Ten-year-olds Mark and Peter were camping out in their yard with just sleeping bags. When it started to rain, they moved over to the shelter of Mr. Hopkins' house trailer that was propped up on one side to make it level. They had made a little fire to cook their breakfast when Mr. Hopkins came out searching for the source of smoke. Have these youngsters committed the crime of attempted arson? We recognize two classes of property and law, real and personal. Real property addresses land that are pertinence or improvements to the land, such as buildings or trees. Personal property addresses everything else where there is a property right and ownership of something that has value. There are borderline properties that can be seen as either depending upon the law. This would include a house trailer. It might be fixed in place, or it might be purposed in the sport of having a traveling home, not really a fixture on the land. Other property is not just in things. A man has property rights in the wages that he earns, in patents, granted for his inventions, and even in personal reputation among others. Crimes against property are generally actions that destroy the property or deny the rights of ownership of the owner. Crimes are those offenses to property which interfere with the person's quiet and peaceful enjoyment of what they own, or that interfere with the government interest in the property. The basis for property crimes is often found in assault, in threats to the property of other people. Arson, for example, addresses an intentional and open burning. It puts the lives of firemen in danger, and containment may well be necessary to keep the fire from spreading. Other crimes are offenses against the peace, as in someone breaking and entering a home. Property law can be very complicated due to the amount of regulation being applied. Government leaders have harvested the ownership of property as a source of government income. Real property taxes often fund public schools, assure public services, and maintain public land and buildings. The complications include a public interest in the real property. Damage to property is also damage to a public tax base. Misuse of property can be a threat to the health and welfare of citizens. We therefore have some recognized property crimes that are in place to protect people from known hazards. Most such criminal assaults on property deal with the ownership and possession of land rather than the land itself. The worst of crimes against property involves destruction of property, or at least destruction to the point where it is reduced in value to its owners. In development of common law, the primary property crime was arson, the use of fire to destroy property. Originally, arson applied to someone's home, and the crime was for someone else to set it on fire or at least try to do so. Burning down someone's place of business was not arson, nor was setting a field of dry acreage on fire and destroying the crops. It was not arson if somebody burned down his own home, as common law considered it to be his property and to be disposed of as he would dispose of it. This crime has been greatly expanded in U.S. law to address almost any burning of real property. It also includes someone's burning of his own property for a criminal purpose as in trying to collect on fire insurance policies. It has also been applied to burning specific high-valued personal property as in setting fire to an automobile. Arson is now just the most aggravated form of the crime of willful destruction of property. It is a public threat as large fires are difficult to contain and a threat to both the peaceful enjoyment of other people's property and their lives, the lives and health of firemen or neighbors who work to extinguish and contain the burning. There is a criminal intent requirement for all such acts to be considered crimes. The person who intentionally makes a deep scratch on someone else's car is engaged in causing willful damage. It is a crime to treat someone else's property in this way, taking value from the owner. The crime of theft is also a crime of intent. It addresses an act to effectively deny the owner or possessor of property the benefits of ownership or possession. It often involves removal of property from a place where the owner or possessor has placed it so that it is no longer available to the owner or possessor. It is not the intent to own and control someone else's property that is a public offense, but the intent to interrupt the ownership or possession of another citizen. The crime is in the threat to the public rather than the damage suffered by a specific victim. We shall address personal wrongs when we study tort law. In terms of the U.S. Constitution, it keys back to a person being secure in his or her possessions. The Constitution, being focused on what the government does, simply denies government any authority to commit theft from its citizens through issuance of a warrant. Even where land is taken for a public purpose, there is a requirement to provide just compensation for what is taken. Possessive rights are recognized in the supreme law of the land, even as it is in the common law. Theft can also address intellectual property or financial interests that have no physical being beyond a piece of paper attesting to ownership. Interruption of these is a form of theft. Most crimes involve unlawful or forced change in possession of the property or stealing its value away. Some of the more disruptive interferences have been given their own name as crimes. For example, robbery is a form of theft that involves criminal assault. The theft, being the lesser crime, is not addressed as a basis for prosecution. Conversion is another example of theft, but one that is not a public threat to other persons, so much as a violation of trust. If the criminal is rightfully given charge over someone else's property and intentionally takes action beyond the reasonable use for their having legal possession, they are guilty of conversion. The crime of conversion is punished more as a violation of trust than a violation of property, though both elements are part of the same conversion action. For conversion, the criminal must be in legal possession of someone else's property and owe some duty to the real owner. If they take action to use the property for their own purposes or to gain from its use without compensation to the real owner, they have engaged in conversion. The person who borrows a friend's car to drive to work and back but takes it on a trip as part of his vacation would have converted the car. The patron who borrows a library book and then burns it to keep warm would have converted the book. A person who leases an apartment but removes the furniture that belongs to the landlord when the lease is up would have converted the furniture. The crime of conversion is not commonly prosecuted as it is often simpler and more effective to seek justice on such matters under tort law, where the one whose ownership is abused gains personal restitution. Even more serious cases of conversion commonly involve other crimes that are punished more intensively than conversion. An example would be treating the conversion of someone's vehicle as vehicular theft, or setting a leased building on fire would be handled as arson. In general, fraud is taking someone's property through trickery, through lies or misrepresentations with the intent of depriving that person of ownership or possession. It addresses intentionally unfair dealings. As with other crimes, intent to commit the crime through trickery is an essential for the crime. The person who sprinkles flakes of gold on the property he sells to another in order to falsely inflate its value would be engaged in fraud. The person who was defrauded sells that same property to a third person to make a profit from having gold found there. He would not be engaged in fraud as he had no intent of tricking the buyer. The one who publishes a number of articles locally indicating a government interest in building a road through his property so that he ups the prices selling lots would be committing fraud. For personal property it might be a used car dealer who manages to turn back the odometer on the car misrepresenting the amount of use it has had by past owners and accordingly the wear on parts in future life of the vehicle. The huckster who sells medicines and beauty products to the public without any real basis for their effectiveness would be engaged in fraud knowingly misleading the public on claims that he had no reason to believe were true. Again fraud generally goes unprosecuted due to the fraud having also involved committing more serious crimes as defied through legislation. There are also special crimes within the general definition of fraud as an employee doctoring a time card to indicate that he was working overtime when he was not. The crime is gaining by false tokens and addresses a fraud accomplished through delivering false evidence as a way to gain a value result at the expense of others. Forgery is a special crime within fraud dealing with creating fake property or property records. If a painting is created to imitate one of greater value and sold as the original it is the crime of forgery. Again forgery is a crime of intent. The one who imitates a valuable statue and sells it as a copy is not guilty of forgery. The one who buys the imitation and then resells it as an original is engaged in the crime of forgery. Forgery has been largely limited to false documents that have legal effect. Forgery often includes producing a false signature or presenting it as a basis of authenticity for the document. Forgery also includes altering otherwise legitimate documents to increase the value of the document to others or to otherwise gain advantage over others through trickery. Forgery is always a fraudulent crime. The final property crime is trespass, entering upon the property of others with the most aggravated trespass being breaking and entering. Breaking and entering is the crime of breaching and intentional security applied to the property. It addresses entering upon property such as a home which has been intentionally restricted as to access. Defeating the actions of the owner and securing his or her property is breaking and entering. If there has been no special precautions or possessory protection then entering on the property is just trespass. Without the effort to secure the property the entry of someone onto it without permission is a tort rather than a crime. A personal wrong instead of a public wrong. For the crime of trespass there must normally be damage to the property or a positive action to defeat the owner's attempted security. If a farmer posts signs on his wood lot forbidding strangers entry then he has taken acts to secure his property and any entry by someone who can see and understand the sign is criminal trespass. If the farmer also puts a fence around his wood lot then he has set a barrier in place and climbing over that fence is breaking and entering. A no trespassing sign is sufficient security but for all but children who cannot read and understand the limitation. The trespasser becomes responsible for any and all damages that occur during his uninvited entry. Climbing over a fence is breaking and entering. Pushing open a partly open door into a house with intent to enter is breaking and entering. A criminal offense against the owner's peaceful enjoyment of his property. The one major limitation is that the owner or possessor cannot set a trap for those who trespass without taking some level of personal responsibility for any who might suffer personal damage from activating the trap. In summation crimes against property are considered far less threatening to we the people or the government than crimes against the person. Lesser violations often go unpunished as crimes as there is restitution through tort law where the victim of the property crime is satisfied to the point where they do not pursue the act through prosecution. The courts generally support such accommodations as achieving less disturbance of the peace than would be accomplished through prosecuting the action as a crime. This also discourages use of the criminal law as a tool of retribution. The cost in time and effort to pursue an act as a crime is an intentional barrier to its use to harm someone else. Still, there are property based crimes to be pursued and they are available to those who cannot get satisfaction through other means.


