From bfd969adc8ebe80f8a52fa5f8efd2d1966d7b89d Mon Sep 17 00:00:00 2001 From: Arvind Iyengar Date: Wed, 17 Aug 2022 10:37:24 -0700 Subject: [PATCH] Forward port 2.5.16 charts Related PR: https://github.com/rancher/charts/pull/2034 --- .../rancher-logging-crd-3.17.700+up3.17.7.tgz | Bin 0 -> 79470 bytes .../rancher-logging-3.17.700+up3.17.7.tgz | Bin 0 -> 13782 bytes .../rancher-webhook-0.1.500+up0.1.5.tgz | Bin 0 -> 2027 bytes .../3.17.700+up3.17.7/Chart.yaml | 10 + .../3.17.700+up3.17.7/README.md | 2 + ...xtensions.banzaicloud.io_eventtailers.yaml | 2123 +++ ...extensions.banzaicloud.io_hosttailers.yaml | 2305 +++ .../logging.banzaicloud.io_clusterflows.yaml | 1684 +++ ...logging.banzaicloud.io_clusteroutputs.yaml | 11638 ++++++++++++++++ .../logging.banzaicloud.io_flows.yaml | 1676 +++ .../logging.banzaicloud.io_loggings.yaml | 9194 ++++++++++++ .../logging.banzaicloud.io_outputs.yaml | 11626 +++++++++++++++ .../3.17.700+up3.17.7/.helmignore | 22 + .../3.17.700+up3.17.7/Chart.yaml | 25 + .../3.17.700+up3.17.7/README.md | 132 + .../3.17.700+up3.17.7/app-readme.md | 27 + .../3.17.700+up3.17.7/templates/NOTES.txt | 0 .../templates/_generic_logging.yaml | 116 + .../3.17.700+up3.17.7/templates/_helpers.tpl | 179 + .../templates/clusterrole.yaml | 318 + .../templates/clusterrolebinding.yaml | 18 + .../3.17.700+up3.17.7/templates/crds.yaml | 6 + .../templates/deployment.yaml | 69 + .../templates/loggings/aks/logging.yaml | 18 + .../templates/loggings/eks/logging.yaml | 19 + .../templates/loggings/gke/logging.yaml | 18 + .../templates/loggings/k3s/configmap.yaml | 57 + .../templates/loggings/k3s/daemonset.yaml | 110 + .../loggings/k3s/logging-k3s-openrc.yaml | 19 + .../loggings/kube-audit/logging.yaml | 24 + .../templates/loggings/rke/configmap.yaml | 29 + .../templates/loggings/rke/daemonset.yaml | 122 + .../templates/loggings/rke2/configmap.yaml | 69 + .../templates/loggings/rke2/daemonset.yaml | 116 + .../templates/loggings/root/logging.yaml | 82 + .../3.17.700+up3.17.7/templates/psp.yaml | 34 + .../3.17.700+up3.17.7/templates/service.yaml | 20 + .../templates/serviceMonitor.yaml | 30 + .../templates/serviceaccount.yaml | 14 + .../templates/userroles.yaml | 35 + .../templates/validate-install-crd.yaml | 20 + .../templates/validate-install.yaml | 5 + .../3.17.700+up3.17.7/values.yaml | 244 + .../0.1.500+up0.1.5/Chart.yaml | 12 + .../0.1.500+up0.1.5/templates/_helpers.tpl | 11 + .../0.1.500+up0.1.5/templates/deployment.yaml | 26 + .../pre-delete-hook-cluster-role-binding.yaml | 19 + .../pre-delete-hook-cluster-role.yaml | 23 + .../templates/pre-delete-hook-job.yaml | 28 + .../templates/pre-delete-hook-psp.yaml | 33 + .../pre-delete-hook-service-account.yaml | 12 + .../0.1.500+up0.1.5/templates/rbac.yaml | 12 + .../0.1.500+up0.1.5/templates/service.yaml | 13 + .../templates/serviceaccount.yaml | 4 + .../0.1.500+up0.1.5/templates/webhook.yaml | 19 + .../0.1.500+up0.1.5/values.yaml | 14 + index.yaml | 59 + release.yaml | 3 + 58 files changed, 42543 insertions(+) create mode 100644 assets/rancher-logging-crd/rancher-logging-crd-3.17.700+up3.17.7.tgz create mode 100644 assets/rancher-logging/rancher-logging-3.17.700+up3.17.7.tgz create mode 100644 assets/rancher-webhook/rancher-webhook-0.1.500+up0.1.5.tgz create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/Chart.yaml create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/README.md create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/templates/logging-extensions.banzaicloud.io_eventtailers.yaml create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/templates/logging-extensions.banzaicloud.io_hosttailers.yaml create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/templates/logging.banzaicloud.io_clusterflows.yaml create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/templates/logging.banzaicloud.io_clusteroutputs.yaml create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/templates/logging.banzaicloud.io_flows.yaml create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/templates/logging.banzaicloud.io_loggings.yaml create mode 100644 charts/rancher-logging-crd/3.17.700+up3.17.7/templates/logging.banzaicloud.io_outputs.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/.helmignore create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/Chart.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/README.md create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/app-readme.md create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/NOTES.txt create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/_generic_logging.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/_helpers.tpl create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/clusterrole.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/clusterrolebinding.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/crds.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/deployment.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/aks/logging.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/eks/logging.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/gke/logging.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/configmap.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/daemonset.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/logging-k3s-openrc.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/kube-audit/logging.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke/configmap.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke/daemonset.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke2/configmap.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke2/daemonset.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/root/logging.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/psp.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/service.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/serviceMonitor.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/serviceaccount.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/userroles.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/validate-install-crd.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/templates/validate-install.yaml create mode 100644 charts/rancher-logging/3.17.700+up3.17.7/values.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/Chart.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/_helpers.tpl create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/deployment.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-cluster-role-binding.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-cluster-role.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-job.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-psp.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-service-account.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/rbac.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/service.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/serviceaccount.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/templates/webhook.yaml create mode 100644 charts/rancher-webhook/0.1.500+up0.1.5/values.yaml diff --git a/assets/rancher-logging-crd/rancher-logging-crd-3.17.700+up3.17.7.tgz b/assets/rancher-logging-crd/rancher-logging-crd-3.17.700+up3.17.7.tgz new file mode 100644 index 0000000000000000000000000000000000000000..7b9f61731ff39c45a4814c63d727eebf33d68f0f GIT binary patch literal 79470 zcma&O18`-*+vgull8J5GwvCBx+qOBeZQFJ-v7MV_V%v5$^Luyezwdu*tG289_UY&L zt<$GYb@%gp`r8*j@+S(=zw|{3L~S6U$Y3NP!zS&)$!f@~%3!R-YN4sb$tI_&$|j>` zZE0X@?4hh+$17oCZ3A@vp_Pc!T2BFWmfl;?f5W@76_NjYaVnG^&PGyK%0R<3tYImr z6&^$@*}ivqYT2lKM|>n*(F-lhXuB5#&iM)ojr&_a1PMZ%cu*07B#RllZ4mnK+K zJGtcb{UQPT={Bc!-%Mls^*f!>_nv=x`S^TX_b%&ozuq>g>GgabW-iz2`F*@*&eZ7n zxO}|6HturCJ^7kf?Hx9rjrs6qt&4+bQ(m+oYyM@Yk0{uWk?MBWa6BUELV3MIib8e* z24ouMB_~d$6jTUwQ+{qsgZgp&6}drO$w<8}IsR%R-pT>W}cmWnV)|8>G3@1mi#HdyV6&Yy8PqY^FqDODSy#)F@dRu-$qev zTahZntRCbT0}VMGQx9|X;`i~8`u+Q%o$sqD^kuz;7e5$x2NxF?`(St4N7uK*nHJuV zGc|hK;EGKYJM6RjQ?t4bMpADGr+g7N8r5z0AzZukQP3Pklw#FsbILw#T7m8^3sVNG z;Hp2)qphV+uLo-MwOVZYd2jFN^&n@@6~0PkV&mwdbGeJ41<>=y&|1QO;fxKOm3k@r z@$Wxig09Fvebx@>by7F0aGnkd(S#-s9m9eml3QeM1TYI)-vyJ zKm>o*FnDkfV62wM$!EnMd*Dj$oleyoxYPlHL8=}cY^jIYlP$21{|IgSa))ZfM=yBE z7Ic$!UBI3e9y_M`#5a?;V>Of$y@Bz1V%}fJ@+7@qI}_E-4k~{gy%tml>Oh~7A<#%Y z&GR;5d6nZ!b9Xor*9jVJQZtD-*for%E&$xuE*N;mQqP4stD#Zq==AHy4ABmnXSt1j zemu!q%u%nunm$M;e@`uV z>hDKW1SdTrdHM%#u9PAxj!WS5PYG-}Xc3%u#;HH%X1|yi5}6gHYQM)}UuA`t;odFo zY1oewG`VK;jOunL{l(1PuaCX2&)Bc_*9E=L=Mg_0y$}BHI{)WY>c-dm*Vlb2|HsTB z{?|<@|Hn=2*X!EW*IlaH)|b}%iQi{&20-Sk_UmP@cl*tcIR5=a&hO>R13cL~3ZXQQ z*FxW7jjzH6nx#&jO|0#$Rg<#~yB)XxC|#=DZVR&>4GHbKo3{PD?cjOyaWBJyHlQ+I zm9+LnT4INsc%5{-GIC)fvVf_hr%8bjL$Ld=`AmZ0V=G(7d#7!ZIEA3}6j1GF{{F{| zW@j%HWVaEZDL!4y$Lg!mDce1Gt^4ePym}SW7~_ebHf;o>B?Ldj^72#R%A-3AWF0uU z4m@3Sl2!9?w)eLwCj#pxt{|}xjtsO(x!MDF;Zc7p)F|&9X=?Q=;$UcwaEr>&=m%{9 zWu*tTa2;g-6DwZce7M`IkXT;nON^_tNyxaFo3xF9kGm{zN^OoH7N~!EJ8*dlMR?@v0K-rPF^7hV?IA;vB2qk6>z&{x|@N2i)5kdlZETUQ4=( zMk(;jlUsA@Nr4D7e{B2e#icoPEH3)5?$QI+nUSEg6FIG|yZBhS>F%YLg&p6EnBkjJ z-;7X|i_2bQVrYCmdg?L}WR%UWOw%EVXN9U@@g%6@Z1rm7awpxq;q)Rq@X_XOnw94> z0r#s9dg!p?M=3PHAD;`pfM|LbgJI0IJDpTdULv57)FO6%S>J_J?WzVyskBH0FI2hdM7IT!DX`yUmY#Kg`%^TQ`w3RJWwymCCjdM;X_+tHTubPcr@$U3$+uiZ_R)Ob3 zA?PO&bd9(^ZBghoz8y{&shr-WM=C&nfAgoFfTY@WH97>G+!oZKK8*4f>xED^eX2aG zV%ZQpbaAWS=O^4a**%OSxZ0hsbDj`*i2I~y0?M55J}(A$6&}%k1Rhe&8j;{|+M-5Q z*SFbH4ok1<$GmV9&OE3p*59U>xL=-O3DS@JeKTF$ynd(zK70+K0uZ5a(|kN5LCAnU z+OQ!e1hH9AJ{~(i3=U98z8Fh4J&4RlC1{q&MQ$Olx^xLR4Tza6O^1sQeV`XGm_zBD zDNR8lc!$dce54~d&~P4S`xw5Wpu}cS8q0I;)42=o4d3wa)mZ>@{p>l}YRx65amqBo zGu}gB(&jHlK@O^U4mqq^dc|iS#*nGv+mG<vy||YJ?v)8PKcu%cP(wdFf=9PkXhXlvK3%rA!exB;*|Qno?~E~f zCRbwcAW#AT9&M5=0dxcF=2#@Fqo9R}%HZSIQy41Tza}yz#C|=H&*m+TJLHQ|yUNP? z#g=785)kdD7^q5DJsWy1c~LGQlu50FK4#o6Q^X9Y=%1lJ*+Yh6_)uH}qCy`LBY1Vo zpO)D#2`}fEl+)`&oiZrn0I^SqW{3HkOwn&2M8_oR*zKWdGEmDq>-faCad}o`PY4dG zdtlDis0VmRKhT{;4+imeMO2le4`h_2ix2P;ikP$VkZZcTVv*bJ)i<4fmD`e=B@QWD zT<+|0>L|k=;Y~YH5>;~LI{kd+nmNJ&E4X!nm-Bt&8EE`s31z7dbcSzBh<+m$QlM-o zxu3&m$VOQ_HK9~gWmoK3P)rJAG70lE3smOUc2fM1cpwJMFv}`_Fg*xVZ1Kq=eGLaF z^Z&DZ#hB$P_sUGf3O@*=1`OblXal!3wR-PkhVv4}AMFL6`N{CK9XI}_eHL4LN3>(E zNDpaX?BD1GjQ3?fl?*r{&=vRimWPYlROp%w@YI8GBXFhbaoliB`xO(`GctJ>wbB>L+hwg z5D)99l940)etCUtqOR3Qz`y#pF=y{Dxm@)3TN_Xc%DOkQM=g52SWP??uh`O~+cvu_xwY$X;_ie>5_no;pPdsh4cyTE6-7k{cT*Hk^{KVsVvmqn@NK-)HFY*I! zp>~|7AN`e^br0=0Pfq^vqiDZK@4HoEmWbp0OjuUd{n#)3$kAA#6Ds)=60srp8aMr> zX2cF9HquttEH$tW!SX7DPX_p3D;$g{#QtzP-8zoV{&9X_fn|)Zf<1G4O~5dF0_H$3 zzoV0%9M~a+hQ%EV>$LHahvGpM)P2PXg|2z3nqt-yDIh-_)L6auei++NTC%y&8i0*E z{B;1Gu>=#Ps+x~hY8yb$>~1Z-Q+bAr!Jq~)ETU{83Amm4;|LP0jFiOM?~6{MLDFTQ zP7B{kTc3gJ_)DpYlf<$KJQOvbxT%HboqbmS+UBi=MvIa|gU3lTa0ibl9fun7jx$Mj zfW)#JB;;D2gF*DtKC@Mabb__2)lzzX@cVRZ~^w^Q;pKqt)z1s&wt~fTfEi@~~x%^*oA--Q&vk`Uo znYrvMbQU72ugy}n1jJ(NIhSO+b}g9ei$1jZy3>uvqSV#F3kId0MWBNBnL;ZLKzoxP z#^S!h1NqEotfP1bGYHPP5gwug;IvtLK4^DrSr0t6WuCX3$Q8HnAK`<8PIEWpBF^~D z+ZvXv=#jlnwO8=2Inj&e?AgwXLXzv|eGbqEQ;lcy)8K z^)=$h1dQ6Hu#ecce^-T^+nOd^ar`tWU@YFl{y05rlg@d zy}!zJ#Eu#&z0a}`8;3)Vau0`c{b=JP9mUI)Vr7c$0JQ9Y)~haX*bea^26O`IK@aJ^ z4UpQQT78=FP)pEwHP`xd@M#^&_SBW_(~C5s8hhu(d*(PL*L*uaUgr3e%=cV%_z66u z<0d34gAaJgP=7d{3qrp4`|HlKF>Pm*C2%tF@uxb%A?RKDOu_>*dPc1Nh0#xn;JS*9 z4>zL7bThDI^Eg2P45_?lApVHtpWxeh(|+sav0P{9Uj5`*Rya3{QtAOWXF=+xCnm40 z36TK$x(ZS^jUbKx1ezn%f)Zl-@r;=DYIIi(%1yUyuQ4${ooVJTO{)L~pcfInu^lM8 zq=~ZrVna}u!t**Y9s$|wzqEfB7s>9{%uSDyDu>uc$)=;w&R;2^Xs(bJ5Ea~lQu&SY z6(OL|)qWT0)o=`h~ zZw=71Wnw&N%)`dFU~Qbd#n1dfk8_4us7)F4@k6OOYTAMRId~f5g2GrVqY8BHBYG!`JpO+aw)4M&<>hXdJ9_tX7 zJnfq2S~+UPx|#;t`-MTnhr~2#+Wrri=4r>@!6#KPqb>rp*45RcQI50>HJTc{XKr_C zT{;c*aMC%?l=3Roq6Enrh;B9X9Gj4>YHOl5_S6rW*Jy|LFc3$zbJ@$246Jy8uhOT;&do0UW-`+m|ls4?psNksJ zy&M)4$MfmT5s#oj(5+S)NGpZsZJy@#UUq>ru20bx$O*WuO&i@x(l;-h-adSs#v7%t z!I9Tivt6oYMh&k-!WVs&?M+)1u5Ep6_^{kKO2oD_icIDcJuAhFM{(7Abht?b+DSC* zf%0|PK->h_!b4>2&V<1GdaY>PHx#)$5577PfO@*d?T;W{4LLl{cdcB1g=Xtla-iH; zg+w`S_LUA;?e-^>KB|ey(GzHg@J-|gZad8~w*JzcM6L<5S~!N_vnA*-Lj(fT{0rXAr>X4GA{ zjHnK#l!k~qZywGf-KWwdn@v*=P>EahW+UjCmW2J^WM#%fu81WdYF+4N5N=1?2iGq) zfNxqxlQ%X}wEN+|+62hzx8ZC(dZfzORt5h;*>9boqQ7|mJOK)cT+n*y-etx_!zD&5 zho6|zlr;bILPze`{In$4oRIX$wlTo(~HiwgToF(RBU8 znF@4Y_R#Nlf+|PM?451)(81F#?>QeQBH>$iOYHp8O98h$v*wy7BsksDffMzyguh-}}7<;f_;p)Top-r#p~t^uS)*`@H*qKuo{8(@3>k)aBTEplFwM zZ&%*-+R(%|iR~c(01(OR))BaDXxD1@X{`tK@$w3Y%vsuETRH*E1eFfDF?~EUyUSKCHsJD3ZxE_#ukuwUAB$2C z21%%1&RG!2r+zGIgWn5f2maL-Zu;5J;>`EN^Zb({#Kq6+dLXvH15~VzeLScBXR|p8 z`&(~QR{kQb)M`WLsi;B~yZ7$UZ|2@_D%w_+`mPdNsoigxDWd(qfxWwx3%)~MPDck^ za&SBgcdphKj1j(ZH9oos0kh5*Os)?9ucbq=Q`Ni=gJw(ZH>D%RC)Y6mWn+(ASvEA} z$76P!pP0*L+$@XLp%X)uHrwfMjT-}HD98vX&=S<%%-?2bUr({D7{okd>x>`<;sSLgJ`9*U0N+|&d8>EcP3C zz^``mZD#YW`uH|Lc#@;|VP)0KXcPB>j$Orn`kF}|gNPlU{tDI4tobpAECo?hwRLuT zNZjU=v-8(4L-_PhRq!bd>X(IkY7Ns#)sJjP;xgqb0rpGC8EVUi2IJ*&Y)UWTFJonJ zcT$Om0akKA?7xtQXO9FxuLS??Fz=Dv*x~$(jAE60kK7-BJ*+job13sGM=PBR_5+w? zs5=9Bi0jEoZoReb;o`#~(0!Kbn#C+K`FCxG!F5>vCrg_^^64vHY`uz7hlYfH-b~SU zlomwqDs>*S;zL%{A7vEt-v)>q!BRzxn=2ztOJUGvFaod}#xPV={}cXT76RCNzWA*! zKB-6s2ZQnp9Tmi)&T zkkDg_Ol&W_%(Jj5$x^tGDEVMe#}#W&-Na@@-Mb51RZ_KGL)`8E#XZnnhf73L%@D0Z zDz8g9JI1uCDZQ-n0gizaPvW1|JpsgSJ8jU`d?Oshu5uEj>Wey2M-@YSX1oKlPEeVd zmZLIxbr?d%eM)l`7jUUMY=#=1RbtED0Z6umaeKO$1Wneh*31(`90<(z-7et2h$Uhg{we*C}3 zz=dT$9M!J;3y>bS|JpH&k`6|7P1xPvjB#O#H zV*4n`0t%4oA`68`s_&Ox2T?~9At6{2;B>vuKElRw{J^hEz(AeJ|MzBQYSF z;nvo-m$v}`S~3)wf)z;J=x?W#bDR#F=r8QmhmE1W?$QOFK zn*gItm4%yNyfZ$^oSRU*D?N&Zn{a&FKeu$w=$#+dg0FZaD0=g0-->w`xtTIp_S_CW z?8C!e|0<^t5!MDb?Nfg`Hy|8bfsmqjM2^^jE7A-X&FT(>Pn_ zC30zUR9i;1_4@%TwTjxgWQ)?sWJ&Z&=%#A*WNi0gtnsGOXo!^{Rb<1&k zAkHaR%a1vWe*fwOGWvc3%;cBz8915y&8}Kr5?8kH5Z>;9>U$UTzDu~rhQIjTpYHy; zesJG;_&YPfRzfgU!wHnAFjZf|Uf)Vr4i?l2&{)1chlwIa7A)r`#e2Wk@&|ygA@ve> z9&hMZyh;`4B21OvE7_Nq-6JRaj{EE=o|FQ~pOk)&4eBqU;@q14;Os$aKAl)f7YT`-jPPRimj4^k^EN$ zz*Zab$NEH{B4Ep`eyYq=`N7R^U-==m;!_cz_uUH>Kcl$s?*T+?YSzUa}=M@{@KZxZ;h?1u5x1I#pp5_v_imz3=5FQ52CJ`YRdb=uoS z0y)^*#k6%$56kntqUBYG|I`WOqQB?qF(spg+r8^W0`d7b-^lI}x8&u$Po+LiGLhKjyLd^JPj{V{{T?FGi(euBE z_+Q8)@E_yg2d3ma`6eP?B;@f~_sm4(DDQK2QL>%@7P*S!O!Vq}isjG>fNF;^))>UA)IDj#68Z%^czJp6gZP)cbjhce- zP?gSmD3{kmrdKv6-l)ET#KRH(7#2{pzw+Lh>#~3dlYf{**KL7GqCwhWs7?&nNL87J zYR{wCz=dN~_Zf&D|E#8k|AJ+~@Luboolu36MVrY=(QgZtARCeF_l7H8W(e1;6(Hn6 zfs>BsUO%)^gS}bJN>zixl&=C5At9npV{VQmm zFb`DDD-52W_npp?2^}}2IbiI209s4j1U^rgO1%7)iu!%c(!dWzSY_$Bs3Ay- zWsHC@j6}irC)SWO5SXLv4&UvxaQby9=Nj?|OPuEcNmc*-l_15_GySuA-|zvt%5qF+ zNk0XZL)T&CMiL^ym*lLocAE4rtU7z8)6sT0%6WksNK_o|RC#C@y?IZvTJ z@GZ_c)ks&L+zlz!fU-QX&8msn5mF@|yHJTtH1hrpB?QeiyezEj-G3av0iNr*qV5l;%e8dpph~fSvT|GJ z_i4q9o@jHT{KVhy^i-f@aw?z5IVWK*ieFh!l)_(zTRd^4bxk3tDouI=P*6*v+N_W}O;Zuz@Ho;U?T9J-9 zJV;pHVzYh8t}E6BO?k?j=YucXdSaXR4rA7v@o7gaRhSNRuj)P8?HI8A%F|RG9hinp zt*!c21mLx7@Mi1EM98&$iksniEMM#wHpty{+7;JoRy=<8@L!i(b4a0zCyV#An_Cpg zsojs(4+TU%T4F3H6P2~T9@TQ!{-JSmiabW1-DvqnH}g^#Ooy`KB(hb;qRR+Z76 z0J1{H$6e49{?oR*)#FDuKR0}tE}Z$o3mQbHvY(&I`-p|I);X8B3ES8S=g^FNsr>Ae z;VcbG0$7+9#%A-QaFG=61$IE?)FdRbmQ=u}RgmHlAeWW_HB$CJ8BMhDV;C=$N3xHO zRl;OC1NovAno#FB3b`MyqH{LhoD}pa-2%eN{e;fC148QP3LCRPhnQ8fr_&@o?v!sv zZM{EUiFBDu6syxsJcdRu(3^H6qaF~pdz2C#ciw)^_gQ66FbDHE(lNSuxe0X9I-0n( zlBQk{@YBWpqG=1#%DFCX^dr{cr(sK;A7`4=*8yFDj^0E%arI_^e_nifQn|Hv} z5Ql$yTN&$mQy@;HjNQ&~fWQ~O7XQP2AL6Xd3QvA-tVG=JJnOTv`{*

v!)t!d*k~ zsvx>M&;6oFFU{w5=p}x$HB9ONzf|>W73`zTO|4(=alH`hGya3$d(`&3{(l!`t;14g zTpSJP=}ou2{t=~gQR+s?NEXhkUu^xyIez)!FMlUJzZa9It+TVUfv=vP&)rJ3T7IvG zgEPAxkB`@f<=Wnt^VbKpTHW5ysy5#!u>YpjqOYl`(LMM0MD0SeKN4^`x;~i7y^zZ1 z*X#A1%ROj~cJX|;+g`lEo$NH1uhu;;-9D7GXw@U`UL41yB~7aYD@$dcf-#MbLrsHw zDLH$1n5fm&ZC&pZczU5X1Y5dM`6!W(PND}lDB;NKU0``NOzi0NOQjUke86BI*oQ+~ zwXVIWoKjQM9_Ri2*mCt*tGMOrm)zgc%lm#HZml8_mctEsAfngU@b zn)M&}5p^TVUGfBr}6Wq?Fa9uF<3XY#w74FUS zOig=9>a#*`(h;)K2E<(_==E^}zSsBWb9=@p;cwc}S=g*Y)}lwz&Pmt3k=ngN&5Hx0 zBVAFDQY>a6T1cFPrlrcQ!UD8do(+7ve6%f1q7X21oj>_bvk`sP~Wv*f^wHu1SsTH=2m~#Rodb39WBMQ`gS0#Ms(B zNS@n-W^ovVw%AWqc2Cly4qVw}1Z7R|iqHxU+M(SPoYosO@8h>j<<{fuomQM?r6lCX zJqdG-J!k<>8@g{fcO8=JKyZGp;7Zi{;WBi!a?U5;jx;i%shqyD3snWnVJ_0}wUWu{ zzw$@2Hh{B7zd4}2ZDNpg#z#QF@l3=bAk%RSEpPCcawIFB)DFFQynmisn@-6QS``KDV{^s{nKFf=I5E&sFr#Lhl8 zDkIWmC+6pL*rP_wO?Rvq-kBTznG61&eKc%Jn6J<<&t^zc4$*0O>5v#p7ihswqS5HD zfihE4`qT?iE_VIynK%y4Hy~UsCt`PsR0kMCYCeJ*G90=irj-RrN&!yQz_HynQMC4=AfTE|bptg11p}e-5oGTACjx9?X7Vb~UbFsN4!+TK zTS-F%cg{q` z&%&aIuI6iKRJk@?F&fS*TBPCCXOOj>$kb|I1(;HFQu=0af3U4SQubYFj9sYz3Sn0j zsN2Sw{xh9;X=Vorr&Z$cCC~E=;ZGf#;Vd=te%v&?{u)zW1W}wm@?VIUoJ@gh#s{_( zk`XILEDw1OyA)*7)Erb}ZOOiNupNbA#22usmlOqI13S8xxTs{b9R;#~hIAAJMZV_} zj4DA+Y}eco>*I)JR^{$OlN$B!kf&-Q$d7S&Yczz?evh!>JW%nk{qG<)t$UzIx_7~d zWP3~}C0j-&5@8V|@Uy`PZhaFY7>eaa1RT#vV(4`MSqTTN;izy$Uf1#KA7V=7;Vu`k zt-5~-ML{^M*fw6-m-<7pTAw1h^dHH?typY*H@q-OH38Zb|buxzx4l zk?%opxqu)0j4xevmO}Sl_UfWxL{>b4p_?WVX$R*8LK>fI@}~(Cwzn^2n;~WOWe5jl zjCR7?OpJX$GlmnCpUQqzu5L8uZ%VfSF65txEHAMSf6=G1oRo*IXo1uJy4VwMTx8Y- zi?s*a(-6Y?JZ@yn&n$Cl*qXU(e+#M+NvzBL)qs(a3(Yvch#lVUaKI_?0fVIQLt$@& zz2FB8jSvi`h`}I&b=HKWtntea$sde{V+f-D-3N9R#YpsuBpAg7a4ecAasv^)jYM^& z5$cTZ6k<&g7+jCPqs7A6RYeJ7S=EP#N3g1Q8FPc~3!>D_e6pica`!}Mm^*KBpHMjj zi)1eLvg8gNzEyx*iiBx&g zO&^Rdn0#z;#_DoxcLrmd_erg@?`YmPgQ>!d7~NFlG3d4!(6o+`M)aY%d9b=cT7yG} z^x!mqhz`h--X@rN@0%nonE79-Zbwnz&$Mw{jbqz;%vgb;`RFVBbZR_eK)jDb3dZJ4 zDtkjRgZAP&jD0Y)gCv<9RI;^PD8gOZV|XPf==1U{re;K6=xUfCWrtBNuk`N-TuojT zn1VHyeEaGWT60VFiYWrxi2ii<{*aCpZ|A(Jqm%m+qjse$>Np_>|?9qt=S5!v_ zVPU9|$*lcX^&?|=!+p=W6eD@v^MNA^2ucTFYnq`^bIP6svMF%RhYHFUe0YaESOgfic)Rw?4GWQuhOtm7$^eLjA%DO+dZ z&AtNZ^(4L^IMmFu!Oz-S>!FV9GmH@0$tlTd|3znIuki+T{+%jByHbN>Srfgbzv*yT z1v-p369-e@mm2b$ZParlY7)AfA$h-$Vad~T31iiVTkDe%0M6t?!7Wmug#LjLF`rdGfrfOKYk{0C}C!{9yYZa(}WJaUR$10XiDKPEca z-IAHJd3u<{ec49h>}V77xx!hZYzJkQ@o6y3^&J~-qBzlAT$h@f<}GKmGGnK-J@bD( zi7II0T05!XKUb$rS?!* z+f5i6x0>&(Y60#}hH|my$6`E_^Stxd&X5oFO3K3Fyuwa|8)NDd#vYA}6*$Y(_3SO* zUXe9E86sSqK>hs+(F)-~sh8}UvZ8>6c^O2~8+$sf5r{Zp2g*JABa0G0yV7^NG zX`T3m&8VEopX8%Ca=rSqo@*}TZ%Ng76lZchgiVH<aU2BkB^lybJNnN_NNM~E1y;anNM)=u!R`voXx$%&d z2>7r{$k2&)n8&94eGkatvn@e29r!`AVgDK~dIZ>5pgD$)zke!0wPdO~Ac*c52~;n@ z3U&|)u*BG@n}LU|`j)zl`oYr2sV?2=DsOe4)hGh)_GA^y=vcNJz+Dz5|4`WLYZ#UE zw%vP2s1OYVH6^d5{&gG!6WW5sJ!8dS>@`~=BI9bdKS|kp9JY+J^91WSD;N>xtzxkvEtI2gN&GUZsF`*fq zAePn*d^AVPsveG^b#X68Rr?rqMgNutRT#gJjrD&V2Px7D-q9Il5v*GIZ9wqx({^11 zg6NWa;PB#wFuj@a6d#YSb35((Ao8~!b|k81A=Ee!ktLe6{20pU84z7d@jGWLQI}4M z>UL<8sUGl5q;ZN_8z|luXheN2s&``ncuMH_Ro3;ie)$<@>6J>X0W&odf?;tQJs4F} zgD!q*78gbohIQ40NUCpuXgEp$Mf_WTPg~WIXo6gxC=5~RHwDN!tzWF#30WTns!QIC z5+C;}2Wkkf%3#EfxLE~*^KYcw`r!(S{d(|9_kHz36`n(4;Fh>(QB^eTU&B}@T^<6z2 zrJ{Cd5IGZuNcF|BXLn=!)AwsA3SvD%BTx>mB^>q#ywF5f4#~6b2*67pi=# zGRLdB5rI!m&}83NQjga-jx?UTfkVo<(T3L#F3j4z2h^?erEr31&#%qzq1KV`mdrTJ z5m8|2yT?bNvJemUFx}pujQ?Mj{-SKlykFc^BL??^B0*30l4^!