From 9e7b5a64ae3432c41d32203bb924aff534380e6d Mon Sep 17 00:00:00 2001 From: vbnrh Date: Fri, 3 Apr 2020 01:45:19 +0530 Subject: [PATCH] ceph: Adds design document for admission controller support in rook Adding admission controllers to rook would help in performing custom CRD validations to rook resources. It ensures that the core specifications that reach rook remain valid despite any kind of changes. In case any invalid changes are found, The kubernetes api server would reject the request and an error would be sent back to the user. Signed-off-by: vbnrh --- design/ceph/ac_design.png | Bin 0 -> 17444 bytes design/ceph/ac_dev_design.png | Bin 0 -> 49744 bytes design/ceph/admission-controller.md | 148 ++++++++++++++++++++++++++++ 3 files changed, 148 insertions(+) create mode 100644 design/ceph/ac_design.png create mode 100644 design/ceph/ac_dev_design.png create mode 100644 design/ceph/admission-controller.md diff --git a/design/ceph/ac_design.png b/design/ceph/ac_design.png new file mode 100644 index 0000000000000000000000000000000000000000..2e2c9d7d2f5ab6f5f3632c15a9c566f355f4d694 GIT binary patch literal 17444 zcmeAS@N?(olHy`uVBq!ia0y~yV3uNFU|7h(#=yYfu=Hdl0|VQW64!{5+={f!oKyx? zV`m6U)yN8v*bJn_+atu+N7cw#)yNA1QBqlu3K307Ez3+! z1&JEFsv0||WG1E;CFZIc8Dv5O$k{Z=so2Cg-z8DkJEbZr)vu(q5~SS7ATKc&YDhq0 zda5qiXk%CNu!59OGv9Kz00YCch+uagGgnn3r;?KJ!a_6i(h~PF+E7RU@Zj6NA!H0s@`NqcU^zjT}{t zoYFlrU2;^7oLnnQLrrqc0+PbY0;-HWjq_asRE^w~gpH!{jKbt_Ky z^$s-mQ8jWi^l=JTHFC>VHFC?VD0Z<(H8D~(aw{wG@^{Y7t2DNB$#E>UaPl%Q2+el) z^aza1EAONIn@O@`L{Lb0K(SkenX6-JP_A1Gr73LVoTBF%FPyb8)IywanR3j!-MO9BJkDm*I^gPq-7q9RK@ z%bYD;JtEw4ax;Q0Lkv9%&7w@g^DWX!9n(BL0t3CAyi=UQvXfPfoTBpbLaQP4deVRgIiX3yLy~eKH(#OpSv=oJ%Y+ z@*|v8jhq5KLwv*XP0gIsfOmiWS&wH6`bL2UStvJk?fpj=%H%lmYfn8VC0+Q>+9}mnCuaf?FlMj%7c=eQwtNz z3xdom3WI%ud`Wszy#`NhL+u z#cqj(W@)8~j)f&j<&oiD-k|XD_YTbPDe%fD^9{F1DG2g3$qe)Kv-HaF$#l(j4E6VL z49YYIrDhLHGm{{L%8;PED3A1VNB637XH%E5OrPLHzw%rYGnc3!|HLR`GZ*iYf{-dR zQx{7=cgw`=Fpo&5!XQ;6C!(1x1GhqdGXodn zBJWWDQfEIOi?Eb{0++<_g7m21qP(({v=HYIFJGTx^Qg=uqx_b#%1Wtru_E_~mkTmA(#(N_RH8UUle($IQt#p7TB_DC|7doRxe!XUV)S ztM!|9N@=q%%+6mDGd0lPwX$TES?;Yxfs5T{S{6TRdA9D8l+S|l_xI8cwQw%I?dDqH zZ*)E3;fa;M+)m7SqPhH>j^oDO3F_Z(OxA?7K|wzJ*2EiqFg{VnC@vhm66 z==l5R&FkdIl_wC>cJmfV0Eh1l)68b+ ztNVLbZTH;0^5v}9lK*0{@wfOE))tvu3d-K}{Io_(YEJOv((IM9qrq}3A8t>0ECtrV zx_iTv^;cH>%MIDP^i7LcPRPZ-(IvH+yM6lHqLO@n)JV1(^qcMd_v>}qVP12S-S7A9 z-udAW_ui^k-}nFDdv^1$SF2|ipR+t}^WgyVvs2pZznq%=<-(y>?z8Lb|7LH#U-x@v zyIj?YH=EDfJ(K_c!#!x*s{QV_E00O0&saXM>Qqe4$D^fFLv=6rS-;EB=e?0K*|%xR zO!xoSvLb?NKRlMz-}ywS_(3DPUYN+=|2xmuo{M`MtL^&x!1tXtzq)p9zm=u^`Q7gK zv)tutO}1(NId<=^iP7|>dr#|bpEK3_SkQ|pSN1P_UHr6l-S@}+_GZHBep`~i-%Oux zs=ap0q?@JJW6x?XpOch2Vap*d?Hk>ZT9$2B6sPW4k^khx#4_vG?((%M*W#*kZ>t^i ziBUSgecxBz&xg46pS0S4FLM6AKEGM}b?xuB+s|sPUXvtO_akxhMK@{PFdp;oYj(fe z_3XL*|H`Y6X1v@{hiXy>2ph`O^SxAS(-G)z7= zV}1SK*9T>L-Q_BeO#6HL{=aJvO7{GGHe2?XOVVL2xsGkZ%#%Oa{l0mAneMVzpXF;l zG|oLSul`@9^Zpi($}jnA%T%u(XE}A0SvqG!#hfi)E;5kdd}*#ij~wwyA@Zb z+5GORnwYzGh9Bm zY}U=X-*3;}tA3wb{rXC<|JK#*?;f|lyDu?aeNI7BWbW3hXI?I!pQrx!_q*Na*S*-d ztG8+Y$79lKKmGrG|9@WHkHhk_!s9BBu9KQu`|V~~=uFWA@9Y2nz810f`@L#j_W5-m zyW?-%-}hyye&q4z+3~+;w_DlGp5=0XXJ5Uzp#SA@`+pz%x8-}rZ1mZ$EdOQa`ZaGh9+zABJL{-u_?D;l z3l8(P*&X?4`Rzusb;_4LpU)Y~ymCHgV3rZQwdBi1_u2Y&AG^2hPd_&&vo~z|v3~jd z|GkAjK#9Svpd-U)p3O}uZHuWA9ocI(wpl)z;CyE1^Lg1b|GY`JH)fY9Xy|k^`SJe* z>n4u%+Us^4s`>YM{`T`BzpG0^KkRzF&RBh3#iE}d4)f>6%~LOOv6icTWBB>s@AtFo z|9zf+EwPO~S;zZ7oA8~kCZ|(|Zq~qt_j+{SkQcC|Np=Fx8tYBmd%vC9Vol$`Mm0~ zEB^9|-Y#m3n0?Z~}H-oKb7|K|bwv+4W)EPdomEV502W4Uj*Db?j%&&?xXnI z+;{h?tKH09i@%>SK3}5q<3hPX>YVV|($k`{G^G!&@5y-ZVR8J7^AfM)|Go;(Wtp-m zuKKO%=e_T1&!1E5d8^!Sb4jM|$HTIFJ*POfv+nG0Q!W+X^-VkeXV+Br6lwMuu3~wY zQ}(4^XAr;VqAXSULhshbm&<0~`q{kkYpZ_EL8~V{{aJ0L6Q3tZs~+EHr0;%sdWf)n zxSJx+-DT?YYc5G;NOVj5ktn&m%y;$6j0Y73$Bj>2cQpyvGR5&n)&1JT}yjlFVL*K03y~M(O-Xv(Yrf6xt)RP1qO3KKeNVB>@u)txrEBg~y#EwtfHKwXdeB_XLH_?>v%_qOkl#!gRgZGx7g_h2Q@F zr~K*E@NIp}(Ts-A3@#PKNvNOJ-@oUsRI}rY9*JXoZS9kFBLewzA6G7Fkg8}$rT+bJ7N8P z&*fJOR`9J{BVXI*W26_cq|-{q;?avq_WysLzn1azW`50M>1!L5wTdsgibqB+-YaqJ z#l9Wi5-%9>6@2(9Um20n$hpbs?g^#$oq@;mC63m3%qVwqb6%#hS8&t1jL566Qtue( zMK-*;zJ7k~oVD2-5*U^8@>V>{STMit>+1NMmY`bL;d<3;w&V*8e`w|9_)H zB{2G!s$bF8x2>+HLoa?^Dl1-Oa!Dxr5U4S+@b-}Hd0KYtFu(&#q}4_DH()lzY8OSa#&o!w%iWCJ_@I zJvUBrS#&3LdhE4nXO}cQbU37ORO8r!70)srv?MT0xSv~@{O+mjR#f< zR5~ra@OSo=bxVHDS=<=>@v;2>8&bX!E{F`ZESf>Bh&7x}_#n%0N`b|>k;+FR{&#luQ9B3@tlxixW-0w1T&+1~6 zcRQcUIWKA4^7UGD^kR|YjLgD6-P-0ZZrt4SkWs%U?#Y}ZE%9&P|9Pe)b>(!HX&Ynb z3s&t366R|T96qr1Vy_|3l_<@X^^>10zIWgGn)eqDy%R~Pi{8JGUes+NWuPMDb;u#b zR9g9prBt4@LiBSFomCggEm|z3HmC`%Rp@fPf2GKzqHl$8?g2%WUoAXIF&E8GEPHJ% z;}=$F_$x#DSG&m7+QPSoKOD_)6*H8mjDI4)KI4cJ-=>Z{munpt0>rhizc|FoEq3Mh z)X>kZZ|!z?#LI4O8#HWlP4W1 z3sRc@B{jrNOSaeTrQUOw#it`O5*wdh4UgY?PW+tpIm=BiZ*}XPaV{6!ne12U)5&FY z-FSZZvPDl|7d^b!aL(6XEYOxCd@B8{>Gds%wdn=PcQ!PgW|@2JVuu`C zdHdnWr^=56ZRd1eO7G?pcKqUyQgXj&&f<@6^XqT>J($YX)!C41xF+Y5+!{04vKxtI zht@yKSn$KZrXVY3QBIgqW`4}>MM`HFtLCVMZE;#Q;qU9q;Dm6nzR=0=j6qT1CWC}a zR#KV2PgzQxn0`CE_u$d}Gc|5{J>|>V;jGyLRN!kj$W z#ih|>da+5zs-5?5Olvnh^u*^&x0zwxqUhxvvmRt5Bpm3xnywUISYO`9c8*2+eBg6N z_gQai)~pGaPWBWxQ2DyPzvs$lpA%Jvk8T>B{ISl*#iS$Zfy1MW0}|I%j+q=&;agQ~ z^1|F=mn&z9Lbuinl@jj|^&PviETt}fOL*`&V#9?-TCzR@&S=IFkZr1yGQz*yzxYo-YF*bl{oXaFFM4>d_Jl_2>K$+X9_uLN zbZu5V|DI^?C#d6=7h z##;3g(y4b#F8h8nSBszXq)L|exU6%3uC|1V-mT;LQ|tTPOm4_^IJ+dV%D6XA&F{Hd zR%#N_x^#WVGS~d_TK_kQXE zj0ZYX9aYXKjuosU2mT-ALsqsD5unP@J{oZi3M*W8de;? zsNqz8^>N0Ng}XPXKgsxU=Ggo?H^JUtJ4{2@sVJ`z)ED05EAuO@-e`5=#Un>r5|5~y za*W<~Y(rE#Q`%8^_h!!dq0u59Prq)vSid=5BK0iG2`_=__Q;2-uLR6*3Y|OZnb=q$yf4X*{;xZp41-po}jSx1*>LEG0@@M z{@X(8O?#W{dr_m-H}Uh!R6!9GakE+2Pm;~hZC|m;jq7iewSDTqG1U0**eX-)yLVK~ z5)Lp_|66|PV#3y0y6Snir#wFNP4h|d?A&b|YfnbP0w|y6)SY-5XciA!lL_IRNc))3i{sMzK@ zV+CL5rUV;-t4BDWTvNO!dAH@?!G{M86J`rn@hD%NJ3oQd((m|@t^H;{Eu^M&>pV^n z*qa>4y4PLhX710G%k8y4x4etLZ+3N+_}+68>Zf`ppHK?YtqneV(cxH!m*B)hiZ0;` z<>$y9a&$;Hc)vlF(_QFUpybLsR-w9!0$bjBz0O!r{OLmMR6!nBlbWTm(aZmMntq(@ zsukRm+7qs}Ux|l3Eb~TxXHcJ9!jinO;u%Y3Oql6ldE)3Qh3bZ%|20bL7N3>)SI`xm zo9fNA+H1|fg+FdiYE2H-UgY>gI$12eDKsrzWkXZvK{t;%d;eMJu1VObYb?Rja(6`&u-K@3266+*ZTO_$$mx!Kn`c%c%{l?1{ZTCxjQSf56 zXz9JqPZrLhX70+XW0uMq_mppYBN%(M2>(4cjhF9s_&qCE zxjD>A-Y&a#sB*-1_#FsT*>&)KWgAC&$n`=!rCB%R-0K&HOL%_~O+TC=ebRDfPUO#L z=KF6Jz7AP?v}eb+pB7RlB>aT?OnVB9GURtn*&MnsXwtnE+vn*NxjyOtcueN;zPW+f zc@BPB`Ewsl)A%C%Q=&d+{gXM|6S>8LB4V7~1+FUWI)A@%+W%dZZ0SetT3z+HJN4Sd zgp0cTcdvT5D|g#m)jq8F`Ks*21@U{A7K)A8M}>))~ck{)X$u4RR9(Unm3 zxinR~OC$E1S$Ny(*Ka4hxO=UzeEIe0GL!hYQ(K~L8WvShvZ$wIuvs z(bVnpKK+%*{o-4@|LmhL=J7A0raU_r&*K@kAtF~*Ub{Kaomu&At*?-KOSVX%*A1Zw zM=utXK41{=dv+jyYs=z8T~gW&``%`mxi7vnbJbG4PeIGBzETM}&n0uJy=v#eg|k3T z+q61p>V#t4C|;Fy@x$`-dmr5nox(=U83 zS7KOm?W5zuO%_s9-+H~yI8y7g;#&Kqf}Tfqi-dbK4v0VR&1G-dz}YM0)heG@xb33A zLeE{*_x1*7Ec6fZahbm3Y{!vnld|~SFXnn>ZLZ_@R_On?RyBN1uE*vGp>MgHryskf zw9R-!!vV#FV|#W7nN`0$8}B6d>B$O{<`}`X&(E+#XWqzKDbnV!`*bKr*QMC`%VxC4 zv|b3lYPaa5+1(fIQWuS{+G)g`uJfI=c-J<+!u3|auijjJa-kRB>Y^DvN3N~RaB1GZ zQGQBv=?=$*K7DRmVl!oXcl2{UEIC@M(R+AKq5Q?dzP8^S;_V+hZf!8{w_Pdo=23vE zFz<7Y0*4ymxp!V1*=F(XxB4ZQQ^^Wuzhp!ItFv@XvQ!VBqneTC?z|~@wnN~jCsB$! zv-mrw#B6o97ymoW^<=1&ZRl&|Sr?^WKC;s|!&E-!@2n%{TNfYHWtO;^6R+fTusv=^ z6QA;qOBWL!EiaUjczjJT&(@>Jr0UCyiyOmdezKTz(owBERk{B3uF_ReyR~F_Z=GRW zk?|-&&QDZu7RdP-M`|^Cn?u3QXWL#=pfP2(lShp5iGzB3JY_`l$~)s8&$@E3*WlH| zV>=}#DM{JcUa30&u0SrIT>pFHSF^iQ~sT& zRxQt}buoUGailh&V*lT7-CN@)SE+4Xe6W{Q=FPJNGtR}b$&<2weORZ(-&`EmBwgCk zFkzAm@0@8b-a6hXIdpY_qD=3L#1E&+Lan4~7EZCfe9?t{Lnx2C^1EcGt$Dw1W-gzb zWWVUK4DYF@WxXpVAO2brQ|oEcVD{1UjEN@y!v59s_qOExPU7~Mc`oC_)!;c{_y3-a zu{todo@d=DJKw{0zjD5W&D)ada{Dq*yOZ-2N~FJQlU>%}^ow1X}BS2pdP zlJ9Y4_72u#wJT0-=Si6(9TYLavpC`W_CIbm)5HHyi(My^Ew+A!HNWMP2}eH^SBr*E z5n^0FZP6xyz3aAoikyGiV}g3#rR2VRHrXf2%in5+UkbOo6!