From a63678a6c9492a609bcd2849b7ecf0a28e46c98c Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Wed, 3 Apr 2024 14:06:42 +0200 Subject: [PATCH 001/408] Add workflow to automatically update `schedule.yaml` Signed-off-by: Sascha Grunert --- .github/workflows/update-schedule.yml | 49 +++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 .github/workflows/update-schedule.yml diff --git a/.github/workflows/update-schedule.yml b/.github/workflows/update-schedule.yml new file mode 100644 index 0000000000..b65ce9cded --- /dev/null +++ b/.github/workflows/update-schedule.yml @@ -0,0 +1,49 @@ +name: Update schedule.yaml +on: + workflow_dispatch: + schedule: + - cron: '0 0 * * *' # daily +jobs: + create-pull-request: + name: Create PR (if required) + if: github.repository == 'kubernetes/website' + runs-on: ubuntu-latest + steps: + - name: Check out repository code + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + with: + fetch-depth: 0 + + - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 + with: + go-version: '1.22' + check-latest: true + + - name: Install schedule-builder + run: go install k8s.io/release/cmd/schedule-builder@v0.16.9 + + - name: Update schedule.yaml + run: schedule-builder -uc data/releases/schedule.yaml -e data/releases/eol.yaml + + - name: Check workspace + id: create_pr + run: | + if [[ $(git diff --stat) != '' ]]; then + echo "create_pr=true" >> "$GITHUB_OUTPUT" + fi + + - name: Create Pull Request + uses: peter-evans/create-pull-request@70a41aba780001da0a30141984ae2a0c95d8704e # v6.0.2 + if: ${{ steps.create_pr.outputs.create_pr == 'true' }} + with: + token: ${{ secrets.GITHUB_TOKEN }} + commit-message: Update schedule.yaml + title: Update release schedule.yaml + body: | + Update release schedule.yaml + + /cc @kubernetes/release-managers + labels: area/release-eng, sig/release, sig/docs + branch: update-schedule + delete-branch: true + signoff: true From 861d0c1892ffca8b7edae00b5afdf9b4ee68b3bd Mon Sep 17 00:00:00 2001 From: Sajib Adhikary <60180521+sajibAdhi@users.noreply.github.com> Date: Mon, 20 May 2024 09:46:55 +0000 Subject: [PATCH 002/408] [bn] Localize reference glossary container-runtime-interface.md Localization of content/en/docs/reference/glossary/container-runtime-interface.md Signed-off-by: Sajib Adhikary --- .../glossary/container-runtime-interface.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 content/bn/docs/reference/glossary/container-runtime-interface.md diff --git a/content/bn/docs/reference/glossary/container-runtime-interface.md b/content/bn/docs/reference/glossary/container-runtime-interface.md new file mode 100644 index 0000000000..d9c1c95bec --- /dev/null +++ b/content/bn/docs/reference/glossary/container-runtime-interface.md @@ -0,0 +1,22 @@ +--- +title: কন্টেইনার রানটাইম ইন্টারফেস (Container Runtime Interface) +id: container-runtime-interface +date: 2021-11-24 +full_link: /docs/concepts/architecture/cri +short_description: > + kubelet এবং কন্টেইনার রানটাইমের মধ্যে যোগাযোগের জন্য প্রধান প্রোটোকল। + +aka: +tags: + - cri +--- + +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} এবং কন্টেইনার রানটাইমের এর মধ্যে যোগাযোগের জন্য প্রধান প্রোটোকল। + + + +কুবারনেটিস কন্টেইনার রানটাইম ইন্টারফেস (CRI) +[নোড কম্পোনেন্ট](/bn/docs/concepts/overview/components/#node-components) +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} এবং +{{< glossary_tooltip text="কন্টেইনার রানটাইমের" term_id="container-runtime" >}} +মধ্যে যোগাযোগের জন্য প্রধান [gRPC](https://grpc.io) প্রোটোকলকে সংজ্ঞায়িত করে। From cf4d92f2c5346e2b7c15699ed112bedcccb710a6 Mon Sep 17 00:00:00 2001 From: Anuj Tiwari Date: Mon, 27 May 2024 22:24:07 +0530 Subject: [PATCH 003/408] [hi] Localized docs/reference/tools/_index.md --- content/hi/docs/reference/tools/_index.md | 73 +++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 content/hi/docs/reference/tools/_index.md diff --git a/content/hi/docs/reference/tools/_index.md b/content/hi/docs/reference/tools/_index.md new file mode 100644 index 0000000000..85460fbb1a --- /dev/null +++ b/content/hi/docs/reference/tools/_index.md @@ -0,0 +1,73 @@ +--- +title: अन्य उपकरण +reviewers: +- divya-mohan0209 +content_type: concept +weight: 150 +no_list: true +--- + + +कुबेरनेट्स सिस्टम के साथ काम करने में आपकी सहायता के लिए कुबेरनेट्स में कई उपकरण शामिल हैं। + + + +## crictl + +[`crictl`](https://github.com/kubernetes-sigs/cri-tools) +{{}}-compatible कंटेनर रनटाइम के +निरीक्षण और डिबगिंग के लिए एक कमांड-लाइन इंटरफ़ेस है। + +## Dashboard + +[`डैशबोर्ड`](/docs/tasks/access-application-cluster/web-ui-dashboard/), कुबेरनेट्स का +वेब पे आधारित उपयोगकर्ता इंटरफ़ेस, आपको कुबेरनेट्स क्लस्टर में कंटेनरीकृत अनुप्रयोगों को तैनात करने, +उनकी समस्या का निवारण करने और क्लस्टर और उसके संसाधनों को प्रबंधित करने की अनुमति देता है। + +## Helm +{{% thirdparty-content single="true" %}} + +[हेल्म](https://helm.sh/) पूर्व-कॉन्फ़िगर कुबेरनेट्स संसाधनों के पैकेजों के प्रबंधन के लिए एक उपकरण है। +इन पैकेजों को _हेल्म चार्ट_ के रूप में जाना जाता है। + +हेल्म का उपयोग करें: + +* कुबेरनेट्स चार्ट के रूप में पैक किए गए लोकप्रिय सॉफ़्टवेयर को ढूंढें और उपयोग करें। +* अपने स्वयं के एप्लिकेशन को कुबेरनेट्स चार्ट के रूप में साझा करें। +* अपने कुबेरनेट्स एप्लीकेशन के लिए प्रस्तुत करने योग्य बिल्ड बनाएं। +* बुद्धिमानी से अपने कुबेरनेट्स मैनिफ़ेस्ट फ़ाइलों को प्रबंधित करें। +* हेल्म पैकेजों के रिलीज़ प्रबंधित करें। + +## Kompose + +[`कॉम्पोज़`](https://github.com/kubernetes/kompose) एक उपकरण है, जो डॉकर कंपोज़ उपयोगकर्ताओं +को कुबेरनेट्स पर जाने में मदद करता है। + +कॉम्पोज़ का उपयोग करें: + +* डॉकर कंपोज़ फ़ाइल को कुबेरनेट्स ऑब्जेक्ट्स में अनुवाद करें। +* स्थानीय डॉकर डेवलपमेंट से कुबेरनेट्स एप्लीकेशनों को प्रबंधित करें। +* v1 या v2 डॉकर कंपोज़, `yaml` फ़ाइलों या + [वितरित एप्लिकेशनो के बंडलों](https://docs.docker.com/compose/bundles/) के माध्यम से अपने एप्लिकेशन + को प्रबंधित कऱे। + +## Kui + +[`Kui`](https://github.com/kubernetes-sigs/kui) एक GUI उपकरण है, जो आपके सामान्य `kubectl` +कमांड लाइन अनुरोधों को लेकर ग्राफिक्स के साथ प्रतिक्रिया देता है। + +Kui सामान्य `kubectl` कमांड लाइन अनुरोधों को लेकर ग्राफिक्स के साथ प्रतिक्रिया देता है। ASCII टेबल्स के बजाय, +Kui उन टेबल्स के साथ एक GUI प्रदान करता है, जिन्हें आप सॉर्ट कर सकते हैं। + +Kui आपको देता है: + +* कॉपी और पेस्ट करने के बजाय सीधे लंबे स्वचालित रूप से जेनरेटेड किए गए संसाधनों के नामों पर क्लिक करें। +* `Kubectl` कमांड टाइप करें और उन्हें चलते हुए देखें, यहां तक कि कभी-कभी `Kubectl` से भी तेज। +* एक {{< glossary_tooltip text="जॉब" term_id="job">}} क्वेरी करें और इसके निष्पादन को + वॉटरफॉल के डायग्राम के रूप में देखें। +* एक टैब्ड UI का उपयोग करके अपने क्लस्टर में संसाधनों पर क्लिक करें। + +## Minikube + +[`मिनीक्यूब`](https://minikube.sigs.k8s.io/docs/) एक उपकरण है, जो डेवलपमेंट और परीक्षण जैसे उद्देश्यों +के लिए आपके वर्कस्टेशन पर स्थानीय रूप से एक-नोड वाले कुबेरनेट्स क्लस्टर को चलाता है। From 19aa53ba0d947731b4d4c1f783e126ddbad2cff7 Mon Sep 17 00:00:00 2001 From: Arhell Date: Sat, 8 Jun 2024 05:46:38 +0300 Subject: [PATCH 004/408] [vi] Ready glossary page for vanilla Docsy --- content/vi/docs/reference/glossary/index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/vi/docs/reference/glossary/index.md b/content/vi/docs/reference/glossary/index.md index 1fca261963..c94d4f9ec3 100644 --- a/content/vi/docs/reference/glossary/index.md +++ b/content/vi/docs/reference/glossary/index.md @@ -2,6 +2,7 @@ title: Thuật ngữ chuẩn hóa layout: glossary noedit: true +body_class: glossary default_active_tag: fundamental weight: 5 card: From 5b91b323f75a443ef52070799c87c8379a3bc5df Mon Sep 17 00:00:00 2001 From: arujjval Date: Tue, 18 Jun 2024 16:41:54 +0530 Subject: [PATCH 005/408] included author metadata in blog front matter --- content/en/docs/contribute/new-content/blogs-case-studies.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/en/docs/contribute/new-content/blogs-case-studies.md b/content/en/docs/contribute/new-content/blogs-case-studies.md index 368f93f226..23086e4e60 100644 --- a/content/en/docs/contribute/new-content/blogs-case-studies.md +++ b/content/en/docs/contribute/new-content/blogs-case-studies.md @@ -157,6 +157,10 @@ To submit a blog post follow these directions: title: "Your Title Here" date: YYYY-MM-DD slug: text-for-URL-link-here-no-spaces + author: > + Author-1 (Affiliation), + Author-2 (Affiliation), + Author-3 (Affiliation) --- ``` From 1d493790e859421ac9ec97c4e049595caeda3945 Mon Sep 17 00:00:00 2001 From: Arujjwal Negi Date: Thu, 20 Jun 2024 20:49:38 +0530 Subject: [PATCH 006/408] Update blogs-case-studies.md --- content/en/docs/contribute/new-content/blogs-case-studies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/contribute/new-content/blogs-case-studies.md b/content/en/docs/contribute/new-content/blogs-case-studies.md index 23086e4e60..d4626f2bcd 100644 --- a/content/en/docs/contribute/new-content/blogs-case-studies.md +++ b/content/en/docs/contribute/new-content/blogs-case-studies.md @@ -199,7 +199,7 @@ To mirror a blog post from the [Kubernetes contributor blog](https://www.kuberne - Keep the blog content the same. If there are changes, they should be made to the original article first, and then to the mirrored article. - The mirrored blog should have a `canonicalUrl`, that is, essentially the url of the original blog after it has been published. -- [Kubernetes contributor blogs](https://kubernetes.dev/blog) have their authors mentioned in the YAML header, while the Kubernetes blog posts mention authors in the blog content itself. This should be changed when mirroring the content. +- Same as [Kubernetes contributor blogs](https://kubernetes.dev/blog), Kubernetes blog posts also mention authors in the YAML header as per the new guidelines. This should be ensured. - Publication dates stay the same as the original blog. All of the other guidelines and expectations detailed above apply as well. From 8cd4e60cb2437e3bff1ddd22bd3fcb9bd4b7e4a6 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Fri, 19 Jul 2024 09:40:50 +0200 Subject: [PATCH 007/408] docs: Localize pod lifecycle to Spanish solves #45708 --- .../concepts/workloads/pods/pod-lifecycle.md | 748 ++++++++++++++++++ 1 file changed, 748 insertions(+) create mode 100644 content/es/docs/concepts/workloads/pods/pod-lifecycle.md diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md new file mode 100644 index 0000000000..5a0e7dfb17 --- /dev/null +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -0,0 +1,748 @@ +--- +title: Ciclo de vida de un Pod +content_type: concept +weight: 30 +--- + + +Esta página describe el ciclo de vida de un Pod. +Los Pods siguen un ciclo de vida definido, comenzando en la fase [`Pending`]( +#pod-phase), +y luego pasando a "en ejecución" `Running` si al menos uno de sus contenedores primarios se +inicia correctamente, +y luego pasando a "exitoso"(`Succeeded`) o "fallido" (`Failed`) si uno de los contenedores de un Pod +termina en error. + +Mientras un Pod está en `Running`, +el kubelet puede reiniciar sus contenedores para manejar algunos errores. +Dentro de un Pod, +Kubernetes rastrea diferentes [estados](#container-states) de contenedores y +decide qué acción tomar para que el Pod esté sano otra vez. + +En la API de Kubernetes, los Pods tienen una especificación y un estado actual. +El estado de un Pod consiste en un conjunto +de [condiciones de un Pod](#pod-conditions). +También puedes +inyectar [información de estado personalizada](#pod-readiness-gate) en los datos +de condiciones de un Pod, si es útil para tu aplicación. + +Los Pods se [programan](/docs/concepts/scheduling-eviction/) únicamente una vez +en su tiempo de vida. +Una vez que un Pod se programa (asigna) a un Nodo, el Pod se ejecuta en ese Nodo +hasta que se termine o se [elimina](#pod-termination). + + + +## Ciclo de vida de un Pod + +Igual que contenedores de aplicación individuales, +se considera que los Pods son entidades relativamente efímeras +(en lugar de durables). +Los Pods se crean y se les +asigna un identificador único +([UID](/docs/concepts/overview/working-with-objects/names/#uids)), +y se programan para ejecutarse en nodos donde se mantienen hasta que se terminan +(de acuerdo con las políticas de reinicio) o se eliminan. + +Si un {{< glossary_tooltip term_id="node" text="nodo" >}} muere, +los Pods programados para ejecutarse en ese Nodo +se [programan para eliminarse](#pod-garbage-collection) luego de un periodo de +tiempo. + +Los Pods, por sí mismos, no se curan automáticamente. +Si un Pod está programado para un {{< glossary_tooltip text="node" +term_id="node" >}} y luego falla, +el Pod se elimina; de la misma manera, +un Pod no sobrevivirá a un desalojo debido a falta de recursos o mantenimiento +del Nodo. +Kubernetes utiliza una abstracción llamada {{< glossary_tooltip term_id=" +controller" +text="controlador" >}}, que maneja el trabajo de administrar las instancias de +Pod relativamente desechables. + +Un Pod dado (definido por un UID) nunca se reprograma a un Nodo diferente; en su +lugar, ese Pod se puede reemplazar por un Pod nuevo, casi idéntico, incluso con +el mismo nombre si se desea, pero con un UID diferente. + +{{< figure src="/images/docs/pod.svg" title="Diagrama de un Pod" class=" +diagram-medium" >}} + +Un Pod con múltiples contenedores que contiene un extractor de ficheros y un +servidor web que usa un volumen persistente para compartir datos entre los +contenedores. + +## Fase del Pod + +El campo `status` de un Pod es un objeto [PodStatus]( +/docs/reference/generated/kubernetes-api/{{< param "version" > +}}/#podstatus-v1-core) de Kubernetes que tiene un campo `phase`. + +La fase de un Pod es un resumen simple y de alto nivel de dónde se encuentra el +Pod en su ciclo de vida. La fase no pretende ser un resumen completo de +observaciones del estado del contenedor o Pod, ni tampoco pretende ser una +máquina de estado completa. + +El número y los significados de los valores de fase de un Pod están +estrechamente guardados. +Aparte de lo que se documenta aquí, no se debe asumir nada acerca de los Pods +que tienen un valor de `phase` determinado. + +Aquí están los posibles valores de `phase`: + +| Valor | Descripción | +|:------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `Pending` | El clúster de Kubernetes aceptó el pod, pero uno o más contenedores no se configuraron ni prepararon para ejecutarse. Esto incluye el tiempo que pasa un Pod esperando ser programado, así como el tiempo dedicado a descargar imágenes de contenedores a través de la red. | +| `Running` | El Pod se vinculó a un nodo y se crearon todos los contenedores. Al menos un contenedor todavía se está ejecutando o está en proceso de iniciarse o reiniciarse. | +| `Succeeded` | Todos los contenedores del Pod finalizaron con éxito y no se reiniciarán. | +| `Failed` | Todos los contenedores del Pod han finalizado y al menos un contenedor ha finalizado con error. Es decir, el contenedor salió con un estado distinto de cero o el sistema lo canceló. | +| `Unknown` | Por alguna razón no se pudo obtener el estado del Pod. Esta fase generalmente ocurre debido a un error en la comunicación con el nodo donde debería ejecutarse el Pod. | + +{{< note >}} +Cuando se está borrando un Pod, se muestra como `Terminating` por algunos +comandos de kubectl. +Este estado `Terminating` no es una de las fases del Pod. +A un Pod se le garantiza un tiempo para terminar con gracia, +cuyo valor por defecto es 30 segundos. +Puedes utilizar el flag `--force` +para [terminar un Pod por la fuerza](#pod-termination-forced). +{{< /note >}} + +A partir de la versión 1.27 de Kubernetes, el kubelet aplica una transición de +los Pods borrados, excepto +por [Pods estáticos](/docs/tasks/configure-pod-container/static-pod/) +y [Pods borrados por la fuerza](#pod-termination-forced) sin un finalizador, a +una fase terminal +(`Failed` o `Succeeded` dependiendo de los códigos de salida de los contenedores +del Pod) antes de su eliminación del servidor API. + +Si un Nodo muere o se desconecta del resto del clúster, +Kubernetes aplica una política para establecer la `phase` de todos los Pods +en `Failed`. + +## Estados del contenedor + +Así como la fase del Pod en general, Kubernetes rastrea el estado de cada +contenedor dentro de un Pod. +Puedes +usar [hooks del ciclo de vida de un contenedor](/docs/concepts/containers/container-lifecycle-hooks/) +para lanzar eventos en ciertos puntos en el ciclo de vida de un +contenedor. + +Una vez que el {{< glossary_tooltip text="programador" +term_id="kube-scheduler" >}} asigna un Pod a un Nodo, +el kubelet inicia creando los contenedores para ese Pod usando un {{< +glossary_tooltip text="espacio de ejecución del contenedor" +term_id="container-runtime" >}}. +Hay 3 estados posibles para un contenedor: `Waiting`, `Running`, y `Terminated`. + +Para revisar el estado de los contenedores de un Pod, +puedes usar `kubectl describe pod `. +La salida muestra el estado de cada contenedor dentro del Pod. + +Cada estado tiene un significado específico: + +### `Waiting` {#container-state-waiting} + +Si un contenedor no está en el estado `Running` o `Terminated`, está `Waiting`. +Un contenedor en el estado `Waiting` aún está ejecutando las operaciones que +requiere para completar su arranque: +por ejemplo, +descargar la imagen del contenedor de un registro de imágenes de un contenedor, +o aplicando datos {{< glossary_tooltip text="secretos" term_id="secret" >}}. + +### `Running` {#container-state-running} + +El estado `Running` indica que el contenedor se está ejecutando sin problemas. +Si hay un hook `postStart` configurado, ya se ha ejecutado y finalizado. +Cuando utilizas el comando `kubectl` para consultar un Pod con un contenedor que +está `Running`, +también puedes ver información sobre cuando el contenedor entró en +estado `Running`. + +### `Terminated` {#container-state-terminated} + +Un contenedor en el estado `Terminated` comenzó su ejecución y luego se terminó +con éxito o falló por alguna razón. +Cuando usas `kubectl` para consultar un Pod con un contenedor que +está `Terminated`, puedes ver un motivo, y un código de salida, y la hora de +inicio y de finalización del contenedor. + +Si un contenedor tiene un hook `preStop` configurado, el hook se ejecuta antes +de que el contenedor entre en estado `Terminated`. + +## Política de reinicio del contenedor {#restart-policy} + +La especificación (`spec` en inglés) de un Pod tiene un campo `restartPolicy` con los posibles +valores `Always`, `OnFailure`, y `Never`. +El valor por defecto es `Always`. + +La política de reinicio (`restartPolicy` en inglés) para un Pod aplica a {{< glossary_tooltip text="contenedores +de apps" term_id="app-container" >}} en el Pod +para [contenedores de inicialización](/docs/concepts/workloads/pods/init-containers/) regulares. +Los [contenedores sidecar](/docs/concepts/workloads/pods/sidecar-containers/) +ignoran el campo `restartPolicy`: en Kubernetes, un sidecar se define como una +entrada dentro de `initContainers` que tiene su `restartPolicy` a nivel del contenedor +establecido en `Always`. Para contenedores de inicio que finalizan con un error, el kubelet reinicia el +contenedor de inicio if el nivel del Pod `restartPolicy` es `OnFailure` +o `Always`. + +Cuando el kubelet está manejando el contenedor se reinicia de acuerdo con la política de reinicio configurada, que solo se aplica a los reinicios que realizan contenedores de +reemplazo dentro del +mismo Pod y ejecutándose en el mismo nodo. +Después de que los contenedores en un Pod terminan, el kubelet +los reinicia con un retraso de retroceso exponencial (10 s, 20 s, 40 s,...), que +está limitado a +cinco minutos. Una vez que un contenedor se ha ejecutado durante 10 minutos sin +ningún problema, el +kubelet restablece el temporizador de reinicio para ese contenedor. +[Ciclo de vida de contenedores Sidecar y el Pod](#sidecar-containers-and-pod-lifecycle) +explica el comportamiento de `init containers` cuando +especifica una `restartPolicy`. + +## Condiciones del Pod {#pod-conditions} + +Un Pod tiene un `PodStatus`, que tiene un listado de [PodConditions]( +/docs/reference/generated/kubernetes-api/{{< param "version" > +}}/#podcondition-v1-core) a través de los cuales el Pod ha pasado o no. +El kubelet administra las siguientes condiciones del Pod: + +* `PodScheduled`: El Pod está programado para un nodo. +* `PodReadyToStartContainers`: (característica beta; habilitada + por [defecto](#pod-has-network)) La zona de pruebas del Pod se creó + correctamente y se configuró la red. +* `ContainersReady`: todos los contenedores en el Pod están listos. +* `Initialized`: todos + los [contenedores de inicio](/docs/concepts/workloads/pods/init-containers/) + han terminado exitosamente. +* `Ready`: el Pod es capaz de recibir peticiones y debería ser agregado a los + grupos de equilibrio de carga de todos los Services que coincidan. + +| Nombre del campo | Descripción | +|:---------------------|:------------------------------------------------------------------------------------------------------| +| `type` | Nombre de esta condición del Pod. | +| `status` | Indica si la condición es aplicable, con valores posibles "`True`", "`False`", ó "`Unknown`". | +| `lastProbeTime` | Marca de tiempo de cuando se probó por última vez la condición del Pod. | +| `lastTransitionTime` | Marca de tiempo de cuando el Pod hizo transición de un estado a otro. | +| `reason` | Texto legible por máquina que indica el motivo de la última transición de la condición. | +| `message` | Mensaje legible por humanos indicando detalles acerca ade la última transición de estado. | + +### Preparación del Pod {#pod-readiness-gate} + +{{< feature-state for_k8s_version="v1.14" state="stable" >}} + +Tu aplicación puede inyectar retroalimentación adicional o señales +al `PodStatus`: +_Pod readiness_. +Para usar esto, establece `readinessGates` en la `spec` del Pod para especificar una +lista de condiciones adicionales que el kubelet evalúa para la preparación del +Pod. + +Las condiciones de preparación están determinadas por el estado actual de los +campos `status.conditions` de un Pod. +Si Kubernetes no puede encontrar una condición en el campo `status.conditions` +de un Pod, el estado de la condición se establece en "`False`". + +Aquí hay un ejemplo: + +```yaml +kind: Pod +... +spec: + readinessGates: + - conditionType: "www.example.com/feature-1" +status: + conditions: + - type: Ready # una PodCondition construida + status: "False" + lastProbeTime: null + lastTransitionTime: 2018-01-01T00:00:00Z + - type: "www.example.com/feature-1" # una PodCondition extra + status: "False" + lastProbeTime: null + lastTransitionTime: 2018-01-01T00:00:00Z + containerStatuses: + - containerID: docker://abcd... + ready: true +... +``` + +Las condiciones del Pod que incluyas deben tener nombres que sean válidos para +los [formatos de etiqueta](/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set) +de Kubernetes. + +### Estado de preparación del Pod {#pod-readiness-status} + +El comando `kubectl patch` no admite actualizar el estado del objeto. +Para establecer estas `status.conditions` para el Pod, las aplicaciones y +los {{< glossary_tooltip term_id="operator-pattern" text="operadores">}} +deberían utilizar la acción `Patch`. + +Puedes utilizar +una [librería cliente de Kubernetes](/docs/reference/using-api/client-libraries/) +para escribir código que establece condiciones personalizadas de un Pod para su +preparación. + +Para los Pods que utilizan condiciones personalizadas, ese Pod es evaluado para +estar listo **solamente** cuando ambas afirmaciones aplican: + +* Todos los contenedores del Pod están listos. +* Todas las condiciones personalizadas especificadas en `readinessGates` + están `True`. + +Cuando los contenedores de un Pod están listos, pero al menos una condición +personalizada está ausente o `False`, +el kubelet establece la [condición](#pod-conditions) del Pod +en `ContainersReady`. + +### Preparación de la red del Pod {#pod-has-network} + +{{< feature-state for_k8s_version="v1.29" state="beta" >}} + +{{< note >}} +Durante su desarrollo temprano, esta condición se llamaba `PodhasNetwork`. +{{< /note >}} + +Luego que un Pod es programado en un nodo, el kubelet debe admitirlo y tener los +volúmenes de almacenamiento necesarios montados. +Una vez que estas fases están completadas, el kubelet trabaja con un tiempo de ejecución del +contenedor para crear un espacio de ejecución (usando {{< glossary_tooltip +term_id="cri" >}})y configurar la red para el Pod. +Si +la [condición](/docs/reference/command-line-tools-reference/feature-gates/) `PodReadyToStartContainersCondition` +está habilitada (está habilitada por defecto para Kubernetes {{< skew +currentVersion >}}), la condición `PodReadyToStartContainers` se agrega al +campo `status.conditions` del Pod. + +La condición `PodReadyToStartContainers` se establece a `False` por el kubelet +cuando detecta que un Pod no tiene un entorno de pruebas en tiempo de ejecución +con red configurada. +Esto ocurre en los siguientes escenarios: + +- Temprano en el ciclo de vida del Pod, cuando el kubelet no ha comenzado a + configurar un entorno de pruebas para que el Pod que utiliza el contenedor en + tiempo de ejecución. +- Luego durante el ciclo de vida del Pod, cuando el entorno de pruebas del Pod + ha sido destruido debido a: + - El nodo ha reiniciado, sin desalojar el Pod. + - Para los tiempos de ejecución de contenedores que utilizan máquinas virtuales para el aislamiento, la máquina virtual de la zona de pruebas del Pod se reinicia, lo que luego requiere la creación de una nueva zona de pruebas y una nueva configuración de red de contenedores. + +La condición `PodReadyToStartContainers` se establece a `True` por el kubelet +luego de completar exitosamente la creación del espacio de pruebas y la +configuración de red para el Pod por el complemento de tiempo de ejecución. +El kubelet puede comenzar a descargar las imágenes del contenedor y crear +contenedores luego que la condición `PodReadyToStartContainers` se establece +a `True`. + +Para un Pod con contenedores de inicio, el kubelet establece la +condición `Initialized` a `True` luego que los contenedores de inicio se +completaron con éxito (esto ocurre luego de la creación exitosa del espacio de +pruebas y la configuración de red por el complemento de tiempo de ejecución). +Para un Pod sin contenedores de inicio, el kubelet establece la +condición `Initialized` a `False` antes que inicie la creación del espacio de +pruebas y la configuración de red. + +### Preparación de la programación del Pod {#pod-scheduling-readiness-gate} + +{{< feature-state for_k8s_version="v1.26" state="alpha" >}} + +Revisa [Preparación de la programación del Pod](/docs/concepts/scheduling-eviction/pod-scheduling-readiness/) +para más información. + +## Sondeos del contenedor + +Una _sonda_ es un diagnóstico realizado periódicamente por +el [kubelet](/docs/reference/command-line-tools-reference/kubelet/) en un +contenedor. +Para ejecutar este diagnóstico, el kubelet ejecuta código dentro del contenedor +o realiza una solicitud de red. + +### Mecanismos de revisión {#probe-check-methods} + +Existen cuatro maneras diferentes de revisar un contenedor usando una sonda. +Cada sonda debe definir exactamente una de estas cuatro maneras: + +`exec`: Ejecuta un comando especificado dentro del contenedor. +El diagnóstico se considera exitoso si el comando termina con un código de +estado 0. + +`grpc` +: Realiza una llamada de procedimiento remoto usando [gRPC](https://grpc.io/). +El destino debe +implementar [revisión de estado de gRPC](https://grpc.io/grpc/core/md_doc_health-checking.html). +El diagnóstico se considera exitoso si el `status` de la respuesta es `SERVING`. + +`httpGet` +: Realiza una petición HTTP `GET` contra la dirección IP en la ruta y puerto +especificado. +El diagnóstico se considera exitoso si la respuesta tiene un código de estado +mayor o igual que 200 y menor que 400. + +`tcpSocket` +: Realiza una revisión TCP contra la dirección IP del Pod en un puerto +específico. +El diagnóstico se considera exitoso si el puerto está abierto. +Si el sistema remoto (el contenedor) cierra la conexión inmediatamente después +de abrir la conexión, el diagnóstico se considera exitoso. + + +{{< caution >}} +A diferencia de otros mecanismos, la implementación de la sonda `exec` involucra +la creación/bifuración de múltiples procesos cada vez que se ejecuta. +Como resultado, en caso de clústers con mayor densidad de Pods, intérvalos más +bajos de `initialDelaySeconds`, `periodSeconds`, configurando un sondeo +con `exec` puede introducir una sobrecarga en el uso de la CPU del nodo. + +En tales escenarios, considere la utilización de los mecanismos alternativos de +sondeo para evitar la sobrecarga. +{{< /caution >}} + +### Resultados de sondeos + +Cada sondeo puede tener uno de tres resultados: + +`Success` +: El contenedor ha pasado el diagnóstico. + +`Failure` +: El contenedor ha fallado el diagnóstico. + +`Unknown` +: El diagnóstico ha fallado (no se debe tomar ninguna acción, y el kubelet hará +más revisiones adicionales). + +### Tipos de sondeo + +Opcionalmente, +el kubelet puede ejecutar y reaccionar a tres tipos de sondeos en contenedores +en ejecución: + +`livenessProbe` +: Indica si el contenedor se está ejecutando. +Si el sondeo falla, el kubelet mata el contenedor, +y el contenedor está sujeto a su [política de reinicio](#restart-policy). +Si un contenedor no tiene un sondeo de liveness, el estado por defecto +es `Success`. + +`readinessProbe` +: Indica si un contenedor está preparado para responder a peticiones. +Si el sondeo falla, +el controlador de endpoints elimina las direcciones IP del Pod de los endpoints +de todos los Services que coinciden con el Pod. +El estado por defecto de readiness antes del retraso inicial es `Failure`. +Si un contenedor no tiene un sondeo de readiness, el estado por defecto +es `Success`. + +`startupProbe` +: Indica si la aplicación dentro del contenedor ha iniciado. El resto de los +sondeos están deshabilitados si un sondeo de inicio se proporciona, hasta que se +complete. Si el sondeo falla, el kubelet mata el contenedor, y el contenedor +está sujeto a su [política de reinicio](#restart-policy). Si un contenedor no +tiene un sondeo de inicio, el estado por defecto es `Success`. + +Para mayor información sobre como configurar un sondeo liveness, +readiness o de startup, mire la +sección [Configurar una sonda Liveness, Readiness y Startup](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/). + +#### ¿Cuándo debería utilizar un sondeo liveness? + +Si el proceso en tu contenedor es capaz de terminar por sí mismo cuando +encuentra un error o deja de estar sano, no necesitas un sondeo liveness; el +kubelet automáticamente realizará la acción adecuada de acuerdo con la política +de reinicio `restartPolicy` del Pod. + +Si te gustaría que tu contenedor fuese destruido y reiniciado si falla un +sondeo, especifica un sondeo liveness, y especifica una `restartPolicy` +de `Always` o `OnFailure`. + +#### ¿Cuándo debería utilizar un sondeo readiness? + +Se te gustaría enviar tráfico al Pod solo cuando una sonda sea exitosa, +especifica un sondeo readiness. +En este caso, +el sondeo readiness podría ser el mismo que el liveness, +pero la existencia del sondeo readines en la especificación significa que el Pod +iniciará sin recibir ningún tráfico y solo iniciará cuando el sondeo readiness +sea exitoso. + +Si quieres que tu contenedor sea capaz de darse de baja por mantenimiento por sí +mismo, +puedes especificar un sondeo de readiness que revisa un endpoint específico de +readiness que es distinto del sondeo liveness. + +Si tu aplicación tiene una dependencia estricta con servicios de trasfondo, +puedes implementar ambos sondeos de liveness y readiness. +El sondeo de liveness pasa cuando la aplicación por sí misma está sana, pero el +sondeo de readiness revisa adicionalmente que cada servicio de trasfondo está +disponible. +Esto ayuda a evitar enviar a Pods que solo pueden responder con errores. + +Si tu contenedor necesita trabajar cargando grandes datos, ficheros de +configuración, o migraciones durante el inicio, puedes usar +un [sondeo de inicio](#when-should-you-use-a-startup-probe). +Sin embargo, si quieres detectar la diferencia entre una aplicación que ha +fallado y una aplicación que todavía está procesando datos de inicialización, +puedes usar un sondeo de readiness. + +{{< note >}} +Si quieres ser capaz de drenar peticiones cuando se elimina el Pod, +no necesitas un sondeo readiness; +cuando se elimina el Pod, +automáticamente se cambia al estado `unready` sin importar si existe el sondeo +readiness. +El Pod permanece en el estado `unready` mientras espera que los contenedores en +el Pod se paren. +{{< /note >}} + +#### ¿Cuándo debería utilizar un sondeo de inicialización? + +Los sondeos de inicialización son útiles para Pods que tienen contenedores que +se toman un largo tiempo para estar en servicio. +En lugar de especificar un intérvalo largo de liveness, puedes crear una +configuración separada para sondear el contenedor en el inicio, permitiendo un +tiempo mayor que el intervalo de liveness. + +Si tu contenedor usualmente inicia en más +de `initialDelaySeconds + failureThreshold × periodSeconds`, deberías +especificar un sondeo de inicialización que revise el mismo endpoint que la +sonda liveness. +El periodo por defecto `periodSeconds` es de 10 segundos. +Deberías especificar el campo `failureThreshold` lo suficientemente alto para +permitir al contenedor arrancar, sin cambiar los valores por defecto de la sonda +liveness. +Esto ayuda a proteger contra puntos muertos. + +## Finalización de Pods {#pod-termination} + +Ya que los Pods representan procesos ejecutándose en nodos de un clúster, es +importante permitir que esos procesos terminen con gracia cuando no se +necesitan (en lugar de detenerse abruptamente con una señal `Kill` y sin +oportunidad de limpiarse). + +El diseño está orientado a permitir que puedas solicitar la eliminación de un +Pod y saber cuándo finalizan los procesos, pero también para asegurar que la +eliminación se completa eventualmente. +Cuando solicitas la eliminación de un Pod, el clúster registra y rastrea el +periodo de gracia antes de que el Pod se elimine por la fuerza. +Con este rastreo de detención forzada en marcha, el {{< glossary_tooltip text=" +kubelet" term_id="kubelet" >}} intenta pararlo con gracia. + +Típicamente, con esta finalización con gracia del Pod, el kubelet hace +peticiones al tiempo de ejecución del contenedor para intentar detener los +contenedores en el Pod, primeramente enviando una señal `Term` (ej. SIGTERM), +con un período de tiempo de gracia, al proceso principal de cada contenedor. +Las peticiones para parar los contenedores se procesan de forma asíncrona en el +tiempo de ejecución del contenedor. +No hay garantía del orden de procesamiento de estas peticiones. +Muchos contenedores respetan el valor `STOPSIGNAL` definido en la imagen del +contenedor y, si es diferente, envían el valor de `STOPSIGNAL` en lugar de +SIGTERM. + +Una vez que el período de gracia ha acabado, +se envía la señal KILL a cualquier processo restante, y luego el Pod se elimina +del {{< glossary_tooltip text="Servidor API" term_id="kube-apiserver" >}}. +Si el kubelet o el tiempo de ejecución del contenedor del servicio que lo +administra se reinicia mientras espera que los procesos terminen, el kubelet +reintenta de nuevo el proceso incluyendo el periodo original de gracia. + +Un flujo de ejemplo: + +1. Utilizas la herramienta `kubectl` para eliminar manualmente un Pod + específico, con un periodo de gracia por defecto (30 segundos). + +1. El Pod en el servidor API se actualiza con el tiempo más allá del cual el Pod + se considera "muerto" + junto con el periodo de gracia. + Si utilizas `kubectl describe` para revisar el Pod que estás borrando, + ese Pod se mostrará como `Terminating`. + En el nodo donde se ejecuta el Pod: tan pronto como el kubelet observa que el + Pod se ha marcado como terminando (se ha definido una duración de parada con + gracia), el kubelet comienza el proceso local de parar el Pod. + +1. Si uno de los contenedores del Pod tiene definido + un [hook](/docs/concepts/containers/container-lifecycle-hooks) `preStop` y + el `terminationGracePeriodSeconds` en la especificación del Pod no está + definido en 0, el kubelet ejecuta ese hook dentro del contenedor. + El `terminationGracePeriodSeconds` por defecto es 30 segundos. + + Si el hook `preStop` todavía se está ejecutando luego de la expiración del + período de gracia, el kubelet solicita una extensión 2 segundos del periodo + de gracia. + + {{< note >}} + Si el hook `preStop` necesita más tiempo para completar que el tiempo + permitido por defecto, + debes modificar el `terminationGracePeriodSeconds` para adaptarlo. + {{< /note >}} + +1. El kubelet lanza el tiempo de ejecución del contenedor para enviar una + señal TERM al proceso 1 dentro de cada contenedor. + {{< note >}} + Los contenedores en el Pod reciben la señal TERM en tiempos diferentes y en + orden arbitrario. + Si el orden de finalización importa, considera utilizar un hook `preStop` + para sincronizarlos. + {{< /note >}} + +1. Al mismo tiempo que el kubelet inicia la finalización con gracia del Pod, el + panel de control evalúa si quitar este Pod en finalización de los + objetos `EndpointSlice` (y `Endpoints`), donde aquellos objetos representan + un {{< glossary_tooltip term_id="service" text=" Service" >}} con un {{< + glossary_tooltip text="selector" term_id="selector" >}} configurado. + + Los {{< glossary_tooltip text="ReplicaSets" term_id="replica-set" >}} y otros + recursos de carga de trabajo ya no consideran al Pod como réplica válida, en + servicio. + + Los Pods que finalizan lentamente no servirían tráfico regular y debería + iniciar la finalización de procesamiento de conexiones abiertas. + Algunas aplicaciones necesitan ir más allá de finalizar las conexiones + abiertas y necesitan finalización aún con más gracia, por ejemplo, drenar y + completar una sesión. + + Cualquier endpoint que representa los Pods en finalización no son removidos + inmediatamente de `EndpointSlices` y se expone un estatus indicando + el [estado de terminación](/docs/concepts/services-networking/endpoint-slices/#conditions) + de la API de EndpointSlice + (y la API de Endpoint legada). + Los endpoints que están terminando siempre tienen su estatus `ready` + como `false` (para compatibilidad con versiones anteriores a 1.26), por lo + que los balanceadores de carga no los usarán para tráfico regular. + + Si se necesita drenar el tráfico en un Pod que está terminando, + el readiness se puede revisar con la condición `serving`. + Puedes encontrar más detalles en cómo implementar drenado de conexiones en el + tutorial [Pods y flujo de terminación de Endpoints](/docs/tutorials/services/pods-and-endpoint-termination-flow/) + +{{}} +Si no tienes la `EndpointSliceTerminatingCondition` habilitada en tu clúster (la +característica está habilitada por defecto desde Kubernetes 1.22, y se bloquea en +1.26), entonces el plano de control de Kubernetes elimina un Pod de cualquier +EndpointSlices relevante tan pronto como inicia el período de gracia terminación +del Pod. +El comportamiento descrito arriba aplica para cuando la característica `EndpointSliceTerminatingCondition` está habilitada. +{{}} + +{{}} +A partir de Kubernetes 1.29, si tu Pod incluye uno o más contenedores sidecars +(contenedores de inicialización con política de reinicio `AlwaysRestart`), el +kubelet retrasará enviar la señal TERM a estos contenedores sidecar hasta que el +último contenedor principal del Pod haya finalizado. + +Los contenedores sidecar terminarán en el orden inverso del que están definidos +en la especificación del Pod. +Esto asegura que los contenedores sidecar continúen sirviendo a los demás +contenedores en el Pod mientras no se necesitan más. + +Ten en cuenta que la terminación lenta de un controlador principal también +retrasará la terminación de los contenedores sidecar. +Si el período de gracia expira antes que acabe el proceso de terminación, el Pod +entrará en terminación de emergencia. +En este caso, todos los contenedores restantes en el Pod se terminarán +simultáneamente con un período de gracia corto. + +Igualmente, si el Pod tiene un hook `PreStop` que excede el périodo de gracia de +finalización, puede ocurrir una terminación de emergencia. +En general, si has usado hooks de `preStop` para controlar el orden de +terminación sin contenedores sidecar, puedes quitarlos y permitir que el kubelet +los administre automáticamente. +{{}} + +1. Cuando expira el tiempo de gracia, + el kubelet lanza un apagado forzado. + El tiempo de ejecución del contenedor envía una señal `SIGKILL`a cualquier + proceso que se esté ejecutando en cualquier contenedor en el Pod. + El kubelet también limpia un contenedor `pause` escondido si ese tiempo de + ejecución del contenedor usa uno. +1. El kubelet hace una transición del Pod a fase terminal + (`Failed` o `Succeeded`, dependiendo del estado de sus contenedores). + Este paso está garantizado desde la versión 1.27. +1. El kubelet lanza la eliminación forzada del objeto Pod del servidor API, + estableciendo el período de gracia a 0 (detención inmediata). +1. El servidor API borra el objeto API del Pod, + que ya no es visible desde ningún cliente. + +### Terminación Forzada del Pod {#pod-termination-forced} + +{{< caution >}} +Eliminaciones forzadas pueden ser potencialmente disruptivas para algunas cargas +de trabajo y sus Pods. +{{< /caution >}} + +Por defecto, todas las eliminaciones tienen un tiempo de gracia de 30 segundos. +El comando `kubelet delete` soporta la opción `--grace-period=` que +permite sobreescribir el valor por defecto y especificar tu propio valor. + +Establecer el período de gracia a `0` elimina de forma forzada e inmediata el +Pod del servidor API. +Si el Pod aún se está ejecutando en un nodo, esa eliminación forzada hace que +el kubelet inicie una limpieza inmediata. + +{{< note >}} +Debes especificar una opción adicional `--force` junto con `--grace-period=0` +para realizar eliminaciones forzadas. +{{< /note >}} + +Cuando se realiza una eliminación forzada, +el servidor API no espera la confirmación del kubelet de que el Pod ha terminado +en el nodo en que se está ejecutando. +Este elimina el Pod en la API inmediatamente para que se pueda crear un Pod con +el mismo nombre. +En el nodo, los Pods que están por terminar inmediatamente aún pueden tener un +pequeño período de gracia antes de ser eliminados de forma forzada. + +{{< caution >}} +La eliminación inmediata no espera la confirmación de que el recurso en ejecución +ha terminado. +El recurso puede continuar ejecutándose en el clúster de forma indefinida. +{{< /caution >}} + +Si necesitas eliminar Pods por la fuerza y son parte de un `StatefulSet`, +mira la documentación +para [borrar Pods de un StatefulSet](/docs/tasks/run-application/force-delete-stateful-set-pod/). + +### Recolección de elementos no utilizados de los Pods {#pod-garbage-collection} + +Cuando los Pods fallan, +los objetos API permanecen en el clúster hasta que un humano o el proceso de {{< +glossary_tooltip term_id="controller" text="controlador" >}} los elimina +explícitamente. + +El recolector de elementos no utilizados (PodGC en inglés) es un controlador en +el plano de control que elimina los Pods que se han terminado (con una fase +de `Succeeded` o `Failed`), cuando el número de Pods excede el umbral +configurado (determinado por `terminated-pod-gc-threshold` en el controlador de +kube-controller-manager). +Esto evita la fuga de recursos mientras que los Pods se crean y se eliminan en +el tiempo. + +Adicionalmente, +el PodGC limpia cualquier Pod que satisfaga cualquiera de las siguiente +condiciones: + +1. Pods huérfanos - asociados a un Nodo que ya no existe, +1. Pods que están finalizando y no están programados, +1. Pods que están finalizando, + asociados a un nodo que no está listo, contaminado + con [`node.kubernetes.io/out-of-service`](/docs/reference/labels-annotations-taints/#node-kubernetes-io-out-of-service), + cuando la condición `NodeOutOfServiceVolumeDetach` está habilitada. + +Cuando la condición `PodDisruptionCondition` está habilitada, +además de limpiar los Pods, +el PodGC también los marcará como fallidos si están en una fase no terminal. +También, el PodGC agrega una condición de disrupción del Pod cuando realiza la limpieza de un Pod huérfano. +Mira [condiciones de disrupción del Pod](/docs/concepts/workloads/pods/disruptions#pod-disruption-conditions) para más detalles. + +## {{% heading "whatsnext" %}} + +* Obtén experiencia práctica + [agregar controladores a los eventos del ciclo de vida del contenedor](/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/). + +* Obtén experiencia práctica + [configurar sondas de Liveness, Readiness y Startup](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/). + +* Aprende más sobre [hooks del ciclo de vida del contenedor](/docs/concepts/containers/container-lifecycle-hooks/). + +* Aprende más sobre [contenedores sidecar](/docs/concepts/workloads/pods/sidecar-containers/). + +* Para información detallada sobre el estatus del contenedor del Pod en la API, + mira la documentación de referencia de la API que cubre el [`status`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodStatus) del Pod. \ No newline at end of file From 5540f0a77dfeb8ae71802144876a59010e7c0ee2 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Fri, 19 Jul 2024 10:18:44 +0200 Subject: [PATCH 008/408] chore: Localize pod lifecycle to Spanish solves #45708 --- .../concepts/workloads/pods/pod-lifecycle.md | 48 ++++++++----------- 1 file changed, 20 insertions(+), 28 deletions(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index 5a0e7dfb17..8283fd34dc 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -50,22 +50,18 @@ se [programan para eliminarse](#pod-garbage-collection) luego de un periodo de tiempo. Los Pods, por sí mismos, no se curan automáticamente. -Si un Pod está programado para un {{< glossary_tooltip text="node" -term_id="node" >}} y luego falla, +Si un Pod está programado para un {{< glossary_tooltip text="nodo" term_id="node" >}} y luego falla, el Pod se elimina; de la misma manera, un Pod no sobrevivirá a un desalojo debido a falta de recursos o mantenimiento del Nodo. -Kubernetes utiliza una abstracción llamada {{< glossary_tooltip term_id=" -controller" -text="controlador" >}}, que maneja el trabajo de administrar las instancias de +Kubernetes utiliza una abstracción llamada {{< glossary_tooltip term_id=" controller" text="controlador" >}}, que maneja el trabajo de administrar las instancias de Pod relativamente desechables. Un Pod dado (definido por un UID) nunca se reprograma a un Nodo diferente; en su lugar, ese Pod se puede reemplazar por un Pod nuevo, casi idéntico, incluso con el mismo nombre si se desea, pero con un UID diferente. -{{< figure src="/images/docs/pod.svg" title="Diagrama de un Pod" class=" -diagram-medium" >}} +{{< figure src="/images/docs/pod.svg" title="Diagrama de un Pod" class=" diagram-medium" >}} Un Pod con múltiples contenedores que contiene un extractor de ficheros y un servidor web que usa un volumen persistente para compartir datos entre los @@ -74,8 +70,7 @@ contenedores. ## Fase del Pod El campo `status` de un Pod es un objeto [PodStatus]( -/docs/reference/generated/kubernetes-api/{{< param "version" > -}}/#podstatus-v1-core) de Kubernetes que tiene un campo `phase`. +/docs/reference/generated/kubernetes-api/{{< param "version" > }}/#podstatus-v1-core) de Kubernetes que tiene un campo `phase`. La fase de un Pod es un resumen simple y de alto nivel de dónde se encuentra el Pod en su ciclo de vida. La fase no pretende ser un resumen completo de @@ -128,11 +123,10 @@ usar [hooks del ciclo de vida de un contenedor](/docs/concepts/containers/contai para lanzar eventos en ciertos puntos en el ciclo de vida de un contenedor. -Una vez que el {{< glossary_tooltip text="programador" -term_id="kube-scheduler" >}} asigna un Pod a un Nodo, -el kubelet inicia creando los contenedores para ese Pod usando un {{< -glossary_tooltip text="espacio de ejecución del contenedor" -term_id="container-runtime" >}}. +Una vez que el {{< glossary_tooltip text="programador" term_id="kube-scheduler" >}} +asigna un Pod a un Nodo, +el kubelet inicia creando los contenedores para ese Pod usando un +{{< glossary_tooltip text="espacio de ejecución del contenedor" term_id="container-runtime" >}}. Hay 3 estados posibles para un contenedor: `Waiting`, `Running`, y `Terminated`. Para revisar el estado de los contenedores de un Pod, @@ -176,8 +170,8 @@ La especificación (`spec` en inglés) de un Pod tiene un campo `restartPolicy` valores `Always`, `OnFailure`, y `Never`. El valor por defecto es `Always`. -La política de reinicio (`restartPolicy` en inglés) para un Pod aplica a {{< glossary_tooltip text="contenedores -de apps" term_id="app-container" >}} en el Pod +La política de reinicio (`restartPolicy` en inglés) para un Pod aplica a +{{< glossary_tooltip text="contenedores de apps" term_id="app-container" >}} en el Pod para [contenedores de inicialización](/docs/concepts/workloads/pods/init-containers/) regulares. Los [contenedores sidecar](/docs/concepts/workloads/pods/sidecar-containers/) ignoran el campo `restartPolicy`: en Kubernetes, un sidecar se define como una @@ -202,8 +196,8 @@ especifica una `restartPolicy`. ## Condiciones del Pod {#pod-conditions} Un Pod tiene un `PodStatus`, que tiene un listado de [PodConditions]( -/docs/reference/generated/kubernetes-api/{{< param "version" > -}}/#podcondition-v1-core) a través de los cuales el Pod ha pasado o no. +/docs/reference/generated/kubernetes-api/{{< param "version" > }}/#podcondition-v1-core) +a través de los cuales el Pod ha pasado o no. El kubelet administra las siguientes condiciones del Pod: * `PodScheduled`: El Pod está programado para un nodo. @@ -305,12 +299,11 @@ Durante su desarrollo temprano, esta condición se llamaba `PodhasNetwork`. Luego que un Pod es programado en un nodo, el kubelet debe admitirlo y tener los volúmenes de almacenamiento necesarios montados. Una vez que estas fases están completadas, el kubelet trabaja con un tiempo de ejecución del -contenedor para crear un espacio de ejecución (usando {{< glossary_tooltip -term_id="cri" >}})y configurar la red para el Pod. +contenedor para crear un espacio de ejecución (usando {{< glossary_tooltip¯ term_id="cri" >}}) +y configurar la red para el Pod. Si la [condición](/docs/reference/command-line-tools-reference/feature-gates/) `PodReadyToStartContainersCondition` -está habilitada (está habilitada por defecto para Kubernetes {{< skew -currentVersion >}}), la condición `PodReadyToStartContainers` se agrega al +está habilitada (está habilitada por defecto para Kubernetes {{< skew currentVersion >}}), la condición `PodReadyToStartContainers` se agrega al campo `status.conditions` del Pod. La condición `PodReadyToStartContainers` se establece a `False` por el kubelet @@ -523,8 +516,8 @@ Pod y saber cuándo finalizan los procesos, pero también para asegurar que la eliminación se completa eventualmente. Cuando solicitas la eliminación de un Pod, el clúster registra y rastrea el periodo de gracia antes de que el Pod se elimine por la fuerza. -Con este rastreo de detención forzada en marcha, el {{< glossary_tooltip text=" -kubelet" term_id="kubelet" >}} intenta pararlo con gracia. +Con este rastreo de detención forzada en marcha, +el {{< glossary_tooltip text=" kubelet" term_id="kubelet" >}} intenta pararlo con gracia. Típicamente, con esta finalización con gracia del Pod, el kubelet hace peticiones al tiempo de ejecución del contenedor para intentar detener los @@ -586,8 +579,7 @@ Un flujo de ejemplo: 1. Al mismo tiempo que el kubelet inicia la finalización con gracia del Pod, el panel de control evalúa si quitar este Pod en finalización de los objetos `EndpointSlice` (y `Endpoints`), donde aquellos objetos representan - un {{< glossary_tooltip term_id="service" text=" Service" >}} con un {{< - glossary_tooltip text="selector" term_id="selector" >}} configurado. + un {{< glossary_tooltip term_id="service" text=" Service" >}} con un {{< glossary_tooltip text="selector" term_id="selector" >}} configurado. Los {{< glossary_tooltip text="ReplicaSets" term_id="replica-set" >}} y otros recursos de carga de trabajo ya no consideran al Pod como réplica válida, en @@ -703,8 +695,8 @@ para [borrar Pods de un StatefulSet](/docs/tasks/run-application/force-delete-st ### Recolección de elementos no utilizados de los Pods {#pod-garbage-collection} Cuando los Pods fallan, -los objetos API permanecen en el clúster hasta que un humano o el proceso de {{< -glossary_tooltip term_id="controller" text="controlador" >}} los elimina +los objetos API permanecen en el clúster hasta que un humano o el proceso de +{{< glossary_tooltip term_id="controller" text="controlador" >}} los elimina explícitamente. El recolector de elementos no utilizados (PodGC en inglés) es un controlador en From 251c93ed7f0557b5d27afbaca69a3b7853a6dd97 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Fri, 19 Jul 2024 15:27:17 +0200 Subject: [PATCH 009/408] fix: Localize pod lifecycle to Spanish Fix rendering solves #45708 --- .../concepts/workloads/pods/pod-lifecycle.md | 133 +++++++++++------- 1 file changed, 83 insertions(+), 50 deletions(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index 8283fd34dc..8e7205865d 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -10,7 +10,7 @@ Los Pods siguen un ciclo de vida definido, comenzando en la fase [`Pending`]( #pod-phase), y luego pasando a "en ejecución" `Running` si al menos uno de sus contenedores primarios se inicia correctamente, -y luego pasando a "exitoso"(`Succeeded`) o "fallido" (`Failed`) si uno de los contenedores de un Pod +y luego pasando a "exitoso" (`Succeeded`) o "fallido" (`Failed`) si uno de los contenedores de un Pod termina en error. Mientras un Pod está en `Running`, @@ -54,10 +54,7 @@ Si un Pod está programado para un {{< glossary_tooltip text="nodo" term_id="nod el Pod se elimina; de la misma manera, un Pod no sobrevivirá a un desalojo debido a falta de recursos o mantenimiento del Nodo. -Kubernetes utiliza una abstracción llamada {{< glossary_tooltip term_id=" controller" text="controlador" >}}, que maneja el trabajo de administrar las instancias de -Pod relativamente desechables. - -Un Pod dado (definido por un UID) nunca se reprograma a un Nodo diferente; en su +Kubernetes utiliza una abstracción llamada {{< glossary_tooltip term_id="controller" text="controlador" >}}, que maneja el trabajo de administrar las instancias de lugar, ese Pod se puede reemplazar por un Pod nuevo, casi idéntico, incluso con el mismo nombre si se desea, pero con un UID diferente. @@ -69,8 +66,9 @@ contenedores. ## Fase del Pod -El campo `status` de un Pod es un objeto [PodStatus]( -/docs/reference/generated/kubernetes-api/{{< param "version" > }}/#podstatus-v1-core) de Kubernetes que tiene un campo `phase`. +El campo `status` de un Pod es un objeto +[PodStatus](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podstatus-v1-core) +de Kubernetes que tiene un campo `phase`. La fase de un Pod es un resumen simple y de alto nivel de dónde se encuentra el Pod en su ciclo de vida. La fase no pretende ser un resumen completo de @@ -123,9 +121,9 @@ usar [hooks del ciclo de vida de un contenedor](/docs/concepts/containers/contai para lanzar eventos en ciertos puntos en el ciclo de vida de un contenedor. -Una vez que el {{< glossary_tooltip text="programador" term_id="kube-scheduler" >}} +Una vez que el {{< glossary_tooltip text="programador" term_id="kube-scheduler" >}} asigna un Pod a un Nodo, -el kubelet inicia creando los contenedores para ese Pod usando un +el kubelet inicia creando los contenedores para ese Pod usando un {{< glossary_tooltip text="espacio de ejecución del contenedor" term_id="container-runtime" >}}. Hay 3 estados posibles para un contenedor: `Waiting`, `Running`, y `Terminated`. @@ -170,7 +168,7 @@ La especificación (`spec` en inglés) de un Pod tiene un campo `restartPolicy` valores `Always`, `OnFailure`, y `Never`. El valor por defecto es `Always`. -La política de reinicio (`restartPolicy` en inglés) para un Pod aplica a +La política de reinicio (`restartPolicy` en inglés) para un Pod aplica a {{< glossary_tooltip text="contenedores de apps" term_id="app-container" >}} en el Pod para [contenedores de inicialización](/docs/concepts/workloads/pods/init-containers/) regulares. Los [contenedores sidecar](/docs/concepts/workloads/pods/sidecar-containers/) @@ -193,10 +191,11 @@ kubelet restablece el temporizador de reinicio para ese contenedor. explica el comportamiento de `init containers` cuando especifica una `restartPolicy`. + ## Condiciones del Pod {#pod-conditions} -Un Pod tiene un `PodStatus`, que tiene un listado de [PodConditions]( -/docs/reference/generated/kubernetes-api/{{< param "version" > }}/#podcondition-v1-core) +Un Pod tiene un `PodStatus`, que tiene un listado de +[PodConditions](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podcondition-v1-core) a través de los cuales el Pod ha pasado o no. El kubelet administra las siguientes condiciones del Pod: @@ -296,43 +295,79 @@ en `ContainersReady`. Durante su desarrollo temprano, esta condición se llamaba `PodhasNetwork`. {{< /note >}} -Luego que un Pod es programado en un nodo, el kubelet debe admitirlo y tener los -volúmenes de almacenamiento necesarios montados. -Una vez que estas fases están completadas, el kubelet trabaja con un tiempo de ejecución del -contenedor para crear un espacio de ejecución (usando {{< glossary_tooltip¯ term_id="cri" >}}) -y configurar la red para el Pod. -Si -la [condición](/docs/reference/command-line-tools-reference/feature-gates/) `PodReadyToStartContainersCondition` -está habilitada (está habilitada por defecto para Kubernetes {{< skew currentVersion >}}), la condición `PodReadyToStartContainers` se agrega al -campo `status.conditions` del Pod. +{{< feature-state for_k8s_version="v1.14" state="stable" >}} -La condición `PodReadyToStartContainers` se establece a `False` por el kubelet -cuando detecta que un Pod no tiene un entorno de pruebas en tiempo de ejecución -con red configurada. -Esto ocurre en los siguientes escenarios: +Tu aplicación puede inyectar retroalimentación adicional o señales +al `PodStatus`: +_Pod readiness_. +Para usar esto, establece `readinessGates` en la `spec` del Pod para especificar una +lista de condiciones adicionales que el kubelet evalúa para la preparación del +Pod. -- Temprano en el ciclo de vida del Pod, cuando el kubelet no ha comenzado a - configurar un entorno de pruebas para que el Pod que utiliza el contenedor en - tiempo de ejecución. -- Luego durante el ciclo de vida del Pod, cuando el entorno de pruebas del Pod - ha sido destruido debido a: - - El nodo ha reiniciado, sin desalojar el Pod. - - Para los tiempos de ejecución de contenedores que utilizan máquinas virtuales para el aislamiento, la máquina virtual de la zona de pruebas del Pod se reinicia, lo que luego requiere la creación de una nueva zona de pruebas y una nueva configuración de red de contenedores. +Las condiciones de preparación están determinadas por el estado actual de los +campos `status.conditions` de un Pod. +Si Kubernetes no puede encontrar una condición en el campo `status.conditions` +de un Pod, el estado de la condición se establece en "`False`". -La condición `PodReadyToStartContainers` se establece a `True` por el kubelet -luego de completar exitosamente la creación del espacio de pruebas y la -configuración de red para el Pod por el complemento de tiempo de ejecución. -El kubelet puede comenzar a descargar las imágenes del contenedor y crear -contenedores luego que la condición `PodReadyToStartContainers` se establece -a `True`. +Aquí hay un ejemplo: -Para un Pod con contenedores de inicio, el kubelet establece la -condición `Initialized` a `True` luego que los contenedores de inicio se -completaron con éxito (esto ocurre luego de la creación exitosa del espacio de -pruebas y la configuración de red por el complemento de tiempo de ejecución). -Para un Pod sin contenedores de inicio, el kubelet establece la -condición `Initialized` a `False` antes que inicie la creación del espacio de -pruebas y la configuración de red. +```yaml +kind: Pod +... +spec: + readinessGates: + - conditionType: "www.example.com/feature-1" +status: + conditions: + - type: Ready # una PodCondition construida + status: "False" + lastProbeTime: null + lastTransitionTime: 2018-01-01T00:00:00Z + - type: "www.example.com/feature-1" # una PodCondition extra + status: "False" + lastProbeTime: null + lastTransitionTime: 2018-01-01T00:00:00Z + containerStatuses: + - containerID: docker://abcd... + ready: true +... +``` + +Las condiciones del Pod que incluyas deben tener nombres que sean válidos para +los [formatos de etiqueta](/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set) +de Kubernetes. + +### Estado de preparación del Pod {#pod-readiness-status} + +El comando `kubectl patch` no admite actualizar el estado del objeto. +Para establecer estas `status.conditions` para el Pod, las aplicaciones y +los {{< glossary_tooltip term_id="operator-pattern" text="operadores">}} +deberían utilizar la acción `Patch`. + +Puedes utilizar +una [librería cliente de Kubernetes](/docs/reference/using-api/client-libraries/) +para escribir código que establece condiciones personalizadas de un Pod para su +preparación. + +Para los Pods que utilizan condiciones personalizadas, ese Pod es evaluado para +estar listo **solamente** cuando ambas afirmaciones aplican: + +* Todos los contenedores del Pod están listos. +* Todas las condiciones personalizadas especificadas en `readinessGates` + están `True`. + +Cuando los contenedores de un Pod están listos, pero al menos una condición +personalizada está ausente o `False`, +el kubelet establece la [condición](#pod-conditions) del Pod +en `ContainersReady`. + +### Preparación de la red del Pod {#pod-has-network} + +{{< feature-state for_k8s_version="v1.29" state="beta" >}} + +{{< note >}} +Durante su desarrollo temprano, esta condición se llamaba `PodhasNetwork`. +{{< /note >}} ### Preparación de la programación del Pod {#pod-scheduling-readiness-gate} @@ -377,7 +412,6 @@ El diagnóstico se considera exitoso si el puerto está abierto. Si el sistema remoto (el contenedor) cierra la conexión inmediatamente después de abrir la conexión, el diagnóstico se considera exitoso. - {{< caution >}} A diferencia de otros mecanismos, la implementación de la sonda `exec` involucra la creación/bifuración de múltiples procesos cada vez que se ejecuta. @@ -516,7 +550,7 @@ Pod y saber cuándo finalizan los procesos, pero también para asegurar que la eliminación se completa eventualmente. Cuando solicitas la eliminación de un Pod, el clúster registra y rastrea el periodo de gracia antes de que el Pod se elimine por la fuerza. -Con este rastreo de detención forzada en marcha, +Con este rastreo de detención forzada en marcha, el {{< glossary_tooltip text=" kubelet" term_id="kubelet" >}} intenta pararlo con gracia. Típicamente, con esta finalización con gracia del Pod, el kubelet hace @@ -691,11 +725,10 @@ El recurso puede continuar ejecutándose en el clúster de forma indefinida. Si necesitas eliminar Pods por la fuerza y son parte de un `StatefulSet`, mira la documentación para [borrar Pods de un StatefulSet](/docs/tasks/run-application/force-delete-stateful-set-pod/). - ### Recolección de elementos no utilizados de los Pods {#pod-garbage-collection} Cuando los Pods fallan, -los objetos API permanecen en el clúster hasta que un humano o el proceso de +los objetos API permanecen en el clúster hasta que un humano o el proceso de {{< glossary_tooltip term_id="controller" text="controlador" >}} los elimina explícitamente. @@ -726,7 +759,7 @@ Mira [condiciones de disrupción del Pod](/docs/concepts/workloads/pods/disrupti ## {{% heading "whatsnext" %}} -* Obtén experiencia práctica +* Obtén experiencia práctica [agregar controladores a los eventos del ciclo de vida del contenedor](/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/). * Obtén experiencia práctica From c4763d99bec929d71a7b130a9da102d10e07b722 Mon Sep 17 00:00:00 2001 From: Ritikaa96 Date: Tue, 2 Jul 2024 18:15:17 +0530 Subject: [PATCH 010/408] added watch to glossary Signed-off-by: Ritikaa96 --- content/en/docs/reference/glossary/watch.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 content/en/docs/reference/glossary/watch.md diff --git a/content/en/docs/reference/glossary/watch.md b/content/en/docs/reference/glossary/watch.md new file mode 100644 index 0000000000..f1770b540a --- /dev/null +++ b/content/en/docs/reference/glossary/watch.md @@ -0,0 +1,20 @@ +--- +title: Watch +id: watch +date: 2024-07-02 +full_link: /docs/reference/using-api/api-concepts/#api-verbs +short_description: > + A verb that is used to track changes to an object in Kubernetes as a stream. + +aka: +tags: +- core-object +- fundamental +--- +A verb that is used to track changes to an object in Kubernetes as a stream. It is used for the excellent detection of changes. + + + +A verb that is used to track changes to an object in Kubernetes as a stream. It is used for the excellent detection of changes when this request is made to Kubernetes API or when HTTP GET request is made with watch query. + +See [Efficient Detection of Changes in API Concepts](/docs/reference/using-api/api-concepts/#efficient-detection-of-changes) for more information. From 5053a95f53085b5fe9bcd6d7fe28896f4473d597 Mon Sep 17 00:00:00 2001 From: Ritikaa96 Date: Thu, 4 Jul 2024 19:39:12 +0530 Subject: [PATCH 011/408] Adding glossary tooltip for watch in k/docs Signed-off-by: Ritikaa96 --- .../docs/concepts/overview/working-with-objects/labels.md | 2 +- .../en/docs/concepts/workloads/controllers/deployment.md | 2 +- .../en/docs/reference/access-authn-authz/authorization.md | 2 +- .../access-authn-authz/certificate-signing-requests.md | 2 +- content/en/docs/reference/glossary/watch.md | 7 +++++-- content/en/docs/reference/using-api/api-concepts.md | 2 +- .../en/docs/tasks/job/automated-tasks-with-cron-jobs.md | 2 +- .../tutorials/stateful-application/basic-stateful-set.md | 2 +- 8 files changed, 12 insertions(+), 9 deletions(-) diff --git a/content/en/docs/concepts/overview/working-with-objects/labels.md b/content/en/docs/concepts/overview/working-with-objects/labels.md index 8a488206d9..93bb28dc3b 100644 --- a/content/en/docs/concepts/overview/working-with-objects/labels.md +++ b/content/en/docs/concepts/overview/working-with-objects/labels.md @@ -201,7 +201,7 @@ For example: `partition in (customerA, customerB),environment!=qa`. ### LIST and WATCH filtering -LIST and WATCH operations may specify label selectors to filter the sets of objects +LIST and {{< glossary_tooltip text="WATCH" term_id="watch" >}} operations may specify label selectors to filter the sets of objects returned using a query parameter. Both requirements are permitted (presented here as they would appear in a URL query string): diff --git a/content/en/docs/concepts/workloads/controllers/deployment.md b/content/en/docs/concepts/workloads/controllers/deployment.md index e39e6f0f81..c07886183d 100644 --- a/content/en/docs/concepts/workloads/controllers/deployment.md +++ b/content/en/docs/concepts/workloads/controllers/deployment.md @@ -813,7 +813,7 @@ apply multiple fixes in between pausing and resuming without triggering unnecess ``` deployment.apps/nginx-deployment resumed ``` -* Watch the status of the rollout until it's done. +* {{< glossary_tooltip text="Watch" term_id="watch" >}} the status of the rollout until it's done. ```shell kubectl get rs -w ``` diff --git a/content/en/docs/reference/access-authn-authz/authorization.md b/content/en/docs/reference/access-authn-authz/authorization.md index 6d4ebb0b60..d80d843bad 100644 --- a/content/en/docs/reference/access-authn-authz/authorization.md +++ b/content/en/docs/reference/access-authn-authz/authorization.md @@ -61,7 +61,7 @@ Kubernetes reviews only the following API request attributes: * **extra** - A map of arbitrary string keys to string values, provided by the authentication layer. * **API** - Indicates whether the request is for an API resource. * **Request path** - Path to miscellaneous non-resource endpoints like `/api` or `/healthz`. - * **API request verb** - API verbs like `get`, `list`, `create`, `update`, `patch`, `watch`, `delete`, and `deletecollection` are used for resource requests. To determine the request verb for a resource API endpoint, see [request verbs and authorization](/docs/reference/access-authn-authz/authorization/#determine-the-request-verb). + * **API request verb** - API verbs like `get`, `list`, `create`, `update`, `patch`, `{{< glossary_tooltip text="watch" term_id="watch" >}}`, `delete`, and `deletecollection` are used for resource requests. To determine the request verb for a resource API endpoint, see [request verbs and authorization](/docs/reference/access-authn-authz/authorization/#determine-the-request-verb). * **HTTP request verb** - Lowercased HTTP methods like `get`, `post`, `put`, and `delete` are used for non-resource requests. * **Resource** - The ID or name of the resource that is being accessed (for resource requests only) -- For resource requests using `get`, `update`, `patch`, and `delete` verbs, you must provide the resource name. * **Subresource** - The subresource that is being accessed (for resource requests only). diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index e5eefc1d60..fe6b012dd7 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -407,7 +407,7 @@ the bundle with their own arbitrary but stable ordering. ClusterTrustBundle objects should be considered world-readable within the cluster. If your cluster uses [RBAC](/docs/reference/access-authn-authz/rbac/) authorization, all ServiceAccounts have a default grant that allows them to -**get**, **list**, and **watch** all ClusterTrustBundle objects. +**get**, **list**, and **{{< glossary_tooltip text="watch" term_id="watch" >}}** all ClusterTrustBundle objects. If you use your own authorization mechanism and you have enabled ClusterTrustBundles in your cluster, you should set up an equivalent rule to make these objects public within the cluster, so that they work as intended. diff --git a/content/en/docs/reference/glossary/watch.md b/content/en/docs/reference/glossary/watch.md index f1770b540a..e2f4ff7418 100644 --- a/content/en/docs/reference/glossary/watch.md +++ b/content/en/docs/reference/glossary/watch.md @@ -8,13 +8,16 @@ short_description: > aka: tags: -- core-object +- API verb - fundamental --- A verb that is used to track changes to an object in Kubernetes as a stream. It is used for the excellent detection of changes. -A verb that is used to track changes to an object in Kubernetes as a stream. It is used for the excellent detection of changes when this request is made to Kubernetes API or when HTTP GET request is made with watch query. +A verb that is used to track changes to an object in Kubernetes as a stream. Watches allow +efficient detection of changes; for example, a +{{< glossary_tooltip term_id="controller" text="controller">}} that needs to know whenever a +ConfigMap has changed can use a watch rather than polling. See [Efficient Detection of Changes in API Concepts](/docs/reference/using-api/api-concepts/#efficient-detection-of-changes) for more information. diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index acd54e8030..36df9e8e9f 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -19,7 +19,7 @@ fine grained authorization (such as separate views for Pod details and log retrievals), and can accept and serve those resources in different representations for convenience or efficiency. -Kubernetes supports efficient change notifications on resources via *watches*. +Kubernetes supports efficient change notifications on resources via *{{< glossary_tooltip text="watches" term_id="watch" >}}*. Kubernetes also provides consistent list operations so that API clients can effectively cache, track, and synchronize the state of resources. diff --git a/content/en/docs/tasks/job/automated-tasks-with-cron-jobs.md b/content/en/docs/tasks/job/automated-tasks-with-cron-jobs.md index af9cd0c95e..1f91a2da87 100644 --- a/content/en/docs/tasks/job/automated-tasks-with-cron-jobs.md +++ b/content/en/docs/tasks/job/automated-tasks-with-cron-jobs.md @@ -49,7 +49,7 @@ hello */1 * * * * False 0 10s ``` As you can see from the results of the command, the cron job has not scheduled or run any jobs yet. -Watch for the job to be created in around one minute: +{{< glossary_tooltip text="Watch" term_id="watch" >}} for the job to be created in around one minute: ```shell kubectl get jobs --watch diff --git a/content/en/docs/tutorials/stateful-application/basic-stateful-set.md b/content/en/docs/tutorials/stateful-application/basic-stateful-set.md index 4fe4bb864f..f2ea4591b3 100644 --- a/content/en/docs/tutorials/stateful-application/basic-stateful-set.md +++ b/content/en/docs/tutorials/stateful-application/basic-stateful-set.md @@ -77,7 +77,7 @@ It creates a [headless Service](/docs/concepts/services-networking/service/#head {{% code_sample file="application/web/web.yaml" %}} You will need to use at least two terminal windows. In the first terminal, use -[`kubectl get`](/docs/reference/generated/kubectl/kubectl-commands/#get) to watch the creation +[`kubectl get`](/docs/reference/generated/kubectl/kubectl-commands/#get) to {{< glossary_tooltip text="watch" term_id="watch" >}} the creation of the StatefulSet's Pods. ```shell From 53dc63aec82e78b7e5174e9cd98382ac628c0165 Mon Sep 17 00:00:00 2001 From: Ritikaa96 Date: Mon, 8 Jul 2024 10:46:13 +0530 Subject: [PATCH 012/408] editing as per the reviews. Signed-off-by: Ritikaa96 --- .../docs/concepts/overview/working-with-objects/labels.md | 7 +++++-- .../en/docs/concepts/workloads/controllers/deployment.md | 2 +- .../en/docs/reference/access-authn-authz/authorization.md | 2 +- .../access-authn-authz/certificate-signing-requests.md | 2 +- content/en/docs/reference/glossary/watch.md | 3 ++- content/en/docs/reference/using-api/api-concepts.md | 4 +++- 6 files changed, 13 insertions(+), 7 deletions(-) diff --git a/content/en/docs/concepts/overview/working-with-objects/labels.md b/content/en/docs/concepts/overview/working-with-objects/labels.md index 93bb28dc3b..d12a84a30d 100644 --- a/content/en/docs/concepts/overview/working-with-objects/labels.md +++ b/content/en/docs/concepts/overview/working-with-objects/labels.md @@ -201,8 +201,11 @@ For example: `partition in (customerA, customerB),environment!=qa`. ### LIST and WATCH filtering -LIST and {{< glossary_tooltip text="WATCH" term_id="watch" >}} operations may specify label selectors to filter the sets of objects -returned using a query parameter. Both requirements are permitted +For **list** and **watch** operations, you can specify label selectors to filter the sets of objects +returned; you specify the filter using a query parameter. +(To learn in detail about watches in Kubernetes, read +[efficient detection of changes](/docs/reference/using-api/api-concepts/#efficient-detection-of-changes)). +Both requirements are permitted (presented here as they would appear in a URL query string): * _equality-based_ requirements: `?labelSelector=environment%3Dproduction,tier%3Dfrontend` diff --git a/content/en/docs/concepts/workloads/controllers/deployment.md b/content/en/docs/concepts/workloads/controllers/deployment.md index c07886183d..5dc8bfb6d4 100644 --- a/content/en/docs/concepts/workloads/controllers/deployment.md +++ b/content/en/docs/concepts/workloads/controllers/deployment.md @@ -815,7 +815,7 @@ apply multiple fixes in between pausing and resuming without triggering unnecess ``` * {{< glossary_tooltip text="Watch" term_id="watch" >}} the status of the rollout until it's done. ```shell - kubectl get rs -w + kubectl get rs --watch ``` The output is similar to this: diff --git a/content/en/docs/reference/access-authn-authz/authorization.md b/content/en/docs/reference/access-authn-authz/authorization.md index d80d843bad..6d4ebb0b60 100644 --- a/content/en/docs/reference/access-authn-authz/authorization.md +++ b/content/en/docs/reference/access-authn-authz/authorization.md @@ -61,7 +61,7 @@ Kubernetes reviews only the following API request attributes: * **extra** - A map of arbitrary string keys to string values, provided by the authentication layer. * **API** - Indicates whether the request is for an API resource. * **Request path** - Path to miscellaneous non-resource endpoints like `/api` or `/healthz`. - * **API request verb** - API verbs like `get`, `list`, `create`, `update`, `patch`, `{{< glossary_tooltip text="watch" term_id="watch" >}}`, `delete`, and `deletecollection` are used for resource requests. To determine the request verb for a resource API endpoint, see [request verbs and authorization](/docs/reference/access-authn-authz/authorization/#determine-the-request-verb). + * **API request verb** - API verbs like `get`, `list`, `create`, `update`, `patch`, `watch`, `delete`, and `deletecollection` are used for resource requests. To determine the request verb for a resource API endpoint, see [request verbs and authorization](/docs/reference/access-authn-authz/authorization/#determine-the-request-verb). * **HTTP request verb** - Lowercased HTTP methods like `get`, `post`, `put`, and `delete` are used for non-resource requests. * **Resource** - The ID or name of the resource that is being accessed (for resource requests only) -- For resource requests using `get`, `update`, `patch`, and `delete` verbs, you must provide the resource name. * **Subresource** - The subresource that is being accessed (for resource requests only). diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index fe6b012dd7..e5eefc1d60 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -407,7 +407,7 @@ the bundle with their own arbitrary but stable ordering. ClusterTrustBundle objects should be considered world-readable within the cluster. If your cluster uses [RBAC](/docs/reference/access-authn-authz/rbac/) authorization, all ServiceAccounts have a default grant that allows them to -**get**, **list**, and **{{< glossary_tooltip text="watch" term_id="watch" >}}** all ClusterTrustBundle objects. +**get**, **list**, and **watch** all ClusterTrustBundle objects. If you use your own authorization mechanism and you have enabled ClusterTrustBundles in your cluster, you should set up an equivalent rule to make these objects public within the cluster, so that they work as intended. diff --git a/content/en/docs/reference/glossary/watch.md b/content/en/docs/reference/glossary/watch.md index e2f4ff7418..e1057ec882 100644 --- a/content/en/docs/reference/glossary/watch.md +++ b/content/en/docs/reference/glossary/watch.md @@ -11,7 +11,8 @@ tags: - API verb - fundamental --- -A verb that is used to track changes to an object in Kubernetes as a stream. It is used for the excellent detection of changes. +A verb that is used to track changes to an object in Kubernetes as a stream. +It is used for the efficient detection of changes. diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index 36df9e8e9f..baed3d8bed 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -19,7 +19,9 @@ fine grained authorization (such as separate views for Pod details and log retrievals), and can accept and serve those resources in different representations for convenience or efficiency. -Kubernetes supports efficient change notifications on resources via *{{< glossary_tooltip text="watches" term_id="watch" >}}*. +Kubernetes supports efficient change notifications on resources via +_watches_: +{{< glossary_definition prepend="in the Kubernetes API, watch is" term_id="watch" length="short" >}} Kubernetes also provides consistent list operations so that API clients can effectively cache, track, and synchronize the state of resources. From c0f001dd1884f512549bfcad01949fb3701e1665 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Mon, 29 Jul 2024 15:33:05 +0200 Subject: [PATCH 013/408] Update content/es/docs/concepts/workloads/pods/pod-lifecycle.md Co-authored-by: Dipesh Rawat --- content/es/docs/concepts/workloads/pods/pod-lifecycle.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index 8e7205865d..dcd08049d5 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -6,8 +6,7 @@ weight: 30 Esta página describe el ciclo de vida de un Pod. -Los Pods siguen un ciclo de vida definido, comenzando en la fase [`Pending`]( -#pod-phase), +Los Pods siguen un ciclo de vida definido, comenzando en la fase [`Pending`](#pod-phase), y luego pasando a "en ejecución" `Running` si al menos uno de sus contenedores primarios se inicia correctamente, y luego pasando a "exitoso" (`Succeeded`) o "fallido" (`Failed`) si uno de los contenedores de un Pod From 2a7b40332f6e5782a4a4047a366549b9b1893f52 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Mon, 29 Jul 2024 15:35:41 +0200 Subject: [PATCH 014/408] Update content/es/docs/concepts/workloads/pods/pod-lifecycle.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rodolfo Martínez Vega --- content/es/docs/concepts/workloads/pods/pod-lifecycle.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index dcd08049d5..3dd90d0fa1 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -39,7 +39,7 @@ se considera que los Pods son entidades relativamente efímeras (en lugar de durables). Los Pods se crean y se les asigna un identificador único -([UID](/docs/concepts/overview/working-with-objects/names/#uids)), +([UID](/es/docs/concepts/overview/working-with-objects/names/#uids)), y se programan para ejecutarse en nodos donde se mantienen hasta que se terminan (de acuerdo con las políticas de reinicio) o se eliminan. From 67444e07b143e0e9854f9baeef211ebc2da8efe3 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Mon, 29 Jul 2024 15:36:10 +0200 Subject: [PATCH 015/408] Update content/es/docs/concepts/workloads/pods/pod-lifecycle.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rodolfo Martínez Vega --- .../docs/concepts/workloads/pods/pod-lifecycle.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index 3dd90d0fa1..779a3be0f9 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -53,9 +53,18 @@ Si un Pod está programado para un {{< glossary_tooltip text="nodo" term_id="nod el Pod se elimina; de la misma manera, un Pod no sobrevivirá a un desalojo debido a falta de recursos o mantenimiento del Nodo. -Kubernetes utiliza una abstracción llamada {{< glossary_tooltip term_id="controller" text="controlador" >}}, que maneja el trabajo de administrar las instancias de -lugar, ese Pod se puede reemplazar por un Pod nuevo, casi idéntico, incluso con -el mismo nombre si se desea, pero con un UID diferente. +Kubernetes utiliza una abstracción llamada {{< glossary_tooltip term_id="controller" text="controlador" >}}, que se encarga del trabajo de gestionar las instancias de Pod relativamente desechables. + +Un Pod determinado (según lo definido por un UID) nunca se "reprograma" a un nodo diferente; en cambio, +ese Pod puede ser reemplazado por un Pod nuevo, casi idéntico, incluso con el mismo nombre si +deseado, pero con un UID diferente. + +Cuando se dice que algo tiene la misma vida útil que un Pod, como un +{{< glosario_tooltip term_id="volume" text="volumen" >}}, +eso significa que la cosa existe mientras ese Pod específico (con ese UID exacto) +existe. Si ese Pod se elimina por cualquier motivo, e incluso si se requiere un reemplazo idéntico +se crea, el objeto relacionado (un volumen, en este ejemplo) también se destruye y +creado de nuevo. {{< figure src="/images/docs/pod.svg" title="Diagrama de un Pod" class=" diagram-medium" >}} From 899c0a8e975dd927c041eab936729bc70d5a9903 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Mon, 29 Jul 2024 16:08:25 +0200 Subject: [PATCH 016/408] fix: Localize pod lifecycle to Spanish pr reviews solves #45708 --- .../concepts/workloads/pods/pod-lifecycle.md | 2 +- package-lock.json | 911 ++++++++++++------ 2 files changed, 616 insertions(+), 297 deletions(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index 779a3be0f9..681e99456f 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -120,7 +120,7 @@ Si un Nodo muere o se desconecta del resto del clúster, Kubernetes aplica una política para establecer la `phase` de todos los Pods en `Failed`. -## Estados del contenedor +## Estados del contenedor {#container-states} Así como la fase del Pod en general, Kubernetes rastrea el estado de cada contenedor dentro de un Pod. diff --git a/package-lock.json b/package-lock.json index ab0163bc23..5392e8022a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,101 +1,132 @@ { + "name": "k8s-website", + "lockfileVersion": 3, "requires": true, - "lockfileVersion": 1, - "dependencies": { - "@babel/runtime-corejs3": { + "packages": { + "": { + "devDependencies": { + "autoprefixer": "^9.8.4", + "postcss-cli": "^7.1.1" + } + }, + "node_modules/@babel/runtime-corejs3": { "version": "7.10.4", "resolved": "https://registry.npmjs.org/@babel/runtime-corejs3/-/runtime-corejs3-7.10.4.tgz", "integrity": "sha512-BFlgP2SoLO9HJX9WBwN67gHWMBhDX/eDz64Jajd6mR/UAUzqrNMm99d4qHnVaKscAElZoFiPv+JpR/Siud5lXw==", "dev": true, - "requires": { + "dependencies": { "core-js-pure": "^3.0.0", "regenerator-runtime": "^0.13.4" } }, - "@nodelib/fs.scandir": { + "node_modules/@nodelib/fs.scandir": { "version": "2.1.3", "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.3.tgz", "integrity": "sha512-eGmwYQn3gxo4r7jdQnkrrN6bY478C3P+a/y72IJukF8LjB6ZHeB3c+Ehacj3sYeSmUXGlnA67/PmbM9CVwL7Dw==", "dev": true, - "requires": { + "dependencies": { "@nodelib/fs.stat": "2.0.3", "run-parallel": "^1.1.9" + }, + "engines": { + "node": ">= 8" } }, - "@nodelib/fs.stat": { + "node_modules/@nodelib/fs.stat": { "version": "2.0.3", "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.3.tgz", "integrity": "sha512-bQBFruR2TAwoevBEd/NWMoAAtNGzTRgdrqnYCc7dhzfoNvqPzLyqlEQnzZ3kVnNrSp25iyxE00/3h2fqGAGArA==", - "dev": true + "dev": true, + "engines": { + "node": ">= 8" + } }, - "@nodelib/fs.walk": { + "node_modules/@nodelib/fs.walk": { "version": "1.2.4", "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.4.tgz", "integrity": "sha512-1V9XOY4rDW0rehzbrcqAmHnz8e7SKvX27gh8Gt2WgB0+pdzdiLV83p72kZPU+jvMbS1qU5mauP2iOvO8rhmurQ==", "dev": true, - "requires": { + "dependencies": { "@nodelib/fs.scandir": "2.1.3", "fastq": "^1.6.0" + }, + "engines": { + "node": ">= 8" } }, - "@types/color-name": { + "node_modules/@types/color-name": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/@types/color-name/-/color-name-1.1.1.tgz", "integrity": "sha512-rr+OQyAjxze7GgWrSaJwydHStIhHq2lvY3BOC2Mj7KnzI7XK0Uw1TOOdI9lDoajEbSWLiYgoo4f1R51erQfhPQ==", "dev": true }, - "ansi-regex": { + "node_modules/ansi-regex": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz", "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==", - "dev": true + "dev": true, + "engines": { + "node": ">=8" + } }, - "ansi-styles": { + "node_modules/ansi-styles": { "version": "3.2.1", "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz", "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==", "dev": true, - "requires": { + "dependencies": { "color-convert": "^1.9.0" + }, + "engines": { + "node": ">=4" } }, - "anymatch": { + "node_modules/anymatch": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.1.tgz", "integrity": "sha512-mM8522psRCqzV+6LhomX5wgp25YVibjh8Wj23I5RPkPppSVSjyKD2A2mBJmWGa+KN7f2D6LNh9jkBCeyLktzjg==", "dev": true, - "requires": { + "dependencies": { "normalize-path": "^3.0.0", "picomatch": "^2.0.4" + }, + "engines": { + "node": ">= 8" } }, - "argparse": { + "node_modules/argparse": { "version": "1.0.10", "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz", "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==", "dev": true, - "requires": { + "dependencies": { "sprintf-js": "~1.0.2" } }, - "array-union": { + "node_modules/array-union": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz", "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==", - "dev": true + "dev": true, + "engines": { + "node": ">=8" + } }, - "at-least-node": { + "node_modules/at-least-node": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz", "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==", - "dev": true + "dev": true, + "engines": { + "node": ">= 4.0.0" + } }, - "autoprefixer": { + "node_modules/autoprefixer": { "version": "9.8.4", "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-9.8.4.tgz", "integrity": "sha512-84aYfXlpUe45lvmS+HoAWKCkirI/sw4JK0/bTeeqgHYco3dcsOn0NqdejISjptsYwNji/21dnkDri9PsYKk89A==", "dev": true, - "requires": { + "dependencies": { "browserslist": "^4.12.0", "caniuse-lite": "^1.0.30001087", "colorette": "^1.2.0", @@ -103,577 +134,780 @@ "num2fraction": "^1.2.2", "postcss": "^7.0.32", "postcss-value-parser": "^4.1.0" + }, + "bin": { + "autoprefixer": "bin/autoprefixer" + }, + "funding": { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/autoprefixer" } }, - "binary-extensions": { + "node_modules/binary-extensions": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.1.0.tgz", "integrity": "sha512-1Yj8h9Q+QDF5FzhMs/c9+6UntbD5MkRfRwac8DoEm9ZfUBZ7tZ55YcGVAzEe4bXsdQHEk+s9S5wsOKVdZrw0tQ==", - "dev": true + "dev": true, + "engines": { + "node": ">=8" + } }, - "braces": { + "node_modules/braces": { "version": "3.0.2", "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz", "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==", "dev": true, - "requires": { + "dependencies": { "fill-range": "^7.0.1" + }, + "engines": { + "node": ">=8" } }, - "browserslist": { + "node_modules/browserslist": { "version": "4.12.2", "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.12.2.tgz", "integrity": "sha512-MfZaeYqR8StRZdstAK9hCKDd2StvePCYp5rHzQCPicUjfFliDgmuaBNPHYUTpAywBN8+Wc/d7NYVFkO0aqaBUw==", "dev": true, - "requires": { + "dependencies": { "caniuse-lite": "^1.0.30001088", "electron-to-chromium": "^1.3.483", "escalade": "^3.0.1", "node-releases": "^1.1.58" + }, + "bin": { + "browserslist": "cli.js" + }, + "engines": { + "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7" + }, + "funding": { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/browserslist" } }, - "caller-callsite": { + "node_modules/caller-callsite": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/caller-callsite/-/caller-callsite-2.0.0.tgz", "integrity": "sha1-hH4PzgoiN1CpoCfFSzNzGtMVQTQ=", "dev": true, - "requires": { + "dependencies": { "callsites": "^2.0.0" + }, + "engines": { + "node": ">=4" } }, - "caller-path": { + "node_modules/caller-path": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/caller-path/-/caller-path-2.0.0.tgz", "integrity": "sha1-Ro+DBE42mrIBD6xfBs7uFbsssfQ=", "dev": true, - "requires": { + "dependencies": { "caller-callsite": "^2.0.0" + }, + "engines": { + "node": ">=4" } }, - "callsites": { + "node_modules/callsites": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/callsites/-/callsites-2.0.0.tgz", "integrity": "sha1-BuuE8A7qQT2oav/vrL/7Ngk7PFA=", - "dev": true + "dev": true, + "engines": { + "node": ">=4" + } }, - "camelcase": { + "node_modules/camelcase": { "version": "5.3.1", "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz", "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==", - "dev": true + "dev": true, + "engines": { + "node": ">=6" + } }, - "caniuse-lite": { + "node_modules/caniuse-lite": { "version": "1.0.30001093", "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001093.tgz", "integrity": "sha512-0+ODNoOjtWD5eS9aaIpf4K0gQqZfILNY4WSNuYzeT1sXni+lMrrVjc0odEobJt6wrODofDZUX8XYi/5y7+xl8g==", "dev": true }, - "chalk": { + "node_modules/chalk": { "version": "2.4.2", "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz", "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==", "dev": true, - "requires": { + "dependencies": { "ansi-styles": "^3.2.1", "escape-string-regexp": "^1.0.5", "supports-color": "^5.3.0" }, - "dependencies": { - "supports-color": { - "version": "5.5.0", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz", - "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==", - "dev": true, - "requires": { - "has-flag": "^3.0.0" - } - } + "engines": { + "node": ">=4" } }, - "chokidar": { + "node_modules/chalk/node_modules/supports-color": { + "version": "5.5.0", + "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz", + "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==", + "dev": true, + "dependencies": { + "has-flag": "^3.0.0" + }, + "engines": { + "node": ">=4" + } + }, + "node_modules/chokidar": { "version": "3.4.0", "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.4.0.tgz", "integrity": "sha512-aXAaho2VJtisB/1fg1+3nlLJqGOuewTzQpd/Tz0yTg2R0e4IGtshYvtjowyEumcBv2z+y4+kc75Mz7j5xJskcQ==", "dev": true, - "requires": { + "dependencies": { "anymatch": "~3.1.1", "braces": "~3.0.2", - "fsevents": "~2.1.2", "glob-parent": "~5.1.0", "is-binary-path": "~2.1.0", "is-glob": "~4.0.1", "normalize-path": "~3.0.0", "readdirp": "~3.4.0" + }, + "engines": { + "node": ">= 8.10.0" + }, + "optionalDependencies": { + "fsevents": "~2.1.2" } }, - "cliui": { + "node_modules/cliui": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz", "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==", "dev": true, - "requires": { + "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.0", "wrap-ansi": "^6.2.0" } }, - "color-convert": { + "node_modules/color-convert": { "version": "1.9.3", "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz", "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==", "dev": true, - "requires": { + "dependencies": { "color-name": "1.1.3" } }, - "color-name": { + "node_modules/color-name": { "version": "1.1.3", "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz", "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=", "dev": true }, - "colorette": { + "node_modules/colorette": { "version": "1.2.0", "resolved": "https://registry.npmjs.org/colorette/-/colorette-1.2.0.tgz", "integrity": "sha512-soRSroY+OF/8OdA3PTQXwaDJeMc7TfknKKrxeSCencL2a4+Tx5zhxmmv7hdpCjhKBjehzp8+bwe/T68K0hpIjw==", "dev": true }, - "core-js-pure": { + "node_modules/core-js-pure": { "version": "3.6.5", "resolved": "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.6.5.tgz", "integrity": "sha512-lacdXOimsiD0QyNf9BC/mxivNJ/ybBGJXQFKzRekp1WTHoVUWsUHEn+2T8GJAzzIhyOuXA+gOxCVN3l+5PLPUA==", - "dev": true + "deprecated": "core-js-pure@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js-pure.", + "dev": true, + "hasInstallScript": true, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/core-js" + } }, - "cosmiconfig": { + "node_modules/cosmiconfig": { "version": "5.2.1", "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-5.2.1.tgz", "integrity": "sha512-H65gsXo1SKjf8zmrJ67eJk8aIRKV5ff2D4uKZIBZShbhGSpEmsQOPW/SKMKYhSTrqR7ufy6RP69rPogdaPh/kA==", "dev": true, - "requires": { + "dependencies": { "import-fresh": "^2.0.0", "is-directory": "^0.3.1", "js-yaml": "^3.13.1", "parse-json": "^4.0.0" + }, + "engines": { + "node": ">=4" } }, - "decamelize": { + "node_modules/decamelize": { "version": "3.2.0", "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-3.2.0.tgz", "integrity": "sha512-4TgkVUsmmu7oCSyGBm5FvfMoACuoh9EOidm7V5/J2X2djAwwt57qb3F2KMP2ITqODTCSwb+YRV+0Zqrv18k/hw==", "dev": true, - "requires": { + "dependencies": { "xregexp": "^4.2.4" + }, + "engines": { + "node": ">=6" } }, - "dependency-graph": { + "node_modules/dependency-graph": { "version": "0.9.0", "resolved": "https://registry.npmjs.org/dependency-graph/-/dependency-graph-0.9.0.tgz", "integrity": "sha512-9YLIBURXj4DJMFALxXw9K3Y3rwb5Fk0X5/8ipCzaN84+gKxoHK43tVKRNakCQbiEx07E8Uwhuq21BpUagFhZ8w==", - "dev": true + "dev": true, + "engines": { + "node": ">= 0.6.0" + } }, - "dir-glob": { + "node_modules/dir-glob": { "version": "3.0.1", "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz", "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==", "dev": true, - "requires": { + "dependencies": { "path-type": "^4.0.0" + }, + "engines": { + "node": ">=8" } }, - "electron-to-chromium": { + "node_modules/electron-to-chromium": { "version": "1.3.487", "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.487.tgz", "integrity": "sha512-m4QS3IDShxauFfYFpnEzRCcUI55oKB9acEnHCuY/hSCZMz9Pz2KJj+UBnGHxRxS/mS1aphqOQ5wI6gc3yDZ7ew==", "dev": true }, - "emoji-regex": { + "node_modules/emoji-regex": { "version": "8.0.0", "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz", "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==", "dev": true }, - "error-ex": { + "node_modules/error-ex": { "version": "1.3.2", "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.2.tgz", "integrity": "sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==", "dev": true, - "requires": { + "dependencies": { "is-arrayish": "^0.2.1" } }, - "escalade": { + "node_modules/escalade": { "version": "3.0.1", "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.0.1.tgz", "integrity": "sha512-DR6NO3h9niOT+MZs7bjxlj2a1k+POu5RN8CLTPX2+i78bRi9eLe7+0zXgUHMnGXWybYcL61E9hGhPKqedy8tQA==", - "dev": true + "dev": true, + "engines": { + "node": ">=6" + } }, - "escape-string-regexp": { + "node_modules/escape-string-regexp": { "version": "1.0.5", "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz", "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ=", - "dev": true + "dev": true, + "engines": { + "node": ">=0.8.0" + } }, - "esprima": { + "node_modules/esprima": { "version": "4.0.1", "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz", "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==", - "dev": true + "dev": true, + "bin": { + "esparse": "bin/esparse.js", + "esvalidate": "bin/esvalidate.js" + }, + "engines": { + "node": ">=4" + } }, - "fast-glob": { + "node_modules/fast-glob": { "version": "3.2.4", "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.4.tgz", "integrity": "sha512-kr/Oo6PX51265qeuCYsyGypiO5uJFgBS0jksyG7FUeCyQzNwYnzrNIMR1NXfkZXsMYXYLRAHgISHBz8gQcxKHQ==", "dev": true, - "requires": { + "dependencies": { "@nodelib/fs.stat": "^2.0.2", "@nodelib/fs.walk": "^1.2.3", "glob-parent": "^5.1.0", "merge2": "^1.3.0", "micromatch": "^4.0.2", "picomatch": "^2.2.1" + }, + "engines": { + "node": ">=8" } }, - "fastq": { + "node_modules/fastq": { "version": "1.8.0", "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.8.0.tgz", "integrity": "sha512-SMIZoZdLh/fgofivvIkmknUXyPnvxRE3DhtZ5Me3Mrsk5gyPL42F0xr51TdRXskBxHfMp+07bcYzfsYEsSQA9Q==", "dev": true, - "requires": { + "dependencies": { "reusify": "^1.0.4" } }, - "fill-range": { + "node_modules/fill-range": { "version": "7.0.1", "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz", "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==", "dev": true, - "requires": { + "dependencies": { "to-regex-range": "^5.0.1" + }, + "engines": { + "node": ">=8" } }, - "find-up": { + "node_modules/find-up": { "version": "4.1.0", "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==", "dev": true, - "requires": { + "dependencies": { "locate-path": "^5.0.0", "path-exists": "^4.0.0" + }, + "engines": { + "node": ">=8" } }, - "fs-extra": { + "node_modules/fs-extra": { "version": "9.0.1", "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.0.1.tgz", "integrity": "sha512-h2iAoN838FqAFJY2/qVpzFXy+EBxfVE220PalAqQLDVsFOHLJrZvut5puAbCdNv6WJk+B8ihI+k0c7JK5erwqQ==", "dev": true, - "requires": { + "dependencies": { "at-least-node": "^1.0.0", "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^1.0.0" + }, + "engines": { + "node": ">=10" } }, - "fsevents": { + "node_modules/fsevents": { "version": "2.1.3", "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.1.3.tgz", "integrity": "sha512-Auw9a4AxqWpa9GUfj370BMPzzyncfBABW8Mab7BGWBYDj4Isgq+cDKtx0i6u9jcX9pQDnswsaaOTgTmA5pEjuQ==", + "deprecated": "\"Please update to latest v2.3 or v2.2\"", "dev": true, - "optional": true + "hasInstallScript": true, + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^8.16.0 || ^10.6.0 || >=11.0.0" + } }, - "get-caller-file": { + "node_modules/get-caller-file": { "version": "2.0.5", "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz", "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==", - "dev": true + "dev": true, + "engines": { + "node": "6.* || 8.* || >= 10.*" + } }, - "get-stdin": { + "node_modules/get-stdin": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/get-stdin/-/get-stdin-7.0.0.tgz", "integrity": "sha512-zRKcywvrXlXsA0v0i9Io4KDRaAw7+a1ZpjRwl9Wox8PFlVCCHra7E9c4kqXCoCM9nR5tBkaTTZRBoCm60bFqTQ==", - "dev": true + "dev": true, + "engines": { + "node": ">=8" + } }, - "glob-parent": { + "node_modules/glob-parent": { "version": "5.1.1", "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz", "integrity": "sha512-FnI+VGOpnlGHWZxthPGR+QhR78fuiK0sNLkHQv+bL9fQi57lNNdquIbna/WrfROrolq8GK5Ek6BiMwqL/voRYQ==", "dev": true, - "requires": { + "dependencies": { "is-glob": "^4.0.1" + }, + "engines": { + "node": ">= 6" } }, - "globby": { + "node_modules/globby": { "version": "11.0.1", "resolved": "https://registry.npmjs.org/globby/-/globby-11.0.1.tgz", "integrity": "sha512-iH9RmgwCmUJHi2z5o2l3eTtGBtXek1OYlHrbcxOYugyHLmAsZrPj43OtHThd62Buh/Vv6VyCBD2bdyWcGNQqoQ==", "dev": true, - "requires": { + "dependencies": { "array-union": "^2.1.0", "dir-glob": "^3.0.1", "fast-glob": "^3.1.1", "ignore": "^5.1.4", "merge2": "^1.3.0", "slash": "^3.0.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" } }, - "graceful-fs": { + "node_modules/graceful-fs": { "version": "4.2.4", "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.4.tgz", "integrity": "sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw==", "dev": true }, - "has-flag": { + "node_modules/has-flag": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz", "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=", - "dev": true + "dev": true, + "engines": { + "node": ">=4" + } }, - "ignore": { + "node_modules/ignore": { "version": "5.1.8", "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.1.8.tgz", "integrity": "sha512-BMpfD7PpiETpBl/A6S498BaIJ6Y/ABT93ETbby2fP00v4EbvPBXWEoaR1UBPKs3iR53pJY7EtZk5KACI57i1Uw==", - "dev": true + "dev": true, + "engines": { + "node": ">= 4" + } }, - "import-cwd": { + "node_modules/import-cwd": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/import-cwd/-/import-cwd-2.1.0.tgz", "integrity": "sha1-qmzzbnInYShcs3HsZRn1PiQ1sKk=", "dev": true, - "requires": { + "dependencies": { "import-from": "^2.1.0" + }, + "engines": { + "node": ">=4" } }, - "import-fresh": { + "node_modules/import-fresh": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-2.0.0.tgz", "integrity": "sha1-2BNVwVYS04bGH53dOSLUMEgipUY=", "dev": true, - "requires": { + "dependencies": { "caller-path": "^2.0.0", "resolve-from": "^3.0.0" + }, + "engines": { + "node": ">=4" } }, - "import-from": { + "node_modules/import-from": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/import-from/-/import-from-2.1.0.tgz", "integrity": "sha1-M1238qev/VOqpHHUuAId7ja387E=", "dev": true, - "requires": { + "dependencies": { "resolve-from": "^3.0.0" + }, + "engines": { + "node": ">=4" } }, - "is-arrayish": { + "node_modules/is-arrayish": { "version": "0.2.1", "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz", "integrity": "sha1-d8mYQFJ6qOyxqLppe4BkWnqSap0=", "dev": true }, - "is-binary-path": { + "node_modules/is-binary-path": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz", "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==", "dev": true, - "requires": { + "dependencies": { "binary-extensions": "^2.0.0" + }, + "engines": { + "node": ">=8" } }, - "is-directory": { + "node_modules/is-directory": { "version": "0.3.1", "resolved": "https://registry.npmjs.org/is-directory/-/is-directory-0.3.1.tgz", "integrity": "sha1-YTObbyR1/Hcv2cnYP1yFddwVSuE=", - "dev": true + "dev": true, + "engines": { + "node": ">=0.10.0" + } }, - "is-extglob": { + "node_modules/is-extglob": { "version": "2.1.1", "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz", "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=", - "dev": true + "dev": true, + "engines": { + "node": ">=0.10.0" + } }, - "is-fullwidth-code-point": { + "node_modules/is-fullwidth-code-point": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz", "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==", - "dev": true + "dev": true, + "engines": { + "node": ">=8" + } }, - "is-glob": { + "node_modules/is-glob": { "version": "4.0.1", "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.1.tgz", "integrity": "sha512-5G0tKtBTFImOqDnLB2hG6Bp2qcKEFduo4tZu9MT/H6NQv/ghhy30o55ufafxJ/LdH79LLs2Kfrn85TLKyA7BUg==", "dev": true, - "requires": { + "dependencies": { "is-extglob": "^2.1.1" + }, + "engines": { + "node": ">=0.10.0" } }, - "is-number": { + "node_modules/is-number": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz", "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==", - "dev": true + "dev": true, + "engines": { + "node": ">=0.12.0" + } }, - "js-yaml": { + "node_modules/js-yaml": { "version": "3.14.0", "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.0.tgz", "integrity": "sha512-/4IbIeHcD9VMHFqDR/gQ7EdZdLimOvW2DdcxFjdyyZ9NsbS+ccrXqVWDtab/lRl5AlUqmpBx8EhPaWR+OtY17A==", "dev": true, - "requires": { + "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" } }, - "json-parse-better-errors": { + "node_modules/json-parse-better-errors": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz", "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==", "dev": true }, - "jsonfile": { + "node_modules/jsonfile": { "version": "6.0.1", "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.0.1.tgz", "integrity": "sha512-jR2b5v7d2vIOust+w3wtFKZIfpC2pnRmFAhAC/BuweZFQR8qZzxH1OyrQ10HmdVYiXWkYUqPVsz91cG7EL2FBg==", "dev": true, - "requires": { - "graceful-fs": "^4.1.6", + "dependencies": { "universalify": "^1.0.0" + }, + "optionalDependencies": { + "graceful-fs": "^4.1.6" } }, - "locate-path": { + "node_modules/locate-path": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz", "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==", "dev": true, - "requires": { + "dependencies": { "p-locate": "^4.1.0" + }, + "engines": { + "node": ">=8" } }, - "lodash": { + "node_modules/lodash": { "version": "4.17.15", "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz", "integrity": "sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==", "dev": true }, - "log-symbols": { + "node_modules/log-symbols": { "version": "2.2.0", "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-2.2.0.tgz", "integrity": "sha512-VeIAFslyIerEJLXHziedo2basKbMKtTw3vfn5IzG0XTjhAVEJyNHnL2p7vc+wBDSdQuUpNw3M2u6xb9QsAY5Eg==", "dev": true, - "requires": { + "dependencies": { "chalk": "^2.0.1" + }, + "engines": { + "node": ">=4" } }, - "merge2": { + "node_modules/merge2": { "version": "1.4.1", "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz", "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==", - "dev": true + "dev": true, + "engines": { + "node": ">= 8" + } }, - "micromatch": { + "node_modules/micromatch": { "version": "4.0.2", "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.2.tgz", "integrity": "sha512-y7FpHSbMUMoyPbYUSzO6PaZ6FyRnQOpHuKwbo1G+Knck95XVU4QAiKdGEnj5wwoS7PlOgthX/09u5iFJ+aYf5Q==", "dev": true, - "requires": { + "dependencies": { "braces": "^3.0.1", "picomatch": "^2.0.5" + }, + "engines": { + "node": ">=8" } }, - "node-releases": { + "node_modules/node-releases": { "version": "1.1.58", "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-1.1.58.tgz", "integrity": "sha512-NxBudgVKiRh/2aPWMgPR7bPTX0VPmGx5QBwCtdHitnqFE5/O8DeBXuIMH1nwNnw/aMo6AjOrpsHzfY3UbUJ7yg==", "dev": true }, - "normalize-path": { + "node_modules/normalize-path": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz", "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==", - "dev": true + "dev": true, + "engines": { + "node": ">=0.10.0" + } }, - "normalize-range": { + "node_modules/normalize-range": { "version": "0.1.2", "resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz", "integrity": "sha1-LRDAa9/TEuqXd2laTShDlFa3WUI=", - "dev": true + "dev": true, + "engines": { + "node": ">=0.10.0" + } }, - "num2fraction": { + "node_modules/num2fraction": { "version": "1.2.2", "resolved": "https://registry.npmjs.org/num2fraction/-/num2fraction-1.2.2.tgz", "integrity": "sha1-b2gragJ6Tp3fpFZM0lidHU5mnt4=", "dev": true }, - "p-limit": { + "node_modules/p-limit": { "version": "2.3.0", "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz", "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==", "dev": true, - "requires": { + "dependencies": { "p-try": "^2.0.0" + }, + "engines": { + "node": ">=6" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" } }, - "p-locate": { + "node_modules/p-locate": { "version": "4.1.0", "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz", "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==", "dev": true, - "requires": { + "dependencies": { "p-limit": "^2.2.0" + }, + "engines": { + "node": ">=8" } }, - "p-try": { + "node_modules/p-try": { "version": "2.2.0", "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz", "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==", - "dev": true + "dev": true, + "engines": { + "node": ">=6" + } }, - "parse-json": { + "node_modules/parse-json": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-4.0.0.tgz", "integrity": "sha1-vjX1Qlvh9/bHRxhPmKeIy5lHfuA=", "dev": true, - "requires": { + "dependencies": { "error-ex": "^1.3.1", "json-parse-better-errors": "^1.0.1" + }, + "engines": { + "node": ">=4" } }, - "path-exists": { + "node_modules/path-exists": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz", "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==", - "dev": true + "dev": true, + "engines": { + "node": ">=8" + } }, - "path-type": { + "node_modules/path-type": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz", "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==", - "dev": true + "dev": true, + "engines": { + "node": ">=8" + } }, - "picomatch": { + "node_modules/picomatch": { "version": "2.2.2", "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.2.2.tgz", "integrity": "sha512-q0M/9eZHzmr0AulXyPwNfZjtwZ/RBZlbN3K3CErVrk50T2ASYI7Bye0EvekFY3IP1Nt2DHu0re+V2ZHIpMkuWg==", - "dev": true + "dev": true, + "engines": { + "node": ">=8.6" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } }, - "pify": { + "node_modules/pify": { "version": "2.3.0", "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz", "integrity": "sha1-7RQaasBDqEnqWISY59yosVMw6Qw=", - "dev": true + "dev": true, + "engines": { + "node": ">=0.10.0" + } }, - "postcss": { + "node_modules/postcss": { "version": "7.0.32", "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.32.tgz", "integrity": "sha512-03eXong5NLnNCD05xscnGKGDZ98CyzoqPSMjOe6SuoQY7Z2hIj0Ld1g/O/UQRuOle2aRtiIRDg9tDcTGAkLfKw==", "dev": true, - "requires": { + "dependencies": { "chalk": "^2.4.2", "source-map": "^0.6.1", "supports-color": "^6.1.0" + }, + "engines": { + "node": ">=6.0.0" + }, + "funding": { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" } }, - "postcss-cli": { + "node_modules/postcss-cli": { "version": "7.1.1", "resolved": "https://registry.npmjs.org/postcss-cli/-/postcss-cli-7.1.1.tgz", "integrity": "sha512-bYQy5ydAQJKCMSpvaMg0ThPBeGYqhQXumjbFOmWnL4u65CYXQ16RfS6afGQpit0dGv/fNzxbdDtx8dkqOhhIbg==", "dev": true, - "requires": { + "dependencies": { "chalk": "^4.0.0", "chokidar": "^3.3.0", "dependency-graph": "^0.9.0", @@ -687,280 +921,358 @@ "read-cache": "^1.0.0", "yargs": "^15.0.2" }, - "dependencies": { - "ansi-styles": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.2.1.tgz", - "integrity": "sha512-9VGjrMsG1vePxcSweQsN20KY/c4zN0h9fLjqAbwbPfahM3t+NL+M9HC8xeXG2I8pX5NoamTGNuomEUFI7fcUjA==", - "dev": true, - "requires": { - "@types/color-name": "^1.1.1", - "color-convert": "^2.0.1" - } - }, - "chalk": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.0.tgz", - "integrity": "sha512-qwx12AxXe2Q5xQ43Ac//I6v5aXTipYrSESdOgzrN+9XjgEpyjpKuvSGaN4qE93f7TQTlerQQ8S+EQ0EyDoVL1A==", - "dev": true, - "requires": { - "ansi-styles": "^4.1.0", - "supports-color": "^7.1.0" - } - }, - "color-convert": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", - "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", - "dev": true, - "requires": { - "color-name": "~1.1.4" - } - }, - "color-name": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz", - "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==", - "dev": true - }, - "has-flag": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz", - "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==", - "dev": true - }, - "supports-color": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.1.0.tgz", - "integrity": "sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==", - "dev": true, - "requires": { - "has-flag": "^4.0.0" - } - } + "bin": { + "postcss": "bin/postcss" + }, + "engines": { + "node": ">=10" } }, - "postcss-load-config": { + "node_modules/postcss-cli/node_modules/ansi-styles": { + "version": "4.2.1", + "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.2.1.tgz", + "integrity": "sha512-9VGjrMsG1vePxcSweQsN20KY/c4zN0h9fLjqAbwbPfahM3t+NL+M9HC8xeXG2I8pX5NoamTGNuomEUFI7fcUjA==", + "dev": true, + "dependencies": { + "@types/color-name": "^1.1.1", + "color-convert": "^2.0.1" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, + "node_modules/postcss-cli/node_modules/chalk": { + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.0.tgz", + "integrity": "sha512-qwx12AxXe2Q5xQ43Ac//I6v5aXTipYrSESdOgzrN+9XjgEpyjpKuvSGaN4qE93f7TQTlerQQ8S+EQ0EyDoVL1A==", + "dev": true, + "dependencies": { + "ansi-styles": "^4.1.0", + "supports-color": "^7.1.0" + }, + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/chalk/chalk?sponsor=1" + } + }, + "node_modules/postcss-cli/node_modules/color-convert": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", + "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", + "dev": true, + "dependencies": { + "color-name": "~1.1.4" + }, + "engines": { + "node": ">=7.0.0" + } + }, + "node_modules/postcss-cli/node_modules/color-name": { + "version": "1.1.4", + "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz", + "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==", + "dev": true + }, + "node_modules/postcss-cli/node_modules/has-flag": { + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz", + "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==", + "dev": true, + "engines": { + "node": ">=8" + } + }, + "node_modules/postcss-cli/node_modules/supports-color": { + "version": "7.1.0", + "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.1.0.tgz", + "integrity": "sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==", + "dev": true, + "dependencies": { + "has-flag": "^4.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/postcss-load-config": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-2.1.0.tgz", "integrity": "sha512-4pV3JJVPLd5+RueiVVB+gFOAa7GWc25XQcMp86Zexzke69mKf6Nx9LRcQywdz7yZI9n1udOxmLuAwTBypypF8Q==", "dev": true, - "requires": { + "dependencies": { "cosmiconfig": "^5.0.0", "import-cwd": "^2.0.0" + }, + "engines": { + "node": ">= 4" } }, - "postcss-reporter": { + "node_modules/postcss-reporter": { "version": "6.0.1", "resolved": "https://registry.npmjs.org/postcss-reporter/-/postcss-reporter-6.0.1.tgz", "integrity": "sha512-LpmQjfRWyabc+fRygxZjpRxfhRf9u/fdlKf4VHG4TSPbV2XNsuISzYW1KL+1aQzx53CAppa1bKG4APIB/DOXXw==", "dev": true, - "requires": { + "dependencies": { "chalk": "^2.4.1", "lodash": "^4.17.11", "log-symbols": "^2.2.0", "postcss": "^7.0.7" + }, + "engines": { + "node": ">=6" } }, - "postcss-value-parser": { + "node_modules/postcss-value-parser": { "version": "4.1.0", "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.1.0.tgz", "integrity": "sha512-97DXOFbQJhk71ne5/Mt6cOu6yxsSfM0QGQyl0L25Gca4yGWEGJaig7l7gbCX623VqTBNGLRLaVUCnNkcedlRSQ==", "dev": true }, - "pretty-hrtime": { + "node_modules/pretty-hrtime": { "version": "1.0.3", "resolved": "https://registry.npmjs.org/pretty-hrtime/-/pretty-hrtime-1.0.3.tgz", "integrity": "sha1-t+PqQkNaTJsnWdmeDyAesZWALuE=", - "dev": true + "dev": true, + "engines": { + "node": ">= 0.8" + } }, - "read-cache": { + "node_modules/read-cache": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/read-cache/-/read-cache-1.0.0.tgz", "integrity": "sha1-5mTvMRYRZsl1HNvo28+GtftY93Q=", "dev": true, - "requires": { + "dependencies": { "pify": "^2.3.0" } }, - "readdirp": { + "node_modules/readdirp": { "version": "3.4.0", "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.4.0.tgz", "integrity": "sha512-0xe001vZBnJEK+uKcj8qOhyAKPzIT+gStxWr3LCB0DwcXR5NZJ3IaC+yGnHCYzB/S7ov3m3EEbZI2zeNvX+hGQ==", "dev": true, - "requires": { + "dependencies": { "picomatch": "^2.2.1" + }, + "engines": { + "node": ">=8.10.0" } }, - "regenerator-runtime": { + "node_modules/regenerator-runtime": { "version": "0.13.5", "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.5.tgz", "integrity": "sha512-ZS5w8CpKFinUzOwW3c83oPeVXoNsrLsaCoLtJvAClH135j/R77RuymhiSErhm2lKcwSCIpmvIWSbDkIfAqKQlA==", "dev": true }, - "require-directory": { + "node_modules/require-directory": { "version": "2.1.1", "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz", "integrity": "sha1-jGStX9MNqxyXbiNE/+f3kqam30I=", - "dev": true + "dev": true, + "engines": { + "node": ">=0.10.0" + } }, - "require-main-filename": { + "node_modules/require-main-filename": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz", "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==", "dev": true }, - "resolve-from": { + "node_modules/resolve-from": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-3.0.0.tgz", "integrity": "sha1-six699nWiBvItuZTM17rywoYh0g=", - "dev": true + "dev": true, + "engines": { + "node": ">=4" + } }, - "reusify": { + "node_modules/reusify": { "version": "1.0.4", "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz", "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==", - "dev": true + "dev": true, + "engines": { + "iojs": ">=1.0.0", + "node": ">=0.10.0" + } }, - "run-parallel": { + "node_modules/run-parallel": { "version": "1.1.9", "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.1.9.tgz", "integrity": "sha512-DEqnSRTDw/Tc3FXf49zedI638Z9onwUotBMiUFKmrO2sdFKIbXamXGQ3Axd4qgphxKB4kw/qP1w5kTxnfU1B9Q==", "dev": true }, - "set-blocking": { + "node_modules/set-blocking": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz", "integrity": "sha1-BF+XgtARrppoA93TgrJDkrPYkPc=", "dev": true }, - "slash": { + "node_modules/slash": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz", "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==", - "dev": true + "dev": true, + "engines": { + "node": ">=8" + } }, - "source-map": { + "node_modules/source-map": { "version": "0.6.1", "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz", "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==", - "dev": true + "dev": true, + "engines": { + "node": ">=0.10.0" + } }, - "sprintf-js": { + "node_modules/sprintf-js": { "version": "1.0.3", "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz", "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=", "dev": true }, - "string-width": { + "node_modules/string-width": { "version": "4.2.0", "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.0.tgz", "integrity": "sha512-zUz5JD+tgqtuDjMhwIg5uFVV3dtqZ9yQJlZVfq4I01/K5Paj5UHj7VyrQOJvzawSVlKpObApbfD0Ed6yJc+1eg==", "dev": true, - "requires": { + "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.0" + }, + "engines": { + "node": ">=8" } }, - "strip-ansi": { + "node_modules/strip-ansi": { "version": "6.0.0", "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz", "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==", "dev": true, - "requires": { + "dependencies": { "ansi-regex": "^5.0.0" + }, + "engines": { + "node": ">=8" } }, - "supports-color": { + "node_modules/supports-color": { "version": "6.1.0", "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-6.1.0.tgz", "integrity": "sha512-qe1jfm1Mg7Nq/NSh6XE24gPXROEVsWHxC1LIx//XNlD9iw7YZQGjZNjYN7xGaEG6iKdA8EtNFW6R0gjnVXp+wQ==", "dev": true, - "requires": { + "dependencies": { "has-flag": "^3.0.0" + }, + "engines": { + "node": ">=6" } }, - "to-regex-range": { + "node_modules/to-regex-range": { "version": "5.0.1", "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==", "dev": true, - "requires": { + "dependencies": { "is-number": "^7.0.0" + }, + "engines": { + "node": ">=8.0" } }, - "universalify": { + "node_modules/universalify": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/universalify/-/universalify-1.0.0.tgz", "integrity": "sha512-rb6X1W158d7pRQBg5gkR8uPaSfiids68LTJQYOtEUhoJUWBdaQHsuT/EUduxXYxcrt4r5PJ4fuHW1MHT6p0qug==", - "dev": true + "dev": true, + "engines": { + "node": ">= 10.0.0" + } }, - "which-module": { + "node_modules/which-module": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.0.tgz", "integrity": "sha1-2e8H3Od7mQK4o6j6SzHD4/fm6Ho=", "dev": true }, - "wrap-ansi": { + "node_modules/wrap-ansi": { "version": "6.2.0", "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz", "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==", "dev": true, - "requires": { + "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" }, - "dependencies": { - "ansi-styles": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.2.1.tgz", - "integrity": "sha512-9VGjrMsG1vePxcSweQsN20KY/c4zN0h9fLjqAbwbPfahM3t+NL+M9HC8xeXG2I8pX5NoamTGNuomEUFI7fcUjA==", - "dev": true, - "requires": { - "@types/color-name": "^1.1.1", - "color-convert": "^2.0.1" - } - }, - "color-convert": { - "version": "2.0.1", - "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", - "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", - "dev": true, - "requires": { - "color-name": "~1.1.4" - } - }, - "color-name": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz", - "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==", - "dev": true - } + "engines": { + "node": ">=8" } }, - "xregexp": { + "node_modules/wrap-ansi/node_modules/ansi-styles": { + "version": "4.2.1", + "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.2.1.tgz", + "integrity": "sha512-9VGjrMsG1vePxcSweQsN20KY/c4zN0h9fLjqAbwbPfahM3t+NL+M9HC8xeXG2I8pX5NoamTGNuomEUFI7fcUjA==", + "dev": true, + "dependencies": { + "@types/color-name": "^1.1.1", + "color-convert": "^2.0.1" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, + "node_modules/wrap-ansi/node_modules/color-convert": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz", + "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==", + "dev": true, + "dependencies": { + "color-name": "~1.1.4" + }, + "engines": { + "node": ">=7.0.0" + } + }, + "node_modules/wrap-ansi/node_modules/color-name": { + "version": "1.1.4", + "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz", + "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==", + "dev": true + }, + "node_modules/xregexp": { "version": "4.3.0", "resolved": "https://registry.npmjs.org/xregexp/-/xregexp-4.3.0.tgz", "integrity": "sha512-7jXDIFXh5yJ/orPn4SXjuVrWWoi4Cr8jfV1eHv9CixKSbU+jY4mxfrBwAuDvupPNKpMUY+FeIqsVw/JLT9+B8g==", "dev": true, - "requires": { + "dependencies": { "@babel/runtime-corejs3": "^7.8.3" } }, - "y18n": { + "node_modules/y18n": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz", "integrity": "sha512-r9S/ZyXu/Xu9q1tYlpsLIsa3EeLXXk0VwlxqTcFRfg9EhMW+17kbt9G0NrgCmhGb5vT2hyhJZLfDGx+7+5Uj/w==", "dev": true }, - "yargs": { + "node_modules/yargs": { "version": "15.4.0", "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.0.tgz", "integrity": "sha512-D3fRFnZwLWp8jVAAhPZBsmeIHY8tTsb8ItV9KaAaopmC6wde2u6Yw29JBIZHXw14kgkRnYmDgmQU4FVMDlIsWw==", "dev": true, - "requires": { + "dependencies": { "cliui": "^6.0.0", "decamelize": "^3.2.0", "find-up": "^4.1.0", @@ -972,24 +1284,31 @@ "which-module": "^2.0.0", "y18n": "^4.0.0", "yargs-parser": "^18.1.2" + }, + "engines": { + "node": ">=8" } }, - "yargs-parser": { + "node_modules/yargs-parser": { "version": "18.1.3", "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz", "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==", "dev": true, - "requires": { + "dependencies": { "camelcase": "^5.0.0", "decamelize": "^1.2.0" }, - "dependencies": { - "decamelize": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz", - "integrity": "sha1-9lNNFRSCabIDUue+4m9QH5oZEpA=", - "dev": true - } + "engines": { + "node": ">=6" + } + }, + "node_modules/yargs-parser/node_modules/decamelize": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz", + "integrity": "sha1-9lNNFRSCabIDUue+4m9QH5oZEpA=", + "dev": true, + "engines": { + "node": ">=0.10.0" } } } From c2ee4383d3919b4bd6fdd7284901b3dcf12b2ed7 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Mon, 29 Jul 2024 16:17:13 +0200 Subject: [PATCH 017/408] docs: Localize pod lifecycle to Spanish solves #45708 --- content/es/docs/concepts/workloads/pods/pod-lifecycle.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index 681e99456f..1f7dd12eb2 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -60,7 +60,7 @@ ese Pod puede ser reemplazado por un Pod nuevo, casi idéntico, incluso con el m deseado, pero con un UID diferente. Cuando se dice que algo tiene la misma vida útil que un Pod, como un -{{< glosario_tooltip term_id="volume" text="volumen" >}}, +{{< glossary_tooltip term_id="volume" text="volumen" >}}, eso significa que la cosa existe mientras ese Pod específico (con ese UID exacto) existe. Si ese Pod se elimina por cualquier motivo, e incluso si se requiere un reemplazo idéntico se crea, el objeto relacionado (un volumen, en este ejemplo) también se destruye y From fa3a46eec75ac6b690033f81bd2879479935f1ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?A=C9=B3=CF=85=CA=9D?= Date: Mon, 29 Jul 2024 22:48:50 +0530 Subject: [PATCH 018/408] Applied suggestions Co-authored-by: divya-mohan0209 --- content/hi/docs/reference/tools/_index.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/hi/docs/reference/tools/_index.md b/content/hi/docs/reference/tools/_index.md index 85460fbb1a..1e56ce55ca 100644 --- a/content/hi/docs/reference/tools/_index.md +++ b/content/hi/docs/reference/tools/_index.md @@ -15,7 +15,7 @@ no_list: true ## crictl [`crictl`](https://github.com/kubernetes-sigs/cri-tools) -{{}}-compatible कंटेनर रनटाइम के +{{}}-संगत कंटेनर रनटाइम के निरीक्षण और डिबगिंग के लिए एक कमांड-लाइन इंटरफ़ेस है। ## Dashboard @@ -33,9 +33,9 @@ no_list: true हेल्म का उपयोग करें: * कुबेरनेट्स चार्ट के रूप में पैक किए गए लोकप्रिय सॉफ़्टवेयर को ढूंढें और उपयोग करें। -* अपने स्वयं के एप्लिकेशन को कुबेरनेट्स चार्ट के रूप में साझा करें। +* अपने ख़ुद के एप्लिकेशन को कुबेरनेट्स चार्ट के रूप में साझा करें। * अपने कुबेरनेट्स एप्लीकेशन के लिए प्रस्तुत करने योग्य बिल्ड बनाएं। -* बुद्धिमानी से अपने कुबेरनेट्स मैनिफ़ेस्ट फ़ाइलों को प्रबंधित करें। +* बुद्धिमत्ता से अपने कुबेरनेट्स मैनिफ़ेस्ट फ़ाइलों को प्रबंधित करें। * हेल्म पैकेजों के रिलीज़ प्रबंधित करें। ## Kompose From 726941bb4e0288cce9105a713ac4af612f69dc47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?A=C9=B3=CF=85=CA=9D?= Date: Mon, 29 Jul 2024 22:50:07 +0530 Subject: [PATCH 019/408] Applied suggestions --- content/hi/docs/reference/tools/_index.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/content/hi/docs/reference/tools/_index.md b/content/hi/docs/reference/tools/_index.md index 1e56ce55ca..88fa250a7d 100644 --- a/content/hi/docs/reference/tools/_index.md +++ b/content/hi/docs/reference/tools/_index.md @@ -20,9 +20,9 @@ no_list: true ## Dashboard -[`डैशबोर्ड`](/docs/tasks/access-application-cluster/web-ui-dashboard/), कुबेरनेट्स का -वेब पे आधारित उपयोगकर्ता इंटरफ़ेस, आपको कुबेरनेट्स क्लस्टर में कंटेनरीकृत अनुप्रयोगों को तैनात करने, -उनकी समस्या का निवारण करने और क्लस्टर और उसके संसाधनों को प्रबंधित करने की अनुमति देता है। +कुबेरनेट्स का +वेब [`डैशबोर्ड`](/docs/tasks/access-application-cluster/web-ui-dashboard/) आपको क्लस्टर में कंटेनरीकृत अनुप्रयोगों को तैनात करने, +उनकी समस्या का निवारण करने और क्लस्टर के संसाधनों को प्रबंधित करने की अनुमति देता है। ## Helm {{% thirdparty-content single="true" %}} @@ -34,7 +34,6 @@ no_list: true * कुबेरनेट्स चार्ट के रूप में पैक किए गए लोकप्रिय सॉफ़्टवेयर को ढूंढें और उपयोग करें। * अपने ख़ुद के एप्लिकेशन को कुबेरनेट्स चार्ट के रूप में साझा करें। -* अपने कुबेरनेट्स एप्लीकेशन के लिए प्रस्तुत करने योग्य बिल्ड बनाएं। * बुद्धिमत्ता से अपने कुबेरनेट्स मैनिफ़ेस्ट फ़ाइलों को प्रबंधित करें। * हेल्म पैकेजों के रिलीज़ प्रबंधित करें। @@ -48,7 +47,7 @@ no_list: true * डॉकर कंपोज़ फ़ाइल को कुबेरनेट्स ऑब्जेक्ट्स में अनुवाद करें। * स्थानीय डॉकर डेवलपमेंट से कुबेरनेट्स एप्लीकेशनों को प्रबंधित करें। * v1 या v2 डॉकर कंपोज़, `yaml` फ़ाइलों या - [वितरित एप्लिकेशनो के बंडलों](https://docs.docker.com/compose/bundles/) के माध्यम से अपने एप्लिकेशन + [डिस्ट्रीब्यूटेड एप्लिकेशनो के बंडलों ](https://docs.docker.com/compose/bundles/) के माध्यम से अपने एप्लिकेशन को प्रबंधित कऱे। ## Kui @@ -62,7 +61,7 @@ Kui उन टेबल्स के साथ एक GUI प्रदान क Kui आपको देता है: * कॉपी और पेस्ट करने के बजाय सीधे लंबे स्वचालित रूप से जेनरेटेड किए गए संसाधनों के नामों पर क्लिक करें। -* `Kubectl` कमांड टाइप करें और उन्हें चलते हुए देखें, यहां तक कि कभी-कभी `Kubectl` से भी तेज। +* `Kubectl` कमांड टाइप करें और उन्हें निष्पादन होते हुए देखें, यहां तक कि कभी-कभी `Kubectl` से भी तेज। * एक {{< glossary_tooltip text="जॉब" term_id="job">}} क्वेरी करें और इसके निष्पादन को वॉटरफॉल के डायग्राम के रूप में देखें। * एक टैब्ड UI का उपयोग करके अपने क्लस्टर में संसाधनों पर क्लिक करें। From b5d1ee5b28e48f78082e01004b31a732e041e03e Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Tue, 30 Jul 2024 12:54:48 +0200 Subject: [PATCH 020/408] docs: Localize pod lifecycle to Spanish Update content with #46529 solves #45708 --- .../concepts/workloads/pods/pod-lifecycle.md | 22 +++++-------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index 1f7dd12eb2..a8ead28535 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -12,23 +12,13 @@ inicia correctamente, y luego pasando a "exitoso" (`Succeeded`) o "fallido" (`Failed`) si uno de los contenedores de un Pod termina en error. -Mientras un Pod está en `Running`, -el kubelet puede reiniciar sus contenedores para manejar algunos errores. -Dentro de un Pod, -Kubernetes rastrea diferentes [estados](#container-states) de contenedores y -decide qué acción tomar para que el Pod esté sano otra vez. +Al igual que contenedores de aplicaciones, los Pods se consideran entidades relativamente efímeras. +Los Pods se crean y se les asigna un identificador único ([UID](/docs/concepts/overview/working-with-objects/names/#uids)), y se programan para ejecutarse en nodos donde se mantienen hasta que se terminan (de acuerdo con las políticas de reinicio) o se eliminan. -En la API de Kubernetes, los Pods tienen una especificación y un estado actual. -El estado de un Pod consiste en un conjunto -de [condiciones de un Pod](#pod-conditions). -También puedes -inyectar [información de estado personalizada](#pod-readiness-gate) en los datos -de condiciones de un Pod, si es útil para tu aplicación. - -Los Pods se [programan](/docs/concepts/scheduling-eviction/) únicamente una vez -en su tiempo de vida. -Una vez que un Pod se programa (asigna) a un Nodo, el Pod se ejecuta en ese Nodo -hasta que se termine o se [elimina](#pod-termination). +Si un {{< glossary_tooltip text="nodo" term_id="node" >}} muere, +los Pods programados para ejecutarse en ese Nodo +se [programan para eliminarse](#pod-garbage-collection). +El plano de control marca los Pods para ser eliminados luego de un periodo de tiempo. From e03e2015b97e5ecc284b49ebe06d7f47449c5d30 Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Tue, 30 Jul 2024 14:24:50 +0200 Subject: [PATCH 021/408] docs: Localize pod lifecycle to Spanish Update content with #46529 solves #45708 --- .../docs/concepts/workloads/pods/pod-lifecycle.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index a8ead28535..9effe5afc5 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -24,6 +24,21 @@ El plano de control marca los Pods para ser eliminados luego de un periodo de ti ## Ciclo de vida de un Pod +Mientras un Pod se está ejecutando, el kubelet puede reiniciar contenedores para manejar algunos tipos de fallos. +Dentro de un Pod, Kubernetes rastrea distintos [estados](#container-states) del contenedor y determina qué acción realizar para que el Pod esté sano nuevamente. + +En la API de Kubernetes, los Pods tienen una especificación y un estatus actual. +El estatus de un objeto Pod consiste en un conjunto de [condiciones del Pod](#pod-conditions). +También puedes inyectar [información de readiness personalizada](#pod-readiness-gate) a los datos de condición de un Pod, si es útil para tu aplicación. + +Los Pods solo se [programan](/docs/concepts/scheduling-eviction/) una vez en su ciclo de vida; asignar un Pod a un nodo específico se llama _vincular_ (binding, en inglés), y el proceso de seleccionar cuál Pod usar se llama _programar_. +Una vez que un Pod está vinculado a un nodo, Kubernetes intenta ejecutar el Pod en ese nodo. +El Pod se ejecuta en ese nodo hasta que termina, o hasta que es [terminado](#pod-termination); if Kubernetes no es capaz de iniciar el Pod en el nodo seleccionado (por ejemplo, si el nodo falla antes que el Pod inicie), entonces ese Pod en particular nunca inicia. + +Puedes usar [readiness de programación del Pod](/docs/concepts/scheduling-eviction/pod-scheduling-readiness/) para retrasar la programación de un Pod hasta que todas sus _puertas de programación_ sean removidas. +Por ejemplo, podrías querer definir un conjunto de Pods, pero solo lanzar la programación una vez que todos los Pods hayan sido creados. + + Igual que contenedores de aplicación individuales, se considera que los Pods son entidades relativamente efímeras (en lugar de durables). From 2e9c8ecf89a1ed7cc2245bc84a3b894f361da2aa Mon Sep 17 00:00:00 2001 From: Kei Takamizu Date: Wed, 31 Jul 2024 09:35:25 +0900 Subject: [PATCH 022/408] [ja]Translate /docs/concepts/policy/pid-limiting.md into Japanese --- .../ja/docs/concepts/policy/pid-limiting.md | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) create mode 100644 content/ja/docs/concepts/policy/pid-limiting.md diff --git a/content/ja/docs/concepts/policy/pid-limiting.md b/content/ja/docs/concepts/policy/pid-limiting.md new file mode 100644 index 0000000000..0703aef409 --- /dev/null +++ b/content/ja/docs/concepts/policy/pid-limiting.md @@ -0,0 +1,54 @@ +--- +title: プロセスIDの制限と予約 +content_type: concept +weight: 40 +--- + + + +{{< feature-state for_k8s_version="v1.20" state="stable" >}} + +Kubernetesでは、{{< glossary_tooltip term_id="Pod" text="Pod" >}}が使用できるプロセスID(PIDs)数を制限することができます。また、オペレーティングシステムやデーモンによる使用のために、Podだけではなく{{< glossary_tooltip term_id="node" text="ノード" >}}ごとに割り当て可能なPID数を予約することができます。 + + + +プロセスID(PIDs)はノードの基本的なリソースです。他のリソース制限に達することなくタスク制限に達することは容易であり、それがホストマシンの不安定性を引き起こす可能性があります。 + +クラスター管理者はクラスター内で実行しているPodがホストデーモン({{< glossary_tooltip text="kubelet" term_id="kubelet" >}}や{{< glossary_tooltip text="kube-proxy" term_id="kube-proxy" >}}や場合によってはコンテナランタイムなど)の実行を妨げるPID枯渇を引き起こさないことを保証するメカニズムを必要とします。それに加えて、同ノード上の他のワークロードへの影響を制限するためにPod間でPIDが制限されていることも重要です。 + +{{< note >}} +特定のLinuxのインストール時に、オペレーティングシステムはPID制限の値を`32768`のような低いデフォルト値に設定することがあります。`/proc/sys/kernel/pid_max`の値を上げることを検討してください。 +{{< /note >}} + +Podが使用できるPID数の制限をkubeletに設定できます。例えば、ノードのホストOSがPIDの最大値を`262144`を設定し、250未満のPodをホストする場合、各Podに`1000`PIDを割り当てることで、そのノードで利用可能なPIDを使い切ることを防ぐことができます。管理者がCPUやメモリのようにPIDでもオーバーコミットを行いたい場合、同様にいくつかの追加のリスクがあります。いずれにしても、単一のPodがマシン全体をダウンさせることはできません。このようなリソース制限は単純なフォーク爆弾がクラスター全体の運用に影響を与えるのを防ぐのに役立ちます。 + +PodごとのPID制限により、管理者はあるPodを他のPodから保護できますが、ホスト上にスケジュールされたすべてのPodがノード全体に影響を与えないことを保証するものではありません。Podごとの制限は、ノードエージェント自体をPID枯渇から保護するものでもありません。 + +また、Podへの割り当てとは別に、ノードのオーバーヘッドのために一定量のPIDを予約することもできます。これは、CPU、メモリ、その他のリソースをオペレーティングシステムやPodおよびコンテナ外の他の機能で使用するために予約する方法と似ています。 + +PID制限は、[コンピュータリソース](/ja/docs/concepts/configuration/manage-resources-containers/)のリクエストと制限と並んで重要な機能です。ただし、指定方法は異なります。Podのリソース制限をPodの`.spec`で定義するのではなく、kubeletの設定として制限を設定します。現在、Pod定義のPID制限はサポートされていません。 + +{{< caution >}} +これは、Podに適用される制限が、Podがスケジュールされる場所によって異なる可能性があることを意味します。簡単にするためには、すべてのノードが同じPIDリソースの制限と予約を使用するのが最も簡単です。 +{{< /caution >}} + +## ノードのPID制限 + +KubernetesはKubernetesシステムが利用するプロセスID数を予約することができます。予約を設定するために、kubeletのコマンドラインオプションで`--system-reserved`および`--kube-reserved`の`pid=`パラメーターを使用します。指定された値は、システム全体およびKubernetesシステムデーモン用それぞれに、指定された数のプロセスIDが予約されることを宣言します。 + +## PodのPID制限 + +KubernetesはPodで実行するプロセス数を制限することができます。特定のPodのリソース制限として設定するのではなく、ノードレベルでこの制限を指定します。各ノードは異なるPID制限を持つことができます。制限を設定するために、kubeletに`--pod-max-pids`のコマンドラインパラメーターを指定するか、kubeletの[構成ファイル](/docs/tasks/administer-cluster/kubelet-config-file/)の`PodPidsLimit`に設定します。 + +## Evictionを基にしたPID + +Podが誤操作していたり、異常なリソースを消費している時にPodの終了を実行することをkubeletに設定できます。この機能はEvictionと呼ばれています。様々なEvictionシグナルのために[リソース不足への対処の設定](/docs/concepts/scheduling-eviction/node-pressure-eviction/)ができます。`pid.available`Evictionシグナルを使用して、Podによって使用されるPIDの数の閾値を設定します。ソフトとハードのEvictionポリシーを設定できます。しかし、ハードEvictionポリシーを使用しても、PIDの数が非常に速く増加している場合、ノードはPID制限に達することで不安定な状態になる可能性があります。Evictionシグナルの値は定期的に計算されますが、この値は制限を強制するものではありません。 + +PID制限 - Pod毎、ノード毎にハード制限を設定できます。一度制限に達すると、ワークロードは新しいPIDを取得しようとする際に失敗し始めます。これがPodの再スケジューリングにつながるかどうかは、ワークロードがこれらの失敗にどのように反応するか、PodのLiveness ProbeとReadiness Probeがどのように設定されているかに依存します。しかし、リミットが正しく設定されていれば、あるPodが誤動作している場合でも、他のPodのワークロードやシステムプロセスがPIDを使い果たすことはないと保証することができます。 + +## {{% heading "whatsnext" %}} + +- [PID制限の強化に関するドキュメント](https://github.com/kubernetes/enhancements/blob/097b4d8276bc9564e56adf72505d43ce9bc5e9e8/keps/sig-node/20190129-pid-limiting.md)で詳細情報を確認できます。 +- 歴史的背景について学ぶために、[Kubernetes 1.14での安定性向上のためのプロセスID制限](/blog/2019/04/15/process-id-limiting-for-stability-improvements-in-kubernetes-1.14/)をご覧ください。 +- [コンテナのリソース管理](/ja/docs/concepts/configuration/manage-resources-containers/)についてご覧ください。 +- [リソース不足時の対応設定](/docs/concepts/scheduling-eviction/node-pressure-eviction/)の方法について学ぶことができます。 \ No newline at end of file From afc8fd9c9466ac25587b2ac05cd994b10357626a Mon Sep 17 00:00:00 2001 From: Paco Xu Date: Mon, 5 Aug 2024 15:36:34 +0800 Subject: [PATCH 023/408] sysctl is moved to namespaced in 4.6 - https://github.com/torvalds/linux/commit/12ed8244ed8b31b023ea6d2851fd8b15f2999e9b --- content/en/docs/tasks/administer-cluster/sysctl-cluster.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/sysctl-cluster.md b/content/en/docs/tasks/administer-cluster/sysctl-cluster.md index a235280dcf..fa22ffd1c5 100644 --- a/content/en/docs/tasks/administer-cluster/sysctl-cluster.md +++ b/content/en/docs/tasks/administer-cluster/sysctl-cluster.md @@ -86,7 +86,7 @@ The following sysctls are supported in the _safe_ set: There are some exceptions to the set of safe sysctls: - The `net.*` sysctls are not allowed with host networking enabled. -- The `net.ipv4.tcp_syncookies` sysctl is not namespaced on Linux kernel version 4.4 or lower. +- The `net.ipv4.tcp_syncookies` sysctl is not namespaced on Linux kernel version 4.5 or lower. {{< /note >}} This list will be extended in future Kubernetes versions when the kubelet From 73c3259d816c54c3ea826992f95a1e4d5db02b7c Mon Sep 17 00:00:00 2001 From: Matthew Cary Date: Thu, 20 Jun 2024 09:37:23 -0700 Subject: [PATCH 024/408] placeholder PR for VAC beta --- .../2024-08-15-volume-attributes-class.md | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 content/en/blog/_posts/2024-08-15-volume-attributes-class.md diff --git a/content/en/blog/_posts/2024-08-15-volume-attributes-class.md b/content/en/blog/_posts/2024-08-15-volume-attributes-class.md new file mode 100644 index 0000000000..20930a4d4f --- /dev/null +++ b/content/en/blog/_posts/2024-08-15-volume-attributes-class.md @@ -0,0 +1,100 @@ +--- +layout: blog +title: "Kubernetes 1.31: VolumeAttributesClass for Volume Modification Beta" +date: 2024-08-15 +slug: kubernetes-1-31-volume-attributes-class +author: > + Sunny Song (Google) + Matthew Cary (Google) +--- + +Volumes in Kubernetes have been described by two attributes: their storage class, and +their capacity. The storage class is an immutable property of the volume, while the +capacity can be changed dynamically with [volume +resize](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#expanding-persistent-volumes-claims). + +This complicates vertical scaling of workloads with volumes. While cloud providers and +storage vendors often offer volumes which allow specifying IO quality of service +(Performance) parameters like IOPS or throughput and tuning them as workloads operate, +Kubernetes has no API which allows changing them. + +We are pleased to announce that the [VolumeAttributesClass +KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/3751-volume-attributes-class/README.md), +alpha since Kubernetes 1.29, will be beta in 1.31. This provides a generic, +Kubernetes-native API for modifying volume parameters like provisioned IO. + +Like all new volume features in Kubernetes, this API is implemented via the [container +storage interface (CSI)](https://kubernetes-csi.github.io/docs/). In addition to the +VolumeAttributesClass feature gate, your provisioner-specific CSI driver must support the +new ModifyVolume API which is the CSI side of this feature. + +See the [full +documentation](https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/) +for all details. Here we show the common workflow. + +### Dynamically modifying volume attributes. + +A `VolumeAttributesClass` is a cluster-scoped resource that specifies provisioner-specific +attributes. These are created by the cluster administrator in the same way as storage +classes. For example, a series of gold, silver and bronze volume attribute classes can be +created for volumes with greater or lessor amounts of provisioned IO. + +```yaml +apiVersion: storage.k8s.io/v1alpha1 +kind: VolumeAttributesClass +metadata: + name: silver +driverName: your-csi-driver +parameters: + provisioned-iops: "500" + provisioned-throughput: "50MiB/s" +--- +apiVersion: storage.k8s.io/v1alpha1 +kind: VolumeAttributesClass +metadata: + name: gold +driverName: your-csi-driver +parameters: + provisioned-iops: "10000" + provisioned-throughput: "500MiB/s" +``` + +An attribute class is added to a PVC in much the same way as a storage class. + +```yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: test-pv-claim +spec: + storageClassName: any-storage-class + volumeAttributesClassName: silver + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 64Gi +``` + +Unlike a storage class, the volume attributes class can be changed: + +``` +kubectl patch pvc test-pv-claim -p '{"spec": "volumeAttributesClassName": "gold"}' +``` + +Kubernetes will work with the CSI driver to update the attributes of the +volume. The status of the PVC will track the current and desired attributes +class. The PV resource will also be updated with the new volume attributes class +which will be set to the currently active attributes of the PV. + +### Limitations with the beta + +As a beta feature, there are still some features which are planned for GA but not yet +present. The largest is quota support, see the +[KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/3751-volume-attributes-class/README.md) +and discussion in +[sig-storage](https://github.com/kubernetes/community/tree/master/sig-storage) for details. + +See the [Kubernetes CSI driver +list](https://kubernetes-csi.github.io/docs/drivers.html) for up-to-date +information of support for this feature in CSI drivers. From e9ad39de391754117042bd23a2dd7ccf0c3e86e7 Mon Sep 17 00:00:00 2001 From: Paco Xu Date: Mon, 5 Aug 2024 16:25:17 +0800 Subject: [PATCH 025/408] add a page for kernel version requirements --- .../node/kernel-version-requirements.md | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 content/en/docs/reference/node/kernel-version-requirements.md diff --git a/content/en/docs/reference/node/kernel-version-requirements.md b/content/en/docs/reference/node/kernel-version-requirements.md new file mode 100644 index 0000000000..9593ebbdbc --- /dev/null +++ b/content/en/docs/reference/node/kernel-version-requirements.md @@ -0,0 +1,68 @@ +--- +content_type: "reference" +title: Linux Kernel Version Requirements +weight: 10 +--- + +{{% thirdparty-content %}} + +Many features rely on specific kernel functionalities and have minimum kernel version requirements. + +## Pod sysctls {#requirements-pod-sysctl} + +On Linux, the `sysctl()` system call configures kernel parameters at run time. There is a command +line tool named `sysctl` that you can use to configure these parameters, and many are exposed via +the `proc` filesystem. + +Some sysctls are only available if you have a modern enough kernel. + +The following sysctls are supported in the [safe set](/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls) +which has a minimal kernel version requirement: + +- `net.ipv4.ip_local_reserved_ports` (since Kubernetes 1.27, needs kernel 3.16+); +- `net.ipv4.tcp_keepalive_time` (since Kubernetes 1.29, needs kernel 4.5+); +- `net.ipv4.tcp_fin_timeout` (since Kubernetes 1.29, needs kernel 4.6+); +- `net.ipv4.tcp_keepalive_intvl` (since Kubernetes 1.29, needs kernel 4.5+); +- `net.ipv4.tcp_keepalive_probes` (since Kubernetes 1.29, needs kernel 4.5+); +- `net.ipv4.tcp_syncookies` (namespaced since kernel 4.6+). +- `net.ipv4.vs.conn_reuse_mode` (used in `ipvs` proxy mode, needs kernel 4.1+); + +### kube proxy `nftables` proxy mode + +The [`nftables` mode](/docs/reference/networking/virtual-ips/#proxy-mode-nftables) of kube-proxy now requires version 1.0.1 or later +of the nft command-line, and kernel 5.13 or later. (For testing/development +purposes, you can use older kernels, as far back as 5.4, if you set the +`nftables.skipKernelVersionCheck` option in the kube-proxy config, but this is not +recommended in production since it may cause problems with other nftables +users on the system. + +## Version 2 control groups + +cgroup v1 support is in maintained mode stating v1.31, and cgroup v2 is a recommended. So very soon _Kubernetes_ Linux nodes will at least recommend this kernel version. +In [Linux 5.8](https://github.com/torvalds/linux/commit/4a7e89c5ec0238017a757131eb9ab8dc111f961c), the system-level `cpu.stat` file was added to the root cgroup for convenience. + +In [runc document](https://github.com/containerd/cgroups/blob/0c03de4a3d82a5f02f455ccc8174cb0dc9c2a532/cgroup2/manager.go#L411-L430), Kernel older than 5.2 is not recommended due to lack of freezer. + +## Other kernel requirements {#requirements-other} + +Some features may depend on new kernel functionalities and have specific kernel requirements: + +1. [Recursive read only mount](/docs/concepts/storage/volumes/#recursive-read-only-mounts): This is implemented by applying the `MOUNT_ATTR_RDONLY` attribute with the `AT_RECURSIVE` flag using `mount_setattr`(2) added in Linux kernel v5.12. +2. Pod user namespace support requires minimal kernel version 6.5+, according to [KEP-127](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/127-user-namespaces/README.md). +3. For [node system swap](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/2400-node-swap/README.md), tmpfs noswap is not supported until kernel 6.3. + +## Linux kernel long term maintenance + +Active kernel releases can be found in [kernel.org](https://www.kernel.org/category/releases.html). + +There are usually several _long term maintenance_ kernel releases provided for the purposes of backporting +bugfixes for older kernel trees. Only important bugfixes are applied to such kernels and they don't +usually see very frequent releases, especially for older trees. +See the Linux kernel website for the [list of releases](https://www.kernel.org/category/releases.html) +in the _Longterm_ category. + +## {{% heading "whatsnext" %}} + +- See [sysctls](/docs/tasks/administer-cluster/sysctl-cluster/) for more details. +- Allow running kube-proxy with in [nftables mode](/docs/reference/networking/virtual-ips/#proxy-mode-nftables). +- Read more information in [cgroups v2](/docs/concepts/architecture/cgroups/). From 7741eaea30be56fb0c32445cf5cac6279b35141b Mon Sep 17 00:00:00 2001 From: Anyul Rivas Date: Wed, 7 Aug 2024 14:05:06 +0200 Subject: [PATCH 026/408] docs: Localize pod lifecycle to Spanish Update content with #46529 solves #45708 --- .../concepts/workloads/pods/pod-lifecycle.md | 204 ++++++++---------- 1 file changed, 95 insertions(+), 109 deletions(-) diff --git a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md index 9effe5afc5..bca40f3968 100644 --- a/content/es/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/es/docs/concepts/workloads/pods/pod-lifecycle.md @@ -38,44 +38,43 @@ El Pod se ejecuta en ese nodo hasta que termina, o hasta que es [terminado](#pod Puedes usar [readiness de programación del Pod](/docs/concepts/scheduling-eviction/pod-scheduling-readiness/) para retrasar la programación de un Pod hasta que todas sus _puertas de programación_ sean removidas. Por ejemplo, podrías querer definir un conjunto de Pods, pero solo lanzar la programación una vez que todos los Pods hayan sido creados. +### Recuperación de fallos en los Pods {#pod-fault-recovery} -Igual que contenedores de aplicación individuales, -se considera que los Pods son entidades relativamente efímeras -(en lugar de durables). -Los Pods se crean y se les -asigna un identificador único -([UID](/es/docs/concepts/overview/working-with-objects/names/#uids)), -y se programan para ejecutarse en nodos donde se mantienen hasta que se terminan -(de acuerdo con las políticas de reinicio) o se eliminan. +Si falla uno de los contenedores en el Pod, Kubernetes puede intentar reiniciar ese contenedor en específico. +Para saber más, lea [cómo los Pods manejan los errores del contenedor](#container-restarts). -Si un {{< glossary_tooltip term_id="node" text="nodo" >}} muere, -los Pods programados para ejecutarse en ese Nodo -se [programan para eliminarse](#pod-garbage-collection) luego de un periodo de -tiempo. +Sin embargo, los Pods pueden fallar de una manera que el clúster no puede recuperar, y en ese caso +Kubernetes no intenta sanar el Pod más; en su lugar, Kubernetes elimina el +Pod y confía en otros componentes para proporcionar una curación automática. -Los Pods, por sí mismos, no se curan automáticamente. -Si un Pod está programado para un {{< glossary_tooltip text="nodo" term_id="node" >}} y luego falla, -el Pod se elimina; de la misma manera, -un Pod no sobrevivirá a un desalojo debido a falta de recursos o mantenimiento -del Nodo. -Kubernetes utiliza una abstracción llamada {{< glossary_tooltip term_id="controller" text="controlador" >}}, que se encarga del trabajo de gestionar las instancias de Pod relativamente desechables. +Si un Pod está programado para un {{< glossary_tooltip text="nodo" term_id="node" >}} y ese +nodo luego falla, el Pod se trata como no saludable y Kubernetes eventualmente elimina el Pod. +Un Pod no sobrevivirá a una {{< glossary_tooltip text="evicción" term_id="eviction" >}} debido +a la falta de recursos o al mantenimiento del Nodo. -Un Pod determinado (según lo definido por un UID) nunca se "reprograma" a un nodo diferente; en cambio, -ese Pod puede ser reemplazado por un Pod nuevo, casi idéntico, incluso con el mismo nombre si -deseado, pero con un UID diferente. +Kubernetes utiliza una abstracción de nivel superior, llamada +{{< glossary_tooltip term_id="controlador" text="controller" >}}, que maneja el trabajo de +gestionar las instancias de Pods relativamente desechables. + +Un Pod dado (como se define por un UID) nunca es "reprogramado" a un nodo diferente; en su lugar, +ese Pod puede ser reemplazado por un nuevo Pod casi idéntico. +Si hace un Pod de reemplazo, incluso puede +tener el mismo nombre (como en `.metadata.name`) que tenía el Pod antiguo, pero el reemplazo +tendría un `.metadata.uid` diferente del Pod antiguo. + +Kubernetes no garantiza que un reemplazo de un Pod existente sea programado +en el mismo nodo que el antiguo Pod que estaba siendo reemplazado. + +### Ciclo de vida asociados Cuando se dice que algo tiene la misma vida útil que un Pod, como un {{< glossary_tooltip term_id="volume" text="volumen" >}}, -eso significa que la cosa existe mientras ese Pod específico (con ese UID exacto) -existe. Si ese Pod se elimina por cualquier motivo, e incluso si se requiere un reemplazo idéntico -se crea, el objeto relacionado (un volumen, en este ejemplo) también se destruye y -creado de nuevo. +eso significa que el objeto existe mientras ese Pod específico (con ese UID exacto) +exista. +Si ese Pod se elimina por cualquier razón, e incluso si se crea un reemplazo idéntico, +el objeto relacionado (un volumen, en este ejemplo) también se destruye y se crea nuevamente. -{{< figure src="/images/docs/pod.svg" title="Diagrama de un Pod" class=" diagram-medium" >}} - -Un Pod con múltiples contenedores que contiene un extractor de ficheros y un -servidor web que usa un volumen persistente para compartir datos entre los -contenedores. +{{< figure src="/images/docs/pod.svg" title="Figura 1." class="diagram-medium" caption="Un Pod de varios contenedores que contiene un extractor de archivos sidecar y un servidor web. El Pod utiliza un volumen efímero emptyDir para almacenamiento compartido entre los contenedores." >}} ## Fase del Pod @@ -97,7 +96,7 @@ Aquí están los posibles valores de `phase`: | Valor | Descripción | |:------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `Pending` | El clúster de Kubernetes aceptó el pod, pero uno o más contenedores no se configuraron ni prepararon para ejecutarse. Esto incluye el tiempo que pasa un Pod esperando ser programado, así como el tiempo dedicado a descargar imágenes de contenedores a través de la red. | +| `Pending` | El clúster de Kubernetes aceptó el Pod, pero uno o más contenedores no se configuraron ni prepararon para ejecutarse. Esto incluye el tiempo que pasa un Pod esperando ser programado, así como el tiempo dedicado a descargar imágenes de contenedores a través de la red. | | `Running` | El Pod se vinculó a un nodo y se crearon todos los contenedores. Al menos un contenedor todavía se está ejecutando o está en proceso de iniciarse o reiniciarse. | | `Succeeded` | Todos los contenedores del Pod finalizaron con éxito y no se reiniciarán. | | `Failed` | Todos los contenedores del Pod han finalizado y al menos un contenedor ha finalizado con error. Es decir, el contenedor salió con un estado distinto de cero o el sistema lo canceló. | @@ -138,7 +137,7 @@ Una vez que el {{< glossary_tooltip text="programador" term_id="kube-scheduler" asigna un Pod a un Nodo, el kubelet inicia creando los contenedores para ese Pod usando un {{< glossary_tooltip text="espacio de ejecución del contenedor" term_id="container-runtime" >}}. -Hay 3 estados posibles para un contenedor: `Waiting`, `Running`, y `Terminated`. +Hay 3 estados posibles para un contenedor: `Waiting`(esperando), `Running`(en ejecución), y `Terminated`(terminado). Para revisar el estado de los contenedores de un Pod, puedes usar `kubectl describe pod `. @@ -175,6 +174,40 @@ inicio y de finalización del contenedor. Si un contenedor tiene un hook `preStop` configurado, el hook se ejecuta antes de que el contenedor entre en estado `Terminated`. +## Cómo los Pods manejan los problemas con los contenedores {#container-restarts} + +Kubernetes maneja los fallos de los contenedores dentro de los Pods usando una [política de reinicio, `restartPolicy` en inglés](#restart-policy) definida en la especificación `spec` del Pod. +Esta política determina cómo reacciona Kubernetes cuando los contenedores salen debido a errores u otras razones, lo que sigue la siguiente secuencia: + +1. **Fallo inicial**: Kubernetes intenta un reinicio inmediato basado en la `restartPolicy` del Pod. +1. **Fallos repetidos**: + Después del fallo inicial, Kubernetes aplica un retraso exponencial para los reinicios subsiguientes, descrito en [restartPolicy](#restart-policy). + Esto evita que los intentos de reinicio rápidos y repetidos sobrecarguen el sistema. +1. **Estado de CrashLoopBackOff**: + Esto indica que el mecanismo de retraso exponencial está actualmente en efecto para un contenedor dado que está en un bucle de fallos, fallando y reiniciando repetidamente. +1. **Reinicio del retraso**: + Si un contenedor funciona correctamente durante un cierto período (por ejemplo, 10 minutos), Kubernetes reinicia el retraso, tratando cualquier nuevo fallo como el primero. + +2. En la práctica, un `CrashLoopBackOff` es una condición o evento que podría verse como salida del comando `kubectl`, al describir o listar Pods, cuando un contenedor en el Pod no arranca correctamente y luego intenta y falla continuamente en un bucle. + +En otras palabras, cuando un contenedor entra en el bucle de fallos, Kubernetes aplica el retraso exponencial mencionado en la [Política de reinicio del contenedor](#restart-policy). +Este mecanismo evita que un contenedor defectuoso sobrecargue el sistema con intentos de inicio fallidos continuos. + +El `CrashLoopBackOff` puede ser causado por problemas como los siguientes: + +* Errores de la aplicación que hacen que el contenedor salga. +* Errores de configuración, como variables de entorno incorrectas o archivos de configuración faltantes. +* Restricciones de recursos, donde el contenedor puede no tener suficiente memoria o CPU para arrancar correctamente. +* Fallos en los chequeos de salud si la aplicación no comienza a servir dentro del tiempo esperado. +* Las sondas de liveness o de arranque del contenedor devuelven un resultado de `Failure` como se menciona en la [sección de sondas](#container-probes). +Para investigar la causa raíz de un problema de `CrashLoopBackOff`, un usuario puede: + +1. **Revisar los registros**: Use `kubectl logs ` para revisar los registros del contenedor. Esta es a menudo la forma más directa de diagnosticar el problema que causa los fallos. +1. **Inspeccionar eventos**: Use `kubectl describe pod ` para ver eventos para el Pod, lo que puede proporcionar pistas sobre problemas de configuración o recursos. +1. **Revisar la configuración**: Asegúrese de que la configuración del Pod, incluidas las variables de entorno y los volúmenes montados, sea correcta y que todos los recursos externos necesarios estén disponibles. +1. **Verificar los límites de recursos**: Asegúrese de que el contenedor tenga suficiente CPU y memoria asignada. A veces, aumentar los recursos en la definición del Pod puede resolver el problema. +1. **Depurar la aplicación**: Pueden existir errores o configuraciones incorrectas en el código de la aplicación. Ejecutar esta imagen de contenedor localmente o en un entorno de desarrollo puede ayudar a diagnosticar problemas específicos de la aplicación. + ## Política de reinicio del contenedor {#restart-policy} La especificación (`spec` en inglés) de un Pod tiene un campo `restartPolicy` con los posibles @@ -305,89 +338,42 @@ en `ContainersReady`. {{< feature-state for_k8s_version="v1.29" state="beta" >}} {{< note >}} -Durante su desarrollo temprano, esta condición se llamaba `PodhasNetwork`. +Durante su desarrollo temprano, esta condición se llamó `PodHasNetwork`. {{< /note >}} -{{< feature-state for_k8s_version="v1.14" state="stable" >}} +Después de que un Pod es programado en un nodo, necesita ser admitido por el kubelet y +tener cualquier volumen de almacenamiento requerido montado. +Una vez que estas fases se completan, +el kubelet trabaja con +un runtime de contenedores (usando {{< glossary_tooltip term_id="cri" >}}) para configurar un +sandbox de runtime y configurar la red para el Pod. +Si la [puerta de características](/docs/reference/command-line-tools-reference/feature-gates/) +`PodReadyToStartContainersCondition` + está habilitada +(esta habilitada por defecto para Kubernetes {{< skew currentVersion >}}), la +condición `PodReadyToStartContainers` se agregará al campo `status.conditions` de un Pod. -Tu aplicación puede inyectar retroalimentación adicional o señales -al `PodStatus`: -_Pod readiness_. -Para usar esto, establece `readinessGates` en la `spec` del Pod para especificar una -lista de condiciones adicionales que el kubelet evalúa para la preparación del -Pod. +La condición `PodReadyToStartContainers` se establece en `False` por el kubelet cuando detecta que un +Pod no tiene un sandbox de runtime con red configurada. +Esto ocurre en los siguientes escenarios: -Las condiciones de preparación están determinadas por el estado actual de los -campos `status.conditions` de un Pod. -Si Kubernetes no puede encontrar una condición en el campo `status.conditions` -de un Pod, el estado de la condición se establece en "`False`". +- Al principio del ciclo de vida del Pod, cuando el kubelet aún no ha comenzado a configurar un sandbox para +el Pod usando el runtime de contenedores. +- Más adelante en el ciclo de vida del Pod, cuando el sandbox del Pod ha sido destruido debido a: + - el nodo reiniciándose, sin que el Pod sea desalojado + - para runtimes de contenedores que usan máquinas virtuales para aislamiento, la máquina virtual del sandbox del Pod reiniciándose, lo que luego requiere crear un nuevo sandbox y +una nueva configuración de red para el contenedor. -Aquí hay un ejemplo: +La condición `PodReadyToStartContainers` se establece en True por el kubelet después de la +completación exitosa de la creación del sandbox y la configuración de la red para el Pod +por el plugin de runtime. El kubelet puede comenzar a extraer imágenes de contenedores y crear +contenedores después de que la condición PodReadyToStartContainers se haya establecido en True. -```yaml -kind: Pod -... -spec: - readinessGates: - - conditionType: "www.example.com/feature-1" -status: - conditions: - - type: Ready # una PodCondition construida - status: "False" - lastProbeTime: null - lastTransitionTime: 2018-01-01T00:00:00Z - - type: "www.example.com/feature-1" # una PodCondition extra - status: "False" - lastProbeTime: null - lastTransitionTime: 2018-01-01T00:00:00Z - containerStatuses: - - containerID: docker://abcd... - ready: true -... -``` - -Las condiciones del Pod que incluyas deben tener nombres que sean válidos para -los [formatos de etiqueta](/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set) -de Kubernetes. - -### Estado de preparación del Pod {#pod-readiness-status} - -El comando `kubectl patch` no admite actualizar el estado del objeto. -Para establecer estas `status.conditions` para el Pod, las aplicaciones y -los {{< glossary_tooltip term_id="operator-pattern" text="operadores">}} -deberían utilizar la acción `Patch`. - -Puedes utilizar -una [librería cliente de Kubernetes](/docs/reference/using-api/client-libraries/) -para escribir código que establece condiciones personalizadas de un Pod para su -preparación. - -Para los Pods que utilizan condiciones personalizadas, ese Pod es evaluado para -estar listo **solamente** cuando ambas afirmaciones aplican: - -* Todos los contenedores del Pod están listos. -* Todas las condiciones personalizadas especificadas en `readinessGates` - están `True`. - -Cuando los contenedores de un Pod están listos, pero al menos una condición -personalizada está ausente o `False`, -el kubelet establece la [condición](#pod-conditions) del Pod -en `ContainersReady`. - -### Preparación de la red del Pod {#pod-has-network} - -{{< feature-state for_k8s_version="v1.29" state="beta" >}} - -{{< note >}} -Durante su desarrollo temprano, esta condición se llamaba `PodhasNetwork`. -{{< /note >}} - -### Preparación de la programación del Pod {#pod-scheduling-readiness-gate} - -{{< feature-state for_k8s_version="v1.26" state="alpha" >}} - -Revisa [Preparación de la programación del Pod](/docs/concepts/scheduling-eviction/pod-scheduling-readiness/) -para más información. +Para un Pod con contenedores de inicialización, el kubelet establece la condición `Initialized` en +`True` después de que los contenedores de inicialización se hayan completado exitosamente (lo que ocurre +después de la creación exitosa del sandbox y la configuración de la red por el plugin de runtime). +Para un Pod sin contenedores de inicialización, el kubelet establece la condición `Initialized` +en `True` antes de que comience la creación del sandbox y la configuración de la red. ## Sondeos del contenedor From 4bc6afb68c0d23065f0f47321e571f91a6a47624 Mon Sep 17 00:00:00 2001 From: Sergey Kanzhelev Date: Thu, 8 Aug 2024 20:38:54 +0000 Subject: [PATCH 027/408] sidecar containers --- .../workloads/pods/sidecar-containers.md | 1 + content/en/docs/tutorials/_index.md | 4 + .../configuration/pod-sidecar-containers.md | 172 ++++++++++++++++++ 3 files changed, 177 insertions(+) create mode 100644 content/en/docs/tutorials/configuration/pod-sidecar-containers.md diff --git a/content/en/docs/concepts/workloads/pods/sidecar-containers.md b/content/en/docs/concepts/workloads/pods/sidecar-containers.md index 86a577156c..1d3c8aa74f 100644 --- a/content/en/docs/concepts/workloads/pods/sidecar-containers.md +++ b/content/en/docs/concepts/workloads/pods/sidecar-containers.md @@ -143,6 +143,7 @@ request and limit, the same as the scheduler. ## {{% heading "whatsnext" %}} +* Learn how to [Adopt Sidecar Containers](/docs/tutorials/configuration/pod-sidecar-containers/) * Read a blog post on [native sidecar containers](/blog/2023/08/25/native-sidecar-containers/). * Read about [creating a Pod that has an init container](/docs/tasks/configure-pod-container/configure-pod-initialization/#create-a-pod-that-has-an-init-container). * Learn about the [types of probes](/docs/concepts/workloads/pods/pod-lifecycle/#types-of-probe): liveness, readiness, startup probe. diff --git a/content/en/docs/tutorials/_index.md b/content/en/docs/tutorials/_index.md index 97a3bacbdf..9599568474 100644 --- a/content/en/docs/tutorials/_index.md +++ b/content/en/docs/tutorials/_index.md @@ -28,6 +28,10 @@ Before walking through each tutorial, you may want to bookmark the * [Example: Configuring a Java Microservice](/docs/tutorials/configuration/configure-java-microservice/) * [Configuring Redis Using a ConfigMap](/docs/tutorials/configuration/configure-redis-using-configmap/) +## Authoring Pods + +* [Adopting Sidecar Containers](/docs/tutorials/configuration/pod-sidecar-containers/) + ## Stateless Applications * [Exposing an External IP Address to Access an Application in a Cluster](/docs/tutorials/stateless-application/expose-external-ip-address/) diff --git a/content/en/docs/tutorials/configuration/pod-sidecar-containers.md b/content/en/docs/tutorials/configuration/pod-sidecar-containers.md new file mode 100644 index 0000000000..26a947a913 --- /dev/null +++ b/content/en/docs/tutorials/configuration/pod-sidecar-containers.md @@ -0,0 +1,172 @@ +--- +title: Adopting Sidecar Containers +content_type: tutorial +weight: 40 +min-kubernetes-server-version: 1.29 +--- + + + +This section is relevant for people adopting a new built-in [sidecar containers](/docs/concepts/workloads/pods/sidecar-containers/) feature for their workloads. + +Sidecar containers is not a new concept as posted in the [blog post](https://kubernetes.io/blog/2015/06/the-distributed-system-toolkit-patterns/). +Kubernetes allowed to run multiple containers in a Pod to implement this concept. However, running sidecar container as a regular container +has a lot of limitations being fixed with the new built-in sidecar containers support. + +{{< feature-state feature_gate_name="SidecarContainers" >}} + +## {{% heading "objectives" %}} + +* Understand the need for sidecar containers +* Be able to troubleshoot issues with the sidecar containers +* Understand options to universally "inject" sidecar containers to any workload + + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} + + + + + +## Sidecar containers overview + +Sidecar containers are the secondary containers that run along with the main +application container within the same {{< glossary_tooltip text="Pod" term_id="pod" >}}. +These containers are used to enhance or to extend the functionality of the primary _app +container_ by providing additional services, or functionality such as logging, monitoring, +security, or data synchronization, without directly altering the primary application code. +You can read more in the [Sidecar containers](/docs/concepts/workloads/pods/sidecar-containers/) +concept page. + +The concept of sidecar containers is not new and there are multiple implementation of this concept. +As well as sidecar containers that you, the person defining the Pod, want to run, you can also find +that some {{< glossary_tooltip text="addons" term_id="addons" >}} modify Pods - before the Pods +start running - so that there are extra sidecar containers. The mechanisms to _inject_ those extra +sidecars are often [mutating webhooks](/docs/reference/access-authn-authz/admission-controllers/ +#mutatingadmissionwebhook). +For example, a service mesh addon might inject a sidecar that configures mutual TLS and encryption +in transit between different Pods. + +While the concept of sidecar containers is not new, +the native implementation of this feature in Kubernetes, however, is new. And as with every new feature, +adopting this feature may present certain challenges. + +This tutorial explore challenges and solution can be experienced by end users as well as +by authors of sidecar containers. + +## Benefits of a built-in sidecar containers + +Using Kubernetes' native support for sidecar containers provides several benefits: + +1. You can configure a native sidecar container to start ahead of {{< glossary_tooltip text="init containers" term_id="init-container" >}}. +2. The built-in sidecar containers can be authored to guarantee that they are terminated last. + Sidecar containers are terminated with a `SIGTERM` signal once all the regular containers + are completed and terminated. If the sidecar container isn’t gracefully shut down, a + `SIGKILL` signal will be used to terminate it. +3. With Jobs, when Pod's `restartPolicy: OnFailure` or `restartPolicy: Never`, + native sidecar containers do not block Pod completion. With legacy sidecar containers, + special care is needed to handle this situation. +4. Also, with Jobs, built-in sidecar containers would keep being restarted once they are done, even if regular containers would not with Pod's `restartPolicy: Never`. + +## Adopting built-in sidecar containers + +The `SidecarContainers` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) is in beta state starting from Kubernetes version 1.29 and is enabled by default. +Some clusters may have this feature disabled or have software installed that is incompatible with the feature. + +When this happens, the Pod may be rejected or the sidecar containers may block Pod startup, rendering the Pod useless. +This condition is easy to detect as Pod simply get stuck on initialization. However, it is rarely clear what caused the problem. + +Here are the considerations and troubleshooting steps that one can take while adopting sidecar containers for their workload. + +### Ensure the feature gate is enabled + +As a very first step, make sure that both - API server and Nodes are at Kubernetes version v1.29 or +later. +The feature will break on clusters where Nodes are running earlier versions where it is not enabled. + +{{< alert title="Note" color="info" >}} + +The feature can be enabled on nodes with the version 1.28. The behavior of built-in sidecar +container termination was different in version 1.28 and it is not recommended to adjust +behavior of a sidecar to that behavior. However if that only concern is the startup order, the +above statement can be changed to Nodes, running version 1.28 with the feature gate enabled. + +{{< /alert >}} + +You should ensure that the feature gate is enabled for the API server(s) within the control plane +**and** for all nodes. + +One of the ways to check the feature gate enablement is running a command like this: + +- For API Server + `kubectl get --raw /metrics | grep kubernetes_feature_enabled | grep SidecarContainers` +- For the individual node: + `kubectl get --raw /api/v1/nodes//proxy/metrics | grep kubernetes_feature_enabled | grep SidecarContainers` + +If you see something like: `kubernetes_feature_enabled{name="SidecarContainers",stage="BETA"} 1`, +it means that the feature is enabled. + +### Check for 3rd party tooling and mutating webhooks + +If you experience issues when validating the feature, it may be an indication that one of the +3rd party tools or mutating webhooks are broken. + +When the `SidecarContainers` feature gate is enabled, Pods gain a new field in their API. +Some tools or mutating webhooks might have been built with an earlier version of Kubernetes API. + +If tools pass the unknown fields as-is using various patching strategies to mutate a Pod object, +this will not be a problem. However there are tools that will strip out unknown fields; +if you have those, they must be recompiled with the v1.28+ version of Kubernetes API client code. + +The way to check this is to use the `kubectl describe pod` command with your Pod that has passed through +mutating admission. +If any tools stripped out the new field (`restartPolicy:Always`), you will not see it in the command output. + +If you hit an issue like this, please advise the author of the tools or the webhooks use one of the patching strategies of modifying objects instead of a full object update. + +{{< alert title="Note" color="info" >}} + +Mutating webhook may update Pods based on some conditions. So sidecar containers may work for some Pods and fail for others. + +{{< /alert >}} + +### Automatic injection of sidecars + +If you are using software that injects sidecars automatically, +there are a few possible strategies you may follow to +ensure that native sidecar container can be used. +All of the strategies are generally options you may choose to decide whether +the Pod the sidecar will be injected to will land on a Node supporting the feature or not. + +As an example, you can follow [this conversation in Istio community](https://github.com/istio/istio/issues/48794). The discussion is exploring the options listed below. + +1. Mark Pods that lands to nodes supporting sidecars. You can use node labels + and node affinity to mark nodes supporting sidecar containers and Pods landing on those nodes. +2. Check Nodes compatibility on injection. During sidecar injection you may use the following strategies to check node compatibility: + - query node version and assume the feature gate is enabled on the version 1.29+ + - query node prometheus metrics and check feature enablement status + - assume the nodes are running with a [supported version skew](/releases/version-skew-policy/#supported-version-skew) + from the API server + - there may be other custom ways to detect nodes compatibility. +3. Develop a universal sidecar injector. The idea of a universal sidecar container is to inject a sidecar container + as a regular container as well as a native sidecar container. And have a runtime logic to decide which one will work. + The universal sidecar injector is wasteful as it will account for requests twice, but may be considered as a workable solution for special cases. + - One way would be on start of a native sidecar container + detect the node version and exit immediately if the version does not support the sidecar feature. + - Consider runtime feature detection design: + - Define an empty dir so containers can communicate with each other + - Inject init container, let's call it `NativeSidecar` with `restartPolicy=Always`. + - `NativeSidecar` must write a file to an empty dir indicating the first run and exists immediately with exit code `0`. + - `NativeSidecar` on restart (when native sidecars are supported) checks that file already exists in the empty dir and changes it - indicating that the built-in sidecar containers are supported and running. + - Inject regular container, let's call it `OldWaySidecar`. + - `OldWaySidecar` on start checks the presence of a file in an empty dir. + - If the file indicates that the `NativeSidecar` is NOT running - it assumes that the sidecar feature is not supported and works assuming it is the sidecar. + - If the file indicates that the `NativeSidecar` is running - it either does nothing and sleeps forever (in case when Pod’s `restartPolicy=Always`) or exists immediately with exit code `0` (in case when Pod’s `restartPolicy!=Always`). + + +## {{% heading "whatsnext" %}} + + +* Learn more about [sidecar containers](/docs/concepts/workloads/pods/sidecar-containers/). From 932f32412cf4c51beaeacd72e0bf3f5e14c64e69 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 12 Mar 2024 23:41:24 +0000 Subject: [PATCH 028/408] Revise deprecation warnings Ready the deprecation warning mechanism for when we want to align with upstream Docsy. --- layouts/blog/single.html | 4 ++++ layouts/docs/baseof.html | 3 --- layouts/docs/glossary.html | 1 + layouts/docs/list.html | 1 + layouts/docs/release-info.html | 3 ++- layouts/docs/single.html | 1 + layouts/partials/deprecation-warning.html | 4 ++-- 7 files changed, 11 insertions(+), 6 deletions(-) create mode 100644 layouts/blog/single.html diff --git a/layouts/blog/single.html b/layouts/blog/single.html new file mode 100644 index 0000000000..84e2b2265a --- /dev/null +++ b/layouts/blog/single.html @@ -0,0 +1,4 @@ +{{ define "main" }} +{{ partial "deprecation-warning.html" . }} +{{ .Render "content" }} +{{ end }} diff --git a/layouts/docs/baseof.html b/layouts/docs/baseof.html index 40c80fc21f..2679883f44 100644 --- a/layouts/docs/baseof.html +++ b/layouts/docs/baseof.html @@ -24,9 +24,6 @@
{{ if not .Site.Params.ui.breadcrumb_disable }}{{ partial "breadcrumb.html" . }}{{ end }} - {{ block "deprecated" . }} - {{ partial "deprecation-warning.html" . }} - {{ end }} {{ block "outdated_content" . }} {{ partial "docs/outdated_content.html" . }} {{ end }} diff --git a/layouts/docs/glossary.html b/layouts/docs/glossary.html index 1688201d25..8c73fbc9c4 100644 --- a/layouts/docs/glossary.html +++ b/layouts/docs/glossary.html @@ -3,6 +3,7 @@ {{ end }} {{ define "main" }} +{{ partial "deprecation-warning.html" . }}

