If it's Tuesday, it's Entrepreneurship Tuesday at Y244 Channel is where you can find us across all our social media handles at Michelle Ashira. You can find me across all my social media in this particular session. We're diving into an interview that looks at the Nail business, the Nail Palace sort of kind of business. The whole aspect of it. Instead, I am joined by Christopher and Jenga who is a nail technician at Chiba Nail Bar. Correct. Chiba Nail Bar. That's where you find Chris. Thank you very much Christopher for creating time to be with us today. Thank you so much for welcoming me. Hey Chris. Yes. So when I say my life is not perfect but nails are not perfect. Yes. Nails are not perfect. But your nails can be perfect. Yes. Life is not perfect but my nails can be perfect. Exactly. And also the guys, the gentlemen, because now the beauty industry in 21st century is quite different from way back. Now the gentlemen are into grooming much more.  All right.  This is actually what I love and this is what I'm going to do. Okay. First of all, say thank you for hosting me here. You're very much welcome. Okay. My name is Chris Jenga. I work at Chiba Nail Bar. I ran the brand called Varembona Chris. Basically, when you ask about how I started my business, how I operate my business of Varembona Chris. Yes. And the beauty perspective issue. This is the thing I've dealt with it since time, Kitambo, because I studied, I did art and all that. So I loved expressing my art even through people. And I'm kind of a guy, I'm an extrovert who loves ladies. So I was brought by two lovely sisters and my cousins out there. And I used to like them when they are beautiful and all that. And it's just in me, I just want to see a lady glamorous. Yeah. So I can see that's why what's pushed me to beauty industry, to nail industry. Because my impression first of all is not even nails first before nails. Okay. Repeat that again. Nails first before nails. Ladies, did you hear that? It is nails before nails. Okay. So how did you gain the skills? Okay. It's back 2017 where my cousin opened a beauty parlor. And I was there with her because she used to, we're good buddies with her. We used to be good buddies, we're still good buddies with her. And so she started a business because being personal, I am as in quote-in-quote, of liking my cousin and all that, I saw this an opportunity to work with ladies because ladies are in my thing as in I just love ladies and all that. I just love ladies looking out and... Looking all glamja. Yeah. Right. So for someone who's watching this conversation and they've never been to a nail parlor, what does a nail technician actually do in details? Basically, a nail technician does what I do. It's basically making you as a person, be able to step out wherever you're going. Maybe it's like you come into a studio. I want you to take care of your face beat. I want to take care of your nails. I want to take care of you. When you're going out there for the office work, I want you to be presented as in to have that confidence and I'll make sure I make your nails to a point like nobody misses out to see who Michelle is. They want to know, this is Michelle. Look at her nails. If this lady is taking care of her nails, this lady is in another class. Yeah. So it's basically taking care of your nails, taking care of your feet because of pedicure, manicure and all that. So you work without confidence.   You're feeling like the queen. Feeling the queen. Yes, feeling the queen. At the Sea of Varembola, Chris. At the Sea of Varembola, Chris. Okay, let's look at the services that you offer because I know when it comes to nails, there are different types of nails and different types of prices that comes with it. So take us through that. The different, the way you're seeing the different types of services offered in a nail bar.  You have the nail perspective whereby you have different people who like to do just their natural nails and the ladies who want to put on that extra image of having long nails, short nails or those carving nails, those, I don't know what it's expressed as in... Different shapes of nails, like we can have bogs or coffin looking like. Exactly. Okay, so it's different, whatever I want, what you're saying is I can get it. You can make my desire, my vision of particular art. You can make it come to life. Yes. For someone who's watching this conversation and they want to get into the same sort of kind of business, how can they gain these particular skills? First of all, when you want to do this kind of business, it must have a passion because you're treating a lady who you don't know. You will ever come back. You must have a passion. I want Michelle to look glamorous. I must be passionate making Michelle so that when I'm doing this kind of work, I want to know what does Michelle want. I must have that passion. I must have the skills. I must go and do the extra. It's not a must. It's good going to school and all those, the different nail schools and all that. But if you don't have the passion, if you don't have the skills, it's totally different. Let's look at the monetary aspect of it. How do you make your money? When it comes to your first client, how much time do you spend on this client and also different rating card for your prices for different nails at the nail bar or even different services? The different services that we offer, the different pricing we have, it all depends again, as I said earlier, it all depends on the services you've done. If you're doing tips, we charge them separately from the normal gel because if it is tips and gel, you'll price this particular amount of money, let's say 1500 if it is a clear X, it's 2500 if it's gum gel, 3K and all that. It all depends on your budget and the kind of service you want. And how do you make sure that you guys stand out in the market space, considering that it is an industry that has been actually quite very crowded in the market, so how do you guys stand out? What is so different about Warenbonakris? What is different about Warenbonakris is not only about making money as we're talking about money. Yes, money is good, all businesses must make money. But at the end of the time, what makes me stand out is when Michelle comes in, she's not just coming for nails, she's coming there to relax, she's coming there to have her own time. It's between me and there as in us too, you see. So that's what makes me stand out. Doing my work to perfection, because I'm a perfectionist, I love, when you're out there, you're able to do your nails like, yeah, these nails are different because the services I offer, I just make, I twist something. Because everybody can apply gel. Anybody can apply gel. If you go that extra mile, maybe decoration and all that, yeah. And speaking about decoration, how do you keep up with the new trends when it comes to art? Because when you head onto Instagram, as you can see, we have just seen from your Instagram page Warenbonakris, there's so many different art out there. You just come into Facebook, social media, different nails and just different art. How do you keep up with the trends? Keeping up with the trends and all gear or step whereby I'm up to date with even the celebrities, what our celebrity is doing. I'll check people like Nicki Minaj, Cardi B and all that. What is their trend? Because I will not stay like, those ladies of Kitamwa, Kinamerika, you know what they used to do. They used to do nails just, plain nail, but at this time, Kinakadibi are here. Oh yeah. I must make sure.  Okay. So we are going through some of your work that is running on our screen. That is Warenbonakris on Instagram, right? Yeah. Okay. Another question that most people ask, especially your parents, when it comes to the long nails, because when you see Cardi B, when she's all on the music videos, with the long nails and everything, do you play a role when it comes to explaining to your client the type of, the length of the nails they should have or is it a personal decision? And what's your take on, you know, ladies who go for the long nails and they're different workspace. Yeah. Just take us through that. That's a tough one. But what I would say is, when a lady comes and say, I want particular nails, maybe they soak at the beach below and all those big, big names and they're saying like, I want nails like that. So first of all, I say, okay, I am able to do that. I will do that because you're paying me. But I'll try to figure out, like I have some Nazis. I have some people who are in the food industry and all that. You know, I will not put long nails for them because I know they will struggle. Like doctors, I can't put long nails because of the gloves and all that. Because professionally, you're not supposed to have all those long nails and all that. Yeah. I don't believe it to be comfortable. It will not be comfortable. So it goes back to what you do. What you do.    Maybe even here, you're talking to us. You're expressing yourself. Yeah.  Yeah. And maybe office because others just, you're typing on your laptop, on your computer and all that. The nails they're typing and somebody passes by, then they make your environment different. Okay. Yeah. And what is your strategy when it comes to maintaining your clientele? My strategy first of all is listening to the client.  What kind of tips do you want? What kind of shape do you want? I will advise you as in you tell me I want those long nails, ballerina, I want those long nails, stiletto and all that. I will listen to you. I'll look at your hands and all that and say this shape and your nails, they are not matching. So I will advise you because when I advise you, then when you go out there, you'll come to appreciate and say, wow, Chris, advise me on ABCD so I can trust Chris next time. Yeah. All right. There's a whole strategy around the type of, the shape of nails you want and your hand, how it looks like and there's a whole aspect on that. Yeah. Also, Kala, because you'll come and say, I saw Michelle with red and for me, I know your skin tone. As much as you want red, it will not blend with your skin tone. So all that advice you say, yes, you want red, we have all those colors because we have like hundred colors because it's a different priority. And I'll tell you for this red, it will not match with your hand and all that. So can we adjust? Maybe I'll push you the red one, but I'll twist something on it. Okay. Let's look at the tools of production. Tools of work. I was about to say tools of production. No problem. Let's look at tools of work that you guys have and is it quite expensive if someone has to get into this business and how do they get them if they even take us through what we have on the set. Okay.  So but what I would say, you want to invest in this, make sure you go, you don't go ah pie. I'm not saying you don't go there, but again, have the tools that will make your clients comfortable. They'll look like you have invested like for us and I'm not marketing blue sky and all that. Our shop, Shiva Nail Bar, we normally like prioritize on blue sky because we know blue sky will never disappoint us.  