From 0fc59a831c4a27d4a9d1f67e9a62ffe0128ceaca Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 6 Jun 2016 16:16:11 +0100 Subject: [PATCH 1/7] Initial awsvpc docs --- site/installing-weave.md | 2 + site/using-weave/awsvpc.md | 91 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 93 insertions(+) create mode 100644 site/using-weave/awsvpc.md diff --git a/site/installing-weave.md b/site/installing-weave.md index 7626f29f..f47c69e4 100644 --- a/site/installing-weave.md +++ b/site/installing-weave.md @@ -32,6 +32,8 @@ With Weave Net downloaded onto your VMs or hosts, you are ready to launch a Weav CoreOS users see [here](/guides/networking-docker-containers-with-weave-on-coreos/) for an example of installing Weave using cloud-config. +Amazon AWS users may want to use AWSVPC? + Amazon ECS users see [here](https://github.com/weaveworks/integrations/blob/master/aws/ecs/README.md) for the latest Weave AMIs and [here](http://weave.works/guides/service-discovery-with-weave-aws-ecs.html) to get started with Weave Net on ECS. diff --git a/site/using-weave/awsvpc.md b/site/using-weave/awsvpc.md new file mode 100644 index 00000000..efcfa3aa --- /dev/null +++ b/site/using-weave/awsvpc.md @@ -0,0 +1,91 @@ +--- +title: Using IP Routing on an Amazon Web Services Virtual Private Cloud +menu_order: 110 +--- + +If you are running your container infrastructure entirely within +Amazon Web Services (AWS) EC2 (Elastic Compute Cloud), then you can +choose AWS-VPC mode to connect your containers without any overlay, so +they can operate very close to the full speed of the underlying +network. + +In this mode, Weave Net still manages IP addresses and connects +containers to the network, but instead of wrapping up each packet and +sending it to its destination, Weave Net instructs the AWS network +router which ranges of container IP addresses live on which instance. + +###Configuring your EC2 instances to use Weave AWS-VPC mode + +First, your AWS instances need to be given access to change the route +table. Give them an IAM Role which has this access; if you have an +existing role then extend it or create a new one with a policy +allowing the necessary actions: + +``` +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:CreateRoute", + "ec2:DeleteRoute", + "ec2:ReplaceRoute", + "ec2:DescribeRouteTables", + "ec2:DescribeInstances" + ], + "Resource": [ + "*" + ] + } + ] +} +``` + +Your Security Group must allow network traffic between instances: you +must open TCP port 6783 which Weave Net uses to manage the network, +and you must allow any ports which your own containers use. Remember: +there is no network overlay in this mode so IP packets with container +addresses will flow over the AWS network unmodified. + +Also, you must disable the "Source/Destination check" on each machine, +because Weave will be operating with IP addresses outside of the range +allocated by Amazon. + +###Using AWS-VPC mode + +Launch Weave Net, adding the `--awsvpc` flag: + + $ weave launch --awsvpc [other hosts] + +You still need to supply the names or IP addresses of other hosts in +your cluster. + +###Limitations + +- AWS-VPC mode does not inter-operate with other Weave Net modes; it + is all or nothing. In this mode, all hosts in a cluster must be AWS + instances. We hope to ease this limitation in future. +- The AWS network does not support multicast. +- The number of hosts in a cluster is limited by the maximum size of + your AWS route table. This is are limited to 50 entries though you + can request an increase to 100. +- All your containers must be on the same network, with no subnet + isolation. We hope to ease this limitation in future. + +###Packet size (MTU) + +The Maximum Transmission Unit, or MTU, is the technical term for the +limit on how big a single packet can be on the network. Weave Net +defaults to 1410 bytes which works across almost all networks, but you +can set a larger size for better performance. + +The AWS network supports packets of 9000 bytes, so in AWS-VPC mode you +can run: + + $ WEAVE_MTU=9000 weave launch --awsvpc host2 host3 + +**See Also** + + * [Using Weave Net](/site/using-weave.md) + * [Performance measurements](/blog/weave-docker-networking-performance-aws-vpc/) From 6a410a77498a40db516ebee34e2e6ee5d8a7313e Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Tue, 7 Jun 2016 13:01:42 +0100 Subject: [PATCH 2/7] Minor improvements --- site/installing-weave.md | 2 +- site/using-weave/awsvpc.md | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/site/installing-weave.md b/site/installing-weave.md index f47c69e4..1e50d908 100644 --- a/site/installing-weave.md +++ b/site/installing-weave.md @@ -32,7 +32,7 @@ With Weave Net downloaded onto your VMs or hosts, you are ready to launch a Weav CoreOS users see [here](/guides/networking-docker-containers-with-weave-on-coreos/) for an example of installing Weave using cloud-config. -Amazon AWS users may want to use AWSVPC? +Amazon EC2 users may want to use [AWS-VPC mode](/site/using-weave/awsvpc.md) Amazon ECS users see [here](https://github.com/weaveworks/integrations/blob/master/aws/ecs/README.md) for the latest Weave AMIs and [here](http://weave.works/guides/service-discovery-with-weave-aws-ecs.html) to get started with Weave Net on ECS. diff --git a/site/using-weave/awsvpc.md b/site/using-weave/awsvpc.md index efcfa3aa..206ee081 100644 --- a/site/using-weave/awsvpc.md +++ b/site/using-weave/awsvpc.md @@ -4,7 +4,7 @@ menu_order: 110 --- If you are running your container infrastructure entirely within -Amazon Web Services (AWS) EC2 (Elastic Compute Cloud), then you can +Amazon Web Services (AWS) Elastic Compute Cloud (EC2), then you can choose AWS-VPC mode to connect your containers without any overlay, so they can operate very close to the full speed of the underlying network. @@ -68,8 +68,8 @@ your cluster. instances. We hope to ease this limitation in future. - The AWS network does not support multicast. - The number of hosts in a cluster is limited by the maximum size of - your AWS route table. This is are limited to 50 entries though you - can request an increase to 100. + your AWS route table. This is limited to 50 entries though you + can request an increase to 100 by contacting Amazon. - All your containers must be on the same network, with no subnet isolation. We hope to ease this limitation in future. @@ -89,3 +89,5 @@ can run: * [Using Weave Net](/site/using-weave.md) * [Performance measurements](/blog/weave-docker-networking-performance-aws-vpc/) + +(that last blog post doesn't exist yet) From c41ca708f3aaa11f6e8d5050f4679d61d2e84b4a Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Tue, 7 Jun 2016 13:58:22 +0100 Subject: [PATCH 3/7] Add AWS-VPC diagram --- site/using-weave/awsvpc.md | 2 ++ site/using-weave/weave-net-awsvpc-1007x438.png | Bin 0 -> 27554 bytes 2 files changed, 2 insertions(+) create mode 100644 site/using-weave/weave-net-awsvpc-1007x438.png diff --git a/site/using-weave/awsvpc.md b/site/using-weave/awsvpc.md index 206ee081..92a727ff 100644 --- a/site/using-weave/awsvpc.md +++ b/site/using-weave/awsvpc.md @@ -14,6 +14,8 @@ containers to the network, but instead of wrapping up each packet and sending it to its destination, Weave Net instructs the AWS network router which ranges of container IP addresses live on which instance. +![Weave Net AWS-VPC Mode](weave-net-awsvpc-1007x438.png) + ###Configuring your EC2 instances to use Weave AWS-VPC mode First, your AWS instances need to be given access to change the route diff --git a/site/using-weave/weave-net-awsvpc-1007x438.png b/site/using-weave/weave-net-awsvpc-1007x438.png new file mode 100644 index 0000000000000000000000000000000000000000..1051f288396b6a0e3a903095f02f9fd9b120bd8a GIT binary patch literal 27554 zcmb@ubySp5+c%0LDoQ9=bVw*jw+M)+bf=QiH6Rkh3}quqDBU65(lvlVNDSQrgVZ27 zz%UHW*#kb$`+nc~FS7NO^(&0tpETrLxjP9TE~!ED6b} z%JXNz8!GE65fTz72jz$IdfsEpN#`O>2IJ;EyPmhmMnosAcX`{znXZIF&pEfWoMrfi zyg|KXK|S+PHuDgY_O0r-}BEN zRY%2(P80qIJf4Q$`dEV8JT#*Sj$a(iHze#GV*LqdjigHt&a=J!|NN77V59NEy&t4r7IkMnEgBTJbGt_)KwkMhc;7a<#dxi*9;2T&q(?sKbqa>Uee~|4TfTFhlCy zjm;Sz^G5Od6t;y~jK%NoN22vBMYb+VuK9fgLxtAo#=F&2S#(htTDs5`vrcLDb@}r+ zvs9QIACuK#Y^acFzgt0??&db`-9l@Mvg=Z-^hBhrEK_#50Pm~G*h7@cl%`s1Ue3od zY^J$LXz^9RdiLB0w-R8J$>M+Gyd{3JLRIC&1t7D2p6gpqaIS+9sWgb(+)AsVEbS1W zco6l2Sc3CAVYlRnGK8gbkOpTglg3_&)4 z;V{KpEVyI=f1PKU@40P9s_^Z`*u8I?lZ(0M33okK2jCmbozf4+uiU?7j!UNYzb7Si zV5IQ=U`%~(B{}Wr7P97YOPzc6kj>V+SVBZUHhqO>>l= zOf!59k1f~8)%mIBRAYs{%bi`X;F4WQnDeakO^Dl&mabr)m%US;Ld$NJ z5C)Uuuh*=*-4jwwJ7`oe^;l^7^}}1X7@35cRr)W89H=Shdmh70?t@;*?P5#xWgfr8 zABdZsKGweNR|t0l)oNNY8pm=yiw{MTE-b<1GW$!=Ui!I7zYT*N1>awG0!sTBV=6<| z*tQYhkR&V+bTilEFwukEx~wbUG%i%jftH1a=Pk@NE{4-MZkJ&J656qbaCvM#x-epd z-@S+2Gwfeqow#Qy@ZeYm9|>W_vkuBBic8vFYG@oCXhlDCc-nL*g#FNzExMQaf`W4b zfr{N~p(vK(JlG%GoaD}$nIo`Q%E($C#dYp+_h%i1Xlz#Aw7l`ark+*VU#kyUhc|In z;}&ReS@I}g6hz6YUA*aX=GNt1N}?pQzWwNoK8W?O`@7!w*Teb2P*IwnsF!2i;U4*A ziPN2kKvyHVNdJA4hP!VKAAHETkoF=Tn%mG{612pu!mu!hwo2Kk)DJ?m)Z~x*o4`?M z^wvcY#QfOikz5c_`_8Aa#}T@cLZey)G+V<15v|E>mjno~^;L4$J^ssBm>^Rlv#OlS z%y=0e1j=B}``|o~!H<0k3lC@a8Bv4TRiEPN%*xuZ8{s)`7C5;3DG(jf70CswgB~N_%2&La)Y9qQni&YKv}A}V$BGez~pb9JrptM z(5Nl5AUws;j~dQ4Zxo<5;-@+`SWzaec0wab?BS_hNn_Edn?x(G|A70-rHD|?)