From 93a6bfaf0e0ef073aeda415db273402e134c3495 Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Tue, 9 Jan 2024 16:27:41 -0500 Subject: [PATCH 1/8] Document managing users, roles and accesslists through IaC --- docs/config.json | 12 + docs/img/management/access-list-web-ui.png | Bin 0 -> 77697 bytes docs/img/management/check-users-web-ui.png | Bin 0 -> 32824 bytes .../kubernetes-operator-troubleshooting.mdx | 70 ++- docs/pages/management/dynamic-resources.mdx | 6 + .../dynamic-resources/access-list.mdx | 303 +++++++++++ .../teleport-operator-helm.mdx | 99 +--- .../teleport-operator-standalone.mdx | 16 +- .../dynamic-resources/teleport-operator.mdx | 3 +- .../dynamic-resources/terraform-provider.mdx | 36 +- .../dynamic-resources/user-and-role.mdx | 501 ++++++++++++++++++ docs/pages/reference/user-types.mdx | 91 ++++ .../resources/terraform/provider-cloud.tf | 30 ++ .../terraform/provider-self-hosted.tf | 31 ++ .../terraform/terraform-user-role-cloud.tf | 85 --- .../terraform-user-role-self-hosted.tf | 86 --- 16 files changed, 1074 insertions(+), 295 deletions(-) create mode 100644 docs/img/management/access-list-web-ui.png create mode 100644 docs/img/management/check-users-web-ui.png create mode 100644 docs/pages/management/dynamic-resources/access-list.mdx create mode 100644 docs/pages/management/dynamic-resources/user-and-role.mdx create mode 100644 docs/pages/reference/user-types.mdx create mode 100644 examples/resources/terraform/provider-cloud.tf create mode 100644 examples/resources/terraform/provider-self-hosted.tf delete mode 100644 examples/resources/terraform/terraform-user-role-cloud.tf delete mode 100644 examples/resources/terraform/terraform-user-role-self-hosted.tf diff --git a/docs/config.json b/docs/config.json index 7c5878168614a..d0dd0cc06a486 100644 --- a/docs/config.json +++ b/docs/config.json @@ -608,6 +608,14 @@ "title": "Using Dynamic Resources", "slug": "/management/dynamic-resources/", "entries": [ + { + "title": "Managing Users and Roles", + "slug": "/management/dynamic-resources/user-and-role/" + }, + { + "title": "Managing Access Lists", + "slug": "/management/dynamic-resources/access-list/" + }, { "title": "Kubernetes Operator", "slug": "/management/dynamic-resources/teleport-operator/" @@ -1670,6 +1678,10 @@ "title": "Signals", "slug": "/reference/signals/" }, + { + "title": "User Types", + "slug": "/reference/user-types/" + }, { "title": "Helm Charts", "slug": "/reference/helm-reference/", diff --git a/docs/img/management/access-list-web-ui.png b/docs/img/management/access-list-web-ui.png new file mode 100644 index 0000000000000000000000000000000000000000..2e1b1b0cd2e996835fc27e68c7d665e9a367c6e1 GIT binary patch literal 77697 zcmbTeXIxWV^d)S0?0^*!kfKtQs#GCT6r~sG9i(^AAcT$$P?26DARtJuQUZohR1^rk z*91fYNDD}nK0Er9|IGX0{mqaMB1!H&_uPH8AwAN=Kl*}|PYd->%RZr{}M7@Q>@@agW~+1=F`)Od-xYec62-&al=eIrKguQ=$W5w?O^NT$B|9p!L_4i-?eXC!Qyt6&Od%!$} zZZH2x)$#2U8&{Uc_*ta3DHpeA&jL1ru-DylV|INgd~IIJhwbl!v!SGg7JuOdBN4wp zCXGCFyPiaD8AAPiibo`x=O)Y&eu~ILzdryc{P&}B$V2}OHWC3J{QUv=_n(2oA@EGU z{|NuWk^erx|2)LM2Y>_pcgBAX0RR4Tf&U!<4)oty|2yx02k`OaT&s!~`SIy(S-F=; zk{uCX6TdwnM3t2{Yxkn^3Ydd=2pFOO;gcTI`XZ!NdHBO9l?cX!L@5*<$Fgk5-Gq|p5 zeM>2lu+6)??E>SvO4Je8sX4j)J-LI85E1YAn&s_$=57o4;>0(Q;3Y_GnQ>& zT)({Es(W&0Ra-DwR@*VNfl5EK=rWdZa3^%iy&V^kjIn7r2-7E7)3wCstGzOK2^%bb z*KLzd{CFhc!ag6D;l@~A?;Ndc8fI~22TCBd8@|6E@${)oAQe3+#OwoAw0hvEI(JS% zlrUi-)WO<932F1ZYPs$0`?DYILT5cJ#OF3V`IVcR?n|s6-PV#BB3?W5JOH2AHq9D| zvyCL+(RCq=x~t#FWOAG7Ukr7zg?B%V7NQFaO`D0Q$D89cdB4Wy51HRCch?@e`7}r` zlu6jWlwqjUPH<=m>%J{J*=pQ~=C83^IvXkrqmy?0;l!Eg=D9S1xlwXj;I6E~vf z=jo4!)ES4a2n=1$BN058>R&O{_nu;kLdf`J1lXRGkDr}#x4HD7L@H-9Fbd(TCTor> zOdt@eUE4-?O=^R}+QY=%x1NdEuO<0jdnig8D={>Dd6bsBZkgmfva?@RRaL-!^$oUc zvc#*!KscFQ3H?BblE|t(r$6g;^{XD6Pm_)lu#(g~kXl)r*gMB}lzZT2eU3AhAFG*GQV)qD^gz1-GdCyC$o}kl-Wx#GkmhATZ!bE?jgNYOVukpt=`HKVzOZ7H>K_T5== zLUsb{?r{o_pBxw}bJ&HvJvV5Qt*|;PW@Kcfk)b?LY?ZrtoOwXfOH5o`al0voJM(Os z>m*;G0RK~y81wDi~(agRs1C2D7#{`yaB6R=y_O& z)GkQWLc5u;`}Z{bAVY+^Jen`DTgq*^yEsj^(72BiHJEFWscP1Hg0eo8)5!Pftl2X6 zRkuATM{M%PNO&(KDw4POe76?qnx~@>KCc4XVtY&lb5|CQx}NU%oE_S;qgqG`k*J!R zRUqdPZ_m$X+6b+daAFMwI(oYdA;&q!=f!dOa)otq1`1&3RwM3QP27bvwPJd$l*k0D z{57E^UfA%f_!W(`aQ|bpe0hPpgv`R}fXuqp9cCQk|aJ1F%P?(Wf^C9DTyk>eXn z?taY7pImO0?&IHQGSQl7C?%8q2-1`5M5|_Y^6GTQyG$x{;U=G}wTy6%PJTu&F($W< zKp-r?6R>Gbt#;`6&K{UOSZc?JC#i}gI1UsuT6@p$$S~p)Ll`Kl`FV<#jkvesV3#oe zMOs_erX;EY-}IT?&H3H=p5Wb+{#!rg!Zt+b;uNi!A9ID!BltWQNd*N3kcx;{SF{xp zeL?16K4;?+-D8*yT_TS`x%0b~s_@f%^cvN-4#;Fi9X9Qlog)go3Jx{&P%6@kCu}EH zZ}*^@aoyV6R___+QVq7HdDFV~2{^Q+!acV+C+yl_L66*#e_rkVR%h4%$vM7Kn;sb} z*zsA|w>ZN$n@Y&&Se|dT*#uKAFY=0+0k z#F*6v=KiuKHK0_=&2~g zfM9F9gw0}fcD81wPLydiQk%BF*lpGGSc>wp)Q2SB^IWmrWI<#-K5+ER zIVrR6&t61rEYES)&J(KUzkk12o0yo0dpITTI+2&Wxh(PU*Yj8Q1I01%5bwhp)N}R( zry=)-e)V_tSz(KAo5#;bf9eT;JcyM4$&}2 z+NFC^>ozG$l)H>v={9(;E(5oG4;$)aS4oO7Jz>LhFWlhzx&x0B&K_(`sG2by5{zlS zu}?d)E1e19L(0qaTsjLi43@j05}Bl2d3W?PWOltG^O!dS*-EzK%Um~~{Dl;_>>92~ zyy3Zcd*_*PtJ8RCpR7k;YC!p!Up{IlU(n+d=WH}>_r_v^>SUdeqNUqRGVjyfj&G^$ zR!@sMa-ue7^n7&=P1&R#zo@c7h^fe#7t1<6U&`OpW;9~E!I1N-O$ZxRc)fTmq}#}L zYPftkE5wBrJ2Qw$Xna5>R3&q$FnC@}Q=hWPST2pxY? z4pxzDDfh0f_4PH)7N3?ux84oACZzxs1M?NvcJhy)mXI{H^XM zuIky&^jx3wQf8^~?_Fwk3`}pO%Z9{rp`)KZ4$0N5jUgn8`|8Z}XBm?m4m`d2zbFJ(tga zXKVjK8jX2hm*JN=Lm5Md=c|1j<&bo;NV<(3(e3-SOZ3ZXrrLc4@dr%;ar5*^{3*xB zc%p=5E}bhFiqWUHcK%S9Jo?$Ni_|)($sapuTNax|i%qF3UsKQI@@DpphBiLHsaZoT|Nik5HtGTluAPClZQy$PbVCFsU66 zpUL^pVb0rJESbkWmg6FEn3-NWE~9=TQ35Ita$~H-Aq+!uZtj0z*Ojqdcw=UaAIUd0 zJ9~b9*F+#_ZU`l-U>FyOGG#9d9@cG&t!8*k;xPMw=&RlP9;8-9@mH46!kH6C5UxOTPwAx7K zG9dDp=AcI)`{xl|RMY(iCB}pX*^ZoIyQ=jL5(h-0*r_b`7&K4z?$RD%dq8+lemh2( z_#^R&)60FCE;W|;ozR=(-s!KXOiSDoF*Z$ue`fIYWtf!Sf@pzob0intif)t0;Z6I2 zC~uja_a4TG)9!f}1dqG;@|j{8M4btro(8>hA>A-`g+MAIc=ih5HYUO zAr-@`uFp`W++~~RsFUxe`1e1tLtO=o!l6q#AwB(zYx{U}(T0~JW~unevA zHJA-`jSsuIc}nZ}@s*-#G+NQMG^+qo(W3gQ?c(srZopYF-^1H%GG5C+?EH~^SXVk< zj?3N>zDU$qoywd(y;3aSP_=L7YUMG^u0~&76p7H-WX z?^1&Bu-A^% zGx*)RcZG$?el+Wg;|}fbM<)#(3_LiibsXuces@+Y&a-qAQOZtis6ZvTDkW1)$z)<8 zp16MLLQX;gJL6-tot&7GLF>5!QtN`p(V?b0$+&az1X>;~dE?4#N&5$FdHN-of^LJ- z$=w^$O)C(Y4=D3zPJ!lgNnT@|%9Y5K!70H>s^bMtooU&2?HTT7ni z`X!UE7$oX)Z|?81Y05cfF)r-gN@y`Gvqw%eX9woyDq@0q&hi>K5`G=&%51aUwFm-q zi5JZogc;`TTm0*UV^SbDQbaeE0Iq6|Sg;%h|7bN1a#VF&ZW`r;u9hNsb7! z?`-tK9t+`6-3yJ&hwE)nE%BJ;o~tTkXzRGgS1gZRV?z}mjTd#f=Ktw46tY-;(z;y2%ZZHPhc^CkcVZ}r2+#eM5;w+C*TB7K{>2nHZacuT8SKYqtADS9k-W#^_ zYb-4M+irzRe*(G&|1tgawv!sdfA-x%?<7F92j9O$bY(?xsbu zjXF6|$eb8%-2#AIO$t$GG&5DNBDy(*RRxz3n0OI7*AWJ}O!rD#_Y6>FBB5-6GbbXhI+uO87z3ex43NKM4ri*km{@k$^tEHL{N9ncclDt&g>^k921vR^vdr$@ z{esrbm%nOcs`75CXiLv&1IN?jH9BPqutJEZyUS*0+U(4rjEnGKly=W)JC_ZjY7AG5 zS>W`<0S)fjg^PDy`fbe=l|XhBeieB%m(L^L03-71B_01TW=7OfD`UP|@Ks|Zd#+Wz z1TR+5$x;Sc?t#~6G7mn>uU^ubrrhWCY=Lm0<+rB^HT_9C6bRb#`kElb98w_RvU=+5fNPfXX~;S}ci%p$u!w{* z?hwf!_{}Em2wYDRs z6r1Pl>&H=47cFAKa`2<-YacJn+AKl3}@J9l>z!ok9iMN4whu1%)L&Bopqq{}7PT ze*?EDXY)%o*$%S2!kg?y_EWj>Z`25^ilbbzM;+K}sY z3r)76UChR@mF^Zjon1EG^|IO^<5Uw7BmVamS>#3)$?o$5oQGo46rvQoIg}>!i!HOY zb9-$|ye4*ybVBT%)^(ZQQe&Q>PserRyi|5|hr zTjH*X{VBonEbhEM4*lk=?w#w{lFEIk+O0iB4?6{U>6Y}FED=~iD)bRdoUH`4)k)># zZSm6WL}Q01&r;-4++P%!4Wz%0$BuSd%zgT>3Te;pN%2t%JB4A#ZgSy`O9kw^e-s$w zAZA=gQ@<|Ct|T-?vU4LeDIoa0HBeR4FNzc+*%V01ic+`T-nSo*P)Mz0Ff+Nzcul}i z=RqDoG~X^NiTONY5#NumQuS*>Ba4+v#y#J24s)VbZw<`&<;~@KSG)O z1rmFPLhN*JrrVKHU+)h1f)6;0rWmR1tEW6qSv zCd)Wg2}$R$!gBRJ6gOZJT#?Ad<>fq+s=Dg!L;X>d@kxKk!ZD9;&ak_X#?b4-6q3ye z$th^*RF_IpJyuh<_QBt>o{`o%KY8u5!MAj^w_2k>+ga0i@{G?_s_M*q;2cRU>a9_; z=Cc^beTjUbmL3===^MEIS~hAUu7T0%T0XmjK(CEkxX|-(brI(KDalwa$H6y8}z$){cle~9Y$nUltlUcS=(aLVi}`P7p2a?VmGuU-#L&~HjxR(pAM`O0S9 zDR#u>m&bn?!$%7*a~!M@T2-xX#cZhEo)KPwwzok3{>>hL@5O}62cnpAOwe)dk!&cP zWOs(g2?G&?zrVhxXNm7Kx~1{iav5-}W?tnum-z_?wtpyWpS`)(lGM7Bh%3#PuE>)e z?-*1uu20S1r%PaQJNh@5dvRo)Le7~@pfsdkcJze)OJaXhLKLm_bU!|R5Q9xOzQYX@ zyj2utd1g-LKN|W!>iK_=-~VsiHFSFaaOVHx0RO*?`JeGVTEMvqc+7vOKQ=RR-t^nz z`&W~joD!FIRWEyZI_ERunaEE8WGDQNgBD38Ys}V@syu zMeV!W2=_Ef;Q!&>lLwZD=B;(H%+}VKqVEVRlc?dYhyUa4rgyeMir(g<;9VkbXfx|s}ba}B+YI$Q=7p7jH?CapOqr??xIJ_8(S={8%n{($Z zNtK|W%|FV8WN`V-WM`&hG+x%iPjRK}?FPuT?__TVN;duz0N-Y=<2XJJj#-V=SkzFo zoIhh)h?zaN*e--+j9I!ELeYu-{->PliiwF~y*zMJCfOz76>y*Y6*wHfam5YU^31jcIkP%9@R}ManZ4fg(fcuWKi%{#BEL2z!xwCwOH>>JjDG#PXu4z&OH+t5k_^d+piK!k_@rGCIu{4T zcJbk2Rv@)Cf-|=3Bf4{JJIw!7u1G5${o-!2#HM3uLN^6r{rvtlYCQ6#({ORmU1|3* zs2i$r0_o8TXg=dAuN6$lWY3J~(}Ty=qnf@qq1J~h(`Bouyoj5Vk~!IeHmw3azYcF} z5UO1Z?YgXi|BF@3P>g9D!ljGYfBJj}I8V3D8SS_CK0#alS_dZ|k-9OF12mI}{di-K zfR2G4LyFlu*+7R7C&&F}I%+!U<3|$(QAs?T{>4eg6uBv0#L2+!^!iKa2`KcrflN)P z_`})DxsuRE05FVk$~M4E18rBF7dUr7zuLzt;3chughYBIGqZv}xl5NF6-bRA91F8j z5q9pp%@Ms~^8Rj$utQ$}iu-n%RS;GGAG zwaEnRX?8_6C0^Hp`SEloUIu-lRa0z?Hh+jF#$LFIXGnJMx~9d#w+jKs=pxixTU(32 zcZW69)tzP6ZF-5tIQw|0d4TSE!UA&XO#_>S*`*P;L`t3#R3q!;>9N-)OD>_;xRea4 ztmlfxI6+;jbQ^NlmL2}^;e(JpL2vli>|j@sX6ACtybAwHB{>jzb?qmYS zZYdVP8oPWrYbD+|j9Fr=K8#;*0OLImz$8O8k*}v0q?LT-)W52ZmMN2O4f|d;EOUfe z%}`4&+Wq(mv=aYa-?BGiuJ)seFO|gI$dwPeCiWjX?le%5f3r3aE=Mkmsl3-2_*%mf zcVfi5ddon86rK-~cNSMxqQI%X~&vHdWFL&S=9o}3uNkG`H(^4f~sOPg>wmaxyWllpEf@}P0>x#zea@C7( zLqswH9hk?OUH9SVY30oeIiv!a`cMN`37_TL)boA*kD60}DfC_?qs4S{jKm-mIMot6 zI7-W?f0U>@^nfH0wQkc8ZU!;d$x%FennP6)NF?Z)_V0VTJd>q_E&xvOyd+XdQGiEKt4V2EE_fk!OxZ89E7MqCh?`Yj;P^;*hCY&}{?mU7i5_xwOd)m;iy3O<> zC6gVX!^fM5C{X~9Zz8F{q-tZTD^s^=2o|B#*4@u{S$}B1&&;$*5OG@BA9S4MB)>@| zq`d4f$_&L(`u+9*Sbv%k+=?vI>me+-|fHKaH#WDGq@ z3Yi{=BhXLmej6QwDpTsP`!2+djhDk=75Ii#{^xeb`aLm@usRJe_W3LVmJN5;X|sk5 z`%7q5;sjdoc>MdX6DZx)7Mi#>_BHPq}vM2VN2 zTsk}yKwrqagF(`NuF7B$s z>iOD_Bz%+_kYmF}6+Yu_iW{?KZ{Am<-&}v7Sna&~_^CSw zN+gG_h@{#KExt*mN3puTpDWHw6G!q90xY$da&)0l%;RZ&zE#IN zphvWGR-Tk6--cC@AnZ_J%$~@l&DG?-v>o+@kKq5`Br?k z+>s3x%((GW?kYqio{933M%r*=yJ|rBq$uwWYbHb4ikYp6HBD~@kb$(^+7uPpD;bIe z3*zA`OC*|Gm(PKz5yZo!bt&}PVtSweD9}-(oT_h%&zd+AN(bO)kU`3ue5)&?CG7x6 za-C@kms~8(da@v6>(3OXalM;Ali|71Y$}_r^kRh{ZqUyDgE;~~`9<#Ae~8*|i!|V$ z|3%Zr62vJfy49^j%JL^ zfi6O2rK}l~p^^}DS-le($ZOz1$7`TmrIsL)|7KlI02>u&+o26c7gJLyUc;ibPVPrpNC|Po`5}(*@>P>cy;!v^r z$(x&IeDl2ZUI%Ii3ya{_i8A@aTh6;_oLfu)ETxfh@H*t9i6?^g`Sj577dfQXMM;zy z2P#n<)%r#(*e)5zrJa+rhIO4Rs}$%CkMu!{ErH|*p$9ShzOq*vi`q>|^dAeR=RmhbLLg5EHOcTZJyKQ-~hJc}!FAu#Mf5!FF0E@(6)B`7Z^~T0Z5T?~WP-_-< z=Q-&mJU8;xM*N_>0jQ+WO-3}CgyiH7{C^73RSvU(0R)7qyRGI zD{WE06H{amva8J{EVoXc2MFlPGRt@(aE!|P8Q8URv><{l#koL|9*nZAJ#*q*^i{K4 zZpUssef;zw&fB9unc(SN9^J@THW!uI+MqEzSF3BafTCzko&R5rW^oOAKDev^xCN{BgyV#qLQ=8H4!_KfU!;wyT=^p7iy z)xGw#){n17A%++YKQ!mN)e2z~OzY7#PoX7~CsSUJT-dOhMaFPC^zO)MwrWM>n!pdY z&NO_foWK3v*x=w`_X|nQH&owTFPUtH`2gZu0@R<4`u9-O5)mkT{dkjZyh&0Vu$_Rc z2O(^AU`{rMHFnzeQ!E-~#@+})x~Cf}RWIpwKN%o1Q>*qJICijF$kWyua1{uaw()6O z%bLe+Y;2nNp7rvntSm1_&tuLDI}K7fh(+5ur&q8Pv^%K^EJ3tdH^myy=$;!UwceE& zFlQ8Yc0^#gjXpfD{y6ikT;uVEiOGf=EIk_ExbCnjqF*y zMSJ<~H(YZZCKz3tKzPAtTv6feL8w|YRSQM)azdIK<81q0A6AHov@=y5IsnM2@T4zT`kyVopqo~uc|F^f%j)SFfl2~ASIRQ`s2dZEEFz!r$h0|vE1sQ5>`>qTp zC_IC^{bozC`G72vg&kH?zbcgm@6}9`zreCaMqCB$0=qO}IKc#90nMci@TMC`d^8^9 zpZJ_~Za4m&u_1FrB zKIg)xBaK<06Bi$(;Ba18$%YM#Jx*6yuU=M5x&cZ%Adx6f#RDA5Z-kJf%ffBYak|g% zL^V(UC>mRInHzMYC_|q!KxLCpke^|??qLf~1?UcVS?<|iDnBK)HpT5a(^a1AGX=H= zfG#}3T4D2)RH!a-VJTX;zsw2Yd1=L{#?0brAT>2UvDAJ2C@p9orQU7T0H7z^l1!?nl zKDSgk0yRIR|FLwitk3$HKCXw@kVp5sCW>cU$YBfRuk z+G&`?>W>4ibX>aG7X{Ui ze*%d?8q6EEMe);%fk|kR)JYAlG4N#Z#Mz8~zH^Z3d>a2Z?fhI<=E&@Dtif-ogUOivnUuEg$AaPVJNnEqQ zNX$-pT{g~%A~F;0xPQP(v~un|46u_y*z1*-^^ zu0#VQ!M_ZKe*BDl(haO5FT`P2o9S7dotEe;QQ$RejJ{%6?(Dkz=~AtDWTS4D-Zk~q z+XBfzjU-5>_pLtBb9fAxv*BepH4n5y#jMi@pT|1?ZaQNeZ)qsRT%RAnNf{Y-2<}co zdDL-jczw;HEvc&5s;OYS1XAl4=<%SH<`YJnhC8Yk7l9FH=zwxA)5PFb;dW=@8lA{r z&MeFK^@9yR?PYOtWNWH)iQ_SXQ^2oY3?ZA%89Xo!y#?AQlN5hwF_+)(NDWC4 zxe^q19`Y)^BD0v6BQXBAWO?;I$X7}EPUI<)V|h&rXeCiQH-6)0eRCX(->(ZtEfB2n zhXv_NCsSL`aY5>U3h_eU&2M_M)#l5)18y!1%;H5ZpDkw4gdK6d5i7`Cd)FvN+UGI& zM8)rX#?{4e>h&c$Bk&H5KY&iLSluLr*Zb_fRfeE&fpV(5WN1xWWueJ${10G}@uhrC*-RqckW_>CdwjokxnI zNPORmi~*DC6c}A``9TV}S{@6HL8P;#^9Fl-XbO}3&wummH8>^8Gq%1zDw!b8u=Sn1Iph7royybp z-9pxRIvE)XgZfA>k>E5^Jys~EaDLo=;71Zc*r9he*m&!?i_HB6Mi-ZPJtW2vZUfW# z^B)Y(NgkhrAr!5kMyTXG@K9tuTO;h?F*Mmj7lfBUXu72KwDjCo$qA|W!Y0*5dKZgyIz7h=F)6!BgtI1 zwcyCN-#q6ZH2Hq|a}MjKw`@4!P8&%z00oTQ=(oMFDyhLaIKrJg8g{n(CsV@OVmsA; znuLkdNYxnghy?BVjfg;d zg~;y~j>PrHQPz*{ZV?c9sCkLQedi~d6H$<^=PbY@mRxhVn=U*I@ahp)N$_)WC`6K) z2bN5&Kh5;y`h(eGJ3NwIiCE!OJmfS~mYC-?q_l1Ix|cLmAQN%%&ZV*|gV>&d5{3FR z5&EP;dBd;n1rGYk1Na|7TZGJcXr~?3+@_ZYfV;G1kqcp{f>^U1;$XQYg+D&$s%&d} z$N?b%qmD$t3uhZmP~mptZJ$TWL~TUX*MX`{HSlEZ z7~m5ziaQH3FTii*#J_?zGl+7*(SRIG#r-uYzcp$73+qV}(z!&!ftn*n1XW^bxpIXw z*ieh7qgVzfU$?i@Tzf!4#ikuqo5vfbsM1vA$qV#RI6r2a)mI)HQoCE_RBUj&1ldp$ zUdxXCS?ZvVL+XqTTVuIlKU{g|U0sMncb45@VbYEF=IM$WNHAw{VRKDKa;wp3Dngl4 z(9RpeuBSAlBLEB>d`6Xd$qFEyQ<%)IR>&Y=BfCrO!??Hu-puX-W4Vd4`yJ-=6rv|v z8X*5TH|e2qMx>Wwep)j$Y28|Z@r;s?Hnk>f^%cZU$6BGq90x1E4r(-=?F3~$E>r03 zXz&;85*;-DWjgtT8uawvXJ&M=3;>wPGCw%AoiMLAtcCLN zK*?Ac#5n<(V=0{dc!`cD52yv@;apvp^~i{-JQ+NLLGKhq zo$5@Fx&Z!7Fs}{^%v^Ik9vG8KE0}Kyu+Q>NQ)y3b-&MyWtA&JEUPF9ykGI|Bb-RXJ zD_~$2!jvX8%dsnVmK{3Ir1KT(R5h62J)vtlm|a==v^pT)sWX=G>9}knq2 z=UPisO22Rc`YmP!wq7SHnoHY2{D9 zV_Hq|U3FFptbe@uwCDK1!?#nisV>}C!olO7o&UkFRySAn^_<=7cI4ze+e33w2FjvH zMv4Y!o@ukg|9tvS{9z+;M-CL+5M#-qro>(sSazy)ORRaf?~8raemn@)PUMq(mqQM| zWKy@WbwR6EkJvhJahQgW(ycB)O-t}XZxdRNSX zMMAdeJ?YiP=dVqH@rHczz^qxZ&rP{jOJh2EhUeEp$7$ai z50?9X0tv3)YY!|u@Va^qvP0X%)j6pJFsd$2^#44KEY9apPgBfPP41CwEMJ=)P^wCn zupz_N5gx`IN-J%MtEPb)PRD2TW!Ljjr9Ti%XXo4&47bZ|n?3-qWp}^nK)GZ2qmOSv z8_LG;(1zRVDUo@~57jEFf6dd@XnLWVEXLVFTNHyc8_S?jQfu0|I>-D@3%C=0Js9J( zCCX>2COU(!XKvLBtB~MKmBAP@)yvLUQX$^?ur;>EVY{@~PqK4S;0B3!$kTs2u+Uy& ziNA-};x+dz!~9r5DIZdnmbOzT5HlsQgt#61&$F(&z(qUcr^LAQ!)@agWx!4lE~m`s7|U#S)bh7}HSsiLpD<9mq1I5EsAWMK9hHJbDz1Fu~|0E>W z3i3<#=L2r4e!HLE0WfXUubTEt*9B0mtx?Sl0Xkh-1!!d>$ar?JN;fAh8Kj3!NYk2_ z9AjK)Sevs<3pLA}0-1-K-Wtj27OQFN)D2}lh=wV{mw=m>1__G#LF9#xk#`(=^PrvK z1@2T5HSFWiVry_(|D}l2V433pSojBFXi*oyiP(*56x32y%mbEmx@X>#7B9ssPxR|LoD*k;NcKO>rtFy#p zDStnwTZIRy!E^6NUu$%7Is_~wA&vtTErUJ9u%35xPg^5J{XT!8(96S3bHgQSI^&Ho zx#QCJz){?DSu^7m=5Yq2f=3jhYgI_u7V8Q|y*#JCZ{NfM8L#Qjmk@I{-2ImTY7e+% zL%PR{4ni#!!8S!)3fg)1M$mzn(Q5jkJ4bs4gbC=ZuAS*(ym~(zLn;7WXWCqJj%37e zAJVOc?447MAM+wTqWUa!xKBIC@sAr5d=KK#^a2+GH9=z zi4~0TGfoZOzRW2H4V;e$s&oKd!Y65?&o0&2YN7Ba=XpM8swVpAOWuX z(ZZ=t3uQ2QDuYOitHdnj@&az%LX7RGlekUS2*%3gZc}pDmN;-3pX#0sq6byuskm=d zT}#B~MNl(}1^}t;Cv3264L$@AV7JJQ^W$1ICD7|Pt@=YdXXl^q@ZJu|iQpSJl}9Z^ zlwW2a*E{`~q-t;eclPWt?-luzJRk7~l4#(@NMIfMcI0~SO0!b;@46l7*bP(sbSpqB zh)HZ*FtIlJN*74Swl>I23bpTs?;vNCf(qyxu3MzR?kNb;$97M#fMNElou70-bD!WGQ>}NhD%$~WZClBcO=vYYW-8CMn{M-+_2(gb zXeK&;RwgSuT+Ad)Cz%i8v3YW}J;k(KI^CwcIGg#MMOv<`(2%kr7305h<{jP@KIMt_ z!R2J~WaymcZCo#skz3iB#UA5wy7re$?A)rr4~$Sm>5B_dkp|hv_G2E$4m~wXx79U` zryz2h-A3(o>liL=*rS(QVH?6MsDm5y>dxx0-)~awGydrDQ{b|cMeUkGK0SN~uD-a| zfkl*)7gM=eZa8fOyONF!%{gl%-Negwa-f}<>-x1ugS&=~Um__DhOo;p@SZl_{1lmm z0PbJd)WBb(?{>YN6P2rzul^Op&w^srE?7h_%)GBw84;6KyVWS`sPt*Cc?Kia&f8$s z^x$tiy0iLoERzZ0?zge5q^wK^u*&6#7V}!xdkw`l)kyl@T{xmcPmXb>DiH{Vk!siZ zv1GN)-(}B@)1yah2J|Wcokk(YZrjFayA81$ev5g?7_OD7N`o>-D+G3^(#ip7sOjE( zU672$9(NarHlz8IQxbk2mx^Af@>CkEgdJi?hN+&nkHtGA?k|M*>D37pZT+IyUYOqW zln4}=pq*lV#|`Zj^XS}SM2buh{u#j1So7&yx?KROUPKq_Wk*Iwh&!wqfe2LQr6msu zUTVj!R=|^=Hat*cts?;}Xt2*N^6`%Uux)SuU1SnJORjeAaHfmYcJaCC`%shTnAbP% z-{rLc`o4$w(~4S=iH8EFpdMx>Ib0Yrgbi_0J0l?#K!ChuHhSw^;DVJnr}OgckvK|> z&=tgR!<^x2CuB3>v66&`{M%r6Rs`4?GRSoAY zHLt0V9cRbWDqltRh6`s^G^r#BXp5X$KWnEE_mm4{JNgx>69W$bju(lvKfH9Uw5L0} z%gWR05&^96c1W9iiIvmwg;OZh8dO%p;JLItzJG65uLiByqFxpJrY{&p$yMHK7#b8PjNF%c_Z)wnu06cp&E zRV#CA7~?n~&|%7d<*Ie_IpHmq-CvWB_U`Y>P~k4I?<*i~uCZ8to9X)mbxjHE06umT z&2ctuN#Jd9fbEZe9XZu-!|If<)4gv^vLOtf9v+rpy5(AhO?15(G4ze40&N}d>n$y=)Ek{4!{_n&X9Mz;xr|<8Iaby2!Ac?0--q zjJb&p#G17q9TuR8#H@kCVW7xj5+Ea3tJ9sQgOAd3X#rq|Y3I{>-~RQh6(E|y(h}+vw#K^qJScz(fLN)!c#6G8Q!Fp+xUhV!qg7xuFf@e7Fy(b%7``J3R#1v9j=~jmh+>@yJd=OPgi2$Zwi z-dPaahcFI+2gM=I;hv&-^c4?+Pl+8S*}#k!i}2g}0DI9ZcfG|Bh^Bf|zxAH*YO9ub zw?z_u+IN0f3e9V%I{fOqn1+3p3K*&g=3ieLa-bHCp+0R`M| z*2-E~7`;SNf!j(kseyV32k`dx&LyeJS~Y}!62NNO4Gvdr0=CItpDQ1so-zcFQGFOo z;V?WFLb^pWkWDSgNGe6y3btr{&q`C{?GOzo*o_*K{*M@d>B~K)zPsM$pRN#9*U_Oq zZYt{hOZ@tEFd_)CvfdqrB_JEaZ&>zbj>PA^Iy+Vu(#33)t5F6-7yeDM#F8i*s?hXM zeF!6JXKTIgZG9-od2^LXV*;Azvdo@H#1%UONe&JaS7k6|liWWKk4SYvPX74u0T`1N zKj_B|eyqaf!h;58`dok?tAYCm(eQ9%d5SV6ZOJ3<$jR~X7*Utu{fB5wK#+wb#bvd* z(&rBgJ{v?$0Usc7ph|%2AX{@1s7vJpk-2Z5WB~C?z)gkSIJ;YIE&?~;3ZM?h+D*13 zWJca}0M+?ZZSA`|!DlssAn$%zCXr{HMMm9f`{sW}K})~iXTj2UW zvYgtJYV=BtED0`wZ{ObAw3#%i^P3*D3yY9&pVdpb6#zQX6-|y6wxbSsB5b&U z9p4d`)h~j8)}5{C5SCZvyQvD>Fu?c^de+D!q&5lct*sf;T?$6Ka%HLQjo1=o*Ez77 z0~$*ZvWtXWXs~!l0K{U-V+k*K4a=BvZ1?TW@ZN0 zC~SAqZ2Ll?^ZqPBuvz{~-Tfi?C`8{s%kvL|_~&eFsQ};rHQS7lJo_%QwUC>xn`ZC_)I51>VWT0=e%Z=OyHIJ$U*C zMnFIjp25(n0|X_j4jam^ob2IU{_xjK3;+VR4K|nV6ZBtCp4@Zdn)e!0xXggyatBK;K~tSV_ij z=eqAy@ayhfBYp1E>rH5iThdhz+&LQ`z=i;|q*2;CL-P$U(Wl?<`wP9{LD{^dpIH<8t*tUNmc&=>#1-l)d_uv!Hufo$BmL^<&h82 zVTG-VA(0mKA*id~*)?U;xR31qR4?Hp;U+mVORY+4nH0K6?B^IUR|tEAp$Ag$e^* zZ+_aV$bA~hM-4N)WBoR=gQ8g^eQtNdZqaSe=-IV?%7uX;m3iUwjn=8%L(O%gn(Qc0 zej-b*NVo+AU%*CL41?GR_R;rCd$Re#;2?OWmlO55uWx>X+H}Qlx_inf>cF0BLRiSq z716WZSXZdH#&ylxuaV)*WecPoBIC>-AeMC}rn= zt~$s4EJTl9kOvbH$x@l|qK&XXnqJZOQY`zr#k+ecw>l+#p-^!K0`mjH#4jKe#O94_ z%-)G_j{kM;`OUuOL67%&sm@57Hn(Ev9-<=i4a+0^>G<^-Kv$aVpD&umoD7Kl1BWD08#=M|%s~vdSSiIWsNsHi_4BM{On{!a;YwCK7&o&6F+|F0YTu~0&QS2>&++fJM-s3NU|$3 zu6sov#iq~+4-}w0cu#VEoHBP{YO_%PWu7w5syA!yYITdMyTXYU!-RMzzm>o|5n z9Sb5&ks@6|K)RJ)LzAx3q)RBFqatFXhK>P|-a9dbGFAvxx3%nwvHsM>Q8Y1v?}9fNO@VbqD1a5=pyDDhM`^Ntp2ySeva zL%<-w{gghi$MGw?fp!Sg7m7@$Hn?uldlo-H1cRu#{xL#U)??)k-^00%I0!}Y_TY%J z47W|_cT}oYsV;)76DG9^fP$c0s5p>_L^8gEE;Tg|Nd57#G4Pjz6|a|7#;ZO_&|OdU z*=T4CBBKe*W_ z8(}h1yKX5VGn#8lx5W|L+^HDUZBPmN`auidUv)HUPfmruCxus+%&h7rK0#Wy-VDDH za)1Ra6m4mCK_M(F)#I3>FzDF69PZsuz(9HRQAM^G%nsh zeO5+aL~6i#2Z_Sk(uB}{&CP8q8}baVHs-2x{Sw@cTNlPvudB0I1Wq>@3C{p654tTL?es`Jhrax(%9ynQAf(jToh%G2 zIJ!Sq zJBOpsUH^lLU;@;8srp0MZ0lB|n7IN5p5B7$`Gzgz%w@zrN65gCLewkp5E5B-z2m@@ zNQcxV;sBx!*PxPfRiD8Ek~;kWdnD$j16(W^3_+5vimx=F*9pH*6LJ25e1twvOJk6J zTlbjDu4`I=&&J{X5dP4~i-Rzn&5_4ygkH=oqJI`JkLiqDKNVKyNcyUILV_V`8F@Eq zxgn;Ylw=IDx5zKuUMxVy*&9o*Q+*$R1PPIRPM&gseSFl0qs#^<`gA!k)a&3|Am=$uwdp_Fh2j0&S%IGIw zYR9Z@+EcJ(g5sqsDd;sI_1}zGcO8SZxwQ0*>1D$Z*GGa0%zKnSRZZ4-*(l$gSL(DF z``#;|p`$jgbfrM9Q+NX=iZThl5YVmm3d>CMu7ifiPm#gt&||khR2?M0%!d z$dtb=DDk;&9dvMGhZleW+DGj#X}NNamJx6yPR2Ta{9}4Z@?#;ho(F;wxpprS`YRTh zN;v_RlmQRi0`GeeaUkSnw7T8DsJ7fK7?_Fr1EiUqT@AoYroE_-T*b#`WMtU0uGPF^ zcTbXP*EaLY-E|qJlm2_MiR_INk0XIRf}|C3hh9~G$uR!74EI`%J^~34yCdRDkDfTv|o-()J)!baotLD)4U2Bws8eYE5c68UVe6qSs@{Oe4TSF&!uK;P`>h2!>^A&T{ zLdX1xNmVLrFY%C(GnLYkFSEAJeTH5hdH|$YEX;;c?NwfzU%x&?lN}e%G;D_>c#qpOOT zA3gON4LhO}l$fbZ9q-H$G8Zz#*-9?CaG-jR-@?de*Gk=?Eibp-S?+&jW}32&tG0pc zo+%Mbbp}_*B>7|sAv9*bu|0(OxGh7&tWXn#rD>1!1NL?4*#S=vL0@Sm zUruupSTd@wHNIO4n{y%`&gmPZ@!KrUS3m;((Ajx*+5fzym_3oh64cW6@x-P?k?ukj zEbvm)e>&M$lL8!M#T0+nT)ON}7}fiEkEY1#EGIi}Vvg*Wu-Ppk`Vv%o?osW)R?oG9 z%bT1f0vip`{@VVdOoxCp5rVayzLV6GN`|SM-wt#^x7=pcq4BQn>fQawi67^^#jZ&T z{&1|3px}nz$8$^d(G74~M*+TA8Ut%6?yB`3GU|4O6bK}Q78=HPV7i)I<7(m%2V(#yV+(E`e|s5 zMe`d@c!q=M*)E$n1C$ygapcU^i?H0)eILhqWaVPSaoVYc?ggp=!1`@?3faF(2v(21 zs)TP3d2@*1SOSk^uS?M)0rRHd%PR(rkiFPxBGl;r+6Z~Z``rOODCr7TAGogZQt2KO zr!JDl@UOO;X^_@>ySp{$Un0NLN)Y9``eL2S^2`cY1eWC7HT6&F<|DosB1eXYy8wht z@*CH}I?6CGFaUf4(&PBkj_{QGZTzKNRKvFQ6>t(1b`z-<`vh`!s^Yn zk-G2;fOygvfy=}h6YCa}u%Cut!J$0pOjXhb$Q^Q)rgYlfua&!#)<85w@Eis;ZdH{L z1W$JNGEPEF3&_K>dT-H(IP{ejXlLZ-@z-G zU$I+4Y2L>yp<_Sm*oI)M<~LtfIn=SeIn7A z5R4?jPf2D@(fbC*OEJ)gChnm;VBdxvUUk`f62CJp-+no+#J!)FNoG3r^~p=blP!iw z>(#ccbcnH#2h^m);U~XF7@2sJ9y!@u9(cVSHdgiySlB<}ygTA7CG&^Bqf39Ih_69+p?^U}kHX-U);t?_{o z;SG#1K#8zk^%(u>KS26ucy0J+2_D)nm^32I4FFQ?E8CtWv|D$jdZTan+s{RYaYk5-#+%|t-bh1CX=U(CQn^%<%mAFbo$hFt&@eV{NIlq zJ9Z`h*0fxWlk{@4({%B|DY{FurN3qtHB2x5`t@s@X?Z?L-^@ni zx$w%Iuzt0s*Y0kh=s(EWRj z4BZ7mFa7#D{aW$Rthl2shWOso$f{EKRE%i-w0hUY5;M1B`)3{-3*;n9C1=*8PjqE6 zt6{lvax6Q8Md|z&Zl}n@I9TPuqrBPF|D{v6dX&tz4f-qq@Spiijrs`zntHQ3?$s$i zE;=$^rMjg=@~y>U6)m3^z}>U`Sr>i`exQ2wys6aH*lZY&JLUAeVjlBh;?6)wPWKPW zAPHL_V>Y^Lref<>BwCvrITysf>+hhOGP)Yxw-Wn}0P*^Je>gEqE+NOef76$c{o+Nu ztkU()I)#?1H%q5hS5(K^YrRIl-MgR=TwY$z15+VX(asaQ2GZNDKgz#m<}}ZQu@mZv z`Tc^KK>A$;w1BV*ZUqaWpq3MV?(#V&=~k@czZ>CC3dc^K0C;d^FhWY8#;E!}0V!^$?GKe6vm2}P`k9&^dVA%;W@RKRVfOXz{rmSF`?mrevuH5jU=zl( zI}4pQXip17UU`fDhc@{?W+el%wu9}#pYVD+f2Bz^|4&)T|GWVF`7dUzZyv}bJ3G59Y5%Q{-p6hL+d-(W9}ktQyGM)qsJo45 zZ$qQCsa#wGN{W@fBUEoyF-s~h6*+53aZ zf|nk~;Bc#O8z?lrS=k!5MxtZS92$cGejM`#gPHDEi>wa|JEq^g8)5F?AYhp#0ZZf6 zD_}uPK-l9B98}rlSi3cmxX%#23=CG+og(7fFb`S5zu%@u4hiSsAI?H)y=+?#~R3 zZ2>y)5LoDd0e)fT%wMNY2`oZt;|P#=YfDpnQEgXwcno;iq&-F{6bEzj3z#~Zjk>wL zJqNJXVsRjCbGz6{fF^23N7RFoD`$SJ_-uqSwPON^iBu#F+ujHuA6V~CvREc+&scEJ zn1OoMV}FE{IQB6}2~?GoSR`FzaX3$V`#0HUuq9NM6&J(U*anv@N!s)5*|WT&(b3UA zYc;~+V`IM$4&KcwDk(_-aBHL)15AhKwqHeQ_rhai7y6uP2z{{K*R=p-ryS4_lVTCvmH;*>9px5;C%Nu8PhVdjXt8kc z*$^SGrIU1jn)&tcS{fPk!F&RAnTo{4i;Clxmk_Md-%Y-91!|?p=jf={w`GKeY5)hB zX7Att49R<7ej5%@w0q=_hMq^r-TV0YdcZ!Fd!P2z*gs2+z=LJ4{%)zyiJfb6p@_Nm28Z{Ujeuw7^9yuprHl33NCqKOehTPUbHE$~SK-AACBvVsDKd-snJmH< znH^69F=`qucd(9ClF5^Rhngf-rRI`)945az&yB$?Y-^)hv(heR9uxePw~MN`QT_T17%JW5Z`Sc6I~7nJ)4wzHn?zEH&lg$oD7uDqNaK~TU#$D zoOdqcC$Jy|Cns@C;!Y)Oy9Vh@IMyF0Ib@)QSz?