The National Archives is home to some of the most important records from the women's suffrage story, including the 19th Amendment. 100 years ago, the 19th Amendment became law, prohibiting states and the federal government from denying the right to vote to citizens of the United States on the basis of sex. Our records, such as petitions, legislation and court cases, tell the story of the struggle for voting rights as a critical step toward equal citizenship. The passage of the 19th Amendment was made possible by decades of suffrage's relentless political engagement. American women across the spectrum of race, ethnicity and class advanced the cause of suffrage. And even though we are commemorating the centennial, the struggle for voting rights continued well beyond 1920. As the National Archives member of the Congressional Women's Suffrage Centennial Commission, I'm honored to be a part of the commemoration of the 100th anniversary of the 19th Amendment. The success of the suffrage campaign and the fortitude shown by its supporters demonstrated that women can make their voices heard in the political arena. Women had been active as advocates for justice and reform before the suffrage movement, but with that fight they showed they could have a voice on the national stage. Without the right to vote, women knew that they were denied their full rights as citizens. With the vote, they could exert influence on elected officials and lobby for issues important to them, as guaranteed in the Constitution. This anniversary reminds us that the right to vote is not always guaranteed, but was won through the work of generations of tireless activists. We are honored to be the home of the 19th Amendment and we want the American people to join our commemoration virtually. Please join us this month at archives.gov slash women as we highlight records from our holdings and examine the fight for women's voting rights through virtual public programs for all ages. Thank you for joining us today for our 19th Amendment commemoration.


situation they haven't had in the last couple of months, well, it's very nice to come out and get back to class. The press is very grateful that they're not out in the rain. It's been a great pleasure to have had the opportunity today to meet with Prime Minister Robert Mugabe of the Republic of Zimbabwe as the first Prime Minister of Africa's newest independent state. His wise leadership has been a crucial factor in healing the wounds of civil war and developing a new nation with new opportunities. Our discussions today have covered a wide range of topics, including our bilateral relationship and regional issues. We've spoken very frankly and in an atmosphere of mutual respect. We didn't always agree, but have all gained much from hearing your views, Mr. Prime Minister. I believe that our two countries will continue to cooperate on those areas where common concerns are shared and that we will come closer to an understanding on those issues where our views diverge. The United States and Zimbabwe have much in common. We both came to independence through a revolutionary process. We're both multiracial societies, and our constitutions offer protection to all our citizens, black and white, ensuring their political freedoms as well as their individual rights. I'm glad to say that since Zimbabwe's independence, relations between Zimbabwe and the United States have been very good, and strengthened by this exchange of views will become even better. We looked at Zimbabwe for leadership in Southern Africa. Blessed with natural resources, a hardworking, multiracial population, and a spirit of national reconciliation, Zimbabwe can provide a firm foundation of economic viability and political stability and serve as an inspiration in its part of the world. Mr. Prime Minister, our talks today have confirmed that we also share a desire for peace and stability in Southern Africa, and I know that we both look forward to a time when all countries there can achieve a level of amity which will allow them to work toward economic, social, and political development free from the threat of attack from whatever quarter. The ultimate responsibility for resolution of their problems, however, rests with the states of the regions themselves. And here, Mr. Prime Minister, you've taken a leading and constructive role. I know that you'll be meeting with a number of leaders in all walks of American life during your stay here in Washington and elsewhere in our land. I'm sure they will benefit as I have from your thoughtful views on our bilateral relationship as well as on regional and global issues. I'm delighted that you accepted our invitation to visit Washington, and I look forward to meeting you again. Mr. President, ladies and gentlemen, may I on behalf of my delegation, on behalf of the government and people of Zimbabwe, express to you on this historic occasion of our visit, the first such by the head of government of the Republic of Zimbabwe, express to you our heartfelt thanks and appreciation for that support which the United States has given us all along the way. And this support starts really from the time we were still struggling for our independence as the United States offered itself as party to the negotiations that were underway to bring about a democratic order in Zimbabwe. We got pledges from your government, from your predecessors, that upon attainment of our independence, the United States would not be found wanting in extending to Zimbabwe that amount of aid the United States was capable of extending to it to enable the young state to attend to those problems created by the war which the young country felt necessary, would feel necessary to attend to. And so here we are, a young state that yesterday was only a toddler, but today is able to do a little more than it was able to do yesterday. And this is because of the amount of assistance, I think the United States contributes the largest amount towards our whole program of reconstruction and development. And that input into our own efforts has enabled us to make the necessary, to create the necessary base for our socio-economic transformation. We have enjoyed excellent relations with your country. There has never been an occasion when we have had to complain to the United States on issues of bilateral relations falling in the political or diplomatic sphere. Yes, as you admit, there have been areas of difference. We have differed on the modality of what we are talking about in Namibia's independence, the linkage with the Cuban question, but generally we have looked at issues through the same glasses one might say. And our posture regarding international situations of conflict has been identical. We all are opposed, we both are opposed to interference and domestic affairs of the country by another. And I'm sure this identity of viewpoint makes for the greater friendship and solidarity that we find between our two countries and our two people. We have enjoyed every minute of our stay in your country. We continue our talks with leaders of your society. But I'm very happy that the discussions we have just had have dwelt on those issues which are of mutual interest to our two sides. As you have said, we have discussed bilateral relations, the question of economic aid to Zimbabwe, the question of regional relations, and the fact that South Africa continues to destabilize our region. We have discussed Namibia, we have discussed the apartheid system in South Africa. And there is a greater measure of agreement. There might be some difference here and there in respect of the method of bringing about positive change to the area. We are very happy indeed that this visit has taken place. And may I thank you. And Vice President Bush visited us not long ago for extending this invitation to me and enabling me, therefore, to come to this wonderful country with a wonderful people and a wonderful tradition and express to them the gratitude of the people of Zimbabwe. We are a young country. We may make mistakes as we move forward. But we are prepared that where we are, we shall correct ourselves and get back to course. We don't intend to vitiate at all those principles which underline the constitutional order that we have created. We are determined that a non-racial society shall exist in Zimbabwe and that racism, tribalism, regionalism and whatever other isms, these are things of the past. What we would uphold as fundamental is that principle which binds us together and makes us one regardless of our race, color or creed. And these are matters on which the United States has long made a decision, matters of principle which make for greater democracy and greater freedom in society. We are prepared that this shall also be our tradition. May I thank you for the kindness and hospitality which has been shard on me and my delegation since our arrival. We have come as friends. We go back as greater and closer friends still. Thank you.


