THE BLUEBIRD by John Burroughs RedFearlyPrivox.org by Alan Davis Drake A wistful note from out the sky, Pure, pure, pure, in plaintive tone, As if the wanderer were alone, And hardly knew to sing or cry. But now a flash of eager wing, Flitting, twinkling by the wall, In pleading's sweet and amorous call, Ah, now I know his heart doth sing. O bluebird, welcome back again, Thy azure coat and ruddy vest Are hues that April loveth the best. Warm skies above the furrowed plain, The farm boy hears thy tender voice, And visions come of crystal days, With sugar camps in maple ways, And scenes that make his heart rejoice. The lucid smoke drifts on the breeze, The steaming pans are mantling white, And thy blue wings a joyous sight Among the brown and leafless trees. Now loosened currents glance and run, And buckets shine on sturdy bowls, The forest folk peep from their holes, And work his play from sun to sun. The downy beats his sounding limb, The nut-hatch pipes his nasal call, And robin perched on treetop tall, Heavenward lifts his evening hymn. Now go and bring thy homesick bride, Persuade her, here is just the place To build a home and found a race In downy cell, my lodge besides. And a poem this recording is in the public domain. Bones by Carl Sandberg. Read for LibriVox.org by Clarica. Sling me under the sea. Pack me down in the salt and wet. No farmer's plow shall touch my bones.  Long green-eyed scavengers shall pick my eyes. Purple fish play hide and seek, And I shall be song of thunder, crash of sea, Down on the floors of salt and wet. Sling me under the sea. End of poem this recording is in the public domain. The Builders by Henry Wadsworth Longfellow Read for LibriVox.org by Michael Robinson, Carbondale, Illinois. All are architects of fate, Working in these walls of time. Some with massive deeds and great, Some with ornaments of rhyme. Nothing useless is or lo, Each thing in its place is best. And what seems but idle show Strengthens and supports the rest. For the structure that we raise, Time is with materials filled. Our todays and yesterdays Are the blocks with which we build. Truly shape and fashion these, Leave no yawning gaps between. Think not, because no man sees. Such things will remain unseen. In the elder days of art, Builders wrought with greatest care, Each minute an unseen part, For the gods see everywhere. Let us do our work as well, Both the unseen and the seen. Make the house where gods may dwell Beautiful, entire, and clean. Else our lives are incomplete, Standing in these walls of time. Broken stairways where the feet Stumble as they seek to climb. Build today, then, strong and sure, With a firm and ample base, And ascending and secure shall Tomorrow find its place. Thus alone can we attain To those turrets where the eye Sees the world as one vast plain, And one boundless reach of sky. The end, this poem, is in the public domain. The Daisy Follows Soft the Sun, by Emily Dickinson. This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox.org. The Daisy Follows Soft the Sun, and when his golden walk is done, sits shyly at his feet, He waking finds the flower near, Where for marauder art thou here? Because, sir, love is sweet. We are the flower, thou the sun, Forgive us if as days decline, We nearer steal to thee, Inamored of the parting west, The peace, the flight, the amethyst, Night's possibility. End of poem. This recording is in the public domain. I have not found thee in the tents, In the broken darkness. I have not found thee at the well-head, Among the women with pitchers. Thine arms are as a young sapling under the bark, Thy face as a river with lights. White as an almond are thy shoulders, As new almonds stripped from the husk. They guard thee not with eunuchs, Not with bars of copper, Guilt turquoise and silver Are in the place of thy rest. A brown robe with threads of gold woven in patterns Hast gathered about thee. O Nathat ikanay, tree at the river. As a rillet among the sedge are thy hands upon me, Thy fingers a frosted stream. Thy maidens are white like pebbles, Their music about thee. There is none like thee among the dancers, None with swift feet. End of poem. This recording is in the public domain. He was Cromwell's measure or degree, Unknown to him as to his horse, If he than his groom be better or worse. He works, plots, fights in rude affairs, With squires, lords, kings, his craft compares. Till late he learned, through doubt and fear, Broad England harbored not his peer. Obeying time, the last to own the genius From his cloudy throne. For the provision is allied unto the thing so signified. Or say, the foresight that awaits Is the same genius that creates. End of poem. This recording is in the public domain. Give All to Love by Ralph Waldo Emerson. Read for LibriVox.org by Alan Davis Drake. Give all to love. Obey thy heart. Friends, kindred, days, estate, Good fame, plans, credit, and the muse. Nothing refuse. Tis a brave master. Let it have scope. Follow it utterly, hope beyond hope. High and more high, it dives into noon. With wings unspent, untold intent. But it is a God, knows its own path and the outlets of the sky. It was never for the mean, it requireeth courage stout. Souls above doubt, valor unbending. It will reward. They shall return more than they were. And ever ascending. Leave it all for love. Yet, hear me, yet, one word more thy heart beloved. One pulse more of firm endeavor. Keep thee to-day. Tomorrow, forever, free as an Arab of thy beloved. Cling with life to the maid. But when the surprise, first vague shadow of surmise, flits across her bosom young, of a joy apart from thee. Free be she, fancy free. Nor thou detain her vesture's hem, nor the palest rose she flung from her summer diadem. Though thou loved her as thyself, as a self of purer clay, though her parting dims the day, stealing grace from all alive, heartily know when half gods go, the gods arrive. A Glimpse by Walt Whitman Read for LibriVox.org by Lauda, Italy, November 2007 A Glimpse Through an interstice court of a crowd of workmen and drivers in a bar room. Around the stove, late over winter night, and diarrhea remarked, seated in a corner. Over youth who loves me, and whom I love, silently approaching and sitting himself near, that he may hold me by the hand. A long while, amid the noises of coming and going, of drinking and oath and smutty jest, there we too, content. Happen been together, speaking little, perhaps not a word. End of poem. This recording is in the public domain. Invocation by Clara Shanafelt Read for LibriVox.org by Clarica O glassblower of time, hast blown all shapes at thy fire? Can't thou know lovelier bell, no clearer bubble, clear as delight inflate me? Worthy to hold such wine, as was never yet trod from the grape, since the stars shed their light, since the moon troubled the night with her beauty? End of poem. This recording is in the public domain. June's Coming By John Burroughs Read for LibriVox.org by Alan Davis Drake Now have come the shining days when field and wood are robed anew, and o'er the world a silver haze mingles the emeralds with the blue. Summer now doth clothe the land in garments free from spot or stain, the lustrous leaves, the hills untanned, the vivid meads, the glockest grain. The day looks new, a coin unworn, freshly stamped and heavenly mint, the sky keeps on its look of mourn, of age and death there is no hint. How soft the landscape near and far, a shining veil the trees unfold, the day remembers moon and star, a silver lining hath its gold. Again I see the clover bloom, and wade in grasses, lush and sweet, again has vanished all my gloom with daisies smiling at my feet. Again from out