My name is Pushkar. I work as a sub project maintainer in Kubernetes security. The sub projects name is tooling. So anything related to security that we do for Kubernetes. Are we good on audio? I hear an echo. All right. So anything that we can do by writing code or helping people write code that is going to improve security for open source Kubernetes is what my sub project lead responsibilities are. And then the other things are I'll end up helping out other sub projects, et cetera. We will have a couple of folks who will help you out if you get stuck, especially Tabby, who is our chair for security who has graciously come out to help out. So bit more about me. If you saw the photo on the previous slide, I'm in the SFB area. One of my favorite places to go for a car ride is Mendocino County, which is what the sweatshirt is from. I really love the coast. Like I said, apart from security, I'm also tech lead for CNCF tax security. Great question to ask what's the difference between tax security security during the breaks or after the session. I am also recently associate member for Kubernetes security response committee. So anytime you get a CV notification, we are one of the people who send it out to the rest of the community. I'm formerly a staff security engineer at VMware Tanzu. Like I said, I love the area. Also, I love many things that start with C. So cycling chai, Indian curries, camera and cricket. If anybody follows, we have a world cup going on and you can find more about me on the link on the slide. So we will divide it into small blocks so that we don't get overwhelmed or get really tired at the end of the session. This is the intro section. We'll have 20 minutes for the first task, including the five minute break, 25 minutes for the second one with five minute break included, and then 30 minutes with five minute break included. Eventually at the end, we will wrap up and I'll share some links for further reading if you want to continue to explore more and more about this.  Okay, perfect. I have tested this on macOS. So most of you should hopefully be able to follow along. How many of you are on M1 macOS? Okay. All right, and Intel. Okay, cool. So there is in the install prerequisites part, there is a small change for people will have to do for once on M1. Basically, instead of Darwin AMD 64 binaries, you will be ensuring Darwin ARM 64 binaries. So we'll talk about talk more about that. Anyone on Windows or Linux computers or virtual box? Okay, cool. So we have similar setup for Linux and Windows binaries as well. I haven't been able to test it, but even if it breaks or doesn't work for either of you, all the scripts that we will use will be available publicly after this session forever. You'll also have have access to the recording of this session. So you'll be able to follow along the demo videos even later. So don't be afraid if something doesn't work. How many of you were able to look at the session description and install the prerequisites mentioned in the link? Okay, perfect. If you haven't installed, that's also fine. We'll spend some time to install it. And only thing I would suggest is if possible use Docker desktop on Mac Windows on Linux environments really like Docker binaries are also fine. But the main important thing is please don't run any of the scripts on production servers or shared computers because this is a lab. Things could go wrong and we don't want other people to suffer because we were trying to learn something good. So as long as you're running this on your personal laptop with Docker desktop, we haven't added advantage of it. Everything running in a virtual machine that Docker desktop has included by default. So things would be much safer if you're running Docker desktop. And again, don't run this in production, even for folks watching online later on or watching live right now. So now back to the actual content.  Security and ops admin. All right, some some of you are both, which is fine. I'm also both. Many times when people ask how do you want the security to be for your system, everyone says secured by design. It should be built in versus bolted on. It should be transparent and it should just work. And I think the one thing people whisper, which is, can it be cheap?  So this is exactly the part that we will do today. We are not going to ask you to install anything paid. Everything we will do is open source part of Kubernetes community. Most of the things we will do are actually part of existing Kubernetes releases. So without really installing anything apart from what's available open source, we will try to secure as much as we can for all the clusters that we work on. Anyone who is a complete new BA on Kubernetes or has just been playing around for like a couple of weeks or so. Okay, that's that's totally fine. Don't feel bad in case something doesn't work or ask questions if I am missing something in terms of giving context. And you can always continue to try this later on. And anyone who is familiar with Kubernetes, if I repeat something that you already know, just be a little bit patient and I'll quickly move on to some more advanced stuff. So we'll focus, like I said on built in Kubernetes security features. All of this is mostly work of Kubernetes community. Since at least since I've been here in the last couple of years, we have tried to do a lot of things in Kubernetes where the security can be part of the project versus being reliant on other things that we need to do. So we'll divide, like I said in three tasks. First task is how do I verify sign container images? How many of you know we have been signing release images of Kubernetes in the last couple of releases or so? Okay, that's good. So now you know for folks who don't know. And the idea behind signing is essentially you want to trust whatever is being sent by Kubernetes release. And that's the reason why