Today, the Pacific Air Force's aerial demonstration team will be showcasing America's premier airlifter, the C-17 Globemaster III. The C-17 made its first test flight in September of 1991, since then this incredible aircraft has set over 30 world records, including payload to altitude, time to climb, and the longest range airdrop mission in history. Designed by an elite team of NASA and McDonald's Douglas engineers, the C-17 blends raw power, maneuverability, and unsurpassed heavy lift into remote airfields around the world. The C-17 is capable of moving over 170,000 pounds of cargo in 18 pilot positions. It can easily move 10 Humvees, two Apache helicopters, or an entire M1 Abrams main battle tank and its support equipment. With air-to-air refueling, a squadron of C-17s can put an entire battalion anywhere in the world in less than 24 hours. Wand of the C-17's cornerstone capabilities is the delivery of outsized cargo into small, remote airfields. The Globemaster has 12 massive disc brakes, and an entire redundant hydraulic system slowly for those brakes. Each one of the C-17's mighty engines is fit with a thrust reversing system. These reversers allow for rapid descent from altitude, and allow the aircraft to further slow itself upon landing. From landing, you'll know how each engine opens and extends seamlessly to reverse the flow of air. Ladies and gentlemen, slanting will occur in just over 1,000 feet, shorter than the length of an aircraft carrier. There is no other aircraft in the world that can perform this maneuver. All the maneuvers you have seen here today are examples of those flown by our operational air crew on a regular basis all over the world. Coupled with the aircraft's directed lift capability, these systems allow the C-17 to safely land on short, dirt, ice, or even sand airfields. At air refueling and full night vision goggle integration, the C-17 can deliver American democracy anywhere, anytime.


We would like to welcome everyone to join us on this virtual tour of Naval Station Norfolk, the world's largest naval station, and home to the United States Navy's Atlantic Fleet. The naval station covers 6,200 acres and is home to 13 piers, an 8,000-foot runway supporting 61 ships, 187 aircraft, and 18 squadrons, all of which you will catch a glimpse of today. There are approximately 46,000 active duty Navy personnel assigned to a shore and a float and 21,000 civilians employed on the Naval Station. We will first look at our waterfront area and assets. When a strike group is deployed, the nucleus of the strike group or battle group is the aircraft carrier. The carrier is escorted by several other smaller ships that are equipped to defend under any circumstances or against any harm. These ships include anti-air, anti-surface, and even anti-submarine warfare. The ships, submarines, and service members assigned to Naval Station Norfolk are deployable worldwide. These ships are not limited to just escorting and defending aircraft carriers. Navy warships execute many missions to include counter-drug operations, search and rescue, anti-piracy, anti-terrorism, anti-humanitarian missions globally. If something goes wrong anywhere, we are there. In addition to the submarines, cruisers, destroyers, and amphibious ships home ported here, we also have oilers and supply ships which provide all of the fuel, food, and any other supplies needed by the ships. These ships are designated USNS which stands for United States Naval Ship and are distinguishable by the blue and gold painted bands around their stacks. A fun fact about our piers, the last two piers are numbered 12 and 14. The Navy does not use the number 13 because it's considered to be unlucky. Piers 12 and 14 are primarily used for aircraft carriers. These nuclear-powered ships are three and a half football fields long and a half football field wide. The flight deck itself covers four and a half acres. While deployed, it carries 75 to 90 aircraft, has a crew of 6,000 sailors, and has eight galleys that serve 21,000 meals a day. Aircraft carriers can operate for a period of over 14 years without refueling. However, it takes three years to refuel. To put United States Naval power into perspective, we have more aircraft carriers than the rest of the world combined. We have 10 aircraft carriers, and here in Norfolk alone, we have six. We are now going to the historical portion of the tour, which is the site of the Jamestown Exposition. In 1907, 10 years before the naval station was built, the World Fair was held here. Expo planners asked every state to construct a house that would represent their state. 21 states participated, but only 13 of these homes still stand today. These homes now serve as homes to our senior military officers, one star and above, and are located on Dillingham Boulevard, which is more commonly known as Admiral's Row. We will now touch on some very important memorials that we have here on base. First is the Iowa Point Memorial. In 1989, the USS Iowa's gun turret exploded, killing 47 sailors. The Navy planted 47 shrubs in the shape of an anchor to honor the sailors that lost their lives. The ammunition you see is the same size as the ammunition that exploded. Next is the USS Cole Memorial. In 2000, while in Port in Yemen, a small boat detonated a bomb alongside the coal, killing 17 sailors. The memorial consists of three sections. The main plaza of the memorial contains three 10-foot monoliths that represent the three colors of the American flag. And circling the monoliths are 17 low-level markers that represent the victims of the bombing. Three plaques are placed on the monument. The two outside pillars contain the names of the sailors killed during the bombing, and the center pillar contains the USS Cole emblem and an inscription that reads, enlasting tribute to their honor, courage, and commitment. Along the path to the memorial, there are 28 pine trees that represent 17 victims and the 11 children who lost their parents during the bombing. The memorial overlooks Willoughby Bay, where the ships leaving and returning to Naval Station Norfolk pass by. Each year, memorial services are held on base to commemorate the lives lost during both the USS Iowa and USS Cole tragedies. As mentioned at the beginning, Naval Station Norfolk has a fully operating airfield, Chambersfield. Chambersfield was previously known as Naval Air Station Norfolk and had a separate chain of command. In 1999, both the Naval Air Station and the Naval Station combined to simply become Naval Station Norfolk. Chambersfield is home to approximately 185 aircraft from multiple squadrons to include a marine medium tilt rotor squadron, three MH-53 Echo C Dragon squadrons, five Echo II Charlie Hawkeye squadrons, eight MH-60 Sierra Seahawk squadrons, and one C-2 Greyhound squadron. Chambersfield also hosts numerous transient aircraft and can accommodate any size and type of aircraft. To ensure that maximum support to all the squadrons is provided, Chambersfield operates 24-7. Each year, the aircraft executes an average of 45,000 flight operations. In addition to the daily operations, Chambersfield also hosts hundreds of distinguished visitors each year to include the President of the United States, Vice President of the United States, Secretary of Defense, and multiple foreign dignitaries. Naval Station Norfolk is also home to the largest Air Mobility Command passenger terminal in the United States, providing around-the-clock support to local and deployed forces. Their mission is to enhance the combat readiness and effectiveness of our military forces while providing the highest quality service to arriving and departing distinguished visitors. They average 3,500 airlift missions annually. Thank you for joining us and allowing us to give you a very small glimpse into the operations that take place each and every day at the world's largest Naval Station. On behalf of myself and my commanding officer, Captain Rich McDaniel, I would like to thank you for joining us today and taking our tour of Naval Station Norfolk.