Congratulations on GWMs and Train India.  You see, what we are showcasing today, they are actually concept vehicles, and the new launches will happen sometime in 2021. The concept cars are basically to showcase, you know, our design prowess, we are, our technology, how good are we in terms of technology, and we showcase certain kind of designs in technology which will get inbuilt into the future cars as we go forward. But coming to, you know, our entry to India, so today's brand launch of Havel Brand, which is under the company GWM, Great Paul Motors, you know, Great Paul Motors, and we plan to launch in 2021. We'll come in two segments. The first one is, as you know, you know, all growing segment of SUVs, and we are getting a range of SUVs in Havel Brand over the next few years, and we also plan to get into electric vehicles as we, after we launch the SUV vehicles, in the near future. So will you be setting up R&D units in India? So we already have R&D unit since 2016, it's been close to four years now, and we were doing a lot of global and local work in that R&D center, so we'll be investing more money into R&D center. As I mentioned, we are going to invest a billion dollar over the next few years, and a good amount of that investment will go into R&D, as once you make the R&D stronger, your future products technology becomes even stronger. Okay, so that gets me to my next question about making India, but what you mentioned about making India. So basically you'll be manufacturing in India? That's absolutely right. We will, we are in discussion to take over Thale Gaum plant, and we will be manufacturing in that plant. Okay, so as you know, as we know that the Indian auto industry is a little stressed because of the economic slowdown. So why make an entry at such a crucial time and the auto industry is actually suffering? Okay, see first of all, we are absolutely confident about the long-term growth story of Indian automotive market. There could be sudden blips, but the long-term story, nobody can take away from India. But very important point is, even despite in this market, which is slightly different this year, SUVs are still growing. And as I mentioned earlier, GWM is China's number one SUV company, and Havel makes a range of SUVs. So you can imagine, here's a market of SUV which is growing and there's a giant from China which comes in and wants to play in that segment. So it makes perfect sense, irrespective of how the market is going at this point in time.


and welcome to this session. This is Professor Farhad in which we would look at relevant cost and irrelevant cost in a non-routine decisions. We're going to start by discussing what's relevant and irrelevant. Then we will discuss briefly what are non-routine decisions and how do we use relevant costs and an irrelevant cost in those type of decisions. Relevant cost or even relevant benefit or revenue are cost or revenues that differ between alternatives. So how do we consider something that's relevant? Well, we have to focus on the differences between decisions not similarities. So if there are differences in terms of cost or revenue, we consider the cost or the revenue as relevant. I'm going to start with a simple example to illustrate the big concept. Then we will focus a little bit more on specific examples and we use numbers. Think about hiring two employees. If you're hiring two employees, we're going to start to evaluate them. Okay, this is employee one and this is employee two. Employee one, they have a four-year degree. Employee two, they have a four-year degree. Those are similarities. It doesn't really matter. We don't focus on those because they both have a four-year degree. Point number two, they both pass the CPA exam. They both pass the CPA exam. Again, this is not relevant. Why? Because they are, they both have the CPA exam. One have zero years of experience and one will have two years of experience. Hold on a second. Now from an experience perspective, we have differences. So what we're looking at are differences. And this is called differential analysis, looking at differences. And specifically when we are doing those differential analysis, we're going to have to look at future revenues and future costs that differ among alternatives. And this is what we are looking at here. What are relevant? Focus on relevant costs and relevant benefit or revenue that's going to differ between alternative in the future. This is what we mean by making differential analysis. So any cost that's avoidable, any cost that we can avoid or any benefit that we can incur in the future is considered relevant. So if we can avoid a cost, that's a relevant cost. If we can, if we can generate additional revenue, that's relevant revenue because we can generate this additional revenue. So costs that can be eliminated in whole or in part and selecting one option over the other is considered relevant. So any cost that we can get rid of, in part or in whole, the whole thing or part of it, well, that becomes irrelevant for our decision. Therefore, we call it relevant cost and we'll take it into account when we are making those non routine decisions, which we'll talk about in a moment. Having said so, we can also state that unavoidable cost, unavoidable costs are obviously irrelevant costs, because they cannot be avoided. What are some examples of unavoidable cost? Well, unavoidable cost, something like something called sunk cost. Sunk cost is a cost that already incurred. We incur that cost and there's no way we can change it at this point. We purchase a machine in the past. Well, we are making a future decision. Purchasing that machine from the past is irrelevant to us because we cannot change that decision anymore. And cost that generally that don't differ between alternative is also called unavoidable cost. Now, we're going to be looking more at, we're going to be giving more specific example about relevant cost, but this is basically the big picture. Before we proceed any further, I would like to remind you whether you are a student or a CPA candidate, and this is mostly likely who you are. If you're watching, please take a look at my website, farhatlectures.com. I provide you additional resources for your accounting courses as well as the CPA exam. I don't replace your CPA review course. I'm a useful addition. If you have not connected with me on LinkedIn, please do so. Like this