we're signing and all the focus on secure supply chain doesn't hurt doing all of these things. Second one is how do we enforce baseline port security standard? So anybody using PSPs or security policies, anybody tried port security admission? Yeah, so we're actually going to try in doing using the port security admission and enforce the existing baseline port security standard. We are also going to work on second filtering. So all the container runtimes like container D we have another helper Nadir who is going to help you out in case you get stuck. All the container runtimes like container D cryo come up with their default runtime second profile. What we are going to do is let Kubernetes actually use that because by default it doesn't know that I can actually use the runtime profile. So we'll see how that works. Some prerequisite knowledge. Knowing basics of curl file redirects file editors, I'll try to go through it in a way that it is clear, but ask questions if needed during the break, or even if you have a small question, we can do it during the session with the time we have. I may not be able to answer all the questions or like unblock everybody in all the tasks. So it's okay if you are halfway there and we have to move on. We can always continue later follow along for the rest of the task. You can run the scripts later on because all of all of the things that I'll do here will be available for you later. Kubernetes basics, water names, spaces, spots, images, those kind of things would be great to know. Pre-requisite tooling. So for folks who installed it, great for folks who want to install it. I would say at least have Docker installed. There is an installed prerequisite script that I will show that will install most of the other things, but see if you can install Docker by yourself right now. Use the five minute break to relax. Also ask questions and I'll be hanging around after the session as well. We have lunch break. So it's really up to us how much we want to talk, but happy to answer questions later. So now let's get started. So this was the link in the session description. If you have sked.com access or the Kubernetes schedule access, you should in the session description of this session, you will find this link. Just run this command, get clone the URL of the repo and you'll be able to download it with all the scripts that we are going to use today. So now let's go back to doing the demos. I'm going to quickly mirror my display so I can see what you're seeing. And let's go here. Is the font small big? Is this better? All right, cool. So like I said, this is the GitHub repo. Everybody been able to find the URL so far. All right. Okay, cool. And this is where you can basically also find the URL and do a git clone. Now going to install prerequisites. So remember for M1 folks with macOS in this section, basically anywhere you see AMD 64 and AMD 64 here, just change it with arm 64. And if you run the script, it should work. So going a bit deeper into the script, basically what it's doing is setting up this so that we know when something fails in bash. Next one is setting up paths so that when we install few things, we can use it as a command line inter prompt directly. This is for different operating systems. So when you run the script dot slash install prerequisite, just add an argument for your operating system. So windows Darwin or Linux, and then it will pick up the binaries that you need. So let's pick Darwin as majority of you are on Mac. What it is essentially doing is downloading the cube CTL, which is the client side interface for interacting with Kubernetes API. It's installing kind. So for folks who are not familiar with kind kind distance for Kubernetes and Docker. And what essentially it's doing is I have a cluster. I want to play around with it, but creating cluster is hard. Maintaining it is even harder sometimes. So this creates test clusters using Docker on your laptop, and you can essentially use it as a test environment. So we will use that quite heavily, especially in the second and the third task. If you're familiar with kind, most likely the pre the whole tutorial, especially the second and third would make a lot more sense. But I am hoping that at the end of the tutorial for folks who haven't been introduced to kind, you'll actually fall in love with it and use it after the session when you're day to day jobs. Don't run kind to run production clusters. Use it for test environment and development only. And so that's pretty much it. So I've I've installed this already to make sure the Wi-Fi doesn't break. I've been informed that the Wi-Fi should be pretty good specifically in this room. So hopefully when you run this script, it should work for all of you. But start running it. The basic idea of running this would be pretty simple. So I have this installed here. Is the font okay for the people at the back? Yes. Okay, good. So I will I won't run it. But basically it will look something like this. And if you click enter, you it will install cosine. You'll see a lot of things getting installed for cosine because it's using go install. And then eventually it will start installing kind and cube sick deal, which will be much quicker. So I take take some time. Let it run while you're looking at the slides next. Let the script run. And by the time we are ready for the first task and actually implementing things, hopefully it will be installed by then. So everybody start installing this and let it run. We'll switch back to slides until it is installing any questions. Yeah, good. Okay. Yes, that is a good idea. So one thing I would also recommend in true open source fashion. The repo is public and any things that you find that could be improved in the repository, like adding Xcode as a dependency, please create PRs. I would love to hear from you. I would love to see all the work that we are doing