From d3df6334c26685c53469db3aaf0a779bd40fa9cf Mon Sep 17 00:00:00 2001
From: Aine Riordan <44700011+ariordan-redhat@users.noreply.github.com>
Date: Mon, 24 Jun 2024 15:40:57 +0100
Subject: [PATCH 001/590] AAP-25774 Add sync script to 2.5 branch (#1476)
---
bin/sync_docs.sh | 19 +++++++++++++++++++
bin/sync_ocp_latest.sh | 13 +++++++++++++
2 files changed, 32 insertions(+)
create mode 100644 bin/sync_docs.sh
create mode 100644 bin/sync_ocp_latest.sh
diff --git a/bin/sync_docs.sh b/bin/sync_docs.sh
new file mode 100644
index 0000000000..6b383e4548
--- /dev/null
+++ b/bin/sync_docs.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+######
+# This script synchronizes content to the downstream repository.
+# A Jenkins job configures the source and target repositories and runs this script directly.
+# If you commit changes to this script you should verify the Jenkins job runs successfully.
+######
+
+# Set the path to the source and target directories.
+# The source directory contains the content that you want to synchronize.
+source=source
+# The target directory is the location where you want to synchronize content.
+target=target
+
+# Clean the existing downstream and release-note folders.
+rm -rf $target/downstream
+
+# Copy the content of the downstream and release-note folders.
+cp -r $source/downstream $target/downstream
diff --git a/bin/sync_ocp_latest.sh b/bin/sync_ocp_latest.sh
new file mode 100644
index 0000000000..217c388759
--- /dev/null
+++ b/bin/sync_ocp_latest.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+# Set the path to the file that contains the ":OCPLatest:" attribute.
+attributes=../downstream/attributes/attributes.adoc
+
+# Retrieve the OCP attributes file from the OpenShift docs repository.
+curl https://raw.githubusercontent.com/openshift/openshift-docs/main/_attributes/ocp-attributes.adoc -o ocp-attributes.adoc
+# Save the value of the "product-version" attribute as a variable.
+ocpversion=$(sed -n -e 's/^:product-version: //p' ocp-attributes.adoc)
+# Replace the value of the "OCPLatest" attribute with the value of the "product-version" attribute.
+sed -i -e "s/^:OCPLatest:.*/:OCPLatest: $ocpversion/" $attributes
+# Delete the OCP attributes file.
+rm -f ocp-attributes.adoc
From 8e319e89f0a22811d5d7f5096145f524f84d73b5 Mon Sep 17 00:00:00 2001
From: Aine Riordan <44700011+ariordan-redhat@users.noreply.github.com>
Date: Mon, 24 Jun 2024 15:58:58 +0100
Subject: [PATCH 002/590] Archive Ansible Creator Guide for 2.5 (#1477)
---
.../{titles => archive/archived-titles}/dev-guide/aap-common | 0
.../{titles => archive/archived-titles}/dev-guide/attributes | 0
downstream/{titles => archive/archived-titles}/dev-guide/core | 0
.../{titles => archive/archived-titles}/dev-guide/dev-guide | 0
.../{titles => archive/archived-titles}/dev-guide/docinfo.xml | 0
downstream/{titles => archive/archived-titles}/dev-guide/images | 0
.../{titles => archive/archived-titles}/dev-guide/master.adoc | 0
.../{titles => archive/archived-titles}/dev-guide/navigator | 0
8 files changed, 0 insertions(+), 0 deletions(-)
rename downstream/{titles => archive/archived-titles}/dev-guide/aap-common (100%)
rename downstream/{titles => archive/archived-titles}/dev-guide/attributes (100%)
rename downstream/{titles => archive/archived-titles}/dev-guide/core (100%)
rename downstream/{titles => archive/archived-titles}/dev-guide/dev-guide (100%)
rename downstream/{titles => archive/archived-titles}/dev-guide/docinfo.xml (100%)
rename downstream/{titles => archive/archived-titles}/dev-guide/images (100%)
rename downstream/{titles => archive/archived-titles}/dev-guide/master.adoc (100%)
rename downstream/{titles => archive/archived-titles}/dev-guide/navigator (100%)
diff --git a/downstream/titles/dev-guide/aap-common b/downstream/archive/archived-titles/dev-guide/aap-common
similarity index 100%
rename from downstream/titles/dev-guide/aap-common
rename to downstream/archive/archived-titles/dev-guide/aap-common
diff --git a/downstream/titles/dev-guide/attributes b/downstream/archive/archived-titles/dev-guide/attributes
similarity index 100%
rename from downstream/titles/dev-guide/attributes
rename to downstream/archive/archived-titles/dev-guide/attributes
diff --git a/downstream/titles/dev-guide/core b/downstream/archive/archived-titles/dev-guide/core
similarity index 100%
rename from downstream/titles/dev-guide/core
rename to downstream/archive/archived-titles/dev-guide/core
diff --git a/downstream/titles/dev-guide/dev-guide b/downstream/archive/archived-titles/dev-guide/dev-guide
similarity index 100%
rename from downstream/titles/dev-guide/dev-guide
rename to downstream/archive/archived-titles/dev-guide/dev-guide
diff --git a/downstream/titles/dev-guide/docinfo.xml b/downstream/archive/archived-titles/dev-guide/docinfo.xml
similarity index 100%
rename from downstream/titles/dev-guide/docinfo.xml
rename to downstream/archive/archived-titles/dev-guide/docinfo.xml
diff --git a/downstream/titles/dev-guide/images b/downstream/archive/archived-titles/dev-guide/images
similarity index 100%
rename from downstream/titles/dev-guide/images
rename to downstream/archive/archived-titles/dev-guide/images
diff --git a/downstream/titles/dev-guide/master.adoc b/downstream/archive/archived-titles/dev-guide/master.adoc
similarity index 100%
rename from downstream/titles/dev-guide/master.adoc
rename to downstream/archive/archived-titles/dev-guide/master.adoc
diff --git a/downstream/titles/dev-guide/navigator b/downstream/archive/archived-titles/dev-guide/navigator
similarity index 100%
rename from downstream/titles/dev-guide/navigator
rename to downstream/archive/archived-titles/dev-guide/navigator
From 42e2c6f94e88e237f51cced3eae9e91bde2aa147 Mon Sep 17 00:00:00 2001
From: Robert Grange <95885266+rogrange@users.noreply.github.com>
Date: Mon, 24 Jun 2024 16:52:22 -0400
Subject: [PATCH 003/590] Updated system requiremenst for planning guide.
Updated attributes file. (#1478) (#1480)
These changes are for AAP-22715 to update the system requirements for
the Planning Guide.
A change has also been made to the 'attributes.adoc' file to update
{CoreInstVers} from 2.14 to 2.15 to concide with the new system
requirments for 2.5 EA.
Resolves: AAP-22715
Also Resolves: AAP-22628
---
downstream/attributes/attributes.adoc | 2 +-
.../modules/platform/ref-system-requirements.adoc | 10 +++++++---
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/downstream/attributes/attributes.adoc b/downstream/attributes/attributes.adoc
index f0391dba2f..5f80cd3db0 100644
--- a/downstream/attributes/attributes.adoc
+++ b/downstream/attributes/attributes.adoc
@@ -8,7 +8,7 @@
:CentralAuth: central authentication
:PlatformVers: 2.5
//The Ansible-core version required to install AAP
-:CoreInstVers: 2.14
+:CoreInstVers: 2.15
//The Ansible-core version used by the AAP control plane and EEs
:CoreUseVers: 2.15
:PlatformDownloadUrl: https://access.redhat.com/downloads/content/480/ver=2.5/rhel---9/2.4/x86_64/product-software
diff --git a/downstream/modules/platform/ref-system-requirements.adoc b/downstream/modules/platform/ref-system-requirements.adoc
index cd12a0f28d..17c051fb60 100644
--- a/downstream/modules/platform/ref-system-requirements.adoc
+++ b/downstream/modules/platform/ref-system-requirements.adoc
@@ -14,15 +14,19 @@ Your system must meet the following minimum system requirements to install and r
h| Subscription | Valid {PlatformName} |
-h| OS | {RHEL} 8.6 or later 64-bit (x86, ppc64le, s390x, aarch64) |{PlatformName} is also supported on OpenShift, see link:{BaseURL}/red_hat_ansible_automation_platform/{PlatformVers}/html/deploying_the_red_hat_ansible_automation_platform_operator_on_openshift_container_platform/index[Deploying the Red Hat Ansible Automation Platform operator on OpenShift Container Platform] for more information.
+h| OS | {RHEL} 8.8 or later 64-bit (x86, ppc64le, s390x, aarch64) |{PlatformName} is also supported on OpenShift, see link:{BaseURL}/red_hat_ansible_automation_platform/{PlatformVers}/html/deploying_the_red_hat_ansible_automation_platform_operator_on_openshift_container_platform/index[Deploying the Red Hat Ansible Automation Platform operator on OpenShift Container Platform] for more information.
h| Ansible-core | Ansible-core version {CoreInstVers} or later | {PlatformNameShort} includes execution environments that contain ansible-core {CoreUseVers}.
-h| Python | 3.9 or later |
+h| Python | 3.11 or later |
h| Browser | A currently supported version of Mozilla FireFox or Google Chrome |
-h| Database | PostgreSQL version 13 |
+h| Database | PostgreSQL version 15 |
+
+h| RAM | 16 GB minimum |
+
+h| CPUs | 4 |
|===
The following are necessary for you to work with project updates and collections:
From 1d70a1d5a2a7666cddbb4b3e261b16456f98ef3e Mon Sep 17 00:00:00 2001
From: Ian Fowler <77341519+ianf77@users.noreply.github.com>
Date: Tue, 25 Jun 2024 08:52:57 +0100
Subject: [PATCH 004/590] Create new ports and networks routing table (#1460)
(#1481)
* Create new ports and networks routing table
Inconsistencies in firewall documentation
https://issues.redhat.com/browse/AAP-21720
* Create new ports and networks routing table
Added two rows
Inconsistencies in firewall documentation
https://issues.redhat.com/browse/AAP-21720
* Create new ports and network routing table
Correction
Inconsistencies in firewall documentation
https://issues.redhat.com/browse/AAP-21720
---
.../assembly-network-ports-protocols.adoc | 251 ++++--------------
1 file changed, 55 insertions(+), 196 deletions(-)
diff --git a/downstream/assemblies/platform/assembly-network-ports-protocols.adoc b/downstream/assemblies/platform/assembly-network-ports-protocols.adoc
index 5f0bf54e33..35f37503ae 100644
--- a/downstream/assemblies/platform/assembly-network-ports-protocols.adoc
+++ b/downstream/assemblies/platform/assembly-network-ports-protocols.adoc
@@ -17,216 +17,75 @@ In some of the following use cases, hop nodes are used instead of a direct link
.{PlatformNameShort} Network ports and protocols
image::aap-network-ports-protocols.png[Interaction of Ansible Automation Platform components on the network with information about the ports and protocols that are used.]
-The following tables show the default {PlatformName} destination ports required for each application.
+The following table indicates the destination port and the direction of network traffic:
[NOTE]
The following default destination ports and installer inventory listed are configurable. If you choose to configure them to suit your environment, you might experience a change in behavior.
+.Network ports and protocols
+[cols="12%,12%,17%,17%,20%,27%,27%",options="header",]
+|===
+| Port | Protocol | Service | Source | Destination | Required for | Installer Inventory Variable
+| 22 | TCP | SSH | Installer node | {HubNameStart} | Installation (temporary) | `ansible_port`
+| 22 | TCP | SSH | Installer node | Controller node | Installation (temporary) | `ansible_port`
+| 22 | TCP | SSH | Installer node | EDA node | Installation (temporary) | `ansible_port`
+| 22 | TCP | SSH | Installer node | Execution node | Installation (temporary) | `ansible_port`
+| 22 | TCP | SSH | Installer node | Hop node | Installation (temporary) | `ansible_port`
+| 22 | TCP | SSH | Installer node | Hybrid node | Installation (temporary) | `ansible_port`
+| 22 | TCP | SSH | Installer node | PostgreSQL database| Remote access during installation (temporary) | `pg_port`
+| 80/443 | TCP | HTTP/HTTPS | Installer node | {HubNameStart} | Allows installer node to push the execution environment image to {HubName} when using the bundle installer. | Fixed value
+| 80/443 | TCP | HTTP/HTTPS | Execution node | {HubNameStart} | Allows execution nodes to pull the execution environment image from {HubName}. | Fixed value
+| 443 | TCP | HTTPS | Controller node | Client | Web UI/API
+This exposes the mesh ingress receptor entry point for inbound connections.| `nginx_https_port`
+| 443 | TCP | HTTPS | Controller node | {OCPShort} | Only required when using container groups to run jobs. | Host name of OpenShift API server
+| 5432 | TCP | PostgreSQL | Controller node | PostgreSQL database | Open only if the internal database is used along with another component. Otherwise, this port should not be open. | `automationcontroller_pg_port`
+| 5432 | TCP | PostgreSQL | EDA node | PostgreSQL database | Open only if the internal database is used along with another component. Otherwise, this port should not be open. | `automationedacontroller_pg_port`
+| 5432 | TCP | PostgreSQL | {HubNameStart} | PostgreSQL database | Open only if the internal database is used along with another component. Otherwise, this port should not be open. | `automationhub_pg_port`
+| 27199 | TCP | Receptor | Controller node | Execution node | Configurable
-.PostgreSQL
-[options="header"]
-|===
-|Port |Protocol |Service |Direction |Installer Inventory Variable |Required for
-|22
-|TCP
-|SSH
-|Inbound and Outbound
-|`ansible_port`
-|Remote access during installation
-|5432
-|TCP
-|Postgres
-|Inbound and Outbound
-|`pg_port`
-a|Default port
-
-ALLOW connections from controller(s) to database port
-|===
+Mesh nodes directly peered to controllers.
-.{ControllerNameStart}
-[options="header"]
-|===
-|Port |Protocol |Service |Direction |Installer Inventory Variable |Required for
-|22
-|TCP
-|SSH
-|Inbound and Outbound
-|`ansible_port`
-|Installation
-
-|80
-|TCP
-|HTTP
-|Inbound
-|`nginx_http_port`
-|UI/API
-
-|443
-|TCP
-|HTTPS
-|Inbound
-|`nginx_https_port`
-|UI/API
-
-|5432
-|TCP
-|PostgreSQL
-|Inbound and Outbound
-|`pg_port`
-a|Open *only* if the internal database is used along with another component. Otherwise, this port should not be open
-
-Hybrid mode in a cluster
-
-|27199
-|TCP
-|Receptor
-|Inbound and Outbound
-|`receptor_listener_port`
-|ALLOW receptor listener port across all controllers for mandatory and automatic control plane clustering
-|===
+Direct nodes involved.
+27199 communication can be both ways (depending on installation inventory) for execution nodes
+| `receptor_listener_port`
-.Hop Nodes
-[options="header"]
-|===
-|Port |Protocol |Service |Direction |Installer Inventory Variable |Required for
-|22
-|TCP
-|SSH
-|Inbound and Outbound
-|`ansible_port`
-|Installation
-
-|27199
-|TCP
-|Receptor
-|Inbound and Outbound
-|`receptor_listener_port`
-a|Mesh
-
-ALLOW connection from controller(s) to Receptor port
-|===
+`peers`
+| 27199 | TCP | Receptor | Controller node | Hop node | Configurable
-.Execution Nodes
-[options="header"]
-|===
-|Port |Protocol |Service |Direction |Installer Inventory Variable |Required for
-|22
-|TCP
-|SSH
-|Inbound and Outbound
-|`ansible_port`
-|Installation
-
-|80/443
-|TCP
-|SSH
-|Inbound and Outbound
-|Fixed value (maps to Table 5.7 {HubNameStart}'s "User interface" port)
-|Allows execution nodes to pull the {ExecEnvShort} image from {HubName}
-
-|27199
-|TCP
-|Receptor
-|Inbound and Outbound
-|`receptor_listener_port`
-a|Mesh - Nodes directly peered to controllers. No hop nodes involved. 27199 is bi-directional for the execution nodes
-
-ALLOW connections from controller(s) to Receptor port (non-hop connected nodes)
-
-ALLOW connections from hop node(s) to Receptor port (if relayed through hop nodes)
-|===
+ENABLE connections from hop nodes to Receptor port if relayed through hop nodes. | `receptor_listener_port`
-.Control Nodes
-[options="header"]
-|===
-|Port |Protocol |Service |Direction |Installer Inventory Variable |Required for
-|22
-|TCP
-|SSH
-|Inbound and Outbound
-|`ansible_port`
-|Installation
-
-|27199
-|TCP
-|Receptor
-|Inbound and Outbound
-|`receptor_listener_port`
-a|Mesh - Nodes directly peered to controllers. Direct nodes involved. 27199 is bi-directional for execution nodes
-
-ENABLE connections from controller(s) to Receptor port for non-hop connected nodes
-
-ENABLE connections from hop node(s) to Receptor port if relayed through hop nodes
-|443
-|TCP
-|Podman
-|Inbound
-|`nginx_https_port`
-|UI/API
-|===
+`peers`
+| 27199 | TCP | Receptor | Controller node | Hybrid node | Configurable
-.Hybrid Nodes
-[options="header"]
-|===
-|Port |Protocol |Service |Direction |Installer Inventory Variable |Required for
-|22
-|TCP
-|SSH
-|Inbound and Outbound
-|`ansible_port`
-|Installation
-
-|27199
-|TCP
-|Receptor
-|Inbound and Outbound
-|`receptor_listener_port`
-a|Mesh - Nodes directly peered to controllers. No hop nodes involved. 27199 is bi-directional for the execution nodes
-
-ENABLE connections from controller(s) to Receptor port for non-hop connected nodes
-
-ENABLE connections from hop node(s) to Receptor port if relayed through hop nodes
-
-|443
-|TCP
-|Podman
-|Inbound
-|`nginx_https_port`
-|UI/API
-|===
+ENABLE connections from controllers to Receptor port if relayed through non-hop connected nodes. | `receptor_listener_port`
-.{HubNameStart}
-[options="header"]
-|===
-|Port |Protocol |Service |Direction |Installer Inventory Variable |Required for
-|22
-|TCP
-|SSH
-|Inbound and Outbound
-|`ansible_port`
-|Installation
-
-|80
-|TCP
-|HTTP
-|Inbound
-| Fixed value
-|User interface
-|443
-|TCP
-|HTTPS
-|Inbound
-| Fixed value
-|User interface
-|5432
-|TCP
-|PostgreSQL
-|Inbound and Outbound
-|`automationhub_pg_port`
-a|Open *only* if the internal database is used along with another component. Otherwise, this port should not be open
+`peers`
+| 27199 | TCP | Receptor | Execution node | Hop node | Configurable
+
+Mesh 27199 communication can be both ways (depending on installation inventory) for execution nodes
+
+ALLOW connection from controller(s) to Receptor port |
+`receptor_listener_port`
+
+`peers`
+| 27199 | TCP | Receptor | Execution node | Controller node | Configurable
+
+Mesh 27199 communication can be both ways (depending on installation inventory) for execution nodes
+
+ALLOW connection from controller(s) to Receptor port |
+`receptor_listener_port`
+
+`peers`
|===
+[NOTE]
+====
+* Hybrid nodes act as a combination of control and execution nodes, and therefore Hybrid nodes share the connections of both.
+
+* If `receptor_listener_port` is defined, the machine also requires an available open port on which to establish inbound TCP connections, for example, 27199.
+====
+
.{InsightsName}
[options="header"]
|===
From 6356525d663b8a296266af6fbdfd8934583f7c82 Mon Sep 17 00:00:00 2001
From: g-murray <147741787+g-murray@users.noreply.github.com>
Date: Tue, 25 Jun 2024 13:13:15 +0100
Subject: [PATCH 005/590] Adding proc content (AAP-22718) (#1483) (#1484)
* adding proc content (AAP-22718)
* Adding PR Suggestions
---
.../platform/assembly-aap-backup.adoc | 4 +--
.../platform/assembly-aap-recovery.adoc | 3 +-
.../proc-aap-platform-gateway-backup.adoc | 32 ++++++++++++++++++-
.../proc-aap-platform-gateway-restore.adoc | 32 +++++++++++++++++--
4 files changed, 65 insertions(+), 6 deletions(-)
diff --git a/downstream/assemblies/platform/assembly-aap-backup.adoc b/downstream/assemblies/platform/assembly-aap-backup.adoc
index 36b77815cb..92bd4ab473 100644
--- a/downstream/assemblies/platform/assembly-aap-backup.adoc
+++ b/downstream/assemblies/platform/assembly-aap-backup.adoc
@@ -9,10 +9,10 @@ ifdef::context[:parent-context: {context}]
[role="_abstract"]
-Backing up your {PlatformName} deployment involves creating backup resources for your deployed {HubName} and {ControllerName} instances. Use these procedures to create backup resources for your {PlatformName} deployment.
+Backing up your {PlatformName} deployment involves creating backup resources for your deployed instances. Use the following procedures to create backup resources for your {PlatformName} deployment.
//part of 2.5 release, (AAP-22178) uncomment when publishing [gmurray]
-include::platform/proc-aap-platform-gateway-backup.adoc[leveloffset=+1]
+//include::platform/proc-aap-platform-gateway-backup.adoc[leveloffset=+1]
include::platform/proc-aap-controller-backup.adoc[leveloffset=+1]
diff --git a/downstream/assemblies/platform/assembly-aap-recovery.adoc b/downstream/assemblies/platform/assembly-aap-recovery.adoc
index 6b87e7237e..704b685bc9 100644
--- a/downstream/assemblies/platform/assembly-aap-recovery.adoc
+++ b/downstream/assemblies/platform/assembly-aap-recovery.adoc
@@ -7,7 +7,8 @@ ifdef::context[:parent-context: {context}]
:context: aap-recovery
[role="_abstract"]
-If you lose information on your system or issues with an upgrade, you can use the backup resources of your deployment instances. Use these procedures to recover your {ControllerName} and {HubName} deployment files.
+If you lose information on your system or experience issues with an upgrade, you can use the backup resources of your deployment instances. Use the following procedures to recover your {PlatformNameShort} deployment files.
+
//part of 2.5 release, (AAP-22178) uncomment when publishing [gmurray]
//include::platform/proc-aap-platform-gateway-restore.adoc[leveloffset=+1]
diff --git a/downstream/modules/platform/proc-aap-platform-gateway-backup.adoc b/downstream/modules/platform/proc-aap-platform-gateway-backup.adoc
index 6274e4e6e7..524dda9a4d 100644
--- a/downstream/modules/platform/proc-aap-platform-gateway-backup.adoc
+++ b/downstream/modules/platform/proc-aap-platform-gateway-backup.adoc
@@ -1,3 +1,33 @@
[id="aap-platform-gateway-backup_{context}"]
-= Backing up your AnsibleAutomationPlatform resource
+= Backing up your AnsibleAutomationPlatform deployment
+Regularly backing up your *AnsibleAutomationPlatform* deployment is vital to protect against unexpected data loss and application errors. *AnsibleAutomationPlatform* hosts any enabled components (such as, {ControllerName}, {HubName}, {EDAName}, and {LightspeedShortName}), when you back up *AnsibleAutomationPlatform* you also back up these components.
+
+.Prerequisites
+* You must be authenticated on Openshift cluster.
+* The {OperatorPlatform} has been installed on the cluster.
+* The *AnsibleAutomationPlatform* instance is deployed using the {OperatorPlatform}.
+
+.Procedure
+. Log in to {OCP}.
+. Go to menu:Operators[Installed Operators].
+. Select the {OperatorPlatform} installed on your project namespace.
+. Go to your *All Instances* tab, and click btn:[Create New].
+. Select *Ansible Automation Platform Backup* from the list.
++
+NOTE: When creating the *Ansible Automation Platform Backup* resource it also creates backup resources for each of the nested components that are enabled.
++
+. In the *Name* field, enter a name for the backup.
+. In the *Deployment name* field, enter the name of the deployed {PlatformNameShort} instance being backed up. For example if your {PlatformNameShort} deployment must be backed up and the deployment name is myaap, enter 'myaap' in the *Deployment name* field.
+. Click btn:[Create].
+
+.Verification
+To verify that your backup was successful you can:
+
+. Log in to {OCP}.
+. Go to menu:Operators[Installed Operators].
+. Select the {OperatorPlatform} installed on your project namespace.
+. Click *All Instances*.
+
+The *All Instances* page displays the main backup and the backups for each component with the name you specified when creating your backup resource. The status for these instances should state *Running* or *Successful*.
+
diff --git a/downstream/modules/platform/proc-aap-platform-gateway-restore.adoc b/downstream/modules/platform/proc-aap-platform-gateway-restore.adoc
index 8f0d5b9ce8..51274db663 100644
--- a/downstream/modules/platform/proc-aap-platform-gateway-restore.adoc
+++ b/downstream/modules/platform/proc-aap-platform-gateway-restore.adoc
@@ -1,3 +1,31 @@
-[id="aap-platform-gateway-restore"]
+[id="aap-platform-gateway-restore_{context}"]
-= Recovering your AnsibleAutomationPlatform resource
+= Recovering your AnsibleAutomationPlatform deployment
+*AnsibleAutomationPlatform* hosts any enabled components (such as, {ControllerName}, {HubName}, {EDAName}, and {LightspeedShortName}), when you recover *AnsibleAutomationPlatform* you also restore these components.
+
+.Prerequisites
+* You must be authenticated with an Openshift cluster.
+* You have installed the {OperatorPlatform} on the cluster.
+* The *AnsibleAutomationPlatformBackups* deployment is available in your cluster.
+
+.Procedure
+. Log in to {OCP}.
+. Go to menu:Operators[Installed Operators].
+. Select the {OperatorPlatform} installed on your project namespace.
+. Go to your *All Instances* tab, and click btn:[Create New].
+. Select *Ansible Automation Platform Restore* from the list.
+. For *Name* enter the name for the recovery deployment.
+. For *New Ansible Automation Platform Name* enter the new name for your {PlatformNameShort} instance.
+. *Backup Source* defaults to *CR*.
+. For *Backup name* enter the name your chose when creating the backup.
+. Click btn:[Create].
+
+Your backups starts restoring under the *AnsibleAutomationPlatformRestores* tab.
+
+NOTE: The recovery is not complete until all the resources are successfully restored. Depending on the size of your database this this can take some time.
+
+.Verification
+To verify that your recovery was successful you can:
+
+. Go to menu:Workloads[Pods].
+. Confirm that all pods are in a *Running* or *Completed* state.
From e6eb382d9643045ffc9fb034abba9d63fdb1ade7 Mon Sep 17 00:00:00 2001
From: EMcWhinn <122449381+EMcWhinn@users.noreply.github.com>
Date: Wed, 26 Jun 2024 14:47:13 +0100
Subject: [PATCH 006/590] Update controller doc titles for 2.5 (#1486) (#1488)
Titles updated as per:
https://miro.com/app/board/uXjVNGGa88w=/
https://issues.redhat.com/browse/AAP-25866
---
.../titles/controller/controller-admin-guide/docinfo.xml | 4 ++--
.../titles/controller/controller-admin-guide/master.adoc | 2 +-
.../titles/controller/controller-api-overview/docinfo.xml | 2 +-
.../titles/controller/controller-api-overview/master.adoc | 2 +-
.../titles/controller/controller-user-guide/docinfo.xml | 4 ++--
.../titles/controller/controller-user-guide/master.adoc | 2 +-
6 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/downstream/titles/controller/controller-admin-guide/docinfo.xml b/downstream/titles/controller/controller-admin-guide/docinfo.xml
index a22b7974ff..2038c1e996 100644
--- a/downstream/titles/controller/controller-admin-guide/docinfo.xml
+++ b/downstream/titles/controller/controller-admin-guide/docinfo.xml
@@ -1,7 +1,7 @@
-
Automation controller administration guide
+Configuring automation execution
Red Hat Ansible Automation Platform
2.5
-Administrator Guide for Automation Controller
+Administrator guide for automation controller
Learn how to manage automation controller through custom scripts, management jobs, and more.
diff --git a/downstream/titles/controller/controller-admin-guide/master.adoc b/downstream/titles/controller/controller-admin-guide/master.adoc
index 0e285bfe8f..e8a730e679 100644
--- a/downstream/titles/controller/controller-admin-guide/master.adoc
+++ b/downstream/titles/controller/controller-admin-guide/master.adoc
@@ -9,7 +9,7 @@ include::attributes/attributes.adoc[]
// Book Title
-= Automation controller administration guide
+= Configuring automation execution
The {ControllerName} Administration Guide describes the administration of {ControllerName} through custom scripts, management jobs, and more.
Written for DevOps engineers and administrators, the {ControllerName} Administration Guide assumes a basic understanding of the systems requiring management with {ControllerName}s easy-to-use graphical interface.
diff --git a/downstream/titles/controller/controller-api-overview/docinfo.xml b/downstream/titles/controller/controller-api-overview/docinfo.xml
index a866e685ea..7047335f62 100644
--- a/downstream/titles/controller/controller-api-overview/docinfo.xml
+++ b/downstream/titles/controller/controller-api-overview/docinfo.xml
@@ -1,4 +1,4 @@
-Automation controller API overview
+Automation execution API overview
Red Hat Ansible Automation Platform
2.5
Developer overview for the {ControllerName} API
diff --git a/downstream/titles/controller/controller-api-overview/master.adoc b/downstream/titles/controller/controller-api-overview/master.adoc
index cb57796ed5..d7c16b455d 100644
--- a/downstream/titles/controller/controller-api-overview/master.adoc
+++ b/downstream/titles/controller/controller-api-overview/master.adoc
@@ -8,7 +8,7 @@ include::attributes/attributes.adoc[]
// Book Title
-= Automation controller API overview
+= Automation execution API overview
Thank you for your interest in {PlatformName}.
{PlatformNameShort} helps teams manage complex multitiered deployments by adding control, knowledge, and delegation to Ansible-powered environments.
diff --git a/downstream/titles/controller/controller-user-guide/docinfo.xml b/downstream/titles/controller/controller-user-guide/docinfo.xml
index ab2fc6ca91..bac7173b64 100644
--- a/downstream/titles/controller/controller-user-guide/docinfo.xml
+++ b/downstream/titles/controller/controller-user-guide/docinfo.xml
@@ -1,7 +1,7 @@
-Automation controller user guide
+Using automation execution
Red Hat Ansible Automation Platform
2.5
-User Guide for Automation Controller
+User guide for automation controller
This guide describes the use of the Red Hat Ansible Automation Platform Controller (automation controller).
diff --git a/downstream/titles/controller/controller-user-guide/master.adoc b/downstream/titles/controller/controller-user-guide/master.adoc
index e530de6e13..4a5c84388b 100644
--- a/downstream/titles/controller/controller-user-guide/master.adoc
+++ b/downstream/titles/controller/controller-user-guide/master.adoc
@@ -9,7 +9,7 @@ include::attributes/attributes.adoc[]
// Book Title
-= Automation controller user guide
+= Using automation execution
Thank you for your interest in {PlatformName} {ControllerName}.
{ControllerNameStart} helps teams manage complex multitiered deployments by adding control, knowledge, and delegation to Ansible-powered environments.
From b890a1f38188f464fb8645ba561546cde58368a7 Mon Sep 17 00:00:00 2001
From: g-murray <147741787+g-murray@users.noreply.github.com>
Date: Thu, 27 Jun 2024 11:31:08 +0100
Subject: [PATCH 007/590] Adding in SME feedback on backup and restore drafts
(#1491) (#1492)
* Adding in SME feedback on draft
* PR suggestions
---
.../platform/assembly-aap-backup.adoc | 6 ++++-
.../proc-aap-platform-gateway-backup.adoc | 26 ++++++++++++++++---
.../proc-aap-platform-gateway-restore.adoc | 9 ++++++-
3 files changed, 36 insertions(+), 5 deletions(-)
diff --git a/downstream/assemblies/platform/assembly-aap-backup.adoc b/downstream/assemblies/platform/assembly-aap-backup.adoc
index 92bd4ab473..b84390d5f2 100644
--- a/downstream/assemblies/platform/assembly-aap-backup.adoc
+++ b/downstream/assemblies/platform/assembly-aap-backup.adoc
@@ -9,7 +9,11 @@ ifdef::context[:parent-context: {context}]
[role="_abstract"]
-Backing up your {PlatformName} deployment involves creating backup resources for your deployed instances. Use the following procedures to create backup resources for your {PlatformName} deployment.
+Backing up your {PlatformName} deployment involves creating backup resources for your deployed instances.
+Use the following procedures to create backup resources for your {PlatformName} deployment.
+We recommend taking backups before upgrading the {OperatorPlatform}.
+Take a backup regularly in case you want to restore the platform to a previous state.
+
//part of 2.5 release, (AAP-22178) uncomment when publishing [gmurray]
//include::platform/proc-aap-platform-gateway-backup.adoc[leveloffset=+1]
diff --git a/downstream/modules/platform/proc-aap-platform-gateway-backup.adoc b/downstream/modules/platform/proc-aap-platform-gateway-backup.adoc
index 524dda9a4d..a5c8d74eaf 100644
--- a/downstream/modules/platform/proc-aap-platform-gateway-backup.adoc
+++ b/downstream/modules/platform/proc-aap-platform-gateway-backup.adoc
@@ -1,7 +1,7 @@
[id="aap-platform-gateway-backup_{context}"]
= Backing up your AnsibleAutomationPlatform deployment
-Regularly backing up your *AnsibleAutomationPlatform* deployment is vital to protect against unexpected data loss and application errors. *AnsibleAutomationPlatform* hosts any enabled components (such as, {ControllerName}, {HubName}, {EDAName}, and {LightspeedShortName}), when you back up *AnsibleAutomationPlatform* you also back up these components.
+Regularly backing up your *AnsibleAutomationPlatform* deployment is vital to protect against unexpected data loss and application errors. *AnsibleAutomationPlatform* hosts any enabled components (such as, {ControllerName}, {HubName}, and {EDAName}), when you back up *AnsibleAutomationPlatform* the operator will also back up these components.
.Prerequisites
* You must be authenticated on Openshift cluster.
@@ -18,9 +18,22 @@ Regularly backing up your *AnsibleAutomationPlatform* deployment is vital to pro
NOTE: When creating the *Ansible Automation Platform Backup* resource it also creates backup resources for each of the nested components that are enabled.
+
. In the *Name* field, enter a name for the backup.
-. In the *Deployment name* field, enter the name of the deployed {PlatformNameShort} instance being backed up. For example if your {PlatformNameShort} deployment must be backed up and the deployment name is myaap, enter 'myaap' in the *Deployment name* field.
+. In the *Deployment name* field, enter the name of the deployed {PlatformNameShort} instance being backed up. For example if your {PlatformNameShort} deployment must be backed up and the deployment name is aap, enter 'aap' in the *Deployment name* field.
. Click btn:[Create].
+This results in an *AnsibleAutomationPlatformBackup* resource. The the resource YAML is similar to the following:
+
+----
+apiVersion: aap.ansible.com/v1alpha1
+kind: AnsibleAutomationPlatformBackup
+metadata:
+ name: backup
+ namespace: aap
+spec:
+ no_log: true
+ deployment_name: aap
+----
+
.Verification
To verify that your backup was successful you can:
@@ -29,5 +42,12 @@ To verify that your backup was successful you can:
. Select the {OperatorPlatform} installed on your project namespace.
. Click *All Instances*.
-The *All Instances* page displays the main backup and the backups for each component with the name you specified when creating your backup resource. The status for these instances should state *Running* or *Successful*.
+The *All Instances* page displays the main backup and the backups for each component with the name you specified when creating your backup resource.
+The status for the following instances must be either *Running* or *Successful*:
+
+* AnsibleAutomationPlatformBackup
+* AutomationControllerBackup
+* EDABackup
+* AutomationHubBackup
+
diff --git a/downstream/modules/platform/proc-aap-platform-gateway-restore.adoc b/downstream/modules/platform/proc-aap-platform-gateway-restore.adoc
index 51274db663..6e6841ad21 100644
--- a/downstream/modules/platform/proc-aap-platform-gateway-restore.adoc
+++ b/downstream/modules/platform/proc-aap-platform-gateway-restore.adoc
@@ -1,7 +1,14 @@
[id="aap-platform-gateway-restore_{context}"]
= Recovering your AnsibleAutomationPlatform deployment
-*AnsibleAutomationPlatform* hosts any enabled components (such as, {ControllerName}, {HubName}, {EDAName}, and {LightspeedShortName}), when you recover *AnsibleAutomationPlatform* you also restore these components.
+*AnsibleAutomationPlatform* manages any enabled components (such as, {ControllerName}, {HubName}, and {EDAName}), when you recover *AnsibleAutomationPlatform* you also restore these components.
+
+In previous versions of the {OperatorPlatform}, it was necessary to create a restore object for each component of the platform.
+Now, you create a single *AnsibleAutomationPlatformRestore* resource, which creates and manages the other restore objects:
+
+* AutomationControllerRestore
+* AutomationHubRestore
+* EDARestore
.Prerequisites
* You must be authenticated with an Openshift cluster.
From 7dc0fa52e1f9d93db38784856c6cd2607f6b046a Mon Sep 17 00:00:00 2001
From: Aine Riordan <44700011+ariordan-redhat@users.noreply.github.com>
Date: Mon, 1 Jul 2024 08:59:10 +0100
Subject: [PATCH 008/590] Adding manifest deprication warning to execution
environments doc (#1489) (#1505)
* Adding manifest deprication warning to Creating and consuming execution environments doc ch. 5 and 5.1
* Update proc-obtain-images.adoc based on feedback
made two changes greg suggested
- used BaseURL attributre
- used btn feature of Asciidoc markdown for accessibility
* Update assembly-populate-container-registry.adoc based on feedback
- changed the URL at the bottom to get it to work with Asciidoc markup "link:"
* fixed minor errors
- changed Simple Account Access to the correct Simple Content Access in the prereq list
- changed the link to be functional at the very end
Co-authored-by: Anni <36550943+annibond@users.noreply.github.com>
---
.../assembly-populate-container-registry.adoc | 14 +++++++------
.../modules/hub/proc-obtain-images.adoc | 21 +++++++++++++++++--
2 files changed, 27 insertions(+), 8 deletions(-)
diff --git a/downstream/assemblies/hub/assembly-populate-container-registry.adoc b/downstream/assemblies/hub/assembly-populate-container-registry.adoc
index 31d00049c2..b882a35bfe 100644
--- a/downstream/assemblies/hub/assembly-populate-container-registry.adoc
+++ b/downstream/assemblies/hub/assembly-populate-container-registry.adoc
@@ -10,10 +10,10 @@ ifdef::context[:parent-context: {context}]
[role="_abstract"]
-By default, {PrivateHubName} does not include container images.
-To populate your container registry, you must push a container image to it.
+By default, {PrivateHubName} does not include container images.
+To populate your container registry, you must push a container image to it.
-You must follow a specific workflow to populate your {PrivateHubName} container registry:
+You must follow a specific workflow to populate your {PrivateHubName} container registry:
* Pull images from the Red Hat Ecosystem Catalog (registry.redhat.io)
* Tag them
@@ -21,16 +21,18 @@ You must follow a specific workflow to populate your {PrivateHubName} container
[IMPORTANT]
====
-Image manifests and filesystem blobs were both originally served directly from `registry.redhat.io` and `registry.access.redhat.com`.
-As of 1 May 2023, filesystem blobs are served from `quay.io` instead.
+Image manifests and filesystem blobs were both originally served directly from `registry.redhat.io` and `registry.access.redhat.com`.
+As of 1 May 2023, filesystem blobs are served from `quay.io` instead.
* Ensure that the link:{BaseURL}/red_hat_ansible_automation_platform/{PlatformVers}/html/red_hat_ansible_automation_platform_planning_guide/ref-network-ports-protocols_planning[Network ports and protocols] listed in _Table 5.10. Execution Environments (EE)_ are available to avoid problems pulling container images.
Make this change to any firewall configuration that specifically enables outbound connections to `registry.redhat.io` or `registry.access.redhat.com`.
-Use the hostnames instead of IP addresses when configuring firewall rules.
+Use the hostnames instead of IP addresses when configuring firewall rules.
After making this change you can continue to pull images from `registry.redhat.io` and `registry.access.redhat.com`. You do not require a `quay.io` login, or need to interact with the `quay.io` registry directly in any way to continue pulling Red Hat container images.
+
+However, manifests, sometimes called “subscription allocations”, on the web-based Red Hat Subscription Management are no longer supported as of early 2024 with one exception: If a system is part of a closed network or “air gapped” system that does not receive its updates from Red Hat’s servers directly, manifests are supported until the release of Red Hat Satellite 6.16. Keep up to date with link:access.redhat.com/articles/1365633[Red Hat Satellite Release Dates] for the announcement for Red Hat Satellite 6.16's release date announcement.
