It is now time for oral questions. I recognize the leader of her match Speaker my first question this morning is for the premier You know for weeks the premier has been saying that all the decisions that he is making have been made on the advice of Experts that sit around his co vid 19 command table So my question is will the premier actually tell us today exactly who those experts are The deputy premier and minister help. Thank you We have been very clear about who's involved in the table from the very beginning Of course, it's dr. Williams our chief medical officer of health. We also have a doctor Hire who is helping with the outbreak management a dr. Yaffe who's also appeared and spoken in on many contexts as well as many other physicians But it's also important to note that as we developed our fall preparedness plan keeping Ontario safe We conducted consultations with over 45 groups including over 300 experts in all aspects of our health care system So our fall preparedness plan was not something that came from one or two people This was something that was done in conjunction with all aspects of our health care system Including the people that are on the public health measures table Well back to the premier speaker for months the premier has said and I quote You'll know What I know When I know that's exactly what he said you'll know what I know when it comes to co vid 19 Yet the government refuses to say which long-term care homes are at high risk Which workplaces have had outbreaks and which experts the premier is consulting Behind the scenes at his co vid 19 command table. So what possible reason? What possible reason could this premier have for not telling us The information that people deserve. Why is he keeping these things secret? There is nothing secret here. We have been straightforward and transparent with the people of Ontario with We have talked to we have brought forward the experts today There was a release of modeling information as the premier has always indicated when he knows it the people of Ontario will know it And that's what's exactly happening now that modeling information has been brought forward the chief medical officer of health comes to Almost every briefing that we have at one o'clock the there is a presentation I understand that you have asked for an update and that will be provided to you and to the other Leaders of the other parties this afternoon that information is going to be provided It's important that everyone know the decisions that are being made and why they are being made That's why it's so important to have this information come forward Responds here to answer any questions that you want to ask about it You can't pick and choose Transparency this is not the case. We have asked questions about who's at the command table. They refuse to answer We have asked questions about which long-term care homes are considered high-risk. They refuse to answer We have asked questions about outbreaks and in employment areas in in in workplaces. They refuse to answer So that's what we're asking for we're asking for transparency across the board Not just when this government picks and chooses to put out a tidbit of information He says he listens to experts the premier says that but now we're unprepared for a second wave because the Ford government Ignored experts for months for months in schools and long-term care We're literally writing the premier and saying we are not prepared for a second wave and now here We sit experts in public health in hospitals warning the premier that the hospital testing system was ready for a crash Yet the premier still insists that he has his own experts Why is he refusing to be transparent and tell people tell all of us who those experts are? First of all we have been open and transparent with this information We have brought the doctors forward to know that it is very important to the people of Ontario to hear not just from us as Politicians but from the doctors about what the situation is on the ground and those doctors have come forward Dr. Yaffe's come forward Dr. Williams has come forward dr. Allen dr. Brown dr. Higher and the list goes on those are the people that are at the public health measures table But we've also consulted more widely than that We've consulted with the Ontario hospital association. We've consulted with the Ontario medical association Who's just come forward with a report? Advising us of their recommendations with respect to COVID-19 and dealing with the second wave We are acting on those recommendations And I would also like to point out that the OMA stated in their report that the government should stay alert and adapt to evolving science and take an iterative approach to developing guidelines and Recommendations as new research evidence and data emerges and that is exactly what we are doing The next question once again the leader of the opposition so much speaker My next question is also for the Premier Yesterday three more families learned that their loved ones died in Ontario long-term care homes from COVID-19 In Ottawa's West End Villa and in Toronto's Fairview nursing home at least 46 homes now have COVID-19 outbreaks a number that has doubled in the last week Will the Premier accept any responsibility for his failure to put measures in place that could have actually saved these lives? Mr. Long-term care to reply Thank you speaker and thank you the member opposite for the question, you know I am deeply troubled when I see members of the opposition Laughing and smiling about this. This is a serious. This is a serious issue When I see people smiling and And laughter Order going to caution all members on their their language and Statements that they're making so as to ensure that we have a civil Question period for the next 53 minutes Start the clock minister long-term care Thank You speaker Our government puts the safety and well-being of residents and staff as a priority and all the measures that we've taken With public health with Ontario health with the public health units in the various locations These are measures that are ongoing with the command table We look at the number of outbreaks and I want to emphasize this point again That the vast majority of outbreaks we have right now have no resident cases response Our surveillance system is working. I take this issue very very Seriously and help that we all do Speaker seniors in long-term care needed protection months ago Back in February the Premier and the Treasury Board Refused to put extra money into long-term care that the department was asking for and again in June The sector was begging the government for more resources begging begging for more Support and the Premier said no Instead the Premier waited for the second wave to hit and scribbled some numbers on a page And he's still refusing to implement the recommendations of his own Expert panel for higher wages and a minimum standard of care for every resident in long-term care A new study confirms that the Premier's inaction in the spring actually led to needless deaths Why is the Premier constantly literally waiting until people are dying before taking action? Thank you, Speaker, I do take exception to the characterization of the efforts on from the Premier I look at his efforts with the PPE. I look at his efforts Ongoing this is his top priority There is no question in my mind and all resources are being used We continue to work to add more layers to do more Working with the evolving information that is coming from the science and understanding this spread and being vigilant and adaptable Our surveillance in the homes looking at this the type of spread as the evidence changes Working with our ethics table working with our public health table working with the science table I want to impart the appreciation that I have for our Premier Premier of Ontario who has done nothing but support me has done everything to support Residents and staff and you will be here hearing more this week about future efforts. Thank you If the Premier's top priority has been long-term care and this is how he has Behaved how he has treated the long-term care system and the people that live in it We are in big big trouble. The Premier said yesterday that the numbers speak for themselves He's absolutely right 46 homes are currently in outbreak Two more homes in Ottawa had to be taken over by hospitals because the for-profit Operators couldn't handle what was happening in the homes 1867 seniors have died my note said 1866 Although another person died just since this note was given to me this morning When the Premier says the numbers speak for themselves What numbers is he actually talking about because these numbers are horrifying and shameful and could have been Mr. Long-term care to reply Thank You speaker and thank you once again for the question of the 78,000 residents in long-term care One tenth of one percent are affected right now. We have 90 resident cases and that Needs to be understood that Perspective needs to be understood the majority of our homes that are considered in outbreak are considered in outbreak Because they have either a case of a resident or a staff and in the majority of our homes the vast majority There is not a single resident case. We will continue to add layers With this virus the fight of all our lives and I would appreciate if the opposition would understand and be part of The solutions we're going to need all the energy We have to muster to fight COVID-19 not only in our long-term care response But across Ontario and a collaborative effort when our energy needs to be at the best would be appreciated. Thank you The next question member for London West Thank You speaker. My question is to the Premier Speaker Londoners are doing their part to limit the spread of COVID-19 They're following public health guidelines They're lining up for hours to get tests for themselves or their children But now the government is capping how many tests can be done in London a leaked government memo states bluntly Do not proceed with any new growth or expansion of assessment centers Speaker just two days ago our local medical officer of health warned order and I quote We've had so many people that have been turned away or not even seeking testing because of the long lineups And that means that there are certainly many times more cases in the community than we're able to diagnose right now Unquote speaker. Why is this government capping testing in London instead of allowing assessment capacity to expand? Thank you speaker, and I thank the member opposite for the question first of all There is no one that needs a test that is going to be turned away There is no capping there is no quotas anyone who needs a test is going to be given a test But there has been a lot of information a misinformation I would say about this and I welcome the opportunity to provide some clarity Speaker with your indulgence I would like to quote from the actual memo that went out from Ontario Health yesterday and my supplementary I'd like to provide further information about it This is what it says and I quote anyone who needs to be tested per the guidance should get tested There are no caps or quotas on testing consistent with the new guidance Goes on to say to that and we are working with assessment centers on testing targets They're based on the historical utilization of tests in each region a testing target refers to how many tests a region should need Response on what we've historically observed in each region They also help us to determine the number of tests coming to us and from where Additionally, these tests go beyond anticipated need based on the ministry's new testing. Thank you very much Thank you speaker the memo also states do not proceed with any new growth or expansion of assessment centers at this time Speaker this minister gave exactly the same answer to the people of Ottawa when my colleague raised this issue in this chamber yesterday The government can pretend that it's COVID response is fine But its failure to plan for a second wave means that tests are being kept in both Southwestern, Ontario and Eastern, Ontario The Premier knew that his government had struggled to complete even to 20,000 tests a day in the spring He knew that demands for testing would increase in the fall as students return to school and post-secondary education He knew that a testing backlog has been growing leaving people who do get a test waiting days for their result Speaker why does this government think it's acceptable to cut off the line and cap the number of COVID tests available to the people who need them? Stop the clock Neither the member for Ottawa South nor the Minister of Municipal Affairs and Housing nor the Minister of Natural Resources and Forestry have the floor All of you have to come to order Start the clock the response Minister of Health. Thank you speaker just to complete what the Guidance note from Ontario Health said is Ontario Health will continue to monitor testing volumes daily and adjust as needed in order to align with And support the Ministry's guidance so the answer is the same because the strategy is the same we have Anticipated the need to enter to increase testing which we've done. We're up over 40,000 tests per day We're increasing our lab capacity and we're increasing our contact order We're putting a billion dollars into managing us And so what I need to say to the member into the people of Ontario is the reason why this memo was sent out is so That we can continue to support and increase the guidance and testing as necessary This is a very complicated system when you have volumes coming in from specimens all across the province from very different regions with Lab different labs doing the testing in some cases with the revised guidance Somewhere the test volumes are going down somewhere. They're going up So we're trying to match the guidance with the specimens going into the labs bearing in mind There is a three-day limit on the specimens So what we're trying to do is to make sure we can continue to increase the test. Thank you very much My questions for the Minister of Heritage Sport tourism and culture industries Today is Rowan's law day and Rowan's law has helped keep athletes safe and protected against the severe impact of Concussions which are much more dangerous speaker when they're neglected I can say as an athlete myself understanding the pressures It's not always easy as an athlete to take yourself out of the game Due to an injury particularly injuries others can't see like a concussion Would the minister please tell us what action our government's taking to change that culture in sport because this is a very real issue speaker Thank you Minister of Heritage Sport tourism and culture industries. Thank you very much speaker I'd really like to say thank you to the member from Durham for raising this important issue today on the third annual Rowan's law day And I think it speaks of all you've said as an athlete herself As she's committed to making sure that we have a safer entry and re-entry into sport for all Ontario young athletes Earlier today. I had the opportunity to be at Sick Kids Hospital here in Toronto To mark a new announcement that the government is embarking upon Obviously, it was quite emotional given that Rowan Stringer my former constituent died tragically at the age of 2017 from second impact syndrome at the Children's Hospital in eastern Ontario We were able to announce last week with with the committed member from Ottawa, West Nippian that we will be creating a national dialogue With the next federal provincial tour to territorial meeting of sports ministers in addition to that We had an exceptional panel last night with the former broadcaster and NHL response former NHL or an Olympian Eric Lindross and former CFL player Tim of a flieser and to talk about the impacts of concussion on young athletes. I'll have more to say in the supplemental but today. Thank you supplementary question And I want to thank Rowan for being for for sharing her story It's a story that's inspired so many Ontarians speaker and the message is this if you're injured Stop and sit out Minister as many members are aware our minister has Coached her daughter's hockey team and no doubt face situations where young athletes want to play through injuries Minister as not only a coach, but as a mother What advice can you share with young boys and girls that are playing sports in Ontario? minister of heritage Thanks very much. I Think the first message would be from Gordon and Kathleen Stringer who lost their daughter Her death was preventable and so therefore it's important that we do what take every precaution we can particularly with young minds I will say that our government is also committed to making sure that we support rural communities Which is why my colleague the associate minister of energy yesterday made an announcement on my behalf for $25,000 to rural communities for enhanced support over the years Our ministry has invested over $780,000 for concussion awareness and protocols But today's speaker was very memorable because we were able to announce a $200,000 investment into a documentary in the name of Rowan Stringer to showcase her life How it was preventable and what I ask all parents to do is just because you paid the entry P And I know it's expensive and you want your kid to play in that last tournament if they have a concussion It could be potentially fatal and it's just not worth it And if Gordon and Kathleen Stringer could have been able to respond I guarantee they would have The next question the member for Kiwet know question is to the premier Speaker communities across Kiwet have been in crisis before COVID-19 The pandemic only has only deepened these these crises in this kind of guy There has been 20 26 years of water boil advisories to be exact mr. Speaker 9373 days without access to clean drinking water in another community eight or five percent of the homes do not have running water and In the community of Obika There has been approximately 25 suicides over the last 30 years What resources? Have been provided By the government to these communities to help them with COVID-19 pandemic Thank You mr. Speaker, and I thank the honorable member for his question and his statement this morning mr. Speaker Just two years ago This government made it a priority to reset the relationships with indigenous communities to focus on things on the ground and in the community That could and would make a difference Some of that is born from the experiences that I had living and working in many of those communities over the course of my career And I appreciate the leadership of the premier and the support of our caucus and this government mr. Speaker and bringing some of those Defruitions others mr. Speaker was business that was unfinished from a previous government that it's simply not put priorities Where they mattered most and that was in the communities That's why we put a particular emphasis on major projects across northern Ontario the east-west high comes To mind the watte power project Fundamentally improve on fortunes and quality of life in those communities mr. Speaker We remain committed to improving the quality of life and investing in the indigenous youth across northern Ontario Mr. Speaker, thank you Thank you for the response again, I think simple basic human rights as Clean drinking water is very basic that we need Ontario in the western Since I've been here since I've been up north growing up. I know governments come and go programs come and go funding comes and goes and So that happens as Ontario enters the second More serious wave of COVID-19. What is this government's? Going to do to support these communities against the second wave Well, thank you mr. Speaker I have to say that during the first wave and Continuing today not only have we had thorough and consistent engagement With the chiefs of Ontario and their leadership council Every single week mr. Speaker I and many of my colleagues Ministerial colleagues have joined them. It's been much appreciated not all the conversations have been easy to the member opposite There have been some difficult intense moments But underpinning that was the confidence that this government was committed to making sure and supporting the incredible leadership that indigenous leaders have shown from Regional chief archibald to the grand chiefs especially and including Grand chief Alvin fiddler with the bigger challenges of protecting isolated communities and the chiefs of those communities I would say given the number of COVID Cases in those communities they and we have done a great job We will continue to remain engaged and make the priority investments to protect those communities He has the word of the premier in my word. Thank you very much Next question the member for land art fronten at Kingston. Thank you speaker the speaker our with my questions to the premier Our COVID policies and the risk that they pose Requires an honest and forthright discussion Dr. Yeadon a former chief scientist with the pharmaceutical giant Pfizer has stated and I quote Most if not all of the PCR tests result in false positives due to high CT thresholds Juliet Morrison a virologist at the University of California states and I quote any test with a cycle threshold above 35 is Too sensitive the public health agency of Canada reported in May of this year that testing over 25 cycles provides dubious results Oxford professor the prestigious Oxford Professor Dr. Carl Hennigan has stated a PCR test does not equal COVID-19 Speaker my question to the premier is our your testing creating both a false understanding of the risk as well as false positives Deputy premier and minister of health. Thank you speaker as the PCR testing is very effective in areas where there are outbreaks. It has proven to be so We are receiving that information. We need that information in order to take action We have taken action on several fronts in terms of limiting social unmonitored social gatherings limiting Capacities in restaurants and bars and in other actions that we've taken, but I'm not quite sure what the member is suggesting Are you suggesting we don't do any testing? We don't we just stop testing Is that the the reaction that we should be taking with this? What else would you suggest? Supplementary question back to the premier and I'm glad that question was posed on July 30th Deputy medical officer of health dr. Barbara Yaffe stated that quote our testing can result in over 50% false positives That is the person actually doesn't have COVID. They have something else or they have may have nothing She has also calls for limits on testing of asymptomatic people while the government calls for more another Contradiction in the long list of covert contradictions We know high false positive rates are due to high CTS and Canadian and world experts agree it should not be more than 25 cycles yet according to the Journal of Virology Ontario