From 3728c000398b1ef13bfb7821f05d9f8dd53a3a1d Mon Sep 17 00:00:00 2001 From: dorota <114921900+wojcik-dorota@users.noreply.github.com> Date: Tue, 17 Dec 2024 18:19:23 +0100 Subject: [PATCH] update(BYOC): AWS (CLI & Console flows) + Google (Console flow) (#606) --- docs/platform/concepts/byoc.md | 99 ++-- .../byoc/add-customer-info-custom-cloud.md | 6 +- .../howto/byoc/assign-project-custom-cloud.md | 6 +- .../create-aws-custom-cloud.md} | 387 ++++---------- .../create-custom-cloud.md | 47 ++ .../create-google-custom-cloud.md | 491 ++++++++++++++++++ .../howto/byoc/delete-custom-cloud.md | 10 +- .../byoc/download-infrastructure-template.md | 13 +- docs/platform/howto/byoc/enable-byoc.md | 24 +- .../howto/byoc/manage-byoc-service.md | 61 +++ .../howto/byoc/networking-security.md | 8 +- .../howto/byoc/rename-custom-cloud.md | 4 +- .../howto/byoc/tag-custom-cloud-resources.md | 10 +- .../howto/byoc/view-custom-cloud-status.md | 32 ++ docs/tools/cli/byoc.md | 4 +- sidebars.ts | 15 +- static/_redirects | 2 +- .../content/figma/byoc-how-it-works.png | Bin 0 -> 63099 bytes 18 files changed, 850 insertions(+), 369 deletions(-) rename docs/platform/howto/byoc/{create-custom-cloud.md => create-custom-cloud/create-aws-custom-cloud.md} (63%) create mode 100644 docs/platform/howto/byoc/create-custom-cloud/create-custom-cloud.md create mode 100644 docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud.md create mode 100644 docs/platform/howto/byoc/manage-byoc-service.md create mode 100644 docs/platform/howto/byoc/view-custom-cloud-status.md create mode 100644 static/images/content/figma/byoc-how-it-works.png diff --git a/docs/platform/concepts/byoc.md b/docs/platform/concepts/byoc.md index cc285ad3e..0564f76dc 100644 --- a/docs/platform/concepts/byoc.md +++ b/docs/platform/concepts/byoc.md @@ -1,7 +1,7 @@ --- title: Bring your own cloud (BYOC) sidebar_label: Bring your own cloud -keywords: [AWS, Amazon Web Services, GCP, Google Cloud Platform, private deployment, public deployment, byoc, bring your own cloud, custom cloud] +keywords: [AWS, Amazon Web Services, GCP, Google Cloud Platform, private deployment, public deployment, byoc, bring your own cloud, custom cloud, backup] --- import Tabs from '@theme/Tabs'; @@ -10,22 +10,42 @@ import byocAwsPrivate from "@site/static/images/content/figma/byoc-aws-private.p import byocAwsPublic from "@site/static/images/content/figma/byoc-aws-public.png"; import byocGcpPrivate from "@site/static/images/content/figma/byoc-gcp-private.png"; import byocGcpPublic from "@site/static/images/content/figma/byoc-gcp-public.png"; +import byocHowItWorks from "@site/static/images/content/figma/byoc-how-it-works.png"; -_Bring your own cloud_ (BYOC) allows you to use your own cloud infrastructure instead of relying on the Aiven-managed infrastructure. +Bring your own cloud (BYOC) allows you to use your own cloud infrastructure instead of relying on the Aiven-managed infrastructure. Aiven services are usually deployed on Aiven-managed infrastructure, using Aiven-managed security protocols, and backed by Aiven-managed storage and backups. This provides a straightforward and safe approach to deploying Aiven services. However, you might need a different configuration if your business, project, or organization has specific requirements. With BYOC, your Aiven -organization gets connected with your cloud provider account by creating _custom -clouds_ in your Aiven organization. +organization gets connected with your cloud provider account by creating custom +clouds in your Aiven organization. + +## How it works A custom cloud is a secure environment within your cloud provider account to run Aiven-managed data services. By enabling BYOC, creating custom clouds, and setting up Aiven services within the custom clouds, you can manage your infrastructure on the Aiven platform while keeping your data in your own cloud. +How BYOC works + +1. [Enable BYOC](/docs/platform/howto/byoc/enable-byoc) in your Aiven organization by + setting up a call with the Aiven sales team to share your use case and its requirements. +1. [Create a custom cloud](/docs/platform/howto/byoc/create-custom-cloud) in the Aiven + Console or CLI by providing cloud setup details essential to generate your custom cloud + infrastructure template. +1. **Integrate your cloud account with Aiven** by applying the infrastructure template for + [AWS](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#deploy-the-template) + or + [Google Cloud](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#deploy-the-template). +1. [Deploy services](/docs/platform/howto/byoc/manage-byoc-service) by creating new + Aiven-managed services in the custom cloud or migrating existing Aiven-managed services + to the custom cloud. +1. **View Aiven-managed assets in your cloud account**: You can preview Aiven-managed + services and infrastructure in your cloud account. + ## Why use BYOC Consider using BYOC and custom clouds if you have specific business @@ -49,7 +69,7 @@ needs or project requirements, such as: strategies to save on compute and storage infrastructure costs related to Aiven services. -## Who is eligible for BYOC {#eligible-for-byoc} +## Who is eligible for BYOC The BYOC setup is a bespoke service offered on a case-by-case basis, and not all cloud providers support it yet. You're eligible for BYOC if: @@ -95,7 +115,7 @@ may have and potentially leverage enterprise discounts in certain cases. For a cost estimate and analysis, contact your account team. ::: -## BYOC architecture {#byoc-deployment} +## BYOC architecture @@ -106,17 +126,17 @@ In the AWS private deployment model, a Virtual Private Cloud (**BYOC VPC**) for services is created within a particular cloud region in your remote cloud account. Aiven accesses this VPC from a static IP address and routes traffic through a proxy for additional security. To accomplish this, Aiven -utilizes a bastion host (**Bastion node**) physically separated from the Aiven services +utilizes a bastion host (**Bastion node**) logically separated from the Aiven services you deploy. The service VMs reside in a privately addressed subnet (**Private subnet**) and are accessed by the Aiven management plane via the bastion. They are not -accessible through the Internet. +accessible through the internet. :::note Although the bastion host and the service nodes reside in the VPC under your management (**BYOC VPC**), they are not accessible (for example, via SSH) to anyone outside Aiven. -The bastion and workload nodes require outbound access to the Internet +The bastion and workload nodes require outbound access to the internet to work properly (supporting HA signaling to the Aiven management node and RPM download from Aiven repositories). ::: @@ -128,18 +148,19 @@ from Aiven repositories). In the AWS public deployment model, a Virtual Private Cloud (**BYOC VPC**) for your Aiven services is created within a particular cloud region in your remote cloud account. -Aiven accesses this VPC through an Internet gateway. Service VMs reside in a publicly +Aiven accesses this VPC through an internet gateway. Service VMs reside in a publicly addressed subnet (**Public subnet**), and Aiven services can be accessed -through the public Internet: the Aiven control plane connects to the nodes +through the public internet: the Aiven control plane connects to the nodes using the public address, and the Aiven management plane can access the service VMs -directly. +directly. To restrict access to your service, you can use the +[IP filter](/docs/platform/howto/restrict-access). - + -BYOC GCP private architecture +BYOC Google Cloud private architecture -In the GCP private deployment model, a Virtual Private Cloud (**BYOC VPC**) for your Aiven -services is created within a particular cloud region in your remote cloud account. +In the Google Cloud private deployment model, a Virtual Private Cloud (**BYOC VPC**) for +your Aiven services is created within a particular cloud region in your remote cloud account. Within the **BYOC VPC**, there are: - **Public subnet** for the bastion node @@ -147,33 +168,34 @@ Within the **BYOC VPC**, there are: Aiven accesses the **BYOC VPC** from a static IP address and routes traffic through a proxy for additional security. To accomplish this, Aiven -utilizes a bastion host (**Bastion note**) physically separated from the Aiven services +utilizes a bastion host (**Bastion note**) logically separated from the Aiven services you deploy. The service VMs reside in a privately addressed subnet (**Private subnet**) and are accessed by the Aiven management plane via the bastion. They are not -accessible through the Internet. +accessible through the internet. :::note Although the bastion host and the service nodes reside in the VPC under your management (**BYOC VPC**), they are not accessible (for example, via SSH) to anyone outside Aiven. -The bastion and workload nodes require outbound access to the Internet +The bastion and workload nodes require outbound access to the internet to work properly (supporting HA signaling to the Aiven management node and RPM download from Aiven repositories). ::: - + -BYOC GCP public architecture +BYOC Google Cloud public architecture -In the GCP public deployment model, a Virtual Private Cloud (**Workload VPC**) for your -Aiven services is created within a particular cloud region in your remote cloud account. -Aiven accesses this VPC through an Internet gateway. Service VMs reside in a publicly -addressed subnet (**Public subnet**), and Aiven services can be accessed -through the public Internet: the Aiven control plane connects to the nodes +In the Google Cloud public deployment model, a Virtual Private Cloud (**Workload VPC**) +for your Aiven services is created within a particular cloud region in your remote cloud +account. Aiven accesses this VPC through an internet gateway. Service VMs reside in a +publicly addressed subnet (**Public subnet**), and Aiven services can be accessed +through the public internet: the Aiven control plane connects to the nodes using the public address, and the Aiven management plane can access the service VMs -directly. +directly. To restrict access to your service, you can use the +[IP filter](/docs/platform/howto/restrict-access). @@ -181,18 +203,21 @@ Firewall rules are enforced on the subnet level. You can integrate your services using standard VPC peering techniques. All Aiven communication is encrypted. -## BYOC and backups +## BYOC service backups -Depending on the service used, Aiven takes regular backups to enable -forking, point in time recovery (PITR), and disaster recovery. These -backups by default do not reside in your cloud. If there is a +Depending on the BYOC service, Aiven takes +[regular service backups](/docs/platform/concepts/service_backups) to enable forking, point +in time recovery (PITR), and disaster recovery. +These backups by default do not reside in your cloud. If there is a requirement to have all backups in your own cloud account, it's still possible. To accomplish this, Aiven needs read-write permissions to access the object storage on your cloud account. :::important -All backups are encrypted using Aiven-managed keys, and you are -responsible for managing object storage configurations. + +- All backups are encrypted using Aiven-managed keys. +- You are responsible for managing object storage configuration. + ::: ## Dev tools for BYOC @@ -204,9 +229,7 @@ Aiven deployment model. ## Related pages -- [Enable the BYOC feature](/docs/platform/howto/byoc/enable-byoc) +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) +- [Enable bring your own cloud (BYOC)](/docs/platform/howto/byoc/enable-byoc) - [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) -- [Assign a project to your custom cloud](/docs/platform/howto/byoc/assign-project-custom-cloud) -- [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) -- [Tag custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources) -- [Rename your custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) +- [Manage services hosted in custom clouds](/docs/platform/howto/byoc/manage-byoc-service) diff --git a/docs/platform/howto/byoc/add-customer-info-custom-cloud.md b/docs/platform/howto/byoc/add-customer-info-custom-cloud.md index 6f4f3456d..976abe908 100644 --- a/docs/platform/howto/byoc/add-customer-info-custom-cloud.md +++ b/docs/platform/howto/byoc/add-customer-info-custom-cloud.md @@ -86,9 +86,7 @@ team if needed. ## Related pages -- [About bring your own cloud (BYOC)](/docs/platform/concepts/byoc) -- [Enable the bring your own cloud (BYOC) feature](/docs/platform/howto/byoc/enable-byoc) -- [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) +- [View the status of a custom cloud](/docs/platform/howto/byoc/view-custom-cloud-status) - [Assign a project to your custom cloud](/docs/platform/howto/byoc/assign-project-custom-cloud) +- [Rename a custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) - [Tag custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources) -- [Rename your custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) diff --git a/docs/platform/howto/byoc/assign-project-custom-cloud.md b/docs/platform/howto/byoc/assign-project-custom-cloud.md index e1f33e4aa..7ddea34b1 100644 --- a/docs/platform/howto/byoc/assign-project-custom-cloud.md +++ b/docs/platform/howto/byoc/assign-project-custom-cloud.md @@ -105,9 +105,7 @@ custom cloud, you can: ## Related pages -- [About bring your own cloud (BYOC)](/docs/platform/concepts/byoc) -- [Enable the bring your own cloud (BYOC) feature](/docs/platform/howto/byoc/enable-byoc) -- [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) +- [View the status of a custom cloud](/docs/platform/howto/byoc/view-custom-cloud-status) - [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) +- [Rename a custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) - [Tag custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources) -- [Rename your custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) diff --git a/docs/platform/howto/byoc/create-custom-cloud.md b/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud.md similarity index 63% rename from docs/platform/howto/byoc/create-custom-cloud.md rename to docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud.md index c4dc03eb5..8d4468965 100644 --- a/docs/platform/howto/byoc/create-custom-cloud.md +++ b/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud.md @@ -1,7 +1,7 @@ --- -title: Create a custom cloud -sidebar_label: Create custom clouds -keywords: [AWS, Amazon Web Services, GCP, Google Cloud Platform, byoc, bring your own cloud, custom cloud] +title: Create an AWS-integrated custom cloud +sidebar_label: Amazon Web Services +keywords: [AWS, Amazon Web Services, byoc, bring your own cloud, custom cloud] --- import ConsoleLabel from "@site/src/components/ConsoleIcons"; @@ -10,114 +10,45 @@ import TabItem from '@theme/TabItem'; Create a [custom cloud](/docs/platform/concepts/byoc) for BYOC in your Aiven organization to better address your specific business needs or project requirements. -:::note - -- Creating and using custom clouds in your Aiven organization requires - enabling - [the _bring your own cloud (BYOC)_ feature](/docs/platform/concepts/byoc). Check - [who is eligible for BYOC](/docs/platform/concepts/byoc#eligible-for-byoc). To - use the feature, - [enable BYOC in your Aiven organization](/docs/platform/howto/byoc/enable-byoc). -- Enabling - [the BYOC feature](/docs/platform/concepts/byoc) or creating custom clouds in your - Aiven environment does not affect the configuration of your existing organizations, - projects, or services. This only makes the new BYOC