The most insane Kobe Bryant story ever. Now let's be honest here, when talking about Kobe Bryant, the black member, you can make at least 50 videos talking about an insane Kobe Bryant moment. He was in the league for 20 years and had countless incredible stories each and every year. Now if you guys want to watch a video talking about 7 of his best stories, I'd advise you to go over to Michael Zemba's channel after this video and watch his. This story I'm about to tell you is one that Mike didn't put in his video and to be honest with you, in my opinion it's his craziest story, if not it's definitely top 5. Now this story not only shows how dedicated to the game Kobe truly was, but it shows how much Kobe Bryant practiced each day to even realize what was happening at the time. That probably doesn't make any sense, so let me explain. Here is the most insane Kobe Bryant story ever, I will also say this is from Gerald Henderson's article in the Players Tribune, which I'll leave a link to in the description box down below. The story starts in Charlotte 2009. At this point Kobe Bryant was at the peak of his palace and hitting clutch shot after clutch shot. It was the year he won his 4th NBA championship and was playing really well. It was during the regular season and Kobe was having his normal pre-game shoot around. I mean if you've ever seen Kobe before a game shooting, he rarely misses. To be fair, there's no defender at all which most NBA players are able to knock down these shots, but on this day Kobe couldn't hit one shot. I mean maybe he was just not feeling it this day, it happens. Players can sometimes just feel a little tired on back to backs, injuries can take over, but usually it's fatigue after a back to back game and things of that nature. Except this is Kobe Bryant we're talking about here. This isn't just a regular player. Kobe was missing wide open shots after wide open shots with no defenders around him. So obviously something seemed a little bit odd. Kobe Bryant missing wide open shots, no defenders around him, that seems really fishy. So Kobe Bryant proceeds to walk to the middle of the court, looks directly at the rim, turns around and says there's something wrong with the rim. Not his shot, the rim. He said that to Gerald Henderson, the first thing that Kobe Bryant ever said to him. In fact this was the first time they'd ever actually met, well kind of. At the time, like I said, Henderson was playing in Charlotte, but it was actually his rookie year in 2009 and the Lakers were visiting. Now Henderson had looked up to Kobe his entire childhood, just as Kobe Bryant had looked up to Jordan and how most players entering the NBA look up to LeBron James nowadays.  And Gerald Henderson was a kid from Philly, who grew up close to Lower Merion. Obviously having that connection with Lower Merion and Kobe Bryant was quite strong as Kobe was not only a national legend, he was a hometown legend. He played high school there and that was a pretty big deal for Henderson growing up. He said that when he was 9 years old, his dad brought him to a high school game where Kobe Bryant dropped 50 points and sat for the 4th quarter. He also said he had visions of Kobe Bryant pulling up from one step inside the half court and draining it and then walking back on defense with a strut as if he knew just how good he was. He did. Lower Merion was a small gym, standing room only. Everyone was there to see him. So as you can imagine, Henderson was pretty pumped to be playing Kobe Bryant, the great, the legend, Kobe Black Momma Bryant and by 2009, Kobe and him were both NBA players. Anyway, back to the story. Henderson was already shooting around and there's still about 45 minutes until the tip up. And in Henderson's own words, he says, Kobe's on the other end, still shooting. And I'm glancing over at him. Remember, I'm a rookie. I want to see how this guy approaches warm-ups. He's one of the greatest of all time. Maybe I can learn something from him, still a move or two. I looked up and he had stopped shooting. Kobe was up to something, but it was weird. He was missing more shots than he was making. Honestly, he was missing a lot. All of a sudden, I look up to Kobe and he stopped shooting. He was holding the ball on his hip with one hand and motioning to the sideline with the other. Then all sorts of commotion started. A crew of maintenance guys showed up out of nowhere. It looked like a hockey line maintenance guys rushing on and off the court. Kobe was saying something to them and gesturing, but from where I was standing, I couldn't make out what they were saying. Suddenly there was a ladder being set up under the basket. Kobe is pointing up at the rim and the maintenance guys are positioning the ladder. A measuring tape is involved. I said, what's going on? Kobe was up to something. I'm standing at half court watching the scene play out and Kobe starts walking over to me. Something's wrong with the rim. Oh yeah? We're watching a guy climb up the ladder and tinker with the rim. It's too low. The rim's a quarter of an inch too low. Hold up, I need to interrupt here because do you know how little size that is? A quarter of an inch? Like what? That's crazy. Anyway, Henderson says, huh? What do you mean? I never really heard about maintenance issues with a rim before a game. Kobe goes, I was missing shots that I don't miss. I'm pretty sure it's low. A quarter of an inch. The fact that he didn't even measure, he just knew from the amount that he practiced. Most NBA players I guarantee you wouldn't even notice. They just shoot a little higher or lower, but not Kobe Bryant. He shot it exactly the same way each and every time. Anyway, Henderson goes on to say, that was it, our first conversation. He went back to his shooting routine, two things pop into my head. Number one, man I can't believe I just had a conversation with Kobe. And Kobe, maybe it's not the rim, maybe you're just missing shots. Kobe finished the game with 30 points. After the game, I was walking off and I saw one of the maintenance guys, one of the guys who was carrying the ladder onto the court during warm ups. I had to ask, hey man, what was up with the rim before? Oh, someone notified that it was a little lower than regulation he added. Don't worry, we adjusted it to 10 feet. Then he told me how much it was off by. I could tell you his answer, but I think you already know what he said.  Obviously it's Kobe Bryant and there are so many to choose from, but this one is definitely my favorite. And I hope you guys enjoyed this video. If you did, I'd really, really appreciate it. If you guys could go ahead, subscribe to the channel if you enjoy this video and you want to watch some more NBA content on the channel. And if you guys want to share this video around, definitely leave a like. That would be amazing. It would show your support so much and I'd really, really appreciate it. But there's a few things I want to say. The number one thing is just if you guys haven't followed my new Instagram account, we're doing an NBA 2K18 giveaway on there, so be sure to definitely follow that account. Links are in the description box down below. New merchandise is up on the store, so if you want to get some Nick Smith merch, definitely rep your boy. And I'll catch you guys in my next video. Thanks for watching. Peace.


