hey guys welcome to my channel please put a like and subscribe if you are new also go over to my other channel moon pie tarot where you can get daily collective reading my readings always start on the 30 minute mark you can come in earlier if you want to wait chat with everyone but they always start the 30 minute mark so just pop in at the 30 minute mark the reading will begin all right let's get into your reading hey Virgo all right you guys let's see what's going on for you I'm gonna take a look at the next 30 days so the time you're listening to this reading until oh let's see November 25th okay all right let's get into this what is Virgo need to know also go over to my moon pie tarot channel if you want to get collective readings what the hell you got this the other day come on the mirror hold on I gotta switch my glasses out can't see damn thing I say it every time mirroring each other self-image relationships reflect our wounds and introspection okay you got the chaser okay okay the sword and the rose an addiction okay so you and a person are mirroring each other you're both chasing each other now that doesn't sound like your situation does it fear of abandonment issue okay um okay hold on give me a second I need to entreat it I need to entreat it clarity truth revelation so solidarity force honor protection power and addiction codependent obsession possession controlling has a black has a block restraint okay perfect this is exactly what it is coming to terms with you both chase each other but not simultaneously you both have a fear of abandonment but you both have a fear of getting close so you both do this little dance where one of you gets real close because the other one is avoidant so when one becomes avoidant it's because they're feeling too close so they pull away and then the other one has a fear of abandonment so the one who's fearful of abandonment chases and then the one who's afraid of getting close runs even further so the one who gets tired of chasing says I'm not chasing anymore and then retreats and then the one who's avoidant is like okay well now I've had enough time out here in the desert by myself where's Virgo or where's my person and looking around nobody's there so the avoidant turns around and starts chasing and the one they're chasing has now become avoidant so there's this chaser runner back and forth mirroring each other but not simultaneously so you both are like holding the mirror but you're both looking into it at different time is there anti simultaneously you're both looking into you're both holding the mirror but looking in it at different times it's a two-sided mirror I don't even know like you guys that there's an addiction to each other you can't let each other go because you've created this dynamic there's a dynamic that has been created in this relationship now this dance this paradigm you've got this dance now where the only way to break this cycle is you don't have to leave the dance floor you just have to stop dancing you just have to stop dancing that's all the dance consists of freaking out because of fear of abandonment or running off the dance floor because of avoidance the only way to break the pattern to break this cycle is to just stay where you are and don't dance you can't have a dance partner if they're on and off the floor all the time like what are you doing well I'm just getting a drink okay but we're in the middle of a dance now I'll be back in three years okay I'm just gonna stand here if somebody else comes up and asked me to dance I'm dancing with them I'm not running off the dance floor I'm here to dance baby so that's what that's what I feel like is happening here with this and it's just wow boing big-time realization big-time realization here like holy shit that's what's going on I'm in this addictive cycle with this person so they're running off the stage and I'm chasing off the dance floor and I'm chasing them and chasing them and chasing them and we're running all over the building and running around the block and then running through the town in the streets and this person and I'm tired I'm tired and I'm tired I'm tired so now I'm leaving and I'm going home and then you go and then this person goes back to the dance floor and you're not there nowhere to be found and then they start chasing looking after you and you're nowhere to be found and then they get tired and they stop chasing and chasing and then you're like where the hell are they and then you go back to the dance floor they're not there in this cycle every once in a while you guys actually come together and you dance for what five minutes out of ten years six years four years I don't know what's going on enough is enough look at this you got the seven of wands don't get close to me don't stand don't stand so don't stand so close to me this total avoidant right here total and you're both in and out of this energy it's not just one you're both in and out because you share this energy mirroring each other and if you're like that's not me at all then it's not your reading and it's okay it doesn't have to be you and that's why I say in the readings don't force it to fit if it's not you then it's fine it's not you I'm fine with that it's totally okay with me so this is avoidant somebody's avoidant here this is the avoidance dance like push back push back push back don't stand so close to me don't get so close you're stepping on my toes I can't breathe you remind me you're like my mother I'm your but you're not like but but but the you're not but I'm I'm afraid that you're gonna be like my mother because my mother was smothering I had a smothering mother my my smothering mothering my smothering mother my mother was smothering me all the time so whenever I see a mother I think she's gonna smother me but no that's not what's happening the Empress in the upright is not a smotherer somebody's just got PTSD from a smothering mother or yeah whoever someone does so that the for soon as they see that or as an ex and as soon as they see that they're like they go into like you know fight or flight or fawn mode they panic somebody's in fight mode they push back or they flight they take off it's definitely not fawn mode or freeze definitely not freeze it's fight mode they push back they run away nope nope nope nope okay there's a page of swords oh the try the clothes are done oh my goodness this is like this craziness this is an energy of someone who is like go away but let me know where you're gonna be go away but keep your Wi-Fi on so I can keep tabs on you keep your distance but don't go too far stay away from me but let me know how long you'll be gone what the hell's going on this is this person or maybe it's you Virgo I hope not but if it's you we have to talk you need to call me sure you you can be free yeah you could do whatever you want I'm not jealous I'm not spying I'm not looking now I'm not doing it I'm not like that no I want you to be free I want you to be happy where are you