the garden hives the exodus of frenzied bees, the humming cyclone onward drives, or finds repose amid the trees. At dawn the river seems a shade, a liquid shadow deep as space, but when the sun, the mist has laid, a diamond shower smites its face. The seasons tide now nears its height, and gives to earth an aspect new. Now every shoal is hid from sight, with current fresh as morning dew, and of poem this recording is in the public domain. This is a LibriVax recording. All LibriVax recordings are in the public domain. For more information or to volunteer please visit LibriVax.org. Recording by Laura, Rome, Italy, November 2007. Music When Soft Voices Die by Percy Bish Shelley Music When Soft Voices Die vibrates in the memory, orders when sweet violets sicken live within the sands they quicken. Rose lives when the rose is dead, are heaped for the beloved's bed, and so thy thoughts, when thou art gone, love itself shes lumber on. End of Music When Soft Voices Die by Percy Bish Shelley Davis Drake Serene I hold my hands and wait, nor care for wind, nor tide, nor sea. I rave no more against time or fate, for lo, my own shall come to me. I state my haste, I make delays, for what avails this eager pace? I stand amid the eternal ways, and what is mine shall know my face. A sleep awake by night or day, the friends I seek are seeking me. No wind can drive my bark astray, nor change the tide of destiny. What matter if I stand alone? I wait with joy the coming years. My heart shall reap when it has sown. And gather up its fruits of tears. The stars come nightly to the sky. The tidal wave comes to the sea, nor time, nor space, nor deep nor high, can keep my own away from me. The waters know their own, and draw the brook that springs in yonder heights. So flows the good with equal law, unto the soul of pure delights. End of poem. This recording is in the public domain. Prize, we sought, is won. The port is near, the bells I hear, the people all exulting, while follow eyes, the steady kill, the vessel grim and daring. But oh heart, heart, heart, oh the bleeding drops of red, where on the deck my captain lies, fallen, cold, and dead. Oh captain, my captain, rise up and hear the bells.   My captain does not answer, his lips are pale and still. My father does not feel my arm, he has no pulse, nor will. The ship is anchored safe and sound, its voyage closed and done. From fearful trip the victorship comes in with object one. Exult, oh shores, and ring, oh bells. But I, with mournful tread, walk the deck my captain lies, fallen, cold, and dead. End of poem. This recording is in the public domain. The Partridge by John Burroughs. Read for LibriVox.org by Alan Davis Drake. List the booming from afar, soft as hum of roving bee. Vague as when on distant bar fall the cataracts of the sea. Yet again a sound astray. Was it the humming of the mill? Was it cannon leagues away, or dynamite beyond the hill? Tis the grouse with kindled soul, wistful of his maiden nest, sounding forth his vernal roll on his love in kindled breast. List his fervid morning drum, list his summons soft and deep, calling spice-bush till she come, waking blood-root from her sleep. Ah, ruffled drummer, let thy wings beat a march the days will heed. Wake and spur the tardy spring till minstrel voices jock and ring. And spring is spring in very deed. End of poem. This recording is in the public domain. Tired. We were very merry. We had gone back and forth all night on the ferry. It was bare and bright and smelled like a stable. But we looked into a fire. We leaned across a table. We lay on a hilltop underneath the moon. And the whistles kept blowing, and the dawn came soon. We were very tired. We were very merry. We had gone back and forth all night on the ferry. And you ate an apple, and I ate a pear. From a dozen of each we had bought somewhere. And the sky went wan, and the wind came cold.  We were very tired. We were very merry. We had gone back and forth all night on the ferry. We hailed good-morrow, mother, to a shawl-covered head. And bought a morning paper, which neither of us read. And she wept, God bless you, for the apples and pears. And we gave her all our money, but our subway fares. End of poem. This recording is in the public domain. For he can make the welkin ring and do it at his leisure. At ease, he sits upon the pool. And void of fuss or trouble makes Vesper music fit for kings from out an empty bubble. A long-drawn out and tolling cry that drifts above the chorus of shriller voices from the marsh that April nights send over us. A tender monotone of song, with vernal longings blending. That rise from the ponds and pools, and seems at times unending. A linkage chain of bubbling notes when birds have ceased their calling, that lulls the ear with soothing sound, like voice of water falling. It is the knell of winter dead, goodbye his icy fetter. Blessings on the warty head, no bird could do it better. End of poem. This recording is in the public domain. I know you, blusterer. I know you, wild one. I know your mysterious call. End of poem. This recording is in the public domain. the land or sea, as I behold young evening star, which yet beholds not me. This morning I climbed the misty hill, and roamed the pastures through. How danced I form before my path, amid the deep I do. When the red bird spread his sable wing, and showed his side of flame, when the rosebud ripened to the rose, in both I read thy name. End of poem. This recording is in the public domain. Your pool of ink, your scratchy pen, have moved the lives of unborn men, and watched young people breathing hard put heaven on a postal card. End of poem. This recording is in the public domain. Two in the Campania by Robert Browning. Read by Jezebel for LibriVox.org 2007 I wonder do you feel today, as I have felt since, hand in hand we sat down on the grass, to stray in spirit better through the land, this morn of Rome in May. For me I touched a thought I know has tantalized me many times, like turns of thread the spiders throw mocking across our path, for rhymes to catch at and let go. Help me to hold it. First it left the yellowing fennel, run to seed there, branching from the brickwork's cleft, some old tombs ruin. Yonderweed took up the floating weft, where one small orange cup amassed, five beetles, blind and green they grope among the honey-meal, and last everywhere on the grassy slope I traced it, hold it fast. The champagne with its endless fleece of feathery grasses everywhere, silence and passion, joy and peace, and everlasting wash of air, Rome's ghost since her decease. Such life here through such lengths of hours, such miracles performed in play, such primal naked forms of flowers, such letting nature have her way while heaven looks from its towers.  How is it under our control to love or not to love? I would that you were all to me, you that are just so much, no more, nor yours, nor mine, nor slave, nor free. Where does the fault lie? What the core of the wound since wound must be? I would I could adopt your will, see with your eyes and set my heart beating by yours, and drink my fill at your soul's springs, your part my part in life for good and ill. No, I yearn upward, touch you close, then stand away. I kiss your cheek, catch your soul's warmth, I pluck the rose and love it more than tongue can speak. Then the good minute goes. Already, how am I so far out of that minute? Must I go still like the thistle ball, no bar, onward whenever light winds blow, fixed by no friendly star? Just when I seemed about to learn, where's the thread now? Off again, the old trick, only I discern infinite passion and the pain of finite hearts that yearn.