Hi everybody, welcome back to another technical demo around the Quarkus application. My name is Daniel O. I'm working for Red Hat as a technical marketing major. This video showcase how to implement a blocking GRPC service on Quarkus. Let's get started. So if you're not familiar with GRPC service, so GRPC is a modern open-source high-performance RPC framework that can run any environment such as Java, Python, Go, JavaScript. You can also have efficient connect service across the data center with a probable support for load balancing and tracing and hash checking and authentication that is a required capability when you build a microservices system. You can also have applicable in the last mile of disappearing computing connected devices and mobile application and even web browser to backend application service here. I'm going to walk you through how Quarkus application enables Java developer to consume the blocking RPC service. Okay, here's my Quarkus application. Just include a simple RESTful API, like Hello. First of all, we need to enable the GRPC service on top of Quarkus. In order to do that, we need to add Quarkus GRPC extension. Once you install GRPC extension, we're going to create a proto file because the GRPC service are described in a proto file, which is with a different method. So in this case, we're going to add some message exchange data as well as some service name here. So first, we need to add the syntax type, the proto3, and a couple more options, like a Java multiple files are true, and a package name, whatever you need to define, like me.daniel.grpc.proto. And also you can expose your Java auto class name like Hello World or Hello World Proto. Here we need to define the package name. This is optional. You can define that. And the most important thing, we need to define the GRPC service here, the service name, Griller, and the RPC method here is to say Hello, with the defining exchange data like Hello Request and Hello Reply. In order to define the messaging Hello Request and string name and Hello Reply messaging, also a string messaging. In order to generate the Java classes like a stuff file, a basic implementation, we need to use Maven compile command line. And once you compile it down, you can find that the product above the generated file here under the product above directory. You can also use tree command line to figure out the directory structure. So you can find the product directory, the GRPC Java, and also the other Java messaging stuff and the generated classes here. Let's take a little bit more of the GRPC service Java file here. You can find that the RPC method already defined and generate the specific application logic and also you're messaging the Java classes here, Hello Reply and Hello Request. Alright, so next step, we're going to run this Quarkus application just to make sure this application is totally working. So using Quarkus Def mode and then just try to access to endpoint. We already have a deeper endpoint, Hello as a RESTful API. Okay, so here are the install features. You can see that and there are the GRPC extension already pulled down and try to access 8080 to default pull in the Quarkus and then return Hello. Okay, this application totally working even we after add GRPC annotation. Alright, let's try to create a new service here. So we're going to implement new service. The name is Hello service Java file. And then using Quarkus to implement the GRPC service we need to extend the Generate Service-Based Implementation here, Greedo-imple base and also we need to add a single-tone CDIB rather than application scope because GRPC service implementation cannot be processed. Okay, we're going to override the Say Hello from Greedo Implementation base and the parameter is Hello Request and Street Optuber. We're going to define that in the specified name and message variable here and we're going to add the Hello with the name as the message. And now we're going to implement the method which is defined in the service definition here in a single method and now to try to build and send the message using the Response Optuber and the last step we're going to close this response using Uncomplete method here responseOptuber.uncomplete. Alright, we just create a new service to override the existing GRPC service implementation. Alright, so next step, we're going to create a new consuming the blocking GRPC service here using existing Hello Resource Java file. First of all, we're going to add injection with CDIBs using inject annotation as well as GRPC annotation. In this annotation, we can use the existing stopped GRPC classes that is generated when we did Maven Compile that came from the prototype file. And then we're going to add a new endpoint method and a get method and a pass is a new parameter like a name and the public string Hello and the passPrem is the name. We're going to pass the name and the string variable also name. We're going to define that. And the return is the, we're going to invoke the gridlock blocking stop classes here client Hello and the return code and the parameter is a hello request and we're going to new build after set the name and build the message here. Alright, and the one thing I just missed that we need to add the service name in a GRPC service annotation here. Okay, so we're going to name is Hello here and we're going to use this name in our application properly. So let's try to add a new GRPC property, Quarkus.grpysClient host name. So we just defined Hello and my host is localhost because I'm going to run this GRPC service server on my local machine Quarkus by default expose the GRPC server with 9000 port and also the Quarkus provide the reflection capability when you enable that reflection. So using GRPCurve to have the reflection list and then now you can see the default has some mechanism in the GRPC server and also the new reflection HelloGridder we just created that thing and let's try to nail down the HelloGridder and say Hello with the pass down some parameter like the name is Daniel O. So we will be return my name Hello Daniel O as a return message. Alright, it's pretty cool. So now we just confirm the GRPC reflection is totally working. So now let's try to ask the actual endpoint like with endpoint. So the Hello and Daniel O we got the same result but in this case we're going to use the GRPC service here. Okay, just in order to recap what we learned today we learned how to implement a blocking GRPC service using Quarkus application so typically you just need to add the Quarkus GRPC extension as you just need to define a protocol file to generate the stop and base implementation classes and then you just consume the GRPC service I mean blocking GRPC service on your Quarkus application. That's good really helpful for you and thanks for watching today and please make sure subscribe for the next practical example. Have a good rest of the day.


Pittsburgh in the 1970s was not a congenial place to be. I want to put this as accurately as possible. The steel industry was closing. Everybody, no, everybody didn't know that. Most people thought, this is just a hiccup. Steel will come back to what it once was. And everything will be fine. Well, that was not going to be. And those people with vision here, and I include the then-president of Carnegie Mellon, Richard Seyert, Herb Simon, a handful of other people said, we're going to do something different in Pittsburgh. We're going to green Pittsburgh. And in 1972, 73, this was a radical idea, very radical. Meanwhile, you could go through fine places in Pittsburgh and find slag heaps in the middle of the road, on vacant lots, because nobody thought they were worth removing. The warehouses, which are now full of high tech, they were left to rust because nobody thought it was worth tearing them down. It was, as I say, not a congenial place. And the promise of greening seemed to me to be so far away. I just didn't think I wanted to spend my life here. I think, well, I told you that I kept seeing this name in the business school, Herb Simon. I later compared it to, as if all English literature had been written by Dryden, somebody you've heard of, but nobody great. And when I finally, after those two years at Stanford, I really understood how great he was. So there's a big reception when Joe and I arrive here for welcoming the new chair and his wife. And there's Herb Simon. I am absolutely tongue-tied. Rockstar. Rockstar. Oh, fabulous. And slowly we got to know each other. Joe and I were living in an apartment on Fifth Avenue just by Wilkins. And we would have parties and I'd get to know him there. But we really didn't become very friendly until Joe and I bought a house, which is at the intersection of Forbes and Northumberland. And Herb would walk home every day along that street, because he lived on Northumberland but about two more miles up the street. And I would see his hat floating past the hedge.  