From fe4f6e23d22c9f415aa8221f7619548dcd4b6ff9 Mon Sep 17 00:00:00 2001 From: Robert Guske Date: Wed, 28 Jan 2026 11:55:50 +0100 Subject: [PATCH 1/4] added rhel router section Signed-off-by: Robert Guske --- content/my-lab/rhel-router.md | 174 ++++++++++++++++++++++++++++++++++ mkdocs.yml | 1 + 2 files changed, 175 insertions(+) create mode 100644 content/my-lab/rhel-router.md diff --git a/content/my-lab/rhel-router.md b/content/my-lab/rhel-router.md new file mode 100644 index 00000000..e711f511 --- /dev/null +++ b/content/my-lab/rhel-router.md @@ -0,0 +1,174 @@ +--- +title: Routing with RHEL +linktitle: Routing with RHEL +description: Routing with RHEL +tags: ['rhel'] +--- + +- [RHEL9 Router Installation](#rhel9-router-installation) + - [`subscription-manager` Setup](#subscription-manager-setup) + - [RHEL9 Router Installation - Network](#rhel9-router-installation---network) + - [Enable IP Forwarding](#enable-ip-forwarding) + - [Configure the Firewall](#configure-the-firewall) + - [Setup DHCP Server](#setup-dhcp-server) + +## RHEL9 Router Installation + +- Installed basic RHEL9 VM on vSphere + - set hostname + - configure network + - select installation source and destination + - add a new user + - set passwords + +### `subscription-manager` Setup + +If not already done during installation: + +```code +subscription-manager register --org="" --activationkey="" +``` + +Checkt the repos: + +```code +dnf repolist +Updating Subscription Management repositories. +repo id repo name +rhel-9-for-x86_64-appstream-rpms Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs) +rhel-9-for-x86_64-baseos-rpms Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs) +``` + +- needed packages post-install: + +```code +dnf install -y \ + dnsmasq \ + firewalld \ + tcpdump \ + bind-utils \ + vim +``` + +### RHEL9 Router Installation - Network + +VM got configured with three vNICs. Each assigned to a specific Distributed Port-Group in vSphere: + +```code +ip -br a + +lo UNKNOWN 127.0.0.1/8 ::1/128 +ens33 UP 10.32.111.8/20 2620:52:0:2060:250:56ff:fe88:71f7/64 fe80::250:56ff:fe88:71f7/64 +ens34 UP 192.168.202.10/24 fe80::2e60:26f7:eca5:3311/64 +ens35 UP 192.168.204.10/24 fe80::4659:fe20:d534:9e48/64 +``` + +`ens33` is connected to a DHCP network and has already got an IP assigned. + +Network 2 and 3 will be static. + +```code +nmcli con add type ethernet ifname ens34 con-name lan2 \ + ipv4.method manual ipv4.addresses 192.168.202.10/24 +``` + +```code +nmcli con add type ethernet ifname ens35 con-name lan3 \ + ipv4.method manual ipv4.addresses 192.168.204.10/24 +``` + +Activate ncs: + +```code +nmcli con up lan2 && nmcli con up lan3 +``` + +### Enable IP Forwarding + +Enable IP Forwarding (Mandatory): + +```code +echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-router.conf \ +sysctl --system +``` + +### Configure the Firewall + +Configure Firewall and NAT (firewalld): + +RHEL 9 uses nftables via firewalld. + +```code +firewall-cmd --permanent --zone=external --add-interface=ens33 +firewall-cmd --permanent --zone=internal --add-interface=ens34 +firewall-cmd --permanent --zone=internal --add-interface=ens35 +``` + +Enable Masquerading on WAN: + +```code +firewall-cmd --permanent --zone=external --add-masquerade +firewall-cmd --permanent --zone=internal --add-masquerade +``` + +Allow Forwarding Between Zones: + +```code +firewall-cmd --permanent --zone=internal --add-forward +``` + +Configure Policies accordingly: + +```code +sudo firewall-cmd --permanent --new-policy=internal-external +sudo firewall-cmd --permanent --policy=internal-external --set-target=ACCEPT +sudo firewall-cmd --permanent --policy=internal-external --add-masquerade +sudo firewall-cmd --permanent --policy=internal-external --add-ingress-zone=internal +sudo firewall-cmd --permanent --policy=internal-external --add-egress-zone=external +sudo firewall-cmd --reload +``` + +```code +firewall-cmd --reload +``` + +### Setup DHCP Server + +Install and Configure DHCP (dnsmasq). `dnsmasq` is lightweight and ideal for this role. + +```code +dnf install -y dnsmasq +``` + +Configuration + +Edit `/etc/dnsmasq.d/router.conf`: + +```code +# Network 2 +interface=ens34 +dhcp-range=ens34,192.168.202.100,192.168.202.150,12h +dhcp-option=ens34,option:router,192.168.202.10 +dhcp-option=ens34,option:dns-server,10.32.96.1 + +# Network 3 +interface=ens35 +dhcp-range=ens35,192.168.204.100,192.168.204.150,12h +dhcp-option=ens35,option:router,192.168.204.10 +dhcp-option=ens35,option:dns-server,10.32.96.1 +``` + +Start and Enable: + +```code +systemctl enable --now dnsmasq +``` + +The leases can be read using `tail -f /var/lib/dnsmasq/dnsmasq.leases`. + +Firewall: Allow DHCP Traffic: + +```code +firewall-cmd --permanent --zone=internal --add-service=dhcp +firewall-cmd --reload +``` diff --git a/mkdocs.yml b/mkdocs.yml index eed101dc..1bf3fde1 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -288,6 +288,7 @@ nav: - My Lab notes: - my-lab/index.md + - RHEL Router: my-lab/rhel-router.md - Hetzner Storage Box: my-lab/storage-box.md - Local fedora: my-lab/local-fedora.md - SSH: my-lab/ssh.md From 4b14838c74dd82fa52c24094d5e3eef53cf78e72 Mon Sep 17 00:00:00 2001 From: Robert Guske Date: Wed, 25 Feb 2026 20:19:07 +0100 Subject: [PATCH 2/4] added kubevirt csi driver Closes: #141 Signed-off-by: Robert Guske --- .../Screenshot 2026-02-18 at 11.06.56.png | Bin 0 -> 117605 bytes .../kubevirt-csi-driver/controller-infra.yaml | 174 ++++++ .../daemonset-csi-codeids.yaml | 57 ++ .../infra-cluster-serviceaccount.yaml | 45 ++ .../kubevirt-csi-driver-complete-tenant.yaml | 329 +++++++++++ .../kubevirt-csi-driver/kubevirt-csi.md | 558 ++++++++++++++++++ mkdocs.yml | 1 + 7 files changed, 1164 insertions(+) create mode 100644 content/kubevirt/kubevirt-csi-driver/assets/Screenshot 2026-02-18 at 11.06.56.png create mode 100644 content/kubevirt/kubevirt-csi-driver/controller-infra.yaml create mode 100644 content/kubevirt/kubevirt-csi-driver/daemonset-csi-codeids.yaml create mode 100644 content/kubevirt/kubevirt-csi-driver/infra-cluster-serviceaccount.yaml create mode 100644 content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml create mode 100644 content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md diff --git a/content/kubevirt/kubevirt-csi-driver/assets/Screenshot 2026-02-18 at 11.06.56.png b/content/kubevirt/kubevirt-csi-driver/assets/Screenshot 2026-02-18 at 11.06.56.png new file mode 100644 index 0000000000000000000000000000000000000000..1456296e95d8156257dc1757894fb541a4861827 GIT binary patch literal 117605 zcmeFZWmH{D)-DW$1P|`+K{xIe+%*Xf!6CQ=HVy$c4#C|mBsc^J8rVp14esvldKc%M zx4Uom>HF&&a4ZY2q4ZIclxww)GT-+rD`VH@(w8^) z4~K+|IJ=2!yrIbjHV9s7Mkb4Dspvu7wuJImTF%ALqSRB;78}nA4u)mxWwmcMc!A`B zdDmpks7H(EbRQA*!MB{9YWP>rlP*L*tWi5!Z-+1d+NCn5|SSh z=8&b9-+s{Q2tn>HFid~myqR^o`#~m`S-4MATCVR@PEEDOBQCjeiR{c+R1TxrNU6%0IZ1q=L$fFCdgu@D#p;D0ROCz%cRKTn^_Wk36$>u20g1z&4O$N^IZqhaD? zW@hJXY436_Ir#`QHEH!m%SB5`QNYCBmet7A-q?&4Z0qn;1x5%g09@LdxfoG^ZEftF z1;D~of0PgauAgp$s3`s@;$kgKrKO}wAz|-iM#00%#>z$|f=od{A>?FgE}$+c{a1D1 zFJUT67Z(Qs5XjBVjn$2l)!xYh#Lmyp4`Sm0ad5BzC0Lx@?Ocq&EOyS+e>UblHxLDcSQ9QM4WNiP@MVN}}=|%te_h&!Nz*hf!lb!Ql!vY2fdU^t4XJrHZqivw7 z(9>N3RV%QWjkctfEg&A?9U^=j>_UH(|BomCeB-~=)cR*lc1~{2f35m2kN&;tTW2#T z342@Moh~B(oSMHX|LeoQDhh#~hW;<2_*2e*+yw+Jf-D63$E1lM_bMw-!N7>Y$Vt9_ z1BTtpK$yenybnfrU4g>*%2iDgvva`&YROgmWrQFytShy(l2~akRm(WMxpP6+rqVbZ z%>Jb-;cqoqzkU64(;iu6?Y@uB8Q_bt=2s$UA`pYu~aM6RpehK*$n2qyle!Hgv)7r*4xK+E@BYcz(A)Z1}bg zCxZ;_PJK0=@3YUNE`J_-z`Yq<^!@7ny~^m|$L7lizI?oyY;ETnQ^dAw*eH1R)Iwo3DsO)eKZ7z0 zZ-&gaK0Y)SUlgHvl6cr@`9vBPmMiHf&o;}jFXTQ~bB$Zv$1cpcD6-v~Gmp+|r&3@h z$J=Xt!){~p&OF(Df=y}CPDAQ?IrtEYzUV9Z`=WNi52J3*sgHZR;;{A6C!%poSx^a= z9QL3O)QY;O`D#@HT^Pqa*$7g+0*pU`b5IM%Dj1az3j+?Ff9!N-`Dha)KZa-&Dt7)}{OpFy)nkW=?SVKBk{Wa|TWWAUDc0J*T|1?qf* zlDB?h_Vky6?rUa{8TdT3F6RgMU}In_Onae#$jrBYH;$Ll+25Xo z549K09%@D`S{yuwHr?Z)8~UD`IqE8udU0;=I^6l_;v~1ssmt*QkampdyH3-ldmj8y z!ji|FI{@TgEF{Id=ym!D!6C^3m~n{k#T2!k_xW$L(}_C!#ZPR)w$t~K^X!f*9Tn5& zX}>XHq6K!o936L)^YRqG2ol{)cW!S(AfL;wD8;obE=WX1VXhGCTnk1gC##(@4i9Vp z*cpiWHzvgoUI5lVS2h*2E6kfot}OKaTg8NQE6T2IrGk%JUW@4Imj3drJzWrG+WlHk zecLpLX`H+g)tRYn2){{`S(~|07CEq&x z>^`Bcmdxt&(A_)1{hJsgNQyavvjh5FwvbjjSVQ3m!pJ4<`km|RZ>9gv*3@TbA zGT-G?nX4NQ+wJhmG$3eSLYL8Fqs?jeJyA>^2qwdc61qIlGH56HxX=vSMnGMDOX_B( zm~_-SeIHWaJX~AlSzDvh?-R%>LdTMGU9IO6 zx*(yOEtBJ0U|%4al!+!I&Gb6yshD@2#f6$_W&%pE)t1^2%Si*He=;QccxPOJtEtC6 z=eFqWU*T0Xzpg>n6+wu7+Bj+8iMyKN(2nH4dYY3aEY0iF8#wQEI&dt(AL@JDiQm0{ zmuBB`4QEgtpRo*!;dDCj-Fh+^Z@cxV9mNQW#>@PoZTED>x;(NQGCLwePI@`-07ZjE zpTT{nMOl$?m&COA^;;RyG%hwv3EP`?mby7C1Fz%GWS&i<32lpk7moV>+`9kic(};J zjg4#W)EN?!4ho!H29+HUbI<0vj2{^pouAh-lGz1u^CCyjdrI6blrHJ>*+y@#-kfm` zlHBw+i}86)euTRF-nKd{)iMPQiKJlI{kR*ic;x9*L0Yt(87`pUpq0>*tWQ5XPcoWn zWkp7?t#jgY+58SAaULX}n7MLe(8^e+b~7YyNxQSXy549-=e$f8jtch};FtN0bh?OO zha_|O!)VHWcfGv`Ta+0w-8bykjsJ?=$p1k>`fxbFO^c=J@q#I6RV7ru&LhfqBBn90 z^F_Hj!J^A~eV#St&=?M!lISY)^AWdNhdGf}WSN5&pJc1V%whY?L$75AN_F6D9Q7Mb14LTudh{%58|mcAELoiBspi_Ck;?cx}#X4 z?D=PHs-@bvA|Lt3A~=J#i?W=^wgm>k$zTyO-@9X@;q2G!0pCh%b*8|pktUNT+l9A1 z)daBi5W>O^DIrn;mu@zPrJoMJ-)aUud&!q=vpgtt+Fx;hG24AFL*gijL$?UjGX}#e zHWYz=ti_I?xW*~*BAxbgsw6uP^5w;$|L*br;iV4BXRn9_xj<+P{Oi*9yk&E1d#e2LHczg_xEIXdLobWCNM$6wzKk3>S|Z`K(*ti8B+1h`Uo8g*+aqu0R9;-n+RGSW8DWAHIus;()m?$-U3W|S zKY-bTl-4Z>oE_Yc4Wowmg|jwTPJQ@R+U|MSjNkHbvs-bq^9=#spkbHXbFY$J8(u=B zhd{)S@&yL?*mNK~JAEAA%Ck|>7EsRH}n2hlPos7f)FhE-wp+%Nh(Q*hz$)TmO zr8T4SYRTTG1H7wrP5NVeUlEhbTOT~w?X$cuw5LqtlycvvuN0a6IAMp_EIjG)D`UNFY9F(Mhewf|8=(ee?kucX1C{^HJL z$JDG)+e6AIxhKPboU>|azTv&2Z<2U=&!Ug+oq?U%Nu8)WLL$oPd6FTH+eZdO|B!t9 zmOH&WRHl#|H~cQ=jH9;3}W#QzSHh>8qp%l z+co=E#Fz;iRL~Q{cX7G+_!&*di8Lk&oWShJs68dl#u^O>P>PJAbt<7e{X^09F=EXJh^^H{3wYY!%G!Zu(5_n1e@6>LfP zb`ttVWquhFz7})jT}an`co+&QJ88}hUVYa{Ml=}?n_B;gpm8ZT019=}BRyzckL5Gp z-LfDHh1>Tl&_t`lgOKp8FD*)|{C--69@#m;^4PqXWd1b_2KgPG&REeM(3gVD9<&dq zS&yd90g-kG1STIwX}#{xC!-euQ@LNiMsAQmistPt% z0;-nzYF?1tneLvKgOOAIP`kp=J(m?amE{D%B&RhsS+ihC_4IJXhV*QZcb!h*(r*tP z5^@&@BP?q8K~uLy2ZJ^ymwP@rtjx?Y#jyg4RG(zmq%*{()l^RC7kUUTG#~fmvQ4nO zD>RSJ``nE3K*e3)a!R-zmR^ta!L6}tS3Uy6F^_{y}d$z89Gq)?P1@qwTVXJ6Z5~8omtcvUW$I0hiL{c_)E8$r}wqp-> zv8%(hWQR)3o_Y;U)W}pqv6@{Xokw3y3q9zhX6#!TptNk->Qy#GHmgEDSwCJ(C89%l zP+?DYzLiH|(*VnRA6!40kkwNfyI(V=?1)9%WG1&crXtD`g&tN1qGDY)BA0+)Lh8Hv zs<;ri$-GE-kga!pGD*74wv4x0OZIVG%~9xW!`UJbl`$x=(*BJrEmj1eGi94}xVKn~ z?)%frQSC+PER}OaM*ER<=oWZ%&L6BzNXG1f$_}&ex?Xf9f3do0mwa77$7W1b2olNA zde`wmaiJ*7s1PQ*y!FoOtEEflq0SM6`MdqspOI6;CJlt`HS?ZDEXfme+P&BQoTcRP=FYbfR99|fGzcph%+P=s9saxYa5G$Bph9lq&j zpIPBHlMH=Q=JhNxPN=ago{!`BRcfVpF=X)uF0^>xLbx&+mUo#9R5RsN?{|5X_lkVt@+6|(h%wORoCh>QM z{g3eV9BZp<0fLwxXac!R;WP=TDy6KQ+z24T>Sv3j82)Z8^f5BTNcHcQ&eIfR9&|aj#A_8yfN~3(*w8?s=DyGvJJ0|-re4q*Q!Y6Hr`ugDasn^%m34# z{kML8afg#q8HFGgoL=Y(MR=dCr-Evp{}*%)c)@2xMdzDki7^kcSNo!tK`WPcy~YaV zLGKcODs+LB_AMkEd(*<{*O%1o2vMRs zWAqdKe>XV)2`VeU91?j5_=QQi~|tRUn+o_ zUAE>M-DcLR5|ARuMMWY=_&FkoxW7t8jX%M>YBWm4q<DX_Mtt1SpPOl7q! zbAmp^{@N{XB?BO)mZ!kKPWHj`dbhj*Hh~-JjKK{E!CPq&ohJUMbPBD;4)+?r+YF#}f;(4`^X0KDy z=;nMnroB2gpLzQ8Gr|D7)ab@AXW8F6gf#F30X2DA3h`!nkvzyQm6J1BFq{7DMrkHt z`2#r?dVi-A!*Yn@y);T_{G=>ucyv}(;ocIKbv^`x63+Ak>NK|Zr)!x1O~d^e>4rI7Mv;bh2q;qhW zKLQ>MI=SziqvB-%x`?Gys&xFHKza==0L9nl&ntK9xQs|aKT}FP;fC%02xL>rKeoWZ z`+yEOHid&)?>M~9Mr6!Tdi;i&%A1^Q-ukY^$gGrDn?0*rjw(phVJvCb`MR8-X%Gsk zjH6Tf0L}A!^-q!d*V0w2#VSDlz%4GOOqRO&mne{YF(yH@7S>o1hDk|0Lq%9ki`1&!W#&WjBfYqqE}2aNNtavw_N}h9>sZp zd-Bb7Zl~|%yc_zE(5WKvTF1YdAwZmgeZMsgh3|F^AH$5zt;vXua6sx!^6WvQ8)MQ} zx@$5q6_v%5uQq}@x(Y`!m#cFvdSxDI3lR&wWH6emDdGz`coH<^8-)`K2JMSaCx#vN z)gTZuY{z(Xh*qymWlhc*>SQYX%v+iav!5Vn1WE~+$C);jOIoGMw*==C{MGh+M^GSW z!HdRAU}Le=l?3}h2>uD*%@x!6Ivz~oBs=BUOJ8xS}PaxA*=nd;2kPG9TY zI!G;jAiQ?_=M&_qY3Tit?`&8CdOm5G#nbqgzWlM#Il{SAb_dk3z>fwZ4~+slhv40g zW@}h(iT)vWN*72WG%!+*7AZ_l(nfLa0yTW|6`Wi4iI>%- z6}nePm1FIjl%EsO8!WI zr{~c2YA+TfHA=;(`HxjBHh}#eRlNbgQO#{DJMmBgUZ61wzznZ$0~(e3c4uJxXUEq?s*e(~|QTmY!a_wk~x745L;RGDw*OWq2GPN3*=Aoff_(c~LK z=E@veA!-w%$wb+vFy8y)t?=EogLVAO2(mmY6D&+jnYi`U{QcieC5LzBL%I^sx6azT zeQ5>-=Ob2gEmnmobQ6b$p8Masr1sWwX7y+?ygP-(%gubSKFp+we%jU(ebi0nTN!0r zZr!XoUlulq#J(EKdcXmoy9_O4g9ad&vyW(V0oFtZp0mLLfH>2?egL3%L@x~G+p}%# zPW4gC@JcaqucI~xV0A*8FJ_oL!dB4I_6B$tBR*{d5+TOZdhh@9=WRrefY;R#PW}Qd z6#a-paNcFCv;O?W!B0WL@Lj+@z0C4`aL?<`$oS^gT5(d929d(k($XwnptPY)pIt1Gi>}(r?nViYBThoiI4wds{Fw z@hL`r;htW|rT-4(KggJvi|LS6sN6G08ChvJ-w*_dlUp&FjZ#_=fOOj-#C8~-7{gZu z+!11FVfp(kpUq=va%w5XxBXzBg<+G8NToUwZ_6uvV=_iWpQdp-et$oI=!4HQ^*%r> zDG}6iMWs9eh5Gcd)I~Tx*=R-kS=%}m53EtR)Wc8hef@Iu893F-D0@=)`fr$DfIuW^ z_<@8L>FiP4$D<0MARxe`s13t=_D%}`7rc#k+1rw*Pk;xJ?B<#78$VmjlJt4bcBX+q z{W$Mc>WFb#uP)_wSR)|9n+jm(?y8IdQ{DmrQaiDI6Xu}6ZVB6m@h?@!*qcf`(==g` z9mK*OF4?;R`XR9+-#3$5@67Hz`q{e!p8(?pnxo`9z^=D{D{mo^QlMk~YN~7d{jHZa z_1xv6FL^C61D|n;s*lk{?~b-;tHlehM zh}#m$fKKFGG2j=ytD|N;U9OV|`n2dFVH5D(4MpLl7PS!jNv*>)S}?>Bd!Yoobn#9h z*yj}eB?@lh)UJIbYI!sF*CRr0`gB8`V6m)ee8lieLt2~G&dTKmlD2@T1G`BKE9H zr5(*PKM%l|nnhc{8Pipzosj%-TdyWT*+0VT37!CVEj_vZ?YtWC1_#q=`+mk>yZ*Ov$Pwve*v;_tDQ6uz%ah4kwY z)r!v(?I;T*M_u*+m0$_WM+^)p69ojd8((a{*y3Nd(0V;!4@X5}5Ro96iUMk?(Bd(- zl#%V=qbsePo*4hJnIafg>@vMkkWbleoPoO0!sb5=xGsd2$G?c+=-`ejjG(!Gsq@_e zAh{+sN(zfeFtJ^|5i>6p4@eO)ICK%%zDPRPY)A&tKzfK_h-vE)&hb+i=1&;w{O8^v z3r~LkcyB$8p48C<23^)cekykkoh%FkD{q;pg2p!zXqDWApFC+-Q-{a|$un0^dx$LGn&%;I zu5UTm5e%dZQklR|494M^yZlvPq_wOu$mi3NMr71y3rbRUuD#ry1hG{Tq7mBK&M|$7 zNWi-NVP9U=%UEetpx%N}dM(6tms)ZC;uc|WI)Rt`Eko+t(tq{8|)o2B+BE(Ia+%_+BTX%+Pe%y1yVo+$vw zfbJxu#NILD6t~_16L}R3lMJt}LwMA0;w2Y|7_sW`tS3BrTB0I4DU60y*{fYSx-E+zk3W40yN<0hGsm z=~AcHa_i@AOJ&!Om2}4gu0I`pu~LjBZ<<}9m>n#%9?{i=+CayIIcg>L-}E`$n1D$HFXrlHC(HYpL3VbEh8RQ9lk8l4`EiyqXku86b`hYMIC@wKS( z7F8lWoGsYyRr}{W_IeN3f9;%+q%p(0b*i2;ygN#Y=@e>ifGkuiW@P*@&!DS7Z#)v! zXzv1vKImFk9vDFmo`2^uY1Of7VDq-qHFwK+dm{BfWD+fMW4R~NG%;h{`A#ly7|2_3 zNA<`GxKtM~apR+{ptNIWX0Vun9gUj^mO|wxt(ycV0o)C&*HBCi1H|_&Ym|h7PE*a$ z+&W5F4C!ljZy*Fa?p%*mU}bpFVr|^3BCz}Z`(0$8i^NLz>}UT;1v9@yYXe1f1q3)E zvIubE2~>Em0vaYxF3!MNN^b&3vtr^PGyaJ);zzNnd3`)lHfbe(j4hDnjh;V9(sSw& zfa2Q#8s@Ju!H37|N5fY=sPwJ43j>u+DUn5YW@3tV^?f_64=Vjn?wCN$lZ>Whg@Qh% z*tA!Z{SUW?)7<+%G{H=T45WCNq&sMFxLmgVkMqPWvoOn0yfYv}BlSAoh|(y4FDwo@RVjMgqvHw)B{l1> zR>Dotw*b#Xcw%Vy<)}lHCFfjLlFo->J|ymQ-W8f)Y{=CrS=3-qHowo@RqSas4yUg1 z^8x<`t74VVrTyAsJJHQ|yUXuz{Ra;W^0-1pjhiyz8mw6((-h<%v6;+{fpwP%< zpQ3&FB3*}FE(-QzTrk7RILPNXTtMGux{I#>u>j3hm?dUlr7(Y^8um4twMkb5Lv6fy zUC~ELfxt={E~lIohQ!{0`cxokOdU?9mWLwOlW<<_woKJ!#BjzWjQAy zZ(J2du|aY=E=KyMattnDzp^`X87LjHJ4aK0O=mCHaPnDN18pN>J07010fim%p{k2b z(NT-a&#ZAA8V|cab_5e)7TX&i*)32~1^Nb_=CHObsLbU%JlC#O5C(nM?nC}!Gjuov zk@~5GhN>5hc#61EvC<&7I^e`9dfb8ij5FgYkKLlUswOtcA!LL30mxQPzXCfqkE(ZF z|2*|O(A8_yvuI-Dbi_60pYQ#}g#HYEe9iGE`_WH2G$E>xzGp=u%lHOd;--;ushI@Y z56j9)H%$qrM6@jD)nGhih6aM2XyNT~$Dp^XZh z=%fZwT*@L%t3QcL*gQej*4Y&1 zl~PC%q=GyXzjdMhg;Ja|KRdpVv*S=)mgoOoYLfKk6h^l2HrWjW9BUqy-*QaIIPBgUc+9csN zGth7+Lfb?+y$00S+&od_I&Tw{ezsLD*<8GE(;r_ctEpR4R);&kt*H&}tz{xh^AKtr zJ4~U9DEpxm&30d-(Im&K@7l1XeY3488c1(=Tl~GI1@%p@ArEV>7uMORtK^7jM4q-C zYP(kxPElnaO~}YS@p6cq2gck>k*lSZtHSkBNoHA5ffIQq2_8e2?^jNoj-471SdFJsOU%K=2ub@;vob6tiqy0A7>KR>B~FjlXHNyS8dE_jH{m=) z@)ffMYMNNX+}2X$t1b+L4wXr{;(ElubHYzXwbtG|%(<`Pk_%M4SEx7>3M;=5h~lrd z`EC6=Pl@<=GKfZo4tJr!N=Ili`$RnqpmU5bI~Vdh;#+cyTX8O>45KDF<%r~q9kJr03Fbj1G3Y$aKP-?sD6=AZk2==PN*!_szC3~Z`BA*?U>1l@#Y8l7Sjd51 z<)Jp}lHaQ6WJDDjAnFP7N4Vr~s_B_xeX>@%3P%|fg)9Hwt(ZX~CWFBQ9U-6-4 zKH4BZN$A9EOVHX3q&`|4FWNqCfe6=w(W)~`V7LO{!LK|DRz`XdK=OJum^>Kd$98?h z#-xxWyj%4!0MbjWKQP8Fa(x!JrIg&VnFQupfejZ++n-V7ldKUutmpI)J;^u_)2?%`HHtLi zqm{mXlzY!gZrn>2*izznDuD`lE^f?kM6g^O`+Jizb!DYk+mNpb*PV}|stvO?#KO9~ z*;PJwE%wA&gbng`NkBqeLVOTMr-QMKDeo}D*gGU!obOMwHz>p0tR`0Z zX`?M{PR1#`%NEyc`##2Hq(|@x9bujwvvpeLQyNUX&pgO+FcV#|IN1smy&l>OucCB1 z5$q5o7~zThA^#AkDG(|7CgNA$uNdm^U<3Q+^A&gVQ3R2YUd7&S6p7lPT7sO4c1h)Q ziN6^9swnVV>utC5^^U8?u2x%Ss8W8 z%PWM9RkGg<;)HM<9f)_fh)B5PWX5y1)Wxf&D@~rCz!L=5JdS8gn)P)%s8~?