just wrapped up an adventures weekend in the Petrified Forest National Park. We did a long bike ride and some hiking and exploring around the park and it was hot. You can probably see it in my face and my eyes. I'm a little bit exhausted. I just wanna get some water and go to bed. But I decided to put this video together to share with you my skincare routine, post-hiking or any outdoors activity for that matter. Just going to share with you what I'm going to do here just to restore my skin and nourish it a little bit. And I hope that you're going to find this to be useful. So obviously before hiking, especially here in the desert in Arizona, it's very dry out. So we always make sure that we are applying a lot of sunscreen and reapplying every two hours, if not less. And that's probably the reason why you saw me with my face looking like a clown with a lot of sunscreen. And one thing that we learned is that wearing long sleeves always helps and long pants as well. So that protects the majority of your skin.  But even with that, you come back and there is some burn. Like look at my face right here on my right and left cheeks. There are some burn marks and in my neck as well because that was not covered. So anyway, so what I'm gonna do with burns in my neck, I'm just gonna start with applying some aloe vera gel. It's supposed to be soothing and moisturizing for any type of burns. I'm just gonna apply some of it on my neck, but I'm not going to apply it on my skin. That's going to be a different type of nourishing and moisturizing. I know that the light is not great because it's dark and I'm just, to be honest, I'm just getting tired. I don't have that much energy to set up the light to look better. But anyway, so with my face, because I had a lot of sunscreen and a lot of dirt with the Bikin and Sush, I did shower, but still I feel like I want to just use some wipes to get all of the stinkiness off. My lips are also dry. So with that out of the way, I'm going to exfoliate. So all you have to do is just use some sort of facial scrub. This is what I'm using right now. And that is hopefully going to do some work to get rid of some dead skin. I do feel like it's deeply exfoliated. It's a little bit gentle. So I'm going to use my brush just to kind of help the exfoliation process. I'm going to try to avoid these areas right here that are a little bit burnt because I feel like they're already burning. And that already feels much better. If I had so much time, I would apply face mask sheet just to really nourish it. But if I do it right now, I might fall asleep. I'm going to use my eye cream first of all. This is one of the eye creams that I've been using lately. And I would apply underneath my eye and on the lid as well. And it's been working really well for me. I don't have a mirror in front of me like I would do right here. And I feel like it does a great job of moisturizing underneath the eyes. This is from the brand BioSense. I've been using them for about, I think, four months now. And they have some very good products. I'm not crazy about using a lot of products. If I find one brand that I like, I just use it for a while until I find another one that works for me. And this one seems to be working really nice. So this eye cream is really good. So this brand claims to be, by the way, this is not sponsored or anything. It's just a brand that I like. And they claim to be clean and organic. So anyway, just apply underneath my eye. Feels so good. So that's done. And then for my face, I'm going to apply a repair cream that's supposed to moisturize my skin, the one I'm using. Same brand also. They do have a night cream. And to be fair, I tried the night cream before. And I didn't like it. I don't like the smell of it. To be honest, most of the smells from their products, they're fragrance-free to start with. And at the same time, they don't smell great. I don't have a problem with the smell as long as it's doing my skin good. And I feel like this one does a great job of hydrating and moisturizing my skin. And I would just apply and lift up, up. My lips are also dry. There we go. This is, by the way, their night cream. If you want to try it, it just didn't work for me. I don't like the skin. This is the one that you're supposed to apply night time. And to be honest, this is one that I apply all the time. Whenever I want to moisturize my skin, this is the one that I apply. I have a bit of a burnt area here too, I think. Yeah, I can feel it. So that's done. What else do we want to do? I think this is good. I'm just gonna apply a lip balm. They have a rose vegan lip balm. It's really nice. I even stopped wearing lipstick lately. Even when I put some makeup on, I would just apply some of their lip balms. Really nice, works well. Plus they have it in a mini glass container. So that's done. Like I said, if I had the time, I would have applied a nourishing mask before applying my moisturizer, but it's not for today. Now the other thing, with the heat and dry temperature, all of your skin should be taken care of, including your hands especially. You can see, since I moved to Arizona, all my hands are always dry most of the time. So you really have to apply moisturizer. And I don't mind using the same one that I have just applied on my face, on my hands. But then the other thing is your hair. Your hair also gets affected by dry heat. Since I already washed my hair, I'm going to apply a reparative cream. And the one that I use, and I love, love, love this one. I've been using it for a couple of months right now. It's number six from Olaplex.  And it does a great job of nourishing and protecting your hair.  But my favorite one is the leaving conditioner just because it does wonders, especially for my hair. My hair has a lot of problems that need to be taken care of. And then when I just go, you know, like this weekend biking or hiking, I can feel it when I'm back. It's like, oh my goodness, my hair is really dry. I've tried their shampoo and conditioner. I like both of them. They do also have another repair cream that you apply on your hair when you're taking a shower and then you just leave it there for 20 minutes.  So instead, I opted for number six, well, where you just wash your hair and then apply it. That's what I'm gonna do. And what some people do before going on outdoorsy activities like this, obviously you wanna make sure that you're wearing your hat, but if you have a long hair, you know, just try to braid it. Some people would apply leaving conditioner even before going out and getting exposed to the sun. But you can see how with my hair, I probably need the whole bottle. But anyway, so that is Olaplex number six. And that's about it for my hair. So this was a very simple, real fast, post-outdoor, post-hiking skincare routine, I would say. But really just to tell you that it's very important to take care of your skin, especially when you are out and you are exposed to the sun and the heat. And I hope that you guys found this to be useful. What I'm gonna do just over the next day or two, I'm going to try to apply face mask just to nourish my skin because I can feel it right now that it's really suffering. But with the amount of moisturization that's going on right now, I think this is going to be good for now. If you have your own skincare routine, post-hiking or post-adventuring, let us know in the comments. If you have any best practices that worked for you in the past, let us know in the comments and we're excited to learn from you. Take care and I will talk to you guys later. Good night.


now wow sometimes in life you feel like on hearing some things you have heard and on seeing some things you have seen with your eyes this is the case of the tragedy that happened in ondo where a 75-year-old woman set her own son daughter-in-law and her two wonderful grandchildren are blaze how i wish this was a movie or a made-up story but unfortunately this is a true life story a tragic occurrence that happened at okmomu in akure sub-op of akure town in ondo capital city according to those who witnessed the incident it was said that the enraged 75-year-old woman lives in the same compound with her son known as olorovictor walk up at midnight to carry out the unfortunate act by setting the house on fire with a sleeping son wife and grandchildren stuck inside this tragic incident occurred on saturday the 18th day of march 2023 in ondo state akure as at the time neighbors were alerted and tried to save the situation it was too late as mr victor his wife and children had already been affected by the fire and were reportedly being rejected by one of the hospitals they were taking to as a result of the degrees of burns sadly despite the efforts put forward by people to save this family unfortunately the man his wife and their last child lost their lives only the first child is alive of course in a very critical condition and needs our prayers is this woman normal or what really happened that led to this unfortunate incident what do you think about this over to you may the souls of the departed raised in perfect peace thanks for watching this video


In the intricate dance of commerce, customer service is the rhythm that can sway the buying process. It's the subtle art of turning inquiries into sales and complaints into loyalty. Let's explore how to master this art and enhance your customer's buying journey. First, ensure your support is a beacon of help, visible and reachable. Place contact details and social media links where they're most seen and offer direct links for immediate connection. Accessibility is the cornerstone of customer service excellence. Next, embrace the spectrum of human emotions with grace. Whether faced with calm requests or heated demands, remain composed and empathetic. Apologize sincerely, listen intently, and let customers feel heard. This is the essence of good interpersonal skills. A swift response can prevent a cart from being abandoned or a subscription from being canceled. Expand your team, streamline processes or employ automated software to deliver solutions with the urgency customers crave. Personalization is the secret ingredient for customer loyalty. Address your customers by name, adopt a conversational tone, and show genuine interest in their concerns. These personal touches can transform a standard interaction into a memorable experience. Implement live chat for real-time problem-solving. It's the bridge between hesitation and purchase, providing immediate assistance that can tip the scales in your favor. Equip your agents with the right tools to offer seamless and informed support. Round-the-clock support is not just a luxury, it's an expectation. Utilize live chat, informative content, and after-hours assistance to ensure help is always available, even when the office lights are off. Harness the power of customer feedback. Use surveys to uncover the chinks in your armor and innovate accordingly. This feedback loop is a goldmine for continuous improvement and customer satisfaction. Finally, gratitude is the glue that binds customers to your brand. Reward loyalty, offer regular discounts, and express thanks through personalized gestures. Show your customers they're not just a number, but the heart of your business.