But I'd see this, and I'd be putting my cover over my typewriter just then. And I would lean out the door and I'd say, Herb, would you like a sherry? And Herb almost always wanted a sherry, so he'd come in. And that's when we really got friendly with each other. And we had such a good time together. We just covered the waterfront. He was so interested in linguistics, so we talked about that. Of course we talked about artificial intelligence. We talked about music. We talked about art. Whatever we felt like talking about. And he was marvelously relaxed and funny. I think he looked so serious in all these pictures. If you listen to those tapes, Herb and I are laughing like hell all the way through them. Partly we were flirting with each other, no question, but also partly we just enjoyed laughing, both of us. And we saw the funny side of everything. Okay, so those were afternoons with Herb. They were wonderful, just wonderful. I didn't realize how often we met until I went back and looked at my journals. Herb was over. Herb was over. Herb was over. Oh my gosh. And there's a kind of footnote here. That is that Dorothea Simon and I never got past a certain coolness. And I thought it was my rather militant feminism, which it was very militant in the 70s. And then much later I realized, here was her husband stopping off at least once a week with a much younger woman to have a sherry. And these conversations were so cerebral. She had nothing to worry about, but I could understand and retrospect how it seemed, maybe a little questionable. And even Joe said when I told him how often Herb and I amazed. Really? I was on campus working. The conventional view of people who were doing this was that they were absolute nerds in the worst possible way. They were dreadful human beings. They were at their computer screens 24-7. They had no interest outside their computer screens, blah, blah, blah, blah, blah. And I'm very sorry to say that a book called Weisenbaum's book, Something in Human Reason, stressed this and found a huge audience because this is just what people wanted to hear. Now, I was keeping company with people who had omnivorous appetites for the world. I should tell you about the Squirrel Hill Sages. At some point, Herb and I were... It may even be in his correspondence, I didn't save mine. Herb and I were discussing how our students had the most interesting conversations, the meaning of life and all that stuff. And we're stuck with conversations about the Xerox budget and can we add another course? And should this course be two semesters or one? Really dull stuff. And I said, how can this be? And I'm sure this was by correspondence. A U.S. post, by the way, because nobody had personal email. You very rarely had personal email. Herb said, you know, Dot and I used to have a little salon when we were at the University of Chicago on Sunday nights. And everybody knew it was serious. You didn't come in just to gossip. You came in to discuss a topic of the day. You could do that. You could do that, meaning me. And I said, oh, Herb, that sounds wonderful. Okay, I will do it. And we decided that it should be a very small number I think there were eight of us. Alan Nuland, his wife, Herb Simon and Dorothea Simon. The novelist, Mark Harris and his wife, Josephine and Joe and I. And we met monthly. We decided the topic ahead of time. It was after dinner, so nobody had to run around being the host or anything like that. And privately, I call them the Squirrel Hill Sages because we all lived in Squirrel Hill. But they found out soon enough. They laughed. That was okay. We had some fabulous conversations. Just fabulous. You could imagine those eight in one room talking. It was just great. It was one of the high points of living in Pittsburgh. All of us had thrown work out into the world. Almost all of us had thrown work out into the world. And so we went around talking about criticism and how we felt about it and whose throats we'd like to strangle and things like that. And Herb made a little speech. And the speech was this. There are two kinds of criticism. There is the criticism that tries to understand what you're doing and gives you the benefit of the doubt because you have put effort into it even if the critic doesn't agree or understand. It's a good faith exploration of your work.  And we all knew exactly what he meant because we'd all been through it. Mark with all of his novels, me with my various books by that time, Joe with his scientific work, on and on. So I said, it's getting pretty late at this hour, and I said to Herb, who do you write for? And he said, oh. I said, no, come on, tell me, who do you write for? And he says, oh, come on, I coaxed. He said, well, they're not all living. I said, oh, okay, name one. He said, well, Aristotle. He said it in such a way that you could laugh. And yet I thought, yeah, there's some truth there. So then I began the interview process and I was reading, of course, all the time because one of the things I, for a long time, taught students to write about science. One of the things I insisted they do is read the papers of the people that they were interviewing. And so I was reading Newell's papers. I was reading Simon's papers. I was reading the papers of everybody I interviewed. It was so hard for me. I was an English major. What did I know? And there were times parts of that book were written through a veil of tears because it was so hard for me. I will never do this. I will never be able to do this right. And yet, somehow I did it. Somehow I did it. And I think I said earlier to other people on campus this morning, I didn't want to ask these guys what their papers meant. I really wanted to go in prepared. And it would take absolute desperation for me to say, Herb, I didn't understand what you meant by, but there were times when I had to say that, and Herb was a natural teacher. Pamela, this is another way of looking at it. Allen was a natural teacher. Pamela, look at it this way and so on. Oh, they were fabulous. And Ed Feige, I was a lot less shy about calling Ed Feige. And Pamela said, what's this? And he would explain to me, I had wonderful mentors, wonderful mentors. Just to this day, I am so grateful. And as I think I said earlier, these guys were at the peak of their research careers. And I know what, how demanding research is.  It was just a gift, a gift. One night, I was sitting with Harold Cohen, the painter, and we had had a glass of wine or two. And he said, Pamela, why were you drawn to artificial intelligence? And I gave him the usual, you know, the most interesting people I know were doing it, which was true. And my smartest people I knew were doing it. What an exceptional thing it is going to be if it works. And we think it's going, it feels a lot more like it's going to work now than it did 20 years ago. And then something popped out of me, which was totally unconscious. And that was, and I think it will put an end to the masculine hegemony in intelligence generally. I thought, did that come out of my mouth? Yeah, it did. And yeah, it was true. And oh, I was wrong. But I didn't know that at the time because we still had hopes that this, the machine would somehow be disinterested in a way that humans are not disinterested. And that is my great disappointment with AI right now, that it isn't making a more even playing field. Joe and I started collecting anti-computational instruments in the 80s. You know, kids were through college.  And Gwen Bell, who was then married to Gordon Bell, said to Joe, well, first of all, she took us through the small museum that she'd started near digital equipment. That later moved to Boston, became the Boston Computer Museum. And later still went out to Silicon Valley, which is the right place for it, I guess. Anyway, she said to Joe, hey, you know, you can pick this stuff up for a song. If you want to collect something, try this.  And he began seeing what we could collect. And we never paid much money for these things. We got them at flea markets. We got them from dealers in scientific instruments. We got them, Joe was in a network, a very informal network of people who knew and were keeping track of who had enigma machines in private hands. And every once in a while we'd hear somebody was ready to turn one into cash. And so we bought the three-rotor enigma first. And then he lusted for a four-rotor enigma and he got that through this network. And as I remember, we went to London and, no, that was another machine. He was in touch with this man. We sent a check. It was probably the most expensive machine we bought. $10,000, which now, of course, there are hundreds of thousands of dollars at auction. But that was rich enough for our blood. And that was the pièce de résistance. And we got other things, too, but mostly we just picked them up cheap. I can remember being out in an orchard. We'd gone to one of these U-pick apricot orchards and I walked in to pay for the apricots we were getting and I saw this old calculator and I said, oh, that's cute. Would you think of selling it? They kind of looked at each other and they said, well, it doesn't work. It works, but it's not very fast. They had an electronic one. I said, oh, well, it's kind of cute. What would you consider? And they said, well, 50 bucks. And I said, 30. And we settled at 40. And that was typical. We'd just buy things on the spur of the moment. And nobody had any idea that these had any value. It was just this tiny coterie of collectors. Because England could not produce enough food to feed the population, for years it had been relying on food coming in from elsewhere. And when I was born, those shipments had been curtailed tremendously. And I was close to starving to death. My mother didn't have enough milk for me because she wasn't getting enough food. And unbeknownst to us, Alan Turing down there in Bletchley Park was figuring out where the U-boats were and how to bring convoys of food into the United Kingdom so that we wouldn't starve to death. And so I have a very personal connection with the enigma machines. I am, is the word proud, grateful that I've had this long connection with artificial intelligence. It has been a splendid, shaping gift for my life. What an opportunity to be in on the ground floor. I mean, how lucky can you get? So I'm also grateful for my luck. I'm grateful for having had a very happy marriage to one of the greats in the field and just having a wail of a good time the whole time. I'm grateful to have been in on the ground floor, but I'm really envious that I'm not going to get to see it go on because immortality is a fact. So just, what fun I've had, what fun I've had.


The 2020 NFL Scouting Combine is the next step in the off-season. General Manager John Robinson, how many different things are you and the personnel staff and the coaching staff taking part in here in Indianapolis? Yeah, I mean we've got a pretty extensive staff here.  So, you know, we get some FaceTime with these prospects. Our doctors and trainers can visit with them and get the medical background. We've started the interview process. We get to physically sit down and talk to them, not via a computer zoom link or whatever kind of webcast you're going to do it on, which is always good. And then the workout portion, you know, here at the end of the week, is we'll get to see these guys move around a little bit. How good does it feel to be able to have those in-person, kind of old-fashioned one-on-one conversations, as opposed to having to navigate some of the software and the technology that you've had to in the last couple years? Yeah, back to normalcy. You can read body language. You can, you know, try to pick up on mannerisms. You can, you know, try to press this button on a certain player to see how he's going to react. You know, ask him some of the tough questions that, you know, why did you not finish on this player or why did you go the wrong way here, as opposed to having to do that through a zoom iPad, whatever. It's just hard. So it's good to be back to the way that we're typically used to doing it. What are the strengths of the 2022 NFL draft class? I think there's a lot of good players. You know, we saw a lot down in Mobile. We saw some out at the East West Shrine game. And you've got the, you got the underclassmen added to the combine. There's a lot of different players at position groups. You know, I think that the receiver group, there's some players. I think the tight end group, there's some players. I think the O-line group, there's some players. You know, it looks like the linebacker group, specifically the edge position. There's a lot of players that can play on the line of scrimmage. So, you know, we'll continue to, to mine through and dig and try to find players that can help our football team, you know, in all rounds of the draft and even the post draft process. Before you get to the draft, though, there's a lot to journey through free agency starts. When can fans start to really see some of that stuff start to pick up and see some movement out of the Tennessee Titans? Yeah. I mean, we'll start, you know, free agency will be here in a couple of weeks. You know, we're having some, some talks now with our current players. They'll start that window when we can talk to, you know, representatives for, for other players on other teams. We'll see kind of how the market unfolds, you know, on a lot of those players. And, you know, that will really dictate how quickly we jump out of the gate or we just kind of sit back and wait and let the market kind of come to us. John, do you remain optimistic about Harold Landry staying with the Titans? Yeah, we'll see how it goes. You know, we've got some productive conversations. Harold knows how, how we feel about them, but it's a big puzzle that we have to put together. There's, there's a lot of pieces and you have to be creative to make sure that you're allocating your resources correctly. And, you know, Harold's an important resource for us and we want to try to keep him. He, he's tough. He's smart. He works hard. He's been a productive player for us. So we'll continue those conversations and hopefully we can get to a, to a resolution. How do you balance wanting to preserve what has been a successful roster and keep those main pieces, but also acknowledge that maybe there can be a benefit to infusing some outside blood into a locker room? Yeah, those are always hard decisions. You know, the decision that we made on Jarrell Casey, I love Jarrell. That was a hard decision that we had to make, but one that we felt was best for the team at the end of the day.  We've got a lot of, you know, we've got good football players and there's, there's other teams that want to get those players and try to get them on their team. And, you know, you've got to be mindful of turning the roster and, and continuing to try to infuse younger players. With your salary cap situation being tighter, and I don't know what the exact number is, but obviously you don't have $50 million in cap room like some teams do. Are we going to see the priority just be on the current Titans more so than going out and going crazy on March the 16th when free agency opens? Yeah, we'll see how it goes.  And those are some of the decisions that we're working through now and the decisions that we'll have to make as we inch closer to the start of free agency. The Titans pick at number 26 and then not again until number 90. How does that play into the equation and all of the puzzle pieces that you're moving around knowing that there could potentially be some wiggle room in there somewhere? Yeah, it's a long time to wait.  Yeah, but certainly the draft picks way into and, you know, we'll get closer to that in April after the pro days and the final meetings about where we see those players maybe falling, you know, is he going to make it past this team at 20 or 21? Do we need to go get him? Or I think we could slide back three picks and get the same player. We have not spoken with you since Amy Adams Strunk gave you and head coach Mike Vrable contract extensions. If you would just acknowledge, you know, how that makes you feel personally and also what you think it says for the organization's position right now. Yeah, extremely blessed that we have her family and trust and the confidence in the direction of the football team. I know our entire staff works extremely hard to put a product on the field in the community that they can be proud of. And, you know, just extremely blessed to work for her and for the way that she allows Mike and I to do our job. So can't thank her enough. And that consistency must be incredibly helpful, not only for the football aspect of it, but for the organization as a whole. Well, I think, you know, that's what we, you know, we talk about building a foundation and, you know, I feel like we've got a good foundation, certainly on our football team players wise, but also organizationally staff wise, you know, that we can continue to build on and improve. And we do a lot of things well and we want to try to do them even better. And there's some things that, you know, I personally got to do better and that we've got to do better. And we're going to try to improve on those things. It's funny, as Amy and I've been here during the last seven years that you've been the general manager, we see a different field towards the Titans. There's certainly respect for what is being done. There's certainly an admiration for being done. It's a different sentiment that we get from other ball clubs. Do you sense the same things from agents, from college players, from other teams that you speak with? Yeah, I think so.  It's hard to win a ballgame in this league. When you look back at games, you know, I was watching some before we came to the combine, there's a lot of teams that didn't have great records that were playing teams with really good records, that going into the fourth quarter, it was a close ballgame. And the team with a good record ended up winning somehow. And that's pro football. And, you know, we've been able to find ways to win and be a competitive football team and be a consistent football team for the last six years since we've been here. And I think that, you know, teams do recognize that because we, in this NFL football environment, we understand how hard it is to win in the national football league. John Robinson with us at TennesseeTitans.com.


