Hello, everyone. Welcome to Cloud Native Live, where we dive into the code behind Cloud Native. I'm Annie, and I'm a CNCF ambassador, as well as a product marketing manager at Cast AI. Welcome on my behalf here today. So every week, we bring together a new set of presenters or presenter to showcase how to work with Cloud Native Technologies. They will build things, they will break things, and they will answer all of your burning questions. So you can join us every Wednesday to watch Cloud Native Live live. This week, we have Jim Bagwalia here with us to talk about supply chain security with Cosi and Kibirna. So thank you much, everyone, for joining in. This is a house group keeping thing. This is an official live stream of the CNCF. And as such, it's subject to the CNCF Code of Conduct. So please do not add anything to the chat or questions that would be in violation of that Code of Conduct. Basically, please be respectful, all of your fellow participants, as well as presenters. So with that, let's get us started. And I'll hand it over to Jim to click us off today. Thank you, Annie. And thanks for having me. So really excited to talk about supply chain security, present some of the work going on with Kibirna, which is an admission controller and policy engine for Kubernetes. And also with Cosi, which is part of the six-door project, right? So this is, for me, just kind of as a caveat and somewhat of a disclaimer. Like obviously, as you see, probably in the last six to 12 months, there's been a lot of headlines, a lot of news on supply chain security and topics related to that. So this is something that, of course, based on customer interests, others, we have been diving into. There's a lot of new work going on in this area. So I'm going to first introduce just some basic concepts, things that we have been researching, collating, and kind of putting together. And some really good emerging work coming out of different open-source communities. So let me share my screen. And I'll pull up a few websites that we'll go through just for the introductory concepts. And then we'll dive into details on what you can do today for your Kubernetes clusters, how you can sort of help improve. So just as a general... Perfect. Just as quickly maybe to kick it off as well. You mentioned that there's a lot of new headlines about supply chain security breaches. What do you think is causing the increase? Yeah, good question. So one of the theories which is fairly interesting and something which resonates is there's been a lot of work and improvement in overall security. If you think about our production deployments, what we're starting to do with multi-factor authentication across the web, but even let's say HTTPS, other network security becoming more prevalent. So of course, what's also as part of that, what happens is attackers are looking for the easy way in. And one of the weak spots, something that has been ignored, unfortunately, is how we build, deliver, deploy software. And if you think about it today, if you're building any commercial or open source software, we don't think twice about running commands like whether it's pulling a Helm chart or updating, adding a dependency. I mean, we might find something that looks interesting on GitHub or some other version control system. And we add it to our dependencies and we pull that in. But how do we know who actually built that? How do we know what that depends on? Things like that are often just an afterthought because there's so much data. If you try installing any package on any one of our systems, we just get a ton of information and ton of data. So it becomes difficult to check and audit and verify and automate all of that. So I think in terms of why this is happening, partly it's perhaps because we've been getting better at securing production and runtime systems and there are better tools, better technologies available there. And this has been exposed as one of the weaker links in our whole software development life cycle and attackers are, of course, as they become aware of that, they're looking for the easy way in, right? This maybe provides that. Perfect. Well, not good, obviously, but perfect as a brief one is. Yes. So but there are the good news is, again, and it's awesome to see all the work that's going on and I'll introduce some of the communities if folks are interested where they can go for meetings and different things. There's just a ton of growing awareness. There's, of course, even at the government levels, etc. There's something which is often talked about now is there's been an executive mandate in the United States to improve this aspect of our software development practices and delivery best practices, right? So, yeah, I mean, I think there are these problems can be mitigated and will be mitigated. So it's a matter of just spreading the awareness, the knowledge and figuring out what we can do right away. Just getting it done is the next step. Right. Yeah. So a few things I would like to introduce, right? And again, this topic may seem daunting as you first look at it, but it is, you know, it is approachable and there's a lot of good work and, you know, things emerging. So the first thing we'll talk about is something, you know, a framework called Salsa or supply chain levels for software architects, artifacts. And that's, you know, a standard which was originally came out of Google and now is being adopted, you know, fairly widely in terms of a reference, you know, model for securing different aspects of your supply chain. So there's different levels of security that can be attained.  So we'll go through some of that. I'll talk about, you know, another project called Six Store, which is, in fact, has multiple sub-projects, cosine being the one that we look at live, but there's also, you know, other projects which are part of Six Store.  There's, you know, it has, you know, sub-projects, I mentioned cosine, which is used for signing as the name might imply, but there's also RECOR, which is a transparency log, which becomes an important part of the supply chain security puzzle. And then there's, you know, FullCO, which is an easy way to manage web-based, you know, PKI and web-based identities, but just makes it, you know, rather than, you know, managing static keys and dealing with key rotation and things like that at scale. You know, FullCO gives some capabilities. We just make this simpler for, you know, developers and teams to adopt and manage this at scale. So we'll briefly talk about those. And then I'll, you know, switch to Kiverno, which is a policy engine for Kubernetes. We'll talk about where Kiverno fits in into this and what admission controllers can do in this whole supply chain security puzzle. And, you know, what we'll use for a demo is I'll start with the repo. This is a just that simple, you know, taking the Kubernetes pause container, just push it into a private repo. And as you can see here, this is just a simple one tag. And there's no, you know, signing of this container, there's nothing right now. And what we'll do is we'll, I'll show how this can be signed, but cosine, what we can, you know, then also do in terms of adding other metadata, which as you'll see, is recommended for various cell levels, and how we can, you know, kind of, you know, verify that metadata in our software supply chain. So again, quite a lot of different concepts and things, but, you know, hopefully as we go through, these will come out as, you know, things again, which are fairly practical and straightforward to start implementing with, so again, looking at improvements in the future as well. So really wonderful. I think it's going to be great. We're going to get a good overview about the things that are happening as well as, I guess, practical things on how to get started on a topic that might seem a bit too big to approach. Sounds good? Right. Yep. So let's, let's go to salsa first, right? And great, great acronym, of course, and what it stands for is supply chain levels for software architects, as it says. And salsa, you know, has four different levels which they identify. They have a nice picture over here with some of the, you know, threat model for different things that could potentially go wrong.  And then you're building your code. And once you build your code, it pulls in a lot of dependencies typically.  So there's several things that could go wrong, which they've identified as, as various threats over here. And then they have, you know, different guidelines in terms of what you can do to mitigate those threats, right?    But at the same time, you know, you might have some provenance, some proof of what you're built, some records in there itself, right? The next level up is, of course, you're going into, you know, salsa level two, where you have more provenance defined for every step of your build process. And you're starting to, you know, attach that in a way that can be verified, right? And we'll actually look at those examples. And then beyond that, you want to go maybe into, you know, level three, which is level three is actually what is, you know, like something, something which takes a bit more effort to attain. But this is where every step, again, becomes auditable.  But at the same time, you have, it has a verifiable identity, which can be then, again, you know, proven at the time of consumption, right? So somebody can look at this and say, or look at the right, or audit the right artifacts and verify who built this package, who reviewed it, how was it, you know, what kind of dependencies did it have. And there's so, you know, there's another acronym called SBOM or software build of materials, which is also there is, you know, activity in terms of standardizing those, which becomes important to have that as an artifact and be able to put that into some trusted, you know, central server, which can be then also verified itself, right? And then level four is where there's some, you know, more requirements in terms of, you know, every, every sort of in your software code reviews of all changes. And again, this could even apply if you're doing infrastructures, code and other things, but requiring at least two people for a code review, making sure that there's proper sign off and processes in place. And then your build process has to be, you know, fully, fully isolated, well protected, as well as fully reproducible, right? And there are, and we're not going to go through each of these details, of course, but if you go to the Salta website, all of this is fairly well defined. In fact, just this morning, I saw there was a good blog post from Google, you know, from the security team at Google, where they talked about attaining different levels, as well as, you know, what, again, practical things that can be done to start mapping to each of these levels. But it's a very detailed and well laid out framework, which talks about, again, these, you know, like different levels of security in your CI CD build process, as well as, you know, discussing what are some of the best practices and things you can do along the way, right? So, It's an interesting, quickly question. How many kind of, what's the majority of the projects where they are usually in this scale or are they on the four or the one or hopefully some way in between, you know, so. Right. Yes. So today, most would be at, you know, level one. So most open source projects will have some automated way of doing bills. They will have, you know, the bill logs available to some levels. So there is most would be at level one or two. And very, I would say the majority would, you know, fall into the level one, where there's some scripted build processes. There is some provenance available. But even this is not, you know, overall as an industry, we're not in good shape here, right? So this needs to be improved. And we'll talk