From f2343f054d6ff2420f2ba035b0a35285e0ae7ece Mon Sep 17 00:00:00 2001 From: asauerwein Date: Wed, 4 Jan 2023 17:21:19 +0100 Subject: [PATCH 1/8] prepend cluster name to nodepool --- charts/templates/cluster.yaml | 5 ++++- charts/templates/nodeconfig-vsphere.yaml | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/charts/templates/cluster.yaml b/charts/templates/cluster.yaml index ff61276..9d6e556 100644 --- a/charts/templates/cluster.yaml +++ b/charts/templates/cluster.yaml @@ -43,7 +43,10 @@ spec: {{- else if eq $.Values.cloudprovider "azure" }} kind: AzureConfig {{- end}} - name: {{ $nodepool.name }} + name: nc-{{ $.Values.cluster.name }}-{{ $nodepool.name }} + {{- if $nodepool.os }} + machineOS: {{ $nodepool.os }} + {{- end}} paused: {{ $nodepool.paused }} displayName: {{ $nodepool.displayName }} {{- if $nodepool.rollingUpdate }} diff --git a/charts/templates/nodeconfig-vsphere.yaml b/charts/templates/nodeconfig-vsphere.yaml index 8c01bfc..a9efd47 100644 --- a/charts/templates/nodeconfig-vsphere.yaml +++ b/charts/templates/nodeconfig-vsphere.yaml @@ -3,7 +3,7 @@ apiVersion: rke-machine-config.cattle.io/v1 kind: VmwarevsphereConfig metadata: - name: {{ $nodepool.name }} + name: nc-{{ $.Values.cluster.name }}-{{ $nodepool.name }} namespace: fleet-default common: {{- if $nodepool.labels }} @@ -51,7 +51,7 @@ vcenterPort: {{ $nodepool.vcenterPort | quote }} apiVersion: rke-machine-config.cattle.io/v1 kind: VmwarevsphereConfig metadata: - name: {{ $nodepool.name }} + name: nc-{{ $.Values.cluster.name }}-{{ $nodepool.name }} namespace: fleet-default common: {{- if $nodepool.labels }} From fd53d297add3499d8a78b9377272285ddc5314f6 Mon Sep 17 00:00:00 2001 From: asauerwein Date: Wed, 4 Jan 2023 17:45:30 +0100 Subject: [PATCH 2/8] add machineselectorconfig --- charts/templates/cluster.yaml | 3 ++- charts/values.yaml | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/charts/templates/cluster.yaml b/charts/templates/cluster.yaml index 9d6e556..faeae1f 100644 --- a/charts/templates/cluster.yaml +++ b/charts/templates/cluster.yaml @@ -143,7 +143,8 @@ spec: # Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert # tls-san: [] - # machineSelectorConfig: + machineSelectorConfig: +{{ toYaml .Values.rke.machineSelectorConfig | indent 6 }} # - config: # Node name # node-name: "" diff --git a/charts/values.yaml b/charts/values.yaml index 81db0ef..dc574cc 100644 --- a/charts/values.yaml +++ b/charts/values.yaml @@ -22,6 +22,9 @@ rke: # enable local auth endpoint localClusterAuthEndpoint: enabled: false + machineSelectorConfig: + # - config: + # system-default-registry: registry.example.com # specify fqdn of local access endpoint # fqdn: foo.bar.example # specify cacert of local access endpoint From 181d87220bdf34fd8255bef4458afc5c9ca87520 Mon Sep 17 00:00:00 2001 From: asauerwein Date: Wed, 4 Jan 2023 17:48:25 +0100 Subject: [PATCH 3/8] add registries --- charts/templates/cluster.yaml | 7 +++++++ charts/values.yaml | 11 +++++++++++ 2 files changed, 18 insertions(+) diff --git a/charts/templates/cluster.yaml b/charts/templates/cluster.yaml index faeae1f..7fd929e 100644 --- a/charts/templates/cluster.yaml +++ b/charts/templates/cluster.yaml @@ -84,6 +84,9 @@ spec: kind: AzureConfig {{- end}} name: {{ $nodepool.name }} + {{- if $nodepool.os }} + machineOS: {{ $nodepool.os }} + {{- end}} paused: {{ $nodepool.paused }} displayName: {{ $nodepool.displayName }} {{- if $nodepool.rollingUpdate }} @@ -168,6 +171,10 @@ spec: # cloud-provider-name: "" # Cloud provider configuration file path # cloud-provider-config: "" +{{- if .Values.rke.registries }} + registries: +{{ toYaml .Values.rke.registries | indent 6 }} +{{- end }} {{- if .Values.rke.localClusterAuthEndpoint.enabled }} localClusterAuthEndpoint: enabled: {{ .Values.rke.localClusterAuthEndpoint.enabled }} diff --git a/charts/values.yaml b/charts/values.yaml index dc574cc..09f9d09 100644 --- a/charts/values.yaml +++ b/charts/values.yaml @@ -34,6 +34,17 @@ rke: # clusterMembers: # - principalName: "local://u-z8zl5" # roleTemplateName: "cluster-member" + registries: + # configs: + # {} + # authConfigSecretName: string + # caBundle: string + # insecureSkipVerify: boolean + # tlsSecretName: string + # mirrors: + # '*': + # endpoint: + # - https://registry.example.com # enable monitoring monitoring: From 7399a9005d310c13ef77ffed50f0bcf0764537ba Mon Sep 17 00:00:00 2001 From: asauerwein Date: Wed, 4 Jan 2023 17:51:38 +0100 Subject: [PATCH 4/8] add node pool os --- charts/templates/nodeconfig-vsphere.yaml | 2 ++ charts/values-vsphere.yaml | 3 +++ 2 files changed, 5 insertions(+) diff --git a/charts/templates/nodeconfig-vsphere.yaml b/charts/templates/nodeconfig-vsphere.yaml index a9efd47..9fe7542 100644 --- a/charts/templates/nodeconfig-vsphere.yaml +++ b/charts/templates/nodeconfig-vsphere.yaml @@ -33,6 +33,7 @@ folder: {{ $nodepool.folder }} hostsystem: {{ $nodepool.hostsystem }} memorySize: {{ $nodepool.memorySize | quote }} network: {{ $nodepool.network }} +os: {{ $nodepool.os | default "linux"}} pool: {{ $nodepool.pool }} sshPort: {{ $nodepool.sshPort | quote }} sshUser: {{ $nodepool.sshUser }} @@ -81,6 +82,7 @@ folder: {{ $nodepool.folder }} hostsystem: {{ $nodepool.hostsystem }} memorySize: {{ $nodepool.memorySize | quote }} network: {{ $nodepool.network }} +os: {{ $nodepool.os | default "linux"}} pool: {{ $nodepool.pool }} sshPort: {{ $nodepool.sshPort | quote }} sshUser: {{ $nodepool.sshUser }} diff --git a/charts/values-vsphere.yaml b/charts/values-vsphere.yaml index a6e94d4..0acd11d 100644 --- a/charts/values-vsphere.yaml +++ b/charts/values-vsphere.yaml @@ -17,6 +17,9 @@ nodepools: # specify nodepool size quantity: 1 + # specify nodepool os (linux, windows) + os: linux + # Pause node pool paused: false From abdbbd9db789ae0aecf178aa9616c3dfa388a19e Mon Sep 17 00:00:00 2001 From: asauerwein Date: Wed, 4 Jan 2023 18:00:48 +0100 Subject: [PATCH 5/8] vapp property should be a list --- charts/templates/nodeconfig-vsphere.yaml | 6 ++++-- charts/values-vsphere.yaml | 3 +++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/charts/templates/nodeconfig-vsphere.yaml b/charts/templates/nodeconfig-vsphere.yaml index 9fe7542..2ab48fa 100644 --- a/charts/templates/nodeconfig-vsphere.yaml +++ b/charts/templates/nodeconfig-vsphere.yaml @@ -41,7 +41,8 @@ sshUserGroup: {{ $nodepool.sshUserGroup }} tag: {{ $nodepool.tag }} vappIpallocationpolicy: {{ $nodepool.vappIpallocationpolicy }} vappIpprotocol: {{ $nodepool.vappIpprotocol }} -vappProperty: {{ $nodepool.vappProperty }} +vappProperty: +{{ toYaml $nodepool.vappProperty | indent 4 }} vappTransport: {{ $nodepool.vappTransport }} vcenter: {{ $nodepool.vcenter }} vcenterPort: {{ $nodepool.vcenterPort | quote }} @@ -90,7 +91,8 @@ sshUserGroup: {{ $nodepool.sshUserGroup }} tag: {{ $nodepool.tag }} vappIpallocationpolicy: {{ $nodepool.vappIpallocationpolicy }} vappIpprotocol: {{ $nodepool.vappIpprotocol }} -vappProperty: {{ $nodepool.vappProperty }} +vappProperty: +{{ toYaml $nodepool.vappProperty | indent 4 }} vappTransport: {{ $nodepool.vappTransport }} vcenter: {{ $nodepool.vcenter }} vcenterPort: {{ $nodepool.vcenterPort }} diff --git a/charts/values-vsphere.yaml b/charts/values-vsphere.yaml index 0acd11d..53d61e2 100644 --- a/charts/values-vsphere.yaml +++ b/charts/values-vsphere.yaml @@ -135,6 +135,9 @@ nodepools: # vSphere vApp properties # vappProperty: [] + # - guestinfo.interface.0.ip.0.address=ip:vLan100_K8S + # - guestinfo.interface.0.ip.0.netmask=${netmask:vLan100_K8S} + # - guestinfo.interface.0.route.0.gateway=${gateway:vLan100_K8S} # 'vSphere OVF environment transports to use for properties. Supported values are: iso and com.vmware.guestInfo' # vappTransport: "" From e6ba34398d2c511deb18a61413576c32be9c46d6 Mon Sep 17 00:00:00 2001 From: asauerwein Date: Wed, 4 Jan 2023 18:17:37 +0100 Subject: [PATCH 6/8] cfgparam should be a list --- charts/templates/nodeconfig-vsphere.yaml | 6 ++++-- charts/values-vsphere.yaml | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/charts/templates/nodeconfig-vsphere.yaml b/charts/templates/nodeconfig-vsphere.yaml index 2ab48fa..efc7a4d 100644 --- a/charts/templates/nodeconfig-vsphere.yaml +++ b/charts/templates/nodeconfig-vsphere.yaml @@ -15,7 +15,8 @@ common: {{ toYaml $nodepool.taints | indent 4 }} {{- end }} {{- if $nodepool.cfgparam }} -cfgparam: {{ $nodepool.cfgparam }} +cfgparam: +{{ toYaml $nodepool.cfgparam | indent 4 }} {{- end }} cloneFrom: {{ $nodepool.cloneFrom }} cloudConfig: | @@ -65,7 +66,8 @@ common: {{ toYaml $nodepool.taints | indent 4 }} {{- end }} {{- if $nodepool.cfgparam }} -cfgparam: {{ $nodepool.cfgparam }} +cfgparam: +{{ toYaml $nodepool.cfgparam | indent 4 }} {{- end }} cloneFrom: {{ $nodepool.cloneFrom }} cloudConfig: | diff --git a/charts/values-vsphere.yaml b/charts/values-vsphere.yaml index 53d61e2..653bf2c 100644 --- a/charts/values-vsphere.yaml +++ b/charts/values-vsphere.yaml @@ -67,7 +67,7 @@ nodepools: # vSphere vm configuration parameters (used for guestinfo) # cfgparam: [] - + # - disk.enableUUID=TRUE # If you choose creation type clone a name of what you want to clone is required # cloneFrom: "" From 3ae4265d6c9f7fbb7802ec9fc6f3c6a79c507a5f Mon Sep 17 00:00:00 2001 From: asauerwein Date: Thu, 5 Jan 2023 09:55:34 +0100 Subject: [PATCH 7/8] package helm chart --- cluster-template-0.0.1.tgz | Bin 10397 -> 10775 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/cluster-template-0.0.1.tgz b/cluster-template-0.0.1.tgz index 8435ccc6369e534abd5498d9c0ae12c5b9564ec5..0a90b9675a873260cfe277687c8d8078da25f2d0 100644 GIT binary patch literal 10775 zcmV+yD(KZ8iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKDHa~n6(;Qq|NqKnE_>^+hq^|F`u<*QO8Ijf2vI@5OQF13{f zXFw94W`GHRq0Bh`->>kR0p>wc56im=Csi>8G#cGNqtR$IfGEj@#Jn$Ynk7i${j&w) zaa@|TDDhQs0Tj77vrCiUNE1{fSL%oqoLjSo7i<_2U-hiNz%4o01? z-GKk$Uv2y^QIccvpbB8a_&+!~KCF)aX9v%AgI@#&#VcQ6wpeas72kehAeEQrB=;@;l_{T zd%(0J6M#4dl%n4l#nC|zVlpR6Jw_PO9-!ZHj(e~a*#dJ6jN95xwGP=Bx_+^4r*oZ8 zF{fB!Q7BMD%^XwAQ37v&yl@nB_%$}Yg(;dQ7!nqt1W+y)fN7jDLY3CmsaETr=5ldi zvs6*AMdLBdP$EqrUbjC&-0`?qg>3BiHHS%lDsg_M~X@9#GX zN~aL(lu;s?uCM&5aMfhD?Ax0Ki56f@2i2{F3W<`W2N9yGj|EPbm;*<2jt6i#D`1HL zoMv*R#w-y5Tn~tZ8Q5nE`GF>5=?&gMT5~B_YBeqhY~<7YX@)W= zX&=KB@h@ZP)aHNpL+t;uz)6O=7|85?roblqU;Pf}|7XLaquu=f7~h)yw^{c$1=sig z!EiLHuK%75pY8hpQ9gfZrp*xblTd$Aw;Xk@35|=TS|`O4#YiHhp+0@;D~oFI!7Lk` z%osBdK7TGvzRsslAld&#Y0?J$I}obOFE}y<6>d!9@{fj!JPXml1q<5tD*bY6>oq3s zr%yEuDx(BxTp}wq-`Gekrlvu+#u5$4Sc_y`+trLp1Jz(_diAvw3hF7QXo}?x-HD-C&@Kad7SBxbhz~G8g7UN9i!spMbxwK&b-zb6l z*n@9eHjKY(EYdNSPsFI?EV)V$#cx?