{w8sUV zMj3-6)DN>KohAqb<8O&>UnWQXu63m|+ zuUIr$rW+DjBNp^j?ON%2f@URYO5gnI2{JfSX+5^ps$8sDo@7$i#E~P^#cACA!H{cJ z?4sOy8Sbz$Q62aZ?+|kkUXbse3C3ld;WlU^he$!A} zb?xvM)lzi;{>xHX>%vWCWv16k#LrXi$AeVRGl}7vj{b{$g=dWC(HjKL7)P1y_2=$+ z7D(qrT@yt~`U_vi$24APyG~WrC`&jlSUM=7^!{p4tKUt zyT?$y8?~++pQGpdJWP!aQtwbpmpwu>BjA=)fzU%=Kc9cWLXTDy9H2Il9G_BumM$@8 zT4Djw&&!mZXF+36j*QbUN}@Ptf#jGF_^}4Hx-9lXthYS4!}1soKlT)qvNWaNb=HS1 zq~hb!ndww6mN-U?@S|Y!DQPByi&czzKBs94>C|z9(waAc&CMRaNp6z~9QWWez>xdO zio5HVp>sqp*Rv^OFbyrJ8j{}=lpgVJ1mgObojdeA^TiA;T9?_HxQc$&wnr+y9FU2- z-3kp_f+~y%yDef*Ja*nlvBN~OG^w*UFmWmyN}y8a<#e&%0C0Bzb^M4vul?N@d?0hM zVs0>Kc`rL}dQ79ZVALt5q_+)ZZq*1jHrkcoj`1@SQ0=Qto5W}-`D~$S>_|fPI9)H~ z3|y>yU8e~k(_oh7m(M!7X^<1;v)+}cFT^m|5XHqGB4)e$a|yCq`54MmH%h*eQY=#Q zOETzSYtV6QHUwyO{<{q<5y3d1g{D`W{>1175Q3%?9sm~~wzzoS>k+phEM4SMmqi7s z%EVQ@Hs~QJ^mFvCW(fg1ulR=oy!>gGflb(SA;}(IbR8n!`j)g+DSw1l*fna!Mih<* z8eApA1aZ7Rnsd*NuB1rlqrnM92#!34-%6U~Bb0f4b##v5i`1xsI-N<4l0BIgDw|-I zj#CffB)hC}S>rL4=PVGj9)&GVdw#5veE16i)uHg4x;~~S@6Kc&*Jp$5hMlddEFe}2&e{2F zq-Oj|x;Unz^$pl{@d6vV*exiBzUmGPECg}f`**8>N<+=3wpTl|pVW1t?^nAk<&Zw% zTkVt?s>BO462-O(U^*G9j*WE&R=5F3%er{r6`XqS7{@MS2KmoK$t}E8UP;uBh^CMr zhj{P$q?6B36wr6B&#cC9;&RAow#`dZ1$N?Kuz7RW$@RB0;Yb!aJ~~Bt{T+>_HSZK1 zQ4IVPn_xNJQ8bv>{EKhXufSbTxmAW@fj$~j3*ME=MDG!C(>AbGyLII#eL*J*i4kEE zJ0X;m#$K_DOG-~+QVw}+LSbrnfS|G@-tn1osqA`}E3Lu1IZ%SKtL_Pb6u~;QKHjTB z9gcB!%w3uHV=cP~ZDzD$df-)b$oIXfKIy|>H1DuM#KBViNm5uaMsRXH zz$We5E!QicBCo?K*IWS8F)#Rr{Y*k1a-%bDIE+yUZ^V#_7QA}6>OsyAWZ<^aXi2A$ z{I(2`9&pA?MU6qgo{G&?@8Cm#&c$7JlwGhZurQ1`-XqW6Ykx~Q-fU0JMh#xM9uz*& zY@KQPC2*`_H7t94wHn>sQ)5ZO4`eb|bK>yrc?_{dQZay@4Gbbt~d_bOm;Hn$sCym(nHi$f&}gL-Xp^FbVWZ_WG{(gT4)rm z$E$F3APH5ob-{EhuoA+(NbrV#3(v$lZW>V#AcKpYfJ(&mDk@1LC`%}3Z51-mKZ1f6 zsI!+H@G{Im4FJfr9L1?Rq#~}s{B-tWCyfBBSc)Ahx}1jVv!>)5ktv;^%J8e#qgaX$ zmTHz^%lF+=z67ElI&=-XehIG2>hB+a2(%?a36*>M%7mi>N0LnPjZcYOyyV*Jiv0B; zJN}+mo5GiKq!mLn-1Z=km+?OHN;- z%0uz;uM!fc0p!&Q%@oa_-@Q%k-5_qOZAX@=gG7E&C$hcfAXAp<9Ks+#H9z}4h?PTj zT#`=ti4I+D(2(I-n1N_>>m1KvN9~y4E@eRPXcp)oWez0U8o#X8TS1x-k;K;Zs>~E&-{)=p zUY7*)cC`qVU!9@pe~|s(VtxWhhpjH2D$xEK^A-%*V#U+J6d^6$Q!pw2z9^Zq!kJ?9pjqF245VzZg~c*PSF!ttVO=tOcN8aW=Sjf6d6qG zLB}db1>K0;YQ8s4@M=DOl9`w;`C${WCJh9rPqSYk(xr`J;m(<>LVxvee;3-sAZ&)h)fea`dec}#3sO$k_U z5heH)BDn*9Nlz0~f8K~rxzB`GuWe&WhxXw z8U_@!EFIrByYA?1TG}3#3k6loHRL4VmF9QHm@j~|$G(pthcPwJsH&Pg1uat7x($+l ze9aMzS+1a@iGk~t?J%SEAfM|G$JeLV@+RGh3g0N<7#x|JOE4kM7jwzMII{jZf6%kU zlz>bNEw;nb+xV6`X-W*!V+u3b;t3&T>$Q0H4Vv=6I1Tf z!I9T+*Moe)&c?OGvb2V?rHWPmf=({T(tmz>lCb>dD7ae@c^7pLvvuKWTxIoR;XU(i zeal1rYG-8})GlfK{6j|o`mLQj=z&~fLjQBQd?GHNd?ZWq3iS}OZ^fo#s1D{9l zHtxDWc0WP8T^CR%Q#fm1ghZIzoU-6P4n_k(QM9+VM8tdMaQSKp^VN8rqNaQavRD~w z$O_rWa?(F%aky2y09ya_jVC8lO566vEgmuJHVh z4foVo<>fKB5MZXKD&W$nGcIHAGVfT$WzVX#82kJpFo;|n%b>!_{3>3$n0Aut)5iy* z{$N{%*IZe4o?e?mFEl6XQt^kFU4XGizXUjFtH5&}sd)E&Cs`h(0WFa!&0DneBU5)CnY{8acPyj*l0( zmx#@Y4D+^JK~{b19hgZFq(|YR-!J8o9O0!plp^r4;AJ|#jL(bsI+%MFF$ozFpNRWg z5MzJFh$bW@-eE})wewzdAE9h*Qltdaj+D0WMNZ2Q9=*_aXnSs=sU4-Z7_l~8gL#we zp6NvGx>5S3&Lwaw2)X))qX9uleL-K`kOa4HFgcWrjX_<49<47aIBD65tl+vLV_T3c z{~Re_8;`i8Sy#*HXX1$(sMC6PU(G~c zvS@2OgQ(Tp;@#{w^-k%jjl#R1e~;Ik%?PMkmK@-0oLOjyg^~ z1ov#iCP#wTGsd#+24gNl%!=(H(p3aWSP_YauDFg83U5dz_ zRhJH7Vp|ok%cShd{gs~jH&Xa#u}m?5pLpFre&g14_C&o2>wM2a+eP_wBqvN<-?50v zR@^V;*R|!}bc-t*=2V9b)(N1l{}g0u6|542tLNtR>*m5e8+PZBjQR zdF<}tll`^<2E!YQQt~*@e-+|i=MTQX!cj{{eDT-gVGd_eON^nGf%rc|;Mwzoe0ck3 zLy9pq{AUqN|0x>a-q6YpQeH7OlQg!@Ff1de{q&E-cdqQV_nthfNZ z`F}Nn>3@6BSY8;U4zJ!jtj=RIRl#;S=NwEa0qH2aWJxI7enTgQ?^zFh1X63IBst=U z0Q(%~*Zkjz1`x9bq8C8ITkayZM+Mk=$bHP!iUSd9y-zA=kAyzD_ni$m0PO&DS;l_! zt)@Qr*}=SEN;-Rl~?W%$AqU;j70xFrWby`{_J%>6sM^3!pEVN8I*>Ka&WN%#-;;lI7z zpAK7<#+E~X`oA7FAocg7vijd{{3XEumBzm+T(}wtFkT=60`c!(8`f91!2DrxH%L0Jo-Yxqtb%tVo4FN}b$v2WsqCCXkE|xvdk}VY(v*up>?JzhH@Q+PsD+FH0;D_aF`4G$7y=s*bl8*qf zs_+h=DMA1!h70H|Ckr?qLdy+4S~~K5yz~WV&UT2vhXvfARBzqCEHrz{z$hLO6P-@iPhU$rf0S1~i zsrm3r#pKk`@al;KZ`Af2pP6v&qz{DtM81?iur7{l_BcnzrdPHpUegiI00@$NdzIZ} zu#TYV%`9KCvX+~jKbYgTA5Lk}B1LbfhuV*pp-|u?#?(f){T?hpn!2t4K3EcDRg}Ra zeZL$`-X4gA-3}NV+^0`9bkR*3FZ*8i8AARKdv6(5Rrj@z3W6dSARq$Lg0Ly+h7Cw} zY&u0mx}+PC6hS(qd(+(@-QBGq-5{WpXYS`0&+{t&&-rw&b6w~C;-#*=)?RzgF-P9x z9snLw(zQ#bU27ja&?qNxQPy@as&UI4;P>@G*9wGcpfths2cYD*4Ny9o)-L(HBZs?B z%ENZaU;T|x_e9Z%gpL7FWO@gQhbzuZHfAtr6Z*_`3|bPnRro%Mh4?mhLFeP_ve*fAF;nsfmj=EK@w#FyxwQ z-|Q zk8RTv7nG0f+wqNBZDr(re2#nN-fpoQp8)R)2f?+YC4(~D zyu3_B%epOQ0)Xxwe{`64`jQc?6Bzs$@L4#`^1GjZ-#gtbteoEGk!)re;I*AJubgWR zVr+QGQ1#h+5BNtulu>G_-|r$o&EsYYAv`-((6k|d9n{1&{Os;K!Qake0V=%c@n$6w zbcgykdkaU91tM6JYN;K3Hb=X%vRq4URr}l zk^7pCspALxXD!#?OUkJ{7Wo)s7^P0IZ5>hPzPaSHrrjf&@d2G7u^+9gD{bYT$9G|< zw9xHV%$vnM47GI5&zQ7YKz{*YWrhcR7k|c-j#SM!Md#{X93auFqEu%hEiq+Kx>!TEjK*t6fJ}xY1-rKQwxcn5+m`#kE(=5+mzPJDo;zNfx zArgyZkLCcUL2>+C*OR12mw*?kB4|yXPVMC~!f8Zv1qfE^>vi^6-w>n+Pg`!Y;0TXI zM%av?KG-F$@mLBj1~BBeci1OMeOoqz?k%?p+x2s;zN#-SO-3?<)cQNCa**LArU;-+d)98!uV_`vB3W|2LdcfEV8^+grZEo zPv8O^*p^-QlUg;=f`vRbUpICgwt|tiMEwVt{s--ry8!G-ZSnG?Vzi?KOoz6bdHLAlQPWZTZZ3guGO65N zva|##IpgrB92aG$>??#Cp* z>2h3@blBwf*rhK_puY!ncH<480)^3J>EnWVBKk}*v0Q5;B6#8M7yM!Gy}HUhte)2y$ z-MQt%*bz;}HOxQUU-IJ7yyET?))$$s;p`LG!QZsx&Z*{sOgjoJ)|WMGdR6_qkb&sZ zgl=PJce~fVTkt1qh-7Y+hG6+qg9Zx^oXm%{boko3IT4S&BJh5g7F1Jx1k^zL8F*wq zcsdY>azS?9U_yu_U#iqbx0JJw@I#4aGV3rSY$5&XvVAHo{kOQ!qq4tZ`JuClF5fo2 zSD5Gc`TkE#;jVkl)V`RK8RU$-@;|utK3z{!Wh7@z#YVm#>DF${x9Cst+!b<`r?f7L z5(8Sc7EckG@>(&aV(DhubB9TNKQ;Um@Au;6o#a8Sk`N(UT>Cmdteicnm5<6nWV0Ux zcoVU_vr(wz6uRH7No5cTgZyi!3l>|1TX{rvgX>=Wvsw7#lFx2EM@@scTDBi;Q9`~7 zzP~oW=D*6Wy&-`uh^z0tKs0gPSB$IC;WiS3Q_Q}m5rTOGtBuNiLaWwTAae0*FaZVL zr9!o=FtjLSlR)8t^*!rEbj}Hi)N85pDSpHRY2?#G<-`azpfvfDju?{9JhtFrczEgtgr+`V-l z`};nLF-0c%?XbJeisRRL2`lm^jC~e0er#KM5CRSM5n5@nb8i+eY~N*PrqU7z+lja- zff&o`)0(kRNVveox|~PLx?UfM+I_+(;;w%=o!k?_;^g} zacJmr91uF?xZ!80IYN=VN{Wx7jxvI?1I3U<-#$bN>wbibW=KnRRSF zZv3)r?yFh~E0Vs~nw(l${5EeQp)m6BqJ&#F?3W4M7J|0z5sQT`RlXx@Ub2qjaBoCQ zXLTLy!~fuKTErxpLGa;CKuXnnEHo_kss$@Io213c-g2qLrw76fhvOd)Rz^$;cO4C_ ziL&G>ijjA9d?bA+Zl@sYqcHOEmUD{v%g-t?G<;uNlaWjlVtyt>wfLo_s$QaKJDGnRd4*8|!>qkIxMO z9jxtc9}YdMT1#&X@ElVR8~7*9O6|)oJ9rkw5S%>sY!*nAL$jXkK`>3Np~|TB>+_oh zf}%7*`>Tkh`L3g9Kd`KS7Oj#5s(*<~CJS89CSZw9qIUo~1y$DS z-3cmkUNc%gmu~G+|1_<5v_#h1RvyCCU*lHl-)zR5;1O7>8^tDu*HJu;V%vS3G0zqF zwjeCBu;CKoY`Rh^{G-ajHdu)mMQjHzXFvSpw)1sscgz;7s>5-d2G*)51NDV732t^i zfhv`|JX=NIXT=BZ&PzbF@6p_e{;xL!MJ|^~)?|B`6#eqHT(8+lUxX@zQ2DNsgN%;e zzG8CN`;&)^Ey|DfnNv#qikf>YnRQb4pNn^N^*;?-d+R8CVoBwfI^5+joW2;5r#Ri> zdnZUc7oXiz5_^%@8*}b7$A@yaIYNhxZhtyu*f&|2k`cyP>Xar$7fI9|UM|_J=H|_T zyyTBXQPPDwkyEzF};|YS@BmbWEN~N+3;MXDFn2$bVt>@A55jtGM)tIk&R{)98GN-Cw#k) zT}O_{wR(yXPmnM2J%2)uvl_4~7%maq4;}?bM{bU_I$2fv$ z%lP7qvESyyK<|~%4%6)vXd!ytQ?8Djn^Np%Z23yW&j#y;)cWk&xE7s-^jaMq(mw7P z_a2QsY+&VNjWj&Hh;Y^g{|;UK;_#0)_-QivNOEJ7{SNF93*R4j2$5xKbHRO@vr%LpVnikgR&5nr@@vlY9uUoDP#DUdDAE-lBkuh8OV z)mLN$l6J@u(>U^dfyKYGm~fnm+>lfcaFa}ni+(MajsZ!G&%to+X1s%eh6YlfA;Prj z`fS7Qtr@3288`*Q_d{49E4MA1iY4(+-i}gMj$WR#w^IAy@s3sr>=V9vht^YNpAVaN z)tTAkIWZx)R%O}3F_%<*xqhiFt7k6hUM+Sg=#!%Vu3+P1h@!WQ(y*n;Bi|5G0Y`$R zzF3X|5)?xpX@ZTC3aiGqX&lb>n$>m$INt}+TC8sH8oioqQDSxq&#aQT-PRM^9{<9> zz|9&kg z8K+~+XoI2e(Nzb%tKqE;=lf0_62YK;BCXzU%odb>zS3#BQ65f@EyO;t0!W{57Z%W> z>qM|g2tt%XJk4e$H)-6t8v67DtfX4lod(!hL$frT@p4)RFaB}xmv5ab8$d`hwU0mJ zwgf?NZ$h3qT9Fk!O{B)fuW_K-zlCMf%0hu2*%p~rsehb7WT{XyKfIg}h@rh*qU|h& z`#z9LsHf2VD7WgX3r%hWyN-yo|A$4ToQxofxsuZP+>Bw1Li5+=naFZ&B@sh>cP*(} z1^RE{%JTBj7%}(XG`LL;F{E8K_HYl#mf;ZQb;K;-6nkBo?k&w>%G>_bhpJA(wCQ0X z)^5k^;7r~u3zv6a;wmM#lpK9rc zitMN1yQ4+Td^DzAJi$9B8Ff;cwRKZsE}n*kCg{@!;^40f(Rd`{DRJu!sl z4gpVCrEbRg@TAX|Wf9lm=Otu2xM<_7YWnMr`%*j?6om+q+&YqB)I=Bj38Dd#XU_?u zF(-{D)Aaq@`FwO*mkpyeEAq0F=7)L?cqoRVKFO{-2jj^Nhe$VN=+;{CTOJA{MtTzV-X30pYITONehSo{{&D(`SkFeHM+|=X3C|W6j z9qDYc#T-C+*Nqj<`IV2Zpz+ITQF9>evyeVBLrg|_s*~hYe^Q|~8YgmTF2(h3wmGi# z<^g8Q9A+KeX&*tHHe0l&8wLT;c#>6?BzH}BIoz%-Cj2z|;Ns3>vxktcXp@dLPct7L zgM4B~L7K6d_)Gmv@;1LBwdW5Szc#SEVQePRHp0T@B#vZ6xe1AvKK1@2Byxud9V<01 zc&E*E?{**I1l2sm|4Hw0eC6q6R?$1tXd6KFawSku#O+bwAVa;B=bi~HS@&K{q1 zvPLod_^cyJfkb|f#FsS%2~ELo^VRpgCzA6l2ZrKzq}{^0-nW#yzcp%{w+t{wvdbjHJI~p1b~CuEC{wrg+r|`Z00f@!bi{E2K?l-{3zgz zpWa2(Wl;XEREn#*y<`H-tV-7ib(rp6`(VZv@4#f@&jee!m6Ki;UDd-<{UIZLn}cHZ=CwWy87ZvOTV>A5?EaYjDa!#zn9 zb*b5(Re~^w2M=B!TRB?q&$y*MmAfbA@5AN?-YV7lNPF2U-1&vP`Ren&5h;8vPaixX7ggF>vRWb_=l2CvYit=k7Me_- zltSCDC2DKE$#~~t2vN$pSgx=(Uos!yixTy%`$E)J9^-R^s|mK}k|xqsdnVh{`sUV9rF%)xs55E)|3u{w2K^}X)KtP)i}3AsH4`-EcA zs{S>~Qe3Lpa^g$`?#@R|A0^*c#?llvZmydKQ=uo=?gC%wJqk_wj|Q>&a}57x{US<$ z_W7q1T|86c2MlD(Xr#`c+k95%2~oYGtnJsGL&Vf+3Nxa3N@xI(ryNR38#XTF&Z9_- zr~P_}Gl~IQh3o-f2m>C%67S3am7u~>f&5(mEi!qBH^OpjA92%LK52N;A(*7Y%k`Y3S6br{`Nme2Fo~*_#|e| zZacby_k`X04AX$un&uLZw*FN~PS!!bE%GUA)C%iJ^mW$X$_XT;13VMc^HIiMP?CCW zkS0Slh*q1l5Ovhf`+9Z5ti-1FwVVI2p9mh9k+KOdzAM?B{`K2TNR!1i?ie-k{?Bsk zKc2EJ3jI(vH|V1Gw-5F|i`K~mpvJ1wqW<*WKkoV;e}&d!ff_5vH)6GaR*U}mk?b2_ zTEUprgWkW3D1YzkUmqN_K*5oixl?}=?7`KwTsWdm%k~lV@ZUA~UmgJdw~P>!i|vJX z{|D^hpP%;nf3h6Onzckz*8vR~O!zb4)GLgui}?^mSp>-OG}r}|eupN!h9WzM*?$T* z`Ed1ngLx0W*wpJ1&YzHOvhtz||5b>Fj@{pL*D23xfA=dX7!((ankFpq^{@miLZp-& z{3?DVkHh?dNs24BP(B}J%R)EbsNMC~$NYB{&4s}J$~<+!{Nw&=+yeW%8Ox;m&mH^c z>O$i&!Tw_R5~DD@{vqZ6l)t}8 z)5>mv{bg_368z&rn@|FA|NqZ&cv+a+MDz+GD1)PPoYw~dH&U;P>J@mEfA1#iyHDTu zms&t06=M7W!Gjc`Y<6sk|FGGue6;P~n=}Y{iy*WU8lR>A(>{pnnII#uGl<$Ng7Eku zyO~-Hr}g5f7eR4GU(HM*NOY%|P857;INMPoHE+Geoc$-UkdMB0H)ib}VCKHF_P(#2 z9ZLehdX5pbrLveaQ(FvkphEu^fPelq`S{l09P!)-GX8i2fVZ?L8xqz3wl>t)m1X_s z1&|iGHur%mG!AhGvqZQ-DElfazUrT(ni_n%xH`PGGC*7da%l1U(f`l;$ln3No%@9@ z=H?&Yb`B`f3PR_5e;nwdd>sh42`9$NpV2TJ$aB-%oqe2p2uP0JYI44B^&@}coE?2mA30=sQ)%>)kPUCT|Rf`m(Tv=L_x5!V|R{07tN+%pp`Qq zrBZ?9{s$F(#a+@O$yCpV^PqtfYk)P32*Dv#^_8arRGV%#8(;DHf3F#VFyc1lWW~9S z^_L-ffsq@5NsBfApiuj#0s_BKJ`gJ7pB~vdU^d~xEBQan?SFRRUz+|7r93vdF+^JB zw#tLopG0jLO0?xx^$H zeP%PagQak*<=x3YsuI8Kw3ja?fJ#I(zi5-=6%UWRFJG#!#QD$E+Aqt0fMO!~nDTJB zb)bxI(>ShT8Dsk&?&`0nJpd{rJsZKSX&gWuM^sp*=y(Eb;xAA9kJw~$$qh?p-A?%i zYFy}u;UgKzJJG+q?cdMGn=^03Z(4+AbO91(fL0;Lg~Kz zh$vV34&elRhyQq!1O_J2CG3|{Q`;bqmatPOvD_Bhy*X^j^$e^l$) zw}9NRS;zIJqdeaGxixpw6=!U^W8d#Vpz=Dh;xlLN5127aBU|<6u&TAki!C2A9|HfNWoM z_|reT`uhLg{=ZB2yX5`9BQ^yOw98&8(5jcDYf6DaVZQBZKb8(fkl59d+KcveptrS{ zcRPm3AP?$=?4>rj}lT|3_Xp2!qn>2BANbVG9#Gt3TG`ckA#0B*j7TqIBpa6{*T z;K&~Ekj+HUC<(PSor{~qj-Tp}FO~Duh5!LG)r8JExWgRm z&2cZwz+{PGPo0G09~8|aOz}0+99NI;UvBceUJD(|*PK9=z$G;wP7kO*=%!^rn=Uny ztKBT9-2(WuGSC&F7DCLo1)|$>KVs)j)Mw=Y*kC^iAh0h1*fZDEp$vqe?B>&~nx!v; zG2n2S;Zc!Ig$J8N4zpjl9ZmtFC?U0Pbadp9!0R2#sNf`k^4Yh(pjFAUTCMQjZ|bIu z)_Q)lIZ+8lJ`7e^%n_KC;Ov^Z0iLe>v0T-Gf|?D;40xZw{kkjE>T?m&FK^P(AJK?! z*lmnfSsTQ2+rfKoj0q|~ef@p!3q$Ga>PV|P_qt<om*1BdpzyRxt1m)40G+LEpTI1J%d1$CGl4a-PGws9LVu1T#F%kz_^nvckxYy8vot)}S|r zi9xAGIY*J*=Bs#gSKiSaaL#u;z5v8~#e&DrIrCjRCZ0&ys=G zI0gb0XYug$#wbnEUBko;US&_^5O7Pay$uYuKx=ZSEU07{uVX)DI6ouCyZKX8P&KmJ zcD2TH4NTe6?vS5v1rS-QCJoq6RlO*7CqDed-&`G14wU;;;_!{Flm~{BGN*s5EAYoA-#fO7)v|mdmDdoni)n|%`Jy}KGEm-fL^2OTJAi8Z}WYO zT%RmRW3|*55~8Df>wpe!uWRc7v%EQd46{E5fU_lT9;HlL)ZdkVr;L}+t+1C5)V+ql z0KyvyGUkD&LC6WtFDlHY%VwkSnCbTAEuPuhUQ?uLdw4bh0TZl$*dN^hW_~#YEupdzvOO((pCx>%SfT&>&x=O=X0JpbK#%(+pdKV+RB@>9`WIik*I>&sdED%1Pdocu5 zeIH-|ebC7X3poJ_H3{@ZvG zJGI6~82#>$ld7Vig{`3T(29_*qIO5n7;G5omWAHKnOI(5R6C1M1zpEsRo18n*E! zazfW*&aNT7SE(>NVHl{%>S*-j)1Ejs(>$OJD$HltPmTdEJ3{SSR2lX}AyS0u69wAW zOQ~yFEfZTv1PG433%zbVyuvox$a}tzx512uk%cNDBLKLAFq$+LJF0AtMKG{nf`HBB z>%5|s?NYmp{oZFJTGfJ&Iob-SY`A)`Yva1gcDhrUV8UU*=C^ggnQo7t3TlDHkq}rn z7|!w%k>$?UZJejiwffR*aSYV+54@JAzbm=WCFB=jE1X=k&q$e(&yKgHY@5(cEM}{Q z8h&27C}l~R5WXHrqXiE_yuswWV{rB?J}x&2Sl?nBl1^l$t(_OI4j4IItQ{oj=bHe zM!AWhaR4~yvP?-Of=BX0Rl^xlwUEONt1eo^Ab_|{rSfxxt%|2>vjuK~)>$UP6$G-u z(8j5AMfg}v39=5AU)33rnaGomrCMM(&;%v}(W(a>Hdnk&5t{rQKixYzl;715ViTXk zJV}l7h`A~VufE<)4!-RFySF1^V3?-1e%h0tUx|y+yX>zp?m!Vi&Cs8TgtD@)Pn!IG zco9K`|4pC__pNZIZeD%8v*eoKFx?0f#qUCg@FrT{fXj}Yfm_$FzWzcTta8+P4A#|) zyeLTO!Mo*i{N;1g8-(vY1HzZ>g+>7#ds?v*3XjY4sECLcZ_#l}>YM_SR;l@Eg|7&N zI@!Fc(83^`H3l7bX<-F{3DY@QW9H*s-LQg4)9m7^#iLyJVv$mT3QGa^{!5L<;lKy< z8{QekRg7jVSH5*Dmj4gZ96VC<`3Ap)1)~=S4Xa(fmn_>qQE-&Um&y)Lr{fJQO4OB} zR55i!GOiF*XChCO|8M~S4`cwDiRdv5*TpcD_--iw;`@;jlC0@4_1(!+Tmi~Pew=|0 zhIeOC9o?{e%kuan(=j=-q(^4_W;xIt_=3_A|GQB-^edK+bOYr%w>X?m5mqelQPAZ0 zLd?KyXrfSz$mW~nV9M9z1LTv*vQs=$=a(c#r<);3Gdo1_dEy_)hZ-@=$gcd|>Nx)E z^G>4@N~QXj^|=GoSq6fj@UzU zj4Fv_y29{++>7G_|MiVy?x#A8$9^-U!K=cNwr4Bq&J|phFUKRok$+&|l);ZQG&AC! zs82!c@?K0qRH`P2qBwMWJ?MOT9rr%D&y-&<&Xnk9n5$J!UY>8?)GXdJooTd`>+I1J z`b~uW-MlyheFr6!zRQZywHV>MNx|jwy~ZqE8pe$0DN~SBjfrld`h)=96+Q@&M;M!l zLja9cjpO*)@kq4g^z<^ua9r@oZ@-$fA7znRoWMxTcTSMB7x`^aREZKpRhtRN=A#wL zj)_Ga&U_ae)e|*lmq0hB^)Fw|M*8;4!?*7Iw&>}Y{_E@#N?Q{CjFQm|2sa(W+Js7& zlpn=}jc?@g>{AwsIExb}uKeZhMN-^3^>3a9W+U>ga0zEHk$MIM3G_5HT||Ates`y8 z>^9B5c78YpHOi`!gVh1cwjjJp5Jb|thj6+?Ss~NceydnXaG{)a_cQg2RCiv9yf;0B z3!kan4Y@P%T>b8EZ~E*5ROm$*2%?5TA=eD!0bLQ8v(&-;dQA^lcpE?c&QLP1mVMBP zHv^{k;yCtQLoQ~p>h?IrCcQHvsGO{xi1Yj22zdE)KIQ}SH>G3K&^?KH9S4cpz)a2A zZ`2B@&pv0b^h7g0?L|B&`S!5rwsY&L#j~;F9^2iWgclK_V+#5Pziv!t15^k_BAP+l z1Wd#z1{C!J^I!%xjtOw=%E4%$`SuVJOArd!bkndKwBL3CtoVrb&r)u?jY+qYIiuyC z=t_{kn3=7%-Hy_TfjfH-%f;|UIyaQZh?!H zz?x0vtM=4_PO$A50|+IfWfHwk-6TkeESG4qH7SS@8G)`WBw~5_ZhNY+vi(5|@LnC+0m-^bDkktOSP~$Qo@S9Fmb}dd=}NUQ~mdck4#L zz%8U)o%$MFI<==(vUMP71A^%4uTB;vp#QZ)mh%e=hnybr4a`nxvQ@F-`2K-M+=os* z8&M-cXahJV-OV3+y?;yN3{i(-#-@Ak&ec}Zh&zFs+&AN%pV12qW$aETIox!X3keg5-%BFhd@pgCF<4#(r zNmqZ2JVB_c<|^d}Z+~0dYO+wwvF%)yd=ro);A>V@PdCX`9-A3~G@c*yU@d`Qcby8R znPQAy0#HOkJ-F!A1^7QyqiHr!Wv)|PawJ#Cz`(2mW{$#@6JiwcpMI@M zHONOZ#QiF=4& zowCAA8d!GQB@A51S8mJhq()EEH_AjD#>B8b(9peL4qR|!Voq4&M4gF)a+7@i0B!ga zIeYv}L{l}5RqmEN>a+UP?a4Z)(qKZ4ezseoz+ZqnFO-|ATHa5@LW6`hLIrb2>ZAtu ztJ$89#AQ^xzI>OQJMhYN5I;@Nr*2tR@K=YzYx04(KWPp(R542mPF@J#8p)F5C_l>a zd;yYk$YSz*(}*Tvi#q3g-D;Z*kiekNtPpx46ZdsRK{LhV%_yzkU7~L{<_hL(}^ z#^ZZ)$AXwM z$hStQ*1>2KeP?POrTU>2>6I#Be;ZV-T~KmiBY^lxx<2L^IBI zIHEB&)31@bD8~;u#l%B-JK(ejBy*Re97YwyVxuNcNCQS@N{bzJ4 z?9to56=1wr5m}9m?OJAz`fJ%Ii9gks>Nidmp#X3{TV>(ZPRi8bx0eI7WyvUcWIxvQL2QV@1PKd@W}$Qf2XbR25En|B{^rgnSu zo1vNph28i7Ihbt8DG(2c{1D z*Jes~?wzgu@KUL^XQ?#D4<6{fOO1JY#1oRm71X}0+;!{Z<22s*n_sjBG!?y7p+m;$ z`Nl)gFvu8qJ-yfvU+E^lH({=<54rY=$E9z=;G&t5=z2qa?Y7T~(Nx_!w)sM$w#Ar$ z+ffu7_cpny`?yEGay49~UQp9?%e0g=Z9jI(-7qjSlAd7eqL+?`Wn{(2Dr6&V2|k% zRNcn{y@nyDhVDPUVCPP3Xld5ErX)Caqh2b|__7crJzvDsaTHW!Ok>Tuo<9Ao`gd2B zv;q~l({TbG?wYJ;26&J2=gzgf)AhOW40FhV>-$_-Z{oOdD?4nNyrNj3&vgbeX7)UK zc3(2kuGjHGKb~WW4H%nv*Ouok-EB1OXSy#~=LO8OTXd3@N6!3&69j5Ux)Of3eZ};c zBV*g)VPRV{AxTpF$bNaJ0o(Z&n-;}xtf_jNhSXBA?q~alR0fh}Xl7GI%&COj4%0ox zF9XJTe&`;rTH07X z+a>D@VV3v&dd09b!$8~oT^+9zJd{vkb5o1D85v)dAbBr^!&?20d~r(b#uP_YdIbZ%mlkh>>7S! z#^HbX3X;dTjowZsJhmtAWscWd&$e5lZ*&|h01|A~Co(p?r)z0lqpA`w2m=H>YbxC~}pTQpu1x1Y&E`>*~usH0yPbP|(>3VjaZAhtIT z&vXpO)5n$9Ot-n>@vdm#^C3%}I;5DGljR1bZU@buKAGNVW+c_+y5hj`gVbSrhxH5K z0+a3aoRCcA(a2>whTwg{3e9!B!l(%#qev{Rs+BxJOUL|vd{NB4TY8ITeo5pQXEl|yzglk$6*p(Un2vKJ%Ooyz)J2aUu2`cysB=PuY0f|8!B6(MAr zA-|jq=u;$Si8oz){K(ei$)D!M2JR-aWYH1J*$sc2qCLSP?Mo#oCHtkKf{B5w@IitA zL*9%6xtK1QomG|LN5AZk0eY2M^;Na`$VYR>l%-i!I$P`MG-6Zg_`kk17X#4#9bM{V z$kh}@re`nDzE|^@U49EtY25yylI4Wg6CV=dIVvU`n-*kLZz z%E!d0YgIJFA&@hlUl#Y@|0Kfz#k<(RTfZ5Bzq~SVJNTw01;eD@UgBTZUx3^dnG)00 z*$lMSG(>KS7rur4>oWfQWVAO`F2HLPX;1KA}Vn+wa0ngfY~9lIocw>-!F#bZFUqtWDzx}6zsQ3A?C8i~A4W`Mx!xRWAe za-}a`2DUl&=o9GeU-hm+{^>)Eq4HzfcAPkS%2p#7&olX-p@+gHF93zf27HW!