^9VC zkn=Xd|Nofb^K3LMMB9DhAR^1Ro7GPdpTWVw%jxS6&ZoU?rFXe_>GdUQqF$|zjZ_*bfw;dXIvBO6;Jl&tp zA|XB>`>RXq7unuw{j{Q#_;~p`2XSc%3=??MX?3IIEcgaECSW`NGx$LT1f9#M0G?rr zLA5}zz@kLyx%9xB^P$eW|2VaO$Kd4iche;yPIBz8K5T;lx28(oGchaV>1Pf(u&9zRaTtOI*s}jPwSPMczt#xYPW+Wf zD7J_D;7{b5(XSB8CbA%~Ey;duod33*#GO+lB)6_M(ch9PE-vnt-jUiLt1SYdOXk-| z)n>7C_ee-yhRYYc68>F)aR1Q;d~92E%(xhOUmj3DWh))J>CA-Uv^ z>vG1CkbIAYDn*_wsy7o0?UeqvBFV=ys?A{HljYO?*J^2kR0UpvRh^!S(IHSpTbZfQ zdj~J2g%>phJ!EYuo-1AxHFsjLtNB%2Fc*KDD+I@O;efwJ*0I)^8K;q;kf5OP$n24s zekjaXlKK(@Adn-sbj(@G`Ci%U($LZQq`EbZ-!T}R=Vn97S^1qcbd-tePM>d4XeZrl zsH|_4^w@!Mm#Gieuns@}PNFm%Co$2hSTqOEe?I*NmW@n9o_fKv!2^zgsYfh7Sq-JC z$(6bvQ0e(=r^7vIX=1QOzUr<-WwE<%@)?DBD<$grU32Vs$fUg=nqN+=`cna}9Uql8 z>%CHz`!-AJw#W69Ws_pektXxsad+B8V_c#;YUn2Kdvj5AY36u=*3(a!rYs#kV;8MvSqUu|3r{#iJO0UYio&3)pmAZ-7{So55L`Y zu%#Y&p{K4e=$lrBTYlp=T7AR5|ZiP;YBzjJ@*-@s9Qf9pBN&qM)d+b1atkpA)Y zhK}aD>&~IFhwd#dw{xG|Yp>yrkBE1fRKt6uO)soHo4=;%wYn&hxVJMZFK~0k#4{Au zinv~btVtBl_JDMWluOaM=j9V82eKPWU|;Y1X|eyb=e!xtW?o!?TQKqgPb*?GQZIGE zQ~RqAx9DZ{9-P=V)%@X_bWw=TmfmKA=ndW*YP$+PhMr|eU2*ee@p-SY#PBL9(})R7 zd3$ab2cXeul1?8tELEM$e8y`v0xr=9NAe>za;*RFINpxwq9{2+*Vo#&d*DWYoTmx( z+~Q>hxQ~U2;M$-aI>@})(LFw7k76uwqe4n1e3UrnVN&8p#K%$?Neklo7tC1=O4Cc$ zE(b;KEKKa@BNd9VQrGPD7Nasac6To4a=_6>MQ>iHo;9m~7TIH{KY9;SZv^SOG4`^w z3d}c1oUef>xXo`pNjk;NXESV;_78anG4>-G55^L$qy`P!07V6{B!Hr2er}FI*U9MB z_g}ROgbZFdePBpaGTzoJi)>ks#%9pm)uVH`w>X%cZTmKhso(-p%tFhhu1i!&9myx? zu8YqHkGZU7egY(DGUYI;|9{wV@;g7`c`1q$<7w^^jP zc3 zBjwAbn2@;*iW*l@h{f#kpkw2hpO~boEB{#JMQO0|y$o`{%_Nhpop_U!&A;_>&loKj z2XQ|w61i5`RhtJ*65PAP5>SZ=J0Yz_$eNt3F-D>>;VK}tsN4zPQo6&C;@AWCN^=W~ zaM^#nR?mo*%*PZ-AzfCJQ<|WR66)SPO!Yen<)2Q@GJv_K=MJHg(%;AB-CVNm;kQJe z!kIO{vTb>(mrB?7=Dm!@Vt^md?>jjqJYNilbTn=l^7)C2osIJPa?A~>&7bA*PRB|O zq$Cme%&8l=P?$jJY6EM{Ir_d6 z3A6IW<#2(^V*70ASai-hVWQjJrKhl5YF2O13au~y)mH_kUopPif)IJeB#65ADvK0j z8WgE=9v^S$^|;YR(`s>tQq?$yHt(UTym?qIBYbdtc`4WN2p$j>i?3l9o3YoUNn@r> zJ6IU`*_M1*nW2hW8oBaar8goBCXgIya!YC})5bT8Qk}E^kVa=nmxUiPD3*aW7BNta zs?2+6FdPy!jS@>+(j8XW-Ys_;2^jaMt*yDjkK_Jg`}1z6558Qgb|<@%)1)`Ob?{p5 z3OQjQa3(vdFCQ87(G{LFcHxu45dRYt4ZqD0ZmP9#f@X{bqJfWxHZz)@8!e)fu^kRB z5-@KMTNaA?^~ssOhc8O?w&tf=wkX$zNX^wpX76Cm*uP6x?os07vb~8@EI@y8l%2s$U1sIu}*)>XF;LrT-h{sWTdKQ=BJ=*(`jG4@LjP9Y_IbiSZ%|dn z)8PzL9~Cq{F*HB1{#h(E`r|Lebwx++&1A2B4an<>D|(!90dIQXGY8e_TWvgjSDdc6 zU%_q$h|EWvt1P^sW6Yj==4gwhd}XJKAHpN@=kZsx&f+2z{~+<>lhZ?LWy2J97=_$m)4L9)Gb$GcwCnA8{! zye*y82k|Ob!7oJ2D1x{8mc^}_wGKjoM>`Fz>Vuz|*b6+i=wC7ywfmBuH5&e+NqDX` zAa0xW)9P}R7S{K<|7pMwn9`4;vnJ)w9RW19S#Z%ZmVn$f0)Dv}<2?~9#$ zLf}80Z5N*J)E)VJbEK|w@!;FFd9Pyqb2u44kP8id7%v0@o<%2j>*PWSos}B8+xhz? z2|vfWjt=%D5`IaLT315muEoj8%npG zv-N$t+$?*mbxf>6VCqIzGQ93`F2jdIK_=c->c&6{3-7NoKn@b1rV_PT%VWLJoLFm# zD122^=H7^y#c&4Qj&o_duxY=)S*BADR=Yb&;K@04*_!LHt0WjEoEbZgnR(c$&vbI_ zt>*<)l5F2d9oKw+}rllZEzH{e7^c%r&ku z4=KGD5vnS~s*U~P)W=HW5dHCuccs)v*P%VWnU&(U!YxyYqC$^RwP<(`p1$IG+!&)D z)r6Lw^jC3S-Gp?nj^h~`X_Uhr)hiC%-7J@i62itsQ|kqPgj1V3wf~B&x>a-wTJr3= zSO4AMIX-cW%;e04dA*OW{$aHtFxO%j!Chd32Y4r37ul27_ivKUXztIc%8(A7&z~Cd z*~xrz;i2%Fu-1_3LX7zno%G>0k2xoF6k>a(^k+T$1s4OjJ-MzPU7BB!nvKPUXl>O{ zU=|{jjDKG8l$dNuUG&-VN%AmV+$E1G;_V$Gr2Fx(8L-cEr#g{Wr+mKkqw#gzo}TrQF8gB^L5T`WFo3A#0jDwAcd@BK!AiF|7%WX z-`F(5wcR%p?VICf_`)irVJow-a9A64J7?sr%uXzn?Don{-O-Y`Tj~hQQ%x))IfN3c zD(jZlUpk}d0I~pQ33wn(R~xEf5eO4NRzv+-4=L*W!Hh{B9qDqN#q70-U8w>F!p@*>2gp^Q7o5)D1z4 z5|D=>*C)2WlvMcsenB61&2Hn_^*Fivxo zo_(}8gU@54{Vc>vI8s87q%UgT%~^U%9umN}D-pdZewD?Cfp0Qn!y#tqGn$ zw6!9Z=y4%XqskYb;Rk%?rPWR#LZ6yf-I+Cu2H-)WC0Yo3fArofu3r!5i>`&r1fa*?u3KJ2pQnmFY3g zSKS?BJP5@%Xe(5eRw!Om+)U7urtz;gvvO+>{tRK^&+gtl^zt3T%!+hKLNs>VdHjYK zIje*gN4XaD`E7>P^eEPG32RvSVa+UGWOrMsDfe9ih}ADfaLjGGC;<>gjCzjuI$Z&2 zAk^aL-P7unw^7bJ+L-zQQ0t*_XhB$^9o&gIK%VvvhDecFeG($H^Xe>4gFQqLOVn&d zV)PmdCHan^wa*g@I^WICqAzSvG};L8;fM4%js33xOJU2-dpwswT=0vbwm5Yxlwawz zy8d`Y3vrotj1ab5ia5;&1W<{WqnKCs6+W|ld3+K`+&oF1z9UF6N%!BJ7v|{W=!=E6 zAo?+^pcZk0h-jv={r;>p&t`1fYS&z_+_CyuiBz>2fG1_hwu*u4Aa}aTUJNo(3-oPi zj-E@_G$~3;G9qpSvYO#4NLaL*vOGJIcrZw4_ln#tB!{V^t1T4~aRFc<0J<e zeF?2?kr05cPDdm$^p(~@c&AA+|)#>%Y{=OLsYiww(IY5QUOkx+WOl3ab+^>C< z>(^LXwj%pBW8>+B3G0^@1Z|^ZJ`#rTL5Y2nyX#S4I#MFLOQ2gVB*e^=iYwOdYC}TD z!gEUfRuopEGq(O^U$+v@fiLYZ$#Yc(m4{Cp4zuhTXPL@a8T#LjvRJARCfE*nF2mJ= z?DUFbWU%QOPjqzr51w?H;^wUOm_3|O=-m>(uzG=yBIzS|?R16>(bR7AqVt_q$cGiNVb^Q0(s zTw3xAk)UQ&HIld^Gla9Y*<36PAK>LIgV+>-(#pt(1na{J7N$VXuCYLxt$A)HpAZ`7 zkY6#q)P&UtqE?XWdsa!6DQ1n`5E&N!Yw*|=5?ZM%{ili>e67cjaj*cJVBJKC(7`_K z>>5g3sY{7j^b}~`XNiSAB<2@HIVB1a8E2pNtssAwpCv0?o0@dasvhdX!