+db%h)u-Tc)c7*`2jN%4hm0SX;_Qt#c%w&{+ zzvhTaB3BhKms|oC1EK^fhl1B;rrF=(+1RERZHIq_Z(5qaSU`14d;muMoVq-NIlzh& zfj6MGYp({xAJQAdvCY35@&)2ctOT(E{XbmZ-B1TB!aDYIFZ*s4=(TB6d#m&&lr;8W zjX2P#uOy;HNA}l9iA?lbrQE0J<9mvhh$Ko2Rw@k23_?)9Q&RMClJoh-;u@&dJZpHdjeM?E zY>KIT=}q2VFH`~i>2))D+FWOG4^L-R!Qvm|=C5i9=CJUA)F-$QK3M-a# zm!M?4efTVWJPd z`4l6G`Z3|3_v7h)0bHrqr7OTddL~%vaXUo<>j_UuP1sNaIClaQ;`*%B>vS{)yhhEVp1*?kSC4nT86s4$W$^hPdLnwdt66!Ghdeu;?aj|Rs*`{M-49?Ceg z6OPR*3AiwhKjVf3Oe4O^Ox+SV7P0^|+w`Jef>ej`7E_p=N*boI!`d|FPdj7i`amW5 zSBy(LC+YE`g~P8(zzvZLc+Fz0VV6XZDM{4&$CK>C;cz(YA09kAdDg8{piGc{#<=Y3 znkw)G_-PyiiesYM1|_gyLTV2)Fz&Stieshou>d4sl288!M-omGi8)1*EHS(`WvK0S zJr>@*oIr$m*&8wueSzp0e*S02w_mE;{dGq=zs7?`;L?UVaYj)!P{1lH7GoDk;?i^z zRn(e48{u?{<5*9RROvL#V?Bc^!9X7KXKycoq*;QMf#=&#b_?B|7!^-fh$#9Ub&uBf`{TI=8{+`SB+6^8^@XCa0VZFah6>W=C8rU!oS9ESYqV`~TcBlmnP+p3Vmy%?NjzUU9(^z2IY)%P$%>HP zN-I=l*sMJ+(oC+-2|q^?HNY6{d$A-@eZp1%bB-c>g*jpI7=~U3nN!B`g^35M6%*Ga z`w0>Gg7I@r#ygT?mdgo_7>z}UN}9Yf(fBFJ2s8jy1{j)S zDlh2LZJOIZKOo*XluPh%uiTT)uN}y+`|k8@j{o6IiK+KacT!`UKx_#-!ebaznZj#9+cv{e7x1=v5W- zsGs(gqTxA>;5j@I3v_UNBJvcTWSmergYI9&{$EAc&^LIC6O05NymrAhHoalT`RP+d zQ4q8A)(f`%-Ux9J#$?Z$NItzUQKqp5K?pDyih@X?FV25GzF76OC9j&P3giOwt1xoe zD-kjj=>D%Q!@KY9-x~dIhH)vTO*3 z^qOf|jfQM)O&iCkp=^9VG#J|T5^IA~ZIiq%o2qL%#plDggcU0i@i~@ynbe11HeS;c z{eJ(82*8)>{Cju&zkR2ZnT?!@SehY@uaJxu?u1Yu{LVsgN`(4p9WmM!G`M~)OknpE zOEj_zNZWt8M3T_?Pk6du?E0)>3)=K#!+RIJjM{GBZFQ(!HOLD_$HLV)-+E8SD6~+;7P`hox3d#~>9V&v-ODZIy z5xz1z=L)QzT0!4jY;8sM%Uw&-73Sjg5vKw?f`Th+H1VZ z5aCX6y+12RD}d{8mXoc@_D%_h7(=ji2w8^d731>r=Z^cSO}SDV_TU@ch~w`Xis@-v z*WJ?4ZS`iHERn>gW{da@O?0?*J+&J1+E{E|MasZ32Cey34K*#Y*CY8g$3jjrCY=Nu zjJ4z%`o@Cm>ngS)?avy{0$?p3#^i+jW(c*vYjL(Eh=)oKA0k&jaF%Bc>NVmRNj&kP zj2t-2Q$dPO5sR&{*Og>Y%|>IR zUB%>qte=7Bnr!uN1%=C6S3DQ^Vk+KblIUm-e@wPyRVrD7U_-rEf$Fj~hKcpM>V-Dc z!j(DcoZi~Btl=y`)}dNzo5D?Vkp%UNZpe=Fr(mRCGn zOm?<8m{hHCXXEc|{GE-zv+;K}{?5k#quKb|8ugX6K&y@4ZmWyNCB<$zuv-r7mIJ%x zz+){3nty)nO^V(3#l9`~|9;CkzVi;?hWMZ3qi2WJ{lAlE!`=ShV|<@B?*A2cKzw?f zy+7}6iTnEm{&UyG_96&<#BhSE3%g3Lb^++4)U`>%C2J6UKI^A<38q%))F0*D6sG4mSP=e(=!e(hvT}F9%+T5)7 zzOX&N(WDg;NfNa*UzlmY8AtObE6K|#P2ffYxXixdct$=p0+}oeT0B6|WKw&X+9uTZ ztF()1EkCqUYi;0XY16LG*3vTd^}Mq?ExgmhJ1xA^!aFV8*86{qRq=M~znFc&^B;$Y z_4VKAXm|eOQNE4qzuF~(kFyMHxV-SsY==xybe(6loo17|aaJbT@}!!VE%iMNTkf0L zxy)YRU5Bpa!{%M4_0!vJyzwUG1)+1y_2J3J5?;P7bXDImwW;ts{F*bl-CVoItG
    ^I)6&@``?yk^GQMi4xXkdu?M;mh5nWzRF^M*S z73q2{o_Yr;!zFo{v(>!u)r_m12=7GrVMO@L8ZX<;|MmrhJ34_j%>O4xhqd|tV6@x+ zf0S?I{O>=G@i?=8)1w=8^?A1!hyH-twH~56n`ellRI5w-yBT!>*@`?$7{xC*OKbaC zHr)c{vAro6e(zKPU0zwsK~aiOQd8wFT?3gV=u0x?h*#rN!^~UG4myyRFxs%?;b%dy zVRtGeC(~Tkpu=1}iy?_3Ol3{2ml+OBNXBauqe~Bf>`i8Eur z-ASRX0hDEz8A{wfXl7qP3=M-upt5+znPgFo<1o{KUvZXUE?2>YGhrbIQW^a!tL;2V zkf(tg#e7-Hxc%AC7haCvA79O4-%UHaX=gX>?53UFwDYH#cG_b*{xq8dwe|noi_`O0 z7lSl@xH>kh|A)^GEB8N-j)uGYKOg7Y(~pC>yXU}(L8tSN@(phNN?n8~Ofl%U6p?5v zwYRqi3wC4Q>gja;^{;44$@WM zRX5l-mpLlzoz4%KVvdr67-rrA(64}$uPMp}XZd^qKYKX;`DC!~{rR-hdBM2%a!3?D zrxA0q)E5DEel9LAC{Yx5AnX{Wt@8dHsRwP+-C-b{H=uHe8B ztVxNA+^r~g+Qn~VW7@a2@FksbBqYxxnR8s~C&fTcW6YD4B41fN!Y95`?#h-c>Blrr zo4SLQudDQ-xDQhQPgS*Nq?^<9Sn}^P#*fV?X}ID zMt&2z*J)g9yi{dDl>&G9Nw?Op_Qfk*4B*l3k;3$MNjf*j(f5DS;|CFI(Aw7ysw{wRu{{wU4I$qMmQKb+7d4 zq)iNO&4hgns?J9wadR#3*3TN^ITjzw?+OR zgkSsqU6vr~aal>Nw#9!K?|X1@cF@`aChXfACvSB^*XKJI{TnP~|DdiTLsfD5(?nGU zyufj5)o{E1Q)N8b{~x0`pd4*W@o%=|7pB+0{w`Q#*{h9Idcc4@M1vH^M6WA0a^lcy z$VXtu-GAnb4`UL}iMR%p5%4lPnQtvX3QMf82#e)m3D=h(c~pP6I@_PT|NiyGyMW?u zgH_N>@G^_w^87I*sCEZrlN`D0A)Tw?4ji@OdRTr?N<0QmUtQW}yaUB$;fE#B?womK zPA2~Vl|-Ej==9ZPs4=HGmHD=Wx1oDjHX1G=^qo{X7u@ZA261b%IjGhbc|gl3CynWF@3T+pMirvoNhxYK#J)RsPL zCUE1ca&}hi474(MR=U*h#i!fr`zrj}covV(W+SP4Fg$ub+?qRmFq6%Ut)v)>S#*s# ze0T*<2!&VQKV73P@5D(NCgbt)N+-5(b8BWy6_3M?jpXqi1t#T=;^rcQZuDPrfvcic zIOmX*C|Vfb+(UAt{tec1=7JcwVl25MQ|^)(&~C7xUmluz8}(E%wp3C@unsm-e>sC( zPp1edqy6s>&cU3#Ua?$T8^YUt6k-9Ht>uCFDZ;KAEJ*mFW@nkE9SezOv&}PAE0c<; zJWCjgaSYdZC5+%vjAMuv?1p}eKD09JNw+XJ@ zaSJxs;zg9{A2ae%?azq8e+FNPUPfZnev%zoDZ=KjLPqPe~s2RW{&y=*_*m|x3 zaXi*F_YC@8StlSGSL*!s%QUJBtP2~{rQW6uFRzwI?#IdI7Ahk8lx~mE7mDRGf zV)=$y=Z*y5%B(rsMER@Ig8A^uhz2|<r(E#OVfe#{Ss1C3Iw6f3%6I z*ET?BnIKx&IfRyR8V}D>aXQv#$dYlX@*3IFrTQGvcw3gtl=)?O@s9BNtMC+x<6_6{MB_V0B{w<$Pcy;IIaRe-ydNZaq6WeHwq?cSYo zl4+Bnv_O_8cPCokhxDZ>F2fNzP4NtOr{0Tm_|iPoZhG=qv3FKNnR$1XY&~uQcnsFI z*`pLQc6hs?TW(T5IKd(`BWm`8=pQYkEbl*`Pj5%_hTX8cQ|vCj@~D1qle%FnO+7j% zB=`kMFhuSWFdbg%A$s_x-p*feu+i95#Wpwq?nUJ`(D+Bv196@i zdqK5cZaw*dOxKzIcOjkztHalm+issiPRXx1hV$1GgT}7nF=YC(XYB%s&2`idOS*Tj zco5-Pqz0^LSuyud>yY}j4vYq1oA?9fDWa9cvjw53lJjpt=5a_Ttd;CgwzCZRstew{Hz}IG@JVKOF5}{=LUYq9= z%$JytN6!btqyEcxld%bS-A=ny^~aluS?@h8Q_e+L367UlL*)hwsr@-yP;T$!EH~2| z)ZxQ&;a{fj+rn0b>GV6;j^U9$e5b0(0$uVfH^3bHTd?P1{**8z;B3 zJVJEl4B8X7LuWcRRx^1@gqq7AchR z_v}W%mQID!D5@I@g@nC)JJ~2-`jQbgg9=8)(}D@98GAD^;h$erJD6udd>(bez14w1 zqdl^UDR*@JhR6k>#;7|XtvC2CpG54q=(%%`uo9Pbn<*K91QnICmTD^%?oFj z=WjtjIq$RSx{Tr*Fr@Spb9oX&#L_HT!P^&SF#7xG`NOhZdxgdKLg>8vSh^O&*D-bd z2V+9t3Y2s7UG&VqgSalkG5Dc60=wZ5>@O|A76Y+Dx0#rg9n2`jk!%Jj_{w&ACGp|J*A=wy=!iUT{!LuPV*?G~g`3V$dmc)wt8w zC5q5azhIGQ3fn(B0DDDkngnxcUU{<~eEQq~Wp2PLugPnK(i~gk-yOmn!^i+$AvHB= zWHyv9Qz@~V8Uk!F5m|y(c8h$^|69+E0WfDtLg*aKd#LCwpM zVIE;Bm7&RIYL*~eM{6lW1qr&uX!zHsu8PwNN+KXaNt7pgDL3OR^$|~1tK>9RFJw{pwN2(U-6^5Dyht_gxby=A}Ea-U=+X*k-q_|hleAzNj*0CT; znbfZG7F4Gtz?vD=21uJbcX4#kcR77KwVwVoDR&X=Cd3|~l$3L&0udRL9jdvI_x?7`u1*i!@c@MQQ@qtff^b6fhADLIB=S&up8ikBq9 zPy~0YzwGqAALHe|h>`1t3mWlNX5{(e`w1*rlBd}2GO9#{)Vb=RD96D z<@!=%e50){l$7_nynp)=o)l-f7)@4+r&*pPD`l!AWJYlORAV+J!lt`CeN{U-+5xDa zS}lv66QPySWb)FCX@QMi;aDHXQzAjAJ_(1tyFNW*sCM+(lqgPG2gj(()^|}Q?m4vb zn7f8~grkhg60M)gEDX}U=3Li#4V5SoUQYmzB*TiZYO zK1H4<*c=E5Pamq~vtQv`jAA7qL0{CvKf-6>6q3p#a=!e0xH_}0Cm^volS#3D8M~lZ zO&n?xnI&khsI+lOdWZHWB%=ic;avVhdLEsx(6!l4Gg^e;SVw<2J!