From 0c6046b385d0e723a4203b64ac11468a39545ade Mon Sep 17 00:00:00 2001 From: Branden Cobb Date: Fri, 6 Aug 2021 21:34:50 +0000 Subject: [PATCH] MM Minio 4 upgrade --- CHANGELOG.md | 46 +++++ CODEOWNERS | 2 +- chart/Chart.lock | 12 +- chart/Chart.yaml | 12 +- chart/charts/bb-test-lib-0.5.2.tgz | Bin 2475 -> 0 bytes chart/charts/gluon-0.1.1.tgz | Bin 0 -> 2691 bytes chart/charts/minio-instance-4.0.4-bb.4.tgz | Bin 8241 -> 0 bytes chart/charts/minio-instance-4.1.2-bb.3.tgz | Bin 0 -> 10865 bytes chart/charts/postgresql-10.3.5.tgz | Bin 40039 -> 40043 bytes chart/deps/minio/Chart.yaml | 38 ++-- chart/deps/minio/Kptfile | 6 +- chart/deps/minio/templates/_helpers.tpl | 6 +- .../allow-sidecar-scraping.yaml | 24 +++ .../networkpolicies/default-deny-egress.yaml | 18 ++ .../networkpolicies/default-deny-ingress.yaml | 11 ++ .../helm-test-network-policy.yaml | 26 +++ .../bigbang/networkpolicies/istio-allow.yaml | 46 +++++ .../networkpolicies/monitoring-ingress.yaml | 19 ++ .../networkpolicies/namespace-allow.yaml | 18 ++ chart/deps/minio/templates/minio-vs.yaml | 4 +- .../templates/release2.0.9/minioinstance.yaml | 122 +++++++++++++ .../minio/templates/release2.0.9/service.yaml | 18 ++ .../{ => release2.0.9}/serviceMonitor.yaml | 2 +- .../deps/minio/templates/service-account.yaml | 2 +- chart/deps/minio/templates/tenant-secret.yaml | 11 +- chart/deps/minio/templates/tenant.yaml | 27 +-- chart/deps/minio/values.yaml | 171 +++++++++++------- .../networkpolicies/allow-dns-egress.yaml | 22 +++ .../networkpolicies/allow-elastic-egress.yaml | 24 +++ .../allow-external-postgres.yaml | 20 ++ .../bigbang/networkpolicies/allow-in-ns.yaml | 18 ++ .../bigbang/networkpolicies/allow-istio.yaml | 33 ++++ .../allow-mattermost-egress.yaml | 20 ++ .../allow-monitoring-ingress.yaml | 24 +++ .../networkpolicies/allow-test-egress.yaml | 26 +++ .../bigbang/networkpolicies/deny-default.yaml | 14 ++ chart/templates/default-bucket.yaml | 40 ++++ chart/templates/env-secret.yaml | 2 +- chart/templates/mattermost.yaml | 16 +- chart/templates/tests/test-ui.yaml | 4 +- chart/values.yaml | 31 +++- docs/keycloak.md | 35 +++- tests/dependencies.yaml | 4 +- tests/test-values.yml | 6 + 44 files changed, 837 insertions(+), 143 deletions(-) delete mode 100644 chart/charts/bb-test-lib-0.5.2.tgz create mode 100644 chart/charts/gluon-0.1.1.tgz delete mode 100644 chart/charts/minio-instance-4.0.4-bb.4.tgz create mode 100644 chart/charts/minio-instance-4.1.2-bb.3.tgz create mode 100644 chart/deps/minio/templates/bigbang/networkpolicies/allow-sidecar-scraping.yaml create mode 100644 chart/deps/minio/templates/bigbang/networkpolicies/default-deny-egress.yaml create mode 100644 chart/deps/minio/templates/bigbang/networkpolicies/default-deny-ingress.yaml create mode 100644 chart/deps/minio/templates/bigbang/networkpolicies/helm-test-network-policy.yaml create mode 100644 chart/deps/minio/templates/bigbang/networkpolicies/istio-allow.yaml create mode 100644 chart/deps/minio/templates/bigbang/networkpolicies/monitoring-ingress.yaml create mode 100644 chart/deps/minio/templates/bigbang/networkpolicies/namespace-allow.yaml create mode 100644 chart/deps/minio/templates/release2.0.9/minioinstance.yaml create mode 100644 chart/deps/minio/templates/release2.0.9/service.yaml rename chart/deps/minio/templates/{ => release2.0.9}/serviceMonitor.yaml (88%) create mode 100644 chart/templates/bigbang/networkpolicies/allow-dns-egress.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-elastic-egress.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-external-postgres.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-in-ns.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-istio.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-mattermost-egress.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml create mode 100644 chart/templates/bigbang/networkpolicies/allow-test-egress.yaml create mode 100644 chart/templates/bigbang/networkpolicies/deny-default.yaml create mode 100644 chart/templates/default-bucket.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 1252c6e..3093630 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,11 +3,57 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). --- +## [0.1.7-bb.1] - 2021-07-23 +### Changed +- Updated to latest IronBank image 5.37.0 +- Updated to latest Minio 4.1.2 package as dependency +- Moved to Gluon test library +- Pulled in changes from main-minio2 branch + +### Added +- Added BigBang networkPolicies ## [0.1.7-bb.0] - 2021-05-17 ### Changed - Updated to latest Minio package as dependency +## [0.1.6-bb.8] - 2021-07-21 +### Changed +- Add openshift toggle, conditionally add port 5353 egress. Changing "openshift:" to true in values.yaml will enable. + +## [0.1.6-bb.7] - 2021-07-08 +### Changed +- Update Mattermost to version 5.36.1 + +## [0.1.6-bb.6] - 2021-06-22 +### Changed +- Update Mattermost to version 5.36.0 + +## [0.1.6-bb.5] - 2021-06-21 +### Fixed +- NetworkPolicy blocking an init container, added policy to allow postgres egress for the init container +- Redo of test egress +- Move around DNS policy + +## [0.1.6-bb.4] - 2021-06-07 +### Added +- Ability to pass volumes / volumeMounts to MM pods + +## [0.1.6-bb.3] - 2021-06-04 +### Added +- Add IPS with new operator +- Switch to the IB image being used directly + +## [0.1.6-bb.2] - 2021-06-02 +### Changed +- Restricted test policy to just cluster + +## [0.1.6-bb.1] - 2021-06-01 +### Changed +- Moved tests to gluon library +### Added +- Default NetworkPolicies added + ## [0.1.6-bb.0] - 2021-05-11 ### Changed - Migrated Cypress tests to Helm tests diff --git a/CODEOWNERS b/CODEOWNERS index 9c87a4c..8de84b2 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1 +1 @@ -* @micah.nagel @branden.cobb +* @micah.nagel @brandencobb @jasonkrause diff --git a/chart/Chart.lock b/chart/Chart.lock index 4365439..59e69ef 100644 --- a/chart/Chart.lock +++ b/chart/Chart.lock @@ -4,9 +4,9 @@ dependencies: version: 10.3.5 - name: minio-instance repository: file://./deps/minio - version: 4.0.4-bb.4 -- name: bb-test-lib - repository: oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates - version: 0.5.2 -digest: sha256:3ca344e6b6e62dc508c2599518d638e424477cf8de51a53cf795c8481d6c2b32 -generated: "2021-05-17T13:29:55.74089-06:00" + version: 4.1.2-bb.3 +- name: gluon + repository: oci://registry.dso.mil/platform-one/big-bang/apps/library-charts/gluon + version: 0.1.1 +digest: sha256:4f58bc0a89971b5e64c0fd8d57d8cee0a116fd8bd62315722a6fea37fdfd44e3 +generated: "2021-07-27T10:06:13.1849167-06:00" diff --git a/chart/Chart.yaml b/chart/Chart.yaml index 4de4aab..79440d1 100644 --- a/chart/Chart.yaml +++ b/chart/Chart.yaml @@ -2,8 +2,8 @@ apiVersion: v2 name: mattermost type: application -version: "0.1.7-bb.0" -appVersion: "5.34.2" +version: "0.1.7-bb.1" +appVersion: "5.37.0" description: "Deployment of mattermost" keywords: - Mattermost @@ -17,10 +17,10 @@ dependencies: condition: postgresql.install repository: file://./deps/postgresql - name: minio-instance - version: 4.0.4-bb.4 + version: 4.1.2-bb.3 alias: minio condition: minio.install repository: file://./deps/minio - - name: bb-test-lib - version: 0.5.2 - repository: "oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates" + - name: gluon + version: 0.1.1 + repository: oci://registry.dso.mil/platform-one/big-bang/apps/library-charts/gluon diff --git a/chart/charts/bb-test-lib-0.5.2.tgz b/chart/charts/bb-test-lib-0.5.2.tgz deleted file mode 100644 index 0df8143dd476200a3e95ccc1ddc9b52dac0bfae4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2475 zcmV;c2~_qUiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PGv>lH0b?zxfnf`X%Z z6f6*60Z`}j*?sm7_#sgeMM*y8&dq3lNF=aWU>CcK1r`iL&!9FQXQBUOLX{!cH02Kt z3PBJAj|PL{KL~==|Db<){-8ey2AAiKW2mlqEpIP5UmA=ieg2f?lTT4nD4 z1Zc+Ipwdi=5zNjVnq~9XKIuOqffJ*S6w6Fe_89(wJcY<=3XG+Kf94@7fd;iBXo@3f zD3oKaGaLbDp`z;Anbm{?G9>5DeRF;U3r+hsm}Z1r)J;batN+IYXsbjM}YfFcI-QUTK&c#z~4QK^J;7%WOwvr`bMT8QXm; z>k$qP-Tq(YLZG^BNZ9TF`@u#3a@GG|^pEl1oxnD4Q)z(7c;RG9Xa7>htE<3XUf=fO z?&w_)xiTDVVbB>yrOWq#je)$OJV#B!uyFb1u-ofu!R~@Xs4{F!qne^dHDeJzjv|>0 z^P-UQW+7`@bx=9)u9rv(LzzHTvFufI*gb^>DgaAqf+J9vFm2Q|iM1pt?P@|~F zbS2f4iR39$Bk&tzjbxfq5s#`@4_rTF!VjsQxQj9`TD*Lyo~-x{csPHJGVryE>Y4rBOjNQ8GpFyb02n z+xjoQ0DPB8W#HMrpa1mRlOLZx`}X9or|{uJTlt)Rmu`1qENl2Kn5%kTP4gIj0WV$= zg^m=W&=YAi{Q3=;35t0O07Dgc&*97DJvem+6|f!HC-e= zfDM%%4dA;DED}B%G)S^BREiA=8kk32;E9cnu#Gx=@tq&z%ojQ5YqEfOA2D(?`03p= zh>n@FPCrseZ$lqEZ>(hMjTy&Xh1eKKyQ0ikjB;-sDOM(lmj`1 zlg9q_>-}ZFR`PRNffhDgSw(3K{%Oy1t&8YecRnn zgXKm*Wo3CXg_C6|&n%rq{j8Aje{yMXnY}f+l_T1RB|Dm`pAB=`54Lo=M}b1S!7_EM z_5x>U?Vz-?m2k7oyrTMGX!)@nh4E|aPkLjfw6U|kkVRF!S)A<%EmG}9{3PMlW52bC_c*0&%);@6@|Mtj z{%0pe-#R0_CI53i7_6QD^#_;7^S`@*ZB9$m%{iafOXpE7M}S)nr|$ar&l|e?Ic&+- zGhWv15t^HcRP22*EHeFC6DIw+TwY0zdr8A~bWie7Ik!=m2Q*{fE173{1i!fMuVv&W za}{AxGT+weqHcyNEX#{spZgWK2^#yynJ)gzou>Qi-VzU)h?z(}Rq%f+o9`|Es@waT z2FdXijxD8nB04yB02-RMqkic;e2bAOCcD*s4`{V}&3O?=>=JQUU$hj=b;l=#_3np1 z*S*!??!Mjh?*<#z|MJSuVXl8{z5g*B3|80w;iF^z?@nNob(RXycKu`T-Cap)2Mki| zQ4e*+WQl`6^bM0re7oK-+4{KAWv?m4o$Y1Ub*LM0p-Q*eaJC!4>Yj7!<9*wB7j*jn z!(9K^=Klx7%Zs)B-^HV&|Gx{^V(Lprd)^&+|Jz+MsYZTZcTD=hp)Z;2emSGT`tse3 z>bSpK@{Nqd0k2rJU$R)aX0d$HV(qF$<8s964GVy1lFAtV{0`2V8A_?3OBye(5lK4mnX~SDdF&!7i2#nH1b7<=3L~`(*sqg8ZEme%+?9n;GnF z0xN04T@rmOqV9VA#1x;`h*rCvw`~j7^IP5@cvH}fj81o!Ve|REL%#wx#Q%jH4)rDA zw(tKghpXTJ4KIelG5)^`unOs)Iqfz8SB!HgAI+77pCAA5FPLiyP!WU7O_m!l6SQtW z=Y}{xO_&Blrv(O3rRX)tF_?)$ESI$64B9p^GAqJcd}r#CihAL+%4P_2mjb;QwPB)& z)K9ybSi6K?nZP)8&iu;u+T2&u=4*##2R8Z^DrYq>UJS%mDw!6pyH~rCo^{^ufI$DW zAaM#GY>zbO26{1z44f`{$oLi_=Ua(XOGmGqp~mPe_1#kAP5UQy6T%W96&_T_w%Pyi zV)gsKi(zm)|Gg7<2rsEIsDuV1p`3iUnxKF%XFRsspo~USnxH1mLnv%p=UFC|(V!>D zIV4<$kWv#(m`J_?g`65TL&&I^G|H)norfSWDU26-nZhx9hjAG}{ppmzkAh!=6h%ur zB*;(!X99^sp1%I=wUG*)hwwzEsTA<$$!mz2(hf&Kc2HnR7-$I(5#7N$s;#EOE~M>pX-vR56)rc>eU6c1WhA-O@XR p#Yp`UUCFl&ndwNz=zkt7{1J|Dgd?=W{{jF2|NlgL>^uNO0047s&W`{9 diff --git a/chart/charts/gluon-0.1.1.tgz b/chart/charts/gluon-0.1.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..b4a4878dae126348cdee9d80977a15121ba59f9f GIT binary patch literal 2691 zcmV-}3Vih+iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PGuUbK5pDpZP2H7*A^ZN>EZPyQfZjlP0-dX4*89bTZfJWHKPR zq7Z`s4*=yjPVTqgfDehHNIh)D&gFy;76~jC*e9`zb<8s<{Kpfj47sEUzxNqhuh;9H zo}A>ry zs{zSnpP-5nE*R%fJems$e?0p27no@YP!WO5Oqv-m69k1i4)Fa2srx=++D22iIrs^rNgY_!KGz2+CrC5X-4kOft32I%_(W)r{)d+`L zW-7!Z=h*-B$+1L6IA#LDZBpt&32r{!RN20?(i} z+J75frV6zVr5Lj~q3QLV!W#SUKRg{S+W(+89Gvd$|2EpPY2@N3rS!eI_^n;djD?MX zyv_}p1VKKddxW5%0mob+7mgc!=bVXX1dsDIex<3CprH{pbmRaOhYR=W3P^E0eQu5X z(!1ac1KCW4W zAytHF!z5wSXW|`(W(4k-a*Y;<(*Sw7p2e2i%?L_jO9FICLmYu6;w5sV8gnx8Zp)8~ z*sCizB>!L>HTjv#0Nla|OH%z~_lP{w1)ty}2wH5gev|UtB@_<(g^Ze>d@IjwmvA@qkh}EmJ9F+j#jtSO zU7y0Pv5K(^Fj94a5vmLu)6nQn2z;MPRV}JfO<9PK!cb zQzlTAT=7aVuauytEvtIKza&Sml=Ex8OV` z@APIfX8228s|_7i`m8bmo);*2p;19NQ8GdByb02X+wlhv%GvPrU(bGj`}nsfPk%W0 z`w@Kn*w$ZLVU>-ohFP?=&0rVJsV2x$%^*etvqOg!XqV@L$_^@w59Y#Nk~7TkN669O z^_Hk195ZJbcc_qF7dLpGja$7j<5=l|-(c&^SzNF47NtCQt4%o<_PSsdI#h^4Po&YX zY@z^$D)64cH}MCSg7>#?zzfGS_SGg6LlucXbYow@8d9?g$;Uj=ae4wju7D!J>B$1p z8!2*~537~=hU(nKk_Dx{p<368sjK$J%v{(^yW&h)gz_3XQ_O2umtw3_Qx>PTD9HlA zZuO%i_p_=-3;Da$ijssjg;>S7g)Q9B6XJVj;NWWZHJp#lR+&nkCHSj7;_11A4@41D9W!btq)oi_=DylOUNAH1_SI3u?1_Z(*EPDAIcZW3 zhh=({9Kk^?QSx1L!3Nhi=~_qgrWCI~^P`w{ANMte3e8gsGDC@CI;vq;RKy4e=ikD? z6h=R+UZ+NK?MQEVd2kK~i(JlgIrH&p&f|Y)(%>R_OMEMKv<*piH|07VGVS-)EV@O9 zLT#urRkZLNr)ceCVQWHL1Gv5HDt4@t;LVcdHR;Tj>ZA1OiS?~@+lMB1mes^fKTgf~>{cLhhvc72HguD7wm0Rz2@H5?Oo_+7yO@Fr5 z{rxWrfp<{;wYL82^x;zd*Ta*+{`-F$t;;$K>0hh-i`oFB5f&BbmP6g;V69^&$x{Qn zDj{2-?yIgKE7^Cm3bIYy`I5ryKH#^C)e&}A`gPNsz>>CIFW_#sp3P$J+x_aS^Zz?2 z|61q&PtS(^rTDLZviJYD(bkyrLe|v#0=)mt3eZZb?yCN*-`jNo+U8YRHPRQ0vdUYQ z)ts+g1nsc4s=d0ZQD3!KVYO6awTmjNT20h)an;h@?iWyuRMI=EEUMF7)#hwOcTw53 zTs~BAWR9w(;AfY2-X%#D4P=w8kEMb_Nr4GC{vIOPC^VQc>fovX{M3#KiW@w`M26ot zMjFKh0O2H&5&ZT29BBgp!-)jf^E|h8;AJKR6Y+dHA*3C$1qJcjSB<2=Hqopu6sWm` zP3i=8ed)iQ-Z!sbmvy$j@8;+=@BDAKIHLMYZc-dkx#usdIHKjcv)X8DQA0JjgQA9o zb?&gJVHHWcENa-MWTC~-x2afIik8>u_-1}!J0Gyx{=3O(z|Xf|W9{nK4U03b#gc}} zZ*A_4l8#M^GPa=on&lW?Es9jZqWlKIH%5 zud}pp&3b~IL(F9W2{qw_iTGPk$f;pdgp`^|t)Gg>xeo&4Jd}pRRNo!X zo8XrqMLyGR2~t$RnLy%@C$HYVGE$*)A0Epjkpf;negzRz+95GBe*U-EzC(f!%Fq8+ z9h2C%f2vnK75*GiK*RGag)!r(onxXeQs_vDi8Ok8>YhQ^jPa;n|a? x+99cuHf(nYi;(&SxRUQ2GS#7s(EoaGjrMKd_U&tE{|x{D|Nn#y-Ua|n0063gS|tDg literal 0 HcmV?d00001 diff --git a/chart/charts/minio-instance-4.0.4-bb.4.tgz b/chart/charts/minio-instance-4.0.4-bb.4.tgz deleted file mode 100644 index 46ad6c493b04ee1a445ecedc63f15adda7d4b0b9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8241 zcmV-1AkN<(iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBhbKAI*=zQj{=qqKg#U$#b5fW3% zVwWbkHz6~3f|6M;B`J z*#sAq`};q>?|c0t&v*U5J24`OKqSG;B2|05b)?XZt^{68EF>iq8?`j7m7ALTE}$7F`N7z3Z9!RT;|gW(bGPe&ns z9uE9N9}V!)8Ui3#OoIXG7zd(V1aQNc6GsB5w zVH}R3Gw=s}*B`n4!Mpx&Ja{o4`d%T#%@&5uv8Rk1S09NyV z|7g_r>->LkaQMjo_ffh|w+k=v6lIYBJ^M;q#ufbt0mDiid9wPuIpIJ!Ao%t8^($BM zJrV+kFeMT8G{7K248sC3f+i8>ASg^Qq=-v3OA>SRG5{8#bi^n(-@D?jA$(=4Uzs61%AfQB>jv z3(Ob^@fbQCr#sD}sPWXX@sT1BP!fVbvlgt*Vl=}}m&pGV61v-5O!f;oNf=EgD7os< z6epZ!EWkZQYW=TlD$s0=?bQWPJzZo`bU`B$T#w;w`i6=NhB;1z<8=R|iInF6U0`^M znWTS6gG>@mO{ALSlFA%2DTI|I&NwV+l*O1sikW$(K*3yyl#hG8kOtg~N#YTzerxPq zUDb_9OaymR%v^yJln8Gw;z*)xx*5X(=+Xrqpa@I!4vdwyaJr`Z3(PK6gE0(b)qz}e zvZpwU3lu*QF^7X3vXeJHi4ck3nboDH1O)-+{51_RAH!RW!hbR%@VT_QBxZs#IeF0k ziIixC^ixuxfk!a7cm}3SA zOg)L8tO$HgvnZ6@qL>bc4wzqK5G=zA&~cJbJ&}sFP#DVpq|sUf=K!Fx?ig;qs`l^Z zSRtO9x^*N3m4>jV>Yhy@p#nG-iUTw*aw;S?&j4vaghQccA>+B7owHWK=}yiZlEqB7 znmA{Pz$`&gfsAU`6hh%zoPtB%&p zRQRj{Q}y$SM3I~y`64u;vw=koXEW@IgaOdz{)z7Y?7{&^DHCIO;rqVhq%=IP&7DKI zAXL%|CsMG6W0<0dOR6pi6B&vwOOjfZ%))6~3;+?D;Hdm_h6MhEuDJ#wm$>TG<=0%` zxF`2B>WvhyRwX@R@8$-)_u7icibRnYE5hLg6WrZOfXD zBXx$B#P5`xk&28YMD3fjgYuFYds`p)LslP)rEjT|V5k;Zt zOUooJg11)^Ms{nu*_QS8%0fa|uPqd%Elts}RYk|Kbcq&g8nY!*&5-MCDg{?C$6*#p zQt*;rV2&AnmQy^XAusqPBs@hzwt~sE)uI68S@2t!a6QbN8ygUd2jjd8JwgY{x|+ev z>tBrU&?sC30zo4=k-6?f5)aA3#p9BL6oiC^_!37rkaM3RhGHzFij|G^%DA8*_u#A? zr!=Wzl*+Ypg|A&@jzNkD;~xA-nIb|;Lv2junBs`c$VBTgh~m z&OcEW{z%#BXB4LqHhM+2-MB%F1tS5kX~YcWL)fQM;rBfx$&79^vSis&W{?Mdlq21-idPx}vt-9$x z_0vvt)V6x+E_IcXUTyknH#+Nn^_G&hb=|cS{iTiDx(?e+kKKhXGisu#&z9-5rFyMR zw<&yItBrGt#9VIf8HS7Zg_Ro1cgpd_Nr+2Q?eTp%59;*=67wFG)U93 z(TS$LlpUBuhy;@Gcs4Q6jF})=8h=hBNhQ6du<*|L zVn)O~n|J|@?QKy{FpPUKl3QxcEF$6-4|NBwc44^XGu!;g2YG^-Fgv1(U4N=920)ph zF%l$zp9?VN6w#ti?i0y(l#)HA>Z}aU?58VZYvFl;_>~?^j1n{>$;=fIcS+(R*SIiB zILe%X@1;Uk296>yFwJV&!xZEW=*QVw0~=XdKhz4T`Ofrbd%U3cICG$)c)P`ifq@xh(xex&F!7P9aIA zRxd!fy+afEiVwXCq!o@Clm?#5)7mqFI)^@-w#LI(RKL;?yNMuqH@GO|iMfO7$Tw$Tc_GwOn zIeb#iMHEH!6MUSgxBO#uL#gd=rLGZIO>rWa)c$m;hyx%0w{9uP^^bKl`X~j`!MMJV zG^Walmodo&bUL-R@T$7*<>i}8dogyq(lB`~SpchZfK)j)nsP;(FDF_qb!`jrL7W6`@rq;7>q=D|7r43_ zSI1iEAr^>e%O$mkmAh+lEb}(TiS`-`B!#=4O0G^;lwb)%<^MvFF^QDeK~;CLCX;+| zLK9A-!VC^-z3|)zEoa8w78HJ!DmG?$)}N}%YMB`C&i&)RXx0EN=utHy6jdvwc8i|iZBG6EC{2CTA20IFDdXyQa6`iZ(Dt) z73;oolrC(EaKQ*w7EZp0C~RiEDUq9`)YMVaKgUUcfyC0}Q0IJf3P@FBI6{Ifl*LZf zNrhr3$L3+eb)<^c_@#}j^nzFADoaT=&!G$t+`{0M?3ItmO&P|q3jgVK^M`8x)iX1Q zy_xr{pn$d0nv>bQfFn7vLC8Xa>*G?AV5nfC#*uT=-cJmra}uCP*`z?Ewwj^c;S18-hp|NE;~##;G~p0$&Xe6Y7U*6ODAWJ z(y9U_q0%`+95>uFhHgvTI{+L-V(UiB-AHS@Tk20*-twW(@o!sd@gHTN&WAaUQp~s~ z(r*m~Srh*?><{blUx&k^$M~;%DK|I0r_Sl;R2^H@4uw_hq~|>Cef{d(+_=&-lX9=4 z4L(`318(_FoxFHDf>6oKFVgf+0ysQSKS_LE@HWY@RIw%GGCr044Dh5zUO~ zTFPo$N=Q|wq+%U=i-zX6iPVKJO0!AD-1+wobUt*pU$bhDXKd|d`02MA!8wj%kI#Dw z=P}&e07-%<3+sdNba(Z)-1r?|8IYc}EX?4Jix_VC4yCDAwWo?`%bS~)CSTx>j0#*E zY!iy!)P(NjS_8_Lh_RnriB-6pSCgwgMz<9KZE!Rxq&doK$2wPZRh(_UXGS(Gt~ao(Z$5iPyc_U`r9=?Jt9r*rT(UJcrpaKRO!$Sk2SRD3!Yf zwNYkA*H3=Ofq-AmJV$$bn}PQ**YcEn#$f?mkH1s6ee#ZoFk4o>R9cv- z2VX@zQ5-Xo<1`eeYwrptk%YQ=qJvOylG8Z2wu!Teq@q(;q5HG#nmO7SwZp z+46X33+J({DogGE>K^W!BEr|$|9yWrtl9rZN2AfB{eK^&ri2Ospl9DReg>^ft(#(f z=ZYlZ*c=ZzvE}J2^zt&8#&O`4p@CL-UtKM$$GTQzdGZw6RaF=j7SR_-ND|^iz)-f- zL6+w!