capabilities available in your - environment. +To configure a custom cloud in your Aiven organization and prepare your AWS +account so that Aiven can access it: -::: +1. In the Aiven Console or with the Aiven CLI client, you specify new cloud details to + generate a Terraform infrastructure-as-code template. +1. You download the generated template and deploy it in your AWS account to acquire IAM + Role ARN (Amazon Resource Name). +1. You deploy your custom cloud resources supplying the acquired IAM Role ARN to the Aiven + platform, which gives Aiven the permissions to securely access your AWS account, create + resources, and manage them onward. +1. You select projects that can use your new custom clouds for creating services. +1. You add contact details for individuals from your organization that Aiven can reach out + to in case of technical issues with the new cloud. -The process of creating a custom cloud in Aiven differs depending on the -cloud provider to integrate with: - - - -You configure your custom cloud setup in the [Aiven -Console](https://console.aiven.io/) and prepare your own AWS account so -that Aiven can access it. In the [Aiven Console](https://console.aiven.io/), -you follow the **Create custom cloud** workflow to generate a Terraform -infrastructure-as-code (IaC) template. Next, you deploy this template in -your AWS account to acquire IAM Role ARN (Amazon Resource Name). You -supply your IAM Role ARN into the **Create custom cloud** wizard, which -gives Aiven the permissions to securely access your AWS account, create -resources, and manage them onward. Finally, you select projects that can -use your new custom clouds for creating services, and you add customer -contacts for your custom cloud. - - -You create and configure a custom cloud via CLI, and you prepare your remote GCP account so -that Aiven can access it. Using the Aiven CLI, you generate an infrastructure-as-code -(IaC) template in the Terraform format. You download the template and deploy it in your -remote GCP cloud account to generate a privilege-bearing service account (SA), which Aiven -needs for accessing your GCP account only with permissions that are required. +## Before you start -:::note -Privilege-bearing service account (SA) is an -[identifier](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account) -of the [service account](https://cloud.google.com/iam/docs/service-account-types#user-managed) -created when running the IaC template in your Google account. Aiven [impersonates this -service account](https://cloud.google.com/iam/docs/create-short-lived-credentials-direct) -and runs operations, such as creating VMs for service nodes, in your BYOC account. -::: +### Prerequisites -Next, you deploy your custom cloud resources supplying the generated privilege-bearing SA -as a parameter. Finally, you select in which Aiven projects to use your custom cloud, and -you assign a contact person for your custom cloud. - - - -## Limitations {#byoc-limitations} - -- You need at least the Advanced tier of Aiven support services to be - eligible for activating BYOC. - - :::note - See [Aiven support tiers](https://aiven.io/support-services) and - [Aiven responsibility matrix](https://aiven.io/responsibility-matrix) for BYOC. - Contact your account team to learn more or upgrade your support tier. - ::: - -- Only [organization admin](/docs/platform/concepts/permissions#organization-roles-and-permissions) - can create custom clouds. - -## Prerequisites {#byoc-prerequisites} - - - - You have [enabled the BYOC feature](/docs/platform/howto/byoc/enable-byoc). - You have an active account with your cloud provider. -- Depending on the dev tool to use for creating a custom cloud, you have: - - Access to the [Aiven Console](https://console.aiven.io/) or - - [Aiven CLI](/docs/tools/cli) installed +- Depending on the tool to use for creating a custom cloud: + - Console: Access to the [Aiven Console](https://console.aiven.io/) or + - CLI: + - [Aiven CLI client](/docs/tools/cli) installed + - Aiven organization ID from the output of the `avn organization list` command or + from the [Aiven Console](https://console.aiven.io/) > + \> . - You have the [organization admin](/docs/platform/concepts/permissions#organization-roles-and-permissions) role in your Aiven organization. - You have Terraform installed. -- You have required [IAM permissions](#iam-permissions) - - -- You have [enabled the BYOC feature](/docs/platform/howto/byoc/enable-byoc). -- You have an active account with your cloud provider. -- You have the [Aiven CLI client](/docs/tools/cli) installed. -- You have the [organization admin](/docs/platform/concepts/permissions#organization-roles-and-permissions) - role in your Aiven organization. -- You have [Terraform](/docs/tools/terraform) installed. -- You have required [IAM permissions](#iam-permissions). -- You have your Aiven organization ID from: - - - Output of the `avn organization list` command - - [Aiven Console](https://console.aiven.io/) > - \> . - - - +- You have required + [IAM permissions](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#iam-permissions). ### IAM permissions You need cloud account credentials set up on your machine so that your user or role has required Terraform permissions -[to integrate with your cloud provider](/docs/platform/howto/byoc/create-custom-cloud#create-cloud). +[to integrate with your cloud provider](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#create-a-custom-cloud). - -
Show permissions required for creating resources for bastion and workload networks @@ -468,62 +399,49 @@ Show permissions required for creating resources for bastion and workload networ ```
- - -
-Show permissions needed by your service account that will run the Terraform script in your -Google project - -- `roles/iam.serviceAccountAdmin` (sets up impersonation to the privilege-bearing service account) -- `roles/resourcemanager.projectIamAdmin` (provides permissions to the privilege-bearing - service account to use your project) -- `roles/compute.instanceAdmin.v1` (manages networks and instances) -- `roles/compute.securityAdmin` (creates firewall rules) -- Enable [Identity and Access Management (IAM) API](https://cloud.google.com/iam/docs/reference/rest) - to create the privilege-bearing service account -- Enable - [Cloud Resource Manager (CRM) API](https://cloud.google.com/resource-manager/reference/rest) - to set IAM policies to the privilege-bearing service account -- Enable - [Compute Engine API](https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com). -
-For more information on Google Cloud roles, see -[IAM basic and predefined roles reference](https://cloud.google.com/iam/docs/understanding-roles) -in the Goodle Cloud documentation. - - -## Create a custom cloud {#create-cloud} +## Create a custom cloud -How you create a custom cloud in Aiven depends on what cloud provider you use. +Create a custom cloud either in the Aiven Console or with the Aiven CLI. - + #### Launch the BYOC setup -1. Log in to the [Aiven Console](https://console.aiven.io/), and go to a organization. +1. Log in to the [Aiven Console](https://console.aiven.io/), and go to an organization. 1. Click **Admin** in the top navigation, and click in the sidebar. 1. In the **Bring your own cloud** view, select **Create custom cloud**. -#### Generate an infrastructure template {#generate-infra-template} +#### Generate an infrastructure template In this step, an IaC template is generated in the Terraform format. In -[the next step](/docs/platform/howto/byoc/create-custom-cloud#deploy-template), +[the next step](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#deploy-the-template), you'll deploy this template in your AWS account to acquire Role ARN (Amazon Resource Name), which Aiven needs for accessing your AWS account. In the **Create custom cloud** wizard: -1. Specify the following: +1. Specify cloud details: + - Cloud provider + - Region - Custom cloud name + - [Infrastructure tags](/docs/platform/howto/byoc/tag-custom-cloud-resources) - - Cloud provider + Click **Next**. - - Region +1. Specify deployment and storage details: + + - [Deployment model](/docs/platform/concepts/byoc#byoc-architecture) + + Choose between: + - Private model, which routes traffic through a proxy for additional security + utilizing a bastion host logically separated from the Aiven services. + - Public model, which allows the Aiven control plane to connect to the service + nodes via the public internet. - CIDR @@ -560,24 +478,13 @@ In the **Create custom cloud** wizard: cannot change the BYOC VPC CIDR block after your custom cloud is created. - - Deployment model: Choose between - [the private architecture and the public architecture](/docs/platform/concepts/byoc). - - - Private model routes traffic through a proxy for additional security utilizing - a bastion host physically separated from the Aiven services. - - Public model allows the Aiven control plane to connect to the service nodes - via the public internet. - - - Infrastructure tags: Select key-value pairs to - [tag your custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources). - -1. Select **Next**. + Click **Generate template**. Your IaC Terraform template gets generated based on your inputs. You can view, copy, or download it. Now, you can use the template to -[acquire Role ARN](/docs/platform/howto/byoc/create-custom-cloud#deploy-template). +[acquire Role ARN](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#deploy-the-template). -#### Deploy the template{#deploy-template} +#### Deploy the template Role ARN is an [identifier of the role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) @@ -587,10 +494,11 @@ role](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) and run operations such as creating VMs for service nodes in your BYOC account. -Use the Terraform template generated in step -[Generate an infrastructure template](/docs/platform/howto/byoc/create-custom-cloud#generate-infra-template) -to create your Role ARN by deploying the template in your -AWS account. Continue working in the **Create custom cloud** wizard: +Use the +[generated Terraform template](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#generate-an-infrastructure-template) +to create your Role ARN by deploying the template in your AWS account. + +Continue working in the **Create custom cloud** wizard: 1. Copy or download the template and the variables file from the **Create custom cloud** wizard. @@ -613,17 +521,17 @@ AWS account. Continue working in the **Create custom cloud** wizard: provided variables. :::important - When running `terraform plan` and `terraform apply`, add `-var-file=FILE_NAME.vars` + When running `terraform plan` and `terraform apply`, add `-var-file=FILE_NAME.tfvars` as an option. ::: -1. Find the role identifier (Role ARN) in the output script after +1. Find a role identifier (Role ARN) in the output script after running the template. -1. Enter Role ARN into the **Role ARN** field in the **Create custom +1. Enter Role ARN into the **IAM role ARN** field in the **Create custom cloud** wizard. -1. Select **Next** to proceed or park your cloud setup and save +1. Click **Next** to proceed or park your cloud setup and save your current configuration as a draft by selecting **Save draft**. You can resume creating your cloud later. @@ -641,24 +549,14 @@ Your cloud can be available in: - Selected organizational units - Specific projects only -Continue working in the **Create custom cloud** wizard: +To set up your cloud's availability in the **Create custom cloud** wizard > +the **Assign BYOC to projects** section, select one of the two following options: -1. In the **Custom cloud's availability in your organization** - section, select either: - - - **By default for all projects** to make your custom cloud - available in all existing and future projects in the - organization - - or - - - **By selection** to pick specific projects or organizational - units where you want your custom cloud to be available. - -1. If you go for the **By selection** option, menus **Assign organizational units** and - **Assign projects** show up. Use them to - select organizational units and/or projects in which to use your custom - cloud. +- **By default for all projects** to make your custom cloud + available in all existing and future projects in the + organization +- **By selection** to pick specific projects or organizational + units where you want your custom cloud to be available. :::note By selecting an organizational unit, you make your custom cloud @@ -667,27 +565,26 @@ available from all the projects in this unit. #### Add customer contacts -Select at least one person whom Aiven can contact in case any technical -issues with your custom cloud need fixing. +Select at least one person whom Aiven can contact in case of any technical +issues with your custom cloud. :::note **Admin** is a mandatory role, which is required as a primary support contact. ::: -1. In the **Customer contacts** section, select a contact person's - role using the **Job title** menu, and provide their email +In the **Create custom cloud** wizard > the **Customer contacts** section: + +1. Select a contact person's role using the **Job title** menu, and provide their email address in the **Email** field. 1. Use **+ Add another contact** to add as many customer contacts as needed for your custom cloud. -1. Select **Create**. +1. Click **Save and validate**. -The custom cloud process has been initiated for you, which is -communicated in the the **Create custom cloud** wizard as **Creating -your custom cloud**. +The custom cloud process has been initiated. #### Complete the cloud setup -Select **Close** to close the **Create custom cloud** wizard. +Select **Done** to close the **Create custom cloud** wizard. The deployment of your new custom cloud might take a few minutes. As soon as it's over, and your custom cloud is ready to use, you'll be @@ -698,16 +595,18 @@ cloud** view. Your new custom cloud is ready to use only after its status changes to **Active**. ::: + + - -1. Generate an IaC template by running [avn byoc create](/docs/tools/cli/byoc#avn-byoc-create). +1. Generate an infrastructure template by running + [avn byoc create](/docs/tools/cli/byoc#avn-byoc-create). ```bash avn byoc create \ - --organization-id "ORGANIZATION_ID" \ + --organization-id "ORGANIZATION_ID" \ --deployment-model "DEPLOYMENT_MODEL_NAME" \ - --cloud-provider "google" \ + --cloud-provider "aws" \ --cloud-region "CLOUD_REGION_NAME" \ --reserved-cidr "CIDR_BLOCK" \ --display-name "CUSTOM_CLOUD_DISPLAY_NAME" @@ -718,19 +617,19 @@ Your new custom cloud is ready to use only after its status changes to - `ORGANIZATION_ID` with the ID of your Aiven organization to connect with your own cloud account to create the custom cloud, for example `org123a456b789`. Get your `ORGANIZATION_ID` - [from the Aiven Console or CLI](#byoc-prerequisites). - - `DEPLOYMENT_MODEL_NAME` with the type of [network architecture](/docs/platform/concepts/byoc#byoc-deployment) + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#prerequisites). + - `DEPLOYMENT_MODEL_NAME` with the type of [network architecture](/docs/platform/concepts/byoc#byoc-architecture) your custom cloud uses: - `standard_public` (public) model: The nodes have public IPs and can be configured to be publicly accessible for authenticated users. The Aiven control plane can connect to the service nodes via the public internet. - `standard` (private) model: The nodes reside in a VPC without public IP addresses and are by default not accessible from outside. Traffic is routed through a proxy - for additional security utilizing a bastion host