recording. If you're watching, please like it. It's going to help you. It's going to help others connect with me on Instagram, Facebook, Twitter, and Reddit. So let's talk now about routine versus non-routine decisions because relevant costs are mostly relevant and irrelevant costs are mostly related to non-routine decisions. What are routine decisions? Routine. These decisions are made frequently to run the company, like ordering supplies, paying vendors, paying employees, running the company on a day-to-day basis. Non-routine decisions are a little bit different. They use a unique set of conditions or conditions to make decisions. So those are different non-routine decisions. Specifically, we're going to be covering four types of non-routine decisions, add or drop a product or a segment, make or buy decision or basically make or outsource, special orders, accept or reject an order, sell a product or process further. And when we are dealing with those non-routine decisions, we have to know specifically what is irrelevant costs. So we're going to be looking at some examples. Again, any avoidable cost is irrelevant cost. Like what? Any future variable production costs. So when you're looking in the future, whether to make a decision or not, any variable production costs such as direct material, direct labor, variable overhead, notice the variability. Those costs are variable. Any future variable selling or shipping costs that you are going to incur, that's relevant cost. Any future fixed costs, be careful, incurred specifically for this project or decision. For example, if you need to buy a special machine, because we are undertaking this project, it's a special non-routine decision. Although the cost is fixed, if it's specifically for this project, then it becomes relevant cost, thus taken into account when you are making that decision. Any future opportunity cost, what is opportunity cost?  Well, if that's the case, you gave it up, then that's a cost because you could have did that instead of doing what you are doing now. You got to ignore cost and benefit that don't differ. And remember, cost in one context could be relevant and another context could be irrelevant. So each case is different. So you have to be careful and obviously we'll work examples down the road and you can go to the website and look at examples. But the best way to illustrate this is to look at a simple example, just to kind of get familiar with what's relevant, what's not relevant. Adam is a college student in Philadelphia, is considering visiting his friend in New York. Adam can drive his car, specifically in New York City. Adam can drive his car or take Amtrak from Philadelphia to New York. Using a car at the 100 miles to his friend's apartment, which alternative should Adam uses? And this is the cost. Well, the car depreciation per year is 2,500 or is 25 cent per mile. Adam will have to pay for gasoline. So let's start with the car depreciation. So we're choosing between driving the car or taking the train. Would the car depreciation be considered irrelevant or irrelevant cost? Well, think about it. Whether you take the train or use the car, the depreciation will be the same. Therefore, it's irrelevant. It doesn't differ between the decision. Cost of gasoline is 30 cent per mile. Is the cost of gasoline relevant? I would say, yes, it is. Because if you drove the car, you're going to spend 30 cent per mile. If you don't drive the car, you don't spend anything. Therefore, it's irrelevant. Therefore, we will take it into account when we are making our decision. Insurance for the car and the license to have the car. It's 1,500 per year per mile. It's 15 cent per mile. Well, would it make a difference whether you pay insurance or not pay insurance, whether you took the train or drove the car? And the answer is, it doesn't matter. Therefore, it's irrelevant. You need the insurance, whether you drive the car or you take the train. Maintenance and repair, it's 5 cent per mile. So every additional mile you drive, the estimate is you have to incur additional 5 pennies in repair and cost. Would you say that's relevant? I would say yes, because if you drove 100 miles, that's going to change. Therefore, we'll be considered relevant. Parking fees at school. Well, Adam paid 200 dollars per year for parking his car at the school in Philadelphia. Now he's going to drive his car to New York. Would that make a difference? It doesn't. Because you're going to have to pay the fee, regardless whether you keep the car in that parking lot in Philadelphia or drive the car to New York. Therefore, parking the fees at the school is a student in Philadelphia. That's irrelevant. Reduction in sale value. Well, for every mile you drive, there's a reduction in sale value of 3 pennies. Would that be relevant? Well, I would say yes, because if you drive your car, it makes a difference. That's a relevant cost. Amtrak fare, which is the train fare, 105 dollars. You have to pay that 105 dollars. Would that be irrelevant or irrelevant cost? Definitely relevant, because whether you took the train or you drove the car, it makes a difference to your budget. Therefore, it's relevant. Obviously, this one is relevant. Cost of putting dog and kennel while gone. So, Adam has a dog and if he's going to drive, go to New York, he's going to have to pay 50 dollars. Would that be relevant or irrelevant cost? Whether he take the train or drive the car? And the answer is, it's irrelevant. Although it's a future cost, it doesn't really matter. Because whether Adam took the train or Adam drove his own car, he still have to pay 50 dollars to take care of that dog. Hassell of parking in New York. Well, we don't know the cost of that. Well, that's hard to quantify. Benefit or hassle have a car in New York, because having a car in New York City, often it's a hassle or it could be a benefit. Again, it's hard to quantify. The point I'm trying to make is there are other factors that can play into the decision in the real world, but you cannot quantify them. You cannot put a number on them. Cost to park the car in New York per day is 25 dollars. Now, it's the parking fee, but that's in New York. Would it make a difference whether you drive the car or take the train? And the answer is yes, because if you take the train, you don't have to worry about this 25 dollars. If you drive the car, you have to worry about