here be useful for everyone later. So add PRs, maybe now, maybe later. And one more thing I wanted to show is for now as well as for later, if you are stuck and it's hard to like share what is wrong in your terminal, what error it is exactly face to face. One thing that I've set up here is if you click new issue, it will give you a issue template. You can still, okay, you can still see this. Open issue template. Help me debug. And if you click on this, you will be able to basically write all the things that are going wrong on your machine right now. And you can put it down with the description. How did you can you reproduce? And if you have any screenshots, you can put it, but really it's optional logs would be great and which environment you're running. So I'll try to see if I can follow along on future issues as well. If you when you try this at home, this is definitely not something I'm being sponsored for. So I will do my best in my personal capacity to answer questions later on. But even during the session, if you want to share something and probably many of you are facing same issues, creating this kind of issue would really help. So please use this as much as you want. Just to repeat, go to issues tab, click new issues and get started and then add any errors that you have. We'll take a look at all of the new issues we create during the break between the two tasks. All right. So we talked about install prerequisites. We talked about how to share how to share when something is going wrong. So now let's go back to the slides. All right. So the first task. All right. Essentially, for folks who are not familiar with cryptography and what how to use it. I'll just give a brief idea as an analogy. If you have a passport, it is basically given by an authority that everybody trusts. And because everybody trusts it authority, when somebody shows like this is me and see the name and the face matching, you trust that the person who is showing this is actually who they are. So that's the main idea of signing and verification. And the stamps for what it's worth are like attestation to your images. So signing always happens where the makers only have the private key. If the private key in a public private key pair is compromised. Essentially, there is no value in anything that's signed by that compromised private key. The verification can be done by a public key, which as the name suggests can be public. And that can be used to verify whether somebody who signed it was actually the holder of that private key. It tells you where the artifact came came from. So in case of Kubernetes release images, right? It will let you know that Kubernetes release actually signed these images. And when you verify it, you'll see an email address that belongs to them. And because it is very fine using the public key, that's the other side of the pair of the private key owned by release team. You know, it's actually signed by them. The next one is how do we actually get all the images in a release? So how many of you have seen the software bill of materials, which is called S bomb of a Kubernetes release? Okay, not a lot. Okay. So it's quite big and it's huge as you can imagine. Kubernetes pretty much depends on many, many things. So we have a way to access as bomb of any specific release on this URL as bomb dot kids.io. And what I'm doing here is we have a constant, which keeps changing based on a new release when it comes up. And we store it in this specific URL, SCTPS deal dot kids.io release latest.txt. If you want the latest stable release, you just change latest with stable.txt. So latest would have alpha releases, beta releases, stable will only have that are officially released like 125.2. And then slash release is when you will know that now I'm getting the S bomb of this specific release. So the dollar curl will actually look like, let's say 126. something. And you will get the S bomb of that specific release. The next one is package name registry dot kids.io. So kids by the way is abbreviation for Kubernetes. We will see a lot of it. The registry dot kids.io is the registry where all the Kubernetes release images are stored. And what we are looking for in the S bomb is get me all the images that are part of the release. And then essentially we do some bash magic and get a list of all the images in a file called images.txt. So after that we take it as input and essentially run a for loop. So while FS read hyphen our images going to run a for loop on every single line of the file and every single line represents one image. So it will loop through all of them. It will verify all the images. And then this cosine experimental equal to one. That's the most important part. Even if you ignore all of the other things, this is where you know that you're actually very fine things. So cosine experimental equal to one. I won't go into too many details. Essentially for now consider it as a as the standard way Kubernetes release has decided to verify images. And in background cosine experimental is essentially using something called keyless signing where I don't have to worry about maintaining my private key or public key. The six store service is going to help me and keep the private key secure as well as the public key will be available whenever we have to verify it. There are ways to do this without where you have access to private key in public right now for the releases. That's what we are doing. So then we run a command called cosine, which is one of the things that you're going to install in the prerequisites and then verifies the command name registry dot cage dot IO is the registry and then QB API server is one of the images that we are actually going to verify. So if you want try running this by yourself if you have installed cosine by now. And if not, we will actually be running this live in front of all of you in case you're facing