going who are you going with who are you talking to can I see your let me see your phone it's very back and forth this is a very back and forth this is very unstable and someone here is not unstable this is someone here is very stable I don't know who it is but someone on the outside I don't I don't know it's like turns I feel like this whoever this is it must not be you Virgo I don't know they're giving me this back and forth energy I feel like you both take turns I feel like when one person gets super super super insecure the other person feels very secure and stable and it's like fine and then it's it flips so I feel like you guys even take turns feeling secure within yourselves based on how the other one is behaving it's crazy one person gets real jealous and wants to ask a whole like what are you doing here you're talking to one person come not doing anything everything's fine calm down relax you're acting crazy and then it flips and the other person is I don't know that it flips and then the other person is like what are you doing here you're talking to me and the other person's like nothing stop relax and like you guys what the hell what's going on what's happening what is going on in this relationship codependency obsession possession controlling y'all need to take break y'all need to like get some distance and figure out how to get secure within the self and maybe not be in a toxic relationship I know that I'm not talking to everybody but this feels very toxic and I'm not listen much look Virgo I love you I want you to be healthy I want you to make healthy choices I want you to make healthy choices there's codependent the word codependent is here twice some of you already know this some of you are like waking up to this yeah reflecting on this like oh shit I'm playing a role in this I may not be as bad as the other person but I'm I'm probably paint playing a role in this in some way I'm probably not making this any easier by hermitting and not communicating but I can't communicate because when I try to talk my other person gets jealous or they get questioning and then they're pushing me in a corner yeah so there's a whole bunch of like crazy back-and-forth energy okay but some of you I feel like you're gonna be talking about this with yourselves with your spirit guys here like alright this is not this is just too much crazy for me in my life right now I'm not being who I need to be I'm not being my best self this is not who but but I love this person but I can be better and that we're not winning how can I make this better how can I make myself better you might be connecting with another Virgo maybe another Libra or a Taurus I need to move on like Virgo I feel like you need to get some distance could have connection with an Aries or a Leo or Sagittarius who's the Emperor oh boy I'm seeing a father and a brother there's a father and a brother figure showing up here somebody's calling their father or their brother or a father figure or a brother during this time or they're or they're calling you Virgo or they're trying to tell you to like wake up about something there's like maybe some advice heed the warning they're saying heed the message they're trying to or they have been trying to tell you about this connection or this relationship or this person whether there's a friend or our love relationship whatever it is you've been trying to tell you they're sending you the call they're sending you the message or they want you to come visit could be one or both or just some friends there's some there's some males or brothers or someone trying to tell you could be parents some family members about this connection it's not healthy yeah they're trying to tell you need to get out of this put an end to this thing like fast pronto yes for the kids or for the kid or come stay with us we need some help with our child just cut them first cut them off yeah there's just I mean I know people give advice you know everybody everybody tells everyone what to do and it's real easy because they're not in the other person's shoes it's real easy to dole out the advice you know but I feel like everybody's situation is different and I feel like it really just you know some people can just they don't have nothing but a lease but some people have like 30 40 years worth of belongings in a house in a community and they put roots down so it really everybody's situation is different some people just can't cut loose very easily some people are willing to take a credit hit and some people are willing to just like duck out on their lease you know and some people just they can't leave because they have like family members or kids in school or they have you know they're taking care of elderly parents you know it's different for everybody and so people just tend to dole out the advice based on what they would do but you know not everybody just kind of sits there and says well tell me what your specific situation is so that I can help you you know so that's why you got to be careful like be objective when you're asking for advice and consider the source of people are telling you things you kind of have to be like okay well where's this coming from because have I given them all the information when I'm seeking advice because you have been really mindful you know as your situation is there a addiction involved is your situation something that's just easy to cut out of you know do you require more help than just someone saying hey just come stay with us for a couple days that's not help that's a reprieve that just gives you a little time and just kind of maybe gives you a little that's a little R&R that gives you that's a little breathe little breathing time but that that buys you time you know if you need that but if you're in a situation that's like you need a chest move staying with someone for a few days might get you out of harm's way but it's not a permanent move you know so I don't know exactly what your situation is but I do see there are some people here who are definitely on your side as far as wanting you to make better choices or wanting you to be happy with regards to you know whatever your whatever this relationship is this mirroring this addiction this codependency thing going on that doesn't seem to be you know it just it just seems like some kind of virus that it's just getting worse they're saying it's like some kind of virus it's getting worse you know you know like when a virus in Bades gets into your nose and then it attacks your sinuses and then it gets your upper respiratory tract and then it goes down to your lower depending on how you take care of yourself you know and then it gets your headache and then you know it just kind of just makes its way all around the town you know it's it's kind of like what I feel like is here you know this situation the longer you're with an infected soul the more infected you're gonna get and you you gotta get out get out of it and go get a brainwashing and get a cleanse so to