_nG;Zv=ad8@t(o?Wq6 z@Vn!~sBhUqE3fpiX@A;N@@0W3yQjgSol{rdy0$Vyd6GSOzU>v*lpam}i{IR_VZScR?IJ2l){ZEyQ;+btKauQGpG*5bCM)B06m zU#9f;8<*KVJ3VChgfA{$)7Q3pYVx}~JFhjCZ0A-yM%XKZ~yv$Rlf8V@d zG+iZp;cM^H?a_-kEFWhqP~Q1pe&*v>f$R9zsweVnc+pfS?t3vhZc@+bEq!jYywzS+ zF0cChDtG;Sn;O z?9+C$9NB-Kh}wN>>X)hgC0G9YWbEWx2ud-VjTQyIZ9b$^bmZoG&m}>YQfpQft2OsG zx_)1|r*NkPXo>z0< z*?W(t&+Ss}`Q8GPjunO8Qo=g&yvf{BotyQ1F5Qup|7(6`=im0+CW+oJx7Y1{m!)3J z_tNO(r-#amq9tl&<`l)3K3gLcXus{#2m3jqc5*EbcYZpheS6ounopj;*9uPG@qV85 z=}5x|vn6G29CCR2ulSeT&5mvDZ>uln7ah5Jewy{XqYTf^)j2J{!w}}ewKik&6Rnck zOo@jMMMuq(r}gXaI%3Y=VW(ssb9C;u`4&@-?~6*AzIMt9hmd(Mg3lc;{LH9giVgymAkh{E*3l9e6{3>?UVLPmp(kbx#!pRGex4Q zPxh@naQ)`ag*`{U2fi@g*WVC#P{1Kwk^7A3nZQCp-d{g99Om0xNU z&DPV|U}(Q_g~yh2FBSCuEyxpdj&ONs&33|SD>Zbw(#kCu}QMLYPsLP#))4% z(2x>3v47>pth4SL40LY3YEwRVjaARaVc*O(JAX7pD;YfaF}E=+_q7O{44Ztkphf@Y zTUo1bu4gH}G5>AbljJ?Fw}tO+3s_yJBsZmzv5V1jri9WKXz&KI=EvBEswos|qZnrb1?Hq|#-W_MLg#Q*q36SJ%;w9j854 zSxTMY?v{wLJfFnLt#2W#Q?Wq$QHj8Lh5j3ifwD(x`sXMZTe#HZOnKq{|KH!-D_aAt zPPm7GXN<(vE`{4on)r6+qTkoI@7vLz;b#BrKIi_H<`Zwj*PJ-&YO=~wN}|wbkxH0oq-9#tv5zks-(B zd~VmP`-^0+XWf~gzbN8FaLlUZ^CvW~SS&bIU4|=fyR%wsiDWwC&FJj4TkW1^B+L<# zd|0`?wEu;4e9W=NgBC|FKHVO3cF$QdYw^KFoK~H#&O&`U7qzzMTKcgcwUl!CoVVxWvAztsK=V^aZaSn% zFKw<#*&_SY>(?oFqfNHKTVh0Gtn`wFRAHc2 z7>nVl8-5N+OJ`h-51TqO#d6PiF^ixp7ZX?uj?0#t{QdRyb;QCHX)$re2WuvD*lqZ9 zV&*~%cjc9J_a=UJQMo1jw|w5Bn2`U|4l20pyD`aS{_&+%zdAM2mo9$zr1QU0xy5R| z!VdnMhbOG*$=L9!r_i%fZ==)EtZ!}7c^To`I;(cJ?3r8rZs)bcG@gyM8#+89WcDw5 zx{{|T^d!^Y4c~5M-_D(tQ<=1}r9}|S7msWX6NK5y`JhF6XB4OeKj<^_o`!I zAKS%5vGhAk$3U|qKjw+FU(qi01LfTPTNlT8#{cwi+m_xnZS|tp-rnx;sh15MW*d`^ zZ`0&)$a5?1V>>1$Z-;Bs695#Ay-2cJXeCI*WYQT)S6%-d6VZvY6`|Yr9U0CHL5#_t_v(`bPCxr3^3M z!=eeZm^Z$u?=Lo4xA$ArZ`bs5*&B|sEbh_eeN)*}Y_el#tLMyJ2LED`q**TV=!GfF zI{47LhoR?mMs-2b9mg{!Ur%2=k^f@(YjWp=`;^7EBzaTj>DIlu_?*G=x!0Z2J%K-;oe^NK`5C3t zdE0A3=5|{H`>v0w;tTaxUA?!W>aj5$9$#?g-#VRb!&Sb$N2l35={m7druUPj z)E19lTJgGJTkdJ>+PCG)lZ+***ILd`59H|15RP^=_-1fwap%dBJ39)?HXW%rv?1M_ zDcawn;(W@vvo>o4j2nv-Y|dTmxM$V+@pzcVy83k{JS*?Jn#^di)ag@vDKy!9^|3jB z51deb)x>6-eYd4bUtEnXq_#}#c6=cCx6JL%QF5EJj+vPz zUZ1w@r0e(mi(jXT)pVP!3H*C|MOE|`Y47h*y|3=OU5(zwmvNCz^zMGw>(jU0Mg-^S z8_U$*+`448^95+_z@?`Ai*2T>>ZL>TyUUVa#;pb$<9(e`_tpYP(k+`U)4S!!tPekp zxDq9AUulVrzNID(GBrHvgYK;jZeQ~kzskLsr*k(OV$4gc1+LN|;H3q(@+Kpaee&#C z8?wD`KLMNS#l6o}`Wkqpf$pu|rPXV}#^}bfZ^>xxdUt=(Ywz2+*Dk)excIozyS?wO zt`5KTr)u95mK}fF_)ndkYrQ>0_o-FD$(WV9R3eh46pJS=4G*u2MyO* zhGgk7)htgu)WUgfg?{j%pA*kaUFm*k>r(KNj_dWQ+A9S=J(2KOcS?=-;VtEzT*re{ zYn>Jd7KNtSKCLK;+LCcm>D|F+hXZQnMyxdD_>j0R@9wUdn!(Gad}>uGUixO5PjA+e zGoJH|N@F#R&4cF22%HSnbX5*stP(!+gJv;LquZ%a$*&<(+DlCyxH+evot0|;R}PEOM9Kd1dsdD3d3azA17wK+vsGi*hV zCmXsi?))9?E6yk=(0GUQ%zXR%Jd#F7Vv0_xru}?6{ruj2VXGbfM6GrIYL}|Apm5sS z@FV)t`%m2|GCA}qBvVO&N!KUg%nZY{M@Kr-o}8GN_UFe(-9O8I?wR%D>EY0&T@F(k zjzyYP3hdAM^CY9?>GDf14lK7?7*@x$wAuf7z@4WL`Yt_U1A0ItG@8#d+u$RT;+$+`Z z`)eLe?~RYib2a(&a8;1214~qgL&?nzgvD5w45e;{oZAprA$*C z{zTO@y!h(n=`2Xeb7SMPE5ZJzhuith=USB- z)jTix^yFmPmlqe)?(8W1CZ@IY70VI-Ns3HAg)dl~J{Iw3)5pn+C(7G{O-N&zv-o1# zdf7LnNA)GVL{*qJvY4FP#M%BM^|AQbwHe|Ui(|hL^bvN)c_8QB3 zeLN3xPLau>kHMZw3QW0f4#EN3_{8_;{FxHXQp1rk=V!pA#S?oc#pk)2{IPhcDJZ}w zxPir_F99?&18SkkoOiCBnSWFmGU#FlL<7%=g@Y88s_rv{@=LsC= z+QOl+XyR%f5C7J~+Jn@LCvUgiK6j_|dhAWEz&t^L##t;&mT%(h_!44PcM+6HHim%1 z*ug=#Vw;~Bau|2jyMbd=uy4MX5Tjs*G1IJuO{F`2q&{ALN9lpH!{amUlVo~xru-?= zUIY(f)die3vlT$`cS@JZj>Y6$jmF7~C)`fzZ@V^STev}EGwZ$<>uucRC^#|ey6plSG}ro2}XdZO`mXe%;v1eG)B zi5TId6BjuYn2j2k96|(@CO9}e)|uS_3Q4qh3P6jeAQxq6)%|yh;CUgyMY)0J1OpdC zple5ilGM&q4PQbm_7s^MLd5l`8KdDbnm(X)$7p^TuH{FgnW{nIBNyYcHxb3JRxY3Q z@Nm1dd87Y4o0~mywzqnu&Cm77SZ?xtsj`3D4^`t!!b%gSf|`R(pvKqQJ4Gg+l2=ax zHNF}S{Q3FW_xroMXM?u2&+kDAOd*=6h)#r6$c3k*Z{qyPc{6_P$&qa^u z%dgW4WmyDjVVrFKk@{HOUD>`)D-zt?>5()(<}=IWq)xzBXJ z#FAl+=KdFX`s>8(`8}#!Sd4@& zSe#}H09V`-`R%7_F)3Y8V_CF1wkvJP`;w2|=Y1?)6m%JTH*Yy2Rv-6g)5q1*q6K?D z_=GOv=y2c`>R4B%Icws+=A-(y#!m$rx3HL;yCf9-rxMg4f;U@xIX2un`c~zR(bCP5 zFRkPLTrv*k6ZG(Qc&wwl(cj&4$@9&IJ*|j8ZywKAGfQVz#(%pV)q@ z1)AL)OF+$ap@^f8L7q&_vy@7#TxB9C(8wk<18GNs?TWjvI+;~sL^s@L*n5xYa%zlnY#J!@9*Y& ztG;S2x#t%4>CUugn);{w?=(vGQw?s;j zN!NlkRxS=KMXCpue7+W)KXdi^eOA}2PR0CqaIo2Td){3mOX)`$J{*0i(}cIKEo3p- zcc@3dkmvBm6%!TQ7i(Nv<<8=wAkNfs-n~~U_1T%3lf8eQ4as1!91574*?2d#nLZb}Wm{<1+WF(x>-GM8t2(o&$_ueef!awJt`G*Zh{6-)x= zUfz86fODUlvFDUqT1-kGG?~sW$mo8v4J5t(M7j1Ry^k7`%3fbrt(>%YV*3>H=9rTg zPb_{Ox{Ra4A(3U4<3%yH!xF*z{Z*euf9APfQjg#b~kXaC@ko7 z*KTDz@*>#PW8J3(xAvua&0Dhk(}aK6%u9)|6g_Ux7BI1P?XFqv4adS~d{pgAv=Fl_ zdXgdH8C}}hz`>%vpi}+K5#_!_3pVir(Hla@fv$=ObVgsBL^ZiWp2LPa8de{erm*0n zXj)BYvP7RNpO&SR>!q+*B?YE~oEeWejX!oIOY|LNjbYu!!q~gs;IX&N;R2nafRh(B zCT)8q#3;z&=OFAqqtjjHZ~>3r1Fa3J92qsOlJTIVIF4J?YZZ?(*jx2=Q|b9RmX~ujpEY~-bb7qm z>NT6X{@#u)znl8)etrGtN8S3zw&j1nTW$_YfagP(?W_GgEAeof?zh{E`|Yx}-7Sm$ z{A_mqwZG@I*KBB-X`J2{S^M?s-qS0}mBfxen|)w!s}sN39Hh`xKnl$XDG~YGZl*mu zq1A zw~EJQ{C9JCG{Ko~-GEdUe`UD z=zd1XTPN|`-SYU~I+{`!E#B>Td?vZyHZ5=8&$Qn$FSBe~!7`~CX;k$F3xz6o0i>fwPFf?vD%VCL@k`)=!Oy%Lnxt-H-Y zg55&hv+tPc^_XNepBV}7_I{7Myfr&~_tCDm0icZxcZ;@WTvRGP$SOW#`~AAx)2g4% zOrQ1d@9%O8sqc5o=hsfljo-35%k2(<>4y@VnsLM?1!x`iAGd7>II(?_?c5d3BVIH zkWV+^vv|O8dAYxQ@s&XLoA*1rKy|pA;kAfl-r~o-=2F|#CKklqtN&m7I!EB*jz6DH zpFJ^Ad2KUju1z(_8{&!17hfAVjtF^3O_z$VJEYuKWb#MF6+AfLpuprQ%zsrt_D1n} z+q1>zZPR&3aF+zk+{kjQLg;(v6-{EK(Mz{SpC)u#x|SinR4}i3X2bMsz;g9=jXFG)926KQQFmU?3i?Zj$5x(>gRJa z3=j9nT3@sI^Wm`BqQb+x<~MYMRTgQwIAy5!9rHE6o1(YxN7CiJ)#cR^WUD;p|I!oyWQXB9G&E?m${hJ z`rVGjd!Kzp}dVBS^d)4`%{Zcn~@!5U}aDLKaES10KW1H^us_pmde)kzm zZQ*rqeZd+2?3$OI&8t$ABZdnetXi>6>4CAH>Ap#>PBKq3RJ=Rq34jI{8(3=8op1#SLP zo1K$%KK#KP0Y=OJe?GrG_(8>8x$3nD`~J=zfw>W7H&fRZA8afre|_a3yL`_1lnINr z`#oggmAAX&mR8X8Xp(;asXzOE9x+_-VbzLliVHr99&-=_wL)YnZdrxGinxaNM}+r0 znj{thsw}69I6q74bWdy1QgCwkBmz@E2dT`za6~xmk>GIynP%=CTsfSeRC8=PxZqqc z2~lu1sLeAF?zd=rC=qiYG{IZo!VfOveMby=jw`WGmFZQ=T&*W4(D;DG* z;S8xgMq5~s>g)?hb#}sq1&(P48W_`FTv&MUblx_m<$iOsmif=mTett;FQQCfI9zpQ zMPS;wIhJ7k)!*Ocg34{#^;=mcACP%%i+GmT@7+CBFZw%|2wszmKmIo2#>>A15!ti)r#5P-|cag_xIYEKO7*2zq zXAoO<_v@a^DVUaUtVc5K(h|>Q`SeU^!j?=gkHV-3e=AJvcaP5 f;f!+4|Lh)8zj}_Ph=npRFfe$!`njxgN@xNAiNDXF literal 0 HcmV?d00001 diff --git a/design/ceph/ac_dev_design.png b/design/ceph/ac_dev_design.png new file mode 100644 index 0000000000000000000000000000000000000000..0bc409531ac6342612603a7e20601d5d53912136 GIT binary patch literal 49744 zcmeAS@N?(olHy`uVBq!ia0y~yV4B0gz~suo#=yW(P^Ip~z`(h<#5JNMw<0YwCzV0f z*crl7H8RM^FD_9vc2PAlN-QYQOUX=3FG|cU*2_yRQ8hABH8RM}PsvQnOih8PF)}bR z&^0j8H8cq^G*C5mGy)N(hI)pkMo|#;iRr0%PyVG*yiZ9199^Qo~b|yfaHwjoeI)&Gn4UKw7*#LVSHxjht1D401BFQ&o)& z+*6aY^FdmiGm7$aQ&o-J%q{c`^o%VHO!N#5EL4pQf)mpci!zan0l7Z4BrzT0a$}EB zv;4sDoWkT_AK$9{^pvdpT!@RyQj3Z+^Yb9e42|?G^$d+5G9{G-sSx4x{QUHsRFJ5# ztE#axG?-M43^Jhs6POzM1xYpTw{~+k}M~$tkAIRYy&q{BPUfO zx9m*Av?%A&&`{^(as#8#NY4tx6dx~DBe$|NKTp#NRU@~M^i-b+%fJ9*LyLk!S8sn4 zCr`^NBNOjHk97Z%L{%d<=X}>v!;19W0<);#N^kGL%G@F+mjDZo(A*5q#Ly%UZ?90Z zpq$h~3vWj+$87IhXP+wX;D~_4qGY$slyLK+G6T<&z~HKKPgNtgB!fZ=lPKSk zWV3X4_U^^O0UQqPm|)bkl?I>;F7Q`!_r`{Y@dh-<8-I2 zq~Opb6L*8C(5ghwlBhCOBPUOj2*V`9Qqv-zDF2c?m)s(A_n@4>AkSQ{st~7uyrAIX zLRTlFvH;(#!r;u1$^ci(vXCl^JX2>63^-fC<^z%5>BGzxG}G|e+BurNqAhzu$7Hp?|gE-p`V zugD7Va;uC;b15yT2n-0TF!wAeHHxTkH1{j9a1A%E$_dN&FHOq|H4HT@3ro)NE;g(( zG0ZCTa8)&O3iHf$G4l*dO)ge7a`N&nPAyLiPxH*LNXrb)EDUhWOv|mx@=wfk^KlCf z3<<9?arX!d&j>UwG)|B7_4Raecg!`fsH$`=t?&-2DmV1+;2{X>kaB;6R$uO$S zcF)RoGO-Mb%JRx`%`d4)b4fI*bTKpZkBqFyDh`Sa$|x-MtSAmQDG&CmG|#B=F|I7j z_x3IcEpoL8b1w)rcg{-m4|2>XG>Hgw@eTDUj&iFojBqw{4EHV0@rg(`E6z76b&PUU zHFERGjVdfE3=K{5_H-^Z$n$dY$c{*LG)c7E&>g`qxa0e;Eu1?J&CY57Lwi8nqKrhckMPRT)ONtscmks;oexh1B4X;qeaW$yW^MovL~X(oZ8Wo|B(1)xg6x!kWR z*(s?!FwH4A%)lbsAjLN#%P-SEvmo27*xcN=+!B=AEh1uSJ zZbX2osexNqT2io2WwDuys*zK8XjpcdlZBUyhqrNohha{JNujEdTScNpm4$_ef1ah2 zzjv@}X+&vOK(S@9TZnT}Nq|qfvtLS>fvS;{X;e;-Yhsd-v4?9}ut{cVkV|B!s*zh_ zeyXFPb5&qTlw-PSWsY-{Pg+%OSiY%wfKR%2u4j%(lvBE2ly9nkZbXSeriD>*da`9v zZdz24s*zi=VOdU2psJCZpI32qxk+$}SEg&0X|Ae~Tdq%XN|af8iivYoQb=-eK~PaZ zTB);TzL9T$k%_sbM?t2aL1~_dpmCsgd61=tMWA1> zlXF#6Sz1bYM38@eZdF8TXs}^gW^ssfm8y|bl2Z|+f=dY~3Np`2Eq8NDNwP?bGBGYF z3d;9aHFAoy3{*98GRrhCb5A$Qstopz@X0arNJ}#duku$law`s3HFC4ev?