From ab0ae3ec3f1fde29bae78e6480a6ca46e6ee1ce1 Mon Sep 17 00:00:00 2001 From: Mikko Ylinen Date: Wed, 24 Apr 2019 20:14:09 +0300 Subject: [PATCH] Blog post: Hardware Accelerated Crypto... (#13874) * Blog post: Hardware Accelerated Crypto... This adds a story of Hardware Accelerated SSL/TLS Termination in Ingress Controllers using Kubernetes Device Plugins and RuntimeClass. Signed-off-by: Mikko Ylinen * Update Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md * Rename Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md to 2019-04-23-Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md * Rename 2019-04-23-Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md to 2019-04-24-Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md --- ...ernetes-Device-Plugins-and-RuntimeClass.md | 174 ++++++++++++++++++ .../k8s-blog-fig1.png | Bin 0 -> 18873 bytes .../k8s-blog-fig2.png | Bin 0 -> 29587 bytes 3 files changed, 174 insertions(+) create mode 100644 content/en/blog/_posts/2019-04-24-Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md create mode 100644 static/images/blog/2019-04-23-hardware-accelerated-tls-termination/k8s-blog-fig1.png create mode 100644 static/images/blog/2019-04-23-hardware-accelerated-tls-termination/k8s-blog-fig2.png diff --git a/content/en/blog/_posts/2019-04-24-Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md b/content/en/blog/_posts/2019-04-24-Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md new file mode 100644 index 00000000000..1db938ef6a2 --- /dev/null +++ b/content/en/blog/_posts/2019-04-24-Hardware-Accelerated-SSLTLS-Termination-in-Ingress-Controllers-using-Kubernetes-Device-Plugins-and-RuntimeClass.md @@ -0,0 +1,174 @@ +--- +layout: blog +title: 'Hardware Accelerated SSL/TLS Termination in Ingress Controllers using Kubernetes Device Plugins and RuntimeClass' +date: 2019-04-24 +--- + +**Authors:** Mikko Ylinen (Intel) + +## Abstract + +A Kubernetes Ingress is a way to connect cluster services to the world outside the cluster. In order +to correctly route the traffic to service backends, the cluster needs an Ingress controller. The +Ingress controller is responsible for setting the right destinations to backends based on the +Ingress API objects’ information. The actual traffic is routed through a proxy server that +is responsible for tasks such as load balancing and SSL/TLS (later “SSL” refers to both SSL +or TLS ) termination. The SSL termination is a CPU heavy operation due to the crypto operations +involved. To offload some of the CPU intensive work away from the CPU, OpenSSL based proxy +servers can take the benefit of OpenSSL Engine API and dedicated crypto hardware. This frees +CPU cycles for other things and improves the overall throughput of the proxy server. + +In this blog post, we will show how easy it is to make hardware accelerated crypto available +for containers running the Ingress controller proxy using some of the recently created Kubernetes +building blocks: Device plugin framework and RuntimeClass. At the end, a reference setup is given +using an HAproxy based Ingress controller accelerated using Intel® QuickAssist Technology cards. + +## About Proxies, OpenSSL Engine and Crypto Hardware + +The proxy server plays a vital role in a Kubernetes Ingress Controller function. It proxies +the traffic to the backends per Ingress objects routes. Under heavy traffic load, the performance +becomes critical especially if the proxying involves CPU intensive operations like SSL crypto. + +The OpenSSL project provides the widely adopted library for implementing the SSL protocol. Of +the commonly known proxy servers used by Kubernetes Ingress controllers, Nginx and HAproxy use +OpenSSL. The CNCF graduated Envoy proxy uses BoringSSL but there seems to be [community interest +in having OpenSSL as the alternative](https://github.com/envoyproxy/envoy/pull/5161#issuecomment-446374130) for it too. + +The OpenSSL SSL protocol library relies on libcrypto that implements the cryptographic functions. +For quite some time now (first introduced in 0.9.6 release), OpenSSL has provided an [ENGINE +concept](https://github.com/openssl/openssl/blob/master/README.ENGINE) that allows these cryptographic operations to be offloaded to a dedicated crypto +acceleration hardware. Later, a special *dynamic* ENGINE enabled the crypto hardware specific +pieces to be implemented in an independent loadable module that can be developed outside the +OpenSSL code base and distributed separately. From the application’s perspective, this is also +ideal because they don’t need to know the details of how to use the hardware, and the hardware +specific module can be loaded/used when the hardware is available. + +Hardware based crypto can greatly improve Cloud applications’ performance due to hardware +accelerated processing in SSL operations as discussed, and can provide other crypto +services like key/random number generation. Clouds can make the hardware easily available +using the dynamic ENGINE and several loadable module implementations exist, for +example, [CloudHSM](https://docs.aws.amazon.com/cloudhsm/latest/userguide/openssl-library.html), [IBMCA](https://github.com/opencryptoki/openssl-ibmca), or [QAT Engine](https://github.com/intel/QAT_Engine/). + +For Cloud deployments, the ideal scenario is for these modules to be shipped as part of +the container workload. The workload would get scheduled on a node that provides the +underlying hardware that the module needs to access. On the other hand, the workloads +should run the same way and without code modifications regardless of the crypto acceleration +hardware being available or not. The OpenSSL dynamic engine enables this. Figure 1 below +illustrates these two scenarios using a typical Ingress Controller container as an example. +The red colored boxes indicate the differences between a container with a crypto hardware +engine enabled container vs. a “standard” one. It’s worth pointing out that the configuration +changes shown do not necessarily require another version of the container since the configurations +could be managed, e.g., using ConfigMaps. + +{{