So, I am Abhishek, I work at Helpship, I do the DevOps here, I will be sharing our learnings with MongoDB. We have been using it for last 3 years and currently we are serving around 10,000 queries per second in our current MongoDB infrastructure. So, we started with... Am I audible now? So, how many of you are using MongoDB? So, how much people? Let me introduce MongoDB, a little introduction. It's an open source document database that provides high performance, high availability and ultimate scale. So, this is basically a MongoDB structure, it looks like. And it looks like JSON, basically a JSON documentation. When we say it's schema-less, it's called schema-less. We say that Mongo doesn't require you to have particular schema and you can have any specific format or data. So, this is basically a simple longer document which has key value pairs JSON-like format. Many of you must be familiar with JSON. So, this is why we chose MongoDB. Basically, it's schema-less as I already told you. And then, faster development and early stage. So, MongoDB is not complex like other no-scale solutions, for example, React. So, it's very straightforward and simple. You can just install a single MongoDB instance on your local system. And it gets started within 10 minutes. So, that's what the faster development is at this stage. For the start-up, it's very much important to deliver the product faster and get it devoid or get it evaluated by the customers. And then, we first started with master-slave replication. And then, replica sets, the current, important, or hot feature of MongoDB was not available. So, we started with master-slave replication. So, advantage of master-slave replication is it's easier to maintain. But the restart advantage is no automatic failure. So, suppose if your primary goes down, then there is no way for MongoDB to automatically tell the secondary to get shifted to primary or get promoted as a primary. You will have to do it manually. So, we have some of these S&T operations, which are very common actually. Like converting master-slave to replica-slave, converting slave to master-slave. Those kind of operations require very, I want to say huge, but it requires a downtime basically. And again, there is no automatic failure. So, you will have to do it manually. So, that's what the problem with master-slave replication. Then we have global locks. This is another debatable topic of MongoDB here. I want to tell you a lot. And back in the point, the version is MongoDB used to take global lock on entire database. So, for every line application, there is a global lock on entire database. And other operations are possible. Suppose you have two databases, two databases stored in the MongoDB, and you are writing something to one database, then you won't be able to write to another database because there is a global lock. That was the problem with 2.2 version of MongoDB. With 2.4, they have come up with the database in their locking, so there are no global locks in it. So, if you are writing to one database, and there are other databases, other databases can accept reads and writes while one is just accepting writes because it's locked. So, they solve this problem. And they are coming up with roll-level locking. So, it's even better, but it's not a production-ready idea. Then 2.4 still has global locks on certain operations, but they are very limited like repairing database or compacting database. So, repairing and compacting are very critical operations. That's why they have global locks for only those operations, but not every write operation. So, roll-level locking means you have documentry. Everything is in form of document. It's not the couple of the RDB. Yeah, but you can read the document like a book. You put a lot of documents. Yes. No content. Right. No concurrent documents. So, yeah. Then, these switch to replica sets for... Because the traffic was increasing. Customers are increasing. And it's not really visible to have master set of application in place. It's such a high-request website. So, these switch to replica sets. replica sets give automatic failure. So, basically, you have a primary. And then you can have around six secondaries. You cannot go beyond six because it's not recommended by MongoDB. But you can have around six secondaries. And you can place them in different... We use AWS. So, we place them in different visions for... And we can have availability zones for failure or AWS failure. So, you can have six secondaries and one primary. And it works like that. It takes up elections. And each election chooses primary and secondary. So, if your primary goes down, then secondary will stay down. As a primary. Then you can... It's called RS company, replica set configuration. In replica set configuration, you can define priorities. Something like this is a primary with priority five. And then this is a secondary, priority four. And then we have another secondary with priority three. Suppose primary with priority five goes down. Then out of these two secondaries, the one which has more priority will become primary. That kind of stuff. So, this happens automatically. You can set priorities yourself or... The priorities are assigned by default. So, that's certainly failure. And rights for loss without rights. So, yeah. So, right concern is basically... How many members of data base you want to write? You want your rights to go missing. So, suppose in three notes, replica set cluster. One is primary and two are secondary. So, first type of right concern is unaccommodation. So, right comes from client. And your driver, which is writing to the primary, will not acknowledge anything to the client. That's unaccommodation. It's very fast. It's very fast, but maybe unceasingly. Because there is no acknowledgement. If there is a network failure, your client won't be able to take it. If there is a data loss, your client won't be able to take it. That's unaccommodation. It's very fast. This kind of unaccommodation right concern may serve because of particular type of obligation, but not in our case. Then second is how a case acknowledged. In that case, if there is a network failure, then only your client gets acknowledged. Otherwise, third type is journal acknowledgement. Means when a request comes, it gets returned to the journal and then your client gets acknowledged. Basically, in that case, you are sure that your data is returned to the journal or to the client. And then another type of acknowledgement is there. It's called replica set or replica set. In that case, what happens is your right comes, it gets returned to the journal primary, and then it propagates to secondary and gets returned over there. And then you get the acknowledgement. This is called replica set acknowledgement. So without right concern, we were losing some rights. There was a height. So we encountered that problem and then we started using replica set to make sure that our rights are going to the secondary journal. So priorities, I already talked about priorities. It's used for election in purpose. So primary goes down and secondary goes to the primary in that case. So you might want to set a low priority to one of the members, which is in another region, and your main infrastructure is in some different. So you can set up priority on that secondary service so that it will become primary. And then promotions and state accounts. Promotions and state accounts, you can... Mongo provides their own shape where you can use RS config to promote and devote primaries and secondary on the fly. So you can just write a single command where you set the priorities. So this is the Mongo now. Let's say it goes from here. And then we have priority here. So this is configuration. So suppose for secondary, we have to... one of the secondary members, we have written this configuration. And then you just do RS not read complete. So what can happen is this way you will be able to change the priority of earlier Mongo users to something 2 or you can set it to 3 or whatever. That is how you can change priorities on the fly. It has... using this RS config to promote any primaries or devote any primaries to secondary, or promote any secondary to primary. And in that case, what I must call a fraction of seconds. All your Mongo's are secondary. So no writes are going to the rating asset. In that case, you can use some writes. Again, we can address that problem through your application or viewing system. It depends upon what your application needs to have. So that problem can solve any problem. Then... So you can... No, it will be this fraction of seconds. One to two seconds. But then if you have a high traffic, then you will lose the writes. So, yeah, sharding. We pride sharding, actually. We are not using sharding in production. But we pride for the generative purpose. And we... We face this outrageous problem, actually. Because if you are shardy, if not chosen properly, then it happens that if you are running, let's say, four instances, and your one connection or in other words, one table is distributed across four instances, okay? And you are writing data with that table based on your sharding. And if your sharding is not right, then it might happen that your data is getting data single server only, out of those... Your table is distributed across four instances. But your data is continuously getting written to only one server. It makes it a hard way, and it might go down. So, choosing the right sharding is very important. They have extensive documentation about changing sharding. One of the early developers from Korea have written a book about it. It's a good read, actually. Then, yeah, the sharding... Taking backups in sharder environments are also... I can say, creepy. Because... Simple monger dump... They have this command for monger dump. You can just grab all the data in a single file. But it's not possible with sharder environment because your tables are distributed across different instances. So, basically, when you take a backup, then you should be able to restore it and use it as if it's a new data. So, that part is actually tweaking with sharding. But you can use file system snapshots and monger dump as well in case of taking backups. But it's tricky. This is a very interesting feature of the read preferences of nobody in the previous analysis. So, by default, all the read operations are written from the primary. So, even if you have secondary, secondary is just to make the data available and in case of failure. But if you have a default mongo installation, then all the reads and writes are going and coming from primary. So, we face this problem that our application actually... Actually, there was a read queue. The read queue was found and one of the promo code ran. And what happened is there was a lock on the database layer. And basically, since there was a lock because the write was going, the read queue found and some of our reads started to fail. So, that's where we discovered that all our reads are being served from primary and secondary are lying there, just like that. So, in that case, what we... Pardon me. So, in that case, what we did is use