<0*!9R5LliK6|BXoW`Cd2#1V;R2 z^JkIX3!}3uvuuC>b-m-O68YKjCF5mYUf$|b~XBr))*Ox<%MWkK^42n4m{9Jno5D=+_`Tp zElD%=t1ib1`}S+#jWo}Kd%OzopwMj!zbZ2Yxic6 zK;Dua|CW3c?uWK^d+E|R(lF{X&!=Z}G4b%2c~OnuM}$4p_r7X>cQ79a`lZPpZM?JT zg9n)}w@bOT9>k<)$J*08Jke=XqSEshFLX!BWPI10#%}F%Sr~0CEG*fF#zVnU@q|{- zKva)0?bWLs06@((HN))Fb9WZ3Rxg*d$IJ|lK!UoGIyfw*X~Zin&7O1K1~&u^B;ltb z)s>{A2%wfD0Q^q<6=>ar6((_wq=V}Z?@OHztea;zIKAsyC^Ms_-aM~NYI@pgE%c%yytYqCDJiRarUWocx_>^~xB@rzBbr_|Hw_9!$obm{eBA58+OW^1tkSmce320cPvirN(xw_$Em z7nWSmb`yy_Bw=DjaPkm5w5y=5)>?UUZP6{D1SVQ$sne13tdQba<=rA%RX-S}-4?1U z{yI3A>B@skDC)+->mY;0!O0(xF7cj$1sAg%3oNaE?wwZu_M_YWmnvc;?|r<**v0^` zj@T9%t+7Py^IucF16en(U%%$n$voFoJgxk_XAy)IK02=UAb5OvT7Z|%swolOgixtA zGt4twggLd;uA2&);|ddkV3a}U(p1e{5;IZ@DenAZ0Og<^j*fWaQxKrKnIu#AWA>+< zUV$m>Y!3JC4Gj*yP0T5D8t{XzHmj((_|SpxS%Rn@EsDxfSHmwL zAOPUVkD<$CBJQD$nBT@zDhaP50s~;#TP{gSd701~P9CUfF56iHSRCWpU#;xyq@4OI z?e7Z*1cSU0+f`DLL;`%P^97A-FDxnw|5~gC>zSYgdC#e-WWWTLMq6*5j@(RP{T$vI zW|35<4Dc_<6c&u%yb8#S@SpXiVyD>e*9c8B}3JrgQBnx?=>?yoR^-? zsS%jCYB?dMAv6uk*76Td6{X-0X%@CN*4^R{yAz*3pNH9ftSb*Mw#%Skl5;GWOn($P zRAMQ2jMjWOJ1@@8YK7)bLB9d*P>%qFo!KL~70#Z*W(9ObC;8>;7bJ#PO+4d z)xF1996QffY9`;99}#*Uj6aJMUYKyI4nHfgtDzrwtKvv0x8lg?xva?brLq|0w-?7m zZ%6u0$XM9}HLa$qcKGB)%@p}2*qF!UZJ;EFebC9#^R4f&8J~7y5V}nmGN!jdm}TqO zbeihv;ER4X-@8|oR#d`1}f^d>>X>;$>48Hs8|UW>iY z>kb!uCoHZcfUfAhm%x^qbjFkIle@_fHx4t4FQRN5QqmVA@Ni3v3>L$&a|LTM-rI@% zb#iqR9a$Gn(8bBaJM)440c2Ju4jCCqk<2v#l`e&(rl$Z3nwfkMap|%@apHsouiIFg zuCJ2h)dg*tx=Q)}XNgc;vM;N?vG(V@=x`A8TR+~`CnW}sXy<*P>jUN6qexvGl&;$1x zWo$JIPuP4bJWpUzq;6dX+kmsHYiVieB-AUQjNF_`_ebD~VZ<*cIK9HV*LfOtYlP&= zcrUg^NWo(jFDiGcX4732<(w6+5k$w7zaGOb@mV>oVEPY2xb&XiG z)A)lf^ME+zMm^vm;+I9EZa}nB2TP=&>C1?e_Z^vv>W4(En%CC9y?2Q@`w+IE;McFq z9s9OEg(grO9{;fy@G$*qAJ0Xh0R0zJCrJ%fy9YPbsjk*)0C;G+9Es!V=~)yN72pAu z)Nd;eEw#E96-w^wYi(5`MZ?FnTw*t?6TXMOX+6vsxssu7YX?5}*grc{@@(2ZjXA|Cm(V)58qZ;GGdWp;TY9~P%h}Nf`I7K2@B}=*hx8=o=t{a3WTc3X)PH zbw8&^;Mo95_zLSh9MoO1hyiRtRb;KK6r1dVYiy)k76|&Ovg?x~q8^N?Es_GFMP z+j+Gn_%OYmy4pwocTgO0FXlja$|IkG?1KnU2eu?029c1>Ikqt_6hbJf#-79_k^>^Z z=7f>;!5*2{r}^)AtT&si_KRH&sOQ4Lcxt)XBIg82^Nry@oQT4rqPmO7UA_K;gGE2D zCjrCWSe6<*U7`y~Tcwca1@ML=oF@Pf5wG?H*bhoqf4q|KE8pf7b=dbN7aua{-dL?hz%=X} zAaImTf;Yga^_^u<2n%K4Xq;3x%Mk+0BNXJnKgj@}#(+->CrbFj#XE&>*LoR%BY+aS zG1x;Yh3Z6!{fimNyPjhSHG(SRbrt`9yvrk$5t`3bRM{jj{;4jf{zyC|qn&%_a=<4@ zhJDAJt>d}!Jbb+4Pn$|d(z8@@B#YD^AZv6TLzc!n$HvBvs&l439+3BEOq4`@xT`O` zi}4v%_mgnXWf75f2&H()b2|hj`~m0uGumsN5@SX^LKFZH|DUJgh0?MPlXiOq(pamz z#VTpX7br`2;J}qwq7qJn&5mc?X)PJX4&gqnJz)WHCp*|Cph(vP`Vc+03sTm*v$VPA zr{*n6D+r{3?fzt1ZV>_yIl8#ZRxa8`_oa4SiX{^CGaJjGJ4ihzl0ySQm`u4uxSwdq zu1x0zLZ_9RKn!M+yN(xasr0O7kup?F)=K%>b}fXfCs!~BL}mpwS_fn5-Vg~E8i(e@ zcqPlhwpbgW4%|v>d%KD)1b6}BVHp*9kmt?S-&6+omEXD$WS@+*@A)={K22)&=W`I4bBCc2(jD zCd%WRz=IbUml<-RpgxQbON>X!`ELO?wZS4Oy<)QUMG$>>%ClHPl?vEidNVFT&i?}d zRrMLd;#v&f$GK3Tszb*;FE@?jIU~JRccxUk-*|tWwE5eUWDnHj%0XQobfnvanBqN{ zwZz2AZ@mT0$b1QmFP)W=IrC){jG1f@lw-VXqb{zo@w$j?NhRK^D$=i&7(Ter1 z2z+h?et!#9exzdn_i*SV0!BPcN2#lvoIelNwzKzclCW=tMo{RPEGbUy?yCACy~A7N zi?JX_l3=bcG7iBbBRd^O-zE?V;dknVck!s~;X#eHxs_(baLN32 z^J$=p6|-s6;kDd1H-#D?oU|J+9TSQtvdEn7NH(t(1K%MDHTbouk5g6k2p8%d$|>g* zpT12`TqX$0$*Zr1hldle8>zNnWI_r`x7|f{L-C0-Fj56J@WuczZ8EB?3+e1@mbK6jyJn{!S+FuYv}4b zLIFDJ-hH;OXK|`OC5TFH9Yk1vY>o!PWm#25X!^33wLo2N(DpdZ0}K$@CY*?($EAW` zL{Z`^YKd9jM0j~}pgWqY(&;os%@(y3i(R;IK|-v7dPs(a%SBB01QSZP=^Obi-~PK< zkr$ky+0*fy^glXez=?wA3$eA9;M7s6wHCg$m>=EQtf=o_k5<#p2(ENRD%kHI+*4!d z{_*LHajw+yaqg)%Qr_PCt6ZoSA*~sqWgqB6H{45az4$9mBUiK7|3+YAe7vZWU?7sx z5EO`MSEK4&b6+&{$?GjU%Ce>QOcJs|vJOfx8dh)AA`8z5yMFg?#vPXBX_tUk1n&UW zZNi=8=CCl(LCq;hjnhk^I2V5%7BE!2PA^`wZ!+>DG#+$ZD8q&prYi@&Gsdco^l+o3 zlmGZzDw1fkt*76k9hxWuUFEqGj~lcuk9QpcjWMrD1w>ljvu+85Y^Q~dK$WA3B!$i| zor`Uh2XQAyHy0JH*xFpb)a!zyE~Y}X9HiwP_A9r z-YPK0%{|Z%^5hHdB-riV{djXtVw`?GCautzq-dVX|N1_yN5fWo$~gydqk8r6NOA8N`L^jNz3C1)8KmC_`CUh9vK ztqadgUAn|G_4J{{nUq6`YKWzEZ)0wPhq=NgiGe*bEP9*SIqMQJXBhlav!^OkBv9-|0o z3)yhZUygfh|Gn@sucTgeo8>$9r25I*^vnp_Q9%a0^GB44YN}#qOctl?1}bmAdPY|h z3!##gKya>RB>DA%5dcKGiC2#o!_X;lNYt*s5>%o9#%cD%F?Z7vCu{sR*~GUkW@J$n z_j>l#1h*wG)Sw1-JEQ^DxG1-6TmkcBp?-Aa}?erANIaPHQM1zL+MTN1P}22 zoMLsBb)h{YJL3}VDWP?%r4O{Chy?MPvNFi9v$W`XOZ_PZoR)0 zeSTGl0*#ezk`?G)J>2(5Nt|hDHPM5#YB#rzM%Yz%n}*~<;4QS`pm$EmWgl6;WtD-v ztM{B%=U)KI2sE4qy$|ZIzbw1Xo8?usd_mhpRO%k>r9C05vN5=5pMz|mGP9+H3k`f1 zW{CKyVry9Ofl&vEtXGjn=`PzERL%eFr;qz7U{Ji!v?zoRgqdkDscq(!Q0WDe=COT| zztz2eub&eY*kn_jjlXZ~skg@pB{YgFD~a`G=pS zky;erCqy!_j&pws`!K@<@91|@um^|KjKFUoTyev6=XYqIj1SUrA ze4gK-!Tp!z9Q)hg^gR8s^AZxA%ixSt4EZI8r@dopl0K+Q0mM4P$mqLfBfyr#Gsbvy zz!-@Vzbx@Tei+YijG4L8ru`_pwDgTm#p|8SS09G)!}*ayd9brd?LnF0S!^Dnl&^V84c%8hX|Z>Q9k0 zn15(a>xH@K;7%3l4UHi1TV=yJQh+SHdKnTG52G~L6Aa#7dkprcx*vcWid_~BhVB8M zPh{)kVV+{8nmLpuLQ5+?t;H?CB$6q6@g#=>JPw@Dlnr$wU zSao%Ef4@2M`w&<`fSOD<5`jJwI=|zJLwhu+_kZS>+jg$?O;@Ampkt%O(m}*C+*ncD zjyE8^azt_ubU>HG1~ql^keyuua4|}jfYdVVj9sK}?f0_9`Eq2T-VJlWwUW++nF{96 zTwT0-Ouh-gFzkVD6XJCWuVQ?J7Tv~U)skdy_5<+>s!Fe5CUKi@Z--!}wsbr9nPD01^93fMF<5{LUWUBzrXqx=8)OF$ zf5%O@aiT64=>w*@=Z`;r<{RTZCz|aByqg8{;pCeOIBz;`qQRXzqZkbaW@dX!%P5?| zjgKa@nW*X(63*6o0Zt`CQ91O|a8OxTz57&eQ@o6VCSu{lFZO zxzM0Yn^pq$(RFPGXjmC=TF!M2R4m3IR)%T?z$_p2vEO&Utkbt^b`NKN&<1R!d(d7b zCYtgVf~?AVc;6?5*OB)|mwMhiqaFJEqn_N9t6i-=TxL$@i>taMu=~8ga?{wYK+n`uzI`u4qO@Vy(sC6+WD;w`(3A} z--PEUU}ok33KiP8c>45dFHuv|{$7C@Q%M}&b3QsFBL=7|G#ZBXpw5ir$HR-CcYr$3 z(CE^|ix0lN{jix>b>IBw5y1lycoZkD4-{m~DquIP0{56MO?%N~|7+Z7 zNDy~Q-maEi8%_C~>OJ!DLiHw93T9003^o5Tvfx#+4vg~KQZMi)bzyGfX@rq~v3uao z9amvt;WjlY1d@M)RoO^az20mrpWkN+LbIR53hWazV z)=aHg>jJ<)9Ep_Ip0F~{S=&=)!FP>`EYg)1m&Qt=40YKT;HMOCTc#+-*d&F9#AgSk+wSm z7jwFT$*$rv(DwGI6z5Jp)lRn75h;tz%fmQ20n-*%#qr5*YSNSZd$JuMy|~6ksvJV&(v&whC&a{^gf{CEBa7YZGd|=;`_$;jTiV;_ z;;k)qWzYL>PMATnsg!x-j$i#2H?AS;{d>N+o00)hhzpAau|&|d`2 zC@YUc_x0nalj7=+FDiTXz298yKEVUIMpoNfdu(TcPsVs&hXv`P-vIo=wd&*!w))<3 zha8Lx)^_nM3=m`wE;EV&hEC9|%V6_3R}Qz%1DjrgcE&_^fzV!w8+G~)8^J~}QiAIw z=B&21Hi=A&?`<+Ftt0;J_9!7{`3%owZ<)g4s%OBy-BNo*3SM#R&^DI>aoqZ9OkR>s z-q}+uOvjyNMFmK`z3Ju(uVTORRaYN|+})%IFS#i{c_^0vLCbjy8iPAh;VhFX^+^9a zg|z~BNJ?W~1jNO~0TgEYk-h!IDymwQy*W_fvk8vNg?TaaaciO}oDh>b2ng*fzv6M? z*RNge4eK9DjBs(Wv2|ShCgsLrBMWhb0YUUI$LQ!~&tZC8hU=dQACZ&W7CI}6@D+3F zzYl3Qc%ZYn zp`j0WK&<@PGt#2dx6$|_^ID7)L;iZ}GdjP=kMX5gSy@>vtyW%~6o@1Al72m11k7k# z+5`v=O9PUalR9EB%CqFd6|jEin)qsQ^-+8cS~I{>&2{pd{g})0(Xan-t$G*=01ZD! zdPE15_WM#n3R0tq;Pz^MaNCFJ-N@f*415<^Hsh!SFu0*2w_E4ES2-qfD~9lN2Wb0vxD7=GQfUJ2n&s6#!*0(SRWmE2$PUlgeZ_{t)&YTU#yCxK|g zbQO*#=m{!v)-S0s?DB5B6Q^S3R+hW*ZXOI`c=iO6<&2+NMM7>2G0SqK5yQQ%*NL@h zA6`#uC>~cvnOnZg-U=X$+Zy!f&keXdtmBEmGhCfgm(f^)av|luF;1l>%P8sjJ$w4J zPND5w5I4~>iD**IOqralgsv|RZ>L3iwA-=x`HykQL4X1P!)ZJW&7p}Zm0Xxyt<-t& zD;O2|_4A1^*)MV*SoMl>x@l*}#FKPTiqBHwBS3_Pz7vp^UkX4b7Z=yuA}GxqXL^d^ z7(=J2)k08oV2g@;U+hJ@P?GeZUOY06C4$3t37(Rdjb~j`PRHqG@?GxagM%+2Cgo0v zl?gDfW!DrqQQ2wnrZxo32cw12r5Y$=iw~axZe@pE)3SJW|6c1@*VLbI#RD|NE`7(9 z!Zdf+p4b_lA`fRzWF}gMr1UD@1049MFo~|It$4oCpakpKm!Ge(wv7?7v<0S37Y1#A zEv>u5VWUW$*Y^1Mhv1Aiqd13zs0ZxF+XY*86I7c9%K;Ya>63cxds>Cy7_%1`_49!Y zYE&u*#}djt+%u_h?k_5rWfX+0jbze6;u2YW9Y8xs0(}QTHN{v;O_;rV%!hSR8F3tX z6SirUsVgT%MMS?xeUL#n`BG(p3cyzVQ0GER-&=hs|_6Vt{ zFHm-&X=ALs9qPDk_<)w^4*Q2AN&V7gQH-c}2+q?x;6lszmK+F(78Xr_JydhE$y>-( z|0#T?f(NFNhOjj${3vPKd#ZO47MY%9P4E`@=0(20kW5oIp_6nE#zsB$TL;u#q6LywJgi4jky{;}*Uvklqm? zC55jBcn%N)!ZPCUDPGX`&!r>wsd!6 zL4vTKp1Ffnh;Og|wi+~fh^$UUgZMF%8wpX6RNx1Des7=L)=GPGvmhw3uxilpGBD`# zSO6Y#9gYXrfH`wX;tX>G8~`PPnp@Ka|uS z)&V^rY*_HjL#csne+}9e9FDHigJ+xukF66et8a&XSg-|5waxnPW|QLRFm&>GJFr^v z^76eGR@N4ZX!*xtmjW=aV7`Gp6%<=^i|)XS!c;;_S67{kf|im|mHIR;&S2=KPA(E0 z4=f%RNYIGdRShM&rtCdmH#CW)GCOfMJa>X~r@3ASCpj^SwrN~kEY$}6iL#yF_%?-aw?VIqSkCkyVO zADHQBr#@pY#;l%}+1H)}d_Gv_H@a)KIA1M~lZ<@5*jG|>Z*1N(9X=PAB#?k}aZ7yr z+MULW=Z&wTHDoUf3r8$wH{2HCriG1bb?1*CJa8b_1YcfMR0LgPMVT2r8fb<@0X{pL z6>*tWri1i}&T&1!`sl#L9rNO;5SGLBZ!~V-dJ`iv->Sf-6ad&!&1h#aE9=cea^8gM zHr8n)SX^1~iknHnB;3S&i(Cu~=Xwb?DyjpT6krKTp;K;q4|-lpR?M$XG)9Gb#NF}| z4$Z=MA>1r%Bc9A~3*yNk86>ueG(o;lHE}0RUh24zH%NM1P|Kq|B^hw#3knLBu6zfF z^fKrU;POBK$V(79MS+&=Q&4DFw4flwQ{@ZC5*dw;aiA_KE}2qaPc4L`!$sfKKgzaP zMy85Zpu;@oyD-(hQ=JZD{h2^237UjB!azh5s~omO`M%X}_=5vAZRf$gzk`VGA>0MT z3^s)2b2t}wXAq-3gmI$(W6caL$*9M}@VA}J0DyCLzG!aPe-aC58s(jD z{sOjWfBgkMwF3ZKJ{H85c24R%=c4RD;?7U~QZ&=Lm*^3HGxbeO621e5p^q2X(;%N| z3JB}jodd&u9hkNpZ&G!d?G(%UM1d64FOI#=aP8g*nU)!f{?_yEAWY(vTQh_kfro6I zV9U}gy8i{(q24~Jx;{q|9;BA3Ci0Gb|jv;{Fl8~p~y zzVZ~<2WtbKtO`Q{(LdMkCxP|`U**^V!VGUv3({05e0qSlz5u{oxdHsLnIrnNAOD3Z zQq?$7e0ur9A|iM%0n>6UIR3l{w9^9tt#HFDE2{$l|A4fnQjPfc!}Z@qE`!X#%F0Ts zwFtHdpwM$-h-FR#A9l!%Q6Q?4Y95Xmd))d+0(qHrM}e7{EJo5{4SK&7$Nze-n*wpgN8^13M4$ezT@`vUV9FUqoCYs=vWe0nTci#Wb zL$UKWTF%6Oi>mpgr9p_-O(K2z(W7!`PLKCs#6OQ7NJ`?!f`ZhSpxKM+%DYq4HsFsA zdjcl~>(nc>J-Q0W-|v^C=5e7wD4m;|3t-)mL{sjlx$rCJD*uV9IEVB0rseHJ0Fj6= zt3{{0Y{b58508$lSlz-w-`LJ)wiLIMHV_gt;=m#5#X8 zT|)R#WTcMh8PH3AHv0Wf?*f4(11sx25csaL_kaU-Wo>P^(AmnoHl(De$a!VjZs9=- zHjIb?diTp0%GRbUsUB3jux(A1<@&D9oq{f}1dBzvx-QJkL1Yw{*}q{QPBUxZg*h6) z{o_UBA{blaPRPJ60=lw+ISJHAi&)kFZntogiSS@+OrYO76EcHIE%<`u#!R zb8B}efgC`1gn+ps7P~-!uwYOYa;e6Sj*foEI+;Nn4D2@9Yc*S507*oGsE42cfeGk% zn53tsYn0-9dV4_wxd2BxH{L^v+q7}m)OgOH4j`D^x+pe-xzxyZP^FxIXsarrW#wpPK*-G#|xW5rpQ77(eSAq0k_EIA-mvMb%E z)QRM)rSuuiOmqs2xz7|EX5bNvcd$#7~w5X$0abe1xHlm=H;c$ z1+n?*Oi?ZvIBjojLLtW_CPI|O&NDG1%YlM+W@{_KRpSHPzYDpERXPUC98xy?uPTj^ z%j?sj@ZNQ_MDH852Vt?H_6ka<=)EAaybFKaEM9h z`x}yslp(8&kUa-FXZ{l2rDrD-G9Eqa^ zRWcqk-=HQJYfww?YTc4gZ1G_y*M+C(Y-D`z>qGzEKq`+CNPU%tdP2#N0<{9sA0pkg zwF75BfKPn_DNG1P1A4U7sU!iD3LSCW{Ol~_rN12@pjGEzg`mj;KF5Sy@&4 zG)SQlH2-^D;Bfh7-jGsg4X{`_@1-~8g8TRH&l~v=K+-+Ki>Y%buxb~j^oD)=rb!Y2 z$@+t4H2&|uO<;U!Wzq%Is8lz{?s3^S^l!h&Ad5P+fA|FN!e14GgM%Q!A;Xn=tPj5g z%RvT7&V2q{5uzr=9O6G@e1MP5cC2t7!mj{PCr`mc0Y>X_P^^Ku&A_1pM2q{6JZz^T zxL+};$^qy9w+VC)AO%Ka;hd!o6>3K`D`b0MgFuFXk=o<7M>b6(Np>7zkf`}MwBzG{ zb%R1q;npoLFE0?RTulhB@R6wh@GOSQwjVz>1J)@!pH>_v z4o3^>f(;IMOmJ^lnt=k%Q09l2 z3pmxFyXw6H^|VK@M;^!NYdE@1Nsy?Rq*Qvk3-54NG)KjeEO>=*kKm;oGNtDhgAt0!xH0D zeFu4NCDtg?4tf0DI3u&5<)P&cLURTqv>^qElBjwh$bm!kXooVfe@Vqq^D8|k9I~@G^kH#k!v&;9>99q>5YIiDJW#XFN2=A zvA_TP<*~$Q;wgAW(b>AtDnm-5HYpZj7EeL{bwx~!Hev`FVYBL?@A8|U!qV_6K!d<2 z-V&(rM)pJ(D1gVhK7URH-U<9-rkv&NzB&338xCKzyAWekYTrZ4Du>@dC-F*6w3cM( zl>lIgaG6EufY_Mq0RM;9qX#mISleWQziAbYYXQ>6^wbiNIN3DOOI~ocK1Q)+yxw?Q zO|Gtw<^jw?+&&%d2SZ+jmw{%dN&}d2If!c6Am8rr*_f?`))c@quf^}`tyT7?cis){ z-U*_z0C|Lam#&K8lB-#7mZsL1!LMGi?RXC%j))TSdRkk$lbJUUAV2E$$r+zgH-L}u z(*L-o8plg{X6AFA0zi=>4q6&RCIc0(ub*HNv$*bw2mWbw6eid3xx}jV)X9nUWp*H0 z43XjwzTM@?dEHW1r)V3(DkDhgC|&6OtIxUoUsAlGllFnZM+YMU5G-@UO*uCzKy@Z@ zbpibmTo!3+;0T%9n4U-pl~u+=ZY*(%gf**&`x7}g`}Qsm_#ua`r>_$i0W-sb#urf3 zI`kMo7j^)Uk9BQMpD6V1sIp zO}*@1TbxhT=3}U>8aIc+-S)h>9kUZ-e9esW;-K-&Q5OxfY3#p z2Voh^I^ZjS>>@$4>dFoV9t4LpyYL9pdpL6#)R(j`+C#A%qEsD|{i8(c;EQ*_Xd_s` z_T@vS$jI04Are#V&CU5J1vRU~fI)hCgYLHHpjVc$dIbJ3gHS?zbR-t!EMZuvlhJdT zt%=1Vlqpy$#pa;S0%nq+v8p4pptpSaJ*fJQ(}WYh2Po9vWfQZ&FyWKVJNf#ggX2Sx z{YNFQN>y1|Q-F0#7?{W2dfDCr!6snC;=W%S831+(2W_hlxFZmb-wKnxu1o>f+0hFw zJp22$yn%4ArG+{bftbz-Y7_%*5-##wYY5A3p_u>q58niuV?5n0PA*;wRqfLO=2R~x zW+W6&F(5w#;fy4J@$~ZzF`vjZN10xpA;g{-b|GL$hlQGer9QCh8Lc5SHma`uT94Pi zy$EZh9bY&Lj)IGZr4In0hu-6|-O?L|-mlJB4@o?Fc!3iCVUWfWLx4 z5gXTKdHdPa0NtvoawFqOTomc()CFKfWQiaAFaH_S1c0*ZNZ6I6WgcPvIAphqN zZ*$1i1cR&fD4h)E(^7IW@LAF9*pJ>&b9r?hfZoEc`{(kMoMy>z2E0l?%n)aj)QUtN zc7uUq^I4+yhuNKf6$&W}GzVayi%&>^qp=%4nb(1R7b@A>+4Ur0%a^Xz=CuV9_Cf+_ zRs4%y;v(P&tAL|?d{tF*^>Dz6WG%q7$@Ox2pc<0+L)*I*fbmf8I6*2EEvXgit1NKgj-uN)|B(=K-0SZ^P{1x3v-YCgX7% zqPGE2fD$pkf4?cIs#J9b=0a$`!_Pu+#PT_Eg`bRRIYg%>bD(f?kadsmg~$k}nsxPh zAfRD>|M55=C}jWM?o2Hg(7l1y7i7}FWi)Ij7V`mG3Bj^lQLw~J!B{gTg}SK`l+~Y` zyY_kDecUIq<7nX!xFuFAuLsciF;Vi++S{NOgvC76ZRVfym!$tT8=$L1hi z$8w@?o{_&zAq9eh)6&ksdANsGz{Cz)y>7cz6X^KE&te}3r20arX@}A81rZ2-jHwE6-mDv-i z@`lRZ2Fi3A{q!)L(E*lGs^Yk34+=)adPCquj7|2x0d5j=lY38e5upWiJ7bPkii*#b zsgO&2jLrY1Ey&(dY%Myon>6G$i5VJ6@EF$5xYi0u-CBw`VpP7_jQMlQ_=bVz*@g_j z{dJ-k8IMK_n(%td@3R7-4TZ7^BYaj3O2`s2po^_xs!X-+akAyJXt$^#JW8WoO0u>= z1IRKF+U+_)z>Ct%xJ@W`_kOHXP4<IzWWr;%G~UJ2D>P0ozqwF@mO}g*<^1XsTsNelDC@CcfPPvKa7~y*V5T zA$Bi2eCC_5eW*VbKlFaJ>X#k>2``(!@paiwS@0AE2mmZ!?KuIeN2?F#Gav*;(yKJ% z%AF!4ZP;^T7<%)&29a_gEmssc|D;IZ5YAIzo~jK^I!7~9+tEQE&MoJy6bv&#hawZq zlRU0eqCq{BhL|}Badt!Fp#y;Dp#(r4-oZXRD#=F@fRVD5kAa6RgS`kOIDb#47@Pqf zDk=?Nw=}M1PFozKQirBw~s_3 zl?RY=2&><=w*Hy7$C2i$7B~@pCH~9;s=Fw zvS4yH*1HL5YEe;9(LU49wd7jT(q+D4r_^SDf2eZ`7~39NG}C2q^%J z01b2dga;=aWO(2M18;-peVU}Aq|tIl)V5SISY`U@Re{?PR=iiilUnG${hl_VaiYML zP7hZuLijQmdskgI*XV3)mdntSrMj7m+1gVbJV-zhx}-uiM9wVjxRJOm`e*|XVmqC6^c@a(&}x;DPCQ8s8`qoB^iA~3yR37d`~H^}k~ z=w9Sl4kYJT()Jk8H!b=+gG1wNM~HcbRr1qs@V`6*4+^mtYFGrc-hBo+;1R$0&J(=g z^tA=87c7wnqK5CqdaUc8ho`_1Q4sQt1LJ1a>Ud58O%Jca`2W~@@1UsD?t4(jQD;=l zVGspH0RaUC0m+Jj1j$K2U<`odOiL28BcdQtvPx{C5^b8GB1n@|a%zwyg3urtNqau% z%)IZnc58QQ_n%+Y&zh>48tLW}p65RIo^$TGt-XnVq$XqVjJq#$GBs~7K>R1xu!mBi z?$B81={|AG+t`ZDKvCi*S&Fcj#8+^;dVDjqe%tDe+>Qx8tG9=Dc2aJsrU{}DT_K27t1$zhy` z8qYH`-M^1_PL^?p(0v$PF@1Xb< z?G^y2&O1ko2Xz6?2hWBvAKj2rVg!zBRzf4R`}_9sBgXitPC=9m4g#%rm>Fx;KB@^$ z@!{@6;|xbakeZxdNvFpw^hJwUwtKX_{1!TPjJq;YyrVM3W^DT*bWBpZ8xIDEb00K* zp^<0NlA_mWL+=?XQBvQ&J(4(|AXH(y+BDbJqq2(j&&gYxY$D{#w)pYI#nUqf_U|Y9 zjuDdXLjQE{v@h%GRSf@XcuSBa{n?Km)iPw-xq~E2!Xyw)Qc6HvtONj-0x2~0^Y%V@ zvZvm_VYC3ut&s(=NT*zRgHx-XsMu*1YleK4lZ(>jqEhnK|HdRaU#lt&;FM&kG5OBC(-g`PM`_a|i znrrLT`KAPb8_WubVYER>;T>cjRl$p;>&WZYuh;2opdHg*6F&g?FNbZt^(bzK`(~vS zr4@E1TLDd@MKEvEJ~@k<6!i4MV9z9^yn)=qx3Bv(5aQmhuF*k7qeg`QP8i^MOfe+E zj-!nymBHXj_UpI-5Eu{8OehwoN7Cuua(+uJp8;+#@oXtbY(v)9RpJ8MpUD>AF-DKt zx2h5snN>8~HAGg42ncsl3=jZk`?|DLPSR3avc6N>pDIq;j7~T!b8~J>*rz;W$R)6v zfsEL@cGa(gmHFN{YsliYw2XmYT2uVRXR<(P3g}NfZlRL4IE$Q?6z{4GJzP)~A?;Pz zP!DZo*QZZ=B+K@gNI)?YrhSG}{B(|rixL<&WM%_EJp@MckE&soDx7L!Z3Yr7{Qdpm zbKV?tdc(v){RyXsfWNw6bPS+=ppBBbPN8A*?%e_Pez6#}L|K@ht>Ed&by=8O=}+Bo z4poFm7`1?%FKCHm@@wl%)rV;iY`!4kXejdXa&&a$ey$1%h}(Qhkl?n{))G@-2`oEP3Aq04M=`lnJ+Qf5A#v?JGIhyC;E(^PYws?e z6Ao8mxc*Ox{Iu6Uh0y<|QvWxV`o9#Fy421>1PdD#MpsuFFlEz|J2!Iu3-uP%_weoQ zOoJ;^NC-(d_WIF%>ae{gHWkQ!FrkGr7ZFL)Nqkgzs3#0pM@c+`mg>} zK&qG_g6rF;F*4OL?iN6W3(VbHx8ys4ArobzJnW>7*{ONVF-;t}w|qt0!uPND0+9-4 zdMz%`ep%j_p~yf1XjH_?e;X$*1rohiDh=$0^D}+Ms2fnYHl`ZzTZZ_?t40^XtAyN^ z=iG`|r*$(cYxY+&c)TsXAoba+2hT3Po46cr%9omB9v7+7s}VVHFsQ!&l6RQ+Z?Vt1 z3d30#mlHz+P4&A9uY0e(;hk~7`?s=(2f|azAKv)%%aw&`&n~gPg({NiANI>P8IN6& zx^m93%Gr2Ipz_niWZp0f@p6tk=x!NSvmdDA)|PUs`^sRbooA=O`D)wt?P;@^`5jK! z1thH9e(;!=6b6|~NfpMw4?c9@046ZqO;M3`cZ*ycuT@3I0Lpy(Z$d0AEQeP6+`k_! zVjH#9Wzeo2aynP$e^y^IbgeNl-8k2^o7>xsqS`xpU^+bpbD~*HUJ(?`%u2Muz=w># z1fatG^hq#2fQm-I=BB1~tP(H5{6dv;kcUTyU(dk6nCfC^+23ieCIZgV6V`>OuNt#N<~>&;Hcl|-K{?;AOnLr zEMZVAIXT7ib8|}{&(gb^$0OLsK*d&*Iay;J0Kn6~^xNbb~X5Wuw@p2;gl? z%iNzD7SskN7=Tc61z3nOP3M4SaYY8;f!=|<)9!A7AS^Avg2JT>Gc$+c7sWld?~aEm zxWmvPfiHrDp%mJML(LhovL(<9Xf`$qCS_%T$~!MAO1Xq(vGiN6^`xyLdUb_Q`?~cP z?pKW)RSBTJeY;jiN9XC&^Cl*_Yu2nmv1?;%n{Jfn#C>v`jEoFM%JAQ=tUQQ9RnSZ( z>(uZ=e=3~XU*BBa*JrHbIne&}O@qtJypy-BD0xwl(-V!xz(mrF4*8D;@va;=W6*z! zzWwAHsBQ!{4gDKuBp)LcbU2L^Jsd^F?D{_rzrxU)iZ?(SzT<787`sv)IE+`LjYfbr zfC+JNsY7-{tm#3}?PX@(&k2lTMRF5Y)WO_%x) zbwxAG=KRqNhzI%qS_btu4*TCzSN;yh{~x~Y->>-RO8*6R|9>ahme$aJ$-(|lf9wAf zJlZg5RNC1M)3&06rDHK9kIUG4>D!kQvJD#g-{XKzWdWpt0DTr#P)K{z%RRD}Hp|j| zNtQLGAwS1o8)S^H=2oiWik^Gag&|C&!j`3PT0)#zA0xXKv23VZtTUgeD=!ag`f;i( zQGd(Fq@DBdE0ls4)YPrGdOuf%TT-IbL-j=0?(ke}pB;vlrRN@3)ED@q-B>vpB9Jjn z%o+bF&4S(2kZCIfqT$=X3 zU9!xze=1u=gB5;^fxd38mgx)KY>RVa(H(VBQR~+QuhJ|G=jlyt&4I$C|Mm_eqC2Y_ z$ZfUwaEh~j!j2s%oM&+}L95aWCtLDe$Fe^h=3gv_>ZD`wt8uhDgYu5mJq6+DeCMW+ z^sOki`X(A%bp^SpjAmYwyCq6l9;xSx@8DM`D^n9KbW-MIcfO=hEW_&x zp#P4MoBG-T+0o}wr-}ya#rZUfej6H7$TL&A#u(4jTQJoTGKw(boWN8#@@6f<5i1%L zvntCfqekgkqZI-tUGhHkGpw{TziS3*ME4DpFB^*B@!=tG|ndlyxY{5Zx7u1pZ9Irww}>4 zlw?s^b!g|&%YH$T$sDANO30G!U5Y9Yn zK5O0d=5yfcso!Dj@#2{-@rGc4a5>?f)I?paMLL3J!Q5!Yd(hqhmFtrE^GDwFMSG=* zGpQ*t-cpAPd6~2*MHE-Guid`nRnfmcf=7s+zPiKIM57_>Iugo<7bnu4eI)Dpv*ZG(n#-@FAvEy&2I;xW z#dnljWS6iMAO+WEUtfGT7g$#}o}|LK<)Sm}sld>vl(jtDbIV1KS!!InfUsoDd9kC_v#X*(21{&9q3}L z&6~hm4O%f;P<+9aTY^2~Sx*`U0cnhN%#el)rkXDL(n#OZ=xKR%UQEo&j9V#Av>G-e z&k60I4sxvnvG}g_s0_d96}TWd&!c}0r;)sj4z8@${-;-|=O%SL{r z9z;A>jGT08()><|=}{3=Zxlzbqd=yEhllS_bLQ~#zDI#|N6FtNzXh$b`1R1u!oU7X zOzzdy3Q;sqappDP6>9lQWBm<@Ad|Ig?w^|)oH%ynEKh*HW~_#xxo3xzh=>R&hHCC4 zxNb_4PfC6Jqv~EWIaA@K6&J0irrhOLlAhRMR)l*|u1}t4Ct|X^~d3PVP-( zf35S*?on|*U>Q*5x85XfCS)z4L%x16$UltpHXgOSQa`LUNr7CJA+lL}bGBZx$NbjG zZ<3rV&11Uq%Mvr2MO_Dc41Yc&!<}Wx4lf_>9t)_3sjokk=iX3OVlqxDPCjR|Fpv8M zL}*7dLWiZd7-T#BzDnoZ)6xF|bPe>G@6#6-AYg zO6kwuM+GGGRlidZLYw6n-btf#MSHXWOD||r5h9`=}LWL0&yqbk%c4MoYDKZ7yn=XwS(|8FA*RGmvY1`~4@f6W;^bFwcA8jTSEN9;(K~N8y_m-q~=|;@_2Kb*eWL*;l-z-ru{T3 zZ%tHA)xZs>fkAyei$+9D?ZS+vv!kKs|b62js z?KYv&OeGCdzu4h$g6C3;N5QRIr}~p1ZbixQ%Ze4&)^`E?_dgUHAD0k-IWfF6r@*Cx zVWyI(4TbqunC#ln(2#KxCmWhEMZ^~Ehx8L*9Y(Wew42{dX+{E z4hoV)b0Mfyi420Ua)w;FzIUijnI{WAu*BN%{nH`A-L^UL%j5F>q?Na2GwKkHv8wBS z6%nc&mvGP$57*AMdffIq_hnk7&m)YgietkbYhI_P6F&5maoK)GvGZO)LKe+44=ktl zZ;5=@6Iv`2GLo`)i4MfQIVEJD{;a3^i|LmkccX=%;;7RqD}PO5xqSKFUK)Lc3Ijat zrDmuaFAMRk@_%!E1!L4dpf<03Y7+L(BtEZoFs*=OFe6)feq7U9oa^Yf8-t&EXqpiF z9lQ;)jD={N7I7tGh1FP%e0q%_mH6zzBa&h}KlgsFgtDEr$s5X&OCdb11;8$bbrn&(Zd{VcS1WpHr{oY#9$vuBi-sKrK0HEbKB@} z7h65O+fHBd%+kmEdxv89V)>*ALT#v!KvxTbi1_aFSrH4IGKl znwyTT(vq!WAq7S0-PEBGDbMeZLqnO^q}V}hLsq(hux{2_gOVTNYr;=ELXu_QZJ_N* zD~m85*wqb2x%9GOxVkZLoT#ZiPohA{b#=i+8>=QHRX{`}H!JHLT0QEMWi!rWbS}ne zRiH|>$cS=+c=JH-Sl`9^G+MBH!N7U=FJ|->l(VI!xj&0}4~|?#EKo8dBLld2w8i$# zo5e1F*h3C1ft|UD@0r1?=H{XID^x^@cK-lp^in9q`TC|G4KCq2^Z0;!>eTkKcA881 z>qmwG^8j+9nL6Upl_(#M30BDo8JV2zJ2!3IxW|B__3)psmT`YAB_^Y21jjsm_&kz+ zuvyO>{@2I#&gJMC1=-ZIx9pRge>Nvo_LK*@pe`J zCA_?DBl6eW0*;leCPGIkRQvAFudc6%lQ1bqpj4^#r`FVDAd*(p0?bO9gF9K3M$v_m zHH22qrqn0YLhP}3fR;lp#zLPy{Vvn&;<^CpqkX4oN{H7XVYWr{Iu?9}<$l@n8#0bS zOVWt2o-;H$0Ca{)#Gu8OSy0C)$eKmUSmVK>u2#Vr^8aT9)?@_&cVE0sLfc9Ja7q9ta-$a zerx!30Y9`Vbb#SsfRpsHDmxc&*XV(F3P>W&?@Y zM&z0-Fsy;YrhdVN=G;L8=St3I7;CiWIfn=KCgcqG``4tTSdn*OKCdj5pLYm-_}H5D z&9BRm(D&5)`Kjs6-eF>?*E&U~2ZmHuRn^xCtG?e?Q(5nAEu_K_B4hbjo&zX>}Hn7cMlW=r7 zO2=&lLKa3(bBx(JIJB!&^Fw;l0Ft3u15bdJb@lML+wFglG6o}niigPUgLGCo7Ok3q z6bH68K7Ve<0c#=tJT%*f24Y!qn>atnA0NMu<258CHxP2aBoeVmsChq>x2EI}*PL+uL>5TTFq*Td$`!wCPm07h&aeg=B zRoH^}8Ea{!xF5K*FZ*VUPA-gCyxYStcO|LzR(1*GVsWK4H5x7nNGrqsylicqN@Yfr zs|)9#k_$@yx&Jha0BX31Qr*h#o`iye0@%J3uaiaZ~AX#j0 zmjZ~Zp^*``gOk4sQx~nT<*D8lGi$ILtIHk$H%M6aId8_$DMh7f{VII-|{1gWo`d1~*V(nE_0G-?1o=_-3uGfw@j)s2~ZnDAe~n z>4Dt`4Gy?VnpU2r@2;fL@T~6c8o;ix>L|Qe=C`-ztgyE2_fE6|RaI4)%*MS>FIv!7 zKAiF;RoybsFjxqU4f7-CRmr=KT!__DWN|)U*a|n>TL2a7n_nW?(9!MS_kg%G(03X@Ap8e>0W1cHS|c)KS{mf%rC!zrIXj$|M>VLc+@ z8S8t`&&{n}`{9yhoJg~l^V*g4iq3vR6+X_-ZGqe!H2v6UgyfRaQlznK*R0to>E?6r z0M*vSWCGAlSd(Y-ZmtC9426trhm^Wl>E_J_1_tDQs3?$1I1Rsfn&t>w!z-ek&<7#H zj*X24oaB=H!gw^!Em(68$qsoO1c zWm8dY*`^tgdf>KKvX!2$lgRi^qk@-QCG6y_f;A2`V|$%EzGr0ZRX(w~qg}n%65| zdg9J)Xp5kDo*f+ZEgoFlEHU4#nQ1IqFirO}rk-Lw=eK#76sOhhxPI$D9K*?M1>XZL z0@HJK+ZQ^71WoMU`8_!l+VdZVYT9Wj(3Q!^OvkdcTQLWL90s;vkfJtB3L0LnnRv5|DB&jQ9ff z3&sq?cP`}*H`${@{%|JmfrFbfn3opb6EX5$SD`*!jjx|SOYZi<-5$O)dfn#*<|Ej* z^%2eFEXHWio4JaW?EH(~R_m5Nl*lTuS@)y^b9nOBbhlA)$RXro4Q_8?#7jGtUo>(^ zdEYyD%koInOj^Je@4Rz6ZS-_^v<}OhH(jYq%ww#e-`}GOQM}b%$}t5vofI27fSu7J~x~HLKGZn_hh4zplS( zs#v;Ot4@krfcmV5?=p#pW+)WF#cLU8yS$KTsdh-b4rnDS<%xIKFL;<*rWQt7@8d2O zaolFhKdT_0KL8uKD@FHR;=FWd(`}^ha$^W%jPF;ZP_I)JgqJXx}<#x<$7mwzIx4e<&m5lC5OA4Uo z&+&4T`%yqm^DH6CPgeOKq58CC&uaO#J^dcb)zeh)$Dc#npG!>{dxanHy5wb7#5>JELv(u|K12md)t z)^E_z(3)&(RMFkqdT3hd)4nUV-lz9cc&QW7U6zdwW9gTAd(A%gnDq3RV&FKY32_(8YDw9YhyUl8lbq!UnGm?DEKx?(b!Jo~WG@q;9N$lR z$+cjhdFHK)wCAR-m|r>7H3*%W1i&qvqzp*J+xn zz_>K%7o>zvfaA`0NUoI_$AfefwCX$GS00eFI?^pf=w#%-@LLEpa2wxM&kw^v11Q2m4)5$)AW)>@BX5rWxLr z3zp7GFvzumV7*}Lo8o=z|B#5y@TX4>)GKk2VAx7F<-}MXJ_5wF+e`bR0a==Et5=cm zKCZEhZnLMH)d7-25sId|;r>(rfXw2{myH}RGd^Exi_-P<`A%&wuSJ~jznPis2udNw zmnls>PSF3Cn~+15 zC1;3{*D*1{!QHVN4sIx|sU+L_(GX*uZ1dV2@Cj(o4K)5uJJjD_?9W%%%%WW720E^E zKY(ya(d786e!N3i`NRV9Bs@?oEc8wMsYUZcwi-pwUv*+60UNj_p1kBH8*iO)Pk2)+ zh2NX&d9pIi(7gGOobs||6364>&S5;yh&)EgYwp!Qd-i4Egpt4Ew%q;#EywR%6ly_# zZ34zzaV<{uztcFIJ<37ItBQr|lqB?(_JYAh_o>_;+{UUUj0hyk!jb7;K?%p?16I7>^2^T`z`&X}| z1zwZdT~G5EIr9j>^^maL z;t{>(7BGY*+KlSTR>j7}h3GEW*IY(j8mH0j&dqO-a|T61gT?|J9kcJ(nwa&Kb!l7% zQl{nR?yiI?d6v&#yqMJ|>X4 z)qM}Rgkfmwci9yU(UNM8hbeT6i=}2K&2mwaQ!q0SUNOzQ>G`8rc(|=JEDB^zc_HiJ z4Z;=aG&r5+_PyPGn5Kz5Y@o(LcoPmI|CM%BwK0PU73!Ew5jjF^*CM2lomKtE9>(f7LvbUiP76 zE#-d8O2qxDD+_g$Ep2CVwsVqZbQ#lH&4N$Qr@2oJ*)>zlIu@Rn9UzPD_AvcAxqGLv zv~;R{<;+>~J!Sbi3z;`>Oq#95BS?99ZmbiE@`^eW%*~?9PrR-fb1~a7!+hnlj~1(x zgVwgK=5}?hcR%i4c5Mq_KGN&f*1q|v4qM=e75qgKm@Pzx#^*4G7wnv#nUS0yuWhLX zd+IdU^a5BS!GM7vyzlKD=K!pLzi|55#|7ACz&h@nzJ3D?XV|VzpO{!=P=}LN2El=8 z<;s<02YLC#JfA|J=EZNmUQtq>`su~DZoSRzxH?-U(vi}$KJ2pBm?h<$`F&f78PC1so~)PN-y8G% zx6zdl-hwu>vZ`N|8(3aEW~LpHuqLm_8Y|DcU#hm2zx>@v{X!^-2G-aUuF(nbkh=fi zL4dDcAhyNV&!6K}NXkk|z`xW!Mv2Af=b~VLYU<1oij1D;YcdU zolQKgUcUQe)alp<=KfbEruQErqd+d*`K{Pl2^HR@4x2B?wDks9M!IDMDq6aA6#W}3rqHm=v1TLO5V%x^fD73N6!*JXSQ4n&@MH5t{H&*3 z3u+dx9ZF3}f$lilu`ew#@v>e>*17yEFM``39iN8Fq@rH)A!