From 973c3102bb550929ca77c00bfc0bc88bc373eba8 Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Thu, 21 Apr 2022 14:50:48 -0700 Subject: [PATCH 1/7] add audit logging proposal --- proposals/1141_audit-logging/README.md | 323 +++++++++++++++++++++++++ 1 file changed, 323 insertions(+) create mode 100644 proposals/1141_audit-logging/README.md diff --git a/proposals/1141_audit-logging/README.md b/proposals/1141_audit-logging/README.md new file mode 100644 index 00000000..d6ae0341 --- /dev/null +++ b/proposals/1141_audit-logging/README.md @@ -0,0 +1,323 @@ +--- +title: "Audit Logging" +authors: [ "@cfryanr" ] +status: "in-review" +sponsor: [ ] +approval_date: "" +--- + +*Disclaimer*: Proposals are point-in-time designs and decisions. Once approved and implemented, they become historical +documents. If you are reading an old proposal, please be aware that the features described herein might have continued +to evolve since. + +# Audit Logging + +## Problem Statement + +Audit logging is a requirement from most compliance standards (e.g. FedRAMP, PCI-DSS). The Pinniped Supervisor and +Concierge components should provide audit logs to help users meet these compliance requirements. + +The Kubernetes API server already supports +rich [audit logging features](https://kubernetes.io/docs/tasks/debug-application-cluster/audit/) which are implemented +by vendors of Kubernetes distributions. The Pinniped audit logs are meant to augment, not replace, the Kubernetes audit +logs. + +### How Pinniped Works Today (as of version v0.16.0) + +The Pinniped Supervisor and Concierge components are Kubernetes Deployments. Today, each Pod has a single container, +which is the Supervisor or Concierge app. Kubernetes captures the stdout of the app into the Pod logs. + +Today, the Pinniped Supervisor and Concierge log many interesting events to their Pod logs. These logs are meant +primarily to help an admin user debug problems with their Pinniped configuration or with their cluster. The Supervisor +and Concierge each offer an install-time configuration option to turn up the verbosity of these Pod logs. + +However, these logs are not meant to be audit logs. They generally focus on logging problems, not on logging successes. +They try to avoid logging anything that might be confidential or PII (personally identifiable information). Since email +addresses might be considered PII, these logs generally avoid including usernames at the default log level, since +usernames could be email addresses in some configurations. Logging the identity of actors (usernames) are a key aspect +of audit logs. + +## Terminology / Concepts + +None. + +## Proposal + +The goal of an audit log is to log events that could be helpful in a forensic investigation of past usage, including the +actor (the username) and the actions that were taken on the system. + +### Goals and Non-goals + +Goals + +- Auditing events relating to upstream identity provider (IDP) authentication, refresh, and sessions. +- Auditing events relating to minting and validating cluster credentials. +- Enabling auditors to easily stitch together authentication events into an audit trail. +- Provide consistent data across auditable events. +- Provide the ability to enable and disable auditing. +- Provide the ability to route audit logs to a separate destination from the rest of Pinniped’s logs. + +Non-goals + +- Enabling auditing in the impersonation proxy. If needed, this will be handled in a separate feature. +- Providing the ability to filter or choose which audit events to capture. +- Auditing the management of CRs (e.g. OIDCIdentityProvider). These events are captured by the API server audit logs. + +### Specification / How it Solves the Use Cases + +This proposal recommends following the recommendation of the Kubernetes docs to create a separate Pod container log. +This new container log will contain the audit logs (and only the audit logs). + +#### API Changes + +##### Configuration Options + +There will be very few user-facing configuration options for audit logging in the first version of the feature. If later +found to be needed, more configuration could be added in future versions. + +This proposal recommends adding a single on/off install-time configuration option for disabling audit logs. By default, +audit logs will be enabled. An admin user who is concerned about logging identities, for example because usernames may +be considered PII, may disable audit logging. + +Like other install-time configuration options, this option would appear in the values.yaml file of the Supervisor and +Concierge deployment directories. The selected value would be rendered into the "static" ConfigMap, and read by the +Supervisor or Concierge app's Golang code at Pod startup time. + +##### Event Data + +Deciding every specific audit event is an implementation detail beyond the scope of this proposal. + +Generally, the following data should be included with every audit event, whenever possible: + +- What type of event occurred (e.g. login) +- Outcomes of event (succeed or fail) +- When the event occurred +- Where the event occurred (Kubernetes Pod logs automatically include the ID of the Pod, which should be sufficient) +- Source of the event (e.g. requester IP address) +- The identity of individuals or subjects associated with the event (who initiated, who participated. etc.) +- Details involving any objects accessed + +The Supervisor's audit logs would include events such as: + +- Upstream logins for all IdP types (started, succeeded, failed) +- Upstream refresh for all IdP types (succeeded, failed) +- Upstream group refresh for all IdP types (succeeded, failed) +- Downstream login (started, succeeded, failed) +- Downstream token exchange (succeeded, failed) +- Session expired +- Maybe: The equivalent of access log events for all Supervisor endpoints, since there is no other component providing + access logs. This would include logging things like calls to the Supervisor's OIDC well-known discovery endpoint. + These logs could help an investigator determine more about the usage pattern of a suspicious client. +- Maybe: Newly authenticated user is associated with “admin” RBAC. Note that the Supervisor is not directly aware of + RBAC, so determining this would require otherwise unnecessary calls to the Kubernetes API server, which would degrade + the performance of the Supervisor. It's also not clear what would constitute "admin" level access, since RBAC is + configurable at a very fine-grained level. On the other hand, the Supervisor is directly aware of the user's group + memberships, which could be logged. + +The Concierge's audit logs would include events such as: + +- Token credential request (succeeded, failed, maybe maps to admin RBAC). While already captured by the API server audit + logs, those should likely be set to metadata. Duplicating the event allows for more controlled capture & management of + data. +- WhoAmI Request. While already captured by the API server audit logs, duplicating the event allows for more controlled + capture & management of data. + +Other events may be useful to auditors and may be included in the audit logs, such as: + +- Application startup with version information +- Graceful application shutdown + +##### Audit Logs as Separate Log Files + +The Concierge and Supervisor apps could each send audit logs to separate files on disk in JSON format. The performance +impact of logging to a file should be acceptable thanks to file buffering, but this assumption should be tested. Note +that this approach would not guarantee that the log statement is flushed to the file before the action is performed, +because then we would lose the benefit of buffering. It would be "best effort" to the file, e.g. the process crashing +might lose a few lines of logs. A normal pod shutdown should be able to flush the file without any loss. + +[A new streaming sidecar container](https://kubernetes.io/docs/concepts/cluster-administration/logging/#sidecar-container-with-logging-agent) +will be added to both the Concierge and Supervisor apps Deployments' Pods. These containers will tail those audit logs +to stdout, thus effectively moving those log lines from files on the Pod to Kubernetes container logs. Those sidecar +container images can be minimal with just enough in the image to support the unix `tail` command (or similar Go binary, +such as [hpcloud/tail](https://github.com/hpcloud/tail)). + +Kubernetes will take care of concerns such as log rotation for the container logs. For the files on the Pod's disk +output by the Supervisor and Concierge apps, we should research whether Pinniped should have code to avoid allowing +those files from growing too large. Old lines can be discarded since the sidecar container should have already streamed +them. + +Container logs in JSON format are easy for node-level logging agents, e.g. fluentbit, to ingest/annotate/parse/filter +and send to numerous sink destinations. These containers could still run when audit logs are disabled by the admin, but +would produce no log lines in that case. + +##### Parsing, Filtering, and Sending Audit Logs to an External Destination + +Many users will use the popular [fluentbit](https://fluentbit.io) project to filter and extract Pod logs from their +cluster. This project implements +a [node-level log agent](https://kubernetes.io/docs/concepts/cluster-administration/logging/#using-a-node-logging-agent) +which understands the Kubernetes directory and file layout for Pod logs. It also has a feature to further enrich the +logs +by [automatically adding more information about the source Pod](https://docs.fluentbit.io/manual/pipeline/filters/kubernetes) +to each event (line) in the log. It supports many configurable options +for [parsing](https://docs.fluentbit.io/manual/pipeline/parsers), +[filtering](https://docs.fluentbit.io/manual/pipeline/filters), and sending logs +to [many destinations](https://docs.fluentbit.io/manual/pipeline/outputs). + +By putting the Supervisor and Concierge audit logs into their own Pod logs, Pinniped will be compatible with any +existing node-level agent software which can extract logs from a Kubernetes cluster. This allows the Pinniped code to +focus on generating the logs as JSON, without worrying about providing any configuration options for filtering or +sending to various destinations. + +##### Audit Log JSON Format + +Each line of audit log will represent an event. Each line will be a complete JSON object, +i.e. `{"key1":"value1","key2":"value2"}`. + +Some, but not all, events will be the result of a user making an API request to an endpoint. One API request from a user +may cause more than one event to be logged. If possible, unique ID will be determined for each incoming request, and +will be included in all events caused by that request. + +Where possible, the top-level keys of the JSON object will use standardized names. Other top-level keys specific to that +action type may be added. All keys should be included in documentation for the audit log feature. + +Every event should include these keys: + +- `time`: the timestamp of the event +- `event`: the event type, which is a brief description of what happened, with no string interpolation, so it will + always be the same for a given event type (e.g. `upstream refresh succeeded`) +- `v`: a number specifying the format version of the event type, starting with `1`, to give us flexibility to make + breaking changes to the format of an event type in future releases (e.g. change the name of the JSON keys, or change + the data type of the value of an existing key) + +Depending on the event type, an event might include other keys, such as: + +- `msg`: a freeform warning or error message meant to be read by a human (e.g. the error message that was returned by an + upstream IDP during a failed login attempt) +- `requestID`: a unique ID for the request, if the event is related to an API request +- `requestPath`: the path of the endpoint, if the event is related to an API request +- `requestorIP`: the client's IP, if the event is related to an API request +- `user`: the username of the user performing the action, if there is one +- `groups`: the group memberships of the user performing the action, if the action is related determining or changing + their group memberships + +The details of these additional keys will be worked out as the details of the specific events are being worked out, +during implementation of this proposal. + +##### Audit Log Timestamps + +The date format used in the audit logs should be something which can be easily parsed by fluentbit, to make it easy for +users to configure fluentbit. We could easily document this to provide instructions on how to configure a custom +fluentbit parser for Pinniped audit logs. We should probably +avoid [fluentbit's default json parser's](https://github.com/fluent/fluent-bit/blob/845b6ae8576077fd512dbe64fb8e16ff4b15abdb/conf/parsers.conf#L35-L39) +date format, which assumes dates will be in an ugly format and also lacks sub-second precision +(e.g. `08/Apr/2022:19:24:01 +0000`). + +fluentbit uses [strptime](https://linux.die.net/man/3/strptime) +with [an extension for fractional seconds](https://docs.fluentbit.io/manual/pipeline/parsers/configuring-parser#time-resolution-and-fractional-seconds) +to parse timestamps. + +It would be desirable for a timestamp to: + +1. Be human-readable (e.g. not seconds since an epoch) +2. Be easily parsable by log parsers, especially fluentbit +3. Be expressed in UTC time +4. Use at least millisecond precision +5. Use the consistent JSON key name `time` + +[Syslog's RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.3) defines a timestamp format which meets +the above goals. An example timestamp in this format is `2003-10-11T22:14:15.003` which is represents UTC time on +October 11, 2003 at 10:14:15 pm, 3 milliseconds into the next second. + +Given this timestamp format, the following fluentbit configuration could be used to parse Pinniped's audit logs. + +``` + [PARSER] + Name json + Format json + Time_Key time + Time_Format %Y-%m-%dT%H:%M:%S.%L +``` + +#### Upgrades + +Since audit logs will be output to a new location, there are not any backward compatibility concerns for them in the +first release. + +Adding a second container to the Pods in generally not noticeable by a user, but may have some impact on existing +installations in some rare cases, so it should be explained in the release notes. For example, a GKE Ingress will, by +default, read the Pod's container definition to try to guess the health check endpoint for the backend Service of the +Ingress. When there is only one container, it will try to guess, but where there is more than one container it will give +up on guessing and instead expect the user to configure the health checks. So upgrading could break the health checks of +a GKE Ingress, if no health checks were configured. + +#### Tests + +Audit logging will be a user-facing feature, and the format of the logs should be considered a kind of documented API. +Unnecessary changes to the format should be avoided after the first release. Therefore, all audit log events should be +covered by unit tests. + +This implies that it may be desirable for the implementation to involve passing around a pointer to some interface to +all code which needs to add events to the audit log. Such an implementation would make the audit logs more testable. A +production code implementation of the interface should take care of common concerns, such as adding the timestamp, +deciding required key names, and formatting the output as JSON. A test implementation of the interface could handle +those common concerns differently to make testing easier. + +#### New Dependencies + +- We might want to consider using a library like [zap](https://github.com/uber-go/zap) to aid in implementation, but + that is already an indirect dependency of Pinniped. +- The new streaming sidecar container will need a container image. Using the existing pinniped-server container image + seems desirable. It is a distroless image, which is good for security. And it is the only image that we currently ship + in Pinniped releases. One option to make this happen would be to implement the tail command in Go, but any binary that + can work in a distroless image should be okay. We should avoid adding linux standard libraries to the container image, + so the binary should be statically linked with no external dependencies. The binary should support the same OS and + architecture that our existing Go binary supports. + +#### Performance Considerations + +By using buffered output to write to the audit log files, there should not be any meaningful performance impact. This +assumption should be tested. + +#### Observability Considerations + +Auditing will improve operator observability, as described in the other sections of this document. + +#### Security Considerations + +The audit logs will be Pod container logs, so the contents of the logs will be protected by Kubernetes like any Pod +container logs. + +#### Usability Considerations + +By using Pod container logs, the user will have many options to manage these logs. + +#### Documentation Considerations + +The supported audit event types, and they JSON keys output for each event type, should be documented. Users should be +able to build their own parsers for these events based on the documentation. + +If the production code implementation of the audit interface used Golang constants for all allowed JSON key names and +event type names, and otherwise enforced certain standards, then it may be possible to auto-generate (or nearly +auto-generate) the documentation for the audit event types. + +### Other Approaches Considered + +None yet. + +## Open Questions + +- Should we output events that can function similar to access logs for the Supervisor endoints? +- Should we try to somehow detect that a user is "root-like"? + +## Answered Questions + +None yet. + +## Implementation Plan + +The maintainers will implement these features. It might fit into one PR. + +## Implementation PRs + +*This section is a placeholder to list the PRs that implement this proposal. This section should be left empty until +after the proposal is approved. After implementation, the proposal can be updated to list related implementation PRs.* From dfbc33b933cdb5e43982c821fe5fbf65192b95be Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Mon, 2 May 2022 09:47:09 -0700 Subject: [PATCH 2/7] Apply suggestions from code review Co-authored-by: Mo Khan --- proposals/1141_audit-logging/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/proposals/1141_audit-logging/README.md b/proposals/1141_audit-logging/README.md index d6ae0341..bc64a476 100644 --- a/proposals/1141_audit-logging/README.md +++ b/proposals/1141_audit-logging/README.md @@ -25,7 +25,7 @@ logs. ### How Pinniped Works Today (as of version v0.16.0) The Pinniped Supervisor and Concierge components are Kubernetes Deployments. Today, each Pod has a single container, -which is the Supervisor or Concierge app. Kubernetes captures the stdout of the app into the Pod logs. +which is the Supervisor or Concierge app. Kubernetes captures the stdout and stderr of the app into the Pod logs. Today, the Pinniped Supervisor and Concierge log many interesting events to their Pod logs. These logs are meant primarily to help an admin user debug problems with their Pinniped configuration or with their cluster. The Supervisor @@ -59,7 +59,7 @@ Goals Non-goals -- Enabling auditing in the impersonation proxy. If needed, this will be handled in a separate feature. +- Enabling Kubernetes API request auditing in the impersonation proxy. If needed, this will be handled in a separate feature. - Providing the ability to filter or choose which audit events to capture. - Auditing the management of CRs (e.g. OIDCIdentityProvider). These events are captured by the API server audit logs. @@ -252,7 +252,7 @@ a GKE Ingress, if no health checks were configured. #### Tests -Audit logging will be a user-facing feature, and the format of the logs should be considered a kind of documented API. +Audit logging will be a user-facing feature, and the format of the logs should be considered a documented and versioned API. Unnecessary changes to the format should be avoided after the first release. Therefore, all audit log events should be covered by unit tests. From 831abc315ee10fccf099fb68023e49342dbb2cf0 Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Mon, 9 May 2022 14:45:18 -0700 Subject: [PATCH 3/7] Update audit log proposal key names and timestamp format --- proposals/1141_audit-logging/README.md | 39 +++++++++++++++++--------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/proposals/1141_audit-logging/README.md b/proposals/1141_audit-logging/README.md index bc64a476..4ebe9cc9 100644 --- a/proposals/1141_audit-logging/README.md +++ b/proposals/1141_audit-logging/README.md @@ -59,7 +59,8 @@ Goals Non-goals -- Enabling Kubernetes API request auditing in the impersonation proxy. If needed, this will be handled in a separate feature. +- Enabling Kubernetes API request auditing in the impersonation proxy. If needed, this will be handled in a separate + feature. - Providing the ability to filter or choose which audit events to capture. - Auditing the management of CRs (e.g. OIDCIdentityProvider). These events are captured by the API server audit logs. @@ -170,6 +171,12 @@ sending to various destinations. ##### Audit Log JSON Format +The +[format of Kubernetes audit logs](https://github.com/kubernetes/kubernetes/blob/d0832102a7017e83bf47a5137b690e52f19c267c/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go#L72-L142) +is not a perfect fit for Pinniped. The Kubernetes audit logs are strongly oriented towards API requests for Kubernetes +resources, with many of the fields representing the details of a request and response. The format of the Pinniped audit +logs will draw inspiration from the Kubernetes audit events without trying to directly copy them. + Each line of audit log will represent an event. Each line will be a complete JSON object, i.e. `{"key1":"value1","key2":"value2"}`. @@ -194,11 +201,15 @@ Depending on the event type, an event might include other keys, such as: - `msg`: a freeform warning or error message meant to be read by a human (e.g. the error message that was returned by an upstream IDP during a failed login attempt) - `requestID`: a unique ID for the request, if the event is related to an API request -- `requestPath`: the path of the endpoint, if the event is related to an API request -- `requestorIP`: the client's IP, if the event is related to an API request -- `user`: the username of the user performing the action, if there is one -- `groups`: the group memberships of the user performing the action, if the action is related determining or changing - their group memberships +- `requestURI`: the path of the endpoint, if the event is related to an API request +- `verb`: the REST method called on the endpoint, if the event is related to an API request +- `sourceIPs`: the client's IPs, if the event is related to an API request +- `userAgent`: the user agent string reported by the client, if the event is related to an API request +- `user`: a nested structure which can include the `username`, `groups`, and `uid` of the user performing the action, if + there is one + +The names of many of these keys are purposefully similar to the names of the keys used by Kubernetes audit events to +make them feel familiar. The details of these additional keys will be worked out as the details of the specific events are being worked out, during implementation of this proposal. @@ -224,9 +235,11 @@ It would be desirable for a timestamp to: 4. Use at least millisecond precision 5. Use the consistent JSON key name `time` -[Syslog's RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.3) defines a timestamp format which meets -the above goals. An example timestamp in this format is `2003-10-11T22:14:15.003` which is represents UTC time on -October 11, 2003 at 10:14:15 pm, 3 milliseconds into the next second. +Golang's standard library's [interpretation](https://pkg.go.dev/time#pkg-constants) of RFC 3339 with nanosecond +precision defines a timestamp format which meets the above goals. An example timestamp in this format, printed +by `fmt.Println(time.Now().UTC().Format(time.RFC3339Nano))`, is `2022-05-09T21:32:59.811913Z`, which represents UTC time +on May 9, 2022, at 21:32:59 pm, 811913 nanoseconds into the next second. Note that trailing zeros on the nanoseconds are +dropped, so the length of the nanoseconds field is variable in the output. Given this timestamp format, the following fluentbit configuration could be used to parse Pinniped's audit logs. @@ -235,7 +248,7 @@ Given this timestamp format, the following fluentbit configuration could be used Name json Format json Time_Key time - Time_Format %Y-%m-%dT%H:%M:%S.%L + Time_Format %Y-%m-%dT%H:%M:%S.%LZ ``` #### Upgrades @@ -252,9 +265,9 @@ a GKE Ingress, if no health checks were configured. #### Tests -Audit logging will be a user-facing feature, and the format of the logs should be considered a documented and versioned API. -Unnecessary changes to the format should be avoided after the first release. Therefore, all audit log events should be -covered by unit tests. +Audit logging will be a user-facing feature, and the format of the logs should be considered a documented and versioned +API. Unnecessary changes to the format should be avoided after the first release. Therefore, all audit log events should +be covered by unit tests. This implies that it may be desirable for the implementation to involve passing around a pointer to some interface to all code which needs to add events to the audit log. Such an implementation would make the audit logs more testable. A From 3cf3b28c5b0a24b5f9adf08fb40cb0716e42034e Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Wed, 22 Jun 2022 15:12:28 -0700 Subject: [PATCH 4/7] Update audit log proposal --- proposals/1141_audit-logging/README.md | 41 +++++++++++++++----------- 1 file changed, 23 insertions(+), 18 deletions(-) diff --git a/proposals/1141_audit-logging/README.md b/proposals/1141_audit-logging/README.md index 4ebe9cc9..994b996c 100644 --- a/proposals/1141_audit-logging/README.md +++ b/proposals/1141_audit-logging/README.md @@ -77,8 +77,7 @@ There will be very few user-facing configuration options for audit logging in th found to be needed, more configuration could be added in future versions. This proposal recommends adding a single on/off install-time configuration option for disabling audit logs. By default, -audit logs will be enabled. An admin user who is concerned about logging identities, for example because usernames may -be considered PII, may disable audit logging. +audit logs will be disabled. Usernames may be considered PII, so disabled by default avoids potentially logging PII. Like other install-time configuration options, this option would appear in the values.yaml file of the Supervisor and Concierge deployment directories. The selected value would be rendered into the "static" ConfigMap, and read by the @@ -106,20 +105,23 @@ The Supervisor's audit logs would include events such as: - Downstream login (started, succeeded, failed) - Downstream token exchange (succeeded, failed) - Session expired -- Maybe: The equivalent of access log events for all Supervisor endpoints, since there is no other component providing +- The equivalent of access log events for all Supervisor endpoints, since there is no other component providing access logs. This would include logging things like calls to the Supervisor's OIDC well-known discovery endpoint. These logs could help an investigator determine more about the usage pattern of a suspicious client. -- Maybe: Newly authenticated user is associated with “admin” RBAC. Note that the Supervisor is not directly aware of - RBAC, so determining this would require otherwise unnecessary calls to the Kubernetes API server, which would degrade - the performance of the Supervisor. It's also not clear what would constitute "admin" level access, since RBAC is - configurable at a very fine-grained level. On the other hand, the Supervisor is directly aware of the user's group - memberships, which could be logged. +- The identity (username, group memberships) of newly authenticated users +- Newly authenticated user is associated with “admin-like” RBAC. Any user that is allowed to perform + `verbs=* groups=* resources=*` according to a subject access review API call shall be considered "admin-like". + This would only indicate that the user has "admin-like" permissions on the Supervisor cluster itself, not on other + workload clusters, since the Supervisor is not aware of the RBAC settings on the workload clusters. The Concierge's audit logs would include events such as: -- Token credential request (succeeded, failed, maybe maps to admin RBAC). While already captured by the API server audit +- Token credential request (succeeded, failed, maps to admin RBAC). While already captured by the API server audit logs, those should likely be set to metadata. Duplicating the event allows for more controlled capture & management of data. + - Similar to the Supervisor, the TCR endpoint could log when an authenticated user is associated with “admin-like” + RBAC. Any user that is allowed to perform `verbs=* groups=* resources=*` according to a subject access review API + call shall be considered "admin-like". - WhoAmI Request. While already captured by the API server audit logs, duplicating the event allows for more controlled capture & management of data. @@ -140,7 +142,8 @@ might lose a few lines of logs. A normal pod shutdown should be able to flush th will be added to both the Concierge and Supervisor apps Deployments' Pods. These containers will tail those audit logs to stdout, thus effectively moving those log lines from files on the Pod to Kubernetes container logs. Those sidecar container images can be minimal with just enough in the image to support the unix `tail` command (or similar Go binary, -such as [hpcloud/tail](https://github.com/hpcloud/tail)). +such as [hpcloud/tail](https://github.com/hpcloud/tail), although that particular example library may not be maintained +anymore). Kubernetes will take care of concerns such as log rotation for the container logs. For the files on the Pod's disk output by the Supervisor and Concierge apps, we should research whether Pinniped should have code to avoid allowing @@ -189,7 +192,7 @@ action type may be added. All keys should be included in documentation for the a Every event should include these keys: -- `time`: the timestamp of the event +- `timestamp`: the timestamp of the event - `event`: the event type, which is a brief description of what happened, with no string interpolation, so it will always be the same for a given event type (e.g. `upstream refresh succeeded`) - `v`: a number specifying the format version of the event type, starting with `1`, to give us flexibility to make @@ -198,7 +201,7 @@ Every event should include these keys: Depending on the event type, an event might include other keys, such as: -- `msg`: a freeform warning or error message meant to be read by a human (e.g. the error message that was returned by an +- `message`: a freeform warning or error message meant to be read by a human (e.g. the error message that was returned by an upstream IDP during a failed login attempt) - `requestID`: a unique ID for the request, if the event is related to an API request - `requestURI`: the path of the endpoint, if the event is related to an API request @@ -209,7 +212,8 @@ Depending on the event type, an event might include other keys, such as: there is one The names of many of these keys are purposefully similar to the names of the keys used by Kubernetes audit events to -make them feel familiar. +make them feel familiar. Also, where it makes sense, the key names should be similar to +[those used in the Pinniped Pod logs](https://github.com/vmware-tanzu/pinniped/blob/main/internal/plog/zap.go#L104-L120). The details of these additional keys will be worked out as the details of the specific events are being worked out, during implementation of this proposal. @@ -233,7 +237,7 @@ It would be desirable for a timestamp to: 2. Be easily parsable by log parsers, especially fluentbit 3. Be expressed in UTC time 4. Use at least millisecond precision -5. Use the consistent JSON key name `time` +5. Use the consistent JSON key name `timestamp` Golang's standard library's [interpretation](https://pkg.go.dev/time#pkg-constants) of RFC 3339 with nanosecond precision defines a timestamp format which meets the above goals. An example timestamp in this format, printed @@ -247,7 +251,7 @@ Given this timestamp format, the following fluentbit configuration could be used [PARSER] Name json Format json - Time_Key time + Time_Key timestamp Time_Format %Y-%m-%dT%H:%M:%S.%LZ ``` @@ -319,12 +323,13 @@ None yet. ## Open Questions -- Should we output events that can function similar to access logs for the Supervisor endoints? -- Should we try to somehow detect that a user is "root-like"? +None. ## Answered Questions -None yet. +- Should we output events that can function similar to access logs for the Supervisor endpoints? + Yes (paragraphs above updated). +- Should we try to somehow detect that a user is "root-like"? Yes (paragraphs above updated). ## Implementation Plan From 5b0c165dc8297967bd323e793acf9d086bb25c20 Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Tue, 28 Jun 2022 12:44:41 -0700 Subject: [PATCH 5/7] fix usage of base64 in hack script --- hack/prepare-supervisor-on-kind.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hack/prepare-supervisor-on-kind.sh b/hack/prepare-supervisor-on-kind.sh index 6a573b1c..a56e5970 100755 --- a/hack/prepare-supervisor-on-kind.sh +++ b/hack/prepare-supervisor-on-kind.sh @@ -254,6 +254,13 @@ EOF --dry-run=client --output yaml | kubectl apply -f - fi +if [[ "$OSTYPE" == "darwin"* ]]; then + certificateAuthorityData=$(cat "$root_ca_crt_path" | base64) +else + # Linux base64 requires an extra flag to keep the output on one line. + certificateAuthorityData=$(cat "$root_ca_crt_path" | base64 -w 0) +fi + # Make a JWTAuthenticator which respects JWTs from the Supervisor's issuer. # The issuer URL must be accessible from within the cluster for OIDC discovery. cat < Date: Thu, 21 Jul 2022 17:51:26 -0400 Subject: [PATCH 6/7] =?UTF-8?q?Update=20current=20maintainers=20=E2=9C=8C?= =?UTF-8?q?=EF=B8=8F=F0=9F=91=8B=F0=9F=AB=A1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Monis Khan --- MAINTAINERS.md | 7 +++-- .../pinniped/layouts/partials/team.html | 27 +++++++----------- .../pinniped/static/img/ben-petersen.png | Bin 0 -> 17231 bytes .../pinniped/static/img/margo-crawford.png | Bin 37975 -> 0 bytes site/themes/pinniped/static/img/mo-khan.png | Bin 20615 -> 0 bytes .../pinniped/static/img/nanci-lancaster.png | Bin 31548 -> 0 bytes .../pinniped/static/img/nigel-brown.png | Bin 0 -> 9225 bytes 7 files changed, 14 insertions(+), 20 deletions(-) create mode 100644 site/themes/pinniped/static/img/ben-petersen.png delete mode 100644 site/themes/pinniped/static/img/margo-crawford.png delete mode 100644 site/themes/pinniped/static/img/mo-khan.png delete mode 100644 site/themes/pinniped/static/img/nanci-lancaster.png create mode 100644 site/themes/pinniped/static/img/nigel-brown.png diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 1c4a9697..2852926b 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -4,21 +4,22 @@ This is the current list of maintainers for the Pinniped project. | Maintainer | GitHub ID | Affiliation | | --------------- | --------- | ----------- | -| Margo Crawford | [margocrawf](https://github.com/margocrawf) | [VMware](https://www.github.com/vmware/) | -| Mo Khan | [enj](https://github.com/enj) | [VMware](https://www.github.com/vmware/) | | Anjali Telang | [anjaltelang](https://github.com/anjaltelang) | [VMware](https://www.github.com/vmware/) | | Ryan Richard | [cfryanr](https://github.com/cfryanr) | [VMware](https://www.github.com/vmware/) | +| Ben Petersen | [benjaminapetersen](https://github.com/benjaminapetersen) | [VMware](https://www.github.com/vmware/) | ## Emeritus Maintainers * Andrew Keesler, [ankeesler](https://github.com/ankeesler) * Pablo Schuhmacher, [pabloschuhmacher](https://github.com/pabloschuhmacher) * Matt Moyer, [mattmoyer](https://github.com/mattmoyer) +* Margo Crawford, [margocrawf](https://github.com/margocrawf) +* Mo Khan, [enj](https://github.com/enj) ## Pinniped Contributors & Stakeholders | Feature Area | Lead | | ----------------------------- | :---------------------: | -| Technical Lead | Mo Khan (enj) | +| Technical Lead | Ryan Richard (cfryanr) | | Product Management | Anjali Telang (anjaltelang) | | Community Management | Nigel Brown (pnbrown) | diff --git a/site/themes/pinniped/layouts/partials/team.html b/site/themes/pinniped/layouts/partials/team.html index c8c16375..991bfc2d 100644 --- a/site/themes/pinniped/layouts/partials/team.html +++ b/site/themes/pinniped/layouts/partials/team.html @@ -3,23 +3,9 @@

The Pinniped Project Team:

-
+
-

Margo Crawford

-

Engineer

-
-
-
-
-
-

Mo Khan

-

Engineer

-
-
-
-
-
-

Nanci Lancaster

+

Nigel Brown

Community Manager

@@ -37,8 +23,15 @@

Engineer

+
+
+
+

Ben Petersen

+

Engineer

+
+

Contributing:

The Pinniped project team welcomes contributions from the community, please see the contributor’s guide for more information.

