from 1984 the time is 22 minutes to midday you're very welcome back into the program Rory on the radio with you until midday Collie McFadging is here we're gonna talk all things movies and I'm delighted to say he's in studio with me this morning Collie good morning good morning Rory it's the most Rory intro and I was just a little worried do you know when your small child and your parents be going no we're not putting up the decorations yet Christmas isn't here yet you have you have to calm down you can't get too excited until a couple of weeks we still have two weeks to go to Ghostbusters Rory all right you can't peak too early no this is our last this is like our last meeting before yeah I feel justified I feel I feel there'll be a lot of text in between in between times have you seen it have you seen it yet have you seen it yeah come and see it but yes it's two weeks it's not it's less than two weeks it's it's 13 day it's 13 days 13 days yeah there you go till the new Ghostbusters and you know I don't know about you like you're always excited about them I think you enjoyed that the last one a little bit more than I did yeah I liked it that was that was about it but there seems to be a vibe of last one was kind of to re-establish the franchise as it were sort of a steady the ship yeah steady the ship introduce younger kids maybe to give them a couple of young kids to look at as well as bring the old people back but this one they seem to be really believing in this is the one that's gonna bring Ghostbusters into into the 2020s that yeah looking at the ads and looking at all the materials that Sony are sending out it seems that they're pretty confident that this is a good one they've got you just get that that impression yeah you do get that vibe and there's no real I mean remember with afterlife back in 2020 or whenever it was supposed to be 2020 they ended up in 2021 but there was lots of secrecy around you know the original you know Bill Murray and Dan Akroyd will they won't they will they appear won't they appear if they do appear will they play a big role or a small role or just be a cameo there doesn't seem to be any secrecy around this one you know judging by the trailers no absolutely they're playing a big part the real Ghostbusters there you would wonder how it is how it's gonna be but they're certainly doing all the you know all the press seems to be as much as much them the effects do look good and it looks like you know kind of a new scary moment and they're back in New York to which I think I think works to doesn't it absolutely you know I understood why they did it the lot the way they did it the last time but now you go now this is what I'm talking about and hopefully you know we can put a few of the other things particularly Ghostbusters to out of our mind I don't be too hard aside from the song aside from the Jackie Wilson song yeah that Statue of Liberty dancing I see you're only a young fella you see I thank you I went you're talking all about the confirmations at the moment I Ghostbusters was a movie I went to around for my I think with my confirmation money Ghostbusters to Ghostbusters I'm very old I'm very old so I had a couple of years to look forward to Ghostbusters to hence the hence the disappointment it's like the fourth Indiana Jones movie that we don't really mention very often it's all about the run-up I had a load so well you know what happened there don't you you had you had the original Ghostbusters which you know wasn't really for kids no not at all you know it wasn't really for quite rude yeah exactly even by today's standards is quite right but you know then you had the cartoon and the intervening years you had the cartoon and all of a sudden it became something for kids so by the time the studio got their hands on all of the original cast and managed to coax them back they had to do something for the younger audience yeah and I think it might have lost a little bit and it was neither Fisher nor Fowle even if they totally embraced the younger audience it could have worked but he was trying to kind of keep everyone happy did lose a bit of its edginess yeah I also forget the first one I know you're a mega fan but you know Bill Murray's behavior isn't great it's not I thought it was charming as well and you go oh it's not great I was watching it relatively recently about a year ago and I was going oh I don't think you talked to a potential customer or certainly they wouldn't stay a potential customer and then no definitely not to be a review on truss pilot absolutely but you know it is where it's that is actually the movie my lifelong love of Scordia Weaver began so and it hasn't changed it hasn't changed at all so that's common that's just coming right and bang on time the first day of Easter holidays basically school holidays I think it's gonna be I'm confident about I think it'd be great fun and I think as you said they've got the mix right it feels of the old nostalgia yeah and a new young cast with the guy from Stranger Things with the cute little sister and the right breed of monsters they're saying as well it is a bit scary which is not a problem kids like to be scared look at your classic Disney's scary is not a problem you have to be appropriately scary that's fine yeah exactly but one of the problems with a couple of movies we had lately like Five Nights of Freddy and I'll get murdered for saying this imaginary is that they're aiming at 15 year olds but it's on the scary level for 12 year olds and it's a balance thing whereas a good scary 12 year old kids love it kids love those those sort of things so more parroted I hope next time we're talking you're gonna say I went to see it callie and I loved it well I hope so too I hope so too so that is out March 22nd hit the theaters all right that's Ghostbusters Frozen Empire right let's talk do you know what we're gonna do we're going to take a very quick commercial break and then we're going to talk doon too yeah because I'll waffle on about this one very just I'll let you waffle away talk after this treatment or surgery did you know you can receive immediate treatment across the border under the new Ni plant healthcare scheme at potentially no cost dunigall patients are still being treated with us at Kingsbridge private hospital northwest post-Brexit the process is easy and our dedicated team will help guide you through it so why wait contact us today to find out how you can skip the waiting lists and receive treatment in northern Ireland visit Kingsbridge private hospital calm because life matters dreaming of a getaway this summer make it a reality with two e choose from beach or city breaks around Europe and beyond with hundreds of holiday packages under 600 euro per person and low booking deposits take to the skies from Dublin cork our Shannon holiday sorted to we live happy opportunities apply are you worried about trees on your property northwest forestry services belly buffet are fully insured and have over 40 years experience in dangerous tree removal tree felling surgery and stump grinding for peace of mind call northwest forest services belly buffet for no obligation quotation on 9 1 3 2 0 double free foe and company belly buffet and letter Kenya the largest docus of interior and exterior paint in the northwest if you're planning a painting project and need help picking the right color and brand of paint for your home or commercial premises call in and ask our qualified paint color consultants interior designers and interior stylists the team at foe and company belly buffet and letter Kenny will be delighted to help the euro millions mega draw on Friday March 15th is for a guaranteed jackpot of 130 million euro Ireland's daydream numbers act through the roof 130 million euro time to dream big the National Lottery it could be you play responsible play for fun the perfect family day out starts and finishes with a visit to the Donegal Boardwalk Resort carry guard packs the buggy bikes and tracks and track along the boardwalk visit the playground and finish with a tasty lunch or dinner in our restaurant open Wednesday to Sunday complete the experience with the stay in our cozy colleges explore more at Donegal Boardwalk Resort dot ie this is Saturday morning rewind it's 14 minutes to midday we are talking all things movies and Colleen McFadden is in studio with me to do just that and we've just been talking Ghostbusters Frozen Empire that hits theaters March 22nd a big release it's in theaters now Dune 2 yes on the weekend of the Oscars here's my prediction 2025 best movie of the year Dune 2 oh that's a bold statement yes and does this Kevin Costner big epic coming out in the summer may or may not get in the way now in the way you're a fanboy for a Ghostbusters I was about the first Dune movie even though I can't my Dublin accent means I can't say it quite properly I always say June and people go it's what about the summer is it but anyway I was a firm believer as a kid I was mad into Star Wars and I got older and a couple of friends went oh you have to read these books this is where they got all the ideas from except it's kind of for grown-ups and I liked it but I was kind of a bit lost and I pretty sure I saw the 1980s mess of an original movie a half of it maybe maybe I sort of got a little bit of sort of cult yeah it has now Sting's running around in his underpants and there's loads of them up there with sort of Starbeast that's exactly but so when this one came around I was really interested because the director Denny Villeneuve he did as Blade Runner 2049 but particularly he did Arrival which I thought was one of the best movies of that year with Amy Adams because it was a grown-up great movie and it's used as sci-fi but it's not really about the sci-fi there's aliens in it but it's not about the aliens it's a bit like we were actually having this discussion last night it was Arrival District 9 all that sort of yeah they just used the sci-fi as a device to talk about things that are happening now and this movie is very much the same now Dune blew me away I absolutely adored it have you seen the first one no try this give up I can understand how my sister was the same and it does take a while to get into I think in the cinema really does make a difference because we know you you've kind of said well I'm here now anyway yeah as most of the effects but also it's the visuals and the sound but I absolutely adored it and I even though I'd seen it twice in the cinema I watched it again the other day before I watch this and I watched this 8 a.m. this movie was not designed to be watched at 8 a.m. but I went to watch so I'd watched three almost three hours of it the night before watching the first one I think that was one of the things that put me on the length of I went in under duress two hours and 45 yeah I can I can understand why you're wrong but I can I can understand why and then I watched the next one and I just done six hours in it and all I could think of afterwards is I want more I want more I want to go back to this okay I've it's such a beautiful looking movie it's amazing looking the big screens you're going this must be CGI I know there aren't giant sandworms not one bit of what looks like CGI they've obviously used a lot of real real effects if you know what I mean they've been in the desert the acting is top-notch from all the cast and you're watching this guy who's become you know he starts off as this like privileged prince who kind of becomes this underground warrior and you know this is Willy Wonker that I watched a couple of months ago it's like a different actor Zendaya is amazing as his sort of link to these people but what I really liked about it is it's for grown-ups so it's not as much as I love Luke Skywalker it's not just Luke Skywalker coming and saving the day you're going is this guy good given them all this power what's gonna happen and not everything goes the way it would in a superhero story the awesome butler who's unrecognizable we last someone's Elvis right and he's this bold evil guy it's actually the character sting plate and he just re resonates malevolence all the way through it it's spectacular there's a fight on this other planet where it's like a negative of it's all black and white and it's just spectacular I've never seen anything like it and one of the things and I won't keep on going on about it so not for everyone is that they don't explain everything to you you walk away going I think that's what