`*kOn6vBWAf^)P-B*Lkx z)p0)6fdYcIuiDUa5$z%&iijL|@*2o^Y-Z*vWxc-unF|Ym#cZ( z5f_aLZsYD~#w5+kX>lTc*Q)rAvymL7zXEPEP~t%m=fg=1!IbxW4VD!FM?g*&Tl;!W zh_1M)widHC>680P{j}~gr=L{BGD24TP|1&~gBkyO2BF_D9xI0`PsMjXh830CEO*-j zRxlE49|8`GE$>kH`$m&7h|5}vpH@^BoPoC176cj=iJ*#5v!!?uGtLYa+#JZW^;Bv% zKL`&KBB>Rc%io-WLlVb~J&F`Q%`#R3yHN2`F^q;#Z$<)Yp`n%D*d=DQ`jfH*K=ajr zz;=KcWNy3WiCE%f$?yqoJPKGjPg}R+2O1epAWU=xerOGA|u}ZmQ39gL=5t$I`$KSH#Ow zp)?;=Cj`KlY5rbu26V)V$ENEzfdojtPQCLuD3b2dPl)Eg7d`fxZWiPZee%D31BVyP zSPzmBR6)(jluNPzTu)Je7kn583R5q65s<5>TcE{-$2;a?;s>4u#%#yy+@RNR2Pa(1 zCB2&}gETbCliOGkns`3}nVbE~nt0ICqlAv=e4%Sz-?7mqR_)Kbip2gS&QMqM$7Z3* z=E3g){sZQ8LNfgp1Fy#9dp9!7>L5K_)`lqEu}Pw^Gz*mIYVza_z1aDQPC$LbCOk*deIxZ`l%=9X3jmXMM6s!5 z@>@;+ZBoTwBcY1JN>>3+!oD$n_)z|)Bgp2k^$91l^3k;a*9i$A3wz~mIQHi6$i*t%)8yLQ`=nzZYkuVQv)L(qBwhayRrlW* z@^Kur8AXD{MK6*KPQ3L7_ed{kEVWnZZ~qMHh^l-j)-)g=l-ZZ9;hx>|{BO?zBwsoS zXW|FOfAeSl?J!JXgA${Qdv7pw77dKnoVR=ZVT#BE@D#o@(s#bX0fD1*J`RSrG_{k4 zx*)3?hiro!Ztua3T!ACKZ8GMJt1oj@3lqyN7x>d< zvQ_fq%3lqUryKtTW)qi6wq9zt2cy$7*aH7i8Mv?IDLsrLfHdib!i&WCc?y`7-Tc={ zZ1o&+8rZ;6o%#27)~y33HNu%Xry#o>*C@NK$szmgX+uB~XqS+E0qDIfmWTEr`zDl4$|_E=E^`xUIPIl z1UMl40#%MYBGx zu^7JJKo%W33E9Ec5AZ0iUf?8|g^T1LVwW^PJ`$cXy>;TL%{09H8Lv3sjm| zWk@9LFT7DPv@jLem~mPUqS0|7lfe2|0F%JMW*UZ_0nmo_pFbg;o$WS;sLg>~=dMNj zk4i&;YO-I6HPV==Fu(34KW0+}cnfFyY60(Ihhzk`KKvpyau{Um0U&E2m0WxpxEwq` z&kx_+kRWkhBRiXDyfg%v<_eH&ePQU(!XFYRRP)&zV+&M2D!?yj;s5a!JD$bpy|(Lq zo8W|98?LHaTOjVOup79~QT|$>GQcX65?n7q^R_+Lq?i6%tHS zK#S@D7@@=Ny0;C;yk`bsL?RG{fcukGRmK(g1eqAg0JWxpz_0-fiq+T?yQU0j7_9GZ zIqyLyh2WC}0gnbg@X~@E9n)ylG-}Bh#f1&0khYcG*=m+O4Sf1&9cN>kqvJ4!nb*K$ z^4iM9mgQ{f=RY%>NX#kGjmTlKUVP?&l|h=vfP(8YXnhWla$CUu+v90;-ySbke9#S$ zG+Tg7)Misk5)$hA#W4%0ylHJc4^SuDc}`cv)Zhj3mQ$c&w!M}XV&5~wm74dooF&_& zj9U!HQ(%? z(va&K#LVMd8G2rUaX9jrX`seh;dW;40t9sKZ6;wC36K^nq;j`BLMueu(fhoC#`}h$ zzCeZYp306G$-nHbKbhY&LHoX14GKteM)mx=ws7j}#{d*6%|e~yxeX?Alkfl<*jc0W z3JF2eNMb(cNswNiEoz7dXT<~_U;}8TVv!323AC?+zq+1h&%pm zMiwOiPGxcZRS6@Sj{+1)0kx_wRiDvuqdt156j`jMbDtP~x)O=V=r#$V)<=7-f>iMo zvC9_IiH6rG!gk)F{hmP@;hz2zKuzuNb0+cvT>C`8Fwq5-8`-wsGGs50Ph_1 z`vAUneUn@TuMvWd0(X8fRbnWkE`%<=_7F0d58YfFN;BV?tsXBilp0}DQpg+x#&i=o z2<(IP<}DR^*i-?CS;_!i>MXq&zBtI`G7$;mdic?ye}%}$)+E3z2_yB728;a6RybI+ z$HV#=Bju0f%s1|m@XuT7^A9*Rg|rMl^_l1hqh>`fD$4o1h0rBX zAkR>h@2KIwKh=Ggl{#SSmbhU%LwhRC56W@o;2_OwavglsfvRw{E5ClEj6*kO)L2oh zlqI{vcafu7sgvAYU1GcdAdjD_9Erb!BY(ZoE!9rIu4U+~Ab8yTMeV-=vd#h!8g8L8 z3m~JV(V0r>D!J4S*IA!!mDg(Q9 zV}WB5mVe0YaWFryrXHKxttX@XO^4U;gY#JyX&Iaaa;CC9pChAasMW1363Yt@EKIH{ z(P%h7kiv@@eOncXoDQB>vpruwbH}uf!LdHo30G@uUr96+`7IcsmR~zL_VzPCB(IDY zl4c+vO4_6<9pG3c+3%wAsIptk;;6l^5FC@iO;(Nyimr#FQeSg%?OS^Dvi=dbV<%wA z<%&kly_;Lc2poF*&3>z&VXFz8`?%3}G7Ph+L-V#l1Xcqm+;t1K+3O1rRbn#$HKkXN zl}h_I2=TP+bJ{^334qc89?)t5uUj#sGWBluw;w>798m3LI56zqh>wk3h;aDNJ1*VP zEPM38po>v-g;2%-$=h@|r=deuV1Ky8?PG4biY+#94eY^rl zyT5Mfi|24ysuO?<76CU4+J_0tRm}=MO;pf~o|h>-!0oQx#pug=sb5wPIh`MF*m$_{ zasd>iUI0kF9k}ft@1Ez3sChixcasXI~MUrd8uw=m&$PE zuKFF|n2}cTJMQV7xMdqs>t*i_mj$|?ywWVEkL$1fl51=iuGRsCZP|^;A-!-~yOA1L zF?VKRZTa};hqn%N%Cy3<)i#4A7acmXyA5XrK=Ug!ei(gF_&!0$w4Sly`}4T%rH%8! zlhVwgmNWk23c+$Y-ctETuUnMaM9cCu*#G6{dZ}S@er(6a(ClU>_k{M|qPEHi3f_7E z`=P=nq5b*$OtT`))edtHY)dUHJI+ld2=6v5OBAwCKzihgQ>Q$hrW$bzZYF1FqLQo8 zr(FcOKB+s}6&}bi`1;Yoa-Y%7yTk>G1$kef5*8by@hUwdZH3c(cQV$7WO+8<~ps zs!i$M4Dr((@wkjSvp>W10S+bEGfsEND9l@7U*#KLuIzW^7NI5%H%5qyc9Y1iXhh`z zI`c-U7|}PH+~bBb->Oe(7M?jdn0)6+^&4w)_izo}AcGmpv@W`^ueg)7V9c4;QyC<6 z)Yb^5LVKuczQ%Gs`(7TE>_(#eM7;|3V{~*#a#p|BC~;PaYxy0WrsN#mJkT~6f!fm?384hL{WK;YM*&&&OKELRb%5g-}ymP+ueV$)Ej(ju(l!@{7zP*r@nmKgLosUJ@5B%DICla#H z?>)03tb75y&Pw)YuYsy#|3Oi!@{QEO#&iMLH?0aOzl?wRue|ldZJ=E`!apGRC{hCGzNHWVssVJ4gN`GL}Aipnk-lWV}CW=-QEw zsfL_)_v#`HQm!^--?YbjM-ybMFT-e~2H613!}dCvfGg_zbDW~>#^?;z>1GA$yWhLm zJ2~3g8jQV^nz0brbGPiG_bLH`CE4XnTvy4%oG|s8H(ZT}0GkFN%NX2mF^x|XF_AM! z#FGY6bL;8{h33Af4GlGI72ar)_HL_4BWN5{dk&-zum%VW>jM~a6Ie^VjDYAb4j6EgO)@h&tQvFX+sP@M%+x3#UhZbCpasxFECqGZ#r zrkje1creY!xk{s*M@A}x^Zlx~_gYES%L&1 zKhSvZFUui3*T1*DEJZ}T#EKr>V-u*M*{eC+oybZI;Inns6a03Kp7)%>_?BZK7D3m@ zyFd!$L8RIHWVpLlE8l=fua|d3DknN5Dc)chxuQy6Nq*q1s;<}c19MKR+x{d@APkLk zHlMZhqRViND|xxeB2DDh_*?T#Ra4ON$L_7yj?#{{;zLUx{EsR|V%lQA&Z{&N$yfpi zgm-GRu2-7RfdwZB99&H*+HZPu-cRI^s#^2DfPFpHE*}&zm${4-h*fv|i4kj^ZZEd& zvakc@2Kv!=T0f?9OFTPSR}U=`IR{+)p8aR&geyUf@bqV6$vU#$R?K{Q+@h7@1H?J} zQIELfpw#heIP?^xddGiLemLz6yT}&Hw$|A6QADut+t?Dm!B!>RtQ!5P<43XWqsB+n zvb}M;#;EH8^ejPuC`u2Q+%X%v%M5i>z*iZ^5+s1l4%wI|ZhL&_hrNwDA384)5Id3E zE>+}7`}7*$)qwtY$pZhhbimO74x89EMY1)l)gO2tct~wuct!nBQ>!W;})1keeszS`l?-^{Z-ph|*?MeKQr}QOM zROs3f=Dv_EZzYJ(NDYY1 zNklP2@nsV$ZNSwY-@zVrrn*CJz?=Sk!)@~m!yP@%@#w0ugsJ>pa(z#x@DdDtWUrQc zA(^K-2ZiJt3nJj0q2xxG`=mnWe7P^9e=79lS=WHZ<+bKLHE~HuvXZ{Wn$AKp=TSuQ z2GhMF>wSZsTuujS2!7z`Mr)O9qTRNi1=D>ENH5I2bb7PjR<)-!y24r#iD?^usEKM# zaTGY3v=sF#7JQEtJ&xt}8j9y!YR;iz)tvGW>JFP7y{r{<4PKk^e!pbKTo}d|?>-2w zs$KJCK$ho%b5<7dcpgvR#ch=n9wLAQm~i;$Qoseu+1tp z?g}jy*0KxGZJUouN)b`^HXjl}vem~kv=VhzTq{3CVk1jK5~ne$@_E_C;qU2X5l=0!C%nh`#Ed%=O+zqGx1mqc+shf!#lJSp(QO_> zTom-LVMsSC*Q4HcH5cD(CTq5mW(lF3{K1J|YKJj!Z8G62w&w>D{nbi!NaVcfzn2<) zA$mXbqWAEq${$}rv;8aS0Y$P&5O9$N#UdrVD@>z>3bLbHtrMro1XVMr7t{~p-dU8^ zkv3-M^{cvh7N#Oy&XNeam)fMM9dFf$_*|auY`iJBEQkEWIynBWtK>a+siYaE*r=WV zDgUmiBTbp)6FQ}JhJh-9pIvn;#mLp}S%LD7wszt)8;g8aU2p3NfPhcXyS59mtT{HX zWcKn)G=qz`ODu2DcNtckyTTvt3nNb?=0i(W2_QBT*Wfw2koHSMwk7M*E;sd_HQOnG z{hhVTTPpVU3b0ONqLZtvdD_5ETmxvIQ%Y&$^CDht*vnD@`;kfwBR;obj|h8yrb#Ah z9_>%OU(^FOm;zbuoA(!|woS)CNDHhI-#>93NC)}rKgjI-m!|_Eis(ETVt+!Al!S0D z?W?K@>BH~O5X@~EJ)sKkX6X&qLj&d-QCGgz8q(}^HipBH&Aq#AELh8|686%j;>Npu zUMFX7-H7Wt_(K{rcw{oDmn;L=nXWeMjwDsDRGJ%MwG5}=25u6Qh} zx5)|61BafjrVpF%p!Z8;9Tc2v5Kb~h;>QS!Hn;%#mt0wNui%XXKw|{;)E5IVWXN6} zC+!HAoV&QK=Y^#b4DSG+Ob&V+fHK(77a1(KARQC@$P_m_CpcFdFknlmQ9za;m{oU& zo^_;2uV~ztu=BIl@w@ZNc%Oj}${u`tIg;a!Qrddu4Oy8iY7kNFSA zK&Y*}+v|KQf^@J4J0N6C4k`1lz$*0<{bEK0=4=L^xPXG#EATC`W(!&NrtfF~#qBaL z=N|M-J*65NDNwC;2*Y^dqsa9;xp1%lyZGpiV54N%*}kXs%$SIcPKHG!rLav==ovP<rE}08^ooL^l_+zLZHC z%Mi#n(9*o0rxX1qW(rNLU_Pn8Rnz^oH-ef2DOZ!;-3dDRA9#g8<_E?Ur}1->qM399 ztVegPW<4FE6rKMnAgV#%YAGUMOZo?t^c|7J{M*}RO2DrMeI!tU7@Ff@O@j z@Loz@`rrIkPE?B!JFN|&?L69+98g`#Q0un{x7Zmy`HKoUfol{pO*@kQ_YG0a)WyV= z5woUVn7RKCf=r2kTx6dWh?1fI7v=MJ=TA@oxNmPwJ8%&>SU$~L0*@{6=oRiDX@zNg z26?bBX>>JR2i#kLs~zO%XD{u}q%H8*N2mw?H&i}ujWV_m5!h|2fmnO}m*(e7Bfy#n zyqscrvhip0Pl=l0YyW6&g%|dGn zoD~2jKQn-)ppC|9D`+BVK-5!Y&||j&qvx33`RoVWWD}Ht_~CL^se#bouaEQs&a+zz zG1}rGYU9JDm~fL9YuXn`iKb?)?G!WXyQ!~KpUxy9!Xi&d@^1H*_^)_~;n(#m9WHcm z@6e7){x6C>JOR9z%#SKPBxhAI@dihfb!R7!S8lin(Jr{e^Z&jYl<|mPWK(6?Y5$8s z{x>j*JvRIn-|`pZ^M9660dAS2A&&oNxZ-#n<3c(yAZl^Em-+d?|nqw-g@{Pk@qgXSSi*=U@JQGovSe+qi$N4Ju`< zaM0VWxmG|+xq~N;P7oq;`XnHVb^$I^1zvrMkoi??xrv%u9Kg+b{$Lb9@zOXND)8$) z*T82u&I};stR?2XnYuavf=(AGq?r88_|KUh1Lp|-L3TiC8uS)5j*v;S-}`ji9B##e ziwFRsZ3=gd15jT3V7{dcn2<^2rGDVU(LVxKJ$|{`(4YVOa%aeo{zRzN*EgwSgqAbi zCgDshd2uVbyg9(}D!(+?{-?$ret}ilVsXVs;2<(!-giO3Z}rw_VIe=gp!+UrbGZgI zu8$FzZc8x=%C)O|fVCHGrq!=0tpGs&aL@KD;90Z-1Oq&w;CQ`4yShLh^k165>j<|O z`2lzdnA*D9t7`V)9)<)M(7q}q|J;t+9m)Dz+F0B zb29}N+2Ik;ai1c2loT!6j; z(hOdM8Bgz63|nVkz9%-$^1rl-7)S=~T2tX|4&$k{54YQ}&-_*I8wj0-q2FmD#$>rc z%XFFgUUKot?$l_4R7v|GnDAu_9M(;6tOaba1nv|*ie+lV9Db(q|bq?-8D$o z?TrR7$d+ieW%AgMOltV~!TsMwP=j3{Y2D-$=Na6csy@X>WfTEyMy*LV`nly;(Fd|W z)YXVNz`N`UyEqNy6eCapC|p?!@N>XF6f092XBVSW}_hE6$ix91KtqwpD2jm7}N{numW|Ex>9@gI^GkHoF#VCGqS z-e`8ZhYXxrsmivj_OO(YT9z3fsFmuD|@Xd1MM6z zoihdw$9JxX0*6d;&2u;R*X(4vyEUE`aC3C>fJdF&7u1J@89L$#o()=Ge7Le-b-P45Z!`z|8=S(gdB)QWM2x_#72av zT?!1vXMo*%fW^+3rrzY+ovo*n^xRh>omjA6i{{DTOSm4f(l}pru zY8UGXjlCRrQd)Tn3`i@cfgf9+>;6`M5B)!`+ao!^AU~n7uW|DRoKKUmhNhKfwdu;o zaQ%PsXNt8yDsS}5A$LK{d*{76h32ry{R#{f21WE(dYV~vrRTp}b z*OEC~*94C@9Q)G+II6S3Ayx}4ay?yV&bQyXj7_MincMHg-v;4X9$nyB8csm~RU0Z6 zc6@8&miDDa>)V{o&aEEdE43JZN!#-ULAwzy9HjZk{Ghw0gXeV(xerd?=l@jNwA-7k z%!O0xe<@=WM{L1?)Xnw!oc3VlM-XesC`pi4u|R8*tW* z0%_>t%L$+!m^4#864?mQcoN$FGVgruKrvzNcvM$ONfW&^iCLoSa{L-09gL1qoxw+Wkda_Biz zfjdnQuO^W!2v?~GQkt*8e*GFgArn5U?+iG>x)UY9Rr1ycGMxJ9Z=Ulc`ZQbVV@Qkl5L~2I25LkQQIh;=baf1MU@1LrVD6L~KzSL3Jl1319VJ~?PJm3|yJMpf9-NZ% zd(8%ncJR5EM)6YJSLt`EPQ-|$ABH{JXs>}t#}3pmL0%@tVzOvn$1fcw!|#G$@kg52 zkmjD-#;{1&5(d3}NN-T}Uf=shR692eyL-Ky!tl<~acssLSzgd^@|({OmjrbB;1l3@ z9|xV^sx*@zuw(AQjgEZtp47IwPq1Jzi9DB}!b3ij?F4ZVn9Z*#8mmn(r=8eIu1u(CX z3Z(ihJ`^lG_8v%o?hZ0@r%Sb~qlvRd9UQSYzIdKgRDdQ%ds^n82`Dg&?QcQJ-Q*%H zkI|Q%!hh$2D$oTpJDIEK_T118kHl0+f?XhDgs&jn;w=AOTpuZaNb~cVr)H!WGdewa zqtC>``1P2}?%STSn8^?q?^z?stQ6y1+B-99!!%Q22lD*_tI4XCC~udbIbP>DAODjm zFLzC6G3R#b__;6Cv;(y(+nK8cKa<(o=1$s?d~8R2&o}vgYxl*|T~k2XZn}rsDUd#TgGE#u$bJXOQ|m0h z{`C%atJaCmC{*bBu+#n$USKP_0N-i-_I0m}Doo^Op_nF~kW?+iuirqfs-4I?rkRLln-E663J zv)s-*{!bPF;n2nwXvwVA3lu65k4OAu?qt^PfoR=X}Oo!6CPiZQ|gR55Sf6x6)u2P1j4KHdI*q#%oRAL zo&hm01~&%>(B^tz?>tBvIEMEHU<9N#AL!ovY{6krPWTNzF6ED6yIM!K;K*zi^VLTj>1Llv|&UxfqTv)ZlF>H+7UdRuo=eSiU| zi??wnaN~o~g8KYS@+zl&jiE5zq__MAl!6L^NGZmslJ;%#|g7TW~R?Z z`byy?Loeb^7=(l;qeSYrJYS;FF;Zgh*N;xf7$hQGEo!;wt@AT|v?*>J`9TIuQSCftBB)jYt6u+7wC3D{k zT5i()ILvck#S63L4SpJL#H*V+kieA9hwvJ|#JPgPxRD<&o7F#5JBE9p%X35E!BI7d zg~eV#;nS*{?%#EB(6v+JuTe~Y`~rbVv0{xuQto)`sbPmIC^`##K=@AC*l<2PxTt*k z1Pl;1hmRU0gGTo=eCV-jWzJ&Un{&8WLJU~=aWwQtyKg`|y1tm<#v(|q zu?1N#=@#j74YZ%qq!_KoUr1%8pxJC4^qOC_ z0bOT$r_x)|B|`q~qTJbwLZhPAibS+IxJo^`c&`gIdNbx*Hm}5~k+0YqRv!@+4WF#_ zCb|UC+G)YfMmwNeX)xd7d%Lcx%91D^{Gh=-_cW!nz+VGH3=#wDkLd-QaU=ES0@$ea z9cwHrb2Q6zYFsC_Uauhy37`}3 z*1x`h;Y2u_)DGDA>wujG^$+JvMH+*lh6H7cx`#AM$b}dR&8bUD=ZX2#0sjnz#Ev)@7 zhHW&dpQGv&sxqaqdw<%Sx~Z$#KcrwXD1NW230onZy!G=bvvzibnBU#{x%)bQN_Z29 zrYoyW%LajfPYC`^z$Rn^1jWWMz2H07}98=75_WL#l2aUe72LDti8?WAR@sxjoT{jJZ=MtXb4#>o>p=8dCouzcWGe!8wG*7Ybk9R z0cE&U6vX^wF$gM;I%ZxZ5)a5C=noZdRu3`tdY&OlUiP0x*y}+_5`cYRdX8J5V1(lg z$aoryuhKg+9}RxMRbe+oP&5}_aG$Z;PapNDwf5M2u(?ywwy#-&eXN1+II>Y`{{jvg z_9n6H%uisIfg+~S_(pZnFlDG$2xd_m!3ia3R;xV)_0}wwMoR^_2I7rW1v#%7HSmSh zWNk8#!k;MW-Tv5YGTg{}6KOrF-3eri+{ia>tT;fqmal^x$T~o z2u_VbAOqy{1(VksHr@|>1N)#Y%DPN)0mZsg2SJ%92nMua9spoheQ*XO{Bs9xQCgI* zR%#YfwNj=5a{M;|D6Spi4-aaH$j9IHFu^U25`(5}pBA49rE}j2JPMuLRf>|fXIkbJ z&U!rO208)m2O>f(d`dw>d8^iE2G3)!y*sxF_VY6dWb!EiSj;d1^wr*mnmGN8m*PWV7AD_#%dJY#)IDEdQW1Z6QrA$l7P zq8aa^A|fZ`U69!{4?qIfThDr{H& z;#gx(TD?;z$ee_^O9ii%Sa0WdZ#tI@aQZOX0;?o6S_~9klRhPRqrrV))>tSlrN)hx9Y5o5br8KcQBck)LohjkHK8I0u-aKOfkD`8*FeVI z?50-j7F<#^ov!I91Id`Fu}R)@3$4PHmEqJ%feQ z-mZxYE|V@)b>3D^o>9iFjL6IWa^P~pkSMlp8j!4bdnt;$>wA`zYr!L#|Mm?$V8cxY zdZRiVwG?z8r4ds*O1)ik6rN8wo-K*ukvnN~pfy9XzbtzG=e3c?3<^-Idt@3gB@Y^= zs&-Mk80&{kck{-k`%UBJ6u%^Xh1`jsoAX~CpX(JWor_*I>@3QTdKqShg`M)<{F?m4 zw3`%WSgkJLQKueH0aP>kqizAL@&PY7K&jtz#c?&6WyA z|4WXdDqsjZmplaMxl={wk+kUH7aW7(&#bK{pI)>DvU(=4WPkcll?4GMcH}2uDa)Hg zaA@Y_I#C&RS{IV<=!!%|FKVn35rnvAZXfRf5u;N@izq`|AI=^5;k^2T4~R;=`l-vy63|1ZK=S)^>Jp4m4W9Ga&k*STG96G77!h}BB;%ALuw2`g=1%a=yQBo zH>ewZUb=l*d|OIdnrgtK(0rl6V#p_Z>hpqZy2u*bP)+(9g6O>kHA;7lRf7EvA-m|I z9=9s3S1{R+seUR$`fXNCfI+I_f+-{nFx42BFQ7Bdd#&4fsA%X_Q*qL2?aJ``x&17Ei>n>-&blt}(CD{o?mZ~k ztgEV0?bQA)idskugwL6)cmh(Zk|bOL7cNz+JpwMycdv*L-_d}SjkrFfxk{FsZDo=a ze0r53bRrh}8D8mHr-R}60Oz#jgDsI1XKO6;)$!{vfjlTmS8`gj9z@3>25 zNKO~`FmwC!CqJd>MCue_A3?8VyS>>%u{gX@$(d2DHWs~Q7;uwl;x+FKSTa2^xvW#D zy!&{Hx3*QwdYyz0W5b<+_rlGkKD1T_()WYOTbU24#&^6LbuNk`NCaULYlEE5Xpl)T zSVDKz?+zwZ2ELsPSU3nKe8|weYMjQoxgC!}4Nxs(t3lay*qIg;Y3jVDFw=^?xIsiq zmMsp@^9wBMST&Nm>uRJN=$CT+YT6IQnEXZXq7Gqxi!6d`h*h3TRe47ZWnDc z=Ud;dg3Zop@X%fEkf`Eo(V5Z4&Ea31O;7H4-*WB_K0d_><769s5hJF__Ps@TQRtY) zGa7<0u=GmUxw2^vojd=Olu9t`8#GwNpUiyhqI&y!rK(!#&iM`2RRG2Buwcc(tLN0Q z^G*{7y<=@G>TOC6Orrus5Im`xtTFAlH|g7fz-i(oeNCw3(A4Z!;348Onnyqht2esJ z-it6h%DTE;k|~cj|5gFF_?&iRXQH@SNJ?$(G?EtK;MKHc=gdEcWxtu|2xI*UlQ{=v zpvBHag@;|3EAYC&^)Y-ccQM|!>PC=3U}+C03o?usOv$0dEknE>iX5lLGo0!6A~gKQ z_3%8@h5uoUz|}6AExZ4Kw(fuyT%15^FgzA1xG_-CFJ>}3e2G=!x&eCAL>}8B$STJL zPoULj>y^_k{AY3jINesG2Iu4&w6-TDwKIDO74@5=@yD1fKvSxZ(|v0-c6bCjzH0}L z|IB9igQakyf#)Luc)coLK3NBTZxUPq27hW>RBMJV%ijbJatNk7w1DId``O6{fLoa+ zgam&FDvoNvG-WGp!T0guas2UwM==Dvi-PVp%MEDD~G1$ea=X(E2!i(*Oi zs!!Q>u~vVk;mS75@BjM8uLe9^GzzgA(zf8E^1_Li4!C_5PP~-st5rr zLCd+p4k+g+LEh~-a4BIkcaoy!o60~{>e9(TiuvHvn5H8p>ttOt&v-fhO{Kt|}ir{{dc}x+_dHwI#jpP75}yNb@hv48)1tiy zyH|b#JRi@LlpfyM=P70AINlH?NfnfRo;DId^Ob{>7SBNXeoUnzqhV{a>)td^&$Ou| z4K69FW4)g(zufFga6?KN0UMkeRP7l!Bi~&E8^-eHCOxQA6F^pVA2<&sRKIo~)H|)@ zz5bc{#(WY)4dwwD-1&T89}0^8lWmy1kdV;RXPRf5!;-1Ic8mbqRJVKZ;DH=aAHm#< zkoFe9!JcpSBQBJ*7u?!%z;*>9^ZAz7*J(i*Tq4L}{tj%5kVL?q^a9`6$+j;}SfDP{ zp=K60$W>=FFRoj7b%S{`BRu9nFs0=<@kt9|kxuF?4K&ZCCb4leE7W?bnEzN9iQt$*h z->!{eIlUjUw!&3sx`H^>>>H8yGhJRq)GtY>%2p@fdE-?8;S9U7tCL%@Qt*b1b%nyT zN1vv7?%kH;3~|J`62JW_L^afr$pjKj=c|bxIR+M5_bFUz=a}( z^K*z$^NyV*H80yM7yk|~D`2lu1HD;gHO4I_3NrGKO4Dz7z~b`=7xxn`h%1-PZ~*aK zl>B$DTO-{_SOenxH~@9mQOSCV_<_ptY*)L}fndAE|3(Lxw#x0_0}QGx^{d4xIDV7C zYy=q)N6~59s@LGG212Vzz#y%U<{!loRjFdZlT#Z6Xsq@nD_{LUZGF(*Z~(%q6PG%} zBD1oxtjEX4HTAE==|=`jfE*_t@a3{#NCs?UCbiaaUg~*zmK6=IIuhmVLR)}nK`I6e zTV$oleJ>82_@TX#a)|p5oEE*z;II#ua~r1$dL;|SxmN!A?361@dHc|Ev>?hCLIkdA4f z<$ybrGXYcpjR~y!IEo%Tu}OqHKR?o^x;Ofj zE>Jd=xtlVCe%kZ`W2Cz|BGi{rhExE;4OP0n^%yNH+OY*vR{v`UdYZ*?fqC?C}v zG5^7mXj4a^JA)fEm3l^L?a${Q#s8cxIRwu~{=D(RY#fKo{J^0E6BZeuDPKH(K>zLR znlX6BkM$-sS?%lYX#ax5x{{}aL$LYMO?tGo(wkN%L47BXF zhb1<2db%Lt(m?pI=QPt^&|_C)LoHp)2`l`Vu?wb_F9$^#qqnfr#nt;`V-#yZp8~5x z6m)$O8!fgS}3*+nx#cZ3h@!frA8mAYL@^8r1G`Iz;=5KdYPk9q$2M4@a^6W zu;yx9f_emrZI1nk6F7W+{XQ~HL<+jUR^qEF<)|))k#_HOWt|y<_`%w*U?ZHyNRME% zt)Pit>Lq4sg)$}=5IoT()yvDDK2~ZY;?X`RKFQmA8s9(249ub@wAXn@pk7{#y>33> zaSsvud2@9_hVZxRkJtAHJR9OzWSAX#|R`(Wy?DC`;IRFYk{q+pXd8f&zMcg~m~IB$!L(z?r>BrK2SwdGn19tmy*#Dy*CCwk zmHm0=K@m4Zkf)IZ0tTQDpAsX;Vo-@GkKhvOJwsDanMprJx2qR6wPUD5zetF}axmDfUf*YTMQ0BwOuIDK?A*nkF zoL1V!Th81L{av^ba{xhPXjWA({8?%NJ-5AxD9MhM_unlsiCSlVrSoWtj+ep3_5AhT zah8fR5%$p}%aIqE*RR89*@pV&H&nL#-;7?RH!KOgi+$R-q!$s!U`#R~&#z_B>ifL( zsRCV)%)>y-X%O2&u#SL(XY4ryCOtXSU>*p)|MVLukH$7U!JwBoAus1di))-E8pof3 z!%w&$g<}T+1sp1QDm8g?C5hoih=+l&_es%ZX-+wh9m#oz`J>NC_e>U-_1?MU`WwE% zeRyb_38)3@bug4-yE!}&3~ea#d6FO;aN7(59A+IIf`)DQ2PN7iL=4t(N*0@gIK2%~ zA7+!1XPT^%PItQ@hc24x8eRI4eT}0E0G%o$8P(6jPnc^*867GYB_b^k=oOUELO^7L#sMw|M}jO)9!`b4CqzQ1yGstFM8$%r zJ%vqgjZR(6O4&ychqNxl@3Z zlHCj4Xy8RSIg0Yq$Nl@9|>-M_g$#dry`X|h~ zwF-_LZ);tHiz4e|fqPDsh_c@C67c^psYHX&gCw-c=lQki##E-v{3NJF!_g+1$M zITcZ*h^xJ&B#{I?lUhA*3>N*YZH-UkX`qpLzZBRu?xv~LQEG-vg6u#1f~9@e`sv-9 zS;q9GK8qpG2+9~*z-ZMuMKRZsE%baTNc%GK(%Ed{WlGNWE$uTV7(vrpDxxo;5ic=t zh2*VH32ky#a((!soFxe7Y9>GFYAPjbQ%~DStms>fn<{*ae|}2b@Z#D)B>8@uF5z4R zq==zL_Y`)v$44^Jl&RO`s+JlcsDwL%pTsOB_sm=3dhfY+1Lns@S+tJl=m}~U&wnMy z@gdxfxb!=d)Lno6av&;6TXremN>-z>LUAqJ;a_UVuPK1}5!&_YOCqP6K(IxLH9huS z=LO=1SUO)67LEb?u0g<32PP(t>fs31snbgEghSg+fxRQH^rLw-urnDD51T=SB+=O( zMAvQPz3SFOD^$+lMJ=^_qC{Fh z(JomA%A2AvD6tpf=)sO7Tj&Lu3dIEZ_iq=E*PO6Dl*x`(>x;#2Bi)eROH+t5=ZD~a z#?W4U1aH4yDBLqh@T@|W)FWeF2_tvn=g55;8oRu#eup3}U>|#E`kumM_Iu|^;IilP zGytp;3+^P-ejC5sRnfzxKC|$AFg!lOOZ6bp{?MdDozwI4 zQXma4raG%f9sH=87NUFnr27S7)MFmC_+qiHKopiPGzAR=2Uc6I%-!wG8lyMFIv-yl z^Cc1+V6f>Z3^;?9ou>n@YX%5$OX%wAUv*SfcI2WE34Zzhu$|p^#zEdDObBD*F9}HU@^%TRAj$Dqbe*7BSXw|SAQdJ_KEq`sN z{9#0LJqCyHJC!^6bVEm8`Mguwfj{>{c|(zar%V>us@21MJ0dz~_WIE2vA(o6ii=|+ zNrfT#LTqdDGN0AR#ytte^)a{Kh&&nr8g;nJ>c_Q=jP9s>&xjjd3EUrVIw6|7036(XHkI}Z3!t{52= zZ?eZ}zs_+KF2WJtO3m-FJ@4sBAM$S9HAs#v*aKDT@NrOfx}*t;YzkxkFO`j0hLDgu zlfZUB!on=D_ESc0w&cECW6KO#ffh;&HO`JEJ1IUFTs zM<6^8%%f9V#xDQKoT0^XN~)@R$@3|{QGq(>5OuNno$)DXbhS)Gn$z4y=~8&GJMtIe zjZR3G#XIBio)(k$VjO)s{qdN}XgL!@iS&0_m?L@+z6)jhV!P^6HM%v)9cAn?@_~&4 zA@VmYersaVef^VTzLyvv77XTy&(! ze=G`1S!rqR-ICw>>sH0@(lYlFzMXAKBLCbmCR4UB_EfX6^?U=8X_VG@BG4d?s^z4t zl#4vY7!7<5^9dmGjRZ+8q4RyL=hH}%0H>unFry3>O0I=rjvI`NrvS1B4d*;lxrQyA zrKWz{inpG35B%t~Mk4=VyLJfU3;ksib19!?Ejy-go?m52o}Oy4_1I30&P7sm{BdaJ z29u^LL0Gs}-RXH8x0l?{rZ36A+x(vu;vA@S?r}6f=}W@oYA03hIayZ>WE}VUuDo5q zmPSj7{qa|%oQs<>b*+x>D~g$t==}B7@tVlxM5-`ZgOYi?XEys!f92BZiTFFt&v@x?DdvBq4_b&L7xSU&AdsK zk#G2SuZvmL2H*XUtIV%n)=U)~;44!4vPe!t)J{KqGC=nbIQSGv2{ZCrjbQl|#|85~7Bk5}{6{8)=gD8B$;+O#KZEgAzHuJ9+=cY=cq!@mQtJGk&A&mQWcNSJ%NZw^r zi=j=$Y)D^kCQHYBe>g_Oy9j4O`m$xO)H-25OVVSSn%01;$FloL(=>w}4A6*Euf2nK z+N~ZYXbWdwa1+(ShX;EoQ1*L=x6Mu$rB1^teaaMbu+Y9X%_C(=b89q_)bJTZ!f*whsiy|z{|3&Dqd41v6PRNSSqZMyrtgz>#iy0Be&LEy&!Yl4^a#$V1iZm(S zyO}DUi1E-G1L*9^8LENzSA`gl5*=F=UWOPoydO-Ni+jY3&Pt z-aE34Jd?5{>$p5TlsBR=hsAH}EQfy?T4#Cb;!!;$FI=z$YZ{7}ha7f>nN)F9*$T#}Xi-X$*PTTVBLIv2%Dw7_{2Dj5@ ze(R@91|LJ_FO?v+U{Hd_xH}B}|8m+cA0i{N!R>b()6( z=y7(t@qYXpa)bBL+jb0IgtzKv)XKQxNxh^ zyu`NQ&|L{$T3-XWM=v${279`?6RUVpG|*6&xF~v(lksmX<%cm_0SYFy2wU<5ARgL? zK=Y~A=JQ)v;`c{@nbK#I^T8bE-+Hd(>I)&g4a7mX*Jgp6vB-gpV=)J&VL-q3E%H5_ zSAh3U2ttSCK*aJW*irF;6PjfB(z7t*USPpe`?