Welcome, everyone, to this afternoon session about security and namespaces. Talk is named, Keeping Kubernetes Safe, the Lowdown on Lock Namespaces. And yeah, quickly go about the introduction. My name is Marco de Benedictis. I am a senior consultant in control plane. We do everything cloud native and DevSecOps and obviously security. You might have seen me, well, at our booth or at the capture of the flag event yesterday and today. I'm based in Italy. And yeah, I hold a PhD in computer and control engineering. I've been doing cybersecurity consultancy for a number of years. More recently, I'm also being quite involved with some of the CNCF security tag activities. As well as, yeah, I was just, that's actually a very nice thing. We actually just published a new security certification, the Kubernetes and Cloud Native Security Associate. And I was fortunate enough to be one of the developers. So yeah, check that out. So this talk is, yeah, you might have well guessed about namespaces. And yeah, the security features that are either namespace aware or bound to namespaces. And the reason I want to do this talk is basically to go through what can go wrong if our namespaces aren't configured properly from the security standpoint or someone can tamper with their configuration. And what I also want to leave you with is a number of mitigations you can effectively enforce in your clusters if you're running any in production. And yeah, you will see this is nothing expensive, actually. The talk itself is motivated by the security reviews we do, the threat models we do in Control Plane, where we see many customers relying on a lot of security features which depend on very, very secure namespace configuration. And what we see is that they don't always really realize what's the impact of a misconfiguration on a namespace level. So yeah, that's basically why I'm talking about you, about this with you. So we all know about Kubernetes namespaces. They are not a security feature by itself, but we use them for logically grouping resources in a cluster. So they definitely make our life easier for organizing resources in a cluster. They are not a security feature, as I said. So they do not provide any form of isolation. And yeah, but we will see that many, many security features depend on them. Whenever we spin up a new cluster, few namespaces are created by default. We don't need to cover them. But yeah, obviously, you will know about Kube system, which holds the Control Plane components. And we typically spin up new namespaces as we build applications on Kubernetes. Not all resources are namespaced. So yeah, this is the output of the API-resources command. And yeah, many resources are actually global to the whole cluster. You will see this with the namespace column. Yeah, interestingly enough, of course, namespaces are a global resource, right? So this is a quote which comes straight from the Kubernetes documentation. I hope they haven't changed it just before this talk, because it would be very embarrassing. But this is actually telling us that, yeah, you don't really need namespaces unless you are running like tens of apps, or you have like tens of users for your cluster. So you start using them when you need the features they provide, which is kind of true. This is another quote from another documentation page, which is very, very specific, just telling us that, yeah, using namespaces is optional. So is that true? Well, definitely from the security standpoint, yeah, the first key takeaway that I'd like you to get from this talk is that they aren't really optional. And we will now discuss a number of use cases which, well, where namespaces are very, very important. So first one I want to mention here, obviously, is role-based access control, where namespaces provide an essential feature to make sure that authorization is properly enforced in a cluster at the users or at the workload level through service accounts. Don't need to go through the different RBAC resources, obviously, but here we have an example of a role which grants us some level of access to a number of resources through verbs. And this is associated to a user through a role binding in a specific namespace. And why is that good? Because if we have two namespaces and we want to segregate access to a user to just the first namespace, we can effectively do that. And if we are not really segregating our applications in different namespaces, this becomes way, way harder. Moving on to networking, we will see a number of slides here with regards to this. And there are actually several networking features that depends on namespaces configuration. First one we see here is actually the internal DNS resolution in a Kubernetes cluster. So by default, all services and pods get the DNS name in a cluster where the namespace, obviously, is also part of that. And why is that important? Well, because this allows us, effectively, to have intercontainer network communication in our cluster, which is also across namespaces. And this all comes by default and for free. And we don't need to care about the IP addresses of our pods, right? And obviously, the services. So yeah, another important thing we want to mention here, obviously, this is a security talk. So is that by default, through these DNS names, cross namespace communication is also allowed. And yeah, there's no default network segregation in Kubernetes clusters unless we effectively enforce network policies in it. So this is an example. You see an implementation of a network policy on the left. And yeah, kind of a picture depicting it on the right. We have this pod, which belongs to a DB namespace, which has a network policy, which is basically allowing traffic to it only from specific namespaces. And this is achieved through a namespace selector configuration. In this particular example, this configuration is actually targeting other namespaces by their name through a specific label, which is Kubernetes.io slash metadata name. But we will talk about this later on. The important bit about this configuration is that the pod belonging to the other namespace, for example, the one on top, cannot really talk to our DB pod because there's no allowed network communication, ingress network communication through that. This is a bit of a newer feature. I'm not sure how many of you are familiar with the Gateway API. This is GA since October 2023. And yeah, I wasn't really familiar with it. But when I started researching into it a little bit more, I came across a very interesting feature they provide, which is called the cross namespace routing. And this basically allows us to implement separation of duties with a centralized gateway management, where the gateway is instantiated in a platform namespace. And different HTTP routes can be implemented into application namespaces. So effectively, the gateway configuration, which includes like TLS and yeah, platform level configuration is kind of centralized way away from the applications, which only manage the routes. This feature also depends on namespace selectors. So this effectively allows, in this example, only the first two applications to get public ingress, while the third application, which is supposed to be like a private application, is not allowed this level of access. So moving on from networking, let's quickly talk about security context. So this slide is obviously talking about pod security standards, which are available since 125. They are the replacement to PSPs. And they're kind of handy because they allow you to define restrictions at the pod and container security context. And you do it just by specifying different levels. So each level is mapped to a set of constraints. And we have privileged, baseline, and restricted. And for each of these levels, you can actually define an action, which tells the pod security admission controller what to do if a violation happens on the level. So you can effectively enforce a restricted level, like in this example on top, which would block a pod running as root. But you can also have a baseline level, for example, which is enforced. Or you could only audit or warn the user if a violation happens. One important thing I want to mention on this before we move on is that once again, namespace are very, very important because pod security standards are defined at the namespace level. So if you end up with an application with a ton of microservices, and maybe some of them, maybe only one of them, requires you to relax the security context restrictions because maybe as to run with some level of privileges, you will end up with lowering the level of restrictions on all the different pods in that namespace. So that's where additional namespace segregation might come into place. Yeah, we talk about RBAC, networking, and security context, but we also need to mention resource management, which also has a lot to do with namespaces. What won't do much on these slides, just want to mention that resource quotas and limit ranges are two important Kubernetes features, which are also namespace bound. With the resource quotas, you set limits to storage, compute, and object count within, let's say, at the namespace level. Sorry. And the security benefit of this is that you can effectively limit the risk of noisy neighbors in a cluster, where one application takes too many resources and basically renders other applications like non-responsive in a cluster. I've mentioned limit ranges as an additional feature on this. I see them as complementary to resource quotas because with limit ranges, you can effectively define limits for individual containers, pods, or persistent volume claims within a namespace. So while the resource quota applies to the whole namespace level, the limit ranges affect the individual instances of these resources within each namespace. And you also get an interesting bonus, which is to inject default compute requests and limits for your pods. So is that it? Have I convinced you or not about why security and namespaces are kind of something to do together? Well, it's actually more than what I've just talked about, and we don't have time to cover all the use cases, obviously. But I'd like to mention here, for example, multi-tenancy considerations, right? There's no single definition for soft multi-tenancy, but typically the way I see it is that when you are shedding the same cluster among different tenants, so you might have a tenant per namespace or set of namespaces with, I don't know, a single control plane or a number of virtualized control planes. As I said, there is no official definition, but obviously if we are considering