}~kMoAQydF5vr9F+UM zs)zHlB9Z`UU$~$jalT7uWr6{(aWD&uJTe-B<8SNtM~F1tJ-9vRaCzAgbags z{}7opSp54&a)vFBt}byeGO3w5~e+td0;A!Y@2F z$-jR0PIq7tl!0P6+DQ`2(O&`-l6Hf?XwCtK0&MPsN62jjt@Vc~$yka7i;^ulo+m{p z$%(7=LIN=trU|yQ*aRIevTixPQpkWD!`V*D=o$o2Q`++JMsJ;#9i|V*>$-|f`}C>v z7njn^`&%OopIx}%@^Y}QOQN8(TAWn!wv=N(hiz-;F0Z``=@_86?A1Q@WPKaFKi`bH zx}(L@J#wwAREO@O6xN>4uBO0F$adTT^pTb!&R>Lje{A|bK!iIWNl=%eK ztHdY-SB)MnPk4>N&t|y2z**P&m@EVBLDr3Fkzwql)&fB~dh*9ry}oOnIu)z4ueJ82 z{YB;)Oui0Zm6!nem%}bC6$gG=?`k%WCo0Dx51+q)28CYTMa(#Xz2yTf2>iUzM>=}Kx+eDC){IQY zSO>_nYzroWj|O}PRLm;waxT)FH+lvN0O>^!C6@5LqXw)jEK|A25bkk>9fi6A4WoCa zKB&Qzr8~RP2onx?2KF93I*5ZYSaD`MnpNtobz>_mO`hFrvMJF$zk@v^fZdkA*J?eD zelnzu-v5%FTd2ylFRhzPg)UB|v;}tt&d>1C6|0lb; zLK{{UF7m#z(mx?m%rnPr!lIxj4O!Om<;!cV9UQ!E92#R4w(JOrPS{R~ zJ%wtE+O9>GHRA1VZu(K?tATC3-uPsforqBzwZ^- zVY}vj$GIylaqG5~T9aJto3jllei6^~!BTAB%({2wV(oPs*3}?*cMi7|7+kfX7oN=X zFArFrfLS{hn5$!ob<3^62|o)+kCri1TwJOlq(MIToyHZN^!sICwg{%~U0%L0jwkmJ zdcILD+i%xbtOj=>e?sh0#@0O2FrmbR8Xds^I?M{*s z1Ib4^MzB|5wj(^@4#d6fX-jWne9Yg~9^;ae!U%oNdUr!|vm-;IJSx1J-st6TD1#Ok-Xm;GXUCzN}pNzI{ z-TIJOa1#6k|H1r$PoGBcU++pwxy4hl!aC@+Ub#mSM-|H_FzFkyq=(d8idGWD_mT=_C8gKaprJ~)X}4rBVwc)4cP$B>fi!n+HO)J1ZSvH>4xP+4!sXcx4roN z9=2eBhQ^iv&4=HolkPdVK?9NSfzh5R^5u-YgMOaFo5jGq?Aw?)?H4$hVVN5i(&st& z@@qRZl^Ge^Yo~%Ah_ZeC+LvJ9XW9}sj*+xqa0afbS*BK>P`&`+?4w8O;E6iC7UvN) zFzC)4QVZbtWcP|Yw{H)(<}SYXT5tp&ofQlV<<+2uVuj67v|Sx_LIW^?-44q+3r>)zPCq5AUWAeZT)XarfyYU3f-ba$gj(y2@45>(?-}T*9uX2r^ z=XuvOA^Gdf^snYIbX6UCiws>-$M#0Mx@|NfSrUuRboBbRY_s=B>>3MZu}Xy>wcWmT zJ9(EH@0A%=%}uPRGh(`uc8M-qb_&8!Xo7};nTS}_eJPk~cXSm0vupjf@`t;tQN39~ z!nT$_|1d;+&z@ZvioSB@+^15Ra(iPTi-;oGg}_>8S-}QqEa0 zRxO^9hrI`iCRChcge0oI%B(SEM%kUb6Em&3c@O66hn8B%oRfXpzM}u{JLjZOso{jx zvyJNVWygEBZ8vguaXI37UYuT0gTf(fqi#L&@y_cs`D&{1RB$BFoGv@Dp8@@MOi;L{ zX|jCTOHGUTaPXh^LhWnh=*sL<)x&fx;)59Suz{1pd+3l!8Ika7>Fbx;p@RJD7Ew;4 z1M&AYYZ@x5d&pwl+B@5vQ*{3R%pS^Yw~;(bX`!E`^eP9G((m94q;(@+<|s%ZnG$Pc zo>NygTWU|K63D6~poPH(uZ*!#qW)H^>KV3WjyZ`SW#8vKk<$`%awUu z9=<1Qv?$zlR77hbPR(Oz)s)}LW!GK;h{P6N0<@M8-G4w~h+Ka*Fzf*m_K)P1w)@rT zM?bq12oMdQU-~f45s$6JKyUo{A0Hr|)PLA7{KUwATp_%DyVC4g+{hyE|G9jC{CTstw~3wQNu>$}m_?+AGE@6XlknOt;-SD#-D z@qY=qCM0u{u<6I#vvBA(CdNbH8}_1DFDP!*c=5aLpMO4SXnOPJO+|%)d)_6Qzez=~ z!uctiMsOYL*`#C$@-T;2(ydNuL~{Kfy$r@jpb((6fL&-v`GTRx`_cX7dq)Mq!m~dK^$9uAMbbk*2OWz(Qo~&s|50anuNf( zn(}hRHQ-JHSnF1wE2}-mX6Sx6YI1utHx_fAj$s%Hn5l1KA{+;na>X;>;8 zy#UiZtJj&cCEmF4283Pm`zM_VXQZxibCWgH*xI422YU}9;gmN#Gxj2h7w666$Bsci7SqpHVdF23 zMhT!_Lc8UZ7!HnOu?yuvzs!UN2BzG&hH9cRTH2UtFyx?KS5KA=S{g`!ZR93CFoYZ1 zm&e08tsQ;hvxCil6sv{?1=Sde{>FP+IN$04JHpfwWx z%3oa|wT8=Y%s_cZhZndtJfY0s*x6uW z<}}_+ywNf*=vByMbAedheRJ&v?n(uID{Wa?$xvLrvJMbG0+vu(S{m2pvA?e}ls5>a zNnirO@(bfqFv3`RZsg?U%a6}HgaiceMtjzul%*LGCT&{=N*3mAc=`jNBDwPUaMZh;Tm;CmB3Ekr%goxki|Hj0SVtSJ%QN97Eqxad-fc^!?1YvU@KtDc)rvLzzSR2JDnNJv;-);2M(Nr6$Z3r53ZKi z-R^q}4iYj9)-8@iem;=oXdw_O{DSZ3(G--jIPe7Aa#HvJCEa~@Vn#-7Z{&Cf+#R#G zL-JtjgDEZTlk2y&95SJtB-A56M#NFYRTyufb*SrqF|bZg)}jz98|L@#BgIwgd(ixG z8$zueTel9hPiS1e{>wG$C+zM7RkoP}Xl||iQeYyhp)rb$dv_f(yET$Oh-tsi%+QpG zaqh2>7WS7q-reA?s3(<5delbF$jcps8z9sl+5PS<2U~#gwz*VC78J}wQ!-S+mS6Gj zUS0NN6+{|#yYPShhy4vPYUQ7v8bq$Y+sOQ>`u=U`REvX~^@$U&w+TIlQX@OtSw)3U zbnDOP4tJT|tuO600Z2p50MN(unI57WcBOerJuC_z@)IqWscS1(yf{xB4 zRufD#PVB+tOI*$p($5Xn>^rgy%A7sq6k85$*ku8jOzDADJD0H7QXY^ zZ~OO-y&mimO#*c3>N;oe}x*+NknXbn);I@3MM}2+$;2?S!;-i-0d#EcI z%^7%e8v7ok8&Vgr56lQKLZJ-1%n46P#_I&;f*9u(nKs{&yaPHz991}V-*4DFA!|AD;{>@{&9*a-; z&dTh9A44(?0ttvm^3Ina^^1sTU_#SXWhK(&69ak90G)+IM082vhxiI%Y5zM87}o(9 z8agL({6q5R?K0BR%Cb0Y*Tv9PeHDW35=6fzW2u#{{4{0-Ts&CT_& zB5H~k{R;d%_Y$eh-+y(=#YIKK+O@23sd?z<7wUI)N-8vbG0!9p0FZ~oQ-2aHpJcd! zNN9eB1tNGXbt};+IA_sUmrq%GJwJ}xG*b=|>If%C@jbU;7@++4@FNoQaajmhtgP>f z@O$mwzh5fWU0qA-98D1)TM9h;NkSZyF(^pUkJoOpY@5A(b2AztQES}0w?k1;G5b4C zTzEYjy5r$qHZ_fxtg5Jh`1QrjncGCo z8G!f>@yPZqTlNKEvbl=b24iDm?JXNOJ~?z{u;~b07`^uP--~?bXQx;uPZIZrz!%=O z{F=FoOC~yR&!1hK?)HW3;}|=8&1HvN_!y!?=R3-GXkOeuQ4c$PQG;_C2S+xjjQk?p zl{P~2vg+2>*4kP}U~wph@7=$zd9M`!$ipD%H^s%^urHmc|BS#<*y{_@0z|vgniD5Z z+?gjH$n_pZrwZVJuUsnz`=Z=cvaCQ@aj>(y(i@~}bfxn) zD7<85m(fG&33K1@aK3Vo2p{*|kdEe^cbEz(nlr&P9QffMj;K%0QPZ)uwB%Jq(@G7w z)=Yn{5$7HEG0{{@Om`hDu}m+(Y%iH?4g@M7!)os=aA_IF7TltHFz7Adra6>?k&*j^ z;J3-=0k^c`p|h;y~6AM%_DgFnfJ^o~73P-C^D52@L-`Ea%-f;!xf;;aT>WW06T zHp9>lYJ(7fZ}=QE)R zMLZruhwms24ZtTSFhInO`nY(&O8xPh1Q78NOs$K@N9DK+ij!@N43^r?KdtgYE2^u?2 zqD}k*quG`qTYQ4?Q4tZ07ddUx zPDFKoaZDB2yZ1ynlFJ71iV5rpv^&#tti$j1sN}K{F~zT~-apd>jg7T9$bC3T#vb2p z?~LOWD73~pxpXPe4gPbg74lKWt3F-jAPwh_J>-EsoF&blW8fswHB?ek!t&!mlNfDr z@g*RW4g!g~oJq{cN)kZ_Z||p1e~xFuz64xN0aHN9?%lhyx2hH%7&raAlamy}XCeWg zQyh*Tlo{xW6(!`xyF?wd8q$;>Qnjzni|g4D#?AX$ym56cij8T`{`5w18;2*CcBGx- zex94V_&MCxsrZ=QZJP>%AaMg1NdNT9USj4k&e5;JlarIK-48?{l`O*d`qJvA3XhF=X{&vd)nniAjoQ5x0yM?I_JPs zD>_FDYeh^{MRK4qeYn%!56`ENi-b{rp+c59Jkk?&nrL5^lg`w4;4<=>cScN%sdADo zkv|2vweekPg;J(m4>+%m^@k zLmp2LkKQu0kDhv%DOTGs?*49An0O$9XBdd99K9gkc7Aq(NGY$6rW4rK&nNpMRNp;D zL4J1;EG_2ML3c%L9yHtmy3-<6NBR_)Y^>P2`3b~782)CVOLoV_os^MzaMcusV^AFbP$Z1VB5jGD2LNAjOT{hlDV=wq1e9?!5Bm)X`*Otr!`f zGT0C%R0QVX%RoK5Iq{~${hP(lght12iUHQ_9F5X#3HrV5k8{l)6m zR}RK}3BgWB#ZF$pcF@R>(d3s6i11_!6< z8x`m~!SJAY*$i1D2f6m8W~^L=aOl>7^Rq2ZCyev6%z;>}mCV$g3x4_Km#lKgx$($oeDB_IA+L~=l~s}k?p`5$_wMOS zXeVG1-HB?G54e19uQGul0U}=<`LDE~v-9ca5B-MGHVBMvLRheQjg)}95(PufjM$&i z2M^OwUH!#6dt%Jy#co|AS6O;c4Ho~ZR{~89r9DU}v4sVW27P>)cRa`^u?QzIPHhGb z-K^)&KZz_)j6zq7S;Jw9U<*dveTCS;=Hs&xu$(^9uvTaH*RZ;}==6a|u+T84g`p${K~n*Kb>9 zky}}r5*yo-pFalxs?o?DUKP`O>6>EgpBk|exE&G0mw>)kCodvS;ueYA1A8lLZTnKy z`4i6kX&XT#K>s3kTKDVf>h!m?(*8S7WfvDuXu#z7DAWJURD}<4bAz!@Uil(&P!`f! z0%ZBA$xGDkG=%V?*u5piiegnXSaNdf4vAefLpeE9FrR+EL~oG*rhGd#P-8}_b9$-x zQX9kCrIpP;Qeiw~o!BXG=`V~BRGvAxW>kx3ruTTNDr0msy{vB$8p&NAxKE(APrACk z3OIy(n~izg1|U1~$i;X}6#5urq|w0BOV)zxn_BYQ$nwfc2m5B4eIku$(R<`Es;N;c zD3Eb%dg)8*j`!~nywtr;v@TykeU&a`zC^C3b3Nqji$tl0&f$o$y&ZtaX>n2kX{%p!5+IWR1kfS|Z) z@7|7lP=Jqb!N^TsQ88ErwhzeD7Z+w*@IEb67&SFDh&*m=!-+BuB(?xTT$Y*P_`Wov zqU=)34~rY2ijw=x0;VC4s6HKRlpYoSpjNo6AZRev7VJHFM=L(}#tj+RaG+Sw;Nzuk z!?pG*zLvCk8WJ*vo}#ImlUiEiDBiO7IKV;>h*0Y1CGrp1$n^92S3N3J1z8P;f&N!d zo;|b7U+U6XR=08GO5J(Y$lxQ?;B68z#Cwd#+hN?IqOy~(g7*OID4Y}M3MM8DVU{h9 zHZ58Ga>fp%DcF_PA-%&frmv=!$YXfUrKP1su@`=h73DU}sm#(>Wn5eyT6n>89vB{C z8R9b+FRy|2_vvZ$=$ZnIT(N4MpIh;a6Vwm_;H06&KV#Jd4r~{ibc*5d0j*;3+ZIg? zjrv_D0Xp_8T8xhI^PhcwJb3q!3q3eYwH$QMc_;@L46Pb&qgZ}eWGz}O)X|2sj)J>h zTZ79L4GjUBVZAau$oM9kzHLFLtcT!|x^?80VR_l8q{}(EuiBEGX?LKR?c9WlxHc8K zuu^147|zvP%asX>M_I_*J|u5gvnC3MzV~nF5S#_?l{9l12GxbGnWs2R z*54Mo^4DJph&kKIK_BUddVN#9voF>kd{|Ipad0JQWu2E1E~e8@Mz$q& z<$E`<{_)34j~R#T!0ke;QiI$T!GVG0lYelMwpot=k<-vguBfckuzfHtioP%BUt_mq zYk*vk8d9Mr$P{jZa0Yg0Z(pChyN^AlH^gsC1c99|OH|?DFqsKS#{jB4DqG;DJfB*V ztTcM~jUGmnzxX3RzhkJDK|o2l3(F-3?hFd#1_GgVJ*@p#$>N>#p6Y5F9q0me7D2>g z)=cuAN{BqPgM)+dE^#u$t0mXAeVX%iF#9h)e+_i zlJ$U8Fz8C;Wo)e08hxYCkdXBDo#fn{oCeMnQfrdX3@B-)Q}|m(h9jm+%M`PF`0kee zbkz=Bu2dH)qb(Z;H~we|G2g6^KUdlLB(B zY$Mp&nI2;;Of%HpPiisG6s62Chc+wF$S>@FM-$v5bu+w|rB`xXJK)GmpSLCwd@+#3 zSNvuut}v;7hGD}@J$d_sWeh{weMjWtWa}_udhiYO9?0gVE6dBD1LgymHT&F|^v`h2 z0g&BqIG{qRrXvqCs|rgkxa3qkUXu&Io^g#Lbd*}$jO%@SF910-yNHM_%18M1U>89X zE|wplT`?uI(EH1y5HDHbB`y3itqsiglJ`=4s!VPfNxm?wLc6Z#MPBdvx?AGrPr@16 zQAI_I*lcwQWYpE1`eI^YP?%I+uG$^Bbh-lZUqm-fi+TPX7Ea61BNso@BMm0Fc z7`%3E8L@cz_V3r4V%>xr&lcBeQ+MDhU}BXxE1dp}Ni*^#WjBtuAP4kD-^)h5J>YW@ zaMQ#9iecFM#6HI{kHW3&hQqRg{CvzytBG6Zoa~L$)sHe+Wa_BHU5q|V}R#sMKc$^_=SOu1ngM-gx|GdKzf8iZGnnT0GF}m+^ zZJSRT{V;{x~^=hI;=jCQlOkCB(` zje+`+-(*`hLKb`)TC@Em5BsIfiM&MO3h?DS>vvmNT8d)`4P=dp6)XR4u35@(mVWYQ ze)2cV`L}%#{{0`I+)s=W-}*15Ngz3YW9k2keBCvkkc|7#iXoB@p6Shokz4iK+n|^DT8}JUR!(k{`A_zNRn9%WME7VXqvwv(!wqQh zaIZE5HUf`Zw9UQ@=^?Djh%VoeZ{Ox&c=bRy2fk@r93N)g|3M?G3HF+9)poi~UFo$x z&;R|04QQjWfm8*@Bs3m$B?ruH@tm;O^f$KosdHkng*rC9lQHkxy_aM23)|FeXWQh| z_L_kkJofinvXhSf&LcDEen|F4L%Y6(Wpbj>eZxVmoAS5z$o!^vsY6#uzH8yz?8v+` zgVML(-oISNsPCJ{mCBiF5`4ZR^q_DG70sX4vDwX7e`uY_JOl!XaS0t5&-h~9F)=YZ zHRNf~hMh;hpwL+~f-)t5(=+A{nA3)|`6}ck?d?|q6&QO?1o5x|IReK3c*PEbn`G`p zKW;NIlWxm*RYH}7`ChO*i}OsxbFsJk!xUiKMUxgEpV|E;KY?8t|6n)LB#V@2sY|Vq zSinZ-aP43Hsrl#fdZ56zVgBphJ$i8&=*2k+Bnb#udd$b1zKmeJMbzWA`O%7W zsQEORJ9;Y?faai0ceK9G2JO!{h=ZBI(^|K^{6Cue?s%&E|8I3&U0td8UP-0ps%#+? z$to?I>=7Eqg^cV?bRgT_JDIU!`<&(EQ*-?;DJ{rmlKKOVP# z^5`6&^EvO&d%VVTSfWsncG{f!VIQHW9*~=pgC3SfQ(XOurHSDd7t_8m%iQEcH?MykGg}vJ z(L{xMfrymjql6n9!{U!Fb>xYO=Wj83a{-3!mnhkeUa;!?tT z`Bq^W86yuWjDeH4Zd-VCV!${yjnfrnNyMxI!<2eBvHb=p;M%TwZ#pgj_vBYO?kKcK z4k_7YeEl(&4BPDC>&XYwS2K(3*dBlf_)d}9RkuaT&0Z&bJ% z{Zy{kigkM~Sj&%=*0{qpB-@RXp*y0X`yTrr)P)vQ0Ga#jNq4>(5YINvUM> z=8K*G;)mfWny4(NNggAecFAkmzDqja&{enp!YsR2!g*%htO;?6<1b%v9x7yV?c^rE zO|#kRCGhHyZzj|E9hV9GOf~ zYnZ3DByHbAvP*M6aayS*ZN7ENsy?Dwkm3Ne5N?%p(Ee-ob->4O+Z;2^yR*Wb-+wwI zA>AN<5DkFaH`VrUcmDSNVpIV%Hr!l-ELC+#-(^XHv^9nx|E9r`c6~6k{?cXzcTCj$mieC4RB`cg)$(q*rCO8X?IB{Kp=O%3n z=2lk4ef=hJFJyZky)lFx{Mao)DTrl}Q48(x+Uum0dAe-VA8Z+hyX_{ZHWmk4d>3Ew zekfL?!XtzA{+&cgtNXJn4h#Ye$G!B4kJpZ?O+T`#f6`T3?=!<@a$SLXuVOrq+I0tV zOt&j?H+Tu1*4k`Y^A%7`Gd-cXt)k|SH)iUQ6sI0$UizhCA)3F!D&GprQG(`qgy!iU zH!Apko#SaYV!b?wguYLxWSLQPDWDH06J80i?b{yRIr8=Sby;cC3t&-Ddf0vR9!jQx zcmm$B+u}U4vCp(w*H~z>l%&%zj2~XWdc}G8{lMb}cbj)84jAOQsXg-e=)ajyHxnic zd(K~7zYPVPD)bcUy!z^+VU}96vZC{$KT1{TD2)8pdDZ{qmT7(JEVIi{YuUxmzIu9k z)$a*SkeT~vW@Q*S;}C+{kPV{nm{?-|smGk`sm8?imlo!fBF#=gi)Y5tLfG`n+uici z#8s|PwoeWtzj(o&_8!Uwt5ZYfS2LxC?2rUV0cU%I8u}4zMoEfcsCWf#mr&$%;#<^c zt72s1w@XqtbJ0-YQ;IjPkh_AOQ|EA4(weX=;yRsl77p4m^}p%vP6>I}W%Ud!b#5?0z( z{6=4##BW&e_}$&}YSCisb)DipUYbKQ5mOeok?s!qHpO4@I$82;Qg)$eKhHrezIT~M zo^T=wEsvUWr*(H&5LpmU@2B0iYTk|fulCs_1>T7jz@Y zq_tH{_{nJ6`iaJqHdgOa^vk{6Em;(5;-qI$XB)v|Q^-}Ca1|9Hg|^jYmF~`MQK2TX z&UH;W!dO8)*IZ?G*U_XAm#=RVo;2+aeZs<}3i%Z^1(hioPgTZ>;ZEJ?riEUwd|PEUfot-6w_XkBcEe)|RfTX5LafaZ+Qq%9&{w9OpSqX8!a&LG8_D z|C?z#8EG!|drsWCb?sJoAu-T-XHi=W*;#F6qO=X{H~pyWxm^vN{2K$bM$`?d~+ zrZpNF3&4gr(~9tHQte!&zdoYcFeRGK&-6&}5>MfQ#iHvol5>$HNvtw^K~n*9Z)&8l z`2f4D&pW!3WTx*o&KY=PlP_Zt1FHMFyZO=7(CGkFms184)-sbk5rWuRl~v)?pEtf zTWPp;G!ONg_=H{3#xt0*N()U+N<4mZ>fNfdm&7ldx_8?&%5~RIQ)jpLKc3w|)K7oG zHfpm-^Oa3&EhQCvUHtwE{vgAgCb_tc;8Vg)PGMq}{*0`N3WhLWpQbjYX`ASCEuz;8 zst2cl2bLuEE9RVSdqpEs(Z&xcNj@sgS)dXfq#bccV6Le|N{7{oIW(*=O)@&e#<$Ad zN7gm&R!CQh7itAty}zGT;=S9IGW;El7s0B~WaXBXIZ8ee+EeE4>8DG4j=H$#T&Wi( z8Ir8>ZMh{Ii$-OQJu|LT9R|DmRVO2R>muyhbHar0n?;g$NG@Ex3;4-=l+XSRcqV?y zf}8`HnxAtexGv@{xa+*!WbBYU)6P4%iBin@Qp!q)CgY0eu}vd`UpK3(h;8pLI}W+* zSN^2c^Si}n-IiUd6D=6^(8+tRb740vYX16NNXaIF?sWC|%lo&W27$HlHnC<%<2$-a zN%K4z5^LA4O(i)E9A;K@}(Kjl#wz8T*!-rkQ z;cmLw3XJlJNuA=^tr=PQ8@K9&%azHz=bLEubnyRfKDLo}YJ5E6Gv|z8xdS@(y>DWLCt1e@r?1@-6fwvhUyI`Uym?xPeM=YrC0b_2kzmk zQitTUQZ>vF*e~d=JP4#N+Fq)5*Ir}4_2^7rIQejD z);*(n$r0<;6|nF2PZK?3s&$K6nQpvCDSR)hhf1~k_+|ua=RQ7sfteCf2@zC1n)whB z*%&>u?E11lC$wqAI63+nTX%A^y~D?S7b3No7=6A~oM;rjNch;rCJgT{aT-YDOIdt$ z&}EK!#6#QKdK=r@B1&H#Sb2Q*jk%L` z25jPZxmB4lM1lBgijByGxou5X&mTMP>I~P!4i=AsQo4=nBHtBF-6OZzWsd~-E_ye= zQ1TJ^GgRs0*nOS9V!y8om1GNVjj65Ba%e;03agS-RID(hv0cJLdB|*chP)+ny-BvZ zffo+;sDlIBy47P}91UD9&xV-%n z7yd2bwa#xcv@XLpC*`9X_mNnd77eG_-eEoEaI*G?6e2dxUvR-Irg*mgmvhlle3ya*$qO#Ys?P-0ss`2c!MU0bto zMz6VEgGwVo8O`H2SFnvzjz1)a=W6 zZ-hpU*R^GZ<;Q>xtUybTy(!?YJCc^x8v13>Y`FVMBUlPQ+ zVct^t;->H8Qwe>Q$8RQ`<9=RWW%4 z45siyg9R6x0-J4E`EY26UPyWQ{H0QSaie>nV?C5MOWNjdi+Ar67texm%d5axLE|ya z+=(*##@gC6Ie$io8xRpNSG=)G}M1Ce`JDSb&xodo^ zzdd`J=Iz;jb|Bo%efHPWYu_pLmf1$^P%v!sVoj zAQk-hBRa}nQQd+2KK&suDAE}df>&P)3d{%Ic|qJ0QbUCUH8&4dpna-n>yW(dea*?_ z#7Er8iPsY;TKZe)Z&BZ$$eDSM(j=zKYureI2*=?ysH2{jY!|9dPEJgOpL8&~XR-5l zDt=$Ou+`!v|Wl z6)^~RL4z8yNuFF4rQbfcWPr=FOGGqx!-mkrXPFbF#4YMVct7N}nmqV_GDGadCHyw@ zQoGh!=2}O*LG3k(lhm9U8m4x)jDdgoWgaoXBXx|7yabO#@f;LKi97>dnh{}39nUp) zeP#pm$ZPXE0oYQP3oW7C&4bI-YUUihY2pJI?jB~|X{uOf)Iq~HPgSCZglJY(?#az% z&l#gXSDs6WZv+KgMcZcdCmIsZ)1H#kK|bw1zkmrPMPxsqRUa=zl?c)`K(56n9A9@^w19_YIh0aOj-I!&#|(RBKb`Weh;}{nNZzV zGw}F}h){b<*(jeKsb4?tks~q!8UAr>P^bXyCn+hYB#->caQMlcgnisv41P_JU@S;Z z?ngO^Fe6ZGH9Z_wol+5%#X31hSN(mcO3le(Z?am+@L-FX*~KbJhQq0MA|n&!@=#^0 z$?oRi)w&qnof0DIORT)iEg>b(?`qvs#@9%oywj=&)hTIL0kG)J<=)hRfx_{WJ*Y|LSAHtIKkBsbi7fe-*m# zDAJ!%FE~bPAMa24`ZhSh>TodQ$)Lp}L!cn9%4P6ddC+Gr2nD+~;JjhIjIM8J2#T7{ zBOTi5_UKl_1MM$6uu5AY{(-!|0zxE&SPY7$8;eOcS>Ue+j!%t^>t2H)SD^yJ!iAPQj<9ct0ZTo05SV{FU z1MktvLVN@gpeYzG9XwIbkM)OzPxhSThOipa92LH5j+{xx(mqiUYPx5`Kp3XUT|=)& zAqV%AyyzA4wb2uXQ+T*8RzLZi*;&ZG*nE^fxE3Pr!G}avtI={ZC0$ZxeBIoNM#uxMy;jv3*?v#A zMP&U(Y}$&<61yD@Rx$VwF3hh6)F$?TwT`|0wTK9UX*I4&Me9Nrn14>C@YChP6`oUZ zD0&d}#jr6yKWi>7E(PC_!cK^6%N;^h!@9?l=FJ8WV4?$x?tn){*?>qeGCW*bRwiUL zhOEu`%!l<|*0Mk-zJP6Vo=vA}-x&zYJ-0qSo@safd^12by1L@Ni~M8y@R+>^doYM0 zNV)Ow@fp-wTyM6x}ELHr1jm!3BgUKHD zvj@|?-he`h(6N9bC@9QpGIB#{LDyxZJze*UH+2qkYaM^jjceq=;ZN-U%6{`g`{wvJ zKFN~eRlj!s&RCXj7Crvvj(V8{eUPpf?RKx;!Eo0ceG+_WK=q3KNt~`zG}#nr=GKPs zFLr)g%fzdjNd^o6vjMu8z}Ttr-X%rdy9cbBVhbBo^w3Q-c9;U{X+H$=P}m1%nGnaH zZS;W5IhT^8_slxBa4Qk7d5<$Ydjx4S<>i}^rw#SH>hlNpKFQ9OS5-Y#6Wh98T^Gt4 zQ6gqCGby*%)wKn?L&ZU8mEp9AFZ!KTj|FI*O*I@6f|0`G;-ybw&#GF?Eo~p?l&E8! znZK_OvUhPFKj=K8bBw|gD%nz|`Wr^YbD{EhS*`Hs8Xw)vG;2%m`dMmwzwJRfwSXBr zhZJjjJ2MnWY=EW)6+%{+G(I{iEG(>`Fn!;U4f<0)D9)RHK#YU7cIse+#rgA^pb-I& z<&N;F1T;3ZWWjfs92*O1?=EHq8vuZV;-aFyf;<%9!&kj8Y%mG{J8Mr>TIiW)gLRdq zpvx9dU^HtZglN=q*&s@NRn^fx(Tkrr^36@%V5Wrc3{-66h#`0SIY=eQZ906r>C0qv zb9C+Z={n_a=KSo5GNYdQAOG#-3M!c8(Y4A|Xnz@qV-Vt*SVnL1qTT{2hVJ|q?uwlQvUOvZ`wS71%7mZOWarfDR4 zYBI_3K^3D~?099(I}0oSkBM2T8BX>te&35{fU{jGKI z;-|mY2^ke@1ptwnA*Qpb>D#DM-+ASEUd=~aCu!CIXTzL0ol*}S-rCQ|aT4+wZEZWv zWKg#k@q$7;TS0!lcX3S@j)3E#W2r@;7H9knYJjym0iY7EQwWe#u+VUbtkA zFxmzDjooF@Mxu(j{6>Bioo*teaCrywfM|yW`-IN(KCPiqfe6Z4I zc-j*j9xj89F_fYclY8P|y%ZLvjkRyqDb`;xLyoO`($FQ|qa3~hhSlQTZbx4N=?aTr zNQ2r9ynk~3@Y8%ODm1Z?y`qy5p&)kQyU~y%3x}J~JnQLK(P3;KkG^Sbt6LX0CN=(LMNVfSe{`X(q+{#J ztg%Z+uQp5@zdcv}q2kcc#r(YtemK7w7#k4E!>al7$VhBwOAZc#)->(9uQIMMaq)b2 zOHqFRfdfXc8U)jo*ABo9kR!}=q&>c=hheL99v!$TRQ?y{OVjRDGTK0>=OfXIj*Lv% z;M@a~X?}OFgwi3CBKt;M5kLm5MpN8en&dA9w)4R*_a(bnLxiN_>Fo~w2b6d3yz=>1 zUb#Gf^EzFrW2n6I@79p$bw459Atw%{&$8Z61x6Ef zk_*YN0*y*qa?N@ndtPwi>BLhOZnZ%s`2!<59@qyQDc4?GvNCL(Ov(WPu*|D{5%CIk z1fVf*Ucdh4b9)ZNYILLx2~a=u+1*F-+YY%>AGcg+{8Wbeu4QZ=3Q&9O(Cmsk35;yv z0b$|BI062;eLx6fBdFb7!$J6SD_Y^)OsYJ|o*%3r1Ji=iiY}I+&W?^WC@u8AuWb?p zUhFoKc@{!Zjg)_(y|%Jajw|?pPIlP+;EO1ctK@L4XAxIZYuL^m>=4BfwA20NYm?}( zvvLtx({$GRi*Rz+o1*(!E-zZF+u(HZVR*3bQ^7n!i;h*pB$^-LmDr0Q|R^Uc>09JH|=+3 z20x3&uF4C9rofpGw;_(Am0{3ACeOvXcAwfD-WN>1ZqpePjq|qLYZ_o+KSi;xEA$P-1WvU2ShNJKIAHe;XN zykW!4bD>Drd7^>3gYbPN%y?lV^H_g8SBx)+qPj`1{HB&09*UN4)k;kTeUBNN^L*({ z7fJpeFGQB&Mz@fXtE)WZQ78H^iVDCMA%vy5xk}yQ1QcY#3i0e)Qv=QZ+_8I-69u5MG|r(GepeOpOiQXklI; z7uCG#k1=-PvTI?@(ujZh#Nceh(!m`-p*D6YYc^X#VnBT_h3EAeR)z=Ps;i5#Htc78 zxC8v(lp>WbPpX~qbA$KGVf8M0ChAq#2)cup%cY{S|udFQ*j@XYyXXdcz?RP#aa* z^2ejS@fqA~L$=-|_kx&3~&b;N}xj^6gtE{f!SyAp^6_r$fg6AK*aCx3a_u{&_1u ziMIcH3hsAyrJWUe%pXoNeZ8{!y)qp;je9t}Mx;Nh4blIr4hC5VKX$37<|~((bC5l9 zOMp@n$WwzOC{7jFIO?eZVQ@3M6~_ zSY*G!nf~(pK}PfLQgv3cjTU%ACLU~=2tq~^2Q+&xVX{VZ?SCHFcDIM zWCGwq-@$j52EBlG)&?7{M-b1!g0v~c^Sk&<{NHM6pBjb|2Z}DR=P?Isc^}>HG1J~{ zQwo|hTal0SS8zebCdwX&Tm#Lm&Ts!qF6GFS`W^XlDuK;b$(4f!%o4q@!+a3bAYr*s z)1G~S7c?{gC3fwKpOa9(o5%hY^c%Q9w`mlk)3`FU*Nipvc@Ez7h$aW0G6w?(>YsVuuxotvg`)_+GKUZQ-BXfafu4)97BH#H2ThJ}18pZ-owT$uG1 zsPadyl&xhK6=_Mp7o_TS)23T+v(}x3Tj?aXZ zpRqjQjEGq;6(ZSXIi3DdLZ12@iwwv~UW>f}&Xl*=XkdUT8nowT_mN-e6+vAoA|{4o zUzc}9IC%t$`(`X-lWit#wFKG!Dw8v4VuM%-y>|@^2(&k{^1;6ktGXwhPFdLM{>o)g z;NuR)r;xJQwM!WC{PlZU7Uu^GMzI!pKkQScDesq%NV4g48Oz$JSf?_tu6;FOdvc4a zWA8>6jHkxQj;N+{S|cZ>Pfw3JF5Ecx`iPge5GJo|p?B6tvE81uDA65BkM@^QGS&@I z-N3db1Qq&xzkPWE#$;`vw3ry+jcUTA=E*8z|Ix5*Ujq{hu|kS10`;-D(W8hBttRY`yZsmXBjZqNm^9K=1oMFIdui5$UKtxY<1&oS+47ZAjcRAc*w zhoLyZb=CLtELkN=MEmAQ-d9z|_V_A!V`F2&5$I6#FqA5&U7p{X#5Zr&t&(xo&H8Oi zbH8e|PF6##-pu!;fC2lf7?9uAZ8>9M(UzpN+1XK}%G)lm^BN>2cQsRce9xe!jdpV5 zh@&{HM$mYXb(kK7R1q&&fIfOYM&P>*aucnXXz?qzXpRtxNwjwAGLROZX5rb(TB2+ zi`3l3OaOlyE)#2YCg@-1LrS(cC_B-#3sE|Pv2Wrc&6^6ywBYPyWaRr&nq#s`9rMnH zBM#iJ2%%!ONYqCTofm$b(AFS;ahv~N2zoeWY3Nj|zEU2k%#Buq`(L~`#adIhB7xXRJ)7VV|8^X1NlR{>YIa}c0QVMBh&it?Kx2^fT zNX+Z|?~;;|Q52xIUcGpcEbH^(0~mFQ$7;2IQ3EPELdDXR^Yh8T%fe)4PfyPwV}>D` z@9_yTv>)<_DBtfUMuXfnrDT@MHQ{_;fS;RNXTr(K7gniDN`!Kqf z%e8p*W$+*2@Txbt$agW6-TkjG8Qfg1?%VZE9jdPU9=&F1f>=7Ne(-g#``kHcKX!?y z%sbDBuK4!>2%Wf3FM89F%0JM_|EE}JImn=gJM=w!x%5qkMDuvp?68Km7)tmW+y1Md z32T>r1q4;myO;YR|DVQp|6kndg=K+<|2h=?AKvQIN9di=AH!1Q|6fGSaju9b;Iw7$ z;9!+J9#W{mlb|O{v`R5umhNri^reFbDL5v@riWTkaR%FK4clABq{~|8jWD|qSgQ~! zUw*rDY`Z*=MZR+ybRlIjkX&gyYFl*I2RSeq-Il0|KKefq_2n`OCNp;Vk zCnBa*E8VHXCx0MyZ)kS+jn{AEnP7-?PWp#T8DeV1So0v0>9n3wcgH=V&%n&&l#w}- zRSLKZv70Ym2R0YL9uI$1G@_rki&3TnP)szby z?O?T3_4vwYyK?t=j|Y5HQx#3%6Z1aS&FV%tlxNvRE-18WDMqDU#0uI_8V+CHeuUbC zp`M;rma#WL)CiRV*%v?0Psu{M*%Mj?n}OhU-WLPjAR-cHi-!W>rMu$P={2l?wQG)8 zz&bXM{(7UXdt=UtrGTj*D8A6#cb*ujAM@ofuL@O5yqJLSVbdn+>ZW;6EN zikZQ5BE9<|Kj)`$k1TQM(5lr}36!wsoE((1IuW4z>F}U`R8DnF4v~ajK@egggeFLl z+TdSYSVCxDqVg3ALv=zY8BX)x_z=jc$Y^<@E>up4eJW9XW(K%z-a)5&5D9{-#nG}? zn%}5hhPSPn`#!V#&Yemp9xtTWoSa^xR&B#n+1#89^s@nTIiNVeVOX9g8EpC?+=s>C z5h^Kg28t-gkRwh=&;*@!|CkPAzO`kN1CUDBu2o}lnUoJ_Mbo1mqsM8{S!ED)o>rkk zE>;6{`{^RUy)!By(pz-4iq_GI(k?Kp-4%;Z_mM&?A-V!qe~lcfH*Ax{{0!WCWpAAA z#}ZnBy^9Ng`rK>(ta~)W0a9cqpyJeZ1Rwb4PM(A=sBYlqnyn#L(`5~@lZ5ygyU%+O z$=UdDG6DnWYaMmnz|MaE-T~{uH{4uY1%P{bFsFcl4!_j4ZrGQnAV7xf$RK1Uw6Cwj zKqm*+r=zR}-y#%`Z?qs0;$fGDwE!}uJ)tGwlkoa}{Zq3r8)8iSI*;#Mg2FWp?=>i^ zLwSx30@W$qhX@$)&!qnDAeJSn#qLsxasUWq5aWjOH12b(u&33MuCp>cGUCkLUf2M6 z3zN3!AZ0>w#&uB=#Wv8JRk9v|UJm;MaTp6$vHOx;5IUe8an=Ey^u$0wi#8peI@eM< zOC~@$cFzFLwL`eZ2HdVcwb1jN!{*JKvu1WNZQXy3AgvHJ2;vm>TLi+tgs#gL6B7e> z0q;+vO6aIg%Il}J28GzXP^ zy*27$P0$ti4Te|yol=gLhe##?e%aA%iLTc%XeERTnPirgxr@q|#}+qqfi#MT65d1f zAQJH55St^G2)z(O`~uGwwG=m}y-Z9H1ib(}q4GLooC=ATwfNt&@a<<}sxox|wg}6c z2FNlpm(QPBHVGM@hGYrrnE?p|>JVtcL<8gE%H_)z^-gySJ6Ox1(sJwCwb%7NJm)2y zzB~{qPf7WLnqIXOnio5zs@JV6{bQ>K|0{~Bj6t70&G^KLm)_!qBY=zPs3jlZB0+;M zMD3!B3)ptjzTHzOJYIBg&`3aJu8u}1p>@u|QJWVbIL#JHUc=T>U?Uk7{TdQ{y{JSJ zhvz?Y;sjG0@kKMU`?}QlB~o9`%*m@bZ%$JOYAE8xjCi`>{0>2Ibf>>V!$5RwAun z%>yli-B0GC+#-K}Fj?Bms|z~$1w1C@UhuER5_lx3Sl)M)yqhnvNIM#BMs1T4!#yp>-PyaHL<}(-k&( z2<0$wVc}E&`$3d;@Tz{i5j**xEr}x5unfX8Uq0hoaK<0=l=m+s?53%hjd^mZ4{V(g zIQ%^1)DvN!(w1RJ`|{--#`kt=>3>6f^uHej5jVc1bM@oKmli5bwuXmI-1&)&f$*n*D@X_Xxm>~Q&6)2(q36eoPE)o4dE}&dRUmgVDFmeG!t~jX z!NS59A1~<{C_bo8*ZJCi@LgnZ|xUrc@Y;rUOha|63FCMv1+NM`PmDXN~T z{=& zL(%Z}#I8?V;-3rPLjM%IvA*fA<6k^2`mg^~)BnvM{Se3{-tliPKu6O3#|z*>|M^pS zK-Q$ck-_iWvE>gX*4)zn{rGZ3G{5xo^QGlW(F6UZm!!sg|4vREJHdZJf%p%Fb_b!Zu0S+oEf&)k+sf3KAiqa+Bh;%!IG^hwegQSRnbc1w*O1HGMbcb}a z*WmNK?{9y{_s`yc?dNz7kb7qCxUO}rb)M%sukn(R625$iuE(NJAIsYfEDqZ$U!NIxgDw-&dA8`~mGjJxGimNVEeYOU|FhaG zWx}$Ti*H_XkvOs{$G=>8ccX@d@=KgZ@Cb9tM}bN@d#h=QFuhu-lI=YW&AgSiwzem~ zqIlSOB595~2;o{dk7&c)$xmVb^#*ko`|An@`x9sU3ijtCB=&}IJO!~oanKjAKkXhP z`CX6b0xu44t_OJg`}v7`O51&0{e2Z)3;ccs^T>GO9vg$l$=T2%NJ_aft8KEAkB$eT z&cYEmcZEI0 zsgt{`p+H|ax$FPqQyJYyaIqptMmqA${P4u8^!tz=BmM!-LPdXXi0wJ@b*8Hdqo5zg zk$3p?$;BF&(6>lJK9=LxMqiG##yh#EJ9#x@B@-P&6R(bT%KkkjSEKE;$c~9E@~hK^ zGe2>=)+Hj)@X1u=S_VbR$;aNHoSu;_{|Rymde>G))!nF{kn8I*AR|4k%;t5&hrMTji@6d(S^2G$@gKFEKC31D9r=@VT_={Y2K%I|!|zCz=HP z=fwU_j1vLcP)2c2uC08v89!jfo5NwW)yGYCujwhD{e{B{+KsITA1Mgy#^CX5v`M@K z?SC%z=NU8xCCbD;dHZ<#vbot#HG#@erJbE!Qnpfz7a?6L=V-ZJ`h!`=dg;p#jE6oF z8A1R^kYI4#lWYbUYb1o0hCq};T6SQi_<-O6-aA@PYr#WlFuD|kS1 ze~TRE8zSuL_*WCY>b$lF5#!EfSK-912bS{lq}dn?2E=ewd;$B1WgC1+m$2^cnphVK z7*}7Gr)3H}){10p+OtdN2$zj#=I+n$?b;pA$@=kcPd102Yg*GATgxtGXzp-*BbUWs zG*k06f&mf0Q)YNhx!mqg%B=EI(gU*rW3Ei)5^wATJQDI0GzuCc<@FO9fKg3Kz0~O{ zAyts*Wz|_Ok8HBsNUrP1_%xR-&Dn*f$Gh(^prGRUog#ZcvflQYSS`)*mj7f=cqd8I zm+$qQo6X^ljdA$}K{3i==eH}T`4z@jZA=HsX?&J*O?NMu1;lX=$!jD@S;Li| zr$5i$o<3(e*`RH1K9XcMnBK>`v0%0F>(6v6v-kD;!NTG0-5Cn$N-O-fhX)02FZ3iC z6w*F3DzS+6n-7G|jH3>aQ z#Z1-sVe6wGiI3fI`?BPO6$PV><~kEeliFnj$W_wW^qMByqRMm|gGODC52qNF?Ac+d zi&z;j_K>TmEhRgQUDU}xn(Nz$c@*T;y~r*hiA>sfTjwej*44qzi7vLR<0HgVxi^;8 zVJAMv!%Mxp@tnby>u~);@(b%-grNBx`O7C37UTCW*Nwe9SCy{GpqTOTfUzLHPS_Wj zxJ8quh6%WpT6cKnbRKn?;oPsU+SQXq4@`R19gAHK_iqoW#y$1=y&pT@%W2X(=ObVC z*@kbs4^Qkzbr|z;`)}IDuZ~BjvXPi;mbiG`mt@#DEk??5iw63oIh8A4e?Wz3y{z>P z#jmp%S(|FbCbd@Q_A#xu+uLMcvo={40*HDHg=6N=7a+Pxm=g0MD@~CkL)1$QR5Sj< z3$~WV>&e$KY*jAm&J>vMPx4*5>La(luo=GknX&Z+7cZP4EOL?}UrO;qYUt~=sRbno zXNRue>oEgf_L}p_V#vxr)vU=9ISPby($Qg|cUALKj43#O#S2R>vACT-E`QZA?icx> zS;KOsjk!qd>fFRV>1bX&7cG>@*5@D^@w76na%+{=ug>*tjlszxXT2RZ=hM~tG6(N) ziBjHVQkEIkAhR7kawBDC-b5EW)r#2^*jxE*-bT9a>NN#=ipF*!Bu=CsP&6_)iYkHhFnKjwA z`q1VxZ6-0Di}1NID&eWvsm3)a7{frJiJu#(hWSEba~ug44-lK9S+N76gN?gY6(Oxz z5s)iR#RO>{?`aBaERghDDX-+Z94A*26rAs2RX-N&%8q4_h)2^CP-vu8a?9d1;BUG6 z&G8}5Una?Ls2iM7OqEU4jWg*pPgl&`rF(zcO@Y6_u%mN!I5VTPDKp5^xK#luHj%34 zx^GsgT0BuF*|@S`U#&Krc1cWDOoQ~kWyq(oKJ>&UI_0KjicG9$gCS>i(Wna@RZp6N z;}jpJ)5TJOd$l;v=V)2jpG?kbU|=BiL&ZKK<%48o(QJ5jujE7LI)ylWt7mC#9$SHdMj&!`F-m0jGTUX<(BddKm@xc{*#H-L}#7slK*~4&!Q%L-( zL!?v%kx5agkn8e%gk)DawSPSAdCzIwEfY%5o>Jkuxo|Ap%DV8-d}yaBlyRmtQfXQq zO+$3U6c=6WxUFfEzEx5aU+=G`oKLTqq3n-**xe?&^s%SJ%2iH@3uVqhf*EiTaT6c= z@hnInTQrz!U^g0zRD&xu^rYDX{GF{4*Tqj|pWz;t5xTRWTzTWO5|D)R7=VrQ~P){ucFfp9_tztATL6PoUZpgUIdyi+n zNX~(l#hB&L8OO=l`y=@9T%AJ~jW%W!@0ZFoTO*C@l}Y##X9j%)HKb$HQ5oD zU!VEpqM7!>tJ<0fbBs(^DgIhIkhCPAr4`%rVu{;ka=xD2m8t90smJrZw346dY6Sv6 zPzZV?@gvUT-%4q33;g-Y8L3(JT7!qP4c1W9=hr65MbA$qAt*zU6-$oW?(HV~{!#Ol zoAW(=E@^@ogq&NvP{93(I!ILpZcRC>{M;>J)Jw`IDb$#S>%;Nak^1`U! zi|Y*3Vva3^o1}bNcIFa1BS}8{ z)orZ5Y}e-Yt5z*A5&ss#q#~;^Ty*@!IQkr(ixL$!