{{ .Title }}

{{- with resources.Get "css/glossary.css" -}} diff --git a/layouts/docs/list.html b/layouts/docs/list.html index cc10537a76..8c1f34b388 100644 --- a/layouts/docs/list.html +++ b/layouts/docs/list.html @@ -6,6 +6,7 @@ {{- end -}} {{- end -}}
+ {{- partial "deprecation-warning.html" . -}} {{ $hasContent := false }} {{ with .File }} {{ if ne .Filename "" }} diff --git a/layouts/docs/release-info.html b/layouts/docs/release-info.html index bdb06233b3..e336673050 100644 --- a/layouts/docs/release-info.html +++ b/layouts/docs/release-info.html @@ -2,6 +2,7 @@ {{ if not .Site.Params.deprecated }} {{ .Content }} {{ else }} +{{ partial "deprecation-warning.html" . }}
{{ range where .Site.Pages "Section" "releases" }} {{ if not .IsNode }} @@ -10,6 +11,6 @@
{{ end }} {{ end }} -
+ {{ end }} {{ end }} \ No newline at end of file diff --git a/layouts/docs/single.html b/layouts/docs/single.html index 8bc6fc7a0a..f681c5d281 100644 --- a/layouts/docs/single.html +++ b/layouts/docs/single.html @@ -1,4 +1,5 @@ {{ define "main" }} +{{ partial "deprecation-warning.html" . }}
{{ partial "docs/content-page" (dict "ctx" . "page" .) }} diff --git a/layouts/partials/deprecation-warning.html b/layouts/partials/deprecation-warning.html index bf5b67e445..c730313d01 100644 --- a/layouts/partials/deprecation-warning.html +++ b/layouts/partials/deprecation-warning.html @@ -1,6 +1,6 @@ {{ if (.Site.Param "deprecated") }}
-
+

{{ T "deprecation_title" }} {{ .Param "version" }}

@@ -11,7 +11,7 @@
{{ else if and (eq .Section "blog") (not .Params.evergreen) .Date (.Date.Before (now.AddDate -1 0 0)) -}}
-
+

{{ T "outdated_blog__message" }}

From 3346b60b8ffc6952eb09fdb89bdae7d9264a28eb Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Thu, 8 Aug 2024 22:26:58 +0100 Subject: [PATCH 029/408] Adapt blog section for Docsy --- layouts/blog/baseof.html | 3 --- layouts/blog/list.html | 1 + 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/layouts/blog/baseof.html b/layouts/blog/baseof.html index de45d440e4..14a5529d3a 100644 --- a/layouts/blog/baseof.html +++ b/layouts/blog/baseof.html @@ -32,9 +32,6 @@
- {{ block "deprecated" . }} - {{ partial "deprecation-warning.html" . }} - {{ end }} {{ with .CurrentSection.OutputFormats.Get "rss" -}} RSS diff --git a/layouts/blog/list.html b/layouts/blog/list.html index 37d152ef5e..fb4084dc47 100644 --- a/layouts/blog/list.html +++ b/layouts/blog/list.html @@ -12,6 +12,7 @@ have blog posts --> {{ $pageGroups := $pag.PageGroups}} {{ if eq $pag.PageNumber 1 }} {{ end }} +{{ partial "deprecation-warning.html" . }}
{{ range $pageGroups }} From be19e4a401cbb6911a6dbff7b2ac1345665be4eb Mon Sep 17 00:00:00 2001 From: stevessr <89645372+stevessr@users.noreply.github.com> Date: Fri, 9 Aug 2024 17:18:05 +0800 Subject: [PATCH 030/408] sync new contributor ambassador from README.md --- README-bn.md | 2 +- README-ja.md | 2 +- README-ko.md | 2 +- README-pt.md | 2 +- README-uk.md | 2 +- README-vi.md | 2 +- README-zh.md | 7 ++++--- 7 files changed, 10 insertions(+), 9 deletions(-) diff --git a/README-bn.md b/README-bn.md index 765d05e2af..71ddeecff2 100644 --- a/README-bn.md +++ b/README-bn.md @@ -186,7 +186,7 @@ sudo launchctl load -w /Library/LaunchDaemons/limit.maxfiles.plist | Name | Slack | GitHub | | -------------------------- | -------------------------- | -------------------------- | -| Arsh Sharma | @arsh | @RinkiyaKeDad | +| Sreeram Venkitesh | @sreeram.venkitesh | @sreeram-venkitesh | ## Localization READMEs diff --git a/README-ja.md b/README-ja.md index a796164244..ea25d980ce 100644 --- a/README-ja.md +++ b/README-ja.md @@ -196,7 +196,7 @@ Kubernetesのドキュメントへの貢献に関する詳細については以 | 名前 | Slack | GitHub | | -------------------------- | -------------------------- | -------------------------- | -| Arsh Sharma | @arsh | @RinkiyaKeDad | +| Sreeram Venkitesh | @sreeram.venkitesh | @sreeram-venkitesh | ## 翻訳された`README.md`一覧 {#localization-readmemds} diff --git a/README-ko.md b/README-ko.md index fd17e2b655..3557f271b8 100644 --- a/README-ko.md +++ b/README-ko.md @@ -173,7 +173,7 @@ sudo launchctl load -w /Library/LaunchDaemons/limit.maxfiles.plist | Name | Slack | GitHub | | -------------------------- | -------------------------- | -------------------------- | -| Arsh Sharma | @arsh | @RinkiyaKeDad | +| Sreeram Venkitesh | @sreeram.venkitesh | @sreeram-venkitesh | # `README.md`에 대한 쿠버네티스 문서 현지화(localization) {#localization-readmemds} diff --git a/README-pt.md b/README-pt.md index ae2f644ed8..d55e32b683 100644 --- a/README-pt.md +++ b/README-pt.md @@ -187,7 +187,7 @@ Caso você precise de ajuda em algum momento ao contribuir, os [Embaixadores par | Nome | Slack | GitHub | | -------------------------- | -------------------------- | -------------------------- | -| Arsh Sharma | @arsh | @RinkiyaKeDad | +| Sreeram Venkitesh | @sreeram.venkitesh | @sreeram-venkitesh | ## Traduções do `README.md` diff --git a/README-uk.md b/README-uk.md index 3b4e7c1e27..a0f876b4ab 100644 --- a/README-uk.md +++ b/README-uk.md @@ -186,7 +186,7 @@ sudo launchctl load -w /Library/LaunchDaemons/limit.maxfiles.plist | Імʼя | Slack | GitHub | | -------------------------- | -------------------------- | -------------------------- | -| Arsh Sharma | @arsh | @RinkiyaKeDad | +| Sreeram Venkitesh | @sreeram.venkitesh | @sreeram-venkitesh | ## Локалізовані файли README diff --git a/README-vi.md b/README-vi.md index 16c86f277b..539c7a734b 100644 --- a/README-vi.md +++ b/README-vi.md @@ -194,7 +194,7 @@ Nếu bạn cần trợ giúp bất kỳ lúc nào khi đóng góp, [Đại sứ | Name | Slack | GitHub | | -------------------------- | -------------------------- | -------------------------- | -| Arsh Sharma | @arsh | @RinkiyaKeDad | +| Sreeram Venkitesh | @sreeram.venkitesh | @sreeram-venkitesh | ## Các tệp README đa ngôn ngữ diff --git a/README-zh.md b/README-zh.md index 732fb6b0e3..ddfba39fdf 100644 --- a/README-zh.md +++ b/README-zh.md @@ -429,13 +429,14 @@ If you need help at any point when contributing, the [New Contributor Ambassador SIG Docs 的当前新贡献者大使： | 姓名 | Slack | GitHub | | -------------------------- | -------------------------- | -------------------------- | -| Arsh Sharma | @arsh | @RinkiyaKeDad | +| Sreeram Venkitesh | @sreeram.venkitesh | @sreeram-venkitesh | + + +A veces las cosas salen mal. Esta guía tiene como objetivo solucionarlas. Tiene +dos secciones: + +* [Depuración de su aplicación](/docs/tasks/debug/debug-application/) - Útil +para usuarios que están implementando código en Kubernetes y se preguntan por qué no funciona. +* [Depuración de su clúster](/docs/tasks/debug/debug-cluster/) - Útil +para administradores de clústeres y personas cuyo clúster de Kubernetes no está satisfecho. + +También debe comprobar los problemas conocidos del [release](https://github.com/kubernetes/kubernetes/releases) +usado. + + + +## Obteniendo ayuda + +Si ninguna de las guías anteriores resuelve su problema, existen varias formas de obtener ayuda de la comunidad de Kubernetes.. + +### Preguntas + +La documentación de este sitio ha sido estructurada para brindar respuestas a una amplia gama de preguntas. [Conceptos](/docs/concepts/) explican la arquitectura de Kubernetes +y cómo funciona cada componente, mientras [Configuración](/docs/setup/) proporciona +instrucciones prácticas para empezar. [Tareas](/docs/tasks/) muestran cómo +realizar tareas de uso común, y [Tutoriales](/docs/tutorials/) son recorridos más completos de escenarios de desarrollo reales, específicos de la industria o de extremo a extremo. La sección de [Referencia](/docs/reference/) proporciona +documentación detallada sobre el [Kubernetes API](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/) +y las interfaces de línea de comandos (CLIs), tal como [`kubectl`](/docs/reference/kubectl/). + +## ¡Ayuda! ¡Mi pregunta no está tratada! ¡Necesito ayuda ahora! + +### Stack Exchange, Stack Overflow o Falla del Servidor {#stack-exchange} + +Si tienes preguntas relacionadas con *desarrollo de software* para su aplicación en contenedores, +puedes preguntarles a los de [Stack Overflow](https://stackoverflow.com/questions/tagged/kubernetes). + +Si tiene preguntas sobre Kubernetes relacionadas con *administración de clusters* or *configuración*, +puedes preguntarles a los de +[Server Fault](https://serverfault.com/questions/tagged/kubernetes). + +También hay varios sitios de Stack Exchange que podrían ser el lugar adecuado para hacer preguntas sobre Kubernetes en áreas como +[DevOps](https://devops.stackexchange.com/questions/tagged/kubernetes), +[Ingeniería de Software](https://softwareengineering.stackexchange.com/questions/tagged/kubernetes), +or [InfoSec](https://security.stackexchange.com/questions/tagged/kubernetes). + +Es posible que otra persona de la comunidad ya haya hecho una pregunta similar o +pueda ayudar con su problema. + +El equipo de Kubernetes también monitoreará +[publicaciones etiquetadas con Kubernetes](https://stackoverflow.com/questions/tagged/kubernetes). +Si no hay ninguna pregunta existente que te ayude, **asegúrate de que tu pregunta +sea [sobre el tema en Stack Overflow](https://stackoverflow.com/help/on-topic), +[Falla del Servidor](https://serverfault.com/help/on-topic), o el Stack Exchange +correcto en el que estás preguntando**, y lea las instrucciones sobre +[Cómo hacer una nueva pregunta](https://stackoverflow.com/help/how-to-ask), +Antes de preguntar una nueva! + +### Slack + +Muchas personas de la comunidad de Kubernetes se reúnen en Kubernetes Slack en el canal `#kubernetes-users`. +Slack requiere registro; puede [solicitar una invitación](https://slack.kubernetes.io), +y el registro está abierto a todos. No dudes en participar y hacer todas y cada una de las preguntas. +Una vez registrado, acceder a la [Organización de Kubernetes en Slack](https://kubernetes.slack.com) +a través de su navegador web o mediante la aplicación dedicada de Slack.. + +Una vez que esté registrado, explore la creciente lista de canales para diversos temas de +interés. Por ejemplo, las personas nuevas en Kubernetes también pueden querer unirse al canal +[`#kubernetes-novice`](https://kubernetes.slack.com/messages/kubernetes-novice). Como otro ejemplo, los desarrolladores deberían unirse al canal +[`#kubernetes-contributors`](https://kubernetes.slack.com/messages/kubernetes-contributors). + +También hay muchos canales en idiomas locales o específicos de cada país. Siéntete libre de unirte +estos canales para obtener soporte e información localizados: + +{{< table caption="Country / language specific Slack channels" >}} +Región | Channels +:---------|:------------ +China | [`#cn-users`](https://kubernetes.slack.com/messages/cn-users), [`#cn-events`](https://kubernetes.slack.com/messages/cn-events) +Finland | [`#fi-users`](https://kubernetes.slack.com/messages/fi-users) +France | [`#fr-users`](https://kubernetes.slack.com/messages/fr-users), [`#fr-events`](https://kubernetes.slack.com/messages/fr-events) +Germany | [`#de-users`](https://kubernetes.slack.com/messages/de-users), [`#de-events`](https://kubernetes.slack.com/messages/de-events) +India | [`#in-users`](https://kubernetes.slack.com/messages/in-users), [`#in-events`](https://kubernetes.slack.com/messages/in-events) +Italy | [`#it-users`](https://kubernetes.slack.com/messages/it-users), [`#it-events`](https://kubernetes.slack.com/messages/it-events) +Japan | [`#jp-users`](https://kubernetes.slack.com/messages/jp-users), [`#jp-events`](https://kubernetes.slack.com/messages/jp-events) +Korea | [`#kr-users`](https://kubernetes.slack.com/messages/kr-users) +Netherlands | [`#nl-users`](https://kubernetes.slack.com/messages/nl-users) +Norway | [`#norw-users`](https://kubernetes.slack.com/messages/norw-users) +Poland | [`#pl-users`](https://kubernetes.slack.com/messages/pl-users) +Russia | [`#ru-users`](https://kubernetes.slack.com/messages/ru-users) +Países Hispanos | [`#es-users`](https://kubernetes.slack.com/messages/es-users) +Sweden | [`#se-users`](https://kubernetes.slack.com/messages/se-users) +Turkey | [`#tr-users`](https://kubernetes.slack.com/messages/tr-users), [`#tr-events`](https://kubernetes.slack.com/messages/tr-events) +{{< /table >}} + +### Foro + +Te invitamos a unirte al Foro oficial de Kubernetes: [discuss.kubernetes.io](https://discuss.kubernetes.io). + +### Bugs y solicitudes de funcionalidades + +Si tiene lo que parece ser un error (bug) o desea realizar una solicitud de funcionalidades, +por favor utilice el [Sistema de seguimiento de asuntos en el GitHub](https://github.com/kubernetes/kubernetes/issues). + +Antes de presentar un problema, busque problemas existentes para ver si su problema ya está cubierto. + +Si presenta un error, incluya información detallada sobre cómo reproducir el +problema, como por ejemplo: + +* Versión de Kubernetes: `kubectl version` +* Proveedor de nube, distribución del sistema operativo, configuración de red y versión del contenedor runtime +* Pasos para reproducir el problema + diff --git a/content/es/docs/tasks/debug/debug-application/_index.md b/content/es/docs/tasks/debug/debug-application/_index.md new file mode 100644 index 0000000000..14b40314e2 --- /dev/null +++ b/content/es/docs/tasks/debug/debug-application/_index.md @@ -0,0 +1,4 @@ +--- +title: "Solución de Problemas de Aplicaciones" +weight: 80 +--- diff --git a/content/es/docs/tasks/debug-application-cluster/debug-init-containers.md b/content/es/docs/tasks/debug/debug-application/debug-init-containers.md similarity index 100% rename from content/es/docs/tasks/debug-application-cluster/debug-init-containers.md rename to content/es/docs/tasks/debug/debug-application/debug-init-containers.md diff --git a/content/es/docs/tasks/debug/debug-cluster/_index.md b/content/es/docs/tasks/debug/debug-cluster/_index.md new file mode 100644 index 0000000000..0764429502 --- /dev/null +++ b/content/es/docs/tasks/debug/debug-cluster/_index.md @@ -0,0 +1,4 @@ +--- +title: "Solución de Problemas de Clústeres" +weight: 80 +--- diff --git a/content/es/docs/tasks/debug-application-cluster/audit.md b/content/es/docs/tasks/debug/debug-cluster/audit.md similarity index 100% rename from content/es/docs/tasks/debug-application-cluster/audit.md rename to content/es/docs/tasks/debug/debug-cluster/audit.md diff --git a/content/es/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md b/content/es/docs/tasks/debug/debug-cluster/logging-elasticsearch-kibana.md similarity index 100% rename from content/es/docs/tasks/debug-application-cluster/logging-elasticsearch-kibana.md rename to content/es/docs/tasks/debug/debug-cluster/logging-elasticsearch-kibana.md diff --git a/content/es/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md b/content/es/docs/tasks/debug/debug-cluster/resource-metrics-pipeline.md similarity index 100% rename from content/es/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md rename to content/es/docs/tasks/debug/debug-cluster/resource-metrics-pipeline.md From d9332efbb1c06115622384a8d40181b422833a50 Mon Sep 17 00:00:00 2001 From: Arhell Date: Tue, 13 Aug 2024 01:03:56 +0300 Subject: [PATCH 032/408] [fr] Fix inconsistent example --- .../configmap-secret/managing-secret-using-kustomize.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/fr/docs/tasks/configmap-secret/managing-secret-using-kustomize.md b/content/fr/docs/tasks/configmap-secret/managing-secret-using-kustomize.md index 4f695c31a2..c54f94c0b6 100644 --- a/content/fr/docs/tasks/configmap-secret/managing-secret-using-kustomize.md +++ b/content/fr/docs/tasks/configmap-secret/managing-secret-using-kustomize.md @@ -102,17 +102,17 @@ kubectl get -k -o jsonpath='{.data}' Le résutat est similaire à : ``` -{ "password": "UyFCXCpkJHpEc2I9", "username": "YWRtaW4=" } +{ "password": "MWYyZDFlMmU2N2Rm", "username": "YWRtaW4=" } ``` ``` -echo 'UyFCXCpkJHpEc2I9' | base64 --decode +echo 'MWYyZDFlMmU2N2Rm' | base64 --decode ``` Le résultat est similaire à : ``` -S!B\*d$zDsb= +1f2d1e2e67df ``` Pour en savor plus, consultez From acebe895e74dc39081c4310e3f5d1416a210cca7 Mon Sep 17 00:00:00 2001 From: kohbis <18735471+kohbis@users.noreply.github.com> Date: Tue, 13 Aug 2024 21:55:40 +0900 Subject: [PATCH 033/408] Update deprecation-policy.md --- content/en/docs/reference/using-api/deprecation-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/using-api/deprecation-policy.md b/content/en/docs/reference/using-api/deprecation-policy.md index 6d1259b365..5af5a15e67 100644 --- a/content/en/docs/reference/using-api/deprecation-policy.md +++ b/content/en/docs/reference/using-api/deprecation-policy.md @@ -480,7 +480,7 @@ registration. Like their stable undeprecated counterparts, deprecated metrics wi be automatically registered to the metrics endpoint and therefore visible. On a subsequent release (when the metric's `deprecatedVersion` is equal to -_current_kubernetes_version - 3_)), a deprecated metric will become a _hidden_ metric. +_current_kubernetes_version - 3_), a deprecated metric will become a _hidden_ metric. **_Unlike_** their deprecated counterparts, hidden metrics will _no longer_ be automatically registered to the metrics endpoint (hence hidden). However, they can be explicitly enabled through a command line flag on the binary From 93bd8323ccadfde233f3c1e5e6c28b7b4f4bf396 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 13 Aug 2024 23:56:59 +0100 Subject: [PATCH 034/408] Revise Sweetalert asset load Use Hugo Pipes to load the Sweetalert script when needed. --- {static => assets}/js/sweetalert-2.1.2.min.js | 0 layouts/partials/hooks/body-end.html | 8 +++++++- 2 files changed, 7 insertions(+), 1 deletion(-) rename {static => assets}/js/sweetalert-2.1.2.min.js (100%) diff --git a/static/js/sweetalert-2.1.2.min.js b/assets/js/sweetalert-2.1.2.min.js similarity index 100% rename from static/js/sweetalert-2.1.2.min.js rename to assets/js/sweetalert-2.1.2.min.js diff --git a/layouts/partials/hooks/body-end.html b/layouts/partials/hooks/body-end.html index ca53b77100..402b7c19da 100644 --- a/layouts/partials/hooks/body-end.html +++ b/layouts/partials/hooks/body-end.html @@ -6,7 +6,13 @@ {{ end }} {{/* copy-and-paste helper for codenew shortcode */}} {{- if or (.HasShortcode "code_sample") (.HasShortcode "code") (.HasShortcode "codenew") -}} - + {{- if hugo.IsProduction -}} + {{- $sweetAlert := resources.Get "js/sweetalert-2.1.2.min.js" | minify | fingerprint -}} + + {{- else -}} + {{- $sweetAlert := resources.Get "js/sweetalert-2.1.2.min.js" -}} + + {{- end -}} + + + + + From f04b70c07fbeb881019ee5861d6f378aeb82fe39 Mon Sep 17 00:00:00 2001 From: Shingo Omura Date: Sat, 17 Aug 2024 13:14:44 +0900 Subject: [PATCH 058/408] [ja] Translated content/en/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control into Japanese (#47499) * [ja] translated content/en/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control into Japanese * Apply suggestions from code review Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * [ja] add kep link to content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/index.md --------- Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> --- .../implicit-groups.yaml | 15 ++ .../index.md | 161 ++++++++++++++++++ .../strict-supplementalgroups-policy.yaml | 16 ++ 3 files changed, 192 insertions(+) create mode 100644 content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/implicit-groups.yaml create mode 100644 content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/index.md create mode 100644 content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/strict-supplementalgroups-policy.yaml diff --git a/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/implicit-groups.yaml b/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/implicit-groups.yaml new file mode 100644 index 0000000000..2e50ed0104 --- /dev/null +++ b/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/implicit-groups.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: implicit-groups +spec: + securityContext: + runAsUser: 1000 + runAsGroup: 3000 + supplementalGroups: [4000] + containers: + - name: ctr + image: registry.k8s.io/e2e-test-images/agnhost:2.45 + command: [ "sh", "-c", "sleep 1h" ] + securityContext: + allowPrivilegeEscalation: false diff --git a/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/index.md b/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/index.md new file mode 100644 index 0000000000..07c6fd9732 --- /dev/null +++ b/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/index.md @@ -0,0 +1,161 @@ +--- +layout: blog +title: 'Kubernetes 1.31: Fine-grained SupplementalGroups control' +date: 2024-08-22 +slug: fine-grained-supplementalgroups-control +author: > + Shingo Omura (Woven By Toyota) +translator: > + Shingo Omura (Woven By Toyota) +--- + +この記事ではKubernetes 1.31の新機能である、Pod内のコンテナにおける補助グループ制御の改善機能について説明します。 + +## 動機: コンテナイメージ内の`/etc/group`に定義される暗黙的なグループ情報 + +この挙動は多くのKubernetesクラスターのユーザー、管理者にとってあまり知られていないかもしれませんが、Kubernetesは、デフォルトでは、Podで定義された情報に加えて、コンテナイメージ内の`/etc/group`のグループ情報を _マージ_ します。 + +例を見てみましょう。このPodはsecurityContextで`runAsUser=1000`、`runAsGroup=3000`、`supplementalGroups=4000`を指定しています。 + +{{% code_sample file="implicit-groups.yaml" %}} + +`ctr`コンテナで`id`コマンドを実行すると何が出力されるでしょうか？ + +```console +# Podを作成してみましょう。 +$ kubectl apply -f https://k8s.io/blog/2024-08-22-Fine-grained-SupplementalGroups-control/implicit-groups.yaml + +# Podのコンテナが実行されていることを確認します。 +$ kubectl get pod implicit-groups + +# idコマンドを確認します。 +$ kubectl exec implicit-groups -- id +``` + +出力は次のようになるでしょう。 + +```none +uid=1000 gid=3000 groups=3000,4000,50000 +``` + +Podマニフェストには`50000`は一切定義されていないにもかかわらず、補助グループ(`groups`フィールド)に含まれているグループID`50000`は一体どこから来るのでしょうか? 答えはコンテナイメージの`/etc/group`ファイルです。 + +コンテナイメージの`/etc/group`の内容が下記のようになっていることが確認できるでしょう。 + +```console +$ kubectl exec implicit-groups -- cat /etc/group +... +user-defined-in-image:x:1000: +group-defined-in-image:x:50000:user-defined-in-image +``` + +なるほど！コンテナのプライマリユーザーであるユーザー(`1000`)がグループ(`50000`)に属していることが最後のエントリから確認出来ました。 + +このように、コンテナイメージ上の`/etc/group`で定義される、コンテナのプライマリユーザーのグループ情報は、Podからの情報に加えて _暗黙的にマージ_ されます。ただし、この挙動は、現在のCRI実装がDockerから引き継いだ設計上の決定であり、コミュニティはこれまでこの挙動について再検討することはほとんどありませんでした。 + +### 何が悪いのか？ + +コンテナイメージの`/etc/group`から _暗黙的にマージ_ されるグループ情報は、特にボリュームアクセスを行う際に、セキュリティ上の懸念を引き起こすことがあります(詳細は[kubernetes/kubernetes#112879](https://issue.k8s.io/112879)を参照してください)。なぜなら、Linuxにおいて、ファイルパーミッションはuid/gidで制御されているからです。更に悪いことに、`/etc/group`に由来する暗黙的なgidは、マニフェストにグループ情報の手がかりが無いため、ポリシーエンジン等でチェック・検知をすることが出来ません。これはKubernetesセキュリティの観点からも懸念となります。 + +## PodにおけるFine-grined(きめ細かい) SupplementalGroups control: `SupplementaryGroupsPolicy` + +この課題を解決するために、Kubernetes 1.31はPodの`.spec.securityContext`に、新しく`supplementalGroupsPolicy`フィールドを追加します。 + +このフィールドは、Pod内のコンテナプロセスに付与される補助グループを決定するを方法を制御できるようにします。有効なポリシーは次の2つです。 + +* _Merge_: `/etc/group`で定義されている、コンテナのプライマリユーザーが所属するグループ情報をマージします。指定されていない場合、このポリシーがデフォルトです(後方互換性を考慮して既存の挙動と同様)。 + +* _Strict_: `fsGroup`、`supplementalGroups`、`runAsGroup`フィールドで指定されたグループIDのみ補助グループに指定されます。つまり、`/etc/group`で定義された、コンテナのプライマリユーザーのグループ情報はマージされません。 + +では、どのように`Strict`ポリシーが動作するか見てみましょう。 + +{{% code_sample file="strict-supplementalgroups-policy.yaml" %}} + +```console +# Podを作成してみましょう。 +$ kubectl apply -f https://k8s.io/blog/2024-08-22-Fine-grained-SupplementalGroups-control/strict-supplementalgroups-policy.yaml + +# Podのコンテナが実行されていることを確認します。 +$ kubectl get pod strict-supplementalgroups-policy + +# プロセスのユーザー、グループ情報を確認します。 +kubectl exec -it strict-supplementalgroups-policy -- id +``` + +出力はこのようになります。 + +```none +uid=1000 gid=3000 groups=3000,4000 +``` + +`Strict`ポリシーによってグループ`50000`が`groups`から除外されているのが確認できました！ + +このように、確実に`supplementalGroupsPolicy: Strict`を設定する(ポリシーエンジン等によって強制する)ことで、暗黙的な補助グループを回避することが可能になります。 + +{{}} +このフィールドの値を強制するだけでは不十分な場合もあります。なぜなら、プロセスが自分自身のユーザー、グループ情報を変更できる権限/ケーパビリティを持っている場合があるからです。詳細は次のセクションを参照してください。 +{{}} + +## Podステータスにおける付与されたユーザー、グループ情報の確認 + +この機能は、Podの`status.containerStatuses[].user.linux`フィールドでコンテナの最初のプロセスに付与されたユーザー、グループ情報を公開しています。暗黙的なグループIDが付与されているかどうかを確認するのに便利でしょう。 + +```yaml +... +status: + containerStatuses: + - name: ctr + user: + linux: + gid: 3000 + supplementalGroups: + - 3000 + - 4000 + uid: 1000 +... +``` + +{{}} +`status.containerStatuses[].user.linux`フィールドで公開されているユーザー、グループ情報は、コンテナの最初のプロセスに、_最初に付与された_ 情報であることに注意してください。 +もしそのプロセスが、自身のユーザー、グループ情報を変更できるシステムコール(例えば [`setuid(2)`](https://man7.org/linux/man-pages/man2/setuid.2.html), +[`setgid(2)`](https://man7.org/linux/man-pages/man2/setgid.2.html), +[`setgroups(2)`](https://man7.org/linux/man-pages/man2/setgroups.2.html)等)を実行する権限を持っている場合、プロセス自身で動的に変更が可能なためです。 +つまり、実際にプロセスに付与されているユーザー、グループ情報は動的に変化します。 +{{}} + +## この機能を利用するには + +`supplementalGroupsPolicy`フィールドを有効化するには、下記のコンポーネントを利用する必要があります。 + +- Kubernetes: v1.31以降、かつ、`SupplementalGroupsPolicy`[フィーチャーゲート](/docs/reference/command-line-tools-reference/feature-gates/)が有効化されていること。v1.31現在、このフィーチャーゲートはアルファです。 +- CRI実装: + - containerd: v2.0以降 + - CRI-O: v1.31以降 + +ノードの`.status.features.supplementalGroupsPolicy`フィールドでこの機能が利用可能かどうか確認出来ます。 + +```yaml +apiVersion: v1 +kind: Node +... +status: + features: + supplementalGroupsPolicy: true +``` + +## 将来の展望 + +Kubernetes SIG Nodeは、この機能が将来的なKubernetesのリリースでベータ版に昇格し、最終的には一般提供(GA)されることを望んでおり、期待しています。そうなれば、ユーザーはもはや機能ゲートを手動で有効にする必要がなくなります。 + +`supplementalGroupsPolicy`が指定されていない場合は、後方互換性のために`Merge`ポリシーが適用されます。 + +## より学ぶには？ + + + +- [Podとコンテナにセキュリティコンテキストを設定する](/ja/docs/tasks/configure-pod-container/security-context/)(`supplementalGroupsPolicy`の詳細) +- [KEP-3619: Fine-grained SupplementalGroups control](https://github.com/kubernetes/enhancements/issues/3619) + +## 参加するには？ + +この機能はSIG Nodeコミュニティによって推進されています。コミュニティに参加して、上記の機能やそれ以外のアイデアやフィードバックを共有してください。皆さんからのご意見をお待ちしています！ diff --git a/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/strict-supplementalgroups-policy.yaml b/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/strict-supplementalgroups-policy.yaml new file mode 100644 index 0000000000..8c949ba10f --- /dev/null +++ b/content/ja/blog/_posts/2024-08-22-Fine-grained-SupplementalGroups-control/strict-supplementalgroups-policy.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Pod +metadata: + name: strict-supplementalgroups-policy +spec: + securityContext: + runAsUser: 1000 + runAsGroup: 3000 + supplementalGroups: [4000] + supplementalGroupsPolicy: Strict + containers: + - name: ctr + image: registry.k8s.io/e2e-test-images/agnhost:2.45 + command: [ "sh", "-c", "sleep 1h" ] + securityContext: + allowPrivilegeEscalation: false From f525060e96c6c094af1a6f7c52e2942d266a9921 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sat, 17 Aug 2024 15:39:06 +0800 Subject: [PATCH 059/408] Update reference for kube components v1.31 --- .../kube-apiserver.md | 38 +++++++++++++------ .../kube-controller-manager.md | 18 ++++++++- .../kube-proxy.md | 12 +++--- .../kube-scheduler.md | 18 ++++++++- 4 files changed, 64 insertions(+), 22 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md b/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md index ef8bbd8119..a283e8c6a4 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md @@ -316,7 +316,7 @@ kube-apiserver [flags] --authentication-config string -

File with Authentication Configuration to configure the JWT Token authenticator. Note: This feature is in Alpha since v1.29.--feature-gate=StructuredAuthenticationConfiguration=true needs to be set for enabling this feature.This feature is mutually exclusive with the oidc-* flags.

+

File with Authentication Configuration to configure the JWT Token authenticator or the anonymous authenticator. Note: This feature is in Alpha since v1.29.--feature-gate=StructuredAuthenticationConfiguration=true needs to be set for enabling this feature.This feature is mutually exclusive with the oidc-* flags.To configure anonymous authenticator you need to enable --feature-gate=AnonymousAuthConfigurableEndpoints.When you configure anonymous authenticator in the authentication config you cannot use the --anonymous-auth flag.

@@ -410,13 +410,6 @@ kube-apiserver [flags]

If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.

- ---cloud-provider-gce-l7lb-src-cidrs cidrs     Default: 130.211.0.0/22,35.191.0.0/16 - - -

CIDRs opened in GCE firewall for L7 LB traffic proxy & health checks

- - --contention-profiling @@ -463,7 +456,14 @@ kube-apiserver [flags] --disable-admission-plugins strings -

admission plugins that should be disabled although they are in the default enabled plugins list (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, ClusterTrustBundleAttest, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

+

admission plugins that should be disabled although they are in the default enabled plugins list (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, ClusterTrustBundleAttest, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

+ + + +--disable-http2-serving + + +

If true, HTTP2 serving will be disabled [default=false]

@@ -480,11 +480,18 @@ kube-apiserver [flags]

File with apiserver egress selector configuration.

+ +--emulated-version strings + + +

The versions different components emulate their capabilities (APIs, features, ...) of.
If set, the component will emulate the behavior of this version instead of the underlying binary version.
Version format could only be major.minor, for example: '--emulated-version=wardle=1.2,kube=1.31'. Options are:
kube=1.31..1.31 (default=1.31)If the component is not specified, defaults to "kube"

+ + --enable-admission-plugins strings -

admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, ClusterTrustBundleAttest, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

+

admission plugins that should be enabled in addition to default enabled ones (NamespaceLifecycle, LimitRanger, ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, DefaultTolerationSeconds, DefaultStorageClass, StorageObjectInUseProtection, PersistentVolumeClaimResize, RuntimeClass, CertificateApproval, CertificateSigning, ClusterTrustBundleAttest, CertificateSubjectRestriction, DefaultIngressClass, MutatingAdmissionWebhook, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook, ResourceQuota). Comma-delimited list of admission plugins: AlwaysAdmit, AlwaysDeny, AlwaysPullImages, CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterTrustBundleAttest, DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter.

@@ -628,10 +635,10 @@ kube-apiserver [flags] ---feature-gates <comma-separated 'key=True|False' pairs> +--feature-gates colonSeparatedMultimapStringString -

A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (BETA - default=true)
APIServerTracing=true|false (BETA - default=true)
APIServingWithRoutine=true|false (BETA - default=true)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
AnyVolumeDataSource=true|false (BETA - default=true)
AppArmor=true|false (BETA - default=true)
AppArmorFields=true|false (BETA - default=true)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (BETA - default=true)
CRDValidationRatcheting=true|false (BETA - default=true)
CSIMigrationPortworx=true|false (BETA - default=false)
CSIVolumeHealth=true|false (ALPHA - default=false)
CloudControllerManagerWebhook=true|false (ALPHA - default=false)
ClusterTrustBundle=true|false (ALPHA - default=false)
ClusterTrustBundleProjection=true|false (ALPHA - default=false)
ComponentSLIs=true|false (BETA - default=true)
ConsistentListFromCache=true|false (ALPHA - default=false)
ContainerCheckpoint=true|false (BETA - default=true)
ContextualLogging=true|false (BETA - default=true)
CronJobsScheduledAnnotation=true|false (BETA - default=true)
CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
CustomResourceFieldSelectors=true|false (ALPHA - default=false)
DevicePluginCDIDevices=true|false (BETA - default=true)
DisableCloudProviders=true|false (BETA - default=true)
DisableKubeletCloudCredentialProviders=true|false (BETA - default=true)
DisableNodeKubeProxyVersion=true|false (ALPHA - default=false)
DynamicResourceAllocation=true|false (ALPHA - default=false)
ElasticIndexedJob=true|false (BETA - default=true)
EventedPLEG=true|false (ALPHA - default=false)
GracefulNodeShutdown=true|false (BETA - default=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
HPAScaleToZero=true|false (ALPHA - default=false)
HonorPVReclaimPolicy=true|false (ALPHA - default=false)
ImageMaximumGCAge=true|false (BETA - default=true)
InPlacePodVerticalScaling=true|false (ALPHA - default=false)
InTreePluginAWSUnregister=true|false (ALPHA - default=false)
InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
InTreePluginGCEUnregister=true|false (ALPHA - default=false)
InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
InformerResourceVersion=true|false (ALPHA - default=false)
JobBackoffLimitPerIndex=true|false (BETA - default=true)
JobManagedBy=true|false (ALPHA - default=false)
JobPodFailurePolicy=true|false (BETA - default=true)
JobPodReplacementPolicy=true|false (BETA - default=true)
JobSuccessPolicy=true|false (ALPHA - default=false)
KubeProxyDrainingTerminatingNodes=true|false (BETA - default=true)
KubeletCgroupDriverFromCRI=true|false (ALPHA - default=false)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
KubeletPodResourcesGet=true|false (ALPHA - default=false)
KubeletSeparateDiskGC=true|false (ALPHA - default=false)
KubeletTracing=true|false (BETA - default=true)
LoadBalancerIPMode=true|false (BETA - default=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
LogarithmicScaleDown=true|false (BETA - default=true)
LoggingAlphaOptions=true|false (ALPHA - default=false)
LoggingBetaOptions=true|false (BETA - default=true)
MatchLabelKeysInPodAffinity=true|false (ALPHA - default=false)
MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
MultiCIDRServiceAllocator=true|false (ALPHA - default=false)
MutatingAdmissionPolicy=true|false (ALPHA - default=false)
NFTablesProxyMode=true|false (ALPHA - default=false)
NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
NodeLogQuery=true|false (BETA - default=false)
NodeSwap=true|false (BETA - default=true)
OpenAPIEnums=true|false (BETA - default=true)
PDBUnhealthyPodEvictionPolicy=true|false (BETA - default=true)
PersistentVolumeLastPhaseTransitionTime=true|false (BETA - default=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
PodDeletionCost=true|false (BETA - default=true)
PodDisruptionConditions=true|false (BETA - default=true)
PodIndexLabel=true|false (BETA - default=true)
PodLifecycleSleepAction=true|false (BETA - default=true)
PodReadyToStartContainersCondition=true|false (BETA - default=true)
PortForwardWebsockets=true|false (ALPHA - default=false)
ProcMountType=true|false (ALPHA - default=false)
QOSReserved=true|false (ALPHA - default=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
RecursiveReadOnlyMounts=true|false (ALPHA - default=false)
RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
RetryGenerateName=true|false (ALPHA - default=false)
RotateKubeletServerCertificate=true|false (BETA - default=true)
RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
SELinuxMount=true|false (ALPHA - default=false)
SELinuxMountReadWriteOncePod=true|false (BETA - default=true)
SchedulerQueueingHints=true|false (BETA - default=false)
SeparateCacheWatchRPC=true|false (BETA - default=true)
SeparateTaintEvictionController=true|false (BETA - default=true)
ServiceAccountTokenJTI=true|false (BETA - default=true)
ServiceAccountTokenNodeBinding=true|false (ALPHA - default=false)
ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
ServiceTrafficDistribution=true|false (ALPHA - default=false)
SidecarContainers=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetAutoDeletePVC=true|false (BETA - default=true)
StatefulSetStartOrdinal=true|false (BETA - default=true)
StorageNamespaceIndex=true|false (BETA - default=true)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
StorageVersionMigrator=true|false (ALPHA - default=false)
StructuredAuthenticationConfiguration=true|false (BETA - default=true)
StructuredAuthorizationConfiguration=true|false (BETA - default=true)
TopologyAwareHints=true|false (BETA - default=true)
TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
TopologyManagerPolicyOptions=true|false (BETA - default=true)
TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true)
UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
UserNamespacesSupport=true|false (BETA - default=false)
VolumeAttributesClass=true|false (ALPHA - default=false)
VolumeCapacityPriority=true|false (ALPHA - default=false)
WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
WatchList=true|false (ALPHA - default=false)
WatchListClient=true|false (BETA - default=false)
WinDSR=true|false (ALPHA - default=false)
WinOverlay=true|false (BETA - default=true)
WindowsHostNetwork=true|false (ALPHA - default=true)

+

Comma-separated list of component:key=value pairs that describe feature gates for alpha/experimental features of different components.
If the component is not specified, defaults to "kube". This flag can be repeatedly invoked. For example: --feature-gates 'wardle:featureA=true,wardle:featureB=false' --feature-gates 'kube:featureC=true'Options are:
kube:APIResponseCompression=true|false (BETA - default=true)
kube:APIServerIdentity=true|false (BETA - default=true)
kube:APIServerTracing=true|false (BETA - default=true)
kube:APIServingWithRoutine=true|false (ALPHA - default=false)
kube:AllAlpha=true|false (ALPHA - default=false)
kube:AllBeta=true|false (BETA - default=false)
kube:AnonymousAuthConfigurableEndpoints=true|false (ALPHA - default=false)
kube:AnyVolumeDataSource=true|false (BETA - default=true)
kube:AuthorizeNodeWithSelectors=true|false (ALPHA - default=false)
kube:AuthorizeWithSelectors=true|false (ALPHA - default=false)
kube:CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
kube:CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
kube:CPUManagerPolicyOptions=true|false (BETA - default=true)
kube:CRDValidationRatcheting=true|false (BETA - default=true)
kube:CSIMigrationPortworx=true|false (BETA - default=true)
kube:CSIVolumeHealth=true|false (ALPHA - default=false)
kube:CloudControllerManagerWebhook=true|false (ALPHA - default=false)
kube:ClusterTrustBundle=true|false (ALPHA - default=false)
kube:ClusterTrustBundleProjection=true|false (ALPHA - default=false)
kube:ComponentSLIs=true|false (BETA - default=true)
kube:ConcurrentWatchObjectDecode=true|false (BETA - default=false)
kube:ConsistentListFromCache=true|false (BETA - default=true)
kube:ContainerCheckpoint=true|false (BETA - default=true)
kube:ContextualLogging=true|false (BETA - default=true)
kube:CoordinatedLeaderElection=true|false (ALPHA - default=false)
kube:CronJobsScheduledAnnotation=true|false (BETA - default=true)
kube:CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
kube:CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
kube:CustomResourceFieldSelectors=true|false (BETA - default=true)
kube:DRAControlPlaneController=true|false (ALPHA - default=false)
kube:DisableAllocatorDualWrite=true|false (ALPHA - default=false)
kube:DisableNodeKubeProxyVersion=true|false (BETA - default=true)
kube:DynamicResourceAllocation=true|false (ALPHA - default=false)
kube:EventedPLEG=true|false (ALPHA - default=false)
kube:GracefulNodeShutdown=true|false (BETA - default=true)
kube:GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
kube:HPAScaleToZero=true|false (ALPHA - default=false)
kube:HonorPVReclaimPolicy=true|false (BETA - default=true)
kube:ImageMaximumGCAge=true|false (BETA - default=true)
kube:ImageVolume=true|false (ALPHA - default=false)
kube:InPlacePodVerticalScaling=true|false (ALPHA - default=false)
kube:InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
kube:InformerResourceVersion=true|false (ALPHA - default=false)
kube:JobBackoffLimitPerIndex=true|false (BETA - default=true)
kube:JobManagedBy=true|false (ALPHA - default=false)
kube:JobPodReplacementPolicy=true|false (BETA - default=true)
kube:JobSuccessPolicy=true|false (BETA - default=true)
kube:KubeletCgroupDriverFromCRI=true|false (BETA - default=true)
kube:KubeletInUserNamespace=true|false (ALPHA - default=false)
kube:KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
kube:KubeletPodResourcesGet=true|false (ALPHA - default=false)
kube:KubeletSeparateDiskGC=true|false (BETA - default=true)
kube:KubeletTracing=true|false (BETA - default=true)
kube:LoadBalancerIPMode=true|false (BETA - default=true)
kube:LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - default=false)
kube:LoggingAlphaOptions=true|false (ALPHA - default=false)
kube:LoggingBetaOptions=true|false (BETA - default=true)
kube:MatchLabelKeysInPodAffinity=true|false (BETA - default=true)
kube:MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
kube:MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
kube:MemoryManager=true|false (BETA - default=true)
kube:MemoryQoS=true|false (ALPHA - default=false)
kube:MultiCIDRServiceAllocator=true|false (BETA - default=false)
kube:MutatingAdmissionPolicy=true|false (ALPHA - default=false)
kube:NFTablesProxyMode=true|false (BETA - default=true)
kube:NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
kube:NodeLogQuery=true|false (BETA - default=false)
kube:NodeSwap=true|false (BETA - default=true)
kube:OpenAPIEnums=true|false (BETA - default=true)
kube:PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
kube:PodDeletionCost=true|false (BETA - default=true)
kube:PodIndexLabel=true|false (BETA - default=true)
kube:PodLifecycleSleepAction=true|false (BETA - default=true)
kube:PodReadyToStartContainersCondition=true|false (BETA - default=true)
kube:PortForwardWebsockets=true|false (BETA - default=true)
kube:ProcMountType=true|false (BETA - default=false)
kube:QOSReserved=true|false (ALPHA - default=false)
kube:RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
kube:RecursiveReadOnlyMounts=true|false (BETA - default=true)
kube:RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
kube:ReloadKubeletServerCertificateFile=true|false (BETA - default=true)
kube:ResilientWatchCacheInitialization=true|false (BETA - default=true)
kube:ResourceHealthStatus=true|false (ALPHA - default=false)
kube:RetryGenerateName=true|false (BETA - default=true)
kube:RotateKubeletServerCertificate=true|false (BETA - default=true)
kube:RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
kube:SELinuxMount=true|false (ALPHA - default=false)
kube:SELinuxMountReadWriteOncePod=true|false (BETA - default=true)
kube:SchedulerQueueingHints=true|false (BETA - default=false)
kube:SeparateCacheWatchRPC=true|false (BETA - default=true)
kube:SeparateTaintEvictionController=true|false (BETA - default=true)
kube:ServiceAccountTokenJTI=true|false (BETA - default=true)
kube:ServiceAccountTokenNodeBinding=true|false (BETA - default=true)
kube:ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
kube:ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
kube:ServiceTrafficDistribution=true|false (BETA - default=true)
kube:SidecarContainers=true|false (BETA - default=true)
kube:SizeMemoryBackedVolumes=true|false (BETA - default=true)
kube:StatefulSetAutoDeletePVC=true|false (BETA - default=true)
kube:StorageNamespaceIndex=true|false (BETA - default=true)
kube:StorageVersionAPI=true|false (ALPHA - default=false)
kube:StorageVersionHash=true|false (BETA - default=true)
kube:StorageVersionMigrator=true|false (ALPHA - default=false)
kube:StrictCostEnforcementForVAP=true|false (BETA - default=false)
kube:StrictCostEnforcementForWebhooks=true|false (BETA - default=false)
kube:StructuredAuthenticationConfiguration=true|false (BETA - default=true)
kube:StructuredAuthorizationConfiguration=true|false (BETA - default=true)
kube:SupplementalGroupsPolicy=true|false (ALPHA - default=false)
kube:TopologyAwareHints=true|false (BETA - default=true)
kube:TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
kube:TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
kube:TopologyManagerPolicyOptions=true|false (BETA - default=true)
kube:TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true)
kube:UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
kube:UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
kube:UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
kube:UserNamespacesSupport=true|false (BETA - default=false)
kube:VolumeAttributesClass=true|false (BETA - default=false)
kube:VolumeCapacityPriority=true|false (ALPHA - default=false)
kube:WatchCacheInitializationPostStartHook=true|false (BETA - default=false)
kube:WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
kube:WatchList=true|false (ALPHA - default=false)
kube:WatchListClient=true|false (BETA - default=false)
kube:WinDSR=true|false (ALPHA - default=false)
kube:WinOverlay=true|false (BETA - default=true)
kube:WindowsHostNetwork=true|false (ALPHA - default=true)

@@ -1040,6 +1047,13 @@ kube-apiserver [flags]

The storage backend for persistence. Options: 'etcd3' (default).

+ +--storage-initialization-timeout duration     Default: 1m0s + + +

Maximum amount of time to wait for storage initialization before declaring apiserver ready. Defaults to 1m.

+ + --storage-media-type string     Default: "application/vnd.kubernetes.protobuf" diff --git a/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md b/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md index 53f190d6c0..5b915fdbd6 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md @@ -421,6 +421,13 @@ kube-controller-manager [flags]

Prevent force detaching volumes based on maximum unmount time and node status. If this flag is set to true, the non-graceful node shutdown feature must be used to recover from node failure. See https://k8s.io/docs/storage-disable-force-detach-on-timeout/.

+ +--disable-http2-serving + + +

If true, HTTP2 serving will be disabled [default=false]

+ + --disabled-metrics strings @@ -428,6 +435,13 @@ kube-controller-manager [flags]

This flag provides an escape hatch for misbehaving metrics. You must provide the fully qualified metric name in order to disable it. Disclaimer: disabling metrics is higher in precedence than showing hidden metrics.

+ +--emulated-version strings + + +

The versions different components emulate their capabilities (APIs, features, ...) of.
If set, the component will emulate the behavior of this version instead of the underlying binary version.
Version format could only be major.minor, for example: '--emulated-version=wardle=1.2,kube=1.31'. Options are:
kube=1.31..1.31 (default=1.31)If the component is not specified, defaults to "kube"

+ + --enable-dynamic-provisioning     Default: true @@ -478,10 +492,10 @@ kube-controller-manager [flags] ---feature-gates <comma-separated 'key=True|False' pairs> +--feature-gates colonSeparatedMultimapStringString -

A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (BETA - default=true)
APIServerTracing=true|false (BETA - default=true)
APIServingWithRoutine=true|false (BETA - default=true)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
AnyVolumeDataSource=true|false (BETA - default=true)
AppArmor=true|false (BETA - default=true)
AppArmorFields=true|false (BETA - default=true)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (BETA - default=true)
CRDValidationRatcheting=true|false (BETA - default=true)
CSIMigrationPortworx=true|false (BETA - default=false)
CSIVolumeHealth=true|false (ALPHA - default=false)
CloudControllerManagerWebhook=true|false (ALPHA - default=false)
ClusterTrustBundle=true|false (ALPHA - default=false)
ClusterTrustBundleProjection=true|false (ALPHA - default=false)
ComponentSLIs=true|false (BETA - default=true)
ConsistentListFromCache=true|false (ALPHA - default=false)
ContainerCheckpoint=true|false (BETA - default=true)
ContextualLogging=true|false (BETA - default=true)
CronJobsScheduledAnnotation=true|false (BETA - default=true)
CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
CustomResourceFieldSelectors=true|false (ALPHA - default=false)
DevicePluginCDIDevices=true|false (BETA - default=true)
DisableCloudProviders=true|false (BETA - default=true)
DisableKubeletCloudCredentialProviders=true|false (BETA - default=true)
DisableNodeKubeProxyVersion=true|false (ALPHA - default=false)
DynamicResourceAllocation=true|false (ALPHA - default=false)
ElasticIndexedJob=true|false (BETA - default=true)
EventedPLEG=true|false (ALPHA - default=false)
GracefulNodeShutdown=true|false (BETA - default=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
HPAScaleToZero=true|false (ALPHA - default=false)
HonorPVReclaimPolicy=true|false (ALPHA - default=false)
ImageMaximumGCAge=true|false (BETA - default=true)
InPlacePodVerticalScaling=true|false (ALPHA - default=false)
InTreePluginAWSUnregister=true|false (ALPHA - default=false)
InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
InTreePluginGCEUnregister=true|false (ALPHA - default=false)
InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
InformerResourceVersion=true|false (ALPHA - default=false)
JobBackoffLimitPerIndex=true|false (BETA - default=true)
JobManagedBy=true|false (ALPHA - default=false)
JobPodFailurePolicy=true|false (BETA - default=true)
JobPodReplacementPolicy=true|false (BETA - default=true)
JobSuccessPolicy=true|false (ALPHA - default=false)
KubeProxyDrainingTerminatingNodes=true|false (BETA - default=true)
KubeletCgroupDriverFromCRI=true|false (ALPHA - default=false)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
KubeletPodResourcesGet=true|false (ALPHA - default=false)
KubeletSeparateDiskGC=true|false (ALPHA - default=false)
KubeletTracing=true|false (BETA - default=true)
LoadBalancerIPMode=true|false (BETA - default=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
LogarithmicScaleDown=true|false (BETA - default=true)
LoggingAlphaOptions=true|false (ALPHA - default=false)
LoggingBetaOptions=true|false (BETA - default=true)
MatchLabelKeysInPodAffinity=true|false (ALPHA - default=false)
MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
MultiCIDRServiceAllocator=true|false (ALPHA - default=false)
MutatingAdmissionPolicy=true|false (ALPHA - default=false)
NFTablesProxyMode=true|false (ALPHA - default=false)
NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
NodeLogQuery=true|false (BETA - default=false)
NodeSwap=true|false (BETA - default=true)
OpenAPIEnums=true|false (BETA - default=true)
PDBUnhealthyPodEvictionPolicy=true|false (BETA - default=true)
PersistentVolumeLastPhaseTransitionTime=true|false (BETA - default=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
PodDeletionCost=true|false (BETA - default=true)
PodDisruptionConditions=true|false (BETA - default=true)
PodIndexLabel=true|false (BETA - default=true)
PodLifecycleSleepAction=true|false (BETA - default=true)
PodReadyToStartContainersCondition=true|false (BETA - default=true)
PortForwardWebsockets=true|false (ALPHA - default=false)
ProcMountType=true|false (ALPHA - default=false)
QOSReserved=true|false (ALPHA - default=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
RecursiveReadOnlyMounts=true|false (ALPHA - default=false)
RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
RetryGenerateName=true|false (ALPHA - default=false)
RotateKubeletServerCertificate=true|false (BETA - default=true)
RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
SELinuxMount=true|false (ALPHA - default=false)
SELinuxMountReadWriteOncePod=true|false (BETA - default=true)
SchedulerQueueingHints=true|false (BETA - default=false)
SeparateCacheWatchRPC=true|false (BETA - default=true)
SeparateTaintEvictionController=true|false (BETA - default=true)
ServiceAccountTokenJTI=true|false (BETA - default=true)
ServiceAccountTokenNodeBinding=true|false (ALPHA - default=false)
ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
ServiceTrafficDistribution=true|false (ALPHA - default=false)
SidecarContainers=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetAutoDeletePVC=true|false (BETA - default=true)
StatefulSetStartOrdinal=true|false (BETA - default=true)
StorageNamespaceIndex=true|false (BETA - default=true)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
StorageVersionMigrator=true|false (ALPHA - default=false)
StructuredAuthenticationConfiguration=true|false (BETA - default=true)
StructuredAuthorizationConfiguration=true|false (BETA - default=true)
TopologyAwareHints=true|false (BETA - default=true)
TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
TopologyManagerPolicyOptions=true|false (BETA - default=true)
TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true)
UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
UserNamespacesSupport=true|false (BETA - default=false)
VolumeAttributesClass=true|false (ALPHA - default=false)
VolumeCapacityPriority=true|false (ALPHA - default=false)
WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
WatchList=true|false (ALPHA - default=false)
WatchListClient=true|false (BETA - default=false)
WinDSR=true|false (ALPHA - default=false)
WinOverlay=true|false (BETA - default=true)
WindowsHostNetwork=true|false (ALPHA - default=true)

+

Comma-separated list of component:key=value pairs that describe feature gates for alpha/experimental features of different components.
If the component is not specified, defaults to "kube". This flag can be repeatedly invoked. For example: --feature-gates 'wardle:featureA=true,wardle:featureB=false' --feature-gates 'kube:featureC=true'Options are:
kube:APIResponseCompression=true|false (BETA - default=true)
kube:APIServerIdentity=true|false (BETA - default=true)
kube:APIServerTracing=true|false (BETA - default=true)
kube:APIServingWithRoutine=true|false (ALPHA - default=false)
kube:AllAlpha=true|false (ALPHA - default=false)
kube:AllBeta=true|false (BETA - default=false)
kube:AnonymousAuthConfigurableEndpoints=true|false (ALPHA - default=false)
kube:AnyVolumeDataSource=true|false (BETA - default=true)
kube:AuthorizeNodeWithSelectors=true|false (ALPHA - default=false)
kube:AuthorizeWithSelectors=true|false (ALPHA - default=false)
kube:CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
kube:CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
kube:CPUManagerPolicyOptions=true|false (BETA - default=true)
kube:CRDValidationRatcheting=true|false (BETA - default=true)
kube:CSIMigrationPortworx=true|false (BETA - default=true)
kube:CSIVolumeHealth=true|false (ALPHA - default=false)
kube:CloudControllerManagerWebhook=true|false (ALPHA - default=false)
kube:ClusterTrustBundle=true|false (ALPHA - default=false)
kube:ClusterTrustBundleProjection=true|false (ALPHA - default=false)
kube:ComponentSLIs=true|false (BETA - default=true)
kube:ConcurrentWatchObjectDecode=true|false (BETA - default=false)
kube:ConsistentListFromCache=true|false (BETA - default=true)
kube:ContainerCheckpoint=true|false (BETA - default=true)
kube:ContextualLogging=true|false (BETA - default=true)
kube:CoordinatedLeaderElection=true|false (ALPHA - default=false)
kube:CronJobsScheduledAnnotation=true|false (BETA - default=true)
kube:CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
kube:CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
kube:CustomResourceFieldSelectors=true|false (BETA - default=true)
kube:DRAControlPlaneController=true|false (ALPHA - default=false)
kube:DisableAllocatorDualWrite=true|false (ALPHA - default=false)
kube:DisableNodeKubeProxyVersion=true|false (BETA - default=true)
kube:DynamicResourceAllocation=true|false (ALPHA - default=false)
kube:EventedPLEG=true|false (ALPHA - default=false)
kube:GracefulNodeShutdown=true|false (BETA - default=true)
kube:GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
kube:HPAScaleToZero=true|false (ALPHA - default=false)
kube:HonorPVReclaimPolicy=true|false (BETA - default=true)
kube:ImageMaximumGCAge=true|false (BETA - default=true)
kube:ImageVolume=true|false (ALPHA - default=false)
kube:InPlacePodVerticalScaling=true|false (ALPHA - default=false)
kube:InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
kube:InformerResourceVersion=true|false (ALPHA - default=false)
kube:JobBackoffLimitPerIndex=true|false (BETA - default=true)
kube:JobManagedBy=true|false (ALPHA - default=false)
kube:JobPodReplacementPolicy=true|false (BETA - default=true)
kube:JobSuccessPolicy=true|false (BETA - default=true)
kube:KubeletCgroupDriverFromCRI=true|false (BETA - default=true)
kube:KubeletInUserNamespace=true|false (ALPHA - default=false)
kube:KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
kube:KubeletPodResourcesGet=true|false (ALPHA - default=false)
kube:KubeletSeparateDiskGC=true|false (BETA - default=true)
kube:KubeletTracing=true|false (BETA - default=true)
kube:LoadBalancerIPMode=true|false (BETA - default=true)
kube:LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - default=false)
kube:LoggingAlphaOptions=true|false (ALPHA - default=false)
kube:LoggingBetaOptions=true|false (BETA - default=true)
kube:MatchLabelKeysInPodAffinity=true|false (BETA - default=true)
kube:MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
kube:MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
kube:MemoryManager=true|false (BETA - default=true)
kube:MemoryQoS=true|false (ALPHA - default=false)
kube:MultiCIDRServiceAllocator=true|false (BETA - default=false)
kube:MutatingAdmissionPolicy=true|false (ALPHA - default=false)
kube:NFTablesProxyMode=true|false (BETA - default=true)
kube:NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
kube:NodeLogQuery=true|false (BETA - default=false)
kube:NodeSwap=true|false (BETA - default=true)
kube:OpenAPIEnums=true|false (BETA - default=true)
kube:PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
kube:PodDeletionCost=true|false (BETA - default=true)
kube:PodIndexLabel=true|false (BETA - default=true)
kube:PodLifecycleSleepAction=true|false (BETA - default=true)
kube:PodReadyToStartContainersCondition=true|false (BETA - default=true)
kube:PortForwardWebsockets=true|false (BETA - default=true)
kube:ProcMountType=true|false (BETA - default=false)
kube:QOSReserved=true|false (ALPHA - default=false)
kube:RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
kube:RecursiveReadOnlyMounts=true|false (BETA - default=true)
kube:RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
kube:ReloadKubeletServerCertificateFile=true|false (BETA - default=true)
kube:ResilientWatchCacheInitialization=true|false (BETA - default=true)
kube:ResourceHealthStatus=true|false (ALPHA - default=false)
kube:RetryGenerateName=true|false (BETA - default=true)
kube:RotateKubeletServerCertificate=true|false (BETA - default=true)
kube:RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
kube:SELinuxMount=true|false (ALPHA - default=false)
kube:SELinuxMountReadWriteOncePod=true|false (BETA - default=true)
kube:SchedulerQueueingHints=true|false (BETA - default=false)
kube:SeparateCacheWatchRPC=true|false (BETA - default=true)
kube:SeparateTaintEvictionController=true|false (BETA - default=true)
kube:ServiceAccountTokenJTI=true|false (BETA - default=true)
kube:ServiceAccountTokenNodeBinding=true|false (BETA - default=true)
kube:ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
kube:ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
kube:ServiceTrafficDistribution=true|false (BETA - default=true)
kube:SidecarContainers=true|false (BETA - default=true)
kube:SizeMemoryBackedVolumes=true|false (BETA - default=true)
kube:StatefulSetAutoDeletePVC=true|false (BETA - default=true)
kube:StorageNamespaceIndex=true|false (BETA - default=true)
kube:StorageVersionAPI=true|false (ALPHA - default=false)
kube:StorageVersionHash=true|false (BETA - default=true)
kube:StorageVersionMigrator=true|false (ALPHA - default=false)
kube:StrictCostEnforcementForVAP=true|false (BETA - default=false)
kube:StrictCostEnforcementForWebhooks=true|false (BETA - default=false)
kube:StructuredAuthenticationConfiguration=true|false (BETA - default=true)
kube:StructuredAuthorizationConfiguration=true|false (BETA - default=true)
kube:SupplementalGroupsPolicy=true|false (ALPHA - default=false)
kube:TopologyAwareHints=true|false (BETA - default=true)
kube:TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
kube:TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
kube:TopologyManagerPolicyOptions=true|false (BETA - default=true)
kube:TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true)
kube:UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
kube:UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
kube:UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
kube:UserNamespacesSupport=true|false (BETA - default=false)
kube:VolumeAttributesClass=true|false (BETA - default=false)
kube:VolumeCapacityPriority=true|false (ALPHA - default=false)
kube:WatchCacheInitializationPostStartHook=true|false (BETA - default=false)
kube:WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
kube:WatchList=true|false (ALPHA - default=false)
kube:WatchListClient=true|false (BETA - default=false)
kube:WinDSR=true|false (ALPHA - default=false)
kube:WinOverlay=true|false (BETA - default=true)
kube:WindowsHostNetwork=true|false (ALPHA - default=true)

diff --git a/content/en/docs/reference/command-line-tools-reference/kube-proxy.md b/content/en/docs/reference/command-line-tools-reference/kube-proxy.md index bf8811fe32..92dd1488ba 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-proxy.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-proxy.md @@ -158,14 +158,14 @@ kube-proxy [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (BETA - default=true)
APIServerTracing=true|false (BETA - default=true)
APIServingWithRoutine=true|false (BETA - default=true)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
AnyVolumeDataSource=true|false (BETA - default=true)
AppArmor=true|false (BETA - default=true)
AppArmorFields=true|false (BETA - default=true)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (BETA - default=true)
CRDValidationRatcheting=true|false (BETA - default=true)
CSIMigrationPortworx=true|false (BETA - default=false)
CSIVolumeHealth=true|false (ALPHA - default=false)
CloudControllerManagerWebhook=true|false (ALPHA - default=false)
ClusterTrustBundle=true|false (ALPHA - default=false)
ClusterTrustBundleProjection=true|false (ALPHA - default=false)
ComponentSLIs=true|false (BETA - default=true)
ConsistentListFromCache=true|false (ALPHA - default=false)
ContainerCheckpoint=true|false (BETA - default=true)
ContextualLogging=true|false (BETA - default=true)
CronJobsScheduledAnnotation=true|false (BETA - default=true)
CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
CustomResourceFieldSelectors=true|false (ALPHA - default=false)
DevicePluginCDIDevices=true|false (BETA - default=true)
DisableCloudProviders=true|false (BETA - default=true)
DisableKubeletCloudCredentialProviders=true|false (BETA - default=true)
DisableNodeKubeProxyVersion=true|false (ALPHA - default=false)
DynamicResourceAllocation=true|false (ALPHA - default=false)
ElasticIndexedJob=true|false (BETA - default=true)
EventedPLEG=true|false (ALPHA - default=false)
GracefulNodeShutdown=true|false (BETA - default=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
HPAScaleToZero=true|false (ALPHA - default=false)
HonorPVReclaimPolicy=true|false (ALPHA - default=false)
ImageMaximumGCAge=true|false (BETA - default=true)
InPlacePodVerticalScaling=true|false (ALPHA - default=false)
InTreePluginAWSUnregister=true|false (ALPHA - default=false)
InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
InTreePluginGCEUnregister=true|false (ALPHA - default=false)
InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
InformerResourceVersion=true|false (ALPHA - default=false)
JobBackoffLimitPerIndex=true|false (BETA - default=true)
JobManagedBy=true|false (ALPHA - default=false)
JobPodFailurePolicy=true|false (BETA - default=true)
JobPodReplacementPolicy=true|false (BETA - default=true)
JobSuccessPolicy=true|false (ALPHA - default=false)
KubeProxyDrainingTerminatingNodes=true|false (BETA - default=true)
KubeletCgroupDriverFromCRI=true|false (ALPHA - default=false)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
KubeletPodResourcesGet=true|false (ALPHA - default=false)
KubeletSeparateDiskGC=true|false (ALPHA - default=false)
KubeletTracing=true|false (BETA - default=true)
LoadBalancerIPMode=true|false (BETA - default=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
LogarithmicScaleDown=true|false (BETA - default=true)
LoggingAlphaOptions=true|false (ALPHA - default=false)
LoggingBetaOptions=true|false (BETA - default=true)
MatchLabelKeysInPodAffinity=true|false (ALPHA - default=false)
MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
MultiCIDRServiceAllocator=true|false (ALPHA - default=false)
MutatingAdmissionPolicy=true|false (ALPHA - default=false)
NFTablesProxyMode=true|false (ALPHA - default=false)
NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
NodeLogQuery=true|false (BETA - default=false)
NodeSwap=true|false (BETA - default=true)
OpenAPIEnums=true|false (BETA - default=true)
PDBUnhealthyPodEvictionPolicy=true|false (BETA - default=true)
PersistentVolumeLastPhaseTransitionTime=true|false (BETA - default=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
PodDeletionCost=true|false (BETA - default=true)
PodDisruptionConditions=true|false (BETA - default=true)
PodIndexLabel=true|false (BETA - default=true)
PodLifecycleSleepAction=true|false (BETA - default=true)
PodReadyToStartContainersCondition=true|false (BETA - default=true)
PortForwardWebsockets=true|false (ALPHA - default=false)
ProcMountType=true|false (ALPHA - default=false)
QOSReserved=true|false (ALPHA - default=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
RecursiveReadOnlyMounts=true|false (ALPHA - default=false)
RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
RetryGenerateName=true|false (ALPHA - default=false)
RotateKubeletServerCertificate=true|false (BETA - default=true)
RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
SELinuxMount=true|false (ALPHA - default=false)
SELinuxMountReadWriteOncePod=true|false (BETA - default=true)
SchedulerQueueingHints=true|false (BETA - default=false)
SeparateCacheWatchRPC=true|false (BETA - default=true)
SeparateTaintEvictionController=true|false (BETA - default=true)
ServiceAccountTokenJTI=true|false (BETA - default=true)
ServiceAccountTokenNodeBinding=true|false (ALPHA - default=false)
ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
ServiceTrafficDistribution=true|false (ALPHA - default=false)
SidecarContainers=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetAutoDeletePVC=true|false (BETA - default=true)
StatefulSetStartOrdinal=true|false (BETA - default=true)
StorageNamespaceIndex=true|false (BETA - default=true)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
StorageVersionMigrator=true|false (ALPHA - default=false)
StructuredAuthenticationConfiguration=true|false (BETA - default=true)
StructuredAuthorizationConfiguration=true|false (BETA - default=true)
TopologyAwareHints=true|false (BETA - default=true)
TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
TopologyManagerPolicyOptions=true|false (BETA - default=true)
TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true)
UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
UserNamespacesSupport=true|false (BETA - default=false)
VolumeAttributesClass=true|false (ALPHA - default=false)
VolumeCapacityPriority=true|false (ALPHA - default=false)
WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
WatchList=true|false (ALPHA - default=false)
WatchListClient=true|false (BETA - default=false)
WinDSR=true|false (ALPHA - default=false)
WinOverlay=true|false (BETA - default=true)
WindowsHostNetwork=true|false (ALPHA - default=true)
This parameter is ignored if a config file is specified by --config.

+

A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (BETA - default=true)
APIServerTracing=true|false (BETA - default=true)
APIServingWithRoutine=true|false (ALPHA - default=false)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
AnonymousAuthConfigurableEndpoints=true|false (ALPHA - default=false)
AnyVolumeDataSource=true|false (BETA - default=true)
AuthorizeNodeWithSelectors=true|false (ALPHA - default=false)
AuthorizeWithSelectors=true|false (ALPHA - default=false)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (BETA - default=true)
CRDValidationRatcheting=true|false (BETA - default=true)
CSIMigrationPortworx=true|false (BETA - default=true)
CSIVolumeHealth=true|false (ALPHA - default=false)
CloudControllerManagerWebhook=true|false (ALPHA - default=false)
ClusterTrustBundle=true|false (ALPHA - default=false)
ClusterTrustBundleProjection=true|false (ALPHA - default=false)
ComponentSLIs=true|false (BETA - default=true)
ConcurrentWatchObjectDecode=true|false (BETA - default=false)
ConsistentListFromCache=true|false (BETA - default=true)
ContainerCheckpoint=true|false (BETA - default=true)
ContextualLogging=true|false (BETA - default=true)
CoordinatedLeaderElection=true|false (ALPHA - default=false)
CronJobsScheduledAnnotation=true|false (BETA - default=true)
CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
CustomResourceFieldSelectors=true|false (BETA - default=true)
DRAControlPlaneController=true|false (ALPHA - default=false)
DisableAllocatorDualWrite=true|false (ALPHA - default=false)
DisableNodeKubeProxyVersion=true|false (BETA - default=true)
DynamicResourceAllocation=true|false (ALPHA - default=false)
EventedPLEG=true|false (ALPHA - default=false)
GracefulNodeShutdown=true|false (BETA - default=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
HPAScaleToZero=true|false (ALPHA - default=false)
HonorPVReclaimPolicy=true|false (BETA - default=true)
ImageMaximumGCAge=true|false (BETA - default=true)
ImageVolume=true|false (ALPHA - default=false)
InPlacePodVerticalScaling=true|false (ALPHA - default=false)
InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
InformerResourceVersion=true|false (ALPHA - default=false)
JobBackoffLimitPerIndex=true|false (BETA - default=true)
JobManagedBy=true|false (ALPHA - default=false)
JobPodReplacementPolicy=true|false (BETA - default=true)
JobSuccessPolicy=true|false (BETA - default=true)
KubeletCgroupDriverFromCRI=true|false (BETA - default=true)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
KubeletPodResourcesGet=true|false (ALPHA - default=false)
KubeletSeparateDiskGC=true|false (BETA - default=true)
KubeletTracing=true|false (BETA - default=true)
LoadBalancerIPMode=true|false (BETA - default=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - default=false)
LoggingAlphaOptions=true|false (ALPHA - default=false)
LoggingBetaOptions=true|false (BETA - default=true)
MatchLabelKeysInPodAffinity=true|false (BETA - default=true)
MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
MultiCIDRServiceAllocator=true|false (BETA - default=false)
MutatingAdmissionPolicy=true|false (ALPHA - default=false)
NFTablesProxyMode=true|false (BETA - default=true)
NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
NodeLogQuery=true|false (BETA - default=false)
NodeSwap=true|false (BETA - default=true)
OpenAPIEnums=true|false (BETA - default=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
PodDeletionCost=true|false (BETA - default=true)
PodIndexLabel=true|false (BETA - default=true)
PodLifecycleSleepAction=true|false (BETA - default=true)
PodReadyToStartContainersCondition=true|false (BETA - default=true)
PortForwardWebsockets=true|false (BETA - default=true)
ProcMountType=true|false (BETA - default=false)
QOSReserved=true|false (ALPHA - default=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
RecursiveReadOnlyMounts=true|false (BETA - default=true)
RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
ReloadKubeletServerCertificateFile=true|false (BETA - default=true)
ResilientWatchCacheInitialization=true|false (BETA - default=true)
ResourceHealthStatus=true|false (ALPHA - default=false)
RetryGenerateName=true|false (BETA - default=true)
RotateKubeletServerCertificate=true|false (BETA - default=true)
RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
SELinuxMount=true|false (ALPHA - default=false)
SELinuxMountReadWriteOncePod=true|false (BETA - default=true)
SchedulerQueueingHints=true|false (BETA - default=false)
SeparateCacheWatchRPC=true|false (BETA - default=true)
SeparateTaintEvictionController=true|false (BETA - default=true)
ServiceAccountTokenJTI=true|false (BETA - default=true)
ServiceAccountTokenNodeBinding=true|false (BETA - default=true)
ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
ServiceTrafficDistribution=true|false (BETA - default=true)
SidecarContainers=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetAutoDeletePVC=true|false (BETA - default=true)
StorageNamespaceIndex=true|false (BETA - default=true)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
StorageVersionMigrator=true|false (ALPHA - default=false)
StrictCostEnforcementForVAP=true|false (BETA - default=false)
StrictCostEnforcementForWebhooks=true|false (BETA - default=false)
StructuredAuthenticationConfiguration=true|false (BETA - default=true)
StructuredAuthorizationConfiguration=true|false (BETA - default=true)
SupplementalGroupsPolicy=true|false (ALPHA - default=false)
TopologyAwareHints=true|false (BETA - default=true)
TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
TopologyManagerPolicyOptions=true|false (BETA - default=true)
TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true)
UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
UserNamespacesSupport=true|false (BETA - default=false)
VolumeAttributesClass=true|false (BETA - default=false)
VolumeCapacityPriority=true|false (ALPHA - default=false)
WatchCacheInitializationPostStartHook=true|false (BETA - default=false)
WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
WatchList=true|false (ALPHA - default=false)
WatchListClient=true|false (BETA - default=false)
WinDSR=true|false (ALPHA - default=false)
WinOverlay=true|false (BETA - default=true)
WindowsHostNetwork=true|false (ALPHA - default=true)
This parameter is ignored if a config file is specified by --config.

--healthz-bind-address ipport     Default: 0.0.0.0:10256 -

The IP address and port for the health check server to serve on, defaulting to "0.0.0.0:10256" (if --bind-address is unset or IPv4), or "[::]:10256" (if --bind-address is IPv6). Set empty to disable. This parameter is ignored if a config file is specified by --config.

+

The IP address and port for the health check server to serve on, defaulting to "0.0.0.0:10256". This parameter is ignored if a config file is specified by --config.

@@ -225,7 +225,7 @@ kube-proxy [flags] ---ipvs-min-sync-period duration +--ipvs-min-sync-period duration     Default: 1s

The minimum period between IPVS rule resyncs (e.g. '5s', '1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will result in an immediate IPVS resync.

@@ -368,7 +368,7 @@ kube-proxy [flags] --masquerade-all -

If using the iptables or ipvs proxy mode, SNAT all traffic sent via Service cluster IPs. This may be required with some CNI plugins.

+

SNAT all traffic sent via Service cluster IPs. This may be required with some CNI plugins. Only supported on Linux.

@@ -382,14 +382,14 @@ kube-proxy [flags] --metrics-bind-address ipport     Default: 127.0.0.1:10249 -

The IP address and port for the metrics server to serve on, defaulting to "127.0.0.1:10249" (if --bind-address is unset or IPv4), or "[::1]:10249" (if --bind-address is IPv6). (Set to "0.0.0.0:10249" / "[::]:10249" to bind on all interfaces.) Set empty to disable. This parameter is ignored if a config file is specified by --config.

+

The IP address and port for the metrics server to serve on, defaulting to "127.0.0.1:10249". (Set to "0.0.0.0:10249" / "[::]:10249" to bind on all interfaces.) Set empty to disable. This parameter is ignored if a config file is specified by --config.

--nodeport-addresses strings -

A list of CIDR ranges that contain valid node IPs. If set, connections to NodePort services will only be accepted on node IPs in one of the indicated ranges. If unset, NodePort connections will be accepted on all local IPs. This parameter is ignored if a config file is specified by --config.

+

A list of CIDR ranges that contain valid node IPs, or alternatively, the single string 'primary'. If set to a list of CIDRs, connections to NodePort services will only be accepted on node IPs in one of the indicated ranges. If set to 'primary', NodePort services will only be accepted on the node's primary IP(s) according to the Node object. If unset, NodePort connections will be accepted on all local IPs. This parameter is ignored if a config file is specified by --config.

diff --git a/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md b/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md index 93de348748..ab374b1242 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md @@ -148,6 +148,13 @@ kube-scheduler [flags]

DEPRECATED: enable block profiling, if profiling is enabled. This parameter is ignored if a config file is specified in --config.

+ +--disable-http2-serving + + +

If true, HTTP2 serving will be disabled [default=false]

+ + --disabled-metrics strings @@ -156,10 +163,17 @@ kube-scheduler [flags] ---feature-gates <comma-separated 'key=True|False' pairs> +--emulated-version strings -

A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (BETA - default=true)
APIServerTracing=true|false (BETA - default=true)
APIServingWithRoutine=true|false (BETA - default=true)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
AnyVolumeDataSource=true|false (BETA - default=true)
AppArmor=true|false (BETA - default=true)
AppArmorFields=true|false (BETA - default=true)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (BETA - default=true)
CRDValidationRatcheting=true|false (BETA - default=true)
CSIMigrationPortworx=true|false (BETA - default=false)
CSIVolumeHealth=true|false (ALPHA - default=false)
CloudControllerManagerWebhook=true|false (ALPHA - default=false)
ClusterTrustBundle=true|false (ALPHA - default=false)
ClusterTrustBundleProjection=true|false (ALPHA - default=false)
ComponentSLIs=true|false (BETA - default=true)
ConsistentListFromCache=true|false (ALPHA - default=false)
ContainerCheckpoint=true|false (BETA - default=true)
ContextualLogging=true|false (BETA - default=true)
CronJobsScheduledAnnotation=true|false (BETA - default=true)
CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
CustomResourceFieldSelectors=true|false (ALPHA - default=false)
DevicePluginCDIDevices=true|false (BETA - default=true)
DisableCloudProviders=true|false (BETA - default=true)
DisableKubeletCloudCredentialProviders=true|false (BETA - default=true)
DisableNodeKubeProxyVersion=true|false (ALPHA - default=false)
DynamicResourceAllocation=true|false (ALPHA - default=false)
ElasticIndexedJob=true|false (BETA - default=true)
EventedPLEG=true|false (ALPHA - default=false)
GracefulNodeShutdown=true|false (BETA - default=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
HPAScaleToZero=true|false (ALPHA - default=false)
HonorPVReclaimPolicy=true|false (ALPHA - default=false)
ImageMaximumGCAge=true|false (BETA - default=true)
InPlacePodVerticalScaling=true|false (ALPHA - default=false)
InTreePluginAWSUnregister=true|false (ALPHA - default=false)
InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
InTreePluginGCEUnregister=true|false (ALPHA - default=false)
InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
InformerResourceVersion=true|false (ALPHA - default=false)
JobBackoffLimitPerIndex=true|false (BETA - default=true)
JobManagedBy=true|false (ALPHA - default=false)
JobPodFailurePolicy=true|false (BETA - default=true)
JobPodReplacementPolicy=true|false (BETA - default=true)
JobSuccessPolicy=true|false (ALPHA - default=false)
KubeProxyDrainingTerminatingNodes=true|false (BETA - default=true)
KubeletCgroupDriverFromCRI=true|false (ALPHA - default=false)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
KubeletPodResourcesGet=true|false (ALPHA - default=false)
KubeletSeparateDiskGC=true|false (ALPHA - default=false)
KubeletTracing=true|false (BETA - default=true)
LoadBalancerIPMode=true|false (BETA - default=true)
LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
LogarithmicScaleDown=true|false (BETA - default=true)
LoggingAlphaOptions=true|false (ALPHA - default=false)
LoggingBetaOptions=true|false (BETA - default=true)
MatchLabelKeysInPodAffinity=true|false (ALPHA - default=false)
MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
MultiCIDRServiceAllocator=true|false (ALPHA - default=false)
MutatingAdmissionPolicy=true|false (ALPHA - default=false)
NFTablesProxyMode=true|false (ALPHA - default=false)
NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
NodeLogQuery=true|false (BETA - default=false)
NodeSwap=true|false (BETA - default=true)
OpenAPIEnums=true|false (BETA - default=true)
PDBUnhealthyPodEvictionPolicy=true|false (BETA - default=true)
PersistentVolumeLastPhaseTransitionTime=true|false (BETA - default=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
PodDeletionCost=true|false (BETA - default=true)
PodDisruptionConditions=true|false (BETA - default=true)
PodIndexLabel=true|false (BETA - default=true)
PodLifecycleSleepAction=true|false (BETA - default=true)
PodReadyToStartContainersCondition=true|false (BETA - default=true)
PortForwardWebsockets=true|false (ALPHA - default=false)
ProcMountType=true|false (ALPHA - default=false)
QOSReserved=true|false (ALPHA - default=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
RecursiveReadOnlyMounts=true|false (ALPHA - default=false)
RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
RetryGenerateName=true|false (ALPHA - default=false)
RotateKubeletServerCertificate=true|false (BETA - default=true)
RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
SELinuxMount=true|false (ALPHA - default=false)
SELinuxMountReadWriteOncePod=true|false (BETA - default=true)
SchedulerQueueingHints=true|false (BETA - default=false)
SeparateCacheWatchRPC=true|false (BETA - default=true)
SeparateTaintEvictionController=true|false (BETA - default=true)
ServiceAccountTokenJTI=true|false (BETA - default=true)
ServiceAccountTokenNodeBinding=true|false (ALPHA - default=false)
ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
ServiceTrafficDistribution=true|false (ALPHA - default=false)
SidecarContainers=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetAutoDeletePVC=true|false (BETA - default=true)
StatefulSetStartOrdinal=true|false (BETA - default=true)
StorageNamespaceIndex=true|false (BETA - default=true)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
StorageVersionMigrator=true|false (ALPHA - default=false)
StructuredAuthenticationConfiguration=true|false (BETA - default=true)
StructuredAuthorizationConfiguration=true|false (BETA - default=true)
TopologyAwareHints=true|false (BETA - default=true)
TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
TopologyManagerPolicyOptions=true|false (BETA - default=true)
TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true)
UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
UserNamespacesSupport=true|false (BETA - default=false)
VolumeAttributesClass=true|false (ALPHA - default=false)
VolumeCapacityPriority=true|false (ALPHA - default=false)
WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
WatchList=true|false (ALPHA - default=false)
WatchListClient=true|false (BETA - default=false)
WinDSR=true|false (ALPHA - default=false)
WinOverlay=true|false (BETA - default=true)
WindowsHostNetwork=true|false (ALPHA - default=true)

+

The versions different components emulate their capabilities (APIs, features, ...) of.
If set, the component will emulate the behavior of this version instead of the underlying binary version.
Version format could only be major.minor, for example: '--emulated-version=wardle=1.2,kube=1.31'. Options are:
kube=1.31..1.31 (default=1.31)If the component is not specified, defaults to "kube"

+ + + +--feature-gates colonSeparatedMultimapStringString + + +

Comma-separated list of component:key=value pairs that describe feature gates for alpha/experimental features of different components.
If the component is not specified, defaults to "kube". This flag can be repeatedly invoked. For example: --feature-gates 'wardle:featureA=true,wardle:featureB=false' --feature-gates 'kube:featureC=true'Options are:
kube:APIResponseCompression=true|false (BETA - default=true)
kube:APIServerIdentity=true|false (BETA - default=true)
kube:APIServerTracing=true|false (BETA - default=true)
kube:APIServingWithRoutine=true|false (ALPHA - default=false)
kube:AllAlpha=true|false (ALPHA - default=false)
kube:AllBeta=true|false (BETA - default=false)
kube:AnonymousAuthConfigurableEndpoints=true|false (ALPHA - default=false)
kube:AnyVolumeDataSource=true|false (BETA - default=true)
kube:AuthorizeNodeWithSelectors=true|false (ALPHA - default=false)
kube:AuthorizeWithSelectors=true|false (ALPHA - default=false)
kube:CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
kube:CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
kube:CPUManagerPolicyOptions=true|false (BETA - default=true)
kube:CRDValidationRatcheting=true|false (BETA - default=true)
kube:CSIMigrationPortworx=true|false (BETA - default=true)
kube:CSIVolumeHealth=true|false (ALPHA - default=false)
kube:CloudControllerManagerWebhook=true|false (ALPHA - default=false)
kube:ClusterTrustBundle=true|false (ALPHA - default=false)
kube:ClusterTrustBundleProjection=true|false (ALPHA - default=false)
kube:ComponentSLIs=true|false (BETA - default=true)
kube:ConcurrentWatchObjectDecode=true|false (BETA - default=false)
kube:ConsistentListFromCache=true|false (BETA - default=true)
kube:ContainerCheckpoint=true|false (BETA - default=true)
kube:ContextualLogging=true|false (BETA - default=true)
kube:CoordinatedLeaderElection=true|false (ALPHA - default=false)
kube:CronJobsScheduledAnnotation=true|false (BETA - default=true)
kube:CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
kube:CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
kube:CustomResourceFieldSelectors=true|false (BETA - default=true)
kube:DRAControlPlaneController=true|false (ALPHA - default=false)
kube:DisableAllocatorDualWrite=true|false (ALPHA - default=false)
kube:DisableNodeKubeProxyVersion=true|false (BETA - default=true)
kube:DynamicResourceAllocation=true|false (ALPHA - default=false)
kube:EventedPLEG=true|false (ALPHA - default=false)
kube:GracefulNodeShutdown=true|false (BETA - default=true)
kube:GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
kube:HPAScaleToZero=true|false (ALPHA - default=false)
kube:HonorPVReclaimPolicy=true|false (BETA - default=true)
kube:ImageMaximumGCAge=true|false (BETA - default=true)
kube:ImageVolume=true|false (ALPHA - default=false)
kube:InPlacePodVerticalScaling=true|false (ALPHA - default=false)
kube:InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
kube:InformerResourceVersion=true|false (ALPHA - default=false)
kube:JobBackoffLimitPerIndex=true|false (BETA - default=true)
kube:JobManagedBy=true|false (ALPHA - default=false)
kube:JobPodReplacementPolicy=true|false (BETA - default=true)
kube:JobSuccessPolicy=true|false (BETA - default=true)
kube:KubeletCgroupDriverFromCRI=true|false (BETA - default=true)
kube:KubeletInUserNamespace=true|false (ALPHA - default=false)
kube:KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
kube:KubeletPodResourcesGet=true|false (ALPHA - default=false)
kube:KubeletSeparateDiskGC=true|false (BETA - default=true)
kube:KubeletTracing=true|false (BETA - default=true)
kube:LoadBalancerIPMode=true|false (BETA - default=true)
kube:LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - default=false)
kube:LoggingAlphaOptions=true|false (ALPHA - default=false)
kube:LoggingBetaOptions=true|false (BETA - default=true)
kube:MatchLabelKeysInPodAffinity=true|false (BETA - default=true)
kube:MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
kube:MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
kube:MemoryManager=true|false (BETA - default=true)
kube:MemoryQoS=true|false (ALPHA - default=false)
kube:MultiCIDRServiceAllocator=true|false (BETA - default=false)
kube:MutatingAdmissionPolicy=true|false (ALPHA - default=false)
kube:NFTablesProxyMode=true|false (BETA - default=true)
kube:NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
kube:NodeLogQuery=true|false (BETA - default=false)
kube:NodeSwap=true|false (BETA - default=true)
kube:OpenAPIEnums=true|false (BETA - default=true)
kube:PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
kube:PodDeletionCost=true|false (BETA - default=true)
kube:PodIndexLabel=true|false (BETA - default=true)
kube:PodLifecycleSleepAction=true|false (BETA - default=true)
kube:PodReadyToStartContainersCondition=true|false (BETA - default=true)
kube:PortForwardWebsockets=true|false (BETA - default=true)
kube:ProcMountType=true|false (BETA - default=false)
kube:QOSReserved=true|false (ALPHA - default=false)
kube:RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
kube:RecursiveReadOnlyMounts=true|false (BETA - default=true)
kube:RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
kube:ReloadKubeletServerCertificateFile=true|false (BETA - default=true)
kube:ResilientWatchCacheInitialization=true|false (BETA - default=true)
kube:ResourceHealthStatus=true|false (ALPHA - default=false)
kube:RetryGenerateName=true|false (BETA - default=true)
kube:RotateKubeletServerCertificate=true|false (BETA - default=true)
kube:RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
kube:SELinuxMount=true|false (ALPHA - default=false)
kube:SELinuxMountReadWriteOncePod=true|false (BETA - default=true)
kube:SchedulerQueueingHints=true|false (BETA - default=false)
kube:SeparateCacheWatchRPC=true|false (BETA - default=true)
kube:SeparateTaintEvictionController=true|false (BETA - default=true)
kube:ServiceAccountTokenJTI=true|false (BETA - default=true)
kube:ServiceAccountTokenNodeBinding=true|false (BETA - default=true)
kube:ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
kube:ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
kube:ServiceTrafficDistribution=true|false (BETA - default=true)
kube:SidecarContainers=true|false (BETA - default=true)
kube:SizeMemoryBackedVolumes=true|false (BETA - default=true)
kube:StatefulSetAutoDeletePVC=true|false (BETA - default=true)
kube:StorageNamespaceIndex=true|false (BETA - default=true)
kube:StorageVersionAPI=true|false (ALPHA - default=false)
kube:StorageVersionHash=true|false (BETA - default=true)
kube:StorageVersionMigrator=true|false (ALPHA - default=false)
kube:StrictCostEnforcementForVAP=true|false (BETA - default=false)
kube:StrictCostEnforcementForWebhooks=true|false (BETA - default=false)
kube:StructuredAuthenticationConfiguration=true|false (BETA - default=true)
kube:StructuredAuthorizationConfiguration=true|false (BETA - default=true)
kube:SupplementalGroupsPolicy=true|false (ALPHA - default=false)
kube:TopologyAwareHints=true|false (BETA - default=true)
kube:TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
kube:TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
kube:TopologyManagerPolicyOptions=true|false (BETA - default=true)
kube:TranslateStreamCloseWebsocketRequests=true|false (BETA - default=true)
kube:UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
kube:UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
kube:UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
kube:UserNamespacesSupport=true|false (BETA - default=false)
kube:VolumeAttributesClass=true|false (BETA - default=false)
kube:VolumeCapacityPriority=true|false (ALPHA - default=false)
kube:WatchCacheInitializationPostStartHook=true|false (BETA - default=false)
kube:WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
kube:WatchList=true|false (ALPHA - default=false)
kube:WatchListClient=true|false (BETA - default=false)
kube:WinDSR=true|false (ALPHA - default=false)
kube:WinOverlay=true|false (BETA - default=true)
kube:WindowsHostNetwork=true|false (ALPHA - default=true)

From 88f00805046ab43b3b95bacc0fa728e130743522 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sat, 17 Aug 2024 15:44:18 +0800 Subject: [PATCH 060/408] update kubeadm reference for v1.31 --- .../setup-tools/kubeadm/generated/kubeadm.md | 2 +- .../_index.md} | 2 +- .../kubeadm_certs_certificate-key.md | 2 +- .../kubeadm_certs_check-expiration.md | 16 ++-- .../kubeadm_certs_generate-csr.md | 2 +- .../kubeadm_certs_renew.md | 2 +- .../kubeadm_certs_renew_admin.conf.md | 2 +- .../kubeadm_certs_renew_all.md | 2 +- ...beadm_certs_renew_apiserver-etcd-client.md | 2 +- ...dm_certs_renew_apiserver-kubelet-client.md | 2 +- .../kubeadm_certs_renew_apiserver.md | 2 +- ...adm_certs_renew_controller-manager.conf.md | 2 +- ...adm_certs_renew_etcd-healthcheck-client.md | 2 +- .../kubeadm_certs_renew_etcd-peer.md | 2 +- .../kubeadm_certs_renew_etcd-server.md | 2 +- .../kubeadm_certs_renew_front-proxy-client.md | 2 +- .../kubeadm_certs_renew_scheduler.conf.md | 2 +- .../kubeadm_certs_renew_super-admin.conf.md | 2 +- .../_index.md} | 2 +- .../_index.md} | 6 +- .../kubeadm_config_images.md | 2 +- .../kubeadm_config_images_list.md | 18 ++-- .../kubeadm_config_images_pull.md | 4 +- .../kubeadm_config_migrate.md | 6 +- .../kubeadm_config_print.md | 2 +- .../kubeadm_config_print_init-defaults.md | 2 +- .../kubeadm_config_print_join-defaults.md | 2 +- .../kubeadm_config_print_reset-defaults.md | 2 +- .../kubeadm_config_print_upgrade-defaults.md | 77 +++++++++++++++++ .../kubeadm_config_validate.md | 4 +- .../_index.md} | 83 ++++++++++--------- .../{ => kubeadm_init}/kubeadm_init_phase.md | 2 +- .../kubeadm_init_phase_addon.md | 2 +- .../kubeadm_init_phase_addon_all.md | 4 +- .../kubeadm_init_phase_addon_coredns.md | 4 +- .../kubeadm_init_phase_addon_kube-proxy.md | 2 +- .../kubeadm_init_phase_bootstrap-token.md | 2 +- .../kubeadm_init_phase_certs.md | 2 +- .../kubeadm_init_phase_certs_all.md | 2 +- ..._init_phase_certs_apiserver-etcd-client.md | 2 +- ...it_phase_certs_apiserver-kubelet-client.md | 2 +- .../kubeadm_init_phase_certs_apiserver.md | 2 +- .../kubeadm_init_phase_certs_ca.md | 2 +- .../kubeadm_init_phase_certs_etcd-ca.md | 2 +- ...nit_phase_certs_etcd-healthcheck-client.md | 2 +- .../kubeadm_init_phase_certs_etcd-peer.md | 2 +- .../kubeadm_init_phase_certs_etcd-server.md | 2 +- ...kubeadm_init_phase_certs_front-proxy-ca.md | 2 +- ...adm_init_phase_certs_front-proxy-client.md | 2 +- .../kubeadm_init_phase_certs_sa.md | 23 ++++- .../kubeadm_init_phase_control-plane.md | 2 +- .../kubeadm_init_phase_control-plane_all.md | 27 +----- ...eadm_init_phase_control-plane_apiserver.md | 13 +-- ..._phase_control-plane_controller-manager.md | 11 +-- ...eadm_init_phase_control-plane_scheduler.md | 11 +-- .../kubeadm_init_phase_etcd.md | 2 +- .../kubeadm_init_phase_etcd_local.md | 4 +- .../kubeadm_init_phase_kubeconfig.md | 2 +- .../kubeadm_init_phase_kubeconfig_admin.md | 2 +- .../kubeadm_init_phase_kubeconfig_all.md | 2 +- ...nit_phase_kubeconfig_controller-manager.md | 2 +- .../kubeadm_init_phase_kubeconfig_kubelet.md | 2 +- ...kubeadm_init_phase_kubeconfig_scheduler.md | 2 +- ...beadm_init_phase_kubeconfig_super-admin.md | 2 +- .../kubeadm_init_phase_kubelet-finalize.md | 2 +- ...kubeadm_init_phase_kubelet-finalize_all.md | 2 +- ...t-finalize_enable-client-cert-rotation.md} | 25 ++---- ...let-finalize_experimental-cert-rotation.md | 6 +- .../kubeadm_init_phase_kubelet-start.md | 4 +- .../kubeadm_init_phase_mark-control-plane.md | 2 +- .../kubeadm_init_phase_preflight.md | 2 +- .../kubeadm_init_phase_show-join-command.md | 2 +- .../kubeadm_init_phase_upload-certs.md | 2 +- .../kubeadm_init_phase_upload-config.md | 2 +- .../kubeadm_init_phase_upload-config_all.md | 2 +- ...ubeadm_init_phase_upload-config_kubeadm.md | 2 +- ...ubeadm_init_phase_upload-config_kubelet.md | 2 +- .../_index.md} | 7 +- .../{ => kubeadm_join}/kubeadm_join_phase.md | 2 +- .../kubeadm_join_phase_control-plane-join.md | 2 +- ...beadm_join_phase_control-plane-join_all.md | 4 +- ...eadm_join_phase_control-plane-join_etcd.md | 4 +- ...e_control-plane-join_mark-control-plane.md | 2 +- ...ubeadm_join_phase_control-plane-prepare.md | 2 +- ...dm_join_phase_control-plane-prepare_all.md | 4 +- ..._join_phase_control-plane-prepare_certs.md | 2 +- ...ase_control-plane-prepare_control-plane.md | 4 +- ...se_control-plane-prepare_download-certs.md | 6 +- ..._phase_control-plane-prepare_kubeconfig.md | 2 +- .../kubeadm_join_phase_kubelet-start.md | 4 +- .../kubeadm_join_phase_preflight.md | 2 +- .../kubeadm_join_phase_wait-control-plane.md | 2 +- .../_index.md} | 2 +- .../kubeadm_kubeconfig_user.md | 2 +- .../_index.md} | 2 +- .../kubeadm_reset_phase.md | 2 +- .../kubeadm_reset_phase_cleanup-node.md | 2 +- .../kubeadm_reset_phase_preflight.md | 2 +- .../kubeadm_reset_phase_remove-etcd-member.md | 2 +- .../_index.md} | 2 +- .../kubeadm_token_create.md | 2 +- .../kubeadm_token_delete.md | 2 +- .../kubeadm_token_generate.md | 2 +- .../{ => kubeadm_token}/kubeadm_token_list.md | 16 ++-- .../_index.md} | 2 +- .../kubeadm_upgrade_apply.md | 11 +-- .../kubeadm_upgrade_diff.md | 23 +---- .../kubeadm_upgrade_node.md | 4 +- .../kubeadm_upgrade_node_phase.md | 2 +- ...ubeadm_upgrade_node_phase_control-plane.md | 4 +- ...beadm_upgrade_node_phase_kubelet-config.md | 4 +- .../kubeadm_upgrade_node_phase_preflight.md | 2 +- .../kubeadm_upgrade_plan.md | 23 ++--- .../_index.md} | 2 +- 114 files changed, 320 insertions(+), 306 deletions(-) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_certs.md => kubeadm_certs/_index.md} (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_certificate-key.md (93%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_check-expiration.md (93%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_generate-csr.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_admin.conf.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_all.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_apiserver-etcd-client.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_apiserver-kubelet-client.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_apiserver.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_controller-manager.conf.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_etcd-healthcheck-client.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_etcd-peer.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_etcd-server.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_front-proxy-client.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_scheduler.conf.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_super-admin.conf.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_completion.md => kubeadm_completion/_index.md} (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_config.md => kubeadm_config/_index.md} (87%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_images.md (93%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_images_list.md (86%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_images_pull.md (86%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_migrate.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_print.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_print_init-defaults.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_print_join-defaults.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_print_reset-defaults.md (94%) create mode 100644 content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_upgrade-defaults.md rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_config}/kubeadm_config_validate.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_init.md => kubeadm_init/_index.md} (62%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_addon.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_addon_all.md (90%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_addon_coredns.md (88%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_addon_kube-proxy.md (97%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_bootstrap-token.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_all.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_apiserver-etcd-client.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_apiserver-kubelet-client.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_apiserver.md (97%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_ca.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_etcd-ca.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_etcd-healthcheck-client.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_etcd-peer.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_etcd-server.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_front-proxy-ca.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_front-proxy-client.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_certs_sa.md (71%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_control-plane.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_control-plane_all.md (72%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_control-plane_apiserver.md (77%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_control-plane_controller-manager.md (79%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_control-plane_scheduler.md (78%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_etcd.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_etcd_local.md (83%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubeconfig.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubeconfig_admin.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubeconfig_all.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubeconfig_controller-manager.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubeconfig_kubelet.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubeconfig_scheduler.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubeconfig_super-admin.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubelet-finalize.md (93%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubelet-finalize_all.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_join_phase_control-plane-join_update-status.md => kubeadm_init/kubeadm_init_phase_kubelet-finalize_enable-client-cert-rotation.md} (63%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md (86%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_kubelet-start.md (84%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_mark-control-plane.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_preflight.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_show-join-command.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_upload-certs.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_upload-config.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_upload-config_all.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_upload-config_kubeadm.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_init}/kubeadm_init_phase_upload-config_kubelet.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_join.md => kubeadm_join/_index.md} (91%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-join.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-join_all.md (82%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-join_etcd.md (82%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-join_mark-control-plane.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare.md (93%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_all.md (89%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_certs.md (97%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_control-plane.md (83%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_download-certs.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_kubeconfig.md (97%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_kubelet-start.md (87%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_preflight.md (97%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_wait-control-plane.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_kubeconfig.md => kubeadm_kubeconfig/_index.md} (91%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_kubeconfig}/kubeadm_kubeconfig_user.md (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_reset.md => kubeadm_reset/_index.md} (97%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_reset}/kubeadm_reset_phase.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_reset}/kubeadm_reset_phase_cleanup-node.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_reset}/kubeadm_reset_phase_preflight.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_reset}/kubeadm_reset_phase_remove-etcd-member.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_token.md => kubeadm_token/_index.md} (96%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_token}/kubeadm_token_create.md (97%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_token}/kubeadm_token_delete.md (94%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_token}/kubeadm_token_generate.md (95%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_token}/kubeadm_token_list.md (93%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_upgrade.md => kubeadm_upgrade/_index.md} (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_upgrade}/kubeadm_upgrade_apply.md (80%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_upgrade}/kubeadm_upgrade_diff.md (72%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_upgrade}/kubeadm_upgrade_node.md (86%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_upgrade}/kubeadm_upgrade_node_phase.md (92%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_upgrade}/kubeadm_upgrade_node_phase_control-plane.md (82%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_upgrade}/kubeadm_upgrade_node_phase_kubelet-config.md (80%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_upgrade}/kubeadm_upgrade_node_phase_preflight.md (93%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_upgrade}/kubeadm_upgrade_plan.md (85%) rename content/en/docs/reference/setup-tools/kubeadm/generated/{kubeadm_version.md => kubeadm_version/_index.md} (93%) diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm.md index 7d9370d8c0..b99a4a0610 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm.md @@ -67,7 +67,7 @@ Example usage: --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/_index.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/_index.md index 5ceca77416..d73a49816c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/_index.md @@ -55,7 +55,7 @@ kubeadm certs [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_certificate-key.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_certificate-key.md similarity index 93% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_certificate-key.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_certificate-key.md index 9590089860..f2e7fc3c77 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_certificate-key.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_certificate-key.md @@ -61,7 +61,7 @@ kubeadm certs certificate-key [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_check-expiration.md similarity index 93% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_check-expiration.md index 1a1803ca41..41602b1f95 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_check-expiration.md @@ -51,13 +51,6 @@ kubeadm certs check-expiration [flags]

Path to a kubeadm configuration file.

- --o, --experimental-output string     Default: "text" - - -

Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

- - -h, --help @@ -72,6 +65,13 @@ kubeadm certs check-expiration [flags]

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

+ +-o, --output string     Default: "text" + + +

Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

+ + --show-managed-fields @@ -97,7 +97,7 @@ kubeadm certs check-expiration [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_generate-csr.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_generate-csr.md index ff8f1f621c..585ef05615 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_generate-csr.md @@ -87,7 +87,7 @@ kubeadm certs generate-csr [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew.md index 7630fa9cdd..7b4a30d807 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew.md @@ -55,7 +55,7 @@ kubeadm certs renew [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_admin.conf.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_admin.conf.md index 81a937a47a..3775b9ba1f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_admin.conf.md @@ -82,7 +82,7 @@ kubeadm certs renew admin.conf [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_all.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_all.md index 219cdbd238..4b5f1f1b6f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_all.md @@ -76,7 +76,7 @@ kubeadm certs renew all [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-etcd-client.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-etcd-client.md index 14d6ed17d7..40cb2e58a2 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-etcd-client.md @@ -82,7 +82,7 @@ kubeadm certs renew apiserver-etcd-client [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-kubelet-client.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-kubelet-client.md index 858b5d1845..64a4c1aca8 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-kubelet-client.md @@ -82,7 +82,7 @@ kubeadm certs renew apiserver-kubelet-client [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver.md index ae846f8d23..9fc3d48752 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver.md @@ -82,7 +82,7 @@ kubeadm certs renew apiserver [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_controller-manager.conf.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_controller-manager.conf.md index 19d7816e31..170781df3f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_controller-manager.conf.md @@ -82,7 +82,7 @@ kubeadm certs renew controller-manager.conf [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-healthcheck-client.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-healthcheck-client.md index 5dd94c77e8..0a764a332a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-healthcheck-client.md @@ -82,7 +82,7 @@ kubeadm certs renew etcd-healthcheck-client [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-peer.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-peer.md index 7ad9ed5f68..11d458c130 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-peer.md @@ -82,7 +82,7 @@ kubeadm certs renew etcd-peer [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-server.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-server.md index 05dcdd7920..ffd12da4ad 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-server.md @@ -82,7 +82,7 @@ kubeadm certs renew etcd-server [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_front-proxy-client.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_front-proxy-client.md index 4cd61043f7..083fd2cba2 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_front-proxy-client.md @@ -82,7 +82,7 @@ kubeadm certs renew front-proxy-client [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_scheduler.conf.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_scheduler.conf.md index ce81cbd8c0..741e67c268 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_scheduler.conf.md @@ -82,7 +82,7 @@ kubeadm certs renew scheduler.conf [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_super-admin.conf.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_super-admin.conf.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_super-admin.conf.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_super-admin.conf.md index df7fedd75b..671fe9221a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_super-admin.conf.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_super-admin.conf.md @@ -82,7 +82,7 @@ kubeadm certs renew super-admin.conf [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_completion.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_completion/_index.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_completion.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_completion/_index.md index e64b7375e2..3cc0307b0e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_completion.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_completion/_index.md @@ -93,7 +93,7 @@ source <(kubeadm completion zsh) --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/_index.md similarity index 87% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/_index.md index df55d3bfe6..c2006abb08 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/_index.md @@ -18,8 +18,8 @@ Manage configuration for a kubeadm cluster persisted in a ConfigMap in the clust There is a ConfigMap in the kube-system namespace called "kubeadm-config" that kubeadm uses to store internal configuration about the cluster. kubeadm CLI v1.8.0+ automatically creates this ConfigMap with the config used with 'kubeadm init', but if you -initialized your cluster using kubeadm v1.7.x or lower, you must use the 'config upload' command to create this -ConfigMap. This is required so that 'kubeadm upgrade' can configure your upgraded cluster correctly. +initialized your cluster using kubeadm v1.7.x or lower, you must use the 'kubeadm init phase upload-config' command to +create this ConfigMap. This is required so that 'kubeadm upgrade' can configure your upgraded cluster correctly. ``` @@ -67,7 +67,7 @@ kubeadm config [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images.md similarity index 93% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images.md index dcd2ebf339..1a8c2a6b4d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images.md @@ -62,7 +62,7 @@ kubeadm config images [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images_list.md similarity index 86% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images_list.md index def9c409b1..8b8cb3abfb 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_list.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images_list.md @@ -44,18 +44,11 @@ kubeadm config images list [flags]

Path to a kubeadm configuration file.

- --o, --experimental-output string     Default: "text" - - -

Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

- - --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

@@ -79,6 +72,13 @@ kubeadm config images list [flags]

Choose a specific Kubernetes version for the control plane.

+ +-o, --output string     Default: "text" + + +

Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

+ + --show-managed-fields @@ -111,7 +111,7 @@ kubeadm config images list [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images_pull.md similarity index 86% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images_pull.md index 3534a45564..fec80d3e65 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_images_pull.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_images_pull.md @@ -48,7 +48,7 @@ kubeadm config images pull [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

@@ -97,7 +97,7 @@ kubeadm config images pull [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_migrate.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_migrate.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_migrate.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_migrate.md index b428c383c2..0bcd5ddae7 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_migrate.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_migrate.md @@ -19,9 +19,9 @@ Read an older version of the kubeadm configuration API types from a file, and ou This command lets you convert configuration objects of older versions to the latest supported version, locally in the CLI tool without ever touching anything in the cluster. In this version of kubeadm, the following API versions are supported: -- kubeadm.k8s.io/v1beta3 +- kubeadm.k8s.io/v1beta4 -Further, kubeadm can only write out config of version "kubeadm.k8s.io/v1beta3", but read both types. +Further, kubeadm can only write out config of version "kubeadm.k8s.io/v1beta4", but read both types. So regardless of what version you pass to the --old-config parameter here, the API object will be read, deserialized, defaulted, converted, validated, and re-serialized when written to stdout or --new-config if specified. @@ -96,7 +96,7 @@ kubeadm config migrate [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print.md index c8d1df3656..19cfe2c81c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print.md @@ -64,7 +64,7 @@ kubeadm config print [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_init-defaults.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_init-defaults.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_init-defaults.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_init-defaults.md index ef5dd5c8b1..abe5fc6260 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_init-defaults.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_init-defaults.md @@ -74,7 +74,7 @@ kubeadm config print init-defaults [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_join-defaults.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_join-defaults.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_join-defaults.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_join-defaults.md index c48848a119..56dd782385 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_join-defaults.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_join-defaults.md @@ -67,7 +67,7 @@ kubeadm config print join-defaults [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_reset-defaults.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_reset-defaults.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_reset-defaults.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_reset-defaults.md index 46f3c948c4..7114d310d6 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_print_reset-defaults.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_reset-defaults.md @@ -67,7 +67,7 @@ kubeadm config print reset-defaults [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_upgrade-defaults.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_upgrade-defaults.md new file mode 100644 index 0000000000..727ef95bf3 --- /dev/null +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_print_upgrade-defaults.md @@ -0,0 +1,77 @@ + + + +Print default upgrade configuration, that can be used for 'kubeadm upgrade' + +### Synopsis + + + +This command prints objects such as the default upgrade configuration that is used for 'kubeadm upgrade'. + +Note that sensitive values like the Bootstrap Token fields are replaced with placeholder values like "abcdef.0123456789abcdef" in order to pass validation but +not perform the real computation for creating a token. + + +``` +kubeadm config print upgrade-defaults [flags] +``` + +### Options + + ++++ + + + + + + + + + + +
-h, --help

help for upgrade-defaults

+ + + +### Options inherited from parent commands + + ++++ + + + + + + + + + + + + + + + + + +
--kubeconfig string     Default: "/etc/kubernetes/admin.conf"

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

--rootfs string

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

+ + + diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_validate.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_validate.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_validate.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_validate.md index 9a65b7e693..7b770dd587 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config_validate.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_config/kubeadm_config_validate.md @@ -23,7 +23,7 @@ fields with invalid values will also trigger errors. Any other errors or warning depending on contents of the input file. In this version of kubeadm, the following API versions are supported: -- kubeadm.k8s.io/v1beta3 +- kubeadm.k8s.io/v1beta4 ``` @@ -85,7 +85,7 @@ kubeadm config validate [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/_index.md similarity index 62% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/_index.md index 538f802c7f..aa6dee8fd2 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/_index.md @@ -19,44 +19,45 @@ Run this command in order to set up the Kubernetes control plane The "init" command executes the following phases: ``` -preflight Run pre-flight checks -certs Certificate generation - /ca Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components - /apiserver Generate the certificate for serving the Kubernetes API - /apiserver-kubelet-client Generate the certificate for the API server to connect to kubelet - /front-proxy-ca Generate the self-signed CA to provision identities for front proxy - /front-proxy-client Generate the certificate for the front proxy client - /etcd-ca Generate the self-signed CA to provision identities for etcd - /etcd-server Generate the certificate for serving etcd - /etcd-peer Generate the certificate for etcd nodes to communicate with each other - /etcd-healthcheck-client Generate the certificate for liveness probes to healthcheck etcd - /apiserver-etcd-client Generate the certificate the apiserver uses to access etcd - /sa Generate a private key for signing service account tokens along with its public key -kubeconfig Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file - /admin Generate a kubeconfig file for the admin to use and for kubeadm itself - /super-admin Generate a kubeconfig file for the super-admin - /kubelet Generate a kubeconfig file for the kubelet to use *only* for cluster bootstrapping purposes - /controller-manager Generate a kubeconfig file for the controller manager to use - /scheduler Generate a kubeconfig file for the scheduler to use -etcd Generate static Pod manifest file for local etcd - /local Generate the static Pod manifest file for a local, single-node local etcd instance -control-plane Generate all static Pod manifest files necessary to establish the control plane - /apiserver Generates the kube-apiserver static Pod manifest - /controller-manager Generates the kube-controller-manager static Pod manifest - /scheduler Generates the kube-scheduler static Pod manifest -kubelet-start Write kubelet settings and (re)start the kubelet -upload-config Upload the kubeadm and kubelet configuration to a ConfigMap - /kubeadm Upload the kubeadm ClusterConfiguration to a ConfigMap - /kubelet Upload the kubelet component config to a ConfigMap -upload-certs Upload certificates to kubeadm-certs -mark-control-plane Mark a node as a control-plane -bootstrap-token Generates bootstrap tokens used to join a node to a cluster -kubelet-finalize Updates settings relevant to the kubelet after TLS bootstrap - /experimental-cert-rotation Enable kubelet client certificate rotation -addon Install required addons for passing conformance tests - /coredns Install the CoreDNS addon to a Kubernetes cluster - /kube-proxy Install the kube-proxy addon to a Kubernetes cluster -show-join-command Show the join command for control-plane and worker node +preflight Run pre-flight checks +certs Certificate generation + /ca Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components + /apiserver Generate the certificate for serving the Kubernetes API + /apiserver-kubelet-client Generate the certificate for the API server to connect to kubelet + /front-proxy-ca Generate the self-signed CA to provision identities for front proxy + /front-proxy-client Generate the certificate for the front proxy client + /etcd-ca Generate the self-signed CA to provision identities for etcd + /etcd-server Generate the certificate for serving etcd + /etcd-peer Generate the certificate for etcd nodes to communicate with each other + /etcd-healthcheck-client Generate the certificate for liveness probes to healthcheck etcd + /apiserver-etcd-client Generate the certificate the apiserver uses to access etcd + /sa Generate a private key for signing service account tokens along with its public key +kubeconfig Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file + /admin Generate a kubeconfig file for the admin to use and for kubeadm itself + /super-admin Generate a kubeconfig file for the super-admin + /kubelet Generate a kubeconfig file for the kubelet to use *only* for cluster bootstrapping purposes + /controller-manager Generate a kubeconfig file for the controller manager to use + /scheduler Generate a kubeconfig file for the scheduler to use +etcd Generate static Pod manifest file for local etcd + /local Generate the static Pod manifest file for a local, single-node local etcd instance +control-plane Generate all static Pod manifest files necessary to establish the control plane + /apiserver Generates the kube-apiserver static Pod manifest + /controller-manager Generates the kube-controller-manager static Pod manifest + /scheduler Generates the kube-scheduler static Pod manifest +kubelet-start Write kubelet settings and (re)start the kubelet +upload-config Upload the kubeadm and kubelet configuration to a ConfigMap + /kubeadm Upload the kubeadm ClusterConfiguration to a ConfigMap + /kubelet Upload the kubelet component config to a ConfigMap +upload-certs Upload certificates to kubeadm-certs +mark-control-plane Mark a node as a control-plane +bootstrap-token Generates bootstrap tokens used to join a node to a cluster +kubelet-finalize Updates settings relevant to the kubelet after TLS bootstrap + /enable-client-cert-rotation Enable kubelet client certificate rotation + /experimental-cert-rotation Enable kubelet client certificate rotation (DEPRECATED: use 'enable-client-cert-rotation' instead) +addon Install required addons for passing conformance tests + /coredns Install the CoreDNS addon to a Kubernetes cluster + /kube-proxy Install the kube-proxy addon to a Kubernetes cluster +show-join-command Show the join command for control-plane and worker node ``` @@ -140,7 +141,7 @@ kubeadm init [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

@@ -182,7 +183,7 @@ kubeadm init [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -266,7 +267,7 @@ kubeadm init [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase.md index 564ed50b18..e5c16f10ce 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase.md @@ -51,7 +51,7 @@ Use this command to invoke single phase of the init workflow --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon.md index a6082dddd2..e4af694fa5 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon.md @@ -55,7 +55,7 @@ kubeadm init phase addon [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_all.md similarity index 90% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_all.md index 4b08bcf5f8..1cba797ebd 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_all.md @@ -69,7 +69,7 @@ kubeadm init phase addon all [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

@@ -139,7 +139,7 @@ kubeadm init phase addon all [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_coredns.md similarity index 88% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_coredns.md index b3811cf5c6..ae940f5fa5 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_coredns.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_coredns.md @@ -48,7 +48,7 @@ kubeadm init phase addon coredns [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

@@ -118,7 +118,7 @@ kubeadm init phase addon coredns [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_kube-proxy.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_kube-proxy.md similarity index 97% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_kube-proxy.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_kube-proxy.md index 4f61b572d2..16e7881780 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_addon_kube-proxy.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_addon_kube-proxy.md @@ -125,7 +125,7 @@ kubeadm init phase addon kube-proxy [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_bootstrap-token.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_bootstrap-token.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_bootstrap-token.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_bootstrap-token.md index 145c1c246a..8e5dac26ce 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_bootstrap-token.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_bootstrap-token.md @@ -93,7 +93,7 @@ kubeadm init phase bootstrap-token [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs.md index a263260100..0841881fe6 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs.md @@ -55,7 +55,7 @@ kubeadm init phase certs [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_all.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_all.md index 0336919ea6..b922aa781b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_all.md @@ -118,7 +118,7 @@ kubeadm init phase certs all [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-etcd-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver-etcd-client.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-etcd-client.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver-etcd-client.md index bb5a59dca5..a0f3792879 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-etcd-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver-etcd-client.md @@ -85,7 +85,7 @@ kubeadm init phase certs apiserver-etcd-client [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-kubelet-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver-kubelet-client.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-kubelet-client.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver-kubelet-client.md index b1ee579e34..58d05d50c7 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver-kubelet-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver-kubelet-client.md @@ -85,7 +85,7 @@ kubeadm init phase certs apiserver-kubelet-client [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver.md similarity index 97% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver.md index 95dc5b9848..6dd40b7b1d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_apiserver.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_apiserver.md @@ -120,7 +120,7 @@ kubeadm init phase certs apiserver [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_ca.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_ca.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_ca.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_ca.md index e92f9c2e95..58067b75b1 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_ca.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_ca.md @@ -85,7 +85,7 @@ kubeadm init phase certs ca [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-ca.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-ca.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-ca.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-ca.md index 3f96728005..4576c2ab70 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-ca.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-ca.md @@ -85,7 +85,7 @@ kubeadm init phase certs etcd-ca [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-healthcheck-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-healthcheck-client.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-healthcheck-client.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-healthcheck-client.md index ff8db9ede5..e6cf49a2e1 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-healthcheck-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-healthcheck-client.md @@ -85,7 +85,7 @@ kubeadm init phase certs etcd-healthcheck-client [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-peer.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-peer.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-peer.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-peer.md index b08540b49e..03930e989a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-peer.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-peer.md @@ -87,7 +87,7 @@ kubeadm init phase certs etcd-peer [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-server.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-server.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-server.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-server.md index a00377dc9f..141f52f304 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_etcd-server.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_etcd-server.md @@ -87,7 +87,7 @@ kubeadm init phase certs etcd-server [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-ca.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_front-proxy-ca.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-ca.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_front-proxy-ca.md index 0f0dfb46e8..8cb8e3c231 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-ca.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_front-proxy-ca.md @@ -85,7 +85,7 @@ kubeadm init phase certs front-proxy-ca [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-client.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_front-proxy-client.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-client.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_front-proxy-client.md index 52b2e30f82..507ff90a0c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_front-proxy-client.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_front-proxy-client.md @@ -85,7 +85,7 @@ kubeadm init phase certs front-proxy-client [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_sa.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_sa.md similarity index 71% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_sa.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_sa.md index 28b5cd9309..9c02f1c37a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_certs_sa.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_certs_sa.md @@ -39,6 +39,20 @@ kubeadm init phase certs sa [flags]

The path where to save and store the certificates.

+ +--config string + + +

Path to a kubeadm configuration file.

+ + + +--dry-run + + +

Don't apply any changes; just output what would be done.

+ + -h, --help @@ -46,6 +60,13 @@ kubeadm init phase certs sa [flags]

help for sa

+ +--kubernetes-version string     Default: "stable-1" + + +

Choose a specific Kubernetes version for the control plane.

+ + @@ -64,7 +85,7 @@ kubeadm init phase certs sa [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane.md index cb73db5164..1682a87a16 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane.md @@ -55,7 +55,7 @@ kubeadm init phase control-plane [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_all.md similarity index 72% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_all.md index ff8784a15a..f2e74a805a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_all.md @@ -55,13 +55,6 @@ kubeadm init phase control-plane all [flags]

Port for the API Server to bind to.

- ---apiserver-extra-args <comma-separated 'key=value' pairs> - - -

A set of extra flags to pass to the API Server or override default ones in form of <flagname>=<value>

- - --cert-dir string     Default: "/etc/kubernetes/pki" @@ -83,13 +76,6 @@ kubeadm init phase control-plane all [flags]

Specify a stable IP address or DNS name for the control plane.

- ---controller-manager-extra-args <comma-separated 'key=value' pairs> - - -

A set of extra flags to pass to the Controller Manager or override default ones in form of <flagname>=<value>

- - --dry-run @@ -101,7 +87,7 @@ kubeadm init phase control-plane all [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

@@ -129,7 +115,7 @@ kubeadm init phase control-plane all [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -139,13 +125,6 @@ kubeadm init phase control-plane all [flags]

Specify range of IP addresses for the pod network. If set, the control plane will automatically allocate CIDRs for every node.

- ---scheduler-extra-args <comma-separated 'key=value' pairs> - - -

A set of extra flags to pass to the Scheduler or override default ones in form of <flagname>=<value>

- - --service-cidr string     Default: "10.96.0.0/12" @@ -171,7 +150,7 @@ kubeadm init phase control-plane all [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_apiserver.md similarity index 77% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_apiserver.md index 862608294c..cb73c5cd5e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_apiserver.md @@ -44,13 +44,6 @@ kubeadm init phase control-plane apiserver [flags]

Port for the API Server to bind to.

- ---apiserver-extra-args <comma-separated 'key=value' pairs> - - -

A set of extra flags to pass to the API Server or override default ones in form of <flagname>=<value>

- - --cert-dir string     Default: "/etc/kubernetes/pki" @@ -83,7 +76,7 @@ kubeadm init phase control-plane apiserver [flags] --feature-gates string -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

+

A set of key=value pairs that describe feature gates for various features. Options are:
ControlPlaneKubeletLocalMode=true|false (ALPHA - default=false)
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

@@ -111,7 +104,7 @@ kubeadm init phase control-plane apiserver [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -139,7 +132,7 @@ kubeadm init phase control-plane apiserver [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_controller-manager.md similarity index 79% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_controller-manager.md index f99791eaf7..c70245c9ea 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_controller-manager.md @@ -44,13 +44,6 @@ kubeadm init phase control-plane controller-manager [flags]

Path to a kubeadm configuration file.

- ---controller-manager-extra-args <comma-separated 'key=value' pairs> - - -

A set of extra flags to pass to the Controller Manager or override default ones in form of <flagname>=<value>

- - --dry-run @@ -83,7 +76,7 @@ kubeadm init phase control-plane controller-manager [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -111,7 +104,7 @@ kubeadm init phase control-plane controller-manager [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_scheduler.md similarity index 78% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_scheduler.md index 63cac55bd4..c10d04a83b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_control-plane_scheduler.md @@ -76,14 +76,7 @@ kubeadm init phase control-plane scheduler [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

- - - ---scheduler-extra-args <comma-separated 'key=value' pairs> - - -

A set of extra flags to pass to the Scheduler or override default ones in form of <flagname>=<value>

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -104,7 +97,7 @@ kubeadm init phase control-plane scheduler [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_etcd.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_etcd.md index 5e58ababb8..2947236f0c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_etcd.md @@ -55,7 +55,7 @@ kubeadm init phase etcd [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd_local.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_etcd_local.md similarity index 83% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd_local.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_etcd_local.md index bdb9b3c8c0..9f8fe5849f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_etcd_local.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_etcd_local.md @@ -81,7 +81,7 @@ kubeadm init phase etcd local [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -102,7 +102,7 @@ kubeadm init phase etcd local [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig.md index cc026ae4ad..4b0add3db8 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig.md @@ -55,7 +55,7 @@ kubeadm init phase kubeconfig [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_admin.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_admin.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_admin.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_admin.md index c19aaaa37d..11cc336f06 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_admin.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_admin.md @@ -111,7 +111,7 @@ kubeadm init phase kubeconfig admin [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_all.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_all.md index 0d2e1792a1..9c5e9fa159 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_all.md @@ -118,7 +118,7 @@ kubeadm init phase kubeconfig all [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_controller-manager.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_controller-manager.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_controller-manager.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_controller-manager.md index c2c9fe26e4..470ba0e862 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_controller-manager.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_controller-manager.md @@ -111,7 +111,7 @@ kubeadm init phase kubeconfig controller-manager [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_kubelet.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_kubelet.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_kubelet.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_kubelet.md index 196b5d78fb..8354a11001 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_kubelet.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_kubelet.md @@ -120,7 +120,7 @@ kubeadm init phase kubeconfig kubelet [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_scheduler.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_scheduler.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_scheduler.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_scheduler.md index cdd9337dea..a5772c5bcf 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_scheduler.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_scheduler.md @@ -111,7 +111,7 @@ kubeadm init phase kubeconfig scheduler [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_super-admin.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_super-admin.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_super-admin.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_super-admin.md index f266096148..32c4140201 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubeconfig_super-admin.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubeconfig_super-admin.md @@ -111,7 +111,7 @@ kubeadm init phase kubeconfig super-admin [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize.md similarity index 93% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize.md index dfa1b52522..b9fb3bf573 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize.md @@ -62,7 +62,7 @@ kubeadm init phase kubelet-finalize [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_all.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_all.md index 3e7f64cd63..18794740aa 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_all.md @@ -83,7 +83,7 @@ kubeadm init phase kubelet-finalize all [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_enable-client-cert-rotation.md similarity index 63% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_enable-client-cert-rotation.md index 9fb71b6c02..f226863db5 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_enable-client-cert-rotation.md @@ -10,15 +10,15 @@ guide. You can file document formatting bugs against the --> -Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap (DEPRECATED) +Enable kubelet client certificate rotation ### Synopsis -Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap (DEPRECATED) +Enable kubelet client certificate rotation ``` -kubeadm join phase control-plane-join update-status [flags] +kubeadm init phase kubelet-finalize enable-client-cert-rotation [flags] ``` ### Options @@ -31,10 +31,10 @@ kubeadm join phase control-plane-join update-status [flags] ---apiserver-advertise-address string +--cert-dir string     Default: "/etc/kubernetes/pki" -

If the node should host a new control plane instance, the IP address the API Server will advertise it's listening on. If not set the default network interface will be used.

+

The path where to save and store the certificates.

@@ -45,24 +45,17 @@ kubeadm join phase control-plane-join update-status [flags] ---control-plane +--dry-run -

Create a new control plane instance on this node

+

Don't apply any changes; just output what would be done.

-h, --help -

help for update-status

- - - ---node-name string - - -

Specify the node name.

+

help for enable-client-cert-rotation

@@ -83,7 +76,7 @@ kubeadm join phase control-plane-join update-status [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md similarity index 86% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md index 9decae2f14..959c1aaf84 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md @@ -10,12 +10,12 @@ guide. You can file document formatting bugs against the --> -Enable kubelet client certificate rotation +Enable kubelet client certificate rotation (DEPRECATED: use 'enable-client-cert-rotation' instead) ### Synopsis -Enable kubelet client certificate rotation +Enable kubelet client certificate rotation (DEPRECATED: use 'enable-client-cert-rotation' instead) ``` kubeadm init phase kubelet-finalize experimental-cert-rotation [flags] @@ -76,7 +76,7 @@ kubeadm init phase kubelet-finalize experimental-cert-rotation [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-start.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-start.md similarity index 84% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-start.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-start.md index 04f89bf380..cf9cae59b9 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_kubelet-start.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_kubelet-start.md @@ -83,7 +83,7 @@ kubeadm init phase kubelet-start [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -104,7 +104,7 @@ kubeadm init phase kubelet-start [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_mark-control-plane.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_mark-control-plane.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_mark-control-plane.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_mark-control-plane.md index 11c5f2b21e..1851c44267 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_mark-control-plane.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_mark-control-plane.md @@ -86,7 +86,7 @@ kubeadm init phase mark-control-plane [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_preflight.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_preflight.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_preflight.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_preflight.md index b7d43d9e1f..73a4d1530b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_preflight.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_preflight.md @@ -97,7 +97,7 @@ kubeadm init phase preflight [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_show-join-command.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_show-join-command.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_show-join-command.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_show-join-command.md index 355e432a90..5ac10927c7 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_show-join-command.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_show-join-command.md @@ -55,7 +55,7 @@ kubeadm init phase show-join-command [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-certs.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-certs.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-certs.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-certs.md index 9e596329d6..29ec08743b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-certs.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-certs.md @@ -97,7 +97,7 @@ kubeadm init phase upload-certs [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config.md index 594cfed952..3183ac3cd8 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config.md @@ -55,7 +55,7 @@ kubeadm init phase upload-config [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_all.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_all.md index 620b801069..52fe0c02c3 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_all.md @@ -83,7 +83,7 @@ kubeadm init phase upload-config all [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_kubeadm.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_kubeadm.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_kubeadm.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_kubeadm.md index 6dc7d87567..2d401db08c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_kubeadm.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_kubeadm.md @@ -92,7 +92,7 @@ kubeadm init phase upload-config kubeadm [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_kubelet.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_kubelet.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_kubelet.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_kubelet.md index 26eb4178aa..1b9d03072d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-config_kubelet.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/kubeadm_init_phase_upload-config_kubelet.md @@ -90,7 +90,7 @@ kubeadm init phase upload-config kubelet [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/_index.md similarity index 91% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/_index.md index 0f29c5473a..7d5baa367d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/_index.md @@ -64,14 +64,13 @@ The "join [api-server-endpoint]" command executes the following phases: ``` preflight Run join pre-flight checks control-plane-prepare Prepare the machine for serving a control plane - /download-certs [EXPERIMENTAL] Download certificates shared among control-plane nodes from the kubeadm-certs Secret + /download-certs Download certificates shared among control-plane nodes from the kubeadm-certs Secret /certs Generate the certificates for the new control plane components /kubeconfig Generate the kubeconfig for the new control plane components /control-plane Generate the manifests for the new control plane components kubelet-start Write kubelet settings, certificates and (re)start the kubelet control-plane-join Join a machine as a control plane instance /etcd Add a new local etcd member - /update-status Register the new control-plane node into the ClusterStatus maintained in the kubeadm-config ConfigMap (DEPRECATED) /mark-control-plane Mark a node as a control-plane wait-control-plane EXPERIMENTAL: Wait for the control plane to start ``` @@ -192,7 +191,7 @@ kubeadm join [api-server-endpoint] [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -234,7 +233,7 @@ kubeadm join [api-server-endpoint] [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase.md index de074378f6..328e8e7cd4 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase.md @@ -51,7 +51,7 @@ Use this command to invoke single phase of the join workflow --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join.md index 47bb65a233..cdc362e64a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join.md @@ -62,7 +62,7 @@ kubeadm join phase control-plane-join [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_all.md similarity index 82% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_all.md index d9ec5fe25f..aeb641be12 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_all.md @@ -76,7 +76,7 @@ kubeadm join phase control-plane-join all [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -97,7 +97,7 @@ kubeadm join phase control-plane-join all [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_etcd.md similarity index 82% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_etcd.md index d97d7a540d..ce48339e8f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_etcd.md @@ -76,7 +76,7 @@ kubeadm join phase control-plane-join etcd [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -97,7 +97,7 @@ kubeadm join phase control-plane-join etcd [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_mark-control-plane.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_mark-control-plane.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_mark-control-plane.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_mark-control-plane.md index 3e55ebbe80..a207a3f45c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_mark-control-plane.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_mark-control-plane.md @@ -83,7 +83,7 @@ kubeadm join phase control-plane-join mark-control-plane [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare.md similarity index 93% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare.md index 395357a202..46a1989f2a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare.md @@ -62,7 +62,7 @@ kubeadm join phase control-plane-prepare [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_all.md similarity index 89% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_all.md index e17152349d..9c35e63ed8 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_all.md @@ -118,7 +118,7 @@ kubeadm join phase control-plane-prepare all [api-server-endpoint] [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -153,7 +153,7 @@ kubeadm join phase control-plane-prepare all [api-server-endpoint] [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_certs.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_certs.md similarity index 97% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_certs.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_certs.md index f488eecfcc..8be3df9549 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_certs.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_certs.md @@ -132,7 +132,7 @@ kubeadm join phase control-plane-prepare certs [api-server-endpoint] [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_control-plane.md similarity index 83% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_control-plane.md index 6ecdb632d9..719fd76460 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_control-plane.md @@ -76,7 +76,7 @@ kubeadm join phase control-plane-prepare control-plane [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -97,7 +97,7 @@ kubeadm join phase control-plane-prepare control-plane [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_download-certs.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_download-certs.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_download-certs.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_download-certs.md index 1e0131256b..5a5d2722dc 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_download-certs.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_download-certs.md @@ -10,12 +10,12 @@ guide. You can file document formatting bugs against the --> -[EXPERIMENTAL] Download certificates shared among control-plane nodes from the kubeadm-certs Secret +Download certificates shared among control-plane nodes from the kubeadm-certs Secret ### Synopsis -[EXPERIMENTAL] Download certificates shared among control-plane nodes from the kubeadm-certs Secret +Download certificates shared among control-plane nodes from the kubeadm-certs Secret ``` kubeadm join phase control-plane-prepare download-certs [api-server-endpoint] [flags] @@ -125,7 +125,7 @@ kubeadm join phase control-plane-prepare download-certs [api-server-endpoint] [f --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_kubeconfig.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_kubeconfig.md similarity index 97% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_kubeconfig.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_kubeconfig.md index 387ca757e7..19e1d8f57f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_kubeconfig.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_kubeconfig.md @@ -125,7 +125,7 @@ kubeadm join phase control-plane-prepare kubeconfig [api-server-endpoint] [flags --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_kubelet-start.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_kubelet-start.md similarity index 87% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_kubelet-start.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_kubelet-start.md index 55befe834c..cb8abc1398 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_kubelet-start.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_kubelet-start.md @@ -97,7 +97,7 @@ kubeadm join phase kubelet-start [api-server-endpoint] [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -132,7 +132,7 @@ kubeadm join phase kubelet-start [api-server-endpoint] [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_preflight.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_preflight.md similarity index 97% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_preflight.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_preflight.md index 10dc190222..ef725cfe7e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_preflight.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_preflight.md @@ -167,7 +167,7 @@ kubeadm join phase preflight [api-server-endpoint] [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_wait-control-plane.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_wait-control-plane.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_wait-control-plane.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_wait-control-plane.md index cbdf65f75d..e9b35bc31b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_wait-control-plane.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_wait-control-plane.md @@ -55,7 +55,7 @@ kubeadm join phase wait-control-plane [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig/_index.md similarity index 91% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig/_index.md index 34a496927e..400875ed0e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig/_index.md @@ -51,7 +51,7 @@ Kubeconfig file utilities. --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig/kubeadm_kubeconfig_user.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig/kubeadm_kubeconfig_user.md index 2f9a2095c8..6520154d6e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig_user.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_kubeconfig/kubeadm_kubeconfig_user.md @@ -100,7 +100,7 @@ kubeadm kubeconfig user [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/_index.md similarity index 97% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/_index.md index fc95b377c3..e0515e33e9 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/_index.md @@ -126,7 +126,7 @@ kubeadm reset [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase.md index b7015907df..ee2ad4fb3d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase.md @@ -51,7 +51,7 @@ Use this command to invoke single phase of the reset workflow --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_cleanup-node.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_cleanup-node.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_cleanup-node.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_cleanup-node.md index 3f10d13b4a..20837bf702 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_cleanup-node.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_cleanup-node.md @@ -83,7 +83,7 @@ kubeadm reset phase cleanup-node [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_preflight.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_preflight.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_preflight.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_preflight.md index 03be0ef5ac..3cfc0033d8 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_preflight.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_preflight.md @@ -76,7 +76,7 @@ kubeadm reset phase preflight [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_remove-etcd-member.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_remove-etcd-member.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_remove-etcd-member.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_remove-etcd-member.md index 383728f8f8..75e5894fd6 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset_phase_remove-etcd-member.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_reset/kubeadm_reset_phase_remove-etcd-member.md @@ -69,7 +69,7 @@ kubeadm reset phase remove-etcd-member [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/_index.md similarity index 96% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/_index.md index a763641ee0..9d3d12873b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/_index.md @@ -86,7 +86,7 @@ kubeadm token [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_create.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_create.md similarity index 97% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_create.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_create.md index 3857d95857..3358e85135 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_create.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_create.md @@ -125,7 +125,7 @@ kubeadm token create [token] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_delete.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_delete.md similarity index 94% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_delete.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_delete.md index 4a5c1ab126..9dcf1c268b 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_delete.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_delete.md @@ -74,7 +74,7 @@ kubeadm token delete [token-value] ... --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_generate.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_generate.md similarity index 95% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_generate.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_generate.md index b16ad1a5a5..19b45e7f30 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_generate.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_generate.md @@ -79,7 +79,7 @@ kubeadm token generate [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_list.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_list.md similarity index 93% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_list.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_list.md index e803b5947f..179a717b16 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token_list.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_token/kubeadm_token_list.md @@ -39,13 +39,6 @@ kubeadm token list [flags]

If true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.

- --o, --experimental-output string     Default: "text" - - -

Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

- - -h, --help @@ -53,6 +46,13 @@ kubeadm token list [flags]

help for list

+ +-o, --output string     Default: "text" + + +

Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

+ + --show-managed-fields @@ -92,7 +92,7 @@ kubeadm token list [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/_index.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/_index.md index 7311869440..969d7bbf97 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/_index.md @@ -55,7 +55,7 @@ kubeadm upgrade [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_apply.md similarity index 80% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_apply.md index 1a30145ae6..2c0e24732f 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_apply.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_apply.md @@ -72,13 +72,6 @@ kubeadm upgrade apply [version]

Perform the upgrade of etcd.

- ---feature-gates string - - -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

- - -f, --force @@ -111,7 +104,7 @@ kubeadm upgrade apply [version] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -146,7 +139,7 @@ kubeadm upgrade apply [version] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_diff.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_diff.md similarity index 72% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_diff.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_diff.md index 0eae71711d..7c279cab58 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_diff.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_diff.md @@ -30,13 +30,6 @@ kubeadm upgrade diff [version] [flags] - ---api-server-manifest string     Default: "/etc/kubernetes/manifests/kube-apiserver.yaml" - - -

path to API server manifest

- - --config string @@ -51,13 +44,6 @@ kubeadm upgrade diff [version] [flags]

How many lines of context in the diff

- ---controller-manager-manifest string     Default: "/etc/kubernetes/manifests/kube-controller-manager.yaml" - - -

path to controller manifest

- - -h, --help @@ -72,13 +58,6 @@ kubeadm upgrade diff [version] [flags]

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

- ---scheduler-manifest string     Default: "/etc/kubernetes/manifests/kube-scheduler.yaml" - - -

path to scheduler manifest

- - @@ -97,7 +76,7 @@ kubeadm upgrade diff [version] [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node.md similarity index 86% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node.md index ffa9d94e3f..b239b460de 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node.md @@ -91,7 +91,7 @@ kubeadm upgrade node [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -119,7 +119,7 @@ kubeadm upgrade node [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase.md similarity index 92% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase.md index 53c0054b7c..b38f1b431d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase.md @@ -51,7 +51,7 @@ Use this command to invoke single phase of the node workflow --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_control-plane.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_control-plane.md similarity index 82% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_control-plane.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_control-plane.md index 0290456ec5..cc798cada6 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_control-plane.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_control-plane.md @@ -69,7 +69,7 @@ kubeadm upgrade node phase control-plane [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -90,7 +90,7 @@ kubeadm upgrade node phase control-plane [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_kubelet-config.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_kubelet-config.md similarity index 80% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_kubelet-config.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_kubelet-config.md index c057e331ab..091260a6f1 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_kubelet-config.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_kubelet-config.md @@ -55,7 +55,7 @@ kubeadm upgrade node phase kubelet-config [flags] --patches string -

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

+

Path to a directory that contains files named "target[suffix][+patchtype].extension". For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of "kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd", "kubeletconfiguration", "corednsdeployment". "patchtype" can be one of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". "suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.

@@ -76,7 +76,7 @@ kubeadm upgrade node phase kubelet-config [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_preflight.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_preflight.md similarity index 93% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_preflight.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_preflight.md index 2b52274ff9..e61de50418 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_node_phase_preflight.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_preflight.md @@ -62,7 +62,7 @@ kubeadm upgrade node phase preflight [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_plan.md similarity index 85% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_plan.md index 09fbdbb194..4a07b976cd 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade_plan.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_upgrade/kubeadm_upgrade_plan.md @@ -58,20 +58,6 @@ kubeadm upgrade plan [version] [flags]

Path to a kubeadm configuration file.

- --o, --experimental-output string     Default: "text" - - -

Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

- - - ---feature-gates string - - -

A set of key=value pairs that describe feature gates for various features. Options are:
EtcdLearnerMode=true|false (BETA - default=true)
PublicKeysECDSA=true|false (DEPRECATED - default=false)
RootlessControlPlane=true|false (ALPHA - default=false)
UpgradeAddonsBeforeControlPlane=true|false (DEPRECATED - default=false)
WaitForAllControlPlaneComponents=true|false (ALPHA - default=false)

- - -h, --help @@ -93,6 +79,13 @@ kubeadm upgrade plan [version] [flags]

The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.

+ +-o, --output string     Default: "text" + + +

Output format. One of: text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-as-json|jsonpath-file.

+ + --print-config @@ -125,7 +118,7 @@ kubeadm upgrade plan [version] [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

diff --git a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_version.md b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_version/_index.md similarity index 93% rename from content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_version.md rename to content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_version/_index.md index e210885018..3dcbb6840d 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_version.md +++ b/content/en/docs/reference/setup-tools/kubeadm/generated/kubeadm_version/_index.md @@ -62,7 +62,7 @@ kubeadm version [flags] --rootfs string -

[EXPERIMENTAL] The path to the 'real' host root filesystem.

+

The path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.