speak you know and I'm not saying that this person is infected I just feel like with addiction here and there's codependency and there's some toxicity going on here there's like this sword in the I always said sword in the stone the sword in the rose there's this little bit of like that rose represents compassion that sword represents to me like clarity you know the rose represents the heart the bleeding heart like suffering even suffering and you're back and forth with this person and you guys are just it feels like you got like this whole dance floor but you're the only one on it you're the only one doing the mambo number five bump bump bump little bit of sunda here I go I don't even remember the words I can't even sing that song I don't even know a little bit of Jessica on a long yeah the only one on the dance floor and this person is on it and then they're off again and then you leave and then they're on it and then you come back and they're not there like kind of gives the appearance that they're there you know like yeah no I'm here I was there I was there where were you what do you mean okay I don't know what's going on here I don't even know yeah look make them plans it looks like you got it looks like you got some ideas here but I feel like you got to make some plans first about you know you're at a crossroad are you gonna stay should I stay or should I go if I go there will be trouble but if I stay it will be double so what are you for seeing your future like where you going this is all about ideas right here you know this is standing at the crossroad here so I go left do I go right but it looks like the new year is coming what do you want to do start trying to materialize your thoughts and your dreams your ideas you know this is materializing your dreams your ideas start thinking about that in the new year you don't have to do it tomorrow you don't have to pack your bags and go tomorrow you know but I mean it's like time to really start thinking I feel like okay you know how's this working after you forget the emotions like just for a minute that's what they're saying just forget the emotional aspect of things for a minute right because the way I feel like this situation right up until this point everything that you've done is not worked out so you need to do something different so if everything you've done up until this point involves your emotional thinking then from this point going forward remove your emotional thinking and try to think practically about this situation is this a practical situation that's going to work for you in the future sure your emotions are always going to be there how you feel about this person is not going to change so that's fine it's set set match it's fine put it over there on the kitchen counter and just leave it there okay got it this how I feel about this person you love them you care about them got it but let's look objectively is this a compatible relationship is this working are you on the dance floor by yourself you have a dance partner or no does that work for you if it works for you and you like being out there solo with an occasional dance partner then hey this isn't the reading for you and you should just go back to business but if it doesn't work for you because relationship is not just about love it's about compatibility and working being able to work together you know it's unfortunate when there's love there it's kind of like when you have a child or an adult child that you love very much that has an addiction you don't have a working relationship with your child that's suffering from a heroin addiction you love them very much but they're not functioning in society especially if they're stealing from you you can't have them in your home you can't have a functional relationship with your with your child your adult child you can love them you will always love them from a distance has to be and try your very best you can send them care packages you can send the cards that you love them you could you can do all that stuff but until they're healthy and well you can't be an enabler and you can't be in a codependent relationship with them and this is similar to this kind of relationship because when you're in love with an addict an addict is going to be in and out of your relationship they're in and out of the dance floor off and on the dance floor that's what an addict does they come back when they need a hit or they need something and then they're gone again so you don't have to have drugs involved in the relationship to be involved with an addict some people have just the addictive type personalities they could have addiction to anything they could have an addiction to I don't even know there's so much there's just so much but someone that is like has that healthy you know they they can have that healthy relationship where they're present to the relationship they don't have to be there 24-7 but they're present consistently at least available as much as possible as much as they can be check in with each other there's just this is just like this level of consistency so if you got some kind of relationship with an addict of some sort this sets up for this codependency you know maybe they are an addict maybe you got something you know it's very unhealthy for you right and that's why I said you know you don't have to get off the dance floor if you're if you're in a situation where you can't leave the dance floor and I use that as like a euphemism you could just stop dancing okay so a lot of people who you know they're married to alcoholics they can't leave their home because they have roots placed they get kids they whatever so they go to codependent are they good at what do they go to they go to those anonymous meetings for spouses of alcoholics I forget what they're called but you know what I mean they go and they get their help and how to learn how to live in that situation so I'm not giving you advice I'm just telling you you know so far what I see transition the end to suffering is upon you out the old and with the new no one said it would be easy or has been the season in your life is transforming bringing you into a new hemisphere allow it to happen and go with the flow it's now time for change so this is pretty damn profound oh you need a girls night out or guys night out or friends night out sisters or brothers yeah you need a little reprieve remember I was saying you got some people here like come on come with us giving you a call not a not a massive change here change is coming it's time for you you got to start thinking about what you're gonna do here but a little reprieve isn't you know it's definitely gonna I don't know I need a little sparkle of some sort in your life a little color in that rainbow little paint refresher what else do you have here okay love offer beautiful you couldn't use a love offer family celebration wedding engagement party very nice this feels more like a I don't know what kind of reading this feels more like a life