labs are testing samples at 38 to 45 cycles That's what needs to be done Speaker to the premier when did the premier become aware of these faulty tests and practices? And why have you done nothing to fix them since at least July? Mr. Health to reply we say to the member there are zero inconsistencies coming from our public health experts Why do you have me has clarified what she indicated before what she indicated before was that 25 testing is very Effective in areas where we are having outbreaks such as what we're seeing in various parts of the province right now in Peel in Ottawa and in Toronto. We need that testing to make those decisions The member for Lanark front in that Kingston will come to order We start the clock Minister can conclude her answer We are taking action where we need to take action We're looking at other methods of testing as well some of the antigen testing is looking very promising It looks as if health Canada is going to be approving that it's a good screening tool But we need every tool that we can use at our discretion PCR testing antigen testing We're looking at saliva testing We need everything that we can do for screening and for testing purposes to keep the people of Ontario safe Thank you speaker My question is to the Minister of Municipal Affairs and Housing Minister I know that this summer you joined the premier in finance and minister of finance to announce that our government has secured Two billion dollars in support from the federal government for our municipal partners The first round of funding from your ministry has played a critical role in relieving the financial pressures The COVID-19 has put on our communities. Could you provide more details on the historic safe restart agreement? Mr. Municipal Affairs and Housing Well, thanks. Thanks, and I I want to take this opportunity to thank the member for Perth Wellington Not just for the question, but for the great work that he does in his riding. He is so very close to his Municipalities and his partners. I want to thank him for that And as I've said in the house before the premier worked with our municipal partners other premieres our prime minister Deputy Prime Minister Freeland to reach the historic a four billion dollar safe restart agreement Which included two billion dollars for our municipal partners? Mr. Speaker one point to two billion dollars of that municipal support is coming directly from our Government and the funding as we all know is addressing those municipal operating needs But it's also creating those more longer-term Innovative housing solutions and also supporting our public health costs. Mr. Speaker 695 million dollars in Municipal operating funding has flowed through phase one of the agreement and there's an additional 695 million dollars that's ready to flow for that second phase. I know that Municipalities are keenly interested. They've been great partners and we want supplementary Thank you, Speaker. Thank you minister for your response I know that this funding has been greatly appreciated across Ontario and certainly in my riding of first Wellington Speaker our government knows that this first round of safe restart funding will be Will be sufficient to meet the needs of most of our municipalities But of course some communities have been hit extra hard and they will need access to the second round of funding Could the minister provide more clarity on how and when municipalities can access the next round of funding Thanks, thanks again, thanks to the member. He's absolutely right We know Collectively because we've all stayed in constant contact with our municipal partners that for many of them that first 695 million dollar allocation was sufficient to address some of those Operating challenges that they had but we we also know that many of those communities need more assistance And that's why phase two will provide that much needed 695 million dollars. It'll be able to be given and demonstrated Demonstrated and given to those municipalities that show that need eligible municipalities That will be applying for phase two funding will be informed of their additional Allocations in the very near future because we know that they certainly need that to deal with those municipal pressures Again speaker. We have been working with our municipal partners throughout the pandemic. I want to thank members Parties and all sides of the house to ensure that we support them. I am convinced Speaker that our municipal partners. They will be leading the recovery in our province Next question member for beaches east York, thank you speaker My question is for the premier and campments Some people are calling them Ford towns because they are the growing legacy of this premier's heartless policies Continue to expand in many neighborhoods in Toronto and across the province winter is coming And we are facing a humanitarian disaster cities can't cope on their own There's simply nowhere for people to go shelters respites and drop-ins are full The government needs to step up to create tens of thousands of units of rent geared to income Affordable housing it needs to create emergency shelters and hotel spaces immediately Accompanied by overdose prevention and harm reduction services and mental health supports as well as the necessities of life for people in encampments now Washing facilities food and water safe sources of heat and winter survival gear Covid has vastly exacerbated what was already a homelessness emergency When is the government going to act on this looming humanitarian disaster? Well speaker, thanks. Thanks very much for the question I've said many times in the house. We on this side of the house believe Every ontarian needs a safe and secure place to call home I want to say to the member opposite through you speaker that our government has Acted we've acted Both in the budget this year while we providing almost a billion dollars To help sustain repair and grow our community housing system That was largely neglected by the the previous government in addition to that speaker as part of our Announcements with the minister Smith and I we've now have provided to our municipal partners over 510 million dollars As part of that agreement to help our most vulnerable we continue to work Collaboratively with our federal government bonds. I'll have more to say in the supplementary speaker the supplementary question To make matters worse housing experts are terrified of the eviction crisis They see on the horizon They're expecting the numbers of people without housing to swell in the coming months by thousands or even tens of thousands Most people who experience homelessness are black or indigenous I am currently fighting to keep an indigenous woman housed in beaches, East York the same communities Most impacted by COVID-19 are also the most likely to be pushed into homelessness It is vital that Ontario both reinstate the residential moratorium on evictions throughout the pandemic and Assist tenants directly with their rent payments so that they are not vulnerable to evictions down the road today On orange shirt day of all days. We need to hear will the premier allow Evictions and Ford towns to continue to grow exponentially or will he act now to keep people housed I want to remind the member that our province was the first province or territory in Canada to sign on to the Canada Ontario housing benefit because we realize that those that are most vulnerable Especially during the pandemic we need to ensure that we have dollars set aside Collaboratively to work with all three levels of government I want the member to know and I want all members to know that as part of the safe restart agreement We are encouraging Every single service provider in our province to bolster the rent backs to ensure that there is more money That's been allocated through our social service relief fund and through the safe restart agreement to ensure that as The the nights are getting colder that those funds are provided directly to those that most need it We will continue to work response members Community here in the city of Toronto and all of our service managers to ensure that that those dollars that are allocated get to people Who thank you the next question the member for Glenn Gary press Scott Russell. Thank you, mr. Speaker Mr. Speaker my question is to the Minister of Education a very serious and alarming issue has come to my attention with specific cases being confirmed to me the ministry's current directive is that only local public health units can order a Classroom into isolation and can notify parents when there's a confirmed case of COVID in the classroom due to the local units being completely overbooked Overburdened and struggling to keep up as it is it can take days for this to happen So during those in between days children are going back into the classroom as usual Parents are unknowingly sending their children into a classroom that has had confirmed exposure to COVID-19 Mr. Speaker is the minister aware of this disturbing situation How can the minister justify putting the lives of children and families at risk with such a poorly thought-out and dangerous directive? Minister of Education Well, thank you speaker the public health guidance is clear We want students all students and all staff to self-assess before the enter schools We provided a self-assessment tool for students launched with the minute with the president the Treasury Board to make it more Accessible and easier for parents to understand the symptoms. We've also increased public health nurses to support Both screening in schools and likewise symptom relief for those children that have ailment we've enhanced the amount of Flu vaccines being provided to more young people 700,000 more have been ordered 70 million dollars a historic investment by the province Everything we're doing is to minimize risk and I would continue to encourage parents to work with and listen to public health And their communities to ensure that those classrooms and those communities are safe Thank You mr. Speaker respectfully to the minister that doesn't address the issue The issue is the directive that it is only the public the public health units that can order the Isolation when there's a confirmed case So it's the gap between that the teachers and the children are going back into the classroom for several days after they know That they've been exposed So there's the problem. What is the minister going to do about that directive? Mr Speaker students are encouraged to isolate if there is any symptoms public health will provide direction as per the outbreak Protocol in some circumstances public health required them to stay home for 14 days The school board will pivot to online learning as has been the case in each of the examples where we've seen outbreaks affecting a cohort or a school in the context of the protocol Dr. Yaffe dr. Williams and the entire COVID-19 command table are constantly refining the protocol I spoke with the doctor doctor directors in Ottawa as well as the director and the Chair of the board in Ottawa region where the member represents we are constantly looking for ways to improve the data flow As well as to improve the directive and it's going to be done by our public health officials by doctors not politicians will continue to take their advice implemented province-wide Thank You mr. Speaker my question is for the parliamentary assistant to the minister of finance Last week I was proud to join the minister of finance the