- \ No newline at end of file + diff --git a/site/themes/pinniped/static/img/ben-petersen.png b/site/themes/pinniped/static/img/ben-petersen.png new file mode 100644 index 0000000000000000000000000000000000000000..871000817e586ff7f8f37b3112e8164e10fd955f GIT binary patch literal 17231 zcmV)=K!m@EP)OBLKM90+QUPTMgA*bV343j*2zQs$&sq?9fMTF9!ktM_)@dx5qJ zx4J|wa2XYuN&-d@kXZ(qrwGa@i82WU(&x1~@8A9MZ$jn-&RS=kbN2r3@9=z{`T6dB z4(xpozfM2>^us>!iBDYaHLrQiWncNqS6=3_m%Z#&e&ttwdS3Y^#X{UYhVi&vE7q5BEYyQJ+ZgZQ{zE{cg|F8CYWCa82<^SoQ{^`j1{OJMa z`k(&vr?2z&x4-=wC!BD?)d!GE-~H})-}~vG{^`B>zBeH6O}h=)-j?Z@*Vn)P^}PXk z`~2b;zqmJj?S1M~pW6G!fBeTUP2ZoGK0fh%-}ikVnSS1N>Zzx`eSm+*10VRnFMN-X zYMbWw1i(8`?>6(j?*MYE`8*s*BYk_H{p@G={_3y(YVQ@Vc*WiouXx41U;3qA+WWB| z`?0;l4?lccpmu;xdi@4!0N2j|x;G&1ee#o^-22RDKC}1LuYPsA?oyY!)b=@`JO9V1HKv{M_e0_s|c2_`^5+(I5TMn;m`h(RUnz-s<8Pzxd?` zn9;BYHh_TZh42Af>)w^GeB}+`Bz2Wu*Lnx6{(SfT@|VB7_cwp@H+vuZ z*vB@2FL8-W>|OGbm)zO|f7JNi%wzA;m%g<2r_LN+GwojfxzBy>jjw+7tKW6fNhf{R zsq*hCfZy_#w_I$b@D3wI51;Qp`9t%%^{sDx7$Q@-feKhe2i&O5y?4Ch9eXc*=}Y&n zd)@195wh~E{oc9$sl!;WeA?5V_Vw=;$^NbYc$}Ln4H0iKg#LF!xT8kx z9{7vD_=~-w!KHnr|CD}IN%;X>v`j| zp7pF#E^44JQh*28OAgWQHlRLmyw+O|(JwKdoAmtIpZ(be((P_{yS=Mk^{V>-BlZe5 zse9{N-?|U*FaPo{Z?-t84cP2(>Nqv89VP)FP^swg%r`r1EMSK1p7eFNAz z48b{Lw@*I#13gOFCz%tI%|j+10*W|ICLz^r7$P++SE=UuXco?|tvP>@4ax#^e0wL+m34;6vF~ga;a; zTa+Ry>P4Z)t&Kxb0jyYy+8*@EmWWS4RNvyi-zzI3yT>eRs@vc9kSen6&rfKmOwzGh}=7gn`5v0`R-u^{&02 z`I(>D-o>s!P6}flV<9w&6WbPU`AyZ5K0wka7z!{XnDmlV48zG1Dp?Dra9%rOanOWW z)?h95!7nhDerTqd$NT5pf0%2Zb3r;`7bw63(0>_%JZu(m2!eSdE^a4f2#`0M-EvGD z0P~J-a+90v-Rx#J+u9>wp^-MgBIT2d-X!COH@xBIXdyPhNSBZaD8SC1`p%|)@Pi-R zz|iIc^u1%g(}o%U z^O&H=-RoZW`c~%Ve12UJ03Ue7BOY<&QAZv1ABW&~q~ZWmtZ88uTr$G%z)woGebbxX zwD?$CVUI3CPjtz$l*laZih%M%Pz3pvp+lX(h%tH3uxa=hc$#E;bPQqPd zPF?`RMCQ)vqjtThWSRgYkyZ?%Pi@U%7dCCGUYq<3OhePm+`c&s|AHCw3CA9LEC=j- zeVy+Bk5hE3A;RyDe+8nMY=GBcH_)!&XGO=WK4Ylhj%M(C7C5N^lNNVwo{|~&Kc=79%kW5 zv%@45ld#*aF+XGZ1UjIN>o@5x0h75v7r#ACice`b20Ngd_nC_?U)DC4H_PZL`mWuF*e0^A`Ywk=SRd zRv#Eizch$cDOGKKK-0H%{q5iW?Pdzh*}BaMZPFMqI`F;Zw`cvoHvOD9;new(?mXWB z9`*9ChM12V)pSLRKt!s{f-RuL0KkPA0M4Ewf<@=30QkM{eeWj0qzl0M13p4~s~%wh zl0uewbjVgZkyWhPxVc@1MtlfMt1*Qw&3Kzxs`oy&6nSZfk(9aIz{Oj?=|7e`AZd~kCupmNS^N)>!vro=_b`Q02K|SBab|CZ=9S>GF@Bg5Xj~YG>ij4 zOkfQFwl-r^(|`Tff4xb#Yx5Pf*9Wkzm(A6W@zIE?H>Xu|k#^$^0~|A(7yjS#fbDka zc>I zSBx3w>$i}HJq%1KM8rZsOhLW=@DKm+rka7WCNu7M$2;!LdbVo;L-Ku=`wnzWMM5!9 z^TJg6#4w~Dh}MAVm$KG$W)^91nS z?sm8P4N(8r5b%mi5Wh(si36}j6$&8^0^`~e2vncY0x^8g@j@(w(^teTPIinmAP8^~ zi1heP!V#A@O+_L&DJMw?tv#@lG;=a{ww?o4%ne}k0(fCorUV$q%%qT%HVXjIJoSlj z+5JMR0Cvn=(8t_p1M^rzDBow!pByH8!12c)|3A*HB%fP=51Ass?FWpPj7>V!LJkDe2&tWPM&SP`j=zGcCptv+4vWo@nnp8l=dXR$ISwa%CtlVZFyn&agHN{-Mfn8mpYE~P+e z#97NJ!#ub7z2E!2bCvZvR{-Dn&UZd~Ch>y;Jr!)^OVl6}0cMoG7 z^UP;H^BjYGjsccio|@|ihl}l4+yIN)0c>IbCc!||#-dWSR4Y&lZ%Cz3Kwyj0h6^hlW(AWM!Eq9oZlLlruVSKeBmq5#ffDN=JK!I_f6 zHf`G`qz`K}CR4ynU<{1g+O==L7aCzueO2Cct+8CokHFY7=aiivS295n4fAAAquG3&c2pLf8n=r@k=E z&hy*|=X&!i4~+>BzMUCmtO7dwZ+yf}a{x{Kml}0E4W;h@avWgA_WIV(ZadGWQK)vN zh1BZ{puUrO06SLUB_G5!Xj3dbYd?MZ{ZA8JJYkYRXFEnd+W?Qte(0!@M-P$y{S1DX z1*9T#9xTFf3pR18r-VC#cp++u1YF8q#w^-cbZI;wvta>_aM{zf1enxdEX>xc;~2m@ zZ(je#+Ig!RaHPbW-ScVQ*2QO#v;j(6bj;WIIbX(QcD(hQDWP=$*JeJa~w|V-K8t{ zLq{|=7mk{Fp({Ggc<-5Y{L1s5_q_L<9gxo!z+-c-Fa&(nNW_gw+aXAae2X=C6EO+I zUQ?77SPt35Q(FjDES#z<0a6@V6=<#Q01#str#Gf@%qJoq3~CJ4@y0fOz#GFl%u%62 zMa!Ci!0B==fD3($6~j>H5*NS=7!2Y#Mglmg^zvIfF)*g!Me93fuVe@Zi;6ZMOtst6 zWH-nN@$>I9pJ$orI$HqW^Pcy7>VSA0AWbft6~HFvSc!oEE*}h}q?F`ZXl27}9)>8z zM|#+0W2JJnLljyeyH$lI8>W4>8L?awumJV$curb7J@T#tfT{-aYhU}?Z63gLz2gW@ z{Z|5Xt$C%&fdWvBQ2rTha<^3wk^}>OjSF)yvbBXe+K>Q%kw#3ynIYAxNYzj+GVd04G?R&PPDhzHV zeR;z;&^d%f7z^|rphAmMj!KKvn5vBH^Jqz`w$vG?gq_74giUe@Aaoi*f7CK5rh2Pp>BBtDrB{2kv?0X-*1Xu(Xoo)Tp#pFoewqZJn1r(yz^*IL zomrc)Pnmh#bP^yRIx{IgQ-F^-=9nKGBE5DxyKc6jSS?Su$_HW=LjpX2eaCfi9;X4f zmdZpBlh)35oA_X0>)Olq@vsP5=gEmz37Em&|6;#Q2_6@ zFuiIDGj}?(*!WBVp0Mb*2EgN|vqQ6KIWPfi;w24I&n6B;i}lu~TRS)og$2MeL2)on z*0=D4iUTZF-99IF&2hlD10s8BZUBwJEIz`ns=EwTfE^5WfM=-rjEWve zH-@mjc2OE9N39(l9Lu)k5&IfzzVRWexA<`%8xg$Ncdh|M95@gM5YnkL`Wv zEa0irc+1463M;n(t=KFgM_{%ESE|VPt}V~lge{090tsk<)Mu$iePISk0Yn3S1@_c) zb}t|*v1Mm{79OpR*Xl_p{YgUSB3j3Do*d7+!&dydaz`3}S z;{iO!0TI9eF=;y|5Px^$^!7;#3keXdeN@hodhO?K{f#L4ML0z8Moa`Od}?mH?9RSJ zl?rx#b(FHRj(M+=yxQY6UmkO(I(^!?;l3&Bt%{VF%#>uBNFIPmBn^`tC4u@u$F?ug zVAg1CD%o{tv)bPhK1BnoX5E>j=Zu>E)w2Y6?j(4?sGi?PTwI5MbxOrJo)cj5&h0WR z`!TS)3x4)ze|GbP+b~XrmxBdTwbgboa;Dg0Ne%!QTff>OTq)6#Er?W`d<1jpo%F6? z26CZNYI+TwQiT!9HO)xPpQ(LUKFtA9fZXB=kpfGb^3JPdrhX5$#YuTY zNix=c^;bBEso7!XCC1NmF+l(`$MWs@D;Qm$KD}CpzJ-87M)cyP1DJ*ccuuVE6(m|~ zpE zi{Wqy0em-Us$BTNc9URCQGGZkj8g{Wz>RwYIdDopuJ*Gv9_&;Fdj0sptXtEkm%QDrcEQMFNB@ubSNq{01PMc4T;rf=Oq89mknvpn!`&K*Ja&P9;%s zoETeON)F)kc83%;rP_;a10Zl$=PLWPCPQ+hR&^djM7$CUfFY^0j-8&sZ9kdywMzrD zit(*6bzaJ`43ukgPSG>ljXtEGP!Jkzs;!rDZKr0Qy)nY6V$Ke$rw{#(o!fb~otXOo z&%?fcY$o*X;g-YNNM-_EjEgJ=QA(Q?e_9Aa8q@~z``qU~`$>-WKJf}&tF2IoS_VY9 zTOj$)z5%%Lsxkq(GGUIBHi1-9q7;AW%XCrm^*NVFZy*| z@AgMyLb1Q`TQd+#ZDNKt6|A*y{Q@?|nCC%E0Z{LTvr8FYSyZ8ReZV z5HSHv+Kp8OsSHpX2@to~6k}-HXKfLQv%(w{TT*|n17hAW2C`S11m*Yu$r=$kJIbka zy|HK->%*+2EGsmigLRbUvPKf=U4Joed2DUFp^b!^ds~Ui$_4NmM_VgeWT(sO&D?K2 z4}jTX;tk-rb;H9?-Zuaop@RU%Apiu7iLaid0d*MX6sO54yGx+t0nWy``n5>v8DY8; zAuhB?65@^PO*|(ef>hK`ljOL#wz{ji(hij!lUnPjI#s$4fn7&)uz^0i_t$m$C>zxt zul3GCOi(tj-I3HJ2F3uKNObYr+S_A=cGl3|tV)Myg-!s*e6i>!XyhX#IZOak*2n} z0FrHLN1=1Yt`*9i2R0B8uv<>6Y{f*Yv%x{(k&^)JT$}%3!BnL_0iI7l`rGF$WT9%E zSMV2?m*mmDWJde79mA~Nr6~39ywJxh+q-TAFt-vo=5Jh@L4O!x_gJP)8^lQY4%y*M zRpDUy^P$@*V+OCH0I^B%BqjdET=ahqNOR3$+aSOR;9}e|HU?b*&V_g0t_IJx(xxOj zt~N0GUac;X{TfUi;fd5zs63Tk>NqG^D1rb6%pu zqmR0#;Ku82EwZ|Frdv$`0p$}~^O8~QPs!`q86?5e*mD2PZp?lmB z#)-(JGw+@BVMz02qj#!r(*VYz(#xS^O6%Z=$y3Y2+iqJVL4&1oD?R|s{7e2=JCOBR zJ-PaMK2H%%47-MkdE4l&{b-Hj<_^sNdSLAD_m5=QwQ-v@agc{vJXmM~u+)a{0bGjE z!f${3+i#02!Qs0>n-J+mWFT?M0PMG%te4|$QbTAURLLrFQJCNpBX&PA;4G3oBSnZC z$gVZ_`Zh0PBCd6$QH%v3bN{D&GD`kX*TP0pUA(=fd3TA7{hWVcmbIs%&5t%U=3M&+vq}De2L_C54~QoYK-VcP zhCqNlIE$jQ;zEn}iUCp&h&D{KEt<;oyRD<74MBjASIK5~2S9g1=zH~Y9nbz}534Gr zauNLvZ+OF|%DSBe@w#&{J8to9+0|D!$+-?ewR62E_V{GaWv(y_1|Ze0&t#Y@FqtL{ z&B1G*G%ZrPmK_G1>#eukbW#l1_MBnx+Gh?c=oB_ZpJM;8NrLCPSI&Cwb6_~{$Qk5K zv)IG)(AEr2u6On?J68R-a78S`cIXwQ9$|e>dEER^XB5rVl8*Id{ z81CADvbgpSlZYf4XzgayPhp<1*7=vb*H6U)%!gq}9;tL3kme?pYP>w|?t4y)X}9LY z+ul^R$#tA3Yvo&@MRwCC<}qJm2XHESEyt!YyLRK89mB8dm}@^Z^S#r7afqHYjsL9+ zv!h8PVwcDOb_s>HaptzC+6`o)>?*F7kvXV*wT5A@`PQg_s-{vv+B#bIfH;s-DbM7 z#c3IQ@A!f0LIVFkF{dn(&G3^MEbH2}Y54jh$UPmQ(sQe}Cq*`5;UEjFn)2$f8V zyH|;trn2*5ad7*ZIAaJ~b;)J{1q+;y@NBbJw|7LCc50em%(jB-8brf{F=-)S4k5xN zy{;wM#l-8zg36FNIH|`fLdNRW*}Pg>NQ&BUko?v`>g}>Y>H3M#IKw*mK|9Qx^s?~60}f6t(ugZ9#?U&fYg2>ixe9o z2=3)zl-04YOoRAY$uM=3$E|;=tISiSx73w!%+VXyS9s7*_3ShfB6tI~ghR~fc!{3E zvQ&K1;k^E9>$qb~1*u8xV^|@R;)_Q^U{Kz-ElEs@`Ot7^Vf@m==;7U_i0*7yf$jUM zmeatQ%N=7p6~L!EnFPlTCAU|}3}DCF6d^0S001BWNkl3;GE79FWpqvd28iJ+Swv(WQVQCG1{xxpBl$(G)AEuXUn{3h0I*4Idc=; z(k`osER>x!J?FsWjrRdAxuG%6FCCfpnnxJG*@lw-sV^C2$~_pYQ7?0oS$Y=2aM&<5=uV^0dK3<(P{gv?)!P6qh3?Nl^*4 zs++#V&(@2En8F}KwRh{qN+<4D+5H81}GKXZV2koqS$S!{oqWQNvFb! zg^Po8rf_=Fp7)>aZ4Hh`DDwwwPnQ*g(jwg_`K*MsM`0Y`B_{%tFPMK<#$`&-&kfVD26~-NmU|joQS8 z3o_gmhr-7zqZMi9iMt`HDmWr`$4*ehdlM7mAWxaEu2 z#bK&4TqL9T*SyjK`bwSQ^43~HKYM6=cCyfm#h!@cGfZUIoShMPG4;n0yw!! zQ892e+MJv`&;ZwQd!|g%A7n^Hl3t6&B)n#mAvqHBYObCM-L01%TUd(G;;Y$a57Q9& z2oZ%uSO>{6R+|dq?mo>mb>7q2t*7lkuIr}jd=q1|i4b$94!c9Y+gVesJ&6x}&=Zr} zj96~kTrs`zyPZ}a&YL?xi{x}y9S;0V=#2lx1M@Jm)8>Lhnyy{M_zC9%VWZFa}JUbIP%dqPhsS85tV z7~i!#Z0&ZHpN%nTgyQ-VIpI(gP*?=SqL$+H)!{L)nc=8)R(p<=(Dn9-f@fDs5dWTdY47Q<^87C0gO;y zg*mu^ zX)gp?A8`+m>bKIA5jmi<9Xd>*_bNKj-gx&VCx20xqX0U?y~>w<|wg}k5dky<4Lf&o8vAQ ze=-Sv>m0aIJ04OiWrhM+$7OdG4%xqbqZqL;rY$b|;~9G-u*p{e!Z4%*aY+thb^|q4 zSmGofAe$2iIU0yv65n^{NftsQQc{uB7uGet`Q{;Kr;UwJ>)y2JVqI0PL;-Di?Qs;w z24LzmP1rxeSf_NQ+O_#%GV^Zt2Gdf83ey>{jq_y_&8x`8Jfr<8*}L@STMzu=FaF}o zrtzH+K7wSgR>vj-UQ!`-R-m2ple);J`4r>1okbXgYby*;$32`IFs0|j&IlKC73w63 z#wgrDKwi3c8X`4qZrLkDwCHRWhF$M;j4|8DU@oprg-7fjNg=Ee!m!VFTDAe9e=kky z0p>07Lrr5|J6eF8%B_ywzUc}NfNSGnAt8atRFup~2;h~v-{JG}19Law(`PXcN`fs! z#}PGqTIR&@xJTQFnEr2Jx$1!eGz-j0G7%vZfJ=f@5GU=+wY zqDV=L2vQ-#+$*S;SFR4te;{$~`p}0z%`{(Thh}QGNqedKYua{$?Dj`(rbxWcne1LH z<62+Rscn^}Y69i$%iWi4w07@oZ(1!cd{+p1oK)pK=HT;lNK&;3k)dBhpg3i%B-Peu z6`xdj^<2j#-rEd7U7H|VNph9aN?B5KBsgZsjuz+xIB64Vv{^n0CK1`IY;NkWXHS)R z%LZdAfa!z7}F0*75TrqBp2t67^5J1h)zzP|v-xh)G; z1}+~cNo^NRA>*3l$O%n?Ge>jnuZn|jG~m8*-iI|yC2VN#1iT3G_uJkwCi8ex&_|JAbr{59|Vr<`&#KOChE|_xnaP5s5fb9C7 zsbLKmPng5T`gERJ^%gVt^qd#J_{H0NNVk65y5kdL0?vBZD4|rNF+>Tj7fSUkl04zH zn33eCQGpiddD=02kxO3qjv2l(zi)qFoS*9q!CpNVA8|0CI!~f?Rx#Z1!l>-nnmR02 zTeU*zzL@Vl2?3FncT>z~=w$v}_E;Otz&KU!+`RJ>CUfS(4PaBQB zD~4nm(?m%r23!*$a7g1iJ~a5)w7rXB!&T7o)Br zP012t=mRkk(1QCHu}p#M+=Qkd4wrc(y`>b3e@Oy>@)gY8+_XcS7>foee$VkiRIl>E z{qZw^fY76x^rwy3)jBXIrqo}KlJR@SW_8`tjm5$kTI9eK&=ft99$&^G$I`wM|=W#Q8 zCxjwtYv|&<1;(9ap-dk5?R1cLj!{PQ5Jt$?7aJO&G=a?S120V35pZSh&vmqEU2B2nNgF9&_^e z4dAIL-F-TF_FQmyKp=K%c~!Y37>X6Ot4w85Yr-RYg21c#?OLiz*g)m=2Un@m)p2mG zeyP?Z8$kivBmZlooq4!Em1T|9l*^En5NKBlVzt4o)N5OJR>sv=&lahF>*VNhuzV-I zoXJc}IR^7maOm07?Ii;shf9S?RDr3gyRStb<2AP;i)gvx0iyxpuOjMkm58!ac*3jwjeDyx*dnWEkx>C zz_#-w-#|a+)^n{=otPz$6tRK5vtOHJr1G@~C`6IsX;l1aK8N*zEEKU!QBPHUNKi{|^5t2%IzvxOMh2Z_Pyq zgPt>%)VQWi;;D9%TywmudPne5n)>2MNo=(DIp(pjHPMmn?U4)|6OzL|re1UADqCho z^i$2%cYWuD8m~HRiILQMAh!vx$1wVhA=<_RAk3C}FNJITA^^wu0{(bJyY@Y!qY%se z$olBD&d+!40)NdkhLz9VxPLa~$lGqdRGm#u`T;|f->+z%!A^Q|yi#q2G-Xy+Y0Vb4 z$R@LXCeH9bvks2UrZ6Oh6wZDj;YS!KYx{lgXi~xd{F-o4e4p`cEw|x7a zc(!Y4FsE;I@G8IgtW0Q}Oix5BwvTz6Yva>y^-<-^HJB{hS!V0t9D4ScCXl@0RGK$G zLLVfV9p^aiN`0H1PLqWRx@LA-YvJe4oW5XU_Fo%^Z`%!UFu=!7<0lVs4?Wmp(@6jq z_pTvOgQYGaTGE@nE>RL!Mtsi8n29a_yGm6hv7}ML0k}9FLE3PhI!k)jFb$Y~=ZIBu zs}xw2fFLVlrVUmm)+V)#*?M4#dFB1CIe_}i!~vL-Wu30+Z{~rGSu00Y&NQF?0~sSE zshOip<~gF zIgXXejL@nrxI3>gi2`2ElVj_)({4L$pI2HXCoiHGss&Ka5Q!_bx|*5H#~RloW=>}g zA7Fsg?hO4JE4p<}3=ZJ_H&`De7=YgT%CpCWY`yC^UL49cG^}dcdYboqethux#rdb0 zcb*}@B$}F@4(^;PNF}YYrHKI{PF>aTsx|_4?W>!p3t>w4A&AX)3Jj^BY*8E9D<2kf za%@PEK4OZ1i6H_w&5`=`yUpvq=ai9VFY8FM^|{{sZGJgoK#}0^iAEJTRtK~7075_g zhcYu{Exl%(EMNKA;JZ6alfkHYXHh|p?q0j7Z+he+O9uW~2QT@d`?oJcr@HMBT7_q#Q z;?+(YJ76kKWP2mj3U-cX`EK(9j?XnLTy1a~uKp!=WVG}}GTCn+_W1t7otU!cdbBZM zr;hgp!F;Fh)8>8j>tFx+H+)BcM@?UBCijK`@~G5N1j-Iq*+_zOtXAiw&?dXR#&Jnm zxom}hd1)%i;$2&~R9cdK+AU;r!2DK_;Js=S5d$|6S4mDHbFONWlvgeDX^v&8R&`w* z>YO)i2Hb;V_K3Wue#`i&h0A7HPj?tfx%RJWdHp$??b!<8m@EO>)c{Tyjdq8*#y_L& zzs~TH{>L7B>^-NGXH5qe%ZSI-g;06cEqL|plHhfb^WCrMirU$){cGKGXN#gK36rohA`T9J_ahB%k<=Ut^KtQpMhAv5x#TT-y9>k zXnA-hhc=?#tpnI;hQc(zt*@MP0<*@xL(6}f_dRB>*UMIL&rn4>_@DaYOnUNc4|XI{Ywdwha%5u^K-x<#d& z?!hJ@TN>d@#sJFO+%g}lSDJcFvIENTiVc{d>RVbP$*Qk}A);rRXep^#v2gbvwbe(P zvT3f50jd|LRhrX|`A(YS_ny+}XU-PD8vW*P{^rAkOtX+pic`ZDmGcw$oy*2%@3Ixn zn>eDBo$|@q@N8*n){}NHhCS5PWnI&QJi9%GYNpEiOMtegl)sL%^Y&vfjI}y|dACVl zlF?eTyMe+^w+D-gwbq`a5ul}5i^27oY0{>#sAt=Eth0Ss)=x_H+in@x0GN$#(?I62 zaA~IMuLCs`P+H2&&ml z;_UClZQGsi`kVi2+U#&nRyM8&nI^p!Y%XbpY;erxxOuMqB(1ANWsl1jN4P>a{Q`nY zm8C-P9%SAvFag_V&K=^fwcIp}^;J{WAN$*rhR~qulYXo*4W_Sy0iHhJI&E$_Ie~Be zuhBuT@A%htkA3W8Z$1ls%?x^2PDM7N^kr#Bi&+8AHfvW3u+$reN{JA`NTWSiis^{@ z_{Tqf|6!o1KtKVQ=e+*iTi{g_%}Xv(Lakwt-W3?M-?)31){F^DWttZdX(IL?vsOXU z7u9MlJ;83>IFP-jt$cSbQ`R^=2~XM*z!Eq8)AuUzq}iN%q;dJ^#kPN8)^PNgx4$|g zaKEDjcfpgM^rYV(@a{hoJ*4zughwC}0Nm1$R2iUFJ6D>`r)rGKkxUNNY#S=)!p&Gh zhvSbwej{%7u^5+%W~UH*w_{-=a#CTwYqrf?fq{TM>?HFNL%23|YToA5KY8~c(UVR( zY1<&zUkXT!*nwhx{r5!X#~hMk-y5e2U9r0BZ93GKIa-sxx*0wH#HT(gN?1qz&)mN; z-=8`(d9-2AHNcO1+~aOM3wYslc8w%st@vc4ahbXGqg28+OJ2$K|7I4@>Sl>?Y0^<=%C1=4-M{v*k4 zCWTF^MfQ`iqy4|HwPFyjwZvzvRZEmt0IrOkaog-qMN`$*ZBFH(%L8bK2C44>_-_V} zyADnEvsUL=MR&nt9`l&vhiFeosv>BB*KSQTBpGXBz_B*0rEYo8z{RDK9QVHWy|;{3 zHc{Us4WM$*-5T2d;Z$wya+Z?d08TyU=p^xZ#Q^RJwcREQ8~~qq;)(lrO*m%zs|Us; zStUzif|5b0=QVMI1_16+iPUeK_c4q<5)x}M|NM=dubmV>d>pgiJu}Je_;<9yHG1@; zAARW=?4$wf#%m0jrFX7v{q8!`JJbISK1Tp+JYMz9=i~W9lpiXT zNTO3ctHb4*oQk%^Mp-F9?Gf;fjpTBqqaC@r(iXkLqFfyqs?`)o~$!`FTe%2JJx!5#7imjL0 z&5H(PoAxmq@7)+Zjh7@3$RC(7?mbznGj*(1sXkj0?1Cpg@rj2_V&Pv6asC6ZItQy* zuj~)vbT5y%vE%>%sUizj`?YA2h+xz;^$T#e4ZxV9KZfpUuo4^nuY>;doy11iek1Y< za21!57(UA#_i&jtRcQ?*M!wq{!m!DZ zfk9=tFgQ8^c(-r*8)KS|oxiz#+F7aQb1cCwc*G+fak=@>`Mryc<5FA=2-|PGskyec zS~w7?AdBm1=%kSf#KB1eNujE{cNiB-EacTv?-)hjdC*C5<;68#Oud%}&c5}#tXqYE zHV>LV>Ehkn@NR9@YJ1{O**RtPRj*gJ=_Zh*iN75$TSDMk~-=?H`os2-lE@1zoE z0*(Eh$IkEnNftYZK(!%R00BCtaUEbtdsUou@vFy}MD36sO{SmTJUgZM*de)Y79q(G4San~XV=QnncFm?nLRwb5_r@Uo%z z|29u?KilBK>|6nS+;PVpJ(Bf|;lLx1++|$-7mU;$1{4z2pF0B%_j^&t>=%G7ipoMHIcN6gMK5~Mwja182;w{5 zV+BctW2stwu356|V0)T#aPq8anO(kie^*F1jO8~J-W7l9i<)Itti_8a!L&3?WlccQ z7=W~1*OP3vwSPhD$pg-Ll>pL*r~0WZc@M8mtjWfD!hUfbp4^ZoNIq5kq&oYH3KO zii#EzGF7f?ydG|jk>>bkMi_qm8P9me%g+tC=NaH9Kl#arPrC6D;|2cq5cJ|b^P)el zKnPMxVmU_CntfMn4+8W*LO`YtE6!tt@~!>tOqrcHJ4vooSNqbD<-bc8<~3I`Tx-8; z_*5E{Ho}y~_w+psb!G3nKkuH zTG=tcB*}q^P$g2R?`-Ls#mckRwvevtQ}LuKYHG|1-9$Xl?^_lL1!!IV@HDj z&3sQG*7Zj6~bcx*YvMs2$!l$Doa?9#0nzi zqsx^i@u}tPFQ&)?rxx3*%wfcksdbV|3;Df1oSdXHPr#I+vKDHcM#2a^8iKQAF8#w9 za4~y-?cTqp4Lv?LV?Fk1PkY+$&z!$?JLh?Loo@h-8oK1D;QP(PuYcG72LplRis5i2 z2c;0iT?