any issues with troubleshooting. Feel free to call Tabby or Nadir. They might be able to help you out, but if you get stuck and can't move on that's totally fine as well. So let's switch back to the demo. All right. So hopefully the prerequisites are working. Now if you see we are here. And we are going to go in this. Oh, oh yeah. Good point. Thank you. Okay. How about now better? All right. People at the back. All right. Cool. So we are going to go in this directory. And if you see here, we have the images dot Txt file downloaded. So let's look at it for as an example of how it looks like. So if you see each line is an image, like I said, the tag is actually the release. So like I said, because we're using latest dot Txt, it's going to pick up any release. Instead of the officially released Kubernetes releases or versions. So this one is using an alpha version of the upcoming 126 dot zero. Every release, regardless of whether it's officially GA version or not will be signed and you can verify it. So we have about 15 plus. I want to say images in total and you can see every one of them is for different architecture. So we have AMD 64 arm, et cetera. Now let's try to run this. Okay. So the script that we are going to run is essentially the same as the ones we saw on the slide. If you want to confirm that, I'll just show it to you quickly. So same thing, except the first four lines which are standard for bash to make sure like if anything is going wrong, we know. And then the idea is after this, we will see a lot of output that shows that we are verifying. So brace yourself for a lot of text on the command line once we run this, but we'll go through some of it one by one. And hopefully all of it will make sense. Oh, okay. So cosine command not found. So why this would happen for you also is if you go here and install prerequisites, what I'm missing is I have cosine installed, but I have not set up this path. So if I go back and run this, I can try and see, okay, cosine is working. So now I will go back and run this. So like I said, lots of text is essentially trying to share all the metadata that you can get about all the images and it will run for about a minute or so depending on Wi-Fi and it will. It is basically doing the same thing for all the images verifying it one by one. And now it's pretty much done. So let's look at what it's actually doing. So if we zoom it out a bit verification for registry dot cage dot IO cube proxy MD 64. That is what it is actually verifying. The thing it's trying to do is our is the whatever I'm claiming it to be like I'm claiming that my image is signed by cosine. It's verifying whether that's true. First, second, it's trying to do is are these claims also in my transparency log. So without going again into too many details with the usage of keyless signing, you end up being able to use transparency logs where you are able to use the public key that will allow you to verify things. Folks who are maybe more familiar with six store cosine than me, feel free to correct me. Any certificates were verified against the full show roots again. It's part of the six store ecosystem. And then the main thing to look at here is what image I'm trying to verify. So this is the Shah of that image that I'm trying to verify. And if we scroll down a bit more, this is the interesting part. So the private key is mapped to this particular account that is owned by Kubernetes. The least engineering team. So if you see it's called K rail life and trust gates dot release engineering dot prod, and it is a basically Google service account. So this gets linked to the private key. And as a result of it, only somebody who has access to this account is able to sign it. And as a result of that, because we can see here that this is the account that's being used to verify it, we are able to know for sure that it's actually signed by Kubernetes release. Okay. Make sense so far. Cool. Okay. Anybody got this running like I did on here? Okay. All right. I see some hands. This is probably going to be one of the easier installs. And the other ones, if you have kind and Docker would be simpler. If you don't have kind or Docker, it might take a while, but that's fine. So the same thing happens essentially every for all the images. And that's how you get what we saw. So now how are we doing on time? One second. I'll extend again. Okay. So about half hour is almost done. So let's take a five minute break before we move. If you want to stretch, drink water, ask me questions. Just close your eyes for a bit. That's fine. Make sure to come back in five minutes. Water should be right outside the rooms. And if you have questions, I'm all ears. And I'll repeat the question so we don't have to move around taking a mic for the people in the virtual attending virtually. Any questions so far from what we did? We quiet. Can you speak a bit louder? The long running command for verifying the images or the big output that we saw or that was the install prerequisites command. So if you have installed the prerequisites before, then you don't have to do it. But otherwise it would basically take a while only because cosine takes a while to download other things should be fairly fast. Okay. I'm back here because people won't see me in the video if I'm standing there. So any other questions from anyone? Anyone stuck where we can help you? Anyone has put any issues in the GitHub link that we shared? You have. Okay. Let's look at it. Okay. All right. So. Great. I think that's always useful to see for folks watching online. So anyone with Mac OS who doesn't have a code at win 140. So. I'll just use your GitHub handle has suggested how you could install Xcode before installing all the other things and take a look at this link if anyone is struggling with the same. Any other questions anybody stuck that we can help anything that felt like can merit more