member for Willow Dale and my colleagues from Ottawa caucus on a virtual budget Consultation with individuals from Ottawa's resilient business community This town hall was an important opportunity for our government to hear directly from the people of Ottawa during these challenging times I know this consultation will play a critical role in helping to ensure the challenges faced by Ottawa residents Are addressed by our government as we continue to respond to the COVID-19 pandemic and plan for an uncertain future Mr. Speaker this town hall provided an opportunity to hear about the important role Ontario has played in Supporting people and businesses during this crisis could the parliamentary assistant Please share with the house the actions our government has taken to support Ontario's small business community during the COVID-19 pandemic Thank you very much mr. Speaker and I want to thank the member from the great riding of Ottawa, West Napaean He's been an important voice and an incredible champion for the constituents in the Ottawa region Speaker the member is correct hearing directly from businesses and community Organizations like those in Ottawa is crucial to help inform Ontario's economic recovery recovery plan and get the stories behind The numbers mr. Speaker our government has taken the necessary action to protect the health and well-being of the people of Ontario during this crisis Because this is not just the right public policy mr. Speaker It's the right economic policy in March the Minister of Finance introduced Ontario's action plan the first phase of Ontario's response to the COVID-19 pandemic and in the time since we've made additional investments in the fight against the virus by allocating more support for people Jobs and a safe reopening and response to a second wave these investments bring our COVID response action plans were projected 30 billion dollars up from the 17 billion dollars as first announced more to be done. Mr. Thank you very much Well, thank you for that answer It is heartwarming to know that our government is taking the economic recovery of Ontario so seriously Mr. Speaker, it's clear to me that this government is committed to listening as we continue building our recovery plan I am proud to be part of a government that is committed to consultation and Collaboration as vice chair on the standing committee of finance and economic affairs I have seen firsthand the value of broad and robust consultations in assessing the impact of COVID-19 Could the parliamentary assistant? Please share with the house the actions This government has taken to listen to the concerns of Ontarians as we plan for an economic recovery Parliamentary assistant to reply. Thank you very much. Mr. Speaker and again, the member is absolutely right Our government understands the value of that broad consultation from hearing firsthand from those on the front lines And that's why we're asking Ontarians to tell us what they want to see in the fall 2020 Ontario budget Since this pandemic began, Mr. Speaker, our government has engaged with an unprecedented level of consultation with the people of Ontario And that includes businesses, labour groups, nonprofits, associations and many others We are listening because we are here to help earlier this year our government established the Ontario jobs and recovery cabinet committee And every minister in that committee established ministerial advisory councils to hear directly from key stakeholders and experts across the province on a variety of sectors We also had MPPs from both sides of this house consult from across the province with local leaders and constituents And I too, Mr. Speaker have been proud to work side by side with the member from Ottawa West and the PN on the standing committee of finance and economic affairs And there's a committee which has met with over 195 hours, Mr. Speaker, and listened to 522 witnesses This is all part of- Thank you very much The next question to the member for Algoma Manitulli Thank you, Speaker. My question is to the Premier The ongoing COVID-19 pandemic has proved that fast, reliable and affordable internet is an essential service Christopher Malte, a constituent of mine, has two kids In their community of Goulay River, unlimited internet is not available Which left the Malte family with very few options at the height of this pandemic Either pay hundreds of dollars extra for more internet or send their kids to the school yard to access wifi and do their online classes Even though the school is closed, obviously they chose a second option If schools have to shut down again in the middle of winter, does the Premier expect the kids to still go out to access wifi And does he expect the parents to pay hundreds of dollars extra to have a few more gigabytes of internet? The Minister of Infrastructure Well, thank you, Mr. Speaker, and thank you very much for the question I know the member opposite and I have talked many times about broadband and the need to expand that as fast as we can And that is why our government started last year before the pandemic With an investment of $315 million in order to leverage up to $1 billion in investment in broadband in this province of Ontario And Mr. Speaker, I know that I work with the Minister of Education closely as well as many ministries now On expanding those programs faster and sooner I know it's going to be in our secondary schools this fall that they'll all have access to broadband Mr. Speaker, I talk about this topic every day and I ask the federal government to come to the table to help us expand faster And to more areas of the province of Ontario This is critical in the times we live in and we are doing as much as we can and there's more to come, Mr. Speaker Mr. Speaker, you know to the Premier again People can't log into announcements because those dollars are not coming down to the communities My colleagues and I have raised the lack of access to broadband with the previous Liberal government to no avail We have raised the issue to this Conservative government continuously since the election again to no avail We know the Ontario government needs to invest a billion dollars over the next 10 years to develop broadband infrastructure Why won't this government work with the federal government and telecommunication companies to bring essential services to all Ontarians The member from Timissum in Cochrane quoted the Premier's words last week I'm on this like a dog on a bone Speaker, my question is to the Premier again Why is this Premier chasing his tail on the broadband file? Well, Mr. Speaker, the member is correct that the Premier has said that there's no more important infrastructure we can do to change people's lives in the province of Ontario Than to build the broadband and that is exactly what we are doing We are asking the federal government to come to the table because they do regulate the telecommunications company I spend large parts of my day talking to everyone, even people like yourselves that live in my riding that can't access internet And we continue to work with the Ministry of Energy, Northern Development and Mines and Indigenous Affairs to get the Northern Ontario Heritage Fund Corporation They've invested in several projects in Northern Ontario, including Indigenous communities Some of the projects are in Northeastern Superior Regional Broadband Network A satellite bandwidth expansion project for remote First Nation communities It lands down Fort Hope and Martin Falls, Mr. Speaker Metawa with a $30 million project that the Minister of Energy, Northern Development and Mines and the Premier and I were at last year to connect Northern communities Thank you very much The next question, the member for Burlington Thank you, Speaker. My question is to the Minister of Transportation In recent weeks we've heard disturbing instances of street racing and stunt driving I understand that many fines were issued in Wasega over the weekend and in Hamilton earlier this month Mr. Speaker, dangerous driving is always a cause for concern Motorists should know that under the Highway Traffic Act, stiff penalties are in place for those who choose to engage in dangerous driving behaviors Speaker, could the Minister please tell us what these penalties look like Great question Mr. Transportation Thank you, Speaker, and I'd like to thank the member from Burlington for the question Mr. Speaker, I was extremely disappointed to hear of recent stunt driving events Especially those that have garnered crowds despite the advice from public health officials This is reckless and irresponsible I want to remind Ontarians that under the Highway Traffic Act, we have some of the toughest penalties in North America when it comes to speeding and aggressive driving Drivers who are caught traveling 50 km an hour or more above the posted speed limit or engage in other high-risk behaviors Are liable to receive an immediate 7-day suspension and 7-day vehicle impoundment at roadside Drivers also face a series of other severe post-conviction penalties including a fine up to $10,000 A licensed suspension of up to two years for the first conviction Six demerit points and a jail term of up to six months Response Mr. Speaker, the Ministry of Transportation reviews its policies on a regular basis And if changes are necessary, we will make them Welcome And the supplementary question Thank you, Speaker, and through you to thank the Minister of Transportation I want to reiterate that events like that we saw in Wasega over the weekend are deeply concerning Not only are stunt driving events a danger to all those on the road and in the community They are a danger to our community in light of the COVID-19 pandemic Public health experts have indicated that these types of irresponsible gatherings are a danger to public safety Through increased risk of COVID-19 transmission That's why it's important to ensure that those who blatantly disregard the rules And put the health and safety of Ontarians at risk are held accountable Can the Solicitor General explain what actions our government is taking To crack down on these types of irresponsible and dangerous events Great question Thank you, Speaker And through you I want to thank the member of Burlington for that question And before I begin, I want to thank our dedicated members of the Ontario Provincial Police For putting a stop to the dangerous events that took place inside of each They are working on the front lines of community safety Addressing the changing nature of criminal behaviour that has become of COVID-19 As a result of COVID-19 while putting themselves in increased risk of exposure Speaker, protecting the health and safety of Ontarians with regard to the threat of COVID-19 Is our government's number one priority And that's why we took decisive action in response to these larger private gatherings That are taking place that break the gathering limits Which have been put in place to protect us and stop the spread of this deadly virus We have provided law enforcement with the additional tools needed to shut down these premises That are hosting these types of events And we're establishing new minimum sentencing Minimum fine, sorry, of $10,000 The highest in Canada for those individuals who organise those events Thank you, Speaker My question is to the Premier Speaker, Ontario is in the midst of two public health emergencies The number of deaths from overdose is 35 to 40% higher than we've seen since the pandemic started Compared to last year's numbers, according to the Chief Coroner In July, the City of Toronto reached a record high number of overdose-related deaths 27 people died The pandemic has made it harder to access help Addiction is a health issue and we need to treat it as such We don't need an ideological government to pick and choose which lives are worth saving Why has the Premier and his government refused to increase resources to save lives? Thank you, Speaker And thank you to the member opposite for the question You're absolutely right There are many Ontarians who during this COVID crisis are being faced with significant mental health as well as addiction challenges We did open our consumption treatment services sites Several years ago now They're still continuing to do their work But we recognize that there's more mental health supports that we need to provide as well There's a number of people experiencing anxiety, depression, and other issues that are leading in some cases to addiction issues as well But that's one of the reasons why we've supplied over $27.75 million for the mental health and addiction system To expand more online and virtual assistance to people in situations where they weren't able to access Their appointments in person with their advisers both with respect to addiction as well as with mental health So we know that we need there's more that we need to do and I will certainly speak to that in my supplemental But thank you Supplementary question Back to the Premier Speaker, we've heard all of this before What the minister has failed to mention is that the government closed overdose prevention sites We only have 16 supervised consumption treatment sites for the entire province And they've abandoned the provincial emergency task force The federal government had to step in to act but it's not enough More people are dying than ever before Speaker, I am angry for the families who have lost loved ones We are sitting here debating but these are real people They deserve care The government is speaking about supports that weren't adequate before the pandemic And now we need it much more Will the minister admit that the government in action is costing lives? We certainly recognize that more needs to be done And with respect to the consumption and treatment services sites Municipalities can still apply to have a site located in their areas We're still considering applications That is still open Municipalities are still able to apply for that So we are ready to expand consumption and treatment services sites But with respect to mental health and addictions generally Just before we were struck with COVID We released our mental health and addictions comprehensive plan A roadmap to wellness, a plan to build Ontario's mental health and addiction system That is something we're still continuing to build It's as relevant now as it was when we launched it We know there's more work that needs to be done and advancement of more services We are dealing with that as we speak because we know that people need that help Because alongside the COVID crisis We know there is a significant increase in mental health and addiction needs It's not something we're going to wait until later to deal with We need to deal with those issues now Because mental health is equally as it is Thank you very much Next question for Ottawa West-Nepid Thank you Mr. President Thank you Mr. Speaker This question is for the Minister of Education Last Friday we celebrate the Day of Franco-Ontarian I am proud that our government That our government supported Franco-Ontarians Including those who are leaving in my writing This week I was very happy to see that our government Took measures to recruit and maintain More teachers who are qualified to teach in French Can the Minister tell us more about those measures And how it will improve our education system Thank you Mr. Speaker And thank you to my colleague for his hard work I'm very happy to see that our government took measures To respond to all the problems related to our education system And to try to improve the education And all the problems that the teachers are facing When they have to teach in French And we're trying to train more teachers in teaching French We're also trying to make sure that we hire more teachers We're able to teach in French Thank you Mr. Speaker And thank you to the parliamentary assistant For his answer Students in Ontario Deserve the tools to learn in French And teachers in French as a second language Are essential in order to support francophone culture I know that the parliamentary assistant And the minister of education have recruited many partners And consulted with them in order to find solutions With the lack of teachers Francophone teachers Can the parliamentary assistant give us more information on this plan Thank you Mr. Speaker Thank you once again to the member of Ottawa West Nippian For this important question We met with many representatives of francophone institutions Such as school boards Associations And all those that are working to improve the francophone education system We'd like to thank them for their efforts We've created a partnership with the Laurentian University To provide training for francophone teachers And we're also working with the York University To promote outreach programs And to promote francophone teaching as a potential career We continue our collaboration with different associations and groups To ensure that all students can have access to quality French education Thank you Speaker This week I heard from Loretta Gibbons Whose brother Gerald and his wife Lucy live at a supportive living home In Niagara named Lakeside Terrace Lakeside Terrace like other supportive living accommodations across Ontario Is a completely unregulated group home That more often than not has horrific conditions Gerald and his wife have major health issues including dementia And are pensioners on a fixed income Loretta sent me a desperate email along with pictures Of unlivable conditions She said there have been bed bugs for at least a year And the food served to residents has rotten Because the homes are unregulated The non-enforcement is unable to do anything When they complained the owner said feel free to move out Why is this government allowing Ontario citizens like Gerald and Lucy To live in unregulated substandard conditions Thank you very much Mr Speaker And thank you to the member opposite for this important question This is an issue that I take personally as well As an important issue because my brother lives in a congregate care setting And I know that our government is committed to ensuring That those in our congregate care settings are provided The protection and services they need Our government took immediate action to protect our provinces Most vulnerable and the frontline staff who care for them In residential settings Through the COVID-19 action plan for vulnerable people We implemented measures that will help to stop COVID-19 at the door of these facilities Through measures like enhanced screening and use of PPE And manage outbreaks when they do happen Which included enhanced testing and contact tracing This plan builds on our previous investments Including up to 40 million dollars to support organizations That provide residential services Like our developmental services agencies And I look forward to providing more information in the supplementaries And treat them Thank you Mr Speaker The real problem is that these homes are unregulated That's the issue I proposed a private members bill 164 That will protect residents from these abusive conditions Members of the Premier's own cabinet supported this bill In 2017 including the solicitor general Many people who have complex needs But who don't qualify for and can't get into long-term care End up in these supportive living homes We offer housing with supportive services And amenities typically provided in full service retirement care Owners have free reign to take advantage of vulnerable seniors Who have no other options and frequently no one to advocate for them We have seen fires, injuries and several deaths As a result of no regulation Will the Premier commit to regulating these homes And ask his members to pass my bill 164 Protecting vulnerable persons in supportive living And the parliamentary system once again Thank you Mr Speaker And thank you for the supplementary question And for the member opposite's interest in this important file The COVID-19 Residential Relief Fund That our government introduced covered eligible costs Such as additional staffing, residential respite For caregivers and personal protective equipment And supplies We have also as a government made several Very important emergency orders Including providing flexibility so staffing and resources Can be redirected to essential tasks Requiring that staff work for a single employer Within that sector And limiting staff to working at a single site In an outbreak to prevent the spread of COVID-19 As the situation continues to evolve Our government remains committed to protecting Our most vulnerable citizens And I thank the member opposite for that question Thank you And I conclude the question period for this morning


Some friends today will see frequency for maximum voltage across inductor. So, generally there are three different stages of variation of frequency at which voltage is maximum across inductor across resistor across capacitor yes. So, when frequency is at resonant frequency voltage is maximum across resistance or resistor because magnitude of voltage across inductor and capacitor is same at resonance. So, both cancels each other both are same in magnitude and opposite in phase. So, both cancels each other and the whole voltage will appear across resistor. So, voltage is maximum across resistor in case of resonance. Now, the question is what is the frequency what is the value of frequency at which voltage is maximum across inductor that we are going to find out ok. Learning outcome students will be able to demonstrate how to find frequency at which voltage across inductor is maximum in case of series resonance. And before starting with the derivation you should recall equations for voltages, equation for current, equations for impedance, magnitude of impedance, variation of frequency with respect to impedances or what is the effect of variation of frequency on impedances all those things. Now, we will start with the derivation yes. So, we will start with the frequency for maximum voltage across inductor. So, we have to write down the equation for voltage across inductor or equation for voltage V L. It is represented by I into X L yes, X L can be also represented by omega into L reactance is equal to omega L and in case of resonance current is represented by V by Z because there is resistor as well as reactive part. So, it is represented by impedance. So, here Z represents the magnitude of impedance therefore, V L is equal to V into omega into L upon R square plus omega L minus 1 upon omega C bracket square is it. Now, V square on both sides. So, we will get V L square is equal to V square omega square L square upon R square plus omega L minus 1 upon omega C bracket square. We will further simplify this as V L square is equal to V square omega square L square upon R square plus. Now, we cross multiply this, it will be omega square L square C square minus 1 bracket square upon omega square C square. Now, V L square is equal to V square omega square L square. Now, again we cross multiply this, it becomes omega square R square C square plus omega square L C minus 1 bracket square. It is not L square C square sorry it is L C this term divided by omega square C square. Now, this term we will go to the numerator. So, V L square is equal to V square omega raise to 4 L square C square upon omega square R square C square plus omega square L C minus 1 bracket square. Yes. Now, what we have to do is we have to differentiate V L square with respect to omega to maximize the voltage and equate the numerator term to the 0. So, again it is in the form u by v.  