From 3b6f229424afc3a462a9f4eee8bb9fe872ed0d5d Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Sat, 17 Aug 2024 16:50:21 +0800 Subject: [PATCH 061/408] Update references to generated pages --- .../setup-tools/kubeadm/kubeadm-certs.md | 34 ++++---- .../setup-tools/kubeadm/kubeadm-config.md | 14 +-- .../setup-tools/kubeadm/kubeadm-init-phase.md | 86 +++++++++---------- .../setup-tools/kubeadm/kubeadm-init.md | 2 +- .../setup-tools/kubeadm/kubeadm-join-phase.md | 27 +++--- .../setup-tools/kubeadm/kubeadm-join.md | 2 +- .../setup-tools/kubeadm/kubeadm-kubeconfig.md | 6 +- .../kubeadm/kubeadm-reset-phase.md | 8 +- .../setup-tools/kubeadm/kubeadm-reset.md | 2 +- .../setup-tools/kubeadm/kubeadm-token.md | 8 +- .../kubeadm/kubeadm-upgrade-phase.md | 8 +- .../setup-tools/kubeadm/kubeadm-upgrade.md | 8 +- .../setup-tools/kubeadm/kubeadm-version.md | 2 +- 13 files changed, 103 insertions(+), 104 deletions(-) diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-certs.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-certs.md index e05ea06b87..37a755eed5 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-certs.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-certs.md @@ -13,7 +13,7 @@ For more details on how these commands can be used, see A collection of operations for operating Kubernetes certificates. {{< tabs name="tab-certs" >}} -{{< tab name="overview" include="generated/kubeadm_certs.md" />}} +{{< tab name="overview" include="generated/kubeadm_certs/_index.md" />}} {{< /tabs >}} ## kubeadm certs renew {#cmd-certs-renew} @@ -22,19 +22,19 @@ You can renew all Kubernetes certificates using the `all` subcommand or renew th For more details see [Manual certificate renewal](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#manual-certificate-renewal). {{< tabs name="tab-certs-renew" >}} -{{< tab name="renew" include="generated/kubeadm_certs_renew.md" />}} -{{< tab name="all" include="generated/kubeadm_certs_renew_all.md" />}} -{{< tab name="admin.conf" include="generated/kubeadm_certs_renew_admin.conf.md" />}} -{{< tab name="apiserver-etcd-client" include="generated/kubeadm_certs_renew_apiserver-etcd-client.md" />}} -{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_certs_renew_apiserver-kubelet-client.md" />}} -{{< tab name="apiserver" include="generated/kubeadm_certs_renew_apiserver.md" />}} -{{< tab name="controller-manager.conf" include="generated/kubeadm_certs_renew_controller-manager.conf.md" />}} -{{< tab name="etcd-healthcheck-client" include="generated/kubeadm_certs_renew_etcd-healthcheck-client.md" />}} -{{< tab name="etcd-peer" include="generated/kubeadm_certs_renew_etcd-peer.md" />}} -{{< tab name="etcd-server" include="generated/kubeadm_certs_renew_etcd-server.md" />}} -{{< tab name="front-proxy-client" include="generated/kubeadm_certs_renew_front-proxy-client.md" />}} -{{< tab name="scheduler.conf" include="generated/kubeadm_certs_renew_scheduler.conf.md" />}} -{{< tab name="super-admin.conf" include="generated/kubeadm_certs_renew_super-admin.conf.md" />}} +{{< tab name="renew" include="generated/kubeadm_certs/kubeadm_certs_renew.md" />}} +{{< tab name="all" include="generated/kubeadm_certs/kubeadm_certs_renew_all.md" />}} +{{< tab name="admin.conf" include="generated/kubeadm_certs/kubeadm_certs_renew_admin.conf.md" />}} +{{< tab name="apiserver-etcd-client" include="generated/kubeadm_certs/kubeadm_certs_renew_apiserver-etcd-client.md" />}} +{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_certs/kubeadm_certs_renew_apiserver-kubelet-client.md" />}} +{{< tab name="apiserver" include="generated/kubeadm_certs/kubeadm_certs_renew_apiserver.md" />}} +{{< tab name="controller-manager.conf" include="generated/kubeadm_certs/kubeadm_certs_renew_controller-manager.conf.md" />}} +{{< tab name="etcd-healthcheck-client" include="generated/kubeadm_certs/kubeadm_certs_renew_etcd-healthcheck-client.md" />}} +{{< tab name="etcd-peer" include="generated/kubeadm_certs/kubeadm_certs_renew_etcd-peer.md" />}} +{{< tab name="etcd-server" include="generated/kubeadm_certs/kubeadm_certs_renew_etcd-server.md" />}} +{{< tab name="front-proxy-client" include="generated/kubeadm_certs/kubeadm_certs_renew_front-proxy-client.md" />}} +{{< tab name="scheduler.conf" include="generated/kubeadm_certs/kubeadm_certs_renew_scheduler.conf.md" />}} +{{< tab name="super-admin.conf" include="generated/kubeadm_certs/kubeadm_certs_renew_super-admin.conf.md" />}} {{< /tabs >}} ## kubeadm certs certificate-key {#cmd-certs-certificate-key} @@ -45,7 +45,7 @@ and [`kubeadm join`](/docs/reference/setup-tools/kubeadm/kubeadm-join) to enable the automatic copy of certificates when joining additional control-plane nodes. {{< tabs name="tab-certs-certificate-key" >}} -{{< tab name="certificate-key" include="generated/kubeadm_certs_certificate-key.md" />}} +{{< tab name="certificate-key" include="generated/kubeadm_certs/kubeadm_certs_certificate-key.md" />}} {{< /tabs >}} ## kubeadm certs check-expiration {#cmd-certs-check-expiration} @@ -55,7 +55,7 @@ For more details see [Check certificate expiration](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#check-certificate-expiration). {{< tabs name="tab-certs-check-expiration" >}} -{{< tab name="check-expiration" include="generated/kubeadm_certs_check-expiration.md" />}} +{{< tab name="check-expiration" include="generated/kubeadm_certs/kubeadm_certs_check-expiration.md" />}} {{< /tabs >}} ## kubeadm certs generate-csr {#cmd-certs-generate-csr} @@ -66,7 +66,7 @@ on how to use the command see [Signing certificate signing requests (CSR) generated by kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#signing-csr). {{< tabs name="tab-certs-generate-csr" >}} -{{< tab name="generate-csr" include="generated/kubeadm_certs_generate-csr.md" />}} +{{< tab name="generate-csr" include="generated/kubeadm_certs/kubeadm_certs_generate-csr.md" />}} {{< /tabs >}} ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-config.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-config.md index e21f6a00fd..18c4d8fe02 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-config.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-config.md @@ -39,31 +39,31 @@ that kubeadm requires. ## kubeadm config print {#cmd-config-print} -{{< include "generated/kubeadm_config_print.md" >}} +{{< include "generated/kubeadm_config/kubeadm_config_print.md" >}} ## kubeadm config print init-defaults {#cmd-config-print-init-defaults} -{{< include "generated/kubeadm_config_print_init-defaults.md" >}} +{{< include "generated/kubeadm_config/kubeadm_config_print_init-defaults.md" >}} ## kubeadm config print join-defaults {#cmd-config-print-join-defaults} -{{< include "generated/kubeadm_config_print_join-defaults.md" >}} +{{< include "generated/kubeadm_config/kubeadm_config_print_join-defaults.md" >}} ## kubeadm config migrate {#cmd-config-migrate} -{{< include "generated/kubeadm_config_migrate.md" >}} +{{< include "generated/kubeadm_config/kubeadm_config_migrate.md" >}} ## kubeadm config validate {#cmd-config-validate} -{{< include "generated/kubeadm_config_validate.md" >}} +{{< include "generated/kubeadm_config/kubeadm_config_validate.md" >}} ## kubeadm config images list {#cmd-config-images-list} -{{< include "generated/kubeadm_config_images_list.md" >}} +{{< include "generated/kubeadm_config/kubeadm_config_images_list.md" >}} ## kubeadm config images pull {#cmd-config-images-pull} -{{< include "generated/kubeadm_config_images_pull.md" >}} +{{< include "generated/kubeadm_config/kubeadm_config_images_pull.md" >}} ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md index f9783e1fc3..37841f4d4c 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md @@ -16,7 +16,7 @@ and behind the scene both use the same code. Using this command you can execute preflight checks on a control-plane node. {{< tabs name="tab-preflight" >}} -{{< tab name="preflight" include="generated/kubeadm_init_phase_preflight.md" />}} +{{< tab name="preflight" include="generated/kubeadm_init/kubeadm_init_phase_preflight.md" />}} {{< /tabs >}} ## kubeadm init phase kubelet-start {#cmd-phase-kubelet-start} @@ -24,7 +24,7 @@ Using this command you can execute preflight checks on a control-plane node. This phase will write the kubelet configuration file and environment file and then start the kubelet. {{< tabs name="tab-kubelet-start" >}} -{{< tab name="kubelet-start" include="generated/kubeadm_init_phase_kubelet-start.md" />}} +{{< tab name="kubelet-start" include="generated/kubeadm_init/kubeadm_init_phase_kubelet-start.md" />}} {{< /tabs >}} ## kubeadm init phase certs {#cmd-phase-certs} @@ -32,19 +32,19 @@ This phase will write the kubelet configuration file and environment file and th Can be used to create all required certificates by kubeadm. {{< tabs name="tab-certs" >}} -{{< tab name="certs" include="generated/kubeadm_init_phase_certs.md" />}} -{{< tab name="all" include="generated/kubeadm_init_phase_certs_all.md" />}} -{{< tab name="ca" include="generated/kubeadm_init_phase_certs_ca.md" />}} -{{< tab name="apiserver" include="generated/kubeadm_init_phase_certs_apiserver.md" />}} -{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_init_phase_certs_apiserver-kubelet-client.md" />}} -{{< tab name="front-proxy-ca" include="generated/kubeadm_init_phase_certs_front-proxy-ca.md" />}} -{{< tab name="front-proxy-client" include="generated/kubeadm_init_phase_certs_front-proxy-client.md" />}} -{{< tab name="etcd-ca" include="generated/kubeadm_init_phase_certs_etcd-ca.md" />}} -{{< tab name="etcd-server" include="generated/kubeadm_init_phase_certs_etcd-server.md" />}} -{{< tab name="etcd-peer" include="generated/kubeadm_init_phase_certs_etcd-peer.md" />}} -{{< tab name="healthcheck-client" include="generated/kubeadm_init_phase_certs_etcd-healthcheck-client.md" />}} -{{< tab name="apiserver-etcd-client" include="generated/kubeadm_init_phase_certs_apiserver-etcd-client.md" />}} -{{< tab name="sa" include="generated/kubeadm_init_phase_certs_sa.md" />}} +{{< tab name="certs" include="generated/kubeadm_init/kubeadm_init_phase_certs.md" />}} +{{< tab name="all" include="generated/kubeadm_init/kubeadm_init_phase_certs_all.md" />}} +{{< tab name="ca" include="generated/kubeadm_init/kubeadm_init_phase_certs_ca.md" />}} +{{< tab name="apiserver" include="generated/kubeadm_init/kubeadm_init_phase_certs_apiserver.md" />}} +{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_init/kubeadm_init_phase_certs_apiserver-kubelet-client.md" />}} +{{< tab name="front-proxy-ca" include="generated/kubeadm_init/kubeadm_init_phase_certs_front-proxy-ca.md" />}} +{{< tab name="front-proxy-client" include="generated/kubeadm_init/kubeadm_init_phase_certs_front-proxy-client.md" />}} +{{< tab name="etcd-ca" include="generated/kubeadm_init/kubeadm_init_phase_certs_etcd-ca.md" />}} +{{< tab name="etcd-server" include="generated/kubeadm_init/kubeadm_init_phase_certs_etcd-server.md" />}} +{{< tab name="etcd-peer" include="generated/kubeadm_init/kubeadm_init_phase_certs_etcd-peer.md" />}} +{{< tab name="healthcheck-client" include="generated/kubeadm_init/kubeadm_init_phase_certs_etcd-healthcheck-client.md" />}} +{{< tab name="apiserver-etcd-client" include="generated/kubeadm_init/kubeadm_init_phase_certs_apiserver-etcd-client.md" />}} +{{< tab name="sa" include="generated/kubeadm_init/kubeadm_init_phase_certs_sa.md" />}} {{< /tabs >}} ## kubeadm init phase kubeconfig {#cmd-phase-kubeconfig} @@ -52,13 +52,13 @@ Can be used to create all required certificates by kubeadm. You can create all required kubeconfig files by calling the `all` subcommand or call them individually. {{< tabs name="tab-kubeconfig" >}} -{{< tab name="kubeconfig" include="generated/kubeadm_init_phase_kubeconfig.md" />}} -{{< tab name="all" include="generated/kubeadm_init_phase_kubeconfig_all.md" />}} -{{< tab name="admin" include="generated/kubeadm_init_phase_kubeconfig_admin.md" />}} -{{< tab name="kubelet" include="generated/kubeadm_init_phase_kubeconfig_kubelet.md" />}} -{{< tab name="controller-manager" include="generated/kubeadm_init_phase_kubeconfig_controller-manager.md" />}} -{{< tab name="scheduler" include="generated/kubeadm_init_phase_kubeconfig_scheduler.md" />}} -{{< tab name="super-admin" include="generated/kubeadm_init_phase_kubeconfig_super-admin.md" />}} +{{< tab name="kubeconfig" include="generated/kubeadm_init/kubeadm_init_phase_kubeconfig.md" />}} +{{< tab name="all" include="generated/kubeadm_init/kubeadm_init_phase_kubeconfig_all.md" />}} +{{< tab name="admin" include="generated/kubeadm_init/kubeadm_init_phase_kubeconfig_admin.md" />}} +{{< tab name="kubelet" include="generated/kubeadm_init/kubeadm_init_phase_kubeconfig_kubelet.md" />}} +{{< tab name="controller-manager" include="generated/kubeadm_init/kubeadm_init_phase_kubeconfig_controller-manager.md" />}} +{{< tab name="scheduler" include="generated/kubeadm_init/kubeadm_init_phase_kubeconfig_scheduler.md" />}} +{{< tab name="super-admin" include="generated/kubeadm_init/kubeadm_init_phase_kubeconfig_super-admin.md" />}} {{< /tabs >}} ## kubeadm init phase control-plane {#cmd-phase-control-plane} @@ -66,11 +66,11 @@ You can create all required kubeconfig files by calling the `all` subcommand or Using this phase you can create all required static Pod files for the control plane components. {{< tabs name="tab-control-plane" >}} -{{< tab name="control-plane" include="generated/kubeadm_init_phase_control-plane.md" />}} -{{< tab name="all" include="generated/kubeadm_init_phase_control-plane_all.md" />}} -{{< tab name="apiserver" include="generated/kubeadm_init_phase_control-plane_apiserver.md" />}} -{{< tab name="controller-manager" include="generated/kubeadm_init_phase_control-plane_controller-manager.md" />}} -{{< tab name="scheduler" include="generated/kubeadm_init_phase_control-plane_scheduler.md" />}} +{{< tab name="control-plane" include="generated/kubeadm_init/kubeadm_init_phase_control-plane.md" />}} +{{< tab name="all" include="generated/kubeadm_init/kubeadm_init_phase_control-plane_all.md" />}} +{{< tab name="apiserver" include="generated/kubeadm_init/kubeadm_init_phase_control-plane_apiserver.md" />}} +{{< tab name="controller-manager" include="generated/kubeadm_init/kubeadm_init_phase_control-plane_controller-manager.md" />}} +{{< tab name="scheduler" include="generated/kubeadm_init/kubeadm_init_phase_control-plane_scheduler.md" />}} {{< /tabs >}} @@ -79,8 +79,8 @@ Using this phase you can create all required static Pod files for the control pl Use the following phase to create a local etcd instance based on a static Pod file. {{< tabs name="tab-etcd" >}} -{{< tab name="etcd" include="generated/kubeadm_init_phase_etcd.md" />}} -{{< tab name="local" include="generated/kubeadm_init_phase_etcd_local.md" />}} +{{< tab name="etcd" include="generated/kubeadm_init/kubeadm_init_phase_etcd.md" />}} +{{< tab name="local" include="generated/kubeadm_init/kubeadm_init_phase_etcd_local.md" />}} {{< /tabs >}} ## kubeadm init phase upload-config {#cmd-phase-upload-config} @@ -89,10 +89,10 @@ You can use this command to upload the kubeadm configuration to your cluster. Alternatively, you can use [kubeadm config](/docs/reference/setup-tools/kubeadm/kubeadm-config/). {{< tabs name="upload-config" >}} -{{< tab name="upload-config" include="generated/kubeadm_init_phase_upload-config.md" />}} -{{< tab name="all" include="generated/kubeadm_init_phase_upload-config_all.md" />}} -{{< tab name="kubeadm" include="generated/kubeadm_init_phase_upload-config_kubeadm.md" />}} -{{< tab name="kubelet" include="generated/kubeadm_init_phase_upload-config_kubelet.md" />}} +{{< tab name="upload-config" include="generated/kubeadm_init/kubeadm_init_phase_upload-config.md" />}} +{{< tab name="all" include="generated/kubeadm_init/kubeadm_init_phase_upload-config_all.md" />}} +{{< tab name="kubeadm" include="generated/kubeadm_init/kubeadm_init_phase_upload-config_kubeadm.md" />}} +{{< tab name="kubelet" include="generated/kubeadm_init/kubeadm_init_phase_upload-config_kubelet.md" />}} {{< /tabs >}} ## kubeadm init phase upload-certs {#cmd-phase-upload-certs} @@ -101,7 +101,7 @@ Use the following phase to upload control-plane certificates to the cluster. By default the certs and encryption key expire after two hours. {{< tabs name="tab-upload-certs" >}} -{{< tab name="upload-certs" include="generated/kubeadm_init_phase_upload-certs.md" />}} +{{< tab name="upload-certs" include="generated/kubeadm_init/kubeadm_init_phase_upload-certs.md" />}} {{< /tabs >}} ## kubeadm init phase mark-control-plane {#cmd-phase-mark-control-plane} @@ -109,7 +109,7 @@ By default the certs and encryption key expire after two hours. Use the following phase to label and taint the node as a control plane node. {{< tabs name="tab-mark-control-plane" >}} -{{< tab name="mark-control-plane" include="generated/kubeadm_init_phase_mark-control-plane.md" />}} +{{< tab name="mark-control-plane" include="generated/kubeadm_init/kubeadm_init_phase_mark-control-plane.md" />}} {{< /tabs >}} ## kubeadm init phase bootstrap-token {#cmd-phase-bootstrap-token} @@ -117,7 +117,7 @@ Use the following phase to label and taint the node as a control plane node. Use the following phase to configure bootstrap tokens. {{< tabs name="tab-bootstrap-token" >}} -{{< tab name="bootstrap-token" include="generated/kubeadm_init_phase_bootstrap-token.md" />}} +{{< tab name="bootstrap-token" include="generated/kubeadm_init/kubeadm_init_phase_bootstrap-token.md" />}} {{< /tabs >}} ## kubeadm init phase kubelet-finalize {#cmd-phase-kubelet-finalize-all} @@ -127,9 +127,9 @@ bootstrap. You can use the `all` subcommand to run all `kubelet-finalize` phases. {{< tabs name="tab-kubelet-finalize" >}} -{{< tab name="kubelet-finalize" include="generated/kubeadm_init_phase_kubelet-finalize.md" />}} -{{< tab name="kubelet-finalize-all" include="generated/kubeadm_init_phase_kubelet-finalize_all.md" />}} -{{< tab name="kubelet-finalize-cert-rotation" include="generated/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md" />}} +{{< tab name="kubelet-finalize" include="generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize.md" />}} +{{< tab name="kubelet-finalize-all" include="generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_all.md" />}} +{{< tab name="kubelet-finalize-cert-rotation" include="generated/kubeadm_init/kubeadm_init_phase_kubelet-finalize_experimental-cert-rotation.md" />}} {{< /tabs >}} ## kubeadm init phase addon {#cmd-phase-addon} @@ -138,10 +138,10 @@ You can install all the available addons with the `all` subcommand, or install them selectively. {{< tabs name="tab-addon" >}} -{{< tab name="addon" include="generated/kubeadm_init_phase_addon.md" />}} -{{< tab name="all" include="generated/kubeadm_init_phase_addon_all.md" />}} -{{< tab name="coredns" include="generated/kubeadm_init_phase_addon_coredns.md" />}} -{{< tab name="kube-proxy" include="generated/kubeadm_init_phase_addon_kube-proxy.md" />}} +{{< tab name="addon" include="generated/kubeadm_init/kubeadm_init_phase_addon.md" />}} +{{< tab name="all" include="generated/kubeadm_init/kubeadm_init_phase_addon_all.md" />}} +{{< tab name="coredns" include="generated/kubeadm_init/kubeadm_init_phase_addon_coredns.md" />}} +{{< tab name="kube-proxy" include="generated/kubeadm_init/kubeadm_init_phase_addon_kube-proxy.md" />}} {{< /tabs >}} For more details on each field in the `v1beta4` configuration you can navigate to our diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md index dba238e9a9..0838c9bb48 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md @@ -10,7 +10,7 @@ This command initializes a Kubernetes control-plane node. -{{< include "generated/kubeadm_init.md" >}} +{{< include "generated/kubeadm_init/_index.md" >}} ### Init workflow {#init-workflow} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-join-phase.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-join-phase.md index c41054b543..ded45ea9fd 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-join-phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-join-phase.md @@ -14,7 +14,7 @@ and behind the scene both use the same code. ## kubeadm join phase {#cmd-join-phase} {{< tabs name="tab-phase" >}} -{{< tab name="phase" include="generated/kubeadm_join_phase.md" />}} +{{< tab name="phase" include="generated/kubeadm_join/kubeadm_join_phase.md" />}} {{< /tabs >}} ## kubeadm join phase preflight {#cmd-join-phase-preflight} @@ -22,7 +22,7 @@ and behind the scene both use the same code. Using this phase you can execute preflight checks on a joining node. {{< tabs name="tab-preflight" >}} -{{< tab name="preflight" include="generated/kubeadm_join_phase_preflight.md" />}} +{{< tab name="preflight" include="generated/kubeadm_join/kubeadm_join_phase_preflight.md" />}} {{< /tabs >}} ## kubeadm join phase control-plane-prepare {#cmd-join-phase-control-plane-prepare} @@ -30,12 +30,12 @@ Using this phase you can execute preflight checks on a joining node. Using this phase you can prepare a node for serving a control-plane. {{< tabs name="tab-control-plane-prepare" >}} -{{< tab name="control-plane-prepare" include="generated/kubeadm_join_phase_control-plane-prepare.md" />}} -{{< tab name="all" include="generated/kubeadm_join_phase_control-plane-prepare_all.md" />}} -{{< tab name="download-certs" include="generated/kubeadm_join_phase_control-plane-prepare_download-certs.md" />}} -{{< tab name="certs" include="generated/kubeadm_join_phase_control-plane-prepare_certs.md" />}} -{{< tab name="kubeconfig" include="generated/kubeadm_join_phase_control-plane-prepare_kubeconfig.md" />}} -{{< tab name="control-plane" include="generated/kubeadm_join_phase_control-plane-prepare_control-plane.md" />}} +{{< tab name="control-plane-prepare" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare.md" />}} +{{< tab name="all" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_all.md" />}} +{{< tab name="download-certs" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_download-certs.md" />}} +{{< tab name="certs" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_certs.md" />}} +{{< tab name="kubeconfig" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_kubeconfig.md" />}} +{{< tab name="control-plane" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_control-plane.md" />}} {{< /tabs >}} ## kubeadm join phase kubelet-start {#cmd-join-phase-kubelet-start} @@ -43,7 +43,7 @@ Using this phase you can prepare a node for serving a control-plane. Using this phase you can write the kubelet settings, certificates and (re)start the kubelet. {{< tabs name="tab-kubelet-start" >}} -{{< tab name="kubelet-start" include="generated/kubeadm_join_phase_kubelet-start.md" />}} +{{< tab name="kubelet-start" include="generated/kubeadm_join/kubeadm_join_phase_kubelet-start.md" />}} {{< /tabs >}} ## kubeadm join phase control-plane-join {#cmd-join-phase-control-plane-join} @@ -51,11 +51,10 @@ Using this phase you can write the kubelet settings, certificates and (re)start Using this phase you can join a node as a control-plane instance. {{< tabs name="tab-control-plane-join" >}} -{{< tab name="control-plane-join" include="generated/kubeadm_join_phase_control-plane-join.md" />}} -{{< tab name="all" include="generated/kubeadm_join_phase_control-plane-join_all.md" />}} -{{< tab name="etcd" include="generated/kubeadm_join_phase_control-plane-join_etcd.md" />}} -{{< tab name="update-status" include="generated/kubeadm_join_phase_control-plane-join_update-status.md" />}} -{{< tab name="mark-control-plane" include="generated/kubeadm_join_phase_control-plane-join_mark-control-plane.md" />}} +{{< tab name="control-plane-join" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-join.md" />}} +{{< tab name="all" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-join_all.md" />}} +{{< tab name="etcd" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-join_etcd.md" />}} +{{< tab name="mark-control-plane" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-join_mark-control-plane.md" />}} {{< /tabs >}} ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-join.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-join.md index 8b8275b1c3..9084441e8a 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-join.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-join.md @@ -10,7 +10,7 @@ weight: 30 This command initializes a Kubernetes worker node and joins it to the cluster. -{{< include "generated/kubeadm_join.md" >}} +{{< include "generated/kubeadm_join/_index.md" >}} ### The join workflow {#join-workflow} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md index a5684ecceb..dc64a12298 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig.md @@ -12,7 +12,7 @@ For examples on how to use `kubeadm kubeconfig user` see ## kubeadm kubeconfig {#cmd-kubeconfig} {{< tabs name="tab-kubeconfig" >}} -{{< tab name="overview" include="generated/kubeadm_kubeconfig.md" />}} +{{< tab name="overview" include="generated/kubeadm_kubeconfig/_index.md" />}} {{< /tabs >}} ## kubeadm kubeconfig user {#cmd-kubeconfig-user} @@ -20,5 +20,5 @@ For examples on how to use `kubeadm kubeconfig user` see This command can be used to output a kubeconfig file for an additional user. {{< tabs name="tab-kubeconfig-user" >}} -{{< tab name="user" include="generated/kubeadm_kubeconfig_user.md" />}} -{{< /tabs >}} \ No newline at end of file +{{< tab name="user" include="generated/kubeadm_kubeconfig/kubeadm_kubeconfig_user.md" />}} +{{< /tabs >}} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md index 7965f1c3d0..79e0a3705e 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-reset-phase.md @@ -14,7 +14,7 @@ and behind the scene both use the same code. ## kubeadm reset phase {#cmd-reset-phase} {{< tabs name="tab-phase" >}} -{{< tab name="phase" include="generated/kubeadm_reset_phase.md" />}} +{{< tab name="phase" include="generated/kubeadm_reset/kubeadm_reset_phase.md" />}} {{< /tabs >}} ## kubeadm reset phase preflight {#cmd-reset-phase-preflight} @@ -22,7 +22,7 @@ and behind the scene both use the same code. Using this phase you can execute preflight checks on a node that is being reset. {{< tabs name="tab-preflight" >}} -{{< tab name="preflight" include="generated/kubeadm_reset_phase_preflight.md" />}} +{{< tab name="preflight" include="generated/kubeadm_reset/kubeadm_reset_phase_preflight.md" />}} {{< /tabs >}} ## kubeadm reset phase remove-etcd-member {#cmd-reset-phase-remove-etcd-member} @@ -30,7 +30,7 @@ Using this phase you can execute preflight checks on a node that is being reset. Using this phase you can remove this control-plane node's etcd member from the etcd cluster. {{< tabs name="tab-remove-etcd-member" >}} -{{< tab name="remove-etcd-member" include="generated/kubeadm_reset_phase_remove-etcd-member.md" />}} +{{< tab name="remove-etcd-member" include="generated/kubeadm_reset/kubeadm_reset_phase_remove-etcd-member.md" />}} {{< /tabs >}} ## kubeadm reset phase cleanup-node {#cmd-reset-phase-cleanup-node} @@ -38,7 +38,7 @@ Using this phase you can remove this control-plane node's etcd member from the e Using this phase you can perform cleanup on this node. {{< tabs name="tab-cleanup-node" >}} -{{< tab name="cleanup-node" include="generated/kubeadm_reset_phase_cleanup-node.md" />}} +{{< tab name="cleanup-node" include="generated/kubeadm_reset/kubeadm_reset_phase_cleanup-node.md" />}} {{< /tabs >}} ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-reset.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-reset.md index 944d0accaa..2b7dab7d24 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-reset.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-reset.md @@ -10,7 +10,7 @@ weight: 60 Performs a best effort revert of changes made by `kubeadm init` or `kubeadm join`. -{{< include "generated/kubeadm_reset.md" >}} +{{< include "generated/kubeadm_reset/_index.md" >}} ### Reset workflow {#reset-workflow} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-token.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-token.md index 6edb87557d..6f9aea3e85 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-token.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-token.md @@ -16,16 +16,16 @@ such a token and also to create and manage new ones. ## kubeadm token create {#cmd-token-create} -{{< include "generated/kubeadm_token_create.md" >}} +{{< include "generated/kubeadm_token/kubeadm_token_create.md" >}} ## kubeadm token delete {#cmd-token-delete} -{{< include "generated/kubeadm_token_delete.md" >}} +{{< include "generated/kubeadm_token/kubeadm_token_delete.md" >}} ## kubeadm token generate {#cmd-token-generate} -{{< include "generated/kubeadm_token_generate.md" >}} +{{< include "generated/kubeadm_token/kubeadm_token_generate.md" >}} ## kubeadm token list {#cmd-token-list} -{{< include "generated/kubeadm_token_list.md" >}} +{{< include "generated/kubeadm_token/kubeadm_token_list.md" >}} ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-upgrade-phase.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-upgrade-phase.md index 1f712f912c..54e2428b84 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-upgrade-phase.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-upgrade-phase.md @@ -14,10 +14,10 @@ secondary control-plane or worker nodes. Please note that `kubeadm upgrade apply be called on a primary control-plane node. {{< tabs name="tab-phase" >}} -{{< tab name="phase" include="generated/kubeadm_upgrade_node_phase.md" />}} -{{< tab name="preflight" include="generated/kubeadm_upgrade_node_phase_preflight.md" />}} -{{< tab name="control-plane" include="generated/kubeadm_upgrade_node_phase_control-plane.md" />}} -{{< tab name="kubelet-config" include="generated/kubeadm_upgrade_node_phase_kubelet-config.md" />}} +{{< tab name="phase" include="generated/kubeadm_upgrade/kubeadm_upgrade_node_phase.md" />}} +{{< tab name="preflight" include="generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_preflight.md" />}} +{{< tab name="control-plane" include="generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_control-plane.md" />}} +{{< tab name="kubelet-config" include="generated/kubeadm_upgrade/kubeadm_upgrade_node_phase_kubelet-config.md" />}} {{< /tabs >}} ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md index 3741c5f30d..9cd28208c7 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-upgrade.md @@ -33,16 +33,16 @@ reports of unexpected results. {{}} ## kubeadm upgrade plan {#cmd-upgrade-plan} -{{< include "generated/kubeadm_upgrade_plan.md" >}} +{{< include "generated/kubeadm_upgrade/kubeadm_upgrade_plan.md" >}} ## kubeadm upgrade apply {#cmd-upgrade-apply} -{{< include "generated/kubeadm_upgrade_apply.md" >}} +{{< include "generated/kubeadm_upgrade/kubeadm_upgrade_apply.md" >}} ## kubeadm upgrade diff {#cmd-upgrade-diff} -{{< include "generated/kubeadm_upgrade_diff.md" >}} +{{< include "generated/kubeadm_upgrade/kubeadm_upgrade_diff.md" >}} ## kubeadm upgrade node {#cmd-upgrade-node} -{{< include "generated/kubeadm_upgrade_node.md" >}} +{{< include "generated/kubeadm_upgrade/kubeadm_upgrade_node.md" >}} ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-version.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-version.md index aabd8dd656..edbee7c9b3 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-version.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-version.md @@ -10,4 +10,4 @@ weight: 80 This command prints the version of kubeadm. -{{< include "generated/kubeadm_version.md" >}} +{{< include "generated/kubeadm_version/_index.md" >}} From 99e7b2067e5733c63f58298c59b8c210b39b4021 Mon Sep 17 00:00:00 2001 From: Asem Hamid <155321064+asem-hamid@users.noreply.github.com> Date: Sat, 17 Aug 2024 16:13:23 +0600 Subject: [PATCH 062/408] Update date format for bengali (#46448) * Changing date format for bn version * Update bn.toml --- data/i18n/bn/bn.toml | 4 ++-- hugo.toml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/data/i18n/bn/bn.toml b/data/i18n/bn/bn.toml index c16a9b60ee..352ca64bf6 100644 --- a/data/i18n/bn/bn.toml +++ b/data/i18n/bn/bn.toml @@ -81,7 +81,7 @@ other = "ইস্যু সারাংশ" other = "অফিসিয়াল কুবারনেটিস CVE তালিকা" [cve_table_date_format] -other = "2006-01-02 15:04:05 MST" +other = "02-01-2006 15:04:05 MST" [cve_table_date_format_string] other = "(সর্বশেষ ভার্সন: %s)" @@ -514,7 +514,7 @@ other = "(রিলিজ হয়েছিল: " # See https://gohugo.io/functions/format/gos-layout-string # Use a suitable format for your locale [release_date_format] -other = "2006-01-02" +other = "02-01-2006" [release_date_format_month] other = "জানুয়ারি 2006" diff --git a/hugo.toml b/hugo.toml index c603dcb143..28a5612633 100644 --- a/hugo.toml +++ b/hugo.toml @@ -313,7 +313,7 @@ contentDir = "content/bn" languagedirection = "ltr" [languages.bn.params] -time_format_blog = "01.02.2006" +time_format_blog = "02.01.2006" language_alternatives = ["en"] description = "প্রোডাকশন-গ্রেড কন্টেইনার অর্কেস্ট্রেশন" languageNameLatinScript = "Bengali" # aka Bangla From 94186e098a788940838d9739bb24c0fdee2e67a9 Mon Sep 17 00:00:00 2001 From: Matteo Bianchi <37507190+mbianchidev@users.noreply.github.com> Date: Sat, 17 Aug 2024 12:55:00 +0200 Subject: [PATCH 063/408] Update pr-wranglers.md Removed a bullet point that was not reflecting the process in place - Kubernetes org members cannot directly edit the wiki only lead and chairs can. --- content/en/docs/contribute/participate/pr-wranglers.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/content/en/docs/contribute/participate/pr-wranglers.md b/content/en/docs/contribute/participate/pr-wranglers.md index ba3186c4fd..cf5162d68d 100644 --- a/content/en/docs/contribute/participate/pr-wranglers.md +++ b/content/en/docs/contribute/participate/pr-wranglers.md @@ -130,10 +130,6 @@ The program was introduced to help new contributors understand the PR wrangling [PR Wranglers Wiki page](https://github.com/kubernetes/website/wiki/PR-Wranglers) to see the PR wrangling schedule for this year and sign up. -- Kubernetes org members can edit the - [PR Wranglers Wiki page](https://github.com/kubernetes/website/wiki/PR-Wranglers) - and sign up to shadow an existing PR Wrangler for a week. - - Others can reach out on the [#sig-docs Slack channel](https://kubernetes.slack.com/messages/sig-docs) for requesting to shadow an assigned PR Wrangler for a specific week. Feel free to reach out to Brad Topol (`@bradtopol`) or one of the From f567d93c4a5b5cb498ebfb5fa666a7ebfc91b073 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sat, 17 Aug 2024 21:38:01 +0800 Subject: [PATCH 064/408] [zh-cn] sync controllers/statefulset.md Signed-off-by: xin.li --- .../concepts/workloads/controllers/statefulset.md | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/content/zh-cn/docs/concepts/workloads/controllers/statefulset.md b/content/zh-cn/docs/concepts/workloads/controllers/statefulset.md index ddf3b592d2..196225a5b1 100644 --- a/content/zh-cn/docs/concepts/workloads/controllers/statefulset.md +++ b/content/zh-cn/docs/concepts/workloads/controllers/statefulset.md @@ -294,19 +294,15 @@ StatefulSet 的控制器也会添加一个包含此索引的 Pod 标签：`apps. --> ### 起始序号 {#start-ordinal} -{{< feature-state for_k8s_version="v1.27" state="beta" >}} +{{< feature-state feature_gate_name="StatefulSetStartOrdinal" >}} `.spec.ordinals` 是一个可选的字段，允许你配置分配给每个 Pod 的整数序号。 -该字段默认为 nil 值。你必须启用 `StatefulSetStartOrdinal` -[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)才能使用此字段。 -一旦启用，你就可以配置以下选项： +该字段默认为 nil 值。在该字段内，你可以配置以下选项： 1. 首先选择剔除悬决（Pending，且不可调度）的各个 Pod 2. 如果设置了 `controller.kubernetes.io/pod-deletion-cost` 注解，则注解值较小的优先被裁减掉 3. 所处节点上副本个数较多的 Pod 优先于所处节点上副本较少者 -4. 如果 Pod 的创建时间不同，最近创建的 Pod 优先于早前创建的 Pod 被裁减。 - （当 `LogarithmicScaleDown` 这一[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/) - 被启用时，创建时间是按整数幂级来分组的）。 +4. 如果 Pod 的创建时间不同，最近创建的 Pod 优先于早前创建的 Pod 被裁减（创建时间是按整数幂级来分组的）。 @@ -20,14 +19,14 @@ dos secciones: * [Depuración de su aplicación](/docs/tasks/debug/debug-application/) - Útil para usuarios que están implementando código en Kubernetes y se preguntan por qué no funciona. * [Depuración de su clúster](/docs/tasks/debug/debug-cluster/) - Útil -para administradores de clústeres y personas cuyo clúster de Kubernetes no está satisfecho. +para administradores de clústeres y personas cuyo clúster de Kubernetes no funciona correctamente. También debe comprobar los problemas conocidos del [release](https://github.com/kubernetes/kubernetes/releases) usado. -## Obteniendo ayuda +## Obteniendo Ayuda Si ninguna de las guías anteriores resuelve su problema, existen varias formas de obtener ayuda de la comunidad de Kubernetes.. @@ -42,19 +41,18 @@ y las interfaces de línea de comandos (CLIs), tal como [`kubectl`](/docs/refere ## ¡Ayuda! ¡Mi pregunta no está tratada! ¡Necesito ayuda ahora! -### Stack Exchange, Stack Overflow o Falla del Servidor {#stack-exchange} +### Stack Exchange, Stack Overflow o Server Fault {#stack-exchange} Si tienes preguntas relacionadas con *desarrollo de software* para su aplicación en contenedores, -puedes preguntarles a los de [Stack Overflow](https://stackoverflow.com/questions/tagged/kubernetes). +puedes preguntar en [Stack Overflow](https://stackoverflow.com/questions/tagged/kubernetes). -Si tiene preguntas sobre Kubernetes relacionadas con *administración de clusters* or *configuración*, -puedes preguntarles a los de -[Server Fault](https://serverfault.com/questions/tagged/kubernetes). +Si tiene preguntas sobre Kubernetes relacionadas con *administración de clústeres* o *configuración*, +puedes preguntar en [Server Fault](https://serverfault.com/questions/tagged/kubernetes). También hay varios sitios de Stack Exchange que podrían ser el lugar adecuado para hacer preguntas sobre Kubernetes en áreas como [DevOps](https://devops.stackexchange.com/questions/tagged/kubernetes), [Ingeniería de Software](https://softwareengineering.stackexchange.com/questions/tagged/kubernetes), -or [InfoSec](https://security.stackexchange.com/questions/tagged/kubernetes). +o [InfoSec](https://security.stackexchange.com/questions/tagged/kubernetes). Es posible que otra persona de la comunidad ya haya hecho una pregunta similar o pueda ayudar con su problema. @@ -63,7 +61,7 @@ El equipo de Kubernetes también monitoreará [publicaciones etiquetadas con Kubernetes](https://stackoverflow.com/questions/tagged/kubernetes). Si no hay ninguna pregunta existente que te ayude, **asegúrate de que tu pregunta sea [sobre el tema en Stack Overflow](https://stackoverflow.com/help/on-topic), -[Falla del Servidor](https://serverfault.com/help/on-topic), o el Stack Exchange +[Server Fault](https://serverfault.com/help/on-topic), o el Stack Exchange correcto en el que estás preguntando**, y lea las instrucciones sobre [Cómo hacer una nueva pregunta](https://stackoverflow.com/help/how-to-ask), Antes de preguntar una nueva! @@ -71,37 +69,36 @@ Antes de preguntar una nueva! ### Slack Muchas personas de la comunidad de Kubernetes se reúnen en Kubernetes Slack en el canal `#kubernetes-users`. -Slack requiere registro; puede [solicitar una invitación](https://slack.kubernetes.io), -y el registro está abierto a todos. No dudes en participar y hacer todas y cada una de las preguntas. -Una vez registrado, acceder a la [Organización de Kubernetes en Slack](https://kubernetes.slack.com) -a través de su navegador web o mediante la aplicación dedicada de Slack.. +Slack requiere registro; puedes [solicitar una invitación](https://slack.kubernetes.io), el registro está abierto a todos. No dudes en participar y hacer todas y cada una de las preguntas. +Una vez registrado, ingrese a la [Organización de Kubernetes en Slack](https://kubernetes.slack.com) +a través de tu navegador web o mediante la aplicación dedicada de Slack.. Una vez que esté registrado, explore la creciente lista de canales para diversos temas de interés. Por ejemplo, las personas nuevas en Kubernetes también pueden querer unirse al canal [`#kubernetes-novice`](https://kubernetes.slack.com/messages/kubernetes-novice). Como otro ejemplo, los desarrolladores deberían unirse al canal [`#kubernetes-contributors`](https://kubernetes.slack.com/messages/kubernetes-contributors). -También hay muchos canales en idiomas locales o específicos de cada país. Siéntete libre de unirte +También hay muchos canales en idiomas locales o específicos de cada país. Siéntete libre de unirte a estos canales para obtener soporte e información localizados: -{{< table caption="Country / language specific Slack channels" >}} -Región | Channels +{{< table caption="País / Idioma en el canal de Slack" >}} +Región | Canal(es) :---------|:------------ China | [`#cn-users`](https://kubernetes.slack.com/messages/cn-users), [`#cn-events`](https://kubernetes.slack.com/messages/cn-events) -Finland | [`#fi-users`](https://kubernetes.slack.com/messages/fi-users) -France | [`#fr-users`](https://kubernetes.slack.com/messages/fr-users), [`#fr-events`](https://kubernetes.slack.com/messages/fr-events) -Germany | [`#de-users`](https://kubernetes.slack.com/messages/de-users), [`#de-events`](https://kubernetes.slack.com/messages/de-events) +Finlandia | [`#fi-users`](https://kubernetes.slack.com/messages/fi-users) +Francia | [`#fr-users`](https://kubernetes.slack.com/messages/fr-users), [`#fr-events`](https://kubernetes.slack.com/messages/fr-events) +Alemania | [`#de-users`](https://kubernetes.slack.com/messages/de-users), [`#de-events`](https://kubernetes.slack.com/messages/de-events) India | [`#in-users`](https://kubernetes.slack.com/messages/in-users), [`#in-events`](https://kubernetes.slack.com/messages/in-events) -Italy | [`#it-users`](https://kubernetes.slack.com/messages/it-users), [`#it-events`](https://kubernetes.slack.com/messages/it-events) -Japan | [`#jp-users`](https://kubernetes.slack.com/messages/jp-users), [`#jp-events`](https://kubernetes.slack.com/messages/jp-events) -Korea | [`#kr-users`](https://kubernetes.slack.com/messages/kr-users) -Netherlands | [`#nl-users`](https://kubernetes.slack.com/messages/nl-users) -Norway | [`#norw-users`](https://kubernetes.slack.com/messages/norw-users) -Poland | [`#pl-users`](https://kubernetes.slack.com/messages/pl-users) -Russia | [`#ru-users`](https://kubernetes.slack.com/messages/ru-users) +Italia | [`#it-users`](https://kubernetes.slack.com/messages/it-users), [`#it-events`](https://kubernetes.slack.com/messages/it-events) +Japon | [`#jp-users`](https://kubernetes.slack.com/messages/jp-users), [`#jp-events`](https://kubernetes.slack.com/messages/jp-events) +Corea | [`#kr-users`](https://kubernetes.slack.com/messages/kr-users) +Países Bajos | [`#nl-users`](https://kubernetes.slack.com/messages/nl-users) +Noruega | [`#norw-users`](https://kubernetes.slack.com/messages/norw-users) +Polonia | [`#pl-users`](https://kubernetes.slack.com/messages/pl-users) +Rusia | [`#ru-users`](https://kubernetes.slack.com/messages/ru-users) Países Hispanos | [`#es-users`](https://kubernetes.slack.com/messages/es-users) -Sweden | [`#se-users`](https://kubernetes.slack.com/messages/se-users) -Turkey | [`#tr-users`](https://kubernetes.slack.com/messages/tr-users), [`#tr-events`](https://kubernetes.slack.com/messages/tr-events) +Suecia | [`#se-users`](https://kubernetes.slack.com/messages/se-users) +Turquia | [`#tr-users`](https://kubernetes.slack.com/messages/tr-users), [`#tr-events`](https://kubernetes.slack.com/messages/tr-events) {{< /table >}} ### Foro @@ -111,7 +108,7 @@ Te invitamos a unirte al Foro oficial de Kubernetes: [discuss.kubernetes.io](htt ### Bugs y solicitudes de funcionalidades Si tiene lo que parece ser un error (bug) o desea realizar una solicitud de funcionalidades, -por favor utilice el [Sistema de seguimiento de asuntos en el GitHub](https://github.com/kubernetes/kubernetes/issues). +por favor utilice el [sistema de seguimiento de asuntos en el GitHub](https://github.com/kubernetes/kubernetes/issues). Antes de presentar un problema, busque problemas existentes para ver si su problema ya está cubierto. From 577aa2f7f955396ffbcc66dbb038f7f5c85ece2d Mon Sep 17 00:00:00 2001 From: kohbis <18735471+kohbis@users.noreply.github.com> Date: Sun, 18 Aug 2024 02:40:20 +0900 Subject: [PATCH 067/408] [ja]Translate content/en/docs/concepts/security/rbac-good-practices.md --- .../concepts/security/rbac-good-practices.md | 157 ++++++++++++++++++ 1 file changed, 157 insertions(+) create mode 100644 content/ja/docs/concepts/security/rbac-good-practices.md diff --git a/content/ja/docs/concepts/security/rbac-good-practices.md b/content/ja/docs/concepts/security/rbac-good-practices.md new file mode 100644 index 0000000000..e5a0236dde --- /dev/null +++ b/content/ja/docs/concepts/security/rbac-good-practices.md @@ -0,0 +1,157 @@ +--- +reviewers: +title: ロールベースアクセス制御のグッドプラクティス +description: > + クラスター運用者向けの適切なRBAC設計の原則と実践方法 +content_type: concept +weight: 60 +--- + + + +Kubernetes {{< glossary_tooltip text="RBAC" term_id="rbac" >}}は、クラスターユーザーやワークロードがその役割を果たすために、必要なリソースへのアクセスしかできないようにするための重要なセキュリティコントロールです。 +クラスターユーザーの権限を設計する際には、クラスター管理者が特権昇格が発生しうる領域を理解し、セキュリティインシデントを引き起こすリスクを減らすことが重要です。 + +ここで説明するグッドプラクティスは、一般的な[RBACドキュメント](/ja/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update)と併せて読むことを推奨します。 + + + +## 一般的なグッドプラクティス + +### 最小特権の原則 + +理想的には、ユーザーやサービスには最小限の権限のみ割り当てるべきです。 +権限は、その操作に明示的に必要なものだけを使用するべきです。 +クラスターによって異なりますが、一般的なルールは次のとおりです: + +- 可能であれば、namespaceレベルで権限を割り当てます。 + 特定のnamespace内でのみユーザーに権限を与えるため、ClusterRoleBindingsではなくRoleBindingsを使用します。 +- 可能であれば、ワイルドカード権限を提供しないでください。 + Kubernetesは拡張可能なシステムであるため、ワイルドカードアクセスを提供すると、クラスター内に現存するすべてオブジェクトタイプだけでなく、将来作成されるすべてのオブジェクトタイプにも権限が与えられてしまいます。 +- 管理者は特に必要でない限り、`cluster-admin`アカウントを使用すべきではありません。 + 権限の低いアカウントに[偽装権限](/ja/docs/reference/access-authn-authz/authentication/#user-impersonation)を提供することで、クラスターリソースの誤った変更を回避できます。 +- `system:masters`グループにユーザーを追加しないでください。 + このグループのメンバーであるユーザーは、すべてのRBAC権限をバイパスし、常に制限のないスーパーユーザーアクセスを持ち、RoleBindingsまたはClusterRoleBindingsを削除しても取り消すことができません。 + 余談ですが、クラスターが認可ウェブフックを使用している場合、このグループのメンバーシップもそのウェブフックをバイパスします(そのグループのメンバーであるユーザーからのリクエストがウェブフックに送信されることはありません) + +### 特権トークンの配布を最小限に抑える + +理想的には、Podには強力な権限が付与されたサービスアカウントを割り当てられるべきではありません。 +(例えば、[特権昇格リスク](#privilege-escalation-risks)にリストされている権限)。 +強力な権限が必要な場合は、次のプラクティスを検討してください: + +- 強力なPodを実行するノードの数を制限します。 + 実行する任意のDaemonSetが必要であることを確認し、コンテナエスケープの影響範囲を制限するために最小限の権限で実行されるようにします。 +- 信頼できない、または公開されたPodと強力なPodを一緒に実行しないようにする。 + 信頼できない、または信頼度の低いPodと一緒に実行されないようにするために、[TaintsとToleration](/ja/docs/concepts/scheduling-eviction/taint-and-toleration/)、[NodeAffinity](/ja/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity)、または[PodAntiAffinity](/ja/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity)の使用を検討してください。 + 信頼性の低いPodが**制限付き**Podセキュリティ標準を満たしていない場合は、特に注意してください。 + +### 強化 + +Kubernetesは、すべてのクラスターに必要とは限らないアクセスをデフォルトで提供します。 +デフォルトで提供されるRBAC権限を確認することで、セキュリティを強化する機会が得られます。 +一般的に、`system:`アカウントに提供される権限を変更するべきではありませんが、クラスター権限を強化するためのオプションがいくつか存在します: + +- `system:unauthenticated`グループのバインディングを確認し、可能であれば削除します。 + これにより、ネットワークレベルでAPIサーバーに接続できるすべてのユーザーにアクセスが許可されます。 +- `automountServiceAccountToken: false`を設定することで、サービスアカウントトークンのデフォルトの自動マウントを回避します。 + 詳細については、[デフォルトのサービスアカウントトークンの使用](/ja/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server)を参照してください。 + Podにこの値を設定すると、サービスアカウント設定が上書きされ、サービスアカウントトークンを必要とするワークロードは引き続きそれをマウントできます。 + +### 定期的なレビュー + +冗長なエントリや特権昇格の可能性がないか、定期的にKubernetes RBAC設定を確認することが不可欠です。 +攻撃者が削除されたユーザーと同じ名前のユーザーアカウントを作成できる場合、特にそのユーザーに割り当てられた権限を自動的に継承できます。 + +## Kubernetes RBAC - 特権昇格リスク　{#privilege-escalation-risks} + +Kubernetes RBAC内には、ユーザーやサービスアカウントがクラスター内で特権昇格したり、クラスター外のシステムに影響を与えたりすることができる権限がいくつかあります。 + +このセクションは、クラスター運用者が意図した以上のクラスターへのアクセスを誤って許可しないようにするために注意を払うべき領域を示すことを目的としています。 + +### Secretのリスト + +一般に、Secretに対する`get`アクセスを許可すると、ユーザーがその内容を読むことができることは明らかです。 +また、`list`および`watch`アクセスも、ユーザーがSecretの内容を明らかにすること事実上可能にします。 + +例えば、Listレスポンスが返却される(例: `kubectl get secrets -A -o yaml`)と、そのレスポンスにはすべてのSecretの内容が含まれます。 + +### ワークロードの作成 + +Namespace内でワークロード(PodやPodを管理する[ワークロードリソース](/ja/docs/concepts/workloads/controllers/))を作成する権限により、そのnamespace内のSecret、ConfigMap、PersistentVolumeなどのPodにマウントできる他の多くのリソースへのアクセスが暗黙的に許可されます。 +さらに、Podは任意の[ServiceAccount](/ja/docs/reference/access-authn-authz/service-accounts-admin/)として実行できるため、ワークロードを作成する権限もまた、そのnamespace内の任意のサービスアカウントのAPIアクセスレベルを暗黙的に許可します。 + +特権付きPodを実行できるユーザーは、そのアクセス権を使用してノードへのアクセスを取得し、さらに特権昇格させる可能性があります。 +適切に安全で隔離されたPodを作成できるユーザーや他のプリンシパルを完全に信頼していない場合は、**ベースライン**または**制限付き**Podセキュリティ標準を強制する必要があります。 +[Podのセキュリティアドミッション](/ja/docs/concepts/security/pod-security-admission/)や他の(サードパーティ)メカニズムを使用して、その強制を実装できます。 + +これらの理由から、namespaceは異なる信頼レベルやテナンシーを必要とするリソースを分離するために使用されるべきです。 +[最小特権](#least-privilege)の原則に従い、最小限の権限セットを割り当てることがベストプラクティスとされていますが、namespace内の境界は弱いと考えるべきです。 + +### 永続ボリュームの作成 + +誰か、または何らかのアプリケーションが、任意のPersistentVolumeを作成する権限を持っている場合、そのアクセスには`hostPath`ボリュームの作成も含まれており、これはPodが関連づけられたノードの基盤となるホストファイルシステムにアクセスできることを意味します。 +その権限を与えることはセキュリティリスクとなります。 + +ホストファイルシステムに制限のないアクセス権を持つコンテナが特権昇格する方法は数多くあり、これには他のコンテナからのデータの読み取りや、Kubeletなどのシステムサービスの資格情報の悪用が含まれます。 + +PersistentVolumeオブジェクトを作成する権限を許可するのは、次の場合に限定するべきです: + +- ユーザー(クラスター運用者)が、作業にこのアクセスを必要としており、かつ信頼できる場合。 +- 自動プロビジョニングのために設定されたPersistentVolumeClaimに基づいてPersistentVolumeを作成するKubernetesコントロールコンポーネント。 + これは通常、KubernetesプロバイダーまたはCSIドラインバーのインストール時に設定されます。 + +永続ストレージへのアクセスが必要な場合、信頼できる管理者がPersistentVolumeを作成し、制約のあるユーザーはPersistentVolumeClaimを使用してそのストレージにアクセスするべきです。 + +### ノードの`proxy`サブリソースへのアクセス + +ノードオブジェクトのプロキシサブリソースへのアクセス権を持つユーザーは、Kubelet APIに対する権限を持ち、権限を持つノード上のすべてのPodでコマンドを実行できます。 +このアクセスは監査ログやアドミッションコントロールをバイパスするため、このリソースに権限を付与する際には注意が必要です。 + +### Escalate動詞 + +一般的に、RBACシステムはユーザーが所有する権限以上のクラスターロールを作成できないようにします。 +この例外は`escalate`動詞です。 +[RBACのドキュメント](/ja/docs/reference/access-authn-authz/rbac/#restrictions-on-role-creation-or-update)に記載されているように、この権限を持つユーザーは事実上特権昇格させることができます。 + +### Bind動詞 + +`escalate`動詞と同様に、ユーザーにこの権限を付与すると、特権昇格に対するKubernetesビルトインの保護をバイパスし、ユーザーがすでに持っていない権限を持つロールへのバインディングを作成できるようになります。 + +### Impersonate動詞 + +この動詞は、ユーザーがクラスター内の他のユーザーになりすまし、そのユーザーの権限を取得することを可能にします。 +権限を付与する場合は、なりすましアカウントを介して過剰な権限を取得できないように注意する必要があります。 + +### CSRと証明書の発行 + +CSR APIは、CSRに対する`create`権限と`certificatesigningrequests/approval`に対する`update`権限を持つユーザーが、クラスターに対して認証するための新しいクライアント証明書を作成できるようにします。 +これらのクライアント証明書は、Kubernetesシステムコンポーネントの重複を含む任意の名前を持つことができます。 +これにより、特権昇格が可能になります。 + +### トークンリクエスト + +`serviceaccounts/token`に対する`create`権限を持つユーザーは、既存のサービスアカウント用のトークンを発行するためのTokenRequestsを作成できます。 + +### アドミッションウェブフックの制御 + +`validatingwebhookconfigurations`または`mutatingwebhookconfigurations`を制御するユーザーは、クラスターに許可された任意のオブジェクトを読み取ることができるウェブフックを制御し、ウェブフックを変更する場合は許されたオブジェクトも変更できます。 + +### Namespaceの変更 + +Namespaceオブジェクトにおいて**patch**操作を実行できるユーザーは(そのアクセス権を持つロールへの名前空間付きのRoleBindingを通じて)namespaceのラベルを変更できます。 +Podのセキュリティアドミッションが使用されているクラスターでは、ユーザーは管理者が意図したより緩いポリシーをnamespaceに設定できる場合があります。 +NetworkPolicyが使用されているクラスターでは、ユーザーは管理者が意図していないサービスへのアクセスを間接的に許可するラベルを設定できる場合があります。 + +## Kubernetes RBAC - サービス拒否リスク {#denial-of-service-risks} + +### オブジェクト作成によるサービス拒否 + +クラスター内のオブジェクトを作成する権限を持つユーザーは、[etcd used by Kubernetes is vulnerable to OOM attack](https://github.com/kubernetes/kubernetes/issues/107325)で議論されているように、オブジェクトのサイズや数に基づいてサービス拒否を引き起こすほど大きなオブジェクトを作成できる可能性があります。 +これは、半信頼または信頼されていないユーザーにシステムへの限定的なアクセスが許可されている場合、特にマルチテナントクラスターに関係する可能性があります。 + +この問題を緩和するための1つのオプションとして、[リソースクォータ](/ja/docs/concepts/policy/resource-quotas/#object-count-quota)を使用して作成可能なオブジェクトの量を制限することが考えられます。 + +## {{% heading "whatsnext" %}} + +* RBACについてさらに詳しく知るには、[RBACのドキュメント](/ja/docs/reference/access-authn-authz/rbac/)を参照してください。 From 0c3195216efa7203843bb3cc297359d3d643bc0f Mon Sep 17 00:00:00 2001 From: kohbis <18735471+kohbis@users.noreply.github.com> Date: Sun, 18 Aug 2024 13:27:59 +0900 Subject: [PATCH 068/408] Update rbac-good-practices.md --- content/ja/docs/concepts/security/rbac-good-practices.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/concepts/security/rbac-good-practices.md b/content/ja/docs/concepts/security/rbac-good-practices.md index e5a0236dde..a5a30fa54c 100644 --- a/content/ja/docs/concepts/security/rbac-good-practices.md +++ b/content/ja/docs/concepts/security/rbac-good-practices.md @@ -1,6 +1,6 @@ --- reviewers: -title: ロールベースアクセス制御のグッドプラクティス +title: ロールベースアクセスコントロールのグッドプラクティス description: > クラスター運用者向けの適切なRBAC設計の原則と実践方法 content_type: concept From 5876c667aefcbd541ee8b67cf1e4bfe498f84a53 Mon Sep 17 00:00:00 2001 From: Michael Date: Wed, 14 Aug 2024 22:06:53 +0800 Subject: [PATCH 069/408] [zh] Sync scheduling-eviction/dynamic-resource-allocation.md --- .../dynamic-resource-allocation.md | 309 +++++++++--------- 1 file changed, 157 insertions(+), 152 deletions(-) diff --git a/content/zh-cn/docs/concepts/scheduling-eviction/dynamic-resource-allocation.md b/content/zh-cn/docs/concepts/scheduling-eviction/dynamic-resource-allocation.md index a8cd3af38e..01596304fc 100644 --- a/content/zh-cn/docs/concepts/scheduling-eviction/dynamic-resource-allocation.md +++ b/content/zh-cn/docs/concepts/scheduling-eviction/dynamic-resource-allocation.md @@ -14,34 +14,52 @@ weight: 65 + +使用结构化参数进行核心动态资源分配： + {{< feature-state feature_gate_name="DynamicResourceAllocation" >}} + +使用控制平面控制器进行动态资源分配： + +{{< feature-state feature_gate_name="DRAControlPlaneController" >}} + 动态资源分配是一个用于在 Pod 之间和 Pod 内部容器之间请求和共享资源的 API。 -它是持久卷 API 的通用资源化。第三方资源驱动程序负责跟踪和分配资源， -Kubernetes 通过**结构化参数**（在 Kubernetes 1.30 中引入）提供了额外的支持。 -当驱动程序使用结构化参数时，Kubernetes 可以处理调度和资源分配，而无需与驱动程序通信。 -而不同类型的资源，可支持用于“定义需求”和“初始化”的任意参数。 +它是持久卷 API 针对一般资源的泛化。通常这些资源是 GPU 这类设备。 + +第三方资源驱动程序负责跟踪和准备资源， +Kubernetes 通过**结构化参数**（在 Kubernetes 1.30 中引入）处理资源的分配。 +不同类别的资源支持任意参数来定义要求和初始化。 + +当驱动程序提供**控制平面控制器**时，驱动程序本身与 Kubernetes 调度器合作一起处理资源分配。 ## {{% heading "prerequisites" %}} Kubernetes v{{< skew currentVersion >}} 包含用于动态资源分配的集群级 API 支持， 但它需要被[显式启用](#enabling-dynamic-resource-allocation)。 @@ -54,113 +72,88 @@ Kubernetes v{{< skew currentVersion >}} 包含用于动态资源分配的集群 ## API -`resource.k8s.io/v1alpha2` +`resource.k8s.io/v1alpha3` {{< glossary_tooltip text="API 组" term_id="api-group" >}} 提供了以下类型： - +ResourceClaim +: 描述对集群中资源的访问请求，工作负载需要使用这些资源。 + 例如，如果工作负载需要具有特定属性的加速器设备，就可以通过这种方式表达该请求。 + 状态部分跟踪此请求是否已被满足以及具体已分配了哪些资源。 + +ResourceClaimTemplate +: 定义用于创建 ResourceClaim 的规约和一些元数据。 + 部署工作负载时由用户创建。 + 每个 Pod 的 ResourceClaim 随后会被 Kubernetes 自动创建和移除。 + +DeviceClass +: 包含某些设备的预定义选择标准和配置。 + DeviceClass 由集群管理员在安装资源驱动程序时创建。 + 对 ResourceClaim 中某个设备的每个分配请求都必须准确引用一个 DeviceClass。 + + -ResourceClass -: 定义由哪个资源驱动程序处理某种资源，并为其提供通用参数。 - 集群管理员在安装资源驱动程序时创建 ResourceClass。 + for a Pod and those ResourceClaims use a control plane controller. -ResourceClaim -: 定义工作负载所需的特定资源实例。 - 由用户创建（手动管理生命周期，可以在不同的 Pod 之间共享）， - 或者由控制平面基于 ResourceClaimTemplate 为特定 Pod 创建 - （自动管理生命周期，通常仅由一个 Pod 使用）。 - -ResourceClaimTemplate -: 定义用于创建 ResourceClaim 的 spec 和一些元数据。 - 部署工作负载时由用户创建。 - -PodSchedulingContext -: 供控制平面和资源驱动程序内部使用， - 在需要为 Pod 分配 ResourceClaim 时协调 Pod 调度。 - +PodSchedulingContext +: 供控制平面和资源驱动程序内部使用， + 在需要为 Pod 分配 ResourceClaim 且这些 ResourceClaim 使用控制平面控制器时协调 Pod 调度。 + ResourceSlice -: 与结构化参数一起使用，发布集群中可用资源的信息。 - -ResourceClaimParameters -: 包含影响调度的 ResourceClaim 参数， - 以 Kubernetes 理解的格式（“结构化参数模型”）呈现。 - 提供了供应商驱动程序，在设置底层资源时，使用的不透明扩展中可能嵌入其他参数。 - -ResourceClassParameters -: 类似于 ResourceClaimParameters，ResourceClassParameters 为 Kubernetes 理解的 ResourceClass 参数提供了一种类型。 - - - -ResourceClass 和 ResourceClaim 的参数存储在单独的对象中，通常使用安装资源驱动程序时创建的 -{{< glossary_tooltip term_id="CustomResourceDefinition" text="CRD" >}} 所定义的类型。 +: 与结构化参数一起使用，以发布有关集群中可用资源的信息。 -资源驱动程序的开发者决定他们是要在自己的外部控制器中处理这些参数， -还是依赖 Kubernetes 通过使用结构化参数来处理它们。 -自定义控制器提供更多的灵活性，但对于节点本地资源，集群自动缩放可能无法可靠工作。 -结构化参数使集群自动缩放成为可能，但可能无法满足所有用例。 +资源驱动程序的开发者决定他们是要使用控制平面控制器自己处理资源分配， +还是依赖 Kubernetes 使用结构化参数来处理资源分配。 +自定义控制器提供更多的灵活性，但对于节点本地资源，集群自动扩缩可能无法可靠工作。 +结构化参数使集群自动扩缩成为可能，但可能无法满足所有使用场景。 -当驱动程序使用结构化参数时，仍然可以让最终用户使用供应商特定的 CRD 指定参数。 -在这种情况下，驱动程序需要将这些自定义参数转换为内部类型。 -或者，驱动程序也可以直接使用内部类型的文档。 +当驱动程序使用结构化参数时，所有选择设备的参数都在 +ResourceClaim 和 DeviceClass 中以树内类型被定义。 +配置参数可以作为任意 JSON 对象嵌入其中。 -### 不使用结构化参数 {#without-structured-parameters} +### 使用控制平面控制器 {#with-control-plane-controller} -ResourceClaim 可以在创建时就进行分配（“立即分配”），不用考虑哪些 Pod 将使用它。 -默认情况下采用延迟分配，直到需要 ResourceClaim 的 Pod 被调度时 -（即“等待第一个消费者”）再进行分配。 - - -在这种模式下，调度器检查 Pod 所需的所有 ResourceClaim，并创建一个 PodScheduling 对象， +当 Pod 被调度时，调度器检查 Pod 所需的所有 ResourceClaim，并创建一个 PodScheduling 对象， 通知负责这些 ResourceClaim 的资源驱动程序，告知它们调度器认为适合该 Pod 的节点。 资源驱动程序通过排除没有足够剩余资源的节点来响应调度器。 一旦调度器有了这些信息，它就会选择一个节点，并将该选择存储在 PodScheduling 对象中。 @@ -341,22 +322,31 @@ responsibility of allocating resources to a ResourceClaim whenever a pod needs them. It does so by retrieving the full list of available resources from ResourceSlice objects, tracking which of those resources have already been allocated to existing ResourceClaims, and then selecting from those resources -that remain. The exact resources selected are subject to the constraints -provided in any ResourceClaimParameters or ResourceClassParameters associated -with the ResourceClaim. +that remain. --> 当驱动程序使用结构化参数时，调度器负责在 Pod 需要资源时为 ResourceClaim 分配资源。 通过从 ResourceSlice 对象中检索可用资源的完整列表， 跟踪已分配给现有 ResourceClaim 的资源，然后从剩余的资源中进行选择。 -所选资源受与 ResourceClaim 关联的 ResourceClaimParameters 或 ResourceClassParameters 提供的约束的影响。 + + +目前唯一支持的资源类别是设备。 +设备实例具有名称以及多个属性和容量信息。 +设备通过 CEL 表达式被选择，这些表达式检查设备的属性和容量。 +此外，所选择的设备集合还可以限制为满足特定约束的集合。 -所选资源与供应商特定参数一起被记录在 ResourceClaim 状态中， +所选资源与所有供应商特定配置一起被记录在 ResourceClaim 状态中， 因此当 Pod 即将在节点上启动时，节点上的资源驱动程序具有准备资源所需的所有信息。 通过使用结构化参数，调度器能够在不与 DRA 资源驱动程序通信的情况下做出决策。 -它还能够通过将 ResourceClaim 分配信息保存在内存中，并在同时将 Pod 绑定到节点的同时将此信息写入 ResourceClaim 对象中， -快速调度多个 Pod。 +它还能够通过将 ResourceClaim 分配信息保存在内存中，并在同时将 Pod 绑定到节点的同时将此信息写入 +ResourceClaim 对象中，快速调度多个 Pod。 动态资源分配是一个 **Alpha 特性**，只有在启用 `DynamicResourceAllocation` [特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/) -和 `resource.k8s.io/v1alpha2` +和 `resource.k8s.io/v1alpha3` {{< glossary_tooltip text="API 组" term_id="api-group" >}} 时才启用。 有关详细信息，参阅 `--feature-gates` 和 `--runtime-config` [kube-apiserver 参数](/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver/)。 kube-scheduler、kube-controller-manager 和 kubelet 也需要设置该特性门控。 + +当资源驱动程序使用控制平面控制器时，除了需要启用 `DynamicResourceAllocation` 外， +还必须启用 `DRAControlPlaneController` 特性门控。 + -快速检查 Kubernetes 集群是否支持该功能的方法是列出 ResourceClass 对象： +快速检查 Kubernetes 集群是否支持该特性的方法是列举 DeviceClass 对象： ```shell -kubectl get resourceclasses +kubectl get deviceclasses ``` -如果你的集群支持动态资源分配，则响应是 ResourceClass 对象列表或： +如果你的集群支持动态资源分配，则响应是 DeviceClass 对象列表或： ``` No resources found @@ -492,9 +488,18 @@ If not supported, this error is printed instead: 如果不支持，则会输出如下错误： ``` -error: the server doesn't have a resource type "resourceclasses" +error: the server doesn't have a resource type "deviceclasses" ``` + +当可以创建设置了 `spec.controller` 字段的 ResourceClaim 时，控制平面控制器是受支持的。 +当 `DRAControlPlaneController` 特性被禁用时，存储 ResourceClaim 时该字段会自动被清除。 + - 了解更多该设计的信息， - 参阅[动态资源分配 KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/3063-dynamic-resource-allocation/README.md) - 和[结构化参数 KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4381-dra-structured-parameters)。 + 参阅[使用结构化参数的动态资源分配 KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/4381-dra-structured-parameters) + 和[使用控制平面控制器的动态资源分配 KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/3063-dynamic-resource-allocation/README.md)。 From fc394e0472ac9264eb851c2a67279259280d700c Mon Sep 17 00:00:00 2001 From: windsonsea Date: Fri, 16 Aug 2024 10:01:10 +0800 Subject: [PATCH 070/408] [zh] Add a blog: 2024-08-15-volume-attributes-class.md --- .../2024-08-15-volume-attributes-class.md | 161 ++++++++++++++++++ 1 file changed, 161 insertions(+) create mode 100644 content/zh-cn/blog/_posts/2024-08-15-volume-attributes-class.md diff --git a/content/zh-cn/blog/_posts/2024-08-15-volume-attributes-class.md b/content/zh-cn/blog/_posts/2024-08-15-volume-attributes-class.md new file mode 100644 index 0000000000..711ffdf6dc --- /dev/null +++ b/content/zh-cn/blog/_posts/2024-08-15-volume-attributes-class.md @@ -0,0 +1,161 @@ +--- +layout: blog +title: "Kubernetes 1.31：通过 VolumeAttributesClass 修改卷进阶至 Beta" +date: 2024-08-15 +slug: kubernetes-1-31-volume-attributes-class +author: > + Sunny Song (Google) + Matthew Cary (Google) +translator: > + [windsonsea](https://github.com/windsonsea) (DaoCloud) +--- + + + +在 Kubernetes 中，卷由两个属性描述：存储类和容量。存储类是卷的不可变属性， +而容量可以通过[卷调整大小](/zh-cn/docs/concepts/storage/persistent-volumes/#expanding-persistent-volumes-claims)进行动态变更。 + +这使得使用卷的工作负载的垂直扩缩容变得复杂。 +虽然云厂商和存储供应商通常提供了一些允许指定注入 IOPS 或吞吐量等 IO +服务质量（性能）参数的卷，并允许在工作负载运行期间调整这些参数，但 Kubernetes +没有提供用来更改这些参数的 API。 + + +我们很高兴地宣布，自 Kubernetes 1.29 起以 Alpha 引入的 +[VolumeAttributesClass KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/3751-volume-attributes-class/README.md) +将在 1.31 中进入 Beta 阶段。这一机制提供了一个通用的、Kubernetes 原生的 API， +可用来修改诸如所提供的 IO 能力这类卷参数。 + + +类似于 Kubernetes 中所有新的卷特性，此 API 是通过[容器存储接口（CSI）](https://kubernetes-csi.github.io/docs/)实现的。 +除了 VolumeAttributesClass 特性门控外，特定于制备器的 CSI 驱动还必须支持此特性在 +CSI 一侧的全新的 ModifyVolume API。 + +有关细节请参阅[完整文档](/zh-cn/docs/concepts/storage/volume-attributes-classes/)。 +在这里，我们展示了常见的工作流程。 + + +### 动态修改卷属性 {#dynamically-modifying-volume-attributes} + +`VolumeAttributesClass` 是一个集群范围的资源，用来指定特定于制备器的属性。 +这些属性由集群管理员创建，方式上与存储类相同。 +例如，你可以为卷创建一系列金、银和铜级别的卷属性类，以区隔不同级别的 IO 能力。 + +```yaml +apiVersion: storage.k8s.io/v1alpha1 +kind: VolumeAttributesClass +metadata: + name: silver +driverName: your-csi-driver +parameters: + provisioned-iops: "500" + provisioned-throughput: "50MiB/s" +--- +apiVersion: storage.k8s.io/v1alpha1 +kind: VolumeAttributesClass +metadata: + name: gold +driverName: your-csi-driver +parameters: + provisioned-iops: "10000" + provisioned-throughput: "500MiB/s" +``` + + +属性类的添加方式与存储类类似。 + +```yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: test-pv-claim +spec: + storageClassName: any-storage-class + volumeAttributesClassName: silver + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 64Gi +``` + + +与存储类不同，卷属性类可以被更改： + +```shell +kubectl patch pvc test-pv-claim -p '{"spec": "volumeAttributesClassName": "gold"}' +``` + + +Kubernetes 将与 CSI 驱动协作来更新卷的属性。 +PVC 的状态将跟踪当前和所需的属性类。 +PV 资源也将依据新的卷属性类完成更新，卷属性类也会被依据 PV 当前活跃的属性完成设置。 + + +### Beta 阶段的限制 {#limitations-with-the-beta} + +作为一个 Beta 特性，仍有一些特性计划在 GA 阶段推出，但尚未实现。最大的限制是配额支持，详见 +[KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/3751-volume-attributes-class/README.md) +和 [sig-storage](https://github.com/kubernetes/community/tree/master/sig-storage) 中的讨论。 + +有关此特性在 CSI 驱动中的最新支持信息，请参阅 [Kubernetes CSI 驱动列表](https://kubernetes-csi.github.io/docs/drivers.html)。 From 766b04853af66efebcc2ddc34f3ab859e9868579 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sun, 18 Aug 2024 11:05:52 +0800 Subject: [PATCH 071/408] [zh-cn] sync device-plugins.md and intro.md Signed-off-by: xin.li --- .../compute-storage-net/device-plugins.md | 97 ++++++++++++++++--- content/zh-cn/docs/concepts/windows/intro.md | 8 +- 2 files changed, 85 insertions(+), 20 deletions(-) diff --git a/content/zh-cn/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md b/content/zh-cn/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md index d739049671..623f8e953e 100644 --- a/content/zh-cn/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md +++ b/content/zh-cn/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md @@ -72,7 +72,7 @@ to advertise that the node has 2 "Foo" devices installed and available. --> 设备插件可以通过此 gRPC 服务在 kubelet 进行注册。在注册期间，设备插件需要发送下面几样内容： -* 设备插件的 Unix 套接字。 +* 设备插件的 UNIX 套接字。 * 设备插件的 API 版本。 * `ResourceName` 是需要公布的。这里 `ResourceName` 需要遵循[扩展资源命名方案](/zh-cn/docs/concepts/configuration/manage-resources-containers/#extended-resources)， @@ -113,6 +113,15 @@ on certain nodes. Here is an example of a pod requesting this resource to run a 假设 Kubernetes 集群正在运行一个设备插件，该插件在一些节点上公布的资源为 `hardware-vendor.example/foo`。 下面就是一个 Pod 示例，请求此资源以运行一个工作负载的示例： + ```yaml --- apiVersion: v1 @@ -127,7 +136,7 @@ spec: limits: hardware-vendor.example/foo: 2 # -# 这个 pod 需要两个 hardware-vendor.example/foo 设备 +# 这个 Pod 需要两个 hardware-vendor.example/foo 设备 # 而且只能够调度到满足需求的节点上 # # 如果该节点中有 2 个以上的设备可用，其余的可供其他 Pod 使用 @@ -281,12 +290,13 @@ The general workflow of a device plugin includes the following steps: The processing of the fully-qualified CDI device names by the Device Manager requires that the `DevicePluginCDIDevices` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) is enabled for both the kubelet and the kube-apiserver. This was added as an alpha feature in Kubernetes - v1.28 and graduated to beta in v1.29. + v1.28, graduated to beta in v1.29 and to GA in v1.31. --> 设备管理器处理完全限定的 CDI 设备名称时， 需要为 kubelet 和 kube-apiserver 启用 `DevicePluginCDIDevices` [特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)。 - 在 Kubernetes v1.28 版本中作为 Alpha 特性被加入，并在 v1.29 版本中升级为 Beta 特性。 + 在 Kubernetes v1.28 版本中作为 Alpha 特性被加入，在 v1.29 版本中升级为 Beta 特性并在 + v1.31 版本升级为稳定可用特性。 {{< /note >}} +### 设备插件和不健康的设备 + +有时会发生设备出现故障或者被关闭的情况，这时，设备插件的职责是使用 +`ListAndWatch Response` API 将相关情况通报给 kubelet。 + + +一旦设备被标记为不健康，kubelet 将减少节点上此资源的可分配数量， +以反映有多少设备可用于调度新的 Pod，资源的容量数量不会因此发生改变。 + + +分配给故障设备的 Pod 将继续分配给该设备。 +通常情况下，依赖于设备的代码将开始失败，如果 Pod 的 `restartPolicy` 不是 +`Always`，则 Pod 可能会进入 Failed 阶段，否则会进入崩溃循环。 + + +在 Kubernetes v1.31 之前，要知道 Pod 是否与故障设备关联， +可以使用 [PodResources API](#monitoring-device-plugin-resources)。 + +{{< feature-state feature_gate_name="ResourceHealthStatus" >}} + + +通过启用特性门控 `ResourceHealthStatus`，系统将在每个 Pod 的 +`.status` 字段中的每个容器状态内添加 `allocatedResourcesStatus` 字段， +`allocatedResourcesStatus` 字段报告分配给容器的每个设备的健康信息。 + + +对于发生故障的 Pod，或者你怀疑存在故障的情况，你可以使用此状态来了解 +Pod 行为是否可能与设备故障有关。例如，如果加速器报告过热事件， +则 `allocatedResourcesStatus` 字段可能能够报告此情况。 -## 设备插件部署 {#device-plugin-depoloyments} +## 设备插件部署 {#device-plugin-deployment} 你可以将你的设备插件作为节点操作系统的软件包来部署、作为 DaemonSet 来部署或者手动部署。 @@ -343,7 +410,7 @@ guaranteed to be non-breaking. --> ## API 兼容性 {#api-compatibility} -之前版本控制方案要求设备插件的 API 版本与 Kubelet 的版本完全匹配。 +之前版本控制方案要求设备插件的 API 版本与 kubelet 的版本完全匹配。 自从此特性在 v1.12 中进阶为 Beta 后，这不再是硬性要求。 API 是版本化的，并且自此特性进阶 Beta 后一直表现稳定。 因此，kubelet 升级应该是无缝的，但在稳定之前 API 仍然可能会有变更，还不能保证升级不会中断。 @@ -398,7 +465,7 @@ identifying containers using `pod`, `namespace`, and `container` prometheus labe 为了监控设备插件提供的资源，监控代理程序需要能够发现节点上正在使用的设备， 并获取元数据来描述哪个指标与容器相关联。 设备监控代理暴露给 [Prometheus](https://prometheus.io/) 的指标应该遵循 -[Kubernetes Instrumentation Guidelines](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/instrumentation.md)， +[Kubernetes Instrumentation Guidelines（英文）](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/instrumentation.md)， 使用 `pod`、`namespace` 和 `container` 标签来标识容器。 `List` 端点中的 `ContainerResources` 中的 cpu_ids 对应于分配给某个容器的专属 CPU。 -如果要统计共享池中的 CPU，`List` 端点需要与 `GetAllocatableResources` 端点一起使用，如下所述: +如果要统计共享池中的 CPU，`List` 端点需要与 `GetAllocatableResources` 端点一起使用，如下所述： 1. 调用 `GetAllocatableResources` 获取所有可用的 CPU。 2. 在系统中所有的 `ContainerResources` 上调用 `GetCpuIds`。 @@ -639,12 +706,12 @@ However, calling `GetAllocatableResources` endpoint is not sufficient in case of update and Kubelet needs to be restarted to reflect the correct resource capacity and allocatable. --> `GetAllocatableResources` 应该仅被用于评估一个节点上的[可分配的](/zh-cn/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable)资源。 -如果目标是评估空闲/未分配的资源，此调用应该与 List() 端点一起使用。 +如果目标是评估空闲/未分配的资源，此调用应该与 `List()` 端点一起使用。 除非暴露给 kubelet 的底层资源发生变化，否则 `GetAllocatableResources` 得到的结果将保持不变。 这种情况很少发生，但当发生时（例如：热插拔，设备健康状况改变），客户端应该调用 `GetAlloctableResources` 端点。 -然而，调用 `GetAllocatableResources` 端点在 cpu、内存被更新的情况下是不够的， -Kubelet 需要重新启动以获取正确的资源容量和可分配的资源。 +然而，调用 `GetAllocatableResources` 端点在 CPU、内存被更新的情况下是不够的， +kubelet 需要重新启动以获取正确的资源容量和可分配的资源。 {{< /note >}} ```gRPC @@ -778,7 +845,7 @@ The Topology Manager is a Kubelet component that allows resources to be co-ordin aligned manner. In order to do this, the Device Plugin API was extended to include a `TopologyInfo` struct. --> -拓扑管理器是 Kubelet 的一个组件，它允许以拓扑对齐方式来调度资源。 +拓扑管理器是 kubelet 的一个组件，它允许以拓扑对齐方式来调度资源。 为了做到这一点，设备插件 API 进行了扩展来包括一个 `TopologyInfo` 结构体。 ```gRPC @@ -851,7 +918,7 @@ Here are some examples of device plugin implementations: * 适用于通用 Linux 设备和 USB 设备的[通用设备插件](https://github.com/squat/generic-device-plugin) * [Intel 设备插件](https://github.com/intel/intel-device-plugins-for-kubernetes)支持 Intel GPU、FPGA、QAT、VPU、SGX、DSA、DLB 和 IAA 设备 -* [KubeVirt 设备插件](https://github.com/kubevirt/kubernetes-device-plugins) 用于硬件辅助的虚拟化 +* [KubeVirt 设备插件](https://github.com/kubevirt/kubernetes-device-plugins)用于硬件辅助的虚拟化 * [为 Container-Optimized OS 所提供的 NVIDIA GPU 设备插件](https://github.com/GoogleCloudPlatform/container-engine-accelerators/tree/master/cmd/nvidia_gpu) * [RDMA 设备插件](https://github.com/hustcat/k8s-rdma-device-plugin) * [SocketCAN 设备插件](https://github.com/collabora/k8s-socketcan) diff --git a/content/zh-cn/docs/concepts/windows/intro.md b/content/zh-cn/docs/concepts/windows/intro.md index 013d37286d..265b380ad7 100644 --- a/content/zh-cn/docs/concepts/windows/intro.md +++ b/content/zh-cn/docs/concepts/windows/intro.md @@ -270,13 +270,12 @@ Some kubelet command line options behave differently on Windows, as described be * The `--kube-reserved`, `--system-reserved` , and `--eviction-hard` flags update [NodeAllocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) * Eviction by using `--enforce-node-allocable` is not implemented -* Eviction by using `--eviction-hard` and `--eviction-soft` are not implemented * When running on a Windows node the kubelet does not have memory or CPU restrictions. `--kube-reserved` and `--system-reserved` only subtract from `NodeAllocatable` and do not guarantee resource provided for workloads. See [Resource Management for Windows nodes](/docs/concepts/configuration/windows-resource-management/#resource-reservation) for more information. -* The `MemoryPressure` Condition is not implemented +* The `PIDPressure` Condition is not implemented * The kubelet does not take OOM eviction actions --> * `--windows-priorityclass` 允许你设置 kubelet 进程的调度优先级 @@ -284,11 +283,10 @@ Some kubelet command line options behave differently on Windows, as described be * `--kube-reserved`、`--system-reserved` 和 `--eviction-hard` 标志更新 [NodeAllocatable](/zh-cn/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable)。 * 未实现使用 `--enforce-node-allocable` 驱逐。 -* 未实现使用 `--eviction-hard` 和 `--eviction-soft` 驱逐。 * 在 Windows 节点上运行时，kubelet 没有内存或 CPU 限制。 `--kube-reserved` 和 `--system-reserved` 仅从 `NodeAllocatable` 中减去，并且不保证为工作负载提供的资源。 有关更多信息，请参考 [Windows 节点的资源管理](/zh-cn/docs/concepts/configuration/windows-resource-management/#resource-reservation)。 -* 未实现 `MemoryPressure` 条件。 +* 未实现 `PIDPressure` 条件。 * kubelet 不会执行 OOM 驱逐操作。 -当[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/) -`PodDisruptionConditions` 和 `JobPodFailurePolicy` 都被启用且 `.spec.podFailurePolicy` 字段被设置时， +当你指定了 `.spec.podFailurePolicy` 字段， Job 控制器不会将终止过程中的 Pod（已设置 `.metadata.deletionTimestamp` 字段的 Pod）视为失效 Pod， 直到该 Pod 完全终止（其 `.status.phase` 为 `Failed` 或 `Succeeded`）。 但只要终止变得显而易见，Job 控制器就会创建一个替代的 Pod。一旦 Pod 终止，Job 控制器将把这个刚终止的 @@ -741,19 +738,35 @@ kubectl get -o yaml job job-backoff-limit-per-index-example succeeded: 5 # 每 5 个成功的索引有 1 个成功的 Pod failed: 10 # 每 5 个失败的索引有 2 个失败的 Pod（1 次重试） conditions: + - message: Job has failed indexes + reason: FailedIndexes + status: "True" + type: FailureTarget - message: Job has failed indexes reason: FailedIndexes status: "True" type: Failed ``` + +Job 控制器添加 `FailureTarget` Job 状况来触发 [Job 终止和清理](#job-termination-and-cleanup)。 +当所有 Job Pod 都终止时，Job 控制器会添加 `Failed` 状况， +其 `reason` 和 `message` 的值与 `FailureTarget` Job 状况相同。 +有关详细信息，请参阅 [Job Pod 的终止](#termination-of-job-pods)。 + -此外，你可能想要结合使用逐索引回退与 [Pod 失败策略](#pod-failure-policy)。 +此外，你可能想要结合使用逐索引回退与 [Pod 失效策略](#pod-failure-policy)。 在使用逐索引回退时，有一个新的 `FailIndex` 操作可用，它让你避免就某个索引进行不必要的重试。 ### Pod 失效策略 {#pod-failure-policy} -{{< feature-state for_k8s_version="v1.26" state="beta" >}} - -{{< note >}} - -只有你在集群中启用了 -`JobPodFailurePolicy` [特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)， -你才能为某个 Job 配置 Pod 失效策略。 -此外，建议启用 `PodDisruptionConditions` 特性门控以便在 Pod 失效策略中检测和处理 Pod 干扰状况 -（参考：[Pod 干扰状况](/zh-cn/docs/concepts/workloads/pods/disruptions#pod-disruption-conditions)）。 -这两个特性门控都是在 Kubernetes {{< skew currentVersion >}} 中提供的。 -{{< /note >}} +{{< feature-state feature_gate_name="JobPodFailurePolicy" >}} -自 Kubernetes v1.28 开始，当使用 Pod 失败策略时，Job 控制器仅在这些 Pod 达到终止的 +自 Kubernetes v1.28 开始，当使用 Pod 失效策略时，Job 控制器仅在这些 Pod 达到终止的 `Failed` 阶段时才会重新创建终止中的 Pod。这种行为类似于 `podReplacementPolicy: Failed`。 细节参阅 [Pod 替换策略](#pod-replacement-policy)。 {{< /note >}} + +当你使用了 `podFailurePolicy`，并且 Pod 因为与 `FailJob` +操作的规则匹配而失败时，Job 控制器会通过添加 +`FailureTarget` 状况来触发 Job 终止流程。 +更多详情，请参阅 [Job 的终止和清理](#job-termination-and-cleanup)。 + @@ -1036,7 +1042,7 @@ Here is a manifest for a Job with `successPolicy`: In the example above, both `succeededIndexes` and `succeededCount` have been specified. Therefore, the job controller will mark the Job as succeeded and terminate the lingering Pods when either of the specified indexes, 0, 2, or 3, succeed. -The Job that meets the success policy gets the `SuccessCriteriaMet` condition. +The Job that meets the success policy gets the `SuccessCriteriaMet` condition with a `SuccessPolicy` reason. After the removal of the lingering Pods is issued, the Job gets the `Complete` condition. Note that the `succeededIndexes` is represented as intervals separated by a hyphen. @@ -1044,7 +1050,7 @@ The number are listed in represented by the first and last element of the series --> 在上面的例子中，`succeededIndexes` 和 `succeededCount` 都已被指定。 因此，当指定的索引 0、2 或 3 中的任意一个成功时，Job 控制器将 Job 标记为成功并终止剩余的 Pod。 -符合成功策略的 Job 会被标记 `SuccessCriteriaMet` 状况。 +符合成功策略的 Job 会被标记 `SuccessCriteriaMet` 状况，且状况的原因为 `SuccessPolicy`。 在剩余的 Pod 被移除后，Job 会被标记 `Complete` 状况。 请注意，`succeededIndexes` 表示为以连字符分隔的数字序列。 @@ -1152,6 +1158,132 @@ and `.spec.backoffLimit` result in a permanent Job failure that requires manual 换言之，由 `.spec.activeDeadlineSeconds` 和 `.spec.backoffLimit` 所触发的 Job 终结机制都会导致 Job 永久性的失败，而这类状态都需要手工干预才能解决。 + +### Job 终止状况 {#terminal-job-conditions} + +一个 Job 有两种可能的终止状况，每种状况都有相应的 Job 状况： + +* Succeeded：Job `Complete` 状况 +* Failed：Job `Failed` 状况 + + +Job 失败的原因如下： + +- Pod 失败数量超出了 Job 规约中指定的 `.spec.backoffLimit`， + 详情请参见 [Pod 回退失效策略](#pod-backoff-failure-policy)。 +- Job 运行时间超过了指定的 `.spec.activeDeadlineSeconds`。 +- 使用 `.spec.backoffLimitPerIndex` 的索引 Job 出现索引失败。 + 有关详细信息，请参阅[逐索引的回退限制](#backoff-limit-per-index)。 +- Job 中失败的索引数量超出了指定的 `spec.maxFailedIndexes` 值， + 详情见[逐索引的回退限制](#backoff-limit-per-index)。 +- 失败的 Pod 匹配了 `.spec.podFailurePolicy` 中定义的一条规则，该规则的动作为 FailJob。 + 有关 Pod 失效策略规则如何影响故障评估的详细信息，请参阅 [Pod 失效策略](#pod-failure-policy)。 + + +Pod 成功的原因如下： + +- 成功的 Pod 的数量达到了指定的 `.spec.completions` 数量。 +- `.spec.successPolicy` 中指定的标准已满足。详情请参见[成功策略](#success-policy)。 + + +在 Kubernetes v1.31 及更高版本中，Job 控制器会延迟添加终止状况 `Failed` 或 +`Complete`，直到所有 Job Pod 都终止。 + +在 Kubernetes v1.30 及更早版本中，一旦触发 Job 终止过程并删除所有 +Pod 终结器，Job 控制器就会给 Job 添加 `Complete` 或 `Failed` 终止状况。 +然而，在添加终止状况时，一些 Pod 仍会运行或处于终止过程中。 + + +在 Kubernetes v1.31 及更高版本中，控制器仅在所有 Pod 终止后添加 Job 终止状况。 +你可以使用 `JobManagedBy` 或 `JobPodReplacementPolicy`（默认启用） +启用此行为的[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)。 + + +### Job Pod 的终止 + +Job 控制器将 `FailureTarget` 状况或 `SuccessCriteriaMet` 状况添加到 +Job，以便在 Job 满足成功或失败标准后触发 Pod 终止。 + + +诸如 `terminationGracePeriodSeconds` 之类的因素可能会增加从 +Job 控制器添加 `FailureTarget` 状况或 `SuccessCriteriaMet` 状况到所有 +Job Pod 终止并且 Job 控制器添加[终止状况](#terminal-job-conditions)（`Failed` 或 `Complete`）的这段时间量。 + +你可以使用 `FailureTarget` 或 `SuccessCriteriaMet` +状况来评估 Job 是否失败或成功，而无需等待控制器添加终止状况。 + + +例如，你可能想要决定何时创建 Job 来替代某个已失败 Job。 +如果在出现 `FailureTarget` 状况时替换失败的 Job，则替换 Job 启动得会更早， +但可能会导致失败的 Job 和替换 Job 的 Pod 同时处于运行状态，进而额外耗用计算资源。 + +或者，如果你的集群资源容量有限，你可以选择等到 Job 上出现 `Failed` 状况后再执行替换操作。 +这样做会延迟替换 Job 的启动，不过通过等待所有失败的 Pod 都被删除，可以节省资源。 + ### 弹性索引 Job {#elastic-indexed-jobs} -{{< feature-state for_k8s_version="v1.27" state="beta" >}} +{{< feature-state feature_gate_name="ElasticIndexedJob" >}} 你可以通过同时改变 `.spec.parallelism` 和 `.spec.completions` 来扩大或缩小带索引 Job， 从而满足 `.spec.parallelism == .spec.completions`。 -当 [API 服务器](/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver/) -上的 `ElasticIndexedJob` 特性门控被禁用时，`.spec.completions` 是不可变的。 +缩减规模时，Kubernetes 会删除具有更高索引的 Pod。 + 弹性索引 Job 的使用场景包括需要扩展索引 Job 的批处理工作负载，例如 MPI、Horovord、Ray 和 PyTorch 训练作业。 @@ -1795,11 +1925,11 @@ See [Pod failure policy](#pod-failure-policy) to learn more about Pod failure po --> 你可以选择仅在终止过程中的 Pod 完全终止（具有 `status.phase: Failed`）时才创建替换 Pod。 为此，可以设置 `.spec.podReplacementPolicy: Failed`。 -默认的替换策略取决于 Job 是否设置了 `podFailurePolicy`。对于没有定义 Pod 失败策略的 Job， +默认的替换策略取决于 Job 是否设置了 `podFailurePolicy`。对于没有定义 Pod 失效策略的 Job， 省略 `podReplacementPolicy` 字段相当于选择 `TerminatingOrFailed` 替换策略： 控制平面在 Pod 删除时立即创建替换 Pod（只要控制平面发现该 Job 的某个 Pod 被设置了 `deletionTimestamp`）。 -对于设置了 Pod 失败策略的 Job，默认的 `podReplacementPolicy` 是 `Failed`，不允许其他值。 -请参阅 [Pod 失败策略](#pod-failure-policy)以了解更多关于 Job 的 Pod 失败策略的信息。 +对于设置了 Pod 失效策略的 Job，默认的 `podReplacementPolicy` 是 `Failed`，不允许其他值。 +请参阅 [Pod 失效策略](#pod-failure-policy)以了解更多关于 Job 的 Pod 失效策略的信息。 ```yaml kind: Job From f12f6abb3647527acf1a4387f5c10b396fb8ffc8 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Fri, 9 Aug 2024 09:31:09 +0800 Subject: [PATCH 073/408] [zh-cn] Add blog 2024-08-12-feature-gates_client-go.md Signed-off-by: xin.li --- .../2024-08-12-feature-gates_client-go.md | 223 ++++++++++++++++++ 1 file changed, 223 insertions(+) create mode 100644 content/zh-cn/blog/_posts/2024-08-12-feature-gates_client-go.md diff --git a/content/zh-cn/blog/_posts/2024-08-12-feature-gates_client-go.md b/content/zh-cn/blog/_posts/2024-08-12-feature-gates_client-go.md new file mode 100644 index 0000000000..77d2540e3a --- /dev/null +++ b/content/zh-cn/blog/_posts/2024-08-12-feature-gates_client-go.md @@ -0,0 +1,223 @@ +--- +layout: blog +title: '向 Client-Go 引入特性门控：增强灵活性和控制力' +date: 2024-08-12 +slug: feature-gates-in-client-go +author: > + Ben Luddy (Red Hat), + Lukasz Szaszkiewicz (Red Hat) +translator: > + Xin Li (DaoCloud) +--- + + + +Kubernetes 组件使用称为“特性门控（Feature Gates）”的开关来管理添加新特性的风险， +特性门控机制使特性能够通过 Alpha、Beta 和 GA 阶段逐步升级。 + + +Kubernetes 组件（例如 kube-controller-manager 和 kube-scheduler）使用 client-go 库与 API 交互， +整个 Kubernetes 生态系统使用相同的库来构建控制器、工具、webhook 等。 +client-go 现在包含自己的特性门控机制，使开发人员和集群管理员能够更好地控制如何使用客户端特性。 + + +要了解有关 Kubernetes 中特性门控的更多信息，请参阅[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)。 + + +## 动机 + +在没有 client-go 特性门控的情况下，每个新特性都以自己的方式（如果有的话）将特性可用性与特性的启用分开。 +某些特性可通过更新到较新版本的 client-go 来启用，其他特性则需要在每个使用它们的程序中进行主动配置， +其中一些可在运行时使用环境变量进行配置。使用 kube-apiserver 公开的特性门控功能时，有时需要客户端回退机制， +以保持与由于版本新旧或配置不同而不支持该特性服务器的兼容性。 +如果在这些回退机制中发现问题，则缓解措施需要更新到 client-go 的固定版本或回滚。 + + +这些方法都无法很好地支持为某些（但不是全部）使用 client-go 的程序默认启用特性。 +默认设置的更改不会首先仅为单个组件启用新特性，而是会立即影响所有 Kubernetes 组件的默认设置，从而大大扩大影响半径。 + + +## client-go 中的特性门控 + +为了应对这些挑战，大量的 client-go 特性将使用新的特性门控机制来逐步引入。 +这一机制将允许开发人员和用户以类似 Kubernetes 组件特性门控的管理方式启用或禁用特性。 + + +作为一种开箱即用的能力，用户只需使用最新版本的 client-go。这种设计带来多种好处。 + +对于使用通过 client-go 构建的软件的用户： + + +* 早期采用者可以针对各个进程分别启用默认关闭的 client-go 特性。 +* 无需构建新的二进制文件即可禁用行为不当的特性。 +* 所有已知的 client-go 特性门控的状态都会被记录到日志中，允许用户检查。 + + +对于开发使用 client-go 构建的软件的人员： + +* 默认情况下，client-go 特性门控覆盖是从环境变量中读取的。 + 如果在 client-go 特性中发现错误，用户将能够禁用它，而无需等待新版本发布。 +* 开发人员可以替换程序中基于默认环境变量的覆盖值以更改默认值、从其他源读取覆盖值或完全禁用运行时覆盖值。 + Kubernetes 组件使用这种可定制性将 client-go 特性门控与现有的 `--feature-gates` 命令行标志、特性启用指标和日志记录集成在一起。 + + +## 覆盖 client-go 特性门控 + +**注意**：这描述了在运行时覆盖 client-go 特性门控的默认方法，它可以由特定程序的开发人员禁用或自定义。 +在 Kubernetes 组件中，client-go 特性门控覆盖由 `--feature-gates` 标志控制。 + +可以通过设置以 `KUBE_FEATURE` 为前缀的环境变量来启用或禁用 client-go 的特性。 +例如，要启用名为 `MyFeature` 的特性，请按如下方式设置环境变量： + +```shell +KUBE_FEATURE_MyFeature=true +``` + + +要禁用特性，可将环境变量设置为 `false`： + +```shell +KUBE_FEATURE_MyFeature=false +``` + + +**注意**：在某些操作系统上，环境变量区分大小写。 +因此，`KUBE_FEATURE_MyFeature` 和 `KUBE_FEATURE_MYFEATURE` 将被视为两个不同的变量。 + + +## 自定义 client-go 特性门控 + +基于环境变量的默认特性门控覆盖机制足以满足 Kubernetes 生态系统中许多程序的需求，无需特殊集成。 +需要不同行为的程序可以用自己的自定义特性门控提供程序替换它。 +这允许程序执行诸如强制禁用已知运行不良的特性、直接从远程配置服务读取特性门控或通过命令行选项接受特性门控覆盖等操作。 + + +Kubernetes 组件将 client-go 的默认特性门控提供程序替换为现有 Kubernetes 特性门控提供程序的转换层。 +在所有实际应用场合中，client-go 特性门控与其他 Kubernetes 特性门控的处理方式相同： +它们连接到 `--feature-gates` 命令行标志，包含在特性启用指标中，并在启动时记录。 + + +要替换默认的特性门控提供程序，请实现 Gates 接口并在包初始化时调用 ReplaceFeatureGates，如以下简单示例所示： + +```go +import ( + "k8s.io/client-go/features" +) + +type AlwaysEnabledGates struct{} + +func (AlwaysEnabledGates) Enabled(features.Feature) bool { + return true +} + +func init() { + features.ReplaceFeatureGates(AlwaysEnabledGates{}) +} +``` + + +需要定义的 client-go 特性完整列表的实现可以通过实现 Registry 接口并调用 `AddFeaturesToExistingFeatureGates` 来获取它。 +完整示例请参考 +[Kubernetes 内部使用](https://github.com/kubernetes/kubernetes/blob/64ba17c605a41700f7f4c4e27dca3684b593b2b9/pkg/features/kube_features.go#L990-L997)。 + + +## 总结 + +随着 client-go v1.30 中特性门控的引入，推出新的 client-go 特性变得更加安全、简单。 +用户和开发人员可以控制自己采用 client-go 特性的步伐。 +通过为跨 Kubernetes API 边界两侧的特性提供一种通用的培育机制，Kubernetes 贡献者的工作得到了简化。 + + +特别感谢 [@sttts](https://github.com/sttts) 和 [@deads2k](https://github.com/deads2k) 对此特性提供的帮助。 From eb6675d43d4a24807d8caf842e9d2f745b4fe79c Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sun, 18 Aug 2024 11:40:50 +0800 Subject: [PATCH 074/408] [zh-cn] sync custom-resources.md Signed-off-by: xin.li --- .../api-extension/custom-resources.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/zh-cn/docs/concepts/extend-kubernetes/api-extension/custom-resources.md b/content/zh-cn/docs/concepts/extend-kubernetes/api-extension/custom-resources.md index ba0f7e1f5b..7668f3161a 100644 --- a/content/zh-cn/docs/concepts/extend-kubernetes/api-extension/custom-resources.md +++ b/content/zh-cn/docs/concepts/extend-kubernetes/api-extension/custom-resources.md @@ -630,13 +630,10 @@ may also be used with field selectors when included in the `spec.versions[*].sel {{< feature-state feature_gate_name="CustomResourceFieldSelectors" >}} @@ -645,7 +642,10 @@ selectable fields. 来使用此行为，然后将其应用到集群中的所有 CustomResourceDefinitions。 {{< glossary_tooltip term_id="CustomResourceDefinition" text="CustomResourceDefinition" >}} -的 `spec.versions[*].selectableFields` 字段可以用来声明可以在字段选择算符中使用定制资源中的其他哪些字段。 +字段可以用来在启用了 `CustomResourceFieldSelectors` +[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/) +（自 Kubernetes v1.31 起，此特性默认启用）的集群中控制哪些字段可以用在字段选择算符中。 + 以下示例将 `.spec.color` 和 `.spec.size` 字段添加为可选择字段。 {{% code_sample file="customresourcedefinition/shirt-resource-definition.yaml" %}} From dfdedb88474d019ffb41eedf843bc6d0eddcca1d Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Sun, 18 Aug 2024 17:52:33 +0800 Subject: [PATCH 075/408] [zh-cn] sync kubeadm-init-phase tutorials/_index.md Signed-off-by: xin.li --- .../docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md | 4 ++-- content/zh-cn/docs/tutorials/_index.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md index 02cc0e3cb2..5a4b5e3d88 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-init-phase.md @@ -229,10 +229,10 @@ install them selectively. {{< /tabs >}} -有关 `v1beta3` 配置中每个字段的更多详细信息，可以访问 +有关 `v1beta4` 配置中每个字段的更多详细信息，可以访问 [API](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta3/)。 ## {{% heading "whatsnext" %}} diff --git a/content/zh-cn/docs/tutorials/_index.md b/content/zh-cn/docs/tutorials/_index.md index 256b364f21..6a7be86e55 100644 --- a/content/zh-cn/docs/tutorials/_index.md +++ b/content/zh-cn/docs/tutorials/_index.md @@ -96,14 +96,14 @@ Kubernetes 文档的这一部分包含教程。 * [Apply Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/) * [Apply Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/) -* [AppArmor](/zh-cn/docs/tutorials/security/apparmor/) +* [Restrict a Container's Access to Resources with AppArmor](/docs/tutorials/security/apparmor/) * [Seccomp](/zh-cn/docs/tutorials/security/seccomp/) --> ## 安全 {#security} * [在集群级别应用 Pod 安全标准](/zh-cn/docs/tutorials/security/cluster-level-pss/) * [在名字空间级别应用 Pod 安全标准](/zh-cn/docs/tutorials/security/ns-level-pss/) -* [AppArmor](/zh-cn/docs/tutorials/security/apparmor/) +* [使用 AppArmor 限制容器对资源的访问](/zh-cn/docs/tutorials/security/apparmor/) * [Seccomp](/zh-cn/docs/tutorials/security/seccomp/) ## {{% heading "whatsnext" %}} From 94f51953cbf3f6c088cd1b034469495ab327a27e Mon Sep 17 00:00:00 2001 From: Michael Date: Sun, 18 Aug 2024 20:17:05 +0800 Subject: [PATCH 076/408] [zh] sync pr-wranglers.md --- .../docs/contribute/participate/pr-wranglers.md | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/content/zh-cn/docs/contribute/participate/pr-wranglers.md b/content/zh-cn/docs/contribute/participate/pr-wranglers.md index 32f4feb2d8..c2e6e8fec3 100644 --- a/content/zh-cn/docs/contribute/participate/pr-wranglers.md +++ b/content/zh-cn/docs/contribute/participate/pr-wranglers.md @@ -164,8 +164,8 @@ These queries exclude localization PRs. All queries are against the main branch - [非主分支的 PR](https://github.com/kubernetes/website/pulls?q=is%3Aopen+is%3Apr+label%3Alanguage%2Fen+-base%3Amain): 如果 PR 针对 `dev-` 分支，则表示它适用于即将发布的版本。 - 请添加带有 `/assign @<负责人的 github 账号>`，将其指派给 - [发行版本负责人](https://github.com/kubernetes/sig-release/tree/master/release-team#kubernetes-release-team-roles)。 + 请添加带有 `/assign @<负责人的 github 账号>`， + 将其指派给[发行版本负责人](https://github.com/kubernetes/sig-release/tree/master/release-team#kubernetes-release-team-roles)。 如果 PR 是针对旧分支，请帮助 PR 作者确定是否所针对的是最合适的分支。 -启用 kubelet，即使在容器镜像和容器位于独立文件系统的情况下，也能进行垃圾回收。 +分离镜像文件系统特性使 kubelet 能够对部署在不同文件系统上的镜像（只读层）和/或容器（可写层）执行垃圾回收。 From b0c56e78ffac7504b611551e37e7f9dabb5585ce Mon Sep 17 00:00:00 2001 From: Kei Takamizu Date: Mon, 19 Aug 2024 09:40:15 +0900 Subject: [PATCH 079/408] [ja]update: /docs/concepts/policy/pid-limiting.md into Japanese --- content/ja/docs/concepts/policy/pid-limiting.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/ja/docs/concepts/policy/pid-limiting.md b/content/ja/docs/concepts/policy/pid-limiting.md index 0703aef409..a11c8093bf 100644 --- a/content/ja/docs/concepts/policy/pid-limiting.md +++ b/content/ja/docs/concepts/policy/pid-limiting.md @@ -8,19 +8,19 @@ weight: 40 {{< feature-state for_k8s_version="v1.20" state="stable" >}} -Kubernetesでは、{{< glossary_tooltip term_id="Pod" text="Pod" >}}が使用できるプロセスID(PIDs)数を制限することができます。また、オペレーティングシステムやデーモンによる使用のために、Podだけではなく{{< glossary_tooltip term_id="node" text="ノード" >}}ごとに割り当て可能なPID数を予約することができます。 +Kubernetesでは、{{< glossary_tooltip term_id="Pod" text="Pod" >}}が使用できるプロセスID(PID)数を制限することができます。また、オペレーティングシステムやデーモンによる使用のために、Podだけではなく{{< glossary_tooltip term_id="node" text="ノード" >}}ごとに割り当て可能なPID数を予約することができます。 -プロセスID(PIDs)はノードの基本的なリソースです。他のリソース制限に達することなくタスク制限に達することは容易であり、それがホストマシンの不安定性を引き起こす可能性があります。 +プロセスID(PID)はノードの基本的なリソースです。他のリソース制限に達することなくタスク制限に達することは容易であり、それがホストマシンの不安定性を引き起こす可能性があります。 -クラスター管理者はクラスター内で実行しているPodがホストデーモン({{< glossary_tooltip text="kubelet" term_id="kubelet" >}}や{{< glossary_tooltip text="kube-proxy" term_id="kube-proxy" >}}や場合によってはコンテナランタイムなど)の実行を妨げるPID枯渇を引き起こさないことを保証するメカニズムを必要とします。それに加えて、同ノード上の他のワークロードへの影響を制限するためにPod間でPIDが制限されていることも重要です。 +クラスター管理者はクラスター内で実行しているPodがホストデーモン({{< glossary_tooltip text="kubelet" term_id="kubelet" >}}や{{< glossary_tooltip text="kube-proxy" term_id="kube-proxy" >}}や場合によってはコンテナランタイムなど)の実行を妨げる、PIDの枯渇を引き起こさないことを保証するメカニズムを必要とします。それに加えて、同ノード上の他のワークロードへの影響を制限するためにPod間でPIDが制限されていることも重要です。 {{< note >}} 特定のLinuxのインストール時に、オペレーティングシステムはPID制限の値を`32768`のような低いデフォルト値に設定することがあります。`/proc/sys/kernel/pid_max`の値を上げることを検討してください。 {{< /note >}} -Podが使用できるPID数の制限をkubeletに設定できます。例えば、ノードのホストOSがPIDの最大値を`262144`を設定し、250未満のPodをホストする場合、各Podに`1000`PIDを割り当てることで、そのノードで利用可能なPIDを使い切ることを防ぐことができます。管理者がCPUやメモリのようにPIDでもオーバーコミットを行いたい場合、同様にいくつかの追加のリスクがあります。いずれにしても、単一のPodがマシン全体をダウンさせることはできません。このようなリソース制限は単純なフォーク爆弾がクラスター全体の運用に影響を与えるのを防ぐのに役立ちます。 +Podが使用できるPID数の制限をkubeletに設定できます。例えば、ノードのホストOSがPIDの最大値を`262144`に設定し、250未満のPodをホストします。この場合、各Podに`1000`PIDを割り当てることで、そのノードで利用可能なPIDを使い切ることを防ぐことができます。管理者がCPUやメモリのようにPIDでもオーバーコミットを行いたい場合、同様にいくつかの追加のリスクがあります。いずれにしても、単一のPodがマシン全体をダウンさせることはできません。このようなリソース制限は単純なフォーク爆弾がクラスター全体の運用に影響を与えるのを防ぐのに役立ちます。 PodごとのPID制限により、管理者はあるPodを他のPodから保護できますが、ホスト上にスケジュールされたすべてのPodがノード全体に影響を与えないことを保証するものではありません。Podごとの制限は、ノードエージェント自体をPID枯渇から保護するものでもありません。 @@ -44,7 +44,7 @@ KubernetesはPodで実行するプロセス数を制限することができま Podが誤操作していたり、異常なリソースを消費している時にPodの終了を実行することをkubeletに設定できます。この機能はEvictionと呼ばれています。様々なEvictionシグナルのために[リソース不足への対処の設定](/docs/concepts/scheduling-eviction/node-pressure-eviction/)ができます。`pid.available`Evictionシグナルを使用して、Podによって使用されるPIDの数の閾値を設定します。ソフトとハードのEvictionポリシーを設定できます。しかし、ハードEvictionポリシーを使用しても、PIDの数が非常に速く増加している場合、ノードはPID制限に達することで不安定な状態になる可能性があります。Evictionシグナルの値は定期的に計算されますが、この値は制限を強制するものではありません。 -PID制限 - Pod毎、ノード毎にハード制限を設定できます。一度制限に達すると、ワークロードは新しいPIDを取得しようとする際に失敗し始めます。これがPodの再スケジューリングにつながるかどうかは、ワークロードがこれらの失敗にどのように反応するか、PodのLiveness ProbeとReadiness Probeがどのように設定されているかに依存します。しかし、リミットが正しく設定されていれば、あるPodが誤動作している場合でも、他のPodのワークロードやシステムプロセスがPIDを使い果たすことはないと保証することができます。 +PIDの制限、つまりPod毎、ノード毎にハード制限を設定できます。一度制限に達すると、ワークロードは新しいPIDを取得しようとする際に失敗し始めます。これがPodの再スケジューリングにつながるかどうかは、ワークロードがこれらの失敗にどのように反応するか、PodのLiveness ProbeとReadiness Probeがどのように設定されているかに依存します。しかし、リミットが正しく設定されていれば、あるPodが誤動作している場合でも、他のPodのワークロードやシステムプロセスがPIDを使い果たすことはないと保証することができます。 ## {{% heading "whatsnext" %}} From 4fe15508353e03e687177423fce944562e25ac31 Mon Sep 17 00:00:00 2001 From: jkskj Date: Mon, 19 Aug 2024 10:34:57 +0800 Subject: [PATCH 080/408] fix: wrong format in content\zh-cn\docs\tutorials\hello-minikube --- content/zh-cn/docs/tutorials/hello-minikube.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh-cn/docs/tutorials/hello-minikube.md b/content/zh-cn/docs/tutorials/hello-minikube.md index 8b25e2341f..b7e1b0feb4 100644 --- a/content/zh-cn/docs/tutorials/hello-minikube.md +++ b/content/zh-cn/docs/tutorials/hello-minikube.md @@ -568,7 +568,7 @@ This page covered the basic aspects to get a minikube cluster up and running. Yo * Learn more about [Deploying applications](/docs/tasks/run-application/run-stateless-application-deployment/). * Learn more about [Service objects](/docs/concepts/services-networking/service/). --> -* **[使用 kubectl 在 Kubernetes 上部署你的第一个应用程序](/zh-cn/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro/)**教程。 +* [使用 kubectl 在 Kubernetes 上部署你的第一个应用程序](/zh-cn/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro/)教程。 * 进一步了解 [Deployment 对象](/zh-cn/docs/concepts/workloads/controllers/deployment/)。 * 进一步了解[部署应用](/zh-cn/docs/tasks/run-application/run-stateless-application-deployment/)。 * 进一步了解 [Service 对象](/zh-cn/docs/concepts/services-networking/service/)。 From 73966675d889c920e07bb1e6d0b9364c57e41830 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Mon, 19 Aug 2024 09:54:02 +0800 Subject: [PATCH 081/408] [zh-cn] sync volume-attributes-classes.md install-kubectl-linux.md Signed-off-by: xin.li --- .../storage/volume-attributes-classes.md | 58 ++++++++++++------- .../docs/tasks/tools/install-kubectl-linux.md | 45 ++++++++++++-- 2 files changed, 79 insertions(+), 24 deletions(-) diff --git a/content/zh-cn/docs/concepts/storage/volume-attributes-classes.md b/content/zh-cn/docs/concepts/storage/volume-attributes-classes.md index 95a40189e8..d716fb2d1c 100644 --- a/content/zh-cn/docs/concepts/storage/volume-attributes-classes.md +++ b/content/zh-cn/docs/concepts/storage/volume-attributes-classes.md @@ -14,7 +14,7 @@ weight: 40 -{{< feature-state for_k8s_version="v1.29" state="alpha" >}} +{{< feature-state feature_gate_name="VolumeAttributesClass" >}} 卷属性类（VolumeAttributesClass）为管理员提供了一种描述可变更的存储“类”的方法。 不同的类可以映射到不同的服务质量级别。Kubernetes 本身不关注这些类代表什么。 -这是一个 Alpha 特性，默认被禁用。 +这是一个 Beta 特性，默认被禁用。 -如果你想测试这一处于 Alpha 阶段的特性，你需要为 kube-controller-manager 和 kube-apiserver 启用 +如果你想测试这一处于 Beta 阶段的特性，你需要为 kube-controller-manager 和 kube-apiserver 启用 `VolumeAttributesClass` [特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)。 你可以使用 `--feature-gates` 命令行参数： -``` +```shell --feature-gates="...,VolumeAttributesClass=true" ``` + +你还必须通过 `kube-apiserver` +[运行时配置](/zh-cn/docs/tasks/administer-cluster/enable-disable-api/)启用 +`storage.k8s.io/v1beta1` API 组： + +```shell +--runtime-config=storage.k8s.io/v1beta1=true +``` + ### 存储制备器 {#provisioner} @@ -107,7 +122,8 @@ The feature support for VolumeAttributesClass is implemented in [kubernetes-csi/ [kubernetes-csi/external-provisioner](https://github.com/kubernetes-csi/external-provisioner) 中实现。 ### 调整器 {#resizer} @@ -152,7 +170,7 @@ A new VolumeAttributesClass gold is available in the cluster: 集群中有一个新的名为 gold 的 VolumeAttributesClass： ```yaml -apiVersion: storage.k8s.io/v1alpha1 +apiVersion: storage.k8s.io/v1beta1 kind: VolumeAttributesClass metadata: name: gold @@ -183,10 +201,10 @@ spec: VolumeAttributeClasses have parameters that describe volumes belonging to them. Different parameters may be accepted depending on the provisioner or the resizer. For example, the value `4000`, for the parameter `iops`, -and the parameter `throughput` are specific to GCE PD. +and the parameter `throughput` are specific to GCE PD. When a parameter is omitted, the default is used at volume provisioning. -If a user apply the PVC with a different VolumeAttributesClass with omitted parameters, the default value of -the parameters may be used depends on the CSI driver implementation. +If a user applies the PVC with a different VolumeAttributesClass with omitted parameters, the default value of +the parameters may be used depending on the CSI driver implementation. Please refer to the related CSI driver documentation for more details. --> ## 参数 {#parameters} diff --git a/content/zh-cn/docs/tasks/tools/install-kubectl-linux.md b/content/zh-cn/docs/tasks/tools/install-kubectl-linux.md index ab8bc1920f..1655bf55fd 100644 --- a/content/zh-cn/docs/tasks/tools/install-kubectl-linux.md +++ b/content/zh-cn/docs/tasks/tools/install-kubectl-linux.md @@ -47,7 +47,7 @@ The following methods exist for installing kubectl on Linux: -### 用 curl 在 Linux 系统中安装 kubectl {#install-kubectl-binary-with-curl-on-linux} +### 用 curl 在 Linux 系统中安装 kubectl {#install-kubectl-binary-with-curl-on-linux} -3. 安装 kubectl +3. 安装 kubectl： ```bash sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl @@ -380,9 +380,46 @@ To upgrade kubectl to another minor release, you'll need to bump the version in {{< /note >}} -2. 使用 `zypper` 安装 kubectl： +2. 更新 zypper 并确认新的仓库已添加： + + ```bash + sudo zypper update + ``` + + + 出现此信息时，按 't' 或 'a''： + + ``` + New repository or package signing key received: + + Repository: Kubernetes + Key Fingerprint: 1111 2222 3333 4444 5555 6666 7777 8888 9999 AAAA + Key Name: isv:kubernetes OBS Project + Key Algorithm: RSA 2048 + Key Created: Thu 25 Aug 2022 01:21:11 PM -03 + Key Expires: Sat 02 Nov 2024 01:21:11 PM -03 (expires in 85 days) + Rpm Name: gpg-pubkey-9a296436-6307a177 + + Note: Signing data enables the recipient to verify that no modifications occurred after the data + were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system + and in extreme cases even to a system compromise. + + Note: A GPG pubkey is clearly identified by its fingerprint. Do not rely on the key's name. If + you are not sure whether the presented key is authentic, ask the repository provider or check + their web site. Many providers maintain a web page showing the fingerprints of the GPG keys they + are using. + + Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?] (r): a + ``` + + +3. 使用 `zypper` 安装 kubectl： ```bash sudo zypper install -y kubectl From d8053756240bd07defce4b17488f59d832bd1095 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Mon, 19 Aug 2024 09:38:06 +0800 Subject: [PATCH 082/408] [zh] Sync command-line-tools-reference/kube-proxy.md --- .../kube-proxy.md | 177 ++++++++---------- 1 file changed, 83 insertions(+), 94 deletions(-) diff --git a/content/zh-cn/docs/reference/command-line-tools-reference/kube-proxy.md b/content/zh-cn/docs/reference/command-line-tools-reference/kube-proxy.md index f368906fb5..8035ca6d1a 100644 --- a/content/zh-cn/docs/reference/command-line-tools-reference/kube-proxy.md +++ b/content/zh-cn/docs/reference/command-line-tools-reference/kube-proxy.md @@ -251,94 +251,87 @@ A set of key=value pairs that describe feature gates for alpha/experimental feat APIResponseCompression=true|false (BETA - default=true)
APIServerIdentity=true|false (BETA - default=true)
APIServerTracing=true|false (BETA - default=true)
-APIServingWithRoutine=true|false (BETA - default=true)
+APIServingWithRoutine=true|false (ALPHA - default=false)
AllAlpha=true|false (ALPHA - default=false)
AllBeta=true|false (BETA - default=false)
+AnonymousAuthConfigurableEndpoints=true|false (ALPHA - default=false)
AnyVolumeDataSource=true|false (BETA - default=true)
-AppArmor=true|false (BETA - default=true)
-AppArmorFields=true|false (BETA - default=true)
+AuthorizeNodeWithSelectors=true|false (ALPHA - default=false)
+AuthorizeWithSelectors=true|false (ALPHA - default=false)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
CPUManagerPolicyOptions=true|false (BETA - default=true)
CRDValidationRatcheting=true|false (BETA - default=true)
-CSIMigrationPortworx=true|false (BETA - default=false)
+CSIMigrationPortworx=true|false (BETA - default=true)
CSIVolumeHealth=true|false (ALPHA - default=false)
CloudControllerManagerWebhook=true|false (ALPHA - default=false)
ClusterTrustBundle=true|false (ALPHA - default=false)
ClusterTrustBundleProjection=true|false (ALPHA - default=false)
ComponentSLIs=true|false (BETA - default=true)
-ConsistentListFromCache=true|false (ALPHA - default=false)
+ConcurrentWatchObjectDecode=true|false (BETA - default=false)
+ConsistentListFromCache=true|false (BETA - default=true)
ContainerCheckpoint=true|false (BETA - default=true)
ContextualLogging=true|false (BETA - default=true)
+CoordinatedLeaderElection=true|false (ALPHA - default=false)
CronJobsScheduledAnnotation=true|false (BETA - default=true)
CrossNamespaceVolumeDataSource=true|false (ALPHA - default=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
-CustomResourceFieldSelectors=true|false (ALPHA - default=false)
-DevicePluginCDIDevices=true|false (BETA - default=true)
-DisableCloudProviders=true|false (BETA - default=true)
-DisableKubeletCloudCredentialProviders=true|false (BETA - default=true)
-DisableNodeKubeProxyVersion=true|false (ALPHA - default=false)
+CustomResourceFieldSelectors=true|false (BETA - default=true)
+DRAControlPlaneController=true|false (ALPHA - default=false)
+DisableAllocatorDualWrite=true|false (ALPHA - default=false)
+DisableNodeKubeProxyVersion=true|false (BETA - default=true)
DynamicResourceAllocation=true|false (ALPHA - default=false)
-ElasticIndexedJob=true|false (BETA - default=true)
EventedPLEG=true|false (ALPHA - default=false)
GracefulNodeShutdown=true|false (BETA - default=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - default=true)
HPAScaleToZero=true|false (ALPHA - default=false)
-HonorPVReclaimPolicy=true|false (ALPHA - default=false)
+HonorPVReclaimPolicy=true|false (BETA - default=true)
ImageMaximumGCAge=true|false (BETA - default=true)
+ImageVolume=true|false (ALPHA - default=false)
InPlacePodVerticalScaling=true|false (ALPHA - default=false)
-InTreePluginAWSUnregister=true|false (ALPHA - default=false)
-InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
-InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
-InTreePluginGCEUnregister=true|false (ALPHA - default=false)
-InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
-InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
InformerResourceVersion=true|false (ALPHA - default=false)
JobBackoffLimitPerIndex=true|false (BETA - default=true)
JobManagedBy=true|false (ALPHA - default=false)
-JobPodFailurePolicy=true|false (BETA - default=true)
JobPodReplacementPolicy=true|false (BETA - default=true)
-JobSuccessPolicy=true|false (ALPHA - default=false)
-KubeProxyDrainingTerminatingNodes=true|false (BETA - default=true)
-KubeletCgroupDriverFromCRI=true|false (ALPHA - default=false)
+JobSuccessPolicy=true|false (BETA - default=true)
+KubeletCgroupDriverFromCRI=true|false (BETA - default=true)
KubeletInUserNamespace=true|false (ALPHA - default=false)
KubeletPodResourcesDynamicResources=true|false (ALPHA - default=false)
KubeletPodResourcesGet=true|false (ALPHA - default=false)
-KubeletSeparateDiskGC=true|false (ALPHA - default=false)
+KubeletSeparateDiskGC=true|false (BETA - default=true)
KubeletTracing=true|false (BETA - default=true)
LoadBalancerIPMode=true|false (BETA - default=true)
-LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
-LogarithmicScaleDown=true|false (BETA - default=true)
+LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - default=false)
LoggingAlphaOptions=true|false (ALPHA - default=false)
LoggingBetaOptions=true|false (BETA - default=true)
-MatchLabelKeysInPodAffinity=true|false (ALPHA - default=false)
+MatchLabelKeysInPodAffinity=true|false (BETA - default=true)
MatchLabelKeysInPodTopologySpread=true|false (BETA - default=true)
MaxUnavailableStatefulSet=true|false (ALPHA - default=false)
MemoryManager=true|false (BETA - default=true)
MemoryQoS=true|false (ALPHA - default=false)
-MultiCIDRServiceAllocator=true|false (ALPHA - default=false)
+MultiCIDRServiceAllocator=true|false (BETA - default=false)
MutatingAdmissionPolicy=true|false (ALPHA - default=false)
-NFTablesProxyMode=true|false (ALPHA - default=false)
+NFTablesProxyMode=true|false (BETA - default=true)
NodeInclusionPolicyInPodTopologySpread=true|false (BETA - default=true)
NodeLogQuery=true|false (BETA - default=false)
NodeSwap=true|false (BETA - default=true)
OpenAPIEnums=true|false (BETA - default=true)
-PDBUnhealthyPodEvictionPolicy=true|false (BETA - default=true)
-PersistentVolumeLastPhaseTransitionTime=true|false (BETA - default=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
PodDeletionCost=true|false (BETA - default=true)
-PodDisruptionConditions=true|false (BETA - default=true)
PodIndexLabel=true|false (BETA - default=true)
PodLifecycleSleepAction=true|false (BETA - default=true)
PodReadyToStartContainersCondition=true|false (BETA - default=true)
-PortForwardWebsockets=true|false (ALPHA - default=false)
-ProcMountType=true|false (ALPHA - default=false)
+PortForwardWebsockets=true|false (BETA - default=true)
+ProcMountType=true|false (BETA - default=false)
QOSReserved=true|false (ALPHA - default=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
-RecursiveReadOnlyMounts=true|false (ALPHA - default=false)
+RecursiveReadOnlyMounts=true|false (BETA - default=true)
RelaxedEnvironmentVariableValidation=true|false (ALPHA - default=false)
-RetryGenerateName=true|false (ALPHA - default=false)
+ReloadKubeletServerCertificateFile=true|false (BETA - default=true)
+ResilientWatchCacheInitialization=true|false (BETA - default=true)
+ResourceHealthStatus=true|false (ALPHA - default=false)
+RetryGenerateName=true|false (BETA - default=true)
RotateKubeletServerCertificate=true|false (BETA - default=true)
RuntimeClassInImageCriApi=true|false (ALPHA - default=false)
SELinuxMount=true|false (ALPHA - default=false)
@@ -347,20 +340,22 @@ SchedulerQueueingHints=true|false (BETA - default=false)
SeparateCacheWatchRPC=true|false (BETA - default=true)
SeparateTaintEvictionController=true|false (BETA - default=true)
ServiceAccountTokenJTI=true|false (BETA - default=true)
-ServiceAccountTokenNodeBinding=true|false (ALPHA - default=false)
+ServiceAccountTokenNodeBinding=true|false (BETA - default=true)
ServiceAccountTokenNodeBindingValidation=true|false (BETA - default=true)
ServiceAccountTokenPodNodeInfo=true|false (BETA - default=true)
-ServiceTrafficDistribution=true|false (ALPHA - default=false)
+ServiceTrafficDistribution=true|false (BETA - default=true)
SidecarContainers=true|false (BETA - default=true)
SizeMemoryBackedVolumes=true|false (BETA - default=true)
StatefulSetAutoDeletePVC=true|false (BETA - default=true)
-StatefulSetStartOrdinal=true|false (BETA - default=true)
StorageNamespaceIndex=true|false (BETA - default=true)
StorageVersionAPI=true|false (ALPHA - default=false)
StorageVersionHash=true|false (BETA - default=true)
StorageVersionMigrator=true|false (ALPHA - default=false)
+StrictCostEnforcementForVAP=true|false (BETA - default=false)
+StrictCostEnforcementForWebhooks=true|false (BETA - default=false)
StructuredAuthenticationConfiguration=true|false (BETA - default=true)
StructuredAuthorizationConfiguration=true|false (BETA - default=true)
+SupplementalGroupsPolicy=true|false (ALPHA - default=false)
TopologyAwareHints=true|false (BETA - default=true)
TopologyManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
TopologyManagerPolicyBetaOptions=true|false (BETA - default=true)
@@ -370,8 +365,9 @@ UnauthenticatedHTTP2DOSMitigation=true|false (BETA - default=true)
UnknownVersionInteroperabilityProxy=true|false (ALPHA - default=false)
UserNamespacesPodSecurityStandards=true|false (ALPHA - default=false)
UserNamespacesSupport=true|false (BETA - default=false)
-VolumeAttributesClass=true|false (ALPHA - default=false)
+VolumeAttributesClass=true|false (BETA - default=false)
VolumeCapacityPriority=true|false (ALPHA - default=false)
+WatchCacheInitializationPostStartHook=true|false (BETA - default=false)
WatchFromStorageWithoutResourceVersion=true|false (BETA - default=false)
WatchList=true|false (ALPHA - default=false)
WatchListClient=true|false (BETA - default=false)
@@ -384,95 +380,87 @@ This parameter is ignored if a config file is specified by --config. APIResponseCompression=true|false (BETA - 默认值=true)
APIServerIdentity=true|false (BETA - 默认值=true)
APIServerTracing=true|false (BETA - 默认值=true)
-APIServingWithRoutine=true|false (BETA - 默认值=true)
+APIServingWithRoutine=true|false (ALPHA - 默认值=false)
AllAlpha=true|false (ALPHA - 默认值=false)
AllBeta=true|false (BETA - 默认值=false)
+AnonymousAuthConfigurableEndpoints=true|false (ALPHA - 默认值=false)
AnyVolumeDataSource=true|false (BETA - 默认值=true)
-AppArmor=true|false (BETA - 默认值=true)
-AppArmorFields=true|false (BETA - 默认值=true)
+AuthorizeNodeWithSelectors=true|false (ALPHA - 默认值=false)
+AuthorizeWithSelectors=true|false (ALPHA - 默认值=false)
CPUManagerPolicyAlphaOptions=true|false (ALPHA - 默认值=false)
CPUManagerPolicyBetaOptions=true|false (BETA - 默认值=true)
CPUManagerPolicyOptions=true|false (BETA - 默认值=true)
CRDValidationRatcheting=true|false (BETA - 默认值=true)
-CSIMigrationPortworx=true|false (BETA - 默认值=false)
+CSIMigrationPortworx=true|false (BETA - 默认值=true)
CSIVolumeHealth=true|false (ALPHA - 默认值=false)
CloudControllerManagerWebhook=true|false (ALPHA - 默认值=false)
ClusterTrustBundle=true|false (ALPHA - 默认值=false)
ClusterTrustBundleProjection=true|false (ALPHA - 默认值=false)
ComponentSLIs=true|false (BETA - 默认值=true)
-ConsistentListFromCache=true|false (ALPHA - 默认值=false)
+ConcurrentWatchObjectDecode=true|false (BETA - 默认值=false)
+ConsistentListFromCache=true|false (BETA - 默认值=true)
ContainerCheckpoint=true|false (BETA - 默认值=true)
ContextualLogging=true|false (BETA - 默认值=true)
+CoordinatedLeaderElection=true|false (ALPHA - 默认值=false)
CronJobsScheduledAnnotation=true|false (BETA - 默认值=true)
CrossNamespaceVolumeDataSource=true|false (ALPHA - 默认值=false)
CustomCPUCFSQuotaPeriod=true|false (ALPHA - 默认值=false)
-CustomResourceFieldSelectors=true|false (ALPHA - 默认值=false)
-DevicePluginCDIDevices=true|false (BETA - 默认值=true)
-DisableCloudProviders=true|false (BETA - 默认值=true)
-DisableKubeletCloudCredentialProviders=true|false (BETA - 默认值=true)
-DisableNodeKubeProxyVersion=true|false (ALPHA - 默认值=false)
+CustomResourceFieldSelectors=true|false (BETA - 默认值=true)
+DRAControlPlaneController=true|false (ALPHA - 默认值=false)
+DisableAllocatorDualWrite=true|false (ALPHA - 默认值=false)
+DisableNodeKubeProxyVersion=true|false (BETA - 默认值=true)
DynamicResourceAllocation=true|false (ALPHA - 默认值=false)
-ElasticIndexedJob=true|false (BETA - 默认值=true)
EventedPLEG=true|false (ALPHA - 默认值=false)
GracefulNodeShutdown=true|false (BETA - 默认值=true)
GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - 默认值=true)
HPAScaleToZero=true|false (ALPHA - 默认值=false)
-HonorPVReclaimPolicy=true|false (ALPHA - 默认值=false)
+HonorPVReclaimPolicy=true|false (BETA - 默认值=true)
ImageMaximumGCAge=true|false (BETA - 默认值=true)
+ImageVolume=true|false (ALPHA - 默认值=false)
InPlacePodVerticalScaling=true|false (ALPHA - 默认值=false)
-InTreePluginAWSUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginAzureDiskUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginAzureFileUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginGCEUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginOpenStackUnregister=true|false (ALPHA - 默认值=false)
InTreePluginPortworxUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginvSphereUnregister=true|false (ALPHA - 默认值=false)
InformerResourceVersion=true|false (ALPHA - 默认值=false)
JobBackoffLimitPerIndex=true|false (BETA - 默认值=true)
JobManagedBy=true|false (ALPHA - 默认值=false)
-JobPodFailurePolicy=true|false (BETA - 默认值=true)
JobPodReplacementPolicy=true|false (BETA - 默认值=true)
-JobSuccessPolicy=true|false (ALPHA - 默认值=false)
-KubeProxyDrainingTerminatingNodes=true|false (BETA - 默认值=true)
-KubeProxyDrainingTerminatingNodes=true|false (ALPHA - 默认值=false)
-KubeletCgroupDriverFromCRI=true|false (ALPHA - 默认值=false)
+JobSuccessPolicy=true|false (BETA - 默认值=true)
+KubeletCgroupDriverFromCRI=true|false (BETA - 默认值=true)
KubeletInUserNamespace=true|false (ALPHA - 默认值=false)
KubeletPodResourcesDynamicResources=true|false (ALPHA - 默认值=false)
KubeletPodResourcesGet=true|false (ALPHA - 默认值=false)
-KubeletSeparateDiskGC=true|false (ALPHA - 默认值=false)
+KubeletSeparateDiskGC=true|false (BETA - 默认值=true)
KubeletTracing=true|false (BETA - 默认值=true)
LoadBalancerIPMode=true|false (BETA - 默认值=true)
-LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - 默认值=false)
-LogarithmicScaleDown=true|false (BETA - 默认值=true)
+LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - 默认值=false)
LoggingAlphaOptions=true|false (ALPHA - 默认值=false)
LoggingBetaOptions=true|false (BETA - 默认值=true)
-MatchLabelKeysInPodAffinity=true|false (ALPHA - 默认值=false)
+MatchLabelKeysInPodAffinity=true|false (BETA - 默认值=true)
MatchLabelKeysInPodTopologySpread=true|false (BETA - 默认值=true)
MaxUnavailableStatefulSet=true|false (ALPHA - 默认值=false)
MemoryManager=true|false (BETA - 默认值=true)
MemoryQoS=true|false (ALPHA - 默认值=false)
+MultiCIDRServiceAllocator=true|false (BETA - 默认值=false)
MutatingAdmissionPolicy=true|false (ALPHA - 默认值=false)
-MultiCIDRServiceAllocator=true|false (ALPHA - 默认值=false)
-NFTablesProxyMode=true|false (ALPHA - 默认值=false)
+NFTablesProxyMode=true|false (BETA - 默认值=true)
NodeInclusionPolicyInPodTopologySpread=true|false (BETA - 默认值=true)
NodeLogQuery=true|false (BETA - 默认值=false)
NodeSwap=true|false (BETA - 默认值=true)
OpenAPIEnums=true|false (BETA - 默认值=true)
-PDBUnhealthyPodEvictionPolicy=true|false (BETA - 默认值=true)
-PersistentVolumeLastPhaseTransitionTime=true|false (BETA - 默认值=true)
PodAndContainerStatsFromCRI=true|false (ALPHA - 默认值=false)
PodDeletionCost=true|false (BETA - 默认值=true)
-PodDisruptionConditions=true|false (BETA - 默认值=true)
PodIndexLabel=true|false (BETA - 默认值=true)
PodLifecycleSleepAction=true|false (BETA - 默认值=true)
PodReadyToStartContainersCondition=true|false (BETA - 默认值=true)
-PortForwardWebsockets=true|false (ALPHA - 默认值=false)
-ProcMountType=true|false (ALPHA - 默认值=false)
+PortForwardWebsockets=true|false (BETA - 默认值=true)
+ProcMountType=true|false (BETA - 默认值=false)
QOSReserved=true|false (ALPHA - 默认值=false)
RecoverVolumeExpansionFailure=true|false (ALPHA - 默认值=false)
-RecursiveReadOnlyMounts=true|false (ALPHA - 默认值=false)
+RecursiveReadOnlyMounts=true|false (BETA - 默认值=true)
RelaxedEnvironmentVariableValidation=true|false (ALPHA - 默认值=false)
-RetryGenerateName=true|false (ALPHA - 默认值=false)
+ReloadKubeletServerCertificateFile=true|false (BETA - 默认值=true)
+ResilientWatchCacheInitialization=true|false (BETA - 默认值=true)
+ResourceHealthStatus=true|false (ALPHA - 默认值=false)
+RetryGenerateName=true|false (BETA - 默认值=true)
RotateKubeletServerCertificate=true|false (BETA - 默认值=true)
RuntimeClassInImageCriApi=true|false (ALPHA - 默认值=false)
SELinuxMount=true|false (ALPHA - 默认值=false)
@@ -481,20 +469,22 @@ SchedulerQueueingHints=true|false (BETA - 默认值=false)
SeparateCacheWatchRPC=true|false (BETA - 默认值=true)
SeparateTaintEvictionController=true|false (BETA - 默认值=true)
ServiceAccountTokenJTI=true|false (BETA - 默认值=true)
-ServiceAccountTokenNodeBinding=true|false (ALPHA - 默认值=false)
+ServiceAccountTokenNodeBinding=true|false (BETA - 默认值=true)
ServiceAccountTokenNodeBindingValidation=true|false (BETA - 默认值=true)
ServiceAccountTokenPodNodeInfo=true|false (BETA - 默认值=true)
-ServiceTrafficDistribution=true|false (ALPHA - 默认值=false)
+ServiceTrafficDistribution=true|false (BETA - 默认值=true)
SidecarContainers=true|false (BETA - 默认值=true)
SizeMemoryBackedVolumes=true|false (BETA - 默认值=true)
StatefulSetAutoDeletePVC=true|false (BETA - 默认值=true)
-StatefulSetStartOrdinal=true|false (BETA - 默认值=true)
StorageNamespaceIndex=true|false (BETA - 默认值=true)
StorageVersionAPI=true|false (ALPHA - 默认值=false)
StorageVersionHash=true|false (BETA - 默认值=true)
StorageVersionMigrator=true|false (ALPHA - 默认值=false)
+StrictCostEnforcementForVAP=true|false (BETA - 默认值=false)
+StrictCostEnforcementForWebhooks=true|false (BETA - 默认值=false)
StructuredAuthenticationConfiguration=true|false (BETA - 默认值=true)
StructuredAuthorizationConfiguration=true|false (BETA - 默认值=true)
+SupplementalGroupsPolicy=true|false (ALPHA - 默认值=false)
TopologyAwareHints=true|false (BETA - 默认值=true)
TopologyManagerPolicyAlphaOptions=true|false (ALPHA - 默认值=false)
TopologyManagerPolicyBetaOptions=true|false (BETA - 默认值=true)
@@ -504,9 +494,9 @@ UnauthenticatedHTTP2DOSMitigation=true|false (BETA - 默认值=true)
UnknownVersionInteroperabilityProxy=true|false (ALPHA - 默认值=false)
UserNamespacesPodSecurityStandards=true|false (ALPHA - 默认值=false)
UserNamespacesSupport=true|false (BETA - 默认值=false)
-ValidatingAdmissionPolicy=true|false (BETA - 默认值=false)
-VolumeAttributesClass=true|false (ALPHA - 默认值=false)
+VolumeAttributesClass=true|false (BETA - 默认值=false)
VolumeCapacityPriority=true|false (ALPHA - 默认值=false)
+WatchCacheInitializationPostStartHook=true|false (BETA - 默认值=false)
WatchFromStorageWithoutResourceVersion=true|false (BETA - 默认值=false)
WatchList=true|false (ALPHA - 默认值=false)
WatchListClient=true|false (BETA - 默认值=false)
@@ -519,17 +509,15 @@ WindowsHostNetwork=true|false (ALPHA - 默认值=true)
---healthz-bind-address 0.0.0.0     默认值：0.0.0.0:10256 +--healthz-bind-address ipport     默认值：0.0.0.0:10256

-服务健康状态检查的 IP 地址和端口。 -如果 --bind-address 未设置或设置为 IPv4，则默认为 “0.0.0.0:10256”。 -如果 --bind-address 设置为 IPv6，则默认为 “[::]:10256”。 -设置为空则禁用。如果配置文件由 --config 指定，则忽略此参数。 +服务健康状态检查的 IP 地址和端口，默认为 “0.0.0.0:10256”。 +如果配置文件由 --config 指定，则忽略此参数。

@@ -646,7 +634,7 @@ A comma-separated list of CIDR's which the ipvs proxier should not touch when cl ---ipvs-min-sync-period duration +--ipvs-min-sync-period duration     默认值：1s

@@ -925,9 +913,10 @@ log to standard error instead of files

-如果使用 iptables 或 ipvs 代理模式，则对通过 Service 集群 IP 发送的所有流量进行 SNAT。 -这对某些 CNI 插件可能是必需的。 +对通过 Service 集群 IP 发送的所有流量进行 SNAT。 +这对某些 CNI 插件可能是必需的。仅支持 Linux。

@@ -951,11 +940,10 @@ Kubernetes API 服务器的地址（覆盖 kubeconfig 中的相关值）。

metrics 服务器要使用的 IP 地址和端口。 如果 --bind-address 未设置或设置为 IPv4，则默认为 "127.0.0.1:10249"。 -如果 --bind-address 设置为 IPv6，则默认为 "[::1]:10249"。 设置为 "0.0.0.0:10249" / "[::]:10249" 可以在所有接口上进行绑定。 设置为空则禁用。如果配置文件由 --config 指定，则忽略此参数。

@@ -968,10 +956,11 @@ metrics 服务器要使用的 IP 地址和端口。

-一个包含有效节点 IP 的 CIDR 范围列表。 -如果设置了，到 NodePort 服务的连接只会在节点 IP 在指定范围内时才会被接受。 +一个包含有效节点 IP 的 CIDR 范围列表，或者单个字符串 “primary”。 +如果设置为 CIDR 列表，则仅在某所给范围内的节点 IP 上接受对 NodePort 服务的连接。 +如果设置为 “primary”，则将根据 Node 对象仅在其主 IP 上接受对 NodePort 服务的连接。 如果不设置，则 NodePort 连接将在所有本地 IP 上被接受。 如果配置文件由 --config 指定，则忽略此参数。

From a8d31cbce9e3dd6b6ac6acd729db2ebd24d66b4b Mon Sep 17 00:00:00 2001 From: windsonsea Date: Mon, 19 Aug 2024 09:12:39 +0800 Subject: [PATCH 083/408] [zh] Sync command-line-tools-reference/kube-apiserver.md --- .../kube-apiserver.md | 618 +++++++++--------- 1 file changed, 322 insertions(+), 296 deletions(-) diff --git a/content/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver.md b/content/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver.md index 24fd7ffa88..6dcf105774 100644 --- a/content/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver.md +++ b/content/zh-cn/docs/reference/command-line-tools-reference/kube-apiserver.md @@ -571,11 +571,13 @@ API group and version used for serializing audit events written to webhook.

