Often we want to search for files. That is somewhere on my hard drive. There's a file that I'm looking for I know the name or the the the the structure of the name. There are different ways to locate files. One is using locate Locate followed by a file name Maybe Wireshark. I know there should be some files about Wireshark. Wireshark is installed Locate may tell me about those And it tells me all the files That have the name Wireshark in it and you you can scroll up and down I will not but it returns a whole set of files the complete path The subdirectory and the file name that refers to Wireshark. So locate Okay, if there's no file then it will return nothing there Locate I Had X what what ITS 352 locate xyz.doc This is interesting I Have a Directory called ITS 352 and I have inside that I have a file called xyz.doc if I try to locate xyz.doc It doesn't return an answer Locate is a very Locate uses a database of files to find the answer It's very fast to find the answer But the way that it works is that maybe the past hour or so the operating system has done a search for all the files and put Them in a database But it's not up to date Recently I've created xyz.doc If I try to locate it, it's not currently in the database So locate cannot find that So locate is very quick, but doesn't cover all the files So a more Powerful command to find files is using find It's more powerful, but slightly more complex Find the pattern will use find Specify the directory we want to search in and then the option dash name because we want to find based upon the name star.doc so there's three arguments to this fine command the Directory I want to search in Including the sub directories Then I say I want to search based upon the file name because actually you can search on other criteria file size creation date permissions and I want to find anything that ends with a dot doc and that finds xyz.doc So it does an actual search If I want to search for my current directory It's good practice to include the double quotes Especially when you use a wild card there the star character find searching through my current directory Files with name the end with dot PDF And it shows me all the PDF files What if I want to find all the PDF files on the hard disk? find slash dash name star dot PDF That is search from the root directory and end including all sub directories and You say it may see many results. You may also see some errors permission denied errors So it's searched through the entire hard disk Returns all the PDFs But some directories the student user is not allowed to access to do the search through so you'll often see permission denied in there But many results We can locate files Although it doesn't get the most recent files more powerfully. We can find files. You think the command find The last way that we've commonly used to search for files Is to search for application files or executables Before we search for why shark and it returned many directories files related to why shark But I want to find where is the application why shark? So there must be a program an executable on my computer that is why shark we can use which It's in slash user slash bin LS is also an application. It's in slash bin Nano is an application So these are the executables the things that are executed when we type the command. It's in slash user slash bin Then is short for binary and it's usually It really means the application the program the executable Which searches for programs locate and find search for any type of files


O hynny'n ysgogut oherwydd? Mae hyn phrogoicieig!现在 mae'n rhaid o'ch你在nau! Mae hyn phrogoi جerionedd cael ei exaggerated. O'ch ddweud o hyd a ymgyrch yn gwneud? Siwnlass o hwnnw sgwyll wedi arleig. Siwnlass o hwnnw erbyn hyn, mae'n dwin jaen o fwy syniadau. Rhaid. Mae'r adnodd. Rhaid. Felly, ydych chi'n gwybod yn ei ddaf. Rhywbeth yma. Mae'n gweithio. Rhaid. Cynnydd gennym. Rhaid, rhaid, rhaid, rhaid. Yn y line. Rhaid, rhaid. Rhaid. Rhaid, rhaid, rhaid, rhaid. Rhaid, rhaid, rhaid, rhaid. Rhaid. Rhaid. Yn y line. Rhaid. Rhaid. Rhaid o Bachelor? No, mae ydych chi'n arno. Rhaid. Rhaid o wybod hwnnw. Rhaid o wybod hwnnw. Pwyd i yn mynd. Rydych chi fedr最近r? Rydych chi'n yma, ONF? Ky año fwy. Right. Yi gwybod hynny? Maen nhw yw, ac yw yw.... A dyna yw, yw ddigon i'r bach? Yw ddigon i'r bach? Felly yn ffordd ddim? Felly yn ddigon i'r bach? Felly sy'n gweithio... Dyna, arnyngwch chi'n falle. Dwi'n iawn ystod... Felly yw 1nil, o unrhyw i fan hyn sy'n maen nhw? Ac niechda. Felly mae...есyrau i'r boeddaf... Felly yn ffordd. Felly yn ffordd. You can't jump hewch hoe can jump in a boat? Can't climbed a boat on a boat? play football? Dyna umut yn fynd y bobl. Mae gyda'n gynyddu meddwl. Rwy'n meddwl. Rwy'n meddwl. Rwy'n meddwl. Gweithi? Gweithi? Rwy'n meddwl. Rwy'n meddwl. Gweithi ddylayodd. Rwy'n meddwl. Mae ddysgu? Rwy'n meddwl. Err... Can't write. So, what's the score? 2, 2-1, 2-0. 2-0, 2-1. I need 1. 1, 2, 2. Right, OK. What's that I say, Em? 1, 2, 2. On a bus. Oh hang on, I'm not finished yet. You don't have to. On a bus. You don't have to drive on the bus. You don't have to drive on the bus. Kim's quicker. Yeah, so that's it. Fine, thank you. So, you lose. No, it's too late, too late, too late. Do you win?  You go to the back. Come here. No, no, you come here. I don't know. What's the score now? 1, 4, 3, 3-2. 3-2? 4. 4-2. 4. And this score? 2. Points. Oh, I love mine. I can't slap mine. OK, I can't slap mine. No, I decide. I think it's 3-2, because I like this side. No, it's not an example. This is it. This is a proper game. You take that. Yeah, no, you take that. Oh, you're supposed to... No, you took the wrong one. No, no, no, it's my turn. You take that. You take that. You take that. In a crowd. Can. Oh, can. Yes. I can then. You can sing. Only you. What about everybody else?  Oh, are you special? You can dance. You can dance? Yes, you can sing. Is that all right? Can. You can sing a song. No, you don't get 2 points because you can come with 2, right? Thank you. You go away, you come here. No, you come here because you lost. No, go on up, you go. There, I think you lost. No, you lost. You go there. I don't know. Something like that. Right. So, last one for the winning team. Five, five points. In airport. You have to. No, it's not these two. You have to buy. Oh, no. It's OK. That's it. That's the end of the game. I'm not doing this anymore.