`L@_`~-f8rq|DsU`&oDvuhc(s4F|#r55FSN%6tTNqN}B^ABafJ>RKl3bpf z>LjJK32@rKr7fT_oxj%s5+(x>)eSfd?2|fo9LPNxhm(kjoiAsA`Kj*0OY7h5&OCLh zO7|Z|dd2)b?6)3ccOGBo8^F!u5C8BFZ#VYk_hzEk9yND>%I+qy9$$!aAMk(&Y$^)_ z^auua?1U3e*g&3bL)(*V07YFYN|4H)H=R?q#;-sLVA9A|=6zGsn4_EI%Bed~yR`iW zp)r)Ujxjqns+*^pbqOBxIOdpRHjkPQLAtAeamW-^FoSBDYt6SBFh)q3=UecAYw>Y zdfs#n5GLqJJdRZz(r>oSSb%hWRiwhD9Jm!={a`9U1~4r`J(EV}L5L?_b$zcCE-ykYt$O;P84=TTt)m&?z0fY%Xz z<2QcezYX_3Wb)#Nl-47~Y#2Lj%Z_rK+a?P+k~pe))cxj!q=vJBNorXoz>+9L*A}6> zS-kRKIq~+3l>q}HPMHGQKwKdP70liOj)OwQRs2VIc8W7r zB?$~n&JPYl{`+}9dsO_H?#MW=5`BRJyqnx1BL%mf1^?ee z*c;$pVAwXwk)obSE4z%~R54;B5Gmr2QG@NqL^P61a`e@41g{97jpGQKx7?1(iVN*^ z0&x4H`g;Mzcn{v|w>gY7Tz)wFakIet4sotLQgR3h6-FUW9(EhNBNDaC38^U0Imw3kY$IFF zR;kTu!qt8&*9A1dc2%0qbMEo}`~&mC9KgkJ6)uweY$@(KnvDW=knNvK$_uY>1jp4saDJj1a< zGh^=N@wvJ7Y4iP=g3-+900091Nkl23`#oogO6cK1^k5~kla%tZ#US&VJI>=5mkA@~D^2sfPfb{7Rg zX6LlaZgzj{dM=^^LTJT#6I-r@gxctf8ZG(KQ)(T{%df;3Q*fNBP{nlm0VK^*Cd|2* zaZZ1AnB+Ax?$bvzyl8%3U{2IoG0jB^@S?V_K7_jcNY|r>aM#O`%4q>se>u}lY^hEJ zE`b0HPESvDt+u-sC{oG79=0F2snXPXQcC5s$vj^Y?iB;HZ!3>|ca49rdF{Oak7@d* zi5@<8RsdYk=f5ieUVuJ)hbeP#v5=dPR9N`mBZ1I?IXaPc`G0b}&iPX+loe%dhIXJ!uXo$LP7sQgz=yR+Qw zctHcZKi3OupmQ?LY$&++ge-gXFo)PQywajCc&u`4X(xhB!1jwJf@$6V|( zkhN17kX56iIacMfdGPJ#C`*?2P9xZtl?1nr8SiuB1H5h+=GEhjy>5I7AG+0kyj*fGn0(o+RPa zypo<*UbgEwSMAEwuF8*0+b-1k%3SjDY4ez zl6I2;`N(EVkOt)#+3w1A%O_LKyk|C5Y}^0#w%ZZIw7+}C^RHT; z8nf`J(Hb8gTm6=i;5QEFZy&}0^7qW^dk)~0vXgPT)DZoOBZXHOTYaSg{c0m!*P0sZ z5u>87H6HA>#zDH~NcQ&6ZjvA*k?q~pi9bIk;N*FKZ2CQU+MGOnePqskdcL1J%y8<2 iV1Iu>rV=k`PWhks6?JUAx1U7-0000KQ#4 zpQ-NZ2zgmCIA|5M%(@e^mY*01zwy#DDPsfFua^|MH3;V|9;QYt`M@&aZ@Lwv< zRy>62GV%mMc8(?lEVRtD^n|?71Ox=!j>e{(io&A*WB%`ohtS;F*`AY*&dtq@){TkQ z&e4pHfrEpCj-HW@k&)(~291-4t+RnUjja>We}nwLIKn1QMvfNt&K7pI1pmP`Ftl@V z<{>2fkE8!B|J_b!3)BDeWb5=l-TK!-y8qmvW1yv{`(NyTrriILa>_YcnEdnnAADX0 z?*G#K|H=Nx4>#R^od16s^WQ!FFX_Lo@CHijb632_+Be`I5oKwZ+o48qiDvA z!PN!De?rKotG){FaEx@!sB!v zU0YlLJ`KsR{WAW4lBN2XXlx3SUJY)<}`GGyr6SvTvp|8l!OF`U$WzdeA!XN`}A zHLly`&hYx|_jP~wIFlWKjfI5+2Ii~!=0~e;U?38-YRv(ZFuUpl?PO36Suz~>rIRR0 zMv@+_pK48-$x@mP-+JS<-!aLWDe;mjODsb=mQm#$RoV!3(N@e7rDm2*tHzonYxXOm zEv?a_M>b;pvSm<-!YRdU4B{9|H$j=HRf^i;fn4no9`P3vuz<%fdvQacWp;UJ2Q^dh8auocBX9c({6GPGhXO# zh(Z$@Q>lJSS8>kl24hAFDKs!cZwJnjVPuHGC90(dK+X1`v=^OnOJ|QBHdJ<+b zE7Yd<`+qNO8^;c$PHD0ui-|L(8zU{oINfpZNh?<;`x{RzKcqvqPe}XzlJXje_GoUi zVYMu^vna1$s$Qj{ZEXET?4V%ONEwiJKSny+IxyeTT22_ls7;O$-5YCPO-@@ilpQiu zVAX!RdRxmFnQ_tUeF_ufeLS2n%iWw9V7$h9{##F^x;61;tJOQ2`}+N@3wh)MH((gJ z4{7iC9=VmNCGXO2TA$0DK8641Cja?lgRB=k90}UMpmRJiO z%5%4CcX~*rxD~FOT;D0QU8e0awsXJJroWRK+**DqM~#?tEf^d)=lAE#6#BSEB#oGj zW0noCU9M*Ac=cUAyN;A?O&MvqdgJPs%b-z1Pjm9*-e+e+*I6e$Pa9s3CJ6Yv1=n0& z7k?Sf6Nv7v8DDau^zK{+Qh>}|Gr3w05szN74M$*k>dPtC6K7a>=~HVOR+Sl= zIs$w*=G}3(%%1oIeIKFRQ!~pkuUBR)Ra;yCq;OBtq=~^!VSni>FlL56-5oc{-vpr- zZ}j)C(6*9z<9ceg?(RTK#>XWI!-ja-Itg4eS$Npl6Y+2}5yKW7`YaoH-1f)sQ>Syk zj_6K4|FtvgEr@T_G}renT=#wE;Yrs0BfYBx6JUakal*(SKBDAXIdS7b9OWOl*D6!#A55;a{CAFsOkuXxM@s>b^ohT-!!BW9m-S zIZU6yn`2LB$qu)oao2?TuKBdaZ3&r1Z)>feL#X-1~W1u&D6QlOxiOih7falG0v zfdc0~((aW@IZ8deSVwO#Sqj0dT~BgRuf~OVh1hO)e&Q+>6NCKrhkJsQ%W;1_oZ*_z z){^|H8n4Vv4gir)#KOSnYnxsxDCp<=eaBM~1$81}Ne+H(kDp}l^O2P$>uAK~dq1<+ zO$qGO2lkqHs2(C(CNI|m4=;6iqXP*AXc7!Qh2Q~)Hz0+$xzfvOq|exL%RPMU4%ZFi z(o|%`U_@jg{Or+? zBMS8HC5KmP3TW;3ksZ%VwHIF3;qw*uOSyp$=3dKEu-SL_#2ee|of%>QDsB|vxV3=8 zK&cP!w+iS@VY)M;lx57W1gm@Q#ymDYQb%p`X#9b2t-(U$kKa#e7{8li0;%qu?H>~q`{~gNb1p<8ysF~ zRl{mk;`xjL)3Cr_QcR4j#GXG$V>9Hc}H( z_0p8dk4J|*8StgGx?Jzga_1yv4s_b?+ABxf4^MU$`ZD_5y#cZ3l9E>2P3u#+M%Qn7 zh5>GW*S=&*Sem$vGu zs-z>tIHFx**pi~xKx00FM}**=x83gnaXNQ;@AAS!iEYC zZ3LXm_+XQ`s+q!53}DKqUJSa?-;d4zhWn{=iiu+UH}3QH)!0;8E8q9dxO#=& zlG@0G%Q)`4Q9k|4hhx6e%hIbqVeq()6%NhRWi^(biKwrX`73_{N$Qi6VH%7_BQlN` zm7M>ej2#`a0~j%kJ!LQOx&{-GdeI9&ueJ5u@uCHm?vGN{NLEghV@pWe?{|K4)H!j* z=Ju^kbQKN6NJR%WH?wrvt5{lE6_-@xtWYL2^kdz6K^K*kNova?)FvQP zf&b_n2}jB^K&*G#yx|UmQ?7PtwB_Ff&yc-vEk#N3AV!gt;Lb|?Wv82B)^p!6IbAcB zo`mipn*@s>Gj@3XxmVwDxL0gz#hleJEi*$pu!|Z-k@;~3Blmfl#GS7ZQwg{rV>#jT z{g7JF#H{SIN~Rsk3%fGg0q^>eyC`klJ*m-B>+2nE-yDCg z6D~O2H>5;ItREqgiH0YE?xc{UNbjgvllHrev{Z|R>p{^@938o0V&0C9E|wi6sxeuZ zv~57jRflUU{n^_iyrv_9ATXD~{!>hVT>=WQ%kL>6mHTCiY>}R$neq_`nx3A0c`cmyf7jY8O(UJFd5k0PHWqFae?RYs(x+1|Z!}(Z_ z?r8xB!~K40@cLs{to0amsrPiUo)r>Wr+(}f!iy1;>G=2%tDOoOR7Fl@U~dY8jw-*| zW3|<*lKW-Hrbg<{nl3>OyQrf|TbuTWZcS0Jh^lI; zNrX2BQM4!_)a?Mi7q_lN$$Uc~TT-`&wS3Bvsrrfc7~BD7On5-6a&1jT;lWty z+?)WB;z^0(bVlfp!^G?rCnTtFoB;pe0fTC{;wo;nf{6GR9NyK&!kDQf;H$nm7OV0^ z|6ODib@k}OWa5ht9tDNH)bTQWc?C65TxlavUsx{5!qb!2)=9mh8h)J)kN2yG5{hOde}~=H0E{dtdj6p3iv|1vcG=lev=jz!7CBnVj_P3v_3T zHYFvDv4@F5fq!1{4t1!ExQGis-e+HTgOyvRg0J`WDt`C~x<5>)OJw!faE4?#HC4ir zvvf;y)7WxJj3o7rM2Mn>u0XbBiaD{RbxMAKK#oxivMG`f98yYuV+M+9VuiG9 z?#QY0tD&)fL4QF%lO5jYTX!6{BXRx|4BZzX1NiMT+Ccf7N!^AH+?gSu?hqI~Y zS0)S-Vc~$3T9m1Ivx`etpkwhFxjJS20 z^e$>qo!{DV62Z>$ql99Fm7+f%_vS$SXlrv52oeYc&@EYTk|&44!L@Y>1B8Z0#8%lM zta1G3)*|P^e@;UTg_2R-+#kPqP-CMMakCi_u7nZr37du^M>fHDQ1dIk*}{+NJYS|{ zoJp3~j^uq%(U=4Ygd59X)~rsDy4>qZ?~w`~9v*QRjV%R_m^J+P_(C6f+j`MgS*YGV zyFg)S5ODjlqWMU2uRFaR*=DF26+^J*xS3+A-3HDj{2m_yepdg|VVvh8v#O*HT%k!y zN@|dPS?jJ<^}STvCR<-)t0w>sP6886p6@p>>Xw$Htu|X3DPg#Ta;sOQf@;Ep_fkkH^p6Ks@zp*DY67-0MJ~(K z0Yu~lubr==6#Lb~6nf74hgeL>&`=a#!mqDNIM^lA_XDzAaZhTKxSs3Xu$~JOwWEVh zCE8R3`eal&_y;@~m%F7#WYd*xpA{O%&taC=!I7)fO)rG8p>re0=2E!^iXXcU8i9bk zEbZC{H@I<_nI6iO8rQM@kAj0Ew8YY1!TpZ;@jwj!v9VAI5a$i*I>H-{aEJ~r(bpn8 zO);5{{1!C(UrFWV6azs`#1oYBq2LY#;B^LRvz8c%TDc>VpIw7QjTn@mJ7-xSPDmy5&w_Nc9F*V?56Iz$)4wkjt#&_3Sq!eiK zLN?yi^xP#oync+yK{#HVVCD={CW{<8KFm9eIlP!SNp(KJ%1M>;QL!AFINHCP@?&Nm z-a%+U(@aQG5B94@O`QEUwsKBGrV^cBTOR)OCb$~f>C*0X*8vr27tL7?nItmi8mo@n zGP*@90>4nDjDAi;c=ZX-slz2SGEG=f|0w}^a5*!>Rv_X}t{*Zxi&nHGDLQ@&vQeO@ zt!{nbP?; z)=hOMH;{~sjM4N=a1_}s`PEM-EV~RDm~2< z-oo!I><(!%Yfi5p+$^uYabP{wnJTq7{jd42PMIU9S)+gBG$9d#6j^!GR1< z_UX$v6ndHPyy#=7p__$9f_wfE?>OyJFm`&?O-r`LZ-8NzGZ34o$@OFXq zxD9Z;1JLfFkx_7XH`j@mFgqC;TvBj%n7IucVDW;D^{~f4WM!nK<(K?Tq7-?<#=;`x zt7oEsyf-z)q>QH8cB0Z{k6CEt>m)B(UN8VZKg};)wapj$%znGW4j$&IkoC?lVOVAE zsj>&u9U3YYt*+c%w06NHki!09b<0x!4+lV!xyNo7e~OAz<5EM+5}KHnQSl6LTMc%Ild zfxqUL351Be5iUJgbu>=T?t*<)&{Lv1L>*%6Z6nlSvyBXLG>i4t$Wk*WIOeDhDCdwF zYpEM+5%a1E?-w+F_TaW}Z4*X#SwZ` z2VG*!KgiZ7tIDiWAC{}EC-2-&j4R1aOMahVn8;~jVObF6^pe`h1GUz$|3Ffl>677g zi8~EYqZZ+)MztAg`KqFr%tu5@NF&st@Cj(;qW~(O#R$wk5Ux+dhpEh z$6vGb(B=-Up>(bcm)N@)uSR+CyDzSlG9d9;lvzTS%PeXm4#Tqqr=+9Boeisn?}9=? zO89)#V#v~YvR$J!>zu)WotvL;NZ|Vnz`?}F4M~@j3e?o-6lnBE|ItCI)0mu`2YlsG z4E;g5&mv`RGBh~+PH(X2eOD5PaCy&JW>wh5ri>*Dzudtk!P~M1@U~7=2bCjR?Bt)t zl3ha7%~eA~GbOoH9+1Dh%j)p3_OIOPk)WWMO1;V?ay;E*;c#C!vMzb_ZDD1ntc)V= zEraZ=S*WgnbY$la4GSZhK;*QR&&8jI6x$8`9U~L@CtEmEJ$9w>bI@wrCrj@WT5=kH zqV0{FFD0PdCEq!YnD1fT&8LXGbm!MtvisThSHEAY3XnPd3Fj{b8{NYn(=_4?bR;@) zrm&49>>W^805jQym4d})y$azf2}N~z(v74#vVE(y?dgUhh1~ZJi^s>xm$0PF5aTQl zwOY!%v8bv+RRu#!5XADAjVO1XnMh}b6qy;Rv7rMh*jkwp(lmq+yQ!jNWyN8QP}rfS zTP?fj(V&op2`QyIebEp9Lx)45)V*}da+4qoYb=vV=zN~0VbOjsC$PqN5_%(di>!>5 z0QAaME2zSye$cA4AEs10W4}@Jb_0XQsPqRK@@oP}F8sO2)rb`1g<@)>q#{=Vhd0Z= zSrZ)BM_oLofsU8LSW`o9-GMBd>g1a4+$d#VK@+*T*>Y>RDRNy;cdc@FIlZpC{SfP{ zh%H#RxgDR4kiKuHVKo23RN=eFm0o!_gO|1a5FpK#a6;GJBI>=qn%?pv2HRmO+UU5U zIN?H_l2YRy2}*6G6mb?k;t}XBMSWs2*i!5G{7aX!%tJ&b)&hw7ox&M-2BnF!rFNv1 zqzQXF!K(J?dpe8bGEiC7+yjLP1tZc`N@_ygo-3y*JV(;JB~?7$`|D3!_ehzZm>3xW zJs~2h1Qv`+o+()-01Y}wo%tZJOJ?nEpc2Ku+>mJCIVYR^wZVH-Y8sW`&%Z=~-OB3fi5uC^Gtuux$`$c|+a!6V;1o{hDWU72j>IOFd2 zz{k&nEK{YnaKbk{Mu)W|cPDNnh8(elfqCd@0O1dQ#G`%E0)LJ%qge;OxfQoBWu=9d zd~38h|I=JFxDO|ezYh-!I;%6@M@)&%q&Z>AWpP!a$X1OE>zbUzTnIKSMd%UE8)Yy| z?jg$+7X08;Bg3HG4Pb@H3CL3A8)|O3S)4wqwy@f$_gOk`7KlLLfuxpBH}}G0=mUbw z0{2YuQYu}lo%1i*?t>|EesKSwFcnqhx;{<#a<sY5Q^EjN%_DQ+ zDlw$w3rf@C!q8za8l1sC*L}|=r%h`BS0+b8$yT)XA3_O99xmj<*za34y|?iMB0Z50 zk3sK`m)mcf(JwN%kMbG6afg{2FGarx^xUt9S1F#jDcMQls3_=5zqb)TBA4o9MO8&& zOoA`3>ucdL{iK!YeTP@wzf}qtS&EX7xzTVk;jNQYQ!Sbl%_vf_mCAc~Nx|L%P`j&e znU-+G7qP3vCNkmt7CzdbboCL!^_d{vCyiO7#d>U zU;bjC-91yfJUb%pK-SFK=LDu6)rhK1hOCf|&1m{n-cn%39CJ!k&gSCB2Lu=h{~$s9 zy|_)=0`VK~kS4(*W%g>I4YFBKIA2&1{8Ax~H3%fIOD+y&?n7NGC{~6mTpY<}(0_)S zqL)toJtEG>y}9i|$}HFWPJ$~Lj%!D3`>PdFm2toEdnFY$c7@%EX?u+7VKp=JT!v{O zs)W{kujL4Cew&Th1Qnw1vxvH;iXRJ6lZoQ=Z@Wkp0J8EZk=ljKiV@|)BrH|x7e7&t zxWpa{CXT&AkfI+ZhhI}Bgh@RG5{d|9c|!A1^jY9pWS~8gs5pES|8Efey9t^fwh5e$ z9SEux-}zc5&(k_L9j^y!j`K}F33q?P*C??xESc@xK+qYw|!5YfT z)4Oa+0{WX1pwnsru(Ux`iVcALJ?Gj9=RXR<)Nu;SB4xWe@TvI_`-!XZyy=0VOK-Tm zS-Vk9m^&nBdwL^T4=!2w|?}T*96h81V~=TgYehU1iG8W#Lt=D`>)=dD~+q4 zTFZ%<=b6dGBFR1VBC zuXozlFpTIpCTyJoeQ51}T{0er)V~Z*&rg5D?vtnj(ZI8&Xr>HF5Ab>Xrp@VJP(LXn zK>k`*Y!m!Iz)R5->`WvtmQUjS84Qk>kk?(R8+tGSps8wdFp>n}fZ|iqBiX>paP>_x z6|xLh<}Wmf-qIUr@oZ*=Bs^FWcNZD^(a#hbbR`U&8HUK;yHy~Jj-4Y&4*6ADEb%1< zJq2lx=(vKKHuu7~6Squ^{o|3YSS3CNDKRGpi6Z~-#E|K9G&*U7e0Gl!k?6%8*Dw{L z*nDmJNY~E?n-))3OX}eG$42xK%IE7bz8~5?q5D{dMDexuMkGRkZ>x<{)SMC>JBo7y0aIXq=aNls;-JsJ zX;E1m4>wC*@wBhVn(7L8ucLFf@p^1*cu?|@i~prV;j%n|kmDyKDK&n}3pw(4x5KJ* zH$RBr=%~wZb!{G$Oa{imL)X>yDn7{F$^moA6+()d7PYwkp2d$r4g4kGX(1k3QZ+ky zxhGPxF%s@2YuJl1<2@W&9gZdZh&=~_2+YGBhtH^dL-vNBwmoY&DEoNQQE!tlk}CcJ z^Nq@+f1W!o5_7S#I#``VRuE{xy0s3-^maGTN@bve8=EMC19q{8AtDY-D>P*Uq_X*z zX4JwaP>p%10OQtj)b$etfs|O~d%_dV@}q%$1X7Xi&P~r7)!YGCPhx9|aIXlq=UY}c zlXoy&-xJq%=2r0^^APM=5Mu8oK6h4n-!sEX7E@uQ*BXQnD(vSF^UidA2~ct_#hD;?VMw2yB;YP7Sp4{DU_ONzWW`h0u~41gzEk! z;7tWHU_^c2$f$}xG04%A0}2BK)58Op>YWMmlkmjc1KHZXQ1tF4wjaN{KItHBEiC4& zR@UE<)0cdtqW&l|BR6ujl|6O9-I4X)YB?I-Ay>1Xt=?or!^(|+ILk-EQ~}ALf@&&j zX_GLDhsW;Cikoed0>B5TkQlr~pegTQ!DdE*4{5aG7Q_UX1UsZJrZhgjFPrF4Dg=^_ zdIqCJ>+7uNXHu||bZouK){&tgRA~JaYtqpzU#={4mKZ8Qr*Y1I<`;*~mzDO_@lRq%hOIuZNV`)eMTrWJ zh6Jh7YPrRFHcX3$Xv9rnpB1-tg~Rm_24o3h=HR5R#P!fHj1PCepSUH}EDIK)&bD(p zVYrmFpf`KZKUWzBk*NPs#!&>vS`ezxOoJQftmQ;cAx+|P!(U64ss0QcJM((_x745E z$a4I#dFjVMzeh);(R&;8{l#UGhTA%mo|A@XwS5!b^)YZtgT*iNWRVrb%-uZ#W)y)+m@`nTFp8vn6a%Ei*$(oGKyAGp@O(wO zklacEIIv&(8Z0{OOX5~5QfwiiBAXbYwAe!TMck4?ta^7@Ln6iU#U>5(vv$nCP~3k9 zu$(zjcC!}?G^hi;=y%-x>Dop2ICh2goR+1HnXzAZm zV?NeGU%2d_$~Z*s1wWn>X`2C3ff}@IusD~(F{+ZOqO0~yjWE3m9PJ?d;biKirKKDAv1*(wHjWpR3CMOipxuFDEvwD3I%G6W5w-^ctRdOCTDQ){ zDAn$y>3`{KJi}}un_E5G6HzzY zgGCo49=zDFQ=g?-OX=>@K#MEo8I^eB#l{cCUe)-*t)fhUQ>zv`-}qg&K*1yoS1VjxUW_IMgl8?@?lFxdNO2tDR!mEQT~ zwcvwM9FM6NsLc|Y-}&-pYUl`js8PPP*Ey*cI5@YzX+;gFAc*dB$njRn)T4=FXTC;@ ztF!pgk;iE_<8LxgTS+S!ntW>sQn652Lqiu1NO5F;f#7U7&mw1NMZ#dT0qKdI3)wWKd4m!Q0tPV{SB&vgBQlaZ2&OYUmF?RVLd56%=B?ituv`#7ec!-;) z5`Z_X@lXbpq4&8A_3PSNxDn}7;LaBWvncXIB3Wrk!k0QlMCifQIv;VdiO9c?qQ~$j zBr_<5ie)~EBw+kvvBxyNRg@ee{(>vZ3aY`#<+H;>#|R8NPZk1H8OJ?oTEQXU2c&J* z_IjPg`{|eOAV|#lo`3JXezeua@h>}RA4gLxpM+j^9bHwL0V5+rtwzBruEDc$$&oJ^ zM-!K{7TubcYL5r?75_)m*-O*%5+g$s^p(XWaTIV&klQ6@U;_ZY-PeMD?{|MIOnT)} zb~#Dcrrh}y70csNXawI)y;pHXvHCch@;E@J010N7{d&}Lp8&^YSAk?@B;eq2Ka$c{nuy(NSI@`_oIscGnZ1@(?k=58N_r&mIMxD{-5x+?&iDSdak-8T6aSLmv$Uk}P@ z(~8N@B4eUWHh{ezU!9I#_parmGyr9e@?X`C56M&wHf&{f=^uk3MfMs=V+O$qny@v} zDaeR1Q!;rLDiX#5$wQ1{WfJ%I8=$q(u(6W+p;+zjTkFQo-odsg<5F(vIBUInjsjDg zYBd7hO_;A@ATi6a8BtB5iw!0*2($6vP!5#-g-W&$MKN^~K1?TV!2I#L)4c=LNBz&% zCiXatZgjd#f1ka(TVnj$>O1_Y0SfZ|&=Q&1nr3&h6O8NeVzebYXQL`9OAm{wP5>U6 z&9pEzMZ0_>%@oUlE#jLb7P2`sV+oM=C3v`{ z4d`F5&s?e`)b>=;y!B&vH+0;Gs%MTujCL{{Pn-1Fp~tM~UC=^iqQzorsN$Frc4PTT zVPYssPoibB`Mo>jRiyoDYHPB;KkJk(_an#qg=gKEmy=E{?5%icg`l?ESJt-Mq>};k zZeT_3Bs5=|Ff0dGC=N)6yS{#KmW++8WeVbBkntEYXzso!tlZ`7cqFjov$+}iOj_p9 zy*LF5^ZX~SHx7p-wtj>JVanrH&gQBK-5Y`R#E{zYc595Ew1B+G@mM;2iF1Zde>AJ}M9v^E5L{jIS!<2>!eMYrb zR12c*sCPDLEj#Ljalxv@#6^FUD9Cj1kGBWEa}#-Uoo;}muRIhd)Yptr(e(u63*NoX z@WO9P(+)*7B@JR>MOEZ(7Dd)aAbEVoto*FLe+YLfZfOxXtF$r!i&D}o*m%Lxj#HLOw`(E<@AMRhyq8pw%49=DQ` z2enKY;zltmiHxbrAPGJ*Ks*eo9Dg#8q)I;mYoLajmC34{klF}jLRyAwr}gkcftp_& zWS%1z!4mweZyypT!?Judi$rMZQrsy4)*UH!LuOm(ihV{hEpPwOhoes4-H2zmN@1RD z8ux6=U5y+T>t=WOzKUae=-TWpZ7P;0eJefCs_mj|z1o5-y-2!kFLI{_a_2;E_?@U8 z*`ywxn&qa#H4P`Gx1nT~uU@n}`x=HHdxBuJiz*PH`DEKEcTH4qck}odSRqndD8ptv>It_zT zIXft-LLe?2qnKZ(*C0QZyVi3bsK6yKnAFqPJr!3X9q0D?$|QdDl#%0KJO9ft*CA@>)l5*x=|S7-`!+(q>NOU6~C-a|7Cvc7BT6OW4X+rxIElN^GE$5)*@M zoE-YyzMI)lkM)NQ?g`?pO!MBA^@^Z3TFPz4<+R72O$m#bk-24x8qI@A$jQLhR%g`r z=>Sg1(rE>^a|kYoLGXE&=Lv$Gt0F;Gz`ew_or$2 zwX$}{)8TatJo-^nO`*;Cu6h~U?q=b&wX?&E(^g_!O@jg3B4Xh^82yEqlPLlBnO^7M zSk#pxF!Qxbj-A-YHJ&6B`s_P-xvK?8NRHM1Q1N``TN>&q{5?g;jEsziWindc{HiQ& zucP%=p9?j<=tO;170twR_nrKAjKefjGfVNvUy)!0X02Hs=M@jp+40r>)!FaobA%ds z+ec7hF#Y_H;?Byf3xw-+?YgQ^65~>23zSlaZ{oNbq2d#uER3jlAUA#3WLbB!?|8%y z=z(qN0*u1jAY;WV)-JKL2N;L$0G_h|&SaRCO-!)!i{ofL|dsRus@gC{S~O(b(+@$@o&cRTsT3eEHoNk&9-Fs~W7~ z%Qy8q+|(O^2m2J94rM=Eg5j8;7-bt)wXM6vpH(PEoaO-|n0KBoG7+!{@MF#AI*#G7 zsb_=L-S8GwmCW3V_f?dPQBn6>0t2vJGK7c(B<8?*Bn_4-LgyIX-^Tn{EiBMOeT*5T z558!F;GDTE@M{PPnM^(gkydzP#?`uU-|#8#cED9e{^eud=k~7B-tP-qlRz{tr4pF^ z;J#^54T;$_*U}u{%VVe&_WJjWh#4c|L`H%#aPydF zmrjeBU^RqI781eE9Ufg__IPv1ug}#-%S8a0m94|bU#9FnZ-5sSk%R{IDrZNpKE3Wk^ zh-Vv6h1O{yjXBv7V__M1C_i+{a9}(lwhqg zkxNl{RCO08L(Kfp0pBj^Z5kuSzrCM`yW(VusN7%7Tfru7FsclpmIS8g(u!kS9AWkeQkVeH0w zebP8!W`9#RCo9F_j{SE8uT&A|CCpXI4QZrpjF<50u1CG(j1Ge#fON$z=4H6VgnC*Uur zgf8^Z!D(tti6TdvNw4>A2;DfbfwR>+8WCRw)-7qIDATU@b@mVA93jb?9v=x;cFn`o zr)?sE670~;B*wpPcoFamAomLG=U*~=zekSSqjtSDFp9XH8t>f+qt2FEFb!a4<~uYx z*(zFTe>{qkdzFxm~S01lqah@u|cWk1)&o zA-Xz2&4q}*C|3G z44-Rw8VhJ>M@ASYs)pg%8UqmAy+Rpumb=Zqjk*mLXZ#T|>9M)j74!bUS|tE;yIkIXyFz@&sArSBPk1K5 z0-O`*m8QnsdOmqDIY%BobO9oXO9vjCi+Rwzz`ts&l5(302s3r@|Hk6Hqvu13mM&

$ImBcBlB>^dJcWRKge(Ha9#xZ{YJ=N8~d#Tm@A+;-q+UPm;3$ByAFuS}jTG~}kVqn*k zBh^V3&*!7?&T)ncC=m}%75;~c@-(k%Z14m$$}|Ci_akag{6JF0g(5091^&(oBaUTy zMBnUOfLwE(JWwT0HCY5?!7l{oSbnr*o;EpCHd--KGVKPE#oaZ zxWg}^&&}uaT^5C~aPZi6-V33u2crb0X6-1+^H+|8=?b1wpa&T!$cixWYY00X_J@fV zYc3e{$tj*CuTm3K2Uat_DomuUt@rk3AnncIR%HR?nxNJqU z%0u;HhkD>zadRP_(UJfpN6a5Kn*t1LjFrlMw_mv<&-lol3AvWGX|Q%rVaEkF=0Qt zN?Vj#m}DJo+Vs9oytV-s$_d-hhd4@so{NE=v810;I%*V|PZD^26$J&-tah8yy25qC zLuNXN@b(qS7-Jy{PWS1h5T;L0kM=i(qjq0+wNBd}{l*}ri(Te8qmJLWZc_G~q+wQE z1dtfD#uifJl&~s6M=X~u1pNDVs4sQvujHwm~N+>mfP|E|sO&l>!e`UK}jv%Z=bVPi@>H8VL z%V(YYZRLHaD8@>)7B$zY@gR$IdH&4~W+&*-G&`E!1l|s>xm|%{a2yiG_|x1}E;T<& zkH`HM+zvXHH?(IJ(XoIFGL$B8rw0v{7ubNNR)S{E4EVdUj{ZHde-IlCJ1eVYy4CW2 zig_Yn0cNOJ&$i9T#yv><^PIRnasmi(A67Y zO#kqPy9EB*otOy@C+rH>%*ez*VhXQ8 z(Vv+*a%>zPD}$m+3SL3$iY}2{EXwP8qu?;;bXa`8ophMsvEMb|W!w3qI8%oGrv#dX zBen6kv7c_YGNU}2C|z}wz5w>ruJj~)!u6sPh!$r$AA)I`0Z8f1IH(`?_>@4wAMS7s z3qE;@OsRA2?0pq*8$+C-R5kE)MDW`uOuSS%XN6Fyd;GjKE1~0%pE@y7*-&8z+?oj% zIWx)^zz}2c94-&R4}bvQXD+77HF13Ky8$GAlh#GFX2wOhkhTby~z%YeGQ>( zMPjm8+@yqhsMW4=5z28%cW%QM=F1i0z2|g9*+N1v67FzT?N;<^4}e^(lV*Gg2v4@$ zVNKb$2K+D|D zm!PEik))EFJcK51aOLsEJfqMVlr?Hws_}`l3`&p3ORL3@o2KC2#0Kw(yGKT#KFIi& zBRnyMiF4u{dW7P@p=ftQr%z^d;V3ufUB$*%4p$L${~sI@I-21Vc^N71#KOolaqH^6 zy$SMzv3lPV{@S=*TG%2RW|2zCaXKYc8rV3%nyCrxu$RB?#$tnj>dPzPuKZXWVv})} zH_o0o)MaZ%n(geE(4!;|C?T>2DHi`pA*{F}n(1rSm|!{ufKUwkSnDo>wC0Z(1sd6u zb`Ey@f_p}6&(&5drb1p4xA?C>8Rw@Bj~q6N=7&xy>TS29*JPNd3S}$hegqFve;zEDoYE8hVJ}vb@GsMaoIalig=;XIrXkX&cUHft>Ko^ ze08VFjfYQdjdLd%>Dt_;9uGosA3xG^Iy&CQVaZ0-kB-n_(|Y>bLXVn^>~K;uSM2PA zZDYIeGHzCjz~&?yQj zuPlvYH5KsvLevuwg-3+bMq-r!(C;_WQ!o&KbQdgq+7i zFbR`=DJB;~QKvZ5fnbT)TU-U0vXF`ER$%BO!}%p zlx?n^A{_4Yr($9#L8vr_MV@*m1V$d-Gef3#kaTIZpcESOI$<%taT@9pc-xiHPhiy$ zp*$FUWwoWaxpAYV{8IdHZuU2JRwmnZK~Rw(O9jfQ39!*a30vL|bK>;cDjg+L~ZI;HFg}mLKx+7g;9a$VnTBH{{u=uwZA$Yvg#k4fZbUT zU)m|Zbm$=f*s>g(zak5%F!G&iwDFLcw$-rKrln1ks4_P?fDCAf@E?%{erBeAZQs$!AX}v*)PQ(mgx61ytFwgbwEi&0f92BtlNgW|I=Nr(_YMFxc>1+o+YFu{n` zz`C`z)NsO&k335ghJN+v#Dr1)Oixd;{tnbK)o9d$I1$wWc*4!kBCw21I{-;I5s=N# zOcfp+GSjtMX4cB}y#2NS06+jqL_t*Y+l4+$UU8l$Ti4KF<{U-iEXV>pQ~SG$@V0Jg zF)s2d(+ImZH8XTp0g~jy*egUrP5`2w7Y-`7lsW%#lvoL??$*HbMJ< z8SqWeu5#Ua3^9LiNmc=4IlLb`!{iEpENlo>d*~r5<8u>oZX7K*X`p}zphqr5crSV+ z)CSJPB5TQk+YbN;!}9%Se<*Ko$`BPQ9_Ny*H;V{Q=cAF)o_$+3v{uQ+jSWV-(n&?I zeM>tzHjhJPkPwYd5*4(bw#(4)AiP2j>KBB2!$S-eOp_98AYQ_>Q)lG->3#<76erN6 zP`NGF%=us@Z;m&DDkS~;x81qd?PD>a226U;*i&Epw&e1LRWcG`XXF);*ck%#_!+>a z^jTO4N*)Qnbyp)h#)WcWl>YA`XHnTn@{DT2<%VfY=qN}z{YxDt%g-&QxlecjC9V?Y zo_zJM#7vvbO=Cfo7)oZWvO&TK)l?-|!UkI+a?I)}0AovX?$S9)5Q?dIklpL6Y+eGTlEY;{&4-CZbH;=$4-I7i3{<5?vS@i~2IN z8kPlwal?oJ#%4Kk38pG1!0`~|L}QSfRnc0T9YXihDkF&#U5p_F01Oz|z(-D3-4=m}LsU5)nOr+KIZP)G5CsmHosLL(aXDVknVf7iE&25C zLWRQ-Q#g{yTIw3>|7dM3W|>ELPVzN*sJ~*kx*p;+0ne*KF9id|m3bt29=MW_H(q>| zv#z$05A$S^`Byz6a7X(lL#@I5gmDqt)>5Kk6yS6A!bRf{GF2;{Cr32{raBthXmyRF z9>Hse*EPXj!i^FXZ@&4a%$rvYs&bNAaDI74tnA>6!%Kj^AhW>DEGlPb;9p8hQal>6 zQ-A;*cdxwm@(U0nO|pMmrxfGG`H1LCD~dSynfY6;E2pA_ni#s0aBAiC!#v0J$uXIk zUZGYk!_)H&Moz~=b)mIQXi*S@$6xHdEPbOhi2XUWj(;g?XFae@m6UEad-t_|dFHFn z%4h%jk7V0{?G#H?9G5TQQBebU}4q>-udDVi@!a^GEd;HA{`2pm+{|F_RP&mn3J zqJJo8VtPh8+FFexDL7otAX3W83#7HV*A8 z8GKZzs&?U{~ zMD*4G&Eq_d;a!lgzw{kB07%d#rj77Jpa9yJOEqJTp0rOUi)i&l^9gYf=`dLfbDSGF zIKa%zwD`>hM$U+(n8vU1qyB@}9Rs-#Hs)65(F9jR0dZgnUOYCBye62CQXi+!0-7A5 zthAb|#1H5Fp#zUXBxL2LtxK{G>9l^ay!zVf)Zr8Incx0xj!EJGu_{6x5kZA(TI#rY z4n5lNmwuBLChz&mh0Aj7^cfIrM&=RLxyYxpoCLH&idk6&QPbL6Bs?eSK&c+9;ow06 z0B3E%DZ4Q|*%)ZA8Yp-GLa`pnR8(5bF-ZJ<2GFlRptL8<7b!-^Je4QcnsnE}-LlA8 znE&sed_hVvWZIe`&o*)R>JqXiND9^@0#Q*y6v>B29~>HxjWu-`gGR*AkTlgnSJELm zv~#bK_9$TiaZs+beqwA8H@ribGIAw2BbCi%vhB83QX-B8P*W~iM}PEarn&h=HUcWl zEjzaV?&MI9rM0Ckn^#n1YN@N2LZqA8f*Kkhm5O?fF=9$RKUpe+!BI#C$aek+1)H3( zI49jV`f0V5A(J6YxUF*SMi1V}VJPJ}lE;+$8qNA_!YX^}J7twFhlPedgC-CpF1dei z2a;FnzF8zG4oG(f(`vj`K-;CAaL^ zhIo&1N$V3fLl6XS!!tK*+-OYKmlYLCg}(%>P$U6@j}xOhQE&K?OimEqeJDJ=5FHyR zSIUW0I*Y8LHk~lkMe@*-)$S0|boM7Zln{98>Lq#UrB}F42!{X$XQFZnMJWu4ai5{S z5xL`m!$c&roOt7u?73|pDwPJF%Ozvr04L)4Y1AMiOY`JUbmb5zE;#1`CN)&>&^h(UT|XB$=rWN~H>?(?)-Yx?V*Asy;0RwGwbQ3$C=uo(*Txrd4+Mz~~@=As}zOd>jH|pKLB|k&J zDO#3ipMRFeHzEycFgRb$fe};^+T+ayc<33GDUh*)Fsmh-f<^tSW_nhK7p6x~08q5= zBrP}qC-|WeX0^+tof;>h860G=R$4+Sd9gtI?$lV1Y{1(GdPa;Pc&+XE!&r>t6j0X0 zC@C9d27Q^H!BIson*D*wWd`pi8Y218+Q)jo!7B#*PFGBHOPJe0U%6i6fMJob$M798sXKUWdLGQ~lCm-ztUa5;;D58m+TKnwzTSt!rJ< zneUNh&}8RboYl?%2fuoSrQWAI;9y7M&VR4X#HdXax|4tk5{=W0DU#AurFe%a7q_Aw;iS8!Mt~JqK(*Hj zY;$S6)T2^SJ-MbKD;uv6$xi_Tc+HI)-WfYxF%+rVf7U3YG-@hMM~hR|xn2`TFHKtx z?A!g3t5>g-zVOTonYB>T>?U+hA;SK_Gsk2R5Oee9HEC~P43uO3ZZ7n2$aNjFM|${} zmp*Qg^3Ws~PrfDhG`)vY=v;DP^n#S(!8b0PMcL6WkG=on(%^4k)O1ETBpjlH+=twy zkW!|MiGFu=J=}GJoH=`5F86eaImamv9K4%yr&xabOMfXL(=t@!8vHj$C(*dD6P7pB z*W;PccBGNEhI)gjP_Uyn9|kuj1Mse_w*Hh5fznf{kJh{q0AZL9N^d|K2BdDr#aUEU zZ7}Y?<2VQce@$*R6y^pg1^@I+U6<1*FVjt9S`+DS zgbl0O^2Lc&xi)a!5FPe`b3%*>>Bx$iwQ!;fTY&~v5j%`IoskWGmgva`=uN^2uNOIQ6Jk&UKxW%fSoe!vYzk z>5yQ&MK{t2C%OjlvQf&hTLBr^=5()G#(nojePTTFhg_mXZMS*Yuc4wr=i_`OJ)*ym6B9ZUiCxl05y? zX*vJ;HR;^EflwQhH!dBA^A@m5RC<^$DMkHJLQ05(lvf!lcN3zuQc*#DKF2(yVf})^ z#SF3?Gi=;VYucWfnHZmt{derk_Vo0zMC^213{>rtS}(my9*{PNWPFHO8p8K?FT5(h zzVqYMp&q$3a7i{+)=9`2kylT@BDLfbJzlqI!?K~SaFLVGy#1z3$7rQ3$K`Kde?wXu z>g3Q4T8eno5K6=ZZ(Pf=En7Qe+m5Zq;P?4!-FQ)kL%_>ngcu=Z9LQn@>C^C^o>^q0 zaRfhQhG(3US)u!~8b{fb{Ow4%TOBk9l|#CyUN{#}7J$S7G#Cv9ZTv?Nra2Jb*&$S1 zs73>XbUh0*g#8(H^bb4`(Mu7!Uf0%ryHytMl0E85$OpY%}O&KK#t=1K$Ga4GJ z*{nNkO#KiD+f9{Aqe!C-31w$Kpa3Xw1nNMWf2a-i*F}n&B+(P^|UKdxtQvs#Vnkv{Pl_aJMYy49xt82oDk+431)Th+M+Vo_m&zDI2|ahCxw%EoG8mwfA@fXY%+D>0 zr8dQ28-JmNwK%+YH@Y&v?Apl@RA8C`DA6F?`f`{VCbZ;BGG5}5qrMYf`5HrT#U1;yz2``Oup)xGX zuaHY7f}qN2kfiF23*_zdm&I9uW|-C)ZbwcIav;g90mue>I64qz$DQxJ)8L0!?Z{oq zc8ZVlC9k`#$VPH+Xoi{F#H4Iz;$ZYlw~WtB8)bs#AFcm%HwVepX+&r`v}Pp-^9O2~ zmIPE`Pz54}YJ=RU-v{vy{X0uatEMw3G7tzxDcy9)#zu$-dy;3F98(Xb&MkxrZEU+w z4&J?AZc-BNI@k$aOUZ;#U(do^T%H51TM4D;tcXG#EnAHd(z(Ssd2sImIeOxxct~60 zpzBS=??q7OVB)ZWGrl@yq;Hyu5D1{91z4skaWEuEzP*j9iKP_jEFjw& zJLKHOOZ-iYEfCBmO43||DeEIjY}vBes4mcJ4Ou#OZS^z%^HC0uHOU1xP3?w#?2M+qWTiRiu+|+&Oe=iJQmN(8_f_b4&%M6cB_FcPp75=zDYAGW$OzPhv ztShgOzxnI05=!y_5IKZ5{tOLE*L9TxN6%j5k4lv)_LKKKaECOu)Emd}-*fk!a`er& zXz(MX<8L7B@E(96V#2VDvWFSrKY#N7liRoMkWx;Df9>S+(%QL=jn_^{hBw!qE=XBR z2L0n4YScL1so$%FM$gdF&w6^mGJLpB_=N!~CeU;OO_d=HCLHq@Ma0Y+DDaBI#+_nH zaG6Glc9>$pm{c?rQyK;2()mj;P7_?0SDydY3q}K=2}#q1ix)XzcRS(T#-@w2>070y zvDP@;EDY|@L&o*b8Eo0w#Px%?O)k~~@gm6l5>)4&?VU1+6nS`VN}8)0Io}H+g*8?B zWr_{`$A9=|oJm%UEDEhS`B-PX6in*8QZeAv=|m#P*}yqDd7rZ;m!rcsuXo2Ps(c6= zlj%HHy=4aCePxj5!2>=+Y~5beVoVo|aNg4-D6bKi-r3s1&W<4~>86~b+rmv{I(nLn z4P>f)%TeC&Ew>*czwumvszq3$aftNoP-|P->*e~@L0Q8q^k;Dz?0PXla@uHbugqED zxG5JB8^dz8_aeX~E{$6{x14IQ#7G6_Zbt>O6YGCS1Tu$ag3*^Qy8fyFy zlEdxP9w}Tcp;^l()f_MLUQ`95WQL;JB;^I8A3PWRVD0>XPWhA2)VC=XbzMJ|){sv) z{_eM4lf)9BQwIZl({S@wDsPUB9}Nw@y*=N$4+ z8qyLn+VjhnbUxkqeZSvle4fwqc|7FSP>AsF+K|=-Y#r~AuRnF9(>?7k zE6G{_-oY}**yOgmZ{^B>vCiUAX zWDq2gY!mp5(TKftMGff&n$8DD!VO?5x7z|4ZsjF8;^AVtyUz;}(P%}tN)_44z!Gw3 zBI?!i$|#B0Wm&}n1jhSh?S^WK{_u*Ev*9>7Wuz5}V$vsNb*Y$`R&*3Ujs&VBkKlWg z^oIt*a){IPB#q8t#ua*FBPi^6QIHJE4v+I{dc|Kq3mrDg3R6;13gNqh1a3~?%sKd6 zaiCWUU7GOAxycTB`PDu0$-8ft%Qh|sa9Kc(nkt7*@8Kl~+Tt^$xfA_p@?LElJ$&N4 z#JWV5EL$Q|aKP2)+oR&89SN$*I3yZ?cC|Zkei?mK1a58pZO9vsg~|6lJdZL&n1n9b zj!e1G*)0bS*2yRDxFt-od+7d06SjTj&AwV zw?Ex5C+4#FsElBMfWSNMr4WtG06w`7P-C3LK8>GsGFUpkCIOhOt)pGC362!Sd1cq@ zw0tg=19b=F+8eJ&L#tGppJ|dKZ$nGP+|jry)A+@T~hPi+z~K3_$xRf`tUiZx(XFyvwhUP>N5S$6k;rsJ7>io`o4PA-)8tFqo_<{G)QE zG#}LARk*h>2`!yP(~}**9FC6n(6>Ah2Jsaz&_X`5ZDEE64c!KPxCPvaw(L%yRiy{TKST)9l@ zdmH6S!$w)@SSBwUzCG9!;b3d9+rlN zGqiD-rFz*y_`q76jwUZeI+w!vBF4)ofIdxOd?pHh6y|l+M?Wf;-1<=_g|3xs_*k}i z3&dGgDcyx7;v_HisgF*fH3qY7?mHtBG0Z|Jbx42v2`Wn+(u4$2)2o=Z6nrV}!81rc zT9hg4FIg4#kGcp<6%Vh5>T{?jC2DZ6KQPyvTm>$a%Bqkg--Iob>QTbo*?i{_cmcXtLRX2#S?NjKV)age>H$r&|Tbs~wBP5-YA1S(tQ8W=J+sm^ zAW;Wj7YmT65jFRTX~2&p2bg#kP@XbN@ac^(Xv{QNq$Ks4#SHFG8JY=vV{B>0TmdrB3ZZut@$c*L-|*8Y*-h5ybBV5 zilJyZL0d?}6&rwR-6JZ@LUbb|=bhpiqEn-UoSWiEklyFF&hM5x({GoYlw5hP<2j&G z5GwNT*zm$e$O&r1$|;M$Z%(rb73J!JnbNNfY%~G1G&RHcC;`GOhVd~JRts!zZj<_> zr-4h;z#MYI8+DQaCi4>)p;1P>67&X-ojgfqlw&9?EBu$AZ2ws|%NV|$nO8o)2g+qm zDAF7l?in*h>rUk&Y6-Ea@f4?Sy`=M`Iw2(npdp>8udAa=diii&rU6OHN|E#uhiu8a zQmQCvMJ3gcg2afYV?XrOR+;D?5Nmgbgos2voElg&65s=0Sp(ql`YwiM#Y0d-=!{;W zNID`S?F;3Nzx}c#J-AWIR(?c!hqo|YrAa16ekMLTv#K2wd!N-z15l`rE;dw$iy8>&j3Xmd z)^H(~Us7oaeLWpwahP`8f4rqoW)F5qVoSGtcKuzlV*XM&SXU=!M}96TrfM0Z zA6k2tY*>mk(#tV|sZkFap6HoaQ7~c{79m8U6gnK?T6roljdn|9Q-s*FYoCnKkf65} zfE+3;-rChh9h;_n;uxcio+=xP(%w1C1ONV`-sWR;+;a<`V7_{{Y+AFz7nrF?Ott$j zbacafrMf{B=%tF13m8H3IQ_smusjCD=XQ|}9Fv?U z&bVP^k1Hqi4P-1+heY0!WV{ACt2_HGpketkE zb54M{_LDc#ScZR1!w={vH&rs%BXF?(j9gh&D9gA%sj>=k9H)i^eLT59TxPG7dC9GF zvc-;%D+e2kBJk;D=jzTRAeHf*XC!IE8XDBr$n+R}KQy74NPvbW(|OZX_$qL3m>T_W z{|M=XNonsvjEurZfQ9oBC@D&%Ooup1Wfuzy_*g!e216P#hd-p2014uB)~~jAXq%_{ zToU&20gMqaSo6K?8pu@nV+DJFU_u!Mh=VxM z+T10M^_R(ov?zIW-(%7|1fUVhM&^RH*u*R;NUD;t=^}aiY)~#;o)21gQcfHu%_OIu zAX*=xT_`^&OZb zQ5$0Iu||YlA2@l6;x)d;^pF2|r+Mej{egQQ{NiMD^U$qt>~D;ir7)b6mu*z7CY8RA zNJ^xihR!y2FWyQHk;tp?w<0Ycx}r)pmQW>X?UG?MIbujHY`}dXK#^FgA3{OGMK5iL z;Kv3wUE-$}%dS1c!WX*cBxmIUIR&u(8Z~80Pd`zh$g$V9%V6`6q>^t3jlEEEAn#Rw zT)NJWNfQ8zADLp!f0gDFIy)g%S1+Roks3a!L>b|)8c?ZEo@QfeDy3B&%?3t+KouAO zwgVC*1!RFa*5L(K{))=%dw8tsc#ZP@C+T`nN~$7cDn=GwQWjXBU-Ra$Bge4wp~S}T zzUl0iQT$;Fz=Zd_PB2db8*s~-6_v7b!6Ldkkd*+@%E-#6yP-tpFI-7gj3ACp9g~oa zYeCA1ir5^wODfsibiRec31jHVZkotk&LPEg`=@RS58V9j1JAH&$qZq?j!sSnV&dY= zpmy%6`ITSXUsvZ^w{D%$3{F9jOXQm6ceP&q*EbwWNJ+UOBOQl5tB~I;AjJ^%*COCI zOd?YJ{XKA>6H=I5PiC`z9dwjp@f-zj1yYNHtgY0RkhX(5tkMmJnywM3rb1jujZH`B zw(EsIWI}DmvWU)x^-JXKv0*Ap{n9~aK~zVIB;;9m%nu|$aDWDwH$>#rOX zOA?eBHjIxVNEZ55hVe*taU*={a;!1FRogDH61up0(@0g(EA8NmhGLYFo5yJc^;IKa24^tD+VH953)YLc&%%}qO(`*V|*Pyqh2?4koDO|jsQeX@D{c+j8 z^I=)Le51@kiE6`gYM++}Umwf#wDsjHPT(a!Y$N1E`5xn2;XS9_VTB zY+dcQzul&vegFRbK@>1291}|sH$=$z{1?1t{$)|9nE`t6IgBmQZHg4%6E1gB7VD)>dHL09q zRf$)^xGwA*zIOr`vmg44@~WJ$C$#XO+-LQ_;Xsbfql>FI*8HLm)(yqyV3Yy@Sp+ko zCgHQ8uVpV{Qwc0cT2}x)#({!Ev6T8SxBK@z8SeW{Dyf9aXq6%>%uf)+>YQ9@uWOJk zw_eAAz%{^_NvBfO?;H%XJ?7}lc;wM1K(HpHIA;mui3*uB%+k0&YD9$GFgNG>H|RUZ z(aExgm1y;iCYh29v_%9vTHAUzU3>Y*XoR*iJ0V2lv>}Z*W@X5g#SV35Yz8E%kpe@k zIBxv}(9@_??s!I0^0UQ+8JspJ$t)Mm!l{?+5*ai3Wa7v^8R`R85a>h`HPw1@75vast@8M3Fc9P5J*l7d z(BU{skzp8Wt+FoEa5s0g!i$1`#>rN9tCcAYxPBe66I|&kYbrLy>*P?!*11wc0}$fl z7I93>l8^X7Ap=MNy;V*JcV z1T|MmW|hv_FfROhxM?jYot&5j?DB)89VHBK-n?)pbXJ z+;H_;W+YCCnMz9oXqqiI9THtBCy5=vi3%(8@V(ZBFIsHPV`@E-I8mu5LAPv&#-4Mfx)f+=Kk*eONz{L_0?-6o=fcpQL|AwI(~3BWlWzLln4CICktZ!Vw6wa~ zNCVo=Gv}HgzXRpq5{*e? zSIENkD9jaANIlWp=7t`bUc7*5WgaPoy2<1{ly#6cY~vzvq9Z9o=JA1(d;26hKU0R$ z+Io{+K4*%SH7zbW{g5=GIB-=nAOvzoP8KD4az@6}+;Rm(vs+k|q^(zqv8`WjlrnKH zzfuyS&hb9b_b_G3-lNAzKS<|jRmlQP`@vVg6z&PGURX($i2PDbCuUS5Wc{mtSjlZ+ zjuU2Dd!2Mto=ywZ9$al@i6^3N8&I&pAo+|Cz)O?P(6+)sP> z-gH)m_dh44HC5uxPLt<7#SkPSeIclxNTTgoamBuds^s1q+>zx<#BqN zqy>E1DW`<`^RjE{B%#W5s0n5v7n}DMZg(kKC{OHoTKd_DR=^D(r&rBq5DTN}ae(TP z`bzc1nx=)zh@?Oqc{pFteu-8mcwgtKf+Z3NDd}zsT%19i6b*QvoZgG_h#Ec5vbao5 z{lMp?1Q*qPZXZx$4wF;oBtF6;mu+%LaTWymHaO#4X7_NX9D32b-ZuaiY&C~<*V_|7N_@n?io zGd(RI{JA^0gf7iX)~`FjwDY=9sMd&bEj_OnZ@*q({js*THvDt>e8+t{6soVk2l|UK zthzqp9FtVY*YO3})LH2eJl!O%Q2~_VJgCIB%Tb)ZA3y7-tz#-Z4<_LZ*eeyIOj;x9 zfG+@6ysOhK*Yesm!{}H*L>p#O>0m6}UYv%P@}Qp&=HvB@v3A1d3*vWVOCRO4apptB zWa2LF$r@)5Y6d!0}qr|5RrDj{v zAKYp9^o0j;;O{P$5E%r`DW0G)dziGygk)n9Qc3(Kx>{4*ujDq~mp-1zTYH6vVY4hG zz)4L-Xq4lva|Pp6o{`ra^9@TWrZ>5uTq5#Iq&N>$(Ago=^}Ui)>>&4M<|3wj3~(eMwD7k-N;yjQe#B@4T}=>~{5gz5Uh?8dmF_dtQ92Ij z%mc_3&UN)mX<8ne*C!WVtK)=*tiDrWH#>7WRE6s46Psz{A3r9yPVxo0k zWrC_&tLChl)3$eXNHaof!}KK0Pzs%86Eq(;Z;&qqv)J7X^k|Pw+H; ze?FxC(wdc!5}_9lHy~tQ20F)Qh(N^v^?|4#TVsa6HT|;+e z8Z`iqJ*-WA$+gvX-qC7hK~EpgCQwp~eo0 zZ)B<&{9ssnl1~8Dwje`(R+%F$Q8YtiqK{B)AK_%A;V*j{9zQC-e5sB!gs2#ZF&i#;AH3_gyPCy;&rF0CGlO65q6<;$!gv8JfnT~Q zrIykB7H2$EdMRZddoS14H9= zm^`Wzd2`963t9ds+27j%A&j9;QSfsykFzw7Ioa{HDWYsNs4bChDNcnSb)iRQxi}s# zg!7y<%o;G@1?DVe+U3$^!RTH%AgFN++eZJ(*GB0*}q2^Up{c<-vy=sIMyH z!p2FN^_#?D56KnoL2JGgjrg$#c(1G4`1mn#Kk0y^Le&_f~pke z`RbDaStsqXY#hC13Km{A#27S~IxxFuM!=4H=)^$iP zJ{w!l%GophyeH_d5b)z*LMD1cDd(^{{oFS8FKnpNU5Hs|5&>i3TcoVlT*jumS60C6%@>kTFwD^blWe&+~y>d z{!+OX#~;})F{@U}fGt&?7|VqFJtUv|1Wl@2Uu#c2QPU+X4$Yv0h8#>wAy9#)Rvq$7g{a zjh0|Ei?soY&T>mUcr!Ya00T9qSjjEUlLn-KTiI;^hyWI9fnH495DbktPMVwVTjEW! zcV4zM!)cl$Iu1s%n_*mLKXOQHM23aHa%EiDlV!OwaCx$r^YgF5MfUXdNKf-Q$t8tb#n8*a$6uC4 zg0+b$)b~z6qQkE$c$%I_D=QJ{6w}0GQp1HROaT*d5cP zC%0U&N#a9P$O5C1QuME64@s2kCS?pa@zPTd%J&{RC|6&$9u^4`%D_Kw|NFm@ex9p@ za^S%JeKNj#k66kJv462=Qs_8W@H#Ly2}Ng z?DELj);4MA=?zQ$h9_>bh)MWF{r@2+s;$HWfIIkWROB(aN)AcRVGeN`L$ScgV=Znd zGf8qu`UJS~SHwy*pQY)T*Dk%&QSzy8Jtm7U{jhxU6F13*wJW6yK;~PYx=k{x*U}%% z$N;QD>p#^>4rrVcnDO?pNZGo`ARoD54cN3>4!p1@JZ{HB3__0%&EI*9I&jM7JD!Ci zWEE#GYCa3r2db-UEWQ21?z0!Bw|1R-VO*XySoiO&)kFC^H$B$xdTVTyxd#~#ea}4) zb$<14H+;pCmT(_FH0Yc18QV;@MpPvR`{NSN8KIRvZ$MzoQ;7@qN~ zfE-RJ3X-o zfH4(Z`;>8Im}(>w;B_4uX9fadpUYYNUwDnOgW=Ox5^+b8J4V95T+4_7e{PDrkd`DV zScu4$RvBm-q}EK)0dAR}_c+99iAe&R#xe~9nR-aobg+iH6z%t2S)3+mg?2FIvoe3n zt#Hy(>5F!e`WPjC2%@3nr&rd=aZbW|Y zz@st`)M|#}L?&*lpb+9=N5Aab-*m4GeDOljrUz|puiW$Ny!XE@=DV8ccOJyz&VjTV z{`u}5_Xh&DgXkEWUFdkd?HZK5w2~Szk(ai)q#De$Ga4-pr2Gcxy{TY9Y(RiMqyfik8 zk+gLD(*fwFP(MQ69*0FxN#btMtYK~B(hp8kmu3g53UIcIt`3O#iP2dSbKz~Vx`t%M zWm{eW%Yz&p&@oGFEP&QkTv~qHmar*+UQhQl9Gq1Q|Ui z5s6V0{O9?a8~aVJo`!=g?)?;03~jHt6rlROx8Hk$fAt%ouhp(MORe}LU+cN`&4Jc) zr)MT@Q=Vymv^~z;PD6KboI@O)V^W0Nk%9(el+H%Y1ST`oT_q9JOWBDm4pDS942%>{ zm$(URLZkvYT>OEeTq(ytxq?VOP;7jtT|5g4%ve5#j) z^>L5WcSTQcYAz&v3mXTTj+sqhAs3$kJbCFTihFx|r9t||v|&=x_MQ;S^Sk8q?YGF( zC5z>9&94*If@6bSBXQ)Th!NsF87OD!?8PTuctXDTxqlLCH>!Xh#sF1S%afA@G9Uka z1(h)`z)Iue+XMtx60X=P#*CD3kJO`&ydnGQh)c3ynbMz~nVlPGY96$t$4t*wEe_p! zx{laj$(^iU7=irNa{ca?clE))`LO-_JA(>de|7s0M(MlljtI#0vt&HUkeDihW`io+ zSpoaa2z?y^u`09EeGc7b8l=ZFW2O{_Qk&l?*~kVb5OA5G-9a}DM?**9Sjn`Ozil+m}qWODd1eBmlEM(8(HCAaPb~M6MttPgR02Qfk#yY zC63sjI4V|(@zYCy9n+%_HYZLPg!MQ=)IW>j+F%butl2P8N()E(s1u8ceDaZ3oas*w;IXWD%^^!B+1R0*(odF}vsG{<7k-0fM&<9ZB zlJW1+#u3Kt%4`E0c9i@&-uOFh%0%hT{^9*dW_? z_Yo&huqY@KQ(-~)^!fmRCIM;eurbqUsOwL?T0S$CDBrm$Q!ZauB_24?L2|IkX=Xq~ zL13gYFM{~xnSIQ0GQbn_bRaUflyov>w%FkXX74|?{Rg#o>Kbg_+NjXLd%9h8Z13Tr z`#C?)RBTlMBzQ|w#&vTc!$?%5-D)16@nLj1g$a@qKrg~QEJc}oD5bYJQDmdvb~)nU zs_+`k$jKOWfeoCvuH2PE`W-AUZxK36GL>O&hFd9Of zTr(G0%YGy5-5zrgsbe%K$un8&@Tt*36{@;!W@Gh3t)0Vd2Uv9tgN?A%CI!++wxMT$|ByFVxV9xJ+ zMCPxBXup4#M4SeYu;epq33()@oy|3!=0s9S^MetD;YL4lP^5LVlfIR_LTZTIuUlTK zbw?Tn*nH&n)4YEJ5M%~2h6i6ggltp?)@mBdawC!tMRSP}oi@L*d-#~se!X7%ty^oY zJ9qB<9mMMQE#Z4!V10s{8h6g^F4|;^dhMxxvmtcV9OJF+zL3R6M4@wjRdu|JhFb$s zErQFWP4wY7au_{hmb`&pDTNc|!Q}ZU4x}!skRI^bB=30_whdZ=Si z>fSsm3~-Z@yh3O(g($D5$XjhK5(3~@3o$<-CN3OBYxy$B<}85gZ0tNMK2Ecp&5M4r z1h-rzS)aNK3&A|$2fr@SNtM8<7D*x6VRb|bV@pb{50K(E=U(QyEc`j@-8fq392a3MBJ%4O{m%u?6E-%&~CDd3nb#w>tqgjhB*+twvG#u zYeep%Y^@v}&yg)@bBw$%lExEFG7ASy=|jU5?=!QLsqqfU_ehD#0?i>?TCO3XXpPV0 z@3RCAE#k6RwjBH6=Z|f=`)=F*AJ=-rANCLU=MP?BeeMcQa(#8RrTpmgy8?rgH$z^f zA7wgQj~6KJTHR~?Ccbza~$Y21}E7Dm?W5ieomtuvYZ{PT7Pd2U||uQr~(_O z8}hurwN(j4m|8?ks0}+Pnk&6EMEVt?-W$QjN$G=SNiS~@000s1Nkl}{$mfg7@jBhk0_{0Y(+Cmj&|vIsL<Fvk{he^K$tt`AoT*^h*K&J?U<@ZiDd`$A4l#X zn$?CrL`{04tx0k>Tp_E95~UIvE^Gzq=5*PSR`9XOCV@(`9LzREwo$3G(Ms%3qp6+u z=mYt(SIrlK2TAK5Ld9T?+!}5bZ6_)j?1mXxQ8*_zUzG-YnI}X0_KWBEAxQMZ2t>{v z_|c|<%Vc0WlhhHG2W8DJ=s5%5xmVK5OXwT6Ad{3NhwDzu&mMhKvTU7_l)us!6BUgb z)HzgZ1GoMByPtnjQ`Cp=d~Xr+yDjwlUSNH)>O1c6*Gsh}|IvqjJZSXZTnhWI&>Ce) zin01;h)g5tHOj6jq2n%3vJz9nsSF6b*mIcgN5`U*ld~8Mxs>XU5M0d;w2AxpVVULP zJJRE%Fdg5=+1EyH3qg{f`=c*FN$nm$GJ(@hq>>M=ooYjH1fWBSaIr+ngGtd6k(|NA zH6TeWgPRSK1m!j|2?alJ$rv`xqKE|9R8vJNqC1C^i_cC;jh9q@-$;03W6k;TXlqK(yX{J4DWYv)mlr}iBgKNpjfg2QQMBM;yF#5e!p$9Gh- zxZAe9E5`h8i}`N%{ZR`HyFXMNs`qch`mVh98&6J{0-FajV}jEYvzCUQmN^@Mz)6@H zPjnoW5S@1>0xXLMaT8<)+o=@6B$kzQ<44oSbU{T)PS*o|&?3pg6_X-Gph6dRIz&*a z0cnyyD0h+V)QM^cGjGncVB7Rvp^=pIV z0%qtS%1DNds1kt{vY-y$QjIEG3>%FUFWAr|zKm?DS)6RxAkKTP6#K64%i>kYCk`OY z{qk^10gGzf-OD|VS(|$l&5a^ZjlrAHp$rK!;IhwoHyNkf-E>h?!3@H?-5Cu3?gPkw9LWA$xKCl*y# zl^;uwOSAR04F(!#NBs%PlAv*111tl+ZWMyRLOKZ&;b{!JV|uk6W-1ARaC9hp8ZJN-V8V%wz=(oFkW|PDNH799F93QqYk)!72V6*QzHs#l z#sd)vXDt#Jn`jJ@pq=r=asor|7&Y+L=sJU5&Q{ZS|P zopt$>EwDbJ=E-*x&hu^mt>5%5pFMtd`$9L8c*#byF~T~hBU{rzZoG(up2g%=!p=0s zGTV26dAzSZCq^i?rI~5r9-vuGZ0TIk+*W5M1Ucyg6a_qJb}S%|)!L!Xw2#NPdpJEa z@SthFLIaw1lpzE`bBo0UPMzo*B%omfXuB%7H{H2XMu29fFp>dZO9jQ1mZK54s_mF( zoZ?$v9Ucu}?j;h&f7_SEBbnSHjckHKfR9#Og$}!n_fJy!Nhh`lh-1|XNnue{_j!Wg z&*w&rvH*LDx z_J`)V?=0l+`}!wcV11E?2!onEealA zR4iFspdu|O07G>htRol-aKZ7Jq#rsDNK1o^4k3ER1XC`I8JH8}u`XG{!p%#`l#?xu zEH1Dor`bb;m@4e~36`S4xII}};!Dnw3Btv2HdPpLXlnx4!v_ z+FA+f;=c0A`%8s>-{R{1fAR&^C%vh*c5Yv7ty#dYKl`0;{3K(=@^a#-gQ>)5bkkdX69o2^du6bmblZq%AcrP@&FmJ0L(P*^NWici_hlp1PLMoM3 z+cI_5fog6T6)ofUy=(^hK(HJLp%G+F@x2Sav(7?dZmSqcqgH1R$z3-%pvf{riK{r+ z)CTWsA{^O=09|61%pgDEM)smxPCAiNk4o@$wRRal^p&U0(4UV145CwYC0G?Y*IG*O^F#nHAp1muYi1z+|;%dIJ2pgb{7 zJAF?;q_c^1E5OV&!R8zT{wyqoX5*uqFBc(lh~YD^M7r_m+QFde1lnUX3v-cfyzp1$ zWd~-6>ybjR@m{pka1P%Zs2`QCQMgO#Ij}epHbddh{ni0V&dq{=mqrARINAwd(5H4t zIqfSdDjp8b`Y77ZSVH}SUEV%#jA`0uvn*b-WGX2=^|RmjJaxzCR(Dhrm~yE?`}e;) z-A1qDAA9?=EwH{ZmMV1T!w>svYuBNd5HhU!=C|+v^8Cf~Yg(J0cBB-*Nj65bKlOaT zI1(f3aT=ysR6>&!#tpdVTt0RM^p3F088^%FZ3YoG>G8DjDv4D zA@Z3Z7j$zv{ovpUW5_asaLrL!VjL$U17I~$FbJsv4gu916(4OY)iJHw+HD4OvG&n~ z);)p%8Ve5eI&d#!^{?C|o7XOuL{4t+?&s;Z`iLBH*T`odZ69a~CZ1ludBgmF`rAvi1HrKMnP*JL2~7F^PZCV&^?tY8 zpLK!XdBNJ+{RmtbWcPy)BFUc6`NfSN_@Fgw-sPQ*r|a@96Xv44JX>;t)yIfApK4GA zFwsGRALUHXkmt6ceB0dDB?;uMs-qbqeF@MOVq6Ytq=!3DySxKj86YtxdGqQlrc< zu^Dw-hs%HZz=uD0{bEDs-FNRM2o1^3n{Il~6`^;oBI}Wt@)9m(OJi;W}fX%@Mt)c;JcpzN=wJ;#Vz-b)q>lJfxnPfVWCB2u54^$dI zr?68z$OAG617B=3gLDxnA=b&sB_f7&H^W~Y=w+n%;5|nZ98qv2U`P}ybFnZ#N8Uau z-|6p?!6KAwmMo?3UVj@Sz~qwHXmcoZ=7e!xex5lu*I}4&&mNfUJ9pi#dp9rH@z6)Z zi(3IcP|HQAt-a|FD)s&5b$h?x|0PfGuiqoPIamv*6=GNKY-}{#L;*Yf2hYC9177U> z*ya_}CexjiSg)~1CnUP9sm60?faE7+2BOTi+0KDp1Cz7iz=upa&mbwDDh+`cy{=*= zm2oHKQuzT}&LIy*%BT-^q8qtIJO0~3HAGeJREM@xR*pYbBk+(_#fE`LW0gtA=*jTeQE8S%Fx0~kBjh9&2(iG1v19}ByjnSuhI4pR zq*Z#qE_71noGHKd$KI8PUuxqn{ktu6_1`26xJMTR0+yxZu{A>mW94v6R$lCIOGHum zDyxs;eu^-ZIwxOdMga7ylB8LS2+9i3k|LEJ?U4w<)YB0Hs5*Oeznl#(6z?$ojc82SFH*eSbW2-{}|&j2Y&Tesv#XbIO5B^(DQ7*TylM3 z#BhH>$mMkO_zdaYK~G|uH8n1JER-=GnXe diff --git a/site/themes/pinniped/static/img/mo-khan.png b/site/themes/pinniped/static/img/mo-khan.png deleted file mode 100644 index 8c4d47f94dbc7d2d6dbb5b403fd9a6eebdea4220..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 20615 zcmV)fK&8KlP)Px#L}ge>W=%~1DgXcg2mk?xX#fNO00031000^Q000001E2u_0{{R30RRC20H6W@ z1ONa40RR91c%TCS1ONa40RR91cmMzZ00`n$?f?Kl07*naRCod1y=jnT$90&Qul85_ z($)Kh2D%#{NQxAR5J(It5TZm<)@rR`$5>%m!3a-G%r8%v4*SRakRs$5D`F;QJXXw* z@>mlS9!Ub?prr+ z?s-n0lP6D}%vVYOKXAv7AMdzw<;qFAa=P^F-P+pfsZ=WY(O;|8^xNZk-t)c*5C2uZ z&&G4`;K7&ApFh9C_m8y8z5P+^L0enfLm=o$kn>@l_tE~NJWV_GqmIxV1%j_jQjWVW zqWGv0e*y2`@cuIOd}(cM?S&oEy{&_OBoN%w)3axNef<|f(33#(N#6SdIRHL2HSLJo z8vt+G$ag~|0mk1f4S7dN_9fDMsiULg&*$goCw405?G*O5MeqX;JkWmO!iAp)sDBTD zehi?s3OK2-j3oWLAtmDO1mKo+n{J)*KTp~}K6>=%XV0BGw|blT-qK`mI|O%jc0K~N z{sW-!8$A7GWD1#^Av2I~nxN`PZ#l;6?iBIme7S%d|I85dC#|impI%y8`u2^{KfI8) z4T4)*TAl##{}fPsqzsNm1V>zBcp%dFn;|&znPxZF7}xl{TfTbu7n_@#e{W@F|Dq-+?^i^hcWTm%{@wkw!`kf4n12yd&JSjbYIa z!+j!c*&k_me}n$~?&|95=SpF3x%Y>LVA$DD(A)nN;Jn{n3#3K_`)zomgF?0eoa5<5 zg@1rOzfCXjqs*FR^KF=AnqLG0{QPYg93=ZUHa2o~<~7ac=H@nQk9HX6a|;AV@-vkE z-!3mNKOF&Y<@+s1aBpw#Af5ev0Q5U_bh~~5)`;K$pa3byi68;roTcXik=sC{#P+tf zj1&>uS*<3PRjIwbBQdwym2reTv!c2Pug4Z`dT6?BO5#|F|$i)VG zjrVajt*4o}$+Wn*xJ~^*&8F9HdA2XgkG4j5W1n{T zo+Ruav!4DV^4`drcF6E%gWeJZGjfkW1^+jVef(w(7GME1(+Sw}w_zfMHE3F0Sxr^m z0v>>6;7f5LJ;Gv8SO#s#X%K$$Krqa7)oK?=?gMFCX?1NWEiNtQIz*b38)aEUs1aGwsR;M&695YYnXa5hWNkokIuRh? zQHJDvBE|1;`kiZox1=3<36)`bz43nZ)R+dv= zUr*}l?94*J7S!y(arBFD=Wy%Sf2Yp6qP~W_L$u|y!bn&(#ND;edqTlb*dYM)XSDJI z(NY21IEv#tMtLCCaG3LU`uq)``uh6v0GOGXN$Vg_*WKNn1_uYz^wb2D>fXS$E=8Rp zrU?YCt*&QEc3{Znb*71d6@C#Ph%L9RxwU0mP>X57wwWgSVwsUge}tFA3~z8x!8Lvj zmVLP){7rw}`H;Ltm5j)T0Mu9L(8JL=vor$1uyVZLG1@_GMw65yyA&bj7wA5+TqR`V z6`&NJR+g7?e$(qL+sE{qP;pZQN~$zNnd>>+bk>*SDc|p|uCDDiM7@?F;&YjBi|sPW zlf#H_bmf8C7`My!5$gCg>ij%?y{r1|yNX~a_fZ=9MLLl;1IkDhFgrPcp$p_Tfsi)X zuuGkYlcFMCgh+ku9qj<*h&MmjQr<*CEMw`~) zE^YZ~X)aj2lgT=q!FE@&;v{F^{u2YhxAoqJYbEV(0E?Gt+w-@P{-#OZG=imE8YFUW zTM{gHw5i#-v5+)_LbC)5FhouuHV`EeL<(8*fDmLNP-Kb>(=!Tkr;YPlM8@FpTVVTb zxOM3)({Jlhh=T`YmMwdBu$iv5DUyr9m!}2t6@#Z(Q}2YoX#X7`*yc2m{+DRa8QS%x zDEUn-lj?KszoS97ja*xAXLY&rP(T1dAZ7syWSK^w8z)scKPtHzwh5qhxg4M>kbV3X zai)zh2Sgq))FT3YOc#i?9M{!`87JlHM6C5joyJEya{~S#_2zi%b6^CA@f}a3jc?1j z9Y^{W2JOES#-J_S;S>*X4Qs2F^vb+BQslLwY% z$t4WyfRekr3x!D)p)Pi??1%N}^xvTq#$Twz{0_6yzdOzG1X>p;=FdRZkvq+6=Nda` z$EA`O*+GR;ifIG*0@3e?mr6yJ@fnFOg}|89XxQX%+Jl@XI`g69a1X(MT9up<}%DWY@=mam*vWqSIBFfhD}dTCw7XE>Wje@oX0ks z=FK?r9}(ul{!YueV-|hs(j|9;e#6e&c%R)|#5cZ8Z+_=KoyrGQiXu-S3XfJKUXdmH z6=70{ah4@O1F(Jv(q)&fS4GCU5-@d`-}E(vqZ)oC?`GL3eudsG>aAEINY`J4DNt>) z`2agcZK;&(x?C1)c@8!ar~oh3TaV7R*iPGH`{FU&K@w@Qr}W2krYSqabfvf>*r>UT z`s;GKTlwz@!Hilr4*nM!qq|kvH#9mjm^XkTfGnvMHDDl0;B|F&=kJ(z?Wj~E_2@*R zPNZ9wgFwGXb~&^TOLgExzIBk&)?#-Nrby=+*7;JUiaU2AwjF=oBL>;f9ey?)@;~Na z%4~=2+a3puE|6<~q8+x&wm5hLM$y*X(E@KdfB8?OEr;n3IN1-L4^X#~^~;UvcKg0H zmg+faux#QPK5u*8-Ko)rWrPASg%K&GwXHP+T*L?{Hwn7B*rP@9prEtPT)P1Uh?Fko zL>4+}X;Ic$uub!EZe0n%IRz`mR+W=c6X#LcaK;AtSqg; zG1^dR7Sj9bda)GS+Jc)vcna;Sw6%qKejN%1>S=yyfqodT2vk_B zNal-+3mKAuUlFFOBW`;zsmX z!goWk2#^KaaMMHwlyp@nxHbj{StycXg~c-azakbH44|TEf?ZZjOPG&TC|+B^C}1Z) z%N8)@xg$hoVodhG`r^d8pQ?3K`Ka7)5{DDSTrTh zxr2p}Ci0Nwc&MWZPJ!Wp14ix>dU4rwQ0)K$n{IM)vXHJRR~LQu9dO7Ir9X!6fM8+v zHR||D-Z5TExvux#)}#$`f17NN@755J>~>3U9|a^#GIuUI;-)||NN$0ZuB{aU zjKFd(ZU=zts3sx#dfpn8$r>4qx3^SMhi@pgt)(fm;*MtKNZQoV#-1;6EdZ+<1k2_{ zMhlc-n*RPS@;0YwsO;+Ea++UWO{<$*X+btie>T=CX}JdF&d!5WD3tcB!VOyTl+s3i ztwGjux20a4a0u3_wCy0xu#p{H2hCk$*Hkk&Nkct=9 zYH5aL*7U++nnQwK-)QE0E1kV^HO($;rZ(nbDR>iPX$_(-+_~8Hi{PMM!vZ-DD(CJz z1(YZ_;scJpBg}s9TYjI-F);A=6e8E+y%Q8ky5*B z>Q>UVFc(+05RjnkD#&#jkbB6UEr-}VB{;8E88AaEz4mX^(&BPwnx30ao5y1*}T};X=u;#+^PD*Za+)LN;0h=vOc!~GT@ zO0%-)S`$bG;C-;To=((^5Myr#%M}n&C6BDN+Ez*ZJ)Nl+_AGL%yk);+%Z+Y_4LcQd zFknP@)TPwk)?RErSg+yHR@bsFr?$45($wNgnpjv#uUsBYXGdn!_Q^Tfcm=ZPxA4&K6EKUoXp7+iSJO8*G5-O$#jYl~ zfMIt>;h!P)kd<0tG$h`UGa47)z72~f(nq?yCri`pbfj^V2XJzS98#6d)CJ}3AM8s* zJzc32f0xJwQJvM6EEV@5xpu=g^BgP^MI7mrxYcg8La}O?GSZ>kVkrhCGZ+-+6!xOM zB02lXD=W904dz=1(!T!QbYN&8ZLTgtv2X_JnVO!>X1N>8*&AC$*)Fr}ul=zM>vP?l z;a6wRQD49#SK9EW99Q;RcI4+Rl->ip{*N5E!=GId%)H?)(SIL#tRxT>?{ZxD<8AtK z!><1>=3x=J!5k*SrD{jFVVkf>*=R>cYwD}E0o)!~achBC=FLpGu;wa2?qMEmgL>MU znNvZ8Y&X9NlM|>ibZ!>$%^=kIP{23kx%}GRvxv~;0U(Q)qFHviN6mzr2D^LH@L*RO z-ZOyIjkHexHh5&!Oy8;ET%O@wXtsg^wKmb^K})^@JvnImPZ>@TxKmif`7XsD#Q!aD zvg5APt_Y@q|AumolnW~rTCTt(*Et73I6G=S!@{qSC55Sou*={U0fhA><53Dw`fnyp z2f!UffZ99I1?!cn2t$Z!hk^?B46;C)5^|Rm%{=TfNy?LQTVc<#WrZ|Vmu;|m*V>sn zLArj|zf?%oEZt1sN;ppw;Y}^30m-y!6UE7j90$KbTwka9@+!!!r6mM2^kP}q0+ri@ zprGXwoXUC}#5*}*6mTlXmth{^0pG~O`#1yWk0QSO-ciUxtbc+=eXyLc?BA)HMoqR4ilJKickKb;u4OxzNUJC(AWQ(y!=Pvdc~WU76w^syGZJzq0+;h%E66s^ zcMB9;Z1NMwyzD4y0_k~hL7~b3@R3Z_YOLIXY$IK>2q&GV9V!TRsTIkYGFMlasl<=zL`ZMojYAPILLNeP9)v|oFAi}Cz$KM z(pdP82nMr~8=E)Ix766~I4~{K1BQ`)_ z3xi4Sv$+0~SnF zZj)>neFlY~1Zl?rzmXjIg6Y`?KL zIgj?Dd@z=gY+Bcz2tKe_=iN$$&4yft`Iuif=o?hxfY{nXJW?zM{7n_oiddp#@6le< zW~!oI!=zq@OloB_qP9|OL)zxB8o4&z6iYz|uYGlJnLk|FA7PDfi|}}xC-Rv#Tpf3##j zNEhw&?FjO1do%Sr5@?%ka>@{~Za#?27`&NssoQqCOBQ8j&)xsi|JrM>{d~FD0wVPg z0QdLw1~393Wdt|+%ipH=JMxz+3V#8pg4m+`81Zf&n%^{1mK4^)yeEYjo>53#7MT35 zBinKmnnYSIlW(a`S`n~1-^Rszi$Uh5zX;xBEvvr*;%f*`a*HjOZMf*4ZSpDdgZRwS z3o{?nR6AkWl%bV}YhTleWZyn2K5~O7Gx{B6=ZflojPuzkF2W*zyv=G{{mD3tGPe=T zzU3Y=d@LgF)!Rncaryv23RbONTJ@mYds&4kP@o2IhUCl~D8k8ShXht$a%AKdtrU?W zSHw$QvP%a;a|{6T6zl7PrCWycvFu-2^a{ zoeFcB@}J$p8`A*iRtA^2%#LANI3k`5|Gj$KNGZW3N@k$|TkwE7@l&Th*q&Mg!a7-( zy2fpGX#_Rqv`|`2VGHQDp#c%MqP?Y}B+GUnNNz`2;gY5aWM!d^^efm`0o`1d?bt-m z4K~?uz%Y+=ZUeTW_LNi5z^tBZVsK^oiy(!<3Ul*Tjk&o3YiDrVu3l8BEm(xAUDJuk z3WLt+Mklut(WbX8ZZ+O(SI6b2t!Ep-blR%{^T;YwX?f)6za3|~av71wusq+=S#1#t zWrIu)nDIwos8(F!lzkOlb05HG6;dD{#JRh(4xlq@McL2@n+hgHetw{RueUF6`@BpNt|hf?1+G zL_zxvw4f+VwrU0O9hu(jyHGe3=CXFYD8G=Vox3)XWV<@pJpzH5DZ4ac3FG>94gsba zrNV0OKpNoasEQAwGrQiD+@R_v_@=t&8kER155AaR)iF1DBGEo-uLYaM(xXspNVzPZ zh*P@-Kgg=c8kpK*U@fr}a?q_~veSw6NRMSRa5mvY9n^n#-(XrldyzbBY_KOSw~&5? zpVVvr9K7M~1x%yt`g^}PrS2Cpf@wge-f|)v<>-qMWMd0K<60`y81J)NT%q`6c#dr#N&*?n@I(;Btg~uwu&UW}{(n zpf~Ls=t+mMgX--rwia6$ES8_uneCKD#Z4dyeHU$3AD+?zYDU@g21fH!a|>yaDPom8 zD@z5tMZC_^@$xD{6-?m%eFLcrs^4lsR%lvJNB8vdT}xB5iMKD5VC61d}ee z{oEh`4N~DMq%}XYlvV)JrUL||Oia$C1myRyAR|0+pqxUt~{wkOrot#P+$0pOr^jw-jVA4XQ0|Nu4>pg4} zb~@l;7q47gPJ8?NQa65ux`Ediw&QTCfzlHh^f5iEYxSLfhLWAYI6v^9#AXv&Zp8(L% z+%#&0R7YmT0Bm&)NqaG$8NxP;Z91vH4+DVNh0ZiJGoO~Rh7{{lGmDuTmqCuoi^1M% zHWWCrryrvq)t#_axd#YPXwn92f)fdovvX+{Gu#U!6Y0|UM5bVM&&$i01%c!N@Bdiu z!YqfUr#GJ=o}ODuTb)>!Fly9|pE!IledFvE2F4QoA&fr6Jgk6an;S8FGg#*2{3)jq zhUM=vybbr!8BW^w>2EoHJYS}L)Q`8q*$Ay66tX&@JR9S@tCOO$vz;d z^r|gZmz(`QAtA9TX79A{YhJJJew z{1r56e=3VUZNj_hY{<=Awtq%&@lcq{4;UtM;5yrMtSe!M)vDWSSTVwy{U@U4R-lk3 z5La7;;um4x9Q$NGt%Bfe)xkQrS@WE}y=i&jGG?mm$ueLnZER%BqY>*{Plr2DIzX|l z0DFeh3?nlO>B8l!%&DVkggJc?DS4BD<-FS6j`3e7xAH*!94rMfC@wIj*NCr;X=Mv8 z!b%ux9?ml%pj8gtpN48I-3b5w3*XQ4u$sB17PMg)Hf%B|no#UyLEvVNvt<~;)U~Fa{sd#oNegCzw^wsBHLKv#1-mc!% z#u3jckU4$zYTA$G=Ai?_uu}}{F|S<*2P>-xbXZRgwDzZAjP3S8l@&O{Ec102Y`&Ft z&Mz#d(d9}So#zlZEV#ltdQD{8Zra5N#nQ8a;Fr>+X^ym_%H-HS?Y})Iyvl?k_w#9_ z;(%$C8Zh^pv;~4A@?O8U5luJk>K0V1@miM(3BI**bfbL(3erZpi{W?r_(23K)}2t$ z;v(!9Gnpmk+_lPTI(FX!S;(56UV>V;Fp3*YPk!jJ^wlqYF^#@{Aq`?$vkBq9bY(J) z&9A5P6EjfzbZY0kPz{#<@ZN#+>mU5_w6VO9o* ze1`s#4*&-O8WD3ZU{4*Vt#hA+->kwwOuVBpjo%U8_>Qt8J&Pn*nCuQ4Dp<8=hPqge zxNEe`ya+a-f=b#q*q@FMYx4{+VQ+BTJReKP16>{I@K9emd0;5*BffKUF|}_jr`74H zR9R-t$^6&0wZL+w$^~j{xWhG$^>wDx14zaRdu9Z?Q~SEpfo`acwEG74GeGvIlZWq5 z?>KQP?H?LS$jj-;_q;3p*zqIOzmcv^&7?WZW@}q3X^3_9`yM!)o_z29^n+y`Lfyj$ z5YQNC9dL@h1D)ycU~d{=zHf2jrBD3IM4z%0W2-pv^oWz^sMFi70$ z*)7AZ!h?m}tkRvzu!$RVc!P!iU^h!0j*2X;!hZM$ZfK$qyr4Lbm2|`7*3@nx{Is_q zRIyCbq{q2;YHS3-tT~-LdI${`ES56A^dG-~bi9Veqna@4fG2wO;e8n%Gfz;2&(jWeZ|Com9)6YNtXnOR-@$}-z z6<9NfqR&pjWg)8!n>&SJIqyyUJuMX6eUk*&ML8;bqA~iN7aCnT-nbjmkVRn!e54Zx z_ooVL&#TiD>>{OfYKGZ|MSi)fsb!aWt}d?;mX za82PVYh@3pxzuU}nk`7MBPdALVE0Fl!3_@gu?*@@rye|+Mv=n5^vrYVBJ=cvd)m_i z){~w|USi&NH)^o62jvNe-8Q%_poM|Br<2nao~md`2WaCy*4F)8tvI=|k%q8?`QXU| zX>{T$%8|Bob#f#vaxHX)OAyY!asjTy+8b4=6SFWYyD|*Rap4!1KJi`7tG^6u(?ojX zAi!=B+_PI|6Wt4^fW?fP=d5OyCLI6~G=eDBx*g51wXO8d6Nl1Euc3-$aoUNr?I3A~ z96jUP*Ml$xLJ>~^qWi-j7}h9xbTa>Sk*BYxxSL~+bG%Z}eMb(mDbMMDRFqY0s($lh zKb@ZW{>$kHFJDOSJ@n)0@Gyc_+d9e~?Tu znldr*-IH0g5it^Ws?4~ZD!7x%EjP+g;BeWYvHCi5ZVio+2g6k9wPObB;j=!~gs{pr z+SU#`ZU&(l$p|^!Ro2F^K_yk$Z$9*e`Okrr=Pkl{4Qfe+2;NWf8-Ai9=j!uslDM&)ov3 zO%7dmHA^Wyskz#V5QC7_Izt|n`v_YA%S|n`J zBb#uChmIXbm;+BNq1*!8+(IR~xsv|YPd10xJuY`u-pOl3jdIE9Nar0^A#DVQgBctj5LwnJ5A!d+9p-!ucEm*zj4-NOF-}<#*NdM2D{dsBz`468y z1P2)4G$Zv@nJV&NC!SiMXIR{gFakx7Q3Dyu9%i-m?MueBs z>5sJKaLcSX+R+G&qe*H#bu>MA>i+cl>o$ndw z=S)x)VF%qX1ERP<1uno|?byOxx;#FaUh|+f>O+m@9zM1w-M4>FHmz}SJS}6RFwzK~P_?QSaGbbkqn-hYlV| z2k$?TKJt@4m4+Ay8_RQY-@Gf;#6Z}`{T~}^^K4pF(zNG^K`s0S49DJgL7BoQU=*-! ze3#?(2Q16!%4r(n=QDx{+&;ZuPFybJcKngoO2WTWJ_s}q=QW1B2f7}*|2UeZS2Bfp zB%}r=WM?&moRdd})3JSfm`j&XK`y0{9bj-^CR1BN z4~!-Wz`MBtxdUWoY366`v^JclwcuEvPp1zJrTc&JXY!`Q7)p~#v{P;%w7JG|Cg!9= zwW~XIbFarvb${g+A!y1%b8S*tVLfk_ZaVqg;pDQ4FV|_VI zaTD!D_H(D<(@f=Ql?lAVIh#%XT7D?i!(m9h-d+b9Su0})4R!Vp?@dF8kOkzm)Luc* z%7*jWc(El|L5R{6$YY~xa0qqks$MoF-wl>y^g}k@hBeAo&j143ICao3;iY9Dl6eii zG}*V|B0O&90)FK*5nL|djrybTs4U)%<$-2;2#x{bA}nwN5q005 zp)@!#pLcFBoPg3`jqpq0YPP9YqieOW&>)J%9XS|2dsKj%9@#F%4nk`+T_WG_G&-vgvxm;dgnmX>UI0#lVpIr`dZQou6T|ekx7F5<597G&nevrvXnZcnG{53Upw! zuvTS#!)ArQ+`|1El-0tzSevb8(k^i;&L&gC*c3YJY9IGjB5+}tS7oi+gz zn<}K+vOn0`(lSdU=E{7q8zezT01RmxK&^rFX%I4j{`n$SjniyGSZ0?B2Lv&%@R#Dc z*;ecUNxew49lSNLlZ{qDtcnMbtc6MICe|Y?+nV7V9jv`CU3eu;O^v6$!~0VIQa_s% zecZ=USd_RVa{cZg(elK7=n0lX-j!AD!io}&*9^kq%MH~W@LK5AcUa6(;T^dOTAHI)G1uio|7+Hck zdYLzuwI^mBssdm8%4{3W+^6#18|Nm_B8_ta=$xiHtU29_^*pdM<0_K0BC~63Einht zO;^y8X(-o(9rG$T=%@`_U&Tt3^i54zf3UmdndJ(|mBQx`=AM7$l{ChZ>w)3Js4ExQ zNZ`r{Pe0OjPe`t5G(el?kpZR=1W(_0lI=~OBIfzs##raOf< z!Y#giN4|KAkIW^&jq!D2Ju8bo8 z@YBk19gfh)&QcG%LCaUKWGbGWndF98mS$LNcoF!KqsOoeL9v1WhS-~q-1kr#V=M5R zfAgJmk*VbUr;errH7qJO_;nVkpMkOj1+N3t71!?!m?5s5aGn2!uYW6j`RQlTpCf>k zoPCe}m;Ltw-V$#!*EOKG-};B;3iL-KY+E@l+8Sxf=^Pw}#}jF9_I6CW-9I)yohFcg z*Fazgi1Mz=TnC7ey?Ius6-rhzzBsj*{>%4X<~@sWg|!5{04rzMp_UD`ZSX5By%&eQ@;OF%Z)j%3!Y&h_3t?dWpj}?yH;~ZcjHrYu<|sI%<3Y|<*Q??bJ2Ap z$#)J6r*EGhL!z&wJ&(Q%)oDBO7K0fIts!_V(1vL!_)~xW1q8IIyq0(Mq*g8fz7rzv z7KE)M>ZzAmJ9zNm%Pr^6pI_nh+XW(zmn$nbCNh^tied3Bi<@Dm{blRdGmol<%Da~8rM=+tSynYeG`5rW4g@o); zQxkY`+IKIGrAJPmfRZt#<)3X^rT=5(TVr4@V6y85i36^nm}_(5oxo+cv=JWgFT+$E z=<0D7#BJ6^6ZSVe$9aB8&e4})SO_lbNY7A%ZVheJCY0=4+QHV{RRC#Bg(Z#p#%%Nk zRe@3@Ur!XsK9RLq#})_%d6eySgPTa@qgSWXIJQ-(X%-IAo!8YG!+FmJ#i9Gw4h%$b zyB%g!8CaUiI*2z>VJh^^V=@bu$6CzW_$p}xwtfXQX>n&369#x^%;ksI55<9GaSHD# z+?RR%O5K0Mt2}CqbcDoc@!NRA!bSRcN4ReR72)-fR?jOn;3!Aira3kaJd3o+;@G!m zY*j}JHG!-^>Va*SH15kP{dOSv`ul_$oqPKnt;*_1>+`oD+Tr272wc@ojqa8*chDra z7s=RVk0wK&_wD9R4KGid6ln-?i&$~0D4AnURRN>rh$_}OCUqt6%M2RTo6AV{YiwHR zDx|STa)vu~0V81?{(x`5F5VFyb;LLE;y^=_B)1d+oLOOY%26J_Z~WQI9qAF@cj4FBCFp|@KS=`&6<1$zn& z>-$j(%D*|dQz2GRuB2S4;eLlxs4=We<;IosL|VgYG0d4aQ42r`0EgSym(Wsq6CL5Xz5JP;7Nick1vqz5NGL?>?1Nu=+r1=NQX8hVe5jxiT0SRGJa-f7=C&$}luCzRU27 zu4gigF^5;u zBd3n1M;^K#dBDA4ehQwse-0(cB7<*vjZ4fycD~%DJ`E{^?S!nm0bd8iP6T7w)Va-( zw-HR@Z3N5r>j^Uz#_00hNR>HZQE09((i$G=Bdk8Uwma>2#6|iX#)ms~p3hZq$@gb~ zfN=z@J`@sOz2Kb}o`Uc<94HW}misIbB9Cwiuo+3Y2{uq0nM|)te4C|LA5!jWI`zE!`7t_EI&GkgH#x5Baq5AWls$|44LZ2Yqiy^b34*zf>q z&o&OLv8;m2tk6i;z>9E(8H6&=QrZ6Km+!J`{Ej{ggK}Ja`;K|ITu%7Qc?=V8b^P3j zU=$vI&LOaWMY?=a*~~sM$w#60`faDQigd~3+L!ea3Jz|TZRyN{&Dg{wY!`JQOCP5K ze-yd{Td5i5V9jh>Iep*Cm30G9w&pUuuvRqCSZ*$1VKI`9vR&7HZUprv%bG*CV0$hvI`=C=hVkW@bpfPcPBrH!NHW`&!tKv2N}BJG_F6!WW& z6uI6|hxnRS&?c?9t_9iCP|6hqu36T}9qsPWu>5J}cZ}Gf^1cjhl3llA>6KOp8)Ocy zx?$hWd0m9FO)Mryv2<)9d<$(^FUAC&>=dnl>=oiV_wbW;G<;%gJPS>e=&Tn|cDTOY zWDqQ1nwyRCFvOceLpH*aYY`3FQeJyQarI6If%wjSs#9rvmtkXAIMeC^2NGC0f24~% zkv`spe_mWhx@`m-K%zh9b=^f;k?>C5(TP%}x1HUNZ4VSWtAV`8b_t>drN=f`Q9&+4 zSu1Y$HFxKw$QmXx%WGBEu3MZ5F3ech87T9s%Y_mIGI4}wr}?MiAI2<{#pvH2frLTXZ_6jdy9cLg*omh8ZU1Gm}g_dE1@!; z>bMF7l&3rWyBRk|y4wa+L&B)9j>GNP>kxeO=+V!<{`%`PBxa}kMi+>?F{TLF389T) zjb#`gX#%m9meYY;xBJ%AY^`Fl3aj?^SB?Q^>e56<;VWN_00OkSSmu=e7>b8MPBO@* z`&!o0WtKx#^v>1kaa4?4yn?j|`}(OJ4&AhjaKzxz5@d|6N4Nj9#2f(m%Pf-?SXZwQ z@3GcJ>hc!6DOmC}g4HZbqyRWRQ?$fgV zWbu`EZk(Q(p!22N-nk**wWw_4yQ4@!w?N!99&&bo9W zI{Y`Lx-lfu#{0$;*M@TZ`NPuymKxh#d$aOLqfGllUSOf~9scNRj%fH3X&QpJ^OnN{UgfZ|AKZO9gsTX@0l^&G{5JPy ze38OF5{d5gZKKPLiEqPn@h+F^0Es-#Q=ZU*&+9X`0w#a{JIV z=L%XZ*<&*&`n)n>6}IX1hn^#H-t;2z_}zsg2lj%f7Np*lG%_&-ckuoXZl{BqJ*#{_ znye+Hn=gBB6(nJT!;W76Z*GT2j3F9I!qY#9_ zhFM$o@LNPx4uoxO&81c%KIIH3E@W zDQNQJ`Jwxd4x{<%NRzC4hlkwQXUmV1i!CTjR+(d0Fb2>n#Dj6py(%u6VfiboQ)#hf zBTd5MYf$r%;bDGKXGARIDZu_ZD5I}_M}O>N^waQghVA4cZNQ|QKl1n%mgV}W|MwcH z*Ycg{Zg8xJze3ie9ki(se(W(;Mj?3OLNT4mpM*4jWoOjtM$j9TbNs2+qQS`bGDe_)R3@Ol-?;G zVhSmI4oUeCM@T>TE>xaQ5AZ&En;{bYh`tyo9PXBja^oH4$M?-}b!`YXw1z8xK1a}* zof^7RnAt^;l{P-*q66`UMY@7=3+dCcJwLRUO@&tGMmO`h9-P!#QDe%(yxD^VX1hud zEGd{Oxk70fO5VtG>-5|TODfH3-7en3N`q7RNW$&p^A4-ale2l=US%EI3L9VIRsfdO zu;MCKk;|C(xc!IuEqTV#cFnUttnT>`Ed8!Odv z*R}6*xPJS+8(bqU^7t;fGj&{*g06XYmg(#9>@Yn?;s1co?GmFg4VB~^f#7S!7oCo8 z=PC1&>H^0$o%WoY zIc$RRqYeG@5)!nUE`hAM%o+&xmK|?(RR+kveT4D@{N{PvpN?HXcyle}T<-}6kG)K> z(J+rXat(^Va&G-~$^xg*!rW4G){jl&YwlA-2bfinHvnMCGLV~Hq zK^e}zgp0n$cf9R;z$yIZi@fDH%ZPCE+poyO`%}!le;DQN^xjd5E+=G^f09D}Heo{% z9u4q2D$^egu~Fe7-Z;bKv7w$=i0{a6x;CU_i|{lbO5kisDa$pi8A??z+|RZl1j-H* zXMzxdy!kaFTAqz2+LI7n2uogH~WqA0@jnp4;@wP$baM`pjI#!M| z%*JbaGlV5Y{)KNSNjxueQopAI;GuO&Tj-6M7mJ^=gF->(8i}kv!^=D%A^+MZgJA|W zBx4~{tK~1lrj1`@i8RT)JAsjaLfSIcm{m3)nql+%89?tpeIPx|2EWsTziQgV3BoJ0 zs5Keu3Uecu&QlJ%Od#1kYs)Spq};dYvtf`|xmgdhEULNc*{R$(wW9k*v2c*z@$n4A$|WWLmft zMy1B$Oxdbl%-b#Ch( zG*sMHrxdNCBL8w3^)#|D%g=x&PHkBiNcEm8$7TT)$~&FXK66y-^h*)%fPEsqWKIHS&`nbvI|7V+W{>Q z((n9h2trbvSK(6>D1>cu!K0DJO3c2 zCmf;RR~9fG8a$5V&90V5XtWGz?*X~?-6=;l?^`5u%!cw%%;kO*16+&IZ~!S?%pQ z^SjoKIaA@q^SEm~*zTk*gs+)d4y&%NbEfiZ6Av48g6 zhk(pw>}y6AbGR<|gR*4X4%h+~a97Cee|DvobP#SArDn;8~~HuT8C{iNvYLp8K*PfWMHYQs3votLM^FPko8{n5Ws4 z5W)V?wf)igZC@jOaVt4f``~g_=f*%y* z_KcBgDIo)k(ld+okeIq_uO5_2{o&_!j0c(!z}f*|56d8bjYSRsW33N7XqZ9bJSyfd zapTS$ceS<;9LF>V;M;cFSAV2NvgYq{U-XyzDF>5^i*bpY+l3$?mpQG|6J0pSuNo52Y7B142zr$ZnCqTRwK_t^_VORhc zKH3cRX&%p1n)(i(O4FNNEQLTS-Kx zBFr^2INN>%zds@0hBasvj^m@6H5(h!>q@0%30V9b$jwIVmUXA@8uafpC+VlAroIU< zf0Yh!@r-CFoc>@v0^RSO9#b1GFmwTw_+I2>evE1_MaicJdHVxYHEgriP=UW;^0u~W;7_AX~*1zVAjkwV<&TMFH-fwW=nc@ zlmq0}9SSY~dwZS=9vzQfr!om6T*pGaFyZ-0G+l^n|lZQcgz z*k7HSoBL*z_eS1~={M&PhR$_&cfU+2zr>RW1fx~H4<2yFvWy#(Epf!fNYp+=lp`IR8inWYFqGDh{C2dfx zyH*?AFmP#lC0$rz2W#*IKg2W)l}phKEO4e)Eu4s4L&|^gh37EDTcAwm@&cLh4n&r} z^$VA95$AU~J;>f*K>ybh6XTzWv~TqNrV(t#u+ry2gj?ou^*gFB}VXQA+O7_d(^A4qM(_oWsuXn}=SV4n&`@>H)bmP-Vc&d)ET7k=q~Uv zm+3^O9r1Wc(a~!x7+N5;z_`Ye&2Q&*rZ-+>8YW;m*{D%$iLZA>iM0MY3Sp8UX*P`hl}Vy>@|QywRSQ(S`O3idU(-WWApmaIj)e* z)f53~1_9+M^|Czij>Zq_~$J%lL>1vSQeduI4MkcGuf8gqhDm?FdM<(g812=UQFLP^UZvPl68jgWMA!r z>BGf$x!gc-^p{*ub#}IYl)F-1jeK|OeODbc19QPNb7e{ zdc+AI{Q(HomL3g}lGHzM13e>HfJ#&DAu;#Cf|roKTLzAzH$IkDd-kQY=TuthKbbCW z^rg$|-KnzoblP*@!<^uTKVM`0_SgOW{Rm&_ zql9s^z_8P6jr4ych!5(5FD-Kq}$7VeZBt{ z5WJtTV-e0b-h%ovaO)94&9YV<@XoFSa~YRR>X}{kWcEy?Y}=&_B3YgjE3nzg@v(IN z(yK_&9yL)2nR#QmqT#YRw^z&DNLr1LH122$hgT6&G!aG!qq8ysW7 zA`|NnhU^WL8_3LsSzbY{`E3~WevQNHKQlf)b|%u?tM?mHRo-c1m|HH=$)DW6|IlyK z-G2@MhNKK#0lWZhA=Csw1eAW~WYv};Ohn5%J+|Vmjx1YbR4~Kw#KWbFS5R(nnfTrx zOFzbM8o49%`uVeI{FN8^wX)vy?Qfr@){gX%pZ+PzyTa#&Tm!$NXeCdeEIT4H|wu;I;Xfdf8G)V+w^*eK7IJ`;s1cK z+wari-vJ;Hg>#WWC+mI0b^g%}ufwiEqO^_Xq+S)Jh><1`~Bkxn=6LJsw~? z^X;ek4MQ(wDQLs?IS|Yjk7=*D%9)my%CC%!T>eA*el7g1@f8xnTT|C{wTz8jdU|wp z`!qV5j6qz}&yI{-dIYL{x-tH(`u?FII662!KKi-w@vD#V{b2z5 zMX5#?l$1XJb{2Z-Y+UrJ)!M)c@|kD9oyI3G=lBb+zXB_sOo#WirV~fqD&$h{HuTw; z`^?O3rID+c0`U`i3S}D@3@k5Ar_cT6U!?O~9@@rb-%_IW2WyTt6v)Oves-Lrq;m`` zr-)){WST&5J^vT^vFHzvja_+cboA2aa{GUXf8KHyy<1;Vb)H8_@_%8b^H%^=+oSsd zUWdYr5C!z8J~6IiV?fEdqpb(3y^uz(xO`++2*h}f$=^d7<`>F(xUS(Srz5Ie{rol| z_hRio$j|ItPOrZFQW_t0gM8Q8*Xi*NY#lzo#mf>@wxQc zt7r4^RE)hcqHQ0`of+PL3}XM`rArroA69%mXL=j_dD|d3U;&b^fb9SG(4j;B6aMc4 zXl~!GoZ#X2pE0pvJv_V*%SOysmpE&*%rO*|AZnTX-QG1WXpuVi9eOYwKk=^g;5*)( z50$l{n||qqXVY`vJ(KqD9m+S_X$0Vg|Mbj6zBl@zcf6DN9Tg}83g!z|i}~L%w#pf$ zFaM{{Bh4=}ccc5RZLKo~{t8XjKVvX`;=+a3KLcW~L_gjx@3$R-12E{dH$m_ZmX?