-用于配置 JWT 令牌验证器的身份验证配置文件。注意：此特性自 v1.29 起处于 Alpha 阶段。 +用于配置 JWT 令牌身份认证模块或匿名身份认证模块的身份认证配置文件。注意：此特性自 v1.29 起处于 Alpha 阶段。 需要设置 --feature-gate=StructuredAuthenticationConfiguration=true 才能启用此特性。 -此特性与 oidc-* 标志互斥。 +此特性与 oidc-* 标志互斥。要配置匿名身份认证模块， +你需要启用 --feature-gate=AnonymousAuthConfigurableEndpoints。 +如果在身份认证配置文件中配置了匿名身份认证模块，就不能使用 --anonymous-auth 标志。

@@ -587,7 +589,7 @@ File with Authentication Configuration to configure the JWT Token authenticator. -对来自 Webhook 令牌身份验证器的响应的缓存时间。 +对来自 Webhook 令牌身份认证模块的响应的缓存时间。 @@ -601,7 +603,7 @@ File with webhook configuration for token authentication in kubeconfig format. The API server will query the remote service to determine authentication for bearer tokens. --> 包含 Webhook 配置的 kubeconfig 格式文件，用于进行令牌认证。 -API 服务器将查询远程服务，以对持有者令牌进行身份验证。 +API 服务器将查询远程服务，以对持有者令牌进行身份认证。 @@ -750,19 +752,7 @@ in the client-ca-file is authenticated with an identity corresponding to the Com of the client certificate. --> 如果已设置，则使用与客户端证书的 CommonName 对应的标识对任何出示由 -client-ca 文件中的授权机构之一签名的客户端证书的请求进行身份验证。 - - - - ---cloud-provider-gce-l7lb-src-cidrs cidrs     默认值："130.211.0.0/22,35.191.0.0/16" - - - - -在 GCE 防火墙中打开 CIDR，以进行第 7 层负载均衡流量代理和健康状况检查。 +client-ca 文件中的授权机构之一签名的客户端证书的请求进行身份认证。 @@ -870,10 +860,11 @@ CertificateApproval, CertificateSigning, CertificateSubjectRestriction, ClusterT DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceExternalIPs, EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, -NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, PersistentVolumeLabel, -PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, -ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, -ValidatingAdmissionWebhook. The order of plugins in this flag does not matter. +NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, +PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, +RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, +ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. +The order of plugins in this flag does not matter. -->

尽管位于默认启用的插件列表中，仍须被禁用的准入插件（NamespaceLifecycle、LimitRanger、 @@ -887,14 +878,26 @@ CertificateSigning、CertificateSubjectRestriction、ClusterTrustBundleAttest、 DefaultIngressClass、DefaultStorageClass、DefaultTolerationSeconds、DenyServiceExternalIPs、 EventRateLimit、ExtendedResourceToleration、ImagePolicyWebhook、LimitPodHardAntiAffinityTopology、 LimitRanger、MutatingAdmissionWebhook、NamespaceAutoProvision、NamespaceExists、NamespaceLifecycle、 -NodeRestriction、OwnerReferencesPermissionEnforcement、PersistentVolumeClaimResize、PersistentVolumeLabel、 -PodNodeSelector、PodSecurity、PodTolerationRestriction、Priority、ResourceQuota、RuntimeClass、 -ServiceAccount、StorageObjectInUseProtection、TaintNodesByCondition、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook。 +NodeRestriction、OwnerReferencesPermissionEnforcement、PersistentVolumeClaimResize、 +PodNodeSelector、PodSecurity、PodTolerationRestriction、Priority、ResourceQuota、RuntimeClass、ServiceAccount、 +StorageObjectInUseProtection、TaintNodesByCondition、ValidatingAdmissionPolicy、ValidatingAdmissionWebhook。 该标志中插件的顺序无关紧要。

+ +--disable-http2-serving + + +

+ +如果为 true，HTTP2 服务将被禁用 [默认值=false] +

+ + --disabled-metrics strings @@ -922,9 +925,23 @@ File with apiserver egress selector configuration. ---enable-admission-plugins strings +--emulated-version strings + + +

+ +不同组件所模拟的能力（API、特性等）的版本。
+如果设置了该选项，组件将模拟此版本的行为，而不是下层可执行文件版本的行为。
+版本格式只能是 major.minor，例如 “--emulated-version=wardle=1.2,kube=1.31”。 +选项包括：
kube=1.31..1.31（默认值=1.31）。如果组件未被指定，默认为 “kube”。 +

+ +--enable-admission-plugins strings + @@ -942,7 +959,7 @@ DefaultIngressClass, DefaultStorageClass, DefaultTolerationSeconds, DenyServiceE EventRateLimit, ExtendedResourceToleration, ImagePolicyWebhook, LimitPodHardAntiAffinityTopology, LimitRanger, MutatingAdmissionWebhook, NamespaceAutoProvision, NamespaceExists, NamespaceLifecycle, NodeRestriction, OwnerReferencesPermissionEnforcement, PersistentVolumeClaimResize, -PersistentVolumeLabel, PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, +PodNodeSelector, PodSecurity, PodTolerationRestriction, Priority, ResourceQuota, RuntimeClass, ServiceAccount, StorageObjectInUseProtection, TaintNodesByCondition, ValidatingAdmissionPolicy, ValidatingAdmissionWebhook. The order of plugins in this flag does not matter. @@ -959,7 +976,7 @@ DefaultStorageClass、DefaultTolerationSeconds、DenyServiceExternalIPs、EventR ExtendedResourceToleration、ImagePolicyWebhook、LimitPodHardAntiAffinityTopology、LimitRanger、 MutatingAdmissionWebhook、NamespaceAutoProvision、NamespaceExists、NamespaceLifecycle、 NodeRestriction、OwnerReferencesPermissionEnforcement、PersistentVolumeClaimResize、 -PersistentVolumeLabel、PodNodeSelector、PodSecurity、PodTolerationRestriction、Priority、 +PodNodeSelector、PodSecurity、PodTolerationRestriction、Priority、 ResourceQuota、RuntimeClass、ServiceAccount、StorageObjectInUseProtection、TaintNodesByCondition、 ValidatingAdmissionPolicy、ValidatingAdmissionWebhook。该标志中插件的顺序无关紧要。

@@ -988,7 +1005,7 @@ Enable to allow secrets of type 'bootstrap.kubernetes.io/token' in the 'kube-sys namespace to be used for TLS bootstrapping authentication. --> 启用以允许将 "kube-system" 名字空间中类型为 "bootstrap.kubernetes.io/token" -的 Secret 用于 TLS 引导身份验证。 +的 Secret 用于 TLS 引导身份认证。 @@ -1237,274 +1254,271 @@ comma-separated 'key=True|False' pairs - - -

+--feature-gates colonSeparatedMultimapStringString + + +

-一组 key=value 对，用来描述测试性/试验性功能的特性门控。可选项有：
-APIResponseCompression=true|false (BETA - 默认值=true)
-APIServerIdentity=true|false (BETA - 默认值=true)
-APIServerTracing=true|false (BETA - 默认值=true)
-APIServingWithRoutine=true|false (BETA - 默认值=true)
-AllAlpha=true|false (ALPHA - 默认值=false)
-AllBeta=true|false (BETA - 默认值=false)
-AnyVolumeDataSource=true|false (BETA - 默认值=true)
-AppArmor=true|false (BETA - 默认值=true)
-AppArmorFields=true|false (BETA - 默认值=true)
-CPUManagerPolicyAlphaOptions=true|false (ALPHA - 默认值=false)
-CPUManagerPolicyBetaOptions=true|false (BETA - 默认值=true)
-CPUManagerPolicyOptions=true|false (BETA - 默认值=true)
-CRDValidationRatcheting=true|false (BETA - 默认值=true)
-CSIMigrationPortworx=true|false (BETA - 默认值=false)
-CSIVolumeHealth=true|false (ALPHA - 默认值=false)
-CloudControllerManagerWebhook=true|false (ALPHA - 默认值=false)
-ClusterTrustBundle=true|false (ALPHA - 默认值=false)
-ClusterTrustBundleProjection=true|false (ALPHA - 默认值=false)
-ComponentSLIs=true|false (BETA - 默认值=true)
-ConsistentListFromCache=true|false (ALPHA - 默认值=false)
-ContainerCheckpoint=true|false (BETA - 默认值=true)
-ContextualLogging=true|false (BETA - 默认值=true)
-CronJobsScheduledAnnotation=true|false (BETA - 默认值=true)
-CrossNamespaceVolumeDataSource=true|false (ALPHA - 默认值=false)
-CustomCPUCFSQuotaPeriod=true|false (ALPHA - 默认值=false)
-CustomResourceFieldSelectors=true|false (ALPHA - 默认值=false)
-DevicePluginCDIDevices=true|false (BETA - 默认值=true)
-DisableCloudProviders=true|false (BETA - 默认值=true)
-DisableKubeletCloudCredentialProviders=true|false (BETA - 默认值=true)
-DisableNodeKubeProxyVersion=true|false (ALPHA - 默认值=false)
-DynamicResourceAllocation=true|false (ALPHA - 默认值=false)
-ElasticIndexedJob=true|false (BETA - 默认值=true)
-EventedPLEG=true|false (ALPHA - 默认值=false)
-GracefulNodeShutdown=true|false (BETA - 默认值=true)
-GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - 默认值=true)
-HPAScaleToZero=true|false (ALPHA - 默认值=false)
-HonorPVReclaimPolicy=true|false (ALPHA - 默认值=false)
-ImageMaximumGCAge=true|false (BETA - 默认值=true)
-InPlacePodVerticalScaling=true|false (ALPHA - 默认值=false)
-InTreePluginAWSUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginAzureDiskUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginAzureFileUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginGCEUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginOpenStackUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginPortworxUnregister=true|false (ALPHA - 默认值=false)
-InTreePluginvSphereUnregister=true|false (ALPHA - 默认值=false)
-InformerResourceVersion=true|false (ALPHA - 默认值=false)
-JobBackoffLimitPerIndex=true|false (BETA - 默认值=true)
-JobPodFailurePolicy=true|false (BETA - 默认值=true)
-JobManagedBy=true|false (ALPHA - 默认值=false)
-JobPodReplacementPolicy=true|false (BETA - 默认值=true)
-JobSuccessPolicy=true|false (ALPHA - 默认值=false)
-KubeProxyDrainingTerminatingNodes=true|false (BETA - 默认值=true)
-KubeletCgroupDriverFromCRI=true|false (ALPHA - 默认值=false)
-KubeletInUserNamespace=true|false (ALPHA - 默认值=false)
-KubeletPodResourcesDynamicResources=true|false (ALPHA - 默认值=false)
-KubeletPodResourcesGet=true|false (ALPHA - 默认值=false)
-KubeletSeparateDiskGC=true|false (ALPHA - 默认值=false)
-KubeletTracing=true|false (BETA - 默认值=true)
-LoadBalancerIPMode=true|false (BETA - 默认值=true)
-LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - 默认值=false)
-LogarithmicScaleDown=true|false (BETA - 默认值=true)
-LoggingAlphaOptions=true|false (ALPHA - 默认值=false)
-LoggingBetaOptions=true|false (BETA - 默认值=true)
-MatchLabelKeysInPodAffinity=true|false (ALPHA - 默认值=false)
-MatchLabelKeysInPodTopologySpread=true|false (BETA - 默认值=true)
-MaxUnavailableStatefulSet=true|false (ALPHA - 默认值=false)
-MemoryManager=true|false (BETA - 默认值=true)
-MemoryQoS=true|false (ALPHA - 默认值=false)
-MultiCIDRServiceAllocator=true|false (ALPHA - 默认值=false)
-MutatingAdmissionPolicy=true|false (ALPHA - 默认值=false)
-NFTablesProxyMode=true|false (ALPHA - 默认值=false)
-NodeInclusionPolicyInPodTopologySpread=true|false (BETA - 默认值=true)
-NodeLogQuery=true|false (BETA - 默认值=false)
-NodeSwap=true|false (BETA - 默认值=true)
-OpenAPIEnums=true|false (BETA - 默认值=true)
-PDBUnhealthyPodEvictionPolicy=true|false (BETA - 默认值=true)
-PersistentVolumeLastPhaseTransitionTime=true|false (BETA - 默认值=true)
-PodAndContainerStatsFromCRI=true|false (ALPHA - 默认值=false)
-PodDeletionCost=true|false (BETA - 默认值=true)
-PodDisruptionConditions=true|false (BETA - 默认值=true)
-PodIndexLabel=true|false (BETA - 默认值=true)
-PodLifecycleSleepAction=true|false (BETA - 默认值=true)
-PodReadyToStartContainersCondition=true|false (BETA - 默认值=true)
-PortForwardWebsockets=true|false (ALPHA - 默认值=false)
-ProcMountType=true|false (ALPHA - 默认值=false)
-QOSReserved=true|false (ALPHA - 默认值=false)
-RecoverVolumeExpansionFailure=true|false (ALPHA - 默认值=false)
-RecursiveReadOnlyMounts=true|false (ALPHA - 默认值=false)
-RelaxedEnvironmentVariableValidation=true|false (ALPHA - 默认值=false)
-RetryGenerateName=true|false (ALPHA - 默认值=false)
-RotateKubeletServerCertificate=true|false (BETA - 默认值=true)
-RuntimeClassInImageCriApi=true|false (ALPHA - 默认值=false)
-SELinuxMount=true|false (ALPHA - 默认值=false)
-SELinuxMountReadWriteOncePod=true|false (BETA - 默认值=true)
-SchedulerQueueingHints=true|false (BETA - 默认值=false)
-SeparateCacheWatchRPC=true|false (BETA - 默认值=true)
-SeparateTaintEvictionController=true|false (BETA - 默认值=true)
-ServiceAccountTokenJTI=true|false (BETA - 默认值=true)
-ServiceAccountTokenNodeBinding=true|false (ALPHA - 默认值=false)
-ServiceAccountTokenNodeBindingValidation=true|false (BETA - 默认值=true)
-ServiceAccountTokenPodNodeInfo=true|false (BETA - 默认值=true)
-ServiceTrafficDistribution=true|false (ALPHA - 默认值=false)
-SizeMemoryBackedVolumes=true|false (BETA - 默认值=true)
-StatefulSetAutoDeletePVC=true|false (BETA - 默认值=true)
-StatefulSetStartOrdinal=true|false (BETA - 默认值=true)
-StorageNamespaceIndex=true|false (BETA - 默认值=true)
-StorageVersionAPI=true|false (ALPHA - 默认值=false)
-StorageVersionMigrator=true|false (ALPHA - 默认值=false)
-StructuredAuthenticationConfiguration=true|false (BETA - 默认值=true)
-StructuredAuthorizationConfiguration=true|false (BETA - 默认值=true)
-TopologyAwareHints=true|false (BETA - 默认值=true)
-TopologyManagerPolicyAlphaOptions=true|false (ALPHA - 默认值=false)
-TopologyManagerPolicyBetaOptions=true|false (BETA - 默认值=true)
-TopologyManagerPolicyOptions=true|false (BETA - 默认值=true)
-TranslateStreamCloseWebsocketRequests=true|false (BETA - 默认值=true)
-UnauthenticatedHTTP2DOSMitigation=true|false (BETA - 默认值=true)
-UnknownVersionInteroperabilityProxy=true|false (ALPHA - 默认值=false)
-UserNamespacesSupport=true|false (BETA - 默认值=false)
-UserNamespacesSupport=true|false (ALPHA - 默认值=false)
-ValidatingAdmissionPolicy=true|false (BETA - 默认值=false)
-VolumeAttributesClass=true|false (ALPHA - 默认值=false)
-VolumeCapacityPriority=true|false (ALPHA - 默认值=false)
-WatchFromStorageWithoutResourceVersion=true|false (BETA - 默认值=false)
-WatchList=true|false (ALPHA - 默认值=false)
-WatchListClient=true|false (BETA - 默认值=false)
-WinDSR=true|false (ALPHA - 默认值=false)
-WinOverlay=true|false (BETA - 默认值=true)
-WindowsHostNetwork=true|false (ALPHA - 默认值=true) -

- +逗号分隔的组件列表，这些 key=value 对用来描述不同组件测试性/试验性特性的特性门控。
+如果组件未被指定，默认值为“kube”。此标志可以被重复调用。例如： +--feature-gates 'wardle:featureA=true,wardle:featureB=false' --feature-gates 'kube:featureC=true' +可选项为：
+kube:APIResponseCompression=true|false (BETA - 默认值=true)
+kube:APIServerIdentity=true|false (BETA - 默认值=true)
+kube:APIServerTracing=true|false (BETA - 默认值=true)
+kube:APIServingWithRoutine=true|false (ALPHA - 默认值=false)
+kube:AllAlpha=true|false (ALPHA - 默认值=false)
+kube:AllBeta=true|false (BETA - 默认值=false)
+kube:AnonymousAuthConfigurableEndpoints=true|false (ALPHA - 默认值=false)
+kube:AnyVolumeDataSource=true|false (BETA - 默认值=true)
+kube:AuthorizeNodeWithSelectors=true|false (ALPHA - 默认值=false)
+kube:AuthorizeWithSelectors=true|false (ALPHA - 默认值=false)
+kube:CPUManagerPolicyAlphaOptions=true|false (ALPHA - 默认值=false)
+kube:CPUManagerPolicyBetaOptions=true|false (BETA - 默认值=true)
+kube:CPUManagerPolicyOptions=true|false (BETA - 默认值=true)
+kube:CRDValidationRatcheting=true|false (BETA - 默认值=true)
+kube:CSIMigrationPortworx=true|false (BETA - 默认值=true)
+kube:CSIVolumeHealth=true|false (ALPHA - 默认值=false)
+kube:CloudControllerManagerWebhook=true|false (ALPHA - 默认值=false)
+kube:ClusterTrustBundle=true|false (ALPHA - 默认值=false)
+kube:ClusterTrustBundleProjection=true|false (ALPHA - 默认值=false)
+kube:ComponentSLIs=true|false (BETA - 默认值=true)
+kube:ConcurrentWatchObjectDecode=true|false (BETA - 默认值=false)
+kube:ConsistentListFromCache=true|false (BETA - 默认值=true)
+kube:ContainerCheckpoint=true|false (BETA - 默认值=true)
+kube:ContextualLogging=true|false (BETA - 默认值=true)
+kube:CoordinatedLeaderElection=true|false (ALPHA - 默认值=false)
+kube:CronJobsScheduledAnnotation=true|false (BETA - 默认值=true)
+kube:CrossNamespaceVolumeDataSource=true|false (ALPHA - 默认值=false)
+kube:CustomCPUCFSQuotaPeriod=true|false (ALPHA - 默认值=false)
+kube:CustomResourceFieldSelectors=true|false (BETA - 默认值=true)
+kube:DRAControlPlaneController=true|false (ALPHA - 默认值=false)
+kube:DisableAllocatorDualWrite=true|false (ALPHA - 默认值=false)
+kube:DisableNodeKubeProxyVersion=true|false (BETA - 默认值=true)
+kube:DynamicResourceAllocation=true|false (ALPHA - 默认值=false)
+kube:EventedPLEG=true|false (ALPHA - 默认值=false)
+kube:GracefulNodeShutdown=true|false (BETA - 默认值=true)
+kube:GracefulNodeShutdownBasedOnPodPriority=true|false (BETA - 默认值=true)
+kube:HPAScaleToZero=true|false (ALPHA - 默认值=false)
+kube:HonorPVReclaimPolicy=true|false (BETA - 默认值=true)
+kube:ImageMaximumGCAge=true|false (BETA - 默认值=true)
+kube:ImageVolume=true|false (ALPHA - 默认值=false)
+kube:InPlacePodVerticalScaling=true|false (ALPHA - 默认值=false)
+kube:InTreePluginPortworxUnregister=true|false (ALPHA - 默认值=false)
+kube:InformerResourceVersion=true|false (ALPHA - 默认值=false)
+kube:JobBackoffLimitPerIndex=true|false (BETA - 默认值=true)
+kube:JobManagedBy=true|false (ALPHA - 默认值=false)
+kube:JobPodReplacementPolicy=true|false (BETA - 默认值=true)
+kube:JobSuccessPolicy=true|false (BETA - 默认值=true)
+kube:KubeletCgroupDriverFromCRI=true|false (BETA - 默认值=true)
+kube:KubeletInUserNamespace=true|false (ALPHA - 默认值=false)
+kube:KubeletPodResourcesDynamicResources=true|false (ALPHA - 默认值=false)
+kube:KubeletPodResourcesGet=true|false (ALPHA - 默认值=false)
+kube:KubeletSeparateDiskGC=true|false (BETA - 默认值=true)
+kube:KubeletTracing=true|false (BETA - 默认值=true)
+kube:LoadBalancerIPMode=true|false (BETA - 默认值=true)
+kube:LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (BETA - 默认值=false)
+kube:LoggingAlphaOptions=true|false (ALPHA - 默认值=false)
+kube:LoggingBetaOptions=true|false (BETA - 默认值=true)
+kube:MatchLabelKeysInPodAffinity=true|false (BETA - 默认值=true)
+kube:MatchLabelKeysInPodTopologySpread=true|false (BETA - 默认值=true)
+kube:MaxUnavailableStatefulSet=true|false (ALPHA - 默认值=false)
+kube:MemoryManager=true|false (BETA - 默认值=true)
+kube:MemoryQoS=true|false (ALPHA - 默认值=false)
+kube:MultiCIDRServiceAllocator=true|false (BETA - 默认值=false)
+kube:MutatingAdmissionPolicy=true|false (ALPHA - 默认值=false)
+kube:NFTablesProxyMode=true|false (BETA - 默认值=true)
+kube:NodeInclusionPolicyInPodTopologySpread=true|false (BETA - 默认值=true)
+kube:NodeLogQuery=true|false (BETA - 默认值=false)
+kube:NodeSwap=true|false (BETA - 默认值=true)
+kube:OpenAPIEnums=true|false (BETA - 默认值=true)
+kube:PodAndContainerStatsFromCRI=true|false (ALPHA - 默认值=false)
+kube:PodDeletionCost=true|false (BETA - 默认值=true)
+kube:PodIndexLabel=true|false (BETA - 默认值=true)
+kube:PodLifecycleSleepAction=true|false (BETA - 默认值=true)
+kube:PodReadyToStartContainersCondition=true|false (BETA - 默认值=true)
+kube:PortForwardWebsockets=true|false (BETA - 默认值=true)
+kube:ProcMountType=true|false (BETA - 默认值=false)
+kube:QOSReserved=true|false (ALPHA - 默认值=false)
+kube:RecoverVolumeExpansionFailure=true|false (ALPHA - 默认值=false)
+kube:RecursiveReadOnlyMounts=true|false (BETA - 默认值=true)
+kube:RelaxedEnvironmentVariableValidation=true|false (ALPHA - 默认值=false)
+kube:ReloadKubeletServerCertificateFile=true|false (BETA - 默认值=true)
+kube:ResilientWatchCacheInitialization=true|false (BETA - 默认值=true)
+kube:ResourceHealthStatus=true|false (ALPHA - 默认值=false)
+kube:RetryGenerateName=true|false (BETA - 默认值=true)
+kube:RotateKubeletServerCertificate=true|false (BETA - 默认值=true)
+kube:RuntimeClassInImageCriApi=true|false (ALPHA - 默认值=false)
+kube:SELinuxMount=true|false (ALPHA - 默认值=false)
+kube:SELinuxMountReadWriteOncePod=true|false (BETA - 默认值=true)
+kube:SchedulerQueueingHints=true|false (BETA - 默认值=false)
+kube:SeparateCacheWatchRPC=true|false (BETA - 默认值=true)
+kube:SeparateTaintEvictionController=true|false (BETA - 默认值=true)
+kube:ServiceAccountTokenJTI=true|false (BETA - 默认值=true)
+kube:ServiceAccountTokenNodeBinding=true|false (BETA - 默认值=true)
+kube:ServiceAccountTokenNodeBindingValidation=true|false (BETA - 默认值=true)
+kube:ServiceAccountTokenPodNodeInfo=true|false (BETA - 默认值=true)
+kube:ServiceTrafficDistribution=true|false (BETA - 默认值=true)
+kube:SidecarContainers=true|false (BETA - 默认值=true)
+kube:SizeMemoryBackedVolumes=true|false (BETA - 默认值=true)
+kube:StatefulSetAutoDeletePVC=true|false (BETA - 默认值=true)
+kube:StorageNamespaceIndex=true|false (BETA - 默认值=true)
+kube:StorageVersionAPI=true|false (ALPHA - 默认值=false)
+kube:StorageVersionHash=true|false (BETA - 默认值=true)
+kube:StorageVersionMigrator=true|false (ALPHA - 默认值=false)
+kube:StrictCostEnforcementForVAP=true|false (BETA - 默认值=false)
+kube:StrictCostEnforcementForWebhooks=true|false (BETA - 默认值=false)
+kube:StructuredAuthenticationConfiguration=true|false (BETA - 默认值=true)
+kube:StructuredAuthorizationConfiguration=true|false (BETA - 默认值=true)
+kube:SupplementalGroupsPolicy=true|false (ALPHA - 默认值=false)
+kube:TopologyAwareHints=true|false (BETA - 默认值=true)
+kube:TopologyManagerPolicyAlphaOptions=true|false (ALPHA - 默认值=false)
+kube:TopologyManagerPolicyBetaOptions=true|false (BETA - 默认值=true)
+kube:TopologyManagerPolicyOptions=true|false (BETA - 默认值=true)
+kube:TranslateStreamCloseWebsocketRequests=true|false (BETA - 默认值=true)
+kube:UnauthenticatedHTTP2DOSMitigation=true|false (BETA - 默认值=true)
+kube:UnknownVersionInteroperabilityProxy=true|false (ALPHA - 默认值=false)
+kube:UserNamespacesPodSecurityStandards=true|false (ALPHA - 默认值=false)
+kube:UserNamespacesSupport=true|false (BETA - 默认值=false)
+kube:VolumeAttributesClass=true|false (BETA - 默认值=false)
+kube:VolumeCapacityPriority=true|false (ALPHA - 默认值=false)
+kube:WatchCacheInitializationPostStartHook=true|false (BETA - 默认值=false)
+kube:WatchFromStorageWithoutResourceVersion=true|false (BETA - 默认值=false)
+kube:WatchList=true|false (ALPHA - 默认值=false)
+kube:WatchListClient=true|false (BETA - 默认值=false)
+kube:WinDSR=true|false (ALPHA - 默认值=false)
+kube:WinOverlay=true|false (BETA - 默认值=true)
+kube:WindowsHostNetwork=true|false (ALPHA - 默认值=true) +

@@ -2181,7 +2195,7 @@ A set of key=value pairs that enable or disable built-in APIs. Supported options The port on which to serve HTTPS with authentication and authorization. It cannot be switched off with 0. --> -带身份验证和鉴权机制的 HTTPS 服务端口。 +带身份认证和鉴权机制的 HTTPS 服务端口。 不能用 0 关闭。 @@ -2421,6 +2435,18 @@ The storage backend for persistence. Options: 'etcd3' (default). + +--storage-initialization-timeout duration     Default: 1m0s + + +

+ +声明 apiserver 就绪之前等待存储初始化的最长时间。默认值为 1m。 +

+ + --storage-media-type string     默认值："application/vnd.kubernetes.protobuf" From 8f7be80cd85a5ce42b05a691d8108de313675a1f Mon Sep 17 00:00:00 2001 From: Jiaxin Shan Date: Fri, 28 Jun 2024 01:00:19 -0700 Subject: [PATCH 084/408] Blog post for KEP-4176: new static policy distributed-cpus-across-cores --- .../cpu-cache-architecture.png | Bin 0 -> 293697 bytes .../cpu-ordering.png | Bin 0 -> 112446 bytes .../index.md | 55 ++++++++++++++++++ 3 files changed, 55 insertions(+) create mode 100644 content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/cpu-cache-architecture.png create mode 100644 content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/cpu-ordering.png create mode 100644 content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/index.md diff --git a/content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/cpu-cache-architecture.png b/content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/cpu-cache-architecture.png new file mode 100644 index 0000000000000000000000000000000000000000..b26cbf74a08bbbde03e04644f1c1633b3b615281 GIT binary patch literal 293697 zcma&OXH-*dv@MK^q9RR1g&zy7_%5q9>2Vt?z^C93KAPK*BQORb@Ii+tV(-KC>LU8P$%eR^V{>e1^fEQOXA zPhOyAtMgT7qn1e)tR8n?Ufc8JUN+M*)6&+GHZ@H)B)`LWs8w87l_ug615g_{v0ed5 zNlBH|*NP=Bsj66VMkNioi0yN;vGeXa+>&HMirAr=N{6-=pu6`>LM+MQl{$TI2KHjvR?A z*P{3K$DZ^lpI?VHbZOtQB-(T}Jfq(=)|_1_IYD-|6N)-cR0%KcS7k#k?ijm~ol7kE zP7)GK%+oT2$RhKMvZsjr=iIPk$AR_Be&H|t-~kZn@sEY#v^HJmh99?_Ve$@oG2iY50vk{XdStIHTwCP`6ry+kiT}!^vE7uru_h6Ht)B{BV z?N(HTEG8r)?5eHl>O}(W4F80r2)!O16>^F{@Zlt2*KR%IGwN2j%+Y0+Z zLj{_E0f-rdulK;nMa3=qG-U2K-iwXUM!J9#dgx>1dV-Qm7<}ARn2P9)zHxl0w)@41GR7rp`)9_II;deIg)c)_oAmOF#{KdM!p6Q+8+Q~ml0OvOiT3L zh*{%+`2RTd9=;wUeHD*H;XKJ-%33^6Aob|vDc)y<^&PbA%MG1)58Bxu=vabM3_mh5 zLp%XQl-4>xTadrW}E*snPpap_@Twzuju*gmQah zBXvk{sCc@H=WUix&v;mbsg-651P0`D6#*<`Te{Fk#bqer&8<5ha%vcV}D{=wyEO! z4-+#K6MaBtR#uWld_EuWhl`8L5@ne0Y_zbJIXTIJL$|bWXFs@qo?x(Cs0d9=mDZ4P z-rO#@Z{_ZkzQaIVUF?$vGx|~2bBHAf6}yg>*Uu1!)BLu=0+~ov_N!`lcVX%<#ZYk+EEwVxzBbO zE+y(KbKlyXmE?b=w0gG>gxJ5fOZaM55F$igKRRio8quCCP#AS#5wb*Xg_B1XI8k3iGxJ(6wXC<2FUO=^)I9*OOoX)3spi3t_r zbGj_yJ27&(>7QayakD}ePZ|VGl^N_4%w9Wu(ah9Zau63*{XSGB4^8|y2=yUnnE$Cj zf^0PtUCQt;TlGkR9&OdvU7jo?cUaLJ(Nz%|n8HI94y}e=c2^m2Db6BS_a%0X6}Hdp zA&S-^AV4%TioUclSdk(@U`Um^#f$LM-V}O>}!x3b0%7MI?EF0dNL! z(&7A1p#5c!@oE5o$Mgx9q1D$$dX+lJ>4ZLbI{0Y~}Be-?^PW9N=KKgggje(<^T` zMPWViK_9LE&jY$`e#uvrB&B624R__iK-4Ls6H~E)F(qq_JeL%eprDf%mPFfjGKQg+ z)_pi+U%<#JlrYw$siQx+0rIueYLhc*8w;|u4dipA|5n(IgR8cE<>bQZ_o%w2!j+1b z@6id}odQ##^h>L&_I)Y#tt+hymsM0%wQ)jkzG8CHG^%b7##+3rZ!#FSV2^Hb7-K1y zk~`RjdE#WTfG z_0AS{AYS!_FVM@yumyk+$PUl3ft^}))H}v%My#w1N{qnwy4wzq- zD%4~zv)8wUHmFcQqRkwiN7HxL^`vL{rPm6;Jk%n{6u*M9C~BwuA^ zgytGgZ;`Qc5*wNpzKjr(%iG__EI()Fv=WQ8&0B#z(GeZ2fG zCC#V#Z9L@%Z{|@%|U19J3)}6aB&|&sQ~EPLKJ+nc+>a^G_EK> zV0sV8EMr#FPXNxRWezJ@kFCIr*l{t!?R^TC|2s(fENC>9@-Ta7aDj^~qYu9SBX2-Hz>vWb8-i^5D2;@fYP zYRRrtpY%&>x&xS0=0!MrI*vaN%%(TTC{ncnc)bH<0Np%A^!Y?qCml_kd_wYdm!PU#$z50>e~c8k%1;G|Z>cBt^bFziW)Oop&{ext)~dJ97`j-0Zf&&X1la_TP$Zn zbdXJM7UfwUG@0Xgwc3vMJCw}*gQ_^>$-CbdD`R%yQwa6AQ>p12{v_60U9Tc$Dc~rx z!}UCJ`+$?~=_XN)E&Saf4S8eQ2xD-Bp|A7Q$mC;t@V<*z$G~tos^!+;S8eU=?=A`_ z+I0@YnK=@9LX@5gDe`8;Egm{n*USm54NR$S5z@L-F*20*;PBXL8Cu z%~k(cgM*$|Wj$j1-nafLd4Bd)GsYeKA5@wws?=kOfq0YY^K&45737zg63I1*|3Du8 zYI38bv7w<7h(~a}W#gisfhIynJQUW@tiKa}mjW1N{;0#2eeVARQ9mYzu=p-tHtE)Z zEZI93&#IOv6;FFrx1-CitBX3Ao0<+VrN!%qFtDY);AR0k7_UM66(6@-NBUt*pNBVEaJp#%{TZ^_FA+Baz3Jn;@y?YT-e*ancGiq{pZSLI*ggZ}I6l5%k8N^4s)DSyh_UN^pML=d|W>U(jgTtKS;(f^d=hK-Z2BLTUF@xAv zRz{e8!U>U36jMv{stgrUw0+e0pXlYc%z6CpS5TtDo(z^lL-X&EbjK2rrZ#_R?G4?= zUg(w@G1lFknrwMgxkGMN&I!GUh|m-gmXr}vQ9WCn&j(S(#}r!HWyd@GV6_(%7ne;l zG3iFp`W_bm)AC%5oW-kGul!~g)4IE-1S%2Ob&5b#jQx{y1FS*>Y2V%!v2Lw$*^j13 z{UQ;ne=Bk;&_c{n(F5yYxh}51bb;4SfBOV|%PA$Ke@gA|V4kWybJJ*m=T6SeDHg!{ zPRmokT>m{Q`AUC(MAYw-g|9^H3bFG)O}se$FhM!|%H!KRyW+h9WkE_`?+G*_`lwkz zRLO>v-|Iau-D*coC)a0Z$x)}NCmMHedjA5g%+lH}`n$;++d2nI>Otf{2jw|EaqDAh zt)v`7p zy>?a!*irjrFheG%AALVx2o>0mIRO$ekyH&vK)Fad<#6L{V3~Ar{1Q(mek;|ZN4S*oxVq?>>4!)*^JAA>g8|AJa zgOT%z^<6h(mIPj2&&qn{I9X@;{HJ}~=$9mCQPiJ0CXM&+&m7kUlqqGf8>tw^obbht ze7jVv{Mqm3eeNHFFG;kYUZ8e$fqJa}5SH;h;NQS+{f2;K{6L{%=Aq(&Q4^A8!|hys zT_E+bNQc9t@f%MoeSDsP>9U$mw%YCf)crFqnDxqBq{%X{zZ7W+g;Zz{90UP&t~RJ@_)xm2v};Ce1mJOtM^GjD&-nO$I@=EaOv zn0lmeIxN3x8Ll|-*m?7xplmCCnurABv4>}C4HVu;k7&Q-F9CleQY~3!8WaU;9@=p( z09Xyo6bo&eG8|)s?fxv`YEw$=OcrKTi4<%3K|bCUFxeNy&y$2!SU6gh~cFogBg7C*f=2n?)nh?%)lGZSCn5SRr{a<^$_e# z^@yL2PQos_hy&WB)`)|gNKhlmUnsYuKFfSp`S-m?_2|lQ;pfx7Y0pIud}+~w4d|0B zwjD8d4XveVelb0GP@|`k>ap^j782vB>~upBVdy%H4$XfGb3Z*hLEe%A-tn^GQs&=* zfmXn)?bcBVfGK@m#9u1H=dZQGhR;)=u_cUZ4L-e7docNv+%_FHslrHQZ}K5t7BZPF zHtpNS$YovSd*-Z{MDtC}aSYfgvOqnUCYm3qILR7k=7@-R!fFz9Zx6iW*rSKJ z|G2l8jlUbdM3^R~g+^7!yY5l?M#(oHX|VnK`_a4qq)(@#^5pK1UaG<$S=Wy(G3l zmBVwzuSyqq^Z50dix(u*`-ZCMMffPK)5uBGWLnahP#J7WHSijKuQ~)vF=)5jZ~aqX zVlhpvd8YXV2GoFEL%P_5`dK=;DiprcPEklTr1`a}V~OI*c4W{X%v_W$L-($z6M@8r zkPa&+U5L0UEp`24AX`3O_Rm0A3*=WrQ5+FlPuhu8R0*HvzlpMI{Qb}x(f>!oaPpFE zCnox4Tw6F-ey41Rw%#KuGXM9sm3>g07G2C3mLM84@Q;;dfO71hJWs7v>C$o6a!TCP zl!DI$?O(VtKS34%7Oa(IinjOFUI%AKPzXwQC;-;Q8X=N6|3mA-nTXpBb47wdYiqXt zv)KD>>D`?W;Wb8gcg1J7p2uURd5VbZudsRkP#%-p(lFa#xS2~NzyNXi8B8H{y$*ezVEoS>R zZGl+iEZ0!ciN&pym6hH~q2nMm(3y4sM~bB#y@7D#Gd?jC&Gpkvb#lM{p5Ow@ zOV~?_KXA0^I(-X&iL1I=^4UVZG+jp8i1rIfD=dKY$) zl2z8jU|2)cTa}pqv21=G1!u#OWx$@af6VHrE?~`h*0qTy*jm3I@lNYAyOC{BLYk0TNip(j5a3gTWfnjeNrf z&;_=)UsslukZpQsHm4s_HHN&7T-Hn+l&f8Ego%jEyN_jNow08~%-ws`(3D`?b+|)= z4q+bfvI=TT`nL453O{f!t|6U1#%$GTKBBYY56X1sdbRzW5l}QrQ5{F1i>%xQn@&a# z(qf`r4qJ$6<%Qak@+p9+dDvtIhy@*1S1Bh7`yspt))K=loo2L_Ku;yvX6by<^y90r z#;${%<;6Dcl;D%Yg&Suu?)Qz1k_PI4g5ryT^_DG}S(!QgTZkQ>8F|*|Cg0^!#YZCI zBF}A}^Jq`jVJ)t}PU^epWJPf0)dZ_4pJ#?oPM6`3Z|59x%N|DrBD|^BUgzN|q1>xP$GPWOdK)z{4I|2;%L>Is_Wdt* zxc8EcoqIar9(B8+W!f+WnQrju-e;995cD_n$8`Ez9n~N zr0wz5{>Cmkn1{dDyX8E`L!0vEAaUj!#kkJFrHHnO-d-lQ+ryJ-FOR)7-a+OfhKP88 zSe?`9tyi2R^x9CwRu`Wxb?2he0Q{-zU0V;2;8QT0+%o*aO1ihVp6W+>D5Gq9!@$@u zo+u@X3T$rS$r-MoJsF=Eo4#ndc=9=|YDjzE)|clf0VJJC;Md#|GH2|0>CDp<=~+~S z11O#5$mjU=qtqx{2HxVjGZ@&nAGz&Ky7#~I_k8^FC&@_I#HFE36jzFC)k zzh!o)t%g+I%mHSMN+k|H^6Tp!im~;EeZ$AD%?`e-nCEWc?F|h=BHH^)SG(&Wyv)~{ zUKJ`WqjkhJZ75dgv5%)hC6to+_DSMMTIdP4fMwvO&)@8mETiu0J>)xm>;C2r3o2b@=d$H>o`=`eDgbOG2{;ZAZAd?Ek^b#emA9h ze+#-wI#HYmpQNB14H8xU_^LY@-|bxY!Pjx0B}U?g>eiQueI@)4y#=6R+4ifZs#u(e zwQh>EN%x!T0=e*2|8Z zz_GG_X8{~0f3iBrClD`M8x~c>9C5VXYMP5BHOLYp321l}J_yJREGVnbS8Exdon&i=U#=E;4 zPj=uEJfkaUMn;RlNG$9fHW4$#X3&vfq38)p%F~CWqS0fxG?Ps+KKH=Q_N@VAw<<@ z2o%2bOdZ&1&n&;dZ|b<3tkgGNZ-43DYP?^NZBNS&ci%1WKQmuI;nBW5<1*X{SNp4< zS*QItZET6%bo6GbQol#uvZuak`|@Nlg2Ho8dz9Ud>F9=%GBnnkPISX9H+r&L;v^4;pWKz$!u<4- zl-wDJaNN-{PODt2sy^nY6k{yQoumsyxjN4mWVsC3`qe&y66If{cL}6O`Z$kyGF5x- z$*>;h2lKaSUrhpkQqaFnPm#QSn6;Q&U@VPxo2|>8*qmU*6nc=_SsYuhL3d=T1|YBq z*yO;bIx9Tup2?;kZCD<V?bHyTOPyZ(tG!ueaQjO3ZJqGPb6Y$`gwB zTsn#NW~J`0o7^tN1+CFU?TajKl8j zb*f!gTc7*IyI92TV@353@);&MYsF2TH)ZgQ8c~)}7a^&rY2D z{;fs?7kgKaA_T7e7a;%xYl3u7J_Qo4hfG>9e@j-LG<4XAv25^DY=2lz+)j31nyhM@ zCq~S^v}Eh}h4T#OtD5q_e1;(#qPOQh6|`S|Iio57S}SEAPI*{C?Df)YS$X?kujH2Zqkl z?wq!nT-@M1!M+Q5(+8a@Q|L=2!e<~K-xhuZYl3;-w6u@H%!NF|JR=I2HmPtX$T_bX z(-p0B139H?zaP=8;5ZSx`c<$z@`xmdMUezjn3NX%i7HEe%xrAcV#aSr>#69?(Q-tU zk6BlIg8EkqN+tn~v(y_CXXJ)ateRejo%-U|i-(>Fs-p<03eCk<2mp^6PU0 z>Yw(dzPI|$9zh&5$Kl$84T`ob7DVE{T%YQEzoj;v^wjSCNFh>?u~-rrS|xVaspEpu&qPJ2S=_kv4%@ZF2)D}T_eT(L((9|{=cNIcDKBgIY$44wqe z61Sb6Y~3FozU#eV9FH#<8jeJEG&Bqb#MRVzEv>9%zgj+jjmSWZJ|~BwX5o7Gj(NU* zmcjT#_QmdkcH`%w{xn_-`2_{nJfhGmQ`=@UGo`1ml1Ed`=RG0i{2Wi@47JD&Sve@`y$dX#QC`r*LFhWfMx3y!a4pQ_wJPEbTYQ^9M& zFThQ)x~4K_CX{?ja-UF;hyg`ss-~)BQa8}&N>|n$&bLPDseM05VlY?Om;|=>XfS}C zTXA8QvF;w%5&I*s zU$|6R{tQ#f3W25-_6p!&s{HewFY*mJxXA6^N}i6NbeQr?OEmusT<{;G*ZRJp17R=g z0AOHOyPq;GQB)s~flqey>*YVyeDB>tBRh+)LHB-_u%bh%#{Q}{pg_}N(O9|e$ zy3nssPV$$#aky0wR-soi{Hnrbr^oDT2btI~Cck^rF1`dw@JFtz2p#r{JeUCWZ3PZ4 zDLGeltkV~-rP!n|1kPQF+E?iEHLYFWmmuRvgnS599m7uo>mzw&G7Xb(`?`K^tnDEK!|{12N5j4I zU^3PRU$Mzx{3$zbH+vdsRLhXIC>b;~Zl}kET&;D8n_S52SZ(uH@#@JGiV(N%Zw}es z#M}w16qCE(ttnn?FJfpF93mFZ*X=j1nLGb5Pe=L=E05yL1q``9oaxBNJ4RhsXG}VsE`m|o2^vsiBS&vTIuQX?oGXL`cP*xf2hI`mQH6~nZ@!K^FRmL^c+^`4t@nPBY z?Qu@5SI)Y}#qOHs0BA1VzFqB`)(>AQdqPFV(0{W)#!LcR`G7?!?PBlM7rv;C`Qvjh z%Q|q2DT;4f@_Lw;ss#Io4JH!zf4Z*2flqJM>y4j-4b}v&>fJr5jmb!h6DLj#Vmyp< zMONuNft4qCEV`oBs$$QJtebGk= z)td&kpTHLM;Mcvobw#7q=2>p!93*#Gk67Z+pu3oWkkD)*w+l7g8|z%td+S04WHR2K zPo{m&O8&O-^Ys~P;!eZT;P*vi_<=wcMAfrwIUkWlp`2kGSJRJN<~4lF%gb9vZm1YG z`fIasY9y3Fn*~gcnC$r1u0L;jQsgyk2vvke#{N5BYRr%mKs0& z?y~ER@;HxZnAn^c;OL@hKJhEC2ks$;%^a|6O-Sa*nw*`bj_QaKy4Ix8yH6#JTlugR zmOEc;$N)CuCf@CW^QcAos&062NLJ`V7%+xH%@&`|f+i#9GUH;6UF?&*%Q zs9u5#>m7cM!Uu~lb*m`<3=RqToS>fE1J8KXb`3$`2!aR9X)N$jo2jtQFqmcW;4#|+ z;Zp9^CJAw2URjnTfUKrDZH9WFL9+RZLHZBah7u$fPfrm!zkl0ZmM)p;s3fP!Tb;C#PB`=FChk*@iXb+8kCI+{9}zhOCQ1b*y*Gh` z^Xe5fKJtT2x~%@vIbq*mtR5UpZEPFaQR5^f4HuEvI&Eu=NMYvf@a+*`->+}l|CwH}v+u82;^0aN01R-#bG@nYYo4;Qa$X*>Vvk=m+QbdhW3ydre(D|6!2FXLn8gAH-PzKO=BSL zVO(PFz+TqP1n0iGN*t6+K0ZTfc_F(>rW1EQH1bRZki)Hu>RPbKL#+8@e#FJb+iB$3 zTV9;g-2cNBJMN0JHPFULPJ;SfppE(2yQ;Z3hPR^Pna}D;VUgv3@H!LZ)xECs{WD-+ z@&b6<2oDl_WHxZxf(bU+8h=0+{MK7FSWQ%2uuC3NlYN<;ZFlZ)WnsY~)dp2vZYQlK z89wcKD|A_kxZVH?cz;nE?>ZHTWsl4!NB{(%aTb1Vcua>jX2iZOY9GjRyWAc(x}3IE32G=5vEb0 z)N|0nRO4|9s{sXPEjkApXFDP8U7&2P5}T=BT)bKX#AO~BWoHeH*@aFsSnQwEHWsb; zrEBd06lfI4@;Gfs)MtRTd?l}kk+4I&V3}P-iJAGWy#`ZNn`S6)n(0Z({jzXe@(w>+ zVmc1m_2a6rK6MFrS7%Cx)5Eob?QtiYV7(w#Wh`^>k|OU$IW}=fK^Xivs$a8*#1mHl-d1MErxWt zFwkxb0=9!b|G9+=+HJ3@76%OtJ|hl1n@qGc9IgT%oqRi5abQAA0tgNr=!W|~t`ma} zULt>poO?%`5>Zh}J8FK3Qn&D*A$=c13Z*rXp>+9PIah6`ABt6bzDI@k8O0Bw+0OK} z-R^jBL!Pd>ouu|OR|wHa&kbATi_HFB>|l#6ZWWc=?)0b~1FtZA-wzZdJ`YJlRQYN) zIy*VRw5D2H?V|2(*1RpY%L1Ofov&%PY+-r`9Kw+Z9-qJj#g8TX5-^R6eqILG-h+Ko z&vZ-Dr{lN52?qi0)?ha8P)iq>#!AlMspkD5a565D|E3uo0opzn68_fLVFOwE)Ic<@ ziZxL|tk25F@yv}F6t;rhzW9&>ZykWbVnns#57*iK2b`UTCowP2w{}7CH=UNSmz_9b z672X)^_d<7-AmPH@vcH7_GMBLDO2&U!BO}t2QfqMRe?OIDZ3ulM~Hb>Od57ejn`@z z2?k?+y5UUU%7f{fhA57`mRXhJ4%$SdqY%4`5dk?KaCq23L+%QM=xyg<4GvK)KA)In z4MS0F{y>w>p!$wZU~CTK<>%)=0`4BxkzAQvcW~k28ZCz$AzQt+y(IavOr+FsaPW|n zVor>4f@a7=haR}{q@#$d&hIOihIcaGC7@>v;}3InB=B=~u5$=}m~V*Y+}6ZJ(CLM*r;=Wni>1Wba!UcxS^c9AHp|-q|`)o$T+tZv;_w z(*E^%ft&m)O@nx1Pj+sg!|u>N&9;%+4!@axIRwphNZ zI`1_$JT|s2Y9}6YO(ji4(9m75^AKuVi%I5<11GJyvR`M>ZKrSlYlOF^6Kjay58b0Y3YaFFVT!DaB0Rbsyu+NdIUr{i!R z{ed6n`Kc1nbgMQ{#6MJ+leHBSEQ=iys2dFK{-f z0*hJdFF!fBC%bviz8`)s>%eTo7})%R@8;nZSJ)HXDg?N6T~6E za&15Fa@k4|zcFYajBi$$mzU!o4Nv^cy>`7hW%?tOAz$VMIB3cg))l8#IK?jebXvN$ z({4579=Km|4CxMznV%sfe2q>L`HhTsY*R01udB~U=>O%`7q>A-jf~S1Q@Rj{Ip#=P zj@?o*XUXCj!6EOD(N}?xyyZ`@frYU5Ik2Y6gis-$lwBfr#=cS1E*rhV&CUuU$PYMdpc0dt23X*xk(!b^SQG zSFE9?njyJ?c~7OiO#Vu;#o3bJx|?uO3;& zfF{L;@4?64qa_XQAI<%Ds6rOtHWlpbKa!9Kha?>HUbz`!>Rk`qWQKj!;1{)}Ga0*( zc(BEg^=77TVo*l1x|$vgjW$~I!zjm|w zBHL_*yA?W*-8(jM!NSnRv1FyHx*?;Wyyu#8ENT&?R4L*WD1=j0^V4ApitZlt5HX&e zyGKJDEDTEJS`RxuxZNt$k7lwL6n)0|h`~L{c zG%7~KUa+AQwp0ZU9E}y8|Eh=m*(6x^EX;<+luRxzxww7_yx_fGX_hbx}qtdNWYy19Dt42)0^x8SPUPI zx8^^#T$)h&u%1xIayCmtpEN&|BYnB@qsnX2++pk*pA_KO-I_g+AA?u7MiM*cQxxEeP%b=+)BV?d)QNjVLCY{~t`& z(Oam_mLdj3x+&H~UIi~m8gHBY+TN5vIx);|`uZk}2KT^yuOokIDCIP-R^i9D*Cjp} zm4YT6LoJ$;!W)Pzci?LhL0f9M=gxv!J0F~voX(7knj;a7>rOU?tnfr;PPTA2=iZR} z_H;W*jo{JHcrHdG$6s86NEQ|oc&=j8j7wR|SLL3oftAMXB_+HnoRxSI5*+z`alq|F zsy)H0&C|!fW$FuTE#kwZ7dX0Ax3mdD;<3dk0V<^41o)4b;SQq&T*Ln0eiADm`?Us! zjf&T=Qlra!&RpVpK3=ab{T438_fXoJCZWykNmj@x7@4*Vho8uEX&4a&slFFYnQ3tVS$Pkg`-_5^+gwEPO^2 zMuNt^+GYY`0(vTQb+--o8<_C>{{8l-jPok}@5ta+IbNzrN?Z-KRzv4a&NS?Et6V$@ z;-2<@$30EFX1}JYug-*uTvTz4TtraXv&}?uPWxr$ zZg#7XAfoI+;)eOwOOhGaS&~}ZNhfd}XF^f-;9VVr>(jWLE6u^-0{IZnaKm={nYT|R z$Mdo`39R|m>a#|`e<4pu4LB$sB1(LRaGfV=@~{M=we#S>09pt9Iq21JhgBkY zo1V3<9(1U36%_fY+)f&e4=YsEZoderagP%Y-7k-MfKsf7BWOQ zXnxZhE#@que;f(9m8s(wM-B;uc=?+-6!qPXxHZ`t{p}le>C`efAkzQco`-?2^un7` z@2wg8@o04CloA8%=IM^9ddoi4ddvlqXEmL_ifU9d6U^--jSFSufTAPPS}V!k{~5T8wUxMuKTNrD zp(~>n=qfzgUGhO$n%&U_E`t-KB12z@t(PHp`e!>O8h38A|FMYUGI#jmipj>x#})>* zkBLx@yc3gVDho;%3syWyP3DvqXWV{%Ag26`!Nc*7GQVXHJyy^npMzvi{oTH*HD<}N z9un+F3)nZfj>@(0B;3ooKND$Yi$%I@q1=&Mvg3}<&c7eRneRt=Z)Kc9dp5*e>~1#X z(MGGjW=;HJ4~@#}{UkIdCQ{-B)@RjVHFku8eQi03(mU1ydr1T>`?p zvi3Jf8nVlH=+&D^b`h`c${sX1sm7psMG5bWYCgX%{P$9bcbRj|7Zect*Bw{iHOF3X|L@s!4&rZ+O{IH8>