physically separated from the + for additional security utilizing a bastion host logically separated from the Aiven services. - - `CLOUD_REGION_NAME` with the name of a Google region where to create your custom cloud, + - `CLOUD_REGION_NAME` with the name of an AWS cloud region where to create your custom cloud, for example `europe-north1`. See all available options in - [Google Cloud regions](/docs/platform/reference/list_of_clouds#google-cloud). + [AWS cloud regions](/docs/platform/reference/list_of_clouds#amazon-web-services). - `CIDR_BLOCK` with a CIDR block defining the IP address range of the VPC that Aiven creates in your own cloud account, for example: `10.0.0.0/16`, `172.31.0.0/16`, or `192.168.0.0/20`. @@ -744,7 +643,7 @@ Your new custom cloud is ready to use only after its status changes to ```json { "custom_cloud_environment": { - "cloud_provider": "google", + "cloud_provider": "aws", "cloud_region": "europe-north1", "contact_emails": [ { @@ -755,7 +654,7 @@ Your new custom cloud is ready to use only after its status changes to ], "custom_cloud_environment_id": "018b6442-c602-42bc-b63d-438026133f60", "deployment_model": "standard", - "display_name": "My BYOC Cloud on Google", + "display_name": "My BYOC Cloud on AWS", "errors": [], "reserved_cidr": "10.0.0.0/16", "state": "draft", @@ -774,8 +673,8 @@ Your new custom cloud is ready to use only after its status changes to - [avn byoc template terraform get-template](/docs/tools/cli/byoc#avn-byoc-template-terraform-get-template) ```bash - avn byoc template terraform get-template \ - --organization-id "ORGANIZATION_ID" \ + avn byoc template terraform get-template \ + --organization-id "ORGANIZATION_ID" \ --byoc-id "CUSTOM_CLOUD_ID" >| "tf_dir/tf_file.tf" ``` @@ -784,7 +683,7 @@ Your new custom cloud is ready to use only after its status changes to - `ORGANIZATION_ID` with the ID of your Aiven organization to connect with your own cloud account to create the custom cloud, for example `org123a456b789`. Get your `ORGANIZATION_ID` - [from the Aiven Console or CLI](#byoc-prerequisites). + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#prerequisites). - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) command, for example `018b6442-c602-42bc-b63d-438026133f60`. @@ -792,9 +691,9 @@ Your new custom cloud is ready to use only after its status changes to - [avn byoc template terraform get-vars](/docs/tools/cli/byoc#avn-byoc-template-terraform-get-vars) ```bash - avn byoc template terraform get-vars \ - --organization-id "ORGANIZATION_ID" \ - --byoc-id "CUSTOM_CLOUD_ID" >| "tf_dir/tf_file.vars" + avn byoc template terraform get-vars \ + --organization-id "ORGANIZATION_ID" \ + --byoc-id "CUSTOM_CLOUD_ID" >| "tf_dir/tf_file.tfvars" ``` Replace the following: @@ -802,7 +701,7 @@ Your new custom cloud is ready to use only after its status changes to - `ORGANIZATION_ID` with the ID of your Aiven organization to connect with your own cloud account to create the custom cloud, for example `org123a456b789`. Get your `ORGANIZATION_ID` - [from the Aiven Console or CLI](#byoc-prerequisites). + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#prerequisites). - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) command, for example `018b6442-c602-42bc-b63d-438026133f60`. @@ -813,7 +712,7 @@ Your new custom cloud is ready to use only after its status changes to To connect to a custom-cloud service from different security groups (other than the one dedicated for the custom cloud) or from IP address ranges, add specific ingress rules before you apply a - Terraform infrastructure template in your GCP account in the process + Terraform infrastructure template in your AWS cloud account in the process of creating a custom cloud resources. Before adding ingress rules, see the examples provided in the @@ -822,24 +721,23 @@ Your new custom cloud is ready to use only after its status changes to ::: 1. Use Terraform to deploy the infrastructure template with the provided variables in - your GCP account. This will generate a privilege-bearing service account (SA). + your AWS cloud account. This will generate a Role ARN. :::important - When running `terraform plan` and `terraform apply`, add `-var-file=FILE_NAME.vars` + When running `terraform plan` and `terraform apply`, add `-var-file=FILE_NAME.tfvars` as an option. ::: - 1. Find `privilege_bearing_service_account_id` in the output script after running - the template. + 1. Find `aws-iam-role-arn` in the output script after running the template. 1. Provision resources by running [avn byoc provision](/docs/tools/cli/byoc#avn-byoc-provision) - and passing the generated `google-privilege-bearing-service-account-id` as an option. + and passing the generated `aws-iam-role-arn` as an option. ```bash - avn byoc provision \ - --organization-id "ORGANIZATION_ID" \ - --byoc-id "CUSTOM_CLOUD_ID" \ - --google-privilege-bearing-service-account-id "GENERATED_SERVICE_ACCOUNT_ID" + avn byoc provision \ + --organization-id "ORGANIZATION_ID" \ + --byoc-id "CUSTOM_CLOUD_ID" \ + --aws-iam-role-arn "GENERATED_ROLE_ARN" ``` Replace the following: @@ -847,22 +745,20 @@ Your new custom cloud is ready to use only after its status changes to - `ORGANIZATION_ID` with the ID of your Aiven organization to connect with your own cloud account to create the custom cloud, for example `org123a456b789`. Get your `ORGANIZATION_ID` - [from the Aiven Console or CLI](#byoc-prerequisites). + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#prerequisites). - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) command, for example `018b6442-c602-42bc-b63d-438026133f60`. - - `GENERATED_SERVICE_ACCOUNT_ID` with the identifier of the service account - created when running the infrastructure template in your Google Cloud account, - for example - `projects/your-project/serviceAccounts/cce-cce0123456789a@your-project.iam.gserviceaccount.com`. - You can extract `GENERATED_SERVICE_ACCOUNT_ID` from the output of the `terraform apply` + - `GENERATED_ROLE_ARN` with the identifier of the role created when running the + infrastructure template in your AWS cloud account. + You can extract `GENERATED_ROLE_ARN` from the output of the `terraform apply` command or `terraform output` command. 1. Enable your custom cloud in organizations, projects, or units by running [avn byoc cloud permissions add](/docs/tools/cli/byoc#avn-byoc-cloud-permissions-add). ```bash - avn byoc cloud permissions add \ + avn byoc cloud permissions add \ --organization-id "ORGANIZATION_ID" \ --byoc-id "CUSTOM_CLOUD_ID" \ --account "ACCOUNT_ID" @@ -873,7 +769,7 @@ Your new custom cloud is ready to use only after its status changes to - `ORGANIZATION_ID` with the ID of your Aiven organization to connect with your own cloud account to create the custom cloud, for example `org123a456b789`. Get your `ORGANIZATION_ID` - [from the Aiven Console or CLI](#byoc-prerequisites). + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#prerequisites). - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) command, for example `018b6442-c602-42bc-b63d-438026133f60`. @@ -885,7 +781,7 @@ Your new custom cloud is ready to use only after its status changes to [avn byoc update](/docs/tools/cli/byoc#avn-byoc-update). ```bash - avn byoc update \ + avn byoc update \ --organization-id "ORGANIZATION_ID" \ --byoc-id "CUSTOM_CLOUD_ID" \ ' @@ -906,7 +802,7 @@ Your new custom cloud is ready to use only after its status changes to - `ORGANIZATION_ID` with the ID of your Aiven organization to connect with your own cloud account to create the custom cloud, for example `org123a456b789`. Get your `ORGANIZATION_ID` - [from the Aiven Console or CLI](#byoc-prerequisites). + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud#prerequisites). - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) command, for example `018b6442-c602-42bc-b63d-438026133f60`. @@ -914,63 +810,8 @@ Your new custom cloud is ready to use only after its status changes to -## Check your cloud's status - -1. Log in to [Aiven Console](https://console.aiven.io/) as an - administrator, and go to an organization. -1. From the top navigation bar, select **Admin**. -1. From the left sidebar, select . -1. In the **Bring your own cloud** view, identify your new cloud on the - list of available clouds and check its status in the **Status** - column. - -When your custom cloud's status is **Active**, its deployment has been completed. Your -custom cloud is ready to use and you can see it on the list of your custom clouds in the -**Bring your own cloud** view. Now you can create new services in the custom cloud or -migrate your existing services to the custom cloud if your service and networking -configuration allows it. For more information on migrating your existing services to the -custom cloud, contact your account team. - -## Manage services in custom clouds - -### Create a service in the custom cloud - - - -To create a service in the [Aiven Console](https://console.aiven.io/) in your new -custom cloud, follow the guidelines in -[Create a service](/docs/platform/howto/create_new_service). - -When creating a service in the [Aiven Console](https://console.aiven.io/), at the -**Select service region** step, select **Custom clouds** from the available regions. - - -To create a service hosted in your new custom cloud, run -[avn service create](/docs/tools/cli/service-cli#avn-cli-service-create) passing your new -custom cloud name as an option: - - ```bash - avn service create \ - --project "PROJECT_NAME" \ - --service-type "TYPE_OF_BYOC_SERVICE" \ - --plan "PLAN_OF_BYOC_SERVICE" \ - --cloud "CUSTOM_CLOUD_NAME" \ - "NEW_BYOC_SERVICE_NAME" - ``` - - - - -### Migrate existing services to the custom cloud - -Whether you can migrate existing services to the custom cloud depends on your service and -networking configuration. Contact your account team for more information. - ## Related pages -- [About bring your own cloud (BYOC)](/docs/platform/concepts/byoc) -- [Enable bring your own cloud (BYOC)](/docs/platform/howto/byoc/enable-byoc) -- [Assign a project to your custom cloud](/docs/platform/howto/byoc/assign-project-custom-cloud) -- [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) -- [Tag custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources) -- [Rename your custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) +- [View the status of a custom cloud](/docs/platform/howto/byoc/view-custom-cloud-status) +- [Manage services hosted in custom clouds](/docs/platform/howto/byoc/manage-byoc-service) diff --git a/docs/platform/howto/byoc/create-custom-cloud/create-custom-cloud.md b/docs/platform/howto/byoc/create-custom-cloud/create-custom-cloud.md new file mode 100644 index 000000000..6a181da86 --- /dev/null +++ b/docs/platform/howto/byoc/create-custom-cloud/create-custom-cloud.md @@ -0,0 +1,47 @@ +--- +title: Create a custom cloud +sidebar_label: Create custom clouds +keywords: [AWS, Amazon Web Services, GCP, Google Cloud Platform, byoc, bring your own cloud, custom cloud] +--- + +import DocCardList from '@theme/DocCardList'; +import ConsoleLabel from "@site/src/components/ConsoleIcons"; +import Card from "@site/src/components/AivenCard"; +import GridContainer from "@site/src/components/GridContainer"; +import Cassandra from "@site/static/images/logos/cassandra.svg"; + +To create custom clouds in Aiven using self-service, select your cloud provider to integrate with. + + + + + + +#### Limitations + +- You need at least the Advanced tier of Aiven support services to be + eligible for activating BYOC. + + :::tip + See [Aiven support tiers](https://aiven.io/support-services) and + [Aiven responsibility matrix](https://aiven.io/responsibility-matrix) for BYOC. + Contact your account team to learn more or upgrade your support tier. + ::: + +- Only [organization admins](/docs/platform/concepts/permissions#organization-roles-and-permissions) + can create custom clouds. + +#### Related pages + +- [About bring your own cloud](/docs/platform/concepts/byoc) +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) diff --git a/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud.md b/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud.md new file mode 100644 index 000000000..f8b591803 --- /dev/null +++ b/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud.md @@ -0,0 +1,491 @@ +--- +title: Create a Google-integrated custom cloud +sidebar_label: Google Cloud +keywords: [Google Cloud, GCP, Google Cloud Platform, byoc, bring your own cloud, custom cloud] +--- + +import ConsoleLabel from "@site/src/components/ConsoleIcons"; +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +Create a [custom cloud](/docs/platform/concepts/byoc) for BYOC in your Aiven organization to better address your specific business needs or project requirements. + +To configure a custom cloud in your Aiven organization and prepare your Google Cloud +account so that Aiven can access it: + +1. In the Aiven Console or with the Aiven CLI client, you specify new cloud details to + generate a Terraform infrastructure-as-code template. +1. You download the generated template and deploy it in your Google Cloud account to acquire + a privilege-bearing service account, which Aiven needs for accessing your Google + Cloud account only with permissions that are required. + + :::note + Privilege-bearing service account is an + [identifier](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account#id) + of the [service account](https://cloud.google.com/iam/docs/service-account-types#user-managed) + created when running the infrastructure template in your Google Cloud account. Aiven + [impersonates this service account](https://cloud.google.com/iam/docs/create-short-lived-credentials-direct) + and runs operations, such as creating VMs for service nodes, in your BYOC account. + ::: + +1. You deploy your custom cloud resources supplying the generated privilege-bearing service + account to the Aiven platform, which gives Aiven the permissions + to securely access your Google Cloud account, create resources, and manage them onward. +1. You select Aiven projects that can use your new custom clouds for creating services. +1. You add contact details for individuals from your organization that Aiven can reach out + to in case of technical issues with the new cloud. + +## Before you start + +### Prerequisites + +- You have [enabled the BYOC feature](/docs/platform/howto/byoc/enable-byoc). +- You have an active account with your cloud provider. +- Depending on the tool to use for creating a custom cloud: + - Console: Access to the [Aiven Console](https://console.aiven.io/) or + - CLI: + - [Aiven CLI client](/docs/tools/cli) installed + - Aiven organization ID from the output of the `avn organization list` command or + from the [Aiven Console](https://console.aiven.io/) > + \> . +- You have the [organization admin](/docs/platform/concepts/permissions#organization-roles-and-permissions) + role in your Aiven organization. +- You have Terraform installed. +- You have required + [IAM permissions](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#iam-permissions). + +### IAM permissions + +You need cloud account credentials set up on your machine so that your user or role has +required Terraform permissions +[to integrate with your cloud provider](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#create-a-custom-cloud). + +