=+f)oe0#x6O0!BmlOHcDM~E4i zxeaxo*m}1K;sH1LNvJ=Y19kGHdyULCoACksdp1Km=c-uq3-T-mv!XikLOq0^8euYf zGxvKSPe(p5OUe?P?wj1yYQ*kHDech&xcmi7gap>D!pNz zT<&O;Dl@B;n)YS!ne=8ff1tv&ywL7=_xDk+V;ZXp9}5M!j+J?#x?_0jHkRwVV*=}H z==Nm$<%4ut3;0uyTeR269w=Ay-F~u37i~ZGHzMafo1~jVyMz*q6|+<`ogZpX#JI?w zw@OQIja0j}R0Mb0)W=80w-YvG~W4&M!t5Z<=fNM}Qk z^1s|jH5=Z-bYOzN%Cp<;4~e;$6qyhAWJ*bu^*sK%C+>!OS)yjlJ2X9r_0_I-XgM)< z0mY&?cJ|&+j#3(a;(ssUgukLUA>-OhtU~OT_;AJl*TSv6A4#1tHbR$rU$~|+Jtnu= zvtzg0+anBa@+NjFn9y<)v^ZWcO>EVCRoE$Cr)})wQ8P9e-?p~4I}?-4;kHFlz3NF{ z;vhh6y0dyU##xacO5D8Te7aJ$xn7S#(~>)yers{~SSMcSna|D8{prTwnTY^_uyk3p z5P7N949ooT06IZ70MTX8o$_3ej87>`J?KNO!wjpsn9-DU4BD(KDU21?=xjKLk^`OXPw9@X+xaIZ}_e(thCO-Xqid-Ia zUEN=)VwJ6th>nU-=~$^uFLJ4%TEWs5BSwVW-kX@S?RXQ^iS3(4&o-LS9}i@Dn8n}K zrbQg7Iv9;geUL?x_%@RkxEt<^%k4!AdWohAYk$>}=LzfiUD9l7Jce68OL7=p9Wws& zg+=ngrJEAPj3(m9%5ao~oT=Fo?q!mLL5uZpW-SWBAmw>STD$w_u=Hh=+HJ+YZ{?Br zT$fwW{U8>hm7anTJvY`EJ9m^sE3ux3?W)sQ$4A;qhmo3X73cCsH`*$n$Hd0MJtP{% zOy6t5$v=5k^Jo$Tv&!&wfuWs-!D^pwypNyAsK1;J+?^#`B^D6bJ zXF|w4jaNj-Co%Ge#`+g2QaK|8LeGa7myu6B=eWC+7~v@QTZfa{ zb^CXaf0-pt%@|&q5s;$8!o|J3-Z7P?r!wUo6gL+$H}@9HI%&TDhYXU-!!+gYWx zr!)E$(iK~yc#29&N)q*w7os)yh^0QGdMX?Pyl*g0VIj?3wZcXJC@D5F06_L@A!4Bn zuB+eATXqp?IprAsxuz+I4QG%TBz({)sQ4uV1tvuWCVdvKh73(ik^`!Xch29u$qb}P ze>gjaBOx>DP?+3VS6{Kax>_zWSvVm2T39fxq-NE~^RRn5(-|gxSLZJsrk=a(oAI-L!VcJ2nWy00 zYN;shY_%dO+FuIpL`QwOua{IA)3b7N&^56)F)?9`bOOO4Hx){)=Uy)j-o}Sfx-0CD z)E@glJN|QK+RQ#Au{mr#?&8Tk`k+2PwCZh(;%OvH7@2O3Bx2f$LUoV7g3J$OK8Dj# zO2V}K`{(d%_0Wfq@U-t8)o+oqxlCt7dZDh{%sZ)MDCZ29ZLgL7J>4b>!23E6kJuGr z!KY7k`?56HUn83YBRvK8Q@bX6e}27Sqwwj~udicJr7I?M#bq*CGRPfc1!m2kz#j3GW@9Kw+@;9ItUBOt0!z84TCbS-#j_4q9M+riy zgD-G6q__Uk%F}NpAv*r{o9bP)urHH*@hf1v*b&m5eNeP?kt#;IWziOeO3um)zFSgGarRo&YS>(biYY2Pl?Jj(NFKc_!!+20=cicl}>Mtdh!cYdQQ{@P+OeeOf>_&wRpE z^7Q#$4?Rreao8UU;^CHviOurQA!bzS%eHkoM5*UkhBA3miJycx_Az)kooYn9axUFq z81OyZEE=5_pAKc*j_{TEj1mQxlB`7zv*HyO7{*mMmmopvh^a+mk_ zjNth}E@Lx7(jFW}5&F6AHMV3Jwtars+S&>grP83C-_1>Af1}_iU%h0g#A*g`L$I{K z(r|J%29xX(4NwW9q9=1-;rqLDR+A0Sfr$5J4t}nB)o6`{y%h@Sy=-~B)<*}s>GG*; z+COR_HI{pv1O<#bR++>~f$V_^2?B(aF+%5f{nw6#opuPZY9qV|$w!}3np}XO?64tc zyY>Dvb>SPl=^1n5&;HFpUezt*+AZwag3l2>ti~!SOgY6;|9wq@f?{n>`@HLID#Uu-)FXewP$NjL%@Q0g5*=qs2)m1;H zr6h5QCpB`Mhlugj&cx;)8@z38EUcd~|LB7gVJsS9>;`RvMb4XU0c3nI(E*v6ne4L2 z($Z4>#vmHh&e3hHH6G7u$a^;#5#Q_P)am zHN05p&Gf3~xP}RGKZkcSgny`{>uw@j2r(3`IV6h9i0i? zd%V2kSa_(A7Q$;-Vmak?G>u0)AX>B`|g1u3^Ry?XH~U5pbYV_3+B zdRaD;%rawheqNs31OuWc5vbuDBcgymBsBcGlbqg(Tn!0WV4%=!ucw9HpBmS+uZ*-sNhM3igy94u9@@-@7zYsu9K0H>JUov;E<(WpZhiWUo9;n> zUc%+uNWEyu$On-T5u%Z)?oNlBTsIgMhsy1n$Et-vKuO443ZxLEc?vvlsXwpCv_BVA zoC78Cp%O-de8Ub(1B39lXU;d~Cnioox(a92`ama5roy%P2x^-7Kz?fe0>lIG=FNKY z!Ge7j<*&bIJ9L7+081V$wTZlmVPRqE%d+3u8IrI?8|D*e<>8-%^c&QH@ZsL^?q(l4 zNP^sH^|7+Doopve#IZW%tNkrf_e(d#_+2wq3-nt)#^yd9kRI&+DByYow@%W+3sOL% zR0PU$(h%}CAMa6W66Cn_0zXgBkTl-ci^U{bC6=L3!Ef5hqK*4rLhgX~rB54;R#u$N zln`Nr3dF_2qUmP~AqE5%cl(ClZLYA_k}H@{lBMcC*1xdf4&wMZ+`wE{a&t|%R&PN; z0pF|NFCf{!)R~ZP<8ut7=F%v!R3OPV?1-!NzOlbrO;GQ5+u{l)&bTLSUZkU;A!Ve( zG5oHa(15JiO4-VM<8P3z#X}hqTQh3MK&Ym+usq%lVmFW~*;^f>a{I=pRe6x1lGnWf zf01zPXwoK0L{OTf40AzzYdLS)tf4~cje+cVcnLa_SGo}Y3ug&Zi-96F*3|h$iiI)V zCFOisBT_OyJx#lG^~Q~;kd1QdxlXge!q5+RL@Z(wpyLb_EMTQ>T5j8A^+d57M&hDP zFt=%_kVt-5xs&LWcaq*4b(dNFuBSf!Eo#q=LZ!^z*D>v8(|bBD=PF#H1b31g|5BDO z9{&nP^?%+<05Gc*st1IGF(C{J3~Gg@3^~+U)QJZN%c7EvHBjq&4z8&tO@OW<)|DjL zCFP#>M5;+HY;lGB#TCrh7#0m^OLJ`MR;L zvtnEyy?7<_ zN@Vp=1~SzhH_>hM$H3J`+{VX8XBsUoUA)*MB{4rfE?f2*v`cJ(5+;$3vZGBzmD{#g z*{@IUuFpVzf*uD=LGTv`d;4R^rsOU=+OQ_l0?YUhJ&PK>No49X)aw7BI z-Ca#p^(MW{9mqW(k||*&-j}eBVw|^BM#}B=%%(~RG5;d_9sUBNt|Wu@=(&_H|6pX` zmA-HQ|<)8tzEvXHAEg{~q26{_nrBO|_H!jxDzT z>9_s2xW4Tvzvcfm^qar)Pd{E+zJs-r(QBLpGN|KOW z-JE?+Dc}mnpoyB~Be?WN*8ZuNpvw*%xr2BM9W&!1ZDl*%A8wd~)sqQ49l?c&*BO7e zg5kGc^CjnpH+l-*S+CQUx6W{VbY)Z(-UXf9hH`XD<@fQd7y$wMf6neNXpj027prS< zTMIr9uV5+VKX3+`lS=518wc%}0J3L7^&ZcjVT7K#KYa?oE3o76(1nO*#d!@uzv3op zx{AeLZ(EQU=@^>Eu1l8<2v6Yz&bc3NDzdKlnr{7l^#(??{n*#X^&7Odad0OOKU8>P zBMaL)?J{VuKIVQGf*m1WPfzc#ZLvaEY;-=t4XCD*4*o$IXE$*k=iB?Q4Gnaz=P1=4 zpM27-F1EbY{h6!>Xk$qP@xNRzV1trPA4$u192^fKh6tbi=;S))k3}LVl>?plvCKoXD&M&9L?`}22ML5Gr-X=C|_T%sbNx_H%eDXZ#NfS!Nz?9 z3f-W_gM*XpYes<`q`=3Jye6KG^qs=7(_52jn*RH)3+P*<`c`^ioeq~%{{*gH zC|W1dZHz254Rsx6)eQMADD0nh@tHo#VJPA<^x1{OpivG~a}4Ec*J$yz*k&dxVc3S1 zwd&2IivlHSf??gS-B!wWZ#*9k*$;PQwcQ{h8w= zB%w|34(Fz-_qP}+ZQY%0{I*Y#w*A1YzZB?m)3D=_v6Rsdaiwf1XjaRPTjW2-W%Nf1 zoy!gw_2_+qzO$RpB%JZ9i*2EOnAX4n=RFaBAi*AMC+-OfZIg2+Y@JGLN5b7PP>fw= zv)j)at!q^~aC_I2Z~etvh%;|UqxAXw^VUU|KQF}`5s9}C56*;i8E9Y=BPR6kR2&m_ z&f4z|4VBxdiD5#;8V+s5I+q4-cnK+v5R6o)NjpS)AWdW9dwPmycI9CV)_Do_W=ys6G1d ze4**SV4PHwB#*58F&}2|_2O#D665-8Ro4&JJ2FuL-7mP}YepJDzuh%zi?%w}nUUJ$ z!x#*;MR-<=D`lm1chmZpeE#WLMTvv6;!z%)`|#|^ihF{r9C(POfd=uXu=R$R8KJe+ z0G^g__Y?nFd}EN+?QGBE{Jz2K7*_M26-EE@<%GQ(98PQ~qr3eCrbG=1H7*N!O?-}9 zPFlyoSgw+LS}sYVLkLPCRA&R?a+hKDGY7rU?KCwqiufopZ%~Soa5ys9F>y);K{mp# z+=4cT;_UdUbL|*B|3Hz&=;TUsV=&#Q5>I11m)Ssf-?l#q+HxRKv9Y$622KS$pSpeO zKHYGW6PiAn-;wMlacv|Y4h}2z%Ez_JM#U?h)!R2Q`&&!l<`F!$SqD6T=Z5POg9^=u zdjWOdWLDi+8sy^OkiZ=t8rs`jV5N%Uu?;gKM!$ZYQ@Gp*#3fb`Gh95DxaC_oq zVA-AUUk5tg_w4yma-J=vh)e)apc-)~W4^n&D&9ru)ZuUb94@m}qT+eI81eyF7$BtT zA3vUiy)ZB!A||GBi;m`UIoc(%zd&4+n;R4@FV475Uu{)QQbyx?&?D)$vp7aeYF0DPyRp`rJ5zTx}#v11S! z5<&pO>qa_vyn{J7~AV_<+E;qq7W2&s@*xYOaX&N$fPj|{|Ymd=MeGW{AnGJMR z%2Z`$w{zTYpla$&Sk{#ZV{!v}!^TYfP_OCwU9O0&)#B*RmcgQxK%nl=E) z>8dLVB_&Gf4eP$_PU&Dc&{YjHGBIJ~Wb6v^oT&4&02Y-IJH*ibd`-3vF2-T_^F@Sm zk$Hs|j0DPY%T$G!IrfA7xXhA(@9!Omb6NgRAVESra=V z65r~nE-{CQ$f0+Be;4%PYZRE{v%e(k!N#&Ji>AMPmwn||j$D$$&$Jpo+vU&my0;^9 zELkH;Y!-R}fwSd^Ar-}t4Cp@ucKc9l-;@jFPMsNFJ**!)*j=Yl^|*YSg>T~b?>k*f z0|mhz7cX7voo{$?9L+5zmy?@oytdK|5L8z^S7vZ5$)CT%W}$F0*jMEIJfRfnuheOI z;ow4}E}^U}<(#$o9uqcg3k%lu;?h!8H8og}`GBzpyywIhfhD-o4Rwa-D+Z9=x|I+h zSTaD}U)#0r!H=NvC>Ra^z9fIj>G!wCZjPejk;*iXe!7>QNCYL{AZY_!aixX zF5sT=d(1Vl`QBnEH=pbNL){rF>=#P_KbpDN45fPWJxh}nDzq3yPcpWs`~%OMcCUc2-LU>u+O@%4y>yA@isey)57F|DGeJSo%};do61rG4N=-Qs z1mygbUE*O(qDK0m-+OxxbzOS$uVL0WrgBsZjA^9B9D!UAXx_pQv8ac5!NND*4hoSp z3eD#Tot!3kgX(U3xwqO8-!S{@Yn4Bz-zDvRusvKn_!nIruRfw9@*~|( ze-PJpHBIUk)kEs8C~liiD0C-l6@H0ryH=ct^Ykn5=jhb^LULOx`-!MGdJdVa{*F<& zDdyJt`Jvp>mxZB{JbbALw%U;q%{0*{;+|1~M~*TPVIP31H(Q&Uex{CKxX;N#z}y82 zNuYOdS-QpWy{nkJtwv(yO{+(TSMKr| ziFgT#mO*-HG7a*_GU~u7TD^zXsdG4B;BgWgQ9J<&fsBbSD^6KxqufYTOr%p?#a6vzzlTe6DV(?e9;7)XEIa ziC;MrJAVi_$Q}Np^!@)fLjI8}|0e|hho=F;_{&$o75NVt`=33Pc=Rpu7%0Cu<#_*i zBTqUkSW@%<{X6>_#>_wrS&a=7Pnk&w1>^)aZDw01nFR>K;am7q}$LYc0anVE^n?VC4Q+@OWxbCY>~eOnKL zdfrA_^GuoTN|vkW!CZ1ocX~vztH9)*O*^OqP?P${ zL-tUgVLaf1_5Oznk^NAnHMM)--YPBYu?9$#eCS6KXzn{4I)Au0QiM}}d2cefmD64? z*bB;0+sFGsg&o&qm2T`?{w8@)08w-y*+&K;ipz zzmjw_nr%I^>?rj)I<9BWR^=!WS|)^In)g9tOgpLyzlniSXJff7xRxC=szpFVLedKY z#9g_hlqi>6zXHptH0^4SDtTlY8~(+MH#R8V*j~Y`aZ_bmtX=9&5GCAn{eHdwEU(i} z1Kz}|y^Xnvdg%)nE=(q0()C4!2pEWqixUIQmz7MZjUDQSaf93~Q5Hw3!>h5(YO-)Y z?YByNSYhR~4I4Fscgzj+jw(9kXk`cTasg^6&tPS3in04xNiFAPqQp?CO_^5J(ZBfT zGRUOKNu zfS{4crtt&UBPZgE1OdulU%V}^f#Z^wf@7EiMebA=s#d3A-(@H z!CTN?PlokeU$)~KJ2j$9!cHBLmu<2NzaqCl;=BD{FSGXk6b$oG{n$C6zz#C~qzzbX zJg#9XD{T|-3+#n_Z_Q0lzn*R(-rN<8043FZpbpk~PqWMP6`Ya&=<4S1Yz~v&mYyC3 z(mUKHy-b@Cg7zhOxw+on-Y(k6kt*^y+Skk0ovyfpv-WrMt!`L8A-Tg`A8R;NoWqak z(N6r-U9U~MS51c)EsM;e*gO4s^-oDu)kt|cSA(vBvyz*=J9m zg7W=H^A7}~jt=`4G?e}{N=Y-^{;-#hmFW{g$_!^7avT=Vt8dLGY#rQuV@-+~=oizn zBiU+M!$>15ZR?3fNHr#1cV{?`dXJ?vNp7<5NBZoccsceF0{4O4uDa-Xul&Fbym-9o zRlU8uQR;|Cq7|*OJ)S>Lw3z<6%8Ew9bz$o{{~qc>gd_oSwkIm#l_(= zCBKIEBr4^0qPQjjcSc2|XZB}`&Xar&vR-f3+(QlRE=Y3wo%D0q#F2Zu!;r|1pfkM4HXHhmr_jYUEyQJvgR&i+SVi| z#Yfj0Y=$A0?7tY{31GE+pUl&!aA4K}v8lz6kfQL$F!)20_H8KtbI;4eWkmpk8tZ9h z@P+1k(vzK$e{9BIfzFKW=?BvVl$6**tGMS&c(@YKll7_nuVClGa-JNArBA|8h6N5c z8cG)-+OYLn8H7Ym_{H@n){RW6&*B@UsD;$9I z^#(NH3)$WSe=o3AiCWD^kG`m1#={GD4QEoJbOYnFGqlHFy!eTA{3&H?ZOhxr2Qd1C zMgW;*qLTc?0m^3Y@)7s){xcFM=UNzlsR;{`&$ZVhs1Y#&$5d{Bm-5GoPX7il%GCaTkxky(Xsp;iLW%xgV+Z<8JpL~GDuu0cDQ zGm;@$Dyj{7Zul-+{RURkEndF94pDSuE&_Y2pLyba4zlshS~R$nM=ua~(YF5uJzcf2 z@$vBkDs;q2P0%ddo1bvE3?}(NtjisW*AmHhr5s=Z&BKj^u?_>SodCwEq|mY1 z9|qxtB{!Yuf*w$vD8mv&n0cSeM9iug#|(J4Z{HSWCGHl|Rn>=Xm$-4*-H7e&?=h0V zIyYB~p=oSZGLWk$UUHY3dSh8bU~{Y*Yfs+k&&z_r2=W5kvnDLNCC73oYK6_u$uX9r zKYvzLYQ9{bX3n<4?M_Mgn7;33#(2E2k+5D_wdfeJl6A5nK1BC?YO|2KopwJX@mx{}IcPc!4tHxPf(7<&+d!;N!b3d-W<3*b9-z=bm zWKqrkRYP}iiq=g~RPX6vl;Hq)Cm=6G^Vlwz+poKeF zynv_>a*Yxcl{XTH5!Dhj4P2J%FIb(42R@c9-rdo6PODupY}h z-dpzWG#?b+NBNaS3{CMpKB)PpMc?v9QSESHe_3*n|5UIk3BvoXXJ9xAFr`s;LIbkq3gb z&Jp*G^~`rSjL~j|pdzbI27BOrLp6Sj1NYg?tSx8;gDyk?Ub9uw+A-+s0$Xo@Pi#y< z19*GKs6yT)PFj(zBAY$1PLxMa^z}tV<+1trJ$icV6gAe9B9Tl?Oe3<$CVe$)3TBUG;^6%o4o>!@`_IO-C z(`M%8ELQ%+I#fzjRPh-Z8JA!y0CXmah=@ks;v|q-Yy~@>I(5ooPR_}~B5HJmj$k(% zZ|*sWNYst_6&s+}-F+VS{%JQ*>C1&qz9ZbPet&@$;}jU7fT=;P>3(5qstyaq=lWe) zaAN~aN_#9^?`NqnogowZ&Rft%rNY5)4mDI{;aXta19lc&BO_umvRGUK*xAzD2z(Km z)gRKWX4*oD*Jj#B3(eH*H^RNELF^hXwF%yD3L8vQNcS^u;B)!B(SjVIP~T5nRu%#t*Y4NQ6f-YgouvT+p8K5ppP6{o=?Ij#vZz$o~O^Of&r_3 zkx8Fs7^_+!s6~og&fsGJ;U_a=sWq~w`!m?Q!-*$j{n}ovE^1muy@f6;5Mju&Lz@fH z25p~rq3xZmS&=llcHbfW?8oOXS^;oTM5jRv~LZN-_WSn||9EN;VYeg71*NM#^Sf=Q{Ni9C9Th zg!km0{7D>_SyRv?K7IPM+q-vq6Rooz>gwv{EsM*`EO|z6VN+QI3xe}_SNaT0uh4{y z=8?<(5|>#Ups=Z?(B|ri(o$o6{jD~suyZ)Dzb2Q0CiKRQ8%s+|>y30V4I*Ir(p3|q z)#Wkz{%%x{DnmY1)-wHd@J)=+Oo(4Cbo61Co9g1c+>0y9P3h=T;m`qT~X@YThdb~33K%Sgh2n}cO(kC{Ba zNbHT-;1-4iY#ZsOq>Ubd@^QuwZg>lN;B%rT88$JY1O5GtB=ajYuAzm6g=yDy9DCfKcA+jZ$HHLeU z!X6pMs-?-}|K#l1vrWyy%g36qON)Y)`=B1@jvu+Av4wy_TB^Mj-t!Vmy?)$IRT1;t z9O8v>%khQmDn)kaC=Yyo=6(ISPnt?zFXSQ#rUOm_MukQ?-ALAZ_e5x^g|ju*SJ&2z zM=RZU)gf@e4v`&`XVj(dxV_B&kzzN`vDF5*QwP~ZD+y2EgX=4iLeLCpOvs|AKK8vj zh_I8a&mX*>40v*RU~sU=sB1cOLPkv5)zYp%qttQ=&g*=+?G|f~YL@!Le$`;27(hL@ z{Hnn-_bD>cM5&^@99(h?w;ku#ALmx|ebp8ukBJoGn#8&>53E{06~JB@yo(nhCL_u< z6Ru;hTL-FUWHj{vqqr>enjM|N3B*mbwhRZo7o-YFVHp zH?a{=iw;!xG?QFXONHZ6s>+T@bfA!UCG0B@c`&E@M6(Fi18w?!*d0?KhKr`pDY9MB z{NIBB?2Mf+aLt72TO=Fae29cjpqjUo@`V{8^w6?Jd*j-jLGO|9s zr=$i1I7aWivfXbzFtvlBtK45M18z<&%^v|ioVVo+aHjT_mPJs0;XWi9@RFG3!AoJ* zmsK(6UNxJoFi4X{>_spfEL(wx))!HW&=&f#UL6=^Qd zE;tI4W587y&ux0pm%T>X#fYWX>y}SSY%{m3l-Y#=-}K%USRfl0V2QhukW(LR2y%ETczR=2i39Ds*V5q9!GD!&R1Vc+VS^P(58O6v$l zKRr+D{qgtHlD*02-WD^EtaEgP?GuBQko}9liY%(|fjq;GuDCUa79`vlX@vz*pwgq9r8>Wu%z5Mh1e(V!U1H>-jKJT0&5&a z@!ID)bQu2n8fzLb7h?)sLOv#=Dq|4%de7Z6Qx`u)L|}JDkxlKO4dQQGLQgt&e6?|6 zCg`1kl6%J7BIouXBQXC%)gNZYp+1(IoxQ6&U+LPT`DeDzy^$vS)LUNi43vKeKdM1( zi`3Tf3Br*@?kYC}gO^cn@ugjrjgr9sFn1RbL(5-PDPX+Cr6hEN*QDE6Jo`=a#rEKx z&{GXhPq0GVUUEA0LzWr(QXg`F+WD)KOP;7XE zF184YF>_y^X#RX#XPUcoRi&sPc0jV@lvgl6x-U6Cgu03o-m3c^Rqn6}k{VgkpMAk3 z?`lt;fVND6VLdBbBk}gp+Zy5$JAFh-83k*-^<$|t-w%4>LxIZ^ufWc8Gqt$EbY+pw zX1wO&X4G$hS9RM+5|@NmgY89|XgmFWXBQKAx5zdcxPNa4dIHauxyjVRf>bJo|8TNV zZfPEt`{yW)&gPY#!9hBDPf}sxhltC(l1`Ps#`liLzy4HNiSIbM;v*!<%nJEWfCl^9 zg0k#Zkb^h1&P6t%tgWnWKeP-4JnS{vop}P}wR~kZ zl+%6V$2{6|A#2M7aWQLZXJAl;{Hp^4WqM4ruVA2`@xd_@IyKC-W6Q&i8JU>{cgk%R zwjj5{B<*aC-&+;?u@rpYK*>WQ+g_BhI;VCBF)%!#1OxuY7l~Dpn3$QTMwP&`UI7NO z<{I!Clk+)b_-)VkFy8+YGjrqmbzb9cLuSPOHu*h(hLG`6QApmM8Gh$I>*XQ)@fy+R z&pqlF-7&%qrJ&`I^cMwhs7FhI$_`lcCafgB&)w5s9=m}m%+mb%o_1VeOGsTUh=s6a zjz0Z95ZdBmJI-5#gbUEIVh10%Raa6g17ga)vB~Gnn@5`)Q_#P${$RhgJiOhW<0&1} z4@KRxh1Z}BN!$-M$&E}V*V&)iPUPkT0o8K_EOP<|JAL8GA4{_47B}yC41?zcr=b{~ z(zFV6U_Py7RTjIWlFZiDHUecmy9$V3mJoyMh_GG!m71jY!n*jlTRF9+&+) z6J-;w=`8eFeB?9mvJTL$$H;$4Gxx=e8N; zmOQ%m(8|VPdx~UHD^#x?>q+m!wvFeA-Pq*O^m&Oc5kL?a%#yZZMekNTK^lX3;ib)7 zXYGq!K*eD%#E**Cz9=dx5|HtBZ&5H1#)^Gn4Zg(e-TW;fVG*5n08l&# z$YbX~XyTZG+1GRFLKnLppK`M=eZ9o6&FLv>GH3f_3cqtX+31Lfa^#Nn;gkXcWSUpXh?P8qJ(V99y#l}vKl$_gk^=ml4M3lZBEPaYCubw&R!+V*c(j} zKf!|PpP*YOsx2)p>Uzkt%maY}9r@?VrQk*I!3OLFMtA=nE^`4rB}l^cbp*&huU4JK z#hWL|d&H--6H~pav1==>yUcQG{#Q;FtpH13ZS9mE0VC(mZVU?jj#gsA5wVGoCiq!D z7Id?3Hxm-*36H|F;FVWAmXj&mCMlC$0A9GEBLH!1vfy&fQgz@mIe#3~-yqE(Z5X~8 zS694RFl6gp)_ZGdYh#+s5zABvehO^*kO6JB81J}&w5e#z;VDQEumIrq1F^&Qa)o}Y>Je|JDsqI6 z$ky34WMTfNpxj|V`(@vN9VPNTq)$hEtl;Gn%N{WeqQ?Nw%(PA{U8Ma&L|}UAaSBD? zhw)dE2CR{BS!sttMEs1-x5f|eJ(v`gkcm64-6_y02X(fxjNosj`;3zJC*#xK-md+f z&+!OKosQM%&0Vgngh3B7{{7^k!S#jVXOesyT!*SdO9RUyC&jD55Ni*l9ABQ;y_`*R z{8I3YPK$cq_Nx8bJ+D!$T@tK^XX;{$Z7B7}q{*so+KQ**FEMB-k5=;>Y*D#jU6bHq z#J`PcKjvp{ZTnzLeKlFJ1eKFfCi%P%wq?|Z^3TW|j^`>y)7`|acVD%|emf3mHM8K! z;j?#{FKvC&Pw^NdZC~=*jsJaVp1k0rUKSp+}=yT$={2#v`S&E9b zLk&Wb$6O&KyiH2FuGt{ie2LfPGd*K97&iZLK9-w6zkWpNO43tBuTi`cnW@VV+tgUw zn9J*KAtoXsCnRiUC4E%-OPiim#V8a1hRXfd6sL{6!^3SwL=5-v3U}Uv#t3#)wB5?( z$_)6r3mPUSUQYJD)b*)CGuKt|^MPBCzVDfZ#Zso%uUrt}0S9@GLHkJ2pC=oNN{%y9 z$>0XZdc$_=#<9B8CYql0Q4PhL{FM{!=wh|J%cbXvL8I4K3kUCt=Ze2tJ+vjnJbwHg zDy=mC^6%d-w6*_)fd%lbTcUXQ(Ww4>RM}bxIlyY{x9gxU+zAe1j^$E7gQ40CnyZ7e z)m*tHxZgI!-&VQ4F$5X|X(G)i{#a|;tR|K>%=9JrZ_yu*##bXPD#5020b-@PhDJ|u zKzl2ALcrnt8=Ul5-@Om)2R8Mnn#k8FBkUe{=-X4w?N-Xi-?Hu<+Wdv*BpR0*Y^aD`$Wah#rAS!(wusDny;SMt;fKLR#aD`cscKz(h8Z-4_^TJV+7tsU%9U!k3Rg#LIdZNB$fh*3j=d9SV-zP3^?Bcf~sOZE#IdnkJJ7 zl7q#(_Q{_5-(NdnL&ou1^A#-9_aB$hY)aUOi;JtMaE6@#gv3Uj30|h+jqgqAn3Y${ zOy5K3iJAA9caHy@{hXU~i29EPjSWQxWH26QGVRpI49zXk@<#3alCd-nGB zvfjV|Hl^1rFMe$-r*aJ2Qtj>3m6Y_-rOnw6pMwnB;ETqZ9YB$9=s@cLK`pSyZr<_F z_*sQ&!c&1L+#$eu#Lb=2J>p`#yLRIfSJ4$vEyKe3Ge;+BK>!3YUU{@%W>^XUu#v)hjMxu4mqrjdoFi!B@ z2mqB5H$ak3(rEoaRS(wyqhdPwb=gd;z6Lr|`3|^hstu834=uZghSbaEr>3Gn$g8QT z5;NOc><6Z50u&RLGXP_iqM_r81}ZT=Yy#WKMoEY{9DxqEI8reKx&Z5t)h_@y08CfO z;aemAS8rb)4|Uu2U6kEeQF2D>ytO$WkT$?GYi4vXV!7yDY!DC&5hsWLd5e?cySh}drh69)?z*!ok^(+R9(hrI-W8!>Sx$STsnO0^(C zcVv)}!Nx(vWn>vvBye;5HsIM>F9JkGf)DNyxbXi2X@NSV!Ss9K%>;A>-_~2U`6xLS z+9rWw>V7O7yo%EreSr?#sbVPt-~~DleCgoN;);E-t8bM?c@ppL0a*K~+T_trZ-xwA zsLVBEb}W57!Cj}vUGoy8HGxQia}OqT6>Dm)!Syt>Nyg7vzcWAw7!@SmcXf3Yeb6=u zrfaU{Drvbp>lRQ`s~An@KJRN=2LMTY8~nU}LXwhp4hCj#$Hp$a-XZjCafr&Qsw53y z%7l8%*`E+%)RsR0@(>JGwAHDzr8lWr0)iJ(u^YiJSR`EtE-$yHef_}Y%j-*u>40CZ z8o{~y1X_yKG1B-&AGRDLAT?pLIZV$B27W-*QHN}vz#83!>X;U^a|5_adw-47-y0ly zK4+@m*Pdl=FnwO!0JIZ$=#u|;%!G$)!M;^%5pI%efylY0+lHrWYTYJ+{G>I2f4JBI}>_Hv!#o-8sifOUv`=+%Mr@lCYT2 zIDTRf7Zd9N-czo7W%>^cBzQaN)5F*XAjk;!9NCeSm510I2{%_mzzm@;?DQG29tvEV{QnV*_B!E0@vLxYM$6 zr+4`s$o{l@ooXIV*RRjus&u*y^3H4p1}^0(;LQL2nSe*N%P5AD@;=o6S;ev9on^fR zG!-@V+H&>5>$Fao5ne4N5&y%l1>As*MP4OMok!D2i=g?jRE*?^1%oE|1!h!R#aA6HU_*~ zJA8p{2XS>H&8PGYx;8Mg!xn@-5;q67s8>sGlcnb; zg73M?Z)41@q@;x8zUjHLAke7P?i?;Wzio12c&F*1gFyLa-b&EJ zQ?Vk3cCqDZu{9zjc9}KNMp;o5W@<%aX)q9x2Hywz`+Mcc7c$;=;Fg%11;-u;#iGM)g7>L4a=Qs|CeEPllAx2= zM&cV}CUv~3X%Nuoq@<(?s`YBgFR70neOg|2!}xA#Df?j{FZR!ChSm3C@=lBLy{W-c z7pUah?U;yz?-d#>6%~~jJguY?7ZjPkpI|iq{P|8D9_))3FG#NC?9in7J%ztfe{&#H zygeBxH-*($|{Z-d1gD9IZVp*gc=8VgLGr zoLB>8PfyR9dIM^4Pi zlPIe1Tf^>Zyz2aAmWbo5tWSZpShY#{=iT&hV~~s$Ve9wns&K$%R_ourWmQR>~-DpNY-y}H`7m(qraQP00tWW>{g%Q3R4Vt#hE2HtX_ zT?8}pMI$4&PK=3(c$`KusO&wkW8W=>7W%8Na5n*l7a2z?tV(fYXnwL z=t?yHkQN{R_b0)F4KqOevytI@|Nnk)HnON_zT?41b_LyrV8yfO?I2zvYK_W|AI03s z0@%q>u+w?4gzfI2t{X7no76^K??-$tY( z&v*Bca7|4*I%ekNB(KVK^0C$-hI9Hx2=WZ1wP0J>>X)0Pz@?8Rb-Q=2ug9ER9aB8~ zNQOGjDY!7uV;@0;h+YyvsW*d>zQS{+B$G@{{mVRPv4JIg^yg*!am&C-=JePC2Z%UL zA@D;CNn2I}J9h8lnXo7Nj*gEOPef>GNvWzncx;VsQ=aVKI-tK+E8F0>4v~x+E1i>Y zV0w~x?W_O1P{|g?Zfj0LHVQ!Cg{FlOfyYS>I>cb58h7Rjp`l3s0saT5cA$sD;x`r)!HQAe znX&VVMns68pVja;`{5S&@P9)a!)dOwv%L-W2*y(9!7TE_bL6O+E4Q4Y2@wwOpZ~g& zh1rs;dz-Pce>N*U0Gd=ywxP~@?7@3$hK{l zjwiOp#GHfS$X5_^KFcyE%O19z^%b-gT>aTP<<{2L&=#tI(dr`Im-bjs^^Dxyb3~a| zze&+wn+}hBb`JLLDHhEdOKgn^CRnp}Y5*aYn)S=T>A+{7E) zE_T%hE6pzFqjBw9!EZyT_(nMsG#$Uu;)+~>YNJ&hDy*pVpc!<4Q4KokG^Ka?Z+uO+L z0;^iJ>6m(Oae)_^Su_z`gn8CEvsK}V6#~JuUgyy zVlHSKe^O$Kalq&SUX3X~G6R)b z=nK_plJ)sfhS@7@k58}epT+s%Xf@uz0C4F5&<$WLt`{TcNO%}1`j5D<3qzBI zfnqq}H**@g0g(c_)6LDzph-wa(yP3%wU`Ai>T}7J;lg1lGG3$A#kwU8b#;DEN(z}l zxtVg<1rW%qd77P_-O^I_EcPm-B_j~3M8q`1MVHo|y7el7aB6d5SCt=I)=}EHQviUC zTjO?42$DsL!wroqGg5hBi~y0A)oYhaTIywheU~Jwj=yT>)w?z&VK2O;sXf`7A_jB+ zZZC%HBdeHW(VggHv%M*m&_oX~5n0>>@fu;1Ih{GVb*g95CU~LLI5+MN3p4ZYonNKb z?e{u{Ac6ynD}bIED&5~F+Z)~6-L2ugy1OI`(jG5aVxZzTpo3s`LA~kzq8WWe3VPwT z9MI%i)%)_&$f^^^`#U%~0)(N7JI`^|vm@@g$v&h!sQgBP?kPkbT0pzi=kX*_SD;;O zX=(X>W6*=(69E|UTis*1TVKSPPZm_)k!XZ!Q!wKWwTBZcn(DRuz4_a>Z{_8WS1>~+ zrA8QEXl|f-o;y3Rc8IhsKvd*@8L1!9ckyWAXBIlE$5HCLb~y z8X7!4pcH<0x~uiBK57L|O5O|AFuGavGf{_v*E7rA$dSUTH$z8 z$3e68N>XrvE)`f|DPyAwBW^65;4{id;8`!dC#Lk}YrO~e1(ONl0lQ*cdT3=#F<+J_UWo6vjA71XMFn(A|RKibNt~RG?dO;o_V^UQ3I4FBPfg z^cHRpHU(V>HA(M8RlI=(<6wD#_GBujSBaECp-`BR28bF! zs@B!Z6Sc$07YcznFjM>1UTs$St)i&d1c=6)TVrNdJR{2pRt_jnRHv>AO}zoC!3FH* zad3u(i;+b34?zZf_i^K4kX`7NQ&Jo>Xk4)XnO_iEEp-4Q7}C?zq3=w52CDNqUq8Re zwQRz*65`M$frT3*&m=!FW@Lz)i?$P>5tLgqrJbGdO?(;P38LP7Z)aE%a~ggasDY`D z5)>oYd`<@$pZQaBN{H4LeWm3jL zzZ;V0#N*VO4jUOl=3}M4DLsUl{P(8&{S45o2ktJs890(s%or5u6xpWZ$e#_TUw2+k zKwzkBa4Kv(B22Cc*>Xf)UVg%VsR2Zb0edSQq9(F%769|Ly;FPB+c-5TiS&FGK!qF< zU#fVOD5&Y_^G;*f>fK@Ly^J3EcH2;+Wbs=AX`SjSfJ8?mn0w<+H-VG{89f3f8!i_o z3jm@)EgaeeBidsn>@lj8uUCc)gEEdv{M2$`v%H?^_jf-&}T+B1())~Pws@#=7=Y?9v=M#@&l8`re_&M z1%AG|0U^0G)YZ3zFR_RLZ5x!wgDoW#OHC~fetubbd19N6n(>LuwtFNmM<1}~-du{; zAcI9bL@-N;iHWi4&CSl{=Lq$_sSp7P;Onxovh7_F+k2KGos+PWPoF+*Y{ce72|S=X zUfU{Te!Sy)4KS16n?ngx$q;NlyrMW96~X`*|5y#-;A%9!sFo7eal|*FTzszE*52Mk zWD}`^fRM6W-IRiT!7^IBfxp2?A+;%!u&}V@;8bWV3G+c`4+mCMDt{Ie*n+6Y2fZb{3^88u;$=iE1!e%_^6pLDCi*15!{Pjvqs+M9tPkEeyBWl z+OkXLh}PCKR#xq!V`GIa&;u3h_JBYY@y6s@%?;zX(2cE1^Hc>xI8sHxug?omr>^$2 zVrBEU{h&R9FOC8t`U}ck5&>JH#fJB zcv=b>XvZl}a>76>9QHu@P1b}PB>s)~YHD_Zj`~%oW44OV`#>>ao5sWr<rO%;l~2j9k0~M`Ur*jl5cG5BrTpF{G<2M0+W0Fvi0wE7`TC20(>I5j>sb0<912m zFJBSe=I*jt3LE+IF7dOSi9@E%&e;ZI#zsXL?i4EJ^_o{558{rG*HQ--HyCAHFf@ZYz=uyLCSS)l_CY_nTn<-X$#Gd|@*fFZ9T^rTyN5vmb(Q;)ixfLJ~mWk{1 zh@unv-Kf9If&n6p?)GgOP4mWvi+OjQYsaI)`LUzuVbbm}@syNHtdd&=bT8ar!$2{L zHm+CVNR#tR#Ui_XfU6h8kTq15mEG;+wKe|45ic#o8H;2G{t*06KGVXpI-{}}hNlA>;U^8G$nH_*bC7vFy@syIi zZjGFm7g@RN^FE*qvMVx>|2n11mm*^u%7pS{pw zyUo7<1S(4a&3bn3b0|91)bAPO(0M<7HJc+f*$LA^8q@DUXV2KQ5O<`(Z zfO_$%1iZ|us;cmT4GoDCfZ49L3BXEid!%Vk74>pcw6^6Kkg_)Ut_%i0pIJ>Vx4YtQ z1$fl3zBvOMTZmb+uSZGygEWqZIV?T4nAJdGVPR--kSE{AFtWilG%!H7+aeizq1EW$ zAd1C#MM5vN7;ngUEqT_FfT{ddvyFJMQvkoR0hYP3vB7Uvw7xk(R(3a+r;RTamGSqU zU0vW@WOt6jZqYQb?mF*x4`5Ebb4P>i1VF&wa`eVBN4zh8ITN%<#v2kC zvF#JtFhcm#<%jY0?gZMFOE7zpzwT!uHNY@%tOc>)?!F%v=XbF1_9rBJd;}5*S|f;&_?qVh%|`RS2KS?4)#)V$sf;Xl_8?y3Y?dE6 zIXM6@LYW`cHEnA?-qd&i#hUTKpPW$L6w!7(FwKX-{05MU)P?)X#``2)(K}O5l5Mn?ElPT$f zq2Gjl)%FZv_(`d7qyZ_36dW5H6Sl5DMR5)fs8Yd|I!Wt$Bb(qL$iP9v0YW7ZFz*7+ zMMO+YeQycOAfRXt4+pY_>a+|MB>;38!7%jL`GGV9Y$$?Nw3JRtz{GPzLzWCQ#j*Ey zKk(}5>4gSn^zqz)M1XbEoGiJrSFehpbbxV$m`IWzoy5)oM%86;n0CIzP;WrWgHYvA z`_1WBwzlUkzjleDucEemtBm&%1!(R5X14SD>6UO!@rxU~?`4-x)h7dM)%qD8=<*W= z-@1GNLc!%0wiYD=4x8Azx(filmC3n2<5%nqGiPP`o$VDq$d%9vk_%MDq-SjPI?>Zy z+<6p=E~ggIV2}YUcdHtSZo`nCZeLOK6w8Aiy7CK$i*eKC65CpAZ>nXS%OQmp&Nn(0 zESU*=YHZ-z>$607SLTDZoncJbhs$pOIAg=3U8+q%`(>L%UA7wS4A2nPGcgYVyywMG z0DvhB@)R}4z6g60j#(zgclmn;AoR2n!219CilbdQ-b{FAOeZk}Y7T&Ohtay0k+N?2 z_wP_su(EH$7Lt2#9zC+om-AcF^eA;zL#5U zRYQ>>DJsgx!=p)*_j0-)TI+72b#m{1l4Bi!uxMW&hY;m4?^2qX+}{Ic5o#RElQ!0+ruR$;d4_^+bl?d%6s|R0OmlR; z_#3o;SBJ5P<1HAE7H_GuOA;<(k{heJX+A%{)=;)>btat2V`gG%{~+p@(y6KfQ4ycv z>Vhy?sx*Y$colCtSo0y6M5##CeRsHN2QJ1&7=Fu2;ccQ&t>?0#mTc{@$udQo`pQ5& zQ@uMR`xr6cYZiVnr)HTp!Z{;3e!97(GvVdsDyJ2Qk>ETwNxV2ai@q^vKO|uJT40W& zAU&?BDHx`}u~#>*0}yD+(@au63feun>uc=~*dMHg#!g#J&L*5`mR^QZ$Qd7voceWS zn@7|!Ot0!X#3u82-M-zS0~j%ku!_^XqILn4=~@=&v*p7WpCjjfptKR5Jw_bSTM_C^ zVT{Ko#%r=kr`v158%V1~rtm&7?K?lK6RAFHPsZY#*NpIv7w10tW=SPRX(=2z4EqP} zQ>y_e@J!U8ULMy)rNuC362;BOMCdllaOpVr8;{oB620i&y+DRv9*s!mEHN#$mX|`S z$qW{n3-hYEGosZ{L?u33Z4LfiwSWq~;~GIF3R%}%P?S61s4s6Co3F#5%1SwMzv)oJ z^r(gj_K=iHX~=Laks?x2Y7D?Aj||UU^D3P+qU#dbSnfoZtR&U zPzZPTlv7}M!s(OnPp?AjNz$r~N^xuW{fNpq#MLz4NS(FRd)WB{6-&fMZkAlXdY&nF7@wO6TuXgtORC!vzmEW8{Imvj|K%worz}D8*sm_c!^jENyz<~p%jxt|E zj)q!Z=$2%|zgKgu&j@<0t9M}?E%5VlndzHbDT``AE@=gCWBr8bJi7WAw1H2kqKF?(=WgV$m&!JC}q3kku>di_lQ9JKE(91u73 z5u7$JxqpIc`th)Unx+Nhqb@+CSL`d`DOOM{((YGXqn)Oz^+LH(Q?Qd^_7b~(hu0z5 zHoG0;yX77)LyLFu>&b}fgVi%e)4;`vA|lhjzph(A_>IVq*N+D0ZHN3C*6d^9urJza&IWK|~= zk+=#DQ21qW?jM=!NX~lz;30mHZ>rM!90pM!d?p$d?FmMK^FPr7<|WT|Zh$=8I*7&P zbJ1v8@WI(|pg~;V*=DZ8k-thlyy&DrZpN)a! zrO-xWMQE*3*Sg{oj~8{@`1t7zDoUX1A_}c)=&=Sb=UwM5PTu-p3pH^?L~4Y{`d&54 z=a|7nU*CeCV}OVgJrixdkX57!hHMtp<{VQe^5# zec#jIeZZ0EluXD4ym}rL!vZBSz83KAcl_i@mM!NaAZ~-kg^6d4;0&Z_3^7mK9uZw< zm2mcQoeeQVtgN&RmqcFrhRNG4j_pieK&ve$$U8bXTzo1C^(}0xnFNf?XD<%S0}Y+` z>c))+{U$g&KQ5DOEyO#j@o{*in{9ICl|4uRq-C(RJ3!!2?hwA`%uD>N1euN ze@8_Pr*m>*p(Q-QX96-e8heri!zyZ9by;m|71lvslTJOvV?oQ$e-Kd)7ddHZ3vqx7P4<9Ddi4?}k^6BViXyqLO6rCWp1uhy|soM)*U{*v0EH!K{A645SN>HT*ejMDI z+}4piE8xTXek5VCVeP#vz_#A*?(qv(d!&y&BNeCeOSbZiJkNLX1jjh2UlXail=RM> zo2jlYgib6s_xj$%;XeE73xdivjKjOv+3Se%_r6?No3;@!e8;Cqh-y zTQP7NS5WUdzzV2PVP78@(5a3OCENI6K|@&Ep|d8WoZ z%;RDF69AeS#}2=T(g3C=3iCR&$f|ERuv=UF1F7e2iKd91RZj2k?Om;OdQki0yc^`O zm@&CK&Nsk?4h`0s7gKddNQJ01T9c61a{D!_n%}>-&N^8Nkx6ERM(|?*KK@Mw3`20B zHQ^ao;AM{I!#&ETVqXNjO`wrLUJBrA3EL*Y-=xs&7Q{sRW|-;r)2F2C-xd8CbQ2!z zl>vbe5KpAHHF)84mJoEI9KPBJ(~1mv3mo~DNkl{hCwpu8+ZeT%@gW=xN}K})ru^e! z1?yd?IO=U1Hpjd@+D~$F+>LL8mBp2IF7}^F5iM5>IYdcxR{wl^4icnulUfIPut&%l z+Q@D5;KBj0)_kQ3f_B^sz?Pa9e0VS#{Gl{_{@5f<;+e<7yIWfUTa(zDE)=J5#jz)> zCJZ+ncoNEy5Mq-KrD^Vsz3I_3ftxpfL0<$U4mdvD+rmve=l zp@W<{4@f4<)Rv*Xz0`8LyZ$``&!cSYJv`O>)&!oi7P9mN0Q#=%$=Y)tl@NvyQT0Y@ zB7ni|=nw!;EdU706#DkK)7x_uujD|h`y5+3f8~dc@7l;M&1hqU_gehjyM0@65wrM5 z*;Sw@4l>pd;u;&!qp8A>rTcVREVqD6-5J2w33Z8%>gG3+5F2)zi)+i#4M^|C^?