All right, well welcome, my name is Jordan Liggett. I work at Red Hat, I work on Kubernetes and on OpenShift. And I'm part of the team that helps lead the Kubernetes authentication and authorization efforts. And today, I'm going to be talking about how you can use RBAC more effectively to secure your API servers and your Kubernetes APIs. So what is RBAC? RBAC stands for Role-Based Access Control. It's one of the authorization modes that you can use with your community's API server. And its job is to answer the question for every request that comes into the server. Can the subject that is submitting this request perform this verb on this object? But that's a little dry, and it's the last session of the last day, and we're all fried. So I figured maybe we'd start with that instead. So instead of deployments or pods or whatever, I'm going to walk you through sort of conceptually how the RBAC design is laid out using this question. Can Bob educate dolphins? So here's a little story. This is Bob. Bob's a pirate. Bob works on a really strict ship, and if you don't ask for permission, you walk the plank. So Bob is the first mate of the green ship, and his responsibilities, his permissions, are to help the captain and train the crew. And so if we're thinking in terms of roles, we can say his role is first mate, and the role is just a named set of permissions. And so the first mate role includes the permissions of helping the captain and training the crew. And that role is granted at a particular location. So he has that role on the green ship. Now, there are lots of ships. Every ship has a first mate. It makes sense for the permissions to be uniform across the ships. So we're going to define the first mate role globally. It means the same thing across all the ships, but we grant it locally. So Bob can only do first matey things on the green ship. Defined globally, granted locally. Now, training the crew got boring. So one day Bob asked if he could also train dolphins. And his captain thought that was a little weird, but whatever. So he said, all right, Bob, I'm going to give you, in addition to your first mate role, the role of dolphin trainer. And you are allowed to educate dolphins. But let's be honest, we're not going to use this role on any other ships. So we're just going to define this role locally. We're going to keep this one to ourselves. And because it's defined locally, it's also only granted locally. So now Bob has two roles, dolphin trainer, first mate. And he can do anything that either of those roles allows. So if we go back to our original question, can Bob educate dolphins on the green ship? The answer is yes. So we're almost done with our story. Just have a little post log. Whatever happened to Bob, it turns out he got himself elected pirate king. So it must have been his strong sense of purpose. Thank you. And so this is a permission that is dealing with something global. The armada is a global thing. And so the role that allows it has to be global. And it also has to be granted globally. So these are sort of the ways you can think about defining roles globally or locally, and then granting them globally or locally. So enough about Bob. Let's look at an actual API request and the types of questions that it would ask of the authorization layer. So a request comes into the API server. It's got an HTTP method and a URL and some headers and some other stuff, the body, that other stuff. But the first thing we do is parse out request attributes from the verb, the method, and the URL. So you can see from this, the post method maps to the create verb. We extract the apps API group, the namespace, and the resource. And so this set of request attributes becomes the input to the authorizer. The next step is authentication. So the authentication layer looks at the request and determines who is making this request. And in this case, there's a bearer token. And so the authentication is going to look at that and determine, OK, this request is coming from Bob. And so the request attributes and the user information become the input to the authorizer. And so for this request, the question we're going to ask is, can Bob in the group system authenticated create apps deployments in this namespace? So let's look at how we would set up our back to allow that. This is basically what we want. We want Bob, OK, and Bob's back. We want Bob to be a deployer in namespace in S1. And we want that to mean that he can create deployments in the apps API group. So remember our roles. We're going to set up a deployer role. And that deployer role is going to map to this one permission, create apps deployments. And then we want to grant that inside the NS1 namespace. So RBAC uses API objects to define this policy. So first, we're going to create a role object.  It lives in the RBAC API group, which is V1 as of Kubernetes 1.8. It has a name. We're just going to call it deployer. And we're going to create it inside the NS1 namespace because that's where we want to grant these permissions. And remember we said that a role is just a named list of permissions? Well, an RBAC role has a list of rules. And each rule has the opportunity to match the attributes on an incoming request. And so this role has one rule, and it matches the attributes on the request that we saw. The create verb is included in this list. The apps API group is included in this list. And the deployments resource is included in this list. And so we can pass this to keep control, create, and we have now defined a role inside our namespace with the permissions we want. So the next step is to grant this role to Bob. And we do that by binding the role to Bob. So we create a role binding object. No surprise, in the RBAC API group, we are also creating it inside the NS1 namespace. And the location of the role binding determines the location of the permissions. So if we created this in a different namespace, we would be trying to grant permissions in a different namespace. But this is the namespace we're in. So that's the first important thing about a binding. Where is it? Second important thing, what role is it referencing? So this is going to reference the role we just defined. And the third important thing, who is it binding the role to? And so you can reference one or more subjects. In this case, it's just one. A subject can be a user, a group, or a service account. In this case, we're binding to a user with the name Bob. And that's going to match the user info coming from the authentication layer. So once we create both of these objects, we have defined a local role inside the NS1 namespace. And then we've granted that role also inside the NS1 namespace to Bob. So once we do this, Bob will be authorized to submit that API request. And just like it makes sense to reuse roles between namespaces, creating deployments is something that would be useful to be able to grant in other namespaces. And it would be a pain to have to create a copy of this in every namespace. We can actually define this globally by changing the kind from role to cluster role. And all that changes is the kind, and then the kind inside the role ref. So now we are defining the permissions globally, but still granting them locally. If Alice was in the NS2 namespace, we could create an almost identical role binding inside the NS2 namespace, referencing this cluster level role. And that lets us reuse permissions and just maintain policy in one place, but then grant it in lots of other places. And then finally, if we wanted to give this permission across all namespaces, let Bob create deployments in any namespace. Big surprise, change role binding to cluster role binding. And now you have granted it globally. So to review, there