}} + +## Hardware Resources and Isolation + +To be able to deploy workloads with hardware dependencies, Kubernetes provides excellent extension +and configurability mechanisms. Let’s take a closer look into Kubernetes the [device plugin framework](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) +(beta in 1.14) and [RuntimeClass](https://kubernetes.io/docs/concepts/containers/runtime-class/) (beta in 1.14) and learn how they can be leveraged to expose crypto +hardware to workloads. + +The device plugin framework, first introduced in Kubernetes 1.8, provides a way for hardware vendors +to register and allocate node hardware resources to Kubelets. The plugins implement the hardware +specific initialization logic and resource management. The pods can request hardware resources in +their PodSpec, which also guarantees the pod is scheduled on a node that can provide those resources. + +The device resource allocation for containers is non-trivial. For applications dealing with security, +the hardware level isolation is critical. The PCIe based crypto acceleration device functions can +benefit from IO hardware virtualization, through an I/O Memory Management Unit (IOMMU), to provide +the isolation: an *IOMMU group* the device belongs to provides the isolated resource for a workload +(assuming the crypto cards do not share the IOMMU group with other devices). The number of isolated +resources can be further increased if the PCIe device supports the Single-Root I/O Virtualization +(SR-IOV) specification. SR-IOV allows the PCIe device to be split further to *virtual functions* (VF), +derived from *physical function* (PF) devices, and each belonging to their own IOMMU group. To expose +these IOMMU isolated device functions to user space and containers, the host kernel should bind +them to a specific device driver. In Linux, this driver is vfio-pci and it makes each device +available through a character device in user space. The kernel vfio-pci driver provides user space +applications with a direct, IOMMU backed access to PCIe devices and functions, using a mechanism +called *PCI passthrough*. The interface can be leveraged by user space frameworks, such as the +Data Plane Development Kit (DPDK). Additionally, virtual machine (VM) hypervisors can provide +these user space device nodes to VMs and expose them as PCI devices to the guest kernel. +Assuming support from the guest kernel, the VM gets close to native performant direct access to the +underlying host devices. + +To advertise these device resources to Kubernetes, we can have a simple Kubernetes device plugin +that runs the initialization (i.e., binding), calls kubelet’s `Registration` gRPC service, and +implements the DevicePlugin gRPC service that kubelet calls to, e.g., to `Allocate` the resources +upon Pod creation. + +## Device Assignment and Pod Deployment + +At this point, you may ask what the container could do with a VFIO device node? The answer comes +after we first take a quick look into the Kubernetes RuntimeClass. + +The Kubernetes RuntimeClass was created to provide better control and configurability +over a variety of *runtimes* (an earlier [blog post](https://kubernetes.io/blog/2018/10/10/kubernetes-v1.12-introducing-runtimeclass/) goes into the details of the needs, +status and roadmap for it) that are available in the cluster. In essence, the RuntimeClass +provides cluster users better tools to pick and use the runtime that best suits for the pod use case. + +The OCI compatible [Kata Containers runtime](https://katacontainers.io/) provides workloads with a hardware virtualized +isolation layer. In addition to workload isolation, the Kata Containers VM has the added +side benefit that the VFIO devices, as `Allocate`’d by the device plugin, can be passed +through to the container as hardware isolated devices. The only requirement is that the +Kata Containers kernel has driver for the exposed device enabled. + +That’s all it really takes to enable hardware accelerated crypto for container workloads. To summarize: + + 1. Cluster needs a device plugin running on the node that provides the hardware + 2. Device plugin exposes the hardware to user space using the VFIO driver + 3. Pod requests the device resources and Kata Containers as the RuntimeClass in the PodSpec + 4. The container has the hardware adaptation library and the OpenSSL engine module + +Figure 2 shows the overall setup using the Container A illustrated earlier. + +{{
}} + +## Reference Setup + +Finally, we describe the necessary building blocks and steps to build a functional +setup described in Figure 2 that enables hardware accelerated SSL termination in +an Ingress Controller using an Intel® QuickAssist Technology (QAT) PCIe device. +It should be noted that the use cases are not limited to Ingress controllers, but +any OpenSSL based workload can be accelerated. + +### Cluster configuration: + * Kubernetes 1.14 (`RuntimeClass` and `DevicePlugin` feature gates enabled (both are `true` in 1.14) + * RuntimeClass ready runtime and Kata Containers configured + +### Host configuration: + * Intel® QAT driver release with the kernel drivers installed for both host kernel and Kata Containers kernel (or on a rootfs as loadable modules) + * [QAT device plugin](https://github.com/intel/intel-device-plugins-for-kubernetes/tree/master/cmd/qat_plugin) DaemonSet deployed + +### Ingress controller configuration and deployment: + * [HAproxy-ingress](https://github.com/jcmoraisjr/haproxy-ingress) ingress controller in a modified container that has + * the QAT HW HAL user space library (part of Intel® QAT SW release) and + * the [OpenSSL QAT Engine](https://github.com/intel/QAT_Engine/) built in + * Haproxy-ingress ConfigMap to enable QAT engine usage + * `ssl-engine=”qat”` + * `ssl-mode-async=true` + * Haproxy-ingress deployment `.yaml` to + * Request `qat.intel.com: n` resources + * Request `runtimeClassName: kata-containers` (name value depends on cluster config) + * (QAT device config file for each requested device resource with OpenSSL engine configured available in the container) + +Once the building blocks are available, the hardware accelerated SSL/TLS can be tested by following the [TLS termination +example](https://github.com/jcmoraisjr/haproxy-ingress/tree/master/examples/tls-termination) steps. In order to verify the hardware is used, you can check `/sys/kernel/debug/*/fw_counters` files