@>= zEt7bSNrKNxedK114hvJWNc;N1Z{FhZ`Z^W*Ep%JSf|gAF33R6I z%Of@BW9nBvRxxPs?9C;E746MhGasqeRBPs>o5rv!PIf0(tBlGbC=S2+nMix_xPwSn zeg6?Pv#8q5Rlrkyd1VcC>X503Oe0W@9FzmC0hx}LLIXlqva;pxL0I#^G#I_|r86FU zq>eZRBsd;gTma<46G0$Kb0RwL?AZlGd|17aIUCcOo`AN>Lv75O?<*AV_Nl|LeF~!~ zoWT$7PYe1<-;9Xo=jU~|1?6lW@NuHyX$WaROZm{g(-Fpk(S(LlRv9hOfbpGF!NF8u z13j6=LttdLQ3XRGj_{m>Qs|X|E_4JXuPr>?1~f;o>#6a8>OAy60Gz}2(00=2Uh-R^ zzLO(z8_e_ofh~`E>kMDVJXAILoUCOmN3a#a;S03}f7jT^$o$wQmPH2CGmwgT-*oU6 zQQg|w+64&!Okt@Cbo2or0%76H##%eLSt76(s;grv-@Gvo2bjjB(gq~-{{d)w(ab^i z7IY;ZWKQ3fC-vtvQCOJQFc=Jp=rkw74?MZ57&d5koTs4zyWbHM5O9xyroP6D*KAYn zy9M$zc8Yh<^~BHed^kOJC!L62uqg&vjq5PxIzTM^h=3&LZ2?-SFbh9_Mh0g1DJUqA z+{U~_Hd+8&6K`~9AJzCIy7nT~SckQ4y?co-0X#8J-=GD-jLegil>B_&tTO|xcAV!w z_;psiE~HJS<|Y!of}ktoaHOv!5HSl0<=4MpwkaRnLo|O*7Xe(byYHiJlIqqeuU{~v z5~JHFQ6>Pm51JD}*({kt9JzV0ZafT0kP_#)b>;Z7g; zJ4D4Q4Qv7C=gf4H3!q^&9KPGNhisowj%~E8!F+<}26*`+USVL|MVxC}G&ssuvd(%A z*B;B2U<#nx!qDD-V99em8SBi5PQT98%B~E^92=jYIjbl-oLT13V>UY_#)GZAbop{l zw!BeO6Wub->?(IWX z3Gu4l)IxDAq$>Z$mnSJ%&73(Dfi{OFYRAJTMzWbh$n(oe>r+GbzOPY?>b1%G571jw zY7sD^Z1cWWyQ$I2N$_+wgMMors0&Y79%3|s3)j?)EJwDG>~1cVZb_FQfrqb0`<(*brECJ z0SNNkg1eX3P_pWita7CGX1*Ch=f@Q#sFi<^NQ{Mwo5PCE`_{H@K%hS;7MTDC9@G|@ z00KER#Bi}?)1BWe(>X2bfZotEGFHL5%3Y~)qD!JTbCeqkYQ#jIY3VUVBQoGpY4_AB zwW`sUbuLgw_{ui4lx329J1VLMzL};+met(wof>EG`eWT~w*=MB#PINUP&DjKjRy5h zsfnVd6BD6;v=Tt@R8B0MWI|r78SlYscoqZbvU78C9A>_LG>$pB0BNz&adBPmYkqH3 zdz1h+0gVGeu`A+??;jh3phzwKMw*1rl7Gt+RdXFwSZab2F;2Be>!|x5dU0HCe?B*y z>7P*wV5;TiCr_~K(1xd{Ha8Tn#j8Gf68pnr)~IL}L$(<@+?@Ug4bPWt0?B$Ww96Wo zfy3xh>X!qeityN%Hx+j+T8JU}2KQ6i3m};S!lPdBuW2g)(fQTi-+w(`_4`s2oxj?d zY&Y7~*T9~qJSBB5zD#udG>9C#pFh6L#Rb$+;HHHGWyfRJI&ie;>UX6z1rrH_tFEpIun3oVB zW*=JbCxd41BL{Ycd^j=Db>%PAI^NtI@s0+X+g^x$SXeMGvY3T;dG+W;!$?!{))vk) z(^}fy#FyftquZIyuDrw@@3vjtCmnYC8Y6u>G!dUDYqxgt3DS`+{%VHt3U~GH%8F zITy5m9}71jok<_J(725^vihSJ*Hf0?wkp^8ERDau)!}CO`e0{_=`YZpf)alF>}ABK ztwGt_4phe^%U9oy4@M+d9vlq`@evGBMZ0>c{4Ch-?1YSj3V0y#O}iA4-zc~ae_&<`o(Bfulf4>qtyi&Hx-^?lRmv52x;2VD(<#=<_ pe|=4O`+t4+|Ng7^!_~v1lA?Q~eRW?Rg9QJGmb$)LiOSV`{{^G -``` - - In case of multi-replica deployments, only one operator instance is running - the reconciliation loop. This operator is called the leader and is the only - one producing reconciliation logs. The other operator instances are waiting - with the following log: +### The CR doesn't have a status - ``` - leaderelection.go:248] attempting to acquire leader lease teleport/431e83f4.teleport.dev... - ``` +1. Check if the CR is in the same namespace as the operator. The operator only + watches for resource in its own namespace. +1. Check if the operator pods are running and healthy: + ```code + kubectl get pods -n "$OPERATOR_NAMESPACE"` + ``` +1. Check the operator logs: + ```code + $ kubectl logs deploy/ -n "$OPERATOR_NAMESPACE" + ``` + + + In case of multi-replica deployments, only one operator instance is running + the reconciliation loop. This operator is called the leader and is the only + one producing reconciliation logs. The other operator instances are waiting + with the following log: + + ``` + leaderelection.go:248] attempting to acquire leader lease teleport/431e83f4.teleport.dev... + ``` + + To diagnose reconciliation issues, you will have to inspect all pods to find + the one reconciling the resources. + - To diagnose reconciliation issues, you will have to inspect all pods to find - the one reconciling the resources. - +### I cannot delete the Kubernetes CR -If the Kubernetes resource has no status update and the operator does not produce -any logs regarding the resource, please check if the resource lives in the same -namespace as the operator. The operator only watches for resource in its own namespace. +The operator protects Kubernetes CRs from deletion with a finalizer. +It will not allow the CR to be deleted until the Teleport resource is deleted as +well, this is a safety to avoid leaving dangling resources and potentially grant +unintentional access. + +There might be some reasons causing Teleport to refuse a resource deletion, the +most frequent one is if another resource depends on it. For example: you cannot +delete a role if it is still assigned to a user. + +If this happens, the operator will report the error sent by Teleport in its log. + +To resolve this lock, you can either: +- resolve the dependency issue so the resource gets successfully deleted in + Teleport. In the role example, this would imply removing any mention of the + role from the various users who had it. +- patch the Kubernetes CR to remove the finalizers. This will tell Kubernetes to + stop waiting for the operator deletion and remove the CR. If you do this, the + CR will be removed but the Teleport resource will remain. The operator will + never attempt to remove it again. + + For example, if the role is named `my-role`: + + ```code + kubectl patch TeleportRole my-role -p '{"metadata":{"finalizers":null}}' --type=merge + ``` diff --git a/docs/pages/management/dynamic-resources.mdx b/docs/pages/management/dynamic-resources.mdx index 209856531eb08..bdaff0c841877 100644 --- a/docs/pages/management/dynamic-resources.mdx +++ b/docs/pages/management/dynamic-resources.mdx @@ -59,6 +59,10 @@ to manipulate cluster resources stored on the Auth Service backend. The design of Teleport's configuration interface makes it well suited for infrastructure-as-code and GitOps approaches. +You can get started with `tctl`, the Terraform Provider, and the Kubernetes +Operator by following +the ["Managing Users and Roles with IaC" guide](./dynamic-resources/user-and-role.mdx) + For more information on Teleport roles, including the `internal.logins` trait we use in these example roles, see the [Teleport Access Controls Reference](../access-controls/reference.mdx). @@ -211,6 +215,8 @@ Here are possible values of the `teleport.dev/origin` label: - `defaults` - `config-file` - `dynamic` +- `terraform` +- `kubernetes` When the Auth Service starts up, it looks up the values of static configuration fields that correspond to fields in dynamic configuration resources. If any of diff --git a/docs/pages/management/dynamic-resources/access-list.mdx b/docs/pages/management/dynamic-resources/access-list.mdx new file mode 100644 index 0000000000000..d5f0e4f97cf4c --- /dev/null +++ b/docs/pages/management/dynamic-resources/access-list.mdx @@ -0,0 +1,303 @@ +--- +title: Creating Access Lists with IaC +description: Use Infrastructure-as-Code tooling to create Teleport AccessLists. +--- + +Access Lists allow Teleport users to be granted long-term access to resources +managed within Teleport. With Access Lists, administrators can regularly audit and control membership to specific roles and +traits, which then tie easily back into Teleport's existing RBAC system. + +In this guide, we'll follow up on [the IaC users and roles guide]() +by allowing users with the `manager` role to grant the `support-engineer` role +to users meeting specific criteria. + +Please note that Access Lists can be managed via IaC but Access List memberships +cannot. The goal of Access Lists is to decentralize granting and reviewing +access. By allowing managers to grant access within specific guidelines and +automatically enforcing review, users can request common access rights without +having to go through the centralized team managing the Teleport IaC. +This reduces the load on the centralized IaC/security team, ensures the access +reviewer is aware of the context, reduces the request resolution time, and +ensures access grants are periodically reviewed. + +### Prerequisites + +To follow this guide, you must follow first [the basic users and roles IaC guide](). +We will reuse its users and roles for our Access List. + +## Step 1/3. Write manifests + +#### Write the privileged role manifest + +We will create a new role `support-engineer` that grants access to production +servers. The `engineer` role from the previous guide was only granting access to +`dev` and `staging` servers. + + + + + +Create the following `privileged-role.yaml` file: + +```yaml +kind: role +version: v7 +metadata: + name: support-engineer +spec: + allow: + logins: ['root', 'ubuntu', '{{internal.logins}}'] + node_labels: + 'env': ['production'] +``` + + + + +Create the following `privileged-role.yaml` file: + +```yaml +apiVersion: resources.teleport.dev/v5 +kind: TeleportRole +metadata: + name: support-engineer +spec: + allow: + logins: [ 'root', 'ubuntu', '{{internal.logins}}' ] + node_labels: + 'env': [ 'production' ] +``` + + +The role version is v5 because the Teleport Kubernetes Operator doesn't support +yet roles v6 and v7. + + + + + +Create the following `privileged-role.tf` file: + +```hcl +resource "teleport_role" "support-engineer" { + version = "v7" + metadata = { + name = "support-engineer" + } + + spec = { + allow = { + logins = ["root", "ubuntu", "{{internal.logins}}"] + node_labels = { + env = ["production"] + } + } + } +} +``` + + + + +#### Write the Access List manifest + +In this step we'll create an Access List that allows users with the `manager` +role such as `alice` to grant access to production to users with the `engineer` +role. + + + + +Create the following `accesslist.yaml` file: + +```yaml +version: v1 +kind: access_list +metadata: + name: support-engineers +spec: + title: "Production access for support engineers" + audit: + recurrence: + frequency: 6months + description: "Use this Access List to grant access to production to your engineers enrolled in the support rotation." + owners: + - description: "manager of NA support team" + name: alice + ownership_requires: + roles: + - manager + grants: + roles: + - support-engineer + membership_requires: + roles: + - engineer +``` + + + + +Create the following `accesslist.yaml` file: + +```yaml +apiVersion: resources.teleport.dev/v1 +kind: TeleportAccessList +metadata: + name: support-engineers +spec: + title: "Production access for support engineers" + description: "Use this Access List to grant access to production to your engineers enrolled in the support rotation." + audit: + recurrence: + frequency: 6months + owners: + - description: "manager of NA support team" + name: alice + ownership_requires: + roles: + - manager + grants: + roles: + - support-engineer + membership_requires: + roles: + - engineer +``` + + + + +Create the following `accesslist.tf` file: + +```hcl +resource "teleport_access_list" "support-engineers" { + header = { + version = "v1" + metadata = { + name = "support-engineers" + } + } + + spec = { + title = "Production access for support engineers" + description = "Use this Access List to grant access to production to your engineers enrolled in the support rotation." + audit = { + recurrence = { + frequency = 6 + } + } + owners = [ + { + description = "manager of NA support team" + name = "alice" + } + ] + ownership_requires = { + roles = ["manager"] + } + grants = { + roles = ["support-engineer"] + } + membership_requires = { + roles = ["engineer"] + } + } +} +``` + + + + +## Step 2/3. Apply the manifests + + + + +```code +$ tctl create -f privileged-role.yaml +role 'support-engineer' has been created + +$ tctl create -f accesslist.yaml +Access list "support-engineers" has been created +``` + + +The user resource depends on roles. You must create roles before users as a user +with a non-existing role is invalid and will be rejected by Teleport. + + + + + +Create the Kubernetes CRs with the following commands: + +```code +$ kubectl apply -n "$OPERATOR_NAMESPACE" -f privileged-role.yaml +teleportrole.resources.teleport.dev/support-engineer created + +$ kubectl apply -n "$OPERATOR_NAMESPACE" -f accesslist.yaml +teleportaccesslist.resources.teleport.dev/support-engineers +``` + + + + +```code +$ terraform plan +[...] +Plan: 2 to add, 0 to change, 0 to destroy. + +$ terraform apply +teleport_access_list.support-engineers: Creating... +teleport_role.support-engineer: Creating... +teleport_role.support-engineer: Creation complete after 0s [id=support-engineer] +teleport_access_list.support-engineers: Creation complete after 0s [id=support-engineers] +``` + + + + +## Step 3/3. Log in as `alice` and grant access to `bob` + +Now, you created an Access List allowing `alice` to grant the `support-engineer` +role to its engineers. + +You can log in as alice and add `bob` to the `support-engineers` Access List. + + + + +Login as `alice` in the web UI, open the management panel and select the +"Access Lists" tab. Your Access List should be displayed, open it, choose "Enroll +members" and add `bob`. + +![Screenshot of the web UI showing the Access List and the "Enroll Member" button](../../../img/management/access-list-web-ui.png) + + + + +Login as `alice` with `tsh`, then add bob to the Access List: + +```code +# login as alice +$ tsh login --proxy : --user alice + +# tctl acl users add [] [] +$ tctl acl users add support-engineers bob "" "Bob is now part of the on-call support rotation" +``` + +Finally, list the Access List members: +```code +$ tctl acl users ls support-engineers +Members of support-engineers: +- bob +``` + + + + +### Next steps + +You can see all supported Access List fields +[in the Access List reference](../../access-controls/access-lists/reference.mdx). diff --git a/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx b/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx index 2a236d5fb989c..c161d8ce93ebc 100644 --- a/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx +++ b/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx @@ -35,7 +35,7 @@ $ kubectl cluster-info ``` -## Step 1/3. Install teleport-cluster Helm chart with the operator +## Step 1/2. Install teleport-cluster Helm chart with the operator (!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!) @@ -86,101 +86,26 @@ $ helm install teleport-cluster teleport/teleport-cluster \ This command installs the required Kubernetes CRDs and deploys the Teleport Kubernetes Operator next to the Teleport cluster. All resources (except CRDs, which are cluster-scoped) are created in the `teleport-cluster` namespace. -## Step 2/3. Manage Teleport users and roles using `kubectl` +## Step 2/2 - Validate the cluster and operator are running and healthy -Create a manifest called `teleport-resources.yaml` that describes two custom resources: a `TeleportUser` and a `TeleportRole`: - -```yaml -apiVersion: resources.teleport.dev/v1 -kind: TeleportRoleV7 -metadata: - name: myrole -spec: - allow: - rules: - - resources: ['user', 'role'] - verbs: ['list','create','read','update','delete'] ---- -apiVersion: resources.teleport.dev/v2 -kind: TeleportUser -metadata: - name: myuser -spec: - roles: ['myrole'] -``` - - - Kubernetes validates all custom resource names to follow RFC 1123, which includes specifications for hostnames. - This requires the `metadata.name` field of Teleport resources controlled by the operator to consist of lowercase alphanumeric - characters, `-` or `.`, and to start and end with an alphanumeric character. - - -Apply the manifests to the Kubernetes cluster: - -```code -$ kubectl apply -n -f teleport-resources.yaml -``` - -List the created Kubernetes resources: - -```code -$ kubectl get teleportrolesv7 -n -# NAME AGE -# myrole 10m - -$ kubectl get teleportusers -n -# NAME AGE -# myuser 10m -``` - -Check the user `myuser` has been created in Teleport and has been granted the role `myrole`: ```code -$ AUTH_POD=$(kubectl get pods -n -l app=teleport-cluster -o jsonpath='{.items[0].metadata.name}') -$ kubectl exec -it "$AUTH_POD" -c teleport -- tctl users ls -# User Roles -# ----------------------------- ----------------------------- -# bot-teleport-operator-sidecar bot-teleport-operator-sidecar -# myuser myrole -``` - -At this point the Teleport Kubernetes Operator is functional and Teleport users and roles can be managed from -Kubernetes. +$ kubectl get deployments -n +# -## Step 3/3. Explore the Teleport CRDs - -Available fields can be browsed with `kubectl explain` in a cluster with Teleport CRDs installed. -For example the command: -```code -$ kubectl explain teleportroles.spec +$ kubectl get pods -n +# ``` -Returns the following fields: -```shell -KIND: TeleportRoleV7 -VERSION: resources.teleport.dev/v1 -RESOURCE: spec - -DESCRIPTION: - Role resource definition v7 from Teleport +## Next steps -FIELDS: - allow - Allow is the set of conditions evaluated to grant access. +Follow [the user and role IaC guide](./user-and-role.mdx) to use your newly +deployed Teleport Kubernetes Operator to create Teleport users and grant them +roles. - deny - Deny is the set of conditions evaluated to deny access. Deny takes priority - over allow. +Helm Chart parameters are documented in the [`teleport-cluster` Helm chart reference](../../reference/helm-reference/teleport-cluster.mdx). - options - Options is for OpenSSH options like agent forwarding. -``` +See the [Helm Deployment guides](../../deploy-a-cluster/helm-deployments.mdx) detailing specific setups like running Teleport on AWS or GCP. ## Troubleshooting (!docs/pages/includes/diagnostics/kubernetes-operator-troubleshooting.mdx!) - -## Next steps - -Helm Chart parameters are documented in the [`teleport-cluster` Helm chart reference](../../reference/helm-reference/teleport-cluster.mdx). - -See the [Helm Deployment guides](../../deploy-a-cluster/helm-deployments.mdx) detailing specific setups like running Teleport on AWS or GCP. diff --git a/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx b/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx index 4fc37b594e5cd..e8b391c05d27a 100644 --- a/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx +++ b/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx @@ -9,7 +9,7 @@ If your Teleport cluster is deployed using the `teleport-cluster` Helm chart, yo ## Prerequisites -(!docs/pages/includes/self-hosted-prereqs-tabs.mdx!) +(!docs/pages/includes/edition-prereqs-tabs.mdx!) - a Kubernetes cluster. You must be able to create/read Namespace, ServiceAccount, Deployment, Secret, Role, RoleBinding and CustomResourceDefinition resources. @@ -127,11 +127,17 @@ At this point, you can configure and run the operator: ```code $ kubectl get pods -n teleport-iac ``` + +## Next steps -## Troubleshooting +Follow [the user and role IaC guide](./user-and-role.mdx) to use your newly +deployed Teleport Kubernetes Operator to create Teleport users and grant them +roles. -(!docs/pages/includes/diagnostics/kubernetes-operator-troubleshooting.mdx!) +Helm Chart parameters are documented in the [`teleport-operator` Helm chart reference](../../reference/helm-reference/teleport-operator.mdx). -## Next steps +## Troubleshooting -Helm Chart parameters are documented in the [`teleport-operator` Helm chart reference](../../reference/helm-reference/teleport-operator.mdx). +TODO: add troubleshooting steps for operator pod + +(!docs/pages/includes/diagnostics/kubernetes-operator-troubleshooting.mdx!) diff --git a/docs/pages/management/dynamic-resources/teleport-operator.mdx b/docs/pages/management/dynamic-resources/teleport-operator.mdx index 3864f031547f7..e4ab426ee9ccd 100644 --- a/docs/pages/management/dynamic-resources/teleport-operator.mdx +++ b/docs/pages/management/dynamic-resources/teleport-operator.mdx @@ -51,4 +51,5 @@ follow [the standalone operator guide](./teleport-operator-standalone.mdx). ## Next steps -Check out [access controls documentation](../../access-controls/introduction.mdx) +- Follow the ["Managing users and roles with IaC" guide](./user-and-role.mdx). +- Check out [access controls documentation](../../access-controls/introduction.mdx). diff --git a/docs/pages/management/dynamic-resources/terraform-provider.mdx b/docs/pages/management/dynamic-resources/terraform-provider.mdx index 6e4611c142ada..f5a5c67287ec7 100644 --- a/docs/pages/management/dynamic-resources/terraform-provider.mdx +++ b/docs/pages/management/dynamic-resources/terraform-provider.mdx @@ -4,10 +4,11 @@ description: How to manage dynamic resources using the Teleport Terraform provid videoBanner: YgNHD4SS8dg --- -This guide demonstrates how to: +This guide demonstrates how to: Set up the Terraform provider for Teleport on +Linux and macOS. -- Set up the Terraform provider for Teleport on Linux and macOS. -- Configure Teleport users and roles using the Terraform provider. +For instructions on managing users and roles