Just look at how cute this waffle maker is. We love Boba at Berkeley a lot, maybe a little bit too much. I highly recommend that you get one. There are a few other gifts. Hi guys, it's Ariana with CalTV Entertainment and today I'll be giving you a list of fun holiday gifts that are $15 or less. The first gift is this Boba themed AirPods case. I know that we love Boba at Berkeley so I think that you guys would really enjoy this gift. It's the perfect gift for pretty much anyone on your list. It's available at Urban Outfitters and Smokonow.com. I think that especially this year, journals make great gifts. There are a lot of different styles to choose from and any of them would be wonderful but today we'll be talking about this one. Okay guys, here's what the journal looks like. It's called Calm the Chaos, very appropriate for 2020. Inside, there are prompts that you can answer. The journal is available at Target. I highly recommend that you get one. There are a few other gifts from Target. This mini waffle maker, just guys, just look at how cute this waffle maker is. It's only $10, it's available at Target and it comes in various designs. I don't know about you guys but I love candles. So I picked out two from Target that I think you'll like. They can both be personalized for the person that you'll be giving it to. The first comes in different astrology signs and the second one comes with different birthstones on it, someone's at the door. Look who it is guys, it's Layla, my puppy and we have matching jackets. What do you think people should buy as Christmas presents? Okay, great. The last gift I have for you guys is this 2020 toilet paper ornament from Etsy. It's a great gift for anybody on your list. It'll make them laugh. They'll remember 2020 forever and what a great year it was. Again, this is Ariana with CalTV Entertainment.


Hey, welcome to Rotate Roots Right Round using CertManager for safer private PKI. You don't need to know what CertManager is and you don't need to know what PKI is. Hopefully by the end of this you'll know and want to use both of them, but obviously it will help if you do know both of those tools. I'm Ash, here's a picture of me with a lot less hair. I'm a senior software engineer at Jetstack by Venify. I've provided a load of ways you could reach me here. Feel free to reach out, I'm happy to talk. Always interested in talking about certificates to the point where actually I did a live stream recently where I was described as a professional certificate nerd and I'm kind of going to wear that as pride and take that as my new title going forward. I'm also a CertManager maintainer which is helpful because I'll be talking about CertManager a lot in this talk. Without further ado let's jump into it. What is CertManager? We need to make sure that everyone's on the same page before we start. CertManager is the easiest way to automatically manage certificates in Kubernetes clusters. We like to say this because it's kind of a guiding mantra for us. We're trying to aim for this in everything that we do. You can actually see this quote at the beginning of every CertManager release that we create. That's because, well technically it's because when we share the release on social media this is the line that we want people to see. There's just a little insider detail but this really does matter to us and it's what we try to do. CertManager is a CNCF incubating project. That's part of why I'm here today at KubeCon. But it's also kind of unique in its role. By that I mean CertManager is really the only tool in the CNCF as far as I can see which kind of does what it does and that is it helps you to manage certificates on Kubernetes. We've also recently reached the milestone of hitting 10,000 stars on GitHub which is a really different kind of achievement to being CNCF incubating but still really satisfying and cool one and we're really chuffed about that. The core of CertManager is really the issuer. By issuer I mean how does CertManager know where to get certificates from and that's a decision that you get to make. In this talk we'll be talking about the CA issuer which is built into CertManager but actually there are loads. Here I've given an example of HashiCop Vault, Venify which is my employer and Let's Encrypt. Let's Encrypt or ACME is probably the most popular choice for CertManager because the certificates it produces are publicly trusted i.e. most devices including the computer on recording this on will have trust for Let's Encrypt without even needing you to install anything and that makes it a very attractive choice. It's not an appropriate choice for private PKI which we'll see later. So what's PKI then? I've mentioned it a few times and we need to know what that is first. Well it stands for Public Key Infrastructure but that doesn't really help much. PKI can basically be thought of chains thought of as change chains of certificates. Private PKI simply means PKI that you control that is a certificate chain that you have full control over and you can do what you like with it. You don't have control over the issuers used by say Let's Encrypt or DigiCert but you can have control over your own. The advantages of this are many. One is that it's cost effective so some issuers especially older ones will charge for issuance or there are other tools that will have a cost associated with them. Private PKI has none of that. The only thing you're really paying for in Private PKI is the cost of the machine to do the actual cryptographic work which is not nothing but it's pretty much negligible in the grand scheme of things. Obviously there are other choices for issuance that are free though. So mainly the bonuses are that first of all you get total control over the certificate you issue. That means you can do whatever you like. If you wanted to use Spiffy which we're not going to go into today but if you did want to use Spiffy well Private PKI lets you do that. You can totally issue a Spiffy S-Fit if you want or any other type of certificate. There's also no artificial rate limits here. There's nothing wrong with the fact that Let's Encrypt has those. They use it to defend the service and I love Let's Encrypt but it can be frustrating if you run into their rate limits and it can cause you problems over a time period. You don't have to worry about that here. And just in case this certificate thing that I keep on talking about is going over your head, certificates in this context of what we need to do TLS or SSL. Many or in fact most services today need certificates. That's because they want encryption in transit. When there's data going over the wire we want it to be encrypted protected from attackers, protected from modification, all that good stuff. That applies just as much in Kubernetes whether that's inside the cluster with pods talking to each other or with traffic coming into the cluster. We almost certainly want any publicly facing services to be encrypted at the bare minimum at the bare minimum. So I mentioned earlier about certificate chains and this is what usually a certificate chain will look like. For example this is what Let's Encrypt has if you're getting a Let's Encrypt certificate for your device. Usually there's some sort of root certificate and that certificate will be self-signed. That's often a confusing term and in this context it's important for me to define that. Self-signed simply means that the certificate's public part has been signed by its own private key. It doesn't mean private. In the context of private PKI means PKI that you control. So we will be using self-signed certificates for this but Let's Encrypt's root certificate is also self-signed. So I'll be careful to talk about private PKI going forwards. So a root certificate usually issues an intermediate certificate. That's because the root certificate tends to live offline. For valuable certificates like Let's Encrypt their root will be stored in some secret place where it's not connected to the internet ever to reduce the attack the attack surface of it. We don't want it to get stolen that would be terrible. So the day-to-day issuance tends to use an intermediate certificate and that intermediate is the thing that will issue the leaf certificate. That is sometimes called an entity certificate if you're interested. The leaf certificate is the thing that has our identity in it. That's the website that we're trying to identify or the email address that we're trying to use our certificate for. Whatever you're using your certificate for the leaf certificate is the thing with the identity in it. So ultimately it's the goal of what we're trying to do. Like I said traditionally it's the intermediates that do this and roots are stored offline. Roots are then only used to issue new intermediates but that's not required. We won't be doing that today. Roots can absolutely just issue any kind of certificate directly they're marked as CA certificates which means they're allowed to sign any other certificate and what's best in what kind of architecture you want to use will depend on you. That's a choice that you get to make. So although I'm very passionate about the topic of PKI and I find it super interesting I would be remiss if I didn't talk a little bit about the risks. It's not a free lunch here and we do need to think about what the risks are that we're trying to deal with with private PKI. There are serious issues like this is not simple necessarily although I'm going to try and make it as simple as I can. It is important that you think about these risks when you consider deploying a private PKI. That's not to say you shouldn't I think everyone should try it but you do need to think ahead and avoid from causing outages or security vulnerabilities down the road. Some of the risks I'll talk about are specific to cert manager and some of the risks will mitigate using tools in the cert manager suite to get around those risks and some are just true generally of PKI and there's something we would have no matter how we issued our certificates. First risk is not locking things down. We need to make sure that people who can request certificates aren't allowed to do that for certificates that we don't expect, the certificate types we don't expect that is, or for domains that we don't want them to get certificates for. If we don't lock down issuance in cert manager someone could use a CA issuer to issue any other type of certificate including their own CA certificate. They could then exfiltrate that out of the cluster and sign other certificates that will be trusted by anyone that trusted our route. We can't allow that that's not great but it can be mitigated using a prover policy. If you've not heard of that we'll talk about it in a second. Risk number two is a huge part of what I'm going to talk about today and that's rotating route certificates. It's easy to get this wrong there's a lot of ways to shoot yourself in the foot and unfortunately it's one of those things that just requires a plan. You have to have a plan for how to do this and it's tricky to automate it which makes it fiddly but we'll cover that. By the end of this talk you'll know what to do. The third risk is trust. If you don't mitigate this then your certificate will be useless. If nothing trusts your new shiny certificate you can't use it to sign anything else. So there are subtleties here relating to rotation I've just mentioned but fortunately we have another tool trust manager and that can help in this situation but you still need to prepare for the thought for trusting certificates and you need to have a plan going forwards. As I said we'll mitigate these risks it's not a showstopper but we do need to have a plan and that plan does need to be production ready I don't just want to talk about something that you can't use. So we'll do our best. So let's start off and let's see what a safe private PKI will look like. First thing with seeing what safe private PKI looks like is to not just copy from these slides. There's a repo there's a QR code on the recording here. I'll have another that QR code showed again later but don't copy from the slides. The examples I'm using here are not full. You'll see it's just an illustration but there's a full guide available in this repo. So the first step is issuance. How do we actually get certificates signed? Well the simplest approach here is just entirely in cluster. By that I mean we just use cert manager to create a CA issuer that will all live in the cluster they'll live in a Kubernetes secret in fact. We could just use cert manager we don't need any other tools to do this but bearing in mind the risks that I mentioned before it's actually safer to use both the proof of policy and trust manager for this use. There are other ways of doing this you could sign an offline route we're not going to consider that just now. And this is what root certificate looks like. This is using an issuer ref which points to a special kind of issuer called a self-signed issuer. That just means we'll get a self-signed certificate which again just means root certificate. You'll see that I've just used an uninventive name of root certificate here. You could customize that if you wanted to. I'm not trying to be too fancy here I just want to show you the idea of what we're talking about. You might notice that I used a 25 year long certificate in that last step. That's totally fine for root certificates. As long as you have rotation policy the fact that it's long lived isn't really a risk. Again feel free to use descriptive names but coming back to that sort of long lived risk problem the only real risk here is maybe quantum computers breaking our certificate but in that case we still need a rotation policy to distrust the old certificate that's been broken by quantum computers. So don't worry too much about the lifetime it's kind of fine. Once we've issued our certificate using a self-signed issuer we actually just create a cluster issuer which looks very much like the example I showed earlier. We're just pointing to some secret in the cluster and this issue will then be able to issue all the kinds of certificates. It's that simple to get issuance set up but this on its own is not safe. To make it safe we need policy. Policy is here to prevent several things. One is that I mentioned earlier people could now just request a CA certificate from this CA issuer that we just created. They could also just request any domain. They could request a certificate for google.com or cncf.io say and if the ifapod trusts your awenu root certificate it would then trust a certificate issued for google or the cncf so we shouldn't really allow that. We also have to look at lifetimes. Lifetimes for root certificates can be pretty long because it's not really an extra risk there but lifetimes for leaf certificates were different stories since leaves are much more likely to be stolen. Ideally if one is stolen we want it to be valid for as little as possible and this is what a policy looks like using approval policy and cert manager. We have a certificate request policy crd and this policy here says that we are not allowed using our root issuer to issue CA's but we do require that the certificate that we're issuing has a common name and it has DNS names and they may have any value. We also say that the max duration of a certificate may only be 48 hours so we set an upper limit there. In production you should probably restrict to the DNS names here if you can do that in a reasonable way and you should try and keep the max duration as low as possible but that will depend on what your operational constraints are. I can, I should say again that you really shouldn't be considering running private PKI without something like this. It doesn't have to be this but you shouldn't just allow anyone to issue anything that could be dangerous. The final component of running our private PKI is trust. Trust is essentially answering the question well how do we use our root? Pods in Kubernetes will need to trust it and they need to trust public certificates as well. We get is no good if our root is trusted but people can't connect to GitHub anymore for example. That's where Trust Manager comes in which is another project that we have. It's also kind of my baby and I kind of really care about Trust Manager so I really hope you try it. Trust Manager adds yet another CRD in this case the bundle. In this bundle we've specified two sources. We specified the default CA's which come bundled with Trust Manager but are easy to update. That's the publicly trusted bundle that we have on all of our devices. You can just use the same one. We also specify a config map and this points to our trusted certificate which we issued in the first step of this. If you look at the example repo for this we'll go into some detail about how actually that config map gets created but it's not particularly interesting so I won't show it in the slides. This bundle will cause a config map to be created in each namespace so pods can then mount that resulting config map and they'll trust ACA because it'll be in the trust bundle that they get. This bundle resource means we only have one thing to update when we need to update trust. That's super important even if we weren't doing private pki that would be valuable. It means that we can avoid rebuilding every container if we need to update the trust bundle because today most containers bake this in at build time. If there were a vulnerability in a trust store you'd need to rebuild all of your containers. Trust manager gets around that even if you don't look at private pki following this talk I highly recommend that you do look into trust manager because even if you're not running private pki I think it's really important. If you are using private pki though it's worth saying that your root certificate will have a ca.crt field which has the root in it. That's the kubernetes secret that got issued as a result of our self-signed certificate. Don't use it directly. This is a really subtle interaction but if you use that directly and the cert is changed in place your trust will automatically update because it will be pulled from that secret. That would break any running application that relied on that trust to exist. Instead it's much safer to copy the certificate into a config map and the example in the repository does show this. So cool we've got a certificate, we've got policy in place and we've got a way of trusting it. So how do we actually scale up with this and how do we get it going and operationalized and running in production? Well really there's a main thing to consider here and that's the elephant in the room which is rotating roots. It's the tile of the talk I had to come back to it at some point. Before we start this like it's worth addressing that alternative architecture that I showed that lets encrypt users where you have an intermediate certificate and you may well think well rotating an intermediate certificate is actually a lot easier and that is true it is generally easier but the context is important here. Rotating intermediates in a disaster is actually really hard. If an intermediate is exposed generally it will have a reasonably long lifetime and you have to sort of rely on revocation revoking the certificate to be able to get rid of it. If you can't rely on revocation then you