reading more than a romantic reading getting together with family financial decision playing out for you coming up yes remember it's going into November so we definitely have holiday season coming up as well so you might have some parties or celebrations or events family friends holiday celebrations all right Capricorn cancer oh we had the Sun nice okay 1988 someone is 30 someone is 31 someone is 39 wow we're hitting all the 30s someone's 64 someone is 44 someone is 52 someone's born in 71 someone's born in 78 okay someone's from Texas okay did I say that the other day all right someone's asking for a plea deal okay play tax someone's no longer using play tax I can tell you that those days are over someone's hitting a plateau okay I just heard you're hitting a plateau if you're dieting and you're hitting a diet plateau I just heard you can eat all right so hmm they said eat more carbs I just heard load up on the carbs for like a day or two if you're hitting a diet plateau like you're not losing any more weight jack up your carb intake I heard okay play tax those play tax okay oh I know what that is all right somebody's just washing their plate somebody's having a latte somebody's also having a malt beer malted beer okay someone's getting here late late that's great someone's name is Pete Peter Peter Peterson Norm Peterson okay what's up Pete all right someone's getting a lap dance hey TMI okay I don't need to hear that all right someone's just flown into or flown out of LAX okay your ex is showing up someone's going out to eat or just came back from eating out okay we have Patrick or Pat or Patricia okay hmm Leah I just heard Leah lay lay Lex okay someone's what are you doing with that axe hold up hold up we don't need any murder scenes unless it's Halloween okay someone's getting their taxes ready or does taxes maybe does taxes for a living or okay they're giving me latex here what are y'all doing with the latex what's going on okay all right let me squish this all up again and see what else they come up with okay we got the initial J we have an F we have a B letter V's in Victoria we have the letter O we have an E and the letter T okay more signs okay we have Scorpio and I always confuse that that is cancer and I don't know why this is showing up I don't remember what that is is that mercury I don't know I never memorized my symbols is that mercury I should know what mercury is shouldn't I yeah I think it is I was expect to see the little arrow coming out of the top but then that would be the Prince sign wouldn't it that would he who shall not be called Prince or something like that the dead guy my prince purple rain alright let me get a charm for you guys and then we're gonna call it a night tomorrow I'll be back with your weekend reading and you guys I know you're gonna kill me but I have to say what I have to say first of all if you complain about like I don't know why I've been excusing like making excuses but yes my readings have been a little bit short and somebody in the comments made a comment like oh the readings have been getting shorter and shorter and someone was so kind to respond and say they'll listen to the peanut gallery the readings what's more important is the message and if the message is really good it doesn't matter how long the readings are and I really appreciate I don't know who it was that said that I meant to reply to her comment but I really appreciate that comment because definitely a sign of maturity and compassion and if some of you know I just have been having some medical issues ever since I got COVID and so yeah I know I'm only here once a night five days a week but I appreciate the patients I do I don't normally let the comments affect me I don't read them all that much but when I do sometimes it's just like I feel like people are becoming more and more impatient I don't know it's not really I guess I don't know if it's a younger crowd generally like I've been on YouTube long enough to know when people are just trolling and I can tell when people are trolling because you just know there's an essence about a troll and when you've been on here long enough you know when people are trolling but I don't know I think maybe it's just because I haven't been feeling all that well so I appreciate all of you guys have been putting up with my antics here on my channel and a little bit of my back and forth I'm sure at some point all of the stuff that I've been dealing with will get results and all will be well and I just want to say thank you so much I greatly appreciate all of your support as you guys have stuck with me all this time especially to my mods who have been so generous to show up here every single time I do a reading even on the live streams and they've been showing up on the moon pie channel I'm always so grateful I must gift them a little gift very soon I must give you all the mods something they're so amazing I love you all and even my old mods I hope they all come back because I miss seeing them so yeah and you guys just my regular subscribers and members just amazing people the peanut gallery can just you know whatever I don't care whoever's making those comments and not even subscribe to my channel anyway let me get a charm and quit my rant all right let's see oh this is nice nothing wrong with a little little guitar little like electric guitar so many plays a guitar little electric guitar music going on can you imagine a guitar that was like completely gold dude has that ever been made that would be very expensive I think I don't know what the most expensive guitar is are they less less Paul I don't know I have no idea anybody know if you know what the most expensive guitar is please leave a comment leave it in the reaction there down there but yeah so many plays a guitar or there's a music connection with humans you or someone okay very strong music connection whether that's lyrics or someone makes music for other people or plays in a cover band or yes very strong musical instrument maybe owns a music shop I just want to get one more oh actually they gave me two so you got a blue star and blue star and a hanger okay maybe somebody has a like a boutique I'm seeing a boutique and this blue star makes me feel like baby blue little baby blue what's it called a baby this is part of my illness lately I haven't been able to remember things can't remember short-term memory what are those things that hang over a baby's crib that and they have music I can't remember the word it's so bad and it has musical lights and little yeah I want to say cradle but that's not the word I think you guys know what I'm talking about and I appreciate all of you who leave the comments and filled in for me makes me very happy but yeah that just it's the image that just came to my mind I can't remember what it's called but yeah maybe somebody's having a little boy there might be a pregnancy a little boy baby blue star and then they just give me that old song baby beluga little baby somebody might be shopping for baby blue clothes okay and I know in this day and age it's not gender or gender neutral I guess but somebody really likes the pastel blue or pastel blue colors or someone's doing a child's room and glow are they're seeing are using glow stars for something okay so I'm gonna leave that there you guys yes and I will again see you all back here tomorrow for your weekend reading and yeah love you all very much take care