about, you know, just think about today, if you pull a container image into your cluster, or a Helm chart, right? It's such a high level of abstraction. Because as a user, you have no idea, you know, okay, well, that Helm chart may have thousands of lines of YAMLs. And now there's tools like Kivarno or Gatekeeper Opa and others that can scan and verify and, you know, audit those configurations before admission. But, you know, that Helm chart also has images. How do you know those images were not tampered with? How do you know those images? Again, where is the provenance to show how they were built? What their reference? So there's a lot of work that needs to be done, even to get to that level one, right? So, but it's possible. And then level two requires more, you know, you have to use build services where the provenance is authenticated. And six store, you know, the tools we'll talk about start getting you towards that level two. And then there's, of course, other processes which have to be improved for level three and four. All right. So hopefully that gives, you know, very quick, but brief overview of Salsa. And certainly would recommend folks go through this in more detail, read and understand. And there's, again, some great work, some really good, you know, posts and things coming about, which are, you know, helping explain this and break this down into more practical and other steps which can be implemented, right? So let's switch then to six store, which is a really exciting project. If you're interested, you know, there's, of course, there's a lot of details on the community and the community meeting. So this project, you know, has an editor receiving, as you can see over here, there's lots of good, you know, things being said about six store and what it can do for supply chain security itself, right? And it started with collaboration from teams. So Luke at Red Hat, Dan at, you know, Google are some of the main folks behind it, you know, and we'll go through some of this in more detail. But just to kind of show what the project does, there's three things that they, you know, three sub projects in six store, which are important to know about. The first is, you know, signing and making signing easier itself. And cosine is the primary tool. It initially started out as being a signing tool for container images and OCI registries, but has, you know, evolved into being able to sign almost anything, right? And it's, whether it's, you know, blobs, whether it's ham charts, there's work going on, you know, to integrate cosine and helm and, you know, standardize some of that. And for the most it will, you know, these signatures again, cosine gives a lot of flexibility in where you can have you manage these signatures. It doesn't, you know, sort of pin the signature to a particular location.  You can, you know, also do things like you can have your other metadata and we'll talk about the importance of metadata and how you can, you know, build attestations out of those and also manage those with cosine, right? So that's the first tool to kind of be aware of and, you know, play around with. It's very easy to get started. So each one of these, of course, like if you go to just the cosine git repo, you know, it has, they have their own kind of getting started pages, how to kind of install and use this. So, and it's cosine is super simple to, you know, get started with manage, you know, public private key pairs, sign images and try out, right? So once the signing part of this is taken care of, there's also, you know, one of the things I mentioned and maybe should I point it out when we were discussing salsa is there's a need for more, you know, metadata and there's other projects also existing projects like Intotor, which is another Linux foundation project, which act as metadata repositories, right? So as you can imagine, when you're creating bills, when you're, you know, verifying these type of things, a lot of information gets produced and, you know, this metadata is important when you're going to then again verify trust and, you know, check things later at deployment time or at runtime. But, you know, signing what's important next to do is signing this metadata and creating something that's known as an attestation out of it, right? So the Intotor project has a format and there's a process and they're, you know, kind of going through the work of standardizing this format of having attestations. So it could be something as simple as saying, okay, yours, you know, I've scanned my container image or, you know, the code that goes into it. Here's, you know, the results of my vulnerability scan. And I'm, you know, as a approver, I'm creating an attestation by signing it with my name, with my identity, that this is ready for deployment into a production system or into my, you know, the next system in my CI CD pipeline. So that, you know, there's another tool from in the six store project called RECOR, which becomes the place where you can, you know, you can push all of these transparency logs, as well as other metadata, which can be in an Intotor can also receive a lot of this metadata. So these systems will now have information you can later audit or look up to verify. And there's also a question from the audience and that we can maybe handle now. So who decides an organization's salsa level, level achievement? Is it managed internally by the org? Yeah, so that's a good question. There is some activity where, you know, there are just like with PCI and other compliance standards, the, you know, auditors and, you know, folks who are in the business of providing these compliance certifications are also adopting salsa as a framework, which will be, you know, auditors will be able to inspect that. Just like with PCI, for example, an auditor would check if you're using proper fire rolling and you're using SSL and things like that. Similarly, auditors will be able to check and provide that, you know, compliance level for salsa. Perfect. Yeah, that was a question from Tatmaka. Perfect. Thank you so much. And then there was also a comment from BiGuy86 from open source applied to enterprise perspective. He or she has sewn a really poor security more than 80% of the project and best ever seen Argo CD, worst ever seen Kanifah. So that was an audience comment as well. Thank you so much everyone for interacting with us. Absolutely. Yeah, so, you know, what I was mentioning with the metadata and what you can do and we'll take a quick look at an example. So record, you know, becomes this transparency log where it's capturing and save some of this metadata for auditing later. And it's also used in conjunction with, you know, what I mentioned of trying to make signing and verification a little bit easier across organizations and teams by another project called Fulcio, which is a web based, you know, PKI, which allows, you know, using OIDC to generate. Sometimes this is also referred to as keyless, but what's happening underneath the covers is Fulcio has, you know, a root CA or root certificate and, you know, it is using OIDC to verify the identity of the person doing, you know, providing the signatures and then looking, you know, based on that, it will generate temporary keys, sign and record that in the transparency log and record, which can be then later audited, right?  So those are the three tools to think, to kind of investigate and look at. We look mostly at cosine in what we are going to do today, but, you know, the cosine, record and Fulcio all work together to solve some of these problems at scale. So that was the second topic I wanted to introduce, right?  And what can you do today? So I'm going to briefly meant, you know, just introduce Kivirno for those folks who may not be aware of it or what it does. So Kivirno is a policy engine. It's a CNCF project which is a policy engine for Kubernetes. So it's a similar in function to, oops, shut that. So it's similar in function to what you could do, you know, with OPA gatekeeper, except it doesn't require writing and managing policies in rego. It uses, you know, Kubernetes custom resources for policies itself and it will, you know, policy results, et cetera, are also available as Kubernetes resources. So just briefly, very briefly looking at how Kivirno works. It acts as a web book based mutating and validating admission controller. So what that means is every API request in Kubernetes can be passed to Kivirno and based on your configured set of policies. Kivirno will then either allow, deny, or it can also mutate. It can generate based on certain things in the API request, which you use as triggers. It can generate other resources for your cluster itself. So several, the several use cases, I mean, the basics use of Kivirno, of course, as for enforcing pod security or enforcing workload security, making sure that your namespaces are configured correctly, just managing configuration security in general. Even simple things like, for example, if you want to make sure this example is saying that every pod and Kivirno, by the way, automatically applies policies which are, you know, written for pods, it can, you know, map those to pod controllers. So every pod, you know, independently of how it's created, here, this policy is requiring a specific label, right? So very simple way to manage and, you know, enforce policies for your cluster and simplify, you know, some of the complexity of managing Kubernetes configurations. So let's talk about, you know, what Kivirno can do, and how it works with, you know, Cosign, as well as, you know, some of the other tools we talked about, right? So what I'm going to do, and here we'll, I'm going to go back to my image, which is just, you know, this pause to, there's a single version, it's latest. And in my, you know, as we kind of, and let me pull up my shell. So if I look over here, you know, I have basically a cluster running locally, it's a mini cube cluster, it has Kivirno. And if I do get C-Poll, which is cluster policies, there's no policies installed, right? So if I, you know, let's say do kubectl, and let's just try run, I'm going to run that image from that. And if we do kubectl, you know, get pods, we should see, we have that pod running, and there's no checks, nothing happening right now, right? So basically, we're just allowing everything into our cluster.  So I think I ran it in default. So we'll just do, you know, we'll delete that one pod, and we'll go back, right? So at this point, what can I do to start signing my image? So the first thing I would do is here, you know, if I look at, in my repo itself, what I've done is using cosine, and the first command you can use on the cosine command, command line is just to create a public-private key pair, right? So I've used generate key pair. I have a couple of different key pairs, and I'll show how I'm using that in signing, because you could, you might have, you know, multiple signatures associated to a single image. And you can then have key rental policies, which we'll, you know, quickly look at, which you can then use to verify or check those. So I've already generated a key pair, and that's, you know, if I look over here, that's in cosine.key, cosine.pubs, this is my public private key. And I have some other yamls, which we'll come back and look at later. But what I want to do now is I want to sign my image, and I want to see what cosine does when I sign that image itself, right?  And in this case, you know, we're going to use, I don't want to sign it first with the, so I have another public-private key pair in under keys, but I'm just going to first sign it with, you know, the key in this folder itself.  