((PaUOvb= zw4!nu9kf4ZFAV?F!G}rrHdonC1Xvm)!wd;!aTWV9o|#=MkG-ic1M5@=D zdr$ViXZA^&_+CDBmnhA%`Y&PU+A-v!A6RwQA3hB#41bhf@}ox4KUu|v&uzv1k;iBb zjlIb7iWt@tnvGUfE(@cmXRaFFo+~FxxNSmllDJ~db(2OYLw@ptgzHLhbh&deY#0Z) z?V{xvAdDZwye~Te>s|_B0a$m2{^94Koo(Hy4~tS!rM4ni9en2_NBT}wjU}(Yq59OT6Te-zB+?4))QJ4zHiVt@Cupy{9&#q27}YK2tE8Sz>nOPS&OlIaV?IWtb(gz# zO8=iaVHu^gbRf)EXPdd^FI5+epmAiFVa}Xvh=coU&XgRy?a+;4H5Q0%bgh3}ToG;* z0iWd+>c59c%A6L&&N;akn4YhaiW?(q^y|SnCY0B26?^@T*`jlC=RiTd4R&(;dX7=B z%b+;@62{%b`dY1-#^Ei@E?2Ts`s*=5_Y=_YRVnN=B|EU85hsQdm{#I0K}jI?Tj+^3 z=I9FsX+%GUI3L>v578_p9sj}w3=~m0n212hG2R9kDu_L?(_94rP9v(`qtSa7XgZw6 zv84u9Kl&r-7$ecNgT4H`Yf%X!TFU=f|HSAM;rHXoh^_=Usgo~`^|({o26u-3HARr< ziE935b#NB)rSm{=71-7P8Feb)&A^8Lqxl~m#%E5y6b}R#)di45gJ=i(5V#wzFK7Q@ ze?-*9P3bQzIR!SMl8Lx=g-=&jzXopS_;iR*~YPu+KwG+2~33l~3+Jl~^ zlz;z_{uvrfh6_Cb{XnfJ5=rzP?;plLjBg4&o(+^|4TUgFFNqW;ZucQOQpfH7aWUq9 z+};1p#ACvP29PgGR_M5Ip(lj@7Y7g>6ww-=KgL!5@t0V30Xr`H@AC9Sc<$VZcpY=> zgz@Y^@I)|4|Cx{oR0Br+Z^j%4C$svXHbo3?{t37UNDDO*fP{WHh6?{P7YH>|kNNmN zKL7tFqYaKEn5aWQRKH~Xw+!{}UzP##+!NvcKUfH=ZvQWdP@L5VaRt#eDEGWQ%w-iR zkq8n!J`L*Lf90%GTJV|aG;Kl&A>%Z1_Lb#S*d88N#mGP<;Ktc_I#Qiiwo26WTavlZVZF~!#2YG$YDn{Shf(h{eOul7 z_uWAK>nstl?!}~T{H-Au8~%?1*O$MtT^Ip%778W6aRF*nE*BvW8Q4 zJ9H*1o5fABF5uHYj2R}nQ1TCB262Z)r;h{7;TcbliGQAZz&2Be5920ELU*#wCWRUv z;$Kqpsviw;)(u3!obfezfe$)l2 zHHRuYhr$SpPl`~3*K4{Hx5HKi4)?pqxsSG7$A`P_4Tdm2PuZJzbv+Kk+!v%yaLuHz zXgN#2EvY2)5INb}D;qOp8#cS0+-2&Xvvcc6Xs|b`w+eybiQah!P!T#yf!VE#g8Q zmj{6A*30eNkqYjqPb6+$wda>>Mth z95D?UXO26uLVDS-7-iY{g8nyso-*7T2jkgq!o7|>h4I5?8|kT?rYQS8tl!eI0oPXV zp8wTlSW8;Py@t-j?pK0IuX(I9VMWWl;8>@}IQOuj&H z`{$JQDaz6W*Ho=+(s_Ixyd3Q~Tb}ryD?)y*KjBd<=_TOJn|8@~Xbt}Sj(hB2*Q(#Gi4Pr%26p~WcwYx{hp zORm|C_-eH}SG3LHubB~%sIn#RLT(gAStstbvI0A@t}K?Y4gt<`C_M{i+qTD#ouxMHPJOh-;Eby0G%H3Lm#lxN5(WEYUSgJIEanX(1H9O%7T;nRSj>}&u z;I%p?5=O?bdM(DlwH`BGIH^t+n{dSUrOeNXF}`m9B1iw+z_@lU$L_*8dz=vue;lOC zrd(MrK+=_)GZ59Vfiw}&j4M{hB)V&eD zS$<0`54LeAf02-tRz%E;EWL~3JZW|a1BY@*i2HC#)ZOlhF1JAQr?H(*t5FrX)=%eO z(d_oA$jB*Rl{kB6eEQHOdW;Y%&P^M8cQ{AwzhI{oh3H5P;j=it*!8^lQ?-cmTmgMp9(iW$ z<=SmW=jW@2^HQMM<4s(Z!#pua;GV#Yt0w4{iqBs=i6C1LhG+4w^PwXxeu3J`HEKES z{Rf%7KT%H7`0{*b8N*RTdpo3M=Rs#(`>Z=2jym+P0-!pRZWcuBCSoftmk|vlVmwX- ztq)@@;E5yAUHcV1cLD7zT-0h&(h5$CEb2)q$)-B;W58+tp^9!B zZHRT^?TGILzF*q2p-5K5lQ~As&E=O4;m44t%f!V`6Ik=f6nd0_g73EgyH;6Lk$SE* zW=FY;QY~yr|FqvQ^~9H}coXA0SI<2`CAz{OT}*rsjUHZeD~NjU7}E*YKHOg9s}%an zBM@`ju&st7OJxpX>M4>cT>q4-EBd3ZKw0p5)OA0(5rdABQ7`cZ)B4ddjlJl&C^~Un z^AE7=V~tU>PL0B-v8rh2vJF4!vjMr1#-$pl#j?>#FWm?A*vkC`_)106R&m?n=F=6$ zL9#J}`c*Gl`4r{W)X`N4dEHw0i@O0l>BF!=ss6)#&N)G>(2Xij>w% zfl2^XrPR*X$(34ZerRLkY~*Z(^a)fDiEO=u>?(3Yi(A#DG22GH3iOE;lS*tfN%$NW z7Zp4-1V|E?y;Y=apIY+EqeCOA;xn z@i}|$qpy&uW@D02x)}-?P0Yq?NsKbLNZFClg6Url2sK=PPmrxqq5u> zRdR~C*MOOiAnu!WJUiGbdK8g~c`p=*O)e`B>p_Q&A$7@N2#-3ot3ZEJhd0X0pxx|F zxh7NoZx4z?Z%+oNmXBZn`Ncvl2cR$?K{Dj(~n%%7?pNwTa@5AvzL zd5D`Z&EIzZTulVd_x+_@J_sKr0z`-V;v~ZGb}aNeB7zk+np%mJwnFb5ycqAXWxuCR z@w=0YvI5srAeq{{2z2}rN=Sy;b z3UVGayWP))*%Z1P`rQ`WgIBprvXB5Ah=kNjyF zQhYd51L67nD$02vkTG9L1)}3ql z3aeiuYHdWYt3Nee=kKIZwZ!{KUA!fJ0nV=nKmYj@Xxs6pJ@b93p)?71isao3*D&Ki z3v>jhnjlXCtZ^-aa}?<#VybcXjmSH22O=%wOpD(FN%h;ZSC>AjPAfckr`3mxI3fgL z#%IH%kb94~DW{y-i2ba@F3>0uY@{%Iwim&W1r(Uq|@2(0YZ zFKvv{O1hs<%agz|P>Xt!{cifwp-E|*aCG2l=Q{7(^hrw9fS~`i#(JV-V#oQCv6<7| zciWFpO>PQ8J8Kv$zd#S7jsQ0oiE}^quCH$LX1^r0mWnt6zP68uNO?AsT^mx&c;@$S zY`|8re2=vEaC2flrTY;%X8BS6cx^p)ZIpE=h?x-P)BZ(OGsxG>Ilzr}{*oZ}B`k0(b0PHN>z4$LMwditk`Ey;Y85)E##jrIy9@x2 zP$mLxq$Kyn;t3W7H$VrhAXe+an#v_!T-O8#$v+hZ!gnm5x72|um3ZU-5Sv|BsEEz4 z0FV!QH;Q3v15K#!fbN_+Zeb-hv(l)`GBhDTM&E^vnK|1j9Z7FV+0>43FC|g>40LG` zD4PZ#Cs3|qP@jax8mN8`5qy{wXr&|?9#Vh}FdH)vsv!x`+CtQpyR2o)N4~v@za=vh z@kx!CGWlsD>SOiV0SZnM3=4c12VLbl_2Uvro*NOfp{4j!=Kkmns=_)KRRWipCk4BG z37ZEt<;OQYM$kSBR8A19te`58dqs?PX{(_F_WEHgbozQv)@c$O96&fg*JE&N`09n0 za9c}!sD$IRyUWOt*=I@Dkt5kjVESUAsp@1eKi>b>*K2{!M-DV#--q3xi?a@8mPmU~ z<7n$wlnIWST<(!Yl;QX8cYv~N>Er~BLX zdtmn?K@pPNpR0*rk;J6EE;wH1dn3{kVQk`^my7&KhSZnmk}eSdA*jl8!QO}tOb^h7czz(B zN;FFZ77tbPyMHmx_x@(pkIZsOh}P_0Rd?AhU9=hhDuF{AqV$7d*dQ+6=7V) z-6dnuDc()2AxTWOvz)u&pqu~2@gpf<^>+Z-vH?g)_OES`Dkq=Fka!JQ0(DI$O4g&J zDqz-NW&3yG=uX|k)b83Bd)V>mmay?e%E0k{-h}vW&}wXfPP6`|XL7oudxo$_+4|~T zP#7soi|nzI0Baw3ro?4ZUc%?s4_2us-xjpo+2az=@Ua*)?$=>(8_%BmV<3(%7^pw* zE8vL|h^g<9Tw`=g&6@^v0>tkGBw~}VU*VxltXkLl3fCV)(TW^217D^PVO$qB%aWH4 zG%XayO%-{IYPlIfx{a%R&de%~Ns1t=8IiDiFD+PzUh(&rA7sRpGO5c8{QSzt5*~T= zJ0c_(9U~e1O0Q4Or#H`{-rhfOFlE~U6lkM9l6KRc8@qbW0PB)hyHo_M$Z66eU`6(+ z0C$0?at(TM`wXt?!DdTi{@OTDt9Z;<{sD{umMWu9V)70Z;y&YFEykS3q|_&j#hGzp zOgSeb48+K2OTWDIyyx~wm0ZRG4UnY|q*p(Z`qX5BnoHt2fGd7S#E>94?giZB3~%O1 z8W?GHOh%k{^dV}saPuoz)2Zoy+AG8#GdXx=v(g@8BDZrxtgM$0z3pOcS!#*;@dtKb z9MojL@pIzGUSM3!^q>)kOFZIMtY54Uw&$`D4^{h(bFW{x3Q*-7bPsi*a8ZtS+?^B5 zbmuUlh|6J;-?Cn~fklYCqZh;Wn>oMec6C9aUQ7ujd+1)reo|ApRumxZZFXe9e!F(= zNA7B0LduKbts4^;nEFk_kY1Dm*NX{%(XI1j5*IHd`56U0=Nvk+A!73DpM``tTz*LBY9a00{}UO$*~8~ zSWQUHALekn9Hc0Y<99E3TNKMx)AKNo@MnJP-r?qJ(;seOaTOIg@xWsi;GW3~+= z4SYRy-UJ0IU?f+?ffnbG;STqQ-neY-{zUpzJEK*WZQ}PRp8VYnGaAeD(4GsKGW+Bp zz-y~J}t_WcmIeOsnqQ93D8Do^q5=4yIn&_`j}}& zwm;+AQ6-y}V_=Mna=i;WUINt=x90RB4%$r3R29(g*-~ma@#|&`Su1{E*0XTT`O~9A z**oHY>nm7RG*eo`Na0=6_a_D@zx=w$bM@S@V`xPvP{tGJoTzORpHzP?g&ml`uiYc< zKGPO_sQ;vnZZ3yIl{}1Yt-4<_e8Ueh@Iy>nHNyRYp@~NsHB}T8syt>4P=URRg zwWfG+gXo@S5?2!VIV92)?%* z7!H@S5S?{2%$%|WibPsOHidgNH%H>y?Js?@l$=^{76wpF%)4%O7A40&VN_jsRGx^D z(H-3v@X@@0?wFic_v0d~zYBq9#nW1Hw#@Bo7&?z)ABQnb?jJT{pdW~J&Q71YnfpGS zbuLX~IN=q?jul%+eq7OtP2L`*F(cwJMiMpaK9*9C){-t5v9dzj^mvjQo<(DOtGpvR z5Q@zT6+6O9d9xb?I{yMrDrdd`#+*SZIIt)rYDVXRsNT~W+Ivk+$3hzu1)WFS%}3G|A?%bJ#(yua17RFi*;zRmZ6|`Y{X@C5VmKI8 zF<<*Cb$#d1$p(Y>1}8KSD~X+NJ%#_dgn2&Du-=Sb_xPEvWV20&h(p$p8#}4s5R2aF+l0WXiHN*UvotBIp|`wyt91pwGTNV z@#jBIl9pctsquxDS6i`!97(MYu$Z>WD1{e%2XVR1W)iwKhZO=c*sA&WF2a9hu0St{ zVYh023Ej6A#{OqBq(n1P~ORjWG6ZR!)Y_Ug>(oGmp@kAyy6I%_KJ=Y+me!)f;`G-0LWoBXqJ5HXij* zW=&fL8*i_7R!+COt{p292VId^MBJi!JELCF^xq)zJEDriK;^aQ&S#nISw-?FPBoRv z0W1Drg&eAF33BfnK96EN@9@M8`+LxSXL*zRP^*3~-nk3D=$TkKn-ubnA^{rJwkN^# z)9JiZK-|z(erR9ivm>7$-lLRzlk@c1z-3aE2w@$E52Tcq@z=P^2ePMMx`cujN;#KV zC-i|;FQs9eM}Rb)bN!Iz2bUXvxn9c@4;x7}uo&*Mo!Y(gRG%}YMpKa3CO{$tTH@{~ zy@ti?gz#LvGk`EAud`({2>ZzSSS8sy7GFhkD@D@ibWm|1V&=~s;Rkdc3)r5&s)VZ^>$ zLxHI3ooFETl(af^MmeymXX>>=`CEG3qn(?=1N8Z;3C{V+7rL{dY_X9=v1e7jjBjj0$@?&xE6L69X6C!UUqW4{Se@R)+dyNnWbx z^3h{l8+I^66?*B?wzU1tV=_#<1h3bZw{h$)YmQxW_t&g(;kQ?cL>qU%n^fHEMUtf* zEyW(x7;e_+_0F}PlB@hX@~ealN7W>FoP}tKD!;^r%6Mp21II zf*^?^hE2qX=Okzb3CTw?V!b$slqiVABtfNH`kdRfwVE3^SI$cB=0kl zfEXtSM!bR8DgC)zUQEMC@d4R!RC7Xl!t0o1k^Q;1!k5jwZaMl*=Ge?Djgb)Hha6|d z-<6vtY;LRoiKOvrI(3{*+y)_{k92iq>)&hqdxL^RFI33fQJ&@F%`zG;TsY?gq85rn zb;mwpNL}RL?m?I?sv_3)*LiRkO7Qu39;>!fHzml7_PG$R7wG}@03WM&400uVeAe7oqt9hu+rLYs8Hr$TcApJi+yjpqt8NNMK1d1x5yG&Rr4M7dM6M|8_{2h<#%G#>*6yYbcihOQ~PP zTS!BShX>&xts@5V;4aS#9KThOunK4z#AL}vyzWy8c_xZG1b*_g^)lAa*G$X*sHy3_ z63$HSXfFDo?fVj5>75_W@K`Sp#9TbKFV<8ne8cSE&T zTlN;;%wy>!xxLjS?9w~yn1>IqoMUFL=`?lg_{Qo5PJWy)ky@ZZsuz_(nP=X=LCA}t zB2$jV7cGfNjEgi3zV%S)wEkl=0%|4@(Mq&H@qjuB=c`574}^kF2SBT036crW3e@70 zsz!akOs@&}Fg{>n1n>HjC+qLymC_c1aU8T_2kr~v+d`i5%~&`=2z%Qsp9O=yv7Q6M z{p3kD&?GjH1)H}%g{k+jLdUqkuQjN`myirDmlp+Xu@ zP^?+K{Jdk>EsLp#Z-ATvoI5Q;biz&k(xu6TVM<(bHi#lJlRcvzqSx0pQwL<6(dk?~ zeKX?xeVuic{YM9J!67fA)pYpDfvO(ch3cJa61bvDuZYE5w!1u`EVqRxdTx2a**I z(3OH=ns!7Zy*rvvR>F&*<7!8HzeZCplQW{I)fdOFTl`G_5J?iZ^)zMg47dqQOiVwQ zM-3pHmTOfoQF^y?`$s>m_9$f7-sGoY&z6ATRhKF1$K)kv17(MoW`xXja@Si{D+P zzSqyQkUuDd<*llx-#33d9E|>UR3AO>E501iIOyf%by$lOpL$_-z=Y;nz#5i^+kx=l zEf683@ym(8sH$6~)ld__Y; zv6|1sw`V^x3?CmvE_{iwd`GSsE(TxT7DxSUdD$3pNaY%_NnntIJG)W%s>OVq$kPJ$m z_iB3pqCB0>V2DGbN5ORoFg3X3OQhn-h*UMJ<882lTkn80$7?mSgWa71*{ui_qQBVq zb3Q^W=XxVK5dk~-h?O5xU%#H8<1|9*_EPeG!)dS}An^20C;YE*hMUZu=duPP%Dpg#^!5^$1;>`9XxyX65y6(ATUNfPKD zcnR*`AF~i#6^|oqb%Bff+*IKBC%vE~91!AE0{yXst$4!wmEyYGvg_3qb(5GnF5)PF z7Eo0Lauw*_7p-(brFi-nmvUaOiS`&Rf%|p&A$IaVP3+0=yZLa*MTo8U;Kuk_#0vss zmKxBj?z(1su$lF}vej(2(f_BgFOP?MegB?vs#CU3lBB3pQE55IOwr&}M;lQp*(+-p zvW_vvw9BJdb}E?)!7! zpXwaG=4msxSbE3s?*`+?>FT-bkiT%gxnL>Ktgbu@l$PjeM%j*rD&}-J-vxNoc zHEBQO{A&G-UF>qxQS=K5slVN;|Mf7R%}iGjy0MwOJYy}=(x*8$7Grk!$|b?DHbKY&9MYat ztzYY#JNuAz(QldO0nc4d1|1Oq2HG79f1c~I%Lr)lLldEm2fRDSI>vDcyvQRkeV5+c z*6mDlS1Hz6ak~3-_isG?nusOds@Qf^rzG5)4l?{!KqtHGX@am4!2@#f=+ECQ(EPpl z(YYr_&x}NuKPjBx#{YRDD|AEKabu_SN9P9Mj}FAXS}B!1z{*m(B26J4Z9j@`s5Y!T zdH$+R&KXNE-6K!gD4hQlbs4$VQ^(k8t5$*Q2C17C!j51fcE<;AkO7Jv(%NX~|9vk? zlQcH6D--T_Q%7qpTOSwPfm<4m#by6{>D=mFnaijXS`lQJ0miB&{groJv0$E}1VxQN znFQc;>FG3Ku%oDHtMM{T5Zyl+z~Os%T&>X^uy1h*kMKU>w1ODbE~+sb}Y**iKX29%c0heY-n5X9f7-VQ;zw25dS=Rl-DJOIQI zivSKWgPi6~hCqyAz-oH7XBh$y-Viiult0pj&UGp|UxDw4i}R0`?KgQeP}QvXNCvzl zcyi#&wT&ssN`B9?FBUAODY6GwKZiGA$^TMEyB;XBq@#h7d-b!KZTsLAAFc9z%I8XP zz(0KY%ZpuGN@x@5&5mDzf;TJyTBVRK;|E(e{2<|>41l>XP)@#QWh)b2{?X3(*Xn)0 z$RafS1K|Ftze{cX*XCP2b}7W|SMc7ktiB#s-L2I`xYz91kh4MO&C$J%3m0!vE71!< zvYMn&;9AccvfT~oHa}QDa572x>-2iB*}u(z-{&nNr_*dz;~U}@ll0-jZVuMXd*mclm{(>k{Zk2i_R`<5=`vxkf;yO6YS^pn@t z4AB&R2~q7H#UK7amKm%s(l__1b_;cQ{E-|L*)t}ew$uzkQ~wyK6f@et$?vu5XBF@C zb=k?#l|@I|z zuBqP%5<$-kNnTd`q^(196pbe`o9Ck6m0j@rdaZr{20||^_g=ovglPvo;Ae!