When I think about poverty and how much I went through poverty, I do not waste any resource that I get as a person. In fact, if a day of a hungry man should be a day of inspiration for him. So that time, I just thought to myself, man, just starting buying fast kwa second kwa third kwa tourist that is coming, we read about you. But it's now learnt that if I do a good job to tourist, not everybody is going to recommend me, but some, most of them will. But at that time I was doing one very important thing. I met every tourist before they left for the national parks, briefed them about their trip, and also met every tourist at the end of their trip and told them about where I've been, where I am, and where I'm going. So that one helped them buy into my vision. They buy into your vision. So we just added studies, buy boat, boat.  Then use a garage as my office. So I started taking off now. I was ready now to think about marriage because when I had enough money, I can look after a family. When I get married, of course, my wife, she used to come to me, sit there looking for money. So the company becomes like a very interesting place. So I moved, I moved, I moved to the smallest office on a big block of buildings. So I, I go there and I also somehow had favour of the landlord and the landlady. They were old couple. So I brought about 30% of their tenants, man. Yeah, so they loved me because of that. So after that they gave me the biggest of it on the block at almost no cost, $200 a month. And they said I must always pay $200 until he leaves but I also paid my fee, I could pay in a year. I was making good money now, you know. But then they started teaching me about property. So they tell me when you're young, don't struggle to buy land in the city.  No one cared at that time. When my, I believe me or not, for $2,000, I would buy three acres of land where today is $200,000. So I bought lots of land. I just bought land, bought land, bought land, bought land. Today, the very few young people that very few of my age did similar thinking, had similar thinking at the time. Now at that time, 20, 20, 16 years ago, if I did a trip and tourist paid me $10,000, I would make maybe 10 or 20%, maybe $2,000. I still today, if I charge the clients, I still actually, if I get $10,000 from the client, I get the same amount of money. But the value of $2,000 then could buy me what I would need to save now, very many safaris. But because I made the right decisions then, and I have a lot of value. I don't know where to gather that. So 2006, they advertised for people to be in Chivali National Park. Now, that time there was no Ugandan, I had picked courage to do this kind of thing. So I get a Ugandan friend who was living in Holland, I give him $5,000. And I say, man, write the proposal, call Joseph Miiti. He was very good at, he's still very good at writing proposals. He writes a very good proposal. Now, me, I'm competing with white fellows who have so much experience, but also knowledge. So we write, we got, so they took the top two, to the next stage financial, and financial they open when you bought them. So they take the top two. So we got 72, the second South African camp and got 70. And I go in the room, I'm putting on a jean, ton, dirty. I'm here sitting with the guys and authority at that time. And I'm here, these are Ugandans.  They start saying, offer this, you offer this. I'm totaling up. I total up and I realize I've won by two dollar difference. I couldn't believe what God had done. Two dollar difference. I hate that. Now everyone is hitting the table. The Ugandans are hitting the table that I've gotten it. They're angry that I've gotten it. The Caucasian guys are angry I've gotten it. I look at these two groups of people and I'm shocked. And I tell both of them guys, I have won. That was 12 January. I got the concession on 12 December. They had refused to give it December there. It took 12 months from the time I'd won for them to give me a paper. Now when they give me a paper they say it's going to fail. And many people say, not everybody but many people say you're going to fail. You can never build a road. This is something Caucasians do. I live in Kampala man. I've been saved up. At that time I'm 35 years old. Explain to my family, I'm supposed to have built a house when I was 35 but now there's an opportunity here. So you're not going to have a home. I build a home when I'm 38. I go and spend time on the ground. I first do an environmental assessment by January 2007 I finished. By August 15th I built a tentad camp. Not top end but it also has a whole story. I can write a book about that tentad camp. I give guys, I go and look for timber somewhere. Give a carpet and put a phone in the streets. The guys sold 180% of the timber man. It's written me on the 20%. I get on a bus to go and look for tents in Kenya because I did a tentad camp. I bought a bus overnight. I arrived in Nairobi. I tried to go and meet guys in Nairobi. You can google it online. I tried to meet the boss. I looked so beaten up. I wanted to see the boss. I wanted to negotiate tents. He looked at me and said things are my thug man. He didn't really treat me nice man. Somehow I met the guy. I told him I'm going to buy tents. He sent me a design. I had to send all the money I had for the tents at that time. I sent all the money the guys were shocked. We actually afforded that money to pay them. I bought the bus. Same day and night I came back to Kampala from Nairobi. Rovernight. I arrived here. I got on the bus straight to Chiba National Park to start construction. So July, September. Now meanwhile these guys had told the guys at the time. Had told these occasion guys that I was going to fail and they would give it to them. I was hosting my first clients on the 15th of August, 2007. 2008 now I was thinking maybe I would fail to pay my grand rent per person because I have to pay grand rent every year. So whether I make money or not it's about $10,000. If you come and sleep in private lodge every night I'll pay about $26. But I was very prompt with my figures up to today. They cannot say this is a Caucasian an Asian guy who pays them before me. No. I pay my fees for the last so many years. It gives me a voice. It's like taxes. You have to pay your taxes. It gives you a voice. When you are arguing with people you are arguing from a very self-space. So anyway 2008 I was awarding the best performers. And I was one of them. Only Uganda. So I started getting awards. How many lodges have you built since then? So by first was primary. Second one was Simba Safari Camp. Must have seen the budget one. Innovate them and make a... So this is the first block that Amos built in here. Of course it is the first block. Before all these... It was this one. It was the first block. Wow. Third was Elephant Plains. Donge Akoloj. Just put one in Tanzania. But Amos is not just in tourism alone now. Because of COVID we put up a fact with me and a friend. It's worth 4.5 million dollars. That we process about 18 types of grains. Now we having a contract signing up a contract with Diageo to supply corn starch supply sogam supply bali That's what we're doing. What really drives you guys? What really drives you? I