secondary preferred read prefer. So, what secondary prefer does is it allows your application to read from secondary. So, in that way, it reduces the reads you found on primary and you are able to serve writes through secondary. So, basically, read preferences are used to scale your read operations and our infrastructure, our application is very read-tennis-happy. So, we had to use this feature to get all the problems we were facing. It's very much possible that there are propagation delays in this scenario where your application is writing to primary and your application is immediately trying to read the same data which is written to primary from one of the secondary because we have enabled the secondary paper. So, your application is writing to primary and trying to read the same data from one of the secondary. But what happens is there are a lot of requests. It might happen that your data is not propagated to secondary. So, in that case, it will fail. So, that is very much possible. Secondary might have a scale data. So, what is the propagation time? Same time. Propulsion time is... we have observed not that much as long as you have all the secondary parameters in the same area. But if region changes then there is some kind of delay. I don't have to remember right now. But there is a delay. Then, yeah. How would you be... you can even check the consistency states of the data. It might happen that there are propagation delays. I have already told you about the right consistency, right? So, yeah. So, one thing you can do you can combine this in reference feature and write concern to make sure that writes are propagated to secondary. So, you do that. Your application might slow down a bit but your data will be consistent. So, that the problem won't happen like your application is trying to read the data from secondary and it doesn't have a data. It can be limited using write concern so that you can tell your application where till the write goes to every secondary at the primary. Yeah. So, it references it reference actually helped us in one more way that there was a failure of one of our primary servers some AWS and then we had to promote secondary to primary and as I have already told you that there is there is some little time fraction of time where you are all normally instances are secondary. In that case all these are writes are failed reads are happening with writes are failed. So, having read reference said we could make sure that primary is not getting all the writes and we could save some data because writes and reads are distributed across all the secondary. So, we could stop, we could avoid all those where in first case all the writes and reads are coming from primary. So, all the reads which went to secondary was not data also. Yes. There is another feature called tags. Tags can be added to secondary and using tags you can tell your application to read particular data from particular instance particular secondary. Say for example some of you manage to figure out particular request is coming from US and particular request is coming from India and you have one secondary in India and one secondary I am just taking some hypothetical situation. So, one secondary is in India and one secondary is in US and you can tell your application based on these tags to fetch data from the nearest instance. So, US traffic coming from US will fetch data from US instance and traffic coming from India will fetch data from Indian instance. So, line instance for that tags can be used. Tags can be used with write and send as well. So, you can tell your application that this write should go to this instance first and then other instance. That way you can use write concerns and tag division. So, let's come to monitoring. So, MMS is called Mongo monitoring service. It is provided by MongoDB, and it is basically a simple command called DB server status which gives a huge output and lots of insights about how Mongo is performing and all. MMS is basically the same information presented in the command graphs like this. So, you have all these information, lot percentage, queues, cursors, network connections everything you get in the document format in Mongo sharing itself using DB.server status all. This is presented here. This is a free service by the way and I would like one to use every MongoDB user then backups. We are still currently using MongoDB to take backups. We use generally secondary instances to take backups from. It might not be a point in time backup, but it has a purpose so far. But it has its own problem like when you are doing Mongo, the system usage on secondary goes very high or it takes up RAM and CPU as well. What is this concept called working set in Mongo? We are frequently as a data has to fit in the memory. If you don't have enough memory, then Mongo will start swapping and swapping will definitely do your performance. In case of Mongo demo you need a lot of memory as well to take the data is done. It might affect the performance of your Mongo cluster if you are using Mongo demo. We have never used a backup service by MongoDB but what I read about it, it's a good solution to have backups without affecting much your cluster performance. I was training the working set needs to fit in memory. So, frequently accessed data needs to fit in the memory otherwise Mongo starts swapping and it degrades the performance and increases page points because Mongo is trying to access some data from memory and it's not there then it goes to this and checks for the data and then there you start having performance points. The second thing is required database. What happened is earlier we used to store our analytics data in MongoDB and that was huge data we request everything we were just putting into MongoDB so I can let our connection size do very fast later we should use some other technology to address the analytics problem and we stop writing to MongoDB but we have these huge collections of useless collections in MongoDB so we decided one day that we know all those collections and that was around 70% of our total name so we removed all those collections but interestingly we found out that the database size is same it has not changed if you take MongoDB dump then you will get around 5 MB of 600 data and the database size never changed even if we deleted around 70% of our data so when I looked up in MongoDocs I came to know about the compaction and repair database name so the repair database what it does is basically the refragmentation so it checks on the collections and removes unwanted data and refragments which reduces the overall size of the database but this repair database operation is very expensive because it takes a global lock on entire database you really don't want your database to be locked when you are still serving the request and then again it needs twice the twice the disk space to complete the operation so that was the problem with the repair database so we still have the huge database and not much similar data then XFS so all of our servers use XFS it's recommended on MongoDocs basically XFS provides journaling and it's very well supported for databases like MongoDocs so we use XFS and XFS gives a nice feature called XFS Reach where you can use that feature to facilitate file system level snapshots of MongoDocs and then it also provides XFS RoHS which you can use in case you need to expand your disks so just attach one more disk and you can just say XFS RoHS and it will just expand disk and live expansion basically you don't have to get anything coming up then yes since we are hosted on AWS we we try to figure out what is the best solution for storing a database on AWS for Mongo then LVM and RAID 10 is what we use LVM we use for extending the file system so you can attach more disk and expand and RAID 10 is basically for redundancy one plus one plus zero then yes there is one terminal level of system level tweak that we use is keep alive time which is we set it to 300 it is recommended for sharding and recognition purpose that particular keep alive time these are some things so we are we are running to use or we are rather evaluating right now this is another solution called TOQMX TOQMX is nothing but another MongoDB but they have come up with different techniques of storing the data all threatened with so using threatened with they manage to reduce 90% of space then they also have contractions the asset the RDBMS databases which are asset those contractions they are providing which are currently assets in MongoDB then and they also claim that they provide takes faster and less so we are running it out right now they don't provide these two services which Mongo Current in Word takes to text search and especially in index so so how many how many people are involved in beginning this setup currently I am I am I am


The Forest Atmosphere Carbon Transfer and Storage, or FACE site, is an outdoor research facility located in Duke Forest. For more than 20 years, a multinational, multidisciplinary group of scientists have been studying the effects of carbon dioxide on forests and plants in relation to climate change. When these scientists share their findings, a picture of a wide range of outcomes that result from exposure to high levels of carbon dioxide begins to emerge. At the FACE site, stands of trees are exposed to levels of carbon dioxide that we can expect to experience in the near future. Elevated carbon dioxide warms the Earth's atmosphere, but it is also used by plants during photosynthesis. So you might think of elevated carbon dioxide levels as a sort of fertilizer. In the main experiment on Loblolly Pines, small stands of trees are exposed to elevated levels of carbon dioxide and paired with a control group of trees that is not exposed. The carbon dioxide, stored in a large tank on site, is mixed with air and pumped through a system of PVC pipes surrounding the trees and the test plots. These exposed trees receive exactly 200 parts per million above the natural concentration of carbon dioxide found in their environment. This difference in concentration between the exposed and the unexposed tree stands is closely monitored and adjusted, ensuring the exposed stands always maintain this consistent elevated level of carbon dioxide. The concentration of carbon dioxide in several other important parameters are measured from tall towers above the trees. This allows scientists to get well-mixed samples at different elevations. There is a constant flow of information from the trees, including measurements of atmospheric variables and carbon dioxide levels. Instrument readouts are compiled by a computer on site. Data collection of some of the same parameters also happens via satellite. It is a challenge to compare the satellite data to the data gathered on the ground. Since the trees are not isolated, scientists also study the effects of elevated carbon dioxide on many other related plants, animals and soil factors. At predetermined times, samples of the trees are harvested and a variety of measurements related to the growth and health of the tree are made by examining samples of leaves, bark and other tissues.