fP8@{NYIJ{3_<062xEKG0}q@`$1q&) zy?EA`L-x}@g==ux7{^!=#rcbab@actx`5)NUX!qOg{kBDL8Bi!omN@G9%*4die}DGu z^MCN6$DjOD==BA{RygEc1<}3C$@~lwY#LkH?jCN>VHQxLnl@gC}Kb)KO}wbmDJBKkb9FJ8~sXrue09%PelE1&z||#KRS2r#ZR&V z`1gy8^Uv6(avR^Se*5(!@1A(#iH-{wE}Vq5pI%sAKRvYP(CIyUhW2p_PtQ+(^yA%6 zKJnomRFgfQ`OIJROmgOTV4!b)dU|GlW_o-cL@!|J;V;jOjgF0+9UC1v`%Ay_x6k%H mc;e;%;qU)_Ch8w;_x}L}g9JVfF&e?FD+3t+*@yr*C~N@Ce<1%Z02DC*?!RmRKmm&6e{BsY`v1W|0|3$X0NDS* z82r=!X>$MMU-bWIn0%=JW6X#CU$k#N%>UW{342-L|MO2FxytE#001aB{}Cv_w;aNM zZ2IyBZ~O0YdfMCkUnUoi|0(NVfo%VI!p6bM&i23D|3ZcT;}ukOx3~V6 z`9J)k9K!#F{Qvp>Cyy}Of0F-y2J_#Q{+IV(siMfjZ2voLqR2}9bou~*I6xjOq2&uT z*@e_uVr!iLlpFZ-MaN&;VM=9b7!z0lE`}oFrP*YhFKTIUBh0~r_^iX{xe5uO^D=`e0Tz9(RG40cR82IsW z|K6kZIK8bAjZUTz>B=8CgqQXvbnz(u&@R<|GcDxt68(35wN)rX;ZnYAV9SK@T+Wu$ z(4+nDfw;9Ncis$!jr&um7VVemBX`Q|iF?kkp3M}JJl_@AqO`L1A8&qRsys+t`qpiW zZ6WOr-p&GC(`YvYmZ!y#;>S(Tv*y~L1NXdOMcC#`4^syw@J7Dn+TF@ z8+j^T6oEq|TlF1K9Er-CUdzU-b8~ZBWIh|$+7Yd8lVT4qKBQq((WC;Y9e-viv*=fY zo@|4BAI8#-yZt>q_we?mH2Ls2f3tiI5cBlkoISIVDuW?@R#r=cAN?JKkvT~aSD_@B zJ#LLsVbPESol;>`i^+*8u26i`xKp;xhL0TB_P~^b$ODxg|H*z(0!s44W5}k7$l%Yt zpLcNLFVVHJQqiY1ipS7263fnqE&nDD4-dJlOJ;DeERZlnTE&;O^}SE%eL~B*;^|bY z^5*SM=5A<0F|MRyOde>8w5fCA^HSr|`V0Awj;>a5<5v~N@5*Hc-_ao_VdCw)6e*hY zy<;FgwB`PqCk+7*u^^&8|61U6#vYOz`7+%(a$5fWr9H`8P3m^ggK<%@Ok=Ea-eh^k?W~k4S66+xGNBFfZ)3|A`ttNA*_h`StsD=h;g~#k-;V>NyLI zr%kgC+NMiY+EnIqnx^Jg6t3g>5_ekM37QZx$-oj~#z-eUqc%+P;8(@n+pkSPPc*U( zG+m=WsWz*T&{-!hDFW!qcPGm2%L1X$THrVOHGJKm^u@!N9)=My0T0zW5^7!U_7 zH-xuzlPG=s-%KjEFONKk(0|+dCBZKK_7vMZyW4ty^VxbT@Wn2p?B;6S^j>dbJl=c% zG_l@F)<>*5eV&Lxy>vzKE_T^gl&A7xRH4>kvSYr{i&}uA(WS(?tlG14L=ah!a(&hJ z^MhXaX^^U5Eke=!hj$ZAPozg#F6yt5Jfv_OL&@4KX<@c#87~&22V*vjmwRI@_~-O>#a23h_AH!n-UUj!!C}Nv?u>A z;g~ci_>xM{&TwhBoBW#&G8C!tMTWXeynOWjC&?*!MC{2AcR@;Qt&ldILMec|1MxCy z$0#tyAun8M>puL`=U=9N-4-wHEm1Gs8SAZZeFzxjljNcS{ITT^Z%ZG|jz_PNrcAiV zKDdnn{4QN-6L<~Yb5#Y|j2VB;yM85r9#Wz&(1P!O)AipxM5&Q>Q!`H*hdA!^&mtcx zAgM4#^+BPPYL(aW4D|PN5{?#FHl*&_7}5RUQMsl;5WmtQ%-g_*j~bS2(TxyVECxmr z7?7@$RQIkL9Dx=n4s8UC7A$bU!Y4LkyU;4d6RRM>aM3Rw(!!^Jqdx_8Qet^*R$Vq# zi{051ALkfdPg7-`j|EcEoSof=7VB<7imgJQ+9-XNr7)yx-!fWXA608=Yv0R)TD5bt zg_b8u1;=@vwl%oJ6b=LQ^bOHv$)BA@IV+Xdks+RhN5nc8->lM>Aw z-K=U=wNFYw8z_2_1#?BrjVYVkm1EP&VEz(!^>$%UGR=b8HDu5FW=`0}XyM@cXLgod zBR_n)iV}UfC~l#z(WS)!APDOTdM(t>Ny=F@sf%V=XT=cm`GYPMUSw|Pn@Y(jKl|HW z#Llb94kadU$~NV=8=W<4ql>Z;r;8LLK`sdv3d<@*$vwD#mptz@+^W1io1|PzvTLiY zF7MCB%Ex17o(MdF;)KW+&Z#`>gYwG@i^Nr5I8;jffu;YSnlJC81MhW+Sm@=vE1PIqM~Eu%*R?Z3f3>fB6sVI(v2G`gEupiS%lV zB>Vmc1gGK3eFPW*^|OJJP87fanQnBXj7vZm7Wbo4)*1~MJPlhKvSrWk;)qHu|<#$3^X}>F2 z_J1p9%M5IsE9rgWM%4IG?~VYo5WnSQ$*sK;>shW{6|hWiZ^i&a7*bVSx4dl0UAgB5 z_!*AU)O{f;6@&N&Z_(b4-pEmnDsAKTb%_MPLuO3V{PuTEfjU4+C`=UPsD7OMP2 zjdDE9&tEAm53Oz%QR0v3++t8A259KKQ0}>6I__STv+>=|`7?WFn)mVbp}Y01g(7e< zA#NgJhWm`^#c-2bX=O-UrQ|0WKYp(_05ch?UauDq%$iNg!V}kKP=k+^PI;x~_ye;C z8bbwkR-{b@t7_UAr_-*s)wg+<|J)%Wn{qsY{B;Xv<%|-e@bD2H9C_9sh-jD^p;yH_ z@Rw86V<05<*sFi?$rAF1#oXOpI8owvNPZ$1raSe4K8%f6TYUx_zw3nVp)D~d$H|qu zXP|ykbqporQ4F1Z9zU!y&!Lvja7Z$Uz4t5%OP4?!-DFZ!rk2ZoODv3Ap*x`86aPDUW#>DlXi7#) z+ZyKEhIw&bcynlx@&#h7g$Ow{`!2*s6H;hsYCv7tw0}oPvAr_%X$3mgew0UMYSNb` z=YmiYMLs=xg63HFZB+GR&veV5Ev0+?{kPy#-eg~l+g0xL&!FGIPrEnAGr=cu7-Grx z3t!et=FLo?rw_%E5si%X(O}wmVZyB`@t~-Om}=p%eu{J2I4Ny6V|FpQ>cX`mVd5;D zMk33d^konhLy<6g3ebjMkPi?#?#n!pQ4;^fl%SxhiH}=|=`ety=LlH%cu*rY=$>CbKV!4na-86MvYL1preAu(t4weiea%UE`IUhN4vK|7MvDLW*^-X z6{vsU^iYmJW%E(Tg0BgGAiLdAL!fsH+oZBrcx|MP(CPwz_wCm`FMqsHfu0_MKdz$W zu4q4Yre5BQT4CFx1utI~^FA85Y*o9?CQO6ab40x~2yKudtubTj?hS-;Ku7C}SoE;8 z$689zl|Lb+v_~_bSUk}ikk6>X(_2`ggsWJL$-G0RHNX?X8?=<1qIsYr?S$>96Yo=` zzNj_h5kQuB(fd`IUx%!%!yrilTLYp#=~({sjg(>p#1@5DeK{@;XJysTv)sjgz7u_pb`y;rn15HW{a8XF8hkNHQC-cl`)%Q8@H-vF z6sq#BKjVcABO%Lv0Sv&g>O}F*wl0diTKp-Ni=W6rt`Dz6*$hy^JSpYMr4nYlp*Qm-T}GiQ_#}M^b>YJqV&9En7jY-9%KR|UAqqX8kMEEHd5B3 z%N>IPB2L<(V|BwhVjaY!Rz%Ex*$kOMCAG4f+LVONYygZIfky|+J9 zrd{%TA};SzbiWm0cAB$%^nC2Hu$}!NrZ9%0R||Z&eY*J?O)gBz`9#@qt(;`D~)GN2YcE9iRH-#FU2cD+|rLe;|-Fs zreEOdjur*`pBzYvAz7u@N8yD#-=~ZmBi0%}JIK(TG1idWV(v^*p4wqKhK04W zQ%L2^japDd4=NA3bh=U$QFASk)i|RzKW4)dwVHJz=H$4nO_)Ah2A#4|P)7ysZ!=OT z)IKMCyoY0ThHiX7nl~K0FX;%fCv^WBD6j69sq~ZGV45@L2y!Sp%%CbKjcQ_1IbhDk zK!(-SM=CuVPc*S`huCGX?fE?EGFfwCwP5dRqLrD5H2C0X|Vg>_}0gp{H>BuAhC{ zj*7gpJK-I{GW%o+*r?;{u8z#E1b7P&|etyNU?&Y%t<1t~0p z9GY-QRo;W}f-KQdp#u284#!A~N*)B=H?4O&w%8|s6&@I{q^p}?*Y~22w2#TaBxw-h zYNCL^Wpo%|QRGVeF!}=l0p5e!6#v`Tdmf+H>^xB)j-+YW_n`Id^;l8Q6Se1A|E+Mr zvog_#n4~~Z_V3Hf`|ObNw97ucDp)Myvu3%9sbK?p;9o{?yqX~pW!(BNazh*~UC1)A zN;GmIA4+{3(0nA5#T_&D^laWC--KyMwya4xbYf84$Vy&&6;x z;#k^dFN_~}0eeWA)fbvc1ef_PA^&H`+R8;k4s9foTb{1y-SDm9QTJ%>_;stl)wFJLKoBWKrv@wY z=-AT6$=Qpex?p@s=gYvgZ7ytqyMV-Z8Ik^mO&4pkT%C3!^7CpR(_7hx*TbJa6rxTW zf`N}$yK!M3Bvj9r2|M8-$5&%%T}Qt#y8V64b~3=Jz-k?Hd%wi|J_T+Q*2zgQtHK6_ zsALo|%Ap2_!B}j?N!8vE%rnH!tc4vu=@Oam<{DS=+;Y(kDWUcL z59qgnY@HuBW&J7(u|qH=3IfETmhrY$cCk#EDU55#a`1?Y{66G(X|meoyz#MK>R1V% zsc2;)qPM~x4qU0_g|Ksw@Dc_pDk|8U{YU_o2b~9=EG|+Na+UG*ttpKqkQKABSbt1_ZzE8LjeQ?SQWhi_ykrjo-SVzcWXmN0@L-26sQJ2y+qycZO-JPWGBagUEQz0&hF zuaF|SCLDTFqak5k_mN)_5x@_6*kX$&8+e=`H66e2*9#4qdh})nQUh)#D9vY2;}x|- z@seWYIb@1Fz4}X?lbujEI5&_zPJ#1YdFkYEkbJ`3$}zF0VDT5j9;=vnIVu!NWA*rz`{TeH!Wr|Uv&%?DdKN@_%t1%$nW&bqyD<*)^5 zCFC1*mhl##SyOVXnS|Btn+ zDpjG(Y)n2yBKT9dlYlmr?Q9Oan|YCnWtwI|Na#`Asv!wXKNvIuO`5U@-;Qkt&cXEd z?mUa4eiox7dDDN8?$NBp8NJr4`RvIhi&0{*>;Fj@b1UfBvENpel`GFh&&UL+O7Yi@ zI~v$kba_ego)%kMQW37W}pS#Y~u%Z%Brw|&uC8GqsL{!?3HIB+m3M@U=SiBz0K z*{z^t6#^EAOIbva*G$84{fihPM^&q!4t;=WEWqCm-@C*ir3v7J+W~WL(LEfti0dDW zX_2s{oKL)UGb!*Tv!+@O!54m`4mfc4vQD)8Tb`#Iw2ZfVYm3^Sv+M z0ICl>0|a}OjKu9g__4;su@jY02Z{3M(WK1Ea`(}_}x zb|k<*E@XvjS&(8$3nfC!=1t(hG9s}U#Tj&KRZ)(b0@@$9RH*e4Dhy;iw^&k1od|j| z>{W&FpPQvvv<=P7A=?yU;ucag#2~Wm;K#_(Rj=?gm&eT^APp0!gtsSBjgOQIQ%PX#3+CblL)em;r_s5H!MzGl23$qMoH&EzV5 z2V#W3&rtYnzj!lL@-gxX>^ipe;PjEmmNq__Rwe(C#%=la=Kk%_(A@qvbmk3d??j|v z;=$mo-HLRr5BoZjWk$eC#ZQ=MVhd&i*F^ip>V1`4Lf{?>ex%SdAuf&kk3}`v*5)ha zl0E1i+0D}J@LJwqMQ~0hZ17JUnG4tY%tg2tkY&mDecdoEz{$_L1m!&b;fOxIoK?pRC4eJA|h3AeWygnP|Fu*BIJ+flGbRPkz>g?M{Wn({?mQ|Bic%S zfn`TeM92;`gE;2y8l~PNhc8THo34f@Mwt*d3`4wt%nE8M{gwcS0(S5{arYzXLpY7t z$ag?tQm`;Prva`0gX6`!%=)r)J(SB?=H*k@b{iSNaiT%j+`deN&(uiE!0W3%Dnj5k z<8stE(tiAitQBCUpw zf7a-0?|IgjH~rR~qk(Q<)7A$j4Gx$Kj$WrKeT-waoVYQc%OVN~1tqMnP?%CDqDmIppbyK%CaLiOseSi7^hwjP7V$ z4jew4Gm0-pXNxcVW(jny^w^XLUPZm`Ug1lDVAy@- z(P&DJt-9qD>h8ta!Mmhzb`g_YX|Ksa_Zt{Up4L}_l1S}7kYzh}TGm|@X(?16$0_O_ zwXImg}}dXZ&!86415Mc;wV;*wU82L&<~l;iC$3f1H||K~OQUa)_{RCk_H@ z8uOFMj5mAdUCeV9o^k?w3fsmB6*lWNoCp2r!{7>gVqn9cl#2v_>Q*gnDg-L<X&Ld!;FH3@VV}Z|@yJx5FrNH2jD` z2mSXIZo?r7q3^9S)l(W@mA?I;BZsTnZA*tuE$A%A7f_!2WF}iE&rc{He#GHlGI;d> z4s<2oE=t7n$1M8@c(^-jh zUTvG6ArjZspf(>?$@-or!8~K}h$_wDu&ITA<`Lr=FQ;!{khv~`Pz*GH@{76*6u?xk zjC87Pb)ZEA?o&oFK$FG>q2Xd3*`_$-GR9JY{|b(l4lk*}gOUYYbKYy`3VBP!b!6@2 zg&dZ#8A=bktpsARst29tzFXK~)sv3yhG6toHdb^dd2piHcM3j_U-QjSVn=Fy?Kcw^ z`$cuaNq97EW*0iT1+wm}@F8fU48#t{O*VX572m{_mWzlUJRv>UK)>;vBpKz# zEW%=VV~i9Qdsn&6tBf(1iNO!P@d?7++SxgN3}}U4mL~mdv5_l9PT7{V+V!w;XWCPz z#cHg|j9r9n8sfNky6Adwjzm9wqLD(#IINC0UHr{0mpZ)TM?#Q!1zj!9gy1gyuW%jZ z!An?h;mYB2I;ERS#;m14H@I@}K(LT>a8~0In)>c5A7B5XMqXVF_OBZ0s`Zm(Ba~uR zXc!Av*l8hjeid~s#{imnMYA^Py$~RrS>Xq^9x^8sg>`<241n?Q-){sm7lT($&dGjt3VBzv!?NXd1~zaFHhyZwmLwnp1|m zE;O+X;|FV&TnQvjY|ouN+B2{ImULYX-o?p#5|w>w-7Kw>y!u{U`T$HHF*Ndl^0Uk; z)dVS0>wG!d>6ZvmUX)g59e@D&P3g)TlvoxGoY8V492iu-q$=-A!}i(Z=L+od=%6i? zcM;QIndieOB3&zL)5sXaSkoKSr1XFP$)%H1>E8~|$#GkK-@B+rCv=UjP!aCS?Rmm9 zs=_-ur1U)NU0~qZV2q4=@KS2vMZpMTa|=#i#pH}@tl#>I z^U!3(=ZA#0fL4CONCZ+LY_{AlLG7=xibOoVUz=m=HiwDcOPLZFQ8q=c{QdF!^6h>K zc!YmT-`BuBvBSdc7>$Q{G8c=4FDA>V6~8FqjTerjO;)6j)}H~rvB#ITrV_I2ijUGT zTKXeKS9Oo#=K}bwBNleHZFcVmZ3m17{M;oxU#AcDXIv=x5b=3DR5JijT=b-iy1roL z-gk(o$MgUo_Ls&_o}HjZ2UUIe3vj>zW8`$AVfdPpRv>PD_-t&-8CrNMs#m$eGb%*U znTI(2Y=y)bV&G`_EyGTuAB~~tGecq1D$xhY0VIXB$8H zIYJhtNngAviW#;-J_P0J3JFNg)LKYi&Kt2L6M$t%2ot-|`WMEgWsR1e{R%B-Heu; zI=O>&fyeNewtF9pXt0%obh6o*Kky==j4^_Pv$)M6xsqQON<7a2AxSx-t}(-G$t?Q@;|xOU z)Tz$i<8!P8m-i;%)8|xKa2o5WOjPc3Tq8)iye+E+-jvTz|m*q^aY<3B$MxMNuu z5X4$a+hK1UGq;nXdgCDPc!*`qZ?t?=viG!M4wU05gcySctSxqpN0hL9uq$NR!1YFd z+5(0Uv(t{6_T&C-m)Jlnd09@cBF_;)Itp%`><~7WOrxajaw$y-RTb2d=qUH^MxUK; zWA-sR*Cv=*0_O_|4^S#>6RKuEf_w_cdY!~nBpr+vC2js1^a(y~w&2BqRIm_6um_!a zIWm)5QuF@A<}{a7cFXyJYnM-XCg~@?5h`g^ja?F3^q{NdcxG#m>%#M{Y108#u^O*V`_{*+Z>DXT;co*q;$^Q9uEshG|zMVLnBaKSiAmSo$ zVQ32o1Dzl>QQ^iABY_A`oseH>kGn}PWo7l~EQYQZFV0zlSAULk?+MAcaRk`n`6x2- z(yJ|Fk7U`K|0v&{%!4j!8!I_wRSTn+(FIXy(|_ zh$ypDk1$JkCb{tw#r-BCUe@l07FYR1RZy&rL)sEqZ-eZLS$Q5AD8v`NXn&5r@P)@f z`*j0F@7Jm41@V_H$RNKdi7pw=ucf4lzM&^-(GE+!{9YMk;>DspU{kGub>bN%UR(Ra7m|u%6>%I7q<{a7~h%2z1k%u zPPz6I;r1yUehj^WIOEttYc!vb08?n4!Ov6WmfA2;lmb(YWCs2rV)xC>sfTv%zX<)% zkg~33R&TwP>C?Z-AzevHog?y z7{vM@t%u{>!6NEm>oX9HpC#NY3SV5+AnIlNJVl=MY@kR;ljgbR(h1ESKA{xIAt~pL z;uR(A%A(;}q38nm4O+x$8y;sxf)Zh5(&fHm!xrjo*C}Ulp@Fy{YC{i#A(}J(sp{of z%6q;{Knu>$u^&&HNCH@0V%p-QOfRTUi%^wqjY`9NpV5kK(S(mIzVl>Y0#F@ux7XEz z*K~*<%U4MY291d1hq8e4vwdooi8c|qt(3}GWH-NmBe5T&O5~1be&0R#N~2NyBV3$> zrG`0DddbXr?FWpwJG(H@mLU{e4)Hh#@ps5czJm5PE^T9g9W1>Y?E=53MRS2#xb1!{ ze=w3RDX}u3=Xm8og!$;wu&e^N#vUF?4^1|p_r0E;!18tZZL5Wt^}bWoR8@D)1c%;d z=skP!aG41W7wK2&xMjn}ZD|95MwQ0(vCshQiO4Pf!o(ppG>txFAs);xCLI$0KEbEpKl@2}aUAjIQLr^`X<4RS?H zf9K;3_K8CzpbJpFj|rGY5GT3FG&eMpwj$&&o9BBQTE{@^+DnwG3L*V=W?L6(*#dOw zqdbBmh+TjgTBo4eBXOzW!=@hVYybe_r3;fzNiU*14pPhOeQ_kc-h(NpAVDHlZy4Zr%zcmwrCpFJO1)r>9EhLly%6PaK%hJSKOH< z!=h+U9J8+%xco})2I^|tzzkJ%ripXmhnh~e2QN$DW=%@!Z6*(~&n;K3{PtsnK5`){tWH?Q#Zpd0o@m+Kwg%fQMbtR+={RGX;mr=<3hMZMQ0>dY-*;&<~& zYkmT2tWC1GZFtO|9V9J4ND6g(xIgHvpY+bgG~h_2PegYl$UsDdXycv@I+V?rdg$`a438)XExuM>uE zG*KNg3Oj5fRb@a6;YVJf zip%{AtP=RuM_%^_apz7sLQ7s!EKt!9oe~an%chm01(Mq=k9qs^imD9@qfn$|_vI+O ze+}yC>Gcm$?euKrpVKLYaR2>X8MU8 zS>4FP%#?IF#jvZ$qx?!Y&w}KuCv*0I zR*NanFE?onYYEoq?DP0QloZHOwz*|)*X{H*;dXsXnSdyIn_N%(Y<-<@VJK-GkQQ37 zHWTZ^9eFa2h>0I+I$T`t(n2}m4XRAdeJW6xG zTDD3yYB$R_(H)eh&cM~6!-gIl`sP4;NOo>6z}ExoHY?>A(eJj`FoiFXf{s`Z2}v&$ zFcHv0vKXDsz{3GnjDK>3bv9ZnJef>cyv~Bw2f8FQPi3{oXjC#JvnR@wZ>lt!-MLp$c+~`+Zk6*FIPIBSci4Yvo3t*_>aD${6?lOxC`(IAGefmT?s9KO^0jl(?*zhK)aD=Qm4fbCFQ7oaPTVZ&V zq;`Pi21Rj~dFi?HtzD163tnnAB)(*=^zIZh@6N{Mwm%kI0>DI6ZhZuVA(N|uK)|oV z;dwW7Ps*cyzG07#(rq%-iU5)xV=L(4Eh!pbVG5|Sz}lM9Lqr50jI1?%4IeBc@!r3?N{4tqBFfamrOjWt$VK??mvWe>*s3N5y(x-26_@}ZDzu0Rp71}DriKp>Bv=UMT=cN=Z)~nn+0G*B)v_?ZG>q^hef4-f2xd+If9PLlSBCJ&I+H z6FD}KEw^iSr-luE=e3LUzlTmg=hhV~e1b7tA86U@J};%`;33n*cFsi8{%%Ndu5J$H z#M8zvvqg}@&mST6Ax>P{GokvHMps=XtQy`{Je$zKNgAEBi&*v;10|zi`8P*w^0^q< zB@U#iPD&*NP?6+Na$uL|8+SP zeOA}Sa=sGi=X-L3Q{cTT=iArQ##?*fVP77TLjH#`c@dK`Q*a=WXUa7wE$a@hzgpEe z3qv(G7kx(f&Wb+qT-+9>_X($ftBqy2D}|#?*K=3M6vgoix4gj7Xd92b-}C^m7kLMQ z8>1byxPy(!@e`g@$u(;(b%!d1e`&v&jF)$)0kn3Lfdw))c5JkTtN2mt&+8$YZeF^$ zNE60heOBm)Cgb>VT|{RE5iyVyTCBp9`uDx12LgUrk{jN42G-&>7+2CV?Z(;SN&t=p z)=k=c-Eo?v^H_8lmd%0B4olJl!8;q($e?U?3)Fln71WmmHD!~6ES4m>mMmp5J4?J8 zlc7$K{Dot`GxsLE>tF~AGjLE}sv`%!qM8FyRm_8y)X+(dO9umib(6fd9wgi`gVcJXB_DF__`e+7_gJ{9zR@O6d$?4W9bAS@lVFpzbj9y*3q?$8gn4Pf}yui zD~&~=q5Ym_p?9HlOZ#((f$hx%$rWKx5a~LcH$z%$E2Rf;f&)~p z2zxB(i^R{CWl^%!2DwG(Ma&ygLzb`B8jiydw3q7n1^ym(AqpM9cw&uE+Yw=}2`bkw zLh&}Hsuc_}OrO>6?*$(B{2Px-ZLiNvh1tb(MW!>*MiBTjzS-`WhFL4D?JssK8~XS0 z5fiQnlMG2o%2CIrKE{tX7;i-HY%E!%B%|}vl{m-bGL?sDvp{3~_REzk-}n_YMCHV| zTB=KRgr=D%j)~De_fo?2v5j? za{)hb=IN9cNeWtjYhx-GSH^+xE+s2!k(&qBc_g%tj2_8kCn zr?2xT`l@ri4n-{BrDpdavT65yBr(cow%4w=gCo2G>g~x`T*=n zM+rkyXInj$n44MU*h1ueFu_Din0Ko>_8>XU=sj*pWrio6k>tm?=&&|g7%?ezxp=#( z?YpA6<8DWCt`J#=_TJ!4*}&j5C9~Z*BE;I=DV=@+8ywaUO-^C{HD2a>FC(g&h=2jQ zA-rBg=%~=$Rhgviu~)%I=Y$kS%IJLMY_5$tKk0gef6X#yYr+&dCH0if(uqDNw5w-V zL;;wA&!sJ8YeL!O&NN=HfoX2comVc3Lzphs`m2gMx_g?kaSoEM$%C=^3yqYgO^k|<@ezNv(8+F_2W|6MVjQ0gS7KwF;RYN15b0jnJV1F((l})+( zVV#@FDX3xN%uYJ_Omq4<=AF6*^k5R+ZU0!^!)y|FvZr*U{WkwI`Yjz(ZadqrwZXk z)R+=|gOR1%a{%GSXXg{D)DFP9!yArmt~h~Gw6bUPPjkAstl*uFt9DD{U;H>1rcLjJa?})@;6~-uL(b~ezjL;E}xs*A@$l#{zK7L$AS+$W|v!!Vh&AG z@4!Ca7RH*MWQ~0LqJ%k9nuw|x=f-2?A36%I-}LA; zP?#eXc=V;ILz?nMFv>6zbY^`V&A;KJYb@X@%JdvZF|k7rFIaPe1G`R; zv3T?}oULo7=^akt^wU?h$r9#k&F*h1jDarQ!Th8?8cwGQJ*T`eoyJ=m+PTz-M_zby zjqh-_SPgD^M!xnzcn21Ul&sC}FVF32IYYmtW6Y`XruT3G#=jI+%)MhH zrC$b^MI948#>L%m%`zlHsvLdev`EPO0Oc3g*5A;iE~nWMMG+lS%GI(A=|T zx~$eq>qC$^URSaN68)D(E=Bf-8sKQK5wU35udvryKmtcde~7Oj-#<|@Vx9X2%9ra{ z@V7?P53YI$EHWv2zD|EUD*wh4;|ji?I6%aJbgGc%I3ADmqw=pd+Czg%eW4f%hD7=K z`x|s1{xr0ucV*qPK+Zh-34fHCqxK2bgO`C{)ksJ7!9oZ~D==AJ?S#|Q99M;z^x~`C z9tg(+cdpLir1q`L;>(R~Bu#-Ca`TfQb^2;+IHwrLX^diMomEg zF6N;TbMXNx?N??Td4PBlcCwxs<&&?`AHrW*0AqXe7ix-mbH5Zr1UG$2&#x)i$s!k@ ze6{S&SL47|vyn{zGdk3e16&KCsnm=hOJI(mm!J~VLU2Pn>Gb3RR3W7bG}@{A9u1rm z(h1iz6$o$B1y`|uj`99^Pqk`oo2rEr>1J~!H3=lJy6=W9K^=s`yz+;WxZ^2Gpktp` zmq7f&M({A#-2TjRw~?tXs;yoM=s*E4V}OJc0%hmKjmZ`ZkhdYDMq#E0Ufcw!=1Sw* z$j-6=W3pp5)GcZZ;x%u3*SdT#jIHPTa6gyn_bi+rlphw`bzxhC&hFCJ;IKH86;6m_Va0k= zi>wURhpFieq|*Th{vIL%H%Ynl8pIRNhC7)(Vt?}^B~daM$F5L0>TONPMM4qhnKV0s zNIO3xz|&rkpIc?6IcQZXc;bX0g`&NArLg`@t8If=KonpUtz^(`f;c1j39_f3+9BST z!=*vqX|&*mhFkdW37-ddw7CMQuV{0TN6_&BCgREqg_}_Nw*kU(XdFVLfiKj^dQYLE zlICY(#J*X3{k51I2@d`{ak2x-{;fr$P+*d9n#i96H+ZoyEgMa@aI7KgVh@8~`WG^5 z07+TYV2ccyxl9D0&Ssg50bNuTTe)4+RRYF_yn=Qi;S~_E5A3UB%&k;Cjc62}%35f9 zs%48>?>pxFJWWdut3}S*8ZC>!hdc+6HQzuayep`e?1b{qAEJO54zNz-aI^A6Szrmn zrvsW&6k-GxaK~=PI<0IeH{e6X+&is(lQF2|bqcbQw2<^MuR||36%H8CJNMx_hx{zF!hH)<>p6nb65G7PFO5^SqW!oh* za0y>Orql;t=Dzpt*u}yj@f6E`o)WY!kHO^9vtid^{_ zpsqz)AH`^)ZID`-=kyMdTN2lWzbo#}mTh3LHbVMH1xKQ6PFwYqSP7)SiR&iXaBU@% zIY!iFbBFG#{<=@N8oI1<5SfBPMOp-Vz?i-(4~8(ZJq;$?m&Dj;iN7N-9GFrQRMj67 z4^DKA&0K`PH2ce2NtlPO8-!`94OIzEcqI;!_MC7Og#NsyeB4*xb^hPKx zdj9SiSbX1}k8+P8sIJr9l}RJQ6zM6s`SAlN{gqY+eYU@y%l27+SYq633L8T%lw{77 z28+x@ncDLI2{k&(#caSm#Lb}|bO!(Eo*X{%*~c*P2cYapI0mjDc5C(E0x7(63+{CDCQ;!v^M%2epc8eNrIWr5V$VK*|F7g^4D28jV*d8vUI>$miIkK^yLj722 za?#3#0p!*c@omrrM8Snz4&j(|(8}Hr$r87p72*2JUqP;)72R6egi#5soI8I$Jaznd zIKzsDCh>S~iS8c-&Lhl==Rpx7J@Vy8`WnBeh(+d|n$@_0b7=UQ$a)|I;%ExS!fus% z%rH?HzGK&Tc<%#GhQH2KK9m3eIN(V{K~#D2d>GnxDONQUkKwY8QeT*(=nSN(A6=C< zj%7VEjseN~kW3O4p?|2Vkdy5sYx}<1a# z*A%9Y5Rhgh_>GDat#J{3*(Foq#vAsAweu@cSL@f>`N!sH@~KGEKCnnp28l+Jl1{?K z-q}E+hcn9E)}>T6O*$K6{gE zPHo>Fa>Il>5zVnVDEDm9L(*n5IXFZ@?-QTSBl28RWhz{v9z*2c^t>y=hd+5NY(w|B zIwOWr;ano0NGn7n=Si?4FOiNUZa7XZmQx+Qzin`>XkYQi&QTKGDZUDKl*^W?@#iT#D7C4d-)BraW zV)*j6|Kwx%xad2cTBd{Hrl=ku^|$+yodm;ucvUJqbL==37*zf`4iCDEhp33=hhB z7cmSNqm^uz0Do`L{PWz&qXbPx@ztk7ndcf7(5)~hx^yX27s%^Uht)yy*igKubq%6( za6W&i(io&OUp`zy7H1bWirsd2?v?0@bE^>L8^Bi3G8bOL!Qb56Clkf2k&=qJD!QYn zKox9ow$&brXVnhY2XnHKjUEOJL4{_+Qr^rUp<>Kn7NLnVo_qphKtRCRewWaxR}6l?0w!f{X$I#B&}+jtu21INPi59|p)e(>6mTRBhT?0sQ| z;_t-^i`6D3Upd zQ$-JVSr279e;2l|oAN}32=pvEeq@Xw0*KY6EAt?(6glTq*2XNEuy{@ z0-533SuFevlC#Mi(|8=JoDR!$R(U#Wu|Rl@F#xRN*$9GD?l;kgG_ZygFh``oQjFdcU=O9~#G= z;1RDoQT!pcHMCkHlclVN#6X#s2+9!=i-q4#ojd!IN||{?o>c2AO~6;;%dw)a0|#sE zvNIl|YZTk*^X})3O{>`NiZa(1@d2qswIq70#*&#f1Xo*fl|FhANzsH0PSD7_L35Z2 z?FR}J?CB;cX7lJiIk->)uyCcE=J?A)toldXX9>%x%3?ECgDd==a4B}}$J7D2QiAWiduwyr zeI!yJ{X9Iho$rWH;1sRkh!xcy^Wm?(O++iC$2A}dt_N>2e9#EoBl@CbVm|za(vL{= zsEw<5PSR$Ab2yJ1q0R`(tgiMaMyJxO8H`2`H;swBA`nZBmFB7 zOSzJTcKE>=+#K*ivFw<1N;>C^9i-)GKdAL7xkd!_~-=eJ97x-Ys)3=UxHOBo(?4X;;h0oa&rVL+C- zt`ibFFf|Z9^u^O*`#txDAO4=}!}G4X3O{!}OtVht)TwhZVIULPU!kk?Xrb5e+T%mIj-u!xG)tB#nJi{l@veYb`6jTpXwBGq@oq zOC(b)8q1{i$Hp>?5M#FK_0wT5sXGi8HRkXlhAF~{x)5Rz+?W5KLQ=4C-6yr})tA10(qjQz-6cl`uw zEZtJsFEH=d#oDAOB8)T@vDT6Rx-AD4M*wvfvK3cm@_>$&ni1H@llB+>LSeQm*6vp63j0YI5-$UziVQMiG#i=6Kj9a|#S%`X$L1lV4kA@C=9&`?v6*!E;*if1KJFn|SY zTM5lOIj%A=N@^4&fdr*O2B`UnJSYVul2m}pGUkCX6rVaZ9a1oB4sKT@E1t{vrw6XQ z89PObpBMqgTqdd$V+0yuiJdS-`q67Qr_Z@$2;xQb*LZyW;26w+sK;14eg0%P^p4*P zH}5|XZlqjjAMayW{)T4TjJb~+TSU6j-IG$&cWg}l&608fgG-eS9F_BGZLguQJ-{UGzjEESQ4MyZO)ZnBDW~Y zT|=y%6Oj@~!l?|{`6#-bq5zP4IZqL9+&Z?DU~ENs*j-O)x>Bc)u`+2;R4K=Ocf4W_lVj-9oScd#anZ z38?F8OZ3{v^k*aR%yBvxtLcGt6yYUw^&-Izq(GS3yE)uL0RHe(cZVN%<;~%S-NRwD zw;Z+*92pw77>w42wp`-c^a6=GUg4@>5IH~~B1`U#`jtUPpD~JLnT!1DEWN^QKW3E*dJcR_pO38Y-Dv)0NG`kBZ>T>*)*q;g5fu$U%7F%{Sh7 zdAT%5S#%o$A%M@$GiQ&5MV4Y3m9bu0BTK(b-Djzclj;%>DDylc%VLHIN5UuJQ;)M6 z@5F_$je4l+3hQ=>0-dJ>=J+!waG4qyE)yUajsv@1!*xqQ6kw{U5sio*jX8C&A=C{E zyN&UtJ~I#^ViN;QPV+d$pW{miAR1|2l+E9aX`7@sDG&oH+(*kK#)3ge1}=1|N%WT? z2GivO#H{f$8JqqrMiE?JCGPyLKfXU?r|5d;@#MW-Nm1Zo9(xZQjCE>hf*~oQcb2~+ zV?uFkIE*mo&AYb8cEt;nK6x#R3#xc2t01_F;gutcVuV-dM@}{FC3feGeaSG9V5vX#U+&sXV9Cf7Jli?ienQRSg?0UyUIXpJE z7LIdnehXC>Cm+X1z!+g7b>h-%HOgGkW9qHwYqQ_h2QhHr1^F-cIu^NE?o$t&m`|*E zf*$y%YF5>4L=qpsdE{h`Hj!=#3*Fq%pB%^0eRO=2ESa36TBuOiP{P(InpkL25RVI` z-#kohml3pu*;7Q@@Cq=v1~yGn=QU1+>C@pp3d?VK0ZUagAUF2P&|4VBI_Ck^8IVqf zM*@k)BJ*0X3I-89Osx38H8&uh+u`gJk0JgER`6M3_PI`L9CMnS?ondtSp$kuJGl1MYG}&*Pautf+{b2NJ{*n__l@bA1;> zs)xkg(h_A1ay3%6w*LmqT@WHcU^?g*jFu6p#>(O`D`x8VFB3b0nS z61j@p7@39Zqg5Sw(y^G;N-S?D<0e7GY6<|CJmLn?jmgmx(71OQ)*Y?StcG((PK8H4 z|44Z3&p#h7eEw*dJ~|y%STV88{xnq}6^z0y|HCa|=e2tgsg-c-+-i8+dp{bk-p?a} z25}`BkxgfOHu1#7_ONHqjc_$qxQn(ZYcfdGMgpwjCZ2K@xWYy%VU+#FeIM_P zr8}9?k+FMU|AsgJrXctwaI0nG@o4eDva0aG{l&^l>!gQ#-u>eI1x)y**ef}mV!;(u z58gPzQ$V!hL(3J6Xu3xx)3Av|;LX!vnl?!-Dlp0{QOpq9)LSDHBj>8gU{pK&EVao>$slmZ-Qm{ga^w!UZP&(V5;0K)=F zj`QWSwubzzissz^r3dPxk`nteb;8c{}IHHhEKDrKDN( zj~28*2kcN5;s(H5pblfkZMABWoMzgY1q==iC&VS3FXFoBogV(2dfi}y0Okh}jBklP z@feXN!nADN4x2_{~&3OyKV2@z>h6h0z8F6Dv5%0+qH1Jd5_LzM_`(e0z7)Re z=I;(qa?CQtjYEidv>Cm=AYB$1jL@#whBJ@N&d|Ju_0FU(ZQB$H8Ndv&JcQ)R((av8 zA9hr9FO0y7ZW7LXmwu!EB30HL>19KB?CF{C+MBLm^#uKv(Ibi%F`~<({_&lYWAfiB$JogZWGBtR zK{m)ujHtvy7Mbc|4YY&+5}6{hy|QpmL_UTOgqFd|?1ByZfRr`^lsy<~>$^a5HLT6d zg*IM52R+;e8OU|4V01IfQ45v9u=PcgVQ|+J;xQA>(^B~<9$>lS(h-P^F{A4(zt!#- zBo1Ivp(`MZMC*JkKwJe$)~Ly1JG;(yaFzD&*%L~y{8wb!X2K#*8rP^?T|A4Z9*-*T z@V$Q%R!e(A;2|f-XeL7b+s0hg+3-CFc7!*+=9S?rCBlF9g-1X%jKMz&F1n>cHeGF2 z|MZP-Iy8Im;KA$%KJWns$aMU3aT7LhO^F9!g&)cETNEQ2k)R}shNERD+bE3BAkf%S zEm|U5C2&4up9*$pRKPrJl*K}RHXM`rzx?!kSVTnbm~wRl0Re6;f^0!-M?4=~p}{3` zO>_u2gYKICx=o5}#hF{oq_EGfJ#HFe-rEOaiB!2)S16Y6z%{xex*3X2k6F{8fe_O? z!Y&H}Cs^B*p@|vG;^TcXSkr|9wcXTnWo%*wFzkG1x$kinnL`U~JCK;VG^3<|hEEmrZ3QHmQr5ycXfhM8`vFhRz zQP`(ADiFR?)Q$`l!Zd-9WyF}ZTxAm&7LFmt;=`v<>@MIIUs}cbt5#t~WGev__Yu(? zaBfAI>IvpiwLYxc6$YB)^;5ub^-@S7iwP3V@fY<;LoP~5_ zL0yk{xMi~S`ROowsvgcBI~hG0y+mN$fnamZTL07c-S@@MI_VF%p6KHCTm*+3K=?z@ z#z?vM_F}ep3jn7n9XvxhZ5v~$&E$*dEBisU^ecg`@!L8aP%7Y8%Dn*9q&o14#)jPF zwuEj8T~_{q_yPxtz#f+2AjV1)(Qj+wJi1tB)&Dfk-LdTfTU_Db2aqX3F`W`bMI@W> zW}nxSv)P9~5r0>iSi9{eXIqv@n1fU%FaC+RC;_leEpmYWiSH5wp?#ET!W;-JAW=FH z1r`Abc4FmR#?)s837}$IXTZK65_{#py{xgc5oWs}v-@ z=(6462VeR^q~6(p%SvBj?qPnI$QsY53iB{fe5xE{RjN5t+gDhUY+}d4i!}_cdGghE z>6IqFO1Wgn*C?fN{_Koz4j9L2L$ z9wz?v+l)oa1wQ4Z$^dM)o1p;QT4o1>oQ$02jjWCYe7qPoKgCEGfNOvNpCN4HFjvMK z^3%uG+AbhQ#H!Y0#*;)A+!`w)BBJ?)cbs(81LI&k3DP_i0%SHxXw}sV01@giyCZQK zJW);fid_XT$n+A7v!@Zymcnu;F2ER67f{g@kKrRK2=P&?MmvbPd8$1zvc|`z!tA+o zVG*Jj8QFxp1LBbu8hXPJ1F4!Ym}ZeS%Sz3?xa>5IWlcA$C~ZtMSn^xtc^5diPAC$p z<8ASv?Npxv2ds1iU0C9~B~bRkAP!