Hello, everyone. Welcome to this talk on Yamal Yo Cloud, Managing Cloud Resources from Kubernetes. To kick off things, let us introduce ourselves. Megan, you want to go first? Yeah. Hi, everyone. My name is Megan O'Keefe. I'm a Developer Relations Engineer at Google Cloud. And yeah, I've been working with Kubernetes and Cloud stuff for the last five years or so. So I'm really excited to be here. Thank you very much. Yeah, I'm Shabir Abdul-Samad. I'm a Developer Relations Engineer as well at Google Cloud. I've been working on Kubernetes and Cloud for the last three to four years. So looking forward to this talk. Let's get started. So to start off, let me brief on what's on the deck. We are going to discuss about what is the Kubernetes resource model just to give a brief introduction. Why we would want to manage cloud resources using Kubernetes. And then finally, go over some of the ways in which we can manage cloud host resources using Kubernetes. So to start the discussion, we would like to speak about two main areas, the API server in Kubernetes and the declarative model that Kubernetes has. So most of the introduction in the next slide can be something that you are already familiar with. So all of Kubernetes components centers around the API server. It's what the control plane uses as the source of truth for external tools, clients, and other internal components. So it's how the nodes know what containers they need to run. It's how any outside actor like a CI-CD system interacts with the cluster. And the API server exposes an HTTP API that the user, external clients, and also the internal components in the control plane can connect to. So through this, we can query and manipulate any of the resources that is understood by the cluster. And some examples of these Kubernetes API clients are the KubeControl CLI tool, client libraries like ClientGo or in any other languages, and also the Kubernetes dashboard. It could be on a standalone Kubernetes deployment or one of the managed Kubernetes provider dashboards. So the second thing we want to cover before we get to KRM is the declarative model adopted by the API server of Kubernetes. So instead of telling how to achieve what you want, what the declarative model says is what you want. And how Kubernetes knows how to get to that part is using the concept of controllers. So every resource or an object in Kubernetes has a controller attached to it. And controllers are trying to continuously drive from the observed state to the desired state, like how you see in this example in the diagram here. So now the next question is, how do we tell the API server what you want? What is your desired state? How do you tell it? For this, we follow the Kubernetes resource model, or KRM, to define the resource or the object we want. So the KRM is a data model or the schema following which the intended state of Kubernetes resources are expressed. And it has three main parts. The first part is the metadata part which explains the object itself. It could have things like the name, name spaces, labels, or even annotations. And then we have the desired state spec explaining what is the state you want the object to be. This has all the information about the resource itself, if it's a container, the things about what's the image to use, what ports to be exposed, and so on. And finally, you have the status field which is maintained, which maintains the current state of the object as is, which is used by the controllers in the reconciliation process. So the status field is only updated and added to the definition on the server side. The clients and the users only specify the metadata and the desired state in a KRM based YAML. So what's cool about this is that as long as we can define resources using this model and have controllers to manage them, we can extend the API server to support all different kinds of entities. New resources that extend the capabilities of the vanilla Kubernetes that follows the KRM are called custom resource definitions. And controllers that introduce capabilities more than just managing the lifecycle of a resource, that is that they manage entire application stacks are called operators. So we have highlighted some of the examples of popping open source operators in the slide here. So whilst that covers what KRM is and gives a general idea, now we would like to see why would we want to manage cloud resources using this model. So with different cloud providers, there are many ways to interact with the cloud APIs. And these tools, and each of these providers have their own tools. And each of these tools also differ from cloud provider to cloud provider as well. And in addition to that, if you operate Kubernetes as well, it could be cloud-based or self-managed, you have an additional API to take care of. And this also comes with a CLI and tools and its own client libraries. So usually an organization running Kubernetes would not only use Kubernetes, but also would need to provision cloud resources like databases, serverless functionalities, DNS, networks, and so on. So this results in having to deal with different ways of interacting with your resources. And this has downsized satisfaction setup. So different APIs with different formats require the expertise to manage it. You also need to deal with the difference in paradigm between internal and declarative. That means the process pipeline would change. And also cloud providers access management, which is commonly known as identity and access management, is different from Kubernetes, from how Kubernetes manages access to its resources, which uses its role-based access control system. And on top of all of this, you run on multiple clouds. If you run on multiple clouds, the variation amongst these increases further. So the question we would like to ask is whether we can consolidate management of all of these via a powerful declarative style introduced by the Kubernetes resource model, the KRM. This wouldn't have to replace your current tooling setup for the cloud, but it could allow for consistency around data format, lifecycle methods, have Git as your source of truth, and also enable a central way of managing authentication. Also, this could give you the power of KRM, including the ability to transform and customize your cloud resources as static files, allowing for self-service for your developers and also a more consistent platform layer. So what would it look like is what you see here in the diagram that's been presented. Like we see on the right side here, the data model is decoupled and defined as KRM. With the tools having to only operate and worry about dealing with KRM rather than keeping up with how the API is changing. So in an ideal scenario, how would it look like? You can treat your cloud resources as a cloud, as KRM-based YAML stored inside Git repositories, and you can integrate your cloud resources into a change approval and validation process. This is of course a very simplified view that we are showing here. You can have multiple repositories and clusters. The important takeaway that we are trying to show here is that you can manage both Kubernetes and cloud resources from the same cluster. And that's what we are going to show today with the demos that are going to follow. All right, so now that we've covered what the Kubernetes resource model is and why you might want to manage your hosted resources with it, we're going to walk through a couple of demos of how exactly you can make this happen. There's a general workflow that would apply to most cloud providers, which is, one, figure out how you're going to manage your hosted resources. We're going to cover both first-party tools as well as third-party open-source tools. Second, you actually have to write your KRM or YAML resources representing those hosted cloud infrastructure. And then you have to figure out where to put the YAML files. So in Git or figure out the workflow of actually getting those files onto one or more clusters. And then finally, we're going to cover how to set up guardrails and some authentication items to make it more secure to be managing your cloud resources inside of Kubernetes. There's a few considerations to worry about there. So to cover step one, choosing your tools, there are different first-party cloud controllers that you can choose, depending on which clouds you are operating in. AWS, Google Cloud and Azure are examples of cloud providers that do offer controllers for Kubernetes. All of them have similarities in that they operate inside the cluster and they interact with the cloud APIs, but there are a few nuances and differences. So we're going to actually cover two. One is going to be the AWS controller for Kubernetes, and then we're going to cover the Google Cloud Config connector. So let's talk about an example workflow using AWS first. So the AWS controllers for Kubernetes, ACK for short, is an open source project led by AWS that is a set of controllers for Kubernetes designed to manage AWS resources. It's open source and each controller is separate. So there's an EC2 controller and S3 controller. And we're going to be showing a demo of the S3 controller running inside an AWS EKS cluster. So this is hosted Kubernetes running inside of AWS. So the way that the AWS controller for Kubernetes S3 edition works is that you install it onto the cluster. We're going to use Helm, which is what the documentation recommends us to do. You have to give ACK permission to create AWS resources from inside the cluster. So that includes connecting the AWS IAM setup to a Kubernetes deployment. And then we have to create the S3 YAML. And then finally, we are going to show an app that's actually using the S3 bucket. So the way that the ACK S3 controller works is we install it using Helm. There's a Helm chart that's been provided by the project and it's running just as a pod inside of our cluster. So here I am with access into my EKS cluster. And you can see we have this name space called ACK system. We can view the pod in it. And you can see that a few days ago, we installed this controller and it's running in our cluster. And we've given it IAM permissions to create and update and destroy S3 buckets specifically. So we gave it pretty specific permissions. And what I can show here, actually is that here's our S3 management console in AWS. We've created a few buckets as we've sort of tested out the demo. And what I'm gonna show is creating a KRM style YAML that represents the custom resource for ACK S3. And we're gonna create a new bucket using this controller and we're gonna watch it be created from inside of our cluster. And we're gonna see it hopefully show up in the S3 dashboard.  Note that in production, you wouldn't probably want to kubectl apply. You'd wanna use CICD or deployment automation for this. But we can see our S3 bucket was created. And then we can go ahead into the S3 management console, refresh the page. And hopefully we should see that new symbol test for bucket called this show up in our dashboard like so. So that's just a very simple example of creating an S3 bucket using KRM. And what we've also done is deployed that little in-store ads application. And that's already running using a different bucket. And so what I can actually show is redeploying this app pointing to the newly created symbol test for bucket. So I'm gonna go ahead and do that. And the way I can do that is by setting this environment variable and for my actual application to symbol test for and then redeploying the app.yaml. And this is just a deployment. And I can get pods. Let's see that seven seconds ago, a new ad deployment was, sorry, a new ad pod was created. And then we can go ahead and this is our application running. And we can see that, yeah, the ads are being successfully written to S3 and then gotten out of the S3 bucket. And here's that HTML page that we just showed on the browser. So that's kind of an example of one cloud provider and like a little miniature workflow. Obviously this is a very small application, but you can imagine that you could use ACK to create lots of different resources and especially ones that are tightly coupled to your applications to have all of that KRM together to apply it in the same way, provides a nice kind of unification, which is nice. Okay, let's run through another cloud provider. So now we're gonna switch over to Google Cloud. Google Cloud offers a similar service to ACK. It's called config connector. There's a few differences. Unlike ACK, config connector is a product. It's not the code for it is not open source in the way ACK is. And it also operates as one controller that can manage lots of Google Cloud resources all at once rather than separate controllers for each resource type. Other than that, these are very, very similar tools that both operate inside of your cluster as a controller. Right, so the general workflow is pretty similar. I'm gonna show a similar setup, a hosted Kubernetes cluster in Google Cloud that has permissions to create resources and I'm gonna show creating a cloud-hosted resource and then deploying an app alongside. So this cluster, again, it's running in Google Cloud. We can see it here. It's called symbol shops. This is a Google Cloud project. And I've pre-installed config connector before this. So the controller itself is actually running in this namespace CNRM system. CNRM is an old name of config connector. It stands for cloud native resource management but it just means config connector. We can see the controllers running