So let's go back to the git repo and see what happened over there. So if I go and refresh this screen, I see something else showed up, right? So previously, that was just latest, but now it's showing me that there's a signature which ends with dot sig, and it's got this big, you know, sort of stream, which is this is actually the digest, and it's telling me that, look, there's a signature which got attached into this. Now, I can verify the signature with, you know, basically, if I want, with cosine itself, but what I want to show is how do you verify this with the Kivorno policy, right? So I'm going to use this policy here, which, you know, is checking, and right now this policy is checking from multiple keys. So basically what this policy is doing is it's, you know, looking at, and if we kind of start from the top, it's the policy name is checked image, it's saying that if there's a failure, it wants to enforce. So Kivorno supports two different modes. It can either audit, so it will just, you know, create a policy report, but it won't enforce that, or it can enforce the configuration, in which case you have, you know, it'll block that container from getting deployed. It also, it's saying that don't run this in the background. I just want to run this on the webbook. It's configuring the webbook timeout as 30 seconds, because we are going and calling, you know, we will check the signature from the registry. It's saying that if this policy webbook fails, it's going to fail closed, right? So it's not going to allow images or things to go by if this webbook doesn't respond for any reason. And then here it's saying if you see a pod, make sure that every pod is signed by two keys. But I don't want to, we don't, we just signed it with one key. So what I'm going to go and I'm going to comment this out. We're going to, we don't want it to sign with two keys right now. We'll just start with one and we'll apply this policy. So let's go back to our shell.  And from here, I have the policy which is check images.yaml. And I'm going to, you know, just create that policy. And if I do get cpaul, I'll see it's here. If I do minus or yaml, it should show me that policy. By the way, Kiverno again, like automatically by default, it will create, you know, that policy for the standard pod controllers. You can manage this, you can turn this off if you don't want that and just apply it at the pod level. But that's kind of what we're seeing over here, right? So this policy is now configured. So what we can do is, you know, it's actually what I should have shown is maybe let's do that. Let's go ahead and delete that signature just for a test and see what happens if I try to, you know, deploy that same image without, you know, with this policy configured now. And, you know, without the signature being present, right? So I'll go back and, you know, try to run that same image which we had.  And we have this policy in place, which is saying that don't allow this to run. So and it's saying as expected, it checked for the signature and said it's not found. So let's go ahead and sign it again using the cosine sign command. We'll use the same key and we'll push the signature back into our repo. And once that's done, if I run pause too, I'm expecting at this point that, you know, the pod gets created, which it did. And, you know, it should automatically also, one other interesting thing to point out is once it, you know, once the signature is verified, what Kivarno will do is it will also, you know, in the pod YAML, it will replace the actual tag with the digest. And what this does is if we just grab for image just to show you what I'm talking about. When I ran the command, I just gave it the tag and by default, of course, it goes into latest. But here, as you see, what Kivarno did is once it verified the signature, it replaced that tag, which is mutable, with the immutable digest. And that also, you know, kind of, that is important because otherwise you have a window in which somebody could potentially, if there's a sophisticated enough attacker, they could potentially either replace the digest or, you know, if you're just pulled by tag, your image, you know, they could masquerade some other container image as an image with that, you know, tag itself, right? But once you use the digest, any time that container is pulled, you're guaranteed to get that exact same image from your OCI registry. There's been a few questions from the audience, and this would be a good moment to take, if you want them at least. Okay. So from Fendi Yusuf, there's, how did the signed artifact propagate the GitHub? Did you do a push? Cosign automatically pushes that signature. So by default, the Cosign assumes that the registry, where the image is, is also where you want to push your signatures. There is an option, you can specify a different registry if you want to manage your signatures in a central registry or, you know, any other repo you can. But by default, Cosign will assume that it's, you know, going to be pushed into that same registry. There's also an option in Cosign, and this again speaks to its flexibility to create a local signature, right? If you don't want to push it anywhere. But by default, it will push it back into that same OCI registry where the image is. Great. Then by Byguy86 again, thank you so much for multiple comments and questions. Can you please share the repo with the list and commands? I will, can you share it after the presentation at some point or? Oh, okay. So the, sorry, the request was to share the repo or to share the actual commands that I'm going through year two? Well, if Byguy has any, any specifications, please let us know. But I would imagine that it's the command. Both, okay, he says both. Okay. Yeah, we'll do. And certainly feel free to reach out. You know, I'm just jambigoladio on the Kubernetes and CNCF Slack. So reach out and I'm also, you can find me on the Kivirno Slack channel.  And then the last question that was a bit wild ago already, but we were so deep in the demo and I want to interrupt from Pat Moka, how do employees receive keys in our organization? Is it solved? So the question was, how do we manage? Yeah. And that was, that was around when we were talking about cosine as well as cells. Right. Yeah. No, that's a good question. Right. So if you are using, so you're today, what I'm going to demo is just using public, private keys. So, and it does become difficult to manage keys at scale. So this is what Filsio and Recor are solving by, you know, by removing by this keyless option of signing, which is very cool, because you can just, with your OIDC identity, you can, you know, once you authenticate with your preferred OIDC server or your identity management tool, it will generate temporary keys to do the signature. And then cosine will check the transparency log to make sure that the, both from a timestamp point of view and from, you know, the fact that there was a valid identity that matched those keys that's available. So that is, you know, those are marked as experimental features, but soon to be production ready. And we will, you know, we can do more demos and we'll have more coverage of that. And Kivarno will of course also support this as soon as it's, you know, ready to be available. And that will reduce the burden of managing keys, of course, in a larger organization. But, but you could also, one other thing you can potentially do is you can today with, you know, things like GitHub secrets and other secret managers or PKI or other, you know, KMS type of infrastructure, you can still at least start with a central key, but then you have to manage and rotate that and, of course, protect your keys, which becomes important. Perfect. Thank you so much for the comments and questions that keep them coming if there's any, any more. But yeah, we can continue with the, with the scheduled programming as well. Okay. Yeah, so so far, just to kind of quickly recap what we have done is we saw that, you know, we were able to basically apply, you know, policy, we signed an image, we verified that without the, you know, without the signature, the image was blocked. And then with the signature now, you know, we are able to run that image, right? So if you recall, what I also did is I kind of commented out the need for multiple signatures. So I'm going to go and undo that. And we're going to require multiple signatures now for this particular image. So by the way, just to kind of also show very quickly here, the first rule here is saying by star. So it's saying for every image must be signed with the first key, but then it's saying that only images in a particular repo are signed with the next key. Right. So you could, if you're kind of thinking of an organizational structure, you could manage your keys in that manner where you have a central key, which requires to say, okay, these, all of these images are coming out from my orgs. And then you could have also as group specific key. And you can, with Kiverno policies, you can match this to any namespace. So you could split this into two policies, one could be namespace based, what the other could be cluster wide. So a lot of flexibility in how you want to organize and manage this for your teams and for your organization.  So I'm going to just go ahead and apply that. And then if we now try to, let's check and see if we still have those. I think the pod was running. So we'll delete it and we'll now try and run this again. Right. And what I'm expecting to see is this time it says that one of the images is, you know, one of the signatures is there, but the next one, it says, you know, it failed. And it's saying, look, it can't, you know, match the second signature. So it denied it again. So to fix that, what we can do and, you know, I'm going to now sign, we'll go back to cosine and we'll sign this image with the second signature, which with the second key, which was in this keys folder that I just happened to have over here. Right. So if I do, you know, kind of assign that again, run the cosine command. And if I check back in my registry, I'm not going to see here, I shouldn't see, you know, anything else. I'll just see still the signature because all of the signatures are captured and put in here. But if we try to run that image, what we should see is at this point, we can, you know, run the image because both signatures now are present in our, you know, pod itself. Right. So so far, so good. We've, you know, we've been able to now sign and verify the signatures. We've seen that we can do multiple signatures. But that's, you know, that's certainly a great starting point. And it's something that everybody, as you can see, it's not difficult to do. It should be something that everyone looks at, you know, adopting. But the next step would be, how do we get to those upper levels, the next level of the salsa framework? Right. And that's where it comes back to, you know, how do you now start producing the right metadata in your CI CD pipeline and, you know, start verifying that metadata as part of your policy set itself. Right. So you're, you know, one, one quick thing, let me just quickly show is if you let me see if I can find this, if you go to in total attestations, this is the definition I was kind of mentioning. This is, there's a standard work in progress. So and it references either a salsa provenance type or other types of attestations you could attach. Right. So here, this is the structure of a, you know, of a in total attestation. Again, an attestation is this sign metadata that you're inserting and uploading. And I'll show how you can do this with cosine. And what it, if you kind of look inside the payload, it could look this is coming. So by the way, there's another pro open source project that's, you know, I should mention. So tecton chains is doing a great job at producing a lot of these attestations and making sure that these are recorded and can be pushed and signed and pushed into either an OCI registry or into a transparency log, which can then be audited. Right. So