##lbdC7KfhivTQ+_|60-#>o*~EQHO3>#T4@V{ zuSaTz#^)1-N3%;-u`-3oQH=bs;doP_Z4!DLt@j*>vQTTsroH6nz8Z5RV(EE(MU?tV z7hFp=iSZXBwAz(vsvc|fX7)9%E7&>XQ1r2MtVnTPv<>U~=D_^`vOaU~a>?)IDQqCk zl7{W5x@VfO<0-Tv>miYzD@MhO&2hWLAH^}shZHQjlGW@8cG zSg}NDfmU+ahKfSq>CrD3uW&aFQ)QNN&&({QXb{C?Dz;gx0`mgLy4~YG*O6sT=6l## zUHkg|j<1u&lMN-VhRL4$k|N(eoJPtg?-Tt?0HQaeA_`M?LV-Ob9glermv z&*oqJDKxK8XNpe6PiNnEWN-^Xeb3Ji4YWF(eU)XuWvy_2Kc;dQ_w;4OD_6t#`pDA4 zfH)@s6m_(%HS*kGNI%Zd^-sbWA*l}MR^+m+S@p-_h=8}&)a&q2{U$s8wnu}I#aiw( zf_FUPlIbPQjwiFi35Ua^*v~jd67h z$G(j-XKw~`E?4feQtt|^TlM>Kl1*m$6)(ipqgc!#&X!qAB!X-E@s51t%ALfyBl-I3 zkj^5|Fw8_x<8T|sJIz1&rKQh<^g1qhysStP?uotW{2q9fFR#puG-?(7EC?G0F6y=* zv!okES#sX{E23D8qWgsSucEqr&Upg`0Xqls>UrK~G$$XT1%_7AdR1gbG^E)~0Y8)~ z_S&Yy@bd3oDR)%^wf6h^466SNtk~o zzAGLRcjwAp^rf3&B}>T|YhOQ5gmspscVK*zpu#)-svCmomu=?2$~??&!iKCw;(tXV zNd#qeVyVj&pwwhJkyV54LT?*8ic1J1e{ZXQ56Lcl7_Xc0E&FGrVMO7FRlOm zKz4hq_du&Y+%Be`Y>GPcW;6!Fdx&A43>w7%tw*|uHspXaP>sV%?BY!HX58YekEo|K8tKZg-gB-aWKbJwtU#?QJ<)a}uRjz0_}V-)o^( zcHz*7x4#j)tYyl>n-ag^Ma(+cQXW(B8ekFF?apLKnSvVZtxbL_V3u2ebHpRI=H{;k zdVjjzZ!h$Arns7*enwQwv2Z{*U3vN>jM<55n3IMk?v4rM8aWOQS78>xOzx6txXi#A_eU$*n}{Q9?8$%lI%^u=PWdB(R>x~jOPv#IAE|{e|Zy97%-Tn z=R^G|ExSLC2US6>%vx3eFt7F7WO5L7GnBcqY@Y&sZle5e(|Gtzgc9*c6qMTqd3UnE zkgec~u=x9389KZn0t)0wc7iTz&b_bSdF0THwQ=StP{s#<<;-RLGQSEVfeQ*BA4D2oA+HNpy3{9 zsP|goZ0+pZ48mylBG0L<+g(l9v2wcxw|TUi)f z+J_JNxcltB*o3zz&PvrDH)^uDGN3r2g*ok>4XVqwsw}Uuqs`BT6u6PjNVNy~93w5S zhg}xDYa$gT8~co)=Rw=ZYRSCt#;DiZO)-*=a&TaC+r?dNm4s?Ctq~Ce4d~cgJ&G!H9LWi+Fldl9)^bRlHc0OWt$d+}QZ$%}InJu)kMR72-FeHxY9 zH2z_2tS6_ClJ9}aX2AVF?4bsL;lLIFjFufUp3-|OD5%C(Zesc)*NX#SQekC0hNzEQ z(RUOKgLn}%BdGs7BV%)2alnHD@_a^5Dz(-3 zoKHPg$T4EY)wkYbq}Oxj@)~6W?0-B9@bzXP)u+8tU)Z&&$xc12q`Yv`lmj0tl@=M; zvnFd{nJ`1^{9BMZ6FPt8EC=Fe={8Ptp44;*B;N_df=2Vr$i?DcbBe z=mUpjWkL_^VPWIrE1hngAZ)fO5w@adU3jYzgLhUVLaPjfW1Xg@)AKk`c8`!g6>@i+ z=48jqXFCQ6PQX{ElP0S5eZmScc(*w>K-d}j%X~UL55LynQ=Ff6!>r>%^9&nlnDx2c zxcGC_mi!L+@2szcvEl|KBIwj#X2)n~@RmSNzt!LfVN^jgp5^HE9WS$FzI2%|L3vQ5xYNS&}S z6FF7M;A+IE&Qt7{&-%Z;^#SP@KOO~psCI66BKV#NUS^}DLptNm`GBf^yfQlh@)tt% zhVCc7-<8^K<`ilkY;+wXY@>X1SXwebOi~~G$q-UpOSm1bW|Mf73MYaX9e7W45XG;k zo4_d_8Mgj>C?(?6&Wt!*;_VaRc9l4$r_2aC^YM`KsDxsrligZTjVM^ zE?Vd|W{*>s9vJy7l-2&FdTU!_tniR0(~BqWihD6o$VeL~s#^#oCIx7?%@m^E@c(2` zr+-)8Y%yay1Sh?v*K-pGRzidXj)9S$5n~8Jd#+$ zRnv9RwLiBG>CKT>wWBaTyyogAUq&f~hk4KdJe}p~AU1K>r$jB(TE*~!SIl@8Syn)1 z5QNQPEEXI^spKxO_R>3`ly;ONft>) zaRn+)X}s>>L1%4Q5KQnB_F*}5sOsS1)LD~rXQ;j(E|;hubYOb58|HmmG0J9&sr)qR z#I$7d7f&_z{T8FjMbI$wN}^hb38 z*DrP0?8G)*owq)*YQn+Q;XD7sb6You@XjK<-k02cnkt9x49s>Br=P1EI?M}aRQjyU z)S@AgHAzjCX8E&TwO7(aPR8E}U$44&xZV|zLDL^c)VOsmdQ8ddF7tcgNTH1{)hsZC z=#Cq0eu*3f(`K=5!z>4ePwQROjOv)Lq3O622iOqGvI{hy7iOx(Z=*0wc(>z#q}Z5! z^|Sjy7qi789XkgHiT<(8U$|$qFegaLB{HYf`%Rb9rJ5hJp)Kp zC7`yU7ECfGPft&ewSw#mw`;k9j>yV=+KMqs2`dEdR}$_N^*W88U|r?;V*$i{ZxEl1 zAJX9ctVz?e+J7(QEgCG!mMd%MSYm)O8Rb>uds7lrnJ&2Gzbz2Rz%VL?x4^R~!9=OI zM*ZAJ_PTnn_e71%;y^3WabmU>eYLMr<;|RmhPvE@o~PufzS8<$(0nd! zHaPZo8N|3b$;A1(uAfK)68d7Z-!&7^mh)R9xBiibJ_^-OAQ(l5DP;Z$1k^ZYS* za#`rhpa7GY`fFS#{FN|O|M7DXj*RR`LwookK53w^H&igl#f+be`F=E2Rd%_CEzL1tFTg9+bEq*th+{Rq1^zFju zR!0~`sx#^ya?2KRo7VkTdp`$>Zy&ZwkNn3K2Zi7Nb;(P!UzhJS1(<$KWa;9r(LeUh?nC=Z`s)siQTQ)%B7C~60_;%4DD$N?uIvN? z1MMVxDz~A6#KZ>$If}mVha~gqy~hr7^#v&vb!WqIFZzY(ndgjEG-01)(Z1VwnIMK41lps=b=s_Nif*h&N5q;s$Pn=V_r97b5P~@tIm$xu$79~1PV0=4p-{-@G#U3BN zNFr5Qb$7qw!)hyfh|F<-5tSB4JGNW3#6e`8SWL|m-*o8UT$G^JwvgH$H=zzZ`V@TG|~7%VcaXetQd z^P%Xg{>})a@sb=|+E971HhT5y`B=PAI1$GnfKdJrf3}R4OT!t(aB*7ENvdStKuq+* z{dbto*$F5`F$u51bsFB((>@f-@Rm;@)Cp$%%b%I_EQDu^xt$I)qrjLaCS5x#S3Jk?Dj$3UAEa$wNo1J4wYzrd1^yyg`P-acU+3 zO>q>p7N}UBh2H<6q0EHMH@EXW5!WAFIc8Y#S$>>VCEZmwSyuJhQm*>68E2_dGWDiv zVooV||FqzQ5;|X&B&HlOEM+lY1#}H|+>zTOABAg*>YaAcSWr0JkPh z|2&}91&%|6HKkj(>Uvvap5vG|XXzXDo?X%{!DG+|%H1)B>x2xq6B6$1C{6iEBABBE zON3Thrr`>#3{@P3jwZ*hL9ik~1an867eGXGxEj zW$LjvV?YLJ!Po^CJ)UlxZU@sIk} z784pzf~54K{i%Y#yqd~YgOftW?RE=v=Y%sOtm!SPK7CE1Ockd(LAFzGyZ}chOXeaS z?)qc5MT$G*Wg+UxPko6%^i&bF*)x7|%_kneeY1rfOR=630o{|V%iDL^I;p}eKeTcQ zb=dTn)qKU-uYZ6P;pyOUtAS<#skW5smlP6T==J?5a^jFohOj;0+tA<#Mqc^ePDfH> z9ho&42%jeyn@O#YolTo*?NK2v2Wpj9M$9;j6H*p*Y4V`vX)kz%h>G|`5$n^nQ@LwN z1*6?pylO$7P;C7l0K%1o;ss<8FgpavliW60jmw;a1BYb95>{nteCB)Dx+>&_pODrq zsP*wXE^OS9taW_Pr?|U+X+Gbc`01F--<-E^RM;oyHsA|a2am1ZOL~vwADCNTqE~qR zmeYQTRrIs$=qHAr7!uy6*vtg8W<<%5hYvhutI_Pemn7rk<5_6cYu%8cXpB^Y%{X94 z=>@_(XHqblQEcYS$V5N(T^9(?&gLC=8ed5y3LHju^62g^bnH@Skatg)-mv)Pimq~B zecA2Yu0l7e!5SlBb3u?~%am~rnMsS>d7fz9yCV6<)W>jDHCs3?yegw{*!S9aJDTwm zEGk~VAFt-uTqIbe3ibDX>5@0H>avQn>b7de#>6ychL|?+#h%E}-F2UbLiO7zM(>DR z(1xENaJpFQv_y#97LdT5KXrdvp~ZcZdf5JfnstjN1a9x% zi8l!