +description: Installs the CRDs for rancher-monitoring. +name: rancher-monitoring-crd +type: application +version: 103.0.3+up45.31.1 diff --git a/charts/rancher-monitoring-crd/103.0.3+up45.31.1/README.md b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/README.md new file mode 100644 index 000000000..e0b63e026 --- /dev/null +++ b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/README.md @@ -0,0 +1,24 @@ +# rancher-monitoring-crd +A Rancher chart that installs the CRDs used by rancher-monitoring. + +## How does this chart work? + +This chart marshalls all of the CRD files placed in the `crd-manifest` directory into a ConfigMap that is installed onto a cluster alongside relevant RBAC (ServiceAccount, ClusterRoleBinding, ClusterRole, and PodSecurityPolicy). + +Once the relevant dependent resourcees are installed / upgraded / rolled back, this chart executes a post-install / post-upgrade / post-rollback Job that: +- Patches any existing versions of the CRDs contained within the `crd-manifest` on the cluster to set `spec.preserveUnknownFields=false`; this step is required since, based on [Kubernetes docs](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#field-pruning) and a [known workaround](https://github.com/kubernetes-sigs/controller-tools/issues/476#issuecomment-691519936), such CRDs cannot be upgraded normally from `apiextensions.k8s.io/v1beta1` to `apiextensions.k8s.io/v1`. +- Runs a `kubectl apply` on the CRDs that are contained within the crd-manifest ConfigMap to upgrade CRDs in the cluster + +On an uninstall, this chart executes a separate post-delete Job that: +- Patches any existing versions of the CRDs contained within `crd-manifest` on the cluster to set `metadata.finalizers=[]` +- Runs a `kubectl delete` on the CRDs that are contained within the crd-manifest ConfigMap to clean up the CRDs from the cluster + +Note: If the relevant CRDs already existed in the cluster at the time of install, this chart will absorb ownership of the lifecycle of those CRDs; therefore, on a `helm uninstall`, those CRDs will also be removed from the cluster alongside this chart. + +## Why can't we just place the CRDs in the templates/ directory of the main chart? + +In Helm today, you cannot declare a CRD and declare a resource of that CRD's kind in templates/ without encountering a failure on render. + +## [Helm 3] Why can't we just place the CRDs in the crds/ directory of the main chart? + +The Helm 3 `crds/` directory only supports the installation of CRDs, but does not support the upgrade and removal of CRDs, unlike what this chart facilitiates. \ No newline at end of file diff --git a/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-alertmanagerconfigs.yaml b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-alertmanagerconfigs.yaml new file mode 100644 index 000000000..fa0f9b189 --- /dev/null +++ b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-alertmanagerconfigs.yaml @@ -0,0 +1,4481 @@ +# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.63.0/example/prometheus-operator-crd/monitoring.coreos.com_alertmanagerconfigs.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.1 + creationTimestamp: null + name: alertmanagerconfigs.monitoring.coreos.com +spec: + group: monitoring.coreos.com + names: + categories: + - prometheus-operator + kind: AlertmanagerConfig + listKind: AlertmanagerConfigList + plural: alertmanagerconfigs + shortNames: + - amcfg + singular: alertmanagerconfig + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: AlertmanagerConfig defines a namespaced AlertmanagerConfig to + be aggregated across multiple namespaces configuring one Alertmanager cluster. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AlertmanagerConfigSpec is a specification of the desired + behavior of the Alertmanager configuration. By definition, the Alertmanager + configuration only applies to alerts for which the `namespace` label + is equal to the namespace of the AlertmanagerConfig resource. + properties: + inhibitRules: + description: List of inhibition rules. The rules will only apply to + alerts matching the resource's namespace. + items: + description: InhibitRule defines an inhibition rule that allows + to mute alerts when other alerts are already firing. See https://prometheus.io/docs/alerting/latest/configuration/#inhibit_rule + properties: + equal: + description: Labels that must have an equal value in the source + and target alert for the inhibition to take effect. + items: + type: string + type: array + sourceMatch: + description: Matchers for which one or more alerts have to exist + for the inhibition to take effect. The operator enforces that + the alert matches the resource's namespace. + items: + description: Matcher defines how to match on alert's labels. + properties: + matchType: + description: Match operation available with AlertManager + >= v0.22.0 and takes precedence over Regex (deprecated) + if non-empty. + enum: + - '!=' + - = + - =~ + - '!~' + type: string + name: + description: Label to match. + minLength: 1 + type: string + regex: + description: Whether to match on equality (false) or regular-expression + (true). Deprecated as of AlertManager >= v0.22.0 where + a user should use MatchType instead. + type: boolean + value: + description: Label value to match. + type: string + required: + - name + type: object + type: array + targetMatch: + description: Matchers that have to be fulfilled in the alerts + to be muted. The operator enforces that the alert matches + the resource's namespace. + items: + description: Matcher defines how to match on alert's labels. + properties: + matchType: + description: Match operation available with AlertManager + >= v0.22.0 and takes precedence over Regex (deprecated) + if non-empty. + enum: + - '!=' + - = + - =~ + - '!~' + type: string + name: + description: Label to match. + minLength: 1 + type: string + regex: + description: Whether to match on equality (false) or regular-expression + (true). Deprecated as of AlertManager >= v0.22.0 where + a user should use MatchType instead. + type: boolean + value: + description: Label value to match. + type: string + required: + - name + type: object + type: array + type: object + type: array + muteTimeIntervals: + description: List of MuteTimeInterval specifying when the routes should + be muted. + items: + description: MuteTimeInterval specifies the periods in time when + notifications will be muted + properties: + name: + description: Name of the time interval + type: string + timeIntervals: + description: TimeIntervals is a list of TimeInterval + items: + description: TimeInterval describes intervals of time + properties: + daysOfMonth: + description: DaysOfMonth is a list of DayOfMonthRange + items: + description: DayOfMonthRange is an inclusive range of + days of the month beginning at 1 + properties: + end: + description: End of the inclusive range + maximum: 31 + minimum: -31 + type: integer + start: + description: Start of the inclusive range + maximum: 31 + minimum: -31 + type: integer + type: object + type: array + months: + description: Months is a list of MonthRange + items: + description: MonthRange is an inclusive range of months + of the year beginning in January Months can be specified + by name (e.g 'January') by numerical month (e.g '1') + or as an inclusive range (e.g 'January:March', '1:3', + '1:March') + pattern: ^((?i)january|february|march|april|may|june|july|august|september|october|november|december|[1-12])(?:((:((?i)january|february|march|april|may|june|july|august|september|october|november|december|[1-12]))$)|$) + type: string + type: array + times: + description: Times is a list of TimeRange + items: + description: TimeRange defines a start and end time + in 24hr format + properties: + endTime: + description: EndTime is the end time in 24hr format. + pattern: ^((([01][0-9])|(2[0-3])):[0-5][0-9])$|(^24:00$) + type: string + startTime: + description: StartTime is the start time in 24hr + format. + pattern: ^((([01][0-9])|(2[0-3])):[0-5][0-9])$|(^24:00$) + type: string + type: object + type: array + weekdays: + description: Weekdays is a list of WeekdayRange + items: + description: WeekdayRange is an inclusive range of days + of the week beginning on Sunday Days can be specified + by name (e.g 'Sunday') or as an inclusive range (e.g + 'Monday:Friday') + pattern: ^((?i)sun|mon|tues|wednes|thurs|fri|satur)day(?:((:(sun|mon|tues|wednes|thurs|fri|satur)day)$)|$) + type: string + type: array + years: + description: Years is a list of YearRange + items: + description: YearRange is an inclusive range of years + pattern: ^2\d{3}(?::2\d{3}|$) + type: string + type: array + type: object + type: array + type: object + type: array + receivers: + description: List of receivers. + items: + description: Receiver defines one or more notification integrations. + properties: + emailConfigs: + description: List of Email configurations. + items: + description: EmailConfig configures notifications via Email. + properties: + authIdentity: + description: The identity to use for authentication. + type: string + authPassword: + description: The secret's key that contains the password + to use for authentication. The secret needs to be in + the same namespace as the AlertmanagerConfig object + and accessible by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + authSecret: + description: The secret's key that contains the CRAM-MD5 + secret. The secret needs to be in the same namespace + as the AlertmanagerConfig object and accessible by the + Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + authUsername: + description: The username to use for authentication. + type: string + from: + description: The sender address. + type: string + headers: + description: Further headers email header key/value pairs. + Overrides any headers previously set by the notification + implementation. + items: + description: KeyValue defines a (key, value) tuple. + properties: + key: + description: Key of the tuple. + minLength: 1 + type: string + value: + description: Value of the tuple. + type: string + required: + - key + - value + type: object + type: array + hello: + description: The hostname to identify to the SMTP server. + type: string + html: + description: The HTML body of the email notification. + type: string + requireTLS: + description: The SMTP TLS requirement. Note that Go does + not support unencrypted connections to remote SMTP endpoints. + type: boolean + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + smarthost: + description: The SMTP host and port through which emails + are sent. E.g. example.com:25 + type: string + text: + description: The text body of the email notification. + type: string + tlsConfig: + description: TLS configuration + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to use + for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for + the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when doing + client-authentication. + properties: + configMap: + description: ConfigMap containing data to use + for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for + the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key file + for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + to: + description: The email address to send notifications to. + type: string + type: object + type: array + name: + description: Name of the receiver. Must be unique across all + items from the list. + minLength: 1 + type: string + opsgenieConfigs: + description: List of OpsGenie configurations. + items: + description: OpsGenieConfig configures notifications via OpsGenie. + See https://prometheus.io/docs/alerting/latest/configuration/#opsgenie_config + properties: + actions: + description: Comma separated list of actions that will + be available for the alert. + type: string + apiKey: + description: The secret's key that contains the OpsGenie + API key. The secret needs to be in the same namespace + as the AlertmanagerConfig object and accessible by the + Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + apiURL: + description: The URL to send OpsGenie API requests to. + type: string + description: + description: Description of the incident. + type: string + details: + description: A set of arbitrary key/value pairs that provide + further detail about the incident. + items: + description: KeyValue defines a (key, value) tuple. + properties: + key: + description: Key of the tuple. + minLength: 1 + type: string + value: + description: Value of the tuple. + type: string + required: + - key + - value + type: object + type: array + entity: + description: Optional field that can be used to specify + which domain alert is related to. + type: string + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: Alert text limited to 130 characters. + type: string + note: + description: Additional alert note. + type: string + priority: + description: Priority level of alert. Possible values + are P1, P2, P3, P4, and P5. + type: string + responders: + description: List of responders responsible for notifications. + items: + description: OpsGenieConfigResponder defines a responder + to an incident. One of `id`, `name` or `username` + has to be defined. + properties: + id: + description: ID of the responder. + type: string + name: + description: Name of the responder. + type: string + type: + description: Type of responder. + enum: + - team + - teams + - user + - escalation + - schedule + minLength: 1 + type: string + username: + description: Username of the responder. + type: string + required: + - type + type: object + type: array + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + source: + description: Backlink to the sender of the notification. + type: string + tags: + description: Comma separated list of tags attached to + the notifications. + type: string + updateAlerts: + description: Whether to update message and description + of the alert in OpsGenie if it already exists By default, + the alert is never updated in OpsGenie, the new message + only appears in activity log. + type: boolean + type: object + type: array + pagerdutyConfigs: + description: List of PagerDuty configurations. + items: + description: PagerDutyConfig configures notifications via + PagerDuty. See https://prometheus.io/docs/alerting/latest/configuration/#pagerduty_config + properties: + class: + description: The class/type of the event. + type: string + client: + description: Client identification. + type: string + clientURL: + description: Backlink to the sender of notification. + type: string + component: + description: The part or component of the affected system + that is broken. + type: string + description: + description: Description of the incident. + type: string + details: + description: Arbitrary key/value pairs that provide further + detail about the incident. + items: + description: KeyValue defines a (key, value) tuple. + properties: + key: + description: Key of the tuple. + minLength: 1 + type: string + value: + description: Value of the tuple. + type: string + required: + - key + - value + type: object + type: array + group: + description: A cluster or grouping of sources. + type: string + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + pagerDutyImageConfigs: + description: A list of image details to attach that provide + further detail about an incident. + items: + description: PagerDutyImageConfig attaches images to + an incident + properties: + alt: + description: Alt is the optional alternative text + for the image. + type: string + href: + description: Optional URL; makes the image a clickable + link. + type: string + src: + description: Src of the image being attached to + the incident + type: string + type: object + type: array + pagerDutyLinkConfigs: + description: A list of link details to attach that provide + further detail about an incident. + items: + description: PagerDutyLinkConfig attaches text links + to an incident + properties: + alt: + description: Text that describes the purpose of + the link, and can be used as the link's text. + type: string + href: + description: Href is the URL of the link to be attached + type: string + type: object + type: array + routingKey: + description: The secret's key that contains the PagerDuty + integration key (when using Events API v2). Either this + field or `serviceKey` needs to be defined. The secret + needs to be in the same namespace as the AlertmanagerConfig + object and accessible by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + serviceKey: + description: The secret's key that contains the PagerDuty + service key (when using integration type "Prometheus"). + Either this field or `routingKey` needs to be defined. + The secret needs to be in the same namespace as the + AlertmanagerConfig object and accessible by the Prometheus + Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + severity: + description: Severity of the incident. + type: string + url: + description: The URL to send requests to. + type: string + type: object + type: array + pushoverConfigs: + description: List of Pushover configurations. + items: + description: PushoverConfig configures notifications via Pushover. + See https://prometheus.io/docs/alerting/latest/configuration/#pushover_config + properties: + expire: + description: How long your notification will continue + to be retried for, unless the user acknowledges the + notification. + pattern: ^(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?$ + type: string + html: + description: Whether notification message is HTML or plain + text. + type: boolean + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: Notification message. + type: string + priority: + description: Priority, see https://pushover.net/api#priority + type: string + retry: + description: How often the Pushover servers will send + the same notification to the user. Must be at least + 30 seconds. + pattern: ^(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?$ + type: string + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + sound: + description: The name of one of the sounds supported by + device clients to override the user's default sound + choice + type: string + title: + description: Notification title. + type: string + token: + description: The secret's key that contains the registered + application's API token, see https://pushover.net/apps. + The secret needs to be in the same namespace as the + AlertmanagerConfig object and accessible by the Prometheus + Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + url: + description: A supplementary URL shown alongside the message. + type: string + urlTitle: + description: A title for supplementary URL, otherwise + just the URL is shown + type: string + userKey: + description: The secret's key that contains the recipient + user's user key. The secret needs to be in the same + namespace as the AlertmanagerConfig object and accessible + by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + type: object + type: array + slackConfigs: + description: List of Slack configurations. + items: + description: SlackConfig configures notifications via Slack. + See https://prometheus.io/docs/alerting/latest/configuration/#slack_config + properties: + actions: + description: A list of Slack actions that are sent with + each notification. + items: + description: SlackAction configures a single Slack action + that is sent with each notification. See https://api.slack.com/docs/message-attachments#action_fields + and https://api.slack.com/docs/message-buttons for + more information. + properties: + confirm: + description: SlackConfirmationField protect users + from destructive actions or particularly distinguished + decisions by asking them to confirm their button + click one more time. See https://api.slack.com/docs/interactive-message-field-guide#confirmation_fields + for more information. + properties: + dismissText: + type: string + okText: + type: string + text: + minLength: 1 + type: string + title: + type: string + required: + - text + type: object + name: + type: string + style: + type: string + text: + minLength: 1 + type: string + type: + minLength: 1 + type: string + url: + type: string + value: + type: string + required: + - text + - type + type: object + type: array + apiURL: + description: The secret's key that contains the Slack + webhook URL. The secret needs to be in the same namespace + as the AlertmanagerConfig object and accessible by the + Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + callbackId: + type: string + channel: + description: The channel or user to send notifications + to. + type: string + color: + type: string + fallback: + type: string + fields: + description: A list of Slack fields that are sent with + each notification. + items: + description: SlackField configures a single Slack field + that is sent with each notification. Each field must + contain a title, value, and optionally, a boolean + value to indicate if the field is short enough to + be displayed next to other fields designated as short. + See https://api.slack.com/docs/message-attachments#fields + for more information. + properties: + short: + type: boolean + title: + minLength: 1 + type: string + value: + minLength: 1 + type: string + required: + - title + - value + type: object + type: array + footer: + type: string + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + iconEmoji: + type: string + iconURL: + type: string + imageURL: + type: string + linkNames: + type: boolean + mrkdwnIn: + items: + type: string + type: array + pretext: + type: string + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + shortFields: + type: boolean + text: + type: string + thumbURL: + type: string + title: + type: string + titleLink: + type: string + username: + type: string + type: object + type: array + snsConfigs: + description: List of SNS configurations + items: + description: SNSConfig configures notifications via AWS SNS. + See https://prometheus.io/docs/alerting/latest/configuration/#sns_configs + properties: + apiURL: + description: The SNS API URL i.e. https://sns.us-east-2.amazonaws.com. + If not specified, the SNS API URL from the SNS SDK will + be used. + type: string + attributes: + additionalProperties: + type: string + description: SNS message attributes. + type: object + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: The message content of the SNS notification. + type: string + phoneNumber: + description: Phone number if message is delivered via + SMS in E.164 format. If you don't specify this value, + you must specify a value for the TopicARN or TargetARN. + type: string + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + sigv4: + description: Configures AWS's Signature Verification 4 + signing process to sign requests. + properties: + accessKey: + description: AccessKey is the AWS API key. If blank, + the environment variable `AWS_ACCESS_KEY_ID` is + used. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + profile: + description: Profile is the named AWS profile used + to authenticate. + type: string + region: + description: Region is the AWS region. If blank, the + region from the default credentials chain used. + type: string + roleArn: + description: RoleArn is the named AWS profile used + to authenticate. + type: string + secretKey: + description: SecretKey is the AWS API secret. If blank, + the environment variable `AWS_SECRET_ACCESS_KEY` + is used. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + subject: + description: Subject line when the message is delivered + to email endpoints. + type: string + targetARN: + description: The mobile platform endpoint ARN if message + is delivered via mobile notifications. If you don't + specify this value, you must specify a value for the + topic_arn or PhoneNumber. + type: string + topicARN: + description: SNS topic ARN, i.e. arn:aws:sns:us-east-2:698519295917:My-Topic + If you don't specify this value, you must specify a + value for the PhoneNumber or TargetARN. + type: string + type: object + type: array + telegramConfigs: + description: List of Telegram configurations. + items: + description: TelegramConfig configures notifications via Telegram. + See https://prometheus.io/docs/alerting/latest/configuration/#telegram_config + properties: + apiURL: + description: The Telegram API URL i.e. https://api.telegram.org. + If not specified, default API URL will be used. + type: string + botToken: + description: Telegram bot token The secret needs to be + in the same namespace as the AlertmanagerConfig object + and accessible by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + chatID: + description: The Telegram chat ID. + format: int64 + type: integer + disableNotifications: + description: Disable telegram notifications + type: boolean + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: Message template + type: string + parseMode: + description: Parse mode for telegram message + enum: + - MarkdownV2 + - Markdown + - HTML + type: string + sendResolved: + description: Whether to notify about resolved alerts. + type: boolean + type: object + type: array + victoropsConfigs: + description: List of VictorOps configurations. + items: + description: VictorOpsConfig configures notifications via + VictorOps. See https://prometheus.io/docs/alerting/latest/configuration/#victorops_config + properties: + apiKey: + description: The secret's key that contains the API key + to use when talking to the VictorOps API. The secret + needs to be in the same namespace as the AlertmanagerConfig + object and accessible by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + apiUrl: + description: The VictorOps API URL. + type: string + customFields: + description: Additional custom fields for notification. + items: + description: KeyValue defines a (key, value) tuple. + properties: + key: + description: Key of the tuple. + minLength: 1 + type: string + value: + description: Value of the tuple. + type: string + required: + - key + - value + type: object + type: array + entityDisplayName: + description: Contains summary of the alerted problem. + type: string + httpConfig: + description: The HTTP client's configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + messageType: + description: Describes the behavior of the alert (CRITICAL, + WARNING, INFO). + type: string + monitoringTool: + description: The monitoring tool the state message is + from. + type: string + routingKey: + description: A key used to map the alert to a team. + type: string + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + stateMessage: + description: Contains long explanation of the alerted + problem. + type: string + type: object + type: array + webhookConfigs: + description: List of webhook configurations. + items: + description: WebhookConfig configures notifications via a + generic receiver supporting the webhook payload. See https://prometheus.io/docs/alerting/latest/configuration/#webhook_config + properties: + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + maxAlerts: + description: Maximum number of alerts to be sent per webhook + message. When 0, all alerts are included. + format: int32 + minimum: 0 + type: integer + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + url: + description: The URL to send HTTP POST requests to. `urlSecret` + takes precedence over `url`. One of `urlSecret` and + `url` should be defined. + type: string + urlSecret: + description: The secret's key that contains the webhook + URL to send HTTP requests to. `urlSecret` takes precedence + over `url`. One of `urlSecret` and `url` should be defined. + The secret needs to be in the same namespace as the + AlertmanagerConfig object and accessible by the Prometheus + Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + type: object + type: array + wechatConfigs: + description: List of WeChat configurations. + items: + description: WeChatConfig configures notifications via WeChat. + See https://prometheus.io/docs/alerting/latest/configuration/#wechat_config + properties: + agentID: + type: string + apiSecret: + description: The secret's key that contains the WeChat + API key. The secret needs to be in the same namespace + as the AlertmanagerConfig object and accessible by the + Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + apiURL: + description: The WeChat API URL. + type: string + corpID: + description: The corp id for authentication. + type: string + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for + the client. This is mutually exclusive with BasicAuth + and is only available starting from Alertmanager + v0.22+. + properties: + credentials: + description: The secret's key that contains the + credentials of the request + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, + BasicAuth takes precedence. + properties: + password: + description: The secret in the service monitor + namespace that contains the password for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor + namespace that contains the username for authentication. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. + The secret needs to be in the same namespace as + the AlertmanagerConfig object and accessible by + the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + followRedirects: + description: FollowRedirects specifies whether the + client should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch + a token for the targets. + properties: + clientId: + description: The secret or configmap containing + the OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 + client secret + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token + URL + type: object + scopes: + description: OAuth2 scopes used for the token + request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when + doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to + use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use + for the targets. + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: 'Name of the referent. More + info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key + file for the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the + targets. + type: string + type: object + type: object + message: + description: API request data as defined by the WeChat + API. + type: string + messageType: + type: string + sendResolved: + description: Whether or not to notify about resolved alerts. + type: boolean + toParty: + type: string + toTag: + type: string + toUser: + type: string + type: object + type: array + required: + - name + type: object + type: array + route: + description: The Alertmanager route definition for alerts matching + the resource's namespace. If present, it will be added to the generated + Alertmanager configuration as a first-level route. + properties: + activeTimeIntervals: + description: ActiveTimeIntervals is a list of MuteTimeInterval + names when this route should be active. + items: + type: string + type: array + continue: + description: Boolean indicating whether an alert should continue + matching subsequent sibling nodes. It will always be overridden + to true for the first-level route by the Prometheus operator. + type: boolean + groupBy: + description: List of labels to group by. Labels must not be repeated + (unique list). Special label "..." (aggregate by all possible + labels), if provided, must be the only element in the list. + items: + type: string + type: array + groupInterval: + description: 'How long to wait before sending an updated notification. + Must match the regular expression`^(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?$` + Example: "5m"' + type: string + groupWait: + description: 'How long to wait before sending the initial notification. + Must match the regular expression`^(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?$` + Example: "30s"' + type: string + matchers: + description: 'List of matchers that the alert''s labels should + match. For the first level route, the operator removes any existing + equality and regexp matcher on the `namespace` label and adds + a `namespace: ` matcher.' + items: + description: Matcher defines how to match on alert's labels. + properties: + matchType: + description: Match operation available with AlertManager + >= v0.22.0 and takes precedence over Regex (deprecated) + if non-empty. + enum: + - '!=' + - = + - =~ + - '!~' + type: string + name: + description: Label to match. + minLength: 1 + type: string + regex: + description: Whether to match on equality (false) or regular-expression + (true). Deprecated as of AlertManager >= v0.22.0 where + a user should use MatchType instead. + type: boolean + value: + description: Label value to match. + type: string + required: + - name + type: object + type: array + muteTimeIntervals: + description: 'Note: this comment applies to the field definition + above but appears below otherwise it gets included in the generated + manifest. CRD schema doesn''t support self-referential types + for now (see https://github.com/kubernetes/kubernetes/issues/62872). + We have to use an alternative type to circumvent the limitation. + The downside is that the Kube API can''t validate the data beyond + the fact that it is a valid JSON representation. MuteTimeIntervals + is a list of MuteTimeInterval names that will mute this route + when matched,' + items: + type: string + type: array + receiver: + description: Name of the receiver for this route. If not empty, + it should be listed in the `receivers` field. + type: string + repeatInterval: + description: 'How long to wait before repeating the last notification. + Must match the regular expression`^(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?$` + Example: "4h"' + type: string + routes: + description: Child routes. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + type: object + required: + - spec + type: object + served: true + storage: true diff --git a/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-alertmanagers.yaml b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-alertmanagers.yaml new file mode 100644 index 000000000..0701ccccf --- /dev/null +++ b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-alertmanagers.yaml @@ -0,0 +1,7112 @@ +# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.63.0/example/prometheus-operator-crd/monitoring.coreos.com_alertmanagers.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.1 + creationTimestamp: null + name: alertmanagers.monitoring.coreos.com +spec: + group: monitoring.coreos.com + names: + categories: + - prometheus-operator + kind: Alertmanager + listKind: AlertmanagerList + plural: alertmanagers + shortNames: + - am + singular: alertmanager + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: The version of Alertmanager + jsonPath: .spec.version + name: Version + type: string + - description: The number of desired replicas + jsonPath: .spec.replicas + name: Replicas + type: integer + - description: The number of ready replicas + jsonPath: .status.availableReplicas + name: Ready + type: integer + - jsonPath: .status.conditions[?(@.type == 'Reconciled')].status + name: Reconciled + type: string + - jsonPath: .status.conditions[?(@.type == 'Available')].status + name: Available + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Whether the resource reconciliation is paused or not + jsonPath: .status.paused + name: Paused + priority: 1 + type: boolean + name: v1 + schema: + openAPIV3Schema: + description: Alertmanager describes an Alertmanager cluster. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: 'Specification of the desired behavior of the Alertmanager + cluster. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + properties: + additionalPeers: + description: AdditionalPeers allows injecting a set of additional + Alertmanagers to peer with to form a highly available cluster. + items: + type: string + type: array + affinity: + description: If specified, the pod's scheduling constraints. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the + pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node matches + the corresponding matchExpressions; the node(s) with the + highest sum are the most preferred. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not be + scheduled onto the node. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to an update), the system may or may not try to + eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: A null or empty node selector term matches + no objects. The requirements of them are ANDed. The + TopologySelectorTerm type implements a subset of the + NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate + this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node has + pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces field. + null selector and null or empty namespaces list + means "this pod's namespace". An empty selector + ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. The + term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces list + and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey + matches that of any node on which any of the selected + pods is running. Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not be + scheduled onto the node. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to a pod label update), the system may or may + not try to eventually evict the pod from its node. When + there are multiple elements, the lists of nodes corresponding + to each podAffinityTerm are intersected, i.e. all terms + must be satisfied. + items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not co-located + (anti-affinity) with, where co-located is defined as running + on a node whose value of the label with key + matches that of any node on which a pod of the set of + pods is running + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to the + union of the namespaces selected by this field and + the ones listed in the namespaces field. null selector + and null or empty namespaces list means "this pod's + namespace". An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list of namespace + names that the term applies to. The term is applied + to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. null or + empty namespaces list and null namespaceSelector means + "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where + co-located is defined as running on a node whose value + of the label with key topologyKey matches that of + any node on which any of the selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. + avoid putting this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the anti-affinity expressions specified + by this field, but it may choose a node that violates one + or more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node has + pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces field. + null selector and null or empty namespaces list + means "this pod's namespace". An empty selector + ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. The + term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces list + and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey + matches that of any node on which any of the selected + pods is running. Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by + this field are not met at scheduling time, the pod will + not be scheduled onto the node. If the anti-affinity requirements + specified by this field cease to be met at some point during + pod execution (e.g. due to a pod label update), the system + may or may not try to eventually evict the pod from its + node. When there are multiple elements, the lists of nodes + corresponding to each podAffinityTerm are intersected, i.e. + all terms must be satisfied. + items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not co-located + (anti-affinity) with, where co-located is defined as running + on a node whose value of the label with key + matches that of any node on which a pod of the set of + pods is running + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to the + union of the namespaces selected by this field and + the ones listed in the namespaces field. null selector + and null or empty namespaces list means "this pod's + namespace". An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list of namespace + names that the term applies to. The term is applied + to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. null or + empty namespaces list and null namespaceSelector means + "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where + co-located is defined as running on a node whose value + of the label with key topologyKey matches that of + any node on which any of the selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + alertmanagerConfigMatcherStrategy: + description: The AlertmanagerConfigMatcherStrategy defines how AlertmanagerConfig + objects match the alerts. In the future more options may be added. + properties: + type: + default: OnNamespace + description: If set to `OnNamespace`, the operator injects a label + matcher matching the namespace of the AlertmanagerConfig object + for all its routes and inhibition rules. `None` will not add + any additional matchers other than the ones specified in the + AlertmanagerConfig. Default is `OnNamespace`. + enum: + - OnNamespace + - None + type: string + type: object + alertmanagerConfigNamespaceSelector: + description: Namespaces to be selected for AlertmanagerConfig discovery. + If nil, only check own namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: A label selector requirement is a selector that + contains values, a key, and an operator that relates the key + and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: operator represents a key's relationship to + a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + alertmanagerConfigSelector: + description: AlertmanagerConfigs to be selected for to merge and configure + Alertmanager with. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: A label selector requirement is a selector that + contains values, a key, and an operator that relates the key + and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: operator represents a key's relationship to + a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + alertmanagerConfiguration: + description: 'EXPERIMENTAL: alertmanagerConfiguration specifies the + configuration of Alertmanager. If defined, it takes precedence over + the `configSecret` field. This field may change in future releases.' + properties: + global: + description: Defines the global parameters of the Alertmanager + configuration. + properties: + httpConfig: + description: HTTP client configuration. + properties: + authorization: + description: Authorization header configuration for the + client. This is mutually exclusive with BasicAuth and + is only available starting from Alertmanager v0.22+. + properties: + credentials: + description: The secret's key that contains the credentials + of the request + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults + to Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth for the client. This is mutually + exclusive with Authorization. If both are defined, BasicAuth + takes precedence. + properties: + password: + description: The secret in the service monitor namespace + that contains the password for authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor namespace + that contains the username for authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: The secret's key that contains the bearer + token to be used by the client for authentication. The + secret needs to be in the same namespace as the Alertmanager + object and accessible by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + followRedirects: + description: FollowRedirects specifies whether the client + should follow HTTP 3xx redirects. + type: boolean + oauth2: + description: OAuth2 client credentials used to fetch a + token for the targets. + properties: + clientId: + description: The secret or configmap containing the + OAuth2 client id + properties: + configMap: + description: ConfigMap containing data to use + for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for + the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 client + secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + proxyURL: + description: Optional proxy URL. + type: string + tlsConfig: + description: TLS configuration for the client. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to use + for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for + the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when doing + client-authentication. + properties: + configMap: + description: ConfigMap containing data to use + for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for + the targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key file + for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + type: object + resolveTimeout: + description: ResolveTimeout is the default value used by alertmanager + if the alert does not include EndsAt, after this time passes + it can declare the alert as resolved if it has not been + updated. This has no impact on alerts from Prometheus, as + they always include EndsAt. + pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + type: object + name: + description: The name of the AlertmanagerConfig resource which + is used to generate the Alertmanager configuration. It must + be defined in the same namespace as the Alertmanager object. + The operator will not enforce a `namespace` label for routes + and inhibition rules. + minLength: 1 + type: string + templates: + description: Custom notification templates. + items: + description: SecretOrConfigMap allows to specify data as a Secret + or ConfigMap. Fields are mutually exclusive. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + type: array + type: object + baseImage: + description: 'Base image that is used to deploy pods, without tag. + Deprecated: use ''image'' instead' + type: string + clusterAdvertiseAddress: + description: 'ClusterAdvertiseAddress is the explicit address to advertise + in cluster. Needs to be provided for non RFC1918 [1] (public) addresses. + [1] RFC1918: https://tools.ietf.org/html/rfc1918' + type: string + clusterGossipInterval: + description: Interval between gossip attempts. + pattern: ^(0|(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + clusterPeerTimeout: + description: Timeout for cluster peering. + pattern: ^(0|(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + clusterPushpullInterval: + description: Interval between pushpull attempts. + pattern: ^(0|(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + configMaps: + description: ConfigMaps is a list of ConfigMaps in the same namespace + as the Alertmanager object, which shall be mounted into the Alertmanager + Pods. Each ConfigMap is added to the StatefulSet definition as a + volume named `configmap-`. The ConfigMaps are mounted + into `/etc/alertmanager/configmaps/` in the 'alertmanager' + container. + items: + type: string + type: array + configSecret: + description: "ConfigSecret is the name of a Kubernetes Secret in the + same namespace as the Alertmanager object, which contains the configuration + for this Alertmanager instance. If empty, it defaults to `alertmanager-`. + \n The Alertmanager configuration should be available under the + `alertmanager.yaml` key. Additional keys from the original secret + are copied to the generated secret and mounted into the `/etc/alertmanager/config` + directory in the `alertmanager` container. \n If either the secret + or the `alertmanager.yaml` key is missing, the operator provisions + a minimal Alertmanager configuration with one empty receiver (effectively + dropping alert notifications)." + type: string + containers: + description: 'Containers allows injecting additional containers. This + is meant to allow adding an authentication proxy to an Alertmanager + pod. Containers described here modify an operator generated container + if they share the same name and modifications are done via a strategic + merge patch. The current container names are: `alertmanager` and + `config-reloader`. Overriding containers is entirely outside the + scope of what the maintainers will support and by doing so, you + accept that this behaviour may break at any time without notice.' + items: + description: A single application container that you want to run + within a pod. + properties: + args: + description: 'Arguments to the entrypoint. The container image''s + CMD is used if this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If a variable + cannot be resolved, the reference in the input string will + be unchanged. Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + items: + type: string + type: array + command: + description: 'Entrypoint array. Not executed within a shell. + The container image''s ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: + i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether + the variable exists or not. Cannot be updated. More info: + https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + items: + type: string + type: array + env: + description: List of environment variables to set in the container. + Cannot be updated. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be + a C_IDENTIFIER. + type: string + value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in + the container and any service environment variables. + If a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Defaults to "".' + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must be + a C_IDENTIFIER. All invalid keys will be reported as an event + when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take + precedence. Values defined by an Env with a duplicate key + will take precedence. Cannot be updated. + items: + description: EnvFromSource represents the source of a set + of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management + to default or override container images in workload controllers + like Deployments and StatefulSets.' + type: string + imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' + type: string + lifecycle: + description: Actions that the management system should take + in response to container lifecycle events. Cannot be updated. + properties: + postStart: + description: 'PostStart is called immediately after a container + is created. If the handler fails, the container is terminated + and restarted according to its restart policy. Other management + of the container blocks until the hook completes. More + info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's + filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you need + to explicitly call out to that shell. Exit status + of 0 is treated as live/healthy and non-zero is + unhealthy. + items: + type: string + type: array + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in + httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. + type: string + required: + - port + type: object + tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward compatibility. + There are no validation of this field and lifecycle + hooks will fail in runtime when tcp handler is specified. + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, resource + contention, etc. The handler is not called if the container + crashes or exits. The Pod''s termination grace period + countdown begins before the PreStop hook is executed. + Regardless of the outcome of the handler, the container + will eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other management + of the container blocks until the hook completes or until + the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's + filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you need + to explicitly call out to that shell. Exit status + of 0 is treated as live/healthy and non-zero is + unhealthy. + items: + type: string + type: array + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in + httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. + type: string + required: + - port + type: object + tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward compatibility. + There are no validation of this field and lifecycle + hooks will fail in runtime when tcp handler is specified. + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. More + info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: List of ports to expose from the container. Not + specifying a port here DOES NOT prevent that port from being + exposed. Any port which is listening on the default "0.0.0.0" + address inside a container will be accessible from the network. + Modifying this array with strategic merge patch may corrupt + the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + items: + description: ContainerPort represents a network port in a + single container. + properties: + containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < 65536. + format: int32 + type: integer + hostIP: + description: What host IP to bind the external port to. + type: string + hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x < + 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. + format: int32 + type: integer + name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. + type: string + protocol: + default: TCP + description: Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe + fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + securityContext: + description: 'SecurityContext defines the security options the + container should be run with. If set, the fields of SecurityContext + override the equivalent fields of PodSecurityContext. More + info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' + properties: + allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag will + be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be set + when spec.os.name is windows.' + type: boolean + capabilities: + description: The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by + the container runtime. Note that this field cannot be + set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent to + root on the host. Defaults to false. Note that this field + cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: procMount denotes the type of proc mount to + use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: Indicates that the container must run as a + non-root user. If true, the Kubelet will validate the + image at runtime to ensure that it does not run as UID + 0 (root) and fail to start the container if it does. If + unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both + SecurityContext and PodSecurityContext, the value specified + in SecurityContext takes precedence. + type: boolean + runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a + random SELinux context for each container. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name is + windows. + properties: + localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile + must be preconfigured on the node to work. Must be + a descending path, relative to the kubelet's configured + seccomp profile location. Must only be set if type + is "Localhost". + type: string + type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - + a profile defined in a file on the node should be + used. RuntimeDefault - the container runtime default + profile should be used. Unconfined - no profile should + be applied." + type: string + required: + - type + type: object + windowsOptions: + description: The Windows specific settings applied to all + containers. If unspecified, the options from the PodSecurityContext + will be used. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is + linux. + properties: + gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named + by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is + alpha-level and will only be honored by components + that enable the WindowsHostProcessContainers feature + flag. Setting this field without the feature flag + will result in errors when validating the Pod. All + of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. + type: boolean + runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. + type: string + type: object + type: object + startupProbe: + description: 'StartupProbe indicates that the Pod has successfully + initialized. If specified, no other probes are executed until + this completes successfully. If this probe fails, the Pod + will be restarted, just as if the livenessProbe failed. This + can be used to provide different probe parameters at the beginning + of a Pod''s lifecycle, when it might take a long time to load + data or warm a cache, than during steady-state operation. + This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, reads + from stdin in the container will always result in EOF. Default + is false. + type: boolean + stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If this + flag is false, a container processes that reads from stdin + will never receive an EOF. Default is false + type: boolean + terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' + type: string + terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success and + failure. FallbackToLogsOnError will use the last chunk of + container log output if the termination message file is empty + and the container exited with an error. The log output is + limited to 2048 bytes or 80 lines, whichever is smaller. Defaults + to File. Cannot be updated. + type: string + tty: + description: Whether this container should allocate a TTY for + itself, also requires 'stdin' to be true. Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices to be + used by the container. + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Cannot be updated. + items: + description: VolumeMount describes a mounting of a Volume + within a container. + properties: + mountPath: + description: Path within the container at which the volume + should be mounted. Must not contain ':'. + type: string + mountPropagation: + description: mountPropagation determines how mounts are + propagated from the host to container and the other + way around. When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. + type: boolean + subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's root). + type: string + subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves similarly + to SubPath but environment variable references $(VAR_NAME) + are expanded using the container's environment. Defaults + to "" (volume's root). SubPathExpr and SubPath are mutually + exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. + type: string + required: + - name + type: object + type: array + externalUrl: + description: The external URL the Alertmanager instances will be available + under. This is necessary to generate correct URLs. This is necessary + if Alertmanager is not served from root of a DNS name. + type: string + forceEnableClusterMode: + description: ForceEnableClusterMode ensures Alertmanager does not + deactivate the cluster mode when running with a single replica. + Use case is e.g. spanning an Alertmanager cluster across Kubernetes + clusters with a single replica in each. + type: boolean + hostAliases: + description: Pods' hostAliases configuration + items: + description: HostAlias holds the mapping between IP and hostnames + that will be injected as an entry in the pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + ip: + description: IP address of the host file entry. + type: string + required: + - hostnames + - ip + type: object + type: array + x-kubernetes-list-map-keys: + - ip + x-kubernetes-list-type: map + image: + description: Image if specified has precedence over baseImage, tag + and sha combinations. Specifying the version is still necessary + to ensure the Prometheus Operator knows what version of Alertmanager + is being configured. + type: string + imagePullPolicy: + description: Image pull policy for the 'alertmanager', 'init-config-reloader' + and 'config-reloader' containers. See https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy + for more details. + enum: + - "" + - Always + - Never + - IfNotPresent + type: string + imagePullSecrets: + description: An optional list of references to secrets in the same + namespace to use for pulling prometheus and alertmanager images + from registries see http://kubernetes.io/docs/user-guide/images#specifying-imagepullsecrets-on-a-pod + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: 'InitContainers allows adding initContainers to the pod + definition. Those can be used to e.g. fetch secrets for injection + into the Alertmanager configuration from external sources. Any errors + during the execution of an initContainer will lead to a restart + of the Pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + Using initContainers for any use case other then secret fetching + is entirely outside the scope of what the maintainers will support + and by doing so, you accept that this behaviour may break at any + time without notice.' + items: + description: A single application container that you want to run + within a pod. + properties: + args: + description: 'Arguments to the entrypoint. The container image''s + CMD is used if this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If a variable + cannot be resolved, the reference in the input string will + be unchanged. Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + items: + type: string + type: array + command: + description: 'Entrypoint array. Not executed within a shell. + The container image''s ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: + i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether + the variable exists or not. Cannot be updated. More info: + https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + items: + type: string + type: array + env: + description: List of environment variables to set in the container. + Cannot be updated. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be + a C_IDENTIFIER. + type: string + value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in + the container and any service environment variables. + If a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Defaults to "".' + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must be + a C_IDENTIFIER. All invalid keys will be reported as an event + when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take + precedence. Values defined by an Env with a duplicate key + will take precedence. Cannot be updated. + items: + description: EnvFromSource represents the source of a set + of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management + to default or override container images in workload controllers + like Deployments and StatefulSets.' + type: string + imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' + type: string + lifecycle: + description: Actions that the management system should take + in response to container lifecycle events. Cannot be updated. + properties: + postStart: + description: 'PostStart is called immediately after a container + is created. If the handler fails, the container is terminated + and restarted according to its restart policy. Other management + of the container blocks until the hook completes. More + info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's + filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you need + to explicitly call out to that shell. Exit status + of 0 is treated as live/healthy and non-zero is + unhealthy. + items: + type: string + type: array + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in + httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. + type: string + required: + - port + type: object + tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward compatibility. + There are no validation of this field and lifecycle + hooks will fail in runtime when tcp handler is specified. + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, resource + contention, etc. The handler is not called if the container + crashes or exits. The Pod''s termination grace period + countdown begins before the PreStop hook is executed. + Regardless of the outcome of the handler, the container + will eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other management + of the container blocks until the hook completes or until + the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's + filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you need + to explicitly call out to that shell. Exit status + of 0 is treated as live/healthy and non-zero is + unhealthy. + items: + type: string + type: array + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in + httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. + type: string + required: + - port + type: object + tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward compatibility. + There are no validation of this field and lifecycle + hooks will fail in runtime when tcp handler is specified. + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. More + info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: List of ports to expose from the container. Not + specifying a port here DOES NOT prevent that port from being + exposed. Any port which is listening on the default "0.0.0.0" + address inside a container will be accessible from the network. + Modifying this array with strategic merge patch may corrupt + the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + items: + description: ContainerPort represents a network port in a + single container. + properties: + containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < 65536. + format: int32 + type: integer + hostIP: + description: What host IP to bind the external port to. + type: string + hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x < + 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. + format: int32 + type: integer + name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. + type: string + protocol: + default: TCP + description: Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe + fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + securityContext: + description: 'SecurityContext defines the security options the + container should be run with. If set, the fields of SecurityContext + override the equivalent fields of PodSecurityContext. More + info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' + properties: + allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag will + be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be set + when spec.os.name is windows.' + type: boolean + capabilities: + description: The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by + the container runtime. Note that this field cannot be + set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent to + root on the host. Defaults to false. Note that this field + cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: procMount denotes the type of proc mount to + use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: Indicates that the container must run as a + non-root user. If true, the Kubelet will validate the + image at runtime to ensure that it does not run as UID + 0 (root) and fail to start the container if it does. If + unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both + SecurityContext and PodSecurityContext, the value specified + in SecurityContext takes precedence. + type: boolean + runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a + random SELinux context for each container. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name is + windows. + properties: + localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile + must be preconfigured on the node to work. Must be + a descending path, relative to the kubelet's configured + seccomp profile location. Must only be set if type + is "Localhost". + type: string + type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - + a profile defined in a file on the node should be + used. RuntimeDefault - the container runtime default + profile should be used. Unconfined - no profile should + be applied." + type: string + required: + - type + type: object + windowsOptions: + description: The Windows specific settings applied to all + containers. If unspecified, the options from the PodSecurityContext + will be used. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is + linux. + properties: + gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named + by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is + alpha-level and will only be honored by components + that enable the WindowsHostProcessContainers feature + flag. Setting this field without the feature flag + will result in errors when validating the Pod. All + of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. + type: boolean + runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. + type: string + type: object + type: object + startupProbe: + description: 'StartupProbe indicates that the Pod has successfully + initialized. If specified, no other probes are executed until + this completes successfully. If this probe fails, the Pod + will be restarted, just as if the livenessProbe failed. This + can be used to provide different probe parameters at the beginning + of a Pod''s lifecycle, when it might take a long time to load + data or warm a cache, than during steady-state operation. + This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, reads + from stdin in the container will always result in EOF. Default + is false. + type: boolean + stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If this + flag is false, a container processes that reads from stdin + will never receive an EOF. Default is false + type: boolean + terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' + type: string + terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success and + failure. FallbackToLogsOnError will use the last chunk of + container log output if the termination message file is empty + and the container exited with an error. The log output is + limited to 2048 bytes or 80 lines, whichever is smaller. Defaults + to File. Cannot be updated. + type: string + tty: + description: Whether this container should allocate a TTY for + itself, also requires 'stdin' to be true. Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices to be + used by the container. + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Cannot be updated. + items: + description: VolumeMount describes a mounting of a Volume + within a container. + properties: + mountPath: + description: Path within the container at which the volume + should be mounted. Must not contain ':'. + type: string + mountPropagation: + description: mountPropagation determines how mounts are + propagated from the host to container and the other + way around. When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. + type: boolean + subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's root). + type: string + subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves similarly + to SubPath but environment variable references $(VAR_NAME) + are expanded using the container's environment. Defaults + to "" (volume's root). SubPathExpr and SubPath are mutually + exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. + type: string + required: + - name + type: object + type: array + listenLocal: + description: ListenLocal makes the Alertmanager server listen on loopback, + so that it does not bind against the Pod IP. Note this is only for + the Alertmanager UI, not the gossip communication. + type: boolean + logFormat: + description: Log format for Alertmanager to be configured with. + enum: + - "" + - logfmt + - json + type: string + logLevel: + description: Log level for Alertmanager to be configured with. + enum: + - "" + - debug + - info + - warn + - error + type: string + minReadySeconds: + description: Minimum number of seconds for which a newly created pod + should be ready without any of its container crashing for it to + be considered available. Defaults to 0 (pod will be considered available + as soon as it is ready) This is an alpha field from kubernetes 1.22 + until 1.24 which requires enabling the StatefulSetMinReadySeconds + feature gate. + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: Define which Nodes the Pods are scheduled on. + type: object + paused: + description: If set to true all actions on the underlying managed + objects are not goint to be performed, except for delete actions. + type: boolean + podMetadata: + description: PodMetadata configures Labels and Annotations which are + propagated to the alertmanager pods. + properties: + annotations: + additionalProperties: + type: string + description: 'Annotations is an unstructured key value map stored + with a resource that may be set by external tools to store and + retrieve arbitrary metadata. They are not queryable and should + be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations' + type: object + labels: + additionalProperties: + type: string + description: 'Map of string keys and values that can be used to + organize and categorize (scope and select) objects. May match + selectors of replication controllers and services. More info: + http://kubernetes.io/docs/user-guide/labels' + type: object + name: + description: 'Name must be unique within a namespace. Is required + when creating resources, although some resources may allow a + client to request the generation of an appropriate name automatically. + Name is primarily intended for creation idempotence and configuration + definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + type: object + portName: + description: Port name used for the pods and governing service. This + defaults to web + type: string + priorityClassName: + description: Priority class assigned to the Pods + type: string + replicas: + description: Size is the expected size of the alertmanager cluster. + The controller will eventually make the size of the running cluster + equal to the expected size. + format: int32 + type: integer + resources: + description: Define resources requests and limits for single Pods. + properties: + claims: + description: "Claims lists the names of resources, defined in + spec.resourceClaims, that are used by this container. \n This + is an alpha field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry in pod.spec.resourceClaims + of the Pod where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute resources + allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + retention: + default: 120h + description: Time duration Alertmanager shall retain data for. Default + is '120h', and must match the regular expression `[0-9]+(ms|s|m|h)` + (milliseconds seconds minutes hours). + pattern: ^(0|(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + routePrefix: + description: The route prefix Alertmanager registers HTTP handlers + for. This is useful, if using ExternalURL and a proxy is rewriting + HTTP routes of a request, and the actual ExternalURL is still true, + but the server serves requests under a different route prefix. For + example for use with `kubectl proxy`. + type: string + secrets: + description: Secrets is a list of Secrets in the same namespace as + the Alertmanager object, which shall be mounted into the Alertmanager + Pods. Each Secret is added to the StatefulSet definition as a volume + named `secret-`. The Secrets are mounted into `/etc/alertmanager/secrets/` + in the 'alertmanager' container. + items: + type: string + type: array + securityContext: + description: SecurityContext holds pod-level security attributes and + common container settings. This defaults to the default PodSecurityContext. + properties: + fsGroup: + description: "A special supplemental group that applies to all + containers in a pod. Some volume types allow the Kubelet to + change the ownership of that volume to be owned by the pod: + \n 1. The owning GID will be the FSGroup 2. The setgid bit is + set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- \n If unset, + the Kubelet will not modify the ownership and permissions of + any volume. Note that this field cannot be set when spec.os.name + is windows." + format: int64 + type: integer + fsGroupChangePolicy: + description: 'fsGroupChangePolicy defines behavior of changing + ownership and permission of the volume before being exposed + inside Pod. This field will only apply to volume types which + support fsGroup based ownership(and permissions). It will have + no effect on ephemeral volume types such as: secret, configmaps + and emptydir. Valid values are "OnRootMismatch" and "Always". + If not specified, "Always" is used. Note that this field cannot + be set when spec.os.name is windows.' + type: string + runAsGroup: + description: The GID to run the entrypoint of the container process. + Uses runtime default if unset. May also be set in SecurityContext. If + set in both SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: Indicates that the container must run as a non-root + user. If true, the Kubelet will validate the image at runtime + to ensure that it does not run as UID 0 (root) and fail to start + the container if it does. If unset or false, no such validation + will be performed. May also be set in SecurityContext. If set + in both SecurityContext and PodSecurityContext, the value specified + in SecurityContext takes precedence. + type: boolean + runAsUser: + description: The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. Note that this field cannot + be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random + SELinux context for each container. May also be set in SecurityContext. If + set in both SecurityContext and PodSecurityContext, the value + specified in SecurityContext takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies to + the container. + type: string + role: + description: Role is a SELinux role label that applies to + the container. + type: string + type: + description: Type is a SELinux type label that applies to + the container. + type: string + user: + description: User is a SELinux user label that applies to + the container. + type: string + type: object + seccompProfile: + description: The seccomp options to use by the containers in this + pod. Note that this field cannot be set when spec.os.name is + windows. + properties: + localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile must be + preconfigured on the node to work. Must be a descending + path, relative to the kubelet's configured seccomp profile + location. Must only be set if type is "Localhost". + type: string + type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - a profile + defined in a file on the node should be used. RuntimeDefault + - the container runtime default profile should be used. + Unconfined - no profile should be applied." + type: string + required: + - type + type: object + supplementalGroups: + description: A list of groups applied to the first process run + in each container, in addition to the container's primary GID, + the fsGroup (if specified), and group memberships defined in + the container image for the uid of the container process. If + unspecified, no additional groups are added to any container. + Note that group memberships defined in the container image for + the uid of the container process are still effective, even if + they are not included in this list. Note that this field cannot + be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: Sysctls hold a list of namespaced sysctls used for + the pod. Pods with unsupported sysctls (by the container runtime) + might fail to launch. Note that this field cannot be set when + spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext + will be used. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named by + the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. + type: string + hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is alpha-level + and will only be honored by components that enable the WindowsHostProcessContainers + feature flag. Setting this field without the feature flag + will result in errors when validating the Pod. All of a + Pod's containers must have the same effective HostProcess + value (it is not allowed to have a mix of HostProcess containers + and non-HostProcess containers). In addition, if HostProcess + is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set in PodSecurityContext. + If set in both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: ServiceAccountName is the name of the ServiceAccount + to use to run the Prometheus Pods. + type: string + sha: + description: 'SHA of Alertmanager container image to be deployed. + Defaults to the value of `version`. Similar to a tag, but the SHA + explicitly deploys an immutable container image. Version and Tag + are ignored if SHA is set. Deprecated: use ''image'' instead. The + image digest can be specified as part of the image URL.' + type: string + storage: + description: Storage is the definition of how storage will be used + by the Alertmanager instances. + properties: + disableMountSubPath: + description: 'Deprecated: subPath usage will be disabled by default + in a future release, this option will become unnecessary. DisableMountSubPath + allows to remove any subPath usage in volume mounts.' + type: boolean + emptyDir: + description: 'EmptyDirVolumeSource to be used by the StatefulSet. + If specified, used in place of any volumeClaimTemplate. More + info: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir' + properties: + medium: + description: 'medium represents what type of storage medium + should back this directory. The default is "" which means + to use the node''s default medium. Must be an empty string + (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: 'sizeLimit is the total amount of local storage + required for this EmptyDir volume. The size limit is also + applicable for memory medium. The maximum usage on memory + medium EmptyDir would be the minimum value between the SizeLimit + specified here and the sum of memory limits of all containers + in a pod. The default is nil which means that the limit + is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: 'EphemeralVolumeSource to be used by the StatefulSet. + This is a beta field in k8s 1.21, for lower versions, starting + with k8s 1.19, it requires enabling the GenericEphemeralVolume + feature gate. More info: https://kubernetes.io/docs/concepts/storage/ephemeral-volumes/#generic-ephemeral-volumes' + properties: + volumeClaimTemplate: + description: "Will be used to create a stand-alone PVC to + provision the volume. The pod in which this EphemeralVolumeSource + is embedded will be the owner of the PVC, i.e. the PVC will + be deleted together with the pod. The name of the PVC will + be `-` where `` is the + name from the `PodSpec.Volumes` array entry. Pod validation + will reject the pod if the concatenated name is not valid + for a PVC (for example, too long). \n An existing PVC with + that name that is not owned by the pod will *not* be used + for the pod to avoid using an unrelated volume by mistake. + Starting the pod is then blocked until the unrelated PVC + is removed. If such a pre-created PVC is meant to be used + by the pod, the PVC has to updated with an owner reference + to the pod once the pod exists. Normally this should not + be necessary, but it may be useful when manually reconstructing + a broken cluster. \n This field is read-only and no changes + will be made by Kubernetes to the PVC after it has been + created. \n Required, must not be nil." + properties: + metadata: + description: May contain labels and annotations that will + be copied into the PVC when creating it. No other fields + are allowed and will be rejected during validation. + type: object + spec: + description: The specification for the PersistentVolumeClaim. + The entire content is copied unchanged into the PVC + that gets created from this template. The same fields + as in a PersistentVolumeClaim are also valid here. + properties: + accessModes: + description: 'accessModes contains the desired access + modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' + items: + type: string + type: array + dataSource: + description: 'dataSource field can be used to specify + either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) If the + provisioner or an external controller can support + the specified data source, it will create a new + volume based on the contents of the specified data + source. When the AnyVolumeDataSource feature gate + is enabled, dataSource contents will be copied to + dataSourceRef, and dataSourceRef contents will be + copied to dataSource when dataSourceRef.namespace + is not specified. If the namespace is specified, + then dataSourceRef will not be copied to dataSource.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API group. + For any other third-party types, APIGroup is + required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: 'dataSourceRef specifies the object from + which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a + non-empty API group (non core object) or a PersistentVolumeClaim + object. When this field is specified, volume binding + will only succeed if the type of the specified object + matches some installed volume populator or dynamic + provisioner. This field will replace the functionality + of the dataSource field and as such if both fields + are non-empty, they must have the same value. For + backwards compatibility, when namespace isn''t specified + in dataSourceRef, both fields (dataSource and dataSourceRef) + will be set to the same value automatically if one + of them is empty and the other is non-empty. When + namespace is specified in dataSourceRef, dataSource + isn''t set to the same value and must be empty. + There are three important differences between dataSource + and dataSourceRef: * While dataSource only allows + two specific types of objects, dataSourceRef allows + any non-core object, as well as PersistentVolumeClaim + objects. * While dataSource ignores disallowed values + (dropping them), dataSourceRef preserves all values, + and generates an error if a disallowed value is + specified. * While dataSource only allows local + objects, dataSourceRef allows objects in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource + feature gate to be enabled. (Alpha) Using the namespace + field of dataSourceRef requires the CrossNamespaceVolumeDataSource + feature gate to be enabled.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API group. + For any other third-party types, APIGroup is + required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: Namespace is the namespace of resource + being referenced Note that when a namespace + is specified, a gateway.networking.k8s.io/ReferenceGrant + object is required in the referent namespace + to allow that namespace's owner to accept the + reference. See the ReferenceGrant documentation + for details. (Alpha) This field requires the + CrossNamespaceVolumeDataSource feature gate + to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: 'resources represents the minimum resources + the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to specify + resource requirements that are lower than previous + value but must still be higher than capacity recorded + in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' + properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used + by this container. \n This is an alpha field + and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of + one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes + that resource available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is + omitted for a container, it defaults to Limits + if that is explicitly specified, otherwise to + an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement is + a selector that contains values, a key, and + an operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + the values array must be empty. This array + is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: 'storageClassName is the name of the + StorageClass required by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' + type: string + volumeMode: + description: volumeMode defines what type of volume + is required by the claim. Value of Filesystem is + implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + volumeClaimTemplate: + description: A PVC spec to be used by the StatefulSet. The easiest + way to use a volume that cannot be automatically provisioned + (for whatever reason) is to use a label selector alongside manually + created PersistentVolumes. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this + representation of an object. Servers should convert recognized + schemas to the latest internal value, and may reject unrecognized + values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST + resource this object represents. Servers may infer this + from the endpoint the client submits requests to. Cannot + be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + description: EmbeddedMetadata contains metadata relevant to + an EmbeddedResource. + properties: + annotations: + additionalProperties: + type: string + description: 'Annotations is an unstructured key value + map stored with a resource that may be set by external + tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying + objects. More info: http://kubernetes.io/docs/user-guide/annotations' + type: object + labels: + additionalProperties: + type: string + description: 'Map of string keys and values that can be + used to organize and categorize (scope and select) objects. + May match selectors of replication controllers and services. + More info: http://kubernetes.io/docs/user-guide/labels' + type: object + name: + description: 'Name must be unique within a namespace. + Is required when creating resources, although some resources + may allow a client to request the generation of an appropriate + name automatically. Name is primarily intended for creation + idempotence and configuration definition. Cannot be + updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + type: object + spec: + description: 'Spec defines the desired characteristics of + a volume requested by a pod author. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + properties: + accessModes: + description: 'accessModes contains the desired access + modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' + items: + type: string + type: array + dataSource: + description: 'dataSource field can be used to specify + either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) If the provisioner + or an external controller can support the specified + data source, it will create a new volume based on the + contents of the specified data source. When the AnyVolumeDataSource + feature gate is enabled, dataSource contents will be + copied to dataSourceRef, and dataSourceRef contents + will be copied to dataSource when dataSourceRef.namespace + is not specified. If the namespace is specified, then + dataSourceRef will not be copied to dataSource.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: 'dataSourceRef specifies the object from + which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty + API group (non core object) or a PersistentVolumeClaim + object. When this field is specified, volume binding + will only succeed if the type of the specified object + matches some installed volume populator or dynamic provisioner. + This field will replace the functionality of the dataSource + field and as such if both fields are non-empty, they + must have the same value. For backwards compatibility, + when namespace isn''t specified in dataSourceRef, both + fields (dataSource and dataSourceRef) will be set to + the same value automatically if one of them is empty + and the other is non-empty. When namespace is specified + in dataSourceRef, dataSource isn''t set to the same + value and must be empty. There are three important differences + between dataSource and dataSourceRef: * While dataSource + only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim + objects. * While dataSource ignores disallowed values + (dropping them), dataSourceRef preserves all values, + and generates an error if a disallowed value is specified. + * While dataSource only allows local objects, dataSourceRef + allows objects in any namespaces. (Beta) Using this + field requires the AnyVolumeDataSource feature gate + to be enabled. (Alpha) Using the namespace field of + dataSourceRef requires the CrossNamespaceVolumeDataSource + feature gate to be enabled.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: Namespace is the namespace of resource + being referenced Note that when a namespace is specified, + a gateway.networking.k8s.io/ReferenceGrant object + is required in the referent namespace to allow that + namespace's owner to accept the reference. See the + ReferenceGrant documentation for details. (Alpha) + This field requires the CrossNamespaceVolumeDataSource + feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: 'resources represents the minimum resources + the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to specify resource + requirements that are lower than previous value but + must still be higher than capacity recorded in the status + field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' + properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used by + this container. \n This is an alpha field and requires + enabling the DynamicResourceAllocation feature gate. + \n This field is immutable." + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one + entry in pod.spec.resourceClaims of the Pod + where this field is used. It makes that resource + available inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount + of compute resources required. If Requests is omitted + for a container, it defaults to Limits if that is + explicitly specified, otherwise to an implementation-defined + value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + selector: + description: selector is a label query over volumes to + consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, + NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. + If the operator is In or NotIn, the values + array must be non-empty. If the operator is + Exists or DoesNotExist, the values array must + be empty. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field + is "key", the operator is "In", and the values array + contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: 'storageClassName is the name of the StorageClass + required by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' + type: string + volumeMode: + description: volumeMode defines what type of volume is + required by the claim. Value of Filesystem is implied + when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. + type: string + type: object + status: + description: 'Status represents the current information/status + of a persistent volume claim. Read-only. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + properties: + accessModes: + description: 'accessModes contains the actual access modes + the volume backing the PVC has. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' + items: + type: string + type: array + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: allocatedResources is the storage resource + within AllocatedResources tracks the capacity allocated + to a PVC. It may be larger than the actual capacity + when a volume expansion operation is requested. For + storage quota, the larger value from allocatedResources + and PVC.spec.resources is used. If allocatedResources + is not set, PVC.spec.resources alone is used for quota + calculation. If a volume expansion capacity request + is lowered, allocatedResources is only lowered if there + are no expansion operations in progress and if the actual + volume capacity is equal or lower than the requested + capacity. This is an alpha field and requires enabling + RecoverVolumeExpansionFailure feature. + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources + of the underlying volume. + type: object + conditions: + description: conditions is the current Condition of persistent + volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'ResizeStarted'. + items: + description: PersistentVolumeClaimCondition contails + details about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed + the condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the + condition transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: reason is a unique, this should be + a short, machine understandable string that gives + the reason for condition's last transition. If + it reports "ResizeStarted" that means the underlying + persistent volume is being resized. + type: string + status: + type: string + type: + description: PersistentVolumeClaimConditionType + is a valid value of PersistentVolumeClaimCondition.Type + type: string + required: + - status + - type + type: object + type: array + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + resizeStatus: + description: resizeStatus stores status of resize operation. + ResizeStatus is not set by default but when expansion + is complete resizeStatus is set to empty string by resize + controller or kubelet. This is an alpha field and requires + enabling RecoverVolumeExpansionFailure feature. + type: string + type: object + type: object + type: object + tag: + description: 'Tag of Alertmanager container image to be deployed. + Defaults to the value of `version`. Version is ignored if Tag is + set. Deprecated: use ''image'' instead. The image tag can be specified + as part of the image URL.' + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: The pod this Toleration is attached to tolerates any + taint that matches the triple using the matching + operator . + properties: + effect: + description: Effect indicates the taint effect to match. Empty + means match all taint effects. When specified, allowed values + are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: Key is the taint key that the toleration applies + to. Empty means match all taint keys. If the key is empty, + operator must be Exists; this combination means to match all + values and all keys. + type: string + operator: + description: Operator represents a key's relationship to the + value. Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod + can tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: TolerationSeconds represents the period of time + the toleration (which must be of effect NoExecute, otherwise + this field is ignored) tolerates the taint. By default, it + is not set, which means tolerate the taint forever (do not + evict). Zero and negative values will be treated as 0 (evict + immediately) by the system. + format: int64 + type: integer + value: + description: Value is the taint value the toleration matches + to. If the operator is Exists, the value should be empty, + otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: If specified, the pod's topology spread constraints. + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + properties: + labelSelector: + description: LabelSelector is used to find matching pods. Pods + that match this label selector are counted to determine the + number of pods in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. + If the operator is In or NotIn, the values array + must be non-empty. If the operator is Exists or + DoesNotExist, the values array must be empty. This + array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: MatchLabelKeys is a set of pod label keys to select + the pods over which spreading will be calculated. The keys + are used to lookup values from the incoming pod labels, those + key-value labels are ANDed with labelSelector to select the + group of existing pods over which spreading will be calculated + for the incoming pod. Keys that don't exist in the incoming + pod labels will be ignored. A null or empty list means only + match against labelSelector. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: 'MaxSkew describes the degree to which pods may + be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, + it is the maximum permitted difference between the number + of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods + in an eligible domain or zero if the number of eligible domains + is less than MinDomains. For example, in a 3-zone cluster, + MaxSkew is set to 1, and pods with the same labelSelector + spread as 2/2/1: In this case, the global minimum is 1. | + zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew + is 1, incoming pod can only be scheduled to zone3 to become + 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) + on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming + pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, + it is used to give higher precedence to topologies that satisfy + it. It''s a required field. Default value is 1 and 0 is not + allowed.' + format: int32 + type: integer + minDomains: + description: "MinDomains indicates a minimum number of eligible + domains. When the number of eligible domains with matching + topology keys is less than minDomains, Pod Topology Spread + treats \"global minimum\" as 0, and then the calculation of + Skew is performed. And when the number of eligible domains + with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. As a result, when + the number of eligible domains is less than minDomains, scheduler + won't schedule more than maxSkew Pods to those domains. If + value is nil, the constraint behaves as if MinDomains is equal + to 1. Valid values are integers greater than 0. When value + is not nil, WhenUnsatisfiable must be DoNotSchedule. \n For + example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains + is set to 5 and pods with the same labelSelector spread as + 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | + The number of domains is less than 5(MinDomains), so \"global + minimum\" is treated as 0. In this situation, new pod with + the same labelSelector cannot be scheduled, because computed + skew will be 3(3 - 0) if new Pod is scheduled to any of the + three zones, it will violate MaxSkew. \n This is a beta field + and requires the MinDomainsInPodTopologySpread feature gate + to be enabled (enabled by default)." + format: int32 + type: integer + nodeAffinityPolicy: + description: "NodeAffinityPolicy indicates how we will treat + Pod's nodeAffinity/nodeSelector when calculating pod topology + spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector + are included in the calculations. - Ignore: nodeAffinity/nodeSelector + are ignored. All nodes are included in the calculations. \n + If this value is nil, the behavior is equivalent to the Honor + policy. This is a beta-level feature default enabled by the + NodeInclusionPolicyInPodTopologySpread feature flag." + type: string + nodeTaintsPolicy: + description: "NodeTaintsPolicy indicates how we will treat node + taints when calculating pod topology spread skew. Options + are: - Honor: nodes without taints, along with tainted nodes + for which the incoming pod has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + \n If this value is nil, the behavior is equivalent to the + Ignore policy. This is a beta-level feature default enabled + by the NodeInclusionPolicyInPodTopologySpread feature flag." + type: string + topologyKey: + description: TopologyKey is the key of node labels. Nodes that + have a label with this key and identical values are considered + to be in the same topology. We consider each + as a "bucket", and try to put balanced number of pods into + each bucket. We define a domain as a particular instance of + a topology. Also, we define an eligible domain as a domain + whose nodes meet the requirements of nodeAffinityPolicy and + nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", + each Node is a domain of that topology. And, if TopologyKey + is "topology.kubernetes.io/zone", each zone is a domain of + that topology. It's a required field. + type: string + whenUnsatisfiable: + description: 'WhenUnsatisfiable indicates how to deal with a + pod if it doesn''t satisfy the spread constraint. - DoNotSchedule + (default) tells the scheduler not to schedule it. - ScheduleAnyway + tells the scheduler to schedule the pod in any location, but + giving higher precedence to topologies that would help reduce + the skew. A constraint is considered "Unsatisfiable" for an + incoming pod if and only if every possible node assignment + for that pod would violate "MaxSkew" on some topology. For + example, in a 3-zone cluster, MaxSkew is set to 1, and pods + with the same labelSelector spread as 3/1/1: | zone1 | zone2 + | zone3 | | P P P | P | P | If WhenUnsatisfiable is + set to DoNotSchedule, incoming pod can only be scheduled to + zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on + zone2(zone3) satisfies MaxSkew(1). In other words, the cluster + can still be imbalanced, but scheduler won''t make it *more* + imbalanced. It''s a required field.' + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + version: + description: Version the cluster should be on. + type: string + volumeMounts: + description: VolumeMounts allows configuration of additional VolumeMounts + on the output StatefulSet definition. VolumeMounts specified will + be appended to other VolumeMounts in the alertmanager container, + that are generated as a result of StorageSpec objects. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: Path within the container at which the volume should + be mounted. Must not contain ':'. + type: string + mountPropagation: + description: mountPropagation determines how mounts are propagated + from the host to container and the other way around. When + not set, MountPropagationNone is used. This field is beta + in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. + type: boolean + subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's root). + type: string + subPathExpr: + description: Expanded path within the volume from which the + container's volume should be mounted. Behaves similarly to + SubPath but environment variable references $(VAR_NAME) are + expanded using the container's environment. Defaults to "" + (volume's root). SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: Volumes allows configuration of additional volumes on + the output StatefulSet definition. Volumes specified will be appended + to other volumes that are generated as a result of StorageSpec objects. + items: + description: Volume represents a named volume in a pod that may + be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: 'awsElasticBlockStore represents an AWS Disk resource + that is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + properties: + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + partition: + description: 'partition is the partition in the volume that + you want to mount. If omitted, the default is to mount + by volume name. Examples: For volume /dev/sda1, you specify + the partition as "1". Similarly, the volume partition + for /dev/sda is "0" (or you can leave the property empty).' + format: int32 + type: integer + readOnly: + description: 'readOnly value true will force the readOnly + setting in VolumeMounts. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + type: boolean + volumeID: + description: 'volumeID is unique ID of the persistent disk + resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount on + the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: None, + Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in the + blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the blob + storage + type: string + fsType: + description: fsType is Filesystem type to mount. Must be + a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single blob + disk per storage account Managed: azure managed data + disk (only in managed availability set). defaults to shared' + type: string + readOnly: + description: readOnly Defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service mount + on the host and bind mount to the pod. + properties: + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that contains + Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host that + shares a pod's lifetime + properties: + monitors: + description: 'monitors is Required: Monitors is a collection + of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted root, + rather than the full Ceph tree, default is /' + type: string + readOnly: + description: 'readOnly is Optional: Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: boolean + secretFile: + description: 'secretFile is Optional: SecretFile is the + path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: string + secretRef: + description: 'secretRef is Optional: SecretRef is reference + to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: 'user is optional: User is the rados user name, + default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + type: string + required: + - monitors + type: object + cinder: + description: 'cinder represents a cinder volume attached and + mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + properties: + fsType: + description: 'fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to + be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: string + readOnly: + description: 'readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: boolean + secretRef: + description: 'secretRef is optional: points to a secret + object containing parameters used to connect to OpenStack.' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: 'volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should populate + this volume + properties: + defaultMode: + description: 'defaultMode is optional: mode bits used to + set permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: items if unspecified, each key-value pair in + the Data field of the referenced ConfigMap will be projected + into the volume as a file whose name is the key and content + is the value. If specified, the listed keys will be projected + into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in + the ConfigMap, the volume setup will error unless it is + marked optional. Paths must be relative and may not contain + the '..' path or start with '..'. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal value + between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. If not + specified, the volume defaultMode will be used. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not start + with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: optional specify whether the ConfigMap or its + keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents ephemeral + storage that is handled by certain external CSI drivers (Beta + feature). + properties: + driver: + description: driver is the name of the CSI driver that handles + this volume. Consult with your admin for the correct name + as registered in the cluster. + type: string + fsType: + description: fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated + CSI driver which will determine the default filesystem + to apply. + type: string + nodePublishSecretRef: + description: nodePublishSecretRef is a reference to the + secret object containing sensitive information to pass + to the CSI driver to complete the CSI NodePublishVolume + and NodeUnpublishVolume calls. This field is optional, + and may be empty if no secret is required. If the secret + object contains more than one secret, all secret references + are passed. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: readOnly specifies a read-only configuration + for the volume. Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: volumeAttributes stores driver-specific properties + that are passed to the CSI driver. Consult your driver's + documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the pod + that should populate this volume + properties: + defaultMode: + description: 'Optional: mode bits to use on created files + by default. Must be a Optional: mode bits used to set + permissions on created files by default. Must be an octal + value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: Items is a list of downward API volume file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the pod: + only annotations, labels, name and namespace are + supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: 'Optional: mode bits used to set permissions + on this file, must be an octal value between 0000 + and 0777 or a decimal value between 0 and 511. YAML + accepts both octal and decimal values, JSON requires + decimal values for mode bits. If not specified, + the volume defaultMode will be used. This might + be in conflict with other options that affect the + file mode, like fsGroup, and the result can be other + mode bits set.' + format: int32 + type: integer + path: + description: 'Required: Path is the relative path + name of the file to be created. Must not be absolute + or contain the ''..'' path. Must be utf-8 encoded. + The first item of the relative path must not start + with ''..''' + type: string + resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, requests.cpu and requests.memory) + are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: 'emptyDir represents a temporary directory that + shares a pod''s lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + properties: + medium: + description: 'medium represents what type of storage medium + should back this directory. The default is "" which means + to use the node''s default medium. Must be an empty string + (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: 'sizeLimit is the total amount of local storage + required for this EmptyDir volume. The size limit is also + applicable for memory medium. The maximum usage on memory + medium EmptyDir would be the minimum value between the + SizeLimit specified here and the sum of memory limits + of all containers in a pod. The default is nil which means + that the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir' + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: "ephemeral represents a volume that is handled + by a cluster storage driver. The volume's lifecycle is tied + to the pod that defines it - it will be created before the + pod starts, and deleted when the pod is removed. \n Use this + if: a) the volume is only needed while the pod runs, b) features + of normal volumes like restoring from snapshot or capacity + tracking are needed, c) the storage driver is specified through + a storage class, and d) the storage driver supports dynamic + volume provisioning through a PersistentVolumeClaim (see EphemeralVolumeSource + for more information on the connection between this volume + type and PersistentVolumeClaim). \n Use PersistentVolumeClaim + or one of the vendor-specific APIs for volumes that persist + for longer than the lifecycle of an individual pod. \n Use + CSI for light-weight local ephemeral volumes if the CSI driver + is meant to be used that way - see the documentation of the + driver for more information. \n A pod can use both types of + ephemeral volumes and persistent volumes at the same time." + properties: + volumeClaimTemplate: + description: "Will be used to create a stand-alone PVC to + provision the volume. The pod in which this EphemeralVolumeSource + is embedded will be the owner of the PVC, i.e. the PVC + will be deleted together with the pod. The name of the + PVC will be `-` where `` is the name from the `PodSpec.Volumes` array entry. + Pod validation will reject the pod if the concatenated + name is not valid for a PVC (for example, too long). \n + An existing PVC with that name that is not owned by the + pod will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC + is meant to be used by the pod, the PVC has to updated + with an owner reference to the pod once the pod exists. + Normally this should not be necessary, but it may be useful + when manually reconstructing a broken cluster. \n This + field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. \n Required, must + not be nil." + properties: + metadata: + description: May contain labels and annotations that + will be copied into the PVC when creating it. No other + fields are allowed and will be rejected during validation. + type: object + spec: + description: The specification for the PersistentVolumeClaim. + The entire content is copied unchanged into the PVC + that gets created from this template. The same fields + as in a PersistentVolumeClaim are also valid here. + properties: + accessModes: + description: 'accessModes contains the desired access + modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' + items: + type: string + type: array + dataSource: + description: 'dataSource field can be used to specify + either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) If the + provisioner or an external controller can support + the specified data source, it will create a new + volume based on the contents of the specified + data source. When the AnyVolumeDataSource feature + gate is enabled, dataSource contents will be copied + to dataSourceRef, and dataSourceRef contents will + be copied to dataSource when dataSourceRef.namespace + is not specified. If the namespace is specified, + then dataSourceRef will not be copied to dataSource.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API + group. For any other third-party types, APIGroup + is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: 'dataSourceRef specifies the object + from which to populate the volume with data, if + a non-empty volume is desired. This may be any + object from a non-empty API group (non core object) + or a PersistentVolumeClaim object. When this field + is specified, volume binding will only succeed + if the type of the specified object matches some + installed volume populator or dynamic provisioner. + This field will replace the functionality of the + dataSource field and as such if both fields are + non-empty, they must have the same value. For + backwards compatibility, when namespace isn''t + specified in dataSourceRef, both fields (dataSource + and dataSourceRef) will be set to the same value + automatically if one of them is empty and the + other is non-empty. When namespace is specified + in dataSourceRef, dataSource isn''t set to the + same value and must be empty. There are three + important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types + of objects, dataSourceRef allows any non-core + object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping + them), dataSourceRef preserves all values, and + generates an error if a disallowed value is specified. + * While dataSource only allows local objects, + dataSourceRef allows objects in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource + feature gate to be enabled. (Alpha) Using the + namespace field of dataSourceRef requires the + CrossNamespaceVolumeDataSource feature gate to + be enabled.' + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API + group. For any other third-party types, APIGroup + is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: Namespace is the namespace of resource + being referenced Note that when a namespace + is specified, a gateway.networking.k8s.io/ReferenceGrant + object is required in the referent namespace + to allow that namespace's owner to accept + the reference. See the ReferenceGrant documentation + for details. (Alpha) This field requires the + CrossNamespaceVolumeDataSource feature gate + to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: 'resources represents the minimum resources + the volume should have. If RecoverVolumeExpansionFailure + feature is enabled users are allowed to specify + resource requirements that are lower than previous + value but must still be higher than capacity recorded + in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' + properties: + claims: + description: "Claims lists the names of resources, + defined in spec.resourceClaims, that are used + by this container. \n This is an alpha field + and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one + entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name + of one entry in pod.spec.resourceClaims + of the Pod where this field is used. + It makes that resource available inside + a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount + of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum + amount of compute resources required. If Requests + is omitted for a container, it defaults to + Limits if that is explicitly specified, otherwise + to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: 'storageClassName is the name of the + StorageClass required by the claim. More info: + https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' + type: string + volumeMode: + description: volumeMode defines what type of volume + is required by the claim. Value of Filesystem + is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that is + attached to a kubelet's host machine and then exposed to the + pod. + properties: + fsType: + description: 'fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. TODO: how do we prevent errors in the + filesystem from compromising the machine' + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: 'readOnly is Optional: Defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts.' + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: 'wwids Optional: FC volume world wide identifiers + (wwids) Either wwids or combination of targetWWNs and + lun must be set, but not both simultaneously.' + items: + type: string + type: array + type: object + flexVolume: + description: flexVolume represents a generic volume resource + that is provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use for + this volume. + type: string + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends + on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds extra + command options if any.' + type: object + readOnly: + description: 'readOnly is Optional: defaults to false (read/write). + ReadOnly here will force the ReadOnly setting in VolumeMounts.' + type: boolean + secretRef: + description: 'secretRef is Optional: secretRef is reference + to the secret object containing sensitive information + to pass to the plugin scripts. This may be empty if no + secret object is specified. If the secret object contains + more than one secret, all secrets are passed to the plugin + scripts.' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached to + a kubelet's host machine. This depends on the Flocker control + service being running + properties: + datasetName: + description: datasetName is Name of the dataset stored as + metadata -> name on the dataset for Flocker should be + considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. This + is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: 'gcePersistentDisk represents a GCE Disk resource + that is attached to a kubelet''s host machine and then exposed + to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + properties: + fsType: + description: 'fsType is filesystem type of the volume that + you want to mount. Tip: Ensure that the filesystem type + is supported by the host operating system. Examples: "ext4", + "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + partition: + description: 'partition is the partition in the volume that + you want to mount. If omitted, the default is to mount + by volume name. Examples: For volume /dev/sda1, you specify + the partition as "1". Similarly, the volume partition + for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + format: int32 + type: integer + pdName: + description: 'pdName is unique name of the PD resource in + GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + type: string + readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + type: boolean + required: + - pdName + type: object + gitRepo: + description: 'gitRepo represents a git repository at a particular + revision. DEPRECATED: GitRepo is deprecated. To provision + a container with a git repo, mount an EmptyDir into an InitContainer + that clones the repo using git, then mount the EmptyDir into + the Pod''s container.' + properties: + directory: + description: directory is the target directory name. Must + not contain or start with '..'. If '.' is supplied, the + volume directory will be the git repository. Otherwise, + if specified, the volume will contain the git repository + in the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: 'glusterfs represents a Glusterfs mount on the + host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md' + properties: + endpoints: + description: 'endpoints is the endpoint name that details + Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: string + path: + description: 'path is the Glusterfs volume path. More info: + https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: string + readOnly: + description: 'readOnly here will force the Glusterfs volume + to be mounted with read-only permissions. Defaults to + false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: 'hostPath represents a pre-existing file or directory + on the host machine that is directly exposed to the container. + This is generally used for system agents or other privileged + things that are allowed to see the host machine. Most containers + will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- TODO(jonesdl) We need to restrict who can use host directory + mounts and who can/can not mount host directories as read/write.' + properties: + path: + description: 'path of the directory on the host. If the + path is a symlink, it will follow the link to the real + path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' + type: string + type: + description: 'type for HostPath Volume Defaults to "" More + info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' + type: string + required: + - path + type: object + iscsi: + description: 'iscsi represents an ISCSI Disk resource that is + attached to a kubelet''s host machine and then exposed to + the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md' + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support iSCSI + Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support iSCSI + Session CHAP authentication + type: boolean + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + initiatorName: + description: initiatorName is the custom iSCSI Initiator + Name. If initiatorName is specified with iscsiInterface + simultaneously, new iSCSI interface : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: iscsiInterface is the interface Name that uses + an iSCSI transport. Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: portals is the iSCSI Target Portal List. The + portal is either an IP or ip_addr:port if the port is + other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI target + and initiator authentication + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: targetPortal is iSCSI Target Portal. The Portal + is either an IP or ip_addr:port if the port is other than + default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: 'name of the volume. Must be a DNS_LABEL and unique + within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + nfs: + description: 'nfs represents an NFS mount on the host that shares + a pod''s lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + properties: + path: + description: 'path that is exported by the NFS server. More + info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: string + readOnly: + description: 'readOnly here will force the NFS export to + be mounted with read-only permissions. Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: boolean + server: + description: 'server is the hostname or IP address of the + NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: 'persistentVolumeClaimVolumeSource represents a + reference to a PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + properties: + claimName: + description: 'claimName is the name of a PersistentVolumeClaim + in the same namespace as the pod using this volume. More + info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + type: string + readOnly: + description: readOnly Will force the ReadOnly setting in + VolumeMounts. Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host machine + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume attached + and mounted on kubelets host machine + properties: + fsType: + description: fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating + system. Ex. "ext4", "xfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: defaultMode are the mode bits used to set permissions + on created files by default. Must be an octal value between + 0000 and 0777 or a decimal value between 0 and 511. YAML + accepts both octal and decimal values, JSON requires decimal + values for mode bits. Directories within the path are + not affected by this setting. This might be in conflict + with other options that affect the file mode, like fsGroup, + and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along with + other supported volume types + properties: + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: items if unspecified, each key-value + pair in the Data field of the referenced ConfigMap + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified which + is not present in the ConfigMap, the volume + setup will error unless it is marked optional. + Paths must be relative and may not contain the + '..' path or start with '..'. + items: + description: Maps a string key to a path within + a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 and + 0777 or a decimal value between 0 and + 511. YAML accepts both octal and decimal + values, JSON requires decimal values for + mode bits. If not specified, the volume + defaultMode will be used. This might be + in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of + the file to map the key to. May not be + an absolute path. May not contain the + path element '..'. May not start with + the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: 'Optional: mode bits used to + set permissions on this file, must be + an octal value between 0000 and 0777 or + a decimal value between 0 and 511. YAML + accepts both octal and decimal values, + JSON requires decimal values for mode + bits. If not specified, the volume defaultMode + will be used. This might be in conflict + with other options that affect the file + mode, like fsGroup, and the result can + be other mode bits set.' + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must + not be absolute or contain the ''..'' + path. Must be utf-8 encoded. The first + item of the relative path must not start + with ''..''' + type: string + resourceFieldRef: + description: 'Selects a resource of the + container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu + and requests.memory) are currently supported.' + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret data + to project + properties: + items: + description: items if unspecified, each key-value + pair in the Data field of the referenced Secret + will be projected into the volume as a file + whose name is the key and content is the value. + If specified, the listed keys will be projected + into the specified paths, and unlisted keys + will not be present. If a key is specified which + is not present in the Secret, the volume setup + will error unless it is marked optional. Paths + must be relative and may not contain the '..' + path or start with '..'. + items: + description: Maps a string key to a path within + a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: 'mode is Optional: mode bits + used to set permissions on this file. + Must be an octal value between 0000 and + 0777 or a decimal value between 0 and + 511. YAML accepts both octal and decimal + values, JSON requires decimal values for + mode bits. If not specified, the volume + defaultMode will be used. This might be + in conflict with other options that affect + the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of + the file to map the key to. May not be + an absolute path. May not contain the + path element '..'. May not start with + the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: optional field specify whether the + Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about + the serviceAccountToken data to project + properties: + audience: + description: audience is the intended audience + of the token. A recipient of a token must identify + itself with an identifier specified in the audience + of the token, and otherwise should reject the + token. The audience defaults to the identifier + of the apiserver. + type: string + expirationSeconds: + description: expirationSeconds is the requested + duration of validity of the service account + token. As the token approaches expiration, the + kubelet volume plugin will proactively rotate + the service account token. The kubelet will + start trying to rotate the token if the token + is older than 80 percent of its time to live + or if the token is older than 24 hours.Defaults + to 1 hour and must be at least 10 minutes. + format: int64 + type: integer + path: + description: path is the path relative to the + mount point of the file to project the token + into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: group to map volume access to Default is no + group + type: string + readOnly: + description: readOnly here will force the Quobyte volume + to be mounted with read-only permissions. Defaults to + false. + type: boolean + registry: + description: registry represents a single or multiple Quobyte + Registry services specified as a string as host:port pair + (multiple entries are separated with commas) which acts + as the central registry for volumes + type: string + tenant: + description: tenant owning the given Quobyte volume in the + Backend Used with dynamically provisioned Quobyte volumes, + value is set by the plugin + type: string + user: + description: user to map volume access to Defaults to serivceaccount + user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: 'rbd represents a Rados Block Device mount on the + host that shares a pod''s lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' + properties: + fsType: + description: 'fsType is the filesystem type of the volume + that you want to mount. Tip: Ensure that the filesystem + type is supported by the host operating system. Examples: + "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from + compromising the machine' + type: string + image: + description: 'image is the rados image name. More info: + https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + keyring: + description: 'keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + monitors: + description: 'monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + items: + type: string + type: array + pool: + description: 'pool is the rados pool name. Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + readOnly: + description: 'readOnly here will force the ReadOnly setting + in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: boolean + secretRef: + description: 'secretRef is name of the authentication secret + for RBDUser. If provided overrides keyring. Default is + nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: 'user is the rados user name. Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: readOnly Defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: secretRef references to the secret for ScaleIO + user and other sensitive information. If this is not provided, + Login operation will fail. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: storageMode indicates whether the storage for + a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool associated + with the protection domain. + type: string + system: + description: system is the name of the storage system as + configured in ScaleIO. + type: string + volumeName: + description: volumeName is the name of a volume already + created in the ScaleIO system that is associated with + this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: 'secret represents a secret that should populate + this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' + properties: + defaultMode: + description: 'defaultMode is Optional: mode bits used to + set permissions on created files by default. Must be an + octal value between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. Defaults to + 0644. Directories within the path are not affected by + this setting. This might be in conflict with other options + that affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + items: + description: items If unspecified, each key-value pair in + the Data field of the referenced Secret will be projected + into the volume as a file whose name is the key and content + is the value. If specified, the listed keys will be projected + into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in + the Secret, the volume setup will error unless it is marked + optional. Paths must be relative and may not contain the + '..' path or start with '..'. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: 'mode is Optional: mode bits used to + set permissions on this file. Must be an octal value + between 0000 and 0777 or a decimal value between + 0 and 511. YAML accepts both octal and decimal values, + JSON requires decimal values for mode bits. If not + specified, the volume defaultMode will be used. + This might be in conflict with other options that + affect the file mode, like fsGroup, and the result + can be other mode bits set.' + format: int32 + type: integer + path: + description: path is the relative path of the file + to map the key to. May not be an absolute path. + May not contain the path element '..'. May not start + with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret or + its keys must be defined + type: boolean + secretName: + description: 'secretName is the name of the secret in the + pod''s namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: fsType is the filesystem type to mount. Must + be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + readOnly: + description: readOnly defaults to false (read/write). ReadOnly + here will force the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: secretRef specifies the secret to use for obtaining + the StorageOS API credentials. If not specified, default + values will be attempted. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: volumeName is the human-readable name of the + StorageOS volume. Volume names are only unique within + a namespace. + type: string + volumeNamespace: + description: volumeNamespace specifies the scope of the + volume within StorageOS. If no namespace is specified + then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS + for tighter integration. Set VolumeName to any name to + override the default behaviour. Set to "default" if you + are not using namespaces within StorageOS. Namespaces + that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: fsType is filesystem type to mount. Must be + a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" + if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy Based + Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies vSphere + volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + web: + description: Defines the web command line flags when starting Alertmanager. + properties: + httpConfig: + description: Defines HTTP parameters for web server. + properties: + headers: + description: List of headers that can be added to HTTP responses. + properties: + contentSecurityPolicy: + description: Set the Content-Security-Policy header to + HTTP responses. Unset if blank. + type: string + strictTransportSecurity: + description: Set the Strict-Transport-Security header + to HTTP responses. Unset if blank. Please make sure + that you use this with care as this header might force + browsers to load Prometheus and the other applications + hosted on the same domain and subdomains over HTTPS. + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security + type: string + xContentTypeOptions: + description: Set the X-Content-Type-Options header to + HTTP responses. Unset if blank. Accepted value is nosniff. + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options + enum: + - "" + - NoSniff + type: string + xFrameOptions: + description: Set the X-Frame-Options header to HTTP responses. + Unset if blank. Accepted values are deny and sameorigin. + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + enum: + - "" + - Deny + - SameOrigin + type: string + xXSSProtection: + description: Set the X-XSS-Protection header to all responses. + Unset if blank. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection + type: string + type: object + http2: + description: Enable HTTP/2 support. Note that HTTP/2 is only + supported with TLS. When TLSConfig is not configured, HTTP/2 + will be disabled. Whenever the value of the field changes, + a rolling update will be triggered. + type: boolean + type: object + tlsConfig: + description: Defines the TLS parameters for HTTPS. + properties: + cert: + description: Contains the TLS certificate for the server. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cipherSuites: + description: 'List of supported cipher suites for TLS versions + up to TLS 1.2. If empty, Go default cipher suites are used. + Available cipher suites are documented in the go documentation: + https://golang.org/pkg/crypto/tls/#pkg-constants' + items: + type: string + type: array + client_ca: + description: Contains the CA certificate for client certificate + authentication to the server. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientAuthType: + description: 'Server policy for client authentication. Maps + to ClientAuth Policies. For more detail on clientAuth options: + https://golang.org/pkg/crypto/tls/#ClientAuthType' + type: string + curvePreferences: + description: 'Elliptic curves that will be used in an ECDHE + handshake, in preference order. Available curves are documented + in the go documentation: https://golang.org/pkg/crypto/tls/#CurveID' + items: + type: string + type: array + keySecret: + description: Secret containing the TLS key for the server. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + maxVersion: + description: Maximum TLS version that is acceptable. Defaults + to TLS13. + type: string + minVersion: + description: Minimum TLS version that is acceptable. Defaults + to TLS12. + type: string + preferServerCipherSuites: + description: Controls whether the server selects the client's + most preferred cipher suite, or the server's most preferred + cipher suite. If true then the server's preference, as expressed + in the order of elements in cipherSuites, is used. + type: boolean + required: + - cert + - keySecret + type: object + type: object + type: object + status: + description: 'Most recent observed status of the Alertmanager cluster. + Read-only. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + properties: + availableReplicas: + description: Total number of available pods (ready for at least minReadySeconds) + targeted by this Alertmanager cluster. + format: int32 + type: integer + conditions: + description: The current state of the Alertmanager object. + items: + description: Condition represents the state of the resources associated + with the Prometheus or Alertmanager resource. + properties: + lastTransitionTime: + description: lastTransitionTime is the time of the last update + to the current status property. + format: date-time + type: string + message: + description: Human-readable message indicating details for the + condition's last transition. + type: string + observedGeneration: + description: ObservedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if `.metadata.generation` + is currently 12, but the `.status.conditions[].observedGeneration` + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + type: integer + reason: + description: Reason for the condition's last transition. + type: string + status: + description: Status of the condition. + type: string + type: + description: Type of the condition being reported. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + paused: + description: Represents whether any actions on the underlying managed + objects are being performed. Only delete actions will be performed. + type: boolean + replicas: + description: Total number of non-terminated pods targeted by this + Alertmanager object (their labels match the selector). + format: int32 + type: integer + unavailableReplicas: + description: Total number of unavailable pods targeted by this Alertmanager + object. + format: int32 + type: integer + updatedReplicas: + description: Total number of non-terminated pods targeted by this + Alertmanager object that have the desired version spec. + format: int32 + type: integer + required: + - availableReplicas + - paused + - replicas + - unavailableReplicas + - updatedReplicas + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-podmonitors.yaml b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-podmonitors.yaml new file mode 100644 index 000000000..f3dfc4284 --- /dev/null +++ b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-podmonitors.yaml @@ -0,0 +1,666 @@ +# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.63.0/example/prometheus-operator-crd/monitoring.coreos.com_podmonitors.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.1 + creationTimestamp: null + name: podmonitors.monitoring.coreos.com +spec: + group: monitoring.coreos.com + names: + categories: + - prometheus-operator + kind: PodMonitor + listKind: PodMonitorList + plural: podmonitors + shortNames: + - pmon + singular: podmonitor + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: PodMonitor defines monitoring for a set of pods. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of desired Pod selection for target discovery + by Prometheus. + properties: + attachMetadata: + description: Attaches node metadata to discovered targets. Requires + Prometheus v2.35.0 and above. + properties: + node: + description: When set to true, Prometheus must have permissions + to get Nodes. + type: boolean + type: object + jobLabel: + description: The label to use to retrieve the job name from. + type: string + labelLimit: + description: Per-scrape limit on number of labels that will be accepted + for a sample. Only valid in Prometheus versions 2.27.0 and newer. + format: int64 + type: integer + labelNameLengthLimit: + description: Per-scrape limit on length of labels name that will be + accepted for a sample. Only valid in Prometheus versions 2.27.0 + and newer. + format: int64 + type: integer + labelValueLengthLimit: + description: Per-scrape limit on length of labels value that will + be accepted for a sample. Only valid in Prometheus versions 2.27.0 + and newer. + format: int64 + type: integer + namespaceSelector: + description: Selector to select which namespaces the Endpoints objects + are discovered from. + properties: + any: + description: Boolean describing whether all namespaces are selected + in contrast to a list restricting them. + type: boolean + matchNames: + description: List of namespace names to select from. + items: + type: string + type: array + type: object + podMetricsEndpoints: + description: A list of endpoints allowed as part of this PodMonitor. + items: + description: PodMetricsEndpoint defines a scrapeable endpoint of + a Kubernetes Pod serving Prometheus metrics. + properties: + authorization: + description: Authorization section for this endpoint + properties: + credentials: + description: The secret's key that contains the credentials + of the request + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults to Bearer, + Basic will cause an error + type: string + type: object + basicAuth: + description: 'BasicAuth allow an endpoint to authenticate over + basic authentication. More info: https://prometheus.io/docs/operating/configuration/#endpoint' + properties: + password: + description: The secret in the service monitor namespace + that contains the password for authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor namespace + that contains the username for authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: Secret to mount to read bearer token for scraping + targets. The secret needs to be in the same namespace as the + pod monitor and accessible by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + enableHttp2: + description: Whether to enable HTTP2. + type: boolean + filterRunning: + description: 'Drop pods that are not running. (Failed, Succeeded). + Enabled by default. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase' + type: boolean + followRedirects: + description: FollowRedirects configures whether scrape requests + follow HTTP 3xx redirects. + type: boolean + honorLabels: + description: HonorLabels chooses the metric's labels on collisions + with target labels. + type: boolean + honorTimestamps: + description: HonorTimestamps controls whether Prometheus respects + the timestamps present in scraped data. + type: boolean + interval: + description: Interval at which metrics should be scraped If + not specified Prometheus' global scrape interval is used. + pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + metricRelabelings: + description: MetricRelabelConfigs to apply to samples before + ingestion. + items: + description: 'RelabelConfig allows dynamic rewriting of the + label set, being applied to samples before ingestion. It + defines ``-section of Prometheus + configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' + properties: + action: + default: replace + description: Action to perform based on regex matching. + Default is 'replace'. uppercase and lowercase actions + require Prometheus >= 2.36. + enum: + - replace + - Replace + - keep + - Keep + - drop + - Drop + - hashmod + - HashMod + - labelmap + - LabelMap + - labeldrop + - LabelDrop + - labelkeep + - LabelKeep + - lowercase + - Lowercase + - uppercase + - Uppercase + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: Regular expression against which the extracted + value is matched. Default is '(.*)' + type: string + replacement: + description: Replacement value against which a regex replace + is performed if the regular expression matches. Regex + capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + sourceLabels: + description: The source labels select values from existing + labels. Their content is concatenated using the configured + separator and matched against the configured regular + expression for the replace, keep, and drop actions. + items: + description: LabelName is a valid Prometheus label name + which may only contain ASCII letters, numbers, as + well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ + type: string + type: array + targetLabel: + description: Label to which the resulting value is written + in a replace action. It is mandatory for replace actions. + Regex capture groups are available. + type: string + type: object + type: array + oauth2: + description: OAuth2 for the URL. Only valid in Prometheus versions + 2.27.0 and newer. + properties: + clientId: + description: The secret or configmap containing the OAuth2 + client id + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + params: + additionalProperties: + items: + type: string + type: array + description: Optional HTTP URL parameters + type: object + path: + description: HTTP path to scrape for metrics. If empty, Prometheus + uses the default value (e.g. `/metrics`). + type: string + port: + description: Name of the pod port this endpoint refers to. Mutually + exclusive with targetPort. + type: string + proxyUrl: + description: ProxyURL eg http://proxyserver:2195 Directs scrapes + to proxy through this endpoint. + type: string + relabelings: + description: 'RelabelConfigs to apply to samples before scraping. + Prometheus Operator automatically adds relabelings for a few + standard Kubernetes fields. The original scrape job''s name + is available via the `__tmp_prometheus_job_name` label. More + info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config' + items: + description: 'RelabelConfig allows dynamic rewriting of the + label set, being applied to samples before ingestion. It + defines ``-section of Prometheus + configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' + properties: + action: + default: replace + description: Action to perform based on regex matching. + Default is 'replace'. uppercase and lowercase actions + require Prometheus >= 2.36. + enum: + - replace + - Replace + - keep + - Keep + - drop + - Drop + - hashmod + - HashMod + - labelmap + - LabelMap + - labeldrop + - LabelDrop + - labelkeep + - LabelKeep + - lowercase + - Lowercase + - uppercase + - Uppercase + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: Regular expression against which the extracted + value is matched. Default is '(.*)' + type: string + replacement: + description: Replacement value against which a regex replace + is performed if the regular expression matches. Regex + capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + sourceLabels: + description: The source labels select values from existing + labels. Their content is concatenated using the configured + separator and matched against the configured regular + expression for the replace, keep, and drop actions. + items: + description: LabelName is a valid Prometheus label name + which may only contain ASCII letters, numbers, as + well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ + type: string + type: array + targetLabel: + description: Label to which the resulting value is written + in a replace action. It is mandatory for replace actions. + Regex capture groups are available. + type: string + type: object + type: array + scheme: + description: HTTP scheme to use for scraping. + type: string + scrapeTimeout: + description: Timeout after which the scrape is ended If not + specified, the Prometheus global scrape interval is used. + pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: 'Deprecated: Use ''port'' instead.' + x-kubernetes-int-or-string: true + tlsConfig: + description: TLS configuration to use when scraping the endpoint. + properties: + ca: + description: Certificate authority used when verifying server + certificates. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + type: object + type: array + podTargetLabels: + description: PodTargetLabels transfers labels on the Kubernetes Pod + onto the target. + items: + type: string + type: array + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 + type: integer + selector: + description: Selector to select Pod objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: A label selector requirement is a selector that + contains values, a key, and an operator that relates the key + and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: operator represents a key's relationship to + a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + targetLimit: + description: TargetLimit defines a limit on the number of scraped + targets that will be accepted. + format: int64 + type: integer + required: + - podMetricsEndpoints + - selector + type: object + required: + - spec + type: object + served: true + storage: true diff --git a/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-probes.yaml b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-probes.yaml new file mode 100644 index 000000000..a20c6ff06 --- /dev/null +++ b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-probes.yaml @@ -0,0 +1,705 @@ +# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.63.0/example/prometheus-operator-crd/monitoring.coreos.com_probes.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.1 + creationTimestamp: null + name: probes.monitoring.coreos.com +spec: + group: monitoring.coreos.com + names: + categories: + - prometheus-operator + kind: Probe + listKind: ProbeList + plural: probes + shortNames: + - prb + singular: probe + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: Probe defines monitoring for a set of static targets or ingresses. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Specification of desired Ingress selection for target discovery + by Prometheus. + properties: + authorization: + description: Authorization section for this endpoint + properties: + credentials: + description: The secret's key that contains the credentials of + the request + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults to Bearer, + Basic will cause an error + type: string + type: object + basicAuth: + description: 'BasicAuth allow an endpoint to authenticate over basic + authentication. More info: https://prometheus.io/docs/operating/configuration/#endpoint' + properties: + password: + description: The secret in the service monitor namespace that + contains the password for authentication. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor namespace that + contains the username for authentication. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenSecret: + description: Secret to mount to read bearer token for scraping targets. + The secret needs to be in the same namespace as the probe and accessible + by the Prometheus Operator. + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + interval: + description: Interval at which targets are probed using the configured + prober. If not specified Prometheus' global scrape interval is used. + pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + jobName: + description: The job name assigned to scraped metrics by default. + type: string + labelLimit: + description: Per-scrape limit on number of labels that will be accepted + for a sample. Only valid in Prometheus versions 2.27.0 and newer. + format: int64 + type: integer + labelNameLengthLimit: + description: Per-scrape limit on length of labels name that will be + accepted for a sample. Only valid in Prometheus versions 2.27.0 + and newer. + format: int64 + type: integer + labelValueLengthLimit: + description: Per-scrape limit on length of labels value that will + be accepted for a sample. Only valid in Prometheus versions 2.27.0 + and newer. + format: int64 + type: integer + metricRelabelings: + description: MetricRelabelConfigs to apply to samples before ingestion. + items: + description: 'RelabelConfig allows dynamic rewriting of the label + set, being applied to samples before ingestion. It defines ``-section + of Prometheus configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' + properties: + action: + default: replace + description: Action to perform based on regex matching. Default + is 'replace'. uppercase and lowercase actions require Prometheus + >= 2.36. + enum: + - replace + - Replace + - keep + - Keep + - drop + - Drop + - hashmod + - HashMod + - labelmap + - LabelMap + - labeldrop + - LabelDrop + - labelkeep + - LabelKeep + - lowercase + - Lowercase + - uppercase + - Uppercase + type: string + modulus: + description: Modulus to take of the hash of the source label + values. + format: int64 + type: integer + regex: + description: Regular expression against which the extracted + value is matched. Default is '(.*)' + type: string + replacement: + description: Replacement value against which a regex replace + is performed if the regular expression matches. Regex capture + groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source label + values. default is ';'. + type: string + sourceLabels: + description: The source labels select values from existing labels. + Their content is concatenated using the configured separator + and matched against the configured regular expression for + the replace, keep, and drop actions. + items: + description: LabelName is a valid Prometheus label name which + may only contain ASCII letters, numbers, as well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ + type: string + type: array + targetLabel: + description: Label to which the resulting value is written in + a replace action. It is mandatory for replace actions. Regex + capture groups are available. + type: string + type: object + type: array + module: + description: 'The module to use for probing specifying how to probe + the target. Example module configuring in the blackbox exporter: + https://github.com/prometheus/blackbox_exporter/blob/master/example.yml' + type: string + oauth2: + description: OAuth2 for the URL. Only valid in Prometheus versions + 2.27.0 and newer. + properties: + clientId: + description: The secret or configmap containing the OAuth2 client + id + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + clientSecret: + description: The secret containing the OAuth2 client secret + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + endpointParams: + additionalProperties: + type: string + description: Parameters to append to the token URL + type: object + scopes: + description: OAuth2 scopes used for the token request + items: + type: string + type: array + tokenUrl: + description: The URL to fetch the token from + minLength: 1 + type: string + required: + - clientId + - clientSecret + - tokenUrl + type: object + prober: + description: Specification for the prober to use for probing targets. + The prober.URL parameter is required. Targets cannot be probed if + left empty. + properties: + path: + default: /probe + description: Path to collect metrics from. Defaults to `/probe`. + type: string + proxyUrl: + description: Optional ProxyURL. + type: string + scheme: + description: HTTP scheme to use for scraping. Defaults to `http`. + type: string + url: + description: Mandatory URL of the prober. + type: string + required: + - url + type: object + sampleLimit: + description: SampleLimit defines per-scrape limit on number of scraped + samples that will be accepted. + format: int64 + type: integer + scrapeTimeout: + description: Timeout for scraping metrics from the Prometheus exporter. + If not specified, the Prometheus global scrape interval is used. + pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + targetLimit: + description: TargetLimit defines a limit on the number of scraped + targets that will be accepted. + format: int64 + type: integer + targets: + description: Targets defines a set of static or dynamically discovered + targets to probe. + properties: + ingress: + description: ingress defines the Ingress objects to probe and + the relabeling configuration. If `staticConfig` is also defined, + `staticConfig` takes precedence. + properties: + namespaceSelector: + description: From which namespaces to select Ingress objects. + properties: + any: + description: Boolean describing whether all namespaces + are selected in contrast to a list restricting them. + type: boolean + matchNames: + description: List of namespace names to select from. + items: + type: string + type: array + type: object + relabelingConfigs: + description: 'RelabelConfigs to apply to the label set of + the target before it gets scraped. The original ingress + address is available via the `__tmp_prometheus_ingress_address` + label. It can be used to customize the probed URL. The original + scrape job''s name is available via the `__tmp_prometheus_job_name` + label. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config' + items: + description: 'RelabelConfig allows dynamic rewriting of + the label set, being applied to samples before ingestion. + It defines ``-section of Prometheus + configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' + properties: + action: + default: replace + description: Action to perform based on regex matching. + Default is 'replace'. uppercase and lowercase actions + require Prometheus >= 2.36. + enum: + - replace + - Replace + - keep + - Keep + - drop + - Drop + - hashmod + - HashMod + - labelmap + - LabelMap + - labeldrop + - LabelDrop + - labelkeep + - LabelKeep + - lowercase + - Lowercase + - uppercase + - Uppercase + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: Regular expression against which the extracted + value is matched. Default is '(.*)' + type: string + replacement: + description: Replacement value against which a regex + replace is performed if the regular expression matches. + Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + sourceLabels: + description: The source labels select values from existing + labels. Their content is concatenated using the configured + separator and matched against the configured regular + expression for the replace, keep, and drop actions. + items: + description: LabelName is a valid Prometheus label + name which may only contain ASCII letters, numbers, + as well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ + type: string + type: array + targetLabel: + description: Label to which the resulting value is written + in a replace action. It is mandatory for replace actions. + Regex capture groups are available. + type: string + type: object + type: array + selector: + description: Selector to select the Ingress objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. + If the operator is In or NotIn, the values array + must be non-empty. If the operator is Exists or + DoesNotExist, the values array must be empty. + This array is replaced during a strategic merge + patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + staticConfig: + description: 'staticConfig defines the static list of targets + to probe and the relabeling configuration. If `ingress` is also + defined, `staticConfig` takes precedence. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#static_config.' + properties: + labels: + additionalProperties: + type: string + description: Labels assigned to all metrics scraped from the + targets. + type: object + relabelingConfigs: + description: 'RelabelConfigs to apply to the label set of + the targets before it gets scraped. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config' + items: + description: 'RelabelConfig allows dynamic rewriting of + the label set, being applied to samples before ingestion. + It defines ``-section of Prometheus + configuration. More info: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs' + properties: + action: + default: replace + description: Action to perform based on regex matching. + Default is 'replace'. uppercase and lowercase actions + require Prometheus >= 2.36. + enum: + - replace + - Replace + - keep + - Keep + - drop + - Drop + - hashmod + - HashMod + - labelmap + - LabelMap + - labeldrop + - LabelDrop + - labelkeep + - LabelKeep + - lowercase + - Lowercase + - uppercase + - Uppercase + type: string + modulus: + description: Modulus to take of the hash of the source + label values. + format: int64 + type: integer + regex: + description: Regular expression against which the extracted + value is matched. Default is '(.*)' + type: string + replacement: + description: Replacement value against which a regex + replace is performed if the regular expression matches. + Regex capture groups are available. Default is '$1' + type: string + separator: + description: Separator placed between concatenated source + label values. default is ';'. + type: string + sourceLabels: + description: The source labels select values from existing + labels. Their content is concatenated using the configured + separator and matched against the configured regular + expression for the replace, keep, and drop actions. + items: + description: LabelName is a valid Prometheus label + name which may only contain ASCII letters, numbers, + as well as underscores. + pattern: ^[a-zA-Z_][a-zA-Z0-9_]*$ + type: string + type: array + targetLabel: + description: Label to which the resulting value is written + in a replace action. It is mandatory for replace actions. + Regex capture groups are available. + type: string + type: object + type: array + static: + description: The list of hosts to probe. + items: + type: string + type: array + type: object + type: object + tlsConfig: + description: TLS configuration to use when scraping the endpoint. + properties: + ca: + description: Certificate authority used when verifying server + certificates. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + cert: + description: Client certificate to present when doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to use for the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keySecret: + description: Secret containing the client key file for the targets. + properties: + key: + description: The key of the secret to select from. Must be + a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be + defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + type: object + required: + - spec + type: object + served: true + storage: true diff --git a/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-prometheuses.yaml b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-prometheuses.yaml new file mode 100644 index 000000000..92c42c633 --- /dev/null +++ b/charts/rancher-monitoring-crd/103.0.3+up45.31.1/crd-manifest/crd-prometheuses.yaml @@ -0,0 +1,9177 @@ +# https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.63.0/example/prometheus-operator-crd/monitoring.coreos.com_prometheuses.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.1 + creationTimestamp: null + name: prometheuses.monitoring.coreos.com +spec: + group: monitoring.coreos.com + names: + categories: + - prometheus-operator + kind: Prometheus + listKind: PrometheusList + plural: prometheuses + shortNames: + - prom + singular: prometheus + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: The version of Prometheus + jsonPath: .spec.version + name: Version + type: string + - description: The number of desired replicas + jsonPath: .spec.replicas + name: Desired + type: integer + - description: The number of ready replicas + jsonPath: .status.availableReplicas + name: Ready + type: integer + - jsonPath: .status.conditions[?(@.type == 'Reconciled')].status + name: Reconciled + type: string + - jsonPath: .status.conditions[?(@.type == 'Available')].status + name: Available + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Whether the resource reconciliation is paused or not + jsonPath: .status.paused + name: Paused + priority: 1 + type: boolean + name: v1 + schema: + openAPIV3Schema: + description: Prometheus defines a Prometheus deployment. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: 'Specification of the desired behavior of the Prometheus + cluster. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + properties: + additionalAlertManagerConfigs: + description: 'AdditionalAlertManagerConfigs allows specifying a key + of a Secret containing additional Prometheus AlertManager configurations. + AlertManager configurations specified are appended to the configurations + generated by the Prometheus Operator. Job configurations specified + must have the form as specified in the official Prometheus documentation: + https://prometheus.io/docs/prometheus/latest/configuration/configuration/#alertmanager_config. + As AlertManager configs are appended, the user is responsible to + make sure it is valid. Note that using this feature may expose the + possibility to break upgrades of Prometheus. It is advised to review + Prometheus release notes to ensure that no incompatible AlertManager + configs are going to break Prometheus after the upgrade.' + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + additionalAlertRelabelConfigs: + description: 'AdditionalAlertRelabelConfigs allows specifying a key + of a Secret containing additional Prometheus alert relabel configurations. + Alert relabel configurations specified are appended to the configurations + generated by the Prometheus Operator. Alert relabel configurations + specified must have the form as specified in the official Prometheus + documentation: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#alert_relabel_configs. + As alert relabel configs are appended, the user is responsible to + make sure it is valid. Note that using this feature may expose the + possibility to break upgrades of Prometheus. It is advised to review + Prometheus release notes to ensure that no incompatible alert relabel + configs are going to break Prometheus after the upgrade.' + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + additionalArgs: + description: AdditionalArgs allows setting additional arguments for + the Prometheus container. It is intended for e.g. activating hidden + flags which are not supported by the dedicated configuration options + yet. The arguments are passed as-is to the Prometheus container + which may cause issues if they are invalid or not supported by the + given Prometheus version. In case of an argument conflict (e.g. + an argument which is already set by the operator itself) or when + providing an invalid argument the reconciliation will fail and an + error will be logged. + items: + description: Argument as part of the AdditionalArgs list. + properties: + name: + description: Name of the argument, e.g. "scrape.discovery-reload-interval". + minLength: 1 + type: string + value: + description: Argument value, e.g. 30s. Can be empty for name-only + arguments (e.g. --storage.tsdb.no-lockfile) + type: string + required: + - name + type: object + type: array + additionalScrapeConfigs: + description: 'AdditionalScrapeConfigs allows specifying a key of a + Secret containing additional Prometheus scrape configurations. Scrape + configurations specified are appended to the configurations generated + by the Prometheus Operator. Job configurations specified must have + the form as specified in the official Prometheus documentation: + https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config. + As scrape configs are appended, the user is responsible to make + sure it is valid. Note that using this feature may expose the possibility + to break upgrades of Prometheus. It is advised to review Prometheus + release notes to ensure that no incompatible scrape configs are + going to break Prometheus after the upgrade.' + properties: + key: + description: The key of the secret to select from. Must be a + valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + affinity: + description: If specified, the pod's scheduling constraints. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the + pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node matches + the corresponding matchExpressions; the node(s) with the + highest sum are the most preferred. + items: + description: An empty preferred scheduling term matches + all objects with implicit weight 0 (i.e. it's a no-op). + A null preferred scheduling term matches no objects (i.e. + is also a no-op). + properties: + preference: + description: A node selector term, associated with the + corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not be + scheduled onto the node. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to an update), the system may or may not try to + eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: A null or empty node selector term matches + no objects. The requirements of them are ANDed. The + TopologySelectorTerm type implements a subset of the + NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: A node selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: Represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists, DoesNotExist. Gt, and + Lt. + type: string + values: + description: An array of string values. If + the operator is In or NotIn, the values + array must be non-empty. If the operator + is Exists or DoesNotExist, the values array + must be empty. If the operator is Gt or + Lt, the values array must have a single + element, which will be interpreted as an + integer. This array is replaced during a + strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate + this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the affinity expressions specified by + this field, but it may choose a node that violates one or + more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node has + pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces field. + null selector and null or empty namespaces list + means "this pod's namespace". An empty selector + ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. The + term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces list + and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey + matches that of any node on which any of the selected + pods is running. Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the affinity requirements specified by this + field are not met at scheduling time, the pod will not be + scheduled onto the node. If the affinity requirements specified + by this field cease to be met at some point during pod execution + (e.g. due to a pod label update), the system may or may + not try to eventually evict the pod from its node. When + there are multiple elements, the lists of nodes corresponding + to each podAffinityTerm are intersected, i.e. all terms + must be satisfied. + items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not co-located + (anti-affinity) with, where co-located is defined as running + on a node whose value of the label with key + matches that of any node on which a pod of the set of + pods is running + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to the + union of the namespaces selected by this field and + the ones listed in the namespaces field. null selector + and null or empty namespaces list means "this pod's + namespace". An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list of namespace + names that the term applies to. The term is applied + to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. null or + empty namespaces list and null namespaceSelector means + "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where + co-located is defined as running on a node whose value + of the label with key topologyKey matches that of + any node on which any of the selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. + avoid putting this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: The scheduler will prefer to schedule pods to + nodes that satisfy the anti-affinity expressions specified + by this field, but it may choose a node that violates one + or more of the expressions. The node that is most preferred + is the one with the greatest sum of weights, i.e. for each + node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, + etc.), compute a sum by iterating through the elements of + this field and adding "weight" to the sum if the node has + pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied + to the union of the namespaces selected by this + field and the ones listed in the namespaces field. + null selector and null or empty namespaces list + means "this pod's namespace". An empty selector + ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: A label selector requirement + is a selector that contains values, a key, + and an operator that relates the key and + values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: operator represents a key's + relationship to a set of values. Valid + operators are In, NotIn, Exists and + DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + the values array must be empty. This + array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is + "In", and the values array contains only "value". + The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list + of namespace names that the term applies to. The + term is applied to the union of the namespaces + listed in this field and the ones selected by + namespaceSelector. null or empty namespaces list + and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching the labelSelector in the specified namespaces, + where co-located is defined as running on a node + whose value of the label with key topologyKey + matches that of any node on which any of the selected + pods is running. Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: weight associated with matching the corresponding + podAffinityTerm, in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: If the anti-affinity requirements specified by + this field are not met at scheduling time, the pod will + not be scheduled onto the node. If the anti-affinity requirements + specified by this field cease to be met at some point during + pod execution (e.g. due to a pod label update), the system + may or may not try to eventually evict the pod from its + node. When there are multiple elements, the lists of nodes + corresponding to each podAffinityTerm are intersected, i.e. + all terms must be satisfied. + items: + description: Defines a set of pods (namely those matching + the labelSelector relative to the given namespace(s)) + that this pod should be co-located (affinity) or not co-located + (anti-affinity) with, where co-located is defined as running + on a node whose value of the label with key + matches that of any node on which a pod of the set of + pods is running + properties: + labelSelector: + description: A label query over a set of resources, + in this case pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaceSelector: + description: A label query over the set of namespaces + that the term applies to. The term is applied to the + union of the namespaces selected by this field and + the ones listed in the namespaces field. null selector + and null or empty namespaces list means "this pod's + namespace". An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a + selector that contains values, a key, and an + operator that relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are + In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string + values. If the operator is In or NotIn, + the values array must be non-empty. If the + operator is Exists or DoesNotExist, the + values array must be empty. This array is + replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, + whose key field is "key", the operator is "In", + and the values array contains only "value". The + requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: namespaces specifies a static list of namespace + names that the term applies to. The term is applied + to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. null or + empty namespaces list and null namespaceSelector means + "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where + co-located is defined as running on a node whose value + of the label with key topologyKey matches that of + any node on which any of the selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + alerting: + description: Define details regarding alerting. + properties: + alertmanagers: + description: AlertmanagerEndpoints Prometheus should fire alerts + against. + items: + description: AlertmanagerEndpoints defines a selection of a + single Endpoints object containing alertmanager IPs to fire + alerts against. + properties: + apiVersion: + description: Version of the Alertmanager API that Prometheus + uses to send alerts. It can be "v1" or "v2". + type: string + authorization: + description: Authorization section for this alertmanager + endpoint + properties: + credentials: + description: The secret's key that contains the credentials + of the request + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: + description: Set the authentication type. Defaults to + Bearer, Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth allow an endpoint to authenticate + over basic authentication + properties: + password: + description: The secret in the service monitor namespace + that contains the password for authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor namespace + that contains the username for authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerTokenFile: + description: BearerTokenFile to read from filesystem to + use when authenticating to Alertmanager. + type: string + enableHttp2: + description: Whether to enable HTTP2. + type: boolean + name: + description: Name of Endpoints object in Namespace. + type: string + namespace: + description: Namespace of Endpoints object. + type: string + pathPrefix: + description: Prefix for the HTTP path alerts are pushed + to. + type: string + port: + anyOf: + - type: integer + - type: string + description: Port the Alertmanager API is exposed on. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use when firing alerts. + type: string + timeout: + description: Timeout is a per-target Alertmanager timeout + when pushing alerts. + pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + tlsConfig: + description: TLS Config to use for alertmanager connection. + properties: + ca: + description: Certificate authority used when verifying + server certificates. + properties: + configMap: + description: ConfigMap containing data to use for + the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the + targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the Prometheus container + to use for the targets. + type: string + cert: + description: Client certificate to present when doing + client-authentication. + properties: + configMap: + description: ConfigMap containing data to use for + the targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the + targets. + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, + kind, uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the Prometheus + container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the Prometheus + container for the targets. + type: string + keySecret: + description: Secret containing the client key file for + the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + required: + - name + - namespace + - port + type: object + type: array + required: + - alertmanagers + type: object + allowOverlappingBlocks: + description: AllowOverlappingBlocks enables vertical compaction and + vertical query merge in Prometheus. This is still experimental in + Prometheus so it may change in any upcoming release. + type: boolean + apiserverConfig: + description: APIServerConfig allows specifying a host and auth methods + to access apiserver. If left empty, Prometheus is assumed to run + inside of the cluster and will discover API servers automatically + and use the pod's CA certificate and bearer token file at /var/run/secrets/kubernetes.io/serviceaccount/. + properties: + authorization: + description: Authorization section for accessing apiserver + properties: + credentials: + description: The secret's key that contains the credentials + of the request + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + credentialsFile: + description: File to read a secret from, mutually exclusive + with Credentials (from SafeAuthorization) + type: string + type: + description: Set the authentication type. Defaults to Bearer, + Basic will cause an error + type: string + type: object + basicAuth: + description: BasicAuth allow an endpoint to authenticate over + basic authentication + properties: + password: + description: The secret in the service monitor namespace that + contains the password for authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + username: + description: The secret in the service monitor namespace that + contains the username for authentication. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + bearerToken: + description: Bearer token for accessing apiserver. + type: string + bearerTokenFile: + description: File to read bearer token for accessing apiserver. + type: string + host: + description: Host of apiserver. A valid string consisting of a + hostname or IP followed by an optional port number + type: string + tlsConfig: + description: TLS Config to use for accessing apiserver. + properties: + ca: + description: Certificate authority used when verifying server + certificates. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + caFile: + description: Path to the CA cert in the Prometheus container + to use for the targets. + type: string + cert: + description: Client certificate to present when doing client-authentication. + properties: + configMap: + description: ConfigMap containing data to use for the + targets. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + secret: + description: Secret containing data to use for the targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + certFile: + description: Path to the client cert file in the Prometheus + container for the targets. + type: string + insecureSkipVerify: + description: Disable target certificate validation. + type: boolean + keyFile: + description: Path to the client key file in the Prometheus + container for the targets. + type: string + keySecret: + description: Secret containing the client key file for the + targets. + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + serverName: + description: Used to verify the hostname for the targets. + type: string + type: object + required: + - host + type: object + arbitraryFSAccessThroughSMs: + description: ArbitraryFSAccessThroughSMs configures whether configuration + based on a service monitor can access arbitrary files on the file + system of the Prometheus container e.g. bearer token files. + properties: + deny: + type: boolean + type: object + baseImage: + description: 'Base image to use for a Prometheus deployment. Deprecated: + use ''image'' instead' + type: string + configMaps: + description: ConfigMaps is a list of ConfigMaps in the same namespace + as the Prometheus object, which shall be mounted into the Prometheus + Pods. Each ConfigMap is added to the StatefulSet definition as a + volume named `configmap-`. The ConfigMaps are mounted + into /etc/prometheus/configmaps/ in the 'prometheus' + container. + items: + type: string + type: array + containers: + description: 'Containers allows injecting additional containers or + modifying operator generated containers. This can be used to allow + adding an authentication proxy to a Prometheus pod or to change + the behavior of an operator generated container. Containers described + here modify an operator generated container if they share the same + name and modifications are done via a strategic merge patch. The + current container names are: `prometheus`, `config-reloader`, and + `thanos-sidecar`. Overriding containers is entirely outside the + scope of what the maintainers will support and by doing so, you + accept that this behaviour may break at any time without notice.' + items: + description: A single application container that you want to run + within a pod. + properties: + args: + description: 'Arguments to the entrypoint. The container image''s + CMD is used if this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If a variable + cannot be resolved, the reference in the input string will + be unchanged. Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + items: + type: string + type: array + command: + description: 'Entrypoint array. Not executed within a shell. + The container image''s ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: + i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether + the variable exists or not. Cannot be updated. More info: + https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + items: + type: string + type: array + env: + description: List of environment variables to set in the container. + Cannot be updated. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be + a C_IDENTIFIER. + type: string + value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in + the container and any service environment variables. + If a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Defaults to "".' + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must be + a C_IDENTIFIER. All invalid keys will be reported as an event + when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take + precedence. Values defined by an Env with a duplicate key + will take precedence. Cannot be updated. + items: + description: EnvFromSource represents the source of a set + of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management + to default or override container images in workload controllers + like Deployments and StatefulSets.' + type: string + imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' + type: string + lifecycle: + description: Actions that the management system should take + in response to container lifecycle events. Cannot be updated. + properties: + postStart: + description: 'PostStart is called immediately after a container + is created. If the handler fails, the container is terminated + and restarted according to its restart policy. Other management + of the container blocks until the hook completes. More + info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's + filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you need + to explicitly call out to that shell. Exit status + of 0 is treated as live/healthy and non-zero is + unhealthy. + items: + type: string + type: array + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in + httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. + type: string + required: + - port + type: object + tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward compatibility. + There are no validation of this field and lifecycle + hooks will fail in runtime when tcp handler is specified. + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, resource + contention, etc. The handler is not called if the container + crashes or exits. The Pod''s termination grace period + countdown begins before the PreStop hook is executed. + Regardless of the outcome of the handler, the container + will eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other management + of the container blocks until the hook completes or until + the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's + filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you need + to explicitly call out to that shell. Exit status + of 0 is treated as live/healthy and non-zero is + unhealthy. + items: + type: string + type: array + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in + httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. + type: string + required: + - port + type: object + tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward compatibility. + There are no validation of this field and lifecycle + hooks will fail in runtime when tcp handler is specified. + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. More + info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: List of ports to expose from the container. Not + specifying a port here DOES NOT prevent that port from being + exposed. Any port which is listening on the default "0.0.0.0" + address inside a container will be accessible from the network. + Modifying this array with strategic merge patch may corrupt + the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + items: + description: ContainerPort represents a network port in a + single container. + properties: + containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < 65536. + format: int32 + type: integer + hostIP: + description: What host IP to bind the external port to. + type: string + hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x < + 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. + format: int32 + type: integer + name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. + type: string + protocol: + default: TCP + description: Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe + fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + securityContext: + description: 'SecurityContext defines the security options the + container should be run with. If set, the fields of SecurityContext + override the equivalent fields of PodSecurityContext. More + info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' + properties: + allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag will + be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be set + when spec.os.name is windows.' + type: boolean + capabilities: + description: The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by + the container runtime. Note that this field cannot be + set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent to + root on the host. Defaults to false. Note that this field + cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: procMount denotes the type of proc mount to + use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: Indicates that the container must run as a + non-root user. If true, the Kubelet will validate the + image at runtime to ensure that it does not run as UID + 0 (root) and fail to start the container if it does. If + unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both + SecurityContext and PodSecurityContext, the value specified + in SecurityContext takes precedence. + type: boolean + runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a + random SELinux context for each container. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name is + windows. + properties: + localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile + must be preconfigured on the node to work. Must be + a descending path, relative to the kubelet's configured + seccomp profile location. Must only be set if type + is "Localhost". + type: string + type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - + a profile defined in a file on the node should be + used. RuntimeDefault - the container runtime default + profile should be used. Unconfined - no profile should + be applied." + type: string + required: + - type + type: object + windowsOptions: + description: The Windows specific settings applied to all + containers. If unspecified, the options from the PodSecurityContext + will be used. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is + linux. + properties: + gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named + by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is + alpha-level and will only be honored by components + that enable the WindowsHostProcessContainers feature + flag. Setting this field without the feature flag + will result in errors when validating the Pod. All + of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. + type: boolean + runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. + type: string + type: object + type: object + startupProbe: + description: 'StartupProbe indicates that the Pod has successfully + initialized. If specified, no other probes are executed until + this completes successfully. If this probe fails, the Pod + will be restarted, just as if the livenessProbe failed. This + can be used to provide different probe parameters at the beginning + of a Pod''s lifecycle, when it might take a long time to load + data or warm a cache, than during steady-state operation. + This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, reads + from stdin in the container will always result in EOF. Default + is false. + type: boolean + stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If this + flag is false, a container processes that reads from stdin + will never receive an EOF. Default is false + type: boolean + terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' + type: string + terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success and + failure. FallbackToLogsOnError will use the last chunk of + container log output if the termination message file is empty + and the container exited with an error. The log output is + limited to 2048 bytes or 80 lines, whichever is smaller. Defaults + to File. Cannot be updated. + type: string + tty: + description: Whether this container should allocate a TTY for + itself, also requires 'stdin' to be true. Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices to be + used by the container. + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Cannot be updated. + items: + description: VolumeMount describes a mounting of a Volume + within a container. + properties: + mountPath: + description: Path within the container at which the volume + should be mounted. Must not contain ':'. + type: string + mountPropagation: + description: mountPropagation determines how mounts are + propagated from the host to container and the other + way around. When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. + type: boolean + subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's root). + type: string + subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves similarly + to SubPath but environment variable references $(VAR_NAME) + are expanded using the container's environment. Defaults + to "" (volume's root). SubPathExpr and SubPath are mutually + exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. + type: string + required: + - name + type: object + type: array + disableCompaction: + description: Disable prometheus compaction. + type: boolean + enableAdminAPI: + description: 'Enable access to prometheus web admin API. Defaults + to the value of `false`. WARNING: Enabling the admin APIs enables + mutating endpoints, to delete data, shutdown Prometheus, and more. + Enabling this should be done with care and the user is advised to + add additional authentication authorization via a proxy to ensure + only clients authorized to perform these actions can do so. For + more information see https://prometheus.io/docs/prometheus/latest/querying/api/#tsdb-admin-apis' + type: boolean + enableFeatures: + description: Enable access to Prometheus disabled features. By default, + no features are enabled. Enabling disabled features is entirely + outside the scope of what the maintainers will support and by doing + so, you accept that this behaviour may break at any time without + notice. For more information see https://prometheus.io/docs/prometheus/latest/disabled_features/ + items: + type: string + type: array + enableRemoteWriteReceiver: + description: 'Enable Prometheus to be used as a receiver for the Prometheus + remote write protocol. Defaults to the value of `false`. WARNING: + This is not considered an efficient way of ingesting samples. Use + it with caution for specific low-volume use cases. It is not suitable + for replacing the ingestion via scraping and turning Prometheus + into a push-based metrics collection system. For more information + see https://prometheus.io/docs/prometheus/latest/querying/api/#remote-write-receiver + Only valid in Prometheus versions 2.33.0 and newer.' + type: boolean + enforcedBodySizeLimit: + description: 'EnforcedBodySizeLimit defines the maximum size of uncompressed + response body that will be accepted by Prometheus. Targets responding + with a body larger than this many bytes will cause the scrape to + fail. Example: 100MB. If defined, the limit will apply to all service/pod + monitors and probes. This is an experimental feature, this behaviour + could change or be removed in the future. Only valid in Prometheus + versions 2.28.0 and newer.' + pattern: (^0|([0-9]*[.])?[0-9]+((K|M|G|T|E|P)i?)?B)$ + type: string + enforcedLabelLimit: + description: Per-scrape limit on number of labels that will be accepted + for a sample. If more than this number of labels are present post + metric-relabeling, the entire scrape will be treated as failed. + 0 means no limit. Only valid in Prometheus versions 2.27.0 and newer. + format: int64 + type: integer + enforcedLabelNameLengthLimit: + description: Per-scrape limit on length of labels name that will be + accepted for a sample. If a label name is longer than this number + post metric-relabeling, the entire scrape will be treated as failed. + 0 means no limit. Only valid in Prometheus versions 2.27.0 and newer. + format: int64 + type: integer + enforcedLabelValueLengthLimit: + description: Per-scrape limit on length of labels value that will + be accepted for a sample. If a label value is longer than this number + post metric-relabeling, the entire scrape will be treated as failed. + 0 means no limit. Only valid in Prometheus versions 2.27.0 and newer. + format: int64 + type: integer + enforcedNamespaceLabel: + description: "EnforcedNamespaceLabel If set, a label will be added + to \n 1. all user-metrics (created by `ServiceMonitor`, `PodMonitor` + and `Probe` objects) and 2. in all `PrometheusRule` objects (except + the ones excluded in `prometheusRulesExcludedFromEnforce`) to * + alerting & recording rules and * the metrics used in their expressions + (`expr`). \n Label name is this field's value. Label value is the + namespace of the created object (mentioned above)." + type: string + enforcedSampleLimit: + description: EnforcedSampleLimit defines global limit on number of + scraped samples that will be accepted. This overrides any SampleLimit + set per ServiceMonitor or/and PodMonitor. It is meant to be used + by admins to enforce the SampleLimit to keep overall number of samples/series + under the desired limit. Note that if SampleLimit is lower that + value will be taken instead. + format: int64 + type: integer + enforcedTargetLimit: + description: EnforcedTargetLimit defines a global limit on the number + of scraped targets. This overrides any TargetLimit set per ServiceMonitor + or/and PodMonitor. It is meant to be used by admins to enforce + the TargetLimit to keep the overall number of targets under the + desired limit. Note that if TargetLimit is lower, that value will + be taken instead, except if either value is zero, in which case + the non-zero value will be used. If both values are zero, no limit + is enforced. + format: int64 + type: integer + evaluationInterval: + default: 30s + description: 'Interval between consecutive evaluations. Default: `30s`' + pattern: ^(0|(([0-9]+)y)?