this 25 dollars. Therefore, it's relevant cost. Now, we are ready to kind of use numbers. Cost of driving the car will be 100 miles times 30 pennies, which is 30 dollars. Maintenance and repair will be costing an estimate of five dollars. Lost value is three dollars. Parking for two days in New York is 50 dollars. Therefore, if Adam wants to drive the car, it will cost him approximately 88 dollars versus taking an Amtrak train, which will cost 105 dollars. Now, from a strictly numbers perspective, Adam will choose to drive his car overtaking the train. Now, from a personal perspective, I would prefer to take the train. But the point is, there are quantitative factors, such as dollar amount, whether Adam drives his car to New York or takes the train, and there are non quantitative factors. For example, I'll prefer to pay the additional amount above 88 and take the train because it's a hassle. It's a hassle. I hope this session clarifies relevant versus irrelevant costs. What should you do now? Go to farhatlectures.com and look at multiple choice through false questions that's going to help you understand this concept better because you need to understand relevant and irrelevant costs when it comes to non-routine decisions. Good luck, study hard, and of course, stay safe!


Today I am so excited to be here physically, you know, the first service mesh con after COVID. I'm sure, is that for any of you the first time traveling to a real conference after COVID, raise your hands. Yeah, very excited you are here. So we are going to talk about, it's a secret. Manage your workload, search in service mesh, without persisting it. Let me quickly introduce myself. Working at IBM for a very long time, I think some of you know me from IBM. I changed to work for SOLO about a year ago. So I'm working on open source at SOLO. I've been a very long time contributor to the Istio project, one of the founding members currently sits on Istio Steering and Technical Oversight Committee. I wrote a book about Istio. Istio explained to help our user get started with Istio. I'm also one of the new CNCF ambassador. And I run a Hoot livestream, which I learned about service mesh Istio envoy, EBPF, GraphQL technologies with you together with the audience. So this is ServiceMeshCon. I'm sure you've all seen some charts like this, the service mesh architecture. But today we're going to focus a little bit on the most useful benefit. I guess widely adopted reason for people to adopt a service mesh is mutual TLS. Would you agree with that? A lot of people are looking at service mesh because mutual TLS. Raise your hand if that's the reason. Yes, I know. We've heard that repetitively from our customers, right? So we're going to dive into how the certificate is distributed. We're going to dive into how to plug in your external certificate authority. And we're going to also dive into a couple of approaches to not persist to your private key on disk. So since I come from Istio, I'm going to start using Istio as an example to talk through how things work. I believe other service mesh works similarly last time when I look at them. So if you use the default profile that comes with Istio, you will have self-signed certificate, which means Istio control plan is serving as the certificate authority for you that means the certificate for each of your workloads in the service mesh. So this is typical, but it's not really what you want to run in production because typically you already have your own PKI system. You probably don't want anything self-signed that's not integrated with your existing PKI system. So the way it works is Istio has agent which runs in the same as Envoy proxy in the same cycle. And the Istio proxy, Istio agent sends the certificate signing request to Istio control plan. And then Istio control plan, who access the certificate authority, sends the certificate back to Istio agent, then back to the Envoy proxy. So that's how your Envoy proxy gets the certificates and it also handles certificate rotation before it expires. So if you take a look at self-signed root CA, essentially in the Istio system namespace, you're going to see Istio CA secrets. So that's the self-signed generated by Istio control plan at the boot time of the control plan. You will also see a config map that contains the root certificate for the self-signed root. So let's take a look at the generated Istio CA root secret. Essentially, it contains four of the files. One is the CA cert, that's the generate root cert. Also the private key. So this may be a concern for some of your organization because it essentially persists to that private key on disk as part of the SCD as a secret. And it also contains empty cert chain and root cert in this case. So if you decode the CA key file, you will see the private key. So why is this an issue? This is like the key to your house or apartment. You don't want to give that to anybody. So and the other thing I want to point out is by default, the certificate is good for 10 years. So what this means is you give somebody else the key of your house for 10 years. If somebody take it, they can access your house for free for 10 years. So certainly not something you wanted by default. Now let's talk about how the trust is distributed in this model. So when ECOD starts up, it has a namespace controller that propagates the ECOCA root cert as a config map to each of the namespace in your Kubernetes system. And when your proxy starts, proxy as a side card to your full service, it's going to mount that certificate as a config map, mount the config map cert as a volume into your proxy container. So interestingly, if you use ECOCA today, if you do a quick check by creating a namespace full, even though without annotate or label it as PsyCa injector, you would immediately see the ECOD creates the ECOCA root cert for the full namespace. So that's how the root cert is propagated to each of the namespace. Now let's talk about in this model how the trust is distributed. So ECOD agent is going to send a certificate signing request to ECOD. We talk about that's acting also as a certificate authority, which means the certificate and approve the request and means the certificate and send the signed certificate back to ECOD agent. In the meanwhile, ECOD also propagates the config map into each of the namespace, which allows the, I'm sorry, I should talk about in this sequence