+Show permissions needed by your service account that will run the Terraform script in your +Google project + +- `roles/iam.serviceAccountAdmin` (sets up impersonation to the privilege-bearing service account) +- `roles/resourcemanager.projectIamAdmin` (provides permissions to the privilege-bearing + service account to use your project) +- `roles/compute.instanceAdmin.v1` (manages networks and instances) +- `roles/compute.securityAdmin` (creates firewall rules) +- Enable [Identity and Access Management (IAM) API](https://cloud.google.com/iam/docs/reference/rest) + to create the privilege-bearing service account +- Enable + [Cloud Resource Manager (CRM) API](https://cloud.google.com/resource-manager/reference/rest) + to set IAM policies to the privilege-bearing service account +- Enable + [Compute Engine API](https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com). +
+For more information on Google Cloud roles, see +[IAM basic and predefined roles reference](https://cloud.google.com/iam/docs/understanding-roles) +in the Goodle Cloud documentation. + +## Create a custom cloud + +Create a custom cloud either in the Aiven Console or with the Aiven CLI. + + + + +#### Launch the BYOC setup + +1. Log in to the [Aiven Console](https://console.aiven.io/), and go to an organization. +1. Click **Admin** in the top navigation, and click + in the sidebar. +1. In the **Bring your own cloud** view, select **Create custom cloud**. + +#### Generate an infrastructure template + +In this step, an IaC template is generated in the Terraform format. In +[the next step](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#deploy-the-template), +you'll deploy this template in your Google Cloud account to acquire a privilege-bearing +service account (SA), which Aiven needs for accessing your Google Cloud account. + +In the **Create custom cloud** wizard: + +1. Specify cloud details: + + - Cloud provider + - Region + - Custom cloud name + - [Infrastructure tags](/docs/platform/howto/byoc/tag-custom-cloud-resources) + + Click **Next**. + +1. Specify deployment and storage details: + + - [Deployment model](/docs/platform/concepts/byoc#byoc-architecture) + + Choose between: + - Private model, which routes traffic through a proxy for additional security + utilizing a bastion host logically separated from the Aiven services. + - Public model, which allows the Aiven control plane to connect to the service + nodes via the public internet. + + - CIDR + + The **CIDR** block defines the IP address range of the VPC that + Aiven creates in your own cloud account. Any Aiven service created in + the custom cloud will be placed in the VPC and will get an IP + address within this address range. + + In the **CIDR** field, specify an IP address range for the BYOC + VPC using a CIDR block notation, for example: `10.0.0.0/16`, + `172.31.0.0/16`, or `192.168.0.0/20`. + + Make sure that an IP address range you use meets the following + requirements: + + - IP address range is within the private IP address ranges + allowed in [RFC + 1918](https://datatracker.ietf.org/doc/html/rfc1918). + + - CIDR block size is between `/16` (65536 IP addresses) and + `/24` (256 IP addresses). + + - CIDR block is large enough to host the desired number of + services after splitting it into per-availability-zone + subnets. + + For example, the smallest `/24` CIDR block might be enough + for a few services but can pose challenges during node + replacements or maintenance upgrades if running low on + available free IP addresses. + + - CIDR block of your BYOC VCP doesn't overlap with the CIDR + blocks of VPCs you plan to peer your BYOC VPC with. You + cannot change the BYOC VPC CIDR block after your custom + cloud is created. + + Click **Generate template**. + +Your infrastructure Terraform template gets generated based on your inputs. You can +view, copy, or download it. Now, you can use the template to acquire a privilege-bearing +service account. + +#### Deploy the template + +Use the +[generated Terraform template](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#generate-an-infrastructure-template) +to create a privilege-bearing service account by deploying the template in your Google +Cloud account. + +Continue working in the **Create custom cloud** wizard: + +1. Copy or download the template and the variables file from the + **Create custom cloud** wizard. + +1. Optionally, modify the template as needed. + + :::note + To connect to a custom-cloud service from different security groups + (other than the one dedicated for the custom cloud) or from IP + address ranges, add specific ingress rules before you apply the + Terraform infrastructure template in your Google Cloud account in the process + of creating a custom cloud resources. + + Before adding ingress rules, see the examples provided in the + Terraform template you generated and downloaded from [Aiven + Console](https://console.aiven.io/). + ::: + +1. Use Terraform to deploy the infrastructure template in your Google Cloud account with + the provided variables. + + :::important + When running `terraform plan` and `terraform apply`, add `-var-file=FILE_NAME.tfvars` + as an option. + ::: + +1. Find a privilege-bearing service account in the output script after + running the template. + +1. Supply the privilege-bearing service account into the **Create custom cloud** wizard. + +1. Click **Next** to proceed or park your cloud setup and save + your current configuration as a draft by selecting **Save draft**. + You can resume creating your cloud later. + +#### Set up your custom cloud's availability + +Select in which projects you'll be able to use your new custom cloud as a hosting cloud for +services. In the projects where you enable your custom cloud, you can create new +services in the custom cloud or migrate your existing services to the custom cloud if your +service and networking configuration allows it. For more information on migrating your +existing services to the custom cloud, contact your account team. + +Your cloud can be available in: + +- All the projects in your organization +- Selected organizational units +- Specific projects only + +To set up your cloud's availability in the **Create custom cloud** wizard > +the **Assign BYOC to projects** section, select one of the two following options: + +- **By default for all projects** to make your custom cloud + available in all existing and future projects in the + organization +- **By selection** to pick specific projects or organizational + units where you want your custom cloud to be available. + +:::note +By selecting an organizational unit, you make your custom cloud +available from all the projects in this unit. +::: + +#### Add customer contacts + +Select at least one person whom Aiven can contact in case of any technical +issues with your custom cloud. + +:::note +**Admin** is a mandatory role, which is required as a primary support contact. +::: + +In the **Create custom cloud** wizard > the **Customer contacts** section: + +1. Select a contact person's role using the **Job title** menu, and provide their email + address in the **Email** field. +1. Use **+ Add another contact** to add as many customer contacts as + needed for your custom cloud. +1. Click **Save and validate**. + +The custom cloud process has been initiated. + +#### Complete the cloud setup + +Select **Done** to close the **Create custom cloud** wizard. + +The deployment of your new custom cloud might take a few minutes. As +soon as it's over, and your custom cloud is ready to use, you'll be +able to see it in the list of your custom clouds in the **Bring your own +cloud** view. + +:::note +Your new custom cloud is ready to use only after its status changes to +**Active**. +::: + + + + +1. Generate an IaC template by running [avn byoc create](/docs/tools/cli/byoc#avn-byoc-create). + + ```bash + avn byoc create \ + --organization-id "ORGANIZATION_ID" \ + --deployment-model "DEPLOYMENT_MODEL_NAME" \ + --cloud-provider "google" \ + --cloud-region "CLOUD_REGION_NAME" \ + --reserved-cidr "CIDR_BLOCK" \ + --display-name "CUSTOM_CLOUD_DISPLAY_NAME" + ``` + + Replace the following: + + - `ORGANIZATION_ID` with the ID of your Aiven organization to + connect with your own cloud account to create the custom cloud, + for example `org123a456b789`. Get your `ORGANIZATION_ID` + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#prerequisites). + - `DEPLOYMENT_MODEL_NAME` with the type of [network architecture](/docs/platform/concepts/byoc#byoc-architecture) + your custom cloud uses: + - `standard_public` (public) model: The nodes have public IPs and can be configured + to be publicly accessible for authenticated users. The Aiven control plane can + connect to the service nodes via the public internet. + - `standard` (private) model: The nodes reside in a VPC without public IP addresses + and are by default not accessible from outside. Traffic is routed through a proxy + for additional security utilizing a bastion host logically separated from the + Aiven services. + - `CLOUD_REGION_NAME` with the name of a Google region where to create your custom cloud, + for example `europe-north1`. See all available options in + [Google Cloud regions](/docs/platform/reference/list_of_clouds#google-cloud). + - `CIDR_BLOCK` with a CIDR block defining the IP address range of the VPC that Aiven + creates in your own cloud account, for example: `10.0.0.0/16`, `172.31.0.0/16`, or + `192.168.0.0/20`. + - `CUSTOM_CLOUD_DISPLAY_NAME` with the name of your custom cloud, which you can set + arbitrarily. + +
+ Show sample output + + + ```json + { + "custom_cloud_environment": { + "cloud_provider": "google", + "cloud_region": "europe-north1", + "contact_emails": [ + { + "email": "firstname.secondname@domain.com", + "real_name": "Test User", + "role": "Admin" + } + ], + "custom_cloud_environment_id": "018b6442-c602-42bc-b63d-438026133f60", + "deployment_model": "standard", + "display_name": "My BYOC Cloud on Google", + "errors": [], + "reserved_cidr": "10.0.0.0/16", + "state": "draft", + "tags": {}, + "update_time": "2024-05-07T14:24:18Z" + } + } + ``` + +
+ +1. Deploy the IaC template. + + 1. Download the template and the variable file: + + - [avn byoc template terraform get-template](/docs/tools/cli/byoc#avn-byoc-template-terraform-get-template) + + ```bash + avn byoc template terraform get-template \ + --organization-id "ORGANIZATION_ID" \ + --byoc-id "CUSTOM_CLOUD_ID" >| "tf_dir/tf_file.tf" + ``` + + Replace the following: + + - `ORGANIZATION_ID` with the ID of your Aiven organization to + connect with your own cloud account to create the custom cloud, + for example `org123a456b789`. Get your `ORGANIZATION_ID` + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#prerequisites). + - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can + extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) + command, for example `018b6442-c602-42bc-b63d-438026133f60`. + + - [avn byoc template terraform get-vars](/docs/tools/cli/byoc#avn-byoc-template-terraform-get-vars) + + ```bash + avn byoc template terraform get-vars \ + --organization-id "ORGANIZATION_ID" \ + --byoc-id "CUSTOM_CLOUD_ID" >| "tf_dir/tf_file.tfvars" + ``` + + Replace the following: + + - `ORGANIZATION_ID` with the ID of your Aiven organization to + connect with your own cloud account to create the custom cloud, + for example `org123a456b789`. Get your `ORGANIZATION_ID` + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#prerequisites). + - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can + extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) + command, for example `018b6442-c602-42bc-b63d-438026133f60`. + + 1. Optionally, modify the template as needed. + + :::note + To connect to a custom-cloud service from different security groups + (other than the one dedicated for the custom cloud) or from IP + address ranges, add specific ingress firewall rules before you apply the + Terraform infrastructure template in your Google Cloud account in the process + of creating a custom cloud resources. + + Before adding ingress rules, see the examples provided in the + Terraform template you generated and downloaded from the [Aiven + Console](https://console.aiven.io/). + ::: + + 1. Use Terraform to deploy the infrastructure template with the provided variables in + your Google Cloud account. This will generate a privilege-bearing service account (SA). + + :::important + When running `terraform plan` and `terraform apply`, add `-var-file=FILE_NAME.tfvars` + as an option. + ::: + + 1. Find `privilege_bearing_service_account_id` in the output script after running + the template. + +1. Provision resources by running [avn byoc provision](/docs/tools/cli/byoc#avn-byoc-provision) + and passing the generated `google-privilege-bearing-service-account-id` as an option. + + ```bash + avn byoc provision \ + --organization-id "ORGANIZATION_ID" \ + --byoc-id "CUSTOM_CLOUD_ID" \ + --google-privilege-bearing-service-account-id "GENERATED_SERVICE_ACCOUNT_ID" + ``` + + Replace the following: + + - `ORGANIZATION_ID` with the ID of your Aiven organization to + connect with your own cloud account to create the custom cloud, + for example `org123a456b789`. Get your `ORGANIZATION_ID` + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#prerequisites). + - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can + extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) + command, for example `018b6442-c602-42bc-b63d-438026133f60`. + - `GENERATED_SERVICE_ACCOUNT_ID` with the identifier of the service account + created when running the infrastructure template in your Google Cloud account, + for example + `projects/your-project/serviceAccounts/cce-cce0123456789a@your-project.iam.gserviceaccount.com`. + You can extract `GENERATED_SERVICE_ACCOUNT_ID` from the output of the `terraform apply` + command or `terraform output` command. + +1. Enable your custom cloud in organizations, projects, or units by running + [avn byoc cloud permissions add](/docs/tools/cli/byoc#avn-byoc-cloud-permissions-add). + + ```bash + avn byoc cloud permissions add \ + --organization-id "ORGANIZATION_ID" \ + --byoc-id "CUSTOM_CLOUD_ID" \ + --account "ACCOUNT_ID" + ``` + + Replace the following: + + - `ORGANIZATION_ID` with the ID of your Aiven organization to + connect with your own cloud account to create the custom cloud, + for example `org123a456b789`. Get your `ORGANIZATION_ID` + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#prerequisites). + - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can + extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) + command, for example `018b6442-c602-42bc-b63d-438026133f60`. + - `ACCOUNT_ID` with the identifier of your account (organizational unit) in Aiven, + for example `a484338c34d7`. You can extract `ACCOUNT_ID` from the output of + the `avn organization list` command. + +1. Add customer contacts for the new cloud by running + [avn byoc update](/docs/tools/cli/byoc#avn-byoc-update). + + ```bash + avn byoc update \ + --organization-id "ORGANIZATION_ID" \ + --byoc-id "CUSTOM_CLOUD_ID" \ + ' + { + "contact_emails": [ + { + "email": "EMAIL_ADDRESS", + "real_name": "John Doe", + "role": "Admin" + } + ] + } + ' + ``` + + Replace the following: + + - `ORGANIZATION_ID` with the ID of your Aiven organization to + connect with your own cloud account to create the custom cloud, + for example `org123a456b789`. Get your `ORGANIZATION_ID` + [from the Aiven Console or CLI](/docs/platform/howto/byoc/create-custom-cloud/create-google-custom-cloud#prerequisites). + - `CUSTOM_CLOUD_ID` with the identifier of your custom cloud, which you can + extract from the output of the [avn byoc list](/docs/tools/cli/byoc#avn-byoc-list) + command, for example `018b6442-c602-42bc-b63d-438026133f60`. + + + + +## Related pages + +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) +- [View the status of a custom cloud](/docs/platform/howto/byoc/view-custom-cloud-status) +- [Manage services hosted in custom