are two API objects you can use to define permissions. The first is a cluster role, which defines permissions globally. And so you would use this if the things you're granting are a cluster scoped, like nodes or persistent volumes. Or if you want to reuse a set of permissions across namespaces. Or if you want to give cluster-wide access, like letting someone list pods across all namespaces or create deployments in any namespace. The other object you can use to define permissions as a role object, you would use this if the permissions are only around namespace resources, like pods, deployments, things like that. And you only wanted this definition to be valid in a particular namespace. So that's the definition side. On the granting side, two objects, you can grant with a cluster role binding to grant permissions across the whole cluster. You would do this to grant permissions to cluster scoped resources, like nodes, persistent volumes, or if you wanted to give cluster-wide access. And you can grant with a role binding object in a particular namespace. So that's the overview of the RBAC API, two ways to define permissions, and two ways to grant them depending on the scopes you want. So next I'm gonna talk about how you go about setting up an RBAC-enabled cluster. So first, the easy way. This is a one-step process. Use a distribution or installer that does it for you. This is becoming more and more realistic, actually. Most major installers have at least an option for it, and many do it by default. So kube-up, kube-atom, distributions like OpenShift, GKE, Tectonic, many of them have an option and many of them do it by default. So this is actually becoming realistic, which makes me very happy. But if you have your own deployment mechanism or you wanna know what's happening under the covers, this is sort of the mechanics of what you would do. First, you tell the API server, start with RBAC authorization, and congratulations. You're running an RBAC-enabled cluster. But there's a little more to it than that. So when you start an API server this way, on start it automatically creates a set of default roles and role bindings. Now these aren't magic. You can actually go look in the GitHub repo and the definitions are there. You can look at them, create them yourself. You can edit them. The thing that is helpful is that these are auto-maintained. So on every start, the API server will recreate these or update them adding in new permissions. So this lets us go release to release and let these automatic roles continue working. You can opt out of the reconciliation if you want, but it's very handy. There's a set of default bindings to system prefixed usernames. So the thinking is there's a chicken and egg problem with any authorization system. If you start it up and it is denied by default, then how can the first user grant permission to anyone? And so what this does is pin the default roles to a set of system prefixed usernames, which lets you provision those components to use those usernames and they automatically have the right roles. If you don't want to use those usernames, you don't have to. You can use your own and set up bindings yourself. But this makes the setup a lot easier and we found to work well with most of the installed methods. The one break glass in case of emergency type of permission you would need would be a bootstrap super user.  This is the group that is allowed to do anything to the API server. And so typical use is to set up with this, delegate more scoped permissions to other users for normal day to day use and then put this in a very safe place and don't use it for daily use. This is a break glass in case of emergency type of credential. The second level is the control plane components. Cube scheduler, cube controller manager, cube proxy. If you set these up to use these system prefixed usernames, they will have our back roles that allow the things required by those components. One note with the cube controller manager, the permissions required by the controller manager give it enough permission to start up all the individual control loops that it manages. There are actually individual roles for each control loop and passing this flag to the controller manager will tell it to use service accounts for those loops. That's recommended so that a bug or an exploit in one loop doesn't allow it to escape and accidentally start messing with completely unrelated resources. The goal is least privilege principle. Each control loop only has the power that it requires. The other nice thing about this is eventually it could let you run those control loops standalone in a pod completely isolated and just run a pod with that control loop role and it would be scoped to just the permissions it required. That brings us to Cubelets. So Cubelets are interesting. Originally they started with our back defined role but as we started thinking about what it looked like to enforce node isolation, our back didn't seem like a great fit. So we actually have a dedicated authorizer for nodes and the recommendation is to use that in combination with our back. So you can start up the API server telling it to use the node authorizer and the RBAC authorizer and if you give your Cubelets well shaped credentials they will be given permission just to their own pods and their own secrets and their own persistent volumes and not allowed to mess with other nodes, pods and secrets. That is what's recommended. That interacts well with the node TLS bootstrapping but you can provision credentials for your nodes manually or some other process if you want to as long as you make them well formed with this username and this group. All right, so at this point you have your bootstrap super user that can set up anything they need to set up. You have your control plane members working. You have your Cubelets working. The next step is usually add ons, right? Network plugins, DNS, the random things that you need to run, metrics, logging, whatever you are running that is accessing the API. What do you do about that? Well, fortunately many already include RBAC role definitions in their manifests. That's really great to see. It makes it easy to plug these into secured clusters and even if you're not using RBAC it's actually very handy to have them enumerate the API permissions that they require. For those that don't, you have a few options. There are some predefined roles. These are pretty broadly scoped. There's the cluster admin role which is a super user role that can do anything to anything. Then we have admin, edit, and view roles and these are kind of three levels of permissions that are designed to be granted within a namespace. So view is read-only access to everything except secrets because those can be escalating. Edit gives you right access to all the workload APIs, things that a normal app developer would need to create. Pods, deployments, replica sets, daemon sets, all the workload types of things, services, stuff like that. Admin includes everything edit does and also includes permission to set up roles and role bindings in the namespace. Then you start getting into access management. If you're looking at what an add-on needs, maybe you can identify this add-on would fit within the view role. All it's doing is listing services for service discovery. So you could grant one of these existing roles. And the way you can do that is to use some of the cube control commands that will let you set up the role bindings. So ideally you would grant the most limited role you could to the service account that the add-on is running as. And so ideally it has a service account, not the default one, but figure out which service account it's using, create a role binding, pick