think for me one is poverty. When I think about it it doesn't matter whether it's 2 a.m. or 2 a.m. I used to work 18 hours every day. 18 hours every day. If someone tells you hard work doesn't work then he doesn't understand what they're talking about. I worked 18 hours a day. I had to pay a price for it. I had to make a name for it. Now when I started growing I remembered my dreams my desire. When I went to fluke the wedding and I ate a lot of meat and I thought about meat so at one point I have 100,000 dollars on my account but I'm struggling with food like I'm struggling to eat food I'm struggling to eat meat I don't even like it you know what I'm talking about I said asking myself why was this so like this. I started struggling with myself and I think many people struggle at that stage that's when they start buying latest cars putting so many things is because that stage everybody goes through it like in the mindset you go through it but I started discovering that if the purpose to life is beyond what you put on what car you drive how many clothes you know this kind of stuff which phone you carry then you start discovering now that my papa is for life today is when I wake up and I know these people are paid on time there's no single employee of great lakes of iris or Uganda Lord is it it can say was paid beyond the 26th of every month none even during covid whoever was paid was paid you know to that display is the papa so when I build a place I look at the young people building the lodge I look at the people working there and I see they are able to support their families that's what brings satisfaction how many people have been employed so far we are many every factories and whatever we are doing we are many the impact is even larger when you run accommodations the impacts are larger than we all see because you have suppliers onions I remember during covid I meet I meet a lawyer and he tells me I had never seen how you are valuable to me until covid happened I said so how he tells me I met my aunt in Fort Porto I realized my auntie was not able to ask for money from him because she supplies us tomatoes but because I was covid she could not supply us so it is covid that made him realize that without primate lodge working he also can't work so you don't know this impact sometimes it takes situations for you to understand but just that we also had so many young people that have left the business of selling down businesses prospering it's a good thing at the same time at one point we have young people training which makes a lot of sense what has been the mega challenge throughout this whole journey well I think every season has had its own cha type of challenge covid has been covid was such a test and those tests on two fronts one that 3 years almost 3 years without business was extremely tough but also it reminded me of the habits of saving that without those habits would have probably gone down but also we used it to train of course during that time but 2020 we had been booked man had counted my eggs as so how much we were going to make that time it taught me a lesson even now by the way from June we are really really looking very good but I no longer think in that direction because anything can happen with life we are not in charge I think covid was one of the toughest of lessons I read on the internet people were complaining about the car you drive people were complaining about the way you dress have you seen those things but you see what many people don't understand is that I am breaking a chain of poverty when you are the one breaking a chain of poverty your responsibility is different from my child I have to be very careful what I do with what I have but also they look as a person a car is just something that moves me from place A to place B it doesn't mean that I don't like brand new cars I sit in my friends brand new cars and by the way I've saved 3 times one day I sat in a friend's car and I started saying I saved particular for everything I want I save even I don't go to the company and get money and buy but when I went something like that I saved $150,000 I went to her to touch a brand new Land Cruiser GX and I thought to myself kid from Rwakaka this is not for me man I left one week later I don't know that you know the internet but you don't this is a good restaurant I am the landlord but I the land next door came out for buying and I paid $160,000 that's the money I should have so it was $160,000 that land the last I was offered was $1.3 million yeah then I saved up again saved saved I went to Toyota again 3 times man I went to Toyota touched the cart was grand looking so cool man brand new I walked out again I walked out again it was just I think the second week someone tells me there's 158 acres for buying 6 to 7 kilometers from my town I went and bought but it's not that I don't like it we all wake up and want to have the latest things but I don't think I'm defined by what I dress I'm the type of guy who will put on sometimes must see me in a picture with the same pair of shoes from Monday to weekend I say yeah it's true I only have one so that doesn't take up my mind really I can enter a place I know I can pay my bills I sign a cheque and even here when you come no one cares whether I'm here or not really at the office everyone just calls me by my name no one calls me both that's not important I've seen you've got a lot of tourist bands land cruises and stuff for the tourists how many you got so far I don't know I think over 20 but we've got some others in the national parks would you agree with me that you started your company with a zero dollar no how much did you start your company with I started with knowledge I had 200 dollars between me and Pokati do you need more money to set up a company no I think this is where we go wrong have you seen people who have inherited lots of money and become poor in have you seen politicians in Africa even Uganda a guy has been earning 50 thousand dollars a month and when he is thrown out thrown out of parliament he has been spoiled within one year so that's the mistake as African thing that we need the cash I always tell people if you want to be progressive you want to succeed continuously the first thing you look for in life is a skill be good at something like Wadi Maya for example you're good at YouTube you're good at understanding people you're good at showcasing things Wadi Maya as a politician was nothing to offer Wadi Maya everything you have can go away and you'll start afresh and you'll still be Wadi Maya in the next 20 years so the skill is number one number two and very very important is networks so it doesn't matter how skilled you are if you're not good at making good networks you're going to go nowhere number three money will come in number four will be the obvious influence when you have a skill you have networks you have a bit of money then they interview you Wadi Maya comes and interviews you that's the bottom line but then also when you want to create wealth in the second stage is you find something to do so you've gotten a skill, you've got the networks and you find something to do when you find something to do in the first stage save as much as you