why that happened but I'm not sure you're walking away with questions with questions and different interpretations we could watch it together we walk away and go well that's why he did that and I go well did he do that or was he made do that yeah it's I think it's a brilliant say that's you know that's not a good thing I know I know I came away with more questions when I went out others will say well that's really good because it's open to as you say it's open to Chris of the Nolan's movies particularly things like you know tenant and no no I don't copy or one escapes the name escapes me at the moment about the dreams of killing Murphy yeah I look it up with the spin and top at the end why quite can't it just escapes me at the moment it begins with an eye and I know that it's like that so it's not it won't be for everything but I think it's brilliant I really would say even though you didn't like you didn't like the first one if you get a chance for it I think with you and with your side for about I really think if you saw it on a big screen and the biggest screen you can and the hands in her sound in it yeah and it's just like it is at times not so much music as noise I had some of the most impressive things I've ever seen in the cinema wow I loved it I loved it now I know the movie that I know you saw Inception Inception thank God for that I thought I was going to sleep if I had any hair I would have had it pulled out and another movie I know you saw which is the opposite of it because you know wicked little letters will is fine on screen because it's all about the actors and the writing isn't it yeah it really is and it's it's such you know the approach to it and the story it's a true story yeah which I was fascinated by and there's probably a little bit of social commentary going on there's huge amount of you know it's about a spinster yeah yeah I think so yeah it's still lives at home with her parents she's in her mid to late 40s and she starts getting these letters but the letters you know contain profanity yeah and obscenities but it's very childish profanity yeah it's not it's like a child's idea of what grown-up swear if I was allowed say any swear words I would swear all those except you know if your parents told you off yeah and you went to your room yeah and you know throwing a strop and you did right Stinker with swear words in it too and she's the blame falls on Jesse Buckley who I've always loved ever since I saw Wild Rose you know and the only problem with this movie is they don't get her to sing you know we anytime she does a bit of singing yeah but not yeah she does a bit of singing but they don't get her to do a song if you know what I mean and but and she just look at it goes I'm Irish I just swear whenever I want and I need to put it in a letter as a man who moved to Dutty Gall I'm very aware of this this is certainly the case and it's just great fun and I was delighted you liked it so much because I think we mentioned it last time that the reviews were weird that nearly all the women who reviewed it really liked it and a lot of the men didn't and I think they were looking to see see it as a mystery in a who-donut where it's really more about the interaction between Olivia Cone and Jesse Buckley I mean within about 20 minutes I thought so too yeah it's screaming at you who's actually responsible yeah but it because of the approach it's it's approached like a black comedy now there is there's scratch away the surface you know there are some darker elements you know family dynamic and things like that a lot of darker elements to it but you know on the surface it's it's funny it's witty it's charming yeah but I just think you know the whole concept that a whole village starts getting these obscene letters and the utter scandal yeah and you know fast forward 70 80 years to you know modern times and it's a daily occurrence on social media it's basically Twitter yeah but we've seen cases of similar stuff of people getting sued by famous celebrities go but you're famous I just doesn't matter what I sent you from the my anonymous account people go no they're still real people it's the same thing this this behavior maybe Twitter and Instagram have made it easier this behavior was always there in us exactly yeah but just use whatever medium was available Charles Dickens famous use get horrendous amounts of anonymous hate mail yeah well there you go there you go and it's interesting to what I found out was the attitudes you know towards you know the woman police officer once you must be referred to as woman police officer and that's a bit that I knew was based on the true story and I went oh yeah but the chances of the first ever female police officer being involved in this and I googled it afterwards went absolutely true absolutely true we're only allowed handcuffs at the discretion of the the superintendent I think people love it and I think you know for as much as I love doing as much as you love ghostbusters and that's the thing people in that sort of movie just doesn't appeal to I think they could really like you know you're you're at a loose end on a Sunday you know Mother's Day bring your mother she knows those words I know she pretend she doesn't she does she does and she enjoys and she knew them before you were around as well and use them maybe about you sometimes so quite a bit on offer there I mean we have obviously ghostbusters doing too on the way at wicked little letters still there yeah I think it's going to hang around for a while because there's not a lot of similar movies after we're getting all the blockbusters and um Easter movies we've Kung Fu Panda 4 coming out soon so that would be for the holidays so some of the more grown-up movies like wicked little letters will hang around for a while because and people who like those movies they come on a slower thing as I said Mother's Day tomorrow oh can I also mention as well Mean Girls part amount of doing a special thing that all all cool moms go free tomorrow oh to mean girls now if you want to tell your mom she's not cool you're a braver man than me we're braver all the cinemas I think are doing it so it's a free entry to all all mums all mums tomorrow and Mean Girls musical is really good fun I really enjoyed it I know you weren't a fan of the original but you're wrong about that too so next month I will let you watch ghostbusters but you have to watch dune and you have to watch mean girls okay we'll do that that's an agreement Carly as always thanks so much we will talk to you in April see you then I know scary and that's where we have to wrap things up for this morning's program as well a few quick shout-outs do before we go a very happy birthday to Ailish Higgardy, Shanice Orr and Marie Fisher and also to Kiera and Timmy Lund and family and also to Mary and Gerald Ford in the family and Isabel Rogers from John Wallace this morning and Rory can you please play a request for JJ Kelly whose birthday is tomorrow a big birthday for JJ at 75 years old so best wishes to you JJ from all of your friends at Bali Liffen Golf Club and that is where we wrap it up for this morning and Michaela is up next with a news update for you Paul McDevitt here with the Saturday Shuffle and I'll talk to you next weekend from 10 a.m. Highland radio are celebrating another birthday we are inviting you to join us for our


Hello everyone and welcome to this episode of this week and cloud native. This is episode number nine And in the previous episode we spent quite a bit of time kind of exploring the a lot of the information about the pod security Admission controller and in this episode. We're gonna do a little bit more hands-on there. So Let me know you're out there if you're out there, and I'll be happy to raise your voice into the Comments, so if you're listening or if you're tuned in definitely, let me know that that's happening Good to see five of you out there the hack and B for this episode is located at the link below where it says hack and D I oh slash at TW ICN and so if you want to see the notes or if you want to put anything in there You can put that stuff there How's it going Russ? Good to see you. Let's dig in here. So Yeah, Russ saying hello to everybody and then here is our notes for this week. That's some good stuff to cover I'm doing some work at some, you know pre-work and getting ready for kubecton. I will be down there in person So I hope that some of you will be as well and hopefully we'll get to see each other I'd be tremendous kind of off-center somehow Stream title things off should say this week in cloud native search magic interesting because according to Where I usually set that that's set correctly, huh? Interesting interesting Take a look here and see if there's something I can do there. Give me one moment Yeah, sure enough. It is correct. It is not correct, but I don't know how to change it because The place where I've normally changed it. It's already set correctly. So I'm not sure where To make the change guess we're gonna have to fix it in post All right, well, thank you for pointing it out at least I don't know exactly how to change that I think it's already set correctly on my side. So I think I can do it on my side. It's correct. Sorry about that Anyway, let's dig into it a little bit more So as you are already aware, this is cloud native TV. This is a official live stream of the CNCF and so it's subject to the CNCF code of conduct If you like the stuff that I'm putting out here make sure that we're that you're throwing in the That you subscribe to this channel and you'll be notified when things are coming We're trying to still figure out the calendar things you can actually schedule ahead of time But that's taken a little bit of time If you want to see any recorded sessions like if you missed an episode or if you want to check something out You can actually go check out the YouTube streams And this is where a lot of the recordings that we're doing will be here So here's a bunch of this stuff from before the last week and the week before but each of these curated playlists Will actually have the content from the previous from the previous shows Actually, it looks like some of mine are missing. I'll figure out what's up. Oh, that's the cloud native classroom Sorry, you want to see a previous episode that'll be there for the Kubernetes side of things There were a couple of good articles or a couple of good things that happened including this one from Celeste Hogan Celeste is a good friend from the community and points out that there's a really great list of first projects or first You know good first good first items inside of the Kubernetes docs And I wanted to kind of share with you how to both define them and also to Be able to you know, how do you get involved, right? And so if you go to go dot ks.io Good dash first dash issue and that's this URL right here go dot ks.io slash good dash first issue and you're going to see any issues that are in the Kubernetes Repository that are marked how wanted and or good first issue And these are great for getting started and if you wanted to look for a particular category you could jump into You could look for you could look right in here And there's lots of good stuff in here for for good first issues And so this is a great place to start if you want to start getting involved in side of the Kubernetes and Environment and there's definitely stuff that is like Easy for some and hard for others like there's one that is talking about like some of the Korean translations for the Documentation is incorrect And that's a great first issue for someone who speaks Korean will be very easy It would likely be very simple for them, but it would not be very easy for somebody like myself Does not speak that language Yeah, there's some stuff in the perf test there's stuff in cube builder there's stuff in the hierarchical name spaces There's there's tons of stuff in here including stuff for docs. So great place to get involved There's actually also just recently a thread on the Kubernetes Twitter bot, which is kates contributors And so if you want to follow kates contributors, there's always good information coming from kates contributors regarding Things that are happening inside the community. They'll announce that like the the summits coming up and those sorts of things But they also call out right here information about Other things that are looking the other folks other parts of the kubernetes community that are