`HzA_}pd`V{0P zmHOr{UA}xG`seQR;qzg)2i@mKM~7Y81#i^IQHDHf*g8=*y-BpYGjFQRSmV+ThEO-z zQ)^hrNyelbVYRXG4$YN;FqjXN5R7_ywLa=y8F}L$%)c?$5p*o1WG*7@zEOC-X}1I(Mg*+ zo|0HKUS!I}EJ+YoWfjzwN*}{;aO}5Yc(tGq3$Qy8#dXRyT-DU5m#MyfwHn3zW%S8B zI|yZ#7{fr{D^SX+JyeYhI<>@2$!|FJ`!5&xVk+Latj0ck!MF{D$%S1FHOf@!Y%Jau zUpq3rps(^hM1M4@^}2>ETK@?d-~piCv={Z_p6+1h`Tcf&zn$N2=lA;(em`w$ z)IEQ9JZE4WgyBhuT4<41!vu5f&b#7-MkGT?5hHbZ4o{eMxAkDk*^R*5+^tN6iQ6DE zEr5kb!mP@pgkT!DKK+c=I`B5f0}K}GJ9Vld z^41YijnD5@)e1L;LaO(D{tW5&L6n*2k!iVJAdHLAGq@e?)-t<`U8ENqvjTD zzZpws+jQR;Xt@5X1I{T_yGzWkqXWTqD<=|hGsbP`KTnJP= ztA21$=DDkL{O})r?T&GrvNT0~fiuLlx=Va_&ir4V`Lr(0ZXZ zdqJ?x*EZ$v^tG-3!k32cSI36+-_h~Gup0mI?BH;>{(FqCvi>VCXk54W^PqMszm}EX zZt1sM`t6o}yQSZ5>9;1r%+B^-v+Gj>WCETfgytW6a6@R!Zp70L025=-sk_MW-Ev{KT-Yra zcFTp`a$&bzxaUrhHBoAtM8#ugsj?k(1g?Dy4sn!XiMcuaYyu1C`Uzn=V>WtwHrHVK zaK1|D>!rxRY}veje|i4hySMKzbk^m}JWaS@OxVa%9WK1eFhmJcc204W`9^iLg1$i} zaL@n{QM_Yns#mEmI7_`l$!=eQ&CD%$eZv(fs~z-H-;zO=OC11j!gMEZ^rl5WMiTvR zc%kF?T*&0q&i%&t)2PPqyA_Q+zXqH3UnV>~sQkafrZ!oG5~&HwkX$Iumh(jK!o;!q zr)cS33FN|d)$F9l=@bckas-%0ELM{ao-vN?jRz&!s;07q!hR^)R%(yB$ZV<#?P+ayMY@#vl*;cy9c(^w`YNjX#Hly#ykj#Z>qtW z^~ddgZstl7u<_NwJKB2|zD{by(o9YG z#e1;jE4L-lZU~w?1EiXJ<3VX$Ofj&ONE=h{-Y#{`sBcR-e>>6DE|`#FB_vMUTW#H2 z!DeRg96R%>SE0eVH%!XpR8xS>6XDGt@v9-Z)V1xa?BiVTQ64B9c_{)#aC!5PrEK?+|zx(Es z{pA<`ytX`Nxm5qok;FG>_1!n0?5_|-*tl;#ya9vvP2$9Zyh-|pLe VyYF`2{|^8F|Nk0Q_x}Jc0RUH#OC^dS!i(C>TB?Et7vO;E9p4cnL1hcXsS62$yz!% zf?amMxfAl-)Afiv)SVV3$8-adDJlnzSG)nK6ythY{->D@8aJgaUj6t>Cqs9goH#D<4^dAMCtwrR$Pob5oA(Boz!-b zu}C^g47q`d3=c30DzyQeFgUr)J#f=VtWsSIx&h1#TD-}?xDz@R3(9&!Yaqlj`?47R zTU0w)oU#em`H-$;j)giXz$v&Nd@#p#j|aG=#>GQsz^6Fa@4|NOe+Bay7S#OKD=wEX zT#OLR{17DQ@2Z~*VoiwncmrYWhGd(N{UG|q7u^>ZoS>wmzTan6i)g~dBLHR<)6uZF zy4Zp)EXI)&g|bG9`TFU{Q9zr>zX!66d4<*`kr;A~tE8d>51~vbrKyBvhn%2NjWbU| zvcmf@qfIr!p2YVrbPigwJ&EaO#&7In;`o~`QJ&?s9lP(2ZQo%W;v4YAP(`ow(<#0zNvD6>e zMlsY52zW+!dQ0fwi>Se=z(&O+4qsr%0=~#=9?no%qfxUYG19zDl*tgg8!gqtBT0v|6M zfkD<#FBBV2hDZd7F-#}#%0Fo65i|caLZ!$LJIDHK?RvRH5e4<(+nF^;LAfIr5^RsD zUt~SRaX;q|=Ngx5OR0u*v_;OGRQYEmfro_q4vSn9RA&~wHXJqvwHzviBsKt|oN+3I zvZD{OEep3^5=@z+U3)Mp3al1Za)4P5V@%cq(g(&ZTI`Ojgi&P9;!oEd)}ty5v_cIU zScp=7hRF0O#PT3!26+#_A9M?F{PGqV+80UV9cROZ%oI|@UMmAt@9w{Y%z*wK08swH z<{XIoV!vwd_?xtwm!H4t8Dzt`^8(WF|6Wn7CO@Yw{4R6iI^RMgz%^)Aj-ihEC27a^ z`q^H`S=BG|*U`m%q{8R+O+K1X`=uH9nSECn4l!~lW?)^v$&8#MS|0% zKcb~uzISWHH$LX$%^f*xf=-N}b<9r5(V+xKYq4OnAR5NPL9(&(%1*vC#BPqO`&}Oa z`U&eDZTLRzj&Mv@yvVZ?iNym}{SQO7ndcbUgr*qklS@VuqrEn`{U1hs1{$?0A9fcv$MiSJEG>7pjld_P z|Kh^uFie%f0VLbO$%wJBm1PNq4vamTT2)apt>9^s{|9S1R4Zg<_yLm~ zoRR;S8I@2QSvyfA{rh7`5jI71vV1B+*pD!@CFc^XfUINxhUPXH1UXhHD@s1GT7zt~Ei{wlC@r`BJ6e~+bnWV!@?pHp*wu9G!SUQQSJvR1w% z|6d?ws^kHk#p(c@b9SV2xsBNDN?}=4{WrxYu%jX{b*`|r%%g~EUN1Oe`s_x zqlmL`g9%h_HxIOaOak6bp1A8t^m%{-L-(W9LKt#2A-P2Epo$0azm{>77TPNgP7^Z7Ce z^wI^>Irlt6V8avAV0!AxB@cPJFOgPSQ-y4EfutFF0-dDzpDQGrk*j5Wu?AT{Cv9`v zRS0akuRA|@M6?$bRv0%!kN(J^qjkjNOUuYA$ts=c3qGj zpqQKJ7AQ$AhmbtRcw_77M(s1UW&F`6!norS3UK12p0Dw))C(s{qKc#l&-o2&5)$Rb z={zO>{2a1v^8nK)6aR@{2|>%7tSe_lz^pOk%y3UlQ6xf;^LUx4LFY$zIK{%tT}QRI zkTD&Hj>;DQ%Fp4cu%|l)F-PPU8wjtSJ0iej>P2s>JCa~GnbCWxSa1QE`VYXta+Otb z5=%l9s0HB^Z8%_nV~*TO5jrJX}24YrqggKvv6Kb2Gxi4i4opNH~x5A#(wIY0P|F z-f`eWU*b_zF%1Le0Ri0+LYf>2ItG&-J`EeaQBBpBs|Y%E+@bH8@)(Pj%w7Hz!U`Cz z9qxJsLsowYew^c4dbf)eY!`>elaeuYlEJtv%7V_^)<9gka$htHA=EEVA5FQ=1Kd`V zmNK}tTsg8Ae^BuiVuT%wK!8%#3>o+YGy(Q>G;#@jX}7%FmHw8f3#aV+_9l_HJIL6c zR7mJI;N1}l+C1do>$0M@Mz3F*9`gMJjxu`pqpr+btsZQ+meU!utzPPH;n=J<9Ib~I z{3vhU-KJd}sV(t)?MpUSVnbI|g*a>3MQaODri_pJ8mX~=P z1V=gM1U1c}w~no*aGYRTGkBB;UV+Nh2R_Azt ziI{OvBwd~}INaU+jE8UTQfhmD?{^-KKX;H0`r?OoxRU&zRf`nOks(Mm*s!4UC;&O2 z4#?_rdj(@I4eT-K1v-Y)7wZEX|=BM4D@iE}mTJ?yT zjbyiD(55;-WO^zqLG8EeDx`h?`o_fv15`bbZry>NbCr)*G$_q%BY1nHf9RWau3m=i z>d`4jtBUX$qmjpRS-3o?l?c5dkg;f{bP zi27j=2nh67Hv%OlNPj$m=zA9C?P*2oBDVLnajk>I9|*TvNvKx#HazAF&PB8VGWuN^ z`swjmen|4sWz5vr7Tkls+nO8yhD-6_YL|79bEZp=@s#S+w_Kc=nla4N|X+#*x`0OtR4$krwSo zj&6Frw^V8-QWxrBcTc5rKAQ_Oj9WannUS}(okzwI2op+@k$)+lR&dR| z_6bGQQIYa0q!gPWjr$p(#D<~dAxXmypN$=is)S|B@u*x*= zR{C1WKxA=|JzshjC6)8We4qj|K*(Jx1<2) zt9v7LwfZ;=l)-s7ie!2XyW*c!E!L(|oZ2Nh>&KNUOJr;CM)+m<3oNHhMo?7&Vm~*< z6vblay9{>x}LoWN6=jDqw|N z#eq-%Bld`08vFjPZDsQSiOz$}(5SFN*3@x1Lh}c#jBx;8$#pQHV@xf$BWQ~F(LHUo zpnBbxBdbUs4K}yz$E3lySdYSrpX6b-huDx(s;`Jbh`LwqECz;=ccl;f zAJ|&?0O5BYY(EFFe}uk>BqW@F^v>UXe~c;3DeTINM2d4d_P4U$y zOpR;=P$v+TJmyM;OTTyfv6sT;x_hb5@g+zFpt%!- zpQ!x&zPspe@YKs@e7{H+w9GpNnx0(X=18KI(%N|OnWnN(Z$6@*%x;-sSszV3NV)Tr z7`BW+buvfh2737L4O47@X_s7d1J8{LkXrv)&M04u=xEeFO8`Z}Nv+|6^o}fBpLV6U zddtymHs3(8#f#_fA|yAnp!|QE9p4{`?1IzhyN_doL4RNWd=$*!;vdj0-_L#5PDr2* z_0lA<#QA~QsxlAt?xRTZ-duTWkfXjoNQ(IC!jA#i@rs{*H zKl7o7)iyIza;Dt$!cg3w-ovP3*iyMd46S(C$noo#ZCQlC8rjD-OpHXow`V?&nWF96 z6pJQ|e~>HrMFuk-9r1vg4nJ;6i8#)=W!jI+KvzDc$^q1i)gzPT2ALa{s;C!*igZlW9c z$jH}6{#rkQtjjOz0sjYjgEgJ+RM$+?bvHrXy@H)UcRty}(M@xQbr3RuNb3NUkP!Lt znyB(Xe0maZc**WESg`nJ@CH*CXw4{&Wrg=>?jqZi%FoLiOx@XB7w^Fj`aBV_mSqxn zmjVQsbIKL$vaUS1@I?j!VEe-Q_y3bIpQaRvVjb6==P;2p8TkV{XP?3J$8_{jrZo2* zfpCTXD9S8+leh}6!-H=x)?pGivnRPTj3eEnm_@fzAsN3@QJ_}eO53`Oi|EWsgl;?n z-)xqMSXWyM=-@!N%aDH)xDkr#$$Z!M`Qkzs60(G`hn3<_1lFVM9sqy^P2|^G@7?WI zpa1O&RL+2YAAWr$mcPYZ=Xt!>i|1slPJL#CS?UhLmt5TUU*X}h_+p+aUlH!O=?Nc| z1{%E9E)LSpc~;FEq?lnQJ*?)q5aFtX%GN+4jKdpwfZ<4Moo;0A)TnOUqjbo4#jico zCvk6_kA8LG-e%LIPGA$^g>uoW{p!R#Qto(-ci>!G!RaY-PYD0#L*<^J@K%C1W*g_z zsQr)8NbGe;XToUHjruF&*jB^4{+>Bj80!w~3DD!6F|K_t18T%j0kQl`gZDUl-CPrF zhCTVB(T|5YyxV&OX-uM#Hghj0LZjf$FFT{LzL;nFMYgDF#`!ZCF2wpSO!