via Terraform, read +the ["Managing users and roles with IaC" guide](./user-and-role.mdx). For instructions on managing the Teleport dynamic resources as code using GitOps, read the guide to using the Teleport Terraform provider with [Spacelift @@ -79,6 +80,7 @@ To prepare credentials for a local Teleport user: - token - trusted_cluster - user + - access_list verbs: ['list','create','read','update','delete'] version: v7 --- @@ -96,7 +98,9 @@ To prepare credentials for a local Teleport user: 1. Create the `terraform` user and role by running the following command: ```code - $ tctl create terraform.yaml + $ tctl create -f terraform.yaml + role 'terraform' has been created + user "terraform" has been created ``` The `terraform` user can't sign in to get credentials, so you must have another user @@ -125,7 +129,8 @@ the following content into the `terraform-impersonator.yaml` file: 1. Create the `terraform-impersonator` role by running the following command: ```code - $ tctl create terraform-impersonator.yaml + $ tctl create -f terraform-impersonator.yaml + role 'terraform-impersonator' has been created ``` 1. (!docs/pages/includes/add-role-to-user.mdx role="terraform-impersonator"!) @@ -142,24 +147,25 @@ the following content into the `terraform-impersonator.yaml` file: To prepare a Terraform configuration file: -1. Create a new file called `main.tf` and open it in an editor. +1. Create a new file called `provider.tf` and open it in an editor. -1. Define an example user and role using Terraform by pasting the following content into the `main.tf` file: +1. Use the Teleport Terraform provider and connect it to your Teleport cluster + by pasting the following content into the `provider.tf` file: ```hcl - (!examples/resources/terraform/terraform-user-role-cloud.tf!) + (!examples/resources/terraform/provider-cloud.tf!) ``` ```hcl - (!examples/resources/terraform/terraform-user-role-self-hosted.tf!) + (!examples/resources/terraform/provider-self-hosted.tf!) ``` -## Step 3/3. Apply the configuration +## Step 3/3. Validate the configuration To apply the configuration: @@ -167,18 +173,18 @@ To apply the configuration: ```code $ ls - # main.tf terraform-identity terraform-impersonator.yaml terraform.yaml + # provider.tf terraform-identity terraform-impersonator.yaml terraform.yaml ``` -1. Initialize the working directory that contains Terraform configuration files by running the -following command: +1. Initialize the working directory that contains Terraform configuration files + by running the following command: ```code $ terraform init ``` 1. Execute the Terraform plan defined in the configuration file by running the -following command: + following command: ```code $ terraform apply @@ -186,5 +192,7 @@ following command: ## Next steps +- Follow [the user and role IaC guide](./user-and-role.mdx) to use the Terraform + Provider to create Teleport users and grant them roles. - Explore the full list of supported [Terraform provider resources](../../reference/terraform-provider.mdx). - Read more about [impersonation](../../access-controls/guides/impersonation.mdx). diff --git a/docs/pages/management/dynamic-resources/user-and-role.mdx b/docs/pages/management/dynamic-resources/user-and-role.mdx new file mode 100644 index 0000000000000..b6a4f19ff15a2 --- /dev/null +++ b/docs/pages/management/dynamic-resources/user-and-role.mdx @@ -0,0 +1,501 @@ +--- +title: Managing users and roles with IaC +description: Use Infrastructure-as-Code tooling to create Teleport users and roles. +--- + +In this guide, you will see how to create users and grant them roles through +Infrastructure-as-Code (IaC). Teleports supports three ways to dynamically +create resources from code: + +- The Teleport Kubernetes Operator that allows you to manage Teleport resources + from Kubernetes +- The Teleport Terraform Provider that allows you to manage Teleport Resources + via Terraform +- The `tctl` CLI that allows you to manage Teleport resources from your local + computer or your CI environment + +### Prerequisites + +To follow this guide, you must have: + + + + +(!docs/pages/includes/edition-prereqs-tabs.mdx!) + + + + +A running operator by following either: +- [the guide to enable the operator in the `teleport-cluster` Helm chart](./teleport-operator-helm.mdx). +- [the guide to setup a standalone operator](./teleport-operator-standalone.mdx). + +You must also set the namespace in which you deployed the operator as this is +the namespace where you will deploy the CustomResources: + +```code +# for operators deployed with the `teleport-cluster` Helm chart +$ export OPERATOR_NAMESPACE="teleport-cluster" + +# for standalone operators +$ export OPERATOR_NAMESPACE="teleport-iac" +``` + + + + +A functional Teleport Terraform provider by following [the Terraform provider guide](./terraform-provider.mdx). + + + + +### Step 1/4 - Write manifests + +In this step, we'll write text files describing the resources we want in +Teleport. Those files are called manifests and their syntax will vary based on +the IaC tooling you'll use. + +Those manifests are typically versioned in a shared revision system like git. +This allows you to keep track of all changes, follow standard code review +procedures before changing resources in Teleport, and quickly redeploy your +Teleport instance if needed. + +#### Write role manifests + +We will create 2 roles: + +- `manager` that allows listing users, roles and reviewing audit events and + session contents. +- `engineer` that grants access to dev and staging servers. + + + + +Create the following `roles.yaml` file: + +```yaml +kind: role +version: v7 +metadata: + name: manager +spec: + allow: + rules: + - resources: ['user', 'role'] + verbs: ['list','read'] + - resources: ['session', 'event'] + verbs: ['list', 'read'] +--- +kind: role +version: v7 +metadata: + name: engineer +spec: + allow: + logins: ['root', 'ubuntu', '{{internal.logins}}'] + node_labels: + 'env': ['test', 'staging'] +``` + + + + +Create the following `roles.yaml` file: + +```yaml +apiVersion: resources.teleport.dev/v5 +kind: TeleportRole +metadata: + name: manager +spec: + allow: + rules: + - resources: ['user', 'role'] + verbs: ['list','read'] + - resources: ['session', 'event'] + verbs: ['list', 'read'] +--- +apiVersion: resources.teleport.dev/v5 +kind: TeleportRole +metadata: + name: engineer +spec: + allow: + logins: ['root', 'ubuntu', '{{internal.logins}}'] + node_labels: + 'env': ['test', 'staging'] +``` + + +The role version is v5 because the Teleport Kubernetes Operator doesn't support +yet roles v6 and v7. + + + + Kubernetes validates all custom resource names to follow RFC 1123, which + includes specifications for hostnames. This requires the `metadata.name` field + of Teleport resources controlled by the operator to consist of lowercase + alphanumeric characters, `-` or `.`, and to start and end with an alphanumeric + character. + + + + + +Create the following `roles.tf` file: + +```hcl +resource "teleport_role" "manager" { + version = "v7" + metadata = { + name = "manager" + } + + spec = { + allow = { + rules = [ + { + resources = ["user", "role"] + verbs = ["list", "read"] + }, + { + resources = ["session", "event"] + verbs = ["list", "read"] + } + ] + } + } +} + +resource "teleport_role" "engineer" { + version = "v7" + metadata = { + name = "engineer" + } + + spec = { + allow = { + logins = ["root", "ubuntu", "{{internal.logins}}"] + node_labels = { + env = ["test", "staging"] + } + } + } +} +``` + + + + +#### Write user manifests + +We will create 2 users: +- Bob, an engineer with the `engineer` role. +- Alice, an engineering manager with both `manager` and `engineer` roles. + + + Users created from manifests are local users, as opposed to users coming from + an external SAML/OIDC/GitHub Identity Provider (IdP). + + See [the user type reference](../../reference/user-types.mdx) for more details. + + + + + +Create the file `users.yaml` with the following content: + +```yaml +kind: user +version: v2 +metadata: + name: alice +spec: + roles: ['manager', 'engineer'] +--- +kind: user +version: v2 +metadata: + name: bob +spec: + roles: ['engineer'] +``` + + + + +Create the file `users.yaml` with the following content: + +```yaml +apiVersion: resources.teleport.dev/v2 +kind: TeleportUser +metadata: + name: alice +spec: + roles: ['manager', 'engineer'] +--- +apiVersion: resources.teleport.dev/v2 +kind: TeleportUser +metadata: + name: bob +spec: + roles: ['engineer'] +``` + + + Kubernetes validates all custom resource names to follow RFC 1123, which + includes specifications for hostnames. This requires the `metadata.name` field + of Teleport resources controlled by the operator to consist of lowercase + alphanumeric characters, `-` or `.`, and to start and end with an alphanumeric + character. + + + + + +Create the file `users.tf` with the following content: + +```hcl +resource "teleport_user" "alice" { + version = "v2" + metadata = { + name = "alice" + } + + spec = { + # referencing to the teleport_role resource name instead of using plain + # strings tells Terraform that the user depends on the role. Thanks to this, + # Terraform will create the role first and won't let you remove the role + # if it is still assigned to a user (which is illegal in Teleport). + roles = [ + teleport_role.manager.metadata.name, + teleport_role.engineer.metadata.name, + ] + } +} + +resource "teleport_user" "bob" { + version = "v2" + metadata = { + name = "bob" + } + + spec = { + roles = [teleport_role.engineer.metadata.name] + } +} +``` + + + + + +### Step 2/4 - Apply all manifests + + + + +```code +$ tctl create -f roles.yaml +role 'manager' has been created +role 'engineer' has been created + +$ tctl create -f users.yaml +user "alice" has been created +user "bob" has been created +``` + + +The user resource depends on roles, you must create roles before users as a user +with a non-existing role is invalid and might be rejected by Teleport. + + + + + +```code +$ kubectl apply -n "$OPERATOR_NAMESPACE" -f roles.yaml +teleportrole.resources.teleport.dev/manager created +teleportrole.resources.teleport.dev/engineer created + +$ kubectl apply -n "$OPERATOR_NAMESPACE" -f users.yaml +teleportuser.resources.teleport.dev/alice created +teleportuser.resources.teleport.dev/bob created +``` + +List the created Kubernetes resources: + +```code +$ kubectl get teleportroles -n "$OPERATOR_NAMESPACE" +# NAME AGE +# engineer 10m +# manager 10m + +$ kubectl get teleportusers -n "$OPERATOR_NAMESPACE" +# NAME AGE +# alice 10m +# bob 10m +``` + + + + +```code +$ terraform plan +[...] +Plan: 4 to add, 0 to change, 0 to destroy. + +$ terraform apply +teleport_role.engineer: Creating... +teleport_role.manager: Creating... +teleport_role.engineer: Creation complete after 0s [id=engineer] +teleport_role.manager: Creation complete after 0s [id=manager] +teleport_user.bob: Creating... +teleport_user.alice: Creating... +teleport_user.bob: Creation complete after 0s [id=bob] +teleport_user.alice: Creation complete after 0s [id=alice] + +Apply complete! Resources: 4 added, 0 changed, 0 destroyed. +``` + + + + +### Step 3/4 - Validate users were created + +Now that the IaC tooling has run, we'll validate that the users were properly +created and granted the correct roles. + + + + +If you have UI access, connect to your Teleport cluster Web UI, open the +management panel, and select the "Users" tab. + +![Screenshot of the web UI listing alice and bob users](../../../img/management/check-users-web-ui.png) + +Two new users `alice` and `bob` should be present. + + + + +```code +$ tctl users ls +User Roles +----------------------------- ------------------------- +@teleport-access-approval-bot @teleport-access-approver +alice manager,engineer +bob engineer +bot-operator bot-operator + +# alternatively you can inspect the users details by doing +$ tctl get user/alice +kind: user +metadata: + id: 1704849160091933780 + labels: + teleport.dev/origin: kubernetes + name: alice +spec: + created_by: + time: "2024-01-10T01:12:40.088581806Z" + user: + name: bot-operator + expires: "0001-01-01T00:00:00Z" + roles: + - manager + - engineer + status: + is_locked: false + lock_expires: "0001-01-01T00:00:00Z" + locked_time: "0001-01-01T00:00:00Z" + recovery_attempt_lock_expires: "0001-01-01T00:00:00Z" +version: v2 +``` + + + + +### Step 4/4 - Create a password reset link + +At this point, the local users have been created in Teleport. However, we never +specified any password or additional authentications factors. You must issue a +password reset link for the users to finish their Teleport registration and be +able to log in Teleport. + +User reset links contain single-use expiring tokens. Because of this, you cannot +follow the same descriptive approach as for other Teleport resources and +generate them via a manifest. You need to create those tokens once after the +user creation, and securely send them to the end-user for them to register their +password/MFA. + + + +You can manually reset a user password via `tctl` by doing: + +```code +$ tctl users reset alice +User "alice" has been reset. Share this URL with the user to complete password reset, link is valid for 8h: +https://teleport.example.com:443/web/reset/05b420fdc784597cbbb1d2ba65697cd8 + +NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access. +``` + + + + +If you have a way to securely send reset links to the users, you can build +automation to fit your organization's specific needs. For example: + +``` +$ tctl users reset alice --format=json | \ + jq '"Sending an email to " + .spec.user +" that contains the link: " + .spec.url' +``` + +You must replace the `jq` command by something that actually sends the link over +a secure channel. This channel will depend on your organization, it is usually a +direct message, or an email. + + + +You can trigger your custom script on Terraform resource creation with +[the `local-exec` provisioner](https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec). + +```hcl +resource "teleport_user" "bob" { + version = v2 + metadata = { + name = "bob" + } + + spec = { + roles = [teleport_role.engineer.metadata.name] + } + + # on user creation, trigger a reset flow and send the link via + provisioner "local-exec" { + command = "tctl users reset alice --format=json | jq '\"Sending an email to \" + .spec.user +\" that contains the link: \" + .spec.url'" + } +} + +``` + + + + + +### Next Steps + +- Allow users with the `manager` role to grant access to production servers to + some `engineers` via Access Lists. Manager will need to justify and review + granted access periodically. + See [the AccessList documentation](../../access-controls/access-lists.mdx) for + a high-level explanation of the feature, + and [the AccessList IaC guide](access-list.mdx) for a step by step IaC + AccessList setup. +- Allow users with the `engineer` role to request temporary access to + production, and have users with the `manager` role validate the requests. + See [the access-requests documentation](../../access-controls/access-requests.mdx) +- You can see all supported fields in the references + of [the user resource](../../reference/resources.mdx#user) + and [the role resource](../../reference/resources.mdx#role). diff --git a/docs/pages/reference/user-types.mdx b/docs/pages/reference/user-types.mdx new file mode 100644 index 0000000000000..b15b60af7e1cb --- /dev/null +++ b/docs/pages/reference/user-types.mdx @@ -0,0 +1,91 @@ +--- +title: User Types +description: Describes the different types of Teleport users and their properties. +keywords: [user,idp,sso] +tocDepth: 3 +--- + +This guide explains the different kinds of users in Teleport, how they are +created, and their properties. + +## Local Users + +Local users are created directly in Teleport. They are not coming from an +external system like an identity provider. + +Local users can be created via the CLI (`tctl users add`), by applying a user +resource manifest (`tctl create -f user.yaml`) or via the web UI. Their roles +and traits can be modified directly in Teleport. + +Those users can connect to Teleport directly via username/password and/or +additional authentication factors such as webauthn physical tokens, passkeys or +One Time Passwords. + +Local user login can be disabled via `cluster_auth_preference` or `teleport.yaml`. +Disabling local authentication is required for [FIPS/FedRAMP compliance +](../access-controls/compliance-frameworks/fedramp.mdx). + +### Special case: Bots + +Machine ID provides machines with an identity that can authenticate to the +Teleport cluster. This identity is known as a bot. Bots are represented in +Teleport by a user and a role resource and can be created via the +`tctl bots add` command. + +Bots are not logging in like human users with a password, MFA or SSO. They join +the cluster as Teleport services using [a join method](./join-methods.mdx). They +can still join even if local auth is disabled. + + +The [Machine ID introduction](../machine-id/introduction.mdx). + + +## SSO users + +Those users are imported in Teleport from an external identity provider. +Teleport contains a user resource representing those users, but it's only a +representation of a user of a remote system. + +Remote users don't log in directly in Teleport, they are redirected to their +identity provider to perform the login challenge. + +Those users cannot be edited via `tctl`, or via any other IaC tooling like +Terraform or the Teleport Kubernetes Operator. They are managed by + +### Temporary users + +Users logging in via GitHub, SAML, or OIDC connectors are created in Teleport +after a successful login. At that time, their roles and traits are computed +according to the connector mappings. + +Those users are short-lived, they are created when a Teleport session is opened +and automatically expires after a few days. Those users cannot be edited via +`tctl`, only deleted. + + +The [SSO setup guides](../access-controls/sso.mdx). + + +### Synced users + +Since version 15, Teleport supports fetching users from external identity +providers like Okta. + +Synchronizing users from the external IdP allows all users to be represented in +Teleport, whether they logged in Teleport or not. The benefits of such +integration are: +- Automatic user locking and deletion if the user is suspended or removed in the + IdP. +- Ability to see all users within Teleport regardless of the last login date. +- All IdP users are displayed in Teleport Access Graph. + +The Okta synchronization service is in charge of creating new users when they +are created in Okta, and locking/deleting users if they get deactivated/removed +in Okta. + +Those users can be identified by the label `teleport.dev/origin: okta` and +cannot be edited via `tctl`, only deleted. + + +Okta synchronization documentation + diff --git a/examples/resources/terraform/provider-cloud.tf b/examples/resources/terraform/provider-cloud.tf new file mode 100644 index 0000000000000..dd5637478e90c --- /dev/null +++ b/examples/resources/terraform/provider-cloud.tf @@ -0,0 +1,30 @@ +terraform { + required_providers { + teleport = { + source = "terraform.releases.teleport.dev/gravitational/teleport" + version = "~> (=teleport.major_version=).0" + } + } +} + +provider "teleport" { + # Update addr to point to your Teleport Cloud tenant URL's host:port + addr = "mytenant.teleport.sh:443" + identity_file_path = "terraform-identity" +} + +# creates a test role, if we don't declare resources, Terraform won't try to +# connect to Teleport and we won't be able to validate the setup. +resource "teleport_role" "test" { + version = "v7" + metadata = { + name = "test" + description = "Dummy role to validate Terraform Provider setup" + labels = { + test = "yes" + } + } + + spec = { + } +} diff --git a/examples/resources/terraform/provider-self-hosted.tf b/examples/resources/terraform/provider-self-hosted.tf new file mode 100644 index 0000000000000..15bcf1a25862f --- /dev/null +++ b/examples/resources/terraform/provider-self-hosted.tf @@ -0,0 +1,31 @@ +terraform { + required_providers { + teleport = { + source = "terraform.releases.teleport.dev/gravitational/teleport" + version = "~> (=teleport.major_version=).0" + } + } +} + +provider "teleport" { + # Update addr to point to Teleport Auth/Proxy + # addr = "auth.example.com:3025" + addr = "proxy.example.com:443" + identity_file_path = "terraform-identity" +} + +# creates