first. So the first sequence is actually copy the config map into each of the namespace, which allow the proxy to be able to mount the config map at the boot time. And then with the root certificate and also the service account token, the ECOD agent can send the certificate signing request, which ECOD looks check, make sure it's good, approves that, and sends the means certificate back to the ECOD agent. So the workload served by default expires in 24 hours. But that doesn't mean the service manager waits until the last minute to refresh the workload certs. In ECOD, there is a configuration as an environment variable, which we don't expect you to config, but for some reason you might. It's 0.5, which means we will rotate the certificate every 12 hours for you. So way before it expires, we will rotate for you. So now this is how the default works. And now let's take a look at how to plug in your own CA. So if you look at LinkedIn, it's essentially during install time, you can specify your CA cert, you can specify your issue key, whether using LinkedIn, CLI, or Helm. So this is not surprising. With QMA, you can also specify your key and cert as a secret and the configured in the match configuration YAML. So these are the ways you can plug in your external CA. With Istio, there are two ways. The first way is through a CA cert secret. The second way is through API called match config CA certificates. So let's take a look at them. So the first thing we want to look at is with CV certs. In this example, essentially you as an admin who is plugging the external CA, you would propulate the CA cert secret in the Istio system namespace, where you install the Istio control plane, and then you would specify the cert and key and also the cert chain if it's an intermediate cert and also the root cert. So you create a secret, populate that into the namespace, and when Istio debuts, it's going to check whether the CA certs exist. If it exists, it would use it. If it doesn't exist, it would fall back to the self-signed flow, which we just talked about. So in this example, then the rest of flow is pretty much the same as what we discussed early on with Istio CA root cert as a config map propagated to each of the namespace. When issued, though, this one still have private key persisted as a secret. So may not exactly be what you wanted. All right, so with match config, so why there are two ways to do this in Istio? The reason is we had users sometimes once multiple root cert, which is a common scenario as you transition maybe from one root cert to another root cert during transition time, or maybe you want to do a federated mesh that has different root cert. So Istio has a configurable API to allow you to do that through match configuration. So you can configure your actual root cert in match config, which Istio will propagate to Istio agents through the XDS API. So this is an example of how that looks like. Essentially, you can configure CA certificates inside of match config, which is part of the Istio operator API. And you can configure your certificate right there. So one thing is that this is compatible with Spiffy, such as Spell, so very attractive if you're using those environments. So now the next question is, can you plug in multiple CA certs for Istio control plan? The answer is yes. You can actually do that for the scenario I was mentioned earlier to federate across different Istio matches, or maybe in the root transition time frame. So in this case, you would have match config Istio actual root cert config through match config along with the CA certs as a secret where you install into your Kubernetes. So one thing I want to point out is I find that a little bit confusing is registration authority, which does approve the request. As I learned in these all these concepts, the other concept is certificate authority, which signs these requests. It typically happens after the registration authority approves the request. By default, all the flow we just went through, Istio works as RA and also CA. So that's a lot of work by Istio. So now let's take a look at another community project, Istio CSR. This is a very cool project. It's essentially Istio CSR acting as a registration authority. So the certificate signing request was sent to Istio CSR, which approves the request and forward to certificate manager, which acts as a certificate authority. Notice in this case, one thing really interesting is Istio D is not acting as CA or RA. So you have to kind of disable this function in Istio D to tell Istio, I don't want you to be my CA. I don't want you to be my CA. And I guess one biggest advantage of this approach is certificate manager is very well known. So it supports a lot of issuers. So all the issuers that certificate manager supports comes with this approach, like Vault and many of the other ones. But one thing I do want to point out is in this approach, private key is still persisted as secret. The other thing the Istio community is innovating is the Kubernetes CSR integration. So Kubernetes has a CSR API. I believe the API just become stable in the most recent Kubernetes release. But in Istio, the integration with this is still actively under development. It's still experimental. So in this mode, Istio D works as RA and the Kubernetes CA or any other customer CA who choose to implement the Kubernetes CSR API as a controller can act as CA. So this approach, when community first introduced, one of the huge benefit of this approach is it doesn't need to persist the private key in Kubernetes cluster, which is very cool. So this walks through how this approach works. So essentially, the service A of full here would send the certificate signing request to Istio D. And Istio D would act as the registration authority. It would approve the request. And it would actually generate the Kubernetes CSR as a request. So notice the CSR request here from Istio agent to Istio D. It's just normal certification request. And the Istio D to certificate authority in this case is actually Kubernetes certificate CSR request. The format is a little bit different, which I will explain shortly. So in this case, Istio D is going to approve the request and generate a Kubernetes CSR request and then forward to Kubernetes CA or other CA who implements the Kubernetes CSR controller and then eventually issues the certificate back and through Istio D is sending the certificate