`Xj>*7mOscmj>69^Ea30uTDQ){P6S3A3t0iUtV7P=iB4U(~a;i9U2B-yEcN;?~oE{R2>$;WLFPpzx27KwEIv_o zMUt6mC%2vb2^J_<9PcZD+7(E?7+W?wx78acO*aF*or*EFr>m)D4&(~>An30sj@ldX zYNIdE?9W)(n{{p<0jfr*e!{f|p*BDTR)YpsJjH>8Yu_f2uNg{acy$kX6AjZRQ`%yGth zCeSoLlA&1{eIp@-m(9CMB6+Ym5pn$P76FJ6ID21A}CkD(i=z5__|7v${|of zLz5ct6te&)!a8v>$Fh?CDlW=;Ea`bEkjVHLhW^3!l--(wT_`u;adiW3cGQ)PcE0h} zwvpb{+ne-T&(6(FzN#Kt&MzxV^}iX8YkXYaVg{_c|35lBsOtZL-ya-3>i_#FOLld( z|F2y+x3B(+lk?VEdVAHYSayl~audzx7OJluzTx7w8=x&}vsSC7CLemrD`g%3zt-37 z?$rO&A2#^kA3mP{-b<;Oj^*vjWv(BqMnD;+Tm`GtMTc27713dHcxfe#;p%xFfT{#T z<%*}~&Mkz2GVyDNJ^_tWn&3o?p;N-{RBwX1rM0$+z{<_r{H)5vxJjF)8r;?*%bI6+ zHNrWWzOxizZ-krpT#!-1dMrTV&)w9)eLmtc-#TzQo0Xz~>n z?(cN+$_nGNPXHczi9ePVWvTqvw(u_8|LgNV9o79mM~D7n{+D|x-|W@@3wiUkBm4?q zuSB%wF4vFOHEMXrA9~()Ro3wTPBKBQ=Kp~|8XeaCzXu0{NB+N$QZelm=b5xVi-8da z`ZmQzo4{K+XdM*>eV*!D3(>U-6wWU%=)id^%3R;A)i*3S)|bcrsy^O__V9MAd4gIm z$h2*TO9M|Xg!Q&xqlM1v^1}E1PRnZ^FeGJoN3aZczS;HMB$soS8A^7Yo#bw_sq7xx zN+y*uk4mv2`j%um`6Y%nO|0H{<-G>@`gOdtnm{wXDjIpxmNqHxKh#>DPL8{I)SDQsWr@SM=%M4!%jES7fFKD3&U8r;mDxXF(mCpvI zn{&%#7tQmRya$yAL(|jBh_Um07`x4eac{XWeE2NXpL$0CCuqYEO<3zPMtf}EMjvX=`h#Yt-(zx)s;u3RnDMXz&nc$0+w&eEC!VZc`k(diCd9JP)#oR6IaQ&Rr-!@C4oor5M031DGtOK z-q1@Uj?1?IYBLjJlP$x3ldt44oc@uO*O#F@xik1%&MWO&w=gMB30u&s$VkhCdS14& zHFZIld&)+#gIpxrWg@xDJS0`BSqnspo-4gk<~(f7Wrfzow6wvx?QDK?7L@zVfzmCr zpjbqdt&dxtYvv~mhc7cml9^#alFZI#2`wIrz5#xl!kTCSBkmA6}7W$!96rXahY z99MI18%yc3@x-7s-R&%>6fdQ$+XnHeARagfRSGV&<3Ggbp?Lql4()lw-ak?6Bl)t(a`XJNnjy8NQ58QTk|Lwqh|Spih7mw_DMIaw z*qohq>x=e|GB)iZTT>(HQd^|{ii=zIG43)M(A}m2x@{t$Hnu+SiV7t~?ml1Dz2vIe zRi3JiII&DLrCF(-)~cQFT0F3Kl&0yPlQeCZqN!y`w$v->a_1?WHca5ObV<|^{JJ!$ z)20i;?hGf3#`(wwtLgr;D|JNEH>ryOfq7E(4B@$-U&Y7PCJ>v}B{b@uY~&AYRAzkYc2^7!Jz ztMl`pf4TVZ!`Yjc>bl@R&#RLr=`t=1qateHEuNN7b5CUyqSVbloKhHJx~M(m#t1m~ zm;Gzw++Tm4%wJ2cxHfZq>2r!^cCa@2-rl$&w04y$Y@0-3n_uazB^6tK_?EZb@DQ$A zy*P|3@`&-3o!H67@`gonzVcY>RyU1TD!taN^pcJA${mQkZ>}tghmQ7WmRkJJ P_ z2=BI!wef$0di>A9@aQrA=U$2(|8tcJFT{)9qK~32QYoa9rNV@^DlnaKD(tFw! zFe6fz&4}TafW|QqV>k%W^Xc?Ce$ju9MpJ(}nNIuo1?ms+VCws57);Q?^u=J5iwau0 z|K(r(HD8-VY07(+sqbcjL`0DMGP4335~f_c*JIErm`rEWyZXTDU%b@#Uy+3OtnYvB z;FHkn_`iQt&;NHcJbb+WeJ^Fj_n-S-|8VVBl}qc+X?{9ZOM{3^7-H8>?JKVjJ@Uu$ z-A4Rxr34MG)xnpxW@D6YC>7S-|MEw*@4pX*{e#E+Klf7Xlw#JbduFQLa;_(c5 zB*Xz?Wd;h8{H~&AIx1;$rxrFWp{enY^X$qS1~BJ?y}5xs??)10?)?H7 z_th)Il&?a_wtp*vIJb$95q2OXEes(x^s-eNWTBu z-#~v<3{L;=*}D%X=PyscfAW9!;men{=T@N5^0mFHMsH7DcS<6>DG@D1+84)ygqUu$E_BWIC86IfSq;^OEeoMiVV7&b4DJr6zcKLL&AdUr zZPJ$$%<8@o2E6Gb{Fw-Na#KjS{Efa{qCyI}ol;EeJzLA!1hGHV$XU>6C)G|!*pe2O z9@@Qlt(<8!1Z)vf^4=PEHG`Z=f|N$Em!E6x!;|(1(OXZ)x-oA$;%1Wb`han=;7ecX zW5H8dr2uInJ#y&!I@^=0XYgbJLF_ z>^2#amF95Coc8@Soo?}fVY!hiVxr#Qg^GJI_rR)VWgB}1xdW->#x1-@%UBS{skl~F z;LTku!mXID!Llo6W_as)XiHI6QYU3(fdqDQV|^>nli3Rvj=<%VTu;MoEW)Lptpc$L z3e2tkYUb({KUV{^cD>%V4m#7g>79F`?{`RfvNt7+3pwj0EzIlX=BDLx@dNRruY z3IBs`zBT<#w+}T9G{PoGIG>0WBX$6+mA2vf;+cxpR+HVzzdPjGt>#?W7n@ijQWjN= zyw!G#;@<7*7i+I>^gXngzO%BG{?~y(+lGIvjsF|KWbh8dk5k{8~O*dneNW+k#9C<_{HP()V{A zWU_g1hBfqRY)1aIqm`7mPAYa7V$mLCQ46!E23j;iEv(>(dV~c)Fpp^n|Na@C+9#Kk zfgT-@1fKo}gtT%_ii0_Yj_bOemd9_iM5TOqa-%_f^*pbwUZc6!E1Fo(Lz>`?P93f3 z`>P!~T3l?`Y(4+TSJhwZ(6QyPFh{iYurPnQgTul~KM#0VxN1ndJS^PiD6nPCZ*vmZ zF!DD(2wcqyo3X*xEKoZ>+~feTM(S06-ty?rwXD@uzt?RGn&)2b|KLr5Z5i!vOhfzk zLz{l8Y-Rr|>TG`#aNYgCqfzbt-=IGl_8;y4`zUfj_MSTJJfPEN=%3;fg$Eg96KST?Bs0vjNO+FQ4MEQ#3odoaSPcw8bPUosji(Y=?8l07NB zKZ6JTeFb74z7%QH_d*f~*e`oXqcuPVYk?Tmv8QLq!cIcp?8tmQ|9f(4LR9k1TduKn z{69JvHNOAz`2FYmDP6cgLSUw|O6h6VDbgkxiBxLy6a`mkhPmgM+%G2kIR`$+Q3SJy zPIO{alFXi!xnoqO#_~BzLZ=G}p6Mhgd;06HIMf!@|JwK9Jc+J>CaR@GNo6ySNP<1b zdwKccQe{Bxnha_1{^Sxu!notji0G+*HTsS>`IGh3zxjjttSA4;|Ky9LR|1-#;3`XD zN+Qgiryl>5I#0a`x^kX+B9^}?BQxje|986Z9x*~Q4rebDc zVQyr3R8em|NM&qo0PKDJbK5ww;QY+LqEE`(OY%aB`mz(fH+$!CytA%JVpr_U+}zey z0+En}F-33yP>Cm*``fSZMS>LdWjji;YfjZfCV>Xf=x#K+8;vkhhM81@eP2M6DU-9fk8{|>@C?8C|@=K`_s z!dtghAKW+cpp5*C87DLy!J_A(EGz#U1l^$L#h6EoWJ0|=g1_Tr4v{1im{0~UNqTw) zW5jU`G?jl63TGK+NKghE!i>)G2xdZLeAMa8Ng5F9kx0U;zU(l}Y0e_dJ7hlXBy>tU zFHc{cp1plfSv*JVD#+5QcZILz-+bixzy)P!iaj6b_%|F0zkG4g_vVPC0+AFmRT$3^ zNk$Ok#s5}xFZ%(IBH2APkSB1OMxK6AZ*bq0!YHwy}x-2fbdM|HH%XJ^%0HiE)P07^e}@ zw5@4>JoW|V!cWN917J9#oCwOUM?fPo>U0>M5-!+v5OW&LNz%y@Bqo&2eVXFVm`wdK zN~fKSWH=!y_645H5|}r<@&F3v2!mk|dNG+|E=Is-s5d+q;b?G(yOUvzpT@oLAVfWU zIDXbghr@&MxIc(`-SI&$Ja{$<2fhAb^sGBX@#N`2_Zf=9{=u`S-V~>jFL6AARxj*z z{cz}adzan8sP}9%2!rmkr~SjHet0kn!`4^9mHT^Y{J%g+j`=zNY-!GYl^Vlhdl3ZNi!JYi^#)p+9)Y~Xn_%7u}G zWGV$&5aWgCwc!^z9>H?_#E$wBr$_?VxZsd;g$UWg&x7D`T^~Ar{am$Y5vs}>5X3@> z1FsF2GYqkr7=sy@OEh1;esdzng$z!B;RGX&1Fzbpkp~vu2qq}u*z-7M3lia@D57~P zWQjIhWH=%dB9S=5Vul$YFy#R0g1~1qPh!~x)o~nqV1A7hIuxLz0_|K<2a03)kHka` zoCnSn@ezFdQ`MIvmRPs=t9L?BiQPbzJ)J;G1#m0?rLpOY#GsxWqyZ5Qh3JQz+o_-A zNus{nC8*E=TP;tao~YRYM-hSE4u{8FMP##utIC5cO_7z7^_M#lJ>rg30r zTu=3BDlkh?Qq)Z?{Z|<`fC2{=UyU=9OQl~>h-jMPNX?L@_X(qOg&f1ZQId0kS#|CV z-NjETFjYGiL&9N#rC!wfY$ow+ff*yQo=gC(h#%|rPtQGoj50BTXJHu1xqiKR4l)`a z)yUK%ToBs8SpW;dM2?b+65mcC!y`>}50IcSPRc*0NZ|MAnrjdMKBz{0e$54*cO+4& zFH%T3g)};Xj~^lUS+C(%iou^6uq6eJ7>fu=@^hL>?T)0=#-T|dJVUZ-S<>@TEZ$Rg zbxsqamB)sv5lsc7$$5fOd`w~{H9YlSC-eYFI%Syi7a9Q?L0L9312$g`KGau@eyDx< zT3D9Kr4l8HZHoh9SoI;n0tX(Mqp6|{Eo`g~-7S=8!e}~1>6P3^rh30=HkRuDlAO_W z1g}qCoE%-81ii2q`rWSIeRkRF`-7)`_u&6Z0?(5~P0IBMTBnm&RGc%+aVowZ;kF4= zf6!DDR2vwcU?wF?Oru;%IlXSmK9_2Q>;h(7?IUsy3!3C}%pt?fd{Ur_eS1tJ9vF** z{H@XJ>!N-_=0tEm!_3!9b1)P0!~@&P2>P1opbb1i36{O<8#Q9_&EVJ|=^V2QHLel# zb)F~5g_pu}y4XtlW-yyDN12CqjZ*|GSb^e^@C zjZr&wil-EAI*4;J zP5q3<5ut-52X{vkB^R#c)=Q9d>S8TZSS!1O#xxgzObuQCuDaN^V11OvK1v1g z?Hh#_`-jtYSB_|A2Zn#oF&A736}|2|}p`RMDqj_2h?QR%$)wi5u_5`Mk=Gha~s|o*6{vqMnHjZ@@TJlQTI^u7*6Qbpf*r6DK;Jwf>FLoUQzU2C})**MRFE& ziaHj$gc+0|B}>U|U5pZ%Vwfwg;dz!N*U;4*7fVq`#<}E>%J%`t{VZkJfhQ+H8<{HG z>6l`!#aN!n-H=(^AZR`4I6=HVwdNB<>YKKtNV!*P3dNk- z793!&)S4v~fyB>{n7NH^E!ow|Todj94x~NE_@b@bNcsZEmh!$R|5>EI(kbeK-)Zz# z(!YSRr!_#C6WnFM>B8;S0x1*Yx8-_#a`lNgtXddMHiSx}$Pk(iC3gFi?qYZsn;tRb3;OKoVx zOVNQj#7H0sj^|?oOukW|l%N5P5au70gD!MV=;${tA3i`p9ggs;o(iv?J|?DqOj z!*eVciMSDgOw#}O8qOJ=V==?I?2#!_>yfpQRZWrr5oSWK$kaMQ9>wV zbRiLkAR$~xk)pQ-X1k6*7-O#kj|Y0^8lkk1*Mb@ouBO_u#mg5L4g)xGfelOW1XdpKE`IyeVQsv8kZFcP_xZ9I==lE{9@qbn@b z*xt`bG=ulb>xPnqzK3^X^_9PK^pAGi2rQ+2Ag-$7R4}Q`(1}70y!&rmQ=;pyn{f0_ z%Fq6&PDr|^${&<7$pv&Wadz{nxNhb7s|%MH+ij_5y_76~m5VAy07L`dd|4k%{qTx$YU`t+MMUUqnmA zU7wlVtn`evyxEnj zJd)P6KX|z7dZriFN6I<2a3#VyBUCADc2iVr0rW0Q?)oxQMos?=rx6A+m)e4g%AgZK zsu;rw5@ew^AXK^V6+3w@4->A#5%r2+s_bfA2&!D=ERxG!7sCTL(BCC{*%A2}!+5TO zN;_@)Qf(+ZW(ILE4W1MjaJG&!GMyE0BquH*vXJ09xP_z`Dm_u-u-x?UM~1Q)iBO_c zY#?&Anpgv^Le!&Xp|eB+hR(F#Q~p}1@i`{ys*$=52&@Tu5eA2W-Q&CFX4l$mZQfGK z9jg!z=sGHF!H~;ZvDJ$URw;EXQ1U99F~so*E>4bLpIq8a2TDZkm7_ubdiLh^@!6}3 zvlk~v$HylZ7v)yP>eEgU1LaG{L;brwwfMg>Q1k5!CmCiu5ZP@*0XM||4*J7-{Qto) zJh+el+sE_qW9PAV@*z`hwORz0it-P<$DKd_^ge#{rMf3&X-g}SvSbVV@|$w(1UiCT z$>C2@zN8Tx^wm!?zsM&O@&Q_Y3rsbf#`349x?#4Js1oyY4Zr6o(OxK&WvYXL_Y2mr zRe2#>ke%g4*c7L8?5<;avmkdf+DoboJZASRm&b=jXEGZL<&n*B^eFI7C)VYvff!wY zn==qP&`eafF)GTj2v}N)K^urxV)20jH~PL2ou&+#lzq_UgV)BZ>=vuO+-54|Ce-}S z7)iwhTK~cQ|KP0}EZyk#le=o39Ry11GeO`Ic?yYUMsz8q39dw>DpO*y-g^g!=C?WH z0-w}sDHr?Jf3~3YwzWIWs(qu;-&gfdf7KnF;bb20Sx5DG1Rp;FNuwl>>w^h&bM>#> zm}XxXkby%MW^hNv86No!Wm!v?(=rmU$^tB2~74i(j>w&2Za;F-Yk z@>3c1s^ls8fa3zV9)GJaC6)0rW*f{`N()m|PsH*(RKutPqbsW!(>CD(kM*^0m&pm- zVAUOvtNoNk;O%^#r`mW~1R81N*=F{Q)pP1fVln~BilG||X5d-}YqrR>WtXkJ5=DbS zze3ti!&SKa(z@2y_^j0b&C!RB3G>ZNm~ThfuzXHp93kfOh@p(6)3qmtHt7G|u-C2X z|Gk4=7~bpu`*;kON(IcaUM;Y@kbw5Pio!15s%5r3Lu@KblDK-R)s3!qMbdZ#uN=77 z-rO-b>ZQDyvZ?{-^;KJk(*60TC$;sFw#(MM*V>GGd7WWn|M1~d2auN`=<9vm)_iQ>Yx-tJl|DY!Shr{0Cz5L(DQ&WCd z$^N^O@>TjV8l54eTgZB^E<_uJzYiz2A?yf#L05}?>$0gzT_rn*eJe@}@%rZZ`L`uZ zZ^!>;`P?7?Ht~OdSl9oChvDF!|M&5HS^g*KZTWr$n_CU9w#aXhmh=tghp58Rxnbh zr=8>7b$r#2TH9ma@-gVfzi(f=RUFiAxscj$_Ugs2pgLEEObZH8Lh~3ba^dv6sDeL4 zICBD$edr!M3wpyrVE*m&dzGFV-D$P*)@TxL>S-qfnMGRuX2nsZ&O*oivpf_3~TM^PcU z>juDWmaAR8r)$)3&-eY$K_<6es_)85@Rg8Lyox}&!?4?HS}k{$|D`#5%iaIx{r|y| z{2vax_ws))&kf{%NdceF3G|tqKVR1Mb9=#k_vVb9`M!5L^yj}X6OMlBo#+CeEJqd8DjIf*bf8n4W z|9yCPaL@mHd20M$gk9;`U&a3gx9c#h1~zvVwmM967$qo^6K*2~ibRQCVbQ8a+a*Or z>?cS`8sk*JK-SbbAkQ-NdyYLWVJ7G zM)$7@?BeLfesY1~QYPN<_oXU|<iNG94(|QG`*|Ane^vWl^=&oHZ6!E*g?^~(DGhOq1+ojr&lNz; z3y3AghIs0mt{ci!vJL3nmYBlDvKCwBkaqze1pO7wljcgiTImxkw^ukywrSiwR<0_c z`l;y+9cltp^s2YiE337;`HbafhSDis--4~8Vft!r8%AAZK;9CpD(}D)Spoq(XaFok zW;K7c<9C(+oDp~HFL&s8LOzVZ90FeSIws#sr<&-4(Y(y)A|b_?3z8~KRw2rcHl1v# z99#%ox16;uRN;V0GuF8Nn@-lu4a(J9LP6si&9QKhZb zq+O(1-&G@6zy5c-2g7>&NB6LMzyI6IW0sDTicJTgYD;{PUBo2PF1Ca!Wx}bwHmh-A zUwuwWwxZL^I;mwV5O>a3yE0p?n|)|wmfE(Hiq>lvX~eGmNTv4mi?7APXOfH*Ara;> z43s2#2(@f27bX?Wg-W|HucTvXx8W?)nPQS_m5#wCjM2$ToXj3NL8Au6u};{fU?g?l z-WD^V%WkO%9k_~<5~Y@)sy8XvVoUl5I0qdhMP)kCn_gDSPj-22uA?tCcov3XtFeIc zEZ`Be1j}*D8KG5uR*h(tvSm{YmiQ`?4tmQPRZ+UooSxRgSOAuqs3fy2nyDmeY-p-d ztJ+*SYI`*9wrRR`LK9cdP;ab_XSDP|psDW3^6A($i)`f#tszm#XXOnaV9y_0&bDk; zoR6H61y1eq?kwKrjejO4-F))^iu(wxduRkL`OXiWOkuBT8E;Kq*p6a$o9I^7`Zg2Y zI`xCsEHmA5Lru-29a4X^FuO;cKy z2|ERamPu*ZT9N5;w?vnS30{NW(pToxvR;;1oqk@v;h;$PhayHfSL=-=hT>8TMi)db z;U-tF$#CV|(9?!OBJPM`DXIx7)_0o^L(i4VB`SmI@|6HiKVgEpwP&R5F%slc?0(Y;p5!rPU;*8eBuB zQmtlu41*x(|G7oh(t5tqhE%01la$udlkRkTMkT|#zCpkTJelA~jNlc$FgqUo1>g!_ zk08b-jk$emb&wI9{GO}fsMp3`WG`#}f+-m*TAjXZ`uz3T%ahB$pS-zvd-Ue=?{6=E zJwGub-t@bb<>Q1zCd**0`VX(qez`b#ZN8Ot=w#ATSXEh6eU(F%(f8a~2jK(scp=qk z%#~sxH_}+(NO0gpMap1JEpbB^&CNI)58iOzbNV!3KDtkk2xl~YAhXSpfX zfJ`xN*_BHcO>76F8IGO=CWSuC``om=PM6Z`Dgd z=9uQ9^7j66ne8r@sqI}gLC1t&X;(ex@wau`jI-rmk%_-43x8t<{(AQP&+UcZ&i-qi zQ8)7iZ;Jmr3~TW}y>Qs=-P?cn@!Z({>x2NUap7*^EBU;^KXx;yB}+rNt^8n5FYF$k zD-fGvab8~FP}m%o@~vo`NMWRegd1AiFrei;f3<<#(aE=+`2VGjXWmr|Y>NNub?f}! z3y1gTfA{h<#D6rz_dnb$A0E{Ogaam`3{$Q&^SanDBvp|fF0Yr?`w?6{wYOg=(p-wK zUzRs(0ydhW_9HsaXo^!Yf>sH;RlU;EFZ~a@L@)DA$E|i00tYqe*>Ido@BBR1=(R$+ z7MG0_=a1zsc!81;^uxl_qNJP=V9M4N&9EcWRGE!Fo8Rd8g>#3%{R!SL`>d4zM&$b@ z$LVdt05_ihI9$^Ix`TWDZ!ga}mCktEcG2vb9CV*o!E5k0*V5N+6ZzKY|6LBXtKGtD z4v#JSUTu(7t$ZzB?n}@8ckB3H58*D3f9!t#vwL{Z>)!MKKAsilKkTW1yFCB#MbCZM z-nH9sq;pXJgqQE3DsG2Y#_Tm?D9>ELCm0_La2i3)m$w4GhOh~Kc^abv|L)@oH}L-* zME`H%|6Vr?59{&&{eJ(R|M&51m;AiGwNs2|1OIwP78nx0LB!v7lEAx*K)5{|2Jk-T z?fZ9s_x|VWtA&1-y>+56^#zQI#5_0Z@=n9pDwc*-MbCu;004@Fy`V08!3Xubg^Yb$|`-}rWevLAOEl|sH^I& zaksd&{?6~LzuQ2*z1>$Yr^JceE29Yaes{g>NmHa=*`>RUb~BwbGg-EBUQFql=(DB> zw1z0OdL$aGibm73@*1P~7e)j=({6G5G=!bOiqJEtho5os2dySypoXY1;5v(QrdEvLOq#yY_2uiOkj==C}!Ym948YFoN9udk)8Z8rcIhBW|95K5{m`UmTx&2J{wO8nWlB!waT!Cvm$Zj4t_9j^v0g|!c5oKpSE zE1JHhR8+1PE=OByuk8Pdj_k^DrH$-%Cq1f1I+{*U+po^%W!tkJlwq!PMcGVoyrXH8 zq`#F-yx~~yKlHf^L2bk_AV>%oa^*MP35{?Y5?+aC541)d>3Dv7pPU=yZcdq0BHf)` z``UPSy%1Id!uK2RUWW88#k^}Vq%@7H_z{T;gI#hbZGROVKzn6}nu*wW@!NHxHDUQh zjO*7Npx=~SXw40O^)X)bt$G~61S644*5G+Gll}i8kFKy#QS|R;B$~l{nkTVNA_wor z>MMWehQ{hWmeQ6HR~2z8m{h&#Lh18_!=|G_!R-C<>Gqxh(nG?rUk9TyJ~iVOccr${~pItjva!5Vtu5VZ)%E zlMqdZARcdV@L?-XEKf&hR;r(tXy&_R*Y1X6QA-w~Z{sl3s#8x5B-v2T;N|1T+C`oX z5n`*-i#Q$xjo>0C=**h6bP@Mb*y591kjlGH%eqhvNHoSsWunvvyme!y6WTgfCi)0K za~k2Ay{y-OOq__a!pKIry{$oEbE*HD%$APVZyj0&TSu-PtRPy844Y{{Nk^{SBWf9l zW1@W~)>$GK2{$T2P($DH!?8{bR|w@w8%t>miZl@G__f|a_u%)-iYaYdZgm^O>7vm5 zc3}1WA2({7^G5A04;;BhF6YG2>hnfhpElb1tWo1hBgf<|Rdy`VDAC6uAy-(@-FwPn z{=_mbN`WdjysO3-KY~(NjA_wvFKBf|wE*t*WS6K`&uT;v}ho z`UKw3D90L?#R6(q?^%IDMS=g5>v9bfb^83|)#d5suWw&GKRSQ=;_U3FH|KAEIDPe8 zC9nMDtU76bGih$yc7LT~3SQ$$`PLe)lNe=MNp|&X{V4Om)*Y~do=~-$vqt5@1gQ~u zPGiVS8ASv$oJJVPTnb&4=!H%IsbUN#NRWjxe^N2SOfSHW&P2HD`YnxiO1`^ZESCUd z8s(DnOG~y{HE&?SlgqIkjh``$=gLjpY1@~PL_=peeMqtTE}=`it?I9vm+t1uOCs;N zzOlQ~bv1A+^B?}mP&OkGN~ChfbQtginN(Q{uaBB^nk89ivWu=BZ$pAv0Q1tE$Xn@) zwRN}j$ySROzFE1GQ92f1+lVQ2takFIqWR`}Id7ErcI}ecXeC);BU!t-bWI`^qPP#e zzJF@*Uq5AHLK1wpZETAF9Q11W|GWKRcpv|@m&Xn3y2?Zl<3(rDMM*X*QnebIXb9|z zW{3$d&$wV1&C6qUQzEs8DG_DD0wPAxL(wxl98ZP_AvEX?FnV_QEFAa3;bA=J;eI%N zdJs>Z^{jBFr7unX)eT}!gE>h$S%Sobvbj%F+!>RpuWqV9S;jlgzS++ONr)genXv*J z6Q=wm*CXiY?(4=TBNznTpy!XrLI2-K9Mp@etFV|^83LdKnA`Ra4#{|~!|y?Xrj z;Ba`)|ND30Z|B`6F5M3H z<41TH{EZ}-2R|ls3@vqGamNg`^SJdWIO4`tQEt+DwVjx^{fy8BW{kv`w=9gpi0oFB zYEUr8Y>Hd(5M`NcDA;PYAKmW~|J9$H$bXinDc&Iq#CrMP4SNT*^FO`*@c#VYex6Oz z#>}dRJITc7{CyOrV276u#GT{CXl3-FurMBDr84Gy*`6CftY zM7bW;rAl6bWR99#X3c+;L37o7c&PWg-q4*&cw5Hp-Q=NklK;QtX#pkRWscpwl9rhlx4 z=fH`OSO?;hiorSn|agurb%CoFsJ#YnEGvB;SWT>gO7!TvtRV_E)}0!$qa4` z+s-QIBE-${&RMinPcAz#VJm7l>(Jec*NPW$Nx&8%KtDUx`9$HW0BY4mp zZhhnF*fi#CM{LSD5oz@S<8;ASe$AX&yzm5dIAp?F#3LdJI;_D#Yy7w z!4*8HV%Y@K*zXI4EE*jxV%U02`F^WvGhU(3=YksZ==rFL7Z$uSREcfd;IuFL)#5+P>c!#XDFdomsfIM1H2{CiXu$g}dAfyuts|8w{50 zfBoUT{ckVNCSk_WYM;+GX#&?7r}l0B^M|e71UXHXJzi2A1}GOZ%FKlu!PQecnV>j|`` zSjc}8!qvZe2ip4Q&KMsPb%WGR5&wg(zBB$!vtMc&Xo5{xww;JIBlZ9sO52jYc&-o0 z$jNTx-#g^mo#tHW7u#qeQWjN|y!CpE;@;iL7qnMb`o6T7{%p@q>%R^J+BN)RWBkW( zP|yF{KRmdP|Juv5iaYgGH-&%fyzA4TwkV+^^zSOfq%wkk=?D{pzHK8+HvU{GvX_Wr zZ+qNj8d_hlB&FMIM4OqQz8Bs2^Goyiy5|P+f7kGjP4a&*JnS#+{|4c`{NKm3fz>M} zKYvfs|8_wprsrQO#-tnGb&$#S!5PlbtFalz4X_^bj;G=dLoAwuENWpE)j*4-PzxtG zq8?!Z5Y6T^hX4Ekk6q6tWuQj~B!$QS1u?DoNpUoz(DHr1)$sato~ryQ4?b!Te+EI& zRBowy&?%}o?_-+ct-OxT^nGnkM~92ul8yckOI2T&)3L!>Xgk{IEVLi*z*$&n=LUDqK(Dmm#+UmOBo3;hZ zelP!DcvIkNMvu0}q5JzwtA6U)N&i>a+5IHort^P?!`k`3UUxXWzyE13k0i*>W3QP9 zbfOadQ@p3}>(R>>#cc^XjS$U6mg_v_4D&n@fu}NZ2y~@N0AdVX>vY5n<04|C*%A4X(YX@c53MM9D24Y22%!5&fp`R;ihB$m#v~H(sB9riHUQ~u1Y(wshkAyb z-bv`&xy(27e;~IeL}jAAA&qU~|6zYvKmU6e-rIlo^0eU`34xi;0;Z=~=Nla7BvE$@ zWGK2qQ_KU;WZN;B(KzrKP7;_VbgZ)slXUu|%+{mQo|f-X8hdR>@l>asd6+RgAs=w8 zHK_mbD1fsxxdxi5nzBpkI)Q|wIPik!7jG|AI^niSHwZr;UqDP4_kt-A9rb_ReJ>dQ z!8+>y_Qh=4k^i%Q@f3>&wm+tnf zSNpI20=g^4qx6Xxhx9Mq2e*~)+;{T8FeDsuOhVRc0pLN7#)Qs#;0SU!gbcM{gg+q4 zFbR9$cBciSDEYa)?QUZe)l!Pq+D2fQfTz`U{a2~N< zr{f7`W9|_15Kgh{k!eT&-2&h?X~6yDeroxMc@#%nzLH!DMudXCV%@=ipKbvd0y6vu z^0-4$AiDzt;Oj1cDGcElO;N}Jn=y{2EdVwyE|1=x4K~3Y<`YpLO`{29m;n+3^ogU8 z;UNw%p8**9;w9rS^da?`=t!(nTTLPQ})eh;*Fx;xuWcgNY;x!T_A?dhl2o+TSO`L#d}n!yajOR1+kCAF|Z}gmQWo= zcpOvY15QB9RQ<6+MRKBO_%NnaXl?Ko;s6eVq(lX>J@w`ijWOd?X>RgOKMsNc@+jh> zLoEeGD7-2E_kY0W`_?l6vLJe3Ix~Nt!zoHjSRi}yEdY*H_*XPjUz1vl6AH)ZFo28+ zumkINOY~OjOO|4*JE(=KC_~XGmBd2zQEHBq!exqOhr==Jh(1eDJt@;o*K}P>a+1D8 zKLvopaiZ}%J{n>eI@?``{?r2C*)uSRkcUSz08{GpNq>O7nfiQ$MlcRI6Qlj&Ah?4w z_5$FM?jVO_fEjoZK#mxHu?0}T5MYSQ;wPhX!uu346!I4eTtbFkr*jhz5e*SX%*CYR z6OVObhNv@+v5z{k0oHjIQRGB%5a4j^sCN>QV1WeH9Plfkr>>OIPgJ$Z;<%H5E7dv z3IPsBgihuDL2Q}=GFF5JCmisYh77zt82ln<=70IY*$ME`FdmPEfWRS`;t>02Xwjlh z)7PaP*)Z!o6W|>ZIzz}NP6F3-T)yam5eyiT(`~@1XqFQpKsc7elSnhA0l9K~+)*3^ z;xE9_G!i@tHl*w`yCON16iF#5hjdd+xM%Xu3k|WCYg52%+@1nwUS~iGs3#%j)@IBW zh=1bqEeYZ&>LWVEjLDt8*hPn9C3DGLh^Sy?@gowFhH+g5Oi3K_h~Q8T|79E=u=fnn z-iW=UB#uP$Mc^#}P$-18Z>X&$rub4Ne#!+<$`4xp4Apj2{GKCoRxWi`DR(qWW@V4U z&$P6J+*w}oJihEndR&k{^CXZG9vKc7oqvoe<}+|eLXJLZQGHH0>dDS|6LJ?Cp7tS! zU_=66C=3kvB-A2H!O$RFYPeeg69OtETtXP4fZP?Qkvj*(Zxa-PX!wK*vcSH`G0&Mq)6CmpQV!BUphpE`Koe zSr2@~K5*iXJ^AlD@CA4=2aewcZQzV{J}U4EA%QQ_mr1>*3b3KU#_8Hg^gzO4nf|@W0$Q|-G^>X(&5`!t6fjg)qjM4)!TZGnc z47#D{=MaZ#?GebRMk3-D23rfLH-Az-$+2dW=?B@U>rJM_&z3N2NDhn^Xo*+^T`A<> zOOOBt9MMp$7R;L~Y^pej}=qhI&^o1xCvd_^bIcp+LR#zCxe4Y`=tB$-*F1i538QA?bnbZg*SacYjzt$sY&H zCV(<20>vB?TAi1#s@4@uLOG?C{iw)jdRcBj7mtJ< zia6^;vPwtLB^fvUPS7A?k$*g}kgJ-l)*Z?>3{VmvDXs5bUWluVUA5l@FokNjx&^CR%l zNG?loNN&-VS^_iW`GhcSR*-An1m2q(L){h-@CPZ3 zl@lVx+B&7LbgI(>9Ovx=1)zk?E|IJB9H`ZUOy>Sq#W*u6Rilyc zp3)etg+eIeqOf_TRP$c?MS?n$Yk>t&eFl&L2u3(S0Edht=!+RI8k4Prx0sSp9?afC ziiK=#Jrm<@@PGUn2PMKC!1Ubmi5S0*sOG4=Kvb!x`A$uu}Rbuq2G=0_zXs7_oFyaBPWnzS!f?1Wq*ff+M=R2$Hw}ExjzJuj@cs- z-5&T8+1ddevn(zUcroK-D%WMXK8O`Wta=u6a0){PJ^48x<0nJ+Hy8+3$@8kwIMw=O zbw=w6*#ee{NlkGddpy~0!YK+4<%xmV?g(I?+iU_U^54dz5u&W!1MSz{?%CV+y<|+i zQ^L1MsDC#z5{s1`L@^hCQ>zQEzyidf-1$zBlq{?x<{0ugp+ya|N(1uL$wG&5q15J- zA*l%Esds4izd%0eG2$b?NXG+aRG(qYfzSeE!E0$yogisMEU7hzBrnS;Azr$Ejv&i$ z)HAtLcl0X598R1easmQ<6i zQ~MpD2gZ1wykJ5pm_j;}8xLjh7%I!9bjTSdA8-gHHm0g%ysPA(N_Gf%lrUyWWK=kz zM@N+0N^5MU)C7+w<_Jo91WCw$Be4P;B6WzB?Absx{$&U={E}GBwV^}pBh+qdgdi8S zq<{HDYVxJ{>8*z=CBGuc0UHPsyq%SA0f8aiFNE=4=1reaUK9ZVmWORIpP-PNb}I#g z+(d`U7b_ZHPlnLdgKg}tJ>V0msj5v?zSP`lpBAs3@+I`{fiI3cbW`+%YW&4Eo^knp zLKsh8%R=%^uE2Db`jE|-R8hBo+Htq{et&ekZnv|u3#R^Si-E-&CWo<3u&Uk5Rq+J1 zLe?nGEOfE;EDJippf?AhDp8eu5LI)~^t!72@R-d7Lhxe}iU~?arhuNLVt)WRkctx+ z62hB|x&e_NaV?