_VWs^kv) z<%lOFdKi`yXkzG#p&TO^91KM3 z1TUE(y^njt$=lx&|2Sx4zr~KF{QSmi=e-Ys-}VjzZNB0K6Vn&k+W z%HBUGgihN6=KQvVg903;`8$;l^NLG+G4;r9{;=A!von+G5!sw7RB~|JKZ)}*eP3^t zC}&X0*zVm9frw%oBdgh9=RL($B**RDZ<7Q8@ahJRX>srlskXTMS<_!xdv++i)Bgw_ z*A3vk6q1JoA*(&Di9WV9|0Fp&&W)t6V0)V@gmJr-mbOK%u%D)`ac23;2k^%(7Wdaz z1vX8*4RFeZLATqGj;?Jo7%KH#s1-}g*Yks#b)WVCpel=X&)U4g^a0<-UW*m?uhfO+ zlw$oRo)o{&?R=-J$sz`L^vM8MrHW5)XVhL?h5MU1d0puc(MCc2F78$aqwie(J(RAj z(e{mY=6jID>wisR3138#p1Ndb@YxR(37&j#wMWEj1vuw*t->4S-xxkRHza+z8c9bK z9bBGNRv`gH4rhw?oxaK^fK4EPw5urJM(V+?!#JyA9qBjIn#KAYH-nIgC`qAMjCs)u zwgI2(Dc3*D`ojaj+h8O+Jg($c@B|zXKbOUeL=-{cPd!}hkt_VFn2TVQh;crtvWP$E z`Mx~(z$r|7PVtr@cJKUvURsqI#$=J#Z67?ha-W2#`M}pOP*q+KW@g85-KqAs3OwH(P9L+w=)h@7*W* z2*W)INipD7MWkX|gc19cIc{hF=}|A_XkPF$UId+d8K+Qr=}W)N((lA8Bm3FA9|#wE z2JKg1D{9*SdGDprETp>@NE&X|_R~GK&NbdU;;(kJ^~`q{2|y_x!_70`^b*YxbM~)B z_&@HwIY^*qt$k;#AQN+tH{RlrS{Lh7jhCmI#ZETsO$FeuRNIsq#ER>Y+}dIwIP=z7 zmw>!NKG$LXtrnjEt1^r}z96g8IqJb;?o$AEV9jR4sP*6EC1TV>0E+jqGGNNwy_k`H z#0+QK1ch|Bk3)Qa`el|UYSPbD-S;Q3t7|@*d21^ZUt@T&-kez1Um`@V{lvu`g}wEi zwS8#0P#fhc|*_}od&X6N*>o+~F1ymD0(`ou>*$zLnRtj^fCcf@r z%@Same07o@V!{UWaR;4|-D;m^?Al4yX5p`$j?ta^e9k#sbA{PV+6AU={UBY(a;uW(dZx8)CS-PZX z+~4q;r?7nH_|mF5rQ)hK?=Ygi-I<-BuAFa=x9|Pfn>&|m#mo)r3HT@Kg9bf+_@AUb zyM4n#%qh<}2C0uX?rJj>tw9=&&A!J z<*HOX?0-EIu#|r#>lId~eMexx&G8Fa3G$q5C=dS}BX^%AYX#FICR zkUU3@eyNljl(#(fhkL)XmG!NP`wcIjp)fm|j{%#4>NGl(X3(?a-A1Y*3^fUAdfn5g zfxlb)f+pn3v?A0Y^>TOeZHQ4%6f_JwC_S=1@vl|7Pfl)2eJZ5h?{pj35euifL=;*` zTEPUN?K^YSV)z6)HkX)D=}B`<(5uk7zQi6Ab=1;c04!GC#Xgg^YhUzUA&LLZgtZc< zQw5Ee8F=_WDGa1vh!CaQ3PO^JyGxzxh$9B6N?H!F;Co`4*NqNtBP}ei0xVgZwnA)o zS(_@y1H8lE^ttJf8cc*!xYtf6E0kg8 z|J?Z-)&utO@A=98+cwa9`PmR}*ENk%)&1f2(&Y+T=Fs`p{hOhlg0Y+;vY`KA`+w+E4vwS#q<}o&ggr>f0Z^`$+q?GVKg>K=0+S49f z_b)?3PLx~_V#O#BcWuKjurBBW7Yl&p#BeXF7unRk*|kXdDsW0@Y!Nz zU_CFJO_P*1`%!J}E=D`m(wf#)&i&MR;&htNRnZ7h#$)}5bPztObU7>RVE?U)M@KW{ zc8AMF*s>(g|Z|j5Y z>zgJRZMXuI0x#G_0%sVPgo=gKxSxCq_3hp^pZR`2Cvno$wh&qD&WuXi^I>wRb&>dg z{>k!q?~vTzIKySaP%{0nhTSWuQ2K2W+LQWgfA8T2S(PT#0ROlKUEbXxHOL#@9fA@P z7{9bo@=H&rN3nFs$ri4DSkeMsf0Oba66D;?4bzuH4PS`JcEMc2t4|>>Sry_?rpHXn z55GrS(-%NtnC%*^pQobS~4?gW5hQPns+j96E zLD*&%i3p$YO3fIW>}su0m#dmmG;FF=a4S@MJobM{TDWy>rUEO6_sm zKV$Lh%*0r67jBx)x7K(Oc9^d)|8r{z!Ja7$>$(*@jTxF$p_^WE^XVK~;*~@%oF+={ zpTFJAb0SO|a&qP#mXe5pqlV6pq0u@XzBQ;rmw%SaI>;c4{@q-SsPn#VrjDTy1Kw5q zYyK92NY)@rwd?vyabEDmE!qe5m`QGpIYCQ;flb4)P%5p>H@I@_DyHuCw4r#9>NlM& zfzc6A978oZn5wcTxOTh(g?+hCRy_1qlH)WNo%C!u>XA#X=u3&;3pi^Lb;1MGXt0$- zsiS)Ww}B&Z|KN#OY0R_F9CxVDNSLcX$mh4UlDnx#Ydcy(+Q_eT>rNzZfjK|2dmBA` zOB}UzR=cihPs$9`2KI}674#AIxP;IK&0iv3!t{btZ`Asx8K#Q+5mfLAe#ldLoY1i` z?PlujnP!#F*`$KyO*txd33JVPlr_I8wXz=(B$R$jDDX9R{$V1+c`UlU3SV_n6RfcA zanhr`&_yd%wA1iGton;#G8kh=T%x3^OBDaXQtq6-@;ATyh`vZDoEI!5*{w#CjKaLJ zOM&oY>-8H0fxfU^^Y4|%TG+hq*UeEq?BSs)YC^J9*~w&1Kd4v#eH zJH@QiMS&hM&~ET$nSL{fSBD}MXUJo?5LL&)k;mGbKM+Ih6LUphEUzh>TlxJtok$Gk z5MwwqB!g^t&B`_6t$!gdhrfC>__2EXr)_fBrcqmP`hiN1QHz?~J@oK|;4eKo_xAF7 z_Qv!)is;vho!(_A9CKXR;;NN0qQgIg(Rcnl0*vtUY?rmznImoO>{%?3Ib(k z*|H_a8qgXrMo^``9SvCiRPQm0O)l3b5>}n5#aX zmMvu7Hk&u^moAsF#l$d^9GZ?L_ENKaexHlWL8}>_zG@Wp+V3ce^LkGmF0OOODpo*^ zBzq9PPvh9geg?HP`SqpQX}VZzt+sv^Pt211f;s$;i~r)LSCn zyo!?>$63KSCo^wR=Zz#!gm5{~NCKw@6o+&Rrs}*B>+7oWQV)>@_Kxba0R&y$HgAAp zcpFjc%(K6oJsyk9Kmx>hanH}a<*!xGB9214HXj^lex18J*R8D|S66}m9|a6tmutm$ z9Npx-AjO5Sb-}B-GvC`~nAJ}Etme!`SoA=G@pi2qOMD@{@mtGZV87)w6@m*~9 z*A0D7%ol5$eb+b=9>jG`h<76l$>mjupWogNNn0!I_5Y>SLUXHpc2@n*W4ipCWgiow z60dbAyv3@_X&C@HuH;mPv>N5GBY*R?3NP!jTyc(6Wf@DniaER`G?H=m#6|Qp03rDc-M8k;&u4?)uNCLsr%mUt z|3_P%iVKbRZ?5|uEa%j|9Ek#08F~=aoCn&|?{;Z#)%RJ#DxIU!jfZHR;f1edOx zwu8+o4vVk5PWV3y#{H7BYMWtDtg21lGsEFzaRhbi*9}l`h53D{vo?e>0ua9EJZQ0Ax$mV|6MesJCeH4p@D+a4LaW2K8Hly zWnEN~wpNBgFvsZF**wUbij<1~u-mS;q_t&Q@NUn~S z7t}4B@iUf!1EO(6%`~`AJnqjHX}!s6%9@qj+~4T)xVipu3E%5K58?vFma13Ds}pgI zj7Ib#+Nr!G3MUM+OFY}#aItzmUK!eYsf>^)_CGGtc{eMlLv76{(@?a}m=AyjI!lcF z*3@^#;l&JB%!!wT8Qcxk(vHv@16gVNZFgkFs F{{?bXlFa}B From dad1cf05cd03648b6c8139550308f11d5a91312b Mon Sep 17 00:00:00 2001 From: asauerwein Date: Thu, 12 Jan 2023 17:26:20 +0100 Subject: [PATCH 8/8] feat: apply additional tls san --- charts/templates/cluster.yaml | 5 ++++- charts/values.yaml | 5 +++++ cluster-template-0.0.1.tgz | Bin 10775 -> 10827 bytes 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/charts/templates/cluster.yaml b/charts/templates/cluster.yaml index 7fd929e..df9e3ea 100644 --- a/charts/templates/cluster.yaml +++ b/charts/templates/cluster.yaml @@ -143,8 +143,11 @@ spec: # service-cidr: "10.43.0.0/16" # Port range to reserve for services with NodePort visibility (default: "30000-32767") # service-node-port-range: "30000-32767" - # Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert # tls-san: [] + {{- if .Values.cluster.tlsSan }} + tls-san: +{{ toYaml .Values.cluster.tlsSan | indent 8 }} + {{- end }} machineSelectorConfig: {{ toYaml .Values.rke.machineSelectorConfig | indent 6 }} diff --git a/charts/values.yaml b/charts/values.yaml index 09f9d09..e1cc9b8 100644 --- a/charts/values.yaml +++ b/charts/values.yaml @@ -9,6 +9,11 @@ cluster: # specify cluster annotations annotations: {} + # Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert + # tlsSan: + # - 10.10.10.10 + # - kube-api.example.com + # specify cloud credential secret name, do not need to be provided if using custom driver cloudCredentialSecretName: "" diff --git a/cluster-template-0.0.1.tgz b/cluster-template-0.0.1.tgz index 0a90b9675a873260cfe277687c8d8078da25f2d0..2c28b8913a24c6b15b8801422e5e4cace96bc956 100644 GIT binary patch literal 10827 zcmV-RDzw!fiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKDHa~n6(;Qq|NqKit(_8v)*)Wcrhm#<2ZIEngJ#Nh7#lWf4{^su~1IJ*^7K%;>M8jbEo1BjAbNX)wur&)p|-anlq zE_+LqCVzXVuix+Yj}H&^zx{r{`fvZBKlt0=@Zh-LKNt><4*u3393CDG{|5aBYr&c? z7ZUNm_3vF*mAF61hbUzdNy4ZYwE!X{QNm`u2uYdX9%1_wrC4Mr!Xua_7|U*qrzlTk zBd}a%cm!3RYN3pL#9R7J!