back to the Istio agent. So that's the flow of this flow, how it works. And when I take a detailed look of how the certificate works in this case, so you can see this is X509 certificate request that I generated using the OpenSSL key command. And this request essentially, on the right side, is a Kubernetes certificate signing request. Notice it's different than the certificate typically standard certificate request. And the request is essentially in the body of here with base 64 encoded format. So essentially what's on the left side with base 64 encoding is part of the request of the Kubernetes certificate signing request. You also have the requester here. In this case, it's the groups. And you also have whoever is the signer for this Kubernetes certificate request. So with this approach, it does require implementation of Kubernetes CSR controller. So by default, Kubernetes has a default Kubernetes CSR controller. I believe third manager also implemented Kubernetes CSR controller, even though I believe they said it's alpha. It's not production ready yet. You could also implement your customer controller. So there are API for implementing controller. So it's all plugable, which is very nice. But one question I would say is there are very limited controller out there, because the Kubernetes CSR API is very new and just become mature. So the controller has not been picked up. Like for instance, certificate manager has a controller. But even with that controller, it's having very limited issue being supported for that controller. The other thing to think through is, do you want your service machine also using a Kubernetes control plane trust domain? Because you may not want to use the same trust domain as your Kubernetes for signing your workload certificates. If so, this may not be a good approach if you choose to use the Kubernetes controller. All right. The other approach, which we're doing as solo, is not changing anything in Istio. Is we actually run a sidecar next to Istio. In this case, Istio control plane continue to act as CA and RA. And the sidecar is taking the responsibility of getting the certificate signed with Vault. So let's take a look how this approach works. So if you have multiple Kubernetes cluster, multiple IstioD, in this case, you would result a less API to your PKI system, less API cost. Because essentially, you're still using IstioD to sign your workload certificate. But the intermediate key and search would be generated from the sidecar to your PKI system, like Vault. So essentially, only the sidecar costs your PKI system. And then each of your service gets their workload certificate from IstioD. So this could potentially allow very large scale of service mesh with many clusters. One last approach I also want to highlight is what we are working in upstream, upcoming upstream, 1.14 of Istio release with spell integration. So the HPE team, shout out to their team, contribute this function in upstream. So for folks who don't know spell, it's really cool that it can attest workload and issue specific identities. By attest workload, you can attest the workload by the image name, by namespace, by part. And it's configurable. So you can tell spell how you want to attest your workload. And spell can be based on the rules and configuration to attest it for you. So in this case, the spell server would act as CA and I for you. And it can support two key management strategies. So you could config spell to say, I want to persist the private key in memory, or I want to persist the private key. I'm sorry, I don't want to persist the private key, or I persist the private key on disk. So that's configurable with spell. And if you use this mode, don't be confused that you still have Istio CA secrets, because that's not really being used, because spell is working as the CA and I, not Istio D. So just walking through real quickly how this model works. Essentially, Istio opened up a hook point to allow a UDS socket on Istio agent. So whenever Istio agent boots, it's going to detect whether the socket exists. If the socket exists, it will detect to fetch the secret, attempt to fetch the secret from the socket. And then the spell agent is going to do a testation on the workload of the service, just making sure it has the right workload with the namespace, service account, and image name. And then once that's all done, it can issue the certificate workload certificate back to the site card. So the normal flow, XDS configuration still goes through Istio agent to Istio control plan. It's just the certification bootstrap flow is going through. Because of the socket existed, it would go through the spell agent in this case. So we actually did a hoot livestream just a week ago. So if you are interested in this, check out our YouTube channel, solo IO. Check out our most recent hoot. I only have one minute. So in conclusion, we talk about many approaches. We talk about the default, how the default works. We talk about how you plug in your own CA is possible, how you plug in your own RA is also possible, how there are some of the approaches out there to allow you not persisting your private key, so such as Kubernetes CSI, control plan site card, and also the external CA integration with Envoy SDS with spell as an example. Now I think I may only have one minute for questions. Do I have a minute for questions or no? All right, there's a question there. Yeah, so Istio CSI is actually very well long in the community. One of the challenges is the persist private key is a security concern. So if that's a concern for you, you might want to see if that's really the right approach for you. That's the main thing. A couple of things I like about Istio CSI, that's super many issues. My main concern is the persisting. Yeah, the private key. Like your private key is like the key to your house. And typically, the root key is good for 10 years. So if you persist on this, if somebody grab it, they can access the whole thing for a very long time. Well, the approach, at least based on the tutorial I've gone through, you still kind of have to generate. Yes, you can provision, you can use certificate manager to create the keys and sorts. But the way Istio CSI is implemented today, it still requires you to create that in the installation directory as a secret if you ever tried that project. Yeah. Well, I hope this is helpful. I'm out of time. Thank you.