multi-tenancy, that's where namespaces are very important, because different tenants deploy their applications into different namespaces, and we need to make sure that one application is not lowering the security of the whole cluster or compromising other applications. Other use cases are like, I don't know, secrets to pull images from private registries, which are typically defined at the namespace level as well. Custom resource definitions, which can be global or namespace. And obviously, globally defined CRDs are kind of risky, because if you are able to act on a global CRD, you can modify configuration of the cluster level rather than, let's say, at the namespace level. So that's also important. And one final example is also like PVs and PVCs, where this is kind of interesting, because persistent volumes are global, but persistent volume claims are namespaced. So you can effectively end up with some other application, like getting hold of a PV, because a PVC gets deployed before the one you are going to deploy. So there's a lot of considerations here, right? And basically what I want to tell you about this is that although Kubernetes namespaces are not as security features, they have a lot to do with security. So in particular, a lot of the things that can go wrong are about misconfiguration. And in Control Plane, we see this all the time, misconfiguration is truly a leading cause of cloud insecurity. And many, many threats are generated by either misconfiguration or lack of audit or any configuration. So we need to care about this a lot, or bad things will happen. So let's now present some examples of threats to our clusters based on namespace misconfiguration. And the first thing that I want to mention here is one interesting, let's say, operation which might not be that clear, but it's actually readily available for you in any cluster, really. So namespaces themselves are a global resource. I've said that. But a role with a role binding which allows you to patch a namespace is enough to modify an existing namespace. So this might sound counterintuitive, but effectively, if you have this level of access which is displayed here in the slide, you are able to patch a namespace and why is that a security issue? Well, we've just talked about many security and networking functionalities which are bound to namespace labels. So patching a namespace means that you can effectively modify its labels or even add new labels. And yeah, we talked about pod security standards, network policies where namespace selectors are very important. So we'll now look into more detail about a practical escalation of privilege where effectively a namespace relabeling is the attack vector. So if you are able to relabel a namespace and you are running a cluster with pod security standards, you might be able to bypass existing security context restrictions just by enforcing a privileged level, which basically bypasses all security controls. If that's the case, next step would be to run a privileged pod. And if you are actually able to run a privileged pod, then yeah, you are going to harm a cluster. And I hope I'm not saying anything which is surprising you by talking about privileged pods. But like an example here is that, for example, if you are able to run a privileged pod, you can mount the host file system, break out on the underlying node. This might be like a worker node, so you might only be able to get information from other application pods. But this might include data stores. This might be CI pipelines, so there might be secrets there. But if you are very unlucky, and this is an on-prem cluster, the pod might even be scheduled on a control plane node by using specific configurations to force a pod on a master node. And you might even be able to steal highly privileged tokens. And yeah, that's really game over for the whole cluster. Talking about network policies and labeling, well, you might be able as an attacker to bypass an existing network policy restriction through relabeling of an empty space. So in this example here, we have this other NS which wasn't previously able to talk to our DB. But if you understand that as an attacker, so if you get information about how the namespace selector is built through a network policy in the DB namespace and you can effectively relabel your namespace, you might grant yourself additional access, OK? And example on the Gateway API is very, very similar, so I don't want to spend much time on this. So yeah, basically namespace selectors are used with Gateway API cross-namespace routing, so if you can modify, for example, this public Gateway label in your namespace, you might provide an existing HTTP route public ingress. And effectively, this can result in very bad things like hijacking of shared gateways, exfiltration of data, unauthorized access to internal phasing applications. Once again, talking about networking and namespaces, this attack doesn't have to do with the labels, but with how namespaces are named. And this might not be so straightforward, so bear with me. So due the way internal DNS resolution works, we might be able to spoof DNS names by naming our namespaces as top-level domains. So in this example here, we have a namespace which is created with the com name and we create a service in it, which is called GitHub. And effectively, yeah, any pod, any client, which is just using a relative DNS lookup in our cluster, will use the local domain search list for this DNS name, which is displayed at the bottom of this slide. This is injected through core DNS. And effectively, this might end up with a DNS resolution which is local to the cluster and not on the public internet. So depending on the way DNS resolution is performed, either in a relative DNS lookup or an absolute lookup, you might end up with this local DNS lookup to actually work, which means that you can spoof an existing public domain and maybe use that for, I don't know, maybe downloading some malicious code into your pod or other bad stuff. This is actually one of the few things that are actually mentioned in the Kubernetes documentation. I want to mention that. So if you look at the documentation about namespaces, they tell you that you shouldn't allow TLD named namespaces. But obviously, there's no built-in support for that. We will see something later on about this. Last kind of threat I want to talk about is obviously a very broad category. This is denial of service. I'm pretty sure everybody knows what this means. And in the context of namespaces, this has to do with the improper resource quota limit range configuration or non-existent configuration of those things. And some of the examples we get here are, for example, noisy neighbors actually taking over of a cluster with the lack of resource quotas, which can be a big problem because even system pods running on the same cluster might become unresponsive due to noisy neighbors or controllers, operators. And effectively, this will break your cluster or make your whole cluster unresponsive. So you have to be careful with this. Talking about storage, couple of interesting examples. The first one is a bit more trivial, probably. If you don't have any kind of limit on your PVC sizes, you might end up with filling up your storage very quickly, which might be your disk if you're using like local storage drivers or even like cloud storage. And this might actually also be like a billing problem if you're using cloud storage. Another interesting thing which is also found in the Kubernetes docs is that secrets themselves can get pretty big. So you might want to have limits on the number of secrets. You can instantiate per name space because that's also a possibility for creating many, many secrets so much that you exhaust the node storage, which will once again result in rendering the cluster nonresponsive, which might make it non-functioning. Talking about limit ranges and here in this context, there's one particular example which is also interesting with regards to misconfiguration, which is that if you don't set your limits right, you might end up with causing denial of service for yourself, for all the pods whose request for a specific resource like Compute exceeds the defined limits. So if you define limits, be mindful of the actual load of your application, right? And yeah, the final thought about this is that all I've been talking about is already scary if you're running your cluster for your company, but if this is like a multi-tenants scenario, so these are different teams, these are maybe different organizations, this can get even worse. So you obviously will end up with breaking down like the isolation model within Kubernetes, rendering other tenants nonresponsive, which will definitely be a bigger issue in this context. So this is just an example, this is just a subset of threats that depend on namespace misconfiguration. So what can we do about it to make this better for us? And the good part about this is that we don't need to buy fancy software to solve most of this. This is the important bit. So first of all, I talk about this all the time as I'm doing security all the time is, least privilege or back is still probably the most important mitigation you need to put in place. So you should carefully understand if your use case requires any form of access to namespace objects, read-only namespace objects should be the default if you need access to namespaces unless your application or operator or whatever actually needs to modify them. This also means, and we have a quote here, very famous quote, this means that you should not have wildcards as much as possible on resources and verbs when defining roles in a cluster. You should also be careful about cluster role bindings. We haven't really talked about that a lot because cluster role bindings effectively only apply to cluster roles. So this will grant you some level of access on global resources most of the time and if an attacker has any access to them, this is a likely point of escalation because they will try to move towards namespaces that hold most sensitive data in a cluster. Final remark on this, regardless of you allowing changes to namespaces, you should log them or detain them regularly. So is it safe to actually grant read access to namespaces? Well, kind of. As we've seen so far, namespaces can still leak a lot of information which is not sensitive per se but might be useful for attackers. Like if you can list all namespaces in a cluster, for example, you might understand that there are specific cluster components running or that there are specific applications running and we