need to rotate your root certificate anyway so you need to have that in place ready to go. So you may say well what about revocation maybe I can use that and it will work maybe you can but it's very very hard to actually get that working. Most places don't try in the internet it generally doesn't work well and even if you do get it working it's very unlikely that you'll get it in place such that you can defend against all possible attacks. My it's not even a hot take my lukewarm take is that revocation is simply not worth it and you can't rely on it so don't. So if we can't use revocation we need to have a root rotation plan and our assumptions for that are that we'll have no downtime for a regular rotation and we'll automate this where possible. When I say no downtime for a regular rotation if you have if your root certificate is exposed you may want to distrust it immediately and that could cause downtime but that's an important and powerful tool to have. If your certificate's been exposed you don't want to trust it any longer you want to fix it as soon as possible but if we're just doing a sort of regular once a month practice run of our rotation policy then actually we don't need to have any downtime at all and we'll see how to achieve that. So this is the simple sort of five step plan for a safe root rotation this is what you need to have in place for your organization if you're running a private pki. First we can't rotate the root certificate until we have something new to rotate it with that's a simple thing like in the in the repo associated with this talk you'll see an example of this it's nothing nothing complicated at all then we need to trust that so with trust manager that means adding that root to the bundle again we'll create a separate config map and then trust that config map in our bundles sources. Great third we need to ensure that everything is using that new trust bundle that means that every pod that mounts that config map probably needs to be redeployed we'll come back to this step. Step four is to shift issuance to the new root by that i mean if you're creating a certificate off the old root you should now create your certificate using the new one once this has been done nothing will be using the old root anymore and that leads us to step five where it can be removed. This seems simple it's a simple enough plan but really there is a warning sign on step three this is why it's so difficult to automate and why you need a plan. Anything outside of your cluster that trusts this root also needs to be updated to also trust the new root. The issue here is that inside the cluster it's very difficult to specify where the root is being used because it doesn't need to call back into the cluster. If you copy that root out which is totally valid although i wouldn't recommend it you could be using that Roots of Issue certificates anywhere or if you're just using certificates in your cluster to access services outside the services outside may know of your old root but won't know of your new one until you manually update them or create some system by which they will be updated. Don't underestimate this step is what i'm saying you need to have a plan here. So within Kubernetes in summary you can redeploy everything because trust manager will allow you to update your config maps in each namespace and then a redeploy will ensure that each part has picked up the new trust store so step three becomes simpler. If you're outside like i say you need to keep track the actual process of updating the bundle i should say is very simple you just add a new source it really couldn't be simpler and trust manager really helps here but the main theme that i should get across to you about rotating Roots is that there's no one answer here.  In fact the key points of this talk are that your architecture matters a great deal if your architecture is such that you have one cluster one god cluster that has everything in it having a root just for that is totally easy to do and easy to get started with and if everything's running inside that cluster you can use tools like trust managers and manage that and approve a policy will handle everything for you as well obviously on the policy side. But if you're using a multi-cluster type situation which obviously is very common nowadays maybe even you're running in multiple clouds if you want those clusters to talk to each other you have the problem of distributing that trust across different clusters that doesn't necessarily come easily trust manager can help when you've got all of your config maps created in each cluster but it doesn't solve the problem entirely because you still need to get those config maps created without planning this there's nothing but you can do beyond say like you need to think about it it is worth me saying that it is possible to create a root certificate which issues an intermediate certificate for each cluster then you only need to distribute that root across each cluster and they'll all trust each other because they all chain to the same root and that's how TLS trust works that is a possible architecture that you could go with the only potential downside with that is that if you have this one root and you issue a new intermediate for each cluster you then need to have access to that root every time you create a new cluster so you may if you're storing a root offline have a manual step where you actually need to go and like unlock a safe and get out a raspberry pi to issue a new certificate to create a cluster obviously that's not a particularly automated thing it's something you need to think about key point two really is that rotation is key and this really is the main thing i'm trying to get across here whether or not you're using any kind of particular architecture you need to plan how to do rotation this is true of any secret but PKI just makes it even more true rotating routes is not that hard it can be time-consuming to make sure that everything is using a new root but trust manager makes it simple to distribute things the main thing is that you need to practice it and you need to have a plan and if a root is exposed you may well need to do this in an emergency so planning it and practicing it regularly is a great way of ensuring that you have the skills to rotate when you need to the other main point is that revocation is not a reliable way of doing anything like i said before you need to have a plan for rotation whatever you're doing so you can just kind of lean on your plan for rotation to get around the fact that revocation can't be relied upon i would suggest you don't even try to set up revocation it's probably going to be really hard for not a lot of gain get a good rotation plan in place instead that does mean that anywhere where you go on to trust your root certificate in your private PKI you need to know about it so you can revoke that trust and you need to have a plan for how to update trust on that thing that you're using your root CA on finally i guess my actual main point is that you should try private PKI and that if you're running cert managers today you've already got all the tools you need to start on a basic level and at the very least you're going to learn something i think it's really fun to play with this stuff and that's how i got into sort of certificates and public key cryptography is that i think this is cool so give it a go maybe you can leverage that to then save some money or time it also enables all kinds of other cool things like you may intentionally want to perform a man in the middle attack on certain connections you may want to do just thousands of certificates and this will give you the freedom to do it just give it a go it can't hurt here's that same qr code that's been on the screen the whole time i highly encourage you to check out this repo if you do do that please feel free to open an issue or leave a message or do anything like open a poor request i would like for this repo to become a useful resource for people and i hope it's useful for you thank you for listening to this i really appreciate the opportunity to talk at kubecon EU so shame i couldn't be there in person but the main thing i appreciate is the ability to spread the certificate gospel i really hope this is useful to people i hope you've enjoyed this thank you very much enjoy the rest of your conference