on host as they +get updated by the Intel® QAT firmware. + +Haproxy-ingress and HAproxy are used because HAproxy can be directly configured to use the OpenSSL engine using +`ssl-engine [algo ALGOs]` configuration flag without modifications to the global openssl configuration file. +Moreover, HAproxy can offload configured algorithms using asynchronous calls (with `ssl-mode-async`) to further improve performance. + +## Call to Action + +In this blog post we have shown how Kubernetes Device Plugins and RuntimeClass can be used to provide isolated hardware +access for applications in pods to offload crypto operations to hardware accelerators. Hardware accelerators can be used +to speed up crypto operations and also save CPU cycles to other tasks. We demonstrated the setup using HAproxy that already +supports asynchronous crypto offload with OpenSSL. + +The next steps for our team is to repeat the same for Envoy (with an OpenSSL based TLS transport socket built +as an extension). Furthermore, we are working to enhance Envoy to be able to [offload BoringSSL asynchronous +private key operations](https://github.com/envoyproxy/envoy/issues/6248) to a crypto acceleration hardware. Any review feedback or help is appreciated! + +How many CPU cycles can your crypto application save for other tasks when offloading crypto processing to a dedicated accelerator? diff --git a/static/images/blog/2019-04-23-hardware-accelerated-tls-termination/k8s-blog-fig1.png b/static/images/blog/2019-04-23-hardware-accelerated-tls-termination/k8s-blog-fig1.png new file mode 100644 index 0000000000000000000000000000000000000000..9b8ce51185b034492f458737f0a9567d6e57920b GIT binary patch literal 18873 zcmZs@cUTi$_XQe2r75U1l_vU1FCsNmm1dzSNUtIS(gGnw2vsR65=5GG0RibCEws?2 z2$CSZgc2#ChE9M`?!>oz_xIfU2lLEK&YW{*=FHw}?X@>=^>ww*Fm!R+RvF2^4U!H-f zB#NJ-7{~Fz5rh{}Je93(GF(spyQ2~oNqz0FJEtGLx<6y#Nc~Pk5JvM?eCfs5pxY*8 z*0$N`e0RIKyK2`(HdiZ!wLGnBK4uRGuE13k$(M%;N69}E6Q!icDO>vwqUKYM5No5@ zgTfsp=OU?FnX!)_2xSACyyM;sNyYe)oM#glJ}c7QDz~HaCFaqEiVL+K4`D9%hKoAm zdA%(2c1CMC!d^~bo=xx%M~+uLo2W7^BnPnIqD&hf0X-c&?g*&^y1apl1Ga-tS6$4? zS{$FlP#A2+ivlPxBO}N-)1Yvh&gn|I3$g${3xzL z>A87_%Z8FwYu{xe$pu#AI`Dhxp!CK;kQvC|^CvoHPqxu!CsEQ|T905Y-3kvhos*NR zTrizX*n?ie?moQE5;*wiT!PtX22<`#E_H;YqU955K@ifo8;KkZh5DW2Fd{U#hLJhq zVk#e1KN$}9zr(A)C3v{BvoxU?*L3u((&a?SP~P~7eP`I^6-6^kg0cCwHc8;v!U20Q zMo+40I+|O`KJ*^)v@#rgYzlvdbl&I8-@?g892r+`r=uHv14eB9Z}-?a??b3Nq^Uay z0tGPDl-#aW?P)Y>%)KHMf~~w|3XdsChgdtJrVJb2OL&dUkG@FOIfs!`=(Cjfe^j~p z@p6;@{mM1%Yjmj?b2zfilBa~TsF1jfkDdxy-E&#c?Fp}XvNnzpzYQ~`4P3~vZ$!Ob z(>_hg9z=IPr#o@;lf{&MjhNAq@yw$qULS9D=(f?-W-z53zZPobUpZ z%yF$^&sq-|m{VK59WZQ67%@DG^lCFa*qYr(A}>`LY~{8NDo)WS)hDF?1fjnPb71&Y zHfCP<5TWULx4ro{Qr!j4Pk=YA7^c5>en)HU^+o@zp5iHAF8ACpd7}A+F!4x(r*A7D z_sr&U%!0-jZus-@P(AB(i)Cg9I?~`^ttx59fKkk9-k=}naDOgDzRRC2=%m8)L;vOJ zs3*ETQxb+utoui6f1UoBF3|1vkZaE63CQIEX3MQ|b!k=!EInhkhcIsS(Gs3c%P-!j zTH+ed_h%Le9SHjpq+rM-?&kZ=2O1EAkuN1wiEN~ z_q1Wi5+nPrZkgy%mO&4+y%SD>58XnZcOo_kQT7*o8~VX2a(%e{no7ELRo^kPCEmDr@5lEdUVRf4RM4qm~Z zp#{sH#w}Nf=2-yiuGXlVx!jDDmw&@*cu6H@U|sILwkmG-DEf!(FTs$>Ar3=Ee1OXr z@PyaPXHR2G7WX=Cb$X9yAkQ?()rOF}WyribU9s8Md;H%T87`xvEvGE|Ll7!l#JR3& zy{M54w@ZVyOfUhFWTK9AD4D0&>hRYYt#onRuwl{L*6V9?tr%~5Qtg&Xa+Ck)Jp!MY zhUa?}+AaK>SV6Ir8B1PjK62;&(Vfb|-;<|wx8+RRP;bRub@1m5ogY{PJS&AZvUv3#8EsP& z@w_hNXM->Jw;L-vAb~Zn-L1hrop1@W+Wu8h+neWq*x|wHT=u zGDOzm1xg&2pVN@4wfG6!`m?xd%thk$C+F&f&fX8M_6>umnpKW*z)jLg8v6MO@3x=h z9&-oARGLM33q~xIc-Ct{q6Q4p#v)S40uJ;fy6)i}U+c$ld?Exo;)XW&rh>(oY#(1r z`FS(x%}GdX?cHfT5jyUNw_)S=jtU=fYVwoRQ^j!xHtAf6Ba7n2q#bcCv^h#kZ?axW zz2YiQ8WnC?fmfz-r7>UcE4Z(Zq1{1?A0D8CPu~Uazi379aNlW^WJFn~HdS7tbP&(m zgHbg=MHyarQ!XR6Q1aYfM*<&U0K?2&-;%2=c^rAA=*2IM)BS6PV*8hPADH+(IWzLI z`6S2lW9k!EC0_A80_L3vV+Zfs-^Si2~x03k*G;-{?>< z_s{`Ea)&=Mv2f)3Jb$M^Ycg5w_q`pr0L2Z;licOE?#ouyrX?B+*gyP|nQ7;oVy6W= zTwks81(D(g8#+dIi|!X3*!+e|g_6sDX6p4WULf~>Wp}#&Bu3S+;fq7Q*)}HnKyp-4 zW;HsRm9LP*HO-IR|FXCNyHot*EfE`ZYc<@Yz#g+d!DIK`IG- zWkI4FV*rBTOP><<5AwhR--M~zxQBI((;KB9r$<>ocID+e$YQfd z7`RPDCmk*OxjVp8S_eJijUwM%O7i{sYVBjb#!2>n=%pzm?8?WEJ6 zy#EZgU6_~~T9-o)2aZC>g{_+%q9AD<)be=JPy$4iA1Cu?pC2do&)I+WoRg}i!Ei>9 z4h!+1DreMulKOUkNL`Loi)FtwzSyZ{A_J1dkNeZH;(${UgoF6+A!VGp(?P(9I{jP> zxxjD3(s(y_pTB#e|F6%>@p1&9Bg?5FX~h9kkRzp?4$2wm2AC2f9B2-V6@uUx8(5;A z-t3l;(A3hBDOz)#X^(7CE`u!(?OQqeyC=)Keycvzc1t^oy>hB&fc6X zxH#a(9?-)9sB{Ck*~gUI1`hGX1Gk(1+YM@-nB4qxHumq<_~KYKd`R6z;0914c%r`i zzXK_<>I&h-ad8)kOrZvU#yP|MzumLM-T1#p|9gtSG`JXsB_M$-WgYL#-D>Qotvkyd zucrLme-7293L&nOvvP4TtH#L{;Km8kgP~ zPLy(ZCy@3s)1)!Le{sCPs7M%CL67T?cE_Pc@myffXG0x6#2NyBY=htPLdn_@abiKwiCs>9;TPFV}6bSf3u5;qC9VyuJ$= z^!5_zru;Z=;DOh%$~;XuS@@L|^I}?Fcv&}9VX*7f6X2ELCq;!zYcDAED58G-s}=#*~L$eL^%@_YS`m7_*y*Eoa9BYNWzaz4r{-%dLmts zR_#?{fF@`#T~xIB17^5>*Jafft4RJlI-X7cV=sBd(Ld{CEETtXvs8Mh&^XK=d8t+3%;Y*Kh9_P7C}t`<*>m?*sMGw(=cKg&{mwWm8lBN(3ZA5 zKUPp!+Mqd=aDm*hbyfRvC_fphi~LcuXFcl4tBcx7gwvehE$6srC+6MXJh<6S=dqMk_v)Kn^pldiG@D68%DjUv&SW(s8-NuM{c>2T3xBb+7SL0f_AF4eK`goVG z$p10)dE?hRP~yNSiph-X*EdXRw3&A;T6~*rcrp^gk4#|b_bAX~| z)_i!9?DO>217@&>h8uRf56!pgN%e%;p3$(K3;2j{d_!_^mL97HZ^_e>n@nMbPfd8R zUx?%}vZ!;kWAwePV(@_ywkxV)=nfmbSL!TP~ZEzNRfFI)u77AHP!IG*Nw zy`%gyhM9V!6f{U)SJ=uWB@XiVMSba`*4%b&D)onnFmS9#h1Zeceg!0`;svVm{Y{ z)afhb8$^0f3#{dQF?(!9)k3b45 zvEF6_jP0L;U{gbOa&^kP7NhBtRd=r-X04nb9%eaJS<#b+-tN9 zi&${WnWC^q_W?hLN^AC40F$_aDx`xST|v^ILzW@adnv7K4xg{SVe;Ac-Tl!zTch@f z5u@fQd7SD+wJ%y6fn99KE;^xO+hrgcveOl4h^waEzzW`VPo3rwJ3K^p25J(n028eX zMa<&*-+3BflxeT3B+X~jp!fLWASyF;V2c?)*z!iGE*pt1aQIy4j8&%H%{Y4WjPrh3 zCXMaNlnAPSp)-8MXl?i9ejhzi`judL-|-n7t-YETk&Utpgm775yvkiZ%^-xO`#v!J z_dd44%#|;YEXogB>7T|6VSeay+$C})V9R)NPov7xobwp7bCDRIrx!WRF3HPu{17Ok zxB190y*JBVGhZR_LJkt;XESE50#`qt`h`d&zvUB4kx&?gy;8*RWSt%n4-@dz+o%V; z{2Dv)SG0(4Y`M6mJ3!wq*|(585S`?o0gn<1mXVViU)D$X6*3=zBX=rZZgiMf8w=@a zw0+w8{+H~Ygv~QkmAB`*!MuS&62B1&7jrmKTbI*y5Zwg(=hEuG14=LXoS$<9?AG(P z&TDDLX0qS6&J$y{UvV#8oa@JKDz81dV(>Yq@?Odred@hSV;|Ws>KF)pG`?=ZrZ$(U zk@o6Sl31@Dr&+1f!v;71pu(7!RUmHK2&h5OARCwbQ*8rIHE5rs+C;;g!TmmJ{FuD% z`?n>@^9f|UPsdTIj<1e^j_SjE z(&FRemWGo6`7`(W-t~m1wW;eopeIp86lx zEDUmGZ{WyOL7?a=qc%k?T-m;9 zVn)9D42@c!`05_{uCAS+8|FgmUX&j%3aBRb-<@vsJLm`IS>Q8NmVV@-dvqXxRh0mq z{EKpxGVj$CcIuOzs&NX$-YPsn1stUu?5G|uXfcJd5MO+1-K1RE%-CIhi6~-b38I6` z2twot;<&--=7u&f=>opk&=vzUxifH{fa9#Zk1DYJNMRLc^wd(Is*d3b*??`^{1mB9>kbRga30O<&|$;i01&>p0hGRxBYp=TU388KF5P2 zd!*E<;Rp1c@>9qX)`+6Las=`6Nx-m!s<}m__bO__cP6r}@pwCTo^qSfwLfYa_jXD+ zO8l11=Lpqk@&tWAWCI!jSDgpEM=tA9EVQF0kZ`mn!JZD)-5?