here, like this is a more complex example of an attestation, some simpler examples, and we'll, you know, use something what actually we'll use this example is like, let's say I want to do a code review. And I have, I'm just here, they're using a custom attestation type, which is then saying that, you know, which kit repo and who are the authors of the code review and what it was able to do. So and another simple example is if I have some automated tests, and I want to create a signed attestation as from a builder, or my test executor, that's saying that, you know, this test has run and has passed for this particular image itself. Right. So let's, let's try that out and see how it works. So here, what I have is if I look at, I think, yeah, I have this review.json. So it's a very simple predicate and a predicate is part of a statement, which is part of a into auto attestation. So this is the inner body of what I'm going to actually check in my policy. And it's just saying that, hey, you know, as part of this repo, I'm going to, and this belongs to this particular URI, I'm checking it on the main branch. Let's say there's an author and then there's a reviewer. Right. And if I want to know if I want to kind of sign this with, you know, cosine, the command I would use is cosine attest, and I would give again my key, I'm giving a predicate, which is just json. I'm giving it an attestation type and I'm pushing it back into the same for the same image, which is the subject in this case. Right. So I'm going to go ahead and sign this and let's see what happens. So it's saying it's using this payload, and it's actually, you know, kind of deploying this up into our OCI registry. So if I go back to our registry now, and if you see, you know, if you look at that positive image, I see there's a .att file, which is also showed up. Right. And what that is, is it contains now the signed attestation. And you can have several of these. Right. So we'll just look at a simple example, which is verifying, you know, that that image has this particular attestation. So then what do you do with this? Or how do you, you know, how do you kind of verify this at admission controls? So let's look at, you know, this policy of which we will apply next. So if I have this Kivarno policy, which is saying check for a code review, the first thing it's doing, it's got a similar verify images, you know, block, which is checking, and it's saying, okay, if my image is coming from, you know, this particular repo, and it has this public key, then I'm expecting these attestations in it. And here, if you recall, the type of attestation we want is code review we want. And within that attestation, it's checking to make sure that, you know, that is coming from a particular GitHub repo. So the repo URI has to match, the branch has to match. And then the reviewers have to be in one of the set of reviewers, which are specified over here at the bottom, right? So here's Anna, Tim, and Bob, who are the allowed reviewers. Of course, if you're putting this in production, you might want to put this in a config map or make this a little bit more declarative where it can be expanded. But the basics of the policy now are, we want to check for this particular attestation when we are, you know, running this image. So let's apply that policy and see what happens, right? It should run because we've already signed and pushed that attestation. And just to prove that if we, you know, maybe we can change that attestation if you want to do something else and make sure that it fails, right? So we'll first go ahead and delete the pod we were running before. We'll apply this policy. So we want to do its check review is the policy. So now this policy is created. If I do my, just to verify that the policy is created and active, I'm just going to do get cluster policies. It shows that they're both set to enforce and they're both ready, right? So let's go ahead and create our pod again. And in this case, we're going to run this container. So now what should happen is we are, you know, we not only did we verify the signature, but we verified that attestation. Just to prove that this is actually, you know, this did something. Let's kind of change something. So let's go ahead and delete the pod first. And what I'll do is I'll edit this policy, you know, just in my cluster itself, right? So what we can do here is if I edit this policy and right now I have, you know, if I go look at who signed it, it was Bob who, you know, did the review. So let's remove, you know, Bob from this list and say, maybe, you know, Bob left our, you know, organization or group. So we're just removing that and updating our policy. So at this point, if we now run that particular image again, if we did this correctly, what should happen is it should check and say, hey, you know, the policy sign, but it did not pass this particular attestation because Bob's not on the reviewer list, right? Which is exactly what we see from this output and Kibirno was able to block that and reject the, you know, that image from running. So this is a simple, but yet powerful example of how flexible, you know, these tools can be and the power of cosine and using Kibirno together, how you can now start, you know, not just creating this metadata, again, Tecton or GitHub actions can be used to create some of this metadata. But then you can sign this metadata, push it into your OCI registries and start verifying this added mission controls to, you know, start achieving some of the requirements that we looked at in the salsa framework. So I know that was quite a lot, but that's what I wanted to cover in the demo. And hopefully, you know, I think this sort of all made sense as we look at it end to end. Yeah, for sure. Really great stuff. Thank you so much. There's been a few comments and a few questions as well. So we can get them now. So, so there was a kind of comments and two questions from a secret tech. He starts or he or she or they start. Thanks, Jim, for taking the time. Question one, what do you recommend as a guideline of private registry? EA, the standard set of Kibirno policy that we can apply be default based on security exposure. And then a question to how can we continue to existing projects to extend this? And please let us know if any project we can contribute to build a policy standard. Yes, a great, great set of questions, right? So, you know, so in terms of private registry, there's several good options, you know, of course, out there and those both commercial as well as open source. So I don't, you know, I'm not going to kind of name any particular ones, but most OCI and cosine, of course, has a list also of registries that they have tested with verified with. So if you go to the cosine get up page and just search for registries, there's a list public and private that they have, you know, validated with any OCI compliant registry should work in theory, but it's always good to check and make sure that it's been tested with. In terms of the set of, you know, Qverno policies. So Qverno, there is, if you go to the Qverno.io site, and I can quickly just share that again, there are a standard set of policies to start with. So if you go to Qverno.io, click on policies, there's about 80 or so best practice and, you know, other policies, of course, the basic to start with, if you're not running PSPs or some other way of managing pod security, definitely start with this pod security set, right, which implements the pod security standards and gives you, you know, some flexible ways of managing pod security. But then there's several and best practices you should look at and see what makes sense to deploy and manage. So it's a good set of policies to get started with. And then in terms of contributing to open source, Qverno is a CNCF project, SixTor, like I mentioned, is a Linux foundation project. Both have, you know, weekly community meetings. And there's several, you know, other, if you go to the community sites on both, they're very active and we welcome, of course, any form of contribution, feedback, or even just, you know, just your usage patterns or use cases, anything you might want to share. So, and both communities are very welcoming and open and seeking new contributors. So feel free to jump in. Perfect. Everyone jump in as fast as you can then.  And they are available as pointed in the chat already, which will help them on their Qverno presentation of the group 26. So perfect timing for this session, I think. And thank you so much for talking through these things. And then there was now a comment from Duke again. Moitation policies are pretty impressive. And he or she or they would love to hear more about them in the future. Yes. So certainly, we see a lot of interesting use cases emerging around both mutate as well as generate policies. So totally agree. We will, you know, we have some samples, but definitely can build will do more in terms of showing some of the some of the use cases and things developing around mutate and generate policies. Great. So we are getting to the end of our time. I have one question left. And then if there's anything else you can the audience can ask super quickly, but after we have to start wrapping up. So since there are so many projects and tools, thank you so much for the really great overview into the space. But it can get a bit confusing to people who are getting started. So what do you recommend to get started? Like what are the things that everyone should be doing? Right. Yeah, no, it is.  There's so many new names, new projects, new things to learn about. But just breaking it down into and look, if you go back to the salsa framework, look at that picture with shows and every for any software you have to, of course, build it in your CICD pipeline. And then you have to, you know, you're using OCI registries already. And then you want to verify some of this, right? So there are for that you cosine is certainly emerging as one of the key projects that you will want to get, you know, get familiar with within six store. Like I mentioned, full CEO and record are also very interesting projects. Definitely take a look at those and, you know, kind of what they can do. And then for admission controls, either a Kibirno or OPA gatekeeper about CNCF projects. I mean, I'm a Kibirno maintainer. So I did all of the demos with Kibirno. I see there was another question about, you know, if OPA can support this. So there is ongoing work and activity for OPA and gatekeeper to support it as well. So, you know, certainly, did some of the same similar validation and checks can be done there. It's a slightly different approach and the policies will look different. But the basics will be covered there. Perfect. So we've randomly answered the last question from the audience already. That's wonderful. And as noted in the little text there, I see, you can join the discussion at cloud native live CSDF Slack channel to continue the discussions. And I think Jim, you mentioned that you're happy to talk in Twitter and all of the other places as well. So please, if there's any questions, I think Jim is happy to take more discussions going further as well. But then now we've got to start wrapping things up. Thank you so much for Jim and thank you so much to the audience. Thank you so much for a lot of questions and comments. Really great to see so many here today. So thank you, everyone, for joining the latest episode of cloud native live. It was great to have Jim here talking about supplies, things, change security with Jose and Kibirno. Really great interactions. Thank you so much. And next week, we have Jalee Rosen presenting Introduction CubeScope, open source tool to test Kubernetes deployment. So really looking forward to that one next. Thank you, everyone, for joining us today and see you next week. Thanks, Anna. Thanks, everyone.