clouds](/docs/platform/howto/byoc/manage-byoc-service) diff --git a/docs/platform/howto/byoc/delete-custom-cloud.md b/docs/platform/howto/byoc/delete-custom-cloud.md index aaf36f3e1..3807fea69 100644 --- a/docs/platform/howto/byoc/delete-custom-cloud.md +++ b/docs/platform/howto/byoc/delete-custom-cloud.md @@ -83,14 +83,10 @@ destroy](https://developer.hashicorp.com/terraform/cli/commands/destroy). ::: :::note -When running `terraform destroy`, add `-var-file=FILE_NAME.vars` as an option. +When running `terraform destroy`, add `-var-file=FILE_NAME.tfvars` as an option. ::: ## Related pages -- [About bring your own cloud (BYOC)](/docs/platform/concepts/byoc) -- [Enable bring your own cloud (BYOC)](/docs/platform/howto/byoc/enable-byoc) -- [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) -- [Assign a project to your custom cloud](/docs/platform/howto/byoc/assign-project-custom-cloud) -- [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) -- [Tag custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources) +- [View the status of a custom cloud](/docs/platform/howto/byoc/view-custom-cloud-status) +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) diff --git a/docs/platform/howto/byoc/download-infrastructure-template.md b/docs/platform/howto/byoc/download-infrastructure-template.md index bdab3ed79..a03985bf0 100644 --- a/docs/platform/howto/byoc/download-infrastructure-template.md +++ b/docs/platform/howto/byoc/download-infrastructure-template.md @@ -1,6 +1,6 @@ --- title: Download an infrastructure template and a variables file -sidebar_label: Download TF template & vars file +sidebar_label: Download TF template & tfvars file keywords: [Terraform, deployment, deploy, byoc, bring your own cloud, custom cloud] --- @@ -76,7 +76,7 @@ to download your variables file. ```bash avn byoc template terraform get-vars \ --organization-id "ORGANIZATION_IDENTIFIER" \ - --byoc-id "CUSTOM_CLOUD_IDENTIFIER" >| "tf_dir/tf_file.vars" + --byoc-id "CUSTOM_CLOUD_IDENTIFIER" >| "tf_dir/tf_file.tfvars" ``` @@ -84,10 +84,5 @@ avn byoc template terraform get-vars \ ## Related pages -- [Bring your own cloud](/docs/platform/concepts/byoc) -- [Enable bring your own cloud (BYOC)](/docs/platform/howto/byoc/enable-byoc) -- [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) -- [Assign a project to your custom cloud](/docs/platform/howto/byoc/assign-project-custom-cloud) -- [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) -- [Rename a custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) -- [Delete a custom cloud](/docs/platform/howto/byoc/delete-custom-cloud) +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) +- [Tag custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources) diff --git a/docs/platform/howto/byoc/enable-byoc.md b/docs/platform/howto/byoc/enable-byoc.md index 611acf898..5b70acc40 100644 --- a/docs/platform/howto/byoc/enable-byoc.md +++ b/docs/platform/howto/byoc/enable-byoc.md @@ -7,6 +7,10 @@ import ConsoleLabel from "@site/src/components/ConsoleIcons"; Enabling [the bring your own cloud (BYOC) feature](/docs/platform/concepts/byoc) allows you to [create custom clouds](/docs/platform/howto/byoc/create-custom-cloud) in your Aiven organization. +To enable [BYOC](/docs/platform/concepts/byoc), open the +[Aiven Console](https://console.aiven.io/) and +[set up a call with the Aiven sales team](/docs/platform/howto/byoc/enable-byoc#enable-byoc). + :::note Enabling [the BYOC feature](/docs/platform/concepts/byoc) or creating custom clouds in your Aiven environment does not affect the configuration of your @@ -14,16 +18,9 @@ existing Aiven organizations, projects, or services. It only allows you to run A services in your cloud provider account. ::: -To be able to create custom clouds on the Aiven platform, first you need -to enable the BYOC feature. The [Aiven Console](https://console.aiven.io/) -offers a quick and easy way to set up a short call with the Aiven sales -team to identify your use cases and confirm the requirements. In the -call, we make sure BYOC can address them, and we check your environment -eligibility for the feature. - :::important Before enabling BYOC, check -[who is eligible for BYOC](/docs/platform/concepts/byoc#eligible-for-byoc) and review +[who is eligible for BYOC](/docs/platform/concepts/byoc#who-is-eligible-for-byoc) and review [feature limitations](/docs/platform/howto/byoc/enable-byoc#byoc-enable-limitations) and [prerequisites](/docs/platform/howto/byoc/enable-byoc#byoc-enable-prerequisites). ::: @@ -33,7 +30,7 @@ Before enabling BYOC, check - You need at least the Advanced tier of [Aiven support services](https://aiven.io/support-services) to be eligible for activating BYOC. -- Only [organization admin](/docs/platform/concepts/permissions#organization-roles-and-permissions) +- Only [organization admins](/docs/platform/concepts/permissions#organization-roles-and-permissions) can request enabling BYOC. ## Prerequisites {#byoc-enable-prerequisites} @@ -74,9 +71,6 @@ With BYOC activated in your Aiven organization, you can ## Related pages -- [About bring your own cloud (BYOC)](/docs/platform/concepts/byoc) -- [Create a custom cloud](/docs/platform/howto/byoc/create-custom-cloud) -- [Assign a project to your custom cloud](/docs/platform/howto/byoc/assign-project-custom-cloud) -- [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) -- [Tag custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources) -- [Rename your custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) +- [About bring your own cloud](/docs/platform/concepts/byoc) +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) +- [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) diff --git a/docs/platform/howto/byoc/manage-byoc-service.md b/docs/platform/howto/byoc/manage-byoc-service.md new file mode 100644 index 000000000..93e33e854 --- /dev/null +++ b/docs/platform/howto/byoc/manage-byoc-service.md @@ -0,0 +1,61 @@ +--- +title: Manage services hosted in custom clouds +sidebar_label: Manage BYOC services +--- + +import ConsoleLabel from "@site/src/components/ConsoleIcons"; +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +Create a service in your custom cloud or migrate an existing service to your custom cloud. + +## Create a service in a custom cloud + + + +To create a service in the [Aiven Console](https://console.aiven.io/) in your new +custom cloud, follow the guidelines in +[Create a service](/docs/platform/howto/create_new_service). + +When creating a service in the [Aiven Console](https://console.aiven.io/), at the +**Select service region** step, select **Custom clouds** from the available regions. + + +To create a service hosted in your new custom cloud, run +[avn service create](/docs/tools/cli/service-cli#avn-cli-service-create) passing your new +custom cloud name as an option: + +```bash +avn service create \ + --project "PROJECT_NAME" \ + --service-type "TYPE_OF_BYOC_SERVICE" \ + --plan "SERVICE_PLAN" \ + --cloud "CUSTOM_CLOUD_NAME" \ + "NEW_BYOC_SERVICE_NAME" +``` + + + + +## Migrate an existing service to a custom cloud + +You can migrate a non-BYOC Aiven-managed service to your custom cloud. How you do that +depends on the [deployment mode](/docs/platform/concepts/byoc#byoc-architecture) of +your custom cloud: public or private. + +### Migrate to public BYOC + +To migrate a service to a custom cloud in the public deployment model, +[change a cloud provider and a cloud region](/docs/platform/howto/migrate-services-cloud-region) +to point to your custom cloud. + +### Migrate to private BYOC + +Migrating a service to a custom cloud in the private deployment model requires network +reconfiguration. Services are never exposed to the internet, and correct private +communication must be established. Contact your account team for private migration guidance. + +## Related pages + +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) +- [View the status of a custom cloud](/docs/platform/howto/byoc/view-custom-cloud-status) diff --git a/docs/platform/howto/byoc/networking-security.md b/docs/platform/howto/byoc/networking-security.md index f433fa1b1..bc3f8da96 100644 --- a/docs/platform/howto/byoc/networking-security.md +++ b/docs/platform/howto/byoc/networking-security.md @@ -115,10 +115,6 @@ For more information on Aiven security and compliance, see ## Related pages -- [Bring your own cloud](/docs/platform/concepts/byoc) -- [Enable the BYOC feature](/docs/platform/howto/byoc/enable-byoc) +- [About bring your own cloud](/docs/platform/concepts/byoc) +- [Enable bring your own cloud (BYOC)](/docs/platform/howto/byoc/enable-byoc) - [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) -- [Assign a project to your custom cloud](/docs/platform/howto/byoc/assign-project-custom-cloud) -- [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) -- [Rename your custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) -- [Download an infrastructure template](/docs/platform/howto/byoc/download-infrastructure-template) diff --git a/docs/platform/howto/byoc/rename-custom-cloud.md b/docs/platform/howto/byoc/rename-custom-cloud.md index 5723fa71c..69089f61c 100644 --- a/docs/platform/howto/byoc/rename-custom-cloud.md +++ b/docs/platform/howto/byoc/rename-custom-cloud.md @@ -65,9 +65,7 @@ avn byoc update \ ## Related pages -- [About bring your own cloud (BYOC)](/docs/platform/concepts/byoc) -- [Enable bring your own cloud (BYOC)](/docs/platform/howto/byoc/enable-byoc) -- [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) +- [View the status of a custom cloud](/docs/platform/howto/byoc/view-custom-cloud-status) - [Assign a project to your custom cloud](/docs/platform/howto/byoc/assign-project-custom-cloud) - [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) - [Tag custom cloud resources](/docs/platform/howto/byoc/tag-custom-cloud-resources) diff --git a/docs/platform/howto/byoc/tag-custom-cloud-resources.md b/docs/platform/howto/byoc/tag-custom-cloud-resources.md index 35932457e..c4179702a 100644 --- a/docs/platform/howto/byoc/tag-custom-cloud-resources.md +++ b/docs/platform/howto/byoc/tag-custom-cloud-resources.md @@ -128,9 +128,7 @@ Any change to infrastructure tags requires reapplying the Terraform template. ## Related pages -- [About bring your own cloud (BYOC)](/docs/platform/concepts/byoc) -- [Enable the bring your own cloud (BYOC) feature](/docs/platform/howto/byoc/enable-byoc) -- [Create a custom cloud in Aiven](/docs/platform/howto/byoc/create-custom-cloud) -- [Enable your AWS custom cloud in Aiven organizations, units, or projects](/docs/platform/howto/byoc/assign-project-custom-cloud) -- [Add customer's contact information for your custom cloud](/docs/platform/howto/byoc/add-customer-info-custom-cloud) -- [Rename your custom cloud](/docs/platform/howto/byoc/rename-custom-cloud) +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) +- [View the status of a custom cloud](/docs/platform/howto/byoc/view-custom-cloud-status) +- [Manage services hosted in custom clouds](/docs/platform/howto/byoc/manage-byoc-service) +- [Download an infrastructure template and a variables file](/docs/platform/howto/byoc/download-infrastructure-template) diff --git a/docs/platform/howto/byoc/view-custom-cloud-status.md b/docs/platform/howto/byoc/view-custom-cloud-status.md new file mode 100644 index 000000000..bbad8a38a --- /dev/null +++ b/docs/platform/howto/byoc/view-custom-cloud-status.md @@ -0,0 +1,32 @@ +--- +title: View the status of a custom cloud +sidebar_label: View custom cloud status +--- + +import ConsoleLabel from "@site/src/components/ConsoleIcons"; + +Find out whether your custom cloud is ready to use by viewing its status. + +1. Log in to [Aiven Console](https://console.aiven.io/) as an + administrator, and go to an organization. +1. From the top navigation bar, select **Admin**. +1. From the left sidebar, select . +1. In the **Bring your own cloud** view, identify your new cloud on the + list of available clouds and check its status in the **Status** + column. + +When your custom cloud's status is **Active**, its deployment has been completed. Your +custom cloud is ready to use and you can see it on the list of your custom clouds in the +**Bring your own cloud** view. + +Now you can +[create new services in the custom cloud](/docs/platform/howto/byoc/manage-byoc-service#create-a-service-in-a-custom-cloud) +or +[migrate your existing services to the custom cloud](/docs/platform/howto/byoc/manage-byoc-service#migrate-an-existing-service-to-a-custom-cloud) +if your service and networking configuration allows it. For more information on migrating +your existing services to the custom cloud, contact your account team. + +## Related pages + +- [Bring your own cloud networking and security](/docs/platform/howto/byoc/networking-security) +- [Manage services hosted in custom clouds](/docs/platform/howto/byoc/manage-byoc-service) diff --git a/docs/tools/cli/byoc.md b/docs/tools/cli/byoc.md index 9010e0213..5b7cf3890 100644 --- a/docs/tools/cli/byoc.md +++ b/docs/tools/cli/byoc.md @@ -13,7 +13,7 @@ Set up and manage your [custom clouds](/docs/platform/concepts/byoc) using the A | Parameter | Required | Information | | ------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `--organization-id` | Yes | Identifier of an organization where to create the custom cloud | -| `--deployment-model`| Yes | Determines the [deployment model](/docs/platform/concepts/byoc#byoc-deployment), for example `standard` (the default deployment model with a private workload network) | +| `--deployment-model`| Yes | Determines the [deployment model](/docs/platform/concepts/byoc#byoc-architecture), for example `standard` (the default deployment model with a private workload network) | | `--cloud-provider` | Yes | Cloud provider to be used for running the custom cloud, for example`aws` (Amazon Web Services) | | `--cloud-region` | Yes | Cloud region where to create the custom cloud, for example `eu-west-1` | | `--reserved-cidr` | Yes | IP address range of the VPC to be created in your cloud account for Aiven services hosted on a custom cloud | @@ -66,7 +66,7 @@ Modifies a custom cloud configuration. Custom cloud tags are key-value pairs that you can attach to your custom cloud for resource categorization. They propagate to resources on the Aiven platform and in your own cloud infrastructure. Custom cloud tags are cascaded to bastion nodes and disks in private -[deployment models](https://aiven.io/docs/platform/concepts/byoc#byoc-deployment). +[deployment models](https://aiven.io/docs/platform/concepts/byoc#byoc-architecture). ### `avn byoc tags list` diff --git a/sidebars.ts b/sidebars.ts index 6d1e02433..2fd502923 100644 --- a/sidebars.ts +++ b/sidebars.ts @@ -311,13 +311,26 @@ const sidebars: SidebarsConfig = { items: [ 'platform/howto/byoc/networking-security', 'platform/howto/byoc/enable-byoc', - 'platform/howto/byoc/create-custom-cloud', + { + type: 'category', + label: 'Create custom clouds', + link: { + type: 'doc', + id: 'platform/howto/byoc/create-custom-cloud/create-custom-cloud', + }, + items: [ + 'platform/howto/byoc/create-custom-cloud/create-aws-custom-cloud', + 'platform/howto/byoc/create-custom-cloud/create-google-custom-cloud', + ], + }, 'platform/howto/byoc/assign-project-custom-cloud', 'platform/howto/byoc/add-customer-info-custom-cloud', 'platform/howto/byoc/tag-custom-cloud-resources', 'platform/howto/byoc/rename-custom-cloud', 'platform/howto/byoc/download-infrastructure-template', 'platform/howto/byoc/delete-custom-cloud', + 'platform/howto/byoc/manage-byoc-service', + 'platform/howto/byoc/view-custom-cloud-status', ], }, { diff --git a/static/_redirects b/static/_redirects index fd23705c9..537f4f54b 100644 --- a/static/_redirects +++ b/static/_redirects @@ -218,7 +218,7 @@ /tools/terraform/reference/troubleshooting/private-access-error https://aiven.io/docs/tools/terraform /tutorials/anomaly-detection https://aiven.io/developer /valkey https://aiven.io/docs/products/valkey - +/platform/howto/byoc/create-custom-cloud https://aiven.io/docs/platform/howto/byoc/create-custom-cloud/create-custom-cloud # Keep splats at the end # diff --git a/static/images/content/figma/byoc-how-it-works.png b/static/images/content/figma/byoc-how-it-works.png new file mode 100644 index 0000000000000000000000000000000000000000..52be72235b06edf7b50c8d39ea8726395ac5eaa9 GIT binary patch literal 63099 zcmeFYdpy&9_&=^vDN2$kp{OL~5IM6>qQsI@IUkb9F{d#$MajAQE{BL!VnvLc8I#k> zX=RBVHVn&gW@a-x{NB^&zPrDl-`~H-@1O4;kMh{|-s^C^uEX4n?e>3xQfj>I}O>YGY2<$(`|F`MNjiXDzhns?Lm|PGj z?L9ODyb<&|Z+>1tpgc{O?Y31wV0F)xOXsa2o8~#fS)QKJiY$!H=vayL(r$D4qn6&? zLI*d!co8!wsOlwXnV-P*zKlr70!eBpnrdq1Jr&y%5S%A=4NSFw4+p=wc|&OxjNG4vn9ca$H37`(u+>CdmFn%?c>_5={r zrA0uKPbJ^Nc@)urb=D9t?H1m0Cg$&Ie~$A|FwU?q$tB7(@{{oHtABnhkW8p)3bkWR zYilF<`!M9pfXz_R3(9!