====
include::hub/proc-obtain-images.adoc[leveloffset=+1]
diff --git a/downstream/modules/hub/proc-obtain-images.adoc b/downstream/modules/hub/proc-obtain-images.adoc
index 56e3593dc4..b0628e19d0 100644
--- a/downstream/modules/hub/proc-obtain-images.adoc
+++ b/downstream/modules/hub/proc-obtain-images.adoc
@@ -8,11 +8,26 @@
[role="_abstract"]
Before you can push container images to your {PrivateHubName}, you must first pull them from an existing registry and tag them for use. The following example details how to pull an image from the Red Hat Ecosystem Catalog (registry.redhat.io).
+[IMPORTANT]
+====
+As of early 2024, Red Hat no longer supports manifests or manifest lists on the Red Hat Subscription Management web platform, which has also been used interchangeably with “subscription allocations.” Red Hat also no longer supports most manifest functionality in Red Hat Satellite with one exception:
+* Red Hat Satellite users in closed network or “air gapped” networks that do not receive their updates directly from Red Hat servers can currently still use `access.redhat.com` until the release of Red Hat Satellite 6.16.
+
+New Red Hat accounts automatically use Simple Content Access for their subscription tooling. New Red Hat accounts and existing Satellite customers who can connect to Red Hat’s servers can find their manifests at `console.redhat.com`.
+====
+
.Prerequisites
-You have permissions to pull images from registry.redhat.io.
+
+* You have permissions to pull images from registry.redhat.io.
+
+* A Red Hat account with Simple Content Access enabled.
.Procedure
+. If you need to access your manifest for your container images log in to link:console.redhat.com/subscriptions/manifests[Red Hat Console].
+
+. Click the three-dot menu for the manifest you need for your container images, and click btn:[Export manifest].
+
. Log in to Podman by using your registry.redhat.io credentials:
+
-----
@@ -43,4 +58,6 @@ $ podman images
[role="_additional-resources"]
.Additional resources
-* See link:https://redhat-connect.gitbook.io/catalog-help/[Red Hat Ecosystem Catalog Help] for information on registering and getting images.
+* See link:redhat-connect.gitbook.io/catalog-help/[Red Hat Ecosystem Catalog Help] for information on registering and getting images.
+
+* See link:{BaseURL}/subscription_central/1-latest/html/creating_and_managing_manifests_for_a_connected_satellite_server/index[Creating and managing manifests for a connected Satellite Server] to learn more about the changes coming to Red Hat subscription tooling
From 10b5941eeaefc86efb2dfd4d7aff4ac9a8b0b893 Mon Sep 17 00:00:00 2001
From: Michelle McCausland <141345897+michellemacrh@users.noreply.github.com>
Date: Mon, 1 Jul 2024 12:13:27 +0100
Subject: [PATCH 009/590] 2.5 Update containerized install guide to incorporate
gateway (#1506) (#1507)
* Update containerized install guide to incorporate gateway
https://issues.redhat.com/browse/AAP-18760
---
...sembly-aap-containerized-installation.adoc | 19 +++--
.../proc-downloading-containerized-aap.adoc | 12 ++--
.../proc-installing-containerized-aap.adoc | 21 +++++-
.../platform/proc-using-postinstall.adoc | 2 +-
...ccessing-control-auto-hub-eda-control.adoc | 70 ++++++++++++-------
.../ref-using-custom-tls-certificates.adoc | 14 ++--
6 files changed, 89 insertions(+), 49 deletions(-)
diff --git a/downstream/assemblies/platform/assembly-aap-containerized-installation.adoc b/downstream/assemblies/platform/assembly-aap-containerized-installation.adoc
index bb08181afc..71b6ae17b2 100644
--- a/downstream/assemblies/platform/assembly-aap-containerized-installation.adoc
+++ b/downstream/assemblies/platform/assembly-aap-containerized-installation.adoc
@@ -15,28 +15,27 @@ endif::[]
:context: aap-containerized-installation
[role="_abstract"]
-Ansible Automation Platform is a commercial offering that helps teams manage complex multi-tier deployments by adding control, knowledge, and delegation to Ansible-powered environments.
-
-This guide helps you to understand the installation requirements and processes behind our new containerized version of Ansible Automation Platform. This initial version is based upon {PlatformNameShort} 2.4 and is being released as a Technical Preview. Please see link:https://access.redhat.com/support/offerings/techpreview[Technology Preview Features Support Scope] to understand what a technical preview entails.
+{PlatformNameShort} is a commercial offering that helps teams manage complex multitiered deployments by adding control, knowledge, and delegation to Ansible-powered environments.
+This guide helps you to understand the installation requirements and processes behind the containerized version of {PlatformNameShort}.
.Prerequisites
-* A RHEL 9.2 based host. Minimal OS base install is recommended.
-* A non-root user for the RHEL host, with sudo or other Ansible supported privilege escalation (sudo recommended). This user is responsible for the installation of containerized {PlatformNameShort}.
-* It is recommended setting up an *SSH public key authentication* for the non-root user. For guidelines on setting up an SSH public key authentication for the non-root user, see link:https://access.redhat.com/solutions/4110681[How to configure SSH public key authentication for passwordless login].
-* SSH keys are only required when installing on remote hosts. If doing a self contained local VM based installation, you can use *ansible_connection: local* as per the example which does not require SSH.
-* Internet access from the RHEL host if using the default online installation method.
+* A RHEL 9.2 based host. Minimal operating system (OS) base install is recommended.
+* A non-root user for the {RHEL} host, with sudo or other Ansible supported privilege escalation (sudo recommended). This user is responsible for the installation of containerized {PlatformNameShort}.
+* It is recommended that you set up an *SSH public key authentication* for the non-root user. For guidelines on setting up an SSH public key authentication for the non-root user, see link:https://access.redhat.com/solutions/4110681[How to configure SSH public key authentication for passwordless login].
+* SSH keys are only required when installing on remote hosts. If doing a self contained local VM based installation, you can use *ansible_connection: local*.
+* Internet access from the {RHEL} host if using the default online installation method.
== System Requirements
-Your system must meet the following minimum system requirements to install and run Red Hat Containerized Ansible Automation Platform.
+Your system must meet the following minimum system requirements to install and run Red Hat Containerized {PlatformNameShort}.
[cols=2]
|======================
| Memory | 16Gb RAM
| CPU | 4 CPU
| Disk space | 40Gb
-| Disk IOPs | 1500
+| Disk IOPS | 1500
|======================
diff --git a/downstream/modules/platform/proc-downloading-containerized-aap.adoc b/downstream/modules/platform/proc-downloading-containerized-aap.adoc
index 9b8451c9fe..c75fe43ad1 100644
--- a/downstream/modules/platform/proc-downloading-containerized-aap.adoc
+++ b/downstream/modules/platform/proc-downloading-containerized-aap.adoc
@@ -8,23 +8,23 @@
.Procedure
-. Download the latest installer tarball from link:https://access.redhat.com/downloads/content/480/ver=2.4/rhel---9/2.4/x86_64/product-software[access.redhat.com]. This can be done directly within the RHEL host, which saves time.
+. Download the latest installer .tar file from link:{PlatformDownloadUrl}[access.redhat.com]. This can be done directly within the {RHEL} host, which saves time.
-. If you have downloaded the tarball and optional manifest zip file onto your laptop, copy them onto your RHEL host.
+. If you have downloaded the .tar file and optional manifest .zip file onto your laptop, copy them onto your {RHEL} host.
+
-Decide where you would like the installer to reside on the filesystem. Installation related files will be created under this location and require at least 10Gb for the initial installation.
+Decide where you want the installation program to reside on the filesystem. Installation related files will be created under this location and require at least 10Gb for the initial installation.
+
-. Unpack the installer tarball into your installation directory, and cd into the unpacked directory.
+. Unpack the installation program .tar file into your installation directory, and navigate to the unpacked directory.
+
.. online installer
+
----
-$ tar xfvz ansible-automation-platform-containerized-setup-2.4-2.tar.gz
+$ tar xfvz ansible-automation-platform-containerized-setup-.tar.gz
----
+
.. bundled installer
+
----
-$ tar xfvz ansible-automation-platform-containerized-setup-bundle-2.4-2-.tar.gz
+$ tar xfvz ansible-automation-platform-containerized-setup-bundle--.tar.gz
----
diff --git a/downstream/modules/platform/proc-installing-containerized-aap.adoc b/downstream/modules/platform/proc-installing-containerized-aap.adoc
index 0ababc924f..8c200bc53f 100644
--- a/downstream/modules/platform/proc-installing-containerized-aap.adoc
+++ b/downstream/modules/platform/proc-installing-containerized-aap.adoc
@@ -13,10 +13,10 @@ For convenience an example inventory file is provided, that you can copy and mod
[NOTE]
====
-There is no default database choice given in the inventory file. You must follow the instructions in the inventory file to make the appropriate choice between an internally provided postgres, or provide your own externally managed and supported database option.
+There is no default database choice given in the inventory file. You must follow the instructions in the inventory file to make the appropriate choice between an internally provided Postgres, or provide your own externally managed and supported database option.
====
-Edit the inventory file by replacing the `< >` placeholders with your specific variables, and uncommenting any lines specific to your needs.
+Edit the inventory file by replacing the `< >` placeholders with your specific variables, and uncommenting any lines specific to your needs. Refer to the `README.md` file for more information about optional and required variables.
----
@@ -39,6 +39,11 @@ fqdn_of_your_rhel_host ansible_connection=local
[automationeda]
fqdn_of_your_rhel_host ansible_connection=local
+# This section is for your AAP Gateway host(s)
+# -----------------------------------------------------
+[automationgateway]
+fqdn_of_your_rhel_host ansible_connection=local
+
# This section is for your AAP Execution host(s)
# ------------------------------------------------
#[execution_nodes]
@@ -141,6 +146,18 @@ eda_pg_password=
#eda_tls_cert=
#eda_tls_key=
+# AAP Gateway - mandatory
+# ------------------------------
+gateway_admin_password=
+gateway_pg_host=fqdn_of_your_rhel_host
+gateway_pg_password=
+
+# AAP Gateway - optional
+# -----------------------------
+# To use custom TLS certificate/key you need to set these variables
+#gateway_tls_cert=
+#gateway_tls_key=
+
# AAP Execution Nodes - optional
# -----------------------------
#receptor_port=27199
diff --git a/downstream/modules/platform/proc-using-postinstall.adoc b/downstream/modules/platform/proc-using-postinstall.adoc
index 8852c919e8..da3df34d16 100644
--- a/downstream/modules/platform/proc-using-postinstall.adoc
+++ b/downstream/modules/platform/proc-using-postinstall.adoc
@@ -7,7 +7,7 @@
[role="_abstract"]
-Use the experimental postinstaller feature of containerized {PlatformNameShort} to define and load the configuration during the initial installation. This uses a configuration-as-code approach, where you simply define your configuration to be loaded as simple YAML files.
+Use the postinstaller feature of containerized {PlatformNameShort} to define and load the configuration during the initial installation. This uses a configuration-as-code approach, where you simply define your configuration to be loaded as simple YAML files.
. To use this optional feature, you need to uncomment the following vars in the inventory file:
+
diff --git a/downstream/modules/platform/ref-accessing-control-auto-hub-eda-control.adoc b/downstream/modules/platform/ref-accessing-control-auto-hub-eda-control.adoc
index 19eb0578b8..a67c54fd74 100644
--- a/downstream/modules/platform/ref-accessing-control-auto-hub-eda-control.adoc
+++ b/downstream/modules/platform/ref-accessing-control-auto-hub-eda-control.adoc
@@ -1,54 +1,72 @@
:_mod-docs-content-type: REFERENCE
-[id="accessing-control-auto-hub-eda-control_{context}"]
+[id="accessing-gateway_{context}"]
-= Accessing {ControllerName}, {HubName}, and {EDAcontroller}
+= Accessing platform gateway
[role="_abstract"]
-After the installation completes, these are the default protocol and ports used:
+After the installation completes, the default protocol and ports used for platform gateway are 80 (http) and 443 (https).
-* http/https protocol
+You can customize the ports with the following variables:
-* Ports 8080/8443 for {ControllerName}
-
-* Ports 8081/8444 for {HubName}
+----
+gateway_nginx_http_port: 8500
-* Ports 8082/8445 for {EDAcontroller}
+gateway_nginx_https_port: 8501
+----
+If you want to disable https, set `gateway_nginx_disable_https` to `true`:
-These can be changed. Consult the *README.md* for further details. It is recommended that you leave the defaults unless you need to change them due to port conflicts or other factors.
+----
+gateway_nginx_disable_https: true
+----
+[NOTE]
+====
+Consult the *README.md* for further details. Leave the defaults unless you need to change them due to port conflicts or other factors.
+====
-.Accessing {ControllerName} UI
+.Accessing platform gateway UI
-The {ControllerName} UI is available by default at:
+The platform gateway UI is available by default at:
----
-https://:8443
+https://:443
----
-Log in as the admin user with the password you created for *controller_admin_password*.
+Log in as the admin user with the password you created for *gateway_admin_password*.
-If you supplied the license manifest as part of the installation, the {PlatformNameShort} dashboard is displayed. If you did not supply a license file, the *Subscription* screen is displayed where you must supply your license details. This is documented here: link:{BaseURL}/red_hat_ansible_automation_platform/{PlatformVers}/html/red_hat_ansible_automation_platform_operations_guide/assembly-aap-activate[Chapter 1. Activating Red Hat Ansible Automation Platform].
+// Michelle: Removing additional component UI references as platform gateway UI will be used going forward - AAP-18760
+// .Accessing {ControllerName} UI
-.Accessing {HubName} UI
+// The {ControllerName} UI is available by default at:
-The {HubName} UI is available by default at:
+// ----
+// https://:8443
+// ----
-----
-https://:8444
-----
+// Log in as the admin user with the password you created for *controller_admin_password*.
-Log in as the admin user with the password you created for *hub_admin_password*.
+// If you supplied the license manifest as part of the installation, the {PlatformNameShort} dashboard is displayed. If you did not supply a license file, the *Subscription* screen is displayed where you must supply your license details. This is documented here: link:{BaseURL}/red_hat_ansible_automation_platform/{PlatformVers}/html/red_hat_ansible_automation_platform_operations_guide/assembly-aap-activate[Chapter 1. Activating {PlatformName}].
+// .Accessing {HubName} UI
-.Accessing {EDAName} UI
+// The {HubName} UI is available by default at:
-The {EDAName} UI is available by default at:
-----
-https://:8445
-----
+// ----
+// https://:8444
+// ----
+
+// Log in as the admin user with the password you created for *hub_admin_password*.
+
+
+// .Accessing {EDAName} UI
+
+// The {EDAName} UI is available by default at:
+// ----
+// https://:8445
+// ----
-Log in as the admin user with the password you created for *eda_admin_password*.
+// Log in as the admin user with the password you created for *eda_admin_password*.
diff --git a/downstream/modules/platform/ref-using-custom-tls-certificates.adoc b/downstream/modules/platform/ref-using-custom-tls-certificates.adoc
index e8b4a03e82..c2f4ec3991 100644
--- a/downstream/modules/platform/ref-using-custom-tls-certificates.adoc
+++ b/downstream/modules/platform/ref-using-custom-tls-certificates.adoc
@@ -8,7 +8,7 @@
[role="_abstract"]
-By default, the installer generates TLS certificates and keys for all services which are signed by a custom Certificate Authority (CA). You can provide a custom TLS certificate/key for each service. If that certificate is signed by a custom CA, you must provide the CA TLS certificate and key.
+By default, the installer generates TLS certificates and keys for all services that are signed by a custom Certificate Authority (CA). You can provide a custom TLS certificate and key for each service. If that certificate is signed by a custom CA, you must provide the CA TLS certificate and key.
* Certificate Authority
----
@@ -16,19 +16,25 @@ ca_tls_cert=/full/path/to/tls/certificate
ca_tls_key=/full/path/to/tls/key
----
-* Automation Controller
+* Platform gateway
+----
+gateway_tls_cert=/full/path/to/tls/certificate
+gateway_tls_key=/full/path/to/tls/key
+----
+
+* {ControllerNameStart}
----
controller_tls_cert=/full/path/to/tls/certificate
controller_tls_key=/full/path/to/tls/key
----
-* Automation Hub
+* {HubNameStart}
----
hub_tls_cert=/full/path/to/tls/certificate
hub_tls_key=/full/path/to/tls/key
----
-* Automation EDA
+* {EDAName}
----
eda_tls_cert=/full/path/to/tls/certificate
eda_tls_key=/full/path/to/tls/key
From 3c6120d8ffe3e375ed6a82b367334e34d598f255 Mon Sep 17 00:00:00 2001
From: Michelle McCausland <141345897+michellemacrh@users.noreply.github.com>
Date: Tue, 2 Jul 2024 10:28:05 +0100
Subject: [PATCH 010/590] Create Containerized AAP Troubleshooting content
(#1499) (#1508)
Create Containerized AAP Troubleshooting content
https://issues.redhat.com/browse/AAP-15683
---
...pendix-troubleshoot-containerized-aap.adoc | 9 +
...ref-containerized-troubleshoot-config.adoc | 23 ++
...ef-containerized-troubleshoot-install.adoc | 133 ++++++++
.../ref-containerized-troubleshoot-ref.adoc | 311 ++++++++++++++++++
.../aap-containerized-install/master.adoc | 3 +
5 files changed, 479 insertions(+)
create mode 100644 downstream/assemblies/platform/assembly-appendix-troubleshoot-containerized-aap.adoc
create mode 100644 downstream/modules/platform/ref-containerized-troubleshoot-config.adoc
create mode 100644 downstream/modules/platform/ref-containerized-troubleshoot-install.adoc
create mode 100644 downstream/modules/platform/ref-containerized-troubleshoot-ref.adoc
diff --git a/downstream/assemblies/platform/assembly-appendix-troubleshoot-containerized-aap.adoc b/downstream/assemblies/platform/assembly-appendix-troubleshoot-containerized-aap.adoc
new file mode 100644
index 0000000000..84dfcc4910
--- /dev/null
+++ b/downstream/assemblies/platform/assembly-appendix-troubleshoot-containerized-aap.adoc
@@ -0,0 +1,9 @@
+[id="appendix-troubleshoot-containerized-aap"]
+= Troubleshooting containerized {PlatformNameShort}
+
+Use this information to troubleshoot your containerized {PlatformNameShort} installation.
+
+include::platform/ref-containerized-troubleshoot-install.adoc[leveloffset=+1]
+include::platform/ref-containerized-troubleshoot-config.adoc[leveloffset=+1]
+include::platform/ref-containerized-troubleshoot-ref.adoc[leveloffset=+1]
+
diff --git a/downstream/modules/platform/ref-containerized-troubleshoot-config.adoc b/downstream/modules/platform/ref-containerized-troubleshoot-config.adoc
new file mode 100644
index 0000000000..17732e9094
--- /dev/null
+++ b/downstream/modules/platform/ref-containerized-troubleshoot-config.adoc
@@ -0,0 +1,23 @@
+[id="ref-containerized-troubleshoot-config"]
+
+= Troubleshooting containerized {PlatformNameShort} configuration
+
+// New items have appeared within installation program directory once an install has been run. What are these items?
+
+.Sometimes the post install for seeding my {PlatformNameShort} content errors out. This could manifest itself as output similar to this:
+
+----
+TASK [infra.controller_configuration.projects : Configure Controller Projects | Wait for finish the projects creation] ***************************************
+Friday 29 September 2023 11:02:32 +0100 (0:00:00.443) 0:00:53.521 ******
+FAILED - RETRYING: [daap1.lan]: Configure Controller Projects | Wait for finish the projects creation (1 retries left).
+failed: [daap1.lan] (item={'failed': 0, 'started': 1, 'finished': 0, 'ansible_job_id': '536962174348.33944', 'results_file': '/home/aap/.ansible_async/536962174348.33944', 'changed': False, '__controller_project_item': {'name': 'AAP Config-As-Code Examples', 'organization': 'Default', 'scm_branch': 'main', 'scm_clean': 'no', 'scm_delete_on_update': 'no', 'scm_type': 'git', 'scm_update_on_launch': 'no', 'scm_url': 'https://github.com/user/repo.git'}, 'ansible_loop_var': '__controller_project_item'}) => {"__projects_job_async_results_item": {"__controller_project_item": {"name": "AAP Config-As-Code Examples", "organization": "Default", "scm_branch": "main", "scm_clean": "no", "scm_delete_on_update": "no", "scm_type": "git", "scm_update_on_launch": "no", "scm_url": "https://github.com/user/repo.git"}, "ansible_job_id": "536962174348.33944", "ansible_loop_var": "__controller_project_item", "changed": false, "failed": 0, "finished": 0, "results_file": "/home/aap/.ansible_async/536962174348.33944", "started": 1}, "ansible_job_id": "536962174348.33944", "ansible_loop_var": "__projects_job_async_results_item", "attempts": 30, "changed": false, "finished": 0, "results_file": "/home/aap/.ansible_async/536962174348.33944", "started": 1, "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []}
+----
+
+The `infra.controller_configuration.dispatch` role uses an asynchronous loop with 30 retries to apply each configuration type, and the default delay between retries is 1 second. If the configuration is large, this might not be enough time to apply everything before the last retry occurs.
