I don't do anything. So I want to interview you here on Radeco Collaboration by Ranjit Reedy. It's his first time presenting, so let's take that into consideration. Thank you. So let me begin the presentation. In this presentation, even though it's about agile, I won't be talking about scrum processors or the backlogs or the meetings that we typically schedule. It's more about how to do with people and how we solve the problems when walking with global teams. So a little bit of overview. I'm from the DevTools team. I'm the agile coach. So we are about 140 people. It's a very young team. We started about a year, probably. But the actual team started assembling about eight months. There are about 12 teams. And we have about six to eight months into agile because the teams keep building. And we have spread out about 10 countries. And even each team, there are about people from about five countries or six countries. So it's a truly global team. And there's no one team which is actually co-located in one country. So that is the background of our team. So I found it really hard, painful, and takes a lot of time. Which might be surprising because being Red Hat and being the leader in open source, collaboration is nothing new for us. We have been doing that for many years. But when agile is introduced, why is it so hard? It's not only about agile, but even I think in our particular team we are building services which probably will need continuous integration and continuous deployment. For that, we need teams which are able to work on a very tight timeline. And the way we built the team also comes into consideration because we kind of split up teams. We have some old Red Haters coming to our team. We have hired a lot of new people who are new to open source, new to agile. So there's people coming with different backgrounds, different mindsets, and we have to work collaboratively at the same time and everybody needs to be on the same page to be productive. So these are some of the challenges that I've listed which we found and we tried to tackle. Class system, time zone challenges, cultural differences, social distance, and cross talk. I'll go into details in the next slides. But why do things come in play? I think as part of being human, there are a lot of side effects that we kind of encounter. And I'm going to talk about them and see how we can go about solving for them. So when typically agile is introduced, people focus on the processes, tools, and practices. That solves only like probably one-tenth or one-twentieth of the problem. The actual value lies when we are able to change the mindset, the values, and the principles. This is a very nebulous area and people, that's why they should ignore it because it's difficult but it's the most valuable area for us to work in. So in our team, we kind of tried a lot of experiments. We split teams, we merge teams, we tried asynchronous meetings, synchronous meetings. We kind of, probably every month, we try new things. And whatever works in one team, we try to cross-pollinate it into other teams. So that's how we learned a few things and I'll share what we learned in our team. The class system. So basically this can manifest in many ways. It could be racial, ethnic, geographic, regional, product stickiness, dev versus QA. When it's a product stickiness, this is basically when we merge two teams who have been working on a product for two, three years, and we are trying to build a new system and try to integrate it. There's always a lot of resistance when we try to bring in their architecture into question or their design into question. They always feel that they are right and why are we changing this? So it's always us versus the new team. But to be collaborative, we always be on the same page. The same with Dev and QE. The way we solve this is instead of reporting structures, now they're part of the SCUM team, the QE. So we work as one team. That's how we solve that one. The other things we'll go into it slowly. So the one way to overcome power balance is to collect the power imbalance. So what I mean by this is because we are geographically distributed, if all the leads, all the managers, everybody is sitting in Westford and you're only hiring developers in India, there's great power imbalance. People will feel that they don't have a voice. And if you're able to bring in some leadership in the other teams also, then the power imbalance will be corrected and all those biases will kind of slowly be eliminated. And of course, sometimes it feels silly when some of the comments are made, but I think when we take into consideration from the guy or the girl, from the receiving end, I think it looks very different. So I think basically having a zero tolerance policy really helps in this area. This is self-explanatory, so I won't spend much time on this one. Now, when we are merging teams and they're sitting in different geographic areas with different cultures, different backgrounds, different mindsets, it's very difficult for them to work as one team. So I think if you keep reiterating that we are one team and we also, if you bring in the competitive spirit, that automatically I've seen it helps a lot. For example, in our space, we've seen GitHub, GitLab coming up with similar products. We've seen IBM coming up with similar products. So this urgency that we have and this sense of competition that we need to meet the timelines kind of really helps for everybody to come together and work as one team. Coming to the time zone challenges, this has been really challenging for us because we have spread about 10 countries and at least each team has 5 or 6 countries. So the way we have solved this problem is we tried to see what is the overlap because when we take into consideration like West 4 which is East Coast, US, India and Bruno, for example, we found there's only a 3-hour overlap which is kind of suitable for everybody because when it's early about 8 o'clock in US Eastern, it's probably around 6.30 in India and later we push it. If we don't want the team to kind of burn the midnight oil and if we want them to leave at 9.30 or 10 in the night, this is only 3 hours we have. And the other thing we did is we fixed whatever scrum meetings that we needed to do for only 2 days in a week. So it's Tuesdays and Wednesdays are what we fixed and 3 hours that's it and that's every week. So what this does is it frees up a lot of time for development because one of the biggest complaints when we talk about Agile or Scrum is everybody complains of more meetings. So the way we solved it is we kind of fixed it to 3 hours in 2 days per week and that kind of repeats every week. So by having a pre-determined fixed schedule everybody knows that this is the best opportunity for them to collaborate or meet so that they don't have to have ad hoc meetings or interrupt others during the day when they're actually being productive and their best coding time or whatever. So we leave them as much free time as possible and this seems to be working and we've kind of unilaterally made this as a structure for all our teams and if they need, they're free to set up their own meetings on the team level but on an overall program level this is what we follow. I think this is an article that Jim mentioned or CEO mentioned that we are free to talk in a way because the redact culture is basically the code is that's the dumbest idea I've ever heard.  I think it works when you're in the same team in the same colocation but when you're working across different countries if I call you a moron when the first or second time if you haven't even met your face-to-face it comes out across very differently and especially in the written format and the text thing or in the emails it seems very disruptive and kind of insulting. So I think unless you build that familiarity with the person or the team I think we should tone down on the language. I know we want to bring our hearts to redact and kind of have an open, energetic discussion but as much as possible until you bond with the team and very close to them I think it's better to refrain from using language or cussing which kind of goes... This is something a little different maybe a little controversial in redact but I think it helps at least in the initial stages. Coming to cultural differences when we have these blue jeans meetings or video conferences it's very difficult to see if the person is agreeing with you and the best thing is to take away assumptions from it. So silence is not equal to consent and nodding is not equal to agreement. A lot of people make fun of Indians because we especially when yes or no we have to say yes and no so it's very confusing for people. So the best way to avoid this maybe incorporate things like dot voting or get a spreadsheet and let them say yes or no, yes or no that way it's best to take away any ambiguity if the team is on board or not. Now conquering social distance unless we feel close to the people that we work with we really wouldn't go the extra distance and we really wouldn't have empathy with them and the best way to we have done is we have a lot of face-to-face meetings and we also invest a lot of unstructured time in this face-to-face meetings. So we go out as a team we have activities other than the typical meetings that we have because small talk is powerful that's where we actually get to know people. For example, you know if your parent you love talking about kids and we are all more alike than we are different the first impressions we always notice the differences whether you're if you're short you notice that the person is tall or if you're so but after we talk you realize how similar you are so if your parent you talk about kids or you know if you're married you can talk about how evil your spouse is these are things that you know basically you've gone over