The Kraft Foods Company, makers of Kraft quality foods, presents Harold Perry as the great Gildersley! There are many cheese foods on the market today, but only one Pabstette. The delicately different pasteurized processed cheese food with that real cheddar flavor. Try Pabstette and your taste will tell you what we mean when we say it's deliciously different. For that rich, satisfying Pabstette flavor comes from AIDS cheddar cheese of real distinction. You can get Pabstette, metal, or golden in the round handy size package. But chances are that once you've tried it, you'll want to save money by buying the economical two pound loaf. Your dealer has both packages. Ask for Pabstette tomorrow. Well, it's the family's night out at the great Gildersley's house. His nephew Leroy took off for the library. His niece, Marge, read just one out the door with her fiance Bronco Thompson. And now the great man himself takes his leave and heads down the front steps. Night air smells good. Somebody's cooking sauerkraut. Bronco's car always exploding. I'll bet that boy doesn't use a starter on that car. He just lights a fuse. Is that you, Margie? Yes, Margie. Can we give you a ride, Mr. Gildersley? Ride? No, Bronco. I'm just going down to the bowling alley. Makes a person healthy to walk, you know. Healthy than riding in that jalopy. Oh, come on, Margie, we're going to the movies.  No, I'll walk. Oh, why not, Mr. Gildersley? There's plenty of room. You haven't ridden in my car since I put the floorboards in it. Come on, Margie, be sociable. Well, all right. The door is welded shut. You just step over. Yeah, I know. Pretty tight squeeze. Getting under this top and over the door. Zeef. Should have left the floorboards out. It'd have been easier to crawl into the bottom. All set, Mr. Gildersley? Yeah, I'm in. Are you going bowling tonight, Auntie? Yeah, I'm going bowling if I ever get there. I'm going to meet Judge Hooker. Knock over a few pins. Marge and I are going to a movie. Well, good. I guess you children are pretty happy these days. I'll say we are. Aren't we, Marge? Oh, yes, it's wonderful. Well, I imagine after you're married, you'll be getting another car, eh, Bronco? Oh, no. We're going to keep this one until I can afford to buy a new one. We're not going to lose our heads, Mr. Gildersley. It won't take as long to save the money, though. I'm going to find a job. What did you say, Margery? I said I was going to get a job. Well, that's something you can talk about later. Oh, no, it isn't, Mr. Gildersley. This is something we have to talk about right now. This is important to our future. Yes, well... A girl can't work and be married at the same time. Why, Bronco, Thompson?  A woman's place is in the home, isn't it, Mr. Gildersley? Well... Don't be so stuffy. When people are first married, there's no reason why the wife shouldn't work, is there, Auntie? Well, what do you say, Mr. Gildersley? Just a minute. Don't get me into this. Well, don't think I'm being stubborn. But after we're married, I'm going to put my foot down. Oh! Is that so, Mr. Thompson? Well, I'm going to put my foot down. Well, if everybody's putting a foot down, somebody put one on the break. We just passed the bowling alley. I'll get out here and walk back.  Is there anything wrong with that?  If they say it'll all come out in the wash. Take me home, Mr. Thompson. Looks like this one's stuck in the ringer. Where's Judge Hooker? Well, there's the girl's team from the shirt factory. Cute uniforms. Hello, Gildersley. Hello, Horace. I'm ready and waiting, old friend. I should warn you, Gildersley. I'm going to be in rare form tonight. All right, Judge. I'm going to get hold of that ball. I'm going to make those pins fly like thistle down in the breeze. Thistle down, Judge. You'll be lucky if you can roll the ball to one end of the alley. Too bad we couldn't have a foreson. I thought perhaps Bronco and Marjorie might decide to join us this evening. No, Judge. Bronco and Marjorie are having a little spat.  A lover's quarrel. But you know what they say, Gilder?  That's the spice that seasons the pot. Yes. What's quarrel about, Gilder? Marjorie insists she's going to get a job after they're married and Bronco says she isn't stubborn kids. Well, what's your opinion, Gilder? I'm staying out of it, Judge. They can figure it out for themselves. I don't know. These days I feel it's quite practical for a young wife to pitch in and help out with the finances. A lot you know about it, Horace. A wife's place is in the home. How do you know? Never mind. Bronco's right, though. A wife can't be running down to a job every morning and still make a home. I thought you weren't taking sides in this argument, Gilder. Well, by George, somebody's got to show a little sense. This thing could ruin their whole marriage. You're going to say that, I suppose. Well, I may have to. When two people are as stubborn as Bronco and Marjorie, they need a balance wheel. Somebody to straighten them out. Oh, yes, of course. Well, come on, balance wheel, let's roll over to the alleys. I don't know, Judge. The more I think about this, the more I'm convinced I should be at home with Bronco and Marjorie. But, Gilder... Don't you tempt me, Judge. This is their first quarrel. They need the sympathy and wisdom of an older person. But, Gilder, who am I going to bowl with? Well, you could go over and join the girls from the shirt factory, Judge. They haven't got a mascot. Maybe they could use an old goat. Bronco and Marjorie in the parlor. Sitting on opposite sides of the room. Gilder, sleep, you got here just in time. Better not barge in the front door, though. I'll go around and duck in through the kitchen. I thought you were down bowling with Judge Hooker. Well, I was, Bertie, but I felt that under the circumstances, I ought to be at home. How are things in the parlor, Bertie? I don't know. I turned the heat up, but it's still pretty chilly in there. You background, what happened? Nothing, LeRoy. I simply came home. There are times when the head of the household needs to be on hand. When the skipper has to stand at the helm. Not around here. Bronco and Marjorie are sitting in there like a couple of mummies. They aren't even talking. You keep out of there, my boy. Aren't they speaking to each other at all, Bertie? No, sir. They come in and sit. They've been sitting there since. They got a man on about something. Why don't they fight? LeRoy? This is serious, Bertie. This could break up everything. Nah, name alone, Mr. Gillesleaf. They'll be billin' and coolin' again for you to know it. That's what you think, Bertie. You goin' in there, Mr. Gillesleaf? I most certainly am. A calm, cool head, a gentle, sympathetic and understanding attitude is the only thing that can straighten this out. Okay. You want to take along something to thaw out that atmosphere? Hot chocolate? No, Bertie. I'll take some. LeRoy? You go down to the basement. Oh, for cornstakes. Bertie, what this needs is tact and mature judgment. Now, you watch. I'll have this thing smooth over in five minutes. I'll break off a sprig of this pot of geranium to take in with me. What's that for, Mr. Gillesleaf? It's an olive branch, Bertie. The symbol of peace. Kind of a cute idea. Yes, sir. Oh, hello, children. Hello, Mr. Gillesleaf. Hello, Uncle Morse. Look here, children. See what I'm carrying? A geranium. Really? A geranium? It's an olive branch. Oh. That fell flat. Mind if I sit down? No. No. Pretty cold out. Nice in here, though. I'll begin.  Well, that was a very funny argument your children got into. The wife working. I laughed so hard I had to come home. Hehehehe. They didn't laugh. How's Judge Hooker? Oh, he's fine. Your mother and father well, Bronco? Yes, they're well. Good. About this little difference between you and Marjorie. It's all about it. Well, we shouldn't let these things upset us too much. We have to give and take, you know. Hehehehe. I'm willing to give, Mr. Gillesleaf, but I'm not going to take money from my wife. If a man can't provide the necessities of the home, then he has no business getting married. There he goes again. Watch it, Marjorie. Why does a man have to think he's so high and mighty? Why does a girl have to stay home and wait for a husband to make the money?  Now wait. Take it easy. What's a girl supposed to do? Sit at home like a bump on a log? What do other women do all day? They have jobs. Oh, no, they don't. All right, back where they started. Now look, children, let's be reasonable. Well, I'm being reasonable. There's a way to work this thing out. Find a middle road, a compromise. Well, I want to do the right thing, Mr. Gillesleaf. I know you do, Bronco. Sure you do. I've got them.  There's a way to figure this out, and I'll cooperate. Well, I'm not going to be stubborn, Bronco. She called him Bronco. It's going great. I do anything for you, Marge. You know that. I did it. They're love birds again. Well, I wouldn't do anything you didn't want me to do, Bronco. Isn't that sweet. Do you think a wife should work, Anki? No. Why not? Well, my dear, it's the woman's place to make the home. Have dinner ready when her husband comes home from work. Oh, a wife is just a cook, is that it? I didn't say that. But that's what you meant. No, I didn't. What's wrong with cooking? Yes, I mean no. But Marjorie. Now, wait a minute. Guess I'll be going. Good night, Mr. Gillesleaf. Mar... Bronco. Gillesleaf, a fine peacemaker you turned out to be. Olive branch. Poison Ivy. The great Gillesleaf will return to his problems in just a minute. Do you like hot sandwiches that are a whole meal in themselves? Then here's a suggestion you'll really go for. Grilled sandwiches, pabsteth. Wait till you try one. Just spread slices of bread with rich, smooth, spreading pabsteth cheese food. Cover with another slice of bread sandwich fashion. Fry in butter or margarine on both sides. Serve golden, brown, and piping hot with marmalade, jam, or honey. Mmm, mmm, is it delicious? For pabsteth is the pasteurized processed cheese food whose rich, satisfying flavor comes from genuine, aged cheddar cheese of real distinction. You'll love pabsteth for every use. It's mild, spreads readily at room temperatures, melts smoothly into sauces, cuts into firm wedges when chilled, and it adds distinctive cheddar flavor to every sandwich, salad, omelet, or casserole dish you make with cheese. Get pabsteth tomorrow from your grocer in the handy-sized round packages or the economical two-pound loaf. Well, the great Gillesleaf's noble effort to patch up the quarrel between Bronco and Marjorie didn't work out too well. In fact, the great man is worse off than he was before. Well, he has Marjorie mad at him, too. Never again. They can fight till the cows come home. I'll never open my big mouth. Well, how come you didn't answer? I'm not taking any chances, Bertie. From now on, I'm saying nothing around here. And I think that's good advice for everybody. Yes, sir. Good morning, Marjorie. Good morning. What is anything? I'll have to talk to myself. It's a good way to stay out of trouble. You and Bronco are still battling, Marge. I prefer not to discuss it if you don't mind. Stick to your rhubarb, my boy. Yeah. So quiet it gives me the creeps. Can't I scrape my toast? In the kitchen. Huh? What is this? A note? Who's it from? Me. What does it say? Dear Mr. Gelfersleeve, would you like some hot coffee? Yes, Bertie. Fine breakfast.  When is Bronco coming over again? Tonight, he says. For heaven's sake, stop this silly quarrel. You're acting like infants. He's going to keep his mouth shut, but he doesn't do it. Leroy! I'm going downtown. I'll see you children later. Goodbye, Marjorie. Marjorie, I said goodbye. An outcast for my own family. Guess I'll go down to Peabee's and get a strong cigar and smoke it at both ends. Oh, Mr. Gelfersleeve. What can I do for you this morning? Give me a couple of cigars, Peabee. The long ones. Yeah. Celebrating today, are you, Mr. Gelfersleeve? No, Peabee. Now that you mention it, maybe I should celebrate. I've learned a valuable lesson. You bet. I've learned to never take sides in an argument. My, my... It's a fact, Peabee. No matter what the situation is, a man should keep his opinions to himself. Yes, I know. I learned that from Mrs. Peabee. Marjorie and Bronco are having a big quarrel. They have a job after they're married. But I've washed my hands of the whole thing. I'm out of it. Yes, indeed. Marjorie thinks more of getting a job than she does of her marriage. It's all right with me. How do you feel about it, Peabee? It's all right with me, too.  Believe me, if you had, you'd sing a different tune. All right, Dad. If you had a niece like Marjorie who was the same as a daughter to you, wouldn't you want her to work after she was married instead of settling down and making home? How would you feel? Well, I'd say it would all depend. Wouldn't you try to put a little sense into her head? Well, maybe I would. Maybe I wouldn't. You mean you'd stand by and let her ruin her marriage? Well, it all depends. Get off the fence, Peabee. Take one side or the other. Isn't that what you did? You bet it is. Give me my cigars, Peabee. There you are. And come in again, Mr. Gilderstein. Yeah, maybe I will. Maybe I won't. I knew I'd think of a clever answer. I wish I could get my mind on going to the water department. Why does Marjorie have to be so stubborn? Women are a problem. Wonder if Katie's home. Want to do any harm to drive by there and see? Yep, that's her car in front of her house. Katie's little convertible. She won't mind if I stop in for a minute. At a time like this, a man should talk to a nurse. It's the next best thing to a doctor. Better in a lot of ways. Wonder if Katie's up yet? Sure, she's an early bird. Little Catherine. Sympathetic understanding. Never seen her early in the morning. Bet she's pretty. Bright-eyed. Sparkling like a rose in the morning dew. Yes. Is Catherine here? It is Catherine. Who is it? Hasn't got her eyes open yet. It's me, Catherine. Throckmorton. Throckmorton? Oh, Throckmorton. Yeah. Just driving by, I thought I'd stop in and say hello. Could you come back in about an hour? Well, I'd like to talk to you now, Catherine. It's very important. All right, come on in. Come outside. I'm sorry. Come on in. Thank you. What is it? What happened? Well, I need somebody to talk to, Catherine. I'm a lost sheep. Who is? Me. Everybody's against me, Catherine. Marjorie and Bronco are having their first quarrel, and I'm right in the middle. What's it about? Well, Marjorie insists she's going to work after they're married, Catherine. Liable upset everything. I knew you'd understand, Catherine. Oh, yes, I understand. I knew you would. I think Marjorie's right. Why shouldn't she work if she wants to? It'll give her confidence. Let her feel she's helping. After all, marriage is a sharing of responsibility. Two people should cooperate and build together.  Sure, that's exactly the way I feel about it. Well, I'm glad. The average man is just the opposite. Yeah, well, I guess I'm just not an average man. So, Marjorie's very lucky to have you for an uncle. I shouldn't be glad I came over here. Is that you, Mr. Gilson? How is everything, Bertie? Well, Mr. Bronco's in the Paula, and Mr. Marjorie's in that tooth. Ain't nobody walked out yet. Good. I thought it'd be better if I ate dinner down time tonight, Bertie. Give Marjorie a chance to cool off a little. I don't see how she can get much cooler than she is. She didn't eat no dinner, Mr. Gilson. Well, let's not worry about it, Bertie. I ain't worried. You worried, Mr. Gilson? No. Was they talking in the Paula? No, that's Leroy and Piggy down in the basement. Uh-huh. Have they been talking? No, sir. When Mr. Bronco came, he said hello, and Mr. Marjorie said good evening. He ain't said nothing since. Hmm, sir. Mr. Bronco's leaning on the mantel, and Mr. Marjorie's sitting on a piano stool. It's a deadlock. And that Bronco, why does that boy have to be so stubborn? Come again. Well, I've been thinking about this, Bertie. Marjorie's right. There's no reason why a girl shouldn't work after she's married if she wants to. Yes, sir. A girl ought to feel she's helping. Marriage is sharing of responsibility. Two people should cooperate and build together. Yes, sir. Besides, I have to be loyal to Marjorie. I don't blame her for getting upset with me. At least a girl can expect there's the backing of her own family. You going in there again, Mr. Gilsley? Well, it looks like I'll have to, Bertie. I took the wrong approach before. Bronco will see it my way. You want another hunk of geranium? No, Bertie, I'm going in there this time Marjorie's uncle, a friendly counselor. At least I'll win Marjorie back. I don't have to live with that Bronco. No, sir. Maybe I should have something to carry though. Give me a reason for going in. You could take this box of chocolate. Mr. Bronco brought them last night. Hey, that's an idea. Milk chocolate. Blums. Open the door, Bertie. Yes, sir. Good luck. Well, hello, children. Hello, Uncle Moore. Good evening, Mr. Gilsley. Found some candy in the kitchen. Some of yours, Bronco. Have some Marjorie. Sweets to the sweet. No, thank you. Bronco? No, thank you. Well, I guess I'll have one myself. Peanut clusters. That's very good, Bronco. Thank you.   Let's see now whose side am I on. Oh, yeah. Marjorie, I've been doing quite a bit of thinking. Really? That's nice. It's entirely possible that you're right. It might be a very good thing for you to work a while after you're married. Well, thank you, Anki. I'm glad somebody's showing a little sense. Did you hear what Uncle Mort said, Bronco? Yes, I heard it, Marge. Let's try to have an open mind.  What? Well, maybe I have. What did you say, Uncle Mort? I simply said, my dear, that Bronco had the wrong attitude. Uncle Mort, I resent that. What? Bronco was only standing up for what he thought was right. And how do you know maybe he is right? With Marjorie. Wait a minute. Don't cry, Marge, honey. Look, I was only crying. It's all right, Marge. Children! Well, excuse you, Uncle Mort. Come on, Marge. Let's go to the movie. My car's out in front. All right, honey. Can we give you a ride, Mr. Gilder Sleeve? No thanks. I've just had one. The Great Gilder Sleeve will be right back. When you do your shopping tomorrow, remember to add a treat for the whole family Get Pabsteth, the pasteurized processed cheese food with the real cheddar flavor. You can get golden or pimento Pabsteth in a round, handy-sized package. But once you've seen how much your family likes this delicious cheese food and how many delicious ways there are to use it in your cooking, you'll want to save money next time by getting the economical two-pound loaf. In either package, you get that superb Pabsteth flavor that comes from genuine AIDS cheddar cheese for your distinction. Ask your grocer for Pabsteth tomorrow. Bear is down here. What are you doing? I'm making a tent. A tent? Better have a look at that. Look here. It's going to have a flap in the front and a flap in the back. Well, that's nice. Lots of flaps. Our Boy Scout troop is having a big show this week. We're all making stuff. Well, good. This week is the 40th anniversary of the Boy Scouts, Uncle. 40 years. That's one. Well, almost.  You know something, Mom? There's more than 2,300,000 kids and grown-ups in the Boy Scout organization. Really? You bet. It's a keen thing for kids. You're right, my boy. The Scouts are doing a fine job all over the world, teaching boys to think straight and be straight. They deserve all the help we can give them, folks. They're doing well on their 40th anniversary and do all we can to assure them many successful years to come. Good night. The Great Gilders League is played by Harold Perry. Incidentally, Mr. Perry will be heard next Saturday over NBC in a program honoring the Boy Scouts of America. This show was written by Paul West, John Elliott, and Andy White with music by Jack Meakin.  This is Jay Stewart saying good night for the Kraft Foods Company, makers of the famous line of Kraft quality food products. Be sure to listen in next Wednesday and every Wednesday for the further adventures of The Great Gilders League. Good night. Want to put magic in leftover meals? Then have plenty of Kraft prepared mustard on hand. Mustard makes hidden flavors pop right out of leftover meats. Adds new life to salad or egg dishes. You can get two kinds of Kraft prepared mustard, you know? Have mustard mild, delicately spiced or Kraft mustard with snappy horseradish added. Have both on hand. For when you add a little mustard, you add a lot of tang. Get Kraft prepared mustard. Break the Bank. Radio's biggest money-paying show is next on NBC.