@B_1ZJQnnanifX_v zV9nIc0U6k%NsnJ1AuUI=otqoSu_Mbf_wGrV$na;kKX}Yr1p?l z^hn++&kr`RnYA@kzp_Sm-VC3}GE#AttlCKcfeo1asdS_(>lf2^{~zoA`PtI}b!d-py0|gs?&?!Sp4-*0zt__qltuPW>2t24 z*LMZ$2jmlxtxGDlQDWwaelpmkj@9Lh&#zDU-bOkeBC3uM(Ak7LOQ7B_vWLQh?UHLe z0-g0fDmaM)IH6shKA365zc`PVU3_mH*?bu4IV$!ob&Q*7SBybFE8~) zHBk!;dJ5B>Y5VjS!U2Rh{%8atb{Jwxwmz6s7g~`$5DCw9;Tgn;An=lbqTw*F3-+9B zIu@=X%LnW~EzE(NkH6iuaka*I4j=I2)jzf_Mux~oCZ-qjQhe`tlK%+WckBxoR8!vJ z-?FFsxVR{+yzZsUlNv1AKyN2aIx2vbw`>$ophr#?3&_T;PoLCmi{vLXBw zdc!;|MZQE%$ChiXg3X&qj?VbBYU}A)nW=QywwEwF*39{8bd;vpO_^o!8j5-Lt$JJe zl453_rJh;~ho#nj&;5EcY+d=Mp^^V+GKymtQn8EpZz7r;rt{2Qy)WN6HyA)|<}Snq zKK~m1RIQPAk=xm$$q>{#MfK`Q1&OePboxk14b7;`Q|5Y$oDtMBRUw%a*S*XMK5K%!lN9 z_w@7>taeCX+zv_?y3Hw%tKZk-&g@O`cxJg)_dayb2A%Eo&c44Vs9k=e-MwD#%GXR4 z3r>|f2IKz@mPV%jfu*(mz-;oz$Ucn{cLBfB^81kLe6OD;C@t(m5|uj%xZtbUG_BrG zmUjTutB$Sfu+|SC*HPL!pOi|1DS5EqE^efwkH2_(xo30u7P6~}bNR-Eh7XcYPG z<5O8{=o)R@b#SkPDuojkrN~^n)=f3aLh65(t>m+`d?)!GCm2T^_TPXBi zcrX7&m7e}lCGS0+V>=Ikn9}yFtV|owJnsf%u55bG9 zWp-O1*JtQg@Si-cW0%<>$n1-A(JOPHB|D$Mkn3Ke^@JO^?j(U)Zy&zVPkUC&wT#!A zQEQt0iks5DZTZ2S?I?d#k~>fmwHxC5OOx(gA}3oP8nIgbusY zc%8A+TD#be_cPnwIh&{LG23e};-O4+RZSEmx`fn6w_d}jYJ#&1*v@11)IMz54+`$u z1T$YZC|$~DLepdQs4eo(!OVP+z_k}BEKI0&pl0ygOKRnS+QZ107y~@ND(Lh&b6aII z2mo;Yy^owTlitgPV+icI=wzdRA(idVY0O)J+B+dk&h4!8_=-bq-d1rBRgaq%u1V2c z(bhiW9Pps-#P9%|xZH~reVFp5yUMr;y#DkfMvy>tJDKu^L)|FA1C*BWtyhrE#{yjB z(_RgR=%Q_sv{ITR%m19yY9CfBpxGO^DmkOCV-^zXUc-?M-Ds1vs16^9QVB9z!hjs> z?#bOWq&o>D$%r&99y+vb9T)+OjD?6!oaON9#-RHQItJi< zF6hs(0gQn9-A?vD?bfqosh1l%9J~xiYnD@u)j?{-s0H)n!{Gn0@n!uor@G{5oCeaX z=fe(#pL&+P+(UFs{(SC+F3 za&$Z;P3VOJ9B+;x?e~xFjGy`W1Xwbn@7@+Db75L*RsNW?0SF~tED@Z)up{`<030jy#O$b4WT+iwEW&%g-Lmwk7|3L?ay zk>!0sy!G`P(75&IN&+JW_+cje|MNZ(=Em7R1hj7&9E>_d$9Q2U|EmKL=8I{R8W)>cDphzLyR@+I~-)ohNe*+5+4hK>tTNuqV5x=LXuBL6SlDMj zqx5xGkuY1%$(6dQrS2^A@Yu7MQ;a?`qh1t(3z3>}l^%)g_`%?nkQmzITyvQQ!ZQgT zE<#Y@Fb?I@A-@W=##Gvb`Lo@yIi)}vXYlb(p;wOwyc^ufDtODo=e-RIkP41m5y(x3 zg58Z$mxiMk+yW6`oH@ycD8rpu(M@rhA{@*49+J{7oOu4Q>33P_fFeNf5Ex*hr>n;d zy8fzjFrp@W8sf4}*9mr`gSfME@7~XW5R~3R_r^iC*-7oo9)=8Uf8i+?F114FMbSW# zU)kQ=T9_ayG%*%wb2>KPr9-M(^$lB#?ym>1q2I6)lNM$%HuN-doez+>nZdRCNL#f55^ zNN(!v+15!N2|9CuO|;FDlWTWclD0M-)^^qBx3RMEsN6V0GQ;)Y#E0Qf%hx`hUosn{ zwWi5*f2()Gq1Mo3))?BT_uLW2kB*gb*sDQit!$9vofjmA>lqyt4C9fE!nS*VhIY?oLsLSX-4vhRP%)l3)iVo3@mPonq6aklvr$NZ0yPm7X22hDw zG3c1a7%)A#><+UOqRtBAcQ{74cOEJ_XY|L-LKEtH#JS9Gtzrx{DZ%*lVz$nF}! zFMqWD2@J?7UTq9V{{G-#QTAfvs5nyga_wi9Eco6QQ}%hdp0j8g0u??~;GQXx`c~_v zblwiG+{9Y>goh2LHfv1;H^fvTsoUIZHz92aq5+wSnLHqP+0?&DQpeTr0ZAarn2QX< z6)^h69+>f$Acy4 zK;fdJR^FoH8|<*s1gBc#>T%~FjfGeFpLyhn=Cwa5+A2(p&f?$1))mI$L#kUJx-c`N z*>aCV96n~3Fk|0;0Jp*z_8DQQC?3PS9D<6CWJE%YrFr`W6lW~aa)|Ex4+c^I`YY%6 zpjrX?%d{o1op--h1bMhq(#5=8_S91&YI2vv?kESovHu5M?-(7~8nx{P9VZk;z`0FV=y$pbnU9yjP^PTXuaH6V6kuBdD9`=~)z zOih`dzLi8lbI%&~OU^PmatqEffp*VI^#z=TW2bM&TtO#qC266cDpCTO^OdejC>rJ# zNYd%c!qwJO>~|JPT&kx?#|`C`j)O1u+?muyqU$8xn*8D-J417VrY{qXwFEYJd^GJx znq=*7r$4Au>P7Q2owtT@Wkyz8OHdhy2O3>GXQezP4oNW}eIzQcW}1ms@_V>9$nrN9 zT<(5`Ap7qvgw24kLiznL)F5u1bd3g_usDN9b8GlOwHM_R*5|W66s5pNQl?}57@%P= z$sD#wKuIvkhWXTD{Om!n7-XXei9q)O|3_;>+cF1=wMFc+jBL(ioI)g_e4(%haZu*p zy)971;RTkAGyuEWxBu0bjP4hr9sB1BjPBh(IuC-h%@@(P|GOiCjqS@14B$cfj=%aA zf4-07pOt#xsNS43AGwMw=-fWQ(XKDCg_^>o(tsEA1Z1h8$qFUakGuJ$#DC{Ey@7%0 z_s45Ub^>Y7Z*pkFvt{@ybcd0SXI+ox^0Cv<2T0;YaJ%wXOdv-tWm;!-xB;z5Edgg< zIPiL@4g{&n<<=R<<~17Uh_0xH6)D^ot@v&Ab!g_^kzy+D8-&}u6m~& zRi0|DpTif|p?{Gh@vsUHngL%*lAbZ1VhB)|*p?{`c=BYLX2a|4qd34uKdQ86Mh<5t z9VTIlXT0|YNuJ=YOqIa?cV#OkxrQww9??;bDW z?bT7MMveH$=4h7Jfp+-dj8<9?c9MpE*br|X4M2@5j9!GbA&nwPEy~Aj^T8vCG4i&x zBJx~e15w+xrc_h-HAvEObGgCSd%nM-LFGiUBILjibW=Ve)#&^suDi2ItUY^S6V%Dc zw8|`f=|5gaLqyEA>3Lkjo=?EP^qLCj+u7o)*C+>>OXf;)>;;QYa5p@9aV8a3%2#d1 zr;zToVZ9Z3Y6tM+G|(3oq>`_$yW!j*yJgV*zkEo8ra-Q&bz(~6VPnGDisSNz`m$T= z|ECWL60a6dK3ljF3bOiHXoazsXvY<=FVJj;>Z@&$9-5yn%n%jX9`;5oMuB}AOYHOC zo=f=%uj!|ohHmMOC$-V9m4e_E#+ZL&Gq}Igj}Xy0pdPk5J7u#BpprNwW;5&S9;2^14uAD{%m;(lGDe zP3J~YKneZVc?6`22rsPk621&}oqX>A(YU=qfrEr7i_iBvipTE##?UX-3`vp=5|Gj>|K=x4t{i+1I z+2mKuQ*T8uizqx(AgD1;58;R$4W5giQ`#wTea@?|Lym+{luP02CD5+?BIra-Wk|Kh z`UeJxv~#Q!sC4G*5<=Ne+p9A_Q#MfhTs_C%*H;x@#NM|+(vtYWoxmJa27IuaFhadV zd`uD6#<(i;W37`-^JY#hQ-w%_mwwWt7zl%p|J9_|{Z*;H!#w{2Yd$HLA>sueTxMlM z6`Ogdpguj%&y1W55Aq*TK*O(FrtWwEs3`&onhd8Lyw%l5tnzv{H9gO4*PY0j#Re zem$|IeIj0*{{qf)>T1KvbKP65Dbo2gc7QJfN%SEYui5A!zAbp}STcKdFHKsw={Uo1 zUN%2oCVqD_-in`|Ixy>XXUh=2RjP50A+O5e(({JnDu5{^i*(Ss9f;1xj)4gkf?m2y z7`n3)GBquT$l#2K%8nAoMq>_1+lMZPDA?pmkihqC8UgVs3L&OXjypQ(8YfKBanTDU&Ic#f^oaog`evO=-r(SQO=Ufi{P`nB5DzG zC*}qXZ5O|4gk2x+yC=xA zI0hM95XAf{5q5 z6`XeskhLa>J?N^5%?nh{yzCj02Cr893?HbD`~&+G9CrKi*GRA>r56e9q6sK!(VA*S~g0NSfvtk&rz}WWsVJt<>iJ6ho z41-mEgG|S6$3j^z`j$|vt7HM;&ANC!fBqOsi#4A_cBd_)RJ@K= z{nci1G>?w2&b3T*{qLv$bI&D@Q+N%K=pX?SoyLC> z9mq8r8EUPupYKOmOlV63zx68NEaoC-8Y#~9>3Hyc(zNwAAow5vSuVZJr#&+<+Smvu z^=cXj({W!c&ils2y$%Vcy!1E$#LHjo*M)46j!KtDQr%7%R3h1I4ttq_?4G@1c9Cm) zxI!rq)q+8IJ*OUSpBAFh$g?JSYj+v5)O|SZv*N!b@SMyF`taVyn}D($xT#M1WS*uX z^>YvWLgX>!iytUHY35Yu7vO&`VPQv|)TBGl8!;JR5W4^dasMBK2%Y>JKtSc7i{^I6 zb0cLF{TmqvV7lzb)eC~3wp^jexO$8J;TC4Wd%*1b5ynL*EE2|*TP;f%jpIrl3qf*| zBZLP=a+Bg4jN}$Um?wm{3n#p%LfKW8?l*DxxRU-%e zSyz{EUWB%$T#n#ioNn)#`wN+cYlfj>$!{dJ&}?O5x$8FcJTrZgQ6K(xx+<$a$z87G zsV==%dNmB81!RRFJ4MZ@9smA+ZH+0HN(p@_35~1rf|IwC~@7xCIm3 zuL+a`2&@Q=9rLAx^Z*Yav}Z^~)A6lx@vZbhux3aB+lYmJLw7BxA~rxV(fH4%*Q9l` zoB(y9?yUt%C^|lO(l*?z$D;9?5hiOO$YD!_h_X;~^1wEAwRIs_l=36+p>>)s#-+15 zKKsyD+lwNw5wLp5?2e;g;N(M)&NRryLw{2y)ay^RDsMm%@dqd_6%XX4LwONipaU~< zVxSoqhSTmzq0+Yy5OQGb`6pLALZlK*9rs~7e~TA(oOAeNEI;C@vaj+WM zgJ=d2crIa2FVSnFMFuUUD?8Mf!d9mngA4nCjuK~gtEQ-#;!@;Uu=FiR6=$8pK7QS$ zmw0#1BiE`#MH&%Uu56O%=UcuG)rz2U*9g2W8 zg71|O8Y9aOB8+kY5gq~-HbWS|(`Rvy*MlvjAoDc-a3v`q<5!EW$WYw_MtBA&rf6cH z&UH9{M0g|~FD}c*aot|hdIb5Roj|P)FbEKamh>?6muy(dv|OteVTv#90wfd!6&X5<_$iuslw1EvS}E;BT8KI5)dsW|qiTRub>$~OEaxD6^JQ0^ zk87<9x%+Gpi8|l7UB-%lOYplh6w!tn?82~G(!_2+S^$*KdMq^WzYttbIT4t_E^I{u z;$tS8GqjGP1B4`Y^f*!n%f&67W0TXpcfRwEt?v0j5q4=1#H4*X!pdWFv&2U*3f z{}LRn6{vA=X4bkJw;{xn%gmOURU2FW$^qJ+G}f(6M1J(&Z)r+*4V|_R`v;tSgj-i2 z4<7YCQVaeHCk*UtCq0a?EjdpFdsonZ3Z%MV5qZH*Y??~MWTp>s-cNdb3}Iv>kpR%? z@cI^6gE$yy%ibLgO)0H{jgIg1Bsv4^=HXb?k@V+TGRu_{GSRd%9Sc(57xF9psgq;K z6f{2j5>?5Y>yK-jmGn2Vx=T#UEscKA%gni0D!71?C?ChIV`UXzT29x&1^mVw447IM zPVTXrg`RAm={kPMs~$(bs@+hc#A#=q)zf z+W^63mNcYHEN%i&9bqqOF%TM`NS8)9aF|)qf>|RJ?aD+9b5ID<=h&cUi)+_+;*uq* z{peDGYK7~~2eBm4J6Qp7xAfYhprzN_9*QGcN+1~RrJQo39g?YKuH|}DExOjsiE!+iBO;#h>A6FBrMAUClkRecYX`cc-RTHW*pHhV}N zruK*qNU&uiMdsTn9CtaQ!DZq%%kdVsDxr_hR&E`R-<^!mnQ3jfsFT)cxOw4&pg8M4 zEKN+HTzYX2P?ZJH^)G!HwxMiyU~((@^)&kjOmZrW8d~(^X;n#PHhz8t$5q=3;_TJUhm5?4W@6Pk zG$sl4m#;V0h1jNTB60TrUPYgcjg?20ytmu`mUUHgfZI<7BcinL^Qx!HyuY^HmC97T z+?DD~m3@3+x+~=kkI=p!#Qp+8=1RR1W-(vXE>=sTFGvpp*%OPg3u$P;IqRYyPTQ%7 zftG7w?QPRl^A18*P>CH$^>owlk80!@io5*l|^l4>}Kcoo7&blo(NV*?41qV)BMIP7Qh`0=C6jcZq) z5(>l1WfF@huA@OmGM45X-BRAO;@!WZ>l(n1zj$@#DKHkU(5CqPDD~A%UgJv)K$m2B zuzZ>kN{;F>tI_|}WC5#d9~ecO4z`etY+1n6JSE(;AG(GRK+(+B1xjqGwXY`&yzkpF5?1Ua=|7>%t7TF~FSkm&JPNyJ zP<&`fQz6YL)3MFnU0Zf&I${u<x_i$FLh+zE7DT@g z!$|*0T&U9We=A#Yn`>+t$cd#WyA!Db@gm^HaM>IEvV^6xX!pa~4YUW9ZCv+wryk_h z@ng(A)Hk*U}@`x4wwytw9 z`PZ)mKgVSc4`RQ#|LRj@M)-2NIU+m%O4Wekjhz~OUS3l<85K%$A}DRYk(?%4zY!`* zGBYq-zfmM1;H7Ku-6(voR}ll^NcZlPgDo9?5$Z6pFOB+n3#@+rDZ3uWlZfJz9T0pn_E3>W z%gLWBA~oBqKwEN{cg>q;+N80SgcO$Gr^{J_sgTPz<4jE zywGkpvl-a9V^XZ}Q5b8k>&;F}_1oaJR{oy}oI_T+VXwq4MLC z%%R26`G;s0V6C)XtLF8=y!u3%7q!RxM>~EdzhCxF;^vWctpAz4=HdAtGRL__6in2qE?*HoZN*J}cJ}p6J6EFsVR>i@Twrx96+2)>} zQzs!#*W80=3*NMU$zL~t2I!_Q3;qnV(@yLQL}7;ieZyU+>fv#XWic1q(i;=>c|W{byHX*Q!nL#4TTnq=C4Uo~CpKMv` zIhal$`dqy%G10MBpleZDaBujaBamHY|IoY0z29S%1$G9 z4=;4}KX3zU*os>9)Ptz6q%Z9#UED?5c2*v9x>? z5TSZSnX+4g&|il4HFbo~qKzcPQZxA`I_ixkEtw420-@jXe_miV7Do%_gRoT*Xnfij zqyL4P{eLQS4nNlN+sX7SLH&zKT)v`c*tbejtNDZms1-MFOBbO|4}L-=Da!YSr78Xz z93+AF~sM z=Ct80`%?yAeSR5TOc8suKV~lik}n!4zd0E2Bri9waah|^m&9*6a3$yqcCBY>xQ0;e}I)9hqC7SFjLi`U?QV`}Wi!Vabu< zfBJNXrEXV zF8SN=>*m{NLr41mUEZ^isVp(oEm+KaNFmL-^xBLnC@GseeIzb4+&4&{o=6^~5A9_c zsAFO@YHh`d@r-?_PpVboa8D$#3vrqq7A~P&Mx_>Al`rdS>A#>ST(z-WaK10&V%q6F{nrns)?qY-kFYt_$8NOSn1ms>}MHpv| zHO$5$EIpzrCcms2P5k^<)Bu>tyEY^ZSmcTvY%a4KW6H?_#@B6wK)Lbgyn_LODq-SL zXKq5!0#P(bS@fr)#YpqST;>!S#zDH&R}MP^taLI0*2)aRjml<}%tAWiI{`@54I~$R z?@p8CGjSa@K#?!+1W@E_pq7IU7CR?FhcA2>s!1Zcy>^G&sDG%2{P;y*O@8NmrV|`(p_w}QmzS>0*rC)Kqp>K;S&uUP3yR8pj3v=BKB8*v8LeH3U{ z2Tejgj1CH7gtJg;d^goW8 z(^)#d_*L*#pQ6nMuRjx?;b-BFN)mOn*p*BCSd_8Idw!6Yc5y1qjD&EFed0=WlitQg zX9oHGP=F8by;2Z4>}ncKCksalqZpxnH^+eyFTnpD1qGY+ZMv-K_}G0vmA8SRntW^-bMMjvXDjkwU|8 zPwsU|Ofuea2~IMCaZgI}0nT|tM{dS#eur*_$$^2&l08^66iV;fue8U4eLQ_3QkK(^+2yC)>Y1oZ4$(o-{{{U|A zKs+POd9@eyegAxYErAPSv12ONnZlceKHJ8vO#RNx0QQ+WZ9;Y9|s%!Sv(Tb z%;852%qv7%OJRdwk854W4(Bl`niA-Ymq^JQMf&^@BSl9Lqnkarq7#TVVd%F+qlx!I z|9K}Y^`2_)APxxe@k3}6T`r;+#}2(qbWxI{_=@x#fHv`RZeLKXH+0xSJ!+C|02X)y zx75;Pg)ZDls`^&qzZXw$kY_{UVkeY&CGCk$1|#Z@x(8j@Rzbb`vt68mLA|>!c!px! zmD&{t6t-+$%6TokTMO!4*qLL{i%fyWypY&J-6AN%%EaS*nNrVE!Q+>OHMJ{^b-brjY zg>5S6i!oY|V6W#Lu-UFWA}l>D(`+c)}4Ne@@bTbd{S#P+n&e`o1S;YNlU9EtV-|@ zsep)R*3}w`2Y71gMV5t5C(5%7wef;u>+T#i zFDd|TQnG4a9zV1(MnvRrj(`}zSp5=9+s)L*H2~Vvb3_IBq&`Kt|j@GNd+*sBrsp8qosKB=012&O$r7KPVn z^bb(C%Hn;0GrGt)aJr4bYod&cG=jXmR$~O{b!LaH8Ljw>G{;4%qsmkuL6>nkx)uO# zV#`f)wu=+*I4O=*s6mRKD$+kh@~2$bYp*UCm#iGG~tx^K<}`%BJKOi1jIG* z1nsVDb5APn->&3N&!#0+8*c|Zb)~*00x*uXPcVQTAR1z)haBFpdG8YT}fjFUEIrkHyFxd;=Ddo&4*#ncoXX z(6fR-?06g1>-mLq2teq1fqv%jHQSznU^B5Imdct166T6eG6F1?l<< z5)nQx9dp!(*{+h&+PQ@@(?(8g2VSVvC_;3HGtAXBFf?R(+?s#vU|77vMxfIDbav=l z`z{U^j)&OHpL!O{>i7p19wK8T3K2D+O??;F^(wUr)F#s=0kk|Cj*S}!>2L!q*@li`ewIx zjVE@37>zq)bd4c!0<|ns=D!P!c97LBp1=2%?gvPJ(V%*fR`|>P335Z2J92NGmW_f6 zeKv%T9o14fSM9E+j6$a0WgcUjvHA|J0q`^w-5r`UO2kGFfP6|sxk#~4uFsF&y!>gX-(`nZ&Q7aItKeBPOc;D zFf`1a{7^@bsH&Rw2kGO!`FZ4%iLbd4?aGOF((1Zu=4+wSB#B3mN>kY(X8XvMS@+3x zGAkcTYu@)aj3~9)s*Qqo-X-!;m0Il9(KL1_jwU0zkV4jKfP_u#G}Qn*=HuQ#GpmadYBahL9*O&?D>tMz7khuW>gyGl?_*Z2_nyuABKoa`jG zegKFQZj5K7uT_d6?fB3hyn)`_C^-h`{Inq;e!bdo+lfzvNBsyF?Fiz(;7vna&x13h z_9R$$rpdOVlSL3C-=d?$#*kp(h4deQ5u-1r21oNYggb;hEVNwqCM_^=4NiZ_=EO|P zk;x)J2Z8K&70BX4gXPNR_zU5`$CqC^Pz4PZCT?5y%cnbe`nz~h$*_ZKo^lv>!F z2-x*Ll-dlYo({`&5ZuIHve-TiyD_JI?08OOc0cwc=^l=xZu-;(Sd*(=wnwgVlme%! zp7WKpHeDrY7f7A7@)Eqh&I;!ylwxU6n>6|AgxPtFM3&5U6!`o@oCH-gd*n}v{%5`c z#7W=CuA^GH=MHBR` zQ%uLvZYSKT<7AVL+)wGA->^T$@0Ou?wy@n;k0z&@#R7;E)A~?mN?AUop(C;!3dkUk zQu{4=K2$J8IX)$RU?nIz6j^3yVPK_QIM3!pAx)q`^=KsVhZ-0n%47Z#-I3K51{+8u zq@wMWZ~$;(L0pD~_$<|vps7;cDOwF}ZU>rac&M+4d3(*VmguC>edYEMeG7W8gAOm~ zXMvsDRS#I0J;vb9^#scLMapsj;)MK*H3nq5dA+8V<2N7KTz{iHs-|AeK@%5MBA)d7 zmyNxR0ps;m2=((h(ekg|zU4DFKo_Dvk7fzpJ(mSV`RodE@h5xmV&_?N5#7*22iLf> zmVQ^`0e}-i`5kO)^FnJrMuUvhl!5P)32C&;NF(gYJrUKlCTfu-i-8~jew!YwkCO_1a^#b1M&*P43 zBl;)4sNr*CZP6z_e+Xrx2SjU}pV690jI*2hu|C&Bp2ZB7?&(l)$xL}7Oo?>??}(l! z-vv`Uaob}ki?R?A(ng=b1)dB=TPCVhFklqk2ScDR?pycttbiz8kERCP8)Tk4UKYkI zjh~qk=qkB924zB-@+}XWUTBFF40;gfDlX!^X($0wkz765EMeQr^ELJ3RfFz&KV476TFIdSx0-eE2s+9h=qdv0^t_kLh0ea0}mc>$v>zfMoeNoBas@ zPC!0^6MtE84)5(rlVu1u3!vHab zR0Jyqyq?8rqB5$ODJ@2^&A0Nm_HXV)<;loG*`dFAiZcpMGX9Swefy1 znLCA3oE+;uq}u`}2;SqDTcs46i&AzKtFP9r-`gqS_Z#G4eVY`-M@+vqn!-UAm{q}Y zhTFI7eTV=GYD~1<2pdL5tr^SpYK9D|5En_CV1Wx#9(sF z^H$buzIuMOCGccf+2N3GLhYpSo0OTucuWlVi1mOK6^PLwksbXE5w6(3f5yy~T)z_y zDdlvyvj~&|S9*15o+!-xKLa^ct;pJ*#ao-w)5D;|=TPxnV^fdswzpe44T-&ZS&Ra2 z#VQg_Jo9hTwcK?r0@a9hV(?=ONq#V9XpKn!FjSbBA?(vyaE;dkFPsq3HwO8TTFCh` zebrzO8{#H>h%^-#_)jZ@U4vgp5}wYzr=NLW;O-s&-tz+YuEn0p zyikocWX1oRp6IyR>-cq>(@5pj83ANP-tUsb9U0z+zIJLbF-aShh$hhwqBHTXXE8KC z2R&yTV(jS_-o*(f#9wNFh6QP(0*TKd0o{bZPj=9Tw#Wwhk z{?h1w8Dq)~z6InpHXY1p;Q`A;ETDGQSZ}1^!_x|E#btz#yBwR`!!V_8#-fx)9YilM zkz$Lbf*T#vX!{<|1kSqUZL{S*)z+ZVq&d!$K#tC=5T~U3t8TrK{C5^Z!$V>s-N1zE zQ(-;#le?V*-{P8jjOE0*rzA>{-ru|t@h~&w@nA%2diJ@uNo)2{<~-?}VMenLdX5Gh zNvfi~e3?BWYhG?R%?Y`&yxG#q?oOd$W~ z`d1wVC(fc{Rpr5j*b`kOaWyAinN^bdlOJQrwAyrVYfWIcPl0ph##F4g-qJ|gbJn(R z7@^%vScN+@R`{U8J5;pK>*9SAT^FHuO$xR@A7rCM;3~IQ%mi;fGVu80N4PeKv_}8O zB)hmVJ++NXyKfZlZC+2h&3+rh` zR4U(!22Jcb0U6^$--Q2X#;AZ@{HspHTJY4nx!pU(vPvrJmvZZ z&&Ube#BV|9WTAo@VxFXO6I=V|M^p{;Cw79X+iu-*n!l5TIa(ii@4F7&iu@HeZGL2U z{%gMUO!Wo+&TiFphQoPG#EB|S_@NmC?WlCfMZ>#oLfnGr_ZNVRw)me^A6JbPEtB8g zIyw}B2rD*&=rc+-XJ1tB7l+Ff;5HlWPmw=-_5AY}J6VRvw`5MJAk_;59551V=Vcqx zZ1X)vly4CNYUg#kW-tcxnv)#J(8V}Ted!z#LZ--31T~{+Fo&dd!azaPn8k$_!fl^* z-=LYQC`h-RxyE1^KcW^=1L7J};;r}^qRK9meyOjDFtMe*trlNnuPMoCIP5+-9KW5; zjA3ch;7}i|jp6!eqmrIg-G5)@bZFAZ)RQ*qcftP(Oa?{MB?O;q&ZjTXKhVjC*(+JE zTc1`V-uL_)sl8{qJGGrO^X`6t0xm*?11X&)BqR!%k z`{r>wl>H{8ev0QQ-r&)!Sg7f+;-ZpWi8CKux>#MjFbSY+m5@MwQYW^4C3ZrBgsp1=RW7 z&4rAPTU74l9lJAhhDy#L?D z`L?|f|J8Z?NWVgNS&C?E*WdjLnzsu3xoB;4TuAHsNBOc9Rf^(?^YQ$HR zUeGO{F#4~ujfJdUB85-(7D3)5E!!`=)T#{{Kn04ZuFtCu#b1lzviUh!E2isOj2J6c zNOA4IV=Ey^XJ5@JQE_Pq*Ir!P3CaU{UZ((ImH3XZ+SkefrNUDpP3@XRZGGg5fi z$2k~V@^E3};U=LVQ#8q$Tc?}VT29Qbqv3L(SoDkWOZV@8MZfv~;TkikwG zDnj(&fy&Mm=I z7)O`vrBddnbEy0^LI4vN$!*b`fHAYZOf5V{+*koF88vln#@H2X@1L2ZJeh#z%#+I+ z$oB&s!WF0|X+B%u4^6@aArxINb3L0GAr)>xwSZHpik1l>65&tyJWzUFZE0&JaO~se z*FN74;PHrJUq7mQFXW2h>^reD;RL+5aa66vxeCp<_a&zVYU&|oR0a-vDX?EL78DRP z&4okEKPpT7H5H)f_R_Gxh!+16C!^?m^ywZ#*N%vhWXAEIZavI^MPg#$UOvv&Lud_s zI+PgaGXPeQX!^yq*d&*jzlMhh0q~>b|M*cZ`6xULBv3#@zd+PqAKZpml_R06T(cnk z=fqx=Q-0s!6ngBwzW};;(6hd+w6B`)vW+X*JSG2W2~N)Q%oU<>0yIGkR;^ruMyb!$sh>H_NePrZdQZ zXCA;b0-kbQ=iH?p^y&Cg_G4M(L)fPeIu9K;3_n<^UY(%{*v0ng2||p-qdvvV)Lgp< zDc?x2N^V!2)_m5~ND1>9;k%#`=KKkR^!PV#tZ!KBf4E-aYTn%hY@Nr&r^omQ1BqI9 zoEP2qhO*tcFSl&IZkv4|YX=9*gU{$)p2ebw{}+PgB>46DW#Ned^y^QFB&7(reH0oK z7jO{x<)X%Jd#r`lKAP*I2G%|*?hAM(Pxp?-qOIE%e@M0^A3Y&f4?h!YuhMDPB{RWE z1NirvnXXGSe(+Hk0hG4k#n0`lFln}wxWRqi;ChaU7MtgYio4g>rS8^JTQS-$tFwU;zOqr}w)=f{3N{iW@w0Yqz1%imWtJ6PAgD@V_dQP|i zEepV$SR79vid%1T6DDg45!t^YeMyrcNHG8wN8s2O(M-B>IB~C+&iV>T77-zm)a$#@d}#%C6QE+V074D!5#! zBx~Jm%$u)fxvGFCZBwcl{@)E#Eqa;c6L0!UhNx zLjMXCZdj`01=l6PyB%)pSTLW=NndXio|yFC3_GQ$n<99~<@np5i>IEO2~D5Do3}{s zk)dx9`wd=QdAn_+5|q|aw#gPCSQVuA)4n&;Yz~JBus&R9Ivp3s_tyxY(8+W&dj^0-%WVfb2Dq%{As?ql{HEBLB_<=c)70d!2V5CZ{sD_LoWdVS?uN=hCNpo$Si+b(Kz7OV+pD??N&eOv(E=cS;q;fOJr$ zpz_01Z+ULb|9SUBCtIfJE%IlrvemsN8B4`{g`4+eGIMD(I<0ow(`~ZO!=Klk{-5uE z0A-E+>_0cp-?M!H`MHnV^UZ#?&c}W{I&J6E>?p67d>h;IqR-9n_lg=#pBqBJ{i?n_ z3LVXsm6gf35h<^}l=-uQT%4WIPu=$Gj63}LaJ_vl3dnI?=e=|5jAPO1RUFb5_H6kw zN@?vzYn-o`w0drlD=${2q!rMS=I7aA`kl_~hnC+(_oCKjo9jo>AuW&AzB_{WN1I!c z&QL=ouhua^f0xf->g}vFpb_|i9Ib;wSRGFG^cs#}KK=Kx`Fk1V#$yXwyp6fj>K_y8 zh8Q#$O)aIn@_b2das=e}xX1tFIE``T>y0!R~{T7!1SW34=%~QvUML0E}L(T z4+gCnzBF@=4rEae^)BWYPS4hVib4(#r_K%>v{@ZKp6Pz><0N@{)s=wnmAP!b-}K*a z@J5$laE^KHdGbs_yd(}Vt?j!`mgt~Z6t2xQ@i3v*bEoyWDb`=F!-$iN(nr%>C{Lg3 z5@^h0DZ@ZX_QGD^0Cx?w0`QBW&8Phw!*x@HKh#V$SJY6^mr`ba(gUH|#j1pdCUpCQU1sjCo=9*ll zE+=*q#ux+gRa+0kiB_?S+R!_^QQV{;p_O6t!9YWB`_NjrVpRd2x$W+(Jn$)+rDf@} zi=&gT7I04i=SMNIUQNSCa1g+a(Q0Gv#aPDM^vx5YrRj$MB zY^o-3Jt~;ss$ZTHdTLXfNIl-fODXL2z zXA}a*XnN2&5Uy>(ZFc~DuyM(^7x)Q%evj`!>YS<~2~2 zpsf!UV;x@57e%G2-So8m^qk(M}W@ z?Nn|iPylw!!c*@dJxt4<6sREFs-+EB@C!zzyEbU%tk6N`a4QjYIS{m^!(W@3`Yxn9*c z8h2NZ&NDSwECCoH7G?yhgtcE{#RC30zJTo&#&?*tdnXaDX-R%TXOi5=U~D|R`JO~b zZUooDd4H+qVvX~}ob9d)b&;Cl=4A`?xiT*N`Bl381|PF9_Pz#`6M?>0UeLr<{CReS z)@-CTArTt<3WMDuUIH zU+EY5Ifsk~X2RxwO-S&S*VTsD5xGvr`Ssa#!rO*S4(TO~>8H}I0x*$OyWh}+zEVh& zsxq&iFiO|l(^Vus7z|9PUI4xjY;SN-`QDe&B3Z%|#L-|fa2zV1k|gmqaYVfY=#?o` zC9bciKE_})TYyQ8Y&Ybpv_q~=@|Tv?A2^ln zS!@x1>a@2Y6ImLf6V{oPK zx<1(HBrCRUyJOq7ZQC|G=&)nkwmV73wrv|L|NQno=ggU@T{TrRA6BhZZ@pFP`Sx7* zr5l-8R!{Js-sbOv=7>vsD|EY21V7f8)ZeZJB8Pd3m0}E;j#NtpX@v-Lo&`AP`tYrA zqm}S?VNGUqMKS;KnN<<@el<3FNk{C^BI8o+5>L+n8n3Gyh`VSaPK4hT0?TpnQHSvZ zOF6>e9|jHp;}t{sX=qc$ntK{=GC5}gKWqv!_-~Ar?~vL0JORMDAX=nAE5H5jLFj=4 zoT2;|ct_ZD{%yqyvSm)5%BF^;{tE0zbz%zdu%1p>=-2z}4dhDngO`|&#Acm+s=)h&l$5=rg*>?E{mXk17e8DSlEm3&}RkC7Y zI_i#0=Lvz7@>?Bsg^F1Vi`Fn1%TNC5l8dzgUU8)Wpa_4C4u8TOWecg^#2Cp)?gf}9 z_G`|1CEu=&&zJub-OA7gesM6WxqH^u{X;6zuCuAU=c~7wYq)VU*@ZNta90PRMx~XIT8peWNxhcz4o+qZ`&}@CH zIxLE3Zl-fix87MA(f*t1+Pi#lGDo!Nq3K}(#|CC*l0EV>U@C06^xk}pTf?R^8x?u7 zVo`(7xL*53i?lm-ig@#5FU#8W!owDCT;lD!hz;X@J>UE=zm+~+2=6$cQQ@D~X4`xByOML0AcFSdHSgP@f#{v8Ho30dUqH`S6G9q`RrTr8dnf@=jn`Pe5n5 zrG%i~(S7XG^00qq%Ru+|!;H!z{0Ldg0g^0fJ6|2e9D1|B&ErUCS|*w34Bjscmdr7? z$Cs<)Y2DCBMLGUViV4aDWc@6~d-%-CSYEAuIokXq5@p8Q@H~f4KlZ)1$W*m;T%=`s zv?5JaApggDwYOK*s7LsLW=3HIcRJr;$0!rj#>3H$^p5o6Z zqs1A1Kn^L+N~quUcA3gh{RH%kq4Om1!y2XXaW#=e@US4lFYfqS6xxaYvP^H4J9wE_ zR(dfb9zElwQf9*GCpeHDE7V-hI^Z2F^YAHLA^B#9)TM8w`|F$Qf}m&nkJOx}*DyuQ zwe)qu3LThw@IT#@f_rNyk_ zU>P(%BB^2S|BY>G`ZWZLe(f89S1P4QGO~$d-Tg0Qqb}s%PZ1g|mrQTSfk%%0OdR~T z{LpFfc7<$XDCIp?_RrSefN6@^d=5>>Xupgda(-Py z5qrBmvjJC;d+_GYIhs?q}7Yxr8G$9R>gzGd@goj6HaNyXCM)N|`3V8t(DI*Rk z(ux8JArA3|v0bx_g>e(ojTwwwC%&w5H|40F`l_?w)>Me^N*sD+cv*ij_rEllCa#UW zAO8WK*b79T@G=8#^2!db1S1Q%qEPhc1=K3hQ6`vqxX&O4^&TTb$=7w^7``zw>r~C> z7m06*XSA``Yes~*1}8HwmT-;lq1-aJhmrCfA%Jc@Mp{`Es1lW@z2`D5Oq0hh+xskH zuR>Z1i#Enh|3RCfhyH&>7`+Obeg6Y6RIAr@2ebqI6og|BqnYHq%-u>KQ+|Ab3%5im zudGRVrfF;xvQuWS2c!<+4N#Lu>zc@>jA*`K+2Ybuo4*eKf)z28W#Q;dFErW^sk6c) z!)WGx+?v;#3Nyl!I%CX@F8J6SjW&9ijLjx`m{xX=(A3H9zm(R^DS!NY@&{12sGO~U z_~l!TKf{0n(-F@R9`%uema(U%)4qEgpTN@kg%67^RrULOn9OkBr_F$0#S1Y8l+@9p z>6F9pckC3kO>aGwhD%FXc1$aiH&*KAO7QL|I)ssMG$!d@BN3<%(U)gLAiEK)tq>?Q zUpoCS9B}-@)v(g<`%lV%vYQ569|gRRNO-v|NGJifo23lkC@*y7G9vTx`xXj?rZUq5iFkIKk;lIp%HTg zb>hrhB53?ZY=(6%20+R1@6x20!v18c=K<;<1ATTu4`d*`OC4#YJR_LnMcvU1N#D|% zqP_*M9GuV*g*8Yx6h=e~d^I)qxAaHeR}&T^+z5l0J9#MJdV}TfVsgzRq~b8vU`HFN z@no3&G}cY!z>9$#kzn`V9nM?a;NqC-_1B6|`>yA=&u7p7AFlnW+JCNnJvY%fzM1ZS z-S)y%HJxuw--9=6DSOvON?sOl$5nI3d&eoshP9#=&E_)BSzq02>*cNN zDt$n8QcsSQsMn7Cr<$&<_dm1-R}AXb=1PPsZ|bk7v27s7M|cu&Kyu*f6i=p_-D{UU zc&SJ;)vM}!hD=&+nlj1zBP6M}7KEFUf zN1KtZ&FHW5adrol+T*CWSYDM4^GEH|CVT77^x|soPc#Mt@ckh5;EY<&IY%G=G^Zk|~r_ISgJgR$=$!N7Ww++AO~JqO<$W$tTmK1xc&kPOXq^VV!hBlNk-XjlNJJ}f zH?LE3g?qIE+`i;z^%kPJg11BHyZhelzT{;096##|f8OP=Ti(55?#Zhg68;JMjJ-Q5 zDGuCh-O?9gn;>Y$o?aBjjd8$1@@N8nwKQ|<*)I`<`Coh%p%3}>yw&hS8b7(+dF2LI zB04QD>evI@)|QJ-LnhDKS({T8JCcQ})pES=IBPOEKYawKj%wGzYX5JfPUL-7C?7Eb z!oL0I-?Xsdv*)-hfr^D2b{;2{BB@KN8aOGJE4fdwa|oWd*twqSg^MWmCGXA78LOA_ zYJZ)K^;q0v`U?Xx7(d*WWzM9)f9%m08Co0oz)4@4w5ZisK0NpG^^rBP6Sm)ZcZAfI zp*E`4VW|ec=kRyVJ}@k_({eo*^W!z`H zE}`BW9y;HKe;2{QL>p5UEUF(l{4e_FbB4{&Pp!7?1(A~-UFvN@*PZ)8wRAvkPUQqS zY|c7AkRe_PoLQAMwIOBdJ?QkN{*mqlFJpZzv%WESoHjevK&Axoh(Fti1y;qun!w8Z z1$KuAUI@SNfs-BY{{l-AE$)~dSFfFW`J-Oz_i5dworEGp;c10-WT9WIPt+`2tA>!@ zy{dr2VrJz_Q`}|i1u6nugvBiJGpWApcXmw*j28R-%rWHdPwN!pDE6QS^n4gT8S-9M z3$umqq#02+7LnUbNw}dHzns78O7oz$MwAZY&WR(bd6qzG-_eDVxW>ni1vY{9U2!su88+`!7}Lco{*(MCz1_&^SEf7`DJD6L0cCbcTEq|!xx#o7kaJ_ zt@lWX@o$?;6IYJAef-Z#WUOFDnXX7K$|D`Z3uw$4M^G)9tKUo`P$T=mv_Ry^TG(?- zrvIja)<3ShA%EZc1)Q7a7&-QDxCW90$b)IqG+BI{*ayWUSvo+!^L00x_-Gg!qURfK zY#+otNao+Yk~n6F38(N55CHb@XDz9*+qY!IeiEADf@TS~z>X8)uS`)TcgJhtiMIZV z*a`qO9FssD6dV+^+}6-2RN+aETKjOA4aSaB@iv z3Q~Gm9Z|-TonT&^fO3f`21L7k7oK1U_FfD&4Is0}E}ago587mV2*xds)TzwFW_=T` z+QprNlQv`rS6q}VLj$d(Xr=mK_q3)5U&o8us(5)nLkEBTYqdO;p4C<1!Fv(bi!VsgjmPS?O9rTh5 zt&^^w4Xm2fb=w6ZwFv$XLOCrC8_~=`8E6ktu83>=HrzS}Q6;9T4ZF?bUer0j_wEm_ zhh=ERo?Q3!?t zlZFA9uJrEAz~p?do|4M2!V5}4ldTXt>>@1|&j(WR-)p|_7vOn` zi3a(wz!XAe)7%mGO-@4_Y)d&P-JcrFQaZiUMYvgILu1R#EJFcUo|u^@4%`jM$j0L_ zY970A>5{r)*sPK$Uek(cme=*J)e6GqLKGlIEcK~`!RG5~Ty^kRot8o$=}4!Rm>k(z z#M3u8#6w%&)Z25V=N4uN#&?N>Wlt*|OCT9UNX4y#W}Z(&#hi+4S?o3RfDDPKzx=oM@*KU^xr(1cE|>w|Z&TsU)XG z@i4HDaxTG|lu-|&A#?@(3=6X!(E&s%rJ#C8NlltCcDdbh98E-KC6#btsX0H6)Z24= zMhvx51XmzzvQc=4N2pb_v1}}`#km|*seYI?><@XX578VDz7ztA*Ca2g z!;*|nBS);ET2`!&U`u~*jpv)qFH1FPLT|%`-Z`6D4EhRms5GTR9UTDl4Vv(&ZyV01 z#9O94RU1?| ztir1$Gx5Tfmd(`t*$jETpzH74KtqT&X%xNy{WVUS*s6h`tHQOcl3t#b!W?Mk&wzgs zI73A$%{7jR8H$U%Hu4dPJ^~}n!^a}l>y@1?0KD(%ax61WoqoQ=P6f9`o6CJBm)Hd$ zwUo&dw^)gIE%U_6=t-60@L%icv^3AE6C&_@^(}tE4f!vIFYk1NDf3$)bb!#Q{P~dr zjlWG(g{@YhIb<{m>M#i=1ey;3O|i5i`ea#mqU*p@6`Z)b>mzxdSsU~<&0etTKg)TA zS@%whjaj#(yQUBJ20NX3b(7gJIQK*-0@&^N({z=h)%g9|qD!s10N#rU=yqj0dsb>R zM=!nI%VfOZzg^5Qq%WR6HvLj&^5zY9x@ltEkcb_zSO3(G&#@D*cBFkOa)zao;N~PR zS^sf$HM&gDw@KZ_(VfNz(pREP6pEJs?H5R+3SN_m$&s0dCL?HF+HKdt*-n3?(9{&) zaAl@s3w+7orquR75lW(>A8hB3fk!z;jMBN++_d5RG&2Sf=hhA;w%IeX37*pz6H7!B zWoMIdy`;^0P%Fr_gv`Duya^4fheLfWCZQcLU-IgbIL-kJzYg{H?D5{royDw9xMPJkbaJ+%ZBaU6gPkdeMU9hsmsCEplEG--H-Y%j=)ljYgz2^?f)_NZ zv2G{}Ty)-30W1efbiGYsFbhs}-{!vKDm>un2WU}e`U;-Sb-Or01_=KO$ByLt1!5#W zM8Y#S5C++QvQMx1nR~&Ndv{HEX|Y^v!OHEESI+{xhqV7HuVUlI=YH|@qhk!hzJAj0 z1*ZFVLR)&Jo#h@$g?4TmmrRj_GDUveTrb$!$f05j1+pS({_K!Aag>NkZN#WIKH=FJ zF|uc`hw$bI_uMp^{}#v*(aG;EvYEp~d?jCO2q#j!fR5FtfC z5J`!wxc?D}^>^+G=z(q1u=kVJ7}D9BVv#vbk~=G?yIJbaIMN?_zRWl*hd<}qNwH$( zj*Ql~tp^ddPK@qIfnMg!fd)LFEjkL~+i&j^iMb3{O+Q6f?v(xM9uD7!uA0z2jiE9$ z>CzBuB+O|F`o7eSMve z8vl=-27kV*zJ#}@ORn$JCischfJm71-dkH;hTt#@gjw-5CddW-@858z78^+ZoR z;Z*j=g+E8Qt9z3LMJ|~Jqq@*4O;L@SDH=@0+KmkirbRmF7$bmc0XEVzUT<-}mucLk>R$Pg-HjydFU! z`&X(*#E|r^BE-8vJ|HlT}UPgif99O?XUusZp7N8O`RtLm&c3)gzWlm;T8mY7-5 z!i#hkINXk^JI7-j3+-Zp6?=KE^` zg!XVKI%1n|8>#GyVXpr{wY`99xd+qsq+jh%wAs*Xm@BZ2fB5EffiSlPdffSfIEf>| zyj7ZskG@alE@KO7>Jih&R)ew9L`mb+|WpmJJ+|=hbGX97GjDN_tSl{>W z5 zs5+r>EAfEy0=L@*b|3_p?lsGhPFm|t27U~Dd(%pWnLg*fqUE~j2HvE1K~!W7Lm(gd zI~%S{^-opW6}q)`n%no?lBQjKdig#Cr%!}r@_rsxS8Ask@*-a0Elut&V{!z9edLN& zmTAPheLsJoc@%4n(uMfe#?Y>joAVOWb(dr>Zd?XFB17;T_rzZqOxx$QXz_LHX{=lg zjiSZG4p#NmyGxaHF*a<{ij*b?fhP0GpUy!{ls#0@uyk!o7h{%9$ zj$TL6ZD&7RzPy8csSk+}0j5cyK<`%bw2#E}@ zSerYspN*KHi)22>e;kH`sdU;^16gNKt1Y-gdGB}=Y~2i%p9*8EqtiO{j4_-Rv);p0 z%eOk5{TkB8E*X{uq|@inE~cnt4>gSEO@O6*21P6*2nX;r3$_=){Z95!XrwY9C}~F| zo_8(Q2>XH)t(mR1Y7I$ebRKhT2Ylc3CbX{bqIOSW6!dq^FUtn5*gY%nL|g}&tE$t7 zNNis2Re>xni{TP|#a+5Zvk>+x+T=WDQadZjV&1(ur*e^fTeY84*X;G(z#CC~_>EH^ zOPZKuBBuBaer30Lwu*d&YY#w^=?VvRJi_nLvN|Q_4>BhEd50n0ETCbM%q;ofA)e{y z@5TrSgw#nE0vK57BcVE(5u&BfXI<^3frfgD$9YIH)At|6mS?LE=KxM(xSv1zsj~pa ziH}j{QXw{4Z_F4ZauA=`)x;rsQ`&73aVT1OT?g(b8v38^yHhK!T26iW8sOY*Im2N) zwd{Ko8em!gb0D=06)&{;NWqj}dBr|u(fo2W+1r&{`p%%w+M?Q*iI?sZKsK;zu5k?# z)P=OVyl<}^_>tx?oeK}qGcSL*1y9I%dBl4i)iq=F7YNV8RQkj#!ICE4Xp)ZHh6wj2_!sLd|=C57Ore=ede~Pr|+Ze=gsjFaL zx#Dgf2=C9RFkCBkjyx$mRW6>vbasfgY)g)7lx1&Y*eAcXb9&Sn)4zUg91wfXCd@}i zOeRu032CGdWol`DSv0-vm%Z0{+1-k#UHe(WO_KGSGfH`0i|g;5Xk#S(H?&U|q=eWT zD@J0?j0I}+tY*ziCh5Q(|p$J^{qkSui%c>+rC98kNn?*1lLf19I=J>0PKqE@|iCo4W zRV5B)-!S90UxR2CD{Wm5M)fj7CaJKUlb#Q?ZNH?90nxu_jT*K#h3#<>o!sm;GE;%O z6`#(DRtIVFW#4lzlvf5nL zQhgQ3-vod(LC~!tZiv6gY+F!tsv86QoksVVMnC_I`CZH=hgV z7k7Z=U{w+_rFI3!g|$hJdmb0;gdj3OteRoC2w_ud!!5zgyzfc|Hz34ioPw{L6Wo2j z)O}!fJNbd{lv&!Vf6NB8Ml5&$ilj{vFc&_HhoLE9wr9?%8?va>G^>cT0?P1(+%NiVg<&(v+LmFuY{0}_$jPFI?hR2?oV5j`fa zrM?t@hz`XCZn`A&$4zCwaTt@=E7Jv1HQc`Xx+nb(C%s*{XEK$1SM*5198$4&KsGzz zPeGWZjs;Z2@iClCQo)auHoV7?fLWac>q|mA7DQ^NKdLq0oSv8Fs4VWr&P(g0!;Hq% z>0la1*7PYWFk(idH0MD^mzb?@e-<92XPe&g8Gq7@_dupwZ4Se@d6DlrMY;umZ+yF% ztg&7BSWh)8Z|f13&piaDpdhk_M_?fbD#n+1w1TKX>|21r5c zB5M24+8~)=xcydlqmt2hI1%b;vu45Elg{fY3P>x)B+$#nU>KcHv$6Wf=_IkCUZVq_ zuxIMt-$*sedp7CKU_NVRDOfhxo zqb!!A?=xP;7ig53G^65>HKYD2`G73S)uVEI6G{KqBX8opZFpXgJwnYWgyTI^Kt1Z7 zzbJVhD6uqC-5(@kX~*3Fz}IihC?=52kps|FNNI3KrK(_5PMF+j@q_JAti3 zSxotPqOs8iqs1m0;LC?-C=MG1{JDN_R2%M5RT$c_KWAr!m@VXUDNg%Y+3w4G=eyHM|0vM`^4PigR>^7o8S3NBci=XBh-Af2n1mU)v+ zcH`*xfh&WrlZJ`VkIP*KD2|5UHujM@L7=9=4JfQLeB@l`%mA@2bGHK^ut;sE@66froN-NLQ{3 zHCK3(M0L1B*DAX$OGgr`v_AIYeby&)o#AT#zc_qIP1p8$0j*2WJCA<%9_m$yf)R1t zQiTS#i{m@L-Du@mw36*r&&Fipx}GY920GS;aTLFfiLSt48~=pZu3Y2`y;0@_GMja} z*Q%Tl=9S5(1?P%JcUw-oF@??EX(iodv0-;t>4MCajv!926H%7=dP;0v!d z3ZhO4$@i-W=(gpY0*H;WRr30NTrPl&v#fvWF$w&{%v@-W@o!s5KjL2(tsHYp(QzX#^(0As`^zOXRBkG6&fxIEzJ zdo=Ra^Ui?J32Wy!t0d?1k$~5QV90cnK6!`5ZlIXaPF2DGwf;4f|COaiNU_+%eIc^V zti&_OtDC$D{)bpFiM)7|pk-M@xG;M{<&wS%c3vWuxhj-Uh>ha-i$ZZ0jp?ah7}2KD zma}Xb^Uh#26+moT>1Zy9y>Al zG(h&}7TKK=Bn8HP1`Xyo*QU||`1?&i{^_8oY?51w&NOHOnD_zlsR%}J^M{{ZEQ6Te?hB94kLAB_+R`1&&Gm4H2 zqWk_eo44_P&E~&XgJpV{%pL_uypvQphkEfB6k8p6`x~=Sosf;x5LnB@)8>QWPWuk; zYp>wgib^0ax6ychS7ME))_m3KJigt_+M`}n$5I4zjYRQNCf*p(_!XIxobM(n^x zE?vcLcaY_XW>l8t%d_7$SNkS!BazHbQ<7B9S~8|gA^Q>Zw%hkvDaKZ!2e}r4`wrlV zenTQSV;eB~CPtHhdJM@OBeY@hFGSbbKX2Qwf!-2-wYJ)1&1g_DYiOU0DhE!5d-laf z?ifg#G*wJ6MRR5n^dzY$jwh>NGiy|$d9GZwJWUV7Ky$j;RZ@9p5;J`CC4hpTu>K3x z&HffT9mNO)smXfJ>eGFknwy^QJf}G~A7-0&xDO?VZDUW`dDw=DEIW>tekhpaAz9f= zutb?7$B$sU32v4*Magi2@2-G+Bv!)t2i18F;T?z$%y&PvPAVq*n_LqFl$nTl@4V`ax%x-Q>v5p4`tC zX&Hl=;e6O~kVwwCwr+wHg@N@84qb>73}4+v);2~{kt@TU0dLm(k5Fq|$F|N`j*59} zq&CrDqPj%QVhTP%-5|aRz?S@4BdBuMYrS$3lW7#auSvlJ?)Atgww}5A>C%Dyv-&Qy zDO78v%Telinbd`6R&((`b|2!t;VmAe@sccKQ$^$$d_i?}0fBD;AE*DZCpZd_) z5Q?_1t2~*}M`@s=j>5CsT7)bMAEJl!cx(MhJs^o0tm)A&kWZ&Bd)crV8l}6kVCLJ> z!8$9!{xzY;?kF!dI0{xPqj&tZyJkRX+u5X-hU<&L@BsFlkh!g5Vixqp-U^qY5wBez*sm(VJ7;uUbeg`jy$(* z#Skt*SL%~?bM{FkNomoOE{b5ZVkWmD0WcbZ{Ib!3EOgJBtD@8i)>3}4&1NOyYlLSY z`>O=Ops|w~2s@pEdMdgFPJB?}o25f4a;**N2naZGMVR?yKcYl^uq+&)^GOUB%5nCa zZz*b^2Wa9WD*@2a(Su}7*b#CycbR&}%peIsD^_hHaF5%H|l(p{%lIHQDdvI5p^DVNBqK+t`#GlaM*F)-9kuF^U?y{yIU`8wrHQG4Frd0noa+ zxr4f(x_U3+@gaJke+qLU$BtMO28YA<-K365Y2O*j6C(x@)5hh`hDzV%LBRoT015z3 zL|RnZs3-{35FpC1G~UD*v`C#DdX$k>K_|QHV@r(mXU{RsY)ZXJHa2CNboBPV2`CZ{ z5>C+vSk9~sVR_GUd_GqCDMP-$%maqIzt{tYvOjXRj%`apfIPHhW6Jy=s2*Yix4W0D z+O1HiL)kka*)#OQkFU7^U>v%?_m_*u7%RZfikr5Iwq*usub}TRLJ`%s7AxCTi%-d-`G zJ<&oeCt*3>97;0GN*;v*eTdaC?pOH?tO_^alZG1ENgz<{>rG*sgxNH!;a18~HJK*k ze4Xzq+(UvY++kM3U~Fk$bycnpSvFc3j{!OAXbnC?*kAo;62E^w10(Oc1HVxoRp~I2 z_<^c*&tBefE~v4Za882l`-3Oj{e3zoM~N}rVb(4-vnUU zqni{uf76RGb+;GOxnSG+Z3MwaSaG3d1jm3;jhaB&tQ`^dFLysvtK;FZ_|C)mkcX

h|C>AUF2rErdm$b=PpZvoannSwTR%AeUn_PkO;zftIXlv2IPxO^ zG>xht8gm&-XE>lW^b~^iZBp}Sg1H#vBAtNkw&POPNRO=oxN_e9HF0x9Ml ztBj}i8edgS^xJUJKK4nLTH>+oH+T9HMkRZNF|wz&5(V_C-srZqsNiK1W%^UKfhlJ= zvudkhihUX!&bcoNqN9oTUkpSu8Q~OKX1t<_OHp%65U#|P{D zJMgP?j%L_wOhXm3QDFg#o5hx3%yp4@I%T5CDI;={Hiv%%&pp=GNRUCj2D^KqGsL~` z{frVTYPYEG+^-pLZ|-X09HJGA#^prwj%-1H>muy5hG01V^^6jSazX!TPwC{)H-B~l zVU;g=c0$EJi|r=e0)^k=O@)nVL4OLMr@*;Np%R+{jpF^!lpZjo;_pjnWCx}T=A4*z zH!VH@MPw9vT4T>x2K16w@#k%@McX^(bp3EGqi%KUcH%M5R4XWV*P^65?>fRuDk*Vv zkJv)nWuCX#PVN;=d?D*E%#ssyS2`PZ;|vsu`y<@gvTi6mdW5RwS^-jxa~Y)u{T#-+ ztf{*nhmqLa8X|weVOm z3jaf(K%AHJqlqTvy_v8 z_cxb#psYH$Wz%ymGJunF!kucf{kpdcZdQnGBR7tF8m5j57iXNQ%)K^Xr0yqb-Cmgt zr`|xtzfV$mHsF3A`Qq>4j+`3ucT@mB#QLtcGC>Ph4@KR$9ycCbQn}T#@jzzZxy*nn z_lKZw3E>HW^(teBS!&Am7K**EWxtku@o-`7Zc3TssxoFl%zocATb=@OcmEkBTlIzX z&bH}-Mj+6iiW|F2X!b?C+T{whiD+D{e~dk^%w8{HQ^%`adv%s>?06{7`9bFJp506J zCL18WVNXn9K|D9b1Q$7BtF#6 zl>1a@ZB?k9cbTjDRCoAxBC)1<8-u8hp?D(XajUMDOlMJJ5N?$5#d4!rmJXj3EGVew z<<*SN`r3Fw9J0>7z6s82SXODdeOvN&;I9DZXp|cFQWQHSB0;HXb=}u`{Wphh8t8QW6(|=dQ?!RxBri`M%5gq##fj+b;BX z)Fq3Y$bH@Uf>*oPXZM|Jfi1k4Z#t;4GXE0NgXBSt0`WEpwSUuLy4vc}T@m&QG@mL^ z?c~of&i=d$c`QTPKbk#zezUkYfvF;ab&6Dqk4n}Mqgz=aTD@wOVN-nXt4W(&ICj*Z z5?AZP@ti3Fnk#M4cF+fd{tp%HNhn#Gk`$n^^ zGlNiCdIhb|u;#I8hA$w0$6$s3D>T`KF|=v^vbgXjulDwfq+nVL)P}mT&X>u-_yxI- zxI1ex&}`FU^R6MtYMnJMAsVe#N|U@#<4F~S9fGD+r!(Z)52onjuo|o-1DP33xkwsQ zE<6&@EpYC(n}{1!SbYoU_hspqzHa!{-T{SL6%YP6VtVyeSM4-$O}FG+P#GxrBaza*C_~ zRA`9^%EOdS{D6oZhc*;$?k=w3O_!*9b^-r6I0?yi*G<#>%9v;$z1LDK+iQ$S9QvcZKT*~`6K=mBF9`SKIcCkF)JOji=tfb^dpPa+Unrq)P6o71k+A)wqpQI9I0YW<15&d{*|n zx%CK8x+!|0F2K zwnrqAo#H;foVp1ULM)Xym6=Q{i>~B3@i{ZBq&ICPTyRFA*X{7@51WFYntt_#871=# zi&XjY!T!*q$5yX1SjQaVvyijlgvF^l z==^e|+L*z15lawR#iGwr97K8>=vrqUozij=n`K~QLz@jC>|5uL z)4@^cZy}!Z17vdE*p&B4eb!1H&lU+@{RP{w;*5HvgF6scKSS(-9{<|$6HKjK!I4P` z@h6zoS@}^L6qd0gwlzhlY>P5h72M7PR5&

_ID|;ytPNA?9vF@uMfx7Z;iDmqJQBgiF*$?F z+UJ(hz;bWf;rxI~Ag{@-E11xW)4ifU{r?`8e0TW+GX4KAE9rvq*iVcz&ED(q5>{u? zEsPs{h~P1A1?2{B>s5y9p4_*cnkp!m(~V8=<*}PGU(aeh=+~q+^1qjutN5#3#@gaB zG;c3davNoqN=asqm??qr)8 zp|q-JHBG6iB@2s=aB<@&!P4C0#ZEQ}m4JVKj(l~_h-Z>Ea?RlZlF77N5D(mkyqy|> zBYk)0zioC9)<&Wk3p(kSugT;a9@eVO#!(u3wS_ECP}Tk5Y#X!*r?7Vw|*6Ic~g*x`SM&LoL;I<0;l zFq3yA*NE<(J=5-P@Nc%MEygY__QfCc3H-wPfWgq8~)3ryQ+P+3aI|!98J<~-4L7wxI$1kg5!G?VQ+#=h2_+3)9 zuL5ht7(e6~y1P3lt@S z)a%lReZGD)=R+wO{U2b$UZ;fmCNBFq8z z1V%H2kcEMYv$_@jFy$=w!kz9&agcR$IOI(Zriyn0hn4ml3J$>VrO5GT--;#x^gc+> z6934CccrZOFr<&gJ7yGvsC=_L{(e&rX1rMrP4E`w$H}O09Tf&v20y={TRp?0BO;^B zG>;E#?$F=$M|!vstwX%jdC}y8@;t;?ksMj10xb2!qqWzu8(B&VYF91qQJN4H2mM2l z2xEr@qfg*7!7gn523;M7(7hxyU=Y-X?t#Yxvc+>oOZO1lQr*-yO84n#RkC4W8Wk`R zvvK{AhlNd`EJ2Nvwi|n4&rld7gojh{F%IWY=vD5e6J>T$blKYnNz5slmu}te__INQ7SZlso=||wgInly*qzy zfX1y99id!B!X2$xRxp2Jp~@xZ2&@#S{$@4(MgOn&*O#^N zMw%m6*bMGs?2HZ{n#&)zqvU5+o>2MfKfA)8l+qb_mN)JKx&e9%LP7yn4aIn-yHolA zdA-uSWcd;yXdIX6A?%4)$l(Z}(kreXjPf*gdCgiZQOy{qiY?v#dB<;+41eGu{OBT} zuxzc!B3OMjwF;^I>h55G^MNu-W33wp-0DcBm}xOH(w#G z52L~&Lre@Z{g`FuF4Wg9-IRMwFmSJ#ai>jMfDIaq=LG!e24WekEM zqbcS%UBn7**4tye5M0_Y72mwEtmU{{QvsCtcUTmxhrK~lnVrIi#;i-fL@y0j^`5h2 zyf^dd8zpAN{aIEB!9rOuL`xJRk<}1_h-yw_kszu73C2)FD02Sk0)6M%u!QA#P z##jPY@ELwv6;Zy_ff=$lo#we!#{uIl2``E(R|6j)6@-dO4>=mAe14{uWP&_1)h$7S zCu`C!D(HAg8LDSf@-C`=hO#x)4=Z|6@{6L8vOZMKrZnQSb@A?G4!IK|_F*cTCo?sQ z#6Y$eypwHV6g;0B5eR*B39je(uWue-T!<|)Opk^M7kv1COF;fPUW}$M)h<}BO>d&8 z#ttA%fVUI^XqIP(7_Z-z7N{lxgtrIah%dK75k8)NxwL`+PI{1%)^8?ik|-3spb}!z z7{}vbbgFCE^VVq@t3N zG?YrG4lbxvuB#wu`;4)qPM9S~oH2WmxI-Sq;Wx&hiiIj1GkqBHF4v}kg~14tF4uqN zh8?eUgTjM|i*Q8}lyLGT%5+hqlDOnhshY^0#Ec^{XADIqEqD@`y)s9zeB}_Ml5SD( zXV(aCw_!f<6$Dn$_&d3jkSC@J#qRjEoZNO{A(iX~l_({_BmYSIyo z+%mcFDV781XL{Ba!(dO&Dw{&uvPEr9N>oi+v?C6FjYU*F&hw$}Phj!?;AC|cU|kMR zqV@Ow`RwTJU!dxuU=*97va;muJC<>^1LOr;T$a0*GxJq3utdgygd3xij8y`J6B@sJ}VhkUww@s869xXsPVG7oHJ0VkoIsE z)M-`J7A|j!Q)CmX9Q?_6lEO-Vlr zGR61y@Mq!kb&25X(H-#feahV5`|<6SA9#JfVxIHy`mtv3@Aov(GuW`@pM2rO^uBbJ z^8vl}4g+<2zOn@r|5Ep=|DBCK{6FlyV`C*<*DV|;9otsNww-ir+qRRAI=0P@ZQHi( zq+?s}?(4em=XuYU^9#<0+Iv;4s*S3eV~#o2syY944h$rEXn=yKCMrt}Tc#L&lOBO9 zule{|!B`Zm>T^UfNGGxIuL8~^BB28Z*WOqpK=DJF#yO$w_k8J5hEC$Lh_;+yT4jWz z#3GJRvABIC9`kH~?4p;m75x2SKX4yJ@;X9!3Gw|mIgDMVN;LyK+gKMu*IE3j5?;yDNb+42tYN;drtdd|oH{Gxi z70#=+oY-5CF`t_;o9QK#Q9^kfOBG3X^q?~=9ODtNUe~I67%+7WH(P~YoN#ek+?|9B zj19M}%IYkWZ?&cX+g60;EOUpVGaoCm%tC;uGtVXhtphg8Y9r$;vre|QXj>t*wJ7IH zZDQ{x_R)gQPS~63rYSRZ2_D(KSqKw#ptTut3nCNnd)k&E$LJHo1y>L%=dR7j#ns&4bdO2vCa_E^I1%xwKT3V#vYmDTMi1qV;a`D z7-;!9=F1Yz7RJ&7afag(^+v|(a}7?^H^~WS!3ig>PQNo`$}0B&1%iT5Rj*&IN?tx# z6D3vSgg$Om<^g#o7E!*S=99@V?+&iMg*{dw2&j>ib{8f{d=yhT(*7xo-GC_BQ+t|eo&0Ljp3MQte^r7jR#3rA?tIDs6ccnKY)q5!K) zBDSRnn*u-ncE@R1hTwm319n#Ql{!dX``~OXjGi}=stk0|DYl4uzGYERizp1ekwZ(1 zpduSB=b595sPJ?wO_C$lWH#mo7q)H<5wd=1u}-@-0tM8g==A+N{{^a&PG;z?O||)| zp#_O`Vh2a*HhnnxL3X-8<2G1Mgm$mlq|I@ zpm7<9SP(S^3WEjP!*3IgzkguO-G%d+Dchc;zTBNgkNr@p>JCEhLMiilAD5?pwM>Z! zq%~eBqwB$l8d~6|Yw-gfWW|`tD{UD8VX8)haj9g#@XE&kc_V|FsjX_o4Zw6-Quv^v zplV0DQu0ERc@-=X<6oh68aN!fb%Vf`m$iS%n=JKH^GlXZNmw4J5YZoUpRlaKVsg3s z(8C)8Qrn6zFFlRMS#CrvuDpW^`vp93@wKqw^dz~vK*ASooBAW;intYVh) z{`MD8OoFz2ddVk}JA9bsQcU&_Q%c_PXlGcNU_s*eho+C#j>9W`iW;0lan9q*Up?v5 z>h*agdS~^jP0{Q=tdDYqWFs`+XwkOAd4p^DLql|FuBMu*Ge%2@jdTT6sh5&gj}6~# z<>C8kZGMP@5CkM|A^)^{1=maJ7)Ha~yfqQKKU(KAn`SigfEl@oTf6)$b7q+QdN7KJ zwr{0sUe76z^IPRLuSd6hNfPj;x)<;Ji9fJJ%#K!{6;*fDpc#6YnbLRr?n6S8O567p z(2?Uvs!Zx&sV#wc3w~Fn_a2ondcw3Js=;hlLruf0zEh+-`Nd}!w5Oo8M!~IjBGQRX z;X}XMkI8(UC4Z*j6`o+3tJ4bsn{ws)@L(zv{(S4s)-!p_x)=mfj6p)5n_siF77?)4 zMRa&ohApQ$B9yk;&4``0q(mNBfG^U0Id{eMCH#sA`2J28V zI}XUHCAUNWs7yU^65A2`9{pRK22|{1lsv!PpkD6^EcF6>`0Qp4FK2LCA2pS*+go!R z+rtHPqPLTgx76u#w5D^42dz4;`jswObSYK|9s2VqM?ukH2?0v z=Xcf(nG{D}^#uz!=-PpbUhkL=^k zSJlZqtoKRYcNy-BuTqt>vdh?6FN-|^ZgU@{uP2*tXC1=20M~9X!0>ifkl7haQc!bg z+rJJd8c5Wlc*(YLFr_ zO;4-mY!P}%yQ-q@iy73F-bhQDxoec_#N#A1BFW2S3t32)fWc09d?ZC3{Fr0K z(~u`I>!3g~ZyPH*=C;%$)wv3f@v9)zXQMRwjk}|SCvg=OqZ$?YGQCMUf<8d11b-k1vA*`|rjgLGCwDW?_&ElQ zBiP7-cYriFw`F#ao05Sr4;iWcnv5-Vy81emhiJJ?)|OFm+i0mOq?l|KcqJ6IP)s}m z24JbE1u=$zLOQ+QZx&v_J2wDW^}IUZ|Mmm=@c&+e-z;Hg{GfmpK3RqIT!-0 zD3Jx}XdTzoTY6|C@sYG8hkCFl+Z4ALW(YHeq+j!Qyz1jA*Z5@HDLQ>;&Gjzuyabp1 zc8%w3*J#$@RG2T8CRXVNgB-+IL~qa?hJ}e8R3y`0A)dGv{w<0&@o_yNxuwk_+ZjH+ zYGhXq;9||*X-K@UP1CDR6Ixp!j@}JT?cG#((s#ZeE5AvstHv%Kzn`G!yCSSr1Znz^ zA?84T#M$RS);5mF3|b#cYCRRAZcOcOhn|7>D%@M0KV7p{H&!G>7F+p;-ip#cB#oZ0 zKV2Pl;9d%ye18Sjo+i*Wt9#n^dEi2sOoEp;CSvR4TKVw;YzcY?HmY{`ty=r?9xWzZ zes7h}p`E}llr)PenjQiShqIT*Bn= zApqjK01#I{Gb0>!?jn_0*Hq9$a7Cr|PcG{L3pyS0T0J6R22P&OR(N+nE!I*w9%_EO zftMpJSCE==@a3bOi_Pgen(E6@a7oRSQ#qdSf6kAr^Up z)9eJgH&~G-*QbmziSKqws=V@Thl4Gi z@2h5y`D%PZFKMKwTGIHZD%s)gdqo%Vt&u99gUUJR@nMI`(7DpW73>txzL)v z$}O03p<^^mby=XPdeR7gRrmp+TA?(p3Q<*3MvQjS+lB|0r3zMp?T=r!f=-v%emJWT!N}`oTRfb#_n#=g?HU%pUJw*YgH`$?z-zIlFEsGRrn^E&$avKv zD$WxNSZWf-rXPVS&cp92q5J`Ch5$7EWnD0rX>h8Ys-xkEi0(Vz;a6J9v+K*>%bk!)^+>l@A)9r zjJ9LJ&CCv1J5hwqs1X05$#_72X>yP@;7u2>@BrWzFIMYx**2H78TD_M3(&GJf}<4D zvM+?A6ds?fZRwr8O;ys3j+==ll3n)jX~7Cqq;DDI7K>rU#3NtErs+*N(?%IowWm{I z5`CX0j50U4l(9!((8z6@aoSByP#bd}Z|D42FNsju`2LNy#O#d#YueP5Le)FqDRA)58?bsp)|J_j8m`zViPuB^_7=aEV?mtu3Q}9_Yo3x?0U6vZ`ji6M2CaDv8;A}l`hU)={bvQ zs#KeCcJyH&wq^59#(z|&v8SZw4Ay`D$wm9P8BSe63-22~d&0ZCTApc)-w_@zyVE*F zepq;Rpzb_F$)%Cb%trg&O3`{xWT{}~J_A>Z7ckvPs%i9hAILX0yC}ArCK6?6xNP#a zrlcC+!xmiItW`Y>i;^j)n^&9IFc?+rMU( z9%v4v-X_1^77^~uGT&4#!f{f~OMS)HZ#@K=M=aXk#O$6sY6usy(P1e1$1pig`YgT$ zPaoA*TV@0ff>?@Rnn8f7_n$#9J!tity*AW+|M~g&C$#tM+kiwGT&GU8Ih$+Sq9T0` zUju~uohUP+>Xcblm_Zz10r50=7Sw+pJ42{PHLb+OD192A&UK9gn~_rdtK-q%)j zTaor#Z}v!BeBTyvm_M(QKhlYTzE-fFC08D-a;nmosq>Pz&yKjnE0A2H=$lpbZ*zR# zAE})5;wme_n^rVjZwDS$6yU{IkSK3w|8^~UjIx&ia%AW_Zmtgr+2}V#93Q@$ui<+$ zsHO9UH03nI-CbW6>LqkpnX5&p#pJA*lVuL6l8rN^qA^+PNAWzLD%w4_t=ypC5>!H8 zCm6gE0BaDFZJTGSwO_UkwPX_iQQIHjhQBN8P%eR}SFlqp>;}&k3c>a$8O@D_ZB&J+ zea|M*>^o4<`0E2g*eSHPEt82V;_|%^lWMnp0-0PY?oRXrJNC*%o9^4_PSMq>f46mc zy;?F}wc%y0EyprB(!o*dezY+ddZGRJC{rw%gX_4uEUYOh$Y`HR3 zC3FwglS7nFj{CU-Ry}%&{gI2`V$tOtV-Fmc_#Rw%5CpWE>tWmKa^ItMqsG9NU$zMk z9i%L~o}l!n@;ZFXIbx+-rHLVD_1gbFe_q9SE)=+&TdAL&-MPl95*LH2Ico!IaLSdW zsqY9pPwi!KU7SLt{{vIYU&fPJWkz;a=t5j<1+N|_?}+KC@3OGUi}qmMeXA^s+{kgI z;qse`0ShxG5caHzi`Vd5(4hFUtTkBOofyP6U2i4K^&j@3w1~U?%>B74eNYIalnHM7 z{H%kl1H(HMYt7NkMJ_M9o||CqY^&Qb!$-DqIA<*2Bm|q(u4S33Of5pJnq2RU9K;o2 zIU)k+P_9DfuwH4uGGKRT@Iqs6(wiW3<=?xez2HfR@{mti@-pP%6S`?Z(gY#jsg-1k z`ybX|e)k^=J5YyM6_1(XhdM$^J*G>tCD+l_k#vwvsH-?Asj94Hs&w)Wo?y~hE|raC z^;jB8>xZ4!Ga#?3*@d6O5Y_$R5)YBT1ff>?0wm5T8CRK2!6jmLzDI;6*kx)=fX{md zxwE3e6Jo^1%6nc5;d_~tdg_PO_kg|+!(nu_I=tYx@-#K>c4q@J)A^`QX9^gq))^{gAoc+}AUK%Ywpv}pBK_+)r#gN==cY4RSPq)H0`#y-VK}DDcn^HLsTI4odokR7Ke_Yt z8_K1)`9ryrhyjGJ$P&gFVT`Jl!{A9XNKUG2qbK!r`(qgx757}2N_c0ctbF{I*1?nxI)z(F| zz9ml>k0&Bs&~4iNeoQ#~EKzNR1q?}!-mEDJi%Ff{?JA-uY2~lVQ~Kw$PP7QxUAT61 zO&i?d*VOH*ungE>yA}NwryrdJ=1)=I!1wI#P7bS%8A6NUn@?E5k#HSMypbPX+cv+K z>O|ROY-@j*CKCFvcb-|{XS&*zex5n$UY1MUe-s$IWr4f>{ZIFGbF$@f%iXgbt>N<@ z@p?%@4Gsuv+LRRg3AEqk9%d5qSlfJ|>v!b3=8RNjPZq6sO_lrT+hfa=4aM`$W9wdo z2kSzhzn34NYk3DNnqcJQIbRyvQVyk1Q{N+vnLH(qUW`&DJ;H)Jc}kkxCzi~}pU)qo z_4>9Fb|gASe!ufFS&a07Xp=LP|1EM?xTK0kyZ#P~F)~l1I`)DUUR`JWXjUpTJuT1T zl5h~0nS_?#8h`jZCyytAQd8&^i>}8EIw{E~*pN(8j6$#E0Ml-E(tBT2O032GBpyjJ zslX>Vqk9_~wZbR(_p;UxnXBc}d^C+2%w@sXVa8ZqEBx5^P_R0)!aQOxReeEr!|6Kx zrr*KzXPRzf9|g;?Cesv4sO45*B^eehiYnJD(EVN@&p?f;D~@o}_B}tpPGUs2>cF;X zdmUgdJkpNn(lTp%u*St43W;%i&+b1^isXdx5!Cn2?7L6Y;X$PgHj|Kf@hGZdp+%1t zvN{!clW3V#DZNfR7M9{9XB610M+GN7%Ei~Unb|G-Q_;N*U3TwpudH6Y7o$T2h) zFTP@H5G{8VQxsE3Wwy_`q$Ei#FtZIfaW7q`t3_9~2HJhye$(NWy4>;C6SuaGa+QCQ zyixP)A9P`I3d8F%a5b-d*SzrxQ@N|>-&Xg*BFM^W^`C#gswR^HFxVZgC~2p1F1-uB zOb)ueQQrC<9&YbawN9xx-61(XJ!0YVR?jApqV@XF3-;wfjj>vdp^9uPMf#e;m(IZ( z+p*^L6rSaMHL-?{Iq)FFmk&6lpLY+8OHOxZ(@ z7qq+3@iS^l<|XqZpcML`!p^T<4+59gq5I}*Kg7T9nh z)XOzyIPgz-H)2`+z)feVKx+CP%YW5;heM>ZQk+b#+piz;+1fY-gpe+ByaVI-Dk2gy zb=@sX`_d+nbp-~h$n|E~!(Zut=Xo&r9?&wLZU=z8;)R<4SXwSB~FXIRRe{ zL2p{%xHJ0H*Fj%xj>zeaMDLmno7}mVeFx?k|JQg(`_;W8<-%=!HG$RY;3gZz##QT& z&~!<0xS6^uXBJ&1JOej`^UaiV93(YuQxX}*iV5LY6ur79K=@tDpxX)I;xF_3GJG{g zyy3TB!Ai(#r_O61B8FN}eTh%X@u-_o^2CE>p_%Y#>}+yadDTmk_a|=6$k;cUy8ubu zm+2;an0XfcNRht}8DEOzg1+}l+>N}qm=oq$D2Dy7?T^H2Rm?uS_HW=x)8gCM#a5n298yB#-;Ef?dPd1mi)Sa z_hzX=xSH;fq7p-8#f7yR-!t@}w6~`$XCY{n=z>Q~7!+j#V(i&kyTID2KW}oOzM(|Y zu+muui*hck7`*Jfb-$?wV|s8Nqh@g)33^~Ob$tVafZMSH!Rl!#s=i9_+!!!Z$40fS zX8)@9bytB@=HIBPTyDs4oXZR`*}0c)G%}o5s@(z~0}SfGyCWGW{tB~ii#!KWtj{)O;PE;7nCK}Q7mZY2l%%$q z(=*hCdT_t>1zX+6uuNkajNHh4K{D)+ji_4zCWg1j&yaOxHe9kND`TitAwM+q;T)_; zVV{xI?T0u@Y!#d^$~z4HejVAN5iAjNKhM~Ae!!$$gF_tXY);74F$wMlhgOpQh#idi z12HrXk%UMr{u;YUS5OmsxI%^7VqRnty4Ug4T;LnJQ_#g$@FbNGDL=`6uLGsipV6AI zio1eSvz~(12^pqrJQ%$^OKe2iPN3gp8zii9-=et0`1kJ?5Swq#{V;EUXLdb+2SUS= zr+TC2=DfvVhjbFrU`+BZVZGHO9;<&anhh&WzOY!ixBY3a*gfg5$Pec%VveCW9hl%v zFZsbBj_ibcj6cXZZ2#y1a4vUT3p!JFu{;Z5aDS>2VR$UoMmL`goPm?BxoiQ1aG06P z)FXE8!+CL%E9M}>)rSnBkyZrs(e$SmrOPCqcd^HvowlROuNOh~Yuya{rJI{EB@Yc+ z04?!;>uTw>ifL`&#ebMpl1UX81^Fv@dv2XXmE=S1%=#;6ca=78(Q-Y!rZy(x-R8jR z(TMP(k5TfCL$^4W6SbJQsVg3(Y8BdNa~nfRv_6+dJmPdAF~yl}K@6JY)SndQ&@~j_ z`n>>R;VJ!&P=M?8Mws=*e3#;PZ1k2Qoh#aMOL;hG0*uCGRUIz`iTJ>zKzQTC44D=++Ti>bszmP&U)fCOE&LAHy27aqf*SY$d>eBN8Ezt zb3<~wYc03`N3bVzC_QLyS)X?rdg$1-$#imiQe0U?So?tL@OZ7WfK|^Jayq7@M<-nf z+r?@wF;=B_Yx}ycKOlrzg0Ae+rU^u@>L9!a`2r`wEC4#3BPD|UJYC%iG{+CGG>taM zqtH#@;30d-?K|L4ETt~);WbB*mXr9nY*dA|d{RmeyJ7Nw8n$|trSE1dGA8uOx1L>? z5?ciTpMIB3voB5C1VOK5D{X2-GlY37>Uu!fwO8Uc8*-H-`&*LtG=Xp6YiaabGF^Qv zBa=g0kKVlW_UREI%geo*Y_-oYjnWUN<~4X^0VlnH-ku^CIlV!trHR%OwwX}6Qk0nv zDQ)k-0^A+T=yV1>!PH7@K$4I5i?7eOuhzHC?$5{OuZNe-udnW}&*rbU`d!~o-|n~N z?T_h80^hIp?T^3x$5&q;#ZP))&Ci=(?nDlGLw>^jp^1?RB zjqrA-n?|YYQ^du2qGD1JIBId(dFm0!#wA|9BR$AiFMcC`kYgrp$(60Qd$oxqh9t?d>3pJl)%6&j7#92egto|he8Fx# zn#@bAIxV(wIwdCdGi89=jvVc&3#Sz}SDw<3IsU|9e97vpkL8`Cq=2T-;1Tk5ODt*I z{EUvZ$g#ed0~?Qk=+)!l_&JkK$I-vhvSXZave|NvmFO6Uxd)kt{h?3q{)_g1$7{m6 z+M(}iWsBQNkQo^dxrq8s+@m>H_q;5QWh{`ze}7QibTP-y6mb9i<+*ye-4b*(-fOdd zh9EXRSHCh|`u+bDRt>ASR@2%#4xfa=7lgUj9kxi#Q<4T2Zx%B5Qi%E3xdrrH>#R9e=VaEhM#XP94OrCTCpT&ke2U_s!+cHyXe(F^M8}er>Eans=*c z(TU#W^PBUD@FQ$2mJ_&k+)VUuwbMU~b&=(Ky}GIJYW{hGd6DTmQXk$NR~7wCU`KBy zkbL=oYDze^{ZQ5*_a^MzzCB0y?u%=A$p+~^thBSftJn6HfE#APUiNk8>wDM1*in_| zG6Va@6^(0qdFuO7y-QGe4x2L1Z&f+8-0WKh$cygFEDJm7To~p1-frc;Tc+#Zn&8=r zYU!btaYTR%P%rRSd{aMPS9#S4T1yHq)29PX+nj8U&&}k#Nl=cS-|wdRzl!-k9iFd_ zb9{a7x3|CckH6jr`G4NHb${&>e7@v-U5D_$&jVUld|&+ls0smm)9Ia>`&ai_#s1M1 z-*oob;dm#~^W^5{rX9S)AwSA1K~wkFq{Q|W*V(=4FiLko-c;<& zDSHU^c32Uc1JSo5+i$1!E^Y`{JfIPxno-KFd*Dsf*v|URew`#Kw2pqk``EnVBx%|uZ5aH2kv=XHe-1d}tPF0=!s8WARI=Y2}7jvnL zk!$BoDq&O{_;vakRmMz4?JVd>w>&92jX^U6 ztca0BV7Cu;1niCtwJ2{W%tUv49A4)YI!ulon=H*knUYo0p8{iBlb)&u*mIq}VLT-G zw1o+QN|};(gK(2W#5^>DJ9z6#cAJ(yb&z-nQs02!MbCM9sx>WA@WPsRT@W0-$L!