$yfQL+pnqEni1y-MABH=ZmgqBvm4${x4&n2%|1-i(1IyEF zGne`%X5F2hCgT$Z+Aly`GCoabQR|Xj| zNW+Eqz@sCPa|<(nnaJjHhJ6nkw2X=Egf9le)f>mQZU+?q-&e-t&k#xjr6NfU64zp8 zeAwXOSokPiv|U^kMiu_AVwrVWn#kN@kD%8aDr{Pk0GVzVwUmkKFG3#ucQ65gjEv8b zCe!+tP8jTau*BaSd$|h}b^SkD;_4kqput`h}pR%Og?it1|7X#kM8?J@Qk2>kEwe39o(I5hLaKB5|N&|6M`lLLFJQ9S10brn%Ab z=X?$D;*0;xeRHUDKK%A4#s3P)er(U~KhLTa3by=b z@{Z@{bpCwVoV8bI`=7T`R-4EFyc6)a`hO<{#PR=`czrzi>KilqwId}HX?YXFovdtV zn9eTlixoA}Twi}3FPptvck-*I4`U=4JXASz?=b-sFBT6In1 zh8j07PFw*GX{5A(;jFtuqm9ey*ebyaoG!W1yY(@n&@#!bqpY|)ZPd!~P+8al%|5T< z)G7E{HBwGY%V_2;-O%aWb?uRRs7C+0pQh@kbT9NdR7W9)(@aH;n6CBAiKITPQJ5u_ z=ijC#9|B{|P+sop5p}?jB=B0R%J~OX`HPa0L@?VFlMv5#@ZSl<$PY$$Dq(B{%TP_M zqEbSITdOWDPoKx8^_5LZ*2e*p8HFmh{MatXW`__WD06xtGV)JkDbZ8P@Dir3Z)~#N z$dtnLw>2_Gb;DNvF@w|cA#7<3wWD-1*0O}Pg2&yBPsyA4;K3N|kXem)XkC~l$S_G!R4OGj30qSttg`AF5^Emaq_z&t>HNh5^xoE@l) zt06Ti=2jXlRN#!>%c)zCa|i6b0pBXEg{~=PT$VBreU>TT1_MUhhkqxM30nCYo8n!j zG#Y|03|U{O!9j6n2ORsE-3|Dv0p|fm_{od2Iod=59^ywp*GbjXN9;pL*mURnL~5Up z;EVQV>Tmb)YCKLn6|9&Wa(}aHgwD#>iw!%$nevxpBtB{TqtR1qRu&OZG3&*B4+&68 zbYHyD%Ii0YVM-6XB^?8uS!3HlFIi%wzqi+u)5+6=`8HJaLpUKOST-^hmwJwIp;vFNJHl;==`WU%N*OSJg?_o8 z`gzL_YBY?(Af!i1NZ@I}fdN4oUM*D<=C)K%9r`$>pTd(HT&@wyHW85Hiy_S9AC=JP z1r(ju@@2p=IMfbU@pS|oMmaJ?WTv>FIP;G#onU#$HN2auyCcPBm2MuW6MDrPC61n< z=+h5|s47G4+PyCCVaJI(=S13U8=+l?B-@DyZ_J?m&kPbs1T3lXtuPgC_~ ze>D{~g!TE~1iT1X4;bpP5xVG|dxJN=FrpPUE}YZaQ~Ygl=hR9<(CO1vK_caj?X|$E z8&;$TF@V4BYl&-854vC-XHnc7RZ+fGtNZ!ad*jjLve7Hwwrn*VPQkgCNH_kv)3`|2 zaEH+~IPS1ZPjz4!_;>ZEM1u9wX&8T*pZ&DkQh@t2K8@ikaeLJ49YS7E$AOtdWv%LN zJgpb%q6c^r;nF1aWLodNUG`WtZC^-${b#;@pXvVU_cZE=ItUEnBxkrnKRlz}yz7iT z6G88{t1^&8oK5z8>yIvNV$H665;dy5UHy$Onlh>1y6*bdrT)GYX;lP=1LjVG@td~4 zbYz1rgj)KY6&<%Veiy)DJ!{yxtypT+MzaVj1T_@aI) z^zkxu_r2QDMDP35c1elxmPduS(u3HqU69AH4thGupmd6X;I4f8$-@SEL@a8~pJ_YT zx@cEJ43=u0wQF)V5vUmm)jWB@#I<(ckpaMkl_D8fP5XC=bhSb&)#0a3b*Umgi0D-d zPGXYJoBN@mGKuHbwo1OtG-7@d4UY=AHf->HbYXd=JT3ae6vIDuax~FXA3>q6U--0m zGoD7(mjmyDTGP>_Ns#g@x9D4<$C zSe0*16OE&fpLC4_o*(n$#->^q>H!nk2>d9|zY$(T!AWy7v5nMVk))@F6I9eSd+Y4h8D90Z?37^LfD%0tjn zZhb;B3=P;6RKax^2VFm4D;T*hV|xvE{=&G};^OhIE)quuoyl$y)N{^C5l7Uc_tWGb zI=!!x(J4hGot-dj^u2iD+OWTh;9Uj*rYbUMvsjxST7Nkv0yxzxjZaRFuR(kDia8;l zk(TJ1;p>d)o|+!0|Le|C&ga${%ajKE8L8oA9bIfE!f!8sX~o?YR6fcLj!%l3ok2vBPK=vEhnWCzKKlyT#`rH7mi zCV1-I=pmmtE@7q61^9G@#)+%qV)oD>>My ziXe0;Rc~p?-$3Er!PnnrqmoS;f>LIFf@^t+$||ZSjpD;-Y90Bb2J>2`gvE&m{+T(` zj0XMF;bPlx7_Yir3Eo!QJSZ66gP~BpLK>&5Vuqk1<+?}XZ$Oti!V?RbR!7*2>N z!51O|L#@9Xt{D*nIlm*hW(ZBKFZJAqlA+et`b8q^)8$juN zI1|woAV^r>b(2g=4`@(`fdQ$0<+WldTagN)TS!GJL)m3I4aBW#ep8i?u^T3oy{@_n z@x>K|L!Qj?XtA^br1PW=Z|)>r)XaGtN}C=YYFZ^g9k6p>FN$8_yT<0Fl8qR8PRzPz zOK9V)qMFo^UVoybTd#8I;Nae(Q9$vqozr5Ulb?E^RUabM(FWZESFE?7wuR_#<>@7; z1z2x$Iq}^gvCKR9-dR@}Qh5Yz!7v4`NR5bC(zuW{+MD)nc^yC^Dl!q1;}x`{8LzW? zg>5V;Hr?w0Hhe9V+F<}<{mO^#1R-E7{Uk<){L_P^p}8~Cv@!?FZ~CZH(RlM5J&PQJ zUx!EoX6d9X3-#nMiP_AgD2LF#D|1#goq_ke<8P+wm4L;*qPC@X3E!-D^3P6h#Jy5oKZ3iWuW!sptjLJF(WP03$>-SW!SU58>`uQ6Xb$HsWQ47zM-Tyroct&Co_ zd0gyo)U0CM0ThmWg$*Bku(XG$f6_Dl(MdnDyFtEt;91RsT^6cD27s%F@pB$8lFs>s zI_jSWQELpI4ujh%LI$dgbC5+Kv6^L7HTsG!$H3yUp-v{9<2K|gAFxScLaMFg#>61~ z*?0L#l;H*AQ^M~XUXjfMSoDyw2ivRBDun^4u4u=x@~k}C%PsY?Fj;FHaRa`IU~g}5 z5n%}zMGY&-Wo~F>(SYlc+KTv2isGPyWLDbYnX*YlKThYd0XuqqK{$S8``P5DKByyo z?~aca3-#MhjejkQf?ZP6y1;5YIJx;rkc7>*_!5;@#2J6V+z&3GdOBpE`{-SxdeI@( zqt#xPXE7&LIzLlxeC={lxEd-^A1`rxBbD!n{m1RcAG&Wk+wX2?x3F()!8UFXx=SZx zw&h2w&?l3xRV>}uWDi-R)WhDG^zSCeI=sG~Y~h?jMVzRzYSt2!6Wu%88~dxPhl-UW zF0UI)MpqVG<*4}*q8z#?>L8YrNvd8^sB_11t+L9U8Czd3_sCMGb#w@Te9l(VbyWg? zRXSpw1Xy)K8&YxI$aDqzHf=vN7(Q6O#w8FN_9@q9d>R+JbeTQ`SWnhA`b+YmELOVR zB~buH;+pX)M)^KZ0d&c>ZlzIq=QEJ!jR&<_1^`&>0FaD5-lUEcGrbt;<%qrGgD{!M zyOeQy&|b-_lbe<*di5%(BPK~Z@v(6=W;xmc{%eg0;mub=Nqf7~Lz- zY6|dWEGM~Y0U1o~&GDgoD7j9(=$Qg|cB;Yh(h!}hfmm~#H5rARPNy4A2ZcI5z7;CN zSLrN;-yU!m`DL&LfI>%+XYR!{c70_SGDaNO$%mOIF2u#g1q1s)WS7wmw>)~(g?m>& zQ-~_4x`#lp(&J5OfwXsRj3;G2x^f-{?t^BAY$rv8Vyxg(Q2_CJ>n1fbW{?PV)qS#f zwUhSoH%%rUCJvydnH@Mu`k_0$WE00j_knEit=p~Sq~jCoCg++Y#RNb=zB}y~>|XB- zT?qBQPR#}DFC=%U5eAmox@2_ttC{kwPjgZ0KfKW%(gZzcQjOmROb9ysKkht1Xt(yo zT)Q++*ILcwb8fO>DKqLS_@f;he*7+ikq}V6kI=gy06!MZ;MJ^bFsgBK32Xr$ zKMuVL=Z>)GbJ7S7p;BK-dCm^$bPZo1C6so3b&ZVU$kM|1jnkRkQHVaJJ+i}vwH4>R ztzWb5mDUxhBV@BVhAOVVG@bbZE*rUaod4JLR*~?cvFl2&J|-7n4$`_G%a|+xbhSAr z@w$iXZJ7=o6FMQqGErSBzn$0w}KU~ax6WYe3VcM`61seOI}Z~H>Vf8@rOE>NEw~7b1W~P zVl0;mE@)B=f?T_T$q2af!D>E^C_j~%mg9fW=}`!Or8g7*N764kTVp(*K+0QN#ja5X zHjsHKvFKX~BFOZ2>TX{&+pz#F(&cZP#O;6C(fHV4cHl5Y#v1f#rv2SrS;^f|oH=de zMNvN|xcgd>G>ltczmwh&8&p3izqtQ8y*$lH^ZQ|V)DM6itTB-6vO$p~*5l5v3fBRA z^$$-S(Pcgb+jTtz?diiMR}B%SXF`VJ`e z$TBn;8n+HTn;fBgHR3C1+5~fcCaUh%HI86lK)rX+=6TCUoLD(_U{`SYJP}G^2N})2 z`w?2=6c|+}jqLn|L~wf}a8<12jGo+Tg02&(HxFRmCQNpD=+GzR>L#Ie50{n=G8Y!&^#TDrfuC^<5`AAiMWE zFWMwSQEwhD-pIra3!QX{q8h)qQ&-)u!Ol}PY21eNh+2PtU9R;BJ%6Bcbo-$|*9EU0 z_$d3jABd*#eC~7YdufW>$ZJ4xlB(QVp&NAjy#K%F8ynfUEki+sPnsg#eks=4OS&JjJ#64R7--Q&5xYLG zSb30m`XqS~xEV-9$gSUmzy2Av`qPV&L0sRVPnHPDd{Zy5Y%J;YopvAEsT2TCnu*zx zhhK)Oo?m79H>Oe~>>Trclt#nK(Z+PL^T4mce{^(?Nr+|`o~9(Y(LZ)i_p>~5eI)NYV_?x{Pqe2^RDoRyAMFg)Z3?z7<^h?) z6|+%3+FSPfdg9XAMKe{-vj`lvUQBY&${C6~tes^iIm87LtPy;r)GDN%oxqrSqX%ga z-f+pTy5bu*7crhEQGXwF>wR|_eSJxVD|^1*ZEH@~Id57p-0#!)fK7f%jEf-W@#&%& z+jh;!88cCYq+p5o`GG8pI=3`3fCTka#|F(~K8l#{zVRTuy#LXP0-GRWQNwFm3-3`D zOS>WHlm;+j8RX8X6CH|}ck-|_Px5Dlv@9pAh0b`@dk3+rz484$kv10jQ9l>0&FfU! z97?gHr3&iZMV2L9t$Sz+9l9sW25eX^MWkGPE_2{V>OGqOHjHieGm9=W_UVk#SWy_v z?<^y@HzEMs<*W2#LFn%qY1Ck8=n$ptjAN?ZC_91LIUve+KZ8!cNxXA_k%bq~di7Oz z%>p3Bci5*P>2y)e<-4eZzmjIr0HbRwNVCxMjuz`p{^}KXH2}j|eG?g2#R@@}X8L>& z1vt!?9f2sN4uyx00b&Owv|#+C`h%MEd5r$zprf@qsyOS=c!#C+bV`K8rglD0(_=Is z(#x|IGe|D;P4+tQSp^%6FEp>hAKRReFNFihXr$+%Vm$RMO4mpRGWMW7N@N45%@mrq zqffPd?g`44O1e6p>C8gXPI_T0OJPI+>*`dpoPZ3neuADf#iuRQduU7Hjw5^0&P>X} zF+lXRceb<5EfpsGNEpb2u@0PmFzB2a{{t84g&l9N#j@-g%ML%bD^-}PcPz?Lw8^*6 zoZ}Nb#x30da4-jlDK40&%RQgPaWPFqL zSwR%sDx2p2*d_6mi=eAXfz`Qk5sNU7=MUPXuy2i&8|@z83cW&z)ulX_#@NA3+Yp4>N4)PWG-)AJmU!Gu95p6qoD^- zdn9islh_*$*e&}v@%vH2=AnY4biXas^09H()$Rs&0C`%Tj#Mvdx_nN(sDYuEdm-6N zaIcABp8Dy?U4~k%V*@ERo}}xKTcEje>T>a7Hy2FeR-w1Hy;)u*az;-_mv~IEz6S_t zJs$OwLhr+CWqg7S{MBxs8UOyJ3F(kl>eQL0*28ngBi`;`ai810+Rqq#_Ud4-u?DbE zE?>&cW&gwm$=A5k4oyyR8In7LGx`G+*xK`Zf(|S@od7N%T64o;P|MavtQ>D>g^nVQ zg#N11%S)0lO^z5`V76B#twH#gCqdRKHGpvMG_Tb=$?BwjUCB62oT(k@U_YVkBk6zM zDk-)zZR&`T;^v0Y6G$tJKo;0PH@l(hcdq(^`x!}Z)Dk+v5e`hczsu}I zX1b*cl9OuZJABHDzbQ4Mq7n7W1oC&_;C}*~Q_$!yP1MZ%hzh1fy#W8q6ByyvYIT&Z4YsrRB=ri`=z=V){_G<|^ zB(|5kphk;ishCejgNLN3&SnrhC7g!X9mDs!--j$sXIU_sZ`G*%%zIpmiB znDPe8%OB@dIDc!+tIXzOO6J$J)f;fm_$MmeTG{uQpup9O7qHk^kP-x7956og|>C=htpC8Xo%SGv(G~`xmcXOk)zULNO z3nS1Ay=#c|I#rwv&;JQ7Wp=Cr0fiqs<-98=bDY+J`-0(K-oSwTb>8gV81PyYqoKlW z>CR!c=V>?sMhKqXUab-OVCf5G#87h8AMHghb^wLXwyS2XqqA|R9!~QD!T+x@*tel1 z#LQ3Z3JmAFw(jBe@@1hNsGuju>){9%O5Y$FlCj*cXHRT|Lwa$B!Cqv>3-+j)>1 z_`k;bwD0`Vi=E@o@ZRnw_k^IVy6taGc=Hb{`7*a@3~!qKwerh^s87RQg+TkC4M)ME zw=OY1m>AKB_86XS^P#~pSfA@?HLDFAa_r`%Neo=&+{b)PRa{wrqc zGLU1t9@giLnt2t)Y0D|2(DeuQP+Zd(Jj*$+L!pD{fomX2%ryMYNf?SbpGmfn!XeI>;9j*^N=T@jFw5yntk>?g-i9EcsC8Z+ zz#AvR|F3HlU|XfWTjl*Nt54=#wTefp6(r2Oz*^@QSQ-`PfJk*OFvd1ZCOiu0mt#Ai zJotRx!b?p$dP@$*q+scV&-lV68!BJfG#h7?{w%zXPxweB&UhK>8%BQGj!%>>HB$yf z7-uuNq6fhl@Z76CePdSMET!VUUV4B<8ispzGyb9k8Uk^ph2eo@lH1M*HQ)(5==OH@AQcv36DQU+Q0qWSc?f6v6vX5sn~mBk@7YnUe3Zh z@(tt~h`csK<&m`U--Vq=tj?jQXe3(LyeZ(}4x2|&9zY7$)?Tv@*cu))$9fRGcI_ji zo}5xPTAzAT&z#i8^e@-EQ)!~v^vsg}T`1`?fT!=O*G*+qViDZ)6(^b3gbd6tnKrBi zParV4t4tE3V8-jil{Bu4oP*jv*>TDj493u$P+lhl2eU~aiStVxPY)tSnd(j)-EXWD zu@hF}?Q=*3^jtQedEP}-4Z!>0qAkRvC^~Ek=kUTBqSr!vSgzDSS5hx624Y|fo1o25 zYZ}k1{TrmDl=-3IL%N+)AB6qwno!i4v(JWl)WWC=Fmo&K*|F9>k2xN$+HDC~%IT8Y zwSdIK%(ifhK4`>H`g7h1BNUz7U4~Q!OXQzPKh7Or>>v>|*9M5DGvWwUqazQ;tyJ}N z%wFaNBd>?X?lGj|PNY;9I_*zUYf2;tKdc7Iyqj*AA3 z?dwTBV`-#|>I=U$r9U4<@9HB3K%>pn4Dyl^C!oGe41O|vF>kFDpPo4Np2tt995 zU`isd4y_G&SPfC1X|9#PvlzPiMCR<9?0+TGd?RewFMJ=!2B0GD7{b^y-ee5aX^7UU zh)j_4H~*^x#;!slv0$C5sZeF^EDqm^sns+$K<8KaFfLVOLo9cpKd3k#Z%s-Z*N{_F z@BhFwyk)yqYAb@shH_TAhrMFQ#CtGyJS{_7)LCU`+uZ@l!=2zLqY^-iRt71U{CB&J z)}3%S5q(99l5kbRM~ViZqkO~vV|W)f43D$I!7ET2&y=92-)O2Ee%re(t!PZSl$~F> zjN+mXtfoeViS_aWMK&l0TzKbm1G|wq*)@9ssNI`T9PXP8Z_4WfS0mp`^6axCxnk)UKQI)wRN_5BXvnttl;l3DA<^Kl z`KN{irt9Qbf6@4(4hk?-SQ9(_y`(aiOzaWtv^utAXq6u2b0^F5uwjR)v(>K0+FZH* zX2m8(>l=HBQqe;&VYOt#Kmli{VGd&GJ{r zNeOV4zs7Cns2?Fd?=Kjst22V{uyf9@yf_D0tDrI@Tv+y0qR$DSXb;*%L;oZqQ}s?6 zhIOzeHVW?eONuG*1u6s^s?uF_v=<`2E5iFbzI|g1sMR}P3hUM z=lF4Nifl~_5EDSW^f4-eBVLxG3#rU6)xcgr!*rd}S}seI+RO=V&HG?*yr}hM9`x<| zI?)rGN#0sgvagrk?RQQbV*n=DIzM+jp#H4kxHdPq>)t=Y5y+4S;>BRf0`)!brLBK` zh{|_E8iaioqp_YX0cWgrkb;BH&nM&tqjFz%w*1tuXok=&cLZv~T-NG%1d#|;*NF!d zWIB8q8~lkfOYTWE)9TI$x_Vlo#Y}89k3C&;2M!0&mjxaiaewZf%6d{Ib{&-WXZDl) z+09GX#i9igHC#-IO_g+7t_e3X8#aXNX zZe`{DDcJQX)eZrULiBa_L-N7jcyarAZ zp7nBl_%=!1si_pb+i#k|>_+&TLD}CTyr;Z)&}=>SJI&BBT4Guj8%ZeyGz+U4fnDgq zsl+>oxSy0Je|Z5IL{QP116`~TnY44<0RwT0WWI7akrz1&!pmMJ5U zaV9#UK`uH$pjmCcH`=+u{IG#uHJ9!Je=Zxf^hvN8k|-`g9jx|)4tXJ>6J^3fwtZ`m zfYVHRI)8eqK_l<0oZ?g>5YW+SRh;#pKRf!QFckL~jr8Igou%Ef3O=%!G0-1Z<+XWI z95j+`%TB|+l>o$o#X%y(PN-r7ilz)J&QspMpQrh>kSiY058%Zsc%yT0zZbjWKv7>G z^mLB3-r zz)jXl)q;_{BfWWxsF3X@HQSYAi$*KQHVd>?>N6r1_CHvP0dW^PaG@*2DAhe$nlu3-&{Pb7Xw=)uZF)V5`D%9@MmkBl@vt9RUub-Q+1MD zCPEsO`C zme8R~%)_#x21~6Iw|hllOR+1HilA?&XEVjHV*o{a-eq`Ma=cDwdM6IHs*xD6OMrCY z|Jd5cG_;AAU4+Ad6qA^#Bh^#o=4q*~manQrYEXa0_6UTnJvlj+f^EZnbSO8LLPL5& zXqM>GD4g{wqYmdCJ=#s_AD_b2L`{DmDeEL3S0-II%IqAlAvnlb&?}Cggm+=RN<|{@ z9MHQc-kDc<)7!C|q&`>V(UVt_y$nj;3D6oThEH$G@@*?wF50haAPu&XKar*UFr;Nn zAXy_iq3c=GB>~sxVOS%Sr^^uoy@m@RVcrItPsx>=!&!Jlo-AZ+yEis99{((F^qB+C$eg|MT9fm(G0CeCu^Q|>VZtb^D;nwlaQJTp)sE^O_4~7~eUp`z|o2R{B8@lh9h*RD&rlAVq zJ_sgByr#HBoTqJS{@kAMQjS*}u_U7yJdzD#>++Qg%o@r-2;KA>u5M&v)N};89yGO0 znebK0r@;X+@KH1l1hloZ5L-tauzvpm1mas&Pz?u6tDlA0I zP=S0;zYoY-e5fP6l1*pKVT^z~Ed(XuD7(!gc#Ta9&q2q@_s37WEu1NF5-C`7Jg}UX zw<8t|woL@8l=KZPcf{IZk*sV@ZKG#XUgpS*>rmYfnbs{tVx4|L0Gsk0HkXn@hU;!p zvsbqLaKis5eW?|sw7VI&Kn`_BZ*0c}*iNR2oL_YhNyn^tXUx<&mx<+kRWX5^A`Mo+ zb}+Y>fqo|?n976ZgJ;L1Ei5yDElyHkM&r3XCwxn4v; zHF;sY3PV=R$j94UUGN#Qp9=6%&A|aM+68e=ZwA`(UIlxz?h$UN17r`XlwD|ZA^MAv! zSuOzE<`-eB*X@IbJL;Z>S?@r_waD@M!{5#zIZ@^UQF_qlo0ev>G3H)Js54qemOl6} z(HNVeXk_+4jWps*HZGDXY!yi_55|wfN1paEFd#-fFUaHSF#HcV%=nnTLtwDPoY3f9 zc!SZ_?Qv#-nn|&+QiYgj!zKvE=}RW?^&$Ygg7U(+Ef_F<9iwIrqLY&t7C`WoPJ>@j zUS!_SMw3u|Z5S@C8);D)@qFNoc|QoGPD3)iK2p0v)@o*^aZh#-BIw8lNxnU{`BK|LQ{_bhO1L0uapaBOzH?zOe6wDCCM9 z5ODr^Wo)389&;F_`bFY!I#8&(14Dhd!sJmOOq|7oqb(xmnKW{v_Q`mx$7~%>t6+fR zW*Ko5VP~4OQX_}w%dyD8yyydQ zFJ2X;+=X>iFz#(@fzQ+hqY`Gv;Ix`s=_?6!fq(L-y?kb@p>9UeD0CV`#a*&I9TiE0 zKa-6f&b-q)_KX)|WgpS{$a`6iSHG4$Gwbp3-QgzMyYRQzG`(X5iVNwo@X@+<+`Iio zlAA?6t0-5Q(2s}03MRtO3OY;gMeKM0?m<(u!QMt!5$uZRrL1dLhvocX7Cth>l_Z?` z3_ZYfMgrw)yPF4BHJfQkd%H36-@dpMrXkXV+cfj7 zhGPS$qmlQ7muR6Ocj9>^84kC}Mz7yX$!N8%_&bbx7wvVwp2=&AWxP$d3or%Oj+OnK z9Z$o|hU0rPn}QbU&!#-;mk*?ybkXn{Y41C6@7FNkJ8nzc7r`?i#PdER_hqm3>b)SE=JfGm9l-WQdpzY>vknqXGSsljNBgv$^~Su z`@dlMW+$ICsH9~DXMw?QbNvj6UP7 z40tb7FxKc$vam~fAp-5QXc#KdJZ!TI(S2c}A7co`Jcq57O*5nEMbBYNswEQL_moq? zIMD)ZunW`is(zRz2q2J9tg7jMdC8b#{A=SA2CN*!6|3#CPHcEP(dj!gynZb{p)={Y z-u6$$xDxgp$ft>X1qx7u2Fm6o5$B^HE!K~PIqyIpT!D2KJ>P9`qJYO-tfMBLgM>QH zcA&y)HCkC;s_&dII23vJsv_d$Kh`YJ@u^c#U{78xZXT|P35Q-4*SNAYGn-WCwRwU% z*&XUhU0?a$4L^PdfnXD4DkzccUp2^mX^{44IN~@g#Dzq~c`v*0jujyM!87B2-sEbz z0u#C67po&4X&s~;N`@SAP5`WrpkzoQXQyr1?a%$dxW7 zKoXq?oy2-iU>SuoNF(HwLLq~v-L5eI!GMS2vGP~)(uzAJTVc+VXI?~Oz7$tO$sAdRZq!W zhWT+~?F+nK2|yYsJYboHbw1-sZuJK&R9lECJj~eA^W7k=f-OI^cu}N&rD%Hgi?PUK zhh<5U#2}wHw{At<|3l~|Z}6{qGts+E#YK(F8utF(yWE$CnQxq-di1{FM3a*S0D6wQ z(C*!yBKbA}$n1b71LR-OWoIRG&C81i)(cjKDd3r{CY4-Hrl^^B|LpT7<`+$AL2!D} zv~en$%C2Di3B9B{04s1i+XjQY15djY}&hR&KyHofM)(g zldXzElAIGf2Z(;T^r$9|3 zS4!ahB9AhUPjfXQfXL?FW#j#2oo%edS#p`S+lKIE^L_#ncL98=SIL$CQBNR|Fy&KZ z_accG@%fnO;A{dp=7r)Np3;0!zmoUFCurZ_p_G~%tQHfm3uE};G@-}5WwRTsR**OV zh5zT(F$5Um*Yk0oLzD z^BvNdYyyufigYgVpLdiOX#~2c@%5qDw+g8`ALbZ97vu}$=6cqx%;<@}*9&F6gr)5> z89A75%OhkE?|q&TZ#pNy?@*vqcJ&CKju4+Cmd~YLQEXad{w4d=cr1i8g}A1zIc*m@ zG&P|w3mbH6zdsYR=`vPthd}aG*hn3BvgYlx0nD*YW%n-0eS5r%+{=|!^ige??`v~i zHu|FDpW0;W8qrx(Fq-J+zt2mT{Ur0P!ftrNgs{_-&DsIcb4nGM;Q;ki_XDY(x@|Ze zi_|IRlhy{1=(L7RrQ2yg#@DO%RtQtGg;ihb8?i2s7=zrO z@s!8_NNbM6vV5!k<>hFn+m1ixF^FiHukIw^7?M=inDdl!xDZgM>+ilHU*7=Dy%Q%< zZi(lH7JUZsAEnm}Mw&zldDVWytegyufCT0JB%glgQhP`Ea*l)EQBuW(&w$&@m4w)W z+4BxM3zgv^GTSiYk5O-hK}&!A>|k5~+8@&fH>FKn9leQF^*;2ZLvwMKp5nRkSQ>M~ z!2PA;m7T4gxqQP3moa_6$Gx|BEBIgN;b$;uqf~NvFFXK-T#iQ??r?)K* z2B`N=Z2r4GIK)!us_Aa2>e^o)4pt^b-}Q}s)1!V$o4~Bfhz{PD)5RBseRGnch33ME9J@k3v>SH@#59cb4k(%haZj5wWEv=M`;6??^O13QM-_d>c08Z z%ky6pF~^)>YmTqZw4{Ga(7*dAElJh8@oM$_VQ14ggZv9u1Y6c6?A(n>pfGgn-FK2U zR=v74bAgeiFBNM>mUq=We|Y3c=yEP5_zt#VTZnt^q1@VY#r5DFLF#)1)b#B3rzb8V zIEJa@#}OZsofK2=6^D=d*iMF=*(oqc@8q6+BYPdQ@bFR751Eb|tj1JSaoVnyGoan)kR8JL`#fJ^!&8`_F-K5&!bM*yu z-Szmyv(S`AEx1_gQ_2X)nTGB*9hVyF+ ztYq_GxCWf#QgqN^+s0#Hl^^}BB-g;u;OLYki1kcy!^s-73<*l$l*+FVP+3~v%13)Y zrNlm%-E=W%~_r{nk0| zY!cAm5~icAwfma#&%`%%K2^(wm4)ri$*BdpNSu3G{htLVJpTu3DZ1k{cx_rz* zJgCsasFZ35;?;qxqE)Y}{y^5N)rM{)C9L4lP+>&;lXJ|BhQ*UCfMfq;7G&W%_hWrj zMLOe!4jjT9S5;E64aLg4ewPPd?>TS@s&HSpb#V2Pj=G#}t_~UUQ&HvgkfG)1>R>4L z1iCC~G;8Zh@kDQXtcpTVDqkRp!kcVS&iz?r)$m@aEF>TkEx+Ma8JP;DdD-LQ%|hvJ zp9j|_w;#=PL4f51SLIRG~3Gix;nxGhFNSA7c_WK z-RV1Y;pe_E(aqyPOMfod`GLZ2|2JnAFDyIUYU_V4tqnUvpXj_CPm%mM+hA$v`g%)2 zJ;V5-(S^K-SlAJDG!f@7ypQPF`jcGfe5rlRU=RG$R`|`4`|mPkpa*+ zfe}BK6OY7~%Dx@PV?6ot2=gnmc z5&sWK=N``V`~PtrRYE6+a!dymhRPwrMi(wAG_5EF!zjwK=`+ncA*Zq7wp3nPQoQT%GXOBGxIzC&VL_&Dq zY0iI;hY7}Ozp)KhWzg7G`;oTQ*CPSHzhjD0IV_|tn?O^mD4a$B3r3@crF$(oLu~v^u{XtpWvJ{;$cY`W6P0DKC}FA@HgjV64qf z4u&yJ z@5Ymk!}zTpQjT28*L^2u2OqFMi|WjN4x8LL_ov8 zR+Tw|ecrn(XW%&DCGI^#+3Sy8WR@#<>n7<*{L=`N9m~`3u+p|u;wn4KY+H>ggsAYu z^wfa|b3xkVZ=;Hhc#LUVRgZ^^AbphF*#;M;52bijUI5t4ufT)rh=i&2nh$J4c<-Vn z`SSQqv*PC`IhsDs0|~(%J~St)o;jt6yy*eM{T?i%hG7XQp8UE&hw|1 zg9g3_`ZNnmN6MI&($HuqL&h@HPR~Q&-%X!6q1sR}&Bv|L`q@bojijVunb%QisPVY= z^-3#HGm7%IRlNw^g{c^f1U?G$bqyzFLi$ntbB4^4vxy4G@nr10NvTlcbFvQgTszNkabf!;fxKP>?;YzuC?MR`qmY9sE!m8I+;F)^ zCE2*Ncu0cPT{}K0cHGS4_civ5Re`u3s?leg`yP}M8777tsU1H{|HDjOyIGg2F|yRB zB^Y~Fq8}y0*nwfJLWDIJnQxso9a?8p=2Dh&u@VF-&9$r%a7?k??Q@3ZCmw7MCaKkI zc#}BYiURI5BSE#T1a{ni!6agygki$R0mZsQwfqoLL6tnqg}T&U+YLFk8Q*%)C!3KI z*OKCr93pKob#+5a5ZJEOCsW7T_kuGEApB|9aQa}@+!R!MQ&#sm7_FOHW4QF<3Ddvy zFY<@1T!+Pp_R(Ony8c~G1dh`>%UB_g$;jmk5%TqXC$Q1kfERsBQ3k06+Wx|PXxd4sM^2;&$c1HDh0UR;lWikS4kE?UJp89tvb%!VuM zg&-;CHDG2XXS7n3C1`hhNUB=;*UMcPXw8=&%X1e-t z3Oh_sK%4AG1*b~2Va_<|;yV&$UM6=t z&OIeUj|3#Ld#yHjA$l!&PjachX_@2gnbrfzSH6TI)P;f^x?0Oks!P}-E3 zBm`lQjXO@k@HF+E@M7U_@@KZM`N#za_(Tm`o3@Ms>^s9-Y?SUy_WuA8Eza*m4M>Jr z_{a_TM;sHpUS`oI9O5rG6+sEkiJ&o$$gO+ja<-nzCQfA1%2gUe@@L#&(kR3pTmQ=U zyihuKAHxikI$63mVA<+u7YH) z2cmb*SyT>MNP}O(Z(`YRP5Yff2c3@ZHKI*eY;TvB=KUPj4S2&)FNDTPk=WxVueNp;uT>Ztvcu(kM2}EAvd37xO><_=*H|m zHu$>@fCu^3o4p(UB|njF}0#d}*uR0kihorU!=XoHs+K_{R!