This is stock number 11425. We are here at Summit Automotive in Fond du Lac, Wisconsin near new and used SUV headquarters today. We are checking out this super clean 2017 Chevy Tahoe LT1. This vehicle has the 5.3 liter V8 motor. It has been fully safe and inspected by our service shop as a fresh oil and filter change. All the fluids have been checked and topped off and this Tahoe is 100% ready to go. Iridescent pearl coat is the color. We shoot all of our videos in 1080p 60 frames per second so if you have HD capabilities on your computer tablet or smartphone device turn them on right now because it is definitely your best way to check out the quality and condition of the vehicle before seeing it in person. And if you'd like to check out all the photos on this car in the upper right hand part of your screen as a link to our website click that and check us out there. This one comes with the 22 inch painted and polished aluminum rims and it has Toyo Proxess ST tires. These are 30540 R22s and these tires have right around I'd say 50 to 60% of the tread left on them. Front fender is in excellent shape. I didn't see any dents or dings on that. It does come with the projector lamp headlamps, the LED running lights. Front bumper is in excellent condition as well. Headlight lenses are nice and clear and the hood is in excellent shape too. Passenger side front fender, no dents or dings on there and the passenger side rim is in excellent condition. I didn't see any scuffs or scrapes on that. As you go down this side of the vehicle take note of how clean the body is, how reflective and mirror like that paint is. We take these HD videos so if you are far away or even if you're close by and you just cannot make the trip down but you're still interested in purchasing the vehicle, you can see the vehicle, hear the vehicle and have confidence in what you are looking at before you even get here so that when you do get here there's absolutely no surprises. And that's why we offer the Summit Auto Fast Pass option in the upper right hand part of your screen. You can link right to our website where you can apply for financing, get pre-approved, see a payment quote, even appraise a trade off in the comfort of your own home. So when you get here all you got to do is drive the vehicle of it and we'll be off to go. Back tires have right around half the tread left. And as we come around to the back of the vehicle your bumper is in great shape. Didn't see any dents or dings or cracks on that. And the tailgate is in really nice shape as well. It has full towing package which includes a receiver hitch and seven pin wiring. You get the power lift gate. These seats do fold down for extra storage. They go down nice and flat. And then I believe the hitch cover is in this box it is. That's in nice shape too. You keep them inside the vehicle so they don't go missing on the lot. Then you get a little bit of storage space underneath here. It looks like it comes with a factory format back there too. These seats go up just like so. Nice and easy to get this gate down. You press this button and it'll come on down for you. Yeah, that rear gate is in really nice clean condition. Then as you go down the driver's side just as clean as that passenger side. No dents or dings on the rear quarter. It does come with the capitalist fuel fill which is a really nice feature. Never get gas on your hands again. And for full disclosure this back rim is in nice shape as well. Down the rest of the side of the Tahoe looks really good. Didn't see any dents, didn't see any dings, didn't see any scuffs, didn't see any scrapes. Power mirrors built in driver's side blind spot mirror. Inside the LT1 package gives you the tan leather interior. No rips or tears on the seat. Nice condition. Both these front seats are power and heated. Weather tech floor mats throughout. Auto headlamps turned out four-wheel drive. You get stability control, lane departure warning, power pedals, and parking sensors. Power windows, power locks, power mirrors, memory driver's seat, and power locks. Bose sound system will hop inside. Take a look at the instrument cluster here. You can see that this one has 37,000, 155 miles digital speedometer. Instrument cluster is very nice and clean. Comes with the leather-wrapped steering wheel. No scuffs or scrapes on that. Bluetooth and information center controls on the right. Cruise controls and forward collision warning controls on the left. This one comes with the six-speed automatic transmission with the optional tap shift. This one has the Chevy MyLink system with the AM, FM, and Siri 6M touchscreen radio. It also has the factory navigation system in it. You also have a hideaway storage space behind the radio with a USB power jack, which is pretty cool. And then you have your home screen here, which you can see has projection where you can project your cell phone to the screen via Android, Auto, or Apple CarPlay. And if you've got a different navigation system you like better or just want to play music onto the radio, you can do that too. So really cool system. Dual climate controls and your normal tactile climate controls down here. You also have heated seat buttons and rear air control buttons as well. Pass and your side floor mat and seat are in excellent shape. This one does have the power sunroof and the headliners in really nice shape. You get home link buttons for your garage door security systems and lighting systems, map lights, and controls for that sunroof and rear gate on-star capabilities in the rear view mirror. And we'll take a quick look at the back seats. And then we'll check out under the hood and start it up. The back seats are just as clean as the front seats. No rips or tears back here. Those have the latch child safety system for any child car seats you may want to put back here. You get those weather tech floor mats throughout. And this one does come with the DVD Blu-ray player up there. You also get a 110 volt, 150 watt plug-in rear air controls, two usb's, an hdmi hookup, and an aux jack back here. These seats fold down and up to get to that third row. And you can see that those third row seats are in excellent condition as well. Side curtain airbags. The rest of the headliner looks really good back here too. And we'll start it up and take a look under the hood. Bottoms of the doors all look really good. Starts right up. No check engine lights or anything like that except that the door is open and you do get the child safety or I'm sorry the backup camera right there. But yeah it says that the door is open but no check engine lights or anything like that. We'll take a quick look under the hood. I would personally like to thank you for checking out the video today and hopefully from this hd video. You've been able to tell just how clean this Tahoe is all the way around inside and out. Under the hood we have the 5.3 liter VA motor and Jermay's very clean runs very smooth. Once again this vehicle has been fully safe and inspected by our service shop. Has a fresh oil and filter change. All the fluids have been checked and topped off. And this vehicle is 100% ready to go. I would highly recommend it from a quality and conditioned standpoint. And to see more pictures of this Tahoe one of our other 450 new and used cars, trucks, SUVs, minivans, Wranglers. You name it we got it. Go to our website right there www.summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at summitauto.com. If you'd like to check out more hd videos you can go to youtube.com slash summit auto. Remember to like subscribe and share on this video and all the videos that you see there. In fact in a second you will see a link to subscribe to our YouTube channel on your left. A link to more Tahoe videos like this one in the upper right. A link to more this vehicle on our website in the bottom left. And a link to our YouTube channel most recent video upload in the bottom right. So click those check us out and we're super excited to help you with this extremely clean 2017 Chevy Tahoe LT1 and Iridescent Pearl Metallic. Thanks again for checking out the video.