a>X~Dc7qb|7G z4QE#YQ>5myx_cJ?xes7!)W0xK<0WEF1yYYe7lWuDWBBI!w?in%{+0dLY zQ=)rIG+ZRtIPwFk?E@ihDj>o6bkl~r)GkK!v(WMhLIT$8JIi{xuc`Q4>>~U#3j55Q z$U%o>UGhxJQmXL1wD)00r^li@P+6|Eu7u!rNIf{=jqJK>Nv7b zAf)F|I5GFfaKuvQ$-uxEti#B@8kbSk;zI%^mcVKco#x%w3?z7qK;Hd+$&46J@BP@d zgD@|11sdoGV}+cWw`(yMep#3J1QNK8|2qpnj>we59||jHuS*E;ymok1bf9bN@-2bj z{TzYySWOeeLA?qxb+a=xik--XJ_eI}aEV*-O5OlvZ~paP*3J`P$ooF_6_eQkNLvIYTCY#dyu^9sIdzocM$O9xU}8)& z{)~Md7A7pbYG}BgaSE~0h2|1Idj3Wgw$))nz}f6m$QXTSrp9~pZ3pMkxhqJ@`RfkM zLyd%Z_lXUNUKA*XW5k!c;cE~P!>p{V0Xu;@@Tm=Bdf@Ep?BGIp_X-v`dVK%@lj&Bi z{40q{Uyx`I4A>e&k_K-kX=HwfW{Bb-UT-stoq-w820tV&Oar_y_tbPM$_)-vH;1Jl z|FpzsjK>%t!BOTq@wsi|IM2ypa1m+whJy|XvNO1*{$Zzwy>dZ6G&opv z@$q<{GQ}Lc32dKeshg6Oq&`!&$Y4#38_ak3Rxf%oBNFnDu9u~s)>rq{9 zW(Nqx@q6+J4*duz!7_GWP%UMG3E1ZgW>Z#{hE*GLg7S)F`m` zCWn0MkbbgYtR3=CSq{pr1%xHo`~CjK5$}=C%6hwhVB4|(o1>HS)56x0uCAR@I;)zX&2!OXvA;75A!5e} zn-Adro&lP*lk=!VmT)#bdPzb|i1TmcmmN`Y5k+Eh$R4r5vR~2n1HWhdKKobj^#Db` z&w~R;uPBLdVmdP_B~P!|Z+F54W5q%_riO+aH03g9=zZriiS$c$ML*WZS|+zG=VziQ zVG#SK>$#E`NoW53A@u)W8|T6kC~vX&GIB5+jS_$atKKR0_CfX5iMBZnZUe?H6N+fp zO#$=kYLfe+d6=Jded*wBhVV4{Mcw0gN%Q8Y*<*(vYMa z962TB_HrVHa-qFF8=>~DqEmvbo`zAa89f+Q4cf=I^#jk{c{44SzVep2F;{~VV;0@x zzvlauJUUjEkFLr|4C6}Ra>7^Ku%uiM9L=|(ABcEAGK}=ljo+SaL3SsK2_ftFLcgBe za`{HugSSd&%O<=VGG>HzJv+}pW;=CFgQYR#^vc4sd($8wpYLP z1!si)G9S;F$oz%f^xfKgjqAPQGAXk>j0m>)3Sw9uslM<9`GNS-ALfNLB`H>K`u9lc zuj1G76*Jlu+x7gt5op(3nM>fp7SFcUT-hF6OTldCO94j-e(wZsT+U6(p z!%Iev>gRkKn)A+Xe%MERD=0vPIwzx_mIgkSoGPIDqRqnf0Pa4JwMb5ZXaDBI6Ye~` zV98P(GB)|SFAb>PHI#<^sJLmuBs$U$jAn6UJz?0t#3-Vu8ZSw@qaq;?HLwBS{4=vq zPs?BYVDqoN2QD&@qeGf2L>Xa2*L)w|q#hVHzG=@E^>EzcJ&T?e7<8GDdpl5qoY|=2 z2XFLw<+wc4Oz>9amoX|svL1ng3>9R(?Gg93)!(0pJ>?f-K(p}ct$DwTHkoGimjyJ* zjCbicQt6@it7QE{QP1`FdsgY^!Eh4kg@wN^vrpK*FwSLkV7wlkw75L%F?Qe8nnA@= zVWbaej~edZXkpJ`cw%c{sst=*rg4z*qi>id93xaVMU!_ff!()`U>YF(@MJ(j`kPzd zXZj70HmTsKFIRkK(d;(Ev>y`{IWzjr(d!dT^fO`?Depmny!^BWS$nAjmv$N7Fs3t! z7c_r=@&9A*J)@fLw)IgJ6$R-kN)!|YR0LFz&?7HZ5qK2=sS%YXkPxM}NRc7}A|Oa; zN|h?o0t6ymrS}#H0j2j&Nb>tH+!;xD}0^X`Awu{x%XQj|JCevXi1YZ~9<&&P1IFH+dome@2 zN)vV>Fl@bLD0AlHE>>AW39_DoW}8hW+cS6hw`0<08jBcyc-xG8x8<^@S0h9AV|Y#% zbCS6Cm(w|b_1x9dfno-yyy@V!m-#<($0K*4bExM;N0BB+1h(;L@#BVGHYT~P^$XJp z-To2*wGsRxD?C;4^5-cbw2}NleqWlKzqI4V-I;CkfJwG z=p5s&hS<(A#kHR9YTHqdDP5b+PgN>9ivLjen+^V0%?lv}*h%z{sjLqVpt4X=yu14PozD6ee$9 zP_jAG3FYq!+|pGtt5j%J|5>~~hq$E1rwP;N&?YkUt>arfo^7LziM}V>$=$r}Yi(+t zU1wbxSAP|c8v%a?ZkAYPokRUqaXlU;m{Q8%V?hrdtJglBHTyHV8(ivE-?u$yoI67O z2I|$eQC53+a}E_C=Kb1FJSi5rEGtKuR(X8NL;)+)bd9S{yoWb@V-DVlT2cz=Q-orl zA+> zeLAh~u@2RD>vmTQnEVBk?&~_~Jpt?QYEtrfDAiFfc#}>=jJ?FB1@XImd3`cd!^F8C zTkmI1mA_47bmuWS)0V0ynw-|p2kmB5PWo!tOzp6$+~RBpR4C)a>+u>yfNy=*@p|p6 z*HWVn?_uolm@mFCEGt9-AgnrW4`Fc+^Qxr3k@?@-M*j!GhIzlvF9(B0=2|3km?+0> zBSxomcaM);D#Xk^@|;V|nMvkQEE#&5lQ*gfFoi59I6Hd);vAFJCQD;I$-~m*iuL<) z^GJr#J^RrW!+^_Qp8;&DqNHg-BG?(N^%6AFFp=R46(dHLM+64^FSy*E=|d3nN?HvH zHa?bGEwsG#fKdI) zYi5Y^Ft?T-C%o|68y!B*4gkpqj{FOfk*6_xJQn?|++}D#R$eAU|Mi}2{_>%`m)^cC zXa7UlsmTnH&;DyW^?ipWZ_=6WZ(lHT`&#e8aSlZh&?oU8!_03;W+LwQfn?#CSE3us=vP?hteSeF<<$-C2Hx{@tQWsLLd7oo?oOvLZRUKE zwrjJeZm=@SP>+M8^v`CPK%f2O9KU#MV;4S&21D&)OAm`hMowQbGycb}-t%!VZg25$ z!f%72OHG+&j3L$i^)2&4W%yc5^d0i3G*cSWigg)IbnQ+GJvsOK!)Fc}o9~PGUSz^5F$}RK z!WQY?gk;Lr%#L>;Z3ey*rx%d%k{TpxkP~iE@-YZIFv>R^WCG1cXs8PY!%mYra}uDv{NTpkx_9^1jqGFnzt9kr zdtIIg%Ex24w|MK*$YZ`!(kQc(E&4YuC$fKpKF$~4sn%gawx_rVfyS@UtpWeVol)1D zhofD0`(IvpmrYq0@X?&<##+q5cQV+(I!^?2Lk+yxNb#!a+Sz^Kh_#F3kjgzZ(Co3- z-@Cqy#f&7|F6}I3vs<>2WY?RVv8>mN9T}NJ*9B4W=TC4jvOV5qGmopY>=3qc_5{!R z-x7Qn7l4cLo)AXu{_(~PpY@fkO?L1f@rzGibz`@=GM6}bIpLHN^C(Uo;09}F4=@By z);KO~tdLQg@2kb@xSA+5UFXHU`B=qY0X@%73h;2@>Of*0Ho$P6lkY5kecvM!7xvNW z9-_BPzabO?ZQnoIL#c7Oh$)V;$!;mhGoD|ZrPJMVyJ*H!dt&!Gz&4;9Ul(gFw3iBIJiZ8iXg7C^4ix zV`GIDpc7yO)_0S?lr+vw0Z|Q%{{rDl)WL`#hGogQFycH&F2yB6;JW^>*xn4h;Gq;o zhuoRvuvxotM}z%P(GJ*N_rTqDtJg(v`<+)X zF8F5gXNlWLu)6hosL{U!z$yHwLC`eQ`k`gXV3PyEI6N16R3I4lr2=$rsa-Smq|*U; zl&RlyL!ZyT+-T2$r|Z6FQ0?r(!D%>RjzMLX?N-l!(e}6#t-a;he95~_$Y}^1pyx@O zOGg7)#~VAGa;3VFcyL{BzmIyb5~v=%^T%#SY8F5gYtAxYfS3#5+O%9f1?sfO5j4U= zhcKyrInT~|)AWThQ!&HhQ&+VcA>oU`l8T3w|EMX1j3f zE80T3nE=5;e)7lsu60xR|JdiKOS@WB6nAY1@)L5WYDqo0FzCE=sIOceD$anqbZkVa76>!*7v6vmRD?YzEX7?Tk0(Y5zY|9hbSd!YYoq5m!T z`(F$F|0(2N48h?HM>M4rwYA>+2p+gv8%m&N7j!0+7km;5I+K0r?w)^r-El>qHHdhh zS4{NwKRw><@yU0g#Jfe-?HQ@zvZGza3q#~V>x92R~pv+`<_C%M)sf|oN71rv3-$Y&_ zM={)R-8^rBEo1w!(zi{rN?>3crN&cvs+6IZ`PheE&N>M2>8nF^*N|6 zq97gI$y_|<{M)kGCc{)R&h@iXUxF+&;ubckz@s;2s7?Q8>#uVW3Boqag7Z+=G0ef&HH>v#+kWU z8%w4+L$^%qtBtf+hw!$+Njr6GI*Ey;vuHaE2V(P$o`#yw+iQz!nOlnL9Q0LN zj}-~1{llE+DBU2wOy%#PGv0I!ZIW9z_n}sauzKyaKbjYJ@v{CeRLAUUqCi|D_sIED)u{ z=*L1q>%E}+EWE(y(_JZVMqKLgqi2f3Ot?%l`GR3Liw9!EQ^c7E73_kcn%)*@0xj$jRdFaFeciUmuUjtvRo>mal8QHke=&J>ow2M3az0Z4w`G?vKq3=dbFbR^45 z=NS)}Vb}Y~22b?PqwtDE_ZK~#$K63nLW|2ku(MlmeWh%$l5o`) zfYAjslRLlfUJzkX8C6Goya70Uk~ar6w!gX&gZlpd# zoT+-To6YJK2?toJ6+w8(?=xRkuiEYH>eT=bpF=UY%p7;_FmqskMN~5!xZ#Ec+v?55 zs>+MDTjM>82U1i>55)hr4yw4-%8jY(ypGygLz-vAn!BezE;t&3H=>qz=cKV|oDh?r zI6gF9Qm}HGQ{z}-slDvVwxRd$`>&!gAVC-23&L>q(4!M}`PJ{kgpC+JiZehJXX zQ=xB^^*+)Mff*hqV(U8Lz`edbc^GBM30ME(&iCKeyZ={I?3c#8*osGXc4m6@c3zE= z&dFD-JSLXN{I6bs-@`ZV<{wPIW~V{IXG{o%7+giv#JY%yj|ZkYup4`XOQxkvpJ!|} zFehnBRMA|ATvvvtfhxBHfyZ=#4%wi zl|zLjl_AuH#Lt^2@O@D4R?nypn>lnP7}rNF+GuPY)nZTOg*I6nst2u{n#!t`i}GZmJGLr{!pJtINloPIQjc+~%!N@^WR=B< zk!3nd$lQB4!AjB?!*CbtuEda)9gG?^MtAwCv_cJ=DBX%j@tp9xr;?rfK0EcFEt_%a z|CwJb@*g{LR)72#2RtC$zEOO06rJlbCC`L^LzBS3275i@Pf)c(D>$hNcvFwHW)7}AXYh^6UTJRiA7e^V?8`(VkhUfN}>z6ps;eRq$>J+l_$zjYBUR}*@l|RwKmyBP_1p^>CmT8?gn8QYI zo_+8qN&3fh=LG(P|Md%FUi|uD*rB+kIB8Szp1tMnk8E%cMLUu2{QVh8@$p8Xr?Yw` zz3qg;q-q8LUI1NItg#=|qXx1S8F}J=E0c=*KC_KaGHINddwT*sYGqe3fipY}=>a>7Pl?%0@d1h>D zNrRb)CeF%Kfy*ryc+^F_X8)Gk_FnqTebxMV_G!$o@ox(fifg|A9!@;NIFSS9#IMeKb`S}h z>2zJb{kBkSBia7X#Lw=p*^)4s2=~_bo5f4jy9Pn+$iPw1QXStNX^=4KC}~&~WzP-I zej3X1=E_%T6yK+G4Rg(Q8pU1X*Q|-eR@LVysd1~=Dvrz=3YYHF@M^jp7d$ihuCC%n z8VgA_uiJ+{{Jc4D`sWEU3vE?V0h3w)S-pOy`z|YITeP37X*lXu)cxomVMGrZxw85A z$=%_FO5%m*TZiPkvqi=4C9B@j7B(z(Td-3g_N*fXPU|JVYt_oXD!*`1K(_nY-{$3a zD{`qn)7fS^Oz(qcxfFMg?uMJ)L1j8|-_u<7iSocjiGZ#oA^ZPIQ`|+v7strMyTlKs zy#@@lGX*;EUDGxdY8cxL17LYp7iSZ0+=vQt?i1evu|EO-_ z?~t?y3B^$6acMgMY1nCU{FShSA3y~nY@3%^eW>m43zhX@xEr~Qywg12;))ezj-q6fjwPgi!e8Nwi&gY6lXk4JVUF=g0c&kAXJ?z%0kl*Xt+O ztZU=?lZCVpoe%hfVQg7UIYYhJfzDqARn>ng2tr+(1qE1Kk?!lOpjy|dN}70Eirouk zdCKw*ZHQz-7hBAIj&(64B3{lP0b}f_x~YG910qXIz+qigT2}R#`Av+{9#=n0EGXdn0f1;dK8T5c4h8&_Sv5f;mr*)&%XtHLI`N-&4cwDj6^F z_cY}28D`+64{gTK+@7K13_ucwN-dM!P5XWT6Lnm>UXdMCm-gHfX4v>|>~pFv2>qJ? z!CpP`J^a=X<0B+B`=^t}sIufP3145YGmO4nR#0)Shh%Eh8bENb6ax{x>nC0QRUf2> z6q*jg`bCKlH0dCvkvFS}{{?>X_b24Lkk6qt@2Mzpu z0<%^EGmv)hqFHF=5C`wZOtN@W2N7Lj2*zc_)q3M8dII&nF6h~A8gXfjVf)->{4wPY z$!&KTxW`R-huw_XN*QHuC3+C#5}cXF1z&ua=vwAA1KZ%pcj*_XWZwEx-^yV2dMQq@ zaUb)PR;B_#EWTTo_0$k#6{3hBs{qP;88Mo}M8HF5)tEpYb1Fc8hJr}(w2}!{~h*mGGnz-yOJH4 z!aw~o!$mv#_NjuDi(GKm5e#g^xqqPzcO-O^B)ZJ~R^smnd8(wtX!4Q3pNkE)CeAkc z*8rsy>pa9OCgO91PPu=IzKs-=UIEMTEhC--sce=%d}z|RqMoAU2@qYy1lQ5OmNDEp4|O(JHL9?u8nD2 zZizflCF5Xy$b&e?4Sz97_<38a-nNsp+A}0F?aREFn%So`^Y&(YfoDE-IG&k*g~ALD z!3P||T^lJ;&-oifYWI$zxeA;%W-vuGET~A@^FZrw9%o2LNo(oKwT5U8dKI-!2k3ey zu=|jAy}rhW^~2aw~!GD@IQf(vBM0ig`$zASa14pg7^KWpz8Ko zc$`0|nBKfsdc-@3Wg%qgA{LvgPe3x&{oqrLa}H1kmJd|A)g$p1wUa}3`5D7#qP9sp z6P>AeeL^7fLPRb>#cy2gn>c1d=#G-twrhSJpj$!Z?;xid{eHP9vz7GrZXeHTtwF~+Zuni9vrfM-I@pC#{5}2$!LLh$ zaX&dTG~wQM*>%8znK}t4zM6&!Ja!3zom}w7 zWvKr>U70Bc!ZXPnVyurh`uA#yk?aPmVK>L3SI3T#Nbj(iD@h|0yMoiHZ1Qor*_zZ# z?r8W|`hyQ-hMM{x%&s=1qilIGb*pVk6UQwD1Lq`ti|W|ryTF~+f%7+vPgL?|RurMl zkgxC-pPn&l%@Q=@nFZW#x$nEXZdyKWQVojo#&y>IcnbeX?EE#4nHWPG1EfG+`408{ z65(K&4MfRtjphGE+9nrvBB3g|Ll~aE+J%1t3K_WPfnsjk-Tr=J>!66*Nzm$PBe;kG z$h?;d3K{P6qegXOxveA+hXEzkxaD%NYm`j9)YAo3 z=1xuT#z?uc5vmH1vMBH7lFycs)6Q?h??ZP!d6WU4azRVxfaUL-)`z%HiyzDMrtl3t zDNCFlW8&R?Tc`$dw`CgIFFh= zddMtF^f-%@k`n(w3()Yz@5cRTkg#mO?LASA`3*U^F@Yy%?7RmAQHwsyQ%>vUNEf+b z+hMruuZDSF-*0Un(qtFjiB50pUInq2!$glectdF$&Bl6Tm=!#6K zAZq)pn6S@>iv=g>8)SKQ&@NzXtKXE*s0#-}iZ&Ji!TcX0M+O_F==twE74u)UW}FK= z6}^`{$&%skDbqM1Ev4Ck@2zlbgbS%~^Kfu3MRN<4jHjF~?-ZgD$;%an-Ljcp38O_@ zsOld#YSw-?qdr+PmI-T18FYlts)!a>H4?pEspL9d z4>|rk)mi4N_3skv*0jHJoa%n{Y%S%gy5?4IJRf?z)@nuVN8dnxb>Ur_BKmCt{Z*v5eMi9IYzzsa@Uj098wcGT^#WO8z9Vn;GVpTH z&z!TX=}L0eAVKOnL`^lg!VDKS)G;X~*)~~%=tF*{htQz)?aO?Op=sBxQB#O6&^5wA ztK~iM1f((VhopudZnm^GH%!KwpL1WMC)1)ws~we}E)8GfzsCb7F=vV@fEjAjAgLvN z>ful@OsDWW+GfSXI7|&o-}(vqJzP8^8Fgaw+uft)e=Mb^{7-l>IUgm+TCaUyifc;- z1QdIjO_BI(e(Nh2*B0 zm|u0R+!jgHwCf{ji6nbn5i_fhiq4&v3J=6vcoA%ywuv7);>sor*qyLGGbcP&3a|yW z_<2Izg-|?2C+?!$>Wf&zAFz?atZCfQPfW21+7eZ!ANn=eAF85Bw43Y8sk+^D5%j*D zvc_Nm`YV$dyzJt1`$2QB?3Q%1#FXhM7l%&_dcHg=RV9`YY6X7=gJ;4kFuhpm?>d5* z)C0E^uT$RfU2$+0R06SOTl_c}&;yhwzI8gR0BdHcz0-`$sb_^;>7Li7knU_F%l;;b z6{N+nEn>g>gkP%r_5#j#)I7e7Ub_B0O7{>qFreL0b_mX+St((vDN#+kp|}=gokRB| z*8oD{h)l>|c*~>f{2f+?-pWfvKpU1G+bbdoj8vV>lgyZjA&Q<|a!OH~OoO}UPcd6T zRNODCu0Zk$R&nYa(U3hD7IPv;|7^(y!d}9Ld~Cn>E;HsycRV;6BqVK}eB20h-+T(e zH=TEY{&cLMOju`ib)egERkTxSbR_@&K`zZ<#CoziD30E{h{~_pG$|fNF@o95UKKpV z#6;a#SgwmmNsUlaFLPI))6gJYdvrH0!DIBM{*6@r`Vn%)g+#|+HK3>^e{;-E6vPZI zpF64vG+~cl{Y2KD-+Og|#22$ow#16>=gu~~_*tB)TkW?;me^YTx{GHdNZIwRt)fJg zrn4{bZObvU(ig5r^J$pQbf_>sELNQy*aA7pa?B$$&emRTaj?0@# zcoGpV6=R%GA11FMY$4FMYeh$tXgL`($BJnTF@Up9F=#) z@oMsa*lY;smGIeca?WQKz#B%n`mFP!K+?3E&7r8*PCJux02Sd%h+?PLXWIVg(tQ|X zr*(=Lw$dW0+pSG5*SVKA)JWfsBC-+!v_UZRL~VJVAI7x2SM38l=@oZ8%+cEh}Jo;Lzv zz5pdw&U0(VU9(tkDZ)OVEvao=z|EC-)&{@b-ikoT={ajiMr~&18 z%F3#TOKY!T*Zg1+F72%3hnRRM=g#D%COU^q7DX&~a$%z%TL5DB?08#)_J5NfqK+na z{z%SIprYc%9lA5ZioJH8R{;K%MJz~Oq!vIod_*<+zJHol6eXAg5;hsu=iE#KJ#)X`;=2=Y_4MCN6Z5p)bDGFk=W5x6&Tj7@s$GpRPkz37 zgVj6OI=`|ZQ5$x8Jfx4b5iyl~!;`qpO=*<4>vopemA)2+xy>}_l1@?7f4f-ZSoM7zl`||`RJ1S}?3T-@F8pzI^l1|Q#q;N5sdVJvq+o3r z+NSTA>QZCgpi#*+9!lUlbs9~8TzLeZVfuX=uGZ1QkAwtCap#k4TFoFg#^s`|Pzf#+ ztu~+^gzT>4d&KYa<3kX0y-;)rB7gyRN_Ms1wHY8}wkzh-lwc62-N)A}}=Z`FJ z5s7wmTVQ0@7w39D+c{(!l%c{)VvH+YzCORW_KlMg=sNyQm-LWgMT_J5`|GlgQ~azw zZ^_WbOmoHJJo2&m23!k#(LN_k6~6-O9&p18kiM*}mhpl`Gtp=gK;(=YjLV(%yS4qq zBXGCq1u^`bKs&;6(`QAfHVhfJEXTe`oq~bwxS81rlD7A+)StpP5h2bMX~F6piFcXH zOJd|7RWmE#n2w91NBoY!2?xhSP`Qpp&(sdB&(N8j;^8!k`orS&d&P+YZ2YG852UJ- z;)RP_c(!PVw9XM-k;BnoaTkW;;?_~5IR0!C6E4)H(+%y=N>%e~n4b7k8cxv0Dxv^L zriD|tcrqWW07Vb(HpCu*`&iV@$>8U}L*}856V7?*a}g0(#M5>GrmgKMjhFBPi&S2Q z|97x4LDF(x-Vu1q_Qc-OQn?i}J7*l1$CRD&?-c(%uJ*RzqZ(5RVf{Mp_zf~1F|=jb zctS&vbg=x!gLx7Ms-{ji0CuNsc@2D0^mg-hrYg@8>)sKM-775{`>)p%;yA%v&$FkO z43+xf;O$AGW>PJ&%u8e|qX~S}eLTTgw3bbhu^nQffuGTHWXd%zSFp=R?EKIj3j&S* zHoQ+)gcEJ_Qq|dHT&}*Zq}PuqmHC(Gn`USQ;Btk2uO0S)qmo5_KXVf#{aqWH45{Hi z)*~AcLh)|MZ7MJ2aKu-z;JD6RZb~43_anFZc5Jcx$_S*2|7dx?9VP&ItQf#W7gvxY z%k`6WW>78S{q>7Vem8kZ_6XLU&A56jQpc0&5kT zAa3cb!`Xmy0+!u${Q^4ZtbD1ZDdzgZ=;KqSQg;JjT^?IF$tqYG`RnoxesHFpjqN~Y ze~(K{By(#MB)sUMj{X`(K(Z~<-XV@E5w_P9#-|WNgzZJFAgSZV=c%v=Y?WIM?!?x1 z0m|+18YLe~5okW;;JIhlT$I34_RdjNyt0b=vzN(u=K!2PGy6B$u=X!urbqdnIp1zJ zaCp?TnfJE8O6#>-szJ(CQSU1geHLjQr(}wF96rfjQ4ohl8opqmrqU|=!BST6+}*qD zEC73My_2}Rfg)8ONxXanEZeu~k1C%2H(9qTo|0!WcqQyKmR6s4fs}Poz7%Q=(LblR zCi|~m0O63!O`+1Ay3uZuPaUD?%{v319~KUkjfZhR4P-yPFUR1)#f!GFPt3P+x{~PK zS@)i7H*Jm>*{J}f;M^hX-}1+`Q*QGlfwNDbOaZgGv=Y0b8zMZ)TMYzPlWLEy`LAJ# zhtkLqEYkQ*kwFg%F5_Bh#YQT;!lHL{7PTY5N2NKs&lv>3tY|AdW%-VhFQ_BeCPqIS z9SXBy67tK6fk%opWQ!AD!wm?E6~>~0;DMjotD>GijkTk_76z&n7iK@zyu$k0c3WHK zv2mfk{`Kqsro$7Su_ykWqUJ)ytu*P9Dr&>HrQ{~f&oskFu0%h*<|jBh5F#yRQd(O2 zviY-Nd*BqGZCRk6Nv-o-WNeAFD*gvcWIN0ef!{fkBt-%0`Qx+?1HdLX_B0f2Gww~9 zLk7SUer}%puN~7(fcY=o9v>r3kg>sTFfQPie&}s)y3JiYgf@T$L;O8=^MUNs^JHTCox#sCk+%u%gmtu0yDtWY z^zKwwJNW@W(Y|rduTNu_`22Y35qS8cRm=robP+ty6{Wz@p9enCMxkhn2ijOLUJy!EQ9QvGK)+NM}!E!(1N(%=A@>0JRyq_dt*& zb;y-Iv6I;{Dp3ub2`i6z6VP$532;UQcG>|j#JQwX zz$t7A2#%`P!y&cRjwOs`oXEjN9_QJH;VQB3EejP?#2>(BQ}V zG|L@A2=OaA;v`uPGcGRS-9qj7oF!DtwlsZx$!w|7VHEAC7z}jktPdk%$;^Nh_x$_> z`M9#A=N>3N33U5(^S|DXm>JfKwtL=_0UR*`ae%<(*iT#*P~F?fag?x5{65k55<$i{ z?P|Vvrk*db{-yAmL5Ggv;AkB#RCGu8!fcM%J?n)b=dWSL_Qk=Db@G@$dkGXYLs zOvN?aTK&lQ+ig`s|n%>>zwnN?A@xdwPusAHYhA)oQdlc?k73FF$romPz6 zbWOQd6iJYDjZ2*6Fd z*fJeH7EoI&IO?&Yy#zSMecxm}{T%5jH#%cPZ{98E`qjNnN5{shd~)R3^sN&kIZhP79dG`8-%<}a+8vw8 z^-7DzDm}gDIO3xam6b+WXx1y~qsrm51l!b7jk<#3kU;xJV!5M=!O8gWgo%Pd-}cs) zZMbeY4C}=JthPw!ca2vAn=Ad^`HyqVNT@U7zmcfy8L3FE64K__0E1QYg}?c&VC|T$s7rE8LfUtlJt8hrVHNLYDk%r+NHJ zf5?Zfz+Far7{ZkiZF;yfcDcQo56&PA&M_QK0$^;TPKG3s+XS|5aio%x|3mMw^?303 z<=QayqhI5)+H%iI%33i8p=y3t{;I7NJj`N5bVDP?T+3x>J^xBPiL4vywO29s`~BC9+?BtCp*I!+1XyO+s$%5Z&s+*zIr zmBrP&BC=87A3yN-`E%{W2b!}xlt!e)Gda)30)Ac`nmIp=KIGnGO@jzNzqQ$>z zS1Gi-+dc9Ycq1pG+AS&(>rK}ADm8(080ovdH69S|Gq5Wma&|XO+lA)Mouy?Fw}R$B z4rkzL9B1SXW|p9$-fqH~iSU=_AMU^|&c6N(BAPGbv*hBk2cDm?S2N66;LIFnUaASL zeSAux7sgb}wVMc%9vN+BS5-Nt*2A1X>%)0ObONfqcPmatAA#p9;~ENEAk*)_c3*jU z5${7jkIoaWe_xZ3*dlGOSxJbZ_T?f!ewMgtZdyk6f#sU*%1PPv9TV0~;^RSg9feoA zEcorGqkVy&$&}^QU@1fT@aI0!3}8T z{yE^X@m#OJ_MV9WY%!R`kp{;~U_6{sek!$NuGuV#nN?|;b@?391!EML%=QRu(X6E*`PQ!L zv&cV|WWDGc0cp-t@~|%!v;CPV$+2oEntM^dHzXp8l5*F}L7`|%h;NbTh==?vEG#Kz zmE@OlkX3t<;x(^rO`DDsrCg(;!|x>uz6|wb8?h#B59?ua9B7Uc9S2{w?~|;AVdGf0KPOjH>f2XFT%da%zLIqBG;4&zJB_&`l>n8BwflPuV9(4s+G4J+@7A&DFg-#wDKg@^MK~8* zZj3bw7(#WuCvR{lp3y3A>Kz&D6iJeNdF~&&Wc%lvk@IVh-VAr2v*=|F~5I|x7aT14Hujd*=ABpEKpI=af`5qB{=#Odxj;2kKfg@8TDnOY19D<}T$^!k@x9H^g9Z>aMq_s*ODcut; zVo$gr_MSKae~l`6r=CaH84qnQ`dXlhOXpCE{*q^0ugPM#K=xLi%U+l~ex)d5WPjPo zlTRCZ3H#xUnsQ7|uQYL{N8SQgJbDNl;La)_nd#f%@39iuU&VSx!R=a&oyUr>A~f4_ zM(BVL5+MI7stpRbS61Vv7Kv2M$uZYqpLc(9wkO9VmQ%mX6cd3cTYWy;pMcF&Oh-3` z5!YyCi=?B5lf2)2@fi9yrcg>Fj(YkQX9A7wol~onO|AA6Yr)qq)AC>7>!S4zit7!T z$l52N?`x?2(%&L4kcA(4=(mesd;059mVTx*_gp=-y{DJFjOKBVu(?Pphxy>?W2$e7Pxt_|CGV_1;nycuTftAYW()b~?3$5cB) zZnS7Pt`!=jTieyd0=OK+uZ+J?Vq6$}RmP}#)DL+dfe2?X6YaRF#a#r5p}v~{n&?Jb zY5JI3ELBPs9<+=|QndIL90@3H1@Gtkc$R`+FHqpA112oC>Ug}=>!d?ZHKX%n;S3Uo zcpK)d5=y#7^s?@?tcN>-#qHW8xz=)xEn_)e^!*)Ok)dC|etrA;HM2A5fOUIE0_0R{ zU65}^nP~|9>e@c)=SjmbJ!&Hw9VTtdw-e3E7E|hR(=mGBv4$tR{NJz3;bmoZa4YlS z&JP1{8+Ov)T8a>+y@&e2^&O(rA=f_fCXYumP7%#pXUetxz$&lB;?- z(xxZ6Cnm*+ty}t94hV;A0$?RV#xz;!5BTF0^@1+CZMq0a^~Jp@a!ZmT%wuELG8%+o z>dU83$zvJUr!V?{9;Bi9dHx^GA24Q%2JIWapB-wmPR6n<5x10Rvoxe~;*j%4vq~4E zD=I98`=b}%I+s`u`LBuiQTwYxVOU_)*57p!%THz8MJ99%MC3S(GdT&5UR*_s3}wX% ziJ1uTzg|36Zl7nfEg(Iu`!`k9=r8NC(N*iXn-+hS?u$cA@nc(NcyjSKnqR`8`3>w? z$N6c*UnSS}l)Ik4714twL>S-HeO0YSKex5o{CGI^bJ0_NF{8uiYR3CspVfpARZ(=y zEa2#p6m^H7j3n82?S(%c+yZt)U>bWv_UX95f2v9Zu2wXLNi4`tYt1WfHnE@<0we)_SDe%-CpX^23vC%e< zy+R!Qm7DWQ??b5bqCSb|9&OU*(t=tX@N;AZCP@y`HckzV%4;Ip$7J|=HLSAW?YdNL z`f^VztkjdG6zXxBl*ZJ~vJ~E2)1AjG8PDd5rNwZ{O{CCV?A-63>-CDy+QNvV-#{x% z9!_l7wXXDRr7|6NbwHJ^59J0kE+urdUiq~NIPvpn4;L>fW$ z-f(JpS(h*$%UMXi6zxkunT?Ho4E}Nkdzmunhb(*9Xr0VBhf%Vh{5so18lyj@q^YJyl zzdQ0cymodBQw)ZpiQ6*Ib8ZHW3`k4vr8~z0U>i)KA0#uBfB3l%)rUByvL$k`*}j6s zq;Na*48muRoyi0lNS(+}D3Nw-Pq5sENNt#28p&Q{V@bGTTpo77s+~AUu!a&U8ATe? zC{`40q*c7qbuZ%l5pI7cw5#iWoTB_HYfCGx%*HJk9$6cvq2gVbc+KTh^m|3y;2gad zf5=_;eAe*i80qGpNvprhr9V8^caHg!(dr(rzZ0D(?|Lz=%zluM|B}&c*QU*iS?6l< zZNkU=Lws1$M1(M_w?r{*Vgk74SZvNoV&G1wfbf~vnx6vg1(hcSNvg|=_uWse%9*0+ zP&JdM3bD32{3W(<{KTasso`g#JYHRu(0I3m#l~vy7t0BQ?J+t>o}_!vpgeHTOe*T^ zIu}^d`-t36lEggOO9_fhczhWIK(V3P>bd0jcqKaOOWt*E(sD4g4 z0o+a4uMSe1)&A6T2G?c%%qu(Honb-)J};I%HL8C$zpvRYyl_h~G!7_iT*?&O#DgLn z|4|N_tYH>7SQ2Jj3UZ(JN6I&37k7e`UN0*_AdW_AyG7iG+*<1W*nOAVuuiAq-NqZq z7hPCP{=u*3dyS-bcCf`)fvN1fR&&vta#EMbnnCs~`22!-lf)A=`VGwMbB{6*GxN!XHFo9Prp4Yh34iSOVOd0_2v6}>kVA^aQs zifa;f(Q<)OxN05JWa+rtv@)x0$AuDYgQG-1b&F zR{{Yg8s;uI7$?ioc1I>z#3#ZvrY>N3>F4xBc9Pkno@lN@rFXAjLfiHaqZrjM%osPX zJ$+zt-%Ec2J6UhE+_f6(Fp;U{T7no(vmqWXl}zsM$?>gm(` zP>um%pJb+X;DS6f!}4BAr@To(`y|yIWX+83lD4heiGWHz8tWKN@kVVT+2xyMt7D+G zrm0_vua3aEa-GYLH8)p{8uxYqXB4;l=;`mUwhgD57hfC=LP|!AciR>|dS^DLxFmje z`Pv?>1mg)BGVNiRyqb8TUoDLhWAnljid?2FM&v>UE2h|P=j#Fz`h=&6lqf>{B_(vp zSM@>B;T#XML)Lu=9%(}9esd3skj(0W>wB`A?p00haKQn(D_)sMluyANJletjV?A7PTOPh)5TL-~=gBRglop zIT56bD7}bChY*@{qEzWqr3a)by-EvGB3oj>PV zzo%34-tY6=WsGr;myyx(`d3>aTx$NdrQ7CpLe-R)fLg-sKQ@j4Me&lm{WJMkDsXx} z3^d$Y74c>FIRd-}%t8{^-G;bXzdei=^~>`X0IjUqzvhI-NFK-7*pM^?(eOEGE_l)W zh>vfj@Tc-6C#Yk58 zxDEPs?b=Sd)f9Cz+IgfUtaUS0y0U4=SR{lCV0<#DA&H}xIeMk6e%|`R>Pk_ys17t; zUL1P+a)Hk*%i$bOWM&jQ58n+zNQZSI6+u=;3T}8i#S_=ZoaR%Lh?@F=3v&P0h7_+csaw()*tDGJi0V z>g1Dg1wDu9&#<<+%Io2S2>i0Kw+Urtc7)nb#Za-tN)>JLpE@lCre$Y&ChxTH^ssKf zXjv_oXqoiufUDM4|87boTSp>;H3A_uh5D0k+d8v55tfIE2HqiPsWPn;-%PUP1#la* z+1)l4k2IMjwZY`BM*FEG{y6)-md^_3%;YK5HxRQ|91e-S4kbMGTsiI|-4^58v-d-x zV1Pwd>?{?Ob^F)Wnncy^tt4KgULBF|)44QqrJQzkjE@#nQW$3@?$Bvi;c*ZS_kQjZh}L;Kb$wKijUk#c%`s_uunB2jUIhXR6vo@cJG z$-E8wKG6yyJYlcx?Gl1m)&~)mC3;CpKGu_9P>e`fkr8SWI!#5-KfT5p2B+6Ae2;MB zuv-NG;aybHciY&$VI_t}b)IAS(Y-$|f4%eNu8fwEB)KiJVoH|NYUjBwp}83Kqx_)} zY1Y7+p1<^U?~RB&kw24c&dfAhfXtBS{Axa!8sLPc<;XB-6p5-xg@W4uP5Z|pg8WK%P)`)U}2$Luj zcDc($2Xp5B3FgZ17=wwC!-PrNWY=7aDyiY+UH=UK@aCyVN(gl|i%!8IV*HvkbfGo% zq@hLf$=>Qv&!}37MN1`QW0ic8h8w@fnr#5|L0Mg zMKfv4fPBgyK~xfgx5UxaVz-~nkaL$@S(&5`(obOunI;EJ}n-U zCmPvb!!X-=%~t&)W{+cPnS&N4rW!Y>wwlVI;S{WJqZY?O#}}XEGQai2AZl{83-M*H z_0G3YYEah5gj)nl;Y0BlJ15Ifri|B8Erw8;NZnMCn*JX*oGemQz>4FytXL&l-o-C(NC= zsi2}fOoq!NIaD=CEl*LNrE{^P;x^h#YX0MHT+2J3YIrbGeFj4eVxY!{dy%t1Ey?Wl z(A`dvpX_q{lC%6i1y}pMqaX9T>vdh$Yqyygdqfk!7q2PRkkdh@mj% zG|erd2Bl~=%y?y}f~p*bwL_(~9BqC|--z|b+g#Lm`KS$TavyV;-Gi8%*!mWSAkYuj z`q@0s>R*_0Pm9>uwYO7jq))f4p&TEft zS+FtE97ti?aU6Hjq9y^~eT|fu*zT{v z=x<^8>QB8)KYWojm{+uF07ER89ae^&2kn1h)wxFv%lG7&sl5n8r!)B?_5Lo%l=I=KMsF*l zS#yS@>9Mx#aQYHD95_`3k|P8XAGq`L?j32})gWo_N@giFxA zG}0iEc;1^33Bc0c_JtS?)X(1Z^D?`=e^oAzzEpV}2;n)lXt~F{4a6~!U8n0E2ORPx zSEsHmoN)XDp%&N7hfzQ=wWSC>e`>b*hNE>j?jIetOa5QctnbTIbon1ONdh#QJwXZl#p|`Cx*yCSLX(LK^k3H+D7LS>yq0fgn*c^^TM?er(N5sAK5Hp4T;X6SA z;WL{oE_>Qlf&uT)X77srX0D?>2Oh!OLVFYFflt6=}{tt5^-b4`7mT=M*+bYLz^?P{`9n zDrh7GT1keq2eE4ZGY|rm>|U4{!$o`d1sxnI1wsz;+N-T{5zBhYs$OJ`(!@UV+<5>F zq$J#O*d-lCKFQu4?x6hVb`!@kqg7k;*ZgficeRdm7%@34v|P`6N&H%JSurB@!}Bi% z>&h#`r>qeW&2cH_=TF*FT@1sX?(%FNek4^H&q?|VNugDfi_(5$yQtRt_Y+iTaAtR1 zqSMw>B@!O`*ZmAfqZKOXDjNi3$-=56`Q=b})3dAHsR&Hy?b;rBP7F$0OQQG*QKI(K zJt0zpw00WYYmG$1Fi&6oN{|YNBBmy1S24&Qxf8LaQomF3-XddZ6n>{;zPns`^YJBJ z2izcF7Ra8PDu1SL=TbQblp5Zs>P1K? z98UkoufgLL`xR<{FV&ye8`ms&uX-) z1a9f0jp*~<-igaMC^QJ<%3m#6#b_^KFD9Q zXh1QO7ga98ORXi-g>>d5+rD?jVGe5&k@VBQVyaQn)tmLg^MWA1K1C|xqt|Qi!Gc$X zIS1(=a-cqy3u~q?e9r79{h!ig#Ej~&fy;URWboYfP(QI>JRY00MMmk``X}+OIvD4 z(>q6WfI)?AV@@ttf036YfDPFBgi9-}wHv!~ZoNA(s`YpeYl--RykjG7uZPPTGD+bc zD89`(sL)1?2yH19nz*ENIT+$)ihLr%-`y0eL>I_?X?Ce4Z0NDfEzYIpIOodNYHk}d*mtF zt{{VdUHB00Ia|?OgzhZkvi?+jA%86Z_}?MYCDVt-JwR-23M(Z)af+*Qkxuf(IQCJE=xiykl*uFhjnhpj4sOF<1WWY4!{?!6JHJw|FSWaW4fxh#Dn$ClQ;f--U&LBFu zLCM>OP=~79Pv_dHp~msFJvk1qdb##EL`-ssa#drJe^30pD^Yb+4L{tbJ={K}nQdV< z@#j*iuNdbo-v42TP**!-x%-u3yxf60goc9zI)E9Ky=>ifNM^|Pg9b`Va*0UbS#xm% zRV$G@W3UJ!X}bNH+2jiuR|UW2j}KJoIw|AB)3*X4i@YWhPcTN)CsGnsW7UtdVM2$` z575t>>>vgB4TZvWiGd2ZAu3ccuN%z*eMLqRwEf{h3tK@g94x4jAc`DDanLz9bH4;M z&YPh(+8A8)`H=5Cv%Un{S#o{;BC+^m_X|2st5-=t&Xu#y)htkgaCZDq-4vd;QC;Wx z08|fmYBBs^5YUH#)ZPg&etvdSzE6;xA1AlPJ5 z+U9P+z4=yC$C(#ppX?D@A?HRb&D}dccZZX;d&CsGW<-vkH)@H~f7;%Su9=HuA=*0n za0@;xPX6jPi>P$?96a(6F@|+7b>TpX&ri#oh2fo!@;CZ5>{1RJjRPS#{@%T-PiI?| z>$Tp@_XR~an1`#TBs7oT4C6{v%U?Auv`&Oi7!OyPy^5zZ4O3)p*uv5Eh#8_S&#Qgq zI#PN-D*~+4q#`~_(XksJ^4U++auvce$8!l*YJ9=b`}mGZ1ot)S>-vv`F*#R$kI8ae z-Q7+P`+{uOW8w7FDwFeVk?dEbU)h%tKH+L(@$*rcO3@$T90f-l51-y(wPJz|iWW#U zDW+J=F9BI6azzSB^yK`fN6wz3^KOwP4k)or9cQ=Qeajw%Fd6uJpMuL8a1P$rR z0K?;Ia`SI8=f==_>-l7&+FVz;ci105n%Wi9d8o+*lQMFqtUX?!Pb!5c05%NB4Nk;B zfW2UN>=E(P4-xu)rrFloORlnH>L@MFh=KerN8u73OwKcILt=ePZsL%zEpn2tf-tlS zsVE#{PW3Yj5G5#FY071LKuc;~Fk*At;otJZr2*OO1R9g?Te| zaowpL#Bywy9%*s*liKIy(^VrB|5jcM&V6v-f`kJFWyn=cw5uKAcLqdeBFL?HLN!8< z@~_3p4^_1rQ$FLTsgUCTKqQ^|Z3A%X*(blc0nu=;T-AC0KWJf(;hv+TCaAF*_hRl* zF`NG8Jr4zx)Abj~E89Kt`+xgk%Cj$8aK2hgv3s>ALN(>0}5s+T<%&MXr2Y9nJpU3oSP{-MIhXXu+| zV`QRr=5seW0w6CcGO}N^*s5a{9p|E$0x6*NtgNgJ3E1L3v-hF6W9XJZ%0-g01Jx85 zHIhaNm6H5w7f_5C_wa`jY;bMf^K`JMpH}e@H!}nuXCw7TD@VcpX!QAuSMJMhaGamz zBI!(7B7-`KViI$8Z{Y!L5mSGzrm|~eSJ=*a65OImh9ISnyA!hf<(n&oLcRK#9YG^zjRxZ67mu!ynYE%Hw8>QyXK;Y&O?Kl4bZ`P^ zXfa}doqogVKz_VF7P^VYvN&CW9$Iq&2z-Tex$^qKVfX@o?a@G#CO{V3T)mchm-)IW=3x3!C-|jsB{Lw>#q70_h%bgcyVU@o z9#{bC0qv!{kUF4};rgYL@gvgDDh5=6*0}N8o6}hmAQdY>Of{$Jb8*^ClDV+swUkow zp^{jAU5=+J*K_pqcv)kec>(7Z#G7X1P4C2y3=xj3hyR4G}DFF=(`621UQb`61q_q5tXejSS<2}dyt_xS3Yq=`oXf57n7 zTD?f1LhhSUPthGHHD7@D&NeCixiwW+<`oJn&SK^H7|s_dR>F<|!`$IUZ*w_D{M2p*1r>$y`#l5w{ix%xOoqyH1J2Kw|f z)~OR`2a7lBQ2%rn)k8yR4+08_W5yO1z|9M=f=(pnyL}JVk?4k_F{{*u)<{H1k311`JdtSi@q(t@ z(aphJ?Re&$z^OfKwzB_81SCmtw+=oZ9gR^yNoHeN(weW3L_vTqDOG zQV)8V>KwAjOR2v)vOZ85=jh#A{E-O9ZTAaO zblJ4{CIQUfudQcpuJ854BNR}%tVBX0J#{;!Lwg9~=F>z(U(7Rs^8j_%XpnzobB99{@nR0+3`?D-0%C9JU%8%qu9!zV;fhe{59zlefn2WnYoq#??`d8i(K8Re zZ%vMfQ%LvmpwnnNO;HRSwc$)&b6uqjK$4V0mJ5^3SbjcsQ3%|wbj-XadvXboWCT1E z)b=hr29oR;Dp9<;_j1+pM+BCFlw&)mzyq)#!XRLZwPT$ZApLZZ74kHWwxc8H5)pUG z9`4x*;Bn6UhZkwV^`n5Xt>TmV+u~bvrkk1l>Fm9x2QTh;St2MqwD04gFj|;L!pO!m zT@;JFC0UGMt$gkTE3eMfr!eRPI)@BpaNAVgY6%3sFW%`_D%j|IFOuB|1YTdCu~p2c z64ijfMwT7?D|{?aZ#X!7|N6OY(TL3iu$1ufHR;C!71XfkuSC&T1{kp77*NogaA%j6eH>2 z8ib@Wgod1+?DGV%C!#nfvYv%PA22v%gnp)XTz6him=G3h+$X4xa0F7B z;?OM)!aFTaoQP#*j-LbQk~A(5Z_I&wh>`GEV^Tnw@tm2gi-O~@^>y$EYfCoAd0(BL z7Wj-A#J=~LQXTyMlb^x$PvL8$i&q(Q@&a>-6&t=A$L{GC`Qj{@q*p9+H1{GbE%8?% zNsBJx|5c%sp@R+DCWCor_4e8q>VwF?0wM8~JnqF@m>9u?i}P(!oqV9B;t6`#^!!*> z`^mU^P1QAWW@@gU7WI%w?= z>;VVR@@KBr22BN+4}#csztfoRzl<1|I@-X_r%GFrPR7iVX=~~WZ5?n3#9IG#2%e_w z%yO`B-zC1V3|}45Ib2?Rx=q6ga*{-?6BzcApmtZfklBX!{!a9=@E-XT3LjaxB`32M zOl%dh!fb0?ADsew9{^v!UwB2i?mdi+H-!w2_xQ7H!C|lj>s+ZRFm-dmTAnay3#nM; z8Q>Oxsf{iEe{){hD4=#G2kbu{A@stDnr>kjn1>aQ6);te@OOiM4Z z4i*O21^E{PC zVQ_PUB|I+GhPU;?7{PebwDrk!5?uI z3oh#$_`s|?7#+Wxt&C!w6QmF1#CmLzg0{_E~VAZ1ZN=-wX0LddGaP0Y8+yMqqr@!fA-=m>dmTGm+B{*}@|eNqze z^{zk8?s?dji9xtM&Mc$F|125AehL9cO&{p6#jW0jOt_6N4=U(x@W~Sl+?ssnug)r3 zp0Te@~q?vCZ`N#$V-6 z@WTvP{xh)#$z(5Lk8%HaxdYIFw6K!Q*m_yh(*c0{Yi**Xa{9(72(Ego9{o+Gfk?qd zbyuY5{F zz8*j2(MSQcja3GsA5pTn(^lH2Se_c|`Sk`*{h!*sg-Rv{mmi|;6nYYldc*>rPt1dp z7W^K&j&sbK`oBH1|9c#*rsYc+Bke?RB3Fu6hYf(R>vwJdQcuGwPR#B3=q+|GOazDM zITfZU$D0_w`5R$S&&itCbUJrU$Iz$+=G`|(RPmsWiafi>1P1t-=Cn{539|Uv5erEA=wB&Q%lK`aD+A_z)tIvBNGqK%IE>(U7s{D6*fErIm26RZX zBVegn9y0315dyuK9hes+8DP21qlv49VWXZQ$H=d%701A&vbHfSd z%<~j2p>5BO7&=M;nQ0Br;2ogw__9WueXyUwb&$oSLG$4rITr>xDZT2xicIJcp$WLp3fW*x`FDWI2h?0%Xt8P-EYK z&`Syqk>dFM^zGAwX|6eE@!tjXh;EkrtlM~2H)xkyrao>p*eqY&|uYf9_l~2N8289IQc| zA>B9zB&k9C_j&`hWU;e4g3+~sMaKE!yY)YLfRosi%&E@fVst(EaDo2$4kEE|I78RZ zPcDK@GO0@AiPtjP35aRR-hZcy0uyE3iVPS(uFy42OIVvGOHt7FDLBM3om$k3iZ0J@ zW%`h3Mm9f%pYVCOPh9C}xma9u*U92}c-u79tYT!oleyw2 z+0^h?gofo*%Jr2nzZl#0Ya_kU8N=PdPV$TB1wNTQ8P``9D7zK4VLUEEHr!yljKdf)AOzK zJe25Y4a8hXv&|jKVDTeG#qEnzVfGn*bg2Iehy8bsy|94hT>Ly z@Li@QH!WgmLqHE5Z`$A@QqPwAbK3n)uvK!@eZGpHW%;IWH06kNtjV5IMu=z3LZ;X| zpIzWTE)+WG#7eZu8$J)Y!V#=HKAkFemLaz&tAB7YVp4I}!=vWYdl-G<7<39;8cddfg#mgn6 z4f$sV%PvHS>;RyH&f=dj0n9i5PA+;dB|+LEW9ShK7O6kP&`z(aAsYh1eJW)Qd{)2& zRuu^0?!~)dUA9-~MJyI7#jL$wEbP|qZl^0#?l?We{9Ly&O}31_I>3p9XZj3v{dfbxIrm{mx!wwqO?SEiu%PgdK+1d3a^`yMXjhxTIkV4$>+8Q_M+6oJ4nUgu& z9Q?jv$4E<|;h$reM2)mZHuN0YJQqjY>gWj0ICZBN^j-LaonYwf=27^}KyiKLhKYlc zxbN=v&GhiC2IWA=!)Ii~6-jY!sx8e?rmoYYkSs!mlO-K2!vV0s1Dm&kVX`|BXbEsr z?ishRU?UL&-)+`y0N#_;Y4Se{W0*Q99RJRYEau3zx}G#*;>{@TFm8>l2da>qXJv5} z$BHS4fdYL|)LdA1rC~0XN!4cyyf7$uVdJ~(u9|AKImWo<-p>OMduIv;(#!$|o-d!A z%q)&T8>~zfbp}7tD`zySpNjgO9ofShUoJm*wH4Cd&Q;Xqj7 z&zVp`wfcCg>uZ@{!uFGF`(UN0vUA9jN+m~&SlLsDp%Wh5f1z<9A`Sex$Ai`P4%AX@ zX49N?iH5{h14Fh!k)@$mHdx)OLC6z!eR5oUZ1x~|EZoImq`P;fnLiC|62w;=bARPd zSS{D+N`f!^+*FCM0x~ zxndqd%mN>n8yJ>XS4#u{@n4~L|5NGydt^WrES((n2WFRDjCyK}ZH#Aqd~?IBaa-2Zr!wG?nxB2JzoR(%90^-KL^k-|}pUBN|zXc55b=+{A z(4A`;oL6GuA7G4s8!X~_2YMQ~H05bR&?nui-m@{%>8dBHWzI>tZwzd-C9tskAI04^ z=jekOvW(w+a%Oj3HioaImZ{}*{7VaP{4KQz&C|^drm)c<$i3FqNR~yt+fnZorHQ?M zPN36#=VPlkA(F=^p>nMiME^OhDy#=eQ0K}n1xYI@;jZ`pbJ{w_hq4F_6$^nSoVV?# z@$qL#c-Jp82*=5y7eY=$b$>-2w$3zZ7t-IKXde=)lROx1?v*m=c|S0k{81KslFrWn^i z$g^CPa+Z5b8f%x?I>A0Rd7-NVcF$@&6AjYFbT~jIe|OXWcG6gAZ2+h<1@yZ26nUy2 zmO4kMTPH?SRiIr$c{~@M8JJqBtI(XjAT-j*hk4nk6Dqa(*=DFx;Sh3hBV3y|cBVEG z0PtQ~jS*gNl1#5kF7r)rH>#8U(OE4`Baf3&GrT%BZf~6`-{=69Zjwq2KNOng%y$>= zP}EK8pH%iDRsU^>P z=@x{{(Y#0O1f}@_TlXMnTBB5Zvi_(isCnc z!yr&Tial}4Q#$H_NQ$|44xx&l#^NXt^N-P&qS*>I&}(B>1oCJZhB2w0u~bGIsH1d1Niy}uVG9TLN<2|F}8k;obtqRYm)W;m&bs5~C6z~U%dkguk((mmJhpH(f z+EP}EtwRcl$D8hx_imegzmNQeHDz-Pgxu2zW}<%N5=HGt(8|agH;GtkTu#lM{_&x; zDJyb|^H0@Obdo!}Udc_flU7#^U`2F4rSjH)P2i^4?YpR4(#%c=%5g6InD1f8c!vwY z%?_dcT7N*J)Gp+iT#aUzo!Y;U2ej3@C5>H!pu+Yoo0Qa}o(d*8778{P*-n&cT!0$# z{B^QmS3Is|YUFj9&mRzEc1KS*dymw6E^x>FD&;i}N`eKhRtGsWvD*VDQ2!mhOZOPqWZD~w$&T2fU3x-Faj#>x zweMQ|Y4BFDE5Up$Pxa{QCv`}Uc1>1=GhdP}+RnQnFg>7ubRI47A`s#hHT-wRS(ffn zAm-dYGG7(*p6EQH5oRUNRE(~YB`O9Y*D0)E4aSHpEOOjsL|)F17Pg%*W(X$@Pfnnr z{B- z%;hR8N?@}VYMrxJ)g5nqDLhLb#^og z9N+_bIG*L`L#%pCyW~4mQdI=H!{HwopQnzb+TgSHfniBBfT?6Gfp-bsDwW7rwwGE= z0Z9C)!9fTK<@k;OTkwA7sdRex}ecJ`lMe)ZzNxl@sHG9~=2w z_cl9!w9iEqL4&Hf`an^)#@c5|72}q_gwSzk{i>Z_=BroS8(6vHo@MOD1tKR~0M{NO zBn*co9^xF=TQvQa+@_gj*DSpJ+>#48iD7@cCiFs zU`HgU0Ntm70cVmcw&pDlD0H+H0MTlZewxga^&woK!n)4-1vT z=_jWO8WPd3D>}AB+l2_V$xL0^x*lRVL{qp;4HMj#=7bsSx!rt{R;g+D^sYSkDi5Jm zD+O#BP5>Cpf#$rXur=tl-zF5GSWLyP5?oL3#c@~z$souO zVs$?fgQMACwgQ+a*EOXdKyR}``S6&Sm@I?PKuTY+rGmL(gI$gEGl7QYl`c5@~wvw`Ht=1g+;?nb`1lF{a zpatAFuAfRt*E72jnj?O?|K+KFtH|Zd+Q`f+E8(;hTF6QfisT%GaoH*;2a@1RTA-Pb z(wof!k|1*Ii$}FLK16uq!#*4m=7KnUB!|v$+eaixGMkKT$61)13~Hx$YzYUbida)y zr8@DjNj;$qqTi~NE2D?K*KLvr4NyTj_3M^XSHbBcGi^^=^9qGimLB}-yoVWKCH_tf z0<^GXok(Npqq&!1X(Rgp&EnLMCeCtwz-HeDFXFI0y_Di#x#l@IHuFkLrb(VRb4rV!#licSbPT&2D_7gRZX>0Z+dQ zd$l=51{ep?_4G&w|l+9*zQ z?K>3Is}{iIbY}`!OSxN9g-M6e+s3LDh1A?gvtqz>MmB{al7L4i)~NtI(~@}&(>=jF9sL7FFtjbueF?WkJ& zt^rkzp!ak_-xP7%rf*oj{+DUbFQ3At)VuLB$G{3OTzd1ktp`#52n$#sYM~DeyG&EZ z(c9cdxM87bd>gWA7v}$(0?M-zDnxlMrZMsopI=RR|9dC+kB7@vZ*kYy@?_q>QoR?( z2+f;+(6ro`zb5`yia~bc_@c{)W0ho7ri0xGUeaD4qA&T$`vP#}kyJEI>qfcTw#EQ> zsb3ByK?@^iCbZBwIIrfK`Xo-G9-=~H!hS_FOJ_o%$EcKEH94aCP_EdXXvmjHr>`GU zoz-nh7A<#hZcu(hOz%JeY+-7{w6F?$pV3A z(oe2fiHTT&5PpI5gEa3n7qITI-1C?cik+x39+73XoVv$%r7AB}njn*GS5p--S3?e& zg@6?(!i7~-DcAF%_C*_9wy%@Q$;^8YJwr*klIP0(lH!&mnFc5KoB~Q~B8^c!fejqZ zjd7MRB^oHJIW`{_ythFOE_&tO!S}MBCQ*_4%b#5=n{}2If{<$YI-u=7-&5q*vV#=t z&PkSH#Mt}3B2=T*wy$%%r7L)^O9qZxI|3h;x~R(DtLGM2jHm(<3=>7ef~$bAT6u>E4{HwHaa*jW9h&RxYAp!(jwGh9X(-1=}2S z`vWMk|FO-hd0;TM$#(ZDz`!sO+<9a{Y7=j(E1o5}nRGFm{<%2YRN{4NxV>`>P2ZVt zEYusS7Ub6EwWXjA&EixueVOKfYd$3n_G59jpd@V4WH4YR~60bp09oiEc1w25#1xuppd&Nc3H{}T}Y(qD@WiK{O)aM1IZSj6e2vm4~&R{pDLZMV{m5vdW_M$L2&b~GNZ=ZEo&PO4EI*L<$td58-r^v+ih0CLdJ)niZg$oK+s_yB z9yku6CnRR)ua1|u>t?rz<(@l3h?_J&QsXoWpfExyR>fQX#*M~E4m}Fb%P>mlB^~aB zPDA`vaYO$Ombk#8_(&a&h7me*|3Jojo z<`y-o?_S8GdkDC3ntu*E0HJ}mpIxl_0vl2-ek{@uv`3YRVA%HS1oM6nsq@iYGKni; z<(^1r^eNKmk--nT+@a-}s>E5uH>MV&#VziI*_Pn~qGvWQs?1C}NYj1Q7I(jL-M$54 z92@hK4N^m}OZDQ%_%z)seJ0nZkpmJ40paVauX1Iz%rs?yjNsZ-A#OD@vo@_d%M%tW zMdbPF%k@tkQ|F(x1a7TY$jsF&CaM@`gUOZTL`cD8{|~_g?!>_3ksC#d=3G<_0sFtj z6Ic;(`6v@=-8!H|?2=F&k`zfwuNSKRuaN+le7$-(@o?>Zc(+xJ)3X-3L{yLCFkhjE z!a2Ai?;)gWL;yC|q$~2c%5mDVY$M@{!69CB?~CojAnxIujnHIckbSSrw(6VAI#@XL z?H|S8IRpBhV6M_floGKa(F#iexVw%b@syJu@@}>x{!Gg$AJQcqP7MWuBrhb`ae|n$k%Q zqj>ElIwL@%!=2iUiHAqgOt9A1j)8cUjaNf!>%T-n+Dv5S#N5^^Wzq5}-CU zE^X5YgNAp<9ivP^>_j zW4VpxA-!9!3NT{79{`JX(^Us{QOv zPX=Ub4>awSuU^v`Wmf6<7;(fZF2P|rEt=fy{)*RmzCB9oS$N%vd_WfS0(Zji&k6WD z(T~KPv@-e-KA5)K8&%Mams_X*2uTQ{dh>jUNR_YKM1B5Z3txM#A+y}^q22lR-_OHS ze5jq`1Gh#C_=ajjuL96;ekav^%cx?7xco0Iz++;#iLTogxrId!%hmZVl7})mL(sRU zVCsHf$3om6n_ZIkiXrV_1%K?C@x1JKs)Txv_q2<1B+PdidO;t6u8n@TIgacNZ##SN zA3*`;^+{qyG~NWQ2XoRj^wmxlZ8>=@rp$2-Z?P^f5Z1q4Vp|_RG2DdcZXcoXRSsq+ z-H29r$~`Ae%<-~33!F1+_Q4IkJw(S_+U?PSp5~RGzUF5;4R=e<8aK30-_ROS`(S!0 zzQ~78_-NA6cukW{oAc`aaoZxoGk<^kM}4$8nOdDYIRoRQ<^8u%l0U(<#|-DRK^OXH z-x5Dz6@nzLXw8u%)?VTP%ixT0%&P1x7wXp^MMJ@-pUK{Qh~kj6Kt83jG#cdu21w3Ef^(24z$06jk zRibbbf+GSVFSV2fJX>p@m@L7E)JL(oM~9*tx9WW1ho&d{6Y#~zBT5??ljEC4 zlk=?ZY1n4F?IRIB6qAWTHGlB%SR|xz2deWR#Y^(zjce-~{yhl2ZA}x0%pGwLQwUyi5-ZM96RVFrVij(#~et5(=db!f7J6_d44UWOk05Xu{&N?d3(q z?d6u#e|!WfPn$QQ8`Yodi@Oa+_qVC&d_VA2PqV*9 zYnv9H!$lXY3j%tG$9s0^x(7v+@ZYI~j#^=8Ty^`1MqIXg8{v4Ou`)(Dpv)!Id%N=q zc@N+AbzCx~g@G^Gk|UZpohE_ej$|p<&pBgHa62yp_6Y7Xu6+PYjGxR>i5C#|E&Y|u zcpL2Hq+h=L;OV-ISKc+A0?F~pVa+RGDmRpV01Thrd_K?&1Y6zJ*FIrTWpBKJRm?82 z}$&ii95Un!&s z3@gaP-Wn(5Zi4k1fJz-dtpAiiGZE2KcvV@6Di<4g_Wj_aJmv@dJMo zZrkq`e%awMH-1J#&=0<%oIQp`c($kldl@n|DfsPlB^*bg$HCkqU^DgtOFWJK)LAA$ zJKIVX^Evt{*_R$PEFDZKhTmV{cd#6xch_;~ndn@d<4S*d*{laUIiwH6q^F{)!)x>4 zseHaygBchf{p@+iA{h2zkd3$-QA)C+^! z9bM|e4bxJh)`0TKuS;9sl)T}M_lCQBm*o>T#I;Tq|$ZG9QDtGwTNC#4CeDkJ(PP?H6xR-pfV)J;LSjmh3HCxH?3K( z^SlPR%QT_KtYd$&#OBY(bU#AJ>mJ^+c z?A#%!gWn|QX3ziSncIlNh|R#lt-AOUAp;*wq2H;UhuM%FS;n2~VaFfyXowT;_9WNQ zC(TGcaUp|>*EmDsIGxKv80TZ(LmHm!+(Yzft6^HDqN<4*eb-j>g$pImXPXp${`2rk z@z6th#&A0@BRf$WI3?5m^YDIr>Lk155MKf_-c#w#Oi#GH`xfa_JM_n)6NrC#eiSIZ z`4I^@@0uUC-1Ozka;O5t6Mn82iQ16Ro>MP|>3%AxEnSva-;2)mgO2y_L`UD&!@Hxu zLNKN~@O!il42DDDMEg1Fdb#|XhkJAK9`>`_9C{LDn<;W3x7B}LM(|;ir{$cOt5u13xfUcq?Q5jdb>gwoXDWUQopZ4a(n1JL{7D>pU{Ub}xm%Tt5-#zS=J0 z;L8cp&!-8RKfmsL=7r%?0-ijEb76e9OhZkRyl``ko^d8spO#HSp)Cg*!9m?Iyc3H3)W$MCv-kCdMV zU$u&?MJ-?V_WPC!ISX7ur4ghrRaMXQ7@j5RrMZGS46F3F5gF@de4fwQ?Wf;)+`i}1 z8#w8riAmJfn#kB&nW9#VO8gVm&Qq^h7aIQe8B5(wED`MWJ@)B&sfV7Wp4b>zXx(5Z zbYD_km8aK;gop?F`^()7A~MW3QJwGk3fy(9nWp? z*t*tNV|$X7!{gAwKy9C%vm*XAhQ%Zq+#4m}5Wn?AU-Fdz$yUqA=DRG>>7V_R!v_*G zMe@4j_Zn}Ro^tuSmga76aiXpmQ4y}(cPo0vX(G~_N^b!~Kxza9 z1O!BybRqOAO(Fu3F5Q6i4pKuWK!A|zTfuwZ?|nbd_v1ajrc@R{E>y&$CFLlK5)t-y(BzYMq|M*c@YAnKr<^ zxac2}GQr>JBY%$h8~ddu!45-c^gU{iX`2HAGYxgG1FCbHoBHbH)fcC$0*<0!hm+{e zz{%M^vn-OJpF5q_!hmXlnh$qCpe7QTzs(}-m!Yl82mMDNC1Wy1O>|=WAq6?ic7kVF z1b}Vax<_gMJa}hl)uJ)^y9bbfgmndZx=|${J(RP?_@uCS{Ff=%7HOVau`^=4FaSIT z`ga=R+6-mt6D2!^yNX5*I(DK)+W?Ee=*nWiycxUS& zN~gWYX0QU~W1y(gBQF!5>_Mhl*$B(SgwMjrj6NQue>T>R{kQ7Xp0gi0LvABFxfa45 z9Timiu)`QiD;qlz587X8T}X9F2*VrmZZxD#2Q(P&m&{FVh&Z6DY!p6SVe(r=VtJ=C zey52=nv%r=ex*HpsSR$tFA?0iqy>hlP|8+1!55Q5uDc@sR;-*K&Tq{d-8=)&9r__O zo`m`4LvwIfe;lQH3^R*Z-UX~Lp^THC4}+UE1_Sb5AJ`W~qw1u3yEkE5dj~yGKR2kM z_dm2D(zo1Gm2TuUg#rO+FYM&_q`ghNVPh20Yi;3gBX(pl4M5eUd_VGt@g>QCZS%Y z1ea`>gPAb$6oH=dzx6Hn%NUA6XTdKbCP-*^vY5-{erGdhT{B4dA62zaLJ1w&`1#hJ z9L&x|^pGu8f&bgs57$FYu&~y#kg;frX*Pk_1D``;2AkrGVKJ%>)OLhzgcNdp6EnDtM#`ecti~7~Xrs;?~ohamf z`R1+n&>prl+3dt8k4f_k<3^a^VKSJqexz24eC*(HFwpLvjW8k~hfGP+J58-Ygn!Gf z@=BlT-kH7q07`J>yEoZ2Ki6fInS}a{%Nvu4h zQIS)+U9XHLmAw3Y<=&D_PJxD+6us)*oj-3o!>&r4$O&1u=;NS2u^bp5>&=L2JGKg5 zUOj|qN(M%afRi7iDoIr2byA(K&jEB$uFNxGiS0hYj0+KkXYs%sCJvo_HQhBbX9@1;ek`syjB zs+K-m&q*+ay_kw-c4a;CVoF|(G3|se;%0)S#j_^F;trb1zyDeSv2}ymk@^F zk#zuuENOg9{u^YC<6Qsf$o%Ukh#&hCb72lbb$iJb&NO4tm7F|xNP|=HcVJ^gB{%0l zKqVBujR4B?lJIzNV+6&jJ0}H<0Dbz3+5GD68S{zfcQkUJ{ca!J)ocjV6ddrZ59V9Y zrc)pzwnmQ)7pF=xkUPXYRs@}8EPkCestBY(lg^&__POi++0@g5lT~h?ry{e?vZ|it ze)^RR$x}7`m`+JVHH8)q+WxEIHB+{Xg#Wv;D;{h2+PN!ie%wEce z?G^K*+N1g01>T5VW5-wKWwN9aR&zLZg}Aqj9kFaNiiZ)M_9LVOf^Mp}?FQ7U(8M>4 z8!Pj~>YQ%EE)A8phAXfPB%A{~eUJ_gF9 z`CSFMD8I9N2uGaUHp*q`{5DEnfmvYi!6+1)WHbWJqZUqtV5cY8otzt1lfUWu(cjxp zBT=C%a<2=LZVuB4IX-=Zj@ewGzS2J9+t$%>!}s>%+`v)A9PQ-x_KvTzF&GClEkq!^ zd=xNhBQEe*DbL=@Q8B}!w$eSp#n!X(WQB$W7A487@#?(BL2p~K5sidJ&I1=T&KRmox{V+AIKAYmYVt` z6qt#bONH(VNb<04#{HJJwpq^+Meme_1_lOd2?qzaKYiRMBqG9HrdP%J#a*1U0$;lA zY-LH>Yfu=)#-B5AE6>5~;z+d6B<3sJ(PYTByJBT+ zW(wE4-XVUcv9lSHo;cB}vNM}pvs$;KHX$EdHvwyGAD^;!hy%lbAx6geYN*6R?q%Q> z%6jur-u&>bE>9e}v!c0YA6AuZ=57XAc-lT$*c{zMfE5iw^InEbOi+#c%6R(8S=6e? zH5-bA!x!U2QFKTiryu#*_wuL%}jg1Wf0ZCRi zFP7lo(IQ+Se`BK-Hu4=6e81pf_lfrQ_CW9XllZq*FWL&u4X zF-g?`G<~uI=41#10jN?9){ELsN%i;++!VJEiF{%q1)WWVb}^XF860DEw3U@_^t@Yru%x7`N$S3)zy|D z8Pz2`z+3PsEfw)8>2-VKx)s{&)atbE1g z=t)EUog?sy4&`uWCZ>-?Yj+q~n4+iCZ^XtYGtjG~3W(Qr13PjKxCJ+NcQDgfGjY)%iFtP#k*`zUJ z|9K_$a8cH~xPmi$YjoiI`>_0S{^0UR?jFMGSjt>t{OEmZCg^ZQK~(A$DF270 z!Ra-)f5$^<3Sc=*^*WRG%Mu|&JDw=8GiRjGBh;{qY@?UobGyoNmOxA!B z2O~tbdXWaxJ>YLD{(M2!H02up)3dSL6U+krS_`9?Xd}mYRN3h7{bX~&{-X zlvN6sAp(us%q&BiR_9j;y)r%*!W-9{um2sQg{p=E6FQPuPD{}tF;K+&Ltmj-1I>PW z`CEM})AbYy$KT(JWwAK-mT5odxuS&1ir-X)Gk$Q8A@Mn`ke6_dIo`_LMeCAw_3ydT zT$jm};jC+Eld6Sur{Pr_sVC3JpNjkKN3N?$YZqz#yu(Qr8E7+NSnCXpZKtsW8?!5p zttxm9_Ldou@_en61?CpRWll-~xNCBUID1uYW^*G)$Z63wQZ@`VN2DmQ{8YIP$$1~0 z`7G|{Hfl>}tQw+Ce4dTByJe_4bhe8v(?ZMMdcKr-36ixRpGyi2lBjyjK1}G)=OMot zk5JPk5F^60=WXNwMszzxDX3D!_6XC=#?<#aJJXa<+BQgcqQE=qwxj?L_s^_XUAF!T zW)fo`14ly`ui8DR8nw(-WjKy|<1Fn}Hz3~7)>g{H=YP}+J|PcDd1EVCGOw~QD%RU; znlgnK6|KGXob&m9Vb|kwbK}K|vaKaFIDsv(_Qz~%oxaigm6Q`$a*9iDd=4Ng0H3_9 zu1isC4l8A@6A%yE<03cU>w{f0%bw39o5FB^B`hy@hluy?c$vJP93HiwJbtXBg{(HK zFM#`g#{_-ON~m`klFfAS4=7oI4kZ7Q7D<;++!NnLs?0j?u6bVyRCb?^Tc&qbYZwo^ zI_0jb5QeZc{Y9ch*&h2ep*G=Pt8(4(d%rA{;gdOL@i_Oyw7|Vw1(zoI z2-TA*CztQftvsu@9lu{bnB*k{)sL~na0p*S(f(eHlAh`$A5f5>8o)UUP!$Rm2b?3V zDCIIqMLy$s%OlLq6SM5M8rl%ecT=Zevj{)tkf7(QD;&dfApg>PYV>2^3M4!Ep!`-N z>xB99=LXidVC^0JJnxK5E_szQk3qOw?c!rOiVIZXzf$eyJ@q-cOTPS~tBSob2q}s? z({7g=t&lG{=~&z$nlxdIdT~?KOpIWWFy_PNMD2%|0ek4E*`62lG5n<9xB!!*sE6ax zfF$s!61OwGwH~Kt?rXTP1io1I;UW^J>-I$Y2 z_Pn35|64@{OPUkiL2ot;0rxU0BguUp1%LBlpSqQ5jg$P~*sm#=IN56(#^}*No@m=t zgBJkVhhqPNyClOKgm}xxB@Il?i#Pw+y-E=t=9SDrXCwc7?~ctBKg}bd!X)d!kIT?v z(wS{k>ffd87A3hTvW?27K3bs_Sjt2aW@2!m5s1OiSKr--ni>!;;Bh8&6HMrgB{>iw za-?mQzszCdCtKLhyL*e>{(Jnc9cF)O&SKunU+GvL{eh!-RFUu`5E5aRDgN^1!qeOc zPqcbWO3E``1KS{P#uV*LImIzFj#fa?%F0cbpu(h5<}RgknLVAT50@tE@m}~ypbAfK zxDlHeZ#S^)?9Q173qgnr4M1PcUO-KT$sUp-r%a8xLg7WTwWRMNWDHrlNj7|I1BP10 zt{91tKcNQ`x+12K?4c+f7Or8;Yed1hoiId|SKTIX<;VgQ>*4ev#VDdZK>JL))cs_f zyp-rSw9}Ah6FDsD{d_ruw(qjc>B9@$?e%~--SHehVU^`qmZ3S#J$F{lL5~Gz_kcY_ z&>?qHO-Lnj6_ARHPyJEZpk=08@;vG4&~kL02rS8m3Mj;72gzH=3A!WQp;*;d?wWBK z$V^==wW+Lov|kN5+x7CRPgqoS@$4Q247aE#4KFS`>H13{)6M;2pMh=5qVg-#ui9O3 z_m}t8Q~^zO1A)jQ%8hOKyZ0pEgr`0?AzqU9mJtG5zrRu(;G58Z)TLPjdDwk}b2?AZ zxch}Iv`_uP9<`@0ClU9wGoL(ritD(@n_3m0r>=LVJxEieOoyqNU4_Dj-M^QFS{JMm z04t@}ePTPWEGSq~{AJz8H|W;XRP!F9y+JNE>3rdOnCb?BiJ{aeA8QQOg@L-M(n)=Y zebHKSC^K{)8;FQT36hlfhev?%r?b8FOBq3XS`_flm`mna-(D#daS$e4d<9r33?V#QL-r5E2BojV3qr(RY0 zGOGnS9g92?FFlcQ@5}d3>r!M#!1x^P_i0hg8S&S;-GudI>=ou6#W}=N&`DchA%8j+ z0eVu_0Vx!s@LwTXgkRl$veBtOSaMD1%6{HdBle3~Jr*XjLq__e=KbQgjrR|WZ6}nM zKFeJhp7Vgue`Iu+U*MDBD?f3*YS$LYNB8LE5koI3&UyjwAdZ`ASDf>2RjB6cd#R6p z+Y!_KL>)G=^<67JLNoCPL(HW&rwyFf|= zYYNAi>5-H3Ngm7LY@wp5mI}0s-+G`chtq$U1CYG1$d}<6hN6UJ!}?HLC;v~d!LVxk z?i~?F5?#pGYW<{FoEmpHz>>6$%Cf%-Z-T`P0ek2NkqZGmV$@fBKxC`&u*LqQMsXyG zN?(E0{Uy?vlQgGV`KIM!KH@W!~FO{DN#oR7I zj#LO==9>@ija_|UBidZhPRsw>w!m8vhi7kJY>8wiopi0WBR@CG-y2d6OsB z)r`ps0f(G&A+cl1(kdwq8W(<@HviWd2(dd71Foiek%OrOJ@Smdm!mm9Zbm9aR!j%F z3hiGo=V(x5s^Z`U@tAhz$l8$*tf75zU-Z~6r-%LpFlmDpbqt>?(!Rgh`aJa3?Wg^G}eGT`#YSnp$&L*NfHe`ueo9)STGs zv<%3PqqR79f??vE^f&M4A5;iyRGi;OO$$Tz`6bLnlrEs+EzJvqi55+5=BI_o$abtq zIIn^sa-wrnO)Rz1=+*`!1@lJ74da_wywdWsjVoqZc8*%84q0{&FQB$w@hYj%A-^c^ zut1{F&0!3joWn)C1kHhRQo=vA06pd-UCY@Z9(RtY+D1**s&wg#TFZ>}0I_oo(}}Up zl#p+By{WOC017`+kGf4h!E5J_x&h{&EZ0XEvATLc+hmzNrRudY6RAOdvNc%hdZgC; z$GL|w64Tx1uDG9l2@(th$W+(V^p&i?g6-2jqo&`#pWuI5eRL2+AozD-D#BG$rA^Fm z!IF|<%=*2N`uewLsa@@z2$w?11v^1X^Q-&?QgZsm7iHwi2Qs861c4)d0MAMuxKpBg zBm}XCRS_xai#m@gKozsa7s!f}x_dMm4P3zBd6@e>WYx6BixFX%!O=#%G3smOSZujn z>P*T`c`#~+^#gcVTX5`Otbz2Bh~KqP-$q4iZ=vMnP1ytXlMTOXZ=*iGjsNz|EmnU3 z!ofo|KPW!z7A)y97=U!)v6T>Ql^=Q!5m$(bJP%C{YLwpSz{;_WBEyI=7on8t>4w$0 zBRm7AuT%*vQ5&rWtgp&YyKKr9stnmj-i14!LQha4Anea9yCdSmxJ=MPPIrtuTyd}Z9jG; zS1(S#m^z1Q*i7dAa!adoYiVd2xOH1M=hf>0&FA2Dxu0T2h9`DUDhVJ-Al1`DXSZsy z=FnMDeGzTn@REZbNf;UL@Jf-Ee0Pk_Ye;@9ZGO-sCR$EyME0iQ2i*P@DMhs6P`}}+ zGke%G@(XI{(GPldrWY6lq8l1e{f|OXjHgQyuC`;%Ty+eupL!yXQ7?T`DK?)L^HaO} zBk82_^{nXO2UWOJ9Ji}JD*Hvsqr>OI&+x2Cl%8}nxDD!ZA?i|vX zrCd;Hk4|m>y=<7;^cN^F^_nt|`~+x2UP2dKE~;8&SfQ8(oSI z77!miH5xE~!*X7D)7>yOB<-u_J=~MRK2uLyo}xiNzl=FMZuQ6E3JpnIyh8D*E7P(! zcjAP``XIuXJeU&W!veMIcYG8*#(iU0_ICA#;Yu{M*Xq$?r&-l2#W%_%@7}#`GBpu% z-l?QSphCcHp_$1`R9me;NM1p1LrzhxxUItlaW&$&zg|8Ee!E|gOF&RC@zo?pj)q)1 zF4U$A1S_kn4~Dd_arb9AbW1r-w$z62SIz~tx{{X!TbNqkzCK86nFaNbhFUh&$d}9Y z$4SWylgx0tkK5JTUN5==ISIFG*7*5Jtxx#e{*vhH#3=0tm&5 z`5~wMx=pn^;ks31?9NU=>uJt}YlZI9w@mB&xA3ofpX-4U3$p{qm`Gc!2 z1}8=v7HH{Jjb4!4=i*wGD~%wN zAQZ$5hRa#qAPDT71(*1QOhFG?G^;OL-PDIqU+S!vzw|AN{G1isi~Z-sNE0 z^HjmCdLxgpQ85_HH%@7Gsg zbn69Y;NM-v6SqfD+pJM|*u?@= zP>|Bt9(IMyKyQH@qDVX7K-!v^2}(phx%+lygYs_~tV&I(51)Z=eNoobcqwjb%I;Qk z2|zV1pLnvx83ueT4u#QmeMcXC=I|DZ$IyEdc)5@05Ijs)?GG{F zo>xzX@f7S5-V_gn(Dr$1Y;2AC`mh5M1D)dfSM^3rGnvlhmp*Y&~uB@(r9E?_hR$xC^0?SOPH%dCanF zs(_Yu%BFxNcs4Nj#*%NFg98)i&84I`>mA`a?NnS02OaY9vFI|MYBhuEJ$v2{I_fts zu1bMm6*2aCdY4nG+5k#xYB5qhIMbovG=VbW;c;^tq%0ulhdhWdjX<-xRJwzX3fHfGOZ2M}UxqYqkd}v156IYU;+%fe~FtX9P zEHD&>YQk3fF$2c2c@z9&!i=*VyN{^vbcL2=FWTI^1QbGSJij)$nitJ!lA5;i6I@0J zRKAdlOLB=#ram6_bVo#z2hX9c_7&`-+oo=2hCz?I+}Y-Z#ST%}YDBemZcoVFFfK@1 zJ;*rb5{g+tE#DrwI|Ao1v&T6L8DlQT{27n<#!HR|`_N*K?Ri74YtQT9(WIyBLs^Tmk2fJ%w!H&T$%L5% zyaL+mz}nqy)rA4SWWNY;{n?;Ff(*bN>*swG*Ag!qQYA3AHkQPhmo0jXYgngI+`BzC zNW?uTqwgjSy+($Gxv$o5>#}=)aHUzP9WBhl>a&j->?; zt_6_|3)OP_7JMGi?O#glP^>7(XEp!;7dZG!XifqiJ^w)cDrW)RwdqgCr5txUP@%tz z7ig}Hdw`G}J91%q*CNsIo>O7_HZc?W7NDbcbZ!&Y>!F>efswxBbD%+zl!M2Rn?*i; zfh_7;U680I#L$D{>d6bA9ZVSU#GYsF4{wNH?QVUa^jaO4t}z}s8jCAdOnpzj)S20r z(}2g}2QxBdo;`?2%E8^jSr^gX13ilQ`lQ6T4*cN9V_8H7j;Se=$Ax~G{w?92Fw8tc zL=`;3m$zLSDo@e%du6*o*9{<3yxJUbmKYPlKlBYp8rsTC*i^?zulfJqtkTc#cx-GU zm9@&PVRqqX*6w0UlUsl|Zx|%kr;^3QUL|veKOKsh2JOk?2k>el!GTJT9M1jAfJqwTl z1h66>kusG$Wh_!{J1f6oKa~8UR{?+tvp9MGDztt9sKdlA=g@;%a`HK_A@Dm}w&vX+ znb)-;W_c2YqIk)}5e>s6lIPHnh{@^Nkm@M(k&q0cv&~u|f?$_`oQ{cpG8}6ye2c6a z5+ugGVEK?cxd8^>*uCq}jj}aJWkBkzSX~V{w17hL3s_}<^}bQ?9cQ{HUm zhED}9BXl3;=gCrgt`ET_qO!Dm7s7!dgGCzWrN~2TzGZa5hy3ENtcDuj$>{0B3o|mZ zginNjiCBm-sVOsQbw94RJ|9W+%65;FQ>$W62iS$&r>hbaL|`ve8l$s^_C$AA*1AR1 zkFU8}r@Bx1K05#5aPFV_m@*MpbCybYlKCLt`7R~TwH+1NHc zo3V77p^N(k?6 zwXgniQ1iJN61F@uQSUc>f?_;~XfHhlw!gNsPn_Cqx|^}nGv`6-hDgtEskF~+8pnxf zA*g}PH_Z{ZT}iDa*0t)kP8w1eB`_wV1XG-qLozp(yPR#pA^(_uT5g~1A3weue4qVX=} zqj$1qV@qvvL&NO|W1CCN`Pz4G%}NOCURZ8x4YavHIKdx$Kph=U=*q-W{9Nwrfgz>A z!gCnF9qw%7aX7MAPD#^=V(qP1)FK;}$7#cmOi)xyZG*a68F8C7k&ote?Q9K-D_LUUVy4Vuq5&&tFck<5RQO-191{p z(x)HET8S{|M^CP_)gO-BjnW zFh7s$i8mE7V9j>&1_hlIv^7D~N|8;fGMxpFao-%SSIg$&v3ko~Wv;CDbM9s$7Z}ZE zUpKeM=f+u8VQXzIPUkEuTgYc4#8dfal^iH>wxNutTm?6#oypP898bG$>a zGd0y=+H}9}JsmPMzUef{bfr$(`W_$_8;Db`Jo?^1r=f)%kOSF^3&STHp`UNFI1~iWfWsf8Z&+Yo$NXH)Fqbz8u*+B4XhR?G6R#` z3fQFgxp%{lnO-6z!{P{zZ9Ye6Uj_QCt#0map0QM~#JLKbUwx8m*R8fEm8Tn`F2*KY zrY1u~6W84il`h3=UY+u4bCz+JVblduCJOS!{g#IizTIAM(Q zR^Qcsba$wbUwL3?ndprhb3e_ozi76z9|+PLg91Dev=j4jrM}7`~rSNHE}f45dBGy>t2zU~DA zUwUou;P14R4&}TA3@$?2-S%;+mXOebN;#kjF#MOtIopQj3+}=YO{e&~b7nfo#8{9F@%^&?lQ{{uMRf)`SS@}3W zzxtI{Wf*D>rte$W^dh67{&%ur5O4=0XMG-?hI2d2(VM6TsTQ84KG$5~9FdO-qhj9; zbH6WFcnPn}T`?zY7DpfiB~>WKPd*Qho_Bq&FqRw}#CwGhSBk98!lbd%M(`dJbsV_g zmB(^$?&f(#Pc$!30A>mRjOKiV+^%{e5iS!#j-N2kr31>|8up@32CN+14CM-vdHH!; zeyuK$JKJnAuIN)?q50M4DoZQr4AL*1hEq{(6npgX;ao$f0)g(_RZkmPsK+u|6UNTM z_0xY%VR;ccYT>7z+{XkO-?+r^fKc^muD-3JS&@;2#rhd@p!hCz)hL)H#8+`WRj~m^ z@6(k*jAGYAzIgGxeba2$EWpS)fQSppF{w-kCz(Cd?m{pfFXDnM?P3C=9iMO`P0{AoKFH1ulnKGQqm3 zK}BiY&NoKg-vLNjQ`?u7b}Mpni4QR9IQfQn)d~4lM_|?bLB;xHBJAwVUBqSYH_`H8 z(3`Kx(-%)g8esxa^eLQA2x$)^0n8j#XHUQ=q~mm?_;NG#36a4W9o@W+tnNLyurKN9 zW&={fJuM(_L>Ls2s>n6=vK$gtlU$QkK|HYo#TKn1sRIi#6g)}};hia9I#S()`nC`5 zs;&2nEKx02p*Ltb=wy?_2c}mS=X{OsxQ)h(7Ln<5|0 zoun_tO`I$W(UXyXu07G&+4++yte>A~*GDUH6qgb2P`3|zg5_#Kew#u$M9x9um(M>w z>P~{CE%5~3{}Jba=2RdUGE})J9}gnj6muw3m0C*O%&ELHI&Bv-Fz~I{DykzwP^q=G z70nUUi(Q_-`ps^(s(9~#XK6}p=vn#O7W8w>?g`}5vf;(2he(57JL=Ti=o zOmsChE$D+}*?XyIJ_)c->{aL+d47}{Lw5A?{6Y)O7`-6Fn>yqb0qgO3wuAo+*u)p^ zspRDzp5~wLc11rE?KEY3yY!xLY;bHTwI{ zk0nn|`Qz86uF@taxGp7~k-b=TLZwg!ue^2(x21zE*mSCFSF|6Njg46Nd1S}-%Wa*r zgG_;<3jusD<(Wf7l8b-0R=#2V5oq)1*vVUA2TuL=mQKYYB_H$#sHhrr_s6Ch>iuo8 z6Jb!zVEYd0Ht7WKk_7Z-QafZF$W<~LMG8)KSErlmi`rBuYYO-d61ftHzMT8hpK-W5 zj7)mG=-T&Zgxsmfb8`z4BI=Ym{L!{P|Q`7$nW>%-^|#fEjf6E=WLDjyW!O0YUI? z6(r9ay*EO9t*q?l_&68HK#xdGn+&RM8sb0R*T7%k{WHfyUZ!qo55fJVt+VstOLXOO z&wCO1qigcpDKlDc6W#Oq$_5AZHD+dKO&xD~Lgslg1UIr%64UT`G^`8c@}R!W`jF@; zvKoS;mGpgO1Ge8JZx1=r4Bgdpz38J{+fE=T<1b>G0|TQ>ifEKQ-Ph$JRNwA4c@^Tj z2qTR29<>piHb={cX6_BUh@K8>xnII)ke+dKKC-j+z6N2GPa3M-nh!ln*lH|AuS=*=ZkbfBeP% zo8=;xrOYtYcNg@aC^Y-VW>C*-7Qw69(?N;D?A;o%4GkG>g$a4{bka}W>RR))JWx?< zW3O_gtrnvln`fjMfpnug)GcjadbZ#Fn6#y9$(MKC8e9-Dh2V}I(FVzml)W+&Hz?DgOxE`xdNl7=$Yu`wy9=ASHr_aHMW-4ThJ>kH3Dq^vbAqwD=~?ZLsGz z_|}RlMp{%@#(r*lkB>}4{D{Uxlug`6kyDe*Tybhk*{{%?_7&+_hPy-cM9gpB!uz$Q z9@d-t2}aB`yZ&Lj8NQL#6LqFkhsQY2>x;(q%8*pTOEf}>Lp4QtWgj4cJ58I^eF&GS zsQod%BwZUevhKx__+;WxLwBA?f`bgX{c>I88MU^z`tpt!Wufg_Qi2e;<=($6b%$1M zZQIf}%!L`Zl1su@cPtJsD11xYEbJ}kzBZ4|mZG=!ml$mdTvu4?g05mG?Vz!tYs}u$ zeZJc-g!U&9sH9We+o<&*_!d<8K}DN?O)Wsf=-WF$W;KjZM$Jdr$S|CHAR1eBmFFMqS z`!O@{yj@-mJy3yTiTDj-JL zgyM>k-PfmK9!EK(PAf6OkWCBP8$2g%bO^3^yO2Nx2M7ojr+;9G9NbVCq9%j zvXkp!!LP@9+jou4C*-BQpZ6^v!Xvd)<*+xZd}zbdA_&8kNiL@u4v&0HYQc4jtl6;On$G3+*53zL%c7urd-TRRIYNsm@ z@6Ne|Urp1~>Enj6Gm{Gn<%y$s;~8|(uJ*$gK-v4yeZ9G>AWOhivXQ&@z&%c3Of9tF zUU#LFlVHt|L>xyW=aFX$;90Vii;T&iBK>yUVv~|4$!ZhVf9{k!{2V$<0}7<%e%Ry9 z_d6e80)wyN`&7QFxKw!upNccqxlko2r2MRIGwr>RNybX2vP$kx8dVEdN%Mbd0g4kh zn+gqrvD#?g&>%SXDLE?;J}zvojxb9_fy;WB0WRZtXHM4CUZYgS(5K@CRa$!;i2vK; z@Ox2uozM4u*u1`QF6{f(F7JB5w=8&`tgnhFdBI!RE{(-glDYTd%yJ&Wds>fF#S~77 zfb9YW^}edZ>8s}!eLmzTzb}aRxeYwKFZ34kIVeW!d zotdq3eb(40f3)VtLr}4K8?AVpMv9(RjXOzJJN|fBi?FU;2jdwq-m@83^by?m+cA20}28`<)e7Kn83ClCH~ zaG3TcS(gwc;Na%^ef?-lY+|C7VW!CFv{2|WznuN5B{S<9N5z91ps^x^YOQgHq4mgt zZIQkrd!hGlnZ0u5$6~=Hrzzo&Qe<2^D9}2M(x{R1i{YBT88@P#kq=!>%Fx{@Wo1P-MuRn4wm3m{|a*yy7{+2Lk=6BUICtbzSR^9V+BBUK$Q8u!I@;z{pz6EaC1Z zo9$2czqq&{Hy`e;3bhaJClj-;?yr^`QRCkY<@Z=WE-XW>GM7n@wSr3Ws)ifhhI*V8 zbV!4D@D8lbrN0MR?p#8)08g_0vRZaq@jR-aR;%3kHewfCkTTUM#&7w%R%_FuX5|}L zM}%;t$QP`BToD}XKw4^V)RWxWj`SG?d(Hya6MW-u>q^f}8FK5-8+`~f)Ak0D639gN z`TmDUYYXzz^~D#mK<5cj_3%V^aENV$dKZV4t-2kI#QxKX&QkbY9bYl*xqrSc<2`H-ZyI2(DPe50bTgAQJjs;vt#jNH3(D4Q;Ep?P7eID%48bKq8k zub5S}{ct>+MP{1r_+Zgh-g8SmTGesy5Yd8@VGS_5L=u|ub`hl?#hRz&5=f2PKA}`b z%KbPF?g0&+rbya-N=^=MhzhV2my4u?%mxGB1F`C8&Sx|66GI}o+Ijh*SoeqKNEZ=N zUfMC}H2y+t>^U|395457b^GVQ+V;<<2Dv(S`c4GRIA1_f>a5wxB9D0NubPvXso+jd z8v<~cYHi}m&p9l9B@x@8HVpc2nky9PO>6!6d9tzuVef=%>Lmw1#71?C>0ynUzy7j4 z(U&}*hU8br6a|1LB6A;`=h+^N|I4rhUI4>l)O9Lq2Zp8fUxt+=A{0+m{OjzPK$?m#thkF}w<>qkK z=Tu_^d-`0`Hc~rA4r?_a)mvzziQDm4A%%9!SFt3N7I~y*z!Jggx9d1p#@d0cS2O75~S-|ax`^Xl(rBz+ccF10-=yX&kkHb<~ zqbvEp3E7x1-#4;jNH}+S0AM40|HVcuWt<$Zi!P<^39Z4c#q}8i1$P}+<}CN(>i`K$ zg%?^fF*C1Rcpd#_J3J;D(DVu5X0r#rAK~QYS#rBWiDnRS=wH~ZulX<>#Sr^vw@FSbr=J7ZW$u64r9hj&U64ew&|D({QSw+|7*VK5~hWOxTa$Q zh_eB9jMf}bL2>>sY(oHhB7y(GC&pEo{rzRlEi6o}+{B91+3IAvEa&KV6f>>5 zh;JzJO`G6ckpvR%^rT4GP2ttbE{G0LrOtw65Acf8$7&7q%783&`+PQYm55!by8ZXN z?ZaLr{_#V2p835WcGQX`aX*0=zdpQ((g)`zLuz-(eRy+yMIgce!nCQ<4>khtAO4@- zf4S^giWt9Aa4_#-iwFL``dWk~EOFCnhPR0#yf)nuZJH*~h#~hHIAODYoUlnF%6NhU z^}3A-S!hUyTzqEr7^sqTyAk80{Xby^#Z~9lr3Z5U89P?C5P2Qa;rp+%FkyC>0tIOd zljkV^|1)qR%MW6c(`#EFMo`yWiQo=AtEYO!lCaZoJnnFb&yZ2>O@pDjt~6j}e`(u- zgVp5e|M}6ct&cE8AzXN+fI|fkXasC}RQ=6?qye&W`qf2=87_?|rpTOl;L*>(>5xCX zY60vB4{nFp{5M%DJRif6^Z|6OP=W%JZ-0Z4zZAna%XdBUb%@zzN9=} z-XjvDPIWM0Q0tApbl3pObcl#XOKwaM!9dvwj?SN|+VCmF zRaMP)v&IAYj-WhOeQc zIgvl+HtNsC9Xe2LF9yDU;5eT<{U=KElhDQ+(!sURTDf1Eu2elxnD6PJo3$aLEM4wU zAE*FNo962D6g@bGX2Ig_9)PI<8k$bA2WoQ;qd9~D*V|7C?e6J7PR z|FR(zPt1S9=4#P7%vua3K=J>(cTei4q$#m`Uw`~nybtQFwD6|{x5*PKuLpkE74}q9 z#cX{L$_)f7)rxxj2g|J-w^! zq|CbPoNsLhYI9(Ri&G6DkxncdC9+p$QZWZJ_|YKbE?e3@%L9n&gvjO~F(#Yf@y~ zTEN#ZJe1;45*OFbap>$z($s3E!;w?v!W_+r=;K0UofSh}X#CM_W+3r~zlcw`Kq}i1ZLkP$X2cc#|uda{3p?=NU|6bH1 zM2`B3CA0+SX&g9zIAuv7R zhtH_kdj}5_n$c5} zSCJkF5PGj6A?4mz&}ZJ6dFR`EX78DQ->>I*h(~hY>ssqv=c-q=q2?;_;TTZ>rc|>& z955(g83gM2PpjbgGnvfvmGBCI(_BoBm;oi}Qoa;|^IFwN!?iLgRmhw%G@r8-v#|<^ zc?wfEUYbNgO9M~whPB|uHQp*EU+c3z2vjqPDeKRGu+|^Pa|)`DBsVN%GAN&$Bxx z{{52}cN5A!fv#`6=(a3=oN~PWnQEjP^CBZ;6pkYHFv&P_$zqEiBqfAgjwR*J2zD1Z zSi%OtPz{)A8rIJMx1lhB($9jkXxTB4@5%8Vl!`UbfC8Qov`x^f@i?pI^NewJNENvO zy2_7$sAb&tV5?4vl!gwHvcefc+a^BqU0PviI=3jw$EF!awvm9k_`pojO0+QIpHJw( zJS{$?W~#{ppY%>xCsJt!TyZjrID_erWtg7mk~TcM3anzBZ@yQ9LmWO~DbD0WkPF+6 z0`GU;ib!CXhV4OvsSnLMz1hD0Ju%Ls z7?=vPCex}A9IKUkw_TCFsi>$*v=E5ltfn`a%0UeQ#4KypeHh-1L^CTH*Es{kn!8FD z@8YCl3MW8sL?4)edBk8rlb2HRax3uus)BoSAm!%1jF-{M9%G!D&#kQh^E82ikewOh zGyspmf5a0%!>EP8q}TAOkc(SyBmxf6OzUJ!=`Vb@oTZp%6zxKv-aY{KAe>2ASCdM- zyX|z*eX&mH+?*#I0vj&Ow*OIO_q#pm&{}$ZFc=%VInlq{`eqwPdHepo@-FZL`~szw z|41wmkW4z^LY|42U68j~h^h%1B3bfF@!)agv$r_(PEaLrnzFV|Xs$omblD6Gc4^@G zSwcG>Kn>k?EaB+H!F0 z?H_BYI?;*jntcwi6AiGlYn&2LWI-{N^p9L$Qj@ugQbLmslfA~>{{>EzvAva9FHgP3 z9k<~CnZpohsjy;u<~Os~@nsqshWnLKLNp|rPYA0FI4l* ztq5hB7=eNmg-#=#)M&3Nho42}?e^YQP2@V`)Ww4aD_STORVNt8Jcpq*IEWb5;7V%* z$V`b18e6MnnRar5r1|aMO5V)#g8`=Pe&DC_yT9Wt@Kn@6Z*d%o{=h)!G#e-i3o(*< zY=k)q)cJI9D@Uu>J;HimoniM<9AeIT79ZQ&2z30s`|LApKo!}R8IR=-F#+#$>Yq@i z;-CEhr%QPt!`YhR3;4g?K(Z%^$&npCy#(EkF@hY-*yl9?Zs$NiRa$6~VATPySiYJa zw`JKJ?^}m~Z-SPljDF}Au5p@zb#~*)aT>>%$x;#KDfJk@`(n-Z z^g)1(twRMTCOJZ)^{v(*qj4l!z^bv~K-Jpj0RQ&@W3ew&?GRbb`-rR$8zZ{+o zT*`<5$N66;i9#(qp652R=MZd;1_W&Ihlx@@nL7eV_6y!XoS}3e!P*GBxqpR+&K*eQ z;|(1^^RO>(66}VAL|is_!@Q%F!E%rIkdX%5WnYV&vX*mF}TB)pc6K1#k8xzJ-`sYeD*$W(cQ#{A9 zhVOB&q|sT9SC-3s*p-s}x_2A2*qJGD3)OCz({|l9r#Rf4N;qz&4a8su8svYwYv7Om zGs^RB7Ps(SK+Uc19)WWI3?pQTBv3ydSn15s`S^8@#CcZF{19-a?Em7Kf`u&ib}fF_ z4wnmDSD8oU-(I+aNZ>Aq1Zqpmxu;&DG=ohl0137LYS94p!u(Aw){QC{`F}7fmV7k9 z=YLRTq6xJ>B>~v12}K;gclU%mXcYvMXsTr5yLo!M6;p-XO#zPR6GaHW?>91QE`{XH zAplgh{3}+-iRzxgR=rl$7emH?1rK^AV$BMnAHsmj&oMyMs;wgX3){5b^#KBtJKe!bKF#j#8ZAEbNA%g1fam~mZWq%|rlu+(> zBLs{blatM27D7gTvS|^G@Wu5xg!RD++m%lgj+sJPKZ0hcarFEdo$kpcRrUh#D{R&% zax(QJP66&w^T57RyLan&gB6<}+iEQgR@^MW!46I~B2qi?{Wl8=mZ>M)oMQ5cf$N~^ z$|6s*YmrKE4K%ocNdneSvdMYM!e>hLF_k$6@_V3U-?E^?*1ngm$JWNTZen`6Gvt?L@@)I9YyFe**F6~3*FlW92&h-rY?m*u4nmg82pGNKDPa zgtEW16#XgWO>+w*E zQgAKQ43A8vp1_HQHRClJ=vrCL}R@(ni=Q^Vt? zx-)Ge)My{)4l7Y~bh;(rgxU0yN(#NSh|I-Z-K`)&1lGi>AE<`Aznv!S__$~jV9ttm zuTfYfBQ^mS>-+mCj(Reo;Y@fCTl%Q62VGZXsR3beLa-T>UBHg#EPGqdxK#O*!p9)h zHHrl3C?2U`oJetX{>DCNf$zSdcQ9_z^wN5Av%Ctm6_nqzUAw>HvJyT9z@1(dQ<$A~ zJ0gX688ERzt%T5zZ6n!l{ZXvT;ykPV*{>3Q~lLe8*sK(~7MB6nCy>Q%d22^|8vZ|p@;^JL; z*~nZ3u3*l_<^%ha4RU|6=k4$dgHo!H`Jj@P>QU08v&mOo|G*_-d$ls#cwU^$>j+gJ z@ns$jx{dla)$dPSRj!O4+UGg#96oqu}D;h2j zAa?SC4sfT^sHF~Py^T>^9yQKGUd`rn;WBw9J)_kd8M89DC++UKJTM0~|AuOAVfvz} z`35BPL%uF1#vyImBhC{|FzXc=$!OI4>p=qnGX0t55rwOlgjWQQu;a^Cdr{PA6c^ns6V+k72gz;&j4$2AWtX0HmwilV^ci<8 zYcsEIYL|I&C#PVnEx+!WI`!Vyhgf!7j=$@h?KL4d_+Pl;YGgR@CJEYLh4qqPXfHGi zzg@^lNlXwK#C9x&jvLN?@W;`meZ;q}^r zEs3gZ7Y}RJ>05@OW>gu=w}(q2N;Z*3kG+R`40MDdHp4T&2)wPABN|;-U243`bxhiH zF_HkTI&NR2@;6~@RuQv39d@UB2AE?!FQwZ@tBKMZ>Ogyw!s4VuGsT654JP79oEwJq57WE^fJ3beM;ecv#eEhrbK{F?n*(mp0O>5u`qmlrf26{_Wm(zay zr*IN#m3>c21&j2o7g#J*xQ^-W$yvxBhCz-&wp|(hah~MlECsA-@k%@j(=VCe6+;a1mAY|QBsn*9i!I*gs`l<9V)!EXb zk;V6k9}kL{x<1*;2Oe(}iG)B>sy54^deWL`gQ33@eKH+%8#{D+4>-REeT|*v6kKQU zNBikfWO$4kl@jhFWWu=Feakl=#0=Y-aJ${M`$rzjuo~h%&9+;D`@=$AGL3nwi73Ff zKr9v^dD$yne9aFsXx4Vw%fAU2wggoZU_=cb(xD1aM#3(y(w3Z|G?$n zMi5CVn%)eF`%2i=RNV`w5#}Ayd94P@c8TRDiE8wP7}LnUREx^ylNMFR%D-UE0&ru2vu$U9 z$yv7Ku>N?EYi3mzDx#25$q|e(@YyEA(>bER6*Q4ecUZhvE}D=cvzGmr*NmZM_(GiT5$fKu@kN^@CoJ0owvy~a1HJX|`6 z>fR$xCmX-$rVvd*FDQa%agdBifzz6tfnbM@e#E|9H!d1(EU$NDcVb#8%dTd0tVY(E zg~vR2Uty{U9sO``;<(cglotugP{n&jKQ&PVUFul<#QyuJlU;0zNl_cxoqP3lb&2k531leSd4%-& zfl5qZ(NfSVH?>c%)U{IyRC|sbRn*a7icI<*s+x3%1pOl$jJjYDB_W+KWV{#+u2f;Q z$uu(^3g%xBYep=SyP^XS#S#L$Kyk(fH9yEE9z~*hY2qzAf_tVH)1QiAf zvy&xsTN-SS=z5nS0x_mDGaJJkrP&$%w+Wd5|7y!YbL+ls#Kmx+&%eRy*U>bguDDbln%KB-b)W8GE5}bXHnIa&ZyLRtvHBp_d zUF`g2n?FqN-H}2uppu-t_Qh%gg!})-@qzL@trtc(N_uzWee-wi!K$bH7v6i&G+li2 zu7Lm9=uQDtO&BcK)V`6e2f8A`(>&ND22p8-V6B%Ecl*JKWztQEdx32PDXTfINNw3 zt;XpFxc95~zxIOr{b3^8L1AMjKVgBBCARxhkQ^8vxodroYg(2B-tI53p?fv^0vPc; zm&S}1g3?^{9;pI=jYVO=Mn5xOuoH{3vAZh>$V@5)tOXH=r230)fuy3$wOxIJzzRS% zIx@}-4}Rb|XjKl}M51Yef{*fFf9luEw+Q7s?_&l*6Zg|A**--vl0ad$+m8T+asE*x z0hV4@@u2=Mq#0F#*E&8>#UXFs*LyaOki6qT?kjwQJ3pwHNL~9NKw=%gNtg(DB|{vm zB+B&f?iK`px9a6oG2abZvH8F5C?JcOhY!$wk&kdptPzOmE zzXx0>*AO_qhZ_+f;cItL@K32&v;>4xJY9wa&dL9epV$`=ikJ0QfPCAQP!8;A?Lw~| z9Il(A&(FPZzL@6+{@z2a;+zpEg+|6&q`xcy6>YPMt*6;D3z(r28FR3`vf@JP3@DUw z3QR{&cW~BOD*MAC?v>#|bZ+#V`*%;nMop0919rA&7MRaFMHqphABSxdI;iK>9Dvg+ zmdO$We{ab{fUSoo%0Z=<=ajqo^bd|P=(a3iLU6)!#z)T&R_&I0f!+)p7|4-nw`N`f z9sJ)x|JZjfPRvX>C%TUM6#~j`;7;Hz8TnYwvwr3v%TE7DFTR3BcMWFIkn!sou)V@J zuVjI9Mj$;bmDDX`CJ$)&yA0o8oI5kpW$x;}t%$V0ZaS(0*UPD`z6d@AG~xizHpx9$ z3heX2 zw-dPo=T!A{wv9cTE9y*TekOFDj6WJn=MRY9q*O+Gp`L{-Pp(jykijmsx-k-mHJxOJl*DJkKv$D5$Z2Tz*k*4lg#1fEPg$*Xcp=d6 zU?gYjX4ZFW6IVNCfH)lnxt=gca|5|qc}{NjVgm;ct@;OqH}BsNO*pG?zg`0<_2GZ3 z?8p-5asNur>2SY7~a1^BcrTV)d!Mf-V60GX}k$c%6gId7OS~*amhBe;s z_2fnGJfUVsv8s_$3<6ecN=)~EBvc5RP(Ry@qyj$^8og5NaEovyD5Hd?W0R?F z`ecpx9->~o2{2}-7$k+t)93Aj&Y6M^q+vxZW02LThI5wb>klcW7lVey5GEcf-YctD z0$Nc-IE9T}=!Y~=yx45EhoNQ{x=A)-iNg@2WBg@+Jmj{UFAgG0r2i+S08+{2?|x|b zM;^B-h!QzUnkHqQ7x$u_ZEbtfed~m9z}BO%)t)2nsGg#D*L9IR3gR-F^#Jp-Iwuxl zNaF77L;jKLsYJK&vnp#{l(zHm;hZs?e5G@rYrxswlZ89$uY*oKCvbTO>BHnQl=FNn z40!o1S>rUsdby4*vUYB;N-9x*@?15@>S6(4*X~So9r>{UcN@kq$9`B9OiDucN?T}V zB?uNH21AN<_0tix+5j3L_GOsEB}qoEKP2t@a^Y{ z{W!&~7940-#Oy-v+&2J2%nvmD@{aR|v0gBJ^J8Q})YmSzT+hb0J(LpMjph{7Tbl5Z z)L>LBhZ8*i^tU^Mmiu=LLw7;J{CI~~>JXkzyS)uMMjC$?dqqdm#OcRf(1Ef!K`8X4 z3NV#TDSO$WhPOYmWA-c*FM_8&yXRjirpwTOQqp6Az(k6V35dPapI-W|y(h=0$?z>U zzH?{EY(r;`lEk5FbrPftGXjVkZ_m=>bdHA zY=fdZTja^mB}PXt*)3R&*}{!-d5;GMHFwd(h!D8=F>7SR$Gdp!nLvjtu(3TqAA*At zSQC=YfvjC8V?Z($_p)O&Nf0nP3PP|_7a)`wX8zXtR-8nvg3Gd?2{%|3uub1jg$pe8 z8GYA%Jg|zKATRagJsziKXXcyReiDG6a?okJr4@{4e(IJ0@#SmD+g8&WQYask<`-hv z=e*XkA=oZcBHD=R={6QAlW;0%SeEoXU2?MHD(8gOOqt)c-FpK@mKB=Amzs!Wlbn}c zQqH@%I3=X^OCv#)fIFA_g9^DEDrIAYYQyuRV9d70xxQlo8Zuw;O53k|tBi(R`4PwV z5?M22FQS*T5$vudqKH=CQ&?kq9Nt9!Yv;9|YXIfq^tVB^so>5Pt-KH_QdWlrbZ;W0 zwMVpl5IA>$n{3d~!CV1cqx-pe{w@a5SWVwhiH9i$WevX7Lo2df>0x;$*?>!H8+bU> zSC?t~D(MW41{&YCuXRUCIzw&5y0owF^Q2N@L?a?Zoe9N*xze@bQ_`J^m>7ti72S#* zKimAuQq428cw8u2HbA4Oh;MlX}!rt`p%! z`w+6JGpYMBN51zs@|}P~*6Jtf1E}Pb_P%uh&pHi=T8stzL^8tgC@9T6izp%e(J?dm z7mYR#nUQAIZ~P7o%+V0aPD+o@P%xDNXD30oA;^dL7KCL19oq|5v!RQYObUj->7?>0 z)zXra>}K4_gwZ=!k%LmR&04|T$3;p{eHYF?)0MO3ntK9vbkGI4v|NHDM5k7C6L`A>I9J#3yRJO<|_DJ;vE9L<`g`%L`lGDCzxeD4Js)1c}0QFX)hEnqvlDnRf|;c~zB3b2&~87{tUBiOiC z4h9qUYg3>J1_W+Hs8msI#Fjd>r;$bZxbscQW8AW#mL+R0Ds)1nc{9kOh+KXd3F&TkRBhPz5tHa?TCSAu?`{w*BYMe_~lStSla=i|Y zT|a;$&Oi4XE==zKHEQv?qOrY`48m{Pj1Manx3FJ@-Zh{6cxB~Rr^zvBYI8_X^vNE! z|Ejb4gSSe*P$1|_12!-9+vW`hr50^k1b!Xcf?$ZcI(BY%ya+~2m8PnyN5bUQZ(e6p zMCwh53&XK}Zac^Fh>XqjdF^~&h|%M0dPGx=>ucdHXj>HLIubop+L9wrl!XHk8}x#O zZ*%s{uOd9ss1EIywX*P{GgQyDsXM`L1--j%Cdcd&i`BP(y_R-Ah=Dp!xZ*B*6H(l#bUkPSrw`_|5I2$! zlfD;}u2n@Ea6RX*z?+brnAVn?v^}bBuZG*myIN{xOuW3=$oRpSjX;#1l;Z)$tCVmE z$mXFt#Hm$vXpMA4BH!6Mu3~xMNKzEU)zN; zA`!p>;FPB<SnN)`2-Uf37(L6&rK{|<0-Usfh?>viUOMqv{yP;Il` zckGWD7AUj7m>)p_ow9!YV(k3CBETkL7NKp&pMZk97>=|4{83V#^B6kA{YuTQcNcm{;wtlnLTI3BDmK36lB;UEk<3*>;C0q` zk&<)2o4#HarL+1;^tQU4VhI)a+T06$J$LU8Rz2bltI(dS$vsGVT2W2+`J@-+=xgNI zVXa?Sf3?4TK_~rA(SkyLJyC7m+ha8VD!SXrFXWyU#afijn$yskF(l?qJZtWkGli(! zSvGE`YtrW?izmNG*J_z8SL7`MtxRG@%tDV}IkUb$EglXrIgD}n@io)gwGa`Xoih3} zk2onQUH7TE2l;7+%El(ou~bn?UIh+m@+PO*W!Ye7pL*2h-5?%pBoG#9><=0UvRtCj!aP8q#I6Pb0IcT+`M z0a#UMGgj&X>4C2hAXiLY`)IC;Ljp(RmS=h~UZz<{2cDNWy%585OLuT|FhKlOK5?b- zeShY}#g=5ivkwkt2Udu1&L5Oh!SDh4Ez{R=rXHPn+8 z+L7%@Z(%3en13(=#vS{XOv5}BGv$O)pi3}TVk7736CuteH+LGUXMipn4q})^Wg4Xd zAcoqw-W&!;-y)n{;*C*m*|5uDNXkpQM~JYBXAARMTsMEWqT&S`dq>zk7f80_6WTUZtmz6ca|_z@r8Xa^i~p zTq5$p-aVB&kp&JvgM#0RpuE!5%wjwrb*A+#u51>6tCdc-x{)94MW>2rw6$Mn*5z?H zj>*bT;gJ?@p;vHd8tLc!WchIO&1PJ5@fb5dr>FPN{sGm=NL>CMC32#>2? zYeA+w=6TVpQY!QxnyHy^k&IxEeuv@a>l#OuAH-wUNYqv5{O_r=BaK5u7@xI2OboaD zRGSv8t->Ha$k3O`vuo?;bbnv-fIt(nLDI|*oI%hGeJ_~bNaajX@mz5PrNwTGeITpg z3ASAPCt+h20?njmCU z<5nJ-Uz2>D9)BS#Xcu}t<|^;4kY_C%RfU{-)w(K9O}Ht8>%R1}4w9xFhFg7h>{jKl z!eih(ys1 zT-$4<^XQ)veN3>EGJd$*H%Hfk$gNa&BgfNI=7}{h(*o*2Mv|wF>tg65M(Rhd&ie~+ z%r)@f=82_uW_zgqVR0j~(6h6asrP;sX#j;h_b2C2O+!?oP+;0c>T(=~yncrl!*rbA z9~K#9@s(c;8mDnCLzL2r8VwVv#*M!wF2sn$k9><@n$f`|#!7UB_BN>L;`oC|A(0YX zf8+Nu?V%r|cdc8)9?Z=3zSAbLz!FKf>GN=wtyYe{&F#;8gHm3bdH~fn7WAYl2p5%Q z2fN^>qoa)-P9D*Ux#B)_X=+>g(bLsEr!MOE==d zUg(0r@A1yW3bQS5m?P|lS3}&b=cBbdLXqHB!bmG&I(FKo=`FMpulYH0-oEGJT(~=% zZljK>?oHRr$|X9tk)fP>pxrY^V+L;dapAG+bY^@0)1N(=kpz0w!BIyH`Peh&QCa+~z)0DEOewUz%m)g=SHO zNJ(&i;qs5qav*$>2HBlFgJ(XGJc-(aQu?;F!MHn}YqfUWtE)=6ryx~mA!+)<2WwVj z^nAfcyhsg*V0ssKA0(ypY@d)Oi8@biTI`!cN`1sEJle8yyh8g9X8tc)Z`12)ad*X_ zuW7D2Dl6u3LROYq-SlQ%+&jZ`^TL&I+HTLAvfaG1oFR`d5vG!0&1E{MIv})^{3HK% zZc-0kuYD`F6m!p-j()H2P&hWrfb^SOswI79Oop`btA6-L=K9t>4&;+zMZif8dQ$;} z18vPthuJBO5wdJ|pC~{gCktjjB#+d|$h`(gzJD>_VESi0`49s>pYn1AgoP1<`7zKQ zSK1&NV{2|R>%|Z|5P|YcPr{O9Zi4ia&3``wimcFfy!)Y17*TR=C?7}Z9G0wBH|=-n zsWr|9GEEx1{HSM5B>i=0h<3lN%;L8kwDXTE}BBisriw%kDvODs%H0+J%pEdOe zpPv{)HZI#pkjAU@=SLfRo33ovZM!G9H2$^U%eShh2jq2_ZJS zFzc?ZIMA|2T|gax?g?@dQe$_mPcU8Y?mxXZyGtjUu(Tb${I($o^pAA^37s z;NzaDqdIROs-eysGCS2YqQr}FMg8m%1A@v_yR_7c%RMa;Phq=-6({t1-O*hcyfGXe z4YE5|;+Dv64?1lEcV&-jtC3~#E-S{qKUBc06MANLS;<0aN% z;Vz<9n!Og}W5Z$54=b)xed5V5g!Oz7xUls?SW;G@Z_t>k0`5WrS3*q$T`^wIAquCYhU>ra6WluY0~*&v z%58>wWVHA6rKjv29G#sZzfx$TpV^>Ur2N`*0PsJxOq;8MYn5$&2)Unp2>t%#KnHQ- z9nQmpn`>9*Ja2bm|4J>&&ho0jkK!h)q@7CyQIv#|^E)h;2D9iHW1A!W*W_NBoCv3~ zBERt=7Hk5=amzajFc*_t$ICYxoYR)3f+mels?IL7TZo5JKN!gay$U~VD%#u)o83dB zm_zZ~p7lNmBR( z*!@85aU`=E9@^YTMR<~lUwyGlbx3!-EohSUfHsqbuD7dE#}9dCo?d%L8BQ?NXbT64 zJ4}}?AHwa{D93N#zf3MIpnDoJ>~obWGcM?58)HXpM(#?-bmazrrdE;PPuwjv{Ne|0 zU_2e4M;!VrJRFyO{f~U}{9&i!DkeH)#$KR66Lc)`rpoOGy{SPxRS@ZgPe zeLX8Vc(xPC##F@Ui&M=;#ua9v5=++2X6&er*H5Uq|9zR>%|{Gq`%b>Y8#S5}k01N1 zCQh*Erp31Nj@$2q9~jspF?8-87x&hU7kJEX9~|&KQ!y0#aHrU&Q^(`I;|~xdveb9) z(sXJ;%r%Ffsi}Y*3fmBUt4?G?V`I-LxkMx!sW9B}_1lta;x`6$Rd;uaeqK#>i9zgz zog2|P?dPsMnW`AA=zQ0kHVY&B1--|hyugY1|{%PCP9j(%}Ks%5-Q zLnH!9k=UtNZ}*RTkTU>7y|;pPt!CROpy|{Fkvt<^SePSO(a>m-9pD_ z{3A3yF|2Fdy;d|LVpHO=1owgIdY06QsXJ}EE{bfjPDLa?ZD`O8L$>HzUsAc~2TLi@ zSqq(~GzWw|+upBs%Inp{WY{Jxvfrk9U76$uixFzpM-FWziE2<)Nj>t06a0DEF8yX2 zulPPSrqD4JlTQr8>>Z+;p89wecGsz*iWC)0my=P<@iD$zU6(Vw+6G=ML!4LZC1G7@M>F3RVJxEU8HO(nY?Q7 z@pj2jm2Laho<@V5UAmaA&%dmB(aU3`ZR4)6hL4I(iL6R#oL{>0>`B`(DK65u9@EIV z5&rhBW>10I+Vxnt3*D<~b>QJ1V?;T=L)>@lXlS;!9^`+BP@Z};#?woD;JulIJQpJ6 z@r!y~#~%F1Bb?ov8Dz|33tb+xOU}zE+LDXTz$GVUJh+3;1lmHHZ@l*~)ruL^9{M;t z@yv1)j_PQioMX%CTMWuIDW!*$2_%=AjMzJfRA!k^(s`TGCcjH!&F=gZ!1^6{)RNIH z?h^X;2F#6Q&u!E`yfsNLT~JhGjhHdfHd8mbrx?5YYLh~x(MH5QNK31K$=2st@B2-Y zLG3E1*!DMwle~kCU4yKHM~`kS?P14rB`P9aCp+@%xzHINkL&Om&U0wX%Bt^cFP`D= z)5&^0YLVqE*yeL@TMq>oM738U>}+Q9QN7|y7)F&Q{ss?%aE!91+v&2>o&@E}8tly@ z8O#?J`o}nV=Gq`Ua&1Bub)N3hJN50EH*0QuqaLEz_h|YBADHblBL?SlHbmRoVXRpO zMX8JEElenD$EROjvlBza7}bkMAQ$o1iNDSu(_2)yjiBzP;DqK^Sa3 z32u|8sQbXW7ec6Xu)0SYTZu3W%#B-+*VXyf7|qoRZXRf>P5qg*;#@D^;YJ@t0`*yQ z3#)H#4xleND5tJi@SsyJIC7Kj8`4fb8D)me_ZOnP@~^_wm*re+X=h?)0}brrbw#g8J2bz`8rT&ZTOkNL>A*(VHG&r-TJ8~w_e1WiHpRu`|qDqJ?}4>z|Pyhlqa$U zoq;xLJvl*lonM(P2{+bGxvjbJSe1kALyxkMQZ62)+mMnddn}PV18e?Cl2E=|R(P~{ z0~`l3mW)0OTX^`|{xSU(iLIpje#sg=dw^7 z8r8j9aDcZtvs}S;{x}T5v8>5ImgVaJWzR<1Li9Td*%H{wc=O@!G1cx|h%5?xX32DU zO=sX4rfR3nMT%)k^qolcO>xfb?8H#RFXmHo;if4oi;XxQ^u3jpW6sp+edABYKHf08 zwGF@j)U#4ghJDAK3H^feGU%5(3pb&2bg`0k-{KnQE7^Y7(UdhCn%k8ppQ=-9v4)cZ z8olAxPJBSo*Xrs~7{k%X!;@t{P;DkMw3arJ>E^rIY*?C2-!`}Y54Nss{KwCgN_&nQ zZ_*55$&0E`iC0?+x|qJV)L0;$Qf{H>O|d{ zPJ2w+&fDM0?e>|epQ%~1_@n9L_9WuH*}f2^y^{r5H_sCo)M$;du>-aSE6uoLGmN(D zHn4hn+Pkm1=Them(cC)4{pJu)ti}?(Ea~YX=Q99M=HD)5D+tU%{r-NP@ch z?v6BlZV+BS8>xqy^lwW#&XR6s0t9{Ag2KkX$6R5`2Y4y0Al{bYA#WZ{T;!D<--nnB zB5hZ?*MgQz_Yhi#yv;~#=AkAWj_#f8mxk^zx>onsuX6*>&K~}989RjOi>%oPrMxJ* z8(bz3l9ja-lh`bQdK7|ek7$fUoL`;oQxBFTzvYtAO%t9-x@eq5kvGIGBKfXZ^zit= z^y{X2zkq8gk6ggO!A-6aVy@k5_0$*)JK1jH=NB#eA~_9gztAU_4e8W}ot=6bgBj5} z8Z42Qa75EV!p7QxOT}#JVyyu*;0<#x*==f&#~xD4;zlQ^y%umSNLTi<`*Ie>kiYhW zj!KmBD6n~oU@qvu75C2Tu`NVY34<}vG)=6~oW3GL5uT90q`5%@d&m%~X+Sz*4;@=8 zUb&FKE`H2IzRvmDQEr6&SWNw7rxM={6BD`X+Y>%Ksy0nyU)xz=aJe1nR*p{|I(bKY zhA!WX+fBL?0u3~KZkrf%+u^#FoYu;ma(jNhaN`RiY5o;^FbU}c+l&w-$;qC|h55iV z-|Gxiz4kcx$aXU+#nh0;Phr+>c>pBYJ=VHAMTzziG9PyI&m)!78*tT&SUZ3lCq_GC zayLOERr{I4*=>nE)oKcxD(KwxEUgV1+LqoN;hownQ0wsn}6W^W*`KkT{^qR%8SAHk^7S z(yAHf3Rv5gP1rL_=}GSot4)2P)#G6k@ZdGTTzt1pq$T)^vkDaIxnvE zc3%6uDTd912A?;a3ohg%VW01LBjr@C{eTVo>$D94Wf~57N-o1)(osb>6kRawhG4Iy z-~H93%X}$gTt~-9gfN0_&H!*A&6P#bp#YAj)BhqX5X78gK*_lfahFcu)E5_Hh|LnR z6Kt7V+KeZ!+0;|Q*5!%opG#!FikIU;h{pMU4m8I4UH_cm=u_hE>_E@PE}XpF?DDE! zH*W{pTuGTCuIxDp**bqg^-?ojdl6nUR>_LG`oAAfzl5J;!^AB8>@VhleDt7cI8Gbj{ zrQc!=bl}R==lds}xgMW*I844zU0UKJ@!Waw#d~_QWho31WI1^AQWVe@7m3;HY+xr~ zyTMv^o*Xd>Ow0C)05je3N({Fj_;Qy;-M88~V?;H;s<#t%oO(f@dL02VJ@;5&Sv7tA zxFb7pryPSk z`J+Adzb+0uJD>APad0DI!-*#0C*Vey_4o2H;uf2}~cpIbC z^~F*xDdql_FZ|8f)FZTOkbsoQ%dK0oy6Xi`|x6J6*_U}m=^$rNV;HZbnmWx zdK7^n1cZHLL0y^mabTJD0soxlzW)e|Dw9zC#rq1K=VrIuU(`OD@o?mHw0BR=K^AJO z6oFvN8o>iySY~O?-ycf4Zo+nO?ARpSy%fSP*Zu956Y~nraB!!|JC44{c}Kb~jh;Ju z*2nsJNx3$9_Tjxe+oO*x1pQtg%6^)7abW9t=b`aVncaD4#!pH`LY&&=na58}d|3P| zJF`|q5<`Tsq4_Qwr~9%aCzyNY!~-OXANVOv3pMd!dh%?94rNvSwdrM|M=`vrTjP~h` z2!iqc`aSn`#qxa-gsd-CGrXEldUx=%_NpHfo+pX3{Cnf~>GfE}WQ8DA_j6Epe-S(7 zRF90N&~@r^mYnv$GtDdi)@eLyCJya70OGJO9H;T`-@}hCqXV6p!(Dip){=fckDawU zj*(8{`@`#eI3eCdU$RJ)jK)~Duf=$a=KbnmF^vJ<(9u%H>sWbUHX~Je zBSON>nKqC_yXwcAd3z<2B3uGa$S8;3VVFVF69bTQk6 z>d8Z;r{rXsXb(4WobTyJ>u#9~vF@v*pR`NT#YMSuFAPY%I@dGy-{5u*Z6{gv0@?M7 zSX_&#-G&~Hb~wbSIy-P_Sn)u1+Kml}lLG?C9J{&l_hkZ8m-+hWA?<$ia?;m<4ywH` zTOHV&B*}&F*(HIEKXw4k%sw`&tI|DC)uj9F18+ooI_gz?aWP5O_4s6%7|wZ=cpzvz zR^=|P=UAi9)8K3IzgdOUu34fYbozrvMgO}YdBoGtIOR!@CObf={hb7Pn~e&Whg1~^ zt-6$!7ck29$v>vKRIPo{^;OR){aIz<{=(wTdaY?sw-U}0nW@G4Z;Kip_MT+CQ1(-r zRaX`UO8jMd0Vr_F>#cW!IUv)Z;k+IK{0p014*~QCc;{9eq9eD2O6mB&P3yB&0isr{ zCWC6r27&#G-oJj`Fg))DKIx|1Z|wJE+O^-5OSq-c+Q9rYNXX zX`v$`pdv--9Ys2X08*rdA|L`HN>MrjBGP-Pp$I5dq(gupz4soH?~dF3e&>91W`6IS z`TpCpN1Z44bKO^2*IMh@x!Y%-SDxAaMsZ5MKGroP#91jx!f91y^2rMj^+ql;!U2~p zQ6iS#*R?zkv~uFMCwxP6nfx3o#rshItg!OKU? z&(5%v!Q6%N90ZN| z=QTFRJ2T(st@i7&YOT%MgbZeGvcK%kn=I+VcD%11 zywq>w^{$&5oh;`=Dk2)zj5|Hac$C>z?0>3Y`alCQ7z+FCU4;B7VaNP1MeJda3QXdL zF~X&x^)$gnd;owUqKy|0oY9%8v?0wwaipp#%@97@_wu&FUH-7tG*PFzJr7>o;o}@j zAMSJD1KonQT1Bip{lRY6WhHCV@V`}%5b^LI_-=E5imHh;*dhj@ks$Kipc3~KYXcwn z^hyTISWlu}{mCPG)%4)&3_s{mHwLR5Ps#4xdr)rszylYd&1HZgMO-hv>U?>2uHorn zA33OM2BGtZ{f#uz8V_9O4j2;r@FlmjOmE&4 z!kfB&x2`B%;7poeFf$>Pt?A1Zx|azf)4AZJzq7ms#RLr$eP(o&K2BF`5@X$+c;$O% zXUI%@G@sQ1YLf`<-D&O=V)AhMXNu%!`CFun3xZq7k3)P6di7G~kzi_ya6D}#FL|-z zffR6hnNxba_a2j=gzwann)=qNRg&@Qp4SZB7=M>3tjuA(71cVJ(6S_IBYQf!t9LmI zx1?!yO7#XOp-l1Af^f}xRU*Tv+7~DsQ_sFd|q#5r)#>Ut4{*YP5LlTQy+AS z-$caP(>Tz!X47Ajj&>H5Q2wW0YZ>L28v>vku4Ksd+v5Wsc0Myg3VIu_!9&n@{4(n_c~bs5i|8{hQMIzO+VFu!8*J zK6BTe%06$dleQ-*$jNcJC(%{TJz=zKLG>xg1u?c|#g3;=9>bpwCxXkSgWc1-<=6UG zJiO|QUuC#9ghymNO}lah6J=mKvmU(jVVX_}XH3GuetwLr?v`0oe;Tj#`uKMaL>8)_ zIZfJ)6t+4+<}c?vqCHqvw$QlQ7kx`dfPkW);KWep*<3!6abC|&VwU`VyK&yM7F7p{ z=I~5jOe4;m>vD$R^SWGaYUTlj+kUIS8wZ0>*pR{4WzJO$-|jHi#=L2e!{*yRVI~cV zIFCGgzWO&^noO$im2sPKeZLWKqE~O79M0sX47X9EZQZAk|CpQ&5?xkxfp0pJk<*+}=c?Fkn``KLP9@ zbM$f~aE(!V2O}kxaXZd%K5-lvgi#(>__@J}7Df_I)FO6vsc8P5Z4YYoXr(;M@ib+B zDp#&`DmSQS^*+MpSgK;4aH5@1+H;cQs3X$-wLJN9_9_jvhAovJjVfxApd#SIPxP87 znZ--JsRUQ|-YWV%Icm;HdGq0XNkRcil*MChl&oqGayCaJWlv|Id`Wk6B9%CjVMpC0 zGA@a+rNvj(#_HI2o^H}$G?MuU`r#BSOE%#G#htDr87lp^s&f!D%fn&nAtXPik5}?= zjJ~JrujYbsYmdp+g_k%DxK}O~p>_nRQ-qtexMpyQ#TMZgW(|h9{=~2C87R3E2dA{6 z>FMJtT54a5GtZGFneXg*-=qZSIv0kT`yW?rJ3DaAD&Q;qOKIjcQpj3cuRV|xFgiV3 zGwEISi?-4Q(@wnEN5-k>^5eyv8-Dzq6pP)yBL!NL42ry#cpxQ#`*a)AX7=W5wpA~F z-p~3h)HeJlX>UW5DEtt>BEB`@rLVhA6l$djGk5T#cR7gbz5n&F{cI-@Dc-FxAsJkj zf=@pB`VTPbC7t(!dvYsxtx%ta&&0=S6x(bZgs#tYBK|b5vHOqA@-7_spqGUYO^!1zjmbt-`H{L{gM1V1()5c)V0np ziJZ<;t0#*$Jy)iw+`)?NwG)e)`>L4OOMVG&q)|XN#nmG_+E&3%`0`}{>lCkdA!OzH z#*2d>-K16OEo=R7h`0|^AjHQzT#)_a0m3707GOT4nO8Lt;;Mu!&}*J^4W!m`yvEuM zoCd>lYt3Vs{@z^iKgDTMk}xc)#n0Yx-HsCWMY_bj>ffxf5jttRAnD>#`$}WYxOu66 zFi%=5nv~|9#XWCM+o?+N=Z*O0?N!L=ahc6fQP`WNjF$E%JC)8L#U`EAANMlvl|Nvk z?qzK^%Wd4U$$XT3o$BqA8yJ6@-C9?kHn6rC;a!x<54J$Qnof+#Mzamz?lfO8RfZDK#rD-iW5Eg zUWYGpxY7%npuw3mIkQh{q4QY2F}0QB**V0f@9yx$R&yBJJv@8>q=H7K_Uh`0C!?j= zZ?&Lj<;QE(Ve-ONf+uZF5-zI~C+t~!%hSZpA10_rgTQFY+m)`kwE1A&L4xmD1giVN z#|UFsV7xdfm?~_1)WqjQQ=}L|5^hG3M zQ%NEZSQS5;H!lxJy8R_KXMv8w+ZY6KV( zu^Dm9b6v7SZjM;pdtjvkOS@9KfY_1W34-L)RB5(=nvQB*m;yQZ2dj%j%nQ8Du<9QS z|H1aIzS~u?1@nEZyV2uHoW{wt#Jy!K3NW^-JXf3J zdn=`*Y~QY0O-YW>A8a<6KiN#j$&Y^~xqm$&F{S{;T*WA0Mtxu-+wq9S2P<{cMx?3W zzKRV^NPmtd8UMxxTXI0#XObW$#7-P^dvBp%Jyv&f7rJq4X+!KCQqHLFIO=C*ig&}S zdbLVi%twGUeJv~Y$r+DBd`NS%OhveTo@)#hPr6i#t#B4@qRFen+jgtme(Sn@==@n3 zwlPl3)AM~_#!-)P_3je75bpc?dfZY%!EGYI^z7 z>wBW)#r1nT6Fu5|!FlnF3$q{hQ7trUv1`+Jo@8I3Lw-ELmR0tYY%yhx_I3w*tjUZd z;(mD_2*(1mF5KLa=gIyWiy3y@z9$R*tOuc?>p}!8uXGutNk!~nf^SMnp#BE<->pPb zS6mKC8um;9Ap@!JDFCShO>85sg-uyn7)adp{F*N6L%?In>s$z3zxTuo-b)FWT7G4B zUY3#?HGCNSQ~-2i3N8u!{ukzD6=d${O?@AlGJLnU?nl<;zitJwdEixLqk!x2c7y?Y zH;fuJpO-eu->=cU9EAHu>pe^ZDHKPp;Fg*~d*sZZ<1Qe!OPBxN_*zgNs)#8I_5S-C zwipt69tD~`h!`ec{&0rA4#wMPI{a&`r@K63!HR~LJFtGFI-+O;4k6avTyhv726We%F3CS)PL$@ z__;Tfbotf|#U*@Ybkz+fZb_qkk3xVGkfC+bEZttoRK`4E{5)x8^A66CHL5ry2;ugmoR-$*oJv0|S!*^QucUC70d=%*eQQr{XjH_jI2 zIu&FVce(00;*wX{9%kM0HYV6luL84g87-G+N}|n+4Nx7N7I4dV~4T)I?8K}N^nvRG6{rdlym%B$gz zKiO{}7AfNhjxDT`exuZ+ueJV=_u3!6X647_GipVTXV?f2kM9oZLuFqM}IOm0gYWj@FDjF-*_u2WAJIV zN~iI0e~Hn`J#D4Ii5mAEtj}=nxi>KfIZ@ca%}j zKSQcsUH+Lrs=KLzvwySpZFUl=nRcvjZ>66eo+NhaehL7B2&PWVLR!?Ou52B}8~ozb zRHy<`E#9W+66zM zs|shx_SpmI+u!)~6m5}0m-VcZV$c0BKM8#jQGVO7g%ZYrcuurBSu#w9Ud+%>uM~${ zlD*MAFh^r;n9vrS8fntRZfR*GfckLmofu{TnRjMg&|;w`-#C74b=fP{+i+)c(!w{tE+4Tqmvk0b`?!5Ztq(&MwEM?x^%4E;SqvvGKZ(NK>N zVQfDT)kpl!xc4j2iuJpIU!XA{TGHKZ+GT2KgsR1K@Teo#xJTiRL+8Cj@dDaR<5f;H z-ANLmZ`Qne=s!W2943>c{TMygN6CyU*M!CGex`Hy7JIx`_u}4Y3*poHb&Q@TcG^tH z8yk8Jc1Ai*c8}Le4ZLO=@W>*Z00?eZ<8qj34RBI2qoY|Kv{5Iy$#jeIWiR$%C8ni# z=Y-SZ;9x3giVQcxIBAYAQTL*k$AxKkD9Zqx4JPe)GV5j)QId@}cuM8HsGs!8$R)Vg z+P%pqAkS8V1FxR&VDM;TVhGqt>!(wiaUu?43U=KnVRgOVpV-N=HAPkG7H*6}`8gn+ z=aD5vhF^@jKHMVSRG7>&EVJ&QOacqcTe^yv(EB`0l+}3b2CBdB1gnH;3wcgkdlSUk zpjHgtRaUq5pP~s4&$lK<_dJ6^=^=@i>-MuW#`eg2VY&2SAPL^5^;Uuka%@RB zPtZocNu>p71N1|cv!`4gYM&k=q&bI1>evSJIW>sxng>hlLB5=D^39oqK-Z6>Pf>aL zo@sFsdn<#%`U`WnQK@n-nl&Xr1bX!#gz$bOUA{}#B>mcuRy?UbJKodwkUk1cyp!bh zY+JElh}?7X^6ms(_^-$7LBHSa$n!n&3aXamrPE{hvVh{c_h2cNXt>-i*O71NR&~ML zk^DK>YHoMg@3xc3mOY0Ei;h`G!hW~D?QAS(5`ebHOGC2G3L%@^95<;UvYl-`%9yq{ zMprs(POzNFoImHo1NXS=AHLX)5U-p?q1h7T@SS_9Mhn^jjWlVnXAD#H4PfVi9qngrpbW!e}prhXWnkO>bq}~^=i^h>Ls-q8?0N)vR zb38}D%wi>y1*{t~*#)n8HL9nBDd0#0qoQYx1P3(2=dxptsqA|2odBqsf4kCo(|gA} ziu*_inl{&sa6SDzlyV(l2jSk&R%(cpMAm~U9PoCwHYfAGi;WcmiH4p_ZF6F;h&h=z zh@JmZI(oF+;m#&rLsW(3ip-e^I9O&T5*zqGAJQ^F!J?XYO+IRudju1E&7|V3f6`Ye zpBy^v2#~P^DJx&m2;5A?YotgK|ETwFY2sFujjU-2>wbFjdb9_hE#8F5CFa(%7b;?yBqwJqi3P{3nPba$sl=`!#9r7y19Wx zr?JmuHesd@6?z(D#ZZ4#guq`G`n=tya3mzOJWwi10{Zv<=pV=9&Zv;Janx3gzrP#di6Ba>_e%W-fsefJS$XIAjCKEynoEUscB8pMfIiftecfRe{^3ZrbNXvj zt;@+B$SUkw);~l5(I3Lzvs!6PH+nEpJ~+*kLuP)ncPm>|RjT6+{_J9?<(oX_xmse^ z&*OHc=7mr%$JaHX=OX+D)elcNUmLPIVN~dhjLMIR>vorARrBs{CMWI6aA;MkS(>^B zOB}~Z$y9BGZhc&S&AGB;o)3;SmHHlvN=2RRN3y*}6OF_G0r>OL&=VwCF9zHZR5L_X~m;gzaa^qv?^#W4$s_d>qL>_n?9ctVDHY zTIZBh^*KL}fqGeNd2lxLYp~mlNSMT#rC^Z{8Bz0*Afu<^t0sMeryY~#q@;vrQ)^kC z-ckOf8uveceQ9q zRDUo&g!y4-6am4*0wLWkU?UW}1K8Q}PRn9}keurC())*44l9%b?`-_;6xgA*qNPoq6r49C_v#N&l zDvgbbr!=KcPMl}!&(h~;ZrV0~a&TvHnVE8e2m7@N7$?jM=;&d*%t5J9mXB344ur_I zTaT67{j8Jfl=!yFaS{1s_<`g7gH$}w!NG8r4!yOp1Za9wnZGpu6R5kA@9?fWhLc#{ zVQ2e^aH4at{TAQ3xY^+AmnV?P4qt{grx3{2VpG=fh;yFKCLKjOY02p_{VHn? zd;7N7Eod;*;Gns+lS@uX&X{X+?hPJU@W5zenaOb^y3`!cj+D{4(s2pXi@0?MZ0pRU z*#h-U@lO|j{n^&t5&^q9u`kNa4CvxlS!ZeG%Ab_9hz!|u8w{r_IJB9|kULq|i%k^Y zRCSKPWP^oCV|7_8+yXE3K$rMeKW4#Cp=F)jN8rSIo;N7nbZUL;`NC@z{l;y?tT#L_ zqyAqmz!)QV9ouOK>;bvaax;O@L#U(i(P}%fmWj#Zxv=^I^jG&wP+Tx5S^hH;&6%Yl zG~+oXa?UKGi>1ddp$f4H31y#4(_Np=BNS68KHAqc(WF}L0N#d@z5Q1{zpL<>*ZI_O z9X$w;u7k^Xl>b}0Zi~StB=v63D^&YyuV?_m#mrqf`f;GYIon%)|4Y&tp@!YksW>t6 z7oqaUo-y zF5ISZwR~C@pOOoX2J9>%Ufx>)JH0D@p0$E6ua6CWaZ#EVXcm*njH=&?K0lY^w`|W| zC(TpkxmXDP2Ok{Xdfv>#w`x604u2}eM~t>T1&AE~;$W>%xzliyo-8?f!HpoB)Kt;}ql%!aDgUtQ`IGfpGXLWxUN7ro>U%4E-h9IIu$Lx)wbn!) z4u0zwz!&FIj>PYe4YUuYK%jw17Lh6UY?U73cK9w6e(R>HV)?Z|NZ;!kUGv#UgnY=i zBO!Y9<`L~}OsKw;=bA=}Gzkq+D&37jx^u8^c6LQPF2GT7Z16z@c;vA^+}DOz%JI6p z^C(u;ZF87>XA*w)SiL~zQ9xr9{a&4;+aDE_T87&~PqFXO)JF#n>D>!p)kgN0xAkG| zN<9~Nth)y2D49!*>SpVF!gJw{oYVPLg7gb0hB}rQaZ+oA1j`E#Jz?l`u%KHWS2Ac^ zj(T%KkziHS!UQ@dax^mIE5u!;=Wsz=H5p8DfNTxJE!d?v>VVehd&jwdraWz}|5U_w zN(c4O<**6XN$(ZTE^&Zp)fXf1{>%#gM9-c*6CPLgCY5gxoS$|bwifK7t} z(SRdU;12?WZmBR#m|8OhCoQAsgIo1;ISpWPC#<-5adfb5@(*kNJq29+s(P)Ds zax-+TEz120^@F9cs2eu`0pQ2okSmK#DUIrjS)zeSKf^=tsjpD@(VgTqoK2C2Om-{i zO55J78ySvnEiAdsj-E%xFlhhZp0;SoV5OV`8hNX3vsul5nkFc9YlcHxZ+v9JOdVdO zR4Pq){D?n~A3UDKz*zVapfipw5P#d5$zUp(Itt$zz2)V8dhfkuD!^G4y+#rU;raMQ z>zo`CQ0r5k^T6q)OF**KJPTqL1cj^o<_?`^!81$3RJy-=QQrvAKR_6Z#Vi2Y=-)5~ z|8+2lFOI(OVu#a*Gxyn-8@Dkk@VmQww#Ca0e*Ihm1)O5`Xy!u4U*~#K<%mxX@aL43 zIU7Oum^zdoXiEFz$B!T%`pH4S=TyOdlS2aDTgq5fpb{A(1klh&f}lO=QMFJQpI3jL zCM&;5`NJ)SMtqcUutbh#O3>%-#1_xmgIj-p2~ep0kUIa7Zv7nWY7T?j&hK@6mpUsY zp~?^>pFht0r&B)%L;K-dBs6Bb5ss&sk2Ai2Ji_!T$Yx@;>mzaNwbq9f3Zj0bS$pc1 zHzDdFpqu6%`^{nE)kM=AK2QjKk!%$RB^M#JL1!l4$V81)s`eYd+L_`vS{%nH9yDes zk^mWAzW4{@OQ}ma#%x0*oKF+&lrR3xGc6NXy8O3DGJPW#dV@8KI4(Fne|AbG zy%d1=DE|D0@BrjdT8?|^BLXbNM-Mn9;3GVmiUe`QbcDe(LuG*p5Ds7BXG^GI`85a#PbyyDCXg?h)F*$F2wQER z3oavfmT*3z1gaji>baK^NO$HSn$y8bCm*je47)bO;acmF^I+(&sYy8kHL(qMbJJRT zumh4QK8F5P5K&5bAEBNo%fKVQrPKHg{0OZpH_tyIyp}t>*%auP8vNLUZ@}Rczi)+b zVITxkYH|WQB2`{B6;Or@Z^fnH!8{^Q@`sE6?+o`pH3g)`vhDNZ&Q&daVDQW?s$0H^ zoDO|vwIWuN56*`^a`n9D%sdGcIo1YgPG1?^m@oiEQBj#^LGd9Sc(DGK@82S->a@08B;_Ah)d0~|@d z&)}O#Xl#2<`hRULxz|oO&COJNutz%FeASfTj^`;juce6I_z8 zG+%!aDY#ogjSLUcjsm5M0-lf5s+{+I0i zKQtl4dm^HoA}AQkwCU>;e&mJUsnXoJh zrGb1k5HhV{d-wi*wS7moDK$9kkiWd}Lg_1muRzm!g>Svhi3$Di#TCf5E7PdQ#a_=Q zH?wahzp)ETy^HzNS|9MCPW>0S@uX#GX*PDMn6}ESNA_G$yj`pMGkHRZOj!CiBnX0{ z!0*X;uh_SCK+zI^{6FOZf&}MvehHi0B-qnOx@+{XUFYZ5(HpNj-IqzOI73(lKi005 zBE5}fCx4Lpo=fv6yWxj7rpgW74q*rK zL{O9Em`4>vfUUL`4B{5tiRasipzrwBjL^J7=#vEh_kEJaUMQ{KIgizm%g-W2*YcCL zW_WL_sF2!3U+Ikm2l@0SI7l*JZg9x=+;OU{FT(iNrb;s2<5PB_gm-HUKB>x|#%bJL z*a=YaN5WOa65`(D2Veh<(-#j3ajFPbJ47JIgHBEgEEEW>CrD1+f7c8BkN#`p2}E=z z%0mWkIGllsuFdEw@`52#j?85{6$}salMBG7fDAn=V0K2EM-zTdP%GuHevbC##RUZi zUbuspiBqN-*4%^up@xdH_L&JD9y#kIE8y$7Rl%dUek2@PP$MWjd?bQ-oHmDF>gr^_ zhx5U3bgu2(U!{Q1kuSM)M}aU_sl08BGHtz5;=4N!iWU(xM)Ff;6E6`o`O%PtT3UnO zleXQD$rWF$ffiQ>ckppZl&hdE4~}tarf8b7lhpZPjbciTtow3aPz|r#M4WR3kn55 zzV>SMaA#L)n{a%ubN?^e;M-AZpzU&f9O!1eMIUycWDAzATIH}zW&I;k4S#?6uCz4b zaEkEaxv~PZ$X^z>_9_+CRH%d#{N#&mP5ulg8@R&w@8NHeTkVuEuv{V$NEFY1rxl5_ z3Fci}57=#v@&Cwr8hP1Ao1&Ocxou?6jnms~c}|Xh z4_Dwsx)i3nZU`Dstc_Jvp=*BD#9_XHkN1_O>u)shoVxJ>Vz9x^P06jQ^(dJwn>{li z6g>{(Mdmt@D{ktefdWw|0jT$M2WJBzuNBNERbI!{9fDn`Hs9udndy`^M^9W(>> zAArpD!)&243*|=BQcc=$2pXqkBmvX}Qj*6aJfd#Qk!&AZj$4xYDF!*rhJT~T4edp+*jgy-3^eaAk8-=9I;QIA%0MB=L7DUj8 zBk2)(8$d&uL+FicU-yHS&)X&Es|tX$eZF_(5&uq|;OU@*DU<9LA+p3U`K<(h}_5>RXH+4@3 zqneYY%FbRc_Xr_IHZ}aFtPj_eCE-@VbypBLVg{-_Q3$EdXNT?uM^F zxb1Skthu*HsZ{X6HYdXV0?2Mxy6>Ab|bB+0Jh zE=m|!$f5<+cZ0Q$)0>KgJ*!Qm1dO1~H~lW#9M7m3fORn7x6!||v-oubgyed*5Rzs0 z@b01aff+K_&-l8ROW_VrkdBgYBTbL7+BV}IFm~5SJ#-f~X^digLl{GvTZ>%tFH*8; zfxV6RW3`u)hc;_3p2hz21|!cCe)>6>&LH3>ThSRx>E50^Q2&Jr+Em_+?9&ndwk*w-i#$aFuKZ@%BCk-A6o?cQl4*k5SvWQx~j=FjBN$a z+1w9z#~crJ6WhO-cf5t&?7y6ib}vZ0Q=j!RK*Fe2o%OV83P+Mpex|&p<~gJ1XYj?M zzs?Q!hn0O$hed{EJUTi$A8I54h&Gono8dLhLXXUTx1mdc^L@J2x*AeK4R@PIOC3%( zq6U*2=IOMAZpCDu#9Ps(VQJo^NK)LVpn&^zGMczAoy?jlCeW@SmuGJ^`#Tvpye72y^VIW0eCxibifo>5eA>a) z=hf3S0q*u|Z#cY}WF>qp8n-7&XgN!uE~;5<;J1d{p7R zH-~S11jJsLwj|s+)i-RRMGaWAvv~^x+E&B;sJ|QD%0TmExQ87M0K$1BCSH}$yj&L| zM*CK{(LIaQUns*KxuvVA$_sA~7RnVbw?q|txA0^O^71L{`ians<-$xCf8`R(%3=i9 zamQ4bh>{E=;=O&h1e0{29BuO0GqPeB!FjI;fqOuUl}etJ=6l6hs=aNBp%A08V|RCm z`Gch0>ve3>?G6J3D6qOR4P>4}W5fyEaC!so%8TbSS> z<&(E=l)M+RnY2nrZN*c+QDBgW%=9ir!?z24uIUgPlv!@E`*=d?X94r?dn1X z#~l0ym1EkPPba*P4eFwEQ>t%(D~U|*9h$m%*%S)m6K1+(K(0=dBTB|z(>%`ql1mDW zD-2HBIKWeKx1(kQ#l6oWa4IqmZ6*1QL@-dC8^{Y9BB5^p%S5SmpFP$*&~t5!hLUPZ zY$E=9e$_NB>?be!m|F3n_c3v?`wHVotqs)i)KPSGqIO*5Hgc{H;1w+LbgJ;O<;*By zyY&cp{~8L|t}(+jWipyYo4x4LFSbM6f;rdBRye#e>)Q*~O3!YHt`I4}T3FndW;vrd2`7V&VMR}>Uj&S6NLM$Lp$k%^5 zjd<^Pdi2TK8tAT7)ke2+w!$90CxhKXq(0*A0gS*u^`z?xV9iPK%izC7U2RANWbk1J z7rjde7o+WgyT?0UczQxLLAn;4kc2bzH2Ad*viCto1lriGrl!}_ zJh#Eu1GV#FiDbXkNY=%r^HIwA8uoDK2?{g+S;HyaB6nlR#1?-LL^nMnAQS5W-_yXo zyAk@6gdR9i9e6Eh0v0I8;zUWki$i6llgyoARMyROQoIs8P(R%%ysJ&|Y5=5L=;f`l zwC+GKV8kj+t37*p>u@SnuGZK86a~Z(Eqbcc$f21d@Kf52ll2z@c53kxo32qg>;yy45WLk_f|1Kp`>X_`Xojl2Kv zF%zr>YOnljEkL@XpNiYX(o-Hsd}v7?P&_av=u57hrZ_BSkrG&D?`k;qYfhYUdn(a4KYmZS-e-wIhYv!y!AAdj&IDepB)#O z{_O7Z1QR@udyP^RKC@=txn3WuP)!0G*dGuQ6lD^8bcWK*OTITTJA$p-$uBHwJNZD= z=J$;7<~|4GUTb5UQ<@S;;UNXPE(0!SURi@)$NIV6=Q*HaD37`d&pZmp9FE$!ITFq) z)cw-79I|YP<9O~FO7db3!0b2#tO#Ow70?!FuD>q+>k*N(yrFPK5Q>?MN``}zz=NyEy^ipgfn@wE}4@SYi!3h{kZCqGy+OK6Hond$Jx5KGSNa5S~kadEaCgjb{-JTXjT?2`qL^ZH~E;7 zv2>w=0BhBWCm1|1gDNFk&DZ>YELjk9OGR%u5)sN>SEh~00C{rtAHF=zgyihJ6PQN) zE7b9mH{R}ak;71ifB=vlw+DOQ7{!C29Y`R1 zwy|C`a#CB2FJltevV%1Bejwuv5M;+QUyu8!uy7U%Fx}xd-aAbn@%cU~GjtUMFz)|zvz8Y#j`Y9r zUu^?@i-^XFdQUu*DID z+kA@;L|)I)(|41uP*;EzyEIiM1I)iTxi||rlY!wBWl@n{?@VdU`E*A?-|o`1q5^+T zYXKvBVb%2K>)02)Q+4_zOHJL4GTx0@)j~#<8_vox{&N@f0@i-tyu2oR8Ed>A$?Mm6 zVdG3C6^xQfuNkm2ol-1kikvHEW-@l0Ns=b26mU)w>6bL`-Fx}_w;RvreNME?iONfz zLzEuSxeQ$&1*Smro7evY8vqdhx53uExh2%xZtQWrL0WD&1b7*>ums$g5usj~yDJK$ zV&SR2u0+75=q??MmLqwqb?H-U=fgiorQrbFcwXynw5+z?T>PGBE2?ZW6BaSIzKe7gr9r&j@L#jrollmhLVdU>hPJjH zj*4AY7K%NNt`HygHPYP40LFQ6r-*ss{S2~8#^uI)eLP+-S|5<$EIw`w)vdVEHR(#* zwW#tTR8P=`yUFQ>j|U+Q!y#2wmhce9G8t3Wfa0Zz&vHl5$Gm>g2d3tniBk_XaX4h)sf24KN| zeFd;MA|wp;=D3g!GDl4NaTCSa_85B9i-0Ik2S1TAOuMTr`}@&2Db(><#6P_ixa z7=7A*R5^aCgc;f34OF!$qa;{YW``JOP8%9!+`_-yU|IlOQcIcJd{SW@xU9#oE;N`Y z-{iYF{p*@mD&pzWr|H%YY0gaS&?ON8f3SiC{%nF@#;hr@j%@M7ZhcvE0N7gOo4Sg- zKL5yv=ksMx2QSb!>^Lhclj!J~ef7p`)7!UwV+I?jZgQY(TFLgwZieEXip8)aewjaH zd*LwMpVp|(JSFL+-D=BJL$CU$NlfxKkTgqrz0FnOAd)bi>&F=kx^M1tXp@tLunZ4h zr$uxjLmf7Gt1c!Yo5`Y+sn$Xn7sg>bQ?Je{eZCt*dOB>D-tz(`p)bqb{>m9kBFzs7 zXo;6a0Gsb!Nc_)iX~Yo>ZCey}H|o1YH?2rQneLmXX_N`;KU_Up$XdmziT=DW)cKjv;A$!w!9QXhcg!zBH zjY!=H65@LlsH3X7I)Z#5Q64`~s7qx(Txex^@ofPrs<7s<81}c29_i>7?`dmWKg@|B zmY`^XgiQ==n#(`urH#RSwzTI-=BvgqqhsUaTGC*gEBe1)cTirxA*k1}yOBa9)f>5a zgL4g|LO;9Nq_jCZ>qsCH&XjZ9+IIe#r*-}bnJ0{zAQ z?oFhW?>5wH1I#HH8U|S};&%-#Dou1`xPtu3(e0s?%Ev~CwkQUzrhRAj-M5d64qmf3 ziPNUqmAS3m?5rFdd8j3iKbqOAJhs&vp+)ws0=7S;rUomW&%wF}TE2N8Tyw;<+s+xg z;~@fIxVeY7raC8sErHj}AXur0Ki=Q9DHtqpwX&Mi(leT`@;33KH?NYgWD0tZk4$mV z0d^=|H zNh)NZDmny$UxL_u>sEy}H$hL>yxR7J_u5ED==!(I7ttf5H`jo@ot7bmR+;r)rOg+s z7s}USO|FLxG(_|LijOnhWm7Q~m7x7SGZU9xO5yIHbh2XH`1YhmDFIR_N<$3#K}PrA z%?Ymw1_4T8w58bv_ir>X<)FJqMUnx<;=>O5Aw8sW3y^h14L;POHv%#L96Q*$9>-lZ z=+&?7GGF&x`Z?*w_~tZD&=I<>KHd-@2P2FqH2;?B{ z4o+UdkZv4s_zw&8+%0G0Rnn3lTpzIzm zoIVIjdyC?Sk=i0pAp}FJdvuf(N9wYvVrphcF*g^d^(fFMo(SWy7VaLUW){(#pr|}| zjRYMVdr2uzK`bzLG+564iClN083hG}dn{@&DmuiVC<&!!KnHVOhzjAz4Xg_2?-^qG z>u)-A<|Nj~?#E37B-U?kW6}t&PkCnIgf>`U+{5eZb)%}7vtrE7Xs`WqcWC#p6h2H- z5!yaZoAHF@roaW@Nic%YBS{PIbdtssLnpt^vJ}$Y}zud;WuY~I;Gmha3Uzb zlbt!6RWM`~(AT1@1H_A=zB`)mbyOXuO;C792LNZ1<^vZmZ?^9Jy7uKu{>#_flwbIZ zUUsM@aD7&xd8Mgk{=jxPWQXZ&)%}({kCZWaAqhe7zNr?}&ZY%#zK$-Uxm6N~rP9Ea zskGde0xj?|_yk5ec6RGVG6C0)()%kVvY7AeSI|jC#2zRxFa#K<-{`%q+p7S)utRe* zkh8LwY6-8w0%NkL4ntzTW`>3o1|S}CjdN%*bOu=S(!B(klaOyaMLHC~dn*-@6`BU5 z0f7*W=~+_aXDb;pF0al(y$v44D$tLWJ5pNBCB&M)PIMeBBsURiB8T-{%0pd0RZA<; z@?B3}s&p9p$|im%A>AzKDE_iHyoKm#PqIL04??%fBx&b45A|w)lnlik7IeDyArXUO z*wN6_A=pm60Pk{d+MkTIG5cyHqrhzPU^$^1e(6T=5 zUM3mO#J1^Pb{TIyz$-rw`Gw+q$Sx;)do`akxm=*Vn8-wGXLG_+F*-I$ZtrMEof!Jp zJ=ke38nDW2W*@SPzgvn>OL(*9xYw62+^c72ZO*odg`}=Qj^@)aXvA6&#LObU6&R8^ zNOvCn)-eoJc%1w4b*bx|a>!`hTLZG)wAf^AgwyN1*DGF%?A?<-x*8LA_f+|Z^x@lS z;;b4Sz{%;6rU!N|Qh_5IU2+*d^QJJr;@@jH|AkPluh`&}&uHtJot?9?itkm}dpEG* zKjuEaD%HEA`HpFzufwaTW2>;mQ}1no!iwyio|M#a9_baZ4x`wR;RTaN?;lmbl~?)7iS@S3U=_-)!j)*Peb*_39bZY8hQs0KXf?{)M(w~kUb zq;A(sT0QD|!6Jhpt-9vDfAr#Kr778ZD5z1t0O{POCndP&bX|A#ymY>4EvnG1oztuVQLEaz99Q+qKj zcG5*xiu5c45~xeX440tb(672(ta7iAHgQo6g$9mnTld=nq1y+o00z7ts~}4NRY*!3 zS6uvSIQQW_Pz$Txh0mLt&;<9&TOq%OZXK!8nS%SZFyI#9FkDDd;lP3z$m5*2c5NXJ zRAUk|cWz@ub(wkbZ=rFum3^yr1xesWQS~^001YYDxM=+z(=-7Vt>K2q_3FwCSI@=mv>(KW|K2?lpNm~AIrp-=r0d@$ss-61(K z$q&GIp6|yM%EDHz9*sNBhi1v7HqS}}An15<{gK_}_wz_?F!EBY1wc+InJS%nx>~ZP z^tvf)bc_?HkQEICW9^accq#1WLK3Maa2M*h9RJO==C=xJ0?kWO)C7>C&HjAA&gsLb ztcb1bNBQnVOX5#k<4Mr3&a@eEg61_+jKAdo(_@Zy6BP-?a-XNC^lEN|%Iy3L-I*Lr6Cg(jw9@gfz%VBSL@+21>k5OoSKbhLKw5Io?cq)cmWBKxv|qC(WhYf(b5YT zUX?~!!>4Udmot2+8xxO>#xGNcF7TTlXf)}zxCdS9ZZluM$C3*P^xfe zVz({a<*mUt6i5^_#7_BAO_dy9kHP-DCsp#eqj)LW+FWG-LH(qc4d=LH^lM|09)8vA zFkYeUtX_3ojGhWy@*ytrLtGg%nb?eXn@2Biffc)`cEQcaJU=8b9QDA$H?wJK>3FbS z*X;dkz+Rf|F>FEVv*whD%^^nbKgTKX^XJqg$TMd14ZJvX6I}~ZaE9hGJx2_sC@zCJ zedV|3E_P#tg|5vSkW0?L{@c2h#ke*Ep1?6@@m9LxE2q&{$`rpep1Y#^yDZ8`sZef0 z7q<0KYu!o>mjO1!kS&>uZchq>ZHGG4;^kiR*h_FU*KDfchb{WydShdCD;?q?-uDU- zkkKru`;r!UTCr>y-yVq$SLlqeer7~8UBc5%RRT5ZtIsiiabNf z(ZKX#{)bRTBQM*0Dx# zw|l6^E;ZGQz?npg7+U1LX?8*z4n09E7lxv0GY zr8T>`H=nW+5N8q)`+_FI!l34Yt`~ntPh~(4j?Qgy`8aGV7~o%IHAV{Z!;}7ewB5oP z2oFs1c+k{d8lvL9i1F`SQN>F*HOW45*or5Sli#*lgK}IOMA^*iV`O9%OCL!iJ~}H}oApJX_7ADtw1VEu(!8#=_`?Q%Vy3jmM=r4yFR2bo^(6)WU~!tG2jBCozz& z(nzy^foOHs0Ii{#(62N57mXJ%YLD|BpJypue2MVZ^QF#$sZ@NGuyqMcT82wl_FdV?ngCg&k$^R8w z*d2`(Cv3h0(NVVZ45j5CE&jqde?yXZT?DzsqKNzCx&`-)N07OsV7C>uGY{C=6T&1j zQE4N&%=b8PKg1Tv$ACa%c8LJ~Lnp6tPb;H_8&;PZrj0`A%WPh%t)?SD*PzwAMV8y# z4L2pECIt!i7?XD{X6WET1_6a&dRATXAMWQqPq59j{1<%#Qhl(o;a%LkdnPisukAUv zYybzZG-NkN^G;^~eN31CcOBdS=ox|HJL0vrSOnDEO zOgu>jD-??e`z|HklHEYql8!f(jUe}EsubZ@fx{A&GAY9BI!8Q?D9t;`(&_rLPRqZs zpB&X_l6v8Ct{13j)|!){pYk$@eVL-xD#Pyc+G5!F5x;Xut+l+cmE3qjf#1IV_Yw8kK{e}BqdZ}=@XZW>; zNEGbS`PE|qYA)O)7dn`&=-6k`tdps9AKDwTI zbzlR$AkKMAF?+e5eyY^?>gAZ_SRq!4z0^i}0m#?0&D3`7M4W;M9?0S3I1r-Nb28=y zO4%Q8t%Ac3Z&}|Qr#KBD<8DXiKs+i14#VgD2hi}}0-Af1De#KjzVh{y+dO^O@bGe7 z+~Snt%Y~cTN1x4Wx-zb!c{M^Yd<-&F2Kcyjx_roBMs#Pi2;Q%CWY;(}f(!Wy9m_pDYT|KHgZU0@Y}tE!696RM zU#%owU)|KP&~yE62edeUlt#AKrS7gz3M0>D3LQ}k(KQhpCv>_T_MkvV53g!|c&d1e z@|Uod!@~%?UF0$MXmG*Z)2%Ts>#{W(irqx26)9OK%tplE)zN7clvP82qJ}~bZo|Ft z!yR)}{{GGH5788c8e^S5`4LA!RWB(Pu)nnIj{I7A=?6~fvzfK~E%|f09#V>Yc~3ayf2{fUZvgJ|F93Sl(R?oUBP{o`gGGa54N5$H#g0AT-ne$X`c>+M~#V{J|bCArkRllkAiww6BDp~ z_E(ZGD>UED%lke$1`)2!jNJ+{u@7Gp6|k~_SRe;EUB&45Y*5q)8^KEZpdMPz+GKsuRCmmydhXIr_@cY@D%K=KlXSX_*{Y(&jOZp|(1tz47(k=yK|0&Q>M}Y-8 zjPJ*sFxh~8_yIpo3f0Ma--pf8BZoJJPU8yJ*7>D`ap(Ri#{6|RMb2D0x5)Yue~aA+ z$Jz9m6O$n~O&=J=Hjduz{*K%XA-hUvDR`KlKhxg z^WffH;ugAlf_${_I|I#Zwb?!i0(efI*1en{Ov@eU*IaS+$oHnjfS?_klMXw7eYq1e z27xX5aQ^l2kX*YV(<4kOm%6=e{@3Q;Jh#|oV2gXwoxcHK{GL>yq6a*O3eOKQ8XfWLPY8fT{5Ed|_i+??^Bet)xlkJV=}-jmHmW zb1NH#6_o$U#eJK{=;nb1%UFkib7+r8EYmW7&NTZk#N_*?m&0!jnAbU3iM#XlZxYan zRGyh)h~@oZ&5a9ADm|3s7IP*CxTIj{N7a+z6fJ%(=i7oksQN4b#;8x@Pf)dGDoe8C z5f^!WvGH7AdkyV-A0W3Fj~A~&2ItV^C0v+*lV#D3V1p*XXfQV{GJptcI*rDU8F3ny zlt*r;#|m9T+&g{LM-(}dQWUB3Omj+iY-_kuE~G#kb4y1&v#Z*k1W^)cv*%?GPCHQI zPc0A3QMYetT>N|dE&CsW`R^sSML~Rx8M_M)bhE~5T;&63Sv31JKX-*?CtD-ym?5tJ z0d&=kJu~1aB`NR3lTBS6W!FxMTyVBv&gd~X>fwH$G~L6UFqR?4lJ{~}T@aLOSP?7= zoG4Gv-MOgc1`b&nZgVE;+1W2>vvXOHboO@A$j1d}Kj&w@I|q#By94R@O*!u9LlJo? zK?qBO^UG|F-iy}9t0?8MV`T*e!s~swoSe`AbgoH;O8M&8=>SP7)Y!2#OizOD!mcvl zZUpK1uc;SJWv7nA6BDtE}zDoXDvGk6yH8CM-lYgO!-}_VKR*6$P3&-N^{;D5K|Kn_Tgk zF`LWMZ5!jCMGXQV(dq3wo#p3obUWLY>vDTjrGI=3maez3U>~E_Q{FU@J#p_!Ykml3 zIpmoaiB|*}fh-q4)AP&w%3f<*QKaO6T_v&p_m$*Uzp-}f2F8cBMz6s)2yM`_)>CXM z80+H%PXHE%hM&#dQ!34^p@Y_sj?b2nLp$y~B|(0D_5CTP?{|V0(KPy2Q*~!MiC4eV zOW!u#LwSNB-ig=x5074n13TUWIDwSQizugLUC$%21AZLxU+?bbU}GF+?2c zs9?Kj@7o(p8Wg`J?_Z76+1BQFg$rN#Lo`_9bgs4TGCyrQnC#)+7W$X#-SJO6!wwne zH;>%PoLWL`rza%>x=w1k|KPAKdt3&KupCL|3K?W{EQ5P0b%Ur93P{6m{1M;SLtGES z1!{;Pdk17oEH&d}mL0|je0y%KCtb>zKe2&PA&s>qLuQqL0M>-OhqPtfZ!cxT5kvf@ z3Y>ATHqFW?D8Gx&ncF6J(7rx3faE9y+i@*&`rnZDs}uZI;2ZfW8-{3EB7|7Mu0M;~i1!y5N@%Hve4=zu}?P=KkcG+b0a?_4cVbu*}(uiqob{ zi9OhZzowAOddFkr+U>V%>{|Pl!Ip<@^xxn2X*lZ84GnV97#oCk?o*@d*7YVgj!>)7 zAq(>%7x?y!ZG=U0*b7h*k-{~{o^R44sBOCZzXJr(*qq=ze96w2ivVmKT&A9drr*H~ zhA#%jnQN)2WO)_TA>4xU%aH~j=SC0cS6_p3)+cZK^dPzDL3$HznR`N_BO_%|oa2vn zd5`7}ueMW&sz7bgWuv{swSlv$G0k_B-qG+!(}$jsF3lEx%jEKb{lcL=MoM$4&kP*Jnf zH9|hmW?!|o`gL;6p$5JmbqyIqj^;KY*PVNBzpw8T)mGb;F9`y5WB1Y2YDJ+If#4~o zA?n<>Tj}V8{NyC~FE1E3y>Vy@{}Q$JCwuIril;Rjb@ob2MD@BBy}4mFWPO)&v_-Na z$3dmkdE8R`pILy8C@$Ds?Y*Hnq0p~v3}(uyue}F@%Xn;=3Pd&*{jV3CpLv0bRQz2U zEslH}Eh%&%O`}in%mqAW68-IIUh0HUrZz=xzmxrKLYI~7Ze{n>H$HXRxo*Y*qJyp; z&mtw?lvh_OmZ+$gEUA)K|0KlM!q&A6Sg7|+t9PR;xU({-K6k7FQ+D)bSF1-`+S2QmDhM4_uCOwh=nU62Wb8#%7=hz*{<`)C!|c+j8y=?==n+ ze%BLt_d32h`?lR_YgDhl|8vIENte>4{(SH;yLKlb=!C~B8?rqpW$qU~a9bC98;B;P za;p$E5sKR`m^IgC7z7&3(kz*xM-dcZ&+s+ElJyx)Z7{9pM%EauC~~J_f>xsiyHSRy zb%r@HVoJcf7k7W{!<-EJ31hGjzdzglPew~~UZ$1=R{F{tq-4Con^1-YkvH-8Sskz# zU{57X)c+R|a)kX)OqYvO->bOCQ~A2SSAV$(8{5AZ3#XbRCQLwe1vt6 zD2O&HJ9SL-H3Ji+!SAb(P5(&JYw4hbYysQx&o1bh@1Q4RfbE=gXypCbhR$F4BfK9R zFYfRDcE9fIBP4m-bs>?S@s7=;$nWuPs_#7Hsp>*?`flOB{_;jQ0%h#J$kdK55q!9O zdEE-*pf0Gf0_^FV1Wj$1INL&rA$8XsfpA&o_+taFU*tS_RH5$7y_HOd-e6Yv4pvV24{EV>Px@MC|%Vmjd zsRO&$RfPI~YS#ZjEb*GD9V(^O-+$nDZV#NK;pG{J>BX~awB}%)W^MlpW@dj}Katbl zl6$FzjbWxU1ufe$B53*bmJdG38J5wkO=UekLekS z3SW@rj^k8y>tOVYKiz!tYR|WI*3u7A(){|ry0_{#4!34MR8gqOoeWL%1A__ve7pa{ zIcvuk(q4wY;x;K(SJQgC-oJFS9Sj;-eXaPo4*#1}G7qi?wyjx|=@%(|?Q-|MGkE#o zQXX?#C}Ab?D17~JYONiwrXS{;JHny z@3R#fdO-Zf@bCj{Mb`I~1-+pP__}9c-*|r4QfFVWp|QYtt<-;E|55+=b!qEAHl;Jc zoAvUBZm+IJw5hk>7hxv6%v^Q@TK>jYXwmW*4vM< zZ(a>lfu65s5uG~cdY3JIA5J{|BKy0tg8FVs$8ITYKTavisbp;zv4ba)FQ7u0G?diwBpr-u(x2HcMUW&U z8ZjfUmP~WsD86IfcY15-8sR|bfK+(Wqh82#NYhI=vhd+RYN*;y6vLZfOK(vGF5in@V+L~h|2kEls)?giWoGOcUVAQ6>bz4dMy!b(X>Y*Frk-k?& zJQ(19ul={d4wEJ<0J;ayvS<=YW_sTAoM49>U8d28*-i z%c?Whi$1j9#|)m#q!YN}#1MuZOq0^SuJL>L+EiGRL^$loKARzmFd=dt2_shUXRb}Qh7#r_>2BOAyDYk00Vw(zSl&*{V&if)WMpZ0*(*!K(9*JsO= zDPNsKtGCaC5_C3irpRQ)rk*oM6F9Wrn}Xs(*N)I;R{o;RC?bd9dtN2rF>tA(G{_lz zk=zG=hR&2%C?aN`4Q0z7ltG+L=B!Y*mMgYfr-2AUsj) zuFb_=U|^9sViC>yV3Duoz7QCbee`v7^@Tc;vppjYf1dbCquuE3eZAyYDSDJQ-TH^k zIV2?lAc_|5@kdxUbF~_HM3KKvd}n6C*khrwtO})VRRlFvo2ewU7G)clEQkUfz7mFg z`Ih#Q)D)DP=UsBDx`3qXY>u#|kDU)Hk_PXA#rW&OvbT{W1~+Gmqr@59i5@= ztH)W)`8uw=hiD{dQ0<|d)a)$Kw2aLhO_{03hb&}|?up`b4OdeUJ^H#cl%dW+a=sU#J4#MG|S% zI*jc4BTB?xC;x+FOJzPLp!oqm#3n6jS7WJzKq8F0sr3NbUrdAe|`_?Fc!Rj^SJ_JGwT?X(TH0g zV<;{}IjT7E#Sa0zY(K9CYEUTI{eiOt0xWB-U$BvQ>y-OlqwSUYvkD}i6bw0voYZ*R;P z!c@7La;zMbus1aC{Ef=*QVsq+aOG2pKHHT>WppWgExDdv_NFere z0KFFBPOed_gkW61yJEM&A z@DJ~nq`tVDnr5p@1(ED$u+_oT>xN}YXX9v73UF3B#Ti>QS_% zgKv~ck$?T(A{l&E?v3Jp!$ZoY>2a%f!uGep)0$~;Ewh9|ZMsiPG>D2L1KgYGvYtZY z-;$grY)fFjz{>GQEO$wYDUJ)yo&cxilsB5KK~@BrS$ z=1O`T28vjf8#n>)*z<_1=1}41tQ52o{qmq9wn~l9>q#%=H@l$QtJyaN4eo*1h|Dl= zPI2jzwRK-E(QLK~E6;b;VE2o`RR_i~rq7o*Op6-Wa_lsFrIzkp^m@4BITi1Yz!J6t z*0#ZE!{Z-83C$`tanPcA5SzM*nNLVzoegZrfD}X@OPvAV1M>qNJod~$g{VQ({u4}E zp?Ez@m)ZV~T$ISI8>8P2FMMu4x*`ZHy$?N^q5ws+N$__}_2B6pP9_}87RL=aSDI8~ zmnGhN2FlY>E$XQp*a9EFEJ=JPro?r^R+DbbfAuX!E$4lxQSjBpv+Un5Wmrhb=ESCb zagM2IXdW+hNNv2VvOiyZvXp6ZU@Win4E&TAKPNk8(Nz)yNsH`lp-K0a%pc1k`&uNP z%(Y>rw)s(@^Bxb700I$#MS8jQuOl) z%mZlIOTEqo#^l01*A1VSMb*sue964(H-)Y5}d2u01sP(g9ao#B|nS;bY z?l*mjHQzhBT+BbcCw=8tcNovVPidYTt>ua#%3k2ow++4u)|QTBzHky|;LfhIZ|PZC zdF!OV>yBfg%*X)ysM+KG(vB|{ta7My9E0NRka{9(Jpv7=C5FtVH?r7AcAIXV44@t- zIb2C&?xZjbq_-EtO?zC`m-ML#vI20!<@zveKO|)-w_6Ye4F-2|UCI?wPD11KOqCj_ z%amxe)ug+?CGT$-urBS&^(P8lBF=a~3?1pd^N$OZf*npm`M6~rz{D8wXP^Ms`wJDk zcR4s(3 zu750C)9H6I$-i2s{P(B6X}QwctC&9hIg~5~`lMZ^TFvfRfYw0PurX;|=J`Js{1EP$ zf2drRhE}1YP^EiM8u{k#)N8d%JDT ze|-A9NS#PZMM(t3=-9JKhev&X{$@v}vSSuR)+>JJc35Z1&TWiJrkPn5xhnC-K+_C! zOy0md-`Mp7q*(VSZXO=$d^3Mf)ziEkCPrmN^+#CA{0D<#7M+5)yU#k0=ZvXWDM+c4 z`|IYZ1LLv7bRaM%Dw7KK+fcetBvw_KM>BI%=zkx{LqF(V zF}U~(ouQBy^tyGaV%YSWnGw2~4h&xz>ijHP$A~T1Q+0-F-ye7xGMXRE3s{q*X^dKl zl}QZ*joRnu2qK@X;Q8M0*u^CAp;fqBGvcc4MX4|Aolb-l_J2zmjiogaAp0g5y_VK+ ztkB7tG*`*2`V}hDB6=^sjumg|&e^}QaX*ZaHxHmT{Fg2 zYk-;FH=V0Zs(V)w0K|4yu4u+sHc1`r(W`!s?X>fX@kP0@#sN(u`YLZTFGgRD=JTa@ z?`G*XN0zr-P=vM#Fv{^w(FZ%!aq`v8b(gu4|IMpiX5iz^ZvQI_FJ*F}a5lCXv&_F} zu7ABbyFc?B)+Xi=PKMF@3f7HQ2Eir|R=IcA0$}wIvJJm^7Cvkr=vB-fVA6Y@?g754 z&wJO~)bME#>s<}-xE{UUM=Kw-+vv3s?$EteIGhLQ1%e;^2)|BA+eb^2@C?4C;UfUT zijCg2tAQlEEX}@rrm^Mp%H+sri|9_Kt$sTTQy6uGoJ529OZTeSIkC`|T*)bY^mPiW z&2-W7+O;i|XbL!+tTvBxysT|fx!T~t5J$FsMZ~2`xs7}(^LDd5I1K0vIs4shTE^~3 z*`scs>#pielyg}sv*JU}*%PGLJiV<7F_}o@ z10pgEWeU>OpMnBg1gcQ`&x`zYS@?f15oPH5u%BLbwc5a1|ICJy;6$Y5fY3Gmw0)MO z;tF#>h_S!stj$ziob%k~sgpjiI7L`)hrW3e5GmsE7Yo^l*3b9Jt4@g{$Zdo)cdznU8u3J*0+j^BJ;=OHAHJ;%uoQ4$q9 zCs~dbf*eq9y@$m+GkvPu4M*9A2PB*to<={%1vZ|xDXM=%@B`^#ET=voR11*jMx4&~ zUz&x}&R;D*h4oSMBH$F=CK?Yuz`;aJ$N)qvd*43H|0d1M%xzQRi!5AA^oHE04f?&n z6>=+Fq8h-v-tQ`O4_?0h;0pWF*XOV_?%OC>QJHohPwvFmyo)+Se;79 z)4X(EGqii~a6nnPHuPc*Vm`(Y_%`C3y6giCR4R~CzwxwYD}XBRqu@^cetLp!BexIvwK3}9lj$Gq z(=gZ7=$Os=Kx)wha0^TBvIr_6l*e|_r^c;m+a!0vO{y8){Ym&5+kWH+wBrQ}m+`c6 z{D(u2*$shLih~o0#AU4#?0&c{Nt^Q;^`HBMAX11*dSZMM|6CNez_0Wxg#a4w`cSc- zg#c_EJ{<^^+up0LVhjPiAl}E%g7hO6s=II6CZe=s_A@k63yI;in!j zjRTs~^&^B>N9di{`7Ir1_4wX>DbItOK6>F*M5T}8!oAUJ3pAa9Col69CAgbpT*#Pj zI1603?xM41g&;}u{;&q%?D!X`Q%NDeWMdlf2{OW!80p(WjobPMjpF){L^gwVxK&)Q z-n?1IEIRJ{tw_%1J0EvStl7VBf>}hXe{h7!(BDS}PFFN+ja#kd90pq9bBihvrCW2z z+u=E@dNtT%7QAn8(bw8*&0t0?ID>|$Ni9tUE}Ub}TMk3f>pRW9d^jpf5Q9svt-*gx zk~LURHLqz?`>ATye0F#KaS_#Xp6iMq3E(R#U0=gTs*D|XD>-2*a@Dk9tta=mf-RhU0fUB&lI7^KF#S#Gsfm@GC>2QfNqE?{6WN9I)( z2w>Npipov^XA}EGk=Uw2CnL|y&)ZK^seC0z(U)c~-JgO8h34cctAH4ySGqC_h$BZ= z_MSGzPzVqhuultS{%~%_#6AlLyd>A-hR(t%ak^y>4vJHcLq11tl)R8;Y#Ol(2Xv_h40X@o9v2le0-Hy+WKfF%ZxHT< zsdC21`w_)mF^W93C*kw=^!jOc`1N(-eHX2lzk>Z@_gGC4JazGRF4dgcX}X677xZHE zi3O*>jQ71WUhD2&b@1M6ASamD*in6lpjf+mPosnP8DH@E4rN$Zx*X!|Cg@1a{ zdrLJXV#u#e-_(eu2>*nc0R$xCnOKjb0n?sdGV=gk##IYF4@JwLuT7y{s=l4vtftA7 z+{zE?l5hfjogUAL9ZXYD(yAAk(!@hmKUkJ24WBmFpW4pU`Og7+=R@+G<3hUg2OTsP ztsOuRYs}d|V-O~mCdq$uggywiXt}5&B=D9Q*1}`^ugvD+0D;Gj3(u6;OjsONkJV`% zG5y4(B|W*(KwPLe55&4z_6hO34&oCf{l?g*N4l{QB}dI%r(C$0c+3N5>(8zmzYxr9 zGJpq&BWTfki`T<`oCm%+_Gl`9t(T*IO~34m`;;|1);NA~yl8o~8M zAq}PR-uapCCc$^Dh|e!4(D(ajZ_Wn1t{ajJt`v9GJkTvzj z64Y_+ef9V+<=$7+*jcSwux|+Q<`~_#gbGSTK@9%1poiQnMJc_7#Km?liw_ex{^UJp z(g$`Yh=$j8MxfH?s10CT)^%6-eE4Yf`BS+h7XWPMsVaOi0PA%ecaQe~rWvTcpWN}k zM3rXJC9Rh&)Fla{5~9Vc1@4OZehkp%u7|fwFQd&o)6i(?^_;tLm})o~Ll*`4IoDg$ za9}oH@~n}H+Qvh+=ElZ8(mC%KX;GNe>@(CtrS3l%BprTQReqL?v)v>KOQ_w~rsGn;jSpUYwC;7a z8`kH7L5ePG}O}Gtwrs_w4JZvt)B;mq(#o%T7Y2exDF;jbS9QLpZrvI0z(bPkrQoFOxy3f$O#2wwcu`>D^py7|O_y1&j4))n&Zd}jdKX+5!1W}p) zp!i4tgi6zmUDF-y!AEIS{I2Qz#3aDbRAL^%$mdK_<^NTogQ!03%pf0~!oILjftk zPd@7#X5o{rclVAu49AgY!tV2_(&h9xTzWcpdUGvRx_BJR!8Aapbi1(pLFb>V+GH@q9j(p+ zvX$_qr?3xzIZ-UDPR2f5^Z?}G(RM^rj(VRfy^rf78~s9b-(hh9jl=NCp3`sXnU@_9 zIRLg`z@p<=Z71lr|4^DXL&V^+TUMv$T*UEQ_}q!qrH);4XUL&Dq@K270WK@?zXYfp(P z@%lVeEPU{?(}i|X<4~t`q}>+KbKi{FsGYCQ*yK^yJG0TXiXk>WX4R;m$d({-L~Yr zY-)`KgDemg5rN6T%n!aE_NtT`-(TX$H+M>iYHkyOpt|cu=r<~4z3cpeIy*^x0)%4; zJN}P#an4hQE!pQ-e7!Opx=Gw!(Q5t?6f`ucsm&k0aLG~%wT#`1VDUOZ4IB&-GbARs zfi)D!2HA?T?OKinmJwVZG7rC|=t5U@{*~sq9Ff5(*a6^8{6oon;2^2Y5WdBvW zduI0XAtdN}Q<57WzBrZpyN;M)E3!~z>uNddfZ-xYDW-k}v4t5D?y~x*h3S*pCaKAA zv%OM(vE>Esx|Ec!VmCaF%Z zlmXq=dekYfTGBbpY*?McU=R?%-RwEOS|o_RS9lbzeNEde`3g!3#8+ZmoK|*XTpH|}tpNmtgt=r{N$<6& zkUU~c=WdbrBIiwmH9B?5Ua+=V8 zIR|-}I$jjLd)`R(cIO;W65Nw9OYyk-W#b}pI#zDK5NbV?8B;j_1lMYW?HVVXlcW0N z>D5}r#Hgal2fK*10mI*QKB`BNBt2HyVG(i3nFYFhfj#bvEfe5tUd{uT`tAG zmiv8u3eUq6H4R%UQ$Oh=%YlDXMth6NQCeYV(U%pH6ngF%ULzOY0 zBA4DW_K~Lj!!nO72&L=6AY@X9;BU2p|R|@CKwvfRM#$7jVAwB$phcQik zlLxpKzw(&Uxg$|e2NYwUsTk${{&^>zK83I)`Si2c(y6ppO)|PMlxkzj4Dz0X7leRT z+tLP6?ecR<*Bpkj*DvSiAAK&1Bj|(CqbD%-lq`$oBbNKH?)(w> z)qFg)t}d`7{A&=5vESz48xMccdZDK(oY57Pm1`AXqc%+SktHr@BqskD2_aHDGxI)s z3m$Fb5{C&aE<@M_Fg|rPww@Ex*w<>j()j)8YaN$FUPlHSt`YVTHr8ian(iF9bOSZ& zH@O=O%%vg*uxSNY8LJcTd$43sU=(}-5>Cgj_Dz7Qu(;kQAg+*qkx`_?Fc{MoI*;3q zRTj70!DLxFmG3^41N}9(9jv|jF;^mf(Ipg@B&LOu?wo_=fc;X)1F$ZwX$WU&gm7F)LzM5HNV_mACrc)hPs@-7Jy)s0&dKMmnhCNqN281E5|9I z?r7r%4Vicj&L*DJnt+3X2&U#*;5rgv@uK%*$?v1On@f);BW)M1yrkRUs!}j`0C7jN z0MAneJM zYr&$wxz}rOg3FQ?g6qT=ckUGyL+2{_y!|o8(W0~eAARW2Vr8qM4ju*vam4WeR`A)E zHWzes5A$O|8m71v1y+dz9NQ9K6+9ylz!tt0C9==v%sfe3-ODqY%FK3R0qJfmN}f*Qctw*g97PF z5=D+Ha)HAl?dUV{>!3S~;7ff35aPpybYSt>E>crg>UU8PmFL1jXjo5o{fTe+}Y`bf9kSyZU}MP+L0 zEak5@0>%XOKZiCm*?MO!-#2|gz|8g!V1}hViL@3=Fr^jjf^r)XOXEhGN@)%yzX`(S z{uz0llI>t_puCf^M&7P1@wf5KP;|pJiFX4%OhHS{lb+7&!bo7_x37AsZky1&)uxE! z%&yDe!h)zqa6E1^QG`6piyLxWT2DV!yGw8Ri0llNt~|1$9#?Ym-^i{m>T`{{9Z^?q zZdDEgUHZ5}?N@=`-pw_1xLrFs`ukOz3lGJ z?L6q}%ASPQ`Rol3nE=Q4Gf}Adzu?fZ1x`KM0@VGO7og{b5<@bENt<;gXIHav5OXw& z_Uy_dGL8~&rxXhJ_OSkhvA{&9zt$a+K+JKJ$-V&GeB;w7qO?D;=g{=@=5r{nt>%m9 z-23M4GaGatzxX-;B&{ruub*M7=x(U}ZG6)7GuP*<`0w>^RL2^AN*kG>DiL&DB$!L4 z{RP1Lm=7E&DNJ<^qK6(;u{EkM9_PH#P=|^Km1_PR?eA-vbxxb6F|cW}Ap;i1I(PaA zz$=NOJl~`hpSfgtA_TvkAxl+{n+ z3jH%^(TnLBVE3;+*u{Og6MlAU13y3;5U}SK6ij!xlfGcU99ig=9@Wb%j(8t+Vy7d# zR4^^oE>xfgdXoVg-73~$mLNnN`xA{h@~Hg#^(n#mtcV$klo2e&J^jRAGcUt-fkrSmIlG~ z4*1mcUOpWoJdtPZAp@CGlzoPhI%pjpPWsK>@02EV{+iicsHDmr|IzAW!@a9na zVTfk^eh`Eh2@j?JboK6Q>B;YT_?@^IAuN_G0`LYOMa7+oCwiCPWlQUQ(f=qd`S-ma z0yqsGWT&;=-|VBq-vlAN33)~KesEqH**%ZPP*`vy0cY2AuB|%3PCA@gHdE!4p-Y%}klJ&h6*;L{de9aeetT zzb(TkQ}GRtrOO@nO-_g)`Kcu(C0m0|oEj1i$c-M;_q=7{n)d?znnvhjV+TQk~#oqA1@yhhu(3_`Uwk^@S+i(x=AN#kJ!3mw9gtLR~m~l|OWJ}Kn zpd;H@tnrII@#)hGi+g=MkAvThafsrWyw-mF+JKCho8Ful3mTcTS~Ao);RdU78}kb1 zFLIsGRj(+fhSU%x8Day%aD&|kIhWIxy!V62<2?Y(wC9n(u2VFN9d)&K=&D>Rr*-#J z;01+mw&vlxr_T$nDZGDyj@OkqgrrE6R~EzWfZMfU3MrhLBL=keVf_ip*9}(HPhnD0Qd=Ct zCm8`x{l2f%qum$-|2i_;CpCtfT1Cyf2!au5Ejj}9MTap%k)dA`;i{|QflS3t5%(sT zWQoI!dy3%>GB2!{x(T=GP+)`RY~bKkv;5?XVz?cDs)Qx$5le!`X=YY$RM8}KQ$a`g zjzzok!|P|cE7#S@J8*-|qiLu(@<6UpSBebGvmSwY*5h!h$)~tbK0!f!>7Px@SSx`X z^jZ<&8QNlqi@42c2~8vg;l&OM@r(A4-i~kGz$Uk&)DH+Eu*LU%)TkZ%D@(bDM5bnS zHxO;Q&Eq{2!RPztLYcESjR47py{|LEczEuOar&u?O#e7*C&4CRH^mFKKl2#qC4-q}sGL)EUZyg^uB>Sds~ z#;511#hLz@k^UN*d+)vspRTNr;7=;mxl-0*IE%ai#Y&0v@fc zE(=%UvACSgZikK~wu3bsmIxs+tmA$y+O-AySG0KYn`Hlp?bCiD{BWVI9_^~hT;CA_ ziY;_gdl~r3@Wi|tWccGYig|*_CQpgY4>{+5_3BTZ&EVXNgAK6@?y}f#OMNNVBsFnT ztZSu55&wgLQmm$ygJhp-j7-`wXlmLwuKfSUJP5iO()*gjNH4HSRpSnfdCC9YtJ|oPSR; zD&9a)pII%FFQ!FpE@F{*idqIsw4o?=k^eArOhaa@O{u>B3 z9xlw*nI~mEuCTfV1_oT_U_0QL?4R&9JN@oGHy77&j%O*?o(cwoR-dK|NkG3~O(L6H z_6>O#L6#|IP1HQgVZDj5v-t9Hl=1Kngxhvn49LpDfjrMyMaoaBJbN|}Jb0q~=D{2O zap}64$;QiyF|m#9st+laDK2)tRcG_xowL|_dz0zH@6D;2>5V#q8zH2dhE?_p+|aS| zfZNa#G+6Ct6pk$HtzY~$&G14)Fh)3sIaY;M=LKKJb6~)TTjd-IYq;n)6J5cu-TCtf zI8*TrpEQPZjOz3d{!6ctV#6}Wt;)v9u?bs>c`5IP1uni#U*Qdhn#OQ?7(b^JpI^}K zk0xO+r~5UlOOo@A?&%y~GCZCbrCzv>Ki3(eIwb&CCXc1k+@G6tZ+FvExya;85#`AG zDl4A5%Y#y`(N7_DFa|{@Y)@FgBA4Hymzh+WWs*M(C-HYzyp-PR?aVPvDQXjxRTBlSSB} z=BcF-hNT*x58d2!O;hW(x-fFb81hb9=_~{yST(e!L2A&-KZoGezouXe9akL=hAl!B zBc?&lht=yKi9Kb0D0n4Cc6T(w5U%YoG5#pPIIbjds=~mu_pEI#Hc@nV>%!h>@&L?6 znOuFL%_}8YF*RkzVOYAbftZN>eA^g8Oj|zo?k&p?#Nx)P|BwK9$~^Qcg(q@zPT2U@ zbBa@ZX)75QtyZ`WhQ1bd&}9Tbw~+JqcdKb~T@W)9nnOP40c744yoy)#xjv-Mu| zj&9!F*^M!A@rC6dqeU1K%T>#w5N*^V;-cZbudFYxWXKvhU5^4p4}Pl)_I}XgjGS)Y z--LgQKD!-xm^7tW=X7XeH)Zsvriu_#(-}H}RhgDlgy#kmwOq(n`on5p@pR3mG+D7W zgbls~jniw;k|ZaMvjPvKgWdpn#hdn0?AVE83z1qnzGxOpQlH8URVKhi$C0+yH6qDiBEQwatIC}6F?3*5=)l!f%I+>9>xpk!zAMv7bIMPdW?KrMA>`;X(pof&5veYK z4>`)sY|Aas)j2bhJ_IxR_8LGAjgi)%*ix?`;aB8AR;`m_e3m=3E^1$0!f3DkMNx?? zVh&&DIN>Ion3#Cq^krLLiK>v#u>x^%6-xAHKty+yV>FG>yj|E2no*2~6`R`CYRrKsdFU zTcuc^$kbg%!hhccxWxnD`V=u2#>l%aNHA`ebx$k=9?92ocKQA-V~Z^rqvp+PU=GQZ zJSA`L#<Ni`R*xO%ZTc?HkTzEXpE;(8xOhrOJx&Mg`vfG}Eh}(Q@k4T6ERNoOW|AeXt#m!e@>a?IX4B$F9pBc#4e0gPwg2+tUw|ojEfuAC};q0Q;K2YsXl7oFv-ZTS7{nrx-`gKC=Iy z0jlSyj^F;Yv2k%A;l9(#--Q%26&1be^jdrf_U$Im_uq=yDT%STi@~zKN?_V?Tv9s0 zx*Auo>qb`^+gUq3{A$~s5%)ZC3(s4&L-m8VseVwU6SfTdM-92EABpO!hd#Pu^a}a2 z=J0jD$krDYcF8^ntr*SzZu0^}Kp_3&7H{$5Sn!a<&fmlL{1t1sv_&{4Li`AViGB=@ z-7_KDmtTj1@l5DzBOpTJNj9SUOTN9$sV=#SL}KoH$V`kv(%DmPRX;cH#5k0nE~RG`}obIS0PXD<|jS^8xfx7vpQm&D&%XbhRFc7O|IAD&NKdU-jGX{ zIyk4>T|hO{G0RADVEq3kF+uC2;lh`c>XoAPQpT@jw)OSjvQjZ=Fc2DcP{l)g!qu>lLyQec=x{c62#qnZdsyMMpae) z9I7DqLH#zX@z%LDKnG>5vT3)o@cHPETAq(+J(|2a|s4fD%TX?2|LdP}4CyR~Zf zewTUgC*4-hC85n#vv;x(aI?@WOr3GDd|9 z>T6{RxrmYXM9=%5?{8p!lCL{X@VVR8Jg2<4VNqxG7!Ar-JsN^4uKeAUc%Vtzw;E886YtXc@g#XctVPAisP^{zG&*0N54YJoWd5NmgP0Tq^KqAK&u)^Nm;ADm+Sksj z_{6&evq4wR&!>8W(~GiM=d;$L<%lCTB70@Q&uq)e{+#~Sike%n?>%!yi%e#pylGTC zT3ilJ&%p57`qaCRP7z*QF%4mcX%0Fb+5!cu7QZ3wF~bCBz?ihrPRB> z`(NJu`;1V;J)--I4;kkKViVf)uEE0fVd`umj+c6t+=R0aICnI@EzfTBxxcu1#S|@GZ9&f< zYnw3q6i@WGNmr_>Yje95ote7Rss8fy>(}@EKlpPi-<(iB1X`kRe{^U^l1Mh}vJ4$` z2nN2=9{&j}y_s@5GVkZ_F8! zBrCqIofnXDmb!m6`qceCS#8g1B2@(5{}&OMs}((x);i0v(=S|r2+yK_$>>i02&kNK z79e29)9$ zMOqutMYo_lTJPiGkt(k3cl@t1ufuCgx?hZYCY(G~afPCK;$K{VySVaNyyI}hqVL_h zW`d~=Wjf-hHJ=`jM8~~T)H&P4z3K!?;%zCfW3?u0xI28qX`?IX+f(!@o#A2hVoDw7 zBz)dTNcpisH!xpbKEIJ~Xiyy-+#`L2k@UH(@5&Z~JVwb+>B{f8HfCnGgDZx9GP^d*O8qpK+AuDs4;${~zV&$+-Sr1#yWDh0W=J?teyqlbbBtLyL zajsuelpK12K*8bHeIJ@HO$tA8Dg0PQEsGT0an<XoFpzXXuhMhY{|Co~Ve zx_ISYGt%z-nA0@N{kM*f#LD+%j&!SoohZP%#iXx0{ysK+KljAqT`{)wV=ZStP4dfD zb^Oltt}x65u5vT*nk8e_X~Vr8FjF{|oaeQ%tBZ6Z=&j+#=zL*fWK7yzJiejZW*@2HRC5Ddq zba%ebwy^#!oT&k(SN$T{K5fJjaA=D^JV6YKQ2~W%{|Z$F@>#Ak$+58umW(%@DeP<) zb0uE#)&wsAmNekf-|{f@AtM@=;D%mFS!-q zIwy_ON;%`l;8XYCNbP@mxFBN%|CZy?>CV|bj7zd5-aQ39`gy%SNQc}rm*BL|Ozzpb zkf-m9Fl^aTL7%6xdT>rLdpjI+yIk#sA#1j|{d7sg^CO zMsFhZj{1Tb{ovb$s%4`HFm`(AgRDf$t2D7|cIs~nEMlFqMZMzW_FUM*Zj8@$#4l*s zda&CJ7iQ!gtOmz)OALAkuc7NustPwcrPo_wBj3StpMZykCA1V&c*uZl?|N9k1Fw=9 zVleCIj%U&p?GqcrUv^mQGG9LUR zf2z^5yHAJmQTDdg3@?0$){~MtI=~=U8ZI| zr1(k1tq0O!x2ra6Yk2nUpv{*$xqJ}`^OAU(g*~Y1rEx9?a$~S<*{Z+1RY}B=s)TRLK5oj6R>lIU;5x{+L2a>6w33V{aA;-JZ80^_)qfNVHBS} zjX$nlnY1jAaWSJSIk{h1-4KWKcyk3g5ysW|yr3Bf zqF&@&T^T^d7wF}tqkylv4UF?Yxu_EjEXqZu_4LyFGY?-+H@)(Xj0_ew?k@p}n4@+D zkq+Tn@uDwk!q!ipQhZ{6H|(m7?)iLlNWy=1`pHeh3`$7Szp49S%%=m@WV6jwe)!y@2RdqB9 z_eg)=4!i*f?4T8V=4w|NUy^|MBZ!%Q{{}!TFDB8%F+v}f*ulB*hC>*mFr=%~T89?- z`rP_zgVx6hjX@T+iBVwePJYifT0sR+j+n+CPNfiUOeDNbB(kewUZ1cTDGpk#vJwGm z9+KofcXp)8T|8^+q--fD`f08%a1Q=kKqjbumJ~j*{};NeDqOZDa;_A=KTTRVuV37! z?ez1o@avw`J5_dFXMv{RZxkqHff6!bEgL)6`p-2OO;N7_w0rP}dJsNm?K*#IlY<1| zmZ=&CjdEGNzXJUr-s`Bz&u_+RSKtE<i>VhG!QQ=icbDd z&C>jn>Lf!zTPhQh9^N3emWZZ`v*yo-^TYRC-^|0%$8NoPM*U<^$^Ozw*x7waGnnGJe?*1qnRM|uL9%729=Emn=Sijm-qgf#A>G7~nY`-MnkiI^ zr7s~{2yEbapN@Q2{+GUN{(7*+NpwFkAJ9X!fy)={k9*8w%@dubdbuNAx(dacEiYJCuEJ*4Al`!!;z3D?d8h_%!Sv#b?hlS6wpLf`Jx`ew+3`wooOo z42r$Hn2>XCkftjDxi4&#)#sY%2N4N(B3+i)_WuQW zt5^EaB4jX_(vwq7B1ydlk7)mRtotudy^@m$yT*Y2Cd6^)+V)Uh-`chkk@@p0md(%t z;3J~64;oAU4Y43cWOQgK|AiR=F@X*NfX=t@GgNmJu6Ppn(-myF>SH-*`l~bl$t3+z zAXYuJYMc%@OSOU1|JZ=Kkmwk{#b8tm_IR0(h2RFBQ+*^?X~s4%K1bIVEqr0+0MsIO zj-wjyA!TkFw)ao`F?!|b`w827Gk-QY*;~34*W96`P5#a=Sq8sisg$=fNf@~tDl>!{ z#KQ%vhof4MdT`9%W?s@zkRzNpOPn6KJ-%MP9p<`SNCC_eP`Z*eD~RRmxc(Zr6lD*f z#!Ij=vVB-r8AWa?Q}@^G4Vp8UgD$YHNa)z2Yr76q5eMeB}E8=7^Z+IN$aK>vzZS8Tk`_+j<#|q zQq6)UcN%ONiiZzvQ^Tm;bXTQEIpqg|050pE)05MtogXvR@JCZm1SZzDYe zD3;7Vl?U13-90`*CS*akfrY@UIi>=Pj^8#NU90&oVS55JJ zNbTSb81Tb~1jCn^w&rU4VK=6mkP!8KJ4emiO*rM-J20UGAk5S*nDj1rnoPFWd;>wO zZacP7zZ{F&&Yl;6Dk0RZIeAKCHKBn#`x%DaZ?4{0274NB?FWg2Z-l3e{|0^$wGBMV|MfUT#4Ye1)~flv3>>cs;qEZj|ML7I@gaJ-a}>wc>Rh`oXW>Pi!@lQ|!)g>Jd_ z&B@;a>U!C8B?`6~{U_9D2I| ztN)=ga=Ct>4Gdf(^~P;x2gFvC$yJdvO-R@6vF8*J|8p7Cxxrx^PeS9Nwz@}5P-|gd z=(+-7gN>vB7Rc+?NWpfLYuj3D6rzj|-{A*T^(Kl!o@~OxNmS(o6L5dj+hcQLkvG5hm>YL)RwMw;7^P}&nlZ)nuj6ovM<_|0ekxAi#k2g!X1A_y^mF`M&~ke`tF4d zT>qhenVHumJ0!(RI40sPXg(UtP5jSGDc|MAFIF~^PlQ3>a%zh}kI{V%EIVfyA#PsD z-%ZfQ?;!z!ZG7-G)?Xhugy%t1Nm4|=_^TPj4!l-MqaUIN*!MRzK10AdA=hBA=n$CyS}3Iwi`Ll1x`xFyyk+3k$fr!N zNZ;hI0j=OEbMUrur}ak8z78nXFz_22^iA64PMA98_1gsJfu~Njbe!FF{>)~Bgk~N@ zWT?#g@5Ni2O-=K$Sv)rGnBW>Grm?EI0n5tjn3|{>LSnrBaxSNcDf1EhY*(npREmtnl#TRade^Oz>omn>SKqE5x$|Cqy;N!A-Y|n&Iw-#;} zK}!8=1IyV~|K*)_nWA><1LF-WZ`23_|Mw>!0M@etlL2j_Xb@IDQ^i$du#CLG4&@V> z3kmIMnXel9Wa{udeo?0L`baFX2}}{-5|^sKP<{yxc2CLeSZ7t99@$u-pn@PXKgt)g zbAH35vqG3Yg7h7TM2F4ZFZNAw`C1+GLc4gEwF1H*e^ChDT@MzSs|S9U{hHCagXrSl z+7Qmy9d(LCEzpHQ!2SSm(`mf9Bn8bgSi3&1gAF~=94p{eG}$D-VfIN_)?Jt)2K8GZ zr$*U6_gR!mDBFa1LN%S;5?bI)ZY3~6kEu{DhqgbLD|0f<$t(z1{8R1Gr{aGDN+<1b z8g~%Uovt|qhF{!YF=3?`3&1;Na843<7^x51*Q{eOR>(G(Pq;qjj9b}40&0DKX_`P< z@v@Qd>;4nG>4~mBR&Cw~knctWIek~WoU>VSXQB6Q*5e%cAq9u@{Ri(*{8wVyI^KSG zVzx3;vNhc0^LfICT^A&t`vllWRF8w=(9L%`N@q%LX|UNl{*DOj!w|bVubq4(s`d+O9))vcokd2uX}{ocbN8kgF*Oe? z=#7{RzIR=IU-e8CvtslpST7a-x;Ny3EL< z-mWQ@MW7AzroiU$LJB}77}r99cXtD^c1I`w1T?VP)@i`te9Aah&ut*hv(?#rUKw2r*jkgrJ-YJ{!)mJoBNX_pN)tXsVDM?RnGZP z8T`c}@2sGB^8@acU69bTLoccbCEA@cawC^VWbTZ{7-!NPKVW`5xUBR(UTy8p_ftq> zn%0|9axpa|^rS<~M5saZ-oFP?kK^^#K8=_?Mwc@IRFX)qUdy2wGVvXF-&X& z7k!8tKk%msLYEsl%3mQOeaM@yUf+Z&2J-In>$|s@UO_S|#*TSn!xk#7YSh{H)iX|E zYZgL3J66jc%quy~>WO6rspD_#{EWtDc<&l1m_=W+<_jGdBM3+^d~#tt9}@>g$~+su zyLD^pn~=?!5g&nYq=9f!PeS!wq`l&Dh|r7nG&&HrYnNhtW}i#XeHA!wvs8w5G#QbU z*EaX$hcBi8=WFM_kfAppt!I+KU5X9m@tGJ`I}`8jbvFSNS+ph%8i`m6$&Lc7NO}81 ze%vLv*N{e6$B7AYeXIc`Uf`513!FG@WVAW{HwlZ^RI_ZL+D&75=_PN+f1*^_`81zA z0U#97KS33RI#z*FJ8DnkJC|cp{Y9QI%zR|CD*CGq$@#B+*X`Suf@c$FLMQ}pvr<7A6yRP9xT5ksH- zS*NKWq0(v=t*N>E&RZeyDvOYfil^?~p7W4F<_YJ zC=t}Cl6h-4IH>5~iKp-pvizB3@+_$l<6Lmc_Ubb2;K40Z z5flZmy#CirS1xdJoRt?2|JJ&f#}-b)9|iRXYMqnNtPRft#fcHf^jV=~mm-(J51tgj z=7Nmgv$#KFKDyfoY##3x>^NiLh7QLr zIi1~H#G53DLGHr=k)ouXoDuX zIPbq?`(QnGz`#VBms&2`eIUKq@>paxg=y3beD{g$`lLIpLbP7vh#8aYJcR>H8C*_o zedggJ8l<>4J6q_|nH`RBd(TXAY<&GeO1qu}mDE?2bRQZsX!K z+*d?%qSa&V^A871w;_oJ^GiYCWUB_Q=#tfB#IqtB+5CW!SNQ5|r32j2DsA}%H;>t9 zy~o_J(;YQ7nMrZeZY!u29WY7oKHmI67-`qV*AbdK{>adENykG6EeV#(iPEdnl2fcz$n{ft@ zxx?jOAqoC~!yL|PLjLvg1BOwU??fJY?nA(Z*e16@qj43OK7ppcA3Wf5-hqdmaT(vR z5ph;i_(@kH(?PXO2TR0z>0HG*?Jg`Wm+6uxB44u zbpW}Q1d?_xP_*F}ZD5A0<{coJ-v{vHLM#1YIH@SMs7>;3hHvz%kdpwyp2k06kDB3y zWHIoaBX7_Ienn8$eq{C9HzTe_`eF_eZF^j8D;4@}21n;A%g8iiuGp|s?x!B9sH!Xo z#~5kK;E4m><+&j2SJ-rvWtY1UIrMT5G!KS^%?6_(j*tD~56I3cNQ<-G8tY z(h7cPW)UsulE)F>Fz-IwpFToH4v>>maGE&{ETR))l{0Nyt>T@jIFr3QFWo0M!nk^` z-cn zg$2j4E^gv{QWiThgX$0bcjoqm8noJxjdNqJz3b-^^sihRGj41dh?%QEKL!axpCc9?QX>-|2 zHR8?Uf_Du%>KF4wwOzJULvW7@fEun+l_F!0zZad{0zM51)gMo&Uq_6BZGx5 z2z`_hU=1N7hpP=+YdgB1qA~yVvwmV zk^0(G1?3nVJBS*mB49Lsps1C_LZJf5lV79KW68L zqwD+nr6J^^L3_fL+N8tEd~{Apr;TvGa`IAg^2?1`2Cp`=I85^e-u1pz>aibhtZ`xe z&cC<-m*N1PrgQ%_xxzCZ9m z>YQiY<;P)XTBbn?#Surq)i)y*#fVdM65H2qw4CGIelrH@kPIo)<=a&tG+f{Ml~Ym> zSK-65#HC^0B1bH~KhFEG`CeH>SuhrGMB3i9H510`>Y3jer@4PQz}|(f6Xr~N@8v+d zs17@^@CU_M9`i%#D$UK?$xzlj@`=j;?NIx*-z;+YERy~3FePDrH+!-(_$e#|R2(QY z0#gW37%Jqalh+(_cKoi@VcGj^JT~h*o~7w$;!uYt?Q8vGN`99{|1uX%Ouh$~hOx@p zz^i8S)XMFy)u>}`{_1i3rLNk|OJ+-;FuVgVxFE+G?^X=0paU;LI@&7jW@_r*!>5^}(pwNF}t%>9;Qj=A%;tBqdOMACM=zo6AS zS2laIlgtXVw2UDn>?ZDm@-;aheIwzj=ixdp$;ADXhgLNEaLu zFut@$o-7S9b&h@V0FAj^*aGMSxJv-U5$s6j6~*9yw~Ugn0Z0x=p#B41`xlaB$Oru2xq9~82O{ai(Fo;eUhdD=Pd+bf}CWj$Qr8n5f=b)wy z(Z`trLlIlk2eepTS@VpIQj37M7ZI}gnY$`UX-gmO2SMak!PxF=@TNAW-7#00*rT#H zPm7EUtDEd3+9A=P(&6!1Q+UPmD0~vQEO_E{(^lklv2i~}X6`&@&b?g>Nl9?y7I>LL z%ye$#*)RFpiY9%7I&Gnr<9!!f;_^cduPtS}^1SGHhFmY8(i^u`uDG^DE137hFv$Ea;Ic+8e_ z+|@P-0UA7r^>Zc5#K0V%DUfc2{)~Zp{C-@3plt?f8u4i}%;3lkc_A>&ECu>65CEg9 z;>HmeEDTOXU8&Wh(BL$EWFSKep0f0K8!b&?_NlSPk}S3tHw8SuH!Rrut=Yg3JC_gg zvDF%A%2>|Uk_qX-i3?;|iHj#VKKos~JDPS9YW`I+3KcZMGi|leEZ`Amsw|48j zVY7aC+V}qUtdsulZsU06$;uv6ty#ZsDWr_1e#{XXzGB~JD5-q$Z2#3$$jdbBglpU& zu~gyjB^F9-3$zQgVZ<)>Na^W#Y=X_rnX_ht&VHQ;)S_ND0O|CPwyx*^$kX#5yirVh z|K5Z=WnWiRfCe~*DvzHb=w(C%OzcP%HR%6A=Ax9t;`v$yC~eUc-1)c`ozj_-sT<8K zb9Coltc>7$npku$N2+kXyRB49_*NRr~wl8|!6K?_D*LRs7&)ABKB z=YSQhd;|MI3l?JURUq!ihTJhD-lrWgGRiA^&L@OrB=<-wr zZxEzK8OMIZvGU6hsM7U)Iv7vDm`;+ef)S=MHO!YK_}w?Z^M`n!i(EPuFJf=zk?9|y z*i)Bo+KJi88l&coTimA~YEi{<_rE}Nj6iQCwrx)WAe@_);Qe!$9bT~mVp=fZME|K3 zsIc`^W+p@CZY!rK>fO#*nftADm%2}}T(1Mp6Xu&?TB_&PYo(5I`J>7gm!N%}GH8iH zhsrIKg~(k9mR!aXeVX>l2A0ojq@ERa?yMs}+`|tAUSwYXm?!>D@aa3BZPGr30H?I1 zR>Y~~?O>tK$oj_ED*-pK?6_4#q<-M;=o!~Df9VSDzO z+Vpzgzts;umpz3Is%&c7>gy!;0U9P^@3#(4Oi8-7tC@BWF>y1Nf9^f{ztzg6yrQl}b4^GB(KRrA>xCbHb%xuAUqb%Ep`tH`gS|nl$Y`S0QvZ_A z#h^+5&4VWo1r%_0!-o<`SNgMV@lYY(LAEophhY@ME*86lBc21~Z_}WKf z#N_o#_O}){EoOfy33R0xO_@79hmd9&j^CfY)7Tz=4oh|gD0%W=o{?sbUVi8&3TSI5 zgHlH*ySanMb6G*p(B2=&Q3aBJ0t|n~-R>TzjeD_%Gg6?2YSE%FxyeTW^~%encbNJv zu9Kyt%X51Z*Oea+|1BRMady6VpUwxTlwoR2PEcq*SMp)}hZD?SDg2dsQ3?HQOpwdo zKqngHw~2k}!zeO+?r&RB$oV3)Ze466aL5wzo1g*Srx`6mI#e|E0eIiQF-GXXSB&%E?mTae zdq#Hehu!xVAElPk44Va*25TgNH-KDpFLYa%nHP>RhCD4#3+4ViO-};|NbIlsGAYS0 z^7LRI3v`Ub-nxdw%V3|z$>MNG%8qLmePXJKJar@0flk*7+{RTdS?iHjv%c3p9q%FH z3~f}%-Q-{+Nk{al<56OF`N3^}5^-x35@ z@!lFAOj~L}ZFc)c90Zg=DJ^|lC^CJ2u6BAA5QFbl!KPsf#T|P3?$2*}Gik9lNCUYem#bDX5@iD)%{P{5UTDw}omf z2%i|UU#kt2I5o9oj7~fXG56?A9s?jrf(v$<`_~d(dRrH$qTr-X=)x|VlDL>(5^gen z>h8u73d<21DF>BiSurG*vievb;3t5smDP_B)88^bI4H5o-lRy=1)wC7e2@~edQ$FRN-DE6sfh9MjDOxK0b&nuNMZcmJA zHf;nCB~QjS>#?d&!O34>uS&BP=5-2usNk*qW^7k`D+09f*cPiu?8=yBG==O`&jP*G zX4W@<`-39Ji;NNL=5`%7TDf=$f7ItJ(A%Z<>UM2Wdo$w=tK@n`t2_MgyOCzd>fO}Q z0nC|N)I5BuiFe~_3#1jT2Fo-3QmToejkr1I6(6Wx-wymR58MTZ{kgonWlg*C;m3!u zhB2-826n5uz43DPZD{CyN2pcL9~M+YE+9-mzLi_miy&Nu7dnzq+eib@0mf_P+5^Sk zuQX5xG5&zs6en@+E0ICUqTFK?HE}OVbkN9HP_k|W`s;e1_1&4c{W+kxyyS@!w@qIn zU*a>ne0F@L!+6AXwC>4-t6#!auLJmw1y^rd1{1@fhCNoIueL$H(IKfF^9Zfz>g80N|7;dD})OwYKWjSNl z3EoX}haBz$+FdQ1Crg&A0FX1Cm7Ax_P;Q6!hGmwx`jmxYZoe)bi>ZnVy)~tj!rz%1 z`mOniD?aSeIA_tD0*jmUYM*Qk5qCd&7b;Mw~|(2J8ln%KE0m zNH01^cD)Bbd?;h_X)L42Xkng}06eh&vEDZ#)D>f|s>*&6s}8c`Oul3(Q4@W|AydN2ys8y~?aURHm@PgV9>f$j`^%P$y;(qn zm9mDipz_`GrsG3r0GdZXVpC?MlE12YAOj~_i!+NZ80o~ehg zt}h{`OEy;!$3gD|#6+z{6HXER7eb{q7X9w~)87pWUoeRnGKS@J#(Zt)s9qZAbL^^4 zR{Q)=N1op<703j=d%Vug=pb6`af|O+#g=a}tA?7;@#28ekg&m!K70d9%M~_*OTYtP z`}8769*WLpk5^F-eurEQFB|y<>W;)@u8@#?cEV)?! z&p~n<=DwdOBPNQZtIAA)V7~8|k5=t(8ZIuM#ar{sjYQ1D@+baWIbiM8S2FLZ0L7pZ zuvm}-{VH=&u)#&C_YhEt$~`csETfcR;WE-o?R^Vh(n9$Rd(mbKK8rX-jGJ1CM)INh zV9M%)is{ZuNcQl!W=!u>gfl&rF!8Kfw;7aP!VMuw=iV#2nTP1yrS0TQXL^s;LAtB- zt;~Kvy^ZNR%s{&1Ts6)V6>xc!n*V_pCpq~w8q{jrPbWT%^uS4CqTV@o>r|@X8vI?#ent;YI%wr{*TUOb^%?x0G_b49VZ5Xo_36`_#=1erF{SE?KcGGA}WV zi&bwqaBLd64&U)tRr>OS8(Uyjf4Nv1F1#%_ENj9I`(S^!r zr-hPO{H>XffQHoRonuOdSI-8hd7OT{vp(=Aa(0nBKBvn zEIBwN%`O?I`o@(WbATmmKpk(@IxY*bj<*T-epUfPd{km`ak}}c@aW|{g8PM%=5ZLx z)4&090GjswyzqZH`#%P=FG2m7e=aH&EMWsLJEFd!uS({PD~JbwXoPE)NlAu_IY0-BJg3E4a}K1%ymsHiN(&^V&>WAj!vNF(uL1=VDFJ$$ zV4RMgSiXyZKKm)fKz%)-vuzu%=_sJaAoc3gWt8 zYdd?PGJjki}#@Qzy9CxS!p>%RINXvU@{0VvEu*hih-m%C0!T zcvm26@~REZvy<$wI&xz;%)|cI~+nZq>Jov;V-nPRP>%xUt zuA1$=SCaw$kdWu%Qg`z0v{cxv4ZNnCHp21{bFd+zSy8j6>L4s1;l;v7ePH_-b4||@ zmiY{y+3i8tCU{UGxu>RQJIsJ`6_aeGv)8FaJ^RzbhaiXJ5Y{_xctgsQW@gPogj#0`HS z0$u~X|EAm%op;t?8+kvrFq?w+UnKgBSlskpOux!uqkM(>;HW$P!Pa7{`vby;yHiYY zv&$A3@(X$+N;|AHulrx(k3%?-_m2Klc{9fwFE=hT2>VP!mC9AjGrdCtG8JU|C8R&Z zdiICiG#&Bp?fl$ETeHIlsyD9KV989?gmJ>}xm0XV?5iY&L{W;;X`ZmtPi_A>IZL6H zg>dLZviD4qE#}FMZLYHNFR=*6CyP%MH}lzxkaNlZ=p3v+Qd{&j+4=cS-?==*)%f{? zSLCOt+Pp*GU7f%bIgA-P^vi6riFq$=5Y2h*cGH_B#PCH7-&2RKG9K_<3+$$iwKSfB zgI?~FRXcLH29R@Srr4+l5sef!Keker zko&JD=_`*EjQ>@(XTo9r5V46cV~X+5LuYC7C_n7{X5?lJ!oc-EK^@l1H=gwM+llb3 zu{Uc~2CB+y{nvhwgRmO<@Ds`Vs&lJ!*uMsn{Lkk#DjuHw$#neHXt zutSnZsNZzB1soH|ed)6;<{7cv-i&Di0zHi=cBOvl9&!(fm1>sV_Jt|$Ah=_Eh z7YRgqk*I(u7!XmAUZp7@J=6#y0i{aEPy$GmPNb!rH|WeiGka$Cp8uS4x39PWlJ{Hh zTF-h`{krhc_6I0x2yT_-AwH@I^k9PvF!vY5`cWY^cef56X+7;h1b4u{!aE*7pt*$_ zt`CG1A~y7P=dwDi?nr!;oMVAKq>@Tj7)LQ2DsW;1pN2kn_eprx4kTHBAVGByO3`am zlZ#IdX>7R5rM#D7d%lbQ`AsMP!QL-!I~q%J;{=pzZE>(Tmyt^$G`ylAk4w2SNUz5E zNO1Jb_~oOfZU-&NazJQnS8Lox zr~mEE(d3dA``>Af90 zBwMv|^Bf8wPMrXzO2JQ#9j50Vd_F@K5A>J<7CZ2gN^qQmEzZXFSFA6^f&kD?M*oVM z;YopxKx@bulzX1xS=vYVa`K%4a$yxi)^M3aX5-e!ulXTu2+=hl{yP^gUj;g~Ou{rV zWKY;6|I}C#BCAsL zsRNvWav@IS#zHcynAtbi;`(bgLX68-!87kfPbY_QV2^$b&=`b*UJs9uLZ$DDQ3wgU z=xC~X(i$yrN5II^kc2%e)CDoIiq2&gMVL)-ax$k&YLbqB{IqQ~eYvmK)KTeewPqxT zITZyxLOP(bfpq{qHg++C2QD3yCbweiCphX!qo337ZNWxrDqdB(iM=f?EtPZhTLY*_ znz62|xs8fZ|KdK?{oCpIWyHY=fxLl1$L8?Sn!qmriy+^d9v^H%9(N_JhBKDi>o}i+ z;1?n3)f;R^wMuKH`r_Doq85O#t#<+~kNvlHz>~Zykq8OT(epp6|MA31y+5hi@rqjd zB2MKl26pLekhS2ve58gHfuO&ss5RsqTR!ihDK#4AIJg*DQ%Oh z_f-5pxt#W0HbvOc8n5RE$q9~WZ{OAUc3tEJf)FH^@B`n9E8Tjo_{TR{oxl3e40Nl| z!xI-)m^tPqb|NhB!^(R)YV4!Nc0V#J}_c{5>8+QFy4=b!)R~ z8~-;CIRdsaFg$_MpF)AIpa_~LJDT*Kd>xZo{;S&3{!_KBYSQa3FwWY(jm9avq<()1 z{Q7Ib)hL)n>LLD5RPd?JixZOIGr9;gN&Ea~Zg&FSYj<^CHqXBcS#nEpr$OF9-`BQ%=vTVL0%Uiqh2A`zDK?b{6(aEwzt#>LT(~9CX9wOn#|z5(~;&WC{yzl>n~i(VacbVyG7}YgltCy3?9M8@lV(kR0s? zYT$EX78jjV?spLYb(o6oNJXR6x4@rfYyc|EPJu{L&o=Oy8_^V|&59@vf`4sdC}8X+ zN}z~ZM75s1U%3D6WRW z8%0Tgxep?`_pCiOfQKL5yNzl@kT$L|oVBHekySITa2!Y|J9Ygm4@E*H9)}zbjLL1Y zil3I|sdgll*k!I^z?_Q*IK?vJN*CC9=tSt*@g!!Qp)IAH_Ge%gdCkx{Pho--eKj?V zq}>7aIdd7pSRY1zq(gH#0U?^;L?{{FpkV_paF9m<0kq+_Tqq}! zCf}wo>@^^hdQ!+3`Ee59LUUul>5?|m*jx^r0n+C=i9b3Hp7;EmGWo;5mOmjx5nLyk zKH$&w0_N6n`31#`I*fA=qk)?CQ*9wmt%Hkr5xx2K_vIeiB}Ibk+MtMYKR8N+u);nb zOXmn5YoZRB;oEA5#_39vhJFIU{X6X(gNIm=udE;%JHTaotuT}PiGh#8CR&bTNwW-{ zK#>i*7ZKo_{cUka{+aSaQR#a;HKgtxKwf{#g>s^-9SnsJMp9&g=h-B&VF{FTsIbCT z)5vw#54BRH|02(1TZ5vVD?8!;TK-c!Sa6Cx>+Zjpmj&7B$m5^jw9;;S{ za@Gs*bzwo-)as^HapS2kh-XLxi3 z*#QC*8mULg-S}{TMEi;l*z<4urNl$GDKaT0r*EMrW+>;_0yat}%!aXFrbs_rt-cAe zubo}ce=UD*@&q`=DEV>fp9h%T)s#AJ2UIhCcuRvkmG$kq_eUa6m=ZnY{4^i&{_o3u z*gyu3w?m17B9tiaUqS=0P$H8hVvYbT@wZ%l1B5L_J3puS{yj8=B0#uxhZiMzxQgr_ z;wepXI<>jWLl1Ep10k2xLl|cOJ=?LwXsi_Z_NAU}+p<|E@&5qVfQ=Gnp%Q%uE>Wb< zzrfP4ubqJ;5ET6@`ES$sf&-J-HvjSf6lg!Y2Xuwv0(f{{KPfo0Og=viE`pb5KK}RR z9@!+af$N%~p!nbvMbZ8RG*Iy5-vDRb)Zama5Mkp#Lw$tDzqMR&H-C$3qSy&2*+1jR z3ySo44U1Qi6zv?_VEWhc$3Rg4(YDa(e?k6gQqQr&!$38ie%1GoxAUZLa(R$7d4X~s z-O)l@{Jz}u6*O=|QWSkaQzG|&2@L>G{ta->a{WCt;L<=|;5IGnSmP36Y=U#&sZe5= ze}!v1A@u*wa>3pFEv^9@CGT|6%RGDzd@j?ofH3!c?My}d8?Q@hv)?x&W?F?ZI<_@b1} zt$vAbBmEL)-DvzTjpNi#ge%VBqnQ-KQ9+P!{vNgPqc02UQyVcdQvvBll!_p{DiYVx zZmt&!t@h5j`7L^nlm$YFu8XopIc4opX2c|es6}hm-sAxJK2b>g!l3(Q%UUb-rIE_q zbJPH_c2N*vwEdS}v4e!{Tm{N)whW>=N$D+BeZ;>1VuYn=<@ z{?hv{knenGGF8ZvZ*#RRiyTy4cDN(D4>eUNw5Q+@@U1X1xC-Nq{XA3H2=i}*qT1Ji z<$WCnD`=$;tcQs-cr6?G$+!*IjNa*;yXmiCtSY2m4^l!)&z`dm2yy z-s@^|-d5z!OP7Hg7(WwW^NTz!n>#t_ShgN*avKHjL`%`n;T<)*nvhbgc*iV?YxMxU zCCj>E#$j^1%99pGOq#lwBqm9|{i~Y-pk!Y(>W;zgIrc z8m;xZRQ^@)8y`DjGbHlZ?tR;%^npFe{?Tm=zuNQetU{NIaMJF2Ft6)U@}RZtr^RiQWLtiO*ggt~1AlsRp|7w+jbqW0iR@KLYwQXLEBcjnpDG=ID9%s|Gw%Pha1yro<8A(o=Ur<~>5;$85zdxP=Pq zsNA>N;+R(=Mn1uKuBF`t#Q@JKhk&~s9Od@kbK$|<$w~=Fjy3eMke5&6q2xB7k#eVj z=S2&B&&;GOvIwRMU>LT+^VNwM~5*Q=6 zqu}YCU0)&YB7~_0bgU+&(tU^R8Ck`gAiX3O8JwGW+Eq(N4A*&z;Iuj&=#z2{ReY~6@%g8ENLa3kLqIBOM? zWKsm)wBU@S|p-0M17XpaG8Gs!B&;0Oe zVWQK48*Iz5BHUTLAxAW*hjSfG%+^~UJUOUIVeYQy{V@*Ls+Q9ksSoA7zh^ykE98h{ z&x}}_Vr9yiL!=pU0hIJ;EFjSK^q1rs@A-Zq6Enqob?^)jfq}$~6CvdXdUM_}Z>2TH zke}6RJaR_#g>tE6?S`fa=<~D5{YfpxVKls4y81zCAx&FkfPn0DIzBQQ4m@po*{(0Q zGQ}o3kAoeX`T?-dQid8c?bcdh^)N37In^>#RNL`x?a}nXG_KS1kUWLU6k3j3-^Znx zU^wBs;o&L}`KYKInE^E$3VRH?X?BjWL=5ARCaJt4c z`wY*5LZ4k!zDYzO6eA`E&}>5(%twN)Jb=ND)UYI43KM3_iXcxzmXRD|*^kA!vYxw{ zS>K!RE7yvhYk3sxVTcpn8RCW<%Y9j~_~}rMPs8K5B2h_Otg#4q$Vw8#aLq{M(_Dpn z?-Q#B3)&_3Mk|dZOwB3VoY7V8lYa~X>m9HmN zw$}=FgGdUkxa0oa?Ane$o4VoNPU_JUn8ULU_qLf4QbTr4N7)fl@-5s61MaJL5-<5z zhQfUZ(n4)rTean7GM{kE-&gY~$bf^Q*EYw&o=0am$P-5)jOkLBWPk$%uaScZ4!+lqh4LD?P)e*c2b0le) z*Jh7_(`ND>@cv36FTz~N{R&@(b{SR-H?VQeoU6!BoQGKA8pbMOJKcNuzif7yU(2@| zt&v(QfP-^=}_%<#W-P6pWp zJcX`xNk{CGy0;fKx#c}Or-%7TY&GJYu9~g`b%J-XDR?2=5PK6PcVn80<-jx{1Bbrc z)}WZ{6fjqfJ|RX#pm+MBfdjHe{si;qM zW;%>R1Y39GhT4vQ&*a0%NA|7d2pG0-WGhqby9&e9tB*dP1O*Q|6GLhGyHQuL5(sOpUgP7y3W z0?javdOdeZ<;@y|`T{*fL950HQPQM0x%GXn*)<@Fa+Yg;pk!#0Oz&U8P#p@^c*tW=|>Tpd=M$-4(OEo6HQBzfbIPXEbQ}{ zM2sTr7!@4^)MFW`m$4{QRLqYiE`ojihIMknCqPtp3f`U0-qF>GdruXSWDdzHAy?2(sEnmC+ad=Y z{7~EgxjuN=5NLGy@|^g$?v4uR04aQ7%0wTqb*KR2-_5l7Pk zmj57BqLU%UH1(aW>iod)W zUi+g`!wNSmTbhuU?6^}tf}4{3Ta_yFuw?`XoPHM-#sQwO;4^{Kb8$TAo(rof%J5Sp zkW!s)7kEJFOqXBXM1z$`z6wr?Cd51ITq%b3`W1|*P8G8k&#%pqY!!IGK}cs1#x3np zgA_dl&oz)yD#HqU#k(6(LFWM6V|x_QwRt zvVvbiDo_Jwwf>(Odud~AnlAFC;FctM;~rZfa@KBEgtu7BSoKcz5HVgV;2;DkQo-{C zu40OHg6Aq!wRaW8o>!gep#vg3KGlg#3ga*p$2M9IC{mOLKzqZ&ZJ@Loxn}KMl2xP* zOpZfL7>7(9(96cJo1CmLUA_Vbrcv@{gWQd;;5VLr36&tlC56l_P?jbYtR-?sFGF)S z3@gHC($-Au+kg5g|F(jAT*BtSpw3*1*1v<(2tVx$!~Qe)039w0{Wif-)p&OmS(!*t zY#xq+AXYiE0D{;JWdi3&xm%xO%%Ui_^tJpg;F8Wt#!DG%Cdk1}KQFRmN;EhK`8itH z)&a8!EC+m`!{YT}cF;NV!ru#UGlgaph?V{`(+=b4eOfTAx&^J5i0Zp<2X4tKM~u3j zr2BtjlB~Vx`JkIi6w@|7Bc*8d$F$AEzYKtsz?1eYW*|b|mj5;F|26G@;wN8xkf;4?L(p3u`m86|5uREUM=OwsutGep0OPGj;f!2Ohbw>g z+aMV;B0Ntc)IT0$0;LTw=&#r8_&I_Q%_(nl`un|$;h)AeXe<#?*xJ4Z0CBlUnEpT}tg-BqyjfPSgvPtzFnj&^?h zd?-ow2i3^xKmf?bWxkQ{9mN4hYC5tH-v|#t!LFfBxGpW%YFv*mqGl&zEJ*n-Md>=4 zU)>Be1_=#t8~*TbsIML{4ap1zzY?&u>bY3)AbM`%MWo`Yuwuf89fL zzDka3_zJqFH6a1Boz!SJ81dVSW|_mE%mB`$dbz2?&J1+|q27@0B(9gD)br)R<{LP> zb@J@lzJkB>0yrFz<;8|ha>{L2K9#sW>hD3pV3WVnD=9H7ZKK~ppLThvUqT4UR-EkB zgq)+Z(abzvMZ;KA5ri5Gv8~y4zzK3)%@_w)^WK+$YVSh`t^*E6V=qmvBLRTTH#hPG z^(YGST6^sAkvMo$s7+rH6apcCh$Uzj7+sIzpb$&P8z|Fi8+jy`)ZffyriE{gCO#V4vmsG`PaTeb%{BktNI#CcV?xez+wmHTj;=+0 zgY1${e)AQ|a=``zj-2t%AEp!F@#UCHyl?&$aS`1T4?cPk81bvd+%h;Zx>kN@z!cSU zx8+khwiVU8 zhl42YlqwiL^W4LztOvq42DgpSE>F>=g=E-11HC{<9Y|7WQiQ~H&#&mqZtkx@z0nT0 z2_wgLT=vD*^0>Wi!etfCf0oL{w z?x9Z0;!GNz`~h*QX=eUktz&dX)6Ir$H(S0hfY zR+%tuSuir<7iT^J&7JCt@6-^OX({=8!30W zrd(4|MM|0z=Dc{}f`glxOj)q+&Re$YWi4&iH|vSLDbmgkCHM(xAHTa_N_ZW4(Su&K zp#fgTE~i4(AgWEDoHI2ToZYnp+l=fo)X<-5B8jXPEhsz z#Fkb3G;Z$ehU>;qDOD}A1k8RC+gyKA<-GFfkPlcS1o85>QmmODd3W-sOQW(JxN>r% zA?@c$W!ae8TQ>9t#bmpg5YJ0E!Ocd~W|cb=-EX$Woy5dkPXeMpgd0HL3tf)-s!Oa* z3ULDl`r96v-viY72i-u|2cXD_bLWO#Lv}FtG24!OAQW0f9x|^wfOF^?BT73ptKOyJ zJ97YHg`h@q1gm0;yNH(V7urKq; z^ei0;(E5CweY5+qqx144+sV!oaFvofqAA|H?yv5(F#4#Xw0%SkGcV&CHf<0vM)CKXNd)oJT=2qpstVlEIT$Zw2ZCh6M?Jq5eZ&2vSwc>k2TH~ZmPrrs( z%X2J}GQANOWS=d8CAP6MV(Gp*RXOb|l`3Ig-;rS_Y(1FtMX}lBiSxT%L$#Vu#%*IG zEb2+I2~3^yp&T(L#3KxaTjQHQ1$+@YVbnl;Zj4nVdp<8;pq1mJoc9(1vrT_KlQx)k z2hi-45gAD#N@fPApCMX~u+;yFIH<E+)x;;!HGp=Mw*G&jeP>u|DXmc-|*no_(skL zCn+BfL`^lun2uh3n%9TvnWd(;>!3JKNT7!ePH>Gz6V916WFI@HESs+Y^1f~DG>$Ad z!B@6jO)Am>o40{Rf%^|E2J3o;X-B!@6Lx(eG~X3Kv~WI)k~q2zLYG`0z4pKQMhTDr z!+Vfrdeln?k8DK$h+6B?Ac$~5gE#$TkE9CE4254`i_Ze}sFs|zvDYW&#^lpv?*$1d zt-OAD?hAPDr;qM{$29ydOQzmB4I4b$EYla=N((uc)0!e~yCRyM6lisZvEu5*{GSVk z&M}g&P8sN~il^B2y(1qQVC2iKg(V+_2xCqPOk%%UCkwK{zKzRyH(Y+r2D3AXCduV$ zzEuxkoy1^&h!pZ9oPcdcxzm4^zQ3Rw5Ip*B0Gj3dZEosyenO>()Hlhv&PhFMa_O&k zG6c82Zt^Rxmv78^$e#ntpB!6`UkBnkrk|*ka)hx#ugP)xxaUsp{bUQ2HWy64K0w-| zyKvxyi?GQrT8Oae4*Xs>8U?(E&rwK!X2dR~w@rM#eG`35=(YEFC9v&}#)=MXxglUYKsC5+&pN{q9pTKDS6i<|XH?)hJ8H_j? zVSGt_K@DZ79CzMODVPPOR#ae}Ug{BBW25&}+nT)1Y&ozf_%&vEFVH6I6sD-Y%AVeh z{8MN57lvp4xsiTGq=eIzL9ZGM2fCL-RGVMEuXLkT_Fk&&OwzjsmuWZ}h5NWs$UszS zj4sL_HY$SKnN9Iz^mf?_bny&^nUS9bMGi^02f~{fvu;bxa9enXaqyltNK$wfG1H-) zWLrQr8LiqE%_bF(C>ZhzOM0OP51PuR$u*iSqP}q&co6DXnj`s8@*4&PDSVoegD0g5 zYIJ6Qz+fCi;@6Wi7soBgy{gA4smy@qJFd4p7RP5|HZTKHMdZ614lDY{@8DYK0+a@g z59=O<#3&kMMjtjp!{=!slcSgD9mY$PU$(~y%IFA&CSg(^ zJQD0Mcal$p;cvhsW#d*4)@->~C!k zRcfhv>np`P84Wr#>ZSKt5?0cLJPmbOIJWysXwOn9W)NxOn+sQ^;qNdQx+ZI~EuN~3 zOiT%^oZ2;@{t)G1Bu&11GPC5kd$LumU{^YpRg9%0uMnX=g~Ls?MCE*omR;0m>SAu{ z3o&xIzJcxYFZGx@y>RSIYdcZG|58Fed79J#a)e0zwoFP_F&OMXU4cgwAv}o&Ojjsn zn>opuV$;S#M3QDFk9il06yA|kuXyEQ7>Cf@nuW=Uix;rE$tB5gDixg(TX;4{^*VPA zVvB$XHi$Ud31D3(^T(%bgRBlaG~fEw;Yn#a7&HB(3B%f&gV27D@tx;{I8Pc8tm z?6t3*i2}?`9S`BmbNy9IS)5RWccG6dZKHknHqHB;3fF<`sQB`?QeS*APkkqY)_>?P z`ns9Tm`&*;E((a8UN(%aiyCAo`$fOp^ zFbiX*NX2Xk(l)rKJg-x>pq{7%ieKfrRa!=#w_ErD@{s96R|e75q}=ecl>F}I>5akn zpxD*HHyd5(XhHro(=nEE79<*(H~os<(Y^sRjG~m~PpQram*|+1F9kxPrN~dtQQQD)4fUdH6)eek|+DyJFFCrf4?HIJuQ!bi2&E}VV z`DW=I7`Bte{NWk54(7>r0?l%yBC8&)V*IQ+Pdw`dEPoQm1zO9|{6l&?%1Xj2a0`no z_Bc$uCY`SE_UWBWdpt)x7>5W= zc=X9Jd_2DlxX(OajNMh#aG5XEay$GHt7b`)AvHW<9L^UdV0K-4Fd$dWblA$o^?W_t zo7DUL=9vuNsm`{x601-O#SBG&%(b2iBM=zi5clLId9m3Mvg?)#s)1YC-`y9uWa?Hs zdp2S7w_K|_3j{W%)ROEf`NERaGIgD-_7>gCeSY$P@tp2U*d)}Lh>g3eR7>LwVKGhL z7Dc$DpBWUBn1Aq#V4sqteA=JhUlUXuL|+Ss+rFQJW-ZrX7Op%K2W9-rqYOz`iV?rD zD{W>M9p#&9OF{R7lihgtBJw=%Q;G^Hw-97RfE(Co-LYLfGf4j6U*;=B3nrotE2l0B z9~2Brnzo7DMT*$HbI#hO5LwY;qzQ`2Bt}iY-*X&20^j$s9cvp%iL){iN?yW*v%&hEI6Za^$H5&FpNMCOyvnk60R1*4dlMoC~N$HhB& z_!X~}jAs=*dr?WUv$KN7ctc-r+y9L5$gtF$4@w)apjlG%dyx}W!{=ZU6F?ODqa-=ZZxxQ@MF8oz_;4~O3XWLK8ZU-GwSk8wk=AVxeR2S z4|*SYZZ|`USBjwozLc(=xmO~Ih?F-(2xuQYl?xjC|8)6St#e>^t4t>dCH+sA$wNPf zYq<}Czs9wcU3&OX8<*qSRXY#Js$i@l?AsNOv1-R2)QNfu=)+Z|c(H2Bs0-pXig!6P zIDB));YL(i_KT6dwVF%@=k8^zR!?rVMKS2O@k%j?Pg2hr2^r`fk02n;X^oilQ?w_E zvh(2LZ}0(P2e-u_hwL|k=UI1W_IRB4*sQ}j6pO?6aV`2SFQJ5#SJ5`JJr98$G`VCb#c?+ z0EDAp0<>{>iC%vjSbQrRpbqEj8%Km3DRRmHa=QQ9NOSM?5Eh$%g6R=#x}5rd#VEww z22-2?c6XLg(q88K;4nxgV4@sro&#wKmS;^rH!{e?zvGU0YC&w_Iw|jx=66uW_1oE_ zVG75AQgmCwRnmG1ebR8WbSl+vq>y_Kg51+jIDR= zWu@2Jj#%Ej{Ot8I&#oN1H9=-$yT^BNf}}=E&T+r3Hz&${I)u;AX0>eVq3G&0bvPq) z0zk^jxcT~2e;T4)VnF`(u*G$o?O&f)9dN%Q#fkJbg4!WkZu}%8{ zU(c3A>7Aqicj!Woj29NX$Mb8bM;XXx+`KLq^;Ed`PwbtYU2YRpu+`t3M9X!;*E`-v zn%MA&E{K!Q@_R|kxB4lKrfz!3{D<;I7df%DtSD_46s&pAFPgv)U(9vcu(y17!KZR{k9)sj$My^Npb zDWggTLqk9Id$sAwtGQjSW@#G zpa%`4WyhNLdns{QvTUiEpXpoT6phhvfbO9i8ykB)Ad0>b{)_F~;{@OA_c2Ghx*HI=r9w1luv*LIeI**3(JwmD2dL&aU*+-t9ey#`yqza4|( zXmA>wI@0#Ls$QFOhC1mdu69%wzP(V*YBRWtT+u`VG2+)R0$}83@$t@Olzy=3kuP&b zaqcl}&}^l6zWbMr*+qEJRgSjF2Vl2b@0@d4p}dji=oP?9&U1wrfe&BuF)dCKMcC48 zvHu(xBdba zL}}-j-JnP%*{@V`2F6Ba?z&8hoocwxpf>NHzBOi4ng;+Cjc{rZ(NWpo&z zS?U`z-9wUmd^5RdI2~_pK!wZZ8it%1Lc=78lt>CoN|bTE0rrQfqPbO)Z{b|pf9VxE}n3tisZ&Bhqxz`xd#S@ zeielu05KP;XRJOjPiMBX+?}ja;B6zeV0>E(y*H|UGgqH$q}ErWo=gfXcj*`2#f3*q z^=dpntz93$(&7&~r6lQcz)_mZR{|856j$l{^NnL89LBD=nF+A=Hm}{yS}|AC;~30! z-eP!qwELBZZKUw8_($=x)>`UPCs%4HDHdtxI3kHY!M6Wg2(n$i2k!hGN-QO`Ru1t^ z_pv>p%+*Fu&sv_ki^U>Ez+-!ti#WU=U*)EQi>!l`h)iZqXp$CAy>2nb?^k)YW)5A3 z-2`fHzA_0$yP`i_=FVd|MC`itq0OhT?sudXS0OT+$=c!k`KPmC8!}lTHr0Bo0AF^q z7G|T)$K0eh9hH_*ANXwvg1;qd4;lr;Kz`+gTmu}8V$wwmpRz4A1PF|A`1mnn1d}On z4zxjiwm-np$%ECq0<@U%=S=zq6Pc7wpbM@a6X?~ff z)_9AgpWxF_t0zAJNW%Yy6&4!b%5{Ene9+5TCq>*9yr*cWZ^UwAc_!L#E36Ee+wJ(KV4hUOD6$X3l`@hYE#G5F;Kj0qtm)x4~6cWXX3 zS?!&P{xuZ+dE+zC@(I(#+HGprR^?Ch^Er#fE@cFwQ1$J1@Xm<%ZJ=H zT8Isnx*EwBr6T1!wfpHu%G}r<_fuxc8$v%wA(6-5Eu&Ys1D0NU(_Mwfp|^E*n5u%= z9S0+u^m;vmb+(RaZ>GMDSY7NZU=awaGp~^mu5z>vNJur`im?2ux@*+y*-1yX8Y(ug zt-Q&QbP^U?rnPpJu-D>Rl&SBJ7AiTUK`XWL8ur$kgLEcpuda;a+k*N=6Fl`dOYI)1 zSZ`MC{iJw5w0nJ9N}~JQ?9U33A~g_@4=%-BiDQ6|4&=UoE%Ycq4?FHOBO3U)VTVLx zRxuZom&V3e<%@nhvb6CRrh@9Sw&VzRpDxOBRj|~r8uL=c7G=tRjmXEaaOK(7R!VN9 z^dqt*t3c{QqNMT(;{u0okZmO$gfebRBh>XY020?X8FRY133*s6_4Fi(DB+z5I(@j4 z_oJ?Gs=ssD|9vcx^~`F#0g=&>1TpGLRd$|k?YU6+bX30AQ8%~$-7V88b_h%ttUqUr z1oc_|CtVCU4Zo9*wTgpd-={$GVHQ{0&nJ2-f^_gj;mg3Ur`FTtn~=3P+h(nE-}CaG zExau)E6zH+j#LuV|0%1mu{nPGF|u_$f9d+M(x#4~S`9T$MZ4t|<17sZv#ka5)Kf48 zZ&WCl+kf>?+;Jx|{%KbVTCTH*EsP_<49OzcxzugykSHVgdi%I*bG8THJ^D3=N$bd_ zN$t{f^%BRZby=;y}kWFG^IAS(j4Hipo;-4pyDFvg@Tz+JR&rXo}vO_#aZVf@}l3Yyex<@ z(uJwOJnIr=qQGTLCpg5MEK8pZtz_>Zf+^0xK~)eSD`U^|W3j&E!@_g7&e{u<>u4T} zI^_=N-mx_ECM4c|YK*u!7ZE>KZM-;N%R^>ndFVH&6aDy?m#0CX#9q)u;~crQ{sL+58{_0GsUiXJl`iPPFXaTW7{BhUy`)Gm}S3Y2W$O*%yqQYn3C z6}-4~o=THemP^7}XX?qZrzfB5(m^sp)fl6dH|p@6NkiB`i{WPh7I6Q^T!x(s&~FC7 zDd5cO$PPaNbG`rheiuE&W_CQgP3n0)MzH@V$U?8l9_C0**t1^W1TARFwELMW#zX&M zQc#1r{)LBB(6*Ma=yQa--lei)^cp)7?U?NCWu{fv*5&TbV2$#Stbn=k#C~RrNovxg zZor7*rl$-(FEeM#7A88J-koa^i;~z|-XptyzMiYE$M^W!y{k4D;1FpFx3>BUje2i4 zP_ndsKE&9s(9e=^{Ok806_8!-q?@2h9AmXU@n~ic zZFZHC{FB^gurf1xO5{1eY56sfbqFaqO5TJjAEp#!voLSa4hgm7Mcm_e2t_L}2n{hR z>n0?930bl`NyQ42?n#9rxWT*RUex$3YA`RS<=NR|qPY6D;?SX=lMJ90U%{`AgHwG0m&#Qrk1p8~ML5=3!Z*4>UveM9gnxEHM zy7;}mHX)C3D76?cEof9P&&Za~x7M{g*d#(O z`AaW=Dt14wdhyOb;Ks~u8uw#L@xI5l-MS3S$jC+m>_~+ZnUWxZzK;RrV(d;*c_3V9 zQT-BZN79RAmFPL?9`LJ9oRf;u;3juovm<{7h81q=7_9aAwj&lgl#iIYFFrECZJ|qR z!s9j^v*{!_2G6SIJP7H)?hc0NBZwGEFKjdw!~v`aI#K`|+60GH1-%mh*#2@rFy`zE zmc3Ap7xlNt0~3c08d?0x9^pDA_7vG48L03A|Z#$*WJhJs0+upgTGaa zVx1b;vW^3*PmtoyI!!$5nJ(>2wu)(vkq3fBDm26ZwIAR-6nVxyrMkC#n)&g7;Q zxnbOyck;@0FS;zZ6bfT?lhzM_1`lodHfJgB9P?dIc#-Uqy8a6v zuT*`@z999olhW?@?VvZ%HT+Z^}srT#KSbc2qNT(V7YVC$2%jGeQ#oG_ekF z17*fTho5I*D1#vy(UORcqcGxkrTe6zfEGOT-q_DkI^bsHu0+q)L;!^-YBGlbhHGw& z8veaj;g)_W=)Vv)t&ak&Kt`z?&_)YVK_g}QklM1C|53<7MewIUeh)1lP+X62x{jGz z7}vmJLqzByWBGSMzso1}1uX&)>T$?F2oJdg+FKU$URAIN~+`y`CIqx9>H^_K7mGLPFsUgoWH!8)r@^1>)tb+6MG2g%-b8=M^A2Cu&cn{@uCr3z3EGWPq5Osa)1(n3^e z@VT!=;&Syir(+E=(t>v-U6RkNwOEjxW6$$k=N);PBFh3&0%#}yqx;lEnbro#;Kd0> zU(~{`OFFL~6Q27PQ|b2oq|7bOc)=(=9q)T@;u}yWF_{c!`Xna(r1x4z>-_13O*bxq zmY#EkFJ%7gE3r2d#oE~{Z8wHjhyEc3 z`R_^Pp9D29#-r}la8C$~3#ai@PX0o!#y2%S-}t8~!p}k(94C?0gx(SXH4eB^Vr$l9 zfiBqK(YrpG`)TDTrN(e=ZRV>bH0J>tOe)V0O^oj?QM$BN`lNwQ;?8;V1NS2kb%@y5 zzYj`%O8-6)u=RZwT3>TafgF&xCMpVS1*~XTxd2Lmg3LeeF1NfD!EP>lixpay35ySR zi=X0cSF-|Vd_cMR{Gn^2BggSSy=|LpyPB8J@isJDU7bFm==lv)eX>=bB37zsKu3C= zQ7=U)=|Sd__s%j%l_B*zrW#QF&jyMq#WP8;mf^o>B>DlV_ubd@jpA_jt|pLI1fwOt zI-3|!N7_eGp!k{T@9FgOO^l%&KeOA_koIQ~kP6qZyWgWx_im;qwDQ|Bg>H$`0kxfhQlM zSr!4>n?9#Dh(@H6Z=L~NV=R);C??9Trm5mCbg)HAvXKpl`*B}ZMGw|Z2{QM+3H0b; z`Q0=K25yq?Df9@Y_(^TWsP|R7KH~QSC!D@m;Z*jf*%01Vq&C^1Y3|c)%D|q}f&9zq zd>5h0tuqZMAbaJJ1a?3Ka$fi>U?|{6=eYw`D{viY|Gy|4InOk#wJer9_wJS3Vxm@C zL8J>@H;eU+Nb8@Ywc!hW`HMFE!_J9eNxG{J0JlMrMs(vlF$!4E)zVBo+5~4K?)3av zp%$t?Hllg(vgZy)!Tir&95&VIz`z@H5F49pKO=PTp`P#-tCD)CCoJ=RnDr# zD){U^3+_|=hq3Pv@~8HpfG^xnP@}{nmhP3__A14Pe)>Bf`q$v#zj5-H-%eqod3Ro1r^KysOk#5hdYEOspyr!oG=C?Z||JJ$o9J zM+t4{d%w2fGpk+txEzgB)Co}G4o*@)MROPQASBu26JfEx(AojF4Wio!eA>>~EE{9W z^rNZqD1|v<+M4f;`p(%)q)y3p2YSl-30oALz9+|e+}vrL^x&3^r5`S=ufW)q@)Bj@ z>Zh$!V1SC$;wnw(R0MC1Y5{RsTy@_Lby{??kk`+(DnqzDx!A_(bA`%kM zATA}XIEkoOk?%%=NPsJ5_J`l_W6*(*c4kB90a-AfWCSr<>-|PB1AoD{Wq)>v>q$Ef z;5HgnW(a(Dae!Z((P6OdK8zz5oA4$YoP8{1)|$E1uI0#7+L`27|GR_|uzioRdj*MW z8GZYer!Ykp$u5&=TE>$jr4Jn~c;4`Ud=#BHgc0Cr>Q z&3w?G)-HzgmrkppBp+S*W+`su&<*%QqDRcYlSC)J_JmK+OLDBRZ#RC#P%W=Yq$ML% zP@qw#E8w%1FIX)A=5wsbrCQZeot*o0&5jXNVF{m8kf7Z^p#M`@@;R_F6_AA=oy|d< zWS`AtC350rK`GhOvf1dEEUe^vj$_wi-oUd8r=@W+H-0SfW>d#@ zAf{)*_}yH?p3wCxkm2}(Ec(t@;O}*L^Bpz8!PmoBVQRYC<03{w;mtkHFsp!-?~>sN zJ1`oBYAe_N4$jPz@&DVImnSD}66HN>yp={KKSygAs|n*ANCf|Kr=F_|gT+v=aqP6E z_L*Nm&`+qM;kkoyCqMtB#%VMQL|KXeXZq#Km&~T0^O=59ULH^#>4>`f_wPF`*L?=? zCM-F?Ns4KpY_AmdUja|CG7jYd)9f*h^)}gxKwlbjQ`X@ju72ucm9c@&=#A|?WDnjpU>=};d2nP@SnXoks*y~qB*_d#I!&mF! z{74~(9tvS|Q$716Y#BA>V}>R%u)=Hxu5Wejl;53F#HBUt4-ghI6iYY2lMeQYG$C7s zVkh-3_2k%fd_B36-Q$X#m$RjG2V3pbD-yms&ZdFg8Azo?7QWwY(&B!^ujhVrg0@{y z;?CSbysfMIb+U`2=X~lbBfbTi1jLmpc>;dnQwk}UP3QA_%7(Au8!Hc@6@V0at{`XS zG%4?F1`7&OJ?X&&|4{ufIb}-N_0d|q`j-^=bF?DLA<~$#rAcxK1#ufuBkpa1*Ozeg z#u|{s3huw8g9L6ZXNadL_BIgrPBxHRi0i!~oStw2G~7W0v`sxr6#xTshC+!y1i%f& z)2+26IPqnAg##hlEspF@_|edKZZFb7=9pkJ>+!|atuf2fY06DV=-S{r>Sj@C(#(Ag z(AlFRk$MGm^2RpvM3jGZEq-;J9Q2gS@QpF4CWYme6Y`nrgJ4hkgV zLOI+gSI$jH=78m#$o;WA>>l9)I=CAz#FMYc2gk4Is}$TyKo~c-M>!HYCi7kND8nts zjzX@6wsloOoL?i;awuyz^wg0epo_m{O!*RS&FQ|P+tnE? z&U!i}&DZc|d$=!2@k-J1WHB{NL#R3g9dz_LTIp7sW*lr>pEBCazM595dNQYHd#{WV z=ATz~rL7^^O?kO;QX=Hn+PIlNs{#2#lez`A>R3`F0K>9CTt%HAGn)hltB9GFhO*1v zb1J(133PzNscuroQiit?6i4>-(r28z#7QsW1yN&@Cz)%$0vD*W+R+DZiyyNmSROEL z%%*h3pKgGMhQ1jANw|+!Lh?)`%FI{T2;Mm3*nnIeIB-pq$f84SGrgq9!%d_YjkBfE{%|z5D4&4+=h&mpa4q{}A@p zQBk&0`{-*CBCQ}Tor2`hBaJkY5+WhZ&>bU!zyL#th_rN0PaZ`RB+JomnLTzg;FreQq;uv(4rZ>j%^0^JfX;fu0e0zZ z->VLR7iV8CH&1V)2PvFeHi_-N={L})r??flV2sH}M&G_>DPPd-^ zVQ_i~M2sQko|{5vg}OF(vYLz9N3j0#*xWE|dc`&^6h z{C<`qy32?^YI}Y2=2p-5OHk!_aiWffRI-ND@?%&7jNvF&k8d<~9`h0$aL%0Wcgg9Y zk>JkLnysHc&AC%FKHoVxpU>wNAaixLS1=8X6O=X76qyDY?|!QxOZ*1B(F?E%>3&r* z!2KW_e0Dok!}3rN5;1)_diY(CJ>G?R2XEMVqV&yJfhGf8H9nv!VTq@#E{JKu_JsuB z4%f7j5kVUjoBl#qwcr#m>qX4xo_O7{K$mpTcpm!-f($neOX6(QEh zP`igS&uMN_;ri-n49${m6F=W{-PJcXzOzJW~O;dXO|gXbes5KA+0905Io^ z%hIQuwHOZ`iR1*eI{d$me}Ck$E<{+4r2&>>g#@qH&hDEV!kW**aV<;c5zfXlTp zk#1BQ6T}yBEUQ%myuDmrl>Z*J;_*7A0_*9&OrI=Qoer_TK0=s*V-lrY{6jX6)s?X< z;@SY-`YZVg*GsMyt0hg`{YxIEN}I@rOpWBOMsFXj z%}JhIT3)BSG#;lqZ+M$FjO_jRQJLH{UzLk)#am}!Nk+AZ6}P1!M*Cum9~ zm-B4c-e6-z5=XxF&$J2GE%f+$KoZ=^#;mq3XAs^Dv%}sjfrpz(i}g03%d(moMH9e$ z$!|{DH7BqYdfW0THCBpb;Lm-nLja(a1~ioCfI)qFAQy;%M*7S*)O)t zrEn_26h+i~grV?F-eld#jJh;avJZ2N82Nq^>3$2W3EAlAM~O)WVx-{K`ej#+LW*k= zc9U4+JEso2LdSDtDyv|A5@Mh27%j0laBbp!sL8;$oJpU9WJYSFwlFIxz(g#pdQv>c zcs0-X;{OdcAD^KDe%cWb?t?ztryC|*K5B_Cf8HcstktpKMNFf4MNG?5b!^=+y^8-( z%=6|H0nsx2Y3IMWZ`U0m%38#8)_+X#jC)df8xyws23HbZDA0T+`R zF?#U_p>sdI-{v}faoywBzY(g*HQ;L2`{zZ7`dFPSx&25kOh-{rh#_!U*{sfCvgu{B zzbR$7QqWs&YH$O%#(9!U&QPII%N90X4M41;&$= zzp}q=*Y+jSdpfjqWwj=caB7d_9dFhr@)^>4ZFz~oGhPUAW@hfA+b&I)Or^-)f9GGB8n*Okx(24(S9^8y+*q@Z zZq+e7a+JXrm?shU+VQzK2kRB8to8<@F-i;=6|wzJ(*MxG}rhQRYnrsrz@*NGHL-Im)DNeBBJTkX`V)kl_f?sTzX}1L%8%J z5u3CZrv~By=r~zg+v_K?tl6hD(#qnDwZ1xjuKhHT7C2{}fFB`+v5`6Xoo%VRuk-2O zFt$)+!d)Q1qD+*N#2Hp`hba zzunpAK_-XXKa>sKVg@Gqn$X_l4KL{JJ*ts_7ODgtDk0kE&b>A(ig&x4@D|a-o zqc9e?m>3uG6uvos<~bgP*D_2v+dvE7>LG*)Bk!)TGdbr%cuF-TA%#cvG>aJ((7esvaJ3iz z)5{aKj0aRn!9zgtME+`pmc32Ad!W+1-4<2nY8RskEIr^f7+AYH#_+}B-y+!eRRJaz z^`SLZT^|u1bdyL#cPaedH)=g|dUa5CbMg)~_Jp)Sf~gS=ihTgcC(KJ0a8djl4i?~Y zw22dC4mMFWdL@%1w;hVMXSR-B!ZA)W(z#VRkXtUTDdk7e-p0l-vo=t>lqq^{ zO%P&tCgs96eh1%7AWHN~G}tGKpUiP_2h~Ec(y*t)Xw}ef7RnkLbkveQm2DDE7Vu4B zUK{PMK@FBUWQ+jcv=yfHP17+@Un5@s&5&B%^t}fi4d|Vbs{nVJWt5=f2?xZZ*wm9{ zpgVqv`BXv}OevTGvg7tx=^J6)+#F{Bw)7DH{%7Q=ch~cFyS_CikE0^?(Ov|*A1KD8 z-gqC8ERuP)4<^ZQ@yeMW0kXw+&Hn5j3LR`QUStSMc9y@6sKZmxi&-L7rts{JhE4Tk5rscqNun25&XucX@iy7JKI0lNT^=K=OX zZK3yr;@vy0LI=e5X)l)&_}UK5hRc}YDKBJ+NGO$xfC7@3lj3oIUQt5MJb0a@X|4V_ z2YW%rXZ)&Bpw?&<7VtN}%=Dp*Ze|8_UCDE91|;@}8a%gYbr_Fm!9h)@z#=w)RTd-T zW%Z8^_6Z}PiF+IDvmf4urigL`y2Jk(?Ye!TL zY**S?;6sFlD`9v&{egtA(3k4ljueKFCGXwcTkVpUUkT*?HH8DX<>g7yPq$T-hLe## z+lkV@yd+N3R$d}RhjXb(`e3D!$x=WWf5Vhi98a(0ZF;dmg~oWXevV2a_voQzm+d*^ zN)xqMDeTDlx8@1M7Xk+f& z&@yQz1PuCKjyah4X%}P&JN4cZ@;pL@hM-8DLQDQsfDiMA6Er0?xTBJWCw3Vc@4Tn@ z`$rNpyx>!S;m_S%oIj0Ce_pkANdurJBGl04YdSVM{@HXOa#S%=wDp|$?^+J%&bg9L z=Z&6?%o|I*_NW-rc3P^dp$D0ev(m!m;S3^kWV#v^P@Lz!es}03nC51@0Rt(PXCD)9 zCCiX)>w#j=p`+?@klgD&zAS2C2SYPQ!|Va6QM-v8!Ob*98{?%I^wM%Ndq&Pu2lqzz zFf)r+XGGHCBYG*(0Nu2yR>8d(|INO^9q(fnvKk=i37RDQ;f0TX$KeDSuf0#^myh;M z0q1n5WTKynn~t5V0o;wHW0;N^4`t1Fv?mZRK`Fk})xM5gH0s3aE7 zGe~&-xwIrRAEef)X45O9mSSs}T-aimIhUQgxWMhZcdM%fK&XawqzWWt&H!era6Stj zUY2kk0tE3o4*~7apM|y}&8HKoKi@kXozt@zf06xAq~DCASD_E*>Oy^xbN9mTV+rO% zI|ea>&~&RC71Z}W3;Fb+v~E+eB^+MI+!jF6rM3*HD_>9YrWft9CJlQ^Ill&x2+PGn z!!^h?C}lf`T5rfOki8~_vFaCR-)P9S-=U$!K2*&&6Wc%icIWN9-z3B2e~jVaU>{aC z>0qDU9Y1u|LP(pA@Wx^S+SSK+2RF?kat;j!=Xo^uR)DIwe1!*pfE0l2-VtD~3KNM=4gjXI_8w=!m(0FWC(w?BM#=$E0jpcr)e*-9e0P zI5D^P@w&H7tYbe>EXw zs-@C!GW!>enirKuFWj51S|;b>^o^IkInjv{WL)SrVOEUJW>e2LJL3`@{QGUko>sOp zng8^yUpD$x-p>xmx2yt)%IDEk zGL0>l#gfmR7o1Zxef^U=z|y?`#fqe#PD;#ObK5U}15$*8!2CfN$IlrB-QDk`_co{7 zO31(X1>7hM089+Lg05J)+ED7lj<%{J1oaaz_M!``+74+MjVw9;AbV-)eHAFVbh$UP z-`3US3FNl3;`W87$M(X-+BNoP1IzN0Ss{oK9o5YIb^WH7xWu&Iixd)ayn5vaHeF;4Oiu)z(x%m zJ&-ib{vc*u_%pST?K`?;uVr|Zgf0LSyFK|&YYSc&K#MtR==*bAi?%dA+;KPDDTeuA zUe%m2D^MOP)%lR8FA4p|*a!-GR0!W+`=+xx$Q zp;=3bX9PLiypkB4*0C3fV%OxjU1*0m3eajiASiG-C*Fu1`VWhQ%{f)0osWz3|CqT< zE9|tmFvnm;PgJjudk6Tuhl6i$H(N-_H@X*@$Bx&)!>1rq28_k>=BnoCkE2=9V*_bf zn+)HuCx`gLCG4|#JVDT%4Oc&l;fJbqVty-l>S^xK*Nba0#(R}>tK{4$`A7pnN_9EGCY{h57U@F%quT4#etYUCK%rR`Z35tN@6G5=zGp0y&z z1HBU{C`LK}{etd#RcoZXbkqO{>M_C+J_kva8)Td)+9zG#6A|nO$Q1V6>t(Y;T!Aa% zsr|=~yNY0zr?78LiD5@?(-`4alK=txNc8SZN+CU%>o951jGw<}ac_meW0CFXh8s3F|5_&IIA;V2NwMsTC8c908x&9EN&@?Qksw8Y zeHJLmWc!WzoWDb%7}ms~x^XfGrp!d-UdA@0Y2Y%sQgCge@wv8w37@l(DuVWBMv+slpm>>hS3j*w*Gn7s9@@eC73Ny9^Y02+CS#*hc^KbzjO5 zW}&PSE(KaFW4sm3y^qC#!GW$%B-V= zt1LU}hK@Cz4k0Z^swhfg+Ut%>gMM;*t(qfpz0YOPDhc+Jbj_{hks-9i{<{Gl(e?Rc z=!qks_XYlS_g`cA4Zo+_q_aQgObdt}3)zpwDH1g%rwEIMr(}40J;igKm(KFjD>llr z(5AgS<8+Iku=4|9bh9(poTO5_`~5w)fiX6!8N$(&L7!2p+gkW``L#=&N1;z9 ze9DR37lzPElW^wu+%tN2V@PYqgy9;OI_wO@knjIwf<$mVe_~6nMN`tXo8OS}iY3?H3FG#vLO@U>e`1-T>T@G_xQvs}A<^F$s?$ zbYF$8x8l~}z6K9o$!(T!fBT8_ZOx!~+!@R|lk4paB03b9Brq0<6sIqHo!9GeHAJ)d zD_E)sGK*CDjvs12K?2odM7$_8ZFCA0WsIQ~P+$yDv%lWZ+`c7mFi>%Bj zJQ>9``>~ZBA;UhyVTK%cU88KiauJA6!XCX;8ZdQ|{rC|ep6ZfF>{Wo>lqVBYQUcVX zJcJx3O78>s+7m#d@Be5Bepo55ojT9QZ;o`-9Q%YdMHyEc(H0IufGmZD5**0d8knGz z+*>Tgp4-HM#8ZQ+<0S?;L!#1_g4Oz;?Kl7 ze!PQ=PIx4s{p{t3`e*U?CzY9~@gLk5k-5tf+Wib>RsIkDLC3E+E3@BIWbcewLhjtd zQ9EFs`hY))L^$Qn_6Roa2af9q3QNsO%?gi?HdcG?jSud4b?oaJWR_J7h+(3c3-v=L z5S?I-{=PkEVF8Q=MyymBsXu$QFeh5xct+N+mhwqBp(U_qRcNs=PGL^S zB`yv}s@&6`!73LSR-vDy-I-tDT?*j1lE;Q|P#4Wj{obzw5v6Ru5@#@Zx(c6pmNh`M zrJ~#HZQn&Egn`6W@!ca%)5cZHJ_n=gUfY(GwW!2`FPPvzql=s%C8rETe7S@SWzZEk z;&R@ppknljAwX-q-vFV)CkgD`eqkYh;a%2+sDDz>@C$(k(U)~1_!ZAs7Xk&h4w&s9 z?$i#poRrK*a^!s71T49lt6kKb`v32 z=4$(~al65Ngnz)tR0JF3d)~qUXd>eLCMjI7WQqwUN&v;VVo&Wea64J_)$~pZKhCsQ z7AATA%tU^1PP7s_1YurWUEI9qKV$S*~Kk`!l4eQPJ8M^P<51Y zfT-1zo24kek-f%!UgOyUzYvFIj>O0>N;{{oVSz5*(?KQF&Z#+Fv3U&heh=F3W(|El z^wa#R_DlKGXMR2#=OiO#Qa_diK_aQ4@~8HMh;7w%n7b?lFKf;t0|)1kTTjLYJ~ehN zX`EcM`6VvHn^fq=mP2`#o#3G7a2=|1HG8pv>0mAeX6+%f5eQ@Oj ztM+@yIQWLIaaBpkdoL}8h~eUbi@JL9ZQH(4I3jxBx?-6Dv)5UE=pCLA$muhe=G=?B zFt^QSdp+ZRLkL>J$?X@@u^yFx1}5Fa2em`Z_CGromV-_BI1^QLIlch1#L{_h*s&i* ziXQL&xYF=wPoJ!!{AbX8)kM%MgYUvIBeDZnKCqSQ(Nj;rk<=%)23@2Fv1ht6(Lq1U zppeV_Mpr}3PmZk4-meeeu{^g)viue}miSWsjj>E&wOP55I^CFz0J5JQi~hnEE0J6i zO9CnQ^8(}lBFcUV$Nf`(+tEDg%#5(09F`hJ^5!v~AGVhMxT=d@wZwpi-a*4{C0RWTO}8F#-@WV&WMB5Sb70}=%0(VwpBx)c_gHzn ziSE;jnI|ayK>rA?t9S0GD6AG_Q9yk!bJqaJezM=*QW+_p=OGq)loACGy?zGqK~zc% zq=_YxDE4azxh^ZJt_l3>Iixqfhivq)?|SY&kA;)-rqsp15#HMRxqdz`CEeN&oZ`@H z7j(`!(*QJ5!3)Rg7xVz77WbPXxXkKQ&BXm8AedxteDp$-SF^r}lr^uhu>^Cik)o{tskgsUgE((>vok>>AX?NE>nxVxyGIprOnJl+VXSg0&GQeDZIpZ-zh}wA{LtS zgk;D4_VD@sJN%oI41c@c9eXl#I(9JT1fUc)*oyz>JSdkG|JW^ej#__bpwv?tGkd9Q zU~|Qut}^x#aPI6Y|X+^!vtW$>aAG8zy(1_I5{^C)La#%ZrPC#8nN zF2xA`Xs2m>!M{*r-!jQl^yp834aLJi%q_UfBHp5gVrhgA(LZ|^H$YmXS<|mJziKcnlTSO zN8bkl5#Xh2SqH;9_#lk4K@{7%p?EU3_G0ZVPrS=FGKx8oy-Cx+9uKxYWtNhlLka#t z!X1V<35_-w&H9hB4g^)eb&OY?^U6%CrHg;UTuvhNfBu|-G!E}I8b~=DJbEiy z^HDOH6|f0EnoPKR@M zR5Wgxi0`hram3oPD=^oXkGy;AQa~5S8gaF!@cIo>>3yax_3-<2H6k$=bbnmA{I?GM z8ghEB=d@ejbD#H&QC~MNJTn$KS~c3|_r}Ga^H}k8EPh2ZhY&yNWVl%l+bfrVR^ybn z`9o_1u}w?U(yKSE!2Q9LL(iA-igT&2Gkwn9h@(S`z1ge<4I?aVtj7PCz4gbGBC=Fa zb*=FU&zS5&{0>z9T2;e0cR}+-ag0sPE*xry@*mmMq{Ct)4h^$XjjnJP2UR-Au5eQe z5eQ|l`*nG_TiHfPu z?z@1v0(xlJC(jw%1o+foX5bN3y1)&KIONBoYdehQ`uy6RH_s*rt8{in2%3&Nn>v^H zx!6hbdjInD{!#dOtfZ*vY6u0t?)0^SyWM$n6FF!@^N(jpW{23xX+GBtahQvJ*)s^b z&3thb(wq!vMHswM-PAst;FT1CS3d8pX-=O9ua*cJb<32U>FEZZ%l;^pmi14 zg*Ct-l%ggUVvo~2LXI=FF0R9U7ryK=xbsqFfY|7x^qZg;S6u_pUfh@I>2!00&=EVX z!>C5Kwup1awaHcmx|ND5at(pS&xEoSZ&V!)oFTDC)xW?{C|b;-#_2Y5K^O)4IsKct zaIisuaRdE^<(Qe|Gd7Jh<g9KgDt;HCZ2q8?(Yl^iBS9XwXRi( zk2dB?>mMwe9)q?=}-RiP5C*L+YB9Vd&NZ#6!qtm0ZCH2_f+uP zfDIXfsq6N6c+5w>Wn#?UdfuUTY@&Nl_k>vq=XV$lsQa=S6L!y)*)K;(R(y;q+sc5F zPGWQ8q3dYRPA1;s@4GAnNsi)OI}9WsSh*XE?B}oZEgu{DGX5s3HMmI#k->*r zEYI?QRJOaxweENRZ1|EMto2HEH*Hv-da!H2~G2U6e9mi?lPVYY40|Es!!@vqYcQ=Ge`~d0ZCw zH=$<;YswU5lu%|@r=3trot?fx|2V_mnT^ZwB$Dtd5>y*tI`NAM;<87MuataV>4RzS zAuS=XOsjjvM*f&Lf$c&z*iCGOyqvIRaOaz0DX#&1Hco8#qu&}zyh$TVD_2dVFUaF4 zmvo&57RsspD|zb*LWtoVfBdql_2R~fjznhLYu#-pZf?&u8FhYIobffM-LJ$jrdSlgwicEs}p_nTM2!l6H}l> z?^}9zz8&#av2oX$1SHv|Hm=%9ziK796WR18Q(!4o+`pRy_7+rS%if`u0k&mM?9sV6 z!Vx>47r&+{>#)uwW?RCkcYHa$;3D@}FPG4nd^c0*0^KlmjEDGj8C=8LO#?k~W`mr~ zyKDNLP=afLnHIsY7p>SWGL!amg=@Y!b%UDgkw_G&NE%C3c{KsyyL_Du(~`N%UGi3Z3e!}X2a<<2s;F9-{#`;|jVb7Cla za%K#*wA|X;w8)xDyMKQ`!nvjWML1D|;>n92`Px#T25s&9aU>ywV9O~%Mg2$KI$P;o ziD~pzdztN0XXee|bBx#OOH{yN2c^d{95nKc-!jE%AghH95^#S~VYGb~^9X`TscSuQ zq{DP;TE+=8w(8^sVOQ@z>}@OgM9^e+`C9P{b%rGyt545Vv*Ur+9kDTGQO=beMmZM0 zS)_$_Wa2Rfwi~tVwukUUgHoU`265NVYdsC`-_}>#9!}#4w7~akE2EkY+6X*4sdNgt z|0+Ozw(KUi7Z2L8A<`EsmJOINnvLK0h}=vy)mvL@T~AI=tBTUSj_&*I49^?nUvzKf zo$NZ()N(C$e8l!q!Vkm6CGc2OY?Rmu7(eq7jj=RtYber^kDn4h(lTq%f;1+ORZYKe zWSX!jrxE!|0`Ur+BK-T>?t{REeYO<)K3xt#$~UNv9O`|?2-#6ig(YZYmz38JxNFdW z@EG?b5f{CEjm*y1!+_-LERW2wbeA&t7BzArqFFWlX(gni=d%e85;wPWY)%q zEu5J#veW)}12*^$yMV)SpG8xMEIVdE<7-o`AqRg29WSi>zNc=w-&R;mUvcu|eUO^A zF|j$ttFI%gKOED#YeQVUNKTV*I5PVTE`J@(744eLUR5YE9F^TyKpl`Slffnf0#oV^ zZLkSu3X1*g89r?`ZDFxmho;`&QqGcK^A^)~FJwqBeQvul+~>LG1*t_$9!{r#{4 zQ(*q%j+-@c^dPNOcaoy5yG^cBW9mXPQ|6%p6R8TaOm20#{@Zp~B5^o=l4bO9X3$!E z`<2(x9DgSn>e3l9|5{IC<3?#*(rO0Z2ulrp(_d7?{y$zpQjOYe8esiE8z;8EaLyM1 z`anH3Nio}DrcY>1XmF){@Dg#vPLY-yhh3Saf9@jtfmroNHoMilt6NF#O9WM|=%3F$ z6h&HI{&(s>N6aMfE1abA6Uo$pV#xy@tnBoB#eHY&^1<)3_L)p=()UB}8fB9w)Q^yG za=Yr4UlOMMa=+qeeV1b~!mi8uQJ97OU*07&=X=|~>!3cC+gjn?GoEllyAk>4nw^! zpc5W)3szKGd~BaLtf<*02J%YVU_;+(-DcO~Gh$_mxaZbARzGw(j$BU7Ral})D)c}0 zwQT-$b^YXjEZVGTOSuaoTiKxET?fM}D}(4yFw7u(&l;S`s{+VdxxBnA*nd7*awnM$ z($w^`h6Y4*pX4>6TW@a8#<`}Xp4}s4f1$R70UnKHMA+i4g=TlD=HiPsQL&9zijLsy z?u3MXs&HC}TuG}ZDDnB&>VynUHf4+;wTv_ETaQ%}5#Ya39tmS!PH#F?!lu-@HkJcP zpwm8Zk8jT%RncJo3W{+VLBfqqzY+09-hAn&z90F7@t)f!a*;m+5usGAmh33G@V~-D zED!PMNu)?n^t+EhZz-Q8|4245b@cto=(qTY@=A#u1et6y)R@KajW%L100sn^Ei4vB zO+x<-a}zEuXc}j&vUJ9^uqr02KUu@s@p#n+JE8s?3-#o%yMuHP?|Q;AoX_}+^MC3+ zznQZ6{QIpCB}Ye_-WmyAd&2T_=fdy#kTf}R;No(yKzs^+?v+FQ4zj{cR!d~wrZE$N z(=J~JdR*;#j}&U>jFr7IcurXU$@m>?EjlDBLF1{WCT20Ym**vFhu@x(>r3&gjfN%j zuc%3lAN3ZjX(>8?9qIRKa46ty#mQH9gYU)C`P^--XQP$v7U^=xmn8>!$M*4cTw{-1 zj~B1@ha=)?e27k4anFYCmDo)r>ukGCKa)(E&k(V8Deb2D^2TkOPRRABCx2=0B=!Zz z_GF-pv13gQw<+MtpQwfG5mVOYKr-F-CJ?C?_Dh|FDr*9m>&09cO>M&qI+MpLJY!E; zG9vKnU82wA`KTKOECxTBWRYp~7fZeU700K==#0{EdaU0sDM$inlwluLM)BhrFHK+L zUoUi*Wl$%LBGoOUw^R#fu&@0YA+!UYcfA(!JGhIe7TUIWP$`Lx zpCP@uxRQhL$c#~&?3LIUOaLl_Ou?;FK^RiG{+5?y%N04$lJDerkez?&uP zpzl8rHCkyt`2c6Kt>3zuN0D;{xew0)OP+T1s=Y)-&)I-f66I1BTO-P+pB}8)QAV=% z)*a-&vU#Yx1H#KvbZQ8j&}#);h_JH3rxZrW*Ev7IG9zD5S z13TY%jMq%oQ#WqOej99xvYr$+)|?ZX04t{gc#BGo(*C}mG;k+MhC9)XPOr+-L`+s) zN-FYTG*m1Az2NpQ1f#8=NajjQB!WEzgh$M_Y~J#ke4ZU&Y1Wte3IJ2@;rH;_HK{|T zLTUwbwNoKBYvm?GR~3!g4V=KYfH;!-fZz!X=TNbHEXskUzH?b`COQWM@2-ViLxh3N zuAMYmjo3)!pNNdT1_N@DhfOARhKZ!yi%c&0JFPn_uR>nfJu`a-pVn~1dtn(Oq(KMr%qIQOT z*ZcE(64?DG{YQmAVqCs~QB+{4W3YK9WI2Q%OZ$3MdCTTsKGrhkBgN zJ!f*YOd`PDJ$e7|{vegr9NqByeZLtYlqVtZV;ZQ0<$#Yg<1&u@jgi=0f;Ck!JC!yY zkM)nMtL}BKl|nV9T^uufwtPXR32YFPR-p}yi>t)e8D{|m3smxdisJ-nX-;!tsfu`q z>osT_^O-NZnes`VYG;nrJ^7`vzWi$s%`Dk3=O%LpdVxLFBa5+B>aj3r2IzjIZTX|O2>(s z%=sNZr=W)S)g3Nx9`%*muG&AjbgOk)#EG2AK!Z*05qgGgwfS_b|2|pN$m8NI@ItEd znq`}`*3psTd%tdD>{1su&b8?IX6enOmYzPr@Gye_mxZMJ`vgql+89I+^dVq0apW_O zHLiKfflB+DB@6*|i!V{6%!H|jH7}R>#kUzU~>C8zee)t`*EKWsCR=sr@4oGp&T1>ZLwI0EF zkMbj{XNRDca{Fr7?_w&THmI>(s2fuK>JRiq*#F8-6Y-3&#cTXOXZW%GlJ>EIo8_y-M7yu*sc&4c7~=U08l<|O5#qew z=zB1wY|PV@$f_Suk|4F!i@{5Q;E#Zh&#k()SiWZ0lQO7gwu5{VyN}~!QzRs%cu`Pxq+;$^_D7o+Z;v@z1H5^-OWSX z>^h&ERzTDJ{QQ9IziZ?UF1>Q9^RMJs=7Tw*#y7)e7PUe-!yKxQ!(C{+?h+?jjZEi_ zJM3>r=wY5Mvu&QoT$BUlvll@}Q11%54yTZtG%IdFU56u)Bca26S+_%4ZQ5nNZoJ>@ zYn_`Vmix5+q@wTBZjS2pxhFJtx>={3a z?AG4U+>_t@LW+>0#n%?H&O{JfegqLF`7r4(-+{X@cN@0@Kg-CW1$t)qbFlRj8$_}K z-Jm5V@O(qOpZPm1b&davLssA!B1;4avttgAY+iJq-o0X?i28B;LL-zSN^2xaO92EE$Zgo@PuSU;eQT`>xU+1v8j72k4(s;H@ z*65Atakb+M$;HgW!)TJvjWTVEFB;(=v}g`~_pFD?1sg^uI_Z zk%2hwE#cfJqVyU6&?tjRy~9{i;VvqCvk1|5ZffCi1wsv8k~ORKQD@}PQ!zIdX2FFw z>!wBp(3K*wqX;>*6?GdrnfFT52lY4ZrZ>Cn$4x-W9LV};kh;tmJAp11LuJMGYbMIEem>(=ZOo!dJ8Zi^j%9|6ebf*m|jR5bznr!KP0rBz5cd7M#+!!YP*#sw_*< zb)*k|Jw#ZQaPdVy{oFq%m+zI>inF}(Iq`-(R)NNZi@s%h{Ve3 zOz9;#sH_WEEe_;@qv*q$@XAfyNT3%#WiG>HPPabVS80BK#In z+{+*l2?=oyyXA)jAH!*$;w6R6JnhFL8+g(?CmoUQ_Xiz9O$OQ-9i7+w#3Y;c6r{fB z*}jz65UE!THtF9`E9I6${b_X3kjuUsxKll7>$jF%U?28SGj&Zl_1&W+qoe%G#X0wi zz>RvFOuNFETOfh8c6QTHgB(O?KK5YxkIN*of8otYKMCmXZ3z7!WT*eK^YPIG)hpaw zMM-+rR+*$#f70DdpCr%j7)Nn~DkxdceNUka(6^0UOQOKF&^z56w7D*tG*jU8thheI z-D!-SSK#3#kjKdU=t)w{S2Zmlx}%P|U&8_H)N1#}GL$0K&CE`(yLbnqlExnjuqDZL z3vM4Xq}4=xba|hBGdk-;_mJ?y5`973mM83wN$A(hY5pdcDb}Bqj(r@-gDi8!SemGW zb!k~r-JXKtARs$;SS=59Pcq#{ovuCst~})>g_vW$M!GC6y$^|cs>rOnDglLwY+7CY z&W}FsQ-!76#>N@W))x@UFQ_1t^wbLn> z>n-D$Q=s!lHDPWfGke8{`(3hzjDu{;C&Op>}u zzf}Gt4j>4W4qtx2C1y`bN%ziaDIN^pzXZJ)I`&5BUvp5QFza289;szAfMKgIH2ECL z-fD?Bn2#5m4S^6B{b6N`ivK{Ay~4!pPE*D`Hb1Hwrf)mf1rtdwJUg4OqiePFUJ|(v z(d<rj6NWvT?88qwX zv1jg<=S4|vRtm#qJx|8c;!SINqTJTQAJsrjc`iN3`m z%dhXTnB_~P7A~o5I-`a}EmVH#fv;s880X{Et~t#T4!Lqc^tYYL;U#rHTvuZHDKI__ zAHyj%B=g*ih{h8DyW!C|W4l;^=52ADyD4?}_N)N9G7cn5csL;Jvk00gny?#7urvR4 z66GMdAST)I7h5!!q}I#I-!1>hd|XFiNMV#KqG9I*_kFDo{-|hCvXI|j2lxN`u;_}e z&ORjwTx^^gF!h%TgJw4=MHA~1 ztIUw=2gy71yQq)EV|fG=Lpib1YN?Q4R8r^#=c(n_Map%YcVsO7`jm?3;wmS-hQb0r z#QWo59Vqw>2;0&-Wd30c3wvfkrSWya^*Q5cPm}8oOS*>M+IXoq$+-}aJg;PbDbC+( z-%YH0*@&+(6h5Bp5Oj9pz6im4IiHO?bNfuwj zI1X^ud@l{tyrS^R>Sz-<*NcO1$W@U5-!9_4efMW-+5FLi&MMNC_C+t#>Ny$Is50P+ zQIWtg0DfrL*nbZypnU%gfab_#F`Qf))M9%WpQ5gfWl+G(96jGNxzYh>oJ3dxCoRIF zN_q3>Hpa3n)vSXR(y(8mj~T{lC9ro$@0u^}B}}Y?o1&G!j*$tZ|Doy9xFnfC1eA}L zCO!K1y`WNA3>?rcSe&=*ff%hw`a73u;_T$fVu4W*~6APB1cRW8ujL&suRra zyFTk}H&L2=-#H zbdxY7yk%uV!ggsTVV1(1qX2?=i)$IjJ%4HhPn>rxF#R?OPX~I=4=2nGIRUx)4`qAA z-n&5N^OY|ml@&CL5n%lI+LIj9W=O;tN-Abmo{INbAC;O$d@JaD4xnPRJ{vDn4vA!MJj^=lqT3}y zO53Z8CS7jxqp8CGpZw@b9rZhh($}8`=Bh2+gGUjeoc0^DxhD`oP9jc~ddyH=OK_=x zB}waB_!ym-J2DPT+i1d#$sQ~(4x0ndY@3=mr(Or61Pe(a_8G+Ur_Kun>lM~?J-^6M z7QvVJIg`)&k@7?h*XHg@lCb4sDl$Wh( za;69_==drE$`z(c z?!Np%RKS1xz%^n{M#Fp@_4^SDIl~M903k-z@5ch`nn^%-z|KeGmJ@f4IgRXoA58v*EyR#2eU4`V+D*n%=4SxBkLOj8U24fo(qp@Ko=!n z%V!8;_gC)+jns?4l*^FKG3{SaoNqTe@Mc~zp+7;d*12HL38wfIMS+XWIO`)%7j}c8@WA=HGAIGx5V8 z8g9(;y-mAb0>MJ2EcE*%qTxo9sC8j&pVIZ-6)vgHpLK9V3{wVnrEeYlTb;%BK#-Uw z468U*Y0|RbgFj_r_9(%66+h&dB@O%G(Gt`DJo;gBcFlo!ws)M4p)kmyJpi+uuW|f7 z3~uPITM~C3c!;;qurOR|1ZYgGA_!m?HX25LRwV15ez~kh8`Le z>6Q|Z5*fN}<#9O)XmyPKJLH~;Ipp7(z5-}AiB{fSR{o^$TKk63FR zYyZOleo5pj3>JK^Gal-Oe4$MEhuW>ax8^NBYPq8E`8~^vBg%q8eKBpp+$Nm3+0>7a zyJ(5Mf%~E!3;O~AtsRPeK9LLpI3$vhO=Z~2H9=wS8$VWwCb8YIB=pa8hQ;)8Ma&ZR zZ^k2kalVw^%(q&QrHmya1V_%35vEmmM%kAns0lbL|KUi;#>%dip61|6X!gqPlJhkb zI!Up!47`b~N&l6c>#}i$r6PeXv0+RIZ(!`%QC2N#e z(Sc;b13H<}j@ao^b5SPa&@8GKY!4%}L_%?}yJ>>O{TYfBf2$O@jVBD;I~A?G69GFCh9xn;PSOzCXb`wyI>q{I{hoMDZNt_+It z%^?6OZJMJ;k-2Je!m%ICnw>VsZ&K>A&M5SS0hl1WCYW+kUQY;!S3=1xJf; zt0I$-$8}nxjNS3yjWtIaSXio2W37^k%|<%?^J80>0vV*4%K!#JdQ3%FPH-r!g~BnR zgm*K;604hc=Z~X%R&)|c78*JUFR|^1qM)+(qY_BB*_8fyPs#*V%Y4qZ4+3qH!3;=B zxYm9@=^+vqyeLV3cIku5oP1%4ibMjxv5-UD$yHRm)SGDls4{2VbiQnSy;~dZ3o6@B zZ}7lPNY0mOG@qLLW{DSM2^<3t>HP)Ex+PjmZY4(dQ;(# zI9SDFlvs3n4I%Xe{pNqaPN0p?@3fN2-rKi83U_kqC&z_fUi<__$4X6brPKgEV3 zqA_t~$ZLA;q;aM5mmcoj>qN%X`0panrglC1XwGkh24b>StW$uNvfkObu0!PL`NAXZ zPEV$GGgUKWH9zl(@SFwEKJl|K5%kyO@tkPN55kA}Fk~jWVX-84X&^n?Mfg_iY+SH| z*NpEgx8ZR%Kb0nfJXQHH90-a(a?lG7l5iGME__0KiGiF^))>`?)Se3;LYtxHvHL9rdJ~eXl^lZS#O&cCb(vb8^-VE{sZ+xCa^U87;c}R5||MIzr*)^wl?^ z4xi%PHI!(0pQk+x^RfDTz&Z3uGT#Sc;RS5Og#t?Uv6gzm^Hht#DX7R;n7hXHi<3?H z8pQQbw2@e|-8Z4*O?UXif5jP}HzWDraCkV-I<(b$;vUJ;VDrtpEMIdg3hSB2H>j>- zBO^$&*RfID`UIL7MVJGyM!Z*3|7`(jvAG`X&@TEDioAV`NkC}3rBcE$d-{--$~Fhw zeAY@oJDYW$LYX3XL3?i$>({2CyW~Vj;Vz{VCOuTy(jTG-f_ z=DrQ6>rwefU8yYPaqj^R^-uzGJmOtFeGgKR`6-E5Th4+_G1-OHzx?^3W4W@ zb2T2Bym2@T^Y>GXqu*J6wv*o4Nvk_n0l+3sKV!XmzRg)WL%v<;B=P5JU8n81@}o)& zQ+?=67YJIeZ(8K&>~RbAs=|N$J`oDxu7wL$qZR|IORQ;)hs8H2PLvZ!Ui7`vK_{m~ zaj6hg$@UIadn9YHn6%$q(m3a)mKb zddi0XghYm{)m`WITn=z&MUD$yZG{#SK-*aVie2qtzAKBJC)C!}u7?Z5U(a5xKqy0Q zmimWIV99R5{@r4cNe;q?aa<&|*3Xv12}Slak)0ue%U%lFw0( zGY2P5pmz>duY`i!OgGh3M4kl{jQ;|s4YWuz0jp(xN>ZQ(;h%IP^Ef%z);Z%n{Q*O} zcrWmy4L!Fc)4VT2WTIA9pn!$?`Y!I8YyCKHFo-$c{bCF5nfXvR($*(MT#)VVXfcGd z+t?Xca?u?0Nd9`^S}5BHPj2G|&*T>wvd_~FpDE5);u6PI?u5e2LYbB5ATEUu@!OM- z{G_1ms&RO+T>PGIeiX1|2O@k?&vi%W*VwvoA!^2$JrO>JFmXBw63>}mn2ub6m3!BR zExq9Xde}N>7J9dCF5Y2YV($OSwZv3K$Qhx7_kojymxLRcw1zU(2FSm6-sB;DY7X{0 zB6-?ib&TN(?^!nyNLg!=2YaD{K*9p6<2fHdzV?MDyZE8_jJ`|zveVp6 z9PR~ddUeifj=Re7O8%?jgUE2A+Qoih%Zb4(e`D|)${MCo?i!UZa=|N-EGoGpyt^<_5)TqKJ!8_|3M_2w*h~B;7s8% zvN4A7ZuCq*?{`_0pR-aA`0vs!@G$ii!tLz}nP6gG7*Qd|mEpUjEuGIbf~m!3@Hvx| zhq4g|@=g##qGI@0qyzJ`&n8EKomg7N6AQ%*p4F80gT^Mbu`%Q=zF?lwA08}Q!=>ty z7$+k>8eD|BI(zKX)IWc|VNrLm|EMB_v##XLZ-4ezF})qAhKFf{_gm(AVwP33ubJCF zmJF7to-Z}1e-7O@?EiY`sNXUKQnVtfk5mOQ+!IhhG|g+PDua)BNblA#-gPmvaZZfj zi9wL-psD`z0q1Q(-QT;_F)^~_tTw-~KKliiV)j5c|LO&a?d@uzr!6)}Y`lJSu!*~d zJeGF_ZNr5&9#2~37+7Y6L9)XjlflP(lh#G5Pe4b7#sE&rd&==!;mS98pTh64wo)oBJ^`3`lN0+`PG1V z@`u-YA3k_de~P;}hOVaw9$n?b(?wloqO@kJ|E$jQHKNaNpjcsZf>oCDn&n5M$sF92 z@7oAjZ|=4M!BIG?lF-Y9lXqy5%@JLbjG zC(B&ES?FbA9$5Ro>i_?14~o$NtPVm}B-(e|PsQxV-WA_ttX*2+mlma4^*EpO1q3h> zxVkC$61{CtJ6~1*M+-pQ4}X!kajq=#u+Z%^*!_LvCH9Fj$to09Z2h|zz~$I39_YTJ zbn`d3FpRbNa4oDDx17V?@rb*#G(wy8TlVf&2^+rYLOjE4-y?EFPArK7fp`0Y{P4p( z1)*x`Y|(fp_OeDl4~KdEYG&K|lzq^8wYJA(M;)_bxstJ#~#xu{EOiwobOOL>E{YCcj;7=ho%hE3~P~YH*znIT<%&qf$N5h~4;;KIq8R zDC>$k(DoM$8H{;7$e3}OUZy0(pn0=XC!2NfS|v4nQ1z%? z#Y$^Y4o0_?Hsg4tlVQJI5kJ5InSK2y5huALq?%MuT-R;%`R+Tn&3A_y>{RC#3tiRQ zHzo7Nm1`V6xcl?AGUD!(W~)!U3Wv6$*E7{H;sM3R+pH$N{E|8q>4`ZVeRnILWnk=V zu|-RM0pKyx$pX_=Ua(nxjpy%_sOh~}JDv@{#N1du5Tsh$&5>s@Pfi}=TEO1)n|NCz z66&!a^A^KGw%?r~@#}uK|7&gSXvuG*n=&j`c6jk*;wfj%6mJ*(r5GgzAp2K1HMV~_ z|D;_%7Qbbsbh{eeFqgi%dxzuL%x?xWf{?FTgWj@vi4?gQH+5>kBYU>CUEGS8nIgm4Mb4A@G3tjdi^q>yJ{`?Ew{XMd;Pb!#lkrcs2Z@TVKQ z8-9%8BgUWugrYaLp{QYJ;jp{4j4-7nCmPYCIjZ!$3*s?woA<;`CbUiY0P9gq-A*pP z!aKgNVB_tbzwNg`&FOorZa0<)F49MT7RK912w4Z{Darj9MBPV1=k{ZKD};gT`|@}1 zQ!~U`oJ3C#o*hLX#EL|$I}W92Vus#||44B`ayy+oi4hH($lJU4EtXWa)*;l=p^xKj zBx3yrza?5XOp6SnB-G{!xYXfSKoei;7XYHG45N|gbMdud**3zov9>O@p)J8f%bvo@ zgLjw&`W>>$!UKcnO4FrZDFHFm4C0g=I z+9!*2n&|KWv}DOQcz&>8i=Mf*drkyn<)4?dx?P2CnE$c5OUN~n1vZu@Lau7;?(NB# zYWE{$vAg=~$dr7FfIFe(zrA40ObBb~CYYW;e)4Kjb=Wj@~9zMCsXsHfY%FCR~O zl>rGS&)A3)P^RCnVr7bYe3=-e*&2rDHa-4QD9!|jktB5$8xv;7P;;y06GbvF(Nm_V z;8phu6N%5>XA;Pd<%wP$Bg4rrOcv-J+h&~Bd^0Q&)0Gyt331~pA{xb^sP;D}$j>bE zx4WwFS_w!l+S01QHA^*#Vfp1&J#9cOMrhl@|Znp7pqg=mr(Qh?I2jK65 zs$FlqMCb6;JPl;BcN|jwIuyN}zp(;_Jrf~^1e3;7HqW*j(fz_lTRlaC83+-*^XZZx zy4Rtc0#)mUM45d{j$Gd%Gv~tA)@6i{O!^cTCL4gU^^&c(Dnm0?jeG)poW`b)23FJ5 zU6~}fpms(>C=Xi@O0*IfGZ&FHW$WoUT6KX=#Uzj)@tjq6s7N8jIMD{vTUzFbU{c=m zHuW{2R?h-MAu8QU#Y`~qnQ^?{uODhRXvxB4bk=le>@s_1-+$pSWPMivq(cBV2wJV- z-U7xs{QgtWy_FDusbNaGew>Fi5~!fMP4apP2~boq&_o@xc4d*981*lHAx0K>|xz;@hMGrN+Fwn2gwU5jRDCxbgtjvgzo^lWDO;_*u`&j6EJ!v@K z@hsR?4;OqT#7j+o^+4h4fbuSe?{Ysus&jAwzrPG=A-<5JM3FFF*pBOxUIpTpR`aGMR)d`87cr&3cZuX%AIL_RQZ>sRA#LO)aO;$IM-c2Lwj zOAn!T6&U$CxSLDx{^uqj0{DKwrtm>rf9p%)o-pd zB^p$Js7Zu<@Ff#`>wVw$8g$*h-2JU_e1+o<+X6cYflaQ#&?WsTKy+vj*VjcK6Sl%G zHgFY%)n1|f3$kaQc_pM}s^~&Z7#zx8yw=LQ~Bu<61hfO`e>TSP|L$9BLOBVNj zV{`LaL{`i_yhRroLdF>R@j(98zRzBC_LEZKHO?C0V~9!(GDsPh!5c<)fhA)vH?I^e%{HPG%Q!U;q zHQotWD?&?&SXbP&^b^+V_qj;iI zf685VX0na22qOZ-Xz#e$%*|a8+*`S09({55=5gOpA}{1d%0y5{<-R;VR@D})B5Mh~ zf8cJ8XZ>=gz+LqWNK9hP%RpseH8&TvW~&GODJBzq_@ zvN>!}^7kLyWZW%*(VB!NyZDMoid?s@I_9s=2hmpLr~QU*qSK8hs#;t7anN)Q{+V3W2c4@$jVR9P(>l4e zKG&Ia4C;(b%jL4jRxT)fCYfZiFYL-;o4NcX4>|}HJNHMQE-G6E71=5T6<^>C1Rpeu z+Tz?EJuE_J1wNNTUHV);-=sIDAUW6`#*?c%xVPZlxL;MJOKvpnL^gVw*Gbps;FTAB zJql*Ek+$i;nY3fUh)Zth7?3aWMv1U{8@jP#OQ)Bv^R{G&^zf?MG(5MLYhpyEM5jL6 z?PpQE!3Bv~TX59PZFqrv)~+sox!qk0LnF|UpXjvOsYMIcI_ zRLm#7r1K1if<~)tR*uQ|bK6xTYQto{{3Yq`NyKExWfgilO#K=~UL@L|R0AVZ=Dpk6 zAO}dS^Zr|M^tbVxTmd)YjS0C*TksPR9HL-q&SJP*IoTD_DsyU zDMC75Fb1~g+e&|h#6=CpH@1+_@ofkn9eRE#<|B!fdQ8f>ry^m=T^5|)W9NC(5CW57 z(NoEZ>Lem!8>DPie0WP++aG^kZNCjK=m}|&sFS^LcDk0*BYVeLEakyF@zc!=xgJw< zY`gTFlnW~f%qLmx@k&LxAmO%2rgP|dJmYBCZWIZUDSOkyel+Q0D#GcwdvQ8`^BH=W zKDAho;sib4adW?Xy^Mxfh0os9vJ2nd?_e>zzrby}9C^t-!_ zQ_WgiK{tP-6}?e{!^d#%+zXe^&9RWqN|a<&_HJl!?rZt_DTw9r)ye5lEf>1)gvK8x zjVs6I+u8T6=W7X*z->XR$*v>6nv(rfyV?_roCgo_p42!xWZoXV_;7Qjy8>|$-ztGHB7$gE0FCKS*~}?QV5xS;p1C%90qY!G zD>eu&dkmSSkjagRgJK>zyJ(qO*fHIHD#=N?DUjQSOXua!Se-X%MP@YpYGmR=;Ix}r zhm;)7qv$T7Q%#!pbJ@>K3LTnlLfr%#2{E)Ce+LG1d4if7>yxO{LC7J9IT+XT0Rx7fn9|>Fm4-xXv!1Iy!o)6!tl4HJ1Wu+^s=j5G% z@=j|Q*6_cflCDx+5Ri)99>HK2T@G(by&mL0BjZ%uvYqMWSu4ledm2Ti^xcW=9`Agy zlvR=Kt~7J4$J#LnN|!!$m6FdnQXGjC&vqD{zg?Hi{WKdK0Mp=Na$El%hCv;XT?`nw z4#}m#U**Sh!elm+VPV8gtm_d6%%-pEP9~h4n|H2kiBRPKGa-tW4W;*`*nH3DjT6&w_gi zuv+=|7Br6%&KG7e*}lFThMim$--+a@X$*Dnf~jHD-uvy1R^PXL>zB3k%Ie=Rl@VjssXD_6T1hF}XpJW%d2kT$>Vr%9Baf-QO8er0iGi22eXWm*epVI;@;1UZ zG}8Zt*?#s(H~aror$*E0RhN#6<)k!tdL*-3zW5jX>JC9=vG{Z~L8Q0H*IYr*n|WZ4 z8iq*-p)S9vOzwjon%>^N!ckRgJ52k<2?S;Ske=jzcy$$F=iNg;6mzO^*L)ljN+kUsGOPvj^Us*Pm(Sz7GVy|L zl9aiI=5}~7B1{UTNPhGxL<_M@DFQTo#m*WF2IQ1_^a8gfC{^t;oT}Z1c|8m??m=Su ztD{pfhkE4`9Y*PF^wlrdCNG0}0J_xf+_Rq3sMB*%yIo8Fm(f&K^MbY?Kr@P@Nq-{0 zL-l8lXDz2aJZF$s+buj+3mtzyX)nmK+sXwCtOIqV+y`pY^Ti&nq0d zp&&zCcnW`L1LlQ*-g*;wuffd4wRD`Z*kp>yUFe69C~B{ezB}>I3y(4F@AD_bK2b_p z;~eUo%(CGH{(;*Djo}4E94e!Egd$Zvn^+4g7XkRs41II@MZW!puf&$3h9po}So|l- z!6x>nj4$iAD{7rYZ%KKgAVsSGqMrGa%HZ!jhMhM^uSKx=O#jYE#Wm-PFYY?rC~IU9 z7Jl-u&?Do1=pD&w9eG}wLVxde#JN`>5nUOxXU8`EGwR3jh_ZU_-iIdXr_-L73mV|xuCX&>WD^nf@G`o8dOnYs`GSu=*Jfe*s09b z1|QojXQF>haOszaOc7aT=OeXl-1I}&kbYKSWR`<91t-_})JD6H+WE%g zN34e@q?-_EsD2Z8+mwzY-7CDPwT$cgwaffz)!XfjW@fg}_SJs^7Atqt4MDcz@fj5H zShS^AvGJj1SVFaq1XoLleM>8NqX3!RSIGWkYg2Vcw0L8K%9#M@S;ar2;?&-b^EdB->Ooax^&jnmsNL0++d%>pMKMo_$^Kb+&Hd zG?%G9!NXR>?1ywuNg{mGX%C99?^lC*w&ry3%~4bxY45MpLxBwe_9ptJo%VB7rwr+e z;?RJ^x`xp=+Njqqss%Jc6|N``NsN9q$}g=ilZdn2uE?-F)XPiDWDHxx23B)SH07no z0DEZU$j2PyA^YX~P=AVKPM^s1!-v;MN!#e*glKAQCggT~fu=1--7}6;l;c=svf4jl zM~GYU_0&-!ca;$>kdtN&0fos=6tM*#>b}XmVt$k&RmKJ{=BBv<E7U8Es#gTk z*%7Z_s2ojy)g>&V=81c#y8ap^U3F&hvv=l$I zhHf~V)5M93&u3emGxyiqN`AW^CT+d4lr` zpyC<*t$Lx1fGR|YUKGn{+S2btG0P2tYys)z2F)MV217`4yblW6eNd%SSW~xi`M|(= zb9*aFuwbhEJYKscQ81!4wR*yImDXxGER;RIE;v7t;$G)+EZZLj_%GI_?(@SWPcy^( zBq76KY7Ob|LYXnce#vY;X5^+>n)hkOH66@&(fkuo;s&E3~N@e@1z}$0uli$p> zo3?Zw;GXOCfNoQ6c$h&rwIK!n{SRE@9LydbmR&ZklY#P!&I0y+X{x6Qeje5Vw5g(gLbvJKMOjY7LY4mu}+Q_hT-em6Lohq4wR0>gdAO2Se6i z`0)qDuLAC$MC7iQ3bB3KT(KXCKDRHhzY`%R;bE|RE7oQ*BEo+qh;TIhl7B&CN>_#$ z)8($Cfz%VG8eu~t*4AMnk3#QF==WED{2+w6Iq)EKQYF;JSh0cV2?MAB|QEU}bA2?@z$&-<=sT zk`N`8qoJg40m~SmId*iv4KmLnYkwAG7Oj%kshE*S>)7_27gHbO?<;W4{&)_384ne;vn*h}v~k$)_(xTu$^tXPt&xk=PykWHaW8OmZ6{@!JZ z{Mn$P3Kl&aTEw1jPlX?AdYmke(Jo>)8WCl1-fZ&2^nOKHzIuzBuC@A1CbysFU#7#-$X-pga5WM=qL>0XF*qANan zyd$;!5ml(Fwl+jD&HbTbn*GB^kvdxP(bi+EoY}D#cP`mzSfhfCC)al^s$|{e3CEw} zW_@w1c`=^)9hwc$7;WC1m3&MnEcTb?`E0ux8a@ zZX-HG9{GK`j7um8HS}Vf#Io-c;WN6^2uCygTe+d~_adIs@p5DUWGEp3*4E8p-i9`1 zxW4_aAr;-UDAOB-<8bF(hYGKy{WSh3xvssre<-y^_s|Amq38S-k)$*w)1O}CsWpO7=a^vYiFzx%42nv zdN#ymtBII3@}jPwD@Rj@DMRVMT<@sC_1BN^^tE5;x`aM*3B8fZMdGEiZ|`_Fz9XiD zGL`KZe{5s%@ky8uiEX(GyA~0XG#C8GYy;yRWo+=c}NvBC&6KxbnTTr$Pkm_Rh)NI8+YX&x&O>4AeXg^njb+R*CBc=)Nl@z~sWCJu zWM{>?9s|TYUMVAcVY_-n4LKIK1Ar^{;qm4u_rmQKQJ6TgH^H61j$z>)hC%w7WcC+c3i{9TAz^g1){;$p)EO=>)rP^?7Sd1li>LEy=*uEiBRiKayvH`yqg91hzGLh(|6wQ#zWleS;@XJu6@L=f+B6#Yi2CjP z9AmMBc;tA1g5N3E2m0|xd$A=#7;ZB5T)!)?dfOwv6ux$}$s_i{Z}G%i8D7mv$O+Hk zuY6$Sp6*$*8_#lRS2fKSg_bvycfhT*vuTvX-%gDXv&7elhu(3}<|6DP8-Pg)xZzDC z_~kl}UldW+N#WCI9Aypi?TZNuN%l@*AInIL^YBD5v3@4&Ng}Hak$v3Zu$PW$4yI-a zRA9;9DV5ice+G}-h86sv|01l}*n7F7NejPcq^{Y~REO)-+p#&to}G+GuISIAK9|Z+oAIKlTc(|963SvI zwXCxZ9C{ZC{$Y4EoyS|g!>02&tW7M9y8Uu$dp{9=N6z{LRwc2C!n;qGK`|pf59SpP zJ4AjTusu+wA`v=8jXoWw9q?}@O2?ZO^*_cbN?^|EGr@4gFw1H1c8GbS&At@hRCWC0 zbNM$t<1|~;bs{m~tz%O1H^^(0Xdutrd4hP!$ z1KEe0xcJ9+FEp75>7JLZ_GV0w_d1sYlOxxYh!L4+FGl5ahadX(z3Fxd?(;f$RR-cn zk<-o`E7ZkCO56EcPNqD+O7Z(f-rLSca2Mo687d=$n(GtL}&c!>>+>~Y5`98GZH}`er>A|wJ zxv43iMRI`K`BU({>~`tP_EbOA(Abo-SAO`p%*LLD}$LT zL`B39!`)G+?lv17Ev{B|pr~^-^TD6aYt8s*u}-V_sY!U!8%b8_5P$ClLEw=C3Hy*r z-556k+seai-W&W*fbROu9wa|PL!MDB_31GS06gNJ?Z8G*5Yc>6PZ9`l7K z*LQKyP)-I`iH8dAz6M<3CkE{!k+_eod%sEZrS)H**u zKY5P<(D_CM@%L!gOSx@^kp_&zqT2sn+0d{B*F+>K`LmPBM?UrFIFA6#$bc!1pjAs0 zMSu`t-5rZ(cifI*x%L93j3q7Klrhv()!Rx-1dppc{*d4Ff!}~Jv`qw3_W@%@Rnr`= z1GvT?Ht%3xR@FLo%?`o1Rf|)j60Vyr#)m;L_PTgI#s$^$G0z~!MTB_g4GU)dljWnE zQuWUMTz>KRlJOx-D;aqW6)MvL5;I3}qIxM}kxah+4zfsB8bb(B})!64cpQ