can we do that that's why we've not been indebted as a business save as much as you can you ever took loan? no, we don't use loans the only loan we've done was for the factory we've done and only for trading not for capital investment so we like now we have about 3 million kilograms of maize that came from a loan but it's there in value we didn't really say we have a loan so we save we went to Simba's fire camp and went to Elephant Plains Simba's fire camp I saved 10 years to be able to build a next lodge I think long term that's very important for us to know so the second stage is up front to explain it so you get an income when you get an income the second stage is save as much as you can the third stage is invest as well as possible because you see if you had 250,000 shillings you cannot shillings 12 years ago was equivalent to $100 15 years ago was about $100 today that money is less than $70 so you've lost value so saving is good now you must invest as well as you can but for you to invest as well as you can depends on who you hang out with right it fits many people it's lifestyle so it doesn't matter how skilled you are how well networked you are how much you save how much you invest for as long as your lifestyle is wrong manu will elude you say you are making african product pure 100% but with lots of context from local people support me East African support me Caucasian support me it's because of the context so you I personally believe in the notion that there's a man who is self-made I can't say that you've come here how many people are we here you've seen them working in all the lodges people are working you have garage people are working these are the guys that make me without them I'm nothing I have so many young Africans that watch my videos I think that makes sense both young and old if you have a message for them in terms of how to run a successful business what would that message be I think running a business is not impossible is a lot of people especially educated people unfortunately for us Africans I think running a business is not impossible is a lot of people especially educated people especially for us Africans a lot of educated people will see 10 ways in which a business can work and one way in which it can't work they will nest that one way in which it can't work and actually stops them from trying out now of course people like me were not very class educated have an advantage me I cannot be employed by anyone I don't have a CV to take to anybody I don't have it in all this building I'm the only guy without a university degree from the receptionist I'm the only guy without a university degree most of them up to 2-3 2 degrees that's how it is so I have to work twice as hard as would like admire to just or 3 times for me to try and be at your level so for me I have no excuse and if you're educated and have an advantage you actually can do a lot better than a person that is not as educated in many ways because I know for sure that the contacts have made all over the world even here locally I've not exploited even 5% why? because much as I'm fairly eloquent, fairly engaging I am limited I have like you saw I have no diary, I've never kept a diary in my life if I didn't have a friend of mine called Simon Kahero who forced me to get a personal assistant in african-american actions the reason why she is is because she understands the mindset of my clients so you have to surround yourself you're as good as who you surround yourself with because she understands the mindset of my clients she's been my personal assistant for the last 7 years unfortunate for her she's going slightly higher in the company which means I have to still get another person but it just improves your life it does that if you had a chance to change one thing in africa what would you change? I think it's the mindset because the resources are there if you look if you look at africa we have between 50% and 60% of the world's arable land we still import food worth over $4 billion a year in fact if you look at countries not like germany like Nigeria if they never imported rice from thailand the thailand economy would struggle even us were still importing certain things yet Uganda has 49% of East Africa's arable land you just imagine this you've seen here you'll never eat a pineapple anywhere in the world mangos are sweet everything you eat the fruits are real nice they are tasty, they are fresh but why are we poor? we've got the lakes, we've got the longest river in the world there's powerful waterfalls in the world you've got a big portion of the world the largest fresh water lake the tropics you've got mountains, rivers, lakes, tropical rainforest why are we poor? it's our mindset it is our mindset it is important if you are in Africa, trauma because for me I have travelled across Europe I have driven I've gone to Yosami I've gone to the Grand Canyon I've done all these things but when you see these guys exploiting some of the things that you will never take seriously I went to Australia one time and I was taken to a tour on the Calypters Street you know Calypters, find over here Maharaja shook my hand and there were many of us buses of us going to the Calypters they were everywhere I was shocked I paid $100 and thousands of us were paying $100 I came back and I thought what about the tripkoreen forest we've got here it's just our mindset we're not exposed to knowledge thank you so much for talking to me I appreciate your time and I hope and believe that your story will inspire many Africans thank you kwa see you in Ghana man


Hey everyone, welcome to CNCF on-demand webinar. Today I'm going to talk about the secret store CSI driver that integrates external secret stores with Kubernetes. A brief introduction about me, I'm Anish. I'm a software engineer at Microsoft based in Seattle. I'm part of the upstream Kubernetes security team. I am a maintainer of the secret store CSI driver and the Azure Key Vault provider for the secret store CSI driver. So why are we talking about external secret storage when Kubernetes has a perfectly good one built in? First, Kubernetes secrets may not meet your data-addressed encryption requirements. By default, when you create a Kubernetes secret, the data is stored in HCD and it's just base 64 encoded, but it's not encrypted. Although there are KMS providers to enable secret data encryption at rest. Depending on your organization, you may have already standardized on a third-party secret solution and need to use that. Also, your external secret solution may have some sort of secret rotation story or integration that you're looking to leverage. Finally, if your organization has already invested in auditing and alerting on a third-party secret system, you may not want to duplicate that effort for Kubernetes secret. So what do you do? There are a few options to consume external secrets. You first might look at modifying your application to fetch the secret from external API directly using the SDKs provided by the external secret store providers. This may not be possible depending on your deployment. You may not have the code to edit or it may be prohibitively expensive to implement these changes. And if you're targeting