$5VGz-kk zOf$DoHFAsa39>B8$#JxZDm1h(O0n=Qs_>7f^vW=+GIY!|G)b&sl$;uA1D0Mb9FHb2fG0zLBbaipJ$cii}DJd&6 z^DR&{a?7jCF7;A1a!Lmmux>@3>0zlwX_ZMiemNjVm6ex(Tv+Z4YE2kBs~Wk%S`gso z1So*PEi+YP*LpD_Q3eJD22U5qkczlBbJ_3oKK*}u|IO<4JwaL_-&S~db7*=hd1A$|d z_TF9g_R*T{Z}>PTFmP7PK9DNnm(MQ{?ari<(0AbZ{CYiEtC9&`Q?)!VFY{gMHC1bp zb$Q;+?fLU{;`T(S`OVQdJzal#;^DTFd%xeyURPk}3$jopp_8HYvXEJt5~I)urAAI+ zHILul-lpE!Q5dv7Ztn))Ikwf?O!Du=+^c%6n|W=`O!3`^%qB8$PH>13Tu^ZAYQZLB zl?gjo>VCac*Nok@MJH;D$KqL6!`5oOzP5I9&{D6ZUo7m^8HE%Wg*uuTT8+6X z&Ui7YJdkDLl{O2x_~y#W;3K_KHWeHEHrIbTsV?~ZVY7+@$Ysws11!!OC-Vs@F!l@n zcs{>=NzTnpo9h49UDiE4ReSoH$jxr+c0A&`TsgCm#iN16L&1ni2O_5RPgBYXV z%Ia*J8&V(-a;P~xd}8g$r1GGe>5j>h--;>h9t|vy<}kDxpJShKSGmze@j&uKq0}We z{e=`5?S&Q;{3^V1BTY!5(VOGLgYtbMAk!bjGKu)T@8gYjV^T?&#ISyw31?6LWCqR& z4bC7pG^UxVI53?PI8ZqUDZamcTX<(@@#%fFzrTbn>=af%_37#9)EgTTtNy78gObYx zhc}!77Rl#lm`-5e+~GhVmBnNTu2x|bQfNG)>hRF#&c^ifo(hQ^F=aPXi~jxj+454~ z+6xp#amo%4zufBBV5{Q5v`u(H!L7b2tdl?v)npR!3*Pa=fOA5FJZFH#UyH09W6lW< zHlQ?fIb)N)iUX4(XMn}eqzNF^yIC~my!({?R>gryP^jYT)$pa^>*ECNa_=Xv*qnZT z-Z#+`lfV(o$QfWETyWuLs*r~XQ%`}~t&Yw6RUDY8?+QMF1qD_NGebeHb1-7jm{Vg5 zipF^it;X-#XUM8B3VpC(oF+WaLVh;n&;k#-viv$j~}Dp9vHzJG>hXz0|9}=EtP+fPs-~IrD@_R*<-g zbHkyN*PB^96y9+LSUj%lxakPW2Eq#ps%jc;*a#^!zTgb7Se$-B2plj{Od{tpUKr|g zPH52Q2(YL%^vO}-oZuiMyrAIN#|N9TRUDYaIRY$xs)0PzfE3)gJnFEf<@1M!hmESf zWW2nyv-pm23cDvLi=kL_LwAnA*?qOYPtDHXr@1nC`LxH!`+qkvOM8NnMxNk;f?clj zzD{D`v~WA1_t3T>`2+osH)>CwQFw#ecYwZ>E~~R9lEqw$>CuSm%Q<02F{AP3@O5wIB&L; zM0q|`nzOU$>7?4<-y$_9ReChAE(4VEoRxCGT#O zbmQD7YooSavhSBNJympgN84p1t2C9y8K9)ivvw_Outo0ClZQMSSoSzEOzMp9$dbyo z5PaKGA@wP9>)Ja@^QOvtp4jl0MPtr4<6hTJk#i9NsWVj^nAQn##BI;yST6h8lG*xL zu|=$GT9_Y`SHq!~{o;*>UiKFzX?r%X_y}j^$g&>g5}S+i!liSnGVQ_mlO3RL%oLoem3jZK3s&R%%585Ezw8-yB7 zl;^xyaFb)z>wp^!LLLbqPx08nUF@>)*rhcEOlH@MKTTC;tQS~N@GE(a#+-i=>f0u< z2+eaa33S&!#Q7j>(MnGH02T)(KH&ugRy=o-N=5v-AI#`w@i-94w72T(q^hs4JX^U$ zeZq4>EjG?8{`Tf((=Jfz-{aYE=;hf$&OA|sm5v8i6}SbeZU$vbmxeZURdD9 zIpL;f1Ir%&hC?s^8YXdj9?)XsS{_<-?%Co3tJAZ$P6SmM4ToMbm4taR@d+*{uwt<~ zm8CH!kSV21NP+P^s9dV=x#1+V!K>j==F~Zxe`?G*_X!+wdIAdyb}`Hiodm7C`Zh^% zrB7j)IhV!bz;94GkXPO|fn|-*f`Ta3=Q(y<%Qx?dlm-=n;G(LRMPrWHp`OG*k#iD< zQZIsPM{o_kQPtsLk8b>KujK`|Tqix9z`!{}so?e6?WZ=So>mE66*5b|_Scu7l|ibN zzu#_OnsRc|vQu0&7VdpAo9g~nX~yg*xM6f_Yqq+iQOX3zX13TbJ{K3crXFhHY}#fx zk%99^GXp5ZTpoToZn1Hyiaa%TlOefd1M{NBWzo10Gl`}=#T?`$)zWgQdjKAlkhr4zKEVBeQZ-kb97 zTK#;p`TQiMl@)4}IMf%-U+mU9srdOh&qgNJCyV>-Caqq-FUl?onhyVKWa`J)2r`JtxC}z=^b8chbGBvJrlP@!- zvv?dZYD{=&Q}$*?$@_b;1@%7g! za>ZWSH>G8>Q!7`{h6Kl#*VoUt`EtP-)Ns~)Jiq?m#MkTh$KB3aW9#}v^kRUEx&8k? z#WStT*Qv^#abZ$P=w)cVEM>mDIM8CQ+PPmI4J=a}3R;8%y?jFLzg`LcRk=25>ypC9 z$1W{$<^F5EsFUC3LqpEpU7_X@xp#I1uG{rW>u=731C5)?-bUU1!2Hm~MP%Yh)9h;= z$9g3774Pk)i{1NA zotUUx+EsgUlB!YRBbPo(6%Sc0i=XxE`T1JsVhbggLfmas>MN1b%;aH+q@h z+*N{ZYmOcfbmO=GvmsBT>h0F+CAz9*P04qkG%~ZB@GDIyzgrr9Ny^W~QgKa(#l6Dg zvf^8dKR-Jgw5udj(lDvTBhT=y-|s zvY)d}GL@>oy_v`-Yn5>~;<@L;Eq|;GlsO~R93F1zId`!~#LvBOvyqSjW3z+C!#m}*kCGP(Ie?)JOOE}l9w(|C1C(&Gsmy=A24Xf1nfXgc4vy6o;uzLhQ_qQUQ{$Jg!bku-L@o}Vh-m?si&vu z?&{kdyxi}Wn487VyvYsLpcZj~d9-%xWgSC1e^7%8RQ5fPWD@Z^&*Qp@cOj^*xZwqA z6)Aw)=>jYobN*H6!fFpttFVE^qv6oY+vOl)Ve(;6xujZfGj;k)$B#ZL4on~28wCC8 zdo)2M9k`Blacnpw$!e3P%GeJo&ubd~Wy|4~1lgppZ4!%zLKTz9xfha~ScE=+DvfaW zXOGGZ;SH8W3Jwo@nB+E3YBV_D_jl`)(R_Yx?&SJ^Ki!L-oOn1>Ox~iv;nVZ;`jgdsC$;fPS1pVEcu#;UeNVr^ z@98H%Q6NzZX@>bI9_s9Pc4?{irVu^=f=7j}~d%oSu{#A2pOXkya*6&4JROVN`(!9B& zaPbtK$e^lkZ!|$Qzx}@-&bPK?E-rm?db)obzr5bo?CaOecq9xQ{_jgaFV~yGCvE1_ zC8oQoRN`f;c-#dIonUw`upt`c`-$e^`mL8`^zGg{GIbQhRlnV8lzgmb35PmM;o&yk zO{u5FEK6TaspG4Bb9s6HmW+!|pPrml{`~ChWKLnV6N~%pw9d{ppZ@#({&=gB7Yi!) z{d^{^t39W{$?EiUef{6x-%t0q`{|;*YJT0Xl{vS!`MzEovT_orm=9X)##{Mv>GUTj zCMs_#c<2PmxFv6H1pfN|ULRCGIkj?CPRRIU+IdK_KKYc~#0E!DL%1B;5DxArU|aX_ z$l@8>}u620U)m2N2ZfwhqzPUAf`l)VP ziQUg9lZ`4rrOcH&Kht>mo=>N=twj4c(tmw<2^uE)^lWziDwia#eQ9TBNwL;GndrWx z;^U)B>te0vwwVhpTJnQ+rEApAqNQKn-HlE=KTp@X{2i#`Ha_(7&~K-QC5%?9RT$ej z0xV>iWK&H=&S@|j?f%Wu)GC}*{`G43>-Af+ub=9ZwSF=yd)>s{@ApM-2uy!-W8d0&Eq;0VxA&ueOqzP3?==D4GT``ED^rw?Q`1MOVCg^cv+8|si0`=o{Ej@ z6pzljaCLQfcIArayI!xmtXX?ybM^N;(SR+?fe|@5k1l$g+hZ@{mu|6HOsD|VgyVhn z?Ddj@S?R}Q^ec1E)otn>gjX9jgSKeeWfkuLoFKB`r|Cbb*MEu$vtYdgvFDE`&)5jvC;_$FU zpiCq*&|-1J@iiaa8$j8jOD@pjadFH|Z6VOef&D#ZNXesuJj^Di?(p!-4~DN%{Ief$L-cJZzW$V&nN{!!h&6mzH{;KCQohjrm7~#OLJ?-rDZa zWIxXQ@Lm3!O~)3#)KCvOG;{Lzd)4`u+;52f`~7}@_Rk$h(_dd(D}Gl~E`sgVLB}_m zQ*-BZcHX^b!M{20?ygJwZk5ON z>f++|dqN^JE|lF-Df#!OGIB#gYyshQfInJ7pP_o4p|Fo40FjH0c8}encMGGt-d#b z`QfRF%I!Wgja<*KZgFwkq~N%-`1!SB&4~qHmDjb{l)sxZFPO8jMdINxS($ZmGo(y1 z7NjRAIsPbkUh(zS)yeN9kMDgnL21eReZT!&1>J=mWeSV=`J(+-<~-h^v_;aK!&PaH zTXes?z24(vy_4<#{|N?F8!LmC`>k4E_V(7M%Fk(2JvhvtNX8ortvh|BKF{J6M=pzS zOm?Qnjo>(ZqL41 z{q4=g-TMpID$nzMm*edrmBN*jGRISLUE|$drISBCKA!!B@6hkd{`Q$mu6VTBu)00& z(TFKZb)HgKVa=D+A7a6Lx;aA8s#8OM(Z++dpt?`)P2XnAi)qSti%#nnT@4L?Y5Qu& z*^J-c-fFFJbBYu&@>r`Fv+$S18Sd?J4=t8?+?o_rd9qfHGkS~eo#KVR#BWRobq^M= z+Oe1O``K#MK#RRbLOJZ5H~bq8W!hhknBwuUhc&c+YUhb7S5^jp6)1|iK11DKZf{-T zE!(OeIYY%$I|@95MbENJTTep}8>rTYJWw|m{X>~FvJQl`qC&_2y{WksQm%wOB@ z*F_7k9{xNdtl!0AvbMDOmn$m*o!|R!SDLdrY^{(F^WzO=9f2B^ZdX2@*57|+U$gkH z+NV>)PaT)9*HQJFav_!D*p@1lLq8w3%d2tP%{wmp`sb&o!8eb;x2Tbu_+rYfCJim6 zWe-nvyI2HEZJ*L2?9^9&(&It%%lbQ>^G&nEddn8gjq?=oTi?TS+mY!TXkhldiI{4T zMY7}7DLn1*G4bbbuJN_xT}?0TupmUW46V|gnxg2vId{>on^wgyUn=z+nb^f z4;*!`Pq1={5WIUtD#(RfaqUEo^n%Adn*?oJu7Fyww}n;~NKI<}6XD+77K*VD0ygO5>c5K@Ck#lx%f&NZK^NzA4tLq*S)m@tJ4#FW3EPU~Mk z>zUB<+F0?`#4Sf}h={D)!y2HaQvY9?yOA3y$tlrLb)WpE-W5Qjfpv7*zCFUk6T(c`Dl)b;V z)~Kblp0>*Z7Hj;Es4euk#^mIn5GvrW!tvIb-&Q5!dZy3n=*YvCSywbNudkb% z@L5nPb4Ht8^|v*7-wrNQexq=_#8PS31YZulmP-?K*6eh-ZJ;afx32Er&-B>Ckvof0 zBllEn%$w4*CAn97*{z8IdEejN)t?o%eN&t8qwcRO?$`gX^;mZ>_v0rizk-9i5AEpo#0%Qx7ytJA{<7J#Hwpd@a9mB{}C%V+$Mi^K)~pL!&-s zzrD3}*KeCUennGyGxKWXEUtF_S{1fd>-YEf{_7m4558|MWE7)o&CwCwxC5?62ax zT3vn4!m_E!;pS#H6`ZH$)U_E?VBC6!`7@2%ARwW^P($@=p)`rLm?H>%ioS|sVX`o zxynA`aOVl_8IMjZd{AuUyj68)vBk#Q^?!eTRlHu2G&ke@y}grV&F5^E>MUq`#eMBq z6YsU_k3<^z?S340h@MQ?#s`PDW5$Lw1W*b0T~Jz!fs+vo)dT=ISe+@@?!rpP&)-Y`060S zqJbjWap+|~BY1p#5oqLXo}#w`<9eY51y!XfdU@i?;6@dwr^>}7a!%ucp*Cm59ER4* zkC~5fEVpOt01uhZV`w!7PvPtV4Y^;PnAmbzUimO+==p|Q!=X%RFEJOUd7we(I}=)R z1eRZc4WXkuWf;4&AlM>&O@!i9tO4H`6kX3P+3gdp`S#?)&`w{OSDtf7OzY^#r~I4V+GXdm1#ueRFgA_4KvN zxStM%zk5^X ze3MB?p>YMsC-dumWj2;5{r&ZN{ih4g{3o|wkJHu;UpK|y{%?p}%?HQIpHHVhUAOz) zq~Gs$`_Hd^xpcao(77k`4sZEu|Nqb8MOMYnd@BF{{hs>pQ0pYUSS!)9ZoN{R7Aa?E zg}!z@vekdS9cYa5nz%t_!C5>HMnY`V2N zT%T+C|NopD*i{^u@`PSoTRWRa&L+ZduGQ2lJTA;urLR=}{`y+HIdjcy7LNmNOmPC| z*m$KtV;HM0zp$T_xt_c|Ni`ZI?-KjV!!>rh{dyJlo|?Mi)Z6X-vO#b)sJ?IPyhDz_Um)y zE*8i8<@Imqw0LACv|OIxvF7#>Hzj3Jtq_lSHJ?0Z+Ef+=wFn3QiHJL*`Sr)&?FZ+9 z#$jC)3{IVVvCR2GBrm6h&jIg4o$Knq-Av!*CiL3MaH(zXEtA;fPL9WS%kQrZzIo$J z^UIG84|%@Jq-C9&uCE`xJ#Q+gk+<*HEA7hXbIVJL1(fFhaFlw=D{B=38rHt+(Nd*w zFyiyh+}mb9A9d@Od=5B0P4{c~-Cd=j2^;mM9D4bI`}8Z129`(t4hd5xUp)ImI{sS+ zi^GBJL!D-c%I8;wt}f}4&DJ%PwadDqadUV1`jC}DuKm7RQCnWP9_oCNvE%s$;lDG} z=S@7?E&lo!Xw}0j5j!C>#>BlZa<|`AD}HuH(C1+CE7{5ojU0!#7>|bh3--5NI(xgd4d+sy-c55?P_)qF&nWNH>X{RRi!H97`m-@AQr9|h8Z@1rnmwIH| zmfk~|+-_n{Oy>k1^je-PNYfSP_)zGPn9R>lIF!7%sGK+mUw_F~v7GBsw3T<@&IM$5dMhG@i?_DE)+xlKO$~ zxDV_IzH8=(-LvfVdzYPG?mIhd{V^98q4bQrJ39isrs=G_p8iO#WX{%`%Y3ER zD#!1ushVH)_SV*|yv%Go7xq6cGj%a4^cFn#&qdbFD9@uP>5Il3zkoDZl>}i%t_EL) zNFNuLANyQeI{A0{9MC@0>3l8y%#4X54_g%SZftPemUDAa`?