When it comes to buffer, what buffer are you using? Because it will determine if you're buffing the nails, the client nails and all that is happening. The client will feel, this thing is so rough, this thing is too, as it's breaking and all that, it's not standard and all that. So it all depends on that. And again, you go to the right companies that they offer because you can do all that research. It is there on the internet. Okay. Yeah. So just good quality, make sure that you retain your client at the end of the day. Yeah. So take us through what we have on set now. What is the this particular white object and what does it do? This particular white object is called UV. Thank you. It's for drying gel. Yes. And basically, because gel is not like normal polish or cutex as we used to know it in back in the days. When you've been applied gel, gel needs to to manicure as in and all that. So it needs to be connected to the power source and all that. There is one that we used to do, like Kausha, the gel polish. Oh, wow. And then we have the buffer. The buffer is basically to buff your nails after we're filing and all that to make them, to make the gel, to make gel able to have a good base for it to come and sit on it so that the gel does not look rough on you. The nails look polished and all that. And then we have the gel itself and the other tools that are not here. But we have the gel that it's there. That's a color that you have. And we're saying, like in Chiva Daleback, we're Rembuna Chris, we have like a hundred colors so you're spoilt for choice. Okay. So these are just the basic required tools that one needs when it comes to this sort of business. They are files, they are nail cutters and all that. Okay. So what are a couple of challenges that you're facing? Challenges, basically, as in, I don't know what you mean by challenges. As in in the market personally. Okay. In the business that it is. Yeah. Challenges we're facing is like, a lot of, there's a lot of imitation of things. And that's what I'm saying. When you're going for these tools and all that, make sure you've done your due research. You know this, this, if it is gel, if I apply this gel, what are people saying about it? Because the challenges that are there, there's a lot of imitation in the market. But you need to step up as a business owner, as a nail, a nail, nail, a nail by owner. Yeah. So the challenges that are there.  And the price that you put, somebody thinks like, no, this is too much. They compare you to the other places that they were. Yeah. But if you go back and do their research from other places, you'll come to realize is that the other place, they are so cheap and all that, and it's good to be cheap and all that, but at what expense?  Those are the kind of challenges. Okay. You put your clients interest at heart. Yeah. Not just business as usual. Yeah. Okay, when what is the best feeling ever after you've like, you know, you've worked on a client and what's the best response that you've ever gotten from a client? The best response is like compliments. You feel somebody is tagging you on Instagram, Facebook and all that, and they say, these are my nails, nails done by, even they'd say, visit my, my nail plug and all that. So it's a compliment. Somebody was satisfied and that's what pushes me. So client satisfaction. Yeah, client satisfaction. All right. So that's it. Warren Bonacris. Yeah, Warren Bonacris. All right. So what are your immediate handles if they want to reach out to you, get their nails done, pedicure, manicure, facial all that. On Instagram at Warren Bonacris, underscore n- underscore criss, that is Warren Bonacris, but if you will forget those underscores, if you just type hashtag Warren Bonacris, everything will come there. Everything pops up. Yeah. All right. Thank you very much. Santisana. Well, Christopher Njenga, for creating time to be there, taking us through what's nail palette looks like in terms of different art that you have also got to see from your social media handles at Santisana. Okay, thank you very much. That is Varembona Kris, yeah? Varembona Kris with Christopher Jenga. So make sure you catch up with him across all social media handles. That is Varembona Kris and you can reach out to him and he'll he got you. He's your plug when he comes to the nails. That is pedicure, manicure, facial, anything, everything when he comes to be glammed up as a lady head on to Varembona Kris. So our time frame, it's finally our time from at 10. So this is the end of the show. So make sure you create time next Tuesday, same time from 7 till 10 a.m. at Y254Channel is where you can find us across all our social media handles at Michelle Ashiro is where you can find me across all my social. So make sure you create time, yeah? Create time next Tuesday, same time frame. Alright, so have a, enjoy the rest of your day. Keep it right here on Y254 channel, the number one youth station. So make sure you stick around because there's so much more when it comes to programs right here. Have a nice day. Take care.


Hey, thank you. Thank you for being here this morning to learn about how we as a support team at Rackspace take care of over 100 private cloud customers every day. Going to give you, there's four of us talking today. Behind me is Darren. He was born and raised in San Diego by a pack of wolves. He's busy raising his kids now up in Dallas Fort Worth with the same pack of wolves. And he's the second shift guy on Rackspace, private cloud engineering support team to solve all of your cloud problems. I am Mark DeVurter. I've been at Rackspace for a little over five years. The one thing I've really learned with Rackspace is kind of grab your and get ready for what's coming next because sometimes it's not a smooth ride. Big guy over here is Chris Woodard. And he's here just to prove that somebody, even somebody with a Louisiana School of Public Education can work an open stack. Berto behind me hails from North Austin. His full name is Alberto Rivera Laporte. And North Austin is where people with the names of that complexity come from. He lives with his wife, Diana. He's got two dogs, Leo and Ryder and the cat, Daisy. He didn't give me a picture of the cat. This is sort of internet stuff. He failed for not giving me a picture of a cat. Anyway, to move on, I'm going to hand it over to Berto. And he's going to talk to you about open stack support one year later. Hey, greeting, guys. So what Mark actually failed to tell you guys is at the end of the conference, at the end of this presentation, there's going to be a real nice cat waiting for you out there. So congratulations. All you guys are going to be cat parents. I wanted to ask everybody a question here. How many of you are open stack operators in the room? Oh, man, this is sweet. OK, how many of you are actually new to open stack in general? I have very little experience, so I haven't worked on it before. OK, fantastic. This presentation is for you guys. So this month actually marks my first year where I've been working in an open or supporting open stack at a professional capacity. So I've survived my first year. It's been really interesting and very exciting, and I'm happy to share a lot of my perspectives as to what goes into supporting this type of environment. So when I started learning, or when I started working with open stack, this is my perception of what the average environment would look like. We are very simple, but it's not always the case. It does that diagram that you see here does a good job into giving you an overall perspective of what open stack environment looks like. But it's not when you actually start digging into it, then you start uncovering the fun stuff. And seeing that for the first time, my mind just went absolutely blank. So this is what resembles a logical architecture in an open stack environment, keeping in mind that does not take into consideration any of your routing, switching, or host, or any of your physical layout. So it does do a good job, as well, to tell you about the complexity that we're involved in working with on a day-to-day basis. So to the eyes of a guy that just started doing this or novice, you just feel like you've just been entirely just trolled by open stack. But it's like that with any type of technology, right? It seems a little bit unsurmountable at first to be able to be very intimately familiar with a lot of this technology, especially as a new guy. But like everything, it just takes time and patience and determination, and then you should be able to get a decent idea of what it is, even after a year later. Now let's explore some of the differences on traditional support, Linux support, and then what you do as an open stack administrators for those that have never supported open stack before. And a lot of this right here that I'm going to be presented next, it's very subjective to the size of your organization, right? They are small shops or small organizations where you see the Linux team pretty much handling everything that you see there and more, where there's also large organizations where there are multiple Linux teams, which are focused on different disciplines. So that just wanted to just point out the difference there. Now, as far as how differences this is in comparison to what you do as an open stack, it's really not a lot changes. You just get to wear a lot of different hats at the same time. So you get to do everything that you see there in a traditional Linux support environment. And you might be exposed to a lot of different technologies that some of you may or may not have any experience working with. I mentioned containers there just because, as a rack space support engineer, we utilize open stack Ansible as the deployment method for our open stack deployments, which uses that technology as well as containers. Sorry. Yep, we use those two technologies to deliver the installation and maintenance and upgrades of the different planes. Network or networking configurations are still one of the very challenges of understanding open stack as far as the deployment methods. It uses a lot of different technologies that a lot of the times I haven't seen. I've been doing Linux for close to 10 years now and it wasn't until I started working with open stack where I had to learn about Linux network namespaces. I was like, my mind was entirely blown by the concept at first because you typically don't see it on a day-to-day environment. And then you have to deal with stuff with Linux bridges, open V-switch if your neutral model supports it, and same thing with IP tables. There's lots and lots of ITP tables that you have to familiarize yourself with. In addition to all of the challenges that you're seeing to having to figure out the physical components and all the other infrastructure, you also didn't have to worry about, not worry, but you have to be responsible for supporting all of the different components. And I'll point back to the logical diagram that we were looking at. We have to dig very deep into a lot of these Python messages or stack traces and identifying what is a normal condition. I mean, is this what it's supposed to be doing? Is this a bug? And given the inner dependencies amongst all the services, a lot of the errors are very obvious, but a lot of them require a lot of dig digging. But like everything with some patients and determination, you're rewarded with a greater understanding of the whole picture. And even a year later, I still have a picture still almost there, but now it's great. In addition to this, you have to also educate and help your consumers of the cloud, meaning your tenants, your projects, your users, with all levels of difficulties of experiences on those users, in addition to dealing with your day-to-day to additional system operation responsibilities, break fixes, continuous improvement, infrastructure life cycle, backup security, and all that stuff. Now, some of the useful strategies to me as a new open stacker, things that I've discovered along the way that have helped me understand this is to divide and conquer, right? I really hear it's the term divide and conquer. It's dividing all of the different components into what they call planes.  