^&Q=QA3t_N(r!Z?gl7~}Q5d*ji!P0e4^f-vPx zJt6KJsWC`urBynKazLr3(X|+rbquzL*I;Ne;G$HyQMh#{TC`xBl+rWyf|4ObEB8fs z(kEV=LYFj-eK0L8icvTa@6N}%`qpp)VXw&AJXq9=fUm4v-=W^Q&?NG^i>3$3dl8I7 zUrctYBs8?Ow@*Y*lT>EogJIy1z|A-WIR`8uC}e^GG=#oEzm9`$Q0cF4J6rbBytfsB sKi!sa`LoqMYk&EFe*Nhj=alkp- Date: Wed, 8 Jun 2016 13:13:46 -0500 Subject: [PATCH 4/7] A few edits to improve awsvpc docs. Fixed up the notes with spaces and bolding Fixed some awkwardness in first paragraph Fixed a couple of other sentences --- site/using-weave/awsvpc.md | 63 +++++++++++++++++++------------------- 1 file changed, 32 insertions(+), 31 deletions(-) diff --git a/site/using-weave/awsvpc.md b/site/using-weave/awsvpc.md index 92a727ff..94a4a47e 100644 --- a/site/using-weave/awsvpc.md +++ b/site/using-weave/awsvpc.md @@ -3,25 +3,25 @@ title: Using IP Routing on an Amazon Web Services Virtual Private Cloud menu_order: 110 --- -If you are running your container infrastructure entirely within -Amazon Web Services (AWS) Elastic Compute Cloud (EC2), then you can -choose AWS-VPC mode to connect your containers without any overlay, so -they can operate very close to the full speed of the underlying -network. +If your container infrastructure is running entirely within Amazon Web Services (AWS) +Elastic Compute Cloud (EC2), then you can enable AWS-VPC mode with Weave Net. In AWS-VPC mode, +containers are networked without using an overlay and allows network speeds +close to that of the underlying network. -In this mode, Weave Net still manages IP addresses and connects -containers to the network, but instead of wrapping up each packet and +With AWS-VPC enabled, Weave Net manages IP addresses and connects +containers to the network as usual, but instead of wrapping each packet and sending it to its destination, Weave Net instructs the AWS network -router which ranges of container IP addresses live on which instance. +router with the ranges of container IP addresses and the instances +on which they live. ![Weave Net AWS-VPC Mode](weave-net-awsvpc-1007x438.png) -###Configuring your EC2 instances to use Weave AWS-VPC mode +###Configuring EC2 Instances to use Weave AWS-VPC Mode -First, your AWS instances need to be given access to change the route -table. Give them an IAM Role which has this access; if you have an -existing role then extend it or create a new one with a policy -allowing the necessary actions: +First, your AWS instances need to be given write access to the route +table. Give them an IAM Role which has the following access, or if you have an +existing role, then extend it or create a new role with a policy +that allows the necessary actions: ``` { @@ -44,46 +44,47 @@ allowing the necessary actions: } ``` -Your Security Group must allow network traffic between instances: you -must open TCP port 6783 which Weave Net uses to manage the network, -and you must allow any ports which your own containers use. Remember: -there is no network overlay in this mode so IP packets with container +Secondly, your Security Group must allow network traffic between instances. +You must open TCP port 6783 which is the port that Weave Net uses to manage the network and also +allow any ports which your own containers use. + +>>**Remember:** There is no network overlay in this mode, and so, IP packets with container addresses will flow over the AWS network unmodified. -Also, you must disable the "Source/Destination check" on each machine, -because Weave will be operating with IP addresses outside of the range -allocated by Amazon. +Finally, since Weave will be operating with IP addresses outside of the +range allocated by Amazon, you must disable "Source/Destination check" on each machine. -###Using AWS-VPC mode +###Using AWS-VPC Mode -Launch Weave Net, adding the `--awsvpc` flag: +Launch Weave Net with the `--awsvpc` flag: $ weave launch --awsvpc [other hosts] -You still need to supply the names or IP addresses of other hosts in + >>**Note:** You will still need to supply the names or IP addresses of other hosts in your cluster. -###Limitations +###Present Limitations - AWS-VPC mode does not inter-operate with other Weave Net modes; it is all or nothing. In this mode, all hosts in a cluster must be AWS - instances. We hope to ease this limitation in future. + instances. (We hope to ease this limitation in future.) - The AWS network does not support multicast. - The number of hosts in a cluster is limited by the maximum size of your AWS route table. This is limited to 50 entries though you can request an increase to 100 by contacting Amazon. -- All your containers must be on the same network, with no subnet - isolation. We hope to ease this limitation in future. +- All of your containers must be on the same network, with no subnet + isolation. (We hope to ease this limitation in future.) ###Packet size (MTU) The Maximum Transmission Unit, or MTU, is the technical term for the limit on how big a single packet can be on the network. Weave Net -defaults to 1410 bytes which works across almost all networks, but you -can set a larger size for better performance. +defaults to 1410 bytes. This default works across almost all networks, but for better +performance you can set it to a larger MTU size. -The AWS network supports packets of 9000 bytes, so in AWS-VPC mode you -can run: +The AWS network supports packets of up to 9000 bytes. + +In AWS-VPC mode you can run the following: $ WEAVE_MTU=9000 weave launch --awsvpc host2 host3 From 71540e6c6d21f62b50a42bed1dc883eff7e8f3df Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 9 Jun 2016 10:40:17 +0000 Subject: [PATCH 5/7] Clarify IAM role and policy --- site/using-weave/awsvpc.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/site/using-weave/awsvpc.md b/site/using-weave/awsvpc.md index 94a4a47e..011cfc85 100644 --- a/site/using-weave/awsvpc.md +++ b/site/using-weave/awsvpc.md @@ -19,9 +19,14 @@ on which they live. ###Configuring EC2 Instances to use Weave AWS-VPC Mode First, your AWS instances need to be given write access to the route -table. Give them an IAM Role which has the following access, or if you have an -existing role, then extend it or create a new role with a policy -that allows the necessary actions: +table via its +[IAM Role](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html). +If you have an existing IAM Role then extend it, otherwise create a +new role. The role must have a +[policy](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html) +attached which allows the following +[actions](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Operations.html): + ``` { From 3494cc39c1067127976427fe397cffc9664c5cde Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 9 Jun 2016 10:52:35 +0000 Subject: [PATCH 6/7] Expand description surrounding link to awsvpc mode --- site/installing-weave.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/site/installing-weave.md b/site/installing-weave.md index 1e50d908..2f668c08 100644 --- a/site/installing-weave.md +++ b/site/installing-weave.md @@ -32,11 +32,15 @@ With Weave Net downloaded onto your VMs or hosts, you are ready to launch a Weav CoreOS users see [here](/guides/networking-docker-containers-with-weave-on-coreos/) for an example of installing Weave using cloud-config. -Amazon EC2 users may want to use [AWS-VPC mode](/site/using-weave/awsvpc.md) - Amazon ECS users see [here](https://github.com/weaveworks/integrations/blob/master/aws/ecs/README.md) for the latest Weave AMIs and [here](http://weave.works/guides/service-discovery-with-weave-aws-ecs.html) to get started with Weave Net on ECS. +If you're on Amazon EC2, the standard installation instructions at the +top of this page, provide the simplest setup and the most flexibility. +A [special no-overlay mode for EC2](/site/using-weave/awsvpc.md) can +optionally be enabled, which allows containers to communicate at the +full speed of the underlying network. + **See Also** * [Using Weave Net](/site/using-weave.md) From 425f17aab13218ae540e3101bbd3b93f95ad4dd4 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Mon, 13 Jun 2016 11:59:37 +0100 Subject: [PATCH 7/7] Mention that 'weave launch' now waits --- site/using-weave/awsvpc.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/site/using-weave/awsvpc.md b/site/using-weave/awsvpc.md index 011cfc85..75fe7d2c 100644 --- a/site/using-weave/awsvpc.md +++ b/site/using-weave/awsvpc.md @@ -73,6 +73,11 @@ your cluster. - AWS-VPC mode does not inter-operate with other Weave Net modes; it is all or nothing. In this mode, all hosts in a cluster must be AWS instances. (We hope to ease this limitation in future.) +- The `weave launch` command waits until the + [IP address manager](/site//operational-guide/concepts.md#ip-address-manager-ipam) + is ready, i.e. until after this peer has been able to make contact + with other peers and confirm that it has joined the cluster the + bridge. Without AWS-VPC, `weave launch` returns without waiting. - The AWS network does not support multicast. - The number of hosts in a cluster is limited by the maximum size of your AWS route table. This is limited to 50 entries though you