the role that lets it do what it needs to do and grant it to it. Yes. So the question was if you're not using RBAC, but a manifest has RBAC objects, can you still deploy it? The answer is yes, probably. The API is independent of the authorizer. There are some edge cases around escalation detection where we don't allow creating objects that have permissions that you don't already have. And so there are some tricky interactions there. If you're the super user, if you're using that bootstrap super user, yes, you can continue to create anything. If you are not the super user, it gets a little bit more complicated. Super user, so the system master's group, that is recognized as a super user against the API server in general, not just by RBAC. So if you grant to a specific service account that's ideal, if everything in the namespace is still using the default service account, you can grant to that. What you typically end up with there is a lot of permissions glommed on to the default service account, and it gets hard to differentiate one app from another. That's also not great from an auditing perspective. If you're trying to figure out who did this thing and you've got 16 applications all running as the default service account, it gets really tricky to know what caused the problem here. You can even grant a permission to all service accounts in a namespace, so you see we're addressing the group, system service accounts, and then the name of the namespace. This is great if you're deploying several related things in their own namespace. You can grant to all of them at once. And then we've all done it, sometimes that's necessary. Just make the thing a cluster admin. Depending on what you're deploying, if this is your credential integration mechanism or your network plugin, you probably trust it very highly already, and so making a cluster admin, we've all done it. Ideally, there would be a custom role that perfectly fits least privilege required by this app. And so now I'm gonna talk about ways to build custom roles. So option number one, know every API call that an app makes or is ever going to make, and then have fun.  And it wasn't great, so I built this. In Kubernetes 1.8, there are structured audit logs, which mean that we can very easily take a look at who is making requests and all the details about the request. All the same attributes that feed into the authorizer are available via the audit logs. And all the user info that feeds into the authorizer available via the audit logs. And so this is actually a really great way to build policy automatically. So the first thing you can do is enable audit logs, run the application through its paces, have it do everything it's gonna do with a service account that is specific to that application, and then process the audit logs and generate a role that encompasses what it did. And so I actually built this tool. So I call this audit to RBAC. I'm from Red Hat, so it's shamelessly sold in from audit to allow for SD Linux. And I wanna show you a video demo. So I have a cluster running and I've got the audit log. Let me see this. That's amazing. The pre-canned video died. There we go, okay. So when I list pods, I can see that my API request showed up in the audit logs. Yeah, I'm gonna have to come out here and watch. That's fun. All right, so I'm gonna create a job here and while it's getting going, let's look at what the job is gonna do. This is just a bash script that uses cube control to try to do some things. So it's gonna read a config map, try to delete and update it, look at pods in a couple namespaces, look at nodes and then run and clean up a couple sub jobs. And so if I look at the logs for this thing, it's actually stuck on that first step, which makes sense because it's running as a service account which has zero permissions. So let's use audit to RBAC to set up a role that's gonna let this job do what it needs to do. So the first thing we can do is run audit to RBAC, feeding it the audit log and the service account that we want it to pay attention to. And as soon as we run that, it spits out a role and that role only has a single permission which is read access to the config map, which is what I'm trying to do. It also, look no hands, it also has a role binding which grants that role to that service account. And so I can actually just pipe that to keep control, apply, and as soon as I do, my job succeeds at that step and now it's stuck on the next step. So what I'm gonna do now is set up a loop that just keeps looking at the log and generating a role and applying it and I'm actually gonna dump it out to this YAML file so we can see what's going on, but that's just for our benefit. And before I start that, I'm gonna set up a diff so we can see changes as they come in. All right, so now we're gonna kick off the apply loop and start taking a look and immediately we start to see create permissions come in. We see delete and update permissions come in. Now, let me zoom out so you can see what's going on or not see what's going on. It's dealing with batch jobs, so it's different API groups. It's moving and collapsing permissions so if you start dealing with things with multiple names, is it gonna combine those into sort of the minimal rule that covers them? It's looking at pod logs so it's dealing with sub-resources and we're just gonna let this thing run and by the end we have the role that covers it and it actually will differentiate cluster roles and roles so it'll give you cluster permissions and names-based permissions and all the bindings that are required to set that up. And if we wait for a couple seconds, I think it's about done. Success, done. So, it was pre-recorded but there was no editing. So, this is the kind of thing that I would spend a couple hours building by hand and now it gives us immediately something that may require a little bit of fix-up. You might look at that and say, oh well actually I want this to be a little broader or a little narrower, but it gets you like 97% of the way there. So just to talk about a few of the things that this is doing, it does some smart verb expansion. So if you list pods, at that point authorization-wise you've already seen the content of all of those objects. So if you list and we allow that we also let you get and watch because that's not exposing any more information. If you update something we give you patch and update. So the kinds of things that encourage best practices so that in a month when you figure out, I'm getting a lot of conflicts, I should start using patch. You don't have to come back and like update your role. You could update, we're gonna let you patch as well. It does multi-name inference. So if you access a pod named A and a pod named B it can collapse that and say you can actually access a pod with any name. That's optional, you don't have to do that. But if you're trying to infer roles from usage patterns letting exercising the app with a few example names across a few example namespaces kind of indicates I'm gonna be working with arbitrarily named objects. Same thing for multi-name space. If you do something to pods in namespace A and you do the same thing to pods in namespace B it actually moves that permission up to a cluster role and says granted across namespaces because you're no longer constrained to a single namespace. Again, it's optional. You don't have to do those expansions if you don't want to. So a couple ways you could use this. One is the way we saw here which is deny by default, watch the audit log and then apply and allow. That works great. That's the most secure thing to do. Depending on the application characteristics your application might be crash looping every time it's denied. So