From 9e2331e60ae394b589baf6f0bbe9e3664725a538 Mon Sep 17 00:00:00 2001 From: WoShiZhangmingyu <2283260207@qq.com> Date: Tue, 29 Oct 2024 18:10:14 +0800 Subject: [PATCH 1/3] build iot system configuration isolation on nodepool(openyurtio#1597) --- .../crds/iot.openyurt.io_platformadmins.yaml | 101 +++++++ .../platformadmin-new-frame.png | Bin 0 -> 146594 bytes .../platformadmin-new.png | Bin 0 -> 29743 bytes .../platformadmin-old-frame.png | Bin 0 -> 145761 bytes .../platformadmin-old.png | Bin 0 -> 29531 bytes ...tem-configuration-isolation-on-nodepool.md | 166 ++++++++++++ pkg/apis/addtoscheme_iot_v1alpha1.go | 14 +- pkg/apis/addtoscheme_iot_v1alpha2.go | 14 +- pkg/apis/addtoscheme_iot_v1beta1.go | 26 ++ .../iot/v1alpha1/platformadmin_conversion.go | 246 +++++++++--------- .../iot/v1alpha2/platformadmin_conversion.go | 106 +++++++- pkg/apis/iot/v1alpha2/platformadmin_types.go | 2 +- pkg/apis/iot/v1beta1/condition_const.go | 32 +++ pkg/apis/iot/v1beta1/default.go | 24 ++ pkg/apis/iot/v1beta1/doc.go | 17 ++ pkg/apis/iot/v1beta1/groupversion_info.go | 44 ++++ .../iot/v1beta1/platformadmin_conversion.go | 20 ++ pkg/apis/iot/v1beta1/platformadmin_types.go | 138 ++++++++++ pkg/apis/iot/v1beta1/zz_generated.deepcopy.go | 162 ++++++++++++ .../controller/platformadmin/iotdock.go | 4 +- .../platform_admin_controller.go | 229 ++++++---------- .../platform_admin_controller_test.go | 182 +++++++++++++ .../platformadmin/utils/conditions.go | 14 +- .../platformadmin/utils/fieldindexer.go | 11 +- .../controller/platformadmin/utils/util.go | 27 ++ .../controller/platformadmin/utils/version.go | 4 +- .../v1alpha1/platformadmin_validation.go | 119 --------- .../platformadmin_default.go | 14 +- .../platformadmin_default_test.go | 56 +++- .../platformadmin_handler.go | 8 +- .../v1beta1/platformadmin_validation.go | 155 +++++++++++ .../platformadmin_validation_test.go | 159 +++++++---- pkg/yurtmanager/webhook/server.go | 9 +- test/e2e/cmd/init/converter.go | 1 + test/e2e/util/util.go | 4 +- test/e2e/yurt/iot.go | 16 +- 36 files changed, 1628 insertions(+), 496 deletions(-) create mode 100644 docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-new-frame.png create mode 100644 docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-new.png create mode 100644 docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-old-frame.png create mode 100644 docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-old.png create mode 100644 docs/proposals/20240819-build-iot-system-configuration-isolation-on-nodepool.md create mode 100644 pkg/apis/addtoscheme_iot_v1beta1.go create mode 100644 pkg/apis/iot/v1beta1/condition_const.go create mode 100644 pkg/apis/iot/v1beta1/default.go create mode 100644 pkg/apis/iot/v1beta1/doc.go create mode 100644 pkg/apis/iot/v1beta1/groupversion_info.go create mode 100644 pkg/apis/iot/v1beta1/platformadmin_conversion.go create mode 100644 pkg/apis/iot/v1beta1/platformadmin_types.go create mode 100644 pkg/apis/iot/v1beta1/zz_generated.deepcopy.go create mode 100644 pkg/yurtmanager/controller/platformadmin/platform_admin_controller_test.go create mode 100644 pkg/yurtmanager/controller/platformadmin/utils/util.go delete mode 100644 pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_validation.go rename pkg/yurtmanager/webhook/platformadmin/{v1alpha1 => v1beta1}/platformadmin_default.go (76%) rename pkg/yurtmanager/webhook/platformadmin/{v1alpha1 => v1beta1}/platformadmin_default_test.go (60%) rename pkg/yurtmanager/webhook/platformadmin/{v1alpha1 => v1beta1}/platformadmin_handler.go (91%) create mode 100644 pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_validation.go rename pkg/yurtmanager/webhook/platformadmin/{v1alpha1 => v1beta1}/platformadmin_validation_test.go (65%) diff --git a/charts/yurt-manager/crds/iot.openyurt.io_platformadmins.yaml b/charts/yurt-manager/crds/iot.openyurt.io_platformadmins.yaml index a0999d96f2d..f6ac78c7107 100644 --- a/charts/yurt-manager/crds/iot.openyurt.io_platformadmins.yaml +++ b/charts/yurt-manager/crds/iot.openyurt.io_platformadmins.yaml @@ -9287,6 +9287,107 @@ spec: type: integer type: object type: object + served: false + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The platformadmin ready status + jsonPath: .status.ready + name: READY + type: boolean + - description: The Ready Component. + jsonPath: .status.readyComponentNum + name: ReadyComponentNum + type: integer + - description: The Unready Component. + jsonPath: .status.unreadyComponentNum + name: UnreadyComponentNum + type: integer + name: v1beta1 + schema: + openAPIV3Schema: + description: PlatformAdmin is the Schema for the samples API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: PlatformAdminSpec defines the desired state of PlatformAdmin + properties: + components: + items: + description: Component defines the components of EdgeX + properties: + name: + type: string + required: + - name + type: object + type: array + imageRegistry: + type: string + nodepools: + items: + type: string + type: array + platform: + type: string + security: + type: boolean + version: + type: string + type: object + status: + description: PlatformAdminStatus defines the observed state of PlatformAdmin + properties: + conditions: + description: Current PlatformAdmin state + items: + description: PlatformAdminCondition describes current state of a + PlatformAdmin. + properties: + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of in place set condition. + type: string + type: object + type: array + initialized: + type: boolean + ready: + type: boolean + readyComponentNum: + format: int32 + type: integer + unreadyComponentNum: + format: int32 + type: integer + type: object + type: object served: true storage: true subresources: diff --git a/docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-new-frame.png b/docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-new-frame.png new file mode 100644 index 0000000000000000000000000000000000000000..e8f1b236782d41dbe80e614428ffe4e4f2e3d418 GIT binary patch literal 146594 zcmeEuhg*}&)~}*&3l^+w3koV?qooicpd^HlLJ~+wl_DX9bVx`=KKi$D2jz5f)u5BU-mxddA@tj;oSQNd@Ar}n0L+0npJ+Y)*6qw5nUF{TQzUm zv}p^l7!-Nhv_JZ$O`Fj*=MSL8xB1Fe;Ky_Y*#$Z6M%9|H)21!94svD$Ni;lxm^;lB z?DY4ODaguSrU)_xqf9{{wOVZl%$GalnXa5V)v0ncKAhztC1;rfYWldm}W z%ViRv1#JzowE#%}H73QE=PMWdPZG`?{{P))a&6ooU;f|g!l+#o?#Mt_gi7t^=BuW< z!<7MluSdm|D+Ds>-`%Xi7GMitMw2fGX#==_w{o~DfgdmhkSW+1U@S-A%a{8C?6VU5 zgKGqVI~MAuq%r(_m`*~el1E0!|0W{!1?K)2?@gUyrU<9We*lYsFH>i@DZ<(m3H_Tc zj0R?N0tpbb%F5RbE_3zc`f0@M04tp}nMk9Wf{+rfJdn#$h+TpL#e68zSL+PtF@&}# z0Zu|;YY2RI2++yh-`$-LupVh8l(Jo{IW9;kI1u>AaYN#57z~(`n>xTn2{icG3W5G; zYpgZI*%jfY^avp7KzJ5g3L_KfI5#9TK;Y_+oS60M00 z7Z;gYNc4505}jpuUSN<^Lc;5~9Cs^5AdamjV2S>2JUTD}e{${&;LDoK;6UV7U~4Be z-Gv243ITaSt27J(K}7%ySUh(PAWTRxj^u{Yy7HwiL^n9kMkVEH+$9hfIs}FXy2H36 zBp_#K3BsAo_P`;z7>E=Mhw#8UIMAx(@%&&ym@O7~4uS%FMGF}qHxvlT)%kN>TvR$V z&_tKZU9nC`h%@jklHuLy1R;jwriC~O{B?9c9G%OP5Ya490AA@Xh1dk}-GP2kF@gnf zf$L9lhNFaN97X3Qp{ej}s8-8Sa7a8TLgr^ha|PrEE#r!@=d>9h#k9U<){c#uw z(#;8P<$)7Q82&7cwGxGfuu&{Oo|}daLbBv80&5T*<)UD_Iq^hjdLUVBZOzxIVEzg~ zCD6`D5*zK|;l#6nkytte1t9LmrUofBAelRlCBV1@F#SB#YKF@AtfNvL8ul@G?@nAT#lljORqzJrFIyoD6 z7Y@S@5r_;D*pm2u94ee_Epr>5rOh7mbRScf3#!0RQ2H+vx;S{lxSl}B(Z~;L`@}NK- zAWcXr8Oi4>*tS}602A&`Qh}saY6%fS(jf&<2#Bc-6uWDb6s0x@4221gBxKhiL zh(%ggB@&|x;_H-38J-Pe1=8tiD=QI_OD1XnzPf028kG*@$3##`DmsCrwNZfGIAkr3 z#6)PhP_0Vnfpo`_z$y)d?G6|pG{XkLLCc{^9Rkg!0^L0ua~( zZLI*&ZOF(VD%KAwQYlqpCpMew28HrbRv3-KjltDWf?!TW0vAI>Owz^rsbPLDK^&^U zMq>@8X=O6DhZR2vrINcigKQ{ju?S9|)NVRoKtrjJT#1v6@x zQbjPS5&?Ij1`3HDB&*4}A^jwHUxCO;C80nSI7>p)exSx(3U}kUaUozj)j5C$OaosqsYXEj&Al93P~5Lrk8_7}sG@o@|;7A=&ZATlbS1~5U(Bd{Pk zDj4Ey?P3FgD;R1u7)^60=*R@A67ZL3SELYNwtz+DsHDJ0i9g_Tk!~D+s!+_5OEr@Y zPD%@uJ9C|h5*s96q;iInurv{$D{vPgP#P&B2uZfl5UB3{0SYRYhGe<2MPe`v<<61Q z6~X|Tt%fAAL7+e=Tcv7JSOO-UfB>M0B+}?s99yO>ia?-ACpXSl!Pm+H{X_~ZnBy$d zk$D`XXz~qP8$YU5fQTYS1i2DX9%L~?frax`{&D~gpfx&oH`_oLp$GVM%sjGt+6t>beK;>-X#_{#VQE8I~mqGFqOJN8R*8^w6 zQUV|bO;n@(iF6Sc0TL<~4U5Zna&v=|#4=k9 z&XsPZ1^Y_`Tpk+1X8IvzAZMl@nvCYt)oPeC(}{*7AT%~XN-76|atc7esZ3iL-zCTf z?Jjo@#KYZ#}}x6uA{j=;%AZR^StDxfr$&?AV8QQN}kPC@>B7+nEY(E#N@yAlLY z8ApheVJ68kU3f4$G!O6V1P{;xQVk#x zq=>`Ax!8cXXj>5mruCI`5p1%*E7%t&!h3iyb(1JYucId_iC##a(CXqCf`( zFoPrv987?-g}BJ%3SYU(RYsAsSV)y`fK(Dd5)wsjQZ6UZ%G#R3hKW@&nk!vpD+H0C z3XH%Bq<|=;lgxl=$!wLcEkh;&+q$?Sb$)6bpz;zAGK9eiu*MQ4u7Px4Ke3#Tdx_hwYldEzS(=bpi9Uj1?>Zoii)K|my1H=9O)I1i^I=~GMrCTxN3^34> zfT0n=0ytQSWVn+l{w`<&M2uppdxd)Hr ztAI!~coiRQWdo&9$r1^K&p<(#bds}^Sfq2C+`UOpTYO0gXXsxLYH!9&)a~6$W?}L&d-eJh2?Yw*q#}ij0w3v(XX{h7*8{(SX21!4w!t zhE-Tuar`J0B8>>)V}lSZClD4vg!1_=BAAdy(I^#sUw3OJmIUQ1&>}8W%mcYN1+pZQ zzL1LKYg_ICV1+0O%r^)P0|l_~lMPmrsL_?nv2k+2_(IqqwYAjO6$iAr2kFoBv*_a#Ua=*)Li#T4k~S!NO6V zhGT4OL;@o4YXKPv5%Znc1Qp6p#3ErRt|C|3q-NqsG$xuYB>Cfz9{#`_7z{R>uf;m6 ze8DnzloOigiepo3fg@L-(49pmNa21kB)iEZw ziv*gqnp3} z@Nm=mbHo&!%GQZW;CV=3fPq%a7%~oLQk8re1T55=>COpMgRv4g4eBBdRA{w0HPJ($ z;EP?Xl~QXJTFL}0pp%A25WqZrU{CX;>7(L*w1uGJEeb z<;3qklJTrL;Rlx(51iV!-^+kBH}yK>rpcTyZO0Ris5`G-H+EUvoTl#oLEQd%i}4k{ zLj`kM^u+O&{aX9=&t4STmoJq{TSv!3De1tU zgEOYjG;o|Y#kYX7j@rOmYu@Bj7Jh59oL%w!qnozKBRa}xqW8GGCu1U{twA2q8x@7+ z{(9dv_(PbIitjlwKP{{58sGnSR#y694s%zGd0J50pYPPisrhuani%a+(Sp#_|cP(`u6i53emd z!vL6a4Cd(=4J??cs^4vTHOh=YJT)B;PdBbH3=(mJN8dKxJEDK z5)9kdujdnx8vQ6wkzAj(VKDX+jwS^^6UT15SX6YbF)yu-NGepoKQrd6$=n=MlPDpx zJT?YL6g+R0IOoWApY`Z2gawl-U)S!x1B{*8Y)#JA>c=hh*k@pgn0<=3VM_TjxZzlT z??6sS-}=VBT6W_t&Dny}UN@a8lSOA@QV*%NW>W5Xp&uN+XYt|l!nx;rTFp(JcjpI? z4(Uo@k{Vv$EIZKd{OC=0bodV+bOImBl7NdfdqM^}tLOHW?#LO?pHe8MAJ{jq)5AaY zkUGNf*t~u{Bc|3o#kYc1bA^f*yh)GZaG-Z1F9 zmgeN?E^~rz-NM1nLSawN+E;6mrkSiAp7Ed6eo}|lE`O8D%NH|$rijONSG$`_8)cTF zdSVpXXb0v%w0R1`8!vcS9Cf`naAWk{s|TXU@{KQ>DU8i_4VjAv9l~6A5%$j_|0h7AB`jR$i|UDIyoma{`a(0!Hti3GC&33 zJ$4uz4%csNiX~;Fr*j&bpsWjpq8`?k7TU+c&rC@(?nmv2@akIdz}vtB2JJ@o2}0^_xvfS zNx^S+R!Eo35$`VZEHJk`(=)65=~Y}87j|hF?!{X8GYj&y-fk}HZM`$nUVU5`Q3az3Cf69OHJ1cM1_uXkx(TDx#&z#f8-sigfKYD?`+yiQ>TaNFY6>pbUjWV__ zT65jqGihP`#=>Bjpl0w-Y~|CVc{^^9$l=d(K#gT%hFe%PV?YwpubyG0p0WXF*YC?s z3GK4MrZ2lBUE2QW@kQ3uUT+TmN)Y90X7H$aqit`}s)hz4KJwEYohU3P7OJ1I*8+L> zvg5PYSvlOk^*z=1jvrr@nr56m{^&r8cZ9t`lCk4a!&x53QB!k_96sKBoYS*g_B?xC zsZY}8{W{KxXItiT4YaZ@_{fqKYc>yuEf%9 zOuTCrz>UyT4G@rfH$2{s+tMt1KBE3jNxDebp*~x>lyn}@oZ=$=yvhf90B54__m)K( zWzb%K;g;xIoGUQ&-mY8)?Z4^RU5q|zXeSaPr=mZ(g)G8+me60%t&mTw&=Cv(a-k~DflTT{mt+V^?Srv|64F%GraO27dU)? z)l8gdyInpb&tSTKxbkwy*3Q#?Ple6I;x;Q>PRU~25qYga`=P`~MN<-;V{7bY8?jNA|3M+)Ucr1ukCTJjlqFx*1O9NepwIL4 zzHPH`h0C$`nq~NBuakm1IuhjRYl6EZ=UCYZ+nT$h(Tm%QxEuXvPc`d({8`WOxR0Y- zmU63O>&te2QuSK2Slq@4Q?BU>+Jfd!Hx0O+Lyj&VUDsF~l(r}tapaV|{r22*2~o4o zt(%UtmoAvf=ue-SxH;f@BC_lf$X#V_w`xzG-3M6WM1b)bSG}&CqaJnZ#-Dy|bt0~U zA%rO@rb`d>lr3p*yw;AInjq5fXJ{vJ40Q<4@O`sq7K{x} zkZnddwF^NkRhQ1zecEd{r!Nkc@?Qu-!kte$Y~5WxQj_{h`>tqmyIvxU(`MO({EpB3 z`L2BD0bc50RIBo7+bkUwFFE%>Ruy}GeW=+k!H7kCOl-(kivWsZKq*F#6 zx3?XEd(L=d@@_%+hIjC5EA*gik9NK#1(I=8Af!Dr$PI^(J!xdv9 z7aV}VSjUWJkI`6{b+JwQ6iG@d@|MDTm%PX3iV`>!7letA^A zjsAS_gW1#Yeh~ax$ZW0dzUGE5Zx1ufZn}xkUl+zG za6LTVp8iKdE4`DGTyg)=u4m<~d-1VQ>Go=3oN-H2;i8NQ%^}ULoBH}2j~gxz9nQ)e z`#vMxOl1q?Kzh{0MzQQcTgLJ{z^EvK15dTRMUAo40|^{eXCaf zx}yJE>gDI}#`bDIUbcLiaeCJ#v*GT=uiiP^9c?O=TzdQS^Rb)~PPR?(O_$VD^-U!~ z^}-@;4M)(Le9Khs2gToG3fsDg8h?DhlqV-55H%TK@U+$7jLcUICB8A0ZO>^OcK;Q7ZEv>C62V<`1m< z_V&*18%6540`aFiuvX*FQtWR{le#C+tN7`QBWurF^fU?ED7jw}LOZBhzgBz6WqAIP zmZ$obXWkpmKlh^e9^W#(E4xS*mnVGfI$@*A2+f8eADkuB=)OVTc)~J=gwJv2|IS=Wr zgE8J)Pp+c*MAz-T(K%Xg=(Tx+MX6&ak25oml3Q2y>lfd=bj<%fGVOZi`H9rH^@R(K zw({dN`|EZrDNYa3dotExEqIlewx+o#*Jed94&O0x$>rHi#AlafRZVxY@55!ar*}O) zKHOGoQE8V^KI!$|FZ*y&G^fuVd_HLAl**K#*GBx)%r3^fKK7;PO~A9cigg8yAw;Er z@SYKH|Ev4id#|?G{T}tOC?8*_^?lA+shZH%$NIq@Zex_tc8-4wF6y~=1lW#x|DuadlS zDwTzLuV0YcSwWzCS}b24CHHKwsL7?Io+)K(`)}lnxP9GBR@BMj;WLqD#ADpS8yOJ> z)k-Jifho0aiTk^-!nd1e7swi7L!Va`V(y?%dbKSGL0^i^f(|Y!#G-Y@Hh5yCTy!ZW zbr$RK#Xvxk>H{-6AobhxcI_NHx-65q?Jom$YG%CfaN`jli}Q>9o;*LeTY7f)kp=Zb z%Lmk7DmbiJC&OP3zLbBm>wW$sa+5H(Vc^4){dz@1WqopKc`dg+tGssm{zIDd7E)!x zhOl1^5zy#C58saZ;kRanalcke1U0NJTbf!AkV+v*O-1P^3|lpnO%4t%g@#w7T5{?| zAJa>|MT1E@v8%U*cs_q#(Gkv1h=TY2rt@}<+>Cp3r^NChB|LNK=<3Iv=+;8Tk-a|# zcI9<;LImsi6CWBG)Sl)((pXdz*WiM=aF zQcE~hK5Nh3`}K>Jzx7M(&*8AAc-ik%^t5Gyqr(p@%b%u%-S)Z^sCvMSp>^@FUw8g` z;I!yiQ&R8cNHZ+)Kxc*9D$+vOLrR6nJES+H{}OO$nOk0x(v)*fSH6puyJTJLR-@g8 z3s<%GY_^CNJ!!F&uplumzk^Z>)?5qy(h)LPOX_c*K}jZ}4|~EULIoEu?f&4IpZuja zl^Au_(9?K>W${bUH0tzs;OvRr`kfwMg!ZA{MdZULi+1mhrc}Dt@!PW+Z@YWPjyS%& zc=A?p+x~ir^2?dA-m7U%f~^l7K1Vei@M`~hd1*UPaPW1_RAALHbLJAsri9pg%HFnw zW%(ZywZH8`E|=QfC_+E>4vUx3Jd;gYGuDM}-teS#+qzxDCkE`Ueo6>WAA^0a%q|E^ zsQ>x3~qJ0|5c|c3o~58rHX2N;)Ll@VIq@*DhkW=0>FM*qE^{Y%2Yn~{)I z8Zvv~%(q}GTKQ^Km+vNT*4%ep-7`CTHz5vfWkPl7R#V3_^jvUnVm99=( zJ(Z=r3)b7UYcN?n!U=zU+2V7&rS?ffoZ!>7s)?@3!jGS@ksZ<7j$kTyl|qQ*YkECs z^v-a)dHz?+hqc46?7BWihUC7;98&6YH+f$%kg2i93Lq)-41fQ_#UxYlL8n66vums} z%HHmjAIvo0ejZU?LXC?(R=Bri$I8$KM$t%n#K(g7^jT}XLtcAt=eMW*VM;z)`1Q#; z&ZE&@!6_|&Fvd@Ir;<<(vX<$ac)xg-W-#SiBJ?tR;R%kdJ_fm|j$N3Bi3ke+@OSYWNbI;|2XPw$CJ? z%&gU@!P9HQz&tL=K7aU1(}r)yVt7x>*IwAZ)jn^Bhr#us<0aoS!Q9Su(#R}3m49%1 zd`)huYmp=`IW^^%g+3qHv(oOGf~<}NP2@yh-lUN`{Z?C2mrbwkozOO`d(K^&u*VYN z-xx(dVlz5QOz|lIu8SzkOcf?~_I|J|+nD{kXD94A4#z#9&FWR-fZK4$A9s1GtYwN88fVb)baRJBK`Qh}lXAZ&s z4IXRlH;2VrQyx3O3E#>)KCLoI2>fk#$91{b!7gxrkf_ajo6{lry3isw^a-PFAJ8Xj z^mcOp{K6;~M2?jQen`pbzhWQqTl4i*nqPh`Z29tM>(=TRD=dAk_F&cQ;ctoii)UZk zwE^6wr6*j5xL4WseGxxfr$6sw)9B-heYM1Tz48+S16P9E)B4wrHbnFf!xi~lm(k1e zoa~l13+DOy&rqD?%gSw4HHB8FstqeZ{dw&$KpvTthDjj{1# z)FdF_W=e3F^4yeQ_|J3L>*}h{^Up_{F{=$C%nt61kUSsw+W*`y>?{C=+6&<$=PoU3 z3oKcYndMoIXl@`Fm6r>zLn;LudqajUUgw%pzoe}&CCb|9 zJ08K`TWoz3J*YE+&D7f0I`aR%zrt+WZ}>^ZZTB zJcC1Ay9z0d(LK%i;~&YQ)aUw?O@ez-<$hl8H?7oG-(mf{#*0mJ_!6DTN-_8QHMD=$ zx!NmNJ(Uw$`G<~}iUZXSX4;~nG6PcOONz<64ZrsyR6UL6y%XbG;2m%L^3&@;3AMaC z+k3+%imvZ*tvp)N9;e{^oONI?_(k`Cb9}C1SZe-O7ktmGzoo`BF}kC>B`d=d5WNi+ ze{RgW1j}}>t7-}U_^ZJureWs@X2tUD4OQjc-MJl2_YCooackOssgU-{oLFDmu6Q-~ zaaikO=!|Sa#0rpYdHIU;d{7VUdR55#lQ1p-hy0b7-{z(Qu=Eh9{l0#(6n&UhxXW(& z-Oz~#r~3!CWj_T@ysxUL_dXM1d~U3Ky#tg4TI^K1&RgR>ByP(bKAz z;BeZYI@byRWJ<8dHg_uuD}Pb0O7<|azfNrlyemrqBAAbgSJoYIM9v)pV*fe1)+ek> z6k$X3^xv^t^1JG=*LR|lZXMLTa!YZYatD)_Gsb)AocgzoWfPb8)^2_#u7L;~zS!!8 z&%_nVB4wB1_Q6!6_#10B8CkB=i=79_7%568h#w z+sc}6F#i2R)AarTqLUM(*C7)Zd+kzP6Sl%zPTl)*6iCh#>P>}jrs=sGFyO(_ncDHT zvU7Hy7M*#WI(Q68Sa!^@9pGL)lIakZkp14s;*RHzMXM7uM#tC@bNdpH;$KZ^ZJwFm z{Bp~M+eP;oG1#%lp3X|pkmX4)N0SXVk4@Myf87fUSy)Nz+IFXRP2_+DZyFFonmg4t zOh)v+kJmlR8Go{FFEps+-FiXj+d%isvx$oXvhPM;4n4PD-8uxl`K-_E>9OHcYT1Dg zZ$QXW+ja_csuk}Wp0$wb@l;LO^!x@F9}+K7KbE1!-#Z##ocTIzC@pimo8l9rm^^Ph zCY)gj1kWDsDak&lDM+(jJe8-P7XE$a{|ssB#SVTk@lvNuZRax# zFb3gHK=!x0B#~RO*IfGYYEqo7bbm6RYl^XCx49xq-&~?>m}>HlOXhieYc`w2NXtTg z4OFCM;6vhWbS{8WG4P&cPInPMnKNE2G%NgP!1w4s z0=^&4))&ODQ9K}=tL?df>L$N!ay@DY(`}tH<>Khb>4=NrR*JG|iyUHMF*f5P*jkGg zW2CXk%z~`VXBJ!z^Op45)qh_Y<7E9$Bw+W3xqWYK*5}QhN8mkGP7RTIaUhoM=&V9%ZhSUr#Ju(4bwi{`gdR1pe1$$SG-XIr!+LkODn4gom+V=wy7k7Z>P_(_ znAT%vxTJ+f4id-DZ@1l4R0_9@eY0!4CFGt&7Z?Ry%`5T0StqD_ddCQJC3B~K@ zJf_m|$yBY6$3{_GC?$0K-T12bDj+NrJG|37c3lHrn3`g`Xr9B#h`aZW&uh#9Qfc0K zn4uMttXGF$&!~geZ-SCcnPIodPh$wY?@kU*XHIc$6I>luDmy2HBxw zRb895k<75sR$N}GINftERun;*^9xJ>%w0v9g^>>Em zrFI@nL1WyCkWs8Rkd&y&P?ui16g0TB-L&OQt?yJ~Fg<%NkVW4JP~Wnp^^JxIf!Uq}YwK>0_GsApAU5%1)(?A;rpxE;}SNOv7GcJS-A z%F%%+KqdlDMou&Fj(eB(Uut9g=XAIH%vctZ?^dvPFy(xvPjBIIz>)%LbH}m{kHsEC zD>j2q=~1cFvX|0^rhIa7)>D}XD8h;4r6z0woY;oJ-G#^eGSXOv#t%PuPwoBhCg};Q z?V(OU=>|}5@~elN)s)7%&~Swdlw0IPaq@**I)m37GY$B%C#CzBGO4@KV{`C4{rr{c z&ftktI&&5#mon-P{WAqw>*n7v+GQTy6S3mismm*{K#pU&drtqt*}4U+ z{PTyifSO6#3gV`X;VJ zA{-4Qd%n${a`$GQb9J1hX*SHTlHD505BiXenAOSQ;~$jTr!_$6AcewoTj50xMEvK# z4q^cMig;KG1i!YXIR8~Z)7_Ydty`-qIvv)27x z!oy+|76Qd$Eh^i*j5lF-X$@V4f^Cgn#W)pxF!d6r;AyVX$gGG2#nB8$ z?pJT0E2&6_!Owe`7kg|{_*`sD96FKLTVL_)RoQE5n0ytMbw^iF(bst_YINvXnU`Ju z#UP-H>D-LYjG;EWl+xsfszMQ;vu0uUz%H*6oRAmN+@MG-nFSk8M zXCK+RErmQ9d}v5L9(?4~SY}h(wuP62Z}xxr)j4uJWHhBTDBGjE*)XsiC}Ufae>$GE z0-TYx_Dz1|j+2*Ao;I^KMgx|CebO-Nzs!12Z?sSvRg-neIfNQEBx#X&L- z7&C*?^*T~lc?o}qSD7Ns56^yg@Sg&hzN0p;YHI@s;*{0ONj<8eM?(8N*;-@tdGrZj;ja5)7{z zA7R1sYid(8z21VR#6!u~_!yv&t|$0$c7CmSS!xyDZm)Ox``9LB*9fv?<2sw--Ye5g z5)NEg2Ansh^iJQFVX)Y@_%D4gOfJmq ze;4+@JNCb#_`f;^n5zFZ9@F%y=H-bSYZ~=FxHVlPT-s=9Ny_*YE4p!Z_PV`pz`cj| zmrK%7cM|}wil^OjTU{n(C^8q{;#Q* zi_c!NF}X6=pgnK{YU54Lvn9-%d%~}0KmJa%%;Q%lBu)%`dF3?ve9FAW8I7LzoW9Ju z`V*yTl+;bF`(Cyu8vtJIxbG>V*^|@jfXZXlqUG%;*E+D+4tAtN5hLrUg%eMtCGbU4 zI6I7Ly5CVcgK^>Jn#ZBnQy}#_wKKJI?cx$-wk8RmkG%P{F#R2ImgYT>=dY-)UNkJ< z-B5XXmrt~XSEu^$m3jRh*EJnc^vCuddG*tYQ9M(w2IleD}5q za>-H1-P&ytv@@x^w}eYJ=E*DfZ*|-FLjSAHJI;T`;~3C%%fp%nhZjV~_=GZ7WA~SC zEV;Tgx#XZ`F33&le{J4V^vP8n49X@_Lid-QTE*w8D7fO&!TOz0Fe%^cH9q8UJ;P$E zIkLCEdt{J(<%;7bVjSj-;fLU3o!$Bd?Tv-F5ioUM>VEswg=Po9&{3lK)sc6IOglO{q`;Lir+b(y$4TU*I|kjAt#oRU7=CseE@5);g!i=fjiJ zF{b$FgL~s!^zSb)?1`?{&N;Zv&C_#xZ~5=Cz5UP3-mkc){5LRY5Pp}*k2n1suTJ0q zw+`Lr#jFSJt2|rPp60&(DLyl}9-n3U@JEe5`l{utxE`KZdcA^PobToSr`~bYmDsy{ zpj0Hgw0|D>+ilB#MY%_F_r+d?ah@8$Kb!!!zg?2gBO^S}4jMOZj zJ}WW*b6io)t0WhEXlPl_E4R^iX$8)sdu+V(4sF@BEWE)xn6Pu~`vYN2(3h8pQ+D5M zzrMMZ1d%j(fIuMRmUD`K+jQfjj!fo7adQEImhEl6YkVLwlbL(1Y5C_k#VJo!BiD94 zklGADmfpXA|De)(s4zVpM<$amoQ=7ebn*5AvxoS%w<53=Nq5#Iw9Z}rF3q^QYHpWfO;_xTiHR{g@W+C4-&#tZlnCnn6|g#z=WgF!;My88?A4ejh|F%A zsl_VwH%j=C4i70aNM~a53d7#+AOca&k%!mcoHX&yY)U@;^5e6}6u^WXv)+?e6R9Vh zTX_-89~n{AV9lO=fB(Rtk-pz)VBzVm;G?OJ&l^`qs0&I)fe_rczGJ~%Z*7*! zCdPgxHZALN>WN4ldIA*oN9(1eq{yEbseh)I_B~$RIKwh}hNIWNs=ylqx8RQsquse> z;B{eRfzMvN$O|-0HU8_?){!R>#+J9fHKSzaCf79-brZUhcYiT48hDD3>b z9WSpsbv)meJs)R~;r8mS0Tl06x#Hs_&xYH=%Ec|k)QtWryWaD(EY_nOUFW}B{7ZVP zVbb$Y)&{%Ul`wO8AVJN>OLX}vyHP&XS$iw=u0kP5QEos$clZ1Ic5|tl6eLCKxsH(c>YHx>& z`>=ev-@b{5OG%oP-2?x21(P)IZRluES!iQOLkD)wjt*uxP}zCt(4o0qyr8u7^mFIW zFEe?HfAc=b>%rVUPuRw9qL*)r6x^yfxVz{=OA3TKqkVaMWBe9>{jbl=oL`7GWN?@C z-gepuuB9!W8&Z?QT~FF&PNr?DNjmaWQs`W6cR9==M-ch+jLDI%rUJspvo5Hi?!|$( z98A0iWDA7<8lk+qWjg(cCM9M4>0K5%fk~JHf2>!xnAYS8zIZJfB0d^hh_1g(Ln3BqM}R((;5szyo_Y@`f+$3Jdjo zy)5j*Nm#eds}cJTzpu>Ry5%itqx0(>z21`fM8MeYAGmOF67QHm6urgyIjW)UTP%K> z9?Y;^9{y!6M{S30TD00?usQ#UZs{_xmLtx4n_B|AhY-0VzF!Ht|^RJTsiycp9Ap*mVZ38 z&P0aj?QP5}2X$E-{^Y?WIffuhN5AX>ZL3~u$o~tnY&<&2OOPA(jcdZ4Qim@GH7>L( z@{t2|2Q@c-Jp%R`sPW33)99cp-wkeOR>tMcqgRIf>XDuPHk{gd zJfPeGS-Ph@{@4%2;Fj;sk()g9zcSP3uh_P{TTnE`}b=F-s^PM(CKIhV5vdS6BBnps5Ku!`Ihey;37+ zy{9r;eVK>iK3xpGWMkCQTm5{as!*993kc!+N^su*z{vKXBwZ#8X@7cwe_lxv@BSqC zZa07l{9wqB9FtJAsGuryUH2nB+fU+0w|GM(o z*>5qPTbY%+QRQr*BM>@!7G0UseX@c3`-WE&@SkF(`t`0n@(+hS*Ya*I{r;k>W_EXT zW6X}^qf?jceE0+A`dGc1cu4bDp4qv8#^+r-T5ks{0Y(iV=DYmfQ!vu|WSwE-?OVKU z2M%e%o7fZY)K`Yxb(N2Yg91mQ)&pi^cv6_=0zAmoT?cruXaO&?c!}VQpAGaYqYfmj}B+em_6;Mxq`UtX!9P;%d~bH6MO`Ix^qk<`3A6S5=40 zKh1{UX?fhcdXz0bU~M%}7g)o@NdH93 zyJH5HZ%P(~^?K+@1nj}kiq4RWy?VNNs5(^mG8W7Cr+_S@Rcxq493)vzwUOlD>^e;|N62)08+_fb$2 zYfHNiY95oeHqN~_HfTC2H4NtX_Lt8t;qh)o7I4AuuXRvJ^$S# zL94n@U$P(-X`iwC-k*sp+h!kH-3}~MbEWxZ+i08{(mrh5ZE$4tVtGLIg3;-#N&(@Q zB{%}ozwHIMzgX3?s-{FK``v}@)tfwuhoLrJ;XN|Yu9z`E2cXiWNM^;E^gYh z!YXuqDY5pNyx(VH-jcr&>)dUV3b4?t1`@}&lr2);Kcbl!iuh5uKhk>!GV1NjSNSBh*-K8L)bPg)gDcxbw5(-ESAi~fn-6$X^F+(HWGc*h^#K6FR z51ezJ_j#}D`QnFjJZJWA@3q&u*S+qww(mCC>_|nD^o~C+r@$4&j@F6Gryh52D{u~c28CuKsH>>Wr z6nH-Qx%)Lju(fQP5iRRGL^f*(x{}Bd*r^9~jL_O-2E^Ej1ZmVH*{qU6Jij?p24M?8 zUWaJ}w;wUz#m6Dp3|6Xc)XoY!|I6RKIU#pusU;jR3@`l7xfq99p~$t6F`6fDKa+Rb z@RRe#nNb&CW7r%KYVntmTA6(Hv?3WddFZlMjUHS!*hHYRH8&tn3x*9)_+Aqw2~Sms zV{z_DrSGD}cwlEYL5Vg>3f*@#>7eILU$&`n-7gitNw8Sz?Zo!^nqkOZyt_xb^w#Xa z{l47i3R8QOK$VCqshf227cue3lf=R#vWu}YZ-k@s5Yn(T>Tp>1mx8q2KLht0o6^y< zh0fvAcg}JL6Gm|2o6o053Tk5ysNu_Eyw$eWR-3C7$@)xbpj!z53qPmqOO_5}bfy*@ zao|3Mv~~-e?A&OS_@2rpfNov-hFCkfjG-K-FIT~ou#&_6RSwg8Ei2Iy)l`NGf&kkW@>5c7z;yeXU<%$TbNBK3i0Hf9bP4TTR{tFQZViIPk$M|mu%yj zEPS1$^4rWcsx78JSCl$VA*J&h5Fvl61Y4D4DPy-2&--6PGw~GoB*o0(K z-_@n&5Thg4Hmi#3dK0A3@&~%=qpn#vrbp?lIYC91-bBO+OtiP8K4ZuJ)-flq!I~c4 z5t?^7KqtPwgL~qidbHzKR71~u#F5Xd6UpXt;@IT#)#6(&Wb>Yxl;|}}2T!(4Z=_kd zJQ(Tf9eZoZ>HP5NOo(cwAghvT=AUK5&zW&ao%P{wwdr+81aC_E5;bX(W3I~AKaiK4 zt7D(@O?S4MrIulFyuP?Y(+R&c$!w^hJ!rlffi{h6a`601u1QQnLXOdI8trO%{hDwL z_e>e;kpERWmXtRyq{$M6LZtI@+!EMufXUYbIz)nQKJVKT?l2ok9aG%l-i`aBZXCZO zRD)oiJbxjM%aZ2jvX33vkG4fz5zCXpA?80jM4$D-mf+q8c_>^m_#mmZj(itYvzmDCw`kj$40Wbdn53^ z1Y`_ca-4J6DaOZr*}4*hif87}F^`;FlWKAJE`_DTcD$^XYHRDOuw&;P*e28cyF$gM z;}M**fH^Zs`qDNEtV#MBPPAaRvy9@TjntC2R~Om>rBZFQwL-k~Ha_p{ndp^`y>1}c z+6#6CChfX8Sh3Q(Cw2T@C$K7u?N(O`mDe<`foglNxMPY#U9aNy;qw6cUymiN0vOE= zR7FA1LjuyuIpbzIhkX47T2WX^QFEP5e-06sUU#cDW1_aeRw1FJ>v*Jl6n)66u!;1E6 zjL=bmp4ChlziudZsasyCn6-d!?xpX-rr2NGs~Y3OlD=Y@i*Wup@zydQ z_UsU&L=L&(*gZl`=)UR8=%c ztkc!1){*3e<(7*AgwQUv6cctmF^gxCr!G+*16FVY@#1@yUU zKtMnbTYjnTZEDpRScfhF-6cXt@@JZoRZ$PU*1~opzCJ7a)m5Yy{I_$X5k)e)lTOo_ zXAJugdC+M-8Xd`)=yPQ!B!q6aJA;IB_JE|K>v;lS=uyB3{{axJ`(yGM)QJ2j7Mpr2HtmA6270XI;RQ z6b4I_k3sD|{a|(o>f%=Pd&#;z7FVyx+r-cnj-;`|I`qos2k3m4?L>)Kx@^=q`o?~R%q|k>n+mDz{eFIR(WuJ0_?;IL zCkNd4(K~zO$eXsN0^~S)F>7o8Gv8=jaz31BDxiSd;+FMLCS3=v{KdN=X8)SUQmu6$ zHVssBub@s%g?{$}yDCjFo_BKH!XuSK<(++g*OS-soc9`NeQ>b}sQqV87zhKvH`l+i zQ#@4Cy4PuQ(TJ(fF?9H(HY2XR?wYu`n_* z|3w6CSe=OdPQ0mO=e1iZ!WQO5$p~TkaL3`g(htW)~Ba2Z)r=QU5(m|M5kn?RjplGfPA z!{En~Gu+YJanF;#mHD^pp>=zs|68x`BGJB48t`VWT9(x+cE%v-P~lfE zg^t6Gs0B`9kto(i|8#S-1Ze*!S=b+t3#Fp>w2ev&n&|0X+I}(IvT5rg4!(lK>25s` zU_td&gk_sRv66DP(XDq{tJ66D90ES+hVA>joNPdg1RB4g9@h6Ygv@1a3g*PH#0!zg^W=Hu6gHxB)W@H_ZtXyE<;YEt9FTywh@2qexucO zO3Vt>cg>wI;LfNYR7_FZe<)FoesN zHutN!zU0Hb4JwS&#LiNG!E^uP1C$GP33dp?LMacPzcvZPVfrfUhBu!n)GtTyHpT?t zuwgaajFfYGZVemDZ`q+<^2}Udos6v!SIT@jUX5`{R&1mZZ@#8QPV;@5<~0~O z4k#vUsc}VN6KHkacQ>YFW~H#r4mXBb(?OkAq)n2NH_q+8lmUN-A@`M+S3eEZw7V~9 zt$l0Gk8{N^Q(G%8J8H$=tioahf0 zJKue2mUMs1&kV2MgVs*omS4tQy)~QXy5my0{`dLH$4OwX`yxS*(>WZidcfso(cAW= z8-lwSu-hjSv)dm|ksy+Xe&eh$_3N#dMno-4QeJW|l88I(!8C-dM(KsZj23ek zoZ3Io^84*Oa~Eolxi5v#LDiE5|Lpl=8jPJ9bbXsZ;bx=(jO|G>Yc?%-sGFqdEL$2QTnLbIWe|@H69?+^o&xeE(%+S z`06}%du3%uY9q4qnR3B3A7{%+a$X}0t8GpFL)C%Utcg=gwd+jdL02n06Djs*DyAIInzBl4=ooe(S?NY#v@|m~&1{6&BvZ01RtJzJBD&7o7S&5&Y zaW@rYwBMN_gz|@>MS*`+zmr+G<8ug@JsBS5iGtMsi!r%=>TwKUb`+QrX0;> z`b?2pUJg4nvw55A=yoMKzfI?#m#)9nC(vgkwIYDEh}A9psu`0jh*k=P-67kc_U=sN zP2?=8*P`Twa0yt!2MBorLk1s979{y`vq>rcEmVf&cn4Qv3Q4M)y zvr97*EjJ>*=7j6$(OuvAaC8!|q1q!*Lj3pIM5;7m4f>rJ{Yjzzjil5|fe&GP&izeJ z*U^Q9Lhi+M33*ALwk1*xe&!iDmmE3_9o|@6pN(|iT^UA*fQY`8&JoGU#Wi5rpQmtA zH6~gIzsr-qz2lL4V#x*_3*;m(_jfcHWn9q{|>FH)Syx(dGBw2%1ZcAF+ z)vmUdOmdLd$1hszMtt|e1?|{Mou+0IURs6^a=`SaU$-!WSONKER<%rGM2>*iWD zzXxIc!|*gAp;H!KQ6Ko7MXXk>0AOmw<`&zucBp>3b8yT%IgEub&ZH4<5A=S^eE8}+ zO^QYe={MH1t7{w;G54q~pf!tn*u*vJahkXgQumUPu)tra7q(Eiq1VUS$~{f2bz8qu zj8yRTZL8(HjTJS^{1d$sj}?MUY+a4Cxmeq|m?SU0riFU5Od8Mv__4sb+e?&o`j;yU zuA4v7D#gTj@8=sPEIsB?x%08a_==9H-mthS^gC46!fAv_OHa=~cX{yR)AtowpupwJ ze#zlBfEzboy(YQf6+8c0F5}9n8~Sh=u&I}s-zge`@4R=u{kxY`>tSHJACteZqa-$X zLbNh0pA2+pSU{j9qCy}4Og$G#E%Swb^bb`wL|;eiq!UJ|2x9HI`fVSn1_E5=yRhUt zljkz9?9-OyRW<2jSK+_aB`^&M#JP7i9PEq)*j7T52dzMrbxI#$%Le6Z?Jv=`$SsWw zA?A@eTotgKRXWU39omAar?A;B{q~|gww$S9G;!-t#Jt){KjEs0qG@Mi3D;k|r7>+u zk(x(sRbfXD(USMShG}YPfSXBaBw7`+KLJ5H)PB-$U)a7!R?%O6qqy$nK(T3~@kdfb z-c;Y;#FmJ!pxw)S5gaw~L?q`asvo}(ICY8kcY3-2gLKw;D)uCKE&KQGu1ykUSV5`2 z(bS6hL&u(fWNh88x|<^{jAZ5M27#URK@nhmC}(k-EjM0Bt5md@Bn-xVUao(}NGE_E zKc+#=?B)#^aMM$lv`leTsPWXWK-9xk8?rQ|bhp?af4iQOdOa+a2jPhSA|$V<+M}=z zQI^M<0+ylU9%C~Lf}eU9dzsAJLgyF0vqPG%zL*P?)*>CYu|gBQDA(ABBax$$E_ zBx)vMaO)$|@D+B7w{Dex>SlbK|FS$tP$6#l#~?TjRITQ`T6)~TMIqj}J8CzWfE?JH zB`IfzE~o3J@BDb$1lXw5+Om7??4$^4r$665<)HOar2T7irCk|Fb)NOH#BvssiXlJW zf!&-X8dM7<|8l@&gIb?(>28>t&zD1Wg5Kzeq>wZpD!_XNdM!TxmnZG4T;t{Z$QS7S z7!M!UP$b6(^*c)woR&CeJ0;GcqC_(Djo7BB1_?{L`iCwn6S8%u#wkzXyaf=k-k;9y zcweV_#(|vbWj~A`x}<6{4lNQLS4&MzRuN?-YS;J#Is@vOiOlb@v$6ywM!Fu>3RWSZYq%+h;Kwkzri#_1$CiNAUTD zKkVtB#vJR^$67RsSgb1&q26GWfn>jeP=f|W;}{4O>YM_lF#fK_fI-bmE4~!uFk0Sg zxeDlsJl8JY<-7nv>mFI4qH2M9X-w&S@-+AX>a_KV`;kKpna8gdN6M_q!(roi`T2I6 zti%D+AFdbdk0aiH(Z-Bk!G7rts7j>nAYp)EnXEyCaTFF;ttSRb9`Flfq9WSM^bA>|{S#(OWx z7Q<-8dkAMqUnLijxtFX>%Z-mP{kPzWm?5`KPovW#t@qXHw^^C z&I-84Y*r&636lZ1jW*YvbZS}*_Tr7-d)y@!74r!$4IblOW+|BCT&G2pr_Hd2G}a|^ z$WnJhU7zddxd^{w{O2IgYxpeNsu29y~-ziG{}R zpy+W5k9>Y-L!S?9&0@DB&?CS0xiWaU9RnP-1FL*4^7G2kEgm4?Wtr$C#5mR5XRPo0 zx}(&xh3|n4ELMAK%$`!a)gED!ZC=tXN$F0ybvr2WIfKvX4sVjg&{x~b5^0VrLN#bW z20f>mw@&tr<__@kz8A&^Z`Q%rZH0=i=z?@z=lcbzK%hn92PR%!G0D-IBH>xwl_bFK z=n(GlYc+z(;rT|QW+*C(?}J4stSQJkWw@EDI_dnq0@;qE*By6vh0+t|E7+9{JGPZbqN-I#(1t^<|{@Yvc4#D>6OP<7sI!=J5eoXex{+To8 zJ(lvcB3Tu$E5np`6ob6cH1C28?__Y&Al)mpqjq`7CsN+g=1JakQUs0p-A*77>2Fi* zz1=Zbq^&~oVavtUpD_VVq_$yRJGfut%@Uce=a`rX>;56oc=;(x<>oB)dEo{eQp%)@ zcd!uRVo2nH+}a6(o4{%$x7Bzsdku%XHtB_deqFbh`ihHgn^`+d>6*-C$F6^=A0VNh zFaoTEOw=pMA&1eg-SZKaL9k_%Qk=+fLnhTJB4P@bmo&d^i4v3ZzLTDEWC|v)6+-`X zl{KtNRuLJE$kN*dsu?HCe6k2gKv(UUiz1x$=x@5V2&5YE{S*yoL#fPl+)}2&5O5VN zOcp_5%--+k0Gc>4BAfO0v|k!|PEeN_+mD)Y;(j(v-PB46WXh}PvI(r$B}={FAwU-? zac?gTDy$LY?h*p=mI(o19~Z{mO$+5EajfqSEM8;l4lE)EBiQCTiE$ri@#(jNaw<@OF1PESC)rxO+h0+}Lbc z5=I=iT6Rd9vI35LRK)aEO{E(wxfdoci*Zq*UEVl`1W}t!Cz)|A`3vz3<|S0|U;5fx z-2y5p*K|8hd&5IRWHU&42T&IV0}4nHM};?6M>_URz7$s+j_1g@<|YLmLoXezxmyKL zUIC%i``}?9A_(hc1Q_nUuwnM19&+Q$jz3CA3Yqj`#xHyfBr9_yWOD)h$a7uG{qukWJ6;#Yy-R{5 z5HH@bvg-V_)W1+-zL5Yk^9Ftf$*6Cw#=8^@ZPFYL0am+rA`lX(apD1Bo6XaXQ{`}I zqHH~=G)*?^mCZ#WSdloNZapMvcfJ1iW51i$2Wk?G(C;P^hj&)i%4uek(%A>MUlgX# z=+Njm!wBnWfBoVIbK@-fHk{%QPd4szS4({N^_)UroHa20)vCZydIbzX)tCB%Rf!jl zgbe2c21qzPzJ{hab#f3t-?honHSxNtOXXc3z%8X^y^%_eFmyT<#m-Vk11%BX#ana? z#l1vAB%0lAKz{i@)~F!4&HlPbFjDP`X~6DCBNdhHqlX18_4;YYdCoZPMP$QN7q9qH zyd5Akn-aB;0Yb)*@7l6KzG;3aIKI7NH&vSLhn|Zb?WC=kkHc=LUA!981pj=WS0jxH zkezNX*`Ui2jq^xQFY>ognY)fs(h}6UPmWjXGtd!+-I^Wob`+pl=44xxgQg{!FB^9G z;gNXD0Yk!|kfZl|fq)=ehv%7XdD3p#B^l5BinV>uje_tF{yT6TIq6QsTXQtP$Olnv zwWBjcMAbxBS7!-){yI?+2^$EtkAE}E=syo4hR?p*0YbC^s8^dpH?dCH`364&%vdKb z+X)VY@M2DPqHmf53V0##Xf5mo#vfCv)bLdl5L|}e9ZjP&X;O+Jd3|atonYPK{Xh~# z?KD$=t~5Ce5f`MDM1jlBN+iNd?`O&=)nBg< z0cqsEvo%Z9@O-n{tXlo3;A~pW?QqhWQ^1G_Wc^|+!U%Emzb|$Ck4p(eOpFlL!I487 zQ%zOw*d4EAQm@s2dEu0&HT{sDut4a zCZ5oCShPh_KgC=b&;u@9g+I7BVy`b=&$oqDEfjXlsM8q+(~+)q00?? z(|tlmYcM45?NSbfDRw1p3L7Cc^(JIWdZIP2`~Z~sXF^_iS*m4*H240lv4drbQM1co z@e69cUAimoV(P#O6#{FrQYM^7vV|~d)_t?8NvsNBwIhcU85!v_$sA| z4U?F(PUVt<=BG>Ub)ZXq+VSbhy&DvLEa6`-#m_UwKf;+cRhS$CIr*q>NyDCzZ%GIu zpaIUA=32Be<6qQYI5OpLns{vD*+(PcQP>6Abg-Bes{NpfiItKjh#=MCXocN0=8|sa z6`H}Jw_b9CruI^Ay?%B4TC7zK@$%tGEpBsdbmLT4FZ+1R)T)NP8X^HSV$S}Zy1t(o zAvGX(`9n1w^>rS>$BYk(eN3Q2W@IToIX6GTIk}x!um@Uj(~OlZN%pTrz2*sNstPi* za>e*=G_cDYqoXYba-TvArUZZYf8&m%@Q#OcBlqaQm@7`D8d)OHPh`|PU=VnK@e@U< zY1^;q_nAS=HL;(m&76S_`=_B^Dcj^jAUJS1q?nFkY0~<17FKFOZQ*G;BNhhIXx2Sx zfHBs``T321I9cCv6FX`kIucJQ*na26saF`|zdNFmEM%83qPJa!kS-%^0?Kd0LE!Pq z;I`u1t`n55gJ6=ot+apAnplPO-cTAA3PYaPH+9!dTN9jcShAJ#FEXvuTW{EdtTa{d z>~V;d)%FxJ4K%G7RNP=z`A}XgAR{1$1SEUBoc|HJy@=0}W`)M7{;88hw;zw?!i@jk zgcau3evQ5?wx-H345e}(Y2o%OrP!}vpwmt$`S{B+@z1YK^?HnK{#}v0q5uy~b8#B> zA93;~N=^A&xzCiRoT%Lqw$=Hw-Xlzix!@7Fmsan#S5mYgVmD|2*D^%U1#J}n{q z)iAXchnMM>!jegON47f`0r2;@aqH%65{0Gs#cQpCxt)9b!Nbu3J6YnW7E{n$lJumD z+A=Al%Wvab%k|Fk1xOg`>WQH2wr!_9I&UME63k*u$V7?@==Hz9XlL2^#Pi%@#ZAP7 zrwmUH1ZDUJ>B}bAg>nke2u100v@LM>ACH@zV26Ets32a?Bb9KTfOK!7U|j*Rgmtdi z3nvqJUqaZS^rCBXy#Aj6hcQ<3XOT>Ngk}x~yiU?bzIKx8##IUACrwi>l9aOX4MK|3-g2k^laiRrVUDG!b?IbPT(*a74?);(@QCM~<&HtW9 z0SKF0N7B9FY7E?rP$*HZ93Ah4aFE1vDs%e`*Y8c^O40F&MIUHK_g*eZZgwrY$I)dQ zJsaG1ou4BrF}moWvBYj#Qo}Pyca`omoKJ$)|METV>+yv)#7T96%K|l1Zda|(ojCve zy;lt(yA=bB4Q#SUG8X1daTD-tAu>BxQRBgxLu(?ffKOUku|HgbN|bTH{if_)lXzPN z#@^Ic?F{&&nnN1>YN`)GFt3O zyuE6RvL$4@sAg^G>-FfC_i*pMjD|K6a*Pt*!4jS)S8WbOET$WqF~&SNaq2&fJYRU6Z} zm*3qsJJHO)dYkLCw#^S1d{tz9o4*d&b^nVv3^?9&^6Xj8X%Rua~VP?vYyCE=QQD_ z?ZVm@K#Gj-5Pd+GmYo<2(0BxR%VZ+6L_O6@GQ{)N#2Ur#i+jO?L2)b;z4I@I zTmd=JS7IiECPqL0z1yooZ)o200Pd$rH6uFa>^L(5+U3N@UM{-_n7Cl%Xs@6-4(k+F zyf5@o&MwIi)-pv?5xxVRWE32fxGikn=8cnmMN7Nx#l6pTY^JhRJ*#f$?7|;vSVaM8 zJOIze`y01eW=VT+5|UyB?op(?3=i|e3WH8BLM&09bNi8aU7gMADiBO80^HzYsF%&$ zR^Fb5o;4Zrk`Db72^Z~<*#+}moo{`yo@>#^kM$cSJg58(6(qS=uC6^cy>qk#557~I zMzqL_km4u zu$t9)fSs|@>|7w*q`5<6S}d6rVa6GdHYdVg*Usi9ff>*iC^$bSo}h)Dc!mH~NY%U` zJF{S+IOz7pZD2WBpW;KM|S`bwJsc*kj4E?vonF|1e-Yc$EnhhV#Kb* z+Vk_|X>|$Dd+|~Jg?Vp3-e?-BuWm{h) zkU0CUbcseXM@rwEeV3`4CPpOq`ET_rbK6hHb27&Y0Hl6SM)UVfgPitt+1H$xS5~!k zSxa4ELb*-8#_Vi%JDB$V)6{{$)z z2HXHjOnzzqvnkJDLl~ftmC?!C&6kVbcfX!5wVa3dfEMH06U!eprIYf}o@PxDAM5?C zH}s)*T^{DQ!Jny--v%hp4+talSVbn>KHhD{Y2Uf0&#wF|UD!dfajIj9#&l%u@9cfP zH!m6fTZbZkANa}Kn70V=9gO3y2q`_88{&%$HQR6r<|!-jP}$70#ZZhQ%0KO`q*6wI z{qPaUJOw(dzc6p^HAO7yuMBy_3|Be1VU;zRxHo$gZu|i_=Q#%bnuI5&UsFb^50~wF z`IB14h}@+|Z%UdflgEyiV5L@5{+)w@YyZ7Ak_UXI+QcV;X(l3wA6n^PZ0gw3bfV7F zsRp}T5K$P`Ng7&wc1FDvdG?4SasA4~atLTWgyg*jkHpXi|B6^+a9U86_}$N2sl3CS zxXize?EctJA2`mxI9^k>xSL#0Dl7Zdu+F1zx|5eXd~Id86N=jl`Jcfr3@pH%#XQRs zennX8kIdICD13!SLN3dBFgC}?tCtCyGN1M=#OzUSu0)#E;|IJ*1@1^|5T*!^$Uy_r zJd$bWX#>1cm1WI3xxP7!2~&%?yv)(X-2$%zPIQcuBr7oZ5O!aeHn?LyVe4*xSnFO2 zQ;NU?h5s(a75q?|--`T^Plyt@joE5bK6nGU#-rr2wZL4Y4utw_1snpSi&e|RVp!(P zkQ#7;)iR{_s(!d4M&u?ZeaGY`g9sMZ3D$l+oQ@7W%BtUNCee!?t8(JaQjQ9Ly0OGT zICEK0VxH7y^8lr{FeY=LxO>-GR`l9a&NGodFpeP52SLsdWA+Smew8{-h!;!;5uBf& zjo^g`lChG8W}ck`-&YQ`M4WhHwt(QxWN;4F|ftpl^sS z`=M_(A_q~AdRPMS_&nU;o2sHXrEt?38U<4)oqu;hz2ZBWwa4G*eX>>ehDbNEqF-vR z41Hgcp#5(^(=46}siMwmTDawW(QA~)Y9?Mgy^@3R3@)&?-3bxKiMK!J+Tp7M?fjmX z2;(WemRKda#u_KCZ^6Z2eNta=mx+%K5P=COH_o9Av)T$|4GP*x?M;@-S$nHdwhW$@ z{S%gMbj`u6LUs49+mn4TB>LY2h|vOH@<~Io1%5xnYFa&ATB___4y82c>|Ici!IHUL zW-&VRk&0Of4@8^btb#wY$-v}?h#xFHL>FETa!CA6k*MogyWI>zPpvRTU+GBsF?-|a=E_F<1Uv{_LE^(hvK=!N$fmAj_3pmL5 zIM~F!E34x*+QJT_ES&nqpQ@$;jP;fdML$pxKt5SUG`_umwlSa0!(Asp5nj7P!S|>56a4Y@(e%#~+*Fry$-yt)K0&v(a9Id})On}<%^CddL~^SU zT!>>hTf@!O=G$+~P!C3P;9DRT#UqjvNH^KPIcL(&JN$i8$5HZJA#hlWgM!c)4BP@; z|9TLwnRhyoiE>QSl>3;0JS_}nc&O@RB~I;SXXD}PxBsqzfiw;n`NMBIG`_(E=P!bm zSB0+@oeAIRNzTjuC^@?l0f&i|E&*x%$hdMecrnmHnOc+o!cY-;Uf%bX`b>qj2OB*K zANhop$v*$6bQpWt`$ehL@4yA1g(yD&Tnl?h9w&x>;d-zh9r)>d6SiY{mYd3qD}AlX z>{FfE)G6Ns{s=YzNz*SM?4qA6VeRaC(D~~z*J;InKUJY+1>UY+&`KpH$SsdeS01N3hIs4hdc=5k-2XYKt`2U!tO-%A8`%oiQ~x59 zyby&pca}5chHp#^ZIpd;vBH16j2(;14mph^#w=PbVZ6T-b^+J7GJ@1IKLuX%L@M7wXmn6BNu{lZ)a|F)H) z&h%oIQUY(4#2z9r{I0u>qJ(PIf2VZ;KUVPBO=|q@CjIBbe(p$nSM0lMO#bc{0*&%+ z-JXWZYN1s8WsR?ja)Rhfe8cd4+oXoD}TdM*0#;XxK#C ziBqGiV(lb;)9|xYDrC;#1DaDXR7zNM1kbK$9*hUIs)C)XEZ=bQ@{-q( zZWN}K6fThGsc~Xs2IbaI(-@uvu3x`I{@X<2YqWH!{yc7u9$0;)L&_qffanF%hc!RI zyER;fFPOO?Tzv)l9dfs&|Ml~vU+^|neQHFlYCov&9IPDx>n@{YeY;h#XnMV=?`YOV zh!J99$)SwnVrdm%OmpsKkI@+GP3JXhl-!=OEa*Z=A3o-3*wIP?q?Y9I z{@hR?JGR0uk#>GbKjb<%p*qhmAzjnp68<7&Ph}{zj=h!Ft7iEMYaBV-FYD5d4alZ{=68Q7usw%TZf-yY{>0vhGNtKtm6O!KR3 zJ-n}Y5A3=(Sx~;-x?9Dd0lbW*Cj1LyyD986DOm#?OEz$t?krmlt~P{H4G&k6#9S@m zYr++&uDVb_rXfXwCtnkh@S`?ZJ;H}dN=)NDcSk%vd;WbMM$2z( z9~jMR7_a{T*yXqQp${K8EAUy;70OK-o&)a0XZdmO-?%6l8>gPO1rvy$>*gN_&p7>B}!KL>4AjyZk=V&q?!%Kt*)pPz?#A8t5Z z^2Qxf8Iup=f3WxF;+X!+8TmR*63S5P|LZ6oehZp%{^L}0K|5Yh@JMwwq8o^QzbEDI zyA2fj^wUY`&)HNDHwB)ETTOYVd7~yjXrB}h+ZtY5>JszWoA6AhX!Cye9>RHCnpQ$Z zKf>gLg-d`d%hZ{G$E-q55Je>u{CmZU52rtAD?+R4|;|GKwfEZb7`-MrnhLjqCjsy8dW2TyfJndqX5 zJH0DSE8_#%1O*)|?56gDW{ozt5o;9QcaTfV6xToxZq$nPq6qkZKP%x1IIu8&aqJf> zSXgX1`5zcm#b=eOP!I4Ag8vflUrRhnh~QTIP20}V4qL7)Zl^*ucWNQmpiGeQHcF=p9u7o&R|snt=%n@40vy(TL9e$DH2| z25zPlo{mWQ4b)SP)cz9Z`kJDSac~S8~>pU%Uw#W^#4HWWN$M9<*Ht@F+KH z^+Aah;-O~}9B&)$7cO4El_W8IoKVa!J$DtnI*57FY9Pb7XjTAe!hxcvB`boO8Z!l zVCfeNl&`8~01=#)t}d%-ty?U9cGC`*KIC*$!2aC;G{G#NCLFT0O3@^i1thVg^aNJb z^Hsxk!^IfmPcBmckYvy4f!w8CQb6@WJ(2XW!Pgw+m%vT@?l0M0>y`6C2rTk4!37R*Y^Pg~3=2RuW1@98wucm0oj=19ISXU)-8 zXEu1yk#(qJA^xTTz>t#I#jH~AZOa0Z+J=60kqMo=^`3tpbFBs(uIdmc>&2sgwE)~d zK{){Vu@?XgzYCW$RZ}>RRJS8K2f?%VN%yf~vSLI#k&@T8c1PMF@t&hL3-)Q1ARmw= znCMtKKHNZ<2)WEZB&;XAmStcv^%!ImS~+&Zrk=E8w#u)*ERutJ7bLrk|54xxqZk>{}b231DKvT0@8PlVPmbzu4;JPsmW#U^)8S?hWu!`A;U#N#Z#`j zOqtx`M!{X8czIx8;AQ2|YCkO6#Cst=>^9Y#vwOh+$Fu1`s=t>8j0eum3|zc5F{ymK zFzg8WA`# zfrQ8E;+SrUF=%U!yv^5KHX--s;-AIdtZdK|+PHGHb{aG<6fxL?)y>{@ZS;sVV;uGx zG%PI2TWOe4x!escr4A}n({yaYI;7(lakT+|1H8WhzHnLZZf>(aNz&nJM@(F z@AnqG)7xxO+8Hm}I3IM+En1o(MlaaUiN*Wf69LPv82n_V&wS=DK|6!eJ1?-zm@DLL z4^xC4_!*(YdmK`{;zKH+wfnm0^ts+kCQX?yo&X|fj=hyrH|C!?e3$X9GviRu-0a)* zlm^&i%u52R%klHC63p#^-{MvgD1S--kRNeIKMUb^Dld$##P6~C8V_B_>ZM=jNJC3x z`J7mizNxDeWe#mEbdrDq7{yKf*XcD_(lpvyrQl;2_P9bzpW5xeRWV?yg~Si%%BVe0H}A4 z@NbFvnCcy908`Ap;1`n*wSw+z=NNEqt~VY!9srT`$~!N3QOwoPhBa2rwIJ~{l(8MF zEHZH))O7*(Zt%NM!MTPGi55XnybQo6*F!^zi6$;#)|-0T+RXTp>%#7s6JnqUv)mzG zrk->BW2bwBz>0JjjE+nt$TCc`ZW91)LUxDh0v9o()vvPLR))H<(EG5t{iAKfioI#F zU4fQ^O8Zyim}SZw@gaNM@J889-lt8)S1;m269WObf);@uGb5Y?BBBcTd)aXhV5z&{ z(Q)U5rv+eKiLHQqAZcidEdKgc*qDcS`yaMBT-c!s{!4OeTUo0y-iz%=-9m!#a%u|9 zYBedSV?$L^dl+bP1;!kce{|7qIgFHM!&Sw!;ogq(*_+v*)E=niwM5HN+!8q29zjuc7k0D@wyI-lPQ5z%Q46+(jF@v{z3E8UiI7 z8d2^=S5}LwXT!yfgK9f{h=L$E*Gm}yJNp_VOvYlsY#5x#r{mM)ltmqsOvpf>^3WHc zJB$9Lp?Jnq$Lf6mBdJKRdI~PlJH-Z*D3Fo};>CdZu?y@>pC=*o(|7U%RQ4jcNw`D^2f!PByw&jfIGQ;iK2bb#d< zASQA*R@*c5UVi}RjN}q-?Ozk@=8&f)XM}JCVipBYw@ek^788I!@$4qjtN%W-Cr<$Y zN_=7m*~85L#Yx^*eD?eDCw+z~nn&>Mky1<-?aLZOOaC^~O`;3j?a(W0M}@5dGoO6l zrR_3zks@javxh&YG3E@@XuzMTSHTC46G1py!Wn}IKv&yH7vmndDp^g_!^-Vu}_r9QwB-@#`QKkKow{+T-CO0K$vBq}UO-)$a3YVB`(G}wEB>ddc z0#_c>?_)MT6*i9K{kyg9D}~(LfGOqxJnc;xt67Kf>hBugsCPV)-+J9Yv9R1f{q66d zQ@tP{6ev)+98JZ;PHh(yQ*HtBZ{};S#f2BFn*ihjfG^?kS8h@arIT}5EAHHJD>hAH zrShadJ$z@wEJ@nJ&V5WccIpHINL?kPs!BD`cEWG<0XOw@)wTSB_HYW=Abw6zQ_HsM z6{~v4Z#8?r+&AJ;N!i5sOgaQMGYkZqzw9wdYmcj6$k&4;$NPN@oTg=>Q6f?RXIN=( zm=kReOR6>FzIZltEC>c*kGp~-v|(TApW6kHES^|FBqWo`{m#Ogzqp15h3jP0Vp?Clx3_lg>vOW%+xIE%@v*cP97VQ%xg^&VI{-2c@ys;2o*xdN z)9cF^>k_f>wY{#PN1%Q-nWxRpDeGF2>-zqMQ6=E}lEim5I7H!0E zXZdiW|6x~$IQeSQ*5KeE5IYOj052p;&P&;J#qH*qp>2VNA>F-^D65jKanEvm#)NnC zOJLvCQ1t?~7dm)1*Q!9?@3H(c#JioIK0t;|lhS){;%IGAFMV+Ep!1z!Gqvb?Q{V(C zZkJ~}4&S1csB@1Y!lhgSJ=4Uhmv)1(@ly`($mBa++ohk-^LnQ{- zpEER~8Q|Q~AIQ zn4Y|(jOr&a<{;|p%PGqG*iWkm7H+4XfF=hpBfwSfVYK%yhhjwOKNe0}3H;38X8br% z4AD?=k!ie$TQ1;ue5^OM;4wU7VlGC=2;OB!*pj4-rvBnmXCYEz`*G|{%i4w*BCo&6 z%2+DVK~2-jbOgRC;J&Q)wFchmdMRO)-U_EY{P}Z_%kF9|Cxw_3@BZPpt3q4KTGTO| ze=j((=#r-AoMnBRz|uKKs)ztu2g-!<&wbj^SUA~F7qC6i^S`eE!8HZTxc zXz=`!H+HblaLE?FS=h6^J|3Lx>z?d7m~voP+0#=vdX$Dfz8FQj)5sRFA=<1 zr}={{gCpQYUZwm$%HBI3>%RRT&lzPzBo&dB9V%pRmF&poq^xA`l@*mpQDo1uXM}8_ z$lj8fa2nZU^E=+gb>E-+@%{ep@8|L8y8gHxSLgXYU+?2}jOXz@p2xM#0I@ST&^tjx z354F;1su1QBq^|~oWacGsQ8B`n4|FT^V`^}YjOulJ& zZ)z~ql{U8)-?KA>G&opP%wCg!ogc#W=e$#> zvfz6s#_(@^xp;@HHpTS7R|_E(!e0xd6v2eGAHXogyx_e*H(%JfNi&6N41v<@oK1`-~8{z`h8qTzGYr-b?HkO3%{*d6$Pc=C4)5et{0nx9>FbZyByU z4DQLAjaw&N8~|^<+SYe6zuCC%72R9L7tk}srA7Z*ZXg5wHhPvmUY!5k_b#HACjf_e z=1MU}NUp4*JMmJ$F4QeRcCF{#1g2P`Oh+4C;)c;7oIJIiXw4YAHBj+5V-x>vihTsm z==!aW^LmeIp_Vcgl|GYslUt!%InaYBW9Rd(et2(AEzon(?t&VpJz zyFN)D97#bU%&F)jwDYLHXHO%V?U$`?cX_F_LxC=xUi|o}y(S0rm*^gz`%mh_^m=q{ zFl7}Xq0U;B>UsmiyxMNlYy70Gd*!6>-`Kd(n?i+r9khFGPFNpi`Sl%1vIzFvaaTRl z->(Ae6DXq>Z_Sk^-3&PAVEna<%Vo(>&pX=G0EVna*CLq*PLu_oeX1FM`oMK{0mCG8 zr>{}SDoeYFV|m+HM5-Gcyest&|55j^`RZp)o{Ah8S`ZoxZKXw+{x*#Ws?@QMZHc={ za79V5erB*=Z*Mu~PD%lv5BH8+1u>^y3_3xxaHvGRwpj9ZXHl`;&55RuW;Qv@O=R~< zincG;E;|j^X5Nb)lI{@8E-CrRCB0PNR>B;s}Zv`*;Rf#JI;a${J`8wip0!0Vmd?8*R@%uH0?cFrM{Dm zlI8QL6e>OsbNYsF7RdVsgmCwh&SR+i1Q3bW3&TqYHzA5w%ar9>DNG*~ptT54X(>Za zjA9`PzXnC7ed(P+biU_a$f@Z2bV_8>;!i$GX< z7Z4+H82^GKA@}ygkX)3&WaD~>)~kNM7<5`mRXMKk5Rt~@6;O#d6FlB6K7cJ|%}%=LmVR@STe;+o!Wo6gsnl;e z?I?$+rUQ>;9o=psjkkzjR=nTOK#~-2O@Ei1RBEqPbq0f)N|c_=(NnlUG;R1T#|Fqu zVbyXgc-mNDh$Isc_lu-=aHVb`r^OO(>0NB|`xd#d>nG4E{}lTRG+#fIlnCVCG%lRw z4nR~`=E$b+kYxbbSI0xvsBW1>^21Rd*r@kk9pOg@6wE$^vw@*g1Q@{@AP z^9mXq^yz6(5UR&TNL#U;VFtc_^Gg=4oIwu<6m2e!lSsvnWM~k&WQU`<9$>#=Uufn< zK(*UcM$cV@-5A}PUUICWY+UK@Fg2P%S4W8hfcw?6%Xn65qe;8HIL8itkqja%vo$S{ z|I~Qv@2mm&$W*hqpZZb`F4=ye52d3Qgk-D-%4GW}`gj=7P-fHw>jl>aa2;M{(-3Eh z4Gc-!p0K`n!@OSq6a{zcP?T`7giv`~=AY$~9@z-c@pOCr^C0|6BUh>W&1_%eV-2=` z_q$CI-^MHI;4QH$xE)!hEQs)Kf%5Ykwp`Z&svhPXYU*vExEl)s`s<3KqaKDq6f)$(HAUO5G z@O4Ccl7bhK7>)mL(nYZgK!Y#lOr_3mg(dD2qV4_SS16Sm>_(t5b0ns_7P?PNF3N2boFv>fDaY)-zc} z4HL~#S+uVy`IQCiCxeoIF}Y@%^<)O$dCRD2VBVb`I^fW&`{EL(&tZZ_gyfI+-}%qb zx1zrm+kjQ<+leozdY_MF=bADJvSz9z@$!?#SeXQ4ptkK~7uF0E+3J$wq3w zRrSwEJnY!GW1Y2IGL!ul8pO}q&Zr(RQN6@y;TMu6lEvl04>if2WI6bSrr@k(JI%Rz z#&AQT`!`f{E291-`Cl16_o=m8FNvpmvMRc_H|T)YxaB_hN?EV3Wsqx@ z&un@~_e06g-B*3L;FpzH6swQ%w+?o`5zqe7UxN6Dp>iNkOum0>7kBl|Jv@Y{miOQ* zzFAYr?C5xyUQ1!*wTj~_@*fcWm3;YWq_qGnIF*;TrFswiwe&l3nDVpH3Sqbb?1A#5e z${BjdRS*+HJdL^43L3%bKnTovi!3GXNXh%yewzAjT%A(#L+heB;I@DJ@n#zP>WmGeo8LH|IlA3 zfWH{I@?Mz~1}Y-(Hjh@&+yd9*hULwNzmAt5oq>sFn~BcoA7Gm+^O(rIUDQS?Ql@rA zUDr|_b0gNcvBjJ=c6rNq9KAf@7|1w4;K~!*Q*Lk@z>?dP&9Sn}a#L?xiOpDI-GY2;P26h01edsg1 zGDU(5b0hd)qBDl&^f6==G38vJ`)^vCtBtD3hQ}O7zOB8Q!b^}4W z<+OOb9BT9X!oT&x?mM6(24qcdiEilrs}JVg?UbZ%%YI z5&$NAsvvh9*O!KPm6)?%(@}=R&<}$qzi@dqlE*P`1HUx#CH>(%RP^mzTO! z{=M1F0Dj@!mDR(GeGKISoV%qncLDmu=WBi0IcFrutKc~?bfc4eZiD}Kb`aO%D?tTA zP=QbsA+dQL@YEM@vxbbWdsnm!Pr78Nb!RuIAZa_`Dr)v@QIpZY5nB!VlqldkW? zs~)^Jc%6h`#irp#-;OqplK^5EFj?Eij=hBcS-s4tw2EqhUsA}Vs>nQ|K7@r%(5Z(I zCuZ2`gxy^Joc-4ru3EdE*()<9g7Q=Wc8>>31MaB@+`B%|+3ig+*4^cI>Vp1r7u}Mv z7)E>u&bTPpSYZ1F$MGvBj&rG~@@X6Hkt2g>p#hIFfO{BOy~MskLd1GYu?82LCTQjl zf7VbrzG7wAJO#T!VHLOT3h9MNGklhrZferAbNPz1=^~uzS6gcud3aidO`f|v$`Bu# zN;!Eo7_kf-yvg~I-1~nSHr-Nx3H+Zq4*SMk^&DnUPha+@AvVQY^XKc-%y(@bbXhBW zmv0hKww0~hz_!BGTiV}FEU#xb@xxQVN7N}O#l3j_K`P(Z6EJiPyC$7=b47? zI$QaWY=tgj@uI%2W8yW~gw!syUSclT$%^Os=Y>kM>{`iOCL)$T$wJ0=kOGKNz#H%2 zn|VpTpPgZ0(;;#T`_1$a`KlT7l02T+_-EWNyC5>UuIAMU5i%hkxsGZTVY_ahI@l6K zOUGsGJIu&__<_ezrtmgpXPUSy58t<+7a&R4jNTkHN@`HL=ojlfZYNrD{FCcbX4isO z=34m0ZKL^GE-s9(E;$h4}$fM-JL4>v+1w z9gspge}Q&VhJ4gWf5I(n;#{2F#nZw0t%Z9q9VfMtDRb1xhTr@PD%q#MWwMSA!0R-m zK-AJ_#cA$>Dg2Vd6b=8}XO3c8AQRqRJOFfc#ac%xx$D*1mibrB75`s84&Lo!f-5=? zpS#3)XqB?IZg{%7t4oPv6W6m|b;_=<^8Wk!|A%?9|8yc?jE`yVBEwG1()zPnNH0A> z^5!!_(y6wDcvfbBR{614t~6jB|AX30dFF}`-42hb8Ypc9b)i~^waPIpYWQ&?LCgql zd6of`&>Vx*RRM7o91lrM|3!yQY>n3x#bo=_^e^xK=Bc#wzn>AT*Z!CY(Z#sgKl>E{ ziI|ua+C%e$r)QMJUYFAA^M~0FTtq(Pd_ODy!!jO`gguof&)kHk_I`tX!wRwymE$LY zsZ&eBp!)qQ?gy=rZgn&D!fAZ<|0_f1KhFtQO8>7ppcBF00->Y)k_(mgPKH=Irs@d} z9aEh7=~62_lK=P5lGER?byFRh$?3Js>B}?H?^Yo}r4c*N@&t>x|4E3oe^X!mH0{C- zpMTcHv%=j`Cvl|shedo3$<&c|0`%-&J>+9xZ3^I6n@pV8sB=F`95Tw58rbqcvP-kb zGRAzkLU`m{D#s~r zo>AkuzH&FG_*E6n1r(qQA?fL?2*)?tx*D$|-=uZqB61}TEF)eDZqpg8Vx$yfw*MLH zdc+0L(jO8MZ0b}}Eb67a{$VoxGci_C6{IC&u%+$zS3x^}`*Y~r6Wgn?D>kRuT=sU>#vz}4r<$Q=#33^KsdKDDmXkg6 zy3A1q#*8XKS^XawAbcT?Y219?AQ<%>25pTNN55Wonj4V&N--8l&h?DU<;z`_eO3fq z!4MiS6x5|KB<_0SPd221#X8J9QXl7eboL?Xy?5qV?#CrW2`$mcUM@&=dHZ}6)+b>* z97n!G(%c&7j^XDD{(o4NtZde;!fS?wZAdYq{SQ_M(V*6Ha+D=& zi3rC(Ci?_o6Un@BMJ^!?_5o9_h2Jr}F5;AUeRAR}Xw20>BFQjD@{x$h7ypmx5D1 z(Kjq2%U~>{=W40_6y5vVuN5|f$f*xrMDV#b3vN*7+m)lf{fhFA*ZC>(xA06d_|@HVx#261VZ&VJ+|C~p(YGoJ{0!;3NqPstG>+bI_q z;>oIxeu`WC4t1FjrO7x4v4_)QVefZyz(nQ!7+MoW0xLpuf5VXV#1 z2O~SW_+679c;x^F;}=`Z>-P7LTo$s_uXMgbTkF$95`EbM)#Cnbm;z*fE&MmUz$kQ> zxKXnXS^5U>a;!Vg_{wwF37yVlc}a4WkD)EF*Uh*kdSgcvOEd@ui*kOXe?D3=E_3$t zM5Nhuo&gvPXXsH|vyClAjbBO6gAt-@c7r~rMKtbF>HNdN$3_y?kjtw`vT>gvQ-fAn zg+5PT97+mR)%!&W|9np9Y~8 z(~Ps8|MAh_u4)8tbx*dgnXYFedr?M+8ZL)tKh4IYk00R?X48d%C(p?iJZR9fVzXY`3W#?v>k2URV|Sl2f^>_30Fh81S-mA7tb~#NMFD zA6uMgX9u8`3CASfVK{~PoYTk|ES`1VFaoyoD1l)8@5hsWW1lAKP`qNgh9yWj`x+vXR%+%up6_z2*g(*m&7^YcB68sJk}#sO+8T*Zvv@BMe=8p`&b)Xl4Cbw zxoGTiYPq~)ps|p_p8qwa@0ri@p^nCBIq(OdyzmvrMTef{C$~Yt_uf z?p^FuN}og*`BKDugvT^b%j|90VolsdnfBjW2chc;8LmL>?}$dCg~Wv>kYfHbk6&HQ~N(Gn-yk{+BhGG5bZD*jWjo9GVtu0rhV8^t!1k~G1 z-CL~ZVBW9*B{i6x1_Y^|1|i*q6wGF^X_Dx6eDP$e9f-y+~mpZWan{cY{nrtr_t|JGAzV39=+4P z=jgc<6Y88W*m3XhEgIrHAzE~vh}3T`a5<4V#uZlBEK^p$JKc`34dHN<0SyRiFg0m| z7~p(Bn~ZUS7%~9er_+MX$4|lCFS;3=?b^xC%A^p@Tymy)CR!k8f0%pf@o}bJ8JI$P z?phcM0Fen_sy0Zl%vba@24Pe#EZSiqWCc1ZOBjmCJv+CHlAt zF?Vj1fJ6G^yW14$F6F-xhdZxYLOOLFdU|YEJ2wG_8?c&tsGY2soP+LHiI{U1Sg!y5A7!QQTbTFfOj>`*9nw&m1R`#6MVmNi%3WWmal}uPQfGy!V5u-_U!PqG;=EZsYD9~^T zP(IAUz7qJ7kCF{%ETJR1OgK~_q|KL0nH^>VLE2E42qJZ*bU@WBs{PC6G!_g)A{pvh zx8l}qlCRY+3wSCP%{_*Nj@Pxdp9wGeI^QQy5k2tN?WEG$eqqUo9Zc?2w9_9Pd(Gu_zU>Z`8)BOYni3(|ow z`j*jD{l(xq-r@sZc%*RR92yS%L&t~E^-{~oa$wogsEXLhLrbiph0mGYkAF0IHU{8~ zp@_elBYWQP0l=E)-+yOK%38t^EXWM930JLXLTBd28mw zCzz^017XMB{s98xynVr%2Uc;j+U9VL9xVcXcu^#y z3VHBcrKlVUQdF&DhyH*Shlgb&eAO|4j8L^N^;LbHNutk|93*FA{x}*h!bZQFOd_YJ z=FM4|If!2V{2QK0o41PY3UM#-JfhAYWmTd1&eVB($E+=0{JQJPL(_CNiAqoTgA^^& z;RMhD=z-O~DlC~iNJ4)LCV0yq>#6_G#^^Lb?X_CAHLkF&zS%dj93<{@{x#sSiSnhW z57GYDaO|!Vk-jS6p+0pQlb_*0CS5O2zVbHwJ;~v`!2YXLVk0gh z&WUc-ncz1=+Lo9bq%?(A!xcj(3lg36fbnaic0i1Wwj=_Q%@1(d!pp0Qt7-@Zn7En% zj=j+I_q>)&s634&ZR`nKprggoM!GEDUTpH;?>=mpFJ!3ayu17U)_3T8WzzXN8(c~@gQ z&cWNtw=)rJ65L&{o{qOqMcLplZu?py^6fB*uBBI!l?;+88!xOl&6krqfRk$k1F&l0 z7!Mzot~;y=wrZoHUUf+a*97|tF-Y+!x9Xq=imPkAQc}jIA**8ifI4s##JEcERAg8!2!U5cSY-Q$L$1ExY8;*90g`8qC zNW$+SA-@7`EM6N>aq$s;3}^lSjS4VA3qOYwzg4FJGeG!d{^Vy?m){@Hf~APY%oAM~#}6Z&)NU-Ss@Oi;E`D%g%HVdw(x;4bk-Jrel6?o%PJc3_ zST#FmO@9w_n?`{at)wkDRrv2TfGc>5+XJe=y4bf4EKcvwKrZl@@Hg;ES(f*!n-@NK zcw8wsDNdPuaXrL_`0&k#%n|=sSqW@E8!5`$XJ$m|SZY-s4x;R!`?`N+fl4gA1uNR6 z9UL5t1DeeHP0w8%BN_d=>6mgj#dGf-4F@fnA+ES7U+s_w5amytlL*3N$e1N^Xvppe z%Y#GH#|FSwu-{)U&F)(Kr&bwLpcVQ(XiSV4|E7hnxaJdB!pBPf%p^s z0yCqKKz#TULRg7Yh;z=g>M&N#z{0Vf)8?T9C-0+SE-abD;Rw1(fQ;sW0NWQKQgm51~24WI8qi07$w;~#0 z{sss|8Yi5mZ~BF`>FGQ>=;DaUfn$6iU}KLkq5U!e@#{yB9QU~?M}S*s4^w<+1~ zm(w0JfL_E_60jUKp1cuPNu6gks2eZ=k3>9-ef`H$f20LJRW} z>XcW&Q#UQdpJxO1o3YN}0U^zl``>T9N5jx&)A56SFOaqFXB$Y)1wxwMo;!`m6bVh!f z<%GiIns#|KpG_hRU-69!C%bvzIL`iL0FG6jKd<=@rAy8uSe0SQM>qp9?oF`rvudpS z;A|?>!cQ~E{w#GN^xg{e!j~QiRYwPlZvQ&1W>H6J_YxT|!s?dexl8N}CDC|{)6mC~ zrTn-ZIR*al5N7)T5yXNa377Fk)~LWxs(GM0=piD=+dYBHHf=`)0ZFq%g1{Y0MuYwN zGq__HAew)Dm^aA^pFr$}MYzzEE+kB^s6OuS2llnyynk$_Hz!PR?lXO7sNj5=3e@D4 z%=UpIAU!S+x8N$66e@xlmRhZSC>N;={K?u*_g>NY+*Y#vlB*>M%5pMovfi6= z@yW@zCR$?5R@31~A7ABouq^3xkc3FT7xSsy+nIOk;IsY)^+)?zJ{Y72Pv$UeqZ1hI~? zEMfUZpEz@1T{J;wAzA#;bQxq{X~CZHBBU#8e&i)VhoizBY}QP@QeCA*a^wY5Y!DRZ zEX!~I4NcZ}YYrc{2HG)O^OcJpSpREH9?o1)n0=>CxKaZ z>(LiX4XvKLcFqUJAVwpBf)GFVWaQKmU6*i)vai<(=aOZt{)gwh>lhA?hS*;$hIk&N z7YLI`_V1A`-T=r9M^KZFCat4g=7k|2&W(qYN>4xQ6LMpPoXfZ#Znmx#gANs*H(&>P z&xoifUR1R0dwqCAsci9VOE40e*3=WZUaJn0TV<1p0UF-thgm)#^KNj(E-S;e4eo4+ zC-w`2oUUwwt!v1#Uk#jgktGat|M{43BVw!p8Jox{Tk^jGYkPaLw3$HeMsdlSl&kPR zJ1J1vk#gNQaZqfDDdX6y4naoBf@qq6s!Xl`=LyoRj5#PeKgfo0*jD2)D(Jo@X*2(y`<#taAht5J-&Q_VbJpGk(~c<=dFZWjm&UcSA~xC z7o6+nKXUV0T|UlwBIpV-T>v1@2NL;;j7SBcw*l@VGkQ!q6S27vb!ZdT#P#wWI;5zK5JJCB=M}{*I+;3${u05^l9~+LiO?HNa)TO zmpYP7;RoJQinr1Weo8R=YU*63`=(UxTl;^yztTwO7{wTTXzz$XNdqXi`F{Wv0z?%` zSiLGVPnk7){ppI}pZN5k3aKpfA2+l-VQErU=m!rySJAyOCee@n)DB&DKc0g1jG5W` z_OFCr4y#HCRXVBRH-eHaK*zKF{r6+Dt45zzv84EwZKlsIG_XOt@Z}NM3OUyWB(kL{ zGr>LEKcNxXDu4=9?GTPpGRg@zL39uFsu+=ZI~}*#f(TpB&Ca;%R)5{Ha2w7QhUaMo zYno1+5?|S(@Z(cYm})JkP=P%tpr~uID&9XoR9;#Tn6g{s!e6wvtTkx((+U07;tG|3 zef^Kmx^jcXg@o*%b{@Oiwc1uJCGUV-srC@4hrWERL8n=7u1 zv=i)MDRA6HuIJI@qF_N@xXkJN{+dbfi>|$mu0ON zVe=K8A}-|vcH?B*E>Ej|o^+4swz2&E*rd&<^tNq*m4`{$TLyDQ@HGb~p92 z-57fN0?@xwT0PBd&(YTsNL;(=AheYUMRjQo@ZVe?`JZT2;zAui;RmJmj{44j{iV?+ zqo!^8g}*yD<@DdNAG3bOG5fP117ty|=FA4gZx(jD&gEWK=Sy^V%vQ72`rO}G=-;U6 zS@;nf2+XFHFxXH5jB*Dm>nf~R@hrR0K2>$y@nTm6ssJ0Cs8Y#apwu$>t((odnM`P7 zwrFd&OKbrF)lX52=-3mjjL*3h+Wl@4#$YblSW%g&QEU=E-q{`+|B31>&r0d-Nf)@( zNxfsWM!CMd#%Oj;qD&b_#d)VAX;YM$ZZqYC%Vtu-rJNPqQtB&oHT{f}pNs2j}a4&jwzR~O&@=5;wUb|mq zg{~`t?;fjs!l*J+2~a>wykDmC&;DwB@#x8mBj_!M*6K8>2o{~e9> z8~Vj2F=-E<#M?f1{#G^fN5Z6jdjk{K2xB2*&n{XL=U2Bmi=+lfv9c5Q+>x9k>Xk)dFBDR!g0;T-mJ@{zQYw6U$8A6eAY^=EoO;7w5o zm^`lp@RL5_PQFVAdeZxDQJ${f|8~dA;EpdOcO5akaM#bKl8%}xrRb^axjPtdiJ6Ry zoLVeXliJWE`LG%hFIFQ#$Qi9|xv5$F!C{@li2!N74850xDT1J!tC5^$&K9@!NTgL%yRuqU38vP)C21SVr8$x(qeWw2EkWH6Gf;9*T`Dqc ztE^bLrM8iW2`Z~K9q&g!1=mM>xH5L+;y^J#)e0xR)zjcH8I0h5l}gY-%~!%0$1(<~ z2-C@o@0`0Jq+!@|#m)CWh)7QWK_nOoq4-Mn))Sq}tc6L`KP{P(m$w+|KDFm&eau zfn|&SRHN-KqlU>F{>CEZ*^OkA;h~XFOTt}N1?-y5JPM-wO1R(`)_rrY{Cu3tz`S~z zL$^dDLuz#%&DPrF65QAFnrlrwJJcCTSIk+aw`1xZ7||aqozTFp#7f(s>Ri6u9NskV z&(+oF=j>Nie`f)Gx#aQzFyv_*Wo4XaL}V_1HQnt0`_Es6Imo!~B-(z9 zqCv*W&F-8`t}gBYu7nr6az$sm!nn-aD>3+sD;UPMYvK{5m2-Bp1NZO1phXOAXj-RB zR&P3|iI;M{MqUipghNl{lT_$!^_aIOlcrpMFo;9&%}Zfk!8==Wu27dItZn3x@_K$I?LWH{NW!-S#_QCwP6-9i4wml%4Ln!7a$!PEu1YDs+}V!G1=V zU!&zd73W)kvv~IcQu!g}-vSKiV50n=9K~0$HuzfcfLmo1GS8e#mSpu>>_+HX$YA-= z=*>q0lX8^UfB&QbW*zSXn6+XY-%7N|Cdua!RB%dMq3m=V#q{D~{SKdvi-xMiS>@3` zJetQa)w1C$BlA%Pnh340W&Le5euL$MP7f((?!#cJ2@vK0fb-5<05}(q1I%!9cT?Rh z{J)zEh+l}zBwv8Ub41o_mfQW>-PE(*ffqrQhVX#q8lp_!tEM%Q7$CK~ZBlyvzkebS z0TY-(S@9RrQ!tTj=J+3-1HVz$tB*g|@9o45y8ZXSCLt83bQbuV3(y~}&QCH9My7UP zTw)xO)VGk0)XzB$1;1OK_`aK=_I(NHR!&5Mauq-FZ-W{o3-IFK%vWqF0F8xEw-zTm zmg}}_j*jW-Qi8b8SYS&G{g6S)!PqaZ$_L)5agG>wj!&xqd5;wYE;%2`lQf(Zb} zM~wox!ft=-LF{B4gz$o4op1xp;~T<|exiwYiJpArj+$#Wn!OJGp)PvFVCD3OdFC`< zeCAHl#|~@{5tCQZ>+XJQrChBcy?vJoxRtUI)Op_w^PuIzFw@hflw;9f*iqr`#t&X~ zJV=r#7|KYQ;~4)&L&6Bq;6czNVl#*!8j930w`s`1R=P!|*&Z5(>CUBM{iCEUIKFpE!&WQCyD{PJ&pP3#$P05@CO0>Z|M~xr2 z17d);mW>Tlmn16slmTYZ`0F{frTZ)pwZ2pH?Qd`Zz~ltVL81)cCf!@FC|SC#ShrK#MJ%uGuQetyX{HNM1N`%~#$iR|u5il|HB&fBV|H8p z!z88IFu^sOUhPbairvL!dw4lXc0&Q=tI(xp14^K%(Z2>tB+l7d3)j{)mVllzN&)$d`9-0Z^NPl zkGHml8?)oKKiI}37#+F`F`6%^EpDq=@6P|{ll5oN^7TcRvLZ%OIVfF$2N2|Z~LiFMZ9eUoMOBDEG|bgL zY)_2lD`^hM#uxpQTa!7f7bz&hp!4!kO)onCN!f|08=62Rz%!9ND@ne|GrDyPJUHsd7&4{Tqb*3k1Z7Ilt$dy@m^C(X)t6?Yt(IBxHO6vzsxWJzTw$362E76n#zH=tZO*p?L}U1?`e~l~mSgKXMBUp=HVhhO z9Rex$=gZfK%AOPUWH)CvY+1s1Z+(A_ri-`WR+e>+&2Pijgy#)TDY05iLH%1l&5{=1 zzt-x0yj68PZ)T~HOZAbniEi)5_uDh?w6|~EEf=k6Ltk&BT3|TFx2*$T&+$$7Cce?Dt5x*_sz9|jJjjV_*(~DOx4?rN`q}o0M zRUo?)DsvVL@_yrF<`L|diLCPF@O#n3|OW*S;jtyRBAJu zk;{RJ^Ik}axpsKP-&u|)J4`i34`T-AIGlOsHxcGT;*chth@^?(((_R+d`(y&h2!Ze&JkB1cFayGw&`5yK3~)hs}ic zp_i+U&(88}fj~*;r{Ba^t(d2ZxP!Rv4-NI|aRySm)Us~Oy03lDhSjO0LsR&|gbRh7 z+Rqq}ON6+6sQj_qpLK{S#J!KcAFJ+XQeAorLT069dFW|{4enQF*W9TsfYRMVa+2C} z`y=LR36O4gHdpg2{t0N-C|Dsth~^Hr1F`B%b-y)$?Yi+sqcifLORQ!RAd4xsxF7QZ zL)6|B;mnxZLFUuq@wsk{skTuy%uP_y!7iI(1%EIP$8oOh?u_k8fAkmQ!rab5g^%v- z9(+Zt%{_am7LpVLIYc}-z(6|x!B}V-@V6XLKh*nFv6AbsCaXRG7^V&An{u}AWp`!# z0zz%Sna2V`&3sIg@Tc?FfIw$vwi&m{EAGe}&C`vQyIYk>U$*8=3VT0Q)J5GfiesWU z%%))4`Qg>xOzom38oBUZ!-bKiwG~O_P4nbmF)r@;7TRSe73K-fw5httzPl3qHQ>Bk zc3VHl)sC-pDi&2B&5|e6$%ljx+^+Krrxr^bXIYmqtwlpZ4py2|WTVBc{&r9vKB3IX zy)t~6U;V91=<3gw4j6V{nsbe2Ljh~6Z*z{)t#DST93@ssi_XrKE5dTfdD1z{&Lhpk zxrSfzU@LLe<*D=BUznE~Y~R*_&R>TewRvCOO@y2TBaBFYs`uhLvd*&3kwFX{=HMA!MN8H?LL7rwAmDu2I{qHT%n z>RsA|Nra2~h)^8T;Q^txJJ4CZj&_ zC};*^90;HkL_8jkIrGaD+SCBQlu-A&NNw#jbih18lqt4a4fB;4luSF?{u)Yj+{&{|lRlF!ru+}a% zOnurhGF0P5%J0r@tG;h@r(_G7>VxSS@YxoDsj{0TukQejoanCk=O6ZnVB24bdj_vNW*9-&~2Ehp<@0N!HW zQxoyH7npAjV0b_6o`-soL*m23oq)oag?U4I~yi4&tn<=XLaYfX5MN9@7vMqQ7Z?7 zB|yDo9dY8hl(CQ~;L|?Yi{xCKWeZOx-$k{A%~jaW6=NDAOk&9cUv&^1xOzH{AV9$@ z%ofIl%(B9X6=!U$(oCOR+35o!cw=5nGTx79ZQn@H1A_6)zA`n^k{VG`4=U*EsaYrI z?8TLHVZBal7}}ls<9&=4?+(owT(cl?LzTNEQaH6F-ZsZ>b_L6S6{V@qWnrzq(IAjW z_Zhg{FX=}8y!@G&IsE8+q_9!U#1d7x#)_W9#f$H{L#ICorp;xid(5~vf3qKUo8zx^ z6I4knYUO{FARGHM-QO9qrbK`2YqOiKiE&q$(%DP#NLt6@?nRZJBxyxoEOT44bcKjG znVamX`Ib@MuQ63awXAbaxxUasqRDP-Jk)3$R%xB{VumTF6M^dmGo~^*N^BYD)AB*_d z{-50I-ZD3ZBAWm1tPK-<4BVplI70uFSJ);aQ7-!_!Fhc2l}N%%Lg66Un)bssY%uwR z&S0$b&sbaF49$LAt&}aLs6sotw(_qsmwQ5wKkHWW z+@vHk`u*$v8Bxwm_- z)X_rJ&3F9h3@Na6q{k;S9*Rbv4Mn_|Ss631j7ZofmX!%HgfA>uPxs}g>@(uGYj^kigYERDBr-|hqmp2IcyH|ps9STh_WIn9K^7NZ%#rWwU~OpyNPn2E_A zMszPBM$oC`$7EL;>FV5I)B^*94D_$*nAvh%w)ui<#P6H+5Ql~+{rde{Wl{39 zCOf6dRt9|Y^E=5y*ZEGOXpZgw(HBR}%pIPm*a)r|ur}N>PoZcQ1hM>_dxY@y+*irU7r$NP=yTE$c)LaMBWXUS zNU#Ql{?W*(vM#!J$9^t4eC}mnQkkA7S@k6j1KfxC$akJn*T6dZsmHL`u`F&}s^ELd z_24qrTv**sS2x2Aeztj-z=>zeDeI_D(kD2y^DDB)=wgkEh+g@4xx>@s520;EJ3)oK z>FXj;b=m>mGA`FYwe-Vgf#zvzxcL3~3fX%~3(vbFdD0#(8M3;r-}g~_Le3c9@~x)k zax~sQ?}m7R5P62Yg~v7gKeAv(qVyBYxSc-*lQdLt5BPqx(|8>I&oq9{eAsY?SWL%A zI7hTcJ|2gWql8{?dqf$VWekjr$}r}|EG#@|Am~VW!F?*pD2cnK<^_k2HQ_bJXB^k_ zQ<(*yUCIp)=ht%)-Mw&?I``_KxxzXBi1BJdZtGUPva!dKUojrZZ^}r=u6!?YXi~-F*gku=^NtjG zWBT>}T|3HzyJsn4r0y3)su)Tz`OC~H1g~ZndX9+r<>uxF^<-*F4wQ(aX=!QgLB2)> zZn1kVo!pay>+ZFICsxa~cj=2Hajq~}=fv=X-CJXjit12OUDZFf8?>Z9L&?v7wghgS zx-xz;4MtX=(uzfw@6*rY85d9}ReGiT#bf@a*WS>PW~WDDH67i>i^P1TPSA0u2{pzFM$^d|`8Ca`E4nMr-U8&4T-*K8;C2b%Ud-IwU1}fcE*#o&s^2jwq3F}Z$Gp8rz5LEE zu(vskKu})+v_aX}IC;qf;IfCnnPrYMZF@IP)i0e=NpX|GrB3%skDr+$Px1DB^Naqe zeSXz+4_;8xp2))I5*M%1l==F!_@48xtK;Ky$plP=?O!_ubtO&*W-HpLb0kcj5cWag zJ;C0;{kWE>l*(OEfyzCj-aXD!Ir0V5!_quw1eEX1zB_v^REjoX@;>DN)7Py@S=psD zzCG;mxSbaq6My3E>O>RYB<6EGdk{Hz+eUr6)9tsoh)<(gwpM{Z++M+_Qd(LRffuel z866#c5=~Tn^5E;vfkS^{ltRLU8y*h7eA%J}xKqAfPSag1UyFg0^TKs)&O*e5eY$X#w1E5woxalZ0>uLQCT9t@~-*sO0_-?#wTJov29Q9Jh%N@De)DjuOT;e zlUKPsJL5aa89Zn78I4L0VPqhtA#;7*nRblFa^Q!o>;M;znbtPhsoIIzuV;w480Ua;Gb zdfKJ(iDF)#q*bq!7~nj8{^*(piv49OD#msGn6|^R*kM!uIluo_)YVHZZH>D&BIB1d z-#gbyphs8dBipo>OFzuMJx@k<6SP}I3m!e?6pQp+8=>9*BrykY%o#+&O*mM@SAF4> zC9hIEFa$cl3J9pM6js;NOo5(w0`%A}KA^tkhp*^)Tk~QLz3n@E%Jz?8%07;E%w@NZ zk6>X{k}#JzzkKD+`(nw~^NMySiNtqd(f59z9X*z@2)qw3eGcA3*@r!{)RK$x!R~Wr zbGh>}BVFEP_SX%9m*`~7)OLJ9!09=%JMiw^yTK2}zMQ1~0KILsL1yD4zwsTpkQ*ny z2ovL;0Q+eA*a+*<=FJ8nT;#EBY620 z^t6RLI_WXHL1dENt%naaA~Eu#L^ciF`yxeHo17&Vj;|O^Ja(RAtFnyQv#;EVC)_=9 z{D_ruGK-zn)XpJTQOMin+b+(yE6$sl*S@70OkO3(rXnP6T666&l|Au1!ux z<_rp5?z)Pa2`5w+-BjRW{VvEsm(lx(`zvp8|FgSvmorHC92R&4ik&`M3v!o;B(3yY z6%dbb9@^vQeYZRA!K+zz?p%ble72s?C1*Z*ET$^qB_fZGIDdk?r<@;Wja6pV-XEU} zQ>Ef_S^7Y{q!7)Q;Oo^9sWvFTe)xnW@PvHSM zz3?datOQvFN)@Z5Ero+0T-+nm7ppqEf5G$qHnDF-#XAzD?_uWUeub&V@WEUe^e38b z*28k-D+Q0b8`5dNSRKA!=G({UE)n720@oVsk)Y`urGUNPxhooC8yg$dSRDT!VQ(E3 z^%}Je3!;LcFf`I2-5>%ofV4CMQW7F1qNKpkA?VOYItKyilI{>`kx>EZ8oC*}`R);Y zzVG?|c;B_oI2}Ox`x`26)N;zKwxF&9bG5q*zeWbiY?vc$wi>>VHKljb(Pj5OE)jQnlAl;UP4rc0DCz46efi@paebqCpuzBE z-Eak~nS@>R=vwOG7Hg^93)t(I8=XESHH(~McH_=Zyw-dt2U3+o`a-0YM7$q?jMI~2u(g7q&GSpW#dLSW+VpBA8jVbUw`HntTbh;o$;9t(-q@aEbsJy7_=RU$v$K-llM8fZOgE{tGviVL}xWYQebYI|?%`|}67T*T?R z#YcV{9!mlqXCqYiYA(J%Ax3X+<1fv0EnoBN}i41RL-YRw8^^# zB_|6fMq|_Z%CAxwLltgFE^FU!gUH;vk;0_-A~4bTo&DcS^HF8GcOz%1cVh%B;yY;l zDxo(LH;pJj5$4p1n55p1&QniTMB5azVr_f?I#A@#TIa<;mSXN5p!(D_GBOh8G5;Uv zh5*p5WfKc}#s4F~lE`MokDopTB7BZ*dU|_F@!!9H-+z@5`q0M4=G^5jT$iisC`$cR zowOW{K>z9m)fh(3!*%{R6pS9UGo_GEcy4!!PFQ|qQ}@T4i%r9yxlL) zbv>gq8OvS48Fz-vAPTnoo%at}A5=MqP*Og*P*9djJnKn!=MT7O@&+K-=d$RfYFlcOo8g?C9S{A@}-|8gK>tF|ztic=LE;dl-VterbVo{KH zGBarRBlJ#%XHN+ZCrP>$w?41nmM*V*h~PdwCmSkHg-NN?asffQdf#q@ck-pD4Sv$$ z4~aL6Z?%n|$7HeZbriJUJMy`h9O`#2X<|_}RZnw}D&49=747Y|NK|W2HHYiHDxV0f z(a%z4ZD#b=7XN7V-(;a<5O!v-dJGy0+g!i5y;&YZoYK4cLic{9eKfC0{H$n1N`EbH zmI@c=lb%%vRil6yl?124jnjipf3f|E%s2bP*Gox{QAck@e_vjZt!w_~tGrpLo%cb@ ztP_*j@FYb1jgn$1a7DPj_gRh~(cvB#9kbj$HoAKC_Q6nVA#|z!>g~nBo{i;x#Rle#sdOdc^UsSoaEiKcW zx?`ee2O9VERg?F3@dwJES~EWE7%H0Go_@4{WIp^dJ*v~jH;%fsr1|XJ%JOw1g4fBI zoWj5_8qH^1`flL7TT4sp)4+aPf2h*8uW2_}JU5>|@ZJ(GwOE_)&)d)Pg=d}bUbX%E z>;O=lZd*acRC+ultCuRnWn?n*&HD;!YZhB2;@NIwSKLk8e_f+X;1a0t_^ZDq&us@P z*=Jy~xx!=bWxGBY<;n#UyB(D8$^K>1D_9n&YgZn`0St;MvyoD40T)2MF{l^YZdbR= zx-wB;?MqI${iJUVA#d%9Bqb$Iiu@Qz&U~ue7JbgGCD(sbO>i|#<+XyM{LSXdjMN+^ z6ZxuP-V#RvK2wYC(kq?Vi47G2l+DEy@g`InjYGQ&%3thS-^v;(`@QU3!SnMtx4EV% z0nvE+Tj)Q_N6!0=kHn;!+5a1|5sF=@;NaQ`{8#N3%1w7Q+j4GXPi-si;rX`tc@}Ta z4>%&Te76NBH**_4cr0G?r9pl)G{@BLpts5?Fa<0P4!2)wre49p$K>aICh&kJC&4cs zwnPEMc;qt{K_eyuELyUE{n9Gc2l##o%>V44wdzX~@rS~5s%eeRwT%0;xbEdGcD?7{ z7JkiYhzXhvHtp;Z=^CRSELp^oBlsFkJXQo!lse;cm=K5-)-&7j&rL*x1|Q#0)a!=z zlQ0)>q8!E466L!Dq}#so-TM3HbLp^z;INv-BsHGoxLAR9iTHE(cW}K%WG!2{DX3VF z!AEKP@!x+$Nl8ze@4ghDCcwpE1M#G3>HsX``Z@E}vQhfZy%!J7 zJHpaIkvqi~Muvk`4u`FrzuKr$;IgnenQ?5cJ#Vb<{~C#8<`{L43TC69ej&6rOlTSc zThWS-mC)=bK@AY5i30I=hGH*(^{;N&IVX|A5THw|-P|&~fM3DVsft&VVyS z=rXueXZCMfTV*iD6yT<+a{mURfF!|dv8-MibX=E&38fkcc0c9J2yq^^*aBeLps+9) z7|W&i3+#W)?lqe{yq=+lTOcu<&t&paxr}J_FyBt>`$J3A6P@46PbK?R6JbQ?{Ik-x zmpq9-1Isgc2;qT|<$GbGL9oLE*(dxvO!_ z2HqN1ITyj?UJ7^@FlmsRuzosv9kdwAk(>5u1Y*liM>AH-t-1Y);M zJSlda>D3)$bs-|cnE!$o-x5mwEzJ*8{mA4oFOZg`QL@doVG*Uzh&tNTyL#}>6nGbw zO#}6WqMnI+)&)(A^4~P8sRrIyJ|0oO^c9?ZjVnwhdsHh1qTa{%z+%$W?d|QhvD5cG zzZTFF&ua7PwzuB`AD7z{NRm>jKMp z;my-MdT-v`15OIzptL+)#nHX`_xs@__Jixm13U$YLmF^GJ4$t)8rHqxSO+Ui8)6a? z9svQAB0Y5KV=<^Irc@9KRkbTcwij&mCr6B*-8ekI8uwB_I-L zPKkBOONtK|{ro#L)~xy)wW7Lk*!h{nmoqfzoG6Zrj69#&UmxoSZHu%2SRa7``^ZAsDthu1v_|Ls+9piTT*%ndFhiY%sdBV`La!tfaM{zYwTpn;$Qc8ozX zYYJJb({h0^(zBE=`F{`9G$Z(4=mJ{#!B0;?{NUEyV?YubTjMTbs-&a@^gMUXDg1;> zz%SjoL&b{YhoROUc1B(P^gB@8Sc_^=?qY#oBI&o1-VItHKY%}M+Y(T=^n;y8t23$u z|4u^-5#UoOH}uJH9zK)@m(a1(43z4-piR$t{rxR!1z;0?-wsPZpBVhIC#~<4d{{x8 zMz)mF{5gYu8koF|r%Ne}p()<_dzjgQ9q1K6dTH4qODG`+ERoTz*zf*Tu)Y{@ASfhc z1Dx2~Dl_ImX~DVjBmM26BbW%Ta9ua71Nna$Y4>G<@YgsF51KF3ro48-9WuZeF~$hA z< z;J+~}jRZmZlYZy@tpDPZlU2ZkXl6_d>AY|i;m_OF^=kDv_OZpR+)IUV7p*3J?$;j@yG4ui-kX4#W=xa_7QvIFCR!3v}zRrC7 z@i~c&OKrgXybcu|8|^s@!DS8WkihwRm=Q+9}ItSdd#4+DuZajhr#8=WR>cvQ*k$- zSq_2p<;Que7Fbi2hciv9x1I1TdOnCf13ejpz)Ox{EUZYpK*fRd!#1uwyVm*Vx8^VA; z7id&Z&eO^HPHL}a_AjyFV1D+SL}h51&qQEYz27DQ%``#doQj9$E3c;kaBIZQ78uWq zzD);Zr&*b76u(6y`UBech2-ytX2<|7!=m9Tn|@ZXXNZc&q#@zguV18a4+%7|!f>k@vti4detNRbq^sr|HWq( zl93yPK94?^6DU<Z8O~--pecvM8r*V>tOjLmL&HuWVaPpOc zcE`@=QNnQ87jIo63CuU5pXg`URxpH4i}Cg zd=|6Utmr>;UViJIm_QZ(jQZXSB0xnbbF{}LCMp3dy6l;+@A0M8trpOt2G_NlvJp84 zcS4<0@+B{eGZv1OtWTfVs}8-32!|hnx9JITiQe9saifQ@qpV$1lCW*|*td$6-va&Y z*e@Y`g)_7|I))hu>W|h{_q6IMD@oV<{5o;e=|+^r6sx#qzskzw9mb2aA&Jn?4!Hki zeqv?*2!{zL|0h(Hi89tv6=caW)(~E~cQ3Kip>qR=7jYD%Zs8+yv{)XaNn0xp=Z&%S z1)=#AZ+bEIMcrshAs6kSO4dfKCD%Ra%AM;fn%uAof|#k3?^>V0q_ns z11Ml#aOcpah^KOkZT*|76#13CS7;B9MBia)@Z%>S|LIjWLftlK&dxS{b3nCWcEtep zWOgaiAOx%0=Q*uNx8C!Q>ME zbE`ar!^|q-Q63+nX_#*JHPwH5VrnsA;Hp=&DQdlVR_9g}6}!m5_A~gFT>B!Z6rOnw zj=(^pXgAXL^zF;Rd`oQPH1?k_@d_?XQ(YUs+Za!^1=EG_&&L2aVK6eh>5EzIO%e_C zh^nBT$V+1E-4?@QM4j!@h^hu&`n_mtjzyFk)?(l3_V~Adcn^PPH({Ro zw;Ml6N(3EXmwBQk21mcmxx-kVG?nvomY|{I^=5#dbfd@rurN{5m=IGUmR5jUYZ0Hs?wG zHp2E!oYzV#RmB6~3sSm{%Mv>wq~*h4_nc~-0Xpw-vbd&9zm7QRc%OsK_pkNedg4P* zib?1-SNx=UUR@VSZBalDwwd^zxy;Cc@u_8C)_J>7R-g87cAPtF1q)wNqB?;7kMr79 zNQssl28>R#0Q6vj&76Uhx=6t^Cj|r;8Krm0+AU46xl!|oQI$Dd67~B{ulVJM)CEeu zZgDT+&ZSByzxUBMAg?Y@cs~0S9M(E*KR*m+XraT2Xc+pCQaJ{HRug9RRpn%inP1L~ z8oT+lW+AdH$=XeOrAYi0N%G)Tu%nrEer^uVkJ)Hg2VDOO>4;A+yFs6^uz*R`DYu>t+;7M zKxj_jra&cc`r*D1H`R@l>wjto&;?VxzsG8A5#{&eV>^!yTd9k~Rq5SqW(QVJLfWx| zrmb&}9RjpG3q?{RzpVTKa#Gdts(=z;=N3Y@Tl2R-X83^tVjegCka^N=I~zn6R#v}2 z@{Cc^kk}&y3#0nQnJL%xut%m;KQ)AoJpVrY>Ap_$5j_jybOlaGQ2_E0+wUTyGpq^W zH31LrBZ5277JVxsbPxTzSt;L#wQR1TA{n-KwVvnHNrUQq_zZ?(5Ig^ zlo8|v4)p2pRfbM^Z|wy%5dot2=F&{}PT(rORb9{T1@^}a$@Xo}0k+Nrh6!J#@Xh~GOAdhFq>H%zm&D((!v|B;D(>#?&%w+< zW-f@ElT47>I2fEXRRb=*s6j{8rVROY3Cpb46xkVDO*re6cJbY`3 z6Q$0)60T2*8D_P8Z!wDt8W$F=vnqB#ibU&`CL19F( zv3682m3eb@lL_agJXE57w5GD@@QmRI_9cZmt-qT&E%XT}XDRRZ{$)49T4ppZvWM+l zc$8<32<{Q+g|&$9yw_hH zK**oP)J-YNpx^ug6b{d2w6usF-3g5r*q)I?B2~2W+qpSD=gISv=TDkc14Sg8(Api5 z{1W&xErw|9kA_#Y@l7{g<((`%xr?$9Lh~-nhc6X=A(^5XBt ze>;qJB&^M>p2>oK_jt~TN_4TFzHDOpiD1e^S$y-WpyV?7*yUNpTU{dRhzg{Hf-R#f z!=;(lB*6XQ^2T^QY^h>0`CIrzMMukLD>D=WN&C;yN?V)r(<4%9>QxbnLuy$A1A}`m zD>@+|oU7M9HaR&vgW(UyfogkG%qEPf(^eUV=?GA8Adwwlhm;KvB|MkGkdD?!1VW>u z%MSu*wS(OZvJlZu{tB7c-r}c%_8DEd(eZ{aY^UxUSGQ$VrDRtKoAnY=KvcO#F^}Ia znyAKJzWvE}g+R(WFndpt2gTCXxzdL>?2q@Ol?aWEL-*~n{-aa|rB=GAS+62^ z`Xk&zX)6)C@kcKWb&2AkaJ|)=CW2!;Sw0!;jokss zy7%T%e?8q9rIU3LDSe$x&YQs;>Y^BF9lsixv!8s+F;Sz4C~r@LnrjSkf9KkYyR0>Z z!h)1>hdV9=DH`_~=TFH(BnmJ&b|)Q|r#g6!#X@X>sPZjQY7G;xo#@wDlox~7*QCqS z_64-a5QGOb;BPan6-Ag5`IY!THmiMlU_eL9d8Zd!;aZ5_h&=^3UlF6-n zX3n~n(=Z_U?O*`CQ`6h4dI#)H%KiF%p0D!$ul{~A1k~iIy0+jrs0T~eLE6Yj$)=zu zCfJhz8o-87is0XcjCHHLQ{v_*vO_nvgSJ^9uD44E^AbPXCR>Gtu?pZY1u#1;bg`=* zl*2@a+_Pjw{1!3r5fT%Sd?C2QfSNfVzkE%!;7ck0$~!7`9V5V*jg&lwPx@YX&#;4E zYVGttxrzwKixstur)6lS7NWwz!4Yzpoyyjk0(CD-(aa*ptE}3SgOXR*WLJ_B?fs5t zN;5QyF0pB^?76SXg|b*kVNNNbuIQyfC1~k!_UE`6w1lsVv{U^`=#*3`OwHF%!Y-_N7M|F8H z7cjC6FHh{q9t=lxuKgi4RvyT)$s!aK6hf?n|9_7i{6a7@OlVv`_m|bY(v=l%5g#?K zSGC{Dw66|C{4D0_d?_z0k(SR1{HTN*MGu8v$EE82*WWRt6s*pHDkT!N>>-8ZlWrY0 z7u?ZcxXu2X;5PQW9F$}7Y}HgQJzb84MGg=|Z#rqeV9BxdfOZnQ?>z^4=*Ii^-yYx; zGNA+>lehf|!18RK!@_ntrpxjP)* zMLk+JGm0M7nu{IT+4XjdrGuv04>R(jWO+E~M8dymrZegt1_l z93y4D5I61xG#QC(g=HvbEC!==7D<(GLujqAae`I|Pi0r0@pcc_2i{oZA=9~&%Ij}A z8(kE`)1Imqjvu03+k3lCj=5S{nsfUOLn8}j-$&0*v4HR$FY=dA27*L5?AVB_ZZYb> z$K$|jaDoN=Hx47}$$`a@wWQS7Q!ska{v4QrkWBcTte+cD7W@nGA$}V2(8??AQ@Un9 zBfd2|zDqFSgYNY`a_mcmcbX3dkY5y%@9qi?4>TUm8BW4sqk{3VsdptH$O)Q}WMp)& zxP5>c+{|28Y^4&eC_7eupC!q2Li`ok9^ae>6{QWraXll7qcq>%Nng&%G-w|t- z2xO%>aMl0_fWL93xQqERpJDjlUAHnO2r`}wmjSiBc|#6rd)je??xYV+W7!`3Y$ofm z`%|%KMzrBl4)&Q0D=h@pG%~sRPYdu;I^S(`@*ZHVz@+6JN7fWJ7J)`cN=4(&%23HB z)15mXg7u6c8denfLRfq1(WDo^dqb}~MP!{PY}ttnR^{IaYjelne9ikE}P@_2+gTjdL|`jO1nFj6$y!02Oxd zgTa+vsn?rgwQm6-W6_Nq9@ZC74KW#npoecC?Du!1v*mUVdF(DpgZfq{P{S=peKpOn zZB{UAh3+j4i5zsy%jY!-Tu}o3j)1Z5!e^{)O^xBN5-NlPP>m!by)}iH^jEphrQa9? zrzjMUtoc)pnc(y?pd9T@DigBShrYE*EXx+IpB0d|aIVM}4v8R>RU1Oxk1|X@*RhpB zyy4n>O4;w(kR&(kzO121X=#;y4KcdyW`DVAS2bi-$Z!V;i$`9%d`tSktf&RrxJ9#2 zD3FqY8twBnth7*=7XK)a4Aj!uZ8rkaSAM)dA}B7%FW+x+MZ z?4@9rK<)l6$z?Nf0r>=JK`%v4H4?WQ93;0v!Y(g+bPP%ndGgc;3RUSm`1xc^l}reW zQ7}z}-lAth@JQBI-ONaVvt`aAU?t7!yFFZTjEr(=zIFvQ61S|tB8pw~W+L3^eVS0R zqXC9;wq4iz?12yA(|4nD#DHtRM%)DHHcyYAH{%hFhUv;yLp+Hhk1YneRd^~Y?UPN^ zw@{9T{_3Mi{8sQ#+-$OS=yEWd(7MI_nVxtAlMDSbmv=NLtukr4Uj4_Jz#JJKIhbl* zLb7CV5AZ&-7VjPd%Qn5^{wasAx9&Y_xgu0^js6na2EhH0@=%UPdF?{Nrj6%zFF$-s zo&F>eS$_73a-rBLhxFGc!WF^j(XhTU_-zXVoLvWW zVrS+2x&mR~oqW}7{f`h+7%&oEbVES_d5M}sID z5|zqbV#+}+Bl)6o`BwrE}Wz;RA^>}!qW zBka9~^m2UWW?G_XZX5{mF7=E*^-2?LoX#59(bM&|{*M$T!p~F=Iy)Z30?v~-ajs5V zx%m&ej=47vmNCLWKvD_J=H(zV03qigO8vE02Ap;SS8N|0&~~EhyYUa>Bp9^K7K&>G zRY$Dzk})OT{~B=s58`k7#PbJTHXd?f(4`6_!Z(hEZ{G8zH1DDgZz+53dbA!ug;f>a zy8(}X0EReq>OKXp(MPa8PDhl6m{VIni`z*{j^`4 z91#M84#g*eCFB-I-{;y6KlWfK>LOE<1qcGUt>2G zr2*N(fU2G9d_7k66Kq{+^8>@bKPTL#UPr1CmazlQVdUM@dq!{=`GjcA-iO3oe1?9f>+2 zm0)0TfiQ_tsAW;7jM`NH81D`g*d#fS?9g&MtLO+gEgE-!LHk z!ihp(rP64k+UR!tv6{o=S-EuzA`SBhbq9$jr8cI&m~!*a>%kHy`Wyi7Ofewx^qjED zqDWmc8>)HiofVda7-sYA0mXMSdrqFUO3B@95s=pToSL|i-K*P;bn)9UEW-13?{CxV zm8}dMIN+g6GmvS9hXuJ_IkbJ5^^`z@Z|f#?yu|DQJP3pO!9-q;|J56YTvuR!^cW1! zY_O|{(KOet$u0JMm_^Au&CNs57v$u`WaLqqH3{&Gvq?SWHN!`^kM$|VzP7@dn7XJS z(mI*f#WFLy4KlAkE;5`83#-_@{?(o6Gd92o8*VnB6o~<2HPvc_2!`icy!%QR5t3Mh7UmPAm{O0Yh zWUIonjfUFGLFxF~E3^1YAgfic`(+?BgVgEk_BquXxoGEa!Lig*lf?;C?xw!+=bkHJ zQuULvK#;IB`zlEqEbmC4|Mtz}adu8l^fA>to0LH2zxa;j84sl7Q=m*)dH07@HAXS9 zIZ>DVHB&p@pcFCLHXxYLv$z}kJ5RQ6Sl_9mGt@T=4{uIY_0z95xr`s0nRgFOP6N1bYPx7)r)=^;i!DM22KI2XF z4E$)J%WZW8RH@wRJF$9aN5`-6TIV9ND-C~h%ss4~5ZJYAq+sxo)M*Y^?9exoHuJy2 z!kcEHg|!KkPGATjPN|d1<^O-u|}r-Jb1 z7LoCdx?i3orKo1zy7S*oluGVB;aFwf+Cbb9&$x5V7WWHKFXSMhQc`Ic2kJ?JTeq^T zftBw?@>{Z7j6`cpCP-@W{+jL`vbeIjs5`~`Psc~?Ej+c=wd4HmI4RmcNN|tI{_Z8s zJ-G9(PuYg8wrYQDU4=p|J+)pipzIzS&|XV!@MB+=*_cPiZotx?WCs5NZMDdkj)ZRG z#>T|preWA;0JO8W3HvTF1$_N+bQoZOyJPZ)F;|+{9>fl45k?u7QOs z23AH!fENGF!e;&L=pob`f^=K}Y{f}9O^!x1Gg}Tf{(t3I8Y%1~*uoT{?pbO{no9lI zI-`YDVrbvB{WBa!L0NE@`#TR;OPYUytxs*qe_Qafu&?k7Je+did9F2pN;KhMb34<4 z<&gK%Y5e^8Ap<9-j+7+cz-fp?BLrrYt#tDpV%PO?eE6@pfbEMs^hF5hmLh4m{!$~D z0E$*M`w0Wj9A>>@8|u8!n@(~{^BVrpV;aYXrGzrtcQZm51E6`ccY26 zjEX<=e;Cmn{mdAf{VC?Gz_gh=x{o`)Ux~3ZQoHMCrsajtQI@LLT(9I{yNrp_w>TZA zW%qwZjz*YNWEfqLR$g%v;7hws=p9pB zo6jS0-!Y-=tDvl1YXajvSPMqCT5;ci+X&s^@gZD~`9TOB0;*BS79?|SU%O#?{KgI4 znW2c}s%HEnjkt`Jsu(gzN#wd+E#ObB8?U0lD95kKM$e#G;OD_m`FiZPhjfeiWeijy z-l~UFY+nee$oL*gpOPfL+P;aO8MW|Te!);_wu33Us0?E%4lGRs4I5wrSy@?6?i)2A z=a+%8uTp_-(Jxx57e5%19=N=${Dl&W=HLC1Ue?>1=IaXCQQJ> zH*%ebQ4YGgjsixx@@c;3wGJt1w4i6P_ZuIZ?vnS^kHSEK4L*uG^BY0lCq-Sl(edRb z5+71^qY%7;gAL!y3L@a0k}ulpE|rxj4)%Z)%rJOe$(N&Tap%Fs0T^5H7H4tbYntNg z6Xf3b;jjF_mDKyx!T;fB&{4{1-T{t8w}I=jbi+u!n|te7dJn?-yf!c71w8R(fB49F*K09r?>oj1OjkJU?hRy{5A z1b0}eZHLvzW#OrOB5cLPZDWo44~@x0qH&d)2_ce0ZGQPMy_jQb;C9_758#~gN%uoA z=pUmj2862FK+rh!zs_thoTAQCB*^QSBZyw~<3sn=A=BmcOhpcH$tI&Cl|-y+msMQ> zNeKz#YPkhqrvCyk*3VVrd5zneg>8S=gcbG1k@gS2Ga2cQztPPi{h9uvnFLHEwhl4pKZ;SYbE$%a_i0U$M_`PuaS zOGJqef`urNE|}{;-mITnnFSK47r=A|)eg3P08<4Ci$;cNfy+P2f=3CYm1*@`JWt_5 zTZa$k9ex1+m%KqBoGJJ9&7z+GcF3_#v0Aw(oi`kIj_)P_l8=2Q%Hfx{sAQ(bb68uR zwUG>9XwLVxoi+*%nrzUQZv9vx1nfWxlQwNOD&oG&6Ffo z`aPDQ?FVkzHq8f4TGkDvusyKbkA1{B#W+4Tc0P(Mhivq4jMsyOw{rg82>F=aL3#h^ z^9vBsI8NVSa*87~-g9nmeN3;rXV!g`Ky2R}bUEjbm-5bnLqdpGdsLxr&NaI)hON^c zgA~x(8AZ;Mo2y93`FeC9>IQ-OTR%2TnA7$EtFYQP6`KwT1A&f4!{K=t9_B1mqr&$F zb~^g**=>833cVhy_$XqUs>Yp>$HxJR^MO|S<^_C69*f#Znx593Z=PMLHi}nxpF{|pU5agOT z&c$CKi#NY9&%nX9 zANW{43W1fCAjt6!kh26594Pb&U|9xsDzb#pX((N8pJRkD{ z%PLXw;GZDi{jWSX1jKbpGawV1iMxgPg_hLibIWqGc3ksgV=@8DgKi<)`s11gHk2*F z1I>CT2IsgLie^UIV^_!^W>1gG!aDhyxy>h=B*-Rw>WMTQ{rxa3fB%%cU5v4g&fUp5 z`y+WdxnZ;Vw}OE6?|5C$UB6t+og>24U05GZZ?Bha13tewa>bkxW#D~dM(R%>yF!9% z1=;N8U|vQWsMri`l^h)R?H(AJsn4k2`RY-B?=JB2Jz42HeYp(}w?P z8{j4Hp5+%A>+3%<;(1>J#`rz)w1>$VBFq?uLLWKZgFRA3l?9hqsBo8E?F4cWWe z;*nhJFT8>FtE=;d0w?C)MADnO+8x>N0IL7W@gYiJV01_{I(!XU{~5i&bPsa{`30~dp|1x;ihLZvL&jAeGl0X&y$03*Sl4Cp|4ae`VevoA7eZ@(jRYc&3Y8 z1Nl8g1&3Kllun*pgCISv5@visjr0F4eHirR8y?Rt*2RRqVf#-B#qHO<9ebKYI$42z zr#XiVXRl*RG?6xk4YeFw`DSQQ-}b$?ga>piE3(u`qa&4w9v^}{j3nWHi90=VEduAy zrG3bNs{_!-QO9Qusd*zu&YBZDPMfj&L_W{eXtC4lT_4ZcmOx^G!fvQIqk)5$=ra@6 zIPU7^9XTi$!pb|15jA4Xw@!m62NmDseU4E|`%g1Iqkw1_BeXUUb#tFQ6uF2eVKni@ zbHp(#KCrS)nr0~gfj{-N6{r#!?MzxtNIH)eN-k%LJ0eLS8vEb1JJYKG;R=%+vx1W% zd3!(OZ((6VeL&>HASRQx`c19jIG(w%i0syM**xHWKh12h4VNXP`3R3UVFI=XWNxbp zLBKP@DRPDmH-^oR+6)eJy)Xh0^yKy!GiVm<4=c)HVe02E>Mgtgu%0Xh!`{7dTVXzIDp9IFdZCiGu{+#m#%t!zgmMhlut2#x-{JoqkF&Mb8vn+O z`VzCyVpTJl9Cn10HkrL$^3>yZx*MCF<)5L17ieLnHTNs4?QA>5V=p5EA)&UyF^-Mp z4Zdwak{uwg%R%cmKTDthbrKp@3!yDI4CnNS0;H-GRpvM33ynC)xxj`KPMe>tTR~<&^s&=V_8-sfAn`MU z-rmr5?2P!M44Ib2oX+>5PDzr`H$L}oK{V)Vz!K~ech4T4#XQrE<1aX)7x~46kdpj4 zelQ$^5p=0y!eJ;(kVGRDlEXW)tfT>*v^Gf6=88~y3SIcFXRQrjqmf({hsbYOv9=c$o?$Z8g{NCc^hVfeqM%v4kC6oRFH+`;{hS$A5#=s zH%*X>Da(lq4^tiv51DGWQQH#*z0*1e^O-hIWyqm6(7D3FoLlWcxOLmI;QLzut(;8f z=`U;=-zzX}S^%J9DA4S$%#Z%^gO8JFj9Hf~-b%GW_mjNX4a^Dtrt4Izq9KSLCN~|W z^VCqMQbO{aM1Jn3h~FHq^i12RDnI;v@q1%;YtCKAfR&E=zXNLkhMCuv@tj8mfP6>8 zw|4z{($*3a7)6@>N`YfLJt9x^N>Jucr;LOcJe54Jfegr3naxRfBHu{jE$F{SS$)ra zHo&ft{R~V=rChNK+^YsUn3l+Fv)dqHE86Im_7?h3xiU;p2EZ3>TR#*2VTOQn#20oj z!C1g%`}s=OhyzAYv@5s?EroEK{}*iiJ+-48-*$t#;ZH4DK;i&FpO2K#%Y)(;&?0bE zUZdZ4TM}a!6(hCGntgP@w&mXh*d{l~z$*lV^oc*A6(o{=PBr-`psf8g{Dr|gC7w9+ z6*2YAg$M4`cFc&s!bhVXt9PPDzdq#$?@K&mzvRjE#B-<1EKp6CH{O415%}?I2 zPu40;uAogmPd(#=sG|=fy_40#4m2l2ItFR6AQW@XCw^LI*8E;MAfYxszsH`p-I-N8>Ce(zo zoG)ue)HlAI0MCuQCQCkUZiBMGva+%lD+76?Pt?BH{GIu<_f*>W+-aaEmLphWNoZ{u%^;z2w0z|BxvrUx!wdu1=2xl|s!foikd5z!!5s02yS;I2AC@t#C9)T2bHY zc?3Z+#B>!p z=1ukKe0EQ@r^Q;y67gD6k2y-aZF7UF22`SA1rvc{Gn^Lcf^Iyj03*a-E2v0xZ7k26GaeC?DuJt+BX9=MQibI*5+)JcyDSU zD*_(FibuWcKm3;yH*cPtI)}hki~M393De(#Sy=r6GPK}6OIA)Exo)2Z zko8^0iYlyZ=?DL`00O*RCoxORi@ZYW$>?l7>}VcOt_ILY-6&UuQsJLu@!om~rW1u% zK0R*ymh;5AUV!3n)rSq*cqR`&n?L5mG$M%;l-|vb1S#Few!>VdhyOu{m?p7vqF;*A z#E87U11Rl1acuG*V4~y^Fgw#aMwPy(0t_exV`L|W%yU=UuQ7)J`Nw1kticMk@nIh^_`EXHPr=R+(^B^jrUecA!66Ls`0*VjL@~q2F@b~TL z5qIC^{zjwyv=Q~<2PAx~rOfTs+rBQ>%LV+UE-&0)zZmi`IuME%ios(GAKWte)0-Z| z6Gc!8v>u5<96yvKT*JpECJeRUMkq0cr*2E5@Krz6&wP0k998CwI4n{$2$M0~P`oERUEZJ)1hWjVl-`cjvFZ|{ zg9b8m4NZ34s~p|7Xcm#mEQv}~x&fig99N0v5}}ml7l{LSSyIizmaspWfvc-cXx64E zNyGYfN#?lhCcGOjFE!8PWqdwW*)TW9yHYqy2}0xzFPqboICO_|)(_Tohi0)R&;n>J z_>}@xEa^m4d~4hWlc}XOxfFZ{sIk*!5vHq;Lp-e}I-(V;wE8}*w>A!UoaL%#mWAN_ zQCRz#*PqC40E{6kP#W2Tkg+bY=^XlbJDcTrkZrdD+>nu*iLT||GCO90A@bAk|Ms3mwJ9A z4AFe0MV&u&YITBR{r1tP!{75OuJ>RMw>G|`)1*F*lhn6IbO<*mzZ9;Syj~v)yvzT9 z_wbgIG5YMNRwIb(rKDW_GvmVsRyIu?hj;tFv`?3 z{U^D5Vn?_zD~Q^&WLywGcDpJMweKp0FDkK40#&cEvfWCNSp~crO!xe}-`A)*$skFUDY?RH%9y+VTe$58$XWqufVHfW#sDJ6y=H zP2A^HG#r%D6^)05zeos~5P4F*4jXQmS1)yw2)(ukIkFr((=pUy2zco=@+_n{^?At^ z9%4017D*oBcQbYimopU{YwrRTw7%M!@_XH)ywqM@!SW>%^_*+oeY!CAJTIZfYG6xi z7q)l9t#C%n-_*xQc2Q%Kf@CH8Ea+v<`N&Q;C6y*96Cj$W`ZRyOv^YOxkBx_Hj1U?V zIWhd8^2=>oph9+7*30o$+b@}|tl6~$!=`3{Wx8Lvsyy>w=L^qycamzU4xmSsVmA+8 zA#Mr(EGZ2tcnO1rB;S>s_+_u(x-&XOf#h$LJWQR%aP0$?7&Sc&?*)HZ^A?e-W)0t5?Qc^mZAdq9%np#pgm@*!E=g+W(uM8 zDPvqMH6%ASMSxlwqua&If`d6Y)%vd=N*ZL+rA{ASI~bQ`i8r+~l$z0ZAOR0`eh%XA z&|=2cDdU6l^=M_yZZ%J>iR0JnWOp-4@A^+gY-SW*r6!wNb%UiaJ-_o*kX-Z2M&aWIDv6-OEowU_%Da>ax zNFjqry+882bj#q>Wz#S#j5V}pPrOf#9MQfHLGp4}nK}H);;&>{1b_k3;{VFil}az< zMt$6$;Hi#k9<)WHo&j}C%y!z7()Crbh$)}UrRDx^Dl&PnL-fQ$Z1{#hC+4e=d;kWn zCAG2<340R+oT8qZXaUAbp+S}P=P%P{QY7$Fpk=X65wG+DLJKDXqsAnxkk24wm+Z$6 zh^X(W_JhjJCoFb-T`J1;bXmf0H}2v{KI2VyXWAiQxf&@EV(-Y;KCpQQwm9vthbjBH zj3|L$CZ_Hn0;6P(V&8Ae>A+6bb-ca{Ur)SUNHt<@k5PIzH{^S?8MwVt^ai7L$gQ=e z{NqJCli|fQ?Y5`(!GcLf>Le7n39*=(&h0vAm1(@%JLT*{rmtP_e9FLAB$GA!P|1FO zS%Z{hERe~TRrApci#_r$uZVsyY8q-iyhh=)l!Ko5I4FlA`}4x$mr!||>(qCd$_f1MpyRc@jx}%Mg_edP z9sV)-P?i=d_Z(jzHIAa?WoXz{tV}!yyzey&Zp>GaFFyNJytk(C2@KD=%qXM)+RmmS z7&8pzVx+7HV(;4#$dR)VIV};%1LZ?s0%cFKz*p4I7Vmm+Lihp6lIG}!PQ~P~v-zu> zeNt3~xI}JO@B-xrGe>XPXB*xsCj3aDe`x`B1;f64 z7+L%Mx?2)k+&&M$DL_%<9$>COO9l=pWK)+3W#JQJQn94|ay;U6sF{8DWHS$BAI_D* zZ*``3E zmKn15evhBJ@8^D=_j%sW`;X7n)%81n=Q#H9J&yyXF-T)WaH`^w{h6u6LqFUO>Xh-y zh{yMcH{d{LIsp!s=kQs#1Tk^imC~eI!tqOtrCbxexJt16fBU@XwcUJbcIZbLP zAeSm_)-+2pYT1B=;eY;-02K+5VF0~FnzFi;kTkR7Q&%&J;o1vz1utt?8|M&eCCq_| za=Zy7yLl@D(ipfhAt~YO>vv7=@09*uUh+rJJJ_`&$F>llrp%WdLVsr6x(h%V1i5|h z0i-3~9kH?hnb@(fF@aP6<%^1hgde9Tl=pfObo0n`;_Byjq!4R-_7`r)_W=6}Jx#!7 zCsb1%PjJaV@_JC#-uv5W*_$ez!czYTI7krj))jIg*7On$#2OPVwil6tE1n7zo4@4_ zLIz1e;!ut5ClogruTcX053dFK#05fZIYf&^4u&Klzl37DzbgPMPlhv+l>3PN2@sM! zI@9m>r@|8C24f&yY>b=u{kd(;K{U#B9Oo~1L@P(Km2~AE`!nl)Nyhd!DxWe`dRB2F zBx;S2-BALIqDGOn_XE8jVEDSB8zZBBB2>B&+5MTUdG?g(Z(suAl=#l#TxMkawzD?# zERk6;KI!#qitfF$XC!LL5s^Z!evkOrwMpUv=zry_oNMEE*jcW=t%G{GG=@Bp56Hil3q3pvecxA+L)VaS}XEx=2@U3c!cUBi#r^4wKe5Hfu)w98b# zU;Psqycp*n`YcdOuRF`7Uhr-eRSL-pf_er_no7ezDoM0d{>w|dg4BRl zy81bj40C7N0RareGZ&k-y{7905CBR%u<#UsVVeH95Ek&q~>WRzZ!=s>RBJ&dGJph_k?kxBrS5Vf94kuCS;8O+lQuZq z1og`i{8zm^M;HS~r@Gf!e6cH>4=oW28Z`tkz33)(-W!M~Xb{t;{eyl3FafVG2k7DZ z>wtc&Cy%r96XztVEqHl%$f^EVANnyXzYT0$l+H1bznADOM?xftD>cgw1SU*olMf>Fe4o!{;rAwRhunL-^ zv%I4T?Zyq!06>7t!n>wELk1SM)Nw!|y|*=z+B)4J{-10J#HTsLyZu`~Bg7|-0kMiC z$V}n(Z7mGm+Q)jRPfHjCJV#IALVX=spZFLKq(DBr{Bg-s{6`!gj_ph6nDL_Ag&*xe zHd>mKYA7pj*p%?Kkse70>bI!MH9m-r-`9aK*#mjg)|GhZwH&7D+Kub$UKeNRpL8KQ zNTZsG8?TCVrH~O7+mEt{YS-2#K(Os4#2FRP|>HZ4@&&2T3BQ;?)yj3-sJ)9%=zXDRJ})-*HyBX z;e06mGp`jaY3OiNXKJ^%sm^oP_h-z^Vph(XcxRNRBUIA>)bN0}t3GbT-cLKt1U_OV z)~}gZ5}Uz$bD8q@S1lnG1Ia&LynZ~TJUV$FcSsG5RxI~qU$vT1^n1UY?~^*7oxk}Y z|N3dnJMu_GQ4iAhg}2B;ViC*`u@#2?--M5iiviUk$Pl(4JvzJvH4i1u^FxtfHkfv8 z?C+mpW1b9^7ItQLJo0{_UG#z~T``QCT`|)38dSD_RFg{4*dAVHMrGt4YiIEz*ZW|% zoRM=FGBmgAv!U+9y;#@A&`S^>%T`t7cHFX28A03a@(4~$WIp;z%VOT!_UMok8{-g( zD0+=U9?gsB11bsuR(08Y()yc0S&2)bwcA|ySb4Z_Ug$oX|HH#seEHAdBx4t@D*+jCEQR^unj7n&x_f8se z0vq!MB1xO2>haLe>&rE1myt>bD9=^dA9JvUE(ic6cZ|>TFYgZ4(0aZU%1zHgVwcPt zdY5dWE8QGgznln=sKo{)cn?$hPmRyzXx~11ls@gR`TVQ?G+&r-g?$5K6xn=fdLf&Du6*up(SkBU`d^Tgu; z4)q&3ne#hQftV%NFt^B3S!@qfpzE)i-g8@f9=|>`1}@01s9LiAg>z|cA$m*VvZx=uqFs=tWp$kb zGe;aD`3gXK;ii*|{)rzqmj4dS!QW3ZV=tgNPp9PeE?|wH|5r_yq)U%-6q~F)i91^O zTykrHm;+KS$}3KN{p`kfUIfRhG>*q{uy;H=)tk@l?hnfD{Jchqkl1Xr3@f|sh5p*$UUJMJs z!+ace0%d?Xk;h<)kUzHYNvWH{lrl*CYde~aBs})2A>gysR(iCEx7sIEUul*VP6s|mTnG9p8ARjLGFDSr`7y@w8&k5M{ z@dThI4FA14OzE$9rN)nr<3PVBXC*T>V40ta^z6F{@KrvGzPyBX`kMl@W0Z))5kxHW zTclCQ*D9Y^Dknprf!4!vZ)^BPr~At4O=Z&+=?mI$wIBi#9O%bQE>*MRU+S1vDffmy zef-GCrXWS(B15zZ0q@OKZgp#K+5}>371M**YtU+dCQv2l@RCI-mChB?a&ZeWk zwUV(&oH=`PFdFvhyR+qa3PiHLe&eeI`*huG^7+|<{2EPK0b-(zZ9u`MSnIJUDDd*a z*jq>6D+so)wCsmY)QI1veIEJLFpB;Kq4G^E(pEniX_b>3!YjfR_5m()I<>1>^#!+7 z&>7#~`%+7@-*A|2N%4t~g;;>DUH z?`*of`s^}hwm&_hPGFGY#Jf$$u0oR#y&C8?pFag)I!wHi3|Im#_a;Abn?p|)+Bu96 ze^4G^SYpyMy;bj;}R7KCvPm#k`$R&rA*kPhlcA@y#URlN|=isl2Kzpj06n1L{-{a0& zCop`lQ&Ll#b94%FExy^tEVpRqn94oz$tKZS1RJdowQ64VU6P zA>r>IP0-{CCuzrcPl{s4)X+b5HOy9Tm|*k+khLll(-gJ5t^a%`HR|5AKW)E~;%WtF z;u*NjIttTx;U=+4XVb(p-{%C^QRm+G zxB0Ir;1emoHOrYep0M#qlB3M(Yhe^4*@o_FM-5Q0Osre@i4J*SIA8#JFvpoKD^FgieNiMhu+Ik;KciA^knvFg74MQew-yh3^Ox)>Y z=Tldc%bSZ)1D3to_Y8w}M~f^|dv`aY9_!Etlp?^VdGjC{ zRiTv~4YwN@PwK0L)n^PEERJ%pypI^JU^MMxSLs}dc>Fj#QDar;du5rElY!lQZ*SC- zGiWw0YHZ?U!>eacoIHcIO{*`;PKSCTeXF|~IuEZM5OMwK!%4XOycT*om<$w}_daA+ zcyk%x*=x;BluQ_5q+>(U4@As=w`}4$x#aIU6?{~CGPB6exLM=T&Q7m}U9Z?+v25rO$u1xJ`*v{qU zaZVm!YjNX~KF?e=u03_?8R|%2)aqIoVS9JzGAbJ8wI`QXtag;ax{Sf$ByDJA)vV!e zXQxU<&K&-V_RAcus1xJpy#PV`mx{sj&ok+i*$~?7lnKWXXNRi^E zwpgY=O|EFi@@ikvN#&UR$n4u&s^OSHdE`}`O5(>9rmro-3%!Q<8R@TkmiQ}6J-5}u zYj%tQ>}3gP{}gxMls*rd%9hC}-10_6uCQY?EOoaE{lm}LPuZ7aYWAf? zcP5D~14>4{_1G(y>%O{}%46~njSW4MdD*Ov5a}hD$j-wL6f79!xW}{W8!$EOzyX?` zvuy$#_oTjAVbEV=Qe1lkIQf=M{or%cd93RSdbnP0^eqi-*}ap67(rYAdW zULptW=UcFOo-81yx}O<;$NqWwc&voE*s@ZFWw=M)3JybV2Z&l~2lv0|gc~cbZ2H2y zj_VvWp%D0Qf&!Ua{z(S$T30w>;&I9&rW3SQ@a6kvsGaw_TNhzQbS-p_w-v!tf|9|r zjQ`)m_>B=RB_8dk2hoTK{o?!Ac;ZPGe$c3+*_{mKUbS3@_YM`-hQ-3O=jXm7v{v zHz92im7Q0f)m9BH6}mv(zZ!fXg}HwPc2O+vf-%xycb@}x@rd`qY3yx7L*j zdqfWnf41h^FbOk4Y7xOdtSGX9R;|z?9k1Hx)$4tpBDIy>LGk^}U;Dx-A@1dk>$!+~ zZW3D5+93ObTmhS-bn}bBU83>czBlinHHN3jq<#GsH?q3va&AjxbpseCl9gb_sT+Fl zn9M)vKYxqrUa*o^w*}lzSw*WU$wIF_6XcrXos>hBAEQvtW=E!!{aLN>A2D2O z=T|$!-V=s9iH>=zE|7lcp@2*r9fQ}yy^8U}VC<#ZoC7%rrXx8p#Ug9lKJuI`?juGN zf8R3|y1S9bHb)SPE7QedU)-MPiO`{zg8ypV4qXB+?=< zdpXP5yJS575{?q)_ZZBML4U82aKB6#p7+{Fzm9wcqSnS8(aIuKkP*vzId{h(Vm*(RZ3gq}xp+=!Ls$S&I$SdfS&UlrWSZ6C(;oeKU6%LY^9r^M6Sb z{ly02NxK+PUW?<4XL?*rl#Y;w<}M2qg2+_N{9eP2nw;;Q#CLyT(p17`}thX3V+DR(~AFbzRkyF*{(nP_XI-?(HF1h)l$JS9$nWM--m-eG9L z3z;w!%5dt0dAj|(H@g|O&pP7;)j~vff3oyF-pGo_zU0Y5lrg)<^Ob!;U~h}i?EGQK zic3(9u?ZIaPPKAk1=_Mc@cfkOnv1BA&&!@9ezB zuLF|_Z!}2cm?JFM#RIh*q;!$3rUJ%&d2Jp_G?;*B`)EHU2iNHGhqoDH^ywkAReUJI z#MH1m>T|f3sNqc096_())F2zS`b?cL+YscVqsG(tp7LFl1B#7@Q{7D zVfPVKgnfzVL=gAnV?6dN8#fe%?7PAuLQJq+jh3s&ygu#GYuC0%wC^AMSR(N8+1~p+ znn>iAbx6Z!-j!09&1iXOq*W;XzYkQEG!E$-y$WUK@`rLm1jeyvp^$S*T3U2jf@!-) z8rE-Va=crF;qD>6XTC=7bF%RR}V;nZQE(aI9qM1Ha)Oi<$q%Z-2|5-@AaV za~C4^NSk<-P67h&jbHt0>^1xL^U?8@EkIn!|0!&d7U@89C$Bz?fV>J6<~?W2T#Tsp zKbs1l&Jtf?VF`!W&v8%enOQ8uxw0S73oyYcTfxu-R+)i&yq^z|{gg@&g~j_30-LcQ z`ZNwem^T##ry>b?`Z51GD#$}^@dN%I#6-*1$}jdoPP&z?WC%lD5JXWV7Q*}DJTT6? zw~C3#XKeVIlmV$AkF?KisDAS8WL`TE>TO^$ahX2cwK1WJh&sxLe{Oda%7`*XT1BJ~4wCwDPG@i>6^I`&S zbpL+*PdSoMQ8BMx(ZY?)b3SHLn`3gqQekT+JQ;k*7Hv$zXvpmO%VzWcy$y_KWpHbff_o3QE}nrl@G%!PPL|)_7fVOZjbpDQG0I^nMf**`Ycm?!+XbU2`|1nfxaV?Z# zX9xZ-^8W^L8bN4^lq`~xv91(IPU$w0vLnI_;A6z5-lc`-#LaQ^jjpF`!)4 ztEHNwkqaH>=?P5ahOTe5{HI$4U?%s{h>vF?1%l)X&hMEp1-L>6GYqbx3a&OWAW^(X zNb9;fMp2Ocb8@tI{cBsISf@bF7aZQmg;TRftK5pczA|bi8)$~M=hi`nrc+R$^8L-AAqk0m!a3IaJi*fP({>!apbd4p@<#&F$E}Y6IoK?Qsw*0_3M% zizc*%%g(EHcpTcS4u2%#_z#Wy5C5@i$o?_G@x;DwX*&#X-d+#O;>5Bu?XUgGnfX?qmxUVmaS3!|RF1Y_} z*^U&8Z=`mK=jaQS_}jbwJ&T`kBHT*%heD!~Zex@-+EPGHF3zzBfzZQ`iezn@#Q z8;W!nyil}whwPv4hi5$CnGro=nWwO6uR%(h)v<8jf`z0alSiNcfXM27GYovzRcNke zly~XLzpEs|ueW>&l@f~{Fd=J5gtOf*)D0p9_9223@L2wI#sqNJy}F?nc;$dLgLGY( zUj7^5xf;+iG0D7m`Las1EieR};CJyn{>U!~-+{mkRJKC?QOb7LBG3ieO0`1T_L_~8 z25L7{%J4r9VgxL+*5!`-oJ7Z4{BIU5%%!!Xqc|p4D&U;Ap=1Lhh5tqT51C)Z#+r8` z-6bk^G{T;DyAAt<&^m1^Av;D{M6J~%xp>&zy$)NeF=&|+i2sX2m+Uz*k zQ3uqB7Z*hRAFrc=uNmqcO6woe9KQu|W$Y2M5=P=E-=5vm{>Q@LNIt;g+*5e$Ub<=87j*?jI$fEp7-*Y6dFf(&$Xy!W4s`5wd> z9qQ9mCmNycK9Dl{%;{3d@_AtSU*q@7d;AP6Q}6b;_7~V>{TkeiAXysy(U-|-gGu;R zpEga=>$#MMnj=I;vDbdfalLz#YMv;Jmye?dd_ z^_utkY4J|v*O-_@gZN>Q5k{fn@;q-}o@nGZ&#N^P`y(Y|Aag-lOZVLT+)ERhz4W*(y-yl}9!p6=+r98xCLX;{7?~^F$WVf|_f22;Heh_}JZJIBJ(1_9dwN5G zi3KSPn#>2GZhqML^4y0HW~2hib(D0a5O%~?0NUqaE=G70Vdm~D^?Lj7t&D^Rvfef% z7wJstN7)?fe+RSr-=O)s75_Ms-A^lfh6hJ zHd$6=?BMzF*s{g83-E@(VvxIqTE2(K#^4?c19fwfh5jpp_F@rr3I!&%62(+QMztQN zkzx>IwwC-m$`ne z+v2(=?5X%ApdGK?@K|6vQ-tZD@zbW9^UtpmFEw%(WjppsCocQ!;OSCu!U=FH`3_pm z)l5^3t{WMf0{fU?2~JsO-?PInF0QWG6C2OFp85fBwm*JD|p~{S;bJG3~5IMKc52 zXqU@x+r=5CZMrTCR>u|&v;m7m!dt?H5Y;ikfsE? zf(7|u!+Ji2)7|gerMrZkQqpG{#$ZZ*FED$}f}^d=F6q^T*mmi?*+@JcZ37cj|fr}cB zGA~od=pe)M$j|3CjakzZOiIxAYcVp_Y8)_i({S>!A9=2|$Z?(nMXKgIaS_otaZ3Wb z|4lz-UC&WgvbX6xxYKJQa(Cku`j?}**FJI2&tL;&TbHnNVqGdothO62D7VN`hJQcA zT{;^QhSmnH5R79EOy$XPcXuUt(A=I8r8HW8_98;$sUSuFTCMYhKdE(WJG+cQTRS7hfcE9(5$<;=j4XUh3mtJ-x+qk ziD0*)H)-&;`B&?k4=$vUDj^&5+p!3I{MQSvR4)8P0-2mhc<+0v**FaEbW%;K@`G{X zfIK%80m|o4yFKABaoOw}D)=MY7WdU59=%Pn2d$qDu;_w=gOPnI!MZ<(jw$tTygf{I zz?gZUoSE>oYk}^o(Nhql(%9jqz`uAWBSLIrV`DepK&c4x58iL@&>yQiY!mY0-?5OS z1~`6RrWBZscr7K&L72LxXLen-V{Gt|kXmpd7^>I;%(d2h2?b8&CLy+pcu1geTL+YN zqE`O?2jcPBlC(C&fLeY68+1wY`E`0<$gciYWx6?45zK;p>=bl2dc88A5l6th9kBlB zW`6S8bncn$>Epx_?bsVo1$`L?vw?)2q^3g0vl9UCJTx4hIkuc20nx*~(#zqdT|DLa zKA0Qeng%7O zHYOpY;wRz`Q^7hvy1;QH?*s4iZKkSJ zog?!@)GLW(7y9~%ZBylw*EKMC$j7$RMlt^PF+dpTnX3n$ca)LY*$<=S)O%jd3*5o` zte;ZOf0Ys+_O_ZTEcn%2Nbz2L4!xAqILVVJogyV1V*7^tY`0V`C+N3bHUT=6w`EHZ zLUm#w^mgt=Q7~X&Qvi4Y&O{}!L}ZIwCuYNUqx!amb9tfYAr8YR!yQmm>*uw(mz=MD zUk>Jd8yUfM`NIL}?j6O6*qcHy|1`S~oV=K4LF=UT)xrFWP;JNR>Lrkok>(3KAR{|C zkK_68ur|mZu9C|sIWX60{&<_o@Iz!3#F z4?J-u2mlP=O`bV0u>5MB!t;|)a!+ucQzFDxD2LtwHi8+;QKZ@gw3`)ZH$@`%EbD)H zAwl5g{83BW3gD%7+Rl@-xC%B?z91R|vEGbPj+#V!DF{~2R@b$G6==bdG{3?o&?cv( zlz%nCb`vykyXtjiL<6(JymO-?n&B};*p1yBCT7769eHR$kI{ks(>=VKl5MFFbmI-n zPq%@B<1or;MzL3Ja&d80>Np1BB5W;w1IAd01_kWv%MN3d=cHi&{|o}L|D6zHbwm-N z;ITgxj1T4pk9PfNdabPDAJc#vS&ySk>y2D{&$SL+#JO8e^UXUJroy(>6BMLy0!is` zuBiEz9GK84m=Hc$7&xWUh*LV2;hV=SNG-i4J^^tLZA^b)FBI9=jcpmAubEkXnkR@| z#e-yg&RMKHe-v0h^PQV(!8vqSz%>2OC$eM4i*DQAY0s@?w~Lk z>er@kgs31Ex;q%WvrujZHkJpB)9$yj6i>o{vE@!7qB!H&rW&1_yqtb( z^uc+m-WNt%tzUhHm?7F9@tpD~tb=+WYH)W^#A7N166*nK)zKv=YDP0u7b|`8_d>U9 zPr->BW!ppCsfNSbT-G!KkCbU#=NKuY4qpuIgC5k#6~)0>CuI&Lq&Qco<|O` z+p{rT#vK@f*RDz^{`{tKI>9APUvN@b_D%-5qC;x2i0g8a=SEFg*X7i(b%E(7i;~YF z-_C#CKuT#1&qqzfdGxMN=J*PUdT;OaMbUgtpgx&9&w}uA6yyKkV<2>BQcRE5^g&S`RZ=2A4nK=Ij<>9D?o$o4_?zY%iTNt`D73tU4bi@=K5#iyKuX*toiO5Ms zdzsE^CJ_hE?B_Il?y{iq<+I=RX$w??!~?F%WiCK;-9A0&g_x-O@t_ytkM+U?Lq12z z;uEFQJd2K1>V*k*wr{Q|xi)r4?lg*o>S(>L5`j(y65-{#i~cugqJwwzCUa+Gntxc+ z6Tf>#H15SSWm#sq?qI*Cpw)CFvJ)=Mzk6;zOQgimkM(4ahO4dcns0pXo>7)IQ7l%~6YPEyee(==nYS+Y8lgX*h7vCqda91`L2bo=h zE-;i?@;60n9my}c{-l(ZyYv2W<(r{uu6P`)k@DekqUB{iww5YgPEHw8Urpy5T`jwp z>+#H_D@)jz1*=M!-UbB{a*!}0R!zk59C!c698V8UKmH2~fb8?{`ASQlnGBmTjA=yq zB&%zayP6v2FB(jK@UZ=0~rA9aXj7rJB@J@%zl zv<`E&aHjud8)^^Nz^C zq1Tw8yKSXdzlD*A?Q)iUXUseR1H&)&mK3X%NT@OSX>GCJ8n`!RTV`p}R*JLwEpj%z zz%+qsu&6-aUgAh~Z!f=V{o-|I!Gp3iNGs@`YSv8SdeplO)EDJ$y1P=&UWUZ4=*Gu(=KnX}nakud$%SYt1$@96E|0tXArR%zy@ z*!t_Hv-t>og=e=%ef@|ARQ)gO860YVg62 zgHK~o117hj0|4gdR1WDP^^Rqji14om?&>IsodZ=yM7Hh=v z`fNN;t`>)(GZ{$>uTQmdIZcnm$nK*T8RCl{Jp5a8`St0b!$WxO0#A=@7i&PgSD}yT;Jh+f3KTto-EaK>Cxr7s;&3e zzoiH?&nADty)fq-Vtc4xdL=}c+6*1lKPQk}o$?OVy*o?JebY;YVcYG)oc#4!jw-ff zl(+Qh^&35hk}u1%4q~EeqRM$4##|#`D{BeSe3Lo!{Lvp?;vL~AxQbmi-K#=`J@+_0 z;rbzi+v=B+$tPMgQRw6wQ8+8=oLh^`MoqykqSw4amTah{(3ZdEmzvA*cQ(lt(aywT z2`rx%y>Gg22s8{Rda2wJVRl(9)aflS>~TeZ(4^j4qSy$!ldw}Y#Oe5IBb8`lim1m_ z;)hM_^7!XoZP!^wM89lY{-62<0$R9QRg7^p6`!(xq?o45&rc*?DM3l$&qxk;l=24$ zFbU7Tq~uz^wAGSv!{(#nVJ7Pj^}A_`i&&Bcb5C6py#))}NFAe!3JUJVoV~ab=w$zB zNNr0l`Sb?kGPe`aYWsBpxtFHF)@9;>F5`9vQ$_203!I$Gl{H24{QY~Fif?QNKNO&w z)t$yQo<(0eaw)Go>Poi1Gqb6==O?~+(3z%ll$ZBzzB{`j-ebDielbz8xULb>`TfQ! z%rZSaROL` zfM$JU+3h0QQ79=)D!lrl`UJCJa?R-;%9D*Ha~ZJ}p}Tu~wQ3x#C1TgYT~L?U6jU$h zP|TIC_$Zk+t!iX59{A~{YOJLZm5LMz*^F##W&dKW=!vpADnGiqji11t7%YhvU6-pg(#nq#8x^j@?LoiBC`ml$sggdZ zLOu1tBS6n@gw&@-tDLI88tv@Iy4Lf7>CrXy9}|rHLyRS(0_a^y`LWczJC(B?N80z2 z%e&%Z3?cfluB#*|T-6)VkN9og2&$`9?z$ql--<|HgwXaV#N?yRs+}{w%df4}`Ud8h z%vt5nWy&SoiwYBOan2}m9ll>?o-cE4k4wAVV9bz1$hMrN7#MRf_(qjkR6{SSD0#PL zd2TR=*niIXp5F--1HYs^_U+}U#>sJq&ca3#Y`~75;y+te8ktdUKbF(#-<;By7>?I5 zXE~~&(jqo;*;zN=oFOp-=Hbcjt`=~{SzKV%<8cb52jud57q32s{~*DCioCnvgTh`!#}DC?BP zrwXl(=hWQY68R=dW8m5`Yk!p67iFPlaDHn^r8BZTH4V2NeSNN@=13!NXH7hNP)e%u zd7}5#zTv}H`&$cUQ_j3L`M|Ru5Sk zNkwC46OU&WH;8)1P(?@HEzwZ9F?Z8=SAI!b>mBv(enoA8FPeL?>r!dE_h}V33GJlh z+9;QpbH6xTjwWn3WxHz~_8v2nyPh@-_^j88m@9J)jZr$(yfzy{Rr!bfTB2`Oi#956 zIAJA~W0|Kj3=Aw}M^w(ac?VRZdqU>OQvLMaM)7af7GR(1?7C?0Ehc*-Ih3kzAw#v( zU{!mTLXb+)e%Ga6uo}>8@2-Oh%hO|hxo6aKLz-ygj)2n_Ju53~%iDev1Md=}^|U@* zihiwak35xvzF!{Z1C~q)Ec>$83q}y|`Xe%fCTj#vXi?cLel@x{Y zvU#laH(L$9X}_-(-JW7$NJLv`8n8uoWk_VwWWmv#ek@fo z7LgEes5m@6-|}Otxll(;U4VPTvwBR=Fe@T^?#1J=L8a5q=i)C@JC4NKFV*A~DZL4C z`{@iO(|}}>z;b6uhF_%BRi3keVGN9 zwhv7I{OY~TjT}+lGaIVRN=rL4MfMX>Pq5drFq~(%5Wn_0N7gW;5LjwBZfN?u$X zd&4#C&J^$NwD?tVv1Y-Yk}E0EYE;ScTe<3e^>6aeTt77?uU4zS3*q=<*=m;z z1m#j&4x8#4Q0ChNP+rnnWsCp~;Wtr=i^b}ZdH4FGUz&TK;XA=W9%kWA((YraHu*bW z6ZipKI-MGW?D%oW+aO;$`vKom*M@7n#K#GLNRH2BPTl1MH@)@}5+Ts|99{M~_3jq| zkNX?p9=DU7pD@x*Va{*9dF$`+)+RkMsm4@2f{^189{Wc7VU510VrofS&Xu$3%x5^t zcbzF+H)p3rx2)R-@Oyhs%*mD2=JK&t5OF-Z_`b%#-LJ@t7R|bpl3Bhxwi9lW+CQV)V%w0$pai zp4`rcsvEMVUNy>wZmWiSnid*Gol6O%;0vY~Sd5q_OvJhL)+sTlbOx(w^_VCoS|1o3 zvbp4X?#~f-RhVTB*)I{lLzP|FzgF>LTC;!U_Cm5v%}$@*Vo9D{z8-%^dDJva%5cuP zs|RNVqvTA2(8P^-&AtWQ66}{g^PALMF5gsDO7_(|!+?Mif0?a6>mj`8p)1}8acdL; z+DW$z{e*b?e+3$l-2GQTaw-*I9e4@F)l|vhI*jDo+auAU;LytIp#|)ftjV?d({F*j zhUvMND-%ml7d3JTIhNZ5NKsfe{BBp|#>k8V7@3;ljAM`Rgvz8!wvhYZw;%;S2m|DythOS-|bh9 zYq`xG9Wn-#nCnc-Rf>3QHA^Yg(AP}mMSLI_y^24_+`o6pUE?h?Zo{$!5|~Ianc6n( zve2^4V<{|OI6_57PM+r4&5L8qQ>3n-+mH@&I9w%g`w><#_0i8v&uIVkYEKENDDhH9 zK!bLtibhFF4of|reylf`7-3J{ou=Bim}78;&*87Azt{X$u!uwe+^ombSAR*lXoD9O z>Rw)FHa`5Q@w5HZ*jkQReb%737~dv7<=WR8d9SyO%O+G#l`Kmw2Xp2HFVJvAD{93T#%=UTF@cTEN7!Lyd8-e$;cw)AT0Dc zSkQOd+6kBnEN08yAz2(?a}nl|LHQhb;V{>$Er@W>InQI7&=RVZw0hdCQ-{A+&JT(j zIP^<53{N-mZY*E@p_Cqf_sl(TQxv#pE<(SuNa5sL2Kd+aQH>^hAsB8u&pmR?w!jw4 z%D!MIUt^?hG?!{)uvr_y0dV&$#i1G8*{0^+f54{y@ebm6&ZlIRXT8!|hoECKrI(J&t=g4#1KXMnGJ!?U-7k0Cww`_4 zw3BL|s4?n{cF3n-k1+I+V;9KIZ`-%=(|7L1E}L!nWZ(Fnbz#uZravu&IXRa#`&45` zmSm-Pjl;Bw&VwpJGnpfeR;I8;+)W+Si0$VBXvGPPbnuq#@~+uwfb z?P%}t`pVqzU>f&9Rr@i_h97*iA#@r7_@O-unHJ9Xo~5(@Hxxm|g6yfQs6JZCUtc3I zosS?sMZM$|m2(ecFU}Viv7NedFH@V5(>Oy}A3x5_VAa)v{Tg}3rba?hV3T4Vw@9LI zL}hA${*+czrk-XNr`1TPSnJhO`5*FHv?&L%0hmF_vfz?nl*EL3C2b~o#hxepQX&Ph#Gz)M}lSRCc~FbHu7(^ zAE1+kL=P5>2((KCG#l}q@Z>hW;BL5x6v;D#zxQ;bQphR0otb+iyh29Il3E_4BwDjE zxqr?3np03FOTC(?AL{}7h``g1@%zG8LZx9AHR@2?%C&oxUzgCT2WKu3JSmxX@N}6k z&CH|HYLqOhDNkLu=GVVR-G||D;h;@mXa3bm`%nGp%}_pJVPbmQ?3Rv^;*VoZg(T60 zt41<^$MYdqjVkF2_y*Bu1n4r&cDVV4pmp<0a_)2D@g1K7DV!B_b4~0hTO_j~6-PvR z$4Ar|mo*KkoSAifkHIUHLfbEkQzd-3@bl#OMz6YN^ z&f%6>+EAN3(_gAt&v5#ZfV+~W=xG?uZe(JBpMkPXM`fqyX{&XX;#FcWEA(^%s62;t z7cDyXqT0vMr3}J&-&IS#tM6s9E}|Fe(a+oa9ehZfq@TT6>rdZ`&OY+=Bc(b$8qNJa zwA`ux;*t`X6BbJ7hsR2pSyN5k(aS>f{x+IWA;GM?%Dv8l{N`xu!Kqf4#uizT3Y`fp zt+lGHS#?%d^#cQ^*`3~kE;+d}2Il+8%)C9}Vxa($qL6rOw=om$GcBS#1D|Ciqt|bLYU#p)va?ZV_ zL+wI0!ffA_=j07~#v1vnApsUQHl)MN3{kWZ)!Pk1#hG>^o;`QV#&WuUainD&^z=Ai zQi!#A7HwhEj6bhuJz_s>GDUN$NY_=0Ir&fI{A&qMH-aU52f@j|Fqc^XZpt3GUBdR* zRw}w{#lpO6XWBl!iF?IS&uyuV`H_6fk-`OL=B+uy*;+|K^SOlB>qPl@hz6Qpv{KsEGd%Ufx+D$Nvpn5EzFtV$uJ&+V_ z2mYk!x&N*!d66=14jevhgjT#4-rr zBLF%9Jdx&|&8_TzF>N!VDozen(e*obe;MFEqsc<&UJ@!bYHT#dgMgnU@N$u9UTOc0 zGP8xG{aUX(+K~qmwWJSxj)$HDmq_DQuot2$$>B9f9Ngg5rY3oXJ+tg#PV0h1)RvWS zUj16{o9h?gYFQb0@|HF~L0?q6c|D`J1o;j+P$4)yKZ|4o$wfTekz>9CC&2yt{-7&z z0&Rp!q*H&4$qLbV#;sQ}3#a8JTX1?805~Fi&};GtkPr9};nqCW9#8?({PFJk19)2) zAQ>*KxY?LV3U{*MoI>)RK@f!Fz8@QV8BSLP#vUS6>Y1Om%@41O-^#u={0A3fH05lC z*j=tVz7g?;h6zm}!AN8ex$IiW2J;=9Ctmysw-QK=J&w2GHf#fO6A9UdGq4S9=T_8Z zt$)MJ-gnK>*E@{0-vX%8SUIfUfH~A6fNJzzi_#2y^A4O~@(%_-Ul4X;Jt#*U7s4x$ zR=TBv5DX1q+yN+&>UOtJ_o_Cp;bu-83&2Cdbk8_PXK4c#zS@rx;IB^^Yh^p$mll41 zJrPIN+H@JP!?=(zb&taSAI>Y1FeSgT`z5=$sc^^bqj#&#{H?0-kypgyMkR-0bSOKY z3$Hmbba5YrtF@Zs+N)BHW?jC23KBYHFxy0qF}lyp|1(sDy@KmZ-fULj@ZeiZd+OZL z)9sQJts#MVvp*OzzQu!2PXPzc@iz{IsfTt$)cos)Vii-9l^g|K{>KXb z;eJyG>21|M_0g$P5RKo7`*mf=>>}h2&A?9U@E(*IEE0k$eSSeHlrYA#eq*wA56}f|UR1<^VULeVcwUUVPA1BA9wb z^+r+T$nfBE+|?I&-qBCGEBb4ezAwo?4_5L=aGuMl;@?KtJ_7h`^SjnIe;rtKrqIAsC)4hiyHB&e?R=qH~Ll6dNx)>qqy*V{tw z(D(f;&c^s;kRf%d)O@5W&zb54){iE|8wG!25DMwWfKwb(^V`r#Hql#b?EN|M8&0?5 z$aJ=X3-%X%2B5r5No$ax1aK+C=fZH)>SIZz0y*oKM8d~l5)GV3jD{MLy9eG4q4N(~ zT*@}SqD`7lo7zIHs$qjE2^bwnbdwG2RjNe81skk2hhs6O*mrNT3=>Ey&;I3$#SU5sI|bGk2eTAb%UUCDD+M%Ri6ex0qs-$cZXK4D;{ zn$h?L8U`o5^_Y}RsZ?i4d2;tuyb{P?m9Z)M03^v8!S5jX<8R(I-^Adpcf)}sWwYD$ z;S!=2&}6l4o&`Ri&!CN)=lFe((Q1)F`OuEste)rra}%3t&l-VSe71ucX~9q3?Yh!* zq|BqkF9%;_YQBeK_s(0BxwyD!;qcw5kI=-kU!_!w&z2(+KMwD*%V)lMv#F}ns3FZ= zM{C1{59MVH9X1x-S^^koQvqG8dFGQAg9$x#{h*+5jC=>qj<(r)5Q6)*lWR%|VIR1G z340@!Ph$*(mWu^w3n=$(nLq#j-seKY2?Eo776+gH2kjp;x=(Xu7+DleS6Fs>#|nz+ zMbAVQlDd9@#y187{4t6F{9&33b6VL8l?pc=e6fvtFq^fZ>Ns{clh57pPT1OBVML1i z+tJ+u-6t786b1SSUky_eC-G4yr~bHtr#!fL?L^0-K)3uhOnTeYdyoN8zclu`x^G7P zjTTl;2gFcPQuf#cP$Pgu0Br*LlY@$_7>TLqlK_aEdrB`Mz*}nP9e0In+%*2@y!WHM zHevbR+E<@dY!2)-{E>8XVQh8o#fBycOM^z2bz1wH_Y?b?M!cjq(>91F9w?7~p2{fx z5i0VlS=0DTe70W$dmgrOTpnk)ED2_YwaZsK=f+sWI`SmG&-}&&M@XF0ESCbgXOk2G z2d$Xhtp5iC5(c+Va(j7Pxzws#qbSAl3cS&I(hQWYGJWr7-V}M}dUA7ApuIB_bmf*7 z7j9y?DORfc^3OC$j#?i4K;XbKn3RW<<|2nAU38?7vI34FcbQG_l8X7&uFtl@5bU~yk$;zF1 zFM}^PE_>R>d~R#y9+6Vgd)X@U(DV>iMb>Su#a&CC&Bfc6?5`~F^G&zITj?B-O;YVG z>}B!>tQ*B4J%~>KLlevQ!Tk5{@*w!n_&?xy#DgfyqhcwWdI6h2lZcpz$Z>N5%zKb0 z=LN~&4v;VxPwLU60Y?%Hj---w)Pr$oCb&IRaZ8CiCsTznTVA1n{di7g*K)!btiZ0?fmKbE&v)YACBZiHbEs#Qp>3k%${^0B9+x4uV?Q8PQnSzBgk40^H-wayn z+%ft4Hk^Qn+BK-SO%2@!RFp(R*$CR%QPngK&&nIk<(kvex8z#4=ZA&&whc+l4v%v6 z-`VeunAzD`T#P9VfQ4tZ>(Jm>Xu-!V7VfOf6yGNhFc*{?V-Wyd#XJ|!bw5amO#{c@ z)-<{7LtpV8#)EJ*t|LAIN50W#OREGd93H4_301oO=8Yv3+yiy*Tq^f$cFWSkW!t|= zx7VP}6qt%Qzi3d=HC7tYS&;1wUDR+m!WhUekSIhBlV5b%*X$cTl#+SDt&kwbd&x1ypr0U0XmjMY$0TOD*f*DK4dhO0rq-h5(Q8eJ3w{?|CEFm@j zRSQrBW^sb#dRAdk1=WgzUU=lK&Pp7_ru4S0V!3^W;jofIoMjVIh3Xz{=kZUu&Mcj@ zD@8;~<}7ZrHF8KmxX6gEIQDbhOl|(y?niU(4Xw42AwLOTwkbt$Nb_<8%Ey#IeL>&B z@pwjaazd|zAx}h0M`wrzKsI({3gc!C-ZK_e)oZ2fo*O_6<%o<%a*P#9w0B6iccvi? zfILr@Fxe;!P`15Pb#t*+C_)=OK~Xq>!RR9yum?WuDMs}V_G<5YVl-rq>}v{4zz51J zB$y0o{D#qo(qn>m@U6|17rF{;EZme<4oxzdh}hYvco1yYUu;NXe<~b_t^Z4&x7$I5 z+tuPCA{!er-|*R?+G9f$014>5S}Z&C_2cSn5AY z+DTg9}L0ES7+V@h0ohLDOVt-K7FNS^@w z&B7sujTNTfl|D#TgWcHBV6sllH-s|(uJi*Ez6JGdj7tK}_oaD(?#764jD8Uns#9R5 zUStXW6$TgnT=_PpdDLFg%e11z5a6uy8r|*!&^=Ae8%M>WDf&FB7yHZX*d?DvW5aO9 zTX$&%a^=#gdk($?4hh9%wnon9%0vKxyZn<^zyEB35JF#}w>RiNEe