Hi, I'm Mike, a partner engineer on Chrome OS. And I'm Joyce, a developer relations engineer on Chrome OS. If you're familiar with Chrome OS, then you probably already know that it's a platform that supports Android, web, Linux apps, and Chrome extensions. Users can access their favorite apps just by logging into a Chrome OS device. However, there's also another way to use Chrome OS to deliver your apps and services to users. Kiosk Mode. Kiosk Mode on Chrome OS allows apps to run full screen in a lockdown environment and without a user login. They can be deployed in schools for a secure and safe standardized testing environment. They can also serve as digital signage to display information or as customer facing kiosks that provide self service utilities and businesses. Chrome OS allows you, the developer to focus on releasing great features for your application and leave app deployment and device management to Google's tooling. I'll hand it back to Mike to share how you can get started. To set up and manage a kiosk device, you'll need three things. A compatible device, a management license, and a kiosk app. When it comes to hardware, Chrome OS offers a number of OEM choices or the option to convert devices through Chrome OS Flex. Chrome OS OEM partners include HP, Acer, and Lenovo. And many others that produce Chromebooks are laptops and Chrome boxes are desktops. They come in a variety of form factors and hardware configurations that can be customized for almost any use case. They're built with efficient power management capabilities that enable as much as 46% less energy consumption than comparable competitor devices, which is great for always-on devices like kiosks or digital signage. If you have a niche use case requiring specialized hardware, or would like to extend the life of existing hardware, you can take advantage of Chrome OS with Chrome OS Flex. Chrome OS Flex is a cloud-first, fast, easy to manage, and secure operating system for PCs and Macs that comes with the same OS architecture, approach to management, UIUX, and security controls as Chrome OS. Flex was also designed to be sustainable, reducing electricity consumption and associated emissions by an average of 19%. Flex can be installed on x86-based devices, and to ensure a consistent and high-quality experience, Google individually certifies and maintains a list of models that you can use with Chrome OS Flex. As of today, there are over 400 devices that have been certified. To try Flex out, you only need three things, an 8Gb or larger thumb drive, a computer you want to modernize, and a few minutes. So whether it's for energy savings, or using existing hardware, or just trying out Chrome OS, you can install Flex today. Just as important as the right hardware devices is a way to easily and efficiently manage them. Kiosk apps can only be deployed to manage devices, so you'll need a Chrome Enterprise, Chrome Education, or Kiosk Insignage License. Once the device is enrolled and licensed in the Admin Console, you'll be able to configure policies for the fleet, lock them into Kiosk mode, and get information and management controls via the Google Admin Console. The Google Admin Console is your one-stop shop for managing Chrome OS devices. You can manage users if you've just hired new employees or started the school year, monitor device stats for fleet management workflows, and configure apps and extensions installed on your devices. Let's take a closer look at some of the information and tools available in the Admin Console. We'll start with the Device Details page. On the left hand, we have a set of commands we're able to perform on our Enterprise Managed devices. We can manage Chrome OS devices. No middleware or additional software is needed to perform these commands. They are sent directly to the device and performed by the OS. The ability to perform remote commands such as screenshot, remote desktop access, and reboots are critical for Kiosks, which are often remotely installed and unattended. In the Hardware and OS section, we can see device specs alongside platform and OS level information. Throughout the OS version policy compliance field, administrators have complete control over device policies and settings, which the OS management components ensure are enforced. Custom fields allows you to set commonly used administrative attributes like IDs associated with asset tags, or the location a device will reside in. These values are readable by the Kiosk mode application running on the device. System activity and troubleshooting contains telemetry data like CPU utilization, temperature, and RAM usage. System logs are also available here for remote collection and debugging. One of the key features of all Chrome OS devices, and especially in Kiosk mode, is the ability to centrally configure policies across a wide range of capabilities and features. There are hundreds, but let's focus on just a few key policies. There are high-level policies that control device monitoring and alerting, URL blocking, and virtual keyboard behavior. Sustainability is a key consideration in always on Kiosk and signage installations, so there are a set of policies that allow administrators to shape the idle and sleep timeouts to be more economic and energy efficient. And, to support accessibility for your application, there are policies to support inclusiveness through accessibility features exposed at the OS level. Many of these fields and functions available in the Admin console are also accessible through the directory and telemetry APIs. These APIs allow for automation of tasks and management outside of the Admin console. Now, Joyce will lead you through creating your first Kiosk app. Thanks, Mike. With the hardware devices set up and the Google Admin console in your tool belt, next, let's look at how to actually create a Kiosk app. If you're creating a new Kiosk app, you'll need to create a web app. This means you can take advantage of the web technologies and Chrome features that you may already be familiar with. The web is a powerful platform that gives you the opportunity to unlock experiences for your users, and we're continuing to invest heavily to bring more features. The advanced web capabilities efforts, also known as Project Fugu, will make it possible for you to build great web apps and therefore Kiosk apps with more native platform capabilities. For example, you can use the web USB API to communicate with USB devices, like a receipt printer, or save the user's edits to a photo on the local device with the file system access API. Kiosk mode PWAs also have the ability to store offline content, such as videos or other large files, using service workers on a data store like the Cache API or IndexedDB. Augmented with Workbox, a popular service worker library, your Kiosk app can seamlessly run with or without an internet connection and persist any required application state. For any capabilities that aren't available on the web platform, you can enhance your Kiosk app with an extension, allowing you to also take advantage of extension APIs. Here are some APIs relevant to Kiosk that you might be interested in. Chrome.Runtime.Restart will restart the Chrome OS device that your Kiosk app is running on. Chrome.System.Display lets you query and set display layout and properties. If your Kiosk app plays audio, you can use the Chrome.Audio API to get information and configure audio devices. As extensions in your Kiosk app are installed and managed by Enterprise Policy, there are also Enterprise Mode Utilities available to you that lets you read device, hardware, and networking attributes. These are the Chrome.Enterprise APIs. To protect user security, privacy, and trust on the open web, many of these APIs are only available to Chrome extensions installed via the admin console or enforced by Enterprise Policy. So, you'll need to create a companion extension to use these APIs. Companion extensions can then connect to your Kiosk-enabled PWA using message passing through Chrome.Runtime. This paradigm helps make sure that these APIs, which provide access to sensitive information and capabilities, are not abused and are only allowed in managed devices and Kiosk apps. Let's take a look at what you'll need to set up for message passing. First up is the extension manifest. In your manifest.json file, you'll need to set the externally connectable property, which declares the extensions and webpages that can connect to your extension via runtime.connect or runtime.send message. In our case, let's say we want to connect to ChromeOS.dev. Then from your web page, send a message to the extension with runtime.send message. In this example, we're sending a custom message object with method name property set to the string call restart. You'll also need to specify the ID of the extension that you want to connect to. And from your extension service worker, you can listen to the message with runtime.onMessageExternal or runtime.onConnectExternal. We'll also check the method name property, and if it matches call restart, that's our cue that the Kiosk app has requested to restart the device, which we can do by calling chrome.runtime.restart. For a full sample, take a look at this GitHub link. One major difference to note is that in Kiosk mode, the Chrome browser address bar and extension icons aren't visible to the user. The app essentially takes up the full screen. So make sure that you implement your extension so that no direct user interaction with a pop-up, options, or any other extension HTML page is required. Since your app is a web app running in Chrome OS Kiosk mode, you can publish your app just like any other web app, self-hosted or in any cloud service. You can then deploy it for your own managed domain or send your app's URL to your customer for them to deploy it to their domain. To deploy your app to your fleet, simply navigate to the Kiosk settings page on Google Admin Console. Choose the organizational unit you'd like to deploy to, then click the plus sign floating action button and choose add by URL. Enter in the URL of your web app. You should then see a prompt about permission granting. Normally applications that utilize permissions such as the use of cameras would need to be accepted by the user. In Kiosk mode, permissions are automatically granted on behalf of the managed user. This ensures the application works without the user being prompted. Once you've added your Kiosk app, you can also optionally set it to auto-launch. In the same Kiosk page, you'll see the auto-launch app option and a dropdown to choose between all the Kiosk apps you've installed. If you also have a companion extension, you can install your extension with your Kiosk app. Click on your Kiosk app and click add extension. These changes will automatically be rolled out to the devices you've specified so that on the next reboot, they'll be able to launch your Kiosk app. Now that you've got everything you need to set up a Kiosk device and create and deploy your Kiosk app, let's take a look at some examples. Mike, do you have any partners you want to share with us? Absolutely. Enterprises big and small are using Chrome OS in a variety of ways to modernize and digitize their in-person customer and user experiences. Arraya Digital Signage is a software service and a Chrome Enterprise recommended partner who uses Chrome OS for Kiosks and Digital Signage deployments. They align with Chrome OS in the value of automatic updates, the ease of intuitive remote management tools, the security built into the OS itself, and reduction in overhead for customers through reduced deployment time. And if you've been to a Buffalo Wild Wings in the last couple years, you've experienced a Chrome OS device running Upshow. Upshow delivers a unified customer and employee experience with their performance marketing cloud, all powered by Chrome OS. Back to you, Joyce. Whatever your use case, Chrome OS is a secure and reliable platform that can help you deliver an integrated solution for your customers and users. Kiosk mode gives you the built-in security and capabilities of Chrome OS while also giving you and your customers the tools to manage and monitor devices and apps. Our team is continuing to improve the Kiosk development experience for you, so be on the lookout for more APIs and features coming soon to Kiosk. A good way to stay up to date on Kiosk news is to go to chromeos.dev and sign up for our developer newsletter. Chrome OS.dev is our developer resource for all things Chrome OS. There, you'll find all the information we've discussed today and more. We've also shared the links in the description. Thank you for spending your time with us learning more about Chrome OS Kiosk. Have a great day!