@Z zdF>x#4yg=c{HB=WLawfZEk>@3tz!IO6{#nGAUy1GxSqaov;AHJW3G#zy)T%?aoxr` zlcclj!*ReY$_ya!7F8{2)<;+5uTh6N0VFC5SNaC^xg-cVPn43I?BKk6fql)o?@-5_ zDvntWY?h75)1(=d2h{&#F#^2(m@Nigd;!LWP`#b$FgB`$?Y$N@izojKONX49AP%bv zyYt60E+xHX2zL7h4_aG~SOr9puyF6ipV zAV}Pl+rA+*zE4$1B| znbV|=)-J8PByemZA)*mOAQh8f!%Vwd$QCD^X=H6@W7eO+`8!#IcL47bg_5G~k<{q; zkweS$)neXyZiBkab4EHDA{Inw{z;V7~jv!HoNs90?%zYewx=0N2ITTf(iPs=xvWW;7N zNqqm73m8IdUO%}MF*C>Y(hyGpkCM;}itAp(g+PIk7H}K@GU3y93T)x#EOHZ~uE-)@W%T zVj2*>6($?MIwyJ4J`5e{e0XD)lMro=Fp`@Iz2)^!KMKpyEYLyKjVkX2egw$+nOlMR zkCEge)ZbxwnC0R*KUs+IYb{a(ASw6IAp6XWQ~Gjr(t2_5wBdGBbo?x~RN9<=jgv4O zV3dCxzgNXi*@E&f_v*2`uHJg$VFHN%jv4iWA_z?L$^>r_wVlNs)X}G)_R7UrtE)cr zPWdE(AR#ut$soQCm5tv;8p5btAv|)D`X){7|}Q(E@gaB z&4yFks;&*tr6(B|lY%4%^OurC*M`;u2#q zd?|$NiaO0aK7a(sEzg$t8%NKo_$69#%HCyfY6zwy>=`7Y;zb7a2M9-x(JIabhD^Y9PmMQT0NKJ^hBS~Wg4>kD6jA( zmgBVYLH4KspheH*IQw!xfFO4?wE+~jw*GtXjOSSg&rm=Ub8nZ|W@lFqGe`HMM? z1#W95>QY>(;6q|Mu^0!+=3PcY^O~=k1qb>z`eA>DY~OHjvhz-hLCe1&%V+mbSpDha zrRSjW>N9*a{nkLUBVE71GfZ3mIAXN9LX=m4hD3hl)j{{FaC_OP0H>LYac*W%5NsmZb-aH(Y@%^)#fU(fe=uyKuCa0M zJp$BoIf@IQhGL3n zN1M~|?4Q|l-gY7adzzAxi~oDhMx~=0H;xerW!=C;f_ zoqJ}vc=oII;4rkvHz5T*Ls>6tV+0lLMqkA%3*LC;)G|JjA>2Tv#eMe)ErE)EryGHz zasQ6T9o{)+$+XrZBy`bWpbZ^O;&)^9kP-D}c&*-VANy?gZHhB5dAhyx z?tF2FdqH6#o*Oc}vPCCopI6C&0fv@+!$P|h+WFl2i;zisxz+WVFV`L)Y&JKaZBWqy z)LQO)3;Ulm!SX^VjKv@B8(QW(c*3R_cREn_Gp*_02DyGgf1^c}{;A$$5;{Hj`()eH zym<351YG0ON#xg2?f!nHe-IQKIKmPJ@c8HR%kcz|xcIANXG8S*Vhs@%FU+I+9tSdd zLNk2`2b0DQ9ne=8Z7<%v^t8z1?V~{6S<)1wO$i<_CAgUx>0rWtfh9J}zN`$5_BjG{ z2tV2w51dL23m}!hVwmP=DK#)0S^UURU_h;dh|c{5uGi{KoumJIaOH-_D&E6OPe%_;AMgRmDLOi+4usc z?MTuWl>gkW0$mtJ|9Fi4UkU6=WisLfvJ7QG4hw zZR7^0F}P=(jt#e=X4RlHdmZ;Er4X|$6^FKi*3F^nDWJTj>uh`Jzxi|$%|1Yg4mFgr zU5213r#;zJ$LfoC&R$ZpDW+e^;K%A^1(U@&kW@HmzKPZ-WmNLYXH@nBV_dfuou~pY zD?t}RzJtl(P%fko>H;aX)(mq>@h=|v=fF&cm6SZBW7SluqAP0qe^O^UPjZ%%=s2OH z&#?j!Str3+W{#D5j+J>Pw(3MwtgXmbfMVVbifbaC7sn)RHp?<~_6g)wO7`HpMW)Ip&IB zdi}_i%+)`y0+^i?W)FSANU}`mSa0IMEc($C&H&T-hil0UQKM!FHwkWAEOg2*mf{A_ zwLeo3?H&acX4(nbB5UEw78?^)E&c*yy2R;I0R|lr;~{xZ(8I$Uc-@V56Q4gBHkJd% z4ph-6mNE=zajiR?BlF;mc=*4Q=9yG&0TyUTRlI>N9FL2^rzw3 zkHZHsG?-U_C6nhIc)&4<_F$Opz_y0Z!zZ%J3AZO|_n2+&$G8~xiT-}QVQKESg+DPr z&++xXSQ0!bE$Px+e(mCCjWzWjKb0uWT_MQ}ksBhCeINtknGWZj->0oSrf*83mk zYC|~aKRT|ULg@g3($n8SsRR9rBrJyF_C0do;Xi?r|JgTIk#ZqIU~19n>@w^iP-zsT zT`QFfOTxVDY~9^fOIy=aR|;J0|xm zN_0hL)tUe^lhU})4cjX*$sAH_Kn$jc80lYDg26`YUp6_vQh=t#oCUpg;Sarq2Y-#c z361~VgS$k1u2Us&_^AOpHRg-appGy8$QX#bB)} zK~KokDb_47?mAD9eRk?Zs3fb3bxQY&wC=qqA^Ajp-x@IKGSO~Jd{r7>4q>)`l_sFw zp!qnqZ>*L1=r|N+P%D>o%55K^Jb`+!oRT~svH+Nn-nPzNbM?y0E;J34qcQOfe*lb(kPp)F0v7jtKg$IVEbccU7aoVuZpl8pyRaGF|Be zD{IN3sZdzc@{k0H{STc$%OzHP?6-+ysvQqEr(xQsu8}I^ae)iLHY;9SFDS~ znegNGUa-P8|J|Yv(w+fLI|wZczGRwDnqck0mTR%xel$-9;>p&6}wqG783_ZCj) zP&yh#uI1Dz-~}BWx`fI<1*D83Hyosl3c6%WKp0p>*BDj)kN~l~lGGj;mzz`4oOOWC zy~`L(>hC13;on3OVeXo?nImO7b^Qm<)Uj8j){`>*5TXIBgoEgwQ&T}|m=UvFJWF*} z`re(-D#y51p~b?`zqT&1*4Ctm%`He;uu^UBj&lbnZ#2BT$O-l{Y$K z5Xro!PtCPrh3Wm*FZKYZWH=MQ8RLOznEG8ku4D@rhS?#@lmE-j3a=-B6~uZD zf;+R<9JO^pgj zV+Zz{IS~5?Pi@mW5VIx-x4B}d$(W4UGh!yg(85trL|^_{HPi_lqx8VMCFN-cRJDO` z%V>lHLF@|U5u^9o?-j#`6gL?75APP#Nb5cV8WisY43&8jjsAouoCHF9uz>=kUlNFf ze*)U+GxeGiEm|C!an2^O%-y2hWjM23BsuiM1y|Da> z7?NE%C@|5iB}qalwpb%tA>0{&@6w`R+5@^9t@iIs_FOG_F=5y8FVf%gT&NpyDkzxN zz@t2=uZfM<1)--rDJV#Y*NuzM_76^Ure{)|`v84k+(WM8?^p@a3~KBR;J?I0F1j;8-~KbFG?FGrGus6kGMVDxc3&GVxFHNcBy0=;M1ov$ zhs-9R;oBTJ)f_p~Oe`DVPp$>}`tb)=CL|~a)qnBxPvf^J2+=y#1hIyLA;dnaxJ#w| z#N0>Fkkt}OLT}5Au1H7Iwb<`E{LPu&$6ZzN{^N@^hGx3lz$m^$|H7E8;KV0Va=w> z6cguR%}34@leI&5x3V~Cv|vM~b5;0mI6ydN@ckc^1=rQkPQ#xY ze^;VDthgiTkOV7|9aTgtl9?LhDTg7uQ>p|gl2NGq{;eDa%aTY1xc;TcpTN74#O-q* zZ>K)HD5z=mN5bGfbvUuIZnk1|IEepJaT*?vKRr9JYE6qnjP4Z%D=0;aGqMC&`r1;! zV+xnp3QcZed)faHdiJwPQb?AOk#fz%4F9V;OdP0>|BQy%a~2m+1_X+k{{)JIPA=kl zmerqZ!cGY2fA7qAiU2OPyKRHO{CU0=cTMu504Tm4?>Z5Dgw#?%n>jXZka&62qKNDUq zz&dPc1)%;sizh8NC3WM4S6(5^1pqWvQ%Mvxu_#-BbN z8sC^e!b^>64zrIKadpYe=VUg0*Z6fovY0<=ZnDUq?Iu}(uRcM*|CNcg!#0unfkXVS znwV{Dyl{Cl;6O@K^!Hgy4;U;5E6sWH$BaItHCqlh+CX^+}j=EAj_|($Y)VtMX#+XOHkIX9y zw=$LbnQ`o0MI;+T?;v+(i)dBTu78F`XkrP2Y*`FfPS%W0pP@yD{(&_iYGguB9S*Lz zU8}>5nfRaBZ+rD`?6*A>^Ig#G&NgVj2qRm(FoYgm=v&A}5{dGkhjZ)isJY?+VRmB3 zKL0TdCjIH-nUod$Ut0kl48$~);46=TkY-`$qQpG)Iryg6>H~f)!zl*TIQD?3Fx4AV z-N8!4I2WBUBatBJM0wM94=@+KCXOWys!sO7au|Igwwt|kT`A)Ia(HFveH7OjJvET5 zIw!uu)(80yjbhWKHg7mxi$}9|xZrSV9~H869I){(YtKIgd(j%hQT?7h_<`I|kP!U^ z@QN-#O4AnVzDN$fY`XT*qL^E$CGc#BMPJw3ofpp@q= z{m;>mZhHs7&9_*jdw=myP@8=4o>M`Z5Y!T``kjK5UFsBavx~5R1-~0M>iudjFQ{Md znRdBej?!uB(1jGMXwd=p$;L*3xBM8Knu5kJ=BA;j7@!+q1S0DPPdyP_pe;$1XZ*r3 zw@R~Fl0GG~0-MT7IzbbIG=q) z1uxTS=0i}O%FKVB`Zy}*KW~!d1Pl&qmX0#N?x(=RQ3OB>@0)gin=u&oM6G--5r9vI|L8z z!GZ*W1-Agf0zra%2X}W38rjHOD7S^DI2)XRB(g`Su1?sp-&9H4F#l=t-<5Bubcl9zmZlg)HyC zHL~_qO{*5DMc_Z_EH<8q!9B27mp(8uZcMWHB{bb^OwyEkOB&oGac)drkyDhm_=r&Y z`PXLoI2QL*yrz9?VofgvEh>P~871QC%KC{y-YY1#qYib^>8uuokl)rxCV~`FaDj5D&XX&HD&QQMPLY5n{7X>WA!>tPF=NN7`{H=_+6b-_V0|Te!MSdKO(I>7OBr1 zd-jbsYv9Amckr=$i<*9jpuVxtjaQj+oOFiD_Jm|!%_r8q?ZPNQ*R1WuRyLCBqSo#C zPCfr)J?gWJ1nPM&^=c>~ckzofHFB0aFc;lhCRDtT14^Uwb&UN85kb4wz8K~M97cxL zDerdf6}L{JULj%c(SN{I6Sfa}m&!V&?_7!>HDZ`Al7SpSJi(qY1xtj}KbK;Ab zwpo_z8eOGYoB6Q606kvH07nVnT1Y}6soSOLR#Ezl#?1&a2>xcm)SvEGDt=r~;Un0> z-bhXc@UY@ghgb;+z{6aUC3H@T8XL(#$5KKE;9Rd?9xjtAnENT&|yO$URK5niQuOUVM zk+ntb&12QL&2gQwEGI8y12<}b3@6!hojnRYqFaqzU>6f2NkLY6Ayoz8P09bF+3Cp> zWVH$SjPEU`166f@-tH#Wnz&L z-xQ2Y+uNg~y5IladK~}Y!xx1vx?dVnAM<)X|6b3&{mk&D>7?u0PJNnqDe#=ZuknBjbTK>tA-ULC8C5@ohiH&m*o?x?;E!?;5BinP5bOz zgRof_ayJe>qN4ThM!QUVc1rX^h=Dm{(Q;qQ#nj$em{P?Dt0(_Xl*#377o{J%&`8dp z#GHRv97j?wCa~=r(H@TCGJ)zxD0avNQ!{3&xUaTpmGHUK)U(~Cz)`TYwfgz#MoU6p znPgAx%ZMvH)*?;AQ`H`!Ma!eGg)X!_6@V<@%Xp8ZH$HVf0vr|}>!{ejsZjE9=c8ZX zX6ib_$=f+~sGsPFj-Of0ueYCFi%i>R&nDhQa7Y|ReA>ZM2nvaD1ZS$ur;<8s8o`Bb5n9)nCFrAl`JRY{677?vwnprSCPS`pbIBJ=cMQ50R2U0ELM5?7Rc#unpp z4h^RxUHYEr6Z4wX1^rL^)zlbU(|=_NE7wMq@>ILUhMTx0SxQT)4sC&*^x5Fb;7>j* z20MK+^?(ajf&u0mB~F;=YN=^+)+EV$<;QE5$3fQt`TE38%Qn98$r6rV3YsHeuHYjN z`e}8M6`i}{c1iQB;`+ugLLQ-jQj|$RDYq|sQTgrdd`X0sAQi+B{LZN)5;;WFQzj7v z(_|Vf-M|>L3UG+Yzm0&IFNfZ2qSemT(Dz|JE8L3$GJKRl8L!xXlsykOD{<_|=e?Kd zZ=>Q?XP1Yj(zW01e1{D7*Q~)l2g|l|YkQA(%gg8K2W6=DE9yS^ z=C!kuXUiJMGjpNkEM6DI#R~}Zi}f|m2LOApmr4(weYTAIW`d)qm9+m1cj-V|#n+>2P< zLlXG_rceOJ-P8Dui0O3^Cn=Eu#U1(M-NMSa^F)iSCkc<_e;77dZz$JFvDDon?Zp8= z@A&TmKIKW)OGl7GzN!96+eMN7NtVW$Mq5Cik(lJ4M3-2fWweFFi8%lV|Mi?cb@Ws2ayM*#(|tUVmp-nwN4W~>9nlu6pp-qHf;HIrwvas$n!xN zg~&gzOl;CZ^s#74WWn)5#8Z~^tcUdMRyhe4p3P&Jx;B@8+e2^*u-R-BCli8nE_+Ay zv9F_G!O`TzpEg~*iBy}+l|3koxK()xKtBL1kWx=B6@$&Icxb0 z&OovBz&^fhovAZ^7X87Pvb5%q$>7nba4Nl;N^M9fd|YivSU(&}%g;zED-s_0Cfeoxt<*7utXj+y_DwKkdu^`nis!q0E3Wwvs{uya%*N z!@qw|5qBafg&ry9>@r+v*59@YVLs*o z7f?Z*I#YWt`jqJ;FvMe~C-VMp7Kkc;JepG!T?2#MBPlc3byJU@6~;{mnH|l~>X#ts zIfffaad=O<5nQbshF>3gzrIwr`~k@WajQMl;ke?X%{XqaXF|#PhS6bwqZm4J+g3J?z8q-g2 za=|xkQmtB<)-ZWxS+yAegPZ4Lj2*F}=5>xG9r1}3sv2;xr)}zt6s{i-R%4Q1N3iI* zQ7sK6qAC=A{@gtpWYz7_Oti>8+9vfL?f{J@jYMF%G}ndzeBp_Wq5FGAs|s<_F=DMO zl}&JH!|N~;meO!7ZA$G@uD5`lw6*LIb{4+ztN1wN0!_6X= zJf(AaCR>(Sai}_kqm_bS;7r zA&e?G0alokzbgzo;BE}-5M89D1_gPHd~1_$wlsw=xMI9WlWd{ANK+ISZ??=XyovJ| zv8YpxMl13L-5lnQ|Kwi_B0DqFTgkNnHE#Je-VDx-r`ni?!{=BYw6kXxt^a_X!f!@x z?)s<>(}q`CL~L3rc&TCo!|qB5L6;ROY6gC0p6|{M0}fz>oaQiKZY(GP;Q1^g(CH1& z%3OWZE*lS|T#6!vP%SN$+#|Veh14kkR%6BqfGGwwKpRx3d<{xwoWRm40Mf&tx$p?a zi3fxnkv2^| zF7%`Z3YQ`CR@j9*HI~`2of7lrxt;BuQH>^v03{wTsh}y}C{?rKE)iwHUu7U3SbSCc z&NCdIUo4a1`eiVij5h6Mw`V9d^nUtRiLPK~N@M90fl39!lj>Acak_?+YS-i=+D#-a znnT;Bw(p@VDoNXfLaha8?)xe)Pj|A#XA}KHE}>1azYrTSh@N8bL6uCGSDA>F2WN+0 z=|LmjYGB5i^ka$;f()W(Q)C_;*z znsaL7k9ilCFi2f72F&Ae)TK|=D-}C$yH{O9%&1s z=(96xE-di3!c=0(%HuoD zoT2_ddkuQmQ zGS+b*OVTVlNWrlF-89cXVu0KtP9(`x@0>9cHm||6#DVp9yNUlH(mQ?uT4EloT$hm?U%llWD4FKfc9b@DZw<}ah746S? zV@Lbppgdsvw)%rzK(qIVNq>PmSGRId7VLisfT27amU}$80>!!D_()ZA5pUx~-kRS)ek@fAPIWi4@t_F)&!4z0Eg2~=S z=Y`iNW}AUd;|wpdr@nnQb3^8gOl|(WMkz~wHY5`({O|3$;mLN1%U+zpFTmr@kvsR{ z{Qu?uwf^wmi_c<8Y=6bsJP6P_)>KKkzSKhJu6YnPTp67grDz)hDM3ynRO3dp)oz`m z_TyB51H%@;r>FhfS=~!=Y|!%_`pVNNq#2^zF8SKXhvkK1tWgy^bq_TMUBg3Ncz>DJ z*in?w?Tt&iPqCn?rEzWQSQbT}7Fn9+3fS~lrU9hww8(HRLtq~hIBN$(HK;RI1)9Hl zb`Gj~mXFW@BHbq09?L;6SH+`E`M4@ZtXKyO!y1q1nNoTF#*X;9{#Qz9m~Lqj#JsgR zSvS^BYlrM~N+sVIm!&b8ekHWQ7?1Tv zq*nNJd{8DL$bnbJS*|eu%b{)Acj z(5lZJzEDTi=FCwGgl0=YX}3d`BUwonlP_IEq!f+5%q^xHHxGZJUE9eeLB3>x@W~;-?h;Ds&yr&uRurqVs1bu?VBqteCg0_#y26*X`aNzFvq0TyJ}d)GFJm zuPEF?4BrrvMZP@D^d6pED06@kvbJJ%UgI8)f^7M{yrcN2?uj9&%*bI?$5@_H8F`xf z!|Rl{F5hpb;0?Xh>07~!tSTr9Hi1Dg$d+XvMoY>zZ9=xwJzG&}^51Nw#_;g|&1D@< zV-~BWZ1elI#nS^_&6|v4x^5$VchK2F-AJDPu+523>~$#l$cT*IUyT&KE=@(eiXIxh zOzj*D`k~6x#)*d3qB&Uti@vwJicG+ND^C}bY92ui3y{X#*Z{^ z&un>m1z^h%@7_cS@9RTub^tXD@TEhnzKrVlS>{kI;_9;uXi(+JG<(aI!(?*H#*NvoGs&PV)E4+RxBVIEsS*r9g+|*BO0Ib|KlFC>W$$ zojH9ha?qd^F#nBleG@Kq#ULdJU^u}>d_KcWwin`;m&6eV)%Jm6Tm*NhEm( ze7~v8xZ&KTa9@((f513MVGf+z)m;Z)D3K4m=X;lg!Zp05NFnum>r>p&#>qLVV9F4A z9f7MS3SChOzo~a*ok|mo+?v;GgJW_<6s5sHd7K~H=BPshByz*V$z-NlmFyuF4x8X@D{Cm~cH$CO`(kV{q_5!d#*h1Oo23*`X zW1OeQA}_sN7#(FQ7_^6z5?KLASbBy-Sa{K)eC0Z;;!O-U&TjR%PGIXOt2w(_spftuoA|804x zGS0G<)DMjK{&AuCn?0Y4=BW4;lxiV=D|JjQaN4R+YD1~nW^RM^+=9w+i#tu38ew~; z!&~(TM~_|II5F#L;1Klq30KUy+`P$vg12Q;lf4z}4XTcijmc>Sbvvl&3_a&0(+YqYil0lL3+A98f;q|5a@emIY)GKw5e#J`h>m zl^p1;6o1fX(%tZFcj!D3getiSsv{tI97mM49rT}%DW1%Dw#r)i9gq`X&y^_^$9t=s z(84|XcbI#8b|--#Vg%yjrDuBB-xNTk*z@5FM{7i;DvdC-g)SnD=FF?%7sBENF#pD?=U z9{Uf-Q{Rqxl?#}66jCkPz;S+5C5+~e1u(TZ3|;=SC6}#M;6Ozs-8|s74!n-Zc|`um zkV@c{#vpPE6xQ@R{23ci!k1)2*Geoagsoy}rf>mixto;9m{=i1M7mwTtd3QZ9I8d(HbW+6vfIvZ{Q@d&xL_`i^&u3c?wCn9_w5}yTGylQRbf1F6=@F1}ARjg0B8N)AD^crE|^Wt&W&b9~G9mzg72qqNv3`SRH> z1NgpDgh^3rdt-`zw9Oz1bY{Z%64(SA0ZdI!7e>7ahztGF-!=*U7z19!^Sk1QaRh-V`d2ce0;iRz5~a1fsx99;YcYzr~%4WIKyNeTN3>2 zx7?dk<{w5}gW(cRl8e1VCMQZJP+kJz#m5C>HWe2E6Pz@>T{-f6Z#pBR?Am~oqu+@g?bHdP&ZgJ(A6+td*z5ZVj4?bTbx(ddA`Z$h zrvBlR{!oy@^lq%ABV23)v_#^JXYipZfUjx(EP}cv*&r5iSen=uUMtC|22?=2~#5zDu%++(op zDn#xSgixkc#)x(^QrZj?v7a*>xuOH_BJ5>kP0NBDT106x-7Rb3>yu5jvGru~ux#2y z4{kn=yVjc9ZZj0NOAmu~=7*8{K9bZz|L+mBA}eAP3*ev){sYG)Nvrp{okW5Guhx`? zRD`P^?=l>=9>k&Vr+#gU$1wWB&?ul^BrP)^<2hAWn)h}VN{Vx zlH^lbp(ovQ#Og}@1K|(aO;6KdGOOXfp9R5oo9Ko;Cl`XU(5^0`G&k-zQzKs6v1t9smsShMjrz&4lkk#BQtm z@HYP1`8E1g)gf#-Y$IZg0fbs!4QZz9T$!$u%}GVQhRJApyB??JWkr@Y=>^ezb%5yS zKfT{Y>T~aB2aJDxczvYFWACx*uI_PdLKf%Hr_U=EWH2)9DhA;}nRsnMxtj1VRJrs* z`SkgKZHFllj-n%0&DT!Z&EZ?00c8ir?XEFwlq6E9rx#vL1;o=-*v}9@tXe4vSZlOO z+25*(N|X0ACGO3T1hQX0lkTgRy4toQ{q`Jh6s+z$@{X_@Odk}r^pn*-y`lTLw?*SO zOm4nEJej@Y|NY}YF7Ag2x+3y+Ogs_pzPu16`olyQfHA^>Me70_j93-+NHySCFH(Xp zaL}$S*I};s+VC#wdE#WO*-Q5gf)Ata-Qr^>WM1FYajJP~0)GR8?A1~%;Cb|uT9~d^)6Uic5$a^|5H)a@94;@iijf>B0Fd&X^DEyBKu=h-76O z#I~9-We5frtvEJx`gh2I#R#EP*!6sqh$R;N;u&pIRDrQc!l ze1gSiTRx-qG)td>nx#R3yFS2}nZps&VSNK)@;VjB4Sb^@WhE7MOZG4P^>V6l zv0yXP+sN^*GqMPJf7-@B%VI$=X|3l9_cv`RMCQzP4Jp~1`C#hynDc$(^WyPN8!dA) zTOnWwGfAe>P$A!TehLcOA}xO-TF;6RYJx~I(s=JLE=AkpIF#W_io`N&}rQmZg8fp89f6ksPghmBv89J*zVxXEaApq19v&nrjI}zWqR$i z-&WoUOIvMEDz_XX@6t7QO11H39Oe7yE8BM;rnj;M3Z&wLENR{Ft+51OjRcK+S*l9i zr*bKnu9;r}ADIr`Y13Il1fMj(erCDgl$Zt1tO&uXJftIxR0c_41?@#dd*Xi!W_X?a z%DOmZl&5qrG;i9Doy4*UMbkb!12??H*m1DG5CNLaJWu1LIgys&Yt{yu6?E^t%xYzU zReEC=PummdJPF$@^QLzd#e5Hmp%T!dKDOwQea7PmD|A$+9U}%`D<&ah9A}gurG$mb zhv6s2FT)9U$GqDsPHhfwY@bYjNATG?&QNipb*mBVH*JV^V3Z^enx&8X5`3*@AtSv} zrCqMR-~y{=9e7ha1W7Re@=`5X&zfSPpW^kPXplY1G33j6&c{&6s-?gHkt|%-$$K5d zKI<}IE+E`PJR5=&)(g83#&sDabx8viee*sFDDeD^H96ZvCbvM6@~1e8pBF2~zAlT6 zx)g&aZiI(HmB#j>B_IF~Pfq}NI2ka|_1i5`@cRk$!5?1*R14M2@mK6KoQ5u4e>QyuhozBB1-^%z@d9 zSL+O17s~w2uu->h5??7YY@paeB`}^#Cv3&zB8_?9Ic#@rPV`gV_Ywpv(iKp@7__kW zhF?^2Cl;*I#BqttE0aXjo(s1?SV{;=JY*S~bg-30Do}o7dJw)WF{1GxfImvg4}D0> zoIR*`>nPq~hEL9-1oNi73gD!Xbv(MT zz*dJ^=eqkKIaO|JM{@UgjDAFey{_{;u9D*%?s!aHm632B4zqZ)>Kt$DmUnwc_=}uZ z-0UbrP$`vXffkdI@+2S45|-`rrGXSsuvBYHTVV3+oRbqCFLY>WmI70*Pdi;nzDJ6l z)QptUAxFB%DY{%J^;^Uj^|t0By6n#8B3V5L78{h7x`ZH4ow@|9RRhfz1PcQd?48Yw zo-mCRp|bj8jB#o9q@~u;{L@3%qc4YSdN34IUNr8*cep7hlDegpvkY#n6FIO_Mh;ZU zS?`7%+Qd>9d$(Q@H6f~(AjX7qekY{yXLa7m;G|2*tc{*0q#i;OPvm5M2Pp;r)q-8? z>1m#`zwG!r#MiA`Mf`kfPVRgC{lEluR>K4mjA0gIop$;7&toic`UBmY^y%;H5w-4j zlPJ|jM?1PWgzea!RJv~hwez{{61@~+8NLu=p=mKgfdRH+3VK2N-8=4ohk zHGz!)lub=x=k2(}4zkD7lKk(+I4}7p*mzzyhbSJpx?VJ#;F*CGg&a+*=(X1%k>5bZwj-QU*I8dgS!)P?nm-KmXncAwb^uYzO zzrx9Yl2sccO4zQK881>80htLeFY7NqxPDYEOS%bN=UFP69$My!jC$-Dn6xO@E3KKI zw64~%!#Q!fAJ}w4>*lyP%FzYxMd9dR*vkUk1v5Ph;w4XGDc zVQyr3R8em|NM&qo0PMZ}bK5rZIDEf;^jGX7w@>XfqAbUD?yKi=H?EW1d72lG?Ox|5 z?Z<{lNJ32#EC9+;<34};cko7nZxSWTPTDi4(^w?1SS%Kc#l8Rx#r_ntUPvbs5>NWa zQ^bTfM^X5fjXk@&ySs<``|97_-QDuPgXg=4e;MrWJ%7Hpw|Dq#_b;U*kppZ^H9|;j+kI+6!1?`cT3lxS!D6vb= zXTggI34dB!*T+ndF~LDrv9?%%laS7NkH$U9hj2sUfZp)>qJ$?Qn)hN9;UT=ySk#uh zPDi*m!;BLe58<1?zkq=^IP`XVyYM#{czXl+=Qp)gC2*b~9}hvl%(~0xT;Qm-Qi54T z1Xn!>Nt}Lsx~Lxsqcaj<-kZ$W5Da*4gyP>2@k5#h9-*Eerd(h)4(UyQHW*=n2DQNK zpcHz$=N*{N?sH@C zCev^ZK8?p@k}@<3F&v-0 zl*qHY`)!&SI;=nc%kqDQ!W8q(E&z+=|KMP6|DY`Y4+eur`Tr2l7QDn`l!gNI$itX2 z%bz`(vHccYObG|V0l|Nc-oELLDT|O0Sj{vn3%taBh!}<$Vnj|Z4uZl6Ln5a{03;R^ z<}_s>aFm2dVD5D~3@0J+(J@V>lo)h6BtjD`S0aWJ%H`acXEUK65ymLPLC+DCy)v>L z0D&f%hyX~^Fg&Fp@#jN08NZ|Alwpoz(dpoif}tZeQA=MBdN`Jd_d<*U%z9W#6GGz` zf~8m^cAAFaIrbSAd@-kab3U51GTX0GP@KY{m1R)yX zkaxDWItdNls2@Z4^n0h{uF&emmZY^@F_rj&lxxvdl~r3?9iL$&@Ud#*40Dgr;19_NSEiSh1Iw%4RV0G*h9FQy{TKm17S66ve*&mkACmje*91;~8Nzj&LkE z+z>H^kjMo@!Ol>53Ox0vviY|pCQ=3P;AAY>4gv}{C@%EGsg}mNw?ZK|reR2L^m?@= zS94he1;3{xcj=)q4zn%ECE}7*ezu%Vp@BoYdcV2B_2)hU#ws zKS_r$*xilH?+8bV@dtZ+WB7Rl#%2W|DaVtN;-jD?a))#cZyj za9yGU_OGGBM(ZlaT30zaRquTJOClL#^==D}@>wQXq!u(lc`oX@dbTd87CO^eN>a=* zblC{`UEo*<5>GfNEm}_vqYv4c#yxmV8PGVK8&xLZ36NM7rZdb!G*?oXKZTnq@u!_F zIi12Z(EMm8tQ8Q)XB@O#2%ZARx=?o#(h&;1geMtN9$Zk+GEp^Y=Pr%~VYsuUr|45# zWJJYOcS}Q&)1m-&Tgiq9%@sEjhGCpCF~v;H`H5aJ)C`hvcf5{-B?nSB5DY;{Vvxw_ z@hyKSj*xmGIl`BksAttH4~5ATdBrJ#Y!Z!i+uQBTz3O;3NEJ%dy z?{8LVz|?UX7{WKT0JpZ_+(@W|25yh+=QBLcb6>nAkmS>$@= z-4;p`#3Hp`ZVsp+#b#m7xi7*_N3DG4=Ib$y1^y^tO2dFlI`u+4!(paF0}_IfQ7X*( zB*i<8<(ecAi80G2o?IsNI%KDt3*=&X#NW~Qj8b7H zg?;-2$4splyYkhT|C7-)8LCcncs(>VCr%lekq}StEAFEZ>8+OOoz&7$@IDUbvccC< z1gQ;jHXpaZM+q8{kO+dawJTsW8N!F|(VI8jpVg>Zodps`sKO*foXbg~`dfafC278Q z(twYZOala`j7C^YamsVRW(j$#>i`}7f_;%M7v_CQs_1Siu@VGo-9e$Fnt@t(1tb0$ zRw7>VlhO<27gl=LF-;x$zS4F()#aqKwfyO9!I@TvD;gjCTdVL}t>ARF;FT8K0Uo6j z$@MA6Fb-23i{6L`P%1A6F-1c20^pC>@2KLL61fF03D--6+@H$DT)>QmX=FANqjWsR zjCTTE>~!WE_ULRG-HbWpwR;b+%B8P&^?D~iW;6oLV?nl)*9(|^8`23RNK9dh8Sa?3 zZ|LL{iRlo!eU`>@U*7+PrYx3BUv;}?(f^^KF^;e# zkGP>)Ta?7aL@jM*aik0k0pLe%7s{+Yk_u{NRLdR^Bj&*v-EaUif>bMZ;D0!I3PivS z38lajy0%irWW!xa-7b)^UQ4yQqqlB9W+o{$H}xkEPGUXC+{ZCugg%v(rP6#u(=dRL zTr0p09gym|ePuxMr=|&w9X7}rDpBYv=IMH-l(Ccz&Cl|>u4lJW5wxzNmt`q)UJ|Bs z+PHQXZY_+=Djbv%W8{0=p_vTqE+4y8T!ba6eZn&?p8AUl&P8lAPk3;DC z!=HXqRN?rIRP$>^q~0BC3$mJ(mkftg?xKfA7B1M#|3adO1anT~o~|6Bq^Ij^C0_34 zXS?3MCwBu{K8=WI0olm1T%_gj2HyYio^=4^MhQ)DEG|ocv||>cAW9dxt#~CM3qagHFd;=QQ)2n{BIRkjC|~L_CnZcd0b8 zA#_PRrd{(s!qKH(5iZphcnIBtx8HR&_`OE>TriUS5C@oXpE9YN+i%y;cw?Z{BU1NnNjF7Bg8(sD`cJE;pB}0A9zL@_PQ93(C+0|68eAMjs8y49A%B zQ$|PD1mY*>a;eK0M%z~Q_V@O8)f;6|LE%drqWL-YX&mq&Jk#G2%!t}-=(mFdBQZ16 zl5VzaNOW0Gz9}#*iIY@ZAQEbXzSF|sc$&u7m*?cSd_tHnZ_&r%`?ol{{4O0|zA^H{ zyiG$vr1Ew7I!yUAdw+gSlFK(Vo?O0>nwfdO2;BiZ8>UJ7NwOHIogiS`UEgP5 zhK5pXf-m3Di9gR3%K~#$vOP+?#-+7 zbNJ8uAK?3U?|+0J|8;bsejS~?f|u`4-u+YZ`?*o0#stglI*ql;s&`@FqZmdEqief- z<(dlvAIV)w8sm=%_5}`Lgr{gms8m~}vJ4~^I1X@N+zrYcuGQDh7Q|S8$oC54H1_qp zBx0^?+xTNbjSaojzHP#|4l|QD4wQE6PqBZkw6QCcNRtBhc0eEh@rXR2VH$_9EX*cyJWYE!CBZFSk=9 zz#548V3pd=mLmd3bcVB*sdiihIBo|~s{O`5sZ?C~<0|v}SidO0QVn#rWD{f(ONGVj zn2+zZimc}6=XR3)iJ!9nHy@;T?=N1Rd*Y+Ga~n(If7IVa|L?)`XZw%---mdb$NzGI zW6X$uX@%k1F#${b|ARp}{%db{|M1cO{~*t&Pd)8c!_cj`{q4w$BFK7n_pBapmz_BH&jR9S6j?R@%_8AfUlRE4_W!7Y$D zkb8oCS)C`?H^vC5roC&`VrgrYMIw~<*q=USAq+JrWl&CJ{j;o|MDq9F?cPl8*j9ma zfhGK0OKvMrK9^a>jYTfXpesHzM49~6a(y0Ibep$i_z!K$t4 z?MiK%*-mElmPu zKyCxRLmUT3zK=OS){I*z*b0e;?&KY^ex7X4ZECzv3g!aHJm~Bi%VmJ6z?e(Xj_x@J zWLrM3vfFD@+U@`smM!cG7ndyV6c?5)?H+AsOMBSLK(y<6HZC=LU@50o0(J|6o(m>- z0~y@X5Uqk{M)NX~`F6Y=iW#6yAy^#ftY*n7umrgxkd2{M;;bCGvT)2*?^0zrQ?)M!Fu4sa~<67pLylkP8 z8Ej*#Wgb>%%DSeiRaztg42l0kM4DMUuaUJOn!u1+pMG&ar3W<+02ID>oO%R14y82u* z_p5c+Rf>wL)qSf-TCP~naE)B4^s^vyHYrjnSQKPS84dU2&V5RrU~_V3K^q14ge_h4 zS*+5Q{ZsBtI}10msUV@J%%^rwtM{{?KJ}l#1x>(&S1F&5G6!2rriy*IvRlS075sH& z`gH|Q`UZ`!1WjQ00>*@K0iH#v{{%!50?|JEOn&JAWa8U+M{C9hfC7M#hjvOPQ_KY<%*O$aeXJP8;AqN(^hOrRx?s3`TQ{M`*!Iez zwPU!nEuWW|ySKn}Qa2^GQIg1pyd}1v3R<7riuL%c`z)~kPH~uE#^s3Lt&Ju2-~HXg zLCOAqc)0&)|9y~0OI;ETmCtTWLM-M9ei2Es_)|Qz;;R3o^Xg-wGJU34nQ(!Q^I(0i zlZmxP;Up{Nk}1=JbjJBR2{F@&oD3?trDSRB!{IaaCyCC}@tAysZm(M>9s5r@Ss<`& zW1NQJ9DYqvsIrj(C5h^S*ZC1^=&HPsZOHC$7-8*q<}|{PyVZ5ajcOp52NlDlUChes zx~<%=7+$_Rmu1y*nqYs&>zs_iWn~%*w4!~;b4XvQehgoE>J=b^qNHaR{jsyHQ~AaRYy;%SF66{Twu$%ChWAVRUu z-J>(iZWs{)$4;|Kw`e<2Rh3#Us$?^oLQ4x2MxwzB(@4+4%yy=XQnR#6N=_G>44IQy zxro~IS{3g$GK$N``fuY2gIl#_mL2GR+lB6BcO8+X(^E_m=yGJO<4Zf`l2QPXjw@W~ zInzQyd6cF&j66Qo$?Qw286v5A)pivd$8~NtaQH}5?B2G4=aFKT1Xk@CH6vonF@+NC@2WmL0-(3qpL7;UP3#CGjOpK&X`v|(u zpu|+b_BDxv6AoPx&rnE$Cgcp1ox4@H79kf*s|vEbGWOJ10vi9UBSRkMo|Dj>to?3o ztm;vL=wDTEITJw&u{B{ad`7scC{nX`CN&f zSJ?nB9@VVvx>@dsnnfd78k>v~-Tn+Ql|+^!+FgYld0aoZBE2PAdrR;lBYPrHUzYB3 z%w|~O%Qu0gY1E`}2hh#(r@#?^W^?F_WJrB&)+9Wud{=xLHSanuQu^Ym>|@h3Hpe^) zqh3fS-Y=ZSD^Z}3II>yRQJ}q$PBw&4g-fzhb(}F-nzdFGgt;M4x^@Kf+<@Aske z{~hnA;M3vn@a;cj=_$h~xFo^fe+s_cf$e|%ZEPs|ckkPsp@dIjtWW1qMShlLBFs6O zs3Hop3libW@9{jxEW;xIUg+A_(boZdebHG)nEdd#m1!eUc+o9T#QS!q3yNSbGRk@1 z?m)yRs$|3`s?1mG_UiS;*Z&%R{dV~E`Ld2>nI6?%N#SsJ1iY``ERc>yKa%s$rc&uF z+PN}rWl0l3mC?;)eO<~sDTvA1Sg>-YikBsytW;Q0q;-W0Mxyqmb;gV8NnxW=D^gx7 zXz(2opkfyw5BY=^_PWMs(VFE(=jj{CddH}ZEG@MZ3{e)~cW9eKOU|ZbL@8Ib2}^^pN&4v{y%e+gW4|M?KsFK z`9IGOcgz02=Le7H|31u9l9B2#3CGaZ>GgVrtPfQHrD94M`AzNTyz9SegRRZ^FvqQ( z(GVB%K9tf-XnbMSmm$Py7@CZbrTGw<%aR2HjjDDOK(X1e}O4~CWFX;ANK<6h9>4S&-5RpiCMQ+;+*_Fi~>C=}A?>^61 zR1tar9PBWdNqcXjgc8N=CEx+V5sf)E|7OueS){ zF99EQ?rXGgh#nN72OYAJDOFWB6~ym>h$YNTooakL@nhDQM7tTj%q2vwPCab zA|Yn?Pr^Im*OwDEZD6em9-C-=O8J*e90$G4&}M0i&aDpIeL+)^q-G_|KiZ=*)Q`N# zgV1rMuH@7!_sIQHDQf%YzN^$*YdrGfK|P-`Ou6UNs7BaihlQ#wg$^{rz1GH@Z@9piC^FId99__ym@|5O( z-F-2cH;btgn7>Mpm_CKCMsuO_?>u$zyZ6tKj-V^KrvF6ojfpRXuWSJO(a@ zH%0!tp62n|N8a2d8ws6D3G?Sf)ZGg%8dso>Epk|4J72)ctB&{dduFxVv;XToIS*4MCsET`Jda?pO`i zyR)ovyHWE2b~R|!R9`#^ngmzfp--j5S6a`x7UIm@k>|)Vdu!ghGrQ7;d*Dre?osuc zfVEm$U_`KE=We;*t)WH~+Wp*$)1TyN*8elhJi5+rGG1#ZutfhK?3VZcdxO14``^Pn zZH|-i(6tlT{Z*(h(~?{NJQE82mNKmJp+YQr+H<4RNo2j+4MbUk?4fI(>FlM$c+KHv z<*Y~N*e|v2>l4*f;-PctiM{sr)2AGHXF&=u7sj*SSjOIS=QLP315{nZ(v`F_FZ7jT zC5Yt^;Wn8&=(>>oy7*w9{4^hx1ABk%*sq;~={+B&1^>em1=!-erXOMmSCqsVm zq=$p-+e?*FzPTrmVaFKVUdMbq(psd6NniLCwCV0Ny6~8*Zr{ewl?%H~;zg+4i zUB09`i|uwH=Z`yVcrOtdj&H;4tTF#Q+hqFB355;98d{qcd< zbjqs7XMWy4%1UtatD$uV1)H0DlJxW1+)wU`7AYqe%H8Z7q_W_B)ImS%(^CJ-5@GK_ z|2rJ)9#r(d=g%JXzlV6fB>k@xf2dgQ9M^>(b{n+7-Y+y|F$#konoJm;NYT?R1|U|d zTB+F0tPo2B0T*hbbvP^y;;Ri@Q}>JWG%~xdLb$}XI_4F=@-7Tq?