Differentiating V L square with respect to omega and equating numerator term to 0 d V L square by d omega equal to 0. I will directly write down the term after simplification the terms are like this 2 into omega square L C minus 1 sorry 2 in bracket omega square L C minus 1 minus omega square R square C square equal to 0. So, this becomes 2 omega square L C minus 2 minus omega square R square C square equal to 0. If we take this 2 to the RHS it becomes 2 omega square L C minus omega square R square C square is equal to 2. Now, from this I will take the term omega square common. So, it become 2 L C minus R square C square is equal to 2. Now, I take this term to the RHS it becomes omega square is equal to 2 upon 2 L C minus R square C square. Now, what we do is we divide numerator and denominator by 2. Now, it becomes omega square is equal to 1 upon L C minus R square C square divided by 2. After dividing numerator and denominator by 2 we will get term like this square root on both sides. Now, take square root on both sides it becomes omega is equal to 1 upon under root L C minus R square C square upon 2. Yes, and if you put omega is equal to 2 pi f here then f L becomes 1 upon 2 pi under root L C minus R square C square upon 2. f L is equal to 1 upon 2 pi under root L C minus R square C square upon 2. Now, if you take L C term outside or from that bracket f L is equal to 1 upon 2 pi under root L C under root 1 minus R square C upon 2 L. And 1 upon 2 pi under root L C is resonant frequency and upon 2 pi under root L C is equal to f 0 resonant frequency. Therefore, f L is equal to f 0 upon 1 minus R square C upon 2 L. So, this is the formula for frequency at which voltage across inductor is maximum. So, either you can use this formula or you can use this just what I have done is I have taken term L C common and instead of 1 upon 2 pi under root L C I have used term f 0 that is resonant frequency. So, this is all related to the frequency at which voltage is maximum across inductor. So, while preparing this video lecture I have used circuit theory and analysis by H. Chakraborty Zanpatraya publication. Thank you.


Okay, let's get started. Welcome everyone. Thank you very much for taking time out of your day to join us today. Welcome to today's CNCF webinar, the ABCs of Kubernetes security. I'm Jerry Fallon and I will be moderating today's webinar. We would like to welcome our presenters today, Roger Klurs, senior product manager at Seuss and Danny Sawyer, senior software engineer at Seuss. A few housekeeping items before we get started. During the webinar, you were not able to talk as an attendee. There is a Q&A box at the bottom of your screen, so please feel free to drop your questions in there and we'll get to as many as we can at the end. This is an official webinar of the CNCF and as such a subject of the CNCF Code of Conduct. Please do not add anything to the chat or questions that are in violation of the Code of Conduct. Please be respectful of your fellow participants and presenters. Please also note that the recording and slides will be posted later today to the CNCF webinar page at cncf.io slash webinars. With that, I'll hand it over to our presenters for today's webinar. Okay, thanks very much. Oops, there we go. Going over a little bit again, my name is Roger Klurys. I'm a product manager at SUSE, working on SUSE CAS platform, our containers as a service product or better known as our Kubernetes distribution. I work with engineering and other constituencies to define the features and the roadmap for the product. And let me introduce Danny Sauer or give Danny a chance to introduce himself. I didn't have a great introduction that I'm Danny Sauer. I'm a software engineer working on the CAS platform with Roger. Okay, cool. Let's take a look at high level agenda. We'll start by talking about how secure we feel about containers. Security is objectively measured, but it's also a subjective sense. And we'll look at how the subjectivity affects containers and their deployment. We'll look at how you can address container security in many different areas. We'll look at an idea that's closely related to security, which is governance. That is, how do you implement security policies? Not technically, but what organizational stances do you take? And if I'm gonna go into the area of securing Kubernetes environments, where do I start? I wanna say upfront that a little bit of level setting. You notice we call this ABCs. This is a fairly fundamental view. There are some more expert and more specific webinars that security specific vendors have done. If you're working already in security, this might just be a pleasant set of reminders or a basis for discussion. But we are assuming that you have a basic understanding or a little more than that of Linux and some Linux security features of containers and of Kubernetes. So it's not Linux 101, it's not Kubernetes 101, but it is kind of a 101 level discussion about security in containers and Kubernetes. So let's jump into it. How secure do we feel about containers? Well, I'm gonna ask you a question. True or false, containers are inherently secure. Inherently, sorry, inherently insecure. Well, as with almost any true or false question, the right answer is it depends. This is why I might not have done so great on a lot of true and false tests when I was good. There are ways in which containers are indeed inherently insecure. One of them is the fundamental assumption that everything is inherently insecure unless you work at it. Another is that there are aspects of Kubernetes like networking, for example, that were originally designed assuming friendly environments. So right out of the box, basic Kubernetes networking assumes that everybody can talk to everybody. But it's true also that aspects of Kubernetes and the Kubernetes ecosystem are being designed and have been designed with an eye of security from the ground up. So containers are inherently insecure, true. Containers are inherently secure, also true. Let's move ahead and look at how this affects how people feel about it. Now, one of the most interesting things I think about this chart is that something like 18 years ago, I presented a chart that could have looked with some of the labels changed exactly like this and a certain virtualization vendor when we were launching the first major server virtualization platform where the top three concerns were indeed cultural changes, security and complexity. These tend to be true for any new technology but you'll still note that security is a pretty high level concern for this audience. If 40% are concerned about security, security is an important component of their plan and their delivery and maybe holding people back from their implementation. Let's look at a few more things. Well, when we look at where people are deploying today, the number one leading category is in the public cloud. Well, we would similarly have a chart like that about public cloud probably four to eight years ago. So, the same concerns carry over to the platform. A significant number are fully on premise and a solid contingent are deploying in hybrid cloud, meaning in both of those in coordinated fashions. And then there's a small number who report other who are probably looking at custom managed services and environments like that. So, container use over the past five years has been relatively stable in development and tasks.  In proofs of concept, many people have already done their proofs of concept. So, that's maybe dropping a little bit, but the ramp in production is the most significant factor where we look at people now who are solidly moving into production environments reporting on this CNCF survey where four and a half years ago, only about a quarter of them were in any sort of production on containers. ESG did a survey about three years ago that many of the learnings are still valid. Almost, luckily, almost every company that they interviewed realized that containers had security implications. About a third were worried about the lack of mature security solutions. As with most new technologies, securing them generally starts out with new vendors and there are some excellent container-specific security vendors. I want to point out if I mentioned any of them by name later, it is neither a specific endorsement of them nor a lack of endorsement of any of the other people in that space.  These two go together. Notice that the same number of people were worried about the lack of mature solutions and the fact that the current solutions that they had don't support containers. So this sort of security split brain was a worry for them. A quarter or more realized that a vulnerable container is an easy attack surface and a smaller number realized that portability comes with a price and that is that containers could possibly be more vulnerable to in-motion attacks. So what do we do about these concerns? Let's take a walk through a list. We're going to take a look at some security requirements now and drill down a little bit into each one. One of them is to start with a secure container image, a secure base image. We're going to look at applying access control to the platform and the containers, scanning for security, both at runtime and at rest, looking at adding network security to the environment, as well as visibility into the network and the general environment. We talked about data in motion issues. We'll look at encryption there. We'll talk about secrets management so that we don't expose passwords and other security information. We'll look at restricting access using policies as well as how the underlying operating system tools relate to the containers themselves. And then we'll look at monitoring the security posture using classical tools. So let's get started with those. The first is looking at the secure gold image and Danny, you want to jump into this one? Yeah, thanks, Roger. Containers like everything in computing are built in a series of layers. Whether you're using a stripped down OS as the base for your containers or a purpose built base like the Python image or something like that, you want to start with a solid foundation. So one of the first steps in ensuring you have secure containers is ensuring you're building upon a secure base. So you want to have a gold master image that you install your code on top of so that you're not starting with any holes. In that build process, you really want to use, you want to be reproducible.  