looking for contribution So here's an example of building an intuitive dashboard So if you're if you're if you'd like to play with angular JS go lang and client go So gui is looking for for such contributors to help them build an intuitive dashboard or information here There are a few other callouts just this last week around things that are around folks that are looking for Feedback there as well Go ahead and retweet those and if you're following me on Twitter, you'll see those retweets as well So a sick cluster of life cycles looking for contributors to help us with at CD ADM, which is a neat project It's basically a tooling that automates the lifecycle of at CD within your cluster cluster add-ons in cube ADM Are you a user looking for a way to give back here for more information? Also, we have sick scheduling looking for contributors to help document scheduler internals They're looking for more folks in the sick auto scaling They're looking for more and then here's what I was referring to earlier If you're considering registering for the contributor summit at the upcoming cube con virtually or in person Please register ASAP if you haven't done that or if you plan on actually attending cube con either Virtually or in person definitely check that out. It would be a really good time So, yeah, great Twitter bot for following what's what's happening kind of in the community and getting updated the next thing up Usually as we cover a security announced look like I have some other chat some kind of bot Would be nice with posts clickable links. Well, Duffy talked about them. That would be neat. Yeah It's something maybe I'll build Why that'd be kind of fun? so We have Kubernetes CBEs usually I check out the announce group which there's nothing in here since July 14th, so that's good No big new security announcements I did find another dashboard that I wanted to share with you all because I thought that this would probably be a good source of information as well I'm not sure that everybody is aware, but Kubernetes is actually From the relationship with hacker one and they have a bug bounty program and it was launched in January of 2020 Which feels like it was a million years ago and only yesterday at the same time so this is the kind of a hacktivity list and I think you can sort by when it was published or when it was Body I guess you can't really sort this in a way that I think makes sense, but here are some here Here are some things that have been Opened against our you know publicly disclosed about things that are happening within the cluster and if you look at that security Announce list you're going to get to see the same events, but I think it's actually probably a pretty good way of understanding what's what's coming and There'd be a coordinated disclosure So if you're following the security list that is in the notes, then you would still be able to see this But also this is kind of like where you're seeing this is where folks that are actually doing the work of trying to find Vulnerabilities and Kubernetes are going to make that announcement And so let's just take this top one here for example node validation admission does not observe all old object fields The validating mission controller Mission webhook for node objects is passing old object fields incorrectly on admission review request It's identified. This was an interesting one because they're theory the premises that you could Potentially allowing users to bypass validating admission by updating node labels taints and others Which is an interesting attack surface and they created a validating webhook and they created a dummy and they created a potential Issue location. So this is a great example of an expert of a vulnerability documentation like that actually provides experiments or provides actions and Really explains the impact of a vulnerability that has been put out So I thought this was really well written and really well really well done here and then You know as I was saying before so this was resolved as a CBE This is the CBE here and again if you just go to that information Within the CBE document There'll be a link to Kubernetes security announce which is the group that I usually check every every time we log in here And this is where you can actually see like what this issue was rated as What the affected versions were and what the fixed versions were and so this particular Piece was actually exposed and fixed so good stuff But anyway more interesting information to go look at Superd CNCF things. I wanted to talk about I always check the cube weekly for the previous week to take a look And see what's coming or what would be announced and what is happening this week? CNCF programs online programs for this week We have Kubernetes clusters need persistent data by James Byron of storage OS And then that tweet that we were just watching for or we're just talking about from Celeste Hogan and Then there's some good technical articles talking about Prometheus definitive guide Interesting so digging into the Prometheus operator by Nadad Desai from in for cloud technologies Kubernetes CI CD by Alex Chakas from Ubuntu and SQL comment emerges with open telemetry interesting. I hadn't seen that one yet Nimesh Paghat from Google Cloud and Then we have Daniel and John John Doing a sneak preview of the cube con talk Should be pretty fun I'll see you to subscribe so subscribe to events for push and pull operations serves as a UI to view them. Oh I mean that should be a really interesting talk So if you're and I think that will be pre-recorded so likely you'll be able to see that one both virtually and in person So we'll see how that works out Upcoming events there'll be kata and arm a secure alternative to the SG space Building an HAA control plane for Tinkerbell. Oh, wow by Jason my good friend Jason de Diberis. That should be a fun one That's coming up on the 15th hasn't happened yet two more days and Then on-demand seminars moving from CLI's to control planes with cross with crossplane somebody else from crossplane Victor Farsik And using CSI snapshots. So that's what's coming in the CNC F community Definitely check those things out if you're interested in them And then one of the ones I also really liked was this blog post by my very good friend Scott Lowe Who gets into Envoy configuration he's talking about how Envoy works what you're configuring and how and how the and how those bits of it work So if you're interested in Envoy and the way that Envoy integrates with service mesh This is probably a pretty good read on the Envoy piece of it. I thought that was a pretty good article Alright now it is playtime. Let's us get started. All right. So last week we did a lot of talking about the Enhancements, ooh, and I just learned something new. I wonder if Click here. I want to see if this works spare with me for just a moment because I think that it does If it doesn't then I'll be kind of sad, but I figured out that there is a new short path features Okay Features goes to issues Hmm I was hoping that was a little easier or more intuitive, but I don't see how it works Right now my phone's ringing Not today, buddy So that's how it would work. So if you know the issue number 2579 for example Then you can actually go to that issue by going features 257 So if you are aware of a like this particular issue, this is the Cooper is the enhancement for pod security admission, which is a thing that we're going to be exploring in hand today These are the assignees to it and this is kind of the work that's ongoing If you know that issue then there is actually a short code that you can use to get there Which I only just recently learned about which I thought was actually pretty cool So let's see. So we talked quite a little quite a lot about this documentation Last time talking about like basically how it's going to work What pod security admission is how do we enable it? Those sorts of things. Oh And actually I just saw an issue go by in the Kubernetes development list Which is on I usually look for LWKD info for this and what they pointed out was this recently merged And what this does is it actually changes the admission Mechanism inside of the API server to enforce pod security before pod security policy So if you're in a state where you're running both then pod security will run before pod security policy and that enables the Functionality of like audit or warn right and we can talk a little bit more about that when we get hands-on But when you have this stuff running if you have pod security admission running and you have it set in an audit mode Or a warn mode, then you probably want to be able to see those things before a pod security policy takes over takes the object and And implements it and so in this case you can they they basically just changed the order of The order of which admission control policies the ordering of admission control controllers policies Objects however, they are being evaluated so that pod security would run before a pod security policy So the admission for pod security runs first Thought that was pretty neat. It's a good fix And then we also talk about okay, so this is actually where we're going to jump in a Good friend Laughlin evansson actually wrote this article And I was helping him kind of understand the way that the sitcom stuff worked But this is actually also just an article that he put together about the very thing that we're going to explore today And so since some of this work is already done, we're going to dig in and we're going to start here To keep it simple for our particular environment So i'm going to jump into my desktop two pop up with a terminal zero zero nine Let's get started here somebody Now there are a couple of the things I wanted to extend in this and I want to talk to you a little bit about why and how and so Inside oh shoot. I want to want it. Um in the documentation Which is here A part of this documentation talks about like if you're in warning mode Let's get down in here So in pod security admission Here we go You have audit and warn And in here it says policy violations will trigger the addition of an audit annotation to the event recorded in the audit log or Policy violations will trigger a user facing warning, but otherwise be allowed And so as we define policy I'd enforce that policy in a given namespace Then we'll be able to see like The three the three different modes here. That's what we know. That's what i'm planning on covering today But in here specifically it calls out the need possibly for being able to see what's happening in the audit log and so I wanted to extend our kind configuration To support an audit log so that we could actually see that And fortunately I have done this work before In the form of a gist and so I wanted to actually just to share with you what I was doing in that gist and then Hopefully that will give us the ability to export our audit log And then we'll be able to actually see The audit event as it is annotated when we go into audit mode and we'd be able to see what that audit Security event looks like so for each mode. Okay, this is actually configuration of the object itself. Okay, so Inside of here This is a gist I put in gosh 13 months ago So a year and a month ago when I was playing with Auditing inside of kind you could even see even the api version is an older version I think now we're on a different version of api um And this is a cribbed from the out cold out cold solutions monitoring keds v4 audit Document which probably good enough for us Do not log from the collector We probably don't need to worry about that piece of it. And then there's Don't log node communications Don't log read only urls Lock fig map and secrets sure To catch a little more than There we go So then here's our kind configuring. So these are this is like basically what's the audit with the The auditing file will look like when we're configuring auditing and auditing inside of kubernetes And then the other file here is our kind config that it leverages That makes the advanced audit dot yaml file available to the api server So that The api server can actually use that audit policy file and specify an audit path And then i'll make it so that we actually have an audit log that we're able to view So what i'm going to do is i'm going to go ahead and copy We're going to build a kind configuration that supports both pod security pod security admission and also The um the audit logging so that we can see those events So bear