I wrote mine to be tolerant of that and just kind of keep retrying. But that might not work well for your application. An alternative is to run in a test environment with CI tests that just exercise everything your app is gonna do and give it full permission in that environment. And then after the fact, post-process that audit log, build roles from it and then compare that to the committed roles for that app and say, oh, you know what? The current build started using more permissions so I'm gonna fail that CI build and open a pull request saying, hey, new permissions, make sure these are okay. So there are lots of other ways you could use this. I'm excited to see how people are gonna use this. And with that, I actually wanna finish up by talking about a new feature in 1.9, which is aggregated roles. So one of the things that we're seeing as the extension capabilities around Kubernetes grow, it's easier for people to create custom resources, add in their own API servers, serving their own API types. The question is, how does this interact with policy? When I tell Kubernetes, hey, I have a custom resource foobar, I need to add permissions for this resource to the appropriate roles. And so that's what aggregated roles let you do. So I mentioned that there are admin edit view roles that are designed to be granted within namespaces. As of 1.9, these are aggregated roles, which means that you can create a separate cluster role and label it and the permissions in that role will get pulled into the appropriate admin edit or view role. And if you remove your cluster role, those permissions get yanked out. And so this makes it really easy to define a cluster role alongside your custom resource definition and declaratively create a new API type and the associated permissions all at one and those get folded into the existing roles. And if later you decide that this API type has to go away, you do the same thing, you delete your definition and your role and those permissions get pulled out. So this is a really powerful way to contribute without having to manage those admin edit view roles yourself. All right, I think we have about five minutes for questions, happy to answer any questions if we run over, I'll be out and all. This is the last session, what am I, what am I talking about? Thank you guys for coming. I'm surprised you made it up here. Any questions? Yes. So the question was, can you mix namespace and non namespace permissions in a single cluster role? And the answer is no, you would need two definitions because if you grant the first one globally, you're granting all the permissions defined in it globally. So if you said I want to edit and delete pods and you grant that globally, they get all of those permissions globally. So you need two role objects for that. Yes, is there a feature to add a mapping from an enterprise role? You mean like in some external authorization system? Yes, the feature is the Kubernetes API. The idea is that you can actually use a glue client to program down policy into a Kubernetes cluster. There's not a built-in feature, you would use the API to transfer that. Yes, so the question was, are there special permissions for auto-scaling? So the horizontal pod auto-scaler resources are their own resource, and so you can permission those individually. You could allow or disallow a user from changing horizontal pod auto-scaler resources. The HPA controller uses scale sub-resources on deployments and replica sets. And so we didn't really talk about sub-resources, but sub-resources are a way of giving you a different endpoint for restricted subsets of operations. So the HPA controller will work with scale sub-resources and typically only it is allowed to address those. Controllers also update status sub-resources and the API server can permission those differently and only pay attention to status content when it comes in via a status sub-resource. I'm not sure if that answers the question, but the two points of permissioning are different resources like HPA and then different sub-resources. Yes, okay, so the question was, are audit logs too verbose to run in production? And the answer is, it depends. There's actually a really expressive policy for describing what you want to show up in audit. So you can scope events to a particular user or a particular resource or a particular set of resources and define what verbosity you want for each of those. So you could say, I only want metadata for this user or I only want metadata for these resources or I want you to ignore node update calls completely because those happen 5,000 times every 10 seconds. You have a lot of control about what you put in the audit logs. Yes, so how does RBAC work with multiple clusters? There are a couple options. One is the program down sort of federation model where you define it here and then it gets synced down to the standalone clusters. That gives you the ability to coast if the central one is unreachable. The other option is to delegate, actively delegate. And this is actually the model that's used for aggregated API servers. So the webhook authorization mode is actually compatible with pointing it at another Kubernetes cluster. And so if you have an extension API server, those typically set themselves up to use webhook authorization checks against the central Kubernetes API server. And so you have RBAC policy defined here and all the other clusters are using webhooks. So you can either program down or you can delegate up depending on like your toleration of performance. The performance capabilities of the central one and what you want to happen when there's an outage. Yes, no, so if you were paying attention, all of the attributes that go to the authorizer come from the URL and on a create API request, the name is not in the URL. So the name is not available for the create permission. What we typically have seen done is having a central sort of namespace provisioner where you ask it, make a namespace for me and it creates the namespace, gives you a role in it and then hands it to you. Name not being available as part of create does add challenges. We are well aware. We're trying to think of ways to address it, but yeah, that's an ongoing effort. The question was, are there plans to add conditions to role specifications? It's been discussed. We want to be really careful about not breaking delegation cases. So the more input there is to the authorization decision, the harder it gets to kind of reconstruct accurately all of the context input for a delegated check. And so there's definitely interest in it. I think that is something that we're kind of currently talking about and thinking about whether it makes sense to do in RBAC proper or as a layer or some combination of the two. There's no projects I'm aware of. I mean the audit to RBAC tool actually does a simulated check internally. The way it works is it looks at the role it's set up so far, looks at the request that was audit logged and says would this have allowed that? And if not, then go add it in. So I mean it's not difficult to reuse what's there to run those simulations. Yes, are there any tools that create users and assign roles? So Kubernetes philosophy around authentication is to try to stay relatively neutral and not have users be a first class concept because everybody's authentication is a special snowflake. And so there aren't APIs around user management. As such, when you're talking about RBAC, if the user authority is over here and the authorization decisions are over here, no, there's not a particularly strong connection between the two. Time for one more and then I'll stick around as long as people want to, but yeah. All right, I appreciate it. Thank you guys.