>oe?QnI>>wr<@W zC4u=A?HwHQG;$(a)}kyxTk7hv?Ee>DH>`BYQ)|Q^UQ5|gym=EA z-M$G6Z{UQ5w{YgzRN~lXHD)nOo=Cpcma2Zf<>_PL_e)J{LTV;z2GXqZ-_{(PYKFC2 z4$-r%neU}>UlL|cLGYQ$X}7}eF=g-1_O#spTm4v0C7R%v`70O#mihk&2hU6U|7U}}NB{qW zJgxly`KT`q19-M_)bI7PKS30jqpvQE0u$5A@9}&H_I&laz<`Ie#h6ju*<^fy!!3_t z24DKqM*e3vHLMv1woLv%KPaF7vUjliX#ahXr=9$FuDMx3uxGV0`QF-ro89kWP&mV5 zlMtT$F6{8vfK;%H+|$C78yIWvBk~#-q^>jTdg|t$)fc7J$djLCAJWN%KF;1<(8>t) z>${iVm*Z8VpR+qHGE>*KPh%em*sigx?c{HrgZ68`uhc&m#GNnqUnj6HN9sPp`<%(z zV)<<$|JgOZ*Z8l&;qyxV-@*R=qx^q}XPq0ZHWjwTuJMD1ZB+xT+K5Tn`+|VHRM!T% z;(MLYt7>4CCW(Hk@gf3|un>1uyca0jR1|S?Aq3RFc0yxbephNA`m&8)Fw+0#zBQH7 ziM?Qy2dm)d^1F2Ggodn6$p}Z6qjWsR>{8vNT_k8ZuB`5QJGJY4B8TL^BI;)2Td9`v z|6b!i_V+61KOP+JJ<9)wc-EBv$^w*22N=F^uQkp;6zoZD4cBSN| zV?@|B{#>CU#io}=gsjvFxVI>b3f5mj@I~9mhNktRHY9+=0bvUx99)KPh+N1^EI`XF zv9$oyc}RrDrOyi^HcHA*+W-y#o{lucW(Z$+oJ(U2LU}Y7y6ao$}uMS;F@vzj9n9Siq8C&0QX!++q6;y(Q|rYYbiROl*+UhmWLcm93S!jT;hcKZMbk5=O@))E^`uN1ayHUl$X|vmHa@+()wx}D(5IRg`6y~spM>sHST?8n} z1@@?XE)07+fVUv%xnLxow7BTAJ<4y<$7Y1>$F}HZz&4F+F(ao?yYOi#qD4R(M>7ot z2}z7EwJW}eXz}B6R7=1dWN+culnT5Vq|dKOa`}eFlgl?G#-%9T(#NGpmw~N;bYuQ8 z6mpPjr}v3PMAd9R#mhO$n}ywAp!=Mw=pC*$-t;nBHg)RfVb{@&1sA2x*IR39lsgN# zDaWD|dD8Nvm!|3!?p;>6h8^o~z0Gw@hJQ^7!>>yVeXeXaD*=rXs9eE&i`fKUzM+mV z&R!YScr_s1MHb~1aZ>rHRlM|>H>=`ifNd1N3r331c=o(x{}~+a4t5{yKM(PI z`cyu0tZ;jK;bqC?vJvaIgjtp$MH~0R*s82tcHT@O9;5DJdfB2=NDIKs3%aOeWAxS? zLzu0Oy2R9;SR;N=N-|k!-LEy!zfHMN*7bKZmaWx$0kTs19f~K|(YhiM51r8I2z?yF z;laVPgQa%;JHTD&O(=Mj9bZ7vXYlFMqYEH^n&rQ7^lxAdSSJ5>4+drVfB5V%|KmZP zMV|ipERJURHcrE^aQ4^wQhX!wR0m!ihbb4Bot$=@Ael_iPlZTqs)6U*q8f?pr`|W$ z?0pl;gyV^4MbnysE#Ep(K8Q`QI8`O(=iHnus87QoTpXWv+`YXiRE%syNurMVG73MT z{T8EBI+d*ogT!2**sl-idlZ&`&S$Coe@kN`+2;<+z%u!NSh@dccW>|*|NS73*8i=< ziu7R1{d;Nn8}xpsf=?Ny-1BMFFE1np$RBk*sf1QGlgaTfDqya)r6$m_ypd=T$i8Y1 z%%PPy4iZXY8w-^bS0ED!7-7MP&ohi$cG^@s!>V}_PqJ?7FU|+o-r4em%@vVhRV-NR z_V;Vs&)Dg_IxK~FzLl8r%ZNo^8Z1eIt$5yu-f*)z)LbT zzEsg(3~w(RiYn$MSBNyo^e2@k5#h9-+0N z^0NFm%wx5BKvR*Vq7p8z06(clcyEq8GlFk6LY);V$~M=jhXW!Wd^D8BR@1Ur$h=%I za+564rUxP6`Hvf^u6>Cj__IFE@_&Xx5=bUccA+rr`7Bs(DOe`|pC3Le$A3TW{~zet zG78{Cz;=jZ*bXVZP7~-Zl6GC_I+CsnUHRY64(uv-|CT46& zT7@EV>2l!NNSC@_8mq4^pTbx8BjG|FKx$wXFxtkyW<^xj3YeHcumHMe_OIi!mmCno z5E0HL!QfQc*TG0v5K|03WeoF#s*F2X1^g*u0!DaDSyohj6H~(VM^8<^rQLIW6y|?> z`M>@)VA=kEf4{Q--`{`C|9OySYo&NiTbeT1o+5spj>qI9be)u+c4<9@%B?ejwu*CW z0jg2T1;kV+mRI|Gu38(yH~nuU_TM-tf0NH3XRp5XW$)WJ^_1toH^pH@CNX7rV{I(8 z|CR5580_yKJnsJ=K8gYr7ybtegtYdlUzqEr{jDlF%5o6O~|u&HVg-c070=hjXB@swq)| z1TzRpjJ=Nc^8E5#P=-5Oa7?3!#_;dsa|j6I9dANJU;SUB-|kWK3HQp980~j)A>;T@bmUmh=dRO{Rt7%bfkQ}j^f`ho85QdEsD_u2jJsaFcgyC zaA2=+1fNC;jd3hY3Q3^CQ1fIKumLGRV{7>FI-RX85aIt9uwkcjb#*mDeA@X6 zClpW+fP+(y3p5HbSj_W~m!49eiMi5Aqga;QjSmE!n@r0>RPg3Ab5DhAz%t23wZ9 zpvC==qLhLne=;4Cq^zlM70r9*#Z{FRER_-v0l$JV4Fk+H=c`Y4{{={> za$MpsNQ6DfK5~y3MY6OWZVpeLl&9&FCz1hVU1vP(P-n!nSzbCYHq}Q@c_5qkP zh@Xt#QE|#J$FW!&eTBGOlitrTVD$lpqD>729zYNDqh`@)&`D5+=gwefV_ja ztlb{_jUt|fjkL$SL~(tx)`KH{lLeW{_FKWdh5RHiLABo##*|q_|9z(CpS`?4#N9}u z);zB7HdC%?d(b4905rAUsd$vSidTZAZKqNj#GO>PRy_VT8XV5PJ37ui8{lGvI2w;h zOhlW7C2#*74KN&;nyXaYAmSM-t+b?{{?LDmBdL4X`ic`V7rd{oXReug8%EqY1-C6o zL-7meP~El_uRi>|Da74#bz6(Om-^tfnySuPQSD(7fNkQ%o&C=M-GM2kT80_xuK83DH zPVNq2Z+Cas9SKEIz9KnG8-a(WtLl4G=62VlZc9Sc=7SqT{eGqUUT2tELV!%qIzD^J zz0GP*OEZY7&1C4DG8$nq#VOBMe*?sT^){=RGzWV(f^RQEiV^ag6(RLE7A%B*3r9gv zx~V{J4=kf+D#KH&e(J^OgSpNtl=a~3^lhza+C8e=7VaC97~gS5?Y7f73I%4d@)3sf zr-0x;M{nOK_nS5z@&x;2OicUQsHI3;vNReaW5Vc+1XAsuN)RP$qK=V)*OUSNh@vFK zs~C%WV{25Kqi6-g|KH)slM9kOc`}6m&{ScXa$K;xesBQ)yzTthDci?iJKmAkxp!nn zkYze;VN4jFDJP}24+a!-c=9Bs;>nY&i&v(`Rj%R*YRsrj4LRNyC>rP^NHm>n=PG^- z%U&z{Gx~yI+>elKwy!-kl`__8xnoB858@lLXlFj6d$kt#GI!e&tMMc4)~DSc%HsaV zGPCP#VSYeidtKk0^$Ztp&Xva}jft;gPexeWU>v)S9=D#%L*Dc&64+PnXPlcg+?V_U4Wlre7MN`)D%<;h-z?IMG5VcDrlZe{b(Ep`aZ9 zj}keTP!QqG;1LuD^C&a3C?DEQ*IR9qNsMlXwz3;bmT@^O`bn9>^w*&5o% z7>ShOr@-(SGx>$43_eH#=j68+LS>}4UYgmS_py&-I|TCgL4QZv&$HOEp6aXPV#xcY z`qa>er)CID(7QUm!&**x_FD~09AjVLKx3~C^pLd4$fRGHfNK4+9ZoUeSP+)QO_flx z4dkfRH+l9_B{h67ZNux3-mJ^pJ`1=#9lh_IY;q~)3FiGB=)q9|F*)^+iqPA>a*h|c z+R;8TePthq8~H zizEh&{HfE8F=hIdY)g&)#^yw2GL$F5>fE2>ttt^kLua5=2R6vIRep_Y81+sZs`_gD z-f}~sM>rqf>vQbbx7`LZhdx7flH)S7(@x*fT}YCtaDG1f^e0`T!|VcU8U#{>lTm zkdsSb7RmWFmn(FocPx$J%11(9!*0IzGm^>Sf?Jp{oIvjt{O?a&|2WsX47de970?U1 zFS^hh?_Gf!XC*>ZQ_7E_GN4c@Xc3G*#r`#raZU4}&sXDc zVQyr3R8em|NM&qo0PI`cbKAHP_cQ;B9nN(8P?I954_`R#gX<)nbaFn8)20tMoeV@S zC7eNk1wbXPtN;CmpQ0$rk`qNaC)^iF_*j4te!pGpf|BrHfztYjvxN|MgX;y6+P)_- zJ3E>#1;{&3Q^ux((cs>PH_?sIQ;7<>HjFtFGr~$*(JUVZpaA_#j7ZA#EzYUZ*_ftj z7>UG}$WZ4kk&_wAXeVQoYOq2@*Ie(?83vl=^~Ee*+jDI1TY%~rNgMwf-4aQ;j==nr8knD@0GY!2hq;~)@^I_B(R`xT?zS13Ayb6{k|f)vxze;+ z{UE%t8~-6DOx(xFzxX(?2mh`&a$5Mm98P-tpG2C@FG&(LSh~g?<)IHR>;K<~QIn8p zl3CwwmsTYhWVH$z23p9%PRB$Ci?=!EiUNR6)B#l6uI$$sFB7(*Vy6;-Y8sgYf@?xK z%DQ6)?d4jFRX)qj)z7cqO|PzB)inUQ8~j>|*l!d9L=;(gi_vCjSw1Ct;n#Dw>*G${ zw(wx!{NbT~-bYB+hSlofq2|lHv%U6wV72nMsx_IzYIR+Xq=T5T`qLhD2|)~Eg-rb22TUW`V=vR0v7(g3f5K%`vXbk6l#+Y5pqTX zo1}UnB>i6=H?r@3QZ^N9!*N|~lv}~@Z^bs*Z$PZ|ZZm4WhldBCJYZ?~h%0Bq|AA8; zBG)j=W(&}YX#toEWU;LlgRH0N!^U8(YU?A?`9hmMn4Z~DT|y$s`Ox%XhLMmJL?q_J zUgW=28U%@kR^9)3}B!S=&ou@@d zRdrdSoE6QBnYUHt{GHdAE4)sa6iwUn?4C>M#FN6Rbc{Yn-L0=&$xf|_2o(mYr20N@ zMzKS4s`fur$3DyY^!BQh!}sHx9M^5}zjHb4{r{85Q~m!L(ZOQv>;FT{ zp33ouxRZYvOE5f=C8z^rGZNg1D0)j{s(l#l4SgNtp@05z{ZuU1X5{RExXktpBxXR; zRVe8f{+dvhO57QZTStuc>TU$j%;pmw8arF>>OE1kcEci`X11rXGv&E%S6Q!X!8Lx; zn*l?a@+W@O+Z5FW1aDJPWUh(_$ zJP-Gl^7Pa0`ZP%x#>h2c<&mt}^ygIRym^sIl7!E(kw%Lt_ra|#S4=+nFd2`BV*?;k zMNIQZ>Lilz7tZc)h0w1l!@}gRmtrYc8du6JI9C`*)aSirJ5Ubi|I#b8%9H*RY{9@CPBN-T2Srx<|POybu2!_y62J|9cua zL2mb$DbFeiMZ%c!MwWADj&s)ym<m_|wvKRkPclWnsAO2lu(vJUl-mu62DdZ@=eGj>3E4%Su9k9N>{hy56@BdD+q8|Sz zkd6EQk6c7q9|6`cz?Sd5UN>`1yUAjmc{0kamHX}WptrcB__3T!=`bwa@}r100|bmB z*TsnC>x2bYJ(@3V)a`fyId?ts`}>2XJ7~NNn?I`HRg;DT6BYT*IuDp<=8W>ChpP0| ze^a_747blBjpYDPG{jd?l%HkbM(|9JrZI|Czr#TAQ2F3GJ= 1.16.0-0 < 1.21.0-0' + catalog.cattle.io/namespace: cattle-logging-system + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: logging.banzaicloud.io.clusterflow/v1beta1 + catalog.cattle.io/rancher-version: '>= 2.5.0-0 < 2.6.0-0' + catalog.cattle.io/release-name: rancher-logging + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: logging + catalog.cattle.io/upstream-version: 3.17.7 +apiVersion: v1 +appVersion: 3.17.7 +description: Collects and filter logs using highly configurable CRDs. Powered by Banzai + Cloud Logging Operator. +icon: https://charts.rancher.io/assets/logos/logging.svg +keywords: +- logging +- monitoring +- security +name: rancher-logging +version: 3.17.700+up3.17.7 diff --git a/charts/rancher-logging/3.17.700+up3.17.7/README.md b/charts/rancher-logging/3.17.700+up3.17.7/README.md new file mode 100644 index 000000000..61c537c07 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/README.md @@ -0,0 +1,132 @@ + +# Logging operator Chart + +[Logging operator](https://github.com/banzaicloud/logging-operator) Managed centralized logging component fluentd and fluent-bit instance on cluster. + +## tl;dr: + +```bash +$ helm repo add banzaicloud-stable https://kubernetes-charts.banzaicloud.com +$ helm repo update +$ helm install banzaicloud-stable/logging-operator +``` + +## Introduction + +This chart bootstraps a [Logging Operator](https://github.com/banzaicloud/logging-operator) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes 1.8+ with Beta APIs enabled + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```bash +$ helm install --name my-release banzaicloud-stable/logging-operator +``` + +### CRDs +Use `createCustomResource=false` with Helm v3 to avoid trying to create CRDs from the `crds` folder and from templates at the same time. + +The command deploys **Logging operator** on the Kubernetes cluster with the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```bash +$ helm delete my-release +``` + +The command removes all Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following tables lists the configurable parameters of the logging-operator chart and their default values. + +| Parameter | Description | Default | +| --------------------------------------------------- | ------------------------------------------------------ |-----------------------------------------------------------------------| +| `image.repository` | Container image repository | `ghcr.io/banzaicloud/logging-operator` | +| `image.tag` | Container image tag | `3.17.7` | +| `image.pullPolicy` | Container pull policy | `IfNotPresent` | +| `nameOverride` | Override name of app | `` | +| `fullnameOverride` | Override full name of app | `` | +| `namespaceOverride` | Override namespace of app | `` | +| `watchNamespace` | Namespace to watch for LoggingOperator CRD | `` | +| `rbac.enabled` | Create rbac service account and roles | `true` | +| `rbac.psp.enabled` | Must be used with `rbac.enabled` true. If true, creates & uses RBAC resources required in the cluster with [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) enabled. | `false` | +| `priorityClassName` | Operator priorityClassName | `{}` | +| `affinity` | Node Affinity | `{}` | +| `resources` | CPU/Memory resource requests/limits | `{}` | +| `tolerations` | Node Tolerations | `[]` | +| `nodeSelector` | Define which Nodes the Pods are scheduled on. | `{}` | +| `podLabels` | Define custom labels for logging-operator pods | `{}` | +| `annotations` | Define annotations for logging-operator pods | `{}` | +| `podSecurityContext` | Pod SecurityContext for Logging operator. [More info](https://kubernetes.io/docs/concepts/policy/security-context/) | `{"runAsNonRoot": true, "runAsUser": 1000, "fsGroup": 2000}` | +| `securityContext` | Container SecurityContext for Logging operator. [More info](https://kubernetes.io/docs/concepts/policy/security-context/) | `{"allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true}` | +| `createCustomResource` | Create CRDs. | `true` | +| `monitoring.serviceMonitor.enabled` | Create Prometheus Operator servicemonitor. | `false` | +| `serviceAccount.annotations` | Define annotations for logging-operator ServiceAccount | `{}` | +| `global.seLinux.enabled` | Add seLinuxOptions to Logging resources, requires the [rke2-selinux RPM](https://github.com/rancher/rke2-selinux/releases) | `false` | + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example: + +```bash +$ helm install --name my-release -f values.yaml banzaicloud-stable/logging-operator +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +## Installing Fluentd and Fluent-bit via logging + +The previous chart does **not** install `logging` resource to deploy Fluentd and Fluent-bit on cluster. To install them please use the [Logging Operator Logging](https://github.com/banzaicloud/logging-operator/tree/master/charts/logging-operator-logging) chart. + +## tl;dr: + +```bash +$ helm repo add banzaicloud-stable https://kubernetes-charts.banzaicloud.com +$ helm repo update +$ helm install banzaicloud-stable/logging-operator-logging +``` + +## Configuration + +The following tables lists the configurable parameters of the logging-operator-logging chart and their default values. +## tl;dr: + +```bash +$ helm repo add banzaicloud-stable https://kubernetes-charts.banzaicloud.com +$ helm repo update +$ helm install banzaicloud-stable/logging-operator-logging +``` + +## Configuration + +The following tables lists the configurable parameters of the logging-operator-logging chart and their default values. + +| Parameter | Description | Default | +| --------------------------------------------------- | ------------------------------------------------------ |------------------------------------------------------------| +| `tls.enabled` | Enabled TLS communication between components | true | +| `tls.fluentdSecretName` | Specified secret name, which contain tls certs | This will overwrite automatic Helm certificate generation. | +| `tls.fluentbitSecretName` | Specified secret name, which contain tls certs | This will overwrite automatic Helm certificate generation. | +| `tls.sharedKey` | Shared key between nodes (fluentd-fluentbit) | [autogenerated] | +| `fluentbit.enabled` | Install fluent-bit | true | +| `fluentbit.namespace` | Specified fluentbit installation namespace | same as operator namespace | +| `fluentbit.image.tag` | Fluentbit container image tag | `1.9.3` | +| `fluentbit.image.repository` | Fluentbit container image repository | `fluent/fluent-bit` | +| `fluentbit.image.pullPolicy` | Fluentbit container pull policy | `IfNotPresent` | +| `fluentd.enabled` | Install fluentd | true | +| `fluentd.image.tag` | Fluentd container image tag | `v1.14.6-alpine-5` | +| `fluentd.image.repository` | Fluentd container image repository | `ghcr.io/banzaicloud/fluentd` | +| `fluentd.image.pullPolicy` | Fluentd container pull policy | `IfNotPresent` | +| `fluentd.volumeModImage.tag` | Fluentd volumeModImage container image tag | `latest` | +| `fluentd.volumeModImage.repository` | Fluentd volumeModImage container image repository | `busybox` | +| `fluentd.volumeModImage.pullPolicy` | Fluentd volumeModImage container pull policy | `IfNotPresent` | +| `fluentd.configReloaderImage.tag` | Fluentd configReloaderImage container image tag | `v0.2.2` | +| `fluentd.configReloaderImage.repository` | Fluentd configReloaderImage container image repository | `jimmidyson/configmap-reload` | +| `fluentd.configReloaderImage.pullPolicy` | Fluentd configReloaderImage container pull policy | `IfNotPresent` | +| `fluentd.fluentdPvcSpec.accessModes` | Fluentd persistence volume access modes | `[ReadWriteOnce]` | +| `fluentd.fluentdPvcSpec.resources.requests.storage` | Fluentd persistence volume size | `21Gi` | +| `fluentd.fluentdPvcSpec.storageClassName` | Fluentd persistence volume storageclass | `"""` | diff --git a/charts/rancher-logging/3.17.700+up3.17.7/app-readme.md b/charts/rancher-logging/3.17.700+up3.17.7/app-readme.md new file mode 100644 index 000000000..3b4d49310 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/app-readme.md @@ -0,0 +1,27 @@ +# Rancher Logging + +This chart is based off of the upstream [Banzai Logging Operator](https://banzaicloud.com/docs/one-eye/logging-operator/) chart. The chart deploys a logging operator and CRDs, which allows users to configure complex logging pipelines with a few simple custom resources. There are two levels of logging, which allow you to collect all logs in a cluster or from a single namespace. + +For more information on how to use the feature, refer to our [docs](https://rancher.com/docs/rancher/v2.x/en/logging/v2.5/). + +## Namespace-level logging + +To collect logs from a single namespace, users create flows and these flows are connected to outputs or cluster outputs. + +## Cluster-level logging + +To collect logs from an entire cluster, users create cluster flows and cluster outputs. + +## CRDs + +- [Cluster Flow](https://banzaicloud.com/docs/one-eye/logging-operator/crds/v1beta1/clusterflow_types/) - A cluster flow is a CRD (`ClusterFlow`) that defines what logs to collect from the entire cluster. The cluster flow must be deployed in the same namespace as the logging operator. +- [Cluster Output](https://banzaicloud.com/docs/one-eye/logging-operator/crds/v1beta1/clusteroutput_types/) - A cluster output is a CRD (`ClusterOutput`) that defines how to connect to logging providers so they can start collecting logs. The cluster output must be deployed in the same namespace as the logging operator. The convenience of using a cluster output is that either a cluster flow or flow can send logs to those providers without needing to define specific outputs in each namespace for each flow. +- [Flow](https://banzaicloud.com/docs/one-eye/logging-operator/crds/v1beta1/flow_types/) - A flow is a CRD (`Flow`) that defines what logs to collect from the namespace that it is deployed in. +- [Output](https://banzaicloud.com/docs/one-eye/logging-operator/crds/v1beta1/output_types/) - An output is a CRD (`Output`) that defines how to connect to logging providers so logs can be sent to the provider. + +For more information on how to configure the Helm chart, refer to the Helm README. + +## Systemd Configuration +Some kubernetes distributions log to journald. In order to collect these logs the `systemdLogPath` needs to be defined. While the `/run/log/journal` directory is used by default, some Linux distributions do not default to this path. For example Ubuntu defaults to `/var/log/journal`. To determine your `systemdLogPath` run `cat /etc/systemd/journald.conf | grep -E ^\#?Storage | cut -d"=" -f2` on one of your nodes. If `persistent` is returned your `systemdLogPath` should be `/var/log/journal`. If `volatile` is returned `systemdLogPath` should be `/run/log/journal`. If `auto` is returned check if `/var/log/journal` exists, and if it does then use `/var/log/journal`, otherwise use `/run/log/journal`. + +If any value not described here is returned, Rancher Logging will not be able to collect control plane logs. To address this issue set `Storage=volatile` in journald.conf, reboot your machine, and set `systemdLogPath` to `/run/log/journal`. diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/NOTES.txt b/charts/rancher-logging/3.17.700+up3.17.7/templates/NOTES.txt new file mode 100644 index 000000000..e69de29bb diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/_generic_logging.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/_generic_logging.yaml new file mode 100644 index 000000000..4389bd951 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/_generic_logging.yaml @@ -0,0 +1,116 @@ +{{- define "logging-operator.logging.tpl" -}} +apiVersion: logging.banzaicloud.io/v1beta1 +kind: Logging +metadata: + namespace: {{ .Release.Namespace }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +spec: + controlNamespace: {{ .Release.Namespace }} + fluentbit: + image: + repository: {{ template "logging-operator.fluentbitImageRepository" . }} + tag: {{ template "logging-operator.fluentbitImageTag" . }} + {{- if not .Values.disablePvc }} + {{- with .Values.fluentbit.bufferStorage }} + bufferStorage: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.fluentbit.bufferStorageVolume }} + bufferStorageVolume: {{- toYaml . | nindent 6 }} + {{- end }} + {{- end }} + {{- if or .Values.global.psp.enabled .Values.global.seLinux.enabled }} + security: + {{- end }} + {{- if .Values.global.psp.enabled }} + podSecurityPolicyCreate: true + roleBasedAccessControlCreate: true + {{- end }} + {{- if .Values.global.seLinux.enabled }} + securityContext: + seLinuxOptions: + type: rke_logreader_t + {{- end }} + {{- if or .Values.fluentbit.inputTail.Buffer_Chunk_Size .Values.fluentbit.inputTail.Buffer_Max_Size .Values.fluentbit.inputTail.Mem_Buf_Limit .Values.fluentbit.inputTail.Multiline_Flush .Values.fluentbit.inputTail.Skip_Long_Lines }} + inputTail: + {{- if .Values.fluentbit.inputTail.Buffer_Chunk_Size }} + Buffer_Chunk_Size: {{ .Values.fluentbit.inputTail.Buffer_Chunk_Size | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Buffer_Max_Size }} + Buffer_Max_Size: {{ .Values.fluentbit.inputTail.Buffer_Max_Size | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Mem_Buf_Limit }} + Mem_Buf_Limit: {{ .Values.fluentbit.inputTail.Mem_Buf_Limit | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Multiline_Flush }} + Multiline_Flush: {{ .Values.fluentbit.inputTail.Multiline_Flush | toString | quote }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Skip_Long_Lines }} + Skip_Long_Lines: {{ .Values.fluentbit.inputTail.Skip_Long_Lines | toString | quote }} + {{- end }} + {{- end }} + {{- with (concat (.Values.tolerations) (.Values.fluentbit.tolerations)) }} + tolerations: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.fluentbit.resources }} + resources: {{- toYaml . | nindent 6 }} + {{- end }} + fluentd: + image: + repository: {{ template "system_default_registry" . }}{{ .Values.images.fluentd.repository }} + tag: {{ .Values.images.fluentd.tag }} + configReloaderImage: + repository: {{ template "system_default_registry" . }}{{ .Values.images.config_reloader.repository }} + tag: {{ .Values.images.config_reloader.tag }} + {{- with .Values.fluentd.bufferStorageVolume }} + bufferStorageVolume: {{- toYaml . | nindent 6 }} + {{- end }} + disablePvc: {{ .Values.disablePvc }} + {{- if .Values.fluentd.replicas }} + scaling: + replicas: {{ .Values.fluentd.replicas }} + {{- end }} + {{- if .Values.global.psp.enabled }} + security: + podSecurityPolicyCreate: true + roleBasedAccessControlCreate: true + {{- end }} + {{- with (default .Values.tolerations .Values.fluentd.tolerations) }} + tolerations: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with (default .Values.nodeSelector .Values.fluentd.nodeSelector) }} + nodeSelector: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.fluentd.resources }} + resources: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.fluentd.livenessProbe }} + livenessProbe: {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} + +{{- define "logging-operator.util.merge.logging" -}} +{{/* Top context to expose fields like `.Release` and `.Values` */}} +{{- $top := first . -}} + +{{/* tpl is the template specific to the logging implementation */}} +{{- $tpl := fromYaml (include (index . 1) $top) | default (dict ) -}} + +{{/* Generic is the shared rancher logging setttings from `_generic_logging.yaml` */}} +{{- $generic := fromYaml (include (index . 2) $top) | default (dict ) -}} + +{{/* values are from the values.yaml */}} +{{- $values := $top.Values.loggingOverlay | default (dict ) -}} + +####### {{$generic}} + +{{/* the sources are merge right to left meaning tpl is the highest prcedence and values is the lowest */}} +{{- toYaml (merge $tpl $values $generic) -}} +{{- end -}} + +{{- define "logging-operator.logging" -}} +{{- include "logging-operator.util.merge.logging" (append . "logging-operator.logging.tpl") -}} +{{- end -}} \ No newline at end of file diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/_helpers.tpl b/charts/rancher-logging/3.17.700+up3.17.7/templates/_helpers.tpl new file mode 100644 index 000000000..7f070904c --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/_helpers.tpl @@ -0,0 +1,179 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "logging-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "logging-operator.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Provides the namespace the chart will be installed in using the builtin .Release.Namespace, +or, if provided, a manually overwritten namespace value. +*/}} +{{- define "logging-operator.namespace" -}} +{{- if .Values.namespaceOverride -}} +{{ .Values.namespaceOverride -}} +{{- else -}} +{{ .Release.Namespace }} +{{- end -}} +{{- end -}} + + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "logging-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "logging-operator.labels" -}} +app.kubernetes.io/name: {{ include "logging-operator.name" . }} +helm.sh/chart: {{ include "logging-operator.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{- define "windowsEnabled" }} +{{- if not (kindIs "invalid" .Values.global.cattle.windows) }} +{{- if not (kindIs "invalid" .Values.global.cattle.windows.enabled) }} +{{- if .Values.global.cattle.windows.enabled }} +true +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "windowsPathPrefix" -}} +{{- trimSuffix "/" (default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "\\" "/" | replace "//" "/" | replace "c:" "C:") -}} +{{- end -}} + +{{- define "windowsKubernetesFilter" -}} +{{- printf "kubernetes.%s" ((include "windowsPathPrefix" .) | replace ":" "" | replace "/" ".") -}} +{{- end -}} + +{{- define "windowsInputTailMount" -}} +{{- (include "windowsPathPrefix" .) | replace "C:" "" -}} +{{- end -}} + +{{/* +Set the controlplane selector based on kubernetes distribution +*/}} +{{- define "controlplaneSelector" -}} +{{- $master := or .Values.additionalLoggingSources.rke2.enabled .Values.additionalLoggingSources.k3s.enabled -}} +{{- $defaultSelector := $master | ternary (dict "node-role.kubernetes.io/master" "true") (dict "node-role.kubernetes.io/controlplane" "true") -}} +{{ default $defaultSelector .Values.additionalLoggingSources.kubeAudit.nodeSelector | toYaml }} +{{- end -}} + +{{/* +Set kube-audit file path prefix based on distribution +*/}} +{{- define "kubeAuditPathPrefix" -}} +{{- if .Values.additionalLoggingSources.rke.enabled -}} +{{ default "/var/log/kube-audit" .Values.additionalLoggingSources.kubeAudit.pathPrefix }} +{{- else if .Values.additionalLoggingSources.rke2.enabled -}} +{{ default "/var/lib/rancher/rke2/server/logs" .Values.additionalLoggingSources.kubeAudit.pathPrefix }} +{{- else -}} +{{ required "Directory PathPrefix of the kube-audit location is required" .Values.additionalLoggingSources.kubeAudit.pathPrefix }} +{{- end -}} +{{- end -}} + +{{/* +Set kube-audit file name based on distribution +*/}} +{{- define "kubeAuditFilename" -}} +{{- if .Values.additionalLoggingSources.rke.enabled -}} +{{ default "audit-log.json" .Values.additionalLoggingSources.kubeAudit.auditFilename }} +{{- else if .Values.additionalLoggingSources.rke2.enabled -}} +{{ default "audit.log" .Values.additionalLoggingSources.kubeAudit.auditFilename }} +{{- else -}} +{{ required "Filename of the kube-audit log is required" .Values.additionalLoggingSources.kubeAudit.auditFilename }} +{{- end -}} +{{- end -}} + +{{/* +A shared list of custom parsers for the vairous fluentbit pods rancher creates +*/}} +{{- define "logging-operator.parsers" -}} +[PARSER] + Name klog + Format regex + Regex ^(?[IWEF])(?\d{4} \d{2}:\d{2}:\d{2}).\d{6} +?(?\d+) (?.+):(?\d+)] (?.+) + Time_Key timestamp + Time_Format %m%d %T + +[PARSER] + Name rancher + Format regex + Regex ^time="(?.+)" level=(?.+) msg="(?.+)"$ + Time_Key timestamp + Time_Format %FT%H:%M:%S +[PARSER] + Name etcd + Format json + Time_Key timestamp + Time_Format %FT%H:%M:%S.%L +{{- end -}} + +{{/* +Set kubernetes log options if they are configured +*/}} +{{- define "requireFilterKubernetes" -}} +{{- if or .Values.fluentbit.filterKubernetes.Merge_Log .Values.fluentbit.filterKubernetes.Merge_Log_Key .Values.fluentbit.filterKubernetes.Merge_Trim .Values.fluentbit.filterKubernetes.Merge_Parser -}} +true +{{- end -}} +{{- end -}} + +{{/*Fluent Bit Image Repository */}} +{{- define "logging-operator.fluentbitImageRepository" -}} +{{- if .Values.debug -}} +{{ template "system_default_registry" . }}{{ .Values.images.fluentbit_debug.repository }} +{{- else -}} +{{ template "system_default_registry" . }}{{ .Values.images.fluentbit.repository }} +{{- end -}} +{{- end -}} + +{{/*Fluent Bit Image Tag */}} +{{- define "logging-operator.fluentbitImageTag" -}} +{{- if .Values.debug -}} +{{ .Values.images.fluentbit_debug.tag }} +{{- else -}} +{{ .Values.images.fluentbit.tag }} +{{- end -}} +{{- end -}} + +{{/*Fluent Bit Image */}} +{{- define "logging-operator.fluentbitImage" -}} +{{ template "logging-operator.fluentbitImageRepository" . }}:{{ template "logging-operator.fluentbitImageTag" . }} +{{- end -}} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/clusterrole.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/clusterrole.yaml new file mode 100644 index 000000000..a5d7a85c2 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/clusterrole.yaml @@ -0,0 +1,318 @@ +{{- if .Values.rbac.enabled }} + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: {{ template "logging-operator.fullname" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - endpoints + - namespaces + - nodes + - nodes/proxy + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - watch +- apiGroups: + - "" + resources: + - persistentvolumeclaims + - pods + - serviceaccounts + - services + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + - events.k8s.io + resources: + - events + verbs: + - create + - get + - list + - watch +- apiGroups: + - apps + resources: + - daemonsets + - replicasets + - statefulsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + - extensions + resources: + - daemonsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + - extensions + resources: + - deployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + - extensions + resources: + - statefulsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - batch + resources: + - jobs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - '*' +- apiGroups: + - events.k8s.io + resources: + - events + verbs: + - get + - list + - watch +- apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - extensions + - policy + resources: + - podsecuritypolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - use + - watch +- apiGroups: + - logging-extensions.banzaicloud.io + resources: + - eventtailers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - logging-extensions.banzaicloud.io + resources: + - eventtailers/status + verbs: + - get + - patch + - update +- apiGroups: + - logging-extensions.banzaicloud.io + resources: + - hosttailers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - logging-extensions.banzaicloud.io + resources: + - hosttailers/status + verbs: + - get + - patch + - update +- apiGroups: + - logging.banzaicloud.io + resources: + - clusterflows + - clusteroutputs + - flows + - loggings + - outputs + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - logging.banzaicloud.io + resources: + - clusterflows/status + - clusteroutputs/status + - flows/status + - loggings/status + - outputs/status + verbs: + - get + - patch + - update +- apiGroups: + - monitoring.coreos.com + resources: + - prometheusrules + - servicemonitors + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - clusterroles + - rolebindings + - roles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/clusterrolebinding.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..89d17d094 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/clusterrolebinding.yaml @@ -0,0 +1,18 @@ +{{- if .Values.rbac.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "logging-operator.fullname" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +subjects: + - kind: ServiceAccount + name: {{ template "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "logging-operator.fullname" . }} + + {{- end }} \ No newline at end of file diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/crds.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/crds.yaml new file mode 100644 index 000000000..f573652d0 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/crds.yaml @@ -0,0 +1,6 @@ +{{- if .Values.createCustomResource -}} +{{- range $path, $bytes := .Files.Glob "crds/*.yaml" }} +{{ $.Files.Get $path }} +--- +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/deployment.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/deployment.yaml new file mode 100644 index 000000000..ac7312ab4 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/deployment.yaml @@ -0,0 +1,69 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app.kubernetes.io/name: {{ include "logging-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + labels: + app.kubernetes.io/name: {{ include "logging-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- with .Values.podLabels }} + {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}" + args: + {{- range .Values.extraArgs }} + - {{ . }} + {{- end }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + ports: + - name: http + containerPort: {{ .Values.http.port }} + + {{- if .Values.securityContext }} + securityContext: {{ toYaml .Values.securityContext | nindent 12 }} + {{- end }} + {{- if .Values.podSecurityContext }} + securityContext: {{ toYaml .Values.podSecurityContext | nindent 8 }} + {{- end }} + + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.rbac.enabled }} + serviceAccountName: {{ include "logging-operator.fullname" . }} + {{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/aks/logging.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/aks/logging.yaml new file mode 100644 index 000000000..54bb73250 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/aks/logging.yaml @@ -0,0 +1,18 @@ +{{- define "logging-operator.logging.aks" -}} +{{- $logPath := "/var/log/azure/kubelet-status.log" -}} +metadata: + name: {{ .Release.Name }}-aks +spec: + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ $logPath }} + destination: {{ $logPath }} + readOnly: true + inputTail: + Tag: "aks" + Path: {{ $logPath }} +{{- end -}} +{{- if .Values.additionalLoggingSources.aks.enabled }} +{{- include "logging-operator.logging" (list . "logging-operator.logging.aks") -}} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/eks/logging.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/eks/logging.yaml new file mode 100644 index 000000000..2ba7860b1 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/eks/logging.yaml @@ -0,0 +1,19 @@ +{{- define "logging-operator.logging.eks" -}} +{{- $logPath := "/var/log/messages" -}} +metadata: + name: {{ .Release.Name }}-eks +spec: + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ $logPath }} + destination: {{ $logPath }} + readOnly: true + inputTail: + Tag: "eks" + Path: {{ $logPath }} + Parser: "syslog" +{{- end -}} +{{- if .Values.additionalLoggingSources.eks.enabled }} +{{- include "logging-operator.logging" (list . "logging-operator.logging.eks") -}} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/gke/logging.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/gke/logging.yaml new file mode 100644 index 000000000..6c834b12e --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/gke/logging.yaml @@ -0,0 +1,18 @@ +{{- define "logging-operator.logging.gke" -}} +{{- $logPath := "/var/log/kube-proxy.log" -}} +metadata: + name: {{ .Release.Name }}-gke +spec: + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ $logPath }} + destination: {{ $logPath }} + readOnly: true + inputTail: + Tag: "gke" + Path: {{ $logPath }} +{{- end -}} +{{- if .Values.additionalLoggingSources.gke.enabled }} +{{- include "logging-operator.logging" (list . "logging-operator.logging.gke") -}} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/configmap.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/configmap.yaml new file mode 100644 index 000000000..aa454c8ad --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/configmap.yaml @@ -0,0 +1,57 @@ +{{- if and .Values.additionalLoggingSources.k3s.enabled (eq .Values.additionalLoggingSources.k3s.container_engine "systemd") }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Release.Name }}-k3s + labels: +{{ include "logging-operator.labels" . | indent 4 }} +data: + fluent-bit.conf: | + [SERVICE] + Flush 1 + Grace 5 + Daemon Off + Log_Level info + Coro_Stack_Size 24576 + Parsers_File parsers.conf + + [INPUT] + Name systemd + Tag k3s + Path {{ .Values.systemdLogPath }} + Systemd_Filter _SYSTEMD_UNIT=k3s.service + {{- if .Values.additionalLoggingSources.k3s.stripUnderscores }} + Strip_Underscores On + {{- end }} + Systemd_Filter _SYSTEMD_UNIT=k3s-agent.service + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser klog + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser rancher + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser etcd + Reserve_Data On + + [OUTPUT] + Name forward + Match * + Host {{ .Release.Name }}-root-fluentd.{{ .Release.Namespace }}.svc + Port 24240 + Retry_Limit False + parsers.conf: | +{{ include "logging-operator.parsers" . | indent 4 }} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/daemonset.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/daemonset.yaml new file mode 100644 index 000000000..5b391d15e --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/daemonset.yaml @@ -0,0 +1,110 @@ +{{- if and .Values.additionalLoggingSources.k3s.enabled (eq .Values.additionalLoggingSources.k3s.container_engine "systemd") }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + selector: + matchLabels: + name: {{ .Release.Name }}-k3s-journald-aggregator + template: + metadata: + annotations: + checksum/config: {{ include (print $.Template.BasePath "/loggings/k3s/configmap.yaml") . | sha256sum }} + name: "{{ .Release.Name }}-k3s-journald-aggregator" + namespace: "{{ .Release.Namespace }}" + labels: + name: {{ .Release.Name }}-k3s-journald-aggregator + spec: + containers: + - name: fluentbit + image: "{{ template "logging-operator.fluentbitImage" . }}" + {{- if .Values.global.seLinux.enabled }} + securityContext: + seLinuxOptions: + type: rke_logreader_t + {{- end }} + volumeMounts: + - mountPath: /fluent-bit/etc/ + name: config + - mountPath: {{ .Values.systemdLogPath | default "/var/log/journal" }} + name: journal + readOnly: true + - mountPath: /etc/machine-id + name: machine-id + readOnly: true + {{- with .Values.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: "{{ .Release.Name }}-k3s-journald-aggregator" + volumes: + - name: config + configMap: + name: "{{ .Release.Name }}-k3s" + - name: journal + hostPath: + path: {{ .Values.systemdLogPath | default "/var/log/journal" }} + - name: machine-id + hostPath: + path: /etc/machine-id +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +{{- if .Values.global.psp.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" +rules: + - apiGroups: + - policy + resourceNames: + - "{{ .Release.Name }}-k3s-journald-aggregator" + resources: + - podsecuritypolicies + verbs: + - use +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ .Release.Name }}-k3s-journald-aggregator" +subjects: + - kind: ServiceAccount + name: "{{ .Release.Name }}-k3s-journald-aggregator" +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: "{{ .Release.Name }}-k3s-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + allowPrivilegeEscalation: false + fsGroup: + rule: RunAsAny + readOnlyRootFilesystem: true + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - configMap + - emptyDir + - secret + - hostPath +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/logging-k3s-openrc.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/logging-k3s-openrc.yaml new file mode 100644 index 000000000..963cf3ac4 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/k3s/logging-k3s-openrc.yaml @@ -0,0 +1,19 @@ +{{- define "logging-operator.logging.k3s-openrc" -}} +{{- $logPath := "/var/log/k3s.log" -}} +metadata: + name: {{ .Release.Name }}-k3s +spec: + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ $logPath }} + destination: {{ $logPath }} + readOnly: true + inputTail: + Tag: "k3s" + Path: {{ $logPath }} + Path_Key: filename +{{- end -}} +{{- if and .Values.additionalLoggingSources.k3s.enabled (eq .Values.additionalLoggingSources.k3s.container_engine "openrc")}} +{{- include "logging-operator.logging" (list . "logging-operator.logging.k3s-openrc") -}} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/kube-audit/logging.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/kube-audit/logging.yaml new file mode 100644 index 000000000..3edf96b79 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/kube-audit/logging.yaml @@ -0,0 +1,24 @@ +{{- define "logging-operator.logging.kube-audit" -}} +metadata: + name: {{ .Release.Name }}-kube-audit +spec: + {{- if .Values.additionalLoggingSources.kubeAudit.loggingRef }} + loggingRef: {{ .Values.additionalLoggingSources.kubeAudit.loggingRef }} + {{- end }} + fluentbit: + disableKubernetesFilter: true + extraVolumeMounts: + - source: {{ template "kubeAuditPathPrefix" . }} + destination: "/kube-audit-logs" + readOnly: true + inputTail: + Tag: {{ .Values.additionalLoggingSources.kubeAudit.fluentbit.logTag }} + Path: /kube-audit-logs/{{ template "kubeAuditFilename" . }} + Parser: json + {{- with (concat (.Values.tolerations) (.Values.fluentbit.tolerations) (.Values.additionalLoggingSources.kubeAudit.fluentbit.tolerations)) }} + tolerations: {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} +{{- if .Values.additionalLoggingSources.kubeAudit.enabled }} +{{- include "logging-operator.logging" (list . "logging-operator.logging.kube-audit") -}} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke/configmap.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke/configmap.yaml new file mode 100644 index 000000000..252572a4e --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke/configmap.yaml @@ -0,0 +1,29 @@ +{{- if .Values.additionalLoggingSources.rke.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Release.Name }}-rke + labels: +{{ include "logging-operator.labels" . | indent 4 }} +data: + fluent-bit.conf: | + [SERVICE] + Log_Level {{ .Values.additionalLoggingSources.rke.fluentbit.log_level }} + Parsers_File parsers.conf + + [INPUT] + Tag rke + Name tail + Path_Key filename + Parser docker + DB /tail-db/tail-containers-state.db + Mem_Buf_Limit {{ .Values.additionalLoggingSources.rke.fluentbit.mem_buffer_limit }} + Path /var/lib/rancher/rke/log/*.log + + [OUTPUT] + Name forward + Match * + Host {{ .Release.Name }}-root-fluentd.{{ .Release.Namespace }}.svc + Port 24240 + Retry_Limit False +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke/daemonset.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke/daemonset.yaml new file mode 100644 index 000000000..fd38fc1e0 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke/daemonset.yaml @@ -0,0 +1,122 @@ +{{- if .Values.additionalLoggingSources.rke.enabled }} +{{- $containers := printf "%s/containers/" (default "/var/lib/docker" .Values.global.dockerRootDirectory) }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: "{{ .Release.Name }}-rke-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + selector: + matchLabels: + name: {{ .Release.Name }}-rke-aggregator + template: + metadata: + name: "{{ .Release.Name }}-rke-aggregator" + namespace: "{{ .Release.Namespace }}" + labels: + name: {{ .Release.Name }}-rke-aggregator + spec: + containers: + - name: fluentbit + image: "{{ template "logging-operator.fluentbitImage" . }}" + volumeMounts: + - mountPath: /var/lib/rancher/rke/log/ + name: indir + - mountPath: {{ $containers }} + name: containers + - mountPath: /tail-db + name: positiondb + - mountPath: /fluent-bit/etc/fluent-bit.conf + name: config + subPath: fluent-bit.conf + {{- if .Values.global.seLinux.enabled }} + securityContext: + seLinuxOptions: + type: rke_logreader_t + {{- end }} + volumes: + - name: indir + hostPath: + path: /var/lib/rancher/rke/log/ + type: DirectoryOrCreate + - name: containers + hostPath: + path: {{ $containers }} + type: DirectoryOrCreate + - name: positiondb + emptyDir: {} + - name: config + configMap: + name: "{{ .Release.Name }}-rke" + serviceAccountName: "{{ .Release.Name }}-rke-aggregator" + {{- $total_tolerations := concat (.Values.tolerations) (.Values.fluentbit.tolerations) }} + {{- with $total_tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "{{ .Release.Name }}-rke-aggregator" + namespace: "{{ .Release.Namespace }}" +{{- if .Values.global.psp.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: "{{ .Release.Name }}-rke-aggregator" +rules: + - apiGroups: + - policy + resourceNames: + - "{{ .Release.Name }}-rke-aggregator" + resources: + - podsecuritypolicies + verbs: + - use +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ .Release.Name }}-rke-aggregator" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ .Release.Name }}-rke-aggregator" +subjects: + - kind: ServiceAccount + name: "{{ .Release.Name }}-rke-aggregator" +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: "{{ .Release.Name }}-rke-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + allowPrivilegeEscalation: false + allowedHostPaths: + - pathPrefix: {{ $containers }} + readOnly: false + - pathPrefix: /var/lib/rancher/rke/log/ + readOnly: false + - pathPrefix: /var/lib/rancher/logging/ + readOnly: false + fsGroup: + rule: RunAsAny + readOnlyRootFilesystem: true + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - configMap + - emptyDir + - secret + - hostPath +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke2/configmap.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke2/configmap.yaml new file mode 100644 index 000000000..3ca20be22 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke2/configmap.yaml @@ -0,0 +1,69 @@ +{{- if .Values.additionalLoggingSources.rke2.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Release.Name }}-rke2 + labels: +{{ include "logging-operator.labels" . | indent 4 }} +data: + fluent-bit.conf: | + [SERVICE] + Flush 1 + Grace 5 + Daemon Off + Log_Level info + Coro_Stack_Size 24576 + Parsers_File parsers.conf + + [INPUT] + Name systemd + Tag rke2 + Path {{ .Values.systemdLogPath }} + Systemd_Filter _SYSTEMD_UNIT=rke2-server.service + Systemd_Filter _SYSTEMD_UNIT=rke2-agent.service + {{- if .Values.additionalLoggingSources.rke2.stripUnderscores }} + Strip_Underscores On + {{- end }} + + [INPUT] + Name tail + Tag rke2 + Path /var/lib/rancher/rke2/agent/logs/kubelet.log + + [FILTER] + Name parser + Match * + Key_Name log + Parser klog + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser klog + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser rancher + Reserve_Data On + + [FILTER] + Name parser + Match * + Key_Name MESSAGE + Parser etcd + Reserve_Data On + + [OUTPUT] + Name forward + Match * + Host {{ .Release.Name }}-root-fluentd.{{ .Release.Namespace }}.svc + Port 24240 + Retry_Limit False + parsers.conf: | +{{ include "logging-operator.parsers" . | indent 4 }} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke2/daemonset.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke2/daemonset.yaml new file mode 100644 index 000000000..23a91f9df --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/rke2/daemonset.yaml @@ -0,0 +1,116 @@ +{{- if .Values.additionalLoggingSources.rke2.enabled }} +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + selector: + matchLabels: + name: {{ .Release.Name }}-rke2-journald-aggregator + template: + metadata: + annotations: + checksum/config: {{ include (print $.Template.BasePath "/loggings/rke2/configmap.yaml") . | sha256sum }} + name: "{{ .Release.Name }}-rke2-journald-aggregator" + namespace: "{{ .Release.Namespace }}" + labels: + name: {{ .Release.Name }}-rke2-journald-aggregator + spec: + containers: + - name: fluentbit + image: "{{ template "logging-operator.fluentbitImage" . }}" + {{- if .Values.global.seLinux.enabled }} + securityContext: + seLinuxOptions: + type: rke_logreader_t + {{- end }} + volumeMounts: + - mountPath: /fluent-bit/etc/ + name: config + - mountPath: {{ .Values.systemdLogPath | default "/var/log/journal" }} + name: journal + readOnly: true + - mountPath: "/var/lib/rancher/rke2/agent/logs/kubelet.log" + name: kubelet + readOnly: true + - mountPath: /etc/machine-id + name: machine-id + readOnly: true + {{- with .Values.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: "{{ .Release.Name }}-rke2-journald-aggregator" + volumes: + - name: config + configMap: + name: "{{ .Release.Name }}-rke2" + - name: journal + hostPath: + path: {{ .Values.systemdLogPath | default "/var/log/journal" }} + - name: kubelet + hostPath: + path: "/var/lib/rancher/rke2/agent/logs/kubelet.log" + - name: machine-id + hostPath: + path: /etc/machine-id +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +{{- if .Values.global.psp.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" +rules: + - apiGroups: + - policy + resourceNames: + - "{{ .Release.Name }}-rke2-journald-aggregator" + resources: + - podsecuritypolicies + verbs: + - use +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ .Release.Name }}-rke2-journald-aggregator" +subjects: + - kind: ServiceAccount + name: "{{ .Release.Name }}-rke2-journald-aggregator" +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: "{{ .Release.Name }}-rke2-journald-aggregator" + namespace: "{{ .Release.Namespace }}" +spec: + allowPrivilegeEscalation: false + fsGroup: + rule: RunAsAny + readOnlyRootFilesystem: true + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny + volumes: + - configMap + - emptyDir + - secret + - hostPath +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/root/logging.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/root/logging.yaml new file mode 100644 index 000000000..d88159106 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/loggings/root/logging.yaml @@ -0,0 +1,82 @@ +{{- define "logging-operator.logging.root" -}} +{{- $containerLogPath := printf "%s/containers/" (default "/var/lib/docker" .Values.global.dockerRootDirectory) }} +metadata: + name: "{{ .Release.Name }}-root" +spec: + {{- if (include "windowsEnabled" .) }} + nodeAgents: + - name: win-agent + profile: windows + nodeAgentFluentbit: + daemonSet: + spec: + template: + spec: + containers: + - image: {{ template "system_default_registry" . }}{{ .Values.images.nodeagent_fluentbit.repository }}:{{ .Values.images.nodeagent_fluentbit.tag }} + name: fluent-bit + tls: + enabled: {{ .Values.nodeAgents.tls.enabled | default false }} + {{- if .Values.additionalLoggingSources.rke.enabled }} + - name: win-agent-rke + profile: windows + nodeAgentFluentbit: + filterKubernetes: + Kube_Tag_Prefix: "{{ template "windowsKubernetesFilter" . }}.var.lib.rancher.rke.log." + inputTail: + Path: "{{ template "windowsPathPrefix" . }}/var/lib/rancher/rke/log" + {{- if .Values.fluentbit.inputTail.Buffer_Chunk_Size }} + Buffer_Chunk_Size: {{ .Values.fluentbit.inputTail.Buffer_Chunk_Size | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Buffer_Max_Size }} + Buffer_Max_Size: {{ .Values.fluentbit.inputTail.Buffer_Max_Size | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Mem_Buf_Limit }} + Mem_Buf_Limit: {{ .Values.fluentbit.inputTail.Mem_Buf_Limit | toString }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Multiline_Flush }} + Multiline_Flush: {{ .Values.fluentbit.inputTail.Multiline_Flush | toString | quote }} + {{- end }} + {{- if .Values.fluentbit.inputTail.Skip_Long_Lines }} + Skip_Long_Lines: {{ .Values.fluentbit.inputTail.Skip_Long_Lines | toString | quote }} + {{- end }} + extraVolumeMounts: + - source: "{{ template "windowsInputTailMount" . }}/var/lib/rancher/rke/log" + destination: "{{ template "windowsInputTailMount" . }}/var/lib/rancher/rke/log" + readOnly: true + daemonSet: + spec: + template: + spec: + containers: + - image: "{{ template "system_default_registry" . }}{{ .Values.images.nodeagent_fluentbit.repository }}:{{ .Values.images.nodeagent_fluentbit.tag }}" + name: fluent-bit + tls: + enabled: {{ .Values.nodeAgents.tls.enabled | default false }} + {{- end }} + {{- end }} + fluentbit: + {{- if .Values.global.dockerRootDirectory }} + mountPath: {{ $containerLogPath }} + extraVolumeMounts: + - source: {{ $containerLogPath }} + destination: {{ $containerLogPath }} + readOnly: true + {{- end }} + {{- if (include "requireFilterKubernetes" .) }} + filterKubernetes: + {{- if .Values.fluentbit.filterKubernetes.Merge_Log }} + Merge_Log: "{{ .Values.fluentbit.filterKubernetes.Merge_Log }}" + {{- end }} + {{- if .Values.fluentbit.filterKubernetes.Merge_Log_Key }} + Merge_Log_Key: "{{ .Values.fluentbit.filterKubernetes.Merge_Log_Key }}" + {{- end }} + {{- if .Values.fluentbit.filterKubernetes.Merge_Log_Trim }} + Merge_Log_Trim: "{{ .Values.fluentbit.filterKubernetes.Merge_Log_Trim }}" + {{- end }} + {{- if .Values.fluentbit.filterKubernetes.Merge_Parser }} + Merge_Parser: "{{ .Values.fluentbit.filterKubernetes.Merge_Parser }}" + {{- end }} + {{- end }} +{{- end -}} +{{- include "logging-operator.logging" (list . "logging-operator.logging.root") -}} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/psp.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/psp.yaml new file mode 100644 index 000000000..46b2071ef --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/psp.yaml @@ -0,0 +1,34 @@ +{{ if and .Values.rbac.enabled .Values.rbac.psp.enabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: psp.logging-operator + namespace: {{ include "logging-operator.namespace" . }} + annotations: +{{- if .Values.rbac.psp.annotations }} +{{ toYaml .Values.rbac.psp.annotations | indent 4 }} +{{- end }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +spec: + readOnlyRootFilesystem: true + privileged: false + allowPrivilegeEscalation: false + runAsUser: + rule: MustRunAsNonRoot + fsGroup: + rule: MustRunAs + ranges: + - min: 1 + max: 65535 + supplementalGroups: + rule: MustRunAs + ranges: + - min: 1 + max: 65535 + seLinux: + rule: RunAsAny + volumes: + - secret + - configMap +{{ end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/service.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/service.yaml new file mode 100644 index 000000000..f419ae2c4 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/service.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +spec: + type: ClusterIP + {{- with .Values.http.service.clusterIP }} + clusterIP: {{ . }} + {{- end }} + ports: + - port: {{ .Values.http.port }} + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: {{ include "logging-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/serviceMonitor.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/serviceMonitor.yaml new file mode 100644 index 000000000..1bb762cde --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/serviceMonitor.yaml @@ -0,0 +1,30 @@ +{{ if .Values.monitoring.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +{{- with .Values.monitoring.serviceMonitor.additionalLabels }} + {{- toYaml . | nindent 4 }} +{{- end }} +spec: + selector: + matchLabels: +{{ include "logging-operator.labels" . | indent 6 }} + endpoints: + - port: http + path: /metrics + {{- with .Values.monitoring.serviceMonitor.metricsRelabelings }} + metricRelabelings: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.monitoring.serviceMonitor.relabelings }} + relabelings: + {{- toYaml . | nindent 4 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "logging-operator.namespace" . }} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/serviceaccount.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/serviceaccount.yaml new file mode 100644 index 000000000..bb97cf108 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/serviceaccount.yaml @@ -0,0 +1,14 @@ +{{- if .Values.rbac.enabled }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "logging-operator.fullname" . }} + namespace: {{ include "logging-operator.namespace" . }} + labels: +{{ include "logging-operator.labels" . | indent 4 }} +{{- with .Values.serviceAccount.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/userroles.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/userroles.yaml new file mode 100644 index 000000000..f4136b09a --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/userroles.yaml @@ -0,0 +1,35 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: "logging-admin" + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - "logging.banzaicloud.io" + resources: + - flows + - outputs + verbs: + - "*" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: "logging-view" + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-view: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" +rules: + - apiGroups: + - "logging.banzaicloud.io" + resources: + - flows + - outputs + - clusterflows + - clusteroutputs + verbs: + - get + - list + - watch diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/validate-install-crd.