=NFypoD1(B z9&F6fH4}PS_I;`*lj@=tSaHy+lQqFKX%oB=Ftu+IH7?fL5Yyv77)ZROT4$2l)OC$l zOpWl#pZxyhfJK40O_M0zAFF=TRZFt!jm%?y#bV*&Mzf&|ZGJh$f8hH^EN1*|`_H?y ziP}!?JwTwCFqeWe4Qpp6E$COi1zA<{sp^3b$MjHB?ZMdcj}B1+8Se$#2ZpW zgGe}|ks8vezaOi<^Vi}u?dtGXdp$HfWvBkYSgHQV&8~sjl)?)L2l;#aLE4edZxua- zp6DCfWbXwA(-@NjzjLJ*JYLxT5}Sbsomxr9vx<%GH64ynu+l_kc)jH9gH8;Ci11_! zETzo$oMzsfE={YKFmo=0ac0rY^Z0p2{T9C1LOB=Vy@yDM+k1QA{g#iUValjh+m!ew zTg2O$nkVnC+UB8&zBLd}{Ig3*acu`Q5@n+LB~gJY8}kLy(%5KAV`8ZH*+O3nkT9qisrO>4GU#lRKa}`@r6f&vI{So*-HVGS{?UAQ}4D}b(x)L zKjs8>B7YN}OEvC9Y_rOG?v}(;oYB}DmS5Cy^b|rT8r&J-eN{%F40#E+lz$2NT0u$v zqCE9Zw!4#gY=rET#Z>w5(#HNR}ag_{J==z$~%t)+S#Sgc}X4Ql1 zMl0t8D&`LAg|wNPTIX(==ySV*viM=#i0d;C*wv#n5z;+`YFmXIZUW1x;OWx03bHmG z$DDL~Ld>EUu-+bryk1)k20xOS{cf0bapS4Gy4+y^6E-&2XkEXMw1BPp0g=;=l>@y8 zwt3hetYMzrosr~&VKJn<5qD3NbOy;t;Buc(6ccsH%E*yxQ$Jb@k350z=shFDM_IMz zCw&z?%t!%nPQ8&w2CgY62g5ecIl+$~sic6VP6`0ns3K!0O5cW76p&7U9X}3Jx@DUY zxliW8Z{&TJHPh{p_KH%SHQUcb?-mg_aFz{iuG>h%ae`hp1=qCT!`zANx8S&YsC*z} zaOG{%Q21L3dJ7wvK`HC(C1tRAD9Y>T-wNjEM;O39jgH7v;a*xt!b8=L+6T4pDD`S# zmt_lI2VcHQI_g;WED`fJk#g5w7i_j~;Y->RDdj3wM}<&CW4r03O{ z7t}6@2+BW>D<}1ctRq zU`{ze#omAox47x8tPzFuSoSaVgGwyhUJ~wT2TY1&j1QytRqz;yQ1BtH2|jFw=_Pw z4I&VhSLU@Pph;_RtP!TkA~CxErl5dIvp|DE_OZvu@8+L6LHfiT^Pk8y9spOg8B16? z39p#ss&U-F;umal{M@LIhhxL}9**o_L$&*1!SF2qe(s$EBI<3n3WDw};r$a-PmFpG zwRAMvn@nVMKNX`kwE~)fdVTHsKrpsO6HFb`&rD9gGmP968r1**o7C+rP>QM5)y_XY z8yH%BP`4B|Fl{P`Vk?-058s;3ETdOVU_ejxy&O{`&SxgfMVAHc>fj5BelFZ|qjfP1 ze^10<{Snh(9mCGF>7xjbH5XFCmy7Y+GEqzA1+=`2CHGuh-kTp_}C;Dsma?e=4Xh2XLHwPT>R0LtaIkcPnu zP?9XsYOuf{*OYQVdm+2p_E4G3VQ?iN8j51qwnr5gM_qwLXN7iE^$}%DW7ZQeTu)EE zjN1`)+3YXbE5dlKX}}i*jeqD#q#!-3ffSF4fyjoGdhPVLy5bhn&PbIU+bFjn2q zKSkDwSFbowuiQI~&q6{J2?{Ij@faqcXR#4k_XDM7T#6HCl~hTA!6Dt;9LQGJ^O!w8 zhOKIS!?U0i9MWL}_%JUKif;J|vZsu3uf;Hfj|(z@u`)dMey)6u`+~!8b(z^;GkASI z3+th2ToVp;ry3LVOCvi=XOa1~dD}r`uo}5>?hg%^kHD_orJ zgAW>y&u00}$aN}Yx->xo>8m9{HJOZK*YN&I(*pH|-jBlA2>-*PbtmCZh5jw`S{QV|(Aqai?1)GpwRZZjfI;xSEq|j?kUG2>Np--rD*o}X!$S~G+GtkS6=M^i zlFT^=>xan|?FH3$2b#X8zaxRJPD_WcT}@6mHg}udE%bdkCkjQm;u8e!JpN|J44u$wGkHIt!1x6YiNvqiUrCuRT#^OaC#Y#QF`d>Xg?U>c zK)IPe>-^4yva6SsKu@!=usSsu#BJ1w-`+&Oa_o^?|Tp>AQ_OH6>A+?nzo- zZv@Src5<+!@%jz1^vu4PJ?neokk3zLQoZCoZk*c?25HmojRt6UtiPkRXqF%>1>mNs z&QKU%#q*YmvK>g1`td)hdN>2b?90)3GFfs@JKA7)s)+*56vT}B4K*So6dvj^$9vH0 zTy9hF`EmQD2>hnw?(=(Fv}ypJdJ8Cu1t5>MJyOm_eqM`mesRAdbY*TfH-LzIrJc*X zyr8<^+D2rz;Zv?23Y$ssV3(&H@v0l?ms{)%gR#Fj*T@)nU?%dNXM5RnCx{s_!7evq%K2;!(wgN@!oinO@ z@UQvDHHOFzHV5XzZKwsjoA1R48~;W*!CrAd{D&te zO@wE7lpW%EQtdcF*~nhv-(fnTmLbz5ug+qqwd{sEQ;@fG>}?h`S=Y`v z)PYjez?e{@_)XtZ*Wbfz%s9-hKf--RXLB+fe5elcP4bpz^DoIj>reI>qEl=7{1CCv zF~89s^lxP`<5zuUODpnSaXYnuJ)0fZy0>7PyTlX(k`^di=tAfz%Q_pu*>N#qe#}ik zjlF64J!}o9#7N4NHaDs?3z{n;`WEQk98MVn1sLwJm?r1;4g9(LXmpl^Z^vG>g@MGYgW)+iHhrEx^l_)5({80Ql=Isx~6%;sA zOQ^)A^Q?wCY7M`q+vJIqU$E{GZ_m&{hOu`79q3DD##=H@08i%&Tu@jqCyDv|&D+sf z&EjReSdDyXYD23B`BC@mpc;pSNfbNCn|eZ#IZk3~t*iJr zQ`Mt2INxSrz4(|BtX-w*8o`)7bnjg-gj7hvn1ZFJ}mqgJbk%QKHGJbKR{rvC+lY@v`x-0&z_Iuq-201n^b2~Y> z3sJ2N)+l0}*pflQCZgu#ST;adVZMCkAoy>M8h3Dy!d7u53&4!wO-i;bldr2v_U-X`Hoh3#*ow{=eZAVSnir43#BRZ zykp&%sUjU+Mv3JIJGBp5Aa3=a?0CW8<)6~O#|P( z;8ER!vcwIQIBtXdw?Y*_^+Ivd!tGR2CGpGwE z_B6s@CKFlZpx3Z}%*+GU_}v-!gUnvCvR%7qsM@x~T@gBH@b*kmqfKZkk7A@HQ5MTLNk?LIfSP)7LVrxFJEd z{)nMzXRJZK4}rqAV6IO{uUkd;2uL`pD49AB7M?Nz9yxqg=T=qLrklHmMa^dTfHWJf z1jP2Hc^luL1ua+?nP|@tq9q$uPKCf%5eTcbaVtrHrs0HH0i&Yf$QZGUmXYiGwHd%ve0+d&|#ur-T?n=Z=}! zkUq9xfR$P~2r^;*R_(^kTb{F?hTq$Rzo2_zjTO;q*OLF#E$A!vsCxT&!ta#L!2obX z-Ahv|n-#T^&oYUWHaN;&GSYj?Y-YNqdUN`}jL#VE(Zx>o>nKJqV(@)d>YxF}Dede* zAb*U~#3@6%Pu9xP^>>I-nvniZR*Nvh99pKvN>=NO!`Bdj7&|?uyl&PEa}Egc5`^53 z@MIyAqOp=~5qU-QeN=0nGlwx6WrJu;0X~0G ze9tTH(ibqv>v1f<-9eO^QTb=^@Dv@5a=I$c0cyoCrWy9dkmD#Lh^1OF%+{NOz$ z)vA3Oa&TnMK5qj)zXhvdpP9SYR!TdH!e0xy&t@C0U>2o?ts$f1qx9!Cu6FWEOH`rG zU)&-Y6at@ioAqyWu0iC7Xg@F}nmc@N zAe@7iOA($ywZ87rqB>?P+M`Yen;-)bIVFP#V&rz~j};=WCJ70j%pabAUYk?TUO$X% zK(D{zV5FI1z5LFibB}&pBvcZMDTX^nsPonChRVbrby?4Ii%kW~;rIQRBg0jEYW~fW zE2Yp$e2$@*1ARuXr;Y!}=NLPCPnVE3YkhDk(Qvo#6}*9P7}xp>B)hq-2MDH(o+}|$ z|6s*5)R3BVph4`u8H=R<^fgAR*^3oZcGOhld74!PtuLQ&Qm^vPhv6>N;bW|s7tYj- z7z?Q48!4s2ME-X@$XH8t#+JGC0es`1Lm= zGS4ZF=|GM7LmJpfnu(A^j-Y#wn^6K#Kh~4P+EgV~UU(^1UtUmZ1@^kAdN`hXJlr4IkG*265PZI2iUr7<^D{Cj?4JQVHKntE zxI-sP@;#l2GW8n2Gf(cR=6c$eF0mN+jzI2HccP3d{52;haY|xdLZvwJ9Ye|quS3-Q zD4?H=f@pFP)bHpcEWlOShs9)q0?it)bqz>u5aSsyq1wz*gu!_$D`6o6ypaC-tn(E_ z4ZmMy#m+1I5aMK+=?cw3SgSo=UZh2ZGIN?+9(rU!1P1PZbFEph6n>fuwT(HtXC*6% z>XFVbfV(by%rc}>g9BH_$t#nNsfgB<_gjlDZUk&M?5qjIc#&bkTbVnzD67|lmyB`F zUnGQpBaZMI^0&5S`)y^!%XiwMnYt(YUJQEQRZ{hpWlZ(!8WLUj;Ed;~q8@7x(d0A7mGB zxbofmcZX^P^UHvpYo_p;XWTKq0-=e{*KoZV!m96-uww{@trSk8e~b2qf{(MSros<9 zX=yG$H4tg9f0MR(z44O%LAxSRPCyELdc&Gv$Z{rYg#x5 zERA^?)e6kc!VcbaINz`sk=r^o@nntOE;ikpGmDI^=Y8s_O?21zkZ*WqB<5G#m2Ga* zQrUP6G*Ty7JQF*p@V~3LM%v}ILY#w zz=EWSkt)LyIv;*=ZDTEXqhjWGyT4xL)i;qHhuiV-WoQ)OHAXF1n~BFQhZlVLt`q7M z7^<$wi*nu!U%NO4lCI33S`MF#taG3Ac^^R~r3roLNt#=$HvG*vUmk<|b~?ZPM3=kk zO|p_nk0*EPR2~4|vn8C4w7M`^!;4^F@7qa7cd|xW)t52k3PXzm=ADH(Z0`i_fe;5t zGSAJG?@DOhjfliT;`14qw`v#svcdGznnU0YgH&UjmRFYLVI+w<0iokin& zWp56D1rEj7tfR3AS6*9HJCPcgE0Sb>1?`Ggjwnj~TSN7`B30!B9_RQU+?q7(M)9vNyQdiOyu7298 zXsO9Dl)02F@`tcF@_7?NKII&YEPe+sT}t8=$#`&=#%M|K5qy78gnGK@!g~3_WL2}y z=649%72rJyTzw{4n&K4s@ljMKg4&*@U&%54O-KV%niQ^IQFQ5rUwbi7F;!CLf*ki} zUr!TGk?lzwD4*tazZX7*-2Q2h;^Vxj#94T>xuDC_G?x7&;xRJU$!i&yhdTo>rC)9+=$3DI8vdmwcIML?5aD~ zx_U1TlhK(Z#?yQo;r`o_i}#^t#F#ty8tFxO47$N{rT1CK-NHiT|O}yr!K|h1B~X z+70{_#hSo|0&n~g)=%Zoc~VxmxlCOT4BEcwFi`>? zmkh!Ei!KxLR$g1UlZt-4EBN&aWPHhnD(H z=Vpw;=)2j=X$l^0)bJ@$*r30 zhx#hyv8xMv)Eg_vqH3?SOIm^TAdp+fY`d6IVuL7&d5BERKU}6rWJ$6ij-IO2n{Xfva z$n#4SEXX3dhw>`=grc>pc- zol^@(>e}(YUt7qu9vN2lZU@{LCXP)&_062geV>|F?PZY6VZk6<=youU>k z&xh=Yf$i@nu1Px|h((xZ7YBVOh;{6h9QnOt(6ouwn(Bd-nWcZOEdv-alRg*jvun_t zmUqI}ZfCy5D`jPTED~|Hm+_d}7(SU-1m0s-NOH>et}Y?b*I%$B;+5RxrTfbTK|<}f6)^CC3C>) ztL9u!X*a=h<8akyCX6*(QO)q8Yi)aPkU!W`!q)P!8;Z0`>%VXr{8nl(Pw!^96Ltf9 zmR<2$PYm|G(NG$9%ZqXdpzF3+P2e)U-IZX{i?B;<>b@9kpy7ynrL36_p1RV(eN6R0 z)~yuQGqv8ucoKh-wYqFAvxuu3r9Y2zuGX{Wk8l$FKjxN-S&$w)Hxp*XM%gTA;l_5{ zEWH&Z>k|hZ^UVU32N?fl@M*m2%+whDeWT7Tpb5KIv`lSqxKtONS2=-SF?VYS*Uc%Dw{4`<)q`4ql;m?MaFv| zCT-jAHjh|%xMe$mtf^zOgjSC_mR>3Z**KAGS(#b<&~i z4t$puM9j?Za1DZr^?A8}(Ctm4PFL`7NAJ{Cc7e*han=3}_1-7U_k4@QP1+m{+WFM| zWX-5MSKEu@kiC; zb?;~sntxnW)JB8-lPz9!Esk^9DxZL=*F0TML_x@+Io7=5ahb92wbB(w@bqd3Hj<3< z{Plii9KS64;0^l=VQ#Qme==d-)oLbtvaZrhU#HJwNFk)-Z(7^Bvm!d=#g@FHRJGJkbuQP5oINwG7sCAXx&n;*{TVt~pCcOGW|8sjj1r{1}Zroq4 z4;>LD?2~epD#0WiXi!`w_R0c2bclU4j@?04q#e1MCRWQu+D+ax-uRRC0hnw-ob+D( z&*yE8*mKRB(tt#}j#DEkuHe>2XFu<48Xz0EDENm!!;BO+C5p~%jCT^;dqG25DdD*P zh`YbszYKkf_L!FzU15YGI(xNl_>BT1mfM!n_Kwv;=!V22e>=b-@BcTHpg&l)yLvuL zsX4>xu0*|8rUw+!u~U5EpB{9@mbk>V7Kgn}SPq$?hp^_R%;g>32KEjmE!Tukebui? zU)!S!eSf(pwafyrwMytqpT016&-(sr>_Un^l!go;nr8=`Pi1tDvFE)BMRvAs@${yA zk>qrpu_ZWyUu*l#(BssbA2qgT~6 zUPdG^Lcir}MgLi~k@AUZchtZz<4eVc862QX#~4O-pSBQ|cv zAP}Dx|G1Af1xaHc#a_F1{9ua^rtQP;yELAfrMHg4pTBX8^s9N&^vZLiVR-QFbPQ`q zNDJcV%cW?8T$}sDOou9&o5>&Dvpq!c+rk*4pEKx-@`@)hhbURio+qz8TZ1npU+Po8 z;LbFUoy=gll!|%k0+-4&`G3O?BWk$bVoX)~Gk~09kevZ`)O#?hN1= z7O2Ce0dJ;wVK1_YP*dlI>pojf{LQ6pak;*`!uRW54JAd&o*Wr&YS$M`j3+7cKtt~i z^S9H+YfHoq{;M2z;*Bw*JG!cdq(h1nou>cJ^clJu{)#=k)AfHPA++?UJc2<&TKvH? zumk($;=)*YbCX5Z1vT|r2Dedk}gyk@Mk0v6Y@%{P+N@R2N|4THbN4Rx# zc;f|0M1>O%qB1;`n;!0SV9YKjQOC9~x9Ct*D~%pat=vIXmmJK<;Nlx{bC<^!@Azu{ z{s-vq8=oanyVRKdR}^yD{oRPDRa_UMin&4RPZD=|+aQ-T2IwVcnWk!(pKOX6kWnJ} z00(qRNZyl12QqUAA3<&+_Y!B8113M@2nnCYhpz-9!D}mogTah$BD+a2%)kh?T)`mZ zwy>IhuuTN{v~e!1u*k?dMtAqeU!Y@>@^rI1!-h9sWDAGRv=lv56@3{twc$3IdA}#r z$JG*X@@ux0Ei%GMG`DE;=*%Hf&|et_sQ0VxL7(H55~upF>Tnz{MhWWSAb2vA%w=uQ zUuHu9ix(Oi#uL;vcTTClBebhnS*?VdMO<#)JHXi=zfnQ-dco!P$GdiG6bG0UH5lPF ze%V#INDU8FOdsg+(g`Rs06SEQiBZEp0zN1@rHWtQy`Lwh6bn`R%zj|Ivf)Ik!qYP#a9{M9!@%gA%y~edB4f{!Gn7d*)=i0r+BLK76GV3Rpo@O@kM7+H3ZHVfEEFMMO22aNE+XI7*qg_mBtY zroqvz#uEKqq1u3sZvu4BRA((F^m8g__&Z{5mTEJ*GRz*oh|h`KUi$~@mimVLkayEd zd|s91ZU7dpnre&!O6 z;wY3~^cppYntqw^AsY%;V7I6rQ+%5E_;mFLg(v7_P`Ho0#PHmT`I@fq zd5pQPGI0Nh70Mx!$WE|btik%t3|i};4YA4QwW3eyHH%>_G#g7j0WC6Y>UB~C(RZeE zEQW}`W+GFo33uQTKsr51hvUvmmc5ax;0lGcilUaIhPhgcW+?M|D^)XwLkLs*!|VKm z?me;4+@m}_aDl5apyk1z<*Q0HgrELcrj;eu5Zs#;H(I@7cM?FX3RQ(shEM=_{2|p( z%HDFQr889^T+D%b^$ecwCRh(cVdB_O6K<2Mt^3EcFIU!9m+cf9sWFH(cNd&d|3&rI zz3-WA5OiTFEy77+Bsd5dqBy-Z1 z`uTz++X;ZCh}Nxa;^JaR`@xx!1cHUbnC5G~>R)avx2XVcF@zQ@Rz)?@47;TSTZ-fH zh=NpG@lz1qNMk4q0B{zz6z^lT-Q6rdpWFYU{?RNtY;?p`s%N7KwHdE)w?=dldQFdZ zNRpN5tD3j^PIyJwRYJ$+a3SK5;b_9X$C=R#Z-D z^}lVYr$wgnyz+`1=C5L5@9lKHMF^PY$!Kvp$NaWG6MQ4<46VG}IzdvrU8SaE;R&%l zg<$>ucB=Y4I<&Imk6?dO)cZQ5;i6Q{c|cwQ+nxHYfME2a9|fsXJN{d>tk7t{`q1f; zZ?Cpjd=*NqiH?4Q%WYMy?hf**bosEIS^=$pcm3|BLcg@qX6V?qw<)-!Oqtg;43D{)RlnR!9nbj$)W)M-vq%L*%&Yww4H6nFGo5j_etYYr&@uu80@8%Z6^TOWd=CE}7KO>1D{HAQS2F*kf#7S6JuD zqErff>9wM!U0+giC9w6vj!nb0-y>q4g`@uo_Z|?SqGS&os>q)f)!y=@xdioxx70R| z#~l%TB)t4`*!;;Pq{cP0cVW8-blD`=XnYd|6jA=YmIoAP?OX!WPYzvtl4DIuuTR1n z9ETGpn;+!fEYH%t-B9HHP9bz6FcDTyzNUn6(r|0JI>M8^*_$tWv!-Ah#2c4cZtoS` z7mVF>5Nt)kcPINa*E7%(4y}us>o0>6|>nl38V}VeA$spWYl@<~gKcCM6jgMB$B6Sq~Hy=X|4% zPd5rt?Jiy83&q_l)z#xZiZ|vOrx|B-WCCDCU>cS5nD^4T29!SP*O8E;KdM&R-*s|g zs^Ic=6OZZymdAQZip-pnR9gAj^p!JuOt1~yl`hw3j9oo0*my*FVgO8?X+xN1Nk%qf zB-S4B-LJl=_`La5tuJWo=cYzmk@#b;e3`2?d3q4M646#k3S+ znI0*pRr%N*c(|H8leDjp&O;XXLWH{2tawO)PhmC(CZnNwTGD+voZOluxVpG&RQITE zMWEabuQ>1pyKdc}A3R+d;AkY0$N=@QA7YtJIqj9k@Ayf};aMGC$uwM+lJK>f-t+)v zy$T1w%};;|Y*az8t*>VHxhy|+*CR}WTJ{@j-lO)v<1)uNn@f=ippnLvw)9Kfv=-nMGAn&ZS-OoV6PF?uV`sW^= z@3X`)1?)xLzU)sC+8=gxUHUqoDthr(rJwZamwW?>oo_PqZogRi;CEO0xqf5mH1gQ~n7gX!AAAlwO2iJ2Wm-N>__8DPjE`nJK&0`3>+K+o zv@{)Ayt=hSDlO&4*TR&0<_^=33;F`+GMVem^Ul-fj<5#5@$Wk7&6fn2VNp)6%hb?i zfBq~Qkyd=u1>4GbA@pWou1rxPOWeZc2NV)LjN+=C74O0ny$idNNy zIV&BLQ`zj)lETw<+6o#rx}Z@#X3_D6M08~+4s){2a2|_+kJ-9onp*pgd^!HMVy_4K zm)VBfU=B)i+nrJHgH>>%{zu`It#k^(RC6l*EPr;_TicexuK(N?vYse4)qM;hjKnFr z+$yw^6Eh5TyZq8uEbe@&?RY_a+(rZqujNxmuIuS9F1zJ)ShlhPFkx}|Yt(#fn!13$ zD$q{ys#dzCbBEaVfYNIAwSXY%>yx!*pq14$q(L^ z!-;p71c++^=#F7YcVZ=I7(iEAKz2Hqi#` zKi=2;2YFXNXya7Q6DhhgkqHN4mQa`r$=Le_&Gy**dks^hca?ueEOP4|Hj{v4+X2lx zs!zM19N3~m>q>JeobnKwe@^HL=wpL1i}YxMQ8jO_yK?xnoafcfR_(?6(CzqDmsh)8 zrTL$5KB`bj{8Vi5w^42IJ*>hw+n8!Up%($FmsLFhr<75Ce*?1nz%@1b&{t2qf%54e zZ5!J$T?VX%=o$ID>D^A@->KfOU|5IY)Z=D*mcdPD96SdD9~_G*su+(MfGi9H7Me_) z0%S_|Z^9_1ojU1fWnmP@;hsyd?re-$*m>zam{&FMm-d}jf`uZ2OlZ!*d#c2fTT#QK zw&78(w}tlrN5A5i8Tsk$v^4)hct_;klSXGFPWG!N{7h?yGm1!=%ak0^*z(YWyk{yplxo!b zl72SBsrzB`G{q6rGgIgMfq=u0X;=vCQd3bnHTLvW;XRkOljeV>zx4?s_;}5}raZF$ zAw`cPUIn3J(gpTb@Rp5Nx_NbG;KG7h2Jot0Z zizS0-wY#0D1kr#i@kc4CXN)U=9t%18suh{%<$r$~y5o(X--Y2a3#szq4J4H=+Uqr2(77RC8$V^tOV*6MYK*0pAy;GB?I)JbwFyxmu=UB3ULw zQAJixis=2aE$nVcNF49&SL%uUPJuk5OSdw^fc(2j4DeM=ziI8=#GY zU*;Mok`IBN%Kj)1*!4kMXzUf~d=EsJnCIwa_Nc2S(QLG#7u78z31ZQ#0> zF{VSM+|SLIf0!^6zC(ebhDzQdnDVf+I;KsB{7-n8ecssE7_bFG{E1M6#u`8i$|Bz_ zk_tIT7}hOFc_HIxxWq5QJxFJo1)g7V{TtE)t;|?~xSfJ3I^Dfd-wO~5yyC5$yGpq1OwL{V#_I=)?!+gAoMUsOK)>`oPMtSW z&|Jj2XXi7}5!MKTaLtK6M1QX5{akas%-63R6C3+GS0fm$@W6W~lwJ&5_;~pixqL5F zUo?Y8ou@@5)fH8Yx=diE88gR$u>42C#6G7lbAK;k7B^w9F;3wtrMK&%Gx-VWy1nlc zuhP>$EE+5!7kFW5?cvhWN2PG+tW8V1bBV<%K5h`%pDSJjnyhsy(pFEV8cZmzxSP@R zZ4kO5490dJq>lfFPW)`Mu{<3Qk_eECX|A50IG5%mLt#p9bDFAfnCeopC!)8|Ii}QVck=3oZ)6x&fhke3JQJG+ zIQX*Uk|2lBrUHF@tm0w4t`7KHcPA?)q?Xyr@iswFe-a&Z2 z=i#?!qm}yJ2?cb6LkV~y*YdZZuUIx#bc4Z zBfN>(FF3hDv2$B1`tHHMT4>b`uRgmIyI+WiZy6 zY%>@$^LzVzzQ5;>=X(Bp=8vvxTyx&N&pG!w=RU9de%&v>dUv;Uy3c|2YKh0vXrcQ9 zafqM=1lK3l?NuN}(9yB2spzF8c)9+Jtb-0}qov#C@5bOUUd^ZuA=8bhZIR!dk9yPx zhm;70hi~3yn(^W%M|;m-2q64{8dfMsU5ZDK#cOe-QV-iASUhKzpUO{va%~6zlVM5K z+H8UWV*HotAipY~8>KcnrUr(j`LOSxAiQ<~ZHV5mPrV_mg_#elarGk_zE|VCwU+Qc zJ-$e1S3~UxX+wt#-`%fpL3Zx%2ANxb5=+S^2`V)%f2Z^w4~&u_IKHW~Xz1Y!*yB<7cAnaOX&XtRiw&-K7xJlQNqyqVLxB(MxyQ!sIq zPvz*AuTo^5UGNSd>C8ww31Seq01)S$bvMa~5|U%RbD@xS=sfqL!uerxlWdGJnVoL` z#nNu_ku%p4+G20Y8I4(Nb|k>K-vsc)Kau%1w)jeb<=eDRi>t%Mf^!Qc2DZCX;dgza z)V0LG7Bl-4*4(He8X?jdI4Gz*L_b@wuhpDT8#%A_{s_@4X-8>}QgG6ib)}aM&cFC> zAy~UJ(&f2jn|`AxCB*#7!d}lyyyluZ~*dNy49CC1g}}&pqd@tB1EFs(mw%ZTOL|h@vnJ^(2ybnL{3ReS zERd!dEq@?D*BHY?`7=JdH!XOrc%$bv0&9r6vp$JbyEOm$DeYn<;$ci02V}r$TidRN z?!@qgfMngAFP(Nz{oKbPlN(O*#oUM*1A`6e5@_`7^agF*|0}X_@GxyYp8%PQh=ofT zo!OPh|K~**vl9~c$V=X5)R^KUKlGtF7O$sCLFNaBh>I?RsNrUT0wv+okZa*$hgSnq zPsYLLjM@Ht?p9n6HO?S?`^@fCD9FC~JACSGfb;y@{Ym>ZzwPI#v_Ve-s0+!&Yy<+) zO{$)~j}7c{Qyt0^RhD(tnXeNBk!ivn?TM`^zK6coGtY5x#`QDWE#5MWuC`8aN_NV( zP&YPL)pz8>g?=~Xxb8kOemkWjn-E!8{nI$R)ra!c66(u=`_rZF`C*G5-Xj?cpYK*X zar5c5oc9v1O%G~0)vqdaY5Dz3c-h$0W9k_+H`X@tcqZQY9(kKp>OH3-ZQ|KRc73x& zTI>0r0TxLvw~*nvs;b$sU?64*D2f~!$ zj(V&{uw)t-6cg&>Q?(O6Q@b#KlbqrFr7JDvA6y8p!AMmp+Scq_Vp8xpaX#XXJs1{F zv&7RO|5!N3xe85>2ue>e=v24@$sj_`OkL1bRF=6}$|^E<#kt1;ESX`A^!FC0%`Iiv zqe>x}6X7AZMxX28=grIYZG0|6%iZIA0c}7DumxmdKGKv~VO$wIj<`6#sbLjvH!T&- znNbC{eTVw;!W(51Ax{D^`&<-uyhbPspcr2O;j4(0wiBae+!4`~?)0!2LPx{UxaUl% z-f4n-y17|3Z?~tvojtaV{40_7Qtc+s&|Koz)XwKwk;>~| zT@#qLeqN~)CPi=!AhJV^W5~5xG^??;h@QkvWCR+q5Nd`LC=H$~C9gGe{#cLI{g+y@b0&Zsh%n~ z4q`ONU&7P5PL;DZw*2k9u+7l>mGe}~PLH6dT*%+&esiqg^=xP>%Kgp{ewEgJ->t(z z^`NJ;=R05Bqm+`0)~pUJyP&atA!c}}__GTBthgl+7U{g{y4)Snt6~tPhO?{E^zGH7 z9h>>X^!P2((T;BIb=^c4w|wg1MvmWHvSA7oEsCRY9ouL|7mWKCTnbfF9V|K|XtPhL z%dV}&Lj>03s+AO=(wf!mzp~Udk|(sc_-;0cJ=nzxmGenUTD*rlHEJ%(zvqV#HzO}o#8PUU?|GO( zUcQ)b)EihU%eAZ@>VpiSx*j;O{ejI>cH-u*Fx@{jZCH$j3Zz_{ttUZowsjva zGNxV9RjV+s+M?d@ZY;3n%jlex#jtm?_}{N)$mvcYT-jSEZzP|W6ly7CDj&#A(H)*& z<*N1><=*#lZYkL0uW?|EaC9Pm8staHyG4d~|i}TmH zv+?rog*yg_sxR+-98yb;NWXmPo28tdyfU-tiN|7*N~t=6IUayyxm`XL`sIbc*#)ce z8?Sis?y~km8AW3(rx!1K@v;Q4bt?ZUqjz-~h#Pkow<15^xmdwpgXtAcKgST?S1v8%aESnnd zFAHpL0Bh0>c+@v0w$5X@s!UG`N&Vxd6o^kUr89^aUXLeskL-nQbraF2w{D5V}hPpo1H_?N*Uc5?=5 z5;z-xbqSgaAuphH7JSW^(L~zW?Ki2FHVSyUK#bTH{n8KqL4j#XFbUHxmO*dJy`s+{ z;1^Oz2U$pqUgcL;L2tMLiF3=$3@L!nB4qP|CW_}1dkZzSe9>nw% zplTe@r(Y7{p&6;2-)YpdwbQtX#~w+oko`XMrQffRS*x`uX3NV(768U2WM;nr#tW z4cq9=n;+q;o+Yi>~A#HO`;%pw~TfQTMrKdcc!~V zjw(#JBLp|_&N~Z|^KrGlOS*UY693?|qg*cW`iZ0246t_q7x2<6_aFRQ?OP-k^Y?26 z{nf_GQCQ&0&(7LCorOVfyw;1qF0taj0ZCPqbC1r!*$cuaj!-tfy+F&C%m10;xAQ2U z+1kHdC}!Y~z{lFn?q3ns|Gs^*{BMx|`vwS-{@3V#U*rF0ng9Fh{OG@z`Crq_|KFQ3 z{~SIz*dR?4|DjE4M(EO@K*3SBdR@N!Y@fqS+`qH;4P%)P%tQP?z{2}D>p%J9`uj+lb z8Y$SUF%6&vT||IJw)q;$slNv!YqalE2f9CQ%ni+?LN>y{2?(5=oLs6Mw2LAO^!w#l z^LAf(omSK`7n=U7EYQ`a!Kc?UH=ni|mk~zSji?tp_51Yka{i{rpQXym&<{?PVbDzy zu&cFC8Wikjc!}J>w3nq*r`uyAc}b_}LY?*Oa5F&5iS`J=14nKJ@gX+;8NWf!nO zn(Gm;C;7^B82vl$ch0fqTdDZSwaa8FSjl#u`zCw5*e%(I9p|Y(V-R5`w+=@Pq=C8T z)|?770NksV;`3&iA18nAkO?jHS888co*yg`Z35&spvWL1K3z0YP%#>_sic`Cp#F7n z{+TNMU&HwM(0BtTJ59#K6kb0z=a%QwXLvs71I2+<&nGp%{!D$^gy>wuCV@Nswvm~9H26eKu6(jWzcdBX6Cait11 zErKRc4K{R34CY|Hszr3&g874z#&H9N$87&?qYS6GKxNg9M{u4Wn=mI2+2D=-7fZXd zESk-TH-8s=RsQ$u*Z`h?o7H1-gJ$a%DK@@s%ErH?v|sE$;=~;9c?=FydO)XvPXXug zrK|XAu*hrs#?99oBSH4Hi}>Rm?!T2Jd2Et*p6KH7b!`zxP2RML8gJT47|mCX*R2-V z7TvCZgYS=)w|Yjg8REaeyoVu=cVLpB#XIyppTDNX4e6JK<{AgCN*mW z3$3V&7@_C4W5exz!7_hi#LfmX$6~Qwngl>h5au-h)BqLo2eqS0@h})d3!*9hZh}KU z_yzu1=P!1O;HthoFzC}axXwpWAwnz};gy_I&wp@6h`}Qu6U2M4lA)B#kFU}36 z1}k9H>ss4HA(739scTSQ^@g3fcQuvpt#%dSEjS8;I&8|1GSRf@n=U_`^dZ*yw3MvL zU#x>zxXM%R!Z*vQR3GA(L9dD_-8LHClk7Ow=ERNlK@-r#hKw*YWV(~Oer%P5)^$Qx zM1(uJXcCD9rve8{>$)uUr;_-lf?OC_c2GO&2k;#WH2t z2F=PN!yAH)DJ*>dB#Pcg)UNynLk}q1A_+c)-$Q}55k#j`SR`T9e}KK&YKxe@IY-sQ zI}d$Jx=%Yy!A7i>5Z78!**n!Re#(mfER3k0Hr)aosw!w$5SGe|=IyBNyt!(Y-!Zw&@2C(KLB?Rz)^9E%+LvxBoZ8cbMRO+xGp*O3M zN>bgXn!CTa6s1B=X_;`uAM)$`A~;3NF;cz zy`lBRb2ruUN%LHoZ?pmixVDTd-BIr&*&a&9QQ0?>kLUrURlA_MT(ObBrwyAjv8dTc z;Uv72%?mIF*81G04YwULSf?_3HsTN+(N6ld0LmrvpVEAbAe%K9vQnOx6#qrQZGEB? zSRqTQs`!IP({b?Nb%OYL4}dm)xxG z_VP@5yl?3?u-u*P13qfEm?^Ze_b=I>S;|$yeP!!h?>=*u)du1;Q8S#a(o=DimknU) z-d{ZiTymUP0;)TN1CdiZ#RSq}0>}d5#et{a?AfBk{E=@G9if1g!S-(X;|U$5xRYOk zOF!gGye%a|Mf;lpCkGUB=^)JloEsz?8jxN%N_tXOw==2ZV)d0$}ZSingbV; zrsCXg%~8D} zf)ra?T}`D5P$Y686XREptt)beh5e1hHXN!G{*7EEZNk;cB@C4YBj`0fbt(&d5@L~2 zkmZq5X z`7Lv^o9h8{m?qMkQFg15pj$Fzd%|b<%I8tz7_5>HSqqrz=4a2IrQbNM5Oe>-rlAwd z`+JQk{sRt~GPOu9_S*GsJYz|3=Hr`A%Tf%UdTT(Bv*Y7h2`JBnIb@88tg$8KGhOz* zNsw>k8v=s*BuxZ-Bi-nB-2Fc&3!5gnFZayXg9yzqL(#kvtg~606wKI^6*2gG!V@D~ zwfc=t&>;1HXOX7n=BlEqgXcKlIi;Jeg@$v!nsx4eicJ<6ucIe!*}%4(DxRA&V;m7e ze-)V^dY-KMEZOykvy0blu$u@qF*JLaNC=Yj&rB_%@E0X;_bTy`qpdJoKDG3R@(-<1 zS&cLg%a6gl`W$RQh}XHUiMU`3xM#Jf=)`@3h~qWHc2~;N z8ttbwA~vl_aAPUS5VNWj?%cuKHVV=(V|;FdYwyV8vn0U*4e%OAmx52DV~B9a_-&h7 zpKa$S!yUI1I|faYr4sL(K_;@z_~Wsva&@2THj`Wo2ZB%`lr51j6Jj;CcBhHLHP>nO z{@z4-<=G5Sa=iFE3Q8S0vGpS(2)&!4c1vV1V}CZ-9;R9?Z>SI>^sTdLj6Py7aSPE@ z>I5UU?