a test role, if we don't declare resources, Terraform won't try to +# connect to Teleport and we won't be able to validate the setup. +resource "teleport_role" "test" { + version = "v7" + metadata = { + name = "test" + description = "Dummy role to validate Terraform Provider setup" + labels = { + test = "yes" + } + } + + spec = { + } +} diff --git a/examples/resources/terraform/terraform-user-role-cloud.tf b/examples/resources/terraform/terraform-user-role-cloud.tf deleted file mode 100644 index da2c045fc0c67..0000000000000 --- a/examples/resources/terraform/terraform-user-role-cloud.tf +++ /dev/null @@ -1,85 +0,0 @@ -terraform { - required_providers { - teleport = { - source = "terraform.releases.teleport.dev/gravitational/teleport" - version = "~> (=teleport.major_version=).0" - } - } -} - -provider "teleport" { - # Update addr to point to your Teleport Cloud tenant URL's host:port - addr = "mytenant.teleport.sh:443" - identity_file_path = "terraform-identity" -} - -resource "teleport_role" "terraform-test" { - version = "v7" - metadata = { - name = "terraform-test" - description = "Terraform test role" - labels = { - example = "yes" - } - } - - spec = { - options = { - forward_agent = false - max_session_ttl = "30m" - port_forwarding = false - client_idle_timeout = "1h" - disconnect_expired_cert = true - permit_x11_forwarding = false - request_access = "denied" - } - - allow = { - logins = ["this-user-does-not-exist"] - - rules = [ - { - resources = ["user", "role"] - verbs = ["list"] - } - ] - - request = { - roles = ["example"] - claims_to_roles = [ - { - claim = "example" - value = "example" - roles = ["example"] - } - ] - } - - node_labels = { - key = ["example"] - alabel = ["with", "multiple", "values"] - } - } - - deny = { - logins = ["anonymous"] - } - } -} - -resource "teleport_user" "terraform-test" { - version = "v2" - metadata = { - name = "terraform-test" - description = "Test terraform user" - expires = "2022-10-12T07:20:50Z" - - labels = { - test = "true" - } - } - - spec = { - roles = ["terraform-test"] - } -} diff --git a/examples/resources/terraform/terraform-user-role-self-hosted.tf b/examples/resources/terraform/terraform-user-role-self-hosted.tf deleted file mode 100644 index 9ea26a644e7ee..0000000000000 --- a/examples/resources/terraform/terraform-user-role-self-hosted.tf +++ /dev/null @@ -1,86 +0,0 @@ -terraform { - required_providers { - teleport = { - source = "terraform.releases.teleport.dev/gravitational/teleport" - version = "~> (=teleport.major_version=).0" - } - } -} - -provider "teleport" { - # Update addr to point to Teleport Auth/Proxy - # addr = "auth.example.com:3025" - addr = "proxy.example.com:443" - identity_file_path = "terraform-identity" -} - -resource "teleport_role" "terraform-test" { - version = "v7" - metadata = { - name = "terraform-test" - description = "Terraform test role" - labels = { - example = "yes" - } - } - - spec = { - options = { - forward_agent = false - max_session_ttl = "30m" - port_forwarding = false - client_idle_timeout = "1h" - disconnect_expired_cert = true - permit_x11_forwarding = false - request_access = "denied" - } - - allow = { - logins = ["this-user-does-not-exist"] - - rules = [ - { - resources = ["user", "role"] - verbs = ["list"] - } - ] - - request = { - roles = ["example"] - claims_to_roles = [ - { - claim = "example" - value = "example" - roles = ["example"] - } - ] - } - - node_labels = { - key = ["example"] - alabel = ["with", "multiple", "values"] - } - } - - deny = { - logins = ["anonymous"] - } - } -} - -resource "teleport_user" "terraform-test" { - version = "v2" - metadata = { - name = "terraform-test" - description = "Test terraform user" - expires = "2022-10-12T07:20:50Z" - - labels = { - test = "true" - } - } - - spec = { - roles = ["terraform-test"] - } -} From 9ae3baa8bf7a23819481c20571cd68267fd0adfc Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Fri, 2 Feb 2024 11:18:27 -0500 Subject: [PATCH 2/8] reformat docs/config.json --- docs/config.json | 218 +++++++++++++++++++++++------------------------ 1 file changed, 109 insertions(+), 109 deletions(-) diff --git a/docs/config.json b/docs/config.json index d0dd0cc06a486..401f91f1489e6 100644 --- a/docs/config.json +++ b/docs/config.json @@ -8,10 +8,10 @@ "title": "Get Started with Teleport", "slug": "/" }, - { - "title": "Documentation Overview", - "slug": "/documentation-overview/" - }, + { + "title": "Documentation Overview", + "slug": "/documentation-overview/" + }, { "title": "Core Concepts", "slug": "/core-concepts/" @@ -20,50 +20,50 @@ "title": "Installation", "slug": "/installation/" }, - { - "title": "Upgrading", - "slug": "/upgrading/", - "entries": [ - { - "title": "Compatibility Overview", - "slug": "/upgrading/overview/" - }, - { - "title": "Teleport Cloud Agents (Linux)", - "slug": "/upgrading/cloud-linux/", - "forScopes": ["cloud", "team"] - }, - { - "title": "Teleport Cloud Agents (Kubernetes)", - "slug": "/upgrading/cloud-kubernetes/", - "forScopes": ["cloud", "team"] - }, + { + "title": "Upgrading", + "slug": "/upgrading/", + "entries": [ + { + "title": "Compatibility Overview", + "slug": "/upgrading/overview/" + }, + { + "title": "Teleport Cloud Agents (Linux)", + "slug": "/upgrading/cloud-linux/", + "forScopes": ["cloud", "team"] + }, + { + "title": "Teleport Cloud Agents (Kubernetes)", + "slug": "/upgrading/cloud-kubernetes/", + "forScopes": ["cloud", "team"] + }, { "title": "Self-Hosted Linux", "slug": "/upgrading/self-hosted-linux/", "forScopes": ["enterprise", "oss"] }, - { - "title": "Self-Hosted Kubernetes", - "slug": "/upgrading/self-hosted-kubernetes/", - "forScopes": ["enterprise", "oss"] - }, + { + "title": "Self-Hosted Kubernetes", + "slug": "/upgrading/self-hosted-kubernetes/", + "forScopes": ["enterprise", "oss"] + }, { "title": "Self-Hosted Automatic Upgrades", "slug": "/upgrading/self-hosted-automatic-agent-updates/", "forScopes": ["enterprise"] } - ] - }, + ] + }, { "title": "FAQ", "slug": "/faq/" }, - { - "title": "Usage Reporting and Billing", - "slug": "/usage-billing/", - "forScopes": ["cloud", "team", "enterprise"] - }, + { + "title": "Usage Reporting and Billing", + "slug": "/usage-billing/", + "forScopes": ["cloud", "team", "enterprise"] + }, { "title": "Upcoming Releases", "slug": "/upcoming-releases/" @@ -90,7 +90,7 @@ { "title": "Teleport Team", "slug": "/choose-an-edition/teleport-team/", - "forScopes": ["team"] + "forScopes": ["team"] }, { "title": "Teleport Enterprise Cloud", @@ -509,11 +509,11 @@ "slug": "/access-controls/access-requests/resource-requests/", "forScopes": ["enterprise", "cloud"] }, - { - "title": "Configure Access Requests", + { + "title": "Configure Access Requests", "slug": "/access-controls/access-requests/access-request-configuration/", "forScopes": ["enterprise", "cloud"] - }, + }, { "title": "Access Requests in Teleport Community Edition", "slug": "/access-controls/access-requests/oss-role-requests/", @@ -604,37 +604,37 @@ "title": "Introduction", "slug": "/management/introduction/" }, - { - "title": "Using Dynamic Resources", - "slug": "/management/dynamic-resources/", - "entries": [ - { - "title": "Managing Users and Roles", - "slug": "/management/dynamic-resources/user-and-role/" - }, - { - "title": "Managing Access Lists", - "slug": "/management/dynamic-resources/access-list/" - }, - { - "title": "Kubernetes Operator", - "slug": "/management/dynamic-resources/teleport-operator/" - }, - { - "title": "Kubernetes Operator in teleport-cluster Helm chart", - "slug": "/management/dynamic-resources/teleport-operator-helm/", - "forScopes": ["oss","enterprise"] - }, { - "title": "Standalone Kubernetes Operator", - "slug": "/management/dynamic-resources/teleport-operator-standalone/" + "title": "Using Dynamic Resources", + "slug": "/management/dynamic-resources/", + "entries": [ + { + "title": "Managing Users and Roles", + "slug": "/management/dynamic-resources/user-and-role/" + }, + { + "title": "Managing Access Lists", + "slug": "/management/dynamic-resources/access-list/" + }, + { + "title": "Kubernetes Operator", + "slug": "/management/dynamic-resources/teleport-operator/" + }, + { + "title": "Kubernetes Operator in teleport-cluster Helm chart", + "slug": "/management/dynamic-resources/teleport-operator-helm/", + "forScopes": ["oss","enterprise"] + }, + { + "title": "Standalone Kubernetes Operator", + "slug": "/management/dynamic-resources/teleport-operator-standalone/" + }, + { + "title": "Terraform Provider", + "slug": "/management/dynamic-resources/terraform-provider/" + } + ] }, - { - "title": "Terraform Provider", - "slug": "/management/dynamic-resources/terraform-provider/" - } - ] - }, { "title": "Admin Guides", "slug": "/management/admin/", @@ -872,24 +872,24 @@ "title": "Getting Started", "slug": "/application-access/getting-started/" }, - { - "title": "Enroll Kubernetes Applications", - "slug": "/application-access/enroll-kubernetes-applications/", - "entries":[ - { - "title": "Get Started", - "slug": "/application-access/enroll-kubernetes-applications/get-started/" - }, - { - "title": "Architecture", - "slug": "/application-access/enroll-kubernetes-applications/architecture/" - }, - { - "title": "Reference", - "slug": "/application-access/enroll-kubernetes-applications/reference/" - } - ] - }, + { + "title": "Enroll Kubernetes Applications", + "slug": "/application-access/enroll-kubernetes-applications/", + "entries":[ + { + "title": "Get Started", + "slug": "/application-access/enroll-kubernetes-applications/get-started/" + }, + { + "title": "Architecture", + "slug": "/application-access/enroll-kubernetes-applications/architecture/" + }, + { + "title": "Reference", + "slug": "/application-access/enroll-kubernetes-applications/reference/" + } + ] + }, { "title": "Securing Cloud Provider APIs", "slug": "/application-access/cloud-apis/", @@ -1556,10 +1556,10 @@ "title": "Telemetry", "slug": "/machine-id/reference/telemetry/" }, - { - "title": "Upgrading to v14", - "slug": "/machine-id/reference/v14-upgrade-guide/" - } + { + "title": "Upgrading to v14", + "slug": "/machine-id/reference/v14-upgrade-guide/" + } ] }, { @@ -1623,23 +1623,23 @@ "title": "Command Line", "slug": "/reference/cli/", "entries": [ - { - "title": "teleport", - "slug": "/reference/cli/teleport/" - }, - { - "title": "tsh", - "slug": "/reference/cli/tsh/" - }, - { - "title": "tctl", - "slug": "/reference/cli/tctl/" - }, - { - "title": "tbot", - "slug": "/reference/cli/tbot/" - } - ] + { + "title": "teleport", + "slug": "/reference/cli/teleport/" + }, + { + "title": "tsh", + "slug": "/reference/cli/tsh/" + }, + { + "title": "tctl", + "slug": "/reference/cli/tctl/" + }, + { + "title": "tbot", + "slug": "/reference/cli/tbot/" + } + ] }, { "title": "Metrics", @@ -1690,9 +1690,9 @@ "title": "teleport-cluster", "slug": "/reference/helm-reference/teleport-cluster/", "forScopes": [ - "oss", - "enterprise" - ] + "oss", + "enterprise" + ] }, { "title": "teleport-kube-agent", From becce18e49cc892ae5c7d874f7af123ce5e75afa Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Fri, 2 Feb 2024 11:36:52 -0500 Subject: [PATCH 3/8] address feedback --- docs/pages/management/dynamic-resources.mdx | 5 +-- .../dynamic-resources/access-list.mdx | 35 +++++++++---------- .../teleport-operator-helm.mdx | 2 +- .../teleport-operator-standalone.mdx | 2 -- .../dynamic-resources/user-and-role.mdx | 31 +++++++--------- docs/pages/reference/user-types.mdx | 4 --- 6 files changed, 33 insertions(+), 46 deletions(-) diff --git a/docs/pages/management/dynamic-resources.mdx b/docs/pages/management/dynamic-resources.mdx index bdaff0c841877..d74b2eef65f39 100644 --- a/docs/pages/management/dynamic-resources.mdx +++ b/docs/pages/management/dynamic-resources.mdx @@ -60,8 +60,9 @@ of Teleport's configuration interface makes it well suited for infrastructure-as-code and GitOps approaches. You can get started with `tctl`, the Terraform Provider, and the Kubernetes -Operator by following -the ["Managing Users and Roles with IaC" guide](./dynamic-resources/user-and-role.mdx) +Operator by following: +- the ["Managing Users and Roles with IaC" guide](./dynamic-resources/user-and-role.mdx) +- the ["Creating Access Lists with IaC" guide](./dynamic-resources/access-list.mdx) For more information on Teleport roles, including the `internal.logins` trait we use in these example roles, see the [Teleport Access diff --git a/docs/pages/management/dynamic-resources/access-list.mdx b/docs/pages/management/dynamic-resources/access-list.mdx index d5f0e4f97cf4c..0e82aed307ff6 100644 --- a/docs/pages/management/dynamic-resources/access-list.mdx +++ b/docs/pages/management/dynamic-resources/access-list.mdx @@ -7,9 +7,10 @@ Access Lists allow Teleport users to be granted long-term access to resources managed within Teleport. With Access Lists, administrators can regularly audit and control membership to specific roles and traits, which then tie easily back into Teleport's existing RBAC system. -In this guide, we'll follow up on [the IaC users and roles guide]() -by allowing users with the `manager` role to grant the `support-engineer` role -to users meeting specific criteria. +In this guide, we'll follow up +on [the IaC users and roles guide](./user-and-role.mdx) by allowing users with +the `manager` role to grant the `support-engineer` role to users meeting +specific criteria. Please note that Access Lists can be managed via IaC but Access List memberships cannot. The goal of Access Lists is to decentralize granting and reviewing @@ -20,14 +21,15 @@ This reduces the load on the centralized IaC/security team, ensures the access reviewer is aware of the context, reduces the request resolution time, and ensures access grants are periodically reviewed. -### Prerequisites +## Prerequisites -To follow this guide, you must follow first [the basic users and roles IaC guide](). -We will reuse its users and roles for our Access List. +To follow this guide, you must follow +first [the basic users and roles IaC guide](./user-and-role.mdx). We will reuse +its users and roles for our Access List. -## Step 1/3. Write manifests +## Step 1/3 - Write manifests -#### Write the privileged role manifest +### Write the privileged role manifest We will create a new role `support-engineer` that grants access to production servers. The `engineer` role from the previous guide was only granting access to @@ -57,8 +59,8 @@ spec: Create the following `privileged-role.yaml` file: ```yaml -apiVersion: resources.teleport.dev/v5 -kind: TeleportRole +apiVersion: resources.teleport.dev/v1 +kind: TeleportRoleV7 metadata: name: support-engineer spec: @@ -68,11 +70,6 @@ spec: 'env': [ 'production' ] ``` - -The role version is v5 because the Teleport Kubernetes Operator doesn't support -yet roles v6 and v7. - - @@ -99,7 +96,7 @@ resource "teleport_role" "support-engineer" { -#### Write the Access List manifest +### Write the Access List manifest In this step we'll create an Access List that allows users with the `manager` role such as `alice` to grant access to production to users with the `engineer` @@ -209,7 +206,7 @@ resource "teleport_access_list" "support-engineers" { -## Step 2/3. Apply the manifests +## Step 2/3 - Apply the manifests @@ -258,7 +255,7 @@ teleport_access_list.support-engineers: Creation complete after 0s [id=support-e -## Step 3/3. Log in as `alice` and grant access to `bob` +## Step 3/3 - Log in as `alice` and grant access to `bob` Now, you created an Access List allowing `alice` to grant the `support-engineer` role to its engineers. @@ -297,7 +294,7 @@ Members of support-engineers: -### Next steps +## Next steps You can see all supported Access List fields [in the Access List reference](../../access-controls/access-lists/reference.mdx). diff --git a/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx b/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx index c161d8ce93ebc..85e21a678063b 100644 --- a/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx +++ b/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx @@ -35,7 +35,7 @@ $ kubectl cluster-info ``` -## Step 1/2. Install teleport-cluster Helm chart with the operator +## Step 1/2 - Install teleport-cluster Helm chart with the operator (!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!) diff --git a/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx b/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx index e8b391c05d27a..d2ba5ef50c4ef 100644 --- a/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx +++ b/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx @@ -138,6 +138,4 @@ Helm Chart parameters are documented in the [`teleport-operator` Helm chart refe ## Troubleshooting -TODO: add troubleshooting steps for operator pod - (!docs/pages/includes/diagnostics/kubernetes-operator-troubleshooting.mdx!) diff --git a/docs/pages/management/dynamic-resources/user-and-role.mdx b/docs/pages/management/dynamic-resources/user-and-role.mdx index b6a4f19ff15a2..9a1be5196a205 100644 --- a/docs/pages/management/dynamic-resources/user-and-role.mdx +++ b/docs/pages/management/dynamic-resources/user-and-role.mdx @@ -1,5 +1,5 @@ --- -title: Managing users and roles with IaC +title: Managing Users And Roles With IaC description: Use Infrastructure-as-Code tooling to create Teleport users and roles. --- @@ -14,7 +14,7 @@ create resources from code: - The `tctl` CLI that allows you to manage Teleport resources from your local computer or your CI environment -### Prerequisites +## Prerequisites To follow this guide, you must have: @@ -49,7 +49,7 @@ A functional Teleport Terraform provider by following [the Terraform provider gu -### Step 1/4 - Write manifests +## Step 1/4 - Write manifests In this step, we'll write text files describing the resources we want in Teleport. Those files are called manifests and their syntax will vary based on @@ -60,7 +60,7 @@ This allows you to keep track of all changes, follow standard code review procedures before changing resources in Teleport, and quickly redeploy your Teleport instance if needed. -#### Write role manifests +### Write role manifests We will create 2 roles: @@ -103,8 +103,8 @@ spec: Create the following `roles.yaml` file: ```yaml -apiVersion: resources.teleport.dev/v5 -kind: TeleportRole +apiVersion: resources.teleport.dev/v1 +kind: TeleportRoleV7 metadata: name: manager spec: @@ -115,8 +115,8 @@ spec: - resources: ['session', 'event'] verbs: ['list', 'read'] --- -apiVersion: resources.teleport.dev/v5 -kind: TeleportRole +apiVersion: resources.teleport.dev/v1 +kind: TeleportRoleV7 metadata: name: engineer spec: @@ -126,11 +126,6 @@ spec: 'env': ['test', 'staging'] ``` - -The role version is v5 because the Teleport Kubernetes Operator doesn't support -yet roles v6 and v7. - - Kubernetes validates all custom resource names to follow RFC 1123, which includes specifications for hostnames. This requires the `metadata.name` field @@ -187,7 +182,7 @@ resource "teleport_role" "engineer" { -#### Write user manifests +### Write user manifests We will create 2 users: - Bob, an engineer with the `engineer` role. @@ -290,7 +285,7 @@ resource "teleport_user" "bob" { -### Step 2/4 - Apply all manifests +## Step 2/4 - Apply all manifests @@ -361,7 +356,7 @@ Apply complete! Resources: 4 added, 0 changed, 0 destroyed. -### Step 3/4 - Validate users were created +## Step 3/4 - Validate users were created Now that the IaC tooling has run, we'll validate that the users were properly created and granted the correct roles. @@ -416,7 +411,7 @@ version: v2 -### Step 4/4 - Create a password reset link +## Step 4/4 - Create a password reset link At this point, the local users have been created in Teleport. However, we never specified any password or additional authentications factors. You must issue a @@ -484,7 +479,7 @@ resource "teleport_user" "bob" { -### Next Steps +## Next Steps - Allow users with the `manager` role to grant access to production servers to some `engineers` via Access Lists. Manager will need to justify and review diff --git a/docs/pages/reference/user-types.mdx b/docs/pages/reference/user-types.mdx index b15b60af7e1cb..e0acbf250acb5 100644 --- a/docs/pages/reference/user-types.mdx +++ b/docs/pages/reference/user-types.mdx @@ -85,7 +85,3 @@ in Okta. Those users can be identified by the label `teleport.dev/origin: okta` and cannot be edited via `tctl`, only deleted. - - -Okta synchronization documentation - From