Welcome everybody. My name is Thomas Graf. I'm CTO and co-founder of Isovalent. Isovalent initially created Cilin before we donated it to the CNCF. Long-time kernel developers. I'm coming from the lower levels and also currently chairing the EBPF Foundation. And I'm Liz Rice. I'm Chief Open Source Officer at Isovalent. You may, if you've been to Kubecons in the past, a long, long time ago, I was a chair of Kubecon and I used to be chair of the Technical Oversight Committee, which gave me this amazing privilege of seeing a lot across the whole cloud native landscape. And when I chose to come and work with Isovalent, the capabilities of Cilin and EBPF had really kind of stuck out to me. So I'm very excited to be working in this technology. So we're going to talk a little bit about how many proxies you need to run a service mesh. I think in this room, we don't really need to tell you what the service mesh is there for. And we probably don't need to tell you the history of how service mesh allows us to abstract functionality that is common across multiple applications. We no longer need to write that directly into an application or in a library. We want to abstract that out into independent service mesh functionality that sits behind the application or in front, depending on your perspective. And for a long time, the model was to use sidecars. So you would have a proxy running in a sidecar container outside of the application, providing all these networking and resiliency and security and observability capabilities that we want to get from a service mesh. But sidecars come with downsides. They're complex to operate. They're complex to inject. They have additional resource needs. We'll dive into this in a little bit more detail in a moment. And they also require network packets to take a much more convoluted path through the stack. When we run in containers, our containers typically have their own network namespace. And we have to run a network stack inside the container, or inside the pod rather, and another network on the host. And if we have the proxy running inside the network namespace for the pod, we've got to kind of connect through that network stack twice before we even get as far as the host network. So there's a lot of path, a lot of processing for packets to go through before they've even left the pod. People have also found configuring sidecars pretty complex. And I love this quote. I mean, it's a couple of years old now, three years old now from Kelsey, but complexity is a real issue with ServiceMesh. So when I joined Isovelin, I remember Thomas telling me that Syllium was already kind of 80% ServiceMesh. We were already providing a lot of the functionality that we expect from a ServiceMesh in Syllium that is traditionally known as a CNI. So could we use this as a basis to remove sidecars and provide a sidecar-free ServiceMesh? And long story short, we did. Around this time last year, just about a year ago, we announced the Syllium ServiceMesh beta. Did anybody here try the ServiceMesh beta? We have a couple of hands up. Great. Excellent. This was a very kind of common comment that we got from people who signed up for that beta. They really liked Envoy, but they'd found the overhead, the resource usage, the complexity of configuring sidecars, the complexity of making sure that all their apps were instrumented, the additional network overhead, the latency involved. All these things were just putting people off from using ServiceMesh. And so they were excited at the idea of Syllium providing a ServiceMesh that didn't require sidecars. But I think something that got a little bit lost when we announced that was that we weren't saying we were completely removing proxies. There's still some proxy in there somewhere, as we'll see. And now, of course, we're not the only people talking about sidecar-free ServiceMesh. Istio now also support a sidecar-free model. And I think a lot of thought that actually getting away from the sidecar model can give us a much simpler, more beautiful implementation. There's a really great podcast about that Ambient Mesh, the Kubernetes podcast. Totally recommend it if you are interested in Ambient Mesh, taking a listen to that, because it's really interesting to hear how those engineers, Ethan and Justin, thought about that model. And one of the quotes from that was they thought for a long time that sidecars were inefficient and that users have a tendency to allocate resources for the worst case. So you can end up in this worst case scenario of resource allocation. When we move to the Syllium model, one of the advantages we have is EBPF, where we can push lots of functionality into the kernel. We can share resources when we're using EBPF much more easily, partly because we're not constrained by this idea of having isolated pods. When you have a sidecar in a pod, by design, that sidecar is isolated from all the other sidecars. It's in a pod deliberately isolated from everything else. When we push as much as we can of the ServiceMesh functionality into the kernel, it is shared, and that can be a really good thing. The kernel is there to be shared amongst all the applications that run on it. I talked a bit about the convoluted network path that packets take through a sidecar. And when we move to a sidecar-free model that shortens the path even through a proxy where that proxy is sitting on a node somewhere. So the ability to remove sidecars solves a lot of problems, but Thomas, where should the proxy live? And given my intro, maybe you already have a slight hint, given I've been doing kernel development for the majority of my career, I think proxy functionality, ServiceMesh functionality should be as transparent as invisible as possible, and the kernel is actually a great place for this. But this does not mean that then the kernels need to solve all aspects. The kernel has always been delegating functionality from kernel space to user space, and we'll see a couple of examples. In the case of ServiceMesh or ServiceMesh in general, there are aspects that are not great matches to be solved in the kernel, such as TLS termination, HTTP authorization or complex HTTP parsing, and of course identity management, TLS control handshakes, and so on. We'll get into the details here. This means that ServiceMesh has this advantage that we can be EBPF native when possible and benefit from the performance gains of EBPF and then fall back to an envoy proxy when EBPF is not the ideal instrument to implement. Other examples I mentioned that this has actually been the case for kernel development for ages. The kernel has always delegated some functionality to user space. Very good example is IDS. So Riccardo running in user space and doing deep packet inspection using IP tables, NFQ to punch packets user space, or even just kernel module loading when your laptop loads the Wi-Fi driver. It actually, the kernel module is getting loaded through a so-called user space mode helper. So let's look at what functionality can be done in EBPF native and where do we still need a proxy? I mean, then we'll talk about the number of proxies afterward. There's a lot of functionality that's already possible EBPF native without any proxy at all, purely in kernel space. Of course, any sort of L3DL4 forwarding, right? Any sort of L3DL4 load balancing, but also cannery rollouts to polygyro routing, multi cluster routing, network policy on layer three, layer four, and we'll talk about the details here, MTLS, as well as a variety of observability functions, HTTP, TLS, tracing, TCP, DNS, TCP, UDP, observability, and so on. When do we still need a proxy or for use cases such as layer seven load balancing, for example, path based load balancing, header based load balancing, retries layer seven rate limiting, as well as TLS termination and origination. Currently still in the proxy land is layer seven or policy. This is road map to be EBPF native, but currently not implemented yet. So this is the current split, which means that we can benefit from the EBPF performance and simplicity whenever possible. And if we cannot do it in EBPF, we essentially fall back to a proxy model. So what do these different possible models of where we put the proxy? What do they mean in terms of pros and cons? Because ever since we first discussed having Sidecarler service mesh, people have been debating the pros and cons of where that proxy lives. So if we think back to the sort of original Sidecar model, we had potentially what could be seen as a security advantage that the proxy shared all the same isolation that the application pod did. So it naturally has access to the application's secrets. It's isolated in the same way as the application is. So from a security model perspective, you don't need to think about it anymore because it's the same as the application. And Cilium has supported this model for Sidecarler for service mesh for a long time now. It has been possible and people are running Istio on top of Cilium as the networking layer. That's a completely supported model. But if we want to move away from that, we want to not have a proxy for every one of our application pods. If we put the proxy on the node, what does that