@y$mvWTNjM5A*Uw11mO*x);Hb0N>Fip(y;i_oHtB&c`p_0U`+r}Z zAr3oiVqPF`LO}b707j;WPjEPP+hsIu(Amnd&fu8GIY)e@aW`rcY>34~@M~&IW`LoP zVL@>FbZ#?;pBRKYLT>;Jh&+w65CVi&V3~7{D_Av)$#ae#h6MtZEC={}m{JWCL#EzEgtY9C#{+^cN;Qkdib@-Lp%&|s z5YPl{qEj9%#3%jzA6rGR{IORytJ0dZ0~4BddCVZjmyjC@LmhQGY+raCn9o zgJZ;c08vWxAc5f07VcMX&TLSx_>s z)K^7ALg@hk9#TlL+!dJBVW z{VOl}H7RqViKq<&%HeRaLq~Q*xWp zVk9#%C7I<)MTC->9Jx6RiG7lwX9T%e_M}+aNX?eY&?l4nhf94fKPi#0-UJL^P5{ipNH zK*c0<$jA{N)KYAHcqiKHBZ`SXP}udrD|KLYdUVh)=t-@>hf%rBod!Md;)Ohq6M|I# zh=fk7|J0LS6^cjc4}YP{9i5vWIP^0=5^H@=0*BO_Ttm)j(wuxVlH@n6oi2A@TVloEgUjIsKpFZFrP{OW;oCD0TVUhlrzX=NR= zq|u%DNT~k$gvU(!Qv&_BFo2qKgnx(&uEF8hyz4v@5FLS! zKsa?yG8pzW_I{S!7JZa+PZ}tUD~+3&=&hSC zV$4!Ur#wY$B8WL8<(t5QgktinkSGSS+-N&PjX+ABz(VV!pC~5K2Pv}ZlEj?;H#l+j zJj9q|9a@x}Jb!xuiG4@!nyE9w6y3of=scr{af&_eXfPu}WuHu!%&}&9*9Ni=moOB{ zfc)x!?XIi-C$?QihEtwc2L#(v1pN)RDI}iwN61wYa}bD?N;3-y0h>(06io?Lg757N z7%f66gA!D76zeMwhKMkRhr!I47?M+JZ8>66ot7-FDby`cZJp$GzRNkLs92 z9{%%*G+O_z8^esn=#PyORaL8|O7oZ{7Tu1l!8*I!dz%tf1JFXb8faR`{!@c|wfA~= zb4vhIbIOxGenWY_15ilf@kD4^SzTVan*{+1SDu&K6p@ zD@t)1BY*jq^g9C(gy;_NX*4npA>tdAOP~TK?I-E*CUZM~ZlAg^rfqzbejZ?de;=gd zC3f3#bCI|q==mbINF-A0D+72O5}_XA5%^g2RY^L98Tcqyt&fSaD;iaPBUvQNjt=_D z8&9Yyid;bZ3GIkMsqM7OsS~m6}MKV!x=H3F9Ex0wF0hCB2{kX6o>OA-)B?2_Z~*AtbQU zRuOdp*ceAUVw4Vk8*C*v@_;g|0PybD<1O(C{D*Q<;?TQMYLua*T5L=B;~@2vQ`ZIk z5`XfG>2?@EJk?%l7V-NZ4ild{qeLeVhiF77GE6Kj0Ye0aBo2MUUP!OWm;qESxwil# zTXN0Tr!rfKBcI&7D+hZ)9QRWDq7n*Rd95pzv*s92cEhZ)qWK7FB{qkpoQnb%Y2TOU z;qqi!Z3BHg8X=l^OXpqJSu!Ohm_Fo_(tkrL3lA0#6MK$v;Y(+~k_?k*JjGj`6}i z&)}{1fAhhb$sx^LDWE_I2XKRCiJUQ?kKJ+N`F(?CJzimjAv)~yFQ8`P2` zC};EgAhQsu<(>rEPQ6-$Du2dNDD+&88BZEcP)uJXY^F%1*YDzr9ufc4E+GfAP>5n8 zor+Tp`-OI$JWf1Tth+nrlT`2$txdbWoY)(abjdfKI6iTb6RT7mP*-ojFlMtM`INrb zmjZg=_ZL2Su?1cvbzl6E?4wFrwdP=Ik0}|s57reTmI0`~NRKfEu75GKGB{ZffMFkb zkS1p>5%DcDW_+5IQl-lms5v7s)fZaANT&2FJ zm4lZ%dPr9PtO>nvej%F8^oSyL7Fp4yq(ONz&ct>z9i!;a7=N)eLWMf8>w%ruduLd` z^P*V1=uUGk#7V;jh`J+(r#NT1oGUOrGL2$+lU?K2QMzmri4J5CEuxu6Qn0*zcFl?M zOO@vxQ9x$MPl=&!r%tCN%*(BoK0MZZt7VcJS92c|kP$eyi=}{Fa3N&(NjRp6F~F%< zkvxDIP_7O7W`ATz?usXB`YsMI=6Vf#N_-T^?nF^AbJg8QW%|!sAcs4Bwg;&j20)^hvNgmVZGFWZ(s6)?9(SJUa}>*1_55 zdrdM;mp+mHJdguOQ4+<$9^e-&jp~q|fygTAh(VuSQ_K;?P#qtU5NWWI+A<0gA-)=h zEqPQy5%d%Zj^66y(6=#H-m!R!*cP}$+Ou7j(ax!Az_9dlC&uYd5m_OUAS>fUsl!}P zUK_bnCx2Qd9Dr(5F6If%WCRECw`i213@|%RRSk^*o5%xh7%+*j8KFSBnjqh`R-)s~ zDpWm|bIxWck@wlCbe;DzWsg6Jtx*y}MOARXXQ}3kdRu@k*9Ta`^xSqgfeHDfDidlN=MwYeI zEfd>L`6|9(sudhf?f^)Th;lr_9^_Itw||;jy~;Q(L4O{mpXC({t?r6iKkJ{B<$p!9e4Ss>ti0Mm zRZG&rLOYlFB`bJ(Pf3nSXD~QTmYLzqXlB}V9~_)J|6RDC); zNV=5tN4&8wvcgRFF43*I6MBjnmjNe&6i8MwPZ6isV?vx0%9TU5ephkhE3Zgf4u7U) z4y4&_b4zVvA}aTpD3)TJc@&CjF9f^2C@rELZ-3hUabFcEx+!Wr&Pa&$B3Xhyusl37 zJ9iUUL@s4LFjY{LrYF7`hjSrIbpS1(@HYP2V7sfe2rV4?Ne?b#rJxLvapp;t+a+Cc zRJBGvIhA*QJwg#-os`m!S^b|WF@I);S_P)aTn>pcom-sR7Oh_-q0g?Qnk974f5eQN z4l_XGKK*i9#MOM`L|y2TzUPVI@eJM|zyx=zE0c^wdmtKLTh}YE133Py;lF8r{+x#TYk!x9=4%5N z+}}HTHn#6U2fW(rcENvvZM&(F(73jz_NyS#2`$qBL$`=Zlc3Pfv5MxBd@oGWq+TX8 zzI|I%@MP0or3KKk7x@ z9VIbhAqtX_x;7*AOn?l>PKfTzTyt(Qbf5`aB-90E@sbUmrK_VrI~rg6NpKGJ3V=Uj zB)FqJI6gf-yaK-KLutwb2Lnm=EpT`+I0nD{a(pfT=xcB81hNF!b$=45W+SP-1zsFp zoSz>bUcJ}^SGmd-BG(N6)2g-!j!y^2pbL)Aj|2wd>-BKP5d%M8UYu0`0rF^p%HW0) z_mFVGIvX#{jPJhK0?ChU@xu`J#b!I9#WYJV%fe~B5l_sd6}5eO@b>t$o%@)PLTy_W zHTbqO4WxanYUbU+`+s-G_00_MKMTzW5=gjhqmI=?J&}P$au@eYB!zUmEKl)K$GDb5 zs*{FQDYa^YOkflJ${3pa@2-#kr+;yIb$oe!bTT-2dwP6*bo}$d`_rrIv*WAFlf!`_ zlL@~fG_`gs2Q@v{DUATQ0ufV;t_NzOCYIj@?CiOKD=rtUa=PkplBQTR&WzDR!&!GcU6?1!Kt(@D-*e8K9(6vs%|=o z-IA<-B&$g!;%kT7|K^@z{s(!X5xW0iBwSG&bMn9J?(KGS`5#_ych~v9p5*!50-*g| zjd{BV+WJ^bjDNnPIf2k|NB#M%y(NnCS%gGcm2peGi>TP1a*SBJ2R_T`-7bd8OTJl9 zm<)+7p{Vzm2lB*l>tMAMHWLZ@v@LfvoWn=&yW7HTS~G{2$r6tt`bizKReku37P z(10>;sASIoqW7++5Z~)B?hV{)JuAu1Z=%bswagktxy!LIR-8r-MK@R)UFt=9MW~LAh?L}V!;d}bgMo~ZrJJW{#a4Ku*8|g5+G%Sq_h{sUy&Av z{r4*(M1QxcfFZ;*M~7C~-&K<)v7#qvrLj?7zKj5+p+36_eJ%A=bG zET8RBOZ@--(Kjr1rYOB{Vx9AgtK)&oKk?PHQLq1RcXx~We|LX(t^Ys8^YW$6?gobP z3b=GNx|`qtr8{hZ85km+!%g|9y?ohf*)a~)g=XdPgM4s{q4Lnm96?y8tKy?Rd{Bu^ ztbfo+N9W28t6YV|W*>*@BuRTUN}op1_;|zp{5d&&a}$pk@qyiXt_c>Z0!6A@-5q(Y z+wu)-eg5nKJOb_qwMVujyb1OI?(Y}EO4^|oM@_qgWidmcY~ElQ5)L-dpI}2J-^)_o zMBi%zcQgIa-UJfD6#-)%0w;;gHzL$32!CiC>H$!)4fHPtSMM&52iFHjXD8>^{e!{a zw~Nc8H_tb2;vw>QAVKPQ;Et2JUsZL!l51FU?4WtaAwcX@#lrih{n_;)ht?T>64ft> zjeg$-Ut|cVyy0eqgPbfZ#=+N|T3bLO9;mXWfZds>!O|fF z-lGhRx-&Gup@(uV)R-AFdBLAq`7JLujON-9G|sZ=?2}%xnIO$NxOGlyRZdvta2s=G z{PIn3X*=9%VK%c~vYaF?WNi}`uANZQcx1@XX!rLS!FPUfbbNi%&xyN`_V|x$f84h>3n=t2F0XP(EYm!TkSCc>wr8$e+_#f}GL6T6 z(1c(n(2zmCoT8+vsj3z+^cWk&_|zunQpdIpNsX?k?y7(VORV| zk7)beOv1(-zAS^ML^3?yV88M0^M2x?IY-VKwh*0jMugr$>Nn#Jc7N-28uQ0|n)Vuy z{Xd?BCAN3=-LBhpx4)rbZm!Jac5)>|x`hGuAx8=uQPU|D*JF7HX^6uybE%4#bp^*M zKPeSCsr%dz|AT^$Nq9^tp$zoi6ae2QWte-Lr%E!6tPM7N>~YXmo0GOR>Q&sfDLzRb zkv4d~S=}`m9-O&xG=HYhM`@ETnnrw9JnhMAha(&yvBbQY3bJ?;)B`U& z_xCMPs&)J+(&1*6c}`pKl@m@&mvgieeQuJg3GSptWN1(22Y)Y@rgU#+B{&CP0H<;2 zfxTDqPdpvSSl*!Rq`-v8)RLm}vZWKmDZ6EoW#Sf5CNrrp6?Abpv#gtP<2J7YvS`|9 zL~+PRp#1}Leh^~V?uh#PgKqMR^nw=aZu_ro(7tXj(Wze(x3@Ipsj?eXVy!;ArnrI( zqsYy=&?z57v41L;%H~uHXiZQsb=jmN2~kr;6H3-8wueK3k*C_s=qBambtqP6ILp>B z33p4$rEW8ryH_OCW^1*BGx0E8>w>0A0DbFaOU$FK1>oW2U6fSCUSG;nZw8>gev-TX zm4yF(FI{X~B}nloxHa}|d4di$K(dm?DAgXsme}RQ<$n{TUS-$K`}<1L6`ODpySY@v zg!DOK$+J?XkDyOWkc8b0yy~_oCcfawUrK5DO+G7zhw3V z@MjDIJi^EaFp5;-*w$}IO>$YDi>WT=1p`CmLBW)aOcAiAwL0&>DDauQVk3hUsOYfL z0JNbcmVZ7Qk(oIo$Ypb`J(DLUcA-sH2D}RvfaX^MJm^Y`hEhM96u9uwa(Q}hF zUGvE?~3J%Tf%nDQ}uW>UR@H&0wWQPwj!z_ky(~ddk#N%}2^omSGI*)>pzCB`v%GDidh- zty{`Y*yDXT9dK?upP!RP7 z&1?k;WI~HrukA2_wl<|%Oa~gwK$1aAtZ}oeCF2Lc9m3-Y?}6>Q0i1}PPQ?H=8h^iu z-1|J{_)U`Cl}SC+eE96Zdsm1~lhgv=!5G$z+5-kG87t{;2ij_OJj%$~vLBBC`V%PY zx^B}}7Me*3*A|i5sGmYre6k2sRl_Y2yz@k!72vXy3uf7TJR;)fMM0-Gpv31C~xZ@0zn%zRj0K!2vR5L3)dgTM|ZmCg-2YLg^+!DwB!`8T`BP4EST zIP?X=+uiKs$@pfeg)-^gX1-{m&K1o9Nu?f;ie5^hLUWe1wPHGCgo&8s8u^lwqA%dj zm~d+=%}GQ8GM@b^WKb3_lM{78;l4Un&4~Kdv1%&c7h%=K*8-=UC0ECgKY!*eB8|B5 z;k=mR#3COq$c0UKu#)TStxYzURtbmcJV34|3Zxqt`wCd;9>prqbPt_tDm|F9a}mi6 zuLa!Ad@R}UI^{dwLN$A+vMs);uT--rsZDQ5Ewg1ne@g2|rpRV)qheUEn5OLS?Z3C% z`31LOUCFBzm{s;B%TB+k!+%u(ha@(+mGwC*;BZ`LWvxAzEo^l!3E_2&Qwq%<0_hx= z`WBd&C~aVwRkVBDM&5?<1yD3bpMJ)n584j>```V)KL5fdaOd@2udViWza3njpPau- zvNDO@10QkZapZ#yF|#f6jdB%`&D`H_CP9PJc#T*(n=?*HIF`8tM1MC`wt7wgyd~H# zQkwxR){}@5KbB6>b~Z4#^;aB@ND@N8CmwS(6|xx-S!Y7-98Nki^SnGcadaz=XvMKg z77ptx*0_}|Z%?BbtCm)v7h781>eOOuJ#MBI>+}6wtYdwZH1Qgc26vg^QY?gZQ+HX< zhqmpX-DdGnACk#SWPgRTlRl(SZ3UggIUE?PCb&!z+}d$gbU76h#)_DwH+Q0kLf|2P z3m|vgvwcbuXK?0dd{xUDOW=UF>dq5zlBh>+65!Bk3$x^OA*n2*2y+)4DNV^l`>0~Y z#ss#^b|z__wn>&atYrOX1kh}qEIU0n7do0j($~eZAmqni(SNL8xR%}w>J6GDZ&}}R zjH+$Jx?y>|NFPLN){T~Yd#NmtYl)aCIihdM)jT1b3P7`&(Gs4UdDl;-ow2bx#-A-) zu9S4vapbQ;^wm*1nST0u1Zc|xwstA=x94G-nn{b_>X6R%PLs&Kgu4iv*~8S%*=V&+ zRn|m)Kx&A6S%2h%hIB9CzD6Tpb*W@DRyQJLJuA~=D_5ct;bfAE<{ZyVcRl}kE|H^1n)`iW&+MF8&mE=mV)uxx_tABNxVwad0p%UwGY@&>YY3xwu z&fqjKYxQ)N@sF)g4AQl^QZXoRmw_<~5rrK2ove}|8?Mj~U^01o>bftWARktnfS#qu$XP&yrKEF$qU1?7t z#n2yG&VSc)X5@6{*kuz{*8X!nXP$P>VRooO3M$9ivoyv;{vpxp)=sc(cUrm8Nr zX)K@Cn~b(A67ZA#Op!6-hkq)3@dwlIcEQz6Xwyb;Xn~PCrZ+8B zQB795A}YkAtq)e9@g^~f0qdT#3AC)jNB%whduSA|AK2f+62E=bxWZhFobe9atneAg z+T#@X7eBBUMX6?mk@mq0$6<(rAJ`A<&2v%Q1cp{O6kX|Sm9R!S`qn!`zyc+j2;sg! z7=Pf9aTh=90hQt}m9_eyKQ)|R79u8oY$ zs)Ckov#LsL0Qp7U+p6#q0{c z2-ZTDqFapaq)bI2$5bm@WTd3CwDCyWy0I)jmp%9*1G<)sbY`i412%xVKx!eAXzn6Zm(*&KoI+xm4gwI8 z&@ss&8nE22XeRhV47|;8scqh3ynpR1AMUh^o6fnMm}xKJr5nYAy8EJi+u!yUQ6?5i zX@}E4b*U_u*+o~R&y{VAfThXdQK{l3I`qakB~`868HN!&t0!F1q1nuFks1iC>phm0Kat?nq`rhjUeB;}~S z&z|Nf(Q%U$WV3U~*}W?{tG)*rag&o#RY%XIrL1;xs;jLa7J+w@zE2l8hQiKj}VxjrABC07-lK2%N71^6@HNR{!@;)ir6Y7K{x+8g;H zwQ$KDKf;mqzWwRov0KD7tAU*kBnagQEFc9ewwZXiFT z`dXZrHEat&CZIz81TK3ku&h$CWLU}Bg(axG#Yd1MnV^Hq2$JmK;eU6`#HIaNoop)$ z?$}Vy<)O|2wPI;!w-zle@Jc-azGH5w?9&{Mso;nxH_2^ws4G`F)>jis;_(E?peAD1 z5dsz1MCkd-*G<`}Q->ve0<1DSH#!D3Ax_jG@Wao*k}a!2s@r|w(Q$&|_G4kVy_)0Z zhX$W1j!2ONB?r%!d4IpP{5e`SZcph>QCgzN$SMugJ$t6Nk5rmWw#0-`o|uaBFb8)e zd?BO{C3lKbUD>YLygMe5RHnT?lm`n&C{|9|c_hsmmkI%jlxnL**P7$%d{JNE z|ADp3R+dcD#ST=O#y=dWq)BqEDxpc1l8Ki$e|T4+2vFp4OND3&e&5jHTyVy|ME zD9`3bLuFM+L4RcijiKo+qK9M}L5e{8KeyfOU8h@e@K?_>6bB47rIcOcDM_Wf{xyiC<2W`XkSSe3oFurM4h~uU z$%2rSYEZ##mEr8LB;GI$gd!I81Y} zH=I>;2)za5&HjT)ry7j;gi!oXwOd()gmu+dN6N#?qoxG(sJ{UH9?p6&!YSJ?M7oNa z&8fy@&KMaeYodcW{epsN65tLq@XCGlSGRQl?o`TKZ-Ts=iqdzG>BPZY-km}|h(nHp zq`)ipm4Dk+$E8`VM}W~3+5&eI>`l^0OE9z(LAO8O-?sr!PBbw^ZtH4-nMMmUyKNbk zO5Qj-lQEca$hb^-G175kD{%n#_ep3i30bJhwrRvJi$n0AuiRH+p2h*!m&arVDLR6l zx(YNRapID2k@*|j(32PE5^AHZ!+x|`xzyKE~(sIB|kFyLi*Fe@A2vN6=E zLVsIXmjbO2YIP%+32`5DP zNgzu^b*4BcO7r8XTAQ_<;;zl*)P6qDS<^^ub%EMc_sU0q4pHi( zwpCKa;&jtPnH4y(sMSkd{imC~TUKt8Dt|xL(|;wm#;T1~&Fbg(N5wO!(kl5jo3`L& zL&Nz8K{SEq@f2)#o6Ajm5E_wvX=*P^1p!M%l7MriN55IRQ(l=CX2;GS*{UD?2%fKJXTeK^MAtZ zCM(S)Odi4IlsD_LU14r_O*WV)Q+k1}dUEgNCrQF;yKM?B zJRz(MDGN=Aq~3f{o+(;AU5XGZiS;g@{ZZecsU?wpn%sy;IhVvTcM_p_$vEdtfjr-= zBv`Jb)1DJ`t3^en!9IggReX6H zdAsJ}S?T=AmPvq@nF}&3Tv4x#m2;+yOwCm>wIP-?0sF{*0M!hL!v@r|%YQCFyz*)d zXlE)u4iO78N3}AAku_^%8hL#QBD3z<7}Xm|1cW;35(+llpK*Yg`z|0u&>o4uJ2}p7 zZ*CKBqAO^tkdMadpnT^AP2S2STWrJcf(~;(ujTQ#@dYC`rV~ zSa5@8bIPhfCnmL_%IgW7iJf1uQBuRt8BeVTll4JV5@Yg+lxnA>TAEU+(?%vCs1>x+ zw!&s3YqkLR9XKPCcc z*fYc@#Lq~rhqn^3XvGk@jQd;xQRqP==GM!0k(#M1?cc+;Rn)Nq`kJ!&1>o=DhlA7i z#{=-;;Pm9^;OgY!y!ZD|9^jcOmZNGtH{~OpkrC)y7e&Fz2!DuCa$}la8Q>EXN(WqD zIx2@qy#qwvF<^*u$&({OW!(kXu9_n(ea4nZ5;r4~HjU@z(Z7O=`mRqt;k1|AFrM20vR5+nSK~lJ4@F$;TYm!V$r!~BLtacVpE>&7Gvn)p z!?AjYW!9&M`*=mfH;t*bN|%FtndYuuU8mcwao2u_dEUcxN#|uvsbbj&5=eV1)(|K4 zyHQ2^i_qx5-fX+OPIn9Z=eE1Q5Ut86l(9VKTKc~WH&E)R`5*ytbvghJ_)RPn;?Hz0 zZ2?Bq#ea<<0w3~c*NaFB9HQS-q6h&% z2JTQ02w8$cCgi)&mhlLCkRvA312Zszw@Ox}cM&aT47WMs+oAnLI}(09mnRCk0iMKo zY#*kWN}B}+@(B_s(!8n!vNWk@y*UlP@(N`Iji#aZVER^^~p*V7v`Yu?*Te4+9V z|El3F*Xdu;?D6}3c(BMIA7qEQIZicuz{SwLJZ*^T`D%DPg{a@XtNtM+phHiGbg=khhNmArW0V-0})kvDzE%eO% z^|htj`kD8XuK&3cT<3xMz?}7e`_=w_cKzSkezm*1UjLusu{Nqz3V;}W*YCWnUXv#} zNC@{jzyI6a*;|u$Ixv4;7xcfKwf^@cPXqnWmsb%T6mmL?2oAZUJkF$2@R?1v*q?#; zzdQcty`>&z+|qJdVY&O>Bb#+>&%d=cSgH-y>4CLupoU*+heI4fIy*}AO0C94kWaS2 z^Wlsumy{%oyUgIBzJvRFiQIG3JmUJp7cku0MWJUW125O;<|~sXJ1&3!YHk02lBeXL z+T7{RdsUkEUd%X|o@oc-2aD`-2V*TB)G*W7B#iQRxU@sHaD)H zr+#YXKfCo-VE~vX|6lKK=lB1w_g}5$|5H3U@tBwWRnmQ+ZXiEI9oJ2*M9ACXyRpnK zZ|;c%y}p!HE~?G_ZmWM=MQ}})3Kk(x5QNVnU96%dQ2^wFC2ycV>npTR3H0B>0EQl- z*48gyIIxPH^!3V~c~^^ES@jGtW!SWyq^hIYaKd?Hv6u?zPI(XfwEg40exYI@_vPzc zd4>YyaYE-XvkUIBmR`Ty+h@8tFWo!zzl z_eq|dsLXm1TdRN)`{(xO%*s%u(pS4BOAUYd^<%v`sFnB;@duU+1Hckhy~@RJo><#c zi0BZ_3eGcd5Cr57;BZLdP+n>ek;<2=C9)-+(-+k&V_k}~62hry2IYJT1p>#PWX|Ux ztv8}%nr${m6Z3x*Xp=t8oyG!;Lf+GfQCc>Hx*7H<3b2QHGKS1xn07-v$Cp-&~KIEH(zl`mfQMeZ$W?8-N|xOeW5QzhbpLbhV_E~ zSPMSIw>Us!%0I>KfEx0P!^WDsQMBVVV}F zt)~@Tn0#hF40I3#ageI zAg);@dZ04JUyH>uLbXmiopA;^@H`TSyk#!VD`eYAPO7;JlS!T+nfyiix z_CoP+xxesI^RKs1EU)p_&3}D_^Vsu$XD1*3WqW^jd%gdEl4ptYKg}Iynmd*|{~Kh0 zl&g;Ow~S@exdP4lht)VyiJJH^@sC(CAND4)eEJVhktY30o8CJ0r)DPMC+e29y-{_-^`dx>I| z4#;c!&g!1>^`AqIMsdIpcPN6s-efIn5UOAQUw8NRUKQiNZLhP_KpqSVe|LZXRX+dA z{`Rx`Olt=M@2rz(RI`7tf85*KX@NAGqzi*+0&_{7bt+Kg#G!P;cTnidEg|daF!2i} z5?5Ki4}+L-L{IuHq0#8Sd*Gaef(XyRZwTDMkOLS5AR;~!G!P`U^4E(on!sC0YD~q@ zsX;NLg?um~R6-Lq8N5M)a7=x3aAnUEZ=BrNwr%Iewr$(yjW@<-H`q9vjh&5cdt=+S zU%tOruj-w@W~R=WJ~dUXPfvI6IQP;-g$9x9X<{5xOh0CSagK#iqSJxa6SQ%4^ zuhn|hC(v0XMEDWmoI-lyJ;;JLB>IL@t$R>?&7i1wo1p3W=xf3C9$HpbGiJ=v*!T*~ z`+we7flW>N8BxH~t7lzOmoL2N&a1b4AZY3JtbC?DpMI9Vzh}R_Y_11({HML>2-&eI zy6h{jTV(g_nPNLYJlzzmBIDv2?s6E-%Zd_Rnsmz*X#wtT@rD!R|Jt!KNP#Fuo#TCi zRMQ{?NL)WNQ=1L3q{=jBhR2qw`H(eq!C%Vjbm=lFk{L@PwB}fz zttO)rEu2CJE5nPVI+ORpY<6q!v_od)JQlOi@-paOu^O~N@g~a-#!wB2R+ioLUR9Q~ zOjRF&A6Y+1y{1f#w4+0i?yMV)R+*<4xP#9qr#Mr?v}FxL`ql;yX$oy*4eFgr7aXuo&L@cWO|><&NGP_BFndFa2%ic zY^`oGKD_JF_Fq5$vI;P#IHtd4QQ)(815|!jXB9<)*pLGV6GWjp2zaH&9R(q^F~-4S zDfleGGxJEnc7qW^_N)mLn!qH%_nxpvGNBjzabGH}NhQoZ%^LD&3rUSzG~cQfaSXzH z5R+6EFlj^JR8hB3TbLegTm-km3l=zBXlc-&TzJ8RiYoRK*e-`Z>F@L}u5$lUeA*i+ z3=&;~NN!WsBeOB5QT=#ap$hHIPXCNu6fDSl!#V4*7z)Mfv3zzda9n|_DVV`1B_!yM z#nV2+-uR3S2!#@9CVU44BwAxEynS-*gu;|Nn{T{<8ghj{HmhDPKd4A({J zrtDQmUp0G9w+S37{Fa7-L9|`W9^10<%YA${Kio*g&Sf=E|D1w;Q=5@Tcn77((W&oM+XN84>?yxXWJi~%3Sw*-;ArUDU(`eewz3g?=;(NmFjY#QxxdG>PIreAi2-;3l~X=c{yGO(kxkfEH}ZVU0PU{E zOm0orVO~TC)@(qT?3;Y}{7@nZ6$}koaet!aO0bqZy>T6Yl`@<|$+RB~>d$YjS^xLy z-_^#2=Z+90lHeI5GvxVT884r-NgYZwyUq2s55A;UVzPS}P(hy{Xy`di$Qk1_MecZr zQr*zj$_0Hz9!Zw19#llMsEipH%UjkM9r$ypu4KU#C<-yhLg+pnLTM?HEeK?+0786+ z3PbUdEC&CL(cO4s-UX+gg?+p$BdTfi&kNG3d@d%qsjkXswX>czvPv3|nIFoXB% zc_ZQUCm6Y$Q>{)78rQGpYoi!(k{J`~LC9|u@OZ_wL*_A@9I^`>zo~5JTFC+OF=;W( zb)P%MrmA?~cFjlYN&GG6%)mD~(H%?kqWo|(sG=x|XoibGk=xws>Ll?dgf2-fM%07Y zA)BvBy>#ed??Z$2w9mDG^wBPGh;iN&liBKEWm29vn>=!oCpOK!ABO4^fAv10jXK+V zXU5V5U1BoaDCP{U{KNu&P@*Z8mc9w~Ti)S7qGl=+kw8Z=913NwU>B#M8)?hiV@4}j zZh*s#i>wxcsOF-=Y4;Rf01v{1ohD%HQb5F(jAT0Z5;6n}%~)xJWvp_@eV3DT83oit zSQr_PQ*fI6)69U&e%vgKgnm-OX#B{UGSg!;Thc!{K4yUsNg)E5P|Qd6%#z(2##@cW`vQ)2t@X^!=^;T7F@L(To^iJ{k)DE-TbqRWIB#}f zh1HUG9WU?q6DnS`2C(`0)LgjJLk6I6_Yf-VPjkVp&HCCOvs`e8|K#a=F?> z+$SB7ny;a`-d0)so(M>7{PxGUPM4Kec|F?R|g=>CMY*ozIOP% zF8vaI13W`~l?lt4;2iW;3ec$^Th-q5tL!uC5=2g+h^XNvX|mMK-m!Uqmrs zLx|On&;B4|C9yac6R?@oCnn^%;fiSW@ON907!nQ#Gn@oFVfWHK%u+DqYggwwKk0&^ z?^H8Lj(}nLwllMV3*3E|ug?%d^oI~QDVFK9eL`ra=_!1O8offZH}yfCeTN87Iv%(> z!HJ9y+b(N`W`I|hW~1MoQ(x;(&nH{i<1p@B;ZLZCvOYV~Ov~{_p9iz&W=~-TIQ|@rrEmYf#!s=F}d#UZvzFTJdM0gEo&1KBVEJx87xVF5OoO; zL=X;QW_aw#tbZ#YM_znqzX8+649piQRWh!*sO-cLsx}O~z*h!>J{hqK*gG z;)Ko;EF90v@Ao66L)4P3pOeRs7rrgCSN*mp*u?-cEVpL5I`vC%Lq^Ad#@MG`o~d(w zvL?aTuS$mS zf?`vi+;7Wkm0(HutP0O{snNN)*@<@nN1cga2^f%yi&1=35l5ijY8WbKuDXU;HsH~W zD}*)Jf4@DagGmDPE$Rzr$4~x93$dXKppTC}?JKUO74n(A3IVGJ>0cPhZ>!rX7?23X zOJ4WPVczp!BjqqQJTNgBBjqmJU*+Dl^K^z$UO@+~^$i#K)dBV#Kl0&Bmy24C&amWV zbv8vfJqUgkY;-xhn^LPm-Uaf8x~&h4M)vO&XR05p;?~NL z(xxFYMRDEeM8`RM(0J$T+3?M02$vcmY%b7UQmNDhMuJRTBqEpOgPj;HwZGEd4BQDf(7L`v=&8gvpjSy0n>|&W89goOe2;0VfG*Z){a@rsF+NYV z!_~l5k8M~^d=Wnv3uEsLO{G@#70(&(guXaL6*fr3CyFk`4n|Tdn}=(&H5zH1Vm^Vy zJXlw48}p`5Pa(ZH8xhK2Xzz`)>k|(bdGcQr>%JNT=bg*fzunbR(l{?JcQEs5I|-Bb zu_wA7mUM^Ng#Cn7;_CfYXCwHO)h-!e0=7emKM;RjoIg?Ew|z^Otw^hNFXat1w&Fti z&J9Yk3sD|0d>@-sI8ScVK3S-CK3Y{{lD-fMU~k#kD<>b&5zmzKx)H9-x|iIy-mZ6h z)l1E<%15Gr&E*PDJ-MmBLW7dVCYdkBRli#xPD9?p_iu_G*%22fkW%LjZ54mk#T)@3 zNQZLdjF>muy9kZhrP1yQT3u2~01{<_`9ZGZ&N3EZqKPVr^&3?|lD$~Z;d7ihKA=sw zvZxP%1F{51ARP%J{$_5q_?$q(17Uzpst1CNM$K<_j4vyR{3qFC4_u-wz#wSS@UA;|))N#ITmHsdG`ta<&@R1QK`wGh1;Vpn zE4k;zH^=^7QdlHgfN9xhmEuqP#RL{NBbmc2{pj7+hR)WngZdlFs7o9uK3?H}JXzG2 z^s1{z3V)<^8p?R`P~az^dh+c14i=ZSagL+GYqp9=z(SIrNya_*`8C}cTL@2fpe@)D2Mtd_GTfL!zpQ`!pETt981NGH3WtYB6pL{+1sKEiMFaMRu? zONQQd<73}By}y#ZbE$AJ)BSnw?=+Pdxt1&5d<(}DtK+Tf~A;x)DVxc(+<)Svy{b{9+gReQJ< zMovE+Jf!L#Q|tP5Trmu<{x8Q9rgKopEk6_TN2Je2Qd;FR;f^q&qLtI&o&*@QZQ7zpP=u09* zQj;{~ys)sw#vj?%GeeNYPh`MwgY=g>(r%-D5?52Tiy|@>`g-<2a@!XHmoZWoqUnL> zFPR6+)icsiEOZ`vfSD80=#~gIYYK08m-z-|$tqYGo{$yKXg@l_0|?X5N?|6vx$+bO zAq!RVmxfTLG*{o@T|GG?d9u`?*u^ffUg&Q}41iU|37`nkHM!UkIWUgYanu3&k*!gGd#h!7g!}v z61}@Gy_FhlE%-D}*v@mOQfl>N5OHh_kablUlE`6`?8hCd2VJ%BcZw`Nt4FO2*&Qj0 z8)sZ#38`vU9r`{=xVrCj=6mE`@g3+6D3-ck0q)Jc&!xpT!|fuKwM`|_d;ei6!cCR^ zYoQw@5gP@1HZgPFotHRG*z=z3%74FNd&Xmb8fUmv_b@PB2PYucih+Ysx`H?nf$YKf z9qaob+1#0z5Bet3&`mR5xFf4=nqPM(cJ<-rEbjem8w5|LDEs52pvg&2+&K43neY)| zNEI4{Cz973p52|kuA2Z7&_M)gsE5?+gr>(BtE;j#)ILFcdB zddMtV3ed1Yit8yi*WG-H(UZYU_*-l})~_`GvTy=P400@`*+E-}uoB|7#LEMRfSk=O zkNon04~bfB-&%n`qar@3Hmep`?l2TBl+AsG%^BXE8@8dammzi`DAzj-TKUEJLRFDi zymq8l-6hyh={hq`v^Hg02fi5v81ONI*ckn=%%EwFU$ae4GUA(|Ux)m9&n_`__^3*l zJVhCv`AZ54`X&+gf%I9L5b<*!>=ax*{z{jE>xZxT{X8~16&aBVI@xF^YBEwFLmB9{ z_2&_=K5Qa(bpO3JIgA8u9wk@vS+jT;Xj;P&MlgJNcJoKBmr~QCVuovroQ?f&gjSSp z4u}}jP7ltE8UJn_XC8t?wm&_RQYFRX{&)!Uo$C~%CyE^1Q&F~1exnr$DUjn=L5|{F zpqJ}urYd288nYH`d8&l9;f@!Q^AXuJ=6#N^zn_o&gL){+E?SEYbiUlhuG~f=9#SAd zndfb2IrWvBH_5PLx-fU9_{M_A=>g}RC&)I&@AE?$#gQe6Si7i+wuk0`_XRMN9wGnG zOGhspc|aXiY~r;QR2H zYYEyOWJy8-w+D#@NBKtbYd8hEB^%m&+R=FDjHOmYtb&p34;<-LgZQ<3xrM||SqU8?51# z%;(&6Umo2FUGn;hwI{aJHtqI|8>?uHLO7NVG8(1`i*cui10C!vHxWCtOrd3Aj_3+B z8sMke*v5ds-(ib4CjyN?