know that namespace names are also part of the DNS names of those applications. Obviously, if you can get an understanding of how a namespace is configured, you understand if there's a pod security standard level attached to it or if there are any custom labels that might be used by attackers. Yeah, one final remark I have about namespace selectors is that, and we just touched on this in one of the earlier slides, is that whenever you have namespace selectors, you should be looking into using the Kubernetes Ion metadata name immutable label. This explicitly requires the owner of the resource which has a namespace selector to mention the namespaces which are allowed to access that resource by name. And obviously this might be a bit more maintenance effort because you cannot use just whatever label, but at least this cannot be modified or deleted by attackers. So a lot of the attacks we've seen before might be mitigated by having this approach. When talking about multi-tenancy, soft multi-tenancy, our recommendation is that namespaces shouldn't be really managed by the tenants. So we look like into internal development platforms nowadays and a lot of resources can be self-provisioned by these platforms, but namespaces shouldn't really be self-provisioned and actually tenants shouldn't really have a say on the labels which are applied to these namespaces or even the names that are applied to these namespaces. This should be assigned by the platform admins if possible. And if you want to enforce these or if you need, for example, your tenants to have some access to namespaces, that's where additional controls can be implemented through policy engines. And yeah, I'll be very quick about this. This is a, you will see now a number of examples about policies. These are all Qiverno policies. There's no particular reason for that. Opagate Keeper obviously is another important one, but what I'm going, I want to show here is that you can implement fairly easy policies which can still provide additional restrictions on what your tenants or users can do on the namespaces. And like this example here, for example, will force, well, will forbid any change to labels into namespaces which are named as like prod-something. This is like a naming convention for this example for all production namespaces. Another example I have here for you is with regards to the top-level domains we talked about earlier. You could implement a policy around that which will basically just not allow the creation of namespaces with those identifiers. Interesting thing about this is that I downloaded the full list from IAEA and A and I created a policy about this and it got like the YAML file got like 60 kilobytes long. So yeah, kind of a big one. But it works. Final policy I have for you, I haven't really talked about this but this is an additional safeguard. You might want to disallow the creation of a cube-something namespaces just as a safe measure against attackers trying to hide themselves in your cluster. Okay, so you might not realize that but that's actually something which is quite important. So yeah, we finally reached the end of this presentation. Key takeaways for you. I strongly believe like Kubernetes namespaces have grown from an optional feature as the documentation says to actually a cornerstone for several security features in our cluster. So although they do not provide any isolation by themselves, a lot of security functionalities are based off them. Misconfiguration is a real thing and therefore you should restrict what users can do and you should audit changes to your namespaces in production. List privilege is the most important mitigation alongside the use of immutable labels which sounds like a trivial thing but actually isn't and this is all for free. If you then need to implement additional safeguards and yeah, this might be more relevant, for example, for multi-tenancy scenarios, you can leverage policy engines which although complex can help you define these additional safeguards which you can't implement with our back alone. So with that said, thank you very much. And...


Hey there, my name is Dr. Ankit Shah and I am a practicing radiologist at Wille Parle West and I practice at Eglad polyclinic. I also happen to be the general secretary of Muscular Skeletal Ultrasound Society. Today, I will be demonstrating the ultrasound scanning technique of the shoulder joint. From the anterior aspect, we will be evaluating the long head of the biceps, the subscapularis tendon and the acromioclavicular joint. Now, we identify the long head of the biceps on the transverse view by placing our probe along the anterior shaft of the humerus and as we scan upwards, we see the bicepital groove which is formed medially by the lesser tuberosity and laterally by the greater tuberosity. The long head of the biceps is seen as an echogenic oval structure which is prone to anisotropy. So, as I rock my probe anterior and posteriorly, you see that the appearance of the long head of the biceps changes. So, once I have scanned the long head of the biceps, I go all the way from the rotator interval superiorly till all the way down till I keep on scanning down till I see the pectoralis major tendon coming into view and that is where I stop. So, on the short axis, what we see is the biceps tendon is flush with the bicepital groove and it is located within the groove itself. It is neither dislocated nor subluxed and what we would like to look for is a possibility of a hypoechoic halo which would represent effusion within the biceps tendon sheath. Once we have seen the biceps tendon on the short axis, what I do is I carefully turn my probe 90 degrees or perpendicular to the perpendicular to what my previous position and I align myself with the long axis of the biceps tendon. So, once I have seen what I do is I scan upwards, I go all the way down, I go all the way down, I look at the long head of the biceps, go all the way down and this is the muscular tendinous junction of the biceps tendon that we see over here. Now that we have evaluated the long head of the biceps, what we do is we ask the patient to externally rotate his arm and as much as possible. So, what this maneuver does is it brings out the sub scapularis tendon. So, what I do is from the bicepital groove, I slide medially and I identify my bony landmark which is the coracoid process that I see over here. Now in this view, what we see is we see that the coracoid process is medially and as I slide my probe laterally, as I slide my probe laterally, what I see is this is a sub scapularis tendon which is forming and it goes all the way and it attaches over the lesser tuberosity. Once again I slide medially, I go all the way, I identify the muscular tendinous junction of the sub scapularis tendon in the long axis and this is a coracoid process that I see. So, while we are scanning the long head of the, while we are scanning the sub scapularis tendon in the long axis, what we do is it is important to know that it is a broad and flat tendon. So, make sure that you make these micro movements and scan the tendon from superiorly to inferiorly and the other way around. So, what I am doing over here is I am scanning the tendon along its long axis from superior to inferior over here and we make sure that you know we scan the entire length and breadth of the tendon. Once I have scanned the tendon on the long axis, what I do is I turn my probe 90 degrees from what it was initially and this is what the sub scapularis tendon looks like. It typically has a multi-penet appearance that we see its alternate areas of echogenic and hypoechoic bands that we see. So, this is the superior edge and this is the inferior edge of the tendon. While I am identifying the sub scapularis tendon, what I do is I scan the entire tendon from its cranial edge over here that I see till all the way down all the way down till its inferior edge which makes sure that I have scanned the entire length and breadth of the tendon. Once again, let me repeat it has a multi-penet appearance with alternating areas of echogenic and hypoechoic bands so do not mistake it for tendinosis or an interstitial tear. Make sure you have sweeping movements which go all the way from medial to lateral and superior to inferior. So, this way we have scanned the entire sub scapularis tendon in the short axis as well. So, from the anterior aspect one more structure that you can easily see is the coracoacromial ligament.  So, what you see over here is this nice thick band-like structure that we see over here that is your coracoacromial ligament. So, you scan medial to lateral and this is an entire thing is a coracoacromial ligament which is really seen as an echogenic linear structure over here. Third structure that we see from the anterior aspect is your acromioclavicular joint. So, the acromioclavicular joint is seen either by the palpation or what you can do is you can place your probe over the bicepital groove over here and you go all the way up you go scanning all the way up all the way up all the way up all the way up and you come to the acromioclavicular joint over here. So, laterally what you have is the acromion and medially what you have is z-clavicle. Alternatively what you can do is you can identify the acromioclavicular joint by palpating the acromioclavicular joint around the superior aspect of the shoulder or what you can do is directly drop your probe over the most bony most prominent bony protuberance along the superior aspect of the shoulder and what you see over here is the acromioclavicular joint. Once you identified the joint once again this is the cortex of the acromion along the lateral aspect medially you have the medial edge of the clavicle and between the two bones what you see is the acromioclavicular joint this echogenic structure that we see over here that is the fibrocartilaginous disc. The superior edge of the acromioclavicular joint is formed by a capsular ligament which is just superior acromioclavicular ligament. So, we scan the ac joint from anterior to posterior and smooth sweeping movements and look for any cortical irregularities which might be over there. So, now we are going to examine the shoulder from the lateral aspect over here what we are going to do is we are going to evaluate the supraspinitis tendon the infraspinitis tendon and the rotator interval along with the subacromil subdeltaid bursa. So, what we do is we ask the patient to flex his elbow and extend his shoulder. So, take it all the way back and ask him to touch his right right lower back or the right gluteal region or ask the patient to reach for the