with me and as we work through this And then we'll be able to actually see exactly what that looks like So i'm going to copy this i'm going to come over here. I'm going to go down here to the bottom just for a second Paste all of this in here And then we're going to do some handy cutting and pasting We can actually just do a relative path now, which is cool Have audit dot yaml read only true type file But this is doing what this line right here with the extra mounts is doing Is it saying for the container paths in the control plane node? At this path etsy kubernetes policies adva audit dot yaml I want you to make a copy of this file, which is local dot slash adva audit dot yaml Make it a read only file and copy it as true now. What this does is it makes the assumption that um Actually, this makes it so that the file is available on the underlying node So if I were to docker exec into the api server sorry into the Control plane node I would be able to see that file sitting on the file system inside the container But what this does not yet do is make the file available to the api server running inside of that Static pod container that cuba dm stands up. So that's where the next piece is going to come in Get rid of that only get rid of that We have our control plane node with this file made available And then here is where we're going to make our cuba dm configuration patches I have to look to see if this is correct. I think it might no longer be So I think we have to see what version is actually the current version And the way that we can do that is we can go back to our You know it That's relative to it's the path is going to be relative to the um, or you're actually running the kind Create cluster command. So our current api version Looks like v1 beta three, okay, so it's v1 beta three 15 newer can be used to migrate from one to two 122 plus no longer support v1 beta one and over apis and But needs to be supported v1 beta three so That works for us that had changed configuration This metadata name thing is just giving it something to actually parse against and then here we're here's where we get things that Makes things interesting. So for the api server component We're going to pass some extra arguments to that binary We're going to set the audit policy flag our file to use our policies of audit.yaml We're going to set the log path var log kubernetes Cube api server audit log and that'll be made available on the underlying container and then the format for that will be json And then here we actually make the file available to the api server binary Yeah inside my laptop And where it will be inside the docker node will be at that path at that container path that we specified And we're going to look at that here in just a second once we get this wired up, right? and so This path host path will be on my laptop and container paths container paths will be inside of the container That makes sense So in the extra volumes made available to the api server Right, we're going to pass in a couple of extra volumes. We're going to create a volume that says host path mount paths that's equivalent to these policies And this will actually give us access to that file that we copied into the node And we're going to make that file available to the api server inside of its container file system And then the other piece is where we're going to put those logs So we called out above that it was farlog kubernetes. So we're just going to mount that path on the underlying container Into the container that's running kube api server Where that path will be this is read only false that's directly occurring So in theory, we should have everything we need to be able to turn on both pod security policy That's all we had to do here was to feature gates pod security equals true Um And then in the nodes on the control plane, we're going to add This advanced audit dot yaml, which we still have to create on a local file system And then we're also going to pass in some configuration options to the to the api server so that the api server can enable autolog So i'm going to go ahead and vim have audit Animal insert mode, and then we're going to go back over here to our gist Nope yep I'm gonna go ahead and grab this whole thing Come back over here and drop it in there now I think Oh, you know what that's probably not right anymore either I'm assuming this is v1 by now, but let's Go for 121 cluster real quick and just take a look at that I'll show you how to actually validate that stuff because like sometimes I also don't know so Pretty sure it's v1 now, but actually we could absolutely just but we could also just bet it here So they apparently have some stuff in v1 alpha one some stuff in v1 beta one And also there is actually now v1 likely what we're doing will fall into the v1 category So we should be good there. We're gonna leave that as v1 Also, you can do cube well explain audit Yes, it probably just can only be known about within I thought that audit was actually something that was serviced in the api. So you could actually oh, no, that never happened That's right I was thinking maybe it would actually be something the surface in the api because I thought we were talking about like dynamic audit for a while, but I don't think that actually were materialized and so It's actually not going to be known here. It's going to be known in the code base All right Here is our audit YAML We have set it to audit.gaze.io v1. It's a policy Here are the rules that we care about Should be enough to get it done We're going to do kind name equals check And then we're going to go ahead and bring up our new cluster with all best configuration stuff And create cluster config equals YAML and then version or image equals Image string from that blog post Too many windows I chuck some of these, you know, I'm gonna do exactly that inside of locky's blog we want Kindness node v120 because that's actually where the feature shows up before this the feature gate will apply to nothing So I'll paste that in there Enter Nothing happened here field type not found in type v1 Alpha 4 mount alias That's changed so under our type Now will it fail or will it work? We are making some pretty significant interesting changes to the um To the control to the control plane configuration. So you might get to see some troubleshooting On the kubadium side. Oh, hey control plane started Whoop whoop Worker nodes I don't think I actually did anything to the worker nodes. So that should be started fine What's the control plane that would have messed up if we had messed it up? Can't believe we got that in the first try That was kind of amazing Feeling kind of chuffed. Okay. So we So now we think we got everything worked out here. Let's just go ahead and validate our assumptions So i'm going to go ahead and ducker exec ti kind open And then we do ls Let's see kubernetes policies There's that file and then if we do our log It is Oh, that doesn't look right Yeah, that's not That's That is where I put it, right? Yeah, so this is where because I was doing kubadium configuration patches We can look at the kubadium configuration file that was actually Resolved and verify that the changes we made show up in that resolved file the way that we do that We can just cat Um kind kubadium dot com This is where the files would show up if they were going to show up. This would be where they would be So we're going to cruise on up here So there's kubadium v1 beta 2 There's our feature gate showing up. So that's working. You know, I don't see this stuff showing up I think we have missed the boat somewhere kubadium Yeah, I don't see it here If I do it at security this manifests cat kubadium server Nope, that did not work. I see no auditing flags. So this failed in a silent kind of way Interesting stuff. It's probably one of those things. You know, there's this thing that um happens with yaml And that's Where it is like It will ignore stuff that is that is not that is missing See i'm forward. This is v1 beta 2 not v1 beta 3 In this configuration we can see that we're using Yeah, that's what's happening. Okay, so take a look at that again real quick and then I can cement this Make sure that we have it right You can see that the configuration that was passed to kubadium was of this particular version kubadium dot k it's the i o v1 beta 2 But in our configuration we were passing a patch to v1 beta 3 And v1 beta 3 is not a configuration that is being passed to kubadium. And so it is failing silently because it does not match If I go back into my kind configuration and I change this value kind cluster Cluster And then we'll see if it works. So we thought we got away with it But we didn't quite get away with it. We're gonna see if we get away with it this time while this is loading up I'm gonna actually go ahead and open up another terminal and do You can actually probably hey trophy started Hey, there we go. Now we're seeing it show up Much better Okay Is there a way to tell kubadium To use beta 3 in the kind config? I think we have to rely on the machinery that kind is using So likely in a some version of kind that is forward so that it would use that next version Um Alternatively we could do a thing where we generate the kubadium.com ourselves And overwrite the destination in that api server with just a complete kubadium file that it would use right And so if we wanted to if we wanted to take like an example kubadium configuration like you see here and um Make that like This is the only part part right is this local ip advertised address Because we need to know for sure that that will be the ip address that it would resolve to but if we did know that Maybe knew it would be the the second docker container running. I want to have you Then we could actually go ahead and make this change Also, there's a default that would probably be okay here because there's actually the only the one ip address on those nodes So we probably don't need to specify node ip here. It's just Being passed because of the way we generate we're generating configuration I hope that I answered your question. I know that's not a super easy I know that's not a super easy answer, but that is one way that we could be doing that So let's go ahead and validate our assumptions again Look like it worked, but I want to jump in here and take a look around control plane and we'll do cat or tail minus f bar log kubernetes Oh Perfect It's working. All right So we do have a working audit log. We do have a working That's the 2di server. So it's actually So inside of here, we should be able to see our audit line And that is pointing at that correct file.  