deployments against multiple secret providers, this effort would need to be duplicated across every single storage system. You might also look at just copying the secrets and syncing them as Kubernetes secrets, perhaps with a single controller. This is portable and won't require application changes, but you may lose out on some of the benefits of your external secret stores, like using the identity of the workload for access controls. Because in this particular scenario, you are granting the single controller permissions to access the secrets instead of the workload that needs to use the secret. The third option is you could use a sidecar to fetch and write these secrets. The sidecar may be injected using a mutating webhook. Here, the identity that is being used to access the external secret store would still be the pod identity, but having a sidecar and an additional mutating webhook may add operational complexity. Finally, there is the secret store CSI driver that uses a container storage interface specification that we are here to talk about today and cover some of the features that we think is a good fit for consuming external secrets. The secret store CSI driver project was originally developed at DS Labs. This storage driver is now built and maintained as a Seagod sub-project. The driver allows Kubernetes to mount multiple secrets, keys, and certificates stored in enterprise-grade external secret store into the pods as volumes. Once the volume is attached, the data in it is mounted into the container's temporary file system. In terms of the features that the secret store CSI driver supports, it has a familiar file system mount experience to compute workloads. It's also pluggable and it can support multiple external secret providers without the application having to be modified. It can load new values of secrets throughout the lifecycle of the pod. It can also sync the mounted content as Kubernetes secret for further compatibility with existing deployments. Finally, it supports both Linux and Windows containers. In terms of the prerequisites that are required for using the driver, the driver can be used on any Kubernetes cluster that's running one 16 or above. In case of Windows, you would require a 118 plus for CSI inline volume support. We talked about the driver supporting multiple external secret providers. The supported providers that we have today with the secret store CSI driver are Azure Key Vault, Google Secret Manager, Hashicot Vault, and AWS Secret Manager. So we saw a brief introduction on what the secret store CSI driver is. So how does the secret store CSI driver work? A driver is installed as a daemon set on each node in the cluster. In addition to the driver being deployed, there needs to be a provider-specific daemon set deployed on every single node. So first, when a pod is created through the Kubernetes API, it gets scheduled onto a particular node based on scheduling decisions. The KubeLit process on the node looks at the pod spec and sees there is a volume mount request and referencing a particular CSI driver. At this point, the KubeLit issues an RPC call to the CSI driver provided in the CSI volume. The first thing that the CSI driver does at this point is it mounts the tempfs to the pod and then it issues an RPC request to the provider based on the configuration. The provider talks to the external secret store to fetch the secrets. The provider in this scenario uses the pod's identity. So it could be the pod's workload identity or any other configuration that's tied to the workload pod. The provider then fetches the secrets from the external secrets to the pod and it sends the content back to the driver as part of the RPC response. The driver then writes the secrets into the file system and at this point, the volume is successfully mounted and then the pod starts up running. So we talked about how the driver works. Now let's get into some of the YAML files that are required for the configuration. So here we have a sample pod spec. So if you look at it here in the volume mounts, we have the mount path defined which is the path inside the container and it has slash var slash secrets. And if you look at the volume, we can see that it is a CSI volume and not a secret volume. The driver name in the CSI volume is what tells Cubelet to use the secret store CSI for this particular volume. The secret provider class in the volume attribute is a namespace Kubernetes custom resource. It is used to provide driver configurations and also provide a specific parameters for the secret store CSI driver. So we've looked at the pod YAML and then the secret provider class YAML where you define all the configuration for your provider. But how do you know which version of the secret that you're getting from an external secret store is currently being used by your pod? The secret provider class pod status is a namespaced Kubernetes custom resource that is created and managed by the secret store CSI driver to track the binding between a pod and a secret provider class. This resource contains details about the current object versions that have been loaded into the pod mount. And then it can indicate whenever there has been rotation and then newer version of the secret is now being used by the pod. So let's see a small demo on all the things that we just talked about to see how the driver works. So as part of this demo, what we're gonna do is we have a kind cluster and it's running Kubernetes 1.21.1. To show how the secret store CSI driver enables pod portability across different external secret store providers, we're gonna start with deploying two applications written against specific third-party secret stores. So in this particular demo, we're gonna be using GCP and Azure. First, we're gonna see what the pod YAML looks like for these applications using the external secret store APIs to access the secrets. So this is a pod spec for a pod that's implementing API calls using the Azure SDK to talk to Key Vault. The Key Vault name is kind KV and the secret that it's trying to fetch is secret one. And this is a pod spec for a pod that is using the GCP SDKs to access a secret from Google Secret Manager. So we can see here, the secret name is the resource ID of the secret that it's trying to get. As you can see, both of these YAMLs are referencing credentials from a secret store creds which I've already pre-configured in the Azure and the GCP namespaces for the demo. So now I'm going to deploy these pods in their respective namespaces. So we have deployed the Azure pod in Azure namespace and now we're deploying the Google Secret Manager pod in the GCP namespace. Let's quickly check if both the pods are running. Okay, now we can see that both the pods are up and running. Let's check the logs to see the secret being logged. So we can see here that the Azure pod was able to successfully get the secret from Azure Key Vault using the SDK and then it logged the secret. Similarly, the GCP pod was able to get the secret from Google Secret Manager and then it was able to log back. So here we have two different pods that are implementing the APIs required for each secret store backing. Now, instead of having two different application implementation