Everybody forced here ripping 2023 chrome jumbo baseball case number 11 random teams find the results anytime a late in sports cards calm Go ahead and get started here. I think it's it's seven or eight magic. I'm not quite sure Forgot what the checklist said it is seven or eight. It's four hits four autos or relics and or relics And then usually you'll get I'm not sure if the insert. I don't know if the answer is guaranteed I know it's not in like baseball bat or basketball football, but It should be about the same setup Usually usually how it shakes out to auto to relic and Then and then usually like three base and or parallels usually how it works out But I think all I said was for I think on the checklist said when I saw it earlier was just for hits essentially That's all I got. Yeah doors be opening out there. I don't know the white box at least but you know That's what I just said up there. I'm gonna play on the All right, y'all best of luck Technicolor Soto you've got a Titans of Scherzer and refractor a Rosarena. All right stowers. You've got a Cabrera Tovar on the insert Luba prison one of the white socks and refractor of a sale Garcia Alvarez base Walker base Magenta speckled to 350 is rhinoic man Rockies Prison rookie Ethan small brewers and refractor of Al Tube Astros Verlander back to the Stroze. He's only gone for a few months Astros is Bregman under a 88 there rookie base auto Josh Lester for the Tigers refractor Stevenson Guy Riley green future stars Titans of buchettes refractor Arunato So debating whether I want to rip a box of this or not myself. It's a gunner base Astros Tucker. Yeah Stroze of ALCS. Yeah, you can't count them out at all Them in the Rangers gonna have a nice little dog fight in the AL West It's like them in the Orioles right now really That are the ones you look at like, okay. Those are the probably the top three. Yeah They're the guaranteed playoff teams and then you're looking at like, okay. Well the admission theoretically go the farthest Prism buchette blue jays refractor Marquez Rockies Yeah, but I think you get to the postseason and it's like, okay.  Yeah, Jay is Jay is drooling right now. Oh My goodness Front fire to them a chance at a 399 McKenzie Gore for the Nationals Clayton Kershaw Titans Blue Jays could be a dark horse Yeah, they got good pitching for the most part and like they're just a solid team And especially picking up Jordan Hicks was probably the biggest thing for them for full pen help Springer Prism rookie Gunner Henderson. Nice. There you go. Oh Nice gunna. I'll be based now Yeah, I died. That's a that's a huge car. We're gonna get a card saying in a second here guys your stars Kirby Came back to pull the heat right here Blow us what blue ray wave Volpe listed for 599 Yeah, that's hey, you can get that for it. I would sell the the non true blue I'd probably do that for sure Or you could gamble and wait for his uh, hopefully hopefully did do better rather green Refractor rookie terrain brewers rookie base auto buddy Kennedy B. Backs a lot of refractors in this one out to vey and Jared Walsh There were a couple of boxes or a couple packs in there with just just an insert though, so It was that wasn't weird. That was just Weird coalition. Yeah, Jay's dark horse. I just wouldn't count on them They're like Recount them, but they have like the talent to where like that heart of the land I could carry them for a decent amount if they get hot and they have a couple of really good pitchers and Yeah They'd have to get hot is basically Acunia Titans Castillo refractor Four days ago. Yeah markets market shifts though. We're a week after release now Got Paraza 88 prism trout for the angels refractor will hop a for the angels batting average match Josh young 200 now Photo negative Rosario Padres prison murky waters for the Royals refractor Matt Olson Braves Maybe the Red Sox to make a push. I'm not out of it, but they're not in it. Yeah It was weird they started off the second half they start like super hot and I'm like, yeah Well, we can't really can't even beat the Asian Yeah Colonel's Goldschmidt, they're they're they're the definition of a team that'll beat up on the bad teams and lose the good teams Or the reverse beat the good teams and lose the bad teams That's the fun of tricky auto for the angels refractor terrain brewers That's actually what it is. Oh, we got daytime baseball Braves Angels This is live really And they restarted you we don't wow angels just got you we don't really well Got to wretzman future stars Titans wretzman refractor Marta one of earlier in the Red Sox. I Just a lot of money for him. What is it like a Is you got one year left on his dealer to he's got one year So what you guys present Reynolds for the pirates you guys pretty much have to eat like I think it was And like the Mets would have to eat 94 would have to eat pretty much the rest of that contract You guys eat 23 That's just not it's not terrible It's just not part of like what the Red Sox are doing like they've been like all their moves show like yeah We won't we're okay to win right now We're not gonna like break the bank to like went now go all in when we don't have the the core young pieces to do it, so I The Red Sox didn't do anything but that's not it's it's not a bad thing. I guess it's not Because you guys try to wear blaze Everyone that would be admirable from the Red Sox to get from them is young Like yeah, you could look like packs in they could have traded packs in yeah, right Okay, for key refractor out of the 499 for the Mariners Refractor Brian Reynolds It's not a lover. Hey thing is just what it is didn't do a lot. So it wasn't like a big risk Green magenta Anthony Volpe It's a 399 going out to the Yankees again Lex. You killed it Yeah, killed it 334 399 on the Volpe magenta Titans of Scherzer refractor JP Crawford Yeah, a lot of teams definitely Waiting on Shohei He says in LA Dodgers are angels. I think he's I think he's gonna be an LA next year Dodgers or angels. I feel like one of the Chicago team See the Cubs doing it got Tovar prism max freed for the Braves refractor Kershaw Dodgers Mets and Yankees will probably take a run out of for sure The usual suspects It did a good job with this this year deets Like I feel this is so much improved over last year Peter Starr is Bobby with junior prison rookie Jordan Walker Cardinals Good stuff refractor Fuginami rookie a's another sneaky pickups. He's got a lot of potential for the Orioles I feel like he was like that was one of the probably like the better bullpen arms to pick up Especially just coming over because he's still he's still trying to figure out himself ran rookie auto guardians. I agree with that refractor to Grom Rangers Yeah, man everything so Everything that has come out even with like top chrome soccer this year And I was talking to people at the Nat like a lot of That's one of the things I want to do is meet some people that did a lot of soccer and you know pick their brains on it Cuz I know we're starting to do more and more of that And everyone agreed that this year's Chrome was just so good And they did the same thing with baseball man. They just made it great Good designs not a crazy amount of parallels You know like value feels like it's really there the rookie class elevates that of course obviously like the box price You're going to have because the rookie class But hey, that's all they can do is make it nice, right? They can't control who the rookies are and they kind of can But yeah, I'm at Olson Titans of Soto refractor of Vargas Dodgers rookie now. I'm ready for a chrome galaxy Oh, baby. I'm ready for chrome galaxy Costs 88 prism Abrams Nationals refractor Castellanos Phillies. I might go to the late in gaming The next couple days and rip some of the 2022 galaxy Magenta speckled 350 Verlander Mets Prism rookie Herrera Cardinals refractor rookie Terrang Brewers I'm not sure. I guess I just got pushed back Unless you just got pushed back is pretty much it because they it was Yesterday was supposed to be presale and then they just said it'd be at a later date apologies for inconvenience, whatever it was. Yeah I'm guessing that's what happened is it got pushed back. I don't know though. I haven't heard anything. Okay. That's rich He might not know either though Got morale 88 cubs Bryce Harper Ultraviolet all stars auto Oh Phillies dude, that's so awesome. That is like the Philly chase in this. Is there rookies? The rookies aren't huge. That's beautiful. I love that man.  