a5b8bcddff515c02e77eb0f5623eb719e1ed5433 Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Fri, 2 Feb 2024 11:38:29 -0500 Subject: [PATCH 4/8] Apply suggestions from code review Co-authored-by: Paul Gottschling --- docs/pages/reference/user-types.mdx | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/docs/pages/reference/user-types.mdx b/docs/pages/reference/user-types.mdx index e0acbf250acb5..6ecd41f785f79 100644 --- a/docs/pages/reference/user-types.mdx +++ b/docs/pages/reference/user-types.mdx @@ -8,7 +8,7 @@ tocDepth: 3 This guide explains the different kinds of users in Teleport, how they are created, and their properties. -## Local Users +## Local users Local users are created directly in Teleport. They are not coming from an external system like an identity provider. @@ -18,8 +18,8 @@ resource manifest (`tctl create -f user.yaml`) or via the web UI. Their roles and traits can be modified directly in Teleport. Those users can connect to Teleport directly via username/password and/or -additional authentication factors such as webauthn physical tokens, passkeys or -One Time Passwords. +additional authentication factors such as WebAuthn physical tokens, passkeys, or +one-time passwords. Local user login can be disabled via `cluster_auth_preference` or `teleport.yaml`. Disabling local authentication is required for [FIPS/FedRAMP compliance @@ -32,17 +32,15 @@ Teleport cluster. This identity is known as a bot. Bots are represented in Teleport by a user and a role resource and can be created via the `tctl bots add` command. -Bots are not logging in like human users with a password, MFA or SSO. They join +Unlike human users, who use a password, MFA, or SSO, bot users join the cluster as Teleport services using [a join method](./join-methods.mdx). They can still join even if local auth is disabled. - -The [Machine ID introduction](../machine-id/introduction.mdx). - +See the [Machine ID introduction](../machine-id/introduction.mdx) for more information. ## SSO users -Those users are imported in Teleport from an external identity provider. +Single Sign-On (SSO) users are imported in Teleport from an external identity provider. Teleport contains a user resource representing those users, but it's only a representation of a user of a remote system. @@ -58,8 +56,8 @@ Users logging in via GitHub, SAML, or OIDC connectors are created in Teleport after a successful login. At that time, their roles and traits are computed according to the connector mappings. -Those users are short-lived, they are created when a Teleport session is opened -and automatically expires after a few days. Those users cannot be edited via +Those users are short-lived: they are created when a Teleport session is opened +and automatically expire after a few days. Those users cannot be edited via `tctl`, only deleted. From 70f834ad233d8a70988986f1eb17ccd9779c586d Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Fri, 2 Feb 2024 11:39:51 -0500 Subject: [PATCH 5/8] Apply suggestions from code review Co-authored-by: Paul Gottschling --- .../dynamic-resources/user-and-role.mdx | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/pages/management/dynamic-resources/user-and-role.mdx b/docs/pages/management/dynamic-resources/user-and-role.mdx index 9a1be5196a205..5212775d7033b 100644 --- a/docs/pages/management/dynamic-resources/user-and-role.mdx +++ b/docs/pages/management/dynamic-resources/user-and-role.mdx @@ -1,17 +1,17 @@ --- title: Managing Users And Roles With IaC -description: Use Infrastructure-as-Code tooling to create Teleport users and roles. +description: Use infrastructure-as-code tooling to create Teleport users and roles. --- In this guide, you will see how to create users and grant them roles through -Infrastructure-as-Code (IaC). Teleports supports three ways to dynamically +infrastructure as code (IaC). Teleports supports three ways to dynamically create resources from code: -- The Teleport Kubernetes Operator that allows you to manage Teleport resources +- The Teleport Kubernetes Operator, which allows you to manage Teleport resources from Kubernetes -- The Teleport Terraform Provider that allows you to manage Teleport Resources +- The Teleport Terraform Provider, which allows you to manage Teleport resources via Terraform -- The `tctl` CLI that allows you to manage Teleport resources from your local +- The `tctl` CLI, which allows you to manage Teleport resources from your local computer or your CI environment ## Prerequisites @@ -24,7 +24,7 @@ To follow this guide, you must have: (!docs/pages/includes/edition-prereqs-tabs.mdx!) - + A running operator by following either: - [the guide to enable the operator in the `teleport-cluster` Helm chart](./teleport-operator-helm.mdx). @@ -64,9 +64,9 @@ Teleport instance if needed. We will create 2 roles: -- `manager` that allows listing users, roles and reviewing audit events and +- `manager` allows listing users and roles, as well as reviewing audit events and session contents. -- `engineer` that grants access to dev and staging servers. +- `engineer` grants access to dev and staging servers. @@ -362,7 +362,7 @@ Now that the IaC tooling has run, we'll validate that the users were properly created and granted the correct roles. - + If you have UI access, connect to your Teleport cluster Web UI, open the management panel, and select the "Users" tab. @@ -372,7 +372,7 @@ management panel, and select the "Users" tab. Two new users `alice` and `bob` should be present. - + ```code $ tctl users ls @@ -448,8 +448,8 @@ $ tctl users reset alice --format=json | \ ``` You must replace the `jq` command by something that actually sends the link over -a secure channel. This channel will depend on your organization, it is usually a -direct message, or an email. +a secure channel. This channel will depend on your organization. It is usually a +direct message or an email. @@ -490,7 +490,7 @@ resource "teleport_user" "bob" { AccessList setup. - Allow users with the `engineer` role to request temporary access to production, and have users with the `manager` role validate the requests. - See [the access-requests documentation](../../access-controls/access-requests.mdx) + See [the Access Requests documentation](../../access-controls/access-requests.mdx) - You can see all supported fields in the references of [the user resource](../../reference/resources.mdx#user) and [the role resource](../../reference/resources.mdx#role). From 6b6c939b921305d1c670f1303432b29d4cafa7c6 Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Fri, 2 Feb 2024 11:43:21 -0500 Subject: [PATCH 6/8] align label names --- .../dynamic-resources/access-list.mdx | 6 +++--- .../dynamic-resources/user-and-role.mdx | 18 +++++++++--------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/pages/management/dynamic-resources/access-list.mdx b/docs/pages/management/dynamic-resources/access-list.mdx index 0e82aed307ff6..f96cb6355874a 100644 --- a/docs/pages/management/dynamic-resources/access-list.mdx +++ b/docs/pages/management/dynamic-resources/access-list.mdx @@ -54,7 +54,7 @@ spec: ``` - + Create the following `privileged-role.yaml` file: @@ -133,7 +133,7 @@ spec: ``` - + Create the following `accesslist.yaml` file: @@ -225,7 +225,7 @@ with a non-existing role is invalid and will be rejected by Teleport. - + Create the Kubernetes CRs with the following commands: diff --git a/docs/pages/management/dynamic-resources/user-and-role.mdx b/docs/pages/management/dynamic-resources/user-and-role.mdx index 5212775d7033b..c4fa00ef3253d 100644 --- a/docs/pages/management/dynamic-resources/user-and-role.mdx +++ b/docs/pages/management/dynamic-resources/user-and-role.mdx @@ -42,7 +42,7 @@ $ export OPERATOR_NAMESPACE="teleport-iac" ``` - + A functional Teleport Terraform provider by following [the Terraform provider guide](./terraform-provider.mdx). @@ -98,7 +98,7 @@ spec: ``` - + Create the following `roles.yaml` file: @@ -135,7 +135,7 @@ spec: - + Create the following `roles.tf` file: @@ -217,7 +217,7 @@ spec: ``` - + Create the file `users.yaml` with the following content: @@ -246,7 +246,7 @@ spec: - + Create the file `users.tf` with the following content: @@ -306,7 +306,7 @@ with a non-existing role is invalid and might be rejected by Teleport. - + ```code $ kubectl apply -n "$OPERATOR_NAMESPACE" -f roles.yaml @@ -333,7 +333,7 @@ $ kubectl get teleportusers -n "$OPERATOR_NAMESPACE" ``` - + ```code $ terraform plan @@ -425,7 +425,7 @@ user creation, and securely send them to the end-user for them to register their password/MFA. - + You can manually reset a user password via `tctl` by doing: ```code @@ -437,7 +437,7 @@ NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users ``` - + If you have a way to securely send reset links to the users, you can build automation to fit your organization's specific needs. For example: From 0ebbe4f7fdcd0d06402aeff5b12adad92e47e77c Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Fri, 2 Feb 2024 16:39:33 -0500 Subject: [PATCH 7/8] address feedback --- docs/cspell.json | 6 ++++- .../teleport-operator-helm.mdx | 4 +-- .../teleport-operator-standalone.mdx | 8 +++--- .../dynamic-resources/user-and-role.mdx | 24 +++++++---------- docs/pages/reference/introduction.mdx | 1 + docs/pages/reference/user-types.mdx | 27 ++++++++++++------- 6 files changed, 39 insertions(+), 31 deletions(-) diff --git a/docs/cspell.json b/docs/cspell.json index cdb536a1561fa..02a2c1eb6ab5f 100644 --- a/docs/cspell.json +++ b/docs/cspell.json @@ -232,6 +232,7 @@ "Zqar", "Zrpsaln", "abcdefghijklm", + "accesslist", "aclfile", "acmecorp", "acpi", @@ -787,6 +788,8 @@ "tctl", "teleadmins", "telenode", + "teleportaccesslist", + "teleportaccesslists", "teleportauditlogssofailed", "teleportblob", "teleportdemo", @@ -796,8 +799,9 @@ "teleportdevprotocol", "teleporters", "teleportproxy", - "teleportroles", + "teleportrolev", "teleportrolesv", + "teleportuser", "teleportusers", "teleportversionoverride", "teleportyaml", diff --git a/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx b/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx index 85e21a678063b..5c5850a252168 100644 --- a/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx +++ b/docs/pages/management/dynamic-resources/teleport-operator-helm.mdx @@ -35,7 +35,7 @@ $ kubectl cluster-info ``` -## Step 1/2 - Install teleport-cluster Helm chart with the operator +## Step 1/2. Install teleport-cluster Helm chart with the operator (!docs/pages/kubernetes-access/helm/includes/helm-repo-add.mdx!) @@ -86,7 +86,7 @@ $ helm install teleport-cluster teleport/teleport-cluster \ This command installs the required Kubernetes CRDs and deploys the Teleport Kubernetes Operator next to the Teleport cluster. All resources (except CRDs, which are cluster-scoped) are created in the `teleport-cluster` namespace. -## Step 2/2 - Validate the cluster and operator are running and healthy +## Step 2/2. Validate the cluster and operator are running and healthy ```code $ kubectl get deployments -n diff --git a/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx b/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx index d2ba5ef50c4ef..f146258278e2d 100644 --- a/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx +++ b/docs/pages/management/dynamic-resources/teleport-operator-standalone.mdx @@ -34,7 +34,7 @@ $ kubectl cluster-info ``` -### Step 1/4 - Create the operator role +### Step 1/4. Create the operator role In this step we create the role the operator uses to interact with Teleport resources. @@ -51,7 +51,7 @@ resources, you will need to re-apply the operator role manifest. This will grant the operator access to the new resources. -### Step 2/4 - Create the operator join token +### Step 2/4. Create the operator join token The join token is used by the operator on each startup to join the Teleport cluster and retrieve its client certificates. @@ -91,7 +91,7 @@ To establish trust between the connecting operator and Teleport, we are delegati $ export CLUSTER_NAME="$(tctl status | awk '/Cluster/ {print $2}')" ``` -### Step 3/4 - Create the operator bot +### Step 3/4. Create the operator bot In Teleport, a bot is a resource allowing a machine to access Teleport. Create a bot for the operator with the following command: @@ -100,7 +100,7 @@ Create a bot for the operator with the following command: $ tctl bots add operator --token operator-bot --roles operator ``` -### Step 4/4 - Deploy the operator in the Kubernetes cluster +### Step 4/4. Deploy the operator in the Kubernetes cluster At this point, you can configure and run the operator: diff --git a/docs/pages/management/dynamic-resources/user-and-role.mdx b/docs/pages/management/dynamic-resources/user-and-role.mdx index c4fa00ef3253d..4aa4cb1989b21 100644 --- a/docs/pages/management/dynamic-resources/user-and-role.mdx +++ b/docs/pages/management/dynamic-resources/user-and-role.mdx @@ -49,7 +49,7 @@ A functional Teleport Terraform provider by following [the Terraform provider gu -## Step 1/4 - Write manifests +## Step 1/4. Write manifests In this step, we'll write text files describing the resources we want in Teleport. Those files are called manifests and their syntax will vary based on @@ -285,7 +285,7 @@ resource "teleport_user" "bob" { -## Step 2/4 - Apply all manifests +## Step 2/4. Apply all manifests @@ -321,7 +321,7 @@ teleportuser.resources.teleport.dev/bob created List the created Kubernetes resources: ```code -$ kubectl get teleportroles -n "$OPERATOR_NAMESPACE" +$ kubectl get teleportrolev7 -n "$OPERATOR_NAMESPACE" # NAME AGE # engineer 10m # manager 10m @@ -356,7 +356,7 @@ Apply complete! Resources: 4 added, 0 changed, 0 destroyed. -## Step 3/4 - Validate users were created +## Step 3/4. Validate users were created Now that the IaC tooling has run, we'll validate that the users were properly created and granted the correct roles. @@ -411,21 +411,20 @@ version: v2 -## Step 4/4 - Create a password reset link +## Step 4/4. Create a password reset link At this point, the local users have been created in Teleport. However, we never -specified any password or additional authentications factors. You must issue a +specified any password or additional authentication factors. You must issue a password reset link for the users to finish their Teleport registration and be able to log in Teleport. User reset links contain single-use expiring tokens. Because of this, you cannot -follow the same descriptive approach as for other Teleport resources and +follow the same declarative approach as for other Teleport resources and generate them via a manifest. You need to create those tokens once after the user creation, and securely send them to the end-user for them to register their password/MFA. - - +### Option 1: Reset via CLI You can manually reset a user password via `tctl` by doing: ```code @@ -436,8 +435,7 @@ https://teleport.example.com:443/web/reset/05b420fdc784597cbbb1d2ba65697cd8 NOTE: Make sure teleport.example.com:443 points at a Teleport proxy which users can access. ``` - - +### Option 2: Automating user reset If you have a way to securely send reset links to the users, you can build automation to fit your organization's specific needs. For example: @@ -476,10 +474,8 @@ resource "teleport_user" "bob" { ``` - - -## Next Steps +## Next steps - Allow users with the `manager` role to grant access to production servers to some `engineers` via Access Lists. Manager will need to justify and review diff --git a/docs/pages/reference/introduction.mdx b/docs/pages/reference/introduction.mdx index f49f562abd5d1..dff6b80cb31e4 100644 --- a/docs/pages/reference/introduction.mdx +++ b/docs/pages/reference/introduction.mdx @@ -16,6 +16,7 @@ running Teleport. - [Helm Reference](./helm-reference.mdx): References for Teleport's Helm charts. - [Networking](./networking.mdx): Ports that Teleport services listen on, plus other information about how Teleport services communicate. +- [User types](./user-types.mdx): The different user representations in Teleport. - [Authentication](./authentication.mdx): Teleport's authentication connectors. - [Signals](./signals.mdx): The signals you can use to control a Teleport binary. diff --git a/docs/pages/reference/user-types.mdx b/docs/pages/reference/user-types.mdx index 6ecd41f785f79..a84520d9f2e3b 100644 --- a/docs/pages/reference/user-types.mdx +++ b/docs/pages/reference/user-types.mdx @@ -10,7 +10,7 @@ created, and their properties. ## Local users -Local users are created directly in Teleport. They are not coming from an +Local users are created in Teleport. They are not coming from an external system like an identity provider. Local users can be created via the CLI (`tctl users add`), by applying a user @@ -44,11 +44,18 @@ Single Sign-On (SSO) users are imported in Teleport from an external identity pr Teleport contains a user resource representing those users, but it's only a representation of a user of a remote system. -Remote users don't log in directly in Teleport, they are redirected to their -identity provider to perform the login challenge. +Remote users don't perform their login challenge in Teleport. They are redirected +to their identity provider (IdP) to enter their password, MFA, or any +authentication method required by the upstream SSO provider. Teleport is not +aware of the authentication method not the user credentials, it trusts the IdP +response. -Those users cannot be edited via `tctl`, or via any other IaC tooling like -Terraform or the Teleport Kubernetes Operator. They are managed by +If `teleport.auth_service.authentication.second_factor` is `webauthn`, Teleport +might ask for an additional MFA for administrative actions. This protects +against IdP compromise. + +SSO users cannot be edited via `tctl`, or via any other IaC tooling like +Terraform or the Teleport Kubernetes Operator. They are managed by Teleport. ### Temporary users @@ -57,12 +64,12 @@ after a successful login. At that time, their roles and traits are computed according to the connector mappings. Those users are short-lived: they are created when a Teleport session is opened -and automatically expire after a few days. Those users cannot be edited via -`tctl`, only deleted. +and automatically expire. The expiry is dynamically computed based on the IdP +answer validity, the max session duration allowed by the user roles, and cannot +exceed 30 hours. Those users cannot be edited via `tctl`, only deleted. - -The [SSO setup guides](../access-controls/sso.mdx). - +See the [SSO setup guides](../access-controls/sso.mdx) to learn how to setup an +authentication connector and allow user to log in via an IdP. ### Synced users From ee67fc793e3983d98cc80e5b2c585b93303f4a07 Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Tue, 13 Feb 2024 14:45:06 -0500 Subject: [PATCH 8/8] update teleportrole version --- docs/pages/management/dynamic-resources/access-list.mdx | 2 +- docs/pages/management/dynamic-resources/user-and-role.mdx | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/pages/management/dynamic-resources/access-list.mdx b/docs/pages/management/dynamic-resources/access-list.mdx index f96cb6355874a..da651b1c4cd95 100644 --- a/docs/pages/management/dynamic-resources/access-list.mdx +++ b/docs/pages/management/dynamic-resources/access-list.mdx @@ -231,7 +231,7 @@ Create the Kubernetes CRs with the following commands: ```code $ kubectl apply -n "$OPERATOR_NAMESPACE" -f privileged-role.yaml -teleportrole.resources.teleport.dev/support-engineer created +teleportrolev7.resources.teleport.dev/support-engineer created $ kubectl apply -n "$OPERATOR_NAMESPACE" -f accesslist.yaml teleportaccesslist.resources.teleport.dev/support-engineers diff --git a/docs/pages/management/dynamic-resources/user-and-role.mdx b/docs/pages/management/dynamic-resources/user-and-role.mdx index 4aa4cb1989b21..a45308852bf8b 100644 --- a/docs/pages/management/dynamic-resources/user-and-role.mdx +++ b/docs/pages/management/dynamic-resources/user-and-role.mdx @@ -310,8 +310,8 @@ with a non-existing role is invalid and might be rejected by Teleport. ```code $ kubectl apply -n "$OPERATOR_NAMESPACE" -f roles.yaml -teleportrole.resources.teleport.dev/manager created -teleportrole.resources.teleport.dev/engineer created +teleportrolev7.resources.teleport.dev/manager created +teleportrolev7.resources.teleport.dev/engineer created $ kubectl apply -n "$OPERATOR_NAMESPACE" -f users.yaml teleportuser.resources.teleport.dev/alice created