So when your bugs are found and patched, when they're rebuilt, everything happens the same way every time. And if you're using a commercial Linux distribution, by the way, pretty much all vendors who offer support also offer a base image, which is a solid starting point that is under the rich end-to-end controls that other delivery formats such as ISO images are in. So if your OS offers it a base image from the vendor is really a good place to start. You can add things and remove things and secure your own base, but that's a great place to start. We can bring role-based access control into the environment. First to the platform itself and then to the containers. For any application, the best approach to securing the application through access is to create a service account that the application uses that has only the permissions that it needs. So you're not only controlling the access of the users to the system, but also of the application to the system environments. And through this approach, you can guarantee that different applications that may require different access to capabilities can't do more than they need. The next step, which is inherently less secure because it really assumes a greater set of things is to take the default service account for a namespace and give it administrative control. That of course gives it access across everything in the namespace and it would be useful on an application basis to use things that are potentially more restrictive. Less secure than that is to have a service account for the application but give it full admin access, give it all rights to that namespace. And of course the worst possible thing you can do is not to use role-based access control at all or to grant CUBE system, the default system wide admin account, giving it all permissions on all workloads. So strive for the most secure approach and that is one of the things that security benchmarks and benchmark suites, I'll get to the difference between those in a little bit, provide for you and we'll examine for how this is implemented and report to you on to what extent you're sticking to best practices. Danny? So you've got your solid base image and now you've added code on top of that. So you've changed things. You need to have some sort of automation that verifies the code changes that have been made still comply with your local policies. You do that by scanning the generated images. There are a number of tools that do that. Aqua Security Triddy is one of them. They just have just a checklist that gets run through run against the container before you do your deployments. Ideally that gets integrated into your CI CD pipeline. People make mistakes, even with the best intentions. So taking people out of the equation generally results in a better, a more predictable results. In addition to running at deployment time, you really want scheduled scans, vulnerabilities are found all the time. Even if you haven't changed your container or your code that's on the container, new stuff pops up. So using scheduled scans on old containers, make sure that you're alerted of new vulnerabilities in old containers. There are also runtime scanners out there. Falco is one example. They do essentially the same thing, but they run while your container is running.  Great, well, I said early on that Kubernetes networking originally by design was flat and open to everybody so that everything could talk to everything. We've grown well beyond that. And especially in multi-tenant environments, but also others, being able to segment networks so that only things that need to talk to each other can talk to each other. And then controlling which of them can talk to each other not just by segmenting, but by more fine-grained control of access within segments is something that has come along more recently in the Kubernetes networking space. You find CNI plug-ins. So CNI is the container network interface that implements the ability to have different implementations of networking in different clusters or with some extensions conceivably in the same cluster at the same time. Calico is a very popular one. Silium is a more recent one that leverages a kernel feature called EBPF or packet filtering to optimize the performance and improve the introspection by running in the kernel. These, you use these to control ingress and egress to the clusters, which typically involves an ingress controller. Obviously. But also to control access between namespaces. If you have a distribution that doesn't support network policies, you may wanna consider introducing third-party options such as container firewalls to introduce policy into the flat network as well or use them as an extra layer of defense in-depth and there are products and technologies out there that implement container firewalls as well as network policies not only at the more traditional levels of L2, L3, L4 but also introduce protocol and application-specific policies at L7. Silium and Calico, for example, do this and container application firewalls do this as well so that you can say, for example, instead of I wanna set a policy on who can talk to on what I can do, for example, on port 80 or port 443, I could set a policy on HTTP and then whatever port was speaking HTTP, the system would recognize the protocol and implement that policy on it, especially with cases where we use non-standard ports for anything from administrative interfaces to specific application-specific protocols being able to have protocol-specific policies is a very effective approach. Danny. Sure, you need to have visibility into what's happening within your cluster. A lot of the controls we're talking about are static, you're analyzing things to ensure are things happening the way we expect them to be happening without any kind of observability, you don't have any way to, one, know what's expected and to know when things are happening that are unexpected. So you have to expose really as much as you can about what's going on within your cluster.  So with your applications, you wanna export metrics wherever you can. Prometheus is sort of the de facto place where all those metrics get gathered so you can do your later analysis and see what's normal. At the network level, CNIs typically provide flow analysis. So rather than just your basic packet level analysis, network flows are another level higher where you see where the packet went, what the whole communication looks like, which is usually a little more useful with determining what's going on with an application. You can look at volume of traffic, the size of packets, they're generally going so you can see when things have deviated and you might need to be concerned. Service meshes that are another layer above that where network flows are your layer three level four stuff, service meshes are operating up at layer seven. So you can see what's happening with your, your HTTP traffic, your database queries. The whole point here is to be able to know what sort of communication is happening inside a cluster so you can identify when anomalous communication is happening, more data is generally better here. I just want to add, for example, Cillium offers a tool called Hubbell, which is its flow analysis tool, but these exist for other CNI plugins as well. So we've talked about what happens, how we protect the environment, but how we can more specifically protect the data in motion is using in motion encryption that cluster science certificates deliver. So out of the box, Kubernetes components will encrypt traffic between them using certificates signed by the cluster. It's particularly good practice though to add to that trusted root certificates that is certificates issued by an external certificate authority for the external interfaces. That would be places where either things outside Kubernetes need to be spoken to like a directory service or for applications and administrative control that talk through the Kubernetes API, we want to expose those typically with a trusted root certificate so that basically it simplifies the need to distribute the certificate authorities certificates for the cluster outside of the cluster. So anything outside should use external certificates and if it's possible in your system and through your practices. Clusters should integrate the ability to issue certificates automatically and renew them automatically. Often this is done through available interfaces to a service like well specifically let's encrypt in order to time that auto issuance and certificate rotation and renewal for the internal certificates is available through tools like Qsara and onto secrets, Danny. The whole point of secrets is they have to be kept secret. So what you want to do is basically expose them for the minimum amount of time. So in ideal world, you have enough control of your application where you can use an external secret manager like Vault or one of those kinds of tools where your application say it needs to connect to a database and these credentials, they could make the API call out to Vault, get the authentication information, make the connection and then free that memory so that the secret is just not exposed in the application at all. In a lot of cases you don't have that level of control over the applications you're developing. So the next step down from there would be to have the secrets available to your application through the environment variables that sets up when the pod gets started. That's not quite as ideal because they still exist a little longer in the memory of the process but that's not really easy to get to. You can then move down from there to exposing virtual files within the container where the environment variables are passed in but they're exposed to within the container as a simulated file by the container runtime. If you can't do any of those things and you have to actually expose the secrets from a physical file into the container, at the very least you need to do some sort of encryption at rest so that those files are less vulnerable. Great, runtime security is an area that of course extends beyond Kubernetes itself. We do have capabilities in Kubernetes to deal with them and it's starting with pod security policies. Pod security policies will control how we use privileged containers and what privileges they can carry, can restrict which host resources that given pod can use, can disable or control privilege escalation, expose Linux capabilities that should probably be a capital C that's the Linux feature called capabilities as well as OS security profiles through things like ST Linux and app armor. In addition, Danny mentioned Falco earlier, it's a good example of considering the use of runtime security monitoring tools. So we see what's going on in our network and in the system environment at runtime, not just based on static analysis. Do you wanna move on? Yeah, and I can talk about this a little bit, I guess. So it's important to remember that your containers, you know, your container runtime runs on top of an OS. So just like your containers have to be built on top of a known secure base image, your runtime ideally would run on top of a known secure OS platform. This is really a solved, well, generally a well-known problem.  