You're gonna be hearing control plane, network plane, maybe compute or storage plane, is identifying all those different components and the level of criticality, right? So the control plane, which consists of all of the services that are shared among all of the open stack services, is what I think is one of the most critical, right? So having a great understanding of how this perform and how well this scale is very critical to any open stack infrastructure followed, which I can't believe I didn't put it here right underneath the control plane is authentication plane, your keystones. You have to understand because as a service that is dependent across it, all of the other projects utilize it. So it's good to have a great understanding of what that entails and how to troubleshoot it and so on to get a better idea of what the entire picture. If you are a new user or someone that's still a little bit on the fence or still looking to explore a little bit more, start small. There's, even within a year from now, there's still been a great changes on the number of all-in-one distributions that are out there that you can use to familiarize yourself with the different projects. And if you were like me that were intimidated by that crazy spaghetti diagram that we see at first, it's really rare to see all the projects implemented at the same time. I mean, so that's one thing. And with that in mind, taking time to explore your core projects, right? Your Keystone, Nova, Neutron, Cinder, Glance, and Swift. And join the different mailing lists that we have. Their IRC channels, your open-stack meetups. I mean, I'm crazy, I'm blessed here that here in Austin we have a really big open-stack presence and there's a lot of meetups that happens on a monthly basis and because of my schedule I'm not able to attend them all, but man, it's great. It's a rich resource to have to interact with other open-stack users.  You know, that's pretty much for me for this morning. I'm gonna go ahead and pass it to Darren Carpenter here. How you doing, everyone? I'm gonna be talking a little about public cloud or private cloud. What's different, what I've seen. Still kind of a high-level overview, but let's keep going. So things changed quite a bit when I went from supporting private clouds to supporting public clouds. Regardless of which cloud you're supporting one key thing is always, you know, stands in the forefront of my mind is that I'm here to serve. I don't want customers using services that they're unfamiliar with or making simple mistakes that I could easily help them avoid. In the public cloud, imagine each support team being compartmentalized from a support aspect. Everyone tends to have a specialty or focus that they're assigned and your success is measured on how deep your understanding is in that focus and how that translates to a happy customer. We had folks specifically working with Nova, others with Cinder, others, you know, tailoring images for consumption and so on. In the private cloud, just imagine being thrown into a canyon, left to fend for yourself wearing a tunic and wielding a crudely made spear. The environment around you changes every six months. So the little shelter that you built to get you guys out of the environment needs to be constantly in a state of growth. With that in mind, from the viewpoint of a support manager, the type of folks that you bring into your fold needs is a very important decision, not that it ever isn't a important decision. It's just that you have to consider that not every great thinker is a great adapter. I realized shortly after transitioning to a private cloud role, that attempting to sit pretty as a master of one or two things simply was not going to be acceptable. Support in a private cloud is like being a Swiss army knife where every tool that you have at your disposal is constantly being used to the point of going dull. With that, the requirement that constantly sharpen your skills becomes paramount in the future success that you're going to achieve. Outside of simply having a support team where members of the unit come from various backgrounds and have various levels of familiarity, it's benefited us to have a small team of folks dedicated to research and development of a training regimen. These folks could be chosen simply due to their tenure, but in my opinion, it works better to find folks with a training background and melding those two groups together. Just have the best results with that. Not to say in the public cloud that you should not also receive training, but from what I've noticed in more generalized roles, the will and desire of the individual determine how much training they're going to pursue. Whereas in the private cloud, it needs to be part of the actual job description to receive frequent training on new and upcoming technologies. Working on the public side, I've run into a very wide range of customers. These customers can be mom-and-pop startups, small development groups testing something out, a variety of other types. The other end of the spectrum can be large companies that simply don't want to invest in the hardware and expertise required to operate things privately. What I've noticed the trend with these large companies in the public realm is that they're testing the waters to see if this is indeed something that they wanted to do. The problem I saw with that was the fact that resources on these hosts are shared and environments created tend to be deployed similar to that of a dedicated offering in that redundancy and recreatability are sometimes limited and this sometimes left them with a bad impression. Let me stop there to make a very important point in my mind. Regardless of the route you choose, public or private, the architecture of your deployment needs to utilize the strength of the cloud. That strength in my opinion is the ability to deploy quickly. Without the overhead and delays encountered in procuring and bootstrapping those new resources. Far too many times in the public cloud, I had customers running issues where they took their dedicated mindset of a single machine or set of machines that must stay up. What I found in all these environments is the data, of course, needed to be accessible, but it wasn't placed on a medium that could easily be transferred to another host in the case of a down event. Ideally, we're coming from a down event in the cloud, should be as simple as bringing up a new host to be a configuration management, potentially even automated against a monitoring failure and associating the required data to that host. Afterwards, you pull the problematic device out of the equation and then once the swap is complete, throw it away. If you were using Rackspace's public cloud, this would typically involve cloud load balancer in front of the respective service with various nodes behind it. RCA's would be limited to repeat issues with hosts of similar type, saving time and effort from your staff at the end of race, but requiring a little bit more preparation on the front end. Now please understand, my experiences do not define every workload or data set, this is just kind of what I've run into in my time amongst the clouds. On the private side, the customers begin to look a little bit more simpler. Similar, they're typically larger, have a legacy dedicated environment, they're attempting to shift onto their cloud platform. These companies typically have a little bit more experience with cloud, though they haven't necessarily graduated from some of the mistakes they made in the public cloud. One key thing that they do understand is that owning the entire cloud presents some new problems, but it prevents other people's problems but from becoming issues that they have to solve for within their deployment. Supporting the public cloud revolved more around the knowledge of the APIs and the ecosystem that was built around the environment. The department-type support was kind of the norm once I moved into an operations role, since the environment gets so large at that point that it's no longer feasible to have a single individual or a group of individuals supporting it. Specialist-minded folks seem to thrive here as they could pick a particular project they were interested in and dig deep. Personally, I've always been more of a jack-of-all-trades, which is why I feel very comfortable working in a private cloud support role. Rarely have it all as far as I can remember that I touched Keystone in the public cloud. Whereas in the private cloud, manipulation of users and tenants is rather commonplace. Upgrades definitely become more of a job in the private cloud. With the frequency of releases, you're typically in discussion with the one or another customer about the version OpenStack they're running and how they can get up to the new, latest, the greatest, with all the fancy bells and whistles. With that in mind, it would benefit you to have a drafted plan in place for environment upgrades and how your instances will be handled during these events. You get to shuttle the instances down at once. You want to shut them down per compute. You want to restart instances in a particular order. Maybe migrate the instances to available hosts. That would probably be the preferred, in my opinion. Another benefit of private clouds is that they provide you with greater flexibility in terms of what modules are utilized. For example, if you want to use Neutron with OBS, Neutron with Linux Bridge, versus in the public cloud, you're pretty much stuck with whatever the vendors decided it's going to work best for them and their environment. Multi-region deployments are another thing that need to be considered as many companies have environments, locations, and customers scattered across the world. From the public cloud standpoint, when dealing with a relatively larger provider, it's much easier to get a married environment in multiple locations as part of their selling points going to be where they already have a presence. Contrasting that against the private cloud, this would typically be limited to where your company itself has a presence, assuming you were going to host it in your own data center. If you were using a cloud provider, you could, of course, utilize their data centers. Public cloud, in my opinion, gives you greater agility in this area, simply because the hardware's already in place. It just becomes a matter of determining what is needed, spinning it up, running some configuration management against it, and then send it out in the wild. Whereas in the private cloud, you may need to order the hardware, get your initial kick, add it to the environment, boot your instances, run configuration management, and so on. Another thing I noticed is there seems to be like a lack of a deep talent pool when it comes to cloud computing, both for the public cloud and the private cloud. The benefit the public cloud has is it's usually a solid system administrator can pick up the nuances of supporting a public cloud environment relatively quickly. While in the private cloud, they'll need to get their feet a little bit more wet, just because you have a tendency to deal with quite a bit more variety on a daily basis. But with that in mind, utilizing the expertise of cloud providers and their support teams becomes beneficial to organizations that don't want to hire a new staff or invest heavily into training their current staff and cloud concepts. One thing I can definitely say that benefits the public and private cloud, consumers rather, is to lean heavily on configuration management. And if you're an administrator, it would behoove you to become familiar with one or more of the configuration management tools. If you're logging into every set of posts whenever a piece of your application stack goes down, in my opinion, you're doing it wrong. In the public cloud, security and privacy are a slightly bigger issue, considering again, that your instances are running on shared resources. I would suggest that you pay close attention to the news regarding the hypervisor and tools being utilized by your provider, along with obviously keeping up the date with the same thing for your application stack. The last piece of advice I'd like to leave you with is regardless of which type of cloud you're using, public or private, ensure your environment is mirrored in at least two different data centers, because you never know when some poor man is going and his pickup truck is going to plow into an electric box outside of the data center where your data is hosted and cause a harddown event. That's all I got for you guys today.  Thanks, Darren. So we all want our clouds to work, and they should work because they're redundant, right? We've got hypervisors everywhere. We have control planes that are multifaceted, but why do we have so many escalations? And it does happen. Escalations come up with us almost on a daily basis at Rackspace. In my experience, it's always rabbit. Something else could fail, but that's gonna take rabbit down. Rabbit doesn't like disruptive network traffic. It starts to partition. It'll lose your cues.  It's really a bad situation. You really have to care for rabbit. That's your pet. You really have to pet your rabbit. Look at this. The same diagram that Alberto showed you. Over there in the center, bottom sort of center left, that's rabbit. In the middle of all these API cues, every API message goes through rabbit. Now, if you're talking about large neutron heat builds, that's a hundred, I mean, neutron workers go out of their minds because there's so many requests coming in for port workers, but I'm gonna get to that in a minute. Here's the easy thing to do. In the rabbit documentation, take a look at the link. You can also pull this down from our slide share, but go to that link, and rabbit says the default is 30 IR, 30 Erlang IO thread workers, but they recommend 128. In the OSIC cluster, which 1,000 nodes, but I was working about 512 of those servers building 800 instances. It took me about 17 minutes without changing anything to build 800 servers with about a 25% failure rate. Most of those were due to neutron failures and some keystone stuff, but that was also related to neutron. I'll get to that in just a moment. So look at your IO workers. This could be an all-in-one deployment. This could be in your, however big your private cloud is. You gotta care for your rabbit, bring those threads up so everything can work properly together. When you're seeing some failures in rabbit, here's a simple script. Again, you can pull this down from our slide share. This'll pull any message out of a queue that you want if you have the username and password. It'll pull the queue or message, let you look at it, and then re-inject it so it can be processed properly, but it gives you an idea of what your rabbit is doing at this point. So what are the other issues? Well, heat builds. See this a lot with our customers that are bursting up and bursting down. In every four hours, they might bring up a few hundred instances.  Well, those are overrunning your message Erlang queues, but your neutron workers really suffer. The default here, I think in the neutron.conf is 16 workers. If you're bursting that big, you've gotta really increase those neutron workers. I brought them up to 128 in our OSIC environment. I didn't see any detriment to load, so seems pretty safe to me. But without increasing that, if I monitored the neutron queues in Rabbit, the neutron queues were bursting to 7,000 messages. That's all these compute hosts requesting ports, ports trying to get sent back, all of this going through Rabbit, all of this having to go through Keystone, and that's the other part, your Keystone workers. Once neutron starts bursting, neutron's gonna start giving you authentication failures, too many connections, I won't do it anymore. So look at your Keystone workers, you have to gauge that against your environment, but this is how you start preventing your end users from coming to you and saying, why is everything failing when I try to do my heat build? So put your focus in your infrastructure. These are your, if it's an AIO, if it's at rack space, our builds are in quorum, so we have to have three, five, seven, that keeps Galera happy, that keeps Rabbit happy, of amount of infrastructure nodes, but look at what you're gonna have to do, look at your CPU power, look at your RAM power, engage your infrastructure accordingly, that keeps down your escalations. Other stuff, neutron, all of this is networking, whether it's VXLAN, whether it's VLAN or GRE, it's all networking at the bottom end. I'm gonna throw a shameless plug-in right here for my friend James Denton, buy this book. Learning, OpenStack, Networking. The second edition just came out, but this you should know back and forth if you're a senior engineer on your support team or expect your support teams to know what they're doing with neutron. You have to know it, this is the best book there is. There's a new one that just came out, Essential Neutron, it's a little bit lighter, it's more topical, it'd be good for your junior admins to learn, but you have to know neutron because if your routers start failing, your instances go offline, they don't have IP addresses anymore. How are you gonna troubleshoot that? By the way, he'll be selling the book tomorrow. We missed it today, it was earlier this morning. And what? It's free. What's free? The book is free. The book is free? Oh, okay, the book is free. Tomorrow you can get that at the Rackspace Cantina at three o'clock. What else? Our move to MariaDB and Galera over MySQL, Master Slave Replication, Master Master Replication, it had been a problem for us at Rackspace. We moved to MariaDB with Galera. I haven't seen maybe but one replication failure with Galera doing all the work. And when it failed, you just restarted Galera. It's an amazing product. So that was another big point of escalations were replication failures. It was a great move for us. I recommend it for your private clouds. Go with that. And with that, I'm gonna give it over to Chris Woodard. Thanks, Mark. Okay, so you've heard about one year later being in open sec support, coming from public cloud to private cloud and then escalation. So I'm gonna do a very, very high level overview of what is architecture and how we design for customer specific needs. So architecture comes from a Greek root to build or to create. And remember we're doing a really high level overview here. So if internet information's super highway, architecture is the road, we would be the civil engineers. So typically what people are thinking about, they're talking about architecture, they're thinking about a product. So it'd be some sort of reference architecture. And really that's just like a set of standards for your product. And so RPC is Rackspace Private Cloud. This is the reference architecture for, sorry this is an ice house. You're gonna hear a lot of the same themes here. You know, some of these guys were kind of covering some of this before. So I don't know who sort of ran our earlier deployments. So like Havana, we did a Chef-based deployment. We had two controller nodes. Use HAProxy, OVS, we're doing active, active replication. So a lot of the things that we learned and some of the pain points that we experienced there, we rolled that into ice house and we made some design decisions for to have a production ready cloud. So we went with containers for a seamless upgrade. We did Linux bridge because we experienced issues with OVS. We took, well, this template's been changing as we've learned other things. Like Cinder is now on bare metal and then we have like a dedicated logging server. And as we add additional projects or features, these like little asterisks on storage will continue to grow as we support additional items. But essentially you have your compute logging in your infrastructure and those are your core components that we can just add on to this. And as we grow to regions or anything else, this will adapt and grow for that. So what really like learning what the customer needs or how we design for that is asking the right questions. Who are you? What do you do? Who's your customer? What do they do? And what does your workload look like? Is it bursty? Is it sustained? Do you have high IO? What are you doing there? And what is your environment? You guys doing straight L2? Are you doing L3? Do you have a ton of neutron routers that are using floating IPs? Do you have multi-region? Are we looking at a DR solution here? And then also we kind of talk about your roadmap. What is your immediate goals? Long term, what's on fire? What can we immediately do to make your life better? And so we'll take that information and we kind of process it. What will benefit you? What will give you the most quality of life? So you're doing a lot of one-to-one virtualization or you're doing bare metal or like you're spinning up a lot of Hadoop nodes. How about we try to do ironic or spin that? The clouds are really about consolidation and so just bringing all these things together. And so trying to make your life easier and possibly does it make sense to bring a product in early for you? Is it production ready? Are you gonna have a bad day with this moving to this product? So really the end of the fun portion of the job is really setting expectations. So we talk about the KISS method. Keep it simple. So you got this million dollar sand that goes down twice a year versus some compute nodes we're just spinning this that are up for three years. What makes sense there? So if you're every summit people are trying to change design direction, new hotness might be lukewarm. You never know. In supportable and repeatable three A.M. calls happen. You don't want this to be a snowflake that only you know about. They talk about being the hero. You don't wanna be the hero every Saturday. So have it so everyone on your team can support it. Solid plan. Also don't, you don't wanna test it in prod. You need people. This is kind of the same thing there. You don't wanna be the only person who knows about this. And also you don't wanna be looking things up as you're troubleshooting. And I think I talked a little fast. And really kind of wrapping it up is we wanna take a base template, receive our customer input, build the solution, enable features and really just plan for tomorrow. How are we gonna grow this? And I think, and so our plug is go check out the Rackspace Cantina and questions.  But you never heard back as to how long did it, after making the neutral modifications and the API workers and so on, did that make a difference in your build success rates as well as the overall speed of the deploy? Thanks for bringing that up because I never looked at my cards once and that was in there. So yeah, it took 17 minutes before any of the tuning to build about 800 instances with about a 25% failure rate. After making the tunings to the early laying workers, bringing my neutron API workers and the keystone workers, I was building 800 instances in four and a half minutes. Somewhere around there was, it was four and a half to five minutes just depending on each individual build with zero failures. All out, everything going status active. I could ping everything over the script with no issues. Yes. Well, so it started off with tracking rabbit logs and looking in rabbit and seeing AMPQ connections failing, going to specific compute hosts where there were failed, you know, instances that went to error state and looking in novacomput.log and seeing what was the basic failure and was AMPQ. So I went back to AMPQ and started looking at the documentation, said, let me bring those workers up. So I brought the workers up. Now I lost when I did my next builds, I was losing the AMPQ connection errors, those were gone, but I was still having failed builds. Now when I dug digger or dug deeper, I saw that they were really related to neutron issues. So neutron was just timing out. Dug into neutron and found out that I just don't have enough API workers to deal with all these port requests going back and forth. So I brought that up. That reduced it now down to about a 12% failure rate. At that point, I was a little bit of a loss but I just started looking through my infrastructure. I went to Keystone, looked at my Keystone logs eventually and found too many connections. I didn't have enough pool workers and they were timing out. So I brought my Keystone pool workers up. I increased my time out to 30 seconds. And at that point, it all cleared up. It was really just Linux troubleshooting. We have it into the OpenStack product, our RPC product. It's published into there. I do need to put it out to the public. I'm just trying to find the right avenue to put it there. Yeah, I'm on FreeNode. My last name is Dverter, but if you spell it backwards, it's reved. You can get me at reved anytime in IRC on FreeNode. Yep, and I'll give you a business card if you want one. Absolutely, thank you for your questions. Anything else? Gotcha. Tell me to what extent you agree or disagree with the statement. When you're on the well-worn path, OpenStack is great.  And to give you some context, at NVIDIA we're doing game streaming. So we want to virtualize the GPU. We want to run on Citrix Zen because that's where VGPU works the best. We want super low latency networking because latency is king when you're streaming your game. And we also want high performance disk because loading textures is very IO intensive. We've barely gotten this working on AWS. And so I'm wondering, are we in for a world of pain if we think about OpenStack? So with OpenStack, in our reference architecture, everything on the compute plane is, or the instance plane is running at 10G. So we try to take away the network latency there. We have one customer that we're working with right now on installing actual GPUs and bringing those in through KVM hypervisor to do the rendering inside of an instance. There's a limitation there. You can only import one GPU to a single instance. So KVM is extremely limited there. I haven't worked in Zen for a number of years, so I can't answer to the point that you brought up right now. But... But in general, so VGPU, it sounds like there's no support at all. It's only pass-through. It's pass-through. We've tried Zen with the latest OpenStack and it just flat-out has bugs. And Citrix acknowledges this and they want to work to fix them. So right there, there are two things. We're in the weeds already. And I worry that that's just the tip of the iceberg. And so for example, we recycle our VMs every 15 minutes.  I like that. That sort of thing is a big deal if the duty cycle, if it takes 10 minutes to get the VM back up, you're only at 50% utilization. So I'm worried that there's gonna be those sorts of gotchas that we're gonna run into if we go down this road. Well, honestly, there probably are gotchas that I don't even know about at this point because these are things that I just haven't worked with with our particular customers. These, the rendering aspect, that's something that we're just starting with with one of our customers. They're gonna be bringing GPUs into their environment very soon. That's something that I've been tasked with working on them with. So once I, I don't know, work on that, look into it. Maybe I can publish something on it, bring a little bit of enlightenment. But it is open stack. I mean, as far as virtualization, bringing up VMs, running things, very, very cloudy. This is probably the number one, this isn't the number one product for it. For some of the really specific use cases, I don't know if... We're on the video, just watch this. Man just wants me to say this, but it's trial and learn. Okay, cool, thanks. Let me check our time. Yeah, we're out. So I was just gonna ask, from a staffing perspective, one of you mentioned that jack-of-all-trades is your more or less approach, but in coming into a legacy enterprise IT shop, is it more common that you've seen where they try to take somebody that's working on a legacy component, like networking or storage, and try to bring them and map them over to that component inside of open stack, or is it more common to have somebody be the jack-of-all-trades and try to address whatever project is being used under the open stack project? Thanks. So from what I've noticed is there's kind of a mixture of both. If that individual doesn't want to stray from what they're used to, then pushing them into that role works. If you have the staffing, obviously you can put more people into specialized positions, whereas if you have smaller teams, then you end up having to be a jack-of-all-trades, just because that's just the way the world works sometimes. But there hasn't been any kind of definitive, hey, if you're coming in as this, I think Berto was networking at some point and now he's basically doing all the same stuff. So jack-of-all-trades seems to work, and then if you happen to have the staffing available to specialize individuals, then by all means, it just put them in with what they're used to. If I can, just I'll add on to that for a second. It depends on the shop. If you saw the keynote yesterday morning, they talked about having to change processes and procedures. Companies coming in the cloud aren't chance, they're coming in the cloud thinking they're gonna save some money, but they're just moving old stuff over to new stuff. They're not building out their new design. They're not training their people to do things a different way. It's really, it's a total change of your thinking, of your enterprise thinking. We just can't rely on a single thing, like Darren said. We need to use a load balancer. We need to put services behind the load balancer if something falls over, there's other things to run it. So I think it's really, it's a change of process and procedure for companies. We have some that are very stringent. They rely on single instances. They can't live without them. If they go down, our phones are ringing off the hook. We have other companies that things fall over and they build a new one and they don't really care. Sir? I have one question about the numbers. So how long will it take you to onboard a new customer to your private cloud and how long will it take you to deploy a typical private cloud architecture and how many staffs will actively participate in the deployment? Staff-wise, I don't know how many people would do it in the data center to get everything cabled and racked and all that stuff. So I can't answer that. We have a deployment team of five people who will deploy the cloud on the hardware once it's up. It'll come to my team or our team actually to do the QC and make sure that it's all set. We'll onboard the customer about a week. So it's starting from the requirement or the department has to go live? I'm not on the deployment side. I would say it's probably, I think it's 30-ish days. So I guess it really depends. So we do rack-based DC deployments and also customer DC deployments. Typically what we say for deployment times if we have access is five days deployment time just to cover all our bases, QC, ensure everything's up. Hardware, typically they say about 20 days and that's just for procurement, set up everything like that. And then we turn over the customer and then from when we turn it over to when they're actually using it, it really depends on the customer. So. Okay, thank you. Any other questions? Sweet. Thank you, bye. Thanks guys, really appreciate it. Thanks for coming out.


We'll welcome everybody to this OpenShift Commons briefing with Tremolo Security. We're going to get the inside scoop on OpenUnison, an identity management open source project that Tremolo Security is backing and has been working on. I have with us today the CTO of Tremolo Security, Mark Horsstein. And he's going to introduce himself and his topic. And we'll have Q&A in the chat section. We'll try and do the presentation and the demo first, unless something really pressing comes up in the Q&A and stop him from rattling on and interrupt him. But otherwise, what we'd like to do is have the presentation for the first 20 or 30 minutes and then do Q&A right afterwards. So try and get your questions into the chat and I'm going to let Mark introduce himself and his topic today. And thank you again, Mark, for joining us. Thanks, Diane. So like Diane said, my name is Mark Horsstein. I'm the CTO of Tremolo Security. Real quick, I want to talk about who we are. We were founded in 2010, built on the experience of our co-founders. So I started off as an engineered octet string now owned by Oracle and have been an open source developer pretty much my entire professional career. In fact, I got my job at octet string based on an open source project that's now part of Open LDAP, the JDBC LDAP bridge. And then over the years have been a consultant and contractor, different industries, different products. And so my co-founder, Brian Bullock, who wasn't able to make it, comes more from IT security background as opposed to the identity management background. And again, consultant and contractor. And so what makes Tremolo a little bit different from other identity management focused companies is that we're built on years of experience, 20 plus years combined. I'm not going to go through all the different bullet points here. But what we found was going through all these different deployments, some real common things, applications which really rely on this identity data and are what drives the business are often the hardest part of integration and figuring out how to do that integration. And that we wanted a lightweight system instead of having a large monolithic system that you spend most of your time trying to massage into what you need. We wanted to give you a set of building blocks that are small enough pieces that you can assemble into what you need. And so we want to have a very modular system where if you need use a provisioning, you can use it. If you need SSO, you can use it. If you need an additional data store, you can use it. But if you don't need those functions, you don't need to add the extra infrastructure to support them. Additionally, we go with a virtual directory approach. So I started a project called My Virtual Directory back in 2007, I believe. And that's really at the core of Open Unison. And so what that allows us to do is to connect to a whole range of different directories and be able to do things in a way very quickly that a synchronization based identity management platform might not be able to do. And then finally, we're open source. Today we're going to be talking about Open Unison, which is our open source project. What we did was we took Unison, our commercial project, and we took out the, I don't want to say core because we're not open core, but the functional