Let's play with it Dig in should be fun And what I'm going to do is I'm going to make this This configuration I'm going to put this to configure. Actually, let me just before I say I'm going to do it Why don't we just do it? And then I'm going to jump over here into our this weekend cloud native Go to edit mode Those who want to play along at home, this will be the avauda.yaml And this will be We're here, okay Same here, relative And create cluster Located one Okay, so that should get you to the place where we are And verify role playing Kubernetes Let's dig a little further down into the rabbit hole So the next thing I want to do I'm going to go back to this blog post because Some of the work that was that was done here has already done Warrants about the baseline pod security pin to be 122 of the policy on the test and s So the way I'm interpreting this When we go back to the documentation Um, remember we have a couple of different modes, right? We have a warning We have a mode for baseline mode for restricted and The baseline one is pretty permissive And the restricted one is not quite as permissive So in restricted for example, you can't run a container as root But in the baseline one, you're pretty okay with it So this is a great example Let's give this a try. Let's let's actually validate this in our configuration And see what this looks like from our slide And then we can kind of play through like what that would look like So we'll do Do I have KNS? I do I've got all Is it label or annotate? Let's go ahead and do that bit baseline Oh label And then we'll do Warn I'll also do audit These are the labels that I have specified on this namespace I've set the kubernetes.io metadata name Oh, that's actually already done for me But then podsecuritykubernetes.io audit restricted podsecuritykubernetes.io enforce equals baseline And then podsecuritykubernetes.io warn equals restricted So now I should be able to get warnings I should be able to see that in my audit log And I should be able to get user facing warnings about Manifests that don't line up with a reality But they should still allow the creation of a pod So if I were to do kubectl Limit I'm already in the nginx test namespace Clut nginx Image equals nginx Stable For replicas equals 3 80 Enter And I do see a warning I use a facing warning Would violate the latest version of the restricted pod security policy Allow privilege escalation is not equal to false Container nginx must set security context Allow privilege escalation equals false Unrestricted capabilities Container nginx must set security context Capabilities drop all Run as not root is not equal to true Pod or container nginx must be set Must set security context when it's not root The second profile must also be defined Run time default Or localhost That's pretty cool I think that's actually pretty useful for the developer side of things You'd be able to see that in your log If you were doing something like a mechanism by which You were deploying automatically using CI or something like that Then this mechanism would actually probably surface in your logs and you'd be able to see it I also want to see the audit log and see if we see that same output Or what the audit event looks like So let's jump in and see Let's do Ducker exec TI Oh wow This is actually not going to deploy I just noticed the typo Whoops Well It doesn't really matter too much We should still be able to see the event Because this is an admission not in runtime So that it doesn't deploy as the most beside the point So kind Proplane nginx kubernetes audit install log I'm going to actually kick this to take you There we go So this is neat Yeah That's exactly what I was looking for Okay So actually that last match gives me kind of what I'm looking for So this is the event for So authorization.case.io decision was to allow The reason was that there was nothing that blocked it Podsecurity Kubernetes.io slash audit allow privilege escalation So this is annotating This piece of it And it basically gives us the same output that we saw before So that's actually Pretty cool But let's look at this entire event So we can see kind of like what this looks like So here's the response object for this deployment Right This is coming from the API server Being and is a response to whatever the command line client is that created this object Right It's a kind deployment apps v1 So this is in line with what we saw previously in the documentation where Now we can actually warn you about the object as it is created as part of a deployment We don't have to necessarily wait for the pod object to get created And this is different than the way pod security policies worked Pod security policies only take effect and only manipulate pods themselves So you could very easily end up in a state with pod security policies where You just wouldn't see pods deploying but the deployment object would be accepted by the cluster And so that was kind of leading to a state where sometimes It was hard to actually debug or understand what was actually happening in the lifecycle of that deployment Because of the way that it would be manipulated Because of the way it would materialize inside of pod security policies So your like your flow would be you know You already have a pod security policy defined inside of your cluster your user or whatever mechanism You're using to deploy inside of the cluster that would create those pod objects has access to that pod security policy If the decision that that pod security policy would enforce is to deny the admittance of that pod Then what happens is that the pod itself just will never be Scheduled it will never it will never show up as a pod object inside of it because the object was denied But you would still get the replica set you would still get a deployment object Those things would be created and they would be allowed in because they're not part of the way that pod security policy Would enforce admission pod security policy would only enforce the pod object itself In this case though with pod security admission This is the different this the new version stuff right the new stuff actually can evaluate the deployment object itself And it can actually look at that object and give you feedback best based on that information Right, so this was the manager for this was kubectl create. We just saw that Here's some information about what was being known what's known about it Information basically that it is evaluating against There's going to be three replicas This is so it's in the configuration we can still see our typo here whatever Right, and then we can see That this object was annotated Authorization k it's the io decision is allow And then here is the pod security audit annotation now. I don't think That the if the engine x Object is annotated with the same information and we can see that it is not So there's no annotation in the object itself with this information. That's just annotated to the event We can see of course, but the image pull back off right because that did not work There we go table What this does is it actually Just as a quick hack will change the image Whose engine x stable instead of engine x and now I should be able to see those things deploying You can all set basically just gives me the ability to set particular things about a deployment or a daemon set or what have you Then the interesting thing was even though that was being set. We still saw the same would violate latest version of restricted And that is being configured by by what's configured at the namespace level So we have things working. We're able to see the audit events. We're able to see The user space feedback. We're not getting any feedback on the object itself, which I think it's kind of interesting I don't think you'll be able to see it here Yeah, because in the trigger it's in the code That is a start. Let's go back to our docs here So you've got auditing working We're able to see the event which is pretty cool So there were some questions that were brought to me By rw. It might be us The u.s Or is that somebody else so it'd be interesting to see applying policy on top of existing pods and see what it does Once an old non-compliant pod restarts it might not come back up plus up down That's true. If you're in a restricted mode, then it would break things Although deprecated pod security policies are still are still supported through 1.25. How badly can you break a cluster with both enabled? I think that That would be fun to play with I'm not sure if that's gonna be in scope this time But I imagine that because now pod security policies So I pod security admission will be enforced will be evaluated before pod security policies Um, and so the way that you would break things It's probably likely that the box originally is it's going to be in pod security policies not in pod security admission and the reason I say that is because pod security admission it's only validating it's only looking it's only Validating the specs and making a decision whether to allow or deny Based on its evaluation and against the policies that you've defined Um, whereas pod security policies do quite a lot quite a lot other other stuff like they might also do things like enforce Um, the configuration of things Or mutate the pod spec itself So likely you're more likely I I would say that you're more likely to run into trouble with pod security policies Then you are with pod security admission because pod security admission is either you're going to allow or deny And pod security policies are going to be the thing that mutate and change Or enforce the change in configuration. That's the way I understand it But I want to see one of my one of my um explorations of this effort was to see Are we doing any any any sort of mutating and I don't think that's that is the case Do duplicates of mode cause an error or is the last one declared or maybe first? so In our example here It'll get ns labels So in this case The mode is somewhat duplicated. I don't think that we can create two labels with this with a different value So I couldn't do like pod security kubernetes.io audit equals Warn, but let's try it Get all label ns Yeah, there's already a value We can't really do it, but we can overwrite it So if I wanted to change the key if I wanted to change the value of this one key And I would have to actually I would have to I would have to change the value of it and another question would be can I pass multiple options to audit? right like could I pass restricted and baseline I don't know that that would be a valid configuration either, but it might be kind of fun to see It doesn't take a comment on that comment on any of the less things So I think that would not I don't think that would work. So do duplicates of a mode So I assume pod security is cluster wide So you couldn't have different rules per node So this is admission and it happens at admission on objects like deployment or daemon sets or pods or those sorts of things And because it's admission it doesn't actually matter The rules would not apply differently on different nodes It would apply differently on different namespaces and you can actually also have sets of exceptions around things like What user is creating an object like you can actually and this is actually one of the things I wanted to explore next was Sort of the exceptions because you can make it so that like a given user has the ability to Deploy a pod that is of a particular enforced set and a particular In a particular namespace you can like overwrite it But how the nodes cri Would or how the node would enforce it would be would be the same Regardless of the node, I think because it's all happening kind of at the admission layer Yay I'm glad that's you I think you can only pass me. Yeah, exactly. I think that's right That's what I thought too all right If I understand it right big if there are only three Milton policies, that's right and they can't be changed also true Privilege baseline and restricted Is there any way to add your own or the too soon and that's why there are links to other projects? Yeah So the way this has shaken out over time is this Initially The concern was the reason there's even a pod security admission piece is that The api for pod security policies has grown somewhat out of bounds, right? Like there's just so many things you can configure and and it's not it's kind of difficult to configure it kind of difficult to To test it and so it became a thing where we're trying where it became very difficult to actually Manage that api's growth over time So that led to the deprecation of pod security policies However Liget stepped up And our Jordan Liget stepped up and he said, you know what? Maybe we could just make a much simplified a much more simplified api for what is happening here Where and you might have like the three major models that people use privileged baseline and restricted And those are following the best practices that we define in the pod security And in the pod security document And that you would be able to then just apply those things to given namespaces and get information back to users that say This is not going to work in a restricted mode or this is not going to work in a privileged mode or what have you And give them a feedback loop that way But just create a much simpler api that only fits a specific set of use cases And if people need more than that then they can actually define that more than that In opa gatekeeper keyboard and caverno, etc And I honestly think that's the right move, right? I feel like we have to have something in place for the project itself And that's that something that is in place for the project itself should follow the best practices that we're describing As a project for how to secure pods and containers inside of your kubernetes cluster But to provide like the entire configurable surface that pod security policies provided was Was arguably like too much. It was arguably too difficult to actually maintain over time And so I think honestly, this is probably the right decision So that's why there are only the three and why they're not mutable. Why you can't change them? Um, and I don't I don't suspect that they'll be changeable in the future But I guess we'll see how that evolves over time So other than getting the future flag enabled should this pod security