+
+Increase the retry delay by setting the `controller_configuration_async_delay` variable to something other than 1 second. For example, setting it to 2 seconds doubles the retry time. The place to do this would be in the repository where the controller configuration is defined. It could also be added to the `[all:vars]` section of the installation program inventory file.
+
+A few instances have shown that no additional modification is required, and re-running the installation program again worked.
+
+//I have updated a configuration file, how do I get changes to apply?
+//
diff --git a/downstream/modules/platform/ref-containerized-troubleshoot-install.adoc b/downstream/modules/platform/ref-containerized-troubleshoot-install.adoc
new file mode 100644
index 0000000000..908f51e0e4
--- /dev/null
+++ b/downstream/modules/platform/ref-containerized-troubleshoot-install.adoc
@@ -0,0 +1,133 @@
+[id="ref-containerized-troubleshoot-install"]
+
+= Troubleshooting containerized {PlatformNameShort} installation
+
+//Upgrades How do I update my components with a new image?
+//
+
+//The UI is inaccessible. What should I check?
+//What should I check for?
+//Database migrations - where?
+//Are containers running web UI services - details?
+
+// I cannot log in to the UI
+
+//How do I check or reset the admin password?
+//How do I check any LDAP configured logins?
+
+.The installation takes a long time, or has errors, what should I check?
+
+. Ensure your system meets the minimum requirements as outlined in the installation guide. Items such as improper storage choices and high latency when distributing across many hosts will all have a significant impact.
+
+. Check the installation log file located by default at `./aap_install.log` unless otherwise changed within the local installer `ansible.cfg`.
+
+. Enable task profiling callbacks on an ad hoc basis to give an overview of where the installation program spends the most time. To do this, use the local `ansible.cfg` file. Add a callback line such as this under the `[defaults]` section:
+
+----
+$ cat ansible.cfg
+[defaults]
+callbacks_enabled = ansible.posix.profile_tasks
+----
+
+.{ControllerNameStart} returns an error of 413
+
+This error is due to `manifest.zip` license files that are larger than the `nginx_client_max_body_size` setting. If this error occurs, you will need to change the installation inventory file to include the following variables:
+
+----
+nginx_disable_hsts: false
+nginx_http_port: 8081
+nginx_https_port: 8444
+nginx_client_max_body_size: 20m
+nginx_user_headers: []
+----
+
+The current default setting of `20m` should be enough to avoid this issue.
+
+.The installation failed with a “502 Bad Gateway” when going to the controller UI.
+
+This error can occur and manifest itself in the installation application output as:
+
+----
+TASK [ansible.containerized_installer.automationcontroller : Wait for the Controller API to te ready] ******************************************************
+fatal: [daap1.lan]: FAILED! => {"changed": false, "connection": "close", "content_length": "150", "content_type": "text/html", "date": "Fri, 29 Sep 2023 09:42:32 GMT", "elapsed": 0, "msg": "Status code was 502 and not [200]: HTTP Error 502: Bad Gateway", "redirected": false, "server": "nginx", "status": 502, "url": "https://daap1.lan:443/api/v2/ping/"}
+----
+
+* Check if you have an `automation-controller-web` container running and a systemd service.
+
+
+[NOTE]
+====
+This is used at the regular unprivileged user not system wide level. If you have used `su` to switch to the user running the containers, you must set your `XDG_RUNTIME_DIR` environment variable to the correct value to be able to interact with the user `systemctl` units.
+====
+
+----
+export XDG_RUNTIME_DIR="/run/user/$UID"
+----
+
+----
+podman ps | grep web
+systemctl --user | grep web
+----
+
+No output indicates a problem.
+
+
+. Try restarting the `automation-controller-web` service:
++
+----
+systemctl start automation-controller-web.service --user
+systemctl --user | grep web
+systemctl status automation-controller-web.service --user
+----
++
+----
+Sep 29 10:55:16 daap1.lan automation-controller-web[29875]: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address already in use)
+Sep 29 10:55:16 daap1.lan automation-controller-web[29875]: nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
+----
++
+The output indicates that the port is already, or still, in use by another service. In this case `nginx`.
+
+. Run:
++
+----
+sudo pkill nginx
+----
++
+. Restart and status check the web service again.
+
+Normal service output should look similar to the following, and should still be running:
+
+----
+Sep 29 10:59:26 daap1.lan automation-controller-web[30274]: WSGI app 0 (mountpoint='/') ready in 3 seconds on interpreter 0x1a458c10 pid: 17 (default app)
+Sep 29 10:59:26 daap1.lan automation-controller-web[30274]: WSGI app 0 (mountpoint='/') ready in 3 seconds on interpreter 0x1a458c10 pid: 20 (default app)
+Sep 29 10:59:27 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:27,043 INFO [-] daphne.cli Starting server at tcp:port=8051:interface=127.0.>
+Sep 29 10:59:27 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:27,043 INFO Starting server at tcp:port=8051:interface=127.0.0.1
+Sep 29 10:59:27 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:27,048 INFO [-] daphne.server HTTP/2 support not enabled (install the http2 >
+Sep 29 10:59:27 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:27,048 INFO HTTP/2 support not enabled (install the http2 and tls Twisted ex>
+Sep 29 10:59:27 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:27,049 INFO [-] daphne.server Configuring endpoint tcp:port=8051:interface=1>
+Sep 29 10:59:27 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:27,049 INFO Configuring endpoint tcp:port=8051:interface=127.0.0.1
+Sep 29 10:59:27 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:27,051 INFO [-] daphne.server Listening on TCP address 127.0.0.1:8051
+Sep 29 10:59:27 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:27,051 INFO Listening on TCP address 127.0.0.1:8051
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: nginx entered RUNNING state, process has stayed up for > th>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: nginx entered RUNNING state, process has stayed up for > th>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: uwsgi entered RUNNING state, process has stayed up for > th>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: uwsgi entered RUNNING state, process has stayed up for > th>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: daphne entered RUNNING state, process has stayed up for > t>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: daphne entered RUNNING state, process has stayed up for > t>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: ws-heartbeat entered RUNNING state, process has stayed up f>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: ws-heartbeat entered RUNNING state, process has stayed up f>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: cache-clear entered RUNNING state, process has stayed up fo>
+Sep 29 10:59:54 daap1.lan automation-controller-web[30274]: 2023-09-29 09:59:54,139 INFO success: cache-clear entered RUNNING state, process has stayed up
+----
+
+You can run the installation program again to ensure everything installs as expected.
+
+.When attempting to install containerized {PlatformNameShort} in {AWS} you receive output that there is no space left on device
+
+----
+TASK [ansible.containerized_installer.automationcontroller : Create the receptor container] ***************************************************
+fatal: [ec2-13-48-25-168.eu-north-1.compute.amazonaws.com]: FAILED! => {"changed": false, "msg": "Can't create container receptor", "stderr": "Error: creating container storage: creating an ID-mapped copy of layer \"98955f43cc908bd50ff43585fec2c7dd9445eaf05eecd1e3144f93ffc00ed4ba\": error during chown: storage-chown-by-maps: lchown usr/local/lib/python3.9/site-packages/azure/mgmt/network/v2019_11_01/operations/__pycache__/_available_service_aliases_operations.cpython-39.pyc: no space left on device: exit status 1\n", "stderr_lines": ["Error: creating container storage: creating an ID-mapped copy of layer \"98955f43cc908bd50ff43585fec2c7dd9445eaf05eecd1e3144f93ffc00ed4ba\": error during chown: storage-chown-by-maps: lchown usr/local/lib/python3.9/site-packages/azure/mgmt/network/v2019_11_01/operations/__pycache__/_available_service_aliases_operations.cpython-39.pyc: no space left on device: exit status 1"], "stdout": "", "stdout_lines": []}
+----
+
+If you are installing a `/home` filesystem into a default {AWS} marketplace RHEL instance, it might be too small since `/home` is part of the root `/` filesystem. You will need to make more space available. The documentation specifies a minimum of 40GB for a single-node deployment of containerized {PlatformNameShort}.
+
diff --git a/downstream/modules/platform/ref-containerized-troubleshoot-ref.adoc b/downstream/modules/platform/ref-containerized-troubleshoot-ref.adoc
new file mode 100644
index 0000000000..e060670f70
--- /dev/null
+++ b/downstream/modules/platform/ref-containerized-troubleshoot-ref.adoc
@@ -0,0 +1,311 @@
+[id="ref-containerized-troubleshoot-ref"]
+
+= Containerized {PlatformNameShort} reference
+
+.Can you provide details of the architecture for the {PlatformNameShort} containerized design?
+
+We use as much of the underlying native RHEL technology as possible. For the container runtime and management of services we use Podman. Many Podman services and commands are used to show and investigate the solution.
+
+For instance, use `podman ps`, and `podman images` to see some of the foundational and running pieces:
+
+----
+[aap@daap1 aap]$ podman ps
+CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
+88ed40495117 registry.redhat.io/rhel8/postgresql-13:latest run-postgresql 48 minutes ago Up 47 minutes postgresql
+8f55ba612f04 registry.redhat.io/rhel8/redis-6:latest run-redis 47 minutes ago Up 47 minutes redis
+56c40445c590 registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel8:latest /usr/bin/receptor... 47 minutes ago Up 47 minutes receptor
+f346f05d56ee registry.redhat.io/ansible-automation-platform-24/controller-rhel8:latest /usr/bin/launch_a... 47 minutes ago Up 45 minutes automation-controller-rsyslog
+26e3221963e3 registry.redhat.io/ansible-automation-platform-24/controller-rhel8:latest /usr/bin/launch_a... 46 minutes ago Up 45 minutes automation-controller-task
+c7ac92a1e8a1 registry.redhat.io/ansible-automation-platform-24/controller-rhel8:latest /usr/bin/launch_a... 46 minutes ago Up 28 minutes automation-controller-web
+
+[aap@daap1 aap]$ podman images
+REPOSITORY TAG IMAGE ID CREATED SIZE
+registry.redhat.io/ansible-automation-platform-24/ee-supported-rhel8 latest b497bdbee59e 10 days ago 3.16 GB
+registry.redhat.io/ansible-automation-platform-24/controller-rhel8 latest ed8ebb1c1baa 10 days ago 1.48 GB
+registry.redhat.io/rhel8/redis-6 latest 78905519bb05 2 weeks ago 357 MB
+registry.redhat.io/rhel8/postgresql-13 latest 9b65bc3d0413 2 weeks ago 765 MB
+[aap@daap1 aap]$
+----
+
+//Describe AAP Controller containers:
+
+//Describe AAP Hub containers:
+
+//Describe EDA Controller containers:
+
+Containerized {PlatformNameShort} runs as rootless containers for maximum out-of-the-box security. This means you can install containerized {PlatformNameShort} by using any local unprivileged user account. Privilege escalation is only needed for certain root level tasks, and by default is not needed to use root directly.
+
+Once installed, you will notice certain items have populate on the filesystem where the installation program is run (the underlying RHEL host).
+
+----
+[aap@daap1 aap]$ tree -L 1
+.
+├── aap_install.log
+├── ansible.cfg
+├── collections
+├── galaxy.yml
+├── inventory
+├── LICENSE
+├── meta
+├── playbooks
+├── plugins
+├── README.md
+├── requirements.yml
+├── roles
+----
+
+Other containerized services that make use of things such as Podman volumes, reside under the installation root directory used. Here are some examples for further reference:
+
+The containers directory contains some of the Podman specifics used and installed for the execution plane:
+
+----
+containers/
+├── podman
+├── storage
+│ ├── defaultNetworkBackend
+│ ├── libpod
+│ ├── networks
+│ ├── overlay
+│ ├── overlay-containers
+│ ├── overlay-images
+│ ├── overlay-layers
+│ ├── storage.lock
+│ └── userns.lock
+└── storage.conf
+----
+
+The controller directory has some of the installed configuration and runtime data points:
+
+----
+controller/
+├── data
+│ ├── job_execution
+│ ├── projects
+│ └── rsyslog
+├── etc
+│ ├── conf.d
+│ ├── launch_awx_task.sh
+│ ├── settings.py
+│ ├── tower.cert
+│ └── tower.key
+├── nginx
+│ └── etc
+├── rsyslog
+│ └── run
+└── supervisor
+ └── run
+----
+
+The receptor directory has the {AutomationMesh} configuration:
+
+----
+receptor/
+├── etc
+│ └── receptor.conf
+└── run
+ ├── receptor.sock
+ └── receptor.sock.lock
+----
+
+After installation, you will also find other pieces in the local users home directory such as the `.cache` directory:
+
+----
+.cache/
+├── containers
+│ └── short-name-aliases.conf.lock
+└── rhsm
+ └── rhsm.log
+----
+
+As we run by default in the most secure manner, such as rootless Podman, we can also use other services such as running `systemd` as non-privileged users. Under `systemd` you can see some of the component service controls available:
+
+The `.config` directory:
+
+----
+.config/
+├── cni
+│ └── net.d
+│ └── cni.lock
+├── containers
+│ ├── auth.json
+│ └── containers.conf
+└── systemd
+ └── user
+ ├── automation-controller-rsyslog.service
+ ├── automation-controller-task.service
+ ├── automation-controller-web.service
+ ├── default.target.wants
+ ├── podman.service.d
+ ├── postgresql.service
+ ├── receptor.service
+ ├── redis.service
+ └── sockets.target.wants
+----
+
+
+This is specific to Podman and conforms to the Open Container Initiative (OCI) specifications. Whereas Podman run as the root user would use `/var/lib/containers` by default, for standard users the hierarchy under `$HOME/.local` is used.
+
+The `.local` directory:
+
+----
+.local/
+└── share
+ └── containers
+ ├── cache
+ ├── podman
+ └── storage
+
+As an example `.local/storage/volumes` contains what the output from `podman volume ls` provides:
+
+[aap@daap1 containers]$ podman volume ls
+DRIVER VOLUME NAME
+local d73d3fe63a957bee04b4853fd38c39bf37c321d14fdab9ee3c9df03645135788
+local postgresql
+local redis_data
+local redis_etc
+local redis_run
+----
+
+We isolate the execution plane from the control plane main services (PostgreSQL, Redis, {ControllerName}, receptor, {HubName} and {EDAName}).
+
+Control plane services run with the standard Podman configuration (`~/.local/share/containers/storage`).
+
+Execution plane services use a dedicated configuration or storage (`~/aap/containers/storage`) to avoid execution plane containers to be able to interact with the control plane.
+
+
+.How can I see host resource utilization statistics?
+
+* Run:
+
+----
+$ podman container stats -a
+----
+
+----
+podman container stats -a
+ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS CPU TIME AVG CPU %
+0d5d8eb93c18 automation-controller-web 0.23% 959.1MB / 3.761GB 25.50% 0B / 0B 0B / 0B 16 20.885142s 1.19%
+3429d559836d automation-controller-rsyslog 0.07% 144.5MB / 3.761GB 3.84% 0B / 0B 0B / 0B 6 4.099565s 0.23%
+448d0bae0942 automation-controller-task 1.51% 633.1MB / 3.761GB 16.83% 0B / 0B 0B / 0B 33 34.285272s 1.93%
+7f140e65b57e receptor 0.01% 5.923MB / 3.761GB 0.16% 0B / 0B 0B / 0B 7 1.010613s 0.06%
+c1458367ca9c redis 0.48% 10.52MB / 3.761GB 0.28% 0B / 0B 0B / 0B 5 9.074042s 0.47%
+ef712cc2dc89 postgresql 0.09% 21.88MB / 3.761GB 0.58% 0B / 0B 0B / 0B 21 15.571059s 0.80%
+----
+
+The previous is an example of a Dell sold and offered containerized {PlatformNameShort} solution (DAAP) install and utilizes ~1.8Gb RAM.
+
+
+.How much storage is used and where?
+
+As we run rootless Podman the container volume storage is under the local user at `$HOME/.local/share/containers/storage/volumes`.
+
+. To view the details of each volume run:
++
+----
+$ podman volume ls
+----
++
+. Then run:
++
+----
+$ podman volume inspect
+----
+
+Here is an example:
+
+----
+$ podman volume inspect postgresql
+[
+ {
+ "Name": "postgresql",
+ "Driver": "local",
+ "Mountpoint": "/home/aap/.local/share/containers/storage/volumes/postgresql/_data",
+ "CreatedAt": "2024-01-08T23:39:24.983964686Z",
+ "Labels": {},
+ "Scope": "local",
+ "Options": {},
+ "MountCount": 0,
+ "NeedsCopyUp": true
+ }
+]
+----
+
+
+Several files created by the installation program are located in `$HOME/aap/` and bind-mounted into various running containers.
+
+
+. To view the mounts associated with a container run:
++
+----
+$ podman ps --format "{{.ID}}\t{{.Command}}\t{{.Names}}"
+----
++
+----
+Example:
+$ podman ps --format "{{.ID}}\t{{.Command}}\t{{.Names}}"
+89e779b81b83 run-postgresql postgresql
+4c33cc77ef7d run-redis redis
+3d8a028d892d /usr/bin/receptor... receptor
+09821701645c /usr/bin/launch_a... automation-controller-rsyslog
+a2ddb5cac71b /usr/bin/launch_a... automation-controller-task
+fa0029a3b003 /usr/bin/launch_a... automation-controller-web
+20f192534691 gunicorn --bind 1... automation-eda-api
+f49804c7e6cb daphne -b 127.0.0... automation-eda-daphne
+d340b9c1cb74 /bin/sh -c nginx ... automation-eda-web
+111f47de5205 aap-eda-manage rq... automation-eda-worker-1
+171fcb1785af aap-eda-manage rq... automation-eda-worker-2
+049d10555b51 aap-eda-manage rq... automation-eda-activation-worker-1
+7a78a41a8425 aap-eda-manage rq... automation-eda-activation-worker-2
+da9afa8ef5e2 aap-eda-manage sc... automation-eda-scheduler
+8a2958be9baf gunicorn --name p... automation-hub-api
+0a8b57581749 gunicorn --name p... automation-hub-content
+68005b987498 nginx -g daemon o... automation-hub-web
+cb07af77f89f pulpcore-worker automation-hub-worker-1
+a3ba05136446 pulpcore-worker automation-hub-worker-2
+----
++
+
+. Then run:
++
+----
+$ podman inspect | jq -r .[].Mounts[].Source
+----
++
+----
+Example:
+/home/aap/.local/share/containers/storage/volumes/receptor_run/_data
+/home/aap/.local/share/containers/storage/volumes/redis_run/_data
+/home/aap/aap/controller/data/rsyslog
+/home/aap/aap/controller/etc/tower.key
+/home/aap/aap/controller/etc/conf.d/callback_receiver_workers.py
+/home/aap/aap/controller/data/job_execution
+/home/aap/aap/controller/nginx/etc/controller.conf
+/home/aap/aap/controller/etc/conf.d/subscription_usage_model.py
+/home/aap/aap/controller/etc/conf.d/cluster_host_id.py
+/home/aap/aap/controller/etc/conf.d/insights.py
+/home/aap/aap/controller/rsyslog/run
+/home/aap/aap/controller/data/projects
+/home/aap/aap/controller/etc/settings.py
+/home/aap/aap/receptor/etc/receptor.conf
+/home/aap/aap/controller/etc/conf.d/execution_environments.py
+/home/aap/aap/tls/extracted
+/home/aap/aap/controller/supervisor/run
+/home/aap/aap/controller/etc/uwsgi.ini
+/home/aap/aap/controller/etc/conf.d/container_groups.py
+/home/aap/aap/controller/etc/launch_awx_task.sh
+/home/aap/aap/controller/etc/tower.cert
+----
+
++
+
+. If the `jq` RPM is not installed, install with:
++
+----
+$ sudo dnf -y install jq
+----
+
+// Reference How do I check on the health of the service and that all components are running?
+//
+// I am experiencing errors and want to look for the application logs, where do I look?
+//
+
diff --git a/downstream/titles/aap-containerized-install/master.adoc b/downstream/titles/aap-containerized-install/master.adoc
index 1a5cf65b27..18762f4cc7 100644
--- a/downstream/titles/aap-containerized-install/master.adoc
+++ b/downstream/titles/aap-containerized-install/master.adoc
@@ -11,3 +11,6 @@ include::attributes/attributes.adoc[]
include::{Boilerplate}[]
include::platform/assembly-aap-containerized-installation.adoc[leveloffset=+1]
+
+[appendix]
+include::platform/assembly-appendix-troubleshoot-containerized-aap.adoc[leveloffset=1]
From 23e393c98948ae0888bbb29758dd89754af14de6 Mon Sep 17 00:00:00 2001
From: Ian Fowler <77341519+ianf77@users.noreply.github.com>
Date: Tue, 2 Jul 2024 11:59:58 +0100
Subject: [PATCH 011/590] 2.5 Create additional settings modules (#1490)
(#1512)
* Create additional settings modules
https://issues.redhat.com/browse/AAP-24538
---
downstream/images/platform_gateway_full.png | Bin 0 -> 92338 bytes
.../images/platform_gateway_settings_page.png | Bin 0 -> 131681 bytes
downstream/images/troubleshooting_options.png | Bin 0 -> 16757 bytes
downstream/images/user_preferences_page.png | Bin 0 -> 32292 bytes
.../platform/proc-custom-logos-images.adoc | 26 +++++
.../proc-settings-platform-gateway.adoc | 97 ++++++++++++++++++
.../proc-settings-troubleshooting.adoc | 19 ++++
.../proc-settings-user-preferences.adoc | 50 +++++++++
8 files changed, 192 insertions(+)
create mode 100644 downstream/images/platform_gateway_full.png
create mode 100644 downstream/images/platform_gateway_settings_page.png
create mode 100644 downstream/images/troubleshooting_options.png
create mode 100644 downstream/images/user_preferences_page.png
create mode 100644 downstream/modules/platform/proc-custom-logos-images.adoc
create mode 100644 downstream/modules/platform/proc-settings-platform-gateway.adoc
create mode 100644 downstream/modules/platform/proc-settings-troubleshooting.adoc
create mode 100644 downstream/modules/platform/proc-settings-user-preferences.adoc
diff --git a/downstream/images/platform_gateway_full.png b/downstream/images/platform_gateway_full.png
new file mode 100644
index 0000000000000000000000000000000000000000..99882b4d694e154e8ebced13c620402d7b171aaa
GIT binary patch
literal 92338
zcmeFZbyU>r+c!D}1_%hEZbwQ{Bm`7uKpF&wk}f4xP=*>17?4H`FeoXdYv@oq1QY{7
z>5c(GI+Yrl_xifG`~AIVt+Uqo=R9XU>pZTt_ZGJd-?;DV`qXtl(NI&MrAAYuP$*g@
zML8`LYM(R;wYTuVKKPT%!5{C#fA%_FQPMd8zdR0@`@`3}9JLg#pmH0TCz1bYA)_jT
zLcIy1*}O>wUmvtryzYoX(S1bz*%i)9cM|^agp>R=CvCesPA)ecZlf#+cDA?q9L*eV
z-zGTX?VRTKR7=8N;zRzDti$b_PL_5Ab{$LG+bA78k^Pb|yE2i$e(Ay`4Eu%4qL(nD
zn2YQ(s_a*^bwUql%%e~{!b);7I`>Rw$OqqswXxOyYKse7(Nap%kdx!Oays$+sh+1P
zS6=X$^QN?$CYeWKsS{_O_$MhU7i-`(pB8eF#=Wbn;~d@RFfP>uilpa2UKeKZyx`(D
z!8VC;k!nY;G{xYWU2uKBe|=PJ`N{g{3wEIcK7W4i(|roH`_C7*{7?t}{NA5sH~XL8
zvpfH{`Ub_Pc2#SiWAA=Gk*gfelPmXxG1qyvmr(cO?2z7{Thizru|%2IJUp1I7;<`Y
z;OTLJIcG9a-(|pcysSxTN8F?HnDC%Sf!IXC1EY9J&l>DbrK$H;2i9(&zw&1d4Pk9z
zl!QmpP$5Kv_RbZrFv(3+G}m}IAy6#
zy+W2=qFrL8+iWPJ!NhIyETzXHzHE8A%g@?jZaS~pS(xk;I^F%otdz5ifdf~1lvl4b
zN&Z=R#e7v?LySmUcR;XJzaw%xDa6XyrW
z4N+KL58Qy;_S$&PF0ZNfjG?HJO~o*?Ac@YvoV!0h=jvwZ<=XV*7qj-HElPT<+6&ta
zytSuYP|@?I95;3fp*oG7;%>R=$1>(T=;^W{W#4O=_Q?95m6%|^*0h^lnU~nAbdFRO
zOYFQZRDXqIFJ}0POz_PQj~_L43w7oiTT?1#@}H6S^i|Y{^H$7P?+oB@EO$RL{KrEr
zt~)c~$L3WUkbjue*AwB(et>P)Po{+Pnn`k{d;huBM@>QpeZH`|&)lSZjo>TTc
zp`U9vSQQbKcI(sA&I^W>ZbX-bx^oqEq38VEMM});UbG+V+E|{pm_By?TJW9IEBE*8
zH<;q9-fU4|>+y;@a;kiAb8XSK(x$htF5raV=T`HMbj=T1du9uoB^KUyO&1wUQE@Wb4W$Iv><9MUciHdBK%3iYl
z2UBoVppy19NX?%ru)ETJt`wO~2Uq(UW^8*#%eQC71CSRWUMVX$3C0(pm&A_sF@LbG|+LXnT
zL9dOTiQJ{e(6<|N6?0+QYIlpQyNW5j?(>ziCCfj8q&PjRV`2pVdB2KBM-qSisI|WQ
zh@7exi_TTeRgD%ZHic*P0W0&mNphpR+@#X&k+tvljI=mq&j$07)ACRE(o1c=o~^j|
zYdB>?&JOmwMRSf}NlIT*Nxav3or&Y8r$=R`J99$kk_{hGANB1r^(L<@NAMX&lvf&8
zI9smdnN+UpZRq3}U>hV`mfO=t-g7-dt4glUjepSZy|+
z=*Ox|wix^NYN)qxdy6vo{o@h!tK>X@21)lZ#^wuztM*>~8Y&&h$nQh5&8bd7`n(9p<
zy9frB-;t^7SiQOMj9jROF{sIFn{8DQC>r?bwf6l1eess4^UTXT
zQp;LhUxM1yrO1`borcBgesnDTym@bj2fTMYh41~maq`4ZSic5&EAYO*ttc%`W##pL
zp$pJyKH%@i>c-Wd{|NUUf99cyOKXZ!C+}dM)JU+b&BMny0^a;lV;_`W+dia5x-C!L
z4ia1#i?-{vwtDz6w_%2!nLTzhdW`QD~=dd->g9QV!90bf$>12AzwUHwyZ=ZG?`}W4xVJai7_rU%Z
zO60da^x`)tP@W4kF?IM`4lL2Q3_KGK#(!z~6!oPK$G^uL^2OR_L=c
zax#MQRV}eXc>4<%&1AaN*E}-4Zu6rysAQ0|O@Fq2PGryD8_*}`+Fxga6qU}b5;t6w
zupME8IN5sEsNfUaU-0_+y7-g!#VXji#g&@LI9SXQ6WHN*L0tY%=Nz||p-Yxr9*=R<
zDxv@D0=rSgBev^FnoM42q%VoO6j^oTd&0Hv+<@*p6v0;oMI^yvZJ}7*BxZvnNW8Vv
zWvZPUe$e{z^aCiSJu6TTA6l1OD(=gIlRW@OM2t3y@i&=swHXhUZO@7
zSgG|>J!`=vmB`0ILMKI?(r5EpHMxFg&sr{yH^pvN4gWdFjce
zle-+=?b^TBx+|Bqi%<;Lm;iVpqpwoLaV&*3OVWFI;_wN0{&tMIOgA||3WdDcT@aqki^Qh
zDgVb@4F`wEIhDe?#!WbGMerM2HL+mu8gN@$B;~T5t$FX2)d%#F_EK9*p%N>}mp9Yt
zesM@*s8iu~gnVTdWBkW9n_XKD>s
zHdQ@-E<(VR5R|;MnXbU<`f<*EWyW&R{7maa@Q*;TMpkRd;LX&K<52}?l{v5&VZYUR
zX^h_!oR)5$33+UhOE3Fc>1`VCf#iJm#=oBwie0m6EJ*W5n$}{BW1~n!>-gqk6Mc#K
z)g#(jr;4=G)P#QJYe{nxL$%JVJ-(*;GA1&NpkVn*&N8$$`LQdh<^|r3Gw;eH>Y?PB
z9@`RfjY6ZA)Y(kf)!Xa59)(ye`!h}r3U_)wM_yB<`q9)S-Kcv;@q)inb<75!
zm)KGyQ43Jb4Vx7_P$N*GouK&?*XC7kmyG~}7y;iRP$&!(jq-Bt~gs&lzPDG2j
zn=5BkBDy_I6g#ygc?xC+?5el!P@=waRBS(U%yU(h+r`;%He{e-aa<>PFGf^u@d1}l
zqG#3m6fcb=_m{*L`QZnrqXgvPvu;!3aL@1q#~T(C%M>wJa2z2_-zWP@>`L_wyqNsa
z16T|H=V)yG78F>a8o6Cz&u5CdOpd*@?0%gXa7Od+I3P7*mx+6hCqEUP6G48wc4uzs
zn!^`x(x{9~UpD@FPXRvXtp{i+dnoO)?Z8q57L?vCjF9*-Qq?
zeWb-LF`mu|n1qj?}{U@(f3001qb703*ogRCE2
zgOgW4Oe=m53IAd|&b@IiR5SDJU};te6;%Mv%75(kD&UyeyLy}Y<0ef<0|@uVV_jzM
z>aDdfx1ju69h89T*zz9@INxG)&I+S%kU6o*nD=(!DY?X^r&WuaJ3MUnNwjK0p^fsJ
zu;;BWi|hsmSb0$ka~1QcjgEH#?(}-+jwv8Cq7C?_IHKU_
z0krAZz19Q2IZo#j`o~=Ikr?aF^9^s0Yzy9|Ec&ZIAU)|6C>vpPHv;(AUiU@t$M_kg
zlr=u4w+tjV#+_&_v(vvm=UX2@!A{Y`w%#QYpai1ewpJLvGGIy
ztT)D^6R0onJP6$PCI_5nW8-ydGxGG(_HXnYox~f0Lyo}bD&5DcEwenx#IDirT
z-tX8%gcj_==JE4>1@yHXmksE2^U7gdH+}QfU9vqrB(wiH@Xw_ecV*=_mN6vDhoOKl(EW
zrTMvSo>Ozm@x)HaN$ebDZ~55WqRHjOdYDb;NoqA?{1uf&FRp~qb7EcA+*A?tF=rgx
zH5Gb9LguSB8s{op=HsGrc{uj$JM>!f+__k%7Xc=}jy$y94vdp=9=FQ=EJ&cRvw!
zQ@5FFXYTiBV{9#Us>yeN9f{LaouN5wzU(qj(dH3oh)k;cyz@*1i@CpfJJR@05Vq?n
z?$`5^!i`nd0Vyrxlw|9q|6SQ{@XD~FrM%vjyY$&2oV7Q*&m!J)rmWI!nYwH5`-zt1
z2LS$4st7=Jec{e~e>jZRQ$futtOZzVy865UF#a(F)-StmN0gc_jy2eNM)DiiU@f<{
zH|Ax4K$f_%c=uVR#ri_`KHKjuSXnYCN$4-Nw>5Y*yZBY0I)&g38>Obm@LQaO7;ys-
z(OO0zQdoMrAeN11CZdPk$Uxnd(8211fi=hihH+RbO+#SGv&@%FPe%5JF3m_=GtdT%Hh;jKsdsbs~;=e&d
zidgSwaqd2Kt;)l-^sL#Q{d8A7>B(@j$HMpwg@|Q91>S@9z%*C+%F89kph%f~u4mSl
zhW`L%;B;2?hS%1*ZBfup|KyfX=+@42x78s(?f4R4<$#K^O{*m*`pX=ria$n6&6lrH
zzSjMV0@HU(9bCU|5qn#r9othl7Ozpy3SFb@_?@P>Sb}IWk8b8QJ6Dpt7ByGELybI_
zhI7Fz%0xlJtH)BPizo$gfbfb
z(suxRzjovr_pLkDAGA)91OMdO4TjWUqo{I&kD_OfnYpzP!mRAn=dCo#Tr4rcZ){O9XzcqvXbSl5plh&M_1?2%M}n9|
zE*V|X%Qh&gAB%4Bbb}3TwphS*;g3-1dLQ-0`AVp#^%dLY(s&WaRKs$o4AsjyN+j%?
z)o^{2$rUJ<_ICcQCWt(P^PT9&pI+lPE(aa0jycj8pjwtY(5ik|IJS;nn}ElJ*4#ig
z0D?c;52DJ=BQyU{9BGsPLmthY`R7@q{+mgn|2MMkQx9NNGOK_6dsoMv?&Yqj{qrU2
zjWqT7KVKXc+bjL&_tGGW-RIP(uBRTt7@4cI?qzvSO97-r5JJWRi+0Z_vU)xY$W=jU=o-%Rg
zcjQ1zAna^WTqymHL4Bon%}PrgrM6d-H-`M!`hlX>V6RhvOqGEg^)1$^RcR=ykW)Qw
z#%*b02spnOA|sZS6Q>^=7PA%HX>b62sH$Rnefk6T&(gGE+YV)52W8z!H439tshgqo
z$#ZQqGS_8(AQwd0A(OI#Tc4`L|VQuCDfh3_4@txvZ;Sh}Wci6KpEYt6JyjU#wmP
z@Yd%Eg2l|gu8fV;f-PNev29O$2N0;vxlmUCCuFMQMmHQ?W=ekq<^r#ugO70n
zctS(57fSk=R=5t2O-tL>vN7nC?BnhqVsoV*ilcK&*+#8R_taSllP#j}%X@y@ZLM2FF@kuD$)
zI_n$VePmeeRp|~@`uuF<7#qU1qA%R^l@Qi^z$w{
zVk{b&-2+!b;OP%U5H~l6R`arZ>p?K+H|vp(bB
zo@Y8Z7kWa-<|XzUZ$bk516;s!7O_rN>j8RAbPg!=eXP7bEjfn56^LA)3s%O;>bpJk
zg|p>d`C2#YY97(pBC;KVsfP>-@izm0b{V_GVpn%I=BtZM!*(yJO0ddD0Jn42$Qv63uipl*UtB7sm*&d5VJq6%ehn
zA`)6IUqj{UY%QyMHrc}2gZeVowzs{ps8a!v^PLAP-CZj7|Fa6&6@0~=`fN+6-0DDe
zp{iweygHQwa$2!TNg#{ZV|Tlroy@FU1R48M(fEFPcHB=z<~4X(K%n*&4+5BF&ZYH5
z1o2J~QzVQ+^#-dvZ7b%I)x>5ohJ%T+e&2yZ6%hdy(?G9PH}pmrtthu%_RAcQy6~lU
zXgv9C-G9E{4@&$`Sg_sY{{mB?1E7+bP47SS*Wp|xmH0P+!;70h`a29i5jHsozBBt(
zPBoZZABwI^DIj<$r_CZ@eWswvrgA`gTvN!lm&s|ix1)2zQ3#fpA)zBPoX;C}Z?RFi
zlVwHD^@7ix(_+omYm2YKf1JE{>meT)RQ(a7q3V)vi0fOR_(=WhBcbx=rB3Y1cbe2v
zc`#y!UQ1x01-zm*I}{%W(63|m?P4S1r8x8IW`>Ck`*Yaz!Q+~dOv4C#0S)?=Wd^I~
zlIF=*?C7oU+M*Irt(@6L6@tzrw`&f7>2ikxW)jr4%V`H&j{Ic2Sw@1$|=H)xm3{FzuC@QoZlj
zQ($5Ep=`|ai@%l(cR;u=lhtMY@=OHa6=z(O5N_AVd%TUtT6Om`X}ZsqrIC5%_0-mI
z?w(`mOP%h|j`8JhRIc=Xof8c0b1b~~>sAHZg&RIB(ba1S@)-Z5LOs|TL~uh&Kq0U+
z2CMVf%ss#sWN>aG%i|-%e`xzCF4j!M-~$;OqLbV!=RO@bwb}SnGlR9)g!U`yc>r-0
zy1oMHvF*dphIW;=kK7**pX$i!n>a*;0^jLKF8Nzi69Y?2h$&NW$a79V%EBsb6HJ8!c|UEBND@RKBA}l%YIk>dxlsF9N(4A+{%D
z(tjWfyD+s5Y6LunB8J^8V$OvJ%MFWdCL5)8JfdHUg|O+qvFhMCDG_`$>Vk1HU09V;
zvgRiKAwsJ;sg9HG)Z2kLnL?_F5+!E318MqD)W~^g2i9v1slmY^&}(PQrGkRF{}yNP
z77QXG?sDG~<(5p(O;^HtGr@cok}1bEaiLCwb(a*tr1|{{hkn?KGF-1)4s6{X3!Qbo
zn+uNrJSk}tE)6JmFL>oUJt^dIFq(hNRc#Qg#e?=yi3db!pwE&lfEb2g3xiGwa`s0_
zRyqUG>xb?29dTo=zvqFs7k$y}u|#LO|7PmD=VR=e2{M!MQ5efxyY`WyTm7G>&%|&v
z44sPd8x5AFdn1AyYl@#o3)xKUqhrQrloSTxjAQI;4mz`jlKY$*ghNh{yrTf$Q;A~MN?Ii>=V++*4&3_@aCMw(EpI{)^usKn
z$u;1m|?rNNPPY3h~
z+LJ=xSnS{JDh?Xo!;H?*LRfh=dq88f+#Ytg_FtB-Q(!?yB>horeENA9Q-lSDsrQl|
zxP)X3x_zQsSgBrHOH_;F}(%VhJYA`g*pgJ>GR&%;=4TDrvK?Z
zw2>iJ*Aa&3P&vz5%>HMR=l*wN}xs)xH-0Z~P(Hs`u3fm=5YduTkjdfSZx;zcdb
z>Zz}h0wp3!Nc)fT-gfn6`{$c|#6KPQ55WHXe^CAZBP#P=&zIdkOFxe;5}xBF&`9=y
zNndV%5P7OTwgOFi*b&N$P~QMF)&VRaXFyiOv>1n{8$UnLe~`#0Kp=nsplpb7;X^fK
zL%>j<2fyvJy=v!qqta&8n9D5^3tu>#+stzIpxAjM&R-wquikXfPg7$7Kb^Z`zB4B}
zTFTq2RH4(RzqDlwvIp={U&FYyje7ELlYiUBJ;Q*xoIyMqcUO9IrvXg?P~xZ3BWp~9
zTxPz2`W|*P)*ht0GV8p`PVjW=j9o{==i0T^iHOQ*-IDa^Bskfn7Gtd5n|CX&ZG&Q2
zgZ)B}-hz6VY0qsv))+etU~;JWTcF0N
zF16)U$~m3>J3}Jf2)P}(T|tPt2{5D_k{cDf_UtPKulI{5Bw=zPUy)0k?i`AH)uzbE
z%O4$Q}w)1W6+KyW8#$P!RpQLRCmZSQ`Rk2&Vn4={4=y|5Pi_WK2!=SP^bE)0X-l<8_ESyYA9+p)N2}T8ExENggj36@rCoKe6Sc!4na^w
zp%n2Bj4EEW-jLXsDaeH!#SnVj#C7zj%eRZQ-Nmuay>%?^GjB4ICFlSUcO@&(yL*7;
zQi^DlsqgMh=akrN0A9aQIoK|J8gYkak(5x+0;F*6e6_k7f;hDc0@a(hB$S!}1?X2e
z+v-CNE7{rJ=v$PZEN_>+3r(*0e58q62CqS3`f~p>t*Kp=cXqb7a>g?QC!1yIiQpq1
zpxDpBf-JG6-p7r7$gd@TJQMLQDyv&P@D=<|iF8hqh$WMJaip+Kt$_6b^_h%c((zJO
zkUbz)%oa!Y6G(D2+ow(c4e{w&c^krur~BJ8b-&`K&Hdb1tKhlMJw8dW
z2eS3%MwhBEd4y0gE93%dX|Jeln`G~Cl#d*Ak>U+l#^ert)7dDj^|4&?)lq+~Es!`*
z8~x}9I5tWLUb}v-kqGaRjsw{Y=|?!PzP<$S%Bw*1F{{g5e@|TUEYH_0os3(flOp3W
zp$3iC?N*TC(E8d8m~XIt5jI+1MEGMB+Qt_qWO+wZ^E3}VvUL0qAmMyU=QR8XV#a9E
z9C0(!$l*zNPi7>SPeNhBluc5;5%DQFj{HQY=XvAlYNx5WCM$__Y3lKWKBqtl5;L#K
z+fvT~E|NuSRg2C`^s8hdV%?7}O$kl5ShOu}ZQc?sM#!UN1$tpQ)~X^;YJI&fIY@Hq
zcS1_C5&9s8eA<5wF#u{S-(El!mH_*0~jCwp@`pik+Dlev72C7R-KKx9enC7nS#_EqC+vt@#0-X!$-O3OwgOUyWmdxUrGo5UkUo@~uSp~lJ
zMpRNd>dpQkV-3-U5;EMEJ5I<3=@vgl*X!B=WNBub4e&w=dTvnx5s()zKQxfO*FsPI&n7Q12Dw59YmcbP1j7(
zCLp%PO>q)rFa@&T8*<}_c_GC-4>~U7wvp!Z`Hb7
zuFL&cuIgL}J{o!lJN~Tdh$ma!1T)X;1ojTWCULWP)upl}mg!CU6PG@Y{iSI<12?TM
zSabT}J$mJ`I$Y2G@+3OQOdQWW=nJ)|w^QDZ`}qB#&cbr%Su_)`-g(6`
z`=Zeh4u#%rL5s%1+X%k#1WK_Q5>
zSgmSxn8w}HI}S1Q`UFOY$q~u?l}lQE!fsWW`gyF#b7rN?_H`Af8C~eh$D8I%Lk}(G
z^i0MDP=mKnX>Td$nF`6wz1+vg-^0ffrVE2ss32Q_6xV*u6Eka~(n~^jhd3LJTt#7w=i_p_x7rXufDwSz7xD1zEx<-4_Zko`(+;=Iw%QlaRQ_@-h<9X
zxIGWHk!>|d2p2u>7_^kDIM-Wr(5?XQwzn)0Y`pwoil4{N^E!avaeM2--ypTwF#Q!C
zh>bDiRc)@v--c#O!=smtpN@B*6EPG3-?xakEj|z0hat;@^M=LWR>2aO>omo8qkqy=`9$lWI#$%-N?;#4Tuf_y(!6}#%%nIVnGJTSFe7fQb&(!aH
zY_OQC&~CZVu+04_TG#KPZ7+Il-m6$+U{MxhN8d~|2~*|`c3`lT7}Daulw)D&*4}47
zRP!i;Ak);wH+rSljs2+`eu@}o!ZVuGuEoQZ^B8BuCI4vteMSq9viob;yS;MLQ={jm
zdM4fPW(p5Oz$e>pn7?9X7?Nq$8|HW7Jy+iRXnW&k5V*39xB#;Syq=HK+ONBLlO`Ag
zxLPbUg7lYdmfAn43ol=87Yb0*Z0hVE>CjvEf1A|8Gu4qf5IeU~KUgLadWso-VZMr%K{{TkwUM=G?9enFPcmlxN;0-EyJatWGEp;msv)n1
zNjV^6{UHbgyXw;CUi2-j0q?q-rI(Y>q+?PD9ZE*W^rzDy<@ix;r>W8~oHECmFfSDj
z6>-v*7K=jdxI)^9(~{qrPTTx?Z@Pf)Iy#d0B6rOaTKN>oacpgoQB@x;;f)?mUQA**
zyX~R@%G<^^qjn795exNRseU$LaURqSvV|Vo@xvcUUn
z_aWtH3GFmd0vTOXD3w}&3A(V^9XjcvW8vA&Cx)~p)9>NR(m
z>ax@QEGKGe`}CV~mb=14Wn6Q^IaR_$rJFja3i)qs#r!pZsG9*NlwA{;o4|i5+83Oy
zK~3u^Ij9l(yqNn!@?*MrM7d!yp+>JQ?XzlcmM?O+rZ6e)4enj8X|-49&rp*+!1N}V
zcaBd1Dt4QbAjNCs+L4%k{k<(i>S-DR>_JC06lH69dpJ`nJ=9n9V)`kAQU7}LaL=jl
z2@Bh#NE7AWFEQ6#f&o*ecCt8Wo0X4+A0E6v3}}RC+gtbs^$nDtevk+4hzA>VL&D2d
z^uCUpFKt_mbcvs>TXlQXD(RZ}Aw6**Z9<194Px8_yE&rrI7Eg0rkK`^s8L)wsiHTz
zxL!R68YXv~2F);@7~8KVQ*i3
zF_n5=8l`h%syoR;Ky5U<^DYnS1q0PJjNKCl3Ep?fW)tlh+NDJ6s3jd*?s6Yp0)8~P
zvl6ZB)RM#8F-6QI)(hvvd9~mU4L;LetHBP-tyPEqs@zT7jAGVXOG}neaa1YG>)3N~
zojh5gm8Y-X_sw{l<_+mZJ-k}}+objIDhtor_4DYEq>w{BiSNR9AGU}k
zMgaHzt_S&$Y}SeDJadd|sh9QCwWP&d5qXTlvv||bZIo=$Y}_8+8%a-UiB(L8zAAfS
zB*23xbgwLF%oF`!{^u2I)l)gfX>Cseuh|PiMPYweeMz=a|8KnBJp(JU$Wx2I>Ot5u
z-RKHgzaNX-dBzo;4ifXPKhQ-`Tw%l
z$|VD|l`p6;&<@Dmd)WQvYqfdhQ=Vt24`ROp#KRaJ=@#j5r)QHCHwx{?b{Uz)
z7XbZ{si*R26_HL7DJE_g@$)+Re1Rat`Ta#ZUc}AvC!LnjE4xta9Ei-ga4*u>`5=h!