for external secret store, I have a third application that was returned to consume the secret from the file system instead. So using the secret store CSI driver, I'm going to show how this application gets the secrets from either of the secret backend, that is Azure or GCP. So as a first step for the demo, I'm going to deploy the secret store CSI driver using Helm in the CubeSystem namespace. So if you see here, I'm setting a couple of values required for the Helm charts. So I'm enabling the secret rotation feature and I'm also setting the rotation pole into the five seconds, which is aggressive, but it's only for this purpose of the demo. And then I'm also enabling the sync secret feature for the directory. We typically recommend to use a separate namespace for the CSI driver pods other than the ones that's used for your workload. The default that we set in the manifest is CubeSystem because the CSI driver pods are privileged and it's recommended to 100 in CubeSystem namespace. Okay. So now let's just quickly check what the Helm chart deployed. When we look at it, we can see that we have a driver we've demonstrated running in CubeSystem namespace and it's running three containers. One of the containers is the actual implementation for the driver. And then the other two cycle containers are for dynamic registration of the diver with Cubelet. And then the third one is the liveness probe, which ensures that the driver is functioning as expected. Okay. So the next, now that we have the driver running, we also have to deploy the providers for the demo. So I'm going to deploy the Azure provider first in CubeSystem namespace and next I'm going to deploy the GCP plugin in the CubeSystem namespace. And if we take a quick look on all the pods, so now we have a driver and then we have an Azure plugin running in CubeSystem and a GCP plugin running in CubeSystem. So let's take a look at what the pod spec looks for this application, which is just reading secrets from the file system. So we have a pod and it has a volume mount and it's mounting the volumes into mount secret store. Here we can see that it has a CSI volume. The driver name is the name of the secret store CSI driver and the secret provider class is CSISPC. So this is familiar to what we just looked at in the presentation. Let's also look at what the secret provider class looks like for this particular, for accessing secrets from Azure keyword. So when you see here, we have provider set to Azure in the secret provider class and these are the provider specific parameters that's required for accessing the secret. So here we have the keyword name, which is kind KB and object name secret one. So we're trying to retrieve secret one, which is of type secret from keyword kind KB. Let's also quickly look at what the secret provider class looks like for the Google provider. Here the provider is GCP and in the parameters for resource name, we have the resource ID of the secret that we're trying to fetch and the file name here is used for writing it in the container. So now I'm actually going to deploy the Azure secret provider class in Azure namespace and then the GCP secret provider class in the GCP namespace. Now that we have the secret provider class created in both the namespaces, I am going to deploy the exact same pod spec without any changes in Azure namespace and also the GCP namespace. So if you see here, I have the exact same pod YAML which is referencing a secret provider class that's being deployed in two different namespaces, which means it's accessing two different secret store packets. So when these pods get scheduled onto a node, the cubelet sees the volume definition and based on the CSI volume, the driver name, it invokes the CSI driver to mount the volume. The CSI driver will mount the tempfs and make an RPC called the driver to fetch and write secrets to the file system. Okay, now let's check the pod mount to see if the secret exists. So we can see that we are exiting into the CSI pod in Azure namespace and then we're looking at the volume mount path and then we can see there is a file secret one. Let's also look what's the content of secret one and we can see it's hello from Azure keyword which was the same as what we saw when we were directly trying to access using the APIs. So now let's weekly check the logs for the CSI pod in Azure namespace just to confirm it's working as expected. And then if you look at the same CSI pod which is reading from the file system in GCP namespace, it has a secret from Google secret manager. So there you go. With this, you can see that the exact same application without any changes to the pod YAML is able to fetch secrets from Google secret manager as well as from Azure keyword. So we talked about the driver also supporting sync as Kubernetes secret. The CSI driver provides an optional feature to sync the mounted content from the pod as a Kubernetes secret, a common usage of this feature is to store the TLS certificates in external secret store and have the driver sync it as a Kubernetes TLS secret and then that can be used with English controllers. So in addition to the sync Kubernetes secret, they can also be referenced in the pod spec to set environment variables if required. As you can see in the secret provider class there is an optional secret objects field which is used to indicate that the mounted content also needs to be synced as Kubernetes secret, secret auto rotation. So a generally acceptable best practice is to periodically rotate your secrets. So if your external secret store has automatic rotation feature, you may be interested in how the workload that's running on your Kubernetes cluster can get the new values of a secret whenever it changes. The driver supports rotation, automatic rotation by periodically re-issuing the RPC calls that we looked at to the provider to refresh the mount. Once the rotation is successfully done in the mount, the driver will also emit a Kubernetes event to indicate that a rotation is successfully complete. In addition, if the mounted content was also synced as a Kubernetes secret, then the driver will also go and update the values in the Kubernetes secret. So we talked about two features. Let's also jump into a demo to look at how the driver does the syncing as Kubernetes secret. So for this part of the demo, you're gonna do it with two steps. The first one that we're gonna look at is how the driver can sync the mounted content as Kubernetes secret. So the first thing we're going to do for this is we're going to enable an application to work with Nginx Ingress Controller and we're gonna store our TLS certificates in Key Vault and access them using the driver. So I've already created a certificate, a self-signed certificate for local host using the step CLI. So let's inspect the certificate before we actually import it to Azure Key Vault. So if you look at this certificate, you can see that it's for local host and in terms of expiry, this certificate is set to expire on March 10th. So I'm going to import this certificate into Azure Key Vault with the name Ingress Cert. And now for the demo, we also want to deploy the Ingress Controller. So here we are deploying the Ingress Nginx Controller on the kind cluster. While the Ingress Controller is starting up and running, let's look at what the secret provider class looks like for this sync as Kubernetes secret. So if we see here, the provider Azure, which is pretty standard as we saw in the last demo, but here now we have this additional field called secret objects. And then the secret name here signifies what the name of the Kubernetes secret should be. And the type is what the driver will set when creating the Kubernetes secret. And then the keys are what are the keys that are required for the secret type. So I'm going to deploy the secret provider class in default namespace. And then I have a single file which defines the pod, the services and the Ingress. So let's take a look at that. So here I have a pod which is called foo app and it has a volume mount and in volumes, it's referencing the secret store CSI driver. And we have a service to expose that pod. And similarly we have another pod called bar app which has a service exposing it. And then finally we have an Ingress resource which is set up to use TLS. The secret name here that we have defined is the same secret that the secret store CSI driver is going to create. And in terms of the rules, we have a slash foo and then a slash bar for validation. So now we're going to apply this YAML which deploys the pods, the services and the Ingress resources. So let's check if the pods are up and running. So here we can see that the bar app and the foo app are pods are up and running. Let's check if the CSI driver actually created the Ingress TLS CSI secret. So we see that it's there in the default namespace. Let's also look at the YAML file. So here we can see that the CSI driver created the secret with TLS.cert and TLS.key as the template provided by the user. And in the labels, you can see that this resource was created and it is being managed by the secrets store CSI driver. So the first thing we're going to try is we're going to try and curl the endpoint to see which certificate is being used. So if we see here, we can actually see it's using the certificate that we uploaded to Azure Keyworld that was mounted into the pod by the CSI driver. So the expiry date is March 10th, which is what we looked at in the certificate. So we also talked about the secret provider class pod status before in the presentation. So let's quickly look at the secret provider class pod status here to see what version of the certificate is currently in the pod. So if we see here, we can see that the secret ingress.cert is in the pod. And then the version that it's currently running has starts with 6498. Now for the second part of the demo, let's actually try the rotation with the current setup and also with the pod portability setup that we have before. So for the ingress rotation demo, I've already created another self-signed certificate with a longer validity. So when we inspect it with OpenSSL, we can see that the validity for the new certificate that I have is March 18th instead of March 10th. So I'm going to import this rotated certificate into Azure Key Vault. The auto rotation feature in the secret store CSI driver should enable us to fetch the new rotated certificate from Azure Key Vault and update the mount and the sync Kubernetes secret. So now when I try to curl the same endpoint that I called before, we expect to see the certificate returned to have an expiry of March 18th instead of March 10th. So let's try that out. Sure. So now when we look at it, we can see that the expiry date has changed to March 18th. This is because the driver updated the mount and it also updated the sync Kubernetes secret. The ingress controller picks up the updated Kubernetes secret and then re-loads the certificate. Now let's also look at our secret provider class pod status to confirm the secret version that's being used in the pod is now different. So now we can see the version is 9475 which is different from 6.4 which was before. We also, I also said that I will do the rotation demo with the first setup that we had. So let's try that. So I'm going to rotate the secrets that were used by the application that was used as part of the pod portability demo to see if it can pick up the latest value. So the application that was used in the first demo watches the file system and it basically reads the file from there and logs it. And then it also has file watcher implemented which means anytime there is a change in the file system it will automatically become the new value and then log that. So let's tell the logs before I actually go and rotate the secret in Azure Key World. So if you see here it is logged out of from Azure Key World which is during the startup. So now I'm going to go and rotate secret one to say I am rotated. So when I do this I'm updating secret in Azure Key World and if we see we can see that the driver has updated the content in the mount for the pod and it was able to pick up the latest value using the file watcher implementation. So we've looked at all these demos and I'm sure the next question is what is the current state of the project? So the secret store CSI driver core functionality is stable. This includes the interface defined for supporting multiple external secrets provider pod portability with secret provider class custom resource. So you have a single YAML file which references a secret provider class. And if you want to move it from a single secret store to a different external secret store there are no changes required for the YAML file. And in terms of the feature parity for Linux and Windows containers, the driver is stable. So what does the future look like for the secret store CSI driver? The auto rotation feature that we talked about is currently in alpha. We are working towards moving this feature to stable by reusing some of the CSI core functionality. So CSI has a requires republish feature in which scenario QBlit will automatically issue an RPC called periodically to update the month. By using this we can actually get rid of the controller that we have in the CSI driver that handles the rotation today. And then we are also looking forward to more community involvement. So if you're interested in adding a new provider for the CSI driver or have feature requests reach out to us on Slack or on GitHub. If you would like to get involved you can join the CSI secret store channel in Kubernetes Slack. We also have a mailing list for notifications on releases and security announcements. We use GitHub issues to track bugs or feature requests or to answer any questions that you might have asynchronously. Also we hold a bi-weekly community meeting. It's every Thursday at 11 p.m. Every bi-weekly Thursday at 11 p.m. EST. And in terms of the resources I share some resources from the presentation. So there is a documentation link to the driver and then also the GitHub repo link to the driver. Each provider have their own specific documentation in terms of what are required for the secret provider class so there's links to documentation for the individual providers. And for the demo I've reused some of what I've used during my QCON talk. So all the artifacts that I've used today are available in that GitHub repo. Thank you.