+ej(56x+BU)`Xo3^b0{deGpFTGOdh)0R{$FL0lQ;$x$3!Kg1m;XgEu?^P zxVT&#?q6IkjuiyQLSO+%z&M}$4~`_9BocFqBw1j1W6DsFa|{CW1?KSn)fghorLIRN zVvMMvAD|0^e$V~CNW01>xQjB_ALrL<#Z;BiaGXnV}z<9(5ZHPILYPw+-8k* z51XR#2&O0ziWyTB%?ZV0oZv_@e#+>S%na-vbRi1hj})h^#}c7a%%!LfY%VZ|j1wA>3?)Ef zVOa+WL1s8sEbk^%iqi?^qE$@v*Ct`qQk_yDvHYW(GTPtIyT85oEjenpR8Mi1;P-Zp zTR69D80_s9xIQCTxGpvwF3KMN^tt${hT05}&%UZWop~b!5&Ax-anhJasK8Oq@%V~l zA2BD>B^Xg3Oikleb)WI(kj?GWt2#! z>nndMTs7V;$M$+oqB&S4M-3~XLZT$;K!m6oV}Vm8syL!E+=Gj00ZRnnG?Pm;XNd^l zIzS{`lO%zRL|2e!TIi|q6w;ON>1Hgv$s2HME(J^N+5iF@{xp9&5jkaS1QWz}I@urR ztLcC4huHsRj*|>?(UaNzRKZR5pZXo@f6x1egPs2O7~h)lw^{c$1=f%Mus;|c)W-k$ z;comNu^vkWS*O)k;KGiU&j1r{L zMWPnZ#!gzHz#DXH^!uP0Ymuz$yPB$Qpc*uIuf7$9f_e(Yhhlln_!VRc;1-g zOPx9b$@5V6;fO|a%wdj`6rwre(kUD<&Jwm%HW8H!Vs=f1c@jI57kuD1NY<8xyT_FH0qqqTBC6_>|zcFtBGZ`h|uQ{TU$Yll0 zC6|E3geZZ^so?dQ>GpScIs)McaV* zV|tA^w)uBMK1Y0k6(csF|EJ5l8|uK$u46y*vhP-bw)mU+TctOlq_GEU*nvh}#StrH zWOog>Se_`enW(YS+i`{Ae3)vJGL#EtS_K76Vp%9AB1_QnO`Vs$oHdQ)EJ+BReaK=Y zJ-8sblYNQe4IHp2xq>%{sU_57e62k-op|E5*cUc;rwUfdo9Q69VLBHOB zn2Ml&SM?c75uqNEcHvN95lY$(m~@E{*_#WvO!67g&URyGc7Ra~YzmZ7tR3$t=|Dsh zlBYp+Dx;_-qGSXSN=U>C>}O_o&!B}2MOSEsV~ALqF^Z`afM^UcPO!v)=(03)J&>mh zl#m#R#HkqR*ody}?vDA3&>6=fnl0;go06|eE=1htLP$hRQl5UY*MR$IaF@X&Z+Y;5^Q9{&gBUEBOMT&2p zo|*17<)4MsV2#C*Qg1TXJAX@sS)c`mcv3dlL#^1uM4x=~DMk`?W5Pf0$CLd6xKgi6 zSAYTcjIq@7c7g=f3!dVdu%mi#<`^c#^ZlefXRmhGkl%0&(*(`5C~|x9 zc27U!EW)DX*D$+__$-tMt1!9-t-x4hZ;#O`@2X6SD4MN8U5BgH@li<#rH`0B?QrP; zG(&_6X(JsH97(JsGmYjc;#U><5)siI^o~0A$1#*6lyPPk9Gh1*;M_R=j2jX#jrcM% zbxYt_$O6y=KZtG#Qk}+IEMayjX;{V%YRj0v?2Mr81C`CcWL(-cNzWI}9DY>-u8Ew( z8x~^?yC8y0NTTc?kFyW@{eHiDFnoUeyj^dBQbD>IuPSEw6R zy(=a_rBqa0!8LAgTV#Wp<7+b2aEdx^euaCDz-2YZu9|8fh80^Z#xA7DrRmP92snRT z!s!IZv0f;tl5UvCdM#Bfg1j)F({~p@(k#JB)$=te8=_#!c6m;fQ0o>u{$Z_e7npMr zW3XfG*Xl%;Qb{~sU<=F>w49296ErWBz?CX4E?vx$VnGxyFqg#gyXuT;-;hjkb5H-z z$Ma)8QR;+ZVwNm=s<*YW>4BImC0C}EMy!%m3SlUloODXCtVpA^GEZwHD^Qut25diK zPH_S#IffH4r*b6E8F9_YL&JAs*cU^ANEUAHQUQrA2+Z4=$~c@;gt!+!g|k{D!M8TtY^b$T+#LMVqVmZ zx2<&>{9vQHwk@us#EP;-EZ4ThZGjbrW}eMBit$)-B=KzNX!QMsXB-jwHYD<-Z;_7fuV zCF5th8ShDoSuV#oVl);ZDrxe{MB}mii;;WEXq0n~X|&X8&A06a7H9yfOfWRVRG!m? z+dj8{enh-+Dwp8luDQpZUpu5>_ub;#9RI_aVo;MfAv7j*cFT~U4e?)tLH{s}{}~?i z4-a|E*}7_VwQ31S5faZ(OjAO>fw7e)deYD2Q2l z=Y=qTZ3QKqwcL0~nQ76p+)U!4AW)V3OH+q`O~Dv%4zFT;3nuS7^t zAo0I85AVLae{1BwnZ~h>!@AdjunqEm_`G`lbJ!maj(76^F}{j6SRPaGjh}6VyAijq z4bSL9#0>(rMBj~g+`V5^rDn_#v~Ad5H$-mEq-4wq}NT0 zYBXeXZ`wFU4P{SFK!bW+FR?Z_)pp67va8x=P<%R!OIVR25uahHjiW9EtMQtV=ytnb zgaN+P;NN@T|KkUpOl{;$#L^6Le2HWweJ=px)IBVFJ4+SfYV7 z8}0bz5=la5KjF!ov8&UDEod{64HKrQ%mV(8VDysdO{2mf@527IK`r+C`%^@coa0Lu zCVcPa+kKF)M!;iD$Olut)~x@O#n|`(yXg8p3c&jHe{k48JgTn$2gBX@k4O2+z`L#D z?i#GajUn#-gyvVcYxjz*kGbifNj09YzK*PjDqFd1)S`<}N_5*&QbA@jJc(N?J4sk{ zb!KJCYeI8rgnUza1^cR^>#B?Kf<%RtR{m9uUJJlHgb_diP=Ac;@R#_(I3=y2SHJk;=I#dg-Q@CZW{Hua41Y3(Ri_GZiA5}Cia~%eyIjaoyZ>7A;@`{JX zWNVv)N!1#6I{r?_-|6@}9e=0e?{xe>n~uM&QeUwJR_gexb#>8bQtZruojI^G2X^Mb zW0?cZKfm@S#qRrJ-xK0VIf zpLe&!{e1#|T)Ws_1fh=@j&aqntK@1IfIdoHTO?ev2GOUo&g$!1nW5beL|iqf$Szrf z(CV@qn_C$$T@cP_iW@BIB1Zx0@i8a(Pg!1ru4ZdvG)1*LFm#&AEYEZY`7T-8h$c4a zjEJjh>-{VRO4(&TNl0{&Re7$+_?kAPwf!!#W)-NKZ44;Eavou0T2##_FHftR_0bo0 z`n^rr0`A(@1*cf3a=XdKZjMko&6WHFL?gr;Gk~* z4GwnaKOW`VX#dqN8GIZwu;KE;zp@@OLD5y7)pnXq>c&->WQ*f!UbfJ;FKoGQX4f)% zfp;CcmJgeEnbt3FxADfCl$V6gFxQ7C8%uckw$NpL$JD06@9=BRc>(3s`q05 zm6xSWZXi#JsmtVq|k zcxe|GlFp6Jtme%&OY`O)? zV|za^{NAbpy1cTMVNr@uQWNDaT>}{t^c9(K#H;bCVdgDY2OY>u7;V_{@Ux)Uuse~G zlSwXX&|$7##gIf1rm`m1%M1r5B;&P((WM7K_9nAcuuxBdBZOXXF)Bvxa4IM;*y*|cNlXIU>r-ASRf z0hDDI8A{wfXl7qP3>AY$pt5+znPgFo;xN;JUvidVE|yXU~ML96x8@(phNN?n8~OfcxT6p>g}YHx23 z=Iq+O)zfPI```bbATe+07rpg~;Us}>x6p?|bqKm$eE}l$_LnT@<_~l89Hh&xtFE_i zE^}1aTdf~3#T+F?W0-jXK)?M_zNRSWoaM7Q{OsZU*VEp<_vf=#>m}pfdm&Nyh(^rG zLSF>f`nkBgphQvJk@u|C`uU^LBE4MSgQg(-&36yX23jeI!h`H(hx>2}N(butttd|F zJljf!)#krGq^mmcJ`rExw|@Q~JU=+9&i|vs-T9x#`HJBlwYsoCoS3%&eY>W-)^Y^t zvV3qq#zlzc2-;)&hQFMb58p0FbQ+V@sBfo_p ztN8160CiWcs$cWHy8Fu-eF;)qZRU&#Y?WzubvT>)HNnLcaGJ>_=)Knx?3yHrc|=+3 z&N%jmsaPRb^}#B-w63@vSsJvFDlNr5w2nZp#5!*BTk5y7*gfp^tLn!}IbV2wX|Ny{ z{o@FGQ-!O^cg;15Q-am`yJFRY-+!-U*>$d-p_jsXvcF{3bN!Xl^^|M1Slv;-=7>rn zm;Q8Hy)3Gd5V71B*M!Rd^#1Tiv26Y=dI`%Y5J;9ri`V8>rOSU(58Q%Q^GMukYK#0o z3BC5!yDUM}qq34(?TbGc?R#*3I$YTUChXgrC+~DZ+owAh-D@mlcUYH^p{O|dX{;&( zUf{U3Xt>?@sWM*M{~x0`XgS)p#lP8-U%0*g^>=}hWv@0;=>Y-q0QFKF6Kz*)q{N}u zkdHu)yZ_8*AI2n{5pe}7BcNq)JlmRq6qZ~(T!}o8_-v=#j zH)sXT4PImsT%0`y2i5L?Y~mw#J*0Cr+<~H%xE_`sloF4Clh+rv8}HEKvhc$;(e9ji z%^Z*a2`Y&?7tqP;i%?=taw_v}8@>wN!;;Z(38C+#(z)Pn?=y(oTdaN|Nk7f8oMR4> zfvFGv?O$s6?@9&QgwYmWNADF_8qKr$_=X6nOoV!)?$$Fa%sXdcuCwm~eh4m83~Zor z(9*&J@~owr4Hov_2cZaFLAk}(xW+rj*-D9Lb}+pWUyO|sa&fuu{1B@qp690so7;dx zGw|Y6*LE9uSbF|$!P8}of-lUic6C-{-kB~h211iXxXe)kHZJH<$kPE6E2z_Xx0IGX zX(n*vt5SAa>(aZpyt-Zm?|EJ92?2wI|@w79ofxA23_mF>8PIO9U|b%$^)~9MqHL+83S$j7w*F!Y zxn52YP)57o56{4yyk4?gYa7DbeH3C2nXTo4=_$gl8Z=1wp{8e>RVal`*9f>b>jiCi=pJbf9rLZ2ODJ=}WUpde zyWJ1=fX~=~8dghZmQNL-*r&a}N~}eM&aSIS~-!EMZIi z;OmOcQdQ`#QB~ZzL-ydGC+|LQ*xw{m#&(HvLVb>SY!