policy admission mechanism work on cloud providers like GKE Aks once they upgrade their services to offer kubernetes version that it's compatible. I believe that is the case Yeah It should just work The way this would evaluate like I mean, I imagine once it becomes default Might be kind of interesting to understand how the how the um Graduation plan would work, right? So if you if we go back to our notes And we go back to that um that cap 2579 or what have you Oh neat, there's a pod security evaluations metric on the api server Oh, that's cool. It's actually broke. Well, okay. Let's just go look at that real quick We're gonna take a quick sideline And because we already have like some that would have been allowed We're just gonna look at like some of the metrics that are exposed here. So Let's just look at that real quick. So you can all get So I'm going to look at the metrics that I looked at the metrics name wrong pod security evaluations should be there with pod security policies Maybe that maybe the metrics aren't quite implemented yet because I don't see them here Hmm It doesn't look like the metrics are in place yet. Unfortunately You know, one of my other commands one of my other favorite commands in this I'll just share with you because I I always thought this was a super interesting one The object One of my big takeaway commands From the raw metrics So I only have the one api server and what I'm doing here is I'm querying the metrics endpoint on the api server Using kubectl. So I'm doing kubectl get dash dash raw which tells Which which means that I'm just going to make like a raw get Against the kubernetes api out of pass And I know that the slash metrics Um Pass it's just hanging right off of the root directory inside of the kubernetes restful api So if I do kubectl get dash dash raw Metrics and I'll be able to see those metrics that are relevant for this api server that I'm connected to If you have multiple api servers, you're going to see multiple different outcomes Because each api server is its own entity and they might have they might have different outcomes for some of these values Now likely they'll all agree on this one But It's an it's still an interesting argument If you're if you're talking to a load balancer that talks to multiple api servers, you're likely to see multiple api server for her however This is one of them in my opinion one of the most interesting Metrics that we expose at the api server and what it is is the scd object scd object counts And you can see like what those actual objects object counts are inside of the kubernetes cluster So we can see there are 43 secrets secrets defined. There are 42 service counts There are two services. There's zero stateful sets One storage class mean you can see like all of these different objects and one of the ones that's really interesting is this one, right? So here are there are 107 events currently stored in scd If I do kubectl delete events a All the events going all the way do that same Object again, and I look for events. So waiting for it to converge Oh, maybe it's because of compaction Maybe it's because of the cache I would have expected that to update by now into the sd it goes a few seconds for for The exported metric to change But yeah, I mean what this can tell you this this can actually show you like Where things are likely to go sideways soon, right? So you can do things like monitor the number of namespaces monitor the number of nodes you can monitor the number of pods The number of events that are currently stored all of those things and you can kind of see where your problem is And so if you're seeing experience if you're experiencing a problem like, you know My kubernetes cluster is really slow, and I want to understand like what's where it's spending its time one One way to see that is this information here, right? and then there's also Rest client request duration request latency in seconds broken down by verb and url Here's another example these are calls to the api scheduling k8s.io piece and then I think this is neat because it's a It's bucketed right so you have the value you have values broken up by category So what we're looking at here is a prometheus histogram um And for that bucket they're broken that means there's a The value of how long a particular call is taking is broken up by uh buckets So we have pointers or one seconds two seconds four eight 16 32 64 128 256 512 And when you're evaluating this what you're looking for is where the event is showing up in the set of buckets that you have Right, so if you're looking at the histogram, it's going to say um in this particular query All of the queries are being resolved in about the point zero six four bucket for resolution I mean, they're not taking 128 and they're not happening any faster than that So if we look for like something that actually has a little bit a few more requests We might be able to see some more interesting outcome Here we go Here's another one So getting the namespace getting the namespaces of the cluster There have been seven requests to get that information um Three of them were responded to within point zero zero two Three more were responded to within the point zero zero four time frame And one of them was responded in the point zero zero eight time frame And so if somebody were to say that kubectl get namespaces is taking a long time Then we would start seeing things we would start seeing things graph up to like a maybe a half a second or longer Yeah, that's reading all the types from ecd that the api server cares about Not I mean there may be other stuff in ecd that if the api server doesn't care about But it's about the objects that it's the ecd itself considers that it's in that it manages right, so um It doesn't store the metrics key in ecd. I believe it's actually What's happening is that the metrics code inside of the api server is evaluating The number of objects inside the cluster as part of a metric that it exposes over a period of time And I suspect that it doesn't constantly pull that to get that metric It's just updating that put that metric on a on a scheduled period of time And that's where that was actually happening because otherwise it would probably greatly increase the load on the api server if every time Somebody hits the metrics endpoint it had to evaluate all of the metrics that would take too long So likely what would happen is what happens instead is that it just evaluates that value And then stores it as a response for anybody hitting the metrics api endpoint For a period of time and then once that period of time expires and it goes back and it re-evaluates Updates the values next time you scrape you're going to get a different value But I suspect that's actually how that's working So that doesn't work yet unfortunately the time for a minute What are reasonable slo's? Dependency, scalability Oh, hey, how does this feature react if the api server And or sdd is unavailable So because the admission is happening effectively at the api server if the api server is unavailable it would not work Oh, yeah, because it's a label maybe we can actually manipulate it differently. So let's see what happens if we did that So if I were to do a kubectl label I'm getting a kind of a confusing error What if I change this to baseline if I'm back to restricted Eat, okay. Well, this is in my opinion. This is the bug Is it saying the namespaces nginx test is invalid, but really what's invalid is the Value that I'm trying to set audit to so I'm going to open that as an issue Because I feel like that's a problem All right So back to our questions make sure we got everything We talked about that Yep, we talked about that Other than getting yeah, we talked about that. I agree. Yeah, who would this so I guess the last thing I wanted to cover was this piece here Which I thought was actually pretty interesting. So pod security tests So this is a project that was built by jim baguardia Contains test pod yamls for each policy type defined in kubectl as pod security standards So I thought we'd try this out because it looked like a pretty interesting way. So We're apply the baseline or restricted yamls by appending the appropriate folder name So this is actually pretty interesting. So I'd like to try this out And then that'll probably be our day. So let's see actually where we are. So it's 327 right now Configure a policy instantiation for your collection like pod security policies or policy interests like opa gatekeeper by the test yamls Like baseline or restricted yamls by appending the appropriate folder name Check the created pods All test pods have the following labels defined But policy baseline or restricted And the control the value that identifies the security code and the control being tested you can view the pods for policy level What's this? Well, let's try this out. I mean, I think I think it looks pretty interesting. So let's do uh, copy What I'm gonna do is I'm gonna create a new namespace Then we'll do kns restricted Okay, and we'll do I do okay cool So inside of here when I want to deploy this Customize build Oh, I know you can do it by url Well, heck let's just do that That's a feature of customize. I don't think I've ever used This is not currently restricted. So all of these pods should be created Blocked app armor blocked Eat This is really fun So I'm gonna call right now. So just for a few more minutes I'm covering some states that you may not have seen before right, but it says sysctl forbidden Some things are in block state Figure some are sitting in container creating still That's cool. Let's do q kettle label That's in force Renewed the IO force rules restricted What happened the other questions that came up? I don't think it'll change anything but Do q kettle delete? I guess because these are all pod specs. I won't be able to just restart them I can tell there's pod specs because they're by name. So if I were to do the same customized thing Now in theory, we should see way fewer of these show up Very few errors output was just surprising because we're in a restricted namespace now Oh, because I don't have warnings for none. So probably a bunch of them just didn't show up Oh, look like they're there privileged running interesting It was running as an out route and it's in policy restricted. So that went to pass I'm gonna do the different label here Let's have a label to warn so we can actually see the output of stuff again And I'm going to do that build again Nope, no outputs interesting That is a surprising output to us here Oh So most of these containers that are being built Actually do match the restricted profile So I guess these are all Here you're setting the override security context Privilege true run is not root true And we see the privilege container startup. Well, we may dig more into this in the future Yeah, I hadn't seen I mean I have seen cctl forbidden before because you're actually trying to manipulate a Cctl that isn't exposed by the api so by the cubelet, but yeah, it's an interesting state All right. Well, I think that's the end of our broadcast today. So I hope this was educational I hope I hope folks found it useful I want to say thank you for tuning in And I'm really looking forward to Keep calm this year should be a really fun one One of the big things I can share with you is that I will be co-hosting with mr. Dan pop from Cystic I'll be co-hosting even if you have day at kubekan, which is a pre-show event So if you're going to be at kubekan or if you want to attend virtually Definitely check that out. I'll be co-hosting that with dan pop and that'll be amazing. So definitely check it out Um, I hope you all have a great week and thank you for tuning in and I hope this was useful And I'll see you all next time. Thank you


fellas it's your boy Johnny and yes I know it's still summer enjoy it because it's gonna end soon and the best season of fashion and style is right around the corner and here are three go-to outfits I will definitely be rocking during this post-summer fall season but Johnny it's still hot and fall is into the end of September hey shut up just kidding there's no animosity on this channel hashtag no animosity 2019 look man I live in the desert you might think it's hot but in the mornings it could actually get pretty cold and then it's super hot during the middle of the day that's just how it works out here so this first outfit is one of my favorite post-summer fits a thinner long sleeve is perfect because if it gets too hot you can roll the sleeve up and if it's a bit chilly you leave it down I got this long sleeve from Meow Wolf's merchandise store it's definitely an exclusive piece that a lot of people will not have if you guys saw my last video I personally think the best places to shop are at local stores not your typical franchise stores so coffee shops airport and museums like Meow Wolf offer pieces exclusive to that city or that small startup and for Meow Wolf it's a museum located in Santa Fe started by a ton of independent artists and their creativity is on another level and that is why I knew I had to cop something at their store this shirt has unique designs the color is on point and it's definitely up there as one of my favorite shirts and the rest of my fit is very simple because that's what I'm on nowadays black skinny stretched denim and extended belt and a pair of all white bands authentic white sneakers are by far the most versatile and fresh piece you can throw on your fit white contrast literally with everything and contrasting it against the black pants is always pleasing to the eye if you get these vans I definitely recommend the comfy cush version way better on your feet and it's only about five to ten dollars more next outfit will be my go-to look when it actually gets a bit chillier a simple black hoodie from essentials by the way if you're gonna be in LA on October 26th come to the pop-up shop and kick it with me and Jose Alex Costa Blumann and so many more influencers it's gonna be a ton of fun but the hoodie is great quality simple and minimal and should be in everyone's wardrobe no matter what brand it is every one of y'all needs a simple go-to hoodie like this definitely keep it oversized or not as fitted for the more relaxed street vibes so cargoes like these that are not as tapered my opinion need a top that has a relaxed fit to it you can pull up some looks with a fitted shirt but it doesn't look right to me what do I know anyways these cargoes come from black Taylor and they are sponsoring this video today black Taylor is a cargo streetwear based company they make a ton of sick cargoes from your super baggy edgy ones to slim fitting ones and everything in between personally I'm an in-between guy baggie up top that tapers down to the ankles now I'll be honest there are a ton of brands out there that ship similar looking cargoes but I've never had a problem with black Taylor I've purchased from them before they even sponsored any of my videos and they have great customer service and respond to any questions you may have about sizing they're very reliable this cargo I'm wearing in the video is part of their nylon collection nylon is a great material because it doesn't wrinkle as much and these ones have a strap in the ankle area so you can taper it as you please definitely gonna rock this pair with a ton of hoodies so check them out click the link in the description use my discount code save you some money bro and again going to be rocking a pair of the comfy kush white authentic like I said earlier vans are so versatile they fit pretty much every aesthetic pick up a pair man don't skip out on these last outfit is another simple go-to outfit this is a car hearty I picked up from Dick's Sporting Goods and it is my favorite color for a shirt a nice charcoal color not pure black not light gray it's a very versatile color because wearing all black can make you look like a silhouette unless it's a graphic tee so that is why I pick up this colorway as often as I can $15 not bad at all and I went with the oversized look cuffed my sleeves and the size of the shirt and color contrast really well with the skinny light wash denim wrapped with an extended belt and again a white pair of sneakers but this time it is a leather sneaker which is a bit more dressed up than your regular white pair of vans all outfits are accessorized with either a chain definitely some bracelets and various rings jewelry could be bought anywhere from Amazon and online retailers I get them from all over the place it's good to have a versatile collection whenever you're feeling different types of moods during that day for your outfits I don't know I carry a ton of accessories from a ton of different brands so fellas what was your favorite outfit comment down below give this video a like because I need validation subscribe to this channel if you haven't already and until then stay flying I'm out brah peace


This study investigates the contribution of bisphenol A, BPA, induced DNA damage in systemic lupus erythematosus, SLE, patients and concludes that structural alterations in DNA by BPA may be responsible for inducing anti-DNA autoantibodies in SLE. This article was authored by Homedin T. Alamedin, Nella Rashid, Salem Almatrafi, and others.


Cause really, don't we have hobbies to kind of take our minds off the everyday stresses of life? Hey guys! So I thought it was about time that I kind of go over my favorite puzzle must-haves. Now these are things that I use to help better my overall puzzle experience. But there is a reason why I say must-haves in quotes. And you'll see why as I talk about each item. And I'm gonna put links down below in case you're interested in any of these items for yourself. So let's start with puzzle must-have number one for me. Number one, my beautiful puzzle table. Now there are tons of different tables you can find either online or at your local department stores. And the prices can range anywhere from about $70 all the way up to in the $200 range. And it really depends which style you go about getting. They have ones that are full tables. There are ones that have pop-out drawers where you can sort pieces in and save extra pieces. And most come with adjustable levels or a cover that you could just lay on top of the puzzle after you've worked on it for the day. Now I'm gonna talk about the table that I have. This one came from Amazon. It has five adjustable levels and it has fold-up legs. So you can store this either standing it up against a wall or under the couch or wherever the heck you want to hide it. And my favorite part about it is that it has a non-slip surface to keep the pieces from sliding. Now is this really a must-have? Well no, but it sure is nice. So obviously you can use any surface to do your puzzles. Now like me before I got my actual puzzle table I just used the end of my dining table. Many use foam boards and you can pick them up from like a buck from Dollar Tree. And with that you can even take it wherever you want in the house which is kind of nice really. My table's pretty heavy so it kind of just stays on the floor and I just sit on the floor or on a cushion and I puzzle like that instead. Really you can use any surface you are comfortable with. But if you have the money to spare and you have space for something like this depending on what style you want to get then go for it. It's a great item to have and I personally think it makes my puzzle experience much better. Must have number two and you always see me using this in my videos. So you know it's my puzzle trays and these are the Ravensburger puzzle trays. They come eight trays to a pack and they stack really nicely on each other as well. You can have all your pieces in the trays and then just stack it. And it keeps them all nice and safe in here obviously not the top but you know what I mean. And what I love about them is that they're actually puzzle pieces themselves.   And again you can find these online. I've even seen these in Walmart places like Target and they're not expensive at all. Price-wise I believe these range between maybe 10 and 15 dollars. I could be exaggerating. But do you really really need to have these puzzle trays? No. They're fun. They're cute. But honestly you can use anything to sort your puzzles.  But again really you could use anything. You can use paper plates, paper bowls, sheets of paper. I mean anything just to help you keep your pieces separated from one another. Or you could just set up little piles on the table wherever you're completing your puzzle. It doesn't really matter. Again I just think they're really cute. Must have number three. And that is my puzzle scoop. Now I've only used this for the first time recently. And it's so good that it already made my list of must haves. And I know this is something that I'm going to be using from now on. And like the other items you can find this online or your local Walmart Target. And they're really inexpensive. These are under 10 dollars. It has three times the magnifying power. It has a built-in LED light. That's a good light. And it's a scoop. So you can kind of scoop sections of puzzles that are completed and move them on to your fully completed puzzle. I haven't actually used it for scooping yet. But I'm sure it will do a great job. But what I really really use this for is for the magnifying power. And for the light. Which is fantastic. Even the magnifier is pretty clear. It's not blurry. At least mine isn't. But is this really a must have? Must you buy this particular scoop? I mean the LED light is pretty darn fantastic on it. But did you know that your smartphone has an LED light on it? And I'm pretty sure you have a phone right? Now also in terms of scooping sections of puzzles. Really you can use any form of card stock paper. Heck you can even use index cards to pick up sections of completed puzzles. And it's roughly about the same size as this scoop. Now I know that may seem a bit silly. But look I'm just trying to help and be creative here. Gotta try to save that money. You know times are rough nowadays. Now in terms of the magnifier.  I mean that's really one of the main things you would get this scoop for.  I know I need to. But yeah definitely one of my new favorite items to use while I'm puzzling. Now I have some other must haves here. And these aren't necessarily puzzle accessories. And I don't feel like I want to use quotes on this. Because I kind of feel like me personally. I really need these things to help my overall puzzle experience. And if you've been watching my videos from the start. Then you're gonna know what I'm talking about here. And these must haves have to do with your environment. I'm talking about your puzzling space. I'm talking about the ambience. All these things are very important in the overall mood setting.  You need to sort out your surroundings. And the way I do that is I put on some aromatherapy. And the scent that I usually put on during my puzzling time. That scent always has some sort of connection to what I'm actually working on. I put background music. And again like the scents. The background music fits the theme of the puzzle I'm working on. And also don't forget to grab a special drink for yourself. And if you just so happen to have a mug. That kind of matches the whole theme of the puzzle. Well even better. But in terms of your puzzling environment. You can make this your own. I mean go nuts. Just get creative. Heck if you want to dress up as a Disney character. Or some other creature by all means go crazy. Maybe throw in a special snack. Look guys I get very serious when I puzzle. And I never used to be this serious about it. But I notice if you work on those little things. And add those little special touches in your puzzle environment. It's going to make the whole experience so much more immersive. And relaxing. And it's just going to take you away from the everyday stresses of life.  As I said I'm very serious about this. You know what. Forget about all the things I said earlier. You can just save your money. And work on those last few things that I said. Work on your environment. And those are the keys. To really filling you inside with good oras. And energy to complete your puzzle. Because really don't we have hobbies to kind of take our minds off the everyday stresses of life. Make this time very special for you.  Make it special. And most importantly have fun with it. Now hit the like button if you have any of the must have items that I mentioned earlier. And let me know down below what you use or you don't use or things that I haven't mentioned that you recommend. It not only give me ideas but I'm sure others will be reading your comment as well and getting some ideas. I hope I was able to give you some ideas or inspiration on how to better your puzzle experience. Either that or I just made myself sound like a complete nutcase. But thank you so much for watching and I will see you in the next one.