So the other day I watched a video by Elliot Hulse one of my favorite You know veteran youtubers that I watch from time to time And this particular video he was talking about how he had gone rid of 90% of his books and If any of you guys know Elliot Hulse from the strength camp channel You know that he's a very Well-read man a pretty smart guy and he's got plenty of videos on YouTube where he's showing his house with you know hundreds of books Heaps of bookshelves stacked everywhere and all that jazz Now the reason he got rid of these books is because he felt that he was getting stifled he felt that he was feeling somewhat of Information paralysis And this is a very common thing for wizard type individuals that really enjoy You know gathering information you can fall for the trap of Gathering too much information and not giving your brain enough time to Truly digest information or to compute different things and when this happens it could be Detrimented to you You can be worse off than you're not even knowing this information Because now you know too much and you're confused about what you should do This often happens in a lot of people when they're trying to learn about business, for example They'll read a bunch of business books, but they'll never take any action Or some guys that try to learn about dating They'll read a bunch of dating books. Maybe watch a bunch of videos, but never approach a girl This happens to a lot of us. We gather the information We watch the videos the tapes for hours on end thinking that we're gonna get better Whereas the opposite happens. We just get more confused So what you need to do to combat this is to Give yourself some room to breathe and What I liked about Elliot's video is he made a metaphor about how reading books and gathering information is somewhat like Digesting food or the food that you put in your body the whole process of that We all know very well that The ratio of the macronutrients macronutrients you put your body your fats cover hydrates proteins Can affect your body composition or the total sheer amount of calories you digest can also affect your body weight In the same way the type of books you read can affect your mind in the amount information you gather or Digests can affect your clarity and your ability to process information and your ability to think so In the same way that you're gonna die of food if you want these wizard type guys you're gonna die of these books So what Elliot suggests is that you get one bookshelf and you keep your best books there and If you need room you get rid of some of the other ones and put some of the new ones in but you never go Past the capacity of the bookshelf It's the same thing for everything else if you're watching too many videos on YouTube Stop doing that if you're listening to many podcasts stop doing that Understand enough to get started Understand what you need to know to do exactly what you have to do at this particular time And then take action because if you start for yourself with information you're getting rid of the chance of authentic creativity You get rid of your capacity to come up with original ideas So that's just something keep your mind and once again this goes over not just books but Information in general the information you're seeing on your Facebook feed your Instagram your audio books Your books just your TV When there's too much information it clouds your mind. So give yourself brief moments of clarity by just removing it Now I used to be one of these guys that used to read a Book a week And I stopped doing that because I realized Most of the time you don't really process the book if you read a book a week Yeah, you read the pages you get the general concept, but you don't really truly understand what's going on So it starts becoming an ego thing where you can brag about I've read 50 books I've read a hundred books in a year and stuff like that But what exactly did you gain from it? Did you did you gain real knowledge or did you just gain a bunch of facts? So what I do now is I read a book and I take my time with it Where I watch a video and I take my time with it and get the information and then apply it straight away There is no more gathering. I suggest you guys do the same Anyway, if you liked that video give me a thumbs up. Give me subscribe. You're like good stuff more videos coming soon. Peace


Well, I went to go see X and I thought, what the hell? I might as well talk about it. So let's get suited up and talk about X. Well, I got my duds on, I'm all ready to talk about X. X is directed by Ty West and I honestly had no intention on seeing this movie until I found out he directed it because I was a huge fan of two other movies he did, House of the Devil and The Sacrament. Jenna Ortega is in this and she's no stranger to the genre. She was in Scream 5 or just Scream. She was also in Insidious Chapter 2. So I'm going to breeze by the plot here very quickly in case you haven't seen the trailer. The movie is about a group of filmmakers who pile into a big van, take a road trip out to a remote farmhouse where they've rented a boarding house on the property to make an independent low-budget pornography film. They hope to make a lot of money on the new booming home rental market. The farm is owned by a creepy old couple and the wife doesn't seem like she's quite all there anymore.  And that's where I'm going to end the plot because I don't want to wreck anything for you but I do want to talk about how much I did like X. I'm not surprised that I liked it because I really liked House of the Devil and the sacrament and like House of the Devil this is a slow burn.  It is so good because even though we haven't gone to any crazy killings or anything yet the character building is so goddamn good. And the characters feel real and that's why it works so well because the most horror movies the characters don't feel like they're real people. They either feel like they're stereotypes or they're cliches. Usually the acting isn't great but in this case the acting is fantastic and you really feel that these are real people that you're watching.   It's actually really sleek and sexy not in a bad way. It's sleek sexy and creepy and scary so it has it all.  This movie is all about sex.  It's about all those human carnal primal instincts and they go about it in a very smart way. There's actually some great dialogue that takes place after they've wrapped filming for the night. They're all sitting around relaxing with a beer talking about the morality of what they're doing the morality of making pornography and the morality of sex and having sex with multiple people and how love is different than sex. All that stuff is addressed and it's way more thought provocative than you thought this movie ever would be. This is also a beautiful looking film. It is shot fantastically. There are some shots that just took my breath away. There's a fantastic aerial shot looking down at the water as one of the girls is skinny dipping and it's not only beautiful but it's also terrifying. The setting for this movie is fantastic too. The farmhouse is creepy. The boarding house is creepy. It reminds you a lot of the evil dead cabin. The lake and the water during the daytime seems very nice and pleasant.  