Welcome everybody to this Cloud Native Computing Foundation webinar which will be delivered by Ori and I on just-in-time AWS access for Kubernetes workloads anywhere with Serp Manager on Thrice. A quick bit of intro, I'm a technical director at Venafire, a machine identities company and I focus on workload identities and Venafire is a company behind Serp Manager as the creators of Serp Manager and donated to the CNCF in 2020. I'm here with Ori. Ori, can you introduce yourself? Yeah, thank you. Hi everyone, I'm the CTO at Autorize. We build open source software for declaratively managing workload IEM on Kubernetes. These days I pretend to be an extroverted CTO doing webinars and such but before that I was just an introverted platform engineer. So here we go. Thank you Ori. I'm really looking forward to present this webinar together with you. It's a mouthful title kind of thing but we're going to try to break this down in easy bite sized pieces so you can definitely understand this. A bit on our agenda, we're first going to talk a little bit about AWS and Spiffy. We're then going to talk about Serp Manager and the Serp Manager CSI Spiffy driver, Autorize, you will see a real-life demo and a small recap. Before actually starting with all of the content, I want to say a big thank you to Jos van Leeuwen and Thomas Meadows, two former Fennify colleagues of mine who last year during KubeCon Europe in Amsterdam did a talk on Serp Manager Kendo Spiffy, solving multi-cloud workload identity using a defective standard tool. Really great talk. I really highly suggest to check this out, maybe even before sometimes watching this webinar if you're watching this in the recording afterwards. They will go really deep into what Spiffy is and how everything is being built up while we stay a bit more on the higher level as we want to show some other bits and pieces besides the Spiffy today and how this can all work together with Autorize. So a small bit on our honorary guest of today, it's AWS. So we are going to talk to AWS and we are going to use a service of AWS called IAM roles anywhere. It's a really great feature of AWS and unfortunately none of the other cloud providers kind of have something quite similar and what it allows this feature is to authenticate to AWS with an X519 certificate that you have minted yourself with your own tool. You mint your X519 certificate through a CA that you own, you give AWS the public keys of that CA so that there's a trust being established and then what you can do is you can exchange that X519 certificate for short-lived access credentials by using the create session feature of IAM roles anywhere and it's a very easy feature and that's what we are going to heavily leverage for this webinar. A small bit of recap as well on Spiffy. Spiffy exists out of multiple components but for the purpose of this talk we're going to focus first and foremost on Spiffy identities which exists out of three components or three parts. First of all you have the scheme of a Spiffy identity and in Spiffy that's just spiffy dot dot slash slash. The second part is the trust domain and a trust domain is kind of how you can mark your trust boundary how you can uniquely mark for example an environment so when you are an enterprise you might have different trust domains for for example production developments and these kind of mark your trust boundaries. Spiffy identities are being cryptographically signed in key materials. The two common key materials that Spiffy identity can be minted is as an X519 certificate and a Jot token. For the purpose of this talk we are only going to focus on the X519 bits but know that like the official Spiffy framework also supports Jot tokens and we're also a big part of that is also the attestation and validation of workloads. Before you can mint a Spiffy identity within X519 certificate you first want to validate that that workload is what it says it is and this can be done through multiple factors and later on this talk you will see for example how CERT Manager can help with these bits. This is where CERT Manager comes in. CERT Manager is kind of the effective standard for certificate management on Kubernetes. It's a really great tool to manage the lifecycle of X519 certificates within Kubernetes clusters. It's part of the CNCF it's currently in an incubating status as it has been donated by Vanavine 2020 but the CERT Manager team is working towards graduation hopefully later this year. It has currently more than 11,000 stars on GitHub and the main use case I think like that everybody's aware of CERT Manager is using it for securing your ingress resources or your gateway resources where CERT Manager creates a certificate that then stores your TLS certificate in a secret in a community secret that then can be used by your ingress gateway to be able to secure your web traffic. Let's Encrypt for example was one of the very first implementations of like CERT Manager and it's still like I think like the most popular used one at least I use it in my own home cluster. Always start with deploying CERT Manager and let's Encrypt every cluster. Indeed yeah like it's been used I think a 9 of the 10 clusters that I see but there are a bunch of other use cases as well of CERT Manager besides the ingress story first and foremost like it can do an integration with Vistio service mesh and some other service meshes as well to replace the built-in self-signed CA. So this is commonly done to improve the security by using external CA's and especially a lot of big enterprises they have their own CA's that they want to use and they don't want to use any self-signed CA's within their production environments. Hence CERT Manager can take care of this and it can replace that self-signed CA. It also makes it's easier to set up multi-cluster when you set up multi-cluster you need to start copying like the trust routes between different clusters this all goes away when you have like that common PKI that you can trust. Another bit that CERT Manager also has is you can build your own MTLS if you want so this either can be done by creating certificates that then store it's in a Kubernetes secret or by using the CSI drivers of CERT Manager to be able to give your workloads just-in-time certificates where you then can have your own create your own MTLS. For example common one that I have seen is lots of java Spring Boot applications that load in java trust stores. One of the other projects that CERT Manager also has is the trust manager and the trust manager is a really great project to get CA route chains public keys from many different sources and then give these to your applications so that they can trust those and this is especially great if you are needing to rely on trust stores and public NCAs kind of thing that are not publicly being distributed like for example indeed if you have your own PKI in your own company like this is a great way to distribute that towards all of your applications without needing to embed these necessarily inside your container images but you can then like easily update them without needing to update your container images and the purpose of this talk as well today is using spiffy for or issuing spiffy identities with CERT Manager and that's where the CERT Manager CSI driver spiffy comes in. It runs in so the way that this CSI driver spiffy work and kind of like how every CSI driver works first and foremost is it uses the tempfs file system on each node and with that like the private key material of the certificate that get generated never leaves that node it's like in memory and it's only there during the lifecycle of your Kubernetes spot and any Kubernetes workload so from the moment that Kubernetes spot has gone that key material is also gone because it was in memory and it's never gone. It uses the CSI token feature request CSI token request feature of the CSI driver and what this allows you is to discover the pot identity and it's going to then form the spiffy identity based on the discovery of that pot identity and embedding that in the X519 certificate signing request and the CSI token request is also to impersonate the service account so that like you cannot do privilege escalation and it does extra security boundaries and this is especially relevant for CSI drivers like the spiffy one but also like for example when you use this for the CSI secret store drivers for TCP and OIS like it uses the same feature because that's extra security on it and then the service is CSI driver spiffy comes with a second component which is the approver and this does some extra checks besides validating the spiffy identity it's going to check if the acceptable key usages are being set which is key and cipherment, digital signature, client off and server off, a request duration which matches the enforced duration so by default the spiffy identities are only going to be one hour old and it's automatically going to renew those that no sense or other identifiable attributes you can only set a single URI send and URI send needs to contain a spiffy identity of the service account which created the certificate request and you also have a spiffy ID trust domain matching the one that was configured at startup so like at startup and you will see that later in the demo we give a trust domain that's the CSI spiffy driver like it's going to match that with and then approve it and then only then the certificate will get issued by our CA and now I'm going to hand off to ORI who's going to talk a bit about authorize. Thank you so I mentioned earlier that authorize does declarative IEM for Kubernetes workloads and we're here to talk about how to do cross cloud AWS IEM access but before we dive into that I'm going to do a quick workflow of the different authorize components and roles in this so what is authorize? Authorize achieves three things with its open source components the first one is credential provisioning automation so to gain access workloads need to be identified and authenticated on AWS this happens for an AWS role on Kubernetes network policies for labels with databases for usernames and certificates and all of these different resources need life cycle management which the authorize credentials operator handles an open source project you just you just label a pod and authorize will take care of keeping all the resources and credentials necessary for authentication in sync and then you have IEM policy automation that means the creation and life cycle management of IEM policies like those on AWS, Microsoft, Azure, and Google Cloud but also the Kubernetes network policies themselves Istio policies and even access to databases this happens in an open source project from authorize called the intense operator a Kubernetes operator that you deploy on your cluster and finally we have mapping actual access so knowing that you have derived policies in place for intentional access to succeed at deploy time can be difficult when you have complicated permissioning systems such as AWS IEM or network policies where the existence of one policy can affect how another policy behaves the authorize network mapper a third open source project uses existing traffic in your cluster to auto-generate the required declarations for access to succeed allowing you to compare the declared access with the actual traffic so let's see how we actually take all of that and put that and how that works in in this specific case so in order to achieve access to AWS IEM we're going to label a pod to tell the credentials operator that we wanted to create an AWS over the credentials operator will then calculate what should be the pods spiffy identity and create an AWS IEM role and IEM roles anywhere profile and then add a CSI volume to the pod referencing the pods spiffy identity the profile and role the third manager CSI driver will then pick that up and create appropriate x509 certificate and create the temporary credentials that Matias mentioned earlier which will be able to find all of that inside the CSI volume so now we've got a pod and it has a role and it has a profile and credentials and it's able to authenticate the next step is we need to apply client intents client intents is an authorized custom resource that you apply to your cluster where each client workload declares which access it needs so once you apply to your cluster in the same name space as the pod the resource tells the intents operator what access our pod needs on AWS then the intents operator uses the client intents to create a matching AWS IEM policy and associates it with the IEM world the credentials operator created in the previous step and then once we did both those steps we have cross cloud access so I'll hand it back over