so and we also it's best that you know you have this activity stories experiences and photographs these all help in getting the shared memories of the team and a lot of times we have people coming over to India spend a few weeks just not for the meetings but they stay there they get to know the people and I think that's been really helping because a lot of time when you have these strong arguments you necessarily see the other person as someone autocratic or you know not willing to entertain someone's ideas but when you spend so much time with them you also realize that's because the case so much about the product or the team that they're really passionate about it so having that kind of interaction is really important now cross talk so you know having coming from different so many different countries we definitely hear a lot of heavy accents and we're dealing with such complex ideas because we're building cutting edge stuff and less fluent English speakers all this makes it very difficult for us to communicate and especially when we're doing it over a video conference or email or chat especially the voice part it's been as a coach I kind of attended a lot of meetings and I see a lot of people are very frustrated and they kind of shut down people not because of their ideas because they're not able to follow what the other person is saying and I think the best way I mean the couple of ways to handle it I think most of the things are kind of also talked about very publicly like public speaking like actively use whiteboards or slowing down the speaking space rephrasing the content and always seek confirmation that what we talked about these are couple of things that would really help and because this is a real problem and I think once we kind of start putting in kind of make an active effort it really helps for the team to communicate better and this is something that we recently introduced our new performance review process so what we have done is now we have rapid feedback cycles in some yearly reviews we are doing it in every two spins what that does is whenever you kind of give evaluation for the team and every two spins they're motivated and they're able to change their behavior so this is also I think a very pleasant change that we have observed and I think we'll soon be seeing a lot of change in the team once we see the rapid feedback looks kicking in that's all I had to offer any questions so this goes back to saying that not taking silence for an answer saying that they're on board so that way you basically do a dot voting or something so you know the people who have signed up first they're on board or not we have a three weeks come cycle but most of the yes why do you decide like two days that are together and not space so something that been experimented with so Mondays we didn't want to have anything and Fridays most of the people are out so we thought on Thursdays is something that we wanted to give people for their own development and then Tuesday works best because the way we also structure our scrum it ends on a Tuesday it starts on Wednesday so all the retrospectives and everything happen on Tuesday and planning meetings happen on Wednesday so that kind of helps us to be seamless so can you say what scrum works for your team? it's working for most of our teams some of we are still improving and we've also given a lot of we have not enforced strictly how the teams implement the scrums we've given a structure that people are free to kind of tweak so specially teams which are working in upstream they have a challenge where they you know can't depend on their own team right working on someone else to merge the PRs so they have a little more liberty as to how they would like to work in the framework these are the typical meetings that we have are the planning meeting the retrospective so I think if you're looking for number of hours per week it probably comes down to the three week sprint cycle 4.5 hours is what we have seen that what we have allocated for these meetings scrum related meetings your leads have a little more because they also have to attend the scrum of scrums where we all collaborate as the 12 teams collaborate together because there's always interdependency between different teams yeah we we have shifting to matter most right now but we have used chat services as one of the means hip chat or Slack and sometimes we've also tried the stand-ups on those things instead of actually meeting because sometimes it's very difficult for all the people in different times to come together and Blue Jeans definitely is one of the most of the meetings that happen meetings everything we use Blue Jeans for that very similar working teams we have some of the same challenges we haven't been able to ever implement scrum across geography I'm curious whether you think that has gone well or you've just been able to sort of power through at least the time shift becomes a blocker to effective stand-ups some people will have to stand in right before they're having dinner coffee at the same time it just seems to fall flat yes so we did that we gave full freedom to the teams to choose how they wanted to do it but what the teams themselves realized as some of the teams came back saying this is not working because when you have an unsignificant stand-up people the what people have said might you know the person might be gone if the status isn't gone and you might not be able to follow up with him so they have actually gone back to face-to-face meetings even though that means maybe one or two people might not be able to join because it's probably 5 a.m. for them so it's kind of a balance that they're doing and I think two or three teams have come back to face-to-face after trying their synchronous because it doesn't seem to be working as well as face-to-face because people are quite silent and they are rather like mothons of singing how do you encourage to participate in dialogue at least at Red Hat I haven't seen too much of the silent type because I think the people they bring in are really passionate about what they believe in and even especially in India where people tend to be a little more silent what I've seen is that really outspoken and they also of course the people who are young like who bring in like interns they have to develop that culture but once they see their peers doing that and I think our leaders also encourage their behavior a lot for example me, they have asked me to come and speak here I'm an introvert as well but this is kind of helping me to speak up as well so I think it goes back to the leadership to encourage the teams and ask them to speak out so face-to-face as in like physical face-to-face meetings or? okay the typical meetings that we have face-to-face when I say are the ones that I'm saying where actually physically people meet so that way you get to know each other and we have quarterly planning meetings that happen wherein everybody for example after this DEF CONFIA meeting three days in the Bruno office where all the leads from all the countries fly over and we basically kind of plan together so that's one kind of face-to-face that we do another one is of course typically or blue jeans for the weekly meetings that we have to handle any other questions? I think this is a problem probably across Red Hat I think some of the old ways we work in Red Hat I think there's a lot of resistance to shift to the new way of doing things because I think it's because it works so well for them and they're I think change is always hard and if you've been successful doing things the other way you always tend to be more resistant because you know that something works but the problem with the old way of doing things in the open source world we're collaborative but I think you typically always the team that you have working collaboratively already have a common purpose so it's much more easier for example like you're working on a kernel you interact with people who already are interested in working on a kernel but in our case when we are building totally new products we are hiring people from different backgrounds and mindsets and that means we also need to carry them with us so it's not enough to have all the information in your head you need to put it down somewhere and it comes on the same page I think that's one change the challenge that I'm saying from especially the old Red Haters one last question balance so he's able to speak out whenever there's something wrong or when someone's voice is not being heard and I think that's been a very important thing that we did to correct those power imbalances at least the majority of the team is right depends how many people are there remote is and all that it's not possible but at least wherever there are a lot of people focus


Good morning everyone. Thank you for tuning in to Straight Talk Vermont. My name is Lauren Tebow, Executive Assistant for Service Rendered. We're here today with Honorable Mayor Christine Lott of Winooski. Thank you Christine for joining us. Thanks for having me. Thank you. And Bruce Wilson, of course. Thanks. And just to, just to, um, this is the afternoon. Oh Yes. Good afternoon. Who knows when they'll be watching it? Good afternoon, morning and night. Anyway, go ahead, Hager. All right, so we are joined here by Mayor Christine. She is the mayor of Winooski. The first women elected as mayor as well. It's amazing making history right from day one. Super exciting. Very exciting. Um, so I wanted to start kind of from the beginning. Did a little bit of researching on your Biography and I noticed that you were born and raised and went to school in Michigan. That's right. I grew up in Michigan. You know, I was in a, in a small town in Southwest Michigan, went to Michigan State University, and it was probably a year after college that I actually moved out to Vermont initially. Right. So how did you kind of, what brought you here? How did you find out about, you know, wanting to move to Vermont? I actually had some friends who had moved out here, a friend came out here for a teaching job at a school and after college, I didn't really know what I was doing, what I wanted to do, and they had offered I could come stay with them and check it out. And so I was like, oh, I've never been to the Northeast. Let me just see what this is about. Drove out here. I actually remember specifically when I drove, when I first drove from Michigan, it was like a, I don't know, 15-hour drive. At the end of the night, I was coming through Winooski through the rotary, and I was like, what is up with the roads here? This is crazy. And then I was staying with these friends out in Jericho for a couple of months and getting to know the area and immediately, when I was ready to, you know, find my own place, Winooski was the spot. That's where I chose. And in the year since then, I ended up meeting my husband who actually grew up in Winooski and, you know, owned a home there. And so here I am still.  That's right. But you know what, it takes me like 19 hours to drive from Chicago. Everybody say 15.  I can't get it in 15. A little more traffic by you. That's awesome. So you lived in Winooski kind of once you settled and you've been here ever since. It's awesome connection with your husband growing up here.  What were you like? What was your job and role before leading up? It's actually, I saw a listing in the School and Community Newsletter looking for folks to join a housing commission having rented for years and really struggled with, you know, finding decent quality housing that, you know, rent prices even worse now, but being high as they were then. I thought here's an opportunity. I have an interest in here. Here's an opportunity to give back but also be more connected to my community. So having my spouse who grew up in the area he knew so many people, knew a lot of the history and I felt like I didn't have that. Like I hadn't made a ton of friends. I didn't know a ton of people here. And so I actually started as a way to just be more connected. And then clearly it escalated. I went from, excuse me, I went from serving on our housing commission to then I ran for a seat on the city council after two counselors, you know, their terms completed, there were these two open seats. And again, it was like I have the time and interest. Somebody needs to do this. So I thought like I'll volunteer for that. There really wasn't like a planned trajectory. Right. That's awesome. Jumping into it. Did you have any background interest in politics, like growing up? Did you kind of have this vision or is it something that came to you once you got to Vermont? I've always been interested. Like I would follow things in the news. I'm interested in how politics and policy, you know, trickle down into our day to day lives. I did, I think for one semester in college, I was like a poly science major. I wasn't really into it. So I didn't. I never actually saw myself in like this forward facing role, you know, being the mayor is very much out in the community, like the face of that work. I really have always been more interested in like behind the scenes and how are things happening. But in this role, I feel like I'm able to be involved in like strategy and facilitating conversations and connecting people and you know, Bruce is a great connector. Here, when I hear about a need or an idea and I know somebody else is also interested in that or has resources or something, like being able to find those connections is really rewarding. Right, exactly.  But but for us, the infrastructure and everything about Winooski, you know, and housing and, you know, schools and everything, everything is really raised up, you know what I'm saying.  And like, and I get on these things, these boards, the commission, whatever for the city of Winooski because I know that I get to work for a mayor like you and that and I know what your goal is. You want to get to see it done, you're a great listener, listener as well.   So I just want to thank you, you know, thank you. Well, it's so important in local government that like, I don't I don't want to be driving all the decisions like it's about like lifting up the voices of the community. And how do we get towards what people need and people want? And so having great volunteers like like you and folks who join on commissions, like how I started or the committee that helped with the reason Centennial celebration and the folks who run for city council and put themselves out there for that. Like being willing to get engaged there, share your perspectives is really key. And then also what you hear from others and help sharing information out to have as many people as we can be involved. Right. I love the hands-on approach is really important when, you know, you're making a community stronger, of course. When you were running for mayor, how did you represent yourself to the community and portray what you stand for going in as mayor? One piece was about that engagement, like I want to make sure that decision-making is happening with community members and that like government is not separate and just doing whatever back here behind the scenes. And that important decisions have a lot of outreach. You know, we've been working to increase connections in New American and non-English primary speaking communities who we haven't been as connected to. Lower income residents like trying to make sure we can reach more people as we make important decisions. So that was important to me in something that I talked about. And then I'm having a bit of a moment. Well, I know this for a fact. Just like, I don't know this. Oh, the vision. So we have a master plan, right? And there's already been a lot of community vision building that I wanted to help carry that forward. Like I don't want us to create something new. We kind of know where we want to be in the future. And so through engagement, through supporting staff and working with partners, like how do we get towards that shared vision? Well, I know for a fact that I don't know no city to have like commissions like going for safe and healthy and connected people. How big is that? And then like the Winooski plan, I don't know cities to have Winooski plan. So it's a plan that I helped, you know, and I was part of, you know, and like that's to be building a whole daggone city and we're from sidewalks to youth centers to trees and all kind of cool stuff. Yeah, it's it's like a list of goals that reflects community values and what people find important. And my point is that, you know, people in the community, you know, help create that plan, you know, everybody everybody was welcome to help be a part of the plan. Absolutely. You know, and so, so that's what I'm trying to say. I'm just going with what you're saying about you need everybody to help you with the goals and aspects of what things that's happened in Winooski.  It's a nice plan. And Winooski is an engaged community. Like people do turn out, people do want to be involved. I hear it when like consultants or folks from state agencies come into a meeting or an event that we have more people show up and speak out than than in other areas. So that's a really nice thing about living where we do. We're all three of us happen to. Woohoo! That's our mayor right there. So if people wanted to pick up that plan, what could they do? Was it a link or something? Yeah, so WinooskiVT.gov is the city website. There's a series of tabs across the top. Cameron Moetit says, but like our strategy, it includes the master plan and all of the relevant documents. So there's like the list of goals we're working towards. We have a transportation master plan, which shows where we're trying to like add sidewalks, add bike lanes over time. You know, a lot of these changes take a long time, but we do have at least these guiding documents to help us continue moving forward. And I told my team, I told Lauren that that's why they want to do some type of event at the skate park, is that I had a team of people we met, you know, from the people who used the park. We met like four or five times, and then they presented and they had like Google Maps and how kind of cool stuff of the skate park, how they wanted to improve it or whatever. And at the time, the people from, who was the name of those people who helped put together our plan, our vision of. Oh, the parks and open space plan? Yeah. I mean, those people that came, the consultants that, you know. The regional planning commission? They were there, but it was somebody. There was another specific, and I can't remember their company. Yeah, but that's okay. But the whole thing about, so what, when we presented our plan to them, so they adopted it. And so it's in the master plan, the skate part of what we created. So I'm, so I'm happy about that because that came from people who used the park, you know, said, wow, how wonderful is that? You know, can't wait till we break that out. But are we, is it actually, so what's gonna, I mean, it's all about, there's a wonderful plan. We still need to raise the money. We still need to raise money to actually do it. But is anything being done now? Like anything within the master plan? On the skate park, specific? No, no, no. Oh, just in general? Anything. Yeah. A lot. We are, so we have the Main Street Violization Project, which carries out some of that vision, right? Improves bike and pedestrian along Main Street. More trees. Improved economic activity. So that's something that was voted on a couple years ago. Voter supported a bond for that. Hopefully we can start this summer. The pandemic has been an issue. There is a hotel and new parking garage development project downtown in the Dirtlot, kind of by Cassavent in the river. That's also been slowed down. We are hopefully close to launching a housing trust fund, which will give community members access to, you know, there's a down payment assistance program, program to get funds to rehab housing and then to create affordable housing. So that drives towards some goals. We're launching a new Wienewski Inclusion and Belonging Commission, which we just appointed Bruce to, which we are hoping to use to work towards one of our goals of having these bodies be more representative of the community and making government more inviting and inclusive. We have some funding for a park improvement plan at the West Allen Park. So there's like a dog park and then like basketball court and stuff. I want to make some improvements to the youth side of that. So we got a grant to do like a, essentially get to construction documents, not actually do the work. There's a lot of that where we have to get the plans in place, like the actual like here's how you could build or engineer this. And then we have to seek funding again from there to do the actual construction. And so like East Allen Street, there's going to be some, the state, V-Trans is doing some work over the summer out there. That's going to do some lane changes, crosswalk improvements that will upgrade that corridor and make it more safe. But then there's like a longer term plan, even more with once more funding is available that could make further improvements down there. There's a lot, a lot going on. I feel like it's, we're very active. You know, there's a lot of people involved, a lot of projects that are underway. And again, like driving towards that shared community vision, we have something to focus on and we're just trying to figure out how can we get closer to it over time. Right. Yeah.  We have a culture diverse community in New Americas and we just keep probably more than many, many cities at least. In Vermont. In Vermont.  You know, I know I see a lot when we do vote on things, when we have meetings on until Bryan Center, a lot of people of New Americans and people are 10. And that's sponsored by the city. And so I like that. And the ideas and the objectives of the meeting is very important agenda items are very important. Just like like talking to the new city manager candidates, and see who's kind of like on your platform of how you like to see a city manager. And so a lot of people were there, New Americans were there, the candidates were there. And I thought that was real good too.  And so that was awesome, you know. And plus, we got, I think they gave me some money. They gave me a stipend. Oh, everybody in there. Yeah. I think I don't know, it could have been 50 bucks. I didn't even know about that. Could have been 50 dollars, you know, but I didn't know about that when I, because I came. I think we are trying a lot of things, you know, and thanks to staff ideas to having an equity director or working with a consultant or the voices of community members recommendations, we are trying a lot of new things to try to make sure we are including everybody in the discussion and making things inviting. And it does take like different forms of outreach. Not everybody is going to come to a scheduled evening meeting. Not everyone's going to go to a community center event. Like you have to do many forms of outreach to reach many different people when it comes to important topics. I think the two that you need, the city needs to come up. I don't know if you've got any technology grants, you know, so we can build on our social media because most people who looks like me or people of color, they're not necessarily going to tune into it. Now, we've been telling mayors, mayors, there's a couple of mayors and city managers and that people who looks like me are not going to tune in to City Hall's website. Let's see, trying to figure out where they're going to pay their something. Park and take it. Park and take it. It's the same with the police, I told Rick the same thing. Chief, our good chief in the Winnowsky. And they'd be like, you guys be like, yeah, we got it on social media, we got this, everything is locked down. I'm like, who's looking at that? Nobody's looking at, maybe they're looking at now, hopefully, I don't know how many hits we got on all the cool events we've been doing in Winnowsky, incredible events that we pull off. So they might look only now and see what kind of events what we're doing. We just had to hunt for one Saturday, which was incredible. I kind of was there was not. But I know I saw the people, I know it was a lot, it was a good big turn out. So one point is that, so they might look at it that, but people, I've been saying this from from day one, is that we need to do boots on the ground. I mean, I know there's, there is no more AmeriCorps vistas, or do we have any interns? Somebody just can go do it. We're seeking one right now to fill an AmeriCorps VISTA position. You need like two. We had two at one point. Yeah, I mean, it does take staff and time to do that.   And so, and then they can do a survey to everybody and sit there and figure out three, three surveys, get along with some Winooski Strong shirt or something, you know, and and learn from them what they like about their commune, their Winooski. Because a lot of people, let me say they don't believe that they're, like the police serve them. They say that they only serve the white people, and the police are always at the people who look like me. And they don't feel comfortable. They don't feel a part of anything, because there's nothing there for them. And this, and I've been knowing that for years, that's why I've always been trying to, trying to do something, you know what I mean. And we, and we are, we are, because they need to be a part of it, they need to feel it, boots on the ground is, that's the most important thing. And you have to get the people, like one thing I didn't like about the O'Brien city, the underground youth center, which I'm a founding member of, at the, that the city would hire American VISTAs that were white people, and then people they were serving, was people of New Americans. And then there was no interpreters really. It was, we'd finally kind of getting it right right now. We still ain't got it right. But we're trying to get it right, you know what I mean? We are getting it right. It's getting better, a lot better. But that's why I believe the center didn't work, because you know, you had nobody who looked like them, you know, to actually hang out with them, you know, as a VISTA or intern. It was pitiful. And I said that, like, I was on the board of directors for Parks and Rights for some years, and then I said it many times, and two rounds of VISTAs, they still, you guys still, well, the city of New Ski came out with this white people, for people who, you know, who are African-American, I mean, people of color. Well, that don't make no sense. Yeah. I mean, that's one of the focuses now is like, how do we do better with staff reflecting the community? We've made some headway, not a lot, and that is also one of the things that came out of the consultant's equity audit recommendation, so that we need to look at our HR policies, how we recruit, how we support staff. We have seen some improvements on our police force, hired some community members. I met one African-American. Yeah. Did he used to be a state police? I don't know. I don't know. I don't know the background. That's all right, but that was awesome to see that person. Yeah, but so there's definitely a need there, and that we do need to focus on and continue to make improvement on. That was awesome. He was at night time.  I'm like, what do I do? Did I pay the ticket? Oh, it's funny, but so it was cool, you know what I mean? I'm happy about that. That's a start, you know, and, you know, I work with the chiefs around the county, and then I'm also sitting, from what I say, police, fair and partial police, and all of them are looking for people. Yeah. They're looking for, I think, that's what I said, they don't, Ryan's the whole chief, I don't think he's, I think he said they're good, they don't need nobody, but. Staffing's been a challenge for police and fire for a while, and lately in public works as well, you know, there's a general staffing challenge like post pandemic, but there already were some issues there. Yeah, for years. Yeah, so it is hiring is hard, and we, you know, we've been talking about with the new city manager, like, how do we do more cultivation within our community to find local folks who are already here that want to, you know, work in city services, and to the extent we can do that, we can have stronger connections between what we're doing, have folks who reflect the community, so I think that's an important aspect as well.  You don't need to share your schedule on here. Okay, sure. That's right. Sorry, man. Thank you. Yes, so anyways, the good thing is that we're going to be talking about UFO boards, you know, getting UFO boards, like, you know, we've created UFO boards for the city of Burlington and, and city of South Brunner adopted UFO boards, which I won't, you know, I, you know, I'm about it, but, so we're excited to get some UFO boards in Winooski, man. You said bring them on, so you told me, sign them up. Yeah, yeah. We're seeking, seeking right now. Any, yeah, so we actually, for the existing commissions, we are seeking new members right now. If anyone's interested in getting involved, you can also just contact me at klott at WinooskiVT.gov, and 766-1988 is also my, my phone number. I think working with youth in the community is a really important strategy as well. Like, here's how you can build up folks to serve in the future, um, to, you know, if they're seeking careers, like, let them know what we have here. I think also for, like, first-generation immigrant families, it can be really, really good to establish that connection with kids who are new here, so that as they grow up, they feel really a part of the community. So, yeah, I hope you and Aline have a good conversation on that.  