&oXGCAkfA0{pJ3HobI>7Sd^hA$N$*-ASP8G5xZU$W!0%0kirB8{5a#?s;CJT03{IN0FHM4~ccmOUP9M3@? z(r-!a-xY>I*h1{5ERZOK*;emS@aXhTghN2E{XDy*zi40jqO!8hC|)fTl(++da=$@= zW2rMwuCxgJ%3;IE_v$0-a+jGG z({4`o+^hfVpatc9(M_~{Jdk;W1TVQPWZG&L^WNxP>~v44JVE&|QHji~cxIU=`E2I+ zd~C{<1U*cpopMfUQOK+cB&fPwQrL@w4`inYu4qxvYujDM&s-6xFkJzBzq>5x4mp~q zzS1VVKy42j6@=~LN>au@hfBzy0uHOu9T9rT$?^MvoMqo$)5Xh3_f@S~^Ww@zB1r32 zZd=YgZ4#T*h{+sc3ou7vj>ZKVT&i7AdQ72#^R+_{-PwC+C$d5ymBBgRaO)l6ixTTe z&s4hB_P$twF-*rz=fvWRZ}|LUJ`$sXl~*cNXBEtR0u5Vv>dwxmS<5k#Mkyl-`>_H9 zyF$@3Tp5^cr+$KlT@8<`x*W3|EJqb|$&cRarG`!Q-Ywis|CS2?^2SGl=2{fD*fkP5 za{Qd$2Mf~PcfT`1nadY;x>t@u@$T3){uj>K*_uGF(#+H%T{_~|m+X$%L^Zs@(_vfn z=Ft z+i?G`U_=ST?g_8;-jb%|wm78bYon{GTSo>YqEuuQF!fj{*@~rZ(I}(OnpmqJ z8C_v8k9q%v683F@5y=$u+$pALgReg-9+^cQqI+?aP@oi&J`lyU>V=&)*X`Gqr}X^u z4mfj?z#VG<>^CJ+Fr)4oyQyrd7;22gi?~148o!N#EcYdMC_?X)@!`48i0hd7$5mj| zJOC6(yu{S&D4(^)!HgW2FP_kgv{5j^o8a@IB%&@Jw!x&@{PL**RiyW@*4I+La+99k z8Et!Y7fzAY7Nu?Fgw!}5-eK)j+MZ2&>@5{-ncFNaWo=Z&BlGKlN5mzW(k#s@MwLP=M~|FYzOgk=LnzrzcF3)a_)0G!Lm zjim5cSz_Gqa6sTse>TOE?@?_CNB3nnr)l6X@q=vmTf7&$S9%oH*6AgmcKp-${4vA9 z?C4y*ckgQNw0ip)t&Qq-eUaReC(<+YpZ``t%|+a(eoG!Kw0b9hULugokb=2`FTf=k z0yMjp6dQVG!irzwBg%nVmpc_JU?-+(Ow7W!w0b*De*S6mFybgbFR&y}`Gt6%mR-t7 zB+CPI2p;Dz6aU))sN2;aJzxFA+~IH(R2p>b_fz<^wW6HSiezlN-lCU{qY3CQ zn+J-MD1*~giJLtWxKuOBM zt_KE|j|?Vf=1oKn-h(ZLY7-Q`_ihtdX@^r#?B*y^PNP1L8^J^wR5AFElrjI~-)U+>YHV z{eLkIIa9S41kfeD%fIPJRi?}|E&=b}Bx{F=y|dWKgFA#wGn?1{d@RrN#YS!q@!chf z`a3{x#tuM>v)>gcnoo)vCvy)wb{9?aA z6N)BD8M=i0Ne}^P=?v}3kF^@IRU}Y<6?45*7>fws1m8N;ARa22f_RFlh|W(OPq9wIdH#EN zMuB;#L+K8+{;F3%{DMG;^#xr%TdDJ^U4x6C$F_L_9%&!x$Sn~a*qLK32BrV9@l~rposouJYx!6X7db5k;>Ia<%j%<7 zy0xWiw>h)Zi-md*-`E4R9JUd>TynS~>n48d?fv;$fKzy6WZ}BwvW+oXt9%0nXhju2 z(r0ftvf{s}l}X~DLP>iVT9Ph8kN&y%7ZcfuHecX7(QVyw!u8vC-;!Y790AW#`XwE~!*OBYj1X_};*>?)@mLYUjEHPILJ4!}Mbby0g zTn&;2_+{BpJk2~$kss(gWIsDxw2Fs_ctzCNca`yVUiJ1F-)FM}ftM3PO^vha;mBY!+kK++16QRR5^VJuqnU>2B;6Pe}ZiRF9!@_tC3ohKvd+6+EFui&+sH z_foAVLhpqwVRetSQVS7qegd07dj$&g^B3(0ktB@&kQ~cV15md2SG8|<21wa|xy^gj zel!{s-$~Cd{p01ncxUr~YNz3WnN#wGk7g?!=qU7yc_e++o^Yzv;YTg3;+Nw@CO7S( zxE~nP3Xc#`bHEwB(8C@*Y+c#J1Kye`)j)fJEL6@uzry1OPH!kI>i8u$)c*+>dG)-H z-Wd5@+?3zMf_S{Jv^ei>qTNC^+^oLr+@NE$6ZC1v zh(xTfUYo(imqN^`sCv1XgNm-wNh2Pj?iSwoV|aMsV!YZAhGRDK~xh zh=$M{TkC*_`7`ba41lhhVP5>hEnDuNz$5&csJugo7pN8G;x>|_tXYRtR#_Eid@XMEnvRyw3k&fcwCk;IrbLylHc8rey=P7^Tx!x(RI z-soBif#h`Vh3cqQ68{Q_S%xJPk>Hgv5DVcoT2P;w)j?El5avL62&>c(Gs$t)l6eG- zEtK*K3f3q;0z&3W7PynKZN^2VTk}05k-6=;fh=3j@{t4?f8iUeW}!N3)kY2D)So& z?xj4mtCHJM;fpqLyWh59!&BD%DWsblHIvo`dRv79qj5M7rcQJI=qR8r9Xe*8ibQ zpzc^P1;wPgAVf6oqR{$q)`&qJm9<1bp2qIto~H9!E(yPG{Wdq=E-&O5VJe(Dh2(e6 z!I+Bn9_xc~`}i@FO#izt!Lw{?{x!xihB);v=l+YPQQx+7Vt<#q@p}=>rmrN`|Bf(V zVU&5(;^${VNovK-{FQFfPR)qp6Ok%Y3sMT9H$CWRt6t0NnXVO_rUo#jqEHR!t$*G} zvT!(V^Q_K){iFANjwx8V;bh*%XcKLo{S|0D;~* z9^&(GdnBS}p;WqO6AN%-o1oN-i;5MuoJ**06hF*DFbX7B6jl(|OBS8v3#Pd;+9R8% z65F1KHvQpZO<{=3V}5T$^#ckN=n029z~09r5Rlg$8~i$QQuBQk^gbirXjIv41q$DP zMtNwDh`ZpKT7cH*me z4qdrmJiY3zT`YY>gb+O_9mw8>p=<6EE*S`ls-HX|EX9l$+CgZi_R%RJQzG z=Y$%A&Xa(=7jvL?Z64G*Cd0C$fDRrq5*6F7?6x@hT1}}0;jzESB;WA*Q;%wxQ{CJY zN0O3S&RGfL2Rd1)#@4^_U4<^!*PXC6wq?{8j9m_x!1;PonN>HkGB3~7wFZIxs(TLn za&AjFX@Dgrlxt-l-K2T+5!g0c5!=NOrA-5W?QHfuN`H!B_zY-MzfCEFfSzu3>VVN#|=CxsHYske2Sq5 z-tCN25RZ0q^MK%d>(bi5Mmx~DY#BP!YNOyvSz}jvHI^1U|8~%L>s4}eH)({{n*v2c zj~ZmtiS7NtF_^f(ZNZM7qv}w9U9?QY9?4ac_fn>ZQv+|wVs5rjV_mZ7a!e$}>)l`_ zpE`TRhXGJ}q88lJape5L1i3$=83B5gx#M8z4#ZAMY#_6}!CnHpX>r+~jO~<2dfT?r}uAHf)|KrG1C`t49QlqydyuCxcsh zh3q@efaEKt=54A((+(zP8GlD5{eUCT5&wjCbaCzv9dDm5Ur2YcdMWc1TEno z+$huY6$t^O#dio$2+u>i)(yQ+pK23a)f_<*E)A%*Bo5dT9h%yu-&PgTz81*==@kg} z`$#Z1tFVh?>)fn`81E`Hy+}d+Zk<}|#77@&1^Ia?(jjR}jiaaZ|4ZtEFYImS^CHBQ zE+sX8N0Q1n`l@5%hkKhJ>N=fbPLs&qWhpA;QUKhnR|mwaKk21W=5M&(C7P3`Dusu& z>n?A2IpOG(dk(1fQZPM?J3Ki7dJmxDC%t!~EgNUy6>ygrJ@YN$Q4kV%M_)pax)z_`*RW)Q+e46L2Z)iYPg`Es?^@WXgu``3Sg6R) zMB{l3@zGDL(z={dwRozJ&*l)|kk-Fi0d-^)IUf6l3^nML!?F~FhQ}Z@ea~-~FZ*Fr zIzh|qyGz!Vc3I|xO`_>bmkyecF$i0y^wnX*0iPVhL8j%6QAws9Wzi*uR_?v(R=In* zs}B`aab6{6kE6$)QQ<3P>IXz8)>5`bLG^*X`^*1_>?>y&b-SIyISOuWf^O$P3m{Hd zx&~cWlSf|8ls{Ags>2xj4<~_3_C~V5rVGyS#@ZZV_0apt7)tJ>V7J76jF3XcM^{=D zSPwhY``ss&sZgA2*k7k}6zt2${uq_6)*!EL_*=E%CP~;;lsf;TxwDlmAi+)M66UaZr z4C9O)v>}Zm#8V88=(iar$yU(^t6tiR)Hn`Qa&~d@um5bE*jQwabRD|*Zb`<#@m+rM z$&%K_jvJ-5*%qANJSukBU`$RZg;o8*PD`CQybmD9UON7lfGo8aJg3+h*{6cx7%zR5 z8>6V7a{q_z{r9pG5(z;H&~kD##?D{nG^$DbROJz~AA1OOYg6dI?%P@qzTq)f`@VHt z%?BhQVLR4q<<SHe{ZcA}4S#Sq%0cOhv7ElOgfWi*6HjTenmEakA|`QJ51M|7Avbyv8H~puO6STaVIo@ z`4G4vI8DGduxT#I1A(RvW_nLKtw)=HA@3#gexX4{Vr7PDQVTZS)46Mt#NT&zj7_AZ znOKedtSH_OJr`*5V+<7=Q^`yvrfWE{9kIq5-#gY92#oX>U-_5jl%exW-t@ff4(uy( zJsoGVTkz2uGgPu@!|2eK8gh3~L{vr2CdDT)D53CAhDR*+N1n;|DLMdFG$F8iT-ze33 zOBjqnn8zS-q&E5rj>)_$*2t%D=ID&2VY%N-+Ym;sfe^c}qB>qrM)B|-mYsLCNKtb77R4>uy+1bVp=T3e5ENjN)fi6gc09!O<3i zP8fqcP@?3)JTyShdpt5b%?eE>--e)Zg9OE>W6iZ#xYeq3K-v6n-as84Vp0_`Q$;v1 zVPY!p)hG1op5ZtyPD?0xn(|2k1K&JJB;KtMx;BWcAmDFiR&MFa!7R%$?@!>Uyu@kX z*-(2|n#npLQ)1spfvkf4=DzScGp{zQ><$qFsAj*<$upij>{Y>z8W$lE(njYa8BMf- zafZq&IN@GFIJM+3yWq}>eX|!Btc1$I!@kfODc4a#7){W_L5>&gF1|>k{gylvzZ$pp z*Rg!nJZ81o5eB#Mm?*_MB&-8Q$%*kYz?t`v^&pTC2QNY-Ie19CO8*mYB#D)gHm&Ul z6qyI5JPns<&ErEARcn-@!SI{0u$8_8NUxmwxyC$`Tb}!Cl2}?B`;$Y=ia4%#Gne5s zo4LH{hUm|?8~9l5D%#q;v2R9Z2ATysW3H!DSbaB#&$Yi^%QU$l>m7e-1^hwqTa_@X z$-H09@9XwBC>Phi@^a3Kp#SyFxipdQ4&){c!8IETxk9d*+y6GmjKOrfEN)?@bRO=e zf;?UQCKW5vCSw(-{{-eULdGcOO^e|+CTFRX!9$raHi(LNp#+7l(hVTzuP$@^UvbSCwt@IAWw0IM?g@8a<1=7#E zsa*@9JRzyD6W^~#Ff#VT-g2{=^wLeei@tg;ovmMJoRiAfsH047`*{Iv)qe=Y5X(W; z{?QBY`?|bcu9}cqK|C>~Hh6PXcL9{0BUT zK-=RdN@zeg`Gai3Yq|B2lB?$@gPvZr}RA><<(1oU|Zu7HGmqJNX17@vI;7FvI0 z^Qpy2780KF2Q>>tfM--cxdL4+X|uKAyS(fOlkr&Uw4IC|1!i8WTMHCn>Q?52Eo$1DG?)ta9f$ z{(2dfU}>TO+CPpY)e(gmP0aX>gFMkBa*bo`6g`d1hhTf$??9&@BcDdZnv!w_){e}y zR}OQ6rp8H(Uh0oZl4qppLH3|M-2niB3mQ6TPk5X60}5c9UGP)elXF-005S9d=|hv^ zg4RA34eKttSJd|}Xl(cCW%F~XKp{;1!~9g{ldR<$=5=UcM!2y(=-vEO_;Z>4?3t$n z@N=jS`NqlV)+>&`2%rhG{`t=wKIyAIpks2Kga$(hy!`H@HQgU)UP8;yRB zl@gu~kS!(`ug8EBoT2pEGN$w(-$i&%?3$i6GtqarEtf7HbX_{~Re5Yn)M0$+bR zz}Sj$Du{v3gkMG=hWl$XaP1m5c6tcIMEEG1SR`gQ!iXyO#IMs=EOH&kLU3mii&dwHR={R$%6v55#nbb6re zVxA?fcwPAt)K;9^W2L1t&EGOVhOLx z=kBHW=kRinf(8#eL*i9}#WO@4`Xi`DU$$esK?sx2pUGMXC80zk^nrtdPV`kuN8-<2 zp&CHp-U_lx;Zm))m4aWzuaJvlq-zP6&W}oVRLo5$#~1Z^)dTFkMU}MrM!j(Gm&X!ERLvy1NeQWd^q+Qd z!qkNQzB!?+UExewcn{b0Ta%e%e7%AQ4`G3az8C)41Y}f?31fKY^amJ!gUG+z)jA$n zq$Cq)H#gf45{hr-+lQceRe%&45J=#XTI}IL8YVqCxUfM=8SvA}I{4O`>ylVD*Qy*N zo#1iWD_YfKY7tUPeCbDqd6&Ke-9mi+fs^(_4f+u*n>|5S1)5qBN+muW#hG6Wz%@6G6%k48z zM(|M=lQ+a2$NWmD5z!B%X2H0jz?{+y?ma8>%Wm5c&%a`{S*rD;1)%B&YmKbK{O?wdgkR6%+Uxy;mwE!vTVCi{;YW7BZu z^`wHuh!{J*ed%H+8&As+MP3lpk0n766`ZTpwVUmtaajZyfuD=!Qb>gv3P$=(i8%o@ zkA2C8(>0{J$AvWW_+_gwhp=BGEXBS7Am=#SwZA3OxLh+bf_B@i-&x@=UINl4YoMqE z9P?c&jyVIvir_8ibLx|dj2e3X0qt(aU`{WH1>fqQ_RRq~MjS3~TMbl~kA68wX%K9V z+xm|{k@MwTemC0PiGpBi6dKc!X$QyETK&+Iw=O7R?YN)cdg+XJE2l>V<{s^m^zRjb zwIJev|BnykXk2-1H{*^h@VbBb%@Dkm5&&L5Ti~U8=zws$(f()9ukLBbgm_Kkfsd?; zgsSg{s>+K_fQDQod_*2}S z`f5Q|Yyn$YdbRgh1q+tuWG3R8sq_{F^-S?7cK|!Xhx&b{5LR0O!LyLVtqgqy`|?3pBYv_M{gbe4iC0Bj?iR=`c??EF&lC^2ldY!R5lPHkEU18cuup>X)l6nc4l{ zp@(dF3@C^&_V@*R10{cv9}Fj^oYkn{bO*O&aUjx#*pM6WaWQ4UYT3zS81RsqvP z#?eMn(j~yXc5yHa#U5bYWL8KL~S^PWuK`*fS$?^Smm&*EH=myrK=}-YS#vzEhe( z(_eC%%qAAjut+XMY^NOVFblw#0VS`NpDMMQ55TLFAbAS)nze|@%W&J+RPxvGr9MJ* zGQwhtH5y+Td~pzNyic!Z?ERSY6=hSv%ZqggM(|zjgueNoblu4bq~RTY*SI5Fx~DpWIeLU(j70OYfN=}fBZb>**?JWw)CCKY4Xd05 z2`J{=YyzZdP}|c3lkJet))%}}&-g3BcRfszjN?!>U+JH^@-5dTqFC%}r=KfcR(E8o zwBEn6dH(p{*k%3($xW(NhB&_qOfy|8v9BsYyiZ~OA{PX*&+orxp^D!;}>YKOAf_ zd*wJtWHGaJRS0mb)*<{HCq~2w(dt&GI zGs`%s9!S-L@P_93sn^C>M=r|#jX1@MJ;xyXmg#Tib9-HF?()0R1M9p$ez0wROOYPH zC*}F@35n}H*UGLIdq=glcrH2BV;E}baQ^koVL1p^)TBGsUMP4TPiC;niZyBlF;(Gj zH~!5XV|yhJB+e0akZeFQd#fCh`M`K&SaG{jf)d(Y|2O|#Tl#e>5g9q`P`IGJNw^Cn zesq7@rE_{b&WKlx5E~A+lvt(knU=X(#rrZtYinJ>=;<>_pkvR@+c4WUG%X6nYOQ2B z_sl##HWVv==ka-ELX@KVYv4L32zO1cRt(U?Z6j8HMZidY_1PCA))^d~vJ{DjolYl) zP5;~?qNx^M;fa(=gAFuKKIAe42a$kwSN}M0ST2OZuo2^*@yB z*p!A+W{AXrb*gxvUlf5n3aXIJf}7~-nZWeWDig73P(ZJQ^h2$ z+S%oghT%cH9}Vulnje+!t|3BMMkg=rST|v-AJZtzQ#&Z%UcbGbziXerTOVy5&&-h| z<_IGgb^5)W&3|l{;~Y)BemzI;^VcZM?h`1)m$l;8eLbRAa@8rJmb}EUAn-16IHI$R17ke^G#ShO^%&0V#Kh00c^yyELAh!vra8w? zxO7_Aeej~|%BJ57rKkpk`HwhV23|@^GgI01w{s~J-VaG;SP9cwmQ9U_(ya@6K8saF z%&O8KBvws^8pL(&eSW+UVcW?@Jc0O<;Y3)lQSE=Vwo_#)z4ZnbKnVGPXIU>Kmjy%2 z(o5#%2a;fXh+*+d)O}U@djlJ5{ zm&Nm^uglvrALS;WE}zHcht)=c`n8=PMC4HMrq=VMcd6iaqd6ez3f`zQ-BU#pPnxXI zOVde)(~3q>|*7%pM( z85&)fhf?D+OBm$(n-b4H z=JC~@c4Eb32QW>C&GuEFjlT)|G)jtkJ=?n@oMc@)RoCBsI%bf>hYHeKP zNW#pkNRzTm7IO+j{8+WPP^d?i=HKWPgyq%J2;zqAFuUM#U|9}5zOR3m_9g5CAE@X} z(T5=&9UtsI^p;&MR1R98r1exi^Su}fdpGnj*+D}_=DIPc{MK^|mR;KWRP2wE@s9xl z;q8hd3A7$!e^(#!SWDEnl84m$jcj}N?P)3in4^7SV+G6sj&QKxH}n%Ehe4vg0}?n< z-$)*EfqkA{*v= zQWr$+FW1XP`Dj(wR|&2h2D-h(ZB#md7vF4c&<}(&-bE#m@`kaIo91&pfg(k9aBRWS z=5Fz?R%eQ0-QzW*z{Nkzsj~Ib-K8u9tw_UTw|SaYBN#hx@L#ci;6J^>rd?s@@u&EH zR8_X!&BJK-7P`Xui5F`A*&@~82Yx`Suqe+jgkzqK!FPkjoZ!!t@d|=$B0FA3Dm76V zP){XrRWZA=YD1DEliF28=HJjZ7yT>~D%q#-Wq1BO{a4|)9GeL7@s+=p_WPeG8(- z*;P2ssIWdwdqdAuRXtf6V>u95!Jfq40QDWNrJIe~T8v_eAtS5n7yOYt-KgNvx-6~Q zvDI_3Z}~-|d_XhzjQVEmr>9M^HIjlYMuHL~E$m&ze<)qT%UE-~x3#t8=vli?q^QNE zf3tV@e*!=Tzxk?jri)&=ke0%+Pj9wGmLPBIa0*rbyX4+TD(%pZwDB6((Z;49yQ)Jhn?6<{> zS1vlh{iNF{?XFYGG8FS64NWzSMCaq7f!WNWC%&}tf{_uN>(5uUnI*BxnoZ-hCUyK6@xG%MH{E4M$^Y&(fS-f+h)xC{`q%XtDTz z&BeRRtIpf2Ba|njg9S6^29Ve5nYNjyVd=7YjwNp<=0-0MZbR?Xh=?2NRvJKINUTZ* z+qdzh)oh^Zl%~o{AJQTushVi@2YeBT3Q*U&L{^sQoS(n@?bGR-i>tpE=Ytbt1H-wM zzCfSRoB@MQTJ6V}UHeXXF5b>hW(+}p5hk{FOk$quR+P>Vo_ebzmz-dPX*u_|bMq_w zO*DABBnBqA>$#zVr&LUQZ&rI?2mw{5t8M(uq#23uR6b}Yj97BdA zG$L`TN5xwHV9 z^14b7de!;gLyi9EF0Zouq*rI@hk_v<<|;|f4BU##nRRbJ_*?L|9_kCsv{K7a?*P6j zZBX8Uk~zPViljza^3LB~%3SaO*zR>tFF%|epMHAVd2`w`8bY4we!KVX{G{MxJ8l7c zX1qcqHs>#Mno!ACL2>H|X{3zEc;f*bEjosJ zvzAEk(5UP!`AkC8rV4?r68v!8k&{+GV?G>$c;RpAdM^h_H-}lio#Y#TzEOnrE~Fpt z?OG!iR_KN}*oEaD=9SEXW47(KQq&$HAB3p=J}-(+I#->aI$itAU(lXP(mmsf66AxN zdjif}?BFd8lf6HIqgU{q%fV+)2@5RBaxct|w{S_=ctO2++xrpVeUQ2ubWlYT=k;h5 z&s=_l0haV%nkCwK(k;$^Q?OW%8$CsZZtF={HX*(1ZLZ})?nYvcILiYLXOjy@_y4UP z-FbN!#0m&{^zvB6JjDLF=&sG3Sqxn<6~2hPU2-Zlf@97Ib_#>9lSbSClt$4VB^1LN zj!1%wct_w^`8^uGAOC;~seIN6Ow*IeVJL$YLzx@;Uq3>T;Azo+lF}IeKmK!eC9eNu zCW%1ryQi1)Pe5b~5f}M^#(ny(@7Ukp-+%G!8T`Ayzd!r$ z{=w51e>!+}u)n{5fB5q0ix+>|KX~!%>C-=<{d&5%oH8wf|7riu@0#u0hS1!MAGHv2 zPP!w`uaD5yKekdq+E!%Q)%#l8ia-C@+M0R1eM9JQq>j*5`(UeCj}M;8>)+Z=+FruC z8s4#T{XgHIS^v*pJUeXG|JR^L=$sg7(OrIF>>hrAAy(*r_)H7O=I*RWnqz!vtRdCO z_9^o(qzW2N@Ia}&{^ck!@$PM#bSbKX6|7qS`%j;h*Z-mZu37(IgYt9`df&IXAdZl6 zq5sxxYv}&TTmR-Ni_6o_$(z$4iRydD%KiWF>CFEBZ2z!X|6hfUc{)LG9iE9En>hf- zEZXCu;yy2bcc-E<_n6oe<_S)lt$w3uZvEREo9bi(tJeR^XLIuZ!ONG;`u`fV=H+2` zy)i5-vzh99!-Cco+)Grx3XHOUn*8%KjK(-K;V85YqmN1*HtF40Gvm4SzxXPvTl0if>;KvQ;f(wRe{k^fS(6T&Q3zyV#k2sz1OVld B28sXx delta 34597 zcmV)2K+M1ExB}<60+3DuiS3b4Pk-$L#zAV*_DXFYHPIUGWUS}?*N5M`Kz zJ#f3zf>D(G+}?J#x7}{bM-d8r6nYr3UdsU?oT47^$aG4=7624QgkdhhPJcL$Sg+IZ z1hX-Bhc{sVd3 zp(v2ufdTM!7r+#TaEzuXM^mtIae4IiY_JLLFrSFpXc|o*!wirRpidly3=eUD z`3%6&7cUuyp%1Cg9FI(+0Dr^KLvCwAL{Ckp#+Xmyq1_qX&km;ub*7MUM3YbH)N5f+ zbj^UVi2@lzoOKw7-VL*=bntX+{d8mjXJ@DTY3J2zHwwqC8#KEk)RzNdHI@EoISGYY z4p84HiURCO0=69B1+l=mHHA3j5Qm6LXlM#?Aja3c{NEPFEue@0t$!ZQv^?@D_Wrkz zm;g70l;hAH(WFA=LrcB05N9N&p5m_>dh353pLjQjI+>1}YIk>cZu-F`blhpBEZ22k zxx1~eJujc?DaikTcsDC_=H|qZM6Mx#>N5c{N$wNE4aJTFKg!Xq|{|FI;yRU|OKl$C=ZRB~|dp~ab zd;b3ZaM&875K+jH-vjNP?#{N;-EnqyuD17jJA1v?`|kGcPu=d`U%T7AZnyn!Gl?JY zSo8lD1~Fofpa9m-|K0spyZib1zxR4Q|DWV}_6)oW$PfnLNPn)F08il_I0yi_MU-M+yhnw~TL6b%5c@bB16$H;3FTpg$1z1d z-~_}>)gLQVBqxf74`WJ&)&_4O4&X3IN>m`*Q*SQO7&A_l?k3;#;~*Fyk0LHQ)KXA{ z!khAc4}89FJ%0lr3!(?6GxPU3oT9XZ1+pjK0^nGMe?>F(HL1lop>T{21IU;FJFtGY zL~pgmWGS|~gIcJHG8BzcNi38frRYd0T&7xfI2^N%=(7aXlQP|OP1nUFC+SNxQ~)>} zCmO%wqalW&v)y&*Pb~nRJp+RXd3ZDfFr`kP1lXIY&woc~1ml1+G1@N!BFl%VhO{eNGx9fhmzsNa?2tpwi4NXvGR^_$Zl9CnLJKJd?(SvJEAA5 zb52C@E#$~CgWWN`eJ1;xFs^t}$GE0DawIs7kr=cYiNPI-10MwV28k~WA+c?u5a4h` z=v3|?#I`9QV?}6i!U2zI$iUl!!7p-Vo*$f@0Dm719mPQ){sJ6L zBf+C!L&`q0FOow^k(82hNH@iVdnW(9&=7mMHU-Sa?J02Pbq1t>dJRDOPOB$(Uk31Am7kV z11J92lmEU0Uw{{L;P`FO2F_^bqXMrG68IvGX)qH|M{ytxZx;~?2NOKv;BJDw379|z znCB^5nm-dW*OORapMecQ$gTh;s0o9B+#!EcFL!?y^!Mq9b;{eeufZVYQ+Cmk)X}bl5u5#8vUx-2>`y6eQvnJv+4mgeiQh_g;4 zt8@fil5x}T1Pvk<$pZ_ys(;yP-JyKL03`vE;%bngmMC(G{*1BMddg#jL0`b5L+F(N zv<%{oD`P)SrEsB7K{K7V$FBsYtm?1q>jM%vnF0m+y+-BVhir050H*|qgfPmpArFU5Pp zIbb7Z$Om^qefXFTpO8BOt&e6gO}>5HEX=G$jz&7efDFy))aCKP(b=&(^`EJU9gZF7 zm~$dWD!3$cMwl}0&^QDeV(S+Yj{etX>zQRv(Y<4RGad4M7Js0?hSVM62vPY{XpT5Q zW5k4(9_tQ^{yuVFnG$~vpCE@4!W}afna)bNQy7o*lq%oFWbS`ej5DKBH5v);DUH!u zD1;&|3Y%9-HSeWgB&ajF7FYn)X8;+1V1xq%aL71InPo+R!4alCP-X!XSV+tc%>GgA z8GK(GY{~{fT77>e6rfLV8U?7Q7=TlF9Nx+wV#lVK|L2Pf^#Ulpp$FPSNZX1?X`SRR z@cSPUn?yYk`rQbR&tPPBKZ*l2asnxqh4ukbc6g>ODt~%&Y^+b1`$GWfm^~8F?SVg$ ztsT%Y%i;oo7c)+#a$T0|gIGbts%J3=r!ZvDlb-`Jelm1_gMna`Jg*v!Q>{-{XSAM> zEnu0L)D-uz$CK?QoTA`Ro*0PjjsW(#%_fi{|7|=PAOWMLgK$B@SfEozum8jz<>7CMXzr8cJwNku46 zy+gbI1@cLs5g++QIvy~i`V3g@zV8k1X+fop2?lM zqgNT`aN-P+6A|s%1i7ds%_mZm zFMq{PZ#`To`4veH*g%lr?W}wY2n^|dA&mDjZ~BDtq6i4EJZy{k1cltRTPYaiCOTBU zSkd@;GK8)kY-4xr0iQ@sRc)&BrRGliw0P~5FQIo2d~xKVo1!OF<1e=HjLY{E!g%sp z7Lspr1*Wsqhit~Ain{&Nj=R10quX`6oqwIzVCwH$3@p|#IgE9JRqbA`iYKTQvPN-c zp^L3&SEGwF2(4Ne_I{hqmC^|LP2J*neRY z^8$Gj0@_CeFfv7ag2S=fE~9CK&Q^|f2FE3xeCH zbDKH*#30-edIMlU zdrN+0cQXgEk2x?a*76IV0E0uJkbkx0-#uk9I3;5vA%$#^=O<>nACU1c`d!8ZC+mq1acUVaTZds(xEEW18p)IS=9q{iOWLL1x;3qtdr+^bK7I$kjGr-Q^Cz}y6Rc$UZ zn+a1>&ZsOXV|_{Co#H9x^M7HQQ^F$1BRTm>0bU*U!3{zY4Dc;t0EZmWTNq^PUwP55 zNtqK}q`bZ#pt`z#fJ*Bb`)*amLuD;j=kSm#hj76QB+gY!K3}P?s?sHzlG}_HBbkvY z$t+hYB9zSJ$jxC$?2`mNBgnEe$tPz6SStlauKb>a=Dkh;r zMvnNPmSXF}JJDVrQB3@S!mbBisROgqql11yPih4|jLL29H0XgBFXVZg5TyD?By?K+ zr=IkxP&`V12wm>z+<*MQp`ZDYSnGQdIHca>8gfpP=H#1^B)@s*O^}fK@&^x?bR)|t z*5=5h&_(@0uP}YW#8BHc_$*4Kl=!=6jMXQ7sn2`nR}Y*kfu^Xi`});RE9;mgjqb!p zLiN`tJZ93L66n8$0SrAvm1mAAXXC*d`Y0uwqAN2eL|kwU4u8kyUFVsA=m>lS!l`qT z!LX;X@9P~I3}*oPVr7=RZe3f^htN|vlNyme+Ht|L=%bu_(m-KcY23s_Z{2(mW0pEP zHjsU|grQIdAvF$Q4obtpvAlQ~7=x?x1A@RgNLavgSgFviQnpsE)*klT(XiBIOd~avKXc0;o zl%SHMSYLTCM1(Os3}(i}kepI$%Mp|6v}_4{?D*)m!+$2zkAho1?!7+ysE$eG;Xj{9 zqxJ8)G0a$u{@5r{RkdoWG>=(g(e20@tn+$%Z&RXb09q(l15FFre`=7g_I6)yZV6y& zPI=PDZz#`q018Pwo(N4VtII2Qvmii$+&&=6zy!fttk#uQ;#bj2XV}No*+L6$3rXMX^K5ZwVjjYh^HM0}%i2~@zO{UjaUWNzor?Nb-Vw2hC_&jal5?}K!_#BN(| zE)q8cJzwM&i9~9BWdM&uBGf}X0w0UMDoLj>10Ut8^)XR)MWf1ZB#UI((LrB%;|VoI zkqc;_VW6CbpFIO7BXhvIm2ogur;h(=zxpp-UVl3wwVifZm3DhekA8CgZ(MrhJQqDw zyCVThY|_>7?uK-=QWI%Y>=$)2VH^ZoAS8vRq!$#xOdTFD#J7MqA%rO}galUFDxxj` z8{=q4jMBkxgRSIF9#DoA0N(w2yd^$?|4>d!9C|lOjWU!}i){&i9HgFd>bjs`LVhvb z4u1oPr`jvcB7XnFVd8UVl;{NF5RC{$hKZ#mV2Hqw#G!B43+Xi(Gl0q^_ZDDeORm}a zRAwu2C(uXUwz)*R!>ZkSb8G#^2&#OAP+b5Y`wBSaH#>AdSYOQxg*(}#RgdPrsA!GGdmV$U%yeCh00l7W*17c4q{YoB7V)PawL z2=qTlnkC2fW&utxWARYo_2Pv@Bj>2!cErw6tz&1zN7`x80hb8+zfsK5MJN|ChX09r z;Kz5kO1WStklm7_Wt4x>C&)c@3Dumsrktl3FI!(rQlKiH!XXM+@=p35^uTl`mVa)k zv+7DlFO4G~ax~y#UoxKMZqlla(I^gtxRkdiIFrjNv%eJ2)|zb?#EL^nARW}02FDQZ zJX1J1Od+Lr*;zz;i3WU0q&Mw*`PsNYTV3dDjUaP}#hA={1wKuR6Cc3QNC^L#*g!DE z7gg<)w;c}04!Tul(GFw`k3;F*C4W>~t>VewrZESGz5_#!lQ&u-DPKt?7g!H4GU8ic z0;!)EU5J06t4K#>uB;ceJ+#~Tj=C9gobReASlwBH##4-^`0v6!5|wh@F<#i`8NBuW zZ$4NvIi#5@1r!M30B+DMku&D=u{%yYzi-g22ijRupdIAEe>!4yY1{tWs()-*D+;gL zhBWHtr;wtmo$cbQ9lKT2=imR(BW|ddmtRrJ>kO#DnkK7L7z(hq{u4C%50QSxg2BuLi(2{+gn{n$^G0|v6Yg|y7eGugIaO~=1tsaK0o#W)Iuo`1_R<4MB_is`F_%@nEh`dwVnBjTUhCFEch3Qnk_uj;wQ1Lv6MJKlF8Rh2$0ts5VwI``>go*`#%wkupVIgGQa}&< z{=z3Ow!n*|?u$Q?eN;)S)*MXjF(o7S!MZ}kG62;V=`p6jHHKCOCw~h9Fzh1_(&Vfq zBECh&j8BtNs&x4RHD@HI`a(;X+(WSlntsoH>X+T=(FGzxxvi_E&51ABcGMtgx=WiF z*xq^dI#F8<;^}}~*mrSDjgIQDUePqY)S!%zT2ECANzNFTwKbL~T~xaEg~81DEacR$ zjPG+{(N1gs>uO=SK7anJ>tShk*P7VBr6!i)_phys+2W^6AuD{Z(8@C9o<=oG>GSzDb3Yr`|y-Kr1)U-u`R%>f(b!`E4O_25>x|(e3w+WI5SE=u5<>2Lx z9+K5RYeFxaUx;QiJ)%gRMOJhvX;9vbGtu2l$0+(UMl6j`p??nSdSGXF?+ojAUKEQL z-D%E+IBD1bQFr9<6z43La|NbHrco?!vTOW0N|#My(SZ!2MKtqB3YNFet~pVDsq(xd z3djukDKXUT)ajIjdAZfnhsT<4wMGD7;al_K8NefeJ_&ZmGN^$Jynn#Vnk$f(XNTd~Iyn1$uSurq z(kIfN2XX)@N}@Q}1N?