It reminds you a lot of of course Friday the 13th and I don't think that is by accident. This movie does pay homage to a lot of other horror movies. You'll see Texas Chainsaw Massacre right off the bat. Of course, them all piled into the van going out driving to a farmhouse. There's a shot of the cattle that reminds me a lot of Texas Chainsaw Massacre. That must be the old slaughterhouse. There's shots in there to remind you of the shining. In fact, somebody did yell behind me. Here's Johnny. Quite sure there's a lot more Easter eggs you'll find in this movie that are nods to other horror movies. I may even be stretching it a little bit. I may be seeing things that I want to see in this movie that are little nods to other horror movies or maybe they're there on purpose but it's subtle enough where it's not completely in your face. I love how this movie takes the old cliche, the boring old cliche that's been overdone so much in horror movies of the kids going out to the woods to have sex. It takes that throwaway cliche and makes it the entire plot of the film. It takes that trope and makes it have meaning.  So there was a reason for them going out to the woods to have sex. It is basically to make a product and to make money off that product. The kills in this movie, once you get to them, once you get past that slow burn, are a great payoff and the effects are great. I'm quite sure the practical. I didn't see any CG in this. If there was, it was good or it was very subtle. Not just the gore but also the atmosphere surrounding the kills, the way they light it makes it just look so good. This movie actually really made me feel almost warm and fuzzy inside because it felt familiar and old but at the same time, it felt new and exciting. They did a great job of tipping their hat to the past but also doing something really new and thought provocative in the slasher genre. Felt like a movie I've seen a gazillion times but it also felt like something I've never seen before. I was honestly smiling ear to ear grin throughout this whole movie because not only was it fun, it was entertaining, it was smart, and it made me really feel like I was watching something special and it did a really good job of being creepy and unnerving and scary. There was moments in the movie I howled laughing because they were legitimately funny. They really balanced the horror in the comedy in a great way where it doesn't feel like they're trying too hard to be funny. So even though I really did like this movie, there are a few things about it I didn't like. Or that I thought they could have maybe done a little different. The first one being, I don't really think it needed to take place in 1979. This movie really could have taken place during modern times with the exact same plot and the exact same premise. It taking place in 1979 with the kids piled into the van seemed way more of a tribute to Texas Chainsaw Massacre and those types of movies than it needed to be. So I don't think it needed to be a nod to those movies because this movie does do something new and does stand on its own. Another thing I didn't like about this movie was actually the way that they pulled off the ending. There's a moment in the movie where you realize that this ride is over and there's nothing really in the back of your mind thinking that oh there might be something else that might happen. Another jump scare, another twist. You pretty much realize we're at the end of this journey. And I thought that that was way too much of a dead end. I thought they could have made it a little bit more open-ended for a bit more suspense. I still wanted to be on the edge of my seat and I wasn't because I knew everything was over. There's also a moment at the ending which I think came off a little too silly. I don't think they were trying to be funny but with me with my sixth sense of humor I found it a little silly. But other than that I thought that X was a fantastic movie. I'd recommend it to any horror movie fan and especially slasher fans who are looking for something new but still feels familiar.  Until next time, keep drinking.


Hello, and welcome to this first video for chapter two in the Sundstrom textbook, and in this video we're going to work on the negations of simple statements in English. So in one sense it's very easy to form negations because you just stick the word not in front of whatever statement you're trying to negate. But there's better ways to do this usually that involve better phrasing and communicating in mathematics. We're all about the phrasing here. So I have three examples we're going to work through here. First of which, let's take the statement that the number 18 is prime. Now this is actually a false statement, but at least it's a statement that has a truth value. And we're going to, in each of these examples, we're going to write down a basic form of the negation, and then a better form of the negation that we should probably shoot for. So the basic form of the negation for this statement is just to simply say that the number 18 is not prime. The number 18 is not prime, you know, to stick in the word not in the appropriate location of the sentence. That is certainly a correct negation, but there's actually a slightly better way to say this and involve some new terminology. In mathematics, we often say that a number that is not prime is what we call composite. That's a technical term. You may not have heard that ever until just now, but now you know. So a better way possibly to say this is to say that the number 18 is composite. Number 18 is composite. That is one way to phrase that negation. It avoids the word not, because sometimes it gets in the way. Second example, the number 36 is even. Of course, the basic way to negate the statements is to say the number 36 is not even. Again, that's correct, but it's a little awkward because we have another way to say what we mean when something is not even, and that is to say that the number is odd. So it would be better to say that the number, the number, again, my handwriting showing its skill right now, the number 36 is odd. Now that, of course, is a false statement, but we're not getting into the truth and false set of these statements right now. Just how to phrase their negations. Okay, so instead of saying not even, let's say odd instead. It's a little bit more to the point. Lastly, and this one is slightly tricky, the statement 10 is less than 8. That's a strict less than here. Now the basic phrasing of this to say it in English is to say that 10 is again not less than 8. That would be correct, but there's a better way to say it that takes up less space and gets the point across more efficiently. Now what do you think it means to say that 10 is not less than 8? It would not be correct, and I'll put this in red because this would be an incorrect way to say this. It would be incorrect to say that the negation is that 10 is greater than 8. Can you think about why? Pause the video for a moment and just think about why is that incorrect? That seems right. So the reason this is incorrect is just because 10 is not less than 8 doesn't mean that it's greater than 8. It could be equal to 8 somehow. So the better way to say this, to negate this statement, is to say that 10 is greater than or equal to 8. So there's three simple examples about how to negate a simple statement. In later videos we'll be moving on to using these negations to do bigger and better things. So thanks for watching.