z48S0GiL7*Xpuh@Q_}8m;(3U$*GPY;wH`N=cFA`U~n){FB6Ud_O+4&l`hfn!2zqsRd
zsFHxVDiW2T&$iZom=Hhms>ApU?`T1wzGJAdQ;YnH$kG5$s4ji*QvERWb;DTMjYw{7
zPJB;3sUhRkgMGC5;}d_~hG4QY0VyX2jXOsg9aFb9Jy`4T(UNInwRo8Lu>Z|#Wcc}&y1=2VG>P}#fXwnpT`_oqpW|R1cFSYClD$3YYCnHf#Rj)jqSY@$r&GpP#
z7UJ&-l`ki7K4+TuX4&=?7d=yIc%K;4H`#NHLpm(fz%hr}@!Q2Y;K6+Mv|vly1m$Z>
z+C5`nZ-^Ey5oy8<`g4X1Mu0tdheJYgV@6Pn9yX{_CB$oH?Eg+WEbRMFcRJz-H#S0!->X6;P)f}WX{1)csU`AsD?Bx^oYoK_Qn>s8rIpgCPqf
zC+@C511v}4_eRQt02+soU=#mn|Hmgs5P{{xS>$q2!G>#Sl;)3jkcmFZf0hF5rxa#0
zE*SOR`tX=`4v4)ofc`^WBSG=r+dZ?zeFS9a3S<;S!0dw3;GX>hk=&6SoUKT;T+?kY
z7Fp-22S}7185TlxXJjIa@Xlu!0m2oDCUdt~mqH|KnW8UfE9{0|~Zdda$}$?7PpN8F#Uvhe!IMbk*dbd}`9w<0a>S
zx~NtX!H@#1-vrLEyJ5H|GGlU5(&Jufm>5`Oj$kR%Mz*FosEn!;_)Ok*ZvpliV*LFO
zKo5`H4RX&w{=OMGm5B3ia6#q)6FVeeQ{@QA*9E-;4gDRl*iFFQu@^u|
z-%P2VU$4mPL-OX(D8>-k8BBtgsYbm}mW+We)%^XUUrU(L1s}p=p5ok{<_9EOuSI_is|GS@J&Wg33o=-SIJ1OrFE0`R>(7B1O-FH>ON}Ntzyf(or3_i1
zAI?3uk57-fuk=_{RC#VZb{C<51J*kc3==D5KwMgmg0&5P)MulZ6WyCJMV$?R6=(Z~z+9$T(>We1(cMwNtN<=pfAq6u`
zef=9`4DSN-Gc3i5kiIuNF1bMuDjj7E(z5>!BPT=zPb}s!oEU`uP}<~Rz!Kg0zAEVDq4?vZLBG}n
z?xX%(g-|*~wNPAC
z*GHIU+N+N~f6(`x=p}r6YCU@Zvn!~AS_&MXfwk9{4OF`K`MY<^qw#2*nWV1H2a3Ub(wD%A8_Z4a3N-E~cdHX?^
zPWV|zLHTo1+COc>i?$BWfo)L+17v;0Ym4I*$b98)M&+QCXmmlx>l_h&xu&*t{Ja`g
zZ-VFzvXy%k51!h@A1xAAJPD7XP)C{i5*JsZr@Vv`gzx7d=4k#kZnuCknMsw11!KB`
zyEKHg!7}m2v$2HciM`l%1f|6~)N^NWi+W^ojvn=f$wM-{aGPXSMCR+$hZVcu+Pr1M
zvSK$s62!Ar3G$_}lGfCa<T@vU0m-TAv_|H&H@BkRg+?3=Q`R9VA3e!%$$iDfkRM{B
zBoWPAmr8xm;%AKTDNlAwB$>5aTUCXaGX-njphX=P;AsQnDBdZTj-;m};*1Ekc_});*RbtP5oKI$lS(GVaN162G>0PKV>g5ET6Je~jVi09O`h!o+xxqc`psrL=
zU1sXWx1|PH4^~woazjmyNU|oaq)%eZcdNhj)$FnBS;8bVf1v0T7tQH*$ooNP;_HB+
zGfehHkIT|hG^Z|RYBB=4w=cc3I6;pMs^bBrYbIWNa5<#~+~=Rl<30%b=-lLHdNFFM@U1sAF6^iYxYrCnuGl
zoZ}7r$VZT5@c|NUs`tOY
z8RT{CLVXO{J;k%1(UQ@TsvWB(_uiFCrCmh&KD{PcW_gc<=`@r^wv%U1&<VYH#ZoIjN+JA)Q`s;`%E|GZ>klaxjdgRwPrQzSvRQ
z<4r!9%LG3!h9byxY>gGAbd`m~fO3@(etp(J5xry{S7OHkn@r;I@UaT0^{r2t@_DFQR
z)3#@VQh*}0Z;HZudMX(?jz>&~wALA@!ZD(_ak)w>a7P^a6!J`AB+kiHd%EKQ70RED
zs#KTmjF$b6X989B(CZ5{1E&5(;;puJAd)onTefGpQ>=Xx%`Jr4Kw&K
zY>#&zv1-;=ze=iC4)UdUtJ=LU4yT4Me2D%om^6O&hy-ihgd?wRD9!>eNw<8aV}h1S
z(19cQ$3mEa^83S77cdU;9J*n*lmmo%5}Q&PPDOFZ1&EjH2N{x9esX7Fn*7n(OxKhP
zL4iLxniz6r0Z>I+qZA`)&1A`=At32{kcsvNXL1Xday;DnaZ;&Pupx&qqoqy??vPa@
z@8|{n6KOa6*lwmjW(j`)@~9svMXOwylve+|zHF&p*H(Ki<-6xns%thT9;62Evvj1T?rX<^B-CTyQ_8hVfQ23z7N@c%L~$8&P|MNsD(jPo
zuQc;C0+^m?t@E;k#{Xp$utuFP=bnhOEPRX;#}N9vBe3^ZA^l|=NE%*KS+K=zvq`}Z)RL4*o}3G$CGG)fl3)UAV>ZY!dkY=^m}Fj*(ZUGpNK
zS2ID;Qg-tT9oC*(qX=wS!f#BiFC9L~ArH_>
z>0x@xXMN^ux!g_)$siidN_K*AFbuQE2HUiyrZqp-&xdSk7VYje2Rwoz$K%Sm9!)ayxM!
z?QGT>7Iw~}I@ilYCoQj50`@ttap=OsXSl;$#0XAq3SwwPb5%kVe<*4xZV)!eqnzQ)HLB8@eV>%5lPwTns~L+|I7v5xa*iS`vLOEk%e3f7fj
zjx~%uPUQyY3y|9DI*vZqQ13wov|ROb7Xb41{8Drqyw4faC9<$&Ji$EeILQnlcwhA?
zVwNU4j`Lwh%965b(qhV1hsp{du;PKzINXPcO)k|Zb{bmfHy{l6yx9;@#z;MrOs=w1
zWzAb$0mr4+OF5Ec3#D5rgHLy5Vg+Jk-CxvHujaCs(&wIwg2W)A;s;#TDNB9Q3PZOx
z$;|S}yjach-3(LN2?=t;=2KC7jc>=8$Z{9xe4ZAuh`Ea^RWO*+NpK3{QP(Zb$kus9
zQtDo2O$t05Wjzg1Pe(*BXi8l&;xYY=)T9Tv?ROnkJ@3{mv%d^ROs-M$3`U#YXHa#^
zSrf-xEOWDUqdpH9lSAYHBBZmfRC(|+cYwmgOts0Q8;Uis}H)idd
z$E?I#6pxZZwA8goGp&+kiR|~smNX8_9(iZ|@Cgq07E&t_>&l1*{hrNp|2nfMYb^cX
z#<|M*8=s$_a9(UzOle`Qugn#>+HRk+h=9(A?l#4cb-ji%2T1H3w^T)Kl>VLvZKKsJ
zSDW!e7tL$iwx+4JJR!~}niuu93Sf1u0a4TCEz@~J;M?Co@zdX_TK1A=m(0s
z#&^uoXXI!AQ?oduj!k>{nl#g!^N>R}=`g0(Qb;d>U(N#U_^Q7nhGWtgf
ziE8($fG4wP-Pnclnfdz@0~pwUUmyJI|D^zb>}i>&Kkw!qs&c>fH=WNd%hzA!vPhRg
zpJ#DF)+qJh%y(ltpt!_htPjk9UMF3iW)(*
z4P-Jd%b+Ne_j-N`nGL8f0nTJWl8HkmR9zr2%v^?i0c-BvIdEJZ5JKk3|L=$VJbF;;
zVUQ!7*m863DR1uUS|p2+rJ4K~0x*O95ShhK^XR01H*ufEc4c1|H01Y(S*%$QVTKw-
z#+hlpe*qQG7-URifXZZGXf`Z=KANi(iLn54)rU#A66aY1Vdt4^E|72cGmJ5Oed9ie
z8l@Xx+xCMGIt~fuqXcf|13rJgTcdR3I(0T2U2^@WEO%bgd-@FRw7`?%_g+&;Gd^Gg
zZNl+fjJb7NZX*+4NC~JZ`J%e2f$uEavdedoyT
zrM?Q3oN|!$`db~>%2XIF7gi8ih;<(FKPw_mNCw&n)+i#~*!01nGZvHu}p^aW=~nIYi({5;zQ>
zcb_V^)On<(%xxTj^MbyMdVefW^nN>Iw#8*9bqb>uP2s9BE#<3hBsJyCpZkZH@8i}oD>6PVM$Ejhhc6z~?N%emN<4=PF227VQ_UeOJI!semw9
zrF81_pH6whJ;Y+yVJa@nn>FBRbD~ZYH#mebXju*nQ}AC+h5#k{SM3OYAa^MEi3=NKRr0Nk3_#MUSbz
z&Sh63Ocr7DW$)8@vIaP}+{LYFvbR>cQ-1y#w?uWruw09g?w2=j%xcRKmOaJ?k6Eqs
zw@-__R2v#s(Sz$NRv>31#eJm|;wR33I}z}Ii&=0!Bdst`Jci6J!C@6cR$aNX$ovv$
zZIkxAf0jk}vA=e`P@y??{`HeC!$SNJQg_C*ZI_OgA7p3V~;l@>J`TF1+P|$Khn`*e&Bkka{;$@YAF=x
za#(|H5$fW<8;V;bKllU@$*Oe8Hc*bZr`inl#Kee}c3vV;I;n$^g1i1xhYqdvk4w^?K-a
z5#7UuP*Z;&ou)NV4&4#y_$75BisBSVistc}R=utG_4(unY@gnpafvs9QAb2_q_kWB
zFJCXX6HozjPT5rn&ilhX&&7M>yF&!9M#AA-Mc2{}vEnm?mdN03emFahWPqLFl(*eI
zuL={ssv1us2Z=!iDjMtu^M@f<)f9P99(GTv=VMrpFCRxe`UH>5b>>a2(W^_h&$lA(
zf}gdp_Q(d5tAmj-hGh<<oKcqeCXDzX^#%z~w+W%%bt1=%biouM1*W}9p=TOAcs$1jk!BEq
zH_Biv#?So@e}O|L`!x{2y!9v<*WM&`$T;1M8)R&%luVYimI>)`RnJZylT(`tYG*;Q
zZy+e@cLSzl5xusR2-_Mwqbf&`;E6DANKL6Pn=xtIiJV1e(ododww1pS
zbvE+&_30SbJ!FL7{eCuPg3^CH8|L57Mk#K;G;*#N10Iy|W}bk%TSEhYw@*
z9fHoUSuH?zuR1B_oLvDmeHJ<24;d&dT$j_copx|AoF-S4U^jKL^!SWIy^AT1@kf5&
zar@X$u%Sy;1S;DBof)qPFLoN*71157$Auhc*|+o6dVQu|b^NLgUmEc&)jy#G}@m>nrVD
zh)wBiyC6wgYSmC$*647LgZWTo9IwQz!+Oe7YV)UTpD8V>cLyTs#kWab%?p2WxbE99
zxgOnnk~JAw+$IuNJbsPO28zwSUPeX&
z{FogSr!=%ZgU}8ciIJfG7O*m*B}Tx_ZhFjU{RI!ZK1VCdW`Y?i=
zC4gLe8FDZI61ZroLiscdcx~8HKxHy~_3GsnO>Z%53>3V*|UZ0rxuItS&V5!M4cBR*O)-exEJ;
zzMEZT9IJI~L_Oe&&zsa2+(p=W~9}^ZkCkU(4`#
zOlXr^O}IkUh>7RHFfzt8r>!Slea|@>PjtU`MAP&gi5x{>NNr>I7K*hw
z4AVb9xNTl76KtYp-B<}t%7G0iT+x%e64#x9YMbg=!mU*i>rh)BMtHq6puo
zo~n8733G|s#&Z7UQdri`9=anS#4}IRo%dpdG#4*erueLiP*t^D@|)MC>Y8-9Q<_xY
zJICjZJ0`W()jk8Byy>c7%6*+Sj5%hp>I1FBw>Uqh-*$OX-u_!K*-y32#8Tje`!jBi
z9uxXn`&uGc4<5ePVcRV*iOOyIWLIPB^W<~jr#X1JGp9`F>zte%8J?R^cy7`)Hjwsi
zV`6e&skJBTJJ`IgR>Z>;*XW$}yZyo<;7f6xeM#seT)Xp*zfCgD7>V-&w0&g+?_feW
zErM{8Exb}|28v!JPn#*}9`t}odZ`~!Xz_OBYnfYB8ArgU#(ppzkth5=8GjZoBQuR5
z#VnHpeY@e+n5fCFZ1WSjZx6G55<0HN%*1riK51TyijBH+HoqB{>Ya(_OspLh
zl_21?0NqAjA%0AWnHS{FROg7MiJHX(>PPbP8;cViz57YYWgv77uPH6f`IOQis@%S!Gd_gjqDV40uA5}^jb_Y3$
zxxD7&*7PlbiwfD+q~Xt#<+vSFRyO%GB_^R$O}Y6oQ6Ff#pp{JTd5+WUUM6$Rymz}e
zmA(R7ZSi$uCS$)WFr_iO^2Vs}BKt3)Ipcj@kE-^Ot;hbd_8QKRkW0?(J=UcPh?1K|
zSl#N;Jhw|>e}w#T{1bED#r4L#+QzLpT=@R%)cZ}RJ@-aVTNr)MO8h{+*cRHPKcba4
zP6;)>UXv}og}A_US8eb}5%0OavE(M>Bvs;yl}qz95}-@jwZD{Y7C2ABusZ~G*y6n@
z3(&S34Ajbs%T&a+O}x;gD5QFA!webBWzR{9+u$zK6@Go*)|X=HV{gl43HPui@&}04s(3;aS1C*PN)m}kdD>-n)d;r7l9Z2Nrhh;iGX#1)B
zR%zn=PC2cW*LD#>%tvnwVmI0ci!xb%m5PxHcW(gIDiw?b>OqNjKSq(N3=Sm^V(v>q
zXQ^2T`qV*j(o5!)_}ZAq%Cxo2-_KdFLKl?*=$(GfE}!3U{jgsaNbLi4l_RlF2NeX_
zd%O|}zCFe!{iQLFm1xoibMaWE!O@r|ok(oRZY_QN9O$ZdWn=`H#mB@Lm7(-{0Av{%i-CmU
z7eGu|I^XXt2i?;HL|Nd;#;G8OqV2DP_U%K?Ip6)}koIF1O2^I$kzz
z=cB_Y^ocWb<1Loy>R{Hw?50kB(ob!qpcSK|-W+>MI7LzZKgsGZK*PU-S0i*6R%qLQ
zp{qN^x_xoApC`3X<6z5qU{Q*
zIS8+%z*z4o@zjPNC<1H;#VWocB)%(pR98J!i8KUBHq{Ml(ia4!-E!g
zFG$qq$C@92wICxRe2z6NNP{((PaX{SgB&{_-`(+kx>|EeG@jc4Pm738n`L0ASO73+
zJDlSF?a;4%MmxVm1@KDn8zK4fo-?_1d0v~m@p7Q#aczl}4n##s5$)t^Zf)2J2QbkpEohQ4m|=p8TiRGrA+~H|
zdrgMeXH$ApcvGtG4R^cr6Fdjzt*x6UL5HnD<`S2@xY@C$=}-KnA$*QUqd(AcWX0r{
zQcM=t@Z4_~)-(q%r>E05(y%i7C!=YTdmAHrvl=^2863=6L&K7K3Qa^LOrjWOR4#f=G>
zE^8~!Ye%_Rrfn9jI1fB`{i1U8YPx%#xsGz;z=PxBb`zvOpJaE?k7EiVpo!@(Y(c)B
zrIVNVNS#jzBCEsQ!gqj*AO_FlDJnBJFF_a*H?^$c%;9oXWWwHI>JyW6?TM;
zZn4n4<^tMmFUO(El02jMQ=E?|QQ@?8isVkAZN|yjjd7>teU>h+59Zf3Q~x51bhzQC
z4%2$b$sUAO^gG7XPb&VyK&Aw>?7I|AoPnwG
z!k&8**Z!b6QsB1rtMqfsw{Q=t19fj`usuD#OT_N0A8DJz^b8v;Xrn>!2*1Ex
z7x>%ZdW)P@Da3>h>%I;$KHFt@B}se;x8nM;y4z%h_#KEI9|4Q%UAVgm?0$}`-M
z8vH@Q7C*)OzDdV&k@oc*M#Gad9g`!I$2-9#tVstW=!EY+*dz_g*`kvfZIQ_no8{wt
z`i2%dNA)N3ad^!Y{hhT>o(-^jI8)|3jn?iDoR+A{x)}3BLPJ8hYat`FWm?|N-7?uo
zMm}Zo{bY%+MvA(X&*Mf7B$&L&h9;^}gm~I7sqEmb
zdh8ai0b^vmm=0YZwT+gB6E
zq*)U|ctbv*vOpmh;#zg-pE0g_HM?ULu*H_%r;IV!R()dusomA#x?zV2vp{vR31cO=
zc)TiEv>sc?)~r*d-wDRQB0j;%-;@7G-B}nf#$~)jwN2$0Gv2TrBjO`2^ze39>G>OE
zcm!0!Vg2l;vgdtrgPQ|V`?y{sv3+J@wk_A;Q!B8>G1?}0-{tt6M@
z#WJM|9uAwxyy(ifZnCb*e1ge}%tNyAKOs8l*P7dV)FUltMLNdT!t)u(v_77-?`*g3
z%n`OJv1oDTRz74$D@*lm@vw?%v>4Z57BwXf+x{qW8?FfrKP~=GgKvwJ&4EyIa0}qF