Hello, and welcome to this talk on efficient searchable encryption for joint queries. This is joint work with Charanget. The advent of Cloud computing allows outsourcing the storage and processing of extremely large databases to third-party Cloud Service providers while retaining the ability to process queries over them. This is simple and efficient if the Cloud Service provider is trusted, but this is not always the case. In order to ensure data privacy, a client might want to encrypt the data before outsourcing it to the Cloud. This poses a challenge. How do we query the encrypted database directly without decrypting it first? Searchable Symmetric Encryption or SSE in short, is a special class of encryption schemes that allow querying and updating symmetrically encrypted databases in an efficient manner while revealing very little information to an honest but curious server. In this paper, we propose joint cross tags or JXT in short, a new practical efficient SSE scheme that supports equi-join queries over pairs of encrypted tables in an encrypted relational database. Here is a one-slide example of an equi-join query. We have two tables, one for transactions and one for merchants, with transaction ID serving as the joint attribute, and we wish to find all records in the join of these two tables with date being January 2022 and merchant name being Apple. JXT supports such queries without any pre-processing of joins, and with some additional storage overheads, which are proportional to the number of join attributes. This is typically small in practice. JXT is a purely symmetric key primitive, which makes it practically efficient and highly scalable to extremely large encrypted databases. JXT is in fact the only SSE scheme till date to support join queries with no pre-processing of joins, and while allowing flexible table updates. In particular, JXT avoids storage blow-ups due to explicit join computations while allowing tables to be set up and updated independently without any re-computation of joins. JXT incurs a default storage overhead, where T is the number of designated join attributes. T is typically small in practice as the join attribute would be the primary or secondary key of a table. In terms of such overheads, JXT incurs a linear communication overhead and linear computation overheads at the client, while outsourcing the heavy quadratic computational overheads to the server. Finally, JXT is fully compatible with state-of-the-art SSE schemes for Boolean queries, such as Oblivious Cross Tags, and can be used in conjunction with such schemes to support rich Boolean queries over joins of encrypted tables in encrypted relational databases. For more details on the construction and leakage of JXT, do tune into our talk at Asia Crypt on Wednesday. Thank you and see you at Asia Crypt 2022.


Hello, I am Susan Steinbacher, and I'm a family nurse practitioner with MidMichigan's Heart Failure Clinic. The management and treatment of heart failure includes a combination of lifestyle changes, medications, medical procedures, cardiac rehabilitation, and in some cases surgery. Lifestyle changes can often improve or control some of the factors contributing to heart failure. These include eating a heart-healthy diet that is low in sodium and fat, getting regular exercise which may include cardiac rehab, reducing stress, not smoking, and avoiding secondhand smoke, not drinking alcohol or limiting your intake, losing weight, and monitoring your weight daily. Avoiding or limiting caffeine intake, keeping track of your symptoms, and reporting any changes to your provider. You should have regular checkups with your provider or through a heart failure clinic to monitor your condition. A number of medications are prescribed for heart failure, and most patients will take more than one drug. The purpose of these medications are to dilate the blood vessels, strengthen the heart's pumping action, and reduce water and sodium in the body to lessen the heart's workload. Medical and surgical procedures may be used to treat the underlying causes of heart failure. These procedures include coronary artery bypass graft or angioplasty to prevent and treat heart failure caused by block arteries, implantation of pacemakers or other devices such as artificial heart valves, and congenital heart defect repair. Surgical treatments may also be used to treat the heart failure itself. These treatments may include left ventricular assist device implantation to increase the heart's pumping action, heart reconstruction to normalize the shape of the heart, and with the most severe types of heart failure, a heart transplant may be necessary. If you or someone you know is suffering from heart failure, the heart failure clinic can help improve your quality of life. For more information or to inquire about becoming a patient, please call<PHONE_NUMBER>.