mean? Well, it means on the one hand, it's co-located on the same node. So our network path can be pretty efficient. But it does mean that if we have multiple tenants that are not on the same node, they can't all share that same proxy. You don't need to have additional proxies elsewhere on the network. And you can have this very, you have a proxy right next to you, which I think is a good thing. This is the kind of default model for Cilium service mesh today, where we would have one proxy per node. But we are working on the idea of having multi-tenancy by having multiple proxies running on the node. So that can give that isolation that people are potentially looking for. Another model that we're seeing now is this idea of having the proxy not necessarily co-located on the same node, but somewhere in the network. And that pretty much guarantees that there will be some extra network hops. But it does mean you can share that one proxy amongst multiple instances that are in the same service. And this is, you know, I would say a relatively new idea. It's something that we're interested in and would like to understand whether Cilium users would like to see this model. It would certainly be possible to implement that Z tunnel approach in the Cilium layer. But I think most importantly, there isn't a single solution for, you know, you must have proxies, this number, this ratio of proxies to applications or this particular location of proxy relative to your applications for some require for some deployments for performance reasons, you will choose to have a proxy on every node. That will almost certainly give the highest performance and probably reduce complexity in other environments. You may choose to emphasize more multi tenant isolation. In that case, you may want to have more proxies, perhaps as much as one proxy per application. So it does depend somewhat on your risk model. And there is no single answer. What about encryption? What about encryption? So we talked about number of proxies and we figured it's actually interesting to look at the most common use cases of why you want to use or why you use a service mesh and encryption and observability are probably among the top asks that you have. So let's look at encryption first. First of all, if we look at encryption, there is two broad models to achieve encryption. We can achieve it at the network level using functionality such as IP sec or wire guards, where we essentially encrypt in higher network nodes to note. This can be fine for many use cases and has been the status quo in networking for a long while, but it does rely or it does, it does require that you trust your node. So if the node gets compromised, the key on that note gets compromised and then the network encryption gets compromised until the key gets rotated. So it uses node identity. That can be that can be great if that is your security assumption. What if we want deeper security, better security and actually take it one level further? Obviously MTLS comes into play. The downside of MTLS as implemented with side cars is that first of all, it is shared with the layer seven proxy, which means that if the layer seven proxy gets compromised, all certificates and secrets in that proxy get compromised as well. And the second big downside of using side cars for MTLS is that is pretty much limited to TCP. And in particular enterprise use cases will require multi-cast UDP, SCDP and a variety of other protocols that need to be supported. So we looked at this and asked ourselves, can we support an MTLS model, a mutual authentication model, while benefiting from the network level to support any network protocol? And this is what we came up with for all the details on how exactly this works. I've linked the blog post that goes into the details. We'll also see the poll request with the initial work later on. Essentially, this splits the authentications piece from the payload, from the data path. And this means that the authentication happens through a regular MTLS handshake where we can integrate with Spiffy, serve manager and so on and do a regular mutual authentication using certificates that are per service. And then instead of instead of carrying the actual payload and network data, the data in that MTLS connection we carried out through the network directly while using the keys to secrets that have been negotiated via the MTLS handshake using IP second wire guard. And we kind of gain the benefits of both models where we get a strong mutual authentication handshake with MTLS while we can support any network protocol without introducing any sort of proxies. So we can establish encryption and mutual authentication network wide without requiring proxies while supporting any protocol. Let's look at how this actually looks like because let's say you're not using this and you're going, you're, you're going down this road and want to use this. We're integrating this into a system that our policy, which is an integrated, which is an extension of Kubernetes network policy. And all some users have to do is essentially opt into this and say, for these connections, let's say front end talking to back end, you need to authenticate. And as soon as that intent has been defined, authentication is required before the connection can be established. The actual service specific certificates are in this case provided by Spiffy serve miniature integration is also on the roadmap. But currently the pull request and the issue that I've listed here on the slide is essentially enabling the Spiffy integration that allows not only to generate certificates for each service and thus give or make X five or nine certificates available to psyllium. It also allows us to actually tie network policy to Spiffy IDs, which means instead of selecting policy by our Kubernetes labels, we can actually use strong Spiffy IDs. So essentially we solve two problems and ideally because psyllium already has a concept of identity, it's simply or easily maps to Spiffy IDs and Spiffy service keys. What about observability list? Well, observability is a pretty hot topic for us this week. Um, I want to actually give a shout out to Adam who gave a talk earlier about how you can use EBPF to kind of gather metrics in a very efficient way because basically that sort of shows the sort of underpinnings of what we what we do here and how we're gathering some really good metrics and then making them available. So how am I going to do this? Okay, my actually, no, I'm going to show one more slide before I do that. We this week we're doing a lot of work with the team at Grafana to show off some really nice integrations between Grafana and psyllium. I'm just going to show you kind of the tip of the iceberg here, I think with this, this demo today, but there's, there's some really nice integrations here. So demo time. So I have a an open telemetry demo app. I'm going to guess that some people here will be familiar with the app. It looks like this. I'm going to just refresh it just so I've started getting some network traffic. Um, and it's sitting behind an ingress, which is a psyllium. It's a Kubernetes ingress with, um, of psyllium type. And as a result of that ingress being created, we should have actually, let me see if I can find, no, I'll show this first. This ingress causes a psyllium envoy configuration to be created, which is that one. And hopefully I'm trying to do this with one finger. That's why I'm um, so that envoy configuration was automatically created from the ingress configuration. And what I'm looking for is the bit that says here we go.  So this is a very, very simple demo, but we are going through an ingress layer seven routing here. So let's just do a little bit of, um, telescope shopping to generate a bit of traffic. Um, I think we can buy these. I've bought a lot of telescopes today. It's quite, quite good.  