=E!R=rIpXXoy%y^j;6iK6`jI+tzDqYJt0F{ZW!%W58S2^H|f<#v=}Tq2RX* zGtG5=vz$cf*N?XRzU@XAIDx*BVh7uV2yxJ%o9S2MVGl#+&kZw92L3rf60pMxpC4%? zE!hVV!g`$c<`x9fq$o-et>?*Z5#)|MgO+ZX!SuB))%P6Mtqt3#5pvquY0Y3b36>9k z-nGdQ>A6~WgBCvXbTn|r77T9)wIPQu=Y6_urFw1)?5w}AfDD3F^*{|$p}2#ObnmVZ z*?5#4`&L*y6i)3aqTE^=MKNw{72^ID`}H`n9#@vKC{Xcll7cJ!VZOXQGK<|O*yh&0p{iWp<{)UWC@fdBg;GbhaAO9~XzTqyX< zg>R8Y35WHP+e9-XKC}C+1q}#cu&fjWdy5FQ_*Z9Oy!alVA+%MF@gz?LeKCWZb zVr525R=8B91mmKiTs6JavzHdDI_wV-}{ zf3}9GiEZRGWTRM|kr%7IK|$<@(A2x3=T}3x==71|mk-@x zC)nQ^0GEP$`95ekww4j*A6E5QZy??%$lqr>G1wHYeDy#z!V~7Dvg}cCZO#}JC8cuX zy^w(5`_s00ZPsH@D^$f?P%7G@W&nHB8kN$N0B#z z>Uk9wT-EEq1wG^-{8n4HlIBQkQB4GWg@x=A`C>Fd5!*fKLU(nx}%D|YOmK3(lRWjx#8*3`Bzsr`sI7`c_F=yoreMoTU_m*BL@P-6W>w$u+& ztwBp}eV3? zzt_$pq#k00gy{j=f8w|rlhvG&xH{HZ=o$p(uWI~m8096550*XBGG%m@k z24-%yaPLbuAQ$F_U4Coka_|v7N_IpyahRc=Hor;IBdm|4T;3e6==PCr?)(?kzxmQ$ zVMk<%>8X;xq;i;Lu@kVAElC0#HYLx87 zc0Dc}ygLhcb)+hW4CB9=v;Ztw$)P4`1T*b3E!E9+T_5G?4Nca`K{yo!bjOYagTrT3 zah`2#k-Cs;gRQ&rV=*BZq$$Uf=*-@mGZFKr(sU3AC$BB|5qdv*=O!ZTN~{PTyp^IP zmQk674VhOA+r4f#)cY3tv!td~NfSp&BS;(K7Ieb3M6xyQntj%C=pfvF8g5V>HCEjC z!}?aNtv`SHsvKkX75c3%U9x)3u9fMA;!T^36AV8sK_}g?r^iwdrxEUp#BlfB{u+xI zk-8URcffABr^{B7(^Yw^Lk!dTm41e;mWeKK7xRy=Xq(@N%vkCvU_Y&|s%x^@vbyav z46S?|EfKRAk4UtHN>y-7#4hgbQ)}y+e-{*YBrLS;JxWO$^z!%aUm$8f7#G4ojZWnU zR3Xp(>|TFlPtPq87l6EH{I(EwUH6YXjAKX zmQ_EW&Vj2>k0D@Yj|Z$gV5`(Sgg;vYReqX}BiAHuSMo%%tkRRP)@47Q?zJ!YCVXdW zofZ9&212SYsOeAJLf)I7nX+*HIQpVRSiOOy34gvc4`1kYjcLX`f!xS{V~MkF-W<0{ zN7_V6u54EC` zT;Bm<`|?UVkxv<%sp7z4Eow5Qo3My(cD}eeVY4gOvKLYwE635BMUCgth896r$~kMA z9K|9nHs@8Q2UFEFkrL92W?XMM7|G4)JrCF8Id#;k#R=KwHiwF#q@i(97#7RzPOXpkWpAxy_3lieWrYI-)o~4S_FhHdJB|wK(nO z%=vCQ(ZZXv1IGJHq;~7U5*(??dZ5_P(i85|)r}A~g>*cda zho6a?lS+DG#LC5~^>otHLZ|VYqN4!&pzWFSnS61X=XoUgku{~rbV5dyCy93f{DHQ? z3EaK*@S`Z-R9F~Db-VrD=A0<``^p9RTr&WvxKkzd*xVtOHb={P`(D7P+urA*voQFmcIFm z*w>5KQiut$rClhpN!zH)hu@*J4eG`ZbII&Ck3eVdw&z)I%I7BrRh!M=s$ylZqWFlb zL672uK9t}FWfJX!W|UEB=FWmHGPRCPRUOK?-B)o`WMu&l?%%^o>ph^BH)^2j>+w2B zdblIhc-5JWO(m}Qw@GV8pXYgXad0W(_1Pr(ikFr_*)}L|Fv%By*9O<3u^&aPnN@DJ zivRp2vZ|t8@FmQMrO^6WXpYvX*X_ZCU8SVj5m)KejROd0Z&q9J{ZkIxU2x$kHW{Y! zUYF0wqLzgDdG!!!{)*=MBnss?0JnJX6C!J-GFhen_b!I2adKw~(pI{FM=%OzJ;vMu z5*tv;4$~sgCQHVqib~GT(Y_yT;v8j=wnl-#jfwVsc=i2Oz_T<|F_QSuF#Pu7G}kIa zP$uvFGe`cWIyrR`ZG`^R;x)=UwLjIKztKi-k^T;nb59#Os+BbRvDPzw*>kwK8?o8# zgAYbe?AL34FuDUENtq(6mfs(ZLHkFTHZs7W(9Qf!F%y*pn~UNeA(m3;u)8tsk-v!~?%rD&@~_^}B)&L!)< zNNkwK9Q`kV|jRO|ULB!h$Q2E>cm>wC04ndxFREw(ydRJ5H zyf`CWRgQswcNe0d^kzLNm5=jKU*jrD@doj_%1V^Vt0F%)i~Jc?J&-}bo*%Pt@DuR6 z@^i6cOgFWK9OU(f0^IIL=>=YW_LWf6qk&$egrAHD$$htw031OHna|m~O1dTe=d_uH zJ>c>PHvcR}`vVRY$uZW3 z2-j3Mrl)zhuHL;>|JaMBy=QA(d!b33 zV^f#Wk8szifFrr!Kt`(FYJ7yLL=f0PCjLcGeCIwC$!rzhyt=j?6dgqcycJbI_ieY;6 z?~V}s?M=&)o`&oMxy^NNl7!(SpR9ATlKpI*yykk6#ba9KG?KMms^Im%BfcqzA{DX> z%=XMuzuM?JY1nP;)HK9Y)%dH$ra9xk^;PwTqrSYt#c5D7vUtHrJTKCajBmpG^mXfK zaNBHaXZWcZuFTaq!)VG7d$n=b)nWgiF4LK6FiKPUGlh6m?lkdbQ0T?+%7O9fdf_82 z^>lEeA0a8@;>!S{YUvn~!hhMAqG*T+tR`t_YDP!`VSr3CP`T`$bx7dk`7ntJwQSP7 zxg0H%;lo^Zi#%T|>^iN*~Y=SVVH6 zTl~}arUdc+tJRe@hY=BVb-2{Vv&{B0xY(qortb&3VY4nVKbsacln2Hhj4;W5uQ>m~ zNZiISSsgBgL|z>3j=dH6!8|rG?H)qBOS1g6pW6G@OeJ$$L6a}dh>;&c;yfm|`T43< zneH&M^n*UFnLV>fsPD9{Ml2diNSAP~;A{y!7AdgdnGbuufLHMD)?uN?(q@{de3^t( zcR8hbe&`M>)?qKq9$fQ6lQ0 z;t8pX4_S7s?nZd8wtt+Qh*(P8ZTj`jt-tr?#*MH2_(##P+p~r}QOs zdKe6|!ff(3GR#Ojn+wN;=7=9|L-jj!6T)xmC&~)6qg`E`u_+Cm`66x{g14Y?uW?Q-N6PH`!sPR=^*w zU9V~rH4dI=Ab#PD)Y+m7sO;*IdUAi89}V6~y#oYmbQZjt*oGeo|GpZ@Yci&g^33_A zX9<)2FU1J&X3_V^$q<_c$&VY!ERA!aI}7w73G#=jTGb$L`)!Ix$tpbee%=chsfMv% zb##Cbiy=k@YNqUYmGpT>CSN-05&A_tbv7NuG*8Biyz0zVmF@$2mdR|ww;Cg1P_7Gl zY?Me_(9&o20S=bQ&zb*RD)+-B2=)hR+Da!1Y?0q`GAZI^_OpGOCqqDpD=;A0Ug=M+-k4aiR;yUk%s%g!dB45y{EG}5PAVUR7z%$uO!NTcq7Ab>s#_Y4WpsZ-W!>9REX%`=4 zTQC5cSKPX*m|a9~Z-03t8V~_`cu2=P9eLV}XWXwwsm7RH1@i`&S8qHs>yca_f_i^L z69_<30m^lKIqb|@WiG5^;N8bpOH2cT{BxG}GpG8T*J`A7-_L)|!r66s_W%4BhdP-syd7EcK!XsM5tR2M zgWgGDoD$F%)2mz-7=zgu*ay{1*Lo{)W;%ZZ#GGS#eOMcbJu;k~Hm*I1L6V|xqTt4A zppTcqW~Yqp8aI!+-u!*>AVlQ0CKZS?=f~}I39UI4gX+(^5}lJ+!VxtY#2N_bPSwII<}Gg3+gkW>pxBbmbja@H9=8uA(f zddbGjf2k)@Z>8rO5{Hiw#EoXJYM%YY`ulT5p*~*g%Qxm(cJdUmAD^@4c32%^*O&D= z)L_)_Dx4G6Z>VrroeAtL8Y-9^V3^*m54Jn>dtov$9QX)V5$vmC5d#Gw%;}+ zMOB5`u@r3we**9pj4~G)-+8=o9UN>ARqZPF!*iUz0?yjYz*x{>UmvwouU^vFx?0Wz z5YyoDc;U;wO1xC3XVlE*YjaUnN=eUSt6&WCkgVAj(M!f(gi3l>b;N$}?+#$uZ6N9b zEB;ThY;Y^-I3+~uW25FjUhNsTZBn?8M!!#w7bFJhS)k^CQ_$%z1gyiGl?-fPKc8f2 zo0_rlrIq$J7wK^%EGE2Iio7#`sexRPRA;0dKHk@p(0J!4>W3T~zin{pQjtbki+++$ zmhDrEtaDr=3^s~Xk%eCuy^BvwAh60SkdwIE@Mk(so})}se)4DCQGq8ht8YFz-mvsB zc)bdwx;ei~JJ+-^X?nH7OPo3jxyX2CY9fy}==~ELfy`S7g);U&lwELm<-Bybbma9r48YM^F`IBayMX)_q4&Oo6z`{8&68_=PD&-o5f7D zQQl8g%NVL%pq|#r@@CJJq*es}bUCRXniLvL&a3#+cs3)S1(ce&(4J%7-A1P^OC(@S z^OhhWLvDled%DRD`6yGfv&N?|v*N~4NY5d|Y{Z%^jMr>YT=0A0tjQc%0(s4S`9BzX z^<7Hi|9$b~mhc`~*Lx4Tmi)1!+=UI6a%53kv=BBI?kjhx(pRILDW-6`xw z!#ypKq(=!8VYLy+e0ltA#`6iZLsb=Lzr?-hnW{HB;l3iKaJ5G`A!@_@`Ajy~yr(Jm zMyJT~@KB>qE80Y4t1JdnCx78F=LqPAh3sc9jf6Oh1h3L^f$qS=FVVTnie~&h`B#4` z(d>ex_`QtC7L)%TG#XX?qSJg`E~mITkCQ7d>bT)rcZ@_{YvU_Cw!K82YnUBce(}2k zBBs-PsF;`aMfE8wyE;)@eG=7!|EBPeKCyuFD<6uqC=820KOrJ#?kcen$%8Eft8HJC zwC7jb@FNE48$&B1^Fj7?R2~XC%&1HbMUjaH?)BxnN9G_Cd5 zU4~Kr>~D+iDhG(w(<%0iN3}QRd#G)zrU>#p{dWppOL3LKx?VqvF=o_lI7lMA)KhlQ zE=U2L6b?kl(!-8}?bbD>kF5`aEH|4Jtm2A)`8!-UzjBMkXb@eLsoCPqNyjSBCyhr}(n%Ka4_hx7iV(`KcZwwaDG@T6_0sQg8d3Gxx~B3baU#~rt zdxWwRqs)1NZGPbt!kls($#%Ybz6dO?CXoe?-%2I zN_yIDQUVmAMswj5e)XYV#Lk~mUf;p2XczK!Agz%-2oW3O%llI)Jayl(S={e)%MV1( zE2xY#LH7(Wk9Xd-AI=y|mWA*5)()xdFCBShwE+DS)tk)_6WYta+g$mqr1SEtVwK+J z3nyX@a|aW02Oa&n`+?OfA|zSfsn)U`zdAPf%P`VO<~q7}y^Tt;GkDE8%nF7G_cg|T zyEjIw$llE`7S$WVHf6x%|eq-J~LU}y=br!3TQ6xt2=m`~OHb$+RR##&DIYMzv zJyE?I-Z=8I2Z_C1*~d}6HOQ!s-KsMd8~O*FmN)VW>4?OSk9bZ8Mkbq^O;INB={Z-f zklardr(VL5`=#1;7rcLEnWYL|F_hTAvTjcL_fCY1!tTB&@jIpE)|-wc0;QsXq?pAJ z8&ro&$3ifu%<@yP22k_d#IT)}HoP3d!*0b`5c>>XNbUGoz=c(!{wGO*nZCFPK({h<+*SftM`kUAt{* z)^PKw_xj+wu55&p0F>}6!3r}ptNb!8W?c{0Xt*G5*mLLmQm?vj6dV|wKH8jjN(6+}qJDycW9Z2r`_95o} zmxw)IbTSpMyS#lL!7{sl<+Ua}T0FV`*)WiRke6G!;;(&%Q2(^Xl+DE2QD}x1quT5v z!6xa%tJBlyv-Ap)XgYiP4Z@`a%+vvRETd~ffM@ul)-!w9aUBGeBTm3q4qcfx+D=|i ztrDNuoevl+0#oEvh|u=5i?U7a)5vj&7^%da!oL!|pFTsbZS&WcCN8z)ts{Cza zzGBzsG!dj3Yir1~&yx}HKdu2Oi9!AcR0L}KPVwfn(%D0+cI1zdNBV8zX=7<~)lLiD zcf@WKvl|y)v}hk9St}Pjnvv+E2-Cnb7Ye7~(lY;~%>}_gr%o|yRa|6nSFOSP(NFaZ z5`)i`vKJHyTBPY&iTQxWq~qH?s<)c!L;a$IwT~(hnc7D-8ls_UggW^c*Lo{7w8LrO z*6r~3-NJ_;PTn74q1c;39MB0~)t;h?K_xqoEG$QBw)@>qr(UjK;e`1p4lI9(2ZwAs zFS`UCDQ5)4a`wM0W>wiFSF9bDUrz*uZp5LHBQ?^Ax+)sz5s?pwlXn7!=;7PEeL%#0 zMw!216IDs=KVQ2m0NBmq^QH67vrr%E#t=B&R|32)BpSqQ6XLpg8Nb}f@xjr5+>POz zSL%pBz<2Js7?1g=~H7j>@zKW^b05DvzZOSbb zJ(F4KbSnVVbnCQVEQ zxz!wTSSCFPC-{N+4@=G?rt!8pd4cr&c-EaiJ#PDIz_!C63C&bW>F|cV(Lv z?+h?GEI|RXxGC=9eOSnA|64yV>-*PG9r^Hpj*Et(vpq%uM@+A7YVCBrb%zV<*ZNLW zKSPG1NrHyJbPD0EiH)RKn09NTrSR=^WeF53op>AoEj}SL4rZSFK<#iIS{5YEK#c;& zD04Y&TN_X1M2%wtK>Z!d~YKzNlbs> zeYAk!)|@aSYvFll=#1|QWMJ$9bXUyFC1qs7>1 zRW7$4XH~D?^eqZbnC2iFnp%&4hBW%k->kwu|9(-hHxmp*$6ngXSnlB?Ld^b_l@@C8^JgFub@*8&Kg$*E zWvC>OR!*1jw+L_DwHs^?hO@4$g8npBh_6a;uhje~C` z-fxoQDXcSZ_|Ca>xbFRB5gS`wB{aQ;^m|$-a zesUH5KXllh*$xF%(`$|4p4WKLd>b*FYW|%c& zTq3rK%#muICGzIVG&2>&B7BdByrpu=p+V=KN=QNgG3pcHrS9phI0bF=W}}l$Kx($` zSe}hRIb{0c1C!aC@ORkCf6^>|Ah97pIx}DQ_+wQniT$`k^-f~$mx2kF8IB_tl_;yo1@fa z00fHWn!iqJb*r?4JzVeTs`BLG1ok6?selbpQAz+v`q<`OQ2BDT$5)nM8)Wkd@$-RW z33r$`E*8i12VzknnryVFSB-7dOwj7`d*=*f?LT4b$fuL2lq=qkHgYohTmB~C5+d`Hv!doJF_=xSYA-Bir zrI6PTP7hf4B?09;(8Fe}gTY2vy9amY=G`%)(;5#z1?H$jC+Ld50B91?9^hm&1vYAm-9JQ>H2;H%oT}?JO=@VQ_Cl%iO-Nldj zAH`DDeVR_nyf4D43!B@yh92j}i+6291)H~|w_Sa$to$9EzS2+vF}&AQ1Z$X0kHY*j z4<`p7rOho6b7uZgujZG2eCV6UOrvKcjD!Ftm@>pA$wN%&U70(I|vCx)J} zq9rYp={E{7b`zv04e6A>8x9%N%`Wh4sbQgf z>8u~W^yA0va!Jm9Hx^TqYwg|>oTPF_+Pay`T8aL&;$rz2ADUS8%z=wr;MiCGfnlRq zj9szY)c$kXnbFYMg_=0__JwA>#SCIT(;k2YI#irxKTV(&?>>G;&{e)Vr4xl`KR<0E5MQC21vvj@NvWDn= z{4Qkqqx4e#JPEZU%OE;rPg@!VxPW{#xrts=GR48e(+I2{s%ra@^mYdc_ z2yk=#wUbIbl(u?Wv%8KC!+N9s#P3ahU5TttSWs5SHu+*w3gzT@RmgFZpXSTTr_O$F zH12{cq6N*p*E=srbFZ{D0-8+Rki29RexdELwJ;v=AV#ZZ7-Qf{)5^y6Ze_+})LYCr z@IU_SUS3APY5!1HvPRP><~zAgGsudxJ1Qn#`|y6o{hoW~vF~+GE*3bS8D>cc#@y__ zHeFzYh5@;cQEXQ#ygt+nCkv1rdnC%|?5Df^aq~9N||9{f~$80qt&E5tPl*C$q`ig^R zD;a+XaenicjULSpXM{db`|f-Pf9$xvyD!Mc;LsX_louOkWGK3xJ|PIW?^6-K9Y}Lz z+R*}8N8Xm9K)v+FwXoy8cvMi0Y?eT*jVmV7?{x0*J4<#Yst!($zt&f~jWf$+8e+Y-2v zX0!m@gxY^8O7l(5us}jn-T!S}(U(D6J_9FmE(P;rWQflw6#hde*5GUH z4;!-U6!YMoKpI2E#eaKHDw7^O2C{H7)`SbG1_der-D%jM+XK7^fD+T-!oc9A0|0wZ z|A@`+*~`9@eywT3DI|Upa}UI9dE%Q8W~a-vxM=Gw`sg9}4=_E0y;Y&}**D$+l*@R_ zY4>R4iF*+kHeEMsrVxuwV2}qe<3d9VcEQkpPg*{k2g1r2{WReD!C&{ZG8~ zPT4&MhOgbneMM#OS}wGUZ5$O7w&G zS^!h%E9t*sTC`jM=waSKt-9J{zTq*6Jp$gfMC>O3WehfeGxk06C5HOW!~e1E0I<|G zkkELO4rEctaRUC_r-KY))(?doM;Z@9eEG*gza#th^%>yTmM|v>!@ca78z&hmZkt?Z zaQLl|3-=@$(0%+!&YGdmfZ;CFQ)pVNRWwjK!SGUE^w_>~ErkKo8)ZA?AbwPxbTlu= z_1`}A{jwZAqKf^mN#(hh_v1R=>^pQAx38mJzHj4vRpsWfDTV;G@L|Q~X<(|{0W&Yb zu$^Eija*@6xO4gVl0xcWIeOV~i-G&8NxFsuyY>6W|IWHKwqpk95~`6;i8CQa$FKicCHUXV zPtA@kz^fWhJbqH(zfTf9UKN;u2nOy5#HEuA_f&xiKK9wpG29W*PG@*IMO&v&uh+7K z|33TU=`kDIw^+pbA9!)10{!e>f9u8&u{(Xxq zrEF!CH7X@Si=FZGkQVV2Pm~zRT9%M4!wfB!ArC6b8c(QrCQBsCjIv}MzABAvEHMv8 zjIqoxX5Q;Yz0db}-}m?(?{WOzlg99a zM~mSHl_&Wi)vM!3C{Fu#0kDz`H%t>gC{+fw-TU)8vOlS>R<*lwc!^TDh_nKO0(iuQ zYVZmHE0qUYJ0X&)0w~mxM6_sQC+r*IAPJT2&`u~Wrp(FGT9(ZX%p9YeYhwZNbCrHF z{Z?lQFZQ5BYd43$?M`rmr8MLZGil8^5)4!Dkk6P4U8A?}Eccqzz%KuvoUu|~j;*X3)AL*gtLK6(m1?D(TKCapzsH-5!x!UX!+ z9Lx8hyRYUyXRC@l804I!;&t|h4Sye)xqoIH_V*lL0Fve)u&JWXE8 ztTfWUk!!~X{W(Hr(-M8Cq)B{GCK-P#vxjnfLjRIodidl!_O)NBA+?&B6B*PH0}2q& z_REczZi_{MBahNfp)fIw1T-#xcY58J^NbM`g=#^5De02v%fyU*_T;4DT}c6(u97M0 zd>J`)j9-29&b=1GzCiHc2&_3Ai>ig=DP$fXbO<`MWrm&Mfa813z2a^YrZW7HV_E$o z0O5Z{Z+DzNB^Y&Fd>f9ySwS%Pe;fW}^~J?4Bg8MT@rGqfNB?Uh{fR$&oTv2Vl|l^h z;o70#c%`#?pi!+R_e|h7X^MlOp5c<8Ru3y$A(>wU>OR1as%5rmBMxnDC}q9L&w5z% zJyefG>!1dQH<{U0e+qfr)U=gyJAnQ~Zf1{B&NTg3O3>3fpbAFH)H?o!(-DS9zn|=uk(9Ce&Z;C{`pfsEIR2hxi=ji2j$KkK5!xA< zVWkqDPeZ>yr&TI#jnA;vv&0rNAK{!W$jw z!@G@qSezc${5J)2#+Q!W9$5&Zx^ap^k-~TEH5&w=R z@sxq$K~jmSn-O*Ssc(?pb@>G*qT4ciY8U^c9m?RhY@^|fyUXPV{wP9G2358|oe5IE zk-3=gLzuvX&`!mjyk^BReMd1pLRVx$_pNkuuNkc*R#a>0_Y?*~j%{)N8?)rZY>?b| z#nx=gNoNX5wpIFu+b)hjfbP5FvW}RfofMg}MPruJ>Cp=V7m{XFt5TmeL*A6oq$2M#z zIY8$?j{Sx#nJVx&?geXzZHc6u)4eyo+ zTxx^d(W?B@)szY}_XY!ht@Gnt31n<{?)FBHV;en+{p|7dF|5;*hrhLnrkVH{$~njG zJKq-0>nO96_oUd{)VxbH7q`Goh=#cm6<`>79aHmt>`;Fd6e1AslK_$qRDyQ|Q>N2Z z{QcEadHbN9t(^^_!ja}soOA?EqIQP4lC{#?3Qub4)chrd?Yz*<$ghJ!FzH{%kkmxM ztjxizntKTJGn|k`S~E&sQppU}{7T$pb_~`f=ib@I9^T|7=B(#e%_9hnW)~>j`m&Uso~YL0 ziuum+af2W)O|Oj^Nk&hr?JF06gmKLN3nTusfPTVB1ky$UW+xy?XKV1r^VzM`~4jxyEmodrp5dQhiUw-lgk+BPUP&?)qDnFJ5^swfyk z)mC?TKE>OXi74v_wA|IbS$tbghMu0R6-?jhn+ zo#0vHz*!g%fP-oGTDdBY$# zP^f^lL|_-&mEhDX_X1;LPi7b3aKcDPh8~x_wIr*ODNX{%B#&F?4@jOKMg;YGAu(id z4%!!jm_0pLG7J|!CF3Ya`nN2g(LYJ}zRf_?C{5YKm2w&fmYkvPQzvxHqd!Cef1;8# zzK>@=lx;7EVf&LYZ^y>}5;DCPoY~ZLR6xXehOoT5*%X45%BfvurKpu}vW9(LQPlCd z7*^<_!BdfAmnJqtj_;;J=EbfBK+vn3%-LaKEC=l7LVsM`ECBT?C&h-3Jx)*ymoM$6 z6o-XU87%VsCr@a$R9z!&?UXPMBY}#PmZKSrX5F5AL937p*5HL4k0~~a%il{)N9-hO z`wXUg4VLWlsW27ZpG4#qc3;G4UD%icATGqvQamewwBB)fT zV^=@=^lO=i6~9K&-n$>9UcKBR$NO+kQaukg@M9MFx$~^Zm9TT1ViRR8`WK7eMrHfd zTev7yHEEuNJ7C&`@~HE*UPgTg5z26D}TQAUAH$n&$1*yHwGznE{G|weULJNhh*y0^R6vAw6t7LMW zc6)~_moc#P?ao7fS)Ocrr%g7`j_fih_UQI>urCSDGkZQ;`GG$fq>mO|>C$vkmH)1J zP`%fS`$4v9?lbCy^%m{Z@{r>)nnNe4{k0rK-#2sFQ+^ZFX&w?e(AIWe7`qJ5Id;-2 zt3SZZAwO#%-=CfS1~c?{Z@crYor z#jDt%8@-%ag;16} zsToZ^C!PX9%K@}t-?nV~&7E;T$yvROUzek%b=haKn#_dm-Yn zSbC?ExplzJ^+GR1QG0YVC`c2&vvf#%DbXAxPW~;Esb9@puzNEA&H)W(n#o^^8!&ab zdHO6^5&q2C80OP0!%%w>C~t(l7`x96;Z{fT26>I{`R*0)LIu`^?Qu~01lY!vIjc)) zSq=q)a?=D@Lir)$q)Zy}9djY?T;oZerx##{;PPbmQhyC|!LoKV2MB1ON=4t{Dq0En zXS3uqp|Y})Jtcx3+AXn(2jU+Zs=I?j`RLUypV>hIl#8Izo8(CkWc43&`|fX(E&+v1 zY04Eo6=${@$H2aa`?G>0Wnir{@VPCW4JlVZRhLeqL}6?1idD7?Hv#^}8}Q$feHd_W z<6&QY2+MPDfB!vOL){T?0%M35cSt4QsB-Fo=gK0k1QWEnApU{p2&}L>&y1-gpLY=i z&g%gciLm9&(31Sj+ef$+r}(+?RWrauOZ6nMChlpWtT$u0pKX8!6>c2<5QQLc8WOHh zj*C@;kt0(u=%L9Qb0Sy|*pY=U?=L#?qD2%2h0d5{Vc2x`lx_1q{@fPc3+H#uQ83J9 zgM;9U%{zUoa{OHO%DgZUf;4oR&d|%FYfKBLsp_GqKn{!Q<}*<3qPZw}Z+9k8LI$oj zW$if`7ug2HvbDlHYIAOuhLyIm29c64%>igobBCqSo!rVX?7gw3qk}vtnSgg>Cnra- z3Y_BhqP~c5H37^c$ z-skk&gpGG)2z>>^9Zo1X!UuJ30yk(nmzHjwF7XSPWrABcSvNC9=OaX}TysG{SfNEc zzVbHxhAE%|zq&Xv?dzvqX7Ntjo}JplePdr$Lb*LuC+xU;P3DdxnujzCtR4I=o)7~b zKbpCm;9Mn7PR7ty`>BisF6(=!WZ#V_s*@9?X>PF}?creu(!KYjN2Ea>{IQyAX&q93L87&uni!_3@64qK>lCK1( z${qbo_C!(G^CwJa(JoT3&|HkMwU5I~hGR&XV3aVdk3GI9?_H^zRV1h7GnizP%?CLe z)c>oD;JajaHt9WX-*p}US!C5xze~JY4jX!EFbwz_$a;daEUad;fMD>L1Dgi;*7srQ zqtQoyi7C+7(QE<=7^MJ`V8UqQ4Ko;Ood9sR8!7PA(rK{boJ6mSxTc5t7N2{z8M;PL zUi{khl+N21oRU;Ys{37P6C`B`u57Fu$+jxw90>{r@QfqcRJ_Y4{PwfpU+Zaun1#<^ zBcJ|V&MgB81T)oW3e?+i{H7>oApZW>L}8;U4=wl=u#f3l@{5pUbPB=*AdN=FaBb}h zjb`du6fN9#mTbLHFWT1t9T! zU#+iqUwSMFfYep8m8Dv^Y%(V{26OJY&@dQkt*rt?6n!}A+iOQWb{U-hgp?$B&A7vl z(+~viSi(S(*I@NNFr;adg{H0Q%oujAfiM0A*!m8K8|qgb1PBNO-Nv21Ws3H;yz}VN zmf{mYv`53SsH>?y#ubKeHcmqD`;JyIu1@jlzzu9dw z08aE9?(hS95b0hmTAsu8pa`jd%+Kb6+G>Pt(yo9Vk9*4|OnmR%3$!lP{FI-G_M=a= z+trU@C-%Zi{G>us9e3fljhnx}KWiybSWX_mIyD8mj{${g*&jOjLYa{OR#J8svBtpozK3oY};+fKFdDu&U$1Zc{6 zh3|m!xg*-N9|Al5HMdW?WN(oM*NiMf!fs^ z+J_ztu5Q0?+p}SriH{t?e4y;gb7`)n zKow0Pnl30EWWUJIY`f+?1NL&sv8J3Z|I-!t$BFB#AP;m;xxZNUIx4Z!1P8H4;s7_YEbB&nIV^IJj3G(4Cap_P=3{s z%*SgGux-XPFyhKR$w^>ysVYSR(J;`gK2twBSR7Wha|L<;o7e|->+RNuI=5RIu-t%D zj4HnrYcNyQUumo3ZRO8&`fai(iO2&Li0)M3f&NDA@PcWWgt4z5SG2Iv;YMzq%i>wD zItGShZ?bbX3;eOeY^^v|ob3*m-%@$9D>lkq!J~$tYo`Gnem3HNekHf{zW+DwiE!QW z0=^kZn41hL^*CSMGg8BA+?Qc+k2Ixc(9Hv?x;E;ZRqyqLh-DIeuktbkA>ljBe!pIO zV`I>8bXFas%tiOU@IC~^MJ*_+8Q@Vn-`eH`=Vg6=0-*Q1&RJu?X~%jfm)o2J zn2HoXy>hIciq-Nni`vqd&w9(?_=kPK92Z&2zagio#U(pri9DncD-PU_p<=BU&iQ~e!r6dJ9`44l-1ftMCtyuL1%-Jh6p z)PnD@E6E7xS9hETZruZaZS3iDu-FiCw5_K;76$+YsPHG;yyT;IoXdVgRYnR1Fe_8$ zNN!IS_=%}c!af`fnH_OgzDak=?>1^zbT8IPwjTl>{S%MapZ(47!To)$r&_>(2i)K3 zF45SRe91C*VJ7jXh_G)glnd`VleDgv(3-CExSQzqSxi} z2H2ObP#zQs@IDRC5&x|)7rUkJ?uk*b?vh&m7bWayn)N0Czf@_HGM^$Vaz~Ad&ZY}p z0YHcL{|UPJen!ItIUkm6$D`Y@1nwk`4Dj3IX*+F}0qoKZPa1!1+NqQpbI^y_FCH3Byy@fJ+;M$+gyrg=-bTp7SI0N70j z0F(E3a}DQWYkR&Nr~4cZA!JWzaksHlP}j$p>%8>L!Tu1RV&N@NT&bXg=StT$78NfW z65{&;e;P5vnC)@69Lz;YV^I=z9jygpKF2r~tsi-3fSz( zu;9I#F8!-!mHKX7x`V4j=!Nn(j6rb1t$wZqSw0rWo=P1soZvM(ul6Fffs>1zzg+s2 z2V1OpdIJuc6kCVK%+TAjGvzb+XncC9-nOcO za!^C)Tj9|jH{{&oo^ezYwgq+05z0-ibFda!?&?@ETnSJHcJ`>V_=XT1Qv$Tn&>QiG zrb~@@Pbx+p;j)`tOL#FWMKl=4T%CUAGgkU>uxz4?R%X>}sI9bHi^Lw#F3oLnXeK0# zS+)i9I$p>KT|5Y~+AUgYUvuxV$%qX0Oz5abM#LjJYWYy4q^6W)>ywPY$#?gR&rxeO zfr}b_AFK;?ClU}3#wB^()tDzAna*?oU#)f2CJU?ti2m2{@Va0~Ne~_9ueU^-RZF%+I08tlw_1u8xj+{OIbEommDZaW>Z42c4 zOx4$X5H7YZ*C${Tf?jRZ8{!~8g|1(scS&}YN4qUA-O8lWuOO*~$(vOn?2E3)8W*y1$<@yD-@ z=CB*_vq@ROj@8fB_;B5hSpUQS5?TB2SJw&i|A|bW>Xq+iq34=eRD=W5m7nO$`cmQ0 zf`lQ#U8AI<(vEsH%p59fFWmrCjYK(lC7briU{CLTtaGW%29zR9%}ecpd+=@C#iCwo za`*_Ps*;dgG>7%c%CcDsBdw)sP^y%=H2I3s3_`Bz1okxT?=BX5s@sBLkj1w=1a#op zLa!1K3)k?d7gtUI!G4V`-8&dhnRjOuhZfij6iHtYGQa;eAG10|`A7&~D+!L7`ced9 zt*i4L(C1fVf0AJej|K~r4Zp#n#)EpK3saUIQkb>QPZxU4{afdr-I8ma3kHVGEQMRj z%`W#5R`uggVTDAO=HBK__Fp}n?gyhYxzw`&Zu@t zDJeXx+;_B*_Gj|`a5-sWJ&wAhUF&;{Kp@P%*JfaFE46o%n{!0AgG7S*-u+o1RbbRy z)mJYXq*>h2YS+ZSI3<{HDaYq_cO^Md$*csAS(Rrz$u->-3^iJ{^~Xj9^p8GKE&fDl zR>sc=TN|d3zO1y^Y!Bir+ywFvQ-8PMBI0+)RMj5(kw7OYW1&PdPN7630^hB?(H}7LfcX6XDmYn7#H?xF}AfpH4 zB-#v`s=o^wRaRlFh6@kb zxD-^l?iwhuPSWgw*#4Q1n^8e62Te~fE7pn|ZxFk8`fD*_jsz0zN&@hq1D9CZQ6k8+ zf9wRE-V8<){D7PDREObGIy+6ttQO#RKU=3aYIV||MLn>+_WJ@JRUpb4Q^x>f{%2eJ zx<4uGTDf=NVmui*$4RpKizgO8eSy3WsRe_tSqhzNWAR%CyBp&DZZxuO?PmQUoHH& zJxc)GUMT+^ot{#|o@*r!)^KldaR2DOF#h8N=MIuNN*hZdWKeJW3@kt1$Hmw$Z{>c* z1YFh9UukSWJ=_6u@_sap+kkXon)xdMc>P191&f;TD%lBS?fk!5$sa_x>T4>?LU-&T zttp)5MNVLUT!#SGU&juwj37Y$MGh77#D+gB!%%s}hm$4?^QnYJRgrkVmD|T%G+9Jo z=(j)^U~rC?oWN!Fm4e&N|49_7>H>a_GRVg!!zAOZ_EEweTwG?~#|jM(6C>1JRu)&~ z$!vBpd*zfcH&LGaG$Y{4(m%OS=&%=ygn5ku9@IF+?D*`~!_0hgABFSb5XXT8lvVQ( z=p+QFW)#RbwcdhZq){Gv_1?1JEWpsbm4)uV$$V7`iW5j39WxMOv#5m3Fjgz7`OqCi zjtX-#f^D0*WAJRz-Psd~QbyWKG^d6&)MSI67nPF;N@8p;pOxXuF+=xG3JtsX`=i>o z%PwDEyFw$^EMaWd1lT4(DEwzL4oaL2YdNUw1~m00GL0sUKrW4PHx+H(cBED&LIQs7 Nw5f&3Und+R{|7hEet!S} literal 0 HcmV?d00001