z9PjS4+y|Zt_Xm(XWqt9sDRaF;Vvogvghu6M8u-kpY4pXsx5mG<=BtqyT8`~IYXIUd
z{y}{%B6;4}!;k8AlC%9ilU{6I)OODP)cK3fyE}F_y2AoGS|O7X;zkfn>9B2k{Grtu
zZ$qk0;5Ma{eP=}=2?hXv+!1QjNz-q&phjNWdFhbn4K>CpCM@HHZgRmMJ$kiK!S0lN
zWmWN>7pegV*`(7|^gH+5L-weIpOh0Mm_y)G)hTHt5LbE~$YBa1ERT&B)&NcEW8i11
zTUyh@aAQVS3C?7Sd+O)6h)t2iq|MA>tQxk}kRU3r*q>>^Q4>d~pw_FfFF9Po)aML`
zIehrp9h|PQRf=K4cPxoIWJtB`6?|eXXL(6J~9njgSOi!$dmet
zI`WtxIq|gnNambLy>!PESt94{ZmEyIcCY*uO>9fyk-9KhRxsM$P@I0E=I;3t)SPOI
zmoqX93R^DPe@kyVBXxXgu3&>FCrv>%9b@x|FgAJ3kitV;()Q2Jh$b2V#XA?-9OdP9
zkK87y1!rY7!G+jN42
zkg&}~iFo3qgK$UYv`!VJNZT{I;q5Ziq623sFEW;3jX9T}a+Ex%(PsQveJ&fr-jTct
zM@SnbF}ZE=+oG95Mq4sleA3|byWIa}u|yp&nCIA1IIP84lc^I(*!Op58hJjQhl`rK
zjp3^#5@iX9V_wB4+ZB}C1!gyPm4f9&}4=1|F4u*y&
zghZ-IHrCGW;iGx&ZKmq5J2J3JcV7l3*e0&*rcH^ASzdX1J^VTAj?j%w9Qev0?|+W9
zubpn=SB5G6KQ94+|C|#3cSnvu5Xwp4L}9SW+v&R!YW29vT
zMG<@j_{!LTUto9#mlT2})%P_kr2XF9)x-#b=83g9GACVsgt450Ne8?tr
zOZo=n(bKnq>m8&kvy7I$}P&p$W7K=4(K
zG#b=_Nl`PJE+5H%p9Ed&EAaQZ44=+nV$*Om#@&BoB^v-~Z4|)art0~~ZaodAQAnhR
z9MjwZalTpJcjJG{jR%XS3(HWl!zU|)^B_kR7@(h402l7+<_0^oZ^)jXzMWWxc_!^#
zRQVPltV8+lxjln%gDM)h;Xi=*e!;e)dFQ~zMYx4ZZYv5~VTjJ}0wZ#-qu^A8*rRJ;
zYdi#>c@CICtg~YlunsI?C~XPSRx}d6;?o1_zwXrs1X*Y?K7dbuD>K*mc9^Crz^E4h
zsXmxk384AFU=GZkNxj^NMOpz=!jBpkKcN5*l>1`Uia@6U9uN;5&4-8PR`lGKNCaU6
zx;dB!RWiQAP*nq(M(15*!Wk{()&ab|Ihfa9X@<|RW(-=q?p0M}*aj2FDVMr+uPJ59
zfh=Sw^&M;g-l4ndQ~*AC(Pp>F;7yNwZa;y5(IH7_7O+)G?lV1SUx0l+5*P$O*?M-T
z7Q{b%QfIgP2GZzBgz!wEh!s_1KOLd5ceu(uq?XFBkA-tzrAwNoC#UFSc%u3H9`WjS
z`gDI6vac{Fy#WUCBSzEWwo`Ey*VcaB)0Kc}2{N${Y@*2^-Q(x|QJ_OB`
zy$~caePeG?1afW3-kUJdHz~jUr3|Lj708AYjYVJ}Jk%=>?QiU`3Qhz3KNfmFrWKpg
zT+kk$zY~^coo#-BjBFH8PSwG~bofP8NZYkk0dWvz)IEG=HH4BDZWzto
zo^mF@RNR!CPluwot{^KdZw1EwH%3vrc=+wA}63(eZGtx
z(wKZ{9Hi}3(4Kf*wim=C<^%bF(FdBt07>yt-iF~7e&rFkYnx6ei8Ai5q|C`%R8{e4
zu(}K!3bSo*p)ik@ZPS1r$+;o;{(iunWJQe)5ruwm7D1RO&?NTgZ>aU$kPri?4A$kI
zj>r>j4P0-Bfcx*rmI|x694KF=XWn)-WINo!ys-ll=UIShN&{gD%$vik{u59^*u)wKNtI?5!UsXAlBtJ30NRD_G)+N|FjP3&=5&
z1j{@tlQp{-7(=h*74{qhgEY0*8a;NAWE=&Hr?l@k2x~BGqS&>o5VtU2HWuGKlW{eJ
zRx{~imZeEdMtoV=FmD4M2Cf>m0qpc&IGw%zMx&384O7SM`E&psaqc%#g8Sus!qg_?
zI9_Q!y2(aL3Aov+@@I%D3n1Jnwu7{F1Z!3rn;%Tnyq&9#)iW4Eyg
zc;m6=Yft6AXe~OCA@rl9ATS+4)1@SFj0!8fm9v58&JMeaHcz#_qpX~%4R8iEWw-{w
zRBvl)(Pc_ujF&m@SzPT1xTWD6-#xaTVM#6(%)?(>SGF$)Bb}F^;9_8keTDTG*bj`^
z{aK#|o1*fph?5vjCgyX-s)77m3x|l*pQ>$L!7La9mau89n2(pztdbK(dHdNj#>K6w
z&+GC0P#e&!Xz1bH26Rj{n`cehLrm8g`NYXweV?vqa@~3e*(o~Z(s{sU>K`{T+f9l#
zw0t%G8^8Vqw!c!=!|Aw#ObKeI_IQxH)CuD_`_f|h3{cnmw`Y<}cb7sd
zRGHZvL@rf%<&o0oi7aEw_u<
z4RtnTHdRq1ISBsTK|%`YZx56D5a1!2^hhI1fd1y`+3QYna5x+lTJu|19{UY)NKrkK
ztfB{`(tHvYB{kyookKk-#JwF=i8d2PRLX~n>YW^EYWlCj3X#%u*%JP2C?}iar65XQMF3L}uG~Pu10>pjm
zh^D)jZyR#z5P$02rc8O-glSDLen#kVlMS(r%1drdTMhia6{UYMD*NiVlqe&n^3r*o
z87`P17WK9JICcl~IPyHVX0^i@-T_q%uTf)9pqc#`s=Nj=j0hmss^4LyIAS
z=ObYwF9fMdQ$CwKI?gNf!Pxspx4Ft|btvK-LY0spMF3K?WAD^5S+46dXO?dk<-+8^P(
zzR{e%Xodz$V}rN?jGj(bVrp&K1Qa|XY;pXmCa;5s&F!l_svUj<12?}2yJX8RT#&X>
zBe{i)#BInzs}E+9RrWDK%iz4zKk;|IWz|6SQQGg+@V#c)+FESoKPY^xpYFi9oL8IL
zhx2PNNW6Sd3FK73{b~P}olHA|EYEv{)wo5w%O#u#Bpp-RpHq`F
zv~}fsI6QI*`#OAbSTYEY!nqmloo_0re6V%Dj^ZRL9yKr%W|q8)K$$%E$@PKfJ)CKt
zQpkNyS|-KKlvg2UUdMTFx}%@7$&gACk7NQ)P!VUlzeITAh}2`Xq~qP+(wBQ2CyuC%
z)yZBWzb0jWI0(UGrOPJSyTh3NgRJ#RK9RKG3x2*%m;H7y>UXETDtiWE2F;2*#cz(t
z&AUPKuGBTC!SAF3pw3VvTxR1R5WoH3G|}S)|8xG|`ccQ#f1NkkF(NPG3!k)>3-s~RaHPw{^{4?zf4Ss1^&-j_vi=&yi-w|pwUO3dQPUmc$3ma}az~Z5F)MKJs$BKzahJkhoQVhe=TS+!$TeuvEP=>3lZC7U
z;lcR-@HphC`cG0(K6GKTMa^P+;v)N?3>rr!kIB%3yS6N4Kq#pTs>NhoT=+IL7HFO?
z{$4%I;M7s!Zi`I(f^@x6MCH=CT9~bUNk|l)wmCD#!f?g>JrG;B@<7-6g6Hm&(*|A;
zv*Nl>elZgD1D1{9+?FsveJ%f2b`;+u<*PESufC$r8$P!?RG)4rpGfN9G;qz9E=?8d
ztuZisRj&Ecc7Am4rky(U-y>n*m_2lNZN^Ixn8CNd$Jl9>f97`
zZp?9|;!K7gAdOUZ^_#}mo00`q=j6yYwBV)yHAHRCK`dt;t1DK)CxFe=`T>0DAV=xuiSwuR5?HwqLuXZx(Z>}w?(KqXhX29|TNM+fL3@LsClw0Zxb5m1qqzW*{a}b+fnE5WhL#fnJ9!G}@x*#G
z@ddNX!c?&R$M5W1!PKZXq5w1>#iYImEVA!tn2>yMnaOMY2??MsgNw3Y@jy+w+_MkD
zP+xVsPfr~J{&CS5B7O}2dB+>E7hHIfzAQf>R$jzujKAz-M2W7=fd3WGjROU6FX9z0
zB7-+r$?IOe)F80qw66!m!P(zWd?0_}_+9@R7hqpKFw&Pf1;~fGE7%zCgqG#SoW7^h
z`i)aHBX(b>bTsJirjwtjb(b+T5SuvG{c!OyJxc+|Aa6F~9FaLhLYVjW$ajbs+>Y2}
z(u_n!q01#!HbXF-c8a(R!M{G?AClzydMD?6HD*{ji1i#L$JA_kS)#1G6Nd=;C!4sT
z1BtcW5($V|JCl(=Mv%Ild{u$a^(ITe^;W-4oaq}?<_V!IJ*nbU0rLK(N0nASAnE{G
zq3?ch<@+GSDpXwMF?nsR8km0d0ORHU;E}Knt_c+49r(V-oh=_U9A)y!=WbfL!gIa@
zh5P-0C(gV+@9jN=&RChW8I9hbxPOU#9#t~nzIQtj(IyS6@BB;!erP>#o)1}oV!G4-
zVs~b|J01sZm34Ueqmgpmkfa{4BPjzh&4dh45#zkvCJ!vN2Y~#1R3OyG9$L|PYBdMu
z3C~A!F4xr>hZfDl!!Y&Ad~OW|czSm-)(F{AFH(P|LuiqgzWNlK2$m6+_vK>u)CI`t
zJvf*g1=g?THd?qSE)aOs1PQ6GZfr`kv;2z1LFx~Zn8DoKkPS?TzstN0<5edYP{;5)k;8cj<
zJdKOMR3w{nRD$0suHVri?DGaP19Utg*4d#@aCHN
zH2GY_7XTIRs6Fl1Mi8A@02|KCwWE5z
zLmy~S{qmB(4h@Pv*F*j@;{u#`z`}t>Wc$A^sI8kInJ|3rYZN2)-K;;QlC+D|9;W@Fg+JsK}wCqE?8Q?@A$d&3yDXfn3&AS
znqx>JEYGXXd<1v^#f>4p>MD=&=7v(o9}68A`0k_4r{k6AP;U5!pKyT6L!#cZ&kQZN
zL;k5+|Im)4$|mTH0w`WdJrh<3Z=&bw!lKE;2JAH<>C7z2H_vP1DNiPrBd1pg;z{NP
z%xW8Vx~H&g{Fc99;+p=r2cnZ+OHG1a0p}3GWiajv@EZQ?DqzmeNt-0fR|WomHt^wU
z;&=S|IcrFLRhGWtmudD(8*Qq)#Or#U(58}j22)ryDV8B@u4B7!%Mo!TO09fHV>xp#^eF#+p2^OD*``l8EM{T1rZ&|GwN^u4OD<3R
zlT}Mrx+ue~v7?i0B9YU@`|Q3w+E~gu{X*i^ALrhQYO)=JTKA4ri9bNaEg2_YJP#O&
zlX<$G+#^2W2Y)##1~-wpPrjHxe~!-euPx2}o?Ub&!o-1rEoU)mfxvDM*3QIY%LgiB
z_FS&=hezGHGbiSL-wc4@v#?_p`^E~g7nI7!$2<vab%FtXIoMrZxq($&*S?R=s}Qy&;#_iX2gG*r>~71^0I+f*v|b_xbRdZA`6o*8nwgtB52)qZd#H
znV&{ohni`grUvP@e$nIA!}ng@0RK6!FfLNv3>JKms@fdZl=M#t^QPOVNXQcw3*9CG
z3@)sE3tY7CKukM07>kipC%ARqjl{^Q5yozL(PT`Op&Wf@;C+|@qdWq|_A+cM6;OjU
z_EJ78OlCg$1jpwz%A(wKxkLdhUbpVRsGtf7l7Iy}sBR~roEpC48A=i0l$XR%`31Z5
zh+B-U)Yy(#-Wdi*CHyVJ*IH0+J7M30gKJerxNOr>*Q2uJoIMxW7Lg5K-m+Nv=dF$p
zk4QT`Me;%vDVO)TO>6Odk5zr?AxppPa(7eZSi^|`DG}l
z%t4za*#uTx_kq_&NorxIR&zne@%(z2mxiIGfUwOEWOX}k6n2s@0zP0pTXkr^(<-0Q
zPSSpNz(i+HAX)55asweEmY$GIlmDt1VV7>y(+2veYbnY_^Xt~e_|^c0QNYe`24u^)
zf4^iY&WnbnLu(8cH&9?jfTa8!6r#7GP1;qK$tLd~Qe+nKL6Bz7z$Dkh-Yw<|^=Y7^
z^v+acgO5;{i$sc>Iv@KXu{xM|(W`kE=AJn{0qWcj@~aaW_?_)V*1h^)PUVbSXRja6
z@CpuX8qMu?k4{5vrX#GV15#GxATy|i^6qz(-Ml=doZ4{$jct4oVx*ZUHqbMw#2!c^
zrt&a4*adgqm2mr}mBTf0vJh;<@JcyXuYu`Rsa_3>#};v#I(2+9-E1xRU*4Q!KKFyI
z4CeBdd!DPW3^RjS@bgg|1E2i+@C8H!+QGs`Lqhth`6l5RE4GJrs$oL5G>+_UigQ=WB7}*MP)3IP?&S#E3(T+nz}F@!v{4QJXDcjEblrj^dUqcXFiG%ibKTo
z9QTU}lJ8N_65hm+TP3WE(=Tnu2DCHczHei99HdvnYP0!(Mp5*gBXW|$Hd%x<;isvA
zj5Rl5OMWG4ZoMSyunS`w1qcA_V!&T5?8CGxwHXcR)E|(V&)JzxV|HlAaG%VOxHOj&
z$eJ_=nk-Y^2b|KZPMs6%VQ!cqohjpj&Rs_t%?}#qUh0^ouNuhHW2CxsuBtI(kmA(Ue4^*_yajjPrT!!g&-GHgg!xO|)qNhewp*QBwX4{kEy{jh>^pKyckL
zSN7O`-D_ZHaSCun^i(srI-d+ms4Om9n2L1&Jb5-4_9^uuiSwstcCHR4e`JXw&Yu^i
zCt3>ts5NNO^yW%3mglfXYHo7R)y_|sOehut7-
zD2`7akSy+H$5&$y`3s*b>veRSg_-Ud&u5typ9ZIVkLlY{mOI=emy71F3+*f&Hh=Pn
zgp+kTHrB8hV`4P5NZ`<(J5M(gWJ^ONYw4RI!~WNw*2&%C*(aKf<8%6260^snc_;OK
z8&=Hi0YEC-1&Pt!3vs_Jv@7nF{q7C%5G%PUsaeeL*e9#EA;{sk?|pI#c2fJVk>Gg`
zhZImu!c#ZCj(0ImIy59)SEXQrN9$$&-fCOU?vCG?cK_rv>=)m31iiF?BVX)pcxKjn
zfom8#>)eZ&3aUhzZk(7hbbi>=6EQJ+mb&}2DuT;Ec9!>|F@X;^mc-9xP%%;JoZgp*
z&r7Ju9zUHN-s%`-I;4&p?~rZDj!Mq$4v;+706o4FeOHgE?_DR%U6(O26M5Y+r^OeU
zCOdLi+1iTouAdj(bSt1^B1UnpP+Z_>JB+*f2{}EbT;HBJTyn{_RpSL
z7UWfq01|QY&M
zT-0|zX)m^icxu(0GVcr;3-CHD>Qp!mJ8B8he|7K^C|zM?#uE>`-;n-$qt&sdiOawy
zn#N6FCLXoI4+uv8(|n#PJ!K~|z!GKZr(J|?(++go$xtZD)}biKc;sLv>x496415Ch
zTGqpUp9Q7el=49Nt?N?(!ki8{D^}fmNYM6_vcM!rBSQp@u#b`sCcWOmID(v2?6EPb
zR+GhF!vW;79$La{WS;(ya!`eV54nmC!Roy7+Maj}>EOQ{{&t!a-X3Y?cPu@v5QQ7C
z9tAFoWRqt8qP|W@2gozKSK1BlI7Nh+L;ro;v2>Y1%c{qH^Fi6VC31Vh`8*f^_O21S>ir{g(3CKf2A&E+uixMOn3j$|2ZA4
z5uerpg;pYP%mX7Bz)CgUcV+%dMq(P!tzJUA4>O&2`JcLv%}X*w4?f<@z#wp8K7BfS
z^SclJ_1)O@{~4RphE9m!7)56MVkdYJtq7gKaiuUg6Gv7%N5EMT+#<{wzJW=QM~P#f
z*G-t|mEZUqST~iB@P?Fzk`_;D0i3D=^qDm5(3?An@;~~(N(sn9)vg73D9R0aT+V_w
z!JfWML|Y+wTMi+6&)fBk?B$#Gb7P@aYw$Zu8v!7U-?Yd8B+I$K3Q)06z-6!>KS>2Y
zgjtxV?Td@9LX;BOrG`P!1ai*Ke1abI3nJhk6OA%}6U&hbD+vIvS@;2_<&P%`(-=f&
zN;+oz@LMo%xYlZIrTw$qOV3}$(oLVNz+mx;+$x)F?