piece. So the piece that does the SSO, does the provisioning, does the reporting, provides the web services, all the functional aspects. And we migrated into a generic J2E application that you can deploy on Tomcat, Wildfly, Jetty, pick your favorite. And so that's what we open sourced. And that's what we're going to talk about today. So before we kind of get into Open Unison, we want to talk about what makes identity management hard. The first question is authentication and SSO. Most applications, you've got users, you've got an app, whether it's J2E lamp or even .NET, and you got a database. And that's easy enough. But how are you handling your users? How are you handling your groups? And how are you authenticating users? Well, you know, put the user in the table, put a password in there. If you're really savvy, you can go ahead and hash it up. And you're good to go, right? Except you're in an enterprise environment, and so there's Active Directory. And there are policies. You've got to have, you know, passwords have to reset every 90 days, have to have a certain complexity. And you don't want to start handling that inside your application. So you're just going to talk to Active Directory. And, you know, most application platforms have a way of talking to Active Directory, so that's kind of easy. Except for the fact that since 2000, Microsoft has been telling everybody to break up your Active Directory infrastructure to multiple forests. Now, if you're living in a Microsoft world, this isn't that big of a deal. It all just kind of automatically happens. But in a non-Microsoft world, you have to know how to talk to those different directories, even their cross-forest trusts. That's not the same thing as a virtual directory. You still need to know how to talk to them. And so now you're starting to build a lot of logic into your application. You might look at something like a SSO system. You know, a lot of commercial ones out there, a lot of open source ones out there. And so somebody says, all right, we're going to stand up an SSO service. Most SSO services know how to talk to multiple directories. So it makes life a little bit easier. But here's the catch. You've got this line here between your SSO service and your application.  But if you're using an older system or a caught system, that might not be possible. And so you have to use the vendor's agent. And now the question becomes, okay, if the agent's broken, is it your application's fault? Is it something your SSO team is doing? Who's going to be doing the integration? And so, and from a DevOps perspective, you want to be in a, you know, branch develop merge, branch develop merge, not branch develop, wait for an agent installation, debug it, figure out what's wrong, code it, merge, move on. So that's one of the first aspects that makes identity management hard. The second aspect is, okay, you can SSO in and we've got that problem solved. And a lot of enterprises do. But now the question becomes, who should have access to your application? You know, there's really two aspects of that question. It's the ability to add users so you can onboard them quickly. But it's also the ability to provide a report to auditors, especially if you're talking about in an enterprise where you have Sarbanes-Oxley, HIP, other types of regulations that you need to worry about. And so you want to be able to provide a report that says who has access. Well, you know, your application, if it's using a database, you know, kind of standard model, users groups, you link them together with the table. And there are variations on the steam. So for instance, WordPress does it a little bit different. Drupal kind of goes with this. SugarCRM has its own model entirely.  But the problem with that is it's not centralized. So, you know, maybe you want to work off of a directory. Again, you know, maybe you've got somebody with some LDAP skills, or there's a web service you can use. The big downside with going a directory is there has to be a directory, right? So the question becomes, who's directory are you using?  They're a central directory. Maybe you're using Active Directory. Active Directory might make a lot of sense, except for the fact that the folks who manage your Active Directory are a lot more worried about Windows workstations than they are about your app's authorizations. And then the applications can cause some issues. So, for instance, AWS integration that we're going to show. And yeah, build this funky string and send it up to the application. Depending on what your identity provider can do, that might be real easy to do on the fly. Might not. And so, you know, you might be storing this as a role, well, or an attribute somewhere. Where are you storing that attribute? And then finally, how are you going to report on all this? How do you generate a report that says Mark has access to these roles? This is the reason why he has that access. This is a person who approved that access. And this is why it matches with our corporate policies. Finally, you take this, and the great thing about OpenShift is that it makes it really easy to build applications. Kind of the, not downside, but one of the things that Sprawl now creates is that this process now gets repeated for every single application. And as you go through catalogs of especially open source applications, but also commercial applications, you'll find all sorts of different methods for doing identity management. And so, providing a central system to be able to do that identity management can really provide a boost in your development life cycle. Because now you're taking away the need to manage those identities in the same way. And you're also providing that central reporting function to get the auditors off your back. So, has OpenUnison helped? So, first off on SSO, we have a lot of SSO and authentication features, stuff that you'd expect using password, federation, we do an IDP broker, multi-factor using TOTP. We also have integration with Symantec Vip. And then some ones that you might not expect, we have a just-in-time provisioning provider. So, as the user comes in, we can create them on the fly. We have banner authentication. You know, I shall do no harm, I promise, when I come to enter the system. We implement that as an authentication mechanism. Oh, and also on the SSO system is our application integration, which really is, I think, one of our biggest strong suits. We run as a reverse proxy for the most part. And we have multiple ways of doing last mile. We could do header injection, but kind of the biggest issue with header injection is there's no way to validate it. It's just some text. So, what we've done is we've created a last mile token system that integrates a attribute, not before, not after, and a not, and gets encrypted. Oh, and the URL that's been authorized. So, that gets sent down to the downstream application. Then we have integrations for Apache.net and Java and multiple Java application servers that will validate that token and set the context for you. And there's no phone home the way you get with an agent. So, we don't call them agents for that reason. And so, that gives us the ability to, since we're cutting out that network hop to validate a cookie, to be able to validate every request individually. And so, what that actually allows us to do is have a set of trusted attributes coming from the reverse proxy. We've also recently had the ability to do Kerberos constrained delegation. So, if you have an app that is set up to only support Kerberos, we can generate a Kerberos ticket that it will accept using protocol transition and allow you to do SSO without any component integration. Now, for authorizations, we have a lot of different ways to do authorizations. Just kind of your standard directory, groups, dynamic groups, filters. We also have a custom authorization mechanism. So, the ability to write a rule that requires a little bit of logic in your authorization path. Examples of custom authorizations, we've built supervisor authorizations. We've built that as a custom authorization.  A couple of different variations there. And then finally, we allow you to do reporting on this. We've got a very simple database. It's relational. We're not right now doing anything with Mongo or other object databases, but it's a published schema. So, we provide a simple reporting interface, but there's no reason you can't use whatever your favorite reporting or business intelligence system is with this. We've got customers using Jasper reports, but there's no reason any other reporting system could be used. So, now for the fun stuff, the demo architecture. So, what we've done is we wanted to set up a demo that showed off a lot of Open Unison's biggest benefits, especially to OpenShift. So, I've got OpenShift origin latest running here in my lab, and I've got two applications set up. Now, I'm going to be spending a lot of time on this particular slide because when I actually do show the demo, it's a really good identity management demo is wholly unspectacular because things just kind of work. You don't see the identity management happen, but there's a lot going on behind the scenes that get automated for you. So, first off on the left-hand side here, I have Active Directory, and right now I only have one Active Directory force set up, but there's no reason why this couldn't be three, four, five Active Directory force, whatever you want to see. I think the most I've ever seen in an organization is eight individual forests. Organization had one set up for each individual continent, a big global company, but no reason why we couldn't handle that. And so, this is going to be our source of truth for identity data. So, this is where you're going to get your first name, your last name, your email address, your ObjectWid, and your display name. Now, ObjectWid is an interesting one that is your unique identifier inside of Active Directory. It's a binary attribute, but it's one that if you can turn it into text is really useful. So, one of the benefits of Virtual Directory we can do data manipulation, and one of those manipulations we do is convert the binary ObjectWid attribute into a text-based ObjectWid attribute. Makes it a lot easier to use in other applications. So, we've got two applications set up inside of OpenShift. The first is what we call our IDAS, our identity as a service. So, we've got two pods. We have an open unison pod that handles authentication. It handles the web services for provisioning that we host. And it's also acting as a reverse proxy for scale, which is the application we've built to use those web services. And finally, it's also acting as an identity provider. It's using database data from an external MySQL server. And then it's also storing its configuration data on an external NFS server persistently. We also have scale. Like I said, that is our open source. It's a set of applications really, but the main app is the one that we've deployed that leverages our different web services to provide an identity service. So, when a user logs in, they will be able to request access to applications, see a dynamic set of links to be able to log into applications, update their profile if they wish, view reports, et cetera. And then over here, our second application is where we have WordPress. So, we've got another open unison instance. This one is primarily or is really responsible only for SSO into WordPress, and for just in time provisioning into the WordPress database. So, there is no extra database or directory here with this unison instance. So, like I said before about being modular, we're not