+Wa;fL?nP;o~O zr9H)1ZTk1Qs5^^_HX9OD8wsnCP&CA}+qsG!w%IO<*|#t+KZu~Y8{LUCPbZkG?p9?r zZ!KBAVb!@~gKwqQ9Byj)>r#XH_}Z`rJT2qO-krQ&r^wuq1n8sU61B z)T4942EQZ;hR9t4ro&4;L=WH9+xZKI8|9i82{1*QWYstA=XlOgzsx>mDs!Ngz0JG;^8bmlg# zfjG~My`Wl~TTg!=lXa^9T^dgV>+sF^w%ezWQ}Sz$;q1-Wps`jwhD=}ftX&|nxsLi_ zo9^8!9z=K+sR1dPSIqs>I;4KB1ET@hCjNkVifASAbWSL$qIOk<5a_Ttd;CfdzCZUttXLe)c%|;T5j*; zEH~2|#NoqI;a{fj>%vxq>GV73j^ZSh%|8@ zt)zJUB?f4HR8-Tzbvlsme9P2`+V<5#tF%5$qfG+E}glNxbg(!=2!{A1V~9KY!Gd;R^v@x}pk z>%!^9**nlr&iiD#A*1*jOjA0FxIBp=VriBv;oZwq82n@K;$g|Iy~5&qA#~n-G+m3~ z>!`Z^gE66R18jvrdaH^jN#@-iW43SZCS(+7iH2{q6Y!IE5Jhx{qN8Ntyr zQ0p>em`9jOrD(FLS|teA(OL>o(F9#$(Es+CtKy`Bk_d=U66J|D<))maKH`b$m7K<^ zxiPz@y@GIEj%ovcf}yXBz}M(zobwr0IQtIr%!{Ba63=f?nyKaTdXA|Hh$2F}IV6LF z{oydrXsg1zQUtR==x!AQte-PJ3&=jKDnt|Mq4wQtYxBAVkkPjC!q!WP;$ z=h|kgts}VqJg8K$dLFFeV2|*CkMBNj@~mkt3~o0ULT+i~ygb{6-7TYcK;+T9!etgw zIWCId)w&VPhuFCF@J)nq414q^5m!tq zH&bluSIrNeQ(Dd^HAm=D&ykgrBUMIvg`lR%p{1O%E-MR&1wAWbJK>dE6!+?xuU4#+ zbu5TdCbg@41*(%0V9knZ1EkHJyEqzlT~607ttUT?%Uwjf39$z#CFNSFKt#r5d6qWL zxrzNH6jDNSsb<@8zXOAz`p=7g2Zo3J4jlCR9W`MOj{DCvDs5k%+0w5~$r1F+ddw+T zydV*VBDh=qWtZ>$7%%okjNCAs(}*uK!_Vj6k72=*JjHgGQ6(y*&Q*W<`o|UkHbu@S z;-dyG?MsdEt=76wQr_$G;oU2ETAbx#G+8Q|rg@Sqm8z1EDZ%kGjoFk4yYAxTb?xM6 z3!r{#wJdf_&|Bpmkc`t+2c+R~b@Ydmv*x-Zq7dt) zPeEQ#sc-($<;y3ce{R3%zv#C+(0*}vc+j>(@K((nrO2a(trMlwn?$=i^S0WJH7f07 z2xXH!wT6WpXH2>oR+}5|(M%}_y;)B&!Jwn9^+D$fFNfy$&LN)+># zktefk81gJJih;gYpyXA1s2Uk`%EV2{Z#eeHFBkZHBHp^J#xZ=!xDAELg|&tnd8%|a z7H^BMota+HSNR^IKO2?3t|5!we@c3|2dFdYM4h;!M_2)k0R44tKi+*S{eQ(hviGlJ zlmBmU@Vw&xJMJGI?)-m`@m2kQ+Izm%_h%q>e!rdHZ|C>h`Tcf&zn$N2=l9$B{l0|X zPpcYr&)*%-85jp)coL!(TIAI*#$3DeE;*qQ$xu?nNL`%4Q)b<59hh)-EigBCD-&Vj zHpo;nVBwK4R(X^VOam84-I6nxqn{aDZqNHOaI>vDnBcSs`xsOEpzrL!+Z+!tSg7yR zsfNf~M?^I~zf+CFH^h4d8x8=N-ndmHyDm}vq{SjR3+6T*5u zohU0q=nO(HJaGhVJ@5fVUm_0AcuMuyHAe`3ZTH6R+wiUO|JjGA9;A*9@4p=#4GyaD ze+R?i&j0rqU&a3yoHbtO1`Gjr-oRUV1NV0Rz@0yE=MUWZ19$$woj-8r58T!t=<6Ic zx8UlVv2?ag_mzQ$>%UsyoI1$hPW1Y2@z78&}gQG8OpL`>0Bsh9;evQsg({| zFVto)2)6m!s{Eb4RrX)_((wK2*kJ!19u51|_>bqq{?7h;jIUz^TI+-~Nr>)q@9LTc5k_w@UxFFEu>KCeViX@4?~0u&VzbJRj`z z|Ht?$`oDXiW1aS2!0dGYHM>4FKqla6LTG-|fonozb}gQ@0GJqoPTfV0@63grxv(=A zcILv)T-ccl_uMJ6DoSmWsCeuwRl0+Yz_pLTA&yckF*k>wO<>_nKOsz~%tmidXBtc& z&Q}RtZHn~Fmd%F`7iZtSfA`^BXI)Iq(}Z)zgpEAa;lj%dLzFP3=M+bouhl>+=xbyG z2Mqub#XF{^dX@T;v(!73?Di$t)ZBvCHB^Dp+Ce|{Eg59F)B*4&On3ZNZ(4L?B+>td zmpYEmg-lND+HaIUjcNqHTh`d~Yp`kmWx~^g%Ktm;YLi7Mk-9+{l5-{5a-Qg2m^fDd z6g}N3fn31gd@HL zX9NY$N%|+wEuh_C(uH4{q_Rp!`03>bH*te!HUoRLJ+!5soCZ9i<(pv}^B^R?t_Ek; zALARrBJC7JbX;pYkl-1LmQUOr6@*a}#oJz_l}6j~L{f4x$rTb4=?PbOX-q@&s^pVl zzyDpjwBS19iRl%ca^lL5;OBN7)P;d>_cpW9Z3~ckPp^IdxG1e5))ij!sBnnHzG7U* zwfPC(z?xXdHqk6EHU`x-HJ@sHx z1M(%B0f|l7oYT?G&5he2SJT=ixw-rpPpz8fH9k69j>8vt(bTKgA**wXt}f#&!(0+; zs;DxTCTZ!Z4aIWTBWj{fQH1qlYrTHY2K#?UveDudqJw__mmgn@HDc zVQyr3R8em|NM&qo0PKDHa~n6(;Qq|NqKnE_>^+hq^|F`u<*QO8Ijf2vI@5OQF13{f zXFw94W`GHRq0Bh`->>kR0p>wc56im=Csi>8G#cGNqtR$IfGEj@#Jn$Ynk7i${j&w) zaa@|TDDhQs0Tj77vrCiUNE1{fSL%oqoLjSo7i<_2U-hiNz%4o01? z-GKk$Uv2y^QIccvpbB8a_&+!~KCF)aX9v%AgI@#&#VcQ6wpeas72kehAeEQrB=;@;l_{T zd%(0J6M#4dl%n4l#nC|zVlpR6Jw_PO9-!ZHj(e~a*#dJ6jN95xwGP=Bx_+^4r*oZ8 zF{fB!Q7BMD%^XwAQ37v&yl@nB_%$}Yg(;dQ7!nqt1W+y)fN7jDLY3CmsaETr=5ldi zvs6*AMdLBdP$EqrUbjC&-0`?qg>3BiHHS%lDsg_M~X@9#GX zN~aL(lu;s?uCM&5aMfhD?Ax0Ki56f@2i2{F3W<`W2N9yGj|EPbm;*<2jt6i#D`1HL zoMv*R#w-y5Tn~tZ8Q5nE`GF>5=?&gMT5~B_YBeqhY~<7YX@)W= zX&=KB@h@ZP)aHNpL+t;uz)6O=7|85?roblqU;Pf}|7XLaquu=f7~h)yw^{c$1=sig z!EiLHuK%75pY8hpQ9gfZrp*xblTd$Aw;Xk@35|=TS|`O4#YiHhp+0@;D~oFI!7Lk` z%osBdK7TGvzRsslAld&#Y0?J$I}obOFE}y<6>d!9@{fj!JPXml1q<5tD*bY6>oq3s zr%yEuDx(BxTp}wq-`Gekrlvu+#u5$4Sc_y`+trLp1Jz(_diAvw3hF7QXo}?x-HD-C&@Kad7SBxbhz~G8g7UN9i!spMbxwK&b-zb6l z*n@9eHjKY(EYdNSPsFI?EV)V$#cx?+db%h)u-Tc)c7*`2jN%4hm0SX;_Qt#c%w&{+ zzvhTaB3BhKms|oC1EK^fhl1B;rrF=(+1RERZHIq_Z(5qaSU`14d;muMoVq-NIlzh& zfj6MGYp({xAJQAdvCY35@&)2ctOT(E{XbmZ-B1TB!aDYIFZ*s4=(TB6d#m&&lr;8W zjX2P#uOy;HNA}l9iA?lbrQE0J<9mvhh$Ko2Rw@k23_?)9Q&RMClJoh-;u@&dJZpHdjeM?E zY>KIT=}q2VFH`~i>2))D+FWOG4^L-R!Qvm|=C5i9=CJUA)F-$QK3M-a# zm!M?4efTVWJPd z`4l6G`Z3|3_v7h)0bHrqr7OTddL~%vaXUo<>j_UuP1sNaIClaQ;`*%B>vS{)yhhEVp1*?kSC4nT86s4$W$^hPdLnwdt66!Ghdeu;?aj|Rs*`{M-49?Ceg z6OPR*3AiwhKjVf3Oe4O^Ox+SV7P0^|+w`Jef>ej`7E_p=N*boI!`d|FPdj7i`amW5 zSBy(LC+YE`g~P8(zzvZLc+Fz0VV6XZDM{4&$CK>C;cz(YA09kAdDg8{piGc{#<=Y3 znkw)G_-PyiiesYM1|_gyLTV2)Fz&Stieshou>d4sl288!M-omGi8)1*EHS(`WvK0S zJr>@*oIr$m*&8wueSzp0e*S02w_mE;{dGq=zs7?`;L?UVaYj)!P{1lH7GoDk;?i^z zRn(e48{u?{<5*9RROvL#V?Bc^!9X7KXKycoq*;QMf#=&#b_?B|7!^-fh$#9Ub&uBf`{TI=8{+`SB+6^8^@XCa0VZFah6>W=C8rU!oS9ESYqV`~TcBlmnP+p3Vmy%?NjzUU9(^z2IY)%P$%>HP zN-I=l*sMJ+(oC+-2|q^?HNY6{d$A-@eZp1%bB-c>g*jpI7=~U3nN!B`g^35M6%*Ga z`w0>Gg7I@r#ygT?mdgo_7>z}UN}9Yf(fBFJ2s8jy1{j)S zDlh2LZJOIZKOo*XluPh%uiTT)uN}y+`|k8@j{o6IiK+KacT!`UKx_#-!ebaznZj#9+cv{e7x1=v5W- zsGs(gqTxA>;5j@I3v_UNBJvcTWSmergYI9&{$EAc&^LIC6O05NymrAhHoalT`RP+d zQ4q8A)(f`%-Ux9J#$?Z$NItzUQKqp5K?pDyih@X?FV25GzF76OC9j&P3giOwt1xoe zD-kjj=>D%Q!@KY9-x~dIhH)vTO*3 z^qOf|jfQM)O&iCkp=^9VG#J|T5^IA~ZIiq%o2qL%#plDggcU0i@i~@ynbe11HeS;c z{eJ(82*8)>{Cju&zkR2ZnT?!@SehY@uaJxu?u1Yu{LVsgN`(4p9WmM!G`M~)OknpE zOEj_zNZWt8M3T_?Pk6du?E0)>3)=K#!+RIJjM{GBZFQ(!HOLD_$HLV)-+E8SD6~+;7P`hox3d#~>9V&v-ODZIy z5xz1z=L)QzT0!4jY;8sM%Uw&-73Sjg5vKw?f`Th+H1VZ z5aCX6y+12RD}d{8mXoc@_D%_h7(=ji2w8^d731>r=Z^cSO}SDV_TU@ch~w`Xis@-v z*WJ?4ZS`iHERn>gW{da@O?0?*J+&J1+E{E|MasZ32Cey34K*#Y*CY8g$3jjrCY=Nu zjJ4z%`o@Cm>ngS)?avy{0$?p3#^i+jW(c*vYjL(Eh=)oKA0k&jaF%Bc>NVmRNj&kP zj2t-2Q$dPO5sR&{*Og>Y%|>IR zUB%>qte=7Bnr!uN1%=C6S3DQ^Vk+KblIUm-e@wPyRVrD7U_-rEf$Fj~hKcpM>V-Dc z!j(DcoZi~Btl=y`)}dNzo5D?Vkp%UNZpe=Fr(mRCGn zOm?<8m{hHCXXEc|{GE-zv+;K}{?5k#quKb|8ugX6K&y@4ZmWyNCB<$zuv-r7mIJ%x zz+){3nty)nO^V(3#l9`~|9;CkzVi;?hWMZ3qi2WJ{lAlE!`=ShV|<@B?*A2cKzw?f zy+7}6iTnEm{&UyG_96&<#BhSE3%g3Lb^++4)U`>%C2J6UKI^A<38q%))F0*D6sG4mSP=e(=!e(hvT}F9%+T5)7 zzOX&N(WDg;NfNa*UzlmY8AtObE6K|#P2ffYxXixdct$=p0+}oeT0B6|WKw&X+9uTZ ztF()1EkCqUYi;0XY16LG*3vTd^}Mq?ExgmhJ1xA^!aFV8*86{qRq=M~znFc&^B;$Y z_4VKAXm|eOQNE4qzuF~(kFyMHxV-SsY==xybe(6loo17|aaJbT@}!!VE%iMNTkf0L zxy)YRU5Bpa!{%M4_0!vJyzwUG1)+1y_2J3J5?;P7bXDImwW;ts{F*bl-CVoItG