%tSeJIYXFRhfLxiX8OGTnjHa44nNW#6~>`+>KsI`Bu-DNuomn z#the=V!~+b7ipo1RN$PvAH&SceaXo$stLc=b0)%`IwQ#-Gh>a@P4&?%VXSLn%Awv0 zh8-+{g4P{+<|i$i>*$JzQi(*Vgpr704-A=9S;NsLCXd`Ch~Xogst9WFDLHyEaAO=*F%j8c+E9DDGA1 zELtrpZ1&$frDOXp-3|^8%>E!hMd&Js)m~kJXlmJg58pdcrTu;9kA9GOevMW>q_NM~ zLB&YD-kimU1$KU!=V6X!IID?7sFpNp5XEbG;%W8DwQ_FDo*({18;`wn98q`z%HG9- zd-6#1P4^+I812Xie6w~ETVZcUtb5yO2xwWqafk@?K^ zc5tx2%t%lBj2#?Rv^$^;nJxwnU{4p!PqGw%awW~Y`@M9>7fOuOMJF4EWog9y;HHvL z*Sh;-QixX|1JgqQshgscfp%c4da>W>xMkD8|Ept;BY@uoYCsjT@Zmtv@u_jw=+#-} zs{~%xU~PqFy_KeyIi*HTo969=_#7eRXp|IPGGqoVyj`=Y6epYA*O)@*y`t;Dq@1$C zdJl@fnxc-ktOX@MZVT(Svo|b0^{bvo9qxr;uErXl3K{}fq|9wwpEITE<8pOL>7&Ro zY|J>1zi&ke{Qbes#5gnf9F}987=q|SC9!z{S>#fw?!B(`Upr9+Grl;qugMXOv6Yh^ z)LfBMUq^sX4aG8nYgHkH6M`h>9GM43Ngcp=*C$twmAL20}rxkojRJs-b6;%e8 z$rn2L>TExQ+e0rYt3=&WJg)Sg9+P!+tdNC0HtYrpuMY%sW6^d zI^qRvtJsj{GoOxw*#bT7WcV#a5GYa{-Vqx(_c^P%e@H0@nhPviNLwG*n3$yY)tH*> zWU*^+)SBICe@I&hnfu{#{$_7C^Jfuz>Cc_eUpd!2|1;Z@ zt(%nP7`z-6Bi7b>SX*T~rO4G$SzL|Z2C-PT9BifV<%9oKd$k*oSID!k_^ozo4T44>t~xWYs76`CCQg{>{5@XZTIT ze*4JYj{7VlJ8ox7H~Kq|aONw80|!;Ois2qZp!b7__B?*GQi_GJ#}9cVul%Y*WEY1= zrdxf`d#%KeVWg>*qI`ln=2@qhw|v0A{tPFyX>Z412X*)wd1L9gp~E;p6I>J9%ZWpz zeNSw##>@Av8FSMs_v*O2yELk8&#mTFf@=y}5g{>*Ek+!WmO*~uX_+&hiV z=Ss$7Ckrxxn4N^-zj42;r;?O;VDEP#Q$+1=XU+Q+N6TPaR}eA_i~JgQy4XJU>`>Tq zV}K74P69RDDN@c!O1zHjk2M!8WVuMX&z4csE#paKi$wsXGB-73tm=QCDA7Oz%I z?A6r%w)I`BLX4*0nRYrm^%@6h)V~og7CG(C=UcW#Cz4Xx9ft7(Z=Jai`%_D+$ues_jFm#DuLER?Vh+!cTEU4~`t2y1C^Bu5^ct0e>U{kS1!ooLZi5- zxJ{%JpNozB+gz(KWqzmfxMR5<4yUdXjD3}RZD#$#LpunJyi6{3h%17r>3oaok(PaV zAya+3mX|L@4Er3}#mW%ArVRYg{~{z2_LVSSb;-t}NQ==caJmbqk_EL81WA*wPt}4@nOn_IaJJaT2npTlz1Ez{rI=~xX@IMNS@ov|j1rMOvRC7RqKkK1eD9b9Qkf9YKx8taa06NyUu6ya-jCv| z;tJH4vgC<{5cuAdotYB{8#(i3%;S+UIlI|A_KpY?acKk(!Ce{`4Pw5)OZs0Djr@g= zV9)g;A=-wn5K+u(6-|t3#55f8#%rDOcfhN~KcP!u-}nn~S*ns2rDL4W-&|?4e^c<> z`Q0#;ZQWe~oaw(YVfv7v{W(E&`mH{EK&QPWSB3PD6O0H$c1+7lNRUCoI)YZ2CKx;t zcz;ekKK-m?!~#p1lu3pPEN3R!nT2)CuedL|9}k&R!{il;^i>%7-0DR1lQf|eyDj*L zBL8<~Jz31rkkQ5MOm`l{_aRmdJpBi4gi{u?KJnQ`UXsWh?@60s5}i+K9!%l7!wQIQ-EF_M%nk-bpSKcqzx#O-QA5bR zMD>S~F8tvMaZ7=*zW&1g`^QswonJDv4ShnQM20LLH6uJU)*&po4%pQ9!x@zjZj`O931s{oml1~vcDN_X z7Bz$!po|0h19w2n1w^-OxoWi6&gl`tgtf%3ANsaIT0a~ zD^*?~B+u&Dam@li?MvLlO5j$gXejSM?V7QV4d$Z1qr3IK@>9K8J_j^*QRD*#iaFnT z*~(d$DJo*p93dA|P}YZ89fm=EaPUw2pNu<`uY2*sI`DU6(vXf&(bMi{M=N!^nm<2! z0k>}*p?9+lHlj-6S0V>T^v{kvcFM>PClmLkrF4WDbQzewu5bg@he6xR`;jtxH-wJQ z@SGhR0h8ge_{}w!w7-5A#LKgAB>yh3bzErK;*)BL`K1ggJ2b5`-NSbiN5NNpeNb9@NB>} z5HuU_7*E^(nwz91Tk>j|N|}`()&lTAwY*Tv>qZ1Z!sd0EKd)7g0mocY$Rx>S zm@ISUzC69>mc7tHE^}fKVN2G0U>&ds+T0|iu{UK{Ks1lMm8tX5cc2a$x%vc}W1TtQ zvUV+p%$V7WQu<_}t9HTL63DYKW6#Rn2=uh+h}fl3KJYZS&!EkaZWla#SLUpP80wW) zIqTE;>T!gfz-tC2X<(f#05&x5@d@$innaBqORq_#RGZJYgMG#^29tKbz4_GklgkL` z1@KOof~YiNU{MD-paHs`b!2ot>pA+h4aedGqQ%10d7XUt_cZsa=a)G&zY5+jGTi>X z&yJ-05gf@gUag}>Xl3g*G&}|UF-F9RmSvKiF)lG0*NU>+4j>o9*4Ot%VcAl1>nG`I z18W(AeC=IK^LvTKqJ83rzVp*{$V)aEZkc-XG)Q5uVYM~#y0&D zg4A*RPsZB6Y(kkYP_Ch|(Bg>slLr{UcLty&FfXSJiLtJ?`?&yg;3NBATv66>L=Gv=KD*PV@z!@pl@D3p3@;Pe4THp6xk2+?8Ju`E?lA#P6XW(1#?EmLm zM1#jr0lxlaEWwA2gPVQ{8Q7`MYf4dmB-W%u&3Crwhxw+UDHM_kyf6$yV;I%Hj6L&d zQRq6E?lgyuy=$wDz~On|#0jwFVKAj%FI=p`nVa8(jG%et`#|(tqbt{GTfiJMW^rwkGreD#c7>NGKyi1 zckc(ms2whV{|HHrXgox$1=lPv(p-PfldjXii`4_^?Nsmps$Kodmu$JQwcRQZW7v&0oeUfEX0E`hU9#z@vgz18cCJBU#aq!~roJgf<;YYhZ ztY{i!-L8>A7tkaIXNAK_Qsn{>EJlCS#k4W6kE(r9F|W0@=~?;%`r5YBEZJY_?tG(( zDC>C|OdGLh5w=Bd8+?%g#-*x9KKWp#nU<9W|M8QRmD<DkNfCW{sl(Ec{7@D=_iN=M<(vO0YbXDI^z=3w6ETR zZ+(v<`GfQ>M)B78JLfQX%ng2BgT+~vk5cuuDQMsV$(>0lnaX%X8IMN$NTyQZnnbY% zfD!Yg`BYwkk89t3S`^he&uHtd_8NiHHz}W?)F)u@^|;XNf4*HvrIKWRsD3UfE(&Zy zOQcfCwH7{wwlRmgMYWOLhC zU_tYk!}x#r%YOp5!wINJJh;KZaqR_~pllN`L(ml({vRl^5NVy6M)U3e;o@)WhX$~h z?ZcW&R6y;lRC3p#;}ALL&Xiiv#BxupgDZa*%9+=Mt+uQ>Bo6^yq`%6u)J;_5gU3^+ z|FxqlV}X%u5S&}u@o4m_nqnu!@SNE(Bf=ho`%!8tsc^^*_->O-ay(REKf)11ruUQJ zS7dKANs>XN)-|sKtTaC8B-h5Gu`y(8B;R+>#6YWf&7X8Y6x`3VD zf7k3%4m^PF37ZAbn}Y`=z8*opbQzg~7KeePlG^q2f4b|pb@FwdKDQ-L83GOvy^hOE z1e~WGCKZCG4(IHLB7tp-cw{$un+~u}PN`R+-)I@{28;xVJLZ#t<0R9KaPYvKl1+Em zSYJ__E?MA(HKwf*p(~eb=aKJ-2vdLW%O%=^!);>jtv-a1JNo2I6j9qT#pr#OALeHwqpU(Z^I>eBu+#2 z`ac%WWe5t>ebuh^NEaq>kCkQZ!JYj{N3%;D;0Ye}{xM(U|9IJT6na(3IyE zw-^+=Oar^%gxF!g?j`HJVXIQO8xeJENT;bY4p}igQlI>USmd*w6{dPj^ws}4@=X_^ zlws`6BYZ01K$M=6FVu$`z`=f3_aYFoopf2*V zxdE6+QxZJm5o?QlP{k7Cq!c+>vUL>+V_-tp!ce_N+ z{_GyhW!j}*a^a9QE+N2m#p^h0l#`U0o=Zkzi5@%~g) zp7xtbb?`au>lnaam<7Gpzf)84KdFfxN%^lzrreq%ffwjCfkWPh9Ey#t@0Rx&O@guk zww2sm>~V~yFL?N0Tk-HV!W%NFR7+*^I1~bz;^XByylP}(igaEzzTiyJ?Kf+xgTib> zYWfn~l=n}l0fFWW$DorQRhI_l)KiMPmmU4RKos>W2E(YCtX@f;^?i?~{`IO%|GQTu z13@uL57L^Um7c)nM(KDf$4^Kn_Q8_a!`7Ux3{vDJsL$LB^YSTE&|!k*h*_wE(0|9z zAuO;f94Xiw@FX+hDO?9ld13R!FLLMIwCe@UBZ8Lzm!T7r+t2>Jmqqp;} z)4Kr~_*+#*{QKVpvf@7lGV#uJ`2%y};KRLriUz+w3_IESkpRki0UOuyDp{|wZ*=qw z68itJ_uf%WrF;LVh#dhH6{#5q1(l|VfFQ)tQA7oFP!K5*rAm!7m9lXZ7^Nx$C=sHf zVxtK{s6mj>i4f@lgaDyKq$MHQ`#wA9yyyJRdCz*!z3=_w-gW+%wOnJ|`+2_Q^X=dL z^>c=L8hFb30E+&w1F&S54*c}D4hcBJw0NNaij~2;s%m3?yjA(1z4fjP>XggaoDy9w zP?)o+ABQfkH37T^?v%Hy#WD91`1}(cpRQOMkUh{iJe`Ef&$`$y9Zh`dNmqdjwdfKD>9o*xg+}xmI5~Gk@N%{Mq=5vmK|sc%hPD6bWlpx(E%E~H~fulr45?XU* zF6Yf+mRHW(RK!5&?=Cgek?ht^yUJ>K90BD?@c*9b)OaVmu}xEMMG^)sIP81BpOc7> zJExpn12vCx@O{&Xct(Yz4ln3g9XL88O{QVp?PV6=EaiLKJNL+fKiJcAUv_WEd4X)$ zl{Y0F%tL=C>}pF9Jr#mufaQSqK6tU~NNX#NQpW5npl|E#={u_SMBGoVAx9FPUmQ6N z$2n4CM8FsRWH4G4eNz%P;OH{gZfEmtD@fc#yhPZ?R`Wh~B3^;<^1wvcLsfqG;q0Kc zX~7j`F3f0nTv*PN4v!?9c^6s%?!U|Ao3)Y*9Ondf=N>e-j2u4=JJ5HuoOJp|)C>r= z*5NtO*;!Iz5OEkiI(y`JPWew|E#NGB*XQM}s{+T6(oT2L{^T}-U2$)sC=4UGVp&om zzGBnYHXVEVoy)2y^^f2mFm*eoiHC%xv}>|!FWWnP18jS3t{aCu@0ekrOr(T2c(E6M zMUPG~)lS;7N+<)I<&Is}hx0n%57i_WgrgA1G9?Oo$F z2hOtoc6xfbK)#G!J4N?dam8<4Ud-rQx?~k5%#QAvC88~c0+|wQ-zkx zw_l8##~zDR1s@8lAm7L5w8;mwn~AHw$*FwCn5w!+vIMsdgpw6@?C!i-7RJ|e`uF`Y`7_i* z2Ge1_U&U4q$CA4<9bZ?Tg4`q&CtK`q^kLQ^qrSE`?LsF?m{zU{J-Pk)zDKsmAu69u zb6)n|(lfq8xuSO)sl;;cmrV6WzcPC7eWL3}FTi<<@uqnD3Z(f(#6*_M)KpKIyu?D* zA_g&eAiBjZa+J99(0bUvhqtn5c08iU>_*jq5xBbersoO9{GDs8rGI9GRbqFWTE@iT z;|`QxBpWQZ<7SE%0?j@nq94v6KQ?MwBu|T{5BrR*MSQONb~$Q-V)!la1AEFbx#-{Tl#z@iO}Fcg3!J0+;+?2cQ= z{AGb-Vf(2m+EWzY^J+RJZSeE|sRtI(7R7OwI6FdxSbH}@%=y94PK>$>Nn8n&*NG;(AZM-o@% zCdeJkVX`EyRCzcdbHmGJ$TMO>+UdgnYxZJ;8bA0|@B)ewlY*;PkAsqhX;$vE>9PlH zu`!^AG4at8`$c~tYk}NbI?s_;IH#0ho3$!s!2hdQ{@un`WWLxV$GViDJehhb_dvkhS`_<;ZMX38K`1fp)Y(J}nAxJ%#DDYx_>y;18jYi%oTXg)XuhgZi zY~h<0xKN(ind=h1GbCh!48Vscv1Ui&b`6hfw=93*{`C1KGPm+PB})C;b|#)TwwQVJ zFgyI5H}}IG=w`jH%MUa;|M>#RvxoB`?`q52?tsS{H*kwR{1SD8{0B#x$Ry5z=&PTm ztY-h<&)iRIi}m7cvFKczV`_Xja_O>}fgCkG&OoQ3h%SR7rK3*-db!fQ%qYDL=Spya zVD*B@n?>xxi*bq_SEQ|us@0D-4kFLvqVqDsl=evA~QbVxk;C>ILcBg3~qPYD{E-c}(KgTY;uh-3L@pOBo?e*78 zi>WJBk=e+_*(XuG`w}A3G?9+}-bhRk-Z}bA>c&Ym8UK9aIj3($iXB0{Cf|bZwq6c@ zWIU#Rdh49|>xC56g$%;V2)H6oM$fTpa|`6R-g$6nO|Cgq((BIXPY#|x=+|l~sUy46C#z#Lm{(Mln!ImOGl2aOdDk-E zsMqnJD&_sYE3WG6=E))nz{E7n-kCNa@W)YDiCgBQT_X$&7#|R-}uWtNbJL!e#n?dU{AC!+q**QAdhr zm$71WVgijtcH^kKb?hhSE@CdaEvVkiHU0Exe@vE)XUYCb6P~oiy=C{sje*0X!A!pK zrdt+> z#)MG2)uWU%Gw+GvUys(idSG)p*?gfl5T13J`k<6x(Bt&AF9)s^OMzqZ7VqenRi!nt z-@*jtU3D94IR1_e-qb@*RDFK0A3wgWrI<#U_^ki)1RO4(cUNNGB-;+9)9zQb_PgqU zJ8}9%%d@*1PxL?%>W{phM9Qq*91cBFEJSv0K2;?K#8dL zIO4h}dWQkE*2lDq=JzCT+6W{=?h!>KWccE-^YwgYAYrCJg~Xx&|9_jK<}P(WJs^x@7Lft|G7cQ zuJ{?XI<4d{Z)rScI27bO%rleNI(TQki1u>1LOMBc*k`C=yrZh!f2-=~me^Ko6gC+$ z;8n@I@P+x4xvzgJ2ToR)xgsF2OcL^}%CiLF{=AE!7$#EXgUp;aO{-^&no^9{&l!$A z%s}S9fS+B=FJvfg5uRNBxy8cPIlo62+j2;BQv6n{bla!30qqVm2Ci|6K~+7DP2BiP4(@8If9LF~ zuvVPOukIo_m-=k{TDBy%*QuB0PT-sY63{rzIw-K|A_Gy_@6@@)B2cYT&;6!CncxmP z{<=dtlJ|Q`Bw?GHERCPJWuZwX2Xhb~9R-~0?< z^xDP`;A@0ipKzR}r-be`_TJXGUW;0Mu;4s4XrMaPz5G+j*X~^D6fkOQMk&`m*_*Q5zJ1MoZFB4jSg=4J*u5 zlQ!I%ce7p_=X%>t6W0876w(yFXZrIKu2NGbum5qEa5qA#XZ&%x4TJLSVyFsI$Os!E z53>qjQ=ZBZ z4-f6-5dTa4+zauaIpIg&>w`zDc%qn+ZB6=m<_yBfirM~tl<08lZysJpy4zPS+5j~% zysL0h+J#=Y*-@GtGj}-&Hgu8)3s=Fz7qC*=vR5=bPOf3El}t;&qIDRfbFUF7qN;ro ziX9NDcWHBm3{wE{#75!}F&gKFq6Rm04Chb(yl$6YUSf_0bAHx~(a@IXT?M0N8G*pPt0Q4B7W2K>sh$id~k)TOjZHyJv3=A|byOpO=?ji9f)bip%n z*SWwhyb&HsYGNxU3M;@rC<)RH&IW<*(Xp5e6!(_jlOv+S;?r09U({9uk-2gFI!Sd~ zH?uU82{_RxPW=6%q`qvp$>R9W(Gvb*vbvDkjLy%r)zQypOc|zcV~3VV0>r|F-^8YI z(^zRUX`D2MBmsR3JPhL5qsmX(1wwONax%gupr6PjjzNKwXfRq$V!b;G_=&SVWHvL|8J3J?p3blP9tqGZp10+ zce?m@Y$wYXfT0WeUZGtFqR3pFj#?Lf=S4`xSX?0O&AdIpz<-TWqe~Xef5K9+Z3vr=hTX4!dpb!nGJD{|ctR#U z|M*6t>K>GEUK-L0=oPjg+0fW;kx<5aIg4j=hF6aN6DbF054l{$|7zwzT?Ce=aS(4Jd%)(70&WlJ-F1RCf6rie!p_G}rACj5ug z{~`7N&!l?3l;Oz4GbWr&k)Oqq=R1y}8n5#|)_67Kt$9YSc1*xgQ6U=}n}ZTZ7)0;F z`@zTm~Av67ct*0$JE=o!-!Q3U84b0Z5=lY>CYRI$99kAuf&+MFz86^*3 zr;s#``prN9aq!$(Ax=Un+`!rXZ%|8oVrQ|k z+Q`dGU|;=wx@VAr(@FFk+J#fto9CnjScdvS>m{Ro;fhwQ1q8gNS6K5PZeIotk;(EM z8%kI44VLlDW2Q#yQc8J)MMdEUX_QCWL0BKg)dZt7L|+Ehll$PsF+%#XW-afwlGzJ( zs&v^T#OqNm^CX}OJi_ZTJJ9E6JcCh-o40=bkn0~~6tM8iY7ia28-6)4>YDMvj2W!q zB<;eNj6-^MjGc8kSZ9#rl?xYe)n&BxIZWhXwezpbJnk?sr*)rw_Td|@Sowa-MWi3| zv_$U}29a~6gAerD_>E^1U-b>VSI)?ja3VHGD6P$x3$2?hhCsavAsv+< z^Jkoe4sWG~r*pt=Fnf(Ieya%`>UE+fYoR z)Ob#Ps;J=@@hvdu`~G;qz=n-;^gqv070M<9E868g zb0v|9YRFJVJ4VgcZHl1#L0sJ_C8#tR-+H49w)vkQVYpXce&WrI#15X7$19ec7C1+*25{Q$8I+liQ!3{1T09d(T`r+=h)=RwNAgLzd%A zIWs65zZHySsyCI7=?I9|R2BIilh`7K(P zyKV8CzW+i+%$=_2a)$-FQPT@3!B~!D$r~9KFeI=LY2u;Qo5n(g8Tc@*$OMl4OfKk4 z)i0Zz`H}==9ZSQbY}4VRG%gdUljxpe_m2nRE7d8z!ZygE<>O+`{0PKvfV_bcr7#q& zH}#$o&Hq&{dI#Navsw|;jL_lv~0O z_V%BhS8E#EkVXcjBPC$c!R+PfY;kCKuM9Rg@YnTC+^Ik~E>@MHxb|eSP8h&3fc2L@ z@2`T^cgzGl86z5obPJ_JtlnszWHagY&i}D4296LNP~G+iai`tekO-3{?SDLa^JnjW z)H@IzcJHYkZ5^hpOp6J(U^wmuqrPxN1D2qVNp2;N65Ey)2q!@r3)?Q!<}kvm2IPTU z05EwDkF=v;2OFJ&=n4^~bkXawI!m3(0c1&sRrQ zS}G884vjSe8={g2{OTo%1PCe&{t>ug-tzY0rNdV2LGvx_?^hwg7L6BqapQ~9Z5kds ztj+U5$?<>Xu}X}vfs##K->aB&+_jQDKC469ZV`6I{R^;Izb!Uki4L*cv@75BGF@Mi z_)lOP4Gipj-wJC-lBKmzh5QR_{vi*bB51x$CV5HFE)2$}{&Q)N(thXR`!$ROL}Bgc zTZBqtw245U(-twPf`N<%h@pYvsq=HzqtLD4(Z23d>i5IGJp|0mSJO5Ky~c{ELb|#F*aGekire77K!JfRouz7^kPn`v91`_ih2MPxdA1Pj_p6LSgYPP_HKmz& zRmSmh2at1H^}q924UZE&%Gvy-0Loh7hIF--%x4KwEafrr}^*w042fYq1xTQ^!a{uta<() z;QfD$=l>rD-h>1CS2ke1Xi*U!^y@-pG8+&TAv8hClaxerja&4;XBnHZ4IouS12qGp zBauRWjPzGVxQ~8$-F<01AK6jFNI7;el zz+QxW{t6tIa+M?Oe&BLY00h=yL14hgb5IDx0SLrJc(>lJV9$6M}?(z5h!U87p8*nHuLe`*T=E9%=P?WPs{Fthqi4Y3$_{S+W5U?TR z@=&QKGU2$s@+ZD$uCu5Q&z)SWB z5YYBkR3iI!47le!w$- z##-p|C0RCu$ne8&H&+Y;1`_47v-UfKZlODa`zNjfM^wNCqqi+86mQ-b*K})OURM%$ zAAavKltyh!Y@i5`Ln)+0gq8-7qk>z8%w@YYGL zO21tm0VSM9lcQ4Fz*Nr}GXF~ae^39bqb3CqDvJj~mR1Z}95m;kmU()eiU-2T_SbvD zN;^BP2ZL(xjW{p6Rl}4%3({U^;9>A`?3)2UKs{#>laAH>EA9V1`5(vvMw!m zAjdoN_@pwvY#Wmcnf@ABTsqJBI6?+PwiHW}?(TF;}QDwldc zCKYzx%;ORPY-meq?-jmE-z($=RALjV?3wCn!Afd<7f>!>#EgDiW~(3_4(TZVIKw|s zOyV|v%k5Rw`kV8S`>z&00ebw!54`aH!`fox^3Y$#o=o=>cgBH|18CkuVW)}nR|VsH z9RrAh5K1T&1QmrUP~QqWUy4?Vi+8|sesZMi^)tFC}}bq>Ob5$l42i zHKEr&`a3)TdN6fMkDdVl6tgCU5~IgppbKdtHe00OJ)_dL#!#_~$(hhz zMW&bCXWd=JY^R#%|E>iR#EO|^{qtD)fP7(T2ppdwkkqx3|HL%>JBSyE2DjH&Zp}wn z?Se9j0;v6{ck4JWBT3|68~Qsu07fqWv~;;H8F9qxf^&iTr|CZp^H628gVP)8oa6l|+j?QSz@sEObm>Y3G;hs=LC6Q$k{%BE8RZ*cmE~y00)!ZM zWk6hT^V|OHtv^`^)k{Mb1eR!e~PMs}x$Vc5+ z{gqn2qhCCx=ewW>-FWJ=+)FnjC1Lp|D<26;x}^_WcRB19Lo|-$!pmTQYLye6K_z4GZe;dO^sO^C#Mfy__^)-&cDLf^Lu=pR#Em#+rxs z+J5Wr70J64cL&>25vx>s=VQxT1` z=m@~iJE+G{>rVtuE=X8VpNZ;3(V(&&7cbnK#HzaKSD#CQ`Y?BnPaWfd#&^&(Z*|R1 zk-Jv=^!PUOr!v}6w?Is>bS2aqj7Y)0*0&)&X<|b76AFhHFuKqjHbJNx%{kEJhv5p4 z^aoe+^0l~IKSHE-PlQZjHP>l^hVk{&H%iVsx~4WyD^5 zvem<+iKTuM?)!5f|H1S^h3Xd-Y2?fec1G$91~*V%F9C}g>hDpFOlr+^}C~WL)cCu8&TFj8LlEeW13!74^wX(CFd@0XUig2D3RGE z^PLgK7_wJopSUntwOBr$^6ktlW?U9ww~n4tG(=EieVa zGbmk=6=FFRVg$RX6pfuuI$w}$tBNgj(9|Y%;?^VbGI!wDOZ9)-d7s3(8PafTV?*aLy8rm=XM z#vN7FGd_H85Nm@Oo!>@QJ*pqUR?l16{#wBd79Et8=u)8(5v_1 zuz&lkxpdIiX$g3!?7iT@gO)8#lr%@v1>aG!7d=5mP?sG5HiGpaNj)%%J@eakWWfM`_ z9DHD-^yjp?7W@WEfckK5z!|6!k)*2N&^pYhWJniz`j{T~RgBa6*irQ>Ap{jP55OzX z|I8$!tN~fTmgGo+#&RFz>6WrNY+r9FKQoIGwcowgzf&diwe>=Ik-Yj*SMxRb>kEY9*(mKZZLldDBiHGc77_D4GK+Y*=^!| zomv-rmoRfOqX3N9bX?m!IC@o9MHLN*X4Oqb#yKJu!K=mO^Uvr#88c;vUvBo4lZHm9 zG5Ke5?m)YC@LQiQB`AOpHw^r!3-cH^n7B*Cg6ZGAcDKFzbp|5|OWmShvXs*1T(OnQ z24zl=8e#ZU_u(>@&*Acr&rLtHDvq4q3uzGw$k|z zLp^viczrIxqo6zb;av9mn!7h#xMh7x^oJXb^R=ZBpCVE0MP7K7X2ZR5tmwtQs&&Zp z!S?-{0inUBNrWsMKj!JiZ)!qwaK1bTU}`4*fchc{4s{6~ zK;f(^TMjRdy%AOMclP0yJ*C`gj#&*{_?6{2cHElHe74yv&uC(#d}WjY)c42npBfoc zkK>|01W5MKL>p_oO|r)_7u{A}dW|?NyLxY@1O53j<=apHGQ9R@KJQK(m?d6Il@g7a z;VGrskExuRQRmGt3T<~_c_L2qLxtC~OFV&hutMo{d)HPhj6)A{Kx}g`Pg31&exJdf z9k^f5LH{M)&6v9ep0Xe{l=Cn&(qs&4uV&y{S%aLnu)R8yL3*zDv}U!ueT>03Vd4rx z{Zmei1hPJ4(#Z%&kDZPBZ%uPl5Z!~)pw%L%KPfz6s4uw~;3R=V&mtz8PpM4~jsEcn zlTYyAFRzo6PS(TkNlX9dRH>Y^;QI=nn@Tgp_vaJrPZ+De2blhFR;oNiJ(Z zMlVEwA7~B)_ZQcZSGv*w^1o1liH0!5MV9r+{SWK45M5;lQ&3X+5EIY#w*6VhfA9=L|bvLExQa6~^O*8K&WF zw{CwoPm>V=2VE~B$Ed_FDQecAhsVlSc0;4ehbf{sDbDy|im`#tg5-A=8My7<5?QI|a$fvt4AO}2K^-Y}@0UTO=s0zmi=lEP$ty~&OD2~m*qzzYL zP{roLHLby*K)vR3FL{_(0H=+4?)yR{E|og<647GZ>h-4DlOeCKtL}tLE{SLvu~*-2 zcHQ1LwbClf2xK0Rv>EZ^&zVQcdnHJRY0f<17kwqCAI~Wm`hTHc-n?P zKvJzwooBQH^^FCNIxSR0I!J%dok{H6mY*15nUR5hV44;4croI)|I)Mdo zgX<6;DMPYm=^Yok-{8wY6u_63EE)4+f#JvS7u1vGy{kWXc?$v&K`!(T8RPNPv56gC zTj8IqLxn)6{>UX-uVzMg2 z0tEEJ(d#T}|K;!CB-MstGn|ly2fMb~X|;yOw~qznUBKj`4i<3smT+YQlVckE%8Rca zJw@hhx554v&@a#i>w|wKK7ZncV(%UfNYM#B`fhkB7uGiwZuQDi6Mp(_+D5670s3(N z=UPw+vDT+~((fuK7sx`%Iy2JG$4r$>-hmAE3+xZ)h@%IOGC^*$^_VTofj$uG!`A@^ zM**X0!E_0sLSXn9lRAgBfxui0Z&q+xKB$rz>4|vjh@Uj@|aBt;kwP zz5RD%;Il4*iI%-T>q~BeQ_5B*9cN&6iB386zr#vt_uR?r_!Z<0LD7}HUBF_vh_@MoMjBJ2#Kyn{eSaNN&QZ^RQW3Av6Jf zCC9=?TBrqtwCHfa1(@-N8Y8TKdn1=BE{bYCCtKEYM>3K{M?LB=2iqq8##l6}#OcfJ zGXuR1$I*iJmXh{0uaIoCbkShjqOB$r3*t_x-mj1I`CR(8~1}pxqus2;+i6&Lbw>T3fMlr zCHeT_IZzP!5Aps5@g!LF=anrw{Y&|(0VAQk34R5$*_Hfp^VO3ZG))Y=PP#lwrj*ne zuwyV_ys=8r8vMnb!-Klxj|S_;!%xY7urN>0wJ_%s_4%{30*Xae@djrE*7mEvK*(a+ z?kwxcYwMc8q&1unvRz~nf9}YW8s$=Ni+5XePJu?&EJ$1~p=xGE^^kdDi;+d^K5n;Y}Yc4RcwW9%y)5WScJDXr=S<+eAy) zd$GM9x^EY^v6Q9O)xr0izpK=>bH<=+8Qj>2we4=1bo=76HH>Rga2Nq-|N9jb&qHQU#~{<&DrejKcSO9Zb_$0 zi0H^2hA?LraFdhsnmKCTG;V4=|CkisUGkN{=W%V6)a0Lu>JBO|{O)&A@<%TK-9?Fd zaQkr5#dkIvs!L%Rh5JE#Q>=Ybx7S!AcVCPi7HN;a-guCh*X2>Vd*0n|7`~T*jL%^E z1`hgh2HWOSiQ|j7D}AGK+Hx1$UpGI%$F0ic1aQ@>NS21=|Fm-UFrI28+fA;$kxO_)mnz zvRHZ(&H9ddRLWC7{u~EE0tI?|A?;Nn?B-+XW0c-+K2<fW-|BJ(&Yueo`s2gA;FV{BnbnAF&)X?V3F5UN9l2Izr_J zH(IT`JjNgT8NG;Fu=L@FHy|zXZ^yaHnK^o%oXZ$vx>udMuRLKZ>e~~v)LdfHK{;%h zYW1H$W=~wbyA|~^Y#6CuLAQj7C?&JfT_Ee@8`F5%Z-&lqnxukVi( zfbAG=9qIwyzOsS~i|t{pcn$WPEc;FID6o{Le@idgg*rmK3(?xYX;mQu9I#dq*l@)H zlLH!xOBXhZxx3J>#v9LR%gDRtK$T?ZD~&s1E#L2DN$Yw!Kwmo-o;;eL-A^7LvLA1s zm`JM&KJUvqqNKKarHuXc62s><-XB+Lxc~m7%Ot{QQc`kZ%?BGr%mr^|!>y?#`(Ez6 zIH;R$N)Bpnn#YK^#;xu&Ze0L;udw&uosaZ8;75`G8))A6VElQm8P z!L!r;sX(-|%lg zCWjn$8beB_g4u4?rNODNNFdVGoxniEu;Vt0C z%L0P~KObM>#@R&U1)o|YOwLLXBsGA(TS?xo%@!VcIl~qEe5*@1_neu*k1Za|)7SxF zzqXPE&qdE<((~o}%P#rncM_^fo;tq3sRq?krd~;gtPaU9qQ7A;^i9vL?ab^DsG-nRRT`# z_v--T@Q-fgU~xnvwyyNqqTn`B#A{zIGo|*wb6id4a`;-oOu0jT=VvL&L9ntduVkWd zAyV1{F1%WihqT`6I-09$%&FD)@2v5@DUW$k_58yMCxU4sux7%42Jshyt&>2P&wHoj zpf|wzQ0*q@433*M@J%txZ#8B@7{<>#B($wr2fdNEf%f!ssRS?pUgMCKv6B&YIiVH8 zF9KtGa%NwpDwr9ut|r}mz3D^Zz?y21X^yj2-553QPIu$>rXBK66V6xidi_$A)5W)^ ze>tXtsC%?o2j92Zm&ufzlB`d5Wm5U}dkhYc%r>Ah(m$B!-d3~PPeLm=EqOwT%DdVH z`3J+YLtRvG_N3t53Z7rRRTp2)Q@yI02_1z?c6w@U1^R1j!@OWnHrU};lcpoz6T zeYVO1R`LMLqFPLp-o=^n7h=vCa4{ONF@IZCWi?jug$Z%qHsDz;$uesgJB}hHZL3Ib z;YzDItJMRy9^O@oiVsd7?9 z7xOqANZU4NYD@YPPdiaG8#?xG^i4@?Jka@LV`LH^)GaS`zl*N6conAM3A55D+nUU+*A)^u*s|Q+d({_B{kFvocwBXg>eT+Ao zrHq6_7n2wVJenOh-3&BfTTB(UlBAq}z|ruhT-%>ld}EURtSX10qZIOM#R+moXY3!z z;TLv8Sp7`ko~x1yJL}4^_(t zJ%7*CWNXO~^x-J~4N7ps842-w%>La@khVh(@4bGn%Tx zUz^cDqT)h9a5)h2dsi*t?#4IrRe4{J!TU;TurXP}C1-*J|f zo*V=gdeQ#4KaQ50i+{GKYgV05cz-wq<+kPYBR}J4@CPxWKB9THU6lxubv>`^>h~3Z z%H5_UAg)bA;ZUbw*WUA%)B7k)Gl+lX5fU2kyG1uR!YBu6KUec!14DJM2 zp6+;Wp8*jJ)214}XlVobn@4>GhEoMUzYqmRA{j3a9+$qqaygv^CYQDbzO;!Gj1CZT zuZm)Ax#BS{dg;U8cjVRb?*OUY>>kWcixO;uxY)4yN}vHq{R(t!o8CRJU}I;1AOUW7 zpyyCwBw=Wq%dcD4*!Mzd@R#Bj*MeE#U7fsX zQyFyYAt5(uH-#Mt)|3El0c7yo43b+X=RxZPxcJrL8(`IA!@lM}R6tM(C{^=&{u$S6 z0;))ytc1r-AaJ{H`Dww5xE>Nq!i4mI6>#p94nxseF<7~Yy*Qyep@I^v`Klt3<-_O9 zkpr`86iynj7m#QfX(aGl3|R6rCZ}ClfsJ`%B7d8L<(LE+qMJMzZzKn@*`y)=Ka}+_AnUje)KqO?9*&Oaa2xR6X9Ut4~WVr;YG zUK$p?{ml(e=D??f<4{=%i02%S#WNzTAKn1#gNnR1EBeougYlHDkd02X5aJa-p1%ns zT|vLFdDEhxxB7dvgGCF-vJ8#_FuZs9HOmv|%dGDt=$;6WCz+*5P235b1|Y^?TQwuL{?w+#y^HlZZNMiZ-JkA4zs+96C^268uD7y$ zx>Q32-MdfVu9FMSNC9Zt|C@?Vi=6gem~%%ditsk0_zU=aLVzBAem7?aVNdN=Jut&O z9y_w%4NQ&y)-Wp<*f1#Bv1LYWs?^KpBfY>6rkirr+Jd_8gefs|l581_VY^ja+ zYbmZ9k97&3H|s5iqaV+ygOr3tmkEQy{3R6KUaEj{#!@&Cse3VUOy*ax=F|9lt&pF% z#F@_vI8e~&jsC%tnerEt0;Z(w^^m_g9jv$Tm^M)%YzhOnf9{&^M#$kz!d| z-*|8=_kq-JoZQ=ZvywIy^(Uz8$CH?GhT&?ZRT5$3_RjWLYB6xrG zDpA>2W7yY1b475X?&(~Kdp(HD9)khmWUVlpf*q463wzo9{hmV9+Pr2W43py-P50N^K)q)O)T?N-r=~j z;PovrJKyBTqx3jvj~6QhgC zDBaBWNaj0R_uj?6nDId@uO`KMKDUG=>X{{nOioQyU=EQ6=~l}#8tuVy*p2DMRgSQ# z_N?A(n@Q40a@ocl14pNn8y=q*dQs@>nBplF=vKtg-`~h_r)RzPX?nKcRQ-9omi_S8 z&A*JOo9xaTJ$Q~{tnk$t?#hG@IkZzXL5`1gy6EDP=22YYE6CQnC)%K*!a_HGn5Zum z3KNyPS`j8{+_b`(XXbVw?&(AobYYt_=)FNZ--nhe+b;22uNM=&ax^_W*x;L~(V@M0 z7H#jw;>JGP9i0dX>UH#v=EqKOhvXJ{LA6iQI)_vV?h{D|`2DjKazK<^@bG56LAH3C zKE7}=FSE-S$2NC?XAoagvtlBz##?Lb)3>@I$$D&+SbKg!hgr#R8^-!_qV3FJA*Zou zT1PLC`-}0yXSc&(g+NKwrk1W#Mbg^w)<AQc8YbnH-NWx zak5!yyzd1z*P<;$wXI zAn|OU7g#wQM=cSV%J!xjq|eF|juZV3cvzcEvRsr>W~V;(KtO^o?ha;RYraSYe|c$a zljlz#>pQ~BKd?nOF8U7NRP)pJ=L88MxwX9l~HkviN-sLNyEgw=Gx zTeldSTK!NSC=EoG?vLya$fYmlJ_zjWAiW;QpCPgQI)F{tPIKB}RL~1>^UYJ19^!I0 z#4)a$LCtgfaO?I}%wl1IYlQm+^3#C%uODx_wNHQhzZiS(csAeneVA(LFuIi(Rc*Bt zHA9V5wG>5_QoE(K#VWBwsnH4@Ms20`td$TEwYQ>n1dTlsJBTFD?el(rzQ6D9^*nz( zFMrDGzLWF1uJb&O;~ZD17P?k;B5X&AQyMoF2Bnx1T(>z#Y+hEigWi*on zvk#X5Kl{ImYlLjs>FyFOBXA^i(&Qf9Ee2akLwTfBt@s9ZE4*HR36ik#wvV8wbk**x zpu>&m#fu9N#8ylUoi)in?U*4UNSMW zR%%eNJ-v!^mJWQEs%<83QaZ{l6VZYTNbx$SsoI6VNm!S$@|InnDIU;Erd5J^-PAmf zM;;r|a~&3Aj;2++jFS@%D?=%ioK@$oQu(T|5Jg1t?eN~JDe6Y)jSvS~RqpV&$3p%G z9@zm+TyZF@h}6>sa*hJ}ZS9^#&3XlXf}jfglm zeSR(5E9oA+OS`{A$hpVR7ow6i8;Ki;1WO-;_BWJ~FspFL8=OJY|>kY0> zrAP6ZQy=?P$T*H9`jsLmQ9SaE%p3&)H|x`OIc6n>Jshb110)cAbOd9G!e78yiD9mU-M187dK7}Fw!B( z9PBc1!>cKJhl9rC=G=YTW!*iav+F>eFTi?GVTYl~zyKX=*y4Cy)%N3x9*ji++PBAq z(k>+SbI5Uc0%So3?+%HZKW+Rm4ty@t+tYb}jMx;$UinIO85;ykpu>J3cq9g*PM*G0Uoq#B=RhbWj2R#F29}AhV}C5avI>hk0TB+U9mB5L$v%O>z&uDI6PjCLMw#og&zl77p8rYhF#Z5-oFNu`4&z z4_x9Mmx|r?oThH`l=|Y^t zVD?+8t>-?b1;7(kuT&l3e@rpM<5eq~uyvH~78(j%74iMk&eYZnWCf^sI;uCO;og5+ z`UheN{26KF2Ci|k#-S_?izc2bf7+!wRh3R+n@j39M5^rv)zE(r32RLH9Cs^Unw#c%KODd+V$m&bXgx)Ja(Qj}4Sgs9|SOe~}A=Tr|u12%>F#)>Ya8ke`s^H2nm z{TgQ`tv4m1IE%?#*x_x1+DEN9?S=1 z-zQIb=`)37`OrOVIuNix;J)nxRX@+Qac&4qU=)E3oJ`xB(WP zL*7#fVM*Xynn_zCwt7O?e=I|}$lc@}$F4qCer2mXw$+_)pOT_$$CM&ZUV#hmZhqi+`+SMh?ll~Y- zul4C)^LPzHZ!n;RO*z*ZfWX94qC^c5qLh2HtB1z{1;yW9G`6eMqomWLWLQk+K)_dc zi>fY_FJP;vZU>l%9Y#|suj^dJY%_yb~Ua&D`8O;c0a++=!Pgt(~ z$X5Yqq7(n;()#N~g`QHRx zvB|Mb4i`Qb4t$^%lO~8Cg{7r)Oe7iwl=#uuOa083%;kniTW;{WoxfWLGA>_=BzDY6 zWfNkzr|cJ%Z6p5j{kIkX!yo7Mcc0TUSuIOFs%+@F_|jY0n&SF?^2+=oYnE|tTEEiB z%nW{Gu!1f+AC*o}3XNQ0gHB_$E!5#=T+Qzwiv@$N0jxkO8pa{F`->YJ7O_aG+uyIRg5UsoLG$LVb zNM@y5iQS2|paau&L;eb39&MjdVp(t?+W1ATkj8jWAoC-y;bAhR&Mv?gXJ|}lBBeVRrSC5>e{uAm z4%}Smavsj@lScOThr?0xy}Y&`x>NjoJ0AKFRxE8lk}!q3DV_dg7F(2Az;3Q1D<7Gx z1+5<{xwloBR8@!ofk(L17U+~ylOB`SeKu*nVN^KwHbl87&26^ziTvNZFZKl1WV{4% z?*O@4ZaSYZPo}eH+#O2#gK~>`m<(S*%y$#~mB;?TH!+k{Ia$-G$r*1z7Fn*R0~(Et zZ`z)VXH3APQ?hI<=~#)e+cX2{-rGDj9$dw44#GV9^E6K21 zT(WVxRc`wG$a77&QsJah%NnhDYr1b)Pb$?VdkLDBY`JfMCFCIU_1RvMdBJS~qtS^n znC;x}s?70GKROr2EKACa+bk_4KLW9MYV-?BY2nOOfcnQ7jf^UjlzvuX)nN0|7xb(M zHoqplh-0~9z!b(L(J=vd-+Y4rVg7sQ!AW?Vc9pT@Lc5?7QEyKD{4iabq}!V@W}N^Y zNwtuLC|e$wV${pE<^K|P(GYs}>+w5v#N}qvk9=8Z%F84*Z=mN+Hv!g)Q34QjP%!uV? zm9H9~#MWblt)i`Eybr))x%;>G(8-Rttaf4S;%W@PZJiv`%?;ZXLsN8)|3WV1(em$C z&#}VAzHQnr`nmW6qMHC{IBrT%=Jn!BkYpv+GH>8OH!7NZA7E4&S^K({aQuS^cVG~F zeEfe8|9@ck0ND~oZBzPCG`8OtG1CO9|5yr}G{UyEPU;beMfv^(^kLuvml232WZN8F za%A}M(e+nKjziJ88@A|l4*GU2GO}Hif7q5cu{n*WH z6LG}7k6@fX%v@6&hC}^YQ27>JO7&}Sx=S{d7DKn53YZnzMXqc8Wuhg}wZ)YB;xuPk+$I-0&Y zWhlnLL+zuKSpg&t?S|WrF-4B$O5y{s{6i$aBaHY4xIkiXD}5(=(>xu33JYB@lHGq@ zeDz4M-`2d?1S;Qu;}`E$_2^Zf-nK`r&tg57I(;M-vcy3pod>4b~ov7qG1kX;H#pp_ql{-g^S7c%TdEfj@Ya1KiU^=bQmgC$58U)jn|+#<-JGp<5Atc}J1C&!~vluLPj(G}1Qf zg7Z(VL3Zf=iN&MlNnot#ms{#wV42*N0F?8Np8atgH2{O7;GABU=E| zllVV46RT9dt~0U3R;pV>_|e+4O|VJeOBe=ztSn-A^3D7QzSUa@t1q^_tNJ#BnATN_!_HQm9#7ITO0IgCvT7ZNYmbcJ6 znaJDQFjZ+^;XGEC{g$RrP2&Q0Q3IN)VLjWhg|5~eP;p_Q6JEN0B0IjI$K1U7RlxoR zUsE_oq0gTr3UbGBI3bXSpsd0Az0(iM4N|J4C3jZM0pT0Km@7m(`dQLqUTUlo2Ga{L~uz!JDSY zdjEtnzb7W7wt`{{Ob+ExC{n<{r%&5DE4(#*El|0Y7egomrfhoB{xiDapZ*walk5|` z*cwO2jwrV<1o}iZ+4fJ~xaE@~Q)J28r!b%+lTMi;PP_r4DzddzJK1@CI#{-B+0B9K zTxa!!CvZ{4iE|x%By4#$AEq8nAv+LS*8-*+RH}!n$Cr(|n7{hP z^wKCqsMxTMLR|?lQvXS7j~15x5wlRX`LSus+rUIA`hnT~wbz7JrTBJpX^tuBY?k%<|8In*{1=!zpL(Lw`YOBZ%$`x4^#;KP)`36vWt zV}E0?FE&hxPW=%REm8`^_Wb5WXPiMFoDbY!^?hCdI@>^|O3a517wO|51 zq{7~M48BYz)X*ZhUmqVReIWQ^`ia_M-WJ+MqiZre<@y%;`(Z z!sbi`Fxue6RpW|ke`;F*ccKtcu|ftG`TC8}F0ADg&d29KAqAu?rGhCBDc2w=*gBSG0ATR zelV>hoh43Qh;y^w^R!mzN4dQ)51f;cef8HOVA|VeU(&SpZKP7gp}oS!4|y4Dp!lgN z4hNj{*S<{n2~-~Lk>o!_p(Z2PEIA!ji#8I&ELB4*Y{Ew{yKS^PaiRSLZGJRin^FAL0a#(U-Vw)ZQE&#&=4-AMz% zR9<_3ZOeWhmE39#Bpd=?WG4c1?76=`+L}7tOAcGv1p(zFbN{w<>eCNY<9DX{)aQv| zOPbzPTgsZlRH1Rr$2aW&gXH^sd9%W6^59G4tTKjB3oi`pLn!3B&Ff_8wxH}4;|Jl7 zR}V)9Hb(f-XQkf5fzHX1Bkf0+{1q zhV%L6IU^@`X-SWzrP7(gDRH4_(;QOn9W!!aXmAK~5}G=sRNkbt+(b=AJ7ynL_)ZA6 z;Sb`$;|IXSGfTBV_8O<5GMB?^8;@G37uru*U+NnJMAtuR2yXi++Oi@@$syDkQb6mP zH7uR@L+$#cC&-+TR%}8A5Sy~w?DzS!JCfeN89?%i`&~X*+Vpvat;`9nuA358d=`hX zsc*-3BHPfxL!{kA*o>Rk-ge0HgXhjTML+~ZPTq(;J~S@T11N!oyYdw=D`}O03jXGT z?WT&X&p_}bC(Gms16zDIcBj=KdGR`-71P$Lv|D`e^C6M5yemOmM9IB}+Bajcf9Uyq zf0xv$4#0cv4n*<*p(Bm%Y(80I319o!m5inv`h<>xEa~@5{YmC*mE$P&04jvPTB`KG z%)VYKTzP*(kfNwlgjGkkxC2Vo>jV1sG?pUf^5HKp7{UF~&!5my5u-)5YXam$GkVR^ zu(-5;jJ6=_M?0L;(zw+MQYkF!a`N~VKP(|iN*708p3Hyd)7K58i!`yfifMBC?bN;i zW>%i32bM{FVV)qTt!nk|VHqfnFfa_gm1+yfz2}-V7o4a8!Z-EdF>gisfb^&o8~gXR zPT=BbVCru<>Ew5rbA7%*M~v9Now@tG@X4K&D(w$n#+_bp3r^;SBb^d-LzY_nJP zUG}Zr8i$c4P{5i>XXTN*x&e3>YN;{0nsS(%28_uuw$pe#$3U^CNrqWa~pgf#%hsUl@6K{+=CTS=CYQwKhJ`60FwRBj$48 zH&MA(J^ZREe1boXuF`QGK>Z;|zaL}M%$%IKy$^bS@fsexxJ22tX(p%bhy%5*|73Mk z_l>xAh(DGjpvq2d{%?Klai4xMIW?Ef0<_=QotSGg*01hgCP266FE%tTa?kB=gKP#W z&?^O3TG!3dWGi5=*-F>>;6MjG6;`uPzM*op)BHan#sZ%d04ai(I0L-32f!6INt3S3 zJp*l*!F3UTp)4lvAp0Ff zre(a!QFC;4cOEIwWaWvH9Y1<)TpzR>|KAMM zE(dz`H3!}_@U_X8zNPd;mnpMt)LQ*Y?`}h5*RqcM+xZ$G3usY!onm*fBGHX7uame< zKaV|$!}PUGBDRq5E#&Sb{ji$4-v@X2=8gt|DXZx8wfeT>rn_6|iGHjm1AW>^9Dd>b z%u%MIs}(>-O@L>~(hSBaSOBvYv1pwGh+9FRw5i}$7KD&9u9ygG&7UMqYhAzdGZ-oDdadCnX=9|CLFt5k22gDc(A}#^3+8ae4l>6FBEnU!wtKXS& z&S2$!-K4&Kh0hfEt=QC57Aj2omS3-x1L+Ru;J0DA@C_V?_Tioq(DxhZ`SeP)+x*)i z)ffv6aUSy`_m<5xaeq_a{{#P$mN0Y$fGwZ0_eb8JY3u#({LqJM|IQCJj(a#%+X!L# z1PaaAI2sO*`1&Yt4^1A7?MYI34lCFmvTV8UW<6;x8W)46RrqS}AL!2UN)5p}wuRhb z$d6LtNddw+PYDXI9Z0oYvQBwyE1nB6AN4V%ts7fSSYulE)Do@fHGoP0VpVbaKk<~g zwMSo9=}j9y+)0BYOD(#bE4-(yKMPp_Io#mbZ70KDIu4ioTnguNpsbPUt5Td6PbHni z>h}hc6dW(#dGT_@!q3y54GbJ!v5v=<8#2+Igx|QV`(Ye~)a(ayE@)D9MNK#sjdsQ@ zAiMabZ8KSU?v`z{?jy`i9WA`T0L%^(FF+HwERpE?XMy|6lqpP14|@6n^)F_5Xh@b^ z*Ef-34S9{O_fZE)wo}WSFekl(*1Q_@WUXdTD)`Q`tbI$Q+Yw9BX+->Omb@5vi-DUU zw~|=#frPyVu{U3*U`%lAs9YpjV&!lkRxL(f>st49AdPp@7tm{jj7x}DV3|ffZm&p; zYYsS8e&xFP&q4OT_V)*|i(BlcfilcnHb7G1yjzqcL7f$LKSj>-)2 zgx3&PuGbXT*V&RwV3*cY9-5BZvX61R3M|x#Hs_sM&w0MF-G()=Q2k2IbAUkPZst|5 zsYO?|knv->tNzgtU=D|vE(|$cW19}BxOKTxn@&cA)6Egx&uA8aLR8_6AcK?{z66jf1!k^9M z{@QNuU6f>}cVA%C{A7#G;|C=mL%w~lX+3?_SZ7j(fvNBmGLameNVO)X6wYp*M@f8* zhET8@CsU|1W*rAME=~i4Rz56F%zW*DA9r}emC2kvn%=1?jEBnyWiI4j3k;z$xq!~n zc4O2UyFFOG4?kOq>ZGYCb9=X6(W}l1`Sg|fB7694zCn(-7?Kt6cIAuL6r+DpIUe*h z3WkS&mD$4QU#7JAx5X}$P6&O#>|Up@ZFH>-^zMlVgE)ecMM_h2lEK)=EPSIMhfB;0 zH{(_8DmN0$I~$TMFup&}+OMSJ^OET{O9L#6-^1fC)Byx;@-kB9=7_}`UYy+eSz)%& zuAs*+c&$SG2-^ztuJiUx4)%CmQNKXT=Jbb>s!O;+-5`;T7aLtqEpC7983vQnYZ>v9QEw*DM6|3i zF(;FhtsjZql2A&bjpu=EsxJKo85kAG|e#{)= zd7gJOn<