using the different services that would require an external data store. So, no need to deploy it. So, again, we're very, very lightweight. And then we have WordPress instance. This is the stock official WordPress instance off of Dockerhub with the addition of our last mile integration for Apache. So, what will happen is when a user logs in, all the bouncing mouse, when a user logs in, they're gonna hit open unison. Open unison doesn't know who they are, gonna request you to put in your username password. Now, we have chain set up. So, this could be a username password, this could be federation of some kind, any of our different options, at which point the user will put in their username password, and a login will happen into Active Directory to validate that credential. Now, here's where the virtual directory comes into play. We're storing our authorizations down here in this database, but in order to make it recognizable, we need to be able to merge that data with what's coming from Active Directory. So, the first thing we do is we do adjusting time provisioning into this user database. So, that will provision just the user's UID or SAM account name in AD world and objectWID. And that's what we use to link the account into Active Directory. Then what we do is all directory operations go through a joiner. That joiner creates a profile based on the Active Directory attributes and the local data attributes. So, if we need to add additional attributes not managed by Active Directory, we could do that here and provide it without issue to applications. So, at that point, we go ahead and we're gonna get SSO'd into scale using the last mile system. Quest comes into scale, which is running on Tomcat 8. We've got a valve that's running that will validate the request and set the user context. At which point, web service calls will come into Unison to be able to load your profile, what you have available, et cetera. So, user's gonna request access, that access gets approved. At which point, they then log back in and they'll see a couple of links come up for the different applications that they've requested. So, let's say we click on the link for Amazon. That'll bring us to the console. Before it does, though, it's going to translate our internal groups into that crazy string that Amazon wants. So, we're getting the best of both worlds. We get to have a consistent way to manage our groups, but we also get to tailor things to the way applications need to see them. If we come back and we click on WordPress, this is where the application integration really becomes powerful. Click on that link to WordPress and a SAML integration starts with this application, the Open Unison over here. So, an assertion gets digitally signed, sent through the user's browser down to Open Unison in this application. Open Unison validates the assertion first off and then based on the attributes in there, we'll run a just-in-time provisioning workflow against the WordPress database. So, if you don't exist, it creates your profile. If it does exist, it makes sure that your profile matches what's in the authoritative data source over here. So, this provides you the ability to get both a centralized way of managing your data but not having to recertify that access on a consistent basis. It helps eliminate a bit of that risk between recertifications. Now, the practical side of that is, let's say I have subscriber or contributor role and administrator tries to make me another admin for some reason through the WordPress interface. Well, that's not gonna work. They'll make me an admin, but then the first time I go to log in, I'm gonna get reset back to contributor because that's what my role is here in the authoritative source. Once that happens, so the data is set here, WordPress is kind of an interesting application because it's not necessarily designed to always have to be authenticated. You really only have to authenticate if you're gonna do things that are authenticated but because this is a enterprise deployment of WordPress, we want users to always be authenticated. So, before you actually log in, before we send your initial request to WordPress, we do a pre-authentication. We have the ability to manage an internal cookie store inside of our reverse proxy. And so what we actually do is we go and we do a login to WordPress behind the scenes. Response comes back, we take those cookies and inject it into your cookie jar. So that way, when you hit WordPress for the first time, you're pre-logged in. So there is no quote unquote anonymous access to WordPress. So like I said, that was a lot. And we'll go ahead and go through the demo and actually show kind of how that all comes together. All right. And Diane, can we see my browser? Yep, looks perfect. It has origin all over it. Okay, cool. So this is my origin deployment. Here are my two applications real quick just to show you there's nothing up my sleeves. And then we've got two pods. Each pod has its own set of services and potentially a router if it's an external pod. And then the same is gonna be true here of scale. And we've also got everything's configured through the environment variables. So there are no passwords, no certificates, nothing's being stored on these images outside of application logic. So I'm gonna go ahead and log in. So the first thing I'm gonna do is log in as mMosly. Now, customizing these pages is very easy. It's just stock JSP. And so I'm logging in. And so that background process is happening where I'm talking to Active Directory. I'm coming back. I'm checking to make sure that my object exists. And this is kind of my super user map Mosley. So he has a lot of capabilities, a few of which are going to be, you'll see that I've got links. These links are dynamically generated. And then I'll also show you that, oops. Ah, I'm back here. Gonna show the responsiveness here. So this is built on Twitter Bootstrap. So it works great on mobile devices. And it's generic Twitter Bootstrap. There's nothing, there are no special themes put on top of it. So we've got a couple of apps. If I wanna come in here, here's my profile and roles. Now, I've got it set up right now for read only, but we can also configure this to show certain attributes as read write and then execute a workflow. So that would save it. So let's say we want to let users specify their Twitter handle here for some reason. We could add a Twitter handle attribute and when the user hit save, execute a workflow, they'll write it to the local database that we're using. And then any application that wants to access it, now can without having to store it in Active Directory.  One of the things that we let you do though is we let each organization have authorization rules on it. So for instance, this identity management reports, you have to be authorized to access. So some of these different reports that I'll kind of show you once we get going, I'll show some of them now. So like the single user change log, oh, that's right, I did this wrong last time too. The single user change log lets you see all the changes that have happened to a user. So for instance, I'm going to pick the Matt Mosley on his own right here and just run the report. And we're gonna do change log for a period. That'll be a little bit easier. So today is the 25th, so we're gonna do that. There we go. So now we have some data that we can show. Now again, this is a simple reporting system. If you want to be able to do more complex reports than the couple that we allow you to do, you can hook it up into any kind of business intelligence system. And these reports are all just SQL, so it's very easy to build different types of reports and add them. So I'm gonna go ahead and log out and I'm going to log in with my new test user. And now I'm trying to remember I created just beforehand and I can't remember what I named that user. It was, oh, now I do. Actually before I do that, so that's SSO into the console. Let's go ahead and go into WordPress real quick. So you'll see I'm SSOed into WordPress. I'm an administrator. And if I come to users, you'll see all the previously provisioned users here. And what I'm going to show you soon is that there is no one here named Jennifer Stanton. I'm gonna go ahead and log in with her for the first time. So let's go ahead and log out. So now I'm signed in as Jennifer. And here my attributes, you'll see I have no roles assigned. So let's go ahead and first I'll show that there are some reports that we can run, but you'll notice that identity management group is no longer here. That's because I'm not authorized to even see anything in there. So you can do interesting things like if you talk about privileged access management, you don't want people requesting unless they're already pre-authorized to be privileged access managed to do things like that. And so you can actually limit what people can request. I've got one customer that's doing it with police officers. If you're not a sworn police officer, they don't even want you to be able to request access to certain things. So first thing I'm gonna do is I'm gonna request access to Amazon and then I'm also gonna request access as an editor for WordPress. You'll see that we've got a cart-based service for this. You know, if I log out, there's some error checking, some error checking there. So I'm gonna go ahead and submit my request. So that's gonna go ahead and submit a workflow request. Now our workflows are asynchronous and we're built on top of JMS and Qs. So every task in our workflow goes on to a JMS Q. Nice thing about that is it makes us really scalable and also reliable and it works really well in OpenShift because there's no persistent data inside of the system.  You'll see I've got a couple of open approvals here. So this is all configurable. You know, we can configure what is seen and let's go ahead and enter a justification of demo. I'm gonna improve the request and I gotta confirm it. Then when I look at the second request, we can already see that the user's been provisioned. So typically your workflow will look something like maybe load some data, do some data manipulation, get an approval, maybe two. We support escalations and approvals. So you can say, all right, if this hasn't been acted on in six days, go ahead and escalate it to the next level and change who the approver set is. We'll be supporting delegation in the not too distant future.  