I don't know why that didn't, doesn't really matter. I'm just trying to generate some traffic. And when I generate some traffic, you can see here at the right hand side, those are my requests, my most recent requests and here is me just checking that the demo works a few minutes ago. Um, and we get this really nice layer seven metrics generated by psyllium through EBPF. A lot of these, these metrics are being gathered by using EBPF and, uh, they're generated in Prometheus format. So they're very easy to pull into Grafana dashboards like this, uh, getting things like the duration, the latency rather very nicely graphed out. We also get a service map. Now, if you're familiar with psyllium and Hubble, you will probably have seen the Hubble service map. This, this is something that, you know, we've had in Hubble for a while and you can see individual network flows as well as the way those flows go to build up an overall service map, but we can now also see that service map inside the Grafana dashboard. I hope there we go. Yeah. So we have this really nice ability to gather metrics. As Adam was talking about earlier, it's very efficient and it's incredibly useful debugging and observability tooling available through this. I'll leave it to you to explain the rest. Yeah. So I think we've seen nice demo. Obviously this also works for just pure network observability on the lower levels. We've seen the layer seven, obviously a free layer for all of this comes integrated into, um, kind of one set of dashboards. Very nice that hobble UI can now directly embed Grafana dashboards. We can also do tracings or is an example of a, um, integration of spans, uh, displayed in Grafana tempo generated by, by hobble, as well as the goal single dashboard that we've just seen. The last point, I think we've looked at observability. We looked at encryption and TLS observable. And the last part is kind of traffic management. So how is it possible to define and use traffic management in Selim service mesh? And we want to quickly show like what is the state of the individual configuration options that you have ingress, gateway API and Kubernetes services, as well as the envoy config. The rest of the stack, I think is hopefully pretty obvious. Obviously Kubernetes has the control plane itself. You don't really need anything beyond that. Um, two of the secrets as the current identity management integration we have an on the road map is spiffy and serve manager and then the data plane, EBPF and on the way. So let's look at these individual layer seven traffic management options ingress services, gateway API and on the way config ingress and eight and on the way config are already fully supported in the one 12, um, services with annotations and gateway API are coming in one 13, the code is actually complete. It's just not merged, but it's available in deaf branches for testing. If you are interested, I've linked the pull request with the branch links in there ingress, very simple. It's simply fully conformant. So it's a basic example of path based or path prefix based routing using ingress. And that's what you saw in the previous. That's what we saw in the demo. Exactly service annotations. Like some of our users said, well, that's great. Ingress is great, but we really want to have this most simple to use case possible for layer seven low balancing. So we simply added a bunch of annotations as a Kubernetes services to enable least weighted, um, least, uh, rated least request, g RPC low balancing where all you have to do is annotate your Kubernetes services with these two annotations and you get transparent g RPC low balancing. Very, very simple. And it gets better because Syllium has multi cluster capabilities built in at another, another annotation to mark this service as global and while a lot of the service low balancing works across clusters now. So this is the simple, the simplest option, right? Okay. Ingress services, if annotations and now gateway API, right? Initially or originally called ingress we do probably the way forward for most of you, how to define traffic management in the future. We have the code complete to support the latest gateway API spec. This is a typical example using the gateway and HB route resource also using a path, path prefix. And then the last option, and this is really kind of a low level building block, but it's also available to you as users. You can actually define and configure raw envoy configuration in a custom resource. This is how the ingress controller and the gateway implementation actually map or use a Syllium service mesh. So they essentially translate into Syllium service mesh. But if you want to use this lower level API, you're absolutely free to do so. This way you can essentially use the full envoy feature set in your own service mesh. Definitely, as you can even see in the example, definitely a lot harder to use, but with a lot more capabilities. And that is it from our side. I think we have a couple of minutes for questions. Thank you. For MTLS, you mentioned that there was an initial handshake that was MTLS and then the data was pushed somewhere separately. Does that mean that data is encrypted and confidential? Yes, correct. So MTLS is used for the handshake. The MTLS handshake generates the secrets, the keys, and they are handed down to WireGuard and IPsec where the symmetric encryption happens in the kernel. So HMAC and encryption is happening in the kernel. But the authentication handshake is done in user space using MTLS. Thank you. When you use mutual tiers, do you use that also for exchanging the certificates for the workload? And when you use both mutual tiers and WireGuard, how do you avoid the double encryption? Because by default, mutual tiers has an encryption right. So hopefully I got the question right. So we are using, in the example shown, either Kubernetes secrets or certificates created by Spiffy. So those are service-specific certificates for the MTLS model. And in our MTLS model, the data gets encrypted using IPsec and WireGuard. So there is no additional TLS-based encryption. There is no double encryption. Hopefully I got your question correct. Otherwise, please clarify. Any other questions? I didn't catch on that slide where you showed the service with the annotations. Was that a service of type load balancer? No. It is a cluster IP. It's a cluster IP service. Okay. Yes. But it would actually also work with of type load balancer. So Cilium also implements type load balancer. And then the cluster IP portion just comes after it. So it also works for node port and load balancer. How do you get your envoy between the load balancer and where it's going? We use EBPF to inject envoy into this picture. Cool. I got you. I got you. I got you. No worries. It's my responsibility. I'm not get paid for this, but you know, I take my responsibility seriously. Thanks, Thomas. You had one slide where you were showing alternative methods to SciCar proxy or even co-locating the proxy. And it was just a proxy on the network. Is that kind of just taking that simple load balancer concept that we know from yesterday year? That was, I guess, a nod towards our understanding of how ambient mesh is doing proxies that they're not specifically located on any given node. I mean, we've kind of shown it floating in space. I think it would be on a node somewhere, but the point was more it's not specifically associated with the node where an application is running. It could be in space. Is it fair to say it can be like a part of namespace or something like that kind of a little bit more abstracted? Yeah, I mean, I think for both models where it's on the node or on the network, any granularity could work. I think it's more just location versus ground. I think the benefit of the network model is that you can share that proxy for the same tenants that are not on the same nodes. Whereas if you're on that node, you'll share it only with tenants on that same node. That's the clear difference. And I think that's a great example of a trade-off where you might minimize network hops in order to but you may have to have multiple instances. So I think from a Selenium service mesh perspective, we're interested to support both models. So if you want us to also support like the proxy on the network model and support waypoints, file a GitHub issue or just talk to us on Slack and we're happy to add it. It's actually very compatible with how we think about service mesh as well. Hey, fantastic talk. With the like sidecar for every pod, those individual envoy instances are only going to have their tunnels to whatever the application happens to be talking to, right? Whereas on the node one, I know this came up in the Istio example as well. It's like on the node, you've now got a single envoy instance that's going to have to do all the wireguard or IP set tunnels from every application on that node to every application that that's talking to. Like, are there any concerns around overloading an instance? Like, I don't know. I presume there's been a lot of testing on this. I'm kind of curious if you can talk about how that's worked for like larger clusters. Yeah. So I think the benefit is that on the proxy on the node model to get a revive the second wire guard, we don't need any tunnels at all. It's purely on the network level and that works for 10 thousands of nodes. So that uses this, the standards to lay in that work layer encryption. So we're not actually creating tunnels like peer to peer tunnels at all on that, on that node. But maybe, maybe clarify your question because I think I got it wrong based on your, but we can also talk outside. Well, I think we have a time for one more question. And I think I have working for one last question. Hi, thank you. That was a great talk. I was wondering for requests that need to go through that envoy proxy. How do you scale that proxy as the requests increase? What mechanism do you have there? Yeah. So envoy has several mechanisms. First of all, you can define the number of listeners, like how many threats on what we can use. And then we also limit the resource per listener. So when we have a shared envoy instance, we actually configure a separate listener for every ingress and for every egress use case or a pod that actually needs, and we limit the number of HTTP requests or layer four requests or layer four connections and scale by the number of threats. And obviously it's also subject to the CPU memory limits that you configure. All right. So let's get around the four plus to Liz and Thomas.