Hey guys, what is up? Welcome to my channel. So for today's video, I am going to be doing my February favorites. So if you want to hear what products I've been loving for the month of February, then just keep watching Let's do a little monthly chit chat here about my month if you care So this was such a good month for makeup releases. Uh, I got to try a lot of cool stuff That was a very busy girl as far as trying out new makeup Yeah, if you couldn't tell the month of February, I didn't have too much going on because I posted like Every single day.  Just so you know the month of march is actually going to be a little Busier for me. I'm going to see if I can try and keep up with four to five uploads a week still But no guarantees in my other whole secret life off of youtube The high school lacrosse team. I'm coaching. It started march 1st. So Every day I got stuff to do now. Anyways, so let's just get into the products So the first thing I have here is a lip mask. This is the lanage lip sleeping mask But this is the vanilla shade so many people have raved about the rose and the rose is really really nice I have that as well But I have to get vanilla because vanilla is my favorite flavor. So they came out with this vanilla It's just as good the same formula. It just smells like vanilla and vanilla just does things to me So the fact that they came out with this was so exciting to me. I love it. I love the smell It's not very overpowering. So if you don't like really strong sense, this really isn't strong You just get a hint of vanilla and it's just really lovely and the formula itself It's like one of the best lip masks ever completely worth it. I always have dry crusty lips So this has been a lifesaver I put it on before I go to bed and I also let it sit on my lips while I'm doing my makeup So love this. If you haven't heard of this product, definitely look into it. It is fabulous Hold up. My eyes are kind of bloodshot right now I'm actually really tired right now from practice this morning Even though I was coaching so I didn't really actually do the practice But I left my house and that's a big deal for me. I haven't done that in a while. I feel like Yeah Huh, let's move on to the next product. This is the last skincare product I have for you guys. This is the charlotte tulberry Magic cream. Now if you recall in my last favorites, I did the magic night cream So these came in a little set and so I fell in love with this. I just started using this This was kind of sitting in my drawer. I heard somebody I can't even remember They used it in one of their makeup tutorials and I was like, hmm Pulled this little guy out. Oh my gosh. I've been so in love with it ever since the big bottle of this is really Really expensive. I would recommend getting the smaller one and plus it's a better value But it's just thick cream and it is so beautiful for applying before your makeup I would recommend this for oily and dry skin. It is such a good consistency Um, I do have normal to dry skin and this works amazing for me But honestly if you have oily skin, I would still use it It just leaves your skin feeling really really nice and moisturized and ready to go for makeup So yeah charlotte's magic cream super bomb been loving it I've been like slowly getting into her skincare and skin prep range before makeup Her brand just keeps getting better and better to me. I swear. Hmm I have no foundation favorites this month. Oh, I've been like switching around using my old classics Right now I am trying out the a cosmetics confidence in a cream. First of all, I bought the wrong shade So if I look a little ghostly, that's why I don't know how I feel about it to be honest Anyways, I will have a review of this up in a few days. I just want to give it a few test drives before So I do have a favorite concealer of the month though I've been loving the georgio armani power fabric concealer So many great things I could say about this if you're interested I do have a review up of this and the power fabric foundation balm up. I did a whole wear test I was loving this not so much the foundation But this is so bomb first of all the coverage is so lightweight I don't even feel it under my eyes and it blends out like butter like a dream This is my new favorite concealer to put underneath my brows to carve them out because it just blends so easily So once I put it under to line my eyebrows I'll just go like this and it blends in with the skin so easily. I don't have to work with it It's not thick It's very lightweight It provides a medium coverage which works fine with me because I feel like I don't have that dark of dark Circles anyways and it doesn't crease too much under my eyes, especially when I powder it. So I've been loving this I'm in the shade number four. So if you're looking for a good Everyday concealer that's easy to work with you can just throw it on in the morning. You don't feel in on your skin It lasts a long time This has been amazing one of my new favorites for sure So so sorry normally I would be wearing these in the video and showing you demos But like I have so much new makeup to try with all the new makeup releases that I just I couldn't So sorry So many cheek products came out this month. So brace yourselves put a seatbelt on lots of cheek products We're talking about so I did do a review of the new Benefit cheek leaders palettes. I bought both of them. So they're both fantastic. I would check my review out on those But I did want to bring out one shade in particular that I'd never tried that really stood out to me And that is the highlighter cookie. This one is in the cheek leaders bronze squad You can also get a smaller version of it in the cheek leaders mini bronze squad palette But I really really hope that they come out with this in an individual pan It's what I have on now because it's the most beautiful creamy reflective formula They do have tickle that one's a little bit too dark and pink for my personal preference But this one is so so beautiful so buttery so beaming It is one of my favorite highlighter formulas that I've tried I cannot talk enough about This highlighter formula like benefit really really did it with it I like look how glowy and beautiful I look Like I said, you can't get that color individually But I would recommend getting the mini bronze squad or just go for the gusto and get this If you're interested in anything else because coral least is beautiful You have a hula bronzer, which is one of the best in the game These three are