=I@!gOE=Cr_oebPGs z+?Ng4@6FRNUjpWnuK_g9y>+a$JQRl}hbFs=Cmii1I&`fqtL&EbRVP?O?rcOyNVpaL zSz!e#=ekc0imD&Hp@EpKl_{AmZyf0r*XHl7Yj9AO&%s}!dVjh7B2OAu;p|MCjtHuI z%^_=nM+;e$r+()ZdD60uUmn4NqhBuLwpFG)x=LPRLcn&`jMy$e$}SM{<3`)Oa|!n+ z55R6GX88NRx;N=i-{2ky2YVk8ZJQR`TvDXVTrz zLWJWu#WhjJU_T!wQs87`qbTd~?nXyX4YMFF*^g5djM#N?E+GT#qiq5{WqBae4qM|z zScl(9^(5|z#F6r*k?GchAF7-^Fu*t5z%J3gu&{u-ZtI+%va&Q-5Mhw3TS-h}=2fu} z1!zt^aooMppKH@X>U8tXufW(%1Xb%HT<%irmIN)6S4f@h{&BeC$<&hqBb{|uzoa>1 zD<69is*^5}64nTIG2xOeq#{wU%6-bJ(7F*_KOfHH>o|Q>Yk*00C|&y@kh{IA3#=2| zhvo*1la>F@pyz~Ll=4umGa4Vp*>yL(jkqb3ZD7MI&*DTwIR(@b2b2+7Gk`>MLO~qIwSCYfyvcqnQLN1-=Kv zYrtR@QFx?Lp~<6HtQWenKEIralzn8EvTZNC*r6HN16%Dc}- zi}5+!+t^&oPz&dOO&=GOoiIakPfz86J`boax`YT|eW}am%dtQhFi!oKu_24M#v2QJlAX2U-k)>MhdR^4R%HMUo3jOw~*&v_Q=nBu}R@wKK?i@ z3tqk-5KXRtm29yDsC5X)!$gG;%1FA<8zo4E4Q_Fq>x#3_e%&I%z&-?3LPpL-ht+h} z*pXZ(%+e6!1Qp{J6-zBQx0yj>xG3mn4YMqcN@N*yB{TbHT}1l&WXybvstMX_vCre> zW}-b_v7WTY$7Xj*dLQWyvYOmq-#Q=Xe^^8xW{45u6_jg9c)=&{eTY)&qIr*fB+l0* zLkypL^xVU5w_AitDauh>JvQi8q{E%-;kT|ICOBM~JH7nUdn+2+0at|(YwXjLE)mj@ zAAO#$1YD->zL$6>$=nKs%>+%`pRuwXF!OjN{ko$bCmhD# zTpD=0dHn#Zo=(;EvEu#PE}7wvnrBcd#MkY2nv{z^K)DO;Os{~Ov}&The*QxKE<**) zbazU;5SeLpuxkkIZroofpF3}aVP3dArOV6t8FTAUiJN*^AH^4rNZq)_f@Gi)w5k?W*$+ot@ze8Pkp+8 zEBz=apki;s8cje)PW>iP!Mj40uH6T-v&FvA*W6bdZ96zbRUBj$M%=ot2mT2R>zdtP z{k+?xhNHYsQeAxQzN#R_t}vSuVf&?Y-MR00P&JwD7Q>@r%>8^^0yYnw8g^FNd0*cmTTrtCQO0_aI^(;$idLsLw~2!<@r+67S4h6TTtM z`rPdKPY#@eUAOAqo$!{?47V4#y5>!Jbk-V-?0ESVPB6K?ol|*B$WQR>k}$|gKsFPk zGh>w}*z3FI<)4?tB@=m7-}Lj1m`Q7%woaL0$jOg~68i;^7Jp4J$!%KqyU6DhlI?w} z9x^xB)$iJxfLet7^xLV&qmCE(wj5=K-+trEq}Lfvkh`@s&2!<@@ng*|sZb$8=HVx| z#9xd@s&@7njX<1?gNwKlJ~Pi03H_qq=5vj}^p|OR)zAH(zE`j44hv0Tz#g0RFf2Sp zMPU$xuU*d4@7!{LWwK){4W_>cz3ZGKG#rATryz>)$BWA)C9ug)1DWRC4&Q*FtMX>= z-m|fdNUSL1*Wd1Y;A1YfJ*8Nzr{DRhoNu_i7%nH-Vz5qlc1JU_(~*`>tTpd2O<|UV zHVZB*^ZaluGU%o2{6SHVG|EEG!lwU8QmyKm|@inlP~jctnQ z%>I!VWMJS!i&z@TA50zi12D5a^D(-NFdXV7zo?fuALfN|Oe2-Er8c;)Z-m%b(> z4V820xK7`8zXQIqFjkVR*-~+dLKiDvMlXBX*L;;64nU?B4H(#oo|y0v}cr4=xPro)Yh3znzXGtQkK41O>Q3mwKp8 zeralw0zvm-N^d=YStr?}`93cwdu!^v#ULtd-H<0_<@;L8Lz6RUG^ z&tssC&%7#DytWkA0s}X?hpo!zfI%NhC#R6v1K8I5*F^lu=pyq~F$vrg)ffC=l6Av| zrpHX!x$G_LN^jQ=-i-4A&h2S@o&po>8JIRQU0NM{- zLy?}k?K4Mmw=%)dj%E?7JsehFVUyO4J4W;?ZmZUT2L|RqGxkQ}hr8FUCyT6Ol9tQk zDdf{-D_2D(x8INfu44{rL@(yl>^S4ys6OvFn5evG2iM3c3`A#LH`EeHQ9b@Ha3xUk z0m|77(Yk3H*a&y`Am`}J*!n)tuG`My74vo(?USE*rrHWTGJc#$Rt%SZ$A+rsMw|U{ zWKE9yW#?6`;M;_hoDaa)qvI@qJ6XbqKl~)2LP+tf`cbDs9=*7|r`WxyJwA|FJO?Iu zbAS@81AM?dM*Z_+$D1P7iz5Z`LkcsvmTMaaxgiHHM^{46UnC zt6go{!X^YT4xIP^&@}oMZ{v2~#dX+nnVow*A1?K~W~HePw0mZ{;%9ObPdoENeJaN* z41~XAb)RO^;Ng^BiC^Aq9Q=LsM zFh8+YIdY4x)Q4stzDOmNryifVZRph9K?;ZNo1838`km&g0|ge1DbUuF(Ixweo$ z*Ye_K98&U7G(HDIH{qw%tet*!)U#`Q_E!W(P{^pzKrB=*GI0TN__fCX)SDl;TsO5t zqHyjEz=HHgi=VZ(H{lA1Jo;4&vlm3?wf)il4%BtPB&$Ssntv zO!y_fxM_^uDe?p>&nfokF3JNw;86+s;DyJieL|ds!3af!5x2g_t>TBOM{d^+6`C3# zEcKK&)XSc>z1vu2m$0&MnXIn~@n7i8P-|OQa4dtLjdwKw7%98Y?1;x+?M?-5F}Ah$ z3h>gE2h)@h?*MKaNp8#3h~Kjm4z4ghCq`DG>*fVA-R`5XQQoU#PtZ1UIEdN? zK$l}>?2aFUN>g?i`Ccr_Zyf9_NBEO>*~lGcg%-my!xjeY`n1eETvNMwxoN^BFd!Px z#%ZV9Ql+PQByA&XRAObB0*2<`kaI31928qgJn4;vPMIGCCZ#A!2qv|>Z1LZlMyjss zx?FbV{>|}67QExfz-#vPfjEe8_-KAQ!GiJJS--U9vlEE5hPf(cykr{+Qz_aUPiw#^DpWVl*h~$JN?fd?*+e)oh9Xz9vTzt%Ux>p;;OF;U>jtPs_MWb z{42%YS^uUe{?K@X1oCxU?8~;labuV`QP)k5hz~Hw zs|;?J8&2kKx(1x7ayl>t!c-*9mowVGz7=)DwCF^IX$Ioy^L|~MpZijk8vY~ChsJuh z4diad*>S-GkRt*8`B1(|K3q|3&q5w@C4hz)vYpiOF*b| zvu<9Mo*Kvy=SrS=^c8drWI4HpA%HcQqztaEO|f`UVl0-JBe@nf7tTm*susG&k@-sZ z##O&J{-9fND?m)4t}xaB9K|5pJEs^2@_WBZw~?DCVH1VzqiZVJa2LMp1dO8pT%Z4g zUhdOh0~yF~*ETo4&?RTSaScV}rYK&h$>UFNDZV5!{AsEMhz|Rkod#h>?wjXNrU-G- zznu$JA1L-PN|A*bai!nHy=GRCZ?^3pQewh;>UcKfr+M#eXXbMz8=;$mCXek*D=zLatr+0H>R|5kwR-L{3gljVB*1XK z1tzaLtdntpEiB+{cWx0$6*c>D)A-9LXc7`yF(h;~NFh|cU!o-uFnu}@fiX77Syera z(_n>SD&H!szoHH2-04TC+Bc>XH)W4G3|BTBy6CEC=3!3*i(|r0u^m@zS*nK3<)Qk8 z9Z;M;u)`FdP4%fDa1o4{*DrYK&l)FSxXZ-7XiE(QiWpOY2ty+)HJ4)b!lf9usZ;Rd z95Hfz3sptlGaDCkj-d$FJ70JX*oczEosaqJ-I001xk;~vQpk{I&rD)5bpX;ZxkfzE2qId z10U?s!66XL@^@3v(I5OxiSn{PmJBI$auMwA$3yU6YV01zAlX5f`=}zO3aV*bscG9E1t!&w7JiB&CYCwe!@g|s)KwM1K`-cJ!N#Q*8IK=( zFN{^Y-^D1e6}(#eevkEFvbTeuWA088bnO)B9&L{DZ-Yno-<&y>SEW105{Z1Hv}=b^ zPLD>$1M^pQ>X(E^~%cd7&HbMc(a;>c{z<&CSl}6~j55g&Zq2>VkuLwGNo934VKs${ z7*4*!03fQhN9imhG^=k3$s~qP@pJIGazzi(J@a|?$AaZUz6(X3!qk3IR>ZP%q1t2S z0m3LKS4xWg3NK!j;WRRJXkN(XskcJk*=VjFc$aHKwsUK z@DQGU#Po=d!{>oBmx=SZaOi=lUrfB*agg7Li4 z-iJu%_r zc?$H8w(*~o0i2)+Rh<+*^*Wai1Lz{zAN~_i{?S4H7F9^DRnjK8@?=q!A~(#NDpt8B8#D$$3ULrY+*!AP z{mr>b=m%%B#?iS1YjHrPa&1~+K3Qi5vN-x_KRdO$yas3lr#A~FneC5;^;+uxC30~u z{VQ@&GSmJjU*iAd&&ldT0y75H@aWyj5;jDd-#7WA2}R zE=9En*dKG=@;%oWuv}!idNKrWG*?>R$8wz12L`VC4mALRPeMBHR9V*Ecn5EKMGsma zU9?(p{ctO0$bT!C_FZGZ_OIam^v3=9WMK9c`>)6cP94jk zE%y8XM%$Lnd$jPywb-n#3g-r3^cZ0trR&1VuQvnbL`$5KxR=gIi!#>-k0Qm)-vu5m z>Ir~2da3qm+?r|ZifvW!x*{oSP9o_Dt8FxiEzooDNgIHZK9x!gx9_@RHlkGMfOkq! zAhBaA6jD}D<2Lb!g*Iy~9|7d@A-OKWN?2`}B73!2D<48!>5|uFY(0g~+)jvJvkutr zo(m|9cz5cyKVV@t7|wJ=*_BG1f6j~i#p;$$k2?uio80`PKpA>{{RvSmoKflja18MA zVPLINM9w!5-Y=y}>!+WBDw0>JW_XLtjqf7Q%ZTA9#FGCBQ_!`J(*wVL-(V;u+VP6C z9up)i&4@JXRPx=U^UUHkUw)FIXFX?v;(Nj554S$coQp+J!Qan3%6PLD^1Fst#USsk zb2G}lkL~p-K=(_^sk9Zu`Qj(dvra3gLga0pA+C18&H6mfn(dcyH~n?(Ls&VLS0Qb$ z;d$ybACt71Z)scEVuw-IzD}-bO5uuer-fN+<{$*9nIzTjw(1+$N~=S0@HKY~2S>Hc1o^V->j_ecf6umBP> z5ECXx8VQLRo7KXW>9zV98r=b=2#I2HJdCXOo9tHNZAGs_)15;U?RuAY->OhIyi(Ns z#9JEUocr-(@%4Hv>|62TWeS1-Cbp_StdPZWd4IMR`C>M`Ki;1ONAnT%!R`VPgU8I? z1j}c=He({a5u7E1Z12uhf%-8?sjZFdyxB8gERxmEJ^%lA%hH0=f)oH=9Qv4=t{(I2HHt4ktB- zcN-g!087ckmFt9d)Bbeak*)O0O-fc#$Q^7>wd*@bb&G;dccW837x(;}^dWEqOCzaa zt_)z8bYY@}%zl7!-CM#;m@qH%@EwOZy7-O|5(530KpVUI+rZ%v<}|; z?nc;P4`9=E%GE3j6bD?#t8{KUQmAzfJ?YLXz>xOwE@;kscl( z7MW-2jw{VLY`fKNEyanuODO+QAeC%s!C}|Fzq(ud*7_4~n&g`HqwXs0_!#E&>sr`L zMz3TTiDbf}U-1@I$H6v?IGJ^0YTw&P((A zn|@`2X)8Z;_bHCx^YF0Lei?%~(CkpGvg^B46@iCt=g^{kn8|K|MdGPn!lrCX$Th}= z!v>u>s*KM6tj!d1g~JECc6pmbYyn0uk6Id3cV2Ao)0%R6a#|N%_l(@Q-2+o1UnAzz zlC0TMc`!nyq42qhRljt2OXV$5Y;0b|%VaY`#l2v@jCDGH7V(^GP1xL9H(V?~admFi z%{9gOOzhVTarIv6)rpE}NwhZqzA0J427HimHJgf>k_o#u^xDY8+?fS9`Q;8=0Dj29d1%6_Zp8pZFZO;ER_ z^6K*qD6@?`P5xxUKd&Ls!7X+IQVOIJZaUp7Sq)@S1GtF17Zxz#~@hyp4-VdQ>oIph(61o z7(k7B7>A}V!d}Lwo5(v6x2EI5amhI`_F)P(KVYTUdppbSRNVs$m6#(?`(C#E=Sy+H zqfOjbwHz97o~YbuOrQaeAfai_D(4kq5|P%Wox<74BH5V^W}`PFhXLs+Ibc?|H!YhX z82V)RSXlal$aK5NQmEw`@hfOu&aAgasO%?D8z4s84Z2pE8)n~O zMdZDPZIJEcyYHE;CUOu5|BwTy9eDg=+H-CB@xH_&H*+&o#pE~$-m>JEBV}28PU!t; zQ)**H?