It's not number, but super short printed. I bet refractor McCarthy I'm actually gonna find out right now Let's see I want to find pack odds on that thing ultra Violet let's find it What's while it all stars auto so in hobby pack odds one in 13,972 hobby packs So a little fewer on the jumbo. I would assume but still Yeah, that's awesome man That's great. Congrats to the Phillies those are cool. I love those Obviously be fewer jumbo packs for sure, but still that's Oh, there's number 99. Sorry, it's very tough to see but I was holding like this. I couldn't see it It's literally top right. It's not 99. Come on There it is. There it is. Yeah, sorry about that. I'll get that a car Santa second Phillies 299 That's why I couldn't see it because it's off to see hard to see future stars seah Got Titans of Harper refractor of albies. That's sweet or paying attention on I mean it all ships Got a judge 88 prism Hanager for the Giants refractor Cabrion Hayes pirates But yeah, that's why that's one of the reasons the angels in the braves get a little price bump because that's your likely MVP buyback Right there your sheet of the color bucks then prism rookie Gonzalez for the guardians and refractor say Oscar They say it's a Oscar Hanna's like a tree The blue jays looking to get him rookie auto Matthew Liebert or going to the Cardinals Fractured Joe Ryan twins. But yeah, that was one of the re the one of the reasons the angels I mean, obviously the angels are gonna be expensive because they have trout not on him anyway But they get that a lecture price bump because likely MVP buyback there. So The base will be worth Defined amount is assuming it stands. Yeah, it'll be worth something Blue sonar J rod to 125 for the Mariners Nice card there J Ram Titans refractor Torque Carol base Rainow prism McMahon Rockies refractor photo variation rookie Mets Francisco Alvarez They congrats to the Mets. Yep short print photo variation That's fire. We'll mag that get in the one touch bull pay base Photo variation seem a little more common this year too, which I do I do like I do like it might So you can now kind of pinpoint it out. I might overall devalue slightly, but I don't think it's not even that much more It just feels like a little more Hey, another Walker prism Cartel's doing pretty well here And then a side rookie refractor for the Cubs Yeah, we got to find some marlins for your deeds Got to find some Marlins Get a jazz Red jash Chisholm Aqua wave rookie auto is Luis Leigh Barato to 199 for the Padres and a Josh young photo variation same box Holy cow That's that's that's pretty nuts big congrats to Texas That box on how the Harper in it or is our previous Yeah, it seems like one box a case has like a low number really cool parallel and like a cool auto At least in jumbo. I haven't ripped any hobby yet Volpe and Carol Prism Alexis Diaz reds refractor Reynolds Influencer box. Hope it's every case. How can it be an influencer box? I Wish I was an influencer. I want to make that influencer money And that whole term is so funny Goldsmith there Titans of Acunia rookie base auto Tommy Henry Diamondbacks refractor morale Cubs rookie see a nice color coming y'all Orange wave is a true Rasmussen going to the Rays at 25 17 to 25 Titans of Rushman refractor Castillo How do I become an influencer? Let me that sounds like good money Mariners Luis Castillo prison rookie drew waters for the Royals got refractor rookie Josh young for the Rangers I got some city and soccer score football coming up in a bit. We got spots left release day for both of those products Josh young Future stars gunner got prism rookie Grove for the Dodgers And Acuna refractor nice assuming he wins MVP. That'll be a good one I Wanted to do buy that for the super It's the fun it's purple speckle rookie auto to 299 go to the angels refractor O'Neill cruise Yeah, I'm not gonna do that That's just nonsense that's all that is that's like the the dude that the guy all the wrong eat But it turns out he's on steroids the whole time. Yeah, it's nonsense Liver King. Yeah, liver King Jose Ramirez refractor of Bieber for the Guardians. Just don't do crazy things.   You don't want to go to everything got your sheet of not a good name either But are they gonna rookie Garrett Mitchell for the Brewers? Prism rookie Prato Royals and refractor rookie Freeman Guardians Nice little pack there a Pete on the 88 Blue record rookie refractor auto to 150 stone Garrett nationals Fracture Sean Murphy Braves. They're saying LeBron's kid. It's on the woods. It's the first they put on him That's true. Who's saying that? We when you say they who do you mean? You just mean like general lunatics on the internet Stephen Kwan future stars refractor rookie is Waldechuk Raza on the 88 Yankees. You've got prism rookie Pasquantino Royals refractor Bobby with junior Royals Yeah, I keep waiting for his car to go Bobby way, but it's not really going up. Yeah, it's really strange. He's doing really well. I Got like a purple Cromberg yard. I probably just sell it all it's still in that redemption like stickered thing It's been waiting I keep looking I saw one cell furniture like That's a little too low Obviously, I'm not expecting like When the stuff released prices, that's just crazy because he's been really good But he hasn't been like otherworldly. Well Gunner Jordan Alvarez and refractor of a sale Garcia.  Oh, the stats are good But you don't see him like Winning games we didn't walk off some things like that Xander 88's prison Bregman Astros were here fractured Iran Rangers. I see what you're saying now Gold wave Ricky Cal Mitchell pirates numbered 43 of 50 We'll wave Cal got prism Soto Padres and refractor of wander for the rays I'm gonna could I could that legitimately could be if he's on steroids Stowers Riley base rookie auto wheel Brennan Guardians Fractured trade Turner Phillies Well, Brandon might be the most common auto in this set Alvarez Walker Got a Melendez future stars Titans of Soto for the Padres and a refractor. Nope. That's not a refractor. That's a photo variation of Bryce Harper Holding up NLCS MVP or just the NLCS trophy. I don't can't I can't tell National League Championship Series MVP. Yeah, there it is good. Good job camera zoom great job Good stuff Phillies At least killed it dude again. They're they're a top team to get in the random As you're chasing some hard to hit cards like the two that you hit in this case Tristan Costas 88 whoops prism of Scherzer rookie refractor of Alvarez Francisco Alvarez Alrighty I hope you all having a great afternoon here It's right 1240. Where is the time going? Got prism Alexi Diaz for the Reds refractor Soto Padres So Tyler Gilbert's really good again. I take it got gunner based rookie says they they won his last five starts Got morale 88 circuit refractor auto serving Rockies the 499 and Holy Roger you guys refractor going out to the There's a right here well thumbnail on the J-Rod maritals to get your boxer rapper and try to get that replaced Definitely a solid card rookie cup refractor Second year cool photo of the J-Rod to why does nothing my phone keeps like lighting up and nothing pops up Casa space Wow green wave Adley Ruchman oh 64 of 99 Baltimore. I think we're on fire. Yeah, we are I think we're on fire today So I don't know what that smell was I thought I thought someone burnt a bagel Baltimore big congrats look at that beauty green wave Adley Ruchman great case again back-to-back great cases here Let's see this goes to Caleb Caleb N Grats congrats Titans of Harper fracter while the Chuck Dude Shrevda the previous case was along the same lines of this too Right along the same lines of this one. I think this one's better like a little better Yeah Judge yeah prism rookie is around the rays refractor miggy Influencer case I'm telling you man. Tell me how to be an influencer make all that money. I'll do it I'm in hi. Is it does it a lot of work? It seems like less work than Than a lot of things got future stars O'Neill cruise Got prism a clan of handrails. I'm just kidding. I really don't I really wouldn't want to do that rookie refractor Perez White Sox as Volpe is big Volpe's in the in the higher up three figures. I Would guess Jay Ram 88 we got rookie base out of Bryce Johnson for the Giants Rookie base cheater downs Let me see. I'll get the green wave up here, too run out of stands We like the rookies. We'll keep the rookies up here.  I can do that. I can do that. I can be like a positive like reinforcement like Brustle sprouts broccoli asparagus Yeah, you've been hitting nice cards in random teams case. You're definitely doing well Alvarez Walker Walker Texas Ranger Kyle likes the Walker Texas Ranger theme song got Harper Titans refractor Austin Hayes. That's a cool photo. Yeah, what's up, Josh? Yeah, we did do it. Josh the results are posted to the site and the Random is uploaded to YouTube. We did at the start of the stream today judge on the 88 we got Prism contraris cardinals refractor yellow spruers Okay, okay, we're getting down to it guys few boxes left photo negative Bellinger Cubs He's swinging the bat well Prism beaver guardians. You see the beaver was riding his bike through the neighborhood. That was that dude. Could you imagine? He's just ride his bike. It was like a viral video going around He was riding his bike through the neighborhood and just join us like look this is like kids pick up game And we're just like swinging the bad and I took pictures with them and stuff.  I would that would never happen to me Jay Ram, you've got a purple rookie auto color match here. Michael totally to 250 Rockies Why is it about a good couple cases actually? I'm telling you like they're like a sneaky good team like yeah It might not be the sexiest team, but they got value. This is all their hits Plus tovar is good tovars legitimately a good a good ball player There's a gunner base. You've got a feature stars Abrams You've got a Titans of Jay Ram and a refractor of steer You guys I believe Matt is sold out over on channel So he's got chrome PYT's reppin though if you want to see Matt rev some chrome We've got finest up next which is sold out We've got obsidian coming up in a bit 11 to go on case to obsidian soccer brand new release today 20 spots a few combo spots in there Moreno rookie prism of Freeman for the Guardians Mullins refractor Orioles We've got newly released score football today as well Random team six boxer at nine to go not a lot of spots up today y'all Appreciate you joining as always Technicolor judge Prism Jimenez guardians refractor half cubs. Yeah, hope is the hit of the day so far Pete on the 88 tricky auto Freddy for mean for the For the Royals in a Kodai Senga rookie refractor Mets got Adley base Harris Torkelson Magenta Tigers number to 399 got Titans of Acunia refractor La Mayhew and then Well, they a Luis and hella Cunha went to the um the Mets to write The Mets the Mets did really well they had eat some of the contracts Well, they did well I think that prism of soda for the Padres refractor Jimenez guardians I feel like they pulled the smart Yeah, for sure because those guys are probably