zM%X+ZO#iRnZW7E!&XSb?la0^;n%bmR^@`$Hmgh!BP>X=_GB@2bo=Mtcfz!gkdIQoG
zT#+QA^gdK^eMnz8i-;nyD>5$!@3b5Q)54%H*jb964Umk!bbf!?2=$@Ei~s;VPZ7(0
zQ#cCjm{%u8wjKxPkQAxP9A(tRG55J-(cuyEf&e3yKI>cnXYu=|mS7}b4v%;R+^tIZ
z`v>4+IDWCRN8y9BFco(LIYq@9u*qJR*e3yug1Qoeni{A`W&us|1T&{Vm=ai)o6Jf&
zbiV_3#)qvc7^c0Hvp0an{w1O1Mr-0E#E=~nJ9QgzFQA&s97Z;*p!ZF@F@)GDYv5SX
zH;V+(fHIbR4itKT!s3xR!}M>yshOw=C?`suwMKBJRs*w5rp0G<5Dfk}XP@^2N^y1W
z85yiZzVO1x2m&Z-R+6<6_bfH}GMOq4-$w&VxSjJd68
zHZ_6Stvmk150$75$%qusJIKVs2b!VRHL$^4rPuvgZyR9p5G6pw&!w6)P@K#{<+TUy
zMF}riwbB17@Xb&>k@WrVa5|K&K}682)*1Mu9AGP35R`BxN6g)tEG_S_dJ{DM-Fr1_xtZ`1orMML=n{pEQOU%i%kPdUlX
zeJgFby&^P!5NJyxTA4b3Z{_3E?#j26TMOOE?Gaf8K(|P0+5&k;#^PRxG7Ee|JxLkY
zfc;4fF19%sgS?iPhUBXh##ia`FjLZM194XF!o8-O^l!L|&Q#@XeGtECE)H=3w%JR@
zqk$TJ4#((t+{y;PvLElJyIsssStQU>(~5MGxKTfWP+(#IEzqx!!lP&c}IOv;3cwd
zyOxq0>9$5lunW`?AUc+*z_h!(M~V_OP;&@>vd2btNJ6a|xrdTzZX}mz#2XZfN#jGD|J4u)=?PC_O?}td
z%K+WRTB^+DJX7={y~R=u8PA~k8HBpfKtk&@c%dd`M6;lvu|xm3Y!J*cbQ3Ve(U<(U
zGNh(9gO4f`hHV28uaS|DGwXc<>o+#3{L|lG;$Htj^79DeFJwS=kz=Qm3@`P9fMJHW
zpv2KfQQSKAB%DR^eIA6icd+cn2NJA)u6V<~`yW<=-OJcZsInqD*4NCzv#Mz40g5WHtRj
z*bwKTm;o%M0Mzu9w_y#EL?D8=Vj2}%h?I^rhhHNo!OCWjWrPqcrvTzlVA)y~`h=Yc
z!v^V;>=CfZ8aNxs!tK!aCK+oOcI51SY*EKZ)W-;_@m?3)+d~)Y1>8@c@^4PH`{-tdX*2e$T1AqVm>vs!{Bl!hx@V$*NkgMX|Aj8IWWps&
zA{fVVUc*%wwi$V_8mt{zgG15628wJ?Iz%8{dBTCTY&PR5O`T)kfDls==lAw$I
zESr#tz$)3mETH&v(AEstDI+0VkbI@d}1m^St)gG3474h>ZdJS@m2?6*WAR
zDJz&?!UU*vCW{sH6{(x#6giyaV?3{&@lGQ@U2fB!TYuGfn`~haAeU-0s1cc@2#%dI
zXoA?XeN^b3F~jL$-0t^}VK$g)pV>FDkN&XT5UVJHdu<|>i&G93U_8pw`kf+
zu4xt3JcNl8!n{2%Fbigsi&)+O&aGy#yFIoED
zOos)2r4b%tuc1_JO8o=ilV2KqnBTar=gACfb|P|7;N2G^b-{aS%ON}DqP26)$qMPA
zM>sJjp;UTqnImi%9mN}Qp>u%8cTG)V)q=BybKRnnvaVWx920c#a=~MrYJL;>i-*!i
z04M9cn}N&Fxt@HUzz9u)$jG+iLczdBz40s*$IBG+!05G+Jljhq3BF<6728Jy3Gi`!
z#glU_BQc(q_c`d{>N8HgWSt|7Sm5qV^?$jkL-d5BcyNkxJJ{}s@4@hhoP+
zA?6asVVB|PL)oL`a~Yh1zu!fv=~$+rIJTc@Q#Yjs9J?RT7}KW=EXRd@?XMA3RrTUu
zX`S@Um30?bkJ-veE2l6#m^%{B(-U-1?h=2eG^5Eu#kfu%d#koYY`ca#8C8Y@rttWP
z%u6w(7awA}07gvJu}oeUV74axPy#fWoDYALH6-tTFF=YG`YXZ0JSNWQi8m!cKI;3c
zcAp!pdw+Ca`sx!wJ0H!RBE$;rtOo=zoW0Zz{*WzPW4tL~r$6@135JN}UhXtzx*^6v
zVC;MZ{$95u-%mf{VZIz({XspxXSpY|mDy_wwqoB4;RwkZZFaa1;4|~8q@NuQPWJqH
z67AfXtFIoqLZZVn!PI;SqeGGW*!Y5u$aLQUAz<-UsE;Md?zdwlW$)P0!*Otmfzz29
zW3FQfoD`;l3G3lxto+n~)pEL{M@v=IQQC1z)TxdYg(97qolUs3n88Y(rG;1x^@1dI
z4nDx2ZD+V9J3gfoYOKd!8a;bpC7gjXBiw9BiPg$b@!)|6ck^ncMJJf3Qlc-g{esdb
zVr(>2zdGrF)D3~c)Mtdd4tx&@Cj|;foHE_bM%{m_1cY1TKIgRG1#lLiSWcCg)mI~n
z15E7#bENtEH&8V9;qDH;X{wVi%n!Z%5edwo3)+^4J}z0^cv%;2$FEwunbmt9j(N-c
z39=I?(5RXC%aJc=D~qf?{b^4mUhi?1jHzUUl>F)}ViY)Dz&A{N7R#&9b2pU`AiGEjUAE66
zhMNxd98Sw+uH5MJr0~nM3AN;;$p(IJZI`N+RijxgT)h#aFklqRX!*CWU6cqpO`5eu
zGhON7ckT{)xkAwW{pl<*I?kjRODgZAnR$jHqA3*Qb%-R~UIbl2QERBqZBbc8hhv8F
zlkk|7E$y>;5WM3d>v4=+kZd?D!D{A|!)rr7-5I$3;4=-#e4C!JSof8v^J(StuGCkl
zJo`B4*dMrG(qI=k>-Z3=Q*7Rx!1p}d@1c%QJja9ZsLOduEMPv
zvieCr#-ZKiF~k$kspst#jmha-GGWqTUU>Rv)^f1U-h06c?p6lD`xt_El5D!)u`mkb
zvdDXl_FLI=OPO_cy$b^lNB^5Df;IJGZ$k=`i-6Ks%Eev$3MWI3qYNKO8V1m*fYq)dFfio2r#y<}iN&}4QECL8Pg%yYCRdE%2)
zmSHB+ink{{!906-|6s_I6d!7{z{~Ul1(kREq{`Z+k5kzvjdiD!IXo2DO3bERm%&)`;<`l_07J|<6jQmIU;
z|Ae$~_%0VB|F@4;7Vb6$KQOI^{z$T;G6WaO+Qfyn4~78nX5
z&Dj4nJVQ9{{&`)qt=e}FIEN^?UF=jDf$o4Zq+A7ULD}#fMn?Mq82RUQ?@y;c4}(1j
zHNl{0=oM+Yzx-Cl8nkGyN!80>SXGGvbK&$mXYry0q%QpmD6bcpouVS}6BtslyR>ln
zg#%KALV*Jv=SN;W+B1aWW}q6mb`DIi{`HF(zLJ$97$_zM$woTCibuQ`I@D)Q>i!4oLxca2Q-6-@@TP0U
zrFz7j9O@hji+T9)WvBd~^;)@Yam_=uBF)p|3l|nX$()6N%?~x>pO$@wN1l0Zewfsx
zy*&)p0CXGy_4$
zN(1Efocj}jH`Q|LGEs@Y4Qaci#$)CS{MU0tNp
z!_SLn->}kaY=1{Bs`TG@=1lW~5o^xxX(%bt~^`Q9z>^-braR
zIx|jlsUF}nE9kmv-C&*;2dtPE)8M)`2GBw7LXpUnwdLmJuwz%1Vpyr)ch?Z*X%D#m
z0TixRV;TNgMK!>CV}R1!^!^%hx(UR9m$yC2jpJe06?v{!Gg5F%7U}0Cz~VF(l6Nuy
z(vmI7?Yen);o0}j0QU}c_MS7J#r;=wIe?kcyyK{oAtZ9ofA73o1;bU^(hc88#q~)8
zsdALT)dWPfVT;iziT$e*%_2sSUQ_7?KHf191@j{J`CHC0XmdnR$tVNAt%>>ECqulc
z4bjZav4-9&3~1hMZ^D?Rb`k&I&x4J=if0*0%t}9^m;a;uVaSU0LgUXfMKxX
zT=;f|-O6tMfgCsN6q-$1;Ny+$^Z%u4dg~2aGmuM6@6JC-i23@=+jwjA4<_Wo
zFk%c~Mxl|l;bjMV@)qrn(G0wUwLN(Ao*6ANP{I}@`+iaPP9*=}tvP4*MRRLn^>@hf
zUE_3cD*qBV28p^k_3iNFT1od?KUw{_o$pqs_GuzUgM;+@D|;QeYaLR;+G03t6Q2(o
z%smw?`&2aBSnZYBsB4{+yJzzb&!n4gi-dO^Y4N#C0M>8wrR!nFbK*tsPL_210U);^
z?8oF-q~SN{Nb?pBa(RduNRbbl*`>+4dN-LdhXbrr72Cu4ROxt)1T4VP0;dIl6bGu8
zJrP+!)SqZ|q<>!rAqn_n`JvJScJxxPLF}~>_1;))eJ8r*9po+HT4kql2d?vxp6_S`
zyx@{*T(w5s{eMiJf8|e=GJJzYmp^Lj!F6*KeDd<-PhzcvI^Dkjd+Kh*=lgq_V3Wh&
zUCcPvGYAprcpnVk-pSk!JIOib#F%EC&(Vh0GNUx83rJqtld_HXy4xpM6E;v~I=4=i
zRgc7E(2kV)!b1QTATFSBVWZ23caS45Srk3xQ%897%n5~=nmX3MpTO)ocN%~vPp8O5
zX^taZ7yr@|74GeTd;D5fU#BUmpWyB;o+wPO#55wE;RW%Td~j+=b-+Jw3bi|wi0ft%dOqD|B$-zrKd*2i+|G#{PSwG%>L{4Fm(7H+JnX}|5-I*K8tv+vUv3-
z3@Q6HJn;h-IX4*&3g;H8a5wlwYx7e`PY=de=SGCX#i--7wsr~)J=95Dgp>(#i}YY_
z;4uynKiH%w&7FUb!WbfFG~B7UL!;z3t}%I^DB6!_0-}=-bA-xoquwsDvfb_4IeNStY+8<%#wlSE1MK;^5TPpZoE^`dz$3tKP*19<=q*vQ#BG^?}6}cu4}{W
zF!#?0?Ff%w_O|_-KXfnOWAOOI=9dhwnYMs36khFK+mCO4p)`2l-sTq!&YBGW)DXqo
z|380dvST8{+dp`5cBl%jd&XktafErqUk&7_b$bTJmdz2cF}S_uu$Ani
zIRag6W1y1zrgwfU=svT#Al8oVjZQ@g$nPSiY%FGv!J-uciNCgcUhT$8n|~}i(PfOA
zfXZN%G6zSsOX~_%@y|-zSX|w28+Y2&d_q#0GjNE+q0+MS2Dmf9kvI<|0QSZoWW
zz}%1C(+q@k+}ysVyG=`ITWz7-)qOAz!Cl>ntDV5;Foz>?BnEBjHl_VHgi-cmKMV|-
zkVGC1J+r}O_+FJvb^%ac^IS&%tdIO50%^iGRpB)(p~|~FD|@S=*U`2bivVO9+mFO$
z1=#lE5V1&RJg3MY7PNM&!!HU>D*iP@xHvwkydvhY;WGZ$2q59lj4qeJ3D!Mc2^GpS
z_u6hk3m}Dc@b4f2E4ILQ+^kNO`=)z~l!+;@JkVC#YvK6W=9n*x!&)fH%K(`5F89>U
zU4-MY84>IfS1VzxUDG_WR-N*jN4)&=efqKug%m3UoI*`+P>Ccs`cA?J7lK{$SkpmW
z5zHU4yz2R;F_=Hz6yx??shZEZyiRp_y>*X>Vd*eo3R$9`i(8U9pP~)vJ21)ghzEvQ
zGw`z86W2Vw3syG1RmJ)hf>UB|-3fGI+{45@>C4YOn~P!tEN@;ZJ6n`;Bk|VTqWT?2
zCC5Ex&`#Cw(WN&vGUKZcQ=@D0$%|7rv9%`1s=*Y*_01O+J{WxmzAk4LHxwtTi#5os
z!fq$w-eQ!-ON)S{K~!SEy?W*b!6-zyg;f@-7@1|?y)XXlZ!P95Q%ac$Ml
z;1z(=2Wh_S+)e*A^OgR#yZC}#b19%!E|DIngMnU)%w-zb>@8T;k-Iy`0Ui_kfmXVVd~K!u=&ufe?Du
zul+5G2ZQ~460dgo)zP-C?k)Rx?eA5>ZdutXP{TCCJ+m5FfC=lzL^&rE$L_pqMrY~v
zAI_mQTi4n>dqj&3ofBuLp{x+=vvAilg`;R~?H3dyFKY3&mh1YV5GQci>9Px)WTwu?
z|GW{ui$P59?`9+1yYI*bYDdl4aW;YMVZaS$cikg#zlSq1cT0Nk!l-6)Z>gOhss-V<
zLqx3a$RRT>$Z4ZXm!oJM&TAJT+=?#u6He-y50YIMOU~B1AD1Dgyw^K7gnJ9dWSpGe
zYCKOZbbU-YBmSjTapPx%8_jpu)b5%av0xq2m(HJiXb=F1rU@-BlDeBNT+Ee#L@%R73
z-Ft^MnYI0*K@^7()WK096hT0YbfgGMQIswyNUsW!j!Fnf2XSze4xuSc2?EjtK?Et5
zkrJeZCZeE22_Yg%mFl@ynD5%M<&ecr_=KNJUT
z)!C^TKLMogmLC943B$edi^d8!NFUsV&AeP&^o4`4AEY6-Zvq<}0}T$*-@ID>)x@u#
z<6gFssY|lMcvtQwCz0@Cn)7oQ8%Azv)Z4QJN~Sp2g5
z#y3w^-CXPdY%NtnUtpiSQmQb?=Bv&bi{!IkpoPUl!NQ@9#PhJxYp>E99ebx;Pw=H>
ziGI)ixt729tTp+44OiW$8gG|#nu9RsvTMs(M`!(0MK_JHh&fxG2%l529aM+sZ{^y0gYRjrhWsHn_!9)c?*1^U+#{?=X5-yg
zy`fiaFb_Q04$Zjz4z`9Jv(-)|RsC*;$?v;@AtdZ3^(q}ZT1^fd|X0!f}Jw^-X2Z-9o)l$Rb|zu6(z23XI##y
zCvD}VOD4>in!kJp!>2J+tZMAa+V{B7;`%pe5Lj7Sf&<5;jTr|%y{a@m#yLfe-NS;{#f4;wcY%Af|!A8Va4>+keARUFF_
zpticTiQRtod6t0i@+t`<5q{wn39$9*8b!GAFTQDGsJk4aWwqvpU+A;v%**Q(=9LEg
zLUz`s6+L^N*hH8AkUwuoD_Yuq2t%jn2*+Hwf@|){WOG(0ikjaSd)%^@YODL&4(qjD
z#5_}MO=l)f{@~77d6h#2dbwUj#qCfMOwlM9@Mhgl_f;jShSE32591=S>WeYOpP0%L
zyr1eQ#Q8Kc@0t>4OOm0AtLF=&vcgib(6P2TzGZ$_9@5Bd569+(Ju(lMPV1G9AAbsw
z#r*;qFPTWZ|M{^8-ZUdtHE$&Y2S;3FHN*@JCd`0^Un+#Aee?WBBL@f
z^X8re8KIG89oFlmKa560^)iTfpz_!CG=sOq&cD^k4bgU$FnX8v>By?Q&?xd#*jTxx
zB?<^g;tEM}Cdk|1c8&=8=@hV>)z!@Fv)=$wO21TKIkA8F=!^)fdG*4>vCY)n)-)mu4dEfpT#-H;a$NCa>mpk_XuXyj
zzWL7jA^M!BtbnHnw|Iug7px?oS`3hp_r?BPT_$zu*9CzehCXOt@
z90rExZ+ZEruurMiQxkEL5j|XCDS<*LbUO{uoK7n)8nz`8L0=#R4n2Y==KUZ1z)NTY4T3S8gGC
z`)|u@6(#G5S7k>NDx30ehc9R9jD|Fcpse<(ABvLjJiZXkCSbpqcpaX}wXZM?IOb#!
z2_w+6*rN&Oggd4)7PdHMtG!AqAfPu@B@HKUI
zNwBdeVs=#ys#PE6VbN@$>j@)`#Pu``c{Gg=r<`)GyiZuZZhWUWVx+UI3BI19*PC
zf51)hfNtYF7^wEe`s7v8cCYx@Tkw`yE0qfMnluG#=us=U~;ntcEejAmoD#?$5J)cY-$9k5D6UWeLIQ8X`k?;~(seCOhjl97t$9@A|G&aHK?QiPY7mlCb+wUh#_P
zP#V#SZQ|(do4h#IUJpH~tNjeFv?(NO8Lwwh+$ci@Vn=zM&T*w(3-c{p{d_U1H#aeGa=cIzQw?a^9M~7sdgE!H?)WDGSx;Cyc$%?^$
zrG{D~s>^@&EaJWW6-|WOta_>sYxg4eb3r
zk>qQQxf{V^jWIJTVInVDxmnq%v&s*J>IkeWIg_z7r%JB_eAMQCHF@STBPBd*l_(la
z{(NFa?6X5iYVAs