{eC{S0KYbZf}wRhPR9~B_l0ijm^3blW%(722aDL_Xz?nTA!3Q8$(_>J;_zB z%u|9CI+l6UzyU$RO<`4x_d-aJ^_Z=MYlDH$Td$_Ot;$3Z-d0`JP+*8I>XQzxS*4h~ z1H(@g13g55ObsjnRzRj&$>z=Eh*u}|wON!CJ@wfz@40pANw43TZTIheVz_-f@lcZd zD=Ak_u3ffbFAENrgAnAo5?1L7psrpyS(_i=W?8u}aWvgE&xsL;dnIC+=KU?x`OP6O zCiuZc=^lNp?a$_@EjeJ(svG`wK>L%GsDAUS%>`xr$z9gh%THA`xhY96NzcP;`BDPd zA?ItEI={QX_Dz<8jL!zoNZGDc+~Dnah$z_thq4s?=$y$-?Fw=nJNWC{`M7X-cF;pa zXgC#YsLfll+;YrW74yhpe@B~6DyqnNj5%URGVWb{U&~Rc=qjkQ{OZT%%}Z1tcE1u{ zin@=fKIU^O;QFj}L)debQ6{tqFp)Ya(l6$YQ@C73xw_r7)rm^yK8x*&L!V+snZXhY zAa-i;M=}HfIR+f=0c(i1MeD=Nik@L>)!eBPle(&xgr;C8|3H^Qm_>{K$?@gYsrfZt zGqm5~mPG*J1oA^m<*|hqK6DPAHrHWXB96K2?1AmruiM8!@%umb07I?QKhI25Og1Vk z1ubCGfGm+IO1=&$G&N&mMdf%SO7Bv!_x@Z02Y{YWZf;{WDNef@)O*0Qse14$>N&29 zjZ!%BzjBXrgZik~|0ah45zv1sME5!vX{?IPu3o z(hh6M+N9+nkO1|rajLF*?dn#E>XFmN7VqKb`l#BSMgTVd<_+A=x}R=9-Z6KN>(~Q; zjkXyHOC}{OKlgM)8pF}sD6T9w<>is~e;pyp>CRCxHlWJH4+Cx+5sMt>weY;Z0pNQ@ ziQ(JXzukEQ{fs(5uPjJX%*uv!$N81c5zN+JkM?~!;>G5U=5HTSY<`E$_us^RXOqb+hH@3h~{<1Ky24<8c4`%Jlss^Fn`m; z{-LZsuX5}mjbHic5wB@VbgkQU%5Qg+e%z)0VCm`pX%5ziNfP>g(K;nl%#?oV2F|Gm zT1-Kl6fsAn7g=+@HL zAFMcxX;7~9Cx<|fFytv~BTtaqmHSt9n#=N7w=WW{Yql^H)hmJ$uO92tRBbu}>YOeB zuo%qBG+yqYC&KU?@Sr%w(C+KTXHnEGAX-6;pJ1IESG}8;|)W&x{pF z16C5{D+3aHq-2|@)aypsAylY`!0P@6>n4Goj%}Wdc1t95n{W_7eF*sK73Q~F%9w|9 zRHYX-k?+)Jzn>iZ(t7xr2hbV5U2CaPgelEfG<|gLjyy7GIv!Of#j?fjVZg)wD|Rzt zOBH>d-MK1H4gul7z(_O+qhk*wfgG=Z%=<+89q7EVFR!nOugWA{~31oB*!#`fxUz*izyvnsG7{T-_Z#oTLnia?R_4>0^ z0(MluY}NKxh8QxAsK)F+6djH!3Eq+pcB{4Z5oZ4t{Q(k~wsmG8NESKnG~49Wx>%s$9uo@g|bNzl-(?jN`m|)I>gbmJPnotmrdRGM0I?qs}IHcY`%;9?=|&*b4@2( zjJ_)5Bx;s;+o&xA$@6xFvRD67N{_nWz$;9@cuV-~BBY#^sJ-`Cj;I)~WuL_XA#lxZ z1WU|}Y~4Fu1RtV0uxd%Qb%$|Zej9MUB{wVcA8JE>f7XT?a<@6!8kyl%u|Ne0$yaPn zMY`X9Tk6Rqzf1L*%JXhtibSZ;^uvx1G*7GUD<=GEO?!8*U)xZxq_y@d>*+V&c1!p+;g;-iquQFAoblPHw3xUET$|4jX5bAOOZygPYbPp_kj z0C7-7V#}OP6K2}L{N4RC<>xL??eejzve}GA9o1lJcf5WV6mWf*npY}MWQXTNb2~EJ z?@l(~luOfaF_5beFI)_?HL;>N1m54JekJeO{}NlPO(ZH*I?4oM|FF9?4U@?f1aqXm zEZ(h!08_2HhNGSOS>sIcyzKKp^381IBA=cEsy6+8Wa9Ar^6;EAMIQrb65yDm0FC}{ z^GvBkG#mFMdVlTz`}Y+wcZ_8}r6Yb^PmS{*;6aOXcTk>;xpJqlE_f8*d!Rzv^Gd$7PD44_8Dp1vUsT?bqpwve<~mUlryT7{{JOB z|LfhLf+>Hz8&CGl1n>ue7W0 zu0PPl_NvhfFRu#y2Rhb`Bt#=zbIRz&`gUC-xef|`+k?qr1FAt|F9M$Wu|GY@4p2Dp z#qK~dy4XJ_0lNo(~9b8i&LHbfTF^~a0d7jCqQ${ww7LOrsWkK-l{HA@SMHp6A5UK`6s<9 zugDCHL7~I(Kvbx#!52u{7+Z(g1LOS3J5_o1_6OdxQsH2#5fX)SOzLj_XA!ds%-*E6Yz%wMc-}5 z4(K1Xk2w1yCT6JYJuGBOVG+m+6|bHtp=h+vfvSv^J?Z1HD0p9<0q_qamb&Qs>~&O< z8KxZSY8NtqHtZnfSLEwaN{<5?iM7jDnvvzjK!z?(++}BJunpfDF5uF!`KR2n^2L*V zpI@08_O?wY@3w#v!-lzU^6g!5A_8ouxS%~rGAtMvpuOsh=u+k^gQHp5vtk)x=2nm< zme}t3GVHHcPt?IVfNEabeV@^9_H&Z^+DxilaRUxp0m`$#Huk;hfIR2tE#55+s+9YW zZ&pr8XGg?r_4l=Blr;c}-DGa1m!+cT0fqHe#xA$69v{tY)(q2$NR>S=lIm;L<6vlR zDBbuYkpB5~WrkB2-e?d-ftSK<*eiVB+>bYRTfD^0*rl+tXYn4le;&Utynl3#j=+G@(zvP~%EkETtwWvClWO-V^v2g9h`Tbd zeh;XKmtrO6GxA|kl37c4Ojx&APxsC!wj!@Q0fL-DK zpM|FHNOn2KkR~VVy%o4F_R{{>e|k$d#{ZDc+-kK$_~+`~(|*_otqbUUQ1P>J#fRlj z+X~+MgVsN}7O1PpcYUb2#dSXV?p&SHlD_!zo?ZXL`M$3_Cwv^VxX1Lct<$p(gDRkk zgErCi$(46+{1SP$v0lA9nd5udVPFg6FT-~e5%;sR!YodoY<`-cwx{i~Y2^9`esAYZ zbGcl}A$j{l|NCsnN9Js7W)zFTZ6v^fkkJie>h`cVEN)p^g3t=z)= z@6P=n_tx$&WiA)dY=|+@d9grTlph!ws8cZvwn6pMNMP4@XlHA74t<`hp z*CehwA$za>|6kDZqs&9HuCICxYB~O|HjQj>!Gze9G0OH@TgTX)Ud2HYa(G2tn2)xhB&J2N7eWHPRs`?o_* z9x;3m>)P@cxj^X+&{ffOXq%#nD)D-<$q3)?xNc-RNy^=I)c{S`ItWXQf? zr$MI+K+XcH1@CPKa{sQ>{CzfeRTe{{^>5&DLn(L7uJ=a&GH$SrHP3s!x$EtQb=EW1 zMjIY^{V8n1YqftOKe&Jg6LCw1+}`8|u?B1x$e#88<)5GWZku8CVi)j8CI(MeKbLh* G2~7Z1N*D+L literal 0 HcmV?d00001 diff --git a/static/images/blog/2019-04-23-hardware-accelerated-tls-termination/k8s-blog-fig2.png b/static/images/blog/2019-04-23-hardware-accelerated-tls-termination/k8s-blog-fig2.png new file mode 100644 index 0000000000000000000000000000000000000000..a2b37098f6ddecdb8eda74acbd0858a0bf164b0d GIT binary patch literal 29587 zcmcG#byQSu_&qv=gbXbR(nu*epum8@NC+wt0@4j4(k&g*AfU7iB}zzlhtf5Gbc1x~ z&~eYf&-b_1@2>mDy?5QqS}LA%<~?sddq4Zx6QZObOL+U$o$#Q#n%k-5n)c>I_WhNt@pJDSi}T-b%gBQEWk0$H8mR)h zxe;>X$=hcrR?ca-wqBb{5xs`yUs0pk^yym`UnMUmGVO3CrdPe9gX(vN=|^X(Px4;{ zzCY2$9C~s#kR@YTWiU-KW2S{AV9lK6Lxnd^DV!Sa0h4tt!%1$liR9arsUpg78s_)5 zp_3@|4p~}33qtPWx$i`8u4zh$FV83{1;Oa}Dg#%5E>1LPR==qAmk2r-^~^eWm<8wc z-QI*kqbC2RQ}aWE{OuQ^z5xZg_AQ*uekcBuD`(W=Hs_gpbP3(Ftcd9_4C5f}Mz)fI z@#%yY0o+M`G#ace2$fsdFFsnRJ0u#V-RXr3t&i|eyq^?YEIY{C$XSB>wHDNSnuhwu zF}H6Iro_-ce9!&I*};H44B2Ni`|Fvyi#GL2BW&e-OeYYl+$t&aG&wZH*FFFt6=KZI ziqln}DITPo+#NOqU!0gxGD#&IJn@XVkE4}k=h;<#RS{XizhTjNnqS5Wae9d3c3;R2 zo?_g2lJ1X1nw8#%s~aikBoq@%3hUpZ9c?4CnqKY7mur(usQn`J8;RA~G9O+cSHHeC zrg3&_hlS>=WFB5h8Die4f?f#+4P zQ=)cdWy|TB^EnqAjv%`+lVPK7vaia-=WxR3V=ybCb**`3imPJ-ecNV1+={W}?lIe^ zo1)oAwCDy=XYLA|rA;?$biqndZNsZ=_cib9IGKiw^ZFf?^@d40_-y@askiA=9I|+h zi?kcgg*_NMZb*mJPlN?lSC7S(JQWY#9r$a(-c;4x^OGB1n{%gGemb^uzfK>D^Er@w zrkqBuEs*uzloMfNVY{D$=BA75(4;lT3Vo^ISUcQBp?SmmcWn7a*?8^pM^-OR$YWj{ zqAGNEUDDyL;{g2)Yqw>M^LoAKA8R$ktI)dJL1MI|Sc1!y`8_mSt}7nLwZSraybWTn zcYJCeARQ!jDP~~X2i7RjC%97!*7oybCh;x~qU+Y;G<8YWuIhcaT{57N?!}@KX7vkW z%W-rOw8vkc>rE;_E%zphrfS(naAvE=H0c_WP#C1r# zaJ8r4VmqGgHDUupbhHb%Mz82c8w5Hv^jeEMoXmH>y}Y!p_LS{~A&K3*C%eM$oPyig zfRw3!(^K88&bVBzORMjc{s`H>Kc_{9SCDi0>}5#%kZxsX(Qn=J!GZ{$V_j;y(GsQ; zPo#^L{#t}x6M67R1o_OV?mcPN+qEP!62E7cqRzdXYxxCZmRBtDj&Vd3=c%biV=zGm}&Hf}41o;>zX8R9{HP6)~>qfmgieXAUH<*Vn0?9qGjjI=j&y ztis2JK}+xWVSB{`mv7#iw%uu}qOnUsy9&iTb209IiA{5Orxu>D8#thf0W0$OYBVSR z8LvaNr740e-RN3}_(T2dBfR6l`AJ<0N-UU2ov{ruZRb;$0%JInprc(^a{LI{Xr9tp5(|l-tJt_FYk`?N%1M&}DNAk)Q-JRY4)45Muh3uf62N+Xx-k7}#>GM(A4ZZP zX8$TI#J6*?l?&RC^qgd1uW`^By3u{28<&I_BRy?cyyOvzt2!QwS_))Vj^3V|a=}@0 zj@i@3$bJCpCm$>6`1D=uf%x#M|H|fB=+ryh%m+9kz#k(b``Je=O%)G$%XK-xyvRuE3JmG4hcCH-L`wC(~6(- zHm6Cv|1O4V5La)__B`th0xSE0doD6EK|-A^t2 z39b$DxS-v{D;@^xpYzo3lWr*d0sQClLh9fQf5G)K*-8UzVuA$4c|K$)oQebYoOFlh zPttyCQvfv?)|L|^4%hj$t#okW_}KD3b3H7z9`)eS677app-^KtI#?tOsh&UicfCj_ zQtWe*Vc}#Ut8y}WB1*kd0z8FxYj;plxh`Q2I>`czI5?rm>lAYj+4x%uz4j2d`zvD+ z=rnRKPF?AIT38V~b$4WuMNL%?hol9+pq^ehw?Y;7VZ#B9eHW3M5_HUE@jLlTGR81w z(=1LL=R4I`$)?XtDXR}0xk6TCFot5Ovv zlV@Ie7vO>0lqS~c?bV#}y^bls zc>60)m*(thgS()YwUkD2BKLgF8nEOt+vLuuufRTtW8bS|vsmEYIgUFP(?iO8_^6hW zo81S_zZuMyapkSqa~na0%12p3wXFO1D_2NjzB1_M;nLJT-TE3xrEzZ!L+v&6MCdOH zxpk?O_sJzyjtymJjdn}1u#b4W<5tFMoNg*wX!hlVs*+)AJVm~z=co}^_hvAR(9TJh z64=T;wHHv!o(H3e;k_}tHoIHT*X*v16d5Luht2vs#y|TF z?ODkh508LD@eBA_?JQQt5w;3_g!)b2;&N+By769<(a35{$dIY=6@JlV-Ns#PXhQWbMF&!