to Matias for us to see a cool demo of all of this in action cool thanks so for the purpose of this demo as like we already know we're going to connect to AWS I have set it up a Kubernetes cluster in Google Cloud you can see this is a GKE cluster it runs version 129 of Kubernetes and to show I'm not cheating I actually have opened this up it's this cluster that you can see so there is nothing in AWS running so we are going from Google Cloud to AWS and the first thing we need to start with is we need to deploy search manager and this is what I'm going to do so this is a simple hell of install that we're going to do of search manager and we are going to add one extra thing besides the normal install of the CRPs and that is that we're going to disable the default certificate requests approver of the search manager install so when you do a normal install of search manager by default all certificate requests are getting approved automatically by search manager which is really great behavior the thing is that our CSI speed driver is going to do its own approver so we don't want to have like two conflicting things approving certificate requests so we are disabling search manager one search manager also has some external certificate requests approved for if you have like for example a combination of multiple issuers later down the line that you can use them together so that like for example the CSI driver only approves the CSI driver issuers and then you might have like another certificate request approver for for example like your ingress certificates which might come from another issuer the second part that we're going to do is we are going to deploy an issuer and we're going to get us a CA kind of cert so in this case we are going to use a self-signed issuer this means that it will self-sign its cert and this is especially great like if you for demo purposes if you want to have a CA and you can see like we're going to create this a CA here in the spec it said a CA is true it's quite long lift normally it will be short lift and we can also see that we have set the common name to spiffy.certmanager.io which is also going to be our trust domain and we are going to get this signed by the self-signed one and then later down the line we're going to create another cluster issuer that will contain the secret of that CA you can see this match with like the the secret name of the certificate that we're going to request and that's then what we're going to use to issue spiffy identities later down the line so i'm now going to apply this and because I have disabled the automatic approver of certificates I now for only this kind of CA I need to manually approve them luckily with the CMCTL tool which is the certmanager CTL tool I can approve this manually and I'm going to do this now and what we're going to see now is certificates all namespaces we have our certificate ready and it's all up and running so that's the first part down we have certmanager running we have a CA in our cluster now we can set up the CSI spiffy driver and for this I have prepared a small YAML file which will be our values of YAML file that we give to Helm you can see our trust domain is being set here we also refer to that issuer that we have created earlier and also for our approver bit we also need to reference the same issuer there I also need to make a small change in the images that we're using because like currently the AWS features are not part of the upstream certmanager CSI spiffy store driver I need to reference this currently to a second one I'm currently working on trying to see how we can get this into upstream as well but like what this will do is when a pod comes up with the CSI driver spiffy one it will automatically exchange that x519 certificate that it gets just in time for access tokens that can be used to authenticate the AWS so that's the main difference it has like that great session that I was talking about earlier inside the CSI spiffy driver so you don't need any extra helpers like from the moment your pod is there the credentials for AWS authentication are going to be there and they will also automatically be refreshed by the CSI spiffy store spiffy driver which is really great so I'm going to is it yes this one need to find the command so I'm going to do help upgrade and do the spiffy driver install this is pulling it and what we're going to see is that our spiffy driver is going to come up so we have the approver one so that's going to be the one that's going to approve the certificate request later down the line and then you can see like we have three pods with the CSI driver spiffy this is because my cluster exists out of three nodes and we need to have like one pod per node to be able to work as a demon set as I said like the CSI driver handles everything in temporary memory so that's why we need to have like that demon set up and running and then we're going to do the AWS bit sorry yep so we're about to deploy other eyes and before we do that we need to do some setup on AWS so that other eyes can go and do all the things that I described earlier create IAM roles IAM roles anywhere profiles and policies another thing that the terraform template will do is it's going to retrieve the public key of the self-signed CA we created before and define it as a trust anchor for IAM roles anywhere as well as configure the IAM policies and roles for the authorized credentials and intense operator themselves which will be running on our Google cloud cluster so go ahead and deploy it yeah and it's deployed and we're going to be able to see is when I do refresh here we can see this is the authorized cert manager spiffy so the trust anchor is now in IAM anywhere we also have two profiles in here set it up and this reference is the authorized intense operator role that's then like has the IAM in there and it also has a trust relationship in there maybe you can talk a bit more about that Tori yep so the trust relationship we see here is actually as you can see it has the spiffy uri for the intense operator so you can see it's the trust domain we set up earlier in the namespace authorized system which is where authorized is going to be deployed on our google cloud cluster and then the service account the intense operator controller manager and below that in the aws source arn you can see the arn for the trust anchor the whole is anywhere trust anchor yeah and this is going to enable the intense operator and the credentials operator to set up things for the rest of the pods on the cluster okay so now that we have all of that set up we're ready to go ahead and deploy authorized and tell it um what are the what are the role arns the profile arns and all of the different details that we need for this to work so you need to pass some flags here um we seem to be in the only directory but well Mattias is seeding I'll tell you a bit about the flags so we need to turn on aws we need to tell it which aws region to default to when it's creating roles and policies since we're not on aws it can't auto detect that then we need to give it the role arn for the intense operator credentials operator and tell it that we're in roles anywhere mode what the trust domain is what the trust anchor arn is and the trust profile for both the intense operator and credentials operator which we all just created with terraform so next step is we're gonna see the actual demo we've completed the setup and now we are we are gonna see a demo where we have a client and server who are communicating locally within that cluster and the client is sending requests to a server and that server is trying to submit files to s3 so before we we deploy the client and server maybe let's look at the s3 bucket and see that no files in it because it's a it's a magic trick before you do the magic trick you gotta show the audience you know there's nothing in here it's completely empty and and it's uh yeah like totally empty so that that's really great so like now we can start deploying it yep and now we're gonna deploy the client and server now the client is periodically sending a request to the server asking it to upload a file to s3 and the server right now is actually going to be failing to do that because it doesn't have access to the s3 bucket and if we look at the logs for the server and we wait a bit longer then we should start to see errors from aws we're waiting for the internet to vacuum the container out of docker hub but it's gonna arrive probably the client is still loading elevator music i noticed that it could have taken some time authorized tutorial let's see yeah it's running so the logs again it's not a good demo if it doesn't have technical problem aha there it is so so took a bit longer than usual but what you can see here in the error is that the server is failing to upload a file because it's trying to do an s3 put object operation and it's not able to retrieve credentials or refresh credentials this is basically the aws go SDK trying all the different methods it knows in order to get credentials and they're all failing because it's on google cloud how would it work so what we now need to do is we need to label our pod before that we need to do something else you're right you're right um for for this pfcsi driver to work we actually need to for our server give it the ability to create a certificate request which the pfcsi driver will do on its behalf and that has to do with the token request functionality i was talking about earlier where the csi driver is going to impersonate the service account of its subject in this case a server and it's then going to on behalf of that server of that subject it's going to do a certificate request to get like certificate issued so it needs to be able to create a certificate object and give me this of course yep if we don't do this then the pod will fail to start because the csi driver will not be able to do the certificate so we now have the ARBAC and now we're going to patch our pod and we're going to do two things first we're going to do the aws row label um for other eyes to tell the credentials operator that hi i'm this pod please create an aws row and all matching resources for me and then the environment variable aws region to tell the pod which region it should work in since it can't tell because it's running on google cloud and so to show this is all going to work quite needlessly the magic trick we were talking about earlier it will automatically create an iam role that starts with otr you can see currently this is completely empty in my AWS environment so and like when we do the patch of this one it will automatically create this one so what's happening behind the scenes we're about to see that what happened to the pod in a moment but we already can see the role that was created here and it still doesn't have any policies but maybe show the trust relationship yep and you can see that we have the principle from from before the service account name space otherwise tutorial iam service account is server and the source er n is the trust anchor it was set up automatically just because we label that pod and this is just by labeling inside kubernetes it's all like happening through authorize nothing through data forum or anything else which is really needs until now and then the last bit i guess yep so maybe before that let's look at the pod's declaration to see what the credentials operator did so can we describe the pod authorize tutorial okay i stopped being able to type when i'm live screen sharing okay so we see the sorry can you give me just one moment sorry about that of course during the webinar is when somebody decides to renovate right outside the office and make tons of noise that happens thank you to make it a bit quieter hopefully succeeded okay so we've described the pod and what we can see is we have our label and under annotations we can see that the credentials operator annotated with the role that it created and if we scroll down to the volume amounts um we can see that it created a spiffy volume with a csi driver and in the volume attributes it placed the role er n the trust anchor er n and the trust profile the role and the trust profile were created especially for this pod or this service account rather and if this pod if all pods using the service account or the service account itself is removed then the role will also be removed so the kubernetes the state of the kubernetes cluster and what's on aws is captain sink and everything is provisioned just in time so now this pod has a role it's authenticated but it can't do anything yet because it doesn't have any policies attached to its role so now we're gonna apply the client-intense cld resource um what this is saying is that