Welcome to our talk while we try to answer this very popular question that many of you probably have heard. How many network policies can I create? My name is Nadia Pinaeva. I'm a senior software engineer at Thread Head. Hi, and I'm Sean Crampton, a distinguished engineer at Tigera, the company behind Calico in case you haven't heard of us. So today we're going to try and answer this question. How many network policies can I create? Nadia has the first half of this talk. So she's going to take you through why that's a difficult question. She's going to introduce you to her new model and framework for scale testing network policies and why it was needed. It comes down to some kind of problem with measuring confusing multi-dimensional objects, these network policies we're dealing with. She's going to introduce you to CubeBurner and the convergence tracking approach that she's using and then show you some sample results from OpenShift. Then it'll be my part of the talk. I'll introduce Tigera's part in all this and give her a demo of testing, like how you run one of these tests. Then we'll circle back to wrap up and try to answer the question. OK, Nadia, over to you. Thank you. All right, let's start from the beginning. What is network policy? For those of you who may not know, network policy is a Kubernetes API that ensures network security. What it does, it allows you to specify connections that should be allowed for a specific set of pods and then everything else will be denied. So here is a simple example that you can see. That's a network policy that is created in the default namespace and it isolates all the pods in that namespace. It is very simple and it has just one ingress rule that allows connections from a specific namespace with a project name, MyProject. So if you look to the right side, you'll see an example configuration where we have two namespaces. The default namespace has just one pod that is the pod that is isolated and there is the MyProject namespace that also has just one pod. So in this case, given network policy allows just one connection. Now, we create one extra pod B in the default namespace. The network policy is still exactly the same, but what it does now, it allows two connections. You can imagine we create a couple more pods and the number of connections that the exact same network policy allows will grow. So what it means for us is even network policy with the exact same spec may have very different scale impact on the cluster. So what it means is that network policy scale impact depends not just on the spec of the object itself, but also on the other objects that exist in the cluster, especially namespace and pods and their labels, which as you can imagine makes the scale testing quite tricky. Now there is more than that. The spec of a network policy itself is also pretty tricky. It has lots of lists of different rules as you can see here and these lists may have any number of elements. Like for example, you can see a list of ingress or egress rules. Every rule may have a list of peers that it specifies, a list of IP blocks, exceptions for some side rules, lists of different pods and many more. So now you can imagine that the network policy we've seen on the previous slide will have also a different scale impact that had just one rule and this network policy is a bit more complicated and the number of rules also can grow like 200s and 1000s potentially. So both these objects are just one network policy but they are very different. So saying I can create one network policy without adding more details to that doesn't really clarify what is the scale impact of that. So we tried to solve this problem with defining a network policy scale profile which is a set of parameters that you set up and that allows you to simplify all the possible network policy configurations but it should be expressive enough to allow for different configurations of different network policies. So these are, I'll try to explain a couple of parameters that we have here. The first one is the number of local pods, that's the number of pods that are isolated which as we figured is important. Then we also simplify all the generated network policy configs to have just one peer in every rule as you can see here and there are two main types of peers in network policy. They are either cider based or pod selector based. So ciders is the parameter that specifies the number of IP block peers. You can see there are three on that slide and the other one is pod selector. So in this example there are two pod selector rules and pod selector is a bit more complicated than ciders because you also need to say how many pods are selected by each peer and we do that with two extra parameters that are called peer namespaces and peer pods. They are again for simplification all namespace peers will select the exact same amount of pods but the pods will be different but the amount will be the same and it is controlled by these two parameters. If that wasn't enough we have a couple more. So as we've mentioned there are also pod specifications that may be attached to every rule in network policy. There are two main types which is a single pod which just a number and the pod range which specifies the beginning and the end of the range. So here when you specify this parameter in our scale profile it will generate a pod config as you can see here both for ciders and pod selector rules. Okay let's take a look at a simple example. Oh, right, so all right, just to sum this up the network policy scale profile in the end has seven parameters that you can see on the slide. That is the thing that defines how network policy YAML will look like and that is good enough to understand what is the scale impact of a given network policy. Now I hope at this point it is obvious that there is no single or simple answer to how many network policies can I create but we can still add some certainty here by using this network policy scale profile which hopefully should allow us to answer this question with some more details. All right let's take a quick look at the example network policy that will be generated for a very simple profile. It has just one local pod and one cider. So you can see it here. There is one ingress rule with a cider based peer and there is a pod selector that selects one pod. Believe me that selects one pod or a tricky labeling system to do that. All right so we've figured out the network policy specification more or less. There are a couple more things that we need to set for every namespace which is the number of pods per namespace, number of network policies per namespace and ingress and egress policies can be also created separately in case that matters. And that set of parameters specifies just one namespace. So what we're gonna do to scale test the cluster will create a number of copies of these namespaces and that goes to the namespaces variable here. All right so that defines the workload I hope more or less in the cluster from the network policy point of view. There are though many more parameters potentially that may affect the test results like the number of nodes, the number of resources on the pod or resources allocated to the node, QBAP server performance and so on and so forth. But fortunately that applies more or less to every scale test. So that is a problem that exists not just for network policies but for all the other scale testing. So we won't pay too much attention to that. But it is important to remember that there are lots of different things that can affect the scale results for a specific run. Okay so we have defined what kind of a workload we want to create. How do we do that? There is a really nice CNCF sandbox project that is called QBurner that is able to generate the workload based on given YAML files for you. So it can create the lead patch Kubernetes objects. It has also some nice features to report test results and collect metrics during the scale run so that you can see how your system is doing in the middle of the scale test. And there is an extra repository here called QBurner.net's Netpol scale. It contains all the YAMLs for the network policy scale testing with the mentioned parameters. So what it does is it generates the workload with the given scale profile using QBurner. It also may visualize scale testing results with Prometheus open-source Grafana stack for you. And it also can do some static network policy analysis which we'll get back to at the end of this talk. And I want to say a special thanks to the OpenShift scale test team that really helped me with that and the QBurner is a really nice project that will help you introduce new parameters in case you need to do so. Okay it looks like we are almost ready to run our scale test, but not just yet. There is one extra nice feature of a network policy that we need to figure out. So the point is network policy doesn't have a status. That means that we have no way to know when all the network policies are applied. So all the objects will be created but it doesn't mean that it is applied to all selected pods at the same time. So what do we do? There are potentially many ways to do so but that's what we went with. Considering we apply the whole workload at once and there are no new changes in the cluster, your cluster should come to a stable or a converged state at some point, hopefully. Now we can try to track networking state on every node and that's what we call a convergence tracker job. That is a customizable job that can be, in our case is a simple Python script and it tracks the networking setup progress on every node. Different networking plugins have different definitions of what the networking state on a node is but that is also what's good about that because they can just implement their own convergence tracker to just see how it looks like. So I am a contributor to the OVN Kubernetes project. That is a plugin that implements network policies using OVS flows. And here you can see the example of metrics that shows the number of OVS flows after you apply a set of network policies. So you can see it's growing, growing, growing and at some point it stops. That point is where all the network policies are applied and where we can say, now we are done, the scale test is finished. So that's how it's gonna look like. All right, so far so good. Now we're ready to run the test and get some nice pictures. So QBurner, as I said, allows you to collect some metrics and see some nice dashboards. So here are a couple of snippets of what you'll get from every scale test run. And these dashboards can also be stored so you can get back to your scale test results and see how it looked like some time ago. So you'll find here all the different parameters of a scale test run, the number of created objects, the scale per name space. You'll find the seven parameters that I've tried to explain before, which specify the scale profile itself. And there are also some details from every convergence tracker from every node that shows at what time every node was converged. In addition to that, there are many more things that you can report. An important example is the resources usage. That's probably what you also wanna track, which is the CPU and memory usage, for example.  And you can see that when the network policies are applied, the CPU usage bumps up, and then it goes down when everything is done. Okay, so let's say I've run this test for a thousand network policies. My dashboards look good, CPU usage is fine. What do I do next? I need to find the scale limit. This is what I care about. So to find the scale limit, we need to define the conditions for a test failure. So when the test is failed. There are multiple ways to do so. Cluster death is an obvious one. That will happen sometimes if you apply too many network policies. Then the other one is cluster health. So you can get different metrics from your cluster and track how well it's doing. Maybe in resource usage point of view or from whatever you care about actually. And the main thing we use here is the conversions time. So we say that if applying a given network policy configuration takes longer than N minutes, and you can set it what N minutes is yourself, then the test is failed. It was too long and it's unacceptable. We say this test doesn't pass. So to find the scale limit, what you can do is you can save all the parameters as you can see here at the little spreadsheet example and just increase the number of network policy per name space for every run. At some point, your test will fail and say I cannot handle that many. That's what you can see there in red. And then basically the answer to the question how many network policies with a given scale profile can I create will be the last successful run. Yay. Okay, so how else we can use that we call this whole system scale testing framework and I am a part of the OpenShift networking team. And what we did is we released some performance improvements for network policy handling in OpenShift 4.14. And we use this framework to just see and measure how much better network policies are handled now. And I will not overload you with lots of details. You can imagine there are lots of different dashboards and parameters to that. I'll show you two simple examples here. So first of all, this is the graph you've already seen which is the number of obvious flows and convergence time. So on top here, you can see how this graph looks for 20,000 network policies with a very simple profile, one local pod, one pod selector and one sider. So in OpenShift 4.12 before the improvements took 24 minutes to converge. Here at the bottom, you can see that after the performance improvements in 4.14, the exact same configuration was applied in five minutes. And that is how you can use this test by the performance scale framework, right? You can measure and see how much better your system is doing. Now, since this system converges faster now, it means we can also create more network policies within a given time. So that's what we have here. On the right side, you can see the scale limit for OpenShift 4.12 was just 15,000 network policies with a given profile. And in OpenShift 4.14, it was already 60,000, which is the sum of ingress and decrease network policies if the numbers don't make sense immediately. Okay, so really good. We use that for OpenShift with React, how well our network policy implementations work for now, but then we thought, oh, maybe it can be useful for someone else too. And the rest of this story, Sean will tell you. Thank you, Nadia. So, I work for Tigera, the company behind Calico. Sorry, just getting a bit of feedback. And where did we come into this story? So, Nadia invited us, as she said. And the problem really resonated with us as well. It's a question that we get asked a lot. We get it from customers, how big does this scale? And it always depends on so many different factors. So, it tends to be costly for us to answer. And we don't have a good way of doing self-service tests for our solutions team and our customers themselves if they wanted to run it. We do have some scale testing infrastructure, but it's a little bit