|-)Cz9ve)qYvA&8G6x zi9MB{Qx3IoR&`W=es=chzu)htgJulm?l827_*p2<-O-rw|KHzFC)MX?xQMpzdYqfXzH-Fl^}4p_g7jo(qQut&ns$*Sy)#^2xHr!VuJ&9!cCiBh1&+y!T>JPxQa zi7?D|*fgVq<3nvXhp>Fn%!cq5;{smw2?@8Pu7{h!hc>0Q|8n5Fy)9RJciG#ZpND-N zXSAK4sy*FJU+|%ir-ih6-kOVkceGl(broiIq&)ID4;s~5~dq*e7c7eoLO`$xc zRpIOB*&Wv`ogN<-=Fb$T>cIHn)rlkNyMOFE`h3T+==FP)=5&ZCWmP;n!r2=ZwmMAr zC7a?F!Qcmy#%WVRRtCK^v6>gXF{$<5#(!_O-#>M7vU+KTTfdy{+UV_mffj;4kF+f* zd3ovO6>Fg-URoKfzW0;x_tpP@zu!MeGgxgc`$Rvk^gVyM6Y4z_*jO|e3>!`< z9Ts}<``Glu{49HvKz-1SYQnG8_y2gr4I1&7l9RUoW)PR}l*SV48jHiiSp>rdHgZ9b2-m`z?Ri+oGXa=a@Ay zY+a1z-sd#M4dkTI%Jenr$dBB%Rgu(o!dfeTb`$G9={@zH|=TblN z?$zq`*W$CUubV1sU3S9sdW>@U{o3sbi_hKIm|VJ6wM9he)}~bNyCN+s^G;}$ZF9CT zbdB4P;Aoq~d8zY->awSbOFL#v(+qZ7JgcKiFK$o7^$AJ7FJ4_;z18MQ@!itvFQ?eO zy1BP{JD0|-MhzV^Gs{vFq3Z>|KE{jRp0j~PgMrif%es;|?`Lb@h+OH(6er?Wa`47d zKFOAVBrWOJx*IpkNO!RD%dL6T&g(kCIp;^C%)R3Cw!74X4|Qr5zbSctd;9v7)6;xE zC){1Sard9=@%2}?E<8O=_wtJj(6r~y=kqQbeY7?cmbEJJNEHtZzH^(;(RJsE-+w-z zU%kg_BAzV6eJE3%$wgIhMO(qG$ZfMz10l292UHlj8axwfY_yna?k_rY{0#a6fr3d4 ztOq=At?7O*eV@@Dw9FxKO2zbD_HLbPRT}?u1Tg&2vhZwpKYQ|)$myX>AJyiBSytG} zE6<6OSKQXm!UR%ag`_~lZ}pQoXWbu`Of%0`Zd}0;zyPvTjq^jTF=tQzZl{JrFS*Jt zPYts0RZeCTD(GimJz)E-Gs5`(b{Cn_|6gYwdf9Kd7&?6x!1R!X;ri6S|9-#!^zpcS zyi3;QWxhe{Vl4N@DrH|=Gd&#YhXC;$!rt%=_s$0e>OQ>Jom zj^*O7=DD{*)@L8K-LG-oODlHQmbk-hMiUC2N}roi{r~Ux$@|)}A6{5DzwVdk`7PX2 z3)V{Cl3nHh!u;Is!#~T*RPIFf7|k}#F7qsW(DnIy!5PlH{|6G!?$Bg0Z;SAKQU3PU z*01NDu<=T@$nJh}Dt=4GM9}mOs8pWNA84_*kMFZ3Xqksf?(5P(i?y4R{e%kUI9M?L zc)R_6NRq-d3z-`p`uqQE%DJ~EGJgigRHoL?H#R0SW%8WKf70n*wf|JzEP5oq|L>DDcKcla{cbs^wfS=4(Zz1Pm)8G%U;lry`n(FK-{N|ejuzYV z?rNo;o;LNke0@y50H|5$Gv6-u*7p4M;b-rb-OimRvG?z{+g1OKPI=|MnWQaqe}&?w z4DS^#54V_@oOxov$hG|N0o^e7hg&%MZh9QxWje{}aCKGaSHC!q856riwU>p@b5tsn zKHA94uHxLrQ+53P-12*x50&P`*M6OP@BD15(yZQyM`heDR|Fo)*w^j(^768~-+a5Z z7fny-w0vok&b#m_f7eSjaQk0r&fzxR$)&HaaVkyPk;rVs<+)^yxb`ugIcbJ^QlOM|*zKUCOV!4?i$JzHJ$ z^XYW%mg1L}mTIlv5yv;*cczi+@5T(3TRpow72kkIicdA#`Oh}<{ou<}s}r!G!7Hy* zNcG8`oyAq!>~`*}K=WXq&sm=`H#o%k(rtgiRhc{v$Nh@a8#%Z4HOMd8neh9|W&hLj zY^zIZ4v2@}X-#Hl>$m+j!>z7R|8s2l-KioETN)nsrN$(NuZ=RD8tCGrxaT0}{KfeX z*KJ!|u?`{jLfg>yTf zmSzRpf5+rm=2Hrs92A^p>{|zIXFq-Ue*gbzJ~NFx7do{*c|N~Btg=~Uk?)S>;+xu5 zW}gUqFvaSLSoy!CEa^{d8=a=S-+DbR_+^XCA~_r8i%!)aEtT>!k}ocD4V?p8B;q^E zgCKVM}|LhnC^CdDmJ zPfx#I_UPWD08XLqT^Ien@aL=!S-EIZ*Dt4y%*zkF$bC@6q2s*c)vDEBvi7iYi+SAL zRazR;wES1UjOC)Yhj+Aji}-o}_nCPz5i|qS7`>+NP^O^F=7|l`ER%#8?o5x~kl;Ag z#6#eSUjDs3RrT*aK0dA*yQ@TM@9mAr?Ok$<8W*+*U%uHfE741abK=P!N#j$~bfdT2 zIo!^#zLvdpPu+)u>{2Uz{44}rO|Eh7`+6;UQ_)ke*u|Bnb+@1R_xJZ!IURO~kV`Ar z%Xyp+eBge2^tnLH9mbxOr5>6sf=TUVXJ#6^pKkPU47-@;W9_Wbd;Y>XzqwW`|2SDF zmi@36y5^{~ii2^EVRGBOYMC4L9~vs0-41earY7gAO%ql)6uH=qSG44W;lCahLw6C8 z*RIa09jeRj7}iO|s}wlyOc3n4yQA>&Aue@^MX?=oloXA+GYU2oEUJ$vmd@MB`YFib z?vL%^Iv#;;AxPq`f7b!u+WEOBvuet!P^H3f@gh1Gm6*mP7p zdVk*LbB|jLv$@z(|M_vs)oxb=f&Dt=zcwcPqnq&8=S(u7G2304wD zoykoCOOL22`N$_X3#9Nev0QWx`S9Z6VyUe>eFaHg64@#nEjcb9s1UonyQ9MCm4fCC zhUOP)Wqr;bimo$^j;AT+OlfS8Jgy`uc=iFu@{JqWQixP-R6Fd-uM71(lDDGvR+aYt@tb3DaZ7=c6<6ZXXKEhCzdB1- zG#=Vn`}^CHUbmBbJ2dy^Pm4=RQ(~OW8DNpiCbjsH#vDVY(@CBRVk}C63@*nuv>AMO zGrt8qFL08ZU;WNX3-9?IXR|rqMQgEpAlc3>I6WeP$lTI?U@Maq_m#=K* zb&<3_c~CXLLU8HPG{qB^b;peuJ**e4)ex5M-tdt(@<}wJ2Dyj*(aW z^-15AkJ))Tw3j_rT-Q2OEcLYwOuFW&!ICQz{mI;R-%dr*ol;_BV!bH@&Dke>9Oj?c?8@Ko{r<}D>x0ko$}g?gEj{AvGDFNvs88D+S{tD5NJn%8dLi_VUcKIvDz8eqU z%{p|hPG)XP?DHF~d3TIbx9)jR6L!yh_p3BZ6#-2~uJk2K?$q`{wzctY)TerAqR+{b8^l|LcONPIrq&`nyFy{-jv!%k`-cWqt2uiLPFSB)yt}u0 z`@L-`Z~V4Lr6t&Dzn?ApbrX+}fpf#5%(iLO=YuTnCZC_>dBB8Gn~C9Ji_Rl1SB}{e z73?fDWZ928TL`{w-l3?~nes>Wd+y_ybD$NQ=Z_qj=(3f{t^gtS*duV<6jeNUce!VN9^ny%#`L-$bH|Q ztSsio;GkmqVbvv%cpL5a(MwW4TMBLHW@x>vH)*48`yt8beL8bla#Rys85E)glsQhb z%hxQpuHh7;p!0+EqL-gV;Z&7nixt~Fc1Q_b^!AWaVKaa0@T!-HFBbQ|dTud` z^KH`_r6lXDD;l+Y-xn^fJE4)sTJ`hk^sTxAKeR$uW&9W1YQlH1-KI(VRGY}6xjP&+ zW4OZO-`?74n$`KjimDGAaBY`FrlAot)&_D*UO-`Ta#RnJ@i@ZuQLX*Ytl` zy5-Y8*C@03%8a`?0xaGtN!~8fn6vTe=}Vpm!kEHX4hZmN zINBdyYx{!v30M98zu#_$&J%cg`0JbU!w!QvriDA6@M3{79~0b98Ch z?9wTu)h%%9L7AeGC1|Z(hsw2`PCIUI&0c<}&qjhW5^%KH4o?MTwU&|z}cSv%F zrFy|;zq7MUOHbXo5z(?T-X&h}q04TborkP~?{xQds4SZxD42U?#l&@P%a|ZHU*E?aksMSp_#7l_N=(2@( zqHD~-%KNq7U)H|!*l}Lw@~xA(eq7=5eEIDKPGN=Xt%Dxicji=Qxt`GRyzrW)M6kur z`5t?~%cD{t%cCZ-EE4l`*(o5~QjxSuT&d~zA>M~A7LI=eTwR*xBjq2n z)^-m8#g5gY508YHuZwFrp_r&8bupMjUFZn!YX!v}5x+TS9*%uJ!F3C7`<%z`O13Zt zy1K|W3oqem>asrDTbCHgptR{>i?E=(j^lw4E1`E4?CNj0++{niNzE=6uw;#X!nitg zb=b@Ie}8`u7d-ljdCk(6DT~*;IUN!Ce)aLb@(tXf@^;4Bb0XZkQ`s*s^S!)k1Dkk~ z-@_;MN*_UUjQtarLI)u>xLRyf`}p;Ge0XEi239WhMFj%NYo52vQQ+z-ofYBUareRm z9hryBjEAP=wsMJn`Q>s#X$hN<#E+N7lT z>fC+zAopuk?a)vVN>`1MZ$UrnwRB*|+0>v^Hy=g?%ZSYCtq zQvW_DvyD28izL_W+x>3W=`96|a{heSka(C4v~rHi`j;;b-!5c3&XX8rTmSEmIH$VV zOod&YFEihGv}c%RTyQwb8+^axPGVKX(Js+T>*MY3O7>}}AK?}BbMXso-@uKDr z89xsLGh4+^T_#CKIATwCzRdH`Fw;ux)ijG%4WECLLw%ZQf~@AXEpdfMMWgs5KyyaR z{)1(Cd*Hyjn@SQ*^4B`;s@*r62E+3V|bjg!Ub z=ohPL4m#1>&XhEM{IPFl+X0?=pcQ+61Y$X6%sGBj-bclOX`g~XK2t-lcgHbBD-O>? z>k4Z=AGqbNmd&zZCU^R*M|ZAD=k0Jj|JG%S`0k%)msM2XKl5$=`QM=RkMfUUTUZJn zsvkM6clop8W7WjDD%U0@)vB4XBnk^Intg1d^T$j6%YQd+T@>++Vc!j%)~75H@!4ia zZ~so)_P^$yJg8M8p$?syZ`>i`$G3VrXMn|CTf3aQte_oDdpKb&G7-Oh%zeTO3at9( zh(;+mJlw)?wpB;OPkg~x?u&ZhARM74)&xVOs>Y1DMgbJoHv|f(97nZ%aAWHRk4Jbt_Iz0Sx zHelmIl>|^Mniz!}1z5x$Jm=-vz%mE4R&|ouYbC~X&H#(KPjk1Lfp(Ieac5F_Ak8G= zcb`X8+KXu!XMlyTat)e5Yo@Sx9Pnfk@f%9kNu{W^!PWu{Z=a6(Zs?{`)VO;t z&7|%(XM#@TrW4ig_o|7_+a zPi?CDnxz@NZOzMV?A*_x%Y3G1U0oF^<~Jp9eVpyh&FTG5PEJ;TWTvV<=i)cx5alyl zKL30^fBMei=cj&seXWewk{O1{OLA{-Gs?YX0@~ogBX1Y;zpv!^-11YiOtVwIzq|YC zalgG6=+ukH$9jv7iiV$v&flwQntg4`6Qw!3%ic~}<~#e;BvtPx?{>cz>o}V}zjm46 zIpg$mCyLM8s)N?{*gG2>?~`5qw&Kf0_sJ6HW*WOIFPF70n=;clJ?q}Nxz^s>^X}?B zoHM6D>aWWe;fdE$Pfzpw{_gJ9IW<2&oxHL#7w3#XD*)|C|-f?w%IZMmTN4zyDK(o*l`O4Xm9cusYz;jOR# zeAZmmxsB)7bI=-RxymPkFE1=?=8}7|K4_`erN!?2wf`>r+h45;{LgRyM8_}Q7h{YD~w z$0u%f5-R9nXuWKBB{0+lyxaeGqr+6K&?mRD*H0~cd@NIiKhUK^pssyJ?a!yvi_Y7A zKe4a&cLz!+T6Vwg_gb#!7Zv*_f;f}LzqdEa{#s|! zUCkxZiz=_jmap{Ko^@4gO~E4hgKt}wEY7zqeioAHensq4*DtNGH5w7_U7DpXo!--Q zG{Nh@USIb&%ekR&J-&XgTe-AZ&Wj(}&fujTDvZZL`)!vF%v z`Rn(7n^p4ais#}Se!CwFYQA0#mr86gNsO}bon@jGJ|oSp;6VdupILqG%}uWJIn}{a z=$Vx+yb}fXwlp}N3R@GgaN?=?_5UJIJ3aY)QholF%&!g;PtUd9evMzV>4TDE$m=UB z7hgQ$(PF$~zJP;^nBmm^mKV>?n%`ej>$qDW)OCv}lXRY!?UaJLFBjdL{@(%35v~xP z-SxrLrIWe!^X~WiF2B%Rv@i4Wva4ne2iSR~mR$ber_Qzf@{ve+(5~+opN2yx&6U=1 z{`vKK{Vut}gH5bbSDlv#UVb(st4-r>_4~b_{{4Qxx>V+bTP}{|F^7{EBTb%*A}63zO&6dKR!Ad znqjD$ui_H@@$^fVhb6NtUMqu6ui#R@-^ilW@U_KvmWiN`uJWXg7R^{6?c^v~=`w{` z6PB~_O1-f1_Rvt8HQPM@nsVQVm>nGIO4S`*eG-OF%B>yu9B(PiNIf-WB4|GDb;Fe; ztDP}Bi;QZ2l}MW9%m6J01kIlHN|{cwtNq1c_P0mgJ`QxMPW}5^TUYBbc0j$cQIO-U zi@n0Vh^mIK(>sFp{rPm-^X(C~RiNI1tJG=U50Wl&wQekum%6?#e!)EBQ3`{Lse8Yi zZnwC8*s%_+;@+}#kPkn!ojCOdw1n_vIHKD^5l@dW|TBbc4A1* zlEyiSf0eHp^GO&uEN&@%eeLRbg~SOKZzdd{V!rJD#ya8MPkJ@W7QcOXt$^+O<(`5? z=lyLyw*2}1e*dmY&OHKOV|JCSbjxGD-FY^ALW)c2MiYjd4evyXy0*@K!F;6d>Z;JH zC&D`tx7#Q!76^WGt6aITce?bINOe%E`eVmcF@Sd2+h$){wn=%_65}sy!>+%=DQ>W6raghU}a>K+Ax6ZCfu( znLkrv)EA1_`g4g-d|ilLY@JEUXQ_}=I{aa$be?uE`=0b!c$=@txfa=~vOE1O8gs6> z^&ZOXl`fvxFr7o^R*949=hIt{D`kbvHJZutsdI(;WYDZ{;-W_2)HswbG{T&Oei(X>WWJG&;)fKFx_qyvtKm$ApEEOFf=jNTG2DXl3 zzXvBei?wFn;MtP-Jk!0ZIJR-iuALm8W~wruHNJL1bIwM!GoL&gSYklS&}unuFbHvY zCY*n`*>lm()cdWgE9UyS7A^M_I=?3}*gCfM&=vQGJ~I}kxqB)Uat2rkm%q7LoGALfd4jx+JOhK7G}v zQ!lMh?+Z)X1WFg6*k$1S(ZSGq*}eJbvSX}_GMD%+#(dbk_3*8|Tnm5kN`~4L&ajyb za&_^ZA10g=8u&Q_ENU$>ayIF6*6e&XqwCqD`)@4Q++8iODrUCh(anC5a!T?qB?2v! zRgXURXke)U9TaqXVe;WxhX;E+F1anZI@|x(f}`I|H^yB2;wjyuw|V`I9Xg$dB&Q!f zJ?zxcN)5t|aCG6OWb^NdbS>3b#F zrPX?QUU~1*2@ISSGZ}TJBf6C7%t($*m&-J;7Z!s^tx_&|=-+YVbonIHZ zeqQ3a%gi`j>|UIRg`bGu{lCHK&7KV`XTWpA$DVsCm^4PN?mPLwl0EhM{&#ZM=9wmI zt*onc%M3T3Epn>z;e>Cw?B`B=SkHg*%vASS`F($G274c`-gNq}sL}3wV(U#B4!xW@ zF~J&i9*tYWAxYycIu?x_HD3-VzO;V5V6|;qhFw{gtIP}$*Ok7ShC90eAseOtZj z?p2-ocrQxOcYWt`-qy<})!%-$K6fr#G{|DFnNkiv=Y)p0p#AI0sg0a22YO$qT}$1z zcB1dQeTvC9Ru*eJ8zdhMlr(%lVcquM_p7bCbVu z@|Bb;NiO>7aP&srw!$cz*HccaP`6I=j30YycrG3sym z3H#qk(t;&kCe6psYkt(3q}^Nd_tDeNAHP(-&O9{p!r}AhCOaevEGSSrX0dttH{l<- z&og)CfAIUw{cpXC^|g#!7cJC}6sH|$3i|VDOPR^_>8Sx0wU#+Kp!5nldBAwf4;{`w z_KbH_zFgY!cboFZt_&;5k2QM}^)e$Yw|TSX$ZJS*FDbaiG1+w@182o#hStloA0G;< zoPS`oG2e+Ps_r@YFLqq}xuj_0mu*wJquYM{Ew{_q{=3NI8qfcFyXW7S)1O@E{2X-1 zC8hA-`QuCP?%2C+i|z&inckMO&YiO~=5$(pdSlM1BEZO%&ctiBJ4?H<{oXCr*SU6l zoEOigt{2<1b}m29T}|o#yHD?RIk=^X*Iku++2qvvIai7;3gy)IUE3bGuH)5_&r_@O zx?e;Z^DoRbo~NCl<{e|}{jg{C!<2N71{Np51qGk>g0p<>Q`y>Wv(L|P>U(9LGUegf z&o{#IJ_qg&)eH8LW)tyzIdRE(W>vFCK7uwo7F0WG&QLC8@jrH7S>)Ug>ELf2EFKCS z46T#bvvAH(H~9bj@uwV~Wz!7b{=KpGTkQ9aV$=5Xzr&Zm*nRc1W`~N@cAkgEDw`+W z&j02px&On4$_&jX5|?zg-wC#w{PyXug$`WH<=r}SL0fyf7+Q_BYR=4Az|wZ^Z@Amv z_e~pa&NNudqq#*paj)vN!lc-Y0;&Ip6Jzh+T<2D1>tT0EWOeBr|2y+ScU?Ivm}&gz zl_ght46nMiGm}b!z>RIWvqiK@66Z#2C}68|OHy%QTF7Z*nbxoK?`_N4iZ^llcNQMc ztV}rJ7b`94m-PPKcIQ?1X9VuL+8y&HX=~r+M^|4yUA$ahG&x$adW!+qa(DK&vr3FY z8~h%8cz8HyUrnWE%#ICT-rtXZc4p?{)~oAcqe172+}u^VdQH?;uT5!N^P|pJWzU?< zvd8_wkC&f=mR>irEc~@+ZSUbN<_dY{DZ%utj<;-{uY@yXgR z7wR%yY|+G7e}0x%`ZHF|)hwTO<@$>Fy7|eEG1UP{o1iqL9NBJ0sp++rK?VP4b3H`I568-On}V6dLxt zVd1oJf3WGa(EC3Y&tJqvUHmkZvMHpW>=eVwiWaH@c3_8iU*&E1)W?My(Y!m?EKWqODFEE z`+uMRw)TgFMiD=LKCam=OmS)q50|i58at)DMw5EoA6m&uxNa5ZIU>n4SEKXLObz9;b(0!=Su`BY8haKz@D$im;U{+ciXhiLrvx%5{d;DO^B%PoN~$6(QS)Rwu515-jW9#84m=#CIl+8 z%FS%qrMT%KUl;$ong_jZWlfS7RJLEyo__M2l5MP5>*dRb4|G8C7sT10?tRa9yHB}-SM}U>9vgY%oxP67HVgQAXf0}rxX#IGS~g+(+KIl)FEcMc zt2p)UvUmPf$981P&Yn79((bt$0t~MV%#?3(F8in(x#T&sAO z8B|Z~G*rxf9lqIsRAl<6AP3T-i3@&yet!D0zrF7M|Np9kvgcL3(%hT% z>9W85)GI54+jBu1rIschZo9N5(s*{2P^Do;d8d%-l7feaCZ=zCcrqj6c7ScShXK=Z zzq!-7Y_}a-a{XZNGXZyJIm55LC!TaXtJK>S%CYI@+sCz4e(Ehk=X>HS3crXdb-l>+ zI=RFDZUtYqSG)Z*^+&xf2Y&{y(!X>*d{112(Q^Nu-Wek2JnnPZxihIOU|BSALBd1O zPPf!|cXl?dPe1eHzj<$qlkD1pdA8MNkqdqED&Ft^Uw4r46X=ke#rcjVYh-gZw7a>P zW-L0!Cb>I!2d}f6ZDa7Yift|jOEwk$UfEqX)7dQDZhHK-clO$U)8qp&+GL$v1|T=&Q(mJbo@F3OILhb;5%SV$TqH0Z?a2q=2GYXj$l zUh{hs&dxSJz5D&X>XY{s=X4m=eZ3mKsrb3y%E-;j=B@7hebF3pO4_CM=_e<-f=;zv z8ML(P-eS^S1--GyK9nuyj|q>yt#8M3Z4G_c+78E{HzDGw0Yg0PhJNZKjz-v zHg&1@bT81^JfO3JGIIX^`@1y#{JfwQ0g93q1q-gM2vmMjobh3SV{^)t6@f+X?pSID zENH0ta?!o$>(%gRxg!}7(d(v23Qs$*;=k;qg~k83?)^XUj+n?vzk=jjwjcUFdz88O*MUWV@qbRX8gWATQV=Z6&(2e>FH_KqF>kJ>sS6! z?BeQd`N1o17gP21mFny3>%$dW0-l|l8~y9cOJ&diCaBi@@$qr$|9^jjHYT~wv@BjW zMKjnfZ_h_JN$avTZWf1a*%kM`+x7a%`~CmL?xcNr*e-u+WAgDQGt=j7w28R5VOxx* zv6@cfwfAo)zOT0xocymndU0lmn8uvO%Xd3=DedZ5Sv)0C<#CSB=0lx-CO$KK)pb>` zbV_~j#xI`|U)LBWzT4`gIVVn9a9cZzjh})PXH!9vteR3UJD*IzLzgR;JTy6<>u$fJ zq`&7wlij_&)#aeAgC%cog|6HGuj+5{st|F$vUMRVC%H)r-u?6E^ZC+Sa-4@O^Y7V! z4%7SczN2Mb%+4Tz+|~(x^K2qPyE*@^@t&?HrR!Q^9AI(Sw!KV5CnDh2*VpR&wqGW6 zdY_L|Ez#X^8=H}L^jh7!ATZwU0G6#Nm z!TRiARltetYdo6rEb^;mU%CA@TDsdO>|0q`?vChuv)0SHpVmxgsqq4P%DfprsmQI zn$=sD#xIUJ8CTxv>)pS1cl7x;J*l&P<JH7{@`*`#Lu6HS=y25pQ1o73v0eq z(}joE7Of0kuI8yywjo(d=H=4qaiBw1U(WLLnS8(OcJ8H>!ONGN-|$XoqN|GnzucaJ zhLQv)7vnhzk9Hn7zkcU4sh>|K`-9GWo<2ob0^|kd$1g80e|j}M{_597o72v2ve^Mm zU@DEC-TfzC8}lF8^M2x*=RDUt3W9HI=E`vO(lzt;Q+6@O5+C^xp4$ zE+={~;Jl;JMozBU6B87h*Ri&GBzxV@>T271)oP}`A*YRf=KPwC&t@pk?Kjbqyffp# z%iPBeH&9trF=B2Xi?8eIHUE1p| zY@PYTxNPzD)#3g}`FCF_e{(}|Yu42u%OfHdWhBe~Z7=%1UXQExy;t+u_vPK)+im{+c&s@8u;ii%ac`=Q&)47orzqF_ zSAwbQ;agdA&rF}eQc!R8F0fqd;WdSr;7l_|tKQjd6U;yCP^#Jct5;Grx-F#W#SzQM z4gV@G<+`P*m`|JC;`G%#e%qB#vHeYHfj{0=axH(~*2AmDSk4*HH0QDZwR0Q&p3K@N zZ=rnk_uB#)$0gErld>b0Y-d<%@;2{^;A>x}hrd33?Vj#EF-H7a|MBca1;<{W*c7iK zpv*L7fkY#3piZRqajS{hziPf3zBHyyW)8$sq4NemHxx$9gu)SV`vP zT1yM8TxWfq;4nvE0gI*igp{{3uPat(o||JCw7cwW$F9=<59V&leBQcR>8?lGwQ#oW z{OpIfOYaZw*W>C-dX#-X>QHpg{KHT7L85SKmtn`UF>!Z`x#rXBIM-T&uPcTDBe zsa0>zH}l)g$k{x1l7dS{!R!mua+7J9&y@g z$Ucww_xJn#pal*;wz~LvUO274Uq`^{@ioN~k@j7W=lB{N-#Ih)_O`3dcNM=&FwfcB zIYl?x?B%t!v-_MsKRf$%w(dJ$_d{o0Egl#D{`MBsbm=X4^gTST(slhF7I_(&{^l1G zKlJ`y+;4YDUSn1Gdc9_L{%IvI=j?1dr+IB!oSA%TQ^vz~1DD@Tljp{7j+%D0=7o1b z+~fB@WdG0epJOrcO6s2N75jNPP3CaOTT~+p}AmZbvD&XZ>7O zT{HjaNzGE@e2w|4jS8RxUU?O5J$A^dhp&q%y6kJdvf`26d(b}jw-yr??J9l!it*9S z&FRxYb1Jrv{B6HZar;!@eXjcb-svICr?}==%`-~vvNNvyl#+R8$4AxV#={p3Q_DcB z4S%h5cz9&tt6nKnA&=+F=hv+|#JTav!IwMYgxJ^dOPl%3tA1zs^WX3HOQW`CB_6+} z$;mW(_q$!*u0p{tcg()C;KpNmHEDTx@NFjtB4TqLl?^zkDr~L zz13g7=0oF|8HUd5=a?+JQvc_pyKFP)#Eat_N?u;7I{S28?Cy{U;`(uG&OZuUZ2f*u z@bN31PeiiSe?3Z*eXt|xDA(VGiWaQ(x|7la+N96VTq$hK{6mq;euiS|sVScI54CPQ zkZ*gw&RR`Y-J)J6Xh*ryEMJ$2`_l9Bg}Cz4zyB^eu~;$Bt80sWT}9uam+gT`(zf0T z5f&E%PN;~zd@L>V?qA&QvbAw%J4!n`P9)lju8V0gsrz;_UCRJ;blsITk-_CtlTJw& zb!v+;??0$u#rgB)?d|LBq~~l1WDw-_P(Eec^7+Zh$wh~G%`^7y$d^gV^jW!>$HnUZ zuh;rhSAcdm7EHJNC7@@i>6pQPt9#$#w*qz@iY=dBtzIAYv+a)Z!`T|gn6Jks&5{ZC zdKBfOq9fjr;N+(GWJ3N2gBIb7As%WfVw}lSEsN7KZ*E%ZXa8uH_Y%-ahHSi2OOjr> z6iwPH{I_s*pUaaD>2+o~Hzugen&AKEgP5LaP4@IZd%jMIb}sSUJ8{nJ%&i;aZmOhg z`Txu5WlB~1pRnDJXV*a19ldg85)eC~s+2Zk)vq6q`=2hI9(U>g4MW}Pv!>TyRGkr2 zcFXvjePzYM?=8uJ_KT)g{5x;||H{f-6_=L=tZ8LlveylrV#3$Q=|-%U)R-d>;^J2i zIyGs(sLq@jZf$FlCNnB6ZhUR$Y*_w!w)wJsigf}-GC!HVSr$F<=&EvBBY0BAs$>P% z^GT}SlggeusR&jcn>yXKOXT8Z0o_xH*&O*w@$n zO+3{3L@ZnV*RvGa&SRi;qSu!y9OF+o*}2S+&mwNc)!)@mp1ky)E^A>K)>yiAwctPY z_|>_GrcQq>9@p`!N-@=|d}dFT()y4+zb?ssi_4flH+Mn7EzilRsxplSe4X8%Z_ETu zpY9TT-e>*pLWjyVVI|vdHROq>A@S<&uF}!_4Db%zsJDQJ7O9c3xp&e8(TB9f~)8FfwWy9E#kO;yE|Zg-JO1m!P-W zgzLReM6%6)JxiI}c}&n=;$geSpV?-Um;J49iJMt>z(>qZTD5UsZ;@)XUB;B7)mqlA zmxB)p!*eS_s(ZXsG)X2fs$00?5`VJ`}40! zuy<&hX+Au{=(A8+sjD~iMn&Ui-nkxr8_O2y=UsE`n|N9N$5F@1|JLta7?ksO{-0O# z>|M^M9N*uIcf_eWKK%0P#D>^?3IbWY=?RB7wh6x$Q1rb~*qd4QX2~%T>m%wB78@hk zv+Xttvc0yvy!`+F%xOPAKlkpJvkmECTE15?x+6e}v;NpDmo=tG)D&}S426!A|N8Q> zX_J90ucccG|Dv`IjT8y#ISTW@aiuu9!$V1m(~&*f;9#JB$GIe9m)&J=O{zHAX8dc@ zNiGiCP_RfpVsTdo|FMHJl+2apuyTuqZ0oRd_A~T5c8tqq#qnP0<*(y5YH~ksdQ_=C zDR|A?7u~ZM=~*i*k)_tdsOUr(h@V)QM#9X3y%Yf-_k z#3?u2&I@^XT5R-|eZ5?vaDw|B<<1O^W!cW0>SY1WJsULBuC5Bz3Ul+yoWAR$%n`!^ z-gE^U7Y^p@1&e%KK5WS3a93QIm;AWr_Mw+I9m_W)il|m6OkQl+SIswfs`{}v6YrPr zEWf*SrCUxGCu`DGFaUy?p)&<(o#!J~8*8hwHxX&Of1H940e)jimnNUbDyIau+j;IyB7gKbR6)!*_5^O=(qS z!VA6Ltg1|}+82v=E)84hbB*oD^PL)V?BpHH=CjOEJCJ|xoS=Gkb;RVwrG0@Iwy1%`)b(Y5jpA%}IDqJn*ub=EZ zZ;$fouLnO=`f)8k&pzR-I^%NA53{!yA31qT?%ERx+2iSUH?;5P>@cW(o96UnQ@}YB zse>*p#lIUjdmg&EK2UGvy?pne&vL7$g(@!+2-4?xe%L&HVjQp2e6>ev!RoJ<6(`F&Ec&l_9qKF3dF7>Nf2*bW_r}Ba zVVYrUlCQ?CpXS|nv6tss;XV6`<$tyw-|K7MkuXhXN|^GDi2aco;aOAtl@E1xsQ=4R z;mF)Abu+~2uGqP*@TJrFqn}T{(z(_B#iZ$dha~UrcYdbU*rF`3I{%)4pNwSdYSYEO z7rE5W{W)U$t+D(j`*zOlRu2{a?ks-pcKgnTpUFq9(s;jR9DE}2_rRKaH9@m_@8~{{ zx#1l0x2?x$Po><-JH^qL+!WTl)QL2>>l*y(;CyF~!XuMsAL2au=g-g6OEcz~T;y*$ z@4cYlR}I6>8li$&4r}&RE?1djaW3=juF|Tn>U>w-TLja)9yxqJJKOwq;ya6EVfOux z@0@d&t8`JGVzEIsJqJ9dRr|YaZzHR_{lhl3JNmuOPbO-Gu2Olw=W`$E@Q3qXOqAwW zgvh7YFVc%~{&hsy|3zT9g%0Sr&#Gyfx8%A-w6AT*CRF@zV{A%wNhB=X7_abBpV(dA@{= zOPz0G`;tZTa&K?Tv=un3zyD9r>x7oeFU>F1)NZUwKfC?Nf6HIztTg2RKKSG7GQ((n zU9#KBX%CGezdiSCjCquud;IOxNvxM&EmJ)4j9JupWk+9hg~iJoDlX23y!|$Q%fjVO zX!_=ze3UYE-nwq++^QMeeCOAuic*V z^wiWUZUGjN@X|-Gyp}}g?Q~r)V%j1c9xOHgp_%#}m6oDYQ#6&&+yCG5%#lUJTsm=; zO@u|@`ib)G9~Z~{SyWK<{x8qfMG<>9|9i3b@7kQd|KxtwJ?8w)y)9zVM(@2T*LB6b zH`w2PyghZQ_`9=-^#|?rCLVhE_+av7&jY+n8-G2M^=tv1Ku~quQi$cs4{McD(AgDR zG6Mgu$-BGD>S!Lv^I4|ZdcSzGZ3@?FEISJtMyi~qAHUArB=_#FuR;%9Y_G=@_u8e$ z%J%?mzkQp=u1kwf_nvjUG4O)_r?(b6T&Tj7IH-?KOr?#sB{N zoaW=Aqv7)?qi|zi@|w(d!7`6Go;&<`UrDA8 z?Ryo=V&tx{ZhCobsRiiRx9+uPwl6tXWVLag3hUdA$K})*1baDrC$*ik|6fynJ+^$O zsCHPyoM#&n4`-#U3=a*R>7gpTFZJ{^SI%=`Yoj9DewE*^O+WpiaLbN}t_KS+3sO1|Ee(R$3VekGhOMUZmYHjc;5K~%mzq^6s zio%22r=<^iYN~q4{k&F_JU49LBZ>W~Rq@{zM*k_an$+=V|Ls}fH}*LPoBzG;C8TvE zwrR6~;@>zH7l$U}g_a5nMR+R;d)ks~_ttzm`aSRb{k`)4TZ1ZEr|Z3Y5M|b_-e=vq zUAoFcXwJfmFI@yPX0SZ+nvgleg!{hf$E8_M1t&bv>5t!-ZvXq(^>;@+Pj}hc2p_jC z_*IoR`|IqKM{$q#adMv9!MVC#P@wS$=bv}w`!^f*NSSJV+?c^IRbAm=q~$Yn`;Rks zzxyaUb$3Ejc+jMP%nzy--jA0qc6DH}QBgSfa^XcKnN2L|Ee72$vTn$pz8f!I6MAIg zKRKfv(c0!&3nsOAZCt>TuDPXT4M#`AbQTqhy(ZBq&C?$A@T6Xp{VMUf@%M+z@4M{o zEoY8&O4p2CYr-TnXX(dF7nKy4+nz5;&;P8{9(yH` zd)-mAGYWoaYhYP!zN{;CfzX_d3A(#3e_mGmMy}#z_o9CP z$BoTp`7ib4u9)>Ye@^oensaZ47qcj%Acwa@ld;auoH^GtD=$ELT^n`#(AV?w##nJH^G<7QJ6y z^8TyuE%U;=+j5@m%DHo9?e?-{{}apVX9&%CxqYIW29r{N8YAa9BgU$_T{d&(Ne3K0 z&%(%g&SyrTxgwKNfIK7Txi(vS6$|NYe@nl=R8TlLlg~OsL`i|kP-wz~9>I0&vEBt$ z2`apXpIKBajPsN3F5u{BU`anbk6CCA@9lrPewPSLc;M46Yr-Wc&?v#_QE-godhVqjUt%TYUL0%YS`E_0$JF zvsU~PW)$?0W!yU>J$w>$l%z(@*`bO_%wtGp8siFr^Ay;9kj7A!!lXWX$Zg=DFCH?{C{{RW1H* znCzy>q!hr`=xcuWifr|pjd@pA1g3sj6kMySaPZ~or(M$9S<(yVOtSN8GS1|F@k>d8 zX`}Fj2OYA7tMnCqFTZ7z%J0{-Ij2SRr9;zZr5UAyf&z^yoE`-#p7uYpPyai4Tj89b zN5L^q^IiK?Efy!Qoaf@e66EF3q`b6k<%JC?|G66dUKk0@;cV3ZxJhV^D%0hMN(xN> z1SdTBa6T=tFXCJOq_khZCOz<(@B2z>BFl35vP&AS4lJh>6b=Tm?ctfD^*jAQ$JaYe zEX(D;O?~j?u%FaYjt&P&78Q$A4bvNgQ~&cw1U6l+R`x2W%6Gckz|rBL$Rs4w%8~l} z`=Y%(5v3__@1Op6bK82GIdwO}kwSOE0}bXl zHovKVjT2ldE%ur(Vp;xO?Fw&41BZx`!ok3ffNk~qzteB;`&95NF`m=U{>_rWt_F@N z4i8?fUSFo{-d8d`wru9_v-x$8nGPD({i!fdI>J$YQg!+c<8u~^TjWYtoM%z7sNEL# zaHDsDSlW~}WfhCd39P-2EG`N`Oxoe=O5WbuTAaOZ=d$dJi&}rbSll0Tdt2_^@c7!N z`~H55{=KjC^|gs{!E={RZ(vEU$`w9(Ld9b70*QKgp*bIouZg-ium~v>yxaMFSK;Gh zJFl(|50BrQd3jmhj}H&?-rU&8+2b+Yr>lV_J?M#caV+P#Qw4h8wS?w86}s|MNr7pl zO2hQcwZFgRU0oG=^>OyKH8Vk5D)-D@xh0~edD4TP{#>c5X%BpwMY;MNn>HIL%PKM{ zJZdh14Plm@L2h+|tze;mwhBGHLh2}^arp&uN z;lY=~`-JAy-SAv2!YIh$$)K+u`8s8(cA2q?%X$CF55C-KU~SVs_!22;3ru2&JE!Q} zw&QmG{@9JP6(xVw&0<;pUTjVMACN(?NEFayj60BZQ!OAgbn07aormvKEW8_@K3pg? zr%u8b8qorpjC&iDkIvk6F6I6#HNpNXz85{%RSrsOp1WZ+`9TlwS}U=}FG3f%E%t8f zOiJ0bo+Vx6^NHzpDi(h?Oo1j{g&-y&m5GmhV$(s=uhdd|m?u5x5zK3e^)7JZ2#)P+ z&}UKcsM#2@qwv%|p*auJ`sSy57W_&yho%{aB`hi)N?<3%bDq26drAW20OdOzyQe+q z5m>fMh%uhSW5SQ5l?9Kd)T&w>J}YB?e$s<4hx0&w^;|5{=)vhR!KKT%bneN0LUUHm zo?^)7(PZqlL$FNuproQtsVdVxfe8v9j|M$Fruo~epl!Bg-8|KUFWc{eJOL^yCJIeZ z=oCqRWi`20)gstjGg)Q=OL|X%@|!47h4spdrAAS~@lp5EL%qS@ras^?FaBfW-E^6M zH^>v}y+JHWstS%mn&+;Rs{QsVSe6%b%tC?loWw)78(TpY>eZ zUKg4pcqk-X=>az*r%=3(XxzW(aE!zJ z&^lEM<(8G}Tn>mc390Oh(7I!h8qayI!1(z2%_&X)nmG9R7 z{~d2$_~?k#z;s?ew3fHe7eg8oP#jkH~Uw^w>9)EpHX7KOG&1q-v$W_022%4bZepD>_#(B`$z~)t7 zGPYNIO!{57{cc&Y`JIC1+a;HMvwPCpWy=bl&n=%PZBwz~Z_U+Jq3@2{|J%6x?Y7&i z>c4%x9&ddNbl&i8-R*Za`R%(NSH1T4ar=KCn}0uj;MmNzGycyb@pnHS_xB$$W0$K~ z@U`;EME7ZT<0F1gt9>}7OhHc5)W_xUqz645DQE6_6ddD;xZCX@#o1EJC@wT7c2~*D zeRug}t#$nYyOmq~*7<#ZK6xMiIvhG|?{+SCE>KF_`ET|5eXq=J=NOxpz6xodaZGyW-Ll&|?f?Hg|L*?(f7@T*+q=6n zW6!P%U%~UIr|A}-oo!w|J+5ly>-+on$AX6O`oy1@->-RmEjr&;_`vO)&Aq3;7API@ zxBVLO{mT~9Okn=Gwq-GodW0W*W;>h2K`fPmw8lnuQFYDh5DR=CeG+1_v`>i=5kd3bWVkT-F)F^8EMv{rPg&)qH2|c)R`nJp++O)}MP^ z_4)bv?S}imUW zv$Ms4dMoSy{d~SH#g9kz^nDYXHjd-&a+ODpr1Z<#-btMv8}@kD!2?xaU!^wnukSU# zcVo|V^|>XJe&0M_m*)NY?X9iG2Y(zDkKd8I{qD8eZ#UDg8ZPbFw|d>KQ+xk>I<2N5 zU;8ES^|z15<;xGZ^KUm)v=E$B<8S?9LGzjJo!{?O->!JUe{M_O-Ca8cmECqcJw1Il zyIjSAWB!MocVCOjo~bS_cz1Vse);FK=C^G>{okOwruJ~0{@drB?zeP9?)^})IQ=+$ z^o<#Md#-hPI}69?#>d$X^TGkJW9QjvADO+ zf&b&lOXf^(@0Q;$)s5P+qVUYq>GAL4s^6M^_S$69cVhSRdDVB~|NjdAoHeih-_LhT zr^jv5f8-OX#xJEbrOwmOspMYe^SR$vANbuFuy(GANKJqEq!iU8zh<{hB1+Q@m8UfS z`%!y(nr`mSc{_q7Ci%F=WJSDJt8Lqw-?c1biL+ooxZvbGcV*_1bBvw^zY-xeg1|S{ zn3t+w@62|Sm~{2rr}7H|=^SP*ii^y*KP)`@y5sqTrR6NLOhV_??VsP-n0)-!`3R=t zrz3VNhJ0LS_vM1~H|m z{*~N0_v2$;+gB?Vzp-i2_x^mOZ&Qu@vevEnGqQgc^i}*wSo$G($^)MB>n5dp6@*RN zwoa8vRH=b|lFE!4!@k7$1D;%dUQ)f1#>ZHs3n!@D6=3#s;=AYaNTXP~spxL$_0ret z_wSqPd@FT&?3?RT9GspAN*$PF(|cdhBeL!|w`Y!e?PTBcr{7EskK349nPj7R-9>X* zP1ENckNb=nyV<{fILyDjxbwBjZ@KfD`<-os4_E&EdOcd`qVai~VCBq?B5$3;li!FC za;`&+LaD*WV}k6F(G_jAjOv;ej>mtydsKHjI6bF%LI*`RcpilR>WvtM6`S=S!Awf)Aw zT5CU>n#~cJkEcG+=?xEZ_byO#jk_+|D8bnyZ+~x6$cZ=4QmcQxTz*|(UKQhU4tv(v z)B8+&734H$OflqhL~WX6DmjRKJ1$?J<9tYZhPKT~qx6%Jy0ckSHmF!^w%q)BpEjqT z{hGJE4^nP+N@&0OxU#c>qeaMVO+b(04Geb0$Un)9MXmJKtOo4@(2 znQ26T#NR2wej8&On)aT%`TlRO`MnKys|5Pn<*HVE-I#E&=~eBSo1Z4hcHiJ#5xm^* z-Ocp*riESQGxnbO|Kqs*Ek6hG_?nHKK`krv&#M3abtvSqk3J*kxi7cW%2PniHAqwU zhnffIe81cCCS5YCFuW<+Av@(mOy2Id+qQ{UZpgRX%^zEOHMGxa$?o_2c2}DHyt~M? zTc&!}W6q^2BD+~1?p$(SGkDpJJ{OZdb-yVU7iZ`1yJ`FBgz~$M$K|@G)Zdx=GwuG4 z$`$`}gps=?jUJpov^;KDa=ur-?Y=4IoZQpuHyhhuUs&jDD*sK}UE>kw+sn)QJ1;GG zyXCUqwkPN8-iXH(G=6QhNL}qY?M3spq@!Hl&)5IEypi`QxBi|7YX0+NH2?3g{(N;` zVR7L9o1pQh_E=cQeWK6@*9kR0pH3IcKDntp&+zkUz1?T_{(7}~o4e)d2PvDb=c$NK z4B1lg@zJYz!RC`2EA+SDNa8+Svj6$KYM%(Z9}k-CUo^X@PP=S*Z27b9+S;U58<#=4 zh?A|2KsjScV3)%ZmKs5ol(zhxPp7?mvADl1eSYmWRZhYAKTpU1yChqFr|@0){$EpX zr%sQ}5jUFDHBC1AW2aqc^2=zP___bEWl8 zvBCwQ!?i1&R4tU}mc8;}Nm5ieD9L^8g!R-1Ju)k;L>j*ce{d~u`m}cYy`uEFrPHe4 z?R=i2xd+tOJTXBr??{K>v#%~LLYIHut9~E3=Gljbhwq+LpP%z|a#pp)%YGNdZ6SC{+6P~@ zcOs%uBYc93l|-qSWnC-xAdymoEFc3jSZ_< zK-*(E{e;eMyH}Nc``=gn`k&pL(LyKP`sL<+4+0GbfEG#aczEmS&Mw*e>ho(JU5hP` z{oZc>=OC|?$%-47-&k;-+g0dUFwLY_$U36Q*zn7)4IC=&3uGK8-C0rkG>LOcay*OZ zLXHmOJq1_vQ?)NHco=K_xW`y#5#K?#HQEo^O`HUe^~>iMZmfR4cl*&xLh9ZTEL($4 z{)kVXTdEVXF#rC(cU!N=Z5CkPrdRv#=kv8E?6!t=F8up8zdl>;T@a)E%juesi8!+z~D1Ux`O*bGBX$ z`&4l4m-B=NI^RxCcvC1e=j5mBS6vkZnVxb?a$#H3JM+?mJ`4?_RZO7kU2w$K(FB zQVgoAHCFXkJh7R!@8b{KFBhD}mUqusI_rR-yG-JuDR<{D^P8JhJ3%2V+@8a96<4U|E9ck$`&rrV zeB;{D&ZrIL_bQiny0_STw@5!H^SGyct9!p(-hl>2wP`nBG^m&f-O1bkx9sy7r7MEp zqk`7|e6DaX^3r3)jm@eS!p`ftyB&&HP6?`1r&u|nbAO7b?FYSUSNTt0>FE}Vs^9?4W_;f~|L>Zp zf=yR7AMtJ!=QwvuNAPs{-O}l~JOLSdIQ*s^{wyorvs}-QBYxe{zn9t9Ecc!LY=wMx z_+%|EgQsyH(jKi%-M%(-b=Xe%zc1X?R;gO3T6EWnEqQ6ddCnx#Ia#ogOOQj`L(9Y_ zc9{=T;@i_jMsY`P^)4-9QJtqUsUYH&tH`r$^Z);O{;ilLDUbU|{N-i7v6Iz&--LH) zx5)p#tbFT(*Q1AvH?sJvHigGkE^T|TX1)BL1r^cFg@HR8p4RQzARbq-urp$vV1>cQ zf=|U}Ob#l_|2{mLq!N0jLU4{u_lmWz_kAdM_PE8|G`!#tFXPEccD>b#g`E7lPLdP* zPAtpaaF8u3X#L}SXSs7m@)Dv}u}zzu7L-Z~dI&deXj1Y0zF^}Mb%AU9-rOts|M&a# z8e01ICpu0pVG;Fy#LUiTlCL_?W6xY2=FP4e-uGnA3mN>rx!I@3UHD+vcD;<; z+uKa}HJXIqgRXziN)pwVOX^$tBZfa+LFx6Y_N7(FL@O*LgV)FH^(hFNKb1wk?pOp9 zf4acolb7sHf3$wHp}AFPf@FWh+Wb8n=bZU0Ro)jKta$b4$fmk=4^o1gtKaXvzGqhU zx}9mJ@?}?(WE$HiON8Ahd40`S?p#!GeADIr+8rD>*)I z{uTAsp+fG=ak=U>(few4)}DIyaQ^LzmlGro6iInI=zRQO>mA1OPWXy{?_q_B3sxMQ zUO2(X+`C;oY{HZ})wvT{8V$ZJJ*Ij3rONLo?{>MYQR>vyS-qLv_EC?EyiHrp#2<$@ zGn{|m$S#|5^FBwwzo!xNSY`UdC#SQYbmVX@%U_hI)ik;GePvmJj;C#hQ<7!nH-!rk zuhb5<`+VN@>tJ!0#o^aoCsf)dKbQFLo}*+{Ij?Z;ttR2$0>LLYnQmOfank8AZ<57l z*>;07$2(JWj(jjYE|WZ4Qo&@Wnp{*}U&W!%RbQ`$?*se3Hn=Fq;FQ%aFGJ|M&a3YY+sOSm zlFZ7>=%uFa$yj5QZZ0mj??{s1X4il}dn!N6oOZFfqkU1u!h5-l+k`1~qH`yTG#Y$6 z`uO;L)0>xemg+aFrnNlCTs}8#p8K>VALE3QJ)F2b&9)RiJ{Gyms&GPwdfjokuQI3E zFYYXUKI^-%q30yO4{sh;fhsuPnu#XDDVfFp*4O{duAcTGMzL|_y1J(9eo5nFWs8$6 zXFpM&wn*^gWOe^-EUHnlO~xIjs?GBZ6&Jjg&JSoezF%87w`PvO8J(lWdgmCNI3vuC zAMVz8W_fP&?4GhyL51=ay&n}Ozi3IHae;B`e|3d}FOTPdnoNGKy_0sxH+`R9^U2eC zUQbZcrVl2Q3?qG3@-zMWnIdZ{*U&wd}z6lc5cqgh<}Q5-R)`X+9&s1 zS+Gv_|E7{-KT{TddY}^5Q(w8!z%6NIMJKC1+f**iQ(si&McgJ#sS%tzL4q;8u5%>P(f9-0e=d&!A7Xvp_U3-P{RZ?9+14rG0hfd#E=*(_C-T&v& zDZdglWe<8JSby|661VYc{Dr0)EBa)utsd>|=uDE-_Fy{^8>IeYeyXb1Oo0XUXHBoq zkl-u(f57-;k)UFH=&3S#ef1KklObECVZz0E&Z))bm+k2YmLI|A`&1>QPT!xxw9v=haH*X@ zeTUyU#bw&&9kvdRVd~!LI)xvD4m*3E5n(b3FL=azV6mqV)5h42v-51LuL;c2SzjpA zD-kg5aL3J{l@lt|=jk`8#BtqxdsqDTFBJ>U@JEM@&j&hnca(>Evoms@E4i`of`*C( zx8SD_-*xhXxA!sBPFo^adnEdq_CvubYMj$Lxj4@;a4LxjdddiW3_N0cc81~ND$lt; z0;iq#6jIo1v^|8=Fs#C&^RLS6scvpsPhBcFSB7}(5k4>OD5T%|=9}K{wCme;ZI%a3 zb|!~;6#PnD-n7`|jNlc2we$%JE#D_TEoizB$)vUHin}7eI@7c@AxXw34VK0h9u*b4 z;OCfJCw`=062pOY%8r>6?gXi}vMl#%6)~xdWcQdbrB(l{`ssZu%_p)+C^CY^gpb{r z3L2r-zG>?HLgnrSftm__&Hf`rW;17}WQzsAT0G%_%D+iZxbZM$tg|;cXz&6lkX|}evMbFNb0u$c2!jm zC*CmisXhvzp?R@%t$B+Nas?KqzgY2$!