->O1V%~HZa{?6Uka3qQ(f!MXu8%W zyREPxcz#&EM(OO7UvbG5`9a*pkS=}dLi^RV<1m)X&3fkvf(rRE{R>uKx}gUW%EaH; zq_2o8!@{%=X<1&e^VbS(>u|nD?>a|rLvVD50;Ahw7E37esEH_oFSc7YeipS3YS8C{ zeu-YkcW}4{6X`Iw9A~dRMmSSxTlA712?6iO?y#J6`9()0m<^iJdyKS2JnyvDOVA?o zW&UU-##5jkmt&q5)2pK!(IEWJ$`)109va~J!Twd7xK~$>&A0&$5Z>e~p>nco&O;L|Jb_|*T~m%e+p!Ahor4bc}v?HJZI}Gz)~?re#thQ`^!+sr?dv5 z%d)cYrGur0KVLpizYQwK{GiZpMze3g5QHMwY($T}oi-bhNW(>E+l$QcO1b>8OCeAs zTaJm$ra`nH|WCK zEwcP*Jv$E5LWUoQ7e*~On09X9wE2C0CZAN~aUDvvi`jgAND2+mq?+xFL^n{A>FiW} zjP@er9(gl$>BHsqrR)(fx(339dw6v5)$OA_f5lVg_#-cZEZz5u9d3jo3*)uKQ-8}O{`d(C;+Gx%xszjPtNnGf z3-c59MQFqUQnS1hR`x_k=PO^)Ma2kip%<{@6L-g(Po(KO?5pGx)Q8_+>K=~!SKJIQ zlOwFWOLJ6~!=N(CMTYQQjF}=5_@;;y+z|Qs_urTr(%=%Iw(mToQ@M6rCfn&*E~>dg z9hB1>TYkzzi^XSmh#%FMn;({;2Vwdq#>qZrP*fZ z=;$bArVeB0mm#FxIcJ&aM%)=&35%D4Yb~=n3v!6$hUlf-F;ZLK;Dd&wf?AP;S*gXry|6Gip;qf294oeHb$M7` z*X>KwSoovJtLHL2>mZW7ZSNXqi(&(^b^ z&vq{QQ*>SQ|VbnyKH!9;8GH zqkE9+H`m17?EcY0?jGWL%bp*c9AlxT4H-Ev)|W?QsJ%BI+w)qa@`Dq3vM6TI+9=A8 z52C?zpD)>kuRY4tp4=QvR&Nvm&WkdjGp8rICP$jG6lHR~?5hiF4ld1jt@%9fge;{H zqR0L$8rRGqV!BZF>o{;{i|7lQ+{5|q4 z4_=Qr8j{|3>ID(0uTl+n)7j0Y9v_UHKU(!MjCAnUQ5?ZHz*JjlxwLX6T7j?zm?1j3 z72QbpeBb{&&AH5hpiha6$gEC-b-}LkKdbVHGU%1eJ;cJArxwh!!uFj1_e0)8>mo)7 z&k2`DU+GdTc!l?|-1$E_(ElaUDOn%2ejlny|0;}jD6e|v?$e*NcPin*ey&_rPikN;6Z{j*dc z{1k~kPKW<3cG?LrAzd|Jj(|ab>sS;yDaospS{vJL@r)_OtSqhc`;gW3zQSS%pRol7>RUk==E`QU45LI9Bf zCx64V$A^biXXoZR`}qbwe-Z7u(7WYFawcM>gFSYQaJAs&MeAZRRjO3pCEjWrh7Q#q zJIb!5bPT;Pk*0&r7e%_>8G}rtw5iwuc#2K9g$$drj=*5;Jdd4&NyMX`WQ4NLs#`Y0TRblCn0P_c2~9c+fIPb`ugv{WWWjnRAag)0I!C5+D}xhS;jcms9h@R(BWy3C)#%s6F$*7RJuE*r3Iu* zq`SLI>F$>929fUWZr(B1I_LcNaqY9ezg~Wr7ffdSVvOgxpF2+Mx=)cd3M{1QRLbOV z6pLlM(w*dT?BU9@DJNbl+tUeZff@~p*${^}dg}Me@>P1=(=;MR*ZhN}VHL#JkT5s@ zHnj5MV4)8%kg35mkp+93L9eqLOo@arM8V9SFcgnB1_+n1dOv%>is0+Q9J(Zdu_6jQ zL6E?>85o1_E;MW76GKhGj{zx1#5tB$t3hRUR^#cyLbnPaiUH;kt6ZtBup*LH63CWi zG$sVpwlW}@vDKpQ@oN_Y$9xTFt`v|z0@WQA@a~KR_;D|YAjk&h2YJ~O`AVj^-shtk z!Y^vwADV)&SfzlaKPAuRB0OD<6&o0i1^ThPV|zV>77eD?SW?q?>jq;$Vh0Rng~$72QPL?29m!E75} z6}SmF!5!_-arUJ0He>U+u*n4j^J#UUxXbhE7f~EX(3`4nZf;Ib0Fz`c=kxwmX5c(o zYr7Kz)Q4>{v}G?GTI9;~MOB+zYEcXb5Q@QA5x5N(Cz#CDRXR90!OfRG%+Jq@(LYNC z2@DKnbEUUr5^18buautH#0RQ8%p6)I4j}))OHz7DrjdV9Vx3ch>fyUr3%jZ|Ezg`J5k%;A zTL9k*C>iA2(uH479GjJ{}YvmF*OeaMKP)v4Najm~IrDyKWHo z{uH<1@#DwVXWNQ`%7A>Kw4mxWRpW4!@ezx`Y<`M<7H44(=-{!))HU97LR<)@1P-~a zmc798_})Jw=h4x`6y(>N4C(?vLV%*Vl{ikAa9Pck51PHoQU)>L_#yRi76f0M)*^`ZfBry$ z5MxH8cZ}yVS>%c(-E(K^Qv0!f2@c}Sn3H>Yf1mr%b2syAbu`zLbW4Na4+fh@jZn+D zFeB}rD%;KS>S`9L);CrRp-$k4F9tM3QH%a25Ke|%M4>?7c;kN{u6+fBZ4F1x7o$V^M=*Hpao`C( zfYkssFxl3D)%9Q25!N5*>k~KZk0VHAHIK2~ne@&BvdYVpMQ6|SJCHb{u)yB92sEkL zx?crygmynVR42>;BlR@h@5@UI zG{%ZPK5NKC>S>)Xw6GDdZe`y$;^y z9V9wpeOjQBmr`y17}SsXREKqy^Co}2l%uZe*S1YPAl_8E@S}bXF1$3V93OtjmTzX2 zTK{J)!wz#a8j1Gd2(VR-f$?4LlYlp%Ta;43P2jZmY1ehWIWIhZ>w2?a*x+;~Mw93c zBeM?VmvR}D4V(nGK{%XB{ z!^fe14cmzClm}94GU#yb_hAi73Uw|xHN9hKR?a#QF$VruT;h?$q8X!LcOV0bwP+xv zqzJbKCK6)(<163t1Rm}Mv85Y=kOU_IaFpkhzv6tTxo{9vj?`DT34b8dj^nL^MZfhH z(N?>`A)Tw|sHAlkf;A2hFi5omD;FX|h$@1mgvUPl_EDX;3xJ$C3JTh}ipe_jX(EC|cpH_3-wa5sPZ z*pEws!3^oSDK#r?s^XS=Di8J8xKja73-tCJHi zD04sm-j)+`#+(83$}IyEM6bR-Sd*m@d=0NfgG13_5&e?u>~pNNg!&Hmw|`Zq5?hI7 zw4=K&zi}88*01}FDqCA}y!1Gc9}5A@GeY?v&4)r@Y(2&sq#amRIK4_!eh)VZYBtwh7RF<tMD*1RjLGzDcv``Vws=jx08>`x>cK^sE;i^><*S;Ng>J+yh#P-aI-2 z&bhzrzBV8sL`~CN=U^O1eiFPTNFuee3pd4(rlgbA#GlwvzX=h|LLsw?A&Ir#@eNn1Dqr9ZzF>HEB+TH&OZkid)=CUCP829?cDr#X1WTo# zsIj+a0vsCrGTEKa&6qtKQ$RoO(!SE6FH#4v1quJmbr_0c1`S*~8_&y&<2CU}eKQQh z8fdME;OxPcd8p=%LE5AqUJ4wL@(wW^SXuOrezDDsGA;+ThG4U2%pc9o*H~pD%%wXg z!@88&Cg|phhi4qFam=*p#c;*ot@?@8A1lAM7jH zGK-@xzGn;YAX|usTQlqLY{&cTLZR!ctL8{DOvZ|*4xgp4W_#I0X$0fAE z_4OI?By4Q5*IF;pk!-hRGL>0L@1c-J&}~;LM~ZPzR;gA$X)Z=>`1Hp`N(}i0N9Ucn455#X&WxfGyh&%M48Z&vX4dO(qL+o9MuASP?Bhu(vOo4X1ek!Go-;5&bT% zm92C#hrz6bS6|#GB!T>+7v&vokyyrl1VQP$ha7VyI-bX){h+G6gisj=QV-39JtF$IL4MsZ%qN&Wq<0H!v zq-E07T9`H>^#?zwhNRKdc=Xb0jOTN3p7qO|$vb65T7IAzA=NsTZ<|I!5-vGBHxC2A zFxU7CR5pI>JJ&l6=Jxrai`vt-jT-bi3ZttOfT_92R`ZIfxI+^sOW+B0;xunYMnBn~ zdpsLI{=8GfcH43rM?mM5`~B6AfHpXSCr7Ut(jzS(w19P%Mrz{mF>h$xe7DwcHbx8i zV14VbrHy*-kX$f@#FBf(E_h~{5#9w62Ex1a+h287=g`7yE7ickpH{U@h*Tmj%_o5f zCnc(ml}z`XP)HcC630K=t)_B2vqU}5nolv|3V2xb@IM#@oLN{a=@C*PahrDsFCv+B zoR1nqg3^-#`z7BYSEW-(0_^6Bk{{i{+McI%*v-rW*K=9)3yd4l>9h(ibx_FtzE8P% zO?*|Y=j}ANVPA*eomjT4t92IrZ4z7=zqDgIKjv|K9gY4=o^zevK@~f@llZ^A0P1S$ z#IvW(VasRRTyW>ZvnXcUH-6$UFO8KMKT#+c8hLS%bBi&A+c%|EIbkjFfHhVga{9Jj zpbiN+#NAarF!rt4&zby-3$4J$LUqu}QplE8VJ}oGx@dDvL|#e#NsYHk_$mp;&64|3 z^heK08Ls2bwNEjB-w757`*FTOFs02)qjB)jsi8OQ4Jk^ekw6pXXR0GseGq)rVuZFt za_aBhf8)^&XDI^bt>YR3yw&ny`NZ3H2WA5IIhM0qU$7LI`&-;}o-N(MADom-y@{=? zK$KQ$N1s@!QlmU!xag95IAW&Zhf&{qhek-sK_ZD;;JS|L6lm@Lxjws#CJUx$Pj_K=l3Ekon}&PY1n%kcf1q zEQ1rBz(WMpZ}S}jgIs7frqariYiesA>cp3J@jI3E9W3sjFOby;ou-Z%E;jV60+H^R z0RJz*U5SdtZ2QAPXF5)PH|l_1%=zFDFc z|HS2ahBe&q{~JjW`UYN4q(xWuPsrh4I znRw7-#{xl=Th97#3u^o@24^=4)m$krb(7R7S*}q7r0S%={Q9&c=9v1=?75R^k<7xX zKL7YM_z1AO88W_58NxDy2Vm5SeEgUO*w!6{-cShvK$8pr1hBlfXI>iQs0&KKEMT|@ z1#zOi&p|E(EiffxMFUn?MN!nMa=UwbiqjwmJlpJdSpN^cq&F+l)kOzC*HM^F&+#2a8cuP&J4SF0<_ z2g+;yu_zEjo&c<_^N|n>Kg^LgAE>uFe*WYKwsKhCMc%5S1285AM9XypEGpW58+_Dk zP)A#Dk5dTBgJTg3e%uEHMFxNazPz+VaJcPqvL0Mv`ioYg6a@*|pYi|;f{B>q;vy(iDYG(&I5hJ*$r;NrZcuMl&|p zuIx@3F(*sKc4v((KqUPCz75+S!(dzBJ%34P?*Yq${&;Te1VnH!jFL16bOm7&0T!-r z5H`Eq{z5Yy@O_ERmH*KT7(9x2uPGJ6C>8U%L1+-v8wTdp8L*Qm0}hVS$aLetnsYj% z1)c$AK6{ghdS|Y_8V%6lfl((!=~dv?)F7ZvV`_mezt__aTzDpUGCgt+0D^coKC;v1 z{8|ULB(!2m@}tO2FJqBCx8v<%RfE%&M2ys4v1^Pcl(KBnrFNEp&+lQWznvCyyg4s< zb<AOH6DcAl4Xv$9+I^e`&^aVx4VKu;-q67J9HfFuISH1EB?yE!9na&Lvj zjv$WKv8fVAkeotv*dzOJe=F>k!mDP^;3cakzMLe1GBs`dZ4)VaH=ZXyiR-c+Me5AD zx>!4kEOcKq7_vH*ISSJsLJ9uWv%s^TuK_b9#8HlxL`WQ#^iyiAPqDVCjh6; zaNuo65$Gm*0m)?G71bBOE498pHCC;)&PI`zCAUwR6-(o?UiCxaBB&w6C7(v=oE=H$Nm&f#pR|RP(l_#rmce+7HLqpy>uMPH}M<wKY-!^D?JLJW<3B#RhS2)b|{2xf*A>^t*?I} zr09zB14>j}Isnyk1ke`bu_Xa(#2DaplgqNC8IXR;dwb~l*6n4e1O^6%;s-ok&}u(z!C1Ycclr81lgGi^T`l5ox`w>5*LYCeG5>l zp@4B)JeOlxZ$OUw%Jm!YVrqV+6;u3+M|X+GC*Kw!FO})Al_Qy=?=zarw9s8{&l)#5 zTs&&BrKmFNCKN;=L$5l{CHX!T%OL)&E*H<~b(O77o^5uOTn|D(zobj$q*S%WP(o!* zZ;6$x6Hh?=j_Ohv$DjggFU7N~(0}el$6%R#pMq%$mZDqnN0DSYaE-KK37$W9Pv{*2 z-eMURcM;1Rz6DuDHD7in2f~mTP_#1ZT7ZmGk{?k)6JMC$;cII>Dym3)V3waY01a~V*?L>y?Ap2?6F#e!?|N9Ztj2u~XE=!&q(B}1#{wJ1#{>@w4pKfPGLK7% z#i>#~F%_>5ThUZMVL}-~fnF(h0@z}Z7fY^iQR`Wgf-rB)V7+)!(Fh@}MyKomJYF{q zkooytH}(3;+hOr1)@e^9*}5bGxQ5u8tw_B_`eNz&fa*3{c?UcSE{|5G{<~cb@CXpi zI$rJ3lj|HsXb@p|42b!y;5)CC+#M=;cVo$;>ZEH>LL&f5 zL1M1J#m(qeXSI()Z#z$(R$;ZLvl{anY2$R4-5GM(7oYC0ZJiCTj^{>x+`I>} zsBwr*J7GuvF+`lfN)`-~h~4jR8G(jJ-=h+)B_2g?1(pql!SKO5oGLSK3yePf9i6oJc~2S{fppp z&G#3VYtB?f24kQu}Y2QbNR=)~? zkg?as20*iv@Pq^sbWi9;k#<{trc&0AETAUyUnnI( zdy2{_Tn(9CauWSa`s+$(#!g=@d?fIurx#W0?03Wl%E!ffl}xF#seZ)*?V;n{_R}T> zCmWYPd*a6^emXELs^x~vwL9BmKSCvv*cg23;hSq8GKLPT{c6Fs9!~OgDgn%}WFzTR z^L92ja}1lhh$UkXBd4>(V+ZMfMrJde;iMI4>rE945BM7 z{HwHKEnTFGVN;?fO1C~RTV2oayzhHsKM@XW2SI$>2W4{xDF1m)5JPyO?Id1Tyt60_ zgIJo@S<|s_EepdmDb~$rSZf0+qO&~rizN;}Bbu2h;;`k{%`sqzECR4S>is(-=0x%I zQAL_{?^wU8M#gotoAwYLbaDMu6{<)<6yi%uw^l5BT-sc&cV4xw{r{-XrbNEB?dh$^ zuCPS5xQpOho?F9=1f$o(EygJp4#x-{=q;8g=FO>@u-qx_&tHB>iXg3?(w(@*S=}w2 zvtDjt3A|eOr!CqaH9o`^-HR4QbLh(BMd7@-nGP)CG4o{FP>&Z|?^IfS-vs>8AEX@zbns zd#|AP@wL+^<`yM!ocexwLoaX2+Sp;eaX(GN8@zAQ?U`dT`v4?s1x2Qxyk7iyfDa#o zz4Pwt=if~5?aVM+W2-TwmA)O7a{;V3p6M4Dba?CfQX^c;hq#R^uA-f1c^CsR-|__= zZY^%#R+fF%wPd%^k6k5~5nE))OH8bft=QsJEz;zoIO%eyvM+j|G00J%&qmnNt_7h4;ZYNA?__};&#)$EPwo1|S!#pAlOiod8@ zi*Nko?MY9@LfVSCuC6Lde?|M}=HK$1^l%|);--c3wR%FaMr|4BgqW(#XsaV(vjSLT zQEBW@bL4p1-!a%7^te}_`S0SaPV{XsR6Ulg3xXJ7D92yA>an{z_(Cc1v?;U2F=tYB zCW1Gv+Fa4Op6a~=R2yr1Gx)#D4Qjb+Y&1h|Yek<`<>D8+q;7Rc&N~Nd5~yV!Uu+4I zZe5GT%nD~I1+=M8Rq7pdIH@?`bMb0%T9er(t$`@XR7-<}5#_;##t zX#6ZA&_Gz(+ar53f%IZV`+bdg&_d-j9HPk3aVTZJM*`JJsG{W5^t2dAp)REC6Cge$ zfXh1Rr-)q4UZsX}`z&WxT4_UthoNa_g&je;2jl&YbBn$bvFDlvlY1G3J(NH6-wbC?^h>=qEn3=!;j=c*JxRb1Lod8p~dHe;~K#qNA6eRbmACs6ry zDyOltAdF&1Dp%QvhL}$!rucHh1n%zG_z9vg;kGv2r`)2Hu77k?mv5l_nY^~!^+d~4 z;WlSbnYRN9O(UZJE9wf%1ubAz^M*e+t`8R=-5)uje6LsC;o16LnwB>FF>v8z2? z#NnhUccu3J)G8CKtxl6@E%r==>SY!sq)P9lqZ+@gm0)vMcIYa1Nts8J4eiIT{@g*n zxjWZvC)_G}(ziA_Cr*0SrsjCQtfQhjA~h7Atxz%J7mB38{tz3qe^kkJR!hf9m#Wx@ zg&rLHeeQj(f71DVm6)TGlQxeYqe7F4cY<8KqBeWe!~fFFF|Lv4(36UX%SERGZRsg? zqsB9dIbszb@)zQX?6Cp-3HdUrk~v&7IL`+n0Fc|A<6TbzY$Wo6vfZI%8aeIp*bd(F z=noebK9t{d?p?`>A~B@#`Wi~pSK=~YsyhB>3_GEk6p;-#5t8zV|MdJ!-1=-8J{nE- z!HK&e@fY*p%0Fsv0Er)o5xaus42bpxlaiB>%y6)=iGd^b@uAKtEIcQbUKJ)szp5&wQFZ>~DlJfG{R$(?-gkCmALUWJvjt!p*|c?xLv?@0WfOoL1g<_26% z=1;?X{*=BiaU$rNZ%2nY+sD9&*Dp3U7QJ_`QKQ~Y67aXO9CI6^0h$z$nVCt+X*7sk z>wHlZ1k^PEMlyov+}+)+0lHh6i(@wu)D9{8^HOUBaDs3=-3%v|h#MZ(2F6_3K+X-I zw)DBn>0VI0LS2pXnxTxB3gC1Ee?8OaTn&tPIa==#gKa!ub-(gavi6m$`2MO$CS9H) zvyN&>dvxS{Cop-(!C&N%8m3URm8BHDA3-ZAMIuskZID$%dJ%E*up4{8K^xAT*wvf- zJeJvVyj`wHNRUFlBBWs9I&-y0>wTFaHFctUD!~uhU6hJcDpLvy)m2l~GK;Y3C{Y`A z(W)TfEU7cCUQ?TsgR!-HBFmnnrnK>gvQT2HFX7r%lJW+{^K2BME*3o-28p6;Wi+eq z?)_0uy1tPmvD>=ER+!O?$^GbmGf(T&d*Xa2$8vj~dFy(XQ$s9Cq8;^%w7o}G>O0*o z@h^*%n3;&)hPG^bhbWV07s zKMT9fFiTG};r`H7CMMGclS^}OmZSRreTz?{qZb=X64e=^U9tmN(94NUrD@a zwUcX?te97+Uv{=J<%;L{NU{=mu{XI^$(T6^)l+mCKlak)h2%TGEuE-(z0+KnoXw?p zr_~s?PlTT9a;H7EpSjv{utU5#fOU5B{3i>SXPEj)BJS}}ZKn0Zq@p5I#(md$Ugr6n z+}z={F7BW0w+lIR3Gkk(1*tYy%Yk%JGVnjkh5S*<+#l{`=8XW-r%bpG+Dq7PKqg_H zt=)WJaJnhWXuT?84BV_iFChi!Mn4?UuJTt_c6OkO>2T0zivx3Z1>Q~MZ$_X^%>q_2 zWxxXrOq2_vXw;Pocb=o$g7&MZT^*n|TfmVWpXrg$Z{Xr8aecN&R(&uV^O{Pj8)TIb z?n+z69{gocLaV0tpz$E?p9m3_PP!As@6MKr=U=DZ$!%|4KlAAu;Kb0M@8w}kn|b@X z{50S~G&jpXD%j)<15xxsB3W_T^_?uLlC}xV2J-~X^a}*1O!!oc%4-aR?rN-Pk;|b< zz2$JqNS6hJ>{DzdF{f(nELZzI#kpE4CvkO235i(JSQOsadoBeI=2Xh!+Z6xC#>`W* zYCe~g`S6i3EV28f*I9;Zv=QUKB~Q*>C={tGDr@T1?FXV=Ke$!J`L-MIB8N+0B8aT0 zJ*liZ=q<>ei&B{`JTr@LE-NOzW(hNk56HQGBX_WrqPkO^&o$gWtO^27#To5M?6z?l zoG+BLnw;{AO*ZnXr_Y}|Q`|d#j&@k!%0GW{)1b4XZ$9HWgzSTWj$XhWgPzCO6ZEKE ztUYreyg7@%pNT4?<833AC5%>nP1?Gn%Ed^7cwkh1x_`<$q~HEHo*%fl+>d4YnlrC+ z08S1S^2l@oAz8!NH4BD_?8k?5=7?FE%5-XUnfae1qD6PEa<~i4G|%r?cT%+FrE{eZAV%JF85J6xt`LIq`@EMNd3~^WFUKfAm`%W+ue=A`1IBN>+vzD z_L{ULflqWc7f&RK`1k1one=Z^Cz?D9kOHs@m~~OW8#w0}BFE6L%?g+0kiHK_5C$O8 z;G2Ik{%S^OHRQckqgH0BY-#SRM``HqSl#u?iS+fNU;%sky&s1#xEeg@KHo2sn^UyCG$^}I#yYrV=7 zxn`<8vtUX;FHE}OoDzg&?AsPDoJ*1!FU!FcHhz&Sa&WEve3h1UhKS2(o^yEsQ-wG4 zxD;)^V572X@s&w%GFP?WTek`AlMu=80UP~l0<^a_EeUzlsGhL2soa#&Ce0%xRt!8c0?yW&M|Do{ISFOz0zT2aPUO?^3(((Q2BzqR(pWLfx znZae8dIkHSMc9^b-EamvI=D-7M27UVks^48d?z26VuL!*2}{(R&KT^1)hd+tRfne=vtU?T=#TKbpd zWI8|9VW)mk++4CvpA4HJ_-H z+Q6k#?&<#M`~>^0qjxg~)hzk0u`vX=b|EhZ8B1=|NF1CNc<2%<(l-x9yzx!UAi}6K zobhm}$qCZ(Fhy4E)NT3WYBs;P^j?wju{zlKRE3Ftr$^L!kn*K9N{HYKl)REUabT_f z%IdZ*YJw9f{M%&j!{ldb;}N36dGhnU0z8i1>dY9CCz5<#ew#PPznkCnJjWA9)U>y< zRTiKG`^ptp1CgkF4F%muqVixLqxt*Gy28p4glR8{lK-X&Fy7ylT6vgciZz~351;RU zi(zma2im1@bNZk-KhgikAka=rXe{hdLaJJHdu#hP?{4yUZ*Tnfp0T8mw%Nku;auP{XmWW6HK{qghMIH$3cAAB z8!==n7Qp7qs5YM`Gc39|KaT-?t^7BiD@`WkQnJ?9PS5`9Zqzb*#LDqUG=3UQEBwftfpAqo$j&qYE>%^)*hZhVM`}?R(o+nkAgVSF(7g?W3g^o$nPzpG7H<|I5ZD?^63uxyR;U*wJQ^ik3Fky-(r~!=iT+U z)y8=G{%pp9UZY(+94#d?uDxeoD^PtCV_I+ruw^Ot$+!exMWUg;Q!Lif1jg;8&gZbs zSC__Z_)yN|a`f{1*M#JV#`F$JZ>9TTttx;~QBlYJHAw9L`) zG6JlOMAhnMns>^u&>+WzGo>_h<3enc^aQaKzvTk?(!0>fkk}6_(VAL`tH!sx>tcL` z4{P?Lbt5XwU-07N6q}}v_S$K@V<}Bfia+G5jofeTKn$x7RLNtDaKn|5-skHaI$@g5 zt24K|y^LJAPbzlR-cv}uKD>gdrRvSoesAn}qJXGaVSiYxtv?q7A0QfyU_Rci;KZxO z1PS&mcgc3#kQzRJky2yKE#R}KOgkf|#~}JFxR_Q-RAbyrWl)OZbX%uMo$9;KZ$7Sp zPooB2Xb%NSTyr;})ib|nQ=)pFB)T@d{Ehl&b@mC?tjuu0gpmdLU7d6i+fiog)f?Br z1ZMFn%Y`D{2;B{Q838kwE5@n(d=SEN47~otfveO+6DOyspwsi0Xv)gUl`myc&H%qW zXOiK?-Eg{~A{JCD0Tu5bLq5o&XOQ}|2$)7vnm!$ zg7Q>%0dbuYtfsOlA`ppGUiYHqNL?7RH>8Pq%Ec*pfuA3P4&+5OucH5h2>vtptg&TJ zI}=>SUG6-|X2%mXf8RqF#39JSyHZz_v*Z$mmwPScL$mM3wNVAZmR_kWasv@TH5J@` zMK=D{bAxhwvy`VWS5NC%DJesIL@fc%o}S;sB0O`J_Qq=yUVK2$7D6iP`1oB0hT?Uuh-^gXUE$m>we@|VI4|H zCUaEI0@l7`3L#y_ebA0gJZy$|nrmdw$T4ZK#e-F06KzE63noCWbX>8FoPbsJQ?IlA zr7>`08-=db@};}NYUY<^N=z-4^II~je;Q~40t)xzo!Pu)22#IN9r&yk>zzp&KrOe8 z>MFS{K@{9-LlKdE?y8C+68`)^;nawW;e*g!I&LtmZa~X9_laH}MOEgj%M1;1n*R68 zM~oY>S36`p81p953pztHeoO*OX5hH z#YDMegLRwd@DSMQ;>RIs#D7Tfj?_5c3cPU6ab?_98>DM4C>ZvvHHibfxsv+p#%Zs0L|D4~T$GO8``AH=i2 z{|tE5>P2)`5q0kUC*hqepm6D-kzxIFi1I&3x}Q1pE&u=cLUs((Z=v7patIEX)@|_a zB;rK=Z(`4XZGLj{`G<1Uo}`mt7Cl zL8H>R&Z~c{O&&F3i;)n~6-teLjK5y3#h2*gL5$$6*x7LV$T!)|_V=g?-0kdCT8hl2 zr&(M)Y>Gh89U!1yAn=dV1et+{I_C0zn{|V}kDo7Wgg!Zy@eXZ32H)GaZ@iQ$eC>?? zdGe1!0TJ`kzQ4AM7_tG!#=#L#U+-LV6U}HKCJNx{8iUh*(3OgUD77=ivk;y#gFeFu zpJ>2O5CcROfo$K{kGZbS&dxxX>Fh8OcLD4l!kiQ^iwjlX74R@lnJLtN;$=~z975F9 zLp>kjIBsBEhp5l^Jr4(BbJ0jzUa!_LfXZ8a{=z6a6vy2hRiMyCOq20id{6IYG;4^| z4jxrlfm>?b*~tk(E2h7rgQV3aDccF?CgO<0fY16*OGSqm5H^j;Y@*;G9QOfcgfI-B zAEqaoDwd5s{vKV`gbAdAM39K1i>p%7Fq(V+hI=Qnh)Vcz3zvu^QMt**aSOnYUlKlQ zqWIau5;n;P*w(irfuW%v9qi{LklrfyGdM9gIQa7NvKx>N3_vOJ3>HGa(H~C)X3dl| z^z<@N3MBAnVvb_a27Z?1yVI58(NKXeu!$F(ot;%E1re=1z{p)6Oh-&yFAtZ%Aw*|) zxh!#fr&EMgoeC_U;(6Vh_}aZ2-5<1AEa#~Kp-D6DY{mJR&lJ{+tg!^rXzG0eUL*bk zAs3g0p55f))y+yiZ&T~Ytcbx0rEMwqw+N|$dN8WLdxX(RIYFHrCWrK>!GLL4Q2c91l+-i+KdV*+fCSY!=Wi0X7vzq-K}n9-v%~ z*4di!y8`zIpO)X{Mw0DAfRPTR#7qPq0l$7l`O5;RJCpTtJG}Ai<->0BQx`O4j1D>o zKK#$Qxx2RHWpBBL8bPZcGFdhCuMs-t{{F|@axo}wR9^pEl7+yd+wnFg*^%dAt{+&< zUo>so)zhhzq=9@yQGn(cR=<29(n1Fd$bMwNW+WUC-{Rc@KkutII#n*J?e3|EE(Fr+ zv_dbLvo?#Bh5*xQAeDeGYCgQP%c4uNmqp$%B1Ji*gQ>BHifi3%H?r|goDu1~-MVw+ ze}oWA$7n3PxJqYF4C4zU{jab_1~xfGM?MseU5YcCRe7Gb?p;nQz+8-~k9mEP4x{UhWiy}67 zJ0KiQQG2S*`t^zDC4$vc3=#<~_>bYF>I@&iY(~zMah;3%hIu>T5h%n{mgO1*1b>%Xg@4Ia=0lg*rJ{JZ z8kRtF6aQVi%Ft9alD#-+Z-j4JVUSvoLm}p}H>1LkYKY@|FAGb6vKjGjgj?#sABa(Q ziVtM&7gw4|nnWTe&G)6UGZ(71(=Q`x{N;Mv?+3DNvn9k9&8ZnyNMaW1gU(!yJaV3T z^(z-^IdT#ug@U+C4Aq*?=}qar1{{O%fVvm~_%m_SfJ>(w_~`vJi_1U^<`F$|s!u8s6B|=opOOxDE z%kdT`iML7l+)|a)QC#6DH&<{i@_BW1$x`wf0MY91y(4c{!I_TWQ6Gln?cosP&H~q5 zA@#DEyeAjTUXP$)eU%35wgxcrh2o}ok1!qACy(CG2V=1YNp4N#$1Z9-?Xw3*{DlW- z+Y{Z!fDk+%k4=EBgQx4y&z^8JzcFK{~V1@HmNKb_#%_AKg~_Jk6bDSd9|7jE;rkkd7~NJBE>kMHr#REm+e2LftEVHTqKfM`FR&vgKaFfQ~$V6fXEfeX}|x8N;Z>VR)W=H zDu)I!?D?z57K#vsU@yEUD(%3?va34+xE}NZs7bO5R%b$_)4RG9IaXN(U8C7;t~;VX z{+;QC3N|!zw^GqFSH}GEyZb2)x6_w_sRm>VXUJ#&#NRq-g@%pewmYjAC8Tq1_nBG# zJH$&#Tzc__lGsWb(cTn7iYNM(NzZUTbZf6niVVT;81#>hF@723&z;T5w@}MhbjPGO z|KZ3gm!_bIS$h~KGBr-aK@-G--i7DRobjUxy z$KofJ4LHTs%enU*;-tO`P)A7f;WJ_4)5aUnSkfdEiqLv6J8W&wInaDa<*iSImCNMO z{lU}Z-ZzC5b5Mfb#r`^-y8v~N1O$Yz7_2lrH-IX?v@2?Cd9$0^OU9FB`F_ zjPS)|pXYKp&g=b{fNW7kA*AAs@cPsd9R|JksLV}eZI1gHZVI6p>@_eP76{g%73p-v z5s*)F0fG*WWF5Ic|}}dwf^8cwn48xlDnss0Q2=*f=@G!R2Y2#N!uSQgKZClg6Os z>tpMyV*_(c1XjnSesCA%J~>K!5&fRGOB(wZt8J%Sn-5au1ewJ;L>xp98%`g$_|5nR zKB;-LoRJ0YRO{tS_^}TE5#OsDK<{1ysh&_*3VA!gTr~jFm~W*(SYD`!65Nr5y@$sz zzdn>o2P~Y&b)EoS+sExxtQ6R!*=2|Q%aSu$)mR=yi%SY!=bF9&Ie{DmO{!=cwnVko zveUKtVwfFy=rsx#o*_cLhTyh-`118wc@g&S#`j%Mgf)h7OgBW@yGMY}WW@KP0L4$l zq5Jd0N^#6;r{ONW*T*fB28?3Wnm^FF@>cf*gk_@?KmE{oL1M;c6b~#$B=C-WYifie z`fCHl^CW7|*p!EGn1hYX8k|q$)BvguVLCN+t_2owMAR5S42 zA6I=EDXwr?&nLV`aJqN)h@03c3HH6R*1XPAJVBSVSQ3sArRSm3^{^eCgv`&8dxEU0 z?RSdLhGsJhbv7QxX2#t=&wS1Cx4|DwT!$|jC{bY5>U1QQ%M$q(8$OK7%HsgQBdLYO zMGr_pcAQ8{GhEB@ORKUY859ZuFSzdu4mEQJphkVzU$Mt&KJY^}PJwX1><>a7-?p8! zHdtEta=}~<>b&CQT7B;#>nBx$&5Ucd(%^TJb>=vMPLXWzkx+KJ3|Y~|^Nr*{ik zd5_zp!Uiv`0m1}wPJ$kW$=u=yKF!zJ_MxSs1`=UP%OoeY_JTbknDo27UOK7&Gc2_Dq1SZ;9-xX*dqZ-gy) zuBds95a?_!a=o#lgpKPQq{=pjol`j(^N%*~C2>+wRh0*EWm`Xep>ZopVwOwcuBFR% zGo|c0w+Nd$iWFlqu!3KDMe!lMtjw}cF0iVO@9x)O=qq&Ht$YmWi40NhtgmWe@Cyq~ zG-7>S$haq5bw-UA=gltJr#D7eFV0%jILuT+6?5L{(-nBlpjaQQlhmeboUBmvjXQ|S z?Ql_7DaZtSj2A1aT0N{Dv99f+@aIwHEAPM(pq2`R?y3=S{u+4qn)lqtKl9FAmVkk$ z!I@|XcOmwT6^d9Hlj^C<3b6$3S`?gl3T-kwwYstd>kxw6%%w!>RFYK_BWbA351n9N zUpb&YV}w_DkJBJn^Gz5YWxJNGUZh_II1<^^19=HrDwh@T6(s?L4e14IFcbe zhAg-wshe_G@Ao{x0nXT~oq=wH1^zPTQIp=`tjD1j1X3d9BNAW=)SW8&{gaLplWaU^ z20H`|g>IlroP_;6@1@Qy;Ktw2s;vjA^yhUP0>W>4YTWrQaj0hz#HIXlRP-Lh|FY@S z4TjKL4Mp?1yWOcDjB!6hq&xg}#*7{aI^Y~v*fGVTWO`=t@@HlL z-I=R4j@oRu&T6OL(8tUd$W5`E7U^eV7q826vD^(*>-cE4^^;xR4aO63b})bQjmGoh z^a~5m=#0`ft&Y7AI~8=1R8bR{>Z&SS-9}e!rP3L_^>*qRyO&Pkb^L@PGBA_ETdI6O zs+8ZV{sS(rxzFh3)^6RNPq!8GeoK`~VUsW7j)taPQ9MyJmfgf!nl9v3}))}$-u z4a8N)3cDYZ=`EZT;r7z5-Dfdf{a zVx+jkpwNE5uo*Xmxk1K-|MSHL!)(En7$gToiWg{?>~=XmvAALD!bJ8ntJK4Vzw~)T z9e?E78eC?(J>OUlO(yak^!Ui@di`b09@!lK=CHNgpe<#`DL| zH`+k3usrW&m917KYl^+=Z__pxltceVO@TFJ-(;T;xF&L@V%+H5ru(?PZkneLGdeyT8Bs+S;Kyuz%vh`4Ehs-kL$@HW5n<7Q59XLW z05Zh!$;^_dj?&90Ib!MbjYW}%l9EcPH*Fy8K)snA%M8oPvtY*C>(2gyOP7t^y1>&- zzBL<#f8*ey0&ULe+*2zpw@PiKNh0RZdMTy8;l>LtC8mdUg;+XP(m&nO_BrQdzv4o! zv|N+a^U6b+$Bkhq2#_(lG-Lg5C&)7{YZKUXmwYv}i)S;=aGi6vFU}{Otch)48W@&pmv$ z-b%DHxAr=!KmKyOxzLI(Y3fHP0e=~j^-ixUDu(Asoj0mWf*Gu0^WkMWN0Rt!&h-bI3oND}Z8QLioxpXmC z2uQdn!$LdY<3(C{;qZx3mdO*yxWJ93uknI#zOnIyQg>x#i8F%8H9oY>9OZM=BQIHp z!6gEe0+9jD*}|Kz!>S-%2`3+InH-mv{rY21xHIBxa}tNGSn3Zz?l{PVJTsN=46VA4 z`gXum#QQ1`?L9|Tk+A1M_>GJH`GKE{Mc-S{Ul4>nQbOqvCZ%PuVnC=yQQ;@#KlGx4 z*El}1Xvg<-W`mU|m@?CVO)In#G(aYzmWLdmdJL{~1pb)IErFm>^Z$R;y=7FD-P$$` zxKI$4kWfLo8>G9tk?xdkq*J=P6i~XmJEc*&JCyFOcdmOs``LTn?)M$z`}vLG55|JA zyweY!*Z>@B4<@X(F_*qEi)iFyr+#-V>NC z2h+^!gdw?~0_!83W-&1TQ&`l|Icw-;${k?%rx(EU2<|4kRN2>a;-i!oR~!;Bsq^#| zh7!MtsUllgi(RehXT7d6*QHTqG~$M5b|ym5&vwHQ$G zI@0`PG=9*e6*HeU)ynzA30Z|?{gAuHwKjYh?w;4g7~1zrSSoii>=QFU6`U4 zb3hdMd#QuPa@HBq@{u(%!sTUi$0rf$n4l-`%6`97Xm&lTIz#h(sW;Rm1h*srQ@#fh zvI#{3Q>AGS5QgTKoz?=Gta{qR3M`LrKh9D7Ue%97U|VNkI}wd#^N%lCrl1|nE! z;=k?*a=|{*80y)m5xdnP3zF3Qfz&L|Oe9{wmX?sPuOpO}2mhJW!iDHbspqjTwKjS+ zUo@KhlIJaDd=Jlw!u|dtLw#jMa-zGTuHHA|hx*z;McO4mSxy);L(TPiQq3|Eh%j@p zL}Pb!%Kv&U(}w~Nd#K@o$h2a81dfttN03uxV3%QG+(|=vRz@P4r;%x&OFcLy8brU- zrTsp728*g(2=7@^LLf#ukJS&Ci_*cUtkG2^N&HAsMD6N|P?0 z;VE@nTHa3y0W#X_XI_p1Qp&1Rgb`+PGO8Fj$PW14vl48)x@Xp^bFUN5RlmZ*#a$6f zIY+_qe|?{?!0{LlcQJ|V%T(CqP#Hvz5OxX0J3IR76YuRglsnw>s>iw|`p_+0H4}vg zwRNy=<-7GSFyP2aLwmfu=Pid)HzFbs#!0Q~TZVF}Wkd+uiso(d=|C%m$@KIL^P0cN zMbkdHF=SQ!**9F2+;O(jj)vDq1h&$_2em{VdU{-{CD&EGc{-7Sd%k2oV6{tvq0bpN z{BU@gLx5Az(OlR8L6@96*^!orhidF<3W^KDYgjrqP2S}%W}ZCo?L0Q%JX5W!#Y;NW`vLSb7;sde@CXRQ|_W$)G=GmFO%|J9|ZnlC2IB|tiQ z#E1~7q!p6`vW(U4E!}iBCPyD1uZ*zMEwnLK372}2n1!*8=DL_#)?Zy`t3*#o3Sz&u z(eb)J{T7aPqgFQG)gkd6PG*wX;JY;F;#)0MY`VK0=KUzv@AnF~IXA5qG!Hu8oDCIX zeY`1~>7{huGG$^xUwUYTsC__KT*Myzt-h0h$Z6OsL*RO z+M64$%qC#jbVs}InlsQ1^2+nFYSX8=+`XZv&AG0|d!se8uhH#|=#6f3n{-mULTWH!9d&d=X)9duOjloYoI-DFs}~ya|WNwHHYYgvH$)b%Qsi z>R)@zz7&(+SA1}ma9ins&!lQ`6I||GJF&ACBn#HC3o6)17uZr+D5dd1AM=UNae2e$ zk$6R0+xpIjMDfYM`9x*QNggaKPWOnn!9d!h02o~L)pp#Mi0;;Ko0!9k;o;_@2PJqT zlOrun*nvjGy3#N^l+%)vOYEK4UD_V$#~uwmWw<|b@8$LvxWkF|)W{BBdXr1&ji3J# ziXLad+63xERn)d26isIQO@`>UNYca2Yuftitd_3cx$hlki=`*Np?7P|necE$PFrg? zPNY;l%KaFrTRo`WBou!m=y)F>=(dv*VNzgf<>+qrMed)cQP&Co1va8U5QW4PLBZS6h{R1i&O>vV%oqMh^Fz4Z0A0T>8e#3|FFW0}$@12l! z`#)Zv5K}l5HVV7PTai(*e^Z2B%0TeL-XO8+HKUTs!hPdrt^dbW{8#81MH8{jZd|o2 zxa2$`osmYI#>M7O5&A!YWnUT}fNa8p=<$R{nIv1aKMgege#QSnetqy|0Sq1WfZzi2 zCwBV3uPh086aIgABa|uxKV&>@g)a}fepw3OTi5VCAg3@89` z78Gd2d<^Di)WBVK{N2^{Sz(c8y~6$F8nRbv@>$(Re|#(eMI`6zY)O;~-n$l^{Q7~^ zC3SMT()pw>i6Qd~K$P$eXC(k$kpRq3W++GR^!(d^838DWbx!Yrp5w2~)s{@*P*TNQ znF$;q#K^vZNd$<)0C2ChJU2B=0N@DJDT0k9=c^z-sIe3>UGSjz(BMOEZJP7hW;2OX z^zru1%F$c5o6YR7Ep6HT`MTfMPcW&p(Y9EO{kdFhM6avJX%J&`V+*8R#a7W@8%`$C z+S%Mt=8t4Vu2ZOw3?%Jf$;Lfw(2$g`lAJ39gpCE(4s^lNSSB#U{&BmYbQ=Dvv9)<| z{3tY&>9TK7uaY0bWqE#lm)B?J6j}{c&~ryF*Ptf?j=&bg2;AEd*L=4e$?%7oHil+> z$43!^##Ew6hOh7Mm#_i{3z~o+(>TBmm4O-&L*d|xrlw4p7WbDOSi1IR*Z-_qQjqTfizc@jeN)3XxbWMY(`=hel^Y&+lH= z;YW7Y2v;{{-!{8};mvk38oydh4IZ25?CEEMRI^`4iH}}jvotxp;!+WyKxG;CLWT=b zG0F1t8c28h0JM!Zzf!>2KBqtLBvG}{AjiW@sg~^oyxMLjx6guQ^+$IJj<*KA~A}S3Ls~PdZKJ|6_(UtcOll*HHbIDzS|hx`gFWG zVLvv4Gu@!sFg`?wohTI(iMKdVDSBZz(t6iTA|Mou!Vr?bSZh&*$0RDGW~#$h{$qS- zTyM|FCa_<NoPiQp$PwZU6Je{j@~SUAml#t{n8$7Rc{$TZka*>8m27{ z8Qpf%tO!BO-Wwr&(=>Jx@s>CL+HmoRTm4vA(0>-mYchlTJUw_h7M;_19={ey5z|N!v8&o17yY~a& zyBeE=Bj_z>4YgLodm#18ww$Zsh#(gdQuTFB#CbdQyAwrx1+5k6bS!5OztsRPfe6MJ z=W6af$n;ge^cT)|G6gk=I=OIq8NToX8;@Jbsn^|EqEPr7B|z#ZZ1gzaO*U4ju~6HK zL0+i^uwV`WDjbYHO!^L3EP{IYaAw%j8$4CmM9@p zXkD`j#-vJnc9&TYA#HB`k;Y9n8emaTO(X@qA<3Q66DU+n>HVB#j>%!$+A0yd+PPY% z#S2T)&+q4Y<@1X6&98%Gpk_xq`gAua;)*#x2s*KFqOA;6`hJs;#ecr%qO-a(K{z@) zuRgKcn3t!!`%^FPiv&A>Z`8h#=Zpi+hI<(p<(RTJeC2cOmzWo_3D~qA}PpiKlRchRAbhr~rW&n3$_^8GT)BwL1^W4-N1ND+|K7-tJaR zzHveh{!E@dZpF>_u_ToW4BP1^F02e@PQNuQ?4O;)U)~F&&|xsV_c~ydAw4xWGgH4z zRCkRqa2;penE4!-56Ajy`zS2s!kyC~W0HW8Scjq%eKXH+@XyzhA_?0@ zy7@G#!sHPceviMuYLw;iIZ>kKHk(9EJ@QpUZ_h=k#Sn{~e7ACQDfNeNLu*_S_NBj5 z4e`mLHyfRoc^KSm7+BTtjtx%1fM-xcs?gVM#W(_ajsjuws>=GzZuUn%@}3Nc2f2$) zi#(GhBO{|L=VZ_Zj&9+`ITygg?V7D5zk(IJ%tF}LF((?|l`x{f#X`yL#5)NBdj`1Y zBKCJLj6vKaTHP?O=dCK8fC%l3NK03c^}kC}m!|PXV<&Rm8y{-Omc@B4kroBzb_5B_b4bzJNcr<1aoKQlnS}|YvtP*WDBh4v_LH3~XvDFih3c3pV9>JnPC@LQ|;H#VM>QJNPIeJqQVEJx?=eHD4$1r1O;z z)~9U_P{2-BcC7?YeT6CO_^O)RuPU_BpDI@cF+cTT0*E4`)jXS8y?!>PIH1PlMIM1^ zsjqOVZZ^_43_=EK@k-;fs^6V$C{y@l8M4&B{SIM(THq&K{z7nh+Y+LM2D4-jaq*m0 zSJ78n#3PT-y|;+X&0&e`PPX;#=VjVppnaC0P$VFzMqgfvvskZAlY%Z& zzC}`eHYvWT+G*EKC?yj&GaHwwKeXG5vKEmte_$S&oz}2iwfQDkn7n-sz$dIjwz-%kiZ|dW$5nlQk0ZCqpM*4P$=PmLbpG9{P zbIL{Zy<*Llft(KI#%8NHrp$J(TghZm?sZFmJcDdA&+XybPm4cT-*29)+Zi@M*PtZ zS*J@hA3iAz>`S^<;vhFwrNzee^o(q$wYE27tuOs_(j$H}GU&Nu+9v&ZF{$uCFA%wwlY)WcELs&zf zG$*zHV`D%-Jw)im@*^G02eXEM(6J%3aOn%Y@Fj@0EPuOv;$=y|!}mZ8oA~>_{Lc;? zyuU9NXu{fePS!{Muk3CZ#LF09^rHi3;P{`{|L>MQKFiQ@{P3E~h3W5?@ozV^g_tjT zJh4qR_3!29zdk9xGj#K7;*rID{(t9^d(#0f`56hlG8k5%h<{-#2esk^=~Gr#R?~@s z_(7mz0yGT0%824YC~+0oI$C0QD5iymhGt2BR_^daTr2eKPoSX!%JiB!Qb0Kac{mu2 z8#Pa#Vo(x;NBC3$ox{Nd4DNyx-HjnuaOG=c7+5N-pJTf|q~M#rIcv7BP_v?XCviHh zP$BVBLwN8{p#y?0xc84<(KnL$EDL=Fig&yHdG?tq(^wof8$N(K5`&JthOG;Dwn&1E zm@eSv4+>|Rev3UO%h~rA^&j`tp%a7Mg~lo3SH`_j{D9R+2)ed75F#*VM!VJ%Ikf@y z_F8f}<)S2ur53FSJYHHV<)Wy{4?kwn$wv_M$-e&v_Fegr&_OCtN=n^KVuRB(cFF5u zfn#p&4z!SB8xrv}+faHm@LMGUK8A6CP%j3~3F`j(mzM}}d8dtG+U^1k;c670J{%;% zj(rp>auz=oS|AjTAMV5&$m=HKUc`EvSabK`sgPp2!ekRkmK1X-VT0_R>K}q^;=?_N zdyDzaIm7fL;KfUiF9)S}0#}|eTyAy755v@e>y!Ykd%v*TQ%BGmd=Fy;vFT7BTadOh zn=$B02BsoVO7d%9(UK(|D+1WtqwQ~8$tQOr~2CTp#ApwpLH1GUZ{6P1JPaLqXc%f!25ND%B%H%^v}yH4>Q6 z!--h-hBsfXRB@RLe>miiCC>Nqt5`oBP)K+SLO|tR;NJus$3?;SLk9TZ7^)f~A?V^6 zLc#jmkF55Pak=RC+-i?be((-}EEYqsW*cUK@vTt@?@MCkB30K`>CY^)zUXi{j=pu% z`HEz(*=)W#Mz?XCY>ju)EUMI zMQk3W-ZeTIY^j%i)#P&I`-yXkSSd%-6DNA;U(fPC_nDR_V3S$;#Mp!H zqbty+E;jg?wbcE+vP16yV26JE9H?P?vA=NkF`7`g%4j`-Mq?e!wPuUmfp@7d+cz=L z2_=G4&aCkLBh(_LgZX-c-C4l(BMN|WrhguQ&c1m(7>~CFG&@on0s0Yn)>Q5B4`(~9 z3ay?V8r`${m;~@p-$PKZ!~-6u+Bonrblg$a^4y(fxY{XgrS3N$&->Q-+ z=YAw~a(saLjI6*(C7V6MEDPFs!{hFJVqx_J4em*8DLPqh86d;*kA>M`6_d;2xw?Pg zZSpGYmRI~XYvUM7O_#Gxhf-LNN8ktq~bZMU!;=C z=ykdz*oXeHPVo7FyyrPe(QX{XmlamkOaP}yy}IDpTaNd5yS>pwj?ZKfzAE?{XzlR zR!WfKTfT0)uXB*w2T`dOF6(zxos;?7@#n_f)A zHH2mF3s1u~UZkc7jFD-euFMf{Ik#yg5^0P54R90}8XT+husLNc6ffBA)}uh9o_ro2 z4rNnFpV)>mwmdk)MeZ-efmytGY>C&va3U2z6{HeXk0+6-cc$s@h-GE)C+@(vhPGSy8&y%nmQHc=R=pNS>20{9=(I9o&s zMIuN6l|Sy5q_BT}fSa0BGfR`3LbV}a@XdlS?qYMv0Ekt`pfHnixnK9$Rpk_wNG>)h zg;&7%fxZQu)~(J6=FfdBs}Kn%w$^ElgSOjc)E;N6`Ga?JcA5)G4}aRlUxq*nfE9fx zq<}(C&4#LC54fms47R{wnPo+{+ZiEnb23F_P@yh?sD+|PO3x<*A}M$J#C#m=Svy>7 ztw8xBaesSN{fZN~lM`vQg8fZ3^ec*fbXg1+L?H`oac1(ENW}c^e!^4`i7uvYBnrFr zUUfFm(G_f6I{3_Z0g@typda%9i>1|4%R<#}G|b3~YPmT1*BJ%H@F^9BeHn#7@-vXv zf59j8RWDcmc%_qbYosoz;_~!zm{clFhU2*w`R7Dw=HPGjA#sVvj-34=uRAw>MkwVF z^=g-eja$sf`uo~2)^7wpef#~rRkN+dkH<7IIm2F zOxjq1{r&ax!|6DPz#CZVenZ-i`bVUyJojME!Xm7I5CO2vv4nUVx4=R!ObTBkGBj#& zJxf!Btlm#3!5&5Gyx_1iOh%(-)q8H13aSy3L|UyFFgo1A*dy@Pk9R(K^$mre!D$ey zuva6OSUjc|Q~>ZuWHXW!F}d_=y|V?eL~bv9;%U&R-xFNUO4^JCR$IhVDlxsx#NB+p z@=EV%5*!|^Y79@E#{_Yden4$$+7#{aYx`Sb4P~iVDfUnk0*A5DKG&sNa!>PlEh}vv z8el&>;Sra=s34(iYNp+-&ncbIAn3kT#Dsj| zK>ZV9E?pOT0n{F?2L8?(eX8-e`$u9nqLDAjO3)~|i(Q0uGV^Xr|>PUSO% z5Z_{9tYIUbs8x#0wd#!{ZgH_FD^>J(_k^_W)s-6Jh3fcL;WZX*Q>dS^ z@_^o&$qEHt>o0`>EOX04;I7a(1I3z9c?Chad*> zCLNy*1DCDe2DgVRpB(n*)j-ssiS1y35xH`6pm&IWrdKPSZd!P71d#V# zhh0c;BVZzsEuSgkTeI0W?>oV@G|5t=td~7or1lQ#iC%Ne3Faf(s(s2HZZ1KUPops~ ztIGEMBze1}hzO98nE9V|-vUvEen>V4NbZRZdWw1h8hs8a7$HWYYRft09NBbQ1o5A( zUS8baf#-(N1f}eSMJDaiqbEN8vDc=FPF;xINUOgCove)nmPny!!PVZy{Ds8WoIRUZ$21Z zrzK%}RjB-^y(&8wQiWLxDw;IF=Ym;HnU!2pkD!Mn{Q?S>-RJGMe0=y-A#blY20n~Q z>G#M|mTGg2AWy0DK;_#4j7M#+{}27H&fA`P2iP#jR8FuNuTj(+0~xO zzu>j&{Q1aKzwnXTqNI|A6H9c4KTC%;e$aKig>;+!qX#4S+y)FsA*F2zy1|2gvnc>w z*`X!G`NNsz?R3ijtUgb2Sfa;=$f=Mge*=N>eej{JD#`;4yT{)@)W2c0)p5NFWoF4*Mo(>y!I#1}*!Be`w-hEIh)21=hNxlDYpo{%bi<~TcX+{oD!LE0yobYx2}b+V^qjO% zB@=uj^Xm9UR@xAath^j|H*7!fbQvx(i!Yvu1(ONs3eHnd^9B#~pT*bfR_-_nG zr!t!AQqe8&Y3}|DZnmTh44T<3^&*z>HALfZc$MmPG!FZEZfxgK1ep6uF7;`U=&%1C zZBP)=Vl`hxQ^--5oB=bxeA$!d>HR}HZ{|?=PcRFKdoC>JDi^ zGyS37;W{d8XQJ1n<4@O6THsOOi8YAh2l0L4({(f^8UD1{x2N5&Ez^7Fu3qw{K52~A z{d~wxD(2!qTk?TrV|^vnT%k(S!>8A2?bvjt+_+}{^<<_~NqS=Y9u+5(!U^un?wM}s z24-?%=v*0q$r9n49_zknOj?=?#HIy_5022lTO zR19>CihWWekwWbfkFsU)zTDY5zet-%M84y|i?CQ&4`$!6Pf-(K&g65-Lvi7f_wiEo zArcd$UgARucZS1t`>hQl&9^!Vt8sfqOAqAqp5!9O*QsT3oihu zpnqDFXfS(D4%yfN$ElcAB0P5+lSpy#UkohkI=H{m#W>1t$DMpPFiwAPmu;4E}!PReEXDe1X%%Zs59VhQDRH;r<4NS~aYVyaK zl*75ZzxcNa(?2%8$FS-#Z-}9`aLY74LPw)dm8C9dEvFfjLK*U2a#Y23g~v;c=JXQD z$mlhjZ_3ToG~1Ji`#v*!k&IJ-hZ6rHRh3NqrE%P=5wxU+hXU#Ymi;fJ-N#eW^m?}k zaUAaY9;OQBS#`oe`fmn!Sq@*XRyMg@eDQL?TD^8Y=~pQ7`|Ju7P3z0&@v{n*Y8QyJ z)!eST5JuM{L>fDRtlMm3^NsT~&5pcQf6z|$f-QO@0PRWizGf?aS)S%Qry}?JU0QJk zBQ&hqUSNVxX?>*(1beF_G8A{}@$nMRxfbq5$d$fp&T>D@WV*!w3c=OoN;BriV$Q*@ z^OvDOynFKfqRdk04P{&vP%H)K%~X-Q?{(O|Udj!wu(tLy`$lBfD|jbFqED(HvFntsn{jq5d>qnXLA5xKe= zxY<}fV*Xyzee-S2d}Hgx4b!FUXQ!>#{i;>8wfTpgv>CgdeHRU3?c=mo_unKxS{X;P zdUtfR{HHyS6N@PK9uLN>oJ97n-P9Vct%}=S4eGuAnbXAOW~XCC35z}#;7<%0;oqa| zXTv~d`m24sXqDQ%e><+;;(1kY%|ZRicsKf-l4q-BNOB#-%jR%QVzWPukB0)nr>Lpx zBh8;DyV1bZd{3R%ZiRvQ$IPhX>C<)=&HZq6?vL)K_R~?`ip+g z{tsJqxD@Y)WN!FVsTp3xs5WGhC}N);eOexALeb515_jiFr7HV}1C=etvN|qLS5Y;c z0%6k@0*qnBg`UZt9~RMXHX5lyW$+4Tiw~ENp1WM!$1faPQ`EVxWf2E`-qdI~OspyE zHM(YjOXq1xbh6g&8~6~}t)%85fY1b>S1vhQ30^QYy1B4EV-fM;3sC{%^Np+6Clv;J zI21-TX70ff;UpqoAa-iiUe|{uS;KLXG~=hSyHZ@D`+42zMT+x66xknlU@PqRG}&vM zJ~@_G7(Op9PKnLFOV@@$JP`;RWx30dJZUABn4?T4sj6_@&(lv3&`o7-2u+fy<@WBXMU_xmv&HUu*$-dS&GJfvHG| zqTj(;nthWo;4wNH?SJw>Js^Ax-k!kZW8SrM3M{tft6FIF$KfW0?>|Q1pD;(6`qmdaa z=)Ap{b1F65YCyGH>E{ndqezG&f3L%sLqTqk%Mx42D%-nvgGH?GXEOS&kI6^UBZOFO zBMHq(ON(%e-Ec^5P`~LWvZSy7xxvPTI+4Tu!jnX!g-Ne$y|Z?Xs`l@xWAK@>b58mY2zFEZUt6t6e!+iEhoB z`P4OfDRgWxP~-^pn{6~8XpXLRi&KP~zfkPhrXsP?p6JZrb-IX@xa7*6O^?O3Of+5j zwK^flalVyKvnkQ2?ULPjFjfWsW>zL;jQvLe^#~tDsN8R!vM#EwCdBGTxKEjCsM@5gN z_@j3krsY*ipAZ>ctjI{N?@9AxjHdQh6!2I-+A&*6x_s^W3I0SfuD85;+Vt5WsB>J- zHj~Q>R|PzkPcBr^P39I|?Cv%x+HKpmt+r;P&GzY}9rrBRuGMDE@nTN&vJt67PavrD zXI>?1n^)h@t-~7!h6Zwt-q$uZq0=hH@{k9Sr~yRKwws0mbzM9qIW^T$5o|Lb; zg6q*FA4)zW5zxp}Bw>$!-7Sf6V%KHlpM*`OXZQI?ZmGpHzk5C={&TONCob1dJsu1Z zm^~T1nXPOu<3GP}D1szsI75f%CkOY7c5e(bO|_0fFa<7#L<^N8a*JOOLgmzWUF+1F5}~x81+78~^ePzaZl^4iNNG9cR7HdWkAsKmNp8;x_k<%3E1DrkHVi!E{Zb_OPUOiv^xMi+g%@A0;hGCYhrtoGr0tEE|= z=+DcI&>@=^y*&yV!Zk$KV=D+=zaFhvia|U)lZ6_OAb?U$_``$pxvUXv%6p_d5$>kW z)E4PZaXVqPL|pcI{+dFiJ&o~`ssMY(VDbfZx^drMXLBD6{q2MUg()HOClL8@_NLGN zhciXPuV|K2raEg-1t&O`COs{TUWd}diufAkPOaO9^#)=$Rd0Noy2fP>dU+*G6JwCd z$E}&M zWy5khk3#Mq{_Ao+8o4Z;c%JGoFyFTW%PUZ&P?Yl&#x~u_eF2(Cv~-R z)3ruD`F4w6n;Y*K&81YDx9`03IUV{2enrMpdBRt!^H{H5Dj4^E!;G6P&eD#CYNX0! zCZwKwP~zob7Mk&zL{x2a3)j|r+}(OvjwpZ%RSAtwo|59w-jU+iT+5QeL!8E&+0wb^ zVf*M03%nL&=!qKmP86J|vdiDpf0COL_Gs=GBV#5+^r0Cg1XA9Ut%eF%2v`gSS&cLY zW%W8aMv%|EOH{DhVy~iVsz*WeK}O;?QrJHVIzt@j>*;?wUN-Ljuu}bzTQ-F}mdnjn zr(4J|x(ji1Cn?Wn#>wvK2X5}rJNkaO^F57ptx1|UceRgTS+#f3D-L??`aU=NHo2b( zeZP ztsWucCF7E6ivjUF1$3flJd&hKFTIyN_NQ^LDy?|#-iBh(m4l$MnNWnqMm37iVLgms ztknP>uiG~C#PK}HlAW5>vgtgpx*G-??cR3@C?#$lsBcJobVXp`G!;l3u9@{vv(zMA z`!}`TRf)y%D0yyBF3w0gq41SY#}rB$(%30eFUV*Zyur|E_RPVuwR^agM@oPFo)>X7 zXSCaYoKRMfbbJKPEMDh6>hZ*5(Q03;#`*-IAgI1uM z8rEUQKl8%=y09G15z#bN8nU)avQr~HiFBqb)#V@?c$|$UWy+;Il9<6U^J5Q zEk(Sq<9RhnF+&6+`Fk9~{?dL9r#uc?)m754ovj+3CO+1@y;e{ytIxOLk$t!LtI?=5UVG${k-LVrr*Ru`mjw^b3 zJi@Da`|w6xgo8CbGxDW!PSAk~UHdiW2AlDYALIG~Po1j9jxy!KVnayxyTUU^FLpmugoJ7&6$(tq5 zuWf5Wq(gX$*5X~K==$;5JVW_Hcq|aJ&X0%SwZ_Zi@iWxP5c&ot!^e>f39PmfxGUq& z%)NHZFmEoOQADZZugKt&9v*ex@Nsd<{Ow`KXG2AJ`{hMI53sib%GLao7{<8r(Wf(mKq<{v_9wL!u)wugNF29#$xz>sE1}L z=p8VJHsH57WHxKVuV>1wOVIljJC8()OcVKhG?jJ}*cD(xr>ZDUekT&0IqjxXvF@|g z)Ws6rmB07{c7Z{JU_o0^+H~T`Pmq?EK4<+Yr@P$?OQuXO)^s3;$;C@DlDZG8eV+fZ zI{sQI|Hgc2b0R2n-jjQpz2sl@@C?oeJ^l6H+}xEf2md&>{`%i6Ug}CI%xNY;*B=aQ-C}xUldJ@$+38T>A}2jg z;iWH(a(NG-bQu3Ol1b5@8OkX701bFvj>nDs1#%k*gK3|_RGUg1mZ%J!Vu+&|#;G!( zNkXQ2&AjFA-yygiMYnyf{jmXJ!R+qNP1(I%O6Qy0hI?3w{+N_N=OxSh-h>pbh~US2 zf#n3WjYIvvj{^TO8T9!o0s^}}&60h;`d|9d--|Cm7NP>j#C=F?>Yp&;|Nb$A8QjSK zU%nBU*IqdElikw80d4QCo`JpY-=`!07>EP6E0BwLm7UyL`%P^7Kx~Ep@%9y*&qmg< zK}1^Sf4_g;ONc)g77uo(WBzkD`;VRN6)1w;%53yWt3$|MEEh^QwGd!57}XEVvE?@c-or{l|-!sQ^K4tu&DQ z?{^D&&wOjvWAR^1KgYp0$CKyf`vuHxU=aQI;80`Gqx|A? zuH^C0o<0+xx)yAe`tu_ZKutfRE|O1z#PNGk$$?vCmBoz04^F8h`WV3Pw~mB$yuLV~ zLqsD!tieV4L<*}K^__-YNO}>q)^!QTfP8`O`eB5^;rCAka4rVpa^6R#g|q_k&5Y72 zsl?X7-Q(;Rwl6|oF=Q-ItewaLKHGww8$1Z>dD&!=x>XytM|No`3Rn1JsCp8XsSHBnc3F(^T9Ez6l^#{l)6$u{MuMB=StL zoMA{%@PM)P{PtXKnsA% z04<%w?7{cKt_s6Y!w2h{&mKhe^L?h+8xx+VGJX&NQXi1dBe~My|CR@+7<&c)Z;%EM zUF_mne*yeDNDsaXtXRU5Qf+KfzuWdOQM40 z2wmnmW%Y6W?`x{a<|(z`cx&`mseA*Aip2WpKR(N!j%WNLb~!qYKDAPoxG(yw6S1pK z)lJ0`BSbNJVjh73a>!kvTAndps3NOeqDfJPJKN+^ zxwZLXDUm=hp!X~PCxK@#aZP>_=z4foGM@nHllYG`ZfW7BG^TIMBKSm6ESBm%aw@=J z<0JO9pJ+B52tc^jT6{uqLqnzZ^E&Z(*t$nGH|KE=y#$WgBl->WQux~ZrOg} z6M-q5o|C|vZ|%>1vfuD~Udt)D{#UA05uO?)<<8FuiCZq`v)HDaOC_^)+i0RGUNr~# zf0{&I?~5V1MzfZnIhq%z9ft* zo{7xn$}}=}2VM_jXM+!duVTQekp$^GMmv+mIT=V;w7no@m|F9iz*#L9P)(C6pa!%E zmip#6iX>JL4LE3W03a3Ytj#q#mENcN+i(EgVqY{-;BY!9h9bcdkBH} z?(*K%vn==*`w&97Xd=fbyED#%wU^V)46Kqs5Txxcy)^VU1kUAhL!Sj1u_oTxg zqr@9l)fUgsnAaZ!7B49f@u8*s$^ErWi?b5D4t&Y75}^OjgP(Ic*ffGL`Dzs>*hRnU3{Q>wcC6EX}cpH?<;Yxq~JJ<`z(VScH~~lsCS( zxN_U+70{OB#50(^;3g|dOtR(HstRMNS=6fzE+2Vu$9%vbFW`UNgw9tahlAbEkY19R zAQ?7|NUZ7n!NVf_0f(sb*V{>>B=g-%ahia>sLZmO7pbh@a_3v^hcX5=K}@(`P&A3d zD>4^{ABuUECMeIGp81TkRn^(9^@9!ZjCQ_Uw;Fbb^n~f-uBxT2**=GL91%L=@W3Wq zzI?z5*>InTuNV^4{_&SlU50jpL!UOrW*|NsiZpP7CahBnoR0Kc(pY1~#T)=`aZ|0W zmoEt43y$Y$3#Qd!_Q+edMrDIkkqPMqJdenn1z{LfPR+G(PhlHImf}3_T zb)|)w9x(<*{Q0+W=dad0OHoaGE+5ciC=RDV@#aqKjXxRm3$jCw@CBsaj9R7IX!(8( zR^_PW_n_0`~Bwus; zNwmDa={%ni+23%QZ`Ub{I@jrHn1CjrSEtDy*mLnj6nS7Y@u1~tk?c@xvn`=e2;os| zRsuGbY@c@x#(IB!CKP}ZkD@N7PR?lgaQ8V>W8Gw%-}~AP5nDzezZKgekiku1fA8*^x#>tv6lo`a#EOoRuFD<*G3U0wa9@){ZA3>bIow3dAcat?-XxO+6|+UY zq07|D5{rh=5q;yfGCA~p<^9h>!y=?z(tg~X9vRO9rq~?FzIj(y z&-FckT}#!n?*U%FZTQvh%)2`|ygBDfLr?Bt8CzVxpb@||_jrpD(5nN}!Wvz<)mbDdfh{WI{Jr5ht zVc==df+xuP{SF5r#dUhU7Rg(c*I+Tjh;;DMKbpR^8zq^5Fl~*l30@V_n3K{Y3^y@hr>}IG1 z;S-1@K5mjm?6$}@?`=?r^rP}IVDRwa8kX7j3#<90)KVKk3tpFcPLwE&)urCO8_wnJ z9#;L;dgbjGil)JZ3t+L86Z(rd^o2_op<~=IKx(Vyg09OT;W=GB016!d{AdR(ESX)E zgaop;+xr8FKh*iczftqkrOneBxH0|Q`||J-S5n!EF#p}JX!wUymf+xIJB)Zsst^6q z3p)-A(Gui)ypDl}gIBRQ3zgb$?imD-s=h%@n%|i_SmauQ8ZH->^6EUEhq}J^QDIknY|ZZ9J2{R(Iz6Mwrgk6DOz$o<330qo z`&uMm4Rn1X2Z{oNqfj%-2W2B^rM;oK_XMvj+xj80d!X2%0oLs!q5;^pU&xBbz=rOK zN&R~8rI3u~`kJO$8ou^xOb_QW|I49(UL$Q})+c57`~uuqAFzU7Q{}V}WX{F2=SMY$ zFR8lAhCPYhB#uIk#$~-YTx}cRq5*nzK+?`%`_iEh7z}Cghbh|qKka>IIGkJ8KY|dE z2oZ@MHF^>)Mh}Tj^ys2@iC&^hq!Qg2gD?o9GkQtWMxDVhTB6rchbY7Umh+rE$2sS{ zuK&mP!|Q{~<-V_buf6svzqR(-djWUX2t9mEGB2}Y%`n9SFQVxQoD1ju_;Y+*76IJv ztd54vxw1xoE@z>@UYkT`E2%ka)3y?lS$tL`il$n}PMo!3!^Tg2i^;nu_u`fEO|e_S zF)UJkmehn#+-(k9W3CCeenxHp$9lp8Z*y#|1s3S#6B`UsJv?bjiFnjU6miK@O-0Hk zw3?aPD%^^JjgvVIqxSP4^xcc$CFQvZ-aA(sN=pUb7+8WGuXf7~e?>@jr%Rgza)0-W zeRCk^GVR{y_u_mQoy)rK3+vFD*G)`&5M1=N9tJAU*rUk_Xv>J+(M87N3l)~FN#j&^ z$y9h=@~~6Tl~)H7}`(C+e?KdnBoG=GmDV-OZQUi`I1OUy>1W?!I~WGqFsBwuGD6R zUqL|3jzI5zwgIR6wN%1BxOmuxtssArqOt}m`SHW*O9>)5K54_lk=Xt^t=Z*e3~M+I zt46ApafvMBUftJpsYi8<&UE-hczvUfyRXhY8rJdBfP8K_`b6$#a))OsL8#TE?p?YO zrRK6pgb~fk8$sQEY!V-DiQ>$g?SO@IP_v`HuyHZDrJ3fb`N)?0BdX%cBdTb`kB9>) zLLGZZLb}#h#wr1MgnpBDy5Eyb#n~S25sgxf`i14`Pi+>J@=|6)R|++eLlv`p=yyM) z(-Y1F`rdI@Q=Q#$d3Wzhr5Yrddy(WN%G;Q9>#-SuUy~vXgbJ5a*J%@`osEL}+!MsCHo`;G%^TL;FJN&h-+dt`TGy)X5MhqCfI>cPYn*gy~aG7rvQ z4S@@DIJvm)i`-;VRte;FRNx4D>^XMO1v^~ao`^OiV-0QbCjtT%xLN8LpI6)^{Jlbz z5F@AR^S&Oz{?6$AnYf9df!BN%aYt4IlCM*@tu#$ab{0`>p2?c^5Qk)4{Ir}&eBABk zmX2{g4&Oa18GV~R_FU&O^6=owJMZ;jSdq1uhl_rOFsVm&mFNu>^r{Ry_w-aRLMvuk z4O42DPf6_b8Yw+04y{IjYa$IoIXm@KeLS+5OpX%7G2G`R--jtOZEeNQ2X-o=#?9j4 zGYw5U(wh#DiOpC?4SLV*ca$E%)pQ)9!