long in the tooth. It gets necessary maintenance, because it's not our main focus, but it is very capable when we need to use it. But we're talking Grafana 4.x, I checked the version of the dashboards that we had there. And it's not really suitable for self-service because the inputs are not as kind of neatly specified as the ones that Nadia took you through. They're not very intuitive. It would need a lot of polish to open source it. So, perhaps, CubeBurner is the answer. We were just investing in scale and scale testing infrastructure again. So, we were also kind of looking around and seeing if the landscape had changed. And Nadia came along and asked if we wanted to contribute to the new tool. So, it sort of dovetailed really nicely for us. So, what do we do? My colleague Mazdeck, mainly, who couldn't be here due to some fun with his passport, built a convergence tracker for Calico. We tackled our sort of mainstream IP tables and IP sets data planes. So, we're monitoring the Calico equivalent to OVS's flows. We're monitoring IP tables and IP sets convergence. But we'll likely extend it to do BPF and other things later. And it all kind of weighs in about 200 lines of Python. So, it's an approach that's really easy to get started with and get something that works and you can start testing. And then you can add more things into it later to monitor the health of your components and things like that. Make sure that things are staying up. But you can do that manually initially. So, it's quite a nice framework to get started with. We added a KubeBurner yaml to scrape our Calico-specific metrics from our Prometheus instance and then those show up in the dashboard. So, that was straightforward again. And we made a new Grafana dashboard. This time for Grafana 10.x. So, things have moved on a little bit. It all went really smoothly with a lot of help from Nadia. So, she helped land some patches to KubeBurner with her contacts there and that sort of made our convergence tracker easier to write. And we ran some tests too. So, we also had some performance improvements and that seemed like an obvious thing to show. But I kind of wanted to show two sides of the coin. So, our performance improvements in our 327 release they apply mostly to selectors and not to like cider-based rules. So, I've got two profiles to show you later in the talk where we can compare the two different change in the 327 results. But before we do that, let's do a little demo and show how you run this tool. So, before the talk, I've set up a cluster in GCP. So, KubeBurner now supports arbitrary Kubernetes clusters. It's not in any way tied to OpenShift. I've got Prometheus metrics enabled in Calico. Actually, I'm going to do that as part of the demo. And I've got a persistent results server with Grafana and OpenSearch, I think we used for this. I've set up KubeBurner, the CLI tool, which is a download on a Jumpbox in GCP. And I've checked out Nadia's repo with the YAMLs that we put into that. And that has Calico's contribution in there. So, I'm going to switch over. Can we switch to this mic? Yeah. Okay. So, I've got my Jumpbox. And I'm going to set up my KubeConfig. And then I have a script. I have a script to configure the cluster. So, I'll run this script. This uses KubeKutl to patch Calico's configuration to enable Prometheus. And it also installs a manifest from Nadia's repo, which is what's needed to monitor Calico. So, it's just a kind of basic Prometheus setup that will work for this. So, if I run that, everything got patched and created. And then I've got a little function I can run, which again came from Nadia, that will just check that Prometheus's service has come up. So, then what do I have? So, while that comes up, I've got the Kate's Nepal Scale repo checked out. And most of the meat of it is inside the sub folder. And the most important thing to look at is the end file. So, that's a set of environment variables that control the framework. And you will recognize these from Nadia's part of the talk. I've also got KubeConfig in there. You need to set the platform appropriately. So, there's a sub directory for each platform that's supported. So, this is the offset Calico, obviously. And I've enabled the convergence tracker. And that's most of what's in there. I think the only other thing is, I've reduced the end of job pause. Normally it waits at the end of the job to collect CPU metrics and so on for a little while after. And I've shortened that for the demo. And if I show the metrics.yaml, I think this is a good one to look at. So, these are Calico's metrics that I've added at the end. So, basically, you just give a Prometheus query to KubeBurner and it will scrape all of these at the end of the test and put them into elastic search for the dashboard to show at the end. So, they go in the persistent store and your Prometheus can be discarded at the end of the test. And then the actual test itself is in that network policy.yaml. But I won't dig into that. It's a lot of templating. So, I think we're ready to run the test. Oh, did I source my end? I'll source the end file. And that's the sort of command that you need to run to execute KubeBurner. So, dash m for the metrics, dash c. I'm not sure what that stands for, but you pass the network policy, which is, like, the test you want to run, dash u to configure the Prometheus instance. It's going to scrape. And I've set log level debug just so we get more output. So, if I run that, it kicks off. And it goes through multiple phases. So, the way you configure KubeBurner is with, like, folders of yamls and chunks of yamls. So, the first phase is creating the convergence trackers. And then it's going through and creating some network policies. And while that's running, it takes about five minutes to run this demo, so I'll switch to something else. It normally takes about 10 minutes to run a proper run. While that's running, we can go back and have a look at the metrics. Switch back to that mic, I think. So, here's our results with a side-heavy profile. And in these results, this is the results from 326. I wasn't really expecting any big change in 327 on this. So, it converges fairly quickly. It doesn't use a lot of CPU, which is the graph on the kind of the left there. And the two graphs at the top, those are from the convergence tracker. So, we get metrics from the convergence tracker showing the IP tables' rules climbing and the IP sets steady in this test. There's also more results that would be off-screen here showing Kubernetes things. Moving to 327, it did improve, which was a bit of a surprise, but it didn't improve by a whole lot on this test and the number of IP tables' rules and so on, CPU usage all kind of fairly consistent. It just converged a little bit quicker. But if we flip over to the selector heavy profile, so here we have a lot of peer selectors in the rules instead of just kind of simple ciders, we actually used the script that Nadia talked about to ramp up the number of network policies until it failed.  But if we switch to 327, we were able to confirm that it converged at that rate and the CPU was a lot lower and everything was like as we were expecting. We also kind of doubly confirmed that things were working as expected by adding some extra metrics in 327. So we were able to put those into our dashboard so we can show this graph at the bottom left, optimize selectors. That counts up when we know we've optimized something as we were intending to optimize it. So it's really useful to be able to add those calico-specific things in for our testing. And yeah, it's sort of, it's nice. So, there are my results. It's probably still running. Let's get back to that idea maybe. Yeah, let's see how do we do. Yeah, pausing for one minute before finishing. Almost done. Let's just carry on. So, Tigera Perspective. I think I'm on these mics now. Tigera Perspective. Really glad Nadia reached out. It was a really good time for us. It is a shared pain point for us and hopefully we all benefit from the shared project. I know we'll be using Cube Burner in future because it's a lot nicer than what we have. We're able to kind of map some real policy questions that we had and some real perf questions into the available parameters and kind of showed roughly what we expected but some surprises which is nice in a way because it shows you that you really are testing something. And I'm interested to see where it goes next. So, maybe a little bit out of scope for this but we'd quite like to figure out a way to do like higher scale testing with mock nodes and things like that. We've been experimenting with that internally and it'd be quite nice to have some real connectivity checking like lead on top of the convergence stuff just like stoke my paranoia and make sure it's really, really doing what I want it to do. But yeah, we've enjoyed contributing. So, Nadia, how many network policies can I create? All right, getting back to the original question and telling what's next. So, we have an answer for this question with a predefined scale profile which boils down to seven parameters I've been talking about. Now, you could say that people don't usually run thousands of network policies with the exact same scale profile in their cluster. They probably have a couple of policies with very different profiles at the same time. So, what can we do with that? And that's something that's still in progress but we are working on that. First of all, we can try to define some meaningful scale profiles to be used as an upper bound. Saying, if I know that a 100 bot selector profile allows 10,000 network policies and I know my network policies just use 10 bot selectors and they need just 2,000, then it probably will work, right? Because it's much less than what is already supported. So, I can use this information already. Now, I may have lots of network policies in my cluster but I don't really know what's the scale profile for them. I don't know how many bot selectors and ciders they're using. So, there is a tool now that, given the output of all the YAMLs that it needs which is bot's namespaces and network policies can give you some analysis or a scale report for the existing workload that you have and it will show you all the scale parameters of different network policies that already exist in your cluster based on this YAML. So, it just provides some statistics and data for you and the most ambitious one is the approximation for any type of profile using existing scale test results. The simple option is, I know, one-sider profile allows 10,000 network policies and 10-siders allows 5,000 network policies. Can I approximately say how many network policies for a five-sider profile can be created without actually running the whole test? So, that's the simple idea. It goes further to all the different parameters. Of course, that's a pretty complicated thing but we are also working on that and hope to get some nice results there. And the last thing is adding more coverage. As you've noticed, we don't have IP block accept for existing network policies or named ports. They are not a part of the profile just yet but it can be added anytime. And we also hope to use the same scale test profile for other APIs like admin network policies in the future. Now, let's see if the demo finished. So, it did. And it spat out a UUID. So, this is how CubeBurner records the tests in Elasticsearch. And if we switch over to this tab over here, we should be able to show the last 30 minutes. And if there was more than one test in the last 30 minutes, it would appear in this dropdown here. But I think we got the right UUID. 8652, yeah. So, we'll show that one which was already visible. And if you home in on the time, this was just a rerun of one of the tests I already showed but you can see you get a live dashboard where you can poke around and scrolling down. We have a few more Calico metrics and some metrics from the Kubernetes API server. You can add whatever you want when you're building these dashboards. And yet, the profile at the top. Oh, the nose should say five. That's a mistake. So, it works. It worked. I think we have a couple of minutes for questions. So, maybe we can just have a discussion. Be here for any questions and discussions considering a lot of people are leaving and moving probably. Great. Thanks, everyone.


Hey friends today, we are hanging out at Disney's Animal Kingdom And we're gonna be dining at one of the highest rated restaurants in all of Walt Disney World Tiffins this restaurant's central theming is all about exploration and adventure So I'm sure we're gonna be trying some very interesting food items And then later on we're gonna park hop over to Epcot to go check out Joey Photone because he has special guests with him and Mer from impractical jokers is one of them any hoos. Let's go do this Today is August 7th, and I wanted to come out to the parks a little bit later in the afternoon It is been super hot out August is a very hot month in Florida and like I always say Animal Kingdom I feel like is the hottest park We're gonna be meeting up with some friends and like I said before we're gonna be dining at Tiffins I have eaten here before and it was always amazing it is definitely a signature Disney restaurant and I'm gonna try something different this time and then maybe Afterwards we're gonna see if we can ride some rides or if we have time beforehand maybe hop on a ride or two I mean, I just love coming to Animal Kingdom Right here is Tiffins restaurant, and it's located right next to Nomad Lounge It's actually together so Nomad Lounge is like the lounge for Tiffins And they have a little bit of a preview of the menu and like I said this menu was so amazing And my favorite thing has to be this Lion King dessert. Look at that. It's so beautiful looking now This is just a little bit of the menu. They have so much more in there, but I'm excited. This is one of my favorite restaurants Last night I was actually at Epcot and I watched Joey Fertone's show But I was just hanging out with friends and it was so cool that Mer came out and I got to meet Joey Fertone I got to meet a member of NSYNC. I got to meet a member of the impractical Jokers. We took photos together They're on my Instagram stories if you guys want to check it out But he had so many other friends there Ryan Cabrera like I was like I was in heaven It was such a great show that and inspired me to come back out and do it again the next day and bring you guys along So I can show you because it really was such a great time Let's take a look at some of the wait times and see how busy the park is It looks like flight of passage is only a 65 minute wait Navi was 45 minutes Cali River Rapids is a 60 minute wait Which is kind of shocking dinosaurs 30 minutes expedition Everest is 30 minutes.  