      ^I)6&@``?yk^GQMi4xXkdu?M;mh5nWzRF^M*S z73q2{o_Yr;!zFo{v(>!u)r_m12=7GrVMO@L8ZX<;|MmrhJ34_j%>O4xhqd|tV6@x+ zf0S?I{O>=G@i?=8)1w=8^?A1!hyH-twH~56n`ellRI5w-yBT!>*@`?$7{xC*OKbaC zHr)c{vAro6e(zKPU0zwsK~aiOQd8wFT?3gV=u0x?h*#rN!^~UG4myyRFxs%?;b%dy zVRtGeC(~Tkpu=1}iy?_3Ol3{2ml+OBNXBauqe~Bf>`i8Eur z-ASRX0hDEz8A{wfXl7qP3=M-upt5+znPgFo<1o{KUvZXUE?2>YGhrbIQW^a!tL;2V zkf(tg#e7-Hxc%AC7haCvA79O4-%UHaX=gX>?53UFwDYH#cG_b*{xq8dwe|noi_`O0 z7lSl@xH>kh|A)^GEB8N-j)uGYKOg7Y(~pC>yXU}(L8tSN@(phNN?n8~Ofl%U6p?5v zwYRqi3wC4Q>gja;^{;44$@WM zRX5l-mpLlzoz4%KVvdr67-rrA(64}$uPMp}XZd^qKYKX;`DC!~{rR-hdBM2%a!3?D zrxA0q)E5DEel9LAC{Yx5AnX{Wt@8dHsRwP+-C-b{H=uHe8B ztVxNA+^r~g+Qn~VW7@a2@FksbBqYxxnR8s~C&fTcW6YD4B41fN!Y95`?#h-c>Blrr zo4SLQudDQ-xDQhQPgS*Nq?^<9Sn}^P#*fV?X}ID zMt&2z*J)g9yi{dDl>&G9Nw?Op_Qfk*4B*l3k;3$MNjf*j(f5DS;|CFI(Aw7ysw{wRu{{wU4I$qMmQKb+7d4 zq)iNO&4hgns?J9wadR#3*3TN^ITjzw?+OR zgkSsqU6vr~aal>Nw#9!K?|X1@cF@`aChXfACvSB^*XKJI{TnP~|DdiTLsfD5(?nGU zyufj5)o{E1Q)N8b{~x0`pd4*W@o%=|7pB+0{w`Q#*{h9Idcc4@M1vH^M6WA0a^lcy z$VXtu-GAnb4`UL}iMR%p5%4lPnQtvX3QMf82#e)m3D=h(c~pP6I@_PT|NiyGyMW?u zgH_N>@G^_w^87I*sCEZrlN`D0A)Tw?4ji@OdRTr?N<0QmUtQW}yaUB$;fE#B?womK zPA2~Vl|-Ej==9ZPs4=HGmHD=Wx1oDjHX1G=^qo{X7u@ZA261b%IjGhbc|gl3CynWF@3T+pMirvoNhxYK#J)RsPL zCUE1ca&}hi474(MR=U*h#i!fr`zrj}covV(W+SP4Fg$ub+?qRmFq6%Ut)v)>S#*s# ze0T*<2!&VQKV73P@5D(NCgbt)N+-5(b8BWy6_3M?jpXqi1t#T=;^rcQZuDPrfvcic zIOmX*C|Vfb+(UAt{tec1=7JcwVl25MQ|^)(&~C7xUmluz8}(E%wp3C@unsm-e>sC( zPp1edqy6s>&cU3#Ua?$T8^YUt6k-9Ht>uCFDZ;KAEJ*mFW@nkE9SezOv&}PAE0c<; zJWCjgaSYdZC5+%vjAMuv?1p}eKD09JNw+XJ@ zaSJxs;zg9{A2ae%?azq8e+FNPUPfZnev%zoDZ=KjLPqPe~s2RW{&y=*_*m|x3 zaXi*F_YC@8StlSGSL*!s%QUJBtP2~{rQW6uFRzwI?#IdI7Ahk8lx~mE7mDRGf zV)=$y=Z*y5%B(rsMER@Ig8A^uhz2|<r(E#OVfe#{Ss1C3Iw6f3%6I z*ET?BnIKx&IfRyR8V}D>aXQv#$dYlX@*3IFrTQGvcw3gtl=)?O@s9BNtMC+x<6_6{MB_V0B{w<$Pcy;IIaRe-ydNZaq6WeHwq?cSYo zl4+Bnv_O_8cPCokhxDZ>F2fNzP4NtOr{0Tm_|iPoZhG=qv3FKNnR$1XY&~uQcnsFI z*`pLQc6hs?TW(T5IKd(`BWm`8=pQYkEbl*`Pj5%_hTX8cQ|vCj@~D1qle%FnO+7j% zB=`kMFhuSWFdbg%A$s_x-p*feu+i95#Wpwq?nUJ`(D+Bv196@i zdqK5cZaw*dOxKzIcOjkztHalm+issiPRXx1hV$1GgT}7nF=YC(XYB%s&2`idOS*Tj zco5-Pqz0^LSuyud>yY}j4vYq1oA?9fDWa9cvjw53lJjpt=5a_Ttd;CgwzCZRstew{Hz}IG@JVKOF5}{=LUYq9= z%$JytN6!btqyEcxld%bS-A=ny^~aluS?@h8Q_e+L367UlL*)hwsr@-yP;T$!EH~2| z)ZxQ&;a{fj+rn0b>GV6;j^U9$e5b0(0$uVfH^3bHTd?P1{**8z;B3 zJVJEl4B8X7LuWcRRx^1@gqq7AchR z_v}W%mQID!D5@I@g@nC)JJ~2-`jQbgg9=8)(}D@98GAD^;h$erJD6udd>(bez14w1 zqdl^UDR*@JhR6k>#;7|XtvC2CpG54q=(%%`uo9Pbn<*K91QnICmTD^%?oFj z=WjtjIq$RSx{Tr*Fr@Spb9oX&#L_HT!P^&SF#7xG`NOhZdxgdKLg>8vSh^O&*D-bd z2V+9t3Y2s7UG&VqgSalkG5Dc60=wZ5>@O|A76Y+Dx0#rg9n2`jk!%Jj_{w&ACGp|J*A=wy=!iUT{!LuPV*?G~g`3V$dmc)wt8w zC5q5azhIGQ3fn(B0DDDkngnxcUU{<~eEQq~Wp2PLugPnK(i~gk-yOmn!^i+$AvHB= zWHyv9Qz@~V8Uk!F5m|y(c8h$^|69+E0WfDtLg*aKd#LCwpM zVIE;Bm7&RIYL*~eM{6lW1qr&uX!zHsu8PwNN+KXaNt7pgDL3OR^$|~1tK>9RFJw{pwN2(U-6^5Dyht_gxby=A}Ea-U=+X*k-q_|hleAzNj*0CT; znbfZG7F4Gtz?vD=21uJbcX4#kcR77KwVwVoDR&X=Cd3|~l$3L&0udRL9jdvI_x?7`u1*i!@c@MQQ@qtff^b6fhADLIB=S&up8ikBq9 zPy~0YzwGqAALHe|h>`1t3mWlNX5{(e`w1*rlBd}2GO9#{)Vb=RD96D z<@!=%e50){l$7_nynp)=o)l-f7)@4+r&*pPD`l!AWJYlORAV+J!lt`CeN{U-+5xDa zS}lv66QPySWb)FCX@QMi;aDHXQzAjAJ_(1tyFNW*sCM+(lqgPG2gj(()^|}Q?m4vb zn7f8~grkhg60M)gEDX}U=3Li#4V5SoUQYmzB*TiZYO zK1H4<*c=E5Pamq~vtQv`jAA7qL0{CvKf-6>6q3p#a=!e0xH_}0Cm^volS#3D8M~lZ zO&n?xnI&khsI+lOdWZHWB%=ic;avVhdLEsx(6!l4Gg^e;SVw<2J!`HzA_}pd`V{0P zmHOr{UA}xG`seQR;qzg)2i@mKM~7Y81#i^IQHDHf*g8=*y-BpYGjFQRSmV+ThEO-z zQ)^hrNyelbVYRXG4$YN;FqjXN5R7_ywLa=y8F}L$%)c?$5p*o1WG*7@zEOC-X}1I(Mg*+ zo|0HKUS!I}EJ+YoWfjzwN*}{;aO}5Yc(tGq3$Qy8#dXRyT-DU5m#MyfwHn3zW%S8B zI|yZ#7{fr{D^SX+JyeYhI<>@2$!|FJ`!5&xVk+Latj0ck!MF{D$%S1FHOf@!Y%Jau zUpq3rps(^hM1M4@^}2>ETK@?d-~piCv={Z_p6+1h`Tcf&zn$N2=lA;(em`w$ z)IEQ9JZE4WgyBhuT4<41!vu5f&b#7-MkGT?5hHbZ4o{eMxAkDk*^R*5+^tN6iQ6DE zEr5kb!mP@pgkT!DKK+c=I`B5f0}K}GJ9Vld z^41YijnD5@)e1L;LaO(D{tW5&L6n*2k!iVJAdHLAGq@e?)-t<`U8ENqvjTD zzZpws+jQR;Xt@5X1I{T_yGzWkqXWTqD<=|hGsbP`KTnJP= ztA21$=DDkL{O})r?T&GrvNT0~fiuLlx=Va_&ir4V`Lr(0ZXZ zdqJ?x*EZ$v^tG-3!k32cSI36+-_h~Gup0mI?BH;>{(FqCvi>VCXk54W^PqMszm}EX zZt1sM`t6o}yQSZ5>9;1r%+B^-v+Gj>WCETfgytW6a6@R!Zp70L025=-sk_MW-Ev{KT-Yra zcFTp`a$&bzxaUrhHBoAtM8#ugsj?k(1g?Dy4sn!XiMcuaYyu1C`Uzn=V>WtwHrHVK zaK1|D>!rxRY}veje|i4hySMKzbk^m}JWaS@OxVa%9WK1eFhmJcc204W`9^iLg1$i} zaL@n{QM_Yns#mEmI7_`l$!=eQ&CD%$eZv(fs~z-H-;zO=OC11j!gMEZ^rl5WMiTvR zc%kF?T*&0q&i%&t)2PPqyA_Q+zXqH3UnV>~sQkafrZ!oG5~&HwkX$Iumh(jK!o;!q zr)cS33FN|d)$F9l=@bckas-%0ELM{ao-vN?jRz&!s;07q!hR^)R%(yB$ZV<#?P+ayMY@#vl*;cy9c(^w`YNjX#Hly#ykj#Z>qtW z^~ddgZstl7u<_NwJKB2|zD{by(o9YG z#e1;jE4L-lZU~w?1EiXJ<3VX$Ofj&ONE=h{-Y#{`sBcR-e>>6DE|`#FB_vMUTW#H2 z!DeRg96R%>SE0eVH%!XpR8xS>6XDGt@v9-Z)V1xa?BiVTQ64B9c_{)#aC!5PrEK?+|zx(Es z{pA<`ytX`Nxm5qok;FG>_1!n0?5_|-*tl;#ya9vvP2$9Zyh-|pLe VyYF`2{|^8F|Nk0Q_x}Jc0RUH#OC