Do you hear that? It's your mom.  Mom? No, she's over there. Uh, you can follow us on Instagram and Twitter! She's a neutral mom. And it's incredibly saturated. We are reacting to a trailer, and thank you guys for some patron of fellow surfers to do it again. This is something that we have reacted to a scene from. Won't ever be able to bing. Uh, it was the hilarious comedy scene. Oh. Yeah, the one that we got no context of and just sat through looking like this. And everybody was like, no, you don't understand! Because this is the trailer to it. So we get that we don't understand it, obviously. It's starring Sanjay Dutt and a couple of the people. Our friend Heynos. Heynos, Heynos. Sub this for us. Thank you, Heynos. But this is called... MMBS basically is what it's like. Thank you. It's like an abbreviation. Thank you, Affirming Bell. Tinker Bell's long lost cousin. Affirming Bell. We'll see what it's about, but especially when we did that scene, people say they love this film. It's like a classic. Right. And we were there going, okay, going on here. This is not funny. I know it's true. I should be laughing. I think I should be laughing. But so this is the trailer for that. So here we go. Okay.  Isn't it? That was the principle. And he came. What's up? What's up? What's up? What's up? What's up? Is this a patient call? No. Who's going to act?  What's wrong with him? Nothing. Why are you going to do this? For a doctor. Who?  Hey. See the big relationship. He is with you. Ok, you again. M-D-G'susion. So I can show off... Okay, so I get the concept of it.  That line was great. Gotcha. So I, yeah, I get it. And he's obviously going to take his whole mafia mindset into pretending to be a doctor and think he can do it. So I get it. I think we're getting it now. We get it. Especially the trailer's old and so, and we've seen what you've said about it, so we trust you. Yeah. Um, and we know that you guys love this film. And it may also be 2003, I mean, we're way ahead of where we were in terms of understanding cultural references and idioms and things in the language that get lost, but we recognize we're still, we got a long way to go. So is this one that you think we're ready to watch now? Yeah.  A gangster sets out to fulfill his father's dream of becoming a doctor. Yeah. So he's clearly still, he's somebody who shouldn't be there. Exactly. And he's like, he's probably proving to his dad, look, I'm a mob guy and look at all I've gotten.  You should have become a doctor. And so he's like, I'm still going to impress my dad. So all the fun, I can still be a doctor. All the funny things are going to be like, he's trying to be a doctor, but he, he's still using like his goons exactly to get where he needs to go. Yeah. So I'm betting that's the kind of thing. It's like taking Tony Soprano and telling him he can go to be a doctor at a hospital, UCLA Medical Center. Looks like somebody else is in it as well, Sulilgut. I don't know if they're related. I don't know if they are either. That would be a coincidence. Yeah. Would be a coincidence. Uh, who else do we know in the creative process? Lagan. Directors. Somebody was in it, Lagan. Gracie Singh. Oh. Who was she in Lagan? Oh. Cool. Cool. Cool. Yeah. She was the, I mean, I was loving her. Yeah. She was great in that. Yeah. She did really, really well. Wonderful. Now who else do we know as far as the creators? I don't. Anybody? No. Rajkumar Sarani. Oh, P.K. Hold on. P.K. Wait a minute. P.K. in three idiots? Hold on. Maybe he was an editor or something in that. Director. Editor. Writer. Director of three idiots. And P.K.? I'm trying to find P.K. There it is. Director. Editor. Producer. Writer. Oh my goodness. It's a good deal. Hardly brain fart him. Because we probably haven't looked at anything of his since January when we first did three idiots and P.K. Yeah. Because those were one of the first films we did after Gully Boy right out the bat.  And my suspicion is we haven't seen a thing of his where we've just missed it since January. Yeah. Wow. Well, that's cool. It's really an added bonus for this, too. For us. Yes. Somebody we know that is reputable and is a good director. And the chokers are producers. I don't know if it's these chokers, but it's a choker. Oh, I thought if you see the names and the producer thing, it's the whole choker family. That could be very wrong. Maybe. You might be right. Cool.  So yeah, it looks interesting. Like he said, let us know if like it's something that we're ready for. Yeah. Or because I know how y'all felt about it from the hilarious scene that we watched. It was lost on us. Yeah. And there's certain things like we've said so far. I think we figured in that it was like stuff context that we do understand. Right. Exactly. And we want to be like, I think we were ready for Dev Das and Lagann. And that's something we would never recommend to our American friends here and say, you should just jump headlong into Dev Das and Lagann. You would miss so much. Also, I think if you ever see Americans reacting to that scene and they laugh really hard without ever seeing it. They're faking and lying to your faces. And I know a bunch of people have reacted to that scene and laughed. Yep. So if that happens, they're lying to you. Call them on their BS. Because that scene cannot be thought as funny if you don't know the context. 100%. Yep. Yep. They're just letting you know that. Yep. It matters to us. Honesty matters to us guys. But please let us know if like this scene is where it's only 156 minutes. Only like three hours. About right for a comedy in India. In the early 2000s. Yeah. And Sanjay Dutt as well. Dutt? Yeah. I think it's Dutt. I think it's Dutt. Dutt. Yeah. Like Dutt. Sanjay Dutt. Sanjay Dutt. We've seen a couple. And I don't even know that the T is a hard T. Like a Dutt. I think it's Sanjay Dutt. Dutt. Dutt. Dutt. Dutt. This looks like he's like most famous thing. Yeah. He's done. He's in KGF Chapter 2. Wow. I'm sure he's going to play something predominant. Wow. I can't wait for that. He was in Kalank which obviously we didn't see. We didn't see because you told us to stay away. You told us not to. He wasn't P.K. So we'd have seen him in that. Yeah. He played the... The priest guy right? The priest guy, yeah. Yeah. Right? Yeah. Who I believe did well. I can't remember totally. I haven't seen that in a long time. Oh yeah. Obviously in the song and Agnipath songs. Mm-hmm. And in the trailer. So he's like a legend that's been around for a very long time. I really would like to get a collection to be able to, you know, we kind of have that. We're getting that with some of the other actors. But to get to know all of these actors and be able to think about the trajectory of their films. You know what I mean? Like we know with American actors. Exactly. We grew up with it. Yeah. So the same thing with them. Yeah. They grew up with these actors so they know exactly what they've been in, what their career was like. Same thing like what we know with here. It's just more learning. Yep. Learning a whole new world. Sorry for the nightmares.