You can't beat a 25 minute wait for Kilimanjaro safaris So we're gonna head right on in and it's probably not even a 25 minute wait Sometimes it's like a walk on and they still say 25 minutes We love coming to Kilimanjaro safaris at this time because usually it's feeding time and the animals are way more active now I have to point out though. This usually closes down before the park does I think the last safari goes out at 7 30 So if you come anywhere after five, it's usually the best time to come in my experiences. So hopefully we have a good safari Up and here comes our trusty motor transportation for the day looks like it's Simba one Sean have we ever rode Kilimanjaro together? Yes we have. You have?  You're feeling, huh? Oh, we're moving Let's go That breeze And let's make sure that we aren't making any loud noises at the animals like whistling clapping or calling out to them as this Is their home that we are entering into now We didn't want to frighten them look at it above see all of them But we usually have to be black right now. Oh, wow. Look at that rile right there eating food Look at that It definitely looks like it's feeding time perfect time for a safari He's back pelicans During mating season they've got a wingspan of about seven to nine feet long Looks like we're getting a little bit of a rain shower here Wow, look at that. Oh the rain's coming in though. They're running though They're just standing there chilling It's dinner time and it's raining. Oh the water. Oh, I got wet Elephants love the rain Seriously, this is the best look at the baby rhino There is a rhino in the mud right there look at that So, yeah, that was a great safari I don't know how much of the footage I could show you guys because it was super rainy and very bouncy because they were trying To like get us through there, but all the animals were out. I saw everybody the rhino though the baby rhino Digging a hole in the mud will last with me forever. That was the highlight of it. It was amazing I'm so happy now. Let's head to Tiffin's. Let's go get some food and also I'm excited for the coffee at Tiffin's. The coffee there is next level only sold there only at Tiffin's And here we go. Are you ready? I'm ready for my first Tiffin's experience. Yeah, first Tiffin's experience You know what Joe Rody does eat here sometimes he does yeah He does dining with imagine your first time at Tiffin's too, right? Are you guys gonna get the Lion King dessert?  I'm only kidding Just like Kristen mentioned this restaurant used to offer Dining with an Imagineer and that was a special event where you get to come in and dine with an Imagineer and Joe Rody used to be One of the Imagineers here and it's funny because this restaurant is based off of Joe Rody and the other creative people behind Disney's Animal Kingdom There's tons of photos on their journeys the dining rooms are split up between Africa Asia and then animals and it's basically kind of just made to show off all of the Amazing things that they did as they were going around getting information to build the park and I love that and Joe Rody's known for Animal Kingdom But he had such an influence on some of the best rides at Epcot even he did Maelstrom and he was even dream finder He actually was dream finder at one point. So it's really cool and I love this restaurant Tiffins is a restaurant But it's also a gallery of art based on the travel and adventure that inspired the creation of Disney's Animal Kingdom And there was a lot of cool things in here lots of art pieces and pictures and some of them There's like a little game where some of them are actually pieces from like Africa and some of them are from Harambe You remember they're not real so you have to try to guess which one's real which one's fake which one's real and which one's here That sounds like a game Now that we've made it into the restaurant we're at our table and we're in the conservation room, which is really really nice This is my favorite room and I'm gonna start off by ordering a Indonesian pressed pot coffee It's a coffee that I was talking about and it's very fancy in there So I had to take the hat off and we're gonna look over the menu and try to decide on what we want to get Here is a look at the full menu and I want to get the charred octopus. I love octopus I'm all about it. They also have a corn and sweet potato soup Which is phenomenal the butter chicken and the whole fried sustainable fish is a popular one But for me, I think I'm gonna do the serpent turf a little South African spiced beef tenderloin Seared scallops potato puree grilled vegetables some nice demi glaze.  What is this? It's pomegranate focaccia with like a pomegranate oil and he said to mix the oil make sure you mix it And a little goes a long way a little goes a long way.  I like that a lot Enough of the bread business here is the charred octopus and we're all gonna share this and it looks really good It's got chorizo in there Just one tentacle and I'm excited. It looks really good good char Especially down at this end there and I love octopus ever since I had it at mythos I've been a little bit obsessed. All right. Here we go.  I feel like we need to add a little bit of this into there, too Yeah, a little bit of everything on one bite except for it all fell off. I Am so excited to try this it looks so good. And like I said, I love octopus. Oh Yeah This is definitely a little bit Adventurous especially when it comes to the different spices on the bottom down here Like the whole entire plate is actually coated in it like this isn't the design of the plate It's actually all the different African spices on there and it actually has a very good texture to it I like I like I said, I'm a big fan of it in the corn salsa is a nice little touch a touch of corn salsa This piece right here definitely has a lot more of the char on there and that's what I like You guys know that I love the char even on my steak Shortly after we tried the octopus all of our food came out and Kristin got the lobster mac and cheese And look at all the lobster on top of that good chunks of lobster I'm excited to see where this ranks on the right down Main Street Mac and cheese rating like everyone told me I needed to try it. So here I am. Well, there we go And then Sean you've got the butter chicken over there. That looks actually really good. Look at that very fancy very nice, and then I went with the surf and turf and that's the The beef right here and then the scallops and also the potato. It's one of those potatoes That's like double fried. This all looks amazing and I cannot wait to dive into it The octopus itself also has tequila. So that's what I was tasting actually as I was Sampling it a little bit that I was tasting a little bit tequila Fun fact, I have never had scallops before and when I first sat down I asked if I could sub out these scallops for shrimp because I do love shrimp and they told me that the scallops were Almost the best thing on the menu. So I said, you know what I'm gonna roll with it I'm gonna try something new today, and that's what we're doing. We're gonna try the scallops All right, here we go my first reaction to trying scallops first time ever here That's amazing right up what I Honestly can't believe I have never tried scallops before and that was phenomenal That was way better than the shrimp. That is so good Now I'm really I'm really worried though because what if my expectations of scallops now is always gonna be that right there At one of the finest restaurants on Walt Disney World property, you know what I mean? It's gonna be a high expectation now anytime I ever have scallops again, but that was so good Just tasting that sear on there and it has that shrimp texture I'm a fan. I'm a scallop fan It Might be shocking to you guys that I haven't tried scallops before but I've been a plain eater my whole entire life and within the past two Years I have been on a