%|5Gq4>Cht!Bfk@F3C7zFLg=RXW1Fj z^K-fNNuY*kneDrVZEsLX_x48yVV}4fZ?270NXb>E9 z-=hwaR}~><&<`6&Lwm~uS@No(2hx8Mg5{#*$5>6Ons`uRSMc?0x|__kjFZ$ney+anYjZ!5k1ASCH%#sh zMFL@%I&Y>KXC*^q^d!s|>19gS*fK=ntATl|x3<506&7&zK}eYsf*Q|`u3gS=R>t+@ z_=pbPviD+XMD4XQxDRi*U~8tMFR!^QS{??PwOl%x)@LYVNj4B z)+Iz$;cs4^_~K^#twbSe-bD4?J#GyGuR~$~Sxnsf&AoEnbfYyW6P>%1Ky?B|wScPZ z;o_kItj*5X*<*IWKzwtB2I79-g)!DHY0(y3oMmpm^Ig-A)jva%h-ZR zj~M$#P2ySg)=K-R3$n2{@5fbq$|{kK1ILr9t=6Yvo~YpPRfv#;z*HF_(WMFZ<36A8 z4?QwG($40Xb5$q;;ZLuwv1RJuFv!o91mlga*AyIPbP0(7JyNKYChpUK^|H#qY#!1V*V1n??V;v_g<@X^~j%|E=pGtiaMXT<aQ<|}T3EF~npF(eqOw1Aa)sq7%s$H+SsBrcwx~0$ujDDiwUFwEEqaR|_3JFOS z`2aW`q{YV`=>0}H)P~L2Ct`s@AHo4Ck(A8Qg&kNI-{YstcO_~AYiIbAezu_{wx09} zZnGP6sH=Lmp4al}Qy(6fudpuns@PRzGv4YrmgK26AWNpno1U#MnlC{g;_mR|_(^B- zQ7(-sgCHZTk||HbL|rEvhN=u~I@_7yk^wQ7DqLHiGHW0sl+jj24x#GSrKDSDMqfrR?%A}-Bg;{i2k~W}-Ut;`475R1 z(sWb<#(WQ&S+yEP6!+iWinmOm^mQL)Rj^QTSPgo-rrAG~*6YJ?ef&A6dal<>yL`!& z@=FpPDkc5obZ_VxnKyvu;ZX_Ei^0dmT)h|&e8IAbWqU&lQ|k>qAHcIA`N?0lPEe1Gy#pC=5d6_Z#z7nzy{V1Sx$a zRGKeB*EI3WgA~L}y}c@R=4Yztkei=JlIOdG`hfd^`lGn;V~h99fF2jC9Q0VsqP>z( zsHjG|)QHUTnt`ipc2USS5oRxKagqe{MS1ZBv#3V-@7Us+<-0y>iv#L`<8hcFQDx6 za`Lg$9QX+|j7Gpw27@;%$=k+DWb~Hx20(KrahOy9v5K3-Cm}j|@gLD)`xUvAP9m~U zFOB#k&HfCPJn=UZEq#zyO$EkrE@{~cV>oav2gV@1?&ExSP*B01B&j3QFDSg6^T}ZK zNA@S@#_Po)^|oFfT4Rc@{nsikS&{1R)?rXd#QTKY*Fy=2=-4uSFON?ra*Z3V4LH)# z?EZxHh}D%uYsXibyoh#9-HuMLh&hk|fiOPJkFodb&}C^jVzzSz32_=+;8)-mKRC5E z%JHZ?j-8f_`Pq*Z1IvnPJe-uQPP_Yezp1?>Rg8iVOy$Z_+i{_THfMx5lr*SBYQ66L za1a(-e3Ee{IyH*)9tFgDbrhGpryw%>-NB>nwa9c-I_Q$MNjO)vxrv{XSsHno*HrFx z-7AO}=|wh(jONjoX(BCwweclp$3ngmhtOuyn>agd}*OF{| z7Fe&ijlx$OhH{e+hG$}0zL7Z;g795VyJp<$@ggj%b|vCOaST%&i|~f~tfFB9#X(-O ztJ+xtIA{l02eE85|7#N(S<*vBm!WuTRT7yq|$<66NgZe$6eD6T^gQOnT zzfUFZS2V%Ti(~#oQ zc##}2()z9b=xIjCb9J<%M1{{Q?sqJA6`Q&OZV`ao5cD)S|22Js0MVd?^z zggt7PX4HkkC!n&vSg(MJMS{Xf7tODS%7KVCuki91>KAc;Ls$rrWFyq{n%Lr`MWmP{_CwGW z_L^#4KN>wO=SfGZ9)VrVtK_0rCb7rij}=c50gNFS(E@Zy5mG1y%c_OLz{iX_XNYf` zX8P4G=j^Wvz+9?EZ#VES3WSn+Z(ZScWHHV#VZpLN47%cHJ@eX&-y)C@=>zsZx$!4o zrf^wSayg~DJai~NqZ87vV0ti)Sq1@AD?LtW4dNY75(O~EAoqm zWWCUr5J4Vp@O3IiB6`-Kg>SpzymCuvMwI8A#|J|rlH<#V~wlDHN6=O*iNw$tP#rUXeVi%Ko@rYO5ZKzi2T<S2&0n z!&0lIIjXP@Y!>Pa0z%>?*BjHDbv4`4jV=Y-gtoDxx&LDAY(38V$RXe<#07tn0I#du!d`A=GI8Ea_@~G#kpRx=)M}(hjuD&VT9OPcZV3=fm zh6|Hu3x*Pe?I5tVKvx^{0hhi9sWPJqLq(?i`tEfa!A3WgWUg+cRxaF>144-8$a^yh z)=?MQ+pPCHI&-$9>hmg(X61Er1_sfX)yjioaLt|3I{it%hM*9LeN6|DjdZ16qK~LN zj%2avxL9G^lkh_)8;d^)mZ@XelhdRF?~CC#AnNo(-#lIHe{@7gz%bp_zZ}4~q>A*3rJXgN2jNAcl?09-0iJ67$ku7;8j%yYn?a9*? z8c(*)NQ$?IFDmGmt|88eYBT6OCR3d2;J&A3$|)NntNXlR^To=MbHv!LgJg%rhZH)w zgC-hSZ{TFRfUjuc$nmwgD#2R1+N{lCOPe24IWwzh=41($1_1#{$|Q*T`u6gowT)s7 zw=DoKk^6(bF!g6nVy_2=Vi?ByeV}N{vp!FiNgESxKL0?f@BJ_o@Ff-U-9-!rs(y+W zv|`yj6jggn$;Bl^QtEbgS#l0gIG4wI5e4+?-g!Qat(}zB6MSow4oaZ|lwWTDRRnE7 zK$6a`PWOJ;rS_{~g#|;1lr#0wbs+~J@Id{0FX+#_VLZ(O<4h!=$xIsfic;i9C)7F?q zf9%)@LBb_%hHx06zms6#`)Fp2(0=Xti!tk!$c`b`8iX#4$IpnySk1 zubPZ`T5Vid`{y6~UZ#sUI`=#f&RtltpyMbOSF5jfeYb$5MVhWvp=5=!HfO5+i%q9S zZ8T9w<7)KMgBo=gkJYC%Mutj^*|HC0>^&*S$z$VeOJWzN&teGjo37cNXY;s!vdx5)lJl+}twN=_mPv)V>eG=j4V7VDRNN>FmI^NX(oHAlU*cOq> zV!JveQSLu`_hoycQgOb2^FY8lNk@|OkL6W$(~pNg_Z*BIqp#7Y>lWAUg+<~<$^$!R z_!r<5vO#J`KmDU4!B4L8p`C729hVf5J3*U^Dq>{n5o^I2v)^gj?T9jgs~xuVOu5}b zG`_|K6AvdzRg`vuTPp;sp2c%pt=!3+EgZYSU?7BZF^2hF8)@3RsN&pce-?eWt6xE^ z_tl`&NNAq3e)(&)`QA%GHsZ2s;-Wug0k4rU=3!4$UqmAkRO9U{;qx<-|9FvMq-pV@ zf8M-q$J{r_U)To#p-c)6F?;guI2{>cs`dwAAD-TO3OZ_X4e317OBov_854h%<_7fE zp+60Ws)NAp!C{Q;gi^%JP%CsMKe!_2@ym0!ZCkQEw!aHPe4Un^rTgwPJINy5(B-}M zo9zgiRgV;~S1z*qVrNA}Q{q7e6F(v(g$rURu$h3{&Yz~Hj?-XX-C?QSdTCz1pJ#OY zcsj&?sGhFrDq7(UeRgJmKLUw^Cjr)`9JU7~TJVG`DIytkm4m zT`dkbTdERW&^3FmlCo&tys#W2RFl4Jz@Jpl60BKV5)?DjW7sm6C>bKZ_o(NrSV`rO zWc^+${#j z#{(+a`;|#mh$DMMPP|m?-@FaKoEoz0>CO#FqTtKz%&B*xt(>BY?2V)6_@3sB&%B4T z+vw$C%Iy)nJWsqS_hum~9&5U1VCu6NpPHjZA$;y=}o< z;o`tXw$4W{+I*e7G8a=BbfuN+_mQ0|sB%5sqt7|89~A5}viMZxajpq#Zf02zxgp^8 zy@s1EVUByLlWrltg~6L0eR;0V!!G%iT)4qjyUq}>IqQ+BRc4D zV%sRLqHs!`56QzGIPA8Gb&WTPj?r=nD_EXfoxBg)hTJGJr?(=)U(e+`QrWZVVkmc; z?e*EM96H`R(8{t-_n}{BVHkT_rlP;M%i!9z+_BldC7lEI|H>%IZ@+4z{?Z$nREl9U zh}V?MQ8@!+7&>HoJ>QcMuq*4fsdl3<>BoqnQfItf91msY5qv?dUi$bn()}wIp}rG1 zS83{S^QMSYlwxwB;DOJ__$=Fk&i9QbIgj&I%|&kn4_0MW^f^1D28IGxX9CLR@bDMmVfFSlq}-e1&zs z>(2Anb{DGSd1!?Kq29H{N7e<%oS;A9C3ijwjhUdOiJe%gmh)dNW@=5rq7R;2;+s$BGV$2&h(>;I|(Y-HS-Z zkTmCmzw?B|>c|u|XE|JBXlF#>E(p6V&?1AsYT1?NhIAOxSj4Z%ELhvadMy@Ig;g{X zy0wl`p^H1R$(`u6=&tZY8jGi!N4@S!-;l z;!zw))pZ~Q+ayw{-{x+nT|150uklgo0N46{9idk@ssqY|fL0gX!#YpAh^ff#gf%=< zRYf#;KIKi04)kkPe>hF7)H~YY^%`Bgsbb<809Uha)I=r-i0FN0r?y)en*Nr4hf9L3 zHzQ}XL${5R@|Lw~t{9>26#NObJy%D^r9~5pnvO=61one!$@;B-hCyI;)<^pobpwZ2 zuL+2b==xZ{=hALH1(j-w#9M{xdEONE&b!Krd(=oO1SN3%JU604`EE%Jw3r}7h>Udo z^7O*H0&+qfefHC91jG#fBtXnC;i=SdX}!K>vsU*oxJyo!l`Aax`3;u8f`gMV*^z>Z zLu2%X0F~T#mM}Ah}fmLD52p~fG`{~7t+t_Jk0E9mHkG*K{J%JGKf$N`$ZnMJ(s z!Us|(`TxfFzatDGKwh>o6r4gsGf1ZXj0uBf+`cnvE*F!snQu*yXcF>}|D7l@(|5o? z6jN5##8eLmDXDt`@-!a6Zwy|68Sh$Npx)B`UN86F%24&;!^kzspQX0xhtCwZGz4es zvr1=#^!RJ_buyJJrG~JS{_p1lJBsHuPKDL1DI|9zYBvX%fbiN}4rn@h(d{}8;vMh2 zEFG|M%{EKg`#dsIaHo>BTQN`I%PV@o2M0tS>4=q>aeWDt0%JYKCL02#WgT10 z6sJrA0TDS6wC-^LSOY{nrP25J-N)lqllxg?5|B(_TxpI?M+h0z_;^Wj4iKDeJl1%|f|v%MpRTZn0?Nq1frR z3!`XmtLV-I-#P>$B3IQbztDExVp+OK>mrtXqAXJSG5_!6&Mz)@kOA^b`m7p|-zj2| zl$xg#mk(-c7>6msTCVujAxv}{wg+?d?Jjg!WPV7K3RZ8W#NO}~^*7)(4Xkij?&p+! zDyXZpTS>bp`{V3Z0K5x)d#q{5(jI4mjaz4|ooT_k#<3eF@E>eAgKq^}zM^g3$D~qI zQ?tcSF7Zlq@8t05#cPBd+8M{EZ>~%eD?`Q4(Fxho9Zxi?)isKKAy(rXMl0kABmzB0 zROXcm)XMk}kfB_5n5DLGljG9{*GHh8?i~-ywF|Z7rnZhaBo)s?80;%FI+4j_NcH9I z#F^PSQJcOQmf8B=R>YW5yo*0+Q?v5i(>r(Px`QnMJQhz#Gmq#ij!6wV@_O|}_>?A5 ztrMw_U0%<7LG;T862FqONq?$ShDP!=&I-Og^Qingb5S4C}+f+QKN##O+O_iWeS=;Xs;2D0J}Gr#mDzWWhu+C z6YzewWStUI(1+cUf}5L0v<2Cs70|&j*{8bC$ffb2LUO zqEusi?M7z_g~Tdt_v{D#wQTv!grY8Dw}_R;8BF!d>Wr$9o=@?ZdL_bG$Sv%xQ09zIgC?9Io$N z4#scISuhy9B$WWlQf584S9wd8MYNc#MIAvvYO_9%^A)s$f)EsHr5B;&~^&#_NEGgtEs+}e!(t`Hgck*ky zerD}IHm>24ZvR}8i}9v^I7klm%F4xlu~#XQq(`s`+ZB*%d3Pb%`fa;lT85C9`RQAo zcM;iZ?!bO_Q?u96ydB#I51?7Qc0VicY0nKLMJqYFUF_d%{xSnLALI^e{dza1HFoza z<9t4$wwHlXNAbV*Gx}cRL?c;?YO`{e5=H zFHc|IrpwnK)+z)#P+`h$az6z%I zT14IhI&Y<3TfPgv^o#v9E<~D-Z#SOpb6a`zs8;#}Ey}wiA5Rt`+Q1x0Y%!$7yEAn+F zYudNxc%-=K`x{ZD#+eMT<#GOKbbj~2tT`zNE3d4;`u=YsUyPDU2@)*#FW(rU9f*pvh_ zVswEjsF@?B(SrtQhQBhNfXK)UAk0Aa%fK(Q%c?*;HQn2>((%P+Xy$z~{%1rUe^RIT zK;uf=k3ZJt&++99Xvw+@XtT}#_=inp3m`s+I+0Y(jL#x|PwUr1BST<_A?fOYU+eLm znnG%PR)EKR--$e?{rVoo<;3{5n2wrHOtZlDzUnh)_baZ_bu&@Dwo41?JMDPxLre4C zBnjQ;qv)9GH6hHP^qALM+0sDB%+2u`fWoS-tFku-ot)*GYn}{_+i-yH;B1H)m63gVNqnE%v!* zCDhN6O88>aT!6Z=!}`fB4=$`%f$byCQ!?|8mIT;erS0YQ{uM0L@Ds)QZ>j*v?%4w{ z%?#9B3jqdp4YJ5ZoNjJ*_q??o6xzxeT73(9nh06hVE0gb6-`%=e=mwqXA2%>^TQBj z^K}_Gt+h`ZC%Hx&$8HZZ%fN(;Pl8>~z$(;t@%=&RiDv@gY7u8M5^5{BI$NSIj+ohp ztS6aG)CK2oBvd4P-182T9&$fExVtpIn{o&^U+Jj+p}dWajoY0wyOS3uV+(l=l9SJB z;Xc|Eo)S_UrV)kBV-*O z6oO)DR-r}T$+{@DljVr_uR_bPL@)6GIT96l6uq9wi(-qauf-PCoA$jv+*)6UXB7^7 z5fe}oskJrn*|b|fG!Beo5+&UU^Med^dpBG|2WIkB5CJoNGL9pTr9gPX4q$1_?%$EY zl@rnt;M_lSBH7gPV6IB6*JXq{80u7w8`kA^^?kbg3CKhzKR{^&&&Jhas~eL%XM6ZA z2=p90k+ij zd--v{)}8EXSPF0m4*&x?WyVF9BcQ*0`leH%_9}gdZEa_{>vXD3^~P*>x!p>?uAK`q zLFe1DTUlWoJXFIma6;*ng(!~$`fpSqM__`#R)UbP)a{#9ZFaw~&OFu*PJwTXX<(Je z-pneI(;li3h zzswzylPW}0vY8v^hia55f|;$0Hi~B!fi;4|rGOeso;mj4h$+JAosgEL%#P!V@x9$u46j1H%#u+r(P`R%3uR}4^B)ZuVbL{Y&THVZc#)LzANc-w z$?=>GB59nI0X25>E#=7u=tIAnv}kEg_mFbaq%H_2OCwtRZ6mco)bnR*K<38Lqe$9w zp3f4!I@#DwY|X8D6n-zqV)Q_fqNNZVB44ak$yOp1gPhGGzDhZ?cg9fr{+|km;)sm=>ho^-6NR+CfU#s$ks*(0PK>aEwfh(60L8 zZwa|=8Y*Y=JcH=mZ-4qrn*7MAIB-+nPpi@ISBN3NyeuWB2k1^2rQf`50CtT7o~)nV z&HDZHH0{4X`df<4fuO(fj$hcnd)!Z4fV&^=xr4iRN)3O5cp<=_n=>~29_{yoUtr3T zhEv(3`(2=aGF5! z`sK6#80Xi-4*BHX4KzSe zMBsnzvWN8%@Ll{S&+0%7r245vymPYtDPJwKSFVD*7Vfcxvo794m9Y~o(kS;{blZ>a zn)v6-1VnCxb))s74^O+YKZQOl^F-mi^3u+ot|j^NL!l;spqWJ2{tsdb0>o6_w=@6d zzpMmcA8G(?t^2>B|Eu;uZ2o@?{});LKQa65qkg+hvj5G>b;JUCpqQ_h`s^_Q@S}21 LQ?dB2W%&OCfFtAq literal 0 HcmV?d00001 diff --git a/content/kubevirt/kubevirt-csi-driver/controller-infra.yaml b/content/kubevirt/kubevirt-csi-driver/controller-infra.yaml new file mode 100644 index 00000000..925daf0f --- /dev/null +++ b/content/kubevirt/kubevirt-csi-driver/controller-infra.yaml @@ -0,0 +1,174 @@ +kind: Deployment +apiVersion: apps/v1 +metadata: + name: kubevirt-csi-controller +# namespace: kubevirt-csi-driver + labels: + app: kubevirt-csi-driver +spec: + replicas: 1 + selector: + matchLabels: + app: kubevirt-csi-driver + template: + metadata: + labels: + app: kubevirt-csi-driver + spec: + enableServiceLinks: false + serviceAccount: kubevirt-csi + priorityClassName: system-cluster-critical + nodeSelector: + node-role.kubernetes.io/control-plane: "" + tolerations: + - key: CriticalAddonsOnly + operator: Exists + - key: node-role.kubernetes.io/master + operator: Exists + effect: "NoSchedule" + containers: + - name: csi-driver + imagePullPolicy: Always + image: quay.io/kubevirt/kubevirt-csi-driver:latest + args: + - "--endpoint=$(CSI_ENDPOINT)" + - "--infra-cluster-namespace=$(INFRACLUSTER_NAMESPACE)" + - "--infra-cluster-labels=$(INFRACLUSTER_LABELS)" + - "--tenant-cluster-kubeconfig=/var/run/secrets/tenantcluster/value" + - "--run-node-service=false" + - "--run-controller-service=true" + - "--v=5" + ports: + - name: healthz + containerPort: 10301 + protocol: TCP + env: + - name: CSI_ENDPOINT + value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock + - name: KUBE_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: INFRACLUSTER_NAMESPACE + valueFrom: + configMapKeyRef: + name: driver-config + key: infraClusterNamespace + - name: INFRACLUSTER_LABELS + valueFrom: + configMapKeyRef: + name: driver-config + key: infraClusterLabels + - name: INFRA_STORAGE_CLASS_ENFORCEMENT + valueFrom: + configMapKeyRef: + name: driver-config + key: infraStorageClassEnforcement + optional: true + volumeMounts: + - name: socket-dir + mountPath: /var/lib/csi/sockets/pluginproxy/ + - name: tenantcluster + mountPath: "/var/run/secrets/tenantcluster" + resources: + requests: + memory: 50Mi + cpu: 10m + - name: csi-provisioner + image: quay.io/openshift/origin-csi-external-provisioner:latest + args: + - "--csi-address=$(ADDRESS)" + - "--default-fstype=ext4" + - "--kubeconfig=/var/run/secrets/tenantcluster/value" + - "--v=5" + - "--timeout=3m" + - "--retry-interval-max=1m" + env: + - name: ADDRESS + value: /var/lib/csi/sockets/pluginproxy/csi.sock + volumeMounts: + - name: socket-dir + mountPath: /var/lib/csi/sockets/pluginproxy/ + - name: tenantcluster + mountPath: "/var/run/secrets/tenantcluster" + - name: csi-attacher + image: quay.io/openshift/origin-csi-external-attacher:latest + args: + - "--csi-address=$(ADDRESS)" + - "--kubeconfig=/var/run/secrets/tenantcluster/value" + - "--v=5" + - "--timeout=3m" + - "--retry-interval-max=1m" + env: + - name: ADDRESS + value: /var/lib/csi/sockets/pluginproxy/csi.sock + volumeMounts: + - name: socket-dir + mountPath: /var/lib/csi/sockets/pluginproxy/ + - name: tenantcluster + mountPath: "/var/run/secrets/tenantcluster" + resources: + requests: + memory: 50Mi + cpu: 10m + - name: csi-liveness-probe + image: quay.io/openshift/origin-csi-livenessprobe:latest + args: + - "--csi-address=/csi/csi.sock" + - "--probe-timeout=3s" + - "--health-port=10301" + volumeMounts: + - name: socket-dir + mountPath: /csi + - name: tenantcluster + mountPath: "/var/run/secrets/tenantcluster" + resources: + requests: + memory: 50Mi + cpu: 10m + - name: csi-snapshotter + args: + - "--v=5" + - "--csi-address=/csi/csi.sock" + - "--kubeconfig=/var/run/secrets/tenantcluster/value" + - "--timeout=3m" + image: k8s.gcr.io/sig-storage/csi-snapshotter:v4.2.1 + imagePullPolicy: IfNotPresent + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + volumeMounts: + - mountPath: /csi + name: socket-dir + - name: tenantcluster + mountPath: "/var/run/secrets/tenantcluster" + resources: + requests: + memory: 20Mi + cpu: 10m + - name: csi-resizer + image: registry.k8s.io/sig-storage/csi-resizer:v1.13.1 + args: + - "-csi-address=/csi/csi.sock" + - "-kubeconfig=/var/run/secrets/tenantcluster/value" + - "-v=5" + - "-timeout=3m" + - '-handle-volume-inuse-error=false' + volumeMounts: + - name: socket-dir + mountPath: /csi + - name: tenantcluster + mountPath: "/var/run/secrets/tenantcluster" + resources: + requests: + cpu: 10m + memory: 20Mi + securityContext: + capabilities: + drop: + - ALL + volumes: + - name: socket-dir + emptyDir: {} + - name: tenantcluster + secret: + secretName: kvcluster-kubeconfig diff --git a/content/kubevirt/kubevirt-csi-driver/daemonset-csi-codeids.yaml b/content/kubevirt/kubevirt-csi-driver/daemonset-csi-codeids.yaml new file mode 100644 index 00000000..17a2ec95 --- /dev/null +++ b/content/kubevirt/kubevirt-csi-driver/daemonset-csi-codeids.yaml @@ -0,0 +1,57 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: kubevirt-csi-nodeid-ds + namespace: kubevirt-csi-driver +spec: + selector: + matchLabels: + app: kubevirt-csi-nodeid + template: + metadata: + labels: + app: kubevirt-csi-nodeid + spec: + serviceAccountName: kubevirt-csi-node-sa + initContainers: + - name: set-node-annotation + env: + - name: NODENAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + image: bitnami/kubectl:latest + args: + - annotate + - node + - $(NODENAME) + - cluster.x-k8s.io/cluster-namespace={{ .Values.deployment.driver.infraClusterNamespace }} + resources: + requests: + cpu: 50m + memory: 100Mi + - name: set-node-providerid + image: bitnami/kubectl:latest + env: + - name: NODENAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + args: + - patch + - node + - $(NODENAME) + - --patch + - '{"spec":{"providerID":"kubevirt://$(NODENAME)"}}' + - --type + - merge + resources: + requests: + cpu: 50m + memory: 100Mi + containers: + - name: sleep + image: registry.k8s.io/pause:3.9 + resources: + requests: + cpu: 10m \ No newline at end of file diff --git a/content/kubevirt/kubevirt-csi-driver/infra-cluster-serviceaccount.yaml b/content/kubevirt/kubevirt-csi-driver/infra-cluster-serviceaccount.yaml new file mode 100644 index 00000000..0dfff835 --- /dev/null +++ b/content/kubevirt/kubevirt-csi-driver/infra-cluster-serviceaccount.yaml @@ -0,0 +1,45 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubevirt-csi +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: kubevirt-csi +rules: +- apiGroups: ["cdi.kubevirt.io"] + resources: ["datavolumes"] + verbs: ["get", "create", "delete"] +- apiGroups: ["kubevirt.io"] + resources: ["virtualmachineinstances"] + verbs: ["list", "get"] +- apiGroups: ["kubevirt.io"] + resources: ["virtualmachines"] + verbs: ["list", "get", "watch"] +- apiGroups: ["subresources.kubevirt.io"] + resources: + - "virtualmachines/addvolume" + - "virtualmachines/removevolume" + verbs: ["update"] +- apiGroups: ["subresources.kubevirt.io"] + resources: ["virtualmachineinstances/addvolume", "virtualmachineinstances/removevolume"] + verbs: ["update"] +- apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots"] + verbs: ["get", "create", "delete"] +- apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kubevirt-csi +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kubevirt-csi +subjects: +- kind: ServiceAccount + name: kubevirt-csi \ No newline at end of file diff --git a/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml new file mode 100644 index 00000000..4f08af46 --- /dev/null +++ b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml @@ -0,0 +1,329 @@ +apiVersion: storage.k8s.io/v1 +kind: CSIDriver +metadata: + name: csi.kubevirt.io +spec: + attachRequired: true + podInfoOnMount: true + fsGroupPolicy: ReadWriteOnceWithFSType +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubevirt-csi-controller-sa + namespace: kubevirt-csi-driver +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kubevirt-csi-controller-cr +rules: + - apiGroups: [''] + resources: ['persistentvolumes'] + verbs: ['create', 'delete', 'get', 'list', 'watch', 'update', 'patch'] + - apiGroups: [''] + resources: ['secrets'] + verbs: ['get', 'list'] + - apiGroups: [''] + resources: ['persistentvolumeclaims'] + verbs: ['get', 'list', 'watch', 'update'] + - apiGroups: [""] + resources: ["persistentvolumeclaims/status"] + verbs: ["update", "patch"] + - apiGroups: [''] + resources: ['nodes'] + verbs: ['get', 'list', 'watch'] + - apiGroups: ['storage.k8s.io'] + resources: ['volumeattachments'] + verbs: ['get', 'list', 'watch', 'update', 'patch'] + - apiGroups: ['storage.k8s.io'] + resources: ['storageclasses'] + verbs: ['get', 'list', 'watch'] + - apiGroups: ['csi.storage.k8s.io'] + resources: ['csidrivers'] + verbs: ['get', 'list', 'watch', 'update', 'create'] + - apiGroups: [''] + resources: ['events'] + verbs: ['list', 'watch', 'create', 'update', 'patch'] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotcontents"] + verbs: ["create", "get", "list", "watch", "update", "delete"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots/status"] + verbs: ["update"] + - apiGroups: [ "storage.k8s.io" ] + resources: [ "volumeattachments/status" ] + verbs: [ "get", "list", "watch", "update", "patch" ] + - apiGroups: ["storage.k8s.io"] + resources: ["csinodes"] + verbs: ["get", "list", "watch"] + - apiGroups: ["security.openshift.io"] + resources: ["securitycontextconstraints"] + verbs: ["use"] + resourceNames: ["privileged"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kubevirt-csi-controller-binding +subjects: + - kind: ServiceAccount + name: kubevirt-csi-controller-sa + namespace: kubevirt-csi-driver +roleRef: + kind: ClusterRole + name: kubevirt-csi-controller-cr + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubevirt-csi-node-sa + namespace: kubevirt-csi-driver +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubevirt-csi-snapshot-sa + namespace: kubevirt-csi-driver +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kubevirt-csi-node-cr +rules: + - apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["get", "list", "watch", "update", "create", "delete"] + - apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["csi.storage.k8s.io"] + resources: ["csinodeinfos"] + verbs: ["get", "list", "watch"] + - apiGroups: ["storage.k8s.io"] + resources: ["csinodes"] + verbs: ["get", "list", "watch"] + - apiGroups: ["storage.k8s.io"] + resources: ["volumeattachments"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["storage.k8s.io"] + resources: ["volumeattachments/status"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["list", "watch", "create", "update", "patch"] + - apiGroups: ["security.openshift.io"] + resources: ["securitycontextconstraints"] + verbs: ["use"] + resourceNames: ["privileged"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotclasses"] + verbs: ["list"] + +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: external-snapshotter-runner +rules: + - apiGroups: [""] + resources: ["events"] + verbs: ["list", "watch", "create", "update", "patch"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotcontents"] + verbs: ["create", "get", "list", "watch", "update", "delete", "patch"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshotcontents/status"] + verbs: ["update", "patch"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kubevirt-csi-node-binding +subjects: + - kind: ServiceAccount + name: kubevirt-csi-node-sa + namespace: kubevirt-csi-driver +roleRef: + kind: ClusterRole + name: kubevirt-csi-node-cr + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: csi-snapshotter-role +subjects: + - kind: ServiceAccount + name: kubevirt-csi-snapshot-sa + namespace: kubevirt-csi-driver +roleRef: + kind: ClusterRole + # change the name also here if the ClusterRole gets renamed + name: external-snapshotter-runner + apiGroup: rbac.authorization.k8s.io +--- +kind: DaemonSet +apiVersion: apps/v1 +metadata: + name: kubevirt-csi-node + namespace: kubevirt-csi-driver +spec: + selector: + matchLabels: + app: kubevirt-csi-driver + updateStrategy: + type: RollingUpdate + template: + metadata: + labels: + app: kubevirt-csi-driver + spec: + serviceAccount: kubevirt-csi-node-sa + priorityClassName: system-node-critical + tolerations: + - operator: Exists + containers: + - name: csi-driver + securityContext: + privileged: true + allowPrivilegeEscalation: true + imagePullPolicy: Always + image: quay.io/kubevirt/kubevirt-csi-driver:latest + args: + - "--endpoint=unix:/csi/csi.sock" + - "--node-name=$(KUBE_NODE_NAME)" + - "--run-node-service=true" + - "--run-controller-service=false" + - "--v=5" + env: + - name: KUBE_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + volumeMounts: + - name: kubelet-dir + mountPath: /var/lib/kubelet + mountPropagation: "Bidirectional" + - name: plugin-dir + mountPath: /csi + - name: device-dir + mountPath: /dev + - name: udev + mountPath: /run/udev + ports: + - name: healthz + containerPort: 10300 + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 10 + timeoutSeconds: 3 + periodSeconds: 10 + failureThreshold: 5 + resources: + requests: + memory: 50Mi + cpu: 10m + - name: csi-node-driver-registrar + image: quay.io/openshift/origin-csi-node-driver-registrar:latest + args: + - "--csi-address=$(ADDRESS)" + - "--kubelet-registration-path=$(DRIVER_REG_SOCK_PATH)" + - "--v=5" + lifecycle: + preStop: + exec: + command: ["/bin/sh", "-c", "rm -rf /registration/csi.kubevirt.io-reg.sock /csi/csi.sock"] + env: + - name: ADDRESS + value: /csi/csi.sock + - name: DRIVER_REG_SOCK_PATH + value: /var/lib/kubelet/plugins/csi.kubevirt.io/csi.sock + volumeMounts: + - name: plugin-dir + mountPath: /csi + - name: registration-dir + mountPath: /registration + resources: + requests: + memory: 20Mi + cpu: 5m + - name: csi-liveness-probe + image: quay.io/openshift/origin-csi-livenessprobe:latest + args: + - "--csi-address=/csi/csi.sock" + - "--probe-timeout=3s" + - "--health-port=10300" + volumeMounts: + - name: plugin-dir + mountPath: /csi + resources: + requests: + memory: 20Mi + cpu: 5m + volumes: + - name: kubelet-dir + hostPath: + path: /var/lib/kubelet + type: Directory + - name: plugin-dir + hostPath: + path: /var/lib/kubelet/plugins/csi.kubevirt.io/ + type: DirectoryOrCreate + - name: registration-dir + hostPath: + path: /var/lib/kubelet/plugins_registry/ + type: Directory + - name: device-dir + hostPath: + path: /dev + type: Directory + - name: udev + hostPath: + path: /run/udev +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: driver-config + namespace: kubevirt-csi-driver +data: + infraClusterNamespace: rguske-ocp42 + infraClusterLabels: csi-driver/cluster=rguske-ocp42 +--- +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: kubevirt + annotations: + storageclass.kubernetes.io/is-default-class: "true" +provisioner: csi.kubevirt.io +parameters: + infraStorageClassName: standard + bus: scsi +--- +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: kubevirt-csi-snapclass +driver: csi.kubevirt.io +deletionPolicy: Delete \ No newline at end of file diff --git a/content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md new file mode 100644 index 00000000..76d436d5 --- /dev/null +++ b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md @@ -0,0 +1,558 @@ +--- +title: KubeVirt CSI Driver +linktitle: kubevirt-csi-driver +description: Page for the KubeVirt CSI Driver Installation +tags: ['cnv', 'kubevirt', 'storage', 'ocp-v', 'csi'] +--- + +# KubeVirt CSI Driver Installation + +Official Repository: + +- [KubeVirt CSI Driver](https://github.com/kubevirt/csi-driver) + +???+ Important + + This CSI driver is made for a tenant cluster deployed on top of kubevirt VMs, and enables it to get its persistent data + from the underlying, infrastructure cluster. To avoid confusion, this CSI driver is deployed on the tenant cluster, and does not require kubevirt installation at all. + +## Controller deployment on the Infra-Cluster + +- Create a `Secret` within the tenant-cluster project/namespace which contains the kube config of your tenant-cluster: + +```code +export OCP42PATH='/Users/rguske/dev/openshift/openshift-on-openshift/rguske-ocp42/conf' +``` + +```code +oc create secret generic kvcluster-kubeconfig --from-file=value=$OCP42PATH/rguske-ocp42-kubeconfig +``` + +- Label the virtualized nodes (vms) accordingly so that the CSI Driver can pick up the labels in order to operate: + +```code +for vm in $(oc get vms -o jsonpath='{.items[*].metadata.name}'); do echo ${vm} ; oc label vm/${vm} csi-driver/cluster="rguske-ocp42" ; done +``` + +- Create a `ConfigMap` within the tanant-cluster project which the KubeVirt CSI Controller is using to identify the tenant-cluster name via the label as well as the tenant-cluster namespace: + +```yaml +oc apply -f - < 89m +pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 2Gi RWO Delete Bound rguske-tests/1g-kubevirt-disk kubevirt 12m +``` + +```code +oc get pvc +NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE +1g-kubevirt-disk Bound pvc-c08d2bd3-c43c-4157-82ab-3fa81464bbd0 1Gi RWO kubevirt 43h +``` + +```code +PVC_UID=eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 +``` + +```code +PV=$(oc get pv -o jsonpath='{range .items[?(@.spec.claimRef.uid=="'"$PVC_UID"'")]}{.metadata.name}{"\n"}{end}') +``` + +```code +oc get pv "$PV" -o jsonpath='{.spec.csi.volumeHandle}{"\n"}' +pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 +``` + +```code +NODE=rguske-ocp42-n3 + +oc debug node/$NODE -- chroot /host bash -lc ' + ls -l /dev/disk/by-id | sed -e "s#^#BY-ID: #"; + echo; + lsblk -o NAME,KNAME,TYPE,SIZE,MODEL,SERIAL' +Starting pod/rguske-ocp42-n3-debug-w9xks ... +To use host binaries, run `chroot /host`. Instead, if you need to access host namespaces, run `nsenter -a -t 1`. +ls: cannot access '/dev/disk/by-id': No such file or directory + +NAME KNAME TYPE SIZE MODEL SERIAL +loop0 loop0 loop 5.8M +vda vda disk 120G +├─vda1 vda1 part 1M +├─vda2 vda2 part 127M +├─vda3 vda3 part 384M +└─vda4 vda4 part 119.5G + +Removing debug pod ... +``` + +```code +oc debug node/$NODE -- chroot /host bash -lc ' + echo "== SCSI hosts =="; + ls -l /sys/class/scsi_host 2>/dev/null || echo "NO_SCSI_HOST"; + echo; + echo "== PCI storage controllers =="; + lspci -nn | egrep -i "scsi|storage|virtio" || true; + echo; + echo "== Kernel messages (storage) =="; + dmesg | egrep -i "scsi|virtio|block|sd[a-z]" | tail -n 50 || true; +' +Starting pod/rguske-ocp42-n3-debug-8qwmm ... +To use host binaries, run `chroot /host`. Instead, if you need to access host namespaces, run `nsenter -a -t 1`. +== SCSI hosts == +total 0 +lrwxrwxrwx. 1 root root 0 Feb 17 08:47 host0 -> ../../devices/pci0000:00/0000:00:03.2/0000:0b:00.0/virtio1/host0/scsi_host/host0 +lrwxrwxrwx. 1 root root 0 Feb 17 08:47 host1 -> ../../devices/pci0000:00/0000:00:1f.2/ata1/host1/scsi_host/host1 +lrwxrwxrwx. 1 root root 0 Feb 17 08:47 host2 -> ../../devices/pci0000:00/0000:00:1f.2/ata2/host2/scsi_host/host2 +lrwxrwxrwx. 1 root root 0 Feb 17 08:47 host3 -> ../../devices/pci0000:00/0000:00:1f.2/ata3/host3/scsi_host/host3 +lrwxrwxrwx. 1 root root 0 Feb 17 08:47 host4 -> ../../devices/pci0000:00/0000:00:1f.2/ata4/host4/scsi_host/host4 +lrwxrwxrwx. 1 root root 0 Feb 17 08:47 host5 -> ../../devices/pci0000:00/0000:00:1f.2/ata5/host5/scsi_host/host5 +lrwxrwxrwx. 1 root root 0 Feb 17 08:47 host6 -> ../../devices/pci0000:00/0000:00:1f.2/ata6/host6/scsi_host/host6 + +== PCI storage controllers == +01:00.0 Ethernet controller [0200]: Red Hat, Inc. Virtio 1.0 network device [1af4:1041] (rev 01) +0b:00.0 SCSI storage controller [0100]: Red Hat, Inc. Virtio 1.0 SCSI [1af4:1048] (rev 01) +0c:00.0 Communication controller [0780]: Red Hat, Inc. Virtio 1.0 console [1af4:1043] (rev 01) +0d:00.0 SCSI storage controller [0100]: Red Hat, Inc. Virtio 1.0 block device [1af4:1042] (rev 01) +0e:00.0 Unclassified device [00ff]: Red Hat, Inc. Virtio 1.0 memory balloon [1af4:1045] (rev 01) +0f:00.0 Unclassified device [00ff]: Red Hat, Inc. Virtio 1.0 RNG [1af4:1044] (rev 01) + +== Kernel messages (storage) == +[ 0.020071] ACPI: RSDP 0x00000000000F54A0 000014 (v00 BOCHS ) +[ 0.020078] ACPI: RSDT 0x000000007FFE2E4F 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.020092] ACPI: DSDT 0x000000007FFDF5C0 0033B7 (v01 BOCHS BXPC 00000001 BXPC 00000001) +[ 0.020118] ACPI: Reserving DSDT table memory at [mem 0x7ffdf5c0-0x7ffe2976] +[ 0.333351] x86/mm: Memory block size: 128MB +[ 0.379458] ACPI: Enabled 2 GPEs in block 00 to 3F +[ 0.706086] SCSI subsystem initialized +[ 1.134417] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 246) +[ 2.305506] systemd[1]: Listening on Open-iSCSI iscsid Socket. +[ 2.306895] systemd[1]: Listening on Open-iSCSI iscsiuio Socket. +[ 2.315245] systemd[1]: Check That Initrd Matches Kernel was skipped because of an unmet condition check (ConditionPathIsDirectory=!