t*>4^L8l4= z&SBg=$k94&Gty^C2iS=m$Uu_iw7IsWp;}uXI7?QEh+K1IdccrXYN&1H$eju{*AX!m zhfBs0720_(V#;#6={MStJxXmHnOYVR*Y&s~`G!p}^l1B&gU*1JEbfH>N=!ijw(i|> zSe!0T7R}QSgo^kYt0?k8EyoqW)+dk#mB69gsHJn^Y%qz&%e5Vm+tu8=ndZCq!D1%W zx#HWRxa!xW%xSdp?v2g1#V$n*5qHeAsBoil^FH{l**0C{Q1OV-;&9+#gWia8cmBe) zo%)jZb$UAWxDr#YDWdw)ed~$;%St4a-cYV3Lmi{14VxeFF$~sHsn>hEgXJg}Q`rFQ z6JM4hnq1>IHDRNQfjD!@g`qr$hKl1~dSX9y?^?+OzTwZ^mW0olEokL5oN*O|R+>}z z`3h^9&=oaI>Ww~x4n}FRyO6!WJCD7sv{F1O60bl{4sjEhT&%l0?+Z~RE)2CJ-++u? z0bq`Dls;i3lp9Uty|eLMT#nLvk)omFEGMO*={G05hPn)w-qoJGAKmn8yf%nosk_*8 zc!LpgJBqfkn>a|Oz(kmTq=oXzh^v~tSH6D0Z6kVFBVX`nS(@ip2wp_8NP=jC*1^xU z&J<}11787Ro9DAFVfV8tw!_IND4IQRC^hFhVn2)BR<&J7AkAMK5lt37?oPByYlyfX zcY3HkHDz8?1Tm&jKfMS(40=5$fUI2q77qG)DD`ZVIUYkl`+Maf z-}={ls>Wl^NJErPky-0;?^(G9F=-jsgH-{DNqe~qR>Tlf%RYITtI`y6e28$_2xw(u zN1U+;aMNd;I{}BvTsYy-(~5mcI#99in<>`n$~aq19uQj9tRMfGa`|mmqDW@UU3nR^ zTKEs$O0~%QV=y@4cs@5@BSFths`V1#L>s&PYZ}Yv`jq$HKy^TQ-(MmdgRm6zxTnYMjr+3s!6UK5N;~ znIAp2(><=tk6et5}0R=S~w&>Ma@3otT**hA5LB0;HL~wBOxm1N|*RNgBH7}@z4)g(GwU;yM)Bz!e4TM-ubYQ}iL2dZTdedBUdP*r7w5Qf>>{;ey7NR+}s^%)qYR)KdvmJdb>`byN6QwF6J6#QVSlitZs#SY;_a5_PS6%j!{CeI1D?pK6wXMDdrCj%-eXvon0Nq9v4wJy zMz^Ik4?`EU3bkljA#Q{FxeYo2AbWbIOeJh>iY={as6bbflK}P;=fJQGyR0A({L9!R zT052XIE8aPMP2a=B4j!vat78(7RID=(cKTg1(m$-()-_T2xkS{(C3PCn-D6%M^Ff@ zbAk%>!x@-yqonYo!jbi#HQbrJ?3+y`CRsHEJB^r9#Rgfj12d`vb3Fm=@H|DXn38UM z_+bsp9UDGhcMP1ln_@{(_e*tM8TcXA31RyO>qte2^~&cDJ*e^AzSemDHKxf&eWLhnTLEiEf zGRM_=#U?62dg;;)BAWj%_n)O(DC&+U>aYjJHd_E=&|9s90e~QDsHOK9Yqi7p@y^Ns z-1fDRmh5cPuzeWalFrg`+T2V^+R|g&R;6rV+@k=UL#36h!L=@f*#p^JUB$+q;-Uze z^S1JiOC2V2uI3*;cC}4pq78XUK+Lgv{y&i6|FR76;BgQNq_cnvy-9$dh7B~QLe7Qx zm2~VW#_e6Dd(G2+jneWjxxLj*zkRSN)m|grZV1dPZ*0wF;k6q{lMC+Od&(`h5LSt;lvV`Wv8OIIKTz1BDuZ)ZA1U>0U9 zHw+>MH=Pjt>9-jS+y^a_3W0Yz&{#xK&&)N&rl^)r1X@YU8*DrAf%JRBqYG{@mNf^e z?H?}%_2zI(%R#BXQp+`h7#27QHXZ^?4JJH;p@{NTpd)+c#7 zLg{6?q<`pT2LpQG+S5dVx_FA_25AKL@7}_fUVz|Enhw7hLm_xaDta_}q1xgz3d0 z!$27v(x?(9KLi~D*>>7E)o*8Z=}h+?+jTCoT5km|%I&6?nM6m;X?+LIV(>C!LHlB*|%!WIx`oK zm-lN~*AFKHek|1(txVS#A&Bk-c6q0=CYL13A5SR@RYhk+BBelJU|`LqJNrEJ*zEL- zN0LKG;OZe+miD+T%;4RLTp*1CdR3;!t_?!c2J0d9m*C%K0_q4vs`s?En08HOjdSB( zW(mIV8d*B^GX{^_04|v_R%BGgWR7;4#`b9UgMySLb`X+4vEc8`C7*6i>_2aA{w~^| z1b`)XMmUq-(?h8hr@1g|MzwR121bHtZ6Ns6R@|w-2|4t=XZ~{NvsRu$8z>0Z0y8&gXgVIt&qqCyHbe8)bW84kHiU0(()%-F6=f=J;Fk5+pMDB`2}SH#Cg3lqAv ztnPbLkPY(!N)^2d4g)P_Kc#>TW4zp-vuz7zJG6uv%+-8KYHbfp*;rprgo&`rg+HKZ ztfRh2M`|9swZXrItvUZDTI}_zb%e2KG)&oYId|`l;~H&es?g^thmgLrZIZ8ib(63u z#DYLL?GCqN`Rm2*M*V$%0b+kJUZDYkS88l*%vG`My;ut$r6s z`*{~a;hJmXz&s4BFtMMa&kWqcF&ct07Brv>YyycKT6tI93}E!e+TJ;%a6o>F0LoKa zs?`NL?=I9{DP7fbM_AAI&^jf3RN*CJ@H84-px+lTM`3TU>exl@5HDu9A`!mP!nD7Q z*XX(0o>RYZDi1$1aYe@QgG?c~$RPL3bHFK}^aPgq=FQ481$Qd%*gc2hm~6;RsBiNl zurPFNFFpY&!ylm6Fj_&r>&M=+yQkuB|MIEx7<~0u^)5jXt`fKWai$|ONxrQ#gHCVn zra?mnK1IWir>b#m_K|TQYZeSW)b0Q7p`gLhrncmzP34Qo%BG`WTMYPNd};2F&;Vsb zs?JP`&g||2Bd|CX^V2mCk`kFh&sGfaJN*1#LS#tb>XaCZ`9d6i?jEqm&q7KF@|bzc zJ%r7FrAx91m|yrEAjsPT(_$3lGx7VI<78Ejvf-!pgrm)=JrRAIyDeJb(j`eB;Daj8 zKZfWt_b>X)aVrC&8)@4GQqw^3eE?D=7(DojwG3!a#mdU+}D zt^@b3S7M2xuCamA)>^-x#SZkozwiSOWBpGL`>X5wq@+*gcR+x*JXP3yI{=+-VJMO= z;$n2Le9sa5X9Wal`XJgis<*-=(oTv1c0H~8w#oKzz>`m77n4PWpUOjVlHl4uaS|`i zVNeEb4r0$Jui;-^M*unUs8vnQI1p3k=mGn+ZI7Co{xX%<+RS=g<*y!!K1W0hZw*aP zW#J7S9`AP=br!#>NcK+3^)cO^&VBOmMl92#^Qw@1k;DBc*f!FpYirNMYZPq1`B@~IwK(6r}NUjM$*$Alj69)pv6OgZus18R-wTeMvm9glR z1c5oZXu{=Revl!&^4h8dPb8|8|ru3!I=UZ-oZTaf?K@(XRmOL;KO~ zD}Yh}Xenv*N$w5c{y^4;(tVhZ#oz%)7#pmecu-5PUbt(TOdQ?f)Z8PMKG8U%*9j=! zRu4#%*S>sv0X+2I@2{ni^KErHkYN;Mzy}2Fg-RHgAQR&@$YATVNYP6Ij*kFOACqfg zpCZ~{lTxh6`GPMo#s7h>SS_`t=fhUbnVl6_0A`|=&`~e10S6-DL1VUOskOS{1je~J zliL1KYLFnH*4r~x25Lxv@UNRp+P-@dwekqHJjtCr1epPWr@wAuv+LXYGQgsV3z~%3&Gf~J3HS`l2n+?LZ(N7BL1cAg4zMdAE{B}DyjgchgWCpc^ zQY)AoB~hCTgDw7CaU&1gzQfP%WeL6kKJaTC5WiDY{3|Sfui!G&TDGwH$@hy(hf_UNq-pR%14_bzbsswXGvI2Lxvu@x_Uxfcj ztf3b$%3)V4F3oIhO(%=0!ARa^J%_9&j=vH)o;Ae(Lud&k`oOTKbOa}e;Pj1HAhTau z`P(zG3*cr9tLTUSGemu_VJQEZ+(DsGNTw2u?=nV+ew;x4E!HY=cA-?fuus`a=UspWX#fG72tg5%G(Gdm0d5o?!;jYDI}n!Dn>SS; zc6U(W=mn6Y7$AT&`Yq)sqmcDUS!GQiI25b2tip_X=r;x#3?8;h1&}2?{oF0?g}0T* zmQ#>{0Pa(Ev~iJnA6Mg;++6}DJVB%@A|cuaPdDGjjB}wcFBozwW;Z#y@Y*04HZymi zgM|Kr4ic~i3U9(DhY_XlG(kS@-jpDOzsXYr)&~_E-A4+)bGiaK?k&4|@1|!~Jsygr z)m`n}|ES%$l>FcZqA$yPV!1E4%L!C?9vK)eUI)&L9PwZLw*5Cw4wgGGP~az(K3MJ_ zQ4O#)9w{EKav39!JmqGa+tZ3dZMESnhiN*aL?eaHoAdn&gGC%vk*eMUxH=jkgI3rH zOb$hw*IAyQ)n|X6jBn&>j(&DvgcgV~S|tqv0OoDE5C$+6?qbOTFE)9-3q%6$O5~uP z#4t(%r%yRe-YK5jQStMu)zs)xY zAI5Ba~B_+>UW7G$TPfq0cEXV zHN6)_vBjSsD!}|TKO07a`b!hw5J`a0d=k_JVO^zg2<76>yHQO{?ZxCe-=H^9fScmT zxqcmjdqU}0_xgS4HA?B8{P;ou7BQ-DnIDwOff^K`F9tp6)quY6hK?fI*dy2(O6h@b zJN*$3l;?j$t2%BUje4UaIci68OhL*{rs;C#)#V$vG$l19Yj|bnmogIyqQP)u+f<8` z0x8VFE@1#Mr<|6NoDm&IoKcqXiFoHC77o@eO|_eMdCrmYY_C*kn?+Ng2}L8ck#^dZ z?G_b%cEZ}onT@KLMwY4;FSTdo0BQS@CpTbKTogXepH;r$KWALN#&5y^;REyE&$D{? z-gYT&=@H-l4#@{_OCIyWr51rKA1T9d7_qWGs9FQj`JC zGXL=jteg^{dW931(LWz61qtF0RA54RQSK9B)ET2PBl+1czzq$<#^z?P5@NISWx%}hzyj#9`$5TjEj6=Qsv

&HQXK!2%48Z>lc*3T84-~j}6D^{InLG|9caJ>`aw>La^-~y=7Pc8sJZ=qHHV+}Fa zsKB83XgegU`F0?Mc!@NRX&^VN!{TbS)9QeFa@JSg~26%mMW@aWJIJh?VFS3T5 z?hc-DlH;FlSTnf4U`hsM$cY8b#`01PUJ92CC?Cjv;yVSl?3 zK($hV;YFbUXSxwU@_*8E`3HpFILvvZ%&Hj-P16L(n`TXql0N!&Z#KJOwZnq7qoF0j z!Ln?7-hGF-<|#yFzi#HWyQe3;T6lDLc+)=tPI-93fMG#r%LYXZ>_Jj;ZfTv~25dv| zOBOI30|8OUZ!ZsMgv^0yPkvzh+k(pDIu!2WA7UCe1>5n(`?vsU^KfuMdP*m-p+8w` z4ECd49!V!QB!t47-u~mL{)cC`la7K(f-@6tBuveLAt4W}Ms1R6>g$(OX#VZtufW4G z@j_FehvP$HLWR&3Ebs{Thq-%ScQ@JbZp`r`0UttIysyw)4KTTIedq1VlbT#`YNz}Q zmB|Ku@1g~FGHw9AQ7ts45x_XLopZ!k^C~UhXk%XobDYA+@xc(nVe2VxwouO;l=1TW z8vqt4a4xEAwe+F8fDn!F@!VoT!Fkoi1LDb^-rgo6t6@?L3yWFapN-;<_gq|Dj^MXi zQ0R;h;XsG8dzD!8S1kaR1Q`|{9z|hOx z*3f%wg3xIrXkFC;88AAFMH!(NFJ6N#c2MT}XLWbSahxHr@mVL|ndxb3En&&lcUZ8; zOqM8gEO$^23*+apgo^T(LG1^2N@{8Vh-H?!>p@Wce_h-s0_U0L&}Q>?P939H2c|P6 zbJ0u6Fu<%K(I22-gD{X%K_`l>0|ae|(;!Roug~)YfAPOBFx^*mRB$_s?FpAoq^WBp zxZYIPxNSww0r>4twxY8dWJ&#`FlH}&h;ct!}b-K11++@W8Pd_5gq?lQZijuXmy`c;D#>2}Fz;h9UE@V| zI{<+d1M*{b{`Tu7FD&sQ50pqnb+jEN)8_%`2|PgECE2>y@BGWAOiI20xZ!D-)2=52 zBV!nS7=vDbisgV7O^oa^D3i{G7qtgvG%Vh;Qs7m4&or70AUgs#~(*1yz>NO+>;?}5m;?hD-n!Hzrt%en7 zq3rfogx+ohszl6{Yj2}kDBoaZElC-J*>hk{1=-ftmU=nG>Ss@y008~FtBrU9T)n@p z_zTV1`wjbZ+{cfYN3G+gXJ-d{yq5;aYs^&}Z$ANR8HW(w#Dn~Wz&+!EdoImfY>Q%V z#cH>X)E=id=%or{x5~r|J!g(0&EH>4c;iX5t@=T%rl_cQe0)4hXOc1-X^puEswemE zI5qfE;~uEL`i&bn+ftaeqGH%??iOhGyTnY$WnbI^CR5ulqmlf}S^>SM1A5OB4mj}) z?tzem=W|a4^fCYqkppD775Jg#`uu)D9-` zI@9D~m~Fk4k8Vs3=!i6<)}adRgALjT1b=!D=4C2B3ML?to6ok;TFvG>@h8Xyg~WeW zT&(sfH&?1ROAQ9_mxH|tn8U@N=URkPJctk+|pOqSr(3Oj~eFMX|og9mZZsFoKi94?qp5fwxmHhNd^t2Ih%71E zHnjyzm$2PIBF3ByZHl%2i$VfqmURSBjswBuT(2MAKUQu#o6vZe&<1;^sJxg_*N?}O zW<@>jtLeKbegGKz%)r;JZt1+2xVgD`87yq=VJo1LkK%-^$l|G%V`lZ5E3|JpxW0o6 z;xn#?OaM^Z_2-v2keRZ*h7U7W%hUE=9xP}s_mfak68_l5|HhND7p}6PPYwn_;BA#8 zxAQsBEN;}_9}a7=`Id9e9;SW_znyww;b@IH$?Rr>J(1u>J%S`WKA>hj2^2uqmDj*_ zuRm#A_|2!_E-}GfaxQ)W<@BI&9x7qXK#hD+0g<7(@Dot6Un&oJi!WHTP5B8HZ3l>F zig$f`LIr37gjrCTlRv}-n41{v%C_4X)gs{tWYmT-s?EC?AfC4~Ca8bH5d)dK zVeK473~2OI3b1t&Poa-Vi4Fc<14=4z0(RO=K4~F809%_YLb)X-z%7Y35U%Ap2{rxR zDF+B#%&ncH=ln&#zsyQrj^5uA;TJ30f@52dJaKt`g3^+9V;mh&Z$FL?&Z;lS;~x$W zDnZ;nby3?E?B`7)*mF3pE6Qa6e#CD^{Y_75^2fl4I!<*5bPB$e%zLIG*GG6dJ%O z*0~`L(A}SH5`21hUtd2xbTJo4O0iT}9}L%=O}up3E(t(PUJ95Z9z5Nm9LO9t*tCO>)NVe!8;cZY>_ykTA&_GQUhg?J1YSBtA5g2`sD#I zW#?Z~?qvCSeC}%zXty}1sizQD(vFSaUZiMTC<*x3seCigPRO1&w`NTteg4Y;n)8#3 z!1akw$&p($@D+4uB~8ho3S7Kz7oYlBAw1km;924EZQqP$!k^Sa?Jy6cJE3I@gl>n;z9z^9H&XR)@_Rk^kZK4|6j+7z!Ir))@exqKHANg=0jFT#te*oau z65e33HAy3+8M=$J-$&G?rr#zMz_=;3L1YWxCmh`hAsk%$Mr$>iu-OvYQvSV@-mdu0 z@ERyFuejjFvpWBkT1v7MuJ401W@edcD<6Fa3-LOew}qdN9tUXPl1%vXFQjLyqU~y% zMBMSx?(U=N1)c*t4bK~YAJV26Koz_A8gek@**8lAHn~0gh?G<@cRz+o@vu&W*SGrz zfrbd6)(0K^64Wzxa?M{yVuUm_5GI7CYgYpp5A0?&m@0nIA}iUm7pmg-zARdHErc;X z&)pXf+8ljW@kDeMIQthKVcQoADo|>8v(Q4L9R8M+oile1Xlu z<$}TJp2tFiQ2jiXJ2W)u=1H#N2zL8(Lvv`c_u%EZthKxengCbM?0G z2o<%GwyO<-`_6f7q2BD~Vdhw-`^yK~{iSy+snqM|x42PLB(DjI%Q1yHR? zLO;~)X#!$FFb3;^y~_!?ueHk1CLCPttL;~b0I8c)y;-X)cNiMevy$ZCH2ys8Q`r_A zNIyy-yS-JtQWwo`;xUcR(Hgw*s^iLClXM=v?*dYC`Q?W@2R{usHXOyi(S0ury_omEcgWv1fn*m6*1LX|^MY5|`nI9c zJ#TczuV-g`N`*W3UwqeiBkA+jJnP{^KRSqtSOa3hu;k@nm(fEdF7JZ0GyEZ`BQ!td zA@Hx4@GGa(oC$nmn~7LtB@^bsc$r9$98l8cN~QT>+C^kjSGKzCw8dkx+^EOe>C|l# z5E-&`fyexiIsdNJs6S658Y*@>j$M2VFt>vQ$xFhXKa`e6KIQL%|wnyR&wUmuU zV71er+Tt%@%>z_5-z_M+0GV=qHm}$!-N>C9?gVrl-x5u00I}aM!p`T*xPuRe#xR){ zT&<>i2sOF)B#@orXU+W2(>JFkp|0NJXb();W!{5J#XwL1E3W{=x}*Ly%J zp{7jA-p55*cWi7QV2d8|_G*<$>on_*8Oo9^yjr|6+{|?425C*6bm&PbeknM14Ftr( zP)N1__QFB-Lr{9TYIp>GE6EQG4pBUsYThqroeNj>fV%U0`@u?BUCH@8r$8^?Ztt;w zb=l}OB!l&^R={AIlcskz$ifxFKkYRb4dl!&jC0UkY6(eyHP+(@2PdF*?~?l)jdMn< zJGlh!vD%GZ4WgQR=b^ci7QZi{^2vVHUL25e-wp((OkY0}E9LEKq6L1Q3Gd5&Jn;)8 zlA+<|0n;%i@32Q)M+7W(<#U}@9KNogxyF!J?E9eEIYHpB##adk%lL&0%kMd1qad8{rB#wbRYFVZOhQnsW z>!iRDs{#3$O5X&-YPHsw`r6v&Y$5JxPHQC@*Qa+s$$hbgjrO*a1kcVsFuz+8=XiI) zAu)|e2Cu>#nV_Y3`_{Q80NAr*cFh&5{gK`tN_gsm(wBNv6$}ILq6{9rn5oo~Dx8qq zI2IEW44Ft$xxaR`F^mr-b@1gI;gVVJpJl-e7g`^Yod+ zlHOcdiwsCSQT>HL4W@%8IaCm+JmlN*;UrB;M*o2mUUiZPl4lEVo>7$!IC^T=f^et< zJ3srjmQd*U_*GJjBzDK{ebFB{?m0hu`{vC6&6;TgavCnlg^%+f^|X0I*C-VXyC4pz zt79{l*riZ`rLazI-MKplSL%8D_3o#*H%4=CF?`U#k|L^xx}~!awLp12RH#4@7+<+o zvP){oz8qWi0Uh^cyF4I*l^}(bT?E&zboNpuHqsB6VKUcim-7q{pGhh1mFzmrU1#B2 zzZ?^5Nc9@@tJz*#9$TvPvAlXG>X0kLk(~!yBa!qU2*WdB}oW2q@G?eY}MIe)@fK3qgY@Tu4u#tEh zL0+wAlpgZg*Xh=>-TeDi5i_OCfSeA{$vaOep)C7gNbZoD<%@IIF_r06+XMfbbMU=P z0)AJJ!YhrmV@2?~&*ifmqLLc7p$h?!4<}JMf6kbZ2V1h_+Ah}w)W|sV-1H(OI=2n)|_vbHOQ2IGij3r#iHybm1H1xxLz)GK=`wqvpop9ZE z#iUv-?_39`z-6|Mhx?S_@dvtjgc*7vrLNlM8}Y=Zo%G~lxwdsej@sqd8-)Bwch{so zMto`o54!T}LBl!Qk5ahG>z}s}Sp);C^)p7kXgd&GlCDOVCtSvc_9%zgd12iWq2@3< zN(;j!a2cLmP<;K(8xZ}dXM_BI2Am&u?tKy!YL-s6X^K%le?Dh5S`-zglvV7aiZM3u zV`N{{+K8@8uBZE~_STCa@?oHBDRW2ly~TBdyf{3AV$*@c&TbiF{2lHY;syWk)ncmw z*DB$e%8;Fn8B8`&vui!@AZ8y~%A%e|`C3sa$$?wJ0@}9akrKCI*lrI#n1Yd@m(hyk zGA)MTX%o(qGr3N40<#yo_Fse!OL9xV$=WJ{LO(U1wO-pPtQ_3-YVl<321+?v-(uu3 zX>`}*CKT7W`w|!iIT$BlACQ%j1-88w0Wo7*7rjC9EuRtvp#=vwY%hGB1EVRp86Z;oq)O7)}#tl|4QB2f#OOd@O>lj2iyiEVIW!9FEx zROhJu>l963H~f%@e9?|W>IxUf`B`g%U0nNQB-e;1;gDSl4A;gKj!^;xpZ zfF!Fo`$VoUvqqZ@(fL}*I6B4Qrg_OQd_Avv@=l)#B;J9GeOc|4m06X zG&MtGzdrfCrs#L|u2y;}LQ?%nMVpNak4h@+gtPL=Xpg9K1e!-Iw$Qz$WK}8LC=F(K z_!5@cO=LWFi0FgY9saOmXS=hrJmZF+%C#ev1At9sPR0R4W$37YXNSy}RnpNT*lOtFJA>B6 z>nun13&HfAIl>wJDzL2dWX3VPo^6c_R&kf+nzO&D2#I_+5DQ8Tw;fPYc|c&f%>AH) zew5GRXj(Ij3H!;)DjjQ|i?$L|?ozPrUl|3OQ)_k6Mf>;> z=Z02;kUWd@%NrX}kuaJp|KK6~!L5P&q;P)B70UaU=7f&Ry^`zl$~LnNM zRWm8fFzbUeci3}z0&ZrMC}(C?KJ7Jn>>sSQ8ZcPeo84ipGisGc(fpCuVDH04bWerN z&Hg@P#^H(y99EUW#+r7{BYfb)rsrb;2AN@I-|1RKYypn{BF-q|fYcJdSY{lICGK)E zgcjm=RM=G%%0lD7D#XI^AGa=go#?ZkUSXn4{Sb=LtdLea{C9_&$l%A)_2?lJ=gkpI zb|R8tRLXhJFo;qxwrPP-Q!(XF)r?OmDZ7X^)U={d?U?>b<5_{>-n4k4slD&(N0Hl~ zG)DOa+^j0dXOxfYm+8x1zTLdT)VzJft)d2Nho$NDwfEmR)NCq#s(!)7(%$Qg@osoj zuH{CwWvdz;BcB*a22xC&YB{+u53!fyx?fmHeOW{?4F~s%xx7cJ9HuM z7dIpl)ZX4^n;UN41yF-cI9p)gtYlXXDAxxH^g2*qwBtFHkibiNGxn_fvu`E{iiGeW zy7OZ^)_fk7ab5OdX#RYhadWD6!@2!xHJWB!eC#Yca{1`?YRCTg24cM@B!nH)Tl}e9 zxyoTHL*v4Xp`V+}NKavvLsf5wbyl})LKVI9)Fig%xSsET??|GX$7iRe*cDjValoku z*LyUkqDqmKk&eFos(j37wy|2P{|%w?J~~6CMc-MQ)jaBz(XgG24~=HMKgk64jEAn` z`UEPE#;O@8C~f)&Z4<6b|EdMRp=Rc^!z_`YyL`mmjJU7oXAWztkcn~Q&xKnIhM2<` z0j2kXaQ8KfJyeY0S3ErY8W4#?yI-p=QkoxZ#tg`jPi1M7*jG5bVb++GxMQW_G_<#z zI>AU_)qI(<=%SP11)IL8z}bEx8wD1)Su^{l9eUN#&!VSYPw9z^hKtHBQCe0$cC*Yc z4}_hVe658?V{m1PEXP6o@vZjuAY(C3G1~<4pP)F^S00}CRkguDvFlhHQ?85|C=?+reQs`0x(vL-B#s{`@?dQH4^{{;D;> zxTU#xRytxT!dHa_*j0TUn53gg5lb_Tm`WtEdc!u%JDcANGt(rzVMitvx2P5@iZiodExWi zDCd;GqxH?1JyQjAEekx@xRf^R=%qAsMXd^7zFM^!_|Tj3$}_j`S@}LZBY-G@di7ds zt8l2Nj(2c;4Y3$ij-Nw!4|4;WaaM5dy0H1sSDUM58#db`d|rGF0lHOZ88_8VmPL*` zNb;E%!w)}|d*_-W837Y``q|(IsO%Xpa7JBFcw#&}P+H9a44)Fsqq2{c^66!WsO5ZR z?Hp;-WWwlzOzgAb9=WH6ctl$?A9j-hjYceVGl)f`{)0H6`o=?Fnl!t zizI7ASl3WLAPFxk;F&;bYfcmwn-EQy{>nvDs(ebjn)9DsZB+zwH%!A5aJ<*k=9Ed| zZ1!qm%{omF@53p@mVeaNjjT^JA--lJi^)XS=`!rnAK;3~d>`dXewCIL!^`0)U(id0 zX6H*QmM@0B#j<1extD1FZjJQGWOWD$43z~u$(r+)2dqCRS*i`GuecM#+T|MxJ-CYW`FzsG;XLAP2uh#6x`08u!*4dip9&XUjd{)$` zhTnh8WWTmjkZb4UGO!gib#taHNpVL^oJvNfdyp&TRaz3L(Sg=Rh-TnR@mML&buZE` zB^jW`{k!PFnjFBMEO0n`IPN%LhPet-=9N~&PNOpNR@vwCY*J8WSs_XqnztmV~R zb1L4OdVn_#)$VZ*e}JS$xJK+D>Er1$DY5W5I4PQT^`-aLOrJVY)nYt?AcpDp9EE?F z3=*YzTs3wtg@O%7yL5410}VD)bK|1E2LWG}nh}lv4%d)6k`*!xxGAVT?yHr#bBf^zpaOg>1ZPu#AkAOttKs|aiS@NJF*yryzlf>2^5zR z=MkMsHjctuj#mJ8)&lSNGAY`nZ??Tl!_994_=hi$!fP~_QOWd|P`~&^cLpf3)DQeK z9fW(|+8VPw+&VQrp~jLqg2-YuwH27GHp>a(Z@DY?*P{cX3GsTcvfVvI)1s1J&CUE6 zoMKShi{~HRPaTb17OLM0?V`Zw(I;}nZ*ik6YQ!V3iil|CAeE%yVBFiWQNJOqd>kWP ztzj^|h2=XYo55Jmd#oXod_(HlVOs@nPm50s_T)gUa0Dub5DRk6yjR!EA@|uIth9i1 zG@NK_y?+R4AEf>AYN12?Y;c~G=J5DDuOQVehZO4N5d1|e(ncTlHOGCkgj*!KHbIGN zG#pb=)<%1`S8M1;y>;xb0k=s9@ALENm zqgY40fOL$tMFKv@^`HLZ&$CK2J;=!Uk6DCq(26T#C6CsJb6@sV9T&j^K4R?(X1fo+ zDB=Vsi?g;Dh2j8q+)|?8dnA~Q-K)ct>yPUyFO$NTUGq^Fh*bhYanst%&;_zUX)c8O zPJ?pK`b^uUJWCyM0`mKpXIP~KDA@;2H2GJ<^_r)g)2Ra~l8nB5GKNYk&(XKa{4_1x zuGxzm!Wal9+a4rc^r2KwY9&~Y?tn-O??JGyLC>RB#}xXGvISJ^*$*U2Gi zFmgWoEGr!_Hc~@XWey=@!*Imn%ka+SF~Q(K*XNGRq_~pb4GORsm&*y^n2>r>vZBgo zBjW=aD|xI$UdF}Cl!CYX_Spdjv@H<@M&v z?v7@4jn(Oj92iCGM>@({E3=&1S)ngP{ksGN9G7dqO?)2cAYxo5?D>6&=$CQbBH~^5 zqU>19FSH>4I|0^J5&74J5UfoP+H{eTa>2WrtT@x_5+B&i48E2>^6Z;` zx!#@GMK&9RR@Nwi=(mihU@*E^F-1rj#iA3C5kgsO2?cnnfiCTJwdQtQ7R-Lz z=d{D%mZqm_g?Z2}@U`yfwbpA=V%*-IXR;!{jw>rGHJChYvE_ppm#NrueYO8!ehe?cU-uC8y9dUZ$J+z@hX-< z1}*LlLPCa-ApAXguvDBmcsOyuXMEfx#VYfx^4O>du%5c8CffE54T!%Dd zibRtRITcTj_QVQUzrQ+friomLLou)Rn%j~V&}6f-+&}qKBN^g>g1A&veNUZk#qyJD zRA|kTZ`bty{b`m9jHZUbte8I5vY$8#?P0u1{mqF{3F~#8=-QqX7>lIxtzzD(7F6GK z?Dk6fW=6TW9yvKpGMf#%Kb`fl8r}Fvb*SmhaoFb)5E%7{fO$2@SZ&R`WX835CRe2W zYSr59Lcj<>^|94Z(ijAdRZ3}zF;LzYr8(}cxh>~asv2X9NFd}Grt^)7ih1Bta`gu0 zCC`S2*BnNY)oljzCz{2g{@%gVN1ys98k>ON%(H&T2U{rLoK(~i5;>t=BnPfRf?cH6_P^Mq2G7btKy)Uj$e=|ZZ(6H?Jg;6)X*bht>p$LnRg2@Z7IfvAri2>fw9T~rb9=7X@AEU@;))(#6!Xj{HYnt0>+>tlFD7+7_ ztZ!FrukUR<5l99;F6=(iBi;c(p#r;0_QtQW+kdsY3V_dn$ZK(0*UcV0u^OJ^y-iV| zlVt>IS|sK|S>?VRCpjlMO=|346gzNZvSL%nyL?Bsf^{I!X9<=hPMC^X8m7EaAdCsg z#2jJ6`&q?WUpQH{^x&7X227e$iEd7n&w7iG6ALBLyKB8(2>^-yqaRG&1`=H#lIRQl z04o+NTOK9R+mn0Gi==9Tm~seO69r}{w!p1^<>zS1$7bdq%6A5E^J;G#-kjcJ)uS!= zWgYrbSND+|GyU{^r_F)Xjat64#DguEaAc^@NGGcKoNHzXP?~H6iP{_Rw2E1@pzbUO0uC%{OoX-Kr_&bVpLfl z_xnqi-cSL(I3Nas-c$!-o4%dbuV3=~*!;QttbTvx1(aFXqhwAMMDkXh_zYwB(lF)h zTmJ9BlDMV23`U=Vrn)@vOUru($j0agB@Dpomj}W5jTn7ka=DD%raZr=IVjD8raV%R z#S6F9L1fn|5GUNxy?};>7N7h`Ke^9^tc(3-w&VO>Xjk2p%>3E0_%E-^1%o4w# zjthPX^FxKz>2Vw*)&!}7$ZOnZx6G2VimkZo+tM@ds|#eQu32EP#IOv202Rx#KYIX2XU`HU9x4gR7z633i2P8Y-pt}$4iR8=T~ zU$l8q1&_;+{ZCOt`N%k+44!@+7tyvkrSSP-Jqg+ zB{O)1v3rg;K-FsU4*kK2dl|ybH6Ii62(J}C?e&Pu;z4auUlZ~WXI5L~&Z6E%*st^a#mFFwsm}Oc7#VzS01Ubrii93^Ra?OahWDZ zzE*K!M5B40rDixxO_Di`JKU67_TwD7daTyKef(RDhBNCT?)4?|`&n12ite*%>Xy(l zc25BzIQd_M;65+MlmjlBT5=F%m~DyQhTqkRrc)^k{(($Vo=&4CpDngctZ97f*#(46 zTc@e|t4B!zb;+^Bcmd1h*zF%DmeTaK8dJdmKH=JEBZln`a0aKBWU`Go{Yd86uUj1V zoqHh|VE#a1-|e!3uIzg9_Ua=!anX zIkM*{t#%brkHJ`I@f^J;#%@4v*a-i@e+h3qgSj|iF4)A}s9+c%S$}TeF zoj~w*>Lb%*$yw1NWRz5tC>Gj`maom3?v8y@xT#{?!FF)!xDrqx{z0gOB)ou$rmiw8K8nu^}HKBf}+k{8Y}J+>C5s zPU$Y3^y3o%%Pa&cEI|41hv4k?E{Di8&T>*)72YQ4c?$nOY-h2Me>!tVS_xaqv_xt|c_aEQCzW=2M z*L9ued93p|p2zcOx?=vM8m-jH&k1;0G z*q)alQa$)$4%B=0ZuHZ^r@@$AFi8NIJR6Ye|8oa*K?jjRr>28#A$O>f ztr}6lUv0zK%szh`F}rI?SA+e*$9-+Cxbmt9*a>$UdT~KLyvoutIhf|~-Pxohx|a5! z&)yaWF$Cl@o#h})L8aVp{d2tvd0E)dav@&4gH6w9W=`&u6|W->8Aa#V(^JIg1huzS z)=8-cV^?KV#(QJ=fB0f8PXlI@nH9M1a8E^^We0ZYi*mZrNvo+EKl|GO*(G! ze@J{Z^mz-TgQ-)}di7?7Ur=3bv8BL3u8wi)wpd^Hj>y zw=)ME-#VeXd**NiZr5E2jZ0$=@HcE6Y{gJ(Cn?m;#Z!-cyLbkB+1HtTj7^h{R7CXJ zZcAb2`G3^7_)V3*w@1e4s*B`txjkjJw_jZ;xtm_`HIb^GQ)Rep`kLMRj0W)Ejx@P= zQ?i0iEQ#^eJpe9g>MK&lP^ha91lmYU zFu{e1XRwWl$!N|{)~ei|2n3d?KaV&vAFB2!P*u+)rYFOSi9%aE$WD?Hci)#6BY<^1 z3JTKS_G}(4GWliQgG*$y{HV7$)(ARM;i`YC(EQ;`fdMfl=bF0yXjTWu9?y2pY$Vc` z6IZ)m4#THXZ*K_ntw+OMosRXJ+W2RJ<`OBFH>y^aja{CiUB{5+-4n;b+!|pMu0GAi zT44J8l<&E{`Aq2Lno<8@&8D8jYDBbivfDq)9;uhbPizP43O=%G45NX9hze7IyY;m< zl?_IB?QxW0l0B65*qO<5_g3Z-_N)~griLD}g%GNS5wNBB$^|ksEm=3chg;QBg?w4b z%Lz4>^c+08yK}seE?K3n_T+ogLNP2SzSWA2kPysZ`@6)skXS{{_QUgt{T)-B{I?R7 zAkBGaFP-EU+v7$Yxo=Y92t!b=O>KFN_gwNK7E$EE$VRhtdm3FO&LUHzG)u0E(ah+e zvqDlOb*rJWvj2R35*gps;_%0aTrpGqo6gwjA*@=wE8~iNG^T3>@7QtBp8=1FygjB6+I&_HSAcQ zR`Ru3)D5;p%B2>2VGhob92BBotxE;5p-B1m0}oSH0U5H<1KyVGtG@Zw-=$jpc_KH? zGK~%G4h$6h`Pe5q!uvVpwmE0?Mdd!;Xz>rN)jGHa*LG~n?Or$}Sd*+!5ErZ1RCNh; zQgs(u=`5+IQhB_0f=GiDR!J%F@9NB;g$iej3kleo#0EvKM1<$UNdpRK90LmdPVKgb z+Z9wi%v8aHFNSeMrojH=(R4r#4C4vJkBvus55gdK0vtNPWtEI9VxpL1fTuk1T=39c4gH^Wya`~JMPmkUD!>g&2J7%bu7lwJg{R@|z?ZYlZ{)XSLdJz&i5<>NB#27(W+RF)N>_fQ}2@ zcVfxu9IX*-@BtrmZCyHr)}3X%B} zPXqP`9Y|1`8(?@MCL%yiVd(^E5Kvv}4>1p{jJ?oEzm;uOmAZ>;-{@Oq?}7I?OIi*{ zwkcKIoep-~^Zb^DsOO-+D|W?o5zVqmi?)K75>BXM-EdYw={`n z?bz!_OP1jZRY${~TEllh*_ELAF1!4(%wZZW*&!teF53c=#HcaU=%$juTVGHadg8L7 zGV>tIwYk7qcX2!i-v~OAp}M0mDBKTJ7nfgUGw+k+sK)pU3t%1iYlB%zh9$Sywh(li zL}T@-hBp5eGJn40as87B?>VDG_v%IdlXhcDSc6}KLjE-I`Q1@rS36VmgEFzPsZxS>th>wowiTVJDtq`|7#mJxmrcjoBR9w%UC9{KJZxvTN zdG+0&FnhFr-?nO3$O0t;wCvx;Ts^alCuOv6SQX;e^Sr^oa1sU+$jQ6q((UV~XT&ACaep&Ib1o4D}g|+AL2u&by=Dis>fbh~0YxpKPcQGX$c7 z4sh?q6^?#f1FB)ZHw1THO10f1cl<>4=bJ*V3sAo*g`|f0I#$ACFgo(<5E_)rsj-B< zN$MRm%qJIWOC7;A-)S?rHtEj03X)D3vc@3{SroWME?c%KSsUloAzv98#Gh$xn)R8Y z+w3ZM!r%9D<~#2>&iDPmW}8oXd=*2Ds(at8;&h8wdcS$2zAt+aiduCw?yvf|%%Q>r z4)RGK_<$UGt*9;-5(}(O8?ZXe^huAQkAeD2K{gJ@IrcVldunN{rXmdp4_(91c$m$0 zDo<@zC#BikZS{48sPtFvvpZTz0QI2OBp10$@JN8#MYIo9Kk|M+e#gZ@C8<^LYz*$` zK@T!P^pcI+=1C0?3R^T{*rQLj?(d^z3D1!2$xjfIR%^r}GU1U@RP@AoLZF_8!* zO0+_tHQt$EKwSXD86}5dyEN8@379DeTQ95n-GJl5pZhO3`hR{HWL>fELUtbX&_5UV zBn~Imq@Hqf3GJ+m+N1)}gG?+kCjC=(uYnqO+-zCZ({B*CrlMDTp!C9JTh_1f!+_e5 z+42=YN7cVC1jIrQdg-C;`Cll!_Yi?2WsGzPW8D*w`(x7vj=|fWB$pc5pX!~d^pDH< z3!I<@3TJ>UH8835A)cp3jWpz+zQeAqdLlb>sh9`>l@-jy*M$HT_UOQ}7L4|D=Ws+K zRsMp6g@PL+h_?%rLY<1ACC46ovWbK_9=Tgyu$hPSeVctB;c0hI@5bQy>HVXV?~~0I zb=MlkU+PE&4k6{fxE8aQLZeBSX7in*gty@}H9pk997;R}lF($do5 z&pU5hq1b;Px!3VTOTBEBtOw^uEjGW^t!1;ucD+w#gMxL2@20!ojT{%bG?_NU0XU2l-r};aJkgNpkaV8_|#ulH4#SQOO&A7<{ur~_v(*Go7 z<18KPV$9m8tOC^SWX$>LidA$QKOJNNrJD?&K`}wU*Q9k+ zC)XBBi-6!LVf=lN2Z-qSC?^Vonp)O)wMhmTdCu)m5rgCR$M#iAw0g~SW){e^)L2L= z?OQ9I&&^4A?GxL>I3DwujWfuL6uz*`=lFC|d?vk{|LL=zUDVsACY>1T#&2??i)Mnq z+p7z_f0L10^>1x`ZybtscGltXT=YMzY zhwn@5nF7Ry)6UCOHWs^suySVK*z1iGdG}wlT*2Yp?s2C9i^OKmUFSC=LtM8=)x&AZ z>RxH{f)=f~Z{*p;?xUynW)iKkc)zDK6ifZ@VKmhBfL?Q>;)1<&X5w>FflKC0Rbw$5 zs}t`XI%^wtA>8dEoC8$ikkM;et`au;8uA%-` z6CcOa|4&ZAd_&uU{xPF46B%T-ssU+b00zga}e1P_07 z`>n?he7@(jo`fw080E6~{4|>;yofvVJZ4mESK8LIz)A@AH2`U4%%yOmA72V**+1Dd zVxxE0#G;?dSM{0orrfV67)MN_#=jgDZ61o(d*45ffT6lZ=jp^%es;3Tuv^e*qGORRcqb)pGPDcYC52RA39Ny|FQ*f&Z;Z~9G*rwH`vH?9CGjc|Wf|m3w z6k1Y-8?pEwi6mMqK}zHz{@-3ZfJD+r7nDoz*$`@2SJ;mAC)^b{M>JiG^EBTbs?H%1 zF2Xr`)JZ+I_2llfHKC<-#iy)tyNQzp`i^o!Uw;dFEsE3|K1t=}xaEqxS3xslA=RRG<0ZKSi#wrg^C z$BBY$GH6iSb8vj@YO(Y2Ue|2X#nz~th7A=mMO=AYKF9`ZJ|Jb$F>)4K0LNJ|hKGiDV* zc7{#4QNdcntaMj2%OKki)%$9;-lV)HUx$^rfbE#^;;P>niMDM#z4~*4`@%9$%c9Qt zzLh~-^5>k~&vQs2k8kU=$e0dm+O-_Rsx_eid5`wmxA*2Iuzh4{M3?@*yfawy3Qz zS!#^c)tA8m6+2l42a@RLSu@%$c@+d~N}ACf_SH$}1it~=dthJ&9VR0!u4@}?yjo!eY-AImerMJ<@==LPStAf{Hv=Nbnr?U6 zmPI-nfRvnL4bA4A_8LLRtb8h};c;#9z3ZypbXIH1G*)`gpA*L?jg!1?#t%UrqBCwO zTi*2bT4VKMOK4&OB6aV#N9?63pfHsa0JE( zvzk(3$Oqyan;;jI{*Mdl?74v^W;|eyWj4VRWi9MguV)uVuCEZ6taV^&Y|nHAmI0-s%Nqht;y^Qxm)+?gi%qnfha z#z>L=`cJ9}Zp_Imp9vW=mDqpQkik=A?@zAZB-3LyCHK8++n)S|edJdP@E69M1xLyjjJZcuyg3==YpC#5 z68Hki#=_1>6EYU6D1NjTajS_%Xc<@+bpW-X+S%S7Ag$X?%l@A|J8ccIjv7Wr&O0(L zfT6A9!b7kLIYU9VESa6V1cRg%^D}L;B51`9)WhmY9Nv&yT6`F#6-YrfQsGcEiRQ_7Y;Ls{nR&omYtZ zM0L{OX8b|TPSS=KHWkUuQIHM7K}A$+J^1_u#;(~(?p*N3|5Q$<67)R=_k2%cncVrg zAUz+qqie)A5Dj;#DOJt%SoH@qh2RpX@Y=CgmKVKTyU;M;3uQO*y5VvQeHzdrL^|@B zCqt9-3_;e(V9h;o`j!)OFd{V4y6c{G^z4mtu@ml^D|nmvHLh9mk|2@L!H|3qP36vc zetYLbi&y@5_U(@1X-?s1yF!7bBSCaYlERiy}5C5 zzR}ay_lC!2((ypb!J&d1r#z7`c9}8pR{*x5P(KtB{D7A zr)@b{a_Ljw1Zb?9OWEanq$y)u^Un696Zbc5dfm&nbYb_oTtsD1O*d+#JMU15ciIUj z@B2gpEQ`fD;SPR03K}!P=5%SOKHqDeH>V{>9lVn!W~SgDI_KM=4-ejOBJa~^x}bdG z-QiyeLD)ypvdh;WrRC)Cj#e+kAZQp`bl|Vl$fimB1SXGF(}aJps&UTvRroj=Y#GXq zs<7iwcf)FIeR@HT=GsOLr&C0P(6ehD=WNoc6-3j@t7^=&Oip-(QeBaZ!{Tf~g{xa* z!3Hf~;_=YRh##(3Wjy+!anlT;!6+Sy&dVBhD&0aV$op0p1Q}6?hKeU3PZ5S*0UF>r z<=k-k`ukh5N+yifgTule+!7wzeu62CytZNt0n!PBl80+hYV{=+L}00)t!=vQ2$)i( z0RP}OmQpKT0kMjaZCM47-1-ThDOL1%Nj*h|0-z69yKL103!Z6kFyy$~UTdvVt`6Gn z=+c-Lrv{LVa?t@#yB>pDc|G&y>!9c_8HG^KS29FHX+x{{u&z(?JPe2A!qjQhv?N^f z-i7J;XOUCNcA?=LP@d!p=-mf5wH-ZkC{MuyYHFu9$sWBazVOyL6@%E+G<6>Fn1EsB zKf($Rc63V0spXrFIO)(TSYM5~4uTw?8qpL93|!}Y?EXsftw?`7q6GQH^{@<@1GfPQ zl%_|oAlNg|lMJ^ryj(d*4hLG?1_QSy=c`ZW*gAZDFL-!kLhAl-%R%JDQ7@8jfiI%K zLZSXKS`N=CT{u13Ns^Bhepxs@p}mT=g-X?k(D;)E1!YD=C?+*L++}NUl3`enMsLbQ zdct+k;uwar)$Tn-s5#d?5SnB(i3M7v0o4o+Yld*$(;7!qi!C9VG=uoWy>RBr&)O6% z;dRW>ZUEE{(n;DpTpprNP+`IcUodJv`W~!}(gPyMl3|6(D#uT*G3c_rP(wR7%5jiU z&l80*KC>CLj~gW4mn7FnLdGd$gc6dKLC-S7)EusS5|blfH5Ed2 z!roeanTY)Fxb3mFB|GSBYOdZ28^3#DYIYjWf^5u&NE$%dP%K;+I;;n1KE(RYM{}X` zF{&`TBp(t^x-TkY<=B)l2;-(^yce`_+hPh0ovL%)eyZ(h3pi19rB_qZbmMeDhd;=6 z#7JW`JOs&KX%tWqmJ8J%FSFhr((?}=kFlNhvK+S_ zeT=PG2%C=C%?}e5b{uxwZ_cip{>H%EVy;hQKy#o1F9n`Zo`|IPNsSmtbz!r=1G&U+ z7@)pjXo*3=20~T7zkf-nj+6R??F^1p9H2D}7%nha5i!J;kn}X5q?4rt z6XcNDe~0|$FgjEss4VFzr3f$pPeeg2r-|r3xm&L1(5av~ zKrKqWwVYriQMb-i<-r8@dD3LzyWZJpZ?*yFZX&<0xLsm05&u7F{S^AsT5PuFo+RlG zGhg~SKsMOBMA?1WpDYhjeGVG7$$%*J7&}wF;Mw`@4_zb;$@d@3P{2Tvk3NrTJjmX&Dsbp#K_CvE$n#Q43uM!ywIJR z=CTyA2`UlLJzH4)jSK+_Hk65kP73fDAtenHSoiUK^GV@?Q9v54eeK4bslR^-FiW!@ z_skw%kNEnPqWWZfWA}gYl8fCGk>JM0X9c4o=Ue`Pfq~P1_Yye9nEgtYN{(PgX#yV%e@FgQQy}01!#?c6&Nbj@$>%%KK>#EaLq<)!<>%hI2@0`@Q}Y-&8sFq zvhB#p(?-%afCcmvi1gt9Vl^hGyhrC}CmpQ57j)!;wz)y$m&^(-U68U=T?rEgln9{w zF~%%%{L4QvEvyPfa5sZ4^~Fi!T{|HP#HyHSkw^&ig&xwEH1!;vYS?|p-IoRB zl;R$cvPCaPI3bM-?nAH~H4G?6I*-~VbPxs6RL?&!=!#(hR_vEU{lE<{v=%~xfYC3P z)z5cH?5b#)Q1ugfwWw$`B*`gnE8n!>+W{-qzFxKEYYvfhFDni1Lc?6Zv%#RoCb7$v zs1+Fn1G4#M(z(swb#s6ayZ?XjlCy5{TP=VmxqUsm>ewh85Vk66|Fv0QDC2!>XmDq@ z))aWOWgANgnuHx#lca(|;CzCgBgnSr-RnU`bt1SFF!K!GBP!f-0QkIYDlvizvHa{i zWo3^__XadSX^#Wu^1y(A-%kd2p_D)93Vs37{|(?^Fn)->`d#a;prvKv*T=Te0Oqay ztbOB&VMurBOWu0B{-&5h1yWCZ+l!LQMYIHY-VbC!cRwLujQxm?9kmz&xkT{2hV)=} zki_O%6q~?Eqs7*V=r!Kpzc}5|ez-j3A?ZmRNsgeNlDKpsr$45{I8py!lC?M(iA@97^KrHZ!1&|*>AO2Uqe~d2IZ2XbklcsvG~NVGDjaF79;{cLm<^Yh#}4=J4eGGzHTqb5 z*E~ipK{PJ<3Vb?`0$NZg#+{2_FEllc{RV7Vok6&v&9S}c0dfG*_Yjm*27eY&u^lD= zB7g7-ByC)rKlF-n!u|DerpA*+UwOb|yyt6JD7B?zD-CNKJIXFG8x(uL_a!CiwvAG zD7rypavvLFG=J|U3TUXu-q+#${B?Jufpfxtq5l?Tj4D%G1*jBXF5+bQc^ihUGO!yN z!TMlr63|&kw>Ba+eGY!33p=0AkkiuAHgvLH5=LEdWrg&a6w*0wG>B+BLnVtt!eM{d zpiSK%dhYu#2_7XV+b{%J;hrF!h8{W)&qT0G0blZjz%Bs^1|(G8yps-!P&8BEjY&Y) z+^?!*Y5>0+Tnz~`AY8_U0`8}%jR4dPpCKWi0nKJ+f;j+UU6x~FZ4F8*JD{}ERTWq* zvUQK&tUk_00L{tlbmpwOR9!(aC;`U!tGH-4h@0aqQe-iI(*NQhhhweJ;-!B^2AQu@ zPUTUIoVJhSP14M-ZBDtOtQVc6rK>$wy2~Q3daEgP%&PaE5C5=BaX9%B+a`W6Zq&)r zr>46c73~i>j~0K*iRc4CI{4}F>!sy#lhd)on}2#PNP53G{%On@o;xTjXuLYv#I0kt zT)2^PznpVkPt*YCvy~6~{LU<=G;^L8CQog2UAU&3?6JKSpd)VG@UUWx_BV)6PhGL7 zYqjEH8pWDR8|_jC7?O9d$J`CZK%1Qp{5Q!){mdWB2fC~TmA7}Hp-)d3-p}~*KDV|m zDm^F~gfZ29zU7}!TM4JGU#Svy#g_9v-w)I}JHz(JT>g$T@o0s6q!^VFWo&QMb?Omxim7Zw0px#7K^SNurs%tCx8@!Ddqw7R#X9>a>^(>E>K%`#_bRLhj0;VziKm~AzU7lYx z?3X)@$YE@WkK#% z8`i3b&o*=xUXo#$BEPHhjN*J^)RrCB+Cwk=Cn*BGbqCz{zp-c*8#Z)>v5RMy&PRwU zKP?3s2#$ORpTf()+v^jwQ41KiiHYIEZ;(?O0SEj7+G2{N}}5pIeBxgbl&@W{#zZj>#Qkh@?#mi&V7Ng#~jWo<}}OF zgz5JEk#Z$0RSM^NOWxxea^3PeOyYnkv1FQuAvk8IvaS zCpwNgI*6SF)`RMj{0donO_pCvSvrba;q<5du_Pzx0t5s0I&q^*Yx@Jli)XGDUJA~8 zOz+aJ7A1M?3I9557(7uw3$qK=elQ9r@|xh)sPtXx=tFE7JAe(()hY^)h zYPO#C|_L zHNU^)`ga|6fqMig^OLlV=aYW4Qi2opR;_HYFYYK>mx$~PhP7%s&%ZlO+z>J;nS8jx zl(~M(syg+;dFIpA<5-d)$NBwxL7(g=^_4?{3;H8_=O@W08e`;22e0BuJZyrw8g_v( zA#(}-!aZN^^IIkY%KvJNC*0qVtOvk1ph-?!dwYL^ytV;`$=HvVFy}LCmM|~~_-FP!zquKgQV7{2V=X7?WH9M z-*PR7;<6nGZYJKi7Z|S|Hu^fIFORWT@bP>nfbq{YFBQ$`|_6A^$dmD!Gx&et*1nZ1V0(NiVVOGO@2? zRCK<>l4>S?$ojE-f_M48=9%BagZ>IHxZR7B8A&ok_=W(zU)t)bR|;5svMHPGK+#3ATQI;@VuPe?e z@2Zv^a_dLHwli{bb8Gy zCf&3?L4+a~OaA3Fi9Q;QUWCCk1rcv}_U24%ioe6CuBDfKG& zU4lQ&^y5!xY3fUBdFkdqEUeRPo$n4X4o3Q?zt}+wD5r5PPt-je>lZSXl8`9BZF-ue zBB}Jj=Z&L*dKcE}{BTpN@VA79=(g-+ec9mM%#9BPZruW7%d%*ClT!@8O--`4Vsy@0 z=-8bl`tlk#qN@@U`0;Z5I75^b5lV<3k9DXzm`$`$d&d(?N_D`;+7QQ<(8QDj#n7Ig zTlR5GRgV4b@6^z1nL1xgazZ~BKPGfm_41a`CS8oA_3(m%;y~$#y_zvQ4vLkYI2*Kp zNBdar?7{sUL5-0OL$Rd@ruI%7;65w&EppxZ61eDlAXq#-udb33x9r+ z_AIOZ*TOh0yCeRon*AcNKKJk0cl-|oyh=vRkAJ;0?^#qZ`aZWKD^Tbb2MZB+I`hO^ zIlpUJ5Kh3~=oQOP9KFFV>?k${86>KV7Rxie;Cjw=cLN{ISkVImeEHZPB@uk8))Lza zvNlzDrYR9`x`?|BKR-K=`o@_oWW2ytO{VDl-j{UvAXx?0`V}*ff19d0c&+ba=DPAs zEJ^5)lIg?hG=o*0-Hn|7{HSFBjvJW8S*qMQi409cT{55CzN(* zOLLkQ{AptB%tg5$o2}0X(r!7dsjlv}40c?^c=y;=SeBf`NxricM9uO_P%Sr^v3?XlwcI%@$NV%iRI;=#M+aH7D?t0J}KH#gFfcjnRD-6HMC)ZA2XH-ksI zW1YCLAgK3QTW$sUp_;;C)clexi_qijs!_(RH!%Bwq31f2^*cOiW6@IP^i^I9*|&-` zk_ThYzVx3f9Pj0GlH~Z!$qFJSXT+agu2Ll1S^B_5Ia6Jj30Dq9e2&YjqSj9(v(@GL{f>47UE}%fHuxV= zjw2qW4?#QW^-@jkL0gD*_B1XT8H>@a>^(i`+hkw@(X_1Dm4FEweZW$$Em)339o_3)e|5YhSFECkp7Gs50j$(g$D zkjGqvH!%;Iu$hS2Q5w`aFY7GYNQus0 z-Dk4bIjw7ZYcsr~bdVoZZ&fmu77e~>|2KA}xyPBOceMs2!8L#97t?_fBO?4) zB%WOg^|;jZk(JDxsk|V(BtGxL^1vp)pMAYC%|7dLHgaRTXZq~*1zbd z#@BdfI(YEUtCCHEltN9rBO(M(bxF9kmtm$h5}HBZOn+!+D6ahu=Us#C=~UhoH&>l! z^-4LoJ}(rw>foGpjDIG$2j5_JmZ`FSTU=a`Y(Lr-X2LZ3P4-oYm%7)z?7{-X~22IqGb?N+)n8-3r(!@Wc^c(;7? z6lQD(I%8}btJ=n#GA60Vr7-R~58eqq^Vt>J`Y5!&t?F#*fGr<<1gaKNU_?>%mlV>= zE0sM^fSe|`+t956O?4_7J`rHOGVt!P&mDHL^|F=hscW+-BlnnirDT7#X}mkT?)#N< zJ7-t1<@ZaU6ioVlF~^U;D_RV!!+rYcU98a^73x!UWh~P~RD;r5q|TD6e*b97Zx6~I zSC>=FnLH$lKjxg7EpqbV7q-%E8?B-_J|foPQWic>6jkDocg$q=A&|5`J9hIuzHpVC zUfK&gs4X+y3f}&#zfp#t{o8{6B!}=i)@1OE#J(|l^4vI$S9oRYA=|~a(>v4jKHX*# zcr*Yb)Jf{UY+zpb`?>muQRgpPYoY@BY1@K(Ohyd4 zGchXjnsR%Nb_rI@lN^Qi#@&8N{rA;Qyl;8+YlhrB#oB$4nCt->3wCg_e1_a)NbJ{V zgc!TX=_UTCmF)D=nUB4u%*7!`a(-`Y_=&Z0tc8pr@6m=?d(nC?i-wM25q+u!bMpD< z;gydTGHJ(4I&7s+`>HaG%$4_YU88AY>|fN4$){PQFp97Bri-{unXWGRZ=?{ky{{c= zBZqR~KC6?H{2ozYhNG5szw-Hm5RN~-KJto`VD(D{TyO`$B}Lg8wZ$f4{^~_Qe~tc* z$bfx%+Vh)^N7Y662?=_0nhOW(J+@9JSWlmRbt!i&I(-~RmmoY@ShseM<2;r6Tiao* zth^Kgkul)*df}XWDX9D8#BkttC6#Y*wE5MyZ=59*y29?Z0uDA5)Lo{Z<;_Lcu@cjF ztyo;@+m`}E;Ch=Mk1n`5_py#?!NnCT^+}}t*Pn;4q^@Lmdw!38xWCM>3!;`c4POYe zb#1Y8QoculR6h7@43t1y*B41LK#1c)(I=cQ9MvoBi&Tu?zD*u;zBsESef%n&X)^zb zhP;xYd+gR4`SXi!Q|p8TVJZqne3*wbQYIO^cO30dMWVDSi{@;{h50wTstrFk?BAmj zr)S%7v~LsIDW7g0F+qG}lv(cz4A6^v4LZ%*UsJ3C%! z-DJ+dbDv67=e0D-TvQc3I`~PZqn;yOWWXl52dD;*-KrsF0-L#o(IkwDkL$dB?=j^PDj|0i0 zf5L_B~2F`QOu-XES$rlj$_I zXEHw?Pah|_Q}df*Jw`buT+k{EA>ht;KFP>-iOMC9xqm~CZDEZ5$#l7k9lwrpV87+} zs==CYITFO)?DI_Rauwm@Md~b1kUmf^`;Z34Sso-xc3zHVqM!g50My#&@xY^sZeXW6 zyJc#XDrE5S@Tf>Hbin`qDUTlyMF;Ap~6v>X;+f=r$RN}do2ag ztc}9?=w39!{7P@5eRR=7kK)B8KxSNAcEDEi zU);r`1V6pf6g?A9EG$$KaN3@2v0N(}91$K&yMF)ND6Nq6B$Nn5FCV1Z9!;jj*pBUT6aA^`8_|d?+ctl@2KOAd{mHvR)%;!^6WP zS9AX)hTo?HHBEt$OhaWk2i&0|<4{2`zAu}Tm<`5!baW*AZ8l2r?jOr6%Fb@Vu{@?p z`-rZS9|a#1e6nm@W!BSur=yRBMMZ|}iAZbtQ+`*~1R*JRUnH*KTMV~sPku6bhbOeR z>ZsiM_mav?5{Q&0&kdTtdR@RQY8V1I_AOh3DQ==g(NFc|slpSnu(9=r^Yyb8*DH49 zNCa$5;9sWH{&*5);Ma336-gldw1p;ZNu$VN+QBx+xD+u zs;yvd@U&^0ZvytG2UlEA1z13XR+$?ZQZ_&P()O9Ml9BP_O?jDpQ~_m*DK*#WoDk`qt@KW* zus$oAnapxBLgU^5^Tg#9dTn+b66?Ghq=KC<+3~^1&E1%qUv)ZC4HFkD=?`aC5wx$n z)hmfzZgI2kZ=?7s;$rAQ-&^sEn2@l=o2_c`(Q1>(d7ez{dV5KHWs!R|a)g2>GqBMC z)|KyAKnnV+%klNr{k72|B7-+?ngN)A2@DR#QFk36AXLa(Q|Y z=zUc1gh_P9^CAsD6{jphTtYHxak}%+`u%&;2v?LxJIz(RN#|2{RhRf@vV+_bU!$ah z4s+3(G*np}FfwT2UiN0-=dKWNNwYTkk^SQig8v*Jj{>!l4wq4n4NgHXAM=eq)(9S+T;!0zx77n-LFUiIi-xw5Umoswq<7pP6dS2wg zmiH^>u^tE+mnG^)1Eux?-BYNnFBFTV(%X1`EK89%R?^^v<89hIX2t2AVoMuGSr4O zy;d?A(hb4 zI?Bb5tlmuCQ*hoSP$l57G>}}*wGuCtst2}-2i@qFBZG27^hsE%{Pw2zo9^ZnlNhq7 zI*og`BpduB5);-EiCi>p+8&0HKR3}*c#ryB1@yylyAFh0n_GjKw4EL5aCklKYl8pWT;r)k@!6EJZ(Beb zD2!FH)p&1v*dVsFvkC&EF)_6@^+Z`{0P7#zxNMsJ%9gr|WYGNqE=Hou5yNKvu2@tK)2G4{(0gUY2-AF*f4R-(?XsNESC<3a~F z6H!oirrA10lVXQFM-X}lt2Sd&Qj&(J_~)C!zr_px@P#g8!fBq&H5VMgQ?V1%khYg-%l(CVs* zdj1;&FUe6WnQ-OwasU8F+h%nr9_5*Y zMBCL{g1FmEJ-h4UqNd2pwj3VFTYO`B3{?q5UC{erSK30^;QbtkeG@P>*UZHj$6;&U zQA5d>p^i@4e&7h7jDYy?N-8L=pR#sO3{ds!M<%X!hp_5@uDx$N@leB$NXq(`bkBfg zy>+VnmB%dD?V5HIyN3w0D5kiHstnfA?z#9+VLu)R#=r~eaoVlSri7m~4z*q9l6ze9 z8}&EOz6O8<0N7DuQkCJa?_VeHP5dsw{f+F`MSB5!*%b>0P_4v$A5n9%QO%a2nq%Y6 z?R>%5 ztHJsSNI2fOTO=Cj(T;&#QXJHjXwzlG)P_@VD0lv=&pIxrX$1&XevkX9WoG&&m%Ce^)the5Bm7Zw$sx>saxH2J z>4{*!;vnsjWVxAidPaKCrL)@ z2N8nQO2%bn$pW|?CIjobgRUS5F3rlvQPdP3jLAy^uHj4$PXT(8C7D zR*E}WB%ju`H`@3-Cz7S*tjk#ydP&Z~9^2L-pMix5cDm{z?J)g{C7$?REVHBTiIma@ z@?h5Y%X4(BXtkno;*Un;ThayydPcO^=p&7iO7j%tNCh6S&>OLghH`yKzR_I8Y%*D8 z1%F9`aR0d`M^LLk(bEW9o-BdDHHjc*)k-^eL_io~85tQhn9f}!iV2q=C^*%EMy~>7 zmS|t7s?t}Vt(hkk7hB;oGB8M)RiD|A2-?0Mdcdt>hF{dD*p}z)E*oixff_)83!+ui z;r9CW9qRbfY@T8svXGg%mBjez-rk9J?*|xny+u7SQ+YQ6JsebzZ$&fYVgBay+n(ci zxWE0>*9sS-N|ev1@+P@3bC<|P1s4~WVO&~T+V)QDg_eSX+AoSj_#Hf?iXPf)#&6)h`+-~`sba%p9ja)c3&wBDZ0JK=n31c4{;A$-!Jm6-QL3^Qqx z<-fWWG5`y)l6mD5DUMzah0c|9i5d@4KHtjpjEp$|0}70YxSKV%wY6mlVR7W-{BSUD zBDrNmYmUH%MmhU>LS4=nVKwXH<#X`rljw}o_I4T5t}A=9x_nM@+{#kYXE1)d3K{9e zXrt_q;-EbcrZAJOnf@MnGvel=hxYxu9u4Copqq5kv4>knD;mv!T*_lOQ2tYel6v0Qi3cCVgK*c_n6mQH}O3KQ^VA})`K26PAe2T zJ!jdu7t19!ea(mHHHn#KXk=a}3*AjIaK#FExUay}mMS#K#KffSA#yU@^`&w-FiN!bosm}dXN~k8+7voHpCT148e0N4yV1d?fZKo7z2pq5VL!a z7zr;U>3==)P+N4(H3i@H7(XKYqo!HuQ#zTjse`fy&_095yut={X`e9836kUHK!UL= zSFjYNo;+5fM4f*E18Aw!S$dIxv9acf*jCEW&krH$16uklGHCeCFvd;^MxEu!DifTrQRKopHLen!?W|FveY`bDprbmfdU9TD8wR0@iUbMukrAyH9LF}K_P zl=|J=z@^~p4;eJ*J2_uaV}Z-O`uP9JbMS=ITTYbAp;C^+*2Mdv(8xg5ikC^ zRasS=R$X0v@zPxXOA08a;I8@k9Ci!Q@WhIWG3EV4sUQdr`!y`=PW7OK>*cobf$L(7 zV$KZ<=&x_$+X5hm{@!xGHkEFy;B{>Zu}f9`O8{!0)KpwV8x8!)pI`(Lf%Y=wa#q3N z7nnB$K!WfDWFI6e&yQDnCMMP`!#MQ6v`6y#&v8>9cgAh~`)Rp|cA@uehi_CK#F$J} z3@fXB_)y5K_2WgdT=d8e)&mI52Sf??HiZ}QM`GWv&<*hwW-6^L1kVCdU^XrX2S*`2 z)Rpy-kZA9}Xn|X<=*yP@sf4f6)6=!Gnmao~!07YbU~vo`RWYP2ES7>Ji@B!&4eP?S zKsB$}@_>+1+9N^$ephQDJQ z408EF*ixL(cTW(#kdCSVP(sj?GMoO0lT(qka#x|Ht7~KJeJTtEkuujmK|6-$*ZLV&q~vU>$7N^BL3q(NaF;9p#ttCuAau*V zLCV*?kk9{LCF~T<@4gTtK!ODVn97HDV{VuPvl1f50pJefrjzgv?^1z;vA)*t;Q93; zPxG85_jTPhyMu9fc||bsy?ac=Iu3d55!~2}{~^5K``@gM6m5gsy|l4$hO~I4BOJgG zTX&aw@sKEH@VPST4b_fs32;^Nrjp*%h635+Y3 z&lSW3dwq`FYYa~p4Z1mV=aWb-9v&M8=f2dJ96&q*?NDB({IU7S9Ro*rh{|YJ;&f&| zTn;x6eT7dzFn2O}Aw0^8c7czF0&TLWCnO#L*iXZtA0A+F@$$A!UYx^0&UEkH?}gb} zL&W{u_O}mU>bel&+Mnlwf5{QQXnUJ3)GPh`x!g$`ztw#6LDhkfm%smKXi_NjohIP) z3NRa9Bekmv8?^DfJ0VZiS89(1$P50Bik(98Jtew7Eg643*tHw)MMjPTz>1E@%gT1V zbImX%>=RyMU|@*veL!`YR;-}}PMXw`5(9!PdZM8Ow*y?C{4Dv!;pf7VlGuS+fNpFn zU5H^aYLWfZDfBOM+(`%m3INg$%?F`n??)d$zYt);U$B-fQU$_0E8U&|@)>Y&sNfA^ zQ&f0V&<|!%A$5BxCDuq}Z*MP!n+>Qc#vetnObnAJ@SZsLK(^2)y}! z23+pF=-=%>o_>DQ-q(HKeak;6DCh&T8WSXZoMM0}r6btch#!qOyvpO~nedTUGO zEq+*#ewYtT=l>&vguoHa&(hW1z13F4EdQPka3pJ*>dNh(fFR||i;K4=%?8y3j=gix zuDwqXv#9*EWW`dW?{97@ySlng%fGX-SV%}H1-S3z*1u=K^DG>oC7c5TaFq=!!&D{k z@I#f_hSJwzH@D@^1~zK%COc|PT>fw4jLDOgfy0=SX3V&;xyurKn`P_cdth z>P`i=4+HtbSFy}nejZpTq&zy(X_R?s3CH9`&`RygK41xX&wRNXI1pzu0W054#n1hI z{(8NB>(c0`s3@CxGbc_|Jlw`R8B`HXP;_?r`~SeZ`3p`ogx zqM|`@aeD21vX}ntU+xcF@4oHmLEzwnE-*$W|M>CagWIA~NEKlLoS>Z7tjD$xoSrJg zG=NRh)R@6)P?ThP^wN@)F zEd^zX-m*1w&r7DyS(uw@kak7_SafeM<~j~F2sIX%^cVbdTs5sS(Ej)L_t&S@2mbGP zik4Ut;vH;{tk|Y5VVKmi?fZ^jf&6x#pw(;R15n%PpQ!>Qx!QA-l$2z2?rCP{&+F?ez_tp8O2xKWb%s(yr4jgD?PW|xU;4LwhEbXR;hugC`_pDg4;zGWRF1P@5 zP~ZW!q*@=kF7*Tl!GE!U->+7tCTC@5Z&ghR3G&y~Ts&=hpgk~|F6s;PKL5h|;s-bR za?q?4JpL?V9rijd&*xmQjXj|Hs;Y`gMl|~h`K?nMyl$<`Wd*i}w&t?kIDhVC_|zYe evgL)=hyM)bY>zG1nWqLa0D-5gpUXO@geCx244cpZ literal 0 HcmV?d00001 diff --git a/docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-new.png b/docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-new.png new file mode 100644 index 0000000000000000000000000000000000000000..977f1e653768cbe17fcc4f7b381633942e81458c GIT binary patch literal 29743 zcmdqIWmuF^*Dxvw5~9?gNFy~0NDU<*J#-8(bPpXfbhi>BrGS9a1EMq*pmZZhsenj# zsC3uagU|DR?{|KmUx!P%H+$~A_S$Q&UTYp}YbsqMr6av`>C!b7Wd)r}m+-+DZ;$v2 zn4$D9COXYnGE0-=2ee+T@^m6sHb9Ax2#33aAZ^R+U?|||2;t*2c5ES(F z^}XkavGK6-y@$fMf(h`cE5^pr&e7K9-y4Gbf-qiwF0tU`E!>&BfNh z)>_Tci$f4DEF^kQNCZqn)s*!#)Hwv@!Pv#o*%myMY*Ee_+!A>Q4~#3AfeQ$V-2@C3IBsDtna33BkU;x z*M!9Td!2 zRzno!>?oq;<_>1PMP&ggj1XuC2Mt?o0Tl$81D7YKA`jD2)kbS+D}q0?6?8Oh1-z}% zII{VvtEw4m8Tkt$UB%=b{2laF9BdTkvxFXt7+z@Q& zXeY0P@b^}6_C$!IP>znOPMU^_D0zDab!AUACtsL`qK~Yzx|b_V9N{ev5Jeeb{L}(8 z?UlXVJ%mJHXb~H2n2~mXu&oVJOGr=%ErQY&c5}25R&jOk_f*0Szy z%C<;Rby;<1K^L?S+z^AqNL!u-#b~f@*b5atr*HQwA z!oBU4-4SRTz{;ZhieBO>^1k-=b}9&G2O(c^LyUr~tb&%Hhm*a5qMeYtu%Rm)M;AwV zAUASy?&`)q+TI9jc|8Z*-KbmJJ8RnOcsly18QD9?+Q_5*3`F4q#+nMs%D#$58rq6T zdmSww1tSj^H(y7Xx~vL9$w5Tl!O6#3BmnMerz7O7tp?Lp^wdV9wGT;%QT5LO67EnyY#fv1Dq z5{J7epu7~VoiRQ(`a)`caFm?3mYAC?T*DA$#c!qMdg6a|&Fw88nbY-Q2j#z;Le5g|iiH)}@`N0_$(SgPpHuZQrHMJd>-1IdGX3ac2| zis&GP#C)A}6vfnS1qIdYMSWBpP+mg(%DVmvDlj=~0SAPlmAHVPt*3{#j;D{OwGUEX zPSwrI$=O@o+859ZZtREl1~fv6**NP6>1oLesCdiyXlp8Hh``4Ec@S9Nmo#HRNG%l!`4tQ_fXiM;qmUK{)uT30t}O8p*)` ze0YF7Ox_z|i-Bpw0}ParaCZS+c>#T-lb4*cjwnXJ)yf^Apr-0;fxI3b}Rl%E@HeS~L{$6NX0Zlz$IbksyJruuzE5C+_s1{nwT14K?P#*kk zErKz2LMo|vsS1fH@}rS<*2en&?mF()8p4Lo{%*QL+9EzS3U1B;0ipn=t+jxQtB9De zg10?J%i2-g#!pPu1E6XpE~uml^Rlxtuy*$|5Vvu%(f0v11+4h5S-G$=;P3y~Zz09r z>O06wmsl>TD9Gyhng7nZTBGq}tn(bvWw!9b<&&<0!PBwSK#yg%$MR^7{nuR_Rg6Eg z#He)sHn1ZYy6b;aeOh9fK=p9w{T;Cm?Uy)Syzj{u_{TfLvs`?U;e1z8$~CZGU{NCE z+_!AgVx88r&+{$#X}U>5kks^yLyiAW>f?jy)(@lmzrrsiB*||*lj*+tWNz=56Lzk3 zVxYzy#V0>gtI~wTUmAecd`Zg+RLFHsOE_@bCEan=A&f_t#=N}=*@9AKi@YZAIS+xT zN&kuxcv3z6QDO}>H18X|@>&;|0x3#78Z~Nse*Ar1XNiu5!>v@KS z^bR*5-=kQ6a>-yVb65klW5ReuC4a72xiF3BK!2k2q2) zv8C*)=|~$=($*vw%3MTcWMVv$O$M9$;&wp0JT^CN@>AS%xa`eB;agns5u9?|_tohL z6(g+-KN1f>M_W2Oioqgn4a)l2Jj8$+#tg28&3!WTA}$#&OPxo<$Qd7z-@?yh0&sMh zL7{$tMXz7Qm~Re1mkX=!VG9uhijEo`D%jk|1F_e^8iWk~TO5UCw{cIah!fP;gL;25VmPll9yHgf}@DH5A6*q>J1`Jx2|Hwy>v%M?O>B z7)&S9o<9k45d1y0JaQ5+9@tYz8GUp}9ysXuTa|}#vbTn<;O7z}vIn&}(3rPzxa1#k zC-}_1-bgc&B$fmfKPYOb@?!-y`*WUadFHtpaNe=JIpl=JtX1!3&hm3JElw2# z*VEk*bK7C>bsyI+WH|e0?fQrV~i} z{SCo}X4JKjrFY1lo$fpoW=+Pve|bK$pNIPDsrGq%mj4)bEtUa8M|k)%PM$0=oiKxe zV-hZ^PjEjpSSC&hP@}guydA&Af7EE?Nq=vF%Uxl8_69o5pL6$9F_?dNs$f{+9@Z%KJ}=~y{paH3`JfM*X7^-X#RaszG~#v zenHYB3(9IWiP2;~<-5+&|t<_h&`}2Vxl`&MpWE^Me;`Vd* z7v=AhKQV}}w{{0y{k&QNJGK(*N{^LFGYjK)Plic5%Tjyj+}n=x5ix1BiTjs<6iUBt zqeXEh#UPUUJjWj0Y^dc6n!|c~^uEcryr-7F;3l59!X=oI90_udW0jyI;3Pv zh8bw8ji-iW!uRp2fsBe5VR9Df`~U|VE3#5zDOOA>YYUQ06q`$3*uOzznq%5{nXs0B z6^Z*Vt(?zcLYw;=nMCfAuuUBhw39B1p7Ad71(nXwL}vPt^!(+kx2OH&S3(LS9h|~S zwuA!Jby9STtuInWFfPLXXThVVFA+)gM74hqmClfsIkBJnK(<(Tq zC3-RWtYwbhck88rT{_23THturpVfF9eMspXd7{B{!cuDQg2LzxccTi^%D=~5j^~jM z*67NV5~-GofEXKyO?UIB6Kdhjv-3-Ik%lUpV$wLeCL6~I-wpSRm-~L*{}M@?Y#5yN zx}oHEQ9y_wHk!-vk(c7-cvAf0aF$^Fc27t>y9{=kBRKn)JJ9wCY_`$v6uF3)%Qwh( zuK`|~Qf`+)vC3d6u5vKV;Z%He*INrdk^!inO3so`COG$;@=q%U0Bbg^T|QVo4BjlN zBQRhH%nMF?)+mAr-nYL;)Btevp`}_zV0Wj*bbM%u@aQ7NEH|~Mz-}AydStL0;EgKn zSphUSgxeFI>aPtP>uKUhrU#9DNXNbEUdae2BkN; zRbfxx3Q=vm0Emu|Zk!}g8NRh4$^N~|FOulI;?Vdzjv$}1=HrN@r08E77*c8eahf@G)dDlBN;{DLhT^6C1GLJ$9Z`7y1sK$%tQnOSO`lc8GZZX`57g!n+0A z-WzbvJ|rKpp283jKO$h@(B5j9tvUTTwtV0wdQVhL^?BACIIwTRinQb;e#%WXbujLp zR$@OVDi*wd9s=%%x{S?D zb_#wl!lOCGpkTTB1@Tly4$M)tbimmu9Kd_w&(j{Vg&*KpweyKm za@ck7sh4&Jianebpw&hk8~rp44(4D~FXcJH9l$7`a&}5ZMjEU=a_pl_mQesB_3KnD z;cj5iO9BQIKtwn%lO$b=$M*~)P!6LZT)ae*B-2Y^h={pGL(U#PO>L>jdO+v-h@FBD z;N|yt(~pXnAB-+N>B)O46M@5!pwo_>0tZ`GFBNtBfBZ@+VhDIorn|d2DU1!g$I#rR zsmwwPMiF^zO0xKxfN*ZlIFE1R)`pSg5SX$6!r|-rsNjcifRVuhttd&261W|y zkH0erf^Z|>X9AW~Zdrh=Ycc-#R2$^r2No_t&S=#tH4SxBO75jTA5{I`H?P(tZL)#sU0vRNCQS zM0%J13e`qT)AArzz+r%;pr{DzyFSSu-*T0&E{rQDh>A@qL7_3^R5CW9hy(BcUNh4g zjd*LLGT)s{bhx$9+We3RQEDiVdEc9~NGqqKqVX*DwqmRwgi%WkpFI~JoP$Qsl8k+t zHN2B4kW9BoGcx_k+FFKvcJn}nMgc17?%QpFtApQ%gb~g7xiyd!U@efZzCt4NFK%IsNi3^{e2of~(Lr zpohcpRXA9XktEcdv<9+n7&)E6Z5#Gn7{IJ>!OD$2NfKWN2?#;dk;vR%Ptx7mC-gLI z3s5~JEe5Yx-LfxJ-0zC8qkDJVL@1lMLi(k2NjmPvOo@-!V(+lzu5K}&4`5z%&(U@MOFTrk~B8^mtW$2V` zt-jE|+~~Ha$LFWJ9!@ZhQymXb+09D?HgmIS%)Bk*kI4^%*vY2Y2a11@eSiHkg`OdU zik$+uPLZ@Mn-ujVDR=!@_3J0I=x<(5x$?HT>hERhO5Z6A9vw}z9R6P*3U1Ndf!B!f zYPDK^uVAbEI$H5=QAS%)IcyDZJABJyUVqn=!V(Sz_n3a0J?U!r-XA7~KhE3t8$|Ph z*H_Yo&#^A{F5@mc}5Z;cwo|j}BF|jpqPo4JAQk}Z!2Q;SE;g{##sGV9OQINNx zlQ%tWcZSTajyFHFJkNeGqb?}paZ zd$7S9>!>^}RwMKiHLoKf^ZOdiFDU4KS_*ggmaUrQ>5}xV z&aSETQtwnNkx7elvt?hMED)2`eN*dL?*jpG-B$m{W$9Vo@3jl0aXAfig#G=|BLF(n z!$sQQYG;Iyjh#nqYpGv)X!71Jx+3m!bV788`!9{OIg4b2nbA#MTH%cctz;^~97Uw6 zwL|T3cU3m63HxIwWR2p>3!Wif1%xt)2lTF#|70d10Jc~zcYfY7lanRcakwun>+i53 zCvgQdz44ts#AY_-ad7i@rFhlw-Csx5(q~l00mK&NNezO&XXuo3gNoxD*GCd&%NfU;VG{$E#NkF?0sAwd#yW^wjA~&Q+ z7bo#=DHI3?zFTFX#$1FUi%dlS;*d4dEY}uMZZdtg+fxU&DmMF*4;{YSF}zAZ`wn|V z311hutwSQPulUFSK3``o=P{;>Soq>$e~Yk$wJJLr-n_YE7tKyV4P+plf0MLQ)BRwX1cfTpfBg<3x|Lb_W z{jjx_GeA7*w9>!d%Pn+e*D3Dn)ZezA71wuW_06#n+;_fcs{D^8JyCDs#ZKFE%Eo3H zNL}0pE-!+9YTFnNj4K84Ew<|saMsZy53fF)YKUSBB!L37!bp$LTk{db9~&65gn;y9 z&UBgMs{##|+cE?tFfmN%LjW)dvo`j!AZ0-TQ+$^gO%rLk)-x!M^P+Dh{N~67%kb~= zaFaIQc#ieN8C0y;Pon`GQ)nRcArWOzrKKz3NeI6`A4WE|3T|$0a#>8zck7}vp9FJ; z%bcAYy7hb=nR{9;wK@HeoO33w`2k_PT+{A?d>#X3`gSxMt<*aE(1{goWasg&V#ntv z0tLQO-y5-{eSB`&OL#(IZNv=Hn?(9`jf9STr3$MP8XG6e0*}4h^sj&eT5{pX++y^S?uq;{QfCwS|Y{tcIn0z@TVKaqwb z z!IAhIboASP!Y>Tr5_upQ($zIfy01G&+G6;O7iFlSjpU_wf6UE;DCE=36m!Jhtbd6k zbSNER;L#0e5_6{XZvnjzAH2`Rh-CDEtRv%7-G8z-k;?^MYK?C>>JM${^=Fo6Dm&3# zG(S09at!3MbRHqe3`CoozR>yN_ty6KdG+)#{k>~h$?N2S2aW}QHg)Si9G(G7Z+7S9 z=H|lzCYd!Ns}VfUO0V4;UZDqguyPA}1GA?Q+kFxvlO&^K-uR&>n_La252)4jOWPkA zm@8o=N-T$74|n(fNYz?+$*f0%rOzAjIazksK_{jk#N7fH?hv)J^5if|awUQ)oA zvATS9Cwz7(r`qag$%G@srC1hgNu4|U)e!=@+4W`vxV=wP$Xk@ovSYt3LE7gxwSKL| zm8G%{6n47Jf4%=G?OgP-k&)4twuNdL;E}&F4B8xmo=8_z8=%{k(=JR6)D#*T1POM7 z#Yadzoqt#=%qYWs&_=sz^5tfh#Q|XU2PwlK$ew#y0 ziqo&r^}&#LnCJ-YVaSG?fc#W6cl{njJ=o>X{{5}bT*;-3A$+N$ucgx7qInS2nfl}_ zAKoBTtO5eSz4{ZV)meJTd`s%RGlE*kV%hS9M;p_)?$00*LP~S5;Sw`1lVy$E8;BS4 z0bR(iP{@cunI*%qP4$(UYIET^`<03>sSDZ*U*7(_OFF#G^I~v9>j=B<~kKn?*H`*6*{>eYh3<2Kx)Aqgk>1 zR&e+-ZAl6JMq)KtRzX>t^`8-LJd_kh6D~{Ek}iPS`2DV*ZX#3cX)yld4;aRTo|mG0 zn!ino=HJRo!t)LvCZd|1`{$xoQ?LCjaK)alM82VpdK7XqFpPWGI%J*S0>eH+6O@gMp4bqSPDmU(xzb=bxVB2uF&|AQR7p4ZG87nVk7h&WYz?0IibWdyH5+_ z(o?J?y;nYPB)V3$CF*GrK}&k*|5wdyV0Ey2d0)9+`$zME%tRpn%Uc2^S7$ogw^?8I zqRQaSFyfV!6|wzs&&{QrP&&Ij5Vv%bbsH=RJ|HF!Ui9l-R4}PCw5mIwxd}givY0@E zyfSHig!kg(s`JTN!mskqS$`CwMq3uRA7mQFdjex!>(%IAG{sOuZX%j5Y0XOOU-=vU z^sKkWNBq=k%yy0Ugx}A}Y&>O?7jW*Afb-bVv^YUxA$MqF?+ghP>ofM<31HiY&Oe*r ztJ}cO4p@CNu++|$DEaIwzn?2)e!JGY`cAq~)jI*%qWEBjZd+k>v7bnS1aJ@flwwe<0NRh&GPiS+Dye8Reu!4WjY|5rTKmIEo=09-J-`gG|)}Y*L~;(zAObC+z&l?gqdh!3Mut|)5O18ZGNj5I{&>7Mmo%w zILz_XZ|R;mSG?R#UGFaOnrMJH{}9bpakH;1vt~Mf@m~FeS3Q0roykmMo?&K)0WM3@ zJWDJWhi|b-Ew)~_J@Cofx%Y)|k0+KTXGV7^$bqco#FRYe#P;pSd#nnAq~gf@vL8#C z#oyN(21P-(H4|G(bLBDbaP5sdYV?dP@n95lph>$cnTYkc0_9~GWX513+}n<&nJh`tTPArHb| z(h#oM$*kE(&7}Gpe)4d2sBPxi?oZz#I~y*>IJ{vUho-C1aIQxz-E1Q2;i5k$tAH8` zKP{HkTzYxlxDqAcs8`|B1?{TRk*cI4G}5oUr)8L?tv8ZQ6S+)k#7*k4bGVd~cy@Y> z#Y{D5=jB`K2XiB9pk5iDYrD-J6fF!-yp5JIUp)I@7#C5iGB~DrcXV;F1Lsk@zx{31 z$5=8PL_M~DV{N>>FnU=$V~%phfYGq$Y`BD}*Oth+uqhyvKq&9i2d!&m9Fdr)?v>T3 z@xGktq-VoCV@#1;*?#z~QPf6vdWR`Xp?lgv&{pT(5E1?W|SA_nFhWWb51OmJ!Tae|C**)fKD zP{TB?8l~p-9NM3A{W;Ro^HMDIbcGQVAsGdv@a9kFymEEZ8o^z6Uh)~IgGe}@;2*C2HCvI^ERF=w?5II4FP{yWq&=*l|)&QRCno9-Ua|DC)KK+Q#8r zW-0jje?=#uYr%fiVn?2=K4z%LXSw}}KDV^_rO{i!iKKKb$2)J*1@W}bWayN{0 zQ9ie{-*xmu;FOWpd$Q1v3I~iVUyICNfIpb%$MGT^LLdb_1GOXU3n5+Sq7 z+tF5#d6!u-i|n1-56_f9wf!IGM1c5K$KMC1Zh#*$42dv zNzEXl7#lJMja$+h)fT2t$s36&pA`~(gQip0{D77kpQ?Q1Qjg*z>8kReUjhy$49&$` zv4K*@vQ$Meb0e?$X9~whTvl0=y_qR38TPm34%=5|R_t_(cN~(m-<79UN zIdMfXOysW0^P!^O8PiOJ4QBP6Ag%TRU*&#dxf~Y>W?GXP2+E7g{$p6v#~XT$*Zoev zF7R`mWNK zS>V$90mHAoXpE`-8JRibTP&1q`ycXV4tztY<8C#C zQs{xSuQ>iqkf*F6HV7{V!4pNZ5-TW2DDz0r(!RZWotS3HS-L3WZ+~^2x3lW0+bc7tX z?hl}5kv`c4Oj4^hkR5H))txNcU0iBTQreqeGkSl5%B%-f;D^VSE1h_dAw!gn2KPQLq1S&$^JqNc**WNBi&!i(-B6?I1R;L-2Dr7vFHq1 zJY>Aw`@t?GIp{3dohs1}jo_U+vEflMv=}T8==zg~`0TUZ<72CEkj#c{U;8oT2&uch z-oHHrJom^_Mssv!Gdq803Q zSIQBRdHao$^u-~UpH4B@MiBH#tV=Td+GYjMae}~&R~i1ygxkeLM#cxr^|zoVi?`WW z){x|jQ#kkh8E649{$dTpvQ!f9vD-Fqx5Z z^0}cW{hi6dV~+e|jZx4voiBEsh}HnQo*PwlCkM2vxae9-A`vxIU|@agb|NdDD_=zs z!g4EF<{rUtg+(Hf@rNdI`pK<{t;><|>N3w6?^T2_o99R{S5F3TgF2Zyu3SZud`>=u zbU5c;njkJHb~|drq@T>ntVc{|FmenOE-BCRy0Mm!BeY#ZBVyliuC*3?Jn;GEX}&*WA=w^Gd`o41c}xh$>7C!#K9kqK$kiPA5_^lm)A z=T9{8`Mu2C(FfLQ>Ahb+DDJP`U6eta)Z4ThtEWpc$J0%2K-H_*QjPzrXQqSRG_;a*oI*i`b+{z|xV+DPpr=IB@(Q6X z8_C|5TQZ;`)1#Y&E6(MTEaOCqV)^~zv@)(}N0159meUZG_TxdML%Xe&AG-{wCrSRh zgcL1}E6Vs6Gyf_~%5r3%NV5puOA>;z9|^&WunV>g*L1#~fP84w$;1D@qQ=Wj`o*5@GCLksr6P;4FinX;#m65+ z^vN<}pc1CxA!m>${4}kV9q-|#sU>v+QR3wn2FCgjkOm*`V%<{#v?s9xJ<>upY6ak?6b=>rXRow4;abe~DirA)Ve83UY#LGwFOk%7w^hvnM zT*KRf44@=_OyG4YQ>~RCH4m2=smn)9A4d=e{dC!1c(7#E)uZaUv~Mu)K<|o&%W>k-@QV_ z^ylyk;2;Ie^@i&5kZ=Vk3o1)rk;P}9X2+2u%ciTr5Wx=&*v16lAPOu-HlH``W_5CbD!b)YOz2GySeyL%|mTBxwhPM++aYBP<{RFe8W z#0DJ%w>6HXNFiGkljO)7HQ%m8n>Sha?8n#kW(mbfGp}=g{Ik|-C#{D zMWw=`TOBJ7H_`XloYVjX`!=>&u3Q|rwj6F3S^SeLC4M*z%4>KU$hC0SxDmYSap^7v z4gl<{U5!_8 z&NnClUz+%Ba=?gqvv{lNnkrJ(Eo~2H+5aJ(0hP=oIJl;N$^Z~F3${IB%)21ldY$b~ z>;=-4C*wl-#T0l?{#`;7RYvP(6xf<&av&i@f0Z(eGBGCSg5@bf%PR>!HZFo%IlI2%=7yGW<^ zTD$omDVh9pZvB^3?r5{mK7_7@4UAgayA;X1c7exxe-2hlDk?)x19&VN7~Z^jvpifz zPbcECZ1VMlqUJ(LhjeM?wAI-5+#sXnza)Kjz;@qz^^ty=G2swoo?S_si!-NS(#UGH zAUZv|)^o{v_4}Ke-*0>PoxVf$-srSf4BcS_X{@0wv74FYauQ1XOWB-S*>UA&pRG5h zn>)_E16N=Ihq5MSyXi1TDtH_%-eG9kJ+l**)C%kGIPKqT;8<)|DIZ1FY=Wte6hL** zuD!b7;FXoG_rus;%0^mysv+2YDtMojmsbP%IOx{R_y|7RC(;hUXy)j-@V2p+8h;@D z_DVy3bG9Aj3~9o8WvA<<==w@sXAlcZV3f#5Pke%1z0Udi;;`2_pQ6pWJz7VrPy(T6 zL1h{d%jL&y1;&4M$z^)wp4{LaDAHoSCoh(g3z})d_3G(?`)PdhXN}Z;RA>zN#6GveDA0WdJp7#;-84Ge0{7^ z=8Ly`P{H)JYO{y0u??i$zEgEa58@hs-Yduf*G$1s(TQzeWqG6`r%E)uqLJ9mT8EqZ zwUUpNO+^dnj_}VReCb%cb^_wkuWf@>wR+U^SNO_Is)yYV#1np&J$?i7upNiyelvuH zh9z`qB;CAHDO9WpmW#a^sPRkj$Vjo=1ve-z0np%BRx+ST!d`7#ZdxnYaCYSEihc#T zDpAeJiR7|D&gCPz#7!1nsV{<3Phi3VW7f97#j)74g^WL@a5L(c8iu>ibvTNjDL?f2 z2K_x+)mmd)kq-0!nki1byZS>YpuP;SAH|ILzLvupU4h<_U!>gLV*JYnQH$gY= ztbB`a?D_NF{_BfKxk%Dm=g&z(C+qw>`Wf$g@xNyj_b3=_P)X*@^L#NU@{627jH0&P zduJK(-g%_2roFPx7zjdfEa*zDnRnq zNQ2YV)8qL-8(CM``-OGEJ3T{@;_6E(aPqoYYkLvxwu=Cvp&psqr zHIM0eBDcNXuXA#A+Q2W0WaeX`CBTe$#BmKIv$vB(G3Kax$(Y30gsYG6X$U=A zXdd!A4CD@YM2M?MSV3CSxO%OkF?R3u$w0!$=2@Vttvpt8^%UIy-z@fNDWKg=Ej|4{ zk^V`kYr%|^n`wIAOb@Ah4ehG-GUBWZ`R41f!Wv`|fh--5!%t)SuHoGMt+bTK`?8*- z;6)?=(Nh1>f<<&0QC5IDJYN$~fP)Re#{;R?K+f5wUmpGP)>n|aj8B}w_I-t#`uw!5 zMcc)_uSGQcG1f@T8uwKrmk@X}@EqQp4LW7_4h~;^02+(~WXbNsWjQ_97UJKE=DGg* z=y$T&8DGLaPva0=FH0HUzDaMK(Y1rWw0)2ly>0Nahz3n&UhKD9*F-{fivfUgD2) z#pB0EFb};1kelNr3lVM)iz9+@yXy=t>BSffQp2>PoFL~%>$ z{Z+BkSCE9q-;oYQ1-Urzchkmy<1lTGKN-4E@bNCBZaFYO;t*xf*G@+$x|ITNzE(`S z_Xe=3iYyMi-o4tNCC zhRgBvMvqg3uF-Qp>F*EWted|dPwHIo&2nus8xQEJ=+h)Ryde>M~|G69;0KRUcoMZZO^&%mp z4<~$YVHVc{q_5I@P2a}O&U&fbY_v8|bnox4=&6uX8lvkAO`vhn{dX57NFGv!o^3|E zXB3#;@c-+-#2R{b0yV7R2Wf+d+4d)MEl=*ry?Msr?*8*_O^vB|K|w*TPN6E)=&g;+ zyS76s1i5`W?yPM8%a}nFu$8FJ>p{SA8m)As7IB@7!+dm+y%82`U>fd`W*#ee=ML1n zo1>;u{ZkbCsnE`|`oPU!e2tdt z{nB%3uD>eP$h!8Y=rzjAbqJ9a^*4T$=(q2VSR`&O^hj`|Vvh5e{;Ggvdt%vzlW}pU zps1^Jt*fi6>DYP1dSdK@nExuIcrr++ykUjYG`RIzO`Wl@sdjP7+SplxFJH)L4dqnO znRvtDj;_nmJoS8k8uc(D}UOb zRQdfBEVX!d|)=GEtQcqDg)7ir?3kdLAJj1PkM&4NC9a6B+=V5lB`^N{lz z{p=*ChW2Z1)?cS3LwLIza1x-S#{Z9w+IxvOSjHyu+n)vTnAcGFiaJMqf6n`KtTY4T z)niygacg^VW+L*cJLa98U#{ZS@1;iHL^q>}RHf=t6F@Bi*K%?a^vxK^D^(XC+-g%| z-SW%MikQz9``!@PGc%SWV(2a22t1c`l$ zrwu<2+#S+P7VU^{ZEJog;Lt_!9`kE>dsCPE!%ih9L3~7gHPQd#)`AxZztYgqle$3B zY`+x_Q;)+1&1>I$Pft!-$q$yWiL=k%+HO|tc=gW~F@@$CC?;+w0Oa?FFR~>U3dWcQ z>$Wj1>$N&YlZLEFm_&6t70DOiH4YS!hm2R^>2hhvRav(`>xc}Pj~nBbx=o^mwOr=~ zzR>@uxi^*&Trfg3_OboX*O%Cdrf|(`y!@xVbmCOZJceN-7Qr-%Pi}Yzn|^2WZR;Lp zt9AfJyq?humvg!>VfxL`7?s!0U&Ka7kqst#39Ldx5bfXmynLprA}zt4 zm>bu)Ne77+&U`QI{O^T$pR#%wsq=7Ya~L4+{#wOTE{yq~(N2kJp&~6Ta^VZDur&b) zOsFy2uRC=UU&p*j!;mQVnM(o&_K*a#u^6&3|i) zN)W%1(D-*U-aMYps_Xlk*Fmk<1ojzw!qKagJ%`{6K6wgQ3Qf@W9_WuXbFPkS!5JhG z*Rfo;M=ILcl>8eR_8Y6AXIMthTW&nmrtJK#6`!xO<@k3D+AH{#MFXLBfM_Iw9&k(0 zOy)QLREeSA8;Fy#_h~*T%HjC$&vV3Uy*E@KJ2cP`94NWjMs0s9inTQ=&r+3iOnO&u zyw_G|#pC!-(h`ShXeVPHW`VixROCp+)oI86%sk}pw*r#lDIa?C;}L+Elu~?)mdVHI zETebYujB}O50=>=JUZ;J=H`Eu2gwJ&w$nIy8~oY5JP?%cD>HVe~YI2dr5RF(e*Yn1iyO6yZ%{2JI+vtm3aZm`p2L>Bjp}LaVCkN10J&@t#r%fy8+6k z$HErAI!W_)OpV1N|Mk<5}9N@^bI=n4WrS?(56BL&B?Z?#g6l z*&$;GFWWv!2z?X7ELKlt)8zP<`#onW_-c?76tTncjdfIpH2ukE5Dx>u-+@b&QUPM^k(P|0n$b3(U zcAnf%GWlIP;Yyc%^xVrJNxnnIaTSesoHjgR^P zOQ%-W?ChQ@4w2qe;60^2qoyw$t&ijP9;rzk#R@D8)E$(tQm6E2B00#QuMBhZ`shn7&h zU&DXPa;Y!NeY@vPI1gnipTz@KDRrzRW3>aW!&gn-j^XL(<9lymHVwUn1><5be&la7 zw8qP^pHh`U(*xc+4B|hz$=3nmTgJi2EcWQI`9?IKKEz9Re9;7ea;JsHhK`%6li!w!_k*T3E`#1Qs`*wm)QRk!OuTO@b5!GN&WUqS^kQM*HeJA zl`Rt^ytTrDE~j9!w*qnvDoppG3PP72gYT2>N%|jb3W5Z;^O9=j>Lqo? zx?UVeGXw5q7{?~PX4=$)v~W3EiDG6IPi>!3H7V=a1K zeh)}1y^(H|5~M@AHl2zfA|j}SN_R<0NF#!ZgfyavfRuoADk=&{rywC63dk92dwc8s zJm-C%_nZ&sI$!v(uC-UpIoF(H{{O!*7_n+7EKSNfp*5X-+qV0K@AraBb8_d(dE2JC zAD^DwCl8+~43qI%8_!GkkE~e8Z|mh&QN6Q(9aG-g{)+|pGsHTN4%{|y)XXg1jc_0F zXSd$^E=L^ET%`HH#(PB$(qY`(88P}u{)0qK^yj+<;a8qHbG@qHg!qGg^q$aBIVq-6 z%dci9=;fIms$8wn^AzdAuuf=k7D09(&zjJm_ew@j1dCl;L8Wh!m)^0LKOf-Td?M5- zW5~Oik_5?Ev_UlzApttF0^}Hw4=DG(Uy)8{raL{_(Mx=?J(;Y@%-5T9GhBmsD&z7T z1wTD~s7;9TLCw>Pq7c$!)=_a{oV~yoHw?gmU@}X^+80>dC=NedGKG+fl|Pd{S3Co4_yDeeLl(77aK}ob4BW4Er0z z4ij;mC!@#P7XE4ZZaeeF$v(C~;Vwd^(z}9d#%5=0PkF~OF{t-N9GMT5^IMs^MUryL zmNJr>@2)xxQF$h_l-0UstU5cuG5X$N^hoUYYxORq#dDGI+ud&48mU=r);c+n&~?(o zE~Rc^c9zBel{||din{Y|OUi#6I*Dbm;&i9VG91v#F^=@UfBW3SVM+9!ggxW&Bg|2X zYp71~8!{~NoBCR0*OXvP`}q7BKJe1x(Lv-mB*-qyRI|0H*p`=$hS)Qe{`vF$qVv_L zf5wjn_e=`HOubVgAo5z~fAl+mEkrk^l0&wo5EP6j`J5BKj4 zM(CWevOd^l;~I`|r%c^x+t$4&bf`@?t-1E$sfo0$rRX;4-A%X20il;7F2_gHPEq5n z&#KLmGQFKn^YIm7oX@;<20GLAcMv&v5}pE`rtzO5{CC;sM9S>n;fP)9+tAsY2s9*f z$N_k$4TEa`^-OCI3FdQL()=(9O{B@6{%$S^h>Y@^!pJx{ zI1VirU%2gdt$%X5;B>zC`s;k(UY*MMTMUj~<#v@BXL$O{_x+a5_ntX%)P37?@m>Ft zH?Yyc)t-Km#qQ(NXlc8Cw4EI<>@+968O_rJygBv2eDf*#W51ih3Q5~XrQH`_L4*-V z@<9Aj@8{P$SG$f*#ogh1s!*kMQuSUWwLzh;mzhcK5zRZip_Vje0ZOX3A6ZN^wi{<) zy^&phshzQY|l07te$F`JZhZB*&=KSw47}iB+N+*!S2ddrpghfP3toj8O z??(79n=kHe8Z*i`Vy*F;bie9IGC=168+k2k3$M!0X_=QPnrv^6q zR882AQ&Lhy*mrJ;CJ_Hdy2qdQgJo@0~7CbUX>8+oje$%w@K{_*Sh^isg16 z-`03In0d`4AsVu{{ct$wB$g1_b6=<~+inoXQ9~NFDgW>B?gnyriQlgKlx>7>JQmST zSb)q(8GIg+e&5S(2Aw?tfo=<~6CWeUGm+L2l*gVy;^Wk6$Io*i79`OBso0LmEAkyJ zz_d%`u}AY0XNt|4Kz~LT+&>A1>j8P(Og6xxRzPk3ATljc2l|Jq`H7<|Y>?A{)D2Dv z?R#=w`r|R^c1m@eKq;5cw8t;?6`j+NJTIu1i9D^6;QFU>1D!M(I=-_-uPU9U%%lmV zA)nMSO`+JlR=?ig&-KgumTzywzQm&gm98nh8Wr^TIvfE)?G%jj&$rM%+@J2_CZH9> zh3_v9-9A|-X*)|Y7y)`^u1(159B*0T8tj@-U|X5_J5usOQZEfr`*US98viK2>Gb5e zps{jzyJY5|^r4to$4}3%fPKOO*42#X*kT+&2VOXC3wBR{s7QI3(ZoU7Iig%q;E_HN=OLcPN^E$p|o$h|zPk3!%EVXrDJY zy$ZnIS#4u^S8$rE%OknO${BV@8f*3*mv3D$Kn3D#OZ(q9P3nBBoDMgLW4ALj%^Bw?;N6n-hm*yJiw$*B@B);Of<@^eoP6m)dB6OxVL+o9?hm zSpwH|>iIO-m9)w7YcIN2OSQ8@F{3@=^5G$bYQZA1f#hyQstz}Vij&fYQBUa@{gX|3 znu9`yDjXrCghVdZf_q&i7!$FBt)&fTsx9g?VMzx~Q2Bu1~ac1bB%6Twm>lxAdu{ckLVF(${ab)t^rsH$M2a*Oy4&fVEu~~kSG!1PUU2ioo^iBf2 zIGb0ItZd>_B_HC4T*y5FvB)v2KO0s@7u(PFsnmms+pkqKRna&zDWHcH!|Jr*V!Cz3 z>AkQk(mf1|fe<1DCWgmu>{|16KTi4*?Vexw5W$3w}1{%6G$$gu#{N5Nu>A z(Tc2yd-|CKhgPW;)(&${((-(^Be60GBa~)6S4TwNTt05H3HerQ$-baK~DbsKwy@R`fFc;Nw z#6BX17^2{T@6Mi$;Qp4D}C{L9=TnyQ?;}XiR9x!G>-GlTMb#lx01co`O)4M>bfQKL#`LE>i zX!FAgJ9nf7FpWCq)ip9X8MI-7Un&hX;F7%<}Gs0@q z*a)X0qrlY5Q=q1u;;End^PwfFLcKh8v55c&5TpU%8j3bz|A67(}Qy>q`9hB~a zK10oJ;q>LZT%G};3A>BrD8i{UGYr1#(Ug58GD)#Y^%nWjWDoTVRzQM`WC)-$jm?gZ zh2+Yq= z<_NGv6oT6 z5I~3*`itAZY>B^rKN1#;%u7wT>OOXp1!4sG@vy}WjVM^A8v?KotxUzrKY}V3Hn3!~ z>L}_uTCb$GSAYWaWbE z^3@iWm$|`mK72Cf>w6a~l69#PS;{^d#R8RZsX3e??!W`08ZyIgyl6~d?wgcrhcA7( zo&4oy-+5Y*t5GHPg;QGn5gJBM-1?Na4s9+C(QJ=+u)Kf&{!CJPvJ-Tp;ftMMfIfCK zTKbf<8=>(8Zw!h;bT0D(jV+@&8=;{p<<>t1q1@a+3CDcj6Rpy5i=dxgn+4^UzN8Zp zQB2ZD*JpeB2RXyPR_kdO&d6K|)>-pq50kG^g6_^g<~ z%@1x>4V`zW5_{>c7R%4C(#W5?71zZjabvKVBxcL7)8+{#2*t!bIuFEEAw()0u1rZB zO-=dWO`{)sFwe%oP!BQE3DYul{&-(nlIS2ZRV~iT5I%$$Ws5tfhxqS*r}LrO`Fv*|vp!el|l-m0#*<~jl^j#LQ zW!F-u_1PA0U5C^ui@)d&!E1ddx>JNWHe525LVfc}jlJ`U?VvD7E6H0EqrVbc{wuDf z`1tV}G~3;hZ>zM$8~RB}!*@D-$JX3?A|7XBV%SNktSeeo?=Q7PQqxMi^_$cPsMkSv5R>zW)no9^!kRz`gmM%B;69yp1TTv*qOFag{NrP3tFmpDI3{3uz15E-S4J4&x9IN<7sT;v>XS zJ-)SExBDh#!%B>JVwbhs-B66&%2GDW*8Fls?dHo4R5PD!f>f(#&#~(N45e(?SqeM! zOZ#kH&$47a*()P+u($3x8NtQ6tJ!$*^IFJ-EY^>aumQMS<5zLcY5aZg>E%<_-{Tns z;oCmEyS?m@t4!ka4ucRkU9J$Be(AMNA6rQ>ne}MN(clyJG;H0u2Mk6o{svEe5SwM% zz&?kv>9szx&&mA*JP{?H=)#%MBJ&t=OD;)f%}c(J^(u$pX3n!|+p}ly)(4&CHvNg6 zXe!BvC}qW!YJ!(EEKVP38@GSx@X-^3TSA&GJSu9eLntu!qI!Bu?J_s5_Y zPA>X>G(`N@2sB$Iy2129xY)(UWZ~?Gn`hsekNmiY;3R#FF|(4G3r}`XGGCLlv%e}M zO|d5M|`@%cfe!ot8KAex{cEhcpGH z9_&>c3K$I#;N>i8xLp}@>EZTVtZfYh^a$I?H9!y)JzLapMxjMI;>n>9z(aQ?;Q>g< zkcbk05i?0t#_M2zO+-KsvM)Lq1SRdCObh4*oyR2pLR#v7ZbbecBP};0cGtR2S^?)5 zM{vUJ>+mN}-t^%T=bx}i6HMQ$?HsYVl2jk)={Li5$UqGi*Nu+>i{=l};|IIfbUTHa z&r&%8gTfjY29rjn&AUgEZu2OZ;(`IC%W|A()V*XaZ$PLYJ75@sW)s&HCI0kF3D(J4 zx!3_qb7a4{56PMZ=fdNQ_5N`OP`nKr5Lbz4C0BG6Q|1DV4(Jq!A4wm2peZnB`52aL zDlXj+|8p4%*zL**COYar&Ibb)46N`&is;5qh#G=O#Gz_KE>8;*d&L z!w)iE)r5Mh91Voaz)JPomwv~cs$&Q!%uF2EpVOnbd6ciw2*1*R{yshU)7YvI=FQlj zw?u6%4TS*#i3BFn9!rgHMrukt#^m<47K$Yu$FWFRXy!fXSVBCeM_$#evWnKtW$nD;M z$9<+O{}TQhHMd2|q4i_A6CWa|Zbe9X&ykb<_#wTuJaT)?{~Mmq%^!3aWzbTg?qJl$ z*)54T-+QS%-@KgnY5foHJFo=s6!;F2Z93|mg3i4DTfrg?G5~uOgptvUHAffvp0;$H z&ePxg{J?2bM`B{0!T#0E$HIvq!yL2zt!+SCnp&fGKCkzzzRpXx?Bz;ly;=)M~K3sk6 zn{~dmF|<8Jf^1p9EZpaTSkobX(~PUH@7G1h%jnNfJaI*2N0{mVb_x82h;NU15uDD| zYb#0Qa&pMit<3ZDL2;YBI4d=;YMu{<(6F*}rGbRYkPNQu^%mUsKR?`qV@J`@}4 zeG)PxE6>h^T-$%}9)$)2FK#fPv-7O_(`4s%HhKd^2`A_yFQth4N_Hj*L^nXnwq;AC zZpZZ+7Qj`QbAdkIGCcoVWu=a8?EX}`8avVS?nX1=@Yv&I_xmq}z_K6(%R>29hTqVO zwAgg-{G2c`HiXlVg+G4-Tpyzvt@d}PX8$Y81QL~Q-^|JLIV!)obGVk*JA@0szS@dg z7%2tAG8NK>1{07yI^F-YvdG(QgIW5lG!r|?&cB#9q5>Z{tUs84q0m5VTL%Ou`ZYtS z<7GL{y=9Ym`-0!z;orTZmp|qobDNgsFHAjRuHw*r!Ca-P435bXhMdJ9Z{^@UX)Bd~ zI3pu^Ioy5EifJVZT&wPO!S0};lQ7FU3U5Ne&ZlaR)Bu{-d}F5QJdwHoBgZHL{!hlqa`eFP_8?f z&#!LIrgJ#H6_mOEw=0PH9Lk{`v=$W**dr5ce6Y^4l+qPob#I(K(AHbCkI;!9 z!2?e8M?v1?Re?m!4xrioi=mal`X5)y zzDU`j{0E=oEqC7!6{hC3XjNm$w1{UHV&WQepJA9+7P~f?yfhT;GSd5$>DKF1BA4fU zW-le{JP-V)9ITG=H!f|DUfa9g%GHx!nPV=?DCfxfH8SXuaGKxIHer!?aaWt+MRu`g zkHgL!D(o)^mS~NYNNW&UgGM%sWya@7j7=RXeAr>`@31C%vtp*SN6ECcb9G>%$@7W4fWu}A{5C3&-8J#1>@wm*R&P9>|_><*u29Fp$-%a^pL z3*|YTYXN{{J5ux|T`s!*V1F54i&}K_$~0f``27bCG1s^!u1se_`@QEia&#G~zU381 zG~X({EP6cbIS-E@7qL{top18zYX?&TU?;aYIwJYhJqw+gZY8TbSO$c5$__JpJ3S{& zETWVx=hilQTgNzGjNH4|>LpUYzg4u;?b1@Z!Fr<(@IjgFl_rxaS6j11XK6_T*`maH zx8dbC=?>bRYr@}Bs5TO(+893bq{dclJOlDtpWz(uv$Gf3oqXNDn#p`DOv=1cDd21l z`O-6mkCpC+u_VtuSE*#qRZJ1Qq{MvyEN3{Rwn*nDf1&_~CHuFx17i<&8l+v4s^b^U zVPoHUmA0@yKk!P82gBI(lvhW^nz34}+`vX61@Zu5{7WSno{u-F( z^R>#RuZV8ccU{NV`?L12B>Vpl07|9aU+IMI2P%;d6>B1cEcg6qbf5DQw}zNzU{!l8 z+h3p8bXR4&k1Yr|N=)LW`#C*{u34xS4O#MY)S)KPO1d92981}Dsfv=qOn8ZvbF~|? zJjNbo37pL$uiJ}{ic|udX$5+=YV8x0o!~P$G{ytT>BrpN1MKPWTw)s|sJNcf;jZ(B ze~+f0h`@z18r!(-5(?iw^Ar`9xNF!5)!v=HrQX5t9x z(Jqdh=%R>&^@*^O#s*p9hTQ(v2&`EwDzc?>glVf zqPAnE288__P>g(}+N}vxpRbD#Xu$ECQZJv2Ln|J>_mCm`|ByjBLUD?eK7@qD-{!=P z_7GGD)Z61)@*jRlXIorH-|vT-PPI4Nv`~v(nMqaGA`_-KU+gWI%mno%k~oFsTrNg< zWd|PDSx`Z9c{JV*(aT=lI!z#JjX7Sm~F-ZT)wx_ ztGDXTwCPD7njh||fE3?NIqF2=*u@QKiBku8f5W?{L$Qxb599|HcDXqzOL=cR`qHq= zo&N|mg(N)+(oC|C19EbVu!?GY%zHz@k7T)<_HcS?%sC+sfuqqZu@z?3A{?9HdUO)7 zLQ$RtG_l#L5&0z-{4&R2$Ko};OpCQ_b5Zh8&(REKA+1Y{bHC8ZW6a7>{r#EhE3GWn zKr$Vzre$C6%i8pv|21l|vz^?EJNHmfS&WwClVTpxMCKQHPK<9>*smAamkpywx;YLS9l z)s+rQe!TR=!zIwEtD9G>XaA>d2C;aooxL0)?v-0$VBbEu!H}I?Nh5pq9W?8 z(#tcLJE)=%J1*GuIL2xWDZy>v4zU_6u_CD3nLK=bpp58&xI?SN`4_Zd*=A07ofo`$ zI?oh^8_sl1H40zRe{_ZiRWpu*;x$F#9i~A;(t;x-PJ~wP!Oqrkz8Q*qIOG0X>Ou_D z&XpnY#qVFZF8d$UzWY4SYoxz9c+H^J&dBWM{wDXuI$z2&XLeB^nq>XJptNF`PP0V? z6+Jy{br^C0iF*IY=4gX#4t}cr(b@rkuO&Ulv8K;IO9@Qm(o^bIOq20){M=2~Bnq`) z#sn!0Nx02lN(xlZvEMmiL_E`ZNAa8UOk6@jkY*BZ=H-qA0d7>cKtY&D^?Po~CW8ud zC^wF9lWs!9;zA`-MBEx+*lL`+Ll%iv^osaE3{yG3EG-F9Gt>ixVoNf8P&(+9SvZu_ zRx+#f6eQw?;`)j_QodA2qJtc=4LS7b@x)v$P@Hju;HIkNmykdWa#jKGX`Ln}8#ptd zcsO3p^oouk)S!shj8*_4?QNhzoB}({yp)-(;!wdnuo7^L=Fr;&i2;Ui^iD#PL<4-C zXkIa#90Pr20<9TI(~_$ycnh{dJ@S5`{LvVSv~j z{pEd55;H;YZKz|ev{>XheG{4J8GfefT_39(@ib+>2*&jfHdZ}}C;FK<5U4JtXV4W; zBJUa3Ag_3b+W=>w?}-R=dN&yD0XGSuR2>!oERDd4>{E$y7zM!!ODVj=6+Zv*F^8<| z2)EI?D&*p`;5<+LP=E6#lJh99C}MaFnvk0<_-2qz|5GLiX6;7?k;7o8cHa|e6C^6V z`kI}D@>gT5fJOu93dB(i5;1~^H?9KUDn=r&cKtG$l}}el3=eolzd=oCakz>qiO;yT z|KiQpB++v3qci7q{-#Gv9B3K+hT+snbSpk$UjXWr%#uRPIZlQ1d@(LQJ`mihZ=9C5 z3c&HlOZu>)aiZ%kzcS=zJ+u4Bo37F=sG;ESCo)p2=(s_ISl@&U3>rq6=xBPx7P`fx zrRr!@eyt?t^rAcUTW>P( zEy!;@BEfkUfQ51#mpLgp-HnY$_zH*k?pf@b6Ni0L*+ToXzY%>|KE`t_LTE7j{Icxi zM7cKkoG1>IGBp*S_lshy^(ZL6k8R3>mmbnf`6GUt6(yGtPF0-g-ZLoo$&_ke;-QOa ze6M9&5EgD4mE)Ux1Eg#w=bhht8e}QC;{PUrY8RKBc(-VP2%As=3x|A%DUd;t#l>w_ UaJUKn11Oe;s;!a6y+&YJaW=d4-3^cemMoWY67;lQ8SDp!odtgNbaU9)B_olv8gYN@}k zP{NyK3P%2YWD2qp$W>}nu%jsmq|@mvgmSLZTW7(MOMw%>w^BJ*=qu!L|Golb1%jAc zAGxiFFgva3d;Dl;Z5E=@$u>iw>(>riZRJ@BR2nifZgkm1>2gBot z<HXyB7@9e7dX0z~Q9Fge+ zvxWd7+uI9NV*dbFj6@p1AtA|Fj;}@o)vG8Fl{b_L1B5}NocU_428DH|@<3>BYpo0q z2dnwkNPB|NSFT~u)jC&Gkb?#zWsCJ9p$}Js@dxhW%OG+qhL1HEjpE3CoG3C3k_FPU zHF%mLKXZQk#&LlC?RV$Dv;4&zb;|+E87g6<0U{DtX)f$J?Na!53n1ir! zkokbEMGiQIRe%oVp!HR``l3|6Hd+@O;93Mos|{cSP(-sGIdCN&t^-lgPEe7rixWug zjB?cB0G7-RqL5d2PM}YKpJ2UXdh>~i;um^SFJ>gBv6C^IK@MOoo%EDA1N3s1@wXD-~d>m z$vP4!fJ)Oz5i+VDP3I^E%nI#K@`3wO$Rr;h79WPeYJ_T`*5AfT?k&K{#ZEN7*oMNR zF|7R^p`>Z0&}~HC9JYo@=1GZMvV((KZKGk6fG-F_;A;nx&{6M1b-9d)1Tl*H5nn~+9T*RtgoY$qnsr**l;l2$U-wBH~Hleh9L? z5Tp@fU|<#sN2Kw{P9hP(TgA5*Vqi*$2v`@!fs1lfS~F$dd|$bQqvjAW_OAXoh>udu z=fbcIy#%aa@u|)t1=2=@p+E^RDPW#x4U=$(9>$pRm~ zmLt*2T)kZ!iCEk;7JwfP(-}+@*(2Bi2(UFs?1a%;2hgpUHcTAaM@n_|=0MR1s-9rQ z0lBJZ4hS;V8zI-Kv}hz1qH_%3KmZvXkZfO!15YcEBdz>hSx}V(fg}(JWIq(&3YY~A z#=#jPl#qv#NW~BcO|Ec4GXdB+)5P|Af0=;q=ZJNtAh8S@lqV(vK;WZMWItCMUk;dt zCL>iYcsj{CKx>V~;r!5mk4IA#dIbaFi??>w(dj50112Oh^{xzzy-MRl1bnFmLiV<& z>CiG9L#bDT9OY<+3dO)HBw!60W>5EblyQMYYXB8HC|nsdmYkszxYCedy1)VLZKV?s zQBDwV8sL}E>;NQD=StN1_!9g;ASWGCjDjeUBp;>3W?F808d;8kTTibEjDzv`D4{Qn z1{V+@u4Fi!twZ|j#7rth1c8XiA{!P3Nzl0>bxa-}2MR!7UF~svvWTq4s}V@7D-!33 zV}ky%CTCX)&7RNn!J}Lp=r)W1D-s7~B@jykY}9g$w=W$>;fnph6d=qy;LvKczpKno zfO5P%0+9>QRp3^LcYpX!T|Vy1Jc?F79ijW z1VRl?YNfD;L8sxa)(hZJ5=QN$SKE;M0J)%2j)q_jl8e~W9!gIn3m_~mQzr-Md4hN2Ef1=D=yqs$d-_iehAC5_Nu7U^E2^0jY?NY`Rnk zRyimT_TIqi958-Zh)f62CkL5CMklc)G^)&zND>oVWKv%)3?}2TAW8vEC{)TRE@B#+ z%ciJt4vtugjk7|J27HS(oWg*BM)iKhdWBCT8S&eN&~^_rj5u(Ms*SLVNe!QYb|nx3P>U=oyOIgq62G~9Ff)u zj6^y+Y884NFq{+0hDrl-(K?I*Wevly?R|WSgn(%*2_ZI2Kb4Q#fiBW9h-#&)zsyM? zadw)vb(OCMF|8pGhXq_2z~D_gY!Ju+#M2PuJdrP$%a>`zJP_Q5z*Wnq^~YpbvDHKy zfwd0q3$_MMz5)PNcusVnf24DmZY5^C^5x^WNTo<&=!N=a;%2|eU6cgb< zT#%9!e7rA{F6THa1Y|8D0IO#4kYY5KjF<+MhzoXdW{?Qz0Mb9b5SuFShDwN7R}B!( zgkoW~g>XDc`h zFOibHMN~dg4me+)9*l?T87du11}s;P_V-pm$r3$U?MFruHP%eFw~|CrK=5QJ2#0sn zaEL%mbWjRuE?}w?QRc^YlJlT?B19_&Lq$>$cbY_ypsX1T_ZlAVxUoNj_q<+7Sp}D7u8eWjJae1V4=n2M5DJre~lzc;hKDIGq3-D=08; zfRFMtWT=Kt5?lLot?5c9vR30G*J`wKJrzx4uylTCh!!u<0sO_mQLk4sWdPZ5@X`B9 zc)n^lIDki|>ydnhFBjs?gNW(gbilmPj?)|n;M!;vNI;mz4qAD2Jr5nr>T5^KTK=1*oLpe_&_-% znG7a#wW3>DV@X($+C}AK<*Jw_#W*L#G`gMjNSqa$4T8W~a+re)2kiq#STkTCYlu>b z60xi#PJFq_nTke`ZM0VQP!*W2*@ z{mFiKzFxw|aC{XI7heq#=Ih50a9AiRMJ#1fL14H}Lla0SU_DZTrb4G9lAl=1Mj|OX z0ubJ<{q;y1Ud;tm8!_E(9hW&JU3Kb7>SQ zkw;Kj+cTgDk`G7YD6`?H32+xb2t(<_2*CIVP&A#;6$53%t$137AK!-0p!E5(fGgp8Z;4(^@t>9oM`GK<)NCR|Yz?E~tb8;S zo(jp3uw>IjGk{4V@WmRLixUq4qeC>lavzbz(G>y$$`Ou0_6^+sUkUg>vT@-5e^xrc zC{XxM$gEkLW?>!ess5h5t@DCb@Ft&q^V&4maJIwzrOsbAT|Q{^rvp6jvB4wn5x3Vr zz7lL#to*sdXYU}Pin6|HB)v}ZkI^;lwD@tQTRj0uw4d2^u2W|VZHE8K_Wzw zyqy&gKs(S<7^i>f<|uWZ-3F}v2R)SRHnT?7t$dU36TTwb!(-*2nQphjl^su>cqf}= zdfKKp-aRq2J=6Po3g6cm{dhN4eqpEZA}jjJ#EbKLG(AT>v{#qF{ofxtA9voVE9v*0 zmOEo}Y`X`ZxYAv>bObtcr?R&65l1E`yctk)Gu*;%;||T4qkSznx+g~XHWl}#Lvctq z$FQ@smQlB2MpTB~n6t}y$mw-Ws%u{F*W_PPQwu6xsw<*LoA9ak+2Ty>^7Q1y%n6Ts z*U^8Pj$KE;>1!!M4y{~SK6!OZQ=uwtNH@r4tq$Y2p88E#lR5U`Kx+w3S4I) z&@6-h?E|~{vH^VMQ{k1je~er;C~hvucnhn!i+2;&6`Y31TIir0W7F_+amFlmshd{% zW>bmHisxB>EOITqbGf1W*1@bMa&T(EyPLPOyj!%MB3Vs+jKZR;IN?{58Rj$e_c%Cw zGbSgXjgiw4`hz=g9d92`Nt4}#^wnXF^Mxj-l`T%!v{KZ)r=QKk4$s?_@)wCzSaR7; zo542i&Ohkp+v8r2NKek|ZuBzN^nS{Gy3JlXzcc#sIpLQ7RX{-KL&I~2GQ76C-A~%? zHaVORpnv(k3&OJ|P3!lHuDENT5u&4`KTbTY{X=9B6BCo88r)@`(o&?)KQA%=ZP)pj zxb2yQ?(A^QsT-5YJ7OKu*L2mSAk*wt zr!}16;4H#|QK+!nS%R0l(s!8W&Jn!LkI&l&xtbLck?_euNfyuVbgx@OojW5;XPaJb zh-!fc#!5!J7vj$BNl&jSeYPyRw%t(Jmbq47NL~J>Se-8MD0VC`A3-gqGl`*1H{X@l z_`b?c2}r*G~+U$n0G$v6EZEBjTP% z(#%BX&$6?VV9{B9m%%CCB}2;+4euM{WVkd@MPGm5AMH_cK$x2 z#=;I7j1{b^=nlPa)^lL;##4($DzMPaRGjOR5B&)D?~L$m1B+X4b=CR0Lc@>E8Q#^egq>_f)( zg_EIPxYy13^-C`e?RQ<+W$f374)R-Cg>rcoHltPy=NK{fw?kQj4QuPQ&qejl%}Z8q zGA|xHw0JhrP~uVG*bw|Je1*KtJ@bB|#riEC$0nMWOBHUW^E=-*nAFXi>3Ke=HP{dQON#`4Sa%&>D8+@GS;t1p_Y zKP*aXtI>5*}`pWE41~Z{9@0U-lXB92rU9p87R@YOW{a+Na{=&@jjg z;fYlS_gCy_V(-AU1rkpduJeqr=sdE#lp`Qt{&0GaCYJN8&9aNd zDi2?V2K?fq2R@9MOCZCoHr$;&c{4*l_VU59#2@ppCFe%N z$p$4`-g|`&dR3o`$>q;Ae$y3QnbPxh*`!o4$J`_#V%BNojIu^k4t7R+eTw%Ro@4yZ z`@znd4|TQC%Ma5{mO37M**O&h^?I>reCWuDbEYNFmie!r=E$xyG8wxE*B?yvuQx$e z#)<-M`rfi4i-YdIG-+BC_UZS(grC(-ca*6OU$(UtSDsk1@4Wl0{JdC2ByRRh);MeS zS_89pK_2uM2^-%0_-if3+4sjPSR~hIPBif{w}n13)RZ1}R96&qSAAb1_-@b4yP$}y zoFVC%Ch$uQRsso6uQ=;`#V_;nZ1*l1jmg{lZR^{mc9&O$4Ni@*=~biD7L!z&M|r5< zrId#31h;>h`qgWN=HB8B`*x`AkI*mi`MBi%)~gnl%-LhkxQ=$qvhz0kCmlZr{W#tG zCf_Y`pw-R7ww@jVaU3)##t>fr{$T*KDfqAb( z?iH)E=EZ(BI18?uS$&3$> zn+rrcO^*F`cI~sMxbfwLGl7`49h#oH6L%Nf`K@#Dx_vvMCfZF$T25X39yM=UMb|U8 zC{n`Y2aNLN8^2}5dMw0Yhgbl4?I7odzT3u4wdh0&O1}PAz}CW z=1=s!iHMAv&>~KwMbT)|o#vl0!*3P$ZcJ?3H{tUB&9!39ImQM(saW&8){}CrEh%7P zQ2@VTw{*QtKKgBpQG%sO)d3=?=hz16jmWamwmUTiJlsg-1?%XTrU%iy*6VoXm`PN{ znu*bJsL_(xpLq~znMdG|pw^Qx^%Z%sjGIo+HnY5Im$fE{oDc2pJ*pDDyw7+yWp{m| zCwN5r;gMZHqlfYYMCu-_C;hm8vyb87ALj1&aK!b1$u;_3=*`~v~0-A#FwE@GOE? z=+p18$-fTo9{YmqOMP2Aui|XsTjR>wqWh9Zh(_JAm5wvH9H*2Ag~L%X>m!VWv@hVG zBV5egD%QT1%jnCtR)egO>eB3Ayx)#ZO}JZ>^l1b9Y8=;u^dstTa%>XZa`gE@ldZ$b zp2JJZ&*`Ghwt191KkHE<+_eTP*K&nJLY!(-}R8*RMy3ya7qKmWe4tS#KOuWUY{G%&dlqP8g zBKLt1*L}o+V%4&$qAc8vr85P`L-BJa1Ai>a32lL8I&Xig&V>k?U*PL=Ga~jI;7?~= z8ZU7(HL>+rTYnv$+R^b@WFOQQY-ILShLH!5ceF%tRh`P zg6(_mn$Su)B!cuI;pQ-%TUP=H|GSDr3e+t4coQwMW&CIuFFvUnwLWFv_NseBXCOmDRgySNM$Fd{r3nsOOel z0&vddPHSx95 zQdvGAt3@C82<I=UPM>+P(Eh+;$W`Sm5bJ@H*B%bSpd7y3u3p>L;tD@ZqQ1lb^=`3M3|n z(tlk?QQ`N~CQEXC8E(l{H@$u;AFW5E5s!^@mh{&&6oTdYFE*V6mV%znaAQQ8L%!M5 zx8~0V`%NEL?Jq$GOpW%IeSdA_B?x1q*~J9|@9jsLi-Yo|pUgmlhS^@;)RW#zD!AtE+;`{O`DfweI;Ib%MPs_fO=AVqgXXHjgcq zh+iUXe=bPxEn!TFuP2SAmw8Tm)!!twFCb2;B~5p3I%L{-+O4IV1)g?Qs{QM##}HuwuW zY`peUoAV^BYoZ8x#`&&|AxvpS<-rdL_X(|C&o*vcz0x;d#)g}8iWYWiR~m^ajyGR@ zwd6c?qWk`WV?$}5FKnOOeLB~;Ldx*md~4x?Po?kPZXujba4Ysbed@02l)L72xU%QC zS7Y2@jEc!nsES)LLKEMIY z^}U@J`0bT#u>Loq7CSTmvhuw{*MY`qda74jW`$oUte zgZXDw$-!gN)105s>X6{JqWq(((MzgAuVC6~E3*V>XI*oMXi>p-&!lZr{s*t#AiWY% zW+$^F`u?aTo+~dap%qBpWo06C4g+nVt_E^+QtT@D?r3P|Pg0JXXHv%{)$*hebZiFO zJnF4qJVf$p)0a_oi?;v#+9|j_0p9IY)ZTsTQ%QIP_kDijiT(Gk-%Jq=v|HZWEuZR` zkNAAthXlW1#66dl zOxwTt<~91!1ugqWL`m+}zNb#DN4PHRKkqGVX+FKSW9n(-xsxYuO zM_J$(Z`N(~#e&Z*cWeVsE_lD;!e~b6_sMzRA07FothjRwV>5Y|d%|5c0AHi7Il(>? zcQ$E*@+E@S#+mZRPQp0XVH2GXmPanB8*2$)$otbnH}4Pom2++$>PzneixS3a1H3A~ z?j1Pa`E-g5P}PY2-LC{`M5Mm?+cV)H#XG&Zt~qSUzOjVT@wPI9iL1oJ=^+C#imafi z{UhBcp5=?}rQ2=)Iu7XvDy{>`{EV^jnBnUUL(ac)d}?ZfAgse7eEA294SqPk|(FY|tN z$bHne_fzb=4X?U0{u@!LX$X(kzYDI(L?&r70*r~lqKcNRV%MX|fsqAKo^5dlCU+G6 zw$Wl@Y-s-Z#=GA1{G~Pi{XLfVsFA(Rrmu!J^AlGZwr2Di!){oDrzY;4y0ni~)%(ut zXi{)&O4{}EQ&IbCM&I}MWXHK>uil)l={afixag08`!OBKK^YfeT@4uQZ(1pF zqueHEm5yyNr&3HF*BQ$fGBRFWKNlpgT30TsV}=CxBb1MMapi}r4_Fo<5Mc_!=^K;} zZPUq(w!h7E<9Odr#E0i5`IPi7NLuOWrJ$crjIJ73LjRCHzsRpR{-b)~DZ|{B&+ALH z!YlQGs{Q8%R++DW+WNlR(AsfzJgDg7_>UBiTXg8j<~!oT(yv1;-y1?FO@74ft{*D< zc?$gL(nBNckKWz~liEj!{9NN@e|3*-e4ZD2&rzvv!m(vlBL!mN>X`!cA@30hhQc<;SMahgYa%kol|OA={-)&dAxg^Q z^t7gZms*!PEe?YwPca&TtZiPsS-y=B+q(g?71J)wi&j+q`g_TYCAm$P7yefrX_iyx zxP483O319uhYlUjn9?U@B-olAeErWN(wo)5-re1GGs|X3IXKCQs))@lTd=OaFC*7< z_)Ytx-QlgvzQ)--1S(wLfeM#^T6u01_iitG?AF=Ec}EphvmH;)7$KbYhYf5eo|hh& zTq^L7`eAvVj#(cQv@~z^>}5^=Re@XeGHO3M@*aO3Y?Z+gmHWThm2uppxLxXgKOW+# zweVa4FMhl;?d0g=qjsSA8Hr;>8A)RSm&==M1Izt5195wV!ty^4mSi4L6{NpeHdAb$ z71nLQd-CM_1W<7dtgm=r$sX!9ZLKb`>rT1;DEv_N+{JXN;9AE5Bg@5kx#YAeW$&9) zqz%&l>IE1xwKc13ltx|mJED61#c%ga;I^w-NbPMko6go(g#0KwgrZl{YuX0Cx+REyK%e5rlLQ-jQ?fP3&aOU#P?V?(|r41LSfBU=*y}QbFkJkR?y4MZ}-*< zb4FVWe=$t&>Zw02!Tn0Tey5(1`V^_`Q8qJ&R;JTW>paAU)X-Jqq6ErrJ&(UVPZ^n5Au(Z3! zi`bR%pE|H5%Zbsx9>v=(8onGn`5-dJjN97yBSp~HETYMp$DF!Cp3rJ;sEo29Pc(yD z6I32?q|Gx%ma_R76YqmrL){Pr)03VlY)agN9a}zz)jo?15rg`^-FQ${e~Z^T^|_wO z$Re-=c(YkNHArOrm<)un)6uW;5&dvs zb9!#nT*0OIx&QZ06ZvK74~sL4jTXo1@$tn)^OMroen{XKpFBC^X2@Um2fe(nWP|`a zSySII&`am)b5iqqYZ>g}E;CJS&G;+#=J!5fzjSou1Uw9Cf`s1h-TBt_+V#GwJ(xY7 z5N3Dbb3Z?`QU>%9VqkC$6g^YXae(|kCJsF2GEO;wPI|>u(xUH_An{Xe_+xDs~)TQeoEs? zx#dvYZ<~S|?)SU7GVR;R2L-&!6h*ludx!4!)kitanPW@NyamEXDbXt%QfUL=_un_> zl+EvLVeg3V3^twKlP`(2%$0bG(8Z9hS6D!iTY-If?8G+w_*1(;2g6>oUC}@xs63K( zE9IY?=KHSt0lS|$UZKMJ?6Nxf*~8*Lfavu5oND2Wu4Abo=3w>FLD#$Ps)34X(Z+>BGnTaFxc>A@H-mXg zsL%Tc*K&uS8Z>#3E}uR_$)4L{oF_9kC-$bDJ|nJ6&n+~LpObHzfct}R{ltu5oLosV z=`NVcvnzO+Y}pce31~xFT-W?2zU=mqY4S{#^9QYh6@9MxK9RZ}V+?t$fEB zkGX48{5kfS=2(CfT^j7VmASF8_s0I3+tR&J1^W;;@$k5H6E0>mDm2>8Zmz0j)r~W< zu%TS;^(oOONCA0L^!x-xeJ7Otx3 zKfM-}x!DNFSrZm~q5{n=h?TGI1Rw!iuAOi+pK;EmhHeK3KI3y#<(95_>U1EP*%jC@ z*Xvdl)1N(|XEW3O*pq)WaX}vlsNoiOb$K_2{c>~8;`4D>><7B}krv8b)Q}`|L3_n; zUm>dQc5o5|VDp#Mj8Nb$j~;ioXLrtx0Wf;oxV_GBCeJ=A?1CZneDC}@nq3)`(8cFt zoA)#H^w_#;*)CC@$KhT{A3u0-dr5izj|WWi3)682Dr+xC*i ztk>wqm}ASfcE#XsF^Jtz+0_ZG_`=Svix;C`Tj6Tf`Z}|HW4VF@;MB-@XVv-j?k(^ueAXqH^TwNU`{oM7blJ2z0 zu{}r28taE}w}!^fBRhaDjJS%E3&;nS(5X)0Lj%gbccbEYOD3|K%PMaT*^>PHLp4Do zZNaYe98AS<|LNk^otp0B?Cn77*2S2#d4B6tJaa#j4R&X4g=i4zLM@*#>4du45}7SslPy0wEN9|gox5@s>jR} zgzO$HGT;GOmv`%AUrTD9Anp9hmGyrWg?19oRyf;GZA$l~q&T6^ZHsP8IZ;TJw>asNNyFXu}jhid1h%(#SjPBRjC|R-oPFO4Zey zGrBCG;l$&RBGT-U7#Q8N$GSUW#?faP%m$Qf@oP5F;uDbh?1tq`v;`PpX_en1e>&hq zay>9lW>%Hmp|dLYUp$usy^`!Gve(Q|UTQc!q_saD7*cGD4*qvTDk8-Xasg?Q`u6Oa zu@MHS#hyxNH~xBQ)`x^f{i)FzITFwsWd|rI;^BXyAb_g;lC%<#M$$<3`!~`Y{Iss| zP~&t9W&@|rXhsh=dyc_0`}yrZQ4r7uVEi=$kcM9pd2;5il0&mhI`95kx(&cZ{)TJ! z{|zpdE(M14`A-xy>jNMSf39KYz7`F2-M^7$HR2icJrn>@_TcJ4)QpxoE9?+3q|xF3 zL_t6%{Odk5K$@nkYajoOG!LF5vS$A$$elBtT(AC56l4bnq+tQlRBP9-oZ0WpnvI?| zhW`M$n}Fu9XHWhU1p$+0&8}Vm*kM7>4fwyYLn|d<4F3so|9{i|fAM|)-#6{0iFWZY z=~c4_b20L_cgaeXD*uvu@L>J-_lK7_^LVKXMd+1FZv)Jxz2dexiOF33#%BBWXG4Cy z$7gc+?+LRH98o=a@+3MYX63B@w?(-@lOvt|bJFOB#|?q5sIb%rkAQl5RRZE_h%pio z+}U<7Fk-a!7Q?b{``VdMd1!df_|hs?`mJT^bK8kSp2tY-DS)fNos=!kKHL8EbgcuT zBz{3B`n0j>w+;9-2joQ5p2EpzvU^QSW^gS|+Swd9gG74ITFlv7cRqIK&YjIG;^wH6 z`dqyj35u%5*0rAP)JGoub~kHF`?IL+mm_}U|Jl{M5NO9O{N9(e z>jGtVA|?J@*ac(rwCg#iv=Q~k?+bdKe4D{%+HILTZd|pKVo>bp$x0}J0c3M)+5W3* zV(4pIZ+kz^+i7~ODPh6qpL<*q_rxqyzg8PQ``<(8p@BK$>#CN$8tGRK;(=Zmpz;5M z&7WOeyI(?&Z~KjMt%C~h{J9FBn2@z_#vRfVtG))pF?MlZ%ufAq1K5Y@H_ftJWYr#F z%C%0PHO52zt!{3IBNxrKS$O{Z`R7XxjBgUjdIx(NE2|RsreE;$t0f-rs6uqE6V{|)SEMR-7_|NF)Sw^?{ysagFpGAeK2}jhytfAJ z=7ZStl6hK@c2+IE_vkW@F=xx~7xwD1N+(BqPMwKxiaPwSgDVJjr*Ev?qrQ=#tk_w# z(iv-bm$~WUV}!vTBd-hlvwb-F051;(&@gqUk(5Iuv$AelbM2QGmAya-TDI(vh z_J~decOpV7|(n?Sw|7fme(ECj~sRbceZlOr~35MMaER zM_O`7H0>6hw)f);aP@hd<-HY{IYE|7v42~u5hu{h%nZo)!2f5o_eAUJswcMy#p8dT zSe~jIXgkqoSd~;~Alg;Q@C-0LsCeu5to-;glj!CnPydxvoe_jFfKA~0WBny|(5$;3 z7hJ#VqE1sxURbbI^?xiJ;$={L!P9qz4CvFu)!?>x)?#jc#f2Z#7WlP4EeE`3UvKyG z{VvijLz8gF9V9AsYxgBfGqYOfO&21TMnC@7$9g>Mko9GX_*HtR8~zgH#KVg_eh>R| zAuwMdxBT}t2SWDE_V{S|IOW#t5AHRZ0NUa9l}DNub$&#ornYrxdty`K3|~gxdGNEV zwj;NCe{I#(>pAOe_3BgAPXE&nERB3{Eo#5b`I9 zA=STn)`Lj9O#9)ts_MBzLF3<^nF8kb^la}RhYA4_c5^i1P?cL_W}_Gf?;PB4>h|Qf z1)bl2{NUByAa54085sQhbHTEz@LpprpcKE%A^@RH`lvrI8?X4EweZbz>cDvb5QTwv zhStSJcmZ5>@$l~1iC)>t;rs|iRdDd{amLH4Xx6tz9@YPhl^Fg>u?y}Ycro=~-#=6~ z3)7zb_?fWqe}o^&g7M+9sTke6U`C5urct(UnK$x*+<22W->|%pyZOBhz(E6To$dJ5C+_|I(#Q7>&s_%$8Ov zvMyhKkSjw2Ep^UVEOwc}o@#Ac&n^PIv)JNrX<2QN+F=F8p9~#Q-6?~>fB9F|LYRMdPlDObWdY-UXBVw?G=~0O^n-AAmH8vN z{sw>7XTDYUZ=<GNov4?tv3DD6Tvg}Xg&xFx!XN_(7{0I$cb;jbzBdYGl z<$1z<8?fibt-S}IiIV+81+NdxT5RkHH@dYy_3iDs+VQ^*OC~;xo9+c&Jm3FjGf;3m z;_>UeO-oPMIky%^zs^gCbT{MK35sZl?dS!klOHZ@UA_Y-f)%`&aMw=e**U{9;(%99 zO)t)RiBGX>9UU|UUR^8Se={m?UkA1Px$M&OZiURqP(f7MZ{O;-^6qw1zs?qkzUG*U zUVZR<;>Je^&RtLhW6>eRe|W z)>+3>H4&JSNBib|NPu2=%`1;K1%-_J8x&h*n`@U?0C`#cWi)07r3%&?imPN*a5-;TSJ*s}YJW*l1s(Veu)hxp&481H#$|SzIlwzdEKc2@9UdOe zwz?j&=MHKQEv0s|_l<%hx!aO>tfybi-;DZ>?ib-9?c;AA9-U|$y7K2=_zm|Q@?VwWBfDBw^uT|Iey{`r}0-%lorey~sZRydU_bi2?%Z`-#Px zd$p@Y-9q49!o^PI4GvAk{&zCKM=W+-?g@P7kA4+UtV_%sKN&ji0egwa3psWicsrd!m<_%Z34sDnJc=KgqQx>~Koul*d|B`MPdX;1PRv zn};^W1V)#QHJ)e)03|FOZaP{IPB-$rF?q`ASzYq{xqkzX1FBWJ!rDyu%gQN zZ)3i0@-k z$W2f3sUuqxA{tBf4Rwx;Jj8~j@9qKKSg4M$JPYjRazcHo4%wL-Jc+j{|EOz=4c@C0 z1*Y$`h$;=-?Q8hF0BD-=x;~EBbXNC$R+oQs*Yizh6k+vK6D|!QBdE(8FsDZEK@Rl) zb)+$3!JqU)fv%F^owiCqk!M>*Mx3gTsUGfm_Lt;wx}u61Ss#E*qy&4v=)MTF>Sh(Z z!q;P_9_5dYwMRur-jH%*uRJPh?)I5<&`GPW{RFQ~t~LE~+7WPg8-e!2z~!$@zxWKk z76LB-*Ij%KGi^R((R|x1iQgPA&Y?BKrOe1OGGV<)!;n2{{2Tz=Cz4u?e0Iz$7 zbyoLG8Ao?t0QwUwy{=>P_Kym>LaG98Y0>@PV%E zHNWirp(;J-b$`iFg4vtgl!Mi`Pi4;w>|gc7=s}`B85m+CkT)STgQjxC5mkB1aI86l z;szw!;EZLGdx68Npgx4Tp08!!E;WO?cbe0Xhv!PPOCQbeY{;_RcdCuBl-Y7@+pTv^ z^KYDbH#&bPtbzdNkNciYRG2Z{9xdt=^_bmyR}bR}Arm2Anl~ln{@CU>wI7!@iC<7Q z>U!(OrHUNNTXZUHF)0l`HoT_Poo zh@>n)x+NDZIu;#gviE-9^ZoeFb^hpe89eiubIg0(;~w#x=x0!|q_mezRikSguN_Gl zG$vfCY1L+T=}}BJxqbEzI$3XzVZGTADyUjvbV~`&(Aw#56DKJesUni(AaIA8=qhq7 z!vOjsxY*f+&}Wk^mXWJk5_Ir%MW}(qj4KDM8fj-KV&hMH-(G}btAC-^#Og;DXlH|C zI!21Rd|klA+n)V8pY;Q*6pnNF?lAa10o|TwLn|0P{nOn z^Smh$!ze~w%?#rDS6Xusru|7YJ7b=IeC9S(yJFA7u?IV(qZUR`U7yk4Sm$eS6=@bA z>yz=TqxDBeojIM*vk2&qR(7i~GCgg2IZ=0>$sXCOW<41*C#UFw1)|JkSDy3wY-;7x zW1_aSE2JSgiNZibu3}M`LA!`=g=x$K_seWT4cjQa1Dw}qOHhMjP;$07(BzpmpGKf0 ziD9_q8xrBt$}p44J%*gxew+Bmy}h`iQh+>G6i*D(XAHW~zM>fDX>iR7*!X-L8W9u@bq<2U zHdwSPoL6GwvsV$l>+E+o8O1I65go6fTxC`9)n@$H$}^lg(sFDH=%+nngi6t^Vu>Nq8}@3v!Q zunpyvQzmeZN={?ZNGgb<#xngR92A1zeB79WXuAHRa$8f+fEv45nVMyhI%%%670D8c zsi>Q=O=iWs4(L;yMSwoS6wx68D&sjSc&Jt)BY0 z;cACOU8HdOnKa^<)>HoqWM#+bM%Ug48=g3K#Zt!mslr5t8|+17Bh=T1ox5HgcM)-P zX}Wl!OPMfFTGS1fL2PL<*G6kn_2~M1kIUxkf4n^vBY_tuM&ACFEi&>+rA|RDKH2a5 zrfw$KOqFAraRA$?z&(ZYpMPHD>VNS#_Xz?;*Z+3ZDI5)P7aC|&y3PBfT5k|##v{kM zD;ABP$dYHMy*a1kdz*dUsuxmp{oZab$A3oV(;Su)$xmuRP{Z?Vn9jO$Q%2;ZeA0w> zztv^qgk!lyV~%MdQ&7z2#E~|IYOce1u^QvCj%g;#`w_?BEaBOK3$M;J*JfGE>Veu^#=#lGs6FQ&_P|$=V`(07(%4pBi+AQNr)0UbX4n1w1lEdHW0*a0w z11nq&H$0>fc25e0J1^rh%?Zk!dYWmkG4L*89Xlw)7?*=O!vZ$hCTADBuEH?Q)x)7{ z#T;>T&tmoTw8Jx`Jmf{o^KlWeC~P5@#^F>!M2Al)%XVuOA>s&&5O>l+N6#rlvnDf7 z>hiSzV^bbgW}(yzD##K4*?t;8)4a6VKnY#~Bj8iM)Te=@VtARMJMh z{Z=P-FetvnthZQFB>{YEEA=JRUz|1^y6|oeMY?;DI-j;iGNK;f!}Re!QHP~BK|{IK zj?%Gj_@Gu~<|v{%E+S$~QbQD#4#-){Cg0QvBP@m#xgUs(IA)+W8} zpD2-G&pqZ7>%=Fif?Ib<;0RZ8V%nMwbcucp({{4J$ei&Te}rO!K^3Jsn;%r$4n83F zN}q_=UYsq`{7gf%u7h1vQ1H|lX?z!p5TBFSgCi$K32Z3OsG+@sl;zhi*G{aXctU^R zNC&=1)7(Dc9Xb$q)j_?+HcZ@d0iVG{^Ytk3Bw{74V4OTP!=1ZPX8%p) z=zUiCZB5lScXiw1`U8=eOQKjgVo*z$&`VOqz(f%+59pw)tV*&dtlGEhixlD;Ronxl!HciF zNz~b4>37R_=7^+ralB;K2faq6Lky}N+FplBP~aVxaZHve>)GfB>(!^?*kpvoSbNqtt!&@RES~xrPp`AD?10teZNdlKg={-*kvwQ@fdK8!M zw@IXW=x&77s#zw*7UcG)(_!SMh`#?a!%dm~FpTgJ8@JRx{0N#JCRv+03thfp8*Di% zfcYN{j}_GEIBmWE#OWyHT=oEN5cm5@0u|p|@3lI%WOK*%2&ySd&#Sk%G##01+>=os zUN(DUBP?=}1N_VT^stNZmwf72TZI>?fn$+WKPa}F!d!U_Wp-%>C5j#9jFu6+k}46x z))iy6W`zrAv&parC@&wSM{om)YgYq<@kjkL4qa>taOTw>$W;=3&f#&3)Oal`ET+~qv`-%`9k+H= zqiN<=-A{B%eCx58rJacYI#t@`<>h-_9qZEfe6V2kl+sX$5XLM^dj`~bGqDFrw&}_< zy3PYFACujmkUag`l|kL*j+`hhl)&bX)JMJ=+NJdsd9uU}`ir^B_#<_?uuu!Urd(#% zr=cbut2;P0 zFS{ad7N2So{oaaq(6%nsbaEgNLkT3QVcL12i|W?V-YF5fhlkWL;5dqTY8Cs1fF?{@ z1muGj?Hatz>LZ|fo33mUmV4tBo}An;fl7w^&fx9E1rjp&u8qc4j}_@sx)l?~f!QEn zhuihjHFmXeb;CdFvQxQ7cG zW^Dc}yE`DkUZcssEhCbq+L8%#@)Y%`Hp-f*%>>G)XEAOn2n&Vyun!YSEr*3Z?oTJIsO!S*f6!)n8@WY!A_rLH&Ug zPxQ-3=%Ol-{)|qX*H6fDeZ6cPpq8RtGzXM3Iap!mqp2maA>DM9asC4JW6krh)^XUr zOe-zC*i|DX*CjWUx3HjgG)`UQoA(g=(=d~bT;%$SShziR=ID`^!TuX!cz|Qs`li+S zb}M;;dAuup=H#QRJ=5chdpHB-8d+Oj=tv4#kn4K5#FDoT6#59k6l?L# zhj8qMH{&r-24WZRcW+|4*ZhGueWo^ON0>f(Kk#ko&TWy_A&yx2>RH#ejqD9rBCSK3YA-bL3^}l{CYn5gJF~O zKd!XoEN5=>gnRkOt%`=P(5yuqTO&)1^5n~&B7EPV@B9iJp7=?eT>S@Eo?(ghGfVEj z9_u#s%`fXYrw=mm5!mZ_+XOd{z_h8)lAi9Puw<@qcXbD?R5~E4Uk=4E-Yz|Ek6&Y% z>~-h6u?(o*h~ZlScOKA^HhPyC_19F*$!9;uf9hL6q)>i7ZECUWeo7?m{ebXH->X~p z>N`}FP|)A+RNg|nkpV3+hMwBAG7fCEjMlBe+}munM1~c6CmR}Z5L;|j2_xwLoL9fu z33rQB+nLWRb2Y8PN)@ONkXs*kX`Ia_cbGwW(xp@|FShO@+r)-V_h*yy$d4xW!=cwm z4MT11cIS_4M}f|}c!jsgtNN2S{+o&-6lS|0vz+=qu#;3?JcxN$Y|ot3M8h43GH0K&0m8F0OT5<#5?1&75-ERv?#R)8i%x>jV2Z6DZz2A; zg5~+9aL_J^j{4It^4YAd-Epn`$s{&@X(DtNo?){6>Z@dahR*;*Fajo-@w1P9a;#ut zf~I5x!B@ege+y7Wq`-g9-fbR#_YXd;R$io@#o+FLU-KcRC9?L0h52a}*AYI+&X?N? zO#OB){$P{cyMeV~IdC!6kQm;O&swBdh5;j-+e-Zxl(;$|_4hn3jPItaG% zww^vympof(cXVjG*ljbbXxb6om~Uy)9<5D1Tun3U3r4%!X-rY5UQut7a?(kr@%-u> zmC4aK?v9OE>Y%wu{_ZpiGt^hdgysrCa~`VaP?T($x9Q9L1+??-NKgrskVfPQQgDy4 zoT!^Q`}QWEi_lwB*@l9c^B%Bc`a}+DSu&5>vLCkeBB7s>^(9XpvkJDDJy?XDT)clU%40693iXw$KT#>` zfQ&f{m&?=#TzFCPS%g36D7LOXQX~4sqWY2ejY*4FKX<*|-~lA3s&c9eFI333x}|1VeFk`i9r*ub3QhZ@tj zp02Ua3lwr3FQfW&2EzAYQ{Bh}Ru~k{pUXVE3lI+c~K_azF&FlNO1|SMj#-)i?x#MooMzB9y(WGFy zm-5?|BmhDu+%Cqe;@Bq&QV>m*9VNjD*mCs;GX2zQYmhD&AKA>0z(>4`kspNyi|y?B zY8MA3;Z72az~%?HX8{Dwk`5K$*%?-(BY;q;Z+rhD*T-la5XpmIHc1AY>u_oip|X6D z>`vzJZn~hd6iY5y-pQA#90=jIv$!HeaTj34!-2k#wQono9AoQ}wF&2+`(BLb?aVdl zQ?nP*iTNJcO||&dd-)dBdR#R9i9l&nq-M5rrt0eFruwKGUiq&TKi(d9HtpjUFvjm3s{aS)fo3%xY(Vp^SrtyY_@#bUxy zM?Gz)u9AANDZT&So8q79z9jn2lM?7&+*{=bVQ--vAN)Wn35%}GVd(m5-r-@b{NMM% zBe|dE4rb@k_OTHkWbzb;xJ?>$c-k)A4ZfO(G#~VF8oH9duBL+63LdCqx;mHzJk64n zUo)`H)Lj-_hK#wnw4n6pCk4jUh!98SJAIs$_@lZD8kkNc*Ij}~vAJ2T3;AiLR3D>X zWFCTSHD0)P83b|cT@Zsrq@vbzKIYGNu5tfyRpnL0gqF;@7JkzCe6;pE-O{nf`0LK& z9O!VwPHoBMjyL0=l$q}4kw>D`wWeGPOWxc%N-cmoY~T}mFD=}sdLpTE97GEfh#!W( z!(1ycd9nBCXYpEAR39|}RrEP~75U$+`$lG!DW*)Y5!r@Fx(7;XjmhTJNoCy(Sq5QR#w4ud`?hf2yE&i4-3b5?@ z47e4o2`6I_G*8T>%~y=S+KcG+=)C|X{DIn^0(XVt-wH&&b&zVIMefGJpui5SQP7_s zQhz86KpxSQ1gl?djFsw}Kh2aZQI7~l`h#+yKj>h*04eEE!&c~tvgh#@iT#w8)$V)= zm95RY(PAd|-4=fLu@Y%cP`ddiS8!8F1TojDQjkFgXV!L^nAZc5F!vjoV5~*cb!J;+ zk3=t}qH=Wkos%z<=f340S74Lums4vwgV+`{28E^*g%vtM`X|m3 zr`k6{*@G|R`6ew_jAwZvyIDgZ5Ndp*YiBbHBU~e$lKr88$?{FTLgFOkF5@{JYM|=* zHSLBQ(paxs)Ff+Pyf&r9r~0|QJ*vWCNLqnv&4vXA-AbGbt~4i!W53-})dE&_U7M41z%s z_nlNDXW%q5eLAOST-ux(jx!}iHR39?KkxnC9N5?#H;97?fM$HR5`5iMH|>y>*#;;j zgkm@)sS`^ronLgP__Nti@~O;I!dS33i|J>3;6jtd-SyXzLDxB3#gkBX2z0 zR<`}~f8qac6uqDy@23j{D^^8B%y+w=)t;Hk{-iz45T{ogV&w6-ZYV3sSe znFTl6vTS9av8VsM6i3tPQVf}H{zsViXf&(x_0@?Hmb!YR6j;8n>bu9!@g79wf9d=} zC$7C-V-GUlhJxi0{8WOn5qpbgxOF(G4V z58DeL?!M}rO;mowz7X?i*Y)INW+;DgAdiafJdR%vl-@k1p=C$q>u>*VWY%V`xX z9M5dpX)JkBpN|*}We5dg3O&4|7 zaPLagvfyl&V6SU6EDY`5~Lo)k2!7uf2K6^JP(2kg;+o7xuhXqzicZ zm)M=o>-04r4+||o*7!=v39O_OAdB#myQ1jIEnRcN% z`IwCm#xq>ikM#UjQ9UGzqmy8C>z6E6uPAGg`u}D;9c&)LQx*|fWWq#Zh)kd=U+&~a zt^#WQ!THev*JfR1jgG?22A|J$d427|;MoPO9?t8Jwma~MQYwfPNr&^#(Tuzt&M9NXJ=|qY)T+#E)2Weio ztF+cNbEZm$_e2b_TCKBk;I+$~n4No`2y}_0BSnbJPe_Xo#}_|9A%M?U46~R2gEL7G z1_Pr5bDV@GE2;;UUhfuQ8F$@1l2#2G_)eHfYqP;L|A6ad&bHUMfo*RxDB`G}_jRP7 ztTrr#H?P5H-)+1~4^&5~Ub_Tc7@1#*q8b}2Dw_}9)iu#>)w(R0QopjLg%lq1RT>md z4;N`N0k1FY2%l;-oYW+9wG>HPFBY=&v@a44*qv{&)D>T4iN0mFqM`;rA!04Ih}`5% z_scqsW;!-@sSZe+iF{%`>o`#dQ>DRD0t`%e`&RY!1?|<(N1Bn)*_*P9k)5jqti|Xc zsm{`SRjsU3IK39bdWG=*mdA~L(b@t1620t7K_AHYVTXzW_VT27|Gs>5ucK3=iS1=G z_j@e^1A~oimdD=PWD)^Zfq|{DT8{SVb#nLKRy8w*mRC~rL$&H|ZX>nfLI4jJZs(D7 zy^eJLY#^|GtVS(-tQaXagxf?^_(()I2fG6T2(O7=8C|%aL3gif{DqkZ(Wnpc&Z@W8 z8_xukL~rqXu4cVx5l_<{=HWS&j_rE$3#f*>@*ld@+qj6%Ufvb0>DBv@i(ys}6KC!p z)`88bztDKVWBl-AzaWWP6>cf%qlaC8Wa2WkKO-iIqZB~0jY{H#hI-c(F0PxA^hBMa zn3kv1#o*IjK9nm0Bt|d`a&<0%8lQe=1(jw>`jFcKC9RYK0mJE5Vgs*gzNJ-|l6e@a zl!}%d?6xlYHrQXvQHtB;s0LiAo!L+EH|(x`swv((YFBP4aN$+Yc=!>nebbWRyaU3F z4`5(e;dViM+ja?Osam%E>lo8i)1a$`u7INjN-)ivfc693$C5#ZbIDa-FqthxbaPvi zcm2Y9b4UinAL8Y3WV0~gBgTn@rnc#tR9}dmr}vTrV9B@10SrH4+6}+om#t6crSvH7 zW9$f=x5yG9QCM)~Rb@fX*uq8ENy~n~7mWnRRzz`-(VW!pk@az}-5RKw;5_eu6Q3#N zkDZ{jOrN*n#|dexvDa5C@NU`(!r{%2Jr~($Z3HEz=Muw{6l*s;;rubj*WF>RL9;Gf zHH;*S#zmWHgIak3rhEyE>T82qAPLd@DcP0|6wPdGS~(T}i$`N(I!)W6ksOf=O-7(z zcEuDn!J*Y7+yQc-=DWe(F(NbZ_geco#f+g zplTrlCxz2}e671>3h;C@fd#41ay8r5n~f9B!@Ik33pe8~)5ewrs#pEgKX%Rrsz2GC zsFvP5*vRVIV@kT9BkE`g$i^u=-X}zC&FY_W>DI3Cfn<&uNb7X?=wAex-L{LmeXAdG zeznP#ML#x2Q zE~q>698m&kg;*|Y(2RZosbKw^`D*VNFjoImnwo?s= zF`;+*C%8h~Fd#v!T}Xdrw_|F!F_72-GhsC12!*bNf44=J;`FuuEQn_TV0 zHllWO>)7i>+w^VwPhiAjQS55mlCC)FLbdvh3AOU7!trTP4XOoXv*)X`p2p1`kSny3 zGnqnK>|*=HBNA&pq91WYTBu=mMbAw=CyY-#rBd`#-;DInJmx3dI}%&C3x)WzMoRQU z<6svkAH+R{?;jHcG}5iIjRFcl!Zx$9=Pl;D`R0zj=?mSpfU9KPY zULpGh{ZmCRBc4bFr7mUN?`@iC>jvOl?_zI|@-G$HtAFryGd8;(Y;p5k(Da8?ATG)| z?KU5($7!4S@BfM}Q8$J=3Z~c^tN&K=X9A_B2^F#4BDTify=->=B38CvU_Nn7%lqd) zJp)XHJ!ubnDxNFEWBA#*RK$p;K_Irc#Y4FZrTgOpuhshWH8-1qGn8W9#;nLg@7T1-0llz*?-U* zEd7r0FHMQ&bi~TXKmWPg^8!HQKeyU10jGW~8XIxS<(YPz&r}O!(0Ov;Y_qh#ZOMzI zaYBt2erj?ulfw$kjgyP(zUAIuH`9J3XdZAl zqM=4l1T9qZ9Egf#VDjmT3@_~;7BV+&#R{Mk>5d8iC>J_3bUl9#q|Z-2PJ+5`wHJ-Q zVj+HjY_+#e0u_Y9q2`@K!oEL9^Cj{IU26L6l@+*X2erK!qCY#V(Z3zMCKnJkADsv- z;XWTta};*Q{qX32t!~5-)H?WOHLxBH|L~Qzwf&OTD3x&nf&lBsCsL)Bv+g$nfyL&Y zG9g{Xtx-7%4}|8)#*Ui3#APF(xjW#ho~&IlCmFIb!m6QWi`Aox_S|P&ziLtwo9nOq z@fTs)era{=|N8b^7jE+jN+}o63gXjrQ$w$cX%Ri?d$PmrFaTLDP}naX_79vdo8Cqo z{}Dm}8-od}$wh-&>rowxALDA@d`%><^@v^!0ue8@+(6qhJZ!4(l(^Ban{b+qPXbnb zuIKrfsIXiCj(O2l=Y|wOy%+hD2t5~NUn_oEj?ANx$`I543_*O*uGyG5A_3nG00S(? zUv>|EmrR@PUVr#HKniM9Ha-G9Hw5vf;b_yU4>O3dE?jqfx@bXamcvRoetP7DpmxpJ z$x*wQA5|P)UU5&12{G$&GjdlLC65*m{xvXr@GR(f9z(SRIelS@k4u1y&0qTrkBuWN zG^+1!xEu?bye#9#b;sZ2%M_%jyA9{}2z&(bvord^wAAPc{m<`vbnmjU-P24|O3!D` z;b(vPxhDs`Z?E+N21AZSmQ-l#B6PN^2Y1CaB>tHARkn<~Y#VND1#P!bkEZ2boioQX z!H?lQzj|G+WMMJRalNC5{_mid+_kG;F5IuSV9PG-oeio|69x5(Fae35od|t=+{Q;M z$z*%|l!3!6!6Fpfmr4u??^Wx<%7(oEu5xDf#vlHkn2aS0K#zhB59Yq3&t8I62Wx4~ zK4qxOC-s_D)NV}pqFSr{v*mgDl6wpkX=}?0o@nu63AUWzhxmBmTxh%t({2)PZY_P& z9CNTEZ|OOkL00(b^U1o>Zu~Qszz=FCCdTks4VI@YGno%pSTWpqo@Wf#ku$r&H3n4b zng)z0lBe9x8#XQZWz^;jHk_A_@Rs0^Or+Vj?=Q%UcRosFUX#(QG4b@g7`h?Hp_Ixc@J}rXJ=OX*KS&M{Y|cHq}&+i ziM@A=FDePJnCD^l2%i1eegqvaGvIeyk~{0w2n2Q7gap>VU&rwne;;aORLxWL+BtJD z(_1*!TY~w*B5Wh4OoWLd3h2bm#3 zgnprPGSVbPT#k$HB8*Un^T`|K0==DrCs!`&H&(UFi27MZsh}0j{T-O+Aik6sf+L1^ z0mYkct~nJDu<^!*5e~6z+N8r<{NGJ=F>$l_>r#vr-j+WJN$a&0B?LRV^nUeC_xi0N znKTy{#?SNG)?+e@d+yGgfU2Bi;_T52{#;XOLs+SCe>)fmbilL^#OB(_=I4}G3 z8RH8>L&Fy-`T<2_SB^W1#qd7fk!-7~PqYI2n2LAYctlboYQjbIpP$EWr-8MYX|2^; zGR$7md?IGRTV$~sHp3r%90aq|eThE$rQ=}2$)gi8#~&&sL$>#i4X%r*Rw2@=$y`MD zw?W96Xjto@q^YU7^roM;?eY)l!L9n4-T)L9&aFV`yneSfDEA(o4k)BWd{ng_^b0RA zJk&XF9}GOM#_cxr?bd3#7_D}i5%NJ67nTKa8qJ$H!JVaTC$i5CewFxtzq!6B4}|;0 zOE>tUkeyH8?Ej)Df2jSd@%7ZVRMT~ zZ5__hX0aA;KfFioumMWVt)O z_tLGcKF}=RP;ldV%Pi-zx8_PEBzcV-aM9F|q=_d7le(rSHpYd!d(A{6O5i*~6Pm+xd`>ihqgEH|C4mPw0< zb&R&94CP~d_efx}n)5##Am1@-+OC@+wMaAi;*RkI;f;Vn)h)Po;gI^G!tg39ONgRV ziQpgAUl31^!jZw~F-ln+8~AXh=_}qTIHYnn@VkiDoc9@|4cgi6ahZ8Sg1Aij^VKAG z*ZbmP;UCO^(*v;|Jll5a(TRMout|H+`-S^aYJ{}8OYcI z&f2U8SvSiy4R0=;?Psq_-Ya(c=VHG|#+A=<6S&=t@YMf1q#<{sUMYV#@Jq`e?S`2+ z#<#DMpS4~c8#zv-PgLj+DYL?vXT}iZXF4>2-f(s|xL=T|^}a~c{$&(2@O#wAfa%z~-qP&QS(ZX9?dNhoALVt?7Ftrb<+d3@VAg z6AXzvoKGE0qmldSD95ij;&X(FoqWWk>a z@8+lE9|eibKq(mqFq(CRp#noGIOG0fwbv0c;P-oDb~AFY7_aL+NeQ$zix)%NfBYT{ zJ_v+xil)DVrr;1%{B5RQ^}TD1e4yo-yop(KdrlY!!8 z=9Ug~Q8)Fo_pb{t80jp?LXMZ8w82 z`RFHCFpjy5IBqTn50=#${NmH|@X$_L)cXqYg3cTvhkxLW-y`W5NOD*rFdkGx$iTgg z9eRE@3aU_$l4Jbub!Eco#W`KwIy%O+GA)gNBWTeXl`O~UJ(KgR!G8;;!mRH5>$}I2 zF|iopzDg%VatxE(97XO&KbY$;< z@WN{+HgIPJ?S|-!D@}Qj@CKc3Lyq|}=uY`ed?GIp+td zGz>4*Hn+TZnS0_ILC1mZ5pf*7&ya)7_NrolH)y~uRW&jh8_0+^yiGTrbPR9kbI3y8 zf}4!Da~9;`j$?Kp9h~t2s|P<3*s7M^WbAghi0x|!oGr8ejuGvjW8B%EtzDa~T5B%s ztOCk>VFg_@O%-=9J*3c#vF$-ZgQ|?Z4+X2H!{R%q|tWHa)@*R1~G!4xgf}| zHq3d%tnhLC_t6DQ@u!)=qJ7_fmCH`?+4|-|qjnF|N38ofZ!*I$8=uj?L}wPhd67Z% zo$ux6mofO@ZLGA&sTGTrs+4MXrAZL}pYvYH;hd6(g*sDc8s|1`r&UjoD8Be4V5`1V zZrb9@46M`7#mJ>8rxPMr;LXMS5t1-Hwk95LR~V>wU34$DUF*rW?=E#^9YP;ungBB{+0xSZ+K#>4cK%x8wwA zp}CzmbG1kc+1p@sx7s!J8rewt`0zB>t9Pu(%nS*eFr+f|!faZ#cz;O$O#EQXbn5Kd z{|xzg>|kJ=cV#kHR_5ccdl>#CMd0&|wS&$qw#FV+Pg@T-iro|f%&zRLcmU)yG{il# z8vVj%Rs2 zK4~*-5sVK>CWeMo)bz@|E&xkjFEJ1O1?(2Hn^eVyq)4|itLJ3FNG6~usO>olX@mLv zDRFSHCWbobSA?uqb(ei?4LW^wcAXm;`!2zp{!WM;fC+g{vp3Wdw~<9ZC9SQ(ziav3 z9IN5j2Ky}icq$V*&&2haSn(lPZiI|rfl$iduZ|NHlX5rxX4hK2N9!b?-rzhH0YBhJ zRcDd`hC`;?+aB))1DSw}F@46uEC;<{xw~lC59Na+TtEL&dO{o}4$gl?`}v&=GHKX| zxXkx7fq!Aw-D~#6U9bTRmsX1E1)>fDxce9zOiRY^pISO^7JPDkM;>A}A5ed^J}0Kf zNA~&&#)q#Lb8Q$=RhHe#aa4k#e6i%%axm%gdjxWXbalTPc-!t58wf0sEJ|X~oAaYR z=um_6RLRi$ViYOezN=zndm@vf6=)z%{aKjhTTOU8-{7^?c5P~I0>xB#4 zZN-z>I2shloAdKm=*ZO0wVF(4dSyhBGLMDw6Jhw1K9umS*_v$_aky%~OVl%Eo4sAl zIzVqO6kuYZkl*7#U zgLT7t!at&Q_$+$}sT+e-ZX+A{H_LItePjA&POdfK_t0)I90Z-Y4p0+%kuE90<*j#q zfHRSn)<)+Fcg%P=8!D}e^CHh{rdiz)ZM&@qF)hh^XQ$iA7kIo^i0*6svkT*8>(}1&oh-+2P+{SN(ELjU2w0Po>&D$E-wo* za}K4=JHm0a^z>}vJO%_OddlnPGa@x9(b3OX|NayGT{FdXMS(lSMAfV+4>(N&T1XDI z|4j?`Q1L{5+BCXJf2xc@cl;}iLR)o=VEDs|N zk;Mm13s>sMeawzn$R7r(f8A8fz06C$jWp=Bgk>i^I4VpfG9%&_81sQM57tNBUMuHp z&QkIaKUZ!KIDt6?OLxmfi-qK^4dnNwnHfGL47hH90iV0`Jcp@%S4?yNH?%iABp5S)mSeW^_fjb5=Gp-qy=7T6uO_w*_8(593i!4t`07@eU4AEZLfOy7IR>w1EtN zW$>WCgNALV0zk}3JIs+^no7H~qAhXR;CDYwecK+67Hh{gf!0-7$nDaVF z!Cn#2iodMTafFByN1^?Dfh>ZBN{O%B;e8^RH4MQbg=!qGop$KZwMoXzY0Nx~M#4w2 zglT`jF@1Gekn{nlwle3vFaW>PLQm|5Zds_BDA0P=^=|1$uB^4$_B2TX_6frsv}9nZ z&hB2(1n9#|U{g%tdoRtEau$PQg z$uuT0>A${C=N{T#aKZDKFwwum`j8(NqxEc!+MvoJqRgmXz4den?+jU5IjKnz(Ya^| z$LLbesC_P<-h;9$mZvAWg&Fs_CfY>JbE>+k32pM<8+=OXFe z;Zs?~cof1ctcozeU6iJ`L`T4wzFEi2IUU+0CMCtH4WZrM*Lm#A<9fyfNe3b@#Ic9T zhdLwV){J3t!5N)jz|sH(p!wHG)57`{yixsAcG!H_gl;_dlvv~juxUhI1QN}mCT18- zl36k!(PFo+gDah5twMrgzK1G`nKY_l3ns(I0ZV9S1r9bKG>;PCCIz^g&E_`5w|H7W z`j5y0*U4(=T1|siEDyDP1x^FEUrOuq&5n0lveQgmueOE+v%I`Kxxd-}s6l|v88&)u zJ}CZ($C|;rFlnoUi4hj5d&V8|u>J_scdaoLGw8smz}}AO zM?S%3x&2>q;q5+%X#eB%?XAM>cWhPhShr8D0GDk-P~a3Z&2#D2gVb_e3#xr1&9_?dkQAuI$O6|vyI&ybJPZoNeHL(Hz9sEdG| z>{xX8GN$^gAp(y=88pI@aqWPrzU25$9U;X8TBq7u-D(vOm!!k7rLw4^Yu@I)(9vRT zMNsTYuYNNqbu%ma42nXI=`{hK-3yTXi%i(P;Z^WiHtwO8^OBx8;c4`_bXx^sTJcD* ziuVK|c)a%w>ft+QgF)|%U1fyy)^C{vy%gA(K_XiPu+&Si>a%4z&fDX^#r0cuEA}T5 z7HkIJixEQWY_LP{R?gcp!r5PK18G1l$_do|BmuXmq4NrOq(IBF@~vX8_^)eGK6nqf zzV4Jm18D_pRP!{xHEnYoa#jY1K74)dVe~~CZ&W$wBJBlbxc%#Yjz3F!rjF5ZV%jDf=xU*II3CnOljtTl*9vcyUfe#1gZTS8W1^trmRZ12;`58+ zJE7qGa(KZtMGX*S$ zV-|JT$L|7g?k~k`v)+B|`#{fgR-uAHBaQjp)ID9}dtl-|?s-A{XfNp84Sc^r3xVnE zzXg;-f3DGh>NE8%&R`R-56P^UokaJQ=pute82>)yd3FcAiWy+zYi*6c#6wAU1eN-0 z{@%a+$3?^-GT_vXg8Hs9ak&5+XLQUlVJ>O`+Udclw#KbG8-YFYNO%L=vn2W3;o2t` zJ>RW-2gJNQVheU?;Thh@tdjb8r(OW}YWQ=VbfGDj26Rh(6e6BKx!oF444wu#t5xNT zZgNgJQ7;Ta@KCe>U?&wW&U^UiZop37S&m0jf;%cb4}3)2WnI5s_b$!<)B^b3A)zD= zBvI0dcV>jIVn0!z<0R|nAlso)Ko+Ukde3D^_^CH)sMkVgG`#_lFfJfP=+G&iUI61} z0wr()0?dbN0Bkl2XV6U$aGNeA9q^!LoFZNZHcfSj{I0b)3Z+E2);#%2(Hx~5Vh^#TiVJ*JA775Q19Gs zRe=-y^s9tH(_nrSu!+=*o$oqgC>p*YO3txU1s0o4J)<1Ileq)Gb%zNdew|QYsus`x z9`wsgUJemnh7rl}G;zHp#s&uxg%1pvDVc*NLYfQ6uoj6nq2a);U)Z4s$}_cX<338L zSpKOo@f%~4V#)Zcc-6g-JscWQoj@WmC7|y4M6=K7GC%sQjeW)O*kJr-6)n-X^ovp7 znB+KW@*jYc06)LlR#5{$#2fIEAZI}W%-{}&I^$pcrw22HoxM2iytD#$-FRqySd__d zKyo0)BaRB#S9d&%f|4pYNf>sKpDYFUHzvIsU5iIVx5j01Yg~>tdwA&kx5i~VAN>!Z z&ic=|sxJ~L2?GKGayIqAleU8^%USm7z zmtUpjqCLfL|I7niqVE;yKX|b_lYtDD<-_W53%x!p|16kia7WQbXEOn)_p8sG0YY8s&(&cRpCJXcb*2`3iJ`mBip_K4Gt| zN!*Uv+6hz6M`B(d3P9ir{Pp2FfvmOc-}T|o-#{OWL4$jK^C4UehfFyKsI&LQ*1v@) z)0N|>g2Lyu!R+k4D(n8#KjlWk5Kt(x0@6zp)84RZ92)Scc*(0HZG-Qwxvyux^M$OI zlvX5xRBR{?dg5&`q0^Wos-pHTkPu8!BaWg&>&%~ZC;We%RYW#%Pk4J_HlPR@f~zM( zy2VM+n9~5)Gl<_TMYEDB8f5vbr5}uBU+ZKDIu=BGe@|o&x$RuKK1gfp0Vr8k0fGxG z+Bfvt0yUArbr>J8%e~G;H3q>Kr~wt6K98~7!1mw zfgT%w4O4)BNfr`G7bxO($D%?h*^>szaOkm{y&tx z2{_f?+BdGj`8Tam0c$BcLp(Z4R zVpu=xv3vw)@ZAs3Sm?C4s;I`zqB-MI67^cRah z;nI14WW4)6hn`Qji(O+(y5`ku;Gw7QI>+DA20mFHBqB0&5^|&}tiFIk#E{#PB1iJh z_EyU=fq|s$xQ6$Spy!j?CdPl^+PT|ETI`8~R{V~z44 z4@xnrTR2R7%KT=UMo!zcwYWH&Pc+Fp4_7#-53%5lCyKKvM|E@2Q+a0&h>`y2dOO*} z1r2vmoAuB@2v2m3EAfivYA$lc5V~MDEimODQ!O^XrpMKlT7Iv)%XXkaNP<#c8!IC} z67K}T&(TsRscN>cSnobK&+$mymC?9!$rqHvwM(o9D+8SHER>_G3&R)5MAws!p1Oqd zf73c3dc}HZfMV*;{Bg;+mW8V(#p~E6N5;6y@W)z3#~ny*xJ46<)tORRH4{E(>~cvd z@=k=x(Lz0z3H8*I7S2)Khnx;Y-h$~mH+~&PZ7~1pkcK3(*6TI8Qq=vokgy>n{AL)V zbNCCPp{$C9j;(;MC|$Aaw+|5{h}JjRyzet3_&$8leJy;q_a^*}aZ|Ca=&P&W45_Le z9N#fNSfKtKx7N)Q1%9L`Fo_me{%qGRA)WvIhJIV-tn+xVx23VxoVQ(IwuZG}Z3W%K ziyCG3JCfCYwD&1aHt;?Ab!X<3!udlV0fyJ>OjA5Fjv%cKH;%;rNS@ z8Yof>`XSoWCL}gWWdS2(=--Ms5<9shb&;t!*U2s`=t1L>M$m=igw8pfjd#WKvo0C+ zHTKiTMWi47uCl`ybVJtHuo#JdQm9q^9VGsI;w_a#)&?Eqm|=J|izVd3-2ynfh^EQa zFS0LmJT>O3#j3tTE9xSTV_}tMoK5)s3~&DPI~8_>7vIGQljo(~me10}aI#(`TT2m- z<5-tIdKks}YEE3xp(WR;vX_gx{@_mC9d3KT(u;N@l39Ir$nO#Dm7ic^;s~XR_fD$> z0|ojxJ@>okxjF(mDG!FOQsj;?qZL?Ry%Z!+J*`HC6v?-`i^XaMEOFp9P2?w}UfPT| zkw4JVf$Ee3mEh9GVV^k+#uh@C9zE;yc~e+?fX-<^^#_}h^>?Fsecs*bdJ|sg<5!y) zH+nJQqyJ33G_~mC_Es-rWv%6WZ8vz2@oGZi44br~;`E)=wyt-n5XE-vM@5kQ5LxUC zqEXrU5@IT8zk4i zRON>%)Y;7nHi~2oT2IS5YQ3T9=3km>U z6ApZ)Ay>SfM<#Uxt&*=D@t=o0_H5`soXC=8Wc}P5b-SjiNq@X{v$%Ac2`X4~8$7U% zGGrMaKe~j#9(&G3ANo%d#C%V24C3gBi)F->HLg;Jj!{hY@rmQd*wL*_uax5KhCL$K zZS!ywHP%XlgtWj^aOc&6_u>-c?eNKkPSSC|&nej8-N%h8rFM)+mFJ0V9K2J1i_wqj z^1`}I-1Yr#G_=8K&x}Wp?x^|T9sGSBicY8kvM0xlkN%BN%ghsH{`epc1=dx!*Udiw zK$pUuB@>+_ox+Bp>*dHP)UP7F`?r#TIwp3DZW!xpl__ZTGweqRb$MI{&mD1zw zeC?cfeqGYNj`1$QDh(E@-}0qHK+gOaC8bF526c1o(s zj#{x_d&!C7MF@wEo>KWSRAv!WqHraR?_gX(OLKG18d)N>z=}EHq4kjcc}&&NuBIdQmCaH+XstqZGom-NcCF@&#Y`5_M(AC0@~BS6{u$nN4F7vK$ARwpNH z##5Ah3Z&z}cQ}0B6q>7ED@v`hgH*vv_M?=OaP^q0)Ro4>k_Wx4ZsXc5R~7F+<4M?C z+S`zZL3^KE9Zv5vyX056aps+$N8@CXr3Gv?QDFa`7Xt(+!o5ga)H574T6DdRdh$43 zA#vq{+|TtGJqQsBBxo*tcvzSQc8t~|>{ThK8$U38)^C#r{arS7=jyIW?xzFN^H}n2&T_ogWQ4lZarGHfY~)}5o!`jksq}0@n&KmxgLGRGUn=XyTpJ{ z%u z^;tf!ubO^nWn`Ocdbpbb9BU-S5H1)Q&LeClJpx#q{Q70*-$rwPJ}_d8;gCG#t0j?Z|r7!{_?^th0EAsMWPw=RQw&E{#AgC0qaTEvG{_$I^ zH;@wJ(^1HTcikYMjyy?{t~-lnU|@pJQ9jrpRJ3%aaZ(#TXNJ=|Hr{~p%^TL}C{6hD zB02lLUrproh#VK^uT|?uje1Y6oe#&9rBOg!X*Kwy=p_r>I;h@ES0!k;L6%;!0()65`4O2cMJ#@dNq* zEWSQUA{+edpHDo()b(HR!te(h{5-!~4`Z7X7Q53qjl(AEEq(4kd>5vbOIYr0+xgiG}b-ZTs)4!gh!5?6- z>fegRSj_Xf0z(8jq7(kc1W&O32=LLwH25Ox`h4Sm_6xoLBaox-VJneB{pH9a^kIr#IvL1npO55Sb}{UcE=ft;Xm74{7|0Lh&WoH4AMNFQknl$ z-6PW>ND^ZG7zl&9D$E6dDr+!59GBU+X0KNXz@{uo7`TF?7)ixAJ8Gu^f8qUv6u4EO zd3{}ONAqyk=yH~3wh^cSs+Cy{9?_r`p**j&%u+05*cvaQ^=I`n!?D-=QgNimxSo+p zGQ1%Dv5}*r^cJ3$lkXChKE=t+EjlHClvvKN`R*-DFW0%fgw@QV|DC_aF}L{&0)@vL z%f3RX8v&;nuemI@@5mqQO0iEQ8bWX*Wc4^F*xgD~%q|1g0kymSoU0RF8zZ%k)TLPQ z{Y8&*K8IzoQ6jPY@SIG!5;M*z!|@P*yt28W!e~zYx)XIU)cJS$ugA4~Up8WZ9u0#z ztS?tbsm2AgxY^wnaT|;4V?kQ$sHcHnA^y=7Jy8w^r2S>tuSd!kA4Ulo96tqf?>=9T zgx!IsB3e@nk~+;ksfOA&AFADp)Ue1`$KbM9WOP6)qbZ>71yw0-Z6Xr><0-vSPht<& z_kvdjun!xG9cFrDq0Y*Q6dvjf5+n@ig;*RZe>XUou1r4@J2WI^9iM(&gkX<9UTZAD zAV>PcCrjsZ`At>|lhEh+n}D`c-t~MV<)n6w9+myrv#&3d# z<e9Gml2&5+DS0pBU zaADN-4jDR1YSoR+6D+rG0e>};_;Te5=r!X)^qdn;4Q>0Et{5+Nj zwu^}29tws1B|9>c*Rt>$R919SIJj5)`o1cV=)rtyp~C~1`$^=o-Q8v?d0;AV<5dkU zxhhG>IcX+5@#mg9I;!LZ+PkxXBJ&v!In|6aGZkQ-K`~yK|IImea>CIa2JCGkjHDT( z?(@o2ik5Aq;OHU2)7K%9-Sv>K2qIa4+qdd;Cu_=A@Z@_k7ViC}sdz!MNC^vT67z!c z6zSDMgcugJqi0n*v9Uh3yxm_)MI(CEz3P%qxle7uO?kh%xXX|Q>QGqrwIBNZ@)gZlZ8MC38Ad)Cp!su zS@WT4XPRBEh((-`<6lh#IzpeXT-SZ$~No1k`+gZP(qPZ+H9`oSOQvfW-eNHxi zcMW=KPwHfz-k*P$$+CaFjNV?pp(4re(e5v&=|pZ83dxb!a9^P(MRi9Z zr$?$+mdx6kY1SxS{s~$V@^YRrT>{zB!HVv!=1H_7s-d=M8K?bB=ZF$ec1AAL0gxS4 zXPO8uGfQ*zxG+nn=G&OFzB+F54$86SMIIg>4Y>x_zGl)nOxrjPXBu8POjhbas6DK- z9cNyqll6vwuvBf(kMPZn5Z}BIw{#@9nZC^ZdBleXa>$R~mKVL+n(b`kIHn^Bvj&r0 zWjRiB{o%h)F%yo50%7Y#Wh{4hK}6pXdtbZLN_TW$(0Q?Od7mt_5?aZ6yuBIxjfbFM zL|t#V798kS*Oj7L8+69$Jk;jD)f0*S6$Dsc3>cs<^AQ2YJDh(rf%#`=EP``Y-*o+$ zAL8PDT-^lf4bejvBIVfZ7INhsbkm#;Cwvbw8WL_a`^kjYbhJ+wSha6-o6djQ{!Nxv z{|<~IRFB5SHUnZ|{AYa;m?RO}zDg{3Axi>2z9ru7hawlJ1j7lGst)F&F7J{enB5z5zaIqkBdB0JjQ6N17cPLM$coZ$7&25Pw9 z*Su)>V7U$tAmR8`KVCYJtev*@+1ZD8!HRc{o1ajlaWAQ;3eV+I@x9XNyC$$OT_Y2| z)0bVG7aW`$6qy_tjdQhFTL_&iZxJ$FWce_$3$idYTeq>SV$F~<~yms z^SP6k8Kp`|7^v?Lq!Xdga9N#o?i9B-9*vuxoV_pGBS2%-Q1ObD(S-5U0WUUgZ$gok zkii`ppUbgZSNLR<@rt)FZ8VIBegjrlEcc9zo_lI1;&)FPqr|hOOAe-GKgsxIm(V{T zRr?zt&7eR}m6ALNJDrE_d0XVv{?-6U3I`A0q!m3`kXcwe6_{yXE#u&%W4zX7%#Kg> z=jpQ&S%|l@?EiK)y(qkQoL4&yoy>+eK5Ym(67XDw->>t^3ACms8mus08Qk7yo`@}9 z(#DX{@f<|Mnoe9&`O>NydRZPb|DQ0z17;Zz+yNW|OuQ#Wa~N)|{{fOLna15Ei=Cd7 z5mO>&gaSgMlDN#skYJl*EPNeCIh0FZ-hV1+DtTJ{kk@}neBvQf+)q|+pQVI!_zwl$ zKU+EusqW}2<9pt?6C|`^R?t0nSo~OubDFPkWX=qHXy2IGk38Yf6wGw&O#i|<6`{KE zHtQH+^}W!1VT$DV=krpfR#eyH{6}-X;t8(v71Dv(ZBKlWbRkPCFE>6&FpSO%u!?3- zqsYO-lOW+@+f&MYG|4B?mzk0RZ^XWye??Ugs5;Y|mw037hg>ccPBAQY1bj*B(Z7IV zY_=?5lp0WSsVq_t2=Zs{d7Xb7Wy=gm|2bSGIBiDCM{9aINgV7@*R)(bX*2I>_iXhn z|J1d6ozCxgZE_3WoUdVomR*I#I6=ShKCUsqNSIG-!3!CSMPD2m7Lm5d8nz?o zc9}Y>?RF=BI85($r^X2$xle*{x(Esq0iH? zsK|wXw_R%avFczx?}1L&W!BNSVESkf1!_Us1(FuC34G^(z;4H$Z189Fq-}w4ZRBCp zA?zstGc3O4zkiV;AIZ%N=-k0%CU0O&eTH|3xUfjaEO`3c!?PGkPk=vBvd#5U=4#aK zlc>M>uBRtb{T9oU9EXDK0tsZ=(5sB(UgZ{M$xw`8P9Cxo(|;{r6A38Frfbm0a-jryNdnc`;ZPrMUtaip~jlItGCnpVbHE4k#XKNUgI*5 z&qBeW-4MIPmPo_Oq zE0LtO*Qi4fWB`pR=eo!v&F^Z^UAS4};(#$%Li$$8fjw%Z-gwoB<_SpJ5uh2KE0tWr zJR}1OVid3Oi`GOjv5w6D(zp`*$;%f;{NQb1z!tQyjN#>tLQrM&rq|MQ2nR+)@twy! zm(YdCP|mX$efJDmmx+Vc`=J!`43>L|wg7g0Ja#YjEi(<`YS;5{uf2BXDrWqpr!ZuV zk~XCF&S&Dh#2J&kg-W)($2cY4`>P(qTwQAAE3}_dJ9hQGPZGxd;KkLYeJ;TKz^(bp zncSq-yN6NE(B^37n6Ey11E!=*4k5Iiy^tsgA(65E<7G%GdA+!FEWE5bm~@iV^J4fV z&YoDpvK>88@^l_V`;=&HZk@V#iXVf5{txstedz42*EKxrK_k!8f#6(wzcgrx+!?9! z>MXN1@OTMmgCfM^%ZdurR;rj5~ zI*A9JEQy;-)~R)?0L#4&Z>F_aRbrTx=R&d#-qjYHcgqPoOgC6nV8)N0e7Z-x`>$PI zVS6^gG3_HSajL4pCr+M}2UAP|f1(DRiS|$Rm(agqb|_4_|NToT#Up_%5&K8b{v66@ z(TX}s2wf*p*41}O?d77>QG-$^Cx9;uxD+Gob3jv@hgDEcpwiY-BIyreLj-gAB|TF1 zj>>siwd(EW!nvUJ8R zVSV`?KcIOoZY$vNDj)g(ooR;neP2!pj!kLD8(*Hk6CzmV__irUmWkioH-MHVK`@>5 zAN$2^Ba!SU>P_ddKI8+>++f&>hNb*M`?U?@a6`k-EO!1;| z0x@uN=BMI?zEV%&McSw*xvMWZ#cG4Etv~mxo|H*!JJZsDu6rx;owopW1X9M21M%sX zE=ea)Mle9@xgZns?VrRmxCf;4yYsr1*4Qatn|Au} z%&*wYuFw!>?5Gv+{w+u4pOYA<`=$P-to-F~qO@wry25n2#Q@nd#ygAMI@hTru zpi8XV1YdtzUlDn+<;2%xU^&=Fi&8pa>TQ-~nmN*S$SRV~0Kvnd1+#-=7=qMr5ii!U zUsPd*zhl~kjr2s4f``& z-T}-4%yZZu+Fb2@=o&Hw0NF@MI3Zi)^MY}gvZje48p2Tg&!Ha?Sv5zR$O!|EAta7g zXTk@CB3lC!%Zt3SXW1ddIb?#p`p*aO6&6U+!wus^d2Gc3LA<}m5 z2mNbKZvq~R5I!El2Efz?#a}lC#@mEIk5_Rf7yvQrf@CI!=6(*55Qbj<9Au1~y;er& z5H>OLeu7)eq~%Q1mY^bGvK7+stu?$-Rey=4f8hO-1s^SL^4!6hhS+x>w2m2NRY`k#f!0EExY#dI2%ghM~U z5<>iR<_FCKv5^WIcJ)duM3n`P7P0_8$I}@Y`__!!!%jhZ6+HEI?hRi!4&)=RYr`N8 zG7+%5v+(=k;Q?EJ-_7X%3xN}Ux+l&E@&>6Z4uV!!4-9^+&~W;g*?_))cXs+s9KPPE z2A$H%lgcD;tB8$hkVa`KTHjep($99fV#5R&Dfk|WZRAIJE5qUbqTvIQ(MTeIyJ8%- z_ixolCSwY7`EUwBX>)d&c?<6N1@Iq@=!V^J7Ra~KlT-&}uca>kx zeFu}K-_3`i2I1}HeCdxc$@1!j=jPR{Er#wlqCt7JNA^77CdC~_-Qj@|8sKL`#@?7i z$+y3g0Md`~V_^krFi+VsV}#H}@}_g`Ei zm_Thk|?czt(dhJpg1(g!G5PQE;Z`0k(-R z^t$-J0umQor($1dTpz^It7OMJE&FvBtsZmugy7SE{T%i?`x<=K}C>I!q*vZpr zUpivn90@=djhOy;-2w74>!EYPHKLC!HGdj@n_B;42U!DW*PxbMO7<Wws+L{Z1#p&F^7N9RODmJ#m>E)BfLQ(i;( zn#XY9e?pS~)oRGsK7jyFZB|EuK_deNr;_AOsi5?13TmFtkNQ6?@TbCz%iI~RbuWYp zFRPqiz^g(S8@P9{^sE{#3d!6Gqi|5Ca#QhW#@Es zsM^6Ef1wPkzhdFfg2{#I)M;uA=NIzS0`m^iYVObl8IdGAVzE6-lr>rNP5zXMOq z@fv;#;B@Jf5q=)ar{p|cjFs+XYW*DN#Rvay3^BOPI0iftY2)1Q34pYK zZhpmJ{(I`ln>omp%+kO1jVJ%m0eUpBoM>)U+GhquT=qNS1@FwZ=s68iQ8_JAqH0N0 z^4#9MP>`6`G*a_7e;4mnjo4~qScP4}#6kkaxPh$V_ z47~rRk8OH_%-9(1{MqnJ;L<4#gXZ~XP((ZrEO{4d>ZuTG=s2DYQx@CS0IfDQc-B$j zs7JS^*5~%u5=(Q($F4(S)Ro=d{`1SF6?W?k8a6WU`_7)Uzk#as>VP4TqV@_WuO~pe z<-j-|f?&iXKT^^QfEB;87QP;NWRKY^6BJ{@9+sQ7C3NN)yqiROrk^K|;(rhU z_`1O27O-4o8w2SWiM^UAlk}xTeY!Z7)K1O#X2||bO?>ydwdDf&epgBk3?w)DycO)Q zE6Sf5AUdSq;xrN7_dWSM+U;*qrP7%FLMD=1&j=pg6m{v4{9n{7t5V2OZv@h2R<*1j z_9_M&F(a2MJg~wZV)ns|{55N|(6J0zlb_)kh)V`rwLv5)$^s}aLJEG=Yh?!f>R#LF zjP=n^+&39U81sQe=e*n@P5F+F&*W&M_Gw=EE^F|mQej#2M=Il#ljgHk}+HW8Efr-QwD&|0R$VacvLURo8FN8YOOXheq=VQWu2vdT^ zAXYdJjJ;38dCF-xmiHeU()l`tss%zz^86J5d2x#2xNbB2PQs%z+okB4B`k`1Beei*L8I5yD>nci^Vbz#F4o zKs;Mt8L9icKEf;^Rvq=d42Dc}tRbvwr7J1i#X4fq^|!VA zVQL3hY~u6fV}U7E-C?+N$>K|n?U{yY@Um%isO4H<`Bx#WNKW%^ruog z0uL{ciZcZGq*~11wQI;ad(DM8uufyN_gjG>Wut*`qfzBTj@@Gdb#1i>ftC?pVF&Z^ zc-2_^Vi-G3pr8QYH;8fzJFR8rJ*4S34wJ_rK*rO;5@@&NB<<(3?EcsX{vf4bqL4hg>t0dO1I4*C^&qWrpjgB^JdfYX6;4+K z>K(hU%e*014G{43+?8TSM@K^)@!Qi{??QIhgLYqm3PEu_zHDQO&_d?1{=wT9#v!sf zsTg8k?lwT~e-=CmyYT$_Mue;sIc2=a13-FRM8VkrZj3 zfy3ru`StN6vMKU2ab!M)zZ%|p@8GC1m2B@@j?+!{4tOywYz+HTx5W$py!5dZ0XvEq( ztr*7`fH;<4hrTInrHIJTMQ)Wm`-GBp6JEryKaX!HTI^phNzfhAUAB`!gNdKOxNTWN z$qVDoki#U>5w|TC)S>IOwVRie0FZkQ5o8#mr|oay;e*~{J65j;<4J@j!N z=-RjIlZ3Mh!F}~8375Q48jK|XkPNyW=LBk!lg!7yaa_0{+lpG?ey5v$_%E}O^1!sF z^OX!O;V%kqejIyuF4r!x{69(7AxN_BkCR-4KTt;!Dd+@S!tB>c0}DB$2677IoWrv9 zy;^5#U7u@b4O-}ngwMqR@5~t3bL2B!9TC%$Eil5O-FQFk`}@&r$zNS_Qn&Pl`45Q@ z#A7C-_@5B1G%FcaR!Y?H-m9dPL_=1QAxj>WR*v}xD#Fwg1OB7nhWBxp&+x75OohAg zD+wk%CRG`vPhB~JxE{IlyqS9R(-}=9l&rq}LJ_lP%Z;4yslq*-d4fPM7)~+NbbKD_ zDxDzQ|GW6BQjueQ=Ae^4eGsish`njT2Z8{K?kM)=kmza{AXi zXsE#>yhzv5s+o?{*x2}dNwkPl?jv9?*$AVIdEeP8iZ$N;Dfene7*=|$sPlSFr`gR> zd1NF2rl1mb8(^RIE~)1ZtaQ1J{45l0X%yeyy@UB&QFq9MYz)=ku;g+gAtXiD)-mO+ zUe%Q!cVn+uQq+fkxBM$kQDOA>LPx7}2%T1DV7h{%fIcsI+eSRaSe!ITz%-iz)l-U9 zWbPW+T(90gJ={`k_SFc|rJL$yccP8uIP5`J>j~2pdq!MM;SAe~TqKPjy$!(g$*do@ z`EY;s?S4{`$VO@5&j{q**u$v28WVqeE}j0W$^K$LiLQppP~10CdC@_(M|{#M>Q2o< zRU7s8&3!C{8qjO!0evsl7d7IL#`G;`YWc+Z1RV3SMFJN^;^BQK#gN1Y{rUK!r`B+> z+%TNCjY#dKgZf1#b1T_J3nXYBPpO4HIMEoGX#>#e-4aS zaOg6D0c;y?&cbi}(O~Cz?v>{8TS^wHFp!YUDrHtX%CTSEE+SdoyEsZ7fOYu1uDMF4 zDVIqJOD8>O$C(B#av7m)bhVGrWZwKK)T5SdKcWC5Z(2gAu4<7LIcTX3$%5N6Q9fcG z(zn4P{P*YMXpt2%wlu&+k__^sAarG0>Hu4GP}qfM#D)Q_t$hUjru2rkcIOp-!3bh- z1JvzIT|O>UuZ@0W0p-DHRWgY+I^H08KP7}dy)JE`LICXLWs=rJ=+wd3E({Ji^K1!7)^#p@yWMykZGG zr88E(R-BI#s185?si%%s;^c&ZAHnITuz!bBFaodjr39UM9O7e)97i){O$d>b`*|?~ z?BH`w%5z{$mVY%1;)D=3MkeK4)UP1{_&lgyj3lTdn4+)5DP4#2UG0J-c%LBF{W}Ww z@W1~&chs;4{NCyAiXyJglKbS_<-QDD@PVC7FYFJ(2LiUZ25~6*8cT+j38A-P5`2aU z6>zh1{?q@{M~bg->tv`%l9fj0$^e(0i#r31f=>B2XUTWc8L{0ysoPs?ElAm?s!Stfo6?nYi*K3H7?|dUoHuvr_v?vJaeg*rH9`h6|^pr*cGQ`aQoGdqh<(CNGrFGeZb2HcgV=y2B zHh{L8`1fBwK7?|sh>(6g@}}r%E)Z>?34Y-rb*Lj-$8EGtE|Fb0Be<^9){3Zw<9AI> z1RbVdKR=uG%jck`0KLbb#Ulo~?KW2mu(^gee`WFlEYbWRWN89gfrm5%Q*k7YpjWN1 z`SC)$3GM%m1@=Kz+VbqQJF?(O+{kxpgoZQC4wte=;c(k8MjT4@w)XFHX)p(-1e5)y zHC>Alj~j&6xI>NZ4-WsH|C%1O^3r-?)XDP#N!JNdd9Tq1Z7-$+dq~$$kE7Tr55Tf} z3375?IKbWa6}W%_3wOlhNF9Xl(W1g3s3^WdMqY{<`si|m17IcsUelPVvSvJ8h}FkT z2Sk%Xzt)8R^WC?#wEWgX)d9PQT3EFDmQz`cC0>gDC%j2Qc>9M1d+CzwX%Oh;>B9;F ztH%8}fkeYe?2wZxJZd@ntsvw}upB`4@za7b+F;&>#-6znTKM4YN2q4k!Q-^2_==oDatyub&JK=})Gjwuseu}vI zaOn_?FgB09imOt9IcTPd7R(FP0d#=nEz3rGdI)6E!eyLnYHa&FoZ1>b+i`2o^UnuI&`NH}DGsm;e^@kmU)ey~mwI2|V={*h+jkq98oJo!hOX^`&` zxOIe_z{Fc%^A&DLwk9v|wPiK);x2Nh$UVNYX7SUGsQ{ax+#f)N2Ai4yo0@&A2xL=a z&WbqriHfC4sQ5>JoBgx?jc}mJUV%=|o^V9hap4v7ub+mbdMit)t$s*O0AV#>Qh%HL z&fU-S=Wk0v)MP*H+}tBStywxgsl^6&R6Mw?t-LGc&qI?F`yX15Bp+vWIFasAd(gfB z5)9Bi(Asuucyk1D1zuP2{Cp#z_)^mW&Jv)W*NV^c>rf3{~(&;AMDmUedRBz zW1Yr&pX`7oz&gdUQfz@LdE)P1?9sKvy|cZ{%tH>z))DWo-4?jod!xXxc3-vw4rJe! zru7c}X(wl!N+X!7MW$27dbqgPoN z%WuM0m-8@F%Vgr~nPdOIz$B#a^Kdz%=BZMRumhwn5nOjuX}o}|(gH#?F~7`Pqj+pL zr_vw%WSKXT7}=+NXoVA?$}};2A&S7vD{}sqy+_e2>?d+g9gBt*no%9`Wo1Qn2DfMb zX+K;7@WtzO12SXae7i&ZEmi&`&DBTw74JW> z75<}by!F-jJK7nby6kPveqcI0IyzN9I=WX-5=N!?TDq9|mgHb)AFO&ZL@{Qc3qbT= zv0P6aFDhFL&T)4z)tJP-#`S~jITVLhZWtsbELTV8gZ`I?I0%L`gTNN0zJWuxCNCsJ zzLH+CSQ%wcm+*w(d9DmCgvreNSK>6mGE>&&Cvo0>($Mr0k_M|klgJcM9VhDfaim!^ z5e`F3InlRxZV1MhCOF@S;MP0+1M_fDJ_#68w!L~z2M(b=LHR`!srFhwI`XTa6yS{) zzyF`Ga8FPAJrN+iu}^RhUO!FLF9tDZBo_;y;ro4wLc&||9}{9Y|M`1S^pP8$E}EB? zy~q@5j?i8>L<-`G8bp(f$7B_cAnnw@I54(}10s3#sL3VdDv&e%Rr&dTp7;K%CWl_B zCg&o(!7}Sa&fCQ@kfnj|RXCnW7j(6sl8v1`WOVeNS#NH<{an8$A|X`MCWwIurIKgM zq8+u4``0rR>n7fG16Z z=fl+PS5FNmDf>lA}JvIzqKA@x9z!g_ocTU z^5ZMW?=W5!c)Sc3<_YjtjzpaA**{)SToZht_@Mx2_^a6VEQSBJX zbEq$|{=mGOYbPZ7Uw)7lY*&sX40VXeU)n*a#wa25D)rU{Z$HppEb|<{|;v-w)cJglBqq}hpRbLdeAw;(Hy)#c<5kgi3yt!Co*6Sz@M-G zOlaCS314O~37NEG>Bt|Ph^iZ^fdc3lEeyq)CfvG{ergDVdVAZ?V&MMs!n;ppKt;q` z3Jb^R1&TKUmomN4UKp6Th5D*|A49;=BH#8T6qr-J8;Yg(C)pbw-E@%8Un)UjoVyYs0{_ zGVcad;z2K>3=z!QUReUa*L2&3e1&gMaDomIoPbQ51hoi<`@(wOk9OY}Wk8tJ->Cl~ zqCnwkg6_#JAr>wfGizrE-r452!#XiZj65N=03ni@o`N%cynY{4F%7R^_jnY986`lg zuZ#I*=+g&(EgOE|h!HHV^~m1gV4l_C<4bV@uBC7odiD-8hYZhfEHbvIy=)TOHEYb4 zG;lCt{~xU{4IOwE*0)kQP5~KzpPIUBXhUSGG)G(-mdghM^@wQ^N{tx z|J(KgNLph}p$v~VSwQBBK`V;$a;_{h1sxZ8UyAGm`novXrwG>1lbAD z-%E|X^Bhn-ZIleps9iw5dZTq?Z&-6xir!z zkD_vWf^!2GF&gX2v_Cb%5CV4%sjiX8g(XMnl!2jCE$j&g=F*W9Y>F7r!j30yl{BAq znUD)UPIqMV&{Kp`AOmW2zxKMzAQS;tBq*Qe$iFiN4h}R#xt*SA|Mfr37+PUwUiV6_ zPKOzgE&3As;V9}eP{NoC@A+&G{hnAI^!XoMI&x-YL>0F;qMAvkb`|@JVshY?Q6KMC znSA66U6%_1e>Vo)!L_9)T3BDeNY(bpf_v)$Y$Xf=h$Q9n@5sS1$>Qd`)lh?42B4zS zmJodOV7dhJ!#-ogA&`lkQ2nQ&^8eGMao!{rLl&g=^lpfHS!TKkZ9Bqt2Th6J$h){O zLT`-ppgndUZ-89i+g{}5ff6CxabMbNE*e01WNi$hZ+k>5JRVt>G4(a|W3FCLlA(3A z>J@+x3=W?HR*|QtGD?8cfP1?;Qb}^WL@9pU!GZH4V%A6%h@=ZdZ zf>I3jzxkdFnDk~}Qx@X|ZNy70`hf0b6%OKQvY@*HmCy%@u}7`vevJgsblMV>IPz^E z2z>hV@(XE*FC4`=49MY0o+d$oGf!fr32n|fsCo}X-4s*G%eC>sGn_(@*QEmeGD{;f zq(o78pRs~H3wHkN+dV`Hi3r^Zt=<;u$ryo?Fw~KvCnEH4#M5oH&$Q>k*r%5fml^}h z>>0i|dyKb6cbYdI=SW&Sc&OMPkeuu>a++XyD6RA9WypiU|FLHQ&f@c4H~gcsP)*u-r`jmde|hJn}A{ zi_`1W4q^T-nQ!#Eb~`j0tGlu^TU;{F-RWu(qPVf0sD8GFr0dUnvXtp$sff_$!!GiH zPBUp`A0ENDWkW>Wg&;BR^sB2;RJ&_rVw}Tb%PJPPu!5i{gsA`26BuO3x*{p#-)waA zY)`Mul?~s%=-~ZsQ~Zr^rvcqUp8j;XheN=-#Poe3KX{FT4Nhg{tIw6c#|exer20T- zMD0yTcr}w`RE;1yJMX4`^kC#i3*y|f2?ssK{hIj{L0dJuO&nLPu&Gfttg=P`! zoPmZ0Gbj*M=-Paw>I4atfKR}uMf@E^=N*8L|7zbcD1%%7jTR>Rz^PlV()9r7)UwhK zhN>$ZyyXzWEK~th{Th1ZDp}A(cPLI}X?K_kIUGbIei+5Sxe{u=Q2U_5c6_CG;#*1Y z^a!;m68Z%JFaDtbq4pouh@8#r-IIA@xbqfHAMf!XG99b1wI_Zhv z8px&*o6^W5Ht9xDzEHbG!3Db8;$MsVpc64svo=(uKOJJb@W!#pVfGu+l4qD64!@=e zJ7~^lDi_`+T7<4N+}<=h&2L34n{;D$N6m8RYRfqAph69=xuDI?>L4GD0!H7XJ8V24 zA%=$h`vg%#RIEzXBsfDBsC*PE-{gXLlr20_t&;~O$hDuvh^!d={}}!Yz}6HDp#hXa zCTl^#4C&$^!bY|*tQ2~6dZ406*Rjvo7W%R#o@HQp7T|%-#%fTqp_!0Z4g4-keUf!po&c2_Hel{w z`%FN1=!nkJHP_X!&6OExR#w`7#LUSXfJ*IYVce5}+gvHDl{_G}vq%=bmIvUA4F2kp z!b~7)B}=c$arOFH5s0yTrpBjHx?${<9x6ICUs6RmQ!&?7;`docLMuaXTK^MD;?D4OIl9iL`F?(4D zE{O;X>dl1QU#LP(kV`g{LE+V2}#H7?s zKflB(AIW!G80v&s(9By!Y0>W~ss0*20~+!`M%+hcIL*JFo2qgJPy#NXbWp5t$*sK! z%&Gnv^B@J>Gyc?XO`xtzAoC0XhgbOQa#+Qcwsv2cwGNuREDn z9z=AHHWi!M<`{@Q+QTqI;LvWT5vMa?bs%zmORK%(#SyHeXN@?-BcfqpVKOk+oeDpY zclFR&Y_JK&7GM87!t zk?PR>f${=}cewUOt<4vszwXK>W$*Mqu$}$g!WBF(S!7aM*(qa<;(z?dFcY{$5uwsM zs{%r44O*ZwLxehwP+LEwj8LHOA;V~6<0l2}OH7jI8HX$EOo^2%LBtPUiVA^9apIfA zvwu1Dq%4Cq9R2mn02^+=4@G5m=h zf5zx_7!Z<;%nLib>CHJod;g1f-9WV9_g3_0qstEIbugjC2}&?>_97Eu>M5Y)ahq04 zZEmh?&UNzi<$QGI*hzyp*+<3QuW&CJB~tnWXd+Cd)09enH~;tPzaEoTFFgo*N!Nm? zrMEn=A8lK>%CwzAmJmmexI~p;oSKc&oUQAK*I^2vd^~aS*j%3CHEP0EKwpPqZfCXZ z9Sikh=-h}bOR}J4IHRd)l+J+4J1z0&uDww%27Of^nm&OjQMsv%WgB*P*~Cl_cE(GZ)LY9)S+ntp9(0WPT?-l|r_+94v#rux z(zV&D7*m>X40Ehqq|WQ~uv#!`k()}So6!j2Y^c!4*l=xw{Am&>bMgN+NVP2T1kKadYIG(g6G?q1HDB>=)sM*>xU6dMv;5bB zqweqDzrD4yR=;>?5omU;9F8Z23pO%E-@@6}f8xY{7V3rmhhdf6Qng`K7Z=xDgI0E1 zKpd%~rpZlBv!89x;VR=PRJ?k-m<^)|H4tK!(+Mmn`YjFs`& zXfYVgns@~C1OWzhLUY9mcd3oxMjr^z=Gg-nZu$maEpjg7ztA(3DiDy=>N>iXIBX0D@i=u;&Z({)?jqX}Mm134hz zuoP%nSlL=oNU@yLpjYa3@zxg;lepOcfhwVp`)(W21u-0-|3oH=?3m?V*5p{H_!2H@ zdgiuYjJ}bYubsZia#|3`34Vo9P0HRrC?I6sk-YDDQsBPTaLbspGhF}CYwTom?3I;6 zM_oRj@|qSHR;Ykk&QBuC1Tl4Z1jod};wTygdt!yT!#Hq^tC;uz_E#*CZOE{9hX*@a z|IrU(m#w+7F{>KDbuz$nW!gV?{kK63YG{fCp+?k`0qUTd2=S=F`daohs5pv41RLF> z7WhfAj@=F>AL}$%4j=VpHY0 zXd)tvC+-pnWLr@-UYbZXG0v=aj^6Fv23rsz(IWx4o+hV|*D9t5s{~5mo7RuliSJ!Q z*it{wiPDJQ)k4lnR6%;$+H83I=nD?#)yUh?A1vcA0ypo)-R>}?W^a8g|AQ%b^6tC@ z)pXb5#sGgd*U9+Jkmf#}%zy>SxT37hkXenJYH?=-A12v|GL)%*RK9@EH2sxn^JzK14A){%Go4Xup=Vkr!zCL z=;J|7-^J1-TT#}mxH0$d>Kg-nmeCj5VnY)-M7(;H?*=-<8weLZh|I2TuMMZ4Pk8jC zxw$z&7{?TfuoM_ZNCU!eaHprudQ^c z+wim%3!0u(UR9;~KHl@#R$l%yt~C0pb752q$fpKuRcGYn{LGAh6=PA=X3u`}3lC4? zxeJ!1n^&X6B&xq;^`2}H%JUOm2zvKkTSMc7(?Ko&8$ZNk3LIuKn*A@T%?|J8Vkg&W zE8}Ph58HV;&{-=}5}FB*ZwI)q2TM;*uJoFIJbv^DavMLxZM;guSWO1LUl!FQ8=dm9 zK#ir&;ONA~>)Bc$-S;t&3#K*p_68?_vKgg~42$JRIEC>?ai(N`zb$-it66R&_zAHV z^J1x&+VWVztapqNm6IPT{lzmAo8~Wl=KmjK-yM$i8~qX9@(QpDA{Br zL`L?=F0%IskCDjUTUN5iV^^{=A7ra+e&?w^-|P4L<9l7d>uO)u=ktEQ@B7^6KIe5_ z=XJ~shYFDaEuE4iOgu>$96A*P5;S}3Pz-on+OU$=2qkulnxZZ z+JbKc%)_51uOKYMgbPr}n0uLDGlR`sChX2b^SgKO_>dZk--1`GuHj%M->&fu`fZ#@ zwhd!9dFb|yG;};F(IM#Z5X>>_34VYufY?5CMa*KD7j#n<$zK?-DuF{Aa{R1iVZn|G zk$*z`K_iTG98z$cg!+o*vnXx5(wuZM^Z-nFw!8S~QvizLt%fF^I+V`y#D2w69d7#J zI{plxDSLeW9Qd&_zE8l`QbUQS&SMdGUc;Ktyf@UYy-fU_nH~klp zpMBwR-ecda#?#5ke6( zc&R^4_0Ef3R5S|}1;)Ba$)L>+TKasX0Iz1lWxrCwLX9=G82u#^@^Vwb1*f!en-5_S zb)>C2W2_Z|l{45;4EL9N5j#5CT&W<(5|0@dfVyrns1nS0L~py+k-(9$xe?Tg@G`t0 zq;^JNSTK#ooI-lFs#3j;Z7kcpSR*c;BeZ6#ZJm}kzq~h-J2$j{H_tArx1fsk-eL%C znn?$C%6>1u(8a~ZJ#qFWmf+Gy@^62BthdhlmLP@>H)&_u0wPO{CJJF3bGJ8+Q2p(j zac@w@4Y+G9EV;H=Y-KB~y7qPZ%_2t!q{etrA}ReT8uv1ruUnfM?nRF#fYctvZ02NK zuZu7>ka=iymn$brj9(HjI*FIMB2X82@({Co;zGGSS!BSj+?&8B80*U_H!D zkV$_wnin_BGjQ>r$CFV?2TjmcGPXEHl>_PIUb2#LnHyyBBI0a(WL2;1La%$T!)#i! z+g>mQ^zjExiq{L|aXSl0(%$`Tr3ccKhb#HujJ=MZWmjiB3cypR;q%Em+V6i{@o8sq za4^}nNYLJD?ly<**bP|6qooA!y~(w_U-P?fFo@-oC#Kb6jURM(1cJ$jBPgCjzm zb@kTK_m_@8KkE_c>BN%lR$3|CxgFMBcZmI<#rtX4vvAJ)O#>d z(_q2&u4}$R&pr>NogSHs0yfXT3PiCb$TWI0si_G5t?ms)K#FeLnR}O51v;qooA*eh z80i5z^K}cq%qh)d8^142a+{RAASF~~%SZR4#$aiN9`J4Gq*>BT?JffxXJv_T;5B^F)@f z?swy}RA6Bd-+g_?UQP7pbK6LKtLer^c#cru5bABENRSSvvO4=G8M+&H2J(rn83{1; zemn?j2(tzUDGfcO;TpQ(Wo}#q9ZT>L!=@~uX^QtUEE%)_Lu4y*H?qlK$~29 zJUOEdT?O*wiZ^6jui{8Gt70!I#>ts58tzl$|0Kd@Xoi!`cPZnZ5y&A`7=82;@wMrU zWW*dB`7!IgbAP@+of<39Aqkgu-A{@bA70`n2hB~Z^h5!3H3fyBr8m`O^)MjgK7Rt? z&RbcT^!#nuv2VFC#LL}!6?dH}r&MEnhF1{kZ!__)RKGlf=PJ{zkab}@jxA>pAJ50< zEJO+y8Qv;9#ea@F`RS6Rm6cs$Lc*PT=K+Y*1`cpO{X4o+u<{pou)rDpfHUky=?BQ; zAcS|SN6NB|K%JMZ$HhavaX^Xe7FNHys|910A<=5u^WRAxyupI4(zp+15j!x;3M(0b z&tT|AczF^M(@gm@2zG9d8Uzl`9wBH0E)GJu%)hdptQVwirGeje$@do@$-m=AO6DW- z8aP!9kxpO`_4v|o=VPQy){hX%VV4-IBPWd0NWXWxl@<>ELxwWj!PLz6f*3ZH=uVeTJ4bFKNb z$rF_DmO7)DTd+<}*MN@7E-WmJy!g@bUxY4lo8fP=_Y|PM5n#KnOf`I9$&BOF8Uh$! z8AS0EUVL;JD>Hq3$wJt3>!vlJf*H_5`E982M{!dsfOg9I>pbK3ZJo`&XX(zTZ2Zer zhBpVrcp|1j+q=W_VDS0+MD6T7_EGecIbgztP?fLQym@n|9A|ywaI-NLvl(PAsBB=o zmJaH`InRZSnQ|;L<}FoD=0LqY+>{mV#-=;{pxq!kYE&w~8*$NV%RfN<$N@1Z-1I;Q zebwbBA*@2`neDh2W;JKQMkT={PD}z)>)F2sZc@S;NZ9+I?GGxxITe64tLrxo|dpXM;GFl)pW!XXW)ex6`3RCDAowM zD7p1&k1jzNXZ7#i8UEQjZmfJo@_9~M>UYAhCulfK$a0yUO;T6DT`{>!z*$(0to-6e z(fW%Y?f-7u8orz&a_(taV0+vXE={|(K&@F?f*=6o$ukVSyu3cMgiMkq<5$z-48E6V>jy2uT}9`~SJlFS~S*bb9{MU>q16d>4DT-E(=oA-P-BDI>b+ zlrB^3n$fR5TlGFSJgP@v?5?-Z>~{;qEgh6o3HKw$bDDJ zeH%y{3Qiw$xiUqnBV!(GK}YHA?pW%nzb*L3+&FkFn&I*h&Acz(B5 z@?-~!n$+XE+Y&?m{{9()lQw$FwJA)y#zn}vFC!8>A69QD!K7f>Z%p#Szs zj9!8Y^la6jdUcdw^;J*?FMX6*@hkSB%G(7P3nS@a3mPk}CtqKlzw{nvRw~w`D5uA> zRnuy$ZxvP*2nx7@x{{T@Y?o|1roZm782e(^?&P<}Q=ip>z3N$3s;9j;tHuS(+wKtK ztb+ek^0cvnwvqSu5@n!gCL^XCB^qK=xBPzOR%=QXPM!+#uEruN>uahwxwYjetl@E3 zcUgU#U95~*QK~GtVr&M1p%l#19DzO0UuvVI_m%nz*SA0S;}T&FY|tRW0r4ZniPV@F zS(uWLNx`j~`HgP$_gLFCF`_SkO`Tlsa@CT?~CDA9;LWt7w#`vejI(?Rv?%Fr{K>T7~D%0OT1|_ zaa~koIWy+fk|De`W(DH#)SLFry4}`{f4BP$Jhxj zID5&{9&|@X4jZEKs+c(C`&q1c&a3GeN)TJdf>X{4y(k7P)3MUXX(gF`73_OMC3`&}- zilePJhCcSmJ3c|*adhqX&MA1pMxtRQ8{Cs5^@)|z$+G8P>dOPl++EW)Kpdg21KFIl4YWwJiYSK0x=Eb}^WvzT$ zE=`AYpmL6ozDZs6-@emg!NE`UZRhSY@2Dj~&)1siAGhsxIZS5aauJ4Il}v?f{SGcJ zZn#X$YA>Ratem)QBeB1sT=WiRfwX?1t05uxw!rPJf0Q-4@7e3aD*^e$EV8z2=t276 zT~4@-C;VT0Ii(B|aiJHhYGXP*|BBPu&J_4ePFV^1j}e=`VM?x)pW_KuPkL>q0`;q~w}jv)XOM(PxK1at z9EKnQO#CAR6Bc9(lwA1}7D(N~#_vZ8q~*3ds*#|Na*!r^fH6E|eoBE}t@?7$RIkTM z9aUM&bJUKP-0N$N6+_ zKGUdG+J!SRrbX!N-VuU_<7<_5GG9HEz($(9PoE>Op8XA`Dp(@#Bg?jyV*0a-MgL+# zZo$vUnTK)TxN|?csjB@tN7u5(RWpE+$wApt1ZlSI|LAD z+563a>}7*AuAi76RVP>7zwql+A68vIeV6O`b5RJFbOp-k>@3Oi=OfIkv_A3A%<}rJZ>4C zuTfY8@^XRe(o-UPwY_&I@QeXW)tPo?jeDOe5aOMHX@1u~m<9u}1-3#PLdWwrRAC{V z@%T(afKa<%PFhH+VF0&?(iv0!0>H;BT(=&-uZ7RJwM~f_nolIADYjuCge1VOcM;x=XX_tgS9XlGmH`b?E{)VGt z)|PZ@6a?G8Roh+_vKYcKN68<&qvHXiM}&NV2u8(YNyrce61*p2zAf^Br0|A}k<#FP z`@X$Cw~N{#yZVPgTxx2Xmp(psW7$>F&IGx>Hn_P8&LkWo~+Xl8H93a-9o%x%NlV3Kxq)o1d92J*x5kkIm(6V zqTd-joCrv+=K1$m%lnsn&(rf=DH}lPp=U3g^PS9Z2m1>@rTI3Ce4S(VDf}bfMa`!Q z-{%%s=C?#W2FFMXQ9A!~jAx{gpRU21b&7&p?~>&M+5B%crL(l<5EBIl8|r^# zcxwAH%}Z;u+cY6(~Kkq4dU1=RVf3o12}QLC&d($E;gr#qONm@?R`14Ve{BPL%H> zhIA5mkD!;wFkf&8I7V{sAO#CPHJV4Gp9#wPt>qnrZ6pziJ_vC@F{vLDtLiUp;*`!1`SKzwij_4(9B%yt)l{uNNt3ysIYk7d_#}XtQSwg84o>LbvpHy^)!o=Dn2? zzMh|BDONj2h!jY`mYtZriY0Mt;RCsB+ZheZ>dcrr@AYY;CB!D|4E9x~LL#}wA>N}- zg@ZP+d-Tj~{_MJ2Roe-AhVIKOTaO|3d8M6@kU(kh+6eJCOnCxHZiv;>87jP2ug|n1 z4z;m`cPR+H&jv2FxWM8xGGFXH)2ZN#k4vZ^1-nx}Yyt@^h>&Z} zNC8Z~3^ksM#R4U?f9@BCGFTV+n-$Lqaav?SZpf(sqfiXtrQp;m)NGuV1{lSBN1KPv z(j*Lo@7j>3ezrMM65U^2rv7!%K%O?V-?VIUYw-iGm<-xU>|uSs_4)Angw#Yye--P= zq0$tOX}yi2^wQJuFEw}Qs!zkd4D`MTco0^<5`OrzZYJT!%^|1bJ44xNr?1u1V#1h@ zpF2coq~(?=o26-Oc<*lUeXIU;HRD47TKu+<-tV7z&wi3I!57MPYUQ5lMds#)d&IF1 zja@yDz(=sBpoj1E83CXj_1g=H$x$&>GH4r5lz|I%*NfpN-oNC|f*6{0Ae@A%!gnID z$j`KC0DZdyq}7_7jkLdTJafr=^PGtLR%r7SuNi4tLW|b%L-&X8h67wbSI2~t1}TN4 z9n$=w7mTM67x8s}I1Xa zI{xH`X^n1!yH&hqgGII+6l^OgLJyGQuazJr)#_+6itJlrHe`7p;Stw2mN-@#6%!eA zeyoO)o!SvQr3tYDKJ7Ohr!y4il5uLGez*Ke;I`>4 zD=J9>I0|ri@U7`z3i4REqVv>NN<~KH!l!w8l?$@5tJeDEW<=cjH3Lt5R%)MjkbMT6 z21F(>=issW3>n_5P;iyqSbAko@VBHtdsJEs2b{Y|OI4P$Vr&yh883oOX2x@w+#v+5 zl38hJ3+4OVap~^BF2!5yEe!|14`&MnR8QF_5ld!u#?4DL-@CaP3%}(vC3>7D*)(Oi zMM!d1rPE3t?Y8=Ti|KEash;-W{#E1jW>9!{yu_=q^bt!FqxD0g`?ytA*19a0FPaLy z{b}CJ{YC9mQsrh<%M*j-YO8m@%`3=@dz@E0!XLHS=>@WWyAj)AoaV}Te@Zddv$9;0 zEbTHEm#LrqW`|TG(_DGDhm%K$$$b8IZ|8TGjP|7Vr2W=ApTBo1JUDJO?=OZ)OhYh* zjGM3qyi~5as?|nn!&9Rte-n625dMY?{FDwGcuonN7rX0Oz>SMg*VJU4k{Z?joSjpM zC2gRssEJ_nudRK!9(pSwyuT!-C1$uAG4{pV&@HO;IO}pt@9bo}^{qLM@h7)_ab2hA zYF9oad*o$o&d7B$$Hh;({(*Ij^aI?xHs&Xftara8Oy6j)63tc#@5x{!cs6vpuPQ<5 zq8T?4uM!-gNuX4pm9r9)c!$+o2=qjTF0N~LYLROIth9xW&|NTs5A_Ov_kU=S+>eE?lvd&9&jQ zpokoKk$IQJP(UkO=-E&w@klRIOq>tfVU!-3-7gwLP4m%Q>zeH_-t1Xq+;i5oXQTDG z#JD=H6+4q$WjfrESsbXXs`#>%2v0u|%Df2YYhm(@bs0mH#3NG7h8pVZ%!cyYb64+X zM}o`PBhYgm*PW&2h`c&JaHZ0IK~Wb*ik371z=B~S3>;wp13fe3Veu)7=zw9pB6B1P zCKWoe z)L4piheTp^DWTc|Ek(TFp<8&JX{Xj$zM6ES{mF7m0zR_*!V9JOYxCCv9gI&ezwS8! zwrI@W9$uqvwGB7Q^?z`|F;>|4agydeFal`Ne@t3n*p&KSCB?Eg5JnWJf${RmV&7vZ zAW$Ouf!0esWtA^HZQN!m4aHF-7xm-VA>a- zswD#pSzJ~*-v2m=xW;CVvYsmARw?=Et_RUS)``@e2|=(}^sQ3u_nN_shB~&NLOjT~ zG9yiQF?$YGuYK8^vCYHXjckzlrZR}2;`h67;ez11GcJGg5{MvY^#_=+Utk7m5u-W$ zP7<1q{HMGQt+#d|9vs4qJDjn?OXz{si;ibjY}cL;cLEoTy(vqTU6K8s*?-&!!aR%J8E zK@0L_bPLeq&Lh~>|$f;#300gP>a=JMMRow zYX{%wV_v-gav`+(ltqk&wLbpub(rB%LO-dmQX$yqI{A$*K(?#qL$Rr60MIW0*rb|O zz@_Tyoiy31wn%=&>ZX=nZH=$eo<=^-^iGKkKfNMfR_9f*0rT21wIzVWxi&*`0ZP zbqHFYIc5hS0<00(E2F2Sii|u%5zi;xA_W35#(~kNH<=9g`>B{SRUxhN3@~2CLa=j1 z4UMbJXFhHBh7STMA=a6R4X@o>qG+T;#`5)g>_15!o){RV?>%+BN+T0;YC?dn5U2e20L=QBfR+l|;s zA%P>&Z?=6g7bd&}jZ_qx+ldYyziD~?Gyik&q_OmHelY)8yd@qKIRyobLw$`C1H87F zBtZ*5YEn{c(9cmw7ZfHVP)btuFoa-S|U zC71*c|9B7BWg#Y>&;P^EZh{}}Ip-9L4-VFDoeEPZraGnm?y$I5kIAcNWu&o$5w$hFt>x=o8|4P0!`!drV*JzZ}B^gd)}N%-`AJ3=qo^={L7TpObd}&a@qO z_U_YYC-^X(OVaIxQYzh4mV~kAfFdLK9rx&SzvL-$Z`GwSN!V5eWKZ#H+W0R0&7guY z85DosCO(eLZ7D4~8^BC4L}_N-`VG%Y%TXB$@rJ&(mguRiOCh_kUrL!rm1O(fhK);; zH1M#g=Y+DnoeIW*q*ih&!RxdlAZjDB@yGzEdG7#hx&6iXzmK|$`6y}%DqN^(4`?6{ z=VMf#f`lp4SGd&QLX+|e`5vBYh<_Fy&V#d*B_)~Ck#seI9t&qklb)o2Nqm-#|0CkP7?D8a>{3Yr0zd`JJ)BN-GipT(ZEiHjqni1{oiH~oan zJve7eVi)dP0t=j9LNo+Q2kjE~QcaB6?+tGEYtD0?e$6o70Ibuk=W)2%;8Qd^0YnuGXg^^3E@I1r z+@U8>nh8y|(Ucy$T>Bpvz{FUgI#BNr;DG< z6whl2u%)l1zZ20iFi-*I%ybaWC5irbf%{R>e~tCQcnk6WA8*m&4G4muSufSh6BU(< zFmpBHajAAiN`MQ-<(PXzgt5+2Y9sP>J6VK0L z3cK;v^C1`q3Z=5Cr=Ps9in|LgEG$qL!<@zeXl@GZ_?{0H96@sw?W}EK=N1K*Hu0`* zI$jIVRD3J&uaTpFud}%C8D|)O8lvaCP6uNMe4!4-)N3)4LlQ=dxN-gc$BUFWB_;FN z6iH@b@O@7L4IdC1?a_l-1geKUv%Y|Tg_ z#=E{`;&pf``WDsHya@o-KcIsG26HEj?QX<6j#$`?Oh%lj((A$|=LY#nLKGEc<~1Ha zoc7#(RA_{ zKuV51`Tb*KXj+)c{{RXDS_W<`kLBDXl5 zK?-32^iT#;sm2SB)o+-P*{hj}m|S*&JAGm+Smpt~kBxSY_~woJzF+y05Or&Qfy#Tk9JTat)Ta z|1uX7r21YU3Vi^cYgvFUGUjKH(;IOBFC2a%L9gY|ISB}_PkTFlPxKgGZvPM2q-HV# zrm;znz+$Epy24&XJR8+bnJ=((V_qNt>;sR=H#5$G=nC=LR}#Mbhr+LSroWr$IW8_P z4gs+w&E334ARlMGMQtD7oMiMwLDTx7zm^7>*C%Q~d85?&y~m`=(kJHx-F^j;Vn(bx<|v}8Dvtf)QRzES zWE=#|-dDW;P;|K#Ub+-w0;L}m58WD60uC#;Ro|XtOH&s5aWh+6r6^qcyF)yFY(m_S zulV#3YD41vaoaT2=T>KLIkt**e{1e?+B7R7fVH@{sf0wh19SQ00+3b|p-xU_kO~brj^ozV^0%5veuL_twVuL)#>xfWo#Z2AQq}Sm)aIZa|R$0ugg=24v^|8LVp z*@t~`jvh_5ycz>B$35L*6mxqwcH8E3G*(RGuAGCy!)B~cp$OX@uP#(5?3pf&unEzu0oU zU*eDpI{#j@TsEja8ZGuB$0;}ZdwPA&;Y8a!voJHNCeJ!o@SO?j`KmZTgqH|QF0{ck z)?%`XPcA<`hw(K09QyZq)@{#4UDId9xmj!74pHn)10zFp45Qj6_EPbowd<6XqDBIgmT>lfc-+c+$k>K|kP58Sl z-V!TH`~+q?0@<0s^{B5N%E=uxkxMLdI8|Pb=i_K6*xSWR+uTM<+T5tCvCjH|@X)QB z4R^+cH9TlUif^B_oLD}2QvLlH51d-C(S7D6(rpc#mzHy+|F;8o7?(WSlr=F=29>d4 z?&^uzBeROXw3jo!f*78}S$Z2xV@ZII&FlnpTi?Y{Y&ZWQwmavpxp#?R0isBYICsw% zZfnTLKI%mlGf|D;)xGi{|Cla=9A?WQ`FR<^?k8RO+yXAtisv&jTPSLCB+y=nhCbQ3 zV&eHfY_g)Z+5$bovta&Accg^vFjBA;UZ8E#0Y{1B`t?Bldro$EA(M4-q7z<_y-aNF zbi2=U7T?XdDhW%yuOO`L$;^h!Nng^Q1hz~s@bc7F0s@g4uG47`5JGepxybwXtp0(X zKg*uMJj#&_4a#~v7(s44G08n)n+d8IhD?Y+E)O+ZnBAm^7bK_&`|!Ufd^E9BKq*!{ z!qshrY)1wrPpjU)_mb}KX>2qdj)-lq@~9l&j`*aW|JZrWtTuci)k~4P4zt#(~U@9#lp_WToLK(ZEuM-!>YEU z+`q8HKnP%X3o(l=#Piz$%7gc1%HFUhr!vHR0vs9EsmXw1sICoxVdcD@+x*)x@`u`JDvtAqD=cic{(Iau z8x#8OEe~fugy@x3`Yt9N&-5Mcwc_G}IGM&Js+jK*gu(k9gb%jcZ_i(|70ICVhS+Mq zNBDZf&S~FkA{y4-nbTxR82l~GPvrbJI*~(4J^7RB!^TC6^g6+St+yBEpd!{pvc0;%vQ@tyIxgSsPO8R zZV5dml+KW4D4W%Hl(}r63M@}m;I%mdS`NC!wp0R-Yi%yIK!9?i@Wze1R3L}xQ=&&J zxf7bEsrzI|19~I)bF9G{MmnE-E=pg_zm85*r|=WF#W{QDrAUJE!9f_^2r~8_GWm4L zLD1{x2B)Vq{w&hl;VY*d4>`dWVcdnv=Tq;-ljKC+;pAgZFA&cl;p2VpyM;HaZzMzF zD(m=yI6#DQkA3-TGanZh!mi!M4!N;*`r+AZ-gPLZGF~aT3Hhw1SedEv{T+?iolBq+ zT28m$EnZ$SMKXe%mqX6o+-UrLS6^PD6>)0D1iyUEK+oYg>cvQ{{&g6B(#^tl;nf2A zwf3f2h1706?a&oJ0K*D$Aa|Sp9Ro8sDx_bX@>EO1H0k#Me+-!>Jh~l1$@?A}Plw<{ zwra+SwZmx&JuGTEali5}YdTJ>vYZ)rl~wf_bvNibDu8RYe^RK>4`Or(|rXE$K2?5bHOWx3gl{Yw!a zAllxl81scL9UCXY zW;kaX)1!2(iLm9?5%IV}w6rVf_+@_o=km%aRU^{#^YY_y1+Tt5wFpjx`)=W$a4c`R zZ5N05JiK^My?_4|6E>44Rc(D$@k8%_n^%z^?UijS+g#+7C$~7>58PgBB1!o+(F^wzz4xYH(l-@~kacie?e<`ESUnnhCpR@`?Kyr@ z5%<+g>qIXDrDqW_JYh=Tal~>lzkXG{24Z}r+X~Yv!UzSrKFd@CFFUlNo^p488geJM zqV(J6GMkid73Lcf#?f`S1*5dW-kQB>dWo`oPW!ZMYsl*Fr=ed8IDU)Ev{jCV z_ZLFU44)XTMqIubQ@T*)e4KMrM+2pkl8u&Ia%`coZc&n|K5rc8Fq4vR*7NX@w!Mth zBlT#RX#II=iM`u)ivjur8vT+{AvD|cY}Tu-2#TP1vE4e6mnx~1W)$dxR?+g5?OoQe zE3GMG?F0{29#iw?Wk-{qQ;QC zeduR-89t*4B(9ptp0SUglucx%DpLl)8lMo2{ zrXA$qv1rr(jECHiE4tsrDs6w-DPO?0FAc$dP2s`4rjlWaF18oO$3PmuI@2$vL17U8$I9QH3z;lM6Y266zQ!rmyR24o{_rWp_%$q zGJcM?$BNPkGBGP{*OzB2&3R1J)E?)cuh21S<)QP-`nIKwNp)L>4q-)^La-~$ln=~L zRie1fIoOrw&B=qIKrUmUE94A;_ShYP`IWN<%nce4c*J=+_$EsPv0Vo zr)E<)G^P@PDNCwvw&3y_<%DpH@$gD@wQ=sqlobRg3s{S!9K^)8+{?eI8KPa^oX>M5 zf9|GLB(GK7R`uj7Vv7aumj`Uuf|u`x=X3ZTTOzbLntPOA!n*7ZS12hLv+5+?)Ih$m2bvc(g3d)-LyY# zwSyj6aWFb5c;nB-SvtO+$T28DK=3e#hfOawJISR$M5K!|C^cx_AqKH~&7Gp$JzhYv z7?C*V8elKOe#IIbec?Uxj$cbbN8^>V#2uZ(o_edT$>cKTXAZvlmGp`7^WI^C@hZh86qL(;8^XT_Q=w%I1%ju77O2sX)(xBEbA zSu~-sQ&?x3wckUiS*u0P{zNDUxz!~n^nq9Tji=)0h$E)gqijU`97+2f-JIYu8>Ve; zJ!8K={lN9znnUnq2i9q!z}u5M=?mqd9D8EBvwGJ~#m#9(&{y~OZAQy-_jae&d+vLr zO;XfqGG*vItv>KbY~!K-#G!gENqLAhe@$ZTpuC5DV#+4D@5z31m%xJzUZLDL`ys=f z`1fVq(8VXQ&qA*1q!)A7pJW~I3J69wQ+IZY5K*~Ic3uJgo&6Ji6~KAbX!Ck!hcYq6BMz?%?ZginageDnAb0lIytMtyq`6^ z&|U04g$$*f*28po_r#bJv6_VJzLWp!6$cZW{+y`qj&>7V*j>2fI@}#Fi{)llE5hkn zum7d+te|0vD+IcW<6K#6i>VO#kGQkflX$&Uug5B9!y0UeB!^Vq(;Jk--j&id^fTxKJ#X zpZxTg>{KLdyQ~fLDn;1WmE_GzQ#iHv1v0%5Y#MevV*(*DDY)u~EQU_`15e!UtXD8N zWO>{a@UG?1F_48t2HJcx06!2I#B9lrhnf*GXd^F^|Q zg#bB!2NQgUYwYGA#AzP<981fPt?_KJd^zc+^%b^r?hg=@xOOQ0N9cK3BeR}e?H~(S zjGd|kd#ewMVr*4!l?CyZelrll+?$>FhPzJ2UHDiZ+U&A5?8>@(6f~&DO{xpC3Z6%X z+&g<9{s(%Xf2vzbDn1(F_u9K{;T}jx7{CAtR!nsTmDoB@GfB)wjtV^GpMv8F|cwY zC^0GOiFKEcZtv_6S+0DJKFS!aiq{Mr4d!vkN=@N=;J82!!%|-u zfjWvJ`i#9;bPB>;%Z@F7xunq4mGt$O_!Z1bqJB`vHk_!z-Tc@tLm(}4b8cP?!DbB| z#o0U=dE+;_+LGnW^Ew??)N+v~x1FamHLDZuwGY`4u(F}Ia~t{Z6jxQYCOULw1neF& zd}lReJavun{%;xWi;V2-7xgo^mt9dTWTUGn&oWU5RQ+1&D8g8Chjv`|U~Bo3SsFNC zC{x`$?5f$(=}W7;hlCeUtG*vQYT|r~O78c)mt~K#A+Y)oEF(Oq`g7vbaZZ}ke%6^< zmO9!F4~n$m`q}wjME*@Rq=000srX{y9T>!vNOVv+YOO5Og!jn=bGY$Xv8LM)>_?zF zhkUP^rUHU?!go7&lZ2j`1v;Dgb|{M6u>JBTA%X4S2}vYwI#hCro8H^JW1r@Q9wwA& z`4!2*LvPJi6 z9wpU1l)IsFB$4_Sc|Z6z&E)5686-lke~2(MY~MeKbOdUDeIUl$ZZ;EPP13)@7#7_}n`F#B7SA(v zEhIR;*P3=sGw|H;v`f}sy?=PW|7*#u2<`_o*|W3}7E`|i4Igr@?70{?9+(}Q4aT?e zNO-sE;#K|vl zc;_*)mj%+$x0jD^Vy;?MC4R;N`{X3=g1pg@L`XIrqGkKc4YtLd$-9uxOjAFYt9vIw zPVp2~G1H2U_?GgJMgHP14{nOFC#h6=8`%L@qTlaZMKx=o=k1{8r|J}j*BacCh_US2F4A^F)wO{{E*%y+~-&#*+xlV z(lQNkfzLg>Wv*yy_iaBP!+tp%YgrY0C9e842n6tKGyjs5KqR78+ta zmcN$fZ=WOs(yd>Iwp&;96V*jy^@h5vXKF6Fom1vGW~n<5lO4#2%)MCC2UabD(Spx@XnL#c5Jdz zY>eyz0wLGEvF)^#dLUXoCs|ty6w&E?&8%(9(ZD<{wmi+S?tQkV2m%~znZLV-mFPTKr1vS~Ek`Wxg`rYc*3K+(Uj}ebhJ;yCcPN2r+>TQ|s|^yT@W-)rx_o*a{V@9jpD2Gb#A zU>dA{XM0BSwhLp+)<#DwNZg##{|=F_%hL$j-VQ%~f~6Yl($Ol$IL}@j_oYB#q0;h! z+uAp|qw?EfB{4q7SPXxmj5GH{Bkq0OT7L4)@QAz>5#gFa?maZZ{dj*|{RE5ii-Qe2S zAG4Kb&vO_|R~Kgl_l0m$G&-21}EBImW>FPVYaCn)PY^{vNG zev&X^*NNlFB12H~lfM>ZzI|8_4|EvBx40($fHHnX5D~GG_Dwk2s|7|@L;Hp7{{n&D zZNS7T*M67aV!%8{R$^_t@ceI&KR7?I+O-K@n@~WswRL!-zwBkPSXVh$P_g{Kn&szObFt0aUBcYaF?5XgkGtyEhz2IWS9y`bR+Q*Ukga{tBqxrP@ z%IqGcK<8gSw2pGMBDz;b1x|PjWQ9_dGG=Ux{#>q`{W{AZBWMiMXNi;;QSxk=Q9tD# zX?NR>zEpX-pM3WKKbsU-G%bYq&~}*5C)Y(o6BScG6KHV60$p~z(+t0g05pmG`iTM) zDGVe^eQrfO=xb*h=f~o?bHQ$#%@&ckG`sV;Ag?@@qfmtLBDvm4@6NkBa~u?5*0MS^ zb9wSb+Vf4E<3YjYd!+hY8S%nT8D8C@`0>h>4Oh&o!A#lPL%LXp`L8(@C=2zU2gn?K zckt~c3@7322(fdJ2YE}n#nT(WM3BCtGQ{@T_%{?cdIufMKY*85UrHDHgUb6D;&@P^ zUtKRZC0MYUd+Vi!qvVI3$wL!R7iXNLt-zK-%-igrC2hQ>G38+904rM7>w1-m1 zrlqOE{oGffg{SAv3} z8plYBTLi{ChLRRwlhD`@-_NP5e?yv)DsixaP;KvUF0@R89MmAC7ggX&qTi zA-lQdCJ1YNjrEBK)}*Osks)0qo9|yVz6f(JJ`5?j(bUzSYmr=pRZX?HeE0k7;*cEI zo+kevzjROIS5iF^!>KBEsrMBR*@-Wl>C}3Q7sGZNIAMMyDgX33uvQGJg@Vq!ea((J z`{_cy6<}FJpe48$^TDej$Lofn%&TV;Z@O#BauvuPEL`JAS^2U{Tc0A*ah8bs#w$!8 zfG}$-qF**L>SApR&+B~tTI?8an=u*wqV5XfHP_U*Doc6OLOuAD2@&R-kBMDy{@~VV z8!wz%CxxwqieJOIEv^4bp7*)fggaS3-R#4|RI9bF_PrZ=M?UT^Ea8B&u#lEVja$=$ zIq;YKRG{Vom*!^)sCl?$2yZ~m!>wPiQ+x#u{JeJa%|FK^$Opi5=S_x%A{|-8voC7v zbxv`4v)%bx!W;>|M~hX-KpM=;d8@4gbOuT*uNea6Up$OnJP8y62~qaX+AuxnU%pjY zD}j{4TR%U)8tsxjn4!WqCsh6&K#HxZxc}HeaaGlTKhDQT!B94#_CyKKy06<&y!$6m zk6H!_Et7@7I7UGh>Md$AhGX<*47>uDy8NnV1Ve(h=`CcT%l#=xhhDR;BxQ&xbt*4p z=?Fc3Hk64kWIHtx=&w=VJ6C4yf$0cWJ8C#+Ua*?x;kaq?e|Y=uc&yvEe?*9)B$7R| zSF%S*$Vygr*_1t#U5bRt&LtvyhU^vDb=fL=UuEw-e#b}M&vSpD=k@#j`Fq{Hx<9U5 z=jS|+^VsKcywB#WtBs>7`esh9hU_6Owu5)9E8R4WQl9BFq$K_mg@(4CtJAMF=6?}J zy?yQOv)OX2lM2oez4l%@xj!RSXGL_K89ghZbIg7J$)e=3Rj&4ixP4T zj+9|>nFUXb{fg_tKp$z!2ZHo> zE9-vMXdkloj!hM1S`5!*B(D*P?W!pF)&BOr*HK!$RvB*XyCQsZ@R{wNdT!GZo+lOP z=x&j1Y*(5cjwJuqSGv$8j1zjF8oK?QUUE2{1|KcR0BfA|IH87|{5MBAmM_(+X=&%> za9I>TkT-g%T3-ZG7h=9(k3tX4RTGw=UAoe17@C%1Y~^l?CU5 z6BGKQx6MXMgk$cPUNfKFl^W8yn!|xR52ZXee`P|eWO0Ebh#m>>~c}+93aBf;9>lI6> ze`I~kz(ty-owLiBqKjRKq} z-I8)2j+Jn%LGOLt9pWiB4*kOfIa%Qe)K6_K)PsTI%#RzX72K9tS^;6K`Y%FF@Xu%l zxg>hCX30)#^%t_xluw-EkR-QU{Sef@VSDUeI7`Z1cWn4;mSyjAzU&Q=@yVujx!ykd zYx+u+iUKs=k}+oh4Faex`Yv3DLS0@@wFJ=rv-97f7bhmg!4 z>QoW)RaZDyRJ^}c^`$}w$4JFWVLML}7#%Ksokol&A$`-L4M+(LLAD)f9Vtvlh=*IPz3ru$Qvw^xVgL?zAC4J(wb9dqR%I$ly;Yg9XXGDjWb$j-+h%#qLcPfh7BP6&sl0RgfB()J+%3Bsg|da+nPC% z@H=>l4Hlp@s3Yu4&P|%7bA9y&puMKem`eAhG$^=n(id%>pfIo zDL+4EMmW_00#hMEHs#KfNCYEO=ZjOLgJuB}=1ajJa0$o4zvo+Z@IV{K7ibY`BFr+{ zSdy29My@AWu8GIgZ66w{R~TmkQhM<}X+!{EgPbdF()v6BR9G1lk%hrMEfIoW;4_6~ z)ZId;8YG21+JS-$d7k2jck*o62Sc9sJ|$cZ@gcgv6_h>TJZR54IQbP?3|YGoXVky~ zLvfRc0{gH@n3rdzaddme-e>Yy!swxio8n7G9V=;Pj2{OY^j6qn)tajJ{W@n-2S}C( z5yp6Q{^@b9W5c$b%W$^oo;Y4|b8@*yl{9_vjzi@@YFE0|5URK1m>6 z{dJI?yNr0^*8qoavN=2*DJBvja#RhEZBSZ5h%ingx_%5SjP$}VpdInKI#m{WgR{KW zU;oOlQl$|CK&(NL+a6t;=+l#v!0K6q`m$W+DmpMNbk(u+z znZtg>V4q8Ty=VZyl_moG~A3m(^XX}LDB09yvA-^zW~(UiNidGR<1vQ{qZHtn4tFU`W+^|xa=;oeg>`_M0oq@b$lI!x9NLv zyU$_1zH8oG6yk_3vr*LKC#TTIIhSk*V4@!;rOkJC$bIv5@+T~F_1>Q(n$%z;9jrAb zs5XdWe+os>leJ4f?z7jgSWWNj+?-C!75og`%MxBNu`h`9eoxGT3 z&2t$j2{n=4zrE7qvKg~uG{V?JI(xU^LFZVRU-N`vf*2KmNaPg;aefglS}t+645YUl zcv09rl%cPqc`sVnmV;w_n?%Pv`gGD<88n+x8t;}=8v+9Ktztqn~*>Tk` zj;guLTc&=G{GOS^#egk^uS#yw-uvQ~rq)gCP0E@-Y2-IOl&X(z$dF^6k2#85MS+DP$Xect z#1N~@kA2?GJ*`_DfkR8=$%R{9<-w`K@PmeI{Vp!!h*6P^R`P6LVW>iIuzU&A^+_G26`?Nj#cUnn>*d>TOZ z0A&#TS1Bh3Wn`pr;AVzYH~=JQW>b!pfeOt&5*&$>{^tq7ioIrJ9s1K|H^%S3{KA>t zZ_Gx5;fLbcr8;beyNctt_9a+NF6L+UnHRRbG$z_>OitE2eL4GN>W`LylvVc>ZhKL7 zIpGV_x2G>`#*q^2xgJ*;23g}X;oJhgSS*`7Qvtx|I5zBG!O(Xm07S~LCDuN^|2^b< zAjhNbt;1O`7mNm7{-1#4^rVJJ_WNDn$EqqP7Aku@cFy5*T1D)Aw#f${IYiWH()W3? zm&+CbHI*mqKPGbwi;?M$VPazL~vrW@^jPUq8y7im^|Cl+oPi?Jw7N$ON-Y@HrA!EXOn;VA(1Q3IN>n2j*O5ozwLkZL z$hyD1L1}_>39$zQjWs{pj- z8D{{w1W0AjLkKkW!(%<9?{$wC5%wDh;%mmu3qJnP2lPiGZ$yx#S)kzKmrTumKu~sI z?HEQ8WRJ&){JT=*d!W4X#wddA$sqe|Ti}csp8sXUU^Bkpe|ijMM|u+{>PtD2X$`<5 zvO=Ro0i=}P3%a6tat+Gg{OttOG%!#GMoK+HBi0G++YP^jA3|P}fb`Ev51!TP=g7LV zW0t3-1Os_B(Re%(e1Ib4ivh29f;OGPW$PQ`GnndVHJ#moYT&a5wKz68= zM;y8vIE2D7^k4rt6BIK)PYoV`TZOi-|AoNaBG7PEjKMze+f~pziza&UOI8ONcBJID(ew574O}w3&f&etG&d>~x_FyzfGisRHbz zKEi0`ZRa5!jmr%`KSy@aAqejqyb1nzA#(sMWGEu07yUCVOCp)odtTs)$ss=A&|^Os zZiE91Me%F7PK2~GtPYS~tzmcS?Sq^L0_o1ABVKaw6~}QmgmoZBfG}{4fVl!nffN${ zcnNnBIm-lhftBQ>o0ds&lM#w&G7?J5&{H8FGKDQOiX$^?Ib;6v7^I*69?a~FGY-sa z?hnmkHrVk`;3(gN!pke3>sI#}I50TWmt%puWWaGIgvA8hKon0hwthXxj8JevBmO4R z79*nx!W3d-HcmnC^sm!${fg*)n&|nLMt|7hMSe~ho-c5J7 zjBng@4eo7{Lw4c@|1;>!h1b+8z-uT|PR3uOH~G7r9|?)wC0LSPIKx%v@8M3XM+4Gg z$9Pfs2q|7L?*b{71L}g#G9d_Fq=wf}YXO&cJA)CK7i+vwb3DyggwRiS?do|1j_}vD zd(e^l+Wq{5!IUg9eh)n#G^<0aK;$p%2?Hv6M@|s@C7|3+8086&#xjIw@VKtvVIwdi zvF8vr#lraspYmMl7(as;Z<*fo%f}TSBda{7SNc&zy6X%6f4|k4Yy<7X2Bq>7%|Q3?@y>* zqvuCn!0`WgF}4wP1>DQ=C1C4USIX&+D&&}xB(%y-j`4D$hYiUiaLY$nAd6%gVHK`_ z9jORh0T#S=K{{RGHCh#Lyo+8n@0_AQ6px3ZpYvDfTxVK+y&LF{w6N29Ennl0)J08V z*hV<^1BiI)C{9)ppWJ;x3{!ed$U=>jr1{@I8x#fbST zW;`nz*P?S~JQ-ja{2t(}5}nxJXO8>d z%CM~Rhw_AzPyA?cmjkgSCy03k0UgW$Y2ExYkOzF3j|s#|hQ0wNYECKgj7S2TEkr5f zEs+=HeR={b02RCy!q=ckN^lz6>puOJ_W|#*kw|C^JKzyake*Z>hG3++TL$fvqz3RD zaOu+BXc`<<06-RsN%(P36DHG!dye~Aip?28L~BRDT>O#yD%6q4wyi7B{&<{!z6&bl zzs8KZ;C~}T37Y8MCnqNt?>2u!eshf6|HjTKtr{cso6_*JD&ZK>301}SH2)nS!Y{po z3u!Th*N)}JN(BHs`p2KIUBx}8)$!iuOb;>*E8Lt54eCM^#g{+Rl6F49s^LpQ0?ArL zuG=Z9kwRtg8IYJW4t5?qaAdX(b^Hca1b4Z4-rMk88GrJgK8YMV+bb|jG&c|fOG9B5ezfV2+sy90iWWS?rBLr&no}A(hT>&;w%zm zgp6mrb#6YB3p`rI;>Szu(N0$V8<3SyKK##{;aBKM;kr*u04W|)iwG|U0G+@~=nCc} z9+(cAMFNStTP}m3z~oYXAzh>Z3GHkfL z`MwOjEljriX3!ag?dxcOjEf#D52~TRT(8`T#rt66y9>bOr91)vh)g(Wp4hs}#p-kB zq5!k5`vCVuhD<2#a zp&gZwjn2*!OAy0JoZaSTmA)wQjDzjV0me%JOc95m&GR5C;$xoTlxHG|ivVXz9Ebl?kYd7M^M~m%;#y}MD9D5ql2OD50}lr! z{3GPWiwuD1SuaXFAhzW7cyhk_KUM(M?2&Z<%3uX|IzHQg3!svJ%p@MwKIQzsS<`;d z4c0V1BLCb5gRuVbpLb+;!FoXttkM^Zb2f$j^G6M*g@bbW9d-X(fBbKiRJq)2!q36W z>+Vjb_eb6Q_w)ecB8*n@*3oveG~AwK%qCT;YUIV^Uh8x4B|4^z0~uELSS|gpVGSmh z*ZeVw-kTQ_d=Gc@I>`R_bTdiEjx;2Ja0t04H=#MP3r?Ule)Ftufv@HjG)|9f^}l1M z8whdte!*Q^F&5w6vXq#V|4xhll~aU%v8w5JtiS&u1wxQ9BJ8|m{gQ_lxuHfiODA6y z>4@uAWZMzY{vjSHLa|9u?}OMM0yf~g@t2p7(g;vEfZ_Ogu*i}`a(nDaF?8#9CFy;# zx#F|$u|lVKj6L-4cYwwuT-J2~;DHYsYLa~i-`);kJE}&=fbK#@ri9V3i3q-e_W`-; zAm=F4ujI}o63c!JU$rvt1R@uR04hf4;Zwio|Fw&MA6_xwc)b%&oC}>p8aiW7|M~bI zcW&m$bV+qAJ7e)M{OAV`^L?fI8eMG)f|lff7be%%GNL%jim%U2<`wJ3RQT(K+}+YV zFVs(yJr<^)l0=|=`zi}p+qo+;^=}H;=G)iA8l0P-zM4XRONbM6mfG6btvyt0_=<8K zsU7`Ry!P!Yy`Ntf&QoXecEDx!c?76asZeXaiyt7GQcKH4i;YVvgZ0l}%bI=;XbroQ zvdAafzS#Amdf4!^eAmw*k82xL2yaii8e8mI8Og;n|9t1qw`HC>gz+3dF3Z9gB(6<2 z;8t=x0*nv)QMmNsWnEp}O%ee6-~dp~7hMORCjgxCUn7*_^`>z5G4bq>B4SJLhg|kd z3YR^jGYIJK6=01I@ircFw*6HYA-?@5q9A&>w{1V9V6MfkUv(AR~f# zE@sO3AM+rHyx=kQTK)sFXNY`F1BCF^b3qR1mck+{*tH#v@<Wp5vAeY8Mn!R63m^*p@5C(gnd^H7vm$sCFN597DzHF z()>4X$;g=cgHx@F;D|kVmYJC;01;rQ6wN${yfBVZpSJjjeDx}Pbs#bz7#`W-F-`NW z>wnU8mq-~UqF!^bssA83J;CkmK0wX&`F1;^7{(2#`9;qo@096w}V(o90J_ib-fO%l04HTgLXw6+S%INkKi7boTEgN{~Q|S$t3IWAgJO!AX1OjNBlN+_iE}dNw0vs_Byb`n5!c|CBJ0XE{HIFuVUP zqspf-$XOtAsfyNPvQg7}E(a5k5+o%@;i-NXtDn>`77k~sGedzWg-}tpd4%5poQq`Dk&rCqVy$tCH2@1IjUbi^4M*BHui6fnMd==l zf-XplMEwtb@h8myhk;tcgOAiX^gA;lW`d>F@mSnZFqCMQi9V2v{tU7cfWz_};mmWI z?p-Ue!hh4TQ_0VPM=3vm?-KHF*dFXIS{h_+qX|j-5*Wm4ci;4{!^JS z;T0AYEx1~mnNgb7B{(-lz70ecq6aKtt#yX=2^J13vXHpj`u#!wR$>IWT1hSn=G{H2 z1ekz@#WSO_1&Q zJAej8$_HG8j=WW*`tOy=(2KxGPn|#i*0y*76Tmfwm2L}};eqV%fl~4#fBE}AMermL z?kxIZ=M2}`|NrCj3`LF9rpUa|QGI3jAid=scgXbEi0!x$U$!ikf8D9xjGo))sOZ=> z^v*<2oniW*ZIWG=7Z_a0TetJg+w>-E-8O-PPss3VhcE}8&Bgm_$D~LH3aB>zKn!X| z8jx5BTWG|4F8R6H1N5lSI|dEJrgB`ciu4J;GV3OOgCLS@Z2zVPD4JJzBDHeHlJ%nX z<-aNexsN$NixaGr;k8Y9_!9Lggh%P5N1~}joj%A49SDzZZI_R!Vd3=x#%TBj*cx2e z8hXuOQAR(R3`7#^_jO|9XNKq-+l>qMihXXWS$F%yGN-+x|1_8OG|N|)7>D4g{Jqgd zl|s|Whd)tUCG$h;)zt-4XdQ)HqmJXcmpOxV{nqrqy37L?N}Y1>SvxD8Buj?ID|S#m zX1y|?OC3?mI+3% zQ|QTP&#@C?7{O3rE!4rv+F>J6kTrrl>mr=g)Rr+9tzHMBv})rEun)n%biKmUQv62a6N0&`AhM z;m=(5KM$m9Dde}tB^3$4!Uzu}bHG4ZPq*EVH(D6<*U;_h*guqi>O4+}*|gK=cpyD% zu2b2Q)Zy`xWz+}emgDD1{NqKY<-nT#qeZXGo`MJWzBha^rGUXJX&y8B`T4*q*0Y1{ z1Q}61xr|@&fpho}=jo+b(JhcUFrqvX;|8s5-_0h4zuz5>8rpZU?!l;siiKt(>qO)A zf34Pf@!i*YA=dLwG_xz^;y(TSSr2Tqy+1Dl5wK|ku1IayxhT*QU3AB!@j;xb_h^{< zy<*r3kNWc55ZX7nqQ25DXXD+!T|B6^SRr^Sm$Y8_h$?lIDYRmkHahj=8GM*1^}Ubm zAlTPof9cz%20;mWrC8oWsBDGk_Vy0&=;}y-PNad(M0BrmiJJ9nBl~x36z7~i(Q!8( zQ)>wKMYJTFTzg_s*!PUR%htUId1W;5C-CI&abilx&WFSSBWl9Cl1&8MnCeAMl{)GX zX)uNj^_sSH0P?7V33E{0IH)naWY#`QlKR0RZJq}mb>eY|%Dz~E1yJ2jCRFS+%lj3_ zJNeW16c_of+pv_Js>_KpamCFdLp%Cphe_-K?PK6IRlWU>x#~r$=Nje_eO!R(<4=V- zU}K8^(Z>%EeQY~7X=d`#sESMPFyK7*=ChSOvNNDwb1$_f*d5kuZTlx6S7k_R| z;s>I59W?%@I7@0eVK|vnmqdi0&-{=g1Q{lLcOSM^1K4W1oDg%Pu&_{KLH19Gz^4Q3 zIy6w^1m3qIJhFLEJactgaoVfkW%eDh-Q>FSN1T`Hb3~Y7*<GUFc?&tv0yf$X^vB*HGEoAViD5pSsp`1hiY(*vb7b4H@o7>|Z&! z{`jft6RAo5Xnv0(A{>HW3`w*nN=#IS`wn84TF}HvhE`@)ZLYHUNFzt&U zbJ#wprU}c|*9bdjz;m+6sV_HS6@NK*rc>_Wh!924fB-O4hQYtY{ETi8OgJzjmJ1II z4q>d14-<+B<-8tv-xSe#{x+}&S|Q;Hh&W<^ztG=YhM8tVV%pzDBu{tfwkyneefr>9 zuJ@gVpBKJB&*7hZr}jIQD;-N{#VC27&%^V?z(1ce$ck=&^(6W`e#lYj3#MbgK$96l z4|_zb(GvY*?cnx~56!cS#F)m$cJIooEzx~+w-m>fe;T4V@i#A27Ey*Fu7;*Y(#?ct zZ#uU{GQT?&FuPMSd^)GEwH7qL7z0dIJ9QCa6PNRRzxSgP5^Q7WnV4jooyr8#yWg8> zYe#dMI^0IqhmCs%3E|j~$8bEv5^n3n+8I}I9f&B04@Qn3lYnTstlfre*9{9wzPkkZ zKpDz_GQ@f@dJ(6|dxuVG|;hjpmTMt8tqm6~JH zmKM6+h#NDodpDO$h&>Na_tPJz#*}(!2b+TC&_R^qn@xM_deNi#ix&}lqzh6#HCyBc zVugec4ta$Rc7LVY%|6Yo!r-l2^+=47IYLHyZU6dIwe}`*-hs;Wgxw0}5}I>!<3Bn~ zv4!hJ(e|_yuYr(tBNU?bR(=VgAvqy_I^Zy#{8Pks`r8ss^oniX93@NaZ$FP#2qK&zh zr_MgDf;>R%d*Jq>er{N9fEId!HBLQlAU8g=IFUG&{+nXJ@TYaBr9@Nr^QFtOV1vAH zdrj-Kl_h(m?zTH)loFm9PC7e;O=QVbHNZOZqC=iQ;MEMTkT|(@Po!Ry0y zFtCb0aHR(q@Uw`Hx=5+(#`D6f7^!Tgi1`XIC-{LRhbr2tkepbpM$<}`2wYfe4gIF`Oj3p2BAoB8Rnr_M$;f*0Tw zeljmSCG%#3wLe0)D(ppMxpwX3(;* zNaH7GMG2<$a)H$#?Ysp6O12ZLDi?XB#1to=p7aY} zaUpO$PcXL=>Y&QZ$*I(lW~vP{!NPe@22r`8qAn?r1|p#J$AQU-bQHWPr6x)+ss?=y z1#g3q3flgDKHnU~3A4zuZX&xpymWF8F;oOMctNpOlj|cY&G9Vchlo-x;EzwFUNFCR z4(!TDnY+A3Hp;XynT|doL`?YCu>47h{tiMhks!7Z=?E=+fHq*e_L ziTR_TUXl^aHMSQ}yjj!#!TEI;ShfP^zT~l`(%P#0e0WTVE-+Pc_KnfV{um$@r9Pwa zTA4?t+{IX2WKh!nkQl0nW^)_V=tOV#^i+gy7t3hEF241|AhIE?A9Ibd2$PHP^yOh1@A^7T(*7t^5x4}0X&PN zV_mO(Z|2(##C+ifK+26`ewY6-c#BC0i&Gw*iU^6p-p3I`t*$0&w+2a%G6DA2Yen6o zS9vspbSnhn?hDa_O%e=CUaNssn^TmclaV!N6z`Z6gEtbW^S+kgpP_!$aU?GPHtp)`cg?QBJ0kPH!jaA2P5C{X0a~ueg4rFf zcV{Ibyf$NYFy-^R(>f$dgW2&R*SFn~u>e3)SEz-yU{ZGVQmE z+ZuNI;*fXG`@MmfQ}M%LZ7xDW*QwBSx>v@Z9!$Gr*x1$z@EYe;PSOcHFbdn>jU@YE z-(i|N`EAE1*z0igr@+_;qt$s?cg6VVZzfcjIZ>jiNCur2U$$C$wylM;J^VjfrLlR8 zb}fw)UW?Xh$%lKpo&!n9q#A!qgei6Ci*VpE*f0}9c=9&zR=^$h8QA{!AZ1J_r8%dK zvwP+1M=fgLhiDcXTGbF^>$a3Eu&iRbNc7#G9z5PZn8smrbsrQem88G);%e&ywb0io z15IqyA*`s!TM@idVIS36bHAUCsg>MBNeFFTo#PSDmwGL})obXSFX5Po>d%jnEIxI$ zDE(VuK;?bRpf|(hai@#Zim~Tj}1kn zBdH5N)03WuFd|9w#Un6+RzPLszkn^*ky86wiS6F@)#aZ2NWyW(r4Mt1lXo9&FJ8)( zSJS?b#r^GDL`Z(Q#-Zl{LHT;X(Z^C-xU%L0-JtH`qbXf=_gTZO=kHf{_Y!ZR-%MZa zA3gHS-7qR|v0UknavJX|ZC~o>c%?3E#B;R&{nBcSV1C;kuM{gAwXea&DTO*ANM9A2 z{k-*Pce?b3!@a*)YH+&>Ww4Slyc&PY>UpTV2?f>o56kd{r4O zzIJ7=>)mSy9`4kSFMY?{tb6&&4IKLnT}fU(?y8t8aNp(Mtd$?p*lN?K({0vSTC1F& z7;Wim;C&U@bUJsTcd{i?ajIwX2aj9J*4ix2#jW}qkG3ML-;`S9Qjg|l8@P;&3GCtL z_tXoU@)(^gN`w4YPJCjKwr|dxwFak06UJobtLesVY21T3(pKeWExN1CA!zP3D~k;t z^$qz;v+iY{`;G|%pUhiy(?i6TT%^+?s$aJ3{CeNz8?C!`p)G<}x%luPk}NESf=xA= z#JH8q*+^adCOTBd(6h$1ib=A6b-6t2AneNF_~62D=~56z<pLIXxoX&? zx2IZvp9}w?+a;AJFtFhD&^YBe+PL(y=N4*L*<*F7TY_6_(ff*$)Vp2dN0V_Mos==g zx<;IbC97BEFx$uVb*p#xDH5&u0Cli0Q@W zi60xv9*Ih~*dKaC7#uYd&rj2023HG z9*Jf#yAC@;=J%=zw;r2&kF(CHzfbfP8mw@5v`Q$+Y}tCM_3d&P_3-b@t)3o{SM1+1 zN^>14)}Tby@@m(vJ=&#nze^#aB~zML(2^xL`Rw#m+vt(@+beeT#vMlVY7$4!P~zLY z0`9_8!^Kow@4!NyXL!c`aC-m3lea%BGuB>KMCc`0_R=M0Y$f?D|8`OL^;6&V&Y2B2 z6iD1FeYt~Kb6QN&Sdi9KcYl9WHh~ccR|rFezd1Ljm~Q+jYV=@}tJPTNaU0rn6=%5Q-rK5!ec3lY${43{)TyBnk0Xup%}x9dzKOK`qBp#oYWLG}42{i> z7=j1vy74v4rV>bQjlOHv9n6%jQ(t<2U^T1LU#Z#W)myHeuw{Q~?WuCyO0I#RNybJq z<81iNUj7gzx3({qbOkf@YzE-f)oZCiR;@3h5Am6SEfoE`G0HJQz6BPFfeJeCSf~a(iu9V5Vd)C&Y6WEkyn_GsNvRA6K-);*$=G$jZsw z!pVocBMeMSo}CrHw(2L{l_GAQW?2<gPShWAdX1}ktd-cZBpe$Ny z(oA&kJDdJ{6M#!zD9<2zH)|LCys4HkUsCiYS|m09z@Fpf-mq)RR8`T*mTF;RTRcB` z&z#g#gmm6+0abAuN#rw`YEx%Z@@r#k1D!c;PfgZhQSct*U*i&lj7`Yf^1Y1F+AYaL z-W|`)t<~Kg(^P94G9uXo;ls_l(OmlFw*;0db@fWESYJ2a$X=VF@vZn;L#99c$gQV3 zyj?AOwLKwRtk~W*ajw^~uf&&Xqu_kZ{3{Gy^!#r1vpJDMZJFPfux`*U$p+8wgbLf(cng^P`R^u8s zSnPPvX3(kGoHZ|Evp;I&6XMEnTe5`n9C4QT$=+eCC5fW~1BcCvn?x zo_MUlgh}aO4U74FLbbRb)Fi;5v7(n&>Od4!+O*h|F?HzC{+@0<$>srp(Hcd~l+sOEko9G?h;ejQ5KQ zokJg3EMt|=Jv-W%ug>@Bi+3b}#2k?h8#vb4@1X7hJiHeWxZUPxlz`Ow733hQyu94) zw745_2MzZ>`R`9cc8_a{73j47wO@WbHw+^yrv@s`n$d=? zWQgJP8?pscEf;E6Z2q>Q1lM;OU z&{8!O9@!%??%VRi2^qBHRF9Z{zMi3d^xb&M(3RrQ;*}ZkJa2Uco#9ONO>Enbw^iap zVm@=TLDIM%9Udo7`yi7Rli`EOmL^qSGSG0(=*u%~e|u-DYV%;iyx$OW`pug*Wg%hv z(4md+mE@6+S=aMhb`%e;wT%1TJy(8WF?p1@flls$1p~cP&qMFfpSzv;t#8;cQ-vz(r(m>$Dov70toAPB%=l3n z?Wc|Bmlj`V8h^`kXqr86PoxI=O1i@1opj+}&Y|VdlN|He^C>tDE#>+PYd)JXtMzjcx#BHMbQ`hl zd-k;>o?iqL9S9+u))xEF_Vp{VP8Wyn>2VZ)s>OT6-O&agM=$D0D?Ady<9POJny9eC z$|}WtV4vD=c9j8=h%dclIn4$)FIC7@8gAo0`IJ2S)cLji{mj}gwcyldu6IR|2YSsW zkM6{ba>$~^4uY1n^fd}bcIUiZE%m2f$3zW_Qaqymeq`kJ?vpojj(B(DZP(JerF=S; z;qc$gBw@Qn8&(1vl()!tH&mr(f&w)e-d0d%^K@o~#LfofdJ3zVRb^!v{~YS8f%vb0 z2c0GVs(QJ}YzOYqo7!n!ETOa3?pxV$cSq79-G)NmVdx!|L_J(<*4gTZvpi+<)`GdC z?b7)?ueOZ5G~pdFmzI1qd&O0hYB}?gKWVv1-Py}%zIV9N^fZpZ?Q5QLc%*T1{?g z`=Z-oer|JEl#hMq_|nf{+(6&T>9+z)HJsl2EndB*Y<=QS`t2@rkoEWF>wF(E$X$9T z|1OFy`iMFFXn|EU%QoA|9lbD6Ex&k#SzBG3{UmVcKbWfCVD|W^VF{-<`95*t4T!Mc zYHFkHS+&GVK4tOEM%Nx_+|i(F{UM$g^Hj`r{zRs9!FHn35m$$VN4kN)6xSSynAFbx z+^JDf_q~J3oUO<#d0B08wA>=I^xpS$1(O5M)meSID59P-BpA(m+Fg}XM&5I#kF2}# zS0UKb#k{Kx+p!E>LRHR`;7^e>pg)d$&H@PSE2CQV;!^S$k@WouZ1)8N76)bE(lb8O=%u@N#;yH7k4Hv@P!ezc`Gjj%#8 zqWxmV!qVe?(H%^!QR$-Q_69rK5A5%+ic}+Vp35t)r9B_7#E{c}5mbOBPXNQLX+%Jo6*xo4%R4MQM_3pJwFW z#nE?EZ{{g`&0x>*$JzLhNFThA*qLDFl-S>3_g=udT`jvf@nGq^P)CbtE2BGF#dk|| zk3W7^mDtsP>l0gZ%f7FWUy59-N{MxU-35WL0 z37URW0patuC1^J9$FvV5qeWL$?~<2=dOB1oqxRztM!vV~8TCEZT-xq2-xS~MEq9$V zB+)*Dtyw7=V7k0f@}d`oquAubF=Zv*P(zPkew=-y`MOF(#a)<)$tBx`^DBJsX=2%u+TG~d` zCtY_$G0bQ#M_=3J<^W~w|zO(l}1aGc|EV3$mf;DGlToXaxp&2mgTEk zwVzI{KuRLSGiRDpZHO&>Lwwz*9Q^ImmxPgwPR>qx>Xj1Oj*YI~{HdSM7vCTOi}-Dg zL1V|Y(Oj(MZ97BrPCv5Tt>xS{V>Sr8^m|RY>B`pBoEC!KZ{oFY1jgrt6wIED6gJus z7u|VE`=-b&a3e3dDU>Rb5Rb`yF2U18ZKoj+b1Q#QKBR(EeIb9w=UdSG{<2xexJhH5 zo(fahz{J@+@&DfV4%qmunQK()35kbWX?r>Hr?c0dd7l5U`-E`gvE;!I^qY-k!~VUo zUM60;c2AW>%DoS+Ji!tZx(VSHXv5nx)EYoYFGly7%p>tteD>5~5aC`X&c2=PfkC=g z&iDy>7W>_phVH?QrJe>c`z-P5zVh1(`LqjO?LrN?YkFoXrimWc4n4-pokn!iTi;1O zURaxX%GP|>*98fr{$^bR=i=KCKO4Im@}28>Bt?)}CPfaS3o^90tmo?S&F1Pq_G?3G zA>a4PII1E;crt!zs>_nCMP8$(aHQ1jz??#F>2vvNG{1n!kDppn{dW|(kF2AHe2yae z#UJER`P9r0e3EyH=8~S6th?2oB|eZ>_UI+KQT4`i| zPy2+52IXp5p4DIjVlC->ec{g)C)5^F7VGxfwQ6Iq*=USs)MIRob7Cs)i8`Zk z)ZJw=gc4mnrOWr-F}nWuem9%m+yudYJe?bUW0*gkXUfQ7Q>Og)tWv6N_ROYNubi4| z`jGTHFU702KRFVs`HfU(hlk(RR_rZ)BT2jKpG>t>7~*SM{UFcUCSpujPeB_=7&EY| zeTw<#ZQ zm#|<~R0wLRgd*lgxD!vPr-w-Tp-MuEmc#ZhL9(3ktd7^{=QiRS_>5}%50aG+*Olgm z(q-2;j)>|pTpW8Oj5@q(yXRsmu-{uN77JUn~t}Kw1%>AURwNDT?H%Q%!ClGRMcwaE=0X ztrR6M3Tfe-$Oz7fm<0tj_QV<=2Z(E{MJMO`*wbw)EWMjVmwRM8OTa;=zF$a;k51je zifHYhqN1ckI7&XSxs!15EE>s7A0H!_KuKbVR@ea&BvZnKz7k_JD<8gfesZ4I_wyp^ zU-cFnu}byjl(m}k&!G13l*7uM!R{}vCa}S6t)F2V{vMU#Ye1IPuQ3grRX9C@=pf`0 z3;uPWPBIcH2%|J;3RmXZKQJ%la>TRbuJyg?pPuC?HARjAWh^0cK5LM$jSgMY|5I-A ziyIF2mUcxFXvR?*{3S>o8EMdSpt8hy(UXWpk%5EVc?Z=`ZT)g2t^KH4odF>@#jeqO z2#4x_Cs`)Ij~vxH!P#!-ZP2FA{fx$8paXQ6UR^jc^{F6ayKOjjZPsMNl&Hrxs%r_G>>+#;chP z6_U>;e_VMUqzb7dF}4z9^%F=@vIvEBS|F!zYwx3-Lc1Q-IeBj~qt|4!H4hI)!Nb{W zbEJoDQ-^Jnn%EP$f)S=$xkv>^if5tXgRsc*2^2Hm{3dfe=TvZ1t?+?nNO2gPp-&|2 zO*O7dE%g z)OG#q%)SiH?7ztw(4A2c!JH6-Q)DpJ1aKOR{NDp%>6rNV2TJbqKe|j^y`Swl_FZ^n z+0;>(YZfkryprw%j>pojE5ftCqu04eW3r(Ve*V;+vyzHo-Wp!5Y7(HFN7ds3LgbqXpW zkW<#4a#o{nwlm2a0y}e60u8C|b}R>;#T4Y7G+c+*&M42>9X(FJmZ-Q;!EU4yj?}sO zmz|m)tX4ce5x4l~L|p77evd401+DA73&2mIGO-=@sj^v6jB76=L>cIy`h*c$BZ1H| zKSAWDJkK2M1IKAv<`hzfnS)%fTCDX7@%_yFaSf#IY|NdHS`a#r1dm75CK# zZ7-2ZD@~<;DthK9UE?<+W}c*L&w0$}r2ilG-ZLtyENB}QL_qycwQJV~W+}W_mjxao?0YK#U>Q`MG-5>&43*Xctz-nx8#>v+fHbzl_lvE5nC-FF zVF|mL9m^BOwdWdfHo&>9W98e>_H^wC?sCHViU9uk=BwbA`C#?@M_SykxdIv-@84sZz{=YF(d~gT2Lx?JWHlC zpLKzyO8>&)J{+NV@HW0X>EM>Eg0OFs?yjz~pY$o;z%#wZ)h>_Wtg-83k#VurrF;r2 z9xswM$g%aBp#q((_nGx=jiiW6nv@Xuq?2JF^tX`*GCelR|l1u*41uHtNd1 zc*ttu06BuKFm>gpt_CoIRiQE{&{OMdRp&ZH&=pup70R3qBxNSfpe->GeB4I912IEAz~-hz&Qh8G5oYv5e%wze1L3j z#u?f$j<=n^$H~mhJUf*KqEX0;DFJ1HKgwr?bO;-;34sTP=hwg2Fo+zzTInv4G;WGp zcl>m7$7Aa}<6!i6RAh%m}gkw8uT&R<`k^E~|)(iwc;{OHmSg zOk%dM`jA3C>cz}RmFagtnnoP1GD8X z_2^J{JDf^Zr{q=0ppU|zUreJ%9pq_OAFi0gC^xGsegP#pd1?iz?RdV9NNl<48sFpM zi_TlJ)-y#EteLR6vZWA5-D?6baWOYiaMQ@{<6^iE$8vsKdd-!{PyC)QE;e5}4?Ov) z8oL<;>d!$v85>K42{{nSH6W7jevXtK+H?jpS%vQT<^%nl?_K@V_STvr7H0}=BL{~w zg;sjwT)n(R;`8tJ#yN#{Hl7xe$z`+fQfj$QY7XsyVgm1P@jCB3P*YW+zt!}W@KcZ( zAAnA1fzm|@jpCfFW@=aG~ zXYt2LLJ8?rQn=`QqUhIp!Hl-zsR$;XDXOpE7wx*}Ev})8MXRO~OoadEq2_9AH znEC!XY=OS{@BrInAl|cIwAd<=g{E_RHCP00%tRyPMkQwJ?$b_CjRPc?H}(63eTODY zgUbx^r_Z6nDm*n4d@x~PKTkOr(#{Jy&Xv(db@mi)g|`!^t>6sy8ohV)<7~R7wlLYx zKe}1y1Ts9ChaTCl2x^sOiSa&WOYgUDUG=zk*RuJWNVe&{)qZ;s7bpLE0YLZG^nJ!Q z#^9F_m)@7!2PgO(9SKu=S#h9b_AlH@?Z27(_M{Y1tX32__Tv&oypvLG<}pyE_C?Km zqE&Hi=q+J?#Yazrkw|Ny>AsNJL81k6=LJ3Id@uDZw#$TD)*}vcT`|d`fPExcuYc~o z&7;+QonHP~1D1+t=7Y+};=wV`J<}$nFyLpUk4Lnr7x{?V7B+RV63FMdrl(!HYjlD% zQ?IXk@izhf%LcH9?X=^QaR`3qeuJNuc5obrW7@)LzlvhXOlvZ_|PwniKwn>i8q=@{2c4O_sU_F@W=PF&T zNDWQ1qoHEU)_ihp8B}77++qs8v7n3B1h3Yi;|CV4a;2?h(R;JkgoTn@ZFftfrgyu9 ztGQCnk(FFQ{@($UGVEgvHauz9?SXpG<_4UU` zZ?>L}vc6hwFlj<63-=1p0ZuFe+?qYD*@L{H zp_CH`z}10v00%Sn9~Mq6e|Xw(1nc8iw&z1i=;pR*rS^0*o|b2c>$ zl9~_TlGI_$DY|n#x3*>t7~4uI1-c-RHU5BaK+-m*FBXcBYz{>xzM`F@DHt1QN&*-g z6p4g<626X{Hz2I}e)xFLrW9~RD?}=?#T@xjjguMm#hANK8X;-}m~wE)lu3K{@NCW? zL(gm$!@5#M;ciJNmwR#G<{On||H7BVNEO0ouUo<7ZkTD-T;3?*L%araYj_Y}QO@Sx zlQl*QRd%m$pF5To5EV8gs^d)-uGV(+t5cfAE`?R1)}cI6ezKd>1vfm&JLE_0Q&*~j zJbL#QkW1rg*J=Bmo!|>LRh~^YJCA4Yw~XiYiS!QA7f1BC7iFz{U>>1FNpRZ;RjSt# zP`(>W;;SDT`+ph<12fp#<^(DXslMd{@7(l_0>9L5=BAr<>v=0~XJU8-Y0k$^jdhJy zS5XRgEVIs>Y*Vq-3o4y|y9f;)^K2{K!LemO+~Dwj z#c()9O6xKhO?m5`yZN6$=Kv@laZ}+PRh*D($<`ClAJ!D~M_TKaXP1?e3j_x==|UST z7w&v%BsL&xRM{MTK8B}cyD%*2j(l~ZWEA6^NZWl^UA{vho7?VO6ipC)43eg_2b-jT z;m!fH`RHiG4EaAB;Q#Csdl$q`{0YiwRPrEMX<2(_whXjwb90{@*y_wh3v`XzOi>;4|zVL!);`R5}NtXvJmB->^Xe5s)1xwHlCHLpbCr$slK~j|FqVbv+ zTF!_6U*rt7!rFi)ej$YE(T`7I*7r}RkF5UWsonN|EIV;TXt%?T4ThbpgY43H&Ps!c9*^y5 z#Im9-@NtfsHK{f^L1Wyhe9#^_b+BQ_t}weu&;?CmE-lFdyEM5W zSHm@tdrLH?SgyKN%iLLCay3jRzd}Z2X93$P_R%RQi=9apg3k#A4l-}nl0{@$5cD68=fY-2Ik@6ZAc z?I$QSCLROXr2el1)lt@Tuq-wq^VdL z>-D{n#)ykG?xRF*t3fZeq-;in(GaH17n2g62%f2^Q#jP~@t3XUY!TPho`!(!-Eh1e zTYI0WHGonds0eLQ8Ze%8qShLboe2Zml`VVCA~dz7k)mD-r>) z9SU?7zS4{app2O{1f5o5Ua$RlMc2=ZAAZ@S_j|m3923%?f7B(|stZrx8ba3AuefjC z+SZ*E(AoN3VP{7@pvCiM-aDR;|Fe>B;sQ$53L$(zAH8n;q0iL6h6dRpgi_BQWm#3$ z**L-&2pu zJ_EDP^HLtwB?hCa7&P#rh_yp1dwzyoZaYYYa+PjnfrPXNNI&3u^Sk~uAi8)QI$JxB z1ola;wP=WH9+kRN#{CB4vpPpvTN+L0y3IdVMXVikORS6XAYQaFSHy{boO%f<|{Ks}Qw*3jXW%jYVm-zH{S2xVQid$Yb@)x`B z?~DPg^%80;C-2H{IPMzf?yvVoWFgLRA@0#ak07gx%{A?<1K1BuT%-|VxYHW-q&MTE zu|f>DEGHM2Y2EX4-Q|wvR)yG<9`~TGChUlfu%x7<=CzqN(}tIqKC;1eJ$^LWDAC(A zrSLr)kF~e*dqe*67jO@DJ%VQXgm zu)o;lh5ule0}spQar;~8$FoYz!}|GE0!zp$VzUhI3zt8Z8FwgbNApPG4Tdip$n5Ej z>Q5e5=b{`P=*-=Gi-T{_mqs0q##E|9EY~I5=Z45F^f&-D`G=;P{RAu*Y>Dg`Cn19r zUF>}p*l9$L&UpdoMRAnftoP)o5fh0k{2Z_N`Z~`v=oHfLEdnt3<4PLyL3H7xi1yZ& zLa$y_83?xH%om7&9|xl;M*N` zCp?M$m?wd8fTm8s1%Q<(6mw1PvrgS2{hQvN40g;10aZac8=ckYi17AR%eb!y1pF%^ zF4r-{*{=9(G0`T;NNO?O!l+=sgd~Czka}r70^XuCXw)&l{sVPL;(sw$*E7d6@jv)t z4F2|12J0H~Rf4I`51Y{IJWGRd-cqg>!yoex63QKO++WlWjtX7P)F3b1PC+Be=|2#~ zjQ>Q=SB~Wjb|+ClD^wl;;npJzf<6Vgu7qDSpKaM@<{etM7|jaBBY$giWIiUKad3Y^ z*Ha?+TQEqC1v5);8u$PkKMNdaI|CBD63VP%SsbKnQ+1R%DIp%#jyWPgJiAc93szU| zgH@@vf}fn}(YOOG)6xDEdg&sk-Cf_r>s=JyvTt0V-kHv%%sSFRgeW1R*j^@tn6reA z@c7?po_HoCyM2K%p8d3WXA8+KISh9$IR;)__$lD7TI~K#ggFg9gEme_>6=hM9uum7 zx~Uq?12#gdL&buiLw)JuEr)5DY|BZMNeZ$piqUa>nel%BX6!LwZaKzqgd7Y3GwuOq zeE7?Zude536w)C3x_XSqLH|ryutf`;GaxSLy7E|Y;S)CHTX3#Ji#$7mmXVRMz+=aO zgv01LI5v*hz$2gHO0E&nh8b0B1FbQ^`%+`EAVXrfu~^SzVl=Cb)8+(qbn!}3QhrJg z9G%&cC0eqwSTvd@zo8>3oV$SD&Y{;DjL})fqw`!bTi1`qE^8Hk_&UU$EgObM`j(9c zq(D>Yy{uQge(~KdGNoASt))@=&T5{v_|5~3tx&;Y%UxbkxM!mIHzwfyv}v<20SrYn zg6K}lo=wbFkk9y{H+b5#zEaPGVkoT|x;M_cU?JihPaRiUAE2rTZ{k6`pmv9Vu;j3P^H=5-) z*#tM0DyTfo+I7Iet-{<#4|;T(%MXTjL_Fc1>=;+l#C*n*c=eh!1K1bo!P($OKL)wPNsq91nsK>-QYx6X5<(*?eI8CV&$% zz#|f`{Pt9px7w%*kAiL)!I7HC>Ez- zQ`lTNmoa4E@2#;K^I#SJAOQrpZwr+zGwX|5+cC_SS{5LUzl6WN09CRNT z2Jm{)(h!}8x+{TBQaui$IYZQ|?LW0j2v>>HRqDrP_PHwLhlyS%3Ou(R&eAWH9NRPc zAbj{Ma@gZdXg&K`tF7P`rst=9wU=jsWfWblyMP$-`Pg_|Is0SX63Ms#&5K<99ZOl(-$ zF|1`SN&Z?+$)5RGZ4krGHJe?8N?F%)^glhBWh&3{AMe$^EDW{3xxvZFIYOZnJ9Xux zdk@Yvkk~a>E!ScJTQ;e{8f)q^&o`)B&id5~(XqDd6Jf8WlC|Ut)a8fr(lu|Id7F1y z*d_FHrj^FuFp{+6x9Yq9p9*5LqJl0Xb#i3L4pxNf>Y$C;R1aSPwK*;+eGild&K7|) zcKdTp>0NbehLW4{{j{=v_;R3Bu((*W8RWL6m(vCA7nL`}C|8=baIWne7r%?`k^Q!$ z`f3?*8HhE^j4byI5NpG4VjUTJcAU^+)ena9ioa*4DoIF#ANi@u{SL^_)^1b2h*<&!{|VQm#%|fA6mhA`CEdwyciowdgve; z?a?(2|5O=@Xa0}Nj>(k4*nEG!Vg{V6c3h|z%D@AID@tak_$u!1EQ?!o8|lktkVda; z>sL`F#U2cdZT~l8vsr>1A4v8)`by+t&Fk^GHdg-=$YM-s2bPd)+9 zIfY3GJrb-moGi`yJC&WlNhW}0DzL(G*_l3$m=Y8w6$vndVtC;#JM&Fz8uJayna1z& zuYC*6d-104f#n>W&$GU0@FM&hytHm_qZ2OXqV_E4S8Rohf#BE}pyZy!?U8oLMbotb zH&gX@W91PWi(UE)H+x-7XDYXs!nJVMXwBWkqo*zklp{7)`$r-;4n!D`UK&0>n1Pzi z|IalI7JV3mA&r?){LofyAF)1Q;%cP%XTS#n4Un8KbGYuEN2y^Q>T0&nGA!p+{!H2ut)^IF$h%XP2C&7MBR(x`x2DM zcUn*6ra=HiCt$y=RWur3gdES4jY~}s(h&T!U;`K;ALzF@Y&YE;YQH`$M%^g1-Qv%+ zKD|ds+Gf|AqxK+p`O6(a%05+XKI>~&)c%)@^^bF>jAP#W3r#HD;FS;nvLLt5xA%dN zDDcJK32XIHG(bpz7)5p4&UdiJi6J^7g7BRimkN3|9)j6FQ|Z+XdNW}%{HiW;AN+`` zVG{;LhodQRGk$8TNmj#E`P|Bik-bu~-M7+n(h~a8_1cD9R;v&C_ohl#ztTwR1ezXv zHqt_P$w#}kN?sVEPOb*@RlCAf=7)nDD9z7XfoRAfa9)(T|()$!p=mhC0{qz@KqS>KM~>9)MHdyBc@ z^7dZe2p-B3v!K!n&;+ZZ&lKf@0ck~*#}k(0vr3#<~B1}n#7lgYuv4k^oS48Jr>t`Nwx3 zfi>k+6^?gM8^DKefJYE-G)o6@DJZo9-=~OcWPCU82kgdY6>Wm-ABA2@E_E0R2aR7SRE-FTw_w-}1puc6d`e zp8r3F2kN{)1GtFj==q184{ha6_PvWyrGX!cXOpc$KXHFv+50?lI#b|5T{*CXFMnUC5Q1k=3Ra%h$Y`CKQR-Ub#_J4a7D)^N_aQq#&MfcsB$y+r4 z7*nm7??sWHVkwHTX4(5y>&S55)7aM&0TWV4*J1#VeIEg)PJQMfCs4_!KrKdgHy39R z+hgGgUc0hjdn_H_*ptL_GiI-UAEA%W7A9zlTJU&~Qwto(3%9E~*PqC$2pY0R-?!+8 zUS|&4U!WoU4r~;^29YfdU0oKa5vSS&IMhIsoix{=rW%9LJm4R9J%w2T)N5XwWEM(f zJ=XzC$RnGk&R~!qAcbXWqzSoAedf#=bu~87YJ0vb(ch2INbZkYq=0q$e;mEm ztG}9A-s@~}yT$zP-D@7Y^QV@Ldv5E2ewd*^z2uG#!4grNAccnS#6QPWct&LZyTqb* zNODTbb$s!YX0}w{Vu2DKH@Qs#8V~?7mlBt+Tv4>f=zskW+xW?J%c`HnZM}mpTLA90 zJI`s-OkjYTLV+$ZUJG2%THM1NaI5lS^BDkh;owsFJKixd{_8$e!=<)SVEI4LeFpr0 zP&P|55oD6w6# z!2+OhAD|yIyX`J+^TC4T=YKTUEd+~^@vOF0Kl~7Li#e4_(1F`Tb%vRAaIT7dv@`my z2%gU8eikIl9{`0^$iBUJyi|RnX!}<*^Nn8IUT^1e_*RQybs4l~kDRFY-{ZTXD0LIw zlSH6!8mQzg1#p|Zr-iy;jRADn%vrd;G*bQmG#575^m_~?1AlX5_mag74L{rl?YXyL zv)Uz(86l(Z1!v&4de&ECOz0lBe>sIA492sOg7m8%clYt(!yNb8%LaXPyRNg)(McYzMb*eWJBwdMqPwnwgW_f<=z-Mk z4pg7sT~`2D@fXlxEoX9QdUjS0blzGTt<>m+%|RWZ=@UE(svAwr{&9aXF)UTFZO|1~ z`;)G=wzinr@*(#*)Civ$7BsQGYXEVbAhHWB73(&Bb8~Z3=TD`uBH6*a&Mku!K#_%H zHvF@FG1#Nl`#`Rj(&?y2`J@&=Y-OleexWauIQ~VWAstv36`LkN42 zVc@7*4*~-Nv!dSG4i&YG<$=z>4lQ(1GM1K>o8Je~3E7j0ga&sXa>~$8eS9dvrB@o) z&ErPT8qPaGK|!WqiL=0FR1h`=jx>+~IW0)*?}LK?GA`DEO4{GJh|ed?1tkIJCbERT z;)y?Xnyq3ja~tUix_WbZ?mEHzr>9Lwgx!n4MDtZV%Y#}2{(ZlPKDGNh>yihdQ$84{ z@ieVHqGbMSy#eSM$&9k-0c|c~D+X+^1g9X2DG6_?nqxn-`W+g@sGehjqf8@ht9PWp z*-nNBtI5E@v;b$rjDMXQXTow+=kf#`Rze0f6BB!H1i-Tb(q#0Sx(nLr$so<28L&Ts z*bit(dJJwJ^H;I2-uHkj^m3pbF)b^rB6N3n+7{dsZ8{>xjzyDS)*R zz`d7uTdU{lvjY3!Z%P+CMY)^$ksW)S-OE|Eqosx z!roTstRzS2Go1#F%cBAiIPgrPn93Ew zzDU8cPWK?Bhzw}T=JPi>dX?Hox!{nBkC=iY`2YkOZJOfI5B==}XlxCU9LeHv_j9}8 zXfG4sEBntp1!vgaiMfxd%N?*P86FsO*&JT3+1cpM*6)}fFM57L$>-lLtp*})&4g(02+6KFLN`UeE?_GZw4Z@dotqzVn>8F&mH6R$jQ zAHv}BWG^^ceSiIRvf@DS{hxjGU$Kb>p?7ioeeeG*un}IU{WJ0a?{Zw~gY`$yblkl4 zAM)mgxPIC-1<(!h_ipZA{_gSq_b{NVe~oJXuc!fS_-B0je?|TOd#&~bM|-qSK}UNW zDc*6Bp`!K8drp2y6-(8`ULwnCv080;s^@-jpXGtp;(f~m^+j#UOtr;3dp~x6Oa;rzv%II{Gt0WT;m4EBl(E= zfDdOFzB&_<&QB1dgA^1jdv8K3Ew?jOq&( z0Sc4cOYq`9CJWq@f*RcC!^1CEq5EKf55(^u_Nd{A)sli=EQQpM?Vh*D(qdJFwI-G4 z=x*_<%E>=?T~y2~qhl3xa3LQD1LrwTQc{YnoMmK^>9lM}7PV|AW9X~+WYI_kKlc_-eiej%h`0@ZDE76q+86JWt>UDbIh%M9us_%17lYI z$C-=vY$7(jPa*yHZ2)qn`y4U^sS?W-FoaiG4_*veubaB=V0UXGm^dVQ{Z3)&(!Gfm zm2;0EV=X^OsaVh`E}Y%XE--J?9n?Gg0A!JFbK&sDDU5Ke``w&L8Z9c_jA}4{$MWo+~OYma~#i zXBOCbM$24UV`4%qnQP>yKnW4-%$2_ z4TS9V#S-ad@mvfpTJPqIw5&9ujP8##Xrf_*l9z=D@}f>Tvcudg`+*Xg2TGz}^(6!& zyfkuPq6zXM0J`wNhe9KS21MvLhigVsjl6#Fw=k2@2;)j=a>-c$aS&p{T(UxAG6?VM zS|8!iPz0%|F1+$Ee?*a|XYR zTxgx?&P)CHV5%t23E>}4=k_dkT|JTf5xyfk_Isntm~5AD7Dkv=s$Mz0b_tT5 zj}IY0HuXm;;ADCqA3$AE?cyWlv$E-f8#bwRF$@~2f@-2UVc-a084=8(A5jse>&~HU z`z@s04|ZRbQSAs`?VtRt$DHKQNYmY2#ul?%Hm;0(l)cZt6_~UHcVU0fS9;Oe z5@tAmm61u9nsHAe@y01%&vUAgo-AsnxPmpPJ%icUJ+5e2=qAB;K8%_U#8NQPBz*L4 zKJ-M$=&6v=AMTPs*Sr8l7Aedc2exGnf^+Y@aNib^k&}vhXpD913->4WxzFX#Ucd80mma@LdAPjllnzGp(hLNajR0?Nwzxq_n;nEkEE^DnFzoI2; z9G)t>cDk@(TR8`3+KeQ_LMb6o(}mm<`IBj3`o{X;$m-J<9R&o-o}I!{CHPvs!yf<@p**gV*&3#`2;G}(muwqDE+fr-|@W?x2!y<3cT``k) zw{ak^=@@BiO!`EKbz6#x1f{P;eHZQ+##RCh1B{#*sKWGF$h4vW&M)J707xw`o;mUp zdDsMRlMN8UdEz5Bom+-0b>zRnBrtTEHE8VlT4POA%IM>Uy zVvfeekAE(ZbRBBIINk9h!UAgKV~||iaxwS1?&0uDQ4P-O2m2CS0!KE_8*7Oai-T0JP@cI-FM zJeNLo-b!239qC5XZDGy8i)F3y9pSri<1&pJuKq)+oNG_!N4=|3hh&U_IJa?@hALEB zHEPHmG(EoXgpHz3ZC@wwr=Qig7fU>k<)Ki!=*Z6Zg$7wJPJ-3}Dgs$B3iw~6xbUr* z5I1>Y*#D0AHHU9IVc`k7+r?#Yk+Nq#tLJ*vY~SJ=h>|auPaHpeiifen#MDx*AthZObFO0OY-g@b16Z#o|9Z=Edz~9qQLRV!9 zr|fgcpDdT`fZMAa9Hl0kwl>$Zg#%X`mFO!3a4iT+Tj#pzruju#dHJat;tFpjzyz3V zEq6Y~CRub!A;=|@dy?{;V%B)OPJyqJVr8_>%9;+|MsSb_V}tF>qE8YH4YMDv%#^?R zLWT3h&qo8LZ-a3M?ij@F1&u(A3J%EM4s=y(3Jhntw$#fllUqG^cbj_KiIGLE=KG2R z)3*zl1ap26a-_5D-DM92q-2-UBk{ie=5UluBj5JCwTyh*8k^bOpkY~E5#n19{IDtPyNlm1GyALsU(0>dL5tlRRnRzPRP zZy?KMNe$4v{vn7FXoyc{N6Dlq#@uu}rPOI{r*X=pb}n2m7;^<6oe5Q*>C7Tv2@1BB zx#ILPpTH4}+?CnM`mG{6Zq3`@14JX+;dkh)KQRJX=%K;X<;S=LK1Q+c_PQ_rTFtt^)I3PFuc&opmp9$kGCWc}v`95{>DATwh&bvOZt0xwm1FSO6hcD}U@|u9 zf%Ll%HE13h63aTf>=V=r3-vdDo?%}g=y8-Ysr^vOgrQw&?W>yold8>vF61Bkvp~W3hVjubH)_05-nxt9!(*vSk8uwO zBy!sk@YlW7{g?h-90X4GHnyHG9v?0V#<^QsRxI&tT1L@)8Pv0ui1o;K$z{P1n5mjwmdwt@}wX-d?&eAF8(`xSB!e9X@2e zygg2MQQ*$*1@+3WIj_}%`gvRUNOh7cN_f~PcFNNoYQL#QbKjOI`oXM4sYz=!EjYAX zdd+6MOpJ-wBg^$x>9`Xk+4_|kaif*w+gN(MwISe@l9v_Q_OD5>gI5YrA5j1ASITi2 z_DI+Mk*0(&Pnh6*GNQ#M{eDz$2dTberxo6=(^WlZi{i3Ys37BElaSj@8nWo;(8;sI z%eL}6Agh1frvFA*XkdW_w`pG$;E(g`%!x;B<^%GM2fPQO{=qe31u%Rk1b$5YnQ@-B zrnXpSy=7?;jUGs(hBr zrPAShJL0YX!-TUxcVNS?qBx7t1mn3E({wDlUOVJ=#Lus( zM|4EB7HsKR0k$0_LW6YlF&Vg7zZxqqD;vSllhc**C8uPf%^5b+LHD}Aw5j@|u9Ax% z-pYW^?&dP%3j|Cq7mn9;7&(^c$)~$MMwFgu8x}JpHK?!0JY2FG`g+)9-aE+S?A4^! zfGeCc-wcIymlFuh^YZSr#hM;a*7Is{tlC&uS$P{E>{iJf*;lJ@#ea@%U9dLSzWn@J zMm$X5O8H7Q^{=oR2nXN`_A$Ot%}wh5;*3rU&$dJr-8adXwXukDEF(3Dco()gUWmp} z@tHl!e|1flK|rhDHMp0DyDjFmT7i*gqsW~&mw_IOa4yp|hDDb+tkbyk^A*NI3>+f} z&*aCuTZH76E}z8jd%Uldp5X1z3eA?c={hh6k&7X=!IF}XIhk#oq-K2ndui2zJ)}P{!-{9vjg7zS3brE zts~Yu`%)G;%me8cW9{-yW-1)Ld$|(0mmHtZe8D)wX@4ZnnPyOJt(9k?Q_OPc5}q|) zkQlDGoYuCUVm>%ae@P-w=6O8d!dXT?{9?ian-*iipBwPYBzAMzIcGmWF|Fs`n-#8H zyCOU?#~9|rDC-esW$*5<^GfCIuP8Vzj>H|l%w2AgDK&T1d9bd(V`*B>vg;Dg&FlQq zXDH4IrQG?}{@L=6a2#$;+B==3&d-SIJDBxBfEXdTUw6PBJ~G)Ncly(aJfqjB+negr zz8;s9Gva|C7JzA7S{ehUah%TjA1@7eeNnWM-IpFBvQHe=Pcz(w)7x9zVocfFmchz; zLlglsZR`CZVQOOW!MIu@O08u-dC_!WW%o@8K(*<~#6miD=?SU|UJgF@4RcTtsAe8TvbmQL}+v(0aRNZh?L z2Y;f1$v; zCC8b4-kXsnj#@HVnt$PFnGS5b|M>aM#pS~?;|t`BG-o%RdvgsvI#QO`4pEsxqq458 zNeTj9cl?+S>*H$coTp2K@GS9|+e9KW3eE_2j@2XI?02sYBl`ozXZ70=s+|(q)0t7N zoZI)gw(p0YK1uljo_mt0W4nS=!CyL2e}s2w+(8`24%hM}DpYJgr9^M@qaJs{SG( zn|TV+Zf{_i%CSp?_lY%u=M6L4FZI{Kh6PqcnS)updb$&R)JfMZcFKx=GcM+ZW?&s`hMi<7yMOH(9Dgl^QJ#zZj=EtPnEu zDtQF+qp;K-gQOLFv}O&$H5 zd9iV&e^eO3uLY**QaKo-Mm}c{m9Ixs+!MiPoTo{paP(o`A#7{OT=k|QZFThvJlHKF zBhh_Fl&L+EP)}{+6rV1GC;5~C`9rVo$N9QCu6mUb{2P9jD1CcuHs8RPj^}C*Gc z3s0(G=^`;vJPz#6Ybw7_S5QB57M_?s4E^$bBA~V5-oc2xB=t#N_a6=jq`C#{b4ora z+PHmC-{LNsR}p?_641{7IH~PY@UqQ{dFD)P-;DdGcr8ZGy)5094!Homt~=*6HGO8f zJ~rgh-0~tqjp>ds*s|E1ciyVHa#O}$Tv^%Fv@uwCtzAd{j=2@rT!{MWJu(6^Jt2q^gg=bF_0*|;o$eYN>wFa^rNB)f7Ch23Uy5J~Rd zXkpwvQ#HTE;#6Pf&QhiR?3%l|Z*zK_V`$|or3Cx;cq`+>R_R~Ug-J_S!lF=KVWv=f%qpu0Tka&-{mwwt^go4hRNB^Xad)a0Ls?oZW15 z6)5N*wH{JuWk+nQrA;mqZz=p-5zy2Oc{X54Q13}I*%arP>($S&>ec6kxB4bb#9@I0 z`w1&yVhO5myCxKWMrgCsjN&W_JjIf^2C<3EmE=$1kIpQT3J!3&l#83 z9W@*7PVZngc8}$6U+ec20 zjeg9~E0ZIE0499-7B_=uXUtj}Qz;e#M!1GwHt8SeT3QZ!6WH$r404)1yjZBV&4?XT z*5#H$%`w7vRh$4a&X+)0KItT8b9N&*d1K%6iZ9l;X>fwUXT9gho8Qo{@gcPr3Q zet@qH?i#)>BTrLY7g7S};gbJ+@wKw<^A{cLnV60ZUtqX*m6qU@>oeMeWrzbA`Q;pe zWn{UDdyx>Ts1j9VZa1#FvpN5R()wJGNub9@$>sWQ0gfIT&JAQlEuwyxBvv~RswRa0 z%J;x}1R+X)@1yM4VS!4>WYPh4ThTcQz2HZaE3>Rx>_OF|X{3UO-xLI9-n=S%RY%SC zI6mVp9->stq?CVPgnI4h(A+gGF)B`2lCyhCl<2-BCf}-cXpIP;==5&QQDIb4s+R3J zmMpGyZG59^pfAz50E7@Dh7-jqE$*yW%I zgM6iVF8_A3(B|5vAHrQh>DZ&oF^DiR<&NBAwC&LOP$^<3bFqB7Y^f{;Bd9FTE#orB z#u#Sk=;SXSDu_rt<0jxR!5Dr!;+Yxg`cJDM6LUqFsF$a9Fdkb`4)RkSi}h+GjbE4X zlq=do%j)YYr@{v#(V}brj6^!Tbad%%AVOQgJ326?$g4AGD}WYc_3c;siLH`7%=doS zq2l<(1NSzH81Jt{r++P%j(2kmSjkIL&KP-O<{{nisSfc@U?$+2yRC1tjr|G~_t~!Y zEs~RSq~*c^>qzZxQK`)JF4FCPJe0Hdvn7Af;rp${%ADB&dWl@7e`8S2W$^3o{o7OSA4)t1{P zy6Fn!q74rO9+hycN7=k#kBpdaRE~bj*rc52rE!y`y?e_>0O%gC7x6Ffs1g#1wk82D zInwrcX^F+3-<)3YF~~QAWVRNtNHbX#kW%#VQG`~E2~l1g=B^B!8i(I;Vn0q-NAJb& z@=tHD7fxOQ{>E!$X-nppHEhpLO1T-^hmUo&U|$Gr!Hyh?lgjz3^V2z+W#9eT%3@Lg ziNj=rLYtSNAxSifiJ*S&#*e?|vfQx6;ThT*BA-2y0K}G*%IJ74|9AoR)p@iv(4eiM zDOXQu?GjM{B33_5@z>LvloErl)z{%BDj8V=mUR`ps?kcs*XD`rq3J?kWK5h`|KCyEcaayUmLN8;V5YHyfZSP7bwB5{Q%hrV-u^}5l+S&fPje%vdZWdx$0ODMN91U`Y znZ04T`m1v<#XV=HX`0-buse8XH$x)ZViborCq)H#buLi!*FWyN2b{6gZ29?yTkbOZ zURiXrI&7+7%JK|LyD@C7oNp!vMj2&JS*f^1 z%5yjO$vU~C$yloVOiRruwI}Y{Or;v>^hl8H8>`$388&{@-Sy8`7-WAs{&*S;@!O!Uc0Um9*)+tq_lRc6qv z}2I`${Io?W!I-h*jP zX5EL+OhM!Cl7<#Vn)S%6D9Le~UOftLyA-&CjFj$*;U!{TWi=o#9jXEyxRuSN9q*$; zq28{9I4-qrm?m+F>P;JvcyOEBIrHJ>{HvF1qaW)7l0`+)8(Yp{_O>)pYv~b zr{b?2@^!eIUmUZ2PbOedmb!LJ-B?7sNWFUBrci(B-RbU`SM`NPYV&J=Z@orx5e7_D zfB1efzKQ4$3@d&FkdvOgV1`L}33b^=8dR(RMSU3y$im268dMoVC2~Bu+E-U#iAw6$ z78V8!B2GzU{28>>-x$(1PZ$^KgmD42yhJfs8QrSI$54!T5tZHWFS&EKt1GVn}>R%J-t5a$S;ULFSoqN4IFr}sFodwZ> z0UOl7uNd#jg6Vt{x6s5dm1Oyc^f^Zmh<}mkG-2i?G zP*XIX2pgY*wQrg@b(=c%nD%yk;9UIG$cb;o!;B~SeexOycGBO|Pl`Ln^Kz7?J}p@O z$Lsg}K#G&^%S(t+1>zYnkQnwS*wF6&0BKMVLCXi$15B~4nh@c{cbi<1N|etPUQ++y z!C5a(bo()jpndOP%hyhq!G*fAht)?v6mef9=-@T>h@Cm+qz_kh{2@AO+;K<=NfKEQ zBb}@(>yCSyUl9!M4R*rn?vU23uHS#yp&&bo`FD`(_uo^k!wrx_{LAjvOq9NOR@XRo zdnTFYUbpB2T;Pt0GDP*b=KT?174$*4m)y4;z?6eY!kK2q9+lOqlig~O89ayyOZORm zzwl;t$WUdwg>lALXxiB*FLGC=Bpv<75A?KGv`u}2AZ$f|tv$RtO72qN(dji#6KGwVw+W^iuZH_U|VnT z|0T$Q-(4wY7ZI&{DWW;;@j`n;cg*f*J3c+j5XH~Vp2wyjm|)b?W3F->Su+Z~pFnM_ zAa`m~zRAo|ZFnZ2~A7PguK}B+Iw6$u?8oHZNdfR%D9b{n~C9vpU>!U4Z5 zR9R1hOlbsG=MpNwL;aUHpeF#P`G6Rp`-~zM7!rHmWf~2u{Tx%7AsmpT^klIit?=#k zcYCQqT%wTI4nq$(ELssGi7-jdsWY?0oP3M^i=rP2d2sF>s&?s(IkP;6rJPKc{OV1l z+N+YHv(ecU2~)f7O#YCP+e9HL4&Ce=*wK8gli54j%?G9CPlF9Y{8NrAVhnyFTG;<> zmkC#jZG829=bas34z{%Yrj}rpa@BKU;#Ka@+EM)|5_^fJSsa*nK$dJSTb%ZxjdoviYdl9 z)7w}vdUiJ_(S?1%87L#Y>k@DLp;HF{->8Vt`)gu6alA*s(m@t4dI;acr;AaE+I!ldU?kv33yQ;o#RzRa0^5POvMkd zporiGa2iN|7`KC^-9>`KtJ)%N0&W#4ZAl74jR8iLJU$MoZM*dv@|2BDx8OQr-ZJ z;~^JLhYdo`%g6jXIgDVD)1)fUa8Ua4rJq<#L?Sf=NdWeimC(3+#et|Ei^HBAwNu86j>rYZa>g#w z5dAsHro_Fwzo78~lX&#**7iYZ5pAH`@Q3?Pqd?w(W^xYmU(^K&)WxJkuSR5F{9Ohu zD+K;!F8Fn{4LoU0t*gv=zRae>1`Lj$yNQ&BuDgAyx!^L5;7zR721NYamlnk()Ub(p zc=QWO7VBt$Ali3ie~`TW`Qd_}w2>r^)OK!xX+E=hr8qcerAM3$($$A<#$B}apdok}9lb)Zk|HLHQXy3k`P^!{7Z_Nw&9DyFj(;d5DMn7&pQev3c=fY@$)@kN|aN99y(d!!hOI^DHiT9pq3PouD&Wi|1$bUTie zwFhF|d)q&Lr~k!?TWGN|sbFw(+z9c|rF+=XWE(wX(DRQ5~lF}&gnWE$Pt z;*<)%s+Cr?Za9wIRc|6RQc$_|3j6Mgz$-TC8I=NEKJ_M=#j{@MGaxRG`?t8*0a%Vd zsWzMjS46UJJ-MoPpBX@(^*B_P`@#w*fijgk8dTh!ff>S&or2{~l z*#Gd^|5xBw)3yi0>A&~`7H&68q|_m%88k5Nb{{ zuN{zN!9j}m-{6sI>K;=45s$Ou=JA?B`*%e-;{$k3JVEz9Gk~K=Cv~Hnvtx#KPR~yo zBI*rK=_fIu!oS5g0F3|UffHf9zTrA!C?;Pwj)RE z8vuEz?3JzaP;1`dX`rDno6cGQFM&q%Z(gpNzQ@N;@1%9_Pp+Gxfl7kK*cgopckXeb z!k(OEs!n@k^rP^^u+*7G<=B`<*N?xp&o&T{Y79KJ_U09q8Qdl981B=DVGD zTj0F5bF^iSS(pQ1ZlS4Lpt5pVM~|@OaZS9O+r-9j7of+CPsO}*{U&Yek%j#yfuZq} zlA(?M_ANV|8p9u(J%{+#vZr`Y!4Z>mHe=(_PECj|9#H_EvfhjWhcf@ctGhD)a-eci zgTwd6 znx5IR^n3me>QB1Q(P4}l=nHiDyL|1G``0I^p$w)b+&o8@wraSV*%n3u z&OTeBCQ>$6SO#9u391P%V0Z?B9PlvaE~!J(Zo(nc8sYUv;0#?zufmRsGJ$buiZmo6 z!1BdiVXjYoaQUfG=tRg9NdgfLUx!?NYSP!~JZ&(fB9%i;dfID&Ubw1BTk!$lZPPvb zQc-T6DUM#RuYkDX;~?5~Txox=WWb#8 z4k+TB*M`r2hp5}vP%*(a$YM}NLHQMR#!EmlV+!`_e2nsm_k+Z3|3!iq#S|oF&~M^@ zpD0l8AhN%ITg`4%u5?m-h1b?xFj_zES8EyrETBE8!Sbld9I! zMaIx5?=B+pRKMgBc6iPw!F~-|GFz}@_y6}x25`L=98c;JEpY#+gdFxxO51`JHxjJq zed-_Yx(!mu?JLeQ+Gf+v!+%hU2EZJmWWQP<6&x5$SC2UDmJ`;aW%-`6U-Lf1G^zTn zTIZHp{8(*G^0~3lBYp||dEN&!07Z^O!x+=#lM`$LPw9FP z>PN-O%oSS34S5wGm9AgM{ox~ah^&~$9FhL{dk4R84J0Qj)Sj%08)A&g*IUEbCQ#zo z{rQYh@g%N{jw3KSrL@gdkT5k>ATcZs`*dxsnv48CP6qQIVGZB_%IP(4!hFA)m=%U| z-D4Se_VM!FOwE0Niu8t;KqY>M7>Ehu3dDncIe6bSkNlN$j}P4Vk$4YcSX{^0^#-u(iL@Lw6|b@)@@2bO>z7{NR=_5SYKm|bZ8 z?&O{F6*XA%i4cIh8l(&{_?`gKzo+^)R^^4XW9de|H08e>ssG1Y0ZVsp_a`-)HnjA& z`N2gR-AG?AGH8r;ABcfj?|^RY0YfYe)@Kn7S{;ae4|uh3J3#MVLpv=N`^dNAdOVAZ zng=DHeD8y?uswfTe;d^!-mT&%7MQ0Ybg%8d<|f7g;_4>;=7;`n7<}^e3RutlVIdh< zcc{Jq&N93Nm#Rl&LBbTHT)bWZaCn`m0mCi`TwDXM_=jQl0JteXz6?HeTO5>DXmP+a zw(NhR09G~_0uk!}TnaYeXCwa?u1oW!Um?h#LQ>E2p@_2JQupvDvGRF&*@1ZuKLLvo zOq@Ru7|gmvCG(hd8mq@%S(nylsSrPXIY-&-L>Z7;g*ev&c@4EUNzPW`Sj zPkcGscDWqO`2M!pTud!2I~8e_bYM|14#6=C+W@<0pTRl1I2j}*+H~LT4N;fjh@SrV z#4rnPCISUQm8MG1&CO-;I{VfM{TvDG%~N<_l)FOh?zhRk*@eVs1;@UU6~|6aof(0( zw#v+bLp&LxyiJvXJp%129IS?mI*Bc-W1e#f z8kkz!q1@l8-Ec0toEir0e`@Gr40_3L-XvyNC$NEVA>?tt|4Yeg0w2ZIX_K&?LMe zNhbuy;Dt%xWLT@51jSBf$=Me1^ylQWRt>vxPhEVwo%U=`{9xll{7%)!wycF4_gdR% zMQJ-t3i^_|wU~BkW%OJPkRnwyCB4C=QZ0?jsLnq=ClmRDpoK9u>>x<%1bGx|(eWM-WHXc*1P%0ML<4s=$AN{hKP(A3E&_!xq0)QG}Z`sJ+$6T@TFf zy&dqZpQ!!z7OQqK7g12757WZ$F7LBI2V1sRUj~}0VQe+xJwh&$(x-!`=1bTw+h4fN z-(3k3Awh7DS9%z@w3WSNfNK?d#1|NT+X!>4oKI^Wz{Tt2u^uATJ=qC-(&{K_7aB#` zzFBcOjV{Cc3&XX7D_ud{L0Ze(ovW{af?%A;0dTUHq=m!?!Lq4q3baJIPvSr0JNM_c zb0WE#;{7N+GnM)ok#!Y=!WOz61SAc8=?xX zGYc{)Stn56Fngn`FTU~aV}=Q$;8Bl*!=&=ti?qE#bsMg69km(Uy~7G=Eu&+rCYhZS z#HW)%J<1I_W#1iAf%0c;X~N@E-jd|O26PANM`75>CzpmoyM@EbL3h+>k~4-^_n{A; zF$AI;0EI_6WWGU=)o`Kml3&qj&-fSVy>Qtnv9VZ}PO z#M&ZSGcQMmbezMSW*mknvgfsn(;jk@^*8Y&tb{H7;tPrtn24uw5EM158RySvHd5B) z;cIytHzw*%w??)DXC_Ib6c$4oZMJrUB8-{{gcrJrqxLTSLX0{CSnJxIa9gGVce^Ye z;9d$r5YS-C?#tn;;U@U&%8W?-@61Sn<4d2Jt^MJXoh6`{7*iF)QB!#qzHE5OJ0BJn zJI0*a-<4@IodlDlCVY~Da}9#=!)F|OOwV}HsyaRFqqW_KJP}0^y-WJ-j!qt$;208^ zND-tpbaFqYvz$=Sx>_04wny{vDMJs(<)E%tYm5WGL-_ITf6j&Y@r~$oI5>pDUoyHA ztBx(_z6>=9(k4J!^~>PTK2B(*6qcyfDykjK<6=6@1=~R#oOa5*nw&w~FOnye9;fsHixfqS)H5&3|#FOu{gxQEihzOm>HdHe7GyJJ39 zkl+y3v-nXW7d9QWs)ZnO$8jqG#JOOd@TI(iPROp=qCr~I{x_kQL*doZ%0Q6*bU@z! z;j8Bk+DQ9oL(kTcA)=z_9hc#ON5_keJs;anG7fPN8{C9Ku2b!JjxNFeJt#C#`QI(c z|54<~GysPCA87UvAaDsQ)H|SF&JQO1&IaQW+R%6!@~?p#RX7w|qd>?$bRo_k#+q>- z+}9Mi3jQjRMEE{}a2BW*wG_OlC2#=O=7Sel9;;1=Wk?Ect%5N49}cD>U_{)pmAAb$ zPk|bOzd48sp!tQ>_t!BVKw&fs8t{@^WpusZqS{ZQ$O$ z?=L^E7|cUUfJN;Msp*m1ooqJZWSgK~#q3mGXs^b>f2gC@mDoT4Ky~XTem7!&9*;w; z%&AJTP~-ksrmq|Rfl+r^t(1lj$T!k_L z1Ys1R^K=gs9$u{DQ2VAUQG~(Y2YA1E zZcIH(i0U9nBs=zA_DT0c{&fZbAbt3lu)=67|DgccU6fv6l-T1l1;fm^d4uXRuJ@)6 zEY79z?Px$R<6DL7^~(cs!^8Igg_Eog1qb5U*vDVbCQjqc^ZI4YFL*B2^e)T_8JaJT z$JbB;Am}29vg8uFV6bT>RFj6migY(Z1d*SEf?gwHe`vu6`K+8*M8A5p7Ai6qliRyo z4_Wb-?HrRq2V_z)LHSIh&WRLqSbWs_ds|KbxCHmUe#TN402^AJdFR~Da6>CbE_`w%@B2)^xFH_uVuDege$Bc_va(5E=GQ`J9 z4;2bwLtLesV1QJg`MgEadLlgVJ)_D~uC2odss2}-D#EweGhxPgA=uRvF|+J>zLP9B z{FMaSe2`b-0JbP#D~$*Gu@it{O9)UOF#n)x=1ku80BJcU$*E@Z1kObiQ0lSODlhmu zJPzN|PplBH&#`Mybdk3d6L#+=IG1VGW!1Vo%Ze5b&q?_T}|$~AahbEoi^rPc#EH=gHOYr0V>O}uER;#Bk{es6d0GxMJ@$Zp)tkTp8T&^jR} z04PmNuIUF340Rf)Fa$j=55aV)Wx}M#38FIn{OrW7W}mO7>ynO5#?!S#^xa{lm@lK$$rHFIu9L#Hk)Y zu=}J@H7I%;$7LLX+^@fm6UmfU-hg131sD_fA}WB_S-*H^On_+#poR+X$1kU*U@gTN zC-uw9$8k!q)*imWFL{7^wbRl7Zqc5{E`a2)9?v^Q&qHI{b&aK_M}{$xu9e&go_^e} z3l8dIw9+Tkvmz)UqXcrGtz@CN(hyqKP9Z)HO3i@vtB|_@bqvEmxzDFgZVi}>ZL1l{ zNJsq5tGlBpfb&b-S3hV83@^F&!HlQqZfCXW;J0=Sk49@#>A#MOif z{V0nT&8qVV6fFLtYkYBb5CbY7H@!N0%NE2JvwrvM8Lmz8RWjpXAy^87P7vUIZ$qgN zKuVyk`F7Dp8`@SjOnc=#pML+ zVY0q_J<*EuW>^_SM|MUQ&>_HDZ%6}43daOr+g!Sguc|6*&@ z>W-s|i;I6-ZPXm-ws&;c{m0ov*E@{pFjhGt2FPp|f_b06d>J-=qvAKYZI8rg`Fk$~ zNV=cEcVzJTZ)22814{}$hLB;909umvt7O;I(0Euj?V5dVx-ng|1l)qnpm6Qg-pm5Q zL`}M8PYIQHn1u=k6Edm(?lA_f%NAOKl?HLqb^i|q8n1D*(6IAu51ijM6I4%b1HK;d z&CUIifGk!ITq(K`%5PA9=ZkNBQLhLSC@?vcnC!mY&Iwz7!F~JXETOGDioNy|s`kGL zsqMv-BV0vrpYifBR5c2u)e1{!If80VkX75qYx!&GpvWloN|IY%0&)xF4uBm%0YM(| zCfb)1prH3q!RrHr&JPzVcQEl8+Cn{cY5(s&bhbcw@fj2x{hiKQ`I{zAzd}wVX zKW4(JO3q0aRKez*wD}P4`(X1EU&b{7R_f1-Xv(Yr!=!iF?sLa@0BqLf<7+5dm_R?r z#=}TjiajILl$C#{ga6}@3;dEhxT?+I?FArHEN9d{P+vssws&bM&k-c`07Z1YZdI{F z)ZX2#GDs3rL(@}%ecuUp6Xi-tMWm@J|K1pc9(w^mA4(@~ydb_|ZfSOd zqCO%9DB9^~@m&;DB+$Fd$JbC!E@w28@S7-xO^-EH9buV=S50)nvpuv2kxZDN4) zyL^l>ssQQf`Si20!xl2@Ho=YRG*9RCg4PcH75GB5`RQN(U=QpL-KEu$KqF$)Wrpxr z3eeh!W}zr%78s(1GHCS+E=Q z8G~R(j6n+evSFHDT8vyEV_}Ive79RQ6?_i*wbM#n|an&5rRlS&N-tyo#r7@tn+`_EhY`{u^AwvcJJm5zZ4-%BN zkdFYzV$*_!cKS?g2|7$Aa|YCk)sus@y?jhHdmnoJitCX6QIwi)7+7S*iw}+$C%}a) z`D$G{XE5e}4p+L=KY)9!fV}zg?%Ie#UfsEC{^RZfM{tMKm#7hUljTZ?Yvq^(Zh(q& ze;<2!$zFPZ-}8vF8PL8%J3Hqk(=E+1p?U5eG}G!#`8pG=o9a&d9( z8favky#dw{+J*nBt@9+~zJ{^_sR;j66*xnv>3W_yOm$QH-A|o4>-npL|E<~}h-rS<%sn|enYqZj zNG~o{&Z|8()7ue;?>IQG-oG^OP;w>g^BV%xT99>FS=$`o$3T1U1z0MBUKKk!HnFER0hPCXV;A5+ma>HAde-I5^&n4Z*3TKpwz&F(A4DgCRGPgMUc!n}!L0;tPQy{4h1=JFH5DJ|amr_pDwiHK!94=Bg#7a*EGo|0MIh$iT?&QGA9$sMO! z(RKeIWOLx)I`gK4o_a-j+7IYqD%B?#?+k~O)$zj9fuX9LcX>6}70wYvt6HCv6Xs)#(H z%PExR^QYPby#!wUSzFty)Acx7;sibZ^f;fu*F#uGx z@5Eh6WtlX`8YJ#H&gCoMqcHbw$_{*1>mH_qjD+SG2y3Mjq|a(wB(z12XS0q=edKD% z5ItSy)KM?n;oxck=Vuuq7fWhT#M7~zJ%h7}pDo0=Al1a^MUY`*K(9eJF+ka*0FzEv zeoMQ?wM1yM{(9xn`ntu@PV&WiB-8p;a`Jz0B;bsjyMqdypuy@FL4n=Ar%QgKrztz~ zgw9YoIM>4`;i{ak7C)&e1}<~!YE1>ew#FYvd@3N)s;-oN`^`FX6(Ze0BiB?;4bavl zS}Eq47^~gvdJK)0BiT$pk(w>ax^9T~+ zTk(-^t#P3Dkf7iuwH!$-@Za8d!`hY9b{h))YIHzxcHu`EM%t$geSZp~Ti#cfDoF{tg2O-C z_?;&UZDQT|rCh7VMLpp&Q^!Bj4bHSZETgKFD#QqsZROo&iYJ8-r{??o)12{#gllKq z;SV@3N)GlslU;L_&RYu!%{c_eU&a-*aOb`Y!#WzDX=p{~!s>5PfBl2&nB1J1z2(DZ z8YrZucI#w+IP{derD>CRoWwYo)A)3jM5Ef?hs403cq*bmU6L$2@pR628|BgS>tMO> zM!k(yYUWBB||iu+P}3 z{lf(~`%U;%D6q8Nl=&4&V4Gyz9$CjzsR7bJ8sqcVlE1(68iWaHSO4iybtcO}!Us>Q z4|^+8nw<t_N*vt}Jn2S$l!Bl`PeK@R~>fVtKp2&HEegI!<4}ZRUCS4=Ej8o z^YGMZd-=r3dih-!>-=cSu!YpEnK@Am_H!cEd5L{d?Om>xJd@H?+mO;h{_PXm;mJX! z3gk0E5KO{<_quJ=FhcDBtXx4`<81&)jbrjcCwR#2t3%gYF^PR3K#EWH^>nq%cBtp+ zQ>Rzz>JRFUx~<_3-|GeD;V!oF_=_DpmcV$`iU(Cm(-6!4`9ro#ez)aGfWENZU7B(E zm^=$PL3j6zs(2d9IFN@?rwS;g!nb_MV3(rFgg+)?$?I3jgcxhJia3+JJ$CbJf%Gqx zlVCk%sR@-dQY_=hh(vm|8JjX}=7+-?&-Q8U3K-(M+kEo#$|YDIKXhgh-gvcy`m(Q? zpM}4egWXP--*g!tdj9^-e)8nEU04$E(=1~mGPu0)tG zpWzBTEBh!d?0Z3zU@kn)HqBbRR;2FM1;>-a`@ONo5@el~$0^E-XYTzTU4%#P@J*S9 zot`eTR_84zJ=e4FOU#B4krL7KtW<1U)rsqSK4vIrDXeJK1UL@?w6kzTp3S7@$tvX$YJuJrZ$E{57!whfWxirC?3 zU*c!->FG_l=i1Z}-cg8&VdIS8f=RQqw+<7rRkqm)>zNc*%S*$spoY-Ybu$h@JMF+y z=Sh{5Hvur6VD$cDLKh3|Ly~)zT|W%8SCQ%iZM8n33ioh=-JE84$3sa+`59kn>=!6U zl~7Voxs8&B>m9!%%(rVZR$S2q{@|12q=9qc$53M(#QY~?`Sc_I{e`?X{&_i1cWKf0 zf~RddX)n}J)tq+X+xWlQ{(9@QAX)B3jF8gocbwBW^A(snxaGG;CXk<@kEB(-; z(p$5R98Z-9Tnu1L>g!%!T58vEnldcITE9FqUqhP*YD7%T^9cIUCdA8evIR8JVw?Ke zm-2KeD?87wCl0lfY(^Ixg!sozt!wN2_|fshPrdhMUDF-O5F|FF*;+w=3}( z_HO9(_~|qLaiwGXSt%wJ_s+{U(^yMHo*{FvDD{F4c*nP5HTf;|k2}ma!cUNus+Cn_ za!lsTxMcI%i^u>Ip{j8WqEHj-;$A>+-9`#q&I#HDft+@rlQstzgPu)K0CnWt5;xMw zvtHjpe=>XHNi|};bXjNYWvzPtv~d#-y>*}MR(xT)?%z#w$T4(Ajdk(t?#T=)sH)oP zicK@wsM-36OuddJ+4hH zkT0m~iRYGW2_{=1lhhKadl|n5$`WB;7TzK{`DX2C|1~?UF386(xmQ4zxWBkHAQ5Kd zK|VQE5FLiSei~J#VcXNy!@r<5s?*GzB)IYh5v{+X?QSjo)Y2zMYdcn#UpV90jr*?V z?!NOmDq01KS+(z^^ApwhG;f6Pv&hS~E9F)ts`zf^)=b2IA#g#naAsSW;wLsQ80~md zO6=6*!0jt3$U4$vOFw=lCt2OaTxf1M#&3)ip01uJ%*@oxBxaqw;B03}vdBw)n*Ltk z;5mpuqqe}1qN2?T9D5|brS%V=H^1B4s$(LXqj|F!fYTCy-Y;+HPyffsq1r`AaHUd! zVl1d{rO*7&!=kJeUB?FXQj55*xIvFUPt44+Oq{9@{tR`>6OTgtP_TOcy^_!DeQ$v8 z$QR3Iml*#&xC6S2VJD&94DFs^?Lf_)@r%c+Lr%q=ESsfONaPX+@>id$&1z^bFzO3E zpVbeV;woA*vrnYDrW1*REz|<#!>}G2jT^5d!umr-u!!+McAs^a##PAasf(c2l<5=_ z!DKjCmjAn_5bI9({Pldt)~&jl$CtI-#)+wmT!}h=d|-1Ns=H-8h1h=VsQ7UsiT&g} zz6Qp+ZAB9-epnDO1(vs+X;>$+1u4ko^wO-)+!9S5l{788l^6+ZCWd>{opSA7tLe$1zZ%y@6%qMazV$o+q{#woJhcc6&w+wIS=54B(5X(` z)_q$8#!W7Hj(^L0Rv?wCXklH&=EWB)W@M9&!%=+3K{vykaN}G&(}L+Gg%L&n++Y`7 zel?Lu$Vww|OHq}mhJV211Q>){{Nv2d5?NpIn>*9gQRQBjr66Uk&`C zm?QsHp~l&jnG<5{*q!+%*tmZ=I83Mt?=Tes$4ZXy?KSQOJ>5kdK`1qT;7^#sc3Q=7 zdf5F1+>>)f8jd)V*P6>0xlCA=$%u=4>ns=iJ+Mgw_M&zJ1_xwE05a4oa+1@PD5%CO z;(lmz)Xe5F7epJAJ8YG}rou!qRI|U%rF|n*uycvXc|yktOGdLZ*ylqdj_{X3n(Trf z=DR)W>lhoB<<9A6I$CtyYePzAjvK4Ps*7*3q6}DWU(8jV7uWf)Jts4ynIL|s-duUm z`2QX!p5d<+Gu{i_^r3F7E5J=VE5o0M&oOT2WhQqE$es(V_)(5{oSZtUA4mUhhdMt-pAH*lJVZzY*__lIz=X?