the service called server wants to call this s3 bucket under this pattern and it wants the s3 put object action um once we apply this to the cluster the intense operator is gonna go and create an im policy and attach it to the role let's see it in action let's have a look over on aws to see the magic materialize and we have a policy exactly what we asked for so to sum up what did we have to do in order for all of this to happen label the pod create a client-intense now let's see if it actually works oh my god for those of you not well versed in json there's a field called status it says 200 which means we are no longer getting errors so if we check our s3 bucket now the magic trick should be complete yep we have files matias did you do that while i was away or was it uh is the the demo work the demo work the demo work and like one of the nice things as well as like authorize not only sets up like the the iam policy and uh the role for it it also does like also automatically the iam anywhere policy which is a specific one you can see here it has created this in the background which then refers to the role uh that we were showing earlier so like everything is handled by authorizing the background so you can really declare your access to AWS resources through your kubernetes cluster and there is actually no need to manually do this in AWS or need to do this through any other infrastructure as code tooling like it's all natively in kubernetes which is really nice and multicloud because this worked from quill clouds natively yep and this really simplifies handling the the lifecycle of all of these resources because you don't need to think okay if i do a helm rollback do i also need to roll back my terraform no you just do your helm rollback the resource goes to the previous state the operators take care of syncing AWS to that and you always know your source of truth is kubernetes cool perfect that was the demo time it all worked from the first try i'm so happy that the demo gods were with us today so a bit too for closing off of this webinar first of all like both authorized and cert manager are two open source projects and we're always looking for extra contributors towards both of these projects so the cert manager project can be found on its own cert manager organization and the main project is on the cert manager in there but we have a bunch of other projects as i was talking about for a bunch of different functionality like coupling with Vistio having CSI drivers the trust manager is in there so like yeah we have a quite great ecosystem already with like lots of contributors from different companies but we always want to expand this and yeah like get feedback as well on cert manager you can also find us on the kubernetes slack we have a cert manager channel in there where you can ping us maybe already you can give a bit of information on authorized and how they can contribute there so authorized isn't yet as popular as cert manager we're not yet deployed on 90 percent of clusters but we'll be there so you're more than welcome to check out any of these repositories they do most of the time it makes most sense to deploy them all in one go so they come in one helm chart that wanders them together but they can also be used standalone and we have a community slack that you're welcome to pop on to and ask questions ask like what's the best issue to get started with if you're interested in contributing and yeah come be an extroverted introverted platform engineer with me yeah and automate your whole environment through cert manager and authorized for access cool uh to recap and to uh like shortly recap what we have seen today first of all cert manager can do spiffy identities and it can mean to spiffy identity in x519 certificates uh thanks to the great coupling of the csi driver spiffy which currently is not yet in upstream but like it's open source already uh you can use spiffy identities to work with idOS iam roles anywhere and then the authorized bit sorry so once you have that authorized creates a matching aws iam roles profiles and policies and put it all together and workloads can get access to aws no matter where they run on another cloud provider your grandmother's laptop um or bare metal as long as it runs kubernetes we are covered and it works and and that's a really great thing like we showed this today from a cool cloud cluster but this could have been an azure cluster or like in the bare metal cluster that you have set it up yourself in kubernetes for example thank you for attending this webinar it was a pleasure to present together with you ori you can you're always looking for new use cases and and new things to do also if you have questions feel please feel free to reach out to us you can email me directly on the email address you see on the presentation but you can also reach out to me on uh twitter or what we now call x with my full name uh or on linkedin as well or any other source you can probably find me on uh yeah uh or it may be some closing thoughts for sure closing arguments uh it was a pleasure to to be here with human ts it's actually my first webinar ever so it was awesome the demo worked a little bit of renovation on the side but we handled it um and yeah feel free to email me reach out to me on slack just ask for a favor i do those too um and yeah try it out let us know what you think um we're really curious to see how people use this yeah definitely thanks everyone for attending and yeah we're also going to open source uh we're going to open up the instructions to fully replicate this demo by the way this will be on the authorized uh uh kit up uh organization where you can go check them out and and run it yourself because all of this what we have showed today is fully open source it uses start manager and authorizing the open source component so like you can fully replicate this in your own environment and even start using it yep and it's gonna you you can even pretend you're running the webinar and just go for the steps if you want the full experience i'm just here to inject you more perfect thanks everyone uh have a nice day for everybody listening to this webinar and hope you learned something thank you very much thanks everyone bye bye


We call meeting to order the Colchester Planning Commission and the 7 of 5. And we're going to start off tonight with their public hearing on supplement 43 toward development regulations. No, may I take you a quick walk through? All right. So I can just run through the hearing notice and then we can go through the regulations. If you want, I'm happy to answer any questions. I will note that we have one person joining us on Zoom. We're just joining shortly. Kevin Sleeper is part of the G2 change. So we'll just let him join. But anyway, so I'll go through and just go through supplement 43 as a house video amendment. It's just clearing up in existing language. It has a couple of rezoning to it. But the first thing is we're going to change section 2.0710 to exempt small chicken coops from permits. The thought was with this that they tend to move around a bit. And so you can check requirements with setbacks and then they'll move. So it's a small ones. The next thing is in section 2.09 a standards for accessory buildings exceeds 50% of principal structure size. We're clarifying that in the process involved in it. We did not mean to when we went from being a conditional use process to being a purely administrative process with particularly ag districts and what happens clarify the bars and such do not need to be in this requirement. Section 2.09 B1E exclude planning closed structures from maximum allowable square footage for accessory apartments. We've had particularly over the past couple of years shared patio or deck space with in-law apartments that they wish to have access between the accessory and the primary. And unfortunately the way that's worded right now is that counts against the maximum accessory apartment size. So this will allow for those sorts of amenities to be included with accessory apartments in that kind of against their square footage. Next one is amend section 6.03 F1 from one foot to two foot. This is above basefoot elevation. FEMA has changed some of its regulations and as part of our maintaining our CIS program is they really want to make sure that the mechanicals are above that basefoot elevation. And so this really tries to move towards that is to make sure that we don't have any mechanicals hanging down that everything is above that basefoot elevation because when mechanicals get inundated that can also be very costly for homeowners. Next on the list clarify section 8.03 B to reference back to 24 BSA section 4413. We're doing this just with some things to clarify with civic cultural and agricultural exemptions as to what those are and those have been recently clarified in state statutes so we're just referring back to that. We ever need to have that clarification or what's exempt. Another clarification is section 9.07 D4 which is exemption is for all GD districts and not just DD3. When we changed our PUD standards around open space set-asides we've had before about all GD districts and this had changed it to just GD3. So for instance the CHT was proposing a PUD for using existing buildings under our current regulations they have to do 25% open space set-aside and we're making very clear that that is not intended to be the case particularly with existing development. Next clarification is to section 10.01 C which is add C7 through 9 regarding electrical charging stations. This is a new state requirement that you have to at least provide for the electrical lines for future charging stations and developments over a certain size and so by pointing us our regulation we're doing what regional planning has asked of member communities to put out to make people aware that this is a new state requirement. And then we also in section 10.01 K clarified biker applications and again saying that they should be approximated to doorways and also electrical power sources so that they can also to benefit from electrical charging stations in the future. Section 10.01 M that we looked at to add additional commercial vehicles maybe permitted on residential properties in conjunction with the home business use. This was at a request for existing business on residential properties so that they might have some more opportunities available to them for home occupation. Amend section 10.08 B3 to B10 feet maximum night per solar panels instead of 8 feet because with the current limitations now they get ground clearance. This was something that was identified by Baccalaureate energy planning. Amend section 9.02 in 9.04 to require cross-lead ease on plans for subdivisions. Add section 10.01 M5 for commercial vehicles on businesses which is the next part of what I went over. Section 11.05 clarified expirations for tank for wastewater permits so the same as for building permits one year. Amend section 12.20 again we're clarifying some definitions for primary care housing hospice care home nursing care institution mental health facility residential care home to reference 33 BSA section 7102 that's again just in case there's any concerns about what those uses are you can point right back to state statute the definitions there. Amend section 12.02 to add a definition of group quarters lowest horizontal number which again goes back to the floodplain requirement with mechanicals and amend the definition of dormitory to reflect group quarters. This is again straining out some of the definitions to follow along with the states. Amend table 8.1 to add group quarters add 4.230 landscape contractor's yard as conditional to GD districts and lumber contractor's yard to 4.210 as a conditional use to GD2. This is signaling some of the existing uses out before that had requested and we have somebody potentially joining us on zoom about that so I'll just pause for a minute connecting audio I can come back to that. We are looking to rezone parcel tax map 64 parcel 4 and also parcel 5 from industrial to a residential one these are existing homes in the shore readers neighborhood that they're somehow resumed industrial that we are going to rezone to residential to be in keeping with what's on and that is the summary of everything that we're looking at for changes in the sub we did receive a notice from Patrick O'Brien representing SD Ireland requesting changes to GD3 we're going to set back for for barges on C streets and a modification to that and I explain that that's not on the hearing of what's in the actual regulations that were warned and that would be on her future side and I believe Mr. Slaper has joined us via zoom and I'll just