Even within your container network, if you've done your CNI level networking, filtering and segmentation, you still probably wanna have firewalls controlling what gets access to the nodes that make up your cluster, using the web application layer firewalls in general to filter, you know, what's coming in and ensure that you're not exfiltrating data using intrusion detection, intrusion prevention systems to, again, look at the anomalous traffic and act on that, you know, use any malware tools. The same thing with storage and your cloud security, your enterprise should have policies that govern what nodes can access, what storage and how they use it, how you're interacting with an external cloud. Great. So, was stepped on from that to some of the specific things you can do to harden the host. And this is in pretty much the order that you'll step into them through the life cycle. Start with secured services. And we mentioned our build service here. There are obviously other places to get secure packages depending on who's OS you're running on, who's distribution, but be sure that you can trust the package, not just to the source, not just to the source you get it from, but to the source that it's built from. Secure boot is an option, harden the host so that it recognizes valid signed images and won't boot images that have been tampered with. Implement automation of security standards, security profiles, such as OpenScap will do that. We talked about firewalls, implement transit, layer security or TLS throughout the environment, not just the internal features, not just accessing the API server, but also exposing TLS for the applications. Enable auditing so that you have a path to assess accesses. Use controlling the capabilities that processes have and controlling their rights through AppArmor or SE Linux, encrypt file systems for data at rest. One thing we strongly advise to both reduce downtime and to be able to bring in security fixes as soon as possible is to implement live patching if your operating system supports it. And then be religious about security updates and vendors as well as yourself. Be concerned about security where previous versions are running as well. Okay, so that's a step through all of the areas that we're concerned with. How does this fit into implementation in a government's process? Here are some examples of policies that you can make and implement that will control your organization's ability to implement a secure environment. I'm not gonna read them all, but an example is we restrict containers from being started by users directly and allow them only to be started by Kubernetes in a Kubernetes cluster. We control where given workloads can run. Sometimes we do that for reasons like performance and availability, but sometimes we do that, for example, to keep things like, here are the payroll and HR systems, here are engineering development. I wanna keep them in separate places. Use of package managers, control of encryption. We talked about all of the areas. The idea here is have policies, control your changes, keep them visible and use an idea of the least access rights. So you want to be sure that nothing can do more than it needs to and implement those in both human policies and then take that to automation. So that's a lot. We've talked about a big chain of things today. Where do you start? Start at the beginning, obviously. And when I say start at the beginning, I mean look at these things from the beginning of your implementation process. Well, let's talk about some of the little hanging fruit. What are some of the things I can do most easily to have a secure environment? First one, and this is one that the benchmark suites are happy to expose and criticize you on is to disable anonymous access. Some distributions and releases enable it automatically. This is really something you really don't want to do. I said, I'm gonna take a little step back. I said earlier that I would talk about benchmarks and benchmark suites. The benchmarks are actually the standards, not the tests. There is a well-known and well-used set of standards or benchmarks for operating systems, for containers, for Kubernetes. There are several, but the one that most people reference is the Center for Internet Security or CI Security or CIS. And they have a, we'll see, they have a set of standards as well as there's an implementation of those to test those that is developed by Apple security called CUBE Bench that should be integrated into the process of all of your deployment processes. I generally insist that it should be run all the time in the upgrade and any process that involves the CI CD pipeline. Don't auto-mount the default service account token. We talked about restricting service account tokens before. Use admission control so that even if you have privileged containers, you cannot escalate privilege with shell access, restrict user impersonation, don't use privilege, don't use privilege, don't use privilege, don't use privilege. Don't use privilege containers to the extent that you can. And if you need to control individual privileges rather than just giving full privileges to a container, isolate name spaces, use resource limits so that noisy neighbor applications can't steal resources or interfere with the processing of other applications. As I said earlier, patch promptly is a key strain and most important, integrate security into all of your processes. Train your developers, train your DevOps people and keep DevSecOps at the heart of the implementation process. Staying vigilant is critically important. Don't release reconfigure, don't do anything without testing the security implications of it. I mentioned QBench, QBench early and often. And don't do it by hand. The most vulnerable component is humans. As we said, as they sometimes say, the most dangerous part of the car is the nut that holds the wheel. Automate and verify the automation of this testing and make assessments continuous. So that's it for us. I'd like to open the floor for questions. Okay, well, thank you both very much for a wonderful presentation. We have about 15 minutes before we wrap up. So if you have any questions, please feel free to drop them into the Q&A box and we will get to as many as we can. Our first question here is there any procedure to add security to the containers that could be done already in the firmware boot phase? Well, I think to containers in the firmware boot phase, that's an interesting question for which I don't actually have details. My email addresses and slides drop me a note and I will check with people. Generally, the firmware process validates the underlying operating system, not the containers themselves. I'm not aware of anything, Danny, are you? No, that's generally that would be securing the OS that underlies the containers, not the containers themselves. So I'm in the same boat you are with, not having a great answer. Okay, thanks. Sorry, folks, but we'll check in, but as far as we know that it's firmware to OS and then OS to containers. Okay. Do we have anyone else who would like to ask questions? We have plenty of time, so if you have anything you'd like to know, please drop in the questions and we'll get to you. Do you think that all security tools and benchmarks should be integrated more natively into containers and Kubernetes? That's a really, that's a good question because it's hard to say what integrated into Kubernetes means. As we go along now, more and more things that have started, there are two competing tensions. There are things that start as extensions that come into mainline Kubernetes. And then there are areas like cloud controllers and storage interfaces that have started tightly coupled and have moved out of tree to provide alternatives. I think the challenge for bringing native security tools into the core of Kubernetes is the question of which to pick. And there are competing options with merits to all of them. So I think the point of integration has to be your evaluation and your choice of processes, not native Kubernetes. Now, the process of building the Kubernetes ecosystem, security has very much been brought into it in that projects are now required that are at least CNCF projects are required to have security assessments some of which are audits, some of which are examination of their approach to security. So security is very much a component of the Kubernetes and CNCF development process. I don't think we'll reach the point where there's one single built-in security approach because the innovation is too fast and the variety too broad. Okay, thank you for that. Before we get to the next question, just Jim, I wanna address your question here. Yes, it will be possible to download the slides for the PDF for this webinar. As always, recording of slides are posted to the CNCF webinar page after each webinar. So please look out for those later today. Our next question, is it advisable to run antivirus-like silence on a cube cluster? Ah, good, good question. I mean, I think it's advisable to run and I'm gonna use a more general term. I think it's advisable to use anti-malware everywhere. Whether that is implemented on the hosts in containers in the pipelines or in appliances outside the cluster will vary. And I mentioned anti-malware because antivirus is one very specific sort of attack point. But more and more what we need to look at are analysis tools that use techniques like sandboxing for dynamic analysis that is looking at the payloads and what they would do rather than conventional antivirus, which is usually just looking at the fingerprint of known malware. It's the unknown malware that's at least as important. And we need things that can look at it behaviorally. There are more than a few technologies out there to do it. I'm gonna name one just because I used to work there and it's a technology called, you think I'd remember where I used to work. But I'll be back on it in a second. They were just acquired by VMware, a very sophisticated advanced anti-malware company.  I'm having like the memory lapse of all time. Well, I like to point out silence is one of those anomalous behavior type programs that works like really any of the kind of runtime security tools. So I mean, it's billed as antivirus, but it fits in very well with, as we were saying, like the runtime security monitoring. So that's another- Last one is the company I was looking for. They were, as I said, recently acquired by VMware, but. Excellent. All right, so next question here. Today, we have to switch over to learn a new tool to run it and then link it somehow to which Kubernetes workload or container it applies. Oh, that's not a question. Continue. Yeah. Do you think that it makes sense to store some of the benchmark reports to be stored as custom resources with standardized CRDs? Danny, you wanna- I mean, if your analysis tooling is all running within Kubernetes, it makes sense that you could store some of your data alongside the applications. That's really more of an organizational, how do you wanna handle operations? It's not a terrible idea. So it's whatever makes sense in your situation, I think. Yep. Okay. Are there any tools to integrate the default Kubernetes RBAC into LDAP? Is that possible? LDAP and Active Directory. Most distributions include some method of interfacing external directories and other authentication methods such as OIDC and SAML into the processes. We, for example, at SUSE, use tools called DeX and Gangway in our product, but there are other approaches as well. But yes, absolutely standard directories are frequently used. Not only is it possible, it's pretty much typical. Do we have any other questions at all? Anyone at all? We have five minutes, so please don't be shy. All right. Well, no one has any other questions and I think we will call this a day. I wanna thank both Danny and Roger for a wonderful presentation and thank everybody for attending today's webinar. As I said earlier, the recording and slides will be available on the CNCF webinar page at CNCF.io slash webinars. Thanks again to everyone for attending today. Have a wonderful rest of your day. Take care, stay safe, and we will see you next time. Bye-bye. Thanks, everybody.