@NwV;(*s zW4Yj_elD1G@ROhIV^f7mX#;xprfnY-D(P_(Dj?SGonN%yj2H8T0ke=NXOruefAvpI#a*gTH{b95#|{NNl0zHm2Wg=1{%Fn^Q;8{U zSNQ;JzFpO-7g~i%f6L_NNBk|5n|@5->!pN7q6ViStDD->6Q)n&W9;o(1$3j9k1XEbYXJsopgR2{9&h{<;XTid<*85!MTOzIRcpH&glhvi99 zY-Enz5|!t=JK>R2^|xs8hUR6_VhrxqyFN3586}2?O_Z`m@+p*IgBf&m_2u)4U$}== z+Q*wcak$&C4!TK$^^r@7LMilH`2IqwYDEMH_1;5a#X%-m{xh1bX}67b^Zc4`32oio zQCikDDusoGcpNf1P}~oobPa7aEy7Ya8WxA>!$1#dK#|qUlpcjYI@MP8!jvBva7Jp!ef@U$Ockv}&G%Pd9&oregLS zc@-6B(z}rBAr`d?_Ct4oyuDcc2^2U{(rQBGAjB?iw)oyAv&ZwJaQ%L|=_mTa^^sOx zwaUG0wbio+j}lqIp&+7G!5+-(2&ZqZqlur!QNgg7|xbR zLYyxdNv_XDE>2-Je?C(`-K8x3C*fQT-LA?GOVNSkqyfVn6n-aTzQ3c?j>yoh zXVbHfc#IhPUY7aYKAs?2z9^$n9q=N;lfe9hGMN)H4rtR>UO$ZcW&6ZSO`vtMlPT;A zIqoI}N`6mG&S%if5yVnljLJ)&nDRbf#}VrLgxT>IHq!>_-IYgH@XIS>$@K=I!VFkM z%zd{{FZPjWe4o~O77i8gDsjVK+f#cxT+^3$dk2&KWyAR4Yq>Ut$eKGp13zr}B>oy6 zk4(&>i+XDwp*;U+LZZ5aaN^LhD;}4Pp#8=|^UeKmTx{vrIbZ0#?tJ)|ha%(O?=7j7 zuTe>ZnId zSAOr_y&R?Iva%(vdw-bt6HBk!|Dox4&1?6ylj4FdXCz5tT3QJnyJ?i|D?1wG%$mj0 zozX00y2f|-v(s!t<8egIr6PEDnFkKP2^u-{sYVy|6%ge+@O|F5gjIor;!HI=8cXhq4^=xwr``=4)kS z4XRiwChA>=*Z7pM0X?Pecqo4zpVEC(oREk}*G1}%K-yMB#*#VzYl%p9RwZrW!;FA25C*PY^!6BemK!*n0ldlF@Or zW~Em*vuRN#?eV=S8ZR#;baw=!$~&76by)DZVM?T8-<9|YdY1@{o6Bi*#z;D@s-!_$V_%EfpsMoYo0Av4|d84mixg@d{``CoEJJM$uOWLq6}GbcJyq z5y{0?a@H3;9n8sCP#TK4P<~f4rFzXsW4fK|T)bebJq6SM@(9YW}d%p`>yN-KSIwCZemY01?lmPm#LoRoMxbOUdH76rt_AZ9>>sh4< z8B$o(`H|f2DAUpkf4ti;YwmCFV?K<-u6? zG2%wfi|__NNtrhFBck2%`}fkF(BKbndk%Dog+V^N1oU1_H~<;yk&dVyj~|@@Bd8qI zUSOafRe?D$IU|Molb1j8PCi>V&dSUzIBsii?+00}`@<)_aYFZSawB@(^m`w|e%zc= z(V>9{d8MJByC&n~o1_{?a~kJ4*mqt3ux2uvyWFw2PuUtIqu8^Xes3j?NYw?G85IMY z#b($|*+Hr_^T0i0im%2dIJ~gIZ4VV$r)JSHY% z!}H?ADvkztB``F9Dj=hGACGntr3hg5$O?3Vvp?`4pmm<{@*{l?z7d46Vf^(1OgNXYO( z?Lo~CJ#mI|wd-k@Ysn|!H4j%Zdd~;+%3J?dY{|Z!%M#(qdUGJLIcU4xxZcg5aeMM+ z^Rwl+$9kj{ddl`Ms$r<~c);$c*UwC(e;XI=aI>?ngEi=fR-}Zl3n*oN>)88)5U}Ls z#vzJba&ZZ?dLZl(;srzRny>?UcP#t@7hhDI)W@7aw6?Fp8;6z?EU9HobPI?jr^cSWU6l1n3WXf@xTFpw6m4@c^YIu+)0S3a8Bd$WF~& z#x#E>b5Kf84cMn176yjtM+0(g4^_Kjn_l1Lx`T?L?IX6~k}N+Gr6o}@JZ8|`NT zZk1Vjf<)nstw7`9q;80rQaWK3SU*N@c-f4! z3@8??^9AS$h4HMqey3M7|J}*{*d4&@ssjy+8>Z7&v}@!kXXx}gy~QiO8WBCDuTfkO zQfd@Yz!R$vMm4T!{WYweIo$F|e3kxNcmKzSorHos6AqbWiK8i8L)KaOWmS4s%W{>! zf_k;A2b$?!wPScOsd160QzH3Y33j=1p2&l5@OGw04Dt&*8;Zc_&Lu5>-hyp#)7`y| zYm?)pwNdlv(WBi4EVfbP&T{u42v=rDU8vYEM~{Yj_X{7fKb|EdB<#4q5r`pt1)-Fz zEGz}*)|Qq(S~JJdw{G2PpgK-@`q)jNWcWM=gbvtd_sPl45mGU+@U+9P_RS1IY8LK= zC8vhU%Da7ugP>QdFH7IZN{j|)W=6J-aH8?Ap?+pPx5Tb#1`p5PFCGRF3{2by8#+Y_ zgT_DO%6@B_dt~od9^Xd*=^|7GJ5Y=}CSS6#!y1i_w(f(W6<*`EV`p zCutvb+U}wJs>PI>S^mZAz6AR_m|-Bqn#Dt1maAA?Cwt7g!qCi6xgui57tviaV)Kjd zrgtA!`P}r{uS})mB{t8@{e4HQ$DnO8M0XUTP^H2+Ba}qD^g3!xVzx*#bbd-`n6Y9G z4kg36S{Xe(@=S%hyY{&nMUteXq;~>$|1_+c<-d|zkovPr5vk!30D3;d8DB@|yx8ng zeYNcHNx`vItGZET|6spuq*{tx&hU@WyEa#tAM|_lucx);V%e2sNa>%y(EIW`R^1q# zWZtCw;MNuzyAYsDmak4{XJ*O(3YHpRJx94bdGdZZPbd5I^z<5?35c}7NWFG|QuBL; z0M`g?`5W&>Kb$q>0~{fT&Z7U9+R3` zBd6q!wVg~CM|bx2;^`BP?-R2Aq?%>*ejw4@^vLx^cuSL8PF+S9p!>Be5hM%fyy0K> z`j+69?-gtEvHm;8vxb@&4a}DH%;~Do;XIA`0fOI?#W!{OUS3AUmk#IZkJnA;T@;`= zg_G?=S+4pII3nM}!^7`V2Hv@Q`R^Dd*P1I7d#^1(W;BhN{fAf#kXrzFNTH*L)m#id zC>j*Ln#-jifj>YnqN1YW3Yb|#)6-VT;`*#&Lh)CQI32v}2b|}uhVt_L< z_(TzWv%U@MzKFXz1hEMS3L<&{Yb_6)&B7>yD6XdQUvDLO^7;TdHC}8QG4+U=S{z4s z_cI_LdXryGB991!Uw>BV`N0^z)Lkk9ND)Lw6P?_I$S(uwvMEpg+W?`Vf-vf@6I$N_ z-z+xjzPGfpa+Br%>FV0!q0HX6dqbbfB}|R5Ns-8H`hd7oGAS{N6(+@Zk%}I2JKXXL_LUcO)B9Pgh2eM6#7P7JwqK0tn zLjeH+B8j(kSKEf+v$hM8AKkV8(8k8b#_uDZFZvInqob2+V!VWGj8PuMf+Ir7kPt$# z$>rToJX_?>vTNvU#yCNKF`Q)iy_k5$gplxTn%=yY%QMUJ{?N=`ryXYe55&X|Weq(* zir?zWh%~=ALF*o#T{wGPbgkUzm)=0{j22AokJf0%`DUC7qF`AP2c)8Tw<}gZ9v$^5 zCem!7M&nT+1M#JkOa*n;1@~YOSg@jr)z*FJ8RWH`*y6ux7uFrMa^)TxM`P^GH(asDRB@q=U#*frfo0 z{3_$eN%isTxNy~F;rep)NDyBoG#qjxp5Ky&6TOCybUwn#>G^O?vVAraFIIr;GL!Wed@aEOV!f(Sk1DQ0eb|D+$-0=_@ z8JY7RvcsCs+-I!p3DO{?5E>=cT{-sr^(UH?&pk_?5Z6$q40p!nyEY5w3 z-t>XPaal-d&)TPFvCSHaz9SLe0e*4!aNcO^lF}fhYRsdH925#AS`2>FcS7b=jcGNW zV*Z{lD8K)~P(i2UUWoH4iY7g~-{j?Oi{fawpIi_wcNZ8=K$Frw1^C^c^a}-z@k(lR ze7p;ie)$u<eh~Y(+BSjL&p;cSJo>S?X_#et3cgUBMqXkN_*g+09LJ=8rt}R<}tt zb@h(E%5!@I2aNUe9M4ip{csTntZt zSW(b@Zj5ajuitukZTCH|gEdCZEzXhsH_6R#lEKaWZq4GAg9K-S9{jnT)SRr&8W`n%M~nb?=8!sBQjkPPcnrf+gv;d?3H4u>*-@15(kiW4@KZJufEmP7!*Uzw{PrH$ z&<{dQm>vnn8FB6KX^+R+^0Km5H!M%p;1C#2c*oV-JTc+zoa00yu_)iw{%PB; ziBqZJI!e^`9i5H41kaIeumcQSPm0`kdQz4of`8fDkU#%gcgbsa#mkqL{^FNrbnLj9 vr?OlI%rrG$6DO%l?=6hHllV4cq)03(^%H-<$~ZRm2*6`w^^;|Z1?lp?2IS=v literal 0 HcmV?d00001 diff --git a/docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-old.png b/docs/img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-old.png new file mode 100644 index 0000000000000000000000000000000000000000..da6f00fa8841cc43235182680dd7e18e22bef4ce GIT binary patch literal 29531 zcmeFZcT|(z*C+^x2-v7LlqOXW41}ii5(p4lfY6Z=AhbXddPfAMNC~}*0wPUOdRIZ3 zBA|d$ML>#DrMEf3_xIlK-gRfq-2Y~+`PPy=$#cr?`|NY}K0egZQaww1g_ewr>?~YO zS&xj25=BNvu0c%&-Z0{9>cE2>ucxX=R`&7gJQ*3aE|a>0a{(Kwir7M+V*b`ky|3ro3|uyib&`~#JNQk zAQ12&A|@muE^6|(zm+}O^`Gg)gl>Te_)r*ETdWrzeAUtiACOz%wWuQa1{%bnf4_Q* zL;1lQ1vfWmGzx94fgx~HH4Gb3T8bE2qqMCoy{)8Np$ID! z{4YJ8XdE7cb^Y57A}S;*1TZ2ECiu9a|Gu?Fdtz(=3L@O1DuA)J7%O|66=2^j%s*U1 zV07VPIv$2bHkQUpj;d$Bts=p#phWrySOosKRiwBTAl!;#f9I7j zBv{*u;h`!zP>7u?Qd z5MO1ezK^wun1ebFfp>!G;8AE*n68GJr;4TuUPI4GN!;5(O4CYL#RTr7rig_3h{4q~ z5HNR1Cwn)Po~;@HZ=&Mm>1M0KEuv`esAs1HwbxK_2e0*PB{UHjXH8c{4bX&=1Z-A> zs!HNTRDpnD28O!I4#pBlT^+2Gks-_k0aX=q(?xoDYT&GtwP41&R%mY}l%19@=&OtJ z^)lAehv5)DDmLJ^C(KRK!`0Ky7qARw2i3F|0Wwj!5(w(scD!byU3tb1_m@S5mZr zX)3tEG^O0^rJN;!3czfjNE{N3HFR~gvBukJc;HP?S}s~Jf{CFf3beyC2^!*d1eB{f z+7l;*H}JA`aPr3JsvC;f8%iiB>3ZI>m(qhtn3#AQIw3p=3T`TJNwl4Vq>sG@+(sLy zh@z{O0@ei3qlmB)b8>=7!c|Dtc~;nv$B{t_V0B zr|T-^=BbFryJ7Y4x==4&sHD26f~t?0yNNBZQ<#Ff0~n!d-~iY65Oc!;ZYmnVqDqFx?4w>;H=CHv}l;^8P| zyr-9*6Iu`Fqi?0)D52&g;VUksi^VDc0yv z#gx(dUOo^{Ltlghpv>1v5AP)o%*ntFuVQ4QNYF6r2 za8DzBCwq5@vxrjVRl!C3mXVi}hmDVym#>zXo|Oy65uz%lDXyz3 z;pw2{43!eob0>LA2t>>c>1k-LGmpK zMQuY(J6kWPfq|Emhn=XZjg~WbZLI7AK7D|5SG0#{Krre)XsnBvyM%|PhlBwHsjKH} zg~vInxM4vDU27)~n6AF6rU6D>Nkv@SUJb!7wskddxA9icH?)>S;1!f{HcB|8v52+12LkGgGcvTX(sL0N(RDD9(ojK( z5+Djz4ln>j&%;d&=4j*~VQ7T`@>Mjl!9huUf_poHPhWi}oVW%O&;kSIY+_)8g;_iK zLUc4V3@{QtHtt%+Qb=`AxTc1(p^}b|gowMSGDgc4t}g;~OqZlCu2SvT3+9f@=~;&e+Dp0O4&cYGf_u zt$GWsq>RUldcsI!jeskGX&aL8vNJ#fcjiS}m`MM?k_7wDqISH(f#3f`527laOfNv7 z!A=HOR?zph_?>mChWX2v=9E;j{+CfyP#zuzQ|OHgOsDxGVFysy45Ob?YjC9QORERl zGzupoPwF08a~m?XgQlGU(otEotrS$;SGU zgR+UtgZjl^X|L3kl$7qRgvyiCNN-Qx!@aFUbt1LpuIB{2%ncT>g&Q*%ImMi-=>B-8 z6T+Lxx%capcJkv}5|r#@10ivS2#{U704#Sq@i?1_opJmp^K(J;P2V4Ys*0p zR2%a*8iQUvE~)l)3ZOG`&!e0Tsx>NT`tvwCT|~okyfh`cekok}r;Qu6JQ)RDu)H4S z3IZOFHp?MvqPgk7F7K|Ql$=!BcPZ>XTZ3Trxo_rQyNq28DbKNN)V!W>V4)Q><_`AZ zAmNhhO0iu~*Vp$_3p{VP_I>c7U_xbT)04wE?ml{*EjCH%v)-kYM|g6RvV_K2d{V3S zSC><*N=G`^iNByt0BB6ST{ezln+K|^3`R$$8nijx-VTUY7#kTKeGWq3BGE>fV3o-!@7`8Kpo_j4QaSXCuRKOJ z%)Vqe^l6YS#jM5DP3>l+?7@C4hE)^<>5;1$r7CGk$AB=5kDu zfnj|3DJ_&{aK1hKZc>2iY0H*mG*v1K;1?NX9$kxs%43z08k)(BDV{EGW5(Q?1P`iI zIYWxnFe7&nBW3V>(Bg3J7)TmJiv&8-@?d(KXM=(7Dp{n!eT|}}lU59bpK^;|Y#1s& zlC3Kp3xWx7k?*wwiv+npa#Z=UuoK`1sr9`&8Ievviz-SDJn1ieIOaV&67<$wEzY?* z@zjFi{t0>ad^i3tjqIACOZ)bXzM6`Im+uB16Zt@qY=Y_j1(zQrW@YgGKqG>u)IsZ^ z5zSo&>$c9j^x(-!@kHvFrMBv16N&tR8^j+OpEYvb$oR^bg!1byhQU8&9hIPB;T^Y6 z^qfB?OcyXM?^B-3C=jAMBf6mku&)!evI&rDDwarI7UTp^<-5=blB_~B0kcHf$^&u! zL|+=Fb7XBvZ}RoGLT}O3t>&LceZy}hn?H<(E_uG7Ct4;H2?t!d9ga=j=l$dBCAD~N$MfrvIPFY_ zjCfK8)o*5T>7U=mj`o{vr^m{}W(_dpsgyta)#XVl!2XGn+<)M_+X|vjh}jILJG@!(p?C0OqMtsI zPTUBod3z;cZ)RzIv)ez$%I4g_IU-#+gUhk0=c)nDZd^pYSs+1)?P327Q1AZ*>cuuXD$a>9Ew)M-~uQ7Rg?BZ$GI!#!7iJI#Uj4VvS1C1c|Kn5&wK&$<&~$8wsa26CdsMqqcp{}F2H zjE^GT!odLtg$7`szK}TB<03Q5EM03IdA4=nN-L7Xj*&LojAmTjwmtn|erTNSmv+M; zw%l#yGrD=bT_R{DgCf$>8FCbG_Yjd>j_ zcg}`OGo%glXaLUGYJOr?obT26n)kj(>W1MR08U_L@%e@F?^aXP7aq%Qdq4KlNapWI zeUq@W)gXK^Wp=M^_nL-EEcxD%N%+`q!>E7zxCQx4YTv;0bU;-car3L9W?;`^$C$)M zq)_3XuNChq^<;bauQw0l7mXWdUUU}>He4%7pyDrE8K*q9Rv*q_tjYJb6~uOdw0ZTr z1tDNnOS9n}3+y_vaK50~$RLq7nwG!Q1X@kio-?ENW4;C1MIC7}B0Glh#UEp6nPyaB z2d2b*ZleEgVtIzCIKTq}Pxl|B*7YHEe yO zqAB%C$)1}xTTcxe);IDyyK`UC_HoZIA_}wy9;V+rDVSsG1L?3w7S-T3!wOk2qs@&! zf3f5w-}Bn7)!f^2-YL%t6k=rc(V#lq91@wUD}0wJPm>)CIe8Vo7ialQ1n9nXq7)pz z^mwE*<5lyD);r~ZOOQ6^@yKHvXV(TcE+@UsHW7yH8mQDLab?J@nXJqhhwL$h*4Qu>T|{`!2dLg*h% z(>4`(%wG|ygazoD(P%_^{PTr4;&d`WS526 zh;i-|sjSE01t$n*RNkokNChjVHC2~e8Y#T+p`~Wm0%3(DM#NAbJfFRD_`3=llfnyl zPVFkfA=iNttkyT5bPe5u>j(u$r-0R3l3ep|zjy$b^Lw6q55NO*0$tNXTCJr|Qqu8) zRXP)TS>OhE>RZ45yIKnZ*cDHEM?qMo10{uJ$+|O(tz3K;<=ea8bJ=E+75wc-TA||I z`XucDKT<x&;NB73}7}cGw7o<5Lejco=K4c7^D>j zlTC32!yf=Ssc?g*di3V87RGUd-pPN`SSG@#B4J>`=o5MFFXL4HRo8+g-~lPNp5ZbI z{B|5$S4kge?fh9U@6S%(IaUuc3J)N|FZW}#ARtt1Ba7$Aybg@0HjyswY{q&7BVEpma^$OqSlZ!l(K7CjLJLr}M3+*b-k+WwK)}d>&ZS3d)?O$T(Yr z6slh{`D&jNP?4G~bxbcAMLZB9=k+H_nk12j*j_3GO6Pv#8YSbY5aJ^_*oDBAiqYE+ zTaw{6XQ)4OxeY&ipML-w>8M$BefBk(>X;2=5 zy574FF(S{jQS%2GXML!mLNf~+mGR{(pHpNLb&+rUL<%@q@F)kYU}GD_&m#f z!hjc7HFe8$I7xmJba3c|E{4fd1Jk67bD;RUy#Qk+YeT63 zbP=Gzag>zoI$(ox5^}uxIY!eBp!r?0kCwuO#E}HdAWaAzhWyXJ5+S17k1tSva0YABp`57tjfc#%1!+?Bg-#;{@`vl_C$Yjk|TGV0e z!EkEwhdlqGLq3=&-~fCfAFzd!a6l0^U<%!df7wl~3ic_F7)#l6?*sI1rrBlDQ7ZsL zr(i(*%X2bb)F;3=9bl2P2>^3-5>u%DMUw6juM*v?;(i-( zKBe{EDFL2${r`AMy5JUCa0HPE6dbAoRBJaF%wQRGP+3wrXwqL|EQ%R#s1-D;(fL-5 z74A+EPFZf+(~>>f$74pSO05+Iul;KWCG5bz(Ex2~J2n@6?v)6+eTDW|w&ly=lZ$Uo z3n!iysv*Put8QczM?mevn1Dq&lAMJ&dv0bh|MQYpA8%LKb|x@9{99$;wcpe=S8GO(F>Bw>~E@T>|*xT}`=DhytD1 z|3@be(CIU1113OHXakB_Wa>+s_r4RX?_L?w(f(_j&$IxNw*itk3ZVOpbiu)@E&jCl zg`&c)REUlDAZdgn;)qz-=DhJtmb&5{r*35<$_QU8E6}V?b0rL@EHL>yNe1d z&+vr|oXX~5g2d+B#5uVI(2SE?5z+Ts&W8_hhI4w>}x zCuQCi< z?YY=au*$`+Q!NqS&e2GzO(qDiCY~xdGR^ioM7R9MA;pmaA}Mr4uP{s`(t8(t;080) zYO*L4!dtFl4mP{1r@zrRYvWC3)#F-dlw661#Yd5*VGOoCpN^F%mq^xB`Dmy~bWz;}cnS9tlT`|ejp$@PT#r!!YZx?Whl ztvDY}{g22`0*>C0XDAjVpU@v2t*F=r3iU9S`#N)6aIO7z|0_?Tx!3U1;NpSCr@T3S z+8>*K(PTH~nNpSfjd-oOKyW}`V59Usp*XD9l0R1(!fPRVU5J!FPS_ukz5CAHYVRk$qYCYX~3p9N)aZ>n!EDqMUXc6I@d5>9_hG zTIgIbN_hSnGsd}D^Y)CS^{=-g8xJLv-miR^LO&j4v0HlPVrYD%jB#*y@Ga(V&sw?0)a8jJ4#jz<$+D&ByT-(0?(UbOM?@=$Cpq&rN=1)y?G|(SMg=cuPZg){F zdL;g|I7}I8-w&+57WAFjq37V`VQ&xrC1jk`%5ZUGPFkh;o?HOBgWC(f^*cz&hDVyC z)X+(&+B~2k(|4(Kd{~urv{aw$`M+mD_!I=XHIF;r<5$D)-f7_>nHv*A#zHCC_&Aij zNTKJAtk3hWwfvT$S`nM2hLJKf3OZ)+&>J?2q-{~KA#gzcM8n^&T&cZ-EXCY-Sh-2w z42lS?Eq&h*%8Sx`*~+A}#2QrL#mT)r-(J5QWL9_c*}fsC=-{tfOW*2Q>D6ELYkS0U zV&T&5w=6*^_k^}+`2t_I?QiV_&0Sa8U7i^;f$oH$)Ljm05zPftEARhA-7aXfHR!QBHyQ#^n3g6~rng zGM+t-7wFkq;!SHr77*;?{WO8YS9(31#WMIdxiRZV<}Z-~fgx}IJwSQ2C(ObO-zN&T zPQ^$WTf3stkLDHU1KuTx1Wv~bj5#tzzh%PqJY+eN0z Cn*y1uSq8{>;4ZdsW+Nrt_MDB~hwp3T^m(N6*1hGo^t01@hm z*Esi+6HMjpYqD4NRL4cPmG+Z1V-0u^>7Q>cRGdb)o1fr+&cr)poiKKgD`5M{_#!T} zjkDZ1BW$wzFcmv>*{795#C3`&;?YlrH7IyyWf40DQG0a9#(JJ5eBU(cMu4e~Ok0wr zbA#*rNJQ6<746U46Apx>;DG55UO&6UuJ4NP4qn$PGotS6E1M-=+&r&Jw4uMSr#i6m zsqucz)uqU#AMkTc7!?whvDuO0w0o+3B6Zd>tp_$q=5=09mk56b*G3wv1ZN$Y%NNEY zEQz{|7V*3}zFLrz_4&MLhF^JkUS^crRqS^X>X$0+y$BkH5Gp11R5yBZ{ZIx@Y!~aQ z?H^z(?B~{~w|VM+f%a8=ZFO@{Nq?TodU&~A%+%+|?yt{9#gQtD!ya*h=5-|>>F2`X zd{tDpXgqgZzE<4-e?KQD=h?IPa(5|1>sRb88M!B=>07w~yhe$k2=nk7*&X1X{nWCA$FVo%$7uuTLebIexFXEcqkYC2)y{X7WRxY0d{a-Eq|)8KBnGNj9<5@7YEaas?^Aut?~1)2(>A>w=L~< zs9*tJ{rX{mD2leF4;xk~6P#vjLM~lG>0#mFRCnT;UU<!uu*CwN-xuM%qg>uqZZ7C|0qQZvrR*x#Gu z4-*f6j&fT1R~l7~H@q6!EJ1E29Qe9^KNyJ~@*ryUdk{CSWSP-?#81Q=G;U4^TJQwy z#sJ;)>s?$t8eLjbFZ4oULrHPCncwe95$}~rLTKlAK^1St9*)h=itSv`7~koRc-$Kr zUbT@b7Xk5}-QAUm_Yr?4x}&h~h9eq}CV=am8E$1nFFYmBKWLGAy#4Oga`I;Q&3adM zwhu?@hce5>{fDdlPOs3UHFI#Wd15bT(95AZeROZdDSy+&wEE9xL{{}d+Wt(PYGdPE zKmHtpTmhe7O4{pxmQ|MD_C@A&Xh!z{eV&}krMC+lk(a7VzHrZ101|Mjl8M@A2 zK}$#c1Z@&1t5H1MelM3iF03WJ`VK~-^8EUt|1kehcPZ-HPiC?3m_T{g!^M|+7AXgj zX8)-L$fZ7fjGU(a7-scbq zG4-6?<%5x2@NY$Mc>BX({Pto%tB|kn5N8Vzy(3tD{0AOZL_UB*dm0M{D-(B?KXejb zMU+b_Oa+l?r-i_N4C-ItTu@y;U`TQ^eJ`2F@>_2)sZ z?rw99^&`wF%T}9-w6_>evUQ#shd$2br;(QW5S0t-juTCdf<`Y|W>!RF&l2N&Xc^9u z5p`Iw5$CSiet&b{LJ98|$KSQ9lI;2W8+>ptLP`PWmg8bO=(pZ@>BFAyPP=8(*HdiP z7USaH0{1Uthpvh9gT%wU80b>iuW#7sfWl!lZy?%jULH;Ds%-}FXEgWUY3taMzDP3$D{c2`dXW>l|aJs8?w_3j=M?hqqp$N#hpv`oHv6wByN zuS}r0nSNwcHDPBXwfZ1ydgVm*x+b)Ijxuon2V1vQ#5Ep9Uag*n8td`5?UL5Dv3#0w6}HhHIVhBXT0jvk-6hRgf&tudpd%4D^vqF$cg3CFLIEJ(z} z_9j|gFNd8ea~31xA&dO0PFA|%LJ3mb&v(wPlin-Mop>jRBupXJ81$<4>J8(6JIZEKL>F(}!PC+U*T=W2D;r1XpWBch=sZzmRxjz+tGA898cApXI z<94vGumt0vjed!5273jyxBO7ISdT`Q9p|NrCh)j?5n~i#LVuj(yqHPOYp0FbpLk8_ zBGBtM=#!*09jFA&%)}Txlt*eevdQ|_l+-Oe9~Jr>M!4FJr`lTox)72C-Jc`B!uk!tHYrg**leStLd?dzi3(xqJ3u@XXe7)MrhM5e0l zskWs33#h#5w5k|zfd7jr1Y7arCl2e6{QYY(Bk=CiFA}$`Z%*Y& z;5h52Zw#CY+hj1m=%elK$PMqf9OEK;A2WivxJ+K!aD(xZ6z*xJ+Z!4Iz{El0i>Q5K z)X$^G+VfCrz1q)?3^gvUXcctn-c#tu8Ub)P{wp!~zry7!0|`SC(33gR-|~A!`=Tr= zSi;6XG8pBLVQX%7aNgOE$B+x3GXE-fgO_IPr+mW&jy%89-bY(K$Lvc1?E6*m_V75s zvO5AfPTyp~A8)ya$)DC(lftA_%K9@_495Z9!GDR)m?vyWtswF|^PQx2;~D=%Sel{N zl))c}h-?^siG;zA1FX&e8ejpbfmQ%kB#cCfFBSw}_I%;nAS$JU(2ydV82F2BI-cY3 z@2ecxsh9O}O(|`8>aQY>Td@`0bWNS4;E=zpCj0Rvkm?&&c=tCRiFZ#y;KY@+Vr=)zgNV-0&F1{;vWJ?U zUl+Zlj(+_>cd+dyg)Vtbo$TL8k#qSYTF9$CU{FD8 zv9#V!^GVqyD&pM;M&ex(dwzis&}_(oVfC@!o#*h~f?M&-Urop4Hux{^3}wu0vK$FU zux_aKW_XxjOA}I}N3I)8#b9ZlyjgHrIVSZtGs@((!}!XV65R@uZnk<>;Z+r`7q;_3 zPi=-2DhTrx4`eV)jB5Q{`XXdbWqk^EvVl*wS-9Gm=|K^JMeI$}D!R?{Uh6iDm-kdX zeCNht#;#i`Tbn!Zeu?`J&taLv^$uM4%0Bmg{9}6r1ck!}9T}lhmd377U2Ck|_bk6@ z{wQU5f!%HSZF%Q2n(_{!whT%YTX%^zvOCzD$fc_{T}-MOj{dwSYBx_EEH#a&`V`7{oeh?1>wg@;GQURLm@aS< zTKh&7C9p1cXjb<-FtKN6&Su$5m9?sTs7%kSdQ8$x>zaSs&>+@+H??XutfyKdS^ekP z!JEvu=ghbEhrPzF1a`VpO&bDJEC?p^TnM)ht(9px=NoM^FaC7GHVi#5aJv>h5PE;2 zWBaAjOdqdB+$-U2r|aL-YBxt+?kpqI_(nglw=zoDeH=d$Ysq-uo04ML6!~>Qal#|z zTG+u`+Q+Z5zREo>q#C;;V7l1ysZs0=tckzJ!MixA(Lk)+aB;dzBPfUYtKUf(-BkbY z8E>WQmeA)FBPP_s$_k7$_$+ zIQ@qamwWBKSM!I&Zs?^=oQ&c~8vMCl(jM^Z83z+euSVascIJZBks3Ln3;7}ldiLsA zpaNnAn~}`fSO%^Sxag z$#b&fXTBiK`j$#HsrJtg)E(lk_sSWrITm>971!vMZ_yT0L<(5J4Y2PIt$IHt(ck#Z zX5rpO>2L!x6unn0ee_14!ucx>WzF;G0VVJPLL=Df%1rNmOs3JpjxxP<_3D#p)(?Dm z)K|`X;x(dzBHJ=4R!?6%Ug!Mga{DpylT;?9HT_jC#r;L6@f2-Axh^|5B@bQTcACw% zY^K&uUrve?ICRlCH0j2=+_2XssF6)P zy)}P9qpYxoLAo}t({!iW_mrHG2rufnPvxy%Gn&n_i;a0tK`;d>G{u&HAO9pnna-{= z4~`UvxOrE5n2+?MkNCr-n5|v&`Gw0;YY*&`Qmd>$`BJYL#Kz2HEGwod>)BNmfWM|f zr(EDdP8Hh1n~2(pE={*M_=#6Cb}V+ia(8($wu7Rc8`pJ*nN1YWm{2`}wjjIT6^?v>d+a z`rNsFTN}+1x_4{#@3!u(P z&Wu(n>6_h5VdRt07poTA1$lwJ;g$C6sBH!YN7qkUe^;V zh6En7l2x(vFl%(&m(NOMV?#;^EL)^N=j^!Lmx|xw<{A?^#!l^$jTf7WF1Q4;apk&$ zcY6cXgVd!XKGk!7O7)NCyFT=oH!o! zEI~3V=D5bjsOg&x!&*{#$&)V*3>9`C_rEgAZ+-pAu1!Cgv6fgm_i`#DPjp~Z>Bpgh zyUMF6V?P8afJlFU8zUpeE&j=8ZGaKuZrkz@9+A~~32|$k3d7=V%M7-D&nTgPentLx zRMIH&QC>Q8 z?>8p~2XMIPFZPqh*roD<*hoLSC1tXpG0(L-%RCw>LfxoI<&4YZF+3ci!bWw7!0C-}R!K zM=f^DuX83PwrACmTE>Nh=eOvzUKxOAV`dF2eN*SgnftNlCz!ICZ=!hqYE%*#C^qTg zg$za4tApcw6>yyI^MDoV9xoqt;RAZ_cU2Oj_U-$O0zy0;tEtd*%J)b`Z+<%YEq-~S zNv7=rYcA#q{b*^sN?MXfNGkc<-f*0ej63F18H4hRhoJMryJ#I!I^jO=F;G2k<5%*> z>4gXPf?-6uQxfeR66A!O<$Zb?klqL>p+43?+kEla<1BE98T}^*23!(*C?brkPMcET z9w~3cCry3~^G$d9$>Thd{8dV5dYEJl1lB~8yXXHic8-)evsF1}AGbgyMEE#&G93wE z#uZc2J9AQg3g9%l%mi{!^51EWVKP|^3ep`X6{pyN3whTX16f0mjs3h6q)aNIV+UlB zG|#vw=I`wXb`%Mw8TW&`j2yvBjICX{B=Tvsk74GoRM>?avxDvwNd?cjM#p1;olfjr z_a%{UO#g|bdY$SnJ*UCsWE8cW0Os@!1T_8QcywP3ne@HWtUc?O-OsMA2{#D^ut0DZdcmBk}eP<1tMB zh7x1;V|Kh#0NVH99*fO%2Cy`*!v~~vti0i0Z&;znvi_I1Wh9uj>U6CTtWq)%&Y%; z?&=3=nL1y4MU*eT+-GLa0>5coe}Tg6r-?|`(rvMY$SL)@D>mZ5Eu5sdGSP!ni{Q84?BqPl~;G2>B9Q>8M9bV)i+eP8@(R?t%F-QJEar8F8~P!U%6+UyvEgql<;fI%z?gFkZ%Sv2PJ9~x(qp7?$EYX92= z5a!fLs9XF@B5d9<`YRypzghd=to=XH+H`Binz_8F$i|k;(j`z7$FweILHB?d+@}w2 zMrJCBT%gS4&F#B-Cnu4D@&Ohn@Nk=_dQCUc0lLcrs>XGN7dsMzAvyby91QIh#3Q&H z??shJgy z+HVgpTg$k^S)M~ySDtfCrkGJ4GltZL;+@$X8 z#GEysk?>NskRvBp%H8qRGwY0^s`jY}ubbzQ2#`Ckiu`_GMb_-2R-la% zYUjhX_#thuv*>-44LaqKm#sJ0-mr9c{LI{zoxW*0qz}r53kjs{WNX5o1O8=zc z+OGq_LfwnLA}VsiOtNxE#9z*NsJQ3zEugQZF?`ydjpujM%;?@e&B8L|V}?>sT=& zAn&v)>fuz3wB*hMaD$VBnlvVf?oBQYr6WB6q#FfKZsuh(?iXGfoqJwWi$?peJ)r96 zZrQ`sH8_2M$vV|v5J>gZU zZ*T}+lon3wLS_c;LJ%fYWXxI4G- zmC4(^8U<_2g)nnnv(6OQ!$Do(Yo)IuPPQ?pFcQ~?Yd+$$<=>P?0hyj=$#SFvGKGiz z-^ld+>)Pn%7cbqjE{azQme5elvHEZ+kePEUR31V)RRKiftY8wH?~%dsXDFdfKJS8W zzU1gowRSK#A6=$jX!(1pukqVw-a0oz65n{oJz{J}#~fYg@faG8GwJfV7f8xenQFV^ zw-(QRF!eE}EHcB?u$?#7f!&;oT<6u0-G zHUqm6C5s0TW3U@BZn7izBiEwS9%u5sb@@*%00xvOG9>_CPTG2KB|ate7{9XX1b1z2 zE;k=FUG@9*5;yla;zC879)F|CSmN3ZG-Bu0$&?XnvpJ~y7G}XVyfpKj&+o5v8fqx` zIA0@{PFcvP=vD+a$DLN~6048(aSM^+B26?CObEz#lVhsG2B=CM>1vkh7N?&QwG!4p z-s#;7auG&k=&|C8#n^td#}GAyYL$DA*n;*~ebfxftUv$PU2^echU98Sbj1P-Ge}rI z*Oo$T9iMc-72#d&S8o%Zjd~23i#UGfTb81`Vre45jl!2ovCZzlK+-tj-nrXq;b&Q9 z9V2m#e33_e1^Z99kRLZUCvN5jI=u1!B zR$5PW&ll!=yr~F*lV+s3_I5fI%qZ*w64OQ%+V2aCC1ISPa!Hb)FB^WmM`lphyH(&r zJu;htT?+V8F=!eRim^lDH2zH6sL1x{qSg&QU>jDc&ez5$eq9-`X80J+jForVHtR^Xj$yF45!XD8T2WU5ec&$Y;8w(+(3+`8fj6g!iW;aN zYbn|KvU>6v9Zc2ZzQvk3vRMNH$poOS8ny&sGI9boN7*{oV zHwRo7==u>WCj@FP5=pxLXL+#HbR>#rhJFPR6Y?Wtiaz(4@zURPMY~38@#q1BL=vd* zFijV8DzF=?ypaC6VA_%X?Ux$9GJV5^t%)GZI@cjk^kssZ-7+8@J%DRQbK_bkwhOxU z6V?!w6=+klBC$Y=pd15PvzhzYNM6xnI#(T3Kk&`Mw+0FjM1k@Ky$|Vc1))WVP9})# z?%ee>QTs=i?%7#Lj1h=`etjL-tA@~=V)f1yG_H8Jw@fOUSZdmHT^_i!UaxSEs&jJ$ zD-3QJtOPc{J$J`D=f!r;^VHSlhIK8FFk}mOoig(MZG_*!-k*77`hfl9mfX)we0sFg z>QozUI$pI4Ts-;dAu}DPq+W<6UEaVti^euTnkP(zPqwnem zg$p$O4h({BeU7yv1h?5hON8HoEG^+&#QI?pRz}!~INf5eV9jF-HWgUUb(w zl5TdcXeW(dFZE5N&)uT0(FdX7G#{9BdS+b%v9yah_3pj14L%1o`$q*e2_H{yST$~ENy;J6n3_H84*FUo?7#ff-+7yQ z)afC%qW9tdAVK^IDDV30k>ePzz+K6oG!ckglyq95e869pIDz^VYp)e^Nz}a`&Ra^L zZ5Phn-dT&fUccN_k4l7;7fgw?5pyAs-}l^EUcKo|`cqCtyvLyw?tSut#Rlm(apAg3 zIVU*&_Wb%zq84SwzXc0an0a((DNgjG(Ark?ludF=diiqmrta@f6&tZSm~6(Vp-+zQ}O&;AmzaIAZR2mXi*E< z#*EyToO*EG_VY8{d`07YM(#k4w$XI`z&r6fSx32JcUNuOqc01{eEtyqyI0jcKRG>N z=OFatY1{YLyb{Zsc5kH7FhxJ_pd*$P3hn^&z}GB8RzgK>5xk{qwAL zBa**?dLY1Uf6n{-&olj&YV%D4_IZci>zeU5dvsWOAl-G%+}CfmN@tehe|}sW^O~r= zeD_=)P*+^s1w~EZYO7B~W4kQfxwkcI*5>%jhRx6WEW`jwCjSpf3MKfg&lZ{BQ`_ux z%^-yeJvXIW8M)oZFX$g;Cb6G#Jx%+BcI(@vEO98b=Aw}nCu#PCD{nO8!0h*;u(`HlF>v<> zujh=JfVUAMZWj;&kfqK$Y*!8ZhMQOQW_<{U62i%HULQfu@8(fk^~o-^xB+etFxjQ=-mq)F^dsp0>&xq}2egQO%Z({h>Tj0$K($HB z6-4MYi0{P^z?p8&CVuk?eF0OD;LfhCIM^KN4x?dgm_1zA-*1|ITPSxhubuyR-?aS0 z`6<4#?H{8)KeNWKl6=?pVYl})L6DC&FfRlj&78++$AzJ&uIyCGYH%5x^NcJ(y!eAm z8MvE$i^d(pFZl>8Ta>EpAoB#wTG$`y9)Mgi4Rh9?3O#xw@jb&CYF7GxHTKnEQGVUp zwqhY6DWHOcl!Vft2qF#Af^^p)9Rnz$(lw-%fPg3^-6(>zC?OIu3Pbk{2!q789{j!M zocBHFkMHs?FRpo>z1LoQ?X}ms@B1m*5Ax&+S631f15FbH6^x25pbZu0zZJL?m?|A& zy+m@*PLM?2$-E1V>^x$V(D{!-TK8p%v*Xtk9uD{eR7}}qjlMj5|2dj*>?n|>h>%}d z7Beg{53Xe2)8qEy%}*>xh9qC7^`Fmb6(Vx-fy{t_e#17tv$s?)^L4ZA-cvx`%6@hF zUa{{ZCIh#`A`h@;c(P^$^?qV8CXe|7UA_M~F^YzEm0PoGpI}ZgYA^oBjE*QtGvdPK z-?Ok}Xh3D1BqA({7jY9KguRj)&^sFrZ@Q8p_)kKh`IC>2Br#CDjUMwz{;qT`coz8u zS^*;@zBhmb2dmi8>^`8DqZFiV{&hybH#3E)c|{4a9>hcisz85`MVQ~R0s5G=fb{^J z&Pjz_;J9OB1AF(ol`(4f9=A5bEbtdm`}R$>{dfBUUWzhS1%+@$NV08^T$&~0)uG5> zm<8?@;H{LT$wi^77xS|%k$Cyh(jp$Q)({7KDxj^<8srLnNP_}0#-ofBFpIV)b;y)h zTp<{-e2C^F$U-ohJOy(o(NGhuUjT$sS~?e$YH>~Ot`ym1KK6Qa2A zs!;ZPQKKQ`u&i(_N2GX;2OrfA&{t$;`h_=f9scs=Tp?e9Hqvjoco@tpb_Pkmz`QvC z@4TRcuzv^c@7wFU&7B7*rKXTre?qrV$&h8Te5qykD~M(#fVj08EKKDxYA|Tn+x78+ zzh^5a-oE|y z#JXS4hs$qXnxr;xdOYgf$z9^PI(|o#M%=SFac@;2;Q;Y+e!E2nHugJ@ucd}QKo_KZa?QY8bcEc6i zVNBGklZaD$@w-bRPA&eAQ&;Re^{b}8POYhVu=Nv5eu}2Xdiph!fYTR*qpS*qUwYxy zB}h^X-ch{1gE5v18Aj4@hiVRdVLEy zT*Jnc82HNkH8^ie%tH{|0wbRMYef9M^S;vj>%6fqPKp*%VOHRN*M6J{eX-Q4C%&36 z)jmojO!oCiVt6I@45+wtFCwf2^dE2w`yqY+pl`SSQLrSO?~>YDjm(w}rRsg7OplO* zU1z@B`ljomtmjiuZoaer4YMxh7Q^$PrtJ>B1B+cjx%MqB^1YHaIdLVCYSUKrEcs&Q zJIj~hYUr+qxXc2jrV$`NeMdWd;6K8)$Sy{_a{2O$z(~ohyM|tq=e^d$g>d0Q*jNwC z?wDg_Lo3r#2`W-MdHEyRq4_(Q^ftQrLQaN3L;c~RhMF?R!Oxs81yMu2oUb=|HLUd- zT=R51_3Esnxwi3&#JN7z$?6G<*MYU zrt_#u62ip)bP1H$6P<_9wTrlf5l7C(QA>K_5S4!0oLy0>r(@&xng(%tzNk}-w~=eP zZZorPwdquErkBgm!`xK!!BqDcMhS1vT%(ZP%S^KtG%%L?|2~$X)l_HtR>a@2_lrc8WVE)Q7xNaG1q`a9=9p4bSCYWww|0z0hr~u3 zR|LZjp z_2BD{Jpi!%?~Pe9L0t|p?dm)8k!cAgICXp>2^6k2&82m#Czz7wh_5^{kTMBC*V-p7 zcr3gtK{fjImT0{lowA#)#CALp`oXdh&cs`AzbtAZLh}CBLM_Vi+il6wyXOJ@O8W1) zNPC1)J?x|P7{weTLjpjS`=0#Qa=ZUv5y!VN^LuyE*!*~xwY{{~XVE%Ve<~r%Dpw^= z>`r8Si;?e@!>STm-s=mq3v}(z_49!CHF^6#moYR8W^*=VH9R^ODL&u}k>h56HV>|o zF!^m}81S10cKyLoh)iu0PU&fKP$v(iI96?%&X#=^bsmelR05?5(JVRqFKtP*i81*C z57~b%67OdSg2Fb#k(17nE6Tr#*O~Y8=H@Jh>seLS>wYzsJRri3ClQ&Tkv!@aG7xy;iut7^gZq)lU~D20lGS-SLhsm4zNv z9(VeJgs9vR%$fC&KGlQ`BVVmgk@RefBbBP|CGTf&S^RVPcy;boWF{p4YbLW}dW(HX zvd}y1Zh}T~pYznQ30X7-*GNLCxMQ#zi=4F=JYQb$`Ya-nnV|BT0)!WGmm2gPYl)U{ zd_EY*#6;$h<)%jFWM)*EdWgVX-@SR}!4V|03PteKHft(A=}0!#`=$Jp%l=AKy{x;? z@)H8c(>QMLwWzFTXS>O&U2oSv{C>^LcgwZteau=Yx}P=0QWDxgpXKVg0i)rq_q9kE z$-Q_GWOwge>Xc+S>P_l^AUNuq)JSjr{U`UorOMs`%IY*JJ*yG75s!b}u6H)=iN*yf zCXW>vu(&Ofo;P1ZHT~pYb;zUd{55B!Q!|4uQgF4~fnC(qSpNljWzGl>|3) zuEnk>-$KrFB&Nl){(6tyQ8_ETt~u*9lQCC?6*LVL7jSzMmc}o8zubnxd#BH_R(Xj* zOna$eBI1j0(~T~ECRF2g$!W3Qy4B8entCqv>rKzNOoaU;{Toit{Lp_E!Ni;FSgJhp z?xUa*KaZ4*D7^m**gKcDT7cM!xp*(B(IfY}|z%yfXd)V&k?4TX_>3nbzj*q-`YBg^2 zRP?p^gy_L>g+w$OvMheM^@^-EQkB=^s<>&tjjhsR;Ymhb%VNM9(y`i(X2 zY~HW1y)v?~z+uFzdya?;p`8Zuk6uHng#NP!PPfe62SmS5eM}J@dgJ3!ZPrD@H&5?3 z;@~`#m+Kvdmb6?lUPAw#nwC`Evnn<8&Wr6VzRNPYMpUW5DhTQ%;S(XPGlAm#nLsop})@Dxf zTtn1~vRhVXUDp1MXsV=B=YV`t;C_xx%EW_|6VMw!Jn%rn!-j`&N%(BUmloD*`<4H2 zkA4(~9e;SM(GTBO_`sr8Vq@(j&s5|VcA+A9+n@%|ok+8KfYvkTB9n_rgCXjI@9vR&Ej%zo(^sx>t>8C!C&u3N_pdrGv zSMjoEs+)72uX6Q>RKc51t38!i9)IyQHQt0tFFwLnb`}QPpCG@IU zYXtY~UW&`-=!pn1o(eSau)4v!|J!J_^9=)ZSo00WSPRttrI71 zgO$%_OOkO$%U)LPJuyPOQ zoYp!%Ju%R@_d_gioLY;D*Kpw-3T``f(1ysspDQP8iF@5lSNR{ok5jTAsRhjKsGa<; zc|Wfi?{KVLWQDd(&poRyhR5#_zNW~}M~87J|3Arfn>!n1-i6lp7t==Y>3{sIA```j zI1ASp#J`JitNTUTf)Jy&m`k9;JQ9^usXQ@sE$UYWpjc`~ypbu1_B&!k2Zgc2D zMH98=j2*GVP@0_Ucy44sQaFOkMC1<~IwP~_#4yw@Bk_B96u~wm%l~Q~dI1mO2ipU7 zA=#>xr79Es&CFb&6UM5jElC_zyx6|O#h+{K7c0yR@02ZglFC7?wy1)9nWUnn_u|CCC!)!XX=asirjcv;XdPw1>o}b-4IyN0q z_XT!T{krz$W%d*U`G1g)uR)%-e-oq{Ifh9VUNb4ct_#Cv_@qmw#^^*Im(+Ilnr95=h zYJpK`)ADiWBbptlJFL2=NPzGSK#O(ASS-kETxZ99Z+F<_rcR}5a_lKg5qN9vYQH4_ zuHBb2%HOQqU)oG!*Vg!%*O6h5-zMfxA?dvoEeL+l7O#hYFZed<(aCMG`IK6r((yeUs}7c4Mr%m)Yp>}P4E;BBh{+-pG)tgn4JyZvJsSDBl3 zwf?MxppwgQP+QpuD&fzku;|*QDrR>^9J6Te{%H+l5%#YD0DE*34f-Fe@0845v256& zHP%kECPiNR3c7h}naWX6yI4CHd=v7FJm~#K{&!9@aQC5|{q~Lrwml=+@oIvhbFl03 zn1uTg95Y?-DeRU-_aU#yFtC`1>`Y zGyI!a9~`Vd#?7#Y9(`EiO_*~2`XwWnI|&^qmkekS*(dU^WrMH?95x6ffjA7)jn7#Nx3uaZV}ZI=3=SmLE50L{f=;!9aiNW7X# zGqZy>!X*h)-JP*5NE^Jk!8iNQHO)1~zHUI9 z-)U{e^j3v#_xap(p5?}^H(^XdDj-pY;=5N?2)TO^lDqq)7zF3o-A4>ld<8h2R}$^_ z^8elp^ehCtwE-?=E-RT!s4*o+qn|uG9W6qb?o84#;+7%~^*AdGNG|yA5z_HeZ0TI7 zgZip>!f8yTj8mDTBG3OcXqWS%<0$Osu&+UU@iihvrQ$^5;bO6$w3Ek+e#}(@=2gdg zf@G>4>xY#($li#3E!2v8CLeK8j}H?fgq^oN485|$B$mZRHns`bSTZ@8B_@yK$Q3Ps zm|aC)IZTTvNZ#xNUtHpV=7+Y5LFe&?c5YuBH(dy)SEuf$)f#K^(=nt{+iE z{#nPw7u+8@+-4n^jrHRs9d*TwO8M25*?yId5ZkhzEnRM)m8I~#k0(pjBbR{MtD1!p zf(Rc#^jy`CH*nA|4On*D!PVArmYwt~0MKv8UkKsjW&I#`!(~dT+6`}>!jay4ZF88@JGE!f^%35@iO~OZvNA zpm;w6LP-ij)6hQg8hpXMj9hU$t~K(qf###K%;hK{%uilNXp@?%sE+P^xs4wUqb=z( z^l7iC_inGKUFJy@8e$=T!b0EUwJhPay4pI~V$+99dd?KjP~(vx>9frJXML8rK)+H2 zZYZs+OnKux%FpE6o{5zLRNWgU8PhG%K*E&#stIb#z1&mZ0alkZ*sL9=gE@Bu56za& zwb{POcB`~#t8}kB@o>vaMpdTT*DO}xLmeuj(;ePD&2RWU9L%?Nd>0S3u=Juvp5?mj zk~+e8DE`wa-n*ew-4?A-a(dt~ERQtQ9Y!jY#Ut|BE<))EI4_KLmH`mijDbKs-gmIU z=BOe>xEF7(lLM6pU{@-jiT5H%=H&_24D<&k-?ivEd9(HFlQZVwZi8_Vc17HaIz|ufSK6@^43|YuaqD+Pg4{uG)ZU-;y*7Nd z;^YXbA-W}$s=bM~F}6r@N3&sb(~P*56^WZ5m5TM++e+x#ZI!B%Y+M-Dx`DM97_udF zTg(?!#-F+I{o*~zknf3TmIN&&X=i&{T4cXnL4>(9dUcL9aELT*=HR|lxtRm@vfEyI z{%WTD>%h5ED29?sZr-%)N#kbfPG%!0Kg5B>N_(Udo}QxeOs7jc)KOy5*-WVkjeb_F z|6aY0wawSer#hZ|xhkTrGZ*a&t8?czc`sXCPO9n@CsRe3j-xa4H2mur+CjoDb<<}oDZi^_^3t! z`rMg+ecM6*HmsCr5D31WBcTqz^po(nMUW7@dGH__6Tnj1+yuhQ=Wmn;bBB#9 zm|BO5Tw~2h^s>+rg#ozYlC;1dmp}-y8guIMoA?-|;TXJc7SB_l#c@``$R(+BDgbbWxA)wR@WXYQ>KsdWwmEySF&X&Gk zQpma!9>ZPnUHaJB3+&1ECBcx98yWiVxX}t)M=3%1?wg(!L+;=$r(f{Z3plai!Emf2 z`}O6_Cz?%GA$*i2kedW;sLgmnI9uAxY~Sj-4QN?>P7whi(9-@XbC4N+pY|SbD!c$b ziw7mp&wkhLAerBR$7*27jB8&{9Qq7;Od<&}21jHbUZJ*eW^0Rp69RS&CxfV~6C3+w zn7A#uZn5#>g{p}N{D6+pfW6}3edhZ6aXB&lGnzZQ;lLIb*iJD0T8zX6Mm> zN(tdR3Gko9hL%#(6S&0pfQp+tug$8Gk~pDtP81nE8U{VdX(V&%;Qpsz`e6?!Nc2-~ zR09mne7MZUc`{DtYR>!KOHopX{z0#_ueLI!H~tK!K|+QKywmxGaFezwxSru5w}YTf zM}4C{b?S2}XR>2WUL7>4#rw63PV0JoK9TsmggCgkHD8ooIzxg`gKql4&k=<5pd$QS zXrqD?dh3d6CV+OqBG{!51-DMR^u!QA7SkbB(zj+5bVZ2<2h{foP#}k@5rL7LxeCwF z%#nzf)i4M?npJp<(R=0+E%egFw`Q_xs6N|Xiqbd)Fo)c*3nKS^1H>bx@KG_sUcw9VtND~eN3B_kO{Z53@3#se^sLRFniWCR) zJ-E+2f*&1Kx~h1U1%`2{@5OK?FiD=(=u*H9LGcC_?cxPMHRAm#)9m;G%AiL?x(~j; zhvddQC(g_cm)kwo{&Ww~(ZoRz;xHm!zW>h{rjaqoYYgd5k!)tkMaF|Njv}b|#1^DY zO22nFgdpmkkV@)8tH-tBQrn^?83RO;K!_yrnR=Ey$XX=bm<|8|3IhfF`7d8GZr58C zjXHfiL#d086V2qlcF^oxgvb;P-^OWD`WyN0IW26E!~`!3Y|A1vS;1M@!3 z4nx@KEUTt26PdGRbo3eXnqH04-{`$9qW~^Y{J^>Wis|m&=0v1UiETUyTn;b#gE5Jn zv}Dwgh_IffIoqA#Usw$IXgri_R<2hpt zl&}<#b`+?LB`g$wJd1y8w4)&EvBb4FT%Pqa<{o2Wj^~lEOS(|Cfj*7gnD;!l*HZN~ z?iVB`(0pn`RI~u7;jv29z5iJU$`ly;PZCS7B-m0G&kPrvDRugDB#BRZQpE=UyqSVB za8Pyn!{1QBVtO_e9s#_ibE%I+NGwmrKB#eBO+)q9`*cQ+zZ->;b)(0{RJPfIv_8rB2y@B9Ps}D{g_8Z literal 0 HcmV?d00001 diff --git a/docs/proposals/20240819-build-iot-system-configuration-isolation-on-nodepool.md b/docs/proposals/20240819-build-iot-system-configuration-isolation-on-nodepool.md new file mode 100644 index 00000000000..7f488c02b9a --- /dev/null +++ b/docs/proposals/20240819-build-iot-system-configuration-isolation-on-nodepool.md @@ -0,0 +1,166 @@ +| title | authors | reviewers | creation-date | last-updated | status | +| :--------------------------------------------------: | ----------------- | ------------ | ------------- | ------------ | ------ | +| Build-iot-system-configuration-isolation-on-nodepool | @WoShiZhangmingyu | @LavenderQAQ | 2024-08-19 | 2024-09-16 | | + +# Build-iot-system-configuration-isolation-on-nodepool + +## Table of Contents + +- [Build-iot-system-configuration-isolation-on-nodepool](#build-iot-system-configuration-isolation-on-nodepool) + - [Table of Contents](#table-of-contents) + - [Summary](#summary) + - [Motivation](#motivation) + - [Goals](#goals) + - [Proposal](#proposal) + - [User Stories](#user-stories) + - [Implementation Details](#implementation-details) + - [Test Plan](#test-plan) + - [Implementation History](#implementation-history) + +## Summary + +Openyurt gave users the ability to customize iot systems, but it's currently not isolated enough for nodepool. +This proposal aims to provide multiple PlatformAdmin deployments within the same namespace, and to allow users the ability to customize the configuration of a nodepool. + +## Motivation + +Suppose now you need to expand several nodepools with the same configuration, the current plan is to create several new Platformadmins with the same configuration.Obviously, the operability and reusability of this solution is poor. +One potential enhancement involves modifying the mapping between Platformadmin and nodepools to a one-to-many relationship, that is, changing the poolName in PlatformadminSpec to pools to correspond to multiple nodepools. +In this proposal, users can deploy multiple node pools with the same configuration by creating a single PlatformAdmin. + +### Goals + +- Provide multiple PlatformAdmin deployments within the same namespace + +- Allow users the ability to customize the configuration of a nodepool + +- Add unit test for platform\_ admin_controller and modify corresponding e2e test + +## Proposal + +### User Stories + +- As a user,I wanted to customize configurations based on the nodepool dimension, thereby achieving the reuse of both custom configurations and Platformadmin. + +### Implementation Details + +PlatformAdmin has evolved from the previous version of the EdgeX CRD and serves as an abstraction for the edge device management platform. Users simply input the platform settings, the name of the NodePool to be deployed, the version to be deployed, and so on, to deploy a complete edge device management platform within the node pool. + +The platformadmin-controller, integrated within yurt-manager, is responsible for parsing the PlatformAdmin CR into the corresponding configmap, service, and yurtappset, thereby realizing the deployment of the edge device management platform. + +Users have the capability to customize a PlatformAdminFramework that is initialized with a standard configuration, followed by the creation of a PlatformAdmin. After this step, the platformadmin-controller will automatically initiate the reconciliation process to handle services and YurtAppSets. + +However, a notable drawback of this process is that, even when multiple nodepools share identical configurations, it necessitates the creation of multiple PlatformAdmins. This redundancy can lead to unnecessary administrative overhead and complexity. + +![platformadmin-old-frame](../img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-old-frame.png) + +- Old Platformadmin Setup(A Platformadmin is responsible for reconciling a nodepool) + +![platformadmin-old](../img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-old.png) + +In scenarios where expansion of a nodepool with identical configuration is required, the current approach involves creating a new Platformadmin with the same configuration. This method, however, lacks operational efficiency and reusability. + +A potential enhancement would be to modify the relationship between Platformadmin and nodepools from one-to-one to one-to-many. Specifically, altering the "poolName" in PlatformadminSpec to "nodePools" would allow a single Platformadmin to correspond to multiple nodepools and modify the corresponding processing logic. + +Therefore, we need to modify the design of PlatformAdmin to allow a single PlatformAdmin to manage multiple nodepools with identical configurations. In the future, when faced with similar situations, we can adopt a configuration scheme as depicted in the following diagram. + +![platformadmin-new-frame](../img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-new-frame.png) + +- New Platformadmin Setup(One Platformadmin is responsible for reconciling multiple nodepools) + +![platformadmin-new](../img/20240819-build-iot-system-configuration-isolation-on-nodepool/platformadmin-new.png) + +OpenYurt extends the concept of nodepools on top of k8s, so an ideal deployment is that users can configure each nodepool iot system independently. With [#1435](https://github.com/openyurtio/openyurt/issues/1435) we can manipulate yurtappset to configure each nodepool individually. And service topology allows us to separate the traffic from each nodepool. With these two capabilities we can take a step closer to idealizing the current deployment model. + +#### Modify CRD + +Platformadmin needs to provide deployment for multiple nodepools, so the original **poolName** has been changed to the **nodePools** , as follows: + +``` +nodepools: + items: + type: string + type: array +``` + +A simple example: + +``` +apiVersion: iot.openyurt.io/v1beta1 +kind: PlatformAdmin +metadata: + name: edgex-sample +spec: + version: minnesota + nodePools: + - hangzhou + - beijing +EOF +``` + +#### Modify PlatformAdminSpec + +Also change PoolName to NodePools: + +``` +type PlatformAdminSpec struct { + Version string `json:"version,omitempty"` + + ImageRegistry string `json:"imageRegistry,omitempty"` + + NodePools []string `json:"nodepools,omitempty"` + + ServiceType corev1.ServiceType `json:"serviceType,omitempty"` + // +optional + AdditionalService []ServiceTemplateSpec `json:"additionalServices,omitempty"` + + // +optional + AdditionalDeployment []DeploymentTemplateSpec `json:"additionalDeployments,omitempty"` +} +``` + +#### Modify Platformadmin + +In the update regarding IoT API, we have decided to remove support for version v1alpha1, while retaining support for version v1alpha2. Furthermore, we have added version v1beta1. In version v1beta1, we made modifications to the spec field of the platformadmin resource, renaming the poolName field to nodePools and changing its data type from a single string to [] string. This change aims to support more complex deployment scenarios, allowing users to configure and manage multiple node pools simultaneously, thereby significantly improving deployment scalability. + +Enhance the Reconcile logic of the platformadminController to accommodate multiple nodepools, thereby enabling more refined resource management and scheduling. +for example: + +``` +for _, nodePool := range platformAdmin.Spec.NodePools { + exists := false + for _, pool := range yas.Spec.Pools { + if pool == nodePool { + exists = true + break + } + } + if !exists { + yas.Spec.Pools = append(yas.Spec.Pools, nodePool) + } +} +yas.Spec.Workload.WorkloadTweaks = []appsv1beta1.WorkloadTweak{ + { + Pools: yas.Spec.Pools, + Tweaks: appsv1beta1.Tweaks{ + Replicas: pointer.Int32(1), + }, + }, +} +``` + +### Test Plan + +#### Unit Test + +Create platformadmin_comtroler_test.go as a unit test file to verify if the corresponding service and yurtappset have been generated correctly. + +#### E2E Test + +Perform E2E testing only after ensuring that the unit test passes. Add test cases specifically to test configurations, such as verifying concurrent processing of multiple PlatformAdmin instances. Test in the local k8s environment simulated by kind to ensure that all parts of the system can work together + +## Implementation History + +- [ ] 8/19/2024: Draft proposal created +- [ ] 8/26/2024: Update proposal +- [ ] 9/16/2024: Updated the version and version description of IoT API diff --git a/pkg/apis/addtoscheme_iot_v1alpha1.go b/pkg/apis/addtoscheme_iot_v1alpha1.go index 99eda0003ab..253e544b1f6 100644 --- a/pkg/apis/addtoscheme_iot_v1alpha1.go +++ b/pkg/apis/addtoscheme_iot_v1alpha1.go @@ -16,11 +16,11 @@ limitations under the License. package apis -import ( - version "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" -) +// import ( +// version "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" +// ) -func init() { - // Register the types with the Scheme so the components can map objects to GroupVersionKinds and back - AddToSchemes = append(AddToSchemes, version.SchemeBuilder.AddToScheme) -} +// func init() { +// // Register the types with the Scheme so the components can map objects to GroupVersionKinds and back +// AddToSchemes = append(AddToSchemes, version.SchemeBuilder.AddToScheme) +// } diff --git a/pkg/apis/addtoscheme_iot_v1alpha2.go b/pkg/apis/addtoscheme_iot_v1alpha2.go index a42e086bb61..5a1567d6f17 100644 --- a/pkg/apis/addtoscheme_iot_v1alpha2.go +++ b/pkg/apis/addtoscheme_iot_v1alpha2.go @@ -16,11 +16,11 @@ limitations under the License. package apis -import ( - version "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" -) +// import ( +// version "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" +// ) -func init() { - // Register the types with the Scheme so the components can map objects to GroupVersionKinds and back - AddToSchemes = append(AddToSchemes, version.SchemeBuilder.AddToScheme) -} +// func init() { +// // Register the types with the Scheme so the components can map objects to GroupVersionKinds and back +// AddToSchemes = append(AddToSchemes, version.SchemeBuilder.AddToScheme) +// } diff --git a/pkg/apis/addtoscheme_iot_v1beta1.go b/pkg/apis/addtoscheme_iot_v1beta1.go new file mode 100644 index 00000000000..3ce5a1c7722 --- /dev/null +++ b/pkg/apis/addtoscheme_iot_v1beta1.go @@ -0,0 +1,26 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package apis + +import ( + version "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" +) + +func init() { + // Register the types with the Scheme so the components can map objects to GroupVersionKinds and back + AddToSchemes = append(AddToSchemes, version.SchemeBuilder.AddToScheme) +} diff --git a/pkg/apis/iot/v1alpha1/platformadmin_conversion.go b/pkg/apis/iot/v1alpha1/platformadmin_conversion.go index 1736ca18d21..9b125b9777b 100644 --- a/pkg/apis/iot/v1alpha1/platformadmin_conversion.go +++ b/pkg/apis/iot/v1alpha1/platformadmin_conversion.go @@ -16,126 +16,126 @@ limitations under the License. package v1alpha1 -import ( - "encoding/json" - - corev1 "k8s.io/api/core/v1" - "sigs.k8s.io/controller-runtime/pkg/conversion" - - "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" -) - -func (src *PlatformAdmin) ConvertTo(dstRaw conversion.Hub) error { - // Transform metadata - dst := dstRaw.(*v1alpha2.PlatformAdmin) - dst.ObjectMeta = src.ObjectMeta - dst.TypeMeta = src.TypeMeta - dst.TypeMeta.APIVersion = "iot.openyurt.io/v1alpha2" - - // Transform spec - dst.Spec.Version = src.Spec.Version - dst.Spec.Security = false - dst.Spec.ImageRegistry = src.Spec.ImageRegistry - dst.Spec.PoolName = src.Spec.PoolName - dst.Spec.Platform = v1alpha2.PlatformAdminPlatformEdgeX - - // Transform status - dst.Status.Ready = src.Status.Ready - dst.Status.Initialized = src.Status.Initialized - dst.Status.ReadyComponentNum = src.Status.DeploymentReadyReplicas - dst.Status.UnreadyComponentNum = src.Status.DeploymentReplicas - src.Status.DeploymentReadyReplicas - dst.Status.Conditions = transToV2Condition(src.Status.Conditions) - - // Transform additionaldeployment - if len(src.Spec.AdditionalDeployment) > 0 { - additionalDeployment, err := json.Marshal(src.Spec.AdditionalDeployment) - if err != nil { - return err - } - dst.ObjectMeta.Annotations["AdditionalDeployments"] = string(additionalDeployment) - } - - // Transform additionalservice - if len(src.Spec.AdditionalService) > 0 { - additionalService, err := json.Marshal(src.Spec.AdditionalService) - if err != nil { - return err - } - dst.ObjectMeta.Annotations["AdditionalServices"] = string(additionalService) - } - - //TODO: Components - - return nil -} - -func (dst *PlatformAdmin) ConvertFrom(srcRaw conversion.Hub) error { - // Transform metadata - src := srcRaw.(*v1alpha2.PlatformAdmin) - dst.ObjectMeta = src.ObjectMeta - dst.TypeMeta = src.TypeMeta - dst.TypeMeta.APIVersion = "iot.openyurt.io/v1alpha1" - - // Transform spec - dst.Spec.Version = src.Spec.Version - dst.Spec.ImageRegistry = src.Spec.ImageRegistry - dst.Spec.PoolName = src.Spec.PoolName - dst.Spec.ServiceType = corev1.ServiceTypeClusterIP - - // Transform status - dst.Status.Ready = src.Status.Ready - dst.Status.Initialized = src.Status.Initialized - dst.Status.ServiceReadyReplicas = src.Status.ReadyComponentNum - dst.Status.ServiceReplicas = src.Status.ReadyComponentNum + src.Status.UnreadyComponentNum - dst.Status.DeploymentReadyReplicas = src.Status.ReadyComponentNum - dst.Status.DeploymentReplicas = src.Status.ReadyComponentNum + src.Status.UnreadyComponentNum - dst.Status.Conditions = transToV1Condition(src.Status.Conditions) - - // Transform additionaldeployment - if _, ok := src.ObjectMeta.Annotations["AdditionalDeployments"]; ok { - var additionalDeployments []DeploymentTemplateSpec = make([]DeploymentTemplateSpec, 0) - err := json.Unmarshal([]byte(src.ObjectMeta.Annotations["AdditionalDeployments"]), &additionalDeployments) - if err != nil { - return err - } - dst.Spec.AdditionalDeployment = additionalDeployments - } - - // Transform additionalservice - if _, ok := src.ObjectMeta.Annotations["AdditionalServices"]; ok { - var additionalServices []ServiceTemplateSpec = make([]ServiceTemplateSpec, 0) - err := json.Unmarshal([]byte(src.ObjectMeta.Annotations["AdditionalServices"]), &additionalServices) - if err != nil { - return err - } - dst.Spec.AdditionalService = additionalServices - } - - return nil -} - -func transToV1Condition(c2 []v1alpha2.PlatformAdminCondition) (c1 []PlatformAdminCondition) { - for _, ic := range c2 { - c1 = append(c1, PlatformAdminCondition{ - Type: PlatformAdminConditionType(ic.Type), - Status: ic.Status, - LastTransitionTime: ic.LastTransitionTime, - Reason: ic.Reason, - Message: ic.Message, - }) - } - return -} - -func transToV2Condition(c1 []PlatformAdminCondition) (c2 []v1alpha2.PlatformAdminCondition) { - for _, ic := range c1 { - c2 = append(c2, v1alpha2.PlatformAdminCondition{ - Type: v1alpha2.PlatformAdminConditionType(ic.Type), - Status: ic.Status, - LastTransitionTime: ic.LastTransitionTime, - Reason: ic.Reason, - Message: ic.Message, - }) - } - return -} +// import ( +// "encoding/json" + +// corev1 "k8s.io/api/core/v1" +// "sigs.k8s.io/controller-runtime/pkg/conversion" + +// "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" +// ) + +// func (src *PlatformAdmin) ConvertTo(dstRaw conversion.Hub) error { +// // Transform metadata +// dst := dstRaw.(*v1alpha2.PlatformAdmin) +// dst.ObjectMeta = src.ObjectMeta +// dst.TypeMeta = src.TypeMeta +// dst.TypeMeta.APIVersion = "iot.openyurt.io/v1alpha2" + +// // Transform spec +// dst.Spec.Version = src.Spec.Version +// dst.Spec.Security = false +// dst.Spec.ImageRegistry = src.Spec.ImageRegistry +// dst.Spec.PoolName = src.Spec.PoolName +// dst.Spec.Platform = v1alpha2.PlatformAdminPlatformEdgeX + +// // Transform status +// dst.Status.Ready = src.Status.Ready +// dst.Status.Initialized = src.Status.Initialized +// dst.Status.ReadyComponentNum = src.Status.DeploymentReadyReplicas +// dst.Status.UnreadyComponentNum = src.Status.DeploymentReplicas - src.Status.DeploymentReadyReplicas +// dst.Status.Conditions = transToV2Condition(src.Status.Conditions) + +// // Transform additionaldeployment +// if len(src.Spec.AdditionalDeployment) > 0 { +// additionalDeployment, err := json.Marshal(src.Spec.AdditionalDeployment) +// if err != nil { +// return err +// } +// dst.ObjectMeta.Annotations["AdditionalDeployments"] = string(additionalDeployment) +// } + +// // Transform additionalservice +// if len(src.Spec.AdditionalService) > 0 { +// additionalService, err := json.Marshal(src.Spec.AdditionalService) +// if err != nil { +// return err +// } +// dst.ObjectMeta.Annotations["AdditionalServices"] = string(additionalService) +// } + +// //TODO: Components + +// return nil +// } + +// func (dst *PlatformAdmin) ConvertFrom(srcRaw conversion.Hub) error { +// // Transform metadata +// src := srcRaw.(*v1alpha2.PlatformAdmin) +// dst.ObjectMeta = src.ObjectMeta +// dst.TypeMeta = src.TypeMeta +// dst.TypeMeta.APIVersion = "iot.openyurt.io/v1alpha1" + +// // Transform spec +// dst.Spec.Version = src.Spec.Version +// dst.Spec.ImageRegistry = src.Spec.ImageRegistry +// dst.Spec.PoolName = src.Spec.PoolName +// dst.Spec.ServiceType = corev1.ServiceTypeClusterIP + +// // Transform status +// dst.Status.Ready = src.Status.Ready +// dst.Status.Initialized = src.Status.Initialized +// dst.Status.ServiceReadyReplicas = src.Status.ReadyComponentNum +// dst.Status.ServiceReplicas = src.Status.ReadyComponentNum + src.Status.UnreadyComponentNum +// dst.Status.DeploymentReadyReplicas = src.Status.ReadyComponentNum +// dst.Status.DeploymentReplicas = src.Status.ReadyComponentNum + src.Status.UnreadyComponentNum +// dst.Status.Conditions = transToV1Condition(src.Status.Conditions) + +// // Transform additionaldeployment +// if _, ok := src.ObjectMeta.Annotations["AdditionalDeployments"]; ok { +// var additionalDeployments []DeploymentTemplateSpec = make([]DeploymentTemplateSpec, 0) +// err := json.Unmarshal([]byte(src.ObjectMeta.Annotations["AdditionalDeployments"]), &additionalDeployments) +// if err != nil { +// return err +// } +// dst.Spec.AdditionalDeployment = additionalDeployments +// } + +// // Transform additionalservice +// if _, ok := src.ObjectMeta.Annotations["AdditionalServices"]; ok { +// var additionalServices []ServiceTemplateSpec = make([]ServiceTemplateSpec, 0) +// err := json.Unmarshal([]byte(src.ObjectMeta.Annotations["AdditionalServices"]), &additionalServices) +// if err != nil { +// return err +// } +// dst.Spec.AdditionalService = additionalServices +// } + +// return nil +// } + +// func transToV1Condition(c2 []v1alpha2.PlatformAdminCondition) (c1 []PlatformAdminCondition) { +// for _, ic := range c2 { +// c1 = append(c1, PlatformAdminCondition{ +// Type: PlatformAdminConditionType(ic.Type), +// Status: ic.Status, +// LastTransitionTime: ic.LastTransitionTime, +// Reason: ic.Reason, +// Message: ic.Message, +// }) +// } +// return +// } + +// func transToV2Condition(c1 []PlatformAdminCondition) (c2 []v1alpha2.PlatformAdminCondition) { +// for _, ic := range c1 { +// c2 = append(c2, v1alpha2.PlatformAdminCondition{ +// Type: v1alpha2.PlatformAdminConditionType(ic.Type), +// Status: ic.Status, +// LastTransitionTime: ic.LastTransitionTime, +// Reason: ic.Reason, +// Message: ic.Message, +// }) +// } +// return +// } diff --git a/pkg/apis/iot/v1alpha2/platformadmin_conversion.go b/pkg/apis/iot/v1alpha2/platformadmin_conversion.go index fb18ecb1bea..6e247dd0e51 100644 --- a/pkg/apis/iot/v1alpha2/platformadmin_conversion.go +++ b/pkg/apis/iot/v1alpha2/platformadmin_conversion.go @@ -16,5 +16,107 @@ limitations under the License. package v1alpha2 -// Hub marks this type as a conversion hub. -func (*PlatformAdmin) Hub() {} +import ( + "encoding/json" + + "sigs.k8s.io/controller-runtime/pkg/conversion" + + "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" +) + +func (src *PlatformAdmin) ConvertTo(dstRaw conversion.Hub) error { + // Transform metadata + dst := dstRaw.(*v1beta1.PlatformAdmin) + dst.ObjectMeta = src.ObjectMeta + dst.TypeMeta = src.TypeMeta + dst.TypeMeta.APIVersion = "iot.openyurt.io/v1beta1" + // Transform spec + dst.Spec.Version = src.Spec.Version + dst.Spec.Security = false + dst.Spec.ImageRegistry = src.Spec.ImageRegistry + dst.Spec.NodePools = []string{src.Spec.PoolName} + dst.Spec.Platform = v1beta1.PlatformAdminPlatformEdgeX + dst.Spec.Components = make([]v1beta1.Component, len(src.Spec.Components)) + for i, component := range src.Spec.Components { + dst.Spec.Components[i] = v1beta1.Component{ + Name: component.Name, + } + } + // Transform status + dst.Status.Ready = src.Status.Ready + dst.Status.Initialized = src.Status.Initialized + dst.Status.ReadyComponentNum = src.Status.ReadyComponentNum + dst.Status.UnreadyComponentNum = src.Status.UnreadyComponentNum + dst.Status.Conditions = transToV1Beta1Condition(src.Status.Conditions) + // Transform AdditionalNodepools + if _, ok := src.ObjectMeta.Annotations["AdditionalNodepools"]; ok { + var additionalNodePools []string + err := json.Unmarshal([]byte(src.ObjectMeta.Annotations["AdditionalNodepools"]), &additionalNodePools) + if err != nil { + return err + } + dst.Spec.NodePools = append(dst.Spec.NodePools, additionalNodePools...) + } + return nil +} + +func (dst *PlatformAdmin) ConvertFrom(srcRaw conversion.Hub) error { + // Transform metadata + src := srcRaw.(*v1beta1.PlatformAdmin) + dst.ObjectMeta = src.ObjectMeta + dst.TypeMeta = src.TypeMeta + dst.TypeMeta.APIVersion = "iot.openyurt.io/v1alpha2" + // Transform spec + dst.Spec.Version = src.Spec.Version + dst.Spec.Security = false + dst.Spec.ImageRegistry = src.Spec.ImageRegistry + dst.Spec.PoolName = src.Spec.NodePools[0] + if len(src.Spec.NodePools) > 1 { + additionalNodePools := src.Spec.NodePools[1:] + additionalNodePoolsJSON, err := json.Marshal(additionalNodePools) + if err != nil { + return err + } + dst.ObjectMeta.Annotations["AdditionalNodepools"] = string(additionalNodePoolsJSON) + } + dst.Spec.Platform = PlatformAdminPlatformEdgeX + dst.Spec.Components = make([]Component, len(src.Spec.Components)) + for i, component := range src.Spec.Components { + dst.Spec.Components[i] = Component{ + Name: component.Name, + } + } + // Transform status + dst.Status.Ready = src.Status.Ready + dst.Status.Initialized = src.Status.Initialized + dst.Status.ReadyComponentNum = src.Status.ReadyComponentNum + dst.Status.UnreadyComponentNum = src.Status.UnreadyComponentNum + dst.Status.Conditions = transToV1Alpha2Condition(src.Status.Conditions) + return nil +} + +func transToV1Alpha2Condition(srcConditions []v1beta1.PlatformAdminCondition) (dstConditions []PlatformAdminCondition) { + for _, condition := range srcConditions { + dstConditions = append(dstConditions, PlatformAdminCondition{ + Type: PlatformAdminConditionType(condition.Type), + Status: condition.Status, + LastTransitionTime: condition.LastTransitionTime, + Reason: condition.Reason, + Message: condition.Message, + }) + } + return +} + +func transToV1Beta1Condition(srcConditions []PlatformAdminCondition) (dstConditions []v1beta1.PlatformAdminCondition) { + for _, condition := range srcConditions { + dstConditions = append(dstConditions, v1beta1.PlatformAdminCondition{ + Type: v1beta1.PlatformAdminConditionType(condition.Type), + Status: condition.Status, + LastTransitionTime: condition.LastTransitionTime, + Reason: condition.Reason, + Message: condition.Message, + }) + } + return +} diff --git a/pkg/apis/iot/v1alpha2/platformadmin_types.go b/pkg/apis/iot/v1alpha2/platformadmin_types.go index a9be10a55aa..fd54a5cd4cc 100644 --- a/pkg/apis/iot/v1alpha2/platformadmin_types.go +++ b/pkg/apis/iot/v1alpha2/platformadmin_types.go @@ -105,7 +105,7 @@ type PlatformAdminCondition struct { // +kubebuilder:printcolumn:name="READY",type="boolean",JSONPath=".status.ready",description="The platformadmin ready status" // +kubebuilder:printcolumn:name="ReadyComponentNum",type="integer",JSONPath=".status.readyComponentNum",description="The Ready Component." // +kubebuilder:printcolumn:name="UnreadyComponentNum",type="integer",JSONPath=".status.unreadyComponentNum",description="The Unready Component." -// +kubebuilder:storageversion +// +kubebuilder:unservedversion // PlatformAdmin is the Schema for the samples API type PlatformAdmin struct { diff --git a/pkg/apis/iot/v1beta1/condition_const.go b/pkg/apis/iot/v1beta1/condition_const.go new file mode 100644 index 00000000000..494446a25a4 --- /dev/null +++ b/pkg/apis/iot/v1beta1/condition_const.go @@ -0,0 +1,32 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1beta1 + +const ( + // ConfigmapAvailableCondition documents the status of the PlatformAdmin configmap. + ConfigmapAvailableCondition PlatformAdminConditionType = "ConfigmapAvailable" + + ConfigmapProvisioningReason = "ConfigmapProvisioning" + + ConfigmapProvisioningFailedReason = "ConfigmapProvisioningFailed" + // ComponentAvailableCondition documents the status of the PlatformAdmin component. + ComponentAvailableCondition PlatformAdminConditionType = "ComponentAvailable" + + ComponentProvisioningReason = "ComponentProvisioning" + + ComponentProvisioningFailedReason = "ComponentProvisioningFailed" +) diff --git a/pkg/apis/iot/v1beta1/default.go b/pkg/apis/iot/v1beta1/default.go new file mode 100644 index 00000000000..64eaeb66eff --- /dev/null +++ b/pkg/apis/iot/v1beta1/default.go @@ -0,0 +1,24 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1beta1 + +// SetDefaultsPlatformAdmin set default values for PlatformAdmin. +func SetDefaultsPlatformAdmin(obj *PlatformAdmin) { + if obj.Annotations == nil { + obj.Annotations = make(map[string]string) + } +} diff --git a/pkg/apis/iot/v1beta1/doc.go b/pkg/apis/iot/v1beta1/doc.go new file mode 100644 index 00000000000..2d9e27a49b7 --- /dev/null +++ b/pkg/apis/iot/v1beta1/doc.go @@ -0,0 +1,17 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// +groupName=iot.openyurt.io +package v1beta1 diff --git a/pkg/apis/iot/v1beta1/groupversion_info.go b/pkg/apis/iot/v1beta1/groupversion_info.go new file mode 100644 index 00000000000..7e296f31ba0 --- /dev/null +++ b/pkg/apis/iot/v1beta1/groupversion_info.go @@ -0,0 +1,44 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1beta1 + +// Package v1beta1 contains API Schema definitions for the device v1beta1API group +// +kubebuilder:object:generate=true +// +groupName=iot.openyurt.io + +import ( + "k8s.io/apimachinery/pkg/runtime/schema" + "sigs.k8s.io/controller-runtime/pkg/scheme" +) + +var ( + // GroupVersion is group version used to register these objects + GroupVersion = schema.GroupVersion{Group: "iot.openyurt.io", Version: "v1beta1"} + + SchemeGroupVersion = GroupVersion + + // SchemeBuilder is used to add go types to the GroupVersionKind scheme + SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion} + + // AddToScheme adds the types in this group-version to the given scheme. + AddToScheme = SchemeBuilder.AddToScheme +) + +// Resource is required by pkg/client/listers/... +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} diff --git a/pkg/apis/iot/v1beta1/platformadmin_conversion.go b/pkg/apis/iot/v1beta1/platformadmin_conversion.go new file mode 100644 index 00000000000..0d3c9768ca3 --- /dev/null +++ b/pkg/apis/iot/v1beta1/platformadmin_conversion.go @@ -0,0 +1,20 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1beta1 + +// Hub marks this type as a conversion hub. +func (*PlatformAdmin) Hub() {} diff --git a/pkg/apis/iot/v1beta1/platformadmin_types.go b/pkg/apis/iot/v1beta1/platformadmin_types.go new file mode 100644 index 00000000000..286d108eb65 --- /dev/null +++ b/pkg/apis/iot/v1beta1/platformadmin_types.go @@ -0,0 +1,138 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1beta1 + +import ( + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +const ( + // name of finalizer + PlatformAdminFinalizer = "iot.openyurt.io" + + LabelPlatformAdminGenerate = "iot.openyurt.io/generate" +) + +// PlatformAdmin platform supported by openyurt +const ( + PlatformAdminPlatformEdgeX = "edgex" +) + +// PlatformAdminConditionType indicates valid conditions type of a PlatformAdmin. +type PlatformAdminConditionType string +type PlatformAdminConditionSeverity string + +// Component defines the components of EdgeX +type Component struct { + Name string `json:"name"` +} + +// PlatformAdminSpec defines the desired state of PlatformAdmin +type PlatformAdminSpec struct { + Version string `json:"version,omitempty"` + + ImageRegistry string `json:"imageRegistry,omitempty"` + + NodePools []string `json:"nodepools,omitempty"` + + // +optional + Platform string `json:"platform,omitempty"` + + // +optional + Components []Component `json:"components,omitempty"` + + // +optional + Security bool `json:"security,omitempty"` +} + +// PlatformAdminStatus defines the observed state of PlatformAdmin +type PlatformAdminStatus struct { + // +optional + Ready bool `json:"ready,omitempty"` + + // +optional + Initialized bool `json:"initialized,omitempty"` + + // +optional + ReadyComponentNum int32 `json:"readyComponentNum,omitempty"` + + // +optional + UnreadyComponentNum int32 `json:"unreadyComponentNum,omitempty"` + + // Current PlatformAdmin state + // +optional + Conditions []PlatformAdminCondition `json:"conditions,omitempty"` +} + +// PlatformAdminCondition describes current state of a PlatformAdmin. +type PlatformAdminCondition struct { + // Type of in place set condition. + Type PlatformAdminConditionType `json:"type,omitempty"` + + // Status of the condition, one of True, False, Unknown. + Status corev1.ConditionStatus `json:"status,omitempty"` + + // Last time the condition transitioned from one status to another. + LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"` + + // The reason for the condition's last transition. + Reason string `json:"reason,omitempty"` + + // A human readable message indicating details about the transition. + Message string `json:"message,omitempty"` +} + +// +genclient +// +k8s:openapi-gen=true +// +kubebuilder:object:root=true +// +kubebuilder:subresource:status +// +kubebuilder:resource:scope=Namespaced,path=platformadmins,shortName=pa,categories=all +// +kubebuilder:printcolumn:name="READY",type="boolean",JSONPath=".status.ready",description="The platformadmin ready status" +// +kubebuilder:printcolumn:name="ReadyComponentNum",type="integer",JSONPath=".status.readyComponentNum",description="The Ready Component." +// +kubebuilder:printcolumn:name="UnreadyComponentNum",type="integer",JSONPath=".status.unreadyComponentNum",description="The Unready Component." +// +kubebuilder:storageversion + +// PlatformAdmin is the Schema for the samples API +type PlatformAdmin struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec PlatformAdminSpec `json:"spec,omitempty"` + Status PlatformAdminStatus `json:"status,omitempty"` +} + +func (c *PlatformAdmin) GetConditions() []PlatformAdminCondition { + return c.Status.Conditions +} + +func (c *PlatformAdmin) SetConditions(conditions []PlatformAdminCondition) { + c.Status.Conditions = conditions +} + +//+kubebuilder:object:root=true + +// PlatformAdminList contains a list of PlatformAdmin +type PlatformAdminList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []PlatformAdmin `json:"items"` +} + +func init() { + SchemeBuilder.Register(&PlatformAdmin{}, &PlatformAdminList{}) +} diff --git a/pkg/apis/iot/v1beta1/zz_generated.deepcopy.go b/pkg/apis/iot/v1beta1/zz_generated.deepcopy.go new file mode 100644 index 00000000000..bb8cfac2242 --- /dev/null +++ b/pkg/apis/iot/v1beta1/zz_generated.deepcopy.go @@ -0,0 +1,162 @@ +//go:build !ignore_autogenerated + +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by controller-gen. DO NOT EDIT. + +package v1beta1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Component) DeepCopyInto(out *Component) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Component. +func (in *Component) DeepCopy() *Component { + if in == nil { + return nil + } + out := new(Component) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PlatformAdmin) DeepCopyInto(out *PlatformAdmin) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + in.Status.DeepCopyInto(&out.Status) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlatformAdmin. +func (in *PlatformAdmin) DeepCopy() *PlatformAdmin { + if in == nil { + return nil + } + out := new(PlatformAdmin) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *PlatformAdmin) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PlatformAdminCondition) DeepCopyInto(out *PlatformAdminCondition) { + *out = *in + in.LastTransitionTime.DeepCopyInto(&out.LastTransitionTime) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlatformAdminCondition. +func (in *PlatformAdminCondition) DeepCopy() *PlatformAdminCondition { + if in == nil { + return nil + } + out := new(PlatformAdminCondition) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PlatformAdminList) DeepCopyInto(out *PlatformAdminList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]PlatformAdmin, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlatformAdminList. +func (in *PlatformAdminList) DeepCopy() *PlatformAdminList { + if in == nil { + return nil + } + out := new(PlatformAdminList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *PlatformAdminList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PlatformAdminSpec) DeepCopyInto(out *PlatformAdminSpec) { + *out = *in + if in.NodePools != nil { + in, out := &in.NodePools, &out.NodePools + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.Components != nil { + in, out := &in.Components, &out.Components + *out = make([]Component, len(*in)) + copy(*out, *in) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlatformAdminSpec. +func (in *PlatformAdminSpec) DeepCopy() *PlatformAdminSpec { + if in == nil { + return nil + } + out := new(PlatformAdminSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PlatformAdminStatus) DeepCopyInto(out *PlatformAdminStatus) { + *out = *in + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]PlatformAdminCondition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PlatformAdminStatus. +func (in *PlatformAdminStatus) DeepCopy() *PlatformAdminStatus { + if in == nil { + return nil + } + out := new(PlatformAdminStatus) + in.DeepCopyInto(out) + return out +} diff --git a/pkg/yurtmanager/controller/platformadmin/iotdock.go b/pkg/yurtmanager/controller/platformadmin/iotdock.go index 8894a637240..3df438759fa 100644 --- a/pkg/yurtmanager/controller/platformadmin/iotdock.go +++ b/pkg/yurtmanager/controller/platformadmin/iotdock.go @@ -26,13 +26,13 @@ import ( "k8s.io/apimachinery/pkg/util/intstr" "k8s.io/utils/pointer" - iotv1alpha2 "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" + iotv1beta1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/config" utils "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/utils" ) // newYurtIoTDockComponent initialize the configuration of yurt-iot-dock component -func newYurtIoTDockComponent(platformAdmin *iotv1alpha2.PlatformAdmin, platformAdminFramework *PlatformAdminFramework) (*config.Component, error) { +func newYurtIoTDockComponent(platformAdmin *iotv1beta1.PlatformAdmin, platformAdminFramework *PlatformAdminFramework) (*config.Component, error) { var yurtIotDockComponent config.Component // If the configuration of the yurt-iot-dock component that customized in the platformAdminFramework diff --git a/pkg/yurtmanager/controller/platformadmin/platform_admin_controller.go b/pkg/yurtmanager/controller/platformadmin/platform_admin_controller.go index 8fefe2d97fe..73ba52f12aa 100644 --- a/pkg/yurtmanager/controller/platformadmin/platform_admin_controller.go +++ b/pkg/yurtmanager/controller/platformadmin/platform_admin_controller.go @@ -18,7 +18,6 @@ package platformadmin import ( "context" - "encoding/json" "fmt" "time" @@ -48,8 +47,7 @@ import ( appconfig "github.com/openyurtio/openyurt/cmd/yurt-manager/app/config" "github.com/openyurtio/openyurt/cmd/yurt-manager/names" appsv1beta1 "github.com/openyurtio/openyurt/pkg/apis/apps/v1beta1" - iotv1alpha1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" - iotv1alpha2 "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" + iotv1beta1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/config" util "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/utils" ) @@ -60,7 +58,7 @@ func Format(format string, args ...interface{}) string { } var ( - controllerResource = iotv1alpha2.SchemeGroupVersion.WithResource("platformadmins") + controllerResource = iotv1beta1.SchemeGroupVersion.WithResource("platformadmins") ) const ( @@ -146,25 +144,25 @@ func add(mgr manager.Manager, cfg *appconfig.CompletedConfig, r reconcile.Reconc } // Watch for changes to PlatformAdmin - err = c.Watch(source.Kind(mgr.GetCache(), &iotv1alpha2.PlatformAdmin{}), &handler.EnqueueRequestForObject{}) + err = c.Watch(source.Kind(mgr.GetCache(), &iotv1beta1.PlatformAdmin{}), &handler.EnqueueRequestForObject{}) if err != nil { return err } err = c.Watch(source.Kind(mgr.GetCache(), &corev1.ConfigMap{}), - handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &iotv1alpha2.PlatformAdmin{}, handler.OnlyControllerOwner())) + handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &iotv1beta1.PlatformAdmin{}, handler.OnlyControllerOwner())) if err != nil { return err } err = c.Watch(source.Kind(mgr.GetCache(), &corev1.Service{}), - handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &iotv1alpha2.PlatformAdmin{}, handler.OnlyControllerOwner())) + handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &iotv1beta1.PlatformAdmin{}, handler.OnlyControllerOwner())) if err != nil { return err } err = c.Watch(source.Kind(mgr.GetCache(), &appsv1beta1.YurtAppSet{}), - handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &iotv1alpha2.PlatformAdmin{}, handler.OnlyControllerOwner())) + handler.EnqueueRequestForOwner(mgr.GetScheme(), mgr.GetRESTMapper(), &iotv1beta1.PlatformAdmin{}, handler.OnlyControllerOwner())) if err != nil { return err } @@ -194,7 +192,7 @@ func (r *ReconcilePlatformAdmin) Reconcile(ctx context.Context, request reconcil klog.Infof(Format("Reconcile PlatformAdmin %s/%s", request.Namespace, request.Name)) // Fetch the PlatformAdmin instance - platformAdmin := &iotv1alpha2.PlatformAdmin{} + platformAdmin := &iotv1beta1.PlatformAdmin{} if err := r.Get(ctx, request.NamespacedName, platformAdmin); err != nil { if apierrors.IsNotFound(err) { return reconcile.Result{}, nil @@ -212,10 +210,10 @@ func (r *ReconcilePlatformAdmin) Reconcile(ctx context.Context, request reconcil if !*isDeleted { // Finally check whether PlatformAdmin is Ready platformAdminStatus.Ready = true - if cond := util.GetPlatformAdminCondition(*platformAdminStatus, iotv1alpha2.ConfigmapAvailableCondition); cond.Status == corev1.ConditionFalse { + if cond := util.GetPlatformAdminCondition(*platformAdminStatus, iotv1beta1.ConfigmapAvailableCondition); cond.Status == corev1.ConditionFalse { platformAdminStatus.Ready = false } - if cond := util.GetPlatformAdminCondition(*platformAdminStatus, iotv1alpha2.ComponentAvailableCondition); cond.Status == corev1.ConditionFalse { + if cond := util.GetPlatformAdminCondition(*platformAdminStatus, iotv1beta1.ComponentAvailableCondition); cond.Status == corev1.ConditionFalse { platformAdminStatus.Ready = false } if platformAdminStatus.UnreadyComponentNum != 0 { @@ -243,7 +241,7 @@ func (r *ReconcilePlatformAdmin) Reconcile(ctx context.Context, request reconcil return r.reconcileNormal(ctx, platformAdmin, platformAdminStatus) } -func (r *ReconcilePlatformAdmin) reconcileDelete(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin) (reconcile.Result, error) { +func (r *ReconcilePlatformAdmin) reconcileDelete(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin) (reconcile.Result, error) { klog.V(4).Infof(Format("ReconcileDelete PlatformAdmin %s/%s", platformAdmin.Namespace, platformAdmin.Name)) yas := &appsv1beta1.YurtAppSet{} @@ -253,13 +251,6 @@ func (r *ReconcilePlatformAdmin) reconcileDelete(ctx context.Context, platformAd } desiredComponents := platformAdminFramework.Components - additionalComponents, err := annotationToComponent(platformAdmin.Annotations) - if err != nil { - klog.Errorf(Format("annotationToComponent error %v", err)) - return reconcile.Result{}, err - } - desiredComponents = append(desiredComponents, additionalComponents...) - for _, dc := range desiredComponents { if err := r.Get( ctx, @@ -273,7 +264,7 @@ func (r *ReconcilePlatformAdmin) reconcileDelete(ctx context.Context, platformAd newPools := make([]string, 0) for _, poolName := range yas.Spec.Pools { - if poolName != platformAdmin.Spec.PoolName { + if !util.Contains(platformAdmin.Spec.NodePools, poolName) { newPools = append(newPools, poolName) } } @@ -283,7 +274,7 @@ func (r *ReconcilePlatformAdmin) reconcileDelete(ctx context.Context, platformAd for _, tweak := range yas.Spec.Workload.WorkloadTweaks { newTweakPools := make([]string, 0) for _, poolName := range tweak.Pools { - if poolName != platformAdmin.Spec.PoolName { + if !util.Contains(platformAdmin.Spec.NodePools, poolName) { newTweakPools = append(newTweakPools, poolName) } } @@ -302,7 +293,7 @@ func (r *ReconcilePlatformAdmin) reconcileDelete(ctx context.Context, platformAd } } - controllerutil.RemoveFinalizer(platformAdmin, iotv1alpha2.PlatformAdminFinalizer) + controllerutil.RemoveFinalizer(platformAdmin, iotv1beta1.PlatformAdminFinalizer) if err := r.Client.Update(ctx, platformAdmin); err != nil { klog.Errorf(Format("Update PlatformAdmin %s error %v", klog.KObj(platformAdmin), err)) return reconcile.Result{}, err @@ -311,9 +302,9 @@ func (r *ReconcilePlatformAdmin) reconcileDelete(ctx context.Context, platformAd return reconcile.Result{}, nil } -func (r *ReconcilePlatformAdmin) reconcileNormal(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin, platformAdminStatus *iotv1alpha2.PlatformAdminStatus) (reconcile.Result, error) { +func (r *ReconcilePlatformAdmin) reconcileNormal(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin, platformAdminStatus *iotv1beta1.PlatformAdminStatus) (reconcile.Result, error) { klog.V(4).Infof(Format("ReconcileNormal PlatformAdmin %s/%s", platformAdmin.Namespace, platformAdmin.Name)) - controllerutil.AddFinalizer(platformAdmin, iotv1alpha2.PlatformAdminFinalizer) + controllerutil.AddFinalizer(platformAdmin, iotv1beta1.PlatformAdminFinalizer) platformAdminStatus.Initialized = true @@ -329,27 +320,27 @@ func (r *ReconcilePlatformAdmin) reconcileNormal(ctx context.Context, platformAd klog.V(4).Infof(Format("ReconcileConfigmap PlatformAdmin %s/%s", platformAdmin.Namespace, platformAdmin.Name)) if ok, err := r.reconcileConfigmap(ctx, platformAdmin, platformAdminStatus, platformAdminFramework); !ok { if err != nil { - util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1alpha2.ConfigmapAvailableCondition, corev1.ConditionFalse, iotv1alpha2.ConfigmapProvisioningFailedReason, err.Error())) + util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1beta1.ConfigmapAvailableCondition, corev1.ConditionFalse, iotv1beta1.ConfigmapProvisioningFailedReason, err.Error())) return reconcile.Result{}, errors.Wrapf(err, "unexpected error while reconciling configmap for %s", platformAdmin.Namespace+"/"+platformAdmin.Name) } - util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1alpha2.ConfigmapAvailableCondition, corev1.ConditionFalse, iotv1alpha2.ConfigmapProvisioningReason, "")) + util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1beta1.ConfigmapAvailableCondition, corev1.ConditionFalse, iotv1beta1.ConfigmapProvisioningReason, "")) return reconcile.Result{RequeueAfter: 10 * time.Second}, nil } - util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1alpha2.ConfigmapAvailableCondition, corev1.ConditionTrue, "", "")) + util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1beta1.ConfigmapAvailableCondition, corev1.ConditionTrue, "", "")) // Reconcile component of edgex confiruation klog.V(4).Infof(Format("ReconcileComponent PlatformAdmin %s/%s", platformAdmin.Namespace, platformAdmin.Name)) if ok, err := r.reconcileComponent(ctx, platformAdmin, platformAdminStatus, platformAdminFramework); !ok { if err != nil { - util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1alpha2.ComponentAvailableCondition, corev1.ConditionFalse, iotv1alpha2.ComponentProvisioningReason, err.Error())) + util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1beta1.ComponentAvailableCondition, corev1.ConditionFalse, iotv1beta1.ComponentProvisioningReason, err.Error())) return reconcile.Result{}, errors.Wrapf(err, "unexpected error while reconciling component for %s", platformAdmin.Namespace+"/"+platformAdmin.Name) } - util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1alpha2.ComponentAvailableCondition, corev1.ConditionFalse, iotv1alpha2.ComponentProvisioningReason, "")) + util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1beta1.ComponentAvailableCondition, corev1.ConditionFalse, iotv1beta1.ComponentProvisioningReason, "")) return reconcile.Result{RequeueAfter: 10 * time.Second}, nil } - util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1alpha2.ComponentAvailableCondition, corev1.ConditionTrue, "", "")) + util.SetPlatformAdminCondition(platformAdminStatus, util.NewPlatformAdminCondition(iotv1beta1.ComponentAvailableCondition, corev1.ConditionTrue, "", "")) // Update the metadata of PlatformAdmin if err := r.Client.Update(ctx, platformAdmin); err != nil { @@ -360,7 +351,7 @@ func (r *ReconcilePlatformAdmin) reconcileNormal(ctx context.Context, platformAd return reconcile.Result{}, nil } -func (r *ReconcilePlatformAdmin) reconcileConfigmap(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin, _ *iotv1alpha2.PlatformAdminStatus, platformAdminFramework *PlatformAdminFramework) (bool, error) { +func (r *ReconcilePlatformAdmin) reconcileConfigmap(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin, _ *iotv1beta1.PlatformAdminStatus, platformAdminFramework *PlatformAdminFramework) (bool, error) { var configmaps []corev1.ConfigMap needConfigMaps := make(map[string]struct{}) configmaps = platformAdminFramework.ConfigMaps @@ -368,7 +359,7 @@ func (r *ReconcilePlatformAdmin) reconcileConfigmap(ctx context.Context, platfor for i, configmap := range configmaps { configmap.Namespace = platformAdmin.Namespace configmap.Labels = make(map[string]string) - configmap.Labels[iotv1alpha2.LabelPlatformAdminGenerate] = LabelConfigmap + configmap.Labels[iotv1beta1.LabelPlatformAdminGenerate] = LabelConfigmap _, err := controllerutil.CreateOrUpdate(ctx, r.Client, &configmap, func() error { configmap.Data = platformAdminFramework.ConfigMaps[i].Data return controllerutil.SetOwnerReference(platformAdmin, &configmap, (r.Scheme())) @@ -381,7 +372,7 @@ func (r *ReconcilePlatformAdmin) reconcileConfigmap(ctx context.Context, platfor } configmaplist := &corev1.ConfigMapList{} - if err := r.List(ctx, configmaplist, client.InNamespace(platformAdmin.Namespace), client.MatchingLabels{iotv1alpha2.LabelPlatformAdminGenerate: LabelConfigmap}); err == nil { + if err := r.List(ctx, configmaplist, client.InNamespace(platformAdmin.Namespace), client.MatchingLabels{iotv1beta1.LabelPlatformAdminGenerate: LabelConfigmap}); err == nil { for _, c := range configmaplist.Items { if _, ok := needConfigMaps[c.Name]; !ok { r.removeOwner(ctx, platformAdmin, &c) @@ -392,22 +383,17 @@ func (r *ReconcilePlatformAdmin) reconcileConfigmap(ctx context.Context, platfor return true, nil } -func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin, platformAdminStatus *iotv1alpha2.PlatformAdminStatus, platformAdminFramework *PlatformAdminFramework) (bool, error) { +func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin, platformAdminStatus *iotv1beta1.PlatformAdminStatus, platformAdminFramework *PlatformAdminFramework) (bool, error) { var ( readyComponent int32 = 0 needComponents = make(map[string]struct{}) + needServices = make(map[string]struct{}) ) - // TODO: The additional deployment and service of component is no longer supported in v1beta1. - additionalComponents, err := annotationToComponent(platformAdmin.Annotations) - if err != nil { - return false, err - } - // Users can configure components in the framework, // or they can choose to configure optional components directly in spec, // which combines the two approaches and tells the controller if the framework needs to be updated. - needWriteFramework := r.calculateDesiredComponents(platformAdmin, platformAdminFramework, additionalComponents) + needWriteFramework := r.calculateDesiredComponents(platformAdmin, platformAdminFramework) defer func() { platformAdminStatus.ReadyComponentNum = readyComponent @@ -425,7 +411,8 @@ func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platfor for _, desiredComponent := range platformAdminFramework.Components { readyService := false readyDeployment := false - needComponents[desiredComponent.Name] = struct{}{} + needServices[desiredComponent.Name] = struct{}{} + needComponents[platformAdmin.Name+"-"+desiredComponent.Name] = struct{}{} if _, err := r.handleService(ctx, platformAdmin, desiredComponent); err != nil { return false, err @@ -434,7 +421,7 @@ func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platfor yas := &appsv1beta1.YurtAppSet{ ObjectMeta: metav1.ObjectMeta{ - Name: desiredComponent.Name, + Name: platformAdmin.Name + "-" + desiredComponent.Name, Namespace: platformAdmin.Namespace, }, } @@ -443,7 +430,7 @@ func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platfor ctx, types.NamespacedName{ Namespace: platformAdmin.Namespace, - Name: desiredComponent.Name}, + Name: platformAdmin.Name + "-" + desiredComponent.Name}, yas) if err != nil { if !apierrors.IsNotFound(err) { @@ -459,34 +446,36 @@ func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platfor // Refresh the YurtAppSet according to the user-defined configuration yas.Spec.WorkloadTemplate.DeploymentTemplate.Spec = *desiredComponent.Deployment - if slices.Contains(yas.Spec.Pools, platformAdmin.Spec.PoolName) { - if yas.Status.ReadyWorkloads == yas.Status.TotalWorkloads { - readyDeployment = true - if readyDeployment && readyService { - readyComponent++ + for _, poolName := range platformAdmin.Spec.NodePools { + if slices.Contains(yas.Spec.Pools, poolName) { + if yas.Status.ReadyWorkloads == yas.Status.TotalWorkloads { + readyDeployment = true + if readyDeployment && readyService { + readyComponent++ + } } } - } - pools := []string{platformAdmin.Spec.PoolName} - tweaks := []appsv1beta1.WorkloadTweak{ - { - Pools: []string{platformAdmin.Spec.PoolName}, - Tweaks: appsv1beta1.Tweaks{ - Replicas: pointer.Int32(1), + pools := []string{poolName} + tweaks := []appsv1beta1.WorkloadTweak{ + { + Pools: []string{poolName}, + Tweaks: appsv1beta1.Tweaks{ + Replicas: pointer.Int32(1), + }, }, - }, - } - flag := false - for _, name := range yas.Spec.Pools { - if name == platformAdmin.Spec.PoolName { - flag = true - break } - } - if !flag { - yas.Spec.Pools = append(yas.Spec.Pools, pools...) - yas.Spec.Workload.WorkloadTweaks = append(yas.Spec.Workload.WorkloadTweaks, tweaks...) + flag := false + for _, name := range yas.Spec.Pools { + if name == poolName { + flag = true + break + } + } + if !flag { + yas.Spec.Pools = append(yas.Spec.Pools, pools...) + yas.Spec.Workload.WorkloadTweaks = append(yas.Spec.Workload.WorkloadTweaks, tweaks...) + } } if err := controllerutil.SetOwnerReference(platformAdmin, yas, r.Scheme()); err != nil { return false, err @@ -500,9 +489,9 @@ func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platfor // Remove the service owner that we do not need servicelist := &corev1.ServiceList{} - if err := r.List(ctx, servicelist, client.InNamespace(platformAdmin.Namespace), client.MatchingLabels{iotv1alpha2.LabelPlatformAdminGenerate: LabelService}); err == nil { + if err := r.List(ctx, servicelist, client.InNamespace(platformAdmin.Namespace), client.MatchingLabels{iotv1beta1.LabelPlatformAdminGenerate: LabelService}); err == nil { for _, s := range servicelist.Items { - if _, ok := needComponents[s.Name]; !ok { + if _, ok := needServices[s.Name]; !ok { r.removeOwner(ctx, platformAdmin, &s) } } @@ -510,7 +499,7 @@ func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platfor // Remove the yurtappset owner that we do not need yurtappsetlist := &appsv1beta1.YurtAppSetList{} - if err := r.List(ctx, yurtappsetlist, client.InNamespace(platformAdmin.Namespace), client.MatchingLabels{iotv1alpha2.LabelPlatformAdminGenerate: LabelDeployment}); err == nil { + if err := r.List(ctx, yurtappsetlist, client.InNamespace(platformAdmin.Namespace), client.MatchingLabels{iotv1beta1.LabelPlatformAdminGenerate: LabelDeployment}); err == nil { for _, s := range yurtappsetlist.Items { if _, ok := needComponents[s.Name]; !ok { r.removeOwner(ctx, platformAdmin, &s) @@ -521,7 +510,7 @@ func (r *ReconcilePlatformAdmin) reconcileComponent(ctx context.Context, platfor return readyComponent == int32(len(platformAdminFramework.Components)), nil } -func (r *ReconcilePlatformAdmin) handleService(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin, component *config.Component) (*corev1.Service, error) { +func (r *ReconcilePlatformAdmin) handleService(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin, component *config.Component) (*corev1.Service, error) { // It is possible that the component does not need service. // Therefore, you need to be careful when calling this function. // It is still possible for service to be nil when there is no error! @@ -537,7 +526,7 @@ func (r *ReconcilePlatformAdmin) handleService(ctx context.Context, platformAdmi Namespace: platformAdmin.Namespace, }, } - service.Labels[iotv1alpha2.LabelPlatformAdminGenerate] = LabelService + service.Labels[iotv1beta1.LabelPlatformAdminGenerate] = LabelService service.Annotations[AnnotationServiceTopologyKey] = AnnotationServiceTopologyValueNodePool _, err := controllerutil.CreateOrUpdate( @@ -555,7 +544,7 @@ func (r *ReconcilePlatformAdmin) handleService(ctx context.Context, platformAdmi return service, nil } -func (r *ReconcilePlatformAdmin) handleYurtAppSet(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin, component *config.Component) (*appsv1beta1.YurtAppSet, error) { +func (r *ReconcilePlatformAdmin) handleYurtAppSet(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin, component *config.Component) (*appsv1beta1.YurtAppSet, error) { // It is possible that the component does not need deployment. // Therefore, you need to be careful when calling this function. // It is still possible for deployment to be nil when there is no error! @@ -567,7 +556,7 @@ func (r *ReconcilePlatformAdmin) handleYurtAppSet(ctx context.Context, platformA ObjectMeta: metav1.ObjectMeta{ Labels: make(map[string]string), Annotations: make(map[string]string), - Name: component.Name, + Name: platformAdmin.Name + "-" + component.Name, Namespace: platformAdmin.Namespace, }, Spec: appsv1beta1.YurtAppSetSpec{ @@ -584,11 +573,23 @@ func (r *ReconcilePlatformAdmin) handleYurtAppSet(ctx context.Context, platformA }, } - yas.Labels[iotv1alpha2.LabelPlatformAdminGenerate] = LabelDeployment - yas.Spec.Pools = []string{platformAdmin.Spec.PoolName} + yas.Labels[iotv1beta1.LabelPlatformAdminGenerate] = LabelDeployment + yas.Spec.Pools = platformAdmin.Spec.NodePools + for _, nodePool := range platformAdmin.Spec.NodePools { + exists := false + for _, pool := range yas.Spec.Pools { + if pool == nodePool { + exists = true + break + } + } + if !exists { + yas.Spec.Pools = append(yas.Spec.Pools, nodePool) + } + } yas.Spec.Workload.WorkloadTweaks = []appsv1beta1.WorkloadTweak{ { - Pools: []string{platformAdmin.Spec.PoolName}, + Pools: yas.Spec.Pools, Tweaks: appsv1beta1.Tweaks{ Replicas: pointer.Int32(1), }, @@ -603,7 +604,7 @@ func (r *ReconcilePlatformAdmin) handleYurtAppSet(ctx context.Context, platformA return yas, nil } -func (r *ReconcilePlatformAdmin) removeOwner(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin, obj client.Object) error { +func (r *ReconcilePlatformAdmin) removeOwner(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin, obj client.Object) error { owners := obj.GetOwnerReferences() for i, owner := range owners { @@ -622,60 +623,7 @@ func (r *ReconcilePlatformAdmin) removeOwner(ctx context.Context, platformAdmin return nil } -// For version compatibility, v1alpha1's additionalservice and additionaldeployment are placed in -// v2alpha2's annotation, this function is to convert the annotation to component. -func annotationToComponent(annotation map[string]string) ([]*config.Component, error) { - var components []*config.Component = []*config.Component{} - var additionalDeployments []iotv1alpha1.DeploymentTemplateSpec = make([]iotv1alpha1.DeploymentTemplateSpec, 0) - if _, ok := annotation["AdditionalDeployments"]; ok { - err := json.Unmarshal([]byte(annotation["AdditionalDeployments"]), &additionalDeployments) - if err != nil { - return nil, err - } - } - var additionalServices []iotv1alpha1.ServiceTemplateSpec = make([]iotv1alpha1.ServiceTemplateSpec, 0) - if _, ok := annotation["AdditionalServices"]; ok { - err := json.Unmarshal([]byte(annotation["AdditionalServices"]), &additionalServices) - if err != nil { - return nil, err - } - } - if len(additionalDeployments) == 0 && len(additionalServices) == 0 { - return components, nil - } - var services map[string]*corev1.ServiceSpec = make(map[string]*corev1.ServiceSpec) - var usedServices map[string]struct{} = make(map[string]struct{}) - for _, additionalservice := range additionalServices { - services[additionalservice.Name] = &additionalservice.Spec - } - for _, additionalDeployment := range additionalDeployments { - var component config.Component - component.Name = additionalDeployment.Name - component.Deployment = &additionalDeployment.Spec - service, ok := services[component.Name] - if ok { - component.Service = service - usedServices[component.Name] = struct{}{} - } - components = append(components, &component) - } - if len(usedServices) < len(services) { - for name, service := range services { - _, ok := usedServices[name] - if ok { - continue - } - var component config.Component - component.Name = name - component.Service = service - components = append(components, &component) - } - } - - return components, nil -} - -func (r *ReconcilePlatformAdmin) readFramework(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin) (*PlatformAdminFramework, error) { +func (r *ReconcilePlatformAdmin) readFramework(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin) (*PlatformAdminFramework, error) { klog.V(6).Infof(Format("Synchronize the customize framework information for PlatformAdmin %s/%s", platformAdmin.Namespace, platformAdmin.Name)) // Try to get the configmap that represents the framework @@ -742,7 +690,7 @@ func (r *ReconcilePlatformAdmin) readFramework(ctx context.Context, platformAdmi return platformAdminFramework, nil } -func (r *ReconcilePlatformAdmin) writeFramework(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin, platformAdminFramework *PlatformAdminFramework) error { +func (r *ReconcilePlatformAdmin) writeFramework(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin, platformAdminFramework *PlatformAdminFramework) error { // For better serialization, the serialization method of the Kubernetes runtime library is used data, err := runtime.Encode(r.yamlSerializer, platformAdminFramework) if err != nil { @@ -780,17 +728,17 @@ func (r *ReconcilePlatformAdmin) writeFramework(ctx context.Context, platformAdm } // initFramework initializes the framework information for PlatformAdmin -func (r *ReconcilePlatformAdmin) initFramework(ctx context.Context, platformAdmin *iotv1alpha2.PlatformAdmin, platformAdminFramework *PlatformAdminFramework) error { +func (r *ReconcilePlatformAdmin) initFramework(ctx context.Context, platformAdmin *iotv1beta1.PlatformAdmin, platformAdminFramework *PlatformAdminFramework) error { klog.V(6).Infof(Format("Initializes the standard framework information for PlatformAdmin %s/%s", platformAdmin.Namespace, platformAdmin.Name)) // Use standard configurations to build the framework platformAdminFramework.security = platformAdmin.Spec.Security if platformAdminFramework.security { platformAdminFramework.ConfigMaps = r.Configuration.SecurityConfigMaps[platformAdmin.Spec.Version] - r.calculateDesiredComponents(platformAdmin, platformAdminFramework, nil) + r.calculateDesiredComponents(platformAdmin, platformAdminFramework) } else { platformAdminFramework.ConfigMaps = r.Configuration.NoSectyConfigMaps[platformAdmin.Spec.Version] - r.calculateDesiredComponents(platformAdmin, platformAdminFramework, nil) + r.calculateDesiredComponents(platformAdmin, platformAdminFramework) } // For better serialization, the serialization method of the Kubernetes runtime library is used @@ -808,7 +756,7 @@ func (r *ReconcilePlatformAdmin) initFramework(ctx context.Context, platformAdmi }, } cm.Labels = make(map[string]string) - cm.Labels[iotv1alpha2.LabelPlatformAdminGenerate] = LabelFramework + cm.Labels[iotv1beta1.LabelPlatformAdminGenerate] = LabelFramework cm.Data = make(map[string]string) cm.Data["framework"] = string(data) // Creates configmap on behalf of the framework, which is called only once upon creation @@ -826,7 +774,7 @@ func (r *ReconcilePlatformAdmin) initFramework(ctx context.Context, platformAdmi } // calculateDesiredComponents calculates the components that need to be added and determines whether the framework needs to be rewritten -func (r *ReconcilePlatformAdmin) calculateDesiredComponents(platformAdmin *iotv1alpha2.PlatformAdmin, platformAdminFramework *PlatformAdminFramework, additionalComponents []*config.Component) bool { +func (r *ReconcilePlatformAdmin) calculateDesiredComponents(platformAdmin *iotv1beta1.PlatformAdmin, platformAdminFramework *PlatformAdminFramework) bool { needWriteFramework := false desiredComponents := []*config.Component{} @@ -882,11 +830,6 @@ func (r *ReconcilePlatformAdmin) calculateDesiredComponents(platformAdmin *iotv1 desiredComponents = append(desiredComponents, yurtIotDock) } - // TODO: In order to be compatible with v1alpha1, we need to add the component from annotation translation here - if additionalComponents != nil { - desiredComponents = append(desiredComponents, additionalComponents...) - } - platformAdminFramework.Components = desiredComponents return needWriteFramework diff --git a/pkg/yurtmanager/controller/platformadmin/platform_admin_controller_test.go b/pkg/yurtmanager/controller/platformadmin/platform_admin_controller_test.go new file mode 100644 index 00000000000..306d076e5e4 --- /dev/null +++ b/pkg/yurtmanager/controller/platformadmin/platform_admin_controller_test.go @@ -0,0 +1,182 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package platformadmin + +import ( + "context" + "testing" + + "github.com/stretchr/testify/assert" + apps "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + kjson "k8s.io/apimachinery/pkg/runtime/serializer/json" + "k8s.io/client-go/kubernetes/scheme" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/client/fake" + "sigs.k8s.io/controller-runtime/pkg/reconcile" + + "github.com/openyurtio/openyurt/pkg/apis" + "github.com/openyurtio/openyurt/pkg/apis/apps/v1beta1" + "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" + iotv1beta1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" + "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/config" +) + +type fakeEventRecorder struct { +} + +func (f *fakeEventRecorder) Event(object runtime.Object, eventtype, reason, message string) { +} + +func (f *fakeEventRecorder) Eventf(object runtime.Object, eventtype, reason, messageFmt string, args ...interface{}) { +} + +func (f *fakeEventRecorder) AnnotatedEventf(object runtime.Object, annotations map[string]string, eventtype, reason, messageFmt string, args ...interface{}) { +} + +func getFakeScheme() *runtime.Scheme { + scheme := runtime.NewScheme() + apis.AddToScheme(scheme) + apps.AddToScheme(scheme) + corev1.AddToScheme(scheme) + v1alpha2.AddToScheme(scheme) + return scheme +} + +var fakeScheme = getFakeScheme() + +func TestReconcilePlatformAdmin(t *testing.T) { + tests := []struct { + name string + request reconcile.Request + platformAdmin *iotv1beta1.PlatformAdmin + yasList []*v1beta1.YurtAppSet + svcList []*corev1.Service + expectedYasNum int + expectedSvcNum int + expectedErr bool + isUpdated bool + }{ + { + name: "create PlatformAdmin with single NodePool", + request: reconcile.Request{ + NamespacedName: client.ObjectKey{ + Name: "test-platformadmin", + Namespace: "default", + }, + }, + platformAdmin: &iotv1beta1.PlatformAdmin{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-platformadmin", + Namespace: "default", + }, + Spec: iotv1beta1.PlatformAdminSpec{ + Version: "minnesota", + NodePools: []string{"pool1"}, + }, + }, + expectedYasNum: 5, + expectedSvcNum: 4, + expectedErr: false, + }, + { + name: "create PlatformAdmin with multiple NodePools", + request: reconcile.Request{ + NamespacedName: client.ObjectKey{ + Name: "multi-pool-platformadmin", + Namespace: "default", + }, + }, + platformAdmin: &iotv1beta1.PlatformAdmin{ + ObjectMeta: metav1.ObjectMeta{ + Name: "multi-pool-platformadmin", + Namespace: "default", + }, + Spec: iotv1beta1.PlatformAdminSpec{ + Version: "minnesota", + NodePools: []string{"pool1", "pool2", "pool3", "pool4"}, + }, + }, + expectedYasNum: 5, + expectedSvcNum: 4, + expectedErr: false, + }, + { + name: "create PlatformAdmin with empty NodePools", + request: reconcile.Request{ + NamespacedName: client.ObjectKey{ + Name: "multi-pool-platformadmin", + Namespace: "default", + }, + }, + platformAdmin: &iotv1beta1.PlatformAdmin{ + ObjectMeta: metav1.ObjectMeta{ + Name: "multi-pool-platformadmin", + Namespace: "default", + }, + Spec: iotv1beta1.PlatformAdminSpec{ + Version: "minnesota", + NodePools: []string{}, + }, + }, + expectedYasNum: 5, + expectedSvcNum: 4, + expectedErr: false, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + objList := []client.Object{} + if tt.platformAdmin != nil { + objList = append(objList, tt.platformAdmin) + } + for _, yas := range tt.yasList { + objList = append(objList, yas) + } + for _, svc := range tt.svcList { + objList = append(objList, svc) + } + + fakeClient := fake.NewClientBuilder().WithScheme(fakeScheme).WithObjects(objList...).Build() + + r := &ReconcilePlatformAdmin{ + Client: fakeClient, + scheme: fakeScheme, + recorder: &fakeEventRecorder{}, + yamlSerializer: kjson.NewSerializerWithOptions(kjson.DefaultMetaFactory, scheme.Scheme, scheme.Scheme, kjson.SerializerOptions{Yaml: true, Pretty: true}), + Configuration: *config.NewPlatformAdminControllerConfiguration(), + } + _, err := r.Reconcile(context.TODO(), tt.request) + if tt.expectedErr { + assert.NotNil(t, err) + } + + yasList := &v1beta1.YurtAppSetList{} + if err := fakeClient.List(context.TODO(), yasList); err == nil { + assert.Len(t, yasList.Items, tt.expectedYasNum) + } + + svcList := &corev1.ServiceList{} + if err := fakeClient.List(context.TODO(), svcList); err == nil { + assert.Len(t, svcList.Items, tt.expectedSvcNum) + } + }) + } +} diff --git a/pkg/yurtmanager/controller/platformadmin/utils/conditions.go b/pkg/yurtmanager/controller/platformadmin/utils/conditions.go index eb9deb1ae69..f2b4f352be1 100644 --- a/pkg/yurtmanager/controller/platformadmin/utils/conditions.go +++ b/pkg/yurtmanager/controller/platformadmin/utils/conditions.go @@ -20,12 +20,12 @@ import ( corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - iotv1alpha2 "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" + iotv1beta1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" ) // NewPlatformAdminCondition creates a new PlatformAdmin condition. -func NewPlatformAdminCondition(condType iotv1alpha2.PlatformAdminConditionType, status corev1.ConditionStatus, reason, message string) *iotv1alpha2.PlatformAdminCondition { - return &iotv1alpha2.PlatformAdminCondition{ +func NewPlatformAdminCondition(condType iotv1beta1.PlatformAdminConditionType, status corev1.ConditionStatus, reason, message string) *iotv1beta1.PlatformAdminCondition { + return &iotv1beta1.PlatformAdminCondition{ Type: condType, Status: status, LastTransitionTime: metav1.Now(), @@ -35,7 +35,7 @@ func NewPlatformAdminCondition(condType iotv1alpha2.PlatformAdminConditionType, } // GetPlatformAdminCondition returns the condition with the provided type. -func GetPlatformAdminCondition(status iotv1alpha2.PlatformAdminStatus, condType iotv1alpha2.PlatformAdminConditionType) *iotv1alpha2.PlatformAdminCondition { +func GetPlatformAdminCondition(status iotv1beta1.PlatformAdminStatus, condType iotv1beta1.PlatformAdminConditionType) *iotv1beta1.PlatformAdminCondition { for i := range status.Conditions { c := status.Conditions[i] if c.Type == condType { @@ -47,7 +47,7 @@ func GetPlatformAdminCondition(status iotv1alpha2.PlatformAdminStatus, condType // SetPlatformAdminCondition updates the PlatformAdmin to include the provided condition. If the condition that // we are about to add already exists and has the same status, reason and message then we are not going to update. -func SetPlatformAdminCondition(status *iotv1alpha2.PlatformAdminStatus, condition *iotv1alpha2.PlatformAdminCondition) { +func SetPlatformAdminCondition(status *iotv1beta1.PlatformAdminStatus, condition *iotv1beta1.PlatformAdminCondition) { currentCond := GetPlatformAdminCondition(*status, condition.Type) if currentCond != nil && currentCond.Status == condition.Status && currentCond.Reason == condition.Reason { return @@ -60,8 +60,8 @@ func SetPlatformAdminCondition(status *iotv1alpha2.PlatformAdminStatus, conditio status.Conditions = append(newConditions, *condition) } -func filterOutCondition(conditions []iotv1alpha2.PlatformAdminCondition, condType iotv1alpha2.PlatformAdminConditionType) []iotv1alpha2.PlatformAdminCondition { - var newConditions []iotv1alpha2.PlatformAdminCondition +func filterOutCondition(conditions []iotv1beta1.PlatformAdminCondition, condType iotv1beta1.PlatformAdminConditionType) []iotv1beta1.PlatformAdminCondition { + var newConditions []iotv1beta1.PlatformAdminCondition for _, c := range conditions { if c.Type == condType { continue diff --git a/pkg/yurtmanager/controller/platformadmin/utils/fieldindexer.go b/pkg/yurtmanager/controller/platformadmin/utils/fieldindexer.go index c033ec1ee52..d222af91ff9 100644 --- a/pkg/yurtmanager/controller/platformadmin/utils/fieldindexer.go +++ b/pkg/yurtmanager/controller/platformadmin/utils/fieldindexer.go @@ -22,11 +22,12 @@ import ( "sigs.k8s.io/controller-runtime/pkg/client" - "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" + "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" ) const ( - IndexerPathForNodepool = "spec.poolName" + IndexerPathForNodepools = "spec.nodepools" + IndexerPathForNodepool = "spec.poolName" ) var registerOnce sync.Once @@ -35,10 +36,10 @@ func RegisterFieldIndexers(fi client.FieldIndexer) error { var err error registerOnce.Do(func() { // register the fieldIndexer for device - if err = fi.IndexField(context.TODO(), &v1alpha2.PlatformAdmin{}, IndexerPathForNodepool, func(rawObj client.Object) []string { - platformAdmin, ok := rawObj.(*v1alpha2.PlatformAdmin) + if err = fi.IndexField(context.TODO(), &v1beta1.PlatformAdmin{}, IndexerPathForNodepools, func(rawObj client.Object) []string { + platformAdmin, ok := rawObj.(*v1beta1.PlatformAdmin) if ok { - return []string{platformAdmin.Spec.PoolName} + return platformAdmin.Spec.NodePools } return []string{} }); err != nil { diff --git a/pkg/yurtmanager/controller/platformadmin/utils/util.go b/pkg/yurtmanager/controller/platformadmin/utils/util.go new file mode 100644 index 00000000000..72b96605b41 --- /dev/null +++ b/pkg/yurtmanager/controller/platformadmin/utils/util.go @@ -0,0 +1,27 @@ +/* +Copyright 2023 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package util + +// Helper function to check if a slice contains a string +func Contains(slice []string, s string) bool { + for _, item := range slice { + if item == s { + return true + } + } + return false +} diff --git a/pkg/yurtmanager/controller/platformadmin/utils/version.go b/pkg/yurtmanager/controller/platformadmin/utils/version.go index 2f3594bbb39..bbe1cf48bb9 100644 --- a/pkg/yurtmanager/controller/platformadmin/utils/version.go +++ b/pkg/yurtmanager/controller/platformadmin/utils/version.go @@ -17,14 +17,14 @@ limitations under the License. package util import ( - iotv1alpha2 "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" + iotv1beta1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" ) const IotDockName = "yurt-iot-dock" const IotDockImage = "openyurt/yurt-iot-dock" const IotDockControlPlane = "platformadmin-controller" -func DefaultVersion(platformAdmin *iotv1alpha2.PlatformAdmin) (string, string, error) { +func DefaultVersion(platformAdmin *iotv1beta1.PlatformAdmin) (string, string, error) { var ( ver string ns string diff --git a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_validation.go b/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_validation.go deleted file mode 100644 index 8e1b28e5c13..00000000000 --- a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_validation.go +++ /dev/null @@ -1,119 +0,0 @@ -/* -Copyright 2023 The OpenYurt Authors. - -Licensed under the Apache License, Version 2.0 (the License); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an AS IS BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package v1alpha1 - -import ( - "context" - "fmt" - - apierrors "k8s.io/apimachinery/pkg/api/errors" - "k8s.io/apimachinery/pkg/runtime" - "k8s.io/apimachinery/pkg/util/validation/field" - "sigs.k8s.io/controller-runtime/pkg/client" - "sigs.k8s.io/controller-runtime/pkg/webhook/admission" - - unitv1beta1 "github.com/openyurtio/openyurt/pkg/apis/apps/v1beta1" - "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" - util "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/utils" -) - -// ValidateCreate implements webhook.CustomValidator so a webhook will be registered for the type. -func (webhook *PlatformAdminHandler) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) { - platformAdmin, ok := obj.(*v1alpha1.PlatformAdmin) - if !ok { - return nil, apierrors.NewBadRequest(fmt.Sprintf("expected a PlatformAdmin but got a %T", obj)) - } - - //validate - if allErrs := webhook.validate(ctx, platformAdmin); len(allErrs) > 0 { - return nil, apierrors.NewInvalid(v1alpha1.GroupVersion.WithKind("PlatformAdmin").GroupKind(), platformAdmin.Name, allErrs) - } - - return nil, nil -} - -// ValidateUpdate implements webhook.CustomValidator so a webhook will be registered for the type. -func (webhook *PlatformAdminHandler) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) { - newPlatformAdmin, ok := newObj.(*v1alpha1.PlatformAdmin) - if !ok { - return nil, apierrors.NewBadRequest(fmt.Sprintf("expected a PlatformAdmin but got a %T", newObj)) - } - oldPlatformAdmin, ok := oldObj.(*v1alpha1.PlatformAdmin) - if !ok { - return nil, apierrors.NewBadRequest(fmt.Sprintf("expected a PlatformAdmin but got a %T", oldObj)) - } - - // validate - newErrorList := webhook.validate(ctx, newPlatformAdmin) - oldErrorList := webhook.validate(ctx, oldPlatformAdmin) - if allErrs := append(newErrorList, oldErrorList...); len(allErrs) > 0 { - return nil, apierrors.NewInvalid(v1alpha1.GroupVersion.WithKind("PlatformAdmin").GroupKind(), newPlatformAdmin.Name, allErrs) - } - return nil, nil -} - -// ValidateDelete implements webhook.CustomValidator so a webhook will be registered for the type. -func (webhook *PlatformAdminHandler) ValidateDelete(_ context.Context, obj runtime.Object) (admission.Warnings, error) { - return nil, nil -} - -func (webhook *PlatformAdminHandler) validate(ctx context.Context, platformAdmin *v1alpha1.PlatformAdmin) field.ErrorList { - // verify that the poolname nodepool - if nodePoolErrs := webhook.validatePlatformAdminWithNodePools(ctx, platformAdmin); nodePoolErrs != nil { - return nodePoolErrs - } - return nil -} - -func (webhook *PlatformAdminHandler) validatePlatformAdminWithNodePools(ctx context.Context, platformAdmin *v1alpha1.PlatformAdmin) field.ErrorList { - // verify that the poolname is a right nodepool name - nodePools := &unitv1beta1.NodePoolList{} - if err := webhook.Client.List(ctx, nodePools); err != nil { - return field.ErrorList{ - field.Invalid(field.NewPath("spec", "poolName"), platformAdmin.Spec.PoolName, "can not list nodepools, cause"+err.Error()), - } - } - ok := false - for _, nodePool := range nodePools.Items { - if nodePool.ObjectMeta.Name == platformAdmin.Spec.PoolName { - ok = true - break - } - } - if !ok { - return field.ErrorList{ - field.Invalid(field.NewPath("spec", "poolName"), platformAdmin.Spec.PoolName, "can not find the nodepool"), - } - } - // verify that no other platformadmin in the nodepool - var platformadmins v1alpha1.PlatformAdminList - listOptions := client.MatchingFields{util.IndexerPathForNodepool: platformAdmin.Spec.PoolName} - if err := webhook.Client.List(ctx, &platformadmins, listOptions); err != nil { - return field.ErrorList{ - field.Invalid(field.NewPath("spec", "poolName"), platformAdmin.Spec.PoolName, "can not list platformadmins, cause"+err.Error()), - } - } - for _, other := range platformadmins.Items { - if platformAdmin.Name != other.Name { - return field.ErrorList{ - field.Invalid(field.NewPath("spec", "poolName"), platformAdmin.Spec.PoolName, "already used by other platformadmin instance,"), - } - } - } - - return nil -} diff --git a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_default.go b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default.go similarity index 76% rename from pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_default.go rename to pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default.go index c95eb92e71c..a306f44e75d 100644 --- a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_default.go +++ b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default.go @@ -1,5 +1,5 @@ /* -Copyright 2023 The OpenYurt Authors. +Copyright 2024 The OpenYurt Authors. Licensed under the Apache License, Version 2.0 (the License); you may not use this file except in compliance with the License. @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package v1alpha1 +package v1beta1 import ( "context" @@ -23,21 +23,25 @@ import ( apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/runtime" - "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" + "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" ) // Default satisfies the defaulting webhook interface. func (webhook *PlatformAdminHandler) Default(ctx context.Context, obj runtime.Object) error { - platformAdmin, ok := obj.(*v1alpha1.PlatformAdmin) + platformAdmin, ok := obj.(*v1beta1.PlatformAdmin) if !ok { return apierrors.NewBadRequest(fmt.Sprintf("expected a PlatformAdmin but got a %T", obj)) } - v1alpha1.SetDefaultsPlatformAdmin(platformAdmin) + v1beta1.SetDefaultsPlatformAdmin(platformAdmin) if platformAdmin.Spec.Version == "" { platformAdmin.Spec.Version = webhook.Manifests.LatestVersion } + + if platformAdmin.Spec.Platform == "" { + platformAdmin.Spec.Platform = v1beta1.PlatformAdminPlatformEdgeX + } return nil } diff --git a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_default_test.go b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default_test.go similarity index 60% rename from pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_default_test.go rename to pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default_test.go index 91a35217b5a..c97a87b60d4 100644 --- a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_default_test.go +++ b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default_test.go @@ -1,5 +1,5 @@ /* -Copyright 2023 The OpenYurt Authors. +Copyright 2024 The OpenYurt Authors. Licensed under the Apache License, Version 2.0 (the License); you may not use this file except in compliance with the License. @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package v1alpha1 +package v1beta1 import ( "context" @@ -27,7 +27,7 @@ import ( "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime" - "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" + "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/config" ) @@ -43,9 +43,9 @@ func TestDefault(t *testing.T) { tests := []testCase{ { name: "should get no error when valid PlatformAdmin object with spec empty version", - obj: &v1alpha1.PlatformAdmin{ + obj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{}, - Spec: v1alpha1.PlatformAdminSpec{ + Spec: v1beta1.PlatformAdminSpec{ Version: "", }, }, @@ -54,9 +54,9 @@ func TestDefault(t *testing.T) { }, { name: "should get no error when valid PlatformAdmin object with spec version is v1", - obj: &v1alpha1.PlatformAdmin{ + obj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{}, - Spec: v1alpha1.PlatformAdminSpec{ + Spec: v1beta1.PlatformAdminSpec{ Version: "v1", }, }, @@ -76,8 +76,48 @@ func TestDefault(t *testing.T) { err := handler.Default(context.TODO(), tc.obj) assert.Equal(t, tc.expected, err) if err == nil { - assert.Equal(t, tc.version, tc.obj.(*v1alpha1.PlatformAdmin).Spec.Version) + assert.Equal(t, tc.version, tc.obj.(*v1beta1.PlatformAdmin).Spec.Version) } }) } } + +func TestDefaultV2(t *testing.T) { + type testCase struct { + name string + obj runtime.Object + platform string + } + + tests := []testCase{ + { + name: "should get default platform when valid PlatformAdmin object with spec empty platform", + obj: &v1beta1.PlatformAdmin{ + ObjectMeta: metav1.ObjectMeta{}, + Spec: v1beta1.PlatformAdminSpec{ + Platform: "", + }, + }, + platform: v1beta1.PlatformAdminPlatformEdgeX, + }, + { + name: "should get no error when valid PlatformAdmin object with spec platform is test", + obj: &v1beta1.PlatformAdmin{ + ObjectMeta: metav1.ObjectMeta{}, + Spec: v1beta1.PlatformAdminSpec{ + Platform: "test", + }, + }, + platform: "test", + }, + } + + handler := PlatformAdminHandler{Manifests: &config.Manifest{}} + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + err := handler.Default(context.TODO(), tc.obj) + assert.Nil(t, err) + assert.Equal(t, tc.platform, tc.obj.(*v1beta1.PlatformAdmin).Spec.Platform) + }) + } +} \ No newline at end of file diff --git a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_handler.go b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_handler.go similarity index 91% rename from pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_handler.go rename to pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_handler.go index a2f9c18b47b..1d78da78355 100644 --- a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_handler.go +++ b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_handler.go @@ -1,5 +1,5 @@ /* -Copyright 2023 The OpenYurt Authors. +Copyright 2024 The OpenYurt Authors. Licensed under the Apache License, Version 2.0 (the License); you may not use this file except in compliance with the License. @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package v1alpha1 +package v1beta1 import ( "gopkg.in/yaml.v3" @@ -25,7 +25,7 @@ import ( yurtClient "github.com/openyurtio/openyurt/cmd/yurt-manager/app/client" "github.com/openyurtio/openyurt/cmd/yurt-manager/names" - "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" + "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/config" webhookutil "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/util" ) @@ -38,7 +38,7 @@ func (webhook *PlatformAdminHandler) SetupWebhookWithManager(mgr ctrl.Manager) ( if err := webhook.initManifest(); err != nil { return "", "", err } - return webhookutil.RegisterWebhook(mgr, &v1alpha1.PlatformAdmin{}, webhook) + return webhookutil.RegisterWebhook(mgr, &v1beta1.PlatformAdmin{}, webhook) } func (webhook *PlatformAdminHandler) initManifest() error { diff --git a/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_validation.go b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_validation.go new file mode 100644 index 00000000000..718f4b44b24 --- /dev/null +++ b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_validation.go @@ -0,0 +1,155 @@ +/* +Copyright 2024 The OpenYurt Authors. + +Licensed under the Apache License, Version 2.0 (the License); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an AS IS BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1beta1 + +import ( + "context" + "fmt" + "strings" + + apierrors "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/util/validation/field" + "sigs.k8s.io/controller-runtime/pkg/webhook/admission" + + unitv1beta1 "github.com/openyurtio/openyurt/pkg/apis/apps/v1beta1" + "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" + "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/config" + util "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/utils" +) + +// ValidateCreate implements webhook.CustomValidator so a webhook will be registered for the type. +func (webhook *PlatformAdminHandler) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) { + platformAdmin, ok := obj.(*v1beta1.PlatformAdmin) + if !ok { + return nil, apierrors.NewBadRequest(fmt.Sprintf("expected a PlatformAdmin but got a %T", obj)) + } + + //validate + if allErrs := webhook.validate(ctx, platformAdmin); len(allErrs) > 0 { + return nil, apierrors.NewInvalid(v1beta1.GroupVersion.WithKind("PlatformAdmin").GroupKind(), platformAdmin.Name, allErrs) + } + + return nil, nil +} + +// ValidateUpdate implements webhook.CustomValidator so a webhook will be registered for the type. +func (webhook *PlatformAdminHandler) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) { + newPlatformAdmin, ok := newObj.(*v1beta1.PlatformAdmin) + if !ok { + return nil, apierrors.NewBadRequest(fmt.Sprintf("expected a PlatformAdmin but got a %T", newObj)) + } + oldPlatformAdmin, ok := oldObj.(*v1beta1.PlatformAdmin) + if !ok { + return nil, apierrors.NewBadRequest(fmt.Sprintf("expected a PlatformAdmin but got a %T", oldObj)) + } + + // validate + newErrorList := webhook.validate(ctx, newPlatformAdmin) + oldErrorList := webhook.validate(ctx, oldPlatformAdmin) + if allErrs := append(newErrorList, oldErrorList...); len(allErrs) > 0 { + return nil, apierrors.NewInvalid(v1beta1.GroupVersion.WithKind("PlatformAdmin").GroupKind(), newPlatformAdmin.Name, allErrs) + } + return nil, nil +} + +// ValidateDelete implements webhook.CustomValidator so a webhook will be registered for the type. +func (webhook *PlatformAdminHandler) ValidateDelete(_ context.Context, obj runtime.Object) (admission.Warnings, error) { + return nil, nil +} + +func (webhook *PlatformAdminHandler) validate(ctx context.Context, platformAdmin *v1beta1.PlatformAdmin) field.ErrorList { + // verify the version + if specErrs := webhook.validatePlatformAdminSpec(platformAdmin); specErrs != nil { + return specErrs + } + + // verify that the poolname nodepool + if nodePoolErrs := webhook.validatePlatformAdminWithNodePools(ctx, platformAdmin); nodePoolErrs != nil { + return nodePoolErrs + } + return nil +} + +func (webhook *PlatformAdminHandler) validatePlatformAdminSpec(platformAdmin *v1beta1.PlatformAdmin) field.ErrorList { + // TODO: Need to divert traffic based on the type of platform + + // Verify that the platform is supported + if platformAdmin.Spec.Platform != v1beta1.PlatformAdminPlatformEdgeX { + return field.ErrorList{field.Invalid(field.NewPath("spec", "platform"), platformAdmin.Spec.Platform, "must be "+v1beta1.PlatformAdminPlatformEdgeX)} + } + + // Verify that it is a supported platformadmin version + for _, version := range webhook.Manifests.Versions { + if platformAdmin.Spec.Version == version.Name { + return nil + } + } + + return field.ErrorList{ + field.Invalid(field.NewPath("spec", "version"), platformAdmin.Spec.Version, "must be one of"+strings.Join(config.ExtractVersionsName(webhook.Manifests).UnsortedList(), ",")), + } +} + +func (webhook *PlatformAdminHandler) validatePlatformAdminWithNodePools(ctx context.Context, platformAdmin *v1beta1.PlatformAdmin) field.ErrorList { + // verify that the poolnames are right nodepool names + nodepools := &unitv1beta1.NodePoolList{} + if err := webhook.Client.List(ctx, nodepools); err != nil { + return field.ErrorList{ + field.Invalid(field.NewPath("spec", "nodepools"), platformAdmin.Spec.NodePools, "can not list nodepools, cause"+err.Error()), + } + } + + nodePoolMap := make(map[string]bool) + for _, nodePool := range nodepools.Items { + nodePoolMap[nodePool.ObjectMeta.Name] = true + } + + invalidPools := []string{} + for _, poolName := range platformAdmin.Spec.NodePools { + if !nodePoolMap[poolName] { + invalidPools = append(invalidPools, poolName) + } + } + if len(invalidPools) > 0 { + return field.ErrorList{ + field.Invalid(field.NewPath("spec", "nodepools"), invalidPools, "can not find the nodepools"), + } + } + + // verify that no other platformadmin in the nodepools + var platformadmins v1beta1.PlatformAdminList + if err := webhook.Client.List(ctx, &platformadmins); err != nil { + return field.ErrorList{ + field.Invalid(field.NewPath("spec", "nodepools"), platformAdmin.Spec.NodePools, "can not list platformadmins, cause"+err.Error()), + } + } + + for _, other := range platformadmins.Items { + if platformAdmin.Name != other.Name { + for _, poolName := range platformAdmin.Spec.NodePools { + if util.Contains(other.Spec.NodePools, poolName) { + return field.ErrorList{ + field.Invalid(field.NewPath("spec", "nodepools"), poolName, "already used by other platformadmin instance"), + } + } + } + } + } + + return nil +} diff --git a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_validation_test.go b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_validation_test.go similarity index 65% rename from pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_validation_test.go rename to pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_validation_test.go index 4900c065caa..99efaf7f59a 100644 --- a/pkg/yurtmanager/webhook/platformadmin/v1alpha1/platformadmin_validation_test.go +++ b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_validation_test.go @@ -1,5 +1,5 @@ /* -Copyright 2023 The OpenYurt Authors. +Copyright 2024 The OpenYurt Authors. Licensed under the Apache License, Version 2.0 (the License); you may not use this file except in compliance with the License. @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package v1alpha1 +package v1beta1 import ( "context" @@ -34,7 +34,8 @@ import ( "github.com/openyurtio/openyurt/pkg/apis" ut "github.com/openyurtio/openyurt/pkg/apis/apps/v1beta1" - "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" + "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" + "github.com/openyurtio/openyurt/pkg/yurtmanager/controller/platformadmin/config" ) // TestValidateCreate tests the ValidateCreate method of PlatformAdminHandler. @@ -53,42 +54,75 @@ func TestValidateCreate(t *testing.T) { obj: &unstructured.Unstructured{}, errCode: http.StatusBadRequest, }, + { + name: "should get StatusUnprocessableEntityError when Platform is invalid", + client: NewFakeClient(buildClient(nil, nil)).Build(), + obj: &v1beta1.PlatformAdmin{ + ObjectMeta: metav1.ObjectMeta{}, + Spec: v1beta1.PlatformAdminSpec{ + Platform: "invalid", + }, + }, + errCode: http.StatusUnprocessableEntity, + }, + { + name: "should get StatusUnprocessableEntityError when version is invalid", + client: NewFakeClient(buildClient(nil, nil)).Build(), + obj: &v1beta1.PlatformAdmin{ + ObjectMeta: metav1.ObjectMeta{}, + Spec: v1beta1.PlatformAdminSpec{ + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "invalid version", + }, + }, + errCode: http.StatusUnprocessableEntity, + }, { name: "should get StatusUnprocessableEntityError when list NodePoolList failed", client: NewFakeClient(buildClient(nil, nil)).WithErr(&ut.NodePoolList{}, errors.New("list failed")).Build(), - obj: &v1alpha1.PlatformAdmin{ + obj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{}, - Spec: v1alpha1.PlatformAdminSpec{}, + Spec: v1beta1.PlatformAdminSpec{ + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", + }, }, errCode: http.StatusUnprocessableEntity, }, { name: "should get StatusUnprocessableEntityError when list NodePoolList is empty", client: NewFakeClient(buildClient(nil, nil)).Build(), - obj: &v1alpha1.PlatformAdmin{ + obj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{}, - Spec: v1alpha1.PlatformAdminSpec{}, + Spec: v1beta1.PlatformAdminSpec{ + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", + }, }, errCode: http.StatusUnprocessableEntity, }, { - name: "should get StatusUnprocessableEntityError when find NodePoolList is empty by PlatformAdmin PoolName", + name: "should get StatusUnprocessableEntityError when find NodePoolList is empty by PlatformAdmin NodePools", client: NewFakeClient(buildClient(buildNodePool(), nil)).Build(), - obj: &v1alpha1.PlatformAdmin{ + obj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{}, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "not-exit-poll", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"not-exit-poll"}, + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", }, }, errCode: http.StatusUnprocessableEntity, }, { name: "should get StatusUnprocessableEntityError when list PlatformAdmin failed", - client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).WithErr(&v1alpha1.PlatformAdminList{}, errors.New("list failed")).Build(), - obj: &v1alpha1.PlatformAdmin{ + client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).WithErr(&v1beta1.PlatformAdminList{}, errors.New("list failed")).Build(), + obj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{}, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "beijing", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"beijing"}, + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", }, }, errCode: http.StatusUnprocessableEntity, @@ -96,12 +130,14 @@ func TestValidateCreate(t *testing.T) { { name: "should get StatusUnprocessableEntityError when get other PlatformAdmin in same node pool", client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).Build(), - obj: &v1alpha1.PlatformAdmin{ + obj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: "hangzhou-PlatformAdmin", }, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "beijing", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"beijing"}, + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", }, }, errCode: http.StatusUnprocessableEntity, @@ -109,21 +145,35 @@ func TestValidateCreate(t *testing.T) { { name: "should get no err", client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).Build(), - obj: &v1alpha1.PlatformAdmin{ + obj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: "beijing-PlatformAdmin", }, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "beijing", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"beijing"}, + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", }, }, errCode: 0, }, } + manifest := &config.Manifest{ + Versions: []config.ManifestVersion{ + { + Name: "v2", + RequiredComponents: []string{"edgex-core-data", "edgex-core-metadata"}, + }, + }, + } + for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - handler := &PlatformAdminHandler{Client: tc.client} + handler := &PlatformAdminHandler{ + Client: tc.client, + Manifests: manifest, + } _, err := handler.ValidateCreate(context.TODO(), tc.obj) if tc.errCode == 0 { assert.NoError(t, err, "success case result err must be nil") @@ -148,7 +198,7 @@ func TestValidateUpdate(t *testing.T) { { name: "should get StatusBadRequestError when invalid new PlatformAdmin type", client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).Build(), - oldObj: &v1alpha1.PlatformAdmin{}, + oldObj: &v1beta1.PlatformAdmin{}, newObj: &unstructured.Unstructured{}, errCode: http.StatusBadRequest, }, @@ -156,33 +206,37 @@ func TestValidateUpdate(t *testing.T) { name: "should get StatusBadRequestError when invalid old PlatformAdmin type", client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).Build(), oldObj: &unstructured.Unstructured{}, - newObj: &v1alpha1.PlatformAdmin{}, + newObj: &v1beta1.PlatformAdmin{}, errCode: http.StatusBadRequest, }, { name: "should get StatusUnprocessableEntityError when old PlatformAdmin is valid and new PlatformAdmin is invalid", client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).Build(), - oldObj: &v1alpha1.PlatformAdmin{ + oldObj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: "beijing-PlatformAdmin", }, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "beijing", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"beijing"}, + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", }, }, - newObj: &v1alpha1.PlatformAdmin{}, + newObj: &v1beta1.PlatformAdmin{}, errCode: http.StatusUnprocessableEntity, }, { name: "should get StatusUnprocessableEntityError when old PlatformAdmin is invalid and old PlatformAdmin is valid", client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).Build(), - oldObj: &v1alpha1.PlatformAdmin{}, - newObj: &v1alpha1.PlatformAdmin{ + oldObj: &v1beta1.PlatformAdmin{}, + newObj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: "beijing-PlatformAdmin", }, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "beijing", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"beijing"}, + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", }, }, errCode: http.StatusUnprocessableEntity, @@ -190,29 +244,42 @@ func TestValidateUpdate(t *testing.T) { { name: "should no err when new PlatformAdmin and old PlatformAdmin both valid", client: NewFakeClient(buildClient(buildNodePool(), buildPlatformAdmin())).Build(), - oldObj: &v1alpha1.PlatformAdmin{ + oldObj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: "beijing-PlatformAdmin", }, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "beijing", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"beijing"}, + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", }, }, - newObj: &v1alpha1.PlatformAdmin{ + newObj: &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: "beijing-PlatformAdmin", }, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "beijing", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"beijing"}, + Platform: v1beta1.PlatformAdminPlatformEdgeX, + Version: "v2", }, }, errCode: 0, }, } + manifest := &config.Manifest{ + Versions: []config.ManifestVersion{ + { + Name: "v2", + RequiredComponents: []string{"edgex-core-data", "edgex-core-metadata"}, + }, + }, + } + for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - handler := &PlatformAdminHandler{Client: tc.client} + handler := &PlatformAdminHandler{Client: tc.client, Manifests: manifest} _, err := handler.ValidateUpdate(context.TODO(), tc.oldObj, tc.newObj) if tc.errCode == 0 { assert.NoError(t, err, "success case result err must be nil") @@ -236,17 +303,17 @@ func buildClient(nodePools []client.Object, platformAdmin []client.Object) clien scheme := runtime.NewScheme() _ = clientgoscheme.AddToScheme(scheme) _ = apis.AddToScheme(scheme) - return fake.NewClientBuilder().WithScheme(scheme).WithObjects(nodePools...).WithObjects(platformAdmin...).WithIndex(&v1alpha1.PlatformAdmin{}, "spec.poolName", Indexer).Build() + return fake.NewClientBuilder().WithScheme(scheme).WithObjects(nodePools...).WithObjects(platformAdmin...).WithIndex(&v1beta1.PlatformAdmin{}, "spec.nodepools", Indexer).Build() } func buildPlatformAdmin() []client.Object { nodes := []client.Object{ - &v1alpha1.PlatformAdmin{ + &v1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: "beijing-PlatformAdmin", }, - Spec: v1alpha1.PlatformAdminSpec{ - PoolName: "beijing", + Spec: v1beta1.PlatformAdminSpec{ + NodePools: []string{"beijing"}, }, }, } @@ -308,12 +375,12 @@ func (f *FakeClient) Build() *FakeClient { } func Indexer(rawObj client.Object) []string { - platformAdmin, ok := rawObj.(*v1alpha1.PlatformAdmin) + platformAdmin, ok := rawObj.(*v1beta1.PlatformAdmin) if !ok { return []string{} } - if len(platformAdmin.Spec.PoolName) == 0 { + if len(platformAdmin.Spec.NodePools) == 0 { return []string{} } - return []string{platformAdmin.Spec.PoolName} + return platformAdmin.Spec.NodePools } diff --git a/pkg/yurtmanager/webhook/server.go b/pkg/yurtmanager/webhook/server.go index 9798e86e076..c816fbb482f 100644 --- a/pkg/yurtmanager/webhook/server.go +++ b/pkg/yurtmanager/webhook/server.go @@ -34,8 +34,7 @@ import ( v1beta1gateway "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/gateway/v1beta1" v1node "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/node/v1" v1beta1nodepool "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/nodepool/v1beta1" - v1alpha1platformadmin "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/platformadmin/v1alpha1" - v1alpha2platformadmin "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/platformadmin/v1alpha2" + v1beta1platformadmin "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/platformadmin/v1beta1" v1alpha1pod "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/pod/v1alpha1" "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/util" webhookcontroller "github.com/openyurtio/openyurt/pkg/yurtmanager/webhook/util/controller" @@ -70,14 +69,14 @@ func addControllerWebhook(name string, handler SetupWebhookWithManager) { controllerWebhooks[name] = append(controllerWebhooks[name], handler) } -func init() { +func init() { addControllerWebhook(names.GatewayPickupController, &v1beta1gateway.GatewayHandler{}) addControllerWebhook(names.NodePoolController, &v1beta1nodepool.NodePoolHandler{}) addControllerWebhook(names.YurtStaticSetController, &v1alpha1yurtstaticset.YurtStaticSetHandler{}) addControllerWebhook(names.YurtAppSetController, &v1beta1yurtappset.YurtAppSetHandler{}) addControllerWebhook(names.YurtAppDaemonController, &v1alpha1yurtappdaemon.YurtAppDaemonHandler{}) - addControllerWebhook(names.PlatformAdminController, &v1alpha1platformadmin.PlatformAdminHandler{}) - addControllerWebhook(names.PlatformAdminController, &v1alpha2platformadmin.PlatformAdminHandler{}) + //addControllerWebhook(names.PlatformAdminController, &v1alpha2platformadmin.PlatformAdminHandler{}) + addControllerWebhook(names.PlatformAdminController, &v1beta1platformadmin.PlatformAdminHandler{}) addControllerWebhook(names.YurtAppOverriderController, &v1alpha1yurtappoverrider.YurtAppOverriderHandler{}) addControllerWebhook(names.YurtAppOverriderController, &v1alpha1deploymentrender.DeploymentRenderHandler{}) diff --git a/test/e2e/cmd/init/converter.go b/test/e2e/cmd/init/converter.go index 47b12041322..0f94843678e 100644 --- a/test/e2e/cmd/init/converter.go +++ b/test/e2e/cmd/init/converter.go @@ -217,6 +217,7 @@ func (c *ClusterConverter) installYurtManagerByHelm() error { output, err := cmd.CombinedOutput() if err != nil { klog.Errorf("couldn't install yurt-manager, %v", err) + klog.Errorf("Helm install output: %s", string(output)) return err } klog.Infof("start to install yurt-manager, %s", string(output)) diff --git a/test/e2e/util/util.go b/test/e2e/util/util.go index 3a5620328d6..fbb2cc153d1 100644 --- a/test/e2e/util/util.go +++ b/test/e2e/util/util.go @@ -35,8 +35,8 @@ import ( appsv1alpha1 "github.com/openyurtio/openyurt/pkg/apis/apps/v1alpha1" appsv1beta1 "github.com/openyurtio/openyurt/pkg/apis/apps/v1beta1" - iotv1alpha1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha1" iotv1alpha2 "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" + iotv1beta1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" "github.com/openyurtio/openyurt/test/e2e/yurtconfig" ) @@ -48,8 +48,8 @@ func init() { utilruntime.Must(clientgoscheme.AddToScheme(scheme)) utilruntime.Must(appsv1alpha1.AddToScheme(scheme)) utilruntime.Must(appsv1beta1.AddToScheme(scheme)) - utilruntime.Must(iotv1alpha1.AddToScheme(scheme)) utilruntime.Must(iotv1alpha2.AddToScheme(scheme)) + utilruntime.Must(iotv1beta1.AddToScheme(scheme)) } const ( diff --git a/test/e2e/yurt/iot.go b/test/e2e/yurt/iot.go index 7ed1026e517..179f37a0f78 100644 --- a/test/e2e/yurt/iot.go +++ b/test/e2e/yurt/iot.go @@ -29,7 +29,7 @@ import ( "k8s.io/apimachinery/pkg/types" "sigs.k8s.io/controller-runtime/pkg/client" - iotv1alpha2 "github.com/openyurtio/openyurt/pkg/apis/iot/v1alpha2" + iotv1beta1 "github.com/openyurtio/openyurt/pkg/apis/iot/v1beta1" "github.com/openyurtio/openyurt/test/e2e/util" ycfg "github.com/openyurtio/openyurt/test/e2e/yurtconfig" ) @@ -77,7 +77,7 @@ var _ = Describe("OpenYurt IoT Test", Ordered, func() { createPlatformAdmin := func(version string) { By(fmt.Sprintf("create the PlatformAdmin named %s for iot e2e test", platformAdminName)) Eventually(func() error { - return k8sClient.Delete(ctx, &iotv1alpha2.PlatformAdmin{ + return k8sClient.Delete(ctx, &iotv1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: platformAdminName, Namespace: namespaceName, @@ -85,14 +85,14 @@ var _ = Describe("OpenYurt IoT Test", Ordered, func() { }) }, timeout, 500*time.Millisecond).Should(SatisfyAny(BeNil(), &util.NotFoundMatcher{})) - testPlatformAdmin := iotv1alpha2.PlatformAdmin{ + testPlatformAdmin := iotv1beta1.PlatformAdmin{ ObjectMeta: metav1.ObjectMeta{ Name: platformAdminName, Namespace: namespaceName, }, - Spec: iotv1alpha2.PlatformAdminSpec{ - Version: version, - PoolName: nodePoolName, + Spec: iotv1beta1.PlatformAdminSpec{ + Version: version, + NodePools: []string{nodePoolName}, }, } Eventually(func() error { @@ -127,13 +127,13 @@ var _ = Describe("OpenYurt IoT Test", Ordered, func() { AfterEach(func() { By(fmt.Sprintf("Delete the platformAdmin %s", platformAdminName)) - Expect(k8sClient.Delete(ctx, &iotv1alpha2.PlatformAdmin{ObjectMeta: metav1.ObjectMeta{Name: platformAdminName, Namespace: namespaceName}})).Should(BeNil()) + Expect(k8sClient.Delete(ctx, &iotv1beta1.PlatformAdmin{ObjectMeta: metav1.ObjectMeta{Name: platformAdminName, Namespace: namespaceName}})).Should(BeNil()) }) It(fmt.Sprintf("The %s version of PlatformAdmin should be stable in ready state after it is created", version), func() { By("verify the status of platformadmin") Eventually(func() error { - testPlatformAdmin := &iotv1alpha2.PlatformAdmin{} + testPlatformAdmin := &iotv1beta1.PlatformAdmin{} if err := k8sClient.Get(ctx, types.NamespacedName{Name: platformAdminName, Namespace: namespaceName}, testPlatformAdmin); err != nil { return err } From 2e476503e986e58237a49c2be8640e97ceaf9224 Mon Sep 17 00:00:00 2001 From: LavenderQAQ Date: Wed, 30 Oct 2024 11:34:15 +0800 Subject: [PATCH 2/3] fix: update controller-gen version to fix make manifests bugs and fix lint issues Signed-off-by: LavenderQAQ --- Makefile | 4 +- .../crds/apps.openyurt.io_nodebuckets.yaml | 19 +- .../crds/apps.openyurt.io_nodepools.yaml | 95 +- .../crds/apps.openyurt.io_yurtappdaemons.yaml | 105 +- .../apps.openyurt.io_yurtappoverriders.yaml | 51 +- .../crds/apps.openyurt.io_yurtappsets.yaml | 218 +- .../crds/apps.openyurt.io_yurtstaticsets.yaml | 27 +- .../crds/iot.openyurt.io_platformadmins.yaml | 7994 +++++++---------- .../network.openyurt.io_poolservices.yaml | 129 +- .../crds/raven.openyurt.io_gateways.yaml | 82 +- .../yurt-manager-auto-generated.yaml | 80 +- go.mod | 2 +- go.sum | 19 + pkg/apis/iot/v1beta1/zz_generated.deepcopy.go | 2 +- .../v1beta1/platformadmin_default.go | 2 +- .../v1beta1/platformadmin_default_test.go | 2 +- pkg/yurtmanager/webhook/server.go | 2 +- 17 files changed, 3975 insertions(+), 4858 deletions(-) diff --git a/Makefile b/Makefile index a1d2b78d688..4f4c6b9cb31 100644 --- a/Makefile +++ b/Makefile @@ -226,10 +226,10 @@ newcontroller: CONTROLLER_GEN = $(shell pwd)/bin/controller-gen .PHONY: controller-gen controller-gen: ## Download controller-gen locally if necessary. -ifeq ("$(shell $(CONTROLLER_GEN) --version 2> /dev/null)", "Version: v0.13.0") +ifeq ("$(shell $(CONTROLLER_GEN) --version 2> /dev/null)", "Version: v0.14.0") else rm -rf $(CONTROLLER_GEN) - $(call go-get-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.13.0) + $(call go-get-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0) endif .PHONY: kubectl diff --git a/charts/yurt-manager/crds/apps.openyurt.io_nodebuckets.yaml b/charts/yurt-manager/crds/apps.openyurt.io_nodebuckets.yaml index 8f6facf60a8..2c7123b181e 100644 --- a/charts/yurt-manager/crds/apps.openyurt.io_nodebuckets.yaml +++ b/charts/yurt-manager/crds/apps.openyurt.io_nodebuckets.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: nodebuckets.apps.openyurt.io spec: group: apps.openyurt.io @@ -35,14 +35,19 @@ spec: description: NodeBucket is the Schema for the samples API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object diff --git a/charts/yurt-manager/crds/apps.openyurt.io_nodepools.yaml b/charts/yurt-manager/crds/apps.openyurt.io_nodepools.yaml index 30171352f54..b8b18f12f43 100644 --- a/charts/yurt-manager/crds/apps.openyurt.io_nodepools.yaml +++ b/charts/yurt-manager/crds/apps.openyurt.io_nodepools.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: nodepools.apps.openyurt.io spec: group: apps.openyurt.io @@ -40,10 +40,19 @@ spec: description: NodePool is the Schema for the nodepools API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -53,12 +62,16 @@ spec: annotations: additionalProperties: type: string - description: 'If specified, the Annotations will be added to all nodes. NOTE: existing labels with samy keys on the nodes will be overwritten.' + description: |- + If specified, the Annotations will be added to all nodes. + NOTE: existing labels with samy keys on the nodes will be overwritten. type: object labels: additionalProperties: type: string - description: 'If specified, the Labels will be added to all nodes. NOTE: existing labels with samy keys on the nodes will be overwritten.' + description: |- + If specified, the Labels will be added to all nodes. + NOTE: existing labels with samy keys on the nodes will be overwritten. type: object selector: description: A label query over nodes to consider for adding to the pool @@ -66,16 +79,24 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -87,23 +108,33 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic taints: description: If specified, the Taints will be added to all nodes. items: - description: The node this Taint is attached to has the "effect" on any pod that does not tolerate the Taint. + description: |- + The node this Taint is attached to has the "effect" on + any pod that does not tolerate the Taint. properties: effect: - description: Required. The effect of the taint on pods that do not tolerate the taint. Valid effects are NoSchedule, PreferNoSchedule and NoExecute. + description: |- + Required. The effect of the taint on pods + that do not tolerate the taint. + Valid effects are NoSchedule, PreferNoSchedule and NoExecute. type: string key: description: Required. The taint key to be applied to a node. type: string timeAdded: - description: TimeAdded represents the time at which the taint was added. It is only written for NoExecute taints. + description: |- + TimeAdded represents the time at which the taint was added. + It is only written for NoExecute taints. format: date-time type: string value: @@ -161,10 +192,19 @@ spec: description: NodePool is the Schema for the nodepools API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -174,29 +214,44 @@ spec: annotations: additionalProperties: type: string - description: 'If specified, the Annotations will be added to all nodes. NOTE: existing labels with samy keys on the nodes will be overwritten.' + description: |- + If specified, the Annotations will be added to all nodes. + NOTE: existing labels with samy keys on the nodes will be overwritten. type: object hostNetwork: - description: HostNetwork is used to specify that cni components(like flannel) will not be installed on the nodes of this NodePool. This means all pods on the nodes of this NodePool will use HostNetwork and share network namespace with host machine. + description: |- + HostNetwork is used to specify that cni components(like flannel) + will not be installed on the nodes of this NodePool. + This means all pods on the nodes of this NodePool will use + HostNetwork and share network namespace with host machine. type: boolean labels: additionalProperties: type: string - description: 'If specified, the Labels will be added to all nodes. NOTE: existing labels with samy keys on the nodes will be overwritten.' + description: |- + If specified, the Labels will be added to all nodes. + NOTE: existing labels with samy keys on the nodes will be overwritten. type: object taints: description: If specified, the Taints will be added to all nodes. items: - description: The node this Taint is attached to has the "effect" on any pod that does not tolerate the Taint. + description: |- + The node this Taint is attached to has the "effect" on + any pod that does not tolerate the Taint. properties: effect: - description: Required. The effect of the taint on pods that do not tolerate the taint. Valid effects are NoSchedule, PreferNoSchedule and NoExecute. + description: |- + Required. The effect of the taint on pods + that do not tolerate the taint. + Valid effects are NoSchedule, PreferNoSchedule and NoExecute. type: string key: description: Required. The taint key to be applied to a node. type: string timeAdded: - description: TimeAdded represents the time at which the taint was added. It is only written for NoExecute taints. + description: |- + TimeAdded represents the time at which the taint was added. + It is only written for NoExecute taints. format: date-time type: string value: diff --git a/charts/yurt-manager/crds/apps.openyurt.io_yurtappdaemons.yaml b/charts/yurt-manager/crds/apps.openyurt.io_yurtappdaemons.yaml index f4ad3d76df8..0ed16be0968 100644 --- a/charts/yurt-manager/crds/apps.openyurt.io_yurtappdaemons.yaml +++ b/charts/yurt-manager/crds/apps.openyurt.io_yurtappdaemons.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: yurtappdaemons.apps.openyurt.io spec: group: apps.openyurt.io @@ -42,14 +42,19 @@ spec: description: YurtAppDaemon is the Schema for the samples API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -57,31 +62,32 @@ spec: description: YurtAppDaemonSpec defines the desired state of YurtAppDaemon properties: nodepoolSelector: - description: NodePoolSelector is a label query over nodepool that - should match the replica count. It must match the nodepool's labels. + description: |- + NodePoolSelector is a label query over nodepool that should match the replica count. + It must match the nodepool's labels. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the key - and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to - a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a strategic + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic merge patch. items: type: string @@ -94,45 +100,46 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic revisionHistoryLimit: - description: Indicates the number of histories to be conserved. If - unspecified, defaults to 10. + description: |- + Indicates the number of histories to be conserved. + If unspecified, defaults to 10. format: int32 type: integer selector: - description: Selector is a label query over pods that should match - the replica count. It must match the pod template's labels. + description: |- + Selector is a label query over pods that should match the replica count. + It must match the pod template's labels. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that - contains values, a key, and an operator that relates the key - and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to - a set of values. Valid operators are In, NotIn, Exists - and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the - operator is In or NotIn, the values array must be non-empty. - If the operator is Exists or DoesNotExist, the values - array must be empty. This array is replaced during a strategic + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic merge patch. items: type: string @@ -145,11 +152,10 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single - {key,value} in the matchLabels map is equivalent to an element - of matchExpressions, whose key field is "key", the operator - is "In", and the values array contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -185,9 +191,10 @@ spec: description: YurtAppDaemonStatus defines the observed state of YurtAppDaemon properties: collisionCount: - description: Count of hash collisions for the YurtAppDaemon. The YurtAppDaemon - controller uses this field as a collision avoidance mechanism when - it needs to create the name for the newest ControllerRevision. + description: |- + Count of hash collisions for the YurtAppDaemon. The YurtAppDaemon controller + uses this field as a collision avoidance mechanism when it needs to + create the name for the newest ControllerRevision. format: int32 type: integer conditions: @@ -228,9 +235,9 @@ spec: type: string type: array observedGeneration: - description: ObservedGeneration is the most recent generation observed - for this YurtAppDaemon. It corresponds to the YurtAppDaemon's generation, - which is updated on mutation by the API Server. + description: |- + ObservedGeneration is the most recent generation observed for this YurtAppDaemon. It corresponds to the + YurtAppDaemon's generation, which is updated on mutation by the API Server. format: int64 type: integer overriderRef: diff --git a/charts/yurt-manager/crds/apps.openyurt.io_yurtappoverriders.yaml b/charts/yurt-manager/crds/apps.openyurt.io_yurtappoverriders.yaml index dbe685eacac..1a70f48f565 100644 --- a/charts/yurt-manager/crds/apps.openyurt.io_yurtappoverriders.yaml +++ b/charts/yurt-manager/crds/apps.openyurt.io_yurtappoverriders.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: yurtappoverriders.apps.openyurt.io spec: group: apps.openyurt.io @@ -39,30 +39,36 @@ spec: openAPIV3Schema: properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string entries: items: - description: Describe detailed multi-region configuration of the subject + description: |- + Describe detailed multi-region configuration of the subject Entry describe a set of nodepools and their shared or identical configurations properties: items: items: - description: Item represents configuration to be injected. Only - one of its members may be specified. + description: |- + Item represents configuration to be injected. + Only one of its members may be specified. properties: image: description: ImageItem specifies the corresponding container and the claimed image properties: containerName: - description: ContainerName represents name of the container + description: |- + ContainerName represents name of the container in which the Image will be replaced type: string imageClaim: - description: ImageClaim represents the claimed image name + description: |- + ImageClaim represents the claimed image name which is injected into the container above type: string required: @@ -105,9 +111,12 @@ spec: type: object type: array kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -115,15 +124,19 @@ spec: description: Describe the object Entries belongs properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource - this object represents. Servers may infer this from the endpoint - the client submits requests to. Cannot be updated. In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string name: description: Name is the name of YurtAppSet or YurtAppDaemon diff --git a/charts/yurt-manager/crds/apps.openyurt.io_yurtappsets.yaml b/charts/yurt-manager/crds/apps.openyurt.io_yurtappsets.yaml index cafac1a5bdd..c2997f09d85 100644 --- a/charts/yurt-manager/crds/apps.openyurt.io_yurtappsets.yaml +++ b/charts/yurt-manager/crds/apps.openyurt.io_yurtappsets.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: yurtappsets.apps.openyurt.io spec: group: apps.openyurt.io @@ -42,10 +42,19 @@ spec: description: YurtAppSet is the Schema for the yurtAppSets API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -53,25 +62,37 @@ spec: description: YurtAppSetSpec defines the desired state of YurtAppSet. properties: revisionHistoryLimit: - description: Indicates the number of histories to be conserved. If unspecified, defaults to 10. + description: |- + Indicates the number of histories to be conserved. + If unspecified, defaults to 10. format: int32 type: integer selector: - description: Selector is a label query over pods that should match the replica count. It must match the pod template's labels. + description: |- + Selector is a label query over pods that should match the replica count. + It must match the pod template's labels. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -83,7 +104,10 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -91,29 +115,47 @@ spec: description: Topology describes the pods distribution detail between each of pools. properties: pools: - description: Contains the details of each pool. Each element in this array represents one pool which will be provisioned and managed by YurtAppSet. + description: |- + Contains the details of each pool. Each element in this array represents one pool + which will be provisioned and managed by YurtAppSet. items: description: Pool defines the detail of a pool. properties: name: - description: Indicates pool name as a DNS_LABEL, which will be used to generate pool workload name prefix in the format '--'. Name should be unique between all of the pools under one YurtAppSet. Name is NodePool Name + description: |- + Indicates pool name as a DNS_LABEL, which will be used to generate + pool workload name prefix in the format '--'. + Name should be unique between all of the pools under one YurtAppSet. + Name is NodePool Name type: string nodeSelectorTerm: - description: Indicates the node selector to form the pool. Depending on the node selector, pods provisioned could be distributed across multiple groups of nodes. A pool's nodeSelectorTerm is not allowed to be updated. + description: |- + Indicates the node selector to form the pool. Depending on the node selector, + pods provisioned could be distributed across multiple groups of nodes. + A pool's nodeSelectorTerm is not allowed to be updated. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. items: type: string type: array @@ -125,16 +167,25 @@ spec: matchFields: description: A list of node selector requirements by node's fields. items: - description: A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: - description: Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. items: type: string type: array @@ -146,7 +197,11 @@ spec: type: object x-kubernetes-map-type: atomic patch: - description: Indicates the patch for the templateSpec Now support strategic merge path :https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/#notes-on-the-strategic-merge-patch Patch takes precedence over Replicas fields If the Patch also modifies the Replicas, use the Replicas value in the Patch + description: |- + Indicates the patch for the templateSpec + Now support strategic merge path :https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/#notes-on-the-strategic-merge-patch + Patch takes precedence over Replicas fields + If the Patch also modifies the Replicas, use the Replicas value in the Patch type: object x-kubernetes-preserve-unknown-fields: true replicas: @@ -154,25 +209,43 @@ spec: format: int32 type: integer tolerations: - description: Indicates the tolerations the pods under this pool have. A pool's tolerations is not allowed to be updated. + description: |- + Indicates the tolerations the pods under this pool have. + A pool's tolerations is not allowed to be updated. items: - description: The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: - description: Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: - description: Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: - description: Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: - description: TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: - description: Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array @@ -212,7 +285,10 @@ spec: description: YurtAppSetStatus defines the observed state of YurtAppSet. properties: collisionCount: - description: Count of hash collisions for the YurtAppSet. The YurtAppSet controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ControllerRevision. + description: |- + Count of hash collisions for the YurtAppSet. The YurtAppSet controller + uses this field as a collision avoidance mechanism when it needs to + create the name for the newest ControllerRevision. format: int32 type: integer conditions: @@ -242,7 +318,9 @@ spec: description: CurrentRevision, if not empty, indicates the current version of the YurtAppSet. type: string observedGeneration: - description: ObservedGeneration is the most recent generation observed for this YurtAppSet. It corresponds to the YurtAppSet's generation, which is updated on mutation by the API Server. + description: |- + ObservedGeneration is the most recent generation observed for this YurtAppSet. It corresponds to the + YurtAppSet's generation, which is updated on mutation by the API Server. format: int64 type: integer overriderRef: @@ -318,10 +396,19 @@ spec: description: YurtAppSet is the Schema for the YurtAppSets API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -329,21 +416,31 @@ spec: description: YurtAppSetSpec defines the desired state of YurtAppSet. properties: nodepoolSelector: - description: NodePoolSelector is a label query over nodepool in which workloads should be deployed in. It must match the nodepool's labels. + description: |- + NodePoolSelector is a label query over nodepool in which workloads should be deployed in. + It must match the nodepool's labels. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -355,17 +452,24 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic pools: - description: Pools is a list of selected nodepools specified with nodepool id in which workloads should be deployed in. It is primarily used for compatibility with v1alpha1 version and NodePoolSelector should be preferred to choose nodepools + description: |- + Pools is a list of selected nodepools specified with nodepool id in which workloads should be deployed in. + It is primarily used for compatibility with v1alpha1 version and NodePoolSelector should be preferred to choose nodepools items: type: string type: array revisionHistoryLimit: - description: Indicates the number of histories to be conserved. If unspecified, defaults to 10. + description: |- + Indicates the number of histories to be conserved. + If unspecified, defaults to 10. format: int32 type: integer workload: @@ -398,7 +502,9 @@ spec: workloadTweaks: description: WorkloadTemplate defines the customization that will be applied to certain workloads in specified nodepools. items: - description: WorkloadTweak Describe detailed multi-region configuration of the subject BasicTweaks and AdvancedTweaks describe a set of nodepools and their shared or identical configurations + description: |- + WorkloadTweak Describe detailed multi-region configuration of the subject + BasicTweaks and AdvancedTweaks describe a set of nodepools and their shared or identical configurations properties: nodepoolSelector: description: NodePoolSelector is a label query over nodepool in which workloads should be adjusted. @@ -406,16 +512,24 @@ spec: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -427,12 +541,17 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic pools: - description: Pools is a list of selected nodepools specified with nodepool id in which workloads should be adjusted. Pools is not recommended and NodePoolSelector should be preferred + description: |- + Pools is a list of selected nodepools specified with nodepool id in which workloads should be adjusted. + Pools is not recommended and NodePoolSelector should be preferred items: type: string type: array @@ -456,7 +575,9 @@ spec: type: object type: array patches: - description: Patches is a list of advanced tweaks to be applied to a certain workload It can add/remove/replace the field values of specified paths in the template. + description: |- + Patches is a list of advanced tweaks to be applied to a certain workload + It can add/remove/replace the field values of specified paths in the template. items: properties: operation: @@ -496,7 +617,10 @@ spec: description: YurtAppSetStatus defines the observed state of YurtAppSet. properties: collisionCount: - description: Count of hash collisions for the YurtAppSet. The YurtAppSet controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ControllerRevision. + description: |- + Count of hash collisions for the YurtAppSet. The YurtAppSet controller + uses this field as a collision avoidance mechanism when it needs to + create the name for the newest ControllerRevision. format: int32 type: integer conditions: @@ -526,7 +650,9 @@ spec: description: CurrentRevision, if not empty, indicates the current version of the YurtAppSet. type: string observedGeneration: - description: ObservedGeneration is the most recent generation observed for this YurtAppSet. It corresponds to the YurtAppSet's generation, which is updated on mutation by the API Server. + description: |- + ObservedGeneration is the most recent generation observed for this YurtAppSet. It corresponds to the + YurtAppSet's generation, which is updated on mutation by the API Server. format: int64 type: integer readyWorkloads: diff --git a/charts/yurt-manager/crds/apps.openyurt.io_yurtstaticsets.yaml b/charts/yurt-manager/crds/apps.openyurt.io_yurtstaticsets.yaml index db5c773252b..37a5caf2b4e 100644 --- a/charts/yurt-manager/crds/apps.openyurt.io_yurtstaticsets.yaml +++ b/charts/yurt-manager/crds/apps.openyurt.io_yurtstaticsets.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: yurtstaticsets.apps.openyurt.io spec: group: apps.openyurt.io @@ -41,14 +41,19 @@ spec: description: YurtStaticSet is the Schema for the yurtstaticsets API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -56,13 +61,15 @@ spec: description: YurtStaticSetSpec defines the desired state of YurtStaticSet properties: revisionHistoryLimit: - description: The number of old history to retain to allow rollback. + description: |- + The number of old history to retain to allow rollback. Defaults to 10. format: int32 type: integer staticPodManifest: - description: StaticPodManifest indicates the file name of static pod - manifest. The corresponding manifest file name is `StaticPodManifest.yaml`. + description: |- + StaticPodManifest indicates the file name of static pod manifest. + The corresponding manifest file name is `StaticPodManifest.yaml`. type: string template: description: An object that describes the desired spec of static pod. diff --git a/charts/yurt-manager/crds/iot.openyurt.io_platformadmins.yaml b/charts/yurt-manager/crds/iot.openyurt.io_platformadmins.yaml index f6ac78c7107..af03218c140 100644 --- a/charts/yurt-manager/crds/iot.openyurt.io_platformadmins.yaml +++ b/charts/yurt-manager/crds/iot.openyurt.io_platformadmins.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: platformadmins.iot.openyurt.io spec: group: iot.openyurt.io @@ -48,14 +48,19 @@ spec: description: PlatformAdmin is the Schema for the samples API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -74,49 +79,49 @@ spec: behavior of the Deployment. properties: minReadySeconds: - description: Minimum number of seconds for which a newly - created pod should be ready without any of its container - crashing, for it to be considered available. Defaults - to 0 (pod will be considered available as soon as it is - ready) + description: |- + Minimum number of seconds for which a newly created pod should be ready + without any of its container crashing, for it to be considered available. + Defaults to 0 (pod will be considered available as soon as it is ready) format: int32 type: integer paused: description: Indicates that the deployment is paused. type: boolean progressDeadlineSeconds: - description: The maximum time in seconds for a deployment - to make progress before it is considered to be failed. - The deployment controller will continue to process failed - deployments and a condition with a ProgressDeadlineExceeded - reason will be surfaced in the deployment status. Note - that progress will not be estimated during the time a - deployment is paused. Defaults to 600s. + description: |- + The maximum time in seconds for a deployment to make progress before it + is considered to be failed. The deployment controller will continue to + process failed deployments and a condition with a ProgressDeadlineExceeded + reason will be surfaced in the deployment status. Note that progress will + not be estimated during the time a deployment is paused. Defaults to 600s. format: int32 type: integer replicas: - description: Number of desired pods. This is a pointer to - distinguish between explicit zero and not specified. Defaults - to 1. + description: |- + Number of desired pods. This is a pointer to distinguish between explicit + zero and not specified. Defaults to 1. format: int32 type: integer revisionHistoryLimit: - description: The number of old ReplicaSets to retain to - allow rollback. This is a pointer to distinguish between - explicit zero and not specified. Defaults to 10. + description: |- + The number of old ReplicaSets to retain to allow rollback. + This is a pointer to distinguish between explicit zero and not specified. + Defaults to 10. format: int32 type: integer selector: - description: Label selector for pods. Existing ReplicaSets - whose pods are selected by this will be the ones affected - by this deployment. It must match the pod template's labels. + description: |- + Label selector for pods. Existing ReplicaSets whose pods are + selected by this will be the ones affected by this deployment. + It must match the pod template's labels. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector - that contains values, a key, and an operator that + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: @@ -124,17 +129,16 @@ spec: applies to. type: string operator: - description: operator represents a key's relationship - to a set of values. Valid operators are In, - NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. - If the operator is In or NotIn, the values array - must be non-empty. If the operator is Exists - or DoesNotExist, the values array must be empty. - This array is replaced during a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -146,11 +150,10 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. - A single {key,value} in the matchLabels map is equivalent - to an element of matchExpressions, whose key field - is "key", the operator is "In", and the values array - contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -159,48 +162,45 @@ spec: pods with new ones. properties: rollingUpdate: - description: 'Rolling update config params. Present - only if DeploymentStrategyType = RollingUpdate. --- - TODO: Update this to follow our convention for oneOf, - whatever we decide it to be.' + description: |- + Rolling update config params. Present only if DeploymentStrategyType = + RollingUpdate. + --- + TODO: Update this to follow our convention for oneOf, whatever we decide it + to be. properties: maxSurge: anyOf: - type: integer - type: string - description: 'The maximum number of pods that can - be scheduled above the desired number of pods. - Value can be an absolute number (ex: 5) or a percentage - of desired pods (ex: 10%). This can not be 0 if - MaxUnavailable is 0. Absolute number is calculated - from percentage by rounding up. Defaults to 25%. - Example: when this is set to 30%, the new ReplicaSet - can be scaled up immediately when the rolling - update starts, such that the total number of old - and new pods do not exceed 130% of desired pods. - Once old pods have been killed, new ReplicaSet - can be scaled up further, ensuring that total - number of pods running at any time during the - update is at most 130% of desired pods.' + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. x-kubernetes-int-or-string: true maxUnavailable: anyOf: - type: integer - type: string - description: 'The maximum number of pods that can - be unavailable during the update. Value can be - an absolute number (ex: 5) or a percentage of - desired pods (ex: 10%). Absolute number is calculated - from percentage by rounding down. This can not - be 0 if MaxSurge is 0. Defaults to 25%. Example: - when this is set to 30%, the old ReplicaSet can - be scaled down to 70% of desired pods immediately - when the rolling update starts. Once new pods - are ready, old ReplicaSet can be scaled down further, - followed by scaling up the new ReplicaSet, ensuring - that the total number of pods available at all - times during the update is at least 70% of desired - pods.' + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. x-kubernetes-int-or-string: true type: object type: @@ -209,24 +209,25 @@ spec: type: string type: object template: - description: Template describes the pods that will be created. - The only allowed template.spec.restartPolicy value is - "Always". + description: |- + Template describes the pods that will be created. + The only allowed template.spec.restartPolicy value is "Always". properties: metadata: - description: 'Standard object''s metadata. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata' + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata type: object spec: - description: 'Specification of the desired behavior - of the pod. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status' + description: |- + Specification of the desired behavior of the pod. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status properties: activeDeadlineSeconds: - description: Optional duration in seconds the pod - may be active on the node relative to StartTime - before the system will actively try to mark it - failed and kill associated containers. Value must - be a positive integer. + description: |- + Optional duration in seconds the pod may be active on the node relative to + StartTime before the system will actively try to mark it failed and kill associated containers. + Value must be a positive integer. format: int64 type: integer affinity: @@ -238,27 +239,20 @@ spec: rules for the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to - schedule pods to nodes that satisfy the - affinity expressions specified by this - field, but it may choose a node that violates - one or more of the expressions. The node - that is most preferred is the one with - the greatest sum of weights, i.e. for - each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a - sum by iterating through the elements - of this field and adding "weight" to the - sum if the node matches the corresponding - matchExpressions; the node(s) with the - highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. items: - description: An empty preferred scheduling - term matches all objects with implicit - weight 0 (i.e. it's a no-op). A null - preferred scheduling term matches no - objects (i.e. is also a no-op). + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). properties: preference: description: A node selector term, @@ -269,11 +263,9 @@ spec: description: A list of node selector requirements by node's labels. items: - description: A node selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. properties: key: description: The label key @@ -281,29 +273,17 @@ spec: to. type: string operator: - description: Represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists, DoesNotExist. - Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of - string values. If the - operator is In or NotIn, - the values array must - be non-empty. If the operator - is Exists or DoesNotExist, - the values array must - be empty. If the operator - is Gt or Lt, the values - array must have a single - element, which will be - interpreted as an integer. - This array is replaced - during a strategic merge - patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. items: type: string type: array @@ -316,11 +296,9 @@ spec: description: A list of node selector requirements by node's fields. items: - description: A node selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. properties: key: description: The label key @@ -328,29 +306,17 @@ spec: to. type: string operator: - description: Represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists, DoesNotExist. - Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of - string values. If the - operator is In or NotIn, - the values array must - be non-empty. If the operator - is Exists or DoesNotExist, - the values array must - be empty. If the operator - is Gt or Lt, the values - array must have a single - element, which will be - interpreted as an integer. - This array is replaced - during a strategic merge - patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. items: type: string type: array @@ -373,35 +339,29 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements - specified by this field are not met at - scheduling time, the pod will not be scheduled - onto the node. If the affinity requirements - specified by this field cease to be met - at some point during pod execution (e.g. - due to an update), the system may or may - not try to eventually evict the pod from - its node. + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. items: - description: A null or empty node - selector term matches no objects. - The requirements of them are ANDed. - The TopologySelectorTerm type implements - a subset of the NodeSelectorTerm. + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: - description: A node selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. properties: key: description: The label key @@ -409,29 +369,17 @@ spec: to. type: string operator: - description: Represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists, DoesNotExist. - Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of - string values. If the - operator is In or NotIn, - the values array must - be non-empty. If the operator - is Exists or DoesNotExist, - the values array must - be empty. If the operator - is Gt or Lt, the values - array must have a single - element, which will be - interpreted as an integer. - This array is replaced - during a strategic merge - patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. items: type: string type: array @@ -444,11 +392,9 @@ spec: description: A list of node selector requirements by node's fields. items: - description: A node selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. properties: key: description: The label key @@ -456,29 +402,17 @@ spec: to. type: string operator: - description: Represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists, DoesNotExist. - Gt, and Lt. + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: - description: An array of - string values. If the - operator is In or NotIn, - the values array must - be non-empty. If the operator - is Exists or DoesNotExist, - the values array must - be empty. If the operator - is Gt or Lt, the values - array must have a single - element, which will be - interpreted as an integer. - This array is replaced - during a strategic merge - patch. + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. items: type: string type: array @@ -501,22 +435,16 @@ spec: node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to - schedule pods to nodes that satisfy the - affinity expressions specified by this - field, but it may choose a node that violates - one or more of the expressions. The node - that is most preferred is the one with - the greatest sum of weights, i.e. for - each node that meets all of the scheduling - requirements (resource request, requiredDuringScheduling - affinity expressions, etc.), compute a - sum by iterating through the elements - of this field and adding "weight" to the - sum if the node has pods which matches - the corresponding podAffinityTerm; the - node(s) with the highest sum are the most - preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields @@ -539,12 +467,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is @@ -553,28 +478,16 @@ spec: to. type: string operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -586,31 +499,20 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaceSelector: - description: A label query over - the set of namespaces that the - term applies to. The term is - applied to the union of the - namespaces selected by this - field and the ones listed in - the namespaces field. null selector - and null or empty namespaces - list means "this pod's namespace". - An empty selector ({}) matches - all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions @@ -618,12 +520,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is @@ -632,28 +531,16 @@ spec: to. type: string operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -665,53 +552,36 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The - term is applied to the union - of the namespaces listed in - this field and the ones selected - by namespaceSelector. null or - empty namespaces list and null - namespaceSelector means "this - pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: - description: This pod should be - co-located (affinity) or not - co-located (anti-affinity) with - the pods matching the labelSelector - in the specified namespaces, - where co-located is defined - as running on a node whose value - of the label with key topologyKey - matches that of any node on - which any of the selected pods - is running. Empty topologyKey - is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: - description: weight associated with - matching the corresponding podAffinityTerm, + description: |- + weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer @@ -721,30 +591,22 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: - description: If the affinity requirements - specified by this field are not met at - scheduling time, the pod will not be scheduled - onto the node. If the affinity requirements - specified by this field cease to be met - at some point during pod execution (e.g. - due to a pod label update), the system - may or may not try to eventually evict - the pod from its node. When there are - multiple elements, the lists of nodes - corresponding to each podAffinityTerm - are intersected, i.e. all terms must be - satisfied. + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. items: - description: Defines a set of pods (namely - those matching the labelSelector relative - to the given namespace(s)) that this - pod should be co-located (affinity) - or not co-located (anti-affinity) with, - where co-located is defined as running - on a node whose value of the label with - key matches that of any - node on which a pod of the set of pods - is running + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running properties: labelSelector: description: A label query over a @@ -756,11 +618,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the @@ -768,23 +628,16 @@ spec: applies to. type: string operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -796,29 +649,20 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaceSelector: - description: A label query over the - set of namespaces that the term - applies to. The term is applied - to the union of the namespaces selected - by this field and the ones listed - in the namespaces field. null selector - and null or empty namespaces list - means "this pod's namespace". An - empty selector ({}) matches all - namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions @@ -826,11 +670,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the @@ -838,23 +680,16 @@ spec: applies to. type: string operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -866,42 +701,29 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The term - is applied to the union of the namespaces - listed in this field and the ones - selected by namespaceSelector. null - or empty namespaces list and null - namespaceSelector means "this pod's - namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where - co-located is defined as running - on a node whose value of the label - with key topologyKey matches that - of any node on which any of the - selected pods is running. Empty - topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string required: - topologyKey @@ -914,22 +736,16 @@ spec: same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: - description: The scheduler will prefer to - schedule pods to nodes that satisfy the - anti-affinity expressions specified by - this field, but it may choose a node that - violates one or more of the expressions. - The node that is most preferred is the - one with the greatest sum of weights, - i.e. for each node that meets all of the - scheduling requirements (resource request, - requiredDuringScheduling anti-affinity - expressions, etc.), compute a sum by iterating - through the elements of this field and - adding "weight" to the sum if the node - has pods which matches the corresponding - podAffinityTerm; the node(s) with the - highest sum are the most preferred. + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields @@ -952,12 +768,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is @@ -966,28 +779,16 @@ spec: to. type: string operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -999,31 +800,20 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaceSelector: - description: A label query over - the set of namespaces that the - term applies to. The term is - applied to the union of the - namespaces selected by this - field and the ones listed in - the namespaces field. null selector - and null or empty namespaces - list means "this pod's namespace". - An empty selector ({}) matches - all namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions @@ -1031,12 +821,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is @@ -1045,28 +832,16 @@ spec: to. type: string operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -1078,53 +853,36 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The - term is applied to the union - of the namespaces listed in - this field and the ones selected - by namespaceSelector. null or - empty namespaces list and null - namespaceSelector means "this - pod's namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: - description: This pod should be - co-located (affinity) or not - co-located (anti-affinity) with - the pods matching the labelSelector - in the specified namespaces, - where co-located is defined - as running on a node whose value - of the label with key topologyKey - matches that of any node on - which any of the selected pods - is running. Empty topologyKey - is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: - description: weight associated with - matching the corresponding podAffinityTerm, + description: |- + weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer @@ -1134,30 +892,22 @@ spec: type: object type: array requiredDuringSchedulingIgnoredDuringExecution: - description: If the anti-affinity requirements - specified by this field are not met at - scheduling time, the pod will not be scheduled - onto the node. If the anti-affinity requirements - specified by this field cease to be met - at some point during pod execution (e.g. - due to a pod label update), the system - may or may not try to eventually evict - the pod from its node. When there are - multiple elements, the lists of nodes - corresponding to each podAffinityTerm - are intersected, i.e. all terms must be - satisfied. + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. items: - description: Defines a set of pods (namely - those matching the labelSelector relative - to the given namespace(s)) that this - pod should be co-located (affinity) - or not co-located (anti-affinity) with, - where co-located is defined as running - on a node whose value of the label with - key matches that of any - node on which a pod of the set of pods - is running + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running properties: labelSelector: description: A label query over a @@ -1169,11 +919,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the @@ -1181,23 +929,16 @@ spec: applies to. type: string operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -1209,29 +950,20 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaceSelector: - description: A label query over the - set of namespaces that the term - applies to. The term is applied - to the union of the namespaces selected - by this field and the ones listed - in the namespaces field. null selector - and null or empty namespaces list - means "this pod's namespace". An - empty selector ({}) matches all - namespaces. + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions @@ -1239,11 +971,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, a key, - and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the @@ -1251,23 +981,16 @@ spec: applies to. type: string operator: - description: operator represents - a key's relationship to - a set of values. Valid - operators are In, NotIn, - Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an - array of string values. - If the operator is In - or NotIn, the values array - must be non-empty. If - the operator is Exists - or DoesNotExist, the values - array must be empty. This - array is replaced during - a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -1279,42 +1002,29 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a - map of {key,value} pairs. A - single {key,value} in the matchLabels - map is equivalent to an element - of matchExpressions, whose key - field is "key", the operator - is "In", and the values array - contains only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: - description: namespaces specifies - a static list of namespace names - that the term applies to. The term - is applied to the union of the namespaces - listed in this field and the ones - selected by namespaceSelector. null - or empty namespaces list and null - namespaceSelector means "this pod's - namespace". + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: - description: This pod should be co-located - (affinity) or not co-located (anti-affinity) - with the pods matching the labelSelector - in the specified namespaces, where - co-located is defined as running - on a node whose value of the label - with key topologyKey matches that - of any node on which any of the - selected pods is running. Empty - topologyKey is not allowed. + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. type: string required: - topologyKey @@ -1328,8 +1038,9 @@ spec: mounted. type: boolean containers: - description: List of containers belonging to the - pod. Containers cannot currently be added or removed. + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. There must be at least one container in a Pod. Cannot be updated. items: @@ -1337,43 +1048,35 @@ spec: you want to run within a pod. properties: args: - description: 'Arguments to the entrypoint. - The container image''s CMD is used if this - is not provided. Variable references $(VAR_NAME) - are expanded using the container''s environment. - If a variable cannot be resolved, the reference - in the input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell items: type: string type: array command: - description: 'Entrypoint array. Not executed - within a shell. The container image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the container''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell items: type: string type: array env: - description: List of environment variables - to set in the container. Cannot be updated. + description: |- + List of environment variables to set in the container. + Cannot be updated. items: description: EnvVar represents an environment variable present in a Container. @@ -1383,20 +1086,16 @@ spec: variable. Must be a C_IDENTIFIER. type: string value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously - defined environment variables in the - container and any service environment - variables. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, - regardless of whether the variable - exists or not. Defaults to "".' + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string valueFrom: description: Source for the environment @@ -1411,10 +1110,10 @@ spec: description: The key to select. type: string name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether @@ -1426,12 +1125,9 @@ spec: type: object x-kubernetes-map-type: atomic fieldRef: - description: 'Selects a field of - the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. properties: apiVersion: description: Version of the @@ -1448,13 +1144,9 @@ spec: type: object x-kubernetes-map-type: atomic resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. properties: containerName: description: 'Container name: @@ -1488,10 +1180,10 @@ spec: be a valid secret key. type: string name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether @@ -1508,16 +1200,13 @@ spec: type: object type: array envFrom: - description: List of sources to populate environment - variables in the container. The keys defined - within a source must be a C_IDENTIFIER. - All invalid keys will be reported as an - event when the container is starting. When - a key exists in multiple sources, the value - associated with the last source will take - precedence. Values defined by an Env with - a duplicate key will take precedence. Cannot - be updated. + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. items: description: EnvFromSource represents the source of a set of ConfigMaps @@ -1527,10 +1216,10 @@ spec: from properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether the @@ -1547,10 +1236,10 @@ spec: description: The Secret to select from properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether the @@ -1561,52 +1250,43 @@ spec: type: object type: array image: - description: 'Container image name. More info: - https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level - config management to default or override - container images in workload controllers - like Deployments and StatefulSets.' + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. type: string imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always - if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/containers/images#updating-images' + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images type: string lifecycle: - description: Actions that the management system - should take in response to container lifecycle - events. Cannot be updated. + description: |- + Actions that the management system should take in response to container lifecycle events. + Cannot be updated. properties: postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array @@ -1616,10 +1296,9 @@ spec: http request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to @@ -1631,12 +1310,9 @@ spec: in HTTP probes properties: name: - description: The header - field name. This will - be canonicalized upon - output, so case-variant - names will be understood - as the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header @@ -1655,27 +1331,24 @@ spec: anyOf: - type: integer - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for the backward compatibility. There are no validation of this field and + lifecycle hooks will fail in runtime when tcp handler is specified. properties: host: description: 'Optional: Host name @@ -1686,52 +1359,38 @@ spec: anyOf: - type: integer - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the container - will eventually terminate within the - Pod''s termination grace period (unless - delayed by finalizers). Other management - of the container blocks until the hook - completes or until the termination grace - period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array @@ -1741,10 +1400,9 @@ spec: http request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to @@ -1756,12 +1414,9 @@ spec: in HTTP probes properties: name: - description: The header - field name. This will - be canonicalized upon - output, so case-variant - names will be understood - as the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header @@ -1780,27 +1435,24 @@ spec: anyOf: - type: integer - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for the backward compatibility. There are no validation of this field and + lifecycle hooks will fail in runtime when tcp handler is specified. properties: host: description: 'Optional: Host name @@ -1811,11 +1463,10 @@ spec: anyOf: - type: integer - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -1823,36 +1474,31 @@ spec: type: object type: object livenessProbe: - description: 'Periodic probe of container - liveness. Container will be restarted if - the probe fails. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -1866,11 +1512,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -1880,10 +1527,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -1895,11 +1541,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -1918,36 +1562,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -1963,70 +1606,59 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object name: - description: Name of the container specified - as a DNS_LABEL. Each container in a pod - must have a unique name (DNS_LABEL). Cannot - be updated. + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: - description: List of ports to expose from - the container. Not specifying a port here - DOES NOT prevent that port from being exposed. - Any port which is listening on the default - "0.0.0.0" address inside a container will - be accessible from the network. Modifying - this array with strategic merge patch may - corrupt the data. For more information See - https://github.com/kubernetes/kubernetes/issues/108255. + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. Cannot be updated. items: description: ContainerPort represents a network port in a single container. properties: containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < 65536. + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. format: int32 type: integer hostIP: @@ -2034,27 +1666,24 @@ spec: external port to. type: string hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this - must match ContainerPort. Most containers - do not need this. + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. format: int32 type: integer name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to by - services. + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. type: string protocol: default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". type: string required: - containerPort @@ -2065,36 +1694,31 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: - description: 'Periodic probe of container - service readiness. Container will be removed - from service endpoints if the probe fails. - Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -2108,11 +1732,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -2122,10 +1747,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -2137,11 +1761,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -2160,36 +1782,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -2205,42 +1826,33 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object @@ -2252,13 +1864,13 @@ spec: resource resize policy for the container. properties: resourceName: - description: 'Name of the resource to - which this resource resize policy - applies. Supported values: cpu, memory.' + description: |- + Name of the resource to which this resource resize policy applies. + Supported values: cpu, memory. type: string restartPolicy: - description: Restart policy to apply - when specified resource is resized. + description: |- + Restart policy to apply when specified resource is resized. If not specified, it defaults to NotRequired. type: string required: @@ -2268,27 +1880,30 @@ spec: type: array x-kubernetes-list-type: atomic resources: - description: 'Compute Resources required by - this container. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ properties: claims: - description: "Claims lists the names of - resources, defined in spec.resourceClaims, - that are used by this container. \n - This is an alpha field and requires - enabling the DynamicResourceAllocation - feature gate. \n This field is immutable. - It can only be set for containers." + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. items: description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: - description: Name must match the - name of one entry in pod.spec.resourceClaims - of the Pod where this field is - used. It makes that resource available + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available inside a container. type: string required: @@ -2305,9 +1920,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -2316,64 +1931,50 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object restartPolicy: - description: 'RestartPolicy defines the restart - behavior of individual containers in a pod. - This field may only be set for init containers, - and the only allowed value is "Always". - For non-init containers or when this field - is not specified, the restart behavior is - defined by the Pod''s restart policy and - the container type. Setting the RestartPolicy - as "Always" for the init container will - have the following effect: this init container - will be continually restarted on exit until - all regular containers have terminated. - Once all regular containers have completed, - all init containers with restartPolicy "Always" - will be shut down. This lifecycle differs - from normal init containers and is often - referred to as a "sidecar" container. Although - this init container still starts in the - init container sequence, it does not wait - for the container to complete before proceeding - to the next init container.' + description: |- + RestartPolicy defines the restart behavior of individual containers in a pod. + This field may only be set for init containers, and the only allowed value is "Always". + For non-init containers or when this field is not specified, + the restart behavior is defined by the Pod's restart policy and the container type. + Setting the RestartPolicy as "Always" for the init container will have the following effect: + this init container will be continually restarted on + exit until all regular containers have terminated. Once all regular + containers have completed, all init containers with restartPolicy "Always" + will be shut down. This lifecycle differs from normal init containers and + is often referred to as a "sidecar" container. Although this init + container still starts in the init container sequence, it does not wait + for the container to complete before proceeding to the next init + container. type: string securityContext: - description: 'SecurityContext defines the - security options the container should be - run with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ properties: allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the no_new_privs - flag will be set on the container process. - AllowPrivilegeEscalation is true always - when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this - field cannot be set when spec.os.name - is windows.' + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. type: boolean capabilities: - description: The capabilities to add/drop - when running containers. Defaults to - the default set of capabilities granted - by the container runtime. Note that - this field cannot be set when spec.os.name - is windows. + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. properties: add: description: Added capabilities @@ -2391,74 +1992,60 @@ spec: type: array type: object privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. type: boolean procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this field - cannot be set when spec.os.name is windows. + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. type: boolean runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does not - run as UID 0 (root) and fail to start - the container if it does. If unset or - false, no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. type: boolean runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if - unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: - description: The SELinux context to be - applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. properties: level: description: Level is SELinux level @@ -2478,54 +2065,44 @@ spec: type: string type: object seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. properties: localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile - must be preconfigured on the node - to work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must be - set if type is "Localhost". Must - NOT be set for any other type. + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. type: string type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n Localhost - - a profile defined in a file on - the node should be used. RuntimeDefault - - the container runtime default - profile should be used. Unconfined - - no profile should be applied." + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. type: string required: - type type: object windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set when - spec.os.name is linux. + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. properties: gmsaCredentialSpec: - description: GMSACredentialSpec is - where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: description: GMSACredentialSpecName @@ -2533,68 +2110,50 @@ spec: spec to use. type: string hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. All - of a Pod's containers must have - the same effective HostProcess value - (it is not allowed to have a mix - of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess - is true then HostNetwork must also - be set to true. + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. type: boolean runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. type: string type: object type: object startupProbe: - description: 'StartupProbe indicates that - the Pod has successfully initialized. If - specified, no other probes are executed - until this completes successfully. If this - probe fails, the Pod will be restarted, - just as if the livenessProbe failed. This - can be used to provide different probe parameters - at the beginning of a Pod''s lifecycle, - when it might take a long time to load data - or warm a cache, than during steady-state - operation. This cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -2608,11 +2167,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -2622,10 +2182,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -2637,11 +2196,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -2660,36 +2217,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -2705,97 +2261,76 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object stdin: - description: Whether this container should - allocate a buffer for stdin in the container - runtime. If this is not set, reads from - stdin in the container will always result - in EOF. Default is false. + description: |- + Whether this container should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the container will always result in EOF. + Default is false. type: boolean stdinOnce: - description: Whether the container runtime - should close the stdin channel after it - has been opened by a single attach. When - stdin is true the stdin stream will remain - open across multiple attach sessions. If - stdinOnce is set to true, stdin is opened - on container start, is empty until the first - client attaches to stdin, and then remains - open and accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the container is restarted. - If this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the container is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false type: boolean terminationMessagePath: - description: 'Optional: Path at which the - file to which the container''s termination - message will be written is mounted into - the container''s filesystem. Message written - is intended to be brief final status, such - as an assertion failure message. Will be - truncated by the node if greater than 4096 - bytes. The total message length across all - containers will be limited to 12kb. Defaults - to /dev/termination-log. Cannot be updated.' + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. type: string terminationMessagePolicy: - description: Indicate how the termination - message should be populated. File will use - the contents of terminationMessagePath to - populate the container status message on - both success and failure. FallbackToLogsOnError - will use the last chunk of container log - output if the termination message file is - empty and the container exited with an error. - The log output is limited to 2048 bytes - or 80 lines, whichever is smaller. Defaults - to File. Cannot be updated. + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. type: string tty: - description: Whether this container should - allocate a TTY for itself, also requires - 'stdin' to be true. Default is false. + description: |- + Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. type: boolean volumeDevices: description: volumeDevices is the list of @@ -2820,48 +2355,45 @@ spec: type: object type: array volumeMounts: - description: Pod volumes to mount into the - container's filesystem. Cannot be updated. + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. items: description: VolumeMount describes a mounting of a Volume within a container. properties: mountPath: - description: Path within the container - at which the volume should be mounted. Must + description: |- + Path within the container at which the volume should be mounted. Must not contain ':'. type: string mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other way - around. When not set, MountPropagationNone - is used. This field is beta in 1.10. + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. type: string name: description: This must match the Name of a Volume. type: string readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false. type: boolean subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: - description: Expanded path within the - volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) are - expanded using the container's environment. - Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -2869,35 +2401,36 @@ spec: type: object type: array workingDir: - description: Container's working directory. - If not specified, the container runtime's - default will be used, which might be configured - in the container image. Cannot be updated. + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. type: string required: - name type: object type: array dnsConfig: - description: Specifies the DNS parameters of a pod. - Parameters specified here will be merged to the - generated DNS configuration based on DNSPolicy. + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. properties: nameservers: - description: A list of DNS name server IP addresses. - This will be appended to the base nameservers - generated from DNSPolicy. Duplicated nameservers - will be removed. + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. items: type: string type: array options: - description: A list of DNS resolver options. - This will be merged with the base options - generated from DNSPolicy. Duplicated entries - will be removed. Resolution options given - in Options will override those that appear - in the base DNSPolicy. + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. items: description: PodDNSConfigOption defines DNS resolver options of a pod. @@ -2910,91 +2443,77 @@ spec: type: object type: array searches: - description: A list of DNS search domains for - host-name lookup. This will be appended to - the base search paths generated from DNSPolicy. + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. Duplicated search paths will be removed. items: type: string type: array type: object dnsPolicy: - description: Set DNS policy for the pod. Defaults - to "ClusterFirst". Valid values are 'ClusterFirstWithHostNet', - 'ClusterFirst', 'Default' or 'None'. DNS parameters - given in DNSConfig will be merged with the policy - selected with DNSPolicy. To have DNS options set - along with hostNetwork, you have to specify DNS - policy explicitly to 'ClusterFirstWithHostNet'. + description: |- + Set DNS policy for the pod. + Defaults to "ClusterFirst". + Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. + DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. + To have DNS options set along with hostNetwork, you have to specify DNS policy + explicitly to 'ClusterFirstWithHostNet'. type: string enableServiceLinks: - description: 'EnableServiceLinks indicates whether - information about services should be injected - into pod''s environment variables, matching the - syntax of Docker links. Optional: Defaults to - true.' + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. type: boolean ephemeralContainers: - description: List of ephemeral containers run in - this pod. Ephemeral containers may be run in an - existing pod to perform user-initiated actions - such as debugging. This list cannot be specified - when creating a pod, and it cannot be modified - by updating the pod spec. In order to add an ephemeral - container to an existing pod, use the pod's ephemeralcontainers - subresource. + description: |- + List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing + pod to perform user-initiated actions such as debugging. This list cannot be specified when + creating a pod, and it cannot be modified by updating the pod spec. In order to add an + ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource. items: - description: "An EphemeralContainer is a temporary - container that you may add to an existing Pod - for user-initiated activities such as debugging. - Ephemeral containers have no resource or scheduling - guarantees, and they will not be restarted when - they exit or when a Pod is removed or restarted. - The kubelet may evict a Pod if an ephemeral - container causes the Pod to exceed its resource - allocation. \n To add an ephemeral container, - use the ephemeralcontainers subresource of an - existing Pod. Ephemeral containers may not be - removed or restarted." + description: |- + An EphemeralContainer is a temporary container that you may add to an existing Pod for + user-initiated activities such as debugging. Ephemeral containers have no resource or + scheduling guarantees, and they will not be restarted when they exit or when a Pod is + removed or restarted. The kubelet may evict a Pod if an ephemeral container causes the + Pod to exceed its resource allocation. + + + To add an ephemeral container, use the ephemeralcontainers subresource of an existing + Pod. Ephemeral containers may not be removed or restarted. properties: args: - description: 'Arguments to the entrypoint. - The image''s CMD is used if this is not - provided. Variable references $(VAR_NAME) - are expanded using the container''s environment. - If a variable cannot be resolved, the reference - in the input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell items: type: string type: array command: - description: 'Entrypoint array. Not executed - within a shell. The image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the container''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell items: type: string type: array env: - description: List of environment variables - to set in the container. Cannot be updated. + description: |- + List of environment variables to set in the container. + Cannot be updated. items: description: EnvVar represents an environment variable present in a Container. @@ -3004,20 +2523,16 @@ spec: variable. Must be a C_IDENTIFIER. type: string value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously - defined environment variables in the - container and any service environment - variables. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, - regardless of whether the variable - exists or not. Defaults to "".' + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string valueFrom: description: Source for the environment @@ -3032,10 +2547,10 @@ spec: description: The key to select. type: string name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether @@ -3047,12 +2562,9 @@ spec: type: object x-kubernetes-map-type: atomic fieldRef: - description: 'Selects a field of - the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. properties: apiVersion: description: Version of the @@ -3069,13 +2581,9 @@ spec: type: object x-kubernetes-map-type: atomic resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. properties: containerName: description: 'Container name: @@ -3109,10 +2617,10 @@ spec: be a valid secret key. type: string name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether @@ -3129,16 +2637,13 @@ spec: type: object type: array envFrom: - description: List of sources to populate environment - variables in the container. The keys defined - within a source must be a C_IDENTIFIER. - All invalid keys will be reported as an - event when the container is starting. When - a key exists in multiple sources, the value - associated with the last source will take - precedence. Values defined by an Env with - a duplicate key will take precedence. Cannot - be updated. + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. items: description: EnvFromSource represents the source of a set of ConfigMaps @@ -3148,10 +2653,10 @@ spec: from properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether the @@ -3168,10 +2673,10 @@ spec: description: The Secret to select from properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether the @@ -3182,47 +2687,40 @@ spec: type: object type: array image: - description: 'Container image name. More info: - https://kubernetes.io/docs/concepts/containers/images' + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images type: string imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always - if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/containers/images#updating-images' + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images type: string lifecycle: description: Lifecycle is not allowed for ephemeral containers. properties: postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array @@ -3232,10 +2730,9 @@ spec: http request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to @@ -3247,12 +2744,9 @@ spec: in HTTP probes properties: name: - description: The header - field name. This will - be canonicalized upon - output, so case-variant - names will be understood - as the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header @@ -3271,27 +2765,24 @@ spec: anyOf: - type: integer - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for the backward compatibility. There are no validation of this field and + lifecycle hooks will fail in runtime when tcp handler is specified. properties: host: description: 'Optional: Host name @@ -3302,52 +2793,38 @@ spec: anyOf: - type: integer - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the container - will eventually terminate within the - Pod''s termination grace period (unless - delayed by finalizers). Other management - of the container blocks until the hook - completes or until the termination grace - period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array @@ -3357,10 +2834,9 @@ spec: http request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to @@ -3372,12 +2848,9 @@ spec: in HTTP probes properties: name: - description: The header - field name. This will - be canonicalized upon - output, so case-variant - names will be understood - as the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header @@ -3396,27 +2869,24 @@ spec: anyOf: - type: integer - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for the backward compatibility. There are no validation of this field and + lifecycle hooks will fail in runtime when tcp handler is specified. properties: host: description: 'Optional: Host name @@ -3427,11 +2897,10 @@ spec: anyOf: - type: integer - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -3447,26 +2916,20 @@ spec: to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -3480,11 +2943,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -3494,10 +2958,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -3509,11 +2972,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -3532,36 +2993,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -3577,50 +3037,40 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object name: - description: Name of the ephemeral container - specified as a DNS_LABEL. This name must - be unique among all containers, init containers - and ephemeral containers. + description: |- + Name of the ephemeral container specified as a DNS_LABEL. + This name must be unique among all containers, init containers and ephemeral containers. type: string ports: description: Ports are not allowed for ephemeral @@ -3630,9 +3080,9 @@ spec: network port in a single container. properties: containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < 65536. + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. format: int32 type: integer hostIP: @@ -3640,27 +3090,24 @@ spec: external port to. type: string hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this - must match ContainerPort. Most containers - do not need this. + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. format: int32 type: integer name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to by - services. + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. type: string protocol: default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". type: string required: - containerPort @@ -3679,26 +3126,20 @@ spec: to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -3712,11 +3153,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -3726,10 +3168,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -3741,11 +3182,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -3764,36 +3203,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -3809,42 +3247,33 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object @@ -3856,13 +3285,13 @@ spec: resource resize policy for the container. properties: resourceName: - description: 'Name of the resource to - which this resource resize policy - applies. Supported values: cpu, memory.' + description: |- + Name of the resource to which this resource resize policy applies. + Supported values: cpu, memory. type: string restartPolicy: - description: Restart policy to apply - when specified resource is resized. + description: |- + Restart policy to apply when specified resource is resized. If not specified, it defaults to NotRequired. type: string required: @@ -3872,28 +3301,29 @@ spec: type: array x-kubernetes-list-type: atomic resources: - description: Resources are not allowed for - ephemeral containers. Ephemeral containers - use spare resources already allocated to - the pod. + description: |- + Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources + already allocated to the pod. properties: claims: - description: "Claims lists the names of - resources, defined in spec.resourceClaims, - that are used by this container. \n - This is an alpha field and requires - enabling the DynamicResourceAllocation - feature gate. \n This field is immutable. - It can only be set for containers." + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. items: description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: - description: Name must match the - name of one entry in pod.spec.resourceClaims - of the Pod where this field is - used. It makes that resource available + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available inside a container. type: string required: @@ -3910,9 +3340,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -3921,48 +3351,40 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object restartPolicy: - description: Restart policy for the container - to manage the restart behavior of each container - within a pod. This may only be set for init - containers. You cannot set this field on + description: |- + Restart policy for the container to manage the restart behavior of each + container within a pod. + This may only be set for init containers. You cannot set this field on ephemeral containers. type: string securityContext: - description: 'Optional: SecurityContext defines - the security options the ephemeral container - should be run with. If set, the fields of - SecurityContext override the equivalent - fields of PodSecurityContext.' + description: |- + Optional: SecurityContext defines the security options the ephemeral container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. properties: allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the no_new_privs - flag will be set on the container process. - AllowPrivilegeEscalation is true always - when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this - field cannot be set when spec.os.name - is windows.' + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. type: boolean capabilities: - description: The capabilities to add/drop - when running containers. Defaults to - the default set of capabilities granted - by the container runtime. Note that - this field cannot be set when spec.os.name - is windows. + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. properties: add: description: Added capabilities @@ -3980,74 +3402,60 @@ spec: type: array type: object privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. type: boolean procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this field - cannot be set when spec.os.name is windows. + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. type: boolean runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does not - run as UID 0 (root) and fail to start - the container if it does. If unset or - false, no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. type: boolean runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if - unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: - description: The SELinux context to be - applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. properties: level: description: Level is SELinux level @@ -4067,54 +3475,44 @@ spec: type: string type: object seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. properties: localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile - must be preconfigured on the node - to work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must be - set if type is "Localhost". Must - NOT be set for any other type. + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. type: string type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n Localhost - - a profile defined in a file on - the node should be used. RuntimeDefault - - the container runtime default - profile should be used. Unconfined - - no profile should be applied." + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. type: string required: - type type: object windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set when - spec.os.name is linux. + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. properties: gmsaCredentialSpec: - description: GMSACredentialSpec is - where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: description: GMSACredentialSpecName @@ -4122,26 +3520,18 @@ spec: spec to use. type: string hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. All - of a Pod's containers must have - the same effective HostProcess value - (it is not allowed to have a mix - of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess - is true then HostNetwork must also - be set to true. + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. type: boolean runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. type: string type: object type: object @@ -4154,26 +3544,20 @@ spec: to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -4187,11 +3571,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -4201,10 +3586,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -4216,11 +3600,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -4239,36 +3621,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -4284,110 +3665,86 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object stdin: - description: Whether this container should - allocate a buffer for stdin in the container - runtime. If this is not set, reads from - stdin in the container will always result - in EOF. Default is false. + description: |- + Whether this container should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the container will always result in EOF. + Default is false. type: boolean stdinOnce: - description: Whether the container runtime - should close the stdin channel after it - has been opened by a single attach. When - stdin is true the stdin stream will remain - open across multiple attach sessions. If - stdinOnce is set to true, stdin is opened - on container start, is empty until the first - client attaches to stdin, and then remains - open and accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the container is restarted. - If this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the container is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false type: boolean targetContainerName: - description: "If set, the name of the container - from PodSpec that this ephemeral container - targets. The ephemeral container will be - run in the namespaces (IPC, PID, etc) of - this container. If not set then the ephemeral - container uses the namespaces configured - in the Pod spec. \n The container runtime - must implement support for this feature. - If the runtime does not support namespace - targeting then the result of setting this - field is undefined." + description: |- + If set, the name of the container from PodSpec that this ephemeral container targets. + The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container. + If not set then the ephemeral container uses the namespaces configured in the Pod spec. + + + The container runtime must implement support for this feature. If the runtime does not + support namespace targeting then the result of setting this field is undefined. type: string terminationMessagePath: - description: 'Optional: Path at which the - file to which the container''s termination - message will be written is mounted into - the container''s filesystem. Message written - is intended to be brief final status, such - as an assertion failure message. Will be - truncated by the node if greater than 4096 - bytes. The total message length across all - containers will be limited to 12kb. Defaults - to /dev/termination-log. Cannot be updated.' + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. type: string terminationMessagePolicy: - description: Indicate how the termination - message should be populated. File will use - the contents of terminationMessagePath to - populate the container status message on - both success and failure. FallbackToLogsOnError - will use the last chunk of container log - output if the termination message file is - empty and the container exited with an error. - The log output is limited to 2048 bytes - or 80 lines, whichever is smaller. Defaults - to File. Cannot be updated. + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. type: string tty: - description: Whether this container should - allocate a TTY for itself, also requires - 'stdin' to be true. Default is false. + description: |- + Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. type: boolean volumeDevices: description: volumeDevices is the list of @@ -4412,50 +3769,45 @@ spec: type: object type: array volumeMounts: - description: Pod volumes to mount into the - container's filesystem. Subpath mounts are - not allowed for ephemeral containers. Cannot - be updated. + description: |- + Pod volumes to mount into the container's filesystem. Subpath mounts are not allowed for ephemeral containers. + Cannot be updated. items: description: VolumeMount describes a mounting of a Volume within a container. properties: mountPath: - description: Path within the container - at which the volume should be mounted. Must + description: |- + Path within the container at which the volume should be mounted. Must not contain ':'. type: string mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other way - around. When not set, MountPropagationNone - is used. This field is beta in 1.10. + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. type: string name: description: This must match the Name of a Volume. type: string readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false. type: boolean subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: - description: Expanded path within the - volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) are - expanded using the container's environment. - Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -4463,24 +3815,24 @@ spec: type: object type: array workingDir: - description: Container's working directory. - If not specified, the container runtime's - default will be used, which might be configured - in the container image. Cannot be updated. + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. type: string required: - name type: object type: array hostAliases: - description: HostAliases is an optional list of - hosts and IPs that will be injected into the pod's - hosts file if specified. This is only valid for - non-hostNetwork pods. + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. items: - description: HostAlias holds the mapping between - IP and hostnames that will be injected as an - entry in the pod's hosts file. + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. properties: hostnames: description: Hostnames for the above IP address. @@ -4493,120 +3845,106 @@ spec: type: object type: array hostIPC: - description: 'Use the host''s ipc namespace. Optional: - Default to false.' + description: |- + Use the host's ipc namespace. + Optional: Default to false. type: boolean hostNetwork: - description: Host networking requested for this - pod. Use the host's network namespace. If this - option is set, the ports that will be used must - be specified. Default to false. + description: |- + Host networking requested for this pod. Use the host's network namespace. + If this option is set, the ports that will be used must be specified. + Default to false. type: boolean hostPID: - description: 'Use the host''s pid namespace. Optional: - Default to false.' + description: |- + Use the host's pid namespace. + Optional: Default to false. type: boolean hostUsers: - description: 'Use the host''s user namespace. Optional: - Default to true. If set to true or not present, - the pod will be run in the host user namespace, - useful for when the pod needs a feature only available - to the host user namespace, such as loading a - kernel module with CAP_SYS_MODULE. When set to - false, a new userns is created for the pod. Setting - false is useful for mitigating container breakout - vulnerabilities even allowing users to run their - containers as root without actually having root - privileges on the host. This field is alpha-level - and is only honored by servers that enable the - UserNamespacesSupport feature.' + description: |- + Use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new userns is created for the pod. Setting false is useful for + mitigating container breakout