quickly go over that also included in tonight's hearing is a change of use the table uses to allow as archival facilities and warehousing as conditionally used in GD2 which is at the board and so that is what you have what we're doing tonight. So we're looking for any comments from the public. So Mr. Slaper is joined us by zoom we have no members we have one number of the public but I don't know Mr. Slaper do you have any comments? All right so Mr. Slaper if you would like to comment you can unmute yourself. So we'll close the public hearing on supplement 43. I'll make a motion. Mr. Slaper did you have any comments? Yes. Very good. I just want to make sure we're jiggling some different popcorn sites I just want to make sure that you had a chance if you wanted to talk. So there's a motion and a second to close the hearing. All in favor. All right here we go. So we move on to action. This is just basically the board has any ideas of changes we can make happy with it. Any changes? Okay we need a motion. All in favor. All right so the supplement has passed the playing question and we'll next go to the slack board sometime in July. We'll work on getting a public hearing noticed out on that. Very good. I think we're possibly looking at the end of July slack board meeting again. Okay. Thank you. You don't need to do anything further but I would say that if you want to look to a slack board meeting to tune into maybe that July 26 meeting would be a good one to look to tune into it might be on that agenda. Thank you. You too. So now I need a motion to recess. All right a motion to recess. Second. All in favor. All right now we will convene as the CRS public information committee. And this is going to hit or rewind and our redo as the last thing you have to have two meetings on the program for public information under our CRS endorsement so nothing has changed since then. It's our annual program on how we're going to communicate information about possible flooding, how to get flood insurance, how to prepare for events and so a lot of this we had already undertaken in the spring. We tried to run this in March prior to any sort of seasonal link flooding but we weren't able to get on an agenda with your sort of a regular agenda until May and June. So if you approve of it tonight it will go to the slack board for adoption and it's one of those things that each year when CRS EVA updates us we just show them that we're keeping this up. I'll make a motion to approve. I'll second. All in favor. All right there you go. All right so the next thing that we have is East Leecher Drive work today. That was a very thorough job. Very good job. That was amazing. Everything right there whoever steps in again there's no question of where we were where we're at. Very very good. Saying all that I don't think we need to go through the whole field and have you read from end to end here. No so I wanted to sort of just walk you through a little bit of history of it and sort of where you're at before COVID. So I think I tried to link this all on staff notes and so this is going on a book in Plaintain Zoning with everything that's gone on to date and with the staff notes but um you had just completed the melt band issue wastewater program in January handed out to the slack board and you guys had taken a look at everything from recreation to bike pad to wastewater and heard a lot of different things sort of along the way and a lot of those weren't necessarily in your real house but I think you served as a great off-lites person for receiving that information and so a lot of that got handed off to the slack board versus the slack entity for this and you're focusing on just the zone and I think some of what you had heard and it was in the town plan was just to take a look at um some of the things that have been an issue over on waslater drive, heights of buildings, massing, use of the lake. It's all zone R2 so you're taking a look really doing any malleable uses it was really just the setbacks and so one of the things that I had regional planning for air and this is something that you can take up later is taking a look at what those setbacks look like as applied to some of the structures so a 15 foot and a 20 foot and so we began to sort of look into these sort of dimensional standards so table of uses is pretty simple keep everything residential the way it is now um dimensional standards um taking a look at maybe the lesser quick hair setback along the lake side and a greater one of 20 feet along the non-lake side to allow for bike head improvements in the future and also taking a look at you can do just simply along the non-lake side there's a lot of work so we so I collected all this information over the intervening year I had started to draft text that could create Ellis one or Ellis three and four districts for this area so I've had that drafted it's there for you guys to start to roll through at some point it incorporates a lot of what was in the Ellis one and Ellis two for design standards and we even have a draft map that we can go with but that's going to be for the next that hopefully go with but I think that when you guys are ready and when there's a staff person I hope that there's consistency in this board to help shepherd that new person through we have great staff Zach and Renee are on board they know what's going on um so you're not starting from scratch and so I'm happy to answer any questions or thoughts people had on that draft but I'm hopefully going to leave it on the shelf for good hands with these two and also with you and yours all right no it's uh no no did you have any questions or thank you for leaving in these capable hands all right I think the key thing is going to be that when the time comes it's not very visit all you had done the MBI it's just to focus on the zoning and the other thing that I'll just bring up now is I think there were concerns about and we had taken a look at and we began to discuss this what's there is there and there's a certain grandfather and you can't force people to comply by a certain date so you're going to have to work towards existing and recognize that and there are some tools that you ever want to go to strap in terms of um regulate how many building permits be issued in a year if you're concerned about how rapid additional growth could be but all the bills that we've done is only up to under the current zoning 50 units in this entire area for bill which is not whole lot so that's a conversation for later and there are some tools there if you need them but this is just a straight zoning proposal and this is contemplating sort of growth restrictions or things like that it just is really saying in the place dimensional standards design standards and really trying to preserve character of the area which I think was overwhelmingly what people were most concerned about all right all right I'll make motion for the best all right all right um all in favor all right but let's have two sets for us to so yes I do actually it's sorry the first time I've I think no you guys have actually signed the previous set yes they're on the box so this is the first time that we've actually had to sign in person I think that would be exciting all right back to information so there's a little bit of everything in there I'm happy to go through any of it but there is a notice from Burlington about their combined development importance a notice for a tower 43 Main Street our main monthly report from planning zoning south here ahead of notice regulation changes any questions of fact information I'll just sort of chime in and say in terms of future agendas you're going into hibernation again for a little bit they have advertised my position this is my last meeting with people say that it's the people I'm going to miss the most people just heard I've had excellent words to work with and I very much value that and that's what's kept me going here and just I miss you guys but it's been a good run and I think I'm leading in capable hands and it's been so nice having Zach back as an intern and now he's just taken the reins of development planner and just one with it every day's pitch hitting and planning zoning for the time being they have advertisement position I believe that they're going to try to get some of your board as soon as possible so so what is technically your last day Thursday yeah okay yes I start in Fairfax on Monday so don't rest I can't think in a great job for the town it's been a great informational wonderful experience having you with your knowledge helping us guide us through our town I think we made a lot of great decisions over the course of your time here and it's much appreciative the town's going to be losing a big asset thanks but it's um it's sort of right back at you because what's made my run here so good has really been the words I've worked with and that you all collaborate we're all involved in your community um and you all work together that is so valuable you don't get that dynamic in every community and that's part of what truly makes culture special so just right back at you guys keep on


Now we need to find X. How are we going to find X? Well, I'm going to erase some of this stuff. Let's erase this one, since we know the sum of the angles is 3, 6, is 180, and let's erase this one because we know there's six pieces of info right now. So, we need to find X. There's two ways. Actually, now there is six ways. Actually, one, two, three, four different ways you can find X. You can use the Pythagorean theorem, and the relationship with the Pythagorean theorem is a squared plus b squared equals c squared. What this means is one leg of a triangle squared, of a right angle triangle squared, plus the other leg of the triangle squared is equal to the hypotenuse squared. So, the way this works is over here, a and b always refer to the two sides that aren't the hypotenuse. So, you can call this one a or this one a. It doesn't make a difference. So, let's just go with the X being a. So, it's going to be a squared plus b squared equals c squared. So, it's going to be x squared plus 3.5 squared is equal to 7 squared. So, all you're going to try to do is get x by itself now. So, again, you're going to grab your calculator because 3.5 is a, you know, it's not a clean number. You don't know what 3.5 squared is. It was 3. You know it was 9 because you know your multiplication table, right? So, what you're going to do is go 3.5 squared is a, that's too many times, 3.5 squared is 12.25. So, you got x squared plus 12.25 is equal to 7 squared is 49. Now, you're going to get x by itself, right? So, you're going to grab this guy, bring it over. It was a plus here, it comes a minus here. So, it's going to be x squared is equal to 49 minus 12.5, 12.25, okay? I'm just going to erase these guys so we've got more room. So, 49, 49 minus 12.25 is 36.75. So, right now, we've got x squared is equal to 36.75. Now, you got x squared equals this. You don't need x squared. You want to find out what x is. So, the way you get x by itself is you do the opposite of squared. The opposite of something squared is a square root. So, you take the square root of both sides. Square root of x squared is x. Square root of 36.75 is 6.06. So, x is 6.06. y was 3.5. And you solve that one because the sum of the angles was 180. You subtracted those two to get that one. Now, whenever you're dealing with triangles, you can do a quick check to make sure you did things correctly because, as we talked about, the side for a triangle, the angle controls the side. So, that means if this is the smallest angle, then this has to be the smallest side. If this is the biggest angle, then this has to be the biggest side, okay? So, for over here, when you're taking a look at these guys, the smallest angle is 30. So, the smallest side has to be a cross from the smallest angle, which is 3.5. The biggest angle is 90. And the biggest side is 7. The middle angle is 60. And this is the middle side. So, that's a mental note. If you had this backwards, let's say this was 8.5 when you solve for it, you would know you did something wrong because that's a cross from the smallest angle. It can't be 8.5. The hypotenuse has to be the biggest side because that's 90 degrees. So, you would know you did something wrong. You would have to redo it, okay? Find out where you got things wrong, okay? So, that's the quick, just a quick intro of dealing with right angle triangles. I'm going to do a couple more of these things, solve these triangles. So, for you to get an idea of exactly how to do it and how many different variations it can give you, okay? I'm going to drop a couple more, a couple more of these guys and we'll see where we go, okay?