She's really excited about, um, like, our arts program and working, doing some art stuff, for our own self. And, um, just, um, I talked about the mural that we're going to be revamping it, you know, and she's excited to be a part of it. I told her, I said, Honorable Mayor, it was out there, you know, without paid rest stroking on that mural. And so, um, you know, so she's excited to be a part of when we, we kind of just touched up, we, we created, I think, I think Elizabeth, kind of, we create, want to recreate it, um, blame her, but, um. Aline was a really excellent hire. Um, you know, we had a really strong city manager previously, big shoes to fill, and I think Aline Wong is a great person to fill those shoes. No doubt about it. And she does have a really collaborative community focus, which I think is what we need right now, um, to try to make sure that we can bring in everybody. And I think she's done a good job already of putting herself out there, trying to meet folks and saying, hey, I'm your point of contact if you need something from the city of Winooski. So you said it because, you know, what exactly is her role?  Oh yeah. So this is actually worth sharing. Um, the form of government in Winooski is called, um, council manager. And so the city council, myself and the four members, I chair that as the mayor, we are there for policy decision making. And then the city manager is like the chief executive of the staff, um, in charge of operations and how we carry out those policies. So that's, you know, she's got a full-time gig overseeing all of the staff and then interfaces with us. Um, I'm, I'm like, I'm a part-time mayor, um, and our council is part-time, right? Then these aren't full-time jobs. And so we work together collaboratively to, it's our role to kind of, to represent the community and bring in that community vision. So there's also, there's onus on us to be getting out there and talking to different people and making sure we're not bringing solely our own perspective. Um, and so through, through that work, you know, we set sort of a vision of here's where we're trying to go. And then it's her job to figure out with staff, you know, how are we going to do that? Um, how do we operationalize a language access plan, for example, which we don't have yet. Um, how do we support these commissions and meetings? Um, who's in charge of supporting this community event? So sort of in those more nitty-gritty details. Hmm.   And, um, you should be in, in, um, wherever you can be at.  I do have a limit of the amount of time I have, but I am looking forward to, there's a lot of summer events happening in Winooski this year. You know, as things have shifted with the pandemic, being able to gather outdoors in larger groups is wonderful. It's been a thing that we have missed for quite a while now and has, for me personally, has been a detriment to my ability to connect in the community. So I'm looking forward to getting out there more now. The centennial celebration on Saturday was a really exciting event. A lot of different, different people there, old, new. Just, I saw tons of folks. You know, we have the Winooski Wednesdays events twice a month in the Rotary. We have a Juneteenth celebration planned, French Heritage Day, and then I'm strategizing with counselors on other targeted outreach. You know, we're doing some listening sessions with interpreters to hear from members of our non-English speaking community or, you know, English is not a primary language. Make sure we're hearing how they've been impacted by the pandemic and what their priorities will be going forward because, you know, we have that great community vision, but we have new situations to respond to and maybe some priorities have shifted, so we want to hear all of that. Right. How do you get in touch with and advertise that to those communities? We have, we do some work through the community, the cultural liaisons at the school district and then AALV we work with and USCRI, you know, they have, they have folks in the community that they work with, that they serve. The housing authority is sometimes a partner. You know, we have our website where we put out information, Facebook and Instagram, but Walewski has the authority. Yeah, yeah. And then, but like leaning on these other partners that are very connected in the community is important as well. There's more to be done there. There's definitely, that's something that we want to focus on in the future, too, is like, how are we getting information out there? Is it the, it's obviously not the best. There's definitely room for improvement, so that's something that we need to, to look at as well. So do you have a set date for when those listening in sessions are going to take place? Yeah, but they're, they're being coordinated right now. They're not, I can't say they're final. We're finishing that up to make sure we have what the interpretation availability is. Right. And then when that day is finalized, it'll be on the website and then yeah and elsewhere. Yeah, and we'll be working with those interpreters and the, you know, the liaisons and the organization serving new American community members to try to make sure they're all aware. Important. That's good. Awesome. Yeah, I'm just, you know, I'm just hoping, you know, it's all wonderful, so I'm sure it's gonna work out just fine.  Well, thank you. And I did want to also mention, like, how important it is to work with community partners. You know, you mentioned the Fight for Kids Foundation, working towards creating a youth center. I think that is an excellent strategy to address the problem that you surfaced earlier of not staffing in a way that supports the audience you want to serve, right? And so, you know, finding folks in the community already doing great work and trying to lift that up and support it is also really important. No doubt about it. And I want to thank you and the City Council for sponsoring the Fight for Kids Foundation. I should have wore the t-shirt today. It's okay. Honorable Mayor, it's all you anyways, you know, just like, whatever is good, that's what you're going to support. I mean, like, you know, that's what you support. I mean, the best you can, you know. And so, that's what we want and we're missing whatever's good, you know what I'm saying? So, why not, you know, why not support it, you know, be a part of it and try to make it meet the goals. So, what else you got? Well, I was actually wondering, you'd mentioned a Juneteenth event. What do you guys have going on for that? There's going to be a celebration in the Rotary. What is it? Sunday the 19th. Music, activities, speakers. It's going to be like a celebration of Blackjoy. We're working with community partners on that as well. Something that downtown Winooski and our equity director and some other folks have been involved in, you know, we had our first one last year and so hopefully we're bigger and better this year. I hope people come out for that.  I've been working with Craig for many years. Oh yeah, Craig's very involved as well. He's great. And we've done events together for many years. Winooski Strong. Another great partner. Yeah, in downtown Winooski, right? They, they are, uh-huh. Yeah, so that's, I mean, that's, that's what I'm talking about. I mean, the events that, you know, things that were the new things we're doing, all the different types of people that's coming. People from around, at least around the county, is understanding what, um, Winooski have to offer. And so, um, and then we want that, we want them to come to our restaurants. We got a lot of great new restaurants. There we have that. The Serbs Cafe just opened, Vietnamese place. There's a kebab shop opening downtown soon. I like those. Mourning Light. Hong Kong Bakery is expanding their outdoor seating. Fusion Cafe and Wicked Wings just opened on Main Street. There's another spot that's gonna fill soon, so there's a lot to check out. That's awesome. Wow, so that's what I'm talking about, you know? Yeah.  Yeah. Isn't that cool? You know, you can be like almost anywhere in the world and you can have a, go to the restaurant right downtown or around town and have a great meal, you know, from people who, who's born and raised with the cultures of types of foods that they are cooking. That's the best thing about it, you know what I mean? Of course. So I can't wait to get to some of those restaurants. Jesus Christ. Then there's Tiny Thai, they still, is that the name, is that their name? Tiny Thai. Yeah, Tiny Thai. They're up on Main Street. They move to a new space. They're very affordable as well. Yeah, Fodang is good too. Street across the street. Fodang, yeah. Wow. Well, we're going to wrap it up here. Awesome. Give it a, anything else you'd like to mention coming up? I don't know. We covered a good amount, yeah. And you'd mentioned, you know, sources and places to check that all out. You want to give your contact information one more time? Yeah, so it's K-L-O-T-T at Winooski-VT.gov,<PHONE_NUMBER>. You can call and text me, you can send an email, whatever, whatever works. I'm on WhatsApp as well, so. Hey, I know. So, all right. Well, thank you so much, Christine. It was a pleasure to have you here today. Thank you everyone for tuning in to Straight Talk Vermont. My name is Lauren Tebow. Bruce Wilson and my dear Honorable Mayor Christine Lott and my friend, and I'm so happy I live Winooski. Thank you for giving me an opportunity to serve as well on the commissioners and things that we do in Winooski. Well, thanks for having me and thanks for your engagement in our community as well.