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/validate-install-crd.yaml new file mode 100644 index 000000000..77fc8047c --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/validate-install-crd.yaml @@ -0,0 +1,20 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "logging-extensions.banzaicloud.io/v1alpha1/EventTailer" false -}} +# {{- set $found "logging-extensions.banzaicloud.io/v1alpha1/HostTailer" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/ClusterFlow" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/ClusterOutput" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/Flow" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/Logging" false -}} +# {{- set $found "logging.banzaicloud.io/v1alpha1/Output" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rancher-logging/3.17.700+up3.17.7/templates/validate-install.yaml b/charts/rancher-logging/3.17.700+up3.17.7/templates/validate-install.yaml new file mode 100644 index 000000000..bd624cc4b --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/templates/validate-install.yaml @@ -0,0 +1,5 @@ +#{{- if .Values.global.dockerRootDirectory }} +#{{- if or (hasSuffix "/containers" .Values.global.dockerRootDirectory) (hasSuffix "/" .Values.global.dockerRootDirectory) }} +#{{- required "global.dockerRootDirectory must not end with suffix: '/' or '/containers'" "" -}} +#{{- end }} +#{{- end }} diff --git a/charts/rancher-logging/3.17.700+up3.17.7/values.yaml b/charts/rancher-logging/3.17.700+up3.17.7/values.yaml new file mode 100644 index 000000000..e16eba6b2 --- /dev/null +++ b/charts/rancher-logging/3.17.700+up3.17.7/values.yaml @@ -0,0 +1,244 @@ +# Default values for logging-operator. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: rancher/mirrored-banzaicloud-logging-operator + tag: 3.17.7 + pullPolicy: IfNotPresent + +extraArgs: + - -enable-leader-election=true +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" +namespaceOverride: "" + +## Pod custom labels +## +podLabels: {} + +annotations: {} + +## Deploy CRDs used by Logging Operator. +## +createCustomResource: false + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +nodeSelector: + kubernetes.io/os: linux + +tolerations: + - key: cattle.io/os + operator: "Equal" + value: "linux" + effect: NoSchedule + +affinity: {} + +http: + # http listen port number + port: 8080 + # Service definition for query http service + service: + type: ClusterIP + clusterIP: None + # Annotations to query http service + annotations: {} + # Labels to query http service + labels: {} + +# These "rbac" settings match the upstream defaults. For only using psp in the overlay files, which +# include the default Logging CRs created, see the "global.psp" setting. To enable psp for the entire +# chart, enable both "rbac.psp" and "global.psp" (this may require further changes to the chart). +rbac: + enabled: true + psp: + enabled: true + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' + ## Specify pod annotations + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl + + + +## SecurityContext holds pod-level security attributes and common container settings. +## This defaults to non root user with uid 1000 and gid 2000. *v1.PodSecurityContext false +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +podSecurityContext: {} +# runAsNonRoot: true +# runAsUser: 1000 +# fsGroup: 2000 +securityContext: {} +# allowPrivilegeEscalation: false +# readOnlyRootFilesystem: true + # capabilities: + # drop: ["ALL"] + +## Operator priorityClassName +## +priorityClassName: {} + +monitoring: + # Create a Prometheus Operator ServiceMonitor object + serviceMonitor: + enabled: false + additionalLabels: {} + metricRelabelings: [] + relabelings: [] + +serviceAccount: + annotations: {} + +################################### +# Rancher Logging Operator Values # +################################### + +# Enable debug to use fluent-bit images that allow exec +debug: false + +# Disable persistent volumes for buffers +disablePvc: true + +# If your additional logging sources collect logs from systemd configure the systemd log path here +systemdLogPath: "/run/log/journal" + +global: + cattle: + systemDefaultRegistry: "" + # Uncomment the below two lines to either enable or disable Windows logging. If this chart is + # installed via the Rancher UI, it will set this value to "true" if the cluster is a Windows + # cluster. In that scenario, if you would like to disable Windows logging on Windows clusters, + # set the value below to "false". + # windows: + # enabled: true + + # Change the "dockerRootDirectory" if the default Docker directory has changed. + dockerRootDirectory: "" + + # This psp setting differs from the upstream "rbac.psp" by only enabling psp settings for the + # overlay files, which include the Logging CRs created, whereas the upstream "rbac.psp" affects the + # logging operator. + psp: + enabled: true + + rkeWindowsPathPrefix: "c:\\" + + seLinux: + enabled: false + +images: + config_reloader: + repository: rancher/mirrored-jimmidyson-configmap-reload + tag: v0.4.0 + fluentbit: + repository: rancher/mirrored-fluent-fluent-bit + tag: 1.9.3 + nodeagent_fluentbit: + os: "windows" + repository: rancher/fluent-bit + tag: 1.9.3 + fluentbit_debug: + repository: rancher/mirrored-fluent-fluent-bit + tag: 1.9.3-debug + fluentd: + repository: rancher/mirrored-banzaicloud-fluentd + tag: v1.14.6-alpine-5 + +additionalLoggingSources: + rke: + enabled: false + fluentbit: + log_level: "info" + mem_buffer_limit: "5MB" + rke2: + enabled: false + stripUnderscores: false + k3s: + enabled: false + container_engine: "systemd" + stripUnderscores: false + aks: + enabled: false + eks: + enabled: false + gke: + enabled: false + kubeAudit: + auditFilename: "" + enabled: false + pathPrefix: "" + fluentbit: + logTag: kube-audit + tolerations: + - key: node-role.kubernetes.io/controlplane + value: "true" + effect: NoSchedule + - key: node-role.kubernetes.io/etcd + value: "true" + effect: NoExecute + +# configures node agent options for windows node agents +nodeAgents: + tls: + enabled: false + +# These settings apply to every Logging CR, including vendor Logging CRs enabled in "additionalLoggingSources". +# Changing these affects every Logging CR installed. +fluentd: + bufferStorageVolume: {} + livenessProbe: + tcpSocket: + port: 24240 + initialDelaySeconds: 30 + periodSeconds: 15 + nodeSelector: {} + resources: {} + tolerations: {} +fluentbit: + inputTail: + Buffer_Chunk_Size: "" + Buffer_Max_Size: "" + Mem_Buf_Limit: "" + Multiline_Flush: "" + Skip_Long_Lines: "" + resources: {} + tolerations: + - key: node-role.kubernetes.io/controlplane + value: "true" + effect: NoSchedule + - key: node-role.kubernetes.io/etcd + value: "true" + effect: NoExecute + filterKubernetes: + Merge_Log: "" + Merge_Log_Key: "" + Merge_Log_Trim: "" + Merge_Parser: "" + +# DO NOT SET THIS UNLESS YOU KNOW WHAT YOU ARE DOING. +# Setting fields on this object can break rancher logging or cause unexpected behavior. It is intended to be used if you +# need to configure functionality not exposed by rancher logging. It is highly recommended you check the `app-readme.md` +# for the functionality you need before modifying this object. + +# this object will be merged with every logging CR created by this chart. Any fields that collide with fields from the +# settings above will be overridden. Any fields that collide with fields set in the files in `templates/loggings` will +# be ignored. +loggingOverlay: {} diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/Chart.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/Chart.yaml new file mode 100644 index 000000000..1c8b2f33b --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/Chart.yaml @@ -0,0 +1,12 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/rancher-version: <2.5.99-0 + catalog.cattle.io/release-name: rancher-webhook +apiVersion: v2 +appVersion: 0.1.5 +description: ValidatingAdmissionWebhook for Rancher types +name: rancher-webhook +version: 0.1.500+up0.1.5 diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/_helpers.tpl b/charts/rancher-webhook/0.1.500+up0.1.5/templates/_helpers.tpl new file mode 100644 index 000000000..45f62d0b8 --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/_helpers.tpl @@ -0,0 +1,11 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{- define "rancher-webhook.labels" -}} +app: rancher-webhook +{{- end }} diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/deployment.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/deployment.yaml new file mode 100644 index 000000000..4cf9d9a4d --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/deployment.yaml @@ -0,0 +1,26 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: rancher-webhook +spec: + selector: + matchLabels: + app: rancher-webhook + template: + metadata: + labels: + app: rancher-webhook + spec: + containers: + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}' + name: rancher-webhook + imagePullPolicy: "{{ .Values.image.imagePullPolicy }}" + ports: + - name: https + containerPort: 9443 + serviceAccountName: rancher-webhook diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-cluster-role-binding.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-cluster-role-binding.yaml new file mode 100644 index 000000000..ca439ff48 --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-cluster-role-binding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.preDelete.enabled }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: rancher-webhook-pre-delete + labels: {{ include "rancher-webhook.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "2" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: rancher-webhook-pre-delete +subjects: + - kind: ServiceAccount + name: rancher-webhook-pre-delete + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-cluster-role.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-cluster-role.yaml new file mode 100644 index 000000000..36a1c7fef --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-cluster-role.yaml @@ -0,0 +1,23 @@ +{{- if .Values.preDelete.enabled }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: rancher-webhook-pre-delete + labels: {{ include "rancher-webhook.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "1" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed +rules: + - apiGroups: [ "admissionregistration.k8s.io" ] + resources: [ "mutatingwebhookconfigurations" ] + verbs: [ "delete" ] + resourceNames: [ "rancher.cattle.io" ] + - apiGroups: [ "" ] + resources: [ "serviceaccounts" ] + verbs: [ "get" ] + - apiGroups: [ "policy" ] + resources: [ "podsecuritypolicies" ] + verbs: [ "use" ] + resourceNames: [ "rancher-webhook-pre-delete" ] +{{- end }} diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-job.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-job.yaml new file mode 100644 index 000000000..7f7f577ed --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-job.yaml @@ -0,0 +1,28 @@ +{{- if .Values.preDelete.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: rancher-webhook-pre-delete + namespace: {{ .Release.Namespace }} + labels: {{ include "rancher-webhook.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "3" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded +spec: + backoffLimit: 3 + template: + metadata: + name: rancher-webhook-pre-delete + labels: {{ include "rancher-webhook.labels" . | nindent 8 }} + spec: + serviceAccountName: rancher-webhook-pre-delete + restartPolicy: OnFailure + containers: + - name: rancher-webhook-pre-delete + image: "{{ include "system_default_registry" . }}{{ .Values.preDelete.image.repository }}:{{ .Values.preDelete.image.tag }}" + imagePullPolicy: IfNotPresent + securityContext: + runAsUser: 0 + command: [ "kubectl", "delete", "--ignore-not-found=true", "mutatingwebhookconfigurations", "rancher.cattle.io" ] +{{- end }} diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-psp.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-psp.yaml new file mode 100644 index 000000000..8acf758d0 --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-psp.yaml @@ -0,0 +1,33 @@ +{{- if .Values.preDelete.enabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: rancher-webhook-pre-delete + labels: {{ include "rancher-webhook.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "1" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed +spec: + privileged: false + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false + volumes: + - 'secret' +{{- end }} diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-service-account.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-service-account.yaml new file mode 100644 index 000000000..93e215394 --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/pre-delete-hook-service-account.yaml @@ -0,0 +1,12 @@ +{{- if .Values.preDelete.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook-pre-delete + namespace: {{ .Release.Namespace }} + labels: {{ include "rancher-webhook.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "1" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed +{{- end }} diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/rbac.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/rbac.yaml new file mode 100644 index 000000000..9afaae6c6 --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/rbac.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: rancher-webhook +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: rancher-webhook + namespace: {{.Release.Namespace}} diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/service.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/service.yaml new file mode 100644 index 000000000..74a8a9e5a --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/service.yaml @@ -0,0 +1,13 @@ +kind: Service +apiVersion: v1 +metadata: + name: rancher-webhook + namespace: cattle-system +spec: + ports: + - port: 443 + targetPort: 9443 + protocol: TCP + name: https + selector: + app: rancher-webhook diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/serviceaccount.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/serviceaccount.yaml new file mode 100644 index 000000000..f9251b418 --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/serviceaccount.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/templates/webhook.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/templates/webhook.yaml new file mode 100644 index 000000000..4f95ae896 --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/templates/webhook.yaml @@ -0,0 +1,19 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: rancher.cattle.io +webhooks: +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: rancher-webhook + namespace: cattle-system + path: /v1/webhook/validation + port: 443 + failurePolicy: Ignore + matchPolicy: Equivalent + name: rancher.cattle.io + sideEffects: None + timeoutSeconds: 10 diff --git a/charts/rancher-webhook/0.1.500+up0.1.5/values.yaml b/charts/rancher-webhook/0.1.500+up0.1.5/values.yaml new file mode 100644 index 000000000..d279f3534 --- /dev/null +++ b/charts/rancher-webhook/0.1.500+up0.1.5/values.yaml @@ -0,0 +1,14 @@ +image: + repository: rancher/rancher-webhook + tag: v0.1.5 + imagePullPolicy: IfNotPresent + +global: + cattle: + systemDefaultRegistry: "" + +preDelete: + enabled: true + image: + repository: rancher/kubectl + tag: v1.20.2 diff --git a/index.yaml b/index.yaml index 6c9754104..2e7b6a6da 100755 --- a/index.yaml +++ b/index.yaml @@ -5864,6 +5864,35 @@ entries: urls: - assets/rancher-logging/rancher-logging-100.0.0+up3.12.0.tgz version: 100.0.0+up3.12.0 + - annotations: + catalog.cattle.io/auto-install: rancher-logging-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/deploys-on-os: windows + catalog.cattle.io/display-name: Logging + catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.21.0-0' + catalog.cattle.io/namespace: cattle-logging-system + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: logging.banzaicloud.io.clusterflow/v1beta1 + catalog.cattle.io/rancher-version: '>= 2.5.0-0 < 2.6.0-0' + catalog.cattle.io/release-name: rancher-logging + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: logging + catalog.cattle.io/upstream-version: 3.17.7 + apiVersion: v1 + appVersion: 3.17.7 + created: "2022-08-17T10:36:01.695415-07:00" + description: Collects and filter logs using highly configurable CRDs. Powered + by Banzai Cloud Logging Operator. + digest: a2848fc548d2b95a6e75eabb175dd431037b47f73749127f0f972f1d92f3ffb8 + icon: https://charts.rancher.io/assets/logos/logging.svg + keywords: + - logging + - monitoring + - security + name: rancher-logging + urls: + - assets/rancher-logging/rancher-logging-3.17.700+up3.17.7.tgz + version: 3.17.700+up3.17.7 - annotations: catalog.cattle.io/auto-install: rancher-logging-crd=match catalog.cattle.io/certified: rancher @@ -6096,6 +6125,20 @@ entries: urls: - assets/rancher-logging-crd/rancher-logging-crd-100.0.0+up3.12.0.tgz version: 100.0.0+up3.12.0 + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-logging-system + catalog.cattle.io/release-name: rancher-logging-crd + apiVersion: v1 + created: "2022-08-17T10:36:01.726417-07:00" + description: Installs the CRDs for rancher-logging. + digest: 611b604bf82e47502057c200eea0695db145467184f998c23200c7642c2e54b5 + name: rancher-logging-crd + type: application + urls: + - assets/rancher-logging-crd/rancher-logging-crd-3.17.700+up3.17.7.tgz + version: 3.17.700+up3.17.7 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" @@ -8931,6 +8974,22 @@ entries: urls: - assets/rancher-webhook/rancher-webhook-1.0.0+up0.2.0.tgz version: 1.0.0+up0.2.0 + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/rancher-version: <2.5.99-0 + catalog.cattle.io/release-name: rancher-webhook + apiVersion: v2 + appVersion: 0.1.5 + created: "2022-08-17T10:36:02.054496-07:00" + description: ValidatingAdmissionWebhook for Rancher types + digest: 6538e88b121723a144b978e83cd6852a3e4781c0d0abe1cb80085d4f960abd99 + name: rancher-webhook + urls: + - assets/rancher-webhook/rancher-webhook-0.1.500+up0.1.5.tgz + version: 0.1.500+up0.1.5 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/release.yaml b/release.yaml index 430b95a0e..5dd2433a2 100644 --- a/release.yaml +++ b/release.yaml @@ -51,8 +51,10 @@ rancher-istio: rancher-kiali-server: - 1.41.0 rancher-logging: +- 3.17.700+up3.17.7 - 100.1.3+up3.17.7 rancher-logging-crd: +- 3.17.700+up3.17.7 - 100.1.3+up3.17.7 rancher-monitoring: - 100.1.3+up19.0.3 @@ -64,6 +66,7 @@ rancher-vsphere-cpi: - 100.4.0+up1.2.2 rancher-webhook: - 0.1.400+up0.1.4 +- 0.1.500+up0.1.5 - 1.0.5+up0.2.6 system-upgrade-controller: - 100.0.3+up0.3.3