&wzLuRkQ~U<63iZe&ge0C|dJ10L=7e-MlC~eMiysA;Y|*y8nB=Z?LZg z@TiS6b)$2;-dGU(=?_JxD+p*^NkAdUv zz-{4j3B?yL4F(;DzPt43H^uVzzx%U?1K6Ln`YZfI_*r4Zn9M!=of9r8@2E_lPQ3gW ze?Ibhwp3@+WnjfoNAHRWF!jK9Z}~3)BGUj%9Oxy+AccQ-iZBBoPY1cy}bzP%-zG<#xnvnRph?zFWtm`#zRGa0~x^n$3f{9ZHlhVhv3u`s2QKivzL2BzBC}(jeA-i-PGzZ z6XQ|3uLj~~D}Bbee&rnb_b-^#*%J&LL42QvemgKEo;|M(GUaoQu#lVgy;w*U_OeVr#wA~RC?3e4#t$=Ku2jL*L|ER8vqsYcywSuE{#s#%X3U)hxY z&y&*>aKv(M6Sk`t8nH`bkW5aUstL&aR>FeIQ=u6A!5ObRD%%#ul=SE9kEdIirfq&_ z1V_=;UVc2;{^Z-;&q+x+S2|aId{_Mj>)o6av0Hz+GlzUGV6^+|J03N7r$5C#KZdFD z(;4-|N0N!JOUigqV@R^cW$xyaD2?hjx8n3J+p6Aa{@b;pCwYQwl8w_}0rx9urN4d| z#wRcZ%rG#27(UCu+idZ^jlB`UdPO-H;WGYa;rF)2g7MkU`>nxG?Y1r}|EjavUIex6 zeh1lD7|e3L{!Z}!45>dbN|LsA>-T5W5lvBu)Zw+L#~Yu3ep;WnGy5skC-RMYOwBi< zX~Aq9;66Sq@%mF!osghF+mub7s;Q zJ@d(V_}wE`GvS;&0V~Ze18jpg9Th*P*wwl5LV`ic9~3xonkVTf7~sTN8`yRqdyk<$ zx3xa;J&!t9lU0LyjI4NSo$*3Zc(ze*Il@9(?M?IWp!1TyoD62yd+e>S_EPNTi)@1z zGR01e)0I+`+z=%LmC^J1Le|fjROmCaMCGiJq~p+TZ=TA-xt4Q31cO2U-@61Hr>QRq zqlX;Imfd)G9%Hxehmo}M36fAuNisIxj;vS7ZY;1LkznBQUUj7iT|Au__C|k%BZ;oE z=2vIwLt_?U?4b9yANiz{xNpItoM!6*<24?(8u!EeNCszIn}WIK7)04qzrNRUy!M#| zN+V63&Ukek_d{we)=t0i{hzi67bO{>CKv2GUn{(*A+l*cKF7cTaJ}-Ebq{tbX{6DQ9$jqx*xh(ik>O!kLKr7<_{<`E8*Lm6CcQLimBlB z?XkO1c^Wrebbs^Pw=TZ0?&nzX;8#ZahBeanGaKlC6PAy&+y) z(RaL0+UK@WS{-Hk^&iKu-J-0<7dPTKez>r%F5G_Eq;TdKN@a?F?I4Kw!c_#prx3lS z((?MZ;FF5~)&e-wVOsPL6ZzSCg1XrgoOcFJ_+S=|j)AWk$#8N$@U94Jl^fX0zcrEe z#zHJ*8FZ$@Z|C(;TE|nRmr8_j&83Ebzo{(m~=G z&zx(~`p0|VFk5S^j1O&mAu(CzI(>3BhgzMoVR;P9#{ed@S!$MIc9UM^NuNwekYIZK zurH-2+49+3=g-osYBKMX_bc6+e2u~!=3g0TG$2I2iWYv(7)h@PK^NUNGI#^uo6hnxoz$D(XYY{rNrE!4dIwF|q-n zC&sfKTz79hg;8U=wGZ=~j)feim@m}}J5uBLT#Q8e<@f(Vq;Vof1LiQ%A6YTVNyA0^ ziPqW+HLmQ6Wt`5qy(ofLw}^?p87lZMaO*Ee-~APbl@E>Ha-fX)X{db%I)$4NoNw?U zddcI;3j3=e6K!`~*jhV+c-8rPS{rCSl!tqRH3H|R6Vw5V;9N+ulY z#7hHZyDZrh#s`0QD7$Me@uIOncPj4gPZVIXU6ToV=jDi3Oarbv(a87lH(afo-_UnT z^^bvhdH>+?DtnMa$ZEv+J;E8Lm3zfLsDUrt6A-lqwg*W9m0Y(jvgoZ)U=|v13Ww^_MHipI z&`%W8fAs*HZ5a#ck>(^r+C@{=+9&CMhPc8~k;r3z4#L|R6=%Pla~&Lx&#aC;uOrLD zeu05Y&_Vmw_Z<}k+fFMPLP<8}8im|i;6IT|r}gv~~Q^8=%$y>q5!CgI$G)dbuH|8#Fec^C~9>mUiHqrK(hnAGN z=g=K)1urLgRpCPDy{|ddDd_ysvzsl=R&KlZ{)jq24cVVI%Ocu#nu4aQmH<^wergWi zM~@k&k#!%b-k0|t2)f%0-O)TLEpr>RKpVa|G&KD5x|!`2ot|R(f{6_yI%1yGgF9V3 z&ImOu^^eNYPJBB2sVGD?&eOH_1ilWtqTgh8$zeLou6KLsEn!=v^DnXpXDt8J_<(eY z6A_%e{0(d5?>PW{!wAl{4GOJk7tOjc3ehv;M%mJy^4-rb%z9zgXCcrysqx?>r`7TH ztK=uw5_0=SL)81}54FB1HLEGMpGc)^Gt%2XUTy!) z;nWnrJaOY)Ja&x{)^Ylm5AJx64rv6t&l)mJUrxmy!(EK9TxTi%95)PcZ@y|2l|~I& zw}#^Bt6hw@P;?a??#T-v@;y<}eO=SLq3OnRpY9m>@O*0MsR9oSRk*mCOX5uDiz@nZYLML(leExN3H^no^_uI| z#z4t{`m2Et;Vl-1uP4StdLCbIJl`UK3p@8qHM`zoDtn0dqaUV4yx*!d@WKFMaB_TY zr-k_EQ&(_^ub&q!Y5BNI(px`;8(*#<-3zUFZWfP&q40SZ7Ly`aIo#ze5|6 zIdS<;`HQLaeGo^^sH+HPor+F+n~{?JX!ddFodUJz7Yh}skugZ9%*HWNB#iry^`I%3pWaC(TD zc$s)+|H&>6Yi7HjCvPwdtgV&Y!Vww>N96eypHy|>z!K|?FCG4z3_c9Iu9~)zq5kqI zQB6Odm(oP)K5rolbBXaBP`U?E5s69hWxHuzEecf?m+x9fe`TKpNnV5NZ% z>55MR4&<=S)f4iKpJvkCy~9pPJW%=mGy&i=FQHR7)0mJKj^=Cp|fk)Rk~YDy!+Nre9jZ7|E+MN z>?{0=2)9#>9f~O?o<(qLWnTz@h`!nXtV7*`O}S>(ABWxfLNjqoleGuX@Z)30^e%#kq z%LlqNf5aNi67IpmJ7C(un5}*u^|NO{%=#c70s{I`{sZYWXAUR|RJhnZQ^08LqR7U7CQ%+@Wiy zR>GhBX`xVckGAu33p2UNE?g0yHh^pFbBi-}rYO|D6wt38?3ZAWP1dY?$!LGhvp4-> z?n4bFr%&+-*YVXMOxfM59VU2!A-SZy4q8f%Bmsz6qnfYV)eF@P8SwENMV z^>=v){@&7^mOUJWoC=ws*QF*nO=2{u#2 zgnT9Pz(ou29gFH%%YQZofITM@42e|T^5U~=k3a|APW4xq_)1@-ZSt9Ptl5!N0m zq@Q+~J=9u>NVxG1FnUUy(}d|iMhBgfv+tgBb1Pu(cs(Gkc6+=4y7`&1b3+zc(23d<0}6;rP#qM7$hC&gw0xN z;((1UhjUi5;|<~ujUy^6bOafUuKhauKEd>M`Ijm6W8iGm3+*WpEjs3J-EnB$-y*7) z79;qY>$9o6^o(JL()`z&tX__+%d39QSTgmbv2bakA9!&(7 zyyG4rDXbNB`ib!Kk$v*=3wrC}Mj#E4IR|xo+-CgOYK;JhMBEs#&{A2!k}2u(kax-O zYyi`{4q!~Plso}tI*l{bOJ*|I(J}9Py(@iizyyeg-qPO1i=P(-tZ!5r=SMb#gokL& z^`Z?d-;<7v$T53Zyz+tb#?j9GhHx6>Kce)u)6C+>)*qA`3O!-rl($e{A5G0x)b0Lr zeJtLf<-U56E>H8xuVGp*gYF%^d4IC*$6&rctA1=7MCpNf(37iXciLpc!K(##$Es8Sp=Iu_m$cIj2CYQrR?8f!eEXZ?q zA@X7`P@%0B-ePN$=#g0dWaMGw!7k{fiP|wRv^cfox6a%mHUSsgfJneq;bon|Jk(Ov zfR1L;W_4R9o8!{nSDkk7wJ>@)!6%dV#OC^&ffHpQd25E|r)=jQqzdRLAmITKdK@ISV~(PLM5o0Yup)JSN8TjCokm=VO}z}P$!gTI z_~JW9Yhpdk9B!JU)bt=|rs47_7K2*}+idine2kK+_ie@pR%0&=cng>^wEU`5c^lf5 z1c&FG8v_w#Y6rdwwZ ziN=G|2?B+lMtiT4*@VvAx1J1J$W!l2tMr|-mUiw8%`DGqixy;%Yn|;oL{N-|e{k6~ zEu0ij0Vt--aTnk1MHLc!&sbybQ-ij~<>z|AoxkCwTw=kXQu(5(`ZTJ?QnvMCl~MIi zEvC^&93|!|Q#@W)^}$ZeF`BU-L!P3d*Yh4;_h#Bs47j6%)(JIKjMkV1JTfh^HS5v7 zd$Xi)*~1gxT@f!Mxj*H(qUgQi(m0Q}~iJq?T~%wK};IE!M!TYE_XB zukpXr=+?Ks^iboPmxGB@pY(7HNIlE7cz5GC;_QH8ckL=zh%|M=^eL^CpQe z={!8{>>XTeYLWS|EyeP<)3*>Xz(-$jSH<54Sxm8Zb1ThT)w(Qw`0_5{-*uSYnc}bk zJTr$_A?0p4T+X#gYietdvKaa`eEsp8yFqzXk9<(aC_;v%3_@eOUJhD0A6NOk(anTq zMVSa6_CDUH(wDPqKhaL;Nq)9klT^@XKl;kSw(N>;@6UO&d=GT=c;FM&q!_Z@R8b?| za^$%DxBhWlb5;>Wu)b za|mD^^_Z0E^EleV+vakMbpXsGSQ^-Z;$&yz&$&Olb!zaz{#pAw-%T`YUNA&5uu%l- zt3K_qy=pqEd$Cj>@z~Uo^=r<;sgOfy*92$Izv&-l2AXkl4AGVNd;UC`uusM>WJC(s z>z6Qm{e>dIAQ7IbXRYZW6Q^85`k5leP_Hl!*L*YB#9z+FS+U~xq~L-YPVg1c_(A5Y zagS|0q&LONFLOsf2K49QM^&+>4C#@F5@rCTOjk}Qhu6dLk9~LIoG( zydUy;v+UI#=^#w*%)Y?5*7#Ti14n)2tAWb2yWV_XZK`z*-_Rre^BsR4e0%lRJV==V zen02cP*E8_``A6as$s!Bas4CT1^LH!jW6}lNd5r^>e@#uvGBiELS!0<;@5KQNbs|~ z@59^MsJfaS^d?5`^^f6fO>jY{7pB6_2Pa<~_kODWkBKPPadZaOzt_XGE_e_a3h7miP7caA=Aw7i%P!D2gX5HQ7lj2zjU;n zLwrg3n5JL{nr1ucHj{OZ;3}{l%P5h6J6~gudu9(%{1y#3J2bbUr<^75$%v(b2xLr^ zV@+F}M%2Bdm~;*RNI;aqzZjG2JJ302$JCcNF)uEen#Je6MJv(OURjp_9Bpyc;HB|X zI`m7#eQT8FbSuPM^bI{lX7i%2PnY3kPK+s;Z=0Y_%ni2W|FIdx`1q^N?S#{x?c~xu zn7^w|f6g3*tO?&0;{G_R^ikoS`;`cW(5t1|!l@m8qjvJw=JW0Q8qn&DucxVv?u5m& zNiO!ib2TcDO{UxjQ8)UI&JJ$#pR@BEz6(bhY8g2L07FGX)()72MweP}a@``IMxFEc zGfm4@=CiJjj(4Rq#c&4FL;S9dg0DW5oN3Ux!`-ov5)3}g7ZJ4n?a}t)xs{bkdV|FS zp91g|g+}yC?4A4QY>nRWQvgMiwJ~QeDMYufsK$Ke&M>YzV|#V$H%FA@Re$Eh@9wO7Hah zKb$A8HDvD8&g{5G2$`6ER4sbHe2eGw1u+xUMgztps4kGO7N)}fit!ibm=#9 znk>a2y(mmU^~Sk6F3Go72#8BS=H!ytbFIXe+t>zkIIGbq++J3n;VM5n?&ZTWTfV?$ z31-|M0leRnpDt&?y!+M<&j)kS{La1X_nlmqysQ1&P%mQaDeoD9cdoXFrg#PQZV$mw z$3cQs`He&*oSU2Qqxbb9$5bl$+5fNeb!J+vnfMZXR1 zL(mJ$e0MBos#37@dqTTcfGY%7>)w#&T!Cbx7!%lPvCOV=FN5k$hMLf(B~7q_<`z(3 zTvKQ$8jw|MHRHvxhmuO*48}bj~?qvqU#e+Z+Z?DuDpkPs49MgJH#-I;^D21#4&6wQ-~j2U^Lk!f z!_|DH=AD2h)2PZny{)+;{gwF_Lf7p&f2|#_oZ;000Q*RHeK7k{z_;up z2YEiZ;KwHj5Ly!dyIwu3{L05fT`Sz1OzzQsT=>BJ?MbCxwRyj8sJd#qw35}n%XqAR zaQ}HOB82p{+9HM6dXA=YDfmGyBIthdZc$UY(S z?h&t)>i&mUnp4N<=4N-z%Woe=u;Kp|!Ol$IOx4l92BTYFLP`A9)p8W^`+eqtx4$=T z@myp2#?u2Ulr)aQ;NRhQVWjPO5Sz=Hnejbp%zrEv!h%`<-7o0PGSmCfXFZf!Lw9qj zG6WEXV(b=7HzB3+B7i7fSC;F%`S*N{pS8_o>2CjQ`&%g8|G`nI$4#(Ie_n;UgysSQP-_qOWFf%{iMYpao+p7iuGR@ReZ1SM!E{h)v5elG2+Sd-Emv`JwE=$#jsmH zq>Gi<>SzGDB@^F(FiinSk{Ao>HY{g;x~Eih?)_~TYhGzW0y7`@YjWU2r09!THO}~P z0NmV=eXbz@2X?g-^*=}==3ep`#Q(TqaPpITS)I-oWEr6M${Flp%Nz<^9TUAYHx*@O z&Mpm++Rxtz<;*XGd#7;+sWHUdk5F>?gN3B*6eRp7`1}jp%z@xjYN%^u59EwgG$j95 z@HvL+50e}8Z5ZvBoE6lW=bOETWaEpuGD&C1V2qp@en{faIzZ9wp?XvFbwwEl4~FHS z?gOM$Zl}o6d1!yo3we>s3ZsqYu>byp@Gt`IOaw9Fp5QHkOW_#L)b&l30m;4@n#)~P@W zf*^txsgpV~=Y@ZP8TaxSWPQ8%k#{+JCMkfVu)P^ye7qq$OHfOV4}5E4JkyM)A(>Mi z8kJX7bCx}HA-@ACWlC#rPh|qBX=NhW=r`x{XVyLheS)WKXXPH*Hf8&tz-|rL7Gn6! zmZ*AUTk-$Pw!h3;&RXwr0e9u>atQo&K%DQr18nPNeu+NTI^*dbtA~_bP9m^&i3Y+w znc8jc5T2#%AquF|fmYdDF0pa2Q;p?rV zqWZqLVY;MIT2NXk$)P($8brE88itk`EQ=^k1@y1To(V`koqzwh(Uv!3<- zrwer5v(LHv?7cs60eEdryMXYXgf%m3viQU3FZEojv7f!KmB|Iql=?n@+P&R2&U&lk zBgo}uLt?)SC(|om!53N$T63g>zO1jQwFIo8FE20IEM6NKFnoVtw0YiT792>6y+5bM zOh$+1q}tF_npA+XY-?jf(e_?}0f_(4RUrPnj;P?>K#=a1Q(zhhD{~8-B9Nb8bf-f6 zB1dtYABetiKWn}8WAst~i#`qz{g20qMnWM*-sbvn?dyjNUrN^pr}t!Xzwr3#JI<$9 za_E<`Jc#$z^|{mQAZwRgMTMo=S4zS)n`hPA7qXAlXPWy@2K@9<*_ZZxN<`{U(O;y4!8|L*f)C4inV|L4h zYM`)DWXf#PofGF(Z)OC?q8SI)xWxY>NFhcehCAQH^|#Z`=P_ z7FO3uAP5m&aBeLjyU)DO{lWf$6tfY?H`i+QU!92!#Y>SuVfWaoAGU_}h}jMAkVp37CA=1C%+C?4XMcYd60tf~ttlx!s?+|~(YmOG7vOHx%^VE38@_78+n%e=xBMdb z?*DKBP6bc$-$3fxQ>`_b%Ax#vjmO9yb0^||VgL88Hp3w&(U1{!Y1KZ0?CbW>5nG5S z=-OpERh)x;EC5CyB36@AVKgINuDY@raPwjrcC>p@u#E7Z)kdimoMi=L z<%wMkfxC|c!08Gacm`AzGb4iA@s&JeYp;=6OU9d6H)H#O1|u2HWPtKW69AF$5f~RtsQ*J3v!$ z^A4G<4rQUb&Qj;s8>q%+Pz3r$NMSK6qH8ao%s8vqVjv6Pd5)&=*~U|Y1Sx@PK#lHh zQBnV_O#0LYMPgW*fW3e|N+8bnZd`sQ0y{{OCkFrs0-mtFg_cMP#MJV31hBYt%E}5* ze>OLgEUYH2pS`^k5;_E9KMn!5GHj#>N1kXElNT_MOv z$>q=tM>^QvbgDDTf!BFxU8IMTDSG|s9N>oAuS>6LDhL*M*)s?V$&l!s3UF6qptNW} z?h*l&Lp};h$T?gxKEel~+YOR}GotlKt5*bVIgY=gY@{c@n6?Yf0Fhi8I)FXEFu-DS zm&nTL-2O-ljzAzqOR*YxF~K(iLxS7Xjr+fwcFH^P&p%lK#eYyKDdpudT$`Zp5v0LB z8WvBt$yNGrI))AqOdV;@h7mArU`prQd9zya%{w(AVd??k=O)V15nb^>EhNezgcyTi zDXCAc#n;lw{9ejHBxkeED?N$_2@VDHqMAk1W7xp49lhFenAvr~sb_SpOYv+44;36{HD5c8_0>nR z)d%jG;@z)&(8{cml15NAH8NtdgZ;x!QG=-z$}1^G6(qV}#QSS`wR*oZ`h48`>@?VQ z=r0j|J}UtSrc#xb`FVo<#i4pIR7KRwHTPQlVcCGHoyK51h2vRA{wrw|510AFC+KD5 z`s3zh1~nP{NcL0q9xBYyQHb;D5Xs%yTuj(`GPLP9yTN@qJyBa5 z6KrzLKpYM;d-^)E`D&oHs)y?9rw(8$ZNTQ$Hh9XMF5$6@bAl11R#8z;d@MRUm(Z$K zD4#)vs=D)@N^1P|XM?8%U@7=p039c^Ou z2V#w8a422IyA>uAzN*<~(t63u3{mf~%|zoN_-gAS1JIB3Dhu1A`^b4d4$wOzZr#=N zsc8HOgF8=tO*UcfW=Z-Gm=GyYHo2K?E_ok|E@q=Zk;~WlUItOLQ4w}8sFiIn$hAC=bHGlS|F23$~(<`!&q^)_~~cQ2fBVVRB!#oeN*vTbyR>kN@{MnTT2q%A)bKAaZhn^^H>_iQxpNRJQh#vT@4H+4yD7pKYUkFnrfZp@ z68+mK@m_EzkX3PdI71-}wT#j2EsyPaE#_R7GGaUWNk*qPM1e0mUEfze^!b_Us>%6oWGw|bjK4u`r(NHa*NC3Eo#={ z(!FtnjWNO*9$$m9X?5U|rHBeDbWQ2PmmN?IqCrKj*M;72gv*&7Z1-yV{vmen)|IN4 zddr(&z!7VLDS`zqzOjr?^0rAm(|G@tzNoqx3=`7x=y^UdR#e{_9;Eo)!@wzc@Y9&< zNjv6v_%reBkUI>34@5@kaqF*LJ*i^*0rn%G{~1)EE!sX+d(6+*$F5S2W`Uo=qWFf& z;V`Scv!`fpq1BbbP++UorS*K-QCn3aR$Sy0QlnMxYmdMu->o&7N4g6HU*uJPIWX*INt@p9dT9Z5Hf=b$cpF_0xB-Hl#D0<`93h;vPE^-9%6jpq2Fjm_FI>O zQvpM`*GAb@CI^TPq=#k1WZD%Np8PpT-rn+M_n)v=BAEDoR4VL)_vfQ3C&CMe>RQqx zNKWiqIDT(<{>l<|LxK|mb^aZ4&;WMZlRLDR$4WlHs@xUAUZA492<%~vTUe8ro`l#^ z$DP-8Gnc*dtV4M6eVhfKQ1588;o%F6QU$jf5q@t54nnz!ub2{rUuvOv%8*oqHFhWm zfnmt>lat1ZcW=lAW&(tAdWL$M+{Xh6IPwan%Z5SP`VoPR8O?ERhzyq@7E0l(oCkr_ zR2NPzq@zDiM+#H0$u@hg#N)1x7BekTC8+#BS8r(yu5QfBcpv|gM#ywH?9kHR5&P=t zMY~o^tL6ztqrhItxYfPB!>=Tlo$Th_Q!Vjn>}V#^Cl+wq438iAD(Sx{k8=cFcES|} zvn*7HDqSr%C8ie3-k-l!}4Qa92S zKr~c7Xgj(Ah2Iy~L<48+MUVAJ^Uc;+fI3u(-wo#+m_ope2d%HSmSgP;Qs$&Q%4IaL zg+pj^Dx|i4<7~#i&QXy= zNvw}vDP_r!l;(P>XA>5!CHRA5+U=tC!r=1V-&^7JRQ;NTdBg%`tX;vG;0U81)oA>C zkrzaqKfDKc`FYjs?eWg*8{C!*?xGP7DBtk`v5uvIJ-II~8MQ!=Wc@=MW0=-ECX#{m zPznM*zNf>;JRf29^G4ax;!Dbz2e&~{0&9*!D}Jbj!|L+tY`-z$-h`y2=<#DJ;9y=r z!9x_D+@P!{deE zrY-n&yEt5OTQ%(`PArCC>HG;B9)*wrq3(8OYtp>RmlttX>@(t*m*KF^uYp20vuqDV zWLMF^AeHYR7f}_Cfh)!@&ObUIf*>ZN`qvMif8L!~mqTM7dJZ!bayV#kT}g~T`GI9! zYcfQ42aDjW%Is05R!roLtZI%_f@XbP^4|9OK#(=Us7yAlK(8_oDnDOo%_`b>;p7F` zUY?a5Im;AHqLt3(L0keG6Md8dh2^lve+;E#A&t~vARa;mEqY&=WRD^(3?w<# z?Bx})biWts`dAW3m@}XfC&VysKNu`yYi*t1-3=bFCqta<<36$@4&t{?KRO#YiQe-Gmq4BcWPFE>ps`?p_ z71$v3Cl(hoPC+BqX?>XXBN~q9%kZgv-Y+|+vX!FS)#FxOIl&WE-tPL&iNV73n2k&D z>-A8`yYr(4`Auuo-fs<#xQq8Is(ey=3+H6b0j3C~pw&+nO$@}PXm8MhWNLE?qR6fY z=KkcN+htam4drPYdj^Xp_!pdtiZ@4N`1%m;lP-ymCSAr<8;hg|Tw9#xxO2}to7sGVvUy=|& z1ry@qts00gT>7&cN}2-goP}=IvjY^+mvWW!<+m$LEKZn~2v(je2twPX5qj(H`U#sr zTcVsjCpG|t(=kYIz{WxxPI&a;tXBQCmhrx0fiFSd=v2>PwFp|G;F4D-dIe&lICDkyc^J_>_e zRpQe@9j8$yBjGH=HY%s|nT*~~`tTYQju#{11$Oe7d>~d#W=yyG9z5sXwqo?Q!3$Q) zqK{eOYcf=&4V~KFTpwi*!iJ+hwe=^k=eg}qjn=im*i)P~wPdwcV@bZso;Ns_RI~RJ zdbZ(`PQXBY`MKo?f$Q`)I{??#(B6>PUIy-ors$=c{rT$KP4N*b2+Wqq1ho)P)Cmi=N0Ff|<<`+e_a0o_ zCg(T~@3nYxML?5jh3$DU)-avoVUM#ST@CqWm-zm*>qX+q^aVb!gBIl!7iezK43d56XmfEVl8SIwHijbx7$?zoqQFEv5ZZT?(s z`^Wc|zLuI=-l{KuyxJm{p2t03@?$=M5*^Yu14HSr-8l))t24XC3G7||Lx^kDLW&ef z;{Q?uz88Yi{h`vAklGQwo~YUA%~y?6kx3H14+i#WY6+J4V!wsbu0eI>(nK6Tu|o41 zGqy2WkC#fhj-3LZBpiu)aj$f<^x!!t;VKpLe6J z)ysDfO{P)1sddGlgdTR8wPlL$Q1vV$IFov(UhmoIeB>|h!@l;3E%9<;tQfAqo_cKnYHh!YSxiePp+ zGL{xkIhs%R^h?%=}@SCPY>w~{f&bm~{ zZSd;bbAJjS*GDFZo~&ya{&?WW5$&XpYU-zB`- z$}~q7^RJR^`a#G7ER>NIF{f!r14vntPiL&EV|qd$+n(SbPS0A*20B$m!k_WzSEmi`RhgRQz)sM!Kf1Vs(C!Z#oKS0zTyI4utq0+LP9JA=sbg}NQx;D|{ zs*pX}pM0G%keavR?ZB5{UloQZjLxX3x@<4@IWPEm!FwPY;}iXb)_t1?m0e*m(gmVq zi0YP>C8EET&YSOmu}QG&#i;yv3ZFP@7v=3D6XuEhQFQ)848NU6w}rB&EIkcQ{pJU#U`mH4kQJkW0^PzA7<61WC!h z>^DKII0uAIn5-zXb@$cOS+c}dLFh)YypeJkdFF!yg$^XY^;|^@aB%hD`L_Op3V}%g zF3@|7(Qt1KMC^{Mim}emWB3i4_0#kQ@_D7B`sr4F%zlY>d=AILe~piet*0*8Uo$Wn9W_*LD~!1V5DE+!tez{sm7N_!2qh=aMB2(gs~LI=U?9pGaUFeY4^H zOoEi~{Se)q?b@Bo;t^*!RLKI5A-;-e~=5Es^=X#Z%xs3M1z176H?r zUdOnsc7MCpnXKXRW0^G_b?S0CHTj1T^U_7Xe*F1$LTjELfgU`so4Hk+4$}@9R9gD= z3vqqO-CdeKTSXv22ImXvAf&eg9lO}0#vWG`i}{&I^$ zDdJJS$n?qc3H3~)ISG3!1Y5NE6h!(iH%z3Sjl1tdMYeQ{g0`_c4<3cy>tVGKOl|Ai zL=*?4xrI8{V0QRZ986KjWjWcBSR#NcD4_`8=gr<0#ZN&Twl^Z-(anyygN;W_LO-uf z8ABX=;0g?>gN*H^(bFVQbIEeEmD`R(T9KnSRS?1)+||Kv2ei#SFF!7avy+&U;fXl? zj!h)!V{o~OCS6cq!1?OlTnmwT`F2HaHDvDmPf9aghyoSJiOq2AXONPMRQUE#)j$O7 z!bPRvWdW|~;0xVzP1T2hr7!lv_p`rf{rGt}QhP-{N&Kw|G!UBOuQrlggHlma>iSGP z=U$WfKnBQSbFo(X8`)cdK9{uGIz=$qbGwZmzUaP`cYkb4A z5%3^9ph04gTOG5pSy_#t;^#EJ4QbG&63QKDLxJ6I*o#c_Nt#7?AoF`-4fP+>)r03wRzl?_9@lKrH#~) z-fPN=;LRVD!Jj+>w%t2pC}htD*-MK&GWq!22Ies?Wdr01Ix@d9Folyq91=#9(c)vs z!K*p4o-0h05u@Ldt0)}JEj3Vj z4nO%=X>(dz5$+#QD|aVCn*U$%yWZTahIUg`|H)0yI1Cwhd%~Asr8-~u}xVE zm?$HfQ&n#7j5YQ9jSK=Xa77Zj0WIeXw%jGQl40YEl2Nf0KNw1x!3>?nm8xwq-@QD+ zTZKH$A2zH|yUi-eF+-2lo!Gw5g{65OKJA~?2YcGgdX(=&qX7{C4l|R{$RDWe9l@TW zqOWse9wSqTc9Z!jHKmXgvVIz&MAmYNcgRrdj)9?xSqA~r_`NVfMQ#O~R{W0t>|47> zO@_?tmHZa}ttFniUjs0Ajy&TMI4wVWv!mnMHRiO4+J+XYiRFbmM^3_2(94sbCj)nP z?j2?m6*vn&yk4wTL(aXHhL@p;vulXM&Df>hbACH=(T9^xG$eUNpk#Wt1Q5b6F9`^Y zXI{K04Sgb!WS1|RXg18!6B*|s2i+}vxqxtede~861^pY?H;OGh;X~&>@116KJ`T zI{BstO#y*l*-Kw2(W%ba%@OY~-kvYi8x+~Hg84`>>v`@@jYsp~rpTSaYh9V=JZWTg zxF^5UI9s)IK76hFDOjYQ{V^3~h&GJ_U}?cu<#EM{CwD8a*%6bhw7L6bspjOhKOI_; ztB-aqp9g>>hg)CJY=rCaB1pYHUcT0^Ob8a{!F;#hT32;0hw!HLVp$Y|5T$!g3I0n; zbXX|!$QfLEYg_}D9oAtq9Ob~x#uB`TbET?Z31FQW{ysk$XH>1^8D4)rgE)?hCd=Fe&r@ve~f_m_9Yte(|N-m{er2IyPQj(Mkl zwyesyJ_pgpfbLtBncf>X9l+iu9bsG^Ev6##1E!lGI~9Ph| z@584`J_6FOo?whGhvJ3u!w8eh732#D0-k6}wf3CYnNe}?HFbF|!f2p@rxYRxxfTQj zk&BtJcB9_-6Rsyp)};5`!fk{O&sY0T)}Chf%MhQBw%O*L*kqSGp+K#Nf~h49b5S+W zV$@W=-beL6fpw-vKQSlcG?JCzVbjiSx$Pq+Pi?dYGc z>+H@A^)t3*%}4cMb8Xk{l|Qy!w0y9br7!#TspF+rk>k(dR9wxFRtfu-BaV)_yPc_jpY_+IAax& zs&*bAV@k!f%Z>C?&~N3cdmk1ZW=?%z+(=0lr9R|BI4!V*QaiE5??xQ{p?3IBqNfOBxH{A(lv#u8rAbf)FK{ zUtbpNS0%Zf1r(hlP@Q2-T?&?mZ{h#uc7OnU?bEhhPx6C3Kwr$Mz4K5)PY7Ek1W_5W zrNvBRWDiM1M&bpLQQ;I~a(Hc8&9B(+dM>hrR{B1uS3JZqx{pH}K-)ch_je5wyt2sP zz4gvBgIMvwRBjN5!^h1Hw z=GihO=*0}Zc=q8uAc*JU@&l=sJR}E0De0)7+pP^>YH|}wF(rNf%wpjnj z*!$4aA!`{Bbqv<={U^xnqYU&lKfZMk+v%$o??(rBM^g3VC|(@Qj>ioEJ^fc@En_TC z6BAXxoY-GDY(%YHbm~P!eowgublFG?C`n(?{xm|^7k(0Rh^)mM`XX9J^<_N7VVsrI z>kO&h+Ug*7SQoneeX&TmxQMKl6F26*mD7&@K<3Q&Ok4;5z5DUdRHi*Z@f#xKV40Dm zz~@mVQ~5{?GNAht!~j0=LiR(6eul)2-dCB3YehyzoP!!ui)VycCgT}rauNGtYvur zHkxXx%h26tU_P5GPmf3IOpSLi9U6j1@u?%A@1b*0JUPAx;*`c|?-OYRvBk7sx_f=N zIA4+yz~!Nt`~X6+Kk{CANh$i7`iXTw1RlG`c&?=?DL>weC_d+C#MGT;V&iH`a<%I$ zOjgUA_RE`em$^dM9e{MvX4bOx(^|KO7&9Qg)yP>#vGaGiROa!#yh962+v{{QaW_vK zUSZ{m~FR4-^2RV*L;!R2j<2tz5fSdqg;{=C-9JOX9R zGwzIlk~F_fu~5lB@9`}wiJz%#jnB}#RrEUhYOJQHXxqY$#Qg%$paSU$zi6g+xRZ*L ztiIu_vUq23x^_OLj_dCx46cvw*vZ^*;7?mcXybi-RKw?Bq=N#IvjeixIKUwm;Rh|c zez(@)6;%P~rK6Qajql1$HLSb3M?-i>TvlEH-kri>l_y@3W;b`#g*2ew)s%i+d{fH1hRJF!I6+kgc>C=;~aa*5_B{ zc9BZGztYV8`ScgP_y)v1GfpoA;ZZvMeFIYdK+x!Jc~*zFV3Klw#hO^@^>XwEluIp; zrY!JtUc>s`_BSNat5vPnP!}0u$s{$y=PvreT*#`=RoLDu_@o)eIog1&%|qJb0L)!~ zdnpYw?03TzQ{zLQE&vAWc;^1;kc_C?zdBZOY9}zrfLxal$*zvxU5lnXyfr8khI&jLD?`8I1!#xOK5$x7TAs`TX$o%zBaoB%5jp-=oy$Ee-UJX0a@sq$;uJY5n()d2D>$b= zwME5f@~cxpC?}nkOr)%7#%rK;Y5|;nA)!jP61)87lO36UrILYPBfh_x7~}d32|5yx zJ$C=rYI19p=dKI}Qmc!gQTEl=FzOsVSMz~pAPXabZEW^fjFu&K--i?Ce^^4?l#VTB zwr=qh4ZxPgU%iFj_t-XPFdzaqAtTMg-&^TdLIPhTaXZh3g{IGfhUg4*P7(_jv`9H+ z=~v$bOSw&Sa8Ue^{xIJ{?u?f$s%FH6CPePh$;o`u7@G%Xo~_ijv+2to>o$g47`5tXZO_@3 zWhYm4oiN3BK{l%V>mm~_099DN$Vqnte4aQY{|$$~T-t@(+@6;KKe@*=oszj{CS?t(lugnzP+5^eH&I2N zI5mb(Vl5y!HaI`9k^17k=v@mv&Y{1jR)6}sI~*PjpbU3*!aB@C^#-gAv+sOmx{q%b4L#AUo2F8KA^4 z^g7^sK;S9Ezqqd&;z2Y7S5)hKtM@sN00CpHr%KK5j^EUiRTQJ}xg2eN} zqjN>;*V}rJmFz(sjfS`BuYY3og?oYtAvMiF0y&LePn z@k_r!qnpv{8jw2EHJwg-_Io>9e&fW3#8?fN8G~JE7iwOIrRk(LRAknQHR?i^2pKbVt+z3?wfs_l zb=0Um;k?)`PNwbBsqJuV`4f{oLJhpjKO!Km4Wbg(8F6-Y;CLJg=872k+jqO1uv{ez z5tyEqJS0MD0IjqYD!jP!^QxO z=8N}4J7%?Qedu7{<|AD_k8#722%v|KL2XOpu)cq&oBuxFhIhQI@<=%#R~SUVhQr}H z$Y8*Fy9;WEFMRNZRXHUAz^7-~N>VV!lHbFl7^$Ov9gxg`kSrudt-jgVPV5(pejf_u z4}_5v6`Q}j?i#W9n34LHp{O!Du2)7ZP0yf*3iDb~1e2hNXvJq$J|>5% zlE>uG`~OG|7`NszmKbQ!WF9S!eV=elg^}u!JXX;-Q?^JMr*Yq&=Bta?0`6L$SGZ75 z&>60%zW!S8kGMpB?WQI#_7HkgssWs1sOM=Hne}+Sau8x`qCl0FQside^{kgZV2UO4 z&ON{We>4>3p=csO`&xS=b1sn-0X|Ph?^ip+;>)V?G~TtZw+9c;x5t0J;&ER5fPv^o zwiiGEx~h4w@!zwxo$ov_PHhW%6_Kc=hbL!fEDx;@V~G5wt(pEhwIlLRK8`QQZ^=B2 zDfWk14JBr(9gKhBW7d22XTC$JuvnM0`ryZ!)u?88r1eW9S9CmsV3PI*LtaF-wfM%{V4!@ZDOfK;4|ZXfPXdcU9P+5csm z?y3#jh`Bh^bK$9gIeb1+$`Zi1$$i|DHDi4lpl)lTfhK~U-BTY@I>-?oC5n+23RIUBr^J5Y~I!zgm%V#+4iXGp= zR)V9E3ABM3z`Pu8VtzbewD4Lo^Kf4LD5??22kzTeQz;v*5a`st0#MDuF&CS7ZiP|6 zZ?srF!PSC}E7;>Hia}Hnax5Kj*F~7W2es+98jy9+PB12B)Erhda&%bYkrqU503p}y zACifM9F-N0s9NnZBiDZRb1R@)m9$OhfeC9aD9T0W6o5!MsJ9GwV!=?0oWP2{z`;x7EUwdh$FNg5uZ z*Xz>he26V*69WYSbAP}fX0@hh3O>43Omx1$Kmt@4ElbHTO%W2rrZIb)vh@hYm}4zm zb_H##$o}vB16sMDvzcw$J}vKf2>CydY5aZW=2jm65E} z^lb|lv{}IpRHMm~3aja8ixt6lJLN`Aq!D4DoI`r4M2W@uija8$8y)YFa=_Spv&J+z z5-qgHvNu&qb+`n>KAb)Ox<}P5ymz3kl0T=gC!o1N?*&nR#&lS>pD=oots=nzyy2xR zsdaX_4$-eY9&Q}0HLi(-&b4Zd*yGle;ch9s1J$KwWwPAA9<9_FD08f?QQE_%^hy-EJMF^=OHb7 zSe&2zk0ujBmx(qKjO+=CU_x7)drY^QD*{XiAyeeM_+N*0{98`M5Y9rH?^U7eiX=Lc zR5YR>-G>tO6#yF2EDBl@p(;rrX@^7!s29AGghPL8HH5FA@8ME7(czIVWJVphFf=!< z8+si(9FHcD)pDm&GN4eCFaLZ}P+rXS?J%yFj3+wHefd_{-p7;`cBkDcc_6wqi8=-t zwnS6^5Of&0w)*=@TIY7l=YAKopP5^l>Z^(xwJ#r`&DN*d50sRC0~h@kW5B3(XfD`J zMSR;;=xnEK1n$Fru_Sz4(ZYq;v`sAZqvwMFbp;Fwe3SO*wPFbJwun^*==QlVp)ivy~ZHBuTNFGDQ6tC_)|5U2v z*_E+JZ#Coh0ev|rLVYd^%FF`|i(Sq)h-*`Bpmxn|x!x|jWnpzexCd5E&BZ+YqqHf& zy}M?IMt=hd1OrT1@EqGga!!Q%Ml^bz!GNzl&$s-AO;|~# zMy&RM$s4lkAXK+V&6>ppk*>H)Ry@7?c@&~%+-Pw$c^mUd&J5LqXFFUlA7(3E*nqrX zGJ@m)PV)W!D)Y2$e^1|Xbc6^e>%9^%f%64`XJ5d#RsK;iBlh4(b{`M)Cm-Sf!?{Af z$Ybhyz&)LuUAHm_1DD(+FJ+w@=u!q6i%PJ(8PnCBZ%;+I(}?7jWgJrGD7&Z%a;0Y> zrc|edWhdPD!Sp}YmIPN>CMPE=)hfyZ!)y#z8vxm;sabO5W2H$@&V7yGPPWNy+-SwK z@Kk$$wv3wpIfp5|cbUtPK7?2LFHexz`j0^iY)>1BFj+m$jRyZ|-0Pq1=rVZb*ctq3 zIv%li0!?Xe^Tr!JZTe#0skIG05*}wQ(|bdFr)Dk37xcqBUwu7C@pEZMCwoJXw%Vzh zh<|3@toQ*Kj6iClu!}8Qv+V1#n_wG^XGK=N6NzG}6T6MvY|Q4{|f&_Z5A04-$6^InMM7nkCMjaL1%gS10|@2#&K zQ6~75lUxOoWnW_ct{*V{MIwpC})!*m57ro2!OO5}}O%j#hK$Z$5 zW~R_nYdNns~R~Qp41zgD4rdqM@kiicq_BR`mZKjTD_qyp->47J5drVMm2~2% z!%lTY1@K3gnXr9vYWylF#Ar^u3wri%w<~h=H{)aXTSegU`t#m!%vC3PXLSDP#U2(Q zZrWu++JN(;D~IPTmmX>5KwA^~v{Whfrc=1l4mUvISzfQWdvKI(lfN}LMRd_Wn~?x} zPW)K==ZNz+`uJZ#f3gg}3@o0y2eR-GE9bj+aPRiXq49j4+kF%emRradUJr`bTfauR z0|R*k>SMP7UoSAy+gt+!-d{*Bs#ANbt44sYasl3&EYzQc(ZX7G0#LvnN!8dSOd6Ub zA0za0B?B=k1Nsxovf2aFHykUbR2}pF#c&}mi3dJ^*i7t~8vWTvf-Dl|5BA^%iP~2~ zB?b65e#|zxm+gH=SrV~Ij5kjN%wA^MTq}?vQ<xdqcq~vw7P%bN?cSXe0?om!{_#%%$XA{MeFFFw*!=I`>}BHLL3@%HdwdX_d@PPT&hAgT2mJezSs+X zZxwT--zbw*Nv6ua#CnJWBsg@;3x=rPrJRzypA>0KR1+akRO6x^M?<;hQ_H!z%|y z$L2R7D^r==AvWR=Mg*&^=#40)<=Hek_+$*F!AjtzMRnX$m6u$hc)n3RIf7)`row+e zmq$D?uvswy`6}<(t*FdWJ$0;d-9^0^k?yzOESAhjUF{65DEw{IoN#xsyY4#o%wRYf zSi*Y3+w{|A@bM-RNJYvgY@G+iUhba2-gxgUPU|Ge>wpTf&tabKhPH99XnG<1u(4+7PQ578v#lrhR|QdTT6b`!XyR z$ZDohsWNm5ySN6r&!i624a8pj!6fkSPDoct;`JVP=Xdn>dHN0$eZkJ_6ur@=8<(H3 z_ysOOnFTXvlx7Q>_J5)IllEU|##6e-W3oHR+e{N*qgSu4b6_|;g|H9-Euf(KVPpFce1_LY)^zP-UmFibGxL?6wj%Y7W}gRY6gDce?UP^ ze2SGy8X2UuI-bU}JlmFjMaJM*^&fu)ko*Lh?oJkyMUry`0C!qO=Frh%llAx$PBp-x z_kJ-;GSI3kJTzUUj%31x2{?%LjCz*9*r`c#1>;4}N%peI;^oflch5YXQ#RxzWHo6; z-%xp;HNZ;$%XXS--SBSrY51H0FU~LaNoL5lZC6Cf(mAjh7S87xh%G(M=iA1G@c^S< zgSu$wcvmTW#e4ucjk3s8{X@*X4sPaFn()7OMj$c8n=kNtD|e{PGJ+AYIBw3&t^gNa z)tfF{SAsJFPSg||K=$Z)#^4ypW!p|w<%vt{%RQJbtc`vkknX-Y_1}Wk|68!dEUI|^ zep!0_@eq!O8QR>;>AMPHapuiuCtLc0!>LkFKD1F0Rj=~>&+hZSJWd)IyeW|0>a=BE zT8d=v-E?-na$Ikw`|n-Q0^WstKJx<1<46B$9#4;9h>QKNsPnRkaKKdV6@KsWlH-f| zOWFTsM{?XTXAF0bq;r zf7e5w)NcsqXRUpEuVLVrBq?-y!&CPI5cipGix*`88{lER=Ae*!NF1;|4PfeniR%EE zf+8HV-+%9DarW+en=%rx-@j;&A0;SD=?JY%F?n|<0;)r9xBPmbnXqkg>4r2l3j-fs ziFJOohWng{x#Y?}BA2X_@Mbuo$2YSU?5V(~E$kxG#Ur1g99`yB`O^w;#g3B|BR#Q% zDXeU~BP zP5_%EK1;K`*LY664<=pCaH!ggFcBoQdxUAxz$h5t0IigFJB!I{z^sLRR&c#_aVZ@M zBqxD;Ox4!Cl?eaa5g5N8{Lx+PD4z2K0zl7t&3jH-<8&UH;k3W3Hl_3clS_rN2f%6* z(!E}S->K`hKyK}acs%@ockME0(Wd?1!vPUc)Ni%{Mz2OrA8KufkdLp8fk;;3V=x2J z1|$YI@h>mMJt)uwQ7nOftc;Ed!YZ5s43A#a^o6#hKbENr#F39B)*`l}%W2ZN^?Jx< zzTwNCGuo|pd|qeUwiABx(KN2}53;;o2LesfmkrPqgxreq_>X?;_CpuNsKe8E@dCh+ z%3KeK3FGXJ*<s{+tn{iwgU`HBmHrrzCsh z1*(=~GO1?&4njq*Mdun&Y}dIn1Gw1Fm*0{M_W(*Opbkm{`;s@=dm6VSA-q;1C!LhQ zJV8Iv{tp-6j%cyg1SoY&xY9^V*N}nj!=G3dQC@sB{EXs!cZx;?+^jbsy?E{Bn)#BTn49f;@eHM9>)nU{c%@4xLWmj#bi7$Dl;b$P=TA0NDZ&*T4V@4cg%+Pb}A zv0(%BARr(_EFjVZDJmr>3JL-$3et>HC5fJG;5FjEFq&MlIh8`e7 zXdz{PD|nvgp8J0HJl}iA{r-C2=Zujt;$dX(z2=(pH-GcD=30At5R^O7I{8lo4*m*+ zz$;J$T-`F7hQ|P60Gv*#Y3_f$PKouhOak;B7nAc~Qm!*2cGZ!_sZCcE8m*@!v4vJFGyzBVlv*tF-TtoF^M78i$sUD%NZr%|7? ze5?4CCm?;5=2UuM`S+Dy>7T7a1|EYoh zw*I%>XiZ8v)u1uH_pj8iP(=c|`CBqa zxn$HZ>IsbuP@#T2J7yU?Bfu_EmG!g3Pz^YH9=!Qug4^u2Igr0LFwN)eOn?)3uS<(n zZ;&V_Kn%{A`fOnq<$>GR3j@#a&G_qNeQ7#hR>PN#};BV!xKUWyD*-`TbJDQu$=uZJ8X~K5W{&z*d z;Zoo-B2wtPY!Bp90VfbyR_dd32fgpe^Xy7H{&D? z&ZvJOpH)3QumwqsxjgAu2cwy9L#8TW(mFFlz2YJsh#t@OdXQXIkpRW4i@0qqDpc(M zY@G%A*jlD<^JhE~{&=P%tpn4MliT%~oD!RbUVSza&Jqq+nWEup>vWNI&chp<-aNXS zK4J`WtQ_UdLNA;n!}h`TIHWDz<}lkgz4dFqxkaU@@Xw>?h~%%vdgrK!Y_$2PYenuV zJGFjj1+^ym1j#<=Tn_pvRK)?he}`_~ttU9T0Wz7hNo8C8eT8BjMBvlJWjJ_~P5EwL z*0^4-TgjnuSSI7~1Uk2XCy>e6gtnoB><-Q^&E5YG>A{@ut+@UJXes@c%cj5w7H8t3 z&7;$kDjz9pQ1^g+fdk2WU1#_JkwT^i!54uy3@@vkU&ZQ!lUnXXr3KKrTyWF*eYn7t zJwSCI%sq-tN~O)G(i{I?-aJUw#T~!v4BL&ZkMKyF;vkhkC&q_(X4CX%}8%*FM|iK?)!u z^1QjL44xYmx}Ks-Y{lX7zPin#uD?n3b0si(UA`sOWRktti_{cG5T8*igU55FDhEoW zQ5@N)EbDx2V!tyEr1M+Z!h64^>c83-F0K zIr8p584{wk^`#I>^ZB_qiibXa>fpGincR3du6bn4XPHm_M6YBQwe*q$5qPyy8>rfhJT!SD%dgqT zH$_pAasIaV$kS0pOZ7RSX|ypqxFf<~q#c`gEM)x`tQIRD&NnkuQj$feAAOHMy1IPL zF4d+3Hjq|_Ut)6wX)L*{Z{nJh!_ZezRo zg%Vl8430LcA&GDzZjbSi%~)C*%IfpCkpzKVzEH-s><_B33@gctr0_XWIAqK4pu;f2 z!H6kk73WC z_HoLX9i*NMi`mjYE3t*X`s$S5K{?LiUi@g77yTROm-#0H25P!tEZ17&?wA?}gtuu| z!q*mc8Prwsbx|91ZmWgzm9;^4)C!fexq6S=#l5M7( z=&e`jp>>@WI7S%1{CatYNWo`` zT_O<<1y#dacKbpN>;4y)by&%JUFm*`EF>;8EG!uvwa0# z&4hm(X8uPvC9~lE_vhDKZQF<;k$Bc~_g&o)D67gnmHvI_eLgPK7>hX-Kxx)pg(K~_ z$q<>aGo$2%+rRvgL-Vc+zucsvrAuUQiM!1Qo)n-Pw&>s~H3!tSw3~m344s5@r#-*5 zDg78ZVoD!vSnR167z;^*4mnpaZzJa}BUG4YuaI=CY}er zVM~_>YZPo2+RIZD{0l$DdrM@`Q5Y9*GdswOJu^d-FT=jI^ia3gt=(OCkbTCO7A^GU ze9r?sbBsZWKT^FtUWQZDMRPw(}yEq<~dR~t^ z71goznU8een3Tki_Gbw?-#!?VQd{5mI@=IW_SYwi+Y#T@9~)!|NS+i;yzrH|EQg7) z|B05L|bF#K3D>TOh_&(UZfm7By>R0?>2J@Gye zrgTfKnyx-wikB~b@CK3pkHhwT4 z`E7JW*QC@J_#*7-tNx+n1+RWfclRYm@2!Zu~z!a*Eb7=ReB@ zUYpRzm)&dhi&Q_}-DG*3OQq=soLlx<5+8pslK9j9fWV=~7bvTB$#O`W-h5I>B_-%- zC99x9>yu3UZwo7q01NYl{I@OqjG({dct-uaghfB0=}E?9!xpKov9ocsj?lwHlzV$( zbt$DGR>b!QQ)tE-?ryzDI%e#Mig*`cHUBcT)%FYz738jP;hDh-olvj*1LgKU($|ia zK4`*9`akj=ST3+`9j*`Gb!wuCz(qEDkFZljM!T7v+-o7E@-&v97=4-?Nkm8E?unXu zr}^qAQaS})r@s@|lPkTkU^jzjXKkV&^?3TVPqM||zFox#XWg}Ucv6p`pCmzL#hh`Y z)PI;QVzgoihhy8YRihyKHd3f_!2OD|t8{0F9qm~8AH%;|sE-Gs zd=11k=4J3G>+h%Bafn>3%MOO(pK)i^Aj zjWSxl9X%0lvAYeME}mxw)4L&Q%#VpVpHS;LAMFQSAj(~}BaXe63aHgjQAO%{DBi1A zS{$RqH!(ZP9kSmHrp0~f;|pfo|CnismoM=gf8z&SA;G9d((?XjmSy)+bFx*~+Q-Xh)jR@yNM)f(vMu|6|(eBA;sg{ihB+qw;!M4Y?ezhY8r7vg;SB=caB zCVKNnH3MdT$-R?7J9iIRJw5eoA@f6bNa>N2b%x*}H;XMEV7~%JI9cW(%f~u-6`$E+asxdE-z8Rp z*CA1gaZ^)MG#ye7If1~1iJ9tk^?hQ1RmQ}$>qIFv;;)xQl*goYbtw__skL9gcKu}J z`~gAL^^ZN2ymUfm?rzyPZk&NR#%IYc3>}5Jw726=;c8K*qkN$6-$ULW!E2_V-UgTP z1EAbvvqv=2+{E7O=Xo=`mu{7vddOJs^!1=nAI=u1(8wQ5yw8;t|6k`q6}XvcLDqvs z@GSep_Xj#C7Fdd$M2mXnjw#DRCRo5cW_l*xpUV^FM`K>d(k(ssogrSSpjpyYOYJC zOZ`X3eyk1w&x?38zh2vSXDjRnlfm{2kS6Fds3k@RcEKEGn!~LE4EnOzWoioahSwI3Y8!eFYT%(0Dp zEfi%HM)7L11#m7?>NQZl^dmq?Ds}0#gTB|?&q_$JBY86M?#1ddQb^M&RQO=w>&ZT%18&dl)vVxG7*WuAt6u4|=;#v4>&1$~=)7m3ff z78l9T2Xlw{c6oSDMhtCAJ&`VbRJ~UA&}RTfV%a z>RQ)I{nU?&Yd9^d^jth#RCbc*VC(rUHe4_xMS~L}ZY}u?OU0&ceh|61EgDR_(lG|L zK1}{u>+k~aeaa9^d?Gu6kP>P(Rtd6hDbBxf9US3QSYtJL#hINnZj#cw|Ebch7pxzQd6TYGrxtJm4{I5F7C?u!jUnHyr8-+o7!gCk|y! z!1#!*E({&~KyFP%xdAq=kc$pK?CQ5tE(b`QtOKG)+5zEzY?U(6=BPIxEnVwB{!8JB zmNIge=6k$vf`5&5SEZ&BLfmtzr!M`CM-}`{6oQq^7+M|dkZ~^lVmMTApRinzQ8@`L zDOxBktdcTu`R(O*6r4*5Mjp{6gD`$Ozl)%MOzZRBAH*!T0pinA$PwwnH*cm8ZeqUN z5a~tQe{X-7gRj6p!^bP|=R9JMvZul+R6oo_V=?6@i?2t}A=!J-Of~wwKk67<*Y&?Fwbf zUmX2iD~d%KG>+RMiAx6+6<2S^eFmqW#e5OGP}Jy}MZknOiN-x>B&F!_cfa{En#Ysl zT^`YU0de|;B0S1I8e?@pV6+|N#9Lm>L*M)7_OW|z7zsN~kN!ZS^R zV*o$UHa`slSet@2P00Do`hnhm9*GVo3^{qVwY5>h35afxHrE8o&W?WMJUqW|dVltA zQmRQf$+}7(9=6+}h6JXNuEqVPx({7kBd>!_c^k`EPEPS^;WckEvL}|W{q#SR+r+x* zU`GGepm6^_3+2E?&3T8EIB2QGGtS@<)v%2Bo4%R1P?^wvSYtVSoLN~yrqBaLvLJSP zXcSJBSl_IaLC^=$L6zGAQS!SIBlBSBFqo?e&O<$o?ceZ#FaGvU$87L!~h|=K{ zXfXD9yQ;wn{1KfJ=mXAPyt(Z1?La2nO|mJu*4GPuGmN$-7p+RLQj8bZw?a!9FU zN1pt(mDvFN;V~W9!nQNN9&T~POI7q+FHViPvc7VB;gOv{*)Zh}#%0tTP*yQ0y8`r< zQfYMhXCi`mpE1;8#3);fq#_0>Wt>4 ze$E9s`3B5lSGa}ha7RMqO}xbo#b>%_oSU%n+kYc01Z#NM&1FwA|I4@=*mJ_nIR& zJz^h_2x^f(%Bu-#{7nRqFx6h50Ds3hefe+PYUzwaLfa$$s%K{$%eOchIMXUZasjd-+6ymq& z{o-Ra|6EYP|5;UsYLHP}3r@pIsorOXwLE96e{Gu*ofoerLAAsi+h`mOu)_>CC=v1B9Y2}Mno0oAe zFK4|~V9tX|Mk%XyX~ugVgvA9;ej`#I=rb-ay#I_dZY;ZIloJ7j%!#gd8Yh|3+J9rw~r@6DHgP#94=Q&78baf=N-%xnD7 zc*gh&ZoWmVo%Jf{e&?cjL+fqX{pf%60_0f}-&@#ll__|2V`ze2ZKVp1ttIvLrB)+M zSLj7&=@8800;g%E`?JUCjzCu-=7euyB}1=E27Pqm1MGr`P!Dg-&uE>{oA-Z??h4mERjW~c z#{d;abLOQlekcefH{z94kd1i0Mi>=Rq2&mjDz|Na&sdf9yEI=);jqJ68=Epd5ioTo zzTFskXYp{sw$WzcAbPgC-)aTtaoP^7GV;pPPLK-0fS%s9xbvEzpB@j`RGq}*eT%=v zT$3~qYaFv44GE6xXYBeb$TUYW-Z6KkhWQAb@PIc*M1&7P&bO|-4_i}w*A3lMZHdb zWJ^jdAFO9YMRPsX396Yc;6IY~6PwQ8uO{kLUvtEIxWunkQmjjU!XUniB=KVq&o_~{ zn6F#f)WH< zbH#m&V?~pAv!zIcLi;@!wE3d2k85YB%vlxjx>B1sS(474%;zukNra;(!>wa9=mLvG zy&U64FN2|u`}HZ47c1YUwU1^32@a7MCK&Mg{p!^PR5TxE~ z=?{p7@U=T<)*BFSoIT(deG@!&^(l`+aF)@k=181Zx-`AXiauW{iLe{I>(<%xnr~f^(pUmf+)~`(#8(4*=n& zH67_k;wA;G)%Wi`S%EnDD|XaU8zt{FhxG+Qn^0q=k+**`g`lqva9Ea|kG_B`eU`@p zq4_5c|C|6gTm)7w{+sgbf8cNwfUAK4zrm;|M8ENDrGAWIx4%iK%v5yuy-`oq5!>A( zvIvMz-(c44ZB zG}GA>z)C}rT5j*ZcWi!jsOxG9V1?q}L!>BzDrnl-)=7Bb=GL`jy3RkUi{CsTihz;n zn<+p6tup}iQ|%O+9~66r7k&r0!DFO|v<2@l)L!j|v%j@s?YKAwCgJE69^*HAI9BO$ z7~zCfL^C>{cDYPQ1+9qmKWXrGMq=7`iIHXm1S?zO(YW#_WRD;{lDODx&G>RJmVK4< zmk*IFr}TvIUAe)ZT3&-&RCBZM%lh2LT;>7S#Gk$()fNs^L4r1Dh&9>wlGpI8{=8}V zNABT7dX84;m203t_{ZJho_=4OVC>(osb;sQ1J6@L=1y{rXT4EGI<^@nU_ybo2>u$e zcbHSaT-CG)ET_#paxFi|e!lNUy6R!BXr>m4Fe%4PPRg@C(>jUPIKh?mFqeuOLW7d6 z9QwG5&rJ(QW1mmJN}wdw)oQF3DW@M|4~3&8#{m1E?*sldXI4Z=LK#Wjn-61ib3$C1 zJ!Y1*9!$WrAP#nY5$LZaYd}32j|mucX~A^Qtzaz>*lrLFkbLe%Q`ascgSJqk9<8s) zngTrk&uZ|0ov$QtBz#6b+Ua#4s7~ntKITTs8N`DcrzrM}jmBk2~7k1i^K5pCy z*w7qjoQ1L_{(SKsN3sKhN2O((9l_yQz*VRM!9_DQD+^^U@Rcu#C@UU4?Jpw#oTDX{ z3GQA&(Pp-b*b;wk+cA zb-|D%F8_Lq`>CNTe3~_@kO`?!~25*>&;QIQe%uJlV%bX zJ^D0DSY^2vG7IKzLNn=dD#!~$#thxExIo<(oe`hh6`{-aE#J&m*K?4>wUCkM&Wum! zp~0HbvV=jc_}jF1LHF9$y;|^FS~G(k9Ub3+H|y|`;=SALTw6x@x~PSFo=@PpWqji{ zXQ2;5ap8_8D*_Z);964m73+f22ch2Y1zp*#RD?r?sj6redNKUwyRhFbS;iOVVn^)x zn57}Cf{E!`YoCViq$?udB-;2nF=-_O=Y&Svuy&Y~^;syTmt7WC(Q4;m^X#=Np=w(u zZW5M3@dkhRUM=aTle8SpCi)tm1#9s<10)B{7Pu&f<2GC7TS#%y5cma`afu@G>sq%B zDHTlLc4>FRj$}Ea+S3|WP~_SYZ$-XKafwCiX`ZOYvL{fBq%GN8CIjR@mCx#WV}Ve{ z;K_N04vD}iIl8u*k`l{uBo++dN#vcNaYR#U_G0{Y~e3UoA!`E8pbRXOS1!ET5__dVI1_0{e7KO)LeOVh z>ef_zYIht~-HFhj&yMK@qu5xqwA_3Sn*FaTd$qHwm>Aoa`94qROaS-F5msqZx1pY@ zYr@;qp}w+$eC~~Te)ErcPC;!U;MtQ5K<7@9U-WIS(Un3$=LU8h5e!kTti19+ZN5EY zVQLnv6v@|5?3-T&aoBq!EH2xdX~n7Iw10`=KyI!-Tga+|8(%*AcP1YQ>F;<@F0)~B zcugIxc5##qH0(hVk_$SpA%x>GI@loqR`-q0c$SSWhl?C6y4Fg~$x@Xfx3Ud>Z2I2@ z|3BH_1O({;aoc2rzERp^j|29;10kw63Kau#hRRJ1W;;r-g+{^Li=(OVIXY#17M<0N znZUD{t8;XHAJ66J!$(g|4jkPQ%m{tfw06VJtL2(+K`Tztu2j5HqfRJZDN$#8ifXTh}H(-YRJzyH!5&cPpr2C}QsL-Mz zb(=4HL@bct{WE%(eOHB7wWN&ey;>aBM+=?$l@|%c_|&biZtE`SyCo~-N<0LWjKeKe z>eu-8eTG9x`%rUPC3Q+AgJzDnA^7U+i+E{94Gz4!tXocY(W4U&O%R$c4;V%s3upP+ z<`cW+CSiKzeoUTus=5zyxu8ZFWEh38F1#NrZ#^t3j-am=oA0&X3}SOvQcyICL2p&B z+`hyh?fYu{unSHzJhH*(?s#M;Bb zzN7h76?CGch3+F%<$Cqh#P@)!{ZLU(lp18na7|xQquu9Z%6}R{5N#3?kS$G9Hz5gV2=w}X{i9b^uqnsTTKVW!*MSV2ar%QU)*`8`?evm7-(Ux@= z*1_a)4I-6Z9Nsp1lS^2Z`XwOx>#=b^No zi$~;H^oe-iX>YYa@NPc9ayTJh!>NMrClux*t25e@I!5Sat~ltTR`3L@0}?nZDvk4+ zll|6#8!E9Le1rQqQcv7x%R0qri{UEmgg#dZ)R7v{=9$yEVIudLgm3gBd+DOE;0|p1 zksi@cA5kQZov;2N&ZFC8Mw&r}{n(2_Zw*7QR-}k+@nv;9eBB_#PO`GSn6RvkR2XCH zw9&F*)ZTp-eYx1luizHYR-DG*xBYK5LW>fzo9C71<5X9FbhjKhY+gKnoWCQTl(aZX zP#NVH_=@snN^saT&1g>#t(seh>k4^Q(Of%zreFT%>eRI3&RR}s<9^v&c%OpUo-}9E zaji=DEhNIlunu3^4~?FC21bmg)}{z%zC>B=iOmgcWduL5}lDXuYMD=kI9p8nbW0Tc-fQr zqSqVcu>l~whKS~{_MP4D3LY%$g2z;~j_{cC|HN=?z9A1aB%I!X?ZtLG``-*yToICo z%-7u}%V~?us>xbO=~q@u>xR2pdxy?w8AE{{rtkFv-5*(a)Ez6Qic4bix=Cx{miKn? z_)q24j(yu1)zEB-tN$Vgrj}9P#1eohC_?X9UUNiAbp!adL1Nd^4pr)pLOpRzR8lf} zKdka6EMx+{yh+^gD~2V|#QZ??tj@~!v*}>Hjl?-Ec6V*i(uI!cP8WY;i4!ga@))pC(;Z>?nLe`&VWjaD=b1Hn(0EwB&L_S=D;ubT z^k@RskJhTLP(Us{Hy$}9-Yjofd4jXJX$Du)${ssi0a}b@00rWtf`S-X>eZ>v}qUEne zB)ZY}Uwq;8KMFuL!+!8+XiI13K22&uK%h3};E@iSL85Ll;H7w)&Z=B{?)}#a>MwqMExES-$z>Cp-3l24JstS$Of`tWV2mWXSuaz%roOpE z{K26J)#n@KW&$qbIsgRW1UlE}>sdIaoahBxRvUBjS|8Rf?xpC$k=}AUBefm{xBbyj zddnGtRP+H2Xb9z@&B~)E1V;XOG9Zm`m0Aa|CoVVyrJ$%iSjzm&D$Ti~G8w zGH)Ql6H%oVct`-l*h$F`+5f_lsgvq}(mVq>7^~EOJ5y4B%E7o~eXX$1&E+C_MPHl>KzgQ#4I0V-NAuD^1>-rl1T!J2>=>S-9s4 zT>U6}PE53$861REec}6)+0Yw|aQF1ca^SIOG=;;}B2k3tHSZr==s*`dv(h8`Va8UGZp6G1T#soG{%nw$VT1ti-v4eB0*R(vnH9R;$JpsH|DGQdBl+|S`jzpK59 ziOkHOJG*u5x9{7BB;FEa!(%lFO?3@bGbk2azWo(nB28yyUJJRzpg%m51G!#6)pp-ZX3*S_{nGG01fad{S;CGc>in7`{93mVFKdTyzc88`IV9dbD z(2C$Id#aMDY&EY{==)?EDrj<(5r;2S9S2IvJNr%I`Tn&4;YK3-@s(GFAMNf5uEuJk zwb5bhdw|Q*+Smh_OamD#QR#ULSnF=#NZtIWMXHVi=Ej2+u-9zC8{Rr(Up0rOA?x6e zms4Z^S_`AWgl={hE~$vF!>daxy>4YV*f+Ne6|&gZZg~@_SdmEU{u!I1^b>S&OHZ42 z@5Ts=Ag2*e2ceCy*7z*&Uq1iD3rSbnr;LZhry8e|oGqqUkJ?ucEBUg{gAOOS*%R>e zYX#`S&3Ux8^=ePKUvP_aB(V6%wpRp=XHrBZa1=rL@=XbOehB(D2X`haGX2*^f|o^A zSv9IT=uOd9_2OH<4M2>m971TtT|hP4&`=^Wc(W@$wh42Vq5UqUp85k+^UnytQSsP| z6tpcfiLOHiw`b3bEd$I74HypNC2XcdxhaQplDpv?BA*tC3n*ZM(it=#Y8(D^|V@-0lSb zpX$t0=dS$`6*SJJ4hUr~1H2u$kmUjvma0y`6GYf>0bA4Q-aF3<)*cL}X(cEADU3>) zNLct?bR!i9TMHd|jh1#`H;7S#cCT)j?F@96Z7}KeHK2dw9$d?V7Q%$z?P{gN%+Of2 zLntDm!OXxA2b1Zm=eGP10>*mvS!Gp48w3b& zxUY1kg zQevVcgkECwYbnG5)%=c+*8l4s?BWeI9<=?H(i0pccFnmSLx5o(v(qqJ=mITyeNsXd zs6={6@cpywS#jQ&l~D74Z806th64A6w8%W{wxrC(4f#*%CV-cerfw1#MDyXrN!gmN^1e)`D(ou(dPq zZO?GfNM0H$`A@g~#Tb<(E@IqB+jnn@jb~WxWN*BX;;20Zil*KnW? z{%60EYYHX75f`!RtB(Twxxnv1v^%c$fpG$1kwYp<0(p|-QJPM|>DG0fj&Q<;mnyPm zVOg4vfYs#=ILHy_Zh{$9hgM!)u{jFdckqA9eR&9y|BLrd5S(}#6t%&8bg}1SQlNwg zv15Ib5sZQRvht=#Kr5_r9j;}8xlUn&a2Jf-#(unMV+A>A#s4I?3q1k0C$R+%%=14B z3`C_LxH4ZNKoWWVosye237TBKaPGzis+_X}!3i*>5IjfA=5f1h5$7_; zhZ#KG%G?NmAMi*OMOF_R`Ph)u%1mDVrwKt!GLk_WtWtOw4`%Wf3uK+&z;Y)dp(Tt2 zPk>u6>0dP}w=af|gIF*219Y_Rn_VtRbN)CK(_6!f2^G) zFxhh--US1{d5Wv}0w88`Nc7G0%L~BYg#Rl~hP{-6DL%|(BTI;{5fZGl0RO@dzl`C8 z`Ch72b-D98tD|i7Rj`Q~_xC6;W_+h z?tT;1+k46?*xZK9)9|Fr4ck>g!blNi0Ule1Xub1o)*Xn!; zqOx^8NAP6B?$$MPWZHzwSys>~WHcgCD0T=Om=`@#T=MW+QE-a*A42GXVf(Y=(YiZc zp)+MS{0l+c$P@p?q?k;gXFu<@o_$I5#R-U&Qzv1k5iCRl?F3aydW>#c)Ff|a&^ z>>mhS`oQD)-78aJvMUKN<>ve)-cCR%BjC-OYWtS&6;wTLkI{J?5)Q9cX14>-U|Q) zLC|dA^8g&&@i#a4os!O?^;i;MzvM&kND-fECY(ML zDPumiMlyUgfQyOOURZux)_|9}EsBfjt??Bz!-K%8uuo3kKXRVXN=8NS`!7Qtz$Jb*NJfbb&q`rK#;zZMu@Wk0N>UK7TSV827{Gv@7 zPtF&D_v&O>OM->c%V$V?z7HsaEJa68Q4u-QR3#o-twPXm02PA;>)%8|H8fQJ!8%sHJLTAe3l$3;}_yjU$0`3LP+9)_qwf0pLZa?Zm&z=_%nHpksGb~k7QPiHo zHUYzTtjRrZl${(kt{>bO1I0G?#a)DtPqG?g_`0b-g~*>ycv*T2iJRl^K6WDnz-R8V zh5ZbyNwbFrI$68m(E;qmZVv{h1MxsvR}MmMh%upJ-JP9kUae=RNU5A|O-i$D1Y`kF8WGrLCttAyBS7i3}outut z8a!?W`*p+j^?aLPN-I;SXO4sAd52dC-_I<5wvw6Nyz%tTmoM>EzsEV6(FGN!)J)6Q zM5CsyzH5`^v_lMdl2~!y8ipCH76&dDsH2s)5M^}I`5Ct=LfMI!Sk>}PXjk{<=R40Q zF6bbzM<2@a>H&Pw{@3_oG67}d(BhLkZa!)HNtBHTv}TSs#>CtFn1CBAJI|)`|9&t- zy@exOLjLj6tTTOu^2;BW1z@LCbgn~47weziI}#^(vLNr{rK-T8am}L_yB1*OD66kZ z0_h|)<1Ig>JcQG~J^48C(++WS&{d#|XWY8J-5xVRB{{hdb3w!t1#$H7Zg3ihaZX{vV^*FEim32px`rnv(v zIpPG~V(hwH=y1RD3xS_fiPDjKO6KlA{Tj4aZC5d{Q4{ChJO=01oew)lqGT6%zh-wr zBrt0`E*poRC-Y#Wmct($nq|;vWG`d1pvy|HLZ+-&@4LgG>W&V8R^ilA?-l)$`o(dc z2B2J+Zr}6Uf~Hsbszs=s&5PAZTI1h#Kf8?cR32)3SLj>FdefEQuD+bG|6I1=0Bs6n zdn4_$;@^?}#c=BlPIMdkJ7)D3Exm>9F%CI^$|m}d8m7PQNmStm0>$P-?8@#pEBBaM z=cz#Z>9$`yPs+*Y8$7W@+lWiQD}SkNbI^ZRMS-{hZ7DtTMeOdQ*77zi$Ek;dr@coB zyB@MxE8t%t{kJ=l$ngIJVW547jU;pOf2q{US$_x9VEubLo3MZvKDJ`dQNb?##!bE? zpoK_nT7)UHZ!UrKyBVAfwbDz{j#?fCX8bajbv^-NSC%EUe=VZcIV+%~<=}Z3sHoX} zJ7DAS1`@@A#sk6Ml?sy@5)NmrSvgMIj-DSn9fIyz2Sxb+w)JLzLkq2d&7~H)6CXJ1 zPpt(H;?<8$AKr%+L9+8sNoTM!HymyIx}YFztsk@=JY91D-?;&Khjdn*gD(c`AI+(4 zCg>`%lzlJ#5k!sJS~2Djf_B~W_Co83AxYc)>#?NzoT4dS&V^Myp5^RkjBeqDMgQ*! zYe)9&U@~}pp-Xcgh~Hrio7g1^qnb|>{UJ10jo8%;P^eRQAu#*JQG@Zj&7dEy|JCn4rNy7FYl zRY6+z9cHlkD`=ffqUMZa$oY>n*<}Lc`1!r1?YYd-KIF~>l+6s?7!G#BG7Hd|Ebx<_ z`41wPO`tOvd_uv-*)!0sZJ^1^os~Cx3dhYMq;i&sJ#lKslS&l$!MipA*?;u|RiQ_% z%P?P{Dagb5!PgehDyM~j?&54bMK&uU-La^f5B3g+?AANB{+;hEbZZ6Ndt)qM;psgr z6nwRTZZVT`pxl8|szMxqMS~AN)LP)iJ~OHXJq5J8zg}ub0OGw5{Q0zRxH zn@NTh-@|yQl~$Yo*GuhPCp5A0u4^N(cfi2^_6N3G&v&DzfCgX7xCOq#>9sRF0nFgJ z_+F14t=Kj&^B>MVl#rELVunN6aS1@4YF&OyY{ves{=1E{J z3`Vuu@OW4Td}$dhC_LyE(Xcv=9s)Gvs`z-UY27N?hLo4|jUFB)9PK7Z%&{{y6B-kSgb literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/cpu-ordering.png b/content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/cpu-ordering.png new file mode 100644 index 0000000000000000000000000000000000000000..5528f399b32a25170f3531c5b55999833b02f2e7 GIT binary patch literal 112446 zcmeFZXIN8R*Dgvg0@9=?AXPw-CejQLR1{DI8-mh70jVMyloqOhG!c~mLJ;golU@U% z*9Z!P8hTIyp%X~R+AHYuKHvV{^PRoVE`QGT{PI$>)|zw7(e5$FJz_4K8glJBw2zLC zj?37{;3^#*lPnz_V{juXWttW!3_B%g)wqH`Ok|!`s_i#BC`1mZtLy52U9p$@ifBG-ktgH?bSl0`=nN zp$1PEP%*Q1Byv1-Fdz^91E}D|no7KPEsSm;O<34cO@5((uGg(=0Qoo(_1 z($Ah6f4+=AQQv}GsEuIP0B!;I0`zsLe6l4@VInDLWE^y)MwUg15p73O<6RDN_*D&b zVZ%KqF?T{}-(lzXpq5f6H|f~<*+~j2Bf^MLKexV90rp;fgIZR<;MOb=sAU(a`ojQr zg-CleS*77TQkk=e*FF*I0jN`b4!X)whgIL8u)gHTWw~jLMnOz!XUMV;)r4udQpIgQ zFK*X+|IbGk(a26Z5qSRAuxi7c-GaCm_qPQ0MMU&DeMZJ|r>`q`fAG0(l&tfAEs9d7 zGw>q(CdZ^%3n)Nw=Ra%v))RTfH=48r_cd~FWfED?A`?h1PTAWj;3~YOK}oDTbj5el zx4?aUzk7Ikrspjxs%dCAx12ZZZfi3-t)s3g#N^TTxp;f9sf$Z~lBh}j1z1xf;WsIz z)T6PlcVD-_h2&p(pCzTV_B1D->PQO7X83;Y(MxZqPAN;Ix97%?3(GzTd)- zG#KTX`Kr`Oiv9?*bLR4=0#oubZhU+{>}*{8M%_qD%ln(RY?sccs_J<;JHHPHZ0&F= zoeBy?sCQ1Sw!;0b9(AuqTH$qDF!R`M)Usdm?Mhe#Tzk}7x4Fe`7blQBJIqVHGFn1C zDr7vH>6i$e9UmUM_6xpLc>McS$jTt?z~%Y7_ai5{yAaWu8k$^X@?KsZX?csDYNt*( z&f)R?6l?2S8d?@HCm;}~mev;kVBGNViI3r%VW-s8oC9mhO`-P)p$(ER-=$5h+5IZb z&~2KtBSCV$UO$UQ9q{Nm>hAo|uNxltoW7l5gdT7#z2YKaW%mo+{YjhAf>SgSMB-L-lO3Lq|lgds%Bl zKw)b7CoNm^qkXFne-$l1$4oJwB%mFa*`8ZTwcojV^VY5XF#D|A#58;5xUZK#lKn1m zK9qhvUbkmG*lBSHHE0WYFraXem3j*(oIc*J7eH~Co-zcSa$b9&GDsH@uJetSq3t4w z!NI}q)ebi)=IQBamTjqf1jomZ-zgl!qMKwB?jBdl;1_w%m1%q|JzcA>_fzcjVXe*H z@z7AQ)HFmTCmVbcV~~}>ku%4$G6u{&ODI1{A-V51CKR0{r@<=;Y=Fj;vcnlPlcti` zL?VhsUrS{~*2pr(N|g|X6Y7cCN7^dty`rYq%PXDz@Cx@vj;6Z=(A0Ndu5z|({Y5GQ zVbsi3t$?=X|JkaI<&ZwHyPxC|aJgGA9e$~+pOm{(vRv@gz7#)1$^|T@3x0hMPects z&7DHFb->;3>>mlo0a&&h#W+*S5tI4GkGHHXf~!XB;}WT*8ynbMh@qij*ZKjNIzcA0 zNdW2OAd)NU&7}?a0A@(@=Z4tE0nhIat0}?JndvmhtQz1_h1F3Bc3yR_j{n z;O4nl{<3;jeo$>Hu1xn-wZQ!>U)?n(rJU{_Q(FNg{Y+(2spUfH^+5Z2^GvN{yh}z# zCm?FNp0cvf6Ri!9#cM|PhD@;Y5zSP^W4D@y3=`OA()3ebzgGEv4dS^m;G!INA!%;; z%@hT4ay;xkmcjw|;$efMRxAMgD)bRe-tofa1M1Z3=3-ZOG)mslYvCfosQy~$PmOO+ z%WjAQ%N5MWC!fTnrv99G#8P%L|4aUcOnKAd!H>xwu!edPGWwSbFJ@Y4PyKTG&|>YF z$-aq}=RWap;Ajs#!~1*ShzID>)?SYYMxt<_pnbQ+bwK|%c|Oi+;Sex3b+bf$((Zt2 z`Nk0wBhV>l+3>3+n0(3e^Xdu7Qh{oYtPNC{GqNAM@+^d}RVJGmm2>#Qj#uQk+@j1C zpYprMj~|B>2zE<9ig+yBmoGGnEb@hP9q_)yf7YkVT2GQX zsou(FsGsV)?`LR`rd3#0c37rDw7b%Z0hScy_|Q}FQRMb^Wu40+ZW?yo0H=H4gpA4C zNQA7j8|x2JYor}1AOQ{$dUE^fp_7iav?y$dW7<1jEF{9W8YC$N|~D1vf`n`{YDv^PC;O znx=EaAK7{ff@+lQp&1L+9GLpzPQl-oqKrhNBG}paVCMWq)eE8M$e#y1Sg)8WI@=8)jX8f|wE-qap?JE*B8YlfPvJN*Tagc|_1LscAP(u`;ly3`fVWbYndxEDaV{xYTX22jd*@TqC* zX=pjX@yCZ4IQhg-c*Im4yN2(6gQ`R@oL<-9AUv_OwB{Vw>{_uW-Z#20qm*>VdhDL& z`GJR7oB1)HKw$_BRfd)=Ze1wHb)i41KIahWYq~6a;sZAu{KGv#FB6i`ldhkP9+aVJ z=m`A7?N_c}v_a*L$@!p7xyWS5nD`M;r@Q}@eG+#bbRkBFiIzK@)HnJ(<=^W;ZyhI0 zc%>g2t*WlgOQ>N}vzm4_w48c=b2!1<(_3UFLLYQsDr(=a#Z+J`Wy5x+r=9)%k7@ab zVpX!Y6qGEY)*nhQs`(hCal=448A9Q--+rxzc$bhq_vKg$^X`}AYq^B6Je+z zK{eBR(TB$nuMuo81(}!21>7Xv4gcPahs9sN9y*!4HP0%@i_JXP?HQ^;usQIPu2|^( z?VWz0jmgz3^V%d1Ys(Y)LBY`#j<#yH7*PkCCc0L$QMpCFfb?hPB`<*v~*d3KDe&@ zOTjDIxt+r9?_ZZO;a7tmM!}f!pNAn)(2c$>+YUK8zf7C}6&=f|R{u`E+YeL}u?*(v-;Vgk( zjcvU=vQJ9H!&E{Il6ZKnUtX37Sq^>8)~A^rd&WuIhFV{PEoSjEclW0EN5+s5BKq#7n3? zQFrQIodocWpYm@V0)CyjvG~eRA8qiM@MP7Pj9|*2;`A=5-$+SLPCl*2N)h=LdB@+a z!^G6|dP}3J2m6)VZud`=UW%4&ljId7Jgp}?7)Ay~y6pIH<5-=y?X>SHsMp&f%>5th z>MXN;1bmNP2k=ukcbf&|`yqSUUf&-imbT7;KePD0hxJS9x9&2`=*=C&*WowsjgUm)ue7W8uv`X3RQX`HK< zWrQx7+;M8}_9eu$`%%XVKi*&wpvO(){D6^z<+lKnJ726$)!f~^rXCzb1nS6k>cQ)Q zVxXKqGWI|9R62ef%&iwC8g5_BjFgg<(D;%+Wpo~Y%A{HX$*^jGJz}CC0~ZlHsJgbc zVyI3?KmOILwQa3VA=lk`(fVrVd~aL{z9_n(cRwj6gAc1tPbi$0t|sZJbOHq7PsJ=& zh)>@&OUHu2v#%8W1Q@Oi?zA#3=zVcmJ&*@q&3bX&aN15_{WCOorQp<)#=)?N7{U8) z9E|1#`6a|=)B6JAtG>m>V=}K|FJ5fO-*-S1SDznV;YhsK=DRM%@$22}Z2qIG{lw!| z5R|)PN20ly`VfCIkuuouX;@U0DKHVtzP;_wBHgq&BBqB!2 zRr_NsYF?W4%&>X-=4Opl$K&;lXQF%%c668+6A#b5Ci-f*rcJAJj#o&=DXN2vB~{$CAnwBF7w<)Z-w5ZRwsUvQv4d3Dn9Oi{U_W`T(IIm@KCDQSdd7N2Mv<9W(F>0QC>bhpxX+F*3? zKttZa^z_jB5d3uhLPJXIqZi*|uoalGlgM5+yGRlG#xbCj+AeN$3z%u`u(=e!2ekU`CBpCU^s2RhN}#%r zz=^r*yez4wsVOq!t6vmJ4=Ivi;utk>z-fi<_*4tr7#yh5bdiW+x^LX{viaSt{)~Rn zn!!wl%woFgXTnm*u9}MwL(-Aap)1nrH@>GK(i*he_XRkvX26xmUwh8iZ;`gffSoC` z1*9X^ZTA|dvS#U?A`)ev{&;G|Bx6$1T&!?hqMQ+?5yAXe6oho$^OpFtoYevY1F-z6 zxN#2$xmTm=P#16^)iILOw%R*2L2=Sva*V5IC$w0b5(=@c+Jw;qJeOL|PeUaZ$HeZo z>aEsuHXQNVGR$=899#*qe+A4swKgYvIJ87^yE)zCy$s;*YX@y7R02VrJh|?{O3%)(ZV;9s%^*HptoFU=;44W}`_?lRjE>I!r?jdnCYWX!IojP`g6`Mj49oY2_!Vr6ATze&HLKP5KyqHbcB z$rjGjlY_0-hJUh==jgW^>uhWZekO5dOj1T9tBPu=pIXMRxhFSlNqKIW?5z)GTuu3} z?SJO>1--YH^KSj?biZ9EYJ{hM$7NhGtF(MBfYJ#JpFQ4B7qHv9VLLF*3t}Fv6NDTt z>>ZvZFC(>ZF-{(V>{eldd+~Dv))M!@#-hYb8@}{(=ewVz1GDTcm=ZkVto&|IZ!KeE zGUTNEU(5VNMD7Yb2QiC;B!1$+B@^p>EX|00hf*GDFx0i8h}7zMXdWCa83@^yH-)}>pO;y z2ROW1Q#bcCqNxiX#CmrxTYb7A2cx)C6k1XihCQe@%J88{?U2L-TzYOIp3*-X0VVhw=%`(a8C-nz7!Vg zSFg(Xy7Ktd?7`SGI+jp5t*-9ww4z>8f=4Wmk=Ma}qP1a2f)8Fk%Fh8rBJBVmXTw+_JZQDuI&El{~> zxLB!gFCWP+YFDrNr0_s3n(wjDy*{a*f=^G>I~5hy#(x(f0Sy2f6&QdS%G8&>aVT2T z!GDsbIa%B`{;TqW2N%^EV*jt~TTDB)Y5 z$2b|z9yOV8I&3Vq0wgEgpU^b1Bx%`!MZuvWo=Cl;K5yNh65s9lwJeL8?nUCYRu`R%n zxBvl~zg=B)<`KT&AjNUYDjJcRsX@vz3>8-4B_v=qa@`j)q=oPoUb;hz$6KkoHO!3F zhvu9it*Wd0_8VQVtf~?;X~XhPuF7BF6=%uKCo&dO@GS}f4rtJK4bc*`gRXS|n10`> zu>tW>W#CC15U{(k7r726)?en}cVAd&FlC#u)<4r$Xn?Vw!nq{5H=O#)EAtF2%<-Me zmPma&cK(KbgA!rFH9DyC+^{c?pgljc@v)>Ae9RC?AtMuWSmXMGz|5F0etkqAHd<-~ z_d?k#n^cTY=HZ(=-U6}A^115jSV0$7|dPuUR=+;$@Js`qMlU;rW~yN!yN+-%Gu$^288Qu1p}{UOW+Hf;4Dw|-d4-q1gLO3+9Oyr0&8>{$?Ia?M&Bx~MDRY4k_oXU$o ze&OEYJlYX|p6fs~pVp1A5%qhQaZ5LCk(PmtnS`#aG zGUx=0gMQ_wAK)4Ddzu8&&U!mml{9ev@F|I4dwfKOk=l|r;Ugj~^HfTp znpx-PX%>1KDj>=xbd;fO5if$gbu~pnrK_H}vVeSapp@#vYxA(|4b@JrYRIz~565j| zoQ>4e4C`Z59CA1BNh%=E6r_XeNc%t^#tPH4Z#`|uP!e=ExGF#A^H>9lj+A)En6Rci1eaA~9AEXvPdzmu@iX&#>{cN8%bpjl& zE-r4YXGv#K?OvYFgMa1yu_GrUZOXL)-@o+6e3L?i0M?s#bPtDu1zo)_NgNLD?!|^o z^(Y7Y8OwX=Osg`t1!gW`M@RQ3s7d%XHZ?smLmTQO8jC~rqouidqUSZgk&lPZ) zPn3%7of9Vh@+LY0jIqUFyvKBgfSF;zB}{DIuXobR!wcSNX0`!m%lj}ms*B;X{t*E4 zTH6Um9M4$ICu|qk0>#G9fg#~fPrTU<468a2t`G zaQpUgtYRpBk+1d~BWfr{ezEEI7Q;eLC+IdTViZRxQSHM=HMgPT>gMv&aRee%_ zG<7xG4eXxRpSH85j#N-@T3V{0)-R%7JcATf3_$Rq@)HXO+|{ z_b&3*(odhGRj}>OfF;cjLFI?sBht-7a9yoAn z5w^{y?R0t5%gr@_$GB@7X$JPUAq!Q}Z6j}kvXqqzm|7L4?rUJTCH(!w2%Ma~3+l6p zTNA?$*VNkYrZ5G6hH&}RIme z0cwTE+S4`?h!B<{rto z(oF6~J92z%H|TI5XffX&QAQe>r!P%yD<3z(#z-VZ z^a(N&aD`+#_G67P`8w}P{LkvQB z^pFd1F4S2Us3r(|oIM}*f60IN{23AF7rH$V)5_o@RYlca{eb+nkN>-xud`#I)FbD+ zcN-@BF(s?@L4N7E1vNTl7y1){dZO81y#V-A5$t56(A_?*V}TR(dTTupVwxXrLFjm) z?^Ns-?z_J0+yY=;bP4u0liNweFGVUj;LPeIaoh{*s7o5$s>`<$q~`OAec2Rc=ZBqW zkBNz~|8T~VAd>`Em7M+E@UJ*OZXzUnnBH!+HQgxWr(c}%zZ}45SQ7s&AtPd+#*G^g zE1oMVcMTJ7uX{BRYHvJnVk{4S@Z8DN)Rf6s-8{`epYd9<>(&S#6}<8f!GW0zOAH`8 z2+hsSoohn|el~o8^=n}5dKd-0OC3XziCq**U||b-2VV={MRmjdcW$nU1HTT2kMXx* zH|87dG*WEuf0WbKPWVP0`j7yNjIq-5{UKUO9nRd~hPl2DT<~1$`T2crLv#EjMsLfJ z`MD>!@}DBkv<) zz8y{wKbI(2d8X$QWP91qNg-c=oqxk2{lgvH3MTwY#zRn4kD5!|H5zfx?_Z8knmY8Y zU!8CRTj_lAmmbXA-Y?R|BZ=PP`IIFy6BnU`jic<;nb-A@2xenV2mW_kZ7r_%rdyh{ z@{fsKs=f5q)Su#M#m|@$FsV$bWFvXn?0SDAdAsfUcIE-e+hjNiSG_!uvonzH{cAi# zu$;P`g52#I4O~EJ!u=Z`&OKT1OOVDcAkA5M`Jj5i8K?v=EM{3vVo*ImS-&=I=r=L&wBkQEt+63HNM(69Z;AMgXnwYdVjM^!DT9X!oOUaBNT=<89`AVxp;)xqIxK;Ij+1Kg($ z$lkbN(LH=iPMMK*eaIsy6BDrsElH z%Ra|d${Hs3TuqVc&miJd&Xf3t91yr{Vqsqg(ZGHv5}6OEq9*P@Fyg)&ub3LcwHRZ|i4W zhM+k#(}tZN34yt6X|-(QGhC=tR%LjD!VJVK+4Q*TM!pXAv$((dj(PZh=8fUj`}&+@Ky6=Sx>jK1P2 zYhh)H)_$J9Ha>0&}cj|+k?xdHD|>{QKkwy$rs zU70^PP9|lPvsPYPeeo<-hI4aCSGg=zp`hZpYPg@#*b@$D-GW-jt)1@dh(?q*( z&k29ek3o0jpKC}~-dVqq;9AE9!9--N-w*cEh?;*EWrSmWq63*}-dFOIPO0nwa z;wQ@m{9~KtiqsLz6+mR5l3Ka82ER*Ps#az_kK5`5S^~Gck=)es+zm`22S1A1fFlH} zq>L@{2;6+m7d&h^^{5kG8eoA_JT{^9)A?yNu@$58u6FD zgh5O!g@m&d$>-C9#iv{CW_;Uyn?CJeXUSVpbEsdcC)*UY1ZAJGO4Zytc8qW0*XM5E z7}-TpUTk}a=QDYTp+3ykgX6K3U`p8WJ|1z3<$vgxKW3{dF@m0oT z5z)>vDN3gleolLm$kKY+^Bjd+%J*SDoH`G$k=1Gmy}x0ek`77S4fwEt{EBY!hR^gZ zMR|=zS&6_*43ceS+4ntm?9r=wzW&C|iQS4jXd`LKZoA0Ji8#K-cuh#GrjU46s9G^o z$0r+auB5%5H1XNuK;UH*r6aefAWhbUj?r2*0Olb1NKjitsdoL@5Xu`lR2z_@{do0y zVXUJA@50aC%-lOUEgq9}!dZc{lLZe)nqTJ1YrS9HFg*NA&-Oeb1RG+*_vRTL1-*%T zjDMg>WR27RV%)hKn!(qmc7JDdMZo^vf}&w}=x)ZA?)Jb@Fe-7UM>ZD+)lG;Orpx@i zHL6pTj7lKl#M6M))((|{2Vml2jL3d03YM8UgAI$|#eOCe!^b!UCllDM)t`>?^GM&L zIJ&v@O+4)_4A7Od(rfRWT@myv#)H`_V`PtJ~?^!G$PoNFf!*Szf;;Vx!4pT*PricI{ z*-`UtFl7$<_OQ88tgeV08_Q;tAL+FX>tO7Z7Rx}XpBVJjjzetDKF!0s9)7#A?)In$ zfNoIv6A5LsuHB<7vn(S%*=+F{?5EJJgt>C8@#=PQ{Y#n2W@zeemv2v-n0PJLEAx(-Yp}JB8Pzj!&8+ zNq|vysk^Q(#{_5MZ zW}<*~kHH(%g9}J;Ui%!A|cj6Pq`Y#WyHS>rsUmiUL#_1tVM7S2D8B?>MB(3=ixDR3j?-Ao^rlNK3^PWKq{lfU%J8nF8;cU z09_kqMTwv9w+)GZ7ZTGEo`KF=jbv!M+rp>2>zYC>Y*$p*-jRv%>ed@$Yr$RbA1`Ld z7w+m*D|;L-vSNT3Kc^0hmyHCtw~_CU9eU1cWwqR<&{4C#nu||((Ik$Kc6??b-`RO~ z++Pv~F|Vh-XYis^T~F^ADu<^Q7jHuJ3RUttx{CwtfHM`P(a~)GhZqA zqpDAhGG_W9#)juw1DB}JxlnD+N%L{m6}!U_A+vq|YT@(}&O88kI`#I5_pa~A?a-%f zoh@X0QVXBO08y!5#^@gFWiAK`5V&n*k|;eKWn=Y)}B9_^fSD zx1PYMa+j4&BsH76E|(6%f7CuXY5Jfe{PbuiK1j*CHe)MDZEg66j^$!aG0fyPi(Q_; zNuYn9_kxJBgo(Z3*++~ll(h5=b}uwrY{ppzKtoOUj;yS#zXW!8SOd)TodX?5;}YZF z5uRMOFVlm$1)W~8Q>aOe=KxHi-SQ+T?vdpi@v%VJl_qOoruO~Uea`11*eT5iA;%J| z;n*5DG4pzHvmP5c{n$=Y+Q#WPTrP#V#x)_P#xW#lq&0^dz|8es+<&Jpm372bs%IIN zSkhvKqz*3iBYj#=cHDoyRavv~l#O4jZ`E6wLag@s5EFoUgcq7?j0#r%7@H&GQ+e$~ z`={%YC>6_g6L;|e%HS=xLywCXKyzc&bd=zDU@4(9@saty!32Qj^NY(tK=*YyKH{?S zT*2JA{;!12T^jhZVYa>*tFz7ebjk%@Z~M4;cJ8x+Qlh7nzrvYU8S|~aqupY6JrC>} z#k%R(VshYImuC=e#V^)*WnkYvewC1P^+Jf$r?~j|w4v10rj}TkEcsXNbP{;ecu3v9Y4(#>93CeZ^ z%iIWJB?l2QxQumPXm>c2TcxOkqNv2NfZ+W*Fug84|8~i61^r~L_H+^-1}~7hI>3QD zny4RMl_6r7|7$ZRH@~7w6o?(E+J+Y9PGu?w_JSFe@9FQ4*TQG$O6&!2&^UEKfD<8^ z3wkCx2C(D!bauz(tonR*(FH`>>v`?*D~A=CoxwhbNn=pLSN@i;8W6XUxH~wmi$}Ty zlYU(^mHd1WQGanW_yP2lyQcp9>qS3-(=CFqddY~P>`VaLTYtMrIcfm!e6498BHK{v>++Xt zh(d3zHo#}}u@mIz?Y@_9Z`MuvK{O3+I<$H*isu8{z$3+h2L~Op{S3R1>6r2RC%@_T0(u6(Qx;ro!F7?P)4$^y}99US@!dq zhkt(`5yO-ZdT^}dm(ZBKmi50^Rj=V2I1$yVy=*b=o$+Y&pvl91{G0hvQss^YiT2ld zowCJO{KkE(aJ-QxRdR^W%NDZZR2-nb?Qa0dl#pkJh(hK(o3*vMsDfb4wO@S>08e}2q|0{7V(xH-@N=mg?DT*NfQ&XI~XifE{)ZjlHRqFJKVWp z;bXrQ)2N9kH?0+W7Bov$pbKoO*YwRc9(<*CFFN z%G7~D*|aI6(EwPG&3VV=XgS- ze6tW=yc#mb2Va}|uALxpyI4>_XZcO=%ueH6+rz>2QlQIM8Nn*l?7{%kj+`sk zwOnIWcy;&P*%E@hf)O({d3r7@)y>;)4J3SBxk1sMMeOz71-9ajyt*^|TqP+ajiJ~? zt1{p`hwp!Autwv=UWH?ylf(@MMr(aF0PGGNBXn3r8MW%BR7|=E2oX`5F18Wr_s8}n zb>4g1*OMPY_)v6hY9Ubvp}=hbbFWo@hMZgqI6S{3WfX8YY(LC=rt&D`;tK)UWe>yG z75Rquq65k=pDgsFf6LDA$~e`8PY}a+h_owz4?KL`fk7A>W0|Z?T!izeeDed>kIr_u z@wE<22#2QajO~5(<{(sUhtGLwv<}`*L84n03AFx-1JEnVcrwsf&inL!x7ewwZy~{ zuxaQ-Wc2!=JIrCf4>NPCz*9E5ml6q&g~jvbaQ^Ak!@X9LA($l_t<|r%(oPmB-h}A& zGTd>XC*y+aGPhFoDXsArFNn9hI-eGgy3H;4g0BM(P*#%Tc#O6`<7F z@}wKz{U~EumUUpk5lj#b&En16>_794ieBOXL?!wy&yfb%mgr6@QdvXZ9LS>;=7A1o)S;74txSVgbKqTyCRm8lN4C=SIrDZn@^QgqMP>fjhcOCL*?CD~xy3gQ>6D=`| zRrj6i0^AS7SC6id_~ojyo4O658RRPLFXB=FaE)S-_~x|NX|%z`At!E=L&CQX33JuH zB6+jTGpTt{D#t}~Rua2I2x{ORoC~mrsY@+s?vVOV*WJXJn;p~+T#T2^hX%!&Ad+Y&u@%^< zUE=ez;;QArb1k>>?_S!%_)*oV{k*{T$n9xm2PvpU{J?E)lSR(1^GBD55hQ#chDNs2 zGr>+n)8V*9@RD6R1Z??+XHd>&J^DFIO!pht_AES$R>JD~Ow_Y>HM1(8to9@3uc==h z-pqi*0O{Uw_0Bnv3>Lu-W0J*M*q6N!HnYvmU`&>qD4&Q^6}cM^_h7k=jG+sl+yMzN zzW@&wN*QJe4iejn!H+M3-_-z#ZCGA;2Pr{%SgXff%afb87DW+U3_;twZssDWM4&u*{% z`2vn6v3MwiIz%eoby>rdDN`#s3qhjZ9v2A0KRFe$AS}b2H!5(4sHqTzt;fj zMqFCOMc^<>@rnx>Gl%rFqx@kzf))U7`2t9$=|v0QHsh>Q?!uCa&pz*lionYN4{A_3 zCIJerg7ka!(2+Wj@%V?^$j(n-dqLCxNY%DX;Xpe?(TYoy3{4Uqzz_w51Y&S-6)S&M zUls(az#od^Z%Lg&8*n&1(^VzasW?qz_8V*b5y{q=9)t?6V*1bOJ;-2=x<^%{$)-^H zGR z$eaMM1u1JNs8bq68@~dcrh026``33jcC-6pigsWw}it9F%4Uh2SHI9eck>a zA1KHz_~$^2xBofNe=PJL3;jRfa$^h}9DUO-as}9L);irA!uy$kKAQX#^i+p{3Q}<% z7*5ETGLUeLrTmT%ps!y9eKyU1La5Dfk!|sz@mDGhM_T+A2%+tM6m=CaREhypIB#m@ z_*!1^wB0UJoUu#Oehsr;%T+eCi{cVi!G(gqK(+_>iN8N$BFyY8!kA1p)w^i{HVqGe z?J`KujBYT>lm%^)K&}NX6qW^nt{fQJ6re@66=mv3+aA+ywBjToG=`uzR>R_~#7rOw z0l{mSjZ7qmM&n<-0Nxp5z%PIzY+py84u4PdEbLwaJnKWY_tSoDvI!EUd4vAf763DG zZ3X$VrA}dSDDd<2w66XC8G-#Fi1Ep`k=*U)_&{bENc%qp?hzC`0Zg9u;;RQ4j6l@l zMFm@u)beE zn0~Wq1_Gjq_DMq_XAmvX=y|_^2xGFmBd2 z9Tvt?%S)_4)HsDw{piG1L>s`u%@4-Z1ZWxXFZ}fzmHmxtk_VutIvVC8>t4R*q6=_z z=Qwh>O}q<+58&>WD)@k$oou`)IBKbsvzuPuwEcgLB0{1DS!gXVB~My z82=~Q{f)=4AbHkEKSWoxh?S)b$Xf)<3y8nV3!rrVC%(QHD;;^iHFYhff%wV~Oci}| z%)ml76-3ILeKvn zjo_Ckvrq^_B@N`$Bv=j5AU>!LpiY435(M z9jDc>;-LV=&8DoFO4ZL+ccZ~_2yKcH!L$J^qJSj*bb8ccF&P}QGDM)2DnRLXhtM!P z_~k(kup}ZoHxOx%quexy+v7Q&57%uGrkTXQ6=cAKQ-kr3a@f$6BMo6C#1~)30~UyA z-av#4#?BuE(gTX6zj>3v>=`^;(BMS*Jt+K(3M!R93Rhe}*2w%?9%vA(v^u~-oc8~+ zIk+wge@`e9ToS$pSO6|k^_hSGn9XjNfz=7d-_?o2y-5VwFU4i|Y)Cl35hSgMgx#D* zwxDh#z<&XwynD5iMZ{_l6*S6!`H-WnOzHHy&6hd83sRd4-;HG#4LZ_xE0R<7@(Gqg zJ`9qOF-r$%zA6_eKDbPCKSk5XZatdVK$pa61lBje8qUL7uoC0y=w)Mca_0$%4fVWX#C1zmb%-(@Mlxzg88jz8Dys`xzy3G_%sG=ohoVjV&Ms|*O@+g30v zmC}YsoeynaJoNu*8rxK!C^+=&$P-T+M#kUeL3P!=X=97@f6Z#)00#kq{$L|b=7+Zd8lY)ObAhY4mAEa-9?0b4hC0*KCi!~oI?M5 z=*oN};@_vy?KY0mBrWF<77t#3bfZRv5B#3-p%+)_bCl9fDh5gK6TkOPkArsY4Z{MR z$oxgbH%e#x>3?2Ln-2DmK>pDXbj1JfO@=nOrhJ6tIO_NOA)E)iijfB@i(!3tX_Cf@1*@cJU*hsVt zi0HT889?LL`;zIb5H#}R-kbGl`3oCEowCVEc~X4HUM?DJh^hf|m|18!H#nGT3TL{| zq1tO|yM7~HGAriO9yI%p6mps)Z$%P7@)YeEO)7Q)gnD1|#rU7nOJ<4jgM&E5_z$s0 z=nK&+c2zcHMQRJdaWopRbjTPGgs1WGFCs2;vVqetXxXZ(C=UalY>#ACWaX)F3~lYJ zNReF+hbJJ@@85qXWAagmjXsCl*NdkRbjJV1+kXFwoqtC7naXKd{W+`Xkmq(~&kodH zO=ctI3wHvtIe9q2|H#q?Im=VTYLFl81;QHC@8J-Od#hYT>{yi_5(=!cm{iwKakkx+7ZtIt^Re%ELq%3EaN8$b%<#Pl(5Y zJCIk=`9qF{(EVSML|L%a|44nod8(>^1Pe-cI)rCW*q4=gK(U@q09E8R!|l3Aa8Cvt z#=Q#aV1R#GMDac`3~ng4?2937a7GIgx$!SnEqGD;mtp+xy&23klo{$0;o*bQU}G_| z3-ZBi?@E0?0q3&$8lI_r&mQhzXkE(hLJ}gr*7#sr>uFl|u!AsG-D>@?`OYVz-(1(h zwSiB_v_V_A^hdwHh^62iywZ$CiP%K3H;#F3H(*PqWSTbe%?T@n&(gC)4?;lv z$13qT=Ja`ee*P5Qy}}Mim(KWOtprl1i@5lX-S)4Xxp%}`N073;uFK>zHDHx6$4B>9 zTg0)_aG^(w8=Bp61+|ioQVhkZUn|$2pKSnwmlYBbV6TrW1`-Uiuu@}{s|ty=XHl7t zmm)1CBwR-+sUp`RB72-}E)qbFqxSvXN#Vf2MEEwcfOWt;ww9XPsa$Hs3?2<_ti#!m z5LsEJn7zqRl?2+rfjz7_w36bv$Gj;Y3)Z<|6s@=0doj3mulvmJ&}*ITSKCdKBKJ$f zxwpa2#^VoL!xT+M1J}RPh+yjFVi2z>gC|JTE+!~JZM5MtP~6S!mn*VDK>^s)^ff*XzsW)e-T^AGChHtnqEU1HSFj7;M=adxx)1sF1uP&25aBmzoFwz>!9< zM0j0YMg+TEY6=byMjLR*&}e?Wp!45@9ex4EB*W&2?MiKsY4(lvizt@Y-|C+OeGAY+?9wsFCZQhr8!{L~PQt6H1;dx|?9W zS@4C(ms%2Z&F1vwqGqN0n_yVWf(T;e!{tB+e;qlIW9(|oPuV{l3?y6T^?w84bx5xs z0)rGR{5kE6u+O-Izth2vrEh)d%!8ZLWXxBq*TRyw9n5(@9{wGb-Hx{}%0N=6tYy*P z_Fw*%m;!J_L#D7VPIny|(J%LrcMkgwyX^{s>$&HtX=l$K(GS3-Uk?9^ z1>)&GlASOljD2o!=(79%qba2=J7J#!d3kV^yea~qByW#fp4Q|#)HmmKSWp>~@(}UG zb+5VW;HTozZQAyGiMwNyiZ9HCh7o*U!~lqwF2xDHji__J1Bp^5%`B}D0F6Q9uUl@q z^njy?Tut&)`5*R;mCwwACTm241tbt8+mOs5hR%^)A9uj@^%ibPyM*nGOeWWk=9qfa z;|76(@RKkv#EGi$uk!3GGiS|XJJzeS){-AKs}*!DLH_@{G{P^*8M`|USSF-N`=FV1 z2q!t{3Dcj)KkZ_aS@(HWOTTM!t2W{8&#@rNO4iRg4pZRDI-ockF_%}l_0?o@A0du z5S-d5N7X-1K|H+q_| zS9G>1Wg5wHw_`017xnFXyqLLAqSj6Y`x*S>lGb zT+k_BT^H&AP{|9&V_zd+T=Q_>?RR6Cq3O^(cGwrOp5b5@%hla~j2PtQI1j&n8#m#2 z!pTB}4}N+L!_1;{3g(vW4u$_U^>kEBWUW4%R9-^lS^hm#FrALNA`jQjW3Mah37;^+ z&PYQ%gBZ>p%d<%QnAx^K+(oyS-zMsMG?(_~Mp~mRx_!1E$?p|#yv!$wKzEpPJk-Rw zVIP7i10v!luxLk8%*B=g+`)g(i#HJY;r)}8b{eSM*8I#?NaGgHcgmbbVmoa&iPNw6 zf7aYnzC3j%cr6?sj91fQHLtJPhhgxz4s@5m%UcoA4>I1rJ~Y^thBnV4H~+pDB3}Lo zHF)R$h8hHCBU@jYXEmk$YtC@9&<6X$m9&saLd#l8F*S7n>g{YQKzoUYS-N=4rd3!Yfi4}mYJla`CW(8_}y1_Wn7RRS9QPd z+T5BaMvwynhVn+=n7{Tgan8U9s+DJdJ!=0K3jnu=+{K%*K(hX0tL^KtgTEE?e*^pzi2Q0Ysnxv1UTD^PGyv*bSH6$*iKj zzPWE#AYL}%YuSaR=<_*jec!HP=GO<}x^naw;4Wk=QVa0RSempIKoExZ<|IRW(0r{NDTU`^Ja87=Quk@ENmsPu;6J5HvHRnv5oubYN)bCd}pIa}$2S3PmcQBzXVKgI+!rW$+P?}n-gSAWL zro2316K$&~DM=U%w41mSjJ)@D>4VVkO0)O=op*O6#gEX<)<@jRSAW;*HaF;arji%Z zqzkHdvb}bzcPpcQ1|9%b7TxSliJzz~qaPH0F3+mScpX_3Y@rNYnmtKH)q8?bCf z8#}!y%f_N*tVPo42_iigClY>lDqifSj-+=tn8-JLlBzwTp;q`yL(L4RV1dMhyjnkW zq$Lr5c%$`UIsPgx4*M{5@Hs0e&WRop9iMq0J8#XwB>N9+LePI97y+O2{_|0?ql;IG zWxXxe*w~naG2m^n^JxP^Q^`cm_e+;E%MF_VBXUS6BI4|#+{ig)`N*AHxVyD=JMM|oYyZMwBJ;lRRC?GkBJVyBxcI|W z&J1XR#rUqzz+rv@Tn-C3aQL~@##{n|;Qzj-l^qHQh^@AJ7J+0s=?>+iG8}_?N12J0W&n!@2C+uCY)SV8UkfPpJYES5KLmOt zCWnhi`XA052jhbiqf#eOVB>#?6sYMTBbTVy^m zmHhT|1&WX3b*0Q|fF&1(gQaCF4~n76K|?Vd?P8OisEYBV3Saq2koF-Hi*99q`q^v- zhPz#Q`Yxv+Q?JTRME;c;X^7CGz|9np(9^bmp<=uu0&I)WwNRs`<7vwF{Se*1vMJ@_n&fros4h5oxiRETn^< z;?7cM58xhF3^t{a2V7K*3qwPO)|bAEMUkg9iiZ~tfiYx#S_L90_*bs)E7~Kp)H}7; zlWSklyqrO2_An`S0*wu~K;^&0=5-BV%N_g50iiq?+p#iYBv@T{+tntD&H%pGu%a8n zXSi6Lde>l$vpyc#9kapSr>hgG`i0y z$hdy%ekDyw=BG2wa0N#at#TeqYil`~v;g4{aA_VCziA$w{z!-*_dO$vz3*OWQIUfftCPJWi@kn$Le4Qj z6gW1{5FtVlL$&#oV{c;u zkXveD&dj8aeYFgJrX-oV$~A_@dVu>RfK zR3O8Uer~j5x+|ho28d8py!tCNg5YzhC@Qi|NRV&k_R)HHzc!!LWE(ZZT1WdLqEnxC z3!uNQg;zCs&n+(^U?D%F=; z4}j81@e|h7$>Bpgi}|L+^<6g5yA^>trV6&ZI%ytO`$`AGrJH^ni8b*3?QumkSdBG= zNA07qty3rUj1iP@LT?aic$oFFzwT+u0-A`49|2M>v-LGn5*@?WHEP{@#+ZJ(EibcK zd%cUB;dKxS!iYMasH5S*s>0m(NQR8~jx+*PRQ{Th_4?qx`f@r>W)Rnff&P-i_ZXV+ z!V&7>EX5vYx9Cm*rGn}X(kdP%Cg#9h8aIWZD)v}*l-2`Q1L?7d7K_>CVzEczv-Keo;-`ta2=$Zyyb5N65rTQ#_Q6~OF(Oa?lPqx7juss5=|x*w zh_SAxmTw73^YoR))qnBd2O`hWH((?Rk!<38C#nRlb6aTZfTKvuVt)MTx9%heE*;oita1SdGgU{Hp zzx`RX9}W<7Mub{_vO9EQTFa6AmqY_O(zn}Eo%Gt6W6sg_8Yd$;HFXH@D0nFI9iSZ zwXQqA`@nxhCLDh9tbXt8=;*kgc-1gAfBO{D%*;%>P1fV;6bnVe@s}T^#z~v*u~ckl zKe0<;c|p`g__@Z|G3`JFO@nav?6(xdT5Q`Thf<;x!*^$ymaZJgWf=BvDTe2Z$FMxB zx!vokE|)1B7q29zr(Vv=YOR9VoAds|e0-$HX#|Y>JkYSQup#o7|IQNzpPO%L;8u~F zp}R)*L?2f;lVJTc%#5MVCygJX&LS-^(z?woeyc4^vhN(x zzti_n{g+Tn*K?4fxEH;ogDO96j`ria=B|MAPaG}l=uA(uZQQMWLy|r!<|+|{;=w%U z*5=mdN01u`oTlXVd`qb=yRw*IV$C82cVulY}-rWH0a%bue&jfEx;D&dK8aZZ>Hlza(fg&2`Huc zYd;eB5Bvl32FB1&zRHD^k z#%cwd+Dc6ssMh12bEEh5v}-oa(qt87PyKF6!B2^=bW(gmj+rMH2y{Su&bfIBP3X$# z+f{Rb=v$w&D#Q1Ol3+ld%r`b+XZ#%C8jkKFfkM2^lhaZz#l^wmv4t?>tEZDwUTHhP zGO1iOf{s`5uKN$^o16Vi_8Oa=9lJ(T$ZQ>d?;ahU0+9gtBlF+-{OJzly3YyHpU-|T7^rZ%RTXw~*wA&8{fKE>`eJUpvg&VU zdXJ`01Mr)y%L%kjM$oMYvq{heA{az)DVkA$eO|g!YLN=UGPu#mYltPke3%hR6-twr zCllLKLE9_R^8Tp;1Hf%vpPp1xS8G4?J=CW;5Dfb`D!%b`?fX*7UHQbmOWqQE7_W;K z&Lw327VpVDbdJfd;95k8%)D@UwWW`BOx82nTy_6e_x4jyvztW#~0pn8?XVUomaBRh18Z|fl<3?c~>G5Xi z!e#FKA$j%<_Ue{r-nL#97t(HR%eM`5uB9X$)zFTr?(WXHQWO+_gd&(f7(pyq+j=)$ zejU}ev!}H^UI1G2OiCl#rD@UqmVjuF{_JYSf>2jZKSloM4Z6Mc1u<6>N*c- zna=eU03u*L*AiR&w?))hh$UxjXv^+!#zIjBbWZ!)&j?zK(Fa8NQ8IeeQOLMT2U#fN z*c|H&jaJ8G7(C@wo$Z?Dt+~af_R5##FnO0;*eyLgvPI2Qf4HYqKl^4=n9BQMYNWHf zAon~Hm&gd{{3)#THdB&P5ml23g4QC08bBGhpjPWlB%t0)C9W7eQ4I-7CxMo5}Tb~}%%XE?y@m<_;p_P|Dj)(&U>2w-C zp6Vk-Q3_%z&Ztp*%);=7JE(ZhA@_z{u>7FS^)qmU#e~=(9iuUWnicZ5^{_cV_TS4` z_osK`3^=}>7d|x!&LoZEsPdJ11WnBSh0xmPJ1cYC_v)WNxnnuw8aON3L&A&xygy+(uPj{S$h;Jc889*H?jF{JQh@-1PK~F22jX zcu(U|(yNaL5jZi#$&xdQq|atJU^B1)N=5?HYQBb?F5`mAlWJ!Fyp)Ia;vBLmy$vtP z-k!}ndX|D1BT2<$fBN}Sh*CnbC$$ac(;n!Nqj%`FfD{Y_(7xMGfX0PPYjY_00l2ehw8+Y+g4WrE|JgcooY5nSX}wT=Ie)}k{|VbAnfa(d4s1lObzgx&D{fiuZU=gf`1BKr2v!roUhJpwj0Fb(m-nf9c8N) zcoYY87J7l5s{|LOK|+oqGw|fj0h#@3Ta;>#DO4ET$}Rdjg~eY3ahpN^k!Ix;^gV8A z)v?X;C76MKNMk1~;59qF@b%a<(P=$-prJOs@juOF(t#)!z|^&Gyh)VEz>6nX2UHVg z{zQ!&o=Yoy^fsJS!p&;UmC~+L8VKi$7Naa<12MN&HdBToo|;l?64h-czbVj_ZtHXEY!6NDD1AHD1plxnvQSk`y|{XLWw?EA}<=(%~h&--0H{-Jd|A!AE=9 zuIEUhq47>y!tgR$VJ$~ahbZiGq5;Ek$}5E~_#`EZ%r)~wF(moY{aw`?ck8#`F60vs z^*Xa}3t^UO!8H604e|GW(s1l_aCxLr&Ze<&ukOS%fV@C(=uR6fdnMeNb z&paUJzyF>@sZU&)w@c;8@rQ9!(;UvH$R3J>ycdIz{&cIO9O1QcsaOl~pnqEc*$@zu z;fe_nC2Srua-$#T<)KA*X>>SQ>QMI5DF>(A=iAH5`=BahVi}p@4 zTPFy}b@(#~T{_M{>x2I=3ICBM7^*sT%#ss426y2%lB$dKq~@d* ztkGr}tIx8|gbmP~l`#^Rm1PZO9@>5y>tS`y-^|cZ!bWK6auD6v7{kQ6xRlgc{$l(3 zf=ZXXi5kKAC6+t3fUe-o*49V*oRFtY=tsEQej|9?`)$3o6d-C-!g3ob7zxZ%T&sbY zeYk*!3Q2e*9aww)Bn+3Nenb5bdYi?Lqk%CgbtWbx`gmMKWawRE|CPckpS3+Sl$4x` z;jb!*(|k9+5wq*9H@K!agaI8kAQEu+-`bSBMD-CE|H+uT4%qfQCigJKA}xs#rLISX~cV>rLp41+(_5Q-6ABNQ(bL- zNX2lcOZeAkWQ@1-^Yf3xE_ooz6<*wEcwU#g{9B>n`@a<$Qq~|)S7CKZBq|heb?id- zkiW4#&3s~g^$jEY-i0tyS>|Z^OBZ`CC*gMQ&Kea)+LKegO-Kkt#GKO*v@MG{bG?vS zUgoUDq-)F$d(iPAgmUaP{&$GFPTG}Y$^lbiiX7<=d6!>r`LO@#R*U{O#Q;Cz`bCNZ z&4H{@+f6?_Jl(8jGo4PL{}EF_2BY9QNt7v_Ih7~ZP%A$+RrnY=Z!ONSa9h-9#jfCU z{&KjIT^JQk*sl5b1{^5FxTn^MN6MISr(Hqly96IWzdX-q&W)IhYJaaTO*_j(bY|L> z%fwYDvugvyn90Q0HstD$>qN@-ZQZJ-JQXZv&gEWs{1|`SDNhAZ*-7r{iBakyg`zz; z8RXB@=SeOsESy3_er=q%gj#UEskZgxxQF!=?l_^6fyt)~fpen22{J|>-c#C*~c2TM**3{)99dn)A8Ws&kmQ z8>=y?V()7>uulPcZb<; z)Sm9>eX9CLaiKe-=v=Kh4f|kdf>;+hXx-)St#<9m3(X}_UJxqP=f4_Fd70kuOIa1~ z@xxjSo5n}mgIjM+`#-%ndZh(tmHX2kinixgSEsG2P7%p&cgGH{a9=~T0qS|{NT|_4 z7h*0YFeu-^~I?4yp+pQOEu67C&o+0aLqagd--%==5t!lkdKzD}yB zp)K1+e_in3oJBch%c0QINX$eHZ&U8I42 zkG$i%13L3iu*nloDA3ic?2XufTA2-N?|A**ApVNxTl{$4L z@~0&;?B<`FJFy{z+VGQ+M9v)+_Mf%o+XEkN&JQo#Td|!_oqW=6;@cA}axY^G zXAp=TT0?uUJT{6K(-*2-9T5RK6Y_kST#GG@g+(l88pOYX*d{6RX5s8@x)TSH$ebMd3Q}hrq02>jKp4d zH-(s^-%dhT!^ysh&3BQ1u>eE2kJztM8X^mb?0=0H5F<7N$esNzCczR|W{9(E-vb`= zdcqZTUGf$CP^P|smSYUuMk^dATd2e(gC9h_o?({BE&BR(ta`%D)uLXznZK$blIC!( zUc|Qbg1%_GN&o~(G>VVqppy{dY06mrX3HG1Ea;`Az(@cTi`f;Z-wjY zdf+^u_F@>#sUB)z8t1CnA7@%gVQD9DiL9^5`CoKP-E1zXnD~mFk0RAAjGJ4IQh0!k zn*^6$Ii$kp!RvRco0%~6roum6gs5P57bUR=2}K9$o39EN(1$>?oh^x?Ff89qfo~Yf z3Ec`bAanxuP)>sam;BfB_%-)8vIHI*BoUg`p_Sy!evLMjZMd^igxBIChRn~)OF-rx zLt=4VCq++Q<=W%$#qAVL*qiDrwaay!fX)3?=!Ks?Kg$+7IH<$q_b&VpG@0#w>O^l6 zt)c?diwLK}^Xc72BiB8{9`+0bA@v(Z?m%TqzP6r14P?9HulF;?%yumwc%~S$RC=7| zs`he}D}pTOloy5I`^`TJG65Csc9dTb8CUhWpZd?{;m@>s@67}rV$&~Z_fb0JXYb*J zs;$A@&#zh5mE`u#ck}CI*s(pb`l(K&B*PEqV(cL^li&&>TH~s17|D*)kl$1Ccyr}@ zC@8(!Gpc&2vQt&aNo?H?s=7qK9d$4G`7Hs5dcNG0CX(JoL6Xhu?l3mCu`Eln6Can( zT9PH`9%Gxy%6l4!(RhD?&E9OAMXVv_?5U#Vobw?vAJ|MeV|Z_$kMeo9bbiii0-aYR z<+fHaa4$-BFvZT#Zf#q*^%@RSF`qQUW?54sIiIxe-RUyZbiRVKcsq#ATJ1Jsx!b)_ zRi}k0snNdCqY>U!Fn%jmM{aVCf5l1A>5-TcbS~G_9tTQXS z(7J!p(*L-fUo~W2bmFvs71Ru}tMBE6B2O7NKCzz@KK*)h)p_?OtDiR@D6aw)Xp8!Z z_xMC@E@Vd*1;5~n3_XiX7XP`g7*vv2oMt48IB)2!?xLW%H%_}6Y4{$>KNgKxTM0(U#`~#qR{$ROJ8NN&)Ha+*|`&l zt2*BwzlG4&2<*)t?n4XAz3D#LCi!O2Nu%WILQ2m$7RK8=J!j@EV^6sXd|=O`zpBD3 zyv3(3AM`3(YEeDb@rAZmy}DG$32Dc077>GZTA~z%oTa4Z4R^Ae3b`GINkTrS!62>F zbW|fc>G9@^>!T5Op2Qu7jit_72oE~#LbySl6KARt)0WfiyDlFDCwm4rAWq8@H=K7g zz3qZ|qUBZINPle4&y5t4yb3ue(dLt|s6Dj=roA5zhw8NL1cvy;%^f$g1|MhRvqx>M z%Lc-W5OOWzVL!h;|8T(|7-1t|^kTq?lS+J3mC~GNHb{_bc3eD5ouVwLg-`#CwBs0M zWHe=R50CI-(jCH0ql~2!f{ZX1N_yyr$!M;{wA1mMI@EJ_`<{PugVZ$#Ylle(piQ%_ zJE2|v?(IykhFndcx8EKzD#xyG;8hMrG!Hbiqm$0{?R`a?bnO{LQu-rXvoNV?pIw=~ zp1=EiGVdE)ZbzZ=F=~GnSMcnD(e`D#`BMVYZ`MDYB#CNhC|w@xk6`=s^^~hy2>r?Z z82*^63N3u(PZ5$yQPE`ki@^w~aCTXuN`#Vi8cN(!jiTq&zNVIvz-$l#u92yOPntz2 z^x@HBdEXm1T0c16&&1Era})Ls2L_EBCYfVHy|pdscTPFuI2d78qa9x_J^uO3Yw6u5 z3yAmWY$;=-kR-*!<(MlAR2GldNPgn#z9gCtmQ1qS$T z%BU+O@e3Zx-c3sZ7HtE`kcT2U3$}M@vAfT$wk78@b(tn80WxoPDZXF&t8fu|0lryz zO@FvKQ9U0SJ1%));Uo%m&I5-{ZyPSwh=&OU}C+Z@eA9 z$(fL8C7Qg3)C zl9yon+r*is2}@dS28g;wA}iRYkpUk+QqMQAia5Z#3p+CfCkFRgce|NW@z zJdI=zAA6+)iVD1mU9YnJqUA12pk%}8i|ff3Y%}l~KCPE3)vxn9?Sd%>!8($vg2Aq* ze(%xhtAo+d))=&D)o#v=kdgzW(}LQis~L66+0hMDgu!Adrgt!R-s#6qeUHyu+8Ia0 zSw~W$9z=_2c*&_>k)x^N^Wx1np>dq2zo9bO&Ewv}*DN!Os`BDP^Jr+#Hg`6s_S0zd z3zm!T{4DZceghpe7LSZ*Xx|De3zKMl1dZ>7Y019t*w!l(s8Mu^k@K4`tE2n95Y#zG zu*VEAk*pV!pEVnT51&l`f^7dQKEVQTxv>$6AGaSK=@!~jSyoAAV{@lm;Msw^ zH|ZMW(j>V#n^bl(evy*q)5v9UbIyurK2}!=6}ao=kXcmpL)`k$B~HGspyaPNC_{Lb zB4ahE@QZm$b4USHwrN@@uav`nQwgPq(!{5Q+F6z2iJU;3B?d$#9CMtb$o&m|v@bRo z%4QPvePhUXvU)sybF%7S@}?fVxF{n0lY@Q6?Ed?}m#oRW>N2xN-vR;x49~HOGXx($ z^6QvwtCwM1$ai{*H5Tsjq?#?LDEQ%BE;ZdLJiIfvXK!Xui12}~Nc3B}>2kZWHl;bY zEN3jIU+1M&n_z;@1P2Q|-&9rNc~G+DRma_E4JtGP!`&;}3-uSZmiG_ubp?D-!o3`4 zoHmoH|FsQ6UL-UEEVK7$beAZ8_@evXwPnL;W2cQfkrqsg{-f>g+-Q&0kDhT2+ff|% zthu7|cC0(Q&3}xqAzcp<@^xk0Kkew%pd8*d_iKG26X#JEf0inIf+9Ydk2g0OIPt~c*<>-U&F@_x zCkUaW{b1m@R_<<`zx_2UgoYz~b|>Ny71g*ABg{}8?0Qh++iSlX(AP?;tQdYTqWQSJ zbnQGgDxDpNuBGbSw?E8J^g7c3{=5O_(Q&A!UCoOI{ zlc|s0G;3aQi^@THm%s<;8`5!>42xF3tZgbE>=UpT|dGZr*@ zR^NSTEBV;X)(hCq3DZuVa%%!*KJxQ;TmwQ%tyN%sQxt{b-MO&uxR1NwCDd*#@9#Rb zR)_G=_sd$F!KXI_Ii*(iEnLyoKm^v1s35|tA8I?pLj2p=88^y62>ignrxs-7w$S;e z(jQ-WR>`9LtdhOqH3@_tNAK}_2_0d_FzL*)@HGY`TxR}LFm6FLpLVVFjAfgF603yO zbdXPfGZ&|>LxPt_X?!#m`K*7D&Vu*aHH~~S9)S&$vgYlmRITsxtvkb>Q;MZfZN{7O zplng2?$&}ItuLL7jo~l95e+Zee^yOpMCmnS<%#$(+W zVRL!cYb>*uuUKUIvc1=QgGa%cNIpK^hchAJKRTRkTGI$47vx_mT^40q?C5g3c|gl< zPrdx=Og4Vg@Ji<~t;{y9MA0&{$@LW@Nr$DrsmW)1tvBDp@)9lxFUR!0xw|7I9>6E~ zAkc%bYA~gHAtYDF_{$eq)AwwLo_gI0I#bRXBcXw2;qQxzw>)t^b(_Y zDMwcXVZmE>mS3>Y(TGrsuz1lxKhTUq`eAo_KQF%Cys_N(Ph5X(?GyKn*Leo-Xh&r7qr2eu}enxC(;W zL86FRBZ#1G?mH_LQ}8|B%kJM#m)ie|O*$@!S$jlscW7-CN?W$e*eJH{oYIdx7V~HU z&J!Q$=c*8G!o_yl_1!a3gF#4VMLyz7F%*|)z|>cqUtsVYd76Z^8T{Xv{i&9oDIrus zbk^B8K^@BZu!`NT{8pCR*_hmBGv~=tpC~zZqsV<48s~HgTZ{E{cC7JNXMZlvi)3RNMo{qqbA`H>1-vydf^N4OkFKKhPug~5&FFj1w)utEew z@)Y6MN87%0O!t&wG5wLf5C0g3Y>@nYwbu+#3MSk2FgJP1d_}qWyyVVfH$G<@WX5Odqo!Ek5TwGG^2wY#z+u|zSDI2`q z5>vcn*iONzM~pCW$~OmaJl8U$lNh-JmmsV_Hq_umR6-eeE(gEAPY=>0Oh7o8`8hT& ze)QLQX=FF8mcAX&z^aoyU4?88d-k(1laKdoAeEV@9ps+ zsbTS~0YT$OuP83zXCBhTg^9H}_`OPG?_3t1j<^p!xU6mUQ7&Qd^hU=b;CFl&VgLEl z|7_ELj>LZ~=gWV*#QzUHBC4SQLkyc_ZoTp+2KI50r~wci2p}dl!!HtSegWUO4FYKt z^5_GI99#~_5`xX%7D$D<33>;EJp`2#6q?%iX?h?3S`7H`3+Hyf$@|y{WD8l3a^)%B zlN*7CA*|9oRl;ksw4fGx#GoZIGrekrnM|^oPX-G;^Qx4B%=b+ne zc-Zp;#P8*(geXp8=>8q3M~K0G;}>K|{RTwef-Jn|QTgrNRXXka+drpe#VmE6?jT3d z!#mB7K#H(~+(CY&<2HW!1%6{!u0?GZlDq%Zo(w!0^6fUOcuc4gM{#5%%Hd|*+g_+> zV7?)|kxQ84_v#k0bVnZ!vgWcdAaD4+Bg93?jezo3IH>vw@Cnuu*LwCT>@qQ@EWv{y zJ(txCKl*?Hj}DRxWQp%Se1Md=)@2(cG1eCPYg&+o!zrvklE{c#V%4>P>-_|>5br}3 z;s>zCz295@9&V07F z$-H`Q`#m(s=2q-}^aV9nEqF zD~MLiwYO3bzuo2XT~uV7^?fWp-DBO(&DbK-XiR*@%^Ac&YB(5v4iyWy#cU0LS4v<(ZT=d%ZI`s9^?)Fhdp~kn> zPO)FK{i_su;lekXc160^%)l{BvL6g?wpE)Q>~x zUyzE;|DbaQAHKQmet);`3hdsXX0zJPc!+i*K~U* zsR2RzGS9P}Jz{0Xpqsi_DP-W92 zz_*c)mfp!=*^bAi5mje|&%Y6yTkht`Hwi z{U9z0+%C7Z7-9DhiCZ`joG2J*W&a3+i0#C_r?A z5>8)ZSYqE>O;|su#@r+$BTJi`V@r}aG1DAzyEj{Bdn{Y<_TVVlW@8w0|A$^Q%_%AO z@61~3U7!7U(xC&p+fJjCT(mhUz|;RSWv;M+h#Q79Jv`P=TY}g39#jrkBh zf`lg<>EtyfkLG5UTKg|lAH>`5aGF)9{pvt76%vw5mwMi5DYUgoi`kyC)`nhqKU{O{ za(HyZy;@O>>tHs>d;O<6Szz_{{PLrL_Fwcfn(3f?dH>3^u+JgHZiBOAeRR-&pCyJ3 zt-Xzd_q~up^N9-uJ_~F~_Muc9SRQiayHUOZlQov_Lhu?H(_4E3?!O?9z|U%VJysrt>!lw2;sC~#@~=pF)&DMDO?0yMrK)xkdD~j& zVfM?KGLP{PZeKGvvCTt;;*JX1BG#EIedn&Nuc;>}?o8s``nX9;~}+Djxnlxhm+|lZWcSwt*}5N_onz`?LubXv#9?(WH(3) z5dW9q^&~a~X%@az);@G@*4^Id93)){ihg3dJU?V9Qfb2e;XWfw)8VBhbE=dR4J9qA z2G?5WS;d$Zn^X&f?NNB@w(k`!KbP*=S)(`=w)pg3QYP_8g<|%9nwH=XNWSsPbwgoq z3=U0+2ffk3@NLMGBYRi2s4p^mt>AUdj|gkfM0xJ4Ueocwtv&2&oJg}!(GI1Ldw|k< zat+-6gR-dE8fC?g3g(N!$#fjv6|{ejZlYha`e@J2Zib5Jpfc2KM2CS&kQ^9*acF7? zn$?imX~ot$&F1R*31_#d-I8i-);qlMTG2%Wa6|=#dQCWwjmpd*e z!Z6*Yj6N4(lQX+BMjMuR9W-tpBXhmcZ1{3`#sRdQkK4 z6cl7@;9`eDnL4fLk9vO16fvz~-(Vdsv43LiaA4;*;-2x@#cMyA#?-+71b_1@r(6e7 z`;!j59a&T^k!RxtD$ejfzq)lz-^(D9-QLHgI7R-U$H%Vc(m(Pn+LACR`T1ys_7MNe zi>{yEPVGkwPgYi;JSzM$jCGhTc(nzC3e-QPBx!8u^*C?C+HMxK^?BQ{*^g{wj^O7f zq-1*dM6YVtBlr5Rvzi(@DkNWCP%8DEi>pijvEq$u(J%FC3p3Tc)*Bml?e$q>Y+bqC zW4PQt9Z5{AYP1dVUitkrZ`0=bz_@H;IJoN<7xvkD%S6PyxMy9pq@PPK9v#YQzCI!b?;au*)Kn#1^l<2wj-?IeP%r25?zt}rCSxkpg4Y#+>tL7Jk=c#CfttpmV9BOEAX!t|k(4G*>Ad-zfXC(|ztL9Fi> z9v0{F3TlsA-TaCjehIJbKL#2Wk5wfeY^R>X3XwO0(tjVb zpdU}PF#gW|JHd0)8j8hEjj9R0J`>YVziNlQUD~;=+wOHxkiHA{1a7qDDEucJuX#tN zCuCvP)Waq|1%plD_`50O1Lwb=5;)lRb0fQ|TyqMV&iYpLb8KER$%T!+nj}_k0$w8O z@$J2|45J@bG@al^8Ss%NLF6Jv4L>PnH_d~|Blx9pG)XjgwoC_`gqE?_0G2hm`okXQJlZkjN z8`mBd_x|8z^kcYUiKtq&JmwYKep2vV4H#@g8nr=xgLk!cNm~DgdZb%PT4#g(65~TH z4&j)$VgB%Zvr!yhcDOP0t)xi%gN|8}K6I%%kKkSmSvmwYag9Soi!<+f35INMu+5L0 z@{t`0pn5+#=h&b&kj?K{e7el5hX>Nk_*KbS{qu$6Jb3?7&dFvT#nM0c1<8BMyZtoJ zo#)x#&$&9_5(r-Z<PJg9hhw&!K3dBnhLA&Yu}8;Hb+16QXD^7212-rY_?k8mthz;gM{R#=2N z+(Ekt2>!^Fj-@=u2)kRI6Nz@Sd{%nW+dT9OoXL+7W^>RB^(Y>@kiO$2MKHu@YQMpD zaSNJA`D>;MTwdZ`9#Pgj6f&F6N__=R#D|cYdHvAP@=@9Sm?SY6Qjh~(=w2#eaaG9s zm7LWJqc4v&m(CP?NqsmjV(ePmr^3ajA%7>M?L7nOm(QiTnqJpRK1v`ZsTg0sEgqHn zgt~j+BvBS9{N*mbDLyIm+ueh-*{UbdRF!FNQp`295>~Gw-?4Pt6gk&T&4)~x%|o%p z`Ihf_Q)57(Q1jeSn5>|7c$_0gk-KCnJ50)b*fGuBbiX_b(?jPa`pbKu zd?%SjmCxD)h59HpLJ#}J5+W3`Sj1p#pT{kzJuQCr7eD_`&jnH1mZowWYBu=);_SWS zn%dfKQ41=FQWXTGLl6;=E}%q^UPM4aK#0<$qg1I;q(wSN5d;L3-mBDzQl8RE28s&hM8<8HVF=NwawkxTL_3JE7z|(dJy;y1>WY ze|=f4mEYiflJ-^Any}+{4lS17kZnwNY5%Fs6vdb166y_DmfpqT#J!uD;_xCcx`wInNaubAo;;zH9 zmlOa{B4d40IuV&H)^MyasRV(5}F%Xz3w33Gpu#O0?=uE2HGZUjJ;6|Je?JN+Grl zE*~Epq6_L-Dp}XfSe9pqUK+@P5ohz5z(+MmPy1&$uq@`(<_4!4rTisBO$r z{{(!wCzOm`TeWD;&_vbH%_y%?xpI;3LXV-ZllAuOu%W{CI-!hmeL}@LRh1e(i;_vBl9#x}6sqnjylz;I2G)eQu4ilg)5IGP$t$lRF*P=5Wd+ zw;WuBVy%n_@RL@D#}pv?YJ)7B@QYMDtSTNgdQ*tq_Yyyloj` zu8xCfCFS&}TOS`$%AY|>^kx>4EW~U_MCyPR-?wk7}mPtV`sv zEb1*w`cdHy&txmZ7=E;zKi_1S!L`49$5tG1{b{+ar9IUtU@6+KqWT+YR~%!KpDzSu zU)F`dvZKNY2duJ_%?XAYQ-XraTSCo>NyTc4-L025{H|*Dxk>0tX4T zJo8H+fl-@5v#zK~&IS?rXxUKkOu}%>V9&dhV4%g)`O)7rF>@!IVCiLm-%tkiY>=3m zIMW>;`3DZXHDgfmHX^>kQ8QhyzZc@b%qm6&AKzBL;_riq&p{Z9WvyJCj_+PCt<$07 zQsLsu(n|T9Ut}$7SLiEGcy7i@2!-IaeD{v64-41h+aL${b001g|~Krk)8D+FGDvsyQeea%4o;8^R7e}8#^XT^d>B5Q9s4{ zBp2>kg$_*WCj_^K5F)GYmoH`F*g?U3gajM_c#erPJV5&DKDFlRyVHemtvV&k?)A&K zjpj_r>fA)BoW+_?*`ljiZ0{Kuw+PpH=** z5>a$NGqR1H^y^Z-Cw8?2u-2rpfmF&nD}Z%?f-ty{bS^-8vEm%v;-E-rko*E_{~eQ^ z?@8-e55cO;peE04n7*@aH$nAlb39{J`^Cv|R92RcWs)30!i4B!y09fE zP9TVP7|`S3a#PrNcCtP^NE!G&>Vi=+6Hf#W_W-~RddI6cFk+2WH~V5gR?7FeyQn@z zpm!VL^=N9++f{+b-7FgFr@CC?tWWOcFFa$d1(=I$LXXg(f$$eR^<~Kai*e&k5s7^_ z)E1i?&u-=Z3XXI)8NGSL_a{xvn0NZodu16@0Hts<;+3lUEDO{ZZB!loKHZ)(4K;TA zkg;A&q!e*Gn5vm=Wx^epZ!;DMn>5l*S@85$=n|iv! zk}Kn|{}L|Mu%Ro%PEaxumXb}8!5h2n4&_#Db${L&=6b^L2ILpkcc|Y7jzGsbFJ==Ce>M*9gV-Rfay~HU6zBXvKR&5hm z+&jDel$Dv7Mcoy#yleXT;E*a;FVOlVj;`z_x)yVqpVs$J+MX6rUZ~`yyV7!uv@er{ zBDGivvpE2L?`(j}29dtxU7YLhxbMUBND^M(?vTxG-8D4o(ai$*fCw*Ng7Z!LV&p9> zjL@I2?iwNoGO>D{@j^PCY@Y4W&-kt2d{4Lokw}YAq7)388P8--&h4RP-K%icsa5K* zal&rCEsAhhd;Fma1<<@7?k6pnNZ~p$t93JDgH@Axagq6a2E|>R21v7DWZ_$A>Iq+! zk~t3k+V^^k%7@U%O)qn&S?WAD7A5mhePEBT1vEf%@gbK($8E+?=InJqnyStpNj`#YZ>v- zyyWazwky?$akw`L%yJlM?KG^4Ge-xuK)vols3^xPfR}@bVaPbbA#W)HfNlR%1+Khc zdu+AC^z}?r32djr#!j4_8AJE!?;&IV7srI>+AV;vFEH;o=w5p)VF(=<~=l}u{i=%n2BRd$%Duk@`@&v+cr z&V21!$*Z?M2h}-uN<+pL>h>5tqHiUhgWn~fysd54gIX#Jtz1L)&#kREPpPp+S<-x&=ehfX zETdl)H3y^}i_Ya6o~EOh5DUTo%*ncZI8?CCXf+pPe!+^4K6UDbheQS3akaiaP_z_JNHG=Z^Q z2yz3tp9^M5#&U#Zh~C68@M16hOwUBpobo?h5-{+0kALrR#or#^t%d$PewfRSEX$;9 z%PDT(NmEHs{*|>*-!e^5@)fF88+~IgX}CmBzdXA5wcBYw)Wz-TKBLIodNRn*Nuh7t zv>@}3azlNpzH!a_FV)2v^I>d9T>Z>r_7{WUuSV`doD|zes7A&Y((<)TekV68y7~5e z3+%AO(@?OU;D=UJs@H8fMRZt49>$cMeXpmd!T${ZGpt#WKWMXGy`N_hv{3|SjQ%}1VeV+eV>^$3zhxx;dz!!y2VoGwn})Ef zeay?Wz0Gpgn<&QkN60}!%F!mEUvFci8X00xJ?C1DL_C=0f;{snA08!oZ>!VIt?0t~ z%S1;s_Vw<*o6Nn(+%gY;STf2Z6A3sWb%=#;Ojo&RZHT*TPyyH7tzy(+p@OIRX7o*@ z#m5Tg@Wha++c4jyjWvTa2nysIul#O5vja$({?!`oF27{b#fpT9dlySiu-l1UBA`AY zzx!5jY-}9-n+m=3{AMFc5tt{AK2FYtP{jG45p7M>43P zR$If$ICBU6dxRnun!Wsw_=H!+kEf53;|x$3Q+^xN&fJO(zpYKCgf`RG9Gi8hns!V_ zTfvQsKM3%3sJO*QQW(Gi(F(Iv>{IB=Ltfrgc8I)7OK;^G-QCaOvY_AHf5roMcvhqz z@sNpm%FDuIGdJWA=PMN{eC!~fFF8t>yazui39~XBRU;u9KbK!3IkMJhrEgbU*%LKv z&KKz75KJS@y665419Dr@?|$3B3!?MdP?v19WLwi;Bj}jiSswl!cFhi^{B<51(Uccr zubNv+N1xT349nSJx#dml9Mm6VlVo{r!1b#tfiJ;jgQ%-rOiyps-1MqjB)SEe!|n_Cy_``<*{XfH?Cr{hn;1{L=Te?tH~;_6O#}M=%NPm#qs0hHZc;f zgI?@svI?(#gl~n>k`>Y3+dUzKZO%IIRWH@Wt1MC!{tzp zc}JotAEawBU%0V^S1kJht!w9-(a%u(5VYt7%_yHe#oqSy-Ov~pERP+ED~E9S<-UY( zp{B--xUJQ52*jQI+h!ThV3j%3er8oU1s6iUgRLH?2)s&^a8iQ-3&?mGVz4V6Ogg3^ z)xJb2qh_H{l9NLp`v0hJpR8X2g9f^pA_bMXP_whT4!;$Psj9YCmU5mSD=^#G zs!L^t%y{j=a}33@69&JB85#SckpUqH?FfJa!7aYQb*sff@|XsZ>(X#-ipMS`s=rK`|tM14UCA$&pv>3&p9|>m`p}prk8|WqZwzcr#*1a?X(^(vdCT&p?&#E zS@YvPXN!?EAl6%ukxfZjoMDgy{2vylE>)J%XZ^lrbKoZ@_|etM1(jk*(j&=!r!CKW zJ6QQ?P_bCh?f!}CA!aNFoMNMaQnEif>}}Nc1*Fv`LE*9^aP7+lpL6wGKvoz^a(b0I zvCZ{SJuu^POIeZn4;Em`EklQ)YHsJK?GZS-H$`aKn|6bb(gk+3IK2kYO)Ohy7q#Lq!k9di;KwshBRZ(t;eO^~;r@bwI@g)S} z?wF_<7q#uxdh_brd0#j=X#dccqk=L>DObksnf&mBwuu6-lV9lt#m0eUBkvM#M_y_F ziQQf5L@Qp;o=KIoESCQ0V9{vJVrIrwuxHwx!)$DY2 zW*|l$e9{O2)^T9t^9z>tpSP;;!-YTfB(fL`_(5T_o3Kiowb?fNc z+)hwh0rkK4t7oNIgd=a|bgTS~25zpIlB?T{z{?XUC%F*WpXp1Pw+4S=G=7w3h=iGO!8=V*;%$9B=WDMMJsgZHeCR~dJ3IRQK^6`Zb!T9j&|j6L zW3`)H;js3L`aD@~*I80+*a1~4cCF6hR#Z5Wt*+0PFyDg8H*eGas_c*$5Wl)26;pJF zFu~@&5Z>_exJcMkv=*T2Rkz9E5jI=SZZ{3J+Y0Cvma5K$!)qoiM|%hf;X0pqlY-&c z-`zy3xT}qhwDj||3hM2Q$6v40C6bdFz(AAa{+5?+2HTc6m}X#lH}JWBk@^9%k&yU6sDO>HeL{q8U!J9wu1 z#O$Te>bkR#%%y`A4hsWkaaFRAyTest)5Pv7URwFG*W(qIcCs=`t|feYCx`H4?&~~| zc?80?Q8(${58o4XO9+Knt^@Xi7Lkx9oyd5DCR~x;c^atz}C{2-Q zLa)|DuEr@*U%Hz6=|(H+zrH3Iu488QFXd@b%wyE}0Gk}@J()@MnnLWJ#FT~v-S2#Q z74<+zDI=`4f(&7KC#K*ARV-N@J^zT zDfTV(+lJveuaDdxlzjFdTqD{_o`vun;9;EhhUaeiPG zd{qsPkC^|(C~WeWQP@-$qzpG@jI55ek7(r$3oEOMFduVAmc1te?A6C#qIgqiK}+|S z=AW|3{<)-g_dmy=TLJaGR31{BX#%N%z&} z4X6C#luOWW&kz*RN%)7?;ISw9K|JMKL~sxAsC+)cz@e$}CZTHBixfwsD(HbmDen|I zP4Cfml5|!ex50-YqeT;MTmpUNDp;kjSzwh4Eh6Ex0(?jfusV&H~S8p*a*d-TMMb?TY?E&gXhhR*U1k5>9_k+*7&(jI+}%01gq<6(UM>h z^hO&S&Qn*wwl%P0RoqPQL2Y|vUyVu*77ZwxKi#De8QATu+XSJu=l1t*HGDQEM#czM z`K@Ia9@&W?rb}2)j^PA`+6Ja+@n!b9DfHIJz^gTEvd)L0r~6>!v58nMof7kz>NX_V z970+y=n@s+3_G9NiZj|+OKk8r-Eq&@5iXK1WzI`U46UpTtL`Tae%XLqtugLukFAgb z9&YLU3pHguek*8$S){+FwrGiXAkE}+*kp0ioyk=7GU-?2H&NeC$)n`L5oe#dshYj2 zmf`o*!~}Ok=?rmzOPNKTU1*aw^|loh^=R5$4gQl??otrY26Ne4IBeICnQ+7-8G%kf zDGOV5-yTfPV?W{P*finDXv#}~VD*tpg28umh5)Hqa%$WTMsAT`Kw(;pf3p!Y;v?Vy z^-J;n*rm()l7V|6#grNvXq| z;Jyp7^Xi>U+ecR`74D#x5yw%;#x<~!6#ci3RW--n7}bTPn9Dp_dpwqAE`uo4dNCg< zagJ2@l8dEIm+0UF%qXh}c#3eYhi*sEsugc&^Q*(tQYYOl-?Wt9h@JJGFo5)ntxf27 zq{N`eW9gjFwjB<+u#6mCnR}WrtrPJ{tTAt9rd*)hQS7mdU~SfWsVd^3EC2&hQsg?_ zT#XQ2pLMd6MU(j*g9`iB1v9Se=|LE{g9axvkKtE`p9W%dD$WZ&2l?io%pdri_Q0)N z`3mrSkng*X*@$Fy#`zX(xJ4{Q<(s*?`HbCFxNxKWV5AdQlZP)4q~MtrBS3%?t`DlA zC$2yUPxVL@dQejO=Zh};Q4+tJ(^@slPxz}ge(aoIn>wQWjrQ~Q07t)c>T8Juz;8XY zUsjE3*%OwNnNpHdoWzq#O=aJ4%$ylt742Tv^BZ8w_^;HHbR=f+C+Q6xSQX@LtBxp1 z3R)gH4(+KU;vaXS)JFFsp)aDQ&YTcUT!#ZY%P7=DIhJmt3slE$is80NR8rgpl!Qga zG5q6O&2mhZpm5%_)1S*T8XIu;+3$zM`fBIIg?BU##po$h3MQs*?|F5=<*xuZAbFn9 zu`TqyVsD4){k^Ro*!3agF=ENKJMU_4mKa4rg;t~eEp}LG?ergjU;2Rf@wysb@p`^) z66PmS2~}S4Kcq(M!4kzq^m|WSKBcs2@M|Rs`(kn60ZX|D;*+V8BcZJ9&&mq!U2ysr z<)obXVWIdO7DDGU%1EtvZ#1n-B%1EG4XWF##^N4pc>=AQoh&oFdgNFb?PRu%s=8^b zIEk#mRx4l*$&?vHIcxb*m{zvRqa*zoP0xW0-mZ2sein8~wiWF^*v>PXvU?1b$TOYG z*1yW_9)#Ad&P%V|@b_GPx)25Z<>Ld74lJMjzV)NY{T*(_M^DgOvFKStW>2bYc2DZP zgt77Yq9XA~!&Sz;KuGoi`}E_ER?Bg2=W{Ffa~jNImjp(0^gtpOuFd725o+HLgaj-6XdyE z=J|eKyJJ=jRn*6@`JZ04I0%(*py%XV`4R=rZAq6Snbwi>L|OMn23v02{fSt+=-bda zIw-Oc{;78)edjP&Beiynxcg;!E5&Moi1wr$S`$lA3cB?NWV7>Q`LwHhlPE_FkFIyg zj#N5q_B1X3f+ls|7xr0#TgDb6CteCJW`;iE-}3&&WO6&mSIYY&w60dPsKh#5rxX$mSH2^O4~HLhYdd98tpmjO)a=# z>!F+Mpqlc%rt9!C2YxlTa$|T&Afa|h!?rGpPP7QZD%~ZOP_w{3nqZF?q*6g)#;d+P z5%MOu<@Z*CJR({16zkyCW3PnbZ1WKov9!Vm3tM^#cil>fOY+?)+3r>%$q~*Tad@N> z;g?9B+nvzz-HsW};BvH+ptNQ#Fp{&!XryvsKDD5#&6lFLx=H(>egCpP@Kx&ie-B7B z2D)QATYYd5DWxoo<)$_pB&znWugJRD;&6ijm(SRZl^uz3I{JPPg%%csJ1{i|R2WE} ziWG!hEq&2Ov{=|180pTX5Vp)b0glrH-=b?&!!-06NYBj3gYzhslRLsb#x<<|056+dXz(`v#Hc|C{ z*R+U9da=h5P*i9T*&CM;C&;;V=rQ78Y(pmv4^A*ymZ*1!{?=!YE(+<;>t$V$9ZI1PM7lzLvX;4XC{dZXQ63M(v3*l!X2i)VS%CKcJkD~DuUT3sc8C{zB)^#RAy z(V}VZp(DzbFSPW~seTHL1n$!|jY7xBI^yiKJM7VaP}bfmCAaulGVexSCKv@%|AEMU z6b>2~Rq~i@4xXTH_M>xn!XOeo;}k=yzAn5QG{o<#EQ#`qC5KeE4Q19jjN@Up@mkrl zg=+6bLnsR0{Ye|>#U$R8<07g-(_~kYN2)7T>%J9lNT=hzf5Ky9hxsaQx!A|7o{^s5 zbZ}R5yyfx}1e-EFmWG01IQ+x6rD6GARIx_}Y)v?Vbou*($)2YEnp?7lm9hk{nT||{ zscRc`a@FqR7-+SOi8^TwI>8z|FNTkUHNd~#8&(h}H14+>Q{!N!izoFeC-~X1yq1&W z7u9cyE)cBh&=Fs-3Wa0XmqA`D+>c*jtGUjudz;wC1iHz^`Ow~MJZUw!cZAngIb*@P zr|x8fA!J8Fu5v#H?0k5KcBj~E{u8+kkx2O?x!-f;DgCumD`j^JJ5a=!ubtq zgQfrY+q(@)aCG1W^c60KcV04C$u5V^HXwJlc}L{A;QbTd`K`v);tK?s&F^`|Ijmiw z;c&0=nD~GqN0tXR+AHLjC6B&s6sj&;@v_q{mRBF;2&54|b?}6;`sP&;ldB^aLvQcC zt1%3|M}Q%n9HV60Alm+0`V6_+F>&f_u~_m>w6MS+4^ZB_{!Z0J; z*f%t8FA{0&O$v`VMCL|b-sBHwyLMAYREeDLJkS6@3ZHcQTs}yayh~VS%rZ+ZxU0I% zPW(C@6Kz^_)JeoNdYyFJDKQFRBS;|KyFWa=+Dzel=ihqyI2@jqmjj9iw!HgOj(f2q z54}%(t@De0y0sUNtOI35UMRD2IF-I0mh*m?GeW3B_c~TPXc;c;Vvt{rx}}>Oh4T3b zhB-&LX<@=2G#8jTfco}E^5ZY>|9DjE&vfSBnVWSo6g(z1j8F8N%IPp9fsn^2!f&KIWxq$n3bH$ zZRTo5-uS-k7UTFeK(%$w$uF?0_Cw(f<&LeoNci$-{XDve3chzu@uds2=B{<2ZO;hm zZdD)bYrrXsE%>qsx#wUnM4AOIAZB$%wD|4*pd)+X?^aZOf96vmY8bjQzs>JqPAkE^ zkP3!2(s!PGWxR=lB~cx%lzGiL+3~@bPG-}P_x_2C+fi_JZ~A+;KV~IbwtT*J>)p-V zYdgXh3mSv^4rHoI?t;F)7gcLK6^o)>Iwnl7l=t939q8d38<)Um?y_KNB}2-sv<&jo zp1zjS{b@q9PkE+3wkB+#r5=A$k^ji#>qvG13&Gj#8y402GOeod6Q_xR>`CZ6FUu0R zf%C&RMh&O0>pf1z+d>jmSQ{odk$_&vfptV zjdnWejP$5DH$0CD_mIQm$A3PA!{6ZSYSNOXwhtrUvl5itFsMHnf&*JG*_Ya-ijHkz z1h388#jOM(qp`}#Z><$&j(Fk1EFTv`{PtmBfyq6>c6IDaDIyiq_3PKW4AP6M*D1n; z(d#hkowf;bk{E%-4OyeTc#ukw7BR=a#Y%ymP4EId0$vV0`d$n*j(z0p1_GcPW|?3G z4<@Yh85^-M3WD>ym-vYr8SC_`MSUhgcZ+`q#FRPstP&^9b@~E zd7T0a+#nL$^a(%fz1s%4cAsw@K>x~msBpanY*PZt6(8N$79t^jj17?&KeM`Xp%4lH zTIbdgP;SUIk#}guX7(_s(Oo{Pe}C&yZ=jA_h`0%HJ<1B895?O&ody;2pGS;#r{`fR zCu*9n%)>Am^VF^Ef~oXpN6r9QC~n&OPMZJqDhl!Au*Cb3P;2U0fabh^Z--B$DO{uq zMgzZ1u-*X(eg+OgGdtq`Jx1kW&H-0^{(~f1dg}rvk^b;gE3g6sI-<#>> zpI^CF^6#$2+vRY=cWG|TLhHuU6xZ< zauIak5K!;>!5EGhH{LfRBY?ieZ0og+gnvJqWdEQ$DqMa0;huvSm195y6hG#H+##Cz zMqx*30kL!HnmIlO`+i3ybfx+2Uv(8#vZO{4r&@w4id*EJGI%=}Hue9DVFRS?DtP-z zC`O(%mBE*&X4neMf0a07>@Rcl?FVvV+K#;j`IK)Rf9xSdVoo0b;V-QO(tnU^tjIcgp>rWcl~LWzs$eteLlX_E7lXHvkI1cWRoL>3o>=!lX*s}`-}XW58l%2Sw3pJsGzN>RSg|E{urVB zWsS5;`w1#XK(>bT{0;ajh8;Zr<=?T~HuEQOlxOeUCz~LD^&-OUyiivuR?0*M2OT-v zhexgf@sG3tHO;;YA*cRHkKLi70ab7h+S#9PzmFu{iO+>O z&U|2TDWLxX_SfG*Jv8%|yANiXWY?QsljZ~bX-fLZTi>_MWMikUz#fn#o|FYCzlhCK z{IV7%f+-%DthG#Mggiy_vxb9}7y$w=PfwDCQh;E}X@H<|#hDjsuZ1Okp{6;ltoiq& zu7eSi4k78u*F;VqfI&Y$`^e`q?Q=l$3I7Rsg1A4(WWEmjRxM(7CRFm93Tf4j$-K<{ zhf@do$xBF_YOpeYN8A%aTIc7@WPcwBhWz&po97hY($YT%i*Q=~-VF z#ZyGG2v59NxFIFhdNSOQpXB1cC+3mXl4rCI;p>qYxVXrB@D`@OOB|N?_rauj{X6sq z(Νo?QiJ2EkNv#4pDH{zsq4|A%eK4Ou-)8r$DTx1Hwt5kjG?S;9zq!GD|LYa%)i zGE3B+aP_&iCLSBCIZT)JQPLM2fL#MNuigLZgt&r%{AXT6C?fvz60pQ!iKlR2hm@SY z(HI2ApYcB~9Y%!JtSsLvfKIoKer=Txe$tjGo-PX zP)8-6VtG4nM_N%^>noDE>SReh*Yt=t8^USnpH}dL6z&T$fJZA;5odXqg@b~l4oylV zz2$${5|`O7$l*4{+_q<%&U4=f?hx5D^2Qk$VK-s8-gEDRek|6{ZQ+X4@;9dbJhT1Q z`n7{hnKmFod?f*o%9svtcrAgWaAwr0sv_p9pLI^-mNf zcm7Mh${Oc_e~&)R1G?dYluW-!sY9NwjMwub-O)RSoA7_8PVp2V)suD|w{Ily(0uQT z1So?aeZi2}Gr->h*Cukz9CvQ#!a^iNFNrbozxO43dlAuwp1N?}z6~HI zhEwUqCJ10D@BMEbS8fQlg>6ze1bPi#@y4<1KR(+3v4WKrAgLytmK95SYNtrdlYBH8)q|jvVz_ZnP@QdjYt3YQtZw5Vzf;c zyAJOVaQ8*vtj$m;5U5?$i6FbOmMAwR0B3CoCKei34*^N)v$|ZzVa(FH;mi^Pr>XXT zwx{QQyMn%l!v&rOE8Ni{DfAyKz}9GLQ6(+hp!pHSAlL|ITW!*y3gqXy2kXSJNDW~&q;v(?WL$HYr4HCM=B!TylMRhT9(H|`w|gS8 zQ|+Hyq0o#Jw+31a3xJ~9e{9T@+pN%xI`^yy{;aQzzmxFty{@Na2;6gQVyG(wLH2Pq zQSy(T>8Im4=$$*)6dzn-VQ`!TUp7443w3%RVupPsVb!%di;{Ah(M^NZG2o14+*bp2 zJmV|#Yy1wX?W&7)t#R~lSbUcO^-gbaa&dJZ*v_~zi$<>y_!X%l_^zjJV|CwxcB4Md zI~3o`9`9+J$44Mt#fofB2Use<=kW;a2zpXo;ffQgw(!p-s=V|EK{+Jd+WmTGj0^9| z&83=^R1sTj$%}N<)>KXA*RUbRk4$39m)Y5b1}|UtdcJM_``ME@bXxxSjHv>UIrbK_ zEcy@v7aFT?2mpF>sAPVZCyFOEgpQ>^NG!)DiY1oTs zs*cALMgn=qLDv&-#zt@-Z6RQrf5AWOTsgjANAXW2Lz26;RKjYAzmGaE#d~w!ap*z( zJS3L`b`>zI>FT*U1bI6w2V5}gEAnJPcgJ<;!6Y+Wv?TT*((MBVH~2_l%qbvsgM*VI zhtzh*^MBuQOAYAX$S(|p5rUPa4gE*~kWPPVVg!OE(P^eWR}SfZub=E!FttI9utJ21 z58Q|pp^KwMRbF&tfIZr)^@E!7ae%~ANzlzWz5{8IaU@;C# z#g9J2OGh~WiG~mq1u(B4u*UP`ufLps5>=w>*m9fw2)}EhD^HNKUwtIuqZk?%5+CQR zE9X@nw3zn&*i)cpDX~9uD1??<_jT;*#S}X({GAJ4FUTa37jT&pHy}XZ;9*zGroq0$ zJnTx7*;eMxOQNt9GQ;Um4t(?#%;`lOh%IyL+W+9eXO|?Nc>N9HGR^!P_anf5@Y(-!_B$%TjUZRutz};bI+BD$_;tkV$DlU zqkwZ>&u`fO@V~lP4wp}t@B)%X^O0`n=TY`2;I2B@(gJ&^$txVXcAbcS@hKZJpLRh4 zzSX=yx-kNv?43_yaX&Z=Jb&v@utrDmxOc7g+ct-gx|kn!-KC?W<&3617J-MxFudO7 zZ3|dTih8-&P7C@WJT#fx1*FLukO<)Tg{c^Jc=);asgn;lJ1XvTu!)>sWHbnfs zxttt^X4^S5qppe|m((`^)YZi(ljYD{9IL*5f`Eor5DvR&UtTM=&;3358~Qnvu(=?@8Gk*eA-**p9m^1*siA{wO8x`Fh^ z16d9r*>%#4oWqW~ydalU51cP0?erF;f{F%B3x;~+{J+8c&k|ka#|1jN?pGQaT#JzK zODCC9Myof-YIGh%yu$h{j$Gzc1A6glzq-UY1A?O%Z6YC%flg<$1Djtn`IMw>{WOh} zKoY@Zwd72?7OAJo4$;mEd1Nge9tF)F+A#o zRxJ{uGZ1U(Y}Qkz0VhUOLBaWk(-J{XXb{Q6CBU~1*38|q-?H6qJARr(8p`B<8w!(@ zNN1K`^LBL8)l>-LixknOx%u8?HqkU$jm}~rQ#5o$z`JffZ6`qXcOphP2-YXssdv9gB1;OV!>SKA^Geh< ziC6tux$~I8Nt-+7o9T^hBeL7i2Iii zIuSj6QzomD`s%G4N1R3$&9}J+zOcZxXcV2wqpU+Z4T{JL`=r^rZUlc_Zs9Ep6UfgL zDJwcFkqJ=_XUP^Deom=AozdX-J00zqz!d~93p{~!DCkFjtz&^@b9)^ zAklkFYnX4;cK}=_w+kfPs~K$$>c}2_o_K0-v6{Z#m7 z-g5D|?_zgyc=!VDaw~^DGFOgN-z>HQt^b(;F=r7v>PUNv$z+E>yz#SGsp z`50$THeI_5gx7izH6)p7(hMgnYCfxfql1=x^~j|D4gXu;IsbF(l(7&qty6KP$en}@ z_M8WgZ`FTlZbqiv%XUYW8l=eh>iRmLBsg@D*fM|lG@H@ELqC4pKUXz-Vtl%tpNo{O zSUqi~Ah}N$&7u8FT!Ami%vzQ`Ac|Z8qR75C(N|#csoD{xZ%|z2{CsTc`wLU!q>)n4 zZ(T_^tmGFRU|Eq8mENazR2EQ_%>gtQvmX*A-`WCgq?8Ua!xNG;jm$}tj@#PqlH{UO zLyd8Fk~FK`nVfyEaO5-M{gl%j_0=yYvGyKp;M)L z4fT7Kr!FLvI7(*|T2rg(c0j5w75)pKwvk3x=Ovi`$H8nql8>nNc0Ftjrn9vQXCS5Z3n(mG!YYS6b-&KTFmz|^?9M!u?Vt#_SGCB(Ql!wM%dU{8ew7uX9_xm-`d#9vaksWqj9y6&EtkOBSg3j9i|xO?uIaRxQlt z@C&1|d*Lk*J;6vmpXQ0fqnpK-b^xC)ISH2xW+b;Q9f+XaBL?AswUzX(O8YJTJ~1kj z1sofjSUM7C!C`8LSO1sZ4h)B+j2yM;Kxukv+qIQ@HBD>)PgL9XAm zI22oFzPuMsfIwydsR;B-dB#%WveKJR0*Ml}{%e48ICtTp;kxF4sLP}#2&XKPLlD^` zh19L7(m+59fYE#s>{tK5b+7IsH4VLj4EYg_$CDh# z#;Gn&Dc5!}lCp}cwX>@~xKWofqP)72B~>-C*WZ+_&o@VrsMz#G=bi4n6zogR$A7jO zEPgacm@nhI)03X-oN3x8YN1I4n^$ZwvM6M1N4k| z3z;4y?`b|&q30V6VK099xURoqm8r307I}?7zU+o?4ZoiZ z`qUTs`3ZjimZ@YmML#t`d${`S%6PT)(*vmuv(><8w+9+GSAPYo+Zyo>XMhM&K*S{@ zYUUSlu|rS2buCw~@#&rBgT)S_Yz|NYD)y3i@8c#5C-^I|u41WR^PNPTjvui!EnG0Uaj>rQ9tdWcrsr{fmXwu2gK-A@P9aME~wHg&y9(R8hl$+{JxlorjcoClf`9qG1ZuvHL8U7nYn>d^yn?iPiz z{$M8g*b#A#Tjl-jDe8!myI-?EpHB5A+E;=LVPleYvG%t~-Qm&>Y>gN z-FN#nZrgtUqtdNTkubgN9)O0?{)_2w8l>@sC>3EVY=X(xAQ02)D&t6*H*;1lc)e>s zKVIA|hFd(q??#%UYi*PRD0cYF)pSwo;yDt8Z^OK!2135r^k;aUx|v}54L441%YrfZ z>~rJ7%e`P?c^|YdO*=Jyqk?bCug0_8OD*;?^W5x)iu(D0rXaW7J84By+I44=B^}fg zQcwUV_RDh~EsVzf@kcr$adl!y{y_>uk8YZ4qIXoyGOQ%uNvbqnQY{LctaiLG>Za~@ zp7k}&=xu3b&NhCZyIjWPXFQd|t`)V0v86mkcPCd5t&A2`!XqJ7VWumee8PS?zWDP1 ziIv#}aQO*EJbpH@nxO)}SCzblxo~D24@cKtR+k(#jJ!2l-B7|W@ttaeG9-Zh{byGzf;!YRJb^`1bIA;h&7NuIoPqRE| zI7IqotMa~nTNa_H`Jjig<{X7ZT$dJYU*UkqIv+FLv;D{{?W{O=@ChLpc!f#A*}^tO zAxV{r04-4Nk6WkOlU95n{o>d|dCi&#{@@)i_5|UIS7mdY3PSQ8)f1ISAzX$@%m1>v3UQ zq;e-cpXQ^O&7JMJOf-4jpUd_4L^zYvv(v`MKqqf1P|-K&u&yIZu5o#J!67Dlut=Y4 z<+}^eamw4Wd`5g6UV}T~(;-KtAip=zCN%Q))6yyNL~HiTrB&&`>i&$=tlf0$PLkkW zjnwTeHRl7M4c4Dx2t{$7&^iV^zftq-XQBKHCU#TyYwS`a3&yoU5`9t|2Rz2ygepfh zakGyWsiH^l%OSL$Urj_)laCuQR(CS;Zkj1@?Z+4Uh*~F%EtbPr^Cv|3sY$gF4y;Ya z(l!6PYSOg3lE&+C&uAY6QR(~&c4IgE?z<9E>%3%}a|~K^32;KX+UlJq4NT9AS%?bi zd>g0Qlj*wwQFt82CL!AXAo}E$dFp7wN&QOW?Hz7|(E(Q+PARq$!+fTLARIaaO(Co} z1jaC6k3Up{x^Ii$r!b*Z%k-mxDnZZ;Y8)L{Lmqv(4X^-$|CB`vg=x7iNZw$PD%hw! zG+iXVY7=P6zyY9nI1QhBv!Zy#op5o4qh`QcPjnosN%U1g-!%J;@@QWOCu0m+<{YBE(*IjXyT?M zwNMtF(2n@ZS9?T_Qt0>8Xzgx`FV=Z&9{;h76B6*TuZ=&Zq>m1UYEW_Td||w;&Gg>b zdBrXFMNB{4>s zm^@dZ)M)gHg`$c3#O?Mbu`C@s^PqDg8B-CsbC__8aw%3d^f^t9?ji6Qn|a2Y1L_Yk zI6@vi@BnCQWG%~_4$y)nNM983F2lee>ClWX_a@6x>EYDi zLo?5%^C-%_hhA(51z*9&^3UPEWWdZ ze`AxCEC!FdTN_nn^Kejt*{vU63D8fIihPQli;-Nae2|QOYD3EH8;EFzo&KK=IiiT< zue<+zFHrkk)M?qI^h6*Yrq$6aQh#+=chk_!;8?q;5qm3++j5%LNT*?U`uB^7?g2jp z^Cw9MTQ2M6YxEF}`8K$VkJg8$H$oFb)~(EwXFfTN>#~4~;n=2~+mveP`#wNIJ!6z=f+oE*n~mxp%e z0*p$Ls}*)UG%aSrO_)0VQB2OUP~#Z2ExA@l=jh~5y=tz(QD4<-FZX9&T6;J^+4sHm zd%}_#q304SO6?%-m{BM*6D&4EntqduI3HI z%gM|nE?g@9)&ZJxBymz)Nok!Ic7>#<=|qZOIb{e9MHbEt#khUq$!!)v&Dwfgc)ynO ziRPkFaPr=D@>!1d3>{i2nP*dRP&15suF6ztR28?jz!v#PgA>9f#Vg-R1Z^#Q7%M7D zw%HSwm;u$V?JgyU%m&d6uh4OuDU=>g9HmdW@)Of0#Hx#Q9FvB5$f`KmHm_n2f8$zj zF&cbg{N_@N*cw25bnC;imajGjH2&mD;aQBel`S_`(eopH2xwAnyL~P%tx5TfjYm5V zrK-Hx+ed&Z=Y>wp`aB{vJXn%Tv@-!(lEeFli8#s zMa!0rHUOrGr`;;zCdNy`lZc>wUxk(Y!NuQkEgaV6Uf*;Vr~INxIn-TDLM}TrHgbQc zWRL2AeMT(wutZ7L>9fz60zIb#UPp&Ntn!;yCCr^{}AeI&k+0DOV9 z19iuDd!nap?edhL?-W|my2MxI^hIWEKyX<5+&t(PC?3g7N)hCqSnR&zwl;dO+j;1w znu^b&!K_=lA!J#jk#h*J;knB8uh!Jw!2}_rj5V~c$8*`P z;1bh$^*B&EX7m)}@OyaMw5ZRJlceh-Tdp{pKsLlRT_aV;3Q;BvFgoa=5yrXf9jka@ zThCsn1-oE=d`uH7*nhUE#!So%k3=DUIJ8KWxulict zB5f0*q7gk!5eyuU)Yf@o#vndrPjDX8XwWmPtMsQ)nb!wOf7&ZlbKr8%avFyijFgwW zJKNiNcC0BNz$SGNwuHCqDpNz88n&lho?xIz#_+>v!Ed-|HV4L@&%P~Pr=MJww3%|H zbR2PLh@EJxw5x(KJyFj0{BlK*MN93TxA_$DfG#~>>qAtQAq#)pqOOlsG;~+@HEYzA zO_5`Nvk)m0ftW4o?hJlZlLpQdT>K^sMjZ~@Oh{O{+66u47T`6%p>{puocuNE8t!gT z#=tfO@}m1?;JhiOGp)bunc|R&JQsE>>P0HO)QN%BJuEzmKbC1ibC#@T0{ew#g5-D{ zcXD(>)oJ@gv`6SU`M$2?-l}~$9ABLD^e5ZBC6hFJ`=_8E^vB36eHfadJ=DQg#rjw8 zr_f6!Bd69Q2cYRwt<(|JW@PmeF_7-YL1_prTLagyAK=hJM$zy1V_Trf19ee*&^+b3 z7GClfG2^m{mVj1D%;dF6G75S-OlehIGrssCgtidn_2hH$Iy7tZz>XYGUvT;iVHa)} zEm8BX*8~AzfMxt|@OX)^Mn4OC&`Q%HE<$i?!C6wUl*>!beB|?`pi8SOaF5x%?o9UR zB10y_`6~?3POtm=ymB9cUIqn^IU7&kH60!5vS)G52)Gi1y*P7D!RPsP^VSQxCdSpz zBzJx!^^AEKq*5tfeX5AL!W-DnEPsTjMOO7B92UccM}Szu^)2u1%lYM7CG`H$)*7+Pzl_|C2i3xl`*cV8B>9GgD54vsA+EY(St8CP$TBW_ z%TAzCxj9;2P-tuqgKvSjnSGemVKi0EGMANB#(TaEDN5++ znP_@jB;SvOJJgRWVkZ(gKV>6etrJk-`=K3Tcsfnk#e)qnqH;A-k*M1QoDGxqiNYR< zE-PMDpS2SPwytWLt*LYL>^*jbCv97rzN_F$B;*~K^cx?%49BJ=mWz4hXW!GO2?GJw zQ}||xLvy3&!z}?!gz9DGmQPjF3}e@-VN9S6ag^kf%6R4N9|71mDB|7?%}+*qh6~Tb z#t3#y;vpL+#WWG!tmboiaOtQ5sv z5G*{qWWre?C7HSE*r%GXXhIdXhuXGt+tD!FHJ2ZU%4p~%?5-_dla)<%V`5^wOzKlw z4~nu&3U`X#BY)di*H1`Jo+vbOCt>~w0vOf2>{0Xj9aKAzd;iyimUm=VfyofP%BBUk z^q!`8&%#aDP%v+8Bv6#p^+m=02>+@&Hj!-iu-33DjW`W%FJ>@b+KiX_$;)S0_XX7+ zpR{3zU4TW{Q2B>TSDW{D2#H+-7mABWSEK!tOhkAQDx-vF1KG*WV;xM~vFwWat?@hc z;R?7bsVLLkOl=vaGGA;CM*iXB*Wjwl$#;*e*SYR|0rwnNtX!3@j=Y!cRtC2oCqiYF zIO6l7&U!wKtc>q3|ab^N^=y(t&XX zsaVNwoR)Flk7%|_f8L5SAj<&J;rG-dKH8{B`R>kx9sSuXcIh@{2S0*Zn?Bpgat_%R zgg(9nzTIx&R^P|)$2f+~!Dw=g8TC)GUHjyFA(%asCQ9YxWxh%`Uimpstx(mNoWLwK zf%mT`+|rI$jfI*{IarNx{Kmz@;-+s7j$0ukg&oZ+Y~i@d#@tV! zIGXr@WqFmJDvp3*ACPt@22ffd=UwK%$)(2S=VfD(^QHP?Lh(}N-j_l!&d#e+vl2p~ z+Qe~fnODbqnKXz8p5f+q@&D(|^Enmi$v4xJGt!l~WclnK7Sa8li ziy4Gg!x@|(yd23a@H8p6XHOaRzwNf09Hi8^R=-J-_af%?F#y5^=2joICeTExhCJr` z_&S7^TLL5c#5_@UXf9u@YpdnVRe4dlJ(40Py$8r=Fi z9AR3VYs|!~XxgfCV!P+yLRN&b39r2FtXFTXF6vf;R@+T8{^kfqwz$*x3aJJVu1N?~ zk|z)EUeix*rF*nz*f^FA_@S>WY67)^xo|z_@;lI0ae3}JdsM1asV2k&0!`eJyM;%_ zHdaQ4BCqeHR8|E#U!9TGyzNRfS<)wTG`qXIf0GlM;;Io%u;67&^VJ9Na9z9MUH8>K zw*H1=+XLW&-8l>v^sbHbY~o!E&spG3J;o7w5nsRiBWlQfF|rMG@X7@@zHW`$skB9X z!rq7@mY*IHhZM;(tE zPW*EgV5+KqIkN8QQh!@$(`PM9gEJkXm(s!78FE0nz4+l&W5vT4*G(9i7@u&lxg~S) zb^F)9Dmx;F<;kLdc2cR!utu(DStU@e$}`c4Rd$zC($0pc+RV$%Tm6AwI)nBqC@=;X zr053STBFU?6soJ6@Hm9#ZSpXrJ@?_37L# zsp-Ctx9Qj3F%&Y4LB@o9OMRfD-0y6-X|W$~KT)~;R@TE9w9~Sw6+TGSdR~+~p?Kj! z>e*a_v~U)YT!tw22lHK(g;(APurK~r)l|NjkR_7gj9+rsO1-9H^u_fiXpDZ_*J&nm zcOdJDiG5}&LrF{N2MthLcn;&0%O#P=pOGy5 z?{fUu`9*Z(>^{BIp}-e=2XsU{5u(N6%=fsLcmP_m2B=fX{NmQ#y@iQWTk6$4-j12x z>Q*keXptSmGzWXKSQLI%;b)=llATfXa0)b?L2VaG>p8*8(d$4JI)(5Xm4CWMDm!{a zu^DH9W@m`}t`}=##rA?br%YLjwB~vi?GG z*9++fqLb&p@v_eZF>vcoac&O<$DC9&Z?)i@52+V;rW$>YBlWaIbX48JZAYyRGB`y^ z7IVvuZ3>{%zp~8sa)vCDI+>kj46k9ldb6g!xzI&9v(|F-mHedx19uwNY_d&~+j+&Y za03MBE*X`!e7h!3d&k%Ad&)`TH4;)|eu1SsC+%7#I1=UqZp)qsGpy;q)?iNfq<_gI zDiPe0rF*2ExLk06T;qR#b-yf%*6_ zx8QsVv~NHE;Y~#-L-d8k-Ne+_72tOGbLJ|T3f z(ZyVWyt32qXD-3@lNLk8={LmNFYjDttDM5^0RcChu%YjtKzeo1A@MgMi6xCZ3zk)Vwt#aE!BJD@?yUf>g2Ug3av z*En^`&{Gu-1)r-sAMXCh9`qJy{Vg(>wloib9*Ok$3mn(11AWYVT^Hk;Jg6vB$D17P z@{h{u24L+>E)syo(XJU0rxe>EUFqSp3d(aGlK1y<}O8%Gq|$+z@PEKfrz)~7T%F)L~d zb5l)b1~FXRK1W=dM+ftq%}BU)i+vHBVWqlk))^AAoISE3jjP|NeFiqBl-=M|QjeIyav5$whG$yh0d$kLsUHiz;A>`AwDZfOO z;@cx{$5aud?aykMzTQ2b+OSY2fgBM{ykg;HEm>vfX}sF8(1zJZm(f?K^0uMKxOq|X?mhs>kHTo*CsISdD?2Z_4`J#lzR|K-`btjMhU=61o{HwEks-eh&v)XnBUjLhy%|wM|Lu08%b)wTna=M z+h{ax%%_Gnr*(L#o(XetXZcRaT-?~xYc2oHJ{-cR&T);MFRaPmGR}d+^VG5G82?P} zH6a$g^_P!cXv(SI4b6J}{Pgfkn$vPz>{cD>T@tZ_{G_yi>kCKAcIJ2Kb{hin>$1vV zcc6Lw_w`^A41=YO+(sm{Z8jc{K^v!ICm8tNJU#o8Rz=hFXmrkT!qCD|L^7|R3+;;# zsw8ol6QpqDTDh+0pj-2VTN@QIfyMbHk>NN4$I?T83-+5eFXRq~W@KNcQiLacKs`vi zU&y)JkY$*U`=xy2I(SRl5+3slX{d23+ZBf@9LrmVW_M`D$g_9)3~)T6+#$4kIsO`l zxRSFXpI_%mh>gAJn{|vFTooXjt;q-b{Z-+55tDFMl4lTI^nhuLRQSdf&9Z@SfaV{`EJ>WEoy~EZCq1j~w*# z--Eu5z-vgym9!lP{lETXVsg0epDN1eG|7L$4!_Ao%U_87%#gvfBE-D8K*h53>Drd& zD_ga(m0>PEr%zPpik-DCjzo#CWrl>v-One>@4VE*>#pj2U$PL<3@d;5LE!w6CCD)R z)Gw%VorIER}ar@;h8$3{i}dY&uu^H=*)2*fl=j@o9o;e=J<%k z?083f|0nSQuG9FhS4jDrnWg2$Ec}nL1$+F|U?C5Nbe7SUXUfUB4Yf<3lt`G{uG`C2 z-B3CfIiYyDNAAd*(@es)49r_wmv-`!$Hk^S&tHGeRdX12d{;))OLSysI*B^Uwh5kU zeFW7qV7BXweVbs>kf4>H8B!fXBf;~ixw(e-*v{8gHuX=7OZT&k-*BAyvkAzY!^2-(qADB!S}5ZGFEzI}-K+h==&UEs6OwQ`HYf%Oh#SWmYOCgiWp!hhpiT7q=Zh9OL%3k>7iT z-Em<($@$1(Tutew<4lCK-;^>!?6Lmq=FMq=lW|IXu`KeTLKbaeMpaR8q{AsRzj2r` z+vOHp*(2!;9lhw~^nVx9bz9JmH_Rk;Exh1I$>}?gHTOhpdm5xvi5$eo86Os#R8?(4 zEVO=in%WP&xWpa#`VdUaYvYb~eIRHerq;vwe8P9C(&je;0sCMeC1{qVk;1jf>(E@R z9j$N)#^OA6%<`oAIeDgIf2jw~^4|@@Uiph($ku@mxacCxNi`Xup6`aXQ472C`X;@C zT>PV23eR}BO1a7JPpVVL9NKJ&ymS3_$YNjYN{I{ch??XnxWZ`NxC`h&V5O>9s-bN6 zyFHL#$ycN-lNx*kTAfQ?;1=T7j@r`Al7HgXS`x(Z_X>{+E!3&9NV&?sHrSv#lg8#|?I(;OH4>a0en7KBg#G;BR8 z^Agl`S}N!;-yPRj<)zawJhlxgr|1``8;;3b-MJt5g1R{`=8A6ghDfl%14mjYFNVF# z%MvmxP5lKLP2XQGT7m|q^gc^Xnw%+l+D-?Kgt1qQ#H}KqTv_LAPfBy(QRhu}Z9BAw zP=<5e_~09(+hE)+W8G!vzbq!J?btY)6ZV{=qA)9mmY9$LeG`I5H%a@9vnY5cICO+R@@NTq+j#}$V$D+M;W(XznICLhTC ztp<~Q7Z{C!mr4`W^^O{=K5{~Wf5Z91gD*JcgKPpfZB?hK74IL*5FBmcJLklADeA$C zpVzYjeVslZouL{rh4YRDXv)>8NvUSAAwJ&z_Ta;Xisoz|#VL9PZ?KRJ zsTvZDxy77k7Ia)z9tnsXb?7>j4hRdS+I(@G>QKh{(c?2OThU3C-dntt5y4w6+bUI_{G(Zkz*=r`arkH!hS0)aF9~LbrYqR_K0QlT zxHzDzx<44aD%yXAz~KL8%Dx|O&06rQSqgZy0-nE#)78}EVrXiMe|Kw|_uDuB;EuMw zQ2sG?Scv6yR^GJD3tZFmvVn52;|wYYmlyrT2-o+g2TIw9`A3u zb1ZCj`80X9B!5b4(&SiJqe1WrGNPjIfBnL$n-`}&*`qjRtu|yi_YeqkbIT@U?C=xT z!t*L?v@tMgKQUkYRewQMdk$&wSGFq7a!0dN+@eE5mx{04i{}p#&v~#HwNZ4cU0jkD z63@|k>j8|x=MO+7Y|5p;#1*tH^P~u|nkGP~&fL5~{@Ke5=cH52;G+>Q{)GB74X zDQA2_QmjAR(Rj51$&l`aVj<(Eu)8CVp$dKVWpstU6;HVaph4>&8V-rQ%w+B9JZoXm z+zEpn{~5<1?e$WQX>Hp009dgV&R0iqQ@c@20?q~Vmn1wbOTVqMbuuzml!JOOhZ2)N zFiv0J2t)Hz-3h{kGNIFnML2Ej74cYXCXlhhe`G8mN!qK!^jR|#W~=Yjkc&``%ZF^z zn3ikk#gN4wdiI;q)YLNkOfP?iUcw1W9 zLnLd}u|@?hPN)7OGCUhd0x!q(Me5JgLFUi3KKGU)2Q&Un!%Wy#0rhMJ;xKF$pg!*( z>cLgOM^$=9dtgtxXWA}U{pv_QI`{Wd-iOfgphko(L+&qbXNd>2nkzO>-z%hp;9`=t7ziFP~_w%Y~f3$NdUn}|FZOsy@6baaW;aAd-QU&DI4we@6=$fr#Mx-y6ar2JFrod5Yb+^3N0S=#_5e>u{^2 z1wr#y;q`zgcEFyBm@76Z3wpmeJ7-w-kHP!1h{G@@&7E?wxeO6tLfBpw&xR+R7VG)J z`94tQKR>gHipkeLqI!W2@JN-*?tq71S@U!0aT~KP$?(5fUq}`pNWe~ueN#4Jvk=CE zHI)HZ24=#*mnFK%{$r`~p*FH6m9nO2&tP-Xzn1yG#m&%!5zxf-XG7J8sGd7z zmQc`(+pxxFbbg)Kd1&Ztj1NDE+$ftmo6()vwT4+pFrTI2fl2zJ3)ltBJ`E= znq3qR{}5*q4_aQV+vYigbHd09=)np zk{lR`0TnsYy$@vq{JUSj{=$54=y?Q|-~1l5x_NO3z)?^&8D8UB0hMg(Le>UA#8${H zyQm5rxDAN2#-b^|uQ-0$oCkK;y~Qrq;OehW?x!>(bG2ETn$h&&0srmFc~n(2i{ukoQQ+?s%7 zLsgK$17`u3N4nFytbff_=66J^3 zP=&h`?fe(1|D7oRYghjz!2i;rI(ztBQxd2$Km4}0*x3KDRbv%s63H6>tHCR7R9=h>LVzDa5>^bQ}rx3F(( zI_Gr=3q6L4SGxz&MBc4JOOOxTwBm(5>f@SyOy?S8|MkT%bp`O8n#osL9$UlDo2i;wP{AX!)P$CIygQ7T&D!(T~N160|Yo610 z7%~-;Om-Qtz)2tU4wH+>-Ft_v=!SN!m&U1wSI868CzI?cYwrGB&%=MWC()v!N37cZ z#7z)}+S+S%7!rqjLA0<8Ud0K4Ux6?IX`lcc7HN2E76RT5Jlrvp#4MH$9KFe9^H&iV zYOBJ-SH)a5tu=rHF96^6CR$Mbpm;f;csT3!L%H@B~0#M}kU;Ftl75SGDpm>`9V9x)qP>XNnVPfByE~GPP+L0DH zUW^{vZ8}p!8s3i|i@x1a3eqIh0=|rdjsza-0Esg_Wi&CIWp;$PXMJc#t~`PzR57jBfeLcz!6He-l~4wDof2Robh>-M7b%I$AJyuf?^la5lLm}ANS(g0{-jWNJOu8LK5@twCn4KN9cZX=dfXd8wAZu4J} z93Wdj!vLHDK#f7VVJ3h6xnI@Fne^sZq$|W=1gX9Qhg9JJ!?I&IX;9ycECgo5rCc|P zR*IZU(dxe9O>0m%22e6USlB26T_iF0-|1vs2>3aOX;1&Hk0@JNRVDg(65A1dm_-fqNQ#NDBmTi|W}CChIWp6ON(88P8$NRDLSLubbn!+BB*~v7MM6RkO!gnB0>5|6&vAZ8nr4Go#xsnQ=4y#zbE8ekDpV z9s|(uSsDX{TBro*gD>S1U^|4kfcgRT{e@H9ZF(PC?Izq~<3F?u&MztrVsxxo#Cn23 zksW)qF`;NP+7=ig!__wyuOd--J~I4+SAjOsF$v>+76A@LO~Ij-BV<6_PJja=@ek6( z_Fqu0R{)<2Jwr9b^q1Wn0pMgK1)O}?l*H4l&k9cJ0V39oLPYbSKZbgUB2LYkW4CVD5rWsC^yTigGk_d?J_L#-6+RRXg2dt}pM)ow8e9iF zqF~d@fh(amm|T_(GkU21-WU`Z5x^Be@lQBZ#j%Ej?lqu0)&_q(77z(KisS<<(5)`! zkIuZ)xH`gBK~ma-e&QVahgCFpxWSQ^-LJ*7w#4ZX@GD*K*(B3x^ktK%Hc5KWinbvj zT)_lXK+6wP(7J0DUH|{B`X2*vRy86Q%7-LirrppM>Lc!;6xeclid=Sc@i#YDX<4uZ z$%{GlAXNANf^p@ca50L}mn1vOU*8Xo1Uf!QZa`AD+m@6`Zoz$ZpF%#d(*!qh#D;pY zi%E9(Q{uauF)~{5d`~Qz%U=M@UlUj*An{6r=tb`sAtFe4DTW64U-HT(z%*BzfDeha zcvc&<@mImh7~1HM2ZrxD=Ag!nqJ(-y#7CmMzAF{t{%>S`rdIr{k4FNU`)HD1p5!?35zT2Ar{!>@sKe7@@ z`(H=`J5DHT0n%U21Y~uDHQqajn!5CG>l9$}VNlAq=K0wbsN)h6P>6C-2ZfhNP_M(o zeiGYpw}RBVWv!6dnsev2C)5 zrALYliUcChp(>th0VYstHp*O}NA3b%!dDw;j4zBS1y!wZ@&B2ObjOZA`vM&0LU#*k1E(RunvY3kkk}_uGuUKO-`W1 z$#$D5tW{@ElN->X*B98ff8wn1X~3r9dH4Z4eedj7!u~MEg>?6?J!ty+w}dE8Bmpzm zw+Gl={H2A_#4d|wD5tIt$TuI6Gz?VmYvQa0-5PpVi zPZ1-jW<$&wvL$hNO7ib&J}96e=756l$b;S4QPH#^&*I;2I9>o|{4+W zvNmri*u$dUw`JLCaBVCW(~*i8ykc0))lfgw_lay%Mlf_DAAC=dJ$!3@0yD8PzFpyI zPdMctxf#gv*70ly#Fg89@)s2RjeVoqV|P_z{Y#mMS;W&{5H@(QsS+hMH@ypGd+a82 z$eKhGvxv|2`x_cC7tIF}v?<}2RPz8{Z*t_S=$Rlp#X2s6OXnq`iO&IZ8J--RLGMTW zrs^_aB-jBa>pm5~Cqo>RFYS@5#ifSYt11J)pT4T=Yd#su>FgG?Ev0%){%M#QcxiVg%i|Hp%alVx)WGDR-?u#k&4;+yls3O zs&<)6VsosjcrkV&wCkc_2Q(!;TCrl~(z5mVf#k_^yW#CLCe9sZ@&*|u`_U|pkm|F(PzFme_O4$ zSM5KVoC?BxKVq@+%f1`eLFd1(GJyMl{X{+xz?vv)X8pbwY4H%Nm-?yTUDPn|5kozS zfn$UDTOJLNC;K{+F3iQ!M_Z2^N=;}%6pDO-ZAsXP5lcc0oCoWy_R{LA2QtS@uv?aq zS+^XRtPr5lYlNlObeRq97TFS(C zHLkxiodboP6SUb|t8+|U#d`2NID|7Y4P87MO!n&wM~1W(*$>aGD;!Pi*hLbUW$1&Y z7@4~5NLI=_HM|z*H9>!N@%**wK0~+fkB?r^Q#pq8?doPOv?_M~fg;`njT@PmMCyrg zdd~BCh9;YE?eLT$IkJ@bsqKf1xp(_T@(Q~dLcQkEL@A29iVe9g%ONq5E^rIPLU!!! z+9y{MbT6RoA*aojBlxb`wZ)Xp3>7#6VT`ihStlLeO?6vFq{w?uM3EySv6X4wAA^d# z$@?vcWN=C)s=mwQ`J|`S_^78&YKi(t&FVqn?fq9!gG={wyO{jVxvBEE;vtXpYF47^ zb;E^M!rGhJ{Pr#U_j5Ihmh`ThI3Mu!=uTW+fnzsR%Jwrb;9 zwgU|>f3lY*Z#9N*VcXc8N@&A6G4t{JP50*4WKrSiGcGs<995HX%4*~j0CVr$JC~*+ zg>kAC5ZKfp&8g4!O-(Ehi^R0;51z7wN_0zKSh^4{vbJ-SeQ~JXB3nY$jR?sW5%uUT zY@Pk9ny4~pebT=1oFX=(Kf51t+?nQyW`j*3RGD+fFm~1owdt}Sk2vmVL}(Ls>)1H7 zm0$NSeDl}&z$GA>_<-=b1sUCR`5Nkh5gL9Q*NODoQUQW@e_V|8!qGd|{hAe4C%@3w zj+oz5F@G{~@=Y&h`cz4c{t?Z}xPPRII9QXc!qUN42pt-`grgY@I;%MRe^ zwh){DN~ArKz4#s(c8Xx^JB_LRskMiN`G1F6&XTJCZOeq)Wk_ppw#r_A+h&rxN9#mVHfLO6akxSKE= zguORPek?T8^_WZd#?OQ3dyhZxWA;XN-_1!33Weg~t%@C(C-%(+eE_F?G0o3EmL74TAgJX6XV-q90k-uhB7Os482yrT(xxPKX;t-&So58+kbsHB^(yWr^b$sFFc&wO;eujkW!hCW% z`a0-F2^rp!9@!L7R6a(Y2on2&W40TGW)7@vVtysP>@#^VU%nRpflz*m4O{8A zq5u8#Kp!-wV(&gjih`=?P`e-b=zoioSLWo@6+ZTcLjoezrQWWB(Z!#dVPShvg_`F6 zRIinJMm6?w7`q`m)Wt_3iIOViLh?6Z})3i-VGp%6g?*B$nUpg%8k56yhm6!u6xA8q{>bUs%pL^^q8y| zTkA3e;czIA%)l&XinCTsi;d+}%o*9nJ|-w{c^~j9t$S};2DQmt@Y?k7ElyT`PhmAk zi+s!cQEqIVTM8@_UoYHT(kS}!blfxBW%Oh>xG_o3nE5dAYH1ZI+-5;l<9D6a*2kI3 zpYlH@Z3$lLQ$W(a$axe=KLCY_jMJ)aXA2$8W(Jp*sHu^j_JZG=(UHL*y}SN=zn1Q; zc$0Fu$-AX*6Y}>)4S6bkwB1>tcSTv+?j}#IxF1F&sh@yTFP6DsU97;gt}#Jn=e2`Z z+uaffLzLDT(j?R`ORnW*ml~-Q!F(TmPTDUxQziU4etBBHv8x{)tfyn%(2ec|9R#z< z)5id5qD)K+vZ-jV5j*mazU&vrRy|ty$nOCcO|N5OXl_;2z z(X-ODOdAz_31fF3!)tFm3qBbTI@=u(B6Y;o1?_>(Zv&I-i1GdD2X5dDAF*V;x-j>r z?HlI8E-^vdyP3=bwW2?CRrcpCuEuImPPqjIV>C2DFt^V_xFWj~cMjpLqPIU>&Pf~- zWXv~cI(YK>;pH^-QkQ_~h+kk-a=v-VO%=a5W{<)pRUO{NF#7P?gKpJ=@dFkU%@W$7 zlI=(biQ>f?-vev@OIa}TA3S1+iUjFskc!Oj&`SCM>2tlB?IcE@-d zdAOf?8^!O8y^qMI=orOq0UZN#(!8_i>K^J%F0q%D@=JpLGjy3g4+2mMs!Y`ZV1pgN z2J<%RVz&5PCXda}rkEy$gzmrkn0A4tItIsFg&$$7g;7tdQ8&+{tKOGLtkXFLt`cmjphdUmIwc9?zJp)(rv$URH9eO0kc>JIQP%J1tzMSjvFTiVFP<

R1%XqrXIc)O_iGS4X$iweb z$5muV+SYcbizA_WhlYk88TT!d>fU|r&v!|E3XW(0vExMmdLax}ikf>rOd$g4b~Fxi zSJSNOVYH{6aEngZ;jdvkWqzcE3nUz>sr$i$;}afr9A`)N;Ii-e~aX0K%pG#6euUB`7Xrg6H3 zz>oxzEJUi5;^gZo>y8!NDeTWb%mb@eYqWz5xbWWSd zG~GF9nrc>VaIawI0{iajBp1Jri|84QLund$J?_S%A*gM;dxvjHDVbSteKqvG&2-{} z2( zdvHF4qBFRem) z`fgh%iCzdqxJf`P^0pse`yza=V9WPo8adkMoJQgp>_*HxlZ>}yzajkV^Mi1hB!M9! zg_2Hry3FGu_ts$F9qkFK%Z#{(TDERa!OW`kD4JIlYeUR%fh9 zchgFd#=`EN+S82JuFr1nQbZS9k-y34;h)2FnbGCvvk{TSq+F^_gQJe20c$9|_U z=bL4mX8MVz%O6b1uJDmO@^#)l$Xxy4wJ?&*j4Qa&jD%~AijxM#9dGAmd?Bk~uZEC2 zClc-%*5-u<ET%3<&WNitu1<$%Y?;;K z-mh`K*^qxGIv(dmfI#y4xFHy{LaVLbl~0*8jtrB4D6zcPTelayw5%EboCVNtx1&OO zw!HyzR(T;;VSZ(deoXZARevUT+%6>Nf~g?UZznG&xQ0u@)9)HX;^d)dHTi9f##O86 z!?U>VvVw_qKYXo)zT=i9@{-o;JW7OG&o7#DD<~v1FXq0yQrK6glO4F1f~4ifU)ffe z(BW+UH=9ad#{woJzkDx7J^F+uUe+jhRGl}!ue50sZuaxBlthpKu<7-<$@0gc%<_%+pgo<;fRjUqc2WK78Md;eyZSE%{ewKn! zN-zSyN17J_WgN`$(40ph_%%}hPB(F#)4O#SR!H)7eC$GSHh3oR-M98nRJw&XPxS-P zJ-=;^5EWIBg=rxJ>!Jy~LP2t{Oms7r{n@#_-GDD5xoa7%dkbnzL(MlspC$jm_CYdq zC3YmEyFUa7_4!J>!w$>b1AC~%q>bSSY=Wk;c|*C$xXw$no2=5YQP1Sca6n9r_S}Qp z<>IRF&gG-~EEv*40sPCu(kBCZkU6ih3`yg1>V|$jd6Rh4UTa1VM+AYv!0;z>in3;Z zbP4b0^DlQ9I&cjFq~-63qFrLBOc6E7nEh~~-PgKB6Kv_FlDPehi|ZOfU3-Juk1>^= z12K#_WqnZUQx9b8G}*+8Tk3i3b_+7G=|>r6odv(?t~&vR+cg)+k9s(SW zx0UMmBcRKJ@rv*o|D%plw0DzW^!=xFryle0dl5A2A(oQu_|(cI&+R!cqi+#jAWg39 z*ySivE;?U&ua0261%&RN#GYQiw? zth|kb8kQu-$33RXA0LSXL8we zpJV9wzImvz#78eogJgANtZ39V$nD9L>z6w%);1%(m&523d?^ zJcn1uzRML0vs~&a=`A!u!3Tm>q(E6|%m!bNtBB zjy7e{$ve>~t**!U@cn4m+!JMMqW-TdMn4@qgbm!f-$kzZ=J7M;6&4vnzrQfEiG9g9k3UZ~_=~ys-P2CRMJxPzaB;acxVEH`&eLrA@trWo=2hy=AA-UX z>nm96aZhU#tMb-9rvc_f-0SMa1cT1@qAw#PHmCiyeAM`Fmd$5P0k*Q({b$_uejxo) zhPkZe)vm8pcb#%s>#V%8K0X>(;rEs0F(R6}>ro;So#wDs^_H!$wt3VK+pAD(e$Rd0 zD8ELTC4+`6rtcx943~dhvbvq!eo_Rl{bz4l60?h{yH zpPjIYH?$pBLl7R$XZ}L`xGIEu$9tsxY_lp%hqkU;J>X!ke%qYq+<9bz=|q7ri%K@c z;^4+21@$H6wbYifReYlF zmoTW@Ct ztFa%_Mqret`8AX^T8Zc0Uh{spz43(M7r)J3Ltvc_O@)u#(jipQGx_O?{7>llVYq@z zUoVz@#k=QF`p!nmK(bnK98F%0Q%+pci;vEXXHkU7@k(mvq9%`$DC3f?G=&C<+zsYL zlZ0WDjoXa0dXi#?W$IU{V_z-QJm1kX#AM|Zl4a8IIBg%{%eORnV`Cn4KmM90k>;o1 zB6sXp$j3*|l<=G9!@U`wJZdp~C>eXl&G(Imjbb1V|M^38r_6cshe6`i0~3R_G^5On zwRLm-%!Pk-{lzVzNc!oIMRH><>{B3h4{ylwjn^BwcBM_nt%+(b_6Dc&s~wS#veutq zAMK)9`%7rF9QU3>YO-l#_)do&*#v7fSQFOB0jB>2Z26B@2iu(wbPbo@=u)kY1GrkR z($8Y&yQrg*d`Rb*3cZX48O zF!Rr~?izeLRfwKU`UWa2JRX@(mX$b)-c?Mb)j1BT{`@WIH@^9amm{9wnawNZ2$G{v zb^or-P$>IE{0GJ}th&El3OT>B`5o{0AAG%eIF#?-|6eGivXv#v*j0$JmOT-&wFz0q zQe@wqP>1MwHFqcfNog|Cp!9qX?iMexO{Vq zQ!}Aer3{~(-{X~_KO`p{%_btEENitP_DbebY!9s$r(9IeBa4fH)%W}SGgonuWjXoJ zHFTvdliwj|lLWrGy6wtkk{k1NG?y@_qkvR{_ElCP<%fn}xTz)zWe3I5vG$HRL$Rcq zxtD|C_q?&xyKuRInh8Q9mXucYBD*@V`#Eq@1$Mc1T;UvztAKT1jOvTotD1(m8c($#&t&vT(7s1Pk*q?} zarym)9R}2&W-1mjl_~hAr6{8(JHHi+X3@ff8ILtL)r+dWf^yuo0?j9aCXCD)*y|G` zBXnU*%xus48g+KZ68Buvn$@eyz0cYfec1#p#8gC2|0L;fmTuR>KepoQ;fXbKLZK7J z15jl;%+46q!;Z0=g^vpN!J>S~o8ed)LRlaCVWm`gACH&G5n$?{nFuzYnH+Q+Tp`Iq zZcoV|27ezOk_1M*OXI!tm1??vwW6;}u&MMb$EOUU&)qT{hAszMcm){mSG5aZ?**H@ zb#a;9)2|W#c1Jf<9`qHI!i`T(Fx|B6+6pK8;-?%!Ggolqw?0o*efK|E|M-Vs_T-fJ z9+n%wSB+qmgu#4& z`c1Mrnajpq87p?1A#7}Ji|DKyemS_V6R@76cYh)Hb6fSnfVm>i`;|uU%1Cws$=zXz zvs5FjU+u$gkt&z5r879ZWhbP*9xCtAJ8zrt+T_%e$sc^~l;oCVrrRC4YnP{fu&0+Q zR?E$K=45wWjB)&wD zy9K|vS|#AtcW(+g?Tk4p_{SUZ#*OWmx^AD#cun$Zlt1*=@LBT+!t9$3ZHnnPu#d*} zo>d$PuiXzD_MiClRcsa~d>q3i=ThTkZw zp*%w4K;2LQVHi)?E_BHIgyxC67RYV42C?vj5Ar#D>#4i^Wvc6*SXbfqhpca{#tGkz ztFEVLwvJEMk`Avl7LvxjlZ1KtJ7I;yjgRjF9p7aTKiqPKX|&_ygeFCseAYjdW}N$5JS1%SdNW_gvx96zOCWNfQbGAy0E?P z`2JE!kvVgxY`k{52lJx|)_8(g_q!TRf7SP11uXZtQT-d(gA?lo2>bg2m1n$&4>k6> zeNv9hXFs}aR_JIovkGkoTY5F$#l2oiN8m#7!L@;e>WXaHFBo|6b$Oqfm!n*h!$n7k zLu_U22Gz0@OSXY%`$12u*sWu;z7O&4qYc*UVTXe8uUG=2jJOY!*LBC&#>BPDgN#LM zv~jr?M)Q3fsDD})p36Isukjy0Su1y5tRHmD^m`NLQ}y~=fRf#i7~Apk2M*FMR_{ir zcVY1K=NF1trxFVx_4doIb>ls~8-*%$-yT1H?B2fa-<0O~hL*aM4)yl7#~eE(A$6Y= z>}Y#PI?_a}BKmQAt(s>7CST&*Gd$*CUUiu;k}Zg^-=m&sN&B5!dT&`qkIlOA4`aU%yeui3aLI! z|6rbxD#yxrY0ji*QYtD!jg5mNO0w^U*&jqngVLUC_0J?!QRA%dv!j|0fbGa$K{T?hVYz{7E>M_vCi#ufobaSFUsujw41lPd6>n6-#Vi! zgKgv(4f^KiT}GUTo~7OtP7k4>Xhj!Y&Ops(Q>~V0JO6p|@fub6c9)Z)sYgzlj}J59 zlf?vsW#OjI*tE2sZs20IVDIqdy?^vea!dIFc%bomiPWUyjXd##n15VGUep?l$q(hj zzl%5h$m1s*d=rDkFy)WZoUVX0{{wEHAQ&j7zgOwoL`om2oa#(HB-UGCakmu-h1%8>7sAZ@3VwO) zYu}Tc*YCE!dD5@2xzCjl0n2#*!K_pBO$}}A+dy=AP|fM%_#c0w$NTI=wMx*Njh&h~ z*@5R>Aou8;eSXg~!s@6j;8K>gDV)Pn!G;Pz5p*7{pAByYJ0bY}^%3d5@ zRu)g&?~r${a=p(J1CDPrI#(%roGAfh@d^Je%(h5q3ZGEqJLRFX8?3%^1kqbR|5SRN z6%;Zvspl{enM^{tok-{plp#=V>ny@T6IWlabp^;mUEnCC&p7-Y zhj1I1E53lOtq=deMYr?!w-3$73;GQYS5^MnjuGxQ5A4ls{@j(%p9iT_o=x<`Q^Ygb z3GNIGmPERWn_6XW6f`j1q5|v>$~QHP zH`JE18JTJ7#w#`_)r(m_!Yz`*JmeupziSGi{KmeJEeh2T|J@u2V7|r!fAGa z)@L{DTV)&WqW3!TZ1D$aKscrp)Gj*L93H^QOEj!!op-Y4)6rz@QB>>LFFs-itIXpg zo*nyXxV?d*l~BjnVf@re>tx~;XaT&c*+|xHoe{^1F>g{hx5uIGQosM}Xi*)tVVo)+uGst%&{!P6;z*uDzDI)&W*d@?0Kmwg~^ zE%L$nTqv!k?!5E;v%Er7y5pm7?a^9$;2J4jy&{UnrDBRz-KVXpo_%twmK0~QX4R8<*$ z-6Q6kgAB}m0&z7n8_te))-9VEHM{BQro2TaEhfLEXN%j6{~+-

gxDBN+qXVRRsk zYDMij_4e{Pn02Gz{Xo1^pO~V{LsL_Ft@Q7X(LoE}KGIWs7T3KqjA_+;Y&*-xP)*W- z7r2%p*b5Hg)1w>0`Gt1sSr(m%L9%n+{Bu(`L(%`3Yomlq#hR(GS2Y!RF(!6jGuqL*)uvvChR)yD?g45&3@bD)u<6c$#G`Oj(J{qp1j-jE`EowbF-yg#0wVUt zIzJD;YW?WArqdbwljkE5w0ZP=^x*hrb|{PZ9_)uoT_6<1FC99I9Sox7zhX(&VwhH94~_s|E7*e|0We=&Lc4BjOA zNzg{s!BGhbO^9#kfoo@u)v?gGD%6)he?&i4&tZr0_*$DALHjJZ+z3}3L5nFYvrikb z4sH7&hdBzig+ZiS!%1&y(Ciu!wB!1=v9yQxI*+`P{hGt!Q%DCsp&eY1zs2i$#I4}T z=N40Ery1eGB5~MCpS@Msyl*7dY6YBuPX2UhJ~#t?FyE#ff?BSd5@_MX7(~I$tS5->^vL{vpoz6yqAdP z&=*k=%`;;w%+?#}eutx{TGpr0wE9TY78j3MP~=qGw2to4R7ad329p#oY>P=1?&AZC z2Wm|mvw%SGohVOgmaqzGXo+L*nAqG#XY8+TB28WOTp%4aVl5vSgC^>rbx7 zJZsmnHTx1=H^)Z?nLx@UmSzE20$?6pqub~>HX4gi-0)lpW&VmvLWOD+z3u8NZ5R#0i>eg)*_w;2+W3f!TEiBNA5Ddud2@E>8KGMlugVe)kr^zDgEqNWUWbSS6Ggq& z;3NGxm{Mi#kkwsFwRu#?=?OsI9?Ul{t!}+xyj56N0nmb!4i%^Us6_O;URZC%U$qJy9K>SH#irrBf4`olC`d=?f72sSt8cP($?`fR;6{>xl zWv90iSBBQe=?ffRS;g!PBrbb19#;RVM9!u(`|VC)vNRPjElrLan;bARrW^I_NUTXB z%8eG4T{z^9Z$(ml>UDXqc10h^Aah62Bvk{KD85u1*21#j&3Lr)VZDR?GK68?wL248jHSj;-dS=GrVjuM4SBK%^sB@1-mlhv?Uh~vy zr2L$b2<0$G0s2c0ymG<$mC-`-*8sl%~xdn)Qnr!>zQZr&O z_NgjW*op0(y4%!5Rqv0e3XHeT@Y_`$A*Y2GyRXhHsi%sY9lscl!t{49)vUL?fwW@* zeV@ZT?--nKQGn{QJoE|=G2=jJ;?`mTC5c@3j}v5HHA!~|Ko#h%U4B7ychCW@ep z&B~~91Y>I1#&Ue#Jj43YZkn~mXESE+jD0xu(l9kI$fK24XSySBQ=NnH17+vLGV-YF zJeO`^giB>a!Cc_+_@ovsh+y84uWXK}vt{(ZEwtKDvvor59S-)iQWxyKMqqb`T*}i{ zd=D-nT)4{fmlL*v%uK6;TIu;dPKXmUWLw`QhQIw_RhXnvRf&1YckM=O%NZ++78oh~qf_I-Qn`o8kSRyx+E0Y4kXq7ii7x5hY|>yYhIK(sR*t7yc4Iz&@V z=jb1WmP+U5n=z(0*A$jj$Zh`EK_1=x0Yr$bkXL3ZOfJAC9;5aF)kXu5ulc`$HDo-) zF-Y6su4N+wbFZ53u#0EESjFKp?+OQ-NB*0+AI{2&Pe(RoHdECz6dL;>M}ZFIF|0#= zeBDKQ;@rgj6Zr_*fs7#+%bl$;JTv;~m~3^ba>XQ%FW6squc=6kbNElPTl`*#t8%e>(5idlP3Y_sOUy6#SE4EqxNwlQ8XUJLBj?S`*s?GYaF}L0nT6D7 zf0WS17sV{0`B<$_%I;ty;%kk~amhxHhFq&J6pQN+Fg3QS@jeL}7VeYxHj~RJZcs70 zx6?=^+uf4ysS_EM>I}DlbU2s}j%4YviEsxm6Sv^!ZPQ{8JEOO~hd+{>h z8l_*JV0T0Y6*y_aH%I`Xnd4;r29Rxq`6WO_!N)3Ayw!MO?x#^xUO}bw*z#!J%B&Ip zm`|}~%bdl`lG@v@v8djp^|VQqx!)?QJ*Mh5P49+oJbr_@{W1GTm$T**lRW;8@tCN( zvryWE+U}Wh4z^i3;R0+KBR@-NwqD=SS+|POy$?D3CtIha0@GsO`p(IfF|ySdpJrA+ zUFnf9c41N>?sB2JN>+@Kg}Z%HU~y&4xK9y+mgAN>a&4+KM}&U8jJQ}1O)osu`d#f^I&Ar6pLLk{qVSh}EzDv{v!Rlh z>isJlxjq-9!rl{0Tpr#&_!(=m1LkbYc)Su+_{VRqp1wc<7rFPp`>CJjHY-O)R5Jw0 zj%JkNs&tkY_RpLs(@=!Pz{9jQYJXdx-V~6gSsq_#idJ1Fil0L_~VD$TOEAcw_ zxqmm$UXKoNNHClt)@sT;R80T=Ltu7-oYw2Sl8B;_mLvX1K+%!CE84P<&_5?IoM+H| zEaV1p{k^jNc_Weg8GoqHUOy6J;Ep{>K+u-cHvY_rd07%TgVC>%9=tw^zLq_HP4mDt z$2`U1!y4vNAMmnh(E-CrkISQ-BVhhW4~$x8b2^^U?c@_0i>>h<|1T{78t?)jdODm0?bwdnKkIRWI)!}f)ROjnD5hYH7 zDTVKM_C|D?w|%Z*3H*^(#iQ7@|GBCCU+Gb0WDCifEaESE>8JW}3aZMM5!ha$R7d&- zNzdRy6gY_{bqw1+`GNo{5LNZ|7nDV)IqK8FyR_e&fv1^r^!C8 zK~mKLE71x#uBNCm0%0deY$z~XRd~FxoIarY*Wbe-^&el&|KUy&)&Ww>|A47pIRo}- zr4kSO|INDt15*=tcX&+yV;cLbe+4+@gHw#m*N%Qe$CptPvNG4wlqBT7ImU~UwNih5 zJPl+w8<(`QKOhZ_Cm? zl~IUUibtQ5{*jou3jfitYW{8O@J(*wt41`7ah=HXIY3|;#RYKWegS`SwTR4670s)~ z!9KiTDbzV)ZT;RMM|S6Gsej^P-gO-JN$D}G5OA0QGR5qwtyjCbd%>I4s_(uBTRJ}u z9-I`x(Zpx9#wKTJBA*Y*NlIETcBU^}ONc?+NjZvqL41~dQFon%XdyB9MC)kyY`)Pi zpeUOI)<|*wL1V2W*3(AV489k~?+r=2x4+d(HvSd=0H~XeE}>rm-}$>RaJ+VJr=m+? zb4?0=2$7&;?Un=k5ji7^V1!Af+ihzuV0rm63eMP%MLq@{nArZj1^okSliSB0*lP~&R4pvkCYi!ER3YHNGuIr>kAG<{(enrWKojQ>rsJU_&}e{ON$v&?E};AL~=q{>k1g71j^iV!)x# zepRefr}ndF9~ypVu$UX=bwkuAhF>UOy%# zIZivF^W&}3fat7!1FrfGZush-Z(3=qaE(8?^-c=g^vcHzWTVKcV-ji-h!SNpqyoxK zKvMc8L3iMpOEIrGP-napaNxZIF)Lf1TLc=!074TJvt7FTo2s2iof^dWqclPg?7hjQq{?%?Yq8-$u289VxGlpLF{~5Kx z1JS22)KN}8+-z^wkrgn!aft?g`zmCHEN0_+tI=Ua>Q<`1iYw_{w(yt^KG{Y2RUMl%Y;7)*5DEYWy)XwX7B!RtD{M|!|78~UPIZg|bS|$kv^RGB-2{{NjsEmIZ!c;xvia_0360QYDPCG7nls;- zq_G<&Gd7t|9~`wF0GF^Gj{Di$P_SY+spus1aKlF`!+S|1S95;53KMT@>V}9KSFasb zXR9kR@ww>Ehq|>>;cMujp(Qtt-FkrOFP@{|GSnSc{YTzYms2Hpf>YT;`iHB2vg9uw z7*(t}r*dGn&h^UXW^K;?o4(7^qY_QiX=O|E+MFxP?|-?|bK+lYHZ*Wc%0NBE7+8os zDkQKJb;)tHjo*TL24!lme4Yc#w;t|k{CAI|jDU@*#dw_?-#%@(&uyBz);&)TC`j;h z`a{i_o^UrF`F_kM$JR+yzCLo|DOe(xZ?2Af>u&w9oGkrqHx=58so4~ib%|#$ZZ*pa zysWPjwD5aI<*LxSpUU^+3W!hn$y*3XN4#zzaQP18`byt=vkHh{kh@XW0qm6Yz1uNl z4^W@cV;mFn7H29eAGi6>NHEks#B2AC5H`ZT;0)w=#Kg+1`UY8ZG+i|GKjbasx?6}M;RVuDR$Y`*5TugPX+sZMob5#s-nnR!LlI#xZPheS6i4fdz#yXB_ z$AD8lu(|dSLmVX_NkmK+wX&NxD}Nbvwdwh|wY{X^Z8fO?@1wL+7}_Tv_tR@GvsNh&xGL z`@=AmPZTG+5G@2UcrR;e-?~o9uj7(byRM|L!GUJDe!AjlX8;CYv!ABu-pHvC+{vlp z{axIDFKCm5cySU=69pkH!@V&eIyEI($CJ_moEs!Po6d+Tpu64^xFzZ^ z!Pndj`tHS}hZ_NJ^mIoYp&66qVh_v(f_1BJ^s|&x(G?t+RZeqy?v{+l2#VYn3SJQ2 zvN)L@OP5TmzI$GF5;z`W$ezJvag*WKeA+8tx=cGmDXBZl*!#Q6zV+8IPs1x$cdjxn zx3vjK*~n*Jkw34Zg%r#%zam%>7;u<+*7>$Y9A#G8M@HY^%0t&I5~) zCyXo+^;NqChQOJ@WwBv9zGUe8^_*Tb;$Nx=q41CqcvxP?0{Vq# zohyU&Y&Et(%0T&eKIGh954?TuF&f1VR&91ETkm0&aw+LyaiWX5$fdaH^>Q`;=@q>x39 zBd>h;**9*V&Iz3*W{?O=7l=j#t3wq=W+mA>-4Wz!fOB-IY@_m<8)~{`yw()i&AyF2 zk6QG`R)lb75+u&uA7TbV!9Oef70YL$YF0nmy#_z1w1#vI}*HrAwJyeI3&&%cGAO-NOwsmoA7mO&*2UX zk{GZU&2GCoa80R~t!;f9DCQ$0!jG2%B_bJaE4W8f&mb@-Q?TT5xU0sV#!S1)*odHz zQ!Fh5GtA$k^tdX+{DrdH!RUhk2KO+>=MU)P|KaPsR{xODCvN^?h_pm{0rKG-Y;`lH zyacC_FSr;U181r6~Obze5)Zv7z|jeHlu@8|Y%fKwqcI9!JIIOC|DB#7JX&C=}p z95x4WVK_O}M?p`6?4?Yj885Tz0Kp3z_Iz_~aZQU`D_Qv`3%}=j4n8`}JDxnc5c}LQ zne7O@-NGS=^en<>L?F0(>Q)jL78jPaerg>$`k4$L2nvnG+fejgkeyjl@;M1MD4?_4 z>Kt-SQP`}OdqvrM9_VJj(O=Qg?M#yr9-Fr_HyOJn*O5ZGeo4ixivkl%0u#7ly0~Eow*-&MO7=U+V6h3Z@v*9Lot;Nd*>f_!pOntb z$Ut9Mhu$1}5-uLRDP9j@WCk2>XlnhQZxX8EciX)S))dY^vys%jvOc2de{>o{ULJws zLrNX62G>gj9wX&YWc919f}c=*k$;Sz!*8RkL-dbz^d6_*Pkcu0d~U=?wzVrGB~uf7 z0n9emSCLN@gx~Do%J5xqLMuGF+l6%0s-ir3AME*!myZB0U>M(VSNFVk!T8`UKOz>A z(}F=PMX82Ud8of+QRi0**Dy$@q5oRrmC=1`rhc|#|J!gPa_7OP7zF(|NlEqFkBA|a zAC0M|$8K|^`olVL`Nr)>D*KPBQp!t72-I?Mlpr(M;W|#?emV-qjQMrFMX4^=pFBj0 zuZb&?L>HdKZu5(_m;sCO;*89p;41OgK1U~Lmm`C9_|Az!Loo{b6B))x9S;FW^2$vi zrnspRuws3mho}@oJIE)8rN&ns^G`BhHD+XSP{v4+ouoL zn%J~?)oxhDrOcM)p-cQ$_IPs&a2Mf#QFt8R0Y=j;Hc?t zmiY-X=I-v!I09bOF5cQ6zWcE7XwQqulr>g)BA};Z!*S$3zakt{?_&VDy-avt_SyOR zG4OTPdp=)bM>u4zLzFj@vM}*rf2KPxc##XK3tcSqAwI_xzhf3|$(*29uz*jBqOo7t?BO)i^_`5>hTESKGE!a-iN#7uPs8ummU0rlN zuSpPD|6?5#RMmrmN>3I53d>o5yodY$0Zf=!;Wflt?mOYPyjEWhg!TV9y0SF=xoI-| zgUNhDu}y0Y76J<|uD|6k|7`(mzO#NL;49H#YYmzi-&>j3`GiXD_YttzjQ#h_#Qo`2 z(>$PGe^>IX(ZnwOc|CqLs{X1_VyV}H;VZqsK1Pb#;Y&~}q#;iar3+uX_4j-WZP-S? z$Ma@rQSa$Qh6Z=qqGRDL!|6*bXSiAkSah%mAJrCcx4V=bO>_iwg5#9tEm7j$YiC9} zBv#2iyeY`+{N%H^`jOe8m^1}U#8_xVgl{&@JlQ!GfoiyH3{PORrwkN@ZjW*l%AuCm z6M)HUef^!L-9pt61E~P8Ocei;R@~&?coS!M8LEkj^9u2)zf_!065gm0?uv7~epg0h zzoh*gz7hS=E`j{3_wt`7MvpGqWo(#-yBZ(UWjQyZeu@EQFoVE>}E47$~;O=17}=>qF|}%Il@CK z!Uot|h7Lp~> zBN}4Q1`P}TaL^8ovkRR6bTpC)Lq;A8DRFvRQzVQHT;tehE%-Lv0S9N|J!jMRBAiryCj0*wj*;v$yX zuYPa?#Adjy^Z$DyY6)K_qnh@V+FZ_(1gsm)NtFVxCJAXcbp)oB<`3@qZ_O-k#p%aJeb=Hff=xt&hoY{#XMC+kl$mg7i-XBW zfOEa`l=mz|6l%qMel|+`DbpQT(zjQr5K$dz0b#_Nb4)5_X4~0vE#PKGT5m-lQoCH? z-rCJY25FL`R$~g3VKpWd%~Tz)KKSsT=f)gqJ)TN;e`!LL4mg>_tV<40ZJGA=m>ADE zQpLWX@W*c^gY%!DrtWu)Wqqw*RI;MvXb1tN9F&sGjrTZxOXYBeu5-Tq5uf$!&_8k- z^HKO{;WJ9l-=#hS9iqjwAbci=`WE?k-Fx{9GpQGFbc+9ymj0(~wen26YX(VR0P~>2 zIgzIb3&C?_^4_KA7Of>}-+PuE{yL_mE!It77lvIf=aXRjr={YESb_|MK-i)Bg zrDAMN!GVVzk626jZ@HC0181u2?v3YMx29PCDHCTxd&QZ*74c!-RI2a&N)JbzGIVb# zi>+|*@MgpPRprlO*@|E)|~}$88Mjx zPPUF59yBF06)x4kqSNF*+|%V5m+n^2T#940!)qrB zs&uYS{i;AcKpVk*-1o*W48v?TD)Uu-E<}FF%MAaz+jGobYPUIVZW*UJ2V5C4KB9*T zDUZhNO?NW^N9fwW^~Whx(TNI~Bt$*B-h^SI(vCa3;aZP{yhwiE*{3m80GD^n`)0cs zz4GmiyQf}uK74IVLvKD*mE;LZTd-@e=gkiFbB4;X&>%x%<=KHVZ_yOA|*NOI2k>O^G#&TQg1Hn!#ED zYFT&Q@>|a?KL6bXz9bJ3v}Re6j(RZodce1!E5oVQ6fln_86{1btyeLL%jz0|&|FGi zgEfI9`}_9RFXoyXoF66h{g7~AS`Rk)d!RSloO6v1SWb!@J!{0ZGpBn;|%g347C}k^dOwo;Ay9p0%BR|_)DLOZ^1!2v2Iq{lF zaw#w?H(rYgW^GMqQyYUu#M{KhhaJphn$@WQo5ugD$5hb4<>c=4Q70Ys z8fNSxHE!^B6>ffCw`#ukS2sPKO8}sQ%7d)(wOHyk}RIh^u^+z&Lv}hX;8ki8HI~3kc>nGSdj7|j&?6YDD$Czu}~^ zq5AO0OTF`k{7=6t&%n+X=IYRqav8;*fDj6?&Ztpfty*t{I5K?K*bIhcXr~amL#rIQaRjCwf4}!^*ASDf;?kbDIu37W38z-l!ta!|6qpBef?*ipYhz^KZwI|04&N zjYBm+FTSJW5lSQ+bUje2Z&qjOHj(>Msre|rex!kg?C7`4@Jg(j-O+iJ<-2<2dP=?# z^PN)P)_=&^a{%V{+MWz^qc0hMjn+{VFds#T^fCTpnNjAbw7zLf;#BVAl`rArUBgi? z?5uttvIh8|!7skfDex$pCkq^n=zG#p!@wAIru3o&4^@3-aF(ApRt`^d?%gR6J1u!Q z6=atWc2AVOEb1~ml8uv{uy#Y?~U*eXHc zxn5^wDIQMvjYh$b-a=C1`iGG>%tEe)5u3B$UW6cAR+e>VOEXOs;<+6+38H-(G8^Kq zuJg<4*%Pc9Yt0!T{1^ogS}zgb_-OU1U9A#iE**XrGBrYf_trnZkDX+pZOm{){MiN+ zz=Ff$ySk5m5LbrFeTci}Bu*u7(cJ5sXJcf+9uH~>pp~RDkYcJz-ri~3*a#~Oh^*62 zLSHll(3K;2=fp!$AT3lYJQqy<=FKf{tk33d3#OljTCT}UzPC4-t(Yf78Kjs?Rkqd? zv@Uk2KJNHyH-p+fPpV@oHy$6QqXe=ubCUH`W*_qf(9#7TPvI05qeA46%Ak$BMb;uo zzPGE;bPlF`_j<211)osL-P(nnt>>qzSU`7y-Q4K)E<$#e=i3Smzxqw9%g6u~?>?@n zg6RKrUtW?f8LVAGcVAbEE*=d%22OJnSuG;(y#w%5Q7EklfH|njufBDv@_ToFCn|JIX>KdPdBEGs6ZgpPtaq_k-AC5`) zT4Y}Y#scW>qF20+kkUcN5KtgOE=48UKOr4B1BfE}EBY&;Sq-S%zym@obcH!&?e~15 zVF`jYt3PPY6)W5>e5z<@dYODX6u+*l79k?~Jow&UM)=2xSoeWC<#P{G-0OtORGj6~ zm-BegfoTdsxj_!=*K>CyD|r)45GfPhmBUuQpr;=|ZE$7FoVK|BwFW1o$0w!AARAy^ zI9%9MP2NYkM916kU0Fc1a({#NXqN(nX#{_R1?mHr_TE&pDmma+bDtzY_(4ogFLhb@ zBNp~Qmsw^~6XYhdVqI9Ud|DTUnIHH(zXCoRv(YL+H(sUP?dj>OX%L!3r z+^}Jmm~pK{UO9X!tmGoJRJ-;^S)TKjeCg9&;sJBRMMlW6 z!7im#fl}RWL4bi=eyPN-{coVjw_H`=MZ5(8Z8;OAt#y%6Ht9mRYrqH{AV>CW@?M9= zG1B~n(FWD$?;{aILB>r-icRIjUcx5dr+p+6nWt+Ep683tb>`NVfAUf%0*d<||GFF8 zk7ZQ)FD<~qcauqhL~vw_%)GueeRMYSVm!B8Ksa<~73}_==Wa6M`{fjvCm49?R_8_hWLW_N0`lHk=EvW`b)Z~)t$Q(vB zrf}hTK3u*cOJ?^gNiNKDbv0FFD%=GwNnpx|0G#kQT$HfAI7(h@uAZD?A&n=u(V2E$ zMr})oIzxzR10%J%!L(0m)K5Vch94ozXB5GEi(?X+6VplzPdZu3~QyFl)fvZ+@HlxVpcKm=MT=U1MH=Y zDJL`3C8EI=5+07Xq>P=okSJP&o?$sZp%Np!;vKm>6rCW<|LXLnu=((c#RtS38~Hr7 z9eCM(*#3a&BL4$vjWKWnurw;XZ4#WJP@5;0B=lt!D)x{c=u0Mv8czR|Fw_6L7-08b zSh||Rq0SDi&W>9h`vAHqpyeewY zyR;F*d^O`zen_g!S{Hj8Z>SlQb`R)l^2bvmQ-vFS;$OP9unAOC?i@ncVzgK|MjvF^ zf6To@4zQLAP852r*Xi~n>7^`?GMdrpPJqm8187elE{Dxx@cqz{(cju?r# zC*-h2!9d-%9@2Ie&x34w-~OnxZC+nfy{xg=X3ogG#kCyVRCk)xI9Oh5Q`scHwQnCz zg52!5^KJB@bDTU1YjfO7Zk~@qq>~ln6+11->L$M`4k8L-Kk!!NS6NC)ja1WhNkX@q8r2V3YosbPBFh)cdA@RyC`>KT3HNDh~ zp*yl_d(x%;#~mLqKl*b+RnzOr$>72K4+p3Qt=k#yd{n+_Tdz zSq)OpJKje$H-zPh({n2h>~?grpZJ*8P^l?8G}fPwr||lP44L+A9k}+0pQ)K>n2TQN<5)x#`@Tz{Isw_|TjzMYh6y{zknhNQxC z?H>Do)wtqzGIfUH;FEH_Wmst}L;>d4t&7!O#x*Y%w=RB;qNxuk&t)g!Jynta2sb^ zi*nu^F-H4R-C=aEv>xaZgYv&dxfPzgM21zu#NVaztpu4_MT)4bgBHB10JRpKqWvao zZ%*2C@>`=aEIvvn1qAWkcgbIbP{bfP|J?tP`^qZm7c_6@!e4p0;n+hj!`EPP=DvHm z>W);M?$LU2%kP=T;oXazh=^E?X!fvi`9AK$TA@rvh9B<^MyTE&O)mO1WzBy*>21> zEr<&O&CMS^9lW`CxJWN&K;>Z&t$U?i;C|psC)eb^S@ZjP{}W}s^wjeIHT6;NnyL6M z6g_CALMYN7oa?@RYB!(KxdD3qW0mMmb0O;)KR1H(3|PrTrThf^cs#Xf1S-m?G!;XI zJal;``sySvRSDl0m*D7DWYl1YO}ao%GY|9ancf8Q^f1RySKhFn22%6=+)dI`(uV zE-8=~f(&fM{{)%?0NwrxkWYcNJLu^N29hU#4^TOxen`H=v){owrpDeq9aW%)hxj@hLRxa{m{-s5UxvrRnx+$xCP?Xk303E|7|# zpO~<6Jwhq^3EZKv6pyoaLM z2|RP3WQ_}VAz8op_EL&QR}1KA`~hz3U}eAXF1I6; z5zG>G?&~)gp`I=0!!9TRwCba*Zw?YGH zsReQs{r8NedHMM=JF>27yksjV`FBhT2VHe5aauSxaCy>y*q|#Z>u&={<+qt-G2k_^ z|5KaK`VX;3=7B$ne82^~GE78@&v;2{7uWBk!9N3k)?t*{xgM5OLefz8wWIB;Ocb|R z-!b$lZ%d($@S^ii-C~{8X|su>gZeWgv9pS$UjGCXavP21Pc}p2UqhRqRKjv=(AP(|YY)k@}jsHV9-DA%4OQ&pVgtIzRO1Bp>g(NTP3fpHI4ClEW+U zDV$b!x_I@cIB}IyAz2`}^vo#(DmKXxQ``~@ekAW{t5@~mm^DRk-j7*|V~GAoMfS&G z&YV{Ds*0fznemq?{GoQQpH=&hFz;sWX2i-&%G_tT>Q6XKdBPyXbG6oQ8B+I&Lkail z&+UMTqb0}z1S}@?FVZKgesdU|hgit_6NrUQ(h0(_FWWt;_T66i&j&EMXUS84#u}SL z!&G+uG!SfOn`vd@ZmX0Zq{mpOJigvbbglH!ODHcK2-G!Ky=$pT!+h|B+VqsFq&EE5 zo#6<^FZs^*PgRINou+rkGZsJmsq(Zm&oMl-Ev{@tN5~zb-{DqaWcmDTIcysH2DUcH zM8xoXDZAj1x5c~SxmqsfY&9D+cVlNdRr2`G z;)-zjFExZAlh2e_h2QS|Yp!QImg!nh#WtF$53=qiS74N#F4h?`!A|(xUvZ>~V#UOD zNAj+$g~y$`B>cd#5BW*}bc0;N1tvTVdvZtuf;^Mhu3S>?XV#67pBy5TKGwS+eWH-0)HVzxyC@!OK7zfPT1~~ zg)YWj{*9@A#>T}b9F-yvx0gb(f7HJ*iBHLWUZ_%OLL{ArAut%jdY>w>kCL(Z(Vyrzc1Zy zp9>Bov*4#jsF0DZIC~?%EkP5gduxXwK(H@$u9+C6)}V_TO$8atKTwV<5x4lIULmV@ z7pGnjJ@)V2&?}iLqr(aP&k+b|23XA1ZnbE@)>rsx& zOjx^)vdNT)9E}Dqe&u8){(9gw&~%B(%AZ092IG0yK>x8mv^k~RV1FRbkwZgOeDN-$ z(^@bsbIeRm&1+SDVB2tfj9Nx+_b6dEr7%HO6}S9m!%fQPhj{M5>*gRBqiDIi(aVut z(9hcj{Oh@f8;1BL$-(Nz@JUx8Mxl^hDTVrl`52l*%v80k72)RYx_OVAef)l~#-|%r z6wHqEYRl_NM!Xc$uJ<=iUiAyS6aM_<_Efm%60UareA~pIDdlVjZC(qUvHP^EU&zhS zd8F~_-u`|Y{q*Zx`v_(!iJv}n!L43b&8K#LdED7L^Y$r1Y;N`ILRN5(0$43P+2bXC z{(=of#i$0IWTb^d?HfyP2GVm9iVr;>tF@L*9BGd_45um{KhK(jaMaMwsaU>2vc>rl zN}Y~jzNV7*SvqTa0U;{>@f?IxWf>APHYn5Qgj)?-Ectz7TUkisatyrhu9e7y5e(lm zmE|-=8lgB9cX46o8tI?d*6#-@LFU`G#f{T#$IMqddfHfp0^!*8o_-qUL7LZi%vWPG z%~Q*LoP76_Bto-9d4)bjvnfyD$B?fKPX*_MXe(2NRIYOdm$d$W?R{rdQ{C4m3Mvs% zsvuP4~H?k#4laob$&mTo9n`Q{uENQD=ib`KjI?p92s4%~k`wQ3_cJgsi zWi7jqsprqf9qzay{#Sp67ttoE@|bHpY3U*ewUx+-x^|P=kjD}%vdiaju!NYj;2l0+ z;@6hXR6d;cOq}c|{r)s-OoQNTO8xGes=(%yu9~$v_ubv#E}G9w=U9RH&jfV2PWjm7 z8i$l9QJn@qKfhFJ_i-|lW5R_=%P;8k_jNX#oKHlr`}^R!AC6ltVSyd^Q>8XAa!!oA zTu*g(zD>-Uywmv>N z?IUQi$W4IRtOtZ25myE2c{m;m(D2d4r2UvAU+1pN^-iaMJ$nUU*bztuqznx-=2sV` zGfS&?)rdSx`ohPN*ZZ}QgDTFgTaVtK2;93#=8VweQ=2M8KAW(hq2Z{ZjM7hzH0COy zrXu_N)U8e!SIGgI?MLWboIJliJ!_5h1{A`3?fnQb|VbjSe?vb!gU`u zMbutw%E)q1u*Va`5Chj^{fDTz3-gc z@{mMV&!I8?FiVXd3~bk20sa$#uqdT=raub@K6hVgPI zd4lNB?H7o2$N+Ypjb+x`&4_PT{TRsPVmbVVczH0!hE`MWAXW)%`M(p< zzTAe}-~ffJRCAh1Jf(keB@3&4iBD$;|8^hzLY$1|`F_+~RRwPR4%N>Vn%;Ss%&5B{pN^5(SZ<2o>EUwk`EbAk}3msLE7A7vLo{0 z^ec;LO|&?a>ACPOk5A+io?fqK( zU2A+oTw_}LdYN(I0o9_h+I=p#mZg|r1Gsm1xZy>&e#5nb@iMJCeyO`@Ix9Kzyy^2>^n5@BF8`=ykJn&&nvb&#ZkVvItO zyqRS*xkSdKvc2&k^Aht^9?D?378omDbhQFA1}M9^eHM&s&fBY~D`|<#1}EieyGR7O zy{`OHsxmz_YpnrcFdigB6O~oU9I2BwPj7fDx8+YQ#pJOViR0qLRt6%2jSU>^#Z;Ou z@BJLiuak;aJYa?1>Pv|9cM?d1m`Wk+Q{n%20zjcJ~y-^NuOn;A4V@lFF19aFu4xB62JR2Cdx{+G` z!WQ;i?(F1R$q}D}vNBCEfHkd4yK06O{g@eZ7Fl^h=nMCDV>FRbm{(GagPV7I^yH11*922{%xzi*LykRezvtfWP^WaVJe6rRBYqwJa)OH2m5ja#_#Lt4 z@Zn9~?Sq_{o303Y!TRPZ7>e-fPqjAf+T0`Vx#ga~Nh#ra+sJF9Cl3W~o>1DVqqtwA zXK0y^dV0a@r2PCXdF-Znm5VvqxNP_P5+BiXl0SR*#;6B9cEumYV6OIPuI#>o)_*BF zdztBZ<;Me)TRhT6#l2DQa}8A%s=b-ZC!r)gL&K|&Vh>OemM9kfafLS7DRDeuAaX8l zxFP)Rjx9C+XvOjRq7pM+n%sHd8LGC1XQqF#tZ`@j4mI`K3pdW0df?8vU|eqa9RQc^ zd4~pGYHWp90H_h71zaUU5;sd_cq)OlfKcVffHIVCXyV&x%oiMI90F6*Kr@ohsnZ<6 z$5xL)j)fLWo9OD&W;@+$i(i5H9m+%KB~4bJ({7A1C*q7Vxj9itgn!jET~jOSc>+3= zNyR^t+@4$}PZ0QLyT0Ni%N4^#L^$N^nzohNX$zlVsIE?{C&nxt<#KSfWO-)R_Jk0S z8@+mctsOx}^p`o00S4k3+%H0Xnw--2HuGb7nBUEXY?s?&YF3ZuA0y6l4W{(xt9i(# zA#&d;+HsuzgKgHcsFx3X6J5j8)Uq@v-O)9Un%HKF%(*K^Legf=(g{B;dT{_D3sd(t zE&`(Uj;Fh>^~Rz4VIv7GP0h}p?#*+jXsImW4O$=b?OU!CSMVI5Oh37eJP>6Sg}~j4 zfCzu8!L#AH%B4ylbKICK&DPddr{ugADa*+jGtU3qhh_iMGKzJzAoBd3c2`=sP_ajN zwxJ$=n!uLjXI3cXRoObGEUK#L-x483)XC0NzJ>8lagw|<_MGBgo8Qz51Ga%ZH2Kre zgvU5)d%`4ed(rlsA83dr)R?EO>C_YHZDotH+d)>cH)fJH1;IxC1ZQ~T&KrJ80@@~s zVpcY(9DDF=If7`fLu&-nxuOOka}|5PPk*)>_TqRH8U59A#NF-Y(jKlf@@XEk=cIA+ zK-%j4<28s|62C^Ky**2Fzn(~VP}+0Bu8AV&hO|}PIA3daxBVyZUIfMHYu;r3Q|1l?GItADzCua5?rBvP6_&6#Ww zoN+53>U^r?+_c3*6M3Pe;#bV2BfdI8PQz~p5R61o=e_3&X}+}!orri*-l}gSVnE1t zM?C+u7dQ=z-x^9d4t1dBC_GT1=HlKOWj-j$s19l3GK#3< zpgt00njin-*Pt4E=Gx&jUYRozuWd5C_NZ^UwBT%P94~n5Xko}GPSGW&?(2>DF`!TQ ziIw4L=hylihn#cX4-D@GE2%w)=LB*9e_I(-6M~_Ip@DTfKytyt{n?Q9P2tX(b3V?& zfv_i|Vy_Ki_Nm$`g}RDn7R&8G-vml_5y z2YYRcmYZZ~j!Qj0MQVd@yK6v6s;M$g9ffy^KxnDd5K@ND(uIl{;?! z@ha$D?sPAx_!gprt|Owwlzdxm&4yUkc^FNr7o`txn@c~5BZD_RKAdVq6=8pDZ9{h3 zcOxK3t5ccE?LWu(FS=o0-?`dwGOTI!(R0PA`9{}OH^`IEJK`1bE@w^BS65YCy3;9) z#`aTOe2k}3Nl!Miby>pl5dtq*nS&f5K7alQlIEV5#Adi0BovpXHY)hEtDU)JOJTKH z4=rtp_CCmm2|CuvM1IUB7lS)s%L9z`6qxzysXf7PxE-5*g7(-sMWf6)m@v8$w`ylN z@{E`Zhu%q)Jz4pT5yQ`BED(8=#poR;FLbn?09l)Eh50U^2Y*n@)Udlsi z95Jx269Yc4sGf-PUNU_3^mp8G@pBo5JkYO>awd+YR~4e+Z-)3#3^>f5FrM^Y(M~4$ z=g}i)w?h{fHC#Z8&$A#bD@>pOK6+2>M!^||exy_2iUN=228+*u4-(N%COYgdps0`d zG6Z6Q{mA|Bcb-`TR%te!6p6PhlqQ(f<>kVgw4vDHhH4#vA&GAim9;q1-s8bg>ZwKT z+(lgEGVhb`D9qHg5VI24p8GmZ^Y*kWSrhY&(cDwW^_jsIxS)P9mhlr*u_+Qk8T4b^ zW#->K<#;_oWO1*Bu_J15*;YEd?@q{i zF(mD>$N#ueDLV+D>-uTWJ|hb6vnIhk-a* zaN({$G1@e#L@KUGUQ7B0Y0ntFr!gABP1P~hT67wEF$K|!lF~h|n4H!B!+p!%ORU_; z?IhFaw%fQ$Q+?2I`PHt%W>}r8Ckiy0klS_n?JS4egx4P4^B-vy4|RO5v3YB;!0MF~ zPRD`5&TB-q#OXhE=ct>+T;VfOJYKi;bsOPvZf9z{egPF9F9b}+E=@_+uNR^5$j~vy z0*`&WN+~Hb-%)J&QWF5fMFSEbu`H zFvPT3VL`+JL$n2vUxEoC%31;M3W?=M_Tu)^?SjNor9uCd`qz`t(=7DlfZ1vd&?7tz zX4#4<`ApNQKZoo_dzx)KR@pac+kM`#QV$8d1QciqUaURiV0SR+w71B~7+Iclb)UX; zEv#!_H}?T)@s87Xep%`MIx)D6(pO(Z-3-f{!uEt~-Y$t}l_t%`gVC;vza3IqGC;3n zxc#nX1Ui`XwelVfd|4js4Q4o8EJ3ct&NFYO$wFDFKgSkw_$waMz#C1uzbAH+lUMZP z(UWV-#r2Oy4yUk15L4ui^SG&9WL9}ITAXLw?u_TWAIFcCOPRG9V+;>j@gm%6sS|pN zLis|ad!%jzczGeVAP>hcBSiSc9T@RR`;O_?SMRr8wws&Kj_=5L>k8Ix%twx6d)Js_ zMJ^J_M~R*~=aZa-Cd+uBB(`RwTY^U9FTLBY%oMpy%HZ2laJ9YnBdhyiH5}HpV)oK% z?XwHJVC7|7w(4%+!OQ9Ewsd_Lm#9YW>pYUIEG#Fjjr6YEw+a;eb3$3o9xGZTlW0^x<)zZxG zu2h9FQK?BUM~3oLc1Pz+>Y0xV9*O&2seTO=DU;d41=kfSR_)TpWiJ~M3&lbY*2QFa zwE3J+A-=x0Vr1_wM*d!{5;aT9qrSA(L#QJi zP1_s${H#H=l8$>i0@)&6Q736vkkiKV+4+zRR`l8fioUYFUP@s9&gufT!;z6}_SF=^ z`?)#SNUc1Sj^I(`G+Tz=jlj5Kb!NmPqYGz^Dlh|@@|PZNw$92zM~$@1i>_o*czJQ2 zk7Vgq-EV$#HMC-`M@IMEh|Xwq*s4E!;CCvZB6K8v40{zMMG4bRxYIJ>a;p4$6TrDW zLdY2t;R#59q_2j*;UN^g$UBsFu=lRc=RcT0U&dNxI@`x!D2cia!xI0dJ13z2N|A?jR%B9q(lv*AFGC~^SU*O9@#J*u@?2(G6vT@x@Q+$_b+zw4%nIo;ivLUT5R*2NhtxesG z*tg?eR1&JUKxe6+vnB&d>`pSlywL1zv-tqJPrGpv#%G3#fAhO9b4PU$)oyI873nP2 zWBM4yK*{m4`%#MF(lIv93w1gU3opD2C@n`kYIQRqHNys>(;eY^PYr6-YjYMv5-22< zXT-zE4pF+r%XO@I_&Zz!sov$hCLkn8fq#)+!+;U!F=D`8lwaisMma1biHKg8RtDpW zEMIygHH;tRRz2G~x$}9&D*u(^$YGM6s}F9KkQ^pOxq69qBImmKP2JJ6gFmgpwPhc@GNwjzjm&FTGT3^qTli0-^d) z@Z-TX%PK|xU$d!Ko2137_p?w(ktTsHdVeu4OeNmCtXc#YUc7tvOn+?=HKL}A7<}+d zznss`1(Lhx0jQgml~8!)$@V|2OVpbNjiGy4kbI&C2;kkJLq94 zbLqN-t_pV2Z!?4N!cZEI88Zl_M%?RInTL+$AuD!kIWg$msx=(0h!GL^L*s@4j;n03 z0BtshSUeNVN!s`Kt=&(~D=w!B;42k!zK^^zH|f8cSC0k(`x-*()i8NRpg_dD_yPC1 z)M}YKKXzyK%mz}*vpi2Q>p}?jzDUEngu+BmHTN}wptXgpMS>jPB(%TAcKoK9r?7ov zH4^wmnm{Y6ui!%4a+~xDdE*$GD{_G};h&fRc%||;{1x~QN~ug|1Y|}+DWD}`L?TZ1 zhOJdQT4kua4ho^%tiIl)mmGG}(o?jFjSmH|9qZSzrzs+;vf(5V9vZRaea6Sy+S=(W z!AQDEU|>Z`$)mQ(Mx}x?{Yo;9-eERSX4TLCC1?V(iRbFotcK0mXx`SeeOd{%adpSc zv5msX0;!An2BPG7XfEqQ9*2MSewMlfM2Puz);KlIySq>Tx3og2QBZd~QBQ=-u1^#d z1N0tKNgPZt4xjFy(HQP%IaLL6yeO}IG_{CFhf;Ub=F2KBC;`+0I2iNhqAiX>8^jAO zif%^%qUujhtEXP_N;Af=m)SC{i*1UF91OZp%R^?Dq_q_E{e%m|Ffs(MdnDDg58FE) zz+b@_r-!S#;s;y6ta`nNG)RDT$5Wx%TEe z>so1^{VQ4}PnWguEeN`I@?7@geyy2bkDNO(y_s?%2G%1d@4BJwWJO;c<*kG*nse6N z+O7)0Zg_ARmyG1TWnUURQrb-A#tAv7uty{a&&wa%)tsOXmkQix$jO_h{#G!;w0%Vl z!Y#mYIgg7LR6o?Lz$LaW(JE%dz$@4h)t8X!{+*O5m7b!Lfc15d{9!@jw#V|0CmM5X zqSW53B`NEUwY0`O=k(7)V=vSDaBU6Ak`N&fvr2hWj(asfcKjKS&SVl@I-i};o_=>q zDWr0z^&au6MY0sR;wNnVT6aw3Ld$bSaZ^YVh)6-qJ z9cu-x9lp+_e8LXT?Iehm1`w11({IyyJ-9UDApodi&^248x|dyn@hhz2cW7x2x(W6coAYiCuijjz<=$8B_-F#sSTnx1{DE@SX7|e2jPRn^n+PH+?qJP-V~*5fN>Dy-X7-F9%+o?#q3)-2Xdl1Fx6$hxZ zS48n$O;+BM}a_C#EQ#v6D!V(`EJjFJ01YV&g^KjH~+p zxtSVsSZ&3g2K7(jy{3uMOgiKbyE4cwH7=aPOza9HDRbYZyJQzfpA$gU`3KM)>Ve^7 zB^xeu{5&=uT?stf1)s|PlJKeE;&6=`yRSPgM3;*CY%;zTD~k4D5@=<6E@ZeLokVk( z!Go;5Ob>v-C|ij|%d_s+;?9(@dny{vO(iHm18@yg*eAPQ#C|h4mu_F%|6sZ03o}tP z+?wtNw6wxkz&Xr4`M?6O@L))rc<&^B>kd^a)jC`bXmG}cA}?%AAZ~-|?n>AglOGtR zDOCFhFiJNp=q}2)J?JDV4r~A&q;6uC?YPV+>{t9ii93d+#%})7h253XO@b07jqV55 zOJFG>!i3S~fCn?yYri85!Uou*6<8X&9JPUW0<+|XkcEP86dMzC|DKS7&qxB-dXG4R zAD(FkMFS(ERRR49d;$z4=%KlQR0!BE7_pAFaIv8kyIdOqf$);pU+>SmD5bVgB|emG zD=4s6|7U?2W55;hZ>9f=_uq;1?~?hiyXn81!~e5;Z?vJ^w6%DOPyo()>v^LSc0v)< zLMyV&s$+S;%rw5ddmhv-M4cMIf&7oI&;eBq;6aZ86(xx#00hmVZ^N-*bfS`eMfWNu zCZS%_*^8}Y2F?&j1C!@MmPs@V`T~xH3>ju9qwvo>1L%0x!<{a+xO$q)S84|}OS-Z8c zokII}S|0?1Gyhvs+DCn0xf__%Gy6>iBL_k9(LoS$?18{!dmoYPD}UlY-G=Y0a#3I! zmdN;f>BJjDcpVu7O1_Yu|86_?wST40IlHHE;DE><_`ejYw8_g23tXqPu7a~X(_{G` zDU{J+s=z-m32Z7IUtYWq8xqhPSOexhPM&Q25COT!T*6eb{b}h0kDxOC8L|KXw?B#Y zAHh%VKh(1T literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/index.md b/content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/index.md new file mode 100644 index 0000000000..f16e349c72 --- /dev/null +++ b/content/en/blog/_posts/2024-08-22-cpumanager-static-policy-distributed-cpu-across-cores/index.md @@ -0,0 +1,55 @@ +--- +layout: blog +title: 'Kubernetes v1.31: New Kubernetes CPUManager Static Policy: Distribute CPUs Across Cores' +date: 2024-08-22 +slug: cpumanager-static-policy-distributed-cpu-across-cores +author: > + [Jiaxin Shan](https://github.com/Jeffwan) (Bytedance) +--- + +In Kubernetes v1.31, we are excited to introduce a significant enhancement to CPU management capabilities: the `distribute-cpus-across-cores` option for the CPUManager static policy. This feature is currently in alpha and hidden by default, marking a strategic shift aimed at optimizing CPU utilization and improving system performance across multi-core processors. + +## Understanding the Feature + + +Traditionally, Kubernetes' CPUManager tends to allocate CPUs as compactly as possible, typically packing them onto the fewest number of physical cores. However, allocation strategy matters, CPUs on the same physical host still share some resources of the physical core, such as the cache and execution units, etc. + +{{< figure src="cpu-cache-architecture.png" caption="cpu-cache-architecture" >}} + +While default approach minimizes inter-core communication and can be beneficial under certain scenarios, it also poses a challenge. CPUs sharing a physical core can lead to resource contention, which in turn may cause performance bottlenecks, particularly noticeable in CPU-intensive applications. + +The new `distribute-cpus-across-cores` feature addresses this issue by modifying the allocation strategy. When enabled, this policy option instructs the CPUManager to spread out the CPUs (hardware threads) across as many physical cores as possible. This distribution is designed to minimize contention among CPUs sharing the same physical core, potentially enhancing the performance of applications by providing them dedicated core resources. + + +Technically, within this static policy, the free CPU list is reordered in the manner depicted in the diagram, aiming to allocate CPUs from separate physical cores. + +{{< figure src="cpu-ordering.png" caption="cpu-ordering" >}} + + +## Enabling the Feature +To enable this feature, users can add `distribute-cpus-across-cores=true` to their CPUManager policy options in the Kubernetes configuration. This setting directs the CPUManager to adopt the new distribution strategy. It is important to note that this policy option cannot currently be used in conjunction with `full-pcpus-only` or `distribute-cpus-across-numa` options. + + +## Current Limitations and Future Directions + +As with any new feature, especially one in alpha, there are limitations and areas for future improvement. One significant current limitation is that `distribute-cpus-across-cores` cannot be combined with other policy options that might conflict in terms of CPU allocation strategies. This restriction can affect compatibility with certain workloads and deployment scenarios that rely on more specialized resource management. + +Looking forward, we are committed to enhancing the compatibility and functionality of the `distribute-cpus-across-cores` option. Future updates will focus on resolving these compatibility issues, allowing this policy to be combined with other CPUManager policies seamlessly. Our goal is to provide a more flexible and robust CPU allocation framework that can adapt to a variety of workloads and performance demands. + + +## Conclusion + +The introduction of the `distribute-cpus-across-cores` policy in Kubernetes CPUManager is a step forward in our ongoing efforts to refine resource management and improve application performance. By reducing the contention on physical cores, this feature offers a more balanced approach to CPU resource allocation, particularly beneficial for environments running heterogeneous workloads. We encourage Kubernetes users to test this new feature and provide feedback, which will be invaluable in shaping its future development. + +This draft aims to clearly explain the new feature while setting expectations for its current stage and future improvements. + + +## Further reading + +Please check out the [Control CPU Management Policies on the Node](/docs/tasks/administer-cluster/cpu-management-policies/) +task page to learn more about the CPU Manager, and how it fits in relation to the other node-level resource managers. + + +## Getting involved + +This feature is driven by the [SIG Node](https://github.com/Kubernetes/community/blob/master/sig-node/README.md). If you are interested in helping develop this feature, sharing feedback, or participating in any other ongoing SIG Node projects, please attend the SIG Node meeting for more details. From f9684bbf76e49e7e4ed44749ed96fcd121148312 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Mon, 19 Aug 2024 13:05:16 +0800 Subject: [PATCH 085/408] [zh-cn] sync kubeadm/* pod-failure-policy.md Signed-off-by: xin.li --- .../kubeadm/kubeadm-certs.md | 33 +++++++++++----- .../kubeadm/kubeadm-reconfigure.md | 2 +- .../kubeadm/kubeadm-upgrade.md | 38 +++++-------------- .../docs/tasks/job/pod-failure-policy.md | 35 +++++++++-------- 4 files changed, 55 insertions(+), 53 deletions(-) diff --git a/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index f9e2e3fb11..e1a04e859e 100644 --- a/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -435,18 +435,20 @@ Kubernetes 证书颁发机构不是开箱即用。你可以配置外部签名者 如果你正在创建一个新的集群，你可以使用 kubeadm -的[配置文件](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta3/)。 +的[配置文件](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta4/)。 ```yaml -apiVersion: kubeadm.k8s.io/v1beta3 +apiVersion: kubeadm.k8s.io/v1beta4 kind: ClusterConfiguration controllerManager: extraArgs: - cluster-signing-cert-file: /etc/kubernetes/pki/ca.crt - cluster-signing-key-file: /etc/kubernetes/pki/ca.key + - name: "cluster-signing-cert-file" + value: "/etc/kubernetes/pki/ca.crt" + - name: "cluster-signing-key-file" + value: "/etc/kubernetes/pki/ca.key" ``` 你要使用 [`kubeadm kubeconfig user`](/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-kubeconfig) 命令为其他用户生成 kubeconfig 文件，这个命令支持命令行参数和 -[kubeadm 配置结构](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta3/)。 +[kubeadm 配置结构](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta4/)。 以上命令会将 kubeconfig 打印到终端上，也可以使用 `kubeadm kubeconfig user ... > somefile.conf` 输出到一个文件中。 @@ -673,9 +675,22 @@ Example configuration file that can be used with `--config`: --> 如下 kubeadm 可以在 `--config` 后加的配置文件示例： + +```yaml +# example.yaml +apiVersion: kubeadm.k8s.io/v1beta4 kind: ClusterConfiguration # kubernetes 将作为 kubeconfig 中集群名称 clusterName: "kubernetes" diff --git a/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-reconfigure.md b/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-reconfigure.md index e8233742e8..8bc20709fd 100644 --- a/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-reconfigure.md +++ b/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-reconfigure.md @@ -102,7 +102,7 @@ ConfigMap 的内容时不会执行验证。 你必须小心遵循特定组件配 #### Updating the `ClusterConfiguration` During cluster creation and upgrade, kubeadm writes its -[`ClusterConfiguration`](/docs/reference/config-api/kubeadm-config.v1beta3/) +[`ClusterConfiguration`](/docs/reference/config-api/kubeadm-config.v1beta4/) in a ConfigMap called `kubeadm-config` in the `kube-system` namespace. To change a particular option in the `ClusterConfiguration` you can edit the ConfigMap with this command: diff --git a/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index bc28015fb4..e75ec21f27 100644 --- a/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -98,16 +98,18 @@ The upgrade workflow at high level is the following: - 要验证 kubelet 服务在升级后是否成功重启，可以执行 `systemctl status kubelet` 或 `journalctl -xeu kubelet` 查看服务日志。 -- 不建议使用 `kubeadm upgrade` 的 `--config` 参数和 - [kubeadm 配置 API 类型](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta3)来重新配置集群， - 这样会产生意想不到的结果。 +- `kubeadm upgrade` 支持 `--config` 和 + [`UpgradeConfiguration` API 类型](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta4) + 可用于配置升级过程。 +- `kubeadm upgrade` 不支持重新配置现有集群。 请按照[重新配置 kubeadm 集群](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-reconfigure)中的步骤来进行。 - 如果 `kubeadm upgrade plan` 给出任何需要手动升级的组件配置， - 用户必须通过 `--config` 命令行标志向 `kubeadm upgrade apply` 命令提供替代的配置文件。 - 如果不这样做，`kubeadm upgrade apply` 会出错并退出，不再执行升级操作。 - {{}} - @@ -353,23 +344,14 @@ Pick a control plane node that you wish to upgrade first. It must have the `/etc the control plane instances have been upgraded before starting to upgrade the addons. You must perform control plane instances upgrade sequentially or at least ensure that the last control plane instance upgrade is not started until all the other control plane instances have been upgraded completely, and the addons upgrade will be performed after the last - control plane instance is upgraded. If you want to keep the old upgrade behavior, please enable the `UpgradeAddonsBeforeControlPlane` - feature gate by `kubeadm upgrade apply --feature-gates=UpgradeAddonsBeforeControlPlane=true`. The Kubernetes project does - not in general recommend enabling this feature gate, you should instead change your upgrade process or cluster addons so - that you do not need to enable the legacy behavior. The `UpgradeAddonsBeforeControlPlane` feature gate will be removed in - a future release. + control plane instance is upgraded. --> 对于 v1.28 之前的版本，kubeadm 默认采用这样一种模式：在 `kubeadm upgrade apply` 期间立即升级插件（包括 CoreDNS 和 kube-proxy），而不管是否还有其他尚未升级的控制平面实例。 这可能会导致兼容性问题。从 v1.28 开始，kubeadm 默认采用这样一种模式： 在开始升级插件之前，先检查是否已经升级所有的控制平面实例。 你必须按顺序执行控制平面实例的升级，或者至少确保在所有其他控制平面实例已完成升级之前不启动最后一个控制平面实例的升级， - 并且在最后一个控制平面实例完成升级之后才执行插件的升级。如果你要保留旧的升级行为，可以通过 - `kubeadm upgrade apply --feature-gates=UpgradeAddonsBeforeControlPlane=true` 启用 - `UpgradeAddonsBeforeControlPlane` 特性门控。Kubernetes 项目通常不建议启用此特性门控， - 你应该转为更改你的升级过程或集群插件，这样你就不需要启用旧的行为。 - `UpgradeAddonsBeforeControlPlane` 特性门控将在后续的版本中被移除。 - + 并且在最后一个控制平面实例完成升级之后才执行插件的升级。 {{}} -确保[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/) -`PodDisruptionConditions` 和 `JobPodFailurePolicy` 在你的集群中均已启用。 - +在 Job 状态中，显示以下情况： +- `FailureTarget` 状况：有一个设置为 `PodFailurePolicy` 的 `reason` + 字段和一个包含更多有关终止信息的 `message` 字段，例如 + `Container main for pod default/job-pod-failure-policy-failjob-8ckj8 failed with exit code 42 matching FailJob rule at index 0`。 + 一旦 Job 被视为失败，Job 控制器就会添加此状况。有关详细信息，请参阅 + [Job Pod 的终止](/zh-cn/docs/concepts/workloads/controllers/job/#termination-of-job-pods)。 +- `Failed`：与 `FailureTarget` 状况相同的 `reason` 和 `message`。 + Job 控制器会在 Job 的所有 Pod 终止后添加此状况。 + + -在 Job 状态中，看到一个任务状况为 `Failed`，其 `reason` 字段等于 `PodFailurePolicy`。 -此外，`message` 字段包含有关 Job 终止更详细的信息，例如： -`Container main for pod default/job-pod-failure-policy-failjob-8ckj8 failed with exit code 42 matching FailJob rule at index 0`。 - 为了比较，如果 Pod 失效策略被禁用，将会让 Pod 重试 6 次，用时至少 2 分钟。 ": "username" }

+anonymous [Required]
+AnonymousAuthConfig + + +

If present --anonymous-auth must not be set

+ + @@ -245,6 +252,66 @@ configuration. If present, it will be used instead of the path to the configurat +## `AnonymousAuthCondition` {#apiserver-k8s-io-v1alpha1-AnonymousAuthCondition} + + +**Appears in:** + +- [AnonymousAuthConfig](#apiserver-k8s-io-v1alpha1-AnonymousAuthConfig) + + +

AnonymousAuthCondition describes the condition under which anonymous auth +should be enabled.