mission to try things and expand my palate and it has been fantastic Like I'm just trying seafood for the first time I would have never eaten seafood like if this was me like probably four years ago I probably would have never came to this restaurant All right, here we go Cut right down in get some of that demi glaze Well, the steak looks great. I'm not even gonna lie Here we go all about the steak today Honestly, I have to say it's all about the demi glaze and I couldn't remember what it was but it's a cola based one So it's actually like really really interesting It's funny that it's on this menu and I love it like that makes the whole entire meal the steak itself is pretty good I do like the char on the outside I wouldn't actually put it up there with like my favorite steaks out there because I feel like this is more for like a Higher palette. I'm more of like the meat and potato guys like you know I mean and this right here is good But I need some fat, you know, I need the ribeye the ribeye is where I'm at But the demi glaze if I had that on a ribeye that would mean chef's kiss right there The issue with this is it's so good But so small like the portions are tiny but I could eat so much of it and it would cost me a lot of money Like this was I think $67 so like that is a lot of money, but Top notch top top notch Honestly, this meal is actually fire I mean everything like all the components to it is just so amazing the potatoes are just out of this world Look at this. Oh man The the demi glaze the scallops like I'm a big fan. I'm a big big fan Like like I said the stink rigging is just out of steaks, but as an overall entree This ranks pretty high for me very high actually Seriously that good Now that we've gotten done and like I said, I gotta say that entree like the whole like surf and turf was phenomenal I loved everything about it, but it's time now for some desserts And you know, I already talked about this Lion King dessert, which is so cool I just I literally get it just to take a picture of it But now they have a 50th anniversary lemon meringue pie and this looks good too And it has one of those little Madeline cakes in it some graham cracker cookie lemon basil sauce lemon basil sauce, huh? Lemon basil I've never either Yeah, we're doing it. We're doing it big day and the coffee's gone that coffee did get a coffee was phenomenal I kind of want to keep this you know pretty in a purse We're gonna actually split the dessert so we're gonna get one lemon one one Lion King one and then we all can just try Like you know me if it was just me I would just get the Lion King one because I love it that much, but the lemon one kind of cut my eye Here is the Lion King dessert and take a look at this this down here the Simba part This isn't actually on the plate itself. They actually put it on there So it's a part of the dessert and this says remember who you are Remember And here is the lemon dessert doesn't that look so fancy and once again Just like the Simba play put the Walt Disney World 50th anniversary logo on the plate And honestly if this is only for the anniversary then this isn't gonna be her much longer But this looks so good too. It actually looks like a lemon kind of reminds me of the dessert They have over at bowling Bear this looks I'm excited to try them both and then decide which one I like more Remember who you are Seriously desserts are just so pretty you don't want to destroy them But you have to you have to do it Here we go All right, here we go. I'm gonna try the lemon now Kristen said I got to get the bottom piece. That's the way, huh? What's this little cotton candy green stuff? What is that? I think it's like a matcha teacake or something matcha teacake. Oh, no, don't want to lose it The moment of truth That's a good dessert too. Oh It's gonna be a close call If I would have to choose I think it has to go to the Lion King Let me be the final decision. Oh final decision because you're just trying that one for the first time Definitely I mean this is a good dessert though. Yeah, the plating is great. I mean presentation presentation Simba remember who you are. I love this plate though. What? It's the 50th To lemony yeah, this is just a lot of there's a lot going on there Yeah, this is the way Well dinner at Tiffins was Exceptional, I really love the desserts are probably my favorite thing other than also the colas demo glaze That was fantastic. The whole meal was great Now it's time to leave here make our way over to Epcot try to catch Joey for tone Hopefully we'll make it there in time But if not I've seen it last night, but I wanted to show you guys and see if he has any other special friends joining him tonight Like I don't know if they change it out. He does four different shows. So you never know I guess you never know who's gonna show up Well, we made it from animal kingdom to the boardwalk We figured it'd be faster to walk in here and then head straight to world's no case We're a little pressed for time. It took us a little bit longer than I thought and the show starts in 25 minutes 20 minutes, holy moly We're not gonna make it We are just power walking through the boardwalk no time no time for boardwalk Joe's marvelous Margaritas We just got to go go go only here for Joey. We're here for Joey not for Joe We have nine minutes to get from here to America and find a seat in probably a super packed theater Chris Kirkpatrick We might make it I think we're gonna do it nine minutes. You have to power walk And by God we did it Look at that one minute to spare. We made it to America. We're gonna make it. We did it 759 holy moly Joey for tone in friends. Look at that. Hey, how are you? We made it I Love this song Patrick came out. So basically that's half of in sync just no Lance bass or JT JT, but we got JT right here a taller version a taller version of JT I'm the Joey for tones. I'll take that I'll take that but also I don't know if you guys notice Ryan Cabrera came out and last night Murr was here from in practice I don't know if they're gonna come back out, but they switch it out. It's never the same show So I'm very excited. We're gonna see who it is now Chris Kirkpatrick came out. No more Okay, well that Joey for tone show was awesome Chris Kirkpatrick came out So that's basically half of in sync like I said no Murr this time though. I feel like they swapped them out It's always different, but I loved it I love the different songs and it was great to see my friend Chris with LBV TV We were dancing to bye-bye bye and it's really good show. I love to eat to the beat concert series It's always so amazing that people you get to see, you know what I mean? Like it's so crazy and now we're gonna watch the little fireworks just probably the finale because that's my favorite part and then Maybe make our way over to the boardwalk. So I Think we are done here today. It was really awesome Catching a little bit of the tail end of the fireworks. Those are like my favorite parts of the fireworks Just those blast alone, you know what I mean? And he if you saw Chris from LBV TV He was standing there who was live streaming it And I was like kind of waiting to see if he knew like they were gonna be blasting off like right next to him And he did he ducked out of the way. So it was really fun And I mean Joey Photone was a great time Chris Kirkpatrick no murder this time though a little sad about that But I do love murder and I had a great day I mean honestly overall animal kingdom and then over to Epcot.  So I hope you guys enjoyed it. I enjoyed making it. We'll see you next time Bye