back pocket and while we are doing this make sure that the elbow is tucked in or as close to the spine as possible. This is typically known as the modified crass position so that when the patient does this maneuver what happens is the entire supraspinitis tendon comes out below the acromial edge and we can assess the entire supraspinitis as well as the infraspinitis tendons. Once the patient is in the modified crass position what I do is I place my probe along the long axis of the supraspinitis tendon. So, what I see is the rotator cuff is seen as a beak shaped appearance birds beak appearance that we see over here. So, as a beginner it is always a good idea to count all the layers from the top. So, on top you have the most echogenic layer which is your skin and the subcutaneous tissue followed by you have the deltite muscle you have the subacromial sub deltite bursa below the muscle and this is seen as a thin echogenic line it is a potential space. So, it will be collapsed and because of the peri bursal fat it is seen as an echogenic line and below the subacromial sub deltite bursa is your echogenic supraspinitis tendon which has a fibrillary pattern below that you have the hypoechoic articular cartilage and just below that you have the below that you have the echogenic cortex of the humeral head. The supraspinitis tendon is seen as an echogenic beak like structure as I had said. So, how do I make sure that my tendon fibers are seen absolutely parallel without any anisotropy what I do is you take a look at the fibers of the deltite muscle belly superiorly. So, if you see these echogenic lines which are parallel that means you your probe is parallel to the supraspinitis muscle fibers or alternatively you come anteriorly you identify the long head of the biceps and try and scan in the long axis in that plane. So, what we do is we scan the tendon from anterior to posterior this is a cuff as we go as we go as we go posteriorly we see that the supraspinitis ends and infraspinitis tendon that we see. Again I come anteriorly and this is what this is how we scan the entire cuff and the long axis often at times it is difficult to identify on the long axis which is a supraspinitis tendon and from where does the infraspinitis begin. So, what we do is we can have a look at the greater tuberosity. So, look at the morphology of the greater tuberosity anteriorly anteriorly it is a little bit more sharp and as we go posteriorly the morphology of the greater tuberosity changes and it becomes more rounded. So, when the greater tuberosity appears a little bit more rounded you are more likely to be in the space of the infraspinitis and as you come anteriorly it is more likely to be supraspinitis due to the sharp edge of the greater tuberosity. One more thing to note is as this supraspinitis tendon fibers reach the greater tuberosity what you see is that this there is this little bit of anisotropy which is happening and the tendon may appear hypoechoic because this is because there is curving of the fibers. So, one way to reduce that anisotropy is you go a little bit laterally and you angle the probe and reduce the anisotropy as much as possible. So, what we see over here is we have reduced the anisotropy and we kept the tendon appears ecogenic with this normally normal fibrillary pattern all the way till the greater tuberosity. Now as the tendon approaches the greater tuberosity along the footprint you see a small hypoechoic area and this is a fibrocartilage because this is where the tendon attaches over the greater tuberosity. So, once we have identified the rotator cuff tendon in the long axis what we do is I turn my probe 90 degrees gradually very carefully I turn my probe 90 degrees and I evaluate the rotator cuff in the short axis. So, this is what the cuff looks like. So, this is a anteriorly what I see is a biceps and posteriorly what I see is a supraspinitis a little bit more anteriorly I see the kefalate fibres of the subscapularis tendon. So, as I go a little bit more posteriorly once again that is the subscapularis tendon that is the biceps tendon at the rotator interval this is the supraspinitis tendon all right and this is the infraspinitis tendon coming in. Now how do I differentiate between the supraspinitis and infraspinitis on the short axis it is a little bit simpler than doing it on the long axis. So, as I go laterally as I go laterally you see the humerus is gets divided into at least two facets over here. The facets of the greater tuberosity have typically a configuration wherein anteriorly you have the more flattened facet which is where your supraspinitis tendon attaches a little bit more posteriorly you have an oblique orientation of the facet where your infraspinitis tendon attaches and as you go a little bit more posteriorly you have a vertical facet where your teres minor tendon attaches. So, this is how the tendons attach over the greater tuberosity and as we go anteriorly as we scan anteriorly just anterior to the supraspinitis tendon what we have is a rotator interval. The rotator interval is formed between the supraspinitis tendon superiorly the subscapularis tendon inferiorly and the floor of the rotator interval is formed by the head of the humerus. Now looking at the rotator interval it consists of three structures which is the coracohumeral ligament, the biceps tendon and the superior glenohumeral ligament. It is important to know the contents of the rotator interval and its clinical significances that it is one of the dynamics stabilizers of the shoulder joint and it is commonly involved during adhesive capsulitis or frozen shoulder. So, what you see over here is the at the rotator interval is the biceps tendon is kind of enveloped by a C-shaped structure that we see over here and this C-shaped or the inverted C-shaped structure is formed by superiorly by the coracohumeral ligament and inferiorly by the superior glenohumeral ligament and this entire structure what we see over here that is known as a biceps pulley. So, from the posterior aspect what we will be covering is the supraspinitis muscle belly, the infraspinitis muscle belly, the teres minor muscle belly and the tendon as well as the posterior joint recess. Apart from that we will also be looking at the suprascapular nerve at the level of the suprascapular notch and the spinal glenoid notch. So, for that the most important bony landmarks that we need to remember is one thing is a scapular spine. If it is a bony or if it is a thin individual what you can do is you can you will be able to palpate the scapular spine because it is important because it divides the rotator cuff muscle bellies into the supraspinus fossa and the infraspinus fossa and so your supraspinitis muscle belly arises from the supraspinus fossa, infraspinitis muscle belly arises from the infraspinus fossa. So, that is a good way of remembering. So, what I do is I begin scanning the posterior shoulder by placing my probe along over the spinus process and what I see is inferior to the spinus process I have the infraspinitis muscle belly whereas superior to the spinus process what I see is a supraspinitis muscle belly. So, once again supraspinitis this is a infraspinitis and as I go a little bit more below I see is a teres minor muscle belly over here. The lateral part is not well visualized because of the shadowing of the acromion and now what I do is I gradually turn my probe 90 degrees and evaluate the muscle belly in the long axis as well. So, this is how the muscle belly looks like you see the nice muscular tendon is junction and as I go laterally like I said because of the shadowing of the acromion and the coracoacromion arch you do not see the entire supraspinitis tendon. Once I have evaluated the supraspinitis muscle belly what I do is once again I come back to the scapula spine and as I go inferior to this scapula spine what I see is this is the infraspinitis muscle belly. As I screen in the short axis from medial to lateral as I am coming laterally as I am coming laterally I see the infraspinitis muscle forming into a tendon and it forms the proper tendon of the infraspinitis. After I have identified the infraspinitis muscle belly on the short axis I turn my probe 90 degrees I evaluate the infraspinitis muscle belly go all the way laterally all the scan laterally and this is what the infraspinitis tendon which forms it crosses the glenohumeral joint and it goes and inserts over the greater tuberosity over here. Below the infraspinitis what you have is a teres minor muscle belly which starts along closer to the lateral aspect of the scapula. Now it might as a beginner it might be difficult to identify or differentiate between the supraspinitis and the teres minor muscle bellies. So, what you can do is you can scan from medial to lateral and as you go laterally as you go laterally you see that both the tendons are forming. So, that is the infraspinitis tendon on top and this is a teres minor tendon which is forming over here and it attaches over the lesser tuberosity. So, that is the infraspinitis tendon and that is the teres minor tendon. So, as once again as I go scanning medially I see that they are forming into a muscle. So, as a practical point it is much more easier to identify the infraspinitis and teres minor muscle bellies on the short axis along the lateral as far lateral as possible. So, we identify the glenohumeral joint either by scanning through the infraspinitis muscle belly or what we do is we identify the inferior axillary fold and what we do is I put my probe on that and as I go up I go scanning up I go scanning up and I identify two bony landmarks. So, medially my bony landmark is a glenoid which I see over here and laterally what I see over here there is a humeral head the echogenic humeral head which is covered by the hypoechoic cartilage. So, between the humeral head and the echogenic glenoid what we see is a triangular structure which is which has an echogenicity which is slightly less than that of the cortex and this is the glenoid labrum that we see and just above the labrum there is a muscle that we seeing over here and this is your infraspinitis muscle that we see over here. So, when we are looking at the glenohumeral joint what we do is we scan the entire joint recess from superior to inferior and as we go up. So, if at all you have to inject within the glenohumeral joint your needle would come from lateral angle towards the glenohumeral joint and between the glenoid and the humerus. The posterior joint recess is a great way to demonstrate glenohumeral joint effusion. So, what you do is you ask the patient to gently internally