+6dxpaIFP^^t!4Gj_AUhaw=w~-(@KswMF4kot z{@nT10gMu2rhU07hs=oaX~fsAJ^PUNPz?qQ!Y^{q8c1D3&lm(p2uE&UlnGL}o+Yp` z>J{%8u@jMOaNo7TBP<5DrIC4KeZo3axrSS1a-)gJvg2M9wfwbBQnb?mx?1}idd`N;&+W9xn1P?RMTjPfncLv7U@d_Rzji_BH{&)MS&WU)@AQv#o-{u zD;jPt6HSv^wDZm?Y&ytdyd|Pfsu!O<(L>+5B7(p}sH3H_?A`9$CS%hj`*I}iCo7t#Utkc`C+7_audOv&Aa+2Y^<*9V`h7ch#iBv%R#r=30mBM)BvX?)uJf`~s)6ffv?^Ad0@E5( zTSMNj5CfmZ=$a*1gMUvYJJwgX^|{mc{>@J_Ogh3$JKV3@zDh)I{BrPM$Q(Y*xccjF z%a#kD>QeATe6v5XV=`sHetwbu58F25oKxa5Z<#2TEU3`-vEOtV?!W>E>FBzPI@sly zx;he=Mv+{l__U|9NH@DuA@(|oXg_y;77oG5VxNW=t<2-1G5dI^e-+~rQ(QH`o>;QN zrA1gwqd_>HuLUiJM7Esk?M1GUFUj0Ocz%h3#<}aV#8$;{vU=0eT8Zg9;)QwT!qmi8 zitOe{gO1153?|pBr1nl7eIgvV{EG1W%XWs3JbH>=Cdb1d3&$rA**=E13$ZlFPv7^* zTz4TIVb9e_2 z9t3BHze+s2|LY=H+ zzM;w>4V$69xEZ@y4h!+IIffY#e9+V!97w_si`encx3rdd{&ah;#dH&5;69!)KcMp3Cfp#OfObI`fFcu z1%_`z(BlfKC=Hy&4sK}MYViKE=9%DGNj$Zds0P0~ZdJsUpHbx2`fjK7w2qS0y z;f#dTfyniewl1TWjAsL^*CNc5P9#+Sv z&r<5E@19~g4v82lFf9CEqa*FyBDGZ@U}D?W*zLf_{+&8=GMuABZGl!2Emi}T(Dl(h zgj*p6<1CUq35g{JQ zm6^j5`xJ@lYsl|kC z45u|>`D;iPZWdL524F-7Ll2m~k?Gu4>~Jh-K!&l7oE8Dc{-%uHnT9l=gfuqR-;+XSjFM0M3-95 z5q5JSHqRN3gEaSAr>;oL_%zX(@4e~raNG4b{yrccJ!G0u?lA3`-qzoW$j88GHE7rkIn5Smyv7?VNj$|HG7=v7@FGt40xeE(nj)M6X z1$#75AcJHx_0@2SMcO6{M4&{tu}RSCSI6O&;3tL2=;`72SfJc$!ghd2SSft9~ z;yCtL2EvM0>#cOi4L10^1y{2BgtZ0;tp9(_om*_%_jSjAyh)TuQKCfMD2bLO*EhxU z94Bp-ZG}AS#ch$a80MD&8MYY?wqaYbVGqMzGBkS_Hf-oifCX6>VC#lDL$W2^+QMz@ zD2`*hmTfh*Y{jx})Ws4-QoKl{BwqIU{wO+`JLh7@N&bLDiK2MwH2t4e|`MTpMXb-3~_PwDV_a-Cq<`cRb}Qu+6v`~IN< zmT;x2-#$OG9O-SHZwdyUoSBXl0|6fzu;f?;RZ*F#u;k`uW+m~A2^=J4i_|th24Csu zS06Kd9RUb;eKxiYuio)mKxtUaS$T zqS+7|Ab;;nPMKFv{HqCdZo^ruHxo0rObD``2Pf+K=v6%EU9c@YW_VUJmFQ_ndJl#L z0^)T!%@%O6pF=2`%nPr^n(4GkYgo-uku0BG(E`q+-4yai7_vjM9a16-Q9PEN%)I_# zs<|rZ4;8Q;h^j6P4i37{ymj&7uH8M6mX@Z2X*zY**7)3ui`XGlNDZiyX6aSvH&TUe z90~+TTfoO2>op%pFcaYEENKy(~nJr*jH(w@+5FumaCN zHo2(agAHhLVAa^VsPj=*_6;&In}idPU#tgf`CIr&E>^>V_gS@LjW~4j*5zqus6G(K zNi7`I+?2Muc;g5Y&5>kcK^zK^!VOytE*`fS6@n=}M$2ltum)hL@7n{6FP;8XVI zZCk5-$|V8vV)keG1^UV6ygAj?%l^*XJpNisg5>;aG<9_AZ|^;*`ry0VZoS-H{(8sV zI>lSTbocIo@CbR_=5&e~WtnyIkpCBr50+$3p-G?uZ5Jy&iI^o}hX2XA|ZxUU=E;?QEuEAY&OL+L)Fy1Ja}+SeX@? zzX3-Q?wjr%uvLTj6$n(oN-Kl`FNm2R-=cdX79lId<8W6l`?xZ>qM{hjaattp&&}rM_@fTxd*0gC z!|!(UkyLc`pQom#u*b#&gL=i|&A*OI^E(LHvq@@+-G(25%A=4gNWD*ABy94WCKpXf zdb)b~ncQX~&Vo@f!AZllG6`bI3)3-kYUTz5FXjOY%CyM`gT*_ogLIE#vl~P|dj-N{ zk7XOJJw|=mQ(#q|)ERNE;z>4<5+b@4Htm7B>h%Ob#Tw1=AD=U0vkPntx4DJ$rw}BA z&0WSOtC%j0?XLHcFo1*H+UYSNI@_sYUv^TJh)Rmou?YlOD*jJWz_tntGtS@+2`i(^hY9D9OIqqlE;vYf_AvuTW53SGV z#y+auwNJG5?PCd8|ATN#0|TaJV!RaX?rFN<^ZR~_IM$iRXkk;Ft!+&vO#Sd0-e`(Y zMxJJtqV1{a3FD{TQjiw;8K^8Gzb!-LUQNuI-j*=7)@K$d_c+HqgmDIGG{7TOP~d(*F!QMH=qBf#IrU?U+I+j*1x=B!XZjS zz`N@~%uo{8Jjz5-y#gPUx0O2eBg9%VJ?aYYZ;+or84c_YwTr3&mMx)mYEjKeK;pA+ zj8n;8j5*Lwkzt?>fCzf$&;fOkM}* zm6>rkzLuZQ4q4$2-^RMO9{u4rA6vkBO2~gKjj4$(t&Mf|G*5J+P@DQQu8s8VH3jC0SRzEm96+qZ+0UouHDF5!+Y)4BZ%AV$k( zYHo?vy*b-PQB)w?Ly4tOxTNB7mA2&N?Xn5Hw$2G73Qnzdieh;JpsSJt_3Sl2xp*BF zJw{(IoG6}Cs!*p%r$_2nDpT6Q1ESnb(&$jWMzwwgj$w zfLa*#4f>1*VDmkdomqL=aG(s~w;u6vuX_^k){7Je2aWsOnbf83-j>;5Q{V}pHYys+ zMR-Y0KQ>l0pA`}lwJiE7-laku**umV5CCtJO%T9Yk>~3tepZq@#lno=xJlcl9RbE8*zHAO(q$SLB>GPBW=IY#a%DZoFeRCNW%%mOA`8%d|Ol6aAt)@s^sy3c~_5-#@RXl8Qx zMZ+4KpWd5r_00DpV51m$5XbASH!lu{yMvRclyA`6%1QmtW>YZeiqpDKU_p{_La5I6 z?R^wSH`+K^WIhelkYgrbL#r1C<4$p^^9`Xj?PKw@@ahmGf$60cyUQvn zIz<7ak~#FOwVHg(=89h}P-l&Vd^0t}5{`u{i5f((8#y=4#uEb)4aGBTlK42Q-yXCtP&(vO{>W>BsVMSV)?1;bmB!G;5Jhq-J#;~KX=`ifc0#0 zyaw52r-$N~+PVVg*Yg`k+S}VOX-*DgfmQ;54%oZ~KzV@~vYSOtmZ}+oWM%}g+c=R= zA5SbpEzMf*INX6<1~1ODsOw~H8VH3jz-E!6^6P|M%!r}bJOi5|gu{b3PESnR5f{(8 zlH--_W-(dNXkyL$!%HW~Sm9OUAW6WQ%VcY6c@3o@#c@`9B++;^u?>(SM=Fui&Xjn35VahZ~gaqEV$b3rCQXYbuCLPG*RP3hQvjiuol-*&?!q(B{ zUfEw%M!8&r$q-lQYpc`AmyJ&DeF~Q+zrPc#C(xynJTNd&Gcr6jw(r2MAMlQUg8`Jx zEB3A@<0;B&Y8}B~GYrav7=M z(4*5cFem7;M@?^@1-vpbZGJX320Y0T0-xFP&Ur^s>Ra1gh#?vbmv}ltoU8LuNR%HnTEhZSH-jW%~kK z-|qVaSD%a`wxS@-(?b_#{XXY+aaewp(;HzlUNHnnKwDoxDHlT{=Sf7s^yhQda`GBk zbXzrtLm~ldJe__|5vLYFgw&i&?FVDbOWHHAAJYVYfHNi=?g2r%N%iB+XcT&BnciG* zi+K%sv=$A;PK#ePa&y6)IDgev2B_Fu!nfHQR#m50Css*y30jVqOrTe%m+}+dB41*F zR8*~E@_N*=F!kw)8)%MJ3#crBWYyDc&W-bBO#siv8{q|{h7}qqtgF2476uNU&%1Ow z=t*8W&!Z0IX0w%0=pG%asx01r`-uryPr3l4DIs6FG`2D~n|R@`pZ&|8zW%<0Y+gq) zxx7(VUk3*rHXu7Z026{)O?1;E9HJs`3C=ORd(^WS{2)<0pSZ@VC0-(&YQhAF+G*|{-0iE5NLi;WcgiStE}1oT*E{^#6PbNR-M1t`*B)wUHr$pfiL zzFYpaHlKK0ZW@+*8G|Q6oLV({LDl3~so-6GF!^UT87dvHMngbK(Buv ztRUzM*WR`ND@RAVP_eY7!JsB}Zk3FvL$Gq7?{Y~P$5s(XlYxBmC8H=pPUuD*&KFMf6+XxH~&{mDiApYP$(?k8W|m(AuJ zr2gZWU3SuuCdf>RTuI7AjHc#a+90 zGqSGPs`L!GXPurnP~oe?S0RG31FPaJjy4#J z40A?JYeqwy8lmOoWhReqBlOxvc}UJIM(41*98ZLnBphl0*>aK5xgMP|O|&c2Twx91 z3eepymSB7ic2#CTK!Fn+xlk`-FEIne_vl=dUD#4SWUUTt~v@g3xB>gyZZak z9>~QlH9%&j~(w?c!d@Y6(A z4>isTw>Bsxkq_k~b*K(`>WZ_57oFqFL2pJIZLg*a`}-sAuN)e5<`zoFAKvlMUJ?f1 z-dgboqLS~F=7T)Jw_i(P6u&s+fDOHVJ~2NV|BuF|+S4FgJJ)in5r6<^4aH2!RGg$A zbT@h{h|#z}CA^R&FKQ4@1%+N&imXF)o?C=D;xipIH%a1o%TrPVPGPqhz=hV9R`Bo+ zVptldvPtCmCOGx#sN=(4tbsoHskPl8gQQa%fQdp^R!oIP@}M!1Ts@_v0c^373|`tA zHi5L|z|iZ#mFw9|8c^aVl&b^fazW8?QWgV=zf8=}%t%|T=L$6VXlAo{mfYrV|LEk| zzoqe7YU|YM#A;0*`1Pp>xcVvNWvl56F|+fHlV@*EjL-j5O5j;@F1+PDJumz1XxXb*-@z8Qf+&RmM&g`uh~+p*o$X=UG>oHs<)79t15;SqcCK|7$z@VIoxY)s_}Od z_tA)~6l`fPFqT$%QWpe65(J>*F4qv-<)qWEj5M8aaFz&(3W<28oJ_`C{X6=d z^cq1J*iM|EW-9PAX(+0|m;x#yIBN~4VmV~uRVk4^e)9&-QUfSiiyiE^L?;`qw=!M? zre=OF3P!$2Es)ZMbpJu90yy^dGA)KqI)W`t$)_6BVpmT{99(y}cQ@X2A848@2_xk{ zW3j{wzxgMBf2R6bG-Cbfr=P$5*{b({nzx_&3BL2gNo{kV;~3ud@bE%;dU7ecG@tsf z_SU)=seOI7wKY_W;KDMIne>_q)#|_zE7R1oNXo8+6Gr_Ng=+M%rd-7#BuwDFNCgUO zEMHoH2}7fhF1hoku|Ge%C#=$wt)M?!YrY&`6`tHem~O? z+|F9ZhO4c)p3Ju=ms;I8$?5+aD7t@i_;;WEx0inSb`;Iw2!|Iuuf2Am{Kz9uJdn`m z&Ncj?-#_yceCL~!jh1>o^}afrFMe^?_W9VYUr!}B4tICAJqFLQGlU%$7?P5cg_i}) z$=a5Sd-m=r>%NAD21iRvv%~NAInJGb+p&A+ULxNTj@vEkdDGXC`ku8iW&wt-vz*GL zagbI_dN%F|1sYxaoi>_I(;N1i_Qp-q#Vn@UQq4j-wRASp+x3Iy#;&))%Sn$ zb0xSb&Psl-%y>O5SrBo0?} zWQ_0&?id(k!R3s0(up_hFaI>+GjDBgY8me0)GE{bP!8BVRcH-|7Rg(!+;?ta-Z~v^0UKtz=y{v t^co!)WZec!I8S;%w>Mw)4S$|){}*=FCxWMII6nXY002ovPDHLkV1i1Y;I04w diff --git a/site/themes/pinniped/static/img/nigel-brown.png b/site/themes/pinniped/static/img/nigel-brown.png new file mode 100644 index 0000000000000000000000000000000000000000..63124eb95130b0a883428c865e44354648d660c6 GIT binary patch literal 9225 zcmV+kB=*~hP)r$SSr=qBps+DT(`&<0Kw(j=TKEx^t zEm*forBt6{tx#M*kVQmXaDjyE+a#HpOfviW&iPG#lV2vknfc9RG8z2j@)?rM@BZ#` zzW1Da?>Xn5D}u@Nji!L;8{NCf&cP(W-|#^&3GgJq-*5_i!@D=h!IJ=g!zqx!?rkp4 zzo#N2{Sl@}zuzJDd1{t4cD5$4ikOR<Z7D5$Rgnf)vX7eVj$IY$vRw*^#Ho@< z^gh484ARm>4OZLIDurTM6so&?hQZuRjK+bO(MiAylK}G&ad&mO3qh3jx?GSZ8YYnh zHys+8G+wf|FRgDW!_xfm77)*SlK}Hj?Ix9~>Z<(g`aT4hn{-ksh&X_UBe>V^2XUBu zKEHSIB@ONS;sGn3cP0T2L$zJi8LKXAhcS>gi}!h4VQJvzHaeRs<*PkZsPm_R1c%m;9@ z%?2F~XRwswbU9RHWH5i*yk0nN4y>)FD>FgICjtEaJqYr}v49p!-bsK%sP&J>YOkMC zu6pjH&keJGci(5t>#NHLSuW-Sn7EXPn1iBt+9**x5@h1)(8QGO2g9|kT{*D;Cp7OQ zz#)`6{K9vRs50T)8Oz^eXhU-`Et*KU z3KmMdSn_4dWV3M8pQy;s_Tr*vluSf|)AwSp*Y~7YoVK>7Z(ym_;~BHqd#p^tU`qco9ORPQA|^!5l5OXqtgWobz0^- zn!gX@99*YSgPbGYX|Q;FzK+#x`jU9tB;>u616YGJ$}Z3{8%v+xXG#;Ljb3^R=~+mg zKEvRRgKqauxkU0Sr^j-yypfvOIp# z4B{M|L(Mqq)nn{a%&%uj{4nSVkV1r;(oC@z(m6&21etkwdrsD6mu72UCx9ZUEh9C6 z#C)s6@%b(7J#%7iXdEvj1z+-?tA_tKDi`S+?Gd@hknhTic*4%!M`_?>L%I~HJ;i>VJL+`nog=%&N9nFa@n zW-(XvkF|f1-cJg^bIY_gnOLN7;5yg<_5pms9%e2tJBH0%M|*ROAJ>UyL9l zFC&mNkABr=Sd6M^#sajfy6g_*^T!D&v<-tShPG09KW*un-{^LKl&t=Z8^A@{tY_si z>FP9zY*)6#z08lIk2|+f2U(!)-Zb3sPaLS>h^@oz zev!!4*kuSJxh_w8@nUt>Zj;*u+0yVPL~aAf@bJUN_HmM4!in(p>JPPAO6GV+p5Ln227-S!cdh z2EYATe_UPn0IwZ zoNFDEqH)aqOh^IqXJ)~Z>uO-{M}2qAo~C}Rai{)-_!-e*nyA zY!{O3n2(hGnHlL!85Q|Cj9N4so!-!xz;G)mU1%_cOP`$lnjwr6Xpc*()qnwl)oiiv z^%#t2Tix*K@28aAIa3T9*44M>e>P;85YpCU#Z#mpQVPGYoncEOB!XTv8) zjzVQgNm#=J73xMqLR(jRuzcFXM@nd{c&g1XaQo8fI=|H$Ug_cTdhh$NvG4v^`aIUW zaRFSOuQ`f__&TcGgK9@w^n}w)+0na!3<~KYH*+YbFt?DI3&SN6>pcbo6jzi(Uq=_{ zve5;AlPt*HWa;6OoXXD(GgxSzzG%gAxM1-@$P%2NVHQ$|7$I ztLx5zWmjGfnYaidh1b8{*aaW$c{gS;%MxJz((l0!mR~lC9=ESp4O(=g37294xHv1e z18H`b`{c0}V^WL`aRJP(nnM>I;fO`X1~x?kxC>XXn|8bak`UeQTd%zdhyEG6?;LHV z9(iUX@8Ed&?q7ow7jF{*Fx6=ou&(?{Z`m%C6XVSn7r?l3HsV4?u&4AEEY#oXN<+v({b>Ax#;JhgnaQnKS^LC>jSJ98HyEmpT-nV%Jth(gi;l(%hKuLKK zbatK$zW>p|Be3(iZM@~#?RMzu9o`&70yteF0-YkdHHojHlm!^);G;MPGm9)CNhrW2 zHC3?Y7i)t>YPBVhlT!wDmH9AZ?rd=Nn}t*t%+t^k;KC`>YGBnZH$ctIn&7j)Kfet= z```#~dEE%E4MAoT7hsx}D6tkXIeOXUWPHN_rVfVVVjsGLlG;zg*)IwOxT~iZw!Aiy zt6q5eFR<(NR~VwsJ9`cc44v~4f;0;-)86W-@bJdq))dyRyaBSqcs+6#SoAInu)~2n zf^->pao0e5ZkNmR8$8ghn3|)!M@V}@^Q0^XQ$tI0HJ@Z;W}I|694n%Ajtg*cK@sYZ z!|#6|_|qRo6nFK~V5khpLhVz2j_^ZxT!71`PJ!P(y*^m>Z`Pn|RhYyFun)Iyq!#5S zbQE0M-fP-;K~uTvS6;UB| zl{yEmwd7J90HMwdq!;%LiFL}0j`zWOQyyS!sRBhco(PGYxExH%hRV|NurJUY_u!T% z1OY5Z-7-0vGe$oA=|Uy6hob@E0=({#d*R4|gXjk4hm*%X0c99nbg!Wo2CbH0{Z!__ z$WR^3vrreF`IWk0&BV>5)+D9P;v6gN?Hjflo@oFxosG7tCXWtUZL%qvvO|G}flIIb z5m+r&IDN7nHBYYv-z5&tz_JuL$2)PpFG=^qJk(d5LQER$Xj#IXboyY>?Spz;WK|az zKn7~LSbuC{CiZt48NMN70)2-FSI)XTPY5}9^~No_E*t3it{|KZBl6YQ;RfLczhCb8u;Gjt6PFp*T|y-Y`0k< z15e76f?q`ch!gNN`biv0Dp4tlI4X%TC^(()9W9-(1u#23@S)KUN|l;f%W26u^0Om5YaZf>)MaoP5hhw7yyixH6Z}Al|{slV*# z0X+v$>Lgi#$X%Bb0ZgD$3IdFE1O^2_tA6Ah+++2A(bCgDD;zOjDl9C2xn@nX(`fbyEH<^i`xW!+6wzDIqC$pl(?!x0Q0RY*gL5o$1Rs}jV88&nq zpu-eUO;+Y+qp=@>7!ucq8v^@fD$9cdCLc9Z9`CTIwK|;-eA#K?)w1Bpw9NJ8g_d2# z{|;uE7G|tEk15NGj(FzgKIqurz!*772G+wD*1%yjv&FvQ^R9ur!geZw4-yJ+XuF7` zz2JWl;X9P8NP9X+c$Jnhx}VlF$CY4SWii;CZpcOh1Bv9XJA1)kvB9^dS1<#B{oh)@y<0 zU4aNmeO)_1>@x(*P8Ro4h2sh^ms+&Sq{GlAN95soUR5a^ZER5C98`h17a4ow zp(g#Xx-OQ+#E~~?09O@i87*IUVLQ6@HHA5lug+pX?L{usC>4;7M@5)M4*|`*MPCd7 zM+>o2=;KvckQNU-&ZZ6L*aB-}_;vs_Di zOIk>E8jLvS`k3!A5&)<(6rjVwkRcCf$=Fpg4XSQ53!d!ii(~u`zaqtXMol{b6b5>*4*pfL9L$Ej;IV%dbP8-S4Hmcc+2Rf(5l;sa3h=ao%5Wq@d8Vm#1DLDHu{z!N zf7v;3A5~USptWEn32^{lbXFz9vBXBqPrlaE%6Ld#ThKUgtf_;SW+ck#;I|C--H{U4 zsp08@q8%dZ;8m2LoQ48B@_@8p1Df%b^;Vh>UTPYD+b>_;2?2P11xCQZ@I|M(%omv* zo_DCCLXGT)CD~c8MDu5g=adsxgAzabRGS^ccM? zX^viq^E1~2?+ET`okI$Zh^!gI!`sr+VKygpQlwWMI4xL)=49H&nS6fd9qszj0kmSM ze=J!O!ol1I%q~@LPM1i2f{yBIPU&r1qUou}(s+8eDqjZ;xK$djRE>M)yN0623a!J2 z>P{PStqE<6YukF_^9B%FS(JPU1-J+;fyFtx-j<%hxjj}FI{62ZR-ss+Rx1uBsLe?$ z24w@>frgLtFo8z-8bVxaM89eh+07pJreAj&ZcAE&c`8aMz>zwFyO*k>Y;FBSb~e_! zmm&9F9wYa%E9!}yce(vc8o+F&<1Mm=>V7Hsvbw_HGpQbU-Pve1BnKV5K+PtkqZo&_ed2;(d(k+ z=hj7gUrOQjzYn6g5elw*DDoYZN2*w}&*yl)y+?H{e5k|(z$Uziqyx-0t*WXj*K0A3 zG`tQyBt5i~!sz2(Cmk(C$xLML`CWwV5Ze}Zu4Vu3N1!{M?zbN4FHSC32v1lG)PjdG8aO{g8CnqF72nS&Je&30u{ince!7FNN>DxEbU14yD15z_?!QNUqA3LJb`xP3t!yaVC;&9Y+JKiz$KdQ7j9(|Dx`VTXHvhf*neJKgB`yKGJ2O~s_LG)B^u5#95 z`(Wuj7aZEG8zD{&C^|cEi?Rt-o#dkU2L!bInw3!eZ-Mje@n-LW) z9Pe<-T$xmz~Dhd19EmGmxL!f)+rE7@s_Km32xN|Kl% zWdSA{`1c0P2!H)?K3u+0kN(Z00Van$S_I`ytpZ!iNZaoPFFpqcSFL8qsjQj`=K2O^ zfRFzP9ZC_o)+>@|$ zOUnojCU@HYAr9q>z`peG0oZ;1g+X|vcu_`IS2yEgD59PE_9!F!8GxXI||%m&fd!-uO?r(U#%!olV!|;M@yR<^%;lNd~>1)~gyjMlS%y1C<1pnUVlswEz@P-vhREn+TKz z!{F|@wG@1wG+rO5aF=9+ifN+V(7g#v-|xxM-Ze8*&YUZacF{(!!*ThlHvP^7(tq5G zN=bn4D=E<~ndUZ}vrZ4jkK|B%LEtbLt)RKeeJ*vvfpgLO@50-QzB_`D6moEv(X?iZ z*|ud%S>c9ax%AF}J}cl~6^@H(frbG_Q<7%kMoP*x7H?=&zKB=4QiCNK9`M*u!IQQ-jo?%TWI-HVou=)Vc$YHby{z=?;~xG4`oUWI|oFt}=1&bqC> zMS~mV*kVbHJD-NHAmspltE!w%agIuJexirMItRRTeIcDr@U3d?65pJa`Jdm`s;@ev2zDthm0vxn+>;Dc>*)148R!Fq3AEw<)b_xXwIbr zX>cflAj7%lmig(q?G2(36&*d}u%XYr(f*V@?+I_X+ngpt+d##%kOrC*v~b1mYSjDkT7Zro8BIu}m5` zIn7C|)@idWmNSVc>oLg7jcxj1Nej1cgAaamHEhR#W%ahEtdB4q*Qx}nAja7lS3T+pEhtu1icyc})A2M_FrH|&A!t0E&4DBw$^B*huw zCR|CM$>37kQv%@o^0Hq%U#+^9OK>tI(5%~!|Gyl={996539T)S=sV?us;Sk`Sbqw< zL%pQ4Op)%8;MV^=jEz-2v{ZYzyKCB4PB^2S_SwFq1i)KMa~GAQXY5M^z-$?GeQg>B zagk8u9sHfK0b_6J(0FJfBCz3&=o$H3|I`yWQq*R5{^p(@<+*zED=+ z&*SV}Sq?TK2X7b1!2}H1h>7#5V{Fhd0+<_Nj^bvqmp}6n+U52A?$cJ&x@3Vcp7o>* zz)zOu`?HbDbhsrUWj_lrM(Keq5dbE2B!S9C++k1or*n>bh5}3>A1G#)1#eZMg!esI zaYRrQL}#zjerMZ&{jcLm^kkNuG62`f<(I9_)4Z-hkOQI4hJ9uJkmee}fh>XC=xj%K z8nKCDYf+#y(q+py*UW_i%!*+e7?fIi%*%SL6Lam&c!QlX08>XFE6!_@rim)(unLhr zofbv-c@Zr?bbBu=W-0at`7V!46frblZ;*vVeIL~r7@s%e zj^dp6GSULEsMJinN)bGTAoCq`peuGt^1bkn^%gky1|3rpcfO^+31A9|$mgCz&n5v* zBEX?lJ$`=eRz*kqO?Uw$w4vaBO&rii<6P^<@P++Z8FD5()2=5B@aBFQ{ONy3M{BZD zcnGusPXauFKt`(??Si=&!h3`wnH$+B9o3od|Iq~Bx_LMV8C&K6-oKEEEA&Z#qft4< zo^t`FdH1S|Eb#YtMtgkFwkV4eEr;6;asX)7_fIaeQVd%_hOC)Wr2Cq0Q5D)&D_*ac z873YUE!Y|-0Zuh|0nRDY97VNbUFeFLucdZWdn&?QCQX-Mo$j9G;FLp{#B=CsIb0(h z=!wBqe1zsZ)oGX%(W!>;1y#9tmCdlVCsO-t$iW#Au7jThIK|K{&63|$UZ5Gi1SvxM z@H$t<*O`si%$Ic%;1mNG#j_2?GZW4?T4F3o6on_ukraA=65wc5O!D)Ec+*(8(+8nV z5dv^yy*?9zI7hwzDaqYTNOdWtix$$O*(IuL)C$F4gyf|>LI9>a6fT-K=lr5vb$&y; zzVqN0rzi~L$YT#eD@?I`XB@x_kbB89LufKvZIFf0;3J7>Rdx>a^0?E^o;&B*pI>`V z@GYxC+my_F!YP%^Rz;}m!s>j%{#J^$?D9Q(_MCBkSt$eXf&~i{Yu2p!@uEeGhHs_}A^Y{qE)ariFb@Ho zrP9FQKtHd;0A&>6l{^l|@MX|^70B>9+}rPY1hzfb1dl&+9g}7E?%lsXaNxjiw{6>I zim6da&OD(27vhz0`}XZSfx$$T(fVz~`viY}?G@3o1)sCx`K4V4;Tjwm;j~`ly2IY_ z5U%i&vUzBW4h$|9U~XQ#Le~1wLk}%^;e{6t32tDLGENA4KhAFF(vFS|Ng!95h4BhvfC2z9}@000BTNklQ|~gOwMZi-*_v zU1lj?q*Pc`1AgfeCd+@`dnuHZX(Q(E@9%%Jwzl@tXnjl8^P~d2fB*h}78MnJUr6U3 z`uQ3-@%bmCveIHni2<{m&hS^Lky9PH$G-gbhr#y=Wa=z?i8C#}_^!s|R+v{X6Qrso zP_v>Ime-YoPAUBA1zb0LR##UyS4dySGfz?hZfI!u87e47-r>&EyO%aS4sX1&En>gJ ziCj`kl8rZ8mkXP=zd53e|GD>W_y~if2?>3r*4Ba|YXN-!&hNs~*(GsfaO~JI$%+*# zM&6nkcWJS|m{fqNc?f`{v9XanGc@6vyZX{axbTU5$)OmX=s0&y2a94wE|+`x>M@&) zU@`%c;8Z|C#uJo$Q>RW%SYffYDd_;S4Mc9v!{6JHqnTT|4D(m-K{|coQQ)8vYc;$EEwE^nt>goy6j7=E8EH#^( zo9E#wlqO5@oj1KOg2+DC`_R)Byu3va09Ran1FXC;dQ3_|g$c-niz?9Ip>v*uQHcH1 zFtUAkEsB8h$C_or0cJaZ#E|dU_KxGlE&D_I0dAQ=;6I|e+(tsXO-sMU0}Epwluzp}Ct&y9;FY~JOzJ!Jr98@1u#R|>le z6bC#`&y-Vt!(a)R(nMzHY{tmVVbbmQJOCGdZ)B(>Hfvj38{Wq4g^G%buvZ4moi0yC>#65KEOCHJqlLoa5~!Iu7p}N^bwn}}aI{z= z?zE%ptl4a4Kw<_BZnp?{0ue!hj*bqdj2 zXG4B|{#sl_rR-Uzlm?iKUQ<)kO602b_z6&6Kw^O Date: Fri, 22 Jul 2022 09:56:20 -0700 Subject: [PATCH 7/7] docs gen tool changed its output, so rerun codegen --- generated/1.17/README.adoc | 25 ++++++++++++++++++++++++- generated/1.18/README.adoc | 25 ++++++++++++++++++++++++- generated/1.19/README.adoc | 25 ++++++++++++++++++++++++- generated/1.20/README.adoc | 25 ++++++++++++++++++++++++- generated/1.21/README.adoc | 25 ++++++++++++++++++++++++- generated/1.22/README.adoc | 25 ++++++++++++++++++++++++- generated/1.23/README.adoc | 25 ++++++++++++++++++++++++- generated/1.24/README.adoc | 25 ++++++++++++++++++++++++- 8 files changed, 192 insertions(+), 8 deletions(-) diff --git a/generated/1.17/README.adoc b/generated/1.17/README.adoc index 9efe8a67..38e7d27a 100644 --- a/generated/1.17/README.adoc +++ b/generated/1.17/README.adoc @@ -614,7 +614,30 @@ WhoAmIRequest submits a request to echo back the current authenticated user. [cols="25a,75a", options="header"] |=== | Field | Description -| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#objectmeta-v1-meta[$$ObjectMeta$$]__ | +| *`name`* __string__ | Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +| *`generateName`* __string__ | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. + If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). + Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency +| *`namespace`* __string__ | Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. + Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces +| *`selfLink`* __string__ | SelfLink is a URL representing this object. Populated by the system. Read-only. + DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release. +| *`uid`* __UID__ | UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. + Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +| *`resourceVersion`* __string__ | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. + Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency +| *`generation`* __integer__ | A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +| *`creationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#time-v1-meta[$$Time$$]__ | CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#time-v1-meta[$$Time$$]__ | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. + Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionGracePeriodSeconds`* __integer__ | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +| *`labels`* __object (keys:string, values:string)__ | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels +| *`annotations`* __object (keys:string, values:string)__ | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +| *`ownerReferences`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#ownerreference-v1-meta[$$OwnerReference$$] array__ | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. +| *`finalizers`* __string array__ | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list. +| *`clusterName`* __string__ | The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request. +| *`managedFields`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#managedfieldsentry-v1-meta[$$ManagedFieldsEntry$$] array__ | ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object. | *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ | | *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-17-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ | |=== diff --git a/generated/1.18/README.adoc b/generated/1.18/README.adoc index f6ecc0f5..5761797e 100644 --- a/generated/1.18/README.adoc +++ b/generated/1.18/README.adoc @@ -614,7 +614,30 @@ WhoAmIRequest submits a request to echo back the current authenticated user. [cols="25a,75a", options="header"] |=== | Field | Description -| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#objectmeta-v1-meta[$$ObjectMeta$$]__ | +| *`name`* __string__ | Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +| *`generateName`* __string__ | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. + If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). + Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency +| *`namespace`* __string__ | Namespace defines the space within each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. + Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces +| *`selfLink`* __string__ | SelfLink is a URL representing this object. Populated by the system. Read-only. + DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release. +| *`uid`* __UID__ | UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. + Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +| *`resourceVersion`* __string__ | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. + Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency +| *`generation`* __integer__ | A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +| *`creationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#time-v1-meta[$$Time$$]__ | CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#time-v1-meta[$$Time$$]__ | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. + Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionGracePeriodSeconds`* __integer__ | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +| *`labels`* __object (keys:string, values:string)__ | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels +| *`annotations`* __object (keys:string, values:string)__ | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +| *`ownerReferences`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#ownerreference-v1-meta[$$OwnerReference$$] array__ | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. +| *`finalizers`* __string array__ | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list. +| *`clusterName`* __string__ | The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request. +| *`managedFields`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#managedfieldsentry-v1-meta[$$ManagedFieldsEntry$$] array__ | ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object. | *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ | | *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-18-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ | |=== diff --git a/generated/1.19/README.adoc b/generated/1.19/README.adoc index 197ed326..0fcfdb1e 100644 --- a/generated/1.19/README.adoc +++ b/generated/1.19/README.adoc @@ -614,7 +614,30 @@ WhoAmIRequest submits a request to echo back the current authenticated user. [cols="25a,75a", options="header"] |=== | Field | Description -| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#objectmeta-v1-meta[$$ObjectMeta$$]__ | +| *`name`* __string__ | Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +| *`generateName`* __string__ | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. + If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). + Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency +| *`namespace`* __string__ | Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. + Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces +| *`selfLink`* __string__ | SelfLink is a URL representing this object. Populated by the system. Read-only. + DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release. +| *`uid`* __UID__ | UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. + Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +| *`resourceVersion`* __string__ | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. + Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency +| *`generation`* __integer__ | A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +| *`creationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#time-v1-meta[$$Time$$]__ | CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#time-v1-meta[$$Time$$]__ | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. + Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionGracePeriodSeconds`* __integer__ | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +| *`labels`* __object (keys:string, values:string)__ | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels +| *`annotations`* __object (keys:string, values:string)__ | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +| *`ownerReferences`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#ownerreference-v1-meta[$$OwnerReference$$] array__ | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. +| *`finalizers`* __string array__ | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list. +| *`clusterName`* __string__ | The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request. +| *`managedFields`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#managedfieldsentry-v1-meta[$$ManagedFieldsEntry$$] array__ | ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object. | *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ | | *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-19-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ | |=== diff --git a/generated/1.20/README.adoc b/generated/1.20/README.adoc index 8ad43876..2371c62a 100644 --- a/generated/1.20/README.adoc +++ b/generated/1.20/README.adoc @@ -614,7 +614,30 @@ WhoAmIRequest submits a request to echo back the current authenticated user. [cols="25a,75a", options="header"] |=== | Field | Description -| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.2/#objectmeta-v1-meta[$$ObjectMeta$$]__ | +| *`name`* __string__ | Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +| *`generateName`* __string__ | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. + If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). + Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency +| *`namespace`* __string__ | Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. + Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces +| *`selfLink`* __string__ | SelfLink is a URL representing this object. Populated by the system. Read-only. + DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release. +| *`uid`* __UID__ | UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. + Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +| *`resourceVersion`* __string__ | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. + Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency +| *`generation`* __integer__ | A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +| *`creationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.2/#time-v1-meta[$$Time$$]__ | CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.2/#time-v1-meta[$$Time$$]__ | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. + Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionGracePeriodSeconds`* __integer__ | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +| *`labels`* __object (keys:string, values:string)__ | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels +| *`annotations`* __object (keys:string, values:string)__ | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +| *`ownerReferences`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.2/#ownerreference-v1-meta[$$OwnerReference$$] array__ | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. +| *`finalizers`* __string array__ | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list. +| *`clusterName`* __string__ | The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request. +| *`managedFields`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.2/#managedfieldsentry-v1-meta[$$ManagedFieldsEntry$$] array__ | ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object. | *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ | | *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-20-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ | |=== diff --git a/generated/1.21/README.adoc b/generated/1.21/README.adoc index 6abd6c4b..24640438 100644 --- a/generated/1.21/README.adoc +++ b/generated/1.21/README.adoc @@ -614,7 +614,30 @@ WhoAmIRequest submits a request to echo back the current authenticated user. [cols="25a,75a", options="header"] |=== | Field | Description -| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#objectmeta-v1-meta[$$ObjectMeta$$]__ | +| *`name`* __string__ | Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +| *`generateName`* __string__ | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. + If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). + Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency +| *`namespace`* __string__ | Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. + Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces +| *`selfLink`* __string__ | SelfLink is a URL representing this object. Populated by the system. Read-only. + DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release. +| *`uid`* __UID__ | UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. + Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +| *`resourceVersion`* __string__ | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. + Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency +| *`generation`* __integer__ | A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +| *`creationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#time-v1-meta[$$Time$$]__ | CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#time-v1-meta[$$Time$$]__ | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. + Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionGracePeriodSeconds`* __integer__ | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +| *`labels`* __object (keys:string, values:string)__ | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels +| *`annotations`* __object (keys:string, values:string)__ | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +| *`ownerReferences`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#ownerreference-v1-meta[$$OwnerReference$$] array__ | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. +| *`finalizers`* __string array__ | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list. +| *`clusterName`* __string__ | The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request. +| *`managedFields`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#managedfieldsentry-v1-meta[$$ManagedFieldsEntry$$] array__ | ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object. | *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ | | *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-21-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ | |=== diff --git a/generated/1.22/README.adoc b/generated/1.22/README.adoc index 46e9a2e5..2833aea7 100644 --- a/generated/1.22/README.adoc +++ b/generated/1.22/README.adoc @@ -614,7 +614,30 @@ WhoAmIRequest submits a request to echo back the current authenticated user. [cols="25a,75a", options="header"] |=== | Field | Description -| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#objectmeta-v1-meta[$$ObjectMeta$$]__ | +| *`name`* __string__ | Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +| *`generateName`* __string__ | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. + If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). + Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency +| *`namespace`* __string__ | Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. + Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces +| *`selfLink`* __string__ | SelfLink is a URL representing this object. Populated by the system. Read-only. + DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release. +| *`uid`* __UID__ | UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. + Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +| *`resourceVersion`* __string__ | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. + Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency +| *`generation`* __integer__ | A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +| *`creationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#time-v1-meta[$$Time$$]__ | CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#time-v1-meta[$$Time$$]__ | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. + Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionGracePeriodSeconds`* __integer__ | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +| *`labels`* __object (keys:string, values:string)__ | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels +| *`annotations`* __object (keys:string, values:string)__ | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +| *`ownerReferences`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#ownerreference-v1-meta[$$OwnerReference$$] array__ | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. +| *`finalizers`* __string array__ | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list. +| *`clusterName`* __string__ | The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request. +| *`managedFields`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#managedfieldsentry-v1-meta[$$ManagedFieldsEntry$$] array__ | ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object. | *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ | | *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-22-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ | |=== diff --git a/generated/1.23/README.adoc b/generated/1.23/README.adoc index 9d67cb25..f0e016c2 100644 --- a/generated/1.23/README.adoc +++ b/generated/1.23/README.adoc @@ -614,7 +614,30 @@ WhoAmIRequest submits a request to echo back the current authenticated user. [cols="25a,75a", options="header"] |=== | Field | Description -| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#objectmeta-v1-meta[$$ObjectMeta$$]__ | +| *`name`* __string__ | Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +| *`generateName`* __string__ | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. + If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). + Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency +| *`namespace`* __string__ | Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. + Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces +| *`selfLink`* __string__ | SelfLink is a URL representing this object. Populated by the system. Read-only. + DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release. +| *`uid`* __UID__ | UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. + Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +| *`resourceVersion`* __string__ | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. + Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency +| *`generation`* __integer__ | A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +| *`creationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#time-v1-meta[$$Time$$]__ | CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#time-v1-meta[$$Time$$]__ | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. + Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionGracePeriodSeconds`* __integer__ | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +| *`labels`* __object (keys:string, values:string)__ | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels +| *`annotations`* __object (keys:string, values:string)__ | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +| *`ownerReferences`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#ownerreference-v1-meta[$$OwnerReference$$] array__ | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. +| *`finalizers`* __string array__ | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list. +| *`clusterName`* __string__ | The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request. +| *`managedFields`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#managedfieldsentry-v1-meta[$$ManagedFieldsEntry$$] array__ | ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object. | *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ | | *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-23-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ | |=== diff --git a/generated/1.24/README.adoc b/generated/1.24/README.adoc index c59924cd..80c05b5f 100644 --- a/generated/1.24/README.adoc +++ b/generated/1.24/README.adoc @@ -614,7 +614,30 @@ WhoAmIRequest submits a request to echo back the current authenticated user. [cols="25a,75a", options="header"] |=== | Field | Description -| *`ObjectMeta`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta[$$ObjectMeta$$]__ | +| *`name`* __string__ | Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names +| *`generateName`* __string__ | GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. + If this field is specified and the generated name exists, the server will return a 409. + Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency +| *`namespace`* __string__ | Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. + Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces +| *`selfLink`* __string__ | Deprecated: selfLink is a legacy read-only field that is no longer populated by the system. +| *`uid`* __UID__ | UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. + Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids +| *`resourceVersion`* __string__ | An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. + Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency +| *`generation`* __integer__ | A sequence number representing a specific generation of the desired state. Populated by the system. Read-only. +| *`creationTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#time-v1-meta[$$Time$$]__ | CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionTimestamp`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#time-v1-meta[$$Time$$]__ | DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. + Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata +| *`deletionGracePeriodSeconds`* __integer__ | Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only. +| *`labels`* __object (keys:string, values:string)__ | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels +| *`annotations`* __object (keys:string, values:string)__ | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations +| *`ownerReferences`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#ownerreference-v1-meta[$$OwnerReference$$] array__ | List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller. +| *`finalizers`* __string array__ | Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list. +| *`clusterName`* __string__ | Deprecated: ClusterName is a legacy field that was always cleared by the system and never used; it will be removed completely in 1.25. + The name in the go struct is changed to help clients detect accidental use. +| *`managedFields`* __link:https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#managedfieldsentry-v1-meta[$$ManagedFieldsEntry$$] array__ | ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object. | *`Spec`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-concierge-identity-whoamirequestspec[$$WhoAmIRequestSpec$$]__ | | *`Status`* __xref:{anchor_prefix}-go-pinniped-dev-generated-1-24-apis-concierge-identity-whoamirequeststatus[$$WhoAmIRequestStatus$$]__ | |===