=vDrp*^U}IC=YGmCcj?PW057Wt`rZy5;)1 z&(GhUt+e^Dgr)QNi9J$PLEm^;)URs(2=MAO?pi5)?y%k4EBBsM|MOSneU%$@u2*V- zh$HCkqFMpfpA&BsOL1CV`KyxC(e&cW=`6n54blRCbN75awyymBy{oG=w%X272?;ts zc}B5T)&{G?UEHQ^oUTdc^1mK78yvr+fAhuG=-R&@9Hkx}_H(^czwY?d=knSJMJuNs1;bxvoAd|MOfGcU(~+O4aTlqXD4@O;-N zeQoOGP5Ma_`Db!y|2yxO-eLdh=e?54zF}S*3$O2~EdFip`bhJa-&U?eB^|8pKNPiY zde3$H$~B22(iL=z@zj9D_F9<}9&{MkemKCaJEi^ZwO3I=%hL?5>I*csFc#*9)oUz~ z<8aQBP?qA9RC+k^mE_j>!C$`y&wtRudh>0{w$1acpFW9@M0fI@`Xs}jD*xZ@et*j> z*G6K6@TzG#j4Yi|+c;GM+l3QbuTO|A$>{Jf>x|f%H8okkVBd#tf%Vf{+*mZV6>2~|6T^|-VvUdy>{!gzjHqC`}ZsRwww8lk3H`*r!+brxF$B|;I%m_{+mMloqs%Z z{rh5Z{~gek9dG)MEfd%IzWIxBtn}^n)CWDXg(~6`9`vv* zwi09%6krr|D0p-*W+Q2=UheD*I* zeDqNEjep#!4;7XI+O6SD(`GlGI^DRmkZZ4SylKLL2C2BFpmoAB(Z8z_e_gNyP23AU zkaX-cn`g=4|44f!ug@DZPva?m%8nh+MIM?t)_k}7{U-Umq}RfYOW%R2<@3{I%WfQ; zcDVV6-=2l<_y6Dbmrt579_1h-jC_M7?(o%0-&km`BIvcOATQkwW zz-j99%zbrDZ!04EjvJpc6cy5`^b# z9hAJkWeRBac#5reft#oC!F?4sCNg>&aXfYYpm*Vh*`!ppZ&u40s`m*gJ7x;}dz#v? z!X<&NH=$l`mW_ve%?C%}jgHE@C$r}Ue3&bKF4*5TwbcCPvPqLPzMMY)d8%9D%&bdG zJWbafKizHzx=Nv%bEC|)?fLQ6ZPP{W>ql=ple_!vwr5wD)|-OTsX$|!t3%Ue{%UVX zU3G*TbeG3x9s!&9aOVS0wGD-8PNm=Mp0P5v?B-Fgz6Y)f)sx>xia8Z1MMYjplB|7k zVc|2*R7q`tIWf&vm9e`@Hts4rVk$V>bzy}N<14LRrwMjRMmyvT17apW-3gi(+Z6mU zrGUR8TkyP&|HRy`@a71eX^*bBIIy@lutpl}=v(R_8 z+1kw}T+g4!@t@c54$xV;@r~R33Zu^7uWoEy{QB0`)mQI5wmK5JHRt9g1!Y+UP)VXR z!IlX$#ufsa78jLCRXFj%;+dXrvC`=qM?6?dU%k>Y{Pd_>f7XK(%{dJJidfWD12z61 z464XW)2t0TrxKqzCFY>y6a~ixn~XVnXM}7!wWPr4yVDsh*JYiD4|R9_2o(mG4H*&O zG0^ScPKAZnq#6xTr(EkKi<`a8ZamK)w#(-!eL2i;eLG{7%i=pd&Bh z=f#X%AUh5t_k?Z)I(rvlPw%IL5EB?yk#eq#M{MwDbSiT4!U!?~2(1ijH z69>8_o8G%h?-WZD;YKADJGTd$RG_WgeM?5c{|*PqYlZ+~CLDdNvsIE8igw10Pf z%TxM)rRf=KkD!82c1q6|q@SO6)soFKl5sij>MqB-VlnQaY12&5?S;+4IAtWmAin5@+;m#UR1eQ%*bV zQA+ywiE*xk{ibO%Ie1rY%x05(c_j9bK%@Ilev8W|Y}T(n;t|Uq=c2Lot-y~P0<%Sx zEgqgzU%UC7)#+D_N$I~1iG7{wmU(%ZZ}01gjeXZk-`&|6cByks`L@l;dLQ&py3|-W z-uV>dv|&|e14l};L+-(u(bII-JXqpk^Ip=+lvm2+gpAzNX~n16a`(Si@;rF*U8qIs zjNl6Pm6uOd8)blwSPTtx+&m$_fthvgp>v#|*sZ7^k1xBK?eC zMzHCV+U^-C6Lv_Q-hM=xNqS=U#P4^@VpR){m zrE5N=<72?-8B=BNMRPFNSv>x6K=P0m|Nl$!@{e}P+XV!h_0JyecaC!0d<>ljwIv)=OXPZTY@tX-gNY4<++H52rsp`W0&>(qfA4{}Q+5FmXk>1C2 zLwwm1yB{36cqlKrBP^^@aMqf9}{*5}y}5G7ajU?-0}^{NCc}Z;qEvER!yDwF@5?@3m}uKAAsu&7Dn$PTz6k_~h6+ zbyxPfoyWpn&8vJSdHVo^;i)-1W(EsX6qd3S&SSlr@?*i_KacWPMQ_hjE0}q`<4nTq ztG`xVDu_KMn!_z!!{D>`0gK%2)`gcmKRxJ|X`Oq_$n*&FrYC2Zo7yG$l_y32__7vK z{s{0hK2rO*>_gDgRBsN^dCuSD-7C!U@7-yU+TE*o$)n(j>RkT1cN+&*c#ebeOk%!UVR1-7-Ai!^o} zpQ3N$#_{S{uk>-|;JyDE9DR zMgsCD)N`TrWd`SlEoVO&&31XsgR3-}MXVo?tYdm*rQi@ZS^8TZuH0eu(b*5(c38jKc_D#Foi`1HC zedk_Xll4*9!>d3j?BE_g7v+U=H4%#Igx4#JCKVJ+EI-sPx@UULhL;x?w?B0e@N%kA z|J-g7@Jytb*SGb$$@Vo0zf@MJHJ1xLmt&f^PhfV(xtN2J9Vd4EdicJ-kX8Q1iFM2S zuWXqJkfbF$#KUGw!hs(NN5rbS6$n zhNC=b=iKLdTdO03j=zrZfX3FBlfO9`Po9>z*u|lvV!_Ox{@|~QnDE2{L7G1~zH<7_ z_?&knx#hysr{}9%T*9{g;8anx_<5j3eYR@hv=z;6tSl^Q^9l~}a6V2pohp&`?NP()4xiv%PYz`no724ew?ksVgK{VRtaoUk}fkkicRlhH_ezUVU51eFO`oS zlL{*OKHR&oqO5Vk)4#4gs`tXCsbwE8Q0i#jxRFUrXXABsi=Fb*?h5kftP$i8ShrHl zzEOomJ!wJ!SJ}nG(UMydG^PDj@0HDoR1pbOpS80+LxpVye@xARLyP;w=c<@b>dI(c zb#lVgKK985j$!G{{MvD4VcaL$>c3oc|NO1_y8Op(_jx-4T@0m{vlK2aj9jxqr_^ri z+_GDlVRlTeXO|yaV`ir-5Pf7hzZ&O8S5R%Jq`>r4@PV@}r)6kp=(a@W^AUSGK+CSq zN}v2*kyi0@qln+si8bD@zV0=Mv|H|PGs}X{V_m|}iK!LSbU#KsI-8<7|Ht23k*_*j z9~ni89slfnLUgU&!OrDej6T~8W*0p8`RMP&Xu0J!RaU$0m^?YosptqDk@>v6QT^)n zuz-S3oV{P`{zaTTlC9C(E|`~Rw=t+8#uwDG1GVoIYFVUaJxKAK7c_a_)+$zYZ%%jl z+AW=Wo0z1d4x9Ggcou9p^E=cNN(xLbl@t!n)T@3X?HhN{Q<6JLN^q{@v3c^_Mc!&? zW;WbVNt>!F49Sv=f&z_S1Tr+5jBSq`?p@+{(DP_@QxIoNZ*lm70_SyqB2#7yUhoTe zdtsrowmm~^Ak0Av{6MWepB{M*KNqz{T?%>gUu7NZoxN+WZS}V;ZyuBut)QQ zl*de)jx`^9X0Fm3__4ud>lV|njh;5A&Ti@IzjAUr~Bl;XPe#DhI@HV;y$#_ zQKW47n@6+r_hqu)(mZf3&oxJ?A;6U($g1a3!jlUHHIvnRWoD~An7E`&EqaU4D~qfv z8n<;CtL9Dl_DE{V&qeog@9(S4<+#H6wAyUP!O17rxm}t0RLXJjJdL;;UR$ybde$yy zm#?|NRln+9k?3g#1_>R|T7awm4RZ}|=uc1Dj}%gZ9^DV_6rI-1HD;EQ^J7u6RLHS# zcpFjIU!mgO_BLFT;rywWw%_k0yWYP!p+UCuhC*ZUji2q){0o$q$`=l1<>`TWWd z&1ZgRqt~78GPM@knB>dHb^B;g&`Z!<*z);xyWTSUvo7+=eU#iZId}gJ<8KSwwl_l=23*_#OAnH5GiMTLB?Z_N%b?%T*LxSL-v+)FupdHw%? zWidymUx`#plU6fp3)k*rnD26<%J(7r(T|q`l^}fy0rti%9DX*f6}&g+3if`uJpbR7 zZKs#9M#pXX`cf);P2%YnGRNn=c|Ny%UiGV$%X6OVO5F~dS8~adl~sM7ztE&vX1P&s z|2TcwsgL?2Z+=iY+_wH zZ`ET+yUWFaMM-Ib*uk07hdq7NK2A1HJ5%uFIE&Jx9lnn&o7+5Gy?tgH9i4Wp{?B9i z=)3vT4t*>z%f5Ez?at@(_>Lvr6(dc8LHcj&Z-&27`C=)36l zu1(S3`9$dZhr|50=e=8VN$t_YIkwehqIq|x$JbdZT{fSS$MH*5tm)(eNE<+bNhzR` zDN|$)hxMwPAHKd?y?z(J{htfD8;^>u3tu1C=Q6ibSUqZuYLkfIsbfY*YLr+6SGT-T zv?%1r+i;LAEQ#}C=l4mel`fi|&erdCES{R|biwZbpU+~>UOpPL`u^=W7Z#nH>isJw z{pF>lY7Ua@aS=kZwL+yy~W!orit4-)=1W-TUZ3@p;?prup~o*kwX%i;f14ka-SLtm-07I;BSxnkFsH zd8B(%N4+uQ&W=L0KOP!RGLt?uTc{XH`nEktIXTDYyJ7ON9cH<=Zde|PWxM$_f6vFZ z)RpJwT3_F@xaH^HZ`=28wfi|eWzl)N-)D~K#a(V>W}oG-H2$3J=QGB>d%_l(zPi0V zU$ogZ)cxkY%IC7)zvr7~Pvi7W67G$o8GJZ&f0QPZFWdtxX~-8 zXJ0IHZWsh#a6CM@OJfP2h>~Dv?`!cy&p(W(WWJtTXSbvI`|W)D;5Uu!n@e9`%X@NS zqFR#uj|a@$t5kP$AN>a!F1d54-|p9n-QVw3-(9=?UKVTk_2_)tVrBQ*`a8m{pH@cy zn*aZgx~KH3ThL5#A%PP#DE`as>@3sOzrI}d&&{+rwXNu>*Y>+*w4`heLX!P?9M(Be^-@fdMkrh&cDG{=WoNJmpQ5I#J*P-7B;8W z=*I866LYB|VyB$<+xWVlOFQqckiMSm^Jg`3A{3f4HC^smSFe<5R!FP5L7!V`byk4j z_J--3-23IiF7ET5t{3)2WMXIgB)1+$(?t=Bp8Z(BP@8+O(;;=`JhzjKHj9rau`~&P z^lH%k$j>fcvmtr)N(##1X!2UEYY|`hR5W_h@{LdY0)wYrVLo{Bd}N<{L6BX- z_1N;QZ`KA0P3W;5sLq)Ua+Fcjctgbem&=NQfrF+TeH_%?4xdsAb{BqJ`ncf85VNkyy%>RUvD^ec6tO>mj!n1(rh!% zTJ*{vS}S@fD;$iJTEC>PPuKhJw%d7|P3n?NR|>cOIDGkp+@d4lK}MZUOWwTpyd*Hs z!$s}u!dJp`rr0eivP)WD{QO+r!$YlVA(2+gXW4PO=S1`usOo)PxBFeuE`Q-7_P zz3IwgwN?M171;t4@a{0LS1%%77i?9^YbmLOu`Fq?xo^FzOs3n4H_A0*gpvz&` zMZp6t0*(Jcdwq`kWIVa-=bX}Ve!l(vjiMn^v&y8rnng|6paWn&paHPg=Brk%TJwkZJ-MshUR-ZZdD_Z0OxJ#a$nOPSR0op_&z$hrt$OB%&wZoJ}eXDL{(0r@X zRj=>v-Y#Dra4>LF@x=!Rn{)S&_^i6-d_g3*9Jn4C5Bj|XK%8x6iul%;3 zMMIq#aoE4pI27nN&*mm*#n!f|YKwvqP0m;r z6^qNM{WXhMh8GlFy0f#`w*)jg09qYacPEr(vCZc*#&_35ZuZG}zwh@u!7nTH;PJ9Z zP2r%V>BWj)+8P!+-&~Kcf9q%c*2Fyjo=y4Fso}fiY^#nK&l36a>&ayQU7!)2w|hRH zd-v=0`tq~0&HWFqFku0wE>Ilo0#9P;cL~ioxYlRB-Q8XZ!$V(RT|J#71zKWm|87%9 z;J*L=ev54e?P=cuTIeQQ^WmWDoTbii$4pXDI5<<~@1ymxlO8O&4cbD{BDpB%$A^dC zuI{V-{b>D+P0G`Cqn{n?l}?ZE$ZRQje5^Ov%!}6@nyFnJ~DLuEd11@`wkyjo;=i< z7dpwkO>EA=1=ICnvlit(I?|cgb~q$53C(GhT>7wM6KncAUz-mHn78RZlmGw2{rdj; z`tA4Yen*y7xAVyg?Y@4rTReK(&mKwRJBRu0-|$(zP`Ev>=)r-;&R$P(F-SgV6zqUa zxTyvml;rvL`MkY(p?UE$pYJ~&_wO#f9(%p?{k^-OoyOb3tLN+%->5B6J@^0H{QBba zw%_M~mhRmyzh4`>zwWOO3+OtNyk)QAVPUtxiABXin`PIT(?^snvim!WygK$<7C+lD zJ+A7c;QyU(x82^gcH6B}x%+-TTbF#iFRz)`%pmdBw%q9L-)?2^7SoN|vCMb&F1KE( zovT)9ZLj*8_5JDe_+6sfVLSTm|J`VL!Y*I);9l+b*zeb(^LLuxueq!nvEjfYgYvtj z;h>hM@XjgbLGaS$1Y})rl;FWg>7%EnYWvD435n}Qr7RNs=wb81UB32--S0QX!qYp> zEKsx)T$p=nOX1sFTQ~3UcF{^I-F()}_+wW`?%iEm<)4^(!4v2vPLG0Vy&IHdRg^5e zcN*`RU15pHvMvkEKsoQ3%PZF9@)Ah8R5&~e)ExJI$@VIkcFrdqQ6jW7u%vtO1SUv; z#?rz2*+4}Rqu`2W&=m4zC(!6Rc<&}8YYWY}caD+MFW+~0BQ&)&aGW^&^0*9mB?V~P zBebls8C3|)KEon-912-L?XWwIR$8A~R;^lPRNuerV4J&xoS%J;9%u^4#7mIFm*Jr1 zLP4qcG`}l0CweqXmA8TmQ&sSa05?shg`6H4EpF3S3Y+p9rTX3V;RB`BWzC?e70{kE z6GqP73ondH7d>-ac4p=5i4VTy@p%+fr5o`^uy`peEDV%dzea9t<%H1Ful7B8_$8SS z)H((2-Eb0~aDk&&FIYWGF6GpmU6Pd+duKBX&AB(zhgq!g5{E~|lw;bf-LvIVu5Q|; zUup4o1~W9VH(p>-F>zXa`by_4_L)Y@^W5b8-al(#SzfMoxxp3Gua!?Gc`H(+*B2d(+igu zyB=U>iWHJ+d{Fa#@AsH?KG~jspiP+NPbRwWIycvPclNrSYExWQESwWBdn!%fViKCO z(!lwkqep?5%Mxan1Nlsm;&UR>LG}5oD=Xi1s?RI9U;lsa?hl8!?|ylC`E0@Nx7%j# zez|P6%)ATNU7C!`j_hjSQ1Mpqc2b_-{`rD4e<^6O_3j^!x_v9+ z3Xh6{_C$cTaT&Z9n6T!d(!Q!`&m50rT$%eEG|g(T0A3a}>Tvct6g*n{WZ%Bu@2o#(C<%QG z6S`dqTJtPhe&^!c%4ai=1630i;uZr|^B#j(3e3g_2;n>p9}^|iIL|K>gJH8(qW z(o*L8jpY8Frq^SPO+K53e}crRR~=``|EYP zcfGs2d-t(k>D`RXY&&+p-*?;D`?~!TowLnnB;CzJ#27ixZTb-UCWZ4{*TQS9E(($$ z+e&p;3ayEN z_nO^00cwo?dU*e|{{A~H8PlSsJ#(D)W>K}~{05fvpFG+Zn_1FTHC{_8O;7-Z;4T(* z?r{+m0wavbHXL^`t^m@Nnh7pU-z6=C{8i)LQlJP3F=G zAF9|=CtCFX-~a7a_PW~N-#DZ6Zh5C?%DH&E?fvNo>V9#1K{w4g37?pBVTE@A)3aOI z>r1!auiIVy^Xc^7;0a6PLPJwex;#GKU#=UyZOyr$_rU5*3(M7 z@^*Lj{(iSx?EK8BVHt93Vs>7t=#jIv(%!!2cZLEuHEcno1}7)wlH*nvwV8fCV{|G$ zGs7_N&W^$|`}mrVuFr&)?J=6d7H!1Hd2Z4~)uJYrbfp`mfr2Y!7&*_K+UWOrYS#H? zhm0T{d4B`WVDZ?Jz-3we%Wld^MVGLsSS(JKO!pU>Q+O%#zS0CHCZRc+22NaU0%w|U zITe3>b=Azu%XedTu;tSQO+~?)JMO-^6rL%;oh&f>&oqtcy)5ZbX_bE;!