<~y9 zJ&WjKS|37G2p!ZKmA|buak^!9-Z+Ppk)j^$*;)EQ`s-ckT{qpG<2skkSQ0G4&as$^ zOKS;1vkS>N+ARKZzChF8leXP~WbNz6XZf4Yk3G%h+TN;I9u%y>cfRs)E(q1bsNKJ# zN!bsN*o^xogsD94T2Zy9ocC|YI1t5<7KiCFylmNU7;PM{C7M4*TQWLkKE#oa((+q* z%U%=t%-><=_`@gm-QTlaf>Q)TWVK&9B}yuKr@1ztIksIYHK*u&tR2w!aQc0tcTCv! zZ@|V`SJlA8iM>UH96TYs_m=qTgeznAF@lW2eU=PPOfyxS>{KsfVU{)eF}%E%ons|+ z1M9Q%&arjf<#t=bD38oz zyZa)-nG!ye@idV;C4p`?!YRw4^v&S`_(9$vF7p8vKZIVx5val!@nQWe^#)d#VKEzZbwK$micaXyki=Qq6obOVMZDapF zHMy{OYUbBqj_i*u*y2_@VKsMJ*$o$M4?CF#JN@&MC+fKsO0#i>{PyreoS%uk+ZWsp z-wcQwX@G$t9uF+j4y}PPYbe1#~Lf=XCwJgw}$1IQS7C->LoGO7N7O7 zfWOTpu0{r)3X0RrOcu;rczv(j8F9LjH3wGxmGz4}B6EXqUtvHHYBD%A?8UDXKU-;i z+3O4xgBxY!LSb{G50ulS>!x|S_+DpH;T=z=gcDCrI?L)Nd5X@Da1*yQne+|%nrv1R zilubSEvZ5vC%bk%vBs-JNMri$EV`0@G0G`8%Qy}|9C`K^!` z3CfscU?_X*#k8T9GbK+e8|(G@YD+PV(uV1bKTOGfG=88C&68^*j$JJNLv8?^Xf<*k zYbTUEs!a63<=<36b?aATsrI9b>v*$lW2AuyLZF@0WNTWm=>w_H`xn6jC++x{}PlXb|9*w?IG4eVEIrX{xuHF4lu+XA}in>z%Tvjg?MT}`>_A6>jLk%3DMv{A;8EV;{Y)k zoDDT9BcKVOd*B4O08tXS$S2BIP6A$WT;;_2_Z-5J;eT(S{Qq$S-d>@;z>j6)f$y(h zzYc%I>%B3i5mi7=K(Ozh z2u-5$IfIggvUg3@4l94ua^IL@K2@mrGeDU<`eG;ycrbf_L`p0e1Kz8WrC_Qc@GJ)% z*aamd{G^>}HDo~)e?EUf&aSX1QvZ6x)6r6-EneRX?gkZ^eHqV_TvX85C}H7V%yg$* zf2)Yk3vPsHFQ{qm2tdhhe&`~_YOOf#Uj6XaA{YalVBdQbSj#Q+-WPjiw$SnG5^bA$ zr>T>(bg7`We05^?&M&NMQp949)_t64U1nU(D)da3{2yI$ue_biQExCG%v8qx(P-~c zp*J!0EDI zj41`6(j!(H&bMiF-?lG=1-v#wIGt^2)P2~iIxw7^?C)TgIDHOmogo@|ZX`Y|O>pc( zB|2~EqGfF`OE$R*+mAM<#Ro1r`OI`^;mx-h&ceDc@CKPMO4Dz@kcn}e9@ncGk#AG= zJ@#6Aip?3~o@806Hhwr7H!Iz*(5v4JAh;V*5Xr>Eto+*ggFd=YuU?i4s?=u*z;}*U& z@3s1@D{D+d-M<|lg3I8+XJu|q?PP5q;YE$M@AVybBgdLQt6LB-)4E+QgAOW%ZdWZt z46ORWO}z0COU5e$ycvDYMBH8Jp3~mfmkUQf7L+wZqFx&{HS)|K337egqOf8#1Nl&? ze14d(ZJxFje-O*cw-kq9w~TbE-Q=Hcnac^DDvBE2!`Ow{1{7@^$$MjpDVv+7+g^dw8mT8ifC=)Y+4 zRu#&DWC+DzAo#Ii)5FD8;E<+NgUUA+{SXXTpBgGRCH#L%QK z5Dbt!1@JgE+uYR1=-JAo+l8x9Q$@T_NV4Lj5D+1jF@Q~A1+yL1b$KP%p;G(USyvv~ zv8ILHw9=C(kWp_OaQzrb61Z(8O32`k8q{ZKrgh~i)lYYmp_1py7UIDmdpk9`{~{D4 zS%5JA-Rga0`W$Z`IoA6OZ`36d!P3LAQ!sAzC|+F2c1p&=UNG4LweF z?^WJA%h{4$_WL*&Og=390V<@#g!m_t&qy)oB8T<4%n;oabbAhLT$skLKvV`9Uu&z+ zr}S>aPT0ndRpoRXd=hwl2mCz^907j-=fAW;$rI`RMWEC-VvBj142-wBnvO?bN}p^T zL@lW6zK=f2Sr~Bs*-nNIXHWUStetiF?ulM|RyvOR3<3xPn4N*bj}D{QafW#CDMaaI zbPgMPi8xqs9K{`V-e*kwtQm5qld^ONPuv4wvU%+JMh4@^2Um*X^XVNDiVOK4=BAWJ zN%6CPKif}fV8_kmt8lxpcQagWaN8#%)Z&$;6VZ+3t!SVUAtI!aD?1syGE#x6RYu4T zVjH*9RZL1mIukv5WHbFk?YE={NuS{JGJC3LC=Y?EK<`d7DTe_K6&}&gTc1 zej}-ID{7D`G5;9rmB%~8158l%@T#~`S`Y34$53HZS=#`GUj;5200;m-_=sD40-7k8 zqDYi7>m}L5h&Cixz{Lc*1T8%9ipXKC@4x35Yk=4P z4|;(OXnp+uqk*QF)+WDO1SK>N0*6bc9S2{5z2RQBdCwHs>jEHilg{bx&qS?Y0GvSp z1%dK^2kOVqS~DrFrJ)8O*5koc1E`cJ1;kFOVrq# zy8Z3=eCT~WJ!|@=voF$fU1jYIy+I0~D$VYQq)*PS_tna^{PmjRwd1p`fV+CY6d+zX zt>&_s0f<}rYxH`T*h~k?Cl7&?Q%%c4o9YaE*N1^lgUrFl&@Yh!i$)0O4y4Ia$y2yUVkk>GpiRDZfIg)Cfn&{XY`iSw^&sYL+$=f#{3@v} z#J6{2FH#_0I}N6@n?b19Y>yJ%cY6JsQt3n<)%3J94Va~LidzKF z{p2j@kj8*xL6j7Mt~Wg~F)?AGqoR_-#l{EZOK>MkyB&7w0;QQ(>^ z*HV4>8^T^97zBc)_{DBBNHWwa&H<9KwmzIY*w)rI0NVw?^KdOIHRTwNHLB<7BzR|z z_dK`Ile_-3ji#ND;2qx60gOO=h(QFriSHNffzmJYj?d!P7Y7+fCkv5TAmfOewQHwS zqbAfSd#CJNkm`9fURGGh>$w!G{zr7DPQc^}hFzIFO}%%hMj^0+41 z?r3w|GI4#h>X5r~ir-LJav-F3yM}XuXG?v{ZS6-qTb`)rnd6(RK7fn-VSO1FUZL2` zFe0A58Z?n5SYB54J@sOdz4W>d2^T0xS!jvl@s8ndoPk66+q6Nj*Cv(tMX4p{1k zmSp!_9?wc}8qKx#c?pV2q9sRkjg~(QK-}KZ=Nu&@@%8 zz}C8CiC+d9;{ZUt<9ZIKC2xD>`{AEvr+HwMOMOGYv0;n-s*SXD6YLm&CMHA_-mQMsOcJu1hzTLw(w{teSMMJdLKH$k zmn7{s!I)m`xb{amoryGUVPtRp!k^hR(;kOQB#Q9B4)mB&{JQ|fQa4%(vec*;Ss%rjIefhwx`NLlo99%oDO zZ!>Mp1dVmZnTKJ9!;hoW0l)DM>LPZchwO8IUh*XF7Nxg^@uE_M()fXWlU)gfW`lc1 zjL27MyOsP0p6x&F*H6!xT)CqUh}^eBIXL94<*42z%GWzEY{_EXTdW;C+s;h6j@G7O^{^C{QqWuJC{)kH`-smGf>CZ>;eg|D zeq~YkgLi8t*=t)Rwd>36$6RTqbx9!63HB`s#Fr!!+GujweXhWqD!KP_Qppj~y?DsV z?BO^wv=P@_ejOGtw6xePa$)CY5nZlGiX|f=DL|TGv0OQ<)G-@KzBqIVyewOzp3RR1 z=g^g>waGCYnD7MF1TBqjqb9dLL*`V}$2d+Co9xQMqFUO#w)1BHr}?8Ia7J`ZnAj|W z$xTd!F_0c%Qtw45u<9-0I>3DQ3L5eRmc|i0@l9HCI71T}_zl}o!B_0MDd9Ox3E%>K zWc|$nT`+oCD8wJgqXx;aBo#CbUA={Wxvj)~vN1m7ZM?8w&Ra6L)WPl^Qm1YdN(n;N zc8Q6e1lz?mpjw|p0Cv*wA zIxqP=iapBgA(&_Ycxa$ygh+P|Krh*<#k-x@x7iO#);plTUA9QUyIHJtrBI;8~kb5q6)#}AcMDP!o8-zaW8G_g1$^lwn_0> zSrF|~!1Y0j5F;S0h;M0I1(z$rfzq!%8KI%LU!Z`IE3xDNVY!5$ld=@y*Q;zpf<)5Jw_?MG)y9ym2t)xy=wetQ<#t>Gq!tF(KKlAc1(MoS>WT6>xAs zPmdklP2K-7pe^7+;%e_X0rm}e0&F?3?ci}ULh3f(rJ-K}RX;%pebxE)^AHR$T*Mi? zXF`;R-u!-(@+x)1v0}-vpydCM$SFnuBo7Zk_8|b1-4_Wy;ANEdTal3kn4R}9kbciP>3I(B2bDAsJs8DvX7A|2ET3Xgn% ziA%r&_{luLTK)+EZ-)xJ&nL}T?g0aZNJ0ViiAs?3=yGR8#IF8h+U{diOVc{B7oWSi zatcM#D}WCGBeE6N_!NqP52^oAM62>I?&dV+1W*am9Q}6a+Y>edL=^_5$8ex2nu@&{ z_ipF)SurnL=(BmnklDc^vhGn%Cte1-J` zOT7j#k{Io08$9)kU%o}&fA${-dMqNJc9+8ZMS37a{JP`*+OfX7)szVLph$g7hrTSZ z3O%G~Ay9&G;Kng=`;!((Kz5wQK7K(azYbh(G zi=OAZ(4F^P=_z7Lo8y@OYnw+2G=+si(%OLI&?FBf?>M}|SiNMSo>D+>!6^@8+tCf!PFU6ChGo@gng=I(u^?50*K z)NjvVhc4GAAyjUwWor0?+Z|-KfE#80Z7O^WpcaulpoSA?KCOfA2QnxiN$+$!UG7&* zd6LMZQ^i-yQz1W^WBW;9&xrYHcZ%29nmmceespS{+f8I|h8RjSzO8g|G8G^KwJd;) z7LBYv6egj|hXT9cpzZfA*L&YKzKzJGj7&5{u!Uwqu5WGa~XZ04b#j8Fo z&0@z>(L8!}!VV?tt{dJGmW2mw?0HUV?3cazWsF0&r9AN){P?gOdo6J6PhO zeD63A_1+_>8H>VI-Cd8e93kqlT1TpFE7~-^)s{HuU zH^c&Q>S_J;$oi{MDL;=#PZ--R7fyZvC6O0()L6yN+M;F2fuu&ie@(pI%4tRV_BXg+ zd^lTg@Lb!_zc4zh_mf+&Yk?@4f}2?>TbIct0DU=y@u_sydD3cJWR|I0(?Wj6?Su?} zJ$=JhVmX|Z=aE2D$z^`{TZR};oU%_T>}hyD(*6?IX~Dj;laweNCDy8p;2whi*{n*(oLu0(u z8_$WEE;+=>fZun3tqo^bkqaFlwqA?bU(727>@%pgO<1*OTwhk0GZ-dJb6F~u6Ozl1 z0*DB5pfrwkyY9W*QSO7(v%8@faMe$1oU({g9HSjbe}(;(eUbf;A@vfYe<{`CMYDNC zC`oqSk*U*Cua{Dv-nr_z+MDa3_B7Azh6IWvHDzKWpZ{TtI|)=i)!ozv34nn0GN^$D zK-C0AFr5wdrN)6N!5;sb z2p1rv0*X3Ro*VmLh7ICFg2YsfhpWi`M+TFlc0dd*IPH*qcy@ZWQE&rM20w*<-y)#= zKC0)=9XMR}f1x}ebio(?@8t*4q1hoxpkM$9C+$LD*(+|~gKxvmlC%=0Rn1O1 zZK(tojwG&d!RB1R6`pChp0HS35l82M2_|yJW8u>p?#yumn5+L`sJlALE1#d#KkX{p z7(3aE%xXMeQ~3Si<#m2@P7{dzE^uYf8@RYgIA_9 zM{V-M@$`S%#Y~Zes3V82?NaR8QoL>){1@(R1xba%y}x0DG&6e|_dP+v&z4 zGvb@!hQ7kgz6Z12^1J19AA9H^9;?2gUd$otN(7yp24@ zyk1A8YkfN2o|K77y32Xx`I1+mZ{E>tz3hI-iX-T;X-tmY(Kll&RRa4`dNiKs7a9KrQkN&_(15-&vz*%i`7w^|y}-3i84L{Pa^*eO6&GF#4hzQ?YF*r z4~v`t!G`A3m(|j%k?wLpletOo29&CiXp@#EcTrJ+AWH>Jv3GE9&ih$E=WmhY{nSsr zY!RjLuJrJ?O+eH;v2620kerCsExpye^2%li~^rdaKxW$UYWTn{vKAn1%!g)+W zPL>WS$n7b|HJvD4sY8cUP(E&p(G*ze0#{qO^c}QWaA!iXj+}{p-*x?R%ke6!p@pOS zx6`SV{u&9V*f?pnFeyUi@;Gjjd}StUpyFf7$o_bxZtXv-u+{wyN+w$RS@ahl2Be8A zkSZ7&PDtLdNBNTP@Bm{`en~^By+E%{+83_zsrp<&P3$tEsEDOr3A%dC=Ua%BZtjGV zYY_Pd@*OrZ<6f0X%kXmDW3(fu2Q_h^qI);f48P;))slMS*V-B4z4jI#^v~h@>eVa> zaqKXIdK-O{Y$Seg0u^56=bV)S9lsYL7_5S9Jc^7uSuAqgr5C=o6}P~+W2yp3cN@>4 z9ly-ObxHmBV2T?