and externally rotate the humerus or his arm and what we see over here is if at all if there is any joint effusion it will pop up through the posterior joint recess. So, what we are seeing over here is we are seeing a humeral head which is rotating internally and externally this is the glenoid and that is triangular structure that we see just lateral to the glenoid that is your glenoid posterior glenoid labrum. So, from the posterior aspect now what we are going to do is we are going to evaluate or we are going to try and trace the path of the suprascapular nerve. We in the standard shoulder examination we evaluate the suprascapular nerve which starts from the brachial plexus courses along the posterior triangle and then it enters the shoulder girdle where the suprascapular notch it travels through the supraspinus spina sphosa gives a branch to the supraspinatus and it winds around the spina glenoid notch and gives a branch to the infaspinatus. So, we evaluate the suprascapular nerve at the level of the suprascapular notch and at the level of the spina glenoid notch. One way to identify the suprascapular notch along the superior border of the spinus you identify the spine of the scapula and what we do is we gradually walk your probe walk your probe anteriorly walk your probe anteriorly and you look at the notch over the scapular spine. So, what we see over here that there is a notch that we see over here and there is a defect in the superior cortex of the scapular spine and this is your suprascapular notch. If you are unable to see the nerve at least what you can see is there will be a certain structure that you see pulsating over here that is the suprascapular artery and the suprascapular nerve is right next to the suprascapular artery that we see. You may or may not be able to see the signal on color Doppler but that is not a problem what you can do is you can just even on your grayscale you will be able to see the pulsations of the artery. So, we evaluate the spina glenoid notch below the level of the suprascapular notch and that is where we see the suprascapular nerve after it has given a branch to the supraspinates. So, what you do is you evaluate you identify the glenohumeral joint and gently slide your probe medially and right below the infaspinates muscle belly you see this valley like structure and that is your spina glenoid notch. So, laterally you have the glenoid medially you have the spinous process and nestle between them that is your suprascapular nerve. If you are unable to identify the suprascapular nerve just look for the pulsating suprascapular artery and your nerve will be right next to that. So, sometimes what happens is if there is a small tear in the posterior superior labrum you might have a parallel cyst forming which courses medially which courses medially and which ultimately comes to the spinoglenoid notch and it will compress the nerve resulting in infaspinates atrophy. To look for subacromial impingement we do dynamic evaluation with the patient standing we place a probe along the lateral aspect of the acromion and ask the patient to abduct the arm and take it down again abduct the arm take it down. So, what we do is we look for sliding of the supraspinates below the lateral edge of the acromion and look for sliding of the bursa as well. So, what I am seeing over here is that there is smooth sliding of the greater tuberosity as well as a supraspinates standard below the acromion edge. We evaluate acromion clavicular joint in dynamic imaging by asking the patient to touch his opposite shoulder repeatedly and extending the shoulder with his elbow flex. So, this is what is known as the SCARF test. So, what we look for is if there is widening of the acromion clavicular joint space or if there is abnormal movement between the acromion and the clavicle that we see over here. So, if we see over here although that the patient is moving that there is no significant movement which is happening at the level of the acromion clavicular joint. There are a lot of pain generating structures within the shoulder. Hence, shoulder is one of the very few joints in muscular skeletal system which requires a standard protocol based approach. Hence, it is a good idea to do a systematic examination doing scanning the shoulder from the anterior aspect looking at the biceps, the subscapularis, the acromion clavicular joint from the lateral aspect looking at the supraspinates and the infraspinates tendon the subacromial subdeltoid bursa and from the posterior aspect to assess the muscle bellies of the supraspinates infraspinates and the teres minor and of course, do not forget to have a look at the glenohumeral joint as well. Before you go ahead with the shoulder examination it is always a great idea to have a look at the radiographs and maybe a little bit of clinical examination for whatever you know a little bit it will help you in a big big way.


We're going to be looking today at Luke chapter 19 verses 45 through 48. The final cleansing is what I've chosen to entire this installment in our study here in the book of Luke. And so beginning in Luke chapter 19 at verse 45, reading to verse 48. Luke writes, he went into the temple and began to drive out those who bought and sold in it, saying to them, it is written, my house is a house of prayer, but you have made it a den of thieves. And he was teaching daily in the temple. But the chief priests, the scribes, and the leaders of the people sought to destroy him and were unable to do anything for all the people were very attentive to hear him. So as we set this up, let's remember what we've been studying here in the gospel of Luke. Jesus entered into the city of Bethany. He entered into the city of Bethany on a Sunday night and he spent the night in that city. According to Mark chapter 11 verse 11, Jesus had gone into Jerusalem, into the temple. When he looked around at all things as the hour was already late, he went out to Bethany with the 12. Now Bethany is just a few miles southeast of the city of Jerusalem. So as we pick up this story right now, it's actually Monday and Jesus is returning to the city of Jerusalem. Mark tells us in Mark 11, 12, the next day he came out from Bethany. And then in chapter 11 verse 15 of Mark, it says they came to Jerusalem and Jesus went into the temple. And so that's what's taking place. This is a Monday. Jesus had entered into the city of Jerusalem on what we call Palm Sunday. He walked into the temple area. He surveyed it and as he did so, he left because the hour was late. He went just a few miles southeast to a small city, a village really called Bethany. Spent the night there. Next morning, gets up, it is now Monday and he goes into the temple once again. Now this temple, as we've looked at it in Scripture, was the center of Jewish religious life. The temple is the center of the worship of the nation of Israel. It's the place where the Jewish believer would meet with their God. Now under Moses, the nation of Israel met in a portable tent. It was called the Tabernacle. It wasn't permanent at all. It was simply a portable tent of meeting because the people of Israel, the children of Israel, the nation had yet to enter into a promised land so there was no permanent structure. When God was given them orders concerning worship of him in the book of Exodus in chapter 30 verse 6, he said, put the altar in front of the curtain that is before the ark of the testimony, before the atonement cover that is over the testimony where he says, I will meet with you. And so the Tabernacle, which later on when it was constructed became the temple, was a place where God would meet with the children of Israel. In the history of Israel, David had a son, King David had a son. His son's name was Solomon. And Solomon built the temple in order that it might be a permanent place of worship and he did so in the city of Jerusalem. And when he finally finished the construction of that temple, he prayed and as he prayed, this is what he prayed. It's recorded in 1 Kings chapter 8 verses 28 and 29. He's praying to the Lord God and he says, give attention to your servant's prayer and his plea for mercy, O Lord my God.   And so as he's praying, he says, Lord, and he reminds him, you said that you would be there with us. You said, my name shall be there. And then according to 1 Kings chapter 9 verse 3, God's answer came to Solomon and the Lord said to him, I have heard the prayer and plea you have made before me. I have consecrated this temple which you have built by putting my name there forever. My eyes and my heart will always be there. And so the temple was the center of religious life in the nation of Israel. It is where Israel would meet with their God. It was at the temple that they would make their sacrifice. It was at the temple that they would pray that they would worship him. And now Jesus is entering into this temple and as he enters into the temple he has one intention and that is he's about to cleanse it. Now he's not just physically going to cleanse the temple. He's cleansing it from spiritual pollution. This isn't the first time that he does this. This is actually the second time recorded in the New Testament that Jesus cleansed the temple. It's recorded in John chapter 2 verses 13 through 17 that he in the beginning of his ministry actually had gone into the temple and had originally cleansed it. In John 2, 13 through 17, John writes, the Passover of the Jews was at hand. Jesus went up to Jerusalem. He found in the temple those who sold oxen and sheep and doves and the money changers doing business. When he had made a whip of cords, he drove them all out of the temple with the sheep and the oxen and poured out the changers money and overturned the tables. And he said to those who sold doves, take these things away. Do not make my father's house a house of merchandise. Then his disciples remembered that it was written, Zeal for your house has consumed me. So he had done this at the beginning of his ministry. Why does he have to do it at the conclusion of his ministry? Well it's because hardness and habits of sin are not necessarily cleansed the first time they're dealt with because God sometimes has to come back and repeat the action. He does it in our lives. He does it in mine. Just because I'm convicted, repent, turn away from something doesn't mean that later on. Two, three, five years later I might not begin flirting with that sin again. And so he's going to come back and cleanse and come back and cleanse and continue doing so. And that's a good picture here of how God continues to work to bring purity into a person's life. He did so with the temple. Now as I said he had arrived on Sunday in the city of Jerusalem. He spent the night in the city of Bethany. No doubt thinking about what he had seen. He comes back the next morning. There he is in what is called the outer court or the court of the Gentiles. And as he's there he can see in this area that booths have been set up for the purchase of sacrificial animals. There are tables that have been set up for those who exchanged money. Because shekels were the only coins permitted for money offerings or purchase of sacrificial animals, a foreigner who would come in bringing their foreign currency would have to have it exchanged there in order that they might purchase a sacrificial animal. And so they had the money changers there. So obviously corruption had crept in. There were high exchange rates that were now being charged and they were defrauding the pilgrims who were coming in to worship the Lord. As he goes in he sees that there are people there selling oxen, they're selling sheep, doves, oil, salt, all of this for the Passover festival. It's now like a marketplace, like an open air market. Some of us have gone to these where you go in and they do have the animals in pens and it smells and it's noisy. And that's what the temple is like in that outer court. It stinks, it's noisy. It's not the kind of place that you can come in and have a quiet time of teaching and meditation because it's now being desecrated. It's being profaned and pilgrims are being defrauded. There's a prophet that's being made off of the sincere pilgrims who came to celebrate the feast. Now what was it that they were doing to make a prophet off of these pilgrims? Well, remember they needed to have offerings. And so what happened is they set up concession stand fees and they charged the people when they would come in with their animals to have the animals inspected. What they would do is they would walk in with a sheep or a proper animal for sacrifice, a dove or whatever. As they brought it in, they had the inspectors there who would look at them and often would say, I'm sorry, but this animal is defective, it's not proper, it cannot be used as an offering to God. You see, the Bible tells us in Leviticus in the Old Testament, chapter 22 verses 21 and 22, when anyone brings from the herd or flock a fellowship offering to the Lord to fulfill a special vow or as a free will offering, it must be without defect or blemish to be acceptable. Do not offer to the Lord the blind, the injured or the maimed or anything with the warts or festering or running sores. Do not place any of these on the altar as an offering made to the Lord by fire. And so they would look at these animals and they'd say, oh, this has a running sore, this thing is just not perfect and so they would take it, they would re-pin it, and then they would sell them an animal at an exaggerated cost as they were declaring the animals unfit. And what they would do is they would charge them more and rip them off. Sometimes the pilgrim would pay up to ten times the value of the animal. You can imagine with the thousands of pilgrims who were there how much money was being made as they were being ripped off. Not only would they come in there and have to buy a sacrificial animal, but at that time also the Jews would come in to pay what they called the Temple Maintenance Tax. Do you see that in the book of Exodus in chapter 30 verse 13? And so foreign currency was regarded as being unclean, so you would have to take your dollar and exchange it for shekels, but they would charge you something like 25% for the exchange. So the result was again an incredible amount of profit. Now the former high priest Anas was the one who was making the profit. This was actually at the time of Christ called the Anas's Bazaar.  And so as the Lord Jesus Christ walks in, notice verse 45, notice how it says he went into the temple and began to drive out those who bought and sold in it. His immediate response was to once again drive them out. He drove them out of the place. He drove all of them out who were buying and selling in that temple. Not only that, but Mark tells us in chapter 11 verse 16 that he would not allow anyone to carry wares through the temple.  And as he does, so verse 46, he says, it is written, my house is a house of prayer. You have made it a den of thieves. You got to angry. The temple is not to be desecrated like this. Now, when Mark speaks of the same event in Mark chapter 11 verse 17, he says, is it not written, my house shall be called a house of prayer for all nations. That's the full scripture. That's found in the book of Isaiah chapter 56 verse 7. My house shall be called a house of prayer for all nations. You see, when you went to the temple, it actually had four courts. It was divided into four courts. You had what is called the outer court. You had the second court, the court of the women, the third court, the court of the men, the fourth court, the court of the priests. The outer court was a court of the men. It was also referred to as the court of the Gentiles. It was the outer court. The outer court area is where all of this is taking place, and it's the one place that a Jewish person and a Gentile could actually come together in the worship of God. It's the only place where the nations could assemble in temple precincts. The other three courts, the women, the court of the men, the court of the priests, were restricted to Jews alone. The outer court, the court of the Gentiles, the outer court is a place where a Jew and a Gentile could actually worship together. The only place in the structure, and so that's where all of this is taking place.  The temple isn't a marketplace. It's his father's house. It's a place of worship. Now when you read this, how that Jesus did this, he began to drive out those who bought and sold in it. Do you guys remember, some of you are old enough too? Others, let me give you a brief history lesson. There was a guy who used to coach, I think it was Indiana. His name was Bobby Knight. Anybody remember that name, Bobby Knight? He's very famous because he used to pick up chairs and throw them across the court at referees and stuff. I mean, the guy was a monster. He'd get angry at a call, and he'd pick up a chair and throw it. He grabbed his players, and he was very violent. What is Jesus a spiritual Bobby Knight? Is that's what taking place here?  Listen, I have had people who have seen this event and have spoken to me about it and said, well, Jesus meek and mild, loving, how could a meek, mild, loving, compassionate savior get so angry? They don't understand the concept of a righteous indignation. There is a time to have an indignation in your heart over injustice. There is a time, and it's proper when you hear of babies being murdered in the womb. The church ought to be indignant about that. The church ought to be angry about how that is looked at as being okay. I remember many years ago when Columbine occurred. All of us were old enough. Remember Columbine? I have a friend of mine who passed Calvary Chapel out there in Columbine, and he went and ministered when that took place, was ministering to so many people, members of his church, had kids who went to the high school. When that went down, my friend was out there ministering and did a lot of ministry amongst the shell-shocked community, the shell-shocked parents, and the thought that kids, some young high school kids could enter into a school and could just randomly take the lives of people, shock this nation, shocked us as a nation as it should have. I remember speaking to our congregation when that took place so many years ago, and I remember saying this to our congregation. I said, would you not think that the safest place for a child should be a classroom? Wouldn't you think that?  And my congregation at that time nodded their head in agreement. Yes, you would think that's the safest place for a child.  When you begin to diminish the value of life in the womb, what surprises you about somebody taking a gun and shooting a child in a classroom? Why should that surprise you? And yet we still remain surprised when we see the violence in the nation that we live in, the violence that we see as acceptable, that is even a sport, the violence that we see today that we say is okay. As a nation, we've got our values backwards. We really do. We get angry at the wrong things. We get angry at the wrong things. Or we get angry at one thing that it's right to be angry about and aren't angry about things that we ought to be angry about. I watch TV like you do, most of you, I'm sure, watch TV. And as I'm watching TV, they have words that are censored on just ordinary channels. They're censored. You'll see the words, their mouths moving, and then some other word comes out and you know they said something that was pretty nasty, shouldn't have said that. It's censored. It's interesting to me how you cannot say certain words, but you can, because they bleep it out. But you can say God's name in vain and nobody bleeps that out. That amazes me. Ethnic slurs are bleeped out. But taking the name of the Lord thy God in vain is not. Americans get angrier at ethnic slurs than they do over God's name being used improperly. I find that twisted. I think you've got to be angry about both. But what do we end up with? Well, no, you can say God's name. It's okay. But don't say this. We get angry over secondhand smoke. We ban commercials for cigarettes on TV. But we don't have any problem at all with a variety of other sins that are absolutely immoral. We just don't have a problem with that. I think there is a time, a right time, and no, I'm not saying let's go march.   I'm not saying that if you want to. No, I'm not saying that. I'm not of that stripe. I do not go for that at all. I'm not into that in the least. What I'm saying, though, is there's got to be a passion in our heart for the right kinds of things. And there should be something inside of us that, though it doesn't express itself through violent action, it should be something that is very strong in us so that we're willing to go to the mat for some things. So you're with three or four friends and they're saying things that are improper about the Lord, about Christianity in general, and we sit there quietly and say nothing. Well, they just constantly say things about the church, about the Bible, and we don't say a thing about it, because we just don't want to cause problems. Now, there are times that we need to say, excuse me.  