`ePApk9bn z>@q)|X9qtXm(Nd~&$LkTj>^p66_%$nE4(gWxnv^OyY$^mK~eENpBKCJdR_i-UPV`6|Q^KT0d#d@js*1yF_c-AC;M2;C>RMpA-01ok>$! z;owZ8W)+h;w>~pGto(X4Jo=EpAz}Z^mCxsPPbDgTBHV=FXgTlgzUYkQ|0%oy`y07Ez zYT$SxFyXw+&syI9{mK+!J>~s07;Q4FU zHqc2X%bzuHq|9k(aXZEv^W<%&oCv2^duId35hsTxW3e@_LRc<2J2)xZZu2NonZ@pT z>H1bz2hb@l>@EtASyW7n@*XJV`+r{G5n$!R;-VnN1UfS&bh*+5IVK^gmm6ItDPOel zn6z)5E|ZeN!IhQ@Op@vf3nvybi&s|9Vs~x2ln6RvL}0>$9@f=XqK#h!CS367*PSHO z`OIVw8tIC=9 z#KVMt(vtPr-3=Tb1zCI@4#zk>GE(jwaJ@J0nd8I-B{MiW9CTPzERqkd@^e+NWl=G? zl-#Z2zNm77N^NX3=scp}Vh0u@KL;n}$836^zM1fMu`E68;sD*L6jrLm^iok_;Y7J; z6-%MB%_=WngGTU#=FDPNno!6jBqeEHFme0x$^aD&Sv4jl0d7Xla}gU>1q*ucGq$wN o;&527YL%A)sQ0QM$n>AtqP$h-eX+X`0|Nttr>mdKI;Vst0JG!`wg3PC literal 0 HcmV?d00001 diff --git a/design/ceph/admission-controller.md b/design/ceph/admission-controller.md new file mode 100644 index 000000000..b0f5a6443 --- /dev/null +++ b/design/ceph/admission-controller.md @@ -0,0 +1,148 @@ +# Admission Controllers in Rook + +# Background + +This proposal is to add support for admission controllers in Rook. An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to persistence of the object, but after the request is authenticated and authorized + + There are two special controllers: MutatingAdmissionWebhook and ValidatingAdmissionWebhook. + + Mutating controllers may modify the objects they admit but validation controllers are only allowed to validate requests. + +Currently, user can manipulate Custom Resource specs with any values which may result in Rook not functioning as expected. The present validation method in Kubernetes is the OpenAPI schema validation which can be used for basic validations like checking type of data, providing a range for the values etc but anything more complex (checking resource availability, network status, error handling) would not be possible under this scenario. + +# Admission Controllers Concept + +![AC Image](ac_design.png) + +## Requirements + +1. Webhook server which will validate the requests +2. TLS certificates for the server, +3. ValidatingWebhookConfig/MutatingWebhookConfig which will intercept requests and send a HTTPS request to the webhook server. +4. RBAC Components + +## Implementation + +As shown in the above diagram, the admission control process proceeds in two phases. In the first phase, mutating admission controllers are run. In the second phase, validating admission controllers are run. Note again that some of the controllers are both. + +The admission controllers intercept requests based on the values given in the configuration. In this config, we have to provide the details on +* What resources should it be looking for ? (Pods, Service) +* What api version and group does it belong to ? *Example : ApiVersion = (v1, v1beta) Group version = (rook.ceph.io, admissionregistration.k8s.io)* +* What kind of operation should it intercept ? (Create, Update, Delete) +* A valid base64 encoded CA bundle. +* What path do we want to send with HTTPs request (/validate, /mutate) + +A webhook server should be in place (*with valid TLS certificates*) to intercept any HTTPs request that comes with the above path value. Once the request is intercepted by the server, an [AdmissionRequest](https://github.com/kubernetes/api/blob/master/admission/v1beta1/types.go#L40) object is sent through with the resource specifications. + +When the webhook server receives Admission Request, it will perform predefined validations on the provided resource values and send back an [AdmissionResponse](https://github.com/kubernetes/api/blob/master/admission/v1beta1/types.go#L116) with the indication whether request is accepted or rejected. + +If any of the controllers in either phase reject the request, the entire request is rejected immediately and an error is returned to the end-user. + +## Certificate Management + +### Development and Testing + +![Dev_AC_Image](./ac_dev_design.png) + +We can use self-signed certificates approved by the Kubernetes Certificate Authority for development purposes.This can be done by following the steps given below. +* Creating the private key and certs using openssl. + +**Sample : Generating the public and private keys** + +``` +openssl genrsa -out ${PRIVATE_KEY_NAME}.pem 2048 +openssl req -new -key ${PRIVATE_KEY_NAME}.pem -subj "/CN=${service}.${namespace}.svc" + +#Created after CSR is approved +openssl base64 -d -A -out ${PUBLIC_KEY_NAME}.pem +``` + +* Creating and sending a CSR to kubernetes for approval + +**Sample : Certificate Signing Request (CSR) in Kubernetes** +``` +apiVersion: certificates.k8s.io/v1beta1 +kind: CertificateSigningRequest +metadata: + name: ${csrName} +spec: + request: $(cat server.csr | base64 | tr -d '\n') + usages: + - digital signature + - key encipherment + - server auth +``` +Verify with +` kubectl get csr ${csrName}` + +**Sample : Approval of Signed Certificate** + +``` +kubectl certificate approve ${csrName} +``` + +If it is approved, then we can check the certificate with following command + +``` +$(kubectl get csr ${csrName} -o jsonpath='{.status.certificate}') +``` + +* Once approved, a generic secret will be created with the given public and private key which will be later mounted onto the server pod for use. + +**Sample : Creating a Secret in Kubernetes** +``` +kubectl create secret generic ${secret} \ + --from-file=key.pem=${PRIVATE_KEY_NAME}.pem \ + --from-file=cert.pem=${PUBLIC_KEY_NAME}.pem +``` +* Modifying the webhook config to inject CA bundle onto the ValidatingWebhookConfig +* All the above resources will be created in rook-ceph namespace + + +Using the above approach, the dev/admins will have the responsibility of rotating the certificates when they expire. + +Below is an excerpt of what a ValidatingWebhookConfig looks like + +``` +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: ValidatingWebhookConfiguration +metadata: + name: demo-webhook +webhooks: + - name: webhook-server.webhook-demo.svc + clientConfig: + service: + name: webhook-server + namespace: rook-ceph + path: "/validate" + caBundle: ${CA_PEM_B64} + rules: + - operations: [ "CREATE" ] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods"] +``` + +We can make changes to the above values according to intercept based on whether a resource is being updated/deleted/created or change the type of resource or the request path which will be sent to the server. + +## Setup in Rook + +### Starting the Webhook Server + + Based on the whether the secrets are present, the rook operator will deploy the relevant configuration files onto the cluster and start the server. + +The secrets will be volume mounted on the rook operator pod dynamically when they are detected. After the volumes are mounted, an HTTPs server would be started. + +Once the server starts, it will look for the appropriate tls key and crt files in the mounted volumes and start intercepting requests based on the path set in ValidatingWebhookConfig. + +### Error Handling + +If the server is unable to find valid certificates, It will not deploy any admission controller components onto the cluster and hence rook will continue to function normally as before. + +# References +1. https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/ +1. https://github.com/kubernetes/api/blob/master/admission/v1beta1/types.go +1. https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/ +1. https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/ + +