<0!O9m2Q5Btao;5~V|Gd5Nu3)WJ{7=IosoXVf%8Z@t?X4@u?V0s3*f59*m1dx6eK9Mkr{W$Kw^7JpDAh;f?+i%bCXCnxZPK2{Y&; z?zb1K=cC+H5*-q!mkkHCti8I5q}19>6f5nYh>`3z+-6R&CawNIv7j|AwR`i zfYi;DLFapVK%MJJFeuhR))k;6)Ct1(e|f)V1gpDv0BH^cDU{=CuDlvhfCcr1Y`{OR z1~$SMh!66_zSbt4XE-tWh46DX=9J|nPFSD!;f_w?^6Ca0bA*SLylr`TV;s}%^XE*) z_g4)m*4emc{tnmZxo^AkGC$<|So=>o-o`$8Tc7aU>3t&*I()tXU`>|UzP$dqIv~?5 zLX~%HK+5ZI2*I7y&AzynE*9cmUOe%=qNCFyk+#trdL&{Ta*M7xFw&FDy+10&ah09v z=ak7z=Bk9Dl2Jqjr9gAY@RS0n(F-?W;RCd(Blhd&P!i92D@&XXmj ztyb|!s~IF*Mod9nL6esxG@uj>)ag)a&&1Al_nO!1H=K7)Xciejmr2~$#=CR>#uBWkK zb^_5xP5Trepd?cLai=cJ*XzI2VDZcUi(bq3{gDD7V67;j*Ly>kSDnN!E5+Z_By%pk z$@U6?Zrx|g1a<@>$O}hJCO-rNP7O~sLa7iQzXxR$`)dcT+hGsyz?`@ z`4~trDK6~1hdE_eWO)|n)ZVZKJz&2}^G8WhdomY^Or!mQ{8r!ffz1KuqS!N;ArbYF zJDRb`IDYWW`2`Y}E(@gzgOS{3?anH~ex9t4kKx_;FvF9=o#s9eEC3FJ@m?7k<0gUN zz>$=-F&%PUKMM&T^M&XYcnBl4uGt+qj+2l;`#`TD zBM~En)gYXpH52_FC%a1OrIIybgD3^XRad;<#zG7y?Z!48j ziBzk%qj?df^7_kH{WiC>dxe#>SPl)YfblF_h?6}<$UmJ4gOGa6+3lI+jKggYS@BUL z#EOXEqYUH3pHxLA-PK>wzBjVSV=f$%+m+qpoOdLcrq0KV$x|LPW__P=rZOzb@nYlq ztyfDMTT#0E;Q=gd*F~>Tkk)1NP;N`Y8EW6~(872FNYX9kWL8E-Hjr{tV1%Wizodnd zyLYMWIuL^K6#Lb@d>+hX|y$Q z=E=y^*y0qA>Sk;~m8bY0$Y>w(8h+!eMW*5tpu>lG=sq5$Uq1I3gPj;XJLe0c)0)W( zeGSLrfBA=#6^HA#!HWFWP#(T#N(2?(e5S`Ox*&UY$B5r1&p;syl?~`P4rpu4fINyb zb-^0iP~=at-No?VEMoAxtoskRcx7|V?dBIe%Rj;ShO_wXJG^x5J?8TuA*78wvFbbe zsMl5{HL5(cf&FGOc#jqs?Lt0I@IaF-ChM~B+TK3sD0^ZqW`oB)PRspVscNg&(3l&p5uS|MAzYL~KB(K;%2Gx?0S$$P+dE>HC|i z_*Q`P_e@Qo(*8a@sIoO}0?}6r3VgL;&6`s=783S3NI#vMu(P=6w6%hA;JST-g#NQB5vLHY4W`Gjo@VmNfJjk*q zz`cEXT^3|yfWw{r>n?>M6;L%($^f}PGZs*01awG;g=RpZx&bZeW5A>YVj$pPL_nhi zd|>imFP{Ip$rJ#y6i~W^`Fs}mC;Y9yfL@HJORWLbv*(dw=ay%eqk6gU_Cv5**Lbn6 zp0RPYmozKico|!0(!O-f5O-7V($3V^DIr0+3UI74m z4IeK->%giA;m!wHE#dFV7Ii0o9RUKYoTXuY{%fN!OWVyoOSca!n&`QshXnpTT|Kgem76|#N$LaYCr%K zIdsT-xX#MI``1h&Nf6-sZtm*pXA?WuSMO|wko^EcTDDCxvTNc8sTWZ7ujm7wsl)o@ zc?9&P6_r= z8-OlCn^_V4F+2dJmKv9v#ch^JUsX}cgomz+jh`dH5QrV!A8kBo?SW6&hs4#9T&lMC zd}BPzTPWoR6`8zbtxTue^OGX@zDCMla)L1kW!{~pdaS+F^nZ4(?U?zd1U+%B88k=R8nx7<;y0*agL!lnejx)aT5VpVwcpF0A|>Pucg z-;}ppJ-DAFXu4H|Eyf*xpiW12=ivdE({w$l^mJE-rEM)bN|kz^5NR$PhLUKMNm+eC zlsJXnN#OWX0aS=|UqfSRZ4$p>NVqo>W+-Epi_xZl>3CX~6ttY4I_dx!p7EKAZ^e{t z1^K~v&3?-M=SY|kY>t>SVd1eXEfKi}okbLY(Sfq#aW?AxvC_xJQ z78S&sLkZYL;aK)R*Dv3XAS~L(g>t(CBcQfcW1sTXJStw}?$K`VuRt*`xTNPBs#%w8GCbGw)Sp!Sg6|zt zPNLp@junZFCdK+%9CaMUBxB6dZ;5vc2vPtwv5STjJ@B(vy4}~EzFyi3;gE%D?1*@L zNkb;C$2JcSi6wTO8oC6mkqdeD$0f-r(=1Y{1^q_5N@1%|UB0=~ zNE5l|>qI#bs+ zFU9@pEFz|wLs4Zz$#XakyKle&EMKhn~Tb>s%}z(N?PNBN8!-v4KoMFcf4tM>jc zNorf<@c-mz&4xXU6Hpq+35eHoTazfOs30Wkjxg- zc-=OsAYcuEF#x&lr6DFT_nUXST{Uif(BSb)f}pXa1vqfD-RJqJ|%kwz@oY~H)pUdG7RJA ze_a*<)KyGxmKbsAxSFV?5nz<2!(_YKpI(-cai5dj!rc5h1KGcEH3+`VUiUh@9< z^y!mk_4!VtgqZ98;_5zV5-p2ZUS3`m2mP{T`T165Iu;fi{5dvHNSlo>=U#KRX(%LzH;RK@QPq)9$3NU;j*6 z*K%tg{U+cI4<(RLR{o3VX1S;5x)f`v|MO+H$DZ&1Sd95z!HV3_>&i@wlV#>AWt)JV zhVs_x<|dM4r11bHIv5xjIH1%Jf+2(D0eA&}oy%drtF9>J2w=YbUcHJp1TSBO`li2c z=`txtGN__DKR2HI4NJ@zHAA;Z^%%DQJ`E*1QN9IuFk__2u@uEm7ps=KX!`d-pUQb& zu&=lT;1nf4`XT2xk^{XVNuYiTR71%yyRb;iP{>ZV=}?G2zPq5bQcs?ljS-_f-y;|a zkxT+r(Zwx7teA=TC88UDGiZ8Joc)&O6EE5=!KN!IR8!P!l!wpT$?j;gaA;{H% zc2rwrBc$-`=OmReUu{LNQDcd}kW|(EDxv`xYZno{(*2L5U*0JboU-rc)*QdO^7^-s zPr!vVg3TSH9{0_<&A+%4gXrfM%hbU4>e?pWNGzZ#GQ{6{={GkZ%g}pdT1tPR2^jr> zjSdcK5aEhpU*_7e7HB$ju3!FMjgm>JB>gQTM;~JkZ@;r4_S1z6Eqc@&rD_dr7J3%J zJ3snM@hN%ro)`xDRt!{tj8gMIXWoAfzMFUf?0w*TrnTK@Bp?%Bp>qQ~V!$<@Rj;M0 z#V;?tb}K6Dw=hA!J+Mcw<3S&O9dJg0_A*4WC@}#{-g^C0gVK3;A=v_QS^4C^ly?V*t#s=(VG~0va9kn_8)VLo2 z@dKV&Cjpd(H+YP|^MEA|>6WN9Hq_t0%bvTlDW)!ea~+8Csd9LAS7D8HNA62_7}!7n zW5i*z|E>0JgmSZ^@_W|^g(ISwfy?uH|5|{WX^z0}C6CpaVR}kq{-1^1#TxRNeZi68 zDG~4GKC+SF!YCbvCSU<6a*Y2K@nO95XN{ob; zPaW%mb#@$~O*H3hVyr)I4 zhb8VzwnyqZ4qT7ikE~_}TkTMjs5UUEF`DC!7b3P}1E%jL{2zRY?rga`Jrtum?uL%c z{>4P-f=D%+m~4=|YP=oGQuvfwIt z70p>XbSXg%>z_ZWCIJxx;*%4Gp^s;oYO>>zq&-6)>`T{4Gk-di=po5S0~wCI4LmF8dU->#zt&NtBo(susSA%%qM!B`@T1QKY(mW5+f zr-8YcK95(}egiH*`ri;q?95&WWPZAb;TA zzg74Py{cxNJ2_H`eo8mrFg(c+ZaKP*{Yv6rSC>wIlCH#%ucRr8W=-m1!1~p`M>w-1 z{*YC$n$2RdR?s}XnX|Mf`V?oJpLRGMcOq;1{Hgk*o)(^amvYjS9x)rGHFh}b-h?-Z z{3|GnUgV|fYmp57%}!D*8fH_qmFl#q5xHswcFKKwoW;3VZ<21CerL{`I1EXsp(2s} z5>iUwTy5Hr5nD>%LyEOteclJvARii^^Z#W)63}n|ikkKT8FdlTZ`T!%b85eSro`Bq zf$-lOV|a12#Mo_AFz&)}^XaSWM-j)T8GxzVDb)$(T{w9p%}5egeWu!Ht$rlWFX$0< zH#W*xVlyrWWz{(b^>-+^Ob=dD1Z=@Zz~*f$9@GTBeD)FD{qEuH)0M@@>X|D^^@7&e z;=W|m>B9%g%~;yeCxf@tydpVAch>buW7eFU*nAmR?Tk#CWXLPrw{`Qs=0d(IhBMzC>A^yB79C&@qk2!)c?Fpn_+_n2oMXc>ua^0TD(i;Ul6y#!LpdHslTO7Dtu&G&>(ip zqSO5RcI6h&DCO)xS=E->HOl0I#4jSN)IfCVjNS#QJ-xE)k>_-dA6Yy-99wnfrjvA3 z?HnY9={Dk(J6X^^u2+bpQ~V%)Pe)T!oznr;+<>suNb;y~T`@}9$lp2W;@&S94>Y+T z@T+l{7^NMeDQTrU*SZN7Kgr?j0oI~*rn1S#cicQTVgE;I-x<|Z^X@AK5hVx+LTG|? zm5u@dDN;m{rlOS4yYybABSn-V9YPbOSLwZX2p~v+geE0GC`#`+JNUlq{_lr-);a6) zfvn8lGqd+IGtcvTYTR~^%HG3HdfIL?(5GQnC9at&rO(R*p=(|L#B~z>Le|UH;&A}k@HoR8;JTLj?$_+Q>)Zo58HkC>RmU|@jBzm z{Yh7e8CUTJ;k_#up1tD7YkgbJC|(DoMK}ui%#9(ezRSFE{|H&|b0bFxBR;+aBAGiY@yxy4L3}88uuY{X>q!(!1^VtAKLYRoO#+-pHu}5=NVb{;q#2H z!3~aByCSB|eSsniQgc)0aC-@l1wX4md5Y89=ZaepS%JCq0wT^E1AmGS_9vI7rhdum z2TvdEXR*3U?nBG3M-g5IgRRZ_!vR*Ulm%6GKng&MDIBf4MOiQ^7w>Z{Us5j)Se-f=r1 z=L4K3Bvc^Ib%La=J|SpHAWuzqrmpCmcd4moHSDd)aqrNpSs!+QgpW zm=ZmHTZ;K$v9&pcK&g1HZ=jO_;LBY;9Is#4 z zA3_{|U(}0;Sxvxa%`&;0JX(GmNp&+iy9c?#( zEFEJz^0HE_6#SzqozCVI63-F<=CF1ZYZ@%E2I|!mOzHZ`$7VdgX=Ieq3oXn-yglGt z=pJ?x#WW9IqnK8Bqap+5R_?k<0k#wI z&wq|cbt!UwVi||tY@s!$164w;T~N0BRrHQ18>b~}VL70RM@4CSSa~LkkwGS`8JSv5 zP(n(tql;oac^f(Q9?wgpKYiy2Qze6~GWapbDGZD6%I+0C=Bw<5ezYmpaU(a?T>Du+ z44YZK7GdOEVn-ThXY3ZXpt#%3%glS!~xe-y_{xgQ~q)e`9 zoCVV>wOItzduV2JEH=Vg*BAA6tbTNjs1g-e)DJAx9Tyg#`Rz`PsVKRdQyi7emKO8h z$RTDGXwD|8SFl=wW^$iDhYHW~E9I-5)<|-+B0n<>aW1iEv0Q*HHS>T=cP@Cj2RAYK zWjw1+?EYUjd0zBPRM7E!J6g@_`+SEyxYy^jo9`$G?>~^Ttoyp!rjD&SPZc?ZHgf}V zX)GQBIqkRemg+23)WW{ji2U7;mtsbjfY2R4P5@RAeBKh?T=I{V2k;r=`6BQlfc@j| zCcU`(A9eD-xvk|L4X6>jsZ68eJtzv>9Zg+T#w~lVrZ)dbInM#wn6e&+O!lxJN30a6tpL7rjCR} z%p!)BRG#&l9?YC=nSUcK_dur~R^p;IcJ%pl9&FZ_+SRUakGOCU?@PIf!uD6%n}v*R zUQSPi>|gAtOGXCcoh=0=r>j9O3b=lz9J}Vt)X8Jr$g`P`mGkr^dkP0q^hV6f?zmsO z2R~plxJ>J__(8J4WQge5r)C5qkSY4&!~jWQIY!diOLjgxDWg`tYjwG!WBdUOi#uLq z%JxQ6``D7Su<;XxZWVJNkug{DXTk9;G32?COXF!ej?4R9_p4PQ)ut%u*y;y@f>+pw zCO{b<%kZgpYuMSa+pzT-+}x6#$rr_qv9hF{>V@l_e&;xu9^m8AdDB#dD415Crz zRPT73DS|hKI7<2{S}kC`XizE|Dt3RTiCrpP&$0I#rCb0!jWBp^ke(xIwA{Wi=?m3| zH-|>D?esphKTnvX8l9$$q$6NhyYt!ug-*ZyqM>|F^tdD0yAhLai#PVet9-a0Qw|tO z298qiHFx!ySv?kZRfY?k0GJADAZocfri&SST8(;8zyh=PX3(RLK+pL_yTxU=XY0AE zS@Yg-vGtLYYBS^(NdNRy}T?q;=W5+5?K+Av5?