right here. So that should be all ready to be able to deploy resources on our behalf. Should be noted that like AWS, you do have to set up IM. And so in this case, we configure config connector with a service account that has the necessary roles it needs to create resources in our project. And then, similar to the S3 example, we can define a hosted Google Cloud resource as KRM. So in this case, we have a instance of memory store called Redis Cart. It has specific spec fields to memory store which you can find in the config connector documentation. And you can see once we've applied it which I've done right before this, the instance is created and we can actually see in the Google Cloud console over here on the right, managed by CNRM True. What that basically says is, this resource was created from inside of the GKE cluster using config connector. The last thing I'm gonna go ahead and walk through is thinking about how to keep all of this secure. So in the case of config connector, the default instructions actually have you install config connector with massive sweeping permissions on your Google Cloud project. Basically, it's a project owner. It can delete resources. It can update resources. And if you imagine a large production system, that could be risky. Once a KRM resource lands in the cluster, it gets created, config connector will create it. So you want basically to set up some guardrails and some policies that happened before that point. So what I mean by that is, how is that KRM getting into a production system? Are there change approvals in Git? Are there validations there? Then once a resource is on its way into the cluster, how do you make sure that the person or actor deploying it is valid and allowed? And how do you make sure that the resource is set up in a secure way? And Kubernetes can actually handle both of these things, which is cool. The question of who can create what kind of resource is actually something that's pretty much already covered by Kubernetes world-based access control, our back for short.  So that's already covered, but then there's a question of, okay, what about this resource right here? What if we want to actually look inside of the spec for a specific resource type and set guardrails on what is allowed for that resource? And this is really powerful because with regular imperative formats, this can be really difficult. There's I am for like, this user can create a reticence instance, but within that reticence instance, what is allowed? And I'm gonna cover a project in Cloud Native Computing Foundation that is gonna help us with this. And that's called Open Policy Agent. Open Policy Agent is a open source project with different parts to it. One of them is called Gatekeeper. And Gatekeeper is a Kubernetes admission controller that runs at the base or at the gate of the Kubernetes API server. So it looks at things as they try to come into the cluster and you can set custom policies that are very specific for certain resource types that allow your cluster to basically accept or reject or audit what is coming in and is it in compliance? And as you can imagine, this could have a lot of really helpful impacts on your organization, especially if you have multiple Kubernetes clusters, it can be hard to determine kind of what's going into the cluster and what resources are allowed and which are not. And it could also help accelerate development as well because again, it's adding an automation layer so that yes, at the gate of the cluster, the policies are checked, but you can also run these checks in your CI CD in kind of a standalone mode that says, oh, this person's trying to merge in this resource. We know it's not allowed. And this allows the developer to kind of have a nice fast feedback loop and avoid surprises. Right, so Gatekeeper has a little bit of a learning curve but once you get started with it, it looks really similar for different resource types. So the way it works is you define a sort of an abstract policy. This is called a constraint template that it's some programming code, specifically the rego language, which I'll show in a moment, that basically is the logic of the policy but the actual parameters of that policy, the concrete stuff happens in a separate resource. So this allows you to reuse templates and I'll explain what I mean by that in a sec. And then you apply them to the cluster. These policies are defined as KRM just like everything else, which is awesome. And then we'll see Gatekeeper be able to enforce that policy on inbound cloud resources. Okay, so let's go ahead and do that. So what I'm gonna show here is a example of a policy that's all about the required version of our Redis instance. So you'll see here in for our instance that we are using Redis v5. Imagine that our organization has a policy that says you have to be on that version of Redis for whatever reason. We can use the rego language, which is a policy language. It's a bit different than a general purpose language. You can see the syntax is a little different but basically we're looking inside of the resource and saying is the Redis version what it needs to be? And you can see this is not a hard coded version. It's a parameter that we will define. And then a message that will tell the developer or the CI CD tool, what went wrong? Why was the resource blocked from entry into the cluster? And you can see, you know, we're gonna define the concrete parameter. Here it is, Redis v5. Let's try it out. The first we're going to apply the template. And this tells Gatekeeper about a new policy type. Then we're gonna create the concrete policies that says, okay, now we're gonna require v5. And now what I'm gonna do is try to apply a Redis instance that's Redis v6.  This is a real Redis version that would otherwise be created. But if I try to apply it to the cluster, you can see here, we get the message from Gatekeeper that says, as we defined in our policy, Redis version parameter is not allowed. Must use version parameter. And yeah, this resource was not allowed into the cluster. Then again, if we were to apply another Redis v5 instance, this would be allowed in. Just a very simple example of how Gatekeeper and Open Policy Agent can be used not only for regular Kubernetes resources, but also for cloud-hosted resources as defined as KRM. So really powerful. And again, like the possibilities are pretty much endless here. So with that, I'm gonna quickly pass it off back to Shabir. The one thing I do wanna mention you may have noticed, I just covered two cloud providers, kind of quick in succession. And sure, you might just be operating in one cloud provider at a time. And using one of these tools separately could work really well for your organization. But imagine that you actually are working with multiple cloud providers at once. And this could be the case for many different reasons. What this would mean is that you'd have to be working with two first-party tools at the same time, which could be complex. So Shabir's gonna walk through a way that could help us mitigate some of that complexity. So what we saw with the demonstrations that Megan showed was that we, like how we can use provider-specific tools like Config Connector and AWS Controllers for Kubernetes and then how that enables us to manage cloud hostess resources. So still there's still a main problem here, which is that these are still two different tools that evolve independently. And what we would ideally want is to reduce this to just one thing we have to worry about. So that is the problem that CNCF's cross-plane project is trying to address and we will look at it briefly here. So cross-plane is an open-source Kubernetes add-on that can be simply installed into any of your Kubernetes clusters. And then you have to activate controllers and various different cloud providers that they support and you want to work with. So they have wide variety of supports for many of the public clouds out there.  