+ + + + + + + + + + + +
FieldDescription
path [Required]
+string +		 +

Path for which anonymous auth is enabled.

+
+ +## `AnonymousAuthConfig` {#apiserver-k8s-io-v1alpha1-AnonymousAuthConfig} + + +**Appears in:** + +- [AuthenticationConfiguration](#apiserver-k8s-io-v1alpha1-AuthenticationConfiguration) + + +

AnonymousAuthConfig provides the configuration for the anonymous authenticator.

+ + + + + + + + + + + + + + +
FieldDescription
enabled [Required]
+bool +		 + No description provided.
conditions [Required]
+[]AnonymousAuthCondition +		 +

If set, anonymous auth is only allowed if the request meets one of the +conditions.

+
+ ## `AudienceMatchPolicyType` {#apiserver-k8s-io-v1alpha1-AudienceMatchPolicyType} (Alias of `string`) @@ -331,7 +398,7 @@ The claim's value must be a singular string. Same as the --oidc-username-claim and --oidc-username-prefix flags. If username.expression is set, the expression must produce a string value. If username.expression uses 'claims.email', then 'claims.email_verified' must be used in -username.expression or extra[*].valueExpression or claimValidationRules[*].expression. +username.expression or extra[].valueExpression or claimValidationRules[].expression. An example claim validation rule expression that matches the validation automatically applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true)'.

In the flag based approach, the --oidc-username-claim and --oidc-username-prefix are optional. If --oidc-username-claim is not set, @@ -341,8 +408,8 @@ For prefix: (1) --oidc-username-prefix="-", no prefix was added to the username. For the same behavior using authentication config, set username.prefix="" (2) --oidc-username-prefix="" and --oidc-username-claim != "email", prefix was "<value of --oidc-issuer-url>#". For the same -behavior using authentication config, set username.prefix="<value of issuer.url>#" -(3) --oidc-username-prefix="<value>". For the same behavior using authentication config, set username.prefix="<value>"

+behavior using authentication config, set username.prefix="#" +(3) --oidc-username-prefix="". For the same behavior using authentication config, set username.prefix=""

groups
@@ -1202,4 +1269,4 @@ the contents would be converted to the v1 version before evaluating the CEL expr - + \ No newline at end of file diff --git a/content/en/docs/reference/config-api/apiserver-config.v1beta1.md b/content/en/docs/reference/config-api/apiserver-config.v1beta1.md index 88c75d3fcb..0e54df86db 100644 --- a/content/en/docs/reference/config-api/apiserver-config.v1beta1.md +++ b/content/en/docs/reference/config-api/apiserver-config.v1beta1.md @@ -95,10 +95,17 @@ JWT authenticator will attempt to cryptographically validate the token.

"iss": "https://issuer.example.com", "aud": ["audience"], "exp": 1234567890, -"<username claim>": "username" +"": "username" }

+anonymous [Required]
+AnonymousAuthConfig + + +

If present --anonymous-auth must not be set

+ + @@ -178,6 +185,66 @@ Must be at least one.

+## `AnonymousAuthCondition` {#apiserver-k8s-io-v1beta1-AnonymousAuthCondition} + + +**Appears in:** + +- [AnonymousAuthConfig](#apiserver-k8s-io-v1beta1-AnonymousAuthConfig) + + +

AnonymousAuthCondition describes the condition under which anonymous auth +should be enabled.

+ + + + + + + + + + + +
FieldDescription
path [Required]
+string +		 +

Path for which anonymous auth is enabled.

+
+ +## `AnonymousAuthConfig` {#apiserver-k8s-io-v1beta1-AnonymousAuthConfig} + + +**Appears in:** + +- [AuthenticationConfiguration](#apiserver-k8s-io-v1beta1-AuthenticationConfiguration) + + +

AnonymousAuthConfig provides the configuration for the anonymous authenticator.

+ + + + + + + + + + + + + + +
FieldDescription
enabled [Required]
+bool +		 + No description provided.
conditions [Required]
+[]AnonymousAuthCondition +		 +

If set, anonymous auth is only allowed if the request meets one of the +conditions.

+
+ ## `AudienceMatchPolicyType` {#apiserver-k8s-io-v1beta1-AudienceMatchPolicyType} (Alias of `string`) @@ -264,7 +331,7 @@ The claim's value must be a singular string. Same as the --oidc-username-claim and --oidc-username-prefix flags. If username.expression is set, the expression must produce a string value. If username.expression uses 'claims.email', then 'claims.email_verified' must be used in -username.expression or extra[*].valueExpression or claimValidationRules[*].expression. +username.expression or extra[].valueExpression or claimValidationRules[].expression. An example claim validation rule expression that matches the validation automatically applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true)'.

In the flag based approach, the --oidc-username-claim and --oidc-username-prefix are optional. If --oidc-username-claim is not set, @@ -274,8 +341,8 @@ For prefix: (1) --oidc-username-prefix="-", no prefix was added to the username. For the same behavior using authentication config, set username.prefix="" (2) --oidc-username-prefix="" and --oidc-username-claim != "email", prefix was "<value of --oidc-issuer-url>#". For the same -behavior using authentication config, set username.prefix="<value of issuer.url>#" -(3) --oidc-username-prefix="<value>". For the same behavior using authentication config, set username.prefix="<value>"

+behavior using authentication config, set username.prefix="#" +(3) --oidc-username-prefix="". For the same behavior using authentication config, set username.prefix=""

groups
@@ -1135,4 +1202,4 @@ the contents would be converted to the v1 version before evaluating the CEL expr - + \ No newline at end of file diff --git a/content/en/docs/reference/config-api/client-authentication.v1.md b/content/en/docs/reference/config-api/client-authentication.v1.md index 5b0f460be5..6e31f697e5 100644 --- a/content/en/docs/reference/config-api/client-authentication.v1.md +++ b/content/en/docs/reference/config-api/client-authentication.v1.md @@ -205,7 +205,7 @@ itself should at least be protected via file permissions.

expirationTimestamp
-meta/v1.Time +meta/v1.Time

ExpirationTimestamp indicates a time when the provided credentials expire.

diff --git a/content/en/docs/reference/config-api/client-authentication.v1beta1.md b/content/en/docs/reference/config-api/client-authentication.v1beta1.md index e787539df7..542dd4acc7 100644 --- a/content/en/docs/reference/config-api/client-authentication.v1beta1.md +++ b/content/en/docs/reference/config-api/client-authentication.v1beta1.md @@ -205,7 +205,7 @@ itself should at least be protected via file permissions.

expirationTimestamp
-meta/v1.Time +meta/v1.Time

ExpirationTimestamp indicates a time when the provided credentials expire.

diff --git a/content/en/docs/reference/config-api/imagepolicy.v1alpha1.md b/content/en/docs/reference/config-api/imagepolicy.v1alpha1.md index c93f3bcb4a..136e562047 100644 --- a/content/en/docs/reference/config-api/imagepolicy.v1alpha1.md +++ b/content/en/docs/reference/config-api/imagepolicy.v1alpha1.md @@ -28,7 +28,7 @@ auto_generated: true metadata
-meta/v1.ObjectMeta +meta/v1.ObjectMeta

Standard object's metadata. diff --git a/content/en/docs/reference/config-api/kube-controller-manager-config.v1alpha1.md b/content/en/docs/reference/config-api/kube-controller-manager-config.v1alpha1.md index 6988671969..2cb2ddc94d 100644 --- a/content/en/docs/reference/config-api/kube-controller-manager-config.v1alpha1.md +++ b/content/en/docs/reference/config-api/kube-controller-manager-config.v1alpha1.md @@ -1256,13 +1256,6 @@ Larger number = more responsive HPA processing, but more CPU (and network) load. pods in horizontal pod autoscaler.

-HorizontalPodAutoscalerUpscaleForbiddenWindow [Required]
-meta/v1.Duration - - -

HorizontalPodAutoscalerUpscaleForbiddenWindow is a period after which next upscale allowed.

- - HorizontalPodAutoscalerDownscaleStabilizationWindow [Required]
meta/v1.Duration @@ -1271,13 +1264,6 @@ pods in horizontal pod autoscaler.

backwards and not scale down below any recommendation it made during that period.

-HorizontalPodAutoscalerDownscaleForbiddenWindow [Required]
-meta/v1.Duration - - -

HorizontalPodAutoscalerDownscaleForbiddenWindow is a period after which next downscale allowed.

- - HorizontalPodAutoscalerTolerance [Required]
float64 @@ -1556,22 +1542,6 @@ and persistent volume claims.

volumeConfiguration holds configuration for volume related features.

-VolumeHostCIDRDenylist [Required]
-[]string - - -

DEPRECATED: VolumeHostCIDRDenylist is a list of CIDRs that should not be reachable by the -controller from plugins.

- - -VolumeHostAllowLocalLoopback [Required]
-bool - - -

DEPRECATED: VolumeHostAllowLocalLoopback indicates if local loopback hosts (127.0.0.1, etc) -should be allowed from plugins.

- - diff --git a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md index e6a03cc7f0..a560024adc 100644 --- a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md +++ b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md @@ -336,7 +336,7 @@ Profiling handlers will be handled by metrics server.

LocalMode -

detectLocalMode determines mode to use for detecting local traffic, defaults to LocalModeClusterCIDR

+

detectLocalMode determines mode to use for detecting local traffic, defaults to ClusterCIDR

detectLocal [Required]
@@ -352,7 +352,7 @@ Profiling handlers will be handled by metrics server.

clusterCIDR is the CIDR range of the pods in the cluster. (For dual-stack clusters, this can be a comma-separated dual-stack pair of CIDR ranges.). When -DetectLocalMode is set to LocalModeClusterCIDR, kube-proxy will consider +DetectLocalMode is set to ClusterCIDR, kube-proxy will consider traffic to be local if its source IP is in this range. (Otherwise it is not used.)

@@ -361,10 +361,12 @@ used.)

[]string -

nodePortAddresses is a list of CIDR ranges that contain valid node IPs. If set, +

nodePortAddresses is a list of CIDR ranges that contain valid node IPs, or +alternatively, the single string 'primary'. If set to a list of CIDRs, connections to NodePort services will only be accepted on node IPs in one of -the indicated ranges. If unset, NodePort connections will be accepted on all -local IPs.

+the indicated ranges. If set to 'primary', NodePort services will only be +accepted on the node's primary IPv4 and/or IPv6 address according to the Node +object. If unset, NodePort connections will be accepted on all local IPs.

oomScoreAdj [Required]
@@ -397,6 +399,13 @@ than 0.

portRange was previously used to configure the userspace proxy, but is now unused.

+windowsRunAsService [Required]
+bool + + +

windowsRunAsService, if true, enables Windows service control manager API integration.

+ + diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1.md index 428f43f43d..5f6cd2e1a6 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-config.v1.md +++ b/content/en/docs/reference/config-api/kube-scheduler-config.v1.md @@ -328,7 +328,7 @@ at least "minFeasibleNodesToFind" feasible nodes no matter what the va Example: if the cluster size is 500 nodes and the value of this flag is 30, then scheduler stops finding further feasible nodes once it finds 150 feasible ones. When the value is 0, default percentage (5%--50% based on the size of the cluster) of the -nodes will be scored. It is overridden by profile level PercentageofNodesToScore.

+nodes will be scored. It is overridden by profile level PercentageOfNodesToScore.

podInitialBackoffSeconds [Required]
@@ -396,7 +396,7 @@ Defaults to false.

addedAffinity
-core/v1.NodeAffinity +core/v1.NodeAffinity

AddedAffinity is applied to all Pods additionally to the NodeAffinity @@ -495,7 +495,7 @@ The default strategy is LeastAllocated with an equal "cpu" and "m defaultConstraints
-[]core/v1.TopologySpreadConstraint +[]core/v1.TopologySpreadConstraint

DefaultConstraints defines topology spread constraints to be applied to diff --git a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md index 2bca31da93..86531a85a8 100644 --- a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md +++ b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md @@ -11,17 +11,17 @@ This version improves on the v1beta2 format by fixing some minor issues and addi

-
-

connectCoreV1PatchNamespacedPodProxyWithPath

-

connect PATCH requests to proxy of Pod

-

HTTP Request

-

PATCH /api/v1/namespaces/{namespace}/pods/{name}/proxy/{path}

-

Path Parameters

- - - - - - - -
ParameterDescription
namename of the PodProxyOptions
namespaceobject name and auth scope, such as for teams and projects
pathpath to the resource
-

Query Parameters

- - - - - -
ParameterDescription
pathPath is the URL path to use for the current proxy request to pod.
-

Response

- - - - - -
CodeDescription
200
string		OK
-
-
-

connectCoreV1PatchNamespacedServiceProxy

-

connect PATCH requests to proxy of Service

-

HTTP Request

-

PATCH /api/v1/namespaces/{namespace}/services/{name}/proxy

-

Path Parameters

- - - - - - -
ParameterDescription
namename of the ServiceProxyOptions
namespaceobject name and auth scope, such as for teams and projects
-

Query Parameters

- - - - - -
ParameterDescription
pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
-

Response

- - - - - -
CodeDescription
200
string		OK
-
-
-

connectCoreV1PatchNamespacedServiceProxyWithPath

-

connect PATCH requests to proxy of Service

-

HTTP Request

-

PATCH /api/v1/namespaces/{namespace}/services/{name}/proxy/{path}

-

Path Parameters

- - - - - - - -
ParameterDescription
namename of the ServiceProxyOptions
namespaceobject name and auth scope, such as for teams and projects
pathpath to the resource
-

Query Parameters

- - - - - -
ParameterDescription
pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
-

Response

- - - - - -
CodeDescription
200
string		OK
-
-
-

connectCoreV1PatchNodeProxy

-

connect PATCH requests to proxy of Node

-

HTTP Request

-

PATCH /api/v1/nodes/{name}/proxy

-

Path Parameters

- - - - - -
ParameterDescription
namename of the NodeProxyOptions
-

Query Parameters

- - - - - -
ParameterDescription
pathPath is the URL path to use for the current proxy request to node.
-

Response

- - - - - -
CodeDescription
200
string		OK
-
-
-

connectCoreV1PatchNodeProxyWithPath

-

connect PATCH requests to proxy of Node

-

HTTP Request

-

PATCH /api/v1/nodes/{name}/proxy/{path}

-

Path Parameters

- - - - - - -
ParameterDescription
namename of the NodeProxyOptions
pathpath to the resource
-

Query Parameters

- - - - - -
ParameterDescription
pathPath is the URL path to use for the current proxy request to node.
-

Response

- - - - - -
CodeDescription
200
string		OK
-
-
-

createCoreV1NamespacedPodBinding

-

create binding of a Pod

-

HTTP Request

-

POST /api/v1/namespaces/{namespace}/pods/{name}/binding

-

Path Parameters

- - - - - - -
ParameterDescription
namename of the Binding
namespaceobject name and auth scope, such as for teams and projects
-

Query Parameters

- - - - - - - - -
ParameterDescription
dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
fieldValidationfieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.
prettyIf 'true', then the output is pretty printed. Defaults to 'false' unless the user-agent indicates a browser or command-line HTTP tool (curl and wget).
-

Body Parameters

- - - - - -
ParameterDescription
body
Binding
-

Response

- - - - - - - -
CodeDescription
200
Binding		OK
201
Binding		Created
202
Binding		Accepted
-
-
-

getCodeVersion

-

get the code version

-

HTTP Request

-

GET /version/

-

Response

- - - - - -
CodeDescription
200OK
-
-
-

getServiceAccountIssuerOpenIDConfiguration

-

get service account issuer OpenID configuration, also known as the 'OIDC discovery doc'

-

HTTP Request

-

GET /.well-known/openid-configuration/

-

Response

- - - - - -
CodeDescription
200
string		OK
-
-
-

getServiceAccountIssuerOpenIDKeyset

-

get service account issuer OpenID JSON Web Key Set (contains public token verification keys)

-

HTTP Request

-

GET /openid/v1/jwks/

-

Response

- - - - - -
CodeDescription
200
string		OK
-
-
-

logFileHandler

-

-

HTTP Request

-

GET /logs/{logpath}

-

Path Parameters

- - - - - -
ParameterDescription
logpathpath to the log
-
-
-

logFileListHandler

-

-

HTTP Request

-

GET /logs/

-
-
-

certificatesigningrequests v1 certificates.k8s.io

-

partially update approval of the specified CertificateSigningRequest

-

HTTP Request

-

PATCH /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/approval

-

Path Parameters

- - - - - -
ParameterDescription
namename of the CertificateSigningRequest
-

Query Parameters

- - - - - - - - - -
ParameterDescription
prettyIf 'true', then the output is pretty printed. Defaults to 'false' unless the user-agent indicates a browser or command-line HTTP tool (curl and wget).
dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
fieldValidationfieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.
forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
-

Body Parameters

- - - - - -
ParameterDescription
body
Patch
-

Response

- - - - - - -
CodeDescription
200
CertificateSigningRequest		OK
201
CertificateSigningRequest		Created
-
-
-

certificatesigningrequests v1 certificates.k8s.io

-

read approval of the specified CertificateSigningRequest

-

HTTP Request

-

GET /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/approval

-

Path Parameters

- - - - - -
ParameterDescription
namename of the CertificateSigningRequest
-

Query Parameters

- - - - - -
ParameterDescription
prettyIf 'true', then the output is pretty printed. Defaults to 'false' unless the user-agent indicates a browser or command-line HTTP tool (curl and wget).
-

Response

- - - - - -
CodeDescription
200
CertificateSigningRequest		OK
-
-
-

certificatesigningrequests v1 certificates.k8s.io

-

replace approval of the specified CertificateSigningRequest

-

HTTP Request

-

PUT /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/approval

-

Path Parameters

- - - - - -
ParameterDescription
namename of the CertificateSigningRequest
-

Query Parameters

- - - - - - - - -
ParameterDescription
prettyIf 'true', then the output is pretty printed. Defaults to 'false' unless the user-agent indicates a browser or command-line HTTP tool (curl and wget).
dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
fieldValidationfieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.
-

Body Parameters

- - - - - -
ParameterDescription
body
CertificateSigningRequest
-

Response

- - - - - - -
CodeDescription
200
CertificateSigningRequest		OK
201
CertificateSigningRequest		Created
-
-
-

replaceCoreV1NamespaceFinalize

-

replace finalize of the specified Namespace

-

HTTP Request

-

PUT /api/v1/namespaces/{name}/finalize

-

Path Parameters

- - - - - -
ParameterDescription
namename of the Namespace
-

Query Parameters

- - - - - - - - -
ParameterDescription
dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
fieldValidationfieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.
prettyIf 'true', then the output is pretty printed. Defaults to 'false' unless the user-agent indicates a browser or command-line HTTP tool (curl and wget).
-

Body Parameters

- - - - - -
ParameterDescription
body
Namespace
-

Response

- - - - - - -
CodeDescription
200
Namespace		OK
201
Namespace		Created
-

Definitions

@@ -41936,6 +41474,11 @@ The contents of the target ConfigMap's Data field will be presented in a vol

DeviceAttribute must have exactly one field set.

+
Appears In: + +
@@ -46355,11 +45898,23 @@ Non-canonical values will still parse as long as they are well formed, but will This format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.

Appears In:
FieldDescription
@@ -47933,6 +47488,7 @@ The contents of the target Secret's Data field will be presented in a volume
  • PersistentVolumeClaimCondition [core/v1]
  • PersistentVolumeStatus [core/v1]
  • PodCondition [core/v1]
    • +
  • PodDisruptionBudgetStatus [policy/v1]
  • PodStatus [core/v1]
  • PriorityLevelConfigurationCondition [flowcontrol/v1]
  • PriorityLevelConfigurationCondition [flowcontrol/v1beta3]
    • From 87aa172179aa05be724a5c5dfc445ec4e7b46a57 Mon Sep 17 00:00:00 2001 From: "Kohei Ota (inductor)" Date: Thu, 22 Aug 2024 02:05:03 +0900 Subject: [PATCH 130/408] [ja] Translate docs/tasks/administer-cluster/cluster-upgrade.md (#47361) * translate docs/tasks/administer-cluster/cluster-upgrade.md * fix translation * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: nasa9084 * Update content/ja/docs/tasks/administer-cluster/cluster-upgrade.md Co-authored-by: nasa9084 --------- Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> Co-authored-by: nasa9084 --- .../administer-cluster/cluster-upgrade.md | 83 +++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 content/ja/docs/tasks/administer-cluster/cluster-upgrade.md diff --git a/content/ja/docs/tasks/administer-cluster/cluster-upgrade.md b/content/ja/docs/tasks/administer-cluster/cluster-upgrade.md new file mode 100644 index 0000000000..a5b057e276 --- /dev/null +++ b/content/ja/docs/tasks/administer-cluster/cluster-upgrade.md @@ -0,0 +1,83 @@ +--- +title: クラスターのアップグレード +content_type: task +weight: 350 +--- + + +このページでは、Kubernetesクラスターをアップグレードする際に従うべき手順の概要を提供します。 + +クラスターのアップグレード方法は、初期のデプロイ方法やその後の変更によって異なります。 + +大まかな手順は以下の通りです: + +- {{< glossary_tooltip text="コントロールプレーン" term_id="control-plane" >}}のアップグレード +- クラスター内にあるノードのアップグレード +- {{< glossary_tooltip text="kubectl" term_id="kubectl" >}}など、クライアントのアップグレード +- 新しいKubernetesバージョンに伴うAPI変更に基づいたマニフェストやその他のリソースの調整 + +## {{% heading "prerequisites" %}} + +既存のクラスターが必要です。このページではKubernetes {{< skew currentVersionAddMinor -1 >}}からKubernetes {{< skew currentVersion >}}へのアップグレードについて説明しています。現在のクラスターがKubernetes {{< skew currentVersionAddMinor -1 >}}を実行していない場合は、アップグレードしようとしているKubernetesバージョンのドキュメントを確認してください。 + +## アップグレード方法 + +### kubeadm {#upgrade-kubeadm} + +クラスターが`kubeadm`ツールを使用してデプロイされた場合の詳細なアップグレード方法は、[kubeadmクラスターのアップグレード](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/)を参照してください。 + +クラスターをアップグレードしたら、忘れずに[最新バージョンの`kubectl`をインストール](/docs/tasks/tools/)してください。 + +### 手動デプロイ + +{{< caution >}} +これらの手順は、ネットワークおよびストレージプラグインなどのサードパーティ製拡張機能には対応していません。 +{{< /caution >}} + +次の順序でコントロールプレーンを手動で更新する必要があります: + +- etcd(すべてのインスタンス) +- kube-apiserver(すべてのコントロールプレーンホスト) +- kube-controller-manager +- kube-scheduler +- クラウドコントローラーマネージャー(使用している場合) + +この時点で、[最新バージョンの`kubectl`をインストール](/docs/tasks/tools/)してください。 + +クラスター内の各ノードに対して、そのノードを[ドレイン](/docs/tasks/administer-cluster/safely-drain-node/)し、{{< skew currentVersion >}} kubeletを使用する新しいノードと置き換えるか、そのノードのkubeletをアップグレードして再稼働させます。 + +{{< caution >}} +kubeletをアップグレードする前にノードをドレインすることで、Podが再収容され、コンテナが再作成されるため、一部のセキュリティ問題や重要なバグの解決が必要な場合があります。 +{{}} + +### その他のデプロイ {#upgrade-other} + +クラスターデプロイメントツールのドキュメントを参照して、メンテナンスの推奨手順を確認してください。 + +## アップグレード後のタスク + +### クラスターのストレージAPIバージョンを切り替える + +クラスターの内部表現でアクティブなKubernetesリソースのためにetcdにシリアル化されるオブジェクトは、特定のAPIバージョンを使用して書き込まれます。 + +サポートされるAPIが変更されると、これらのオブジェクトは新しいAPIで再書き込みする必要があります。これを行わないと、最終的にはKubernetes APIサーバーによってデコードまたは使用できなくなるリソースが発生する可能性があります。 + +影響を受ける各オブジェクトについて、最新のサポートされるAPIを使用して取得し、最新のサポートされるAPIを使用して再書き込みします。 + +### マニフェストの更新 + +新しいKubernetesバージョンへのアップグレードにより、新しいAPIが提供されることがあります。 + +異なるAPIバージョン間でマニフェストを変換するために`kubectl convert`コマンドを使用できます。例えば: + +```shell +kubectl convert -f pod.yaml --output-version v1 +``` + +`kubectl`ツールは`pod.yaml`の内容を、`kind`がPod(変更なし)で、`apiVersion`が改訂されたマニフェストに置き換えます。 + +### デバイスプラグイン + +クラスターがデバイスプラグインを実行しており、ノードを新しいデバイスプラグインAPIバージョンを含むKubernetesリリースにアップグレードする必要がある場合、デバイスプラグインをアップグレードして両方のバージョンをサポートする必要があります。これにより、アップグレード中にデバイスの割り当てが正常に完了し続けることが保証されます。 + +詳細については、[API互換性](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/#api-compatibility)および[kubeletのデバイスマネージャーAPIバージョン](/docs/reference/node/device-plugin-api-versions/)を参照してください。 From d658d29b1ae12875c5a371b8dd882aadb81a0a54 Mon Sep 17 00:00:00 2001 From: Matteo Bianchi <37507190+mbianchidev@users.noreply.github.com> Date: Wed, 21 Aug 2024 22:36:23 +0200 Subject: [PATCH 131/408] Update node version to latest LTS Updated netlify.toml, Node 2.11.0 -> Node 2.17.0 --- netlify.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/netlify.toml b/netlify.toml index c0cdfd8f98..b7fc6f1286 100644 --- a/netlify.toml +++ b/netlify.toml @@ -7,7 +7,7 @@ functions = "functions" command = "git submodule update --init --recursive --depth 1 && make non-production-build && npx -y pagefind --site public" [build.environment] -NODE_VERSION = "20.11.0" +NODE_VERSION = "20.17.0" HUGO_VERSION = "0.121.2" [context.production.environment] From f1641bdf94a845f973782e31ab60818aa9958edf Mon Sep 17 00:00:00 2001 From: Arhell Date: Thu, 22 Aug 2024 00:21:51 +0300 Subject: [PATCH 132/408] [ja] Fix broken hyperlink --- content/ja/docs/contribute/participate/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/contribute/participate/_index.md b/content/ja/docs/contribute/participate/_index.md index a6ee9c8eeb..1b3457b346 100644 --- a/content/ja/docs/contribute/participate/_index.md +++ b/content/ja/docs/contribute/participate/_index.md @@ -62,7 +62,7 @@ ProwチームとGitHub teamsが完全に一致せずに重複する場合があ Kubernetesプロジェクトは、GitHubのissueとPull Requestに関連する自動化のためにprowと呼ばれる自動化ツールを使用します。 [Kubernetes Webサイトリポジトリ](https://github.com/kubernetes/website) -は、2つの[prowプラグイン](https://github.com/kubernetes/test-infra/tree/master/prow/plugins)を使用します： +は、2つの[prowプラグイン](https://github.com/kubernetes-sigs/prow/tree/main/pkg/plugins)を使用します： - blunderbuss - approve From a0ede947a2593e8de98bd8d6a14b225c44c455be Mon Sep 17 00:00:00 2001 From: Andrii Holovin Date: Wed, 21 Aug 2024 23:43:48 +0300 Subject: [PATCH 133/408] refactor: the link processing logic has been redefined depends on: https://github.com/kubernetes/website/pull/47612 --- layouts/_default/_markup/render-link.html | 53 +++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 layouts/_default/_markup/render-link.html diff --git a/layouts/_default/_markup/render-link.html b/layouts/_default/_markup/render-link.html new file mode 100644 index 0000000000..a420c62049 --- /dev/null +++ b/layouts/_default/_markup/render-link.html @@ -0,0 +1,53 @@ +{{- $u := urls.Parse .Destination -}} +{{- $href := $u.String -}} +{{- $langCode := .Page.Site.Language.Lang -}} + +{{- if strings.HasPrefix $u.String "#" }} + {{- /* Anchor link in the document, leave unchanged */ -}} + +{{- else if $u.IsAbs -}} + {{- /* External link, leave unchanged */ -}} + +{{- else if strings.HasPrefix $u.Path (printf "/%s/" $langCode) -}} + {{- /* Internal link in the current language, leave unchanged */ -}} + +{{- else if strings.HasPrefix $u.Path "/" -}} + {{- $localizedPath := printf "/%s%s" $langCode $u.Path -}} + {{- with or + (.Page.GetPage $localizedPath) + (.Page.Resources.Get $localizedPath) + (resources.Get $localizedPath) + -}} + {{- $href = .RelPermalink -}} + {{- else -}} + {{- $path := strings.TrimPrefix "./" $u.Path }} + {{- with or + (.Page.GetPage $path) + (.Page.Resources.Get $path) + (resources.Get $path) + -}} + {{- $href = .RelPermalink -}} + {{- end -}} + {{- end -}} + + {{- if and $u.RawQuery (not (strings.Contains $href "?")) -}} + {{- $href = printf "%s?%s" $href $u.RawQuery -}} + {{- end -}} + {{- if and $u.Fragment (not (strings.Contains $href "#")) -}} + {{- $href = printf "%s#%s" $href $u.Fragment -}} + {{- end -}} + +{{- else -}} + {{- /* Other internal links, leave unchanged */ -}} + +{{- end -}} + +{{- $attributes := dict "href" $href "title" (.Title | transform.HTMLEscape) -}} +{{ .Text | safeHTML }} +{{- /**/ -}} \ No newline at end of file From 8dddc5b515a945cc57c2a3677c92f01ea9bd638f Mon Sep 17 00:00:00 2001 From: windsonsea Date: Thu, 22 Aug 2024 09:19:17 +0800 Subject: [PATCH 134/408] [zh] Sync kubectl_config/* files --- .../generated/kubectl_config/_index.md | 24 ------------------- .../kubectl_config_current-context.md | 24 ------------------- .../kubectl_config_delete-cluster.md | 24 ------------------- .../kubectl_config_delete-context.md | 24 ------------------- .../kubectl_config_delete-user.md | 24 ------------------- 5 files changed, 120 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/_index.md index d54d2ba972..4d826ee0a8 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/_index.md @@ -169,30 +169,6 @@ TLS 客户端密钥文件的路径。

    -     - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_current-context.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_current-context.md index 78d88b50c1..a24eae71d1 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_current-context.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_current-context.md @@ -150,30 +150,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-cluster.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-cluster.md index 771c4dafd0..94d5b3dbaa 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-cluster.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-cluster.md @@ -149,30 +149,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-context.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-context.md index 063860326f..58ca226f6a 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-context.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-context.md @@ -149,30 +149,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-user.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-user.md index 6ec5f2abe6..6e6a3a83c6 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-user.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_delete-user.md @@ -149,30 +149,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From caba235cc3b515e20f55096f355d13503b96fd51 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Wed, 21 Aug 2024 16:34:30 +0800 Subject: [PATCH 135/408] [zh] Add zh text to: access-authn-authz/webhook.md --- .../reference/access-authn-authz/webhook.md | 87 +++++++++++++++---- .../feature-gates/authorize-with-selectors.md | 28 ++++++ 2 files changed, 98 insertions(+), 17 deletions(-) create mode 100644 content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/authorize-with-selectors.md diff --git a/content/zh-cn/docs/reference/access-authn-authz/webhook.md b/content/zh-cn/docs/reference/access-authn-authz/webhook.md index b04b7d2782..96603376b9 100644 --- a/content/zh-cn/docs/reference/access-authn-authz/webhook.md +++ b/content/zh-cn/docs/reference/access-authn-authz/webhook.md @@ -22,7 +22,6 @@ A WebHook is an HTTP callback: an HTTP POST that occurs when something happens; WebHook 是一种 HTTP 回调：某些条件下触发的 HTTP POST 请求；通过 HTTP POST 发送的简单事件通知。一个基于 web 应用实现的 WebHook 会在特定事件发生时把消息发送给特定的 URL。 - 配置文件的格式使用 [kubeconfig](/zh-cn/docs/tasks/access-application-cluster/configure-access-multiple-clusters/)。 -在该文件中，“users” 代表着 API 服务器的 webhook，而 “cluster” 代表着远程服务。 +在该文件中，“users” 代表着 API 服务器的 Webhook，而 “cluster” 代表着远程服务。 -期待远程服务填充请求的 `status` 字段并响应允许或禁止访问。响应主体的 `spec` 字段被忽略，可以省略。允许的响应将返回: +期待远程服务填充请求的 `status` 字段并响应允许或禁止访问。 +响应主体的 `spec` 字段被忽略，可以省略。允许的响应将返回： ```json { @@ -199,8 +200,9 @@ authorizers are configured, they are given a chance to allow the request. If there are no other authorizers, or none of them allow the request, the request is forbidden. The webhook would return: --> -在大多数情况下，第一种方法是首选方法，它指示授权 webhook 不允许或对请求 “无意见”。 -但是，如果配置了其他授权者，则可以给他们机会允许请求。如果没有其他授权者，或者没有一个授权者，则该请求被禁止。webhook 将返回： +在大多数情况下，第一种方法是首选方法，它指示授权 Webhook 不允许或对请求 “无意见”。 +但是，如果配置了其他授权者，则可以给他们机会允许请求。 +如果没有其他授权者，或者没有一个授权者，则该请求被禁止。Webhook 将返回： ```json { @@ -219,7 +221,8 @@ configured authorizers. This should only be used by webhooks that have detailed knowledge of the full authorizer configuration of the cluster. The webhook would return: --> -第二种方法立即拒绝其他配置的授权者进行短路评估。仅应由对集群的完整授权者配置有详细了解的 webhook 使用。webhook 将返回： +第二种方法立即拒绝其他配置的授权者进行短路评估。 +仅应由对集群的完整授权者配置有详细了解的 Webhook 使用。Webhook 将返回： ```json { @@ -256,6 +259,54 @@ Access to non-resource paths are sent as: } ``` +{{< feature-state feature_gate_name="AuthorizeWithSelectors" >}} + + +启用 `AuthorizeWithSelectors` 特性后，请求中的字段和标签选择算符将被传递给授权 Webhook。 +此 Webhook 可以根据作用域字段和标签选择算符做出授权决策（如果它愿意的话）。 + + +[SubjectAccessReview API 文档](/zh-cn/docs/reference/kubernetes-api/authorization-resources/subject-access-review-v1/)提供了这些字段应如何被授权 +Webhook 解释和处理的指南，特别是应使用解析后的要求而不是原始选择算符字符串，以及如何安全地处理未识别的操作符。 + +```json +{ + "apiVersion": "authorization.k8s.io/v1beta1", + "kind": "SubjectAccessReview", + "spec": { + "resourceAttributes": { + "verb": "list", + "group": "", + "resource": "pods", + "fieldSelector": { + "requirements": [ + {"key":"spec.nodeName", "operator":"In", "values":["mynode"]} + ] + }, + "labelSelector": { + "requirements": [ + {"key":"example.com/mykey", "operator":"In", "values":["myvalue"]} + ] + } + }, + "user": "jane", + "group": [ + "group1", + "group2" + ] + } +} +``` + -更多信息可以参考 authorization.v1beta1 API 对象和 -[webhook.go](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go)。 - +更多信息请参阅 +[SubjectAccessReview API 文档](/zh-cn/docs/reference/kubernetes-api/authorization-resources/subject-access-review-v1/)和 +[webhook.go 实现](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/plugin/pkg/authorizer/webhook/webhook.go)。 diff --git a/content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/authorize-with-selectors.md b/content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/authorize-with-selectors.md new file mode 100644 index 0000000000..efb5088421 --- /dev/null +++ b/content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/authorize-with-selectors.md @@ -0,0 +1,28 @@ +--- +title: AuthorizeWithSelectors +content_type: feature_gate +_build: + list: never + render: false + +stages: + - stage: alpha + defaultValue: false + fromVersion: "1.31" +--- + + +允许授权使用字段和标签选择算符。 +启用 [SubjectAccessReview API](/zh-cn/docs/reference/kubernetes-api/authorization-resources/subject-access-review-v1/) +中的 `fieldSelector` 和 `labelSelector` 字段， +将字段和标签选择算符信息传递给[授权 Webhook](/zh-cn/docs/reference/access-authn-authz/webhook/)， +启用[授权程序 CEL 库](https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#AuthzSelectors)中的 +`fieldSelector` 和 `labelSelector` 特性， +并允许在[授权 Webhook `matchConditions`](/zh-cn/docs/reference/access-authn-authz/authorization/#using-configuration-file-for-authorization) +中检查 `fieldSelector` 和 `labelSelector` 字段。 From cb2d70f064147ff02368f57f460d125cdd2560fb Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Thu, 15 Aug 2024 19:24:51 +0800 Subject: [PATCH 136/408] [zh-cn] Add blog: 2024-06-21-custom-profiling-kubectl-debug.md Signed-off-by: xin.li --- ...24-06-21-custom-profiling-kubectl-debug.md | 160 ++++++++++++++++++ 1 file changed, 160 insertions(+) create mode 100644 content/zh-cn/blog/_posts/2024-06-21-custom-profiling-kubectl-debug.md diff --git a/content/zh-cn/blog/_posts/2024-06-21-custom-profiling-kubectl-debug.md b/content/zh-cn/blog/_posts/2024-06-21-custom-profiling-kubectl-debug.md new file mode 100644 index 0000000000..ca14407b36 --- /dev/null +++ b/content/zh-cn/blog/_posts/2024-06-21-custom-profiling-kubectl-debug.md @@ -0,0 +1,160 @@ +--- +layout: blog +title: "Kubernetes 1.31：kubectl debug 中的自定义模板化配置特性已进入 Beta 阶段" +date: 2024-08-22 +slug: kubernetes-1-31-custom-profiling-kubectl-debug +author: > + Arda Güçlü (Red Hat) +translator: > + Xin Li (DaoCloud) +--- + + + +有很多方法可以对集群中的 Pod 和节点进行故障排查，而 `kubectl debug` 是最简单、使用最广泛、最突出的方法之一。 +它提供了一组静态配置，每个配置适用于不同类型的角色。 +例如，从网络管理员的视角来看，调试节点应该像这样简单： + +```shell +$ kubectl debug node/mynode -it --image=busybox --profile=netadmin +``` + + +另一方面，静态配置也存在固有的刚性，对某些 Pod 所产生的影响与其易用性是相悖的。 +因为各种类型的 Pod（或节点）都有其特定的需求，不幸的是，有些问题仅通过静态配置是无法调试的。 + +以一个简单的 Pod 为例，此 Pod 由一个容器组成，其健康状况依赖于环境变量： + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: example-pod +spec: + containers: + - name: example-container + image: customapp:latest + env: + - name: REQUIRED_ENV_VAR + value: "value1" +``` + + +目前，复制 Pod 是使用 `kubectl debug` 命令调试此 Pod 的唯一机制。 +此外，如果用户需要将 `REQUIRED_ENV_VAR` 环境变量修改为其他不同值来进行高级故障排查， +当前并没有机制能够实现这一需求。 + + +## 自定义模板化配置 + +自定义模板化配置使用 `--custom` 标志提供的一项新特性，在 `kubectl debug` 中引入以提供可扩展性。 +它需要以 YAML 或 JSON 格式的内容填充 `container` 规约， +为了通过创建临时容器来调试上面的示例容器，我们只需定义此 YAML： + +```yaml +# partial_container.yaml +env: + - name: REQUIRED_ENV_VAR + value: value2 +``` + + +并且执行： + +```shell +kubectl debug example-pod -it --image=customapp --custom=partial_container.yaml +``` + + +下面是另一个在 JSON 中一次修改多个字段（更改端口号、添加资源限制、修改环境变量）的示例： + +```json +{ + "ports": [ + { + "containerPort": 80 + } + ], + "resources": { + "limits": { + "cpu": "0.5", + "memory": "512Mi" + }, + "requests": { + "cpu": "0.2", + "memory": "256Mi" + } + }, + "env": [ + { + "name": "REQUIRED_ENV_VAR", + "value": "value2" + } + ] +} +``` + + +## 约束 + +不受控制的扩展性会损害可用性。因此，某些字段（例如命令、镜像、生命周期、卷设备和容器名称）不允许进行自定义模版化配置。 +将来如果需要，可以将更多字段添加到禁止列表中。 + + +## 限制 + +`kubectl debug` 命令有 3 个方面：使用临时容器进行调试、Pod 复制和节点调试。 +这些方面最大的交集是 Pod 内的容器规约，因此自定义模版化配置仅支持修改使用 `containers` 下定义的字段。 +这导致了一个限制，如果用户需要修改 Pod 规约中的其他字段，则不受支持。 + + +## 致谢 + +特别感谢所有审查和评论此特性（从最初的概念到实际实施）的贡献者（按字母顺序排列）： + +- [Eddie Zaneski](https://github.com/eddiezane) +- [Maciej Szulik](https://github.com/soltysh) +- [Lee Verberne](https://github.com/verb) From d4812b0d5077af5b6bb34ee4d1402a41a9263156 Mon Sep 17 00:00:00 2001 From: babugeet <97796199+babugeet@users.noreply.github.com> Date: Thu, 22 Aug 2024 08:11:38 +0530 Subject: [PATCH 137/408] Update content/en/docs/concepts/services-networking/dns-pod-service.md Co-authored-by: Charles Uneze --- content/en/docs/concepts/services-networking/dns-pod-service.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/dns-pod-service.md b/content/en/docs/concepts/services-networking/dns-pod-service.md index 9f0cd6ac66..4e42f8c008 100644 --- a/content/en/docs/concepts/services-networking/dns-pod-service.md +++ b/content/en/docs/concepts/services-networking/dns-pod-service.md @@ -191,7 +191,7 @@ An {{}} can spec the DNS hostname for any endpoint addresses, along with its IP. {{< note >}} - A and AAAA records are not created for Pod names since `hostname` is missing for the Pod. A Pod with no `hostname` but with `subdomain` will only create the +A and AAAA records are not created for Pod names since `hostname` is missing for the Pod. A Pod with no `hostname` but with `subdomain` will only create the A or AAAA record for the headless Service (`busybox-subdomain.my-namespace.svc.cluster-domain.example`), pointing to the Pods' IP addresses. Also, the Pod needs to be ready in order to have a record unless `publishNotReadyAddresses=True` is set on the Service. From da0d7e7eac5f7cf669bbac2a1e40b9cb5b4562d8 Mon Sep 17 00:00:00 2001 From: inductor Date: Thu, 22 Aug 2024 11:43:47 +0800 Subject: [PATCH 138/408] Update tonistiigi/binfmt --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index f31a6c729f..cff50172cb 100644 --- a/Makefile +++ b/Makefile @@ -81,7 +81,7 @@ container-push: container-image ## Push container image for the preview of the w PLATFORMS ?= linux/arm64,linux/amd64 docker-push: ## Build a multi-architecture image and push that into the registry - docker run --rm --privileged tonistiigi/binfmt:qemu-v6.2.0-26@sha256:5bf63a53ad6222538112b5ced0f1afb8509132773ea6dd3991a197464962854e --install all + docker run --rm --privileged tonistiigi/binfmt:qemu-v8.1.5-43@sha256:46c5a036f13b8ad845d6703d38f8cce6dd7c0a1e4d42ac80792279cabaeff7fb --install all docker version $(DOCKER_BUILDX) version $(DOCKER_BUILDX) inspect image-builder > /dev/null 2>&1 || $(DOCKER_BUILDX) create --name image-builder --use From 9ba081ed28f026fffe8ef38d508604dc50521bc3 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Thu, 22 Aug 2024 09:08:46 +0800 Subject: [PATCH 139/408] [zh] Sync kubectl_rollout/ files --- .../generated/kubectl_rollout/_index.md | 24 ------------------- .../kubectl_rollout_history.md | 24 ------------------- .../kubectl_rollout/kubectl_rollout_pause.md | 24 ------------------- .../kubectl_rollout/kubectl_rollout_resume.md | 24 ------------------- .../kubectl_rollout/kubectl_rollout_status.md | 24 ------------------- .../kubectl_rollout/kubectl_rollout_undo.md | 24 ------------------- 6 files changed, 144 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/_index.md index 35e7e7c517..7086aad333 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/_index.md @@ -180,30 +180,6 @@ TLS 客户端密钥文件的路径。

    -     - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_history.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_history.md index d3dbd05a60..6276654806 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_history.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_history.md @@ -279,30 +279,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_pause.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_pause.md index 6d48afdd86..53f234147d 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_pause.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_pause.md @@ -278,30 +278,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_resume.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_resume.md index fb290cd106..12b2809bee 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_resume.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_resume.md @@ -276,30 +276,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_status.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_status.md index 7df021b4f5..f50e355da9 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_status.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_status.md @@ -247,30 +247,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_undo.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_undo.md index 337de57d9f..c1b86dc9e5 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_undo.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_rollout/kubectl_rollout_undo.md @@ -299,30 +299,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From 4aa7c8b45cfd7f0ea19a0eeb898148487bddde7f Mon Sep 17 00:00:00 2001 From: berikulyBeket <123827444+berikulyBeket@users.noreply.github.com> Date: Thu, 22 Aug 2024 09:14:58 +0500 Subject: [PATCH 140/408] Added the initial of the Russian language for the link (#45721) * Added the initial of the Russian language for the link * Update what-is-kubernetes.md --------- Co-authored-by: Dmitry Shurupov --- content/ru/docs/concepts/overview/what-is-kubernetes.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/ru/docs/concepts/overview/what-is-kubernetes.md b/content/ru/docs/concepts/overview/what-is-kubernetes.md index 1f9f463269..58e5dbf612 100644 --- a/content/ru/docs/concepts/overview/what-is-kubernetes.md +++ b/content/ru/docs/concepts/overview/what-is-kubernetes.md @@ -87,6 +87,6 @@ Kubernetes: ## {{% heading "whatsnext" %}} -* Изучите [Компоненты Kubernetes](/docs/concepts/overview/components/) -* Готовы [начать](/docs/setup/)? +* Изучите [Компоненты Kubernetes](/ru/docs/concepts/overview/components/) +* Готовы [начать](/ru/docs/setup/)? From 5c67f34e47457d96e34b9a0dbbe146580cf2f794 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Thu, 22 Aug 2024 12:24:56 +0800 Subject: [PATCH 141/408] [zh] Remove --cloud-provider-gce sections from kubectl_config/* --- .../kubectl_config_get-clusters.md | 24 ------------------- .../kubectl_config_get-contexts.md | 24 ------------------- .../kubectl_config_get-users.md | 24 ------------------- .../kubectl_config_rename-context.md | 24 ------------------- .../kubectl_config_set-cluster.md | 24 ------------------- .../kubectl_config_set-context.md | 24 ------------------- .../kubectl_config_set-credentials.md | 24 ------------------- .../kubectl_config/kubectl_config_set.md | 24 ------------------- .../kubectl_config/kubectl_config_unset.md | 24 ------------------- .../kubectl_config_use-context.md | 24 ------------------- .../kubectl_config/kubectl_config_view.md | 24 ------------------- 11 files changed, 264 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-clusters.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-clusters.md index 7fde6855dd..3442ca8544 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-clusters.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-clusters.md @@ -144,30 +144,6 @@ TLS 客户端密钥文件的路径。

    -     - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-contexts.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-contexts.md index 5f97527b5b..9901a5254f 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-contexts.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-contexts.md @@ -174,30 +174,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-users.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-users.md index d6b1f87a9e..677d3f1483 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-users.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-users.md @@ -149,30 +149,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_rename-context.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_rename-context.md index fa8be4a17b..cd138e481d 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_rename-context.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_rename-context.md @@ -159,30 +159,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-cluster.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-cluster.md index 2b1865e303..26b8748f9d 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-cluster.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-cluster.md @@ -247,30 +247,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-context.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-context.md index 465daa3524..cfcc7fffe4 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-context.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-context.md @@ -205,30 +205,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-credentials.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-credentials.md index dd24998d58..ea52f21640 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-credentials.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set-credentials.md @@ -415,30 +415,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set.md index 9e66f0eeee..74ffcb1b26 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_set.md @@ -184,30 +184,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_unset.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_unset.md index f7a66df16f..8b69402fba 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_unset.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_unset.md @@ -157,30 +157,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_use-context.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_use-context.md index c4c92c795e..d581e0359d 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_use-context.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_use-context.md @@ -149,30 +149,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_view.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_view.md index 07f5a5ac08..73e3d74fa5 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_view.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_config/kubectl_config_view.md @@ -268,30 +268,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From 0e2559bdd950d0c75e164385e9b4340767f585cd Mon Sep 17 00:00:00 2001 From: inductor Date: Thu, 22 Aug 2024 12:30:06 +0800 Subject: [PATCH 142/408] update Japanese index.html --- content/ja/_index.html | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/content/ja/_index.html b/content/ja/_index.html index 5971f5ee6c..e80e9de9d0 100644 --- a/content/ja/_index.html +++ b/content/ja/_index.html @@ -45,12 +45,15 @@ Kubernetesをダウンロードするには、[ダウンロード](/releases/dow

    - 2023年4月18日〜21日のKubeCon + CloudNativeCon Europeに参加する + 2024年8月21日〜23日のKubeCon + CloudNativeCon Chinaに参加する


    + 2024年11月12日〜15日のKubeCon + CloudNativeCon North Americaに参加する
    - 2023年11月6日〜9日のKubeCon + CloudNativeCon North Americaに参加する +
    +
    + 2024年12月11日〜12日のKubeCon + CloudNativeCon Indiaに参加する
    From cf1850d230253c8e7f88a8d253781a8f3880d40c Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Thu, 22 Aug 2024 12:33:57 +0800 Subject: [PATCH 143/408] [zh-cn] sync kubectl_set/* Signed-off-by: xin.li --- .../kubectl/generated/kubectl_set/_index.md | 24 ------------------- .../generated/kubectl_set/kubectl_set_env.md | 24 ------------------- .../kubectl_set/kubectl_set_image.md | 24 ------------------- .../kubectl_set/kubectl_set_resources.md | 24 ------------------- .../kubectl_set/kubectl_set_selector.md | 24 ------------------- .../kubectl_set/kubectl_set_serviceaccount.md | 24 ------------------- .../kubectl_set/kubectl_set_subject.md | 24 ------------------- 7 files changed, 168 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/_index.md index fef9da0899..41b118ecd0 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/_index.md @@ -147,30 +147,6 @@ TLS 客户端密钥文件的路径。

    -
     - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_env.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_env.md index bdf2b35f44..a96150ef86 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_env.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_env.md @@ -458,30 +458,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_image.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_image.md index 8da07fe9f4..b358ff81e3 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_image.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_image.md @@ -328,30 +328,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_resources.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_resources.md index c7679ab2ad..d0367c18a7 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_resources.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_resources.md @@ -363,30 +363,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_selector.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_selector.md index e0692c2080..b6e6e789e5 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_selector.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_selector.md @@ -296,30 +296,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_serviceaccount.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_serviceaccount.md index bb12a29990..6634775e33 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_serviceaccount.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_serviceaccount.md @@ -303,30 +303,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_subject.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_subject.md index 1443c860e7..7149c0d6d2 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_subject.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_set/kubectl_set_subject.md @@ -348,30 +348,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From 96e945db6a598a38779cd669774e979acfdbbe7c Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Thu, 22 Aug 2024 12:48:26 +0800 Subject: [PATCH 144/408] [zh-cn] sync kubectl_delete kubectl_describe kubectl_diff kubectl_drain Signed-off-by: xin.li --- .../generated/kubectl_delete/_index.md | 24 ---------------- .../generated/kubectl_describe/_index.md | 24 ---------------- .../kubectl/generated/kubectl_diff/_index.md | 27 +----------------- .../kubectl/generated/kubectl_drain/_index.md | 28 ------------------- 4 files changed, 1 insertion(+), 102 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_delete/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_delete/_index.md index 5300ab575e..d21b693d19 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_delete/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_delete/_index.md @@ -444,30 +444,6 @@ TLS 客户端密钥文件的路径。

    -     - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_describe/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_describe/_index.md index e1df35b9bd..96828929f9 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_describe/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_describe/_index.md @@ -282,30 +282,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_diff/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_diff/_index.md index 3c5a676008..e887df582b 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_diff/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_diff/_index.md @@ -14,7 +14,6 @@ no_list: true ## {{% heading "synopsis" %}} - 默认值：130.211.0.0/22,35.191.0.0/16 - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_drain/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_drain/_index.md index 277e410d98..c5a9c8c58c 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_drain/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_drain/_index.md @@ -340,34 +340,6 @@ TLS 客户端密钥文件的路径。 - - - - - - - - - - - - - - From 517d2ba539fbfdfdb6a5592e88091f63af4904bb Mon Sep 17 00:00:00 2001 From: kohbis <18735471+kohbis@users.noreply.github.com> Date: Thu, 22 Aug 2024 14:49:41 +0900 Subject: [PATCH 145/408] [ja] Translate content/en/docs/reference/using-api/deprecation-policy.md (#47235) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * cp content/en/docs/reference/using-api/deprecation-policy.md * Translate to ja * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * 翻訳前の英文削除 * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * suggestion取り込み * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> * Update content/ja/docs/reference/using-api/deprecation-policy.md Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> --------- Co-authored-by: Taisuke Okamoto <34154552+b1gb4by@users.noreply.github.com> Co-authored-by: Junya Okabe <86868255+Okabe-Junya@users.noreply.github.com> --- .../reference/using-api/deprecation-policy.md | 450 ++++++++++++++++++ 1 file changed, 450 insertions(+) create mode 100644 content/ja/docs/reference/using-api/deprecation-policy.md diff --git a/content/ja/docs/reference/using-api/deprecation-policy.md b/content/ja/docs/reference/using-api/deprecation-policy.md new file mode 100644 index 0000000000..b1df9121eb --- /dev/null +++ b/content/ja/docs/reference/using-api/deprecation-policy.md @@ -0,0 +1,450 @@ +--- +title: Kubernetes非推奨ポリシー +content_type: concept +weight: 40 +--- + + +このドキュメントではシステムのさまざまな側面に関する非推奨ポリシーについて詳しく説明します。 + + + +Kubernetesは多くのコンポーネントと多くのコントリビュータを持つ大規模なシステムです。 +このようなソフトウェアでは、機能セットは時間の経過とともに自然に進化し、時には機能を削除する必要がある場合があります。 +これにはAPI、フラグ、または機能全体が含まれることもあります。 +既存のユーザーへの影響を避けるため、Kubernetesは削除される予定のシステムの側面については非推奨ポリシーに従っています。 + +## API + +KubernetesはAPI駆動型のシステムであるため、問題領域の理解の進化を反映して時間の経過とともに進化してきました。 +Kubernetes APIは実際は「APIグループ」と呼ばれる一連のAPIであり、各APIグループは個別にバージョン管理されています。 +[APIバージョン](/docs/ja/reference/using-api/#api-versioning)は主に3つのトラックに分類され、それぞれに異なる非推奨ポリシーがあります: + +| 例 | トラック | +|----------|-----------------------| +| v1 | GA (一般提供、安定版) | +| v1beta1 | Beta (プレリリース) | +| v1alpha1 | Alpha (実験的) | + +Kubernetesの特定のリリースでは任意の数のAPIグループと任意の数のそれぞれのバージョンをサポートすることができます。 + +次のルールはAPIの要素の非推奨を管理します。これには以下が含まれます: + + * RESTリソース (別名 APIオブジェクト) + * RESTリソースのフィールド + * RESTリソースのアノテーション、"beta"アノテーションは含まれますが"alpha"アノテーションは含まれません + * 列挙された値や定数値 + * コンポーネントの設定構造 + +これらのルールは、masterまたはリリースブランチへの任意のコミット間ではなく、公式リリース間に適用されます。 + +**ルール #1: APIの要素はAPIグループのバージョンをインクリメントすることでもに削除することができます。** + +APIの要素が特定バージョンのAPIグループに追加されると、 +トラックに関係なくそのバージョンから削除されたり、 +大幅に挙動が変更されることはありません。 + +{{< note >}} +歴史的な理由により、「core」(グループ名なし)と「extentions」という2つの「monolithic」APIグループがあります。 +リソースはこれらのレガシーなAPIグループからより特定のドメインに特化したAPIグループに段階的に移行されます。 +{{< /note >}} + +**ルール #2: APIオブジェクトはいくつかのバージョンに存在しないRESTリソース全体を除き、 +任意のリリース内のAPIバージョン間で情報を失うことなくラウンドトリップできる必要があります** + +例えば、あるオブジェクトがv1として書き込まれその後v2として読み取られv1に変換された場合、 +結果として得られるv1リソースは元のリソースと同一である必要があります。 +v2における表現はv1とは異なるかもしれませんが、システムは両方向にそれらを変換する方法を知っています。 +さらに、v2で追加された新しいフィールドはv1にラウンドトリップできる必要があります。 +つまりv1では同等のフィールドを追加するかアノテーションとして表現する必要があるかもしれません。 + +**ルール #3: 特定のトラックのAPIバージョンは安定性の低いAPIバージョンを優先して非推奨になることはありません。** + + * GA APIバージョンは、betaおよびalpha APIバージョンに置き換えることができます。 + * Beta APIバージョンは以前のbetaおよびalpha APIバージョンに置き換えることはできますが、GA APIバージョンに置き換えることは*できません*。 + * Alpha APIバージョンは以前のalpha APIバージョンに置き換えることはできますが、GAまたはbeta APIバージョンに置き換えることはできません。 + +**ルール #4a: APIの有効期間はAPIの安定性レベルによって決まります** + + * GA APIバージョンは非推奨としてマークされることがありますが、Kubernetesのメジャーバージョン内で削除されることはありません。 + * Beta APIバージョンは導入後9ヶ月または3つのマイナーリリース(いずれか長い方)以内に非推奨にされ、 + 非推奨後9ヶ月または3つのマイナーリリース(いずれか長い方)以内に提供されなくなります。 + * Alpha APIバージョンは事前の非推奨通知なしにリリースから削除される場合があります。 + +これによりbeta APIバージョンのサポートは [最大2つのリリースのバージョンの差異](/ja/releases/version-skew-policy/)をカバーし、 +APIが不安定なbetaバージョンで停滞し、beta APIのサポートが終了したときに本番稼働が中断されることはありません。 + +{{< note >}} +GA APIを削除するKubernetesのメジャーバージョン改訂の計画は現在ありません。 +{{< /note >}} + +{{< note >}} +[#52185](https://github.com/kubernetes/kubernetes/issues/52185)が解決されるまで、 +ストレージに永続化されているAPIバージョンは削除されません。 +これらのバージョンのAPIエンドポイントの提供は無効にできます(このドキュメントの非推奨タイムラインに従います)が、 +APIサーバーはストレージから以前永続化されたデータをデコード/変換できる機能を維持する必要があります。 +{{< /note >}} + +**ルール #4b: 特定のグループの「優先」APIバージョンと「ストレージバージョン」は、 +新しいバージョンと以前のバージョンの両方をサポートするリリースが行われるまで更新されない場合があります。** + +ユーザーはKubernetesの新しいリリースにアップグレードした後、 +(新しいバージョンでのみ利用可能な機能を明示的に使用していない限り) +何も新しいAPIバージョンに変換することなく、また破損が発生することなく、 +以前のリリースにロールバックできる必要があります。 +これはオブジェクトの保存された表現において特に顕著です。 + +これらはすべて例を挙げて説明するのが最も適切です。新しいAPIグループを導入する +Kubernetesリリース、バージョンXを想像してください。 +新しいKubernetesリリースは約4ヶ月ごと(1年に3回)に行われます。 +以下の表は一連の後続リリースでサポートされるAPIバージョンを示しています。 + +
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16
    -

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    -
    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16
    -

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    -
    --cluster string
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    リリースAPIバージョン優先/ストレージバージョンノート
    Xv1alpha1v1alpha1
    X+1v1alpha2v1alpha2 +
      +
    • v1alpha1は削除され、リリースノートに"action required"と記載されます
      • +
    +
    X+2v1beta1v1beta1 +
      +
    • v1alpha2は削除され、リリースノートに"action required"と記載されます
      • +
    +
    X+3v1beta2, v1beta1 (非推奨)v1beta1 +
      +
    • v1beta1は非推奨になり、リリースノートに"action required"と記載されます
      • +
    +
    X+4v1beta2, v1beta1 (deprecated)v1beta2
    X+5v1, v1beta1 (非推奨), v1beta2 (非推奨)v1beta2 +
      +
    • v1beta2は非推奨になり、リリースノートに"action required"と記載されます
      • +
    +
    X+6v1, v1beta2 (非推奨)v1 +
      +
    • v1beta1は削除され、リリースノートに"action required"と記載されます
      • +
    +
    X+7v1, v1beta2 (非推奨)v1
    X+8v2alpha1, v1v1 +
      +
    • v1beta2は削除され、リリースノートに"action required"と記載されます
      • +
    +
    X+9v2alpha2, v1v1 +
      +
    • v2alpha1は削除され、リリースノートに"action required"と記載されます
      • +
    +
    X+10v2beta1, v1v1 +
      +
    • v2alpha2は削除され、リリースノートに"action required"と記載されます
      • +
    +
    X+11v2beta2, v2beta1 (非推奨), v1v1 +
      +
    • v2beta1は非推奨になり、リリースノートに"action required"と記載されます
      • +
    +
    X+12v2, v2beta2 (非推奨), v2beta1 (非推奨), v1 (非推奨)v1 +
      +
    • v2beta2は非推奨になり、リリースノートに"action required"と記載されます
      • +
    • v1 is deprecated in favor of v2, but will not be removed
      • +
    • v1はv2に置き換えられますが、削除はされません
      • +
    +
    X+13v2, v2beta1 (非推奨), v2beta2 (非推奨), v1 (非推奨)v2
    X+14v2, v2beta2 (非推奨), v1 (非推奨)v2 +
      +
    • v2beta1は削除され、リリースノートに"action required"と記載されます
      • +
    +
    X+15v2, v1 (非推奨)v2 +
      +
    • v2beta2は削除され、リリースノートに"action required"と記載されます
      • +
    +
    + +### REST resources (別名APIオブジェクト) + +上記のタイムラインではAPI v1に存在し、非推奨化される必要があるWidgetという仮想のRESTリソースを考えてみましょう。 +私たちはリリースX+1と同期して非推奨をドキュメント化と[アナウンス](https://groups.google.com/forum/#!forum/kubernetes-announce)を行います。 +WidgetリソースはAPIバージョンv1(非推奨)にはまだ存在しますがv2alpha1には存在しません。 +WidgetリソースはX+8までのリリースに引き続き存在して機能します。 +API v1が期限切れになるX+9でのみ、Widgetリソースは存在しなくなり、その動作が削除されます。 + +Kubernetes v1.19以降は、非推奨のREST APIエンドポイントへのAPIリクエストを行うと、以下のようになります: + +1. APIレスポンスにおいて`Warning`ヘッダー([RFC7234, Section 5.5](https://tools.ietf.org/html/rfc7234#section-5.5)で定義)を返します。 +2. リクエストに対して記録された[監査イベント](/ja/docs/tasks/debug/debug-cluster/audit/)に`"k8s.io/deprecated":"true"`というアノテーションを追加します。 +3. `kube-apiserver`プロセスで`apiserver_requested_deprecated_apis`ゲージメトリクスに`1`を設定します。 + このメトリクスには`apiserver_request_total`メトリクスに結合することができる `group`、`version`、`resource`、`subresource`ラベルと、APIが提供されなくなるKubernetesリリースを表す`removed_release`があります。 + 次のPrometheusクエリはv1.22で削除される非推奨APIへのリクエストに関する情報を返します: + + ```promql + apiserver_requested_deprecated_apis{removed_release="1.22"} * on(group,version,resource,subresource) group_right() apiserver_request_total + ``` + +### RESTリソースのフィールド + +すべてのRESTリソースと同様に、API v1に存在していた個々のフィールドはAPI v1が削除されるまで存在して機能する必要があります。 +リソース全体と異なり、v2 APIはフィールドをラウンドトリップできる限り、異なる表現を選択することができます。 +例えば非推奨になった「magnitude」という名前のv1フィールドは、API v2では「deprecatedMagnitude」という名前になる可能性があります。 +最終的にv1が削除されると、v2から非推奨のフィールドも削除することができます。 + +### 列挙された値や定数値 + +すべてのRESTリソースとそのフィールドと同様にAPI v1でサポートされていた定数値はAPI v0が削除されるまで存在して機能する必要があります。 + +### コンポーネント設定の構造 + +コンポーネント設定はRESTリソースと同様にバージョン付けされて管理されています。 + +### 今後の取り組み + +時間の経過とともに、Kubernetesはよりきめ細かいAPIバージョンを導入し、これらのルールは必要に応じて調整されます。 + +## フラグまたはCLIの非推奨化 + +Kubernetesシステムは複数の異なるプログラムが連携して構成されています。 +KubernetesリリースではこれらのプログラムのフラグやCLIコマンド(総称して「CLI要素」)が削除されることがしばしばあります。 +個々のプログラムは、非推奨ポリシーが若干異なる、ユーザー向けプログラムと管理者向けプログラムの2つの主要グループに分類されます。 +フラグに明示的に接頭辞が付けられていないか、「alpha」または「beta」としてドキュメント化されない限り、そのフラグはGAとみなされます。 + +CLI要素は事実上システムに対するAPIの一部ですが、REST APIと同じ方法ではバージョン管理されておらず、非推奨のルールは次のようになっています: + +**ルール #5a: ユーザー向けのコンポーネントのCLI要素(例: kubectl)は +非推奨がアナウンスされてから以下の期間は機能しなければなりません:** + + * **GA: 12ヶ月または2リリース(いずれか長い方)** + * **Beta: 3ヶ月または1リリース(いずれか長い方)** + * **Alpha: 0リリース** + +**ルール #5b: 管理者向けのコンポーネントのCLI要素(例: kubelet)は +非推奨がアナウンスされてから以下の期間は機能しなければなりません:** + + * **GA: 6ヶ月または1リリース(いずれか長い方)** + * **Beta: 3ヶ月または1リリース(いずれか長い方)** + * **Alpha: 0リリース** + +**ルール #5c: コマンドラインインターフェース(CLI)の要素は +より不安定なCLI要素の代わりに廃止されることはありません** + +APIに関するルール#3と同様、コマンドラインインターフェースの要素が代替実装にリプレイスされる、 +例えば既存の要素名の変更やコマンドライン引数の代わりにファイルから取得した設定を使用するように切り替える場合、 +推奨される代替案は同じかそれ以上の安定性レベルでなければなりません。 + +**ルール #6: 非推奨のCLI要素は使用時に警告を表示しなければなりません(オプションで無効化可能)** + +## 機能や動作の非推奨化 + +時には、KubernetesリリースではAPIやCLIによって制御されないシステムの機能や動作を非推奨にする必要があります。 +その場合、非推奨に関するルールは以下の通りです: + +**ルール #7: 非推奨となる動作はアナウンスされてから最低1年間は機能しなければなりません。** + +機能や動作が、変更を取り込む作業が必要な代替実装に置き換えられる場合、 +可能な限り移行を簡素化する努力が必要です。 +代替実装がKubernetes organizationの管理下にある場合、以下のルールが適用されます: + +**ルール #8: 安定性の低い代替実装を優先して、動作の機能を非推奨にしてはなりません** + +例えば、一般提供されている機能がBeta版にリプレイスために非推奨にされることはありません。 +ただし、Kubernetesプロジェクトは同じ成熟度に達する前であっても、ユーザーが代替実装を採用して移行することを推奨しています。 +これは、機能の新しいユースケースを検討したり、リプレイスについての早期フィードバックを得るために特に重要です。 + +代替実装は、外部のツールや製品である場合があります。 +例えば、機能がkubeletからKubernetesプロジェクト管理外のコンテナランタイムに移行することがあります。 +このような場合、ルールを適用することはできませんが、コンポーネントの成熟度を損なわない移行方法を確保するための努力が必要です。 +コンテナランタイムを例に挙げると、一般的なコンテナランタイムが、リプレイスする動作を実装しながら同等の安定性を提供するバージョンを持つように取り組む必要があるかもしれません。 + +機能と動作の非推奨ルールは、システムに対するすべての変更がこのポリシーによって管理されることを意味するものではありません。 +これらのルールはKubernetes上で実行されているアプリケーションの正確性やKubernetesクラスターの管理に影響する、また完全に削除されるものにのみ適用されます。 + +上記のルールの例外は _フィーチャーゲート_ です。 +フィーチャーゲートはユーザーが実験的な機能を有効/無効にできるようにするキー=バリューのペアです。 + +フィーチャーゲートは機能の開発ライフサイクルをカバーすることを目的としており、 +長期的なAPIを目的としたものではありません。 +そのため、機能がGAになるが削除された後は、非推奨となり削除されることが期待されます。 + +機能が段階を踏むにつれて、関連するフィーチャーゲートも進化します。 +機能のライフサイクルと対応するフィーチャーゲートの関係は以下の通りです: + + * Alpha: フィーチャーゲートはデフォルトで無効化されており、ユーザーによって有効化できます。 + * Beta: フィーチャーゲートはデフォルトで有効化されており、ユーザーによって無効化できます。 + * GA: フィーチャーゲートは非推奨となり(["非推奨"](#deprecation)を参照)動作しなくなります。 + * GA、非推奨期間終了後: フィーチャーゲートは削除され、呼び出しは受け付けられなくなります。 + +### 非推奨 + +機能はGA前のライフサイクルのどの時点でも削除できます。 +GA前に機能が削除されると、それに関連するフィーチャーゲートも非推奨になります。 + +動作しないフィーチャーゲートを無効化するために呼び出そうとすると、 +サイレントに実行される可能性あるサポートされていないシナリオを避けるため呼び出しは失敗します。 + +場合によっては、GA前の機能を削除にかなりの時間がかかることがあります。 +フィーチャーゲートは、関連する機能が完全に削除されるまで機能し続け、 +その時点でフィーチャーゲート自体が非推奨になる可能性があります。 + +GAされた機能のフィーチャーゲートの削除にも時間がかかる場合、 +フィーチャーゲートが機能に影響を与えず、エラーも引き起こさない場合、 +フィーチャーゲートへの呼び出しは動作し続けることがあります。 + +ユーザーによって無効化されることを意図した機能には、関連するフィーチャーゲートで +その機能を無効化するためにメカニズムが含まれている必要があります。 + +フィーチャーゲートのバージョニングは、前述のコンポーネントとは異なるため、 +非推奨に関するルールは次のとおりです: + +**ルール #9: +フィーチャーゲートは、対応する機能が次のようにライフサイクルステージを移行する際に非推奨にする必要があります。 +フィーチャーゲートは以下の期間は機能しなければなりません:** + + * **Beta機能からGA: 6ヶ月または2リリース(どちらか長い方)** + * **Beta機能からEOL: 3ヶ月または1リリース(どちらか長い方)** + * **Alpha機能からEOL: 0リリース** + +**ルール #10: 非推奨となったフィーチャーゲートは使用時に警告を返す必要があります。 +フィーチャーゲートが非推奨になる場合には、リリースノートと対応するCLIヘルプの両方にドキュメント化される必要があります。 +警告とドキュメントの両方には、フィーチャーゲートが動作しないかどうかを明記する必要があります。** + +## メトリクスの非推奨化 + +Kubernetesコントロールプレーンの各コンポーネントはメトリクス(通常は`/metrics`エンドポイント)を公開しており、 +通常はクラスター管理者によって収集されます。 +すべてのメトリクスが同じというわけではありません。一部のメトリクスは一般的にSLIとして使用されたり、 +SLOを決定するために使用されるため、より重要な役割を持つ傾向があります。 +他のメトリクスは、事実上実験的なものであるか、主にKubernetesの開発プロセスで使用されます。 + +そのため、メトリクスは3つの安定性クラス(`ALPHA`、`BETA`、`STABLE`)に分類され、 +Kubernetesリリース間のメトリクスの削除に影響します。 +これらのクラスは、メトリクスの重要性に基づいて決定されます。 +メトリクスの非推奨と削除に関するルールは次のとおりです: + +**ルール #11a: メトリクスは、対応する安定性クラスに応じて、以下の期間は機能しなければなりません:** + + * **STABLE: 4リリースまたは12ヶ月(いずれか長い方)** + * **BETA: 2リリースまたは8ヶ月(いずれか長い方)** + * **ALPHA: 0リリース** + +**ルール #11b: メトリクスは、非推奨がアナウンスされた後も、以下の期間は機能しなければなりません:** + + * **STABLE: 3リリースまたは9ヶ月(いずれか長い方)** + * **BETA: 1リリースまたは4ヶ月(いずれか長い方)** + * **ALPHA: 0リリース** + +非推奨となったメトリクスの説明テキストには、先頭に非推奨を通知する文字列「(Deprecated from x.y)」が付けられ、 +メトリクスの登録時に警告ログが出力されます。 +非推奨でない安定版のメトリクスと同様に、非推奨となったメトリクスも自動的にメトリクスエンドポイントに登録されるため、表示されます。 + +後続のリリース(メトリクスの`deprecatedVersion`が _current_kubernetes_version - 3_ に等しい場合)で、 +非推奨となったメトリクスは _非表示_ になります。 +非推奨となったメトリクス **_とは異なり_** 、非表示のメトリクスは自動的にメトリクスエンドポイントに登録されなくなります(それゆえに非表示になります)。 +ただし、バイナリのコマンドラインフラグ(`--show-hidden-metrics-for-version=`)を使用して明示的に有効化することができます。 +これによりクラスター管理者は、以前の非推奨の警告に対応できなかった場合でも、 +非推奨となったメトリクスから適切に移行するための回避策を取ることができます。 +非表示のメトリクスは、1リリース後に削除される必要があります。 + +## 例外 + +想定し得るすべての状況を網羅するポリシーはありません。 +このポリシーは生きたドキュメントであり、時間の経過とともに改善されます。 +実際には、このポリシーにうまく適合しない状況や、このポリシーが重大な障害となる状況が発生する可能性があります。 +そのような状況では、特定のケースに対して最適な解決策を見つけるためにSIGやプロジェクトリーダーと協議するべきであり、 +Kubernetesが可能な限りユーザーに影響を与えない安定したシステムであることを常に念頭に置いておくべきです。 +例外は、関連するすべてのリリースノートで常にアナウンスされます。 From 0f49ecca354b83470a1b3efb117a7daa3d0c39a9 Mon Sep 17 00:00:00 2001 From: Dmitry Shurupov Date: Thu, 22 Aug 2024 16:13:46 +0700 Subject: [PATCH 146/408] [ru] Translate Releases and Download pages (#47524) * [ru] Translate Releases and Download Signed-off-by: Dmitry Shurupov * Update content/ru/releases/download.md Co-authored-by: Kirill Kononovich <41591254+kirkonru@users.noreply.github.com> --------- Signed-off-by: Dmitry Shurupov Co-authored-by: Kirill Kononovich <41591254+kirkonru@users.noreply.github.com> --- content/ru/releases/_index.md | 37 ++++++++++++++ content/ru/releases/download.md | 85 +++++++++++++++++++++++++++++++++ data/i18n/ru/ru.toml | 4 +- 3 files changed, 124 insertions(+), 2 deletions(-) create mode 100644 content/ru/releases/_index.md create mode 100644 content/ru/releases/download.md diff --git a/content/ru/releases/_index.md b/content/ru/releases/_index.md new file mode 100644 index 0000000000..65a701c291 --- /dev/null +++ b/content/ru/releases/_index.md @@ -0,0 +1,37 @@ +--- +linktitle: История релизов +title: Релизы +type: docs +layout: release-info +notoc: true +--- + + + +Проект Kubernetes поддерживает ветки с релизами для трёх последних минорных версий +({{< skew latestVersion >}}, {{< skew prevMinorVersion >}}, {{< skew oldestMinorVersion >}}). +Kubernetes 1.19 и более новые версии поддерживаются патч-релизами на протяжении +[примерно одного года](/releases/patch-releases/#support-period). +Kubernetes 1.18 и более старые версии поддерживаются патч-релизами около 9 месяцев. + +Версии Kubernetes обозначаются как **x.y.z**, +где **x** — это мажорная (major) версия, **y** — минорная (minor), а **z** — патч-версия +(patch), в соответствии с терминологией [семантического версионирования](https://semver.org/lang/ru/). + +Больше информации можно найти в документе [Version Skew Policy](/releases/version-skew-policy/). + + + +## История релизов + +{{< release-data >}} + +## Следующий релиз + +Смотрите [план](https://github.com/kubernetes/sig-release/tree/master/releases/release-{{< skew nextMinorVersion >}}) +по следующему релизу Kubernetes — **{{< skew nextMinorVersion >}}**. + +## Полезные ресурсы + +В документе [Kubernetes Release Team](https://github.com/kubernetes/sig-release/tree/master/release-team) +можно найти основную информацию о ролях людей, задействованных в подготовке релизов, и процессе их выпуска. diff --git a/content/ru/releases/download.md b/content/ru/releases/download.md new file mode 100644 index 0000000000..6e20582df4 --- /dev/null +++ b/content/ru/releases/download.md @@ -0,0 +1,85 @@ +--- +title: Скачать Kubernetes +type: docs +--- + +Kubernetes поставляет бинарные файлы для каждого своего компонента, а +также стандартный набор клиентских приложений для запуска кластера и +взаимодействия с ним. Компоненты вроде API-сервера могут запускаться +в контейнерных образах внутри кластера. В рамках процесса подготовки +официальных релизов эти компоненты также поставляются в виде образов. +Все бинарные файлы и контейнерные образы доступны для множества +операционных систем и видов аппаратной архитектуры. + +### kubectl + + + +Консольная утилита Kubernetes, [kubectl](/docs/reference/kubectl/kubectl/), +позволяет взаимодействовать с Kubernetes-кластерами. + +kubectl можно использовать для деплоя приложений, исследования кластерных +ресурсов и управления ими, просмотра логов. Больше информации, включая +полный список возможных действий с kubectl, смотрите в +[референсной документации `kubectl`](/ru/docs/reference/kubectl/). + +kubectl можно установить на разных Linux-платформах, macOS и Windows. +Выберите предпочтительную операционную систему ниже. + +- [Установка kubectl на Linux](/docs/tasks/tools/install-kubectl-linux) +- [Установка kubectl на macOS](/docs/tasks/tools/install-kubectl-macos) +- [Установка kubectl на Windows](/docs/tasks/tools/install-kubectl-windows) + +## Образы контейнеров + +Все контейнерные образы Kubernetes деплоятся в реестр `registry.k8s.io`. + +| Образ контейнера | Поддерживаемые архитектуры | +| ------------------------------------------------------------------------- | --------------------------------- | +| registry.k8s.io/kube-apiserver:v{{< skew currentPatchVersion >}} | amd64, arm, arm64, ppc64le, s390x | +| registry.k8s.io/kube-controller-manager:v{{< skew currentPatchVersion >}} | amd64, arm, arm64, ppc64le, s390x | +| registry.k8s.io/kube-proxy:v{{< skew currentPatchVersion >}} | amd64, arm, arm64, ppc64le, s390x | +| registry.k8s.io/kube-scheduler:v{{< skew currentPatchVersion >}} | amd64, arm, arm64, ppc64le, s390x | +| registry.k8s.io/conformance:v{{< skew currentPatchVersion >}} | amd64, arm, arm64, ppc64le, s390x | + +### Архитектуры образов контейнеров + +Все образы контейнеров могут работать на множестве архитектур. Исполняемая +среда контейнеров (runtime) должна сама определить подходящую, исходя из +используемой платформы. Образ с конкретной архитектурой можно также получить, +добавив суффикс к названию образа контейнера. Например, +`registry.k8s.io/kube-apiserver-arm64:v{{< skew currentPatchVersion >}}`. + +### Подписи образов контейнеров + +{{< feature-state for_k8s_version="v1.26" state="beta" >}} + +Для Kubernetes {{< param "version" >}} +образы контейнеров подписываются подписями [sigstore](https://sigstore.dev): + +{{< note >}} +В настоящий момент sigstore-подписи образов контейнеров не совпадают +в разных географических локациях. Подробности об этой проблеме можно +найти в соответствующем +[issue на GitHub](https://github.com/kubernetes/registry.k8s.io/issues/187). +{{< /note >}} + +Проект Kubernetes публикует список подписанных образов контейнеров Kubernetes +в формате [SPDX 2.3](https://spdx.dev/specifications/). +Получить этот список можно так: + +```shell +curl -Ls "https://sbom.k8s.io/$(curl -Ls https://dl.k8s.io/release/stable.txt)/release" | grep "SPDXID: SPDXRef-Package-registry.k8s.io" | grep -v sha256 | cut -d- -f3- | sed 's/-/\//' | sed 's/-v1/:v1/' +``` + +Для ручной проверки подписанных образов контейнеров базовых компонентов +Kubernetes воспользуйтесь инструкцией +[Verify Signed Container Images](/docs/tasks/administer-cluster/verify-signed-artifacts). + +Если вы скачиваете образ контейнера для конкретной архитектуры, этот +образ, предназначенный только для неё, будет подписан так же, как и +в списке с мульти-архитектурными манифестами. + +## Бинарные файлы + +{{< release-binaries >}} diff --git a/data/i18n/ru/ru.toml b/data/i18n/ru/ru.toml index 780e6cfa03..6fef9d3c79 100644 --- a/data/i18n/ru/ru.toml +++ b/data/i18n/ru/ru.toml @@ -526,7 +526,7 @@ other = "Дедлайн для Cherry Pick" other = "Дата конца жизни (EOL)" [release_full_details_initial_text] -other = "Полностью" +other = "Полная информация по релизу" [release_information_navbar] other = "Информация о релизе" @@ -552,7 +552,7 @@ other = "**%s** переходит в режим поддержки (maintenance other = "Примечание" [release_schedule] -other = "График" +other = "План патч-версий" [release_target_date] other = "Планируемая дата" From 65ce82dd0bb5e70b227fbd4355542a3716501367 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Thu, 22 Aug 2024 18:04:39 +0800 Subject: [PATCH 147/408] Revise step desc in image-volumes --- .../configure-pod-container/image-volumes.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/content/en/docs/tasks/configure-pod-container/image-volumes.md b/content/en/docs/tasks/configure-pod-container/image-volumes.md index 08da62beaf..974384934f 100644 --- a/content/en/docs/tasks/configure-pod-container/image-volumes.md +++ b/content/en/docs/tasks/configure-pod-container/image-volumes.md @@ -26,7 +26,7 @@ mount content from OCI registries inside containers. ## Run a Pod that uses an image volume {#create-pod} -An image volume for a pod is enabled setting the `volumes.[*].image` field of `.spec` +An image volume for a pod is enabled by setting the `volumes.[*].image` field of `.spec` to a valid reference and consuming it in the `volumeMounts` of the container. For example: {{% code_sample file="pods/image-volumes.yaml" %}} @@ -43,29 +43,29 @@ to a valid reference and consuming it in the `volumeMounts` of the container. Fo kubectl attach -it image-volume bash ``` -Run this command: +1. Check the content of a file in the volume: -```shell -cat /volume/dir/file -``` + ```shell + cat /volume/dir/file + ``` -The output is similar to: + The output is similar to: -```shell -1 -``` + ```none + 1 + ``` -Also run: + You can also check another file in a different path: -```shell -cat /volume/file -``` + ```shell + cat /volume/file + ``` -The output is similar to: + The output is similar to: -```shell -2 -``` + ```none + 2 + ``` ## Further reading From e12941d31bd204962c30e0bce9bc753fddad739b Mon Sep 17 00:00:00 2001 From: Ritikaa96 Date: Thu, 22 Aug 2024 15:43:09 +0530 Subject: [PATCH 148/408] improving documented auth annotation decision Signed-off-by: Ritikaa96 --- .../reference/labels-annotations-taints/audit-annotations.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/docs/reference/labels-annotations-taints/audit-annotations.md b/content/en/docs/reference/labels-annotations-taints/audit-annotations.md index 2698cc2657..e273864ef7 100644 --- a/content/en/docs/reference/labels-annotations-taints/audit-annotations.md +++ b/content/en/docs/reference/labels-annotations-taints/audit-annotations.md @@ -76,7 +76,8 @@ for more information. Example: `authorization.k8s.io/decision: "forbid"` -This annotation indicates whether or not a request was authorized in Kubernetes audit logs. +Value must be **forbid** or **allow**. This annotation indicates whether or not a request +was authorized in Kubernetes audit logs. See [Auditing](/docs/tasks/debug/debug-cluster/audit/) for more information. From 1f80bc470d37dba24a334fa5cfaf16a96ddb9ffb Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Thu, 22 Aug 2024 20:24:42 +0800 Subject: [PATCH 149/408] [zh-cn] sync kubectl_autoscale kubectl_certificate/* Signed-off-by: xin.li --- .../generated/kubectl_autoscale/_index.md | 24 ---------------- .../generated/kubectl_certificate/_index.md | 25 ----------------- .../kubectl_certificate_approve.md | 24 ---------------- .../kubectl_certificate_deny.md | 28 ++----------------- 4 files changed, 2 insertions(+), 99 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_autoscale/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_autoscale/_index.md index 9fe4aeeab3..be74e8cb9e 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_autoscale/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_autoscale/_index.md @@ -345,30 +345,6 @@ TLS 客户端密钥文件的路径。

    - ---cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - - ---cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - --cluster string diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/_index.md index 6934911414..358bade55b 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/_index.md @@ -142,30 +142,6 @@ TLS 客户端密钥文件的路径。

    - ---cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - - ---cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - --cluster string @@ -506,4 +482,3 @@ Treat warnings received from the server as errors and exit with a non-zero exit * [kubectl](../kubectl/) - kubectl 控制 Kubernetes 集群管理器 * [kubectl certificate approve](kubectl_certificate_approve/) - 批准证书签名请求 * [kubectl certificate deny](kubectl_certificate_deny/) - 拒绝证书签名请求 - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/kubectl_certificate_approve.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/kubectl_certificate_approve.md index c19e93ad03..3e0a6e0835 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/kubectl_certificate_approve.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/kubectl_certificate_approve.md @@ -260,30 +260,6 @@ TLS 客户端密钥文件的路径。

    - ---cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - - ---cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - --cluster string diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/kubectl_certificate_deny.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/kubectl_certificate_deny.md index 2dd0278c8e..3ad544ef44 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/kubectl_certificate_deny.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_certificate/kubectl_certificate_deny.md @@ -42,7 +42,7 @@ kubectl certificate deny csr-sqgzp ## {{% heading "options" %}} - +
    @@ -165,7 +165,7 @@ Template string or path to template file to use when -o=go-template, -o=go-templ ## {{% heading "parentoptions" %}} -
    +
    @@ -256,30 +256,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From 7579778ed03d553df6485f02140786a98c38668a Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Thu, 22 Aug 2024 21:10:45 +0800 Subject: [PATCH 150/408] [zh-cn] sync kubectl_attach kubectl_completion kubectl_cluster-info/* Signed-off-by: xin.li --- .../generated/kubectl_attach/_index.md | 24 ---------------- .../generated/kubectl_cluster-info/_index.md | 28 ++----------------- .../kubectl_cluster-info_dump.md | 24 ---------------- .../generated/kubectl_completion/_index.md | 24 ---------------- 4 files changed, 2 insertions(+), 98 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_attach/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_attach/_index.md index a39e77cba2..f680b835d0 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_attach/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_attach/_index.md @@ -243,30 +243,6 @@ TLS 客户端密钥文件的路径。

    -     - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_cluster-info/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_cluster-info/_index.md index e947656b82..cb4dcdebec 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_cluster-info/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_cluster-info/_index.md @@ -20,7 +20,7 @@ Display addresses of the control plane and services with label kubernetes.io/clu 显示控制平面和带有标签 kubernetes.io/cluster-service=true 的 Service 的地址。 要进一步调试和诊断集群问题，请使用 "kubectl cluster-info dump"。 -``` +```shell kubectl cluster-info [flags] ``` @@ -29,7 +29,7 @@ kubectl cluster-info [flags] -``` +```shell # 打印控制平面和集群服务的地址 kubectl cluster-info ``` @@ -153,30 +153,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_cluster-info/kubectl_cluster-info_dump.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_cluster-info/kubectl_cluster-info_dump.md index 2a7fa7bbb0..3bdff117d0 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_cluster-info/kubectl_cluster-info_dump.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_cluster-info/kubectl_cluster-info_dump.md @@ -286,30 +286,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_completion/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_completion/_index.md index 4d3fa1cb3b..0f45115556 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_completion/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_completion/_index.md @@ -272,30 +272,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From 85dd71357fda5e9b83cde0ca1426ced6b8d92090 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Thu, 22 Aug 2024 21:27:01 +0800 Subject: [PATCH 151/408] [zh-cn] sync kubectl_cordon kubectl_cp kubectl_edit kubectl_events Signed-off-by: xin.li --- .../generated/kubectl_cordon/_index.md | 32 ++------- .../kubectl/generated/kubectl_cp/_index.md | 70 ++++++------------- .../kubectl/generated/kubectl_edit/_index.md | 24 ------- .../generated/kubectl_events/_index.md | 26 +------ 4 files changed, 28 insertions(+), 124 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_cordon/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_cordon/_index.md index d25d995fc8..04152a7005 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_cordon/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_cordon/_index.md @@ -32,13 +32,13 @@ kubectl cordon NODE ``` --> ```bash - # 将节点 "foo" 标记为不可调度的 - kubectl cordon foo +# 将节点 "foo" 标记为不可调度的 +kubectl cordon foo ``` ## {{% heading "options" %}} -
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    +
    @@ -88,7 +88,7 @@ Selector (label query) to filter on, supports '=', '==', and '!='.(e.g. -l key1= ## {{% heading "parentoptions" %}} -
    +
    @@ -179,30 +179,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_cp/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_cp/_index.md index a83b6f671a..b7face6dc0 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_cp/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_cp/_index.md @@ -54,29 +54,29 @@ kubectl cp ``` --> ```shell - # !!!重要提示!!! - # 要求你的容器镜像中存在 'tar' 可执行文件 - # 如果 'tar' 不存在，'kubectl cp' 将会失败 - # - # 对于符号链接、通配符扩展或文件模式保留等高级用例，考虑使用 'kubectl exec' - - # 将本地文件 /tmp/foo 复制到远程命名空间 中 Pod 中的 /tmp/bar - tar cf - /tmp/foo | kubectl exec -i -n -- tar xf - -C /tmp/bar - - # 将 /tmp/foo 从远程 Pod 复制到本地的 /tmp/bar - kubectl exec -n -- tar cf - /tmp/foo | tar xf - -C /tmp/bar - - # 将本地目录 /tmp/foo_dir 复制到远程默认命名空间中 Pod 中的 /tmp/bar_dir - kubectl cp /tmp/foo_dir :/tmp/bar_dir - - # 将本地文件 /tmp/foo 复制到远程 Pod 中特定容器内的 /tmp/bar - kubectl cp /tmp/foo :/tmp/bar -c - - # 将本地文件 /tmp/foo 复制到远程命名空间 内 Pod 中的 /tmp/bar - kubectl cp /tmp/foo /:/tmp/bar - - # 将 /tmp/foo 从远程 Pod 复制到本地的 /tmp/bar - kubectl cp /:/tmp/foo /tmp/bar +# !!!重要提示!!! +# 要求你的容器镜像中存在 'tar' 可执行文件 +# 如果 'tar' 不存在，'kubectl cp' 将会失败 +# +# 对于符号链接、通配符扩展或文件模式保留等高级用例，考虑使用 'kubectl exec' + +# 将本地文件 /tmp/foo 复制到远程命名空间 中 Pod 中的 /tmp/bar +tar cf - /tmp/foo | kubectl exec -i -n -- tar xf - -C /tmp/bar + +# 将 /tmp/foo 从远程 Pod 复制到本地的 /tmp/bar +kubectl exec -n -- tar cf - /tmp/foo | tar xf - -C /tmp/bar + +# 将本地目录 /tmp/foo_dir 复制到远程默认命名空间中 Pod 中的 /tmp/bar_dir +kubectl cp /tmp/foo_dir :/tmp/bar_dir + +# 将本地文件 /tmp/foo 复制到远程 Pod 中特定容器内的 /tmp/bar +kubectl cp /tmp/foo :/tmp/bar -c + +# 将本地文件 /tmp/foo 复制到远程命名空间 内 Pod 中的 /tmp/bar +kubectl cp /tmp/foo /:/tmp/bar + +# 将 /tmp/foo 从远程 Pod 复制到本地的 /tmp/bar +kubectl cp /:/tmp/foo /tmp/bar ``` ## {{% heading "options" %}} @@ -234,30 +234,6 @@ TLS 客户端密钥文件路径。

    -     - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_edit/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_edit/_index.md index 9dae99f253..fcf8b7fe34 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_edit/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_edit/_index.md @@ -379,30 +379,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_events/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_events/_index.md index 0f24a4b453..9f6ea4af6d 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_events/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_events/_index.md @@ -67,7 +67,7 @@ kubectl events --types=Warning,Normal ## {{% heading "options" %}} -
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -在 GCE 防火墙中打开 CIDR，以进行第 7 层负载均衡流量代理和健康状况检查。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -在 GCE 防火墙中打开 CIDR，以进行第 4 层负载均衡流量代理和健康状况检查。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    +
    @@ -307,30 +307,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From 1bda35ea7bbec0c1b6c34f25f4fe2fae533309dc Mon Sep 17 00:00:00 2001 From: Arhell Date: Fri, 23 Aug 2024 01:17:53 +0300 Subject: [PATCH 152/408] [ko] add the missing newline --- content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md b/content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md index 0dff130aa4..6d88bb8b90 100644 --- a/content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md +++ b/content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md @@ -15,6 +15,7 @@ weight: 50 ## docker run nginx 디플로이먼트(Deployment)를 실행하고 해당 디플로이먼트를 노출시키려면, [kubectl create deployment](/docs/reference/generated/kubectl/kubectl-commands#-em-deployment-em-)을 참고한다. + docker: ```shell From 65defbec5a344836fb0b896883a3d1f291368bb8 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Thu, 22 Aug 2024 14:00:06 +0800 Subject: [PATCH 153/408] [zh] Sync kubectl_create/* files --- .../generated/kubectl_create/_index.md | 24 ---------------- .../kubectl_create_clusterrole.md | 24 ---------------- .../kubectl_create_clusterrolebinding.md | 24 ---------------- .../kubectl_create_configmap.md | 24 ---------------- .../kubectl_create/kubectl_create_cronjob.md | 24 ---------------- .../kubectl_create_deployment.md | 24 ---------------- .../kubectl_create/kubectl_create_ingress.md | 24 ---------------- .../kubectl_create/kubectl_create_job.md | 24 ---------------- .../kubectl_create_namespace.md | 24 ---------------- .../kubectl_create_poddisruptionbudget.md | 24 ---------------- .../kubectl_create_priorityclass.md | 24 ---------------- .../kubectl_create/kubectl_create_quota.md | 24 ---------------- .../kubectl_create/kubectl_create_role.md | 24 ---------------- .../kubectl_create_rolebinding.md | 26 +---------------- .../kubectl_create_serviceaccount.md | 24 ---------------- .../kubectl_create/kubectl_create_token.md | 28 ++----------------- 16 files changed, 3 insertions(+), 387 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/_index.md index ecdaa44d8b..0d2943ebf5 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/_index.md @@ -365,30 +365,6 @@ TLS 客户端密钥文件的路径。

    -     - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_clusterrole.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_clusterrole.md index 3c9efde42f..d3e1e6c62f 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_clusterrole.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_clusterrole.md @@ -352,30 +352,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_clusterrolebinding.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_clusterrolebinding.md index 4a2a1ce7ad..0deefec08c 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_clusterrolebinding.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_clusterrolebinding.md @@ -310,30 +310,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_configmap.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_configmap.md index b5e69c0786..f3b0552caa 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_configmap.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_configmap.md @@ -346,30 +346,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_cronjob.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_cronjob.md index 4b2dc6fdb2..9fc5374aad 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_cronjob.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_cronjob.md @@ -304,30 +304,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_deployment.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_deployment.md index 8ec6860b99..d55d5c43d6 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_deployment.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_deployment.md @@ -318,30 +318,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_ingress.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_ingress.md index 4be686807c..bca106299d 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_ingress.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_ingress.md @@ -346,30 +346,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_job.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_job.md index 9c3d5d1135..119e1eccb7 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_job.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_job.md @@ -298,30 +298,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_namespace.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_namespace.md index 4b73e6ca7e..81f7d96796 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_namespace.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_namespace.md @@ -263,30 +263,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_poddisruptionbudget.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_poddisruptionbudget.md index cc8a147832..abc9a2ba1a 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_poddisruptionbudget.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_poddisruptionbudget.md @@ -308,30 +308,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_priorityclass.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_priorityclass.md index 32f8582970..33d34ad106 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_priorityclass.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_priorityclass.md @@ -322,30 +322,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_quota.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_quota.md index 3ebaee89d1..368a8e7a7a 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_quota.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_quota.md @@ -293,30 +293,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_role.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_role.md index f8c5e44287..ed7740bbf0 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_role.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_role.md @@ -316,30 +316,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_rolebinding.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_rolebinding.md index c9a7df1577..1c8a866766 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_rolebinding.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_rolebinding.md @@ -32,7 +32,7 @@ kubectl create rolebinding NAME --clusterrole=NAME|--role=NAME [--user=用户名 # Create a role binding for user1, user2, and group1 using the admin cluster role kubectl create rolebinding admin --clusterrole=admin --user=user1 --user=user2 --group=group1 - # Create a role binding for serviceaccount monitoring:sa-dev using the admin role + # Create a role binding for service account monitoring:sa-dev using the admin role kubectl create rolebinding admin-binding --role=admin --serviceaccount=monitoring:sa-dev ``` --> @@ -328,30 +328,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_serviceaccount.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_serviceaccount.md index 01d7d8bd8d..4b12394b5d 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_serviceaccount.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_serviceaccount.md @@ -244,30 +244,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_token.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_token.md index df2ed2005c..4078099aac 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_token.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_create/kubectl_create_token.md @@ -105,9 +105,9 @@ Audience of the requested token. If unset, defaults to requesting a token for us @@ -296,30 +296,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From 77cb162195744d3b357f7ab5936a45a187789118 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Thu, 22 Aug 2024 17:34:28 +0800 Subject: [PATCH 154/408] [zh] Add a task: image-volumes.md and its dependent files --- .../feature-gates/image-volume.md | 19 +++ .../configure-pod-container/image-volumes.md | 118 ++++++++++++++++++ .../zh-cn/examples/pods/image-volumes.yaml | 17 +++ 3 files changed, 154 insertions(+) create mode 100644 content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/image-volume.md create mode 100644 content/zh-cn/docs/tasks/configure-pod-container/image-volumes.md create mode 100644 content/zh-cn/examples/pods/image-volumes.yaml diff --git a/content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/image-volume.md b/content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/image-volume.md new file mode 100644 index 0000000000..2fdafa317a --- /dev/null +++ b/content/zh-cn/docs/reference/command-line-tools-reference/feature-gates/image-volume.md @@ -0,0 +1,19 @@ +--- +title: ImageVolume +content_type: feature_gate +_build: + list: never + render: false + +stages: + - stage: alpha + defaultValue: false + fromVersion: "1.31" +--- + + +允许在 Pod 中使用 [`image`](/zh-cn/docs/concepts/storage/volumes/) 卷源。 +这个卷源允许你将容器镜像挂载为只读卷。 diff --git a/content/zh-cn/docs/tasks/configure-pod-container/image-volumes.md b/content/zh-cn/docs/tasks/configure-pod-container/image-volumes.md new file mode 100644 index 0000000000..fb396c8fd3 --- /dev/null +++ b/content/zh-cn/docs/tasks/configure-pod-container/image-volumes.md @@ -0,0 +1,118 @@ +--- +title: Pod 使用镜像卷 +reviewers: +content_type: task +weight: 210 +min-kubernetes-server-version: v1.31 +--- + + + + +{{< feature-state feature_gate_name="ImageVolume" >}} + + +本页展示了如何使用镜像卷配置 Pod。此特性允许你在容器内挂载来自 OCI 镜像仓库的内容。 + +## {{% heading "prerequisites" %}} + +{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} + + +- 容器运行时需要支持镜像卷特性 +- 你需要能够在主机上执行命令 +- 你需要能够进入 Pod 执行命令 +- 你需要启用 `ImageVolume` + [特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/) + + + + +## 运行使用镜像卷的 Pod {#create-pod} + +为 Pod 启用镜像卷的方式是：在 `.spec` 中将 `volumes.[*].image` +字段设置为一个有效的镜像并在容器的 `volumeMounts` 中消费此镜像。例如： + +{{% code_sample file="pods/image-volumes.yaml" %}} + + +1. 在你的集群上创建 Pod： + + ```shell + kubectl apply -f https://k8s.io/examples/pods/image-volumes.yaml + ``` + + +2. 挂接到容器： + + ```shell + kubectl attach -it image-volume bash + ``` + + +3. 查看卷中某个文件的内容： + + ```shell + cat /volume/dir/file + ``` + + + 输出类似于： + + ```none + 1 + ``` + + + 你还可以查看不同路径中的另一个文件： + + ```shell + cat /volume/file + ``` + + + 输出类似于： + + ```none + 2 + ``` + + +## 进一步阅读 + +- [`image` 卷](/zh-cn/docs/concepts/storage/volumes/#image) diff --git a/content/zh-cn/examples/pods/image-volumes.yaml b/content/zh-cn/examples/pods/image-volumes.yaml new file mode 100644 index 0000000000..3a3cc79a4a --- /dev/null +++ b/content/zh-cn/examples/pods/image-volumes.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Pod +metadata: + name: image-volume +spec: + containers: + - name: shell + command: ["sleep", "infinity"] + image: debian + volumeMounts: + - name: volume + mountPath: /volume + volumes: + - name: volume + image: + reference: quay.io/crio/artifact:v1 + pullPolicy: IfNotPresent From 96e8e0b808211edbef37c84a2853c9e9ded01b58 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Fri, 23 Aug 2024 10:03:48 +0800 Subject: [PATCH 155/408] [zh] Sync kubeadm_certs.md and its dependent files --- .../_index.md} | 2 +- .../kubeadm_certs_certificate-key.md | 0 .../kubeadm_certs_check-expiration.md | 10 ++-- .../kubeadm_certs_generate-csr.md | 8 +-- .../kubeadm_certs_renew.md | 0 .../kubeadm_certs_renew_admin.conf.md | 8 ++- .../kubeadm_certs_renew_all.md | 0 ...beadm_certs_renew_apiserver-etcd-client.md | 0 ...dm_certs_renew_apiserver-kubelet-client.md | 0 .../kubeadm_certs_renew_apiserver.md | 10 ++-- ...adm_certs_renew_controller-manager.conf.md | 2 + ...adm_certs_renew_etcd-healthcheck-client.md | 10 ++-- .../kubeadm_certs_renew_etcd-peer.md | 0 .../kubeadm_certs_renew_etcd-server.md | 0 .../kubeadm_certs_renew_front-proxy-client.md | 0 .../kubeadm_certs_renew_scheduler.conf.md | 0 .../kubeadm_certs_renew_super-admin.conf.md | 0 .../setup-tools/kubeadm/kubeadm-certs.md | 55 +++++++++---------- 18 files changed, 53 insertions(+), 52 deletions(-) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{kubeadm_certs.md => kubeadm_certs/_index.md} (97%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_certificate-key.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_check-expiration.md (92%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_generate-csr.md (94%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_admin.conf.md (93%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_all.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_apiserver-etcd-client.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_apiserver-kubelet-client.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_apiserver.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_controller-manager.conf.md (99%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_etcd-healthcheck-client.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_etcd-peer.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_etcd-server.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_front-proxy-client.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_scheduler.conf.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_certs}/kubeadm_certs_renew_super-admin.conf.md (100%) diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/_index.md similarity index 97% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/_index.md index d593c4dc6b..8596da8fff 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/_index.md @@ -48,7 +48,7 @@ help for certs -### 继承于父命令的选项 +### 从父命令继承的选项
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string

    -要绑定令牌的目标对象的类别。支持的类别有 Pod 和 Secret。 +要绑定令牌的目标对象的类别。支持的类别有 Node、Pod 和 Secret。 如果设置了此参数，则必须提供 `--bound-object-name`。

    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_certificate-key.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_certificate-key.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_certificate-key.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_certificate-key.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_check-expiration.md similarity index 92% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_check-expiration.md index 8c0cfc3df9..52dcffb6c9 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_check-expiration.md @@ -117,11 +117,13 @@ text|json|yaml|go-template|go-template-file|template|templatefile|jsonpath|jsonp @@ -145,7 +147,7 @@ If true, keep the managedFields when printing objects in JSON or YAML format. -### 继承于父命令的选项 +### 从父命令继承的选项
    +

    -

    在和集群连接时使用该 kubeconfig 文件。 -如果此标志未被设置，那么将会在一些标准的位置去搜索存在的 kubeconfig 文件。

    +在和集群连接时使用该 kubeconfig 文件。 +如果此标志未被设置，那么将会在一些标准的位置去搜索存在的 kubeconfig 文件。 +
    diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_generate-csr.md similarity index 94% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_generate-csr.md index defd852d32..02ff510ac6 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_generate-csr.md @@ -1,7 +1,7 @@ -生成密钥和证书签名请求 +生成密钥和证书签名请求。 -此命令设计用于 [Kubeadm 外部 CA 模式](https://kubernetes.io/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#external-ca-mode)。 +此命令设计用于 [Kubeadm 外部 CA 模式](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#external-ca-mode)。 它生成你可以提交给外部证书颁发机构进行签名的 CSR。 -``` +```shell # 以下命令将为所有控制平面证书和 kubeconfig 文件生成密钥和 CSR： kubeadm certs generate-csr --kubeconfig-dir /tmp/etc-k8s --cert-dir /tmp/etc-k8s/pki ``` @@ -126,7 +126,7 @@ The path where to save the kubeconfig file. -### 继承于父命令的选项 +### 从父命令继承的选项
    diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_admin.conf.md similarity index 93% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_admin.conf.md index 126e3eeee7..b43532b3ae 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_admin.conf.md @@ -91,11 +91,13 @@ kubeadm certs renew admin.conf [flags] diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_all.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_all.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-etcd-client.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-etcd-client.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-kubelet-client.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver-kubelet-client.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver.md index 0bae18c6f8..16db01393c 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_apiserver.md @@ -55,10 +55,10 @@ kubeadm certs renew apiserver [flags] @@ -69,10 +69,10 @@ The path where to save the certificates. @@ -83,10 +83,10 @@ kubeadm 配置文件的路径。 @@ -103,10 +103,10 @@ apiserver 子操作的帮助命令。 diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_controller-manager.conf.md similarity index 99% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_controller-manager.conf.md index 26f97dd813..691c968385 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_controller-manager.conf.md @@ -109,10 +109,12 @@ kubeadm certs renew controller-manager.conf [flags] diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-healthcheck-client.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-healthcheck-client.md index a71039b387..fe2263abd4 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-healthcheck-client.md @@ -55,10 +55,10 @@ kubeadm certs renew etcd-healthcheck-client [flags] @@ -69,10 +69,10 @@ The path where to save the certificates. @@ -82,10 +82,10 @@ kubeadm 配置文件的路径。 @@ -101,10 +101,10 @@ etcd-healthcheck-client 操作的帮助命令。 diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-peer.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-peer.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-server.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_etcd-server.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_front-proxy-client.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_front-proxy-client.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_scheduler.conf.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_scheduler.conf.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_super-admin.conf.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_super-admin.conf.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_super-admin.conf.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs/kubeadm_certs_renew_super-admin.conf.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-certs.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-certs.md index 2c2d776802..ad0d7d404f 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-certs.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-certs.md @@ -9,8 +9,8 @@ weight: 90 For more details on how these commands can be used, see [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/). --> -`kubeadm certs` 提供管理证书的工具。关于如何使用这些命令的细节，可参见 -[使用 kubeadm 管理证书](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 +`kubeadm certs` 提供管理证书的工具。关于如何使用这些命令的细节， +可参见[使用 kubeadm 管理证书](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 ## kubeadm certs {#cmd-certs} @@ -20,33 +20,31 @@ A collection of operations for operating Kubernetes certificates. 用来操作 Kubernetes 证书的一组命令。 {{< tabs name="tab-certs" >}} -{{< tab name="概览" include="generated/kubeadm_certs.md" />}} +{{< tab name="概览" include="generated/kubeadm_certs/_index.md" />}} {{< /tabs >}} - ## kubeadm certs renew {#cmd-certs-renew} -你可以使用 `all` 子命令来续订所有 Kubernetes 证书，也可以选择性地续订部分证书。 -更多的相关细节，可参见 -[手动续订证书](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#manual-certificate-renewal)。 +你可以使用 `all` 子命令来续订所有 Kubernetes 证书，也可以选择性地续订部分证书。更多的相关细节， +可参见[手动续订证书](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#manual-certificate-renewal)。 {{< tabs name="tab-certs-renew" >}} -{{< tab name="renew" include="generated/kubeadm_certs_renew.md" />}} -{{< tab name="all" include="generated/kubeadm_certs_renew_all.md" />}} -{{< tab name="admin.conf" include="generated/kubeadm_certs_renew_admin.conf.md" />}} -{{< tab name="apiserver-etcd-client" include="generated/kubeadm_certs_renew_apiserver-etcd-client.md" />}} -{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_certs_renew_apiserver-kubelet-client.md" />}} -{{< tab name="apiserver" include="generated/kubeadm_certs_renew_apiserver.md" />}} -{{< tab name="controller-manager.conf" include="generated/kubeadm_certs_renew_controller-manager.conf.md" />}} -{{< tab name="etcd-healthcheck-client" include="generated/kubeadm_certs_renew_etcd-healthcheck-client.md" />}} -{{< tab name="etcd-peer" include="generated/kubeadm_certs_renew_etcd-peer.md" />}} -{{< tab name="etcd-server" include="generated/kubeadm_certs_renew_etcd-server.md" />}} -{{< tab name="front-proxy-client" include="generated/kubeadm_certs_renew_front-proxy-client.md" />}} -{{< tab name="scheduler.conf" include="generated/kubeadm_certs_renew_scheduler.conf.md" />}} -{{< tab name="super-admin.conf" include="generated/kubeadm_certs_renew_super-admin.conf.md" />}} +{{< tab name="renew" include="generated/kubeadm_certs/kubeadm_certs_renew.md" />}} +{{< tab name="all" include="generated/kubeadm_certs/kubeadm_certs_renew_all.md" />}} +{{< tab name="admin.conf" include="generated/kubeadm_certs/kubeadm_certs_renew_admin.conf.md" />}} +{{< tab name="apiserver-etcd-client" include="generated/kubeadm_certs/kubeadm_certs_renew_apiserver-etcd-client.md" />}} +{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_certs/kubeadm_certs_renew_apiserver-kubelet-client.md" />}} +{{< tab name="apiserver" include="generated/kubeadm_certs/kubeadm_certs_renew_apiserver.md" />}} +{{< tab name="controller-manager.conf" include="generated/kubeadm_certs/kubeadm_certs_renew_controller-manager.conf.md" />}} +{{< tab name="etcd-healthcheck-client" include="generated/kubeadm_certs/kubeadm_certs_renew_etcd-healthcheck-client.md" />}} +{{< tab name="etcd-peer" include="generated/kubeadm_certs/kubeadm_certs_renew_etcd-peer.md" />}} +{{< tab name="etcd-server" include="generated/kubeadm_certs/kubeadm_certs_renew_etcd-server.md" />}} +{{< tab name="front-proxy-client" include="generated/kubeadm_certs/kubeadm_certs_renew_front-proxy-client.md" />}} +{{< tab name="scheduler.conf" include="generated/kubeadm_certs/kubeadm_certs_renew_scheduler.conf.md" />}} +{{< tab name="super-admin.conf" include="generated/kubeadm_certs/kubeadm_certs_renew_super-admin.conf.md" />}} {{< /tabs >}} ## kubeadm certs certificate-key {#cmd-certs-certificate-key} @@ -63,7 +61,7 @@ to enable the automatic copy of certificates when joining additional control-pla 命令，从而在添加新的控制面节点时能够自动完成证书复制。 {{< tabs name="tab-certs-certificate-key" >}} -{{< tab name="certificate-key" include="generated/kubeadm_certs_certificate-key.md" />}} +{{< tab name="certificate-key" include="generated/kubeadm_certs/kubeadm_certs_certificate-key.md" />}} {{< /tabs >}} ## kubeadm certs check-expiration {#cmd-certs-check-expiration} @@ -73,13 +71,11 @@ This command checks expiration for the certificates in the local PKI managed by For more details see [Check certificate expiration](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#check-certificate-expiration). --> -此命令检查 kubeadm 所管理的本地 PKI 中的证书是否以及何时过期。 -更多的相关细节，可参见 -[检查证书过期](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#check-certificate-expiration)。 - +此命令检查 kubeadm 所管理的本地 PKI 中的证书是否以及何时过期。更多的相关细节， +可参见[检查证书过期](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#check-certificate-expiration)。 {{< tabs name="tab-certs-check-expiration" >}} -{{< tab name="check-expiration" include="generated/kubeadm_certs_check-expiration.md" />}} +{{< tab name="check-expiration" include="generated/kubeadm_certs/kubeadm_certs_check-expiration.md" />}} {{< /tabs >}} ## kubeadm certs generate-csr {#cmd-certs-generate-csr} @@ -91,11 +87,11 @@ on how to use the command see [Signing certificate signing requests (CSR) generated by kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#signing-csr). --> 此命令可用来为所有控制面证书和 kubeconfig 文件生成密钥和 CSR（签名请求）。 -用户可以根据自身需要选择 CA 为 CSR 签名。要了解如何使用该命令的更多信息，请参阅 -[签署由 kubeadm 生成的证书签名请求（CSR）](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#signing-csr)。 +用户可以根据自身需要选择 CA 为 CSR 签名。要了解如何使用该命令的更多信息， +请参阅[签署由 kubeadm 生成的证书签名请求（CSR）](/zh-cn/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#signing-csr)。 {{< tabs name="tab-certs-generate-csr" >}} -{{< tab name="generate-csr" include="generated/kubeadm_certs_generate-csr.md" />}} +{{< tab name="generate-csr" include="generated/kubeadm_certs/kubeadm_certs_generate-csr.md" />}} {{< /tabs >}} ## {{% heading "whatsnext" %}} @@ -114,4 +110,3 @@ on how to use the command see * 用来回滚 `kubeadm init` 或 `kubeadm join` 对当前主机所做修改的 [kubeadm reset](/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-reset/) 命令 - From bb4bcafa7bff4c7ef56813bb73c9c5e7afb70f39 Mon Sep 17 00:00:00 2001 From: windsonsea Date: Fri, 23 Aug 2024 09:50:05 +0800 Subject: [PATCH 156/408] [zh] Sync kubeadm-join-phase.md and its dependent files --- .../_index.md} | 0 .../{ => kubeadm_join}/kubeadm_join_phase.md | 0 .../kubeadm_join_phase_control-plane-join.md | 0 ...beadm_join_phase_control-plane-join_all.md | 0 ...eadm_join_phase_control-plane-join_etcd.md | 0 ...e_control-plane-join_mark-control-plane.md | 0 ...ubeadm_join_phase_control-plane-prepare.md | 0 ...dm_join_phase_control-plane-prepare_all.md | 0 ..._join_phase_control-plane-prepare_certs.md | 0 ...ase_control-plane-prepare_control-plane.md | 0 ...se_control-plane-prepare_download-certs.md | 0 ..._phase_control-plane-prepare_kubeconfig.md | 0 .../kubeadm_join_phase_kubelet-start.md | 0 .../kubeadm_join_phase_preflight.md | 0 .../kubeadm_join_phase_wait-control-plane.md | 0 ..._phase_control-plane-join_update-status.md | 120 ------------------ .../setup-tools/kubeadm/kubeadm-join-phase.md | 34 ++--- .../setup-tools/kubeadm/kubeadm-join.md | 8 +- 18 files changed, 21 insertions(+), 141 deletions(-) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{kubeadm_join.md => kubeadm_join/_index.md} (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-join.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-join_all.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-join_etcd.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-join_mark-control-plane.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_all.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_certs.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_control-plane.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_download-certs.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_control-plane-prepare_kubeconfig.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_kubelet-start.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_preflight.md (100%) rename content/zh-cn/docs/reference/setup-tools/kubeadm/generated/{ => kubeadm_join}/kubeadm_join_phase_wait-control-plane.md (100%) delete mode 100644 content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/_index.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/_index.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_all.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_all.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_all.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_etcd.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_etcd.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_etcd.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_mark-control-plane.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_mark-control-plane.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_mark-control-plane.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-join_mark-control-plane.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_all.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_all.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_all.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_certs.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_certs.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_certs.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_certs.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_control-plane.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_control-plane.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_control-plane.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_download-certs.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_download-certs.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_download-certs.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_download-certs.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_kubeconfig.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_kubeconfig.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-prepare_kubeconfig.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_kubeconfig.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_kubelet-start.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_kubelet-start.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_kubelet-start.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_kubelet-start.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_preflight.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_preflight.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_preflight.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_preflight.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_wait-control-plane.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_wait-control-plane.md similarity index 100% rename from content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_wait-control-plane.md rename to content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join/kubeadm_join_phase_wait-control-plane.md diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md deleted file mode 100644 index dd376a9057..0000000000 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_join_phase_control-plane-join_update-status.md +++ /dev/null @@ -1,120 +0,0 @@ - -将新的控制平面节点注册到 kubeadm-config ConfigMap 维护的 ClusterStatus 中（已弃用）。 - - -## 概要 - - -将新的控制平面节点注册到 kubeadm-config ConfigMap 维护的 ClusterStatus 中（已弃用）。 - -``` -kubeadm join phase control-plane-join update-status [flags] -``` - - -### 选项 - -
    +

    -

    与集群通信时使用的 kubeconfig 文件。 -如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。

    +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +
    +

    -

    保存证书的路径。

    +

    -

    kubeadm 配置文件的路径。

    +

    -

    apiserver 子操作的帮助命令。

    +

    -

    与集群通信时使用的 kubeconfig 文件。 如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。

    @@ -133,10 +133,10 @@ The kubeconfig file to use when talking to the cluster. If the flag is not set,
    +

    -

    [实验] 到 '真实' 主机根文件系统的路径。

    +

    使用 Kubernetes 证书 API 续订证书。 +
    +

    -

    保存证书的路径。

    +

    -

    kubeadm 配置文件的路径。

    +

    -

    etcd-healthcheck-client 操作的帮助命令。

    +

    -

    与集群通信时使用的 kubeconfig 文件。 如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。

    @@ -131,10 +131,10 @@ The kubeconfig file to use when talking to the cluster. If the flag is not set,
    +

    -

    [实验] 到 '真实' 主机根文件系统的路径。

    ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    --apiserver-advertise-address string
    - -

    如果该节点托管一个新的控制平面实例，则 API 服务器将公布其正在侦听的 IP 地址。如果未设置，则使用默认网络接口。

    -
    --config string
    - -

    kubeadm 配置文件的路径。

    -
    --control-plane
    - -

    在此节点上创建一个新的控制平面实例。

    -
    -h, --help
    - -

    update-status 操作的帮助命令。

    -
    --node-name string
    - -

    指定节点名称。

    -
    - - -### 从父命令中继承的选项 - - ---- - - - - - - - - - - -
    --rootfs string
    - -

    [实验] 到 '真实' 主机根文件系统的路径。

    -
    diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join-phase.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join-phase.md index 3f2c81f2df..b29e2acf8c 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join-phase.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join-phase.md @@ -1,11 +1,12 @@ --- title: kubeadm join phase weight: 90 +content_type: concept --- - `kubeadm join phase` 与 -[kubeadm join 工作流程](/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join/#join-workflow) -一致，后台都使用相同的代码。 +[kubeadm join 工作流程](/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join/#join-workflow)一致， +后台都使用相同的代码。 ## kubeadm join phase {#cmd-join-phase} {{< tabs name="tab-phase" >}} -{{< tab name="phase" include="generated/kubeadm_join_phase.md" />}} +{{< tab name="phase" include="generated/kubeadm_join/kubeadm_join_phase.md" />}} {{< /tabs >}} ## kubeadm join phase preflight {#cmd-join-phase-preflight} @@ -38,7 +39,7 @@ Using this phase you can execute preflight checks on a joining node. 使用此命令可以在即将加入集群的节点上执行启动前检查。 {{< tabs name="tab-preflight" >}} -{{< tab name="preflight" include="generated/kubeadm_join_phase_preflight.md" />}} +{{< tab name="preflight" include="generated/kubeadm_join/kubeadm_join_phase_preflight.md" />}} {{< /tabs >}} ## kubeadm join phase control-plane-prepare {#cmd-join-phase-control-plane-prepare} @@ -49,12 +50,12 @@ Using this phase you can prepare a node for serving a control-plane. 使用此阶段，你可以准备一个作为控制平面的节点。 {{< tabs name="tab-control-plane-prepare" >}} -{{< tab name="control-plane-prepare" include="generated/kubeadm_join_phase_control-plane-prepare.md" />}} -{{< tab name="all" include="generated/kubeadm_join_phase_control-plane-prepare_all.md" />}} -{{< tab name="download-certs" include="generated/kubeadm_join_phase_control-plane-prepare_download-certs.md" />}} -{{< tab name="certs" include="generated/kubeadm_join_phase_control-plane-prepare_certs.md" />}} -{{< tab name="kubeconfig" include="generated/kubeadm_join_phase_control-plane-prepare_kubeconfig.md" />}} -{{< tab name="control-plane" include="generated/kubeadm_join_phase_control-plane-prepare_control-plane.md" />}} +{{< tab name="control-plane-prepare" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare.md" />}} +{{< tab name="all" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_all.md" />}} +{{< tab name="download-certs" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_download-certs.md" />}} +{{< tab name="certs" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_certs.md" />}} +{{< tab name="kubeconfig" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_kubeconfig.md" />}} +{{< tab name="control-plane" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-prepare_control-plane.md" />}} {{< /tabs >}} ## kubeadm join phase kubelet-start {#cmd-join-phase-kubelet-start} @@ -65,7 +66,7 @@ Using this phase you can write the kubelet settings, certificates and (re)start 使用此阶段，你可以配置 kubelet 设置、证书和（重新）启动 kubelet。 {{< tabs name="tab-kubelet-start" >}} -{{< tab name="kubelet-start" include="generated/kubeadm_join_phase_kubelet-start.md" />}} +{{< tab name="kubelet-start" include="generated/kubeadm_join/kubeadm_join_phase_kubelet-start.md" />}} {{< /tabs >}} ## kubeadm join phase control-plane-join {#cmd-join-phase-control-plane-join} @@ -76,11 +77,10 @@ Using this phase you can join a node as a control-plane instance. 使用此阶段，你可以将节点作为控制平面实例加入。 {{< tabs name="tab-control-plane-join" >}} -{{< tab name="control-plane-join" include="generated/kubeadm_join_phase_control-plane-join.md" />}} -{{< tab name="all" include="generated/kubeadm_join_phase_control-plane-join_all.md" />}} -{{< tab name="etcd" include="generated/kubeadm_join_phase_control-plane-join_etcd.md" />}} -{{< tab name="update-status" include="generated/kubeadm_join_phase_control-plane-join_update-status.md" />}} -{{< tab name="mark-control-plane" include="generated/kubeadm_join_phase_control-plane-join_mark-control-plane.md" />}} +{{< tab name="control-plane-join" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-join.md" />}} +{{< tab name="all" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-join_all.md" />}} +{{< tab name="etcd" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-join_etcd.md" />}} +{{< tab name="mark-control-plane" include="generated/kubeadm_join/kubeadm_join_phase_control-plane-join_mark-control-plane.md" />}} {{< /tabs >}} ## {{% heading "whatsnext" %}} diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join.md index 545c95c8ac..82c4f0af69 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/kubeadm-join.md @@ -20,7 +20,7 @@ This command initializes a Kubernetes worker node and joins it to the cluster. -{{< include "generated/kubeadm_join.md" >}} +{{< include "generated/kubeadm_join/_index.md" >}} 要允许 `kubeadm join` 使用预定义的 kubelet 凭据并跳过客户端 TLS 引导程序和新节点的 CSR 批准： @@ -603,10 +603,10 @@ the [kubeadm config migrate](/docs/reference/setup-tools/kubeadm/kubeadm-config/ 有关配置的字段和用法的更多信息，你可以导航到我们的 -[API 参考页](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta3/)。 +[API 参考页](/zh-cn/docs/reference/config-api/kubeadm-config.v1beta4/)。 ## {{% heading "whatsnext" %}} From b9fec59288bb56e182c2748e4769579b19cf8fd3 Mon Sep 17 00:00:00 2001 From: "xin.li" Date: Fri, 23 Aug 2024 13:46:57 +0800 Subject: [PATCH 157/408] [zh-cn]sync kubectl_options kubectl_port-forward kubectl_proxy kubectl_scale Signed-off-by: xin.li --- .../generated/kubectl_options/_index.md | 28 ++----------------- .../generated/kubectl_port-forward/_index.md | 24 ---------------- .../kubectl/generated/kubectl_proxy/_index.md | 26 +---------------- .../kubectl/generated/kubectl_scale/_index.md | 24 ---------------- 4 files changed, 3 insertions(+), 99 deletions(-) diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_options/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_options/_index.md index 37f949f8b0..8955f84f36 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_options/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_options/_index.md @@ -19,7 +19,7 @@ Print the list of flags inherited by all commands --> 打印被所有命令继承的标志列表。 -``` +```shell kubectl options [flags] ``` @@ -28,7 +28,7 @@ kubectl options [flags] -``` +```shell # 打印被所有命令继承的标志 kubectl options ``` @@ -151,30 +151,6 @@ TLS 客户端密钥文件的路径。

    - ---cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - - ---cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - --cluster string diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_port-forward/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_port-forward/_index.md index fa7c59d8d0..9708ddd25a 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_port-forward/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_port-forward/_index.md @@ -212,30 +212,6 @@ TLS 客户端密钥文件的路径。

    - ---cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - - ---cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16 - - -

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    - - --cluster string diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_proxy/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_proxy/_index.md index 53ca12fbea..6be1f1c672 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_proxy/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_proxy/_index.md @@ -67,7 +67,7 @@ kubectl proxy --api-prefix=/k8s-api ## {{% heading "options" %}} - +
    @@ -339,30 +339,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - diff --git a/content/zh-cn/docs/reference/kubectl/generated/kubectl_scale/_index.md b/content/zh-cn/docs/reference/kubectl/generated/kubectl_scale/_index.md index c4f664afc0..cbc4450c17 100644 --- a/content/zh-cn/docs/reference/kubectl/generated/kubectl_scale/_index.md +++ b/content/zh-cn/docs/reference/kubectl/generated/kubectl_scale/_index.md @@ -352,30 +352,6 @@ TLS 客户端密钥文件的路径。

    - - - - - - - - - - - - - - From 36c8de6aea6bed866502fe75f3d4e1625c57e8f0 Mon Sep 17 00:00:00 2001 From: xin gu <418294249@qq.com> Date: Mon, 19 Aug 2024 11:05:33 +0800 Subject: [PATCH 158/408] sync cpu-management-policies custom-resource-definitions scheduling-gpus Update cpu-management-policies.md Update cpu-management-policies.md u --- .../cpu-management-policies.md | 36 ++++++++++++++++++- .../custom-resource-definitions.md | 21 ++++++----- .../docs/tasks/manage-gpus/scheduling-gpus.md | 4 +-- 3 files changed, 50 insertions(+), 11 deletions(-) diff --git a/content/zh-cn/docs/tasks/administer-cluster/cpu-management-policies.md b/content/zh-cn/docs/tasks/administer-cluster/cpu-management-policies.md index d68384904b..95c9c914bd 100644 --- a/content/zh-cn/docs/tasks/administer-cluster/cpu-management-policies.md +++ b/content/zh-cn/docs/tasks/administer-cluster/cpu-management-policies.md @@ -419,6 +419,7 @@ The following policy options exist for the static `CPUManager` policy: * `full-pcpus-only` (beta, visible by default) (1.22 or higher) * `distribute-cpus-across-numa` (alpha, hidden by default) (1.23 or higher) * `align-by-socket` (alpha, hidden by default) (1.25 or higher) +* `distribute-cpus-across-cores` (alpha, hidden by default) (1.31 or higher) --> #### Static 策略选项 @@ -429,8 +430,9 @@ The following policy options exist for the static `CPUManager` policy: 静态 `CPUManager` 策略存在以下策略选项： * `full-pcpus-only`（Beta，默认可见）（1.22 或更高版本） -* `distribute-cpus-across-numa`（alpha，默认隐藏）（1.23 或更高版本） +* `distribute-cpus-across-numa`（Alpha，默认隐藏）（1.23 或更高版本） * `align-by-socket`（Alpha，默认隐藏）（1.25 或更高版本） +* `distribute-cpus-across-cores` (Alpha，默认隐藏) (1.31 或更高版本) +如果指定了 `distribute-cpus-across-cores` 策略选项， +静态策略将尝试将虚拟核（硬件线程）分配到不同的物理核上。默认情况下， +`CPUManager` 倾向于将 CPU 打包到尽可能少的物理核上， +这可能导致同一物理核上的 CPU 争用，从而导致性能瓶颈。 +启用 `distribute-cpus-across-cores` 策略后，静态策略将确保 CPU 尽可能分布在多个物理核上， +从而减少同一物理核上的争用，提升整体性能。然而，需要注意的是，当系统负载较重时， +这一策略的效果可能会减弱。在这种情况下，减少争用的好处会减少。 +相反，默认行为可以帮助减少跨核的通信开销，在高负载条件下可能会提供更好的性能。 + +可以通过将 `distribute-cpus-across-cores=true` 添加到 `CPUManager` 策略选项中来启用 `distribute-cpus-across-cores` 选项。 +当前，该选项不能与 `full-pcpus-only` 或 `distribute-cpus-across-numa` 策略选项同时使用。 \ No newline at end of file diff --git a/content/zh-cn/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md b/content/zh-cn/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md index ce067620f9..435ff0ff6c 100644 --- a/content/zh-cn/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md +++ b/content/zh-cn/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md @@ -2732,24 +2732,29 @@ may also be used with field selectors when included in the `spec.versions[*].sel {{< feature-state feature_gate_name="CustomResourceFieldSelectors" >}} -你需要启用 `CustomResourceFieldSelectors` -[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/) -才能使用此行为，然后该行为将应用于集群中的所有 CustomResourceDefinition。 +在 Kubernetes {{< skew currentVersion >}} 中， +自定义资源的字段选择器功能默认启用（自 Kubernetes v1.31 起默认开启）。 +如果你想禁用此功能，可以通过关闭 `CustomResourceFieldSelectors` +[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/) 实现。 CustomResourceDefinition 的 `spec.versions[*].selectableFields` 字段可用于声明自定义资源中的哪些其他字段可在字段选择器中使用。 +这一功能依赖于 `CustomResourceFieldSelectors` +[特性门控](/zh-cn/docs/reference/command-line-tools-reference/feature-gates/)（自 Kubernetes v1.31 起默认启用）。 以下示例将 `.spec.color` 和 `.spec.size` 字段添加为可选字段。 将 CustomResourceDefinition 保存到 `shirt-resource-definition.yaml`： diff --git a/content/zh-cn/docs/tasks/manage-gpus/scheduling-gpus.md b/content/zh-cn/docs/tasks/manage-gpus/scheduling-gpus.md index 6f9a40b4b1..fa212fabf0 100644 --- a/content/zh-cn/docs/tasks/manage-gpus/scheduling-gpus.md +++ b/content/zh-cn/docs/tasks/manage-gpus/scheduling-gpus.md @@ -224,9 +224,9 @@ spec: #### GPU vendor implementations - [Intel](https://intel.github.io/intel-device-plugins-for-kubernetes/cmd/gpu_plugin/README.html) -- [NVIDIA](https://github.com/NVIDIA/gpu-feature-discovery/#readme) +- [NVIDIA](https://github.com/NVIDIA/k8s-device-plugin) --> #### GPU 供应商实现 - [Intel](https://intel.github.io/intel-device-plugins-for-kubernetes/cmd/gpu_plugin/README.html) -- [NVIDIA](https://github.com/NVIDIA/gpu-feature-discovery/#readme) +- [NVIDIA](https://github.com/NVIDIA/k8s-device-plugin) \ No newline at end of file From 493ef1ba1cc078e77648c300819e16963e464397 Mon Sep 17 00:00:00 2001 From: vaibhav2107 Date: Fri, 23 Aug 2024 15:14:04 +0530 Subject: [PATCH 159/408] Fixed the security white-paper link in cloud-native-security.md --- content/en/docs/concepts/security/cloud-native-security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/cloud-native-security.md b/content/en/docs/concepts/security/cloud-native-security.md index d8f4ccdd7b..c5a213581b 100644 --- a/content/en/docs/concepts/security/cloud-native-security.md +++ b/content/en/docs/concepts/security/cloud-native-security.md @@ -24,7 +24,7 @@ There are localized versions available of this whitepaper; if you can link to on when localizing, that's even better. {{< /comment >}} -The CNCF [white paper](https://github.com/cncf/tag-security/tree/main/security-whitepaper) +The CNCF [white paper](https://github.com/cncf/tag-security/tree/main/community/resources/security-whitepaper) on cloud native security defines security controls and practices that are appropriate to different _lifecycle phases_. From e5477708545c98ea26ec5348921e199c4f241f3b Mon Sep 17 00:00:00 2001 From: mavk <535788792@qq.com> Date: Fri, 23 Aug 2024 20:32:38 +0800 Subject: [PATCH 160/408] [zh-cn] Update `/kubeadm_init/_index.md`, add `kubeadm_init` execute phases add `kubeadm_init` execute phases --- .../kubeadm/generated/kubeadm_init/_index.md | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/_index.md b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/_index.md index 561bfe774e..562a95a341 100644 --- a/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/_index.md +++ b/content/zh-cn/docs/reference/setup-tools/kubeadm/generated/kubeadm_init/_index.md @@ -18,6 +18,7 @@ The "init" command executes the following phases: --> "init" 命令执行以下阶段： + +``` +preflight 预检 +certs 生成证书 + /ca 生成自签名根 CA 用于配置其他 kubernetes 组件 + /apiserver 生成 apiserver 的证书 + /apiserver-kubelet-client 生成 apiserver 连接到 kubelet 的证书 + /front-proxy-ca 生成前端代理自签名CA(扩展apiserver) + /front-proxy-client 生成前端代理客户端的证书（扩展 apiserver） + /etcd-ca 生成 etcd 自签名 CA + /etcd-server 生成 etcd 服务器证书 + /etcd-peer 生成 etcd 节点相互通信的证书 + /etcd-healthcheck-client 生成 etcd 健康检查的证书 + /apiserver-etcd-client 生成 apiserver 访问 etcd 的证书 + /sa 生成用于签署服务帐户令牌的私钥和公钥 +kubeconfig 生成建立控制平面和管理所需的所有 kubeconfig 文件 + /admin 生成一个 kubeconfig 文件供管理员使用以及供 kubeadm 本身使用 + /super-admin 为超级管理员生成 kubeconfig 文件 + /kubelet 为 kubelet 生成一个 kubeconfig 文件，*仅*用于集群引导 + /controller-manager 生成 kubeconfig 文件供控制器管理器使用 + /scheduler 生成 kubeconfig 文件供调度程序使用 +etcd 为本地 etcd 生成静态 Pod 清单文件 + /local 为本地单节点本地 etcd 实例生成静态 Pod 清单文件 +control-plane 生成建立控制平面所需的所有静态 Pod 清单文件 + /apiserver 生成 kube-apiserver 静态 Pod 清单 + /controller-manager 生成 kube-controller-manager 静态 Pod 清单 + /scheduler 生成 kube-scheduler 静态 Pod 清单 +kubelet-start 写入 kubelet 设置并启动（或重启） kubelet +upload-config 将 kubeadm 和 kubelet 配置上传到 ConfigMap + /kubeadm 将 kubeadm 集群配置上传到 ConfigMap + /kubelet 将 kubelet 组件配置上传到 ConfigMap +upload-certs 将证书上传到 kubeadm-certs +mark-control-plane 将节点标记为控制面 +bootstrap-token 生成用于将节点加入集群的引导令牌 +kubelet-finalize 在 TLS 引导后更新与 kubelet 相关的设置 + /experimental-cert-rotation 启用 kubelet 客户端证书轮换 +addon 安装用于通过一致性测试所需的插件 + /coredns 将 CoreDNS 插件安装到 Kubernetes 集群 + /kube-proxy 将 kube-proxy 插件安装到 Kubernetes 集群 +show-join-command 显示控制平面和工作节点的加入命令 +``` ``` kubeadm init [flags] From b153426c85dcf6500c64d651f97daddd8655a584 Mon Sep 17 00:00:00 2001 From: Matteo Bianchi <37507190+mbianchidev@users.noreply.github.com> Date: Fri, 23 Aug 2024 17:37:52 +0200 Subject: [PATCH 161/408] Fixed flag deprecations and updated Hugo version to latest (#47612) * Fixed flag deprecations and updated Hugo version to latest * Removed deprecated flag from css.html * Includes fix for Hindi and Russian Signed-off-by: mbianchidev * Update netlify.toml Applied node update (from my other PR) Co-authored-by: Dmitry Shurupov --------- Signed-off-by: mbianchidev Co-authored-by: Dmitry Shurupov --- content/hi/includes/index.md | 3 +++ content/ru/includes/index.md | 3 +++ layouts/docs/baseof.html | 4 ++-- layouts/partials/css.html | 2 +- layouts/partials/scripts.html | 2 +- netlify.toml | 2 +- 6 files changed, 11 insertions(+), 5 deletions(-) create mode 100644 content/hi/includes/index.md create mode 100644 content/ru/includes/index.md diff --git a/content/hi/includes/index.md b/content/hi/includes/index.md new file mode 100644 index 0000000000..3d65eaa0ff --- /dev/null +++ b/content/hi/includes/index.md @@ -0,0 +1,3 @@ +--- +headless: true +--- \ No newline at end of file diff --git a/content/ru/includes/index.md b/content/ru/includes/index.md new file mode 100644 index 0000000000..3d65eaa0ff --- /dev/null +++ b/content/ru/includes/index.md @@ -0,0 +1,3 @@ +--- +headless: true +--- \ No newline at end of file diff --git a/layouts/docs/baseof.html b/layouts/docs/baseof.html index 40c80fc21f..e75c288805 100644 --- a/layouts/docs/baseof.html +++ b/layouts/docs/baseof.html @@ -42,11 +42,11 @@ {{ partial "docs/auto-generated-pageinfo.html" . }} {{- end -}} {{- end -}} - {{ if (and (not .Params.hide_feedback) (.Site.Params.ui.feedback.enable) (.Site.GoogleAnalytics)) }} + {{ if (and (not .Params.hide_feedback) (.Site.Params.ui.feedback.enable) (.Site.Config.Services.GoogleAnalytics.ID)) }} {{ partial "feedback.html" .Site.Params.ui.feedback }} {{ end }} {{ partial "page-meta-lastmod.html" . }} - {{ if (.Site.DisqusShortname) }} + {{ if (.Site.Config.Services.Disqus.Shortname) }}
    {{ partial "disqus-comment.html" . }} {{ end }} diff --git a/layouts/partials/css.html b/layouts/partials/css.html index 9522306c03..20bde08e5f 100644 --- a/layouts/partials/css.html +++ b/layouts/partials/css.html @@ -1,6 +1,6 @@ -{{ $inServerMode := site.IsServer }} +{{ $inServerMode := hugo.IsServer }}
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string
    --cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L7 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16

    - -GCE 防火墙中为 L4 负载均衡流量代理和健康检查开放的 CIDR。 -

    --cluster string