You know, we need to come out of the closet ourselves as Christians. We need to stand up and say, this is what I believe. This is what the Word of God says. Now, part of the reason we don't do that is because we're still learning what the Word of God says, and sometimes we're afraid. Sometimes we don't want to say the wrong kind of thing, but I learned a long time ago, if I'm quiet, my silence is in agreement with their position. There are times that I have to say, you know what, I don't agree with you. I don't want to necessarily get you angry at me, but to be honest with you, I disagree with what you're saying, and this is the reason why. I learned to do that when I was about 23 years old. I started learning actually earlier, 2021. I started learning to do that. I started doing it in classrooms at the age of 23 to professors. And I'd say, I disagree with that.  I didn't want them to think that I was going to sit there not in agreement with everything they said just because they have a PhD and I don't, because I know one thing is true, and it's the Word of God. And what I decided was to begin to see what God valued because the things that he values, I want to value. The things that he doesn't value, then they're not worth valuing. It's just that simple to me, and that's what you do as you study the Word of God. Some things are valuable to God, and some things are not. Some things are enough to make him angry. And this is something that we see with the Lord Jesus Christ. He walks into the temple. It's the second time he's done this.  You have made it a den of thieves. It's a house of prayer for all nations. You see, one of the lowest things a person can do is to take advantage of somebody's religious faith. I find it interesting in political years and election years that we have in presidential elections. We have politicians who start talking about their Christian faith, their favorite books of the Bible, their favorite scriptures. They talk about being saved or born again, and they use it to their own profit. You know, what you are every other year is more important to me than what you're saying you are right now. I'd like to see a consistency in your walk with God when votes don't matter, when it's just between you and in your conscience in God. I'd like to see that. God's intention for the temple was for it to be a place of worship for him. And Jesus, as he's upset here, is actually combining two Old Testament scriptures. He's combining the book of Isaiah 56 verse 7, my house shall be called a house of prayer for all nations. And Jeremiah chapter 7 verse 11, where the question is asked, has this house, which bears my name, become a den of robbers to you? And so Jesus sees his father being blasphemed. Jesus sees the temple being desecrated. It moves him to action, and he responds with a righteous anger towards those who are doing such a thing. As we read in John Psalm 69 verse 9, gives to us insight into what is driving him, zeal for your house has eaten me up. Those who should have known better were disillusioning the people. That's because religion sells well. There was a time in this church, and I don't know. Some of you perhaps were with me in the early days. I was a lot more open about things than I am now. And I would stand up and I would say things. I would name names, and I would warn my congregation over and over again, watch out for these people, they're charlatans. And I didn't have a problem saying that. I didn't have a problem saying that at all because they were. And they would do things. They would sell holy hankies and blessed water and all kinds of nonsense. And it used to just get me so upset. And I'd come out here and I'd bubble over in this pulpit and I'd say, watch out. Oh, did I ever get people upset? Because even Christians have their groupies and the groupies would get upset at me. How could you say that this is a profound brother? He's got deep things. You don't give us deep things. This guy gives us deep things and I heard it all. And the bottom line is, is it would bother me because they would say things that were just untrue scripturally. And the poor sheep, the gullible people were buying into it like the time that guy said, I'm going to say something to you that is going to go against your theology, but it's true because I know it's true. It happened to me. And then everybody gets quiet and he says, I cast a demon out of myself. And people hear that kind of thing. I cast a demon out of myself, he says. And I'm thinking, yeah, that goes against everything I believe, because it's wrong. How do you cast a demon out of yourself? You do. Look in the mirror and say, I mean, what did you do?  He's a lion demon.  You know, I've been out of the pulpit two weeks. I'm burning. These are the things that get to me. They really do, because that's the work of a hireling. That is not the work of a shepherd, you see. There are things that you ought to say, no, this is not right. This is not right. This is wrong. And Jesus is absolutely doing that. These people, religious leaders, were taken advantage of the religious faith of these innocent people. And it bothers me too, because I believe it's the heart of Christ.  It bothers me to see that, to rip off the poor and to bless them, to give them false blessings, false promises. In 2 Peter in chapter 2, the apostle Peter writes, there were also false prophets among the people, just as there will be false teachers among you. They will secretly introduce destructive heresies, even denying the Lord who bought them, bringing swift destruction on themselves. Many will follow their shameful ways, and will bring the way of truth into disrepute. In their greed, these teachers will exploit you with stories they've made up. Their condemnation has long been hanging over them, their destruction has not been sleeping. One TV preacher said that he was preaching, and he froze in one spot for like 24 hours and didn't move. People laughed and came back and he was still frozen in that spot. And then he was reanimated, and people buy that, and they give their money. They give their money to these people. Another preacher said he was preaching, and the Spirit of God was on him so intensely that he actually walked off the edge of the platform and hovered in the air without hitting the ground. Gravity was suspended, as the Spirit of God held him up, and all these poor gullible sheep are clapping and giving their offerings for an obvious madman, if he believes that. One guy told John MacArthur, every morning when I shave, Jesus stands next to me and we have a conversation. Do you believe that? And John MacArthur says, no I don't, but what scares me is I think you do. We have a reasonable faith, a reasonable faith. And when Jesus saw things that were improper, they were taking the temple, the place where you come to worship God, the place where you come, all nations are welcome to have this time of worship, and they're ripping them off, discouraging them. It caused Jesus great anger. He hates hypocrisy, and he cleans up, and he cleans up his own house first. In 1 Peter, in chapter 4 verse 17, the Apostle Peter said, it is time for judgment to begin with the family of God, and if it begins with us, what will the outcome be for those who do not obey the gospel of God? Now as the disciples watched Jesus cleansing the temple, they saw that it is proper to be righteously upset over certain things. Because the temple was to be a house of prayer for all nations. Meaning that faith in God is something that God desires all people to enjoy, not simply the nation of Israel. You see, early in Jesus' ministry, he had begun sending his disciples out to preach his message, and at first he told them, go to the lost sheep of the house of Israel. He said that in Matthew chapter 10 verses 5 and 6, when he says these 12, Jesus sent out and commanded them saying, do not go into the way of the Gentiles, do not enter into a city of the Samaritans, go rather to the lost sheep of the house of Israel. And so originally as he was sending his men out, they were to restrict their message to the nation of Israel. But after Jesus' death and after his resurrection, they are now sent throughout the whole world. Go into the whole world, Jesus said, and preach the gospel. Make disciples, and that's a responsibility. Because God's intention is to save all who will place a saving faith in Him. That's why in Revelation chapter 5 verse 9, looking at the redeemed, it says they sang a new song saying, you are worthy to take the scroll to open its seals. You were slain and have redeemed us to God by your blood out of every tribe and tongue and people and nation. God's desire is to reach us all. I thank God that the gospel of Jesus Christ went from Jerusalem into Judea into Samaria and unto the uttermost parts of the earth, which means it came to us here in the United States. And we got a chance to know the God who loves us and gave a son for us. God's intent to be worshiped by all nations. And anything that disrupts that, he's angry about. On a practical level, as I was preparing this today and I started thinking about it just a little while ago, I thought about it again, and I realized that I could be a stumbling block too to people. And I don't think that the Lord Jesus would be pleased with me in the way that I can stumble people from having a faith in Him. It's been said that a professing Christian who lives an ungodly life is just as dangerous as a false prophet or a heretic. Because you're preaching a false message by living a message, living a life that undermines the power of the gospel message. Because the gospel message is one that says that God will transform your life. Isn't that what we tell people? If any man be in Christ he's what? A new creature. All things are what? Passed away. Behold, all things are become new. So I say to people, and I do, you can have a new life in Christ, but I live as if I'm in the old life. And I'm undermining the power of the gospel in my living presentation of it. Because the gospel is presented not just with words, but with works also. Words and works going together. The actions and the attitudes, the beliefs and the behaviors. The gospel transforms lives. No, we're not perfect. No, we're not going to be perfect this side of heaven. But we should be better than we were yesterday. I should be better than I was last year. I should be better today than I was 34 years ago. I should be moving closer to the things of the Lord. If I'm in the word, if I'm in prayer, if I'm walking in fellowship, if I'm sharing my faith, those basic things, if I do that on a daily basis, I guarantee you my life changes. It changes. It changes. But a lot of us, unfortunately, we go two days with the Lord, then we backslide for five. Then we walk two or three more days, and then we backslide for two weeks. Then we walk with him for three weeks because we're really upset at what we've been, and then we backslide again for another week. And that's our life. Two steps forward, one step back. Two steps forward, one step back, and we constantly do that. Well, God, in his word says, He can give me a new life, but I need to say, Lord, then give me that new life. And that's why I wake up every morning and say the same basic thing, God, I need your help today. I need your help today. Because without your help, I'm not going to make it. God, I need your help today because I don't want to be a misrepresentation of the gospel. And I can be a stumbling block, and I realize that.  