It could be your Kubernetes resources. It could be the cloud resources running in your primary cloud provider. If you're running on another cloud provider, then you can use the same control plane to manage resources in that cloud provider. And also it can extend to resources in your on-prem environments. So a key functionality of cross-plane on top of this is also allowing you to assemble multiple cloud resources into a single time definition and to provide that abstraction. But for the purpose of this talk, we will stick to just the basic deployment example we're using cross-plane. And in terms of composition, we will provide you useful links at the end of the talk. And also finally cross-plane provides you support for you to set policies just like open policy agent on your resources. And you can do gatekeeping work on top of it. So how cross-plane works is basically by extending the Kubernetes API, by introducing new custom resource definitions with its own controller. What I have showed here at the bottom is a very small diagram that explains the concepts of creating and managing cloud resources using cross-plane. The resource claim that you see in blue is the main key definition that the user would submit to the API server. Then you have the resource class, which is the Kubernetes object that defines how to serve the claim, which has all the information related to a specific cloud resource type. The resource that you see in orange is the representation of an instance of the cloud resource that actually is going to serve the resource claim. And finally cross-plane also allows you to pool resources together and serve resource claims from this pool of resources. So let's look at a demo. For the purpose of the demo, we will not go through setting up the entire setup. We have already set it up in a Kubernetes cluster, as you see in the diagram here. We have a GKE cluster running in Google Cloud, and we have an EKS cluster running in AWS, just like how Megan showed, and we have cross-plane installed in our GKE cluster. And this cross-plane installation has been given all the information it needs to be able to connect to and create and manage cloud resources in Google Cloud and AWS. So let's have a quick look at this. So what you're seeing on screen is the Kubernetes cluster that I have created. It's called cross-plane cluster. And this is the object browser for the cluster. If you see here, you can see that it has, we have, it has a bunch of new object types, which are namespaced under cross-plane.io. So these are all done by installing cross-plane into your cluster. And I'm going to show you what I have installed by going through some of the items in the CLI. So you can see that I have made the cross-plane installation using Helm. So you can see that Helm chart installation up here. And also we can list all the cross-plane specific resources in the namespace that I've created for this specific purpose. Let's see what it shows. As you can see here, there are four deployments and two of them are specific to two providers. One is for AWS, one is for GCP. Cross-plane also installs an RBEC manager to manage access control. And you have the main deployment that manages all of cross-plane's control activity. We can also quickly list the list of providers that has been installed. You can see already that the deployments, the two deployments were AWS and GCP, but let's look at the provider definitions. So you can see here I have a configuration for AWS. There's a configuration for GCP as well. And I'm going to also have a quick peek into one of these configurations to highlight the key components inside this configuration. So if you see here, this configuration is of kind provider config that says it's a cross-plane provider config. And at the bottom you can see that it has associated to it, a secret reference to a secret inside our cluster. So this secret is mainly the AWS secret that we would usually use with the AWS CLI. Similarly, the GCP config has the GCloud service account, JSON that we would use using GCloud as a secret here. I'm going to show you the two cloud resources that we have created, which is an S3 bucket and a Redis instance through the cloud memory store manage hosted service. So you can see that there is a bucket called symbol ads bucket. That's the S3 bucket. And also you can see symbol mem store, which is a Redis instance that is managed by GCP.  And we can see whether the same is created. So if you see here symbols ads bucket is the bucket that we created. We can make sure that the system is running as expected by just going through the external IP. So it's in the cluster that we are looking at at the moment. So you can see that it's running as expected and you can see that the cart is also working as expected.  But we saw today is that there are a lot of ways that you can manage your cloud infrastructure in alongside your Kubernetes deployment as well. However, Kubernetes resource model can act as a single data model to consolidate all of them and all your infrastructure in a single place using the declarative model that the Kubernetes API server demands. And different cloud providers has also provided their own solutions to be able to do cloud resource management using a KRM based model. However, crossplane comes as a single control plane to support multiple cloud providers from single cluster. And it also comes with an added benefit of being able to abstract composite resources together. So with that, we come to the conclusion of our demo. Here are a list of resources that we used in the site and some of the things that we could not go into detail because of the time constraints, please go through them. In addition to that, everything that we showed in the demo has been put up in a Git repository that is publicly available for anyone to try it out. Please try it out and report any issues, modifications that you all wanna see. And also these slides are accessible at the link that you see on screen. Thank you very much.