retiring. Yeah, that's the whole thing is they're older Yeah, they're still really good, but they're older, but they're not like he'll eat you still hunter green future stars Prism can Fordo Giants refractor ikitobar Rockies have a tough one Matt, but Have you haven't been able to find any other museum collection harpers that have sold ten? I mean it's definitely three figures I just I don't know the player like him I don't know Goldschmidt's gold Nolan Gorman Rookie Otto That is sharp a true gold 36 a 50 st. Louis Cardinals Good break for you to your two prism walkers now a gold Gorman. That'll look fantastic in a one-touch Don congrats Don love to see it in a Murphy refractor man Paulie's hits make me home Maybe Rocco's birthday cake will show up to the shop soon Even though Rocco won't be at the shop soon Yeah, this break has been awesome. Is it I was gonna ask like is this the first double case the first two double case I've ripped have been really good. I'm just curious if this is how normally goes or if I just brought the heat brought the heat back from Chicago He just smashed his cake. Oh Rocco He got a Freddie Freeman rookie prison blue day a's refractor Stefana tricky for the angels Yeah, I've rise to sign a little bit less Yeah, specifically with like an exact like within the $10 within, you know, 15 20 buck range I could not name a comp for a Harper like that though All I know is last year helped his values quite a bit actually Like that stuff and even old even older stuff rather green 88 rookie base auto Rosario for the Padres and refractor big show Big show that'll be nice assuming he wins American League MVP with that buyback all over the place Rocco is going through his Hulk phase Where he doesn't he's like getting stronger, but doesn't quite realize it yet and doesn't understand the content of like messes and like breaking things Aqua Lava to 199 boom for the Phillies Trout Titans refractor on Muto. Maybe Rocco should just be the Hulk for Halloween They wouldn't be David Bowie for Halloween Gotta get some big hair though. Got prism Varshow blue Jays refractor by as tigers forming base Future stars out Thomas prism Rafi Devers. There he is. There he is. That's my guy refractor Castellanos Driving a deep left Mm-hmm Josh Jung 88 purple rookie auto G Juan Bay pirates at 250 pirates on a solbury solbury pirates another team with some Some rookies get refractor Votto Rocco's already won. That's crazy. It's gonna happen every year at the National Oh, Rocco's birthday again Like a hair set in color Titans Bichette refractor Max Meyer rookie going to the Marlins Trying to get some nicer Marlins for for Deets So Sam Aka I think a sports cards a ka. I don't know any of the nicknames number one of the trash list. Yeah, aka got prism trout Angels refractor Zach Wheeler Phillies Holly rushman Harris Rizzo purple speckle Acuna it's at 299 Atlanta That's good stuff right there Prism arise Marlins and refractor rookie Piguero pirates So again, just two breaks left daytime. I'll get you a link after this box here You got obsidian soccer and score football. We've got much more breaks than I with Sam on the main channel here Personals at nights with Kyle on channel to Gorman 88 purple speckle rookie auto Anderson Espinoza to 299 Padres He must not have base because that's the first time I've seen of him in this Anderson Espinoza Okay refractor Diel Hall Orioles Warning track homerun trot coming up got Yoshida warning track flyout homerun trot Holy Roger you get to start still the funniest clip I think I've ever seen a baseball fields when he climbs the wall and it lands like 10 feet in front, dude. I Love that clip. It's like Kershaw Refractor Hunter Green. I love that clip. It's so good. All right guys Last pack of box 7 we got box 8 coming up next I think we got one more monster coming in at least one more monster coming in this case. We just had a great case That's the burnt bagel still got George Springer It's hopefully a prison rookie Rockies and refractor gallon. Alrighty Get some more card stands out here keep pulling all this all these monsters. I'm excited for the finest case I'm gonna find this case give me some heat. Okay. Make sure you guys if you have iOS download the fanatics live app I'll be listening some breaks for the next couple of days on there You don't want to check that out bull pay There's some jumbo PYT's actually Astros are your don Kershaw refractor rookie short friends No, just refractor von Grissom refractor Chris Bryant Rockies Their faces like more blown up That's how it should be notice that how it should it's less of like a baseball action. Yeah, it's more of a face George Springer 88 prism Salvi Perez Royals all Sam said was hello Yeah, he said nothing and dropped the mic Said he got handed the mic and just dropped the mic purple speckled Tim Anderson white socks the 299 Fractor burns brewers and refractor Diaz Reds That's a bit weird you didn't want to get traded rather green 88 Rookie refractor auto Justin Steele the 499 Cubs anybody had a blue refractor steel auto and say blue steel and Zoolander refractor Shohei So hey That's how they say it Josh Jung Future stars Royce Lewis Titans of trouts refractor Ricky Cavalli Nats code I sing The last remaining picture on the book that's for patient pretty much. Yeah, man Vladdy got prism hunter green Reds and refractor of Mitch Hannigar Because I think it's like now calls Carrasco, Jose Quintana and him are the third and he's the ace. Oh boy Prism Chris Sale Red Sox Prism Musgrove refractor Crawford Organization thinking oh, yeah, I'm gonna be the rookie and he ended up becoming the ace in less than a couple months. Oh Man, look at these all-time pitchers right over here Josh Jung 88 for the Rangers base rookie auto Josh Smith for the Rangers and a base refractor rookie the L Hall Orioles Very Roddy Kukuchi Gray Rock gets it together. The Orioles are gonna be unstoppable. Oh, yeah They won't lose I mean anybody can lose any time. It's baseball. You can go cold. Just that's it It's one that a guy and rookie Nick Eden Aqua Royals Titans Jordan refractor Moreno d-backs repacks left We need like a two-minute warning like sound effect or something like last box of the break Prism Devers Red Sox refractor trade Turner Phillies All right future stars Francisco Alvarez prism Stephenson Reds refractor Longoria Diamondbacks still feels weird Last one. I think we have an auto or just a parallel. I can't remember you pull all the autos yet in this one gunner Sorry, we have an auto it's Ricky base auto of Louis Varland's twins Interfractor of albies Okay, give me a sack everybody. We got a recap to do recap time This Matt is not I was new Matt. Oh, yeah Like a lot So fresh and so fresh I was cool seeing that big boys at the Him and sleepy brown performed. Oh, that's pretty cool. It's pretty cool, man. I Mean, it's no hundred two thousand, but I don't know Okay, we had a fun break here the photo variation of Harper for the Phillies autos Varland Josh Smith eggy Rosario Freddie for mean Bryce Johnson will Brennan Tommy Henry Matthew Libretor will Brennan Spanish buddy Kennedy John Lester said John Lester Josh Lester. It's gonna be so hard to not say John Lester All right refractors of Justin Steele Brian servant and Brian O'Keefe purple speckle Stefanich Espinoza true purple G Juan Bay and Michael Tuglia with the color match off away Louise Liberato true blue stone Garrett stone Garrett That's just the coolest name in the rookie class right there Photo variation rookie Josh Jung and Francisco Alvarez The Bryce Harper ultraviolet all-stars auto to 99 Phillies 11 of 99 up here top right very tough to see Big congrats to the Phillies. We got gold rookie Otto Gorman Cardinals Greenway rookie Ali Ruchman Royals Orioles to 99 and a blue ray wave rookie Otto New York Yankees Anthony Volpe 124 of 150 That will do what a case we got finest coming up next. Thanks everybody


Hi, and welcome to our session. Let us discuss the following question. The question says the line through the points h3 and 4 1 intersects line 7x minus 9y minus 19 is equal to 0 at right angle. Find the value of h. Let's now begin with the solution. In this question, we will first find the slope of line passing through points h3 and 4 1. Since this line intersects the line 7x minus 9y minus 19 is equal to 0 at right angle, therefore, by using the result, that product of slopes of two perpendicular lines is minus 1. We will find the value of h. So let's first find the slope of line passing through. We know that passing through points x1, y1, and x2, y2 is y2 minus y1 upon x2 minus x1. Now here, x1, y1 is h3, and x2, y2 is 4 1. So slope of line passing through h3 and 4 1 is 1 minus 3 upon 4 minus h. This is equal to minus 2 upon 4 minus h. So m1, that is slope of line passing through h3 and 4 1 is minus 2 by 4 minus h. Now we will find the slope of second line, that is 7x minus 9y minus 19 is equal to 0. Now 7x minus 9y minus 19 is equal to 0 implies minus 9y is equal to minus 7x plus 19. This implies y is equal to 7 by 9x minus 19 by 9. Now this equation is of the form y is equal to mx plus c. On comparing this equation with y is equal to mx plus c, we find that m is equal to 7 by 9. So slope of line 7x minus 9y minus 19 is equal to 0 is 7 by 9. So m2 is equal to 7 by 9. m1 into m2 is equal to minus 1 as lines are perpendicular. Now substitute the value of m1 and m2. m1 is equal to minus 2 by 4 minus h into m2 is 7 by 9. Now this implies minus 14 upon 4 minus h into 9 is equal to minus 1. This implies 14 upon 36 minus 9h is equal to 1. This implies 14 is equal to 36 minus 9h. This implies 9h is equal to 36 minus 14. This implies 9h is equal to 22. This implies h is equal to 22 by 9. Hence the required value of h is 22 by 9. This concludes the session. Bye and take care.