You can say, okay, I'm authorizing this. And so that way there's an audit log of that process. So at this point, Jennifer has received an email saying, hey, you now have access to these applications. Thought log in. And you'll now see I've got these dynamic links have now been generated. I have these roles. And I'm gonna go ahead and go ahead SSO into AWS. And if you take a look 1F844D7, 1F844D7, I use the object grid because I really like the fact that it's immutable. If names change, et cetera, that ID never changes in Active Directory, whether it gets moved around, reorganized, et cetera. So it's a really good ID from that perspective. And then I'll go ahead and log into WordPress, which okay, we're gonna go live demo. We're gonna try this again. I know why. The user doesn't have an email address. So I'm gonna show the virtual directory here in action real quick. Go to here. And let me see if I can find Ms. Jackson or Ms. Stanton. So yep, no email address. And so I'm gonna come back here. I'm gonna log out back in here that we now have an email address. So again, this is all being done in real time. We're not syncing information in. Now I log into WordPress, I get in no problem. You'll see I'm already logged in. And we've got a form of single log out here set up. So I have to log back in again. And then you'll also notice when we go to the WordPress dashboard, we don't have all any of the administrator stuff. That is because we're not an administrator. We're a subscriber. And so we're gonna go ahead and show the just in time provisioning, kind of changing that right on the fly. So I'm gonna log out. I'm gonna log back in as my super user. Oops. And I'm gonna go right into WordPress. So I'm logged in as Matt Mosley. And I'm gonna come down to users. And there's Ms. Stanton, our user who is an editor. So we're gonna go ahead and change her over to a administrator. We're gonna hit update user. So now when Ms. Stanton logs back in again, she's gonna see administrator rights, right? That's, you know, I just enabled it, right? So now we're Jay Stanton. However, we don't have administrator rights. That's because the just in time provisioning process said no, that's not okay. You can't go ahead and be an administrator because the authoritative source said no. So let's come in here and let's request access to be an administrator. Now you can see we get some indicators that we've already been approved as an editor. And I'm going to say for admin. And now I wanna know what the status is. So I'm going to take a look and see my open requests. Okay, well, this guy Matt Mosley is still sitting on my request. That's why I can't make the changes that you keep asking for. And again, these reports are all customizable. You know, just some SQL you need to know and our published schema. And you can also go ahead and, you know, we allow parameters to current user. We let you specify a user. We let you specify a date range. We showed you a couple of those before. You know, some other things that you can do with open unison from a deployment standpoint. We have a TOTP app. So being able to not only request a TOTP key but be able to import it into your phone. We've got a user self registration application. So users can go ahead and if you're talking about folks from the outside being able to register for your systems. And then we also have a single request application. So like the privileged access manager use case I had mentioned before, you know, it's more trying to stop users from just requesting everything. And so what we did was we let you deploy a version of scale that all it's gonna do is request that one request for you execute that one workflow. And so if you've got privileged access, folks you want to give privileged access to you can give them that URL a little bit of security through obscurity there. So that's really the demo. Like I said, everything, you know, minus a couple of little glitches there. You know, kind of just came together from a deployment time standpoint. Once we had open shift up and running. You know, getting that first open unison instance took the longest. That probably took me about a day. Just trying to tailor the image correctly. But scale was very easy. That probably took me a couple of hours. The second unison instance really only took me about half an hour. And then WordPress took me about 45 minutes to an hour. So very quick, very easy to deploy. All right, let's come back to our, so questions gonna come up. How does open unison and key cloak relate? There's certainly some overlap, you know, kind of in this slide, can't give either project, you know, can't do either project justice and the breadth of features that they have. You know, in common, there's a lot of SSO functionality in common. We can both do identity provider brokers. We can both do federation, social login and a couple of different multi-factor methods. You know, we can both integrate using SAML 2, reverse proxies and there are mechanisms to be able to do just in time provisioning. You know, kind of where we really separate out is on the user provisioning side. We're not, we go beyond SSO. SSO is certainly one of our capabilities. But really, I think our most powerful capability is in the user provisioning aspect of things. You know, we've got a very simple workflow engine. We specifically didn't go with a standard like BPM or BIPL because we wanted to keep the workflows very simple. We find that engines built off of BPM or BIPL tend to become very big and very difficult to manage. And you know, for what they're built for, they're great. But for a really constrained use case like identity management, they tend to be overkill. You saw our reporting integration. What you didn't see behind the scenes is our queue integration. Kind of touched on this. We ship with active MQ embedded. However, we can integrate with any JMS based queue. That makes us very, very scalable. Task can be run on one server and then next task can be run on another server and next task can be run on a third server. And I mean, you know, this is open shift, right? And open shift leverages that same type of queue infrastructure. So you know how well that helps things scale. And then we've also got the ability because of that to retry. So we can't get a network connection for some reason. It can go off into a dead letter queue and when you're ready and the system comes back up and running, you're able to go. And then we also have integrated distributed scheduler. So built on Quartz and what this actually lets us now do is anything that's time-based. So for instance, reminders, you know, every morning we want to remind folks that have open requests that have been open for more than a week.  Some other examples are automatically disabling users after a certain amount of time. Well, this user hasn't authenticated or has been disabled for a certain amount of time. We actually wanted to delete them, things like that. So what are we up to? You know, what's next for open unison and TRIMO security? Well, right now we're working on a white paper on cloud server management with open unison and free IPA. The idea being that you've got this great tool and free IPA for managing servers but what if you can't build a Kerberos trust with Active Directory, usually for policy reasons. You know, we provide a very powerful mechanism to be able to do that integration in a disconnected fashion, makes it a great tool for managing servers up in the cloud. Now we can also manage the authorizations. You know, you can define in free IPA, you know, which roles have the ability to do what on which hosts but we can also add that capability to say, okay, well, instead of having to manually add them or rely on Active Directory administrators, admins can log in and request access to these different services, get it approved and you know, you've got an audit report. We're also gonna have a white paper on building an open source identity as a service with open unison. So what you've seen here, a little more generic built on just generic Docker with a more open shift focus coming once we have a source to image built. So now that we've gotten it up and running, we've kind of, you know, we've got generic Docker builds for everything but now that we've gone through open shift, you know, there are certainly updates we can make to make that process easier. We're gonna do some integrations with Key Cloak. Some of them a little more theoretical that I don't know how much value they'll provide but they might just be a lot of fun to code and some of them, you know, I think would be really useful. You know, we're looking at on the, why I think it's a little more concrete side of being able to have an SPI where if you've got Key Cloak set up, you can leverage our just-in-time provisioning solution to be able to go ahead and update downstream applications. So broaden Key Cloak's ability to access those systems and provide reporting and whatnot. And then on the more theoretical side, I think it would be really cool to have a virtual directory on top of Key Cloak. You know, Key Cloak has a way of managing users and doing things that a directory can do. You know, I don't know how great it would scale as a directory but certainly be an interesting exercise. So that's one that I'm hoping to be able to do. And then we're going to build a AngularJS version of scale and that's in process now. And yeah, you can see our progress on GitHub. And so the idea will be is instead of having to deploy a separate J2E application, you can sit directly on OpenUnison running AngularJS. We're not going to retire scale. You know, we're just want to offer multiple options. And finally, this is all in lead up will be, we're proud to announce that we'll be sponsoring Red Hat Summit again this year. We had a great time in Boston last year and we're looking forward to seeing everybody in San Francisco in June. If you'd like to get in touch with us, you can catch us on Twitter at Tremolo Security, the web at Tremolo.io. And our GitHub repository is Tremolo Security. The OpenUnison project itself is OpenUnison. We have an open source first mentality. So whenever we add a feature, it goes straight into GitHub. You'll see a lot of repositories in there of stuff we haven't yet merged into the main system. The only time we don't start with open source is if we don't own the code. So for instance, like Symantec, we don't own the code to do that integration. And so we didn't want to open source it without really making sure that we could. So, but we're all in on open source from that standpoint. Perfect. And now open it up for discussion. Well, we were, we can go back and forth in the chat and you have really covered off pretty much everything that I was going to ask you a question on. So the KeyClub stuff was one of the key things that I was curious about because there's a lot of discussion about KeyClub around OpenShift as well. So, and there will be an upcoming presentation. I think I've got someone lined up in April to do a talk on KeyClub. So we'll get you back on at that time to have that conversation. But this has been really great. I love the open source first ethos at Tremolo security. It's really wonderful to see. We've had a whole bunch of people on the call today. So, but I'm not seeing any questions, which means you just did an awesome job covering off identity management for me. So thank you very much for coming and doing this talk today. We'll have many more, I'm sure, with Tremolo security and on identity management. I am thoroughly impressed with the production readiness and especially the auditing reports that are available because I think I come from a long time ago on auditing the IT background and having those compliance things there is really a necessary evil for goodness depending on your outlook on life. And so they're often an afterthought and an add-on to different projects. So it's really nice to see how thorough your UI is and your reporting is and your coverage of different applications, identity management practices. So thanks again, Mark. And we look forward to seeing you at Red Hat Summit. Thank you for sponsoring. And if people have questions, you can post them on the OpenShift Commons mailing list and Mark will pick them up there or pick him up at Tremolo security and we'll make sure we keep him in the loop on our further identity management questions and briefings. So thanks again, Mark, and we'll talk to you all soon. Next week- Thank you very much. We'll be having one more OpenShift briefing. I think on March 10th is the next one. We may slip one in between. Next week if the speaker that I have lined up, mystery speaker decides to commit. But I think the next one is on March 10th and it will be with Andy Goldstein on the service catalog and service linking with OpenShift. So again, Mark, thank you very much. Thank you.