_fHAb;+F(%=l%$?8+RmsTU4UnaK*K`6~ z4o{X0(b~G6)DP{~N@{6IOQKJKD(c%YV+_hMZ|o83e-66 zz5>`{_IOrA{y|0Yx23)T2UWnFOVz;wZqicEiiHplrEkEZuUsGmAZ(w7XyA{ws(Pan z)EinbycooO$r`4tsy;Lh&+i(IF$k97BBF9pQ_s+>_x)4#b5dCKY#+l}@i;;QYqW5b z2?JX(*-!I%tU7L;1%elW%t3! zCFn~bscPwTshyUH^_^_h(K%j_$1ws7g3L=`3c4{j&#orhOuY6j@$ z!TnbO7YhlHrQ@gQ*mb}jb)j7N<i9eV{yS>G_pkIwv+WBz>%A`-?+9&5-bUoV zdgkuqElk-uw44r@l@{I*N(<3h^oBlyD$uL^9{h4m;3_o`hxwYGNX@Ky+)65cHeHabEW@<#SYrrw5*0XZ zj`JWCxWS4uFd%>QFs2( zDAN^sU)e5Z;Z>|O0=jk0PmxW%u`CCpMc;Nez*Ewnp6Nn97e5)KmD=N{`Tc^*&}?s>V>Xwam4>&{})lLfUv-;5dwao zzfNLl@Z7(_n)d+{ZlFffM!q39=AlUQo<1ENosWAb40i63@1o;2E$-XGM{*$*dw&F^ z@=a6)q~4#9QMrbnX*r!-b4}8XmH0yc@_jEIzvK)`nP2Tk@0*lP+qbIND*|@%OKKBaW)qW^x2E@m z%f{9rL4JhtR-fQbc&Y;sW$Y8g!fjmrYXnD$j_mtR=~|hL zNgIs_%^vZzC)LGcQBU%`@w*j28E=QQYAd4F<@ERlM;ll zera*^SOc-|P-hU%iZS$RRdMegoe%n8?cEyOAckP03}LM(X>a`l=bm8sXLcYTLKL%y zmW5F|{GdmFH@*UUQ;Jyp#3lzbvvyK(&vJr4zwX)*2b&Kgg<^I#ar=Uue%JiV<%6WN zoTg|RgbVFY>d8f&DDRo4a*58#^8};o_KH8jrkhl+j`;a#*p(F2qkf7&7-)=uVo)t2 zdRSE^??bmAn1kE*wD$ins(!=Ek#gJxB0$|L=kqzgpM^R{VAA^Imwuk5-+0F}y&E?B z)c5TYR(?YUm%0K4a`h>Py6+s4Gt*BT{+m8YABJFNb_T!}Te6eHUJ|$r4NV zI+pLaByAJ!?`WNZF$jUjkjkEmUshlu!HLw*I2}9)z9#G?ac0Q*#3<21i+;6L-<|@5 zdjwVpzI2SPGi}`tw5`1s&C^Xe0QzT<<8b= z+{_De%{2wKZd(*z&2h4|)_^~*t@*5FMcA?%##{gB1otJJ?)zEZrzM8|bIc7Io5;18 z7&5Fl0J&5&&~^8!Nz>80b3xv3r}1bql)!I_8WhO8&Q#9m4>$<|d7|sY&~?+BJGT!e z;l55P^c?qrBD4tod4`Q7Hpwo#7oqQ?Llx2~3C}%5lSZqed$w&_qdKo?=yTUOiirXt zl@G}%cZ=&qPCjduNSQhI-P_srJbol!@Cep>xtHdLywr43(LriG;qa#|pP}60KPYAblZ}(e z^qDZorCcci{v^2n?StB!r{2^?b`I@C%Pk7>xFdYcDKMVdA45ZCHv?nH z?`1+DiHm^C1t{XRI2R7pg(~gEFDaez*H+!7K0e^#AX=F7a=5v?K!tM}h7UmztMd%6;4^lpg1~w*LhhO22xvkRd>9UA<D|C|Z&{IC-sSh?&SL?hbuf+E%Ft2Z?bk0cw>r2V`pb0s4pJkbG;N zufrqq0mEY%pqi9)uiJ6qoewWjeXIF}L9Name(+j8X>OJ;3n}YIfPOO|E)d0LOuJq5 znCvX~K8kiXzI`?LtW|Q!en?ps%+{;(*2%ERRFI|JScxW z64?RddxEcfHvz~M@1gZ~>}a`(Bw=!2gbjsmwd@ zyt=6egfb>bM@Uwbb_3N==nMD&=sM}xDJ?KsNRXmz(9YBu4EPE!xjfewjQ>rOH5zx# zi7+;^d3NvgDjcK}O&KAz*0&gE<)(6C^71rO7N!IHAYrhQc)z^I=?6BIxa?`?xydh3 zpb~e`dLL9uBD%^#pMKf_TtnQG7V6%M0yaf5KqQ}=Y`bp@C54NnrVTIC$EyWpj8!$e zqt*%wzn|bkttUj-S&o4ik;OUhQJ)H%b@zucc#EhS5S6^Vz3Q5*Xx{7TnC9sD;fA_4 zc*4Dr!8^~UZG*j{?q-}(KY><0EJRE?p*WLhu zCK=1q)p{;2!d+xaO(-w#sRVVf%WBi_ zDqRUDej2sXc;y14wKPzGJe^D6sSNIVNkF(fHq}Zoi{)k*fUb$7xbAYY@B@({d@o-* zGyid<7$Z`S`ABMvM_uF~7apSJzSv>&ElRF^xt62{5{VYYD7^3oKqySW4-XCS$N-@eggjm{Mzxgw=S*#auWY0ufTZwfg0W%U^4FMQfJWma8yu2-o8Szkas=5 zz{k<=gb+_HP4J=4UJS_-72M!^XEDH}zAAtD|IaC$^ z42#mQg4_A6XC|NRl1Jka&IJqvo*nr6pQ0R&_i1_^l*AsF?*tn{-gvo|zBKZ4qa>#V zXfhQ<^A|q>V_l4lC(2*z_=Q$-fo$-T;i-55Fabz$0WbmBi^qKUZvSCNzaYW?89?p% z1FFJu1KlgIm!;YFEMX~D359{rUyD?@BP(rgphgy(b}YMDcuDYM?Yt(mzMF{fU7NIT z-M>``EtgVW?-bQ7Z4G!BKa#Dx*%fCV>Mw#Ych}qZ_$BCUiA~*M zbVmMYE~Y`(EtNA9#n+vY)?*vmQrib@_47_thOTgQ;5~{!L6+;vn_W(V_J>`YPxP4HZq+d(C>*`O%eCOOspSs=0hwL}Emo5vCBrpl@<02})Nnb26&i6oo_!CZwg zb-a$V-8=r81r-nrS0fXyFfx*gy0g3@Cjss_Jo*HZ)|A(Sn?%gdWH_ljIXy=C&3_2W z3)qkGzyNXyV?>V|P5W6WKnU`IHxDvnlwuY7v|=b1s`_TH1-Gt zTRUuU3B!M4<@y!v^d&a8wB4rP)L1nL=0x0@sarxM>!cjixmH~19$k=M^9kEFQA)M9Rsu!z zO^eSBtEaUz%zW+jsOy|ejZZOXs2J>yfc;clnaLPQ@p&Gawf$tV&xCtmi^&)&0l+x& zf+q>6t|q6v0`uk*DJ4H^2aHRCn}n+PA5Vn$?dv{X&p(&l`9QLXV^3>uoRi-!L`Q#h z{=TK&*)ncoom)I4-i--#1Qj!48l8-v^-#BB-Da04woa?-w+z;TWY+7;Id1l%m%{9E zCtiI(`O>=^hX?K(DDmFe>%h5IJ1A7@x|xfpO=&x3nSW9LmfJ;Y*;RGE#S!;}f^QT}GD_ain+eA^+j`P*!X> zdL4z93~spnii=1)b##S{VQl%S-Jv?O3?2GY6`Zj5rIA4qY?dZg>Lr1If$WQ%0ON|= zzIkQm^IuO53)R4h5Ul+yLA@(1V4EJ4xu!q#M3o65m^J}caT|J8m~i)T5Ri<*jD!BY&(|i z59GfP(|q2}R*Dx&F@VW|cNdAHZV%nD{S+iXi7Z$n>1cT>=x~@JUeg+EWMK6 zi?o!Wkj5UR#3j2-B(+`rt!VG{^dLyh9Mq~jhPQ2);;wJaWuv)V&YtavvRXM4gM1@q zYON`1IRa{V&v*}HIg~|E#@uV5652J+(#GW+{HmAM!a1NAwSj#a0a+P3@>&15Zso1= z!2T05K1Q$hjjD5Jhe-(KYvE0)L{_4w+!#7*Hew|7Gr*>5n z3}>ZHRbNl-x6|NE9&YwdTKZk2<#2lA+kmSjCFakNvnU3>r3NhAt<}lR{@Rf}59FPp zsn2Enu7w&E_w$qx(p-MQtSYP=uJMG?-_*ddULQT+t|*asi+;xvB@K!YIt+1xg3QBuD-p{=tev(ZRwveU8sl{wlc(-mS2-m0y7TQ7V~T_GhJ_OfcsC3)itJphO$^`y&~jaAr5NzL`%K_ z6$zVfisOK-!5QnL09S)&S*6D76oA->0VyHmkteEnj;Z1O2c*r#tdfcW`SN8eCW%LTS?D4x{ z7@DCr3|8Dmw{@bHH%aKReh@VDvRaj~-*JnhiQO@hfq38h4lNMx7kVA|NfkQXl;F>Qp4ratJzCQplHU{~B~(E+k!;x3rti(n>)!WOw0dbMV34js z$dWIWlz0N<(F(hd_!A9w1)*;2BG<1`49teJfBF0)R9ion z{g+n2*9Qi={=Z>i#_=se>nZ*eb1YM!$C z79OMyEJ%27dYJ9Ix}pa*F(9eU_@qYE+2DXsI>yDvPB+)Xa=u!QawmAYa*HYSyE)N% zS+ZD;Ox6$wB<%}$Ad=(B+SYSRakJ&XBsaY>+uLTFyLYhOSqRc$jbT!G%D~(wMY9TU z_?{M2aI{P^jKhtz@+Hx|-ZF6p(b@4UeLXK!@3%i5azoQTJdY|W+$j*eLR$*+d8fR< z`pkCLDFTz2^UWe*PpcTrFd7(tX!27pCEDNL!f4u0geT93Ir)(>D;vmFWuVqYG#OHZ z(c2mFG8s-YTe*JbdOxK8Gkm=~$dyZ$DBH1!8Pp?y{rVNzh}F-u z^6UA9%^J$rI|_$x)fw`H|LDH`)jPXz#qC`6=g#CbPG9*tr*}f-NQY(UvfZwB(WSs= zdIRU}X^-}1q2^+~Lio|+E`~Eh6 z=%GLErj#`VZ5}7=sF-T0HL0^F0tp&uUwWfG>*2{pLSzh z!xdE_ekPaOb&5#_-t|3cSUg03Zm5>BA55{z7;-(pY}rGC&9*gOU=0nh;G3Kz}5=iiH$q>1WY6Gg199@XUJ2*z{Xi!+{GgagWw32@6Lpf{k? z;4QcpUH>1A%qguaJy}AsWc?5$ujTzah_^uaT@jdD(#jrt7|@ToA$s=6!R}rX%le(g z=B=-_S9^?i{%pvbH;hsUmijC#7fGFTmS9zzDp2*Cxa^Sh!g2}k6L-U!yKfDX>cC1; zn=uVTW-I%NBd8OtG^;0J*E zg!l`(_dr%IcV>6yj2YAcVlxAT_cIu{G@^7mpGT9V{CAZuMxSO#cFir0U+HO+`_E~I z|DF2pt;WD2{ycKMn~T? z?tn-;l2hy=clHiRO0qZIu&D=KCpNRSB0fc@W{e<4P7`K{%{tt?sD>8EO~lSiY(`aT z&vPmNVbT#q?<;e1svih_0P zloRpuHL_T7+HR{^GQ8h6^}w?TZMLM}O-#!*A_l6X%}e)g->UkW#xD`4cy>Z_&g^rB zK}v7|SKwrZ5@orq*BD-bybLlfdkD$blYv2??g8OW*G z1~OU;N#~e6L>gr`3?~UeZ{AiCKW7SvbYF9!MR6WUnTV+`ab%JeY>Ui1O>;6peBzs17T^mu3 z;!~$k=N+}3vAm_W)Ly|%Pb)e#-f5WX56{$A)i&fh87J*W7e@Jy2j}etU6)wK*9Sq9h zON+HK$*3$lTzC4lgGMUnW7{^rJSNg+k~;3ShpXx%I)h|mDeR^TOKp+ zV)VS+K7(^7)tl?1#}7KhK=av_`i2&~Vx#iL{eH994KET|(sk#0 z3u{{9CH(+@@PpgfttKf%&T+Ob?VFv7X?z!Lmv=`)bmX7FO1FDf-yAFDdUb7nDeGsi z96#K)3#S)U`=0lHIopmVI9m$EsA^!sOtq0;7VnWt;N(#IKGV_8ZDc|)$`$PVG0MNI z9lbl$2vcrs)lvibXJm9tvsJsOk`k}sSB)Bl&8%DqRU-ao;1gPCU|IbvRz`K zF_=4m1?T1g$+ybkNhshoq`7b#pUVVGgbcd6CMx^3xV6@bbRe|Ds`}?Bc4O0c0wLip zL~1reU3W*kKS{j)ufb;2=P+=r^~fD%fie==hl6?i&MA**r8SijNrsfJJs6eT;HB#V zQ_&;~e|u-OAFNj(J!&7mQ}CxEiG(?1=W;ZRo(@w=B3iXx5K~{l4HqVoMxzk^Y;$xETa64Qu2Sw zWX;;u{7IPMr8CK>8UCct6LFJ3s1z;Ie~osf#f9h{EAlmjPJsXZ%pH)vss(vY@{@;- zNThrqn2KJT`#I7tNo5HOY?cosLXNscm&KaBbszLd{|V2?d#xn69&tySNbFrIf!l|$ z1jdEsu!Jx;2-8!8~1OMZKiu<(f+^8;-6h&yKKo$ zLfRn*3^3p);i;avDrx$eU~+vR>F35mx=k*yz;))a`ua4af@<#)ljzK-H@I6T0J9zNO$vaPaSG&ri5Jtqw@-d}w1uP@BDqnjo1Op3 zjh!wu$fGY~t#A^@8ZxMWYdB(B?#0y%FtS7rD%cpz`-;mDaTCQ%UP&lx%-aAkz_*0| z9uH)I1^MGo1p=6f1DN}6dHueF2M+&>zu$k@(G4_jqe_k@@x7kOtH>407zF$mTAws} literal 0 HcmV?d00001