We will see about the NFS setup, NFS is network file system. So you have a server where you store all the files and say you want to access those files by logging into any other machines. So you share those files using NFS. So NFS file system does what it does is as it says clients are it is a client server system that allows users to access files across the network and it treats them as the local file. So user will not know that the file they are accessing is on actually on the server. They will think that it is on their local machine. So for the sake of this example there are two machines provided to each everybody one is the NFS server and another will be the NFS client. So for this demonstration OSL 4 this machine will be used as NFS server and OSL 5 will be used as NFS client. So who are working on the servers follow these steps. The deep packages are stored in this URL. The last three are the deep packages for installing NFS. You download them in your home directory then in OSL 4 run these commands. These are the package names. So you have to give the path where these packages are stored. As most of you have stored these packages in the home directory just these commands will be enough. This DPKG command will install the deep packages. So copy paste this command in the terminal you have to give the path where it is stored. In the handout the command is given. So go to the path and do port map write PORT and click tab. So it will complete the name you do not have to write the complete name manually. So first package to be installed is the port map press enter. So we will use apt-get to install the required packages for NFS. You go to this URL after going here download this sources.lst file. Right click save link as save it in your home directory. After you do that open a terminal that is applications accessories terminal we have to copy the sources.list file that we have just downloaded. So cp is the copy command as you give the path of sources.lst as we have saved it in the home directory. I am giving sources.list it should be copied to slash etc slash apt slash sources.list use sudo for both server and client should do follow this procedure. After copying this file we have to update the repositories. So use apt-get update command it will update the repository. Open a terminal go to applications accessories terminal you will get this screen. Go to super user mode using su enter password is reset to root 1, 2, 3. Root password is set to root 1, 2, 3. After that for server installation we have to install some packages. The packages in Linux are installed with this command apt-get install and then the package name. So here we are installing three packages for NFS server. One is NFS kernel server, second is NFS common and third is port map. So write these commands as it is press enter. It might ask for yes no confirmation press y and press enter. There are three packages it has to be written space separated port map is 1, NFS common is second and NFS kernel server is third. Next thing is what we have to do is we have to create a file in server and that has to be ultimately shared using NFS with the client. So we have basic purpose for our server now is we have to create a directory and in that directory we will create a one file. So as you see in the slide we will create a directory called slash extra slash dir. So for that write mkdir slash extra slash dir. By the way who is running server should do this thing. The one with the server machine there is client server player. So one should install client and one should install server. So the server machine should do this thing. So make dir space slash extra slash dir now for the server machine see what is your IP.  So you have shifted to this directory now create a file using VIM so VIM some name say abc enter press so that you can write in this file write something some word say nishant to close this file press escape shift colon wq. Now this is the file we want to share on all the clients which we will install in future. So the after creating this file open one more file VIM slash etc slash exports slash etc slash exports it will open one file press I to insert the insert into the file open slash etc slash exports file with using VIM so open this file press I to write into this file then see the handouts you have to enter the first entry this entry into the file only the IP is to be changed so write slash extra slash dir space your IP address that you got from if config command so my machine is acting as a server so I am writing <IP_ADDRESS> remember these commands are to be done on the server side only okay since you are using different machine let me restate my statements after opening this on client machine run if config command on terminal and note down the clients IP and this thing is to be written in the exports file let me state again in the slash on the server side in slash etc slash exports you have to write clients IP what this statement means is this directory is to be shared on this client machine using read write permissions so let me restate on server side in slash etc slash exports file you have to write clients IP address yeah on server side in that file you have to write clients IP address is everybody done with it okay next thing so here understand you have created this directory on server side and you have given permission to this machine that is client machine to have read write permission to whatever is there in that directory this is the meaning of this complete line come out of the file then you have to start a service it is given in the handout slash etc slash init dot d slash nfs kernel server restart nothing is to be done in the client side till now client will not do anything for now the services will start giving message okay so I hope you have run this command to start the nfs server next thing to do is run the last command export fs export fs minus ra after this you have enabled the access for the client machine to read and write the files in the server so now we have to set up the client so servers server side is done now you the client's client machines will follow the next procedure I will log in to the client I had specified this IP as the client so I am logging in there to set up the client side you do not need to do to do this in the next slide of handout you will see these commands this is for nfs client installation so run the first command abgate install nfs common and port map this is to be done on the client side after that the packages will be installed you now have to create one more directory in the client side mkdir slash root slash temp you go to this directory with CDs slash root slash temp and do LS you will find that there is no file we are just created the directory and after doing LS there is no file in that directory now we run the third command this mount command will mount the directory so what this command will do is it will mount this directory which we have created on the server side so this is the server at IP address so this directory from this server will be mounted at this place on the client side this command is to be run at the client side and the IP address given here should be of the server side because we are mounting this directory from server at this client path press enter now do LS you will find that previously there was no file in the root slash root slash temp directory now the file which was created on the server this ABC will be listed on the client side you can open this file from the client side and see the content the file see still research in the at the server side but client doesn't know client thinks that it is in the in his local file system that is slash root slash temp but in the reality we have just mounted the file from the server at the client side now open the file again from the client side make some changes in the file press I write something else in the file save it using escape shift colon WQ now go to the server server side open the file at the server side and you will see the changes reflected back at the server side also out of this file now as we are mounted this file system using mount command at the client side so after we restart the client this changes will not do I will not be reflected so to make the changes permanent so that after each reboot of the client this system this file system to be mounted on the client side you need to change the fstap file the file is slash etc slash fstap open this file on the client side slash etc slash fstap it will list the currently mounted file systems so at the end you can write one more line that is given in the handout if you write this line in the fstap of your client machine after each reboot of the client this changes will be made and you will see the changes permanent so here server side IP is to be given so that it will mount the server side directory in the clients this directory and after each reboot you would you do not have to do run the mount command again and again we will not do that actually because it requires rebooting the system and see this thing so what we have done is current now we have installed NFS server and we have created a directory in that directory we have created a file we have installed NFS client machine this NFS client is used to mount the directory from the server side to the client side and the we can we have seen the changes that was done in the server side reflected back at the client side and as we have shared this directory in read write mode the client side the changes which client makes are reflected back at the server side also so this is the NFS setup


Where are all the black swans? Meet Misty Copeland. She's a black ballerina. Like most ballerinas, she has studied extensively to master her craft. Her dream is to become principal dancer, the highest-ranking ballet. However, most ballerinas with this title are white. Misty wonders why? Well, to answer this, we would have to travel back to the beginning of ballet. Ballet originated in Italy during the Renaissance period. It was then introduced to France when Catherine de Medici of Italy and King Henry II of France got married. With ballet's original audience consisting of royal aristocrats, only white swans would dance. However, today's ballet audience is more diverse, which creates a need for dancers of all ethnicities. After dancing for 16 years, Misty's dream comes true. She is now the first African-American principal ballerina in the American Ballet Theatre Company and wonders what changes should be made to make the Swan Lake more diverse. For starters, change should begin at the training level by making ballet more accessible to students and communities that are underrepresented on state. Having dance schools, teachers and professional dancers provide the right kind of support will help all swans reach their full potential. Through hard work and perseverance, Misty has become a pioneer in ballet. Her efforts have helped create a lake for all audiences where all swans can equally shine.