/usr/lib/modules/5.14.0-570.83.1.el9_6.x86_64). +[ 2.440742] Loading iSCSI transport class v2.0-870. +[ 2.454825] iscsi: registered transport (iser) +[ 2.644810] iscsi: registered transport (tcp) +[ 2.682132] iscsi: registered transport (qla4xxx) +[ 2.682698] QLogic iSCSI HBA Driver +[ 2.694396] libcxgbi:libcxgbi_init_module: Chelsio iSCSI driver library libcxgbi v0.9.1-ko (Apr. 2015) +[ 2.762615] Chelsio T4-T6 iSCSI Driver cxgb4i v0.9.5-ko (Apr. 2015) +[ 2.763228] iscsi: registered transport (cxgb4i) +[ 2.785001] QLogic NetXtreme II iSCSI Driver bnx2i v2.7.10.1 (Jul 16, 2014) +[ 2.785574] iscsi: registered transport (bnx2i) +[ 2.799647] iscsi: registered transport (be2iscsi) +[ 2.800127] In beiscsi_module_init, tt=00000000e3e2ce31 +[ 3.463881] virtio_blk virtio3: 1/0/0 default/read/poll queues +[ 3.466980] virtio_blk virtio3: [vda] 251658240 512-byte logical blocks (129 GB/120 GiB) +[ 3.525550] scsi host0: Virtio SCSI HBA +[ 3.567813] virtio_net virtio0 enp1s0: renamed from eth0 +[ 3.573555] scsi host1: ahci +[ 3.573805] scsi host2: ahci +[ 3.574676] scsi host3: ahci +[ 3.574949] scsi host4: ahci +[ 3.575552] scsi host5: ahci +[ 3.575970] scsi host6: ahci +[ 4.985041] systemd[1]: iscsid.socket: Deactivated successfully. +[ 4.985652] systemd[1]: Closed Open-iSCSI iscsid Socket. +[ 4.998835] systemd[1]: iscsiuio.socket: Deactivated successfully. +[ 4.999420] systemd[1]: Closed Open-iSCSI iscsiuio Socket. +[ 10.150956] virtio_net virtio0 enp1s0: entered promiscuous mode +[ 10.487925] virtio_net virtio0 enp1s0: left promiscuous mode +[ 15.282762] virtio_net virtio0 enp1s0: entered promiscuous mode +[ 15.835818] virtio_net virtio0 enp1s0: left promiscuous mode +[ 15.840535] virtio_net virtio0 enp1s0: entered promiscuous mode + +Removing debug pod ... +``` + +### On the Infra-Cluster + +Check the controller logs `oc logs deploy/kubevirt-csi-controller -f` + +```code +I0218 10:14:27.668076 1 controller.go:241] creating new DataVolume rguske-ocp42/pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 +I0218 10:14:27.686963 1 server.go:126] /csi.v1.Controller/CreateVolume returned with response: {"volume":{"capacity_bytes":2147483648,"volume_context":{"bus":"scsi","serial":"5bcccca9-2b42-4de8-8b62-a1e72ab38b58"},"volume_id":"pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9"}} +I0218 10:15:29.630238 1 server.go:121] /csi.v1.Controller/ControllerPublishVolume called with request: {"node_id":"rguske-ocp42/rguske-ocp42-n3","volume_capability":{"AccessType":{"Mount":{"fs_type":"ext4"}},"access_mode":{"mode":1}},"volume_context":{"bus":"scsi","serial":"5bcccca9-2b42-4de8-8b62-a1e72ab38b58","storage.kubernetes.io/csiProvisionerIdentity":"1771401314268-2085-csi.kubevirt.io"},"volume_id":"pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9"} +I0218 10:15:29.639135 1 controller.go:403] Attaching DataVolume pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 to Node ID rguske-ocp42/rguske-ocp42-n3 +I0218 10:15:29.644847 1 controller.go:430] Start attaching DataVolume pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 to VM rguske-ocp42-n3. Volume name: pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9. Serial: 5bcccca9-2b42-4de8-8b62-a1e72ab38b58. Bus: scsi +E0218 10:17:29.674335 1 controller.go:468] volume pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 failed to be ready in time (2m) in VM rguske-ocp42-n3, client rate limiter Wait returned an error: context deadline exceeded +E0218 10:17:29.674361 1 server.go:124] /csi.v1.Controller/ControllerPublishVolume returned with error: client rate limiter Wait returned an error: context deadline exceeded +``` + +Checking the scsi controller which is used when hot-plugging a PVC: + +```yaml +oc -n rguske-ocp42 get vmi rguske-ocp42-n3 -o yaml | sed -n '1,140p' +apiVersion: kubevirt.io/v1 +kind: VirtualMachineInstance +metadata: + +[...] + +spec: + architecture: amd64 + domain: + cpu: + cores: 1 + maxSockets: 24 + model: IvyBridge-v2 + sockets: 6 + threads: 1 + devices: + disks: + - bootOrder: 1 + disk: + bus: virtio + name: rootdisk + - disk: + bus: scsi + name: pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 + serial: 5bcccca9-2b42-4de8-8b62-a1e72ab38b58 + interfaces: + - bridge: {} + macAddress: 02:06:b6:02:4d:b6 + model: virtio + name: coe-bridge + state: up + rng: {} + +[...] + + volumes: + - dataVolume: + name: rguske-ocp42-n3-rootdisk-mig-62fcqw-mig-ctpb + name: rootdisk + - dataVolume: + hotpluggable: true + name: pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 + name: pvc-eb7ff8dc-ed38-473f-a5ea-4baa4686b0b9 +[...] +``` + +The hotplug disk is attached as `disk.bus: scsi` and the serial is set correctly (5bcccca9-…). + +But inside the guest you never see a second block device (only vda), so the CSI node can’t possibly find /dev/disk/by-id/**. + +```code +NODE=rguske-ocp42-n3 + +oc debug node/$NODE -- chroot /host bash -lc ' + ls -l /dev/disk/by-id | sed -e "s#^#BY-ID: #"; + echo; + lsblk -o NAME,KNAME,TYPE,SIZE,MODEL,SERIAL' +Starting pod/rguske-ocp42-n3-debug-w9xks ... +To use host binaries, run `chroot /host`. Instead, if you need to access host namespaces, run `nsenter -a -t 1`. +ls: cannot access '/dev/disk/by-id': No such file or directory + +NAME KNAME TYPE SIZE MODEL SERIAL +loop0 loop0 loop 5.8M +vda vda disk 120G +├─vda1 vda1 part 1M +├─vda2 vda2 part 127M +├─vda3 vda3 part 384M +└─vda4 vda4 part 119.5G + +Removing debug pod ... +``` + +## StorageClass fixed the Issue + +I changed the StorageClass from `odf-replica-two-block` to `ocs-storagecluster-ceph-rbd-virtualization`. The difference between both sc's were the `volumeBindingMode:`. The working one has `volumeBindingMode: Immediate`. + +```yaml +kind: StorageClass +apiVersion: storage.k8s.io/v1 +metadata: + annotations: + storageclass.kubernetes.io/is-default-class: 'true' +provisioner: csi.kubevirt.io +parameters: + bus: scsi + infraStorageClassName: ocs-storagecluster-ceph-rbd-virtualization +reclaimPolicy: Delete +volumeBindingMode: Immediate +``` + +Deployed the Pod with the PVC accordingly and: + +```code +I0218 11:07:36.353840 1 controller.go:163] Create Volume Request: name:"pvc-846e7c17-7655-41e1-9668-af5241c1aaad" capacity_range:{required_bytes:1073741824} volume_capabilities:{mount:{fs_type:"ext4"} access_mode:{mode:SINGLE_NODE_WRITER}} parameters:{key:"bus" value:"scsi"} parameters:{key:"infraStorageClassName" value:"ocs-storagecluster-ceph-rbd-virtualization"} +I0218 11:07:36.358648 1 controller.go:241] creating new DataVolume rguske-ocp42/pvc-846e7c17-7655-41e1-9668-af5241c1aaad +I0218 11:07:36.378859 1 server.go:126] /csi.v1.Controller/CreateVolume returned with response: {"volume":{"capacity_bytes":1073741824,"volume_context":{"bus":"scsi","serial":"0778c423-7c23-49ec-98a5-957183a31639"},"volume_id":"pvc-846e7c17-7655-41e1-9668-af5241c1aaad"}} +I0218 11:08:27.138455 1 server.go:121] /csi.v1.Controller/ControllerPublishVolume called with request: {"node_id":"rguske-ocp42/rguske-ocp42-n3","volume_capability":{"AccessType":{"Mount":{"fs_type":"ext4"}},"access_mode":{"mode":1}},"volume_context":{"bus":"scsi","serial":"0778c423-7c23-49ec-98a5-957183a31639","storage.kubernetes.io/csiProvisionerIdentity":"1771401314268-2085-csi.kubevirt.io"},"volume_id":"pvc-846e7c17-7655-41e1-9668-af5241c1aaad"} +I0218 11:08:27.149209 1 controller.go:403] Attaching DataVolume pvc-846e7c17-7655-41e1-9668-af5241c1aaad to Node ID rguske-ocp42/rguske-ocp42-n3 +I0218 11:08:27.154702 1 controller.go:430] Start attaching DataVolume pvc-846e7c17-7655-41e1-9668-af5241c1aaad to VM rguske-ocp42-n3. Volume name: pvc-846e7c17-7655-41e1-9668-af5241c1aaad. Serial: 0778c423-7c23-49ec-98a5-957183a31639. Bus: scsi +I0218 11:08:36.187861 1 controller.go:472] Successfully attached volume pvc-846e7c17-7655-41e1-9668-af5241c1aaad to VM rguske-ocp42-n3 +I0218 11:08:36.187881 1 server.go:126] /csi.v1.Controller/ControllerPublishVolume returned with response: {} +``` + +## StorageProfile Adjustments + +Make sure that the `AccessMode` is configured for the `StorageProfile` otherwise, you'll get an error message for the respective `DataVolume` that the `AccessMode` is missing/not specified. + +```yaml +oc get storageprofiles.cdi.kubevirt.io kubevirt-ceph-rbd-virt -oyaml + +apiVersion: cdi.kubevirt.io/v1beta1 +kind: StorageProfile +metadata: + name: kubevirt-ceph-rbd-virt +spec: + claimPropertySets: + - accessModes: + - ReadWriteMany + volumeMode: Block +``` + +## VirtLauncher Pod can't be scheduled + +```code +0/6 nodes are available: 3 node(s) didn't match Pod's node affinity/selector, 3 node(s) had untolerated taint {node-role.kubernetes.io/master: }. preemption: 0/6 nodes are available: 6 Preemption is not helpful for scheduling. +``` + +Check KubeVirt specific labels: + +```code +oc get nodes rguske-ocp42-n1 rguske-ocp42-n2 rguske-ocp42-n3 --show-labels | egrep -o 'kubevirt\.io/schedulable=[^, ]+' || true + +kubevirt.io/schedulable=true +kubevirt.io/schedulable=true +kubevirt.io/schedulable=true +``` + +```code +oc describe pvc rhel-9-ivory-whippet-47-volume + +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Warning UnrecognizedDataSourceKind 3m5s (x5 over 3m5s) volume-data-source-validator The datasource for this PVC does not match any registered VolumePopulator + Normal Provisioning 3m5s (x4 over 3m5s) csi.kubevirt.io_kubevirt-csi-controller-6d7fc974b4-xr4hq_b59c3cb9-66f2-47c1-8f30-2aa3a4e7c7d6 External provisioner is provisioning volume for claim "rguske-tests/rhel-9-ivory-whippet-47-volume" + Normal Provisioning 3m5s (x4 over 3m5s) external-provisioner Assuming an external populator will provision the volume + Normal VolumeSnapshotClassSelected 3m4s (x11 over 3m5s) clone-populator VolumeSnapshotClass selected according to StorageProfile kubevirt-csi-snapclass + Normal ExternalProvisioning 3s (x18 over 3m5s) persistentvolume-controller Waiting for a volume to be created either by the external provisioner 'csi.kubevirt.io' or manually by the system administrator. If volume creation is delayed, please verify that the provisioner is running and correctly registered. +``` + +### VolumeSnapshotContent Error + +???+ warning + + Failed to check and update snapshot content: failed to add VolumeSnapshotBeingCreated annotation on the content snapcontent-4860fa21-076c-49b1-9cbf-5b66407fbe72: "snapshot controller failed to update snapcontent-4860fa21-076c-49b1-9cbf-5b66407fbe72 on API server: VolumeSnapshotContent.snapshot.storage.k8s.io \"snapcontent-4860fa21-076c-49b1-9cbf-5b66407fbe72\" is invalid: spec: Invalid value: \"object\": sourceVolumeMode is required once set"' + +Check whether your CRDs enforce `sourceVolumeMode`: + +```code +oc get crd volumesnapshotcontents.snapshot.storage.k8s.io -o yaml | egrep -n 'sourceVolumeMode|required once set' + +145: - message: volumeHandle is required once set +147: - message: snapshotHandle is required once set +153: sourceVolumeMode: +162: - message: sourceVolumeMode is immutable +235: - message: sourceVolumeMode is required once set +236: rule: '!has(oldSelf.sourceVolumeMode) || has(self.sourceVolumeMode)' +``` + +In Kubernetes snapshots, there are two relevant components: + +- snapshot-controller (cluster-wide) - OpenShift provides this + +```code +oc -n openshift-cluster-storage-operator get deploy +NAME READY UP-TO-DATE AVAILABLE AGE +cluster-storage-operator 1/1 1 1 3d1h +csi-snapshot-controller 2/2 2 2 3d1h +csi-snapshot-controller-operator 1/1 1 1 3d1h +volume-data-source-validator 1/1 1 1 3d1h +``` + +- csi-snapshotter sidecar – runs inside the CSI driver controller deployment in my case, the KubeVirt CSI driver I've installed in the tenant cluster. It watches VolumeSnapshot/VolumeSnapshotContent and performs the CSI snapshot RPCs, and updates VolumeSnapshotContent objects. + +### Solution + +I've deleted the associated CRDs: + +```code +oc delete crd \ + volumesnapshots.snapshot.storage.k8s.io \ + volumesnapshotcontents.snapshot.storage.k8s.io \ + volumesnapshotclasses.snapshot.storage.k8s.io +customresourcedefinition.apiextensions.k8s.io "volumesnapshots.snapshot.storage.k8s.io" deleted +customresourcedefinition.apiextensions.k8s.io "volumesnapshotcontents.snapshot.storage.k8s.io" deleted +customresourcedefinition.apiextensions.k8s.io "volumesnapshotclasses.snapshot.storage.k8s.io" deleted +``` \ No newline at end of file diff --git a/mkdocs.yml b/mkdocs.yml index 2d1c1dd6..05724851 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -282,6 +282,7 @@ nav: - Ansible: kubevirt/ansible/README.md - Networking: kubevirt/networking/index.md - Storage: kubevirt/storage.md + - KubeVirt CSI Driver: kubevirt/kubevirt-csi-driver/kubevirt-csi.md - NFS CSI Driver: kubevirt/nfs-csi-driver.md - Adjust domain.xml: kubevirt/adjust-domain-xml.md From 07eeabca0c236a1daa2b00c456030b9774a35661 Mon Sep 17 00:00:00 2001 From: Robert Guske Date: Wed, 25 Feb 2026 20:31:50 +0100 Subject: [PATCH 3/4] added kubevirt csi driver Closes: #141 Signed-off-by: Robert Guske --- .../daemonset-csi-codeids.yaml | 57 ------------------ .../infra-cluster-serviceaccount.yaml | 2 +- .../kubevirt-csi-driver-complete-tenant.yaml | 2 +- .../__pycache__/sha256_filter.cpython-312.pyc | Bin 0 -> 624 bytes 4 files changed, 2 insertions(+), 59 deletions(-) delete mode 100644 content/kubevirt/kubevirt-csi-driver/daemonset-csi-codeids.yaml create mode 100644 hooks/__pycache__/sha256_filter.cpython-312.pyc diff --git a/content/kubevirt/kubevirt-csi-driver/daemonset-csi-codeids.yaml b/content/kubevirt/kubevirt-csi-driver/daemonset-csi-codeids.yaml deleted file mode 100644 index 17a2ec95..00000000 --- a/content/kubevirt/kubevirt-csi-driver/daemonset-csi-codeids.yaml +++ /dev/null @@ -1,57 +0,0 @@ -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: kubevirt-csi-nodeid-ds - namespace: kubevirt-csi-driver -spec: - selector: - matchLabels: - app: kubevirt-csi-nodeid - template: - metadata: - labels: - app: kubevirt-csi-nodeid - spec: - serviceAccountName: kubevirt-csi-node-sa - initContainers: - - name: set-node-annotation - env: - - name: NODENAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - image: bitnami/kubectl:latest - args: - - annotate - - node - - $(NODENAME) - - cluster.x-k8s.io/cluster-namespace={{ .Values.deployment.driver.infraClusterNamespace }} - resources: - requests: - cpu: 50m - memory: 100Mi - - name: set-node-providerid - image: bitnami/kubectl:latest - env: - - name: NODENAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - args: - - patch - - node - - $(NODENAME) - - --patch - - '{"spec":{"providerID":"kubevirt://$(NODENAME)"}}' - - --type - - merge - resources: - requests: - cpu: 50m - memory: 100Mi - containers: - - name: sleep - image: registry.k8s.io/pause:3.9 - resources: - requests: - cpu: 10m \ No newline at end of file diff --git a/content/kubevirt/kubevirt-csi-driver/infra-cluster-serviceaccount.yaml b/content/kubevirt/kubevirt-csi-driver/infra-cluster-serviceaccount.yaml index 0dfff835..4773f95d 100644 --- a/content/kubevirt/kubevirt-csi-driver/infra-cluster-serviceaccount.yaml +++ b/content/kubevirt/kubevirt-csi-driver/infra-cluster-serviceaccount.yaml @@ -42,4 +42,4 @@ roleRef: name: kubevirt-csi subjects: - kind: ServiceAccount - name: kubevirt-csi \ No newline at end of file + name: kubevirt-csi diff --git a/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml index 4f08af46..23b5e34c 100644 --- a/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml +++ b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml @@ -326,4 +326,4 @@ kind: VolumeSnapshotClass metadata: name: kubevirt-csi-snapclass driver: csi.kubevirt.io -deletionPolicy: Delete \ No newline at end of file +deletionPolicy: Delete diff --git a/hooks/__pycache__/sha256_filter.cpython-312.pyc b/hooks/__pycache__/sha256_filter.cpython-312.pyc new file mode 100644 index 0000000000000000000000000000000000000000..6a9216e161d4d18b845ea569b9fa1b5c9f02da36 GIT binary patch literal 624 zcmZuvJ4*vW5Z=AJT%v~&6+y+qN0Y?krWXGvC>X0 zL|d`;SJ)U*D2ttyR^oM5&R%jB!GZbavES^@4ExmA*NZ@IK5O11*moI3qI8^K1e{Am z5W!`XLqs`2IZRYQrG`!IL((>E++j--164tT0>CBm|ISL$osf^Dj!Kf>B?Lcosv=v8 zcTpgG=%hB0scam@_WZ(J#?(aI&2zWxZ3~^d`Gv)_(4C4+i6eSk=a6_shx;ZL_>jvd zCVo;Dt@>8JTAgE*`W9!l Date: Wed, 25 Feb 2026 20:34:17 +0100 Subject: [PATCH 4/4] added kubevirt csi driver Closes: #141 Signed-off-by: Robert Guske --- .../kubevirt-csi-driver-complete-tenant.yaml | 1 - content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml index 23b5e34c..0cbbbf2c 100644 --- a/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml +++ b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi-driver-complete-tenant.yaml @@ -132,7 +132,6 @@ rules: - apiGroups: ["snapshot.storage.k8s.io"] resources: ["volumesnapshotclasses"] verbs: ["list"] - --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 diff --git a/content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md index 76d436d5..29ffd3cf 100644 --- a/content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md +++ b/content/kubevirt/kubevirt-csi-driver/kubevirt-csi.md @@ -112,7 +112,6 @@ for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}'); do echo ${n - Install the complete CSI Driver: - === "Download" ```bash @@ -555,4 +554,4 @@ oc delete crd \ customresourcedefinition.apiextensions.k8s.io "volumesnapshots.snapshot.storage.k8s.io" deleted customresourcedefinition.apiextensions.k8s.io "volumesnapshotcontents.snapshot.storage.k8s.io" deleted customresourcedefinition.apiextensions.k8s.io "volumesnapshotclasses.snapshot.storage.k8s.io" deleted -``` \ No newline at end of file +```