%eQ617V5LrbXG3c{viaDYfs^cRPA`MnjTSj3b#8<G>fdJp4P|P}``(pVkqJLzF8XW>Pz2$Bia*{?IjfA5b>pZi7 znC4r$Okcbxk2@1$j$v?w0ywk1&g61td!lXc3Kdg%`z0^MyAi}eOwrYZA~qp`-virS zd1xrP+kV|@nO+p}(dW#~(djluXRivIgp`Y+v->#M$Y^fT#c`kpO>vQ2y9 zSMdc?t>9=P?>i%TdhQ_xC{#5jP>FUWFki@XYE^C^Asou8EcIQG4Vv4OqNcttAO&D@ z2S9>El;aWhAeXwi{nOm)RmN!v@-Y1@uYX`@byw8-S^umo|0|m1>->sl<<$>gTZOC%nWBnGt>SgQvmG_YbCQ`tOU`NBQ{^eXXeJyt(xs$7 z;*EWg6=u43iEhoE&{NE~3^);_K(dl~ia5m{6XKjut{k%UyNVlMc}3cCFfDT+&3|s2 zTWS*%QMu1Vu@vLXqfk_PA=vFjX%X#s`_uN1`>H_EO;O`8sxxtqWu zaw+S9se+<3J@L&roC{g1184z-xAETw+g+_iXyMRLdT<#l1!ahgGf%4AF6ok^sx|V- zsl4;+5sC=wq?C5d>ikna!8cv+~U->X#FAyeRd_)ETMb;BWB!mm;o9G zLg$K9@1PGOuI3vj>OzgeXYd9ACb(N&nPi+otW`$|%4qoJB4|1%4Hu;m%S8E% z4HE`P@ZvA=7+DcMPT@E$B()>j1JU@}x?Xu5!0~4d|4sYz=QPw`yEHUk8-KXq{@&5E zv3(CZ;MHEY3;qji+f9vx#OyXqgTex5nsbYx15MZ>p)M$kmu&DXT^$A5(fHa=f^(=>0Q?yv!5!_v z@#*p574TgjN>d&<7)Y{jfy0BrG5GD5<8uK(Uwd;WkR`yblRz~aNq_Y%@Z#{|{QUUv z>cu9w%2l=yxn}sER<%uVd^$J=U2uGUBrp(PuZJ^^82I_};;aG)kVgwt1~-(rhlC5( z*?3`QeD}o`NPcXKABMOuHroj;rdfJf7EbGpcw#24sO{5(x5uaL+{cU*YTK%)!MB}h zAnjvSGw%-GzdNpPW`BVHS!hO(K*DVsb*v`pi3}`~ySQH>DWv0Nd6JJh#D$ByA)_)XhEF|@Y5#8^CIiR=$ zui1l_@50OX;Z-~FioG}hMccr)f}5DJa=J>ptD^i2PNi*GnaC~kvCLRfb<;`gmSp`S zSxqVtUpw6XH}@3tKgbJ>(ESG^;fmUrlmF%Q-s^n+uiftc&N~0YQ#_wr0JNX0F>m)k zTOW&w(RVZ_5Pv%Es6U^zw?uJ1i;yU*GH$7N5f$50juC73z-KwV+r?0M$u|oMlOfS1 z6!jkSKz=xoK@nqyX!>zP=(KG~sQayaQzj?lp9O&NDvQz^B{93c*Iz~+l9tr}KMfgvFQf?@*^sfGNg`YSs;0_ynm8}BlA`lV~%}df~Df5^5~`k%V&Gk z692z{^bL!hDN65~Sm*rW>UiMtPkc3P)a(D--Pa}h|K6*${{Ixu%a=O48yLzf;L_FT zZh`}p?yv!7V2E@MH|3-D@@1=K$2e3Mnw7^7^1&^J%0nx21Yw=7ijVs6K_xb^LMI)a zD}OtzaupJreH^NjB<eh)}B_pmC@NK!3?L(7za5y}LXfTpt{rot$6y4+ewZE-sJW zJm0v9hsfiB1gYbJJ5K6;Rn_@Qu3^csgXSHF0I^dQ3-6ouXV-@uT4(r4RKFxP`h6RG zks+Y=UIWMRkw<*AnIT~%0jhAa=qb;!s>$;$5vG+Vbntrf;vC%~`l1<)9Cgf9Nh|r)kjX*e?VEQ0T{<>} z;c5dttzhVb4I=?EPK8DWY=R9j_sYv;oI^LYxNsbG9K67hv!c}-Y2*hf>jKBo0|6Wd zMC{K1IF1Zr+xQsRc`vD|u`gP0WPceS|+>3;xW?Z+W?4G}nfpah6SIpY)2&1Zmd6t#eYVa>6Qy+n6)smv4eg z+u>FVvzhghenDVzZg zZxDcBgzmr;hcQR2JjUTk-+%b1o5aFyvJd-By2|VL@;p|vy9Zum*6draArIX(=86}Y z$ul^<{BUwuGJhI3-CXQDX}Qmz#X>~oUVQ_HKKcaAbhDlMT&%B-bT{P)yW&53MBDdf z5;o@WWf?prlHu_N`;Bj(_Y)7zIdayph3K3!BJ>VYzZq|^Td&iYKY!-awAX;_|M4U& zvAwhJcHOSK{S6Isb7dyClPe+8Eex;^Ia1h&nogm(9?LsOLmZBoOI5tAD>zR1NvX(5 z-RFk*9~68{!edGaWuW(_0Qfd3!`$0ERgz(3ZLr~EkAt?_oV2Y`ui~~%@k#oKw88Vu z>aNM~;LMGqF@-)#n}2lCG~%9ZJ&AUr_}y;JwZW)D06uf zte}m0```ZV{!YREx4++A+y9>8`TV)_65QfxPhLA5;Q)yx=FL=)#haiWc-gtXZ;4W^ z<4=(eH>=EZ+Jdi~a9X;Yqn+q;lUz-3CoLjFdn!M8xiqDFGk+_=IrsuNjYALYy^??8 z=|INv25lz=CPb!|6rGnXoghxxEt4!0w}>*CNrkDPi^G{^-IN=*c^!~N(?%nTLp}oS zADHul5W{vy)ZZU;lV7A4v{-lBe{F;Ib$f|U{hGMFr6Et1-JlX{_1QJW6=WDiZq|iP z`51~-xl}f%T7N)mf`X~bCLKwLnkt%5vQDu*914s))n-OFDKD=>u{y(9wuVW#TS_i< zo59?@BB3^0s~wz)hv`}uG*trVTQ6H;9&IfE4=3-Uq$>9MQl5G<0QL2g-1V;{{P%n5 zV%sV~ibuh%v2V*0bg%)El{7}F_8_*zE+;OZAoVJ{Zhzk2SCX#Sgp=6Kr6MMz&k0M; z{ef$42qgP6QIJQ0`Qqx9fdxnFVudOjy3QBC$=~2K*etKDbg)X<0u%WqvnPN*V;JBO zMm~U1q!P!renV=K%ko@Ibulj(7$Oe}retJ_fHkevc?U*;&*T*w8LU7>hm{7P4K1@m%(y_on%>Vd0sOLqW;TqXgH?+l3L#F9sQCs@+9oe%0S*n)8?{6TCXY zR(DP0NR~}%9fnz3z0HJ{KQ9U4<&#>0Y>xvngnz-jIh}1G88vggZs*51hUitR>M?rj}|xQkJp|V_3Jo65c3j;SErkK(lY%Qg+Jz zYGs;Moyt_xU!o^M1dr6|%7)y1XTWUA@yL^*KsE~nzs5fY4D@Y&{ zTEu#7hY7T`Da~R!&|n6V3|eB1n_Vp#KLG9!9#41=Y}XCoMC^1b2C&iiP2}F^F@MKz zlI*Tb>Y?VtX9wQ9LUfv>7WfXvux8XAFks18Nq;-gRMc!K4fc6&H zM43wf+gg6REp}(-!}0<$rG=PcW`7z4b}*@QZrD+qB*_a#>$1(i*+p)GFCfIBFA(1D zW+zX^H%l#)N$)oEMH6+dXckB+^?+3LQW6!Kv!tyR(;*{F#3a|qmz)%R0e{AXTU%*P zA`+1C>{lU!vUr)Cs0#}B)v;vbnTMI85gOay?NX-N4vaz)JThR)MB_=v-6j!JM6oNN#v7;BMw) z$%fY{-|-fz*+Z3W@lAcDnng)%dP{1VEd%;fT0b&HHgg*l!+OOuWq)t~z1_|)xDD${ zUai2avNu_F`b{0K0yreG$$zb^&shP7<2oyA?YV4Wt9wZZuVb82X!a0D=eX3jz{Esp z1Iw(U-Qza$Hk2=bqA~jPGY);wcIe;#?*H}q7dC-AyL-L1+S~nhaCv@m{w~SNBzg~g z#F5954>rWiw#+xmRX{d#f4`Xo4NBuRV(DzoI3?j&<`NLyRN3k|0e|q8V82Lh2C!I9 zB1-&NIz`*rz}(hfaX2DL2mzmX%+*xLW<+G23AuAP>B!9U^5n$PtvI3;$0}Jktgl$( zR<^u7jbf}?T7h0{X?d$ti>>vznO3aN_j9q1^;OcuYd{*@Wrjmvg^`8+yvvsoU^xRzNXa-4N7t4Z>AAd!&e&JerGk>TzXqLQXeakVbwhils zFW`oEf3h*rOe-+hiz&mEq<#*I@>!CHVbQWZWL6KE4@~mUY4)cX^LH9Vt<56ti!R1G8(3_Lzz2+)4;6N z(^-LO+m0G{1dSO!rMA<3kS1n`keh8RREl zI*GJpJ5lwV8vU{au-IP|=5)%#ZZgo7^37Gxo(_!>L&aAE>(7=J%toQe`q;h z&zX_anSW!KO;lO?&-I*n+BuU`*9*{rlkJ`kYioaCW>bJ6vV_r6Nw5({@QrHqEUVyjs|iAl|d9>DZ`lf<5U{+oOV`3$bTAf6d`&D8Tz?U)!tZJjyAbAGBT?QTDr}u zDzO3N7kO{1!b=GJgWynlzgI#jorCWXPd%FDO=fK=S0gxgkd>%(viw~3;EN3CS~Aj^rTz`r0O|s%g-n)1tPgMOl{PPy zllA*nj9+@@s;WqcpwbA>zzEaS(NJb!mG||bN%x?+i%?xst4VSSiDfznKuAKzB!_6g za=)UP;0rPEHpiv5d5iJ3vwXPIE`M%1=W=4Ey@Z!;6c6g|i}r1Q+gn7LSR|z#PXE-U zvRq~tU6DRlwlM;hCWl9*ikIln8{?EzwRUG1M)0hjbY&cJ5P!k}7HZ-s4%Nw#j56$D z9|`qeTDVQ>51xx9%RH#PDWK7J(rfU+R3S|`s(@IT3R3}1!BI(YEu?4sxigm2{)^c zjM{F~Z!sRopE)F+Dvjp)e0Y{zRdo7LHANTT&wL|Q#!HJI(w(R^97bwyLphg+ zItSE>rJdbcw6wr0^#u5ixuvpCb2z4gBcj|Sx7netT;*6_O(==S6Ci_{h+RhrRA3XK z=PO?~Wv5OZmh=g*%Iw_e7}$h3QHQ_}KLbm)tOluW_kl;p35MH`h2i#Uj+-AEe5N=e zMG}-8JYVMh*7E0Q*?+h_r8`Awi6SGbG*I{KnchB9X)@Uo6GC}nD$c_k+>!8wkUo^$ zDNc1|yJqw5m_$;U_WDpBEEu6!IcevSG;3Tc1SnFrMRgdEqk=ufVd$6CFBqmz*n5RX z*7zWC)HLnA0qwtsCKS~G9A92uT=u|>#A-U~oV7Y=vB_hZOn+Z%j;r%UeS!Z6)-GFF zGEEmdP-%{kfB?e-9HxLp@L zLEbJACF{c>EJ7&8AxEP)V5ljj>>5u=D&6(3K_nf=u_1v>=?dZ`!R2&t$m&lPgrro1 zBF26E>o9D2!#_Q^VI7Sahhz8VM|qE_5igWg%QD8AYJba6?IF|Y^6kN4nuERJtfE8c zEg*09A51#cV9Y0k;(w~$$|5AJtG+r?9$p?bC7?(B1?cy1)`JmF*?u9?Rn%-wH70Y$ z$Us>W9n9$$6ikxzKal15sBp`8f2{rUdB4S;f@i79ehR};)MTA0~w%dk}P#@U&S z!Hh%3Wy*_@jvHHv1Gv9WLTgFLLRGd+BX(IFg8zKwz7q2^4!FKNCNoIU5%knmpb?2f zzioCpFJE5i?a`FnB3~)+(iKT%W`4oI6o+^khks?G@$zLu^&^gCcySBY3@=-hX@B0h z{k`k_^vCAQ-~aFZA209kpSQtAhCKE?KI>>zvd?^OTQJt6Wh;5=NRQuEG`2d*L=;aU zot4B>TRy_sa|6t-y)i!^+2;HJZgbMz6wlgaTPZ?q-QR`*FUx~j*#MV~p;i^z%DNP2 zg?~`18^KJ7vw4x$Dg&+Mf~%DTuv!p%lWVMDFLd!0^(F)D!M#em05**L#vx7uSt6=4 z#W_)$A5YcVtnG9msosjZUjg^QglG_VZ7!$w^MTHqMrx}I)TX*uKKgTrQXjRgk}4Lb zn;y!nz==hzUh3*U-R#}6a+6f~v7Y`bxqmfQZLDfmKfgaJoMalo%mWUDk=^38H}pp%iGA?H4o29 z=TEjw0=&#zkYVA9dS$GfGi79Iu8OG*v7`yuNB#q-Wq`)sbT!EU8gUq9I6@$Q3rf6d{?>}rV6gBPfE}yjhO&D)5!$qq*J#qGCMwK z`$O^JO+`hkQFZevb1Y8*)Ee)FAXdkL$2_}+*?oHmCpWbBW~csD6__%AwD5~ zMru90m540IYjCm zAo7j@L!3*V91$w(F2Hux9AW7*wnUP+8IiP+#7s2NX6#Zi4K_EcKQlyc5#3agc2fj< zN%yyaRZgmUe3Zs|S*#cHMNyQ3`aiMEC z1cdsCN|qMiI01Kr-qZ|6HdwkE2NHTH;$q(tU{A&(Q?Lcn=`&0+E272;n#C{qM#e#NsPz#VT!2) zq%vQ!w8ULPk`Sa}n{!)+WW(?!QEjReYEhhZet%$94r+Bhy+O0)z0JfID(~>G8s2i9 z{uRw0zu$)kiwyEXc9@&vRI>+M4BgAqhNxbimYTLC0yHSJzGPQQAeBwBMe~2#8^k34 zdty?RAvGVIW4u29dv|C1)m|?D``*sp>vjJ3r+AcOwcMn96Bg~w?Almv*WOeavyF<= z1An*Mts5Nrz0{o9nj#K;$f3-$XOc;#MwlwoB)GrNo?EnZt}uDg_H#)9;X$$vraX-lvUZFYlZTUIDD<3BA)+6cT1ZTMWp zpkg7sL7sAVc%vd@>dfUi(_YrfH-9qK(9JHl5Y37wNs3%4Kt-y$8c8#+3q3P`eQoKs ze&#);>woS9*Lk2mFlYVWezm`!UH^BsU%h&@UjLusu{Nqz3V;}W*YCWnUfho@SCcO~ zLIxv5B3;N&oTK{{Jr-Ar2$R}Ii z`EbUSOG*;PU1so5-@*O8MDDq19&!EQ3mERbMxkdX125O;<|~sbJ1&2}v$p>~$y0Jr zZSHjEy(-OnFJ_!f&$I*agGF|^gRvG5Yav~=Wd}fwgYmnTQ&f>wi<;VDE0?2Rn;X~9 zQ$MxxpWS+^FaXSx|GWF!`ThUy-p*S7KgE+1k9pZ&CEW+=2J%DHaoyBPguE@j8_WFi z=AKB<>q}YXqT1Z=wz_{+1lMG#U=i{JLHI1v#VT471wcMn@&@{|zC!zyK>sZaVCW%g zZT<3v1FP6cU$5+$ceTisRnHJphE3~9sydntC!9wXi>ZL_l=r|-+duB>7b*sFU%t+j zXDC1(Cv*-|P9gUur}FPoz65}h0QGvsC!6<~j!|Ih3FoxJ|P^J;DX zeUc|9Dzje1)+(UH{<-}*vochv^wn<3Qo~<<{a9}fY9)R|{DCFI0I)<=uX6F5C)V~9 zB05B~g7XX<1Od4NI2@8Vl$Y8=r1IrziEN4I^hGtxSeN3ggm5aFK{=m7fxz)6ne#bF z>y0RxW}D5?#5{im+N4i&r?CK|koRr}~MSOx{2AD@-gy!&PqA7fJ zBi$oDrR#t3&dsCR|BB~7-R<@H@6$ZFDP&z|%WeI#x1fLP?qs>CzR(w^!fW2o(uPrndBLBsuczY1eUdX-JDGuXL z)!*YN3ebNPg&YR&D2XGMDS8$&E{iL)<#ALZ?Hw@1VGnG#(lzZ<5A5ykzS?a8Fk%wk zs=$eb>>>n0rHS#p>TivT7hS1OU;68%_(=QT5FmhmL^M3 zdU0CYIyA0ZCcdXdO)XbVNh8FMMt^Kcc4y8xqT-I{>4rkWQRSlmY#6$3g69^pKYkMj z@=yGf%73x%TFuoz`OK65J3D##zq_-yy_Ww^@#JKO6^nD)$17G8(OIeUG8~ zE2)20>{@mcC&VR;u-1&h?^fuB_8&TJtxi}azUKFK7@1%$x7Pq&JE=lbFXr_^ z((Eaf|H>-JR<#9~YyW?p_y5}6-(Qn{KYf3_THpV8lE-%UtWdv_XoQ(7d?h+s-2#!( z5bcHH;c|cBrRHC6p;%tyt(*V)2%3MtNr!<|4E)D&i^!boN4Y@?)-0% z0aC6y&fhYYP3HyQ5ys=MNI!lpeaKPPN*k)RSn1uoy^$ztLOgF;_k>rD;|qcU6% z|K@a;nc;73$5QjA3GWnZ7o04cp`m;hukaL+n5UI9ubUuL0jGS;De)mL+WO1ar0gY% zRXQNA?K`V`%GZAmIU2w+a^g@r;X5ew<(823beQ-B z6N#%V--kiWIHD*0me6SQ-#u_nLP3OQ;5P*BV8{Us0uT|O2^t8JTKVh67){`kkE;>vngfM;htuMq{6Db8Oflk8O)e|`0Oz5YMNQ#fQSMt;{?<8zb9*IE{PZ-7T& zfS89e=aeRJvzv&1t5ULAFZt%=8oQcBsCg?gL3kd#e3^%PN}&H11~Bx*!qB{hAX_ir zR_=3Ms{^?ux)fWl1?U)5L8!wdQ!tNHvQjojB3V!it)^e{&72b-$=n2uTM12#e|#g! z2hql3>8}E%mFTWHBS14%_A6?y8o{#Jz6fd=%*udO>|D!GT3r46{5dN@?4H5UuMz_r z=+A7uwq2mDZ2;Lxo@p!xuadd~hq;Z-l^O+X?61oi8|JpTz_8W!H4!^jM^jNG>sxxe zMdDncOpA*twJXwUErU=&*d-8*f6U5srC2P}o0X``($q!*)RTLIg88RX|67sjC!cxx z-`;LFr~mD4Z||-3zo&Q>(d?4@3Xi4KjngsNO!(@&wr<=bDm0+(;#tLkoR zwQa4ot<|=FS+(uoOKa1T_0i0pmj35XP%y>gkWjSRHs4hO);f0VV{G3FilUxj|l9sZMc!`K)OzU-;Z5tM%coK6<^R`u20lQFNzA~>(J^be5hedX9&fqWN3f&HQSy)P z@od7H|G!3D&|vj#%$xtO_VefeJNvu)>-ql_kFA5>MBMe!ZRd7df1cDDja>6ZiAHX% zsBy$NMR1xbb7Ra~K>Sy&?4Haf*#q7V^tShQ;qLxV@W)Yi&qqGm8Sah5Kcm;k+Zm1! zeErj|S_4r;dSxfi=8}dtf#zz4kEvXEXQcrMG`LX@sHCso<6M1=$D03_#|KAe$L`c$ zbsM$w|MlzrSKE7qfBFCF)q4Iv#q-R#DGdJmwAK1O{qe_!nRa(~cXo6ELdTs=AYEGk z8H#n#QA<7vVUR{In8FZ_Wgv3EW{jgL*tobndV4n5R0}=~0h&e=$S?yW1oCrU`PmOoWh6!2ueq-r1$z?M_<24+uH;_ ziUKl|qeVgie=_y|Q6PJrPR4O()9mv=%!HE2CkXuh3ks$w2BN<%n`{~dQnLhgTdlX6 zZi-&OgCQ6q5Hq6<%I0Adu@u^kej|Id2}Xq4NDGFsIF5{fzy%yC_&7A!G8b4>oInPK z2!((n##J1SJ3?<14(IPq&i@CTgn~qDOWrVWbPu+`e<+Ai$bH#vpOPu!6BJ8E<|Hz1 zK)=8JwSSrIK}3n~V$#`k<@oj~k~b9?=7_agj^%a*w%zTWzqTCJkyq}v+if|Z{{cjl z++wj{BWg5p3NIN%_2y-bWP0>Aemg;OL3 z`;U!hQSxIGFqMA;1ekFq!K7aSpFnOH(LhB$@MEgTDZ8ecX|?_fynK0uqn9sx;1o0E zMy9*W^n~~*Ng|q3Q~7;}%jho#AU2;mJ_-<5f6je2wJlCBCA_Yd)+iF0%De*%n1QxQ zOQsPCQOKF}6YPIDe8B)@jCdGwGb2;xP(v2Tsuqv9vMW{x%Hh;8k(eMJ4-Am#)&ovL z*Ejjzi7_}Q9Em|V5;Y8ARm0LF(m+Z*@x=NBAOm+O2wc$DT#A4PV=i}i+Ck4Ja@e_^ zf2RqbD5{P~5Rg0BARGpWSuB-sw7!6kI<%OK;#xw>VxkZ#>A2IN;r1Ivf z`n!Hs`aC-Oyw~x=%Gt+67pq{Or1F}5zRl;6*vDK8R@eMLW?MWL{6a>+6f%JZI1%h5 z?F|-(nYbD(!(zDx*6j6lo=2BHCICyh^nv~qhY5#N$e;wonn}L3=aJY)yN~nWS=BVyHZG4 zIn?~dJ=wBr4M_TN0w@psAf<4z=7GMi!u5kF4gx)<(%DNL zDj;9pPB&t}W*;3vbt--}mzcd{oW_E+)$`QHFgY!Z0Uu7^sAOq~&M*e232$@UiGHumB%f?8D)> zNyQTO;c&f1eV@-4@bUB2!8@4^=6(tBW3f+~wrEl5BekqZWjtCx-_!F2e|$U{ofF=t zh@r4xq?uno%RaSxF4N*br+qppYUu0d`+AJ(yzJJ?Vjmw3;|9xD%074mWF7501lWYc zGGrWJXjuo6_4B097w~Ze1M5J1(fWdYgz9^t4SsV0eE|b5of|m;5u_Z$AeaGTF9fAG ztkbKP%845=1!6q5|Ji%{=C*O9Uv&Q+eF|LXsT(_M(Jy%&-urIVd-~xr*RD1nOqMpcDN4}Rt z^uX=5H?V)$T{GgaZQpQl-Egcgrdl?zdH5_bCQi{=88@bMy9AZSqPQ7Ui|KGNd@78I z>%*t9C_Z@dOos_&e>5WfF9Xq1_*5Db*N0DIQGD>E;R69?x7@v!!l%-hxITOui{gW) zDe86N8$4NR?ORs98a}hv;6LekZ+r(y;0ye?hmlS7WE05S{6i7KvQ2Z**(;Wku)cw4 z=r%M(y?@{4z#=cd9(+9YXNvT{=q8@7wIbZxFE+QOOQTa5HI1In;QFREy#sM>t((>X~_?wfmf(bT0BF1`TZ_)d-)(@i{YZ zTq9TqpjCwFe>C(!sTQjt-;eh8MqH|o zN18qTzSqZ+MC{{#f5b`&+RqgE{o{Xslp#;y!+^$$h~Izz{r9`<#SMKK)dwF*#CRS3 ze~Qj7+-+c53TBoUY517^3@Qq4-K2)T9@Ph*v?8vnfBKD(JeXxkp9q)e$it1^!$Qs& z31K^H=pj>$+$S87WDOZ=itN>dP)zom$fFU|ZFtURQGM`H@p`7m0zL;hbgs_3h_Fyh zn!Hh)MKx|-kc)dQ?o+soIcG0(l`Vvwf-Gb#hg>8sA=}AYutifA-MXm_)lW5UUfJM_ z;e*o#e?1#bb!uK%griSdtzO}8*m0V-h6G$KfbbAgCe;jztU7OMzI78Dx<{%VKgIyF zq{1oWhqah6Pdgb1xQ@yBX@37RFdUqz5n;-uR%qzqP<`;}V@XcluCsexa<1HdM22M^ zQZf7?$(n??1)=TkbHP^{{W?s&e;Y8oVM zAk_k&io5!kotfGrcdyi~U*FKTrCN^MefVT@#mQGiim`?^mF(nyS~=^B%Fn`Q<@U8K zLtR4~Mh-q}2rbp+XW=6Vjx0W^Pcf$GtvxOsz%}-66O+YSL7SO0*M`b2t*$zZ1L+*nS9+MKd{L0Z=uE-HO zhFj%PpP->2SeZy?wuBir2m1FzwRp_?f3v39gZ=y#SNU;Fk-Y&Od5^+bMS$K*GRR_3 z>v1&3EF@7$O_M|^%7)D*_fTkxddcLIH<4e6C4kSm-p=-ox4fSquxB3d>Szwr|R-$_{`m&%p;p zRGORHrOk`N^A<2z46_7o?Qdv9 z=w9IS8;%zXKqdIZ+!~a@e}PP3CUFRV$Gk~Uw*gc$e9Uf?i6s{7DZ0#&7;Vgj-;(Nq&+yki zUW4)2H$vt*bBvS@KaKi0(15sg6B_zn+v3m?{hdfDeTapwDP?cgTRl{B$FahttSv2p~wPyJ;eBR*C z$0o@N>83*d1THV*XPye{blaQqAzW3e&$5lH!<-i9BP9h%t_5;d6C-fv)qX5Veoh(3^(7 zGTkeDqN-fa^YDq{=EQwN=|16e%(IG{Qs>|k>c{TdkA}Vp)eN7m!ipq>sVkZgo>i%H zQOy{6cG%Z;04ry27)I> z7xV0kaD72T4}ofdPnb!?ldi%-W$A_B{pH?Y3rOcIe;D&&Bin2a)sp5XhtI0>E;I|Dm=D{OA)XR*Qs2O6v#4J9oKP9ALeLz1 zc&20npv|Nj;gb$K`rmV2agB26jT$~>xM-+k(&YlT6(RCj5hj}yb`O|plzj|Cc|+M7 zA|)O!3R|5b`#XRpCSww71j!K=1l>?IDw1Y4^w6nZf6@7zGIFuvj*BU}vY|3Id^JC3 z2RKnikhvz~)@^F&t5Lo1xuOaA7iTLpFZWalH;N`iDx9Q^)7S=4J$4`8&Dr=ozrpE3 zSNZ&jVz2UIcS@Ck@GQ}`$tvayMsi7The>fW?|i+}1P|T=)dC;l#aFCCPc?j84J&Ze zK;VHNvh~rqieuLVq|Cwtq`+3 zJt)+)5X4+G=({hf1wN99F%3zeCh6+ak16_V)+d4yMI`E)l1P`lbsHM`W;8`To2L8h z;?_5#IQXPotPWN!iO#yj?Hb;_fv7~ibMKKxbAPy0EBEnn(dC&4$t7m9o*UrrBZ#zW78V3ydkGUHk(c98 zBgh9(9UX1xKFDTPy(9MtMIQ`A!;yS2~iER4cY!lUJ2f)tquE3h0QD1ctReCgOy4y0{5WL%I)%Sb(gf3yoC z5-O#Zy^D8fk;(YoHmLgQR119k-1F<-%k7o24$l`Kj&IwJhQ0~a4b*xU z%CM?MoUVBc!E>`VXp5zW9z4~)dEqc5QoiBQ;&?9&pAI~R^m7e(HkYQT_wkb8=r=(X zdB;NXg|{@#b07Mz<$`#b`&^PgG9pz2q0OWz>b?4f*2#TV9iPr0okGM;f1|T+BH5$U z+n1l?J|qUAcuA&>u6@K@d!oWoNrf*ocw|&~w5>)|uGHQeqv1E8THq7%B;l;Hj@!m8 z_fZ`63Br-RLnB4JVMwOMJbdGf6$qCYT;ht9)iOPc&cNM?SVVVBh-_8pp2*U2+zcS+)>Y* z>nu}rd50HwmMPl4-yToh4>fd_@raarTH&Ew*;!q3c51;vr{3PyIkOd=y(W{H$`^Mw z#(ff_YceTz*Y$e3erxZyvu31wU(i`oBJc0IQ@d_w?{aN!sk22Bf0n+`jmNA;<}F}} zu#|LY?#!)^?&wE1H?!T*AY7K#a1^;*Xi{NC23f3G@^)dicSF%gXAg&JmD9{>Ul|!|@nd;I1D#E#+U5L} zy5buA2Uu-`o=u>-fAMp^k_9d2KMiy?i|WOXpj=Qjfn(c6?%GpyVIQ-{yNaVsnu9um z!x5N(=I_#vN_z-NrAV-sCpb(4#U5TTHmD7Fr^`O^(E+BCYO6`=w@=4j*% z&scSis}g?fSuQvwHR#zux-a~!$cJCXPlKF|rCRYLX+%O?f3<0q-q?vEjTVQY^7du% zbNd!G^fjqo{H&8?W@=7eq>Tu{D58S_5rnC7oV6dN*3d(xTIJ`p(u6F*Po5;C!Oo`8 zz2GNYmhWf@e)4h+fHsBd#7{?d6=u;-lcgb!Q}o-2m`Hq%%!4S*gb$#{vWTyiNa{-a z6WHB|FqUf*f68wkM_eGrzvQ64p}MG+8-eEVW54*7%gT$yM+E7gG!$&uJ!D;Un4t`$ z=n_U6a6C-9AO2&%09j_<_3H|*Q4kG&z5}WSKZ4-s(f~oObe1gnTtVs&&f<;ol$`7C zGIz;k-Q5gd$x?S$IZQ6-?gn{FuIg^dWpY_}H^X0Ye^qx&PLr#<`_MfmOWj@NHo4ei zvb2yNu+QY&>@IVhT(-)yQ{njzs!-ad?4Y!s5zB*I8=)}MhQiEtk2?`5-#5F zy&(w~lRPj82^0D%_hOn*B@uTQ(Cby@*DnL~8;xT$z;WEi;k8Cy&oEK{)pVdWbQF;R zWh82Zf9dVf710Tf7W$fSsMgx4&5J$7J0RU^`258i+S}E$ ze+z%@S6=)xTi#s08D?hTRq$kaYL|DggK56w3W9!5J}aA0ma;I;B5-bMQ|Vl# zp+HK)I=kP{-Kdr$vsw78xc1K8TQ-NChBl7sxixVHJ_GrS;90r|KJX(tJIPb$HBm3r5Q}+A?@Tu0{?dG)vKMidN)v|dl zgpbHrN4}Rtl)|L+7yjN=;HaSuqgpmEYj*C0AlUadFz+DbpsmumQ)M(DZ>ZHF~2$etcYN^ z0+>^D!r5a5c4jIF3S&x`vH`VP911yOBsAe14LxkCMRcCwKA+Q=hE(Z2N~Sm@vJ}NT zMIH3ltWN|Zibw>p9sWglu6R5_f9483#PW*JK=1_JjA%GQlnn)u5-EWP0~(@`XK@7b zk&V4?=>Dl5tFyvFW$A_B{p!Q^@*AD#?3KEG1Lmu*LzweBL>W~S$0sDlld5CjDT1F+ zpA5JlD5hh=G_F(V7+9=y1?rZFo}#Dwx9rP;4yDUZwBe1v@*BhliZH#Ne^Vj`TqMT8 zTf<~c(ZTaOm7nX7q6y)dTG%7-^>VMs`1V!fy6pk~NH z^-_Lehis|UJ+coDvbfwUf78=IcjzwtF&%OXdo4DXbGcHfJ2j$QeGR*QxkD@1+&y!- zhQ21%vZs{cvtm=Z=RKvNuSvD+4`ukQ*uod=;5=&#Wt&H}$V+ATtPq&)Szc=BYtj_G zxLf&o_^c35?^Qaz+h8>GrBsV9APA1=y2?PV3zSRUsTB={1E1xpSEG4- zM^uaErDD1Ah}nCi)x56GySbl%%+i#LX8YPSs^w%~!zUGFKtva=r#hzTsPfusG@BzJ zlf)!PhH{T3U@C;-f5_BGSV$xi*pwJy8>j-_RgW7_s&7p7BnOCP5E7y2fQDER*(ITv zyK$y?qx15`%y;zFMKnJ0F}K$^o>SQ6&QzEebzM%&}_aQnv z_!M`7_}BB5HZON0ADmTShWZ3$l0-=ISsa1wr%zBsWyr^H_}-uR$ZF^tP%Y8j3*eIn z_0I%Df4@sDc=87jWj5r0AscGwA<}(rUX&>!#>j=wb`b>+J$3MkEcXr zfU{U3SuUeRB4ASueN(zm_?RibGOnw=;*AzQ)~EGL&|`}<;CU!iD|`wa?J|oO1?-eX zXDvB{*+|Y0oN5)FXW(-;(Rmh0jqLmYf2mf{c?LdOQFiM+d7mzQ4xAECie5$E+0e)xTRq*N-8_V&tl$%u#2`)V)7 zib%B=ayFpDOn`}c5646(%7&kys=XcOQg2YUi^35JuhAICncV@wvk@n0-1u(PNwwVY zf9c>u6Fek=AVVsZm@ITw^*nh_-QmQUE{a^y+qb8ouS!$Yi+FfVL_qnik4$IblX9t5 zuWA4-gHPjgxM4I!y*^b8Cv?y4S8aD*xz@F2^YBr4xctO@F?|f@_wPuZE8a)v1j1 znxbw>LOPiEkTG#Ojq<%|-y>&QGl3C?aXhCnQ2CkEFd_qXeHYlZq#A z%wLOheR_5uQzCcOXlTQzUSH?WO5jsA{(u*Sn3^DE{TL!_Oa*5NVG510ptv6sTtKPD zugR<4xIaI1vS!0=GRAQRmN_gDMv5e9j1^gVgU`&F*BY0>Huva#M^v-J#u}HwF1`fT z_f~CaBdBI~vDMe;Exkvt0nmm~E%)d-_^g#(zR4>89Z@Y=<&!OUDt}lFp9Luno7{%q z5!I60(7|V|?DA7|15RKQo}rjt6NG2;%Nxkp(s%1#L-$LyB&S;dpK8^s(Y(GRs#W$` zE4zH7d3{GztLC*hIow{E%5ZXkl<-}d|akw^qa`;^Gm>|p|`0x{Dk=}#01^FYRAmwm@F1iL zE#2K&wdFkD2@Xdn#R4Zpi?o@v8M;xg-Ihe5YchEaai1S|^N+vx5EjD>JXRG)y%C8M zM441Lj(Y+6nF|*jy4z~?dOa;e^O&^$3;9o?WYTs>`$r2Q^S&Zb_5w?J!$tJkIBuu* z&)wpQ6RdC_OMmh@nY1JO8LC2PHje3!SU05Ax*8FL`+Teg`y|m^RDw_Vi1?u-Jy)!U za2WE8Ddb)c9WJ-17kG}~@dQz2184P`$=k(nLL$`jn%WCmt-qkR@2*ad&^s0qlYt@} zVFB4loRj*lu8rPU3~g{R?{Xi!~`RLX2`?mMTPOJ6k z5jyrmzG2jDYs?oBQJBV3Kl%uLv_diZ&_!oSl7A`i6;*iX#hFJul!0w-5b|U%cL9`p zBYx9Xd@o}W5mI3mwS}p$t?OuePwuo@XMk_11ZTr|f&|fPlQ2Ej_5vnaY68*#(DM;x zAvE1{p%2iNUPXjSFbPd~=0gpU3bO1L# zDSs1L60}-BnE^1_JlvdO#K?_>H`Jhqk}6qvNgA}mV`IHkIMZ9RetUu`E1ug$k`5W9 z&u6aH5>`kkD6|`mvzQTq`!uFXqZzIo3d}qnLs$y^mwtaLXoAJWt~adz2WzXyXAI+N zztx>CB?)M?Itm)7c#2{&CNZQ|5^!piSASyV3Y+*XA_L0o0?Xf`msp>x(OiQr&6}lJ zMiC(?5jL=f{tMdR-iQU6d7)RWG2zVgRqJ}XgApCmDATiTk%Hrx-vCfF*!Y+TK_lX` z1nV)McYC(0k{fLFtAzbLVwE?9u^#Nl=TA}fUo(X*qdkOdzyjm?f8P07b%_Z zI^~_jd*=1ug1-mAg~FvB5BcH#pT26qRN#v%9x`t-V_jFya=hSwlA?Zter|wjN!r-hZE?$na+y zJ7;!gj<(>ndoxYj((?k3YqeGnUPJ{66&G$LLwT1}DbZ4!QC#xILv}CURoyH;s`64W z|C*7w2D?e}uwpI(oR=>gP;eBXB2koIvOEf&gyDgq==JGm1$&_0wmoDRRV<>Ra#CA} z6A~X|Np=wlh5`EbmK_39s0p+?%N*5WZ| zM9YzqD3y<1sYG6DXs^T!g)XTbgjTPZ1S8 z+Z50MVCOM=d2JK4WPg!=0gR2k<;%fLJO*$}EYINB!uZU125ALpcCKZtrp zvLh2G#A#hFOPn<$1{*5Oj20ulnuB@>{HgT;TtB(rj5yrwp{LsyUDfahBXpt#FEIcNeS0@Xt}l* z$Wd=s|MN%O1Aop7AA{k)dUkP{lN~*3_TFhT+gIn^R_p4#n_ok1G3DGeom3A9?dQBa zAAS|fpy$gB#tH$3CUec2)jf?oKH$3jp!F3+y!3&V85!|E6+9&(p4i5~3;m}0Z98hU z+U480kNnHFZIJ+-7@le_BQUmZSFqwD-J{!InX6&vIDfbd{CDIx)*UUl&~Q;f|DMgG zh1Y4$ly7+g`%$a)1pQ2fRJ$&XtkHm>Ke?SfB*n$Qz>JPsV7&CqM*7d|tWQD}yP9k* zL&AulVQDPdDwb{gd%LYSytc0Qb+D(O3PMr&weHl+*H}O6+M+viH6m;`UqV&rs&2cn z{ap}|P=5)l$ie2d5}A3#!&3Rnd7Ql7TF~3AQXw~a=5gJX^6%dK+DER*WUJ_|{_q#W z%`~RM7P!%?BV+8;PyEFf7=x zSlD(g1L@68J6uI#jB<#KiI}L7ZiE&oLBS-SQxYl?IVMUY5@I292^lOEzFOr;l3Iz$ z7%VHxslb4ja@eT7Y1#($2s6JP7pTkyiurJ;8|8H5onr5ZxRwRR6dPtNZS#7Tk@}lp zmwzT{Jh7H9E9T^((Krmb8Gb7ed-v6qGcp8VJ)YnsZao59z>F4ZO)4$>?@BG z%_5LO(Kc+oKOVe#x#LcMbj?zWpT=lGi)B+7AYDCLSP6L?o1a1V@dV-PSJD|7t$ZS( zN$`m#G{zu-8s$g}V*Nry`DiyeKU1~MrC-uKa7`_nFj8FcuyM(6Ia?BZ6vKqD#yG9qXBXEK$!pMd{6C zzJ+-Jogh|jWUO@!m3mP*5;uZpL^2ZRhOSSp_#>kmw;8!<+g7*76t{8P3@~idJ0{Np z2YU^i+*scE-f-?=%=pb;L=ZtzMFW4$J+ zRz_J!bya$KRGuvVxm}_^S3fnKJ&vv{{%3^DJQz>EKUdZ}T~=@9J4z4b6&9~tQDVuL z552^=szk+?S0xt7-;j+cd5CN*DCDiM(Jp>$gLPf$7Xwhkv% z<;QZeGn3>kj_1r{~8C%uqLYvOCv0XMbYOy*%K=I*#4Z zdAVz6x4S z68d;1QZ10gjIII zLj%gF99eA|y(LOdwo#4X5ZtQi%>3ZO7{GHlM{&-A&`0c^1Qs7>L(l}U(rt(d0Bly7 zExi*I+F}Yk`G4KrPoc29mV3^ri-@*WPWB=a##oTHZ9v;J^^u8QZcljD?vo*9I|jX) zqxG2o>LQ3fzZBJ)>b%B|4}$0D|JMJ!@N5}iQCFE@dN(ikXT~;eZJj5CP5fIw@*ALy zW&FsqiW4^AA|(FEf5LJ62@=veMJuoBXvUMw83gSc{C}%P+)>sRBP!?@1&NF~116+8v#ou3;RQO|Zht!_f}o3c-K$?NPrIMqcTX>Oi$70( z^8UE!bi2R3yFBr}I(vI|b@J1v&gC!N`EP&goS&Rs!kAzDa?-i#1gK*V#so<)WncrW zY&y7|8L!dMS@0H3YG7w&;iQ96hqd)ap+~~5T#M@5q6~ai&x^>cPQk6aSZ^j#qdAT; z{(p*wAD67qMzS!5S$iDF%vsp6lQwz*>cA04pD;3@$`qn<=IokE&)H>!f{QY3Jl6skIeJFDFTF!hP98swR?Po?(g7%HDh)U^6r4pFx%?4bV-lc?fM|7a{ zNNZ-2f3XX?jMk+Hg_C}3jD;z7W@~8HK!5%sc$OA+*?0oJl}b!Z&y9U$qGvF)+R;(P zp~k|TnXk8Sruf$Gf}E^|mF+GxvX>u|qr`}SK{!fyRQ}Z%e@r-t^E?G%ehFJRGwkDM z!JRjkbA)>q><9bK^W673H$qD89hWoORm>-7{X`_yV%yBgCL=elaB{$PpY8O5bAamCgsKA0fF%JBkG8Leour$uTyNfE&;-hAgeFGS;w5?v3r3#I(b1>1n zK;QF6x4-=@aNon(GXc?mTkZttXR5UYy*elx zaC;b!`#e)KZOF~W-htBs>u7~w7;+YpRLR-<%A}-2)=qiU*1EvnBlos8W>Fh6MceM1 zouJj~NI3N=^x(2rfaQ&;AbM10lr}A!!BLW}Z`b_gzrqNgx*|8N)Y1A;^oq=zf=nWHuT`Cumf4e9wsp5QO7n4Zq`t}-QowP=-iK7nBR4O zW`6W+4@Szl5~lg~KT3uvqko|Eu^hQL7uQ)Y z&Sl={VPmxx27Y~XqTBy}o=bVZmkL$2`1Qxj(~I-7uIrT|aTwPu&@lEZjt=(q zX54Che8{2uZr#)s(i-FeVz zJ$dpQco^A+-#|zUQxIO{g#(lZ;lH0e(Q4O)b7r$&%Uopk`U{TJIHe!VGe>BA&_mm9 z#`Q4tCnjlW*m-{47Z`SkVA0w)0JW1F|eN-?vXn;UT188%?H1_0-V?(J9pvtFnu8XsDax}#+0 zsZi+n;6>n-jyRF*abbdROA)h)hE&lEi)9j($KKTgtGy^3L9^wuc6%kB=El|BObj9# zciIa)wtqlMty(za!%yR^68`eV>^?i9b%~kHM2zQPi$yl@A{xP8b8%D_g<1g z7NeN5YiTBCp;)6b#RbK&+!I9dcuYW;IfVZ|1w(ebXoz(L^XgltCl!zPV?Nw7PY~la z2qM(@u&ucL_;e3;uSe)7K`@w&Eq8UcDn&$sdVfZ??G=l_2BSC&hjnhU;)#s$nDp#V zzW-1UsgdB>aO60Um53ozhKY8DGX~QJy9?(p_v_YNwfs{3o?ZY}a}QWOvnTgJ5iHzl z!EsuULWR2ca4hpf8ZA>)DxKU0SmYotTzPYu-WXYOSs|An%(3%!`4~2LP>~WMuXA&a zlYhnFYE~+JS+KWrRD`2nz+<`dDn@-AUT3M^-AqKSi)y!NL>(W-Y+`mmE(yY+i=BA~ z^3U9Hp7S-d0qKKV3|W{7V7InovzBt>QG+UExYz%+?ab&yqEPNMJ8w$&XK6$GuYZpApC26@2G4&)XK#OghtTWSf3eonnOQPU7ZwQ- zupeES{x3JbU2*iIQPR#>S?chdH?Y=ZaB8J@kD-GIV9uP%rt@8xmyZ{h=;{99!8#_R zG>hXs{V=$dVuccdZP0{f;Wt=B;Qxmeg?s@MC$SAPEHG1qEL8GyfvThkS%2#qEKe+W z#v;#ax&r<_##U&D18$1|wrh(ajvh{072U ztg#$3q_-J2W81HSzXgBWS(d$H6{m4ky$TNYg9GbL+(z%bw?JwM6RL0a&Z_stvh}v} z=G1ts{h&W~FFMDkKU|)EIDhM&y?gt^`-_v#)#*u7aQtiM@~Zq> z=i&l=IK9;Mc`M`xxBa0XT%N@r4)+iD+xxHD`_It9)1#+99zA~+ynOZa*{l7-S1-_? z_xJbr(fh08A6({|A3WY;hvJ8WgW#23Ck4xJJi_bhEM1;-*m4!msk38 z=a>73R!y~!Yz?n@3e}o7ef2kIrTr@MUP#Mu*b$k_PCs3^D!*u zfqR=9d`}wj-ub1%#S9Cn-UM5|jI(rz*v6EUis#-h?yhV+ z)H+;lW$pQ3@40kpxj6L7h(i~G4CrU)kD#?5qwKkAsMdP9;vtVs$Oeb#DfszJDhhr& zW34b6P0}SyD1W;_UF*pF(BT@$GoNV)71_!$N zohZs3R)G7RpL8zDCxm_(=&~_Co1-5s8O5Ay)!8K$vq^)rdI%k$N}?e+A#7`Qw6j|X zBI5(=*9N?P`y}`0+_9;Ej58;ePziW4Si9?Asg}dIK!3k{_-kM?;y6j`mk)nM#-+pM zwZ=0NVP6n@O@uL%6fPQ%?IAcHpfM#k;4^L|J-uaZStx8-?cd8U>6SUXnzg~i6QENp zVoF5GbZ#xy5sgf`JMVf4JB%S0<_z9um>OY;BxNBn1|$tO5U&&1L19NR(R61FEk6P= zvh%^q!+%!?^JZ-4VC*d^K_t&asKGpEmrv#1_@Dvy`BRvFmZUB>7?IT|ei1wmUe4(xyCskEIEDj?S%oLJ3_z5bje*balD0{o z{H#e(>Y~{5+>ZzQyXe5gBODxR#;9x|# z6mC)O0chO=OaeQ1%w+9hMHj)~dxSnZl-}Ij_#X3I4EMl*yvN9m+&g&nPjquAP8ZYnPMdaoe?aOq-?xEP7ILfrrE#U7Cb|nPHWA zu1j4klV*>AQ(rc88<3ahL95J?C&c*`fU{V6sI^FM$A8|K@f(RDqGHCs&lBfzQ%I|u z^-Xl7O``zqbrN)cf^IYy(r>(t`?;t%vy^Cfx zP2zx%sE@;IRHR!VLjHf=fkUfR*h-!}(F%u{wQ0e|i=I4b^&(<&bC4V-f zqSUdMU(9#3Eu1a9htIh&#gx;?lq-ZB9HzEJON-XMS#PY~Q(eW=wA|KmHBX+*Pp0!B z_`meDu13I~++Oc%X!AuWYt zp8+%m%lY1Hi!4FlL|l=`PwzTLK(O|$+4p~yjC2PF!BcC^b9+Mwg12WOwFh2BludqU z&Ev?okP)Y?cnk-#B2}M@uU0l~WGTSfxHs9znx(wgxW}2}kGi7r&gme{<0}Ki~1%>`ppMhnyw%$Xxl#=P%MChx37Vo!&)Sfv`y@Asz~RHkp4v z5`{$a%`KsPvg{y<;d1hk)hQzJa^G9rAeA|OYga{fFnlf0yuZ|*LeVEo`I(vNY(S$ zl1b1Oz`gr6h<)}@T$UTC7aESn)SiE(IlBZ+5)x6YNIcPE@tccxmsg#)S4SvMMh6RK z&J7^1*E4N1Ps7q>^BhawOw5g59^8iBsSy!3)U7mt!jM>%47P9MORL#H)hSJtmp-IL zNK!S?>JRuL5EY=Vb&0Gj(K$bV_uHq_Hy2lbFU|)i#s-FSD}8}Jqd5ZxowR@2k1@OU zo$_3~ouAAYf+9?8?U=+o)vYLa zJ@w9}0SlJ+1@xfRYEtqCFlm3&wN_={TR0>a2lvI7CXZ9m;pKIe9`vg7zlR$A(Oq6; z`AM(N(hmhgJj_*+oEf+kmow|$e(<;8Z#~o(m}#Y!quv30Q`(@s10{2QClyJJvgDn= zyOg=$0kGZco?d=9J3jsNw)5t+XEcO7)BSeu-T6tu$9CKT_RM&NNNj)3U*s?4c-rKcCEUeHCaj*-^JAy5fwDY7} zoTp&19yfZ53fej_&_kJ-YMqFo+cp^yuZWig}3r zbJ1O!JF^(NVk&$QdAsCPY6Qoe5$qHOUnh;Y0Vs{4J4z^qH5`!y7x9k3vGRK~d_VpH z6;k=E6PTtalf!>d1}la#H}t=Lgd)Myq9vs<{(t=E>`Gk!$xIS~-gi$g=bwPc79@B~ ziU(Y>2s`|be>%H*+j(;ap_Dm-AD5~b3O&kjz%A&Q#$-q!eO+}M_3$lg&Vo|>#)?p0 zS&g(mHS~q#nR7xH7}Uvw&W-!@UEi_4zrX+D*)#Zee}8{}_TT-3r!W3=@NED2{`2Sh zuRrY{ym)qa_$RbqPZyU{rbX~S?ce!bvz^-znw#;X7DCQRcf|Si5!(94Rw_u_iY&W& zUu#?O=O0^JGmp1#2px{p5!z}WY&Glg!BcttTiZ$7OITOKJ65j$=le73|M`oj2hIBb z8uSRA6C-~uy2~$&-NO$s#0njsY2n!1ofS!Qj4zEfq&nF?W&VX!LBk0iD3#a093>{+ zy={{&MRl-(RqKEM>9d*j|MKO_X8->xl&6Ex`@YQuafFNu{kLvgL-$YK`ZrfuT%LAL z-kb(WRNp&R?*E5RXV(9-{ex!xe-%3B=>)-bcqV^(Y~}zQvuKZtiu=6Wor=obV`5X7 zCpc}k`i-Kw^>1%%s*??@TK_Mf&B^} l;;Ry@Zp{-`t^a5HhvoHucyRFIX_FG1Q3wX#W>f&e1OO%NCBgsz diff --git a/chart/deps/minio/Chart.yaml b/chart/deps/minio/Chart.yaml index 677b4ce..1b0a01f 100644 --- a/chart/deps/minio/Chart.yaml +++ b/chart/deps/minio/Chart.yaml @@ -1,29 +1,17 @@ apiVersion: v2 - -name: minio-instance - -description: |- - A Helm chart for deploying the Minio instances based on use of the Minio operator - -#home: https://github.com/elastic/cloud-on-k8s - type: application - -version: 4.0.4-bb.4 - -appVersion: RELEASE.2020-11-19T23-48-16Z - -kubeVersion: ">=1.17.0-0" - +name: minio-instance +version: 4.1.2-bb.3 +appVersion: v4.1.2 +description: A Helm chart for MinIO based on Minio Operator 4.1.2 +home: https://min.io +icon: https://min.io/resources/img/logo/MINIO_wordmark.png keywords: - - Minio - - Instance - +- storage +- object-storage +- S3 maintainers: - - name: me - email: - -dependencies: - - name: bb-test-lib - version: "0.5.0" - repository: "oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates" +- email: dev@minio.io + name: MinIO, Inc +sources: +- https://github.com/minio/operator diff --git a/chart/deps/minio/Kptfile b/chart/deps/minio/Kptfile index 5111a05..cf023c6 100644 --- a/chart/deps/minio/Kptfile +++ b/chart/deps/minio/Kptfile @@ -1,11 +1,11 @@ apiVersion: kpt.dev/v1alpha1 kind: Kptfile metadata: - name: minio + name: chart upstream: type: git git: - commit: 3da8ff8e918a5f0fbff1e9a14e2f00a4cba3f925 + commit: 2ac9e5bf5aaaa414ea9790b2057d42e30b86df92 repo: https://repo1.dso.mil/platform-one/big-bang/apps/application-utilities/minio directory: /chart - ref: 4.0.4-bb.4 + ref: 4.1.2-bb.3 diff --git a/chart/deps/minio/templates/_helpers.tpl b/chart/deps/minio/templates/_helpers.tpl index d0d9309..29db7b7 100644 --- a/chart/deps/minio/templates/_helpers.tpl +++ b/chart/deps/minio/templates/_helpers.tpl @@ -61,8 +61,12 @@ Create the name of the service account to use Create the name of the service used to access the Minio object UI. Note: the Minio operator has a fixed name of "minio" for the service it creates. */}} -{{- define "minio.serviceName" -}} +{{- define "minio.serviceName" }} +{{- if .Values.upgradeTenants.enabled -}} minio +{{- else -}} +{{- default (include "minio.fullname" .) .Values.service.nameOverride }} +{{- end }} {{- end }} {{/* diff --git a/chart/deps/minio/templates/bigbang/networkpolicies/allow-sidecar-scraping.yaml b/chart/deps/minio/templates/bigbang/networkpolicies/allow-sidecar-scraping.yaml new file mode 100644 index 0000000..0d45971 --- /dev/null +++ b/chart/deps/minio/templates/bigbang/networkpolicies/allow-sidecar-scraping.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.networkPolicies.enabled .Values.istio.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-sidecar-scraping + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + policyTypes: + - Ingress + ingress: + - from: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: monitoring + podSelector: + matchLabels: + app: prometheus + ports: + - protocol: TCP + port: 15090 + - protocol: TCP + port: 15020 +{{- end }} diff --git a/chart/deps/minio/templates/bigbang/networkpolicies/default-deny-egress.yaml b/chart/deps/minio/templates/bigbang/networkpolicies/default-deny-egress.yaml new file mode 100644 index 0000000..c086cca --- /dev/null +++ b/chart/deps/minio/templates/bigbang/networkpolicies/default-deny-egress.yaml @@ -0,0 +1,18 @@ +{{- if .Values.networkPolicies.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-deny-external-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: {} + policyTypes: + - Egress + egress: + - to: + - namespaceSelector: {} + ports: + - port: 53 + protocol: UDP +{{- end }} diff --git a/chart/deps/minio/templates/bigbang/networkpolicies/default-deny-ingress.yaml b/chart/deps/minio/templates/bigbang/networkpolicies/default-deny-ingress.yaml new file mode 100644 index 0000000..956331f --- /dev/null +++ b/chart/deps/minio/templates/bigbang/networkpolicies/default-deny-ingress.yaml @@ -0,0 +1,11 @@ +{{- if .Values.networkPolicies.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-deny-ingress + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + policyTypes: + - Ingress +{{- end }} \ No newline at end of file diff --git a/chart/deps/minio/templates/bigbang/networkpolicies/helm-test-network-policy.yaml b/chart/deps/minio/templates/bigbang/networkpolicies/helm-test-network-policy.yaml new file mode 100644 index 0000000..0381a21 --- /dev/null +++ b/chart/deps/minio/templates/bigbang/networkpolicies/helm-test-network-policy.yaml @@ -0,0 +1,26 @@ +{{- $bbtests := .Values.bbtests | default dict -}} +{{- $enabled := (hasKey $bbtests "enabled") -}} +{{- if $enabled }} +{{- if and .Values.networkPolicies.enabled .Values.bbtests.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-helm-test-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + helm-test: enabled + egress: + - to: + - ipBlock: + cidr: {{ .Values.networkPolicies.controlPlaneCidr }} + {{- if eq .Values.networkPolicies.controlPlaneCidr "0.0.0.0/0" }} + # ONLY Block requests to cloud metadata IP + except: + - 169.254.169.254/32 + {{- end }} + policyTypes: + - Egress +{{- end }} +{{- end }} diff --git a/chart/deps/minio/templates/bigbang/networkpolicies/istio-allow.yaml b/chart/deps/minio/templates/bigbang/networkpolicies/istio-allow.yaml new file mode 100644 index 0000000..5ecf011 --- /dev/null +++ b/chart/deps/minio/templates/bigbang/networkpolicies/istio-allow.yaml @@ -0,0 +1,46 @@ +{{- if and .Values.networkPolicies.enabled .Values.istio.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-istio-ingress + namespace: {{ .Release.Namespace }} +spec: + ingress: + - from: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: istio-controlplane + podSelector: + matchLabels: + app: istio-ingressgateway + istio: ingressgateway + ports: + - port: {{ .Values.service.port }} + protocol: TCP + podSelector: + matchLabels: + app.kubernetes.io/instance: {{ .Release.Name }} + policyTypes: + - Ingress + +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-istio-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + policyTypes: + - Egress + egress: + - to: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: istio-controlplane + podSelector: + matchLabels: + app: istiod + ports: + - port: 15012 +{{- end }} diff --git a/chart/deps/minio/templates/bigbang/networkpolicies/monitoring-ingress.yaml b/chart/deps/minio/templates/bigbang/networkpolicies/monitoring-ingress.yaml new file mode 100644 index 0000000..59065e3 --- /dev/null +++ b/chart/deps/minio/templates/bigbang/networkpolicies/monitoring-ingress.yaml @@ -0,0 +1,19 @@ +{{- if and .Values.networkPolicies.enabled .Values.monitoring.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-scraping + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + policyTypes: + - Ingress + ingress: + - from: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: monitoring + ports: + - port: {{ .Values.service.port }} + protocol: TCP +{{- end }} \ No newline at end of file diff --git a/chart/deps/minio/templates/bigbang/networkpolicies/namespace-allow.yaml b/chart/deps/minio/templates/bigbang/networkpolicies/namespace-allow.yaml new file mode 100644 index 0000000..495131c --- /dev/null +++ b/chart/deps/minio/templates/bigbang/networkpolicies/namespace-allow.yaml @@ -0,0 +1,18 @@ +{{- if .Values.networkPolicies.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-in-ns + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + egress: + - to: + - podSelector: {} +{{- end }} \ No newline at end of file diff --git a/chart/deps/minio/templates/minio-vs.yaml b/chart/deps/minio/templates/minio-vs.yaml index 08496b4..31dead7 100644 --- a/chart/deps/minio/templates/minio-vs.yaml +++ b/chart/deps/minio/templates/minio-vs.yaml @@ -26,12 +26,12 @@ spec: http: - match: - uri: - prefix: /minio/prometheus/metrics + prefix: /minio/v2/metrics/cluster route: - destination: host: {{ include "minio.serviceName" . }} port: - number: {{ include "minio.servicePort" . | trim }} + number: {{ .Values.tenants.metrics.port }} fault: abort: percentage: diff --git a/chart/deps/minio/templates/release2.0.9/minioinstance.yaml b/chart/deps/minio/templates/release2.0.9/minioinstance.yaml new file mode 100644 index 0000000..76122a2 --- /dev/null +++ b/chart/deps/minio/templates/release2.0.9/minioinstance.yaml @@ -0,0 +1,122 @@ +{{- if not .Values.upgradeTenants.enabled }} +apiVersion: operator.min.io/v1 +kind: MinIOInstance +metadata: + name: {{ include "minio.fullname" . }} +## If specified, MinIOInstance pods will be dispatched by specified scheduler. +## If not specified, the pod will be dispatched by default scheduler. +# scheduler: +# name: my-custom-scheduler +spec: + ## Add metadata to the all pods created by the StatefulSet + metadata: + ## Optionally pass labels to be applied to the statefulset pods + labels: + app: {{ include "minio.fullname" . }} + {{- include "minio.labels" . | nindent 6 }} + {{- with .Values.podAnnotations }} + annotations: + prometheus.io/path: /minio/prometheus/metrics + prometheus.io/port: "9000" + prometheus.io/scrape: "true" + {{- toYaml . | nindent 6 }} + {{- end }} + {{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | indent 8 }} +{{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + + ## Registry location and Tag to download MinIO Server image + image: {{ .Values.image.name }}:{{ .Values.image.tag }} + serviceAccountName: {{ include "minio.serviceAccountName" . }} + ## A ClusterIP Service will be created with the given name + serviceName: minio-internal-service + zones: + - name: "zone-0" + ## Number of MinIO servers/pods in this zone. + ## For standalone mode, supply 1. For distributed mode, supply 4 or more. + ## Note that the operator does not support upgrading from standalone to distributed mode. + servers: {{ .Values.zones.servers }} + ## Supply number of volumes to be mounted per MinIO server instance. + ## 2 is minimum volumes with 3 servers + volumesPerServer: {{ .Values.volumesPerServer }} + ## Mount path where PV will be mounted inside container(s). Defaults to "/export". + mountPath: /export + ## Sub path inside Mount path where MinIO starts. Defaults to "". + # subPath: /data + ## This VolumeClaimTemplate is used across all the volumes provisioned for MinIO cluster. + ## Please do not change the volumeClaimTemplate field while expanding the cluster, this may + ## lead to unbound PVCs and missing data + volumeClaimTemplate: + metadata: + name: data + spec: + accessModes: + - {{ .Values.volumeClaimTemplate.accessModes}} + resources: + requests: + storage: {{ .Values.volumeClaimTemplate.storage}} + ## Secret with credentials to be used by MinIO instance. + credsSecret: + name: {{ .Values.minioRootCreds }} + ## PodManagement policy for pods created by StatefulSet. Can be "OrderedReady" or "Parallel" + ## Refer https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy + ## for details. Defaults to "Parallel" + podManagementPolicy: Parallel + ## Secret with certificates to configure TLS for MinIO certs. Create secrets as explained + ## here: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret + # externalCertSecret: + # name: tls-ssl-minio + ## Enable Kubernetes based certificate generation and signing as explained in + ## https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster + requestAutoCert: false + ## Used when "requestAutoCert" is set to true. Set CommonName for the auto-generated certificate. + ## Internal DNS name for the pod will be used if CommonName is not provided. + ## DNS name format is minio-{0...3}.minio.default.svc.cluster.local + certConfig: + commonName: "" + organizationName: [] + dnsNames: [] + ## Used to specify a toleration for a pod + # tolerations: + # - effect: NoSchedule + # key: dedicated + # operator: Equal + # value: storage + ## Add environment variables to be set in MinIO container (https://github.com/minio/minio/tree/master/docs/config) + env: + - name: MINIO_PROMETHEUS_AUTH_TYPE + value: "public" + # - name: MINIO_BROWSER + # value: "off" # to turn-off browser + # - name: MINIO_STORAGE_CLASS_STANDARD + # value: "EC:2" + ## Configure resource requests and limits for MinIO containers + # resources: + # requests: + # memory: 20Gi + ## Liveness probe detects situations where MinIO server instance + ## is not working properly and needs restart. Kubernetes automatically + ## restarts the pods if liveness checks fail. + liveness: + initialDelaySeconds: 10 + periodSeconds: 1 + timeoutSeconds: 1 + ## nodeSelector parameters for MinIO Pods. It specifies a map of key-value pairs. For the pod to be + ## eligible to run on a node, the node must have each of the + ## indicated key-value pairs as labels. + ## Read more here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + # nodeSelector: + # disktype: ssd + ## Affinity settings for MinIO pods. Read more about affinity + ## here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity. + # affinity: + securityContext: + runAsUser: 1001 + runAsGroup: 1001 + fsGroup: 1001 + {{- end }} \ No newline at end of file diff --git a/chart/deps/minio/templates/release2.0.9/service.yaml b/chart/deps/minio/templates/release2.0.9/service.yaml new file mode 100644 index 0000000..cf3ce13 --- /dev/null +++ b/chart/deps/minio/templates/release2.0.9/service.yaml @@ -0,0 +1,18 @@ +{{- if not .Values.upgradeTenants.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "minio.serviceName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "minio.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: 9000 + protocol: TCP + name: http + selector: + {{- include "minio.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/chart/deps/minio/templates/serviceMonitor.yaml b/chart/deps/minio/templates/release2.0.9/serviceMonitor.yaml similarity index 88% rename from chart/deps/minio/templates/serviceMonitor.yaml rename to chart/deps/minio/templates/release2.0.9/serviceMonitor.yaml index a9a1e57..1098800 100644 --- a/chart/deps/minio/templates/serviceMonitor.yaml +++ b/chart/deps/minio/templates/release2.0.9/serviceMonitor.yaml @@ -1,4 +1,4 @@ -{{- if .Values.monitoring.enabled }} +{{- if and .Values.monitoring.enabled (not .Values.upgradeTenants.enabled) }} apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: diff --git a/chart/deps/minio/templates/service-account.yaml b/chart/deps/minio/templates/service-account.yaml index 1ff1374..2507392 100644 --- a/chart/deps/minio/templates/service-account.yaml +++ b/chart/deps/minio/templates/service-account.yaml @@ -10,4 +10,4 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} imagePullSecrets: - {{ toYaml .Values.imagePullSecrets | indent 2 }} + - {{ toYaml .Values.tenants.imagePullSecret | indent 2 }} diff --git a/chart/deps/minio/templates/tenant-secret.yaml b/chart/deps/minio/templates/tenant-secret.yaml index c1ded29..3b1e576 100644 --- a/chart/deps/minio/templates/tenant-secret.yaml +++ b/chart/deps/minio/templates/tenant-secret.yaml @@ -1,3 +1,4 @@ +{{- if .Values.tenants.secrets.enabled }} apiVersion: v1 kind: Secret metadata: @@ -6,7 +7,9 @@ metadata: labels: {{- include "minio.labels" . | nindent 4 }} type: Opaque -stringData: - accesskey: {{ .Values.tenants.secrets.accessKey }} - secretkey: {{ .Values.tenants.secrets.secretKey }} ---- +data: + ## Access Key for MinIO Tenant + accesskey: {{ .Values.tenants.secrets.accessKey | b64enc }} + ## Secret Key for MinIO Tenant + secretkey: {{ .Values.tenants.secrets.secretKey | b64enc }} +{{ end }} diff --git a/chart/deps/minio/templates/tenant.yaml b/chart/deps/minio/templates/tenant.yaml index aa06c5f..b162c1d 100644 --- a/chart/deps/minio/templates/tenant.yaml +++ b/chart/deps/minio/templates/tenant.yaml @@ -1,3 +1,4 @@ +{{- if .Values.upgradeTenants.enabled }} apiVersion: minio.min.io/v2 kind: Tenant metadata: @@ -8,17 +9,6 @@ metadata: labels: app: {{ template "minio.fullname" . }} {{- include "minio.labels" . | nindent 4 }} - {{- if .Values.istio.virtualService.labels }} - {{ toYaml .Values.istio.virtualservice.labels | indent 4 }} - {{- end }} - {{- if .Values.istio.virtualService.annotations }} - ## Annotations for MinIO Tenant Pods - annotations: - prometheus.io/path: /minio/prometheus/metrics - prometheus.io/port: "9000" - prometheus.io/scrape: "true" - {{ toYaml .Values.istio.virtualService.annotations | indent 4 }} - {{- end }} ## If a scheduler is specified here, Tenant pods will be dispatched by specified scheduler. ## If not specified, the Tenant pods will be dispatched by default scheduler. @@ -61,6 +51,7 @@ spec: resources: requests: storage: {{ .size }} + #storageClassName: {{ .storageClassName}} ## Used to specify a toleration for a pod # tolerations: @@ -174,6 +165,15 @@ spec: ## for details. podManagementPolicy: {{ .Values.tenants.podManagementPolicy }} + {{ if or .Values.monitoring.enabled .Values.tenants.metrics.enabled }} + ## PrometheusOperator enables the Minio Operator to create the Prometheus serviceMonitor objects to scrape + ## metrics from the tenant. This is only applied if monitoring support is enabled. + prometheusOperator: + labels: + app.kubernetes.io/component: "monitoring" + {{ include "minio.labels" . | nindent 6 }} + {{- end }} + ## serviceMetadata allows passing additional labels and annotations to MinIO and Console specific ## services created by the operator. {{- with .Values.tenants.serviceMetadata }} @@ -185,7 +185,9 @@ spec: {{- end }} ## Add environment variables to be set in MinIO container (https://github.com/minio/minio/tree/master/docs/config) - # env: + #env: + # - name: MINIO_PROMETHEUS_AUTH_TYPE + # value: "public" # - name: MINIO_BROWSER # value: "off" # to turn-off browser # - name: MINIO_STORAGE_CLASS_STANDARD @@ -220,3 +222,4 @@ spec: {{ toYaml . | nindent 6 }} {{ end }} {{- end }} +{{- end }} diff --git a/chart/deps/minio/values.yaml b/chart/deps/minio/values.yaml index 97f048b..4c7310a 100644 --- a/chart/deps/minio/values.yaml +++ b/chart/deps/minio/values.yaml @@ -1,33 +1,13 @@ -# ## Default values for minio instance creation. -## This is a YAML-formatted file. -## Declare variables to be passed into your templates. -## Configure number of MinIO Operator Deployment Replicas -#replicas: -# count: 1 +## Note: to enable upgrade of minio instance, then values file has a number of values that will be +## deprecated in the future. Deprecation candidates will have an annotation in comments regarding the timeframe for deprecation. hostname: bigbang.dev -#nameOverride: "" -#fullnameOverride: "" -# Configure repo and tag of MinIO Operator Image -#image: -# name: registry1.dso.mil/ironbank/opensource/minio/minio -# tag: RELEASE.2020-11-19T23-48-16Z -# imagePullPolicy: IfNotPresent - -#zones: - # refer to documentation for number of servers versus volumes per server - # https://docs.min.io/docs/minio-server-limits-per-tenant.html -# servers: 3 # scale to 3 for dev -#volumesPerServer: 2 # 2 is minimum volumes with 3 servers - -#volumeClaimTemplate: -# accessModes: ReadWriteOnce -# storage: 1Gi # scale down for dev - -imagePullSecrets: - - name: private-registry +# When true, upgradeTenants enables use of the V4.* Minio Operator CRD for creation of tenants is enabled. +# The default will be made TRUE in a future release. +upgradeTenants: + enabled: false serviceAccount: # Specifies whether a service account should be created @@ -38,6 +18,8 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" +# This is maintained for compatible upgrade with the 2.0.9 release. The following service itens will be removed ina future release +# because the operator handles the service deployment in 4.x and beyond. service: # Internal service name for minio instance. This is the full name of the service used to connect to Minio from within the cluster. # If not specified, the service name will be the default full name of the minio instance. @@ -45,6 +27,7 @@ service: type: ClusterIP port: 9000 +# Removed ina future release podAnnotations: {} istio: @@ -60,56 +43,89 @@ istio: service: "" port: "" - monitoring: enabled: false namespace: monitoring +networkPolicies: + enabled: false + controlPlaneCidr: 0.0.0.0/0 + ingressLabels: + app: istio-ingressgateway + istio: ingressgateway + +# This is maintained for compatible upgrade with the 2.0.9 release. The following service itens will be removed ina future release +# once all upgrades are complete. +image: + name: registry1.dso.mil/ironbank/opensource/minio/minio + tag: RELEASE.2020-11-19T23-48-16Z + pullPolicy: "IfNotPresent" -## MinIO Tenant Definition +# This is maintained for compatible upgrade with the 2.0.9 release. The following service itens will be removed ina future release +# once all upgrades are complete. +zones: + # refer to documentation for number of servers versus volumes per server + # https://docs.min.io/docs/minio-server-limits-per-tenant.html + servers: 3 # scale to 3 for dev + +# This is maintained for compatible upgrade with the 2.0.9 release. The following service itens will be removed ina future release +# once all upgrades are complete. +volumesPerServer: 2 # 2 is minimum volumes with 3 servers + +# This is maintained for compatible upgrade with the 2.0.9 release. The following service itens will be removed ina future release +# once all upgrades are complete. +volumeClaimTemplate: + accessModes: ReadWriteOnce + storage: 1Gi # scale down for dev + +# This is maintained for compatible upgrade with the 2.0.9 release. The following service itens will be removed ina future release +# once all upgrades are complete. +minioRootCreds: default-minio-creds-secret + +## MinIO Tenant Definition used for 4.1.2 upgrade tenants: # Tenant name name: minio - ## Registry location and Tag to download MinIO Server image -# Configure repo and tag of MinIO Operator Image + ## Registry location and Tag to download MinIO Server image + # Configure repo and tag of MinIO Operator Image image: repository: registry1.dso.mil/ironbank/opensource/minio/minio - tag: RELEASE.2020-11-19T23-48-16Z + tag: RELEASE.2021-06-17T00-10-46Z pullPolicy: "IfNotPresent" + ## Customize namespace for tenant deployment + #namespace: default imagePullSecret: name: private-registry - ## If a scheduler is specified here, Tenant pods will be dispatched by specified scheduler. - ## If not specified, the Tenant pods will be dispatched by default scheduler. - ##scheduler: - ## name: + ## If a scheduler is specified here, Tenant pods will be dispatched by specified scheduler. + ## If not specified, the Tenant pods will be dispatched by default scheduler. + ##scheduler: + ## name: scheduler: {} - ## Used to specify a toleration for a pod - tolerations: {} - ## nodeSelector parameters for MinIO Pods. It specifies a map of key-value pairs. For the pod to be - ## eligible to run on a node, the node must have each of the - ## indicated key-value pairs as labels. - ## Read more here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - nodeSelector: {} - ## Affinity settings for MinIO pods. Read more about affinity - ## here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity. - affinity: {} - ## Configure resource requests and limits for MinIO containers - resources: {} - ## Configure security context - ## BB Note: Defaults for Ironbank image are 1001 for user, group, and fsGroup - securityContext: - runAsUser: 1001 - runAsGroup: 1001 - fsGroup: 1001 - secrets: - name: minio-creds-secret - accessKey: ThisIsAVeryLongPasswordForExample - secretKey: ThisIsAVeryLongPasswordForExample - metrics: - enabled: false - port: 9000 - ## Specification for MinIO Pool(s) in this Tenant. + ## Used to specify a toleration for a pod + #tolerations: {} + + ## nodeSelector parameters for MinIO Pods. It specifies a map of key-value pairs. For the pod to be + ## eligible to run on a node, the node must have each of the + ## indicated key-value pairs as labels. + ## Read more here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + #nodeSelector: {} + + ## Affinity settings for MinIO pods. Read more about affinity + ## here: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity. + #affinity: {} + + ## Configure resource requests and limits for MinIO containers + #resources: {} + + ## Configure security context + ## BB Note: Defaults for Ironbank image are 1001 for user, group, and fsGroup + #securityContext: + # runAsUser: 1001 + # runAsGroup: 1001 + # fsGroup: 1001 + + ## Specification for MinIO Pool(s) in this Tenant. pools: ## Servers specifies the number of MinIO Tenant Pods / Servers in this pool. ## For standalone mode, supply 1. For distributed mode, supply 4 or more. @@ -120,7 +136,7 @@ tenants: ## size specifies the capacity per volume size: 1Gi ## storageClass specifies the storage class name to be used for this pool - storageClassName: standard + storageClassName: local-path ## Used to specify a toleration for a pod tolerations: {} ## nodeSelector parameters for MinIO Pods. It specifies a map of key-value pairs. For the pod to be @@ -139,10 +155,24 @@ tenants: runAsUser: 1001 runAsGroup: 1001 fsGroup: 1001 - ## Mount path where PV will be mounted inside container(s). + ## Mount path where PV will be mounted inside container(s). mountPath: /export - ## Sub path inside Mount path where MinIO stores data. + + ## Sub path inside Mount path where MinIO stores data. subPath: /data + + # pool secrets + secrets: + enabled: true + name: minio-creds-secret + accessKey: minio + secretKey: minio123 + + # pool metrics to be read by Prometheus + metrics: + enabled: false + port: 9000 + certificate: ## Use this field to provide a list of Secrets with external certificates. This can be used to to configure ## TLS for MinIO Tenant pods. Create secrets as explained here: @@ -195,12 +225,13 @@ tenants: enabled: false image: repository: minio/console - tag: v0.6.3 + tag: v0.7.4 pullPolicy: IfNotPresent replicaCount: 1 secrets: - name: minio-console-secret - passphrase: ThisIsAVeryLongConsolePasswordForExample - salt: ThisIsAVeryLongConsolePasswordForExample - accessKey: ThisIsAVeryLongConsolePasswordForExample - secretKey: ThisIsAVeryLongConsolePasswordForExample + enabled: true + name: console-secret + passphrase: SECRET + salt: SECRET + accessKey: YOURCONSOLEACCESS + secretKey: YOURCONSOLESECRET diff --git a/chart/templates/bigbang/networkpolicies/allow-dns-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-dns-egress.yaml new file mode 100644 index 0000000..ec71cd2 --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-dns-egress.yaml @@ -0,0 +1,22 @@ +{{- if .Values.networkPolicies.