That temple there was a place of prayer, but because of the merchandising of religious faith, it had become a den of thieves. Now in verse 47 it says, He was teaching daily in the temple, but the chief priests, the scribes, and the leaders of the people sought to destroy Him and were unable to do anything, for all the people were very attentive to hear Him. So as Jesus was teaching, He would teach there during the day, then He would return possibly to Bethany, perhaps to the garden there in Gethsemane. He'd rest and then He'd come back and He'd continue ministry. As this is taking place, the chief priests, scribes, and leaders of the people were seeking to destroy Him because His action of cleansing the temple infuriated the leadership of Israel. And that's because it brought delight, their hypocrisy, and greed, and they were outraged because it had been exposed. Malachi in chapter 3 verses 1 and 2 says, I will send my messenger who will prepare the way before me, then suddenly the Lord you are seeking will come to His temple. The messenger of the covenant whom you desire will come, says the Lord Almighty. But He goes on to say, But who can endure the day of His coming? Who can stand when He appears? For He will be like a refiner's fire or a launderer's soap. And so when the Lord Jesus came, He exposed these things. And not everybody likes having their sin revealed. Not everybody appreciates it.  And you might smile at them and say, Oh, thank you so much. I really appreciate that.    We don't, we don't, we don't, I don't like being told I'm wrong. Who does? Who does? One of the things though that is wise is to listen to correction. The wise man listens to correction.  If you listen to correction, your wiser still, Proverbs tells us. And that's true. Is it easy? No. What's it require? Humility? Hunger? God, I want to know you. You know, when Marie corrects me, and indeed she does, when she corrects me, don't like it.  She's such a good person. And she loves me. I know she's right. I know she's right. Because she's taken the chance of getting me upset. And she knows that I don't like correction any more than anybody else does. But when she does correct me, I listen because she sees something that maybe I'm just not seeing right now. And so I'm a wise man if I listen to her. I'm a wise man. And I'll be wiser still if I do what I know is true. But not everybody wants to be corrected. These people certainly didn't like it.  He'd done it three years earlier. He does it again. They're upset and they want him dead. Their anger is so great, they begin to seek ways to destroy him. Now they've already desired to do that and have done so for a long time.  But at this moment, they're not going to move because of the people's admiration of him. Jesus had just entered into the city of Jerusalem to the thunderous approval of the people. They had been crying out to him, Hosanna, Hosanna, blessed is he who comes in the name of the Lord that had just happened. And so they don't want to do anything. They're unable to do anything because the people, according to verse 48, are very attentive to hear him. So they can't mount an attack on him yet, but they greatly desire to do so. You see in John 11, 47 and 48, John writes that the chief priests and the Pharisees gathered a council and said, what shall we do? This man works many signs. If we let him alone like this, everyone will believe in him and the Romans will come and take away both our place and nation. What can we do? This man is doing something that has joined the hearts of people and we're going to end up being second-class citizens when we're the religious leadership. What shall we do? Well, Luke tells us later on in chapter 22 verse 2 that the chief priests and scribes saw how they might kill him, but they feared the people. Well, ultimately what's going to happen is there's going to be someone who's going to help them. His name is Judas. And Judas is going to make it possible for this to take place. He's going to make it possible for them to be able to destroy this one that they have desired to destroy for some time now. Judas. He's going to make it possible before you notice. As a matter of fact, at the end of the week, he's going to go to them and he's going to say, this is how you can do it. And he's going to make sure that Jesus is betrayed into their hands. Jesus Christ gets angry over the right kinds of things for right reasons. We should have a strong sense in our heart that some things are right. Some things are wrong. The wrong things ought to be righted. And the right things ought to be held fast too. And we ought to hold fast that line and not let the enemy move us away from our position. We're living in a time. I'm telling you, we're living in a time when people are giving up and giving in. I told you I wrote a letter to the editor that was published in the Orange County Register on a Sunday edition. It was actually placed in the center of the page there. Sunday editions of newspapers are the most heavily read newspapers. Sundays are the day that people read their papers. Some people only subscribe to one day, and that's Sunday. It's the number one day that people read their newspapers. And it just so happens I wrote a letter to the Orange County Register relating to the gay situation and marriage and all. And it was put in the center of the second page on the opinion second. Yes, it was there in the opinion section.  And it was just a whole, it was just a large section right in the center there. And I didn't even know that.   And I'll tell you why, because I believe in this one little saying, if you throw a rock into a pack of dogs, the one that barks is the one who got hit.  And so I responded to him and I told him, you're miserable. You're miserable.  You have no joy. And the reason you have no joy is you have no relationship with God. And you need that. And so I wrote him back and shared a long letter with him in response because I really believe that we're living in a time when the church had better wake up. We are that frog in that kettle of water. It's beginning to boil, but we don't notice the temperature change. And we're going to boil the death if we don't wake up. We need to start looking out at our culture realizing that we are salt. We are light. We are a voice that the Lord would have to speak to a generation that needs a clear voice. This is the way, follow it. And that's what the church is called to do. Don't be afraid to speak out for truth. Don't be afraid to stand up for Jesus Christ.   I will give you words and wisdom which none of your enemies will gain say nor resist.  I've been in your word Father I'm asking you to give me an answer to this person. Give me the ability to communicate what is true. Why? Because we want to argue no because eternity is at stake. Many years ago, I'll close with this, many many years ago back in 1985 I received a phone call member of our congregation was dying. Can you visit him in the hospital? And I said of course. He was dying of a disease that we had just begun to become aware of. It was a disease that originally was called grids but had been changed to AIDS.   Some of you know that I've said this before. But it was a new category of disease and I was given that phone call and that request to come. And as I went to the hospital and I stood outside and I looked into that window and I saw him, he had all of these tubes on his body and he hadn't entered into a homosexual relationship but he had an illicit affair and had contacted it in that way. And his wife was very dear to us who was there ministering to her husband. And Randy Walls my assistant at that time we now pastor at Calvary upland and I stood there looking into that room and I was afraid and I turned to Randy and I said I don't know how this is communicated. There are too many things as a new disease we don't know. They're wanting to put gowns on us and masks on us and I said Randy you stay outside I'm going in and Randy says no if you're going in I'm going in with you and so he and I both walk in and I'm quoting Psalm 23 I walk in through the valley of the shadow of death I will fear no evil for thou art with me and I remember that and I walk up to the side of this man's bed and he's very weak and he's lost all of this weight and as he's there his wife wakes him up and he looks at me and he motions and asks her to give him a pen and some paper and as I'm standing next to him and I was praying for him he after I prayed he writes a little something on the paper and hands it to his wife and his wife hands it to me and I'll never forget as I looked at that paper what he wrote he simply wrote these words I am eternally grateful to you and the word eternally I am eternally grateful to you I have never forgotten I have never forgotten why because he died and he went to be with the Lord because in our ministry he had come to faith in Jesus Christ and the word eternity to him wasn't something he was afraid of it was something that he was able to enter into with confidence no he didn't get healed from AIDS but he has no disease now he's walking with the Lord Jesus Christ in heaven beholding his face the gospel righteousness the grace of mercy compassion power all of that is eternally eternally important to us and when Jesus walks into his father's house and sees what they're doing to those pilgrims ripping them off my father's house is a house of prayer for all nations and you have made it into a den of thieves yes he got upset over that because God wants all men to be saved to come to a knowledge of the truth and so I as a minister I have to be careful to represent his heart sometimes I don't probably tonight I didn't very well but in some ways I do and one thing is I want to know him him in his word that we might have an eternity with him and Jesus wants that too