Well, thank you for coming out My session today is going to be like the screen says on identity management and compliance. We're going to talk a little bit about Why do you care about this? Why is identity management important to compliance? And why I broke it out from say what we folks typically talk about compliance and what is compliance? I know the first time I used to work at an audit firm someone asked me You know is this compliant? Have you taken compliance into account and my first question was compliance with what? So we'll talk a little bit about that How does it apply it being identity management to appliance? Compliance and we'll talk about some real-life workflows And then finally we'll get into some tech stuff and a demo Any questions, please hold till the end since it's a pretty short session. I want to get through all the fun stuff first So who am I my name is Mark Borschtine. I'm the CTO of tremolo security. We are an identity management company I have been doing identity management for close to 15 years You name the industry and the product before I started tremolo pretty good chance that somewhere in that cross section I've done a deployment. I also spent time as a FICAM architect that's in the federal government what they call identity management For multiple three-letter civilian agencies and have had to work a lot in the compliance space, especially with the feds And if anybody has worked on Open ID connect with Kubernetes. I contributed a lot of the documentation around open ID connect All right, so why is compliance important? So there are two reasons why compliance is really important The first is it will often be used against you if somebody doesn't want you to put something into their environment The first question is is it compliant? Whether or not it has to be compliant is a little bit of a squishier subject And it really depends on whether or not people want things in the environment But when you're trying to push something a new disruptive technology, I think we'll all agree that Kubernetes is pretty disruptive It's always good to have the compliance question in your back pocket the happy path Which I'm gonna spend more time on today is this mathematical equation I like to have where if you take DevOps identity management you put them together you make everybody happy You make the suits happy because guess what they don't like pouring through 10,000 emails any more than you like putting them together and makes your admins happy because there is nothing more annoying Then having to answer tickets and add users to groups and have users who can't get into what they're doing Get upset complain to their boss. They complain to your boss So automation is really key So what is compliance? So there are two types of compliance frameworks out there There is the classic NIST 853 Which is a true framework. So just like Kubernetes doesn't do anything unless you tell it to NIST 853 doesn't actually tell you what compliance is it gives you a framework to design your compliance So here we have a control There we go. So this control here the The step one to find your policy will say all right You need to have a policy in this area and then it's up to you as the implementer to define what that policy is And then you have often much more industry focused Compliance frameworks and they tend to be a little more prescriptive So I do a lot of work with law enforcement and so see just comes up a lot So how does IDM fit into this? So if we're looking at NIST 853 This is an actual control Authorize access to the information system based on 1a at valid access authorization as an extremely helpful control That is a palindrome So basically what it's saying is you need to have a process designed to say Why somebody should have access to it and then from a technology in standpoint? How do you implement that? That's where identity management fits in and then looking here at CGIS The section deals with passwords password complexity how often you have to change them etc. And again, that's where you want to have identity management So let's talk about the unhappy past with compliance and no dev ops Everybody's gone through this. I need access to something in Kubernetes whether it's a namespace A cluster or whatnot. I'm gonna email my boss say hey I need access to this they forwarded on to an admin saying I approve it Or the admin, you know sends an email saying hey, do you approve this access admin gets told? Yes goes ahead creates the access Maybe they're creating a Roll binding maybe they're creating an object in a directory somewhere a database and then send you an email And if everything worked according to plan you have access If they work according to plan then you go into this state of going back and forth with a sys admin who really has better things to do then every year every few months whatever the Compliance requires you go through the certification process if the admin's really good at saving those emails Then they just pack trip the emails and send them if they're not really good at saving those emails that admin's not gonna have a good day Trying to go through all those emails. Even if you're using a ticketing system You know remedy service now you're still digging through a lot of information to get to what the auditors need So nobody's really happy with that. So here's the happy path when you when you take dev ops and identity management You pull them together to do this User logs into a portal ask for access to something Identity management figures out. Hey, this is the workflow that has to happen This you know the manager has to approve it and the namespace owner has to approve it User goes ahead gets notified that it the request is out there. The approvers get notified They log in they approve it it all gets audited the user gets notified that they now have access Notice there's no admin anywhere in there because the admins have better things to be doing than giving users access Then when it comes time for the auditors to come along here's a report Everybody's happy the users are getting into their systems. The admins are not dealing with user stores and user permissions and well users And they don't have to deal with the others everybody's getting what they want out of it So let's talk a little bit about technology has this actually work in Kubernetes. I break identity management down into who what and why Who are you? What can you do? Why can you do it? So the who is where the most? Existing implementation is inside of Kubernetes and so that's typically authentication. You have certificates You have open ID connect and reverse prox are really the big ones and then custom I am not a huge fan of certificate authentication for Kubernetes and the reason is a few fold one Certificates are really easy to do poorly Really hard to do correctly Kubernetes does support CRLs now But in order to do group authorizations inside of a certificate you've got to embed it into the DN And that can get messy especially if you have long-lived certificates And then from a compliance standpoint one of the things that's really important with compliance is you want to do as little as possible you want some You want as much to be someone else's problem as you can and when you're talking about compliance of credentials if You own the credential you own compliance for the credential You have to have all the controls in place to make sure that the credential gets revoked that you're managing it that if it's Privileged the you're handling it properly whereas if somebody else owns that credential that Compliance is also somebody else's problem. You just say go talk to your identity provider So with certificates you actually own the credentials. So that's issue one From a compliance standpoint from an operational standpoint order to do certificate-based authentication You need a point-to-point connection, which means no inspection of the content going across the wire You do reverse proxies, but you're you're proxying network traffic. You're not looking at the information So if you have a web application firewall in place You can't do that Now you might be able to make the argument you don't really need or shouldn't have to have a web application firewall in place For the kubernetes API server and I'd probably agree with that to be honest But again going back to compliance as a weapon against your implementation That is yet another argument you have to have so it's a few of the reasons why I'm not a huge fan of certificates for kubernetes Open I connect this is my personal favorite. I'm a big fan of the way kubernetes implements it Because you can generate these short-lived tokens that last 10 seconds 30 seconds a minute and be forced to refresh them You can also embed authorization information into the token, which is what I'm going to show here So it covers you from the standpoint of you are now not issuing individual Credentials to people so you don't have to manage passwords. You don't have to manage revocation of those passwords and And you so from a compliance standpoint that helps cover you anybody who's familiar with NIST 863 Which is the federal government's kind of recommendations for authentication the latest revision that came out a couple months ago now includes open ID connect So if somebody comes after you for that you're covered And so you have a lot more flexibility. It works well with any kind of network infrastructure that you have And it's pretty common out there Reverse proxy plus header. I'm not a huge fan of either because Raise the hands beyond corp anybody heard of it Concept is the zero trust network. You don't let anybody you know You don't trust anything on your network. Your network is not trusted. You just assume you're breached and somebody's in there so now you have Your API server if somebody's inside your network and just start injecting commands because they can inject headers They're not verifiable. That's really not a lot of fun Custom to be honest if your solution is custom and you don't have a cloud. I Would really think long and hard about it Because most of the people I talked to when they start saying well I just want something simple and you start kind of going through and iterating all the things you got to think About they basically have open ID connect So that's the who who are you the what what can you do? So in kubernetes that's done via our back our back is via from one Eight one eight or one seven is now the standard of how you do it and it's a pretty actually straightforward process You combine a subject who you are a role which is a description of Collection of actions, you know verbs and nouns and a Role binding which is taking that role information and binding it to particular users and then you have the same thing at the cluster level a Lot of people will use the role bindings as the facto groups Not a huge fan of that approach because it's really easy to add users to that What's whoops? Thank you What's a little harder is doing the reverse. Hey, what does mark have access to new? Functionality is coming in for that, but quite frankly there are a lot of tools. They're really good at doing that outside of kubernetes. I Like to do as little work as possible And then finally the why Kubernetes has nothing that does that for you need something to track why someone should have access And that's where you start to get into identity management systems so we had demo for you and So what we are demoing here is open unison, which is our open source project You can do this a lot of different ways So I have seen people do similar things with Jenkins. I have seen people do similar things with bash scripts So there this is by no means the only way that you're ever going to be able to do compliance But this is an open source project source code is going to be Reference here in the slide and what we're doing is we're using the open unison what I call the identity manager for kubernetes So it's a version of open unison that we have Put in features specifically for managing kubernetes runs inside of it And so what we have here is probably easier if I come over here So we've got kubernetes one eight cluster it is running open unison as a container and We have a relational database. It's actually not running inside of kubernetes But it is storing our audit data and it's also storing our authorization data So common issue in identity management is Organizational people own the identity data are not the same people who need to use it if you need to read identity data from AD ADFS whichever that's usually relatively easy where things become harder is you need to write to it and you know Think about those are the keys to the kingdom You know, that's your company's entire infrastructure, especially if you're on the enterprise side So they're paranoid for a reason So what we are doing here is saying, all right, we're not going to connect directly to your ad. We're going to use SAML 2 to authenticate via ADFS and Because this is a compliance talk. I thought it'd be a little fun to add multi-factor So we are going to show how we do multi-factor with open ID connect and U2F tokens Am I doing on time? I'm doing okay on time Okay, let's do it So I'm gonna go ahead and start off by logging in as a new user So you can see I'm being bounced over to ADFS My little token here. This is a Yubico U2F token. I think they're like 15 bucks Okay, there we go So what's happening now is that the assertion has all the information about the user first name last name email Etc. I'm being asked to register my token now anybody who Actually does work with compliance first thing they're gonna say is this is technically not valid to factor Because if registering the token is not done with two factors then using the token is not done with two factors I would have had a second factor for this such as SMS which technically is deprecated by NIST 863 but still available maybe by email So some other trusted way to do it. I have 35-minute demo. I wanted to keep it a little straightforward So at this point, I have registered my token And so now bounce back to ADFS. I'm gonna tell you Baco. Hey, I'm here There we go. This is the oh so valid Banner, you know, I I solemnly swear I am up to no good that you're gonna have to click to acknowledge that you should do no harm And so now I'm in so this is scale.js. This is our front-end Everything is API driven And you'll see I really don't have a lot of access to anything I'm a user. Here's my information if I want to request access to something For instance, I want to become a namespace administrator What we're actually doing is pulling this information directly out of Kubernetes So as we add new project or namespaces They'll show up here. So you don't have to create new workflows every time you onboard someone so the first thing I'm gonna do as This user is I'm gonna ask for a new namespace great thing about Kubernetes. It's all API driven So if I want to create a new namespace with IDA management I've already got the workflow engine and the connections to do that So I'm gonna go ahead and create a new namespace called the user sandbox For demo so that request has been submitted and Then again, this is where the DevOps plus identity manage Compliance makes life better in identity management. I want to see my open request. I'm sorry boss I can't do my job because this guy Matt Mosley hasn't approved it yet.  How am I doing on time? Beautiful? So I'm gonna log in as our super administrator Second factor and you'll see I have this open request for D user to So I'm gonna review the request This person wants his own sandbox. I'm gonna say okay now If I go here to my reports I can see approvals completed by me and guess what there's the request by demo user and Then if I want to go see the audit reports Angel log for period well, yeah, and then I'm gonna go ahead and do today and There we can see for instance, there's the u2f data and then if I come all the way down here, I think Here we go. Here are all the objects being created in Kubernetes for D user to so that's now all audited And then the next thing I'm gonna do because I forgot to do this when I requested it is he needs access to my Sandbooks my sandbox as mr. Mosley. So I'm going to go ahead and request access on his behalf I'm gonna go request access name space administrators and Where's Matt Mosley right there? I'm gonna say for demo I'm gonna request for someone else and you can customize when this happens I'm gonna do a pre-approval approved Now if I requested this, but I was not a valid approver The request would go through because I can't it's dynamic So I can't figure out who's a valid approver up front But the approval would fail and it would be log that it failed and that I was the one requesting it So I'm gonna go ahead and submit that So that was already pre-approved so I would not get a notification to go ahead and approve it So at this point our de-user 2 Is going to be able to log back in and we're gonna see a couple of new badges here on the front So I have access to the dashboard because now I have something in kubernetes worth accessing I have access to a token so first if I go to the dashboard as of 1 7 I think the dashboard now supports authentication my favorite way to do that is via reverse proxy We just inject your open ID connect token right in and it then takes that and passes it along to the API server So whatever you as the user can do Dashboard can do and it does it on your behalf It's not quite there where it's it's like you can see that it's complaining that I don't have access to do certain things So it's not quite Intelligent enough to preempt those things, but if we come down here and I say go to my sandbox you'll see I no longer have any error messages and Then whoops the other thing that I'm gonna want to do is actually start doing some work So when we talk about open ID connect and tokens The thing to realize is that you need to tell kube control what your token is and then you need to tell kube control How to refresh that token? You want short-lived tokens, especially if you're embedding identity