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-dns-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + policyTypes: + - Egress + # Allow access to DNS + egress: + - to: + - namespaceSelector: {} + ports: + - port: 53 + protocol: UDP + {{- if .Values.openshift }} + - port: 5353 + protocol: UDP + {{- end }} +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-elastic-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-elastic-egress.yaml new file mode 100644 index 0000000..9ebb80c --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-elastic-egress.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.networkPolicies.enabled .Values.elasticsearch.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-elastic-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + app: mattermost + policyTypes: + - Egress + egress: + - to: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: logging + podSelector: + matchLabels: + common.k8s.elastic.co/type: elasticsearch + ports: + - port: 9200 + protocol: TCP +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-external-postgres.yaml b/chart/templates/bigbang/networkpolicies/allow-external-postgres.yaml new file mode 100644 index 0000000..265a0e5 --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-external-postgres.yaml @@ -0,0 +1,20 @@ +{{- if and .Values.networkPolicies.enabled (not .Values.postgresql.install) }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-external-postgres-egress-upgrade + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + app: mattermost-update-check + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + # ONLY Block requests to AWS metadata IP + except: + - 169.254.169.254/32 +{{- end }} diff --git a/chart/templates/bigbang/networkpolicies/allow-in-ns.yaml b/chart/templates/bigbang/networkpolicies/allow-in-ns.yaml new file mode 100644 index 0000000..495131c --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-in-ns.yaml @@ -0,0 +1,18 @@ +{{- if .Values.networkPolicies.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-in-ns + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: + - from: + - podSelector: {} + egress: + - to: + - podSelector: {} +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-istio.yaml b/chart/templates/bigbang/networkpolicies/allow-istio.yaml new file mode 100644 index 0000000..e222789 --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-istio.yaml @@ -0,0 +1,33 @@ +{{- if and .Values.networkPolicies.enabled .Values.istio.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-istio + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + app: mattermost + policyTypes: + - Ingress + - Egress + ingress: + - from: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: istio-controlplane + podSelector: + matchLabels: + {{- toYaml .Values.networkPolicies.ingressLabels | nindent 10}} + ports: + - port: 8065 + protocol: TCP + egress: + - to: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: istio-controlplane + podSelector: + matchLabels: + istio: pilot +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-mattermost-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-mattermost-egress.yaml new file mode 100644 index 0000000..931746c --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-mattermost-egress.yaml @@ -0,0 +1,20 @@ +{{- if .Values.networkPolicies.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-mattermost-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + app: mattermost + policyTypes: + - Egress + egress: + - to: + - ipBlock: + cidr: 0.0.0.0/0 + # ONLY Block requests to AWS metadata IP + except: + - 169.254.169.254/32 +{{- end }} diff --git a/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml b/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml new file mode 100644 index 0000000..9d615b7 --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-monitoring-ingress.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.networkPolicies.enabled .Values.monitoring.enabled .Values.enterprise.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-monitoring-ingress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + app: mattermost + policyTypes: + - Ingress + ingress: + - from: + - namespaceSelector: + matchLabels: + app.kubernetes.io/name: monitoring + podSelector: + matchLabels: + app: prometheus + ports: + - port: 8067 + protocol: TCP +{{- end }} \ No newline at end of file diff --git a/chart/templates/bigbang/networkpolicies/allow-test-egress.yaml b/chart/templates/bigbang/networkpolicies/allow-test-egress.yaml new file mode 100644 index 0000000..974182b --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/allow-test-egress.yaml @@ -0,0 +1,26 @@ +{{- $bbtests := .Values.bbtests | default dict -}} +{{- $enabled := (hasKey $bbtests "enabled") -}} +{{- if $enabled }} +{{- if and .Values.networkPolicies.enabled .Values.bbtests.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-test-egress + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + helm-test: enabled + egress: + - to: + - ipBlock: + cidr: {{ .Values.networkPolicies.controlPlaneCidr }} + {{- if eq .Values.networkPolicies.controlPlaneCidr "0.0.0.0/0" }} + # ONLY Block requests to cloud metadata IP + except: + - 169.254.169.254/32 + {{- end }} + policyTypes: + - Egress +{{- end }} +{{- end }} diff --git a/chart/templates/bigbang/networkpolicies/deny-default.yaml b/chart/templates/bigbang/networkpolicies/deny-default.yaml new file mode 100644 index 0000000..b8fe223 --- /dev/null +++ b/chart/templates/bigbang/networkpolicies/deny-default.yaml @@ -0,0 +1,14 @@ +{{- if .Values.networkPolicies.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-deny + namespace: {{ .Release.Namespace }} +spec: + podSelector: {} + policyTypes: + - Ingress + - Egress + ingress: [] + egress: [] +{{- end }} \ No newline at end of file diff --git a/chart/templates/default-bucket.yaml b/chart/templates/default-bucket.yaml new file mode 100644 index 0000000..f3065f2 --- /dev/null +++ b/chart/templates/default-bucket.yaml @@ -0,0 +1,40 @@ +{{- if .Values.minio.install }} +apiVersion: batch/v1 +kind: Job +metadata: + name: default-minio-bucket-creation + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": before-hook-creation +spec: + template: + metadata: + name: default-minio-bucket-creation + spec: + imagePullSecrets: + {{- with .Values.global.imagePullSecrets }} + {{ . | toYaml | nindent 8 }} + {{- end }} + restartPolicy: Never + containers: + - name: minio-bucket-creation + image: {{ .Values.minio.bucketCreationImage }} + command: + - /bin/sh + - -c + - | + set -ex + attempt_counter=0 + max_attempts=25 + until [ $(mc config host add bigbang http://{{ .Values.minio.service.nameOverride }} {{ .Values.minio.tenants.secrets.accessKey }} {{ .Values.minio.tenants.secrets.secretKey }} >/dev/null; echo $?) -eq 0 ]; do + if [ ${attempt_counter} -eq ${max_attempts} ];then + echo "Max attempts reached" + exit 1 + fi + attempt_counter=$(($attempt_counter+1)) + sleep 10 + done + mc mb bigbang/mattermost +{{- end }} diff --git a/chart/templates/env-secret.yaml b/chart/templates/env-secret.yaml index 9dd5e1e..ebb8e7b 100644 --- a/chart/templates/env-secret.yaml +++ b/chart/templates/env-secret.yaml @@ -46,4 +46,4 @@ stringData: MM_ELASTICSEARCHSETTINGS_PASSWORD: {{ .data.elastic | b64dec }} {{- end }} {{- end }} -{{- end }} +{{- end }} \ No newline at end of file diff --git a/chart/templates/mattermost.yaml b/chart/templates/mattermost.yaml index 524b26d..6360eec 100644 --- a/chart/templates/mattermost.yaml +++ b/chart/templates/mattermost.yaml @@ -9,6 +9,10 @@ metadata: spec: image: {{ .Values.image.name }} imagePullPolicy: {{ .Values.image.imagePullPolicy }} + {{- with .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 4 }} + {{- end }} size: {{ .Values.users }}users version: {{ .Values.image.tag }} @@ -149,12 +153,22 @@ spec: {{ toYaml .Values.nodeSelector | nindent 6 }} {{- end }} + {{- with .Values.volumes }} + volumes: + {{- toYaml . | nindent 4}} + {{- end }} + + {{- with .Values.volumeMounts }} + volumeMounts: + {{- toYaml . | nindent 4}} + {{- end }} + database: external: secret: {{ .Values.database.secret | default (printf "%s-dbcreds" (include "mattermost.fullname" .)) }} fileStore: external: - url: {{ .Values.fileStore.url | default "minio:80" }} + url: {{ .Values.fileStore.url | default .Values.minio.service.nameOverride }} bucket: {{ .Values.fileStore.bucket | default "mattermost" }} secret: {{ .Values.fileStore.secret | default .Values.minio.tenants.secrets.name }} diff --git a/chart/templates/tests/test-ui.yaml b/chart/templates/tests/test-ui.yaml index 57f9771..163bd16 100644 --- a/chart/templates/tests/test-ui.yaml +++ b/chart/templates/tests/test-ui.yaml @@ -1,11 +1,11 @@ -{{- include "bb-test-lib.cypress-configmap.overrides" (list . "mattermost-test.cypress-configmap") }} +{{- include "gluon.tests.cypress-configmap.overrides" (list . "mattermost-test.cypress-configmap") }} {{- define "mattermost-test.cypress-configmap" }} metadata: labels: {{ include "mattermost.labels" . | nindent 4 }} {{- end }} --- -{{- include "bb-test-lib.cypress-runner.overrides" (list . "mattermost-test.cypress-runner") -}} +{{- include "gluon.tests.cypress-runner.overrides" (list . "mattermost-test.cypress-runner") -}} {{- define "mattermost-test.cypress-runner" -}} metadata: labels: diff --git a/chart/values.yaml b/chart/values.yaml index 81d5481..541b99c 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -18,6 +18,13 @@ monitoring: enabled: false namespace: monitoring +networkPolicies: + enabled: false + ingressLabels: + app: istio-ingressgateway + istio: ingressgateway + controlPlaneCidr: 0.0.0.0/0 + sso: enabled: false client_id: platform1_a8604cc9-f5e9-4656-802d-d05624370245_bb8-mattermost @@ -28,8 +35,8 @@ sso: # Repo and image tag image: - name: registry.dso.mil/platform-one/big-bang/apps/collaboration-tools/mattermost/mattermost - tag: 5.34.2 + name: registry1.dso.mil/ironbank/opensource/mattermost/mattermost + tag: 5.37.0 imagePullPolicy: IfNotPresent global: @@ -95,14 +102,28 @@ existingSecretEnvs: {} # key: DB_CONNECTION_CHECK_URL # name: "mysecretname" +volumes: {} + # - name: ca-cert + # secret: + # secretName: ca-secret + # defaultMode: 0644 + +volumeMounts: {} + # - name: ca-cert + # mountPath: /etc/ssl/certs + # readOnly: true + minio: install: false - + bucketCreationImage: "registry1.dso.mil/ironbank/opensource/minio/mc:RELEASE.2021-06-13T17-48-22Z" + # Override the minio service name for easier connection setup + service: + nameOverride: "minio.mattermost.svc.cluster.local" tenants: secrets: name: "mattermost-objstore-creds" accessKey: "minio" - secretKey: "minio#123" # default key, change this! + secretKey: "minio123" # default key, change this! postgresql: install: false @@ -167,3 +188,5 @@ elasticsearch: enablesearching: true # When true, Elasticsearch will be used for all autocompletion queries on users and channels using the latest index. Autocompletion results may be incomplete until a bulk index of the existing users and channels database is finished. When false, database autocomplete is used. enableautocomplete: true + +openshift: false diff --git a/docs/keycloak.md b/docs/keycloak.md index a2423ae..36431b3 100644 --- a/docs/keycloak.md +++ b/docs/keycloak.md @@ -20,7 +20,7 @@ Under the mappers tab, create a new mapper: - claim JSON type - long - add to userinfo - on -Create another mapper: +Create username mapper: - name - username - mapper type - user property - property - username @@ -29,6 +29,15 @@ Create another mapper: - add to userinfo - on - all other sliders off +Create email mapper: +- name - email +- mapper type - user property +- property - email +- token claim name - email +- claim JSON type - string +- add to userinfo - on +- all other sliders off + Add mattermostid to existing user: - Login to keycloak Admin Console with the master realm user - Go to your realm @@ -68,3 +77,27 @@ helm upgrade -i mattermost chart -n mattermost --create-namespace -f my-values.y Role based authentication can be configured as long as you are on an enterprise version. Follow the steps in [this tutorial](https://docs.mattermost.com/deployment/advanced-permissions.html) to customize the permissions given to users. In general permissions can be edited under the "System Console -> User Management -> Permissions". Users should be created by default under the "Member" group, except for the first user to sign up or login. + +## OIDC Custom CA + +Mattermost can be configured to point to specific files to trust with an OIDC auth connection, here is an example when using Big Bang to deploy mattermost, assuming you are populating a secret named "ca-cert" in the same namespace, with a key of cert.pem and value of a single PEM encoded certificate (an easy way to make this secret is included below as well): + +```yaml +addons: + mattermost: + values: + volumes: + - name: ca-cert + secret: + secretName: ca-secret + defaultMode: 0644 + volumeMounts: + - name: ca-cert + mountPath: /etc/ssl/certs + readOnly: true +``` + +For secret creation with this example and a pem file at `/path/to/cert.pem`: +```bash +kubectl create secret generic ca-secret --from-file=cert.pem=/path/to/cert.pem -n mattermost +``` diff --git a/tests/dependencies.yaml b/tests/dependencies.yaml index 0199dcd..8ca3e48 100644 --- a/tests/dependencies.yaml +++ b/tests/dependencies.yaml @@ -1,9 +1,9 @@ mattermostoperator: git: "https://repo1.dso.mil/platform-one/big-bang/apps/collaboration-tools/mattermost-operator.git" namespace: "mattermost-operator" - branch: "1.13.0-bb.2" + branch: "1.14.0-bb.2" miniooperator: git: "https://repo1.dso.mil/platform-one/big-bang/apps/application-utilities/minio-operator.git" namespace: "minio-operator" - branch: "4.0.4-bb.1" + branch: "4.1.2-bb.1" diff --git a/tests/test-values.yml b/tests/test-values.yml index f180ba2..3f12784 100644 --- a/tests/test-values.yml +++ b/tests/test-values.yml @@ -1,10 +1,16 @@ minio: install: true + upgradeTenants: + enabled: true postgresql: install: true +networkPolicies: + enabled: true + bbtests: + enabled: true cypress: artifacts: true envs: -- GitLab