definitely my favorite in this palette. So been loving that for this month. I really feel like it's such a jewel So good. Heck of blush products. All right. So the first one that I have I did like a little demo on and this is the charlotte tulberry cheek to cheek blush in the shade pillow talk I will link all the videos down below that I'm using this stuff because I have done videos on a lot of the Stuff I'm talking about so this one in the pan I thought it looked pretty blood to me and just like a normal blush, but on your cheeks. Oh my gosh, it is so beautiful It's like a beautiful mauvee berry shade the perfect everyday shade the perfect color to wear with so many different looks Um, and what I love about it is the inside is a little shimmery So you can mix it all together for just a glowy cheek or you can actually use this as a subtle highlighter So that's what I did in the video I use the outside ring as my blush color and this kind of on the tops of my cheeks to really Give a glow. So I just really love this blush. This is my favorite blush in her line that I've tried I don't know if you're looking to try one of her blushes. This one is 100% worth it I normally don't like to buy single blushes for high end brands because there's like a lot of money for one Uh, but this one was definitely definitely worth it Also had a review of this one up for you guys and I was so obsessed with it I still am so this month. I've just been really into simple eyes with really heavy glowy blush So this is perfect for that type of look. This is the natasha denona bloom. This is one of my favorite things She's ever come out with I just love the color scheme. I love how glowy this makes my cheeks look You can get a lot of versatility with this palette and how you use it today I am only using the duo glow blush on my cheek Uh, but you can also get a really berry cheek with this You can get a little bit of a glow with this or this or you could just use this to get an all over glowy cheek Like I said, perfect look for simple eyes and just a really pink beautiful Glowy cheek honestly that whole clown look It's a look and I'm into it. Okay. I love it. This is totally 100% worth the money. I hope she comes out with other colors. I have been I almost want to film like my blush tutorial, but that sounds really boring But what I mean is that like simple eye and really blushed glowing cheek and glowing skin I feel like that'd be such a good tutorial, but nobody would watch it Okay, last blush product. I only talked about this once but this is the jouet bouquet demore blush palette Oh my gosh, you guys, this is amazing I bought this because I had heard so many people talk about their blush formula And I thought this was the perfect way to get into it. You get six shades of blush the packaging is a little cheap But this blush formula is amazing Now I've been into super glowing shimmery blushes But this was a good way to kind of tone me down and bring me back down to earth Because these are more of a matte satin formula not too obnoxious and glowing like what I have going on because at the end of the day These super shimmery blushes they do show your texture My skin just happens to be at a really good point, but it's not always like that. I will go through phases where I got a lot of breakouts and a lot of texture and you know what? I can't be wearing glowy blushes. I need to stick to good old matte satin formulas But this is perfect.  They apply the perfect amount of color This is a very very pinky palette. So if you don't like a pink cheek, you may not like this, but I love a pink cheek It's my favorite shade of blush. So I've been loving this palette. This shade's a little out there Um, I've used it a few times. It's not the most flattering on my skin tone But I still convince myself that it is so I've worn it a couple times But anyways, if you're looking into trying jouet blushes Or just for a really good blush palette and you really like pinks Get this one. This one is super good. I've been loving that. All right. So next I have a few lipsticks for you guys They're all kind of the same So if you oh my gosh, I have more Charlotte Tilbury products I've been loving Charlotte Tilbury this month. Charlotte Tilbury is definitely the brand of the month But she came out with her supermodel lipstick collection I do have a whole video of it if you want to see the shades more in detail and what they look like on me Uh, but she came out with three shades super 90, which is a little bit of a more deep nude brown Supermodel, which is a lighter nude, which is what I'm wearing right now.  Yes, and then she also came out with super sexy, which is like a muted Corally Mulberry color, which is so beautiful. It's like a red without being obnoxious Which I feel very insecure right now because I cannot find it. Um, it's probably somewhere in my purse I don't know like I feel so uneasy right now that I can't find it But I did find supermodel for you guys and super 90s Like I said, super 90s is a bit on the deeper side with a little bit more brown. These two are super duper similar Uh, I really kind of didn't need both They're similar, but they're not they have their own personality. I don't know But I've been loving these and I swear I think it's in my head But I really do think this formula is like a such better than her regular line I think it's in my head, but like I swear these are like a little bit better than her regular line So speaking of charlotte, let's let me shot her out another time So I am trying out the icon palette right now. This isn't one of my favorites I'm just telling you in case you were curious. Uh, this is her new palette I'm using this trio. This is the diva eyes I'm just giving it a run before I film my tutorial. Um, so in case you're curious What was on my eyes this is expect a review to come out whenever sometime this week. Okay Brushes, this is kind of boring, but don't exit because this is important. Okay. I know brushes are boring But they can make or break your makeup if you suck at makeup Brushes can help you so these are kind of expensive I do have a soft spot for cheap brushes because I think you can definitely get cheap brushes And then you use an expensive brush and you're like, wow, I've been missing out So I here are some expensive brushes, but I've been loving them So I did do a video that not many people watch But it was like me trying out new brushes new makeup Isam came out with some new brushes and then I got a couple of their old brushes