Hey, what's good everyone be every here for another trailer reaction This one is for Sony's the dark tower International trailer number two saw the first one. They came out a few months ago, and I liked it I really didn't you know I've always kind of heard of dark tower that you know, this has been adapted from a book But I haven't read the book, you know, don't know too much about the characters But you know, I am excited because it has Matthew McConaughey the evil guy and it just elbow the good guy So, uh, let's go ahead and see what this international trailer number two Is about our is all that stands between light and darkness Thousand generations of gunslingers were knights sworn to protect it And I'm the only one left The tower will fall get used to the carnage Now the wars come to earth You really think you can stop me gunslinger Everyone who walks with you die That coming out in August Yeah, it looks I mean it looks good your August the fourth and it's being directed by Nicolage or sale. I looked at my right before I press play and I've never seen any of his movies before but it looks good But at the same time, I mean I'll have reservations because it's a Sony and at the same time, you know They aren't my favorite studio and seems like they like to play it safe a lot But you know, we'll just have to wait and see I'm really excited about seeing Idris Elbow and all the gunplay or whatever That looks really cool.   You know, I don't know. I just thought about it But we're just gonna have to wait and see, you know, it looks decent You know, I don't want to say like I'm super duper excited. I can't wait for this movie There will be a lie, but you know, it does at the very least like it will be entertaining So guys, that's just my opinion of this new The dark tower international trailer number two. What did you think? Did you like it? Did it turn you off? Did it turn you on? Do you agree with me or do you disagree with me? Let me know in the comment section below Let's get this conversation going and keep it flowing and if you liked this video Go ahead and give me that thumbs up and if you don't like this video, that's fine Just leave me a comment below why and still give me a thumbs up Also guys, help me make the red carpet for Black Panther. I know it's a long shot But hey, I'm going for it comes out February 16th of 2018 next year. I love comic books. I love Marvel I love like Panther. I'm a black guy in this movie come out in the black history month. What are you serious? Yes, I am super duper excited. This would be like the most epic super duper dream come true for me So, I mean I want to go whether I'm on the red carpet or if I'm on the side I'm just trying to get there, you know, because this is just crazy and I cannot wait for this movie So help me out get there by sharing this video 1000 times and also guys if you're watching this video on YouTube go ahead and subscribe to the YouTube channel So you get all the content that I have to provide. We've got B23 coming out next this weekend Comic Con the weekend after that is about to go down with these reviews and reaction So subscribe click that bell so you can be notified when I upload stuff to the internets guys You can also go to my website book market. Check me out there and also look me up on social media My guys, I just want to thank you again for tuning in for my opinion slash reaction Sony is the dark tower international trailer number two before you go. Don't forget that my name is Brandi Keith. Abram And that's just my pain peace


Ukrainian Army prepares for complex operations in Crimea, all places on Peninsular are on target. There are no safe places for the Russian occupiers in Crimea, and the pressure exerted by the Defence Forces of Ukraine makes it difficult to use the Crimean Peninsula as a logistic hub. Andrew Yusov, a representative of the main intelligence directorate of the Ministry of Defence of Ukraine, said this. Yes, there was information, it is confirmed, about the transfer of air and missile defence equipment from other directions and, in particular, from the Far East to the temporarily occupied territories of Ukraine, including the Peninsular. But as chief of the main intelligence directorate, Kyrylo Budanov said, today there are no safe places for the occupiers in Crimea. And we see this with our own eyes, actually on a daily basis. The planned work of the Security and Defence Forces continues operations in various areas, both on land and water. And this work will continue, Yusov said, responding to a request to share Ukrainian intelligence data on how the Russians are strengthening air defence in Crimea. He also emphasised that the pressure exerted by the Ukrainian Security and Defence Forces makes it difficult for the enemy to conduct. Plan and implement those operations, in particular, from the temporarily occupied Crimea, which they planned. Earlier, head of the press centre of the operational command, South Natalia Humeniuk, noted that the Ukrainian Defence Forces were conducting complex work in Crimea, the results of which would be seen later.