vulnerabilities even allowing users to run their + containers as root without actually having root privileges on the host. + This field is alpha-level and is only honored by servers that enable the UserNamespacesSupport feature. type: boolean hostname: - description: Specifies the hostname of the Pod If - not specified, the pod's hostname will be set - to a system-defined value. + description: |- + Specifies the hostname of the Pod + If not specified, the pod's hostname will be set to a system-defined value. type: string imagePullSecrets: - description: 'ImagePullSecrets is an optional list - of references to secrets in the same namespace - to use for pulling any of the images used by this - PodSpec. If specified, these secrets will be passed - to individual puller implementations for them - to use. More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod' + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod items: - description: LocalObjectReference contains enough - information to let you locate the referenced - object inside the same namespace. + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. properties: name: - description: 'Name of the referent. More info: - https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic type: array initContainers: - description: 'List of initialization containers - belonging to the pod. Init containers are executed - in order prior to containers being started. If - any init container fails, the pod is considered - to have failed and is handled according to its - restartPolicy. The name for an init container - or normal container must be unique among all containers. - Init containers may not have Lifecycle actions, - Readiness probes, Liveness probes, or Startup - probes. The resourceRequirements of an init container - are taken into account during scheduling by finding - the highest request/limit for each resource type, - and then using the max of of that value or the - sum of the normal containers. Limits are applied - to init containers in a similar fashion. Init - containers cannot currently be added or removed. - Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/' + description: |- + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ items: description: A single application container that you want to run within a pod. properties: args: - description: 'Arguments to the entrypoint. - The container image''s CMD is used if this - is not provided. Variable references $(VAR_NAME) - are expanded using the container''s environment. - If a variable cannot be resolved, the reference - in the input string will be unchanged. Double - $$ are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell items: type: string type: array command: - description: 'Entrypoint array. Not executed - within a shell. The container image''s ENTRYPOINT - is used if this is not provided. Variable - references $(VAR_NAME) are expanded using - the container''s environment. If a variable - cannot be resolved, the reference in the - input string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal - "$(VAR_NAME)". Escaped references will never - be expanded, regardless of whether the variable - exists or not. Cannot be updated. More info: - https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell' + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell items: type: string type: array env: - description: List of environment variables - to set in the container. Cannot be updated. + description: |- + List of environment variables to set in the container. + Cannot be updated. items: description: EnvVar represents an environment variable present in a Container. @@ -4616,20 +3954,16 @@ spec: variable. Must be a C_IDENTIFIER. type: string value: - description: 'Variable references $(VAR_NAME) - are expanded using the previously - defined environment variables in the - container and any service environment - variables. If a variable cannot be - resolved, the reference in the input - string will be unchanged. Double $$ - are reduced to a single $, which allows - for escaping the $(VAR_NAME) syntax: - i.e. "$$(VAR_NAME)" will produce the - string literal "$(VAR_NAME)". Escaped - references will never be expanded, - regardless of whether the variable - exists or not. Defaults to "".' + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". type: string valueFrom: description: Source for the environment @@ -4644,10 +3978,10 @@ spec: description: The key to select. type: string name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether @@ -4659,12 +3993,9 @@ spec: type: object x-kubernetes-map-type: atomic fieldRef: - description: 'Selects a field of - the pod: supports metadata.name, - metadata.namespace, `metadata.labels['''']`, - `metadata.annotations['''']`, - spec.nodeName, spec.serviceAccountName, - status.hostIP, status.podIP, status.podIPs.' + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. properties: apiVersion: description: Version of the @@ -4681,13 +4012,9 @@ spec: type: object x-kubernetes-map-type: atomic resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, limits.ephemeral-storage, - requests.cpu, requests.memory - and requests.ephemeral-storage) - are currently supported.' + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. properties: containerName: description: 'Container name: @@ -4721,10 +4048,10 @@ spec: be a valid secret key. type: string name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether @@ -4741,16 +4068,13 @@ spec: type: object type: array envFrom: - description: List of sources to populate environment - variables in the container. The keys defined - within a source must be a C_IDENTIFIER. - All invalid keys will be reported as an - event when the container is starting. When - a key exists in multiple sources, the value - associated with the last source will take - precedence. Values defined by an Env with - a duplicate key will take precedence. Cannot - be updated. + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. items: description: EnvFromSource represents the source of a set of ConfigMaps @@ -4760,10 +4084,10 @@ spec: from properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether the @@ -4780,10 +4104,10 @@ spec: description: The Secret to select from properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: Specify whether the @@ -4794,52 +4118,43 @@ spec: type: object type: array image: - description: 'Container image name. More info: - https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level - config management to default or override - container images in workload controllers - like Deployments and StatefulSets.' + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. type: string imagePullPolicy: - description: 'Image pull policy. One of Always, - Never, IfNotPresent. Defaults to Always - if :latest tag is specified, or IfNotPresent - otherwise. Cannot be updated. More info: - https://kubernetes.io/docs/concepts/containers/images#updating-images' + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images type: string lifecycle: - description: Actions that the management system - should take in response to container lifecycle - events. Cannot be updated. + description: |- + Actions that the management system should take in response to container lifecycle events. + Cannot be updated. properties: postStart: - description: 'PostStart is called immediately - after a container is created. If the - handler fails, the container is terminated - and restarted according to its restart - policy. Other management of the container - blocks until the hook completes. More - info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array @@ -4849,10 +4164,9 @@ spec: http request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to @@ -4864,12 +4178,9 @@ spec: in HTTP probes properties: name: - description: The header - field name. This will - be canonicalized upon - output, so case-variant - names will be understood - as the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header @@ -4888,27 +4199,24 @@ spec: anyOf: - type: integer - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for the backward compatibility. There are no validation of this field and + lifecycle hooks will fail in runtime when tcp handler is specified. properties: host: description: 'Optional: Host name @@ -4919,52 +4227,38 @@ spec: anyOf: - type: integer - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object type: object preStop: - description: 'PreStop is called immediately - before a container is terminated due - to an API request or management event - such as liveness/startup probe failure, - preemption, resource contention, etc. - The handler is not called if the container - crashes or exits. The Pod''s termination - grace period countdown begins before - the PreStop hook is executed. Regardless - of the outcome of the handler, the container - will eventually terminate within the - Pod''s termination grace period (unless - delayed by finalizers). Other management - of the container blocks until the hook - completes or until the termination grace - period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks' + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the - command is root ('/') in the - container's filesystem. The - command is simply exec'd, it - is not run inside a shell, so - traditional shell instructions - ('|', etc) won't work. To use - a shell, you need to explicitly - call out to that shell. Exit - status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array @@ -4974,10 +4268,9 @@ spec: http request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. - You probably want to set "Host" - in httpHeaders instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to @@ -4989,12 +4282,9 @@ spec: in HTTP probes properties: name: - description: The header - field name. This will - be canonicalized upon - output, so case-variant - names will be understood - as the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header @@ -5013,27 +4303,24 @@ spec: anyOf: - type: integer - type: string - description: Name or number of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for - connecting to the host. Defaults - to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object tcpSocket: - description: Deprecated. TCPSocket - is NOT supported as a LifecycleHandler - and kept for the backward compatibility. - There are no validation of this - field and lifecycle hooks will fail - in runtime when tcp handler is specified. + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for the backward compatibility. There are no validation of this field and + lifecycle hooks will fail in runtime when tcp handler is specified. properties: host: description: 'Optional: Host name @@ -5044,11 +4331,10 @@ spec: anyOf: - type: integer - type: string - description: Number or name of - the port to access on the container. - Number must be in the range - 1 to 65535. Name must be an - IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port @@ -5056,36 +4342,31 @@ spec: type: object type: object livenessProbe: - description: 'Periodic probe of container - liveness. Container will be restarted if - the probe fails. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -5099,11 +4380,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -5113,10 +4395,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -5128,11 +4409,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -5151,36 +4430,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -5196,70 +4474,59 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object name: - description: Name of the container specified - as a DNS_LABEL. Each container in a pod - must have a unique name (DNS_LABEL). Cannot - be updated. + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. type: string ports: - description: List of ports to expose from - the container. Not specifying a port here - DOES NOT prevent that port from being exposed. - Any port which is listening on the default - "0.0.0.0" address inside a container will - be accessible from the network. Modifying - this array with strategic merge patch may - corrupt the data. For more information See - https://github.com/kubernetes/kubernetes/issues/108255. + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. Cannot be updated. items: description: ContainerPort represents a network port in a single container. properties: containerPort: - description: Number of port to expose - on the pod's IP address. This must - be a valid port number, 0 < x < 65536. + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. format: int32 type: integer hostIP: @@ -5267,27 +4534,24 @@ spec: external port to. type: string hostPort: - description: Number of port to expose - on the host. If specified, this must - be a valid port number, 0 < x < 65536. - If HostNetwork is specified, this - must match ContainerPort. Most containers - do not need this. + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. format: int32 type: integer name: - description: If specified, this must - be an IANA_SVC_NAME and unique within - the pod. Each named port in a pod - must have a unique name. Name for - the port that can be referred to by - services. + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. type: string protocol: default: TCP - description: Protocol for port. Must - be UDP, TCP, or SCTP. Defaults to - "TCP". + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". type: string required: - containerPort @@ -5298,36 +4562,31 @@ spec: - protocol x-kubernetes-list-type: map readinessProbe: - description: 'Periodic probe of container - service readiness. Container will be removed - from service endpoints if the probe fails. - Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -5341,11 +4600,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -5355,10 +4615,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -5370,11 +4629,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -5393,36 +4650,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -5438,42 +4694,33 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object @@ -5485,13 +4732,13 @@ spec: resource resize policy for the container. properties: resourceName: - description: 'Name of the resource to - which this resource resize policy - applies. Supported values: cpu, memory.' + description: |- + Name of the resource to which this resource resize policy applies. + Supported values: cpu, memory. type: string restartPolicy: - description: Restart policy to apply - when specified resource is resized. + description: |- + Restart policy to apply when specified resource is resized. If not specified, it defaults to NotRequired. type: string required: @@ -5501,27 +4748,30 @@ spec: type: array x-kubernetes-list-type: atomic resources: - description: 'Compute Resources required by - this container. Cannot be updated. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ properties: claims: - description: "Claims lists the names of - resources, defined in spec.resourceClaims, - that are used by this container. \n - This is an alpha field and requires - enabling the DynamicResourceAllocation - feature gate. \n This field is immutable. - It can only be set for containers." + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. items: description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: - description: Name must match the - name of one entry in pod.spec.resourceClaims - of the Pod where this field is - used. It makes that resource available + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available inside a container. type: string required: @@ -5538,9 +4788,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Limits describes the maximum - amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -5549,64 +4799,50 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Requests describes the minimum - amount of compute resources required. - If Requests is omitted for a container, - it defaults to Limits if that is explicitly - specified, otherwise to an implementation-defined - value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object restartPolicy: - description: 'RestartPolicy defines the restart - behavior of individual containers in a pod. - This field may only be set for init containers, - and the only allowed value is "Always". - For non-init containers or when this field - is not specified, the restart behavior is - defined by the Pod''s restart policy and - the container type. Setting the RestartPolicy - as "Always" for the init container will - have the following effect: this init container - will be continually restarted on exit until - all regular containers have terminated. - Once all regular containers have completed, - all init containers with restartPolicy "Always" - will be shut down. This lifecycle differs - from normal init containers and is often - referred to as a "sidecar" container. Although - this init container still starts in the - init container sequence, it does not wait - for the container to complete before proceeding - to the next init container.' + description: |- + RestartPolicy defines the restart behavior of individual containers in a pod. + This field may only be set for init containers, and the only allowed value is "Always". + For non-init containers or when this field is not specified, + the restart behavior is defined by the Pod's restart policy and the container type. + Setting the RestartPolicy as "Always" for the init container will have the following effect: + this init container will be continually restarted on + exit until all regular containers have terminated. Once all regular + containers have completed, all init containers with restartPolicy "Always" + will be shut down. This lifecycle differs from normal init containers and + is often referred to as a "sidecar" container. Although this init + container still starts in the init container sequence, it does not wait + for the container to complete before proceeding to the next init + container. type: string securityContext: - description: 'SecurityContext defines the - security options the container should be - run with. If set, the fields of SecurityContext - override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/' + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ properties: allowPrivilegeEscalation: - description: 'AllowPrivilegeEscalation - controls whether a process can gain - more privileges than its parent process. - This bool directly controls if the no_new_privs - flag will be set on the container process. - AllowPrivilegeEscalation is true always - when the container is: 1) run as Privileged - 2) has CAP_SYS_ADMIN Note that this - field cannot be set when spec.os.name - is windows.' + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. type: boolean capabilities: - description: The capabilities to add/drop - when running containers. Defaults to - the default set of capabilities granted - by the container runtime. Note that - this field cannot be set when spec.os.name - is windows. + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. properties: add: description: Added capabilities @@ -5624,74 +4860,60 @@ spec: type: array type: object privileged: - description: Run container in privileged - mode. Processes in privileged containers - are essentially equivalent to root on - the host. Defaults to false. Note that - this field cannot be set when spec.os.name - is windows. + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. type: boolean procMount: - description: procMount denotes the type - of proc mount to use for the containers. - The default is DefaultProcMount which - uses the container runtime defaults - for readonly paths and masked paths. - This requires the ProcMountType feature - flag to be enabled. Note that this field - cannot be set when spec.os.name is windows. + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. type: string readOnlyRootFilesystem: - description: Whether this container has - a read-only root filesystem. Default - is false. Note that this field cannot - be set when spec.os.name is windows. + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. type: boolean runAsGroup: - description: The GID to run the entrypoint - of the container process. Uses runtime - default if unset. May also be set in - PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer runAsNonRoot: - description: Indicates that the container - must run as a non-root user. If true, - the Kubelet will validate the image - at runtime to ensure that it does not - run as UID 0 (root) and fail to start - the container if it does. If unset or - false, no such validation will be performed. - May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. type: boolean runAsUser: - description: The UID to run the entrypoint - of the container process. Defaults to - user specified in image metadata if - unspecified. May also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: - description: The SELinux context to be - applied to the container. If unspecified, - the container runtime will allocate - a random SELinux context for each container. May - also be set in PodSecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. properties: level: description: Level is SELinux level @@ -5711,54 +4933,44 @@ spec: type: string type: object seccompProfile: - description: The seccomp options to use - by this container. If seccomp options - are provided at both the pod & container - level, the container options override - the pod options. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. properties: localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the - node should be used. The profile - must be preconfigured on the node - to work. Must be a descending path, - relative to the kubelet's configured - seccomp profile location. Must be - set if type is "Localhost". Must - NOT be set for any other type. + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. type: string type: - description: "type indicates which - kind of seccomp profile will be - applied. Valid options are: \n Localhost - - a profile defined in a file on - the node should be used. RuntimeDefault - - the container runtime default - profile should be used. Unconfined - - no profile should be applied." + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. type: string required: - type type: object windowsOptions: - description: The Windows specific settings - applied to all containers. If unspecified, - the options from the PodSecurityContext - will be used. If set in both SecurityContext - and PodSecurityContext, the value specified - in SecurityContext takes precedence. - Note that this field cannot be set when - spec.os.name is linux. + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. properties: gmsaCredentialSpec: - description: GMSACredentialSpec is - where the GMSA admission webhook - (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA - credential spec named by the GMSACredentialSpecName - field. + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: description: GMSACredentialSpecName @@ -5766,68 +4978,50 @@ spec: spec to use. type: string hostProcess: - description: HostProcess determines - if a container should be run as - a 'Host Process' container. All - of a Pod's containers must have - the same effective HostProcess value - (it is not allowed to have a mix - of HostProcess containers and non-HostProcess - containers). In addition, if HostProcess - is true then HostNetwork must also - be set to true. + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. type: boolean runAsUserName: - description: The UserName in Windows - to run the entrypoint of the container - process. Defaults to the user specified - in image metadata if unspecified. - May also be set in PodSecurityContext. - If set in both SecurityContext and - PodSecurityContext, the value specified - in SecurityContext takes precedence. + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. type: string type: object type: object startupProbe: - description: 'StartupProbe indicates that - the Pod has successfully initialized. If - specified, no other probes are executed - until this completes successfully. If this - probe fails, the Pod will be restarted, - just as if the livenessProbe failed. This - can be used to provide different probe parameters - at the beginning of a Pod''s lifecycle, - when it might take a long time to load data - or warm a cache, than during steady-state - operation. This cannot be updated. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes properties: exec: description: Exec specifies the action to take. properties: command: - description: Command is the command - line to execute inside the container, - the working directory for the command is - root ('/') in the container's filesystem. - The command is simply exec'd, it - is not run inside a shell, so traditional - shell instructions ('|', etc) won't - work. To use a shell, you need to - explicitly call out to that shell. - Exit status of 0 is treated as live/healthy - and non-zero is unhealthy. + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. items: type: string type: array type: object failureThreshold: - description: Minimum consecutive failures - for the probe to be considered failed - after having succeeded. Defaults to - 3. Minimum value is 1. + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. format: int32 type: integer grpc: @@ -5841,11 +5035,12 @@ spec: format: int32 type: integer service: - description: "Service is the name - of the service to place in the gRPC - HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - \n If this is not specified, the - default behavior is defined by gRPC." + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + + If this is not specified, the default behavior is defined by gRPC. type: string required: - port @@ -5855,10 +5050,9 @@ spec: request to perform. properties: host: - description: Host name to connect - to, defaults to the pod IP. You - probably want to set "Host" in httpHeaders - instead. + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. type: string httpHeaders: description: Custom headers to set @@ -5870,11 +5064,9 @@ spec: HTTP probes properties: name: - description: The header field - name. This will be canonicalized - upon output, so case-variant - names will be understood as - the same header. + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. type: string value: description: The header field @@ -5893,36 +5085,35 @@ spec: anyOf: - type: integer - type: string - description: Name or number of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true scheme: - description: Scheme to use for connecting - to the host. Defaults to HTTP. + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. type: string required: - port type: object initialDelaySeconds: - description: 'Number of seconds after - the container has started before liveness - probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer periodSeconds: - description: How often (in seconds) to - perform the probe. Default to 10 seconds. - Minimum value is 1. + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. format: int32 type: integer successThreshold: - description: Minimum consecutive successes - for the probe to be considered successful - after having failed. Defaults to 1. - Must be 1 for liveness and startup. - Minimum value is 1. + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. format: int32 type: integer tcpSocket: @@ -5938,97 +5129,76 @@ spec: anyOf: - type: integer - type: string - description: Number or name of the - port to access on the container. - Number must be in the range 1 to - 65535. Name must be an IANA_SVC_NAME. + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. x-kubernetes-int-or-string: true required: - port type: object terminationGracePeriodSeconds: - description: Optional duration in seconds - the pod needs to terminate gracefully - upon probe failure. The grace period - is the duration in seconds after the - processes running in the pod are sent - a termination signal and the time when - the processes are forcibly halted with - a kill signal. Set this value longer - than the expected cleanup time for your - process. If this value is nil, the pod's - terminationGracePeriodSeconds will be - used. Otherwise, this value overrides - the value provided by the pod spec. - Value must be non-negative integer. - The value zero indicates stop immediately - via the kill signal (no opportunity - to shut down). This is a beta field - and requires enabling ProbeTerminationGracePeriod - feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds - is used if unset. + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. format: int64 type: integer timeoutSeconds: - description: 'Number of seconds after - which the probe times out. Defaults - to 1 second. Minimum value is 1. More - info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes' + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes format: int32 type: integer type: object stdin: - description: Whether this container should - allocate a buffer for stdin in the container - runtime. If this is not set, reads from - stdin in the container will always result - in EOF. Default is false. + description: |- + Whether this container should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the container will always result in EOF. + Default is false. type: boolean stdinOnce: - description: Whether the container runtime - should close the stdin channel after it - has been opened by a single attach. When - stdin is true the stdin stream will remain - open across multiple attach sessions. If - stdinOnce is set to true, stdin is opened - on container start, is empty until the first - client attaches to stdin, and then remains - open and accepts data until the client disconnects, - at which time stdin is closed and remains - closed until the container is restarted. - If this flag is false, a container processes - that reads from stdin will never receive - an EOF. Default is false + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the container is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false type: boolean terminationMessagePath: - description: 'Optional: Path at which the - file to which the container''s termination - message will be written is mounted into - the container''s filesystem. Message written - is intended to be brief final status, such - as an assertion failure message. Will be - truncated by the node if greater than 4096 - bytes. The total message length across all - containers will be limited to 12kb. Defaults - to /dev/termination-log. Cannot be updated.' + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. type: string terminationMessagePolicy: - description: Indicate how the termination - message should be populated. File will use - the contents of terminationMessagePath to - populate the container status message on - both success and failure. FallbackToLogsOnError - will use the last chunk of container log - output if the termination message file is - empty and the container exited with an error. - The log output is limited to 2048 bytes - or 80 lines, whichever is smaller. Defaults - to File. Cannot be updated. + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. type: string tty: - description: Whether this container should - allocate a TTY for itself, also requires - 'stdin' to be true. Default is false. + description: |- + Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. type: boolean volumeDevices: description: volumeDevices is the list of @@ -6053,48 +5223,45 @@ spec: type: object type: array volumeMounts: - description: Pod volumes to mount into the - container's filesystem. Cannot be updated. + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. items: description: VolumeMount describes a mounting of a Volume within a container. properties: mountPath: - description: Path within the container - at which the volume should be mounted. Must + description: |- + Path within the container at which the volume should be mounted. Must not contain ':'. type: string mountPropagation: - description: mountPropagation determines - how mounts are propagated from the - host to container and the other way - around. When not set, MountPropagationNone - is used. This field is beta in 1.10. + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. type: string name: description: This must match the Name of a Volume. type: string readOnly: - description: Mounted read-only if true, - read-write otherwise (false or unspecified). + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false. type: boolean subPath: - description: Path within the volume - from which the container's volume - should be mounted. Defaults to "" - (volume's root). + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). type: string subPathExpr: - description: Expanded path within the - volume from which the container's - volume should be mounted. Behaves - similarly to SubPath but environment - variable references $(VAR_NAME) are - expanded using the container's environment. - Defaults to "" (volume's root). SubPathExpr - and SubPath are mutually exclusive. + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. type: string required: - mountPath @@ -6102,58 +5269,68 @@ spec: type: object type: array workingDir: - description: Container's working directory. - If not specified, the container runtime's - default will be used, which might be configured - in the container image. Cannot be updated. + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. type: string required: - name type: object type: array nodeName: - description: NodeName is a request to schedule this - pod onto a specific node. If it is non-empty, - the scheduler simply schedules this pod onto that - node, assuming that it fits resource requirements. + description: |- + NodeName is a request to schedule this pod onto a specific node. If it is non-empty, + the scheduler simply schedules this pod onto that node, assuming that it fits resource + requirements. type: string nodeSelector: additionalProperties: type: string - description: 'NodeSelector is a selector which must - be true for the pod to fit on a node. Selector - which must match a node''s labels for the pod - to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/' + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object x-kubernetes-map-type: atomic os: - description: "Specifies the OS of the containers - in the pod. Some pod and container fields are - restricted if this is set. \n If the OS field - is set to linux, the following fields must be - unset: -securityContext.windowsOptions \n If the - OS field is set to windows, following fields must - be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - - spec.securityContext.sysctls - spec.shareProcessNamespace - - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions + description: |- + Specifies the OS of the containers in the pod. + Some pod and container fields are restricted if this is set. + + + If the OS field is set to linux, the following fields must be unset: + -securityContext.windowsOptions + + + If the OS field is set to windows, following fields must be unset: + - spec.hostPID + - spec.hostIPC + - spec.hostUsers + - spec.securityContext.seLinuxOptions + - spec.securityContext.seccompProfile + - spec.securityContext.fsGroup + - spec.securityContext.fsGroupChangePolicy + - spec.securityContext.sysctls + - spec.shareProcessNamespace + - spec.securityContext.runAsUser + - spec.securityContext.runAsGroup + - spec.securityContext.supplementalGroups + - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - - spec.containers[*]." + - spec.containers[*]. properties: name: - description: 'Name is the name of the operating - system. The currently supported values are - linux and windows. Additional value may be - defined in future and can be one of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration - Clients should expect to handle additional - values and treat unrecognized values in this - field as os: null' + description: |- + Name is the name of the operating system. The currently supported values are linux and windows. + Additional value may be defined in future and can be one of: + https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration + Clients should expect to handle additional values and treat unrecognized values in this field as os: null type: string required: - name @@ -6165,52 +5342,45 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Overhead represents the resource overhead - associated with running a pod for a given RuntimeClass. - This field will be autopopulated at admission - time by the RuntimeClass admission controller. - If the RuntimeClass admission controller is enabled, - overhead must not be set in Pod create requests. - The RuntimeClass admission controller will reject - Pod create requests which have the overhead already - set. If RuntimeClass is configured and selected - in the PodSpec, Overhead will be set to the value - defined in the corresponding RuntimeClass, otherwise - it will remain unset and treated as zero. More - info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md' + description: |- + Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. + This field will be autopopulated at admission time by the RuntimeClass admission controller. If + the RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests. + The RuntimeClass admission controller will reject Pod create requests which have the overhead already + set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value + defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero. + More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md type: object preemptionPolicy: - description: PreemptionPolicy is the Policy for - preempting pods with lower priority. One of Never, - PreemptLowerPriority. Defaults to PreemptLowerPriority - if unset. + description: |- + PreemptionPolicy is the Policy for preempting pods with lower priority. + One of Never, PreemptLowerPriority. + Defaults to PreemptLowerPriority if unset. type: string priority: - description: The priority value. Various system - components use this field to find the priority - of the pod. When Priority Admission Controller - is enabled, it prevents users from setting this - field. The admission controller populates this - field from PriorityClassName. The higher the value, - the higher the priority. + description: |- + The priority value. Various system components use this field to find the + priority of the pod. When Priority Admission Controller is enabled, it + prevents users from setting this field. The admission controller populates + this field from PriorityClassName. + The higher the value, the higher the priority. format: int32 type: integer priorityClassName: - description: If specified, indicates the pod's priority. - "system-node-critical" and "system-cluster-critical" - are two special keywords which indicate the highest - priorities with the former being the highest priority. - Any other name must be defined by creating a PriorityClass - object with that name. If not specified, the pod - priority will be default or zero if there is no + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no default. type: string readinessGates: - description: 'If specified, all readiness gates - will be evaluated for pod readiness. A pod is - ready when all its containers are ready AND all - conditions specified in the readiness gates have - status equal to "True" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates' + description: |- + If specified, all readiness gates will be evaluated for pod readiness. + A pod is ready when all its containers are ready AND + all conditions specified in the readiness gates have status equal to "True" + More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates items: description: PodReadinessGate contains the reference to a pod condition @@ -6225,52 +5395,54 @@ spec: type: object type: array resourceClaims: - description: "ResourceClaims defines which ResourceClaims - must be allocated and reserved before the Pod - is allowed to start. The resources will be made - available to those containers which consume them - by name. \n This is an alpha field and requires - enabling the DynamicResourceAllocation feature - gate. \n This field is immutable." + description: |- + ResourceClaims defines which ResourceClaims must be allocated + and reserved before the Pod is allowed to start. The resources + will be made available to those containers which consume them + by name. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. items: - description: PodResourceClaim references exactly - one ResourceClaim through a ClaimSource. It - adds a name to it that uniquely identifies the - ResourceClaim inside the Pod. Containers that - need access to the ResourceClaim reference it - with this name. + description: |- + PodResourceClaim references exactly one ResourceClaim through a ClaimSource. + It adds a name to it that uniquely identifies the ResourceClaim inside the Pod. + Containers that need access to the ResourceClaim reference it with this name. properties: name: - description: Name uniquely identifies this - resource claim inside the pod. This must - be a DNS_LABEL. + description: |- + Name uniquely identifies this resource claim inside the pod. + This must be a DNS_LABEL. type: string source: description: Source describes where to find the ResourceClaim. properties: resourceClaimName: - description: ResourceClaimName is the - name of a ResourceClaim object in the - same namespace as this pod. + description: |- + ResourceClaimName is the name of a ResourceClaim object in the same + namespace as this pod. type: string resourceClaimTemplateName: - description: "ResourceClaimTemplateName - is the name of a ResourceClaimTemplate - object in the same namespace as this - pod. \n The template will be used to - create a new ResourceClaim, which will - be bound to this pod. When this pod - is deleted, the ResourceClaim will also - be deleted. The pod name and resource - name, along with a generated component, - will be used to form a unique name for - the ResourceClaim, which will be recorded - in pod.status.resourceClaimStatuses. - \n This field is immutable and no changes - will be made to the corresponding ResourceClaim - by the control plane after creating - the ResourceClaim." + description: |- + ResourceClaimTemplateName is the name of a ResourceClaimTemplate + object in the same namespace as this pod. + + + The template will be used to create a new ResourceClaim, which will + be bound to this pod. When this pod is deleted, the ResourceClaim + will also be deleted. The pod name and resource name, along with a + generated component, will be used to form a unique name for the + ResourceClaim, which will be recorded in pod.status.resourceClaimStatuses. + + + This field is immutable and no changes will be made to the + corresponding ResourceClaim by the control plane after creating the + ResourceClaim. type: string type: object required: @@ -6281,45 +5453,44 @@ spec: - name x-kubernetes-list-type: map restartPolicy: - description: 'Restart policy for all containers - within the pod. One of Always, OnFailure, Never. - In some contexts, only a subset of those values - may be permitted. Default to Always. More info: - https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy' + description: |- + Restart policy for all containers within the pod. + One of Always, OnFailure, Never. In some contexts, only a subset of those values may be permitted. + Default to Always. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy type: string runtimeClassName: - description: 'RuntimeClassName refers to a RuntimeClass - object in the node.k8s.io group, which should - be used to run this pod. If no RuntimeClass resource - matches the named class, the pod will not be run. - If unset or empty, the "legacy" RuntimeClass will - be used, which is an implicit class with an empty - definition that uses the default runtime handler. - More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class' + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used + to run this pod. If no RuntimeClass resource matches the named class, the pod will not be run. + If unset or empty, the "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class type: string schedulerName: - description: If specified, the pod will be dispatched - by specified scheduler. If not specified, the - pod will be dispatched by default scheduler. + description: |- + If specified, the pod will be dispatched by specified scheduler. + If not specified, the pod will be dispatched by default scheduler. type: string schedulingGates: - description: "SchedulingGates is an opaque list - of values that if specified will block scheduling - the pod. If schedulingGates is not empty, the - pod will stay in the SchedulingGated state and - the scheduler will not attempt to schedule the - pod. \n SchedulingGates can only be set at pod - creation time, and be removed only afterwards. - \n This is a beta feature enabled by the PodSchedulingReadiness - feature gate." + description: |- + SchedulingGates is an opaque list of values that if specified will block scheduling the pod. + If schedulingGates is not empty, the pod will stay in the SchedulingGated state and the + scheduler will not attempt to schedule the pod. + + + SchedulingGates can only be set at pod creation time, and be removed only afterwards. + + + This is a beta feature enabled by the PodSchedulingReadiness feature gate. items: description: PodSchedulingGate is associated to a Pod to guard its scheduling. properties: name: - description: Name of the scheduling gate. - Each scheduling gate must have a unique - name field. + description: |- + Name of the scheduling gate. + Each scheduling gate must have a unique name field. type: string required: - name @@ -6329,80 +5500,73 @@ spec: - name x-kubernetes-list-type: map securityContext: - description: 'SecurityContext holds pod-level security - attributes and common container settings. Optional: - Defaults to empty. See type description for default - values of each field.' + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. properties: fsGroup: - description: "A special supplemental group that - applies to all containers in a pod. Some volume - types allow the Kubelet to change the ownership - of that volume to be owned by the pod: \n - 1. The owning GID will be the FSGroup 2. The - setgid bit is set (new files created in the - volume will be owned by FSGroup) 3. The permission - bits are OR'd with rw-rw---- \n If unset, - the Kubelet will not modify the ownership - and permissions of any volume. Note that this - field cannot be set when spec.os.name is windows." + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer fsGroupChangePolicy: - description: 'fsGroupChangePolicy defines behavior - of changing ownership and permission of the - volume before being exposed inside Pod. This - field will only apply to volume types which - support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume - types such as: secret, configmaps and emptydir. - Valid values are "OnRootMismatch" and "Always". - If not specified, "Always" is used. Note that - this field cannot be set when spec.os.name - is windows.' + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. type: string runAsGroup: - description: The GID to run the entrypoint of - the container process. Uses runtime default - if unset. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes - precedence for that container. Note that this - field cannot be set when spec.os.name is windows. + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer runAsNonRoot: - description: Indicates that the container must - run as a non-root user. If true, the Kubelet - will validate the image at runtime to ensure - that it does not run as UID 0 (root) and fail - to start the container if it does. If unset - or false, no such validation will be performed. - May also be set in SecurityContext. If set - in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes - precedence. + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. type: boolean runAsUser: - description: The UID to run the entrypoint of - the container process. Defaults to user specified - in image metadata if unspecified. May also - be set in SecurityContext. If set in both - SecurityContext and PodSecurityContext, the - value specified in SecurityContext takes precedence - for that container. Note that this field cannot - be set when spec.os.name is windows. + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. format: int64 type: integer seLinuxOptions: - description: The SELinux context to be applied - to all containers. If unspecified, the container - runtime will allocate a random SELinux context - for each container. May also be set in SecurityContext. If - set in both SecurityContext and PodSecurityContext, - the value specified in SecurityContext takes - precedence for that container. Note that this - field cannot be set when spec.os.name is windows. + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. properties: level: description: Level is SELinux level label @@ -6422,55 +5586,48 @@ spec: type: string type: object seccompProfile: - description: The seccomp options to use by the - containers in this pod. Note that this field - cannot be set when spec.os.name is windows. + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. properties: localhostProfile: - description: localhostProfile indicates - a profile defined in a file on the node - should be used. The profile must be preconfigured - on the node to work. Must be a descending - path, relative to the kubelet's configured - seccomp profile location. Must be set - if type is "Localhost". Must NOT be set - for any other type. + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. type: string type: - description: "type indicates which kind - of seccomp profile will be applied. Valid - options are: \n Localhost - a profile - defined in a file on the node should be - used. RuntimeDefault - the container runtime - default profile should be used. Unconfined - - no profile should be applied." + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. type: string required: - type type: object supplementalGroups: - description: A list of groups applied to the - first process run in each container, in addition - to the container's primary GID, the fsGroup - (if specified), and group memberships defined - in the container image for the uid of the - container process. If unspecified, no additional - groups are added to any container. Note that - group memberships defined in the container - image for the uid of the container process - are still effective, even if they are not - included in this list. Note that this field - cannot be set when spec.os.name is windows. + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. items: format: int64 type: integer type: array sysctls: - description: Sysctls hold a list of namespaced - sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail - to launch. Note that this field cannot be - set when spec.os.name is windows. + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. items: description: Sysctl defines a kernel parameter to be set @@ -6487,195 +5644,159 @@ spec: type: object type: array windowsOptions: - description: The Windows specific settings applied - to all containers. If unspecified, the options - within a container's SecurityContext will - be used. If set in both SecurityContext and - PodSecurityContext, the value specified in - SecurityContext takes precedence. Note that - this field cannot be set when spec.os.name - is linux. + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. properties: gmsaCredentialSpec: - description: GMSACredentialSpec is where - the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) - inlines the contents of the GMSA credential - spec named by the GMSACredentialSpecName - field. + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. type: string gmsaCredentialSpecName: description: GMSACredentialSpecName is the name of the GMSA credential spec to use. type: string hostProcess: - description: HostProcess determines if a - container should be run as a 'Host Process' - container. All of a Pod's containers must - have the same effective HostProcess value - (it is not allowed to have a mix of HostProcess - containers and non-HostProcess containers). - In addition, if HostProcess is true then - HostNetwork must also be set to true. + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. type: boolean runAsUserName: - description: The UserName in Windows to - run the entrypoint of the container process. - Defaults to the user specified in image - metadata if unspecified. May also be set - in PodSecurityContext. If set in both - SecurityContext and PodSecurityContext, - the value specified in SecurityContext - takes precedence. + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. type: string type: object type: object serviceAccount: - description: 'DeprecatedServiceAccount is a depreciated - alias for ServiceAccountName. Deprecated: Use - serviceAccountName instead.' + description: |- + DeprecatedServiceAccount is a depreciated alias for ServiceAccountName. + Deprecated: Use serviceAccountName instead. type: string serviceAccountName: - description: 'ServiceAccountName is the name of - the ServiceAccount to use to run this pod. More - info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/' + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string setHostnameAsFQDN: - description: If true the pod's hostname will be - configured as the pod's FQDN, rather than the - leaf name (the default). In Linux containers, - this means setting the FQDN in the hostname field - of the kernel (the nodename field of struct utsname). - In Windows containers, this means setting the - registry value of hostname for the registry key - HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters - to FQDN. If a pod does not have FQDN, this has - no effect. Default to false. + description: |- + If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default). + In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname). + In Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters to FQDN. + If a pod does not have FQDN, this has no effect. + Default to false. type: boolean shareProcessNamespace: - description: 'Share a single process namespace between - all of the containers in a pod. When this is set - containers will be able to view and signal processes - from other containers in the same pod, and the - first process in each container will not be assigned - PID 1. HostPID and ShareProcessNamespace cannot - both be set. Optional: Default to false.' + description: |- + Share a single process namespace between all of the containers in a pod. + When this is set containers will be able to view and signal processes from other containers + in the same pod, and the first process in each container will not be assigned PID 1. + HostPID and ShareProcessNamespace cannot both be set. + Optional: Default to false. type: boolean subdomain: - description: If specified, the fully qualified Pod - hostname will be "...svc.". If not specified, - the pod will not have a domainname at all. + description: |- + If specified, the fully qualified Pod hostname will be "...svc.". + If not specified, the pod will not have a domainname at all. type: string terminationGracePeriodSeconds: - description: Optional duration in seconds the pod - needs to terminate gracefully. May be decreased - in delete request. Value must be non-negative - integer. The value zero indicates stop immediately - via the kill signal (no opportunity to shut down). - If this value is nil, the default grace period - will be used instead. The grace period is the - duration in seconds after the processes running - in the pod are sent a termination signal and the - time when the processes are forcibly halted with - a kill signal. Set this value longer than the - expected cleanup time for your process. Defaults - to 30 seconds. + description: |- + Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + If this value is nil, the default grace period will be used instead. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + Defaults to 30 seconds. format: int64 type: integer tolerations: description: If specified, the pod's tolerations. items: - description: The pod this Toleration is attached - to tolerates any taint that matches the triple - using the matching operator - . + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . properties: effect: - description: Effect indicates the taint effect - to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, - PreferNoSchedule and NoExecute. + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: - description: Key is the taint key that the - toleration applies to. Empty means match - all taint keys. If the key is empty, operator - must be Exists; this combination means to - match all values and all keys. + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: - description: Operator represents a key's relationship - to the value. Valid operators are Exists - and Equal. Defaults to Equal. Exists is - equivalent to wildcard for value, so that - a pod can tolerate all taints of a particular - category. + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. type: string tolerationSeconds: - description: TolerationSeconds represents - the period of time the toleration (which - must be of effect NoExecute, otherwise this - field is ignored) tolerates the taint. By - default, it is not set, which means tolerate - the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict - immediately) by the system. + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: - description: Value is the taint value the - toleration matches to. If the operator is - Exists, the value should be empty, otherwise - just a regular string. + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: - description: TopologySpreadConstraints describes - how a group of pods ought to spread across topology - domains. Scheduler will schedule pods in a way - which abides by the constraints. All topologySpreadConstraints - are ANDed. + description: |- + TopologySpreadConstraints describes how a group of pods ought to spread across topology + domains. Scheduler will schedule pods in a way which abides by the constraints. + All topologySpreadConstraints are ANDed. items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: - description: LabelSelector is used to find - matching pods. Pods that match this label - selector are counted to determine the number - of pods in their corresponding topology - domain. + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement - is a selector that contains values, - a key, and an operator that relates - the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents - a key's relationship to a set - of values. Valid operators are - In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array - of string values. If the operator - is In or NotIn, the values array - must be non-empty. If the operator - is Exists or DoesNotExist, the - values array must be empty. This - array is replaced during a strategic + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic merge patch. items: type: string @@ -6688,157 +5809,128 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} - pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, - whose key field is "key", the operator - is "In", and the values array contains - only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: - description: "MatchLabelKeys is a set of pod - label keys to select the pods over which - spreading will be calculated. The keys are - used to lookup values from the incoming - pod labels, those key-value labels are ANDed - with labelSelector to select the group of - existing pods over which spreading will - be calculated for the incoming pod. The - same key is forbidden to exist in both MatchLabelKeys - and LabelSelector. MatchLabelKeys cannot - be set when LabelSelector isn't set. Keys - that don't exist in the incoming pod labels - will be ignored. A null or empty list means - only match against labelSelector. \n This - is a beta field and requires the MatchLabelKeysInPodTopologySpread - feature gate to be enabled (enabled by default)." + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array x-kubernetes-list-type: atomic maxSkew: - description: 'MaxSkew describes the degree - to which pods may be unevenly distributed. - When `whenUnsatisfiable=DoNotSchedule`, - it is the maximum permitted difference between - the number of matching pods in the target - topology and the global minimum. The global - minimum is the minimum number of matching - pods in an eligible domain or zero if the - number of eligible domains is less than - MinDomains. For example, in a 3-zone cluster, - MaxSkew is set to 1, and pods with the same - labelSelector spread as 2/2/1: In this case, - the global minimum is 1. | zone1 | zone2 - | zone3 | | P P | P P | P | - if - MaxSkew is 1, incoming pod can only be scheduled - to zone3 to become 2/2/2; scheduling it - onto zone1(zone2) would make the ActualSkew(3-1) - on zone1(zone2) violate MaxSkew(1). - if - MaxSkew is 2, incoming pod can be scheduled - onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, - it is used to give higher precedence to - topologies that satisfy it. It''s a required - field. Default value is 1 and 0 is not allowed.' + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. format: int32 type: integer minDomains: - description: "MinDomains indicates a minimum - number of eligible domains. When the number - of eligible domains with matching topology - keys is less than minDomains, Pod Topology - Spread treats \"global minimum\" as 0, and - then the calculation of Skew is performed. - And when the number of eligible domains - with matching topology keys equals or greater - than minDomains, this value has no effect - on scheduling. As a result, when the number - of eligible domains is less than minDomains, - scheduler won't schedule more than maxSkew - Pods to those domains. If value is nil, - the constraint behaves as if MinDomains - is equal to 1. Valid values are integers - greater than 0. When value is not nil, WhenUnsatisfiable - must be DoNotSchedule. \n For example, in - a 3-zone cluster, MaxSkew is set to 2, MinDomains - is set to 5 and pods with the same labelSelector - spread as 2/2/2: | zone1 | zone2 | zone3 - | | P P | P P | P P | The number of - domains is less than 5(MinDomains), so \"global - minimum\" is treated as 0." + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. format: int32 type: integer nodeAffinityPolicy: - description: "NodeAffinityPolicy indicates - how we will treat Pod's nodeAffinity/nodeSelector - when calculating pod topology spread skew. - Options are: - Honor: only nodes matching - nodeAffinity/nodeSelector are included in - the calculations. - Ignore: nodeAffinity/nodeSelector - are ignored. All nodes are included in the - calculations. \n If this value is nil, the - behavior is equivalent to the Honor policy. - This is a beta-level feature default enabled - by the NodeInclusionPolicyInPodTopologySpread - feature flag." + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: - description: "NodeTaintsPolicy indicates how - we will treat node taints when calculating - pod topology spread skew. Options are: - - Honor: nodes without taints, along with - tainted nodes for which the incoming pod - has a toleration, are included. - Ignore: - node taints are ignored. All nodes are included. - \n If this value is nil, the behavior is - equivalent to the Ignore policy. This is - a beta-level feature default enabled by - the NodeInclusionPolicyInPodTopologySpread - feature flag." + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: - description: TopologyKey is the key of node - labels. Nodes that have a label with this - key and identical values are considered - to be in the same topology. We consider - each as a "bucket", and try - to put balanced number of pods into each - bucket. We define a domain as a particular - instance of a topology. Also, we define - an eligible domain as a domain whose nodes - meet the requirements of nodeAffinityPolicy - and nodeTaintsPolicy. e.g. If TopologyKey - is "kubernetes.io/hostname", each Node is - a domain of that topology. And, if TopologyKey - is "topology.kubernetes.io/zone", each zone - is a domain of that topology. It's a required - field. + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. type: string whenUnsatisfiable: - description: 'WhenUnsatisfiable indicates - how to deal with a pod if it doesn''t satisfy - the spread constraint. - DoNotSchedule (default) - tells the scheduler not to schedule it. - - ScheduleAnyway tells the scheduler to - schedule the pod in any location, but giving - higher precedence to topologies that would - help reduce the skew. A constraint is considered - "Unsatisfiable" for an incoming pod if and - only if every possible node assignment for - that pod would violate "MaxSkew" on some - topology. For example, in a 3-zone cluster, - MaxSkew is set to 1, and pods with the same - labelSelector spread as 3/1/1: | zone1 | - zone2 | zone3 | | P P P | P | P | - If WhenUnsatisfiable is set to DoNotSchedule, - incoming pod can only be scheduled to zone2(zone3) - to become 3/2/1(3/1/2) as ActualSkew(2-1) - on zone2(zone3) satisfies MaxSkew(1). In - other words, the cluster can still be imbalanced, - but scheduler won''t make it *more* imbalanced. - It''s a required field.' + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. type: string required: - maxSkew @@ -6851,51 +5943,45 @@ spec: - whenUnsatisfiable x-kubernetes-list-type: map volumes: - description: 'List of volumes that can be mounted - by containers belonging to the pod. More info: - https://kubernetes.io/docs/concepts/storage/volumes' + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes items: description: Volume represents a named volume in a pod that may be accessed by any container in the pod. properties: awsElasticBlockStore: - description: 'awsElasticBlockStore represents - an AWS Disk resource that is attached to - a kubelet''s host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore properties: fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore - TODO: how do we prevent errors in the - filesystem from compromising the machine' + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine type: string partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave - the property empty).' + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). format: int32 type: integer readOnly: - description: 'readOnly value true will - force the readOnly setting in VolumeMounts. - More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore type: boolean volumeID: - description: 'volumeID is unique ID of - the persistent disk resource in AWS - (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore' + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore type: string required: - volumeID @@ -6919,11 +6005,10 @@ spec: disk in the blob storage type: string fsType: - description: fsType is Filesystem type - to mount. Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string kind: description: 'kind expected values are @@ -6934,8 +6019,8 @@ spec: set). defaults to shared' type: string readOnly: - description: readOnly Defaults to false - (read/write). ReadOnly here will force + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean required: @@ -6948,8 +6033,8 @@ spec: mount to the pod. properties: readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force + description: |- + readOnly defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretName: @@ -6970,9 +6055,9 @@ spec: on the host that shares a pod's lifetime properties: monitors: - description: 'monitors is Required: Monitors - is a collection of Ceph monitors More - info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it items: type: string type: array @@ -6982,74 +6067,72 @@ spec: Ceph tree, default is /' type: string readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it type: boolean secretFile: - description: 'secretFile is Optional: - SecretFile is the path to key ring for - User, default is /etc/ceph/user.secret - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it type: string secretRef: - description: 'secretRef is Optional: SecretRef - is reference to the authentication secret - for User, default is empty. More info: - https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic user: - description: 'user is optional: User is - the rados user name, default is admin - More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it' + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it type: string required: - monitors type: object cinder: - description: 'cinder represents a cinder volume - attached and mounted on kubelets host machine. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md properties: fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md type: string readOnly: - description: 'readOnly defaults to false - (read/write). ReadOnly here will force + description: |- + readOnly defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. - More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + More info: https://examples.k8s.io/mysql-cinder-pd/README.md type: boolean secretRef: - description: 'secretRef is optional: points - to a secret object containing parameters - used to connect to OpenStack.' + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic volumeID: - description: 'volumeID used to identify - the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md' + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md type: string required: - volumeID @@ -7059,35 +6142,25 @@ spec: that should populate this volume properties: defaultMode: - description: 'defaultMode is optional: - mode bits used to set permissions on - created files by default. Must be an - octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer items: - description: items if unspecified, each - key-value pair in the Data field of - the referenced ConfigMap will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the ConfigMap, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. items: description: Maps a string key to a path within a volume. @@ -7096,29 +6169,21 @@ spec: description: key is the key to project. type: string mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. type: string required: - key @@ -7126,10 +6191,10 @@ spec: type: object type: array name: - description: 'Name of the referent. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: optional specify whether @@ -7143,49 +6208,43 @@ spec: by certain external CSI drivers (Beta feature). properties: driver: - description: driver is the name of the - CSI driver that handles this volume. - Consult with your admin for the correct - name as registered in the cluster. + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. type: string fsType: - description: fsType to mount. Ex. "ext4", - "xfs", "ntfs". If not provided, the - empty value is passed to the associated - CSI driver which will determine the - default filesystem to apply. + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. type: string nodePublishSecretRef: - description: nodePublishSecretRef is a - reference to the secret object containing - sensitive information to pass to the - CSI driver to complete the CSI NodePublishVolume - and NodeUnpublishVolume calls. This - field is optional, and may be empty - if no secret is required. If the secret - object contains more than one secret, - all secret references are passed. + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic readOnly: - description: readOnly specifies a read-only - configuration for the volume. Defaults - to false (read/write). + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). type: boolean volumeAttributes: additionalProperties: type: string - description: volumeAttributes stores driver-specific - properties that are passed to the CSI - driver. Consult your driver's documentation - for supported values. + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. type: object required: - driver @@ -7196,20 +6255,15 @@ spec: volume properties: defaultMode: - description: 'Optional: mode bits to use - on created files by default. Must be - a Optional: mode bits used to set permissions - on created files by default. Must be - an octal value between 0000 and 0777 - or a decimal value between 0 and 511. - YAML accepts both octal and decimal - values, JSON requires decimal values - for mode bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer items: @@ -7241,20 +6295,13 @@ spec: type: object x-kubernetes-map-type: atomic mode: - description: 'Optional: mode bits - used to set permissions on this - file, must be an octal value between - 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts - both octal and decimal values, - JSON requires decimal values for - mode bits. If not specified, the - volume defaultMode will be used. - This might be in conflict with - other options that affect the - file mode, like fsGroup, and the - result can be other mode bits - set.' + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: @@ -7267,12 +6314,9 @@ spec: start with ''..''' type: string resourceFieldRef: - description: 'Selects a resource - of the container: only resources - limits and requests (limits.cpu, - limits.memory, requests.cpu and - requests.memory) are currently - supported.' + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. properties: containerName: description: 'Container name: @@ -7302,139 +6346,118 @@ spec: type: array type: object emptyDir: - description: 'emptyDir represents a temporary - directory that shares a pod''s lifetime. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir properties: medium: - description: 'medium represents what type - of storage medium should back this directory. - The default is "" which means to use - the node''s default medium. Must be - an empty string (default) or Memory. - More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir type: string sizeLimit: anyOf: - type: integer - type: string - description: 'sizeLimit is the total amount - of local storage required for this EmptyDir - volume. The size limit is also applicable - for memory medium. The maximum usage - on memory medium EmptyDir would be the - minimum value between the SizeLimit - specified here and the sum of memory - limits of all containers in a pod. The - default is nil which means that the - limit is undefined. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir' + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object ephemeral: - description: "ephemeral represents a volume - that is handled by a cluster storage driver. - The volume's lifecycle is tied to the pod - that defines it - it will be created before - the pod starts, and deleted when the pod - is removed. \n Use this if: a) the volume - is only needed while the pod runs, b) features - of normal volumes like restoring from snapshot - or capacity tracking are needed, c) the - storage driver is specified through a storage - class, and d) the storage driver supports - dynamic volume provisioning through a PersistentVolumeClaim - (see EphemeralVolumeSource for more information - on the connection between this volume type - and PersistentVolumeClaim). \n Use PersistentVolumeClaim - or one of the vendor-specific APIs for volumes - that persist for longer than the lifecycle - of an individual pod. \n Use CSI for light-weight - local ephemeral volumes if the CSI driver - is meant to be used that way - see the documentation - of the driver for more information." + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. properties: volumeClaimTemplate: - description: "Will be used to create a - stand-alone PVC to provision the volume. - The pod in which this EphemeralVolumeSource - is embedded will be the owner of the - PVC, i.e. the PVC will be deleted together - with the pod. The name of the PVC will - be `-` where - `` is the name from the - `PodSpec.Volumes` array entry. Pod validation - will reject the pod if the concatenated - name is not valid for a PVC (for example, - too long). \n An existing PVC with that - name that is not owned by the pod will - *not* be used for the pod to avoid using - an unrelated volume by mistake. Starting - the pod is then blocked until the unrelated - PVC is removed. If such a pre-created - PVC is meant to be used by the pod, - the PVC has to updated with an owner - reference to the pod once the pod exists. - Normally this should not be necessary, - but it may be useful when manually reconstructing - a broken cluster. \n This field is read-only - and no changes will be made by Kubernetes - to the PVC after it has been created." + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. properties: metadata: - description: May contain labels and - annotations that will be copied - into the PVC when creating it. No - other fields are allowed and will - be rejected during validation. + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. type: object spec: - description: The specification for - the PersistentVolumeClaim. The entire - content is copied unchanged into - the PVC that gets created from this - template. The same fields as in - a PersistentVolumeClaim are also - valid here. + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. properties: accessModes: - description: 'accessModes contains - the desired access modes the - volume should have. More info: - https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1' + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 items: type: string type: array dataSource: - description: 'dataSource field - can be used to specify either: - * An existing VolumeSnapshot - object (snapshot.storage.k8s.io/VolumeSnapshot) + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) - If the provisioner or an external - controller can support the specified - data source, it will create - a new volume based on the contents - of the specified data source. - When the AnyVolumeDataSource - feature gate is enabled, dataSource - contents will be copied to dataSourceRef, - and dataSourceRef contents will - be copied to dataSource when - dataSourceRef.namespace is not - specified. If the namespace - is specified, then dataSourceRef - will not be copied to dataSource.' + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. properties: apiGroup: - description: APIGroup is the - group for the resource being - referenced. If APIGroup - is not specified, the specified - Kind must be in the core - API group. For any other - third-party types, APIGroup - is required. + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: description: Kind is the type @@ -7450,44 +6473,26 @@ spec: type: object x-kubernetes-map-type: atomic dataSourceRef: - description: dataSourceRef specifies - the object from which to populate - the volume with data, if a non-empty - volume is desired. This may - be any object from a non-empty - API group (non core object) - or a PersistentVolumeClaim object. - When this field is specified, - volume binding will only succeed - if the type of the specified - object matches some installed - volume populator or dynamic - provisioner. This field will - replace the functionality of - the dataSource field and as - such if both fields are non-empty, - they must have the same value. - For backwards compatibility, - when namespace isn't specified - in dataSourceRef, both fields - (dataSource and dataSourceRef) - will be set to the same value - automatically if one of them - is empty and the other is non-empty. - When namespace is specified - in dataSourceRef, dataSource - isn't set to the same value - and must be empty. + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. properties: apiGroup: - description: APIGroup is the - group for the resource being - referenced. If APIGroup - is not specified, the specified - Kind must be in the core - API group. For any other - third-party types, APIGroup - is required. + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. type: string kind: description: Kind is the type @@ -7498,61 +6503,44 @@ spec: of resource being referenced type: string namespace: - description: Namespace is - the namespace of resource - being referenced Note that - when a namespace is specified, - a gateway.networking.k8s.io/ReferenceGrant - object is required in the - referent namespace to allow - that namespace's owner to - accept the reference. See - the ReferenceGrant documentation - for details. (Alpha) This - field requires the CrossNamespaceVolumeDataSource - feature gate to be enabled. + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. type: string required: - kind - name type: object resources: - description: 'resources represents - the minimum resources the volume - should have. If RecoverVolumeExpansionFailure - feature is enabled users are - allowed to specify resource - requirements that are lower - than previous value but must - still be higher than capacity - recorded in the status field - of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources' + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources properties: claims: - description: "Claims lists - the names of resources, - defined in spec.resourceClaims, + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. - \n This is an alpha field - and requires enabling the - DynamicResourceAllocation - feature gate. \n This field - is immutable. It can only - be set for containers." + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. items: description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: - description: Name must - match the name of - one entry in pod.spec.resourceClaims - of the Pod where this - field is used. It - makes that resource - available inside a - container. + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. type: string required: - name @@ -7568,10 +6556,9 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Limits describes - the maximum amount of compute - resources allowed. More - info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: @@ -7580,15 +6567,11 @@ spec: - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true - description: 'Requests describes - the minimum amount of compute - resources required. If Requests - is omitted for a container, - it defaults to Limits if - that is explicitly specified, - otherwise to an implementation-defined - value. Requests cannot exceed - Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object selector: @@ -7602,12 +6585,9 @@ spec: requirements. The requirements are ANDed. items: - description: A label selector - requirement is a selector - that contains values, - a key, and an operator - that relates the key and - values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is @@ -7616,28 +6596,16 @@ spec: to. type: string operator: - description: operator - represents a key's - relationship to a - set of values. Valid - operators are In, - NotIn, Exists and - DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values - is an array of string - values. If the operator - is In or NotIn, the - values array must - be non-empty. If the - operator is Exists - or DoesNotExist, the - values array must - be empty. This array - is replaced during - a strategic merge - patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -7649,31 +6617,22 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is - a map of {key,value} pairs. - A single {key,value} in - the matchLabels map is equivalent - to an element of matchExpressions, - whose key field is "key", - the operator is "In", and - the values array contains - only "value". The requirements - are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic storageClassName: - description: 'storageClassName - is the name of the StorageClass - required by the claim. More - info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1' + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 type: string volumeMode: - description: volumeMode defines - what type of volume is required - by the claim. Value of Filesystem - is implied when not included - in claim spec. + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. type: string volumeName: description: volumeName is the @@ -7691,13 +6650,11 @@ spec: host machine and then exposed to the pod. properties: fsType: - description: 'fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. - TODO: how do we prevent errors in the - filesystem from compromising the machine' + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine type: string lun: description: 'lun is Optional: FC target @@ -7705,9 +6662,9 @@ spec: format: int32 type: integer readOnly: - description: 'readOnly is Optional: Defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts.' + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. type: boolean targetWWNs: description: 'targetWWNs is Optional: @@ -7716,30 +6673,27 @@ spec: type: string type: array wwids: - description: 'wwids Optional: FC volume - world wide identifiers (wwids) Either - wwids or combination of targetWWNs and - lun must be set, but not both simultaneously.' + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. items: type: string type: array type: object flexVolume: - description: flexVolume represents a generic - volume resource that is provisioned/attached - using an exec based plugin. + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. properties: driver: description: driver is the name of the driver to use for this volume. type: string fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". The - default filesystem depends on FlexVolume - script. + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. type: string options: additionalProperties: @@ -7749,25 +6703,23 @@ spec: any.' type: object readOnly: - description: 'readOnly is Optional: defaults - to false (read/write). ReadOnly here - will force the ReadOnly setting in VolumeMounts.' + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. type: boolean secretRef: - description: 'secretRef is Optional: secretRef - is reference to the secret object containing - sensitive information to pass to the - plugin scripts. This may be empty if - no secret object is specified. If the - secret object contains more than one - secret, all secrets are passed to the - plugin scripts.' + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic @@ -7781,10 +6733,9 @@ spec: being running properties: datasetName: - description: datasetName is Name of the - dataset stored as metadata -> name on - the dataset for Flocker should be considered - as deprecated + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated type: string datasetUUID: description: datasetUUID is the UUID of @@ -7793,63 +6744,55 @@ spec: type: string type: object gcePersistentDisk: - description: 'gcePersistentDisk represents - a GCE Disk resource that is attached to - a kubelet''s host machine and then exposed - to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk properties: fsType: - description: 'fsType is filesystem type - of the volume that you want to mount. - Tip: Ensure that the filesystem type - is supported by the host operating system. - Examples: "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk - TODO: how do we prevent errors in the - filesystem from compromising the machine' + TODO: how do we prevent errors in the filesystem from compromising the machine type: string partition: - description: 'partition is the partition - in the volume that you want to mount. - If omitted, the default is to mount - by volume name. Examples: For volume - /dev/sda1, you specify the partition - as "1". Similarly, the volume partition - for /dev/sda is "0" (or you can leave - the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk format: int32 type: integer pdName: - description: 'pdName is unique name of - the PD resource in GCE. Used to identify - the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk type: string readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk' + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk type: boolean required: - pdName type: object gitRepo: - description: 'gitRepo represents a git repository - at a particular revision. DEPRECATED: GitRepo - is deprecated. To provision a container - with a git repo, mount an EmptyDir into - an InitContainer that clones the repo using - git, then mount the EmptyDir into the Pod''s - container.' + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. properties: directory: - description: directory is the target directory - name. Must not contain or start with - '..'. If '.' is supplied, the volume - directory will be the git repository. Otherwise, - if specified, the volume will contain - the git repository in the subdirectory - with the given name. + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. type: string repository: description: repository is the URL @@ -7862,59 +6805,61 @@ spec: - repository type: object glusterfs: - description: 'glusterfs represents a Glusterfs - mount on the host that shares a pod''s lifetime. - More info: https://examples.k8s.io/volumes/glusterfs/README.md' + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md properties: endpoints: - description: 'endpoints is the endpoint - name that details Glusterfs topology. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod type: string path: - description: 'path is the Glusterfs volume - path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod type: string readOnly: - description: 'readOnly here will force - the Glusterfs volume to be mounted with - read-only permissions. Defaults to false. - More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod' + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod type: boolean required: - endpoints - path type: object hostPath: - description: 'hostPath represents a pre-existing - file or directory on the host machine that - is directly exposed to the container. This - is generally used for system agents or other - privileged things that are allowed to see - the host machine. Most containers will NOT - need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath - --- TODO(jonesdl) We need to restrict who - can use host directory mounts and who can/can - not mount host directories as read/write.' + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. properties: path: - description: 'path of the directory on - the host. If the path is a symlink, - it will follow the link to the real - path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath type: string type: - description: 'type for HostPath Volume - Defaults to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath' + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath type: string required: - path type: object iscsi: - description: 'iscsi represents an ISCSI Disk - resource that is attached to a kubelet''s - host machine and then exposed to the pod. - More info: https://examples.k8s.io/volumes/iscsi/README.md' + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md properties: chapAuthDiscovery: description: chapAuthDiscovery defines @@ -7926,31 +6871,27 @@ spec: support iSCSI Session CHAP authentication type: boolean fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi - TODO: how do we prevent errors in the - filesystem from compromising the machine' + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine type: string initiatorName: - description: initiatorName is the custom - iSCSI Initiator Name. If initiatorName - is specified with iscsiInterface simultaneously, - new iSCSI interface : will be created for the connection. + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. type: string iqn: description: iqn is the target iSCSI Qualified Name. type: string iscsiInterface: - description: iscsiInterface is the interface - Name that uses an iSCSI transport. Defaults - to 'default' (tcp). + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). type: string lun: description: lun represents iSCSI Target @@ -7958,17 +6899,15 @@ spec: format: int32 type: integer portals: - description: portals is the iSCSI Target - Portal List. The portal is either an - IP or ip_addr:port if the port is other - than default (typically TCP ports 860 - and 3260). + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). items: type: string type: array readOnly: - description: readOnly here will force - the ReadOnly setting in VolumeMounts. + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. type: boolean secretRef: @@ -7976,19 +6915,17 @@ spec: for iSCSI target and initiator authentication properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic targetPortal: - description: targetPortal is iSCSI Target - Portal. The Portal is either an IP or - ip_addr:port if the port is other than - default (typically TCP ports 860 and - 3260). + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). type: string required: - iqn @@ -7996,48 +6933,51 @@ spec: - targetPortal type: object name: - description: 'name of the volume. Must be - a DNS_LABEL and unique within the pod. More - info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string nfs: - description: 'nfs represents an NFS mount - on the host that shares a pod''s lifetime - More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs properties: path: - description: 'path that is exported by - the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs type: string readOnly: - description: 'readOnly here will force - the NFS export to be mounted with read-only - permissions. Defaults to false. More - info: https://kubernetes.io/docs/concepts/storage/volumes#nfs' + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs type: boolean server: - description: 'server is the hostname or - IP address of the NFS server. More info: - https://kubernetes.io/docs/concepts/storage/volumes#nfs' + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs type: string required: - path - server type: object persistentVolumeClaim: - description: 'persistentVolumeClaimVolumeSource - represents a reference to a PersistentVolumeClaim - in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims properties: claimName: - description: 'claimName is the name of - a PersistentVolumeClaim in the same - namespace as the pod using this volume. - More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims' + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims type: string readOnly: - description: readOnly Will force the ReadOnly - setting in VolumeMounts. Default false. + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. type: boolean required: - claimName @@ -8048,11 +6988,10 @@ spec: and mounted on kubelets host machine properties: fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string pdID: description: pdID is the ID that identifies @@ -8067,15 +7006,14 @@ spec: host machine properties: fsType: - description: fSType represents the filesystem - type to mount Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs". Implicitly inferred - to be "ext4" if unspecified. + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. type: string readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force + description: |- + readOnly defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean volumeID: @@ -8091,18 +7029,13 @@ spec: API properties: defaultMode: - description: defaultMode are the mode - bits used to set permissions on created - files by default. Must be an octal value - between 0000 and 0777 or a decimal value - between 0 and 511. YAML accepts both - octal and decimal values, JSON requires - decimal values for mode bits. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set. + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer sources: @@ -8118,23 +7051,14 @@ spec: about the configMap data to project properties: items: - description: items if unspecified, - each key-value pair in the - Data field of the referenced - ConfigMap will be projected - into the volume as a file - whose name is the key and - content is the value. If specified, - the listed keys will be projected - into the specified paths, - and unlisted keys will not - be present. If a key is specified - which is not present in the - ConfigMap, the volume setup - will error unless it is marked - optional. Paths must be relative - and may not contain the '..' - path or start with '..'. + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. items: description: Maps a string key to a path within a volume. @@ -8144,37 +7068,21 @@ spec: key to project. type: string mode: - description: 'mode is - Optional: mode bits - used to set permissions - on this file. Must be - an octal value between - 0000 and 0777 or a decimal - value between 0 and - 511. YAML accepts both - octal and decimal values, - JSON requires decimal - values for mode bits. - If not specified, the - volume defaultMode will - be used. This might - be in conflict with - other options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: - description: path is the - relative path of the - file to map the key - to. May not be an absolute - path. May not contain - the path element '..'. - May not start with the - string '..'. + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. type: string required: - key @@ -8182,10 +7090,10 @@ spec: type: object type: array name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: optional specify @@ -8233,26 +7141,13 @@ spec: type: object x-kubernetes-map-type: atomic mode: - description: 'Optional: - mode bits used to set - permissions on this - file, must be an octal - value between 0000 and - 0777 or a decimal value - between 0 and 511. YAML - accepts both octal and - decimal values, JSON - requires decimal values - for mode bits. If not - specified, the volume - defaultMode will be - used. This might be - in conflict with other - options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: @@ -8268,13 +7163,9 @@ spec: with ''..''' type: string resourceFieldRef: - description: 'Selects - a resource of the container: - only resources limits - and requests (limits.cpu, - limits.memory, requests.cpu - and requests.memory) - are currently supported.' + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. properties: containerName: description: 'Container @@ -8310,23 +7201,14 @@ spec: about the secret data to project properties: items: - description: items if unspecified, - each key-value pair in the - Data field of the referenced - Secret will be projected into - the volume as a file whose - name is the key and content - is the value. If specified, - the listed keys will be projected - into the specified paths, - and unlisted keys will not - be present. If a key is specified - which is not present in the - Secret, the volume setup will - error unless it is marked - optional. Paths must be relative - and may not contain the '..' - path or start with '..'. + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. items: description: Maps a string key to a path within a volume. @@ -8336,37 +7218,21 @@ spec: key to project. type: string mode: - description: 'mode is - Optional: mode bits - used to set permissions - on this file. Must be - an octal value between - 0000 and 0777 or a decimal - value between 0 and - 511. YAML accepts both - octal and decimal values, - JSON requires decimal - values for mode bits. - If not specified, the - volume defaultMode will - be used. This might - be in conflict with - other options that affect - the file mode, like - fsGroup, and the result - can be other mode bits - set.' + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: - description: path is the - relative path of the - file to map the key - to. May not be an absolute - path. May not contain - the path element '..'. - May not start with the - string '..'. + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. type: string required: - key @@ -8374,10 +7240,10 @@ spec: type: object type: array name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. - apiVersion, kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string optional: description: optional field @@ -8392,38 +7258,25 @@ spec: data to project properties: audience: - description: audience is the - intended audience of the token. - A recipient of a token must - identify itself with an identifier - specified in the audience - of the token, and otherwise - should reject the token. The - audience defaults to the identifier - of the apiserver. + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. type: string expirationSeconds: - description: expirationSeconds - is the requested duration - of validity of the service - account token. As the token - approaches expiration, the - kubelet volume plugin will - proactively rotate the service - account token. The kubelet - will start trying to rotate - the token if the token is - older than 80 percent of its - time to live or if the token - is older than 24 hours.Defaults - to 1 hour and must be at least - 10 minutes. + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. format: int64 type: integer path: - description: path is the path - relative to the mount point - of the file to project the + description: |- + path is the path relative to the mount point of the file to project the token into. type: string required: @@ -8437,31 +7290,30 @@ spec: mount on the host that shares a pod's lifetime properties: group: - description: group to map volume access - to Default is no group + description: |- + group to map volume access to + Default is no group type: string readOnly: - description: readOnly here will force - the Quobyte volume to be mounted with - read-only permissions. Defaults to false. + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. type: boolean registry: - description: registry represents a single - or multiple Quobyte Registry services - specified as a string as host:port pair - (multiple entries are separated with - commas) which acts as the central registry - for volumes + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes type: string tenant: - description: tenant owning the given Quobyte - volume in the Backend Used with dynamically - provisioned Quobyte volumes, value is - set by the plugin + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin type: string user: - description: user to map volume access - to Defaults to serivceaccount user + description: |- + user to map volume access to + Defaults to serivceaccount user type: string volume: description: volume is a string that references @@ -8473,62 +7325,68 @@ spec: - volume type: object rbd: - description: 'rbd represents a Rados Block - Device mount on the host that shares a pod''s - lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md' + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md properties: fsType: - description: 'fsType is the filesystem - type of the volume that you want to - mount. Tip: Ensure that the filesystem - type is supported by the host operating - system. Examples: "ext4", "xfs", "ntfs". - Implicitly inferred to be "ext4" if - unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd - TODO: how do we prevent errors in the - filesystem from compromising the machine' + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine type: string image: - description: 'image is the rados image - name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: string keyring: - description: 'keyring is the path to key - ring for RBDUser. Default is /etc/ceph/keyring. - More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: string monitors: - description: 'monitors is a collection - of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it items: type: string type: array pool: - description: 'pool is the rados pool name. - Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: string readOnly: - description: 'readOnly here will force - the ReadOnly setting in VolumeMounts. - Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: boolean secretRef: - description: 'secretRef is name of the - authentication secret for RBDUser. If - provided overrides keyring. Default - is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic user: - description: 'user is the rados user name. - Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it' + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it type: string required: - image @@ -8540,11 +7398,11 @@ spec: Kubernetes nodes. properties: fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Default - is "xfs". + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". type: string gateway: description: gateway is the host address @@ -8556,21 +7414,20 @@ spec: the configured storage. type: string readOnly: - description: readOnly Defaults to false - (read/write). ReadOnly here will force + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: - description: secretRef references to the - secret for ScaleIO user and other sensitive - information. If this is not provided, - Login operation will fail. + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic @@ -8580,9 +7437,9 @@ spec: false type: boolean storageMode: - description: storageMode indicates whether - the storage for a volume should be ThickProvisioned - or ThinProvisioned. Default is ThinProvisioned. + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. type: string storagePool: description: storagePool is the ScaleIO @@ -8594,10 +7451,9 @@ spec: storage system as configured in ScaleIO. type: string volumeName: - description: volumeName is the name of - a volume already created in the ScaleIO - system that is associated with this - volume source. + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. type: string required: - gateway @@ -8605,40 +7461,30 @@ spec: - system type: object secret: - description: 'secret represents a secret that - should populate this volume. More info: - https://kubernetes.io/docs/concepts/storage/volumes#secret' + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret properties: defaultMode: - description: 'defaultMode is Optional: - mode bits used to set permissions on - created files by default. Must be an - octal value between 0000 and 0777 or - a decimal value between 0 and 511. YAML - accepts both octal and decimal values, - JSON requires decimal values for mode - bits. Defaults to 0644. Directories - within the path are not affected by - this setting. This might be in conflict - with other options that affect the file - mode, like fsGroup, and the result can - be other mode bits set.' + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer items: - description: items If unspecified, each - key-value pair in the Data field of - the referenced Secret will be projected - into the volume as a file whose name - is the key and content is the value. - If specified, the listed keys will be - projected into the specified paths, - and unlisted keys will not be present. - If a key is specified which is not present - in the Secret, the volume setup will - error unless it is marked optional. - Paths must be relative and may not contain - the '..' path or start with '..'. + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. items: description: Maps a string key to a path within a volume. @@ -8647,29 +7493,21 @@ spec: description: key is the key to project. type: string mode: - description: 'mode is Optional: - mode bits used to set permissions - on this file. Must be an octal - value between 0000 and 0777 or - a decimal value between 0 and - 511. YAML accepts both octal and - decimal values, JSON requires - decimal values for mode bits. - If not specified, the volume defaultMode - will be used. This might be in - conflict with other options that - affect the file mode, like fsGroup, - and the result can be other mode - bits set.' + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. format: int32 type: integer path: - description: path is the relative - path of the file to map the key - to. May not be an absolute path. - May not contain the path element - '..'. May not start with the string - '..'. + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. type: string required: - key @@ -8681,9 +7519,9 @@ spec: the Secret or its keys must be defined type: boolean secretName: - description: 'secretName is the name of - the secret in the pod''s namespace to - use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret' + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string type: object storageos: @@ -8692,48 +7530,42 @@ spec: nodes. properties: fsType: - description: fsType is the filesystem - type to mount. Must be a filesystem - type supported by the host operating - system. Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string readOnly: - description: readOnly defaults to false - (read/write). ReadOnly here will force + description: |- + readOnly defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. type: boolean secretRef: - description: secretRef specifies the secret - to use for obtaining the StorageOS API - credentials. If not specified, default - values will be attempted. + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. properties: name: - description: 'Name of the referent. + description: |- + Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, - kind, uid?' + TODO: Add other useful fields. apiVersion, kind, uid? type: string type: object x-kubernetes-map-type: atomic volumeName: - description: volumeName is the human-readable - name of the StorageOS volume. Volume + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume names are only unique within a namespace. type: string volumeNamespace: - description: volumeNamespace specifies - the scope of the volume within StorageOS. If - no namespace is specified then the Pod's - namespace will be used. This allows - the Kubernetes name scoping to be mirrored - within StorageOS for tighter integration. - Set VolumeName to any name to override - the default behaviour. Set to "default" - if you are not using namespaces within - StorageOS. Namespaces that do not pre-exist - within StorageOS will be created. + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. type: string type: object vsphereVolume: @@ -8742,11 +7574,10 @@ spec: host machine properties: fsType: - description: fsType is filesystem type - to mount. Must be a filesystem type - supported by the host operating system. - Ex. "ext4", "xfs", "ntfs". Implicitly - inferred to be "ext4" if unspecified. + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. type: string storagePolicyID: description: storagePolicyID is the storage @@ -8793,237 +7624,224 @@ spec: creates on a service. properties: allocateLoadBalancerNodePorts: - description: allocateLoadBalancerNodePorts defines if NodePorts - will be automatically allocated for services with type - LoadBalancer. Default is "true". It may be set to "false" - if the cluster load-balancer does not rely on NodePorts. If - the caller requests specific NodePorts (by specifying - a value), those requests will be respected, regardless - of this field. This field may only be set for services - with type LoadBalancer and will be cleared if the type - is changed to any other type. + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. type: boolean clusterIP: - description: clusterIP is the IP address of the service - and is usually assigned randomly. If an address is specified - manually, is in-range (as per system configuration), and - is not in use, it will be allocated to the service; otherwise - creation of the service will fail. This field may not - be changed through updates unless the type field is also - being changed to ExternalName (which requires this field - to be blank) or the type field is being changed from ExternalName - (in which case this field may optionally be specified, - as describe above). Valid values are "None", empty string - (""), or a valid IP address. Setting this to "None" makes - a "headless service" (no virtual IP), which is useful - when direct endpoint connections are preferred and proxying - is not required. Only applies to types ClusterIP, NodePort, - and LoadBalancer. If this field is specified when creating - a Service of type ExternalName, creation will fail. This + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. type: string clusterIPs: - description: ClusterIPs is a list of IP addresses assigned - to this service, and are usually assigned randomly. If - an address is specified manually, is in-range (as per - system configuration), and is not in use, it will be allocated - to the service; otherwise creation of the service will - fail. This field may not be changed through updates unless - the type field is also being changed to ExternalName (which - requires this field to be empty) or the type field is - being changed from ExternalName (in which case this field - may optionally be specified, as describe above). Valid + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid values are "None", empty string (""), or a valid IP address. Setting - this to "None" makes a "headless service" (no virtual - IP), which is useful when direct endpoint connections - are preferred and proxying is not required. Only applies - to types ClusterIP, NodePort, and LoadBalancer. If this - field is specified when creating a Service of type ExternalName, - creation will fail. + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. items: type: string type: array x-kubernetes-list-type: atomic externalIPs: - description: externalIPs is a list of IP addresses for which - nodes in the cluster will also accept traffic for this - service. These IPs are not managed by Kubernetes. The - user is responsible for ensuring that traffic arrives - at a node with this IP. A common example is external - load-balancers that are not part of the Kubernetes system. + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. items: type: string type: array externalName: - description: externalName is the external reference that - discovery mechanisms will return as an alias for this - service (e.g. a DNS CNAME record). No proxying will be - involved. Must be a lowercase RFC-1123 hostname (https://tools.ietf.org/html/rfc1123) - and requires `type` to be "ExternalName". + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". type: string externalTrafficPolicy: - description: externalTrafficPolicy describes how nodes distribute - service traffic they receive on one of the Service's "externally-facing" - addresses (NodePorts, ExternalIPs, and LoadBalancer IPs). - If set to "Local", the proxy will configure the service - in a way that assumes that external load balancers will - take care of balancing the service traffic between nodes, - and so each node will deliver traffic only to the node-local - endpoints of the service, without masquerading the client - source IP. (Traffic mistakenly sent to a node with no - endpoints will be dropped.) The default value, "Cluster", - uses the standard behavior of routing to all endpoints - evenly (possibly modified by topology and other features). - Note that traffic sent to an External IP or LoadBalancer - IP from within the cluster will always get "Cluster" semantics, - but clients sending to a NodePort from within the cluster - may need to take traffic policy into account when picking - a node. + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. type: string healthCheckNodePort: - description: healthCheckNodePort specifies the healthcheck - nodePort for the service. This only applies when type - is set to LoadBalancer and externalTrafficPolicy is set - to Local. If a value is specified, is in-range, and is - not in use, it will be used. If not specified, a value - will be automatically allocated. External systems (e.g. - load-balancers) can use this port to determine if a given - node holds endpoints for this service or not. If this - field is specified when creating a Service which does - not need it, creation will fail. This field will be wiped - when updating a Service to no longer need it (e.g. changing - type). This field cannot be updated once set. + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. format: int32 type: integer internalTrafficPolicy: - description: InternalTrafficPolicy describes how nodes distribute - service traffic they receive on the ClusterIP. If set - to "Local", the proxy will assume that pods only want - to talk to endpoints of the service on the same node as - the pod, dropping the traffic if there are no local endpoints. - The default value, "Cluster", uses the standard behavior - of routing to all endpoints evenly (possibly modified - by topology and other features). + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). type: string ipFamilies: - description: "IPFamilies is a list of IP families (e.g. - IPv4, IPv6) assigned to this service. This field is usually - assigned automatically based on cluster configuration - and the ipFamilyPolicy field. If this field is specified + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified manually, the requested family is available in the cluster, - and ipFamilyPolicy allows it, it will be used; otherwise - creation of the service will fail. This field is conditionally - mutable: it allows for adding or removing a secondary - IP family, but it does not allow changing the primary - IP family of the Service. Valid values are \"IPv4\" and - \"IPv6\". This field only applies to Services of types - ClusterIP, NodePort, and LoadBalancer, and does apply - to \"headless\" services. This field will be wiped when - updating a Service to type ExternalName. \n This field - may hold a maximum of two entries (dual-stack families, - in either order). These families must correspond to the - values of the clusterIPs field, if specified." + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. items: - description: IPFamily represents the IP Family (IPv4 or - IPv6). This type is used to express the family of an - IP expressed by a type (e.g. service.spec.ipFamilies). + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). type: string type: array x-kubernetes-list-type: atomic ipFamilyPolicy: - description: IPFamilyPolicy represents the dual-stack-ness - requested or required by this Service. If there is no - value provided, then this field will be set to SingleStack. - Services can be "SingleStack" (a single IP family), "PreferDualStack" - (two IP families on dual-stack configured clusters or + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or a single IP family on single-stack clusters), or "RequireDualStack" - (two IP families on dual-stack configured clusters, otherwise - fail). The ipFamilies and clusterIPs fields depend on - the value of this field. This field will be wiped when - updating a service to type ExternalName. + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. type: string loadBalancerClass: - description: loadBalancerClass is the class of the load - balancer implementation this Service belongs to. If specified, - the value of this field must be a label-style identifier, - with an optional prefix, e.g. "internal-vip" or "example.com/internal-vip". - Unprefixed names are reserved for end-users. This field - can only be set when the Service type is 'LoadBalancer'. - If not set, the default load balancer implementation is - used, today this is typically done through the cloud provider - integration, but should apply for any default implementation. - If set, it is assumed that a load balancer implementation - is watching for Services with a matching class. Any default - load balancer implementation (e.g. cloud providers) should - ignore Services that set this field. This field can only - be set when creating or updating a Service to type 'LoadBalancer'. - Once set, it can not be changed. This field will be wiped - when a service is updated to a non 'LoadBalancer' type. + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. type: string loadBalancerIP: - description: 'Only applies to Service Type: LoadBalancer. - This feature depends on whether the underlying cloud-provider - supports specifying the loadBalancerIP when a load balancer - is created. This field will be ignored if the cloud-provider - does not support the feature. Deprecated: This field was - under-specified and its meaning varies across implementations. + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. Using it is non-portable and it may not support dual-stack. - Users are encouraged to use implementation-specific annotations - when available.' + Users are encouraged to use implementation-specific annotations when available. type: string loadBalancerSourceRanges: - description: 'If specified and supported by the platform, - this will restrict traffic through the cloud-provider - load-balancer will be restricted to the specified client - IPs. This field will be ignored if the cloud-provider - does not support the feature." More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/' + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ items: type: string type: array ports: - description: 'The list of ports that are exposed by this - service. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies' + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies items: description: ServicePort contains information on service's port. properties: appProtocol: - description: "The application protocol for this port. - This is used as a hint for implementations to offer - richer behavior for protocols that they understand. + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. This field follows standard Kubernetes label syntax. - Valid values are either: \n * Un-prefixed protocol - names - reserved for IANA standard service names - (as per RFC-6335 and https://www.iana.org/assignments/service-names). - \n * Kubernetes-defined prefixed names: * 'kubernetes.io/h2c' - - HTTP/2 over cleartext as described in https://www.rfc-editor.org/rfc/rfc7540 - * 'kubernetes.io/ws' - WebSocket over cleartext - as described in https://www.rfc-editor.org/rfc/rfc6455 - * 'kubernetes.io/wss' - WebSocket over TLS as described - in https://www.rfc-editor.org/rfc/rfc6455 \n * Other - protocols should use implementation-defined prefixed - names such as mycompany.com/my-custom-protocol." + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 over cleartext as described in https://www.rfc-editor.org/rfc/rfc7540 + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. type: string name: - description: The name of this port within the service. - This must be a DNS_LABEL. All ports within a ServiceSpec - must have unique names. When considering the endpoints - for a Service, this must match the 'name' field - in the EndpointPort. Optional if only one ServicePort - is defined on this service. + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. type: string nodePort: - description: 'The port on each node on which this - service is exposed when type is NodePort or LoadBalancer. Usually - assigned by the system. If a value is specified, - in-range, and not in use it will be used, otherwise - the operation will fail. If not specified, a port - will be allocated if this Service requires one. If - this field is specified when creating a Service - which does not need it, creation will fail. This - field will be wiped when updating a Service to no - longer need it (e.g. changing type from NodePort - to ClusterIP). More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport' + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport format: int32 type: integer port: @@ -9033,23 +7851,23 @@ spec: type: integer protocol: default: TCP - description: The IP protocol for this port. Supports - "TCP", "UDP", and "SCTP". Default is TCP. + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. type: string targetPort: anyOf: - type: integer - type: string - description: 'Number or name of the port to access - on the pods targeted by the service. Number must - be in the range 1 to 65535. Name must be an IANA_SVC_NAME. - If this is a string, it will be looked up as a named - port in the target Pod''s container ports. If this - is not specified, the value of the ''port'' field - is used (an identity map). This field is ignored - for services with clusterIP=None, and should be - omitted or set equal to the ''port'' field. More - info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service' + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service x-kubernetes-int-or-string: true required: - port @@ -9060,35 +7878,35 @@ spec: - protocol x-kubernetes-list-type: map publishNotReadyAddresses: - description: publishNotReadyAddresses indicates that any - agent which deals with endpoints for this Service should - disregard any indications of ready/not-ready. The primary - use case for setting this field is for a StatefulSet's - Headless Service to propagate SRV DNS records for its - Pods for the purpose of peer discovery. The Kubernetes - controllers that generate Endpoints and EndpointSlice - resources for Services interpret this to mean that all - endpoints are considered "ready" even if the Pods themselves - are not. Agents which consume only Kubernetes generated - endpoints through the Endpoints or EndpointSlice resources - can safely assume this behavior. + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. type: boolean selector: additionalProperties: type: string - description: 'Route service traffic to pods with label keys - and values matching this selector. If empty or not present, - the service is assumed to have an external process managing - its endpoints, which Kubernetes will not modify. Only - applies to types ClusterIP, NodePort, and LoadBalancer. - Ignored if type is ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/' + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ type: object x-kubernetes-map-type: atomic sessionAffinity: - description: 'Supports "ClientIP" and "None". Used to maintain - session affinity. Enable client IP based session affinity. - Must be ClientIP or None. Defaults to None. More info: - https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies' + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies type: string sessionAffinityConfig: description: sessionAffinityConfig contains the configurations @@ -9099,32 +7917,32 @@ spec: Client IP based session affinity. properties: timeoutSeconds: - description: timeoutSeconds specifies the seconds - of ClientIP type session sticky time. The value - must be >0 && <=86400(for 1 day) if ServiceAffinity - == "ClientIP". Default value is 10800(for 3 hours). + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). format: int32 type: integer type: object type: object type: - description: 'type determines how the Service is exposed. - Defaults to ClusterIP. Valid options are ExternalName, - ClusterIP, NodePort, and LoadBalancer. "ClusterIP" allocates - a cluster-internal IP address for load-balancing to endpoints. - Endpoints are determined by the selector or if that is - not specified, by manual construction of an Endpoints - object or EndpointSlice objects. If clusterIP is "None", - no virtual IP is allocated and the endpoints are published - as a set of endpoints rather than a virtual IP. "NodePort" - builds on ClusterIP and allocates a port on every node - which routes to the same endpoints as the clusterIP. "LoadBalancer" - builds on NodePort and creates an external load-balancer - (if supported in the current cloud) which routes to the - same endpoints as the clusterIP. "ExternalName" aliases - this service to the specified externalName. Several other - fields do not apply to ExternalName services. More info: - https://kubernetes.' + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes. type: string type: object required: @@ -9211,14 +8029,19 @@ spec: description: PlatformAdmin is the Schema for the samples API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -9310,14 +8133,19 @@ spec: description: PlatformAdmin is the Schema for the samples API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object diff --git a/charts/yurt-manager/crds/network.openyurt.io_poolservices.yaml b/charts/yurt-manager/crds/network.openyurt.io_poolservices.yaml index 0ebbdb6264e..2924b733684 100644 --- a/charts/yurt-manager/crds/network.openyurt.io_poolservices.yaml +++ b/charts/yurt-manager/crds/network.openyurt.io_poolservices.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: poolservices.network.openyurt.io spec: group: network.openyurt.io @@ -31,14 +31,19 @@ spec: description: PoolService is the Schema for the samples API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -68,42 +73,42 @@ spec: description: Current poolService state items: description: "Condition contains details for one aspect of the current - state of this API Resource. --- This struct is intended for direct - use as an array at the field path .status.conditions. For example, - \n type FooStatus struct{ // Represents the observations of a - foo's current state. // Known .status.conditions.type are: \"Available\", - \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge - // +listType=map // +listMapKey=type Conditions []metav1.Condition - `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" - protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }" + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" properties: lastTransitionTime: - description: lastTransitionTime is the last time the condition - transitioned from one status to another. This should be when - the underlying condition changed. If that is not known, then - using the time when the API field changed is acceptable. + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: - description: message is a human readable message indicating - details about the transition. This may be an empty string. + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. maxLength: 32768 type: string observedGeneration: - description: observedGeneration represents the .metadata.generation - that the condition was set based upon. For instance, if .metadata.generation - is currently 12, but the .status.conditions[x].observedGeneration - is 9, the condition is out of date with respect to the current - state of the instance. + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: - description: reason contains a programmatic identifier indicating - the reason for the condition's last transition. Producers - of specific condition types may define expected values and - meanings for this field, and whether the values are considered - a guaranteed API. The value should be a CamelCase string. + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 @@ -117,11 +122,12 @@ spec: - Unknown type: string type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - --- Many .condition.type values are consistent across resources - like Available, but because arbitrary conditions can be useful - (see .node.status.conditions), the ability to deconflict is - important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string @@ -138,37 +144,40 @@ spec: in the current nodepool properties: ingress: - description: Ingress is a list containing ingress points for the - load-balancer. Traffic intended for the service should be sent - to these ingress points. + description: |- + Ingress is a list containing ingress points for the load-balancer. + Traffic intended for the service should be sent to these ingress points. items: - description: 'LoadBalancerIngress represents the status of a - load-balancer ingress point: traffic intended for the service - should be sent to an ingress point.' + description: |- + LoadBalancerIngress represents the status of a load-balancer ingress point: + traffic intended for the service should be sent to an ingress point. properties: hostname: - description: Hostname is set for load-balancer ingress points - that are DNS based (typically AWS load-balancers) + description: |- + Hostname is set for load-balancer ingress points that are DNS based + (typically AWS load-balancers) type: string ip: - description: IP is set for load-balancer ingress points - that are IP based (typically GCE or OpenStack load-balancers) + description: |- + IP is set for load-balancer ingress points that are IP based + (typically GCE or OpenStack load-balancers) type: string ports: - description: Ports is a list of records of service ports - If used, every port defined in the service should have - an entry in it + description: |- + Ports is a list of records of service ports + If used, every port defined in the service should have an entry in it items: properties: error: - description: 'Error is to record the problem with - the service port The format of the error shall comply - with the following rules: - built-in error values - shall be specified in this file and those shall - use CamelCase names - cloud provider specific error - values must have names that comply with the format - foo.example.com/CamelCase. --- The regex it matches - is (dns1123SubdomainFmt/)?(qualifiedNameFmt)' + description: |- + Error is to record the problem with the service port + The format of the error shall comply with the following rules: + - built-in error values shall be specified in this file and those shall use + CamelCase names + - cloud provider specific error values must have names that comply with the + format foo.example.com/CamelCase. + --- + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string @@ -179,9 +188,9 @@ spec: type: integer protocol: default: TCP - description: 'Protocol is the protocol of the service - port of which status is recorded here The supported - values are: "TCP", "UDP", "SCTP"' + description: |- + Protocol is the protocol of the service port of which status is recorded here + The supported values are: "TCP", "UDP", "SCTP" type: string required: - port diff --git a/charts/yurt-manager/crds/raven.openyurt.io_gateways.yaml b/charts/yurt-manager/crds/raven.openyurt.io_gateways.yaml index 37e49dd9db6..6cabf0bada3 100644 --- a/charts/yurt-manager/crds/raven.openyurt.io_gateways.yaml +++ b/charts/yurt-manager/crds/raven.openyurt.io_gateways.yaml @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.13.0 + controller-gen.kubebuilder.io/version: v0.14.0 name: gateways.raven.openyurt.io spec: group: raven.openyurt.io @@ -27,10 +27,19 @@ spec: description: Gateway is the Schema for the gateways API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -38,9 +47,13 @@ spec: description: GatewaySpec defines the desired state of Gateway properties: endpoints: - description: TODO add a field to configure using vxlan or host-gw for inner gateway communication? Endpoints is a list of available Endpoint. + description: |- + TODO add a field to configure using vxlan or host-gw for inner gateway communication? + Endpoints is a list of available Endpoint. items: - description: Endpoint stores all essential data for establishing the VPN tunnel. TODO add priority field? + description: |- + Endpoint stores all essential data for establishing the VPN tunnel. + TODO add priority field? properties: config: additionalProperties: @@ -61,21 +74,31 @@ spec: description: ExposeType determines how the Gateway is exposed. type: string nodeSelector: - description: NodeSelector is a label query over nodes that managed by the gateway. The nodes in the same gateway should share same layer 3 network. + description: |- + NodeSelector is a label query over nodes that managed by the gateway. + The nodes in the same gateway should share same layer 3 network. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -87,7 +110,10 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic @@ -145,10 +171,19 @@ spec: description: Gateway is the Schema for the gateways API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -195,21 +230,31 @@ spec: description: ExposeType determines how the Gateway is exposed. type: string nodeSelector: - description: NodeSelector is a label query over nodes that managed by the gateway. The nodes in the same gateway should share same layer 3 network. + description: |- + NodeSelector is a label query over nodes that managed by the gateway. + The nodes in the same gateway should share same layer 3 network. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array @@ -221,7 +266,10 @@ spec: matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic diff --git a/charts/yurt-manager/templates/yurt-manager-auto-generated.yaml b/charts/yurt-manager/templates/yurt-manager-auto-generated.yaml index 2bbea2ef178..01b0e219a63 100644 --- a/charts/yurt-manager/templates/yurt-manager-auto-generated.yaml +++ b/charts/yurt-manager/templates/yurt-manager-auto-generated.yaml @@ -1480,26 +1480,6 @@ webhooks: resources: - nodepools sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: yurt-manager-webhook-service - namespace: {{ .Release.Namespace }} - path: /mutate-iot-openyurt-io-v1alpha2-platformadmin - failurePolicy: Fail - name: mplatformadmin.kb.io - rules: - - apiGroups: - - iot.openyurt.io - apiVersions: - - v1alpha2 - operations: - - CREATE - - UPDATE - resources: - - platformadmins - sideEffects: None - admissionReviewVersions: - v1 - v1beta1 @@ -1604,6 +1584,26 @@ webhooks: resources: - yurtstaticsets sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: yurt-manager-webhook-service + namespace: {{ .Release.Namespace }} + path: /mutate-iot-openyurt-io-v1alpha2-platformadmin + failurePolicy: Fail + name: mplatformadmin.kb.io + rules: + - apiGroups: + - iot.openyurt.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - platformadmins + sideEffects: None --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration @@ -1672,26 +1672,6 @@ webhooks: resources: - nodepools sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: yurt-manager-webhook-service - namespace: {{ .Release.Namespace }} - path: /validate-iot-openyurt-io-v1alpha2-platformadmin - failurePolicy: Fail - name: vplatformadmin.kb.io - rules: - - apiGroups: - - iot.openyurt.io - apiVersions: - - v1alpha2 - operations: - - CREATE - - UPDATE - resources: - - platformadmins - sideEffects: None - admissionReviewVersions: - v1 - v1beta1 @@ -1777,3 +1757,23 @@ webhooks: resources: - yurtstaticsets sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: yurt-manager-webhook-service + namespace: {{ .Release.Namespace }} + path: /validate-iot-openyurt-io-v1alpha2-platformadmin + failurePolicy: Fail + name: vplatformadmin.kb.io + rules: + - apiGroups: + - iot.openyurt.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - platformadmins + sideEffects: None diff --git a/go.mod b/go.mod index 91446e6c0f0..e01564d3568 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/openyurtio/openyurt -go 1.20 +go 1.21 require ( github.com/aliyun/alibaba-cloud-sdk-go v1.62.156 diff --git a/go.sum b/go.sum index 1a532381c73..905f451f846 100644 --- a/go.sum +++ b/go.sum @@ -638,6 +638,7 @@ github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= github.com/benbjohnson/clock v1.3.0 h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A= +github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= @@ -694,6 +695,7 @@ github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4Kfc github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE= github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= +github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/edgexfoundry/go-mod-core-contracts/v3 v3.0.0 h1:xjwCI34DLM31cSl1q9XmYgXS3JqXufQJMgohnLLLDx0= github.com/edgexfoundry/go-mod-core-contracts/v3 v3.0.0/go.mod h1:zzzWGWij6wAqm1go9TLs++TFMIsBqBb1eRnIj4mRxGw= github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= @@ -777,6 +779,7 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.2.3/go.mod h1:eIauM6P8qSvTw5o2ez6UEAfGjQKrxQTl5EoK+Qa2oG4= github.com/go-logr/zapr v1.2.4 h1:QHVo+6stLbfJmYGkQ7uGHUCu5hnAFAj6mDe6Ea0SeOo= +github.com/go-logr/zapr v1.2.4/go.mod h1:FyHWQIzQORZ0QVE1BtVHv3cKtNLuXsbNLtpuhNapBOA= github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= @@ -793,6 +796,7 @@ github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+ github.com/go-pdf/fpdf v0.5.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M= github.com/go-pdf/fpdf v0.6.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M= github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s= +github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4= github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA= github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY= github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY= @@ -814,6 +818,7 @@ github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptG github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY= github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I= github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg= +github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4= @@ -940,6 +945,7 @@ github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/ad github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 h1:pdN6V1QBWetyv/0+wjACpqVH+eVULgEjkurDLq3goeM= github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA= github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 h1:+9834+KizmvFV7pXQGSXQTsaWhq2GjuNUt0aUU0YBYw= +github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y= github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho= github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk= github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo= @@ -971,6 +977,7 @@ github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHW github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8= github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U= github.com/jonboulle/clockwork v0.2.2 h1:UOGuzwb1PwsrDAObMuhUnj0p5ULPj8V/xJ7Kx9qUBdQ= +github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4= @@ -1027,6 +1034,7 @@ github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovk github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.7 h1:Ei8KR0497xHyKJPAv59M1dkC+rOZCMBJ+t3fZ+twI54= github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU= @@ -1034,6 +1042,7 @@ github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5 github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo= github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4= github.com/maxatome/go-testdeep v1.12.0 h1:Ql7Go8Tg0C1D/uMMX59LAoYK7LffeJQ6X2T04nTH68g= +github.com/maxatome/go-testdeep v1.12.0/go.mod h1:lPZc/HAcJMP92l7yI6TRz1aZN5URwUBUAfUNvrclaNM= github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcsrzbxHt8iiaC+zU4b1ylILSosueou12R++wfY= github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= @@ -1170,11 +1179,14 @@ github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w= github.com/ruudk/golang-pdf417 v0.0.0-20201230142125-a7e3863a1245/go.mod h1:pQAZKsJ8yyVxGRWYNEm9oFB8ieLgKFnamEyDmSA0BRk= github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= +github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0= +github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js= +github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0= github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4= @@ -1206,6 +1218,7 @@ github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE= +github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk= github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaOOb6ThwMmTEbhRwtKR97o= github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk= github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg= @@ -1220,6 +1233,7 @@ github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcY github.com/xhit/go-str2duration v1.2.0/go.mod h1:3cPSlfZlUHVlneIVfePFWcJZsuwf+P1v2SRTV4cUmp4= github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU= github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 h1:eY9dn8+vbi4tKz5Qo6v2eYzo7kUS51QINcR5jNpbZS8= +github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU= github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ= github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0= github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= @@ -1232,16 +1246,21 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0= github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA= go.etcd.io/bbolt v1.3.7 h1:j+zJOnnEjF/kyHlDDgGnVL/AIqIJPq8UoB2GSNfkUfQ= +go.etcd.io/bbolt v1.3.7/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw= go.etcd.io/etcd/api/v3 v3.5.9 h1:4wSsluwyTbGGmyjJktOf3wFQoTBIURXHnq9n/G/JQHs= go.etcd.io/etcd/api/v3 v3.5.9/go.mod h1:uyAal843mC8uUVSLWz6eHa/d971iDGnCRpmKd2Z+X8k= go.etcd.io/etcd/client/pkg/v3 v3.5.9 h1:oidDC4+YEuSIQbsR94rY9gur91UPL6DnxDCIYd2IGsE= go.etcd.io/etcd/client/pkg/v3 v3.5.9/go.mod h1:y+CzeSmkMpWN2Jyu1npecjB9BBnABxGM4pN8cGuJeL4= go.etcd.io/etcd/client/v2 v2.305.9 h1:YZ2OLi0OvR0H75AcgSUajjd5uqKDKocQUqROTG11jIo= +go.etcd.io/etcd/client/v2 v2.305.9/go.mod h1:0NBdNx9wbxtEQLwAQtrDHwx58m02vXpDcgSYI2seohQ= go.etcd.io/etcd/client/v3 v3.5.9 h1:r5xghnU7CwbUxD/fbUtRyJGaYNfDun8sp/gTr1hew6E= go.etcd.io/etcd/client/v3 v3.5.9/go.mod h1:i/Eo5LrZ5IKqpbtpPDuaUnDOUv471oDg8cjQaUr2MbA= go.etcd.io/etcd/pkg/v3 v3.5.9 h1:6R2jg/aWd/zB9+9JxmijDKStGJAPFsX3e6BeJkMi6eQ= +go.etcd.io/etcd/pkg/v3 v3.5.9/go.mod h1:BZl0SAShQFk0IpLWR78T/+pyt8AruMHhTNNX73hkNVY= go.etcd.io/etcd/raft/v3 v3.5.9 h1:ZZ1GIHoUlHsn0QVqiRysAm3/81Xx7+i2d7nSdWxlOiI= +go.etcd.io/etcd/raft/v3 v3.5.9/go.mod h1:WnFkqzFdZua4LVlVXQEGhmooLeyS7mqzS4Pf4BCVqXg= go.etcd.io/etcd/server/v3 v3.5.9 h1:vomEmmxeztLtS5OEH7d0hBAg4cjVIu9wXuNzUZx2ZA0= +go.etcd.io/etcd/server/v3 v3.5.9/go.mod h1:GgI1fQClQCFIzuVjlvdbMxNbnISt90gdfYyqiAIt65g= go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= diff --git a/pkg/apis/iot/v1beta1/zz_generated.deepcopy.go b/pkg/apis/iot/v1beta1/zz_generated.deepcopy.go index bb8cfac2242..c9ac14b2fa7 100644 --- a/pkg/apis/iot/v1beta1/zz_generated.deepcopy.go +++ b/pkg/apis/iot/v1beta1/zz_generated.deepcopy.go @@ -1,7 +1,7 @@ //go:build !ignore_autogenerated /* -Copyright 2024 The OpenYurt Authors. +Copyright 2023 The OpenYurt Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default.go b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default.go index a306f44e75d..9c8d1a2fc71 100644 --- a/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default.go +++ b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default.go @@ -38,7 +38,7 @@ func (webhook *PlatformAdminHandler) Default(ctx context.Context, obj runtime.Ob if platformAdmin.Spec.Version == "" { platformAdmin.Spec.Version = webhook.Manifests.LatestVersion } - + if platformAdmin.Spec.Platform == "" { platformAdmin.Spec.Platform = v1beta1.PlatformAdminPlatformEdgeX } diff --git a/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default_test.go b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default_test.go index c97a87b60d4..2763f0ff347 100644 --- a/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default_test.go +++ b/pkg/yurtmanager/webhook/platformadmin/v1beta1/platformadmin_default_test.go @@ -120,4 +120,4 @@ func TestDefaultV2(t *testing.T) { assert.Equal(t, tc.platform, tc.obj.(*v1beta1.PlatformAdmin).Spec.Platform) }) } -} \ No newline at end of file +} diff --git a/pkg/yurtmanager/webhook/server.go b/pkg/yurtmanager/webhook/server.go index c816fbb482f..006b24ddeb6 100644 --- a/pkg/yurtmanager/webhook/server.go +++ b/pkg/yurtmanager/webhook/server.go @@ -69,7 +69,7 @@ func addControllerWebhook(name string, handler SetupWebhookWithManager) { controllerWebhooks[name] = append(controllerWebhooks[name], handler) } -func init() { +func init() { addControllerWebhook(names.GatewayPickupController, &v1beta1gateway.GatewayHandler{}) addControllerWebhook(names.NodePoolController, &v1beta1nodepool.NodePoolHandler{}) addControllerWebhook(names.YurtStaticSetController, &v1alpha1yurtstaticset.YurtStaticSetHandler{}) From 3b5b27648fae2fa8fcd995b18f034ac270e0540d Mon Sep 17 00:00:00 2001 From: LavenderQAQ Date: Wed, 30 Oct 2024 11:39:01 +0800 Subject: [PATCH 3/3] chore: adapt ci to golang 1.21 Signed-off-by: LavenderQAQ --- .github/workflows/ci.yaml | 2 +- .github/workflows/release-assets.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 020ee55f08a..63bd1ad5719 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -9,7 +9,7 @@ on: workflow_dispatch: {} env: - GO_VERSION: '1.20' + GO_VERSION: '1.21' GOLANGCI_VERSION: 'v1.55.2' # Common users. We can't run a step 'if secrets.AWS_USR != ""' but we can run diff --git a/.github/workflows/release-assets.yaml b/.github/workflows/release-assets.yaml index 64114632763..c749a0f0b99 100644 --- a/.github/workflows/release-assets.yaml +++ b/.github/workflows/release-assets.yaml @@ -31,7 +31,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: 1.20 + go-version: 1.21 cache: true - name: Run GoReleaser uses: goreleaser/goreleaser-action@v5