So these were sent to me, but like they're so good. So The first one I've been loving is the isam x 51. This has been a great big powder brush I've been in need of a new one because my old main powder brush was like falling apart So this came just in time. It's just a perfect shape to apply powder It has a perfect amount of roughness to really pick up a lot of product which I like But it also has a perfect amount of softness where it just it's so nice and fun to apply I've also been using this brush for bronzer as well. I actually use it today to apply my bronzer So like today my foundation was really really light So I was like, oh, I need to apply a lot of bronzer That was the perfect brush for me to use because it really just covered so much surface area So I've been loving this one and I've also been loving it's like little brother This is the x 52 and this has been the best Blush brush it just I think it was made for my cheek Honestly, I can't speak for you, but I can speak for myself and this was made For my cheek and I don't know what it is But the This brush really agrees with the jouet formula like these two work together This picks up the perfect amount of pigment from here and it's just like I swear I don't have to blend with those two.  Um, but I got the eye set from wingos Been loving this set just because it's a huge range of different blending brushes And I love a beautiful blended look. I know cut creases are in and I try to get into it And you know, I'll do a few tutorials on it But at the end of the day my style I love a blended eye And you can never have too many blending brushes to stop colors from being mixed together And you just get all different shapes and sizes in this set in case you're curious Some of my favorites, um the 17 brush from wingos Perfect crease brush just in general been loving the 20 brush to really get in the outer corner and the lower lash line And 19 has also been really good for when I do Want not a cut crease, but I do want a more defined crease. This has been the perfect shape I mean, I've been loving these. I mean, who am I kidding? I love all of these in here So, I mean wingos is expensive as well But again, if you get this set you don't need any other blending brushes, you know So it's an investment, but these are gonna last a lifetime. They're so good quality. I'm really excited about this month's favorites video I feel like it's because all the majority of these products were new to me that I tried this month And they just really took over the show and I guess that's why I'm so excited new products good releases February it was a good month for me makeup wise found some awesome products Also found some not so awesome products, but um, I digress. I hope you guys enjoyed this month's favorites Let me know what your favorites were for this month Of course, I left all the products I talked about in this video in the description box for you to check out at your convenience And you know, I 100% Stand by you purchasing these products because I love them and I want you to experience what I experience with them Don't come to my channel if you're looking to save money. Okay. I'm the friend. You don't want to take shopping You deserve it girl. Get it Anyways, I hope you guys enjoyed this video. I hope you found it helpful Uh, remember to like my channel wait Well, I mean, I hope you like it, but remember to like my video comment down below Let's get a conversation going subscribe to my channel. Turn the notification bell on I've never told you to do that But honestly you should because I'm uploading all the time now and I want you to watch my videos Um, and of course subscribe to my channel. I hope you guys are having a great day I hope you guys had a good month and I will see you guys in the next video. Bye guys. Have a great day


Good morning to each and everyone out there and welcome to my village. I've been calling myself I'm the village boy from Ghana. So today I want to show you my morning routine growing up in a village in Africa. I have seen my fellow content creators waking up from big beds, exercising their body. And I could not relate because my morning routine is an exercise on its own. Growing up in the village from mattress were for our parents where we kids sleep on the mat.  The clothes that you are wearing that day that is exactly the same clothes that you sleep with. And when you wake up in the morning that is when the exercise begins. And what I call the exercise is sweeping the compound with your neighbors. And after sweeping since you are the youngest in the family you have to go and empty the dustbin.  If I should show you the distance from my house to the refuge dam some of you will think that that's a lie. But from this drawing shot I know some of you will believe me. The distance from my house to this refuge dam will take me 2 kilometers. And when you get there you have to pay depending on the size of your dustbin. After dumping of refuge you walk 2 kilometers back to the house go get a utensils and start washing. Now it's time to brush my teeth.  We had 3 different traditional ways of keeping the teeth clean and bright. And one is the chewing sponge. Chew the sponge till it gets soft and you start using it to brush your teeth. The second one is the chewing stick. You chew one side till it gets frayed and you start using it to brush your teeth. Also use the mirror in case your parents are there. The last one is my favorite. And this is how we used to whiten our teeth those days. First of all, crush the charcoal. After crushing the charcoal, now grind it into a powder form. Now crush the plantain peel to obtain a spongy like substance. Dip the plantain peel sponge into the powder charcoal. Now you are good to go. Brush your teeth. Oh my God, good olden days. After you feel refreshed, it's time to add more liquid clay to the traditional tripod cooking stove. I mean, I know most of you have never seen this before but this is faster than all the cooking methods that I know.  Basically going to cut worse the grass for the live stove. Come back home and then feed them. The two good hours all I need is a quick cold shower. So I have to go to the top, go fetch water. I hope you guys enjoyed this amazing morning routine from the village. Leave a comment, let me know if you can relate to my story. I help my, I don't forget to give this video a thumbs up. Subscribe if you are new to the channel. The boy is the Ghana baby, the village boy from Ghana. I love you all. Peace out. Bye.