Hey guys, I'm going to take you through another vegan day of eating and to get started, before any of you guys think I'm wearing makeup, we have to do a little bit of a makeup check because this isn't makeup guys, this is what a plant-based diet does for your skin. See? No makeup. So the first thing I love doing every day is getting started with some lemon water. If you guys haven't tried this, it's amazing. It's so cleansing and alkalizing, at least that's what my homeopathic doctor told me. I mean, aren't lemons acidic? And you know, my dentist was saying my tooth enamel hasn't been doing so well since I've been on this vegan diet, but what does he know? Oh my god, it's so refreshing. I love this diet. So I love exercising in the morning. I feel like I'm burning off all the excess carbs and, you know, food from the night before just really kind of improves my mood and gets me energized for the rest of the day. But we need to fuel our bodies for intense workouts. And the best way to do that is with carbs and particularly carbs that humans are meant to eat, like fruit. And here I have two liters of orange juice, but this orange juice isn't that sweet. So what I like to do is I like to add raw, natural cane sugar.  There's nothing wrong with natural sugar. I mean, it all gets sent to the liver and has to be processed as glucose and fructose. But since you're getting, you know, a little bit of vitamin C in with all the sugar, it's perfectly fine. So I'm going to take this out on my run with me and I'll see you guys back for breakfast. I just got back from my run and I am starving. So I'm going to show you guys my favorite morning shake, how to get so many nutrients in your body as well as energy. So all we need is bananas, dates, flaxseed and kale. So this might seem like a lot of bananas, but this is our meal. And I like adding a few dates for more energy, just some natural, high quality sugars. You know, we're getting so much potassium, so many micronutrients, so much energy from the shake. And then I like to add some ice because I'm always craving ice as I'm anemic from my vegan diet. Just in case this shake was looking a little good, we got to add some kale, not only to ruin the taste, but what we want to do is we want to add a bunch of oxalates and goitrogens to inhibit some nutrient absorption as well as ruin the taste of the shake. So be sure to load your shake up with some kale. I almost forgot, don't forget your flaxseeds for omega-3. Alright guys, I'm going to go enjoy this shake, that's about half the size of my torso and I'll see you guys for my next meal. The nice thing about flaxseeds is that they're so cheap, I can use them to feed the birds outside too. Usually when I'm drinking my morning shake, whatever I'm doing, I'll sit outside and feed some to the birds. So I finished my shake and while I was editing some videos I got a little hungry, so I just want to show you guys a quick and easy snack that's delicious, it's healthy for you. It's these natural dates, just really good fiber, small amounts of minerals, micronutrients and here I have some natural raw cashew butter that I got. So all I do is I dip the date in the butter and it's delicious. I mean, I have pure dried sugar and inflammatory omega-6 fats, what could be better as a snack? Guys, one thing I love about a vegan diet is how natural and delicious everything is. So it's been about an hour and I'm going to show you guys my favorite bowl. We're going to have some oats, so here I just have some rolled oats organic from Whole Foods and I'm going to add some milk and not regular milk, I mean, unless you're into that, but I'm plant-based, I don't eat cow's milk, I use coconut milk. So just some coconut milk and now, I mean, this is delicious but I love adding just a little bit of maple syrup for some sweetness. Natural sugars, they're good for you.  Look at that, guys. It's almost as beautiful as I am. I'm going to go feed this to my horse buckwheat outside. I'm so hungry, guys. I was like hangry almost.  So I have some toast here, some natural organic white bread and this is an avocado that I had flown in from halfway across the world because it's better for the environment than a cow eating grass in my backyard. And, guys, I love avocados so much. I only add just a little bit of black pepper, just a little bit and then just a little bit of salt and then it's delicious, guys. It's amazing. See, guys, how good does that look? And this is the bread I use, guys. It's organic. It only has wheat flour, water, cane sugar, soybean oil, organic molasses, cultured wheat, organic weeper and organic potato flour, enzymes, the scorpic acid, citric acid, organic soil acid. See? All organic. It's amazing for you. Oh, and if you want to add turmeric to this, it's great because you have black pepper on it and black pepper helps activate the turmeric, which is an amazing cancer fighter. Okay, guys, I'm starving. I couldn't wait for dinner. I feel like I've eaten nothing all day and we're going to have some pasta for dinner. I love pasta, just like I love eating smoothie bowls and sugar and desserts and I feel like I'm eating like a kid again. I really love this diet. So I just want to make a quick pasta sauce. It's really easy. It's really natural. It's super amazing. So first you just need some cashew butter that requires a grinder and a mortar because the seeds are so hard to grind that it takes thousands and thousands of man hours to engineer a machine that can actually grind the nuts into something edible. So now we have this cashew butter and to that cashew butter, we just need a few ingredients.  And that's it, guys. It's delicious. It's easy. It's quick. It's simple. And if you're vegan and you don't add garlic and onion powder to every single recipe you're doing, you're doing it wrong. Oh, I almost forgot. Don't forget to add some liquid coconut aminos to add some more sweetness. That's it, guys. That's my amazing pasta sauce recipe. If you guys want to see how this pasta meal turned out, subscribe and check my Instagram story later today. Hey, guys, this is one of my many workouts of the day. And ever since I've been a vegan, my bowel movements are so smooth. I just have like five to six amazingly smooth bowel movements per day. And it just goes to show how good my digestion is. And I mean, almost everything is coming out the way it came in. So, I mean, isn't that a good thing? And my farts don't smell at all. I mean, I might fart like a lot more than I used to, but I don't really think they smell. They smell good.  But I think it's a good thing.  I get to kind of like sit in the squat position, work on some, you know, pelvic muscles. I think overall, being a vegan and with the amount of bowel movements we have and the amount of time we spend in the bathroom, on the toilet, in the kitchen, I know we're working muscles that we, you know, we're so sedentary now that we're working muscles that usually don't get worked. I think it's a big part about getting back to our natural selves. I actually, I started my own compost in my backyard because I had so much extra, you know, fecal matter. I was like, well, this is all going to waste. So why not grow some vegetables? And I've actually been able to supply the entire New York tri-state area with enough manure for about three years in just two months of being a vegan. I was about to go to bed, but I need chocolate. And I have this organic dark chocolate, 57% cacao from Whole Foods, 100% organic, 100% natural, only has 50 grams of sugar per bar. So nothing too crazy. I'm just going to have some of this before I go to bed. And I think it's well deserved after a long day of vegan dieting. So I've been tracking all my nutrients in chronometer. And even though I don't seem to be digesting this food at all on paper, I'm getting all the vitamins and minerals I need. I mean, even if I eat flax seeds and they come out as flax seeds, I'm definitely getting my omega-3s in, right? So thank you guys so much for watching. Please hit the subscribe button below. If you guys would like to support me, because I spent $100 on these plant foods. I don't know how people can afford to eat this way every day. It's completely ridiculous. But you guys enjoy the rest of your week.


Back to my channel if you knew my name is Akira Jenae and thanks for clicking on my video. So clearly by the title you see that I'm going to be reviewing this beautiful hair company called Nadula Hair. This is my first time with this hair company. So yeah, the box I'm going to start off with is very, very cute and on the back of the box you just have the tips to take care of this hair and then it tells you about Nadula Hair company itself. Okay, so you can order Nadula Hair from four different places. You can order it from their eBay account, their Amazon account, their official website or their early express little website. So I ordered my hair from their Amazon website and since I'm a prom student my shipping was extremely fast. It was only two days so I mean shipping was very good with this company and ordering off of Amazon. I've never ordered hair off of Amazon but I mean it worked out perfectly fine. It's beautiful. And the hair that I ordered was inches 16, 18, 20 and then I have a 12 inch closure and the hair was true to length so that's extremely good. My total for three bundles in a closure was $149.50 and then I did have a little promo code so that knocked off $2.99.  So yeah really, really good deal. It is a lot cheaper than some of the other hair companies that I've been with and I honestly can say that I'm kind of falling in love with the Nadula Hair honestly. So far so good like nothing bad about this hair at all. So moving on to what's actually inside the box of course will be your three bundles in a closure whatever you order. This is just what I have left over from my install and I didn't bleach this hair at all but I'll get into that.  I got lashes but I receive lashes, I see Sonam's receive flexi rods, I don't know what other little gifts they have but I mean anything is better than nothing right. So yeah I will start a clip of how the hair looked of course before I bleached it and right when I took it out the bag and everything like that but that's all you're getting your little box. So shedding with Nadula Hair is extremely minimum to none at all.  Since I do wear this ring though if I comb through it'll kind of get caught onto my ring sometimes but I mean as far as like bad shedding and then the hair getting tangled up at your neck from sweating and stuff like that I haven't experienced any of that yet so I mean I really like it and I've had this hair in for about two two and a half weeks I got it in for my birthday so yeah and let's move on to the color. I will insert clips of what I used I did go to Sally's and got the L'Oreal I want to say maybe like the highlight stuff it's a it's in a box I'll insert a picture because I honestly don't know what it's called and my longest bundle is 20 inches so don't mind my shorts it comes about you know all the way down there but I mean I really really like it and I've never rated a hair company a 10 out of 10 but job this hair right here honey like come on now come on now like come on and I didn't bleach it like I said I'm pretty sure it can take bleach though because I did do a strand test because I was thinking like do I want to bleach it or do I not want to bleach it but I did do a little strand test I can't find the strand but I mean it took it but I'm like I want to try to see if I can you know live hair without actually bleaching it and when I tell you I did this but yeah I really really like it and honestly like I said I've never rated a company a 10 out of 10 but Naduba might just have this like for the win so yeah if you have any other questions about this hair or anything about how I dyed the hair you can just comment down below like always and I will answer your questions to the best of my abilities and I will try to get a coupon code for you guys also if I get a coupon code for you and if I do then it'll be linked below and then I put it on the screen here if I do if not then I'm sure they have more coupons and back to school sales like that going on so yeah like always thank you so much for watching my videos don't forget to like comment and subscribe and until next time see ya