(([0-9]+)w)?(([0-9]+)d)?(([0-9]+)h)?(([0-9]+)m)?(([0-9]+)s)?(([0-9]+)ms)?)$ + type: string + excludedFromEnforcement: + description: List of references to PodMonitor, ServiceMonitor, Probe + and PrometheusRule objects to be excluded from enforcing a namespace + label of origin. Applies only if enforcedNamespaceLabel set to true. + items: + description: ObjectReference references a PodMonitor, ServiceMonitor, + Probe or PrometheusRule object. + properties: + group: + default: monitoring.coreos.com + description: Group of the referent. When not specified, it defaults + to `monitoring.coreos.com` + enum: + - monitoring.coreos.com + type: string + name: + description: Name of the referent. When not set, all resources + are matched. + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + minLength: 1 + type: string + resource: + description: Resource of the referent. + enum: + - prometheusrules + - servicemonitors + - podmonitors + - probes + type: string + required: + - namespace + - resource + type: object + type: array + exemplars: + description: Exemplars related settings that are runtime reloadable. + It requires to enable the exemplar storage feature to be effective. + properties: + maxSize: + description: Maximum number of exemplars stored in memory for + all series. If not set, Prometheus uses its default value. A + value of zero or less than zero disables the storage. + format: int64 + type: integer + type: object + externalLabels: + additionalProperties: + type: string + description: The labels to add to any time series or alerts when communicating + with external systems (federation, remote storage, Alertmanager). + type: object + externalUrl: + description: The external URL the Prometheus instances will be available + under. This is necessary to generate correct URLs. This is necessary + if Prometheus is not served from root of a DNS name. + type: string + hostAliases: + description: Pods' hostAliases configuration + items: + description: HostAlias holds the mapping between IP and hostnames + that will be injected as an entry in the pod's hosts file. + properties: + hostnames: + description: Hostnames for the above IP address. + items: + type: string + type: array + ip: + description: IP address of the host file entry. + type: string + required: + - hostnames + - ip + type: object + type: array + x-kubernetes-list-map-keys: + - ip + x-kubernetes-list-type: map + hostNetwork: + description: Use the host's network namespace if true. Make sure to + understand the security implications if you want to enable it. When + hostNetwork is enabled, this will set dnsPolicy to ClusterFirstWithHostNet + automatically. + type: boolean + ignoreNamespaceSelectors: + description: IgnoreNamespaceSelectors if set to true will ignore NamespaceSelector + settings from all PodMonitor, ServiceMonitor and Probe objects. + They will only discover endpoints within the namespace of the PodMonitor, + ServiceMonitor and Probe objects. Defaults to false. + type: boolean + image: + description: Image if specified has precedence over baseImage, tag + and sha combinations. Specifying the version is still necessary + to ensure the Prometheus Operator knows what version of Prometheus + is being configured. + type: string + imagePullPolicy: + description: Image pull policy for the 'prometheus', 'init-config-reloader' + and 'config-reloader' containers. See https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy + for more details. + enum: + - "" + - Always + - Never + - IfNotPresent + type: string + imagePullSecrets: + description: An optional list of references to secrets in the same + namespace to use for pulling prometheus and alertmanager images + from registries see http://kubernetes.io/docs/user-guide/images#specifying-imagepullsecrets-on-a-pod + items: + description: LocalObjectReference contains enough information to + let you locate the referenced object inside the same namespace. + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + type: array + initContainers: + description: 'InitContainers allows adding initContainers to the pod + definition. Those can be used to e.g. fetch secrets for injection + into the Prometheus configuration from external sources. Any errors + during the execution of an initContainer will lead to a restart + of the Pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + InitContainers described here modify an operator generated init + containers if they share the same name and modifications are done + via a strategic merge patch. The current init container name is: + `init-config-reloader`. Overriding init containers is entirely outside + the scope of what the maintainers will support and by doing so, + you accept that this behaviour may break at any time without notice.' + items: + description: A single application container that you want to run + within a pod. + properties: + args: + description: 'Arguments to the entrypoint. The container image''s + CMD is used if this is not provided. Variable references $(VAR_NAME) + are expanded using the container''s environment. If a variable + cannot be resolved, the reference in the input string will + be unchanged. Double $$ are reduced to a single $, which allows + for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references + will never be expanded, regardless of whether the variable + exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + items: + type: string + type: array + command: + description: 'Entrypoint array. Not executed within a shell. + The container image''s ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container''s + environment. If a variable cannot be resolved, the reference + in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: + i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether + the variable exists or not. Cannot be updated. More info: + https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + items: + type: string + type: array + env: + description: List of environment variables to set in the container. + Cannot be updated. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be + a C_IDENTIFIER. + type: string + value: + description: 'Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in + the container and any service environment variables. + If a variable cannot be resolved, the reference in the + input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. "$$(VAR_NAME)" will produce the string + literal "$(VAR_NAME)". Escaped references will never + be expanded, regardless of whether the variable exists + or not. Defaults to "".' + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: 'Selects a field of the pod: supports + metadata.name, metadata.namespace, `metadata.labels['''']`, + `metadata.annotations['''']`, spec.nodeName, + spec.serviceAccountName, status.hostIP, status.podIP, + status.podIPs.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: 'Selects a resource of the container: + only resources limits and requests (limits.cpu, + limits.memory, limits.ephemeral-storage, requests.cpu, + requests.memory and requests.ephemeral-storage) + are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: 'Name of the referent. More info: + https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + envFrom: + description: List of sources to populate environment variables + in the container. The keys defined within a source must be + a C_IDENTIFIER. All invalid keys will be reported as an event + when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take + precedence. Values defined by an Env with a duplicate key + will take precedence. Cannot be updated. + items: + description: EnvFromSource represents the source of a set + of ConfigMaps + properties: + configMapRef: + description: The ConfigMap to select from + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + type: object + x-kubernetes-map-type: atomic + prefix: + description: An optional identifier to prepend to each + key in the ConfigMap. Must be a C_IDENTIFIER. + type: string + secretRef: + description: The Secret to select from + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, + uid?' + type: string + optional: + description: Specify whether the Secret must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + type: object + type: array + image: + description: 'Container image name. More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management + to default or override container images in workload controllers + like Deployments and StatefulSets.' + type: string + imagePullPolicy: + description: 'Image pull policy. One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent + otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images' + type: string + lifecycle: + description: Actions that the management system should take + in response to container lifecycle events. Cannot be updated. + properties: + postStart: + description: 'PostStart is called immediately after a container + is created. If the handler fails, the container is terminated + and restarted according to its restart policy. Other management + of the container blocks until the hook completes. More + info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's + filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you need + to explicitly call out to that shell. Exit status + of 0 is treated as live/healthy and non-zero is + unhealthy. + items: + type: string + type: array + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in + httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. + type: string + required: + - port + type: object + tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward compatibility. + There are no validation of this field and lifecycle + hooks will fail in runtime when tcp handler is specified. + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + preStop: + description: 'PreStop is called immediately before a container + is terminated due to an API request or management event + such as liveness/startup probe failure, preemption, resource + contention, etc. The handler is not called if the container + crashes or exits. The Pod''s termination grace period + countdown begins before the PreStop hook is executed. + Regardless of the outcome of the handler, the container + will eventually terminate within the Pod''s termination + grace period (unless delayed by finalizers). Other management + of the container blocks until the hook completes or until + the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for + the command is root ('/') in the container's + filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions + ('|', etc) won't work. To use a shell, you need + to explicitly call out to that shell. Exit status + of 0 is treated as live/healthy and non-zero is + unhealthy. + items: + type: string + type: array + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to + the pod IP. You probably want to set "Host" in + httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the + host. Defaults to HTTP. + type: string + required: + - port + type: object + tcpSocket: + description: Deprecated. TCPSocket is NOT supported + as a LifecycleHandler and kept for the backward compatibility. + There are no validation of this field and lifecycle + hooks will fail in runtime when tcp handler is specified. + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access + on the container. Number must be in the range + 1 to 65535. Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + type: object + type: object + livenessProbe: + description: 'Periodic probe of container liveness. Container + will be restarted if the probe fails. Cannot be updated. More + info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + name: + description: Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: List of ports to expose from the container. Not + specifying a port here DOES NOT prevent that port from being + exposed. Any port which is listening on the default "0.0.0.0" + address inside a container will be accessible from the network. + Modifying this array with strategic merge patch may corrupt + the data. For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + items: + description: ContainerPort represents a network port in a + single container. + properties: + containerPort: + description: Number of port to expose on the pod's IP + address. This must be a valid port number, 0 < x < 65536. + format: int32 + type: integer + hostIP: + description: What host IP to bind the external port to. + type: string + hostPort: + description: Number of port to expose on the host. If + specified, this must be a valid port number, 0 < x < + 65536. If HostNetwork is specified, this must match + ContainerPort. Most containers do not need this. + format: int32 + type: integer + name: + description: If specified, this must be an IANA_SVC_NAME + and unique within the pod. Each named port in a pod + must have a unique name. Name for the port that can + be referred to by services. + type: string + protocol: + default: TCP + description: Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + required: + - containerPort + type: object + type: array + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: 'Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe + fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + resources: + description: 'Compute Resources required by this container. + Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + properties: + claims: + description: "Claims lists the names of resources, defined + in spec.resourceClaims, that are used by this container. + \n This is an alpha field and requires enabling the DynamicResourceAllocation + feature gate. \n This field is immutable." + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: Name must match the name of one entry + in pod.spec.resourceClaims of the Pod where this + field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. If Requests is omitted for a container, + it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. More info: + https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + securityContext: + description: 'SecurityContext defines the security options the + container should be run with. If set, the fields of SecurityContext + override the equivalent fields of PodSecurityContext. More + info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' + properties: + allowPrivilegeEscalation: + description: 'AllowPrivilegeEscalation controls whether + a process can gain more privileges than its parent process. + This bool directly controls if the no_new_privs flag will + be set on the container process. AllowPrivilegeEscalation + is true always when the container is: 1) run as Privileged + 2) has CAP_SYS_ADMIN Note that this field cannot be set + when spec.os.name is windows.' + type: boolean + capabilities: + description: The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by + the container runtime. Note that this field cannot be + set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: Run container in privileged mode. Processes + in privileged containers are essentially equivalent to + root on the host. Defaults to false. Note that this field + cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: procMount denotes the type of proc mount to + use for the containers. The default is DefaultProcMount + which uses the container runtime defaults for readonly + paths and masked paths. This requires the ProcMountType + feature flag to be enabled. Note that this field cannot + be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: Whether this container has a read-only root + filesystem. Default is false. Note that this field cannot + be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: The GID to run the entrypoint of the container + process. Uses runtime default if unset. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: Indicates that the container must run as a + non-root user. If true, the Kubelet will validate the + image at runtime to ensure that it does not run as UID + 0 (root) and fail to start the container if it does. If + unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both + SecurityContext and PodSecurityContext, the value specified + in SecurityContext takes precedence. + type: boolean + runAsUser: + description: The UID to run the entrypoint of the container + process. Defaults to user specified in image metadata + if unspecified. May also be set in PodSecurityContext. If + set in both SecurityContext and PodSecurityContext, the + value specified in SecurityContext takes precedence. Note + that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a + random SELinux context for each container. May also be + set in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. Note that this field cannot be set when + spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: The seccomp options to use by this container. + If seccomp options are provided at both the pod & container + level, the container options override the pod options. + Note that this field cannot be set when spec.os.name is + windows. + properties: + localhostProfile: + description: localhostProfile indicates a profile defined + in a file on the node should be used. The profile + must be preconfigured on the node to work. Must be + a descending path, relative to the kubelet's configured + seccomp profile location. Must only be set if type + is "Localhost". + type: string + type: + description: "type indicates which kind of seccomp profile + will be applied. Valid options are: \n Localhost - + a profile defined in a file on the node should be + used. RuntimeDefault - the container runtime default + profile should be used. Unconfined - no profile should + be applied." + type: string + required: + - type + type: object + windowsOptions: + description: The Windows specific settings applied to all + containers. If unspecified, the options from the PodSecurityContext + will be used. If set in both SecurityContext and PodSecurityContext, + the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is + linux. + properties: + gmsaCredentialSpec: + description: GMSACredentialSpec is where the GMSA admission + webhook (https://github.com/kubernetes-sigs/windows-gmsa) + inlines the contents of the GMSA credential spec named + by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: HostProcess determines if a container should + be run as a 'Host Process' container. This field is + alpha-level and will only be honored by components + that enable the WindowsHostProcessContainers feature + flag. Setting this field without the feature flag + will result in errors when validating the Pod. All + of a Pod's containers must have the same effective + HostProcess value (it is not allowed to have a mix + of HostProcess containers and non-HostProcess containers). In + addition, if HostProcess is true then HostNetwork + must also be set to true. + type: boolean + runAsUserName: + description: The UserName in Windows to run the entrypoint + of the container process. Defaults to the user specified + in image metadata if unspecified. May also be set + in PodSecurityContext. If set in both SecurityContext + and PodSecurityContext, the value specified in SecurityContext + takes precedence. + type: string + type: object + type: object + startupProbe: + description: 'StartupProbe indicates that the Pod has successfully + initialized. If specified, no other probes are executed until + this completes successfully. If this probe fails, the Pod + will be restarted, just as if the livenessProbe failed. This + can be used to provide different probe parameters at the beginning + of a Pod''s lifecycle, when it might take a long time to load + data or warm a cache, than during steady-state operation. + This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + properties: + exec: + description: Exec specifies the action to take. + properties: + command: + description: Command is the command line to execute + inside the container, the working directory for the + command is root ('/') in the container's filesystem. + The command is simply exec'd, it is not run inside + a shell, so traditional shell instructions ('|', etc) + won't work. To use a shell, you need to explicitly + call out to that shell. Exit status of 0 is treated + as live/healthy and non-zero is unhealthy. + items: + type: string + type: array + type: object + failureThreshold: + description: Minimum consecutive failures for the probe + to be considered failed after having succeeded. Defaults + to 3. Minimum value is 1. + format: int32 + type: integer + grpc: + description: GRPC specifies an action involving a GRPC port. + This is a beta field and requires enabling GRPCContainerProbe + feature gate. + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + format: int32 + type: integer + service: + description: "Service is the name of the service to + place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + \n If this is not specified, the default behavior + is defined by gRPC." + type: string + required: + - port + type: object + httpGet: + description: HTTPGet specifies the http request to perform. + properties: + host: + description: Host name to connect to, defaults to the + pod IP. You probably want to set "Host" in httpHeaders + instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + properties: + name: + description: The header field name + type: string + value: + description: The header field value + type: string + required: + - name + - value + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + anyOf: + - type: integer + - type: string + description: Name or number of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + scheme: + description: Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + required: + - port + type: object + initialDelaySeconds: + description: 'Number of seconds after the container has + started before liveness probes are initiated. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + format: int32 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe + to be considered successful after having failed. Defaults + to 1. Must be 1 for liveness and startup. Minimum value + is 1. + format: int32 + type: integer + tcpSocket: + description: TCPSocket specifies an action involving a TCP + port. + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + anyOf: + - type: integer + - type: string + description: Number or name of the port to access on + the container. Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + x-kubernetes-int-or-string: true + required: + - port + type: object + terminationGracePeriodSeconds: + description: Optional duration in seconds the pod needs + to terminate gracefully upon probe failure. The grace + period is the duration in seconds after the processes + running in the pod are sent a termination signal and the + time when the processes are forcibly halted with a kill + signal. Set this value longer than the expected cleanup + time for your process. If this value is nil, the pod's + terminationGracePeriodSeconds will be used. Otherwise, + this value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates + stop immediately via the kill signal (no opportunity to + shut down). This is a beta field and requires enabling + ProbeTerminationGracePeriod feature gate. Minimum value + is 1. spec.terminationGracePeriodSeconds is used if unset. + format: int64 + type: integer + timeoutSeconds: + description: 'Number of seconds after which the probe times + out. Defaults to 1 second. Minimum value is 1. More info: + https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + format: int32 + type: integer + type: object + stdin: + description: Whether this container should allocate a buffer + for stdin in the container runtime. If this is not set, reads + from stdin in the container will always result in EOF. Default + is false. + type: boolean + stdinOnce: + description: Whether the container runtime should close the + stdin channel after it has been opened by a single attach. + When stdin is true the stdin stream will remain open across + multiple attach sessions. If stdinOnce is set to true, stdin + is opened on container start, is empty until the first client + attaches to stdin, and then remains open and accepts data + until the client disconnects, at which time stdin is closed + and remains closed until the container is restarted. If this + flag is false, a container processes that reads from stdin + will never receive an EOF. Default is false + type: boolean + terminationMessagePath: + description: 'Optional: Path at which the file to which the + container''s termination message will be written is mounted + into the container''s filesystem. Message written is intended + to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. + The total message length across all containers will be limited + to 12kb. Defaults to /dev/termination-log. Cannot be updated.' + type: string + terminationMessagePolicy: + description: Indicate how the termination message should be + populated. File will use the contents of terminationMessagePath + to populate the container status message on both success and + failure. FallbackToLogsOnError will use the last chunk of + container log output if the termination message file is empty + and the container exited with an error. The log output is + limited to 2048 bytes or 80 lines, whichever is smaller. Defaults + to File. Cannot be updated. + type: string + tty: + description: Whether this container should allocate a TTY for + itself, also requires 'stdin' to be true. Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices to be + used by the container. + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + required: + - devicePath + - name + type: object + type: array + volumeMounts: + description: Pod volumes to mount into the container's filesystem. + Cannot be updated. + items: + description: VolumeMount describes a mounting of a Volume + within a container. + properties: + mountPath: + description: Path within the container at which the volume + should be mounted. Must not contain ':'. + type: string + mountPropagation: + description: mountPropagation determines how mounts are + propagated from the host to container and the other + way around. When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: Mounted read-only if true, read-write otherwise + (false or unspecified). Defaults to false. + type: boolean + subPath: + description: Path within the volume from which the container's + volume should be mounted. Defaults to "" (volume's root). + type: string + subPathExpr: + description: Expanded path within the volume from which + the container's volume should be mounted. Behaves similarly + to SubPath but environment variable references $(VAR_NAME) + are expanded using the container's environment. Defaults + to "" (volume's root). SubPathExpr and SubPath are mutually + exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + workingDir: + description: Container's working directory. If not specified, + the container runtime's default will be used, which might + be configured in the container image. Cannot be updated. + type: string + required: + - name + type: object + type: array + listenLocal: + description: ListenLocal makes the Prometheus server listen on loopback, + so that it does not bind against the Pod IP. + type: boolean + logFormat: + description: Log format for Prometheus to be configured with. + enum: + - "" + - logfmt + - json + type: string + logLevel: + description: Log level for Prometheus to be configured with. + enum: + - "" + - debug + - info + - warn + - error + type: string + minReadySeconds: + description: Minimum number of seconds for which a newly created pod + should be ready without any of its container crashing for it to + be considered available. Defaults to 0 (pod will be considered available + as soon as it is ready) This is an alpha field from kubernetes 1.22 + until 1.24 which requires enabling the StatefulSetMinReadySeconds + feature gate. + format: int32 + type: integer + nodeSelector: + additionalProperties: + type: string + description: Define which Nodes the Pods are scheduled on. + type: object + overrideHonorLabels: + description: When true, Prometheus resolves label conflicts by renaming + the labels in the scraped data to "exported_