data or authorization data into those tokens so I like to scope my tokens at a minute and What we have here is just a giant kube control command that gets generated for me to be able to Update my kube config so I can go ahead and start working with it and what kube control will do here is start Refreshing tokens as they expire. So the nice thing about this approach is we've separated out your authentication from your from your kube control access So we're authenticating via SAML, but we're still using open ID connect Can everybody see that? Okay, cool. So I'm just gonna go ahead set that up. So I am now Not able to get all because I'm de-user. So let's do de-user to sandbox No resources found. So let's go ahead and deploy something Run nginx image so and then De-user to sandbox Sats up and running if I do get all you can see we're off to the races now. I was also authorized for Matt Mosley So I'm gonna go ahead and do the same thing, but this time I'm gonna run it in Matt's project So now we're off to the races there as well. So Matt says, okay, you've you've done So, okay, cool. You figured out how I use this. I don't want you in my sandbox anymore So I'm gonna go ahead and log out now the other thing about This session is it's actually tied to my web session. So once I log out and That token expires in about 35 seconds I won't be able to refresh it even though technically the refresh token is still valid So I'm gonna log in as Matt and I'm going to go ahead and revoke Demo user choose access to my project because he doesn't need it anymore Denied so it's been pre approved. It's gone through the approval process in the workflow now me personally I actually really enjoy when I look at compliance reports seeing rejected Because that means people are actually paying attention So if I go to the audit report and I see my completed approvals Rejected demo user to here we go not need anymore. So now when I go and I log in Even before I do that just to show that there was nothing up my sleeve at this point that Tokens no longer good We're gonna get a whole lot of unauthorized because I can't get a refresh token anymore So if we look at my groups, you'll see that I don't have M. Mosley anymore And if I do a get all on the M. Mosley project, I'm still gonna get that same access denied But oh wait home tokens Need to generate a new token here So now you'll see it's forbidden because I don't have access But if I do the same thing on my own, I'm still able to access it So that's the demo I can present mode just enough time for some questions. So a couple of useful resources And this is up on the slide Entry on shed Podcat pod cuddle episode 15 a couple of weeks ago. My mom thinks that the presenter was really smart Talking about identity management in Kubernetes The actual authentication page on Kubernetes has a lot of detailed information Pictures on how that sequence actually works This is a really great link for a blog post on how the CAs in Kubernetes work If you know, you really want to understand how the different certificate authorities work and how that all fits in And then this is a link to the original Blog post that I wrote when I actually wrote this originally it was for open shift the folks at Red Hat put together a really nice compliance framework and everything that had to do with identity management was Go talk to someone else. So I wanted to provide a that's someone else a little bit of shameless self promotion You can catch us on the web We have here my Twitter handles. Please feel free to reach out to me. I love talking to folks Hear the links to github for the identity managers and specifically the fork that I did that has the U2f support and the compliance page Please feel free to to ask for things support what not really happy to help out and with that I went the wrong direction I think that's pretty much it so Two minutes left any questions Yes, so we're not actually that's a great question. So we're not actually adding users directly to roll bindings we created a group inside of our database and Then when we created the namespace we created the roll binding and added the group to the roll binding So we don't have to update the roll binding every time We only have to update our internal group. So it gives us a level of separation exactly So that way you don't actually have to go into Kubernetes every time that you want to authorize or unauthorize someone great question Any other questions? Awesome. Well, thanks for coming by


Good morning, Hank. It's Tuesday. So I have a new book coming out, which would be a great title for this video if I hadn't made an absurd and increasingly ridiculous commitment several months ago, but one must get the show on. So here we are. For the last two and a half years, I've been writing a podcast called The Anthropocene Reviewed, which is a little hard to describe. Like, the premise is that I review different facets of the human-centered planet on a five-star scale, like I might review the bacterium Staphylococcus aureus, or the concept of love at first sight, or the Taco Bell breakfast menu. But that's not actually what the podcast is about. It's about, like, hope and whether it is justified. And it's about how people can be so wonderful, but also so horrible, and how humans are at once forces of astonishing creation and gut-wrenching destruction, and it's about the contemporary human paradox of being at once far too powerful and not nearly powerful enough. Like, powerful enough to reshape the entire climate of the planet, but not powerful enough to reshape it in a way that's beneficial. I don't know, though. That makes it sound very serious, and I want the essays to be funny and also sometimes sad. I'm very bad at talking about my own work. I guess the reviews are my attempt to pay attention to what I pay attention to, to borrow a line from my friend Amy Krauss Rosenthal, and over the last year I've been expanding and revising some of the reviews from the podcast and also writing some new ones, and now the Anthropocene Reviewed is going to be a book. It's my first book of nonfiction, and I am very nervous and or excited. One symptom of 2020 for me is that I genuinely can't tell if it's an and or an or. But anyway, the Anthropocene Reviewed book will be published on May 18th, 2021, and it is available for pre-order now. Also, there will be an audiobook read by me. The response to the podcast in general, and especially to the most recent, quite personal episode, has been really overwhelming in the best possible way. I've never been as worried about sharing something as I was about that episode, and people have been so generous, so thank you. I hope you like the book. But wait, you ask, will you be signing the entire first printing of the book like you did with The Fault in Our Stars? As it happens, yes, I will be signing the entire first printing of the American and Canadian edition, which unfortunately means that if you live outside the US or Canada, even if you order an American English language edition, it will probably not be signed. I'm really sorry about that, but the systems of international printing and shipping just don't allow for that. But if you live in the US or Canada and you pre-order the book, it will be signed. I would like to say that I'm doing this as a gift for people who pre-order the book or whatever, but no, I'm doing it for myself. I would like to make a small repeated mark on a piece of paper over 100,000 times in a way that hopefully makes at least some people happy, and this opportunity has conveniently emerged. Somewhat related, look at my circles. I have so far drawn 17,000 circles in my attempt to understand the number 170,000. This is so many circles that it might freak out the YouTube compression algorithm, and yet it is only 10% of the circles I need to draw. Now, astute observers will note that I have somewhat less than 90% of the paper remaining to draw 90% of the circles. How will this problem resolve itself? I look forward to finding out. Also related, it has been really lovely to see the circles that many of you are drawing, some because you're trying to grieve a loss, some because you are trying to understand your own large numbers, and some because you, like me, also find relief in doodling. I'm really grateful to all of you who've shared circles on the Nerdfighter subreddit or Nerdfighter discords and so on. Hank, as I discussed on the most recent episode of the Anthropocene Reviewed, it has been a long and at times very challenging three years since my last book, Turtles All The Way Down, was published. But writing these essays has also been the most fun I've had writing since maybe ever. In fact, I'm going to go get back to it. I'll see you on Friday. Oh, wait, I should say that the Anthropocene Reviewed book comes out on May 18th, 2021, and is available for pre-order now. And then I say, I'll see you on Friday. I'll see you on Friday. You're a good brother. I never would have done this if it hadn't been for you. So thank you for encouraging me to do it. Thank you. Goodbye.