explanation? Go ahead. Speak louder. Speak louder a bit more. Right. Yeah. So how many folks are familiar with public key infrastructure? Like how private key public keywords? Okay. All right. So we can go quickly like a three minute summary and see how it goes. So essentially it's like I want to let you verify that what I'm claiming is true without sharing anything secret. So how do you do that? And essentially that's where the private and public key pair comes into picture where I will not share my private key, but I'll give you an option to verify that I am the only holder of the private key. And what cosine essentially does is it creates a framework for all of us to use that. So anytime we do a release in Kubernetes, we will use the private key that release engineering team owns to sign the image. So once it's signed, the signature gets stored alongside the image. And then when you want to use the image, you can choose to verify it like we did. And when we verify it essentially again, cosine will use the existing six store keyless signing to find the appropriate public key and then use that public key to confirm that the images are actually coming from the release team or not. So that's essentially what the whole big output looks like. Most of the other things are metadata about the images. The main thing to look at was the identity of the signer which we looked at which was that email address of Google service account. And that's basically how it was in summary. Any other questions? All right, let's move on to the next task. So, all right. So the next task is about pod security standards and how to enforce it. If you have been using pod security policies for a while, they are essentially gone from version 125. We have deprecated it since version 121. Many people from six security and SIG Auth which is another SIG as well as many other SIGs in Kubernetes have worked for multiple months to make sure this deprecation and eventual removal process is as convenient and simple for anyone who is an end user. So hopefully you are aware by now that we have removed it and it's been deprecated for a while. Anybody using pod security policies? There was actually a great talk on how to migrate from an existing set of pod security policies to something like the pod security admission that we have which happened yesterday. I attended it, I really loved it. They also explained something of a policy migrator tool that they have created which will allow you to figure out what PSPs you have and what you need to do to make sure it runs with the new pod security admission. It should be on YouTube with all the other talks soon. So make sure to check it out. I think anyone using that will actually benefit from it. So this is I love analogies, if you know me and I felt like instead of going into depth of looking at the yamls of all the pod security standards this might be the best way to explain what they are. How many people either still commute or used to commute before the pandemic to their offices? Wow, there are a lot of remote workers looks like. So if you commute or went to school in the past or the main idea is you want to be there safely and as quickly as possible. Same thing goes with pods and workloads that you want to run. You want the pods and the workloads to be safe and you want them to essentially do the job that they are defined and has to do. So if you think about it there are three modes of commute I have used all of them at some point in time in my opinion and obviously everybody's experience is different being on a train and going to some place feels the safest to me because I don't have to depend on my driving skills which is very important. There is a lot of less chance of some other train coming in front of me and we getting into an accident so that feels safer and basically what this represents is the most secure, highly restricted configuration of pod security standards which is actually called restricted. The second one is baseline which is somewhat of my current commute where I go through a very complex set of streets and roads where we have bike lanes where we have trams where we have people driving in their cars through buses and that feels about right because it can cover a lot of people and the way people commute but there are some things that they are doing well like if I haven't been in a bike lane I feel safer than being in a bike lane if I am in a tram I feel safer that I have a dedicated route there so same thing for bus routes also but it's still not as safe as you would feel if you are in a train and then the last one is privileged which is basically like driving along the beautiful freeways that we have here and if you have a car of yourself you have all the things that you need well said but not everybody can afford a car not everybody has a car so sometimes if I cannot imagine myself biking on this particular highway the one in the photo because I would be very very scared so if you have the means to do it it is great but probably it's only great for you and I wouldn't share the road with any other types of workloads which is what port security standards are which is basically anything goes you're on your own at your own risk so that's what port security standards are they are opinionated only three because we can't cover all the different permutations and combination of port security fields and from lowest to highest risk they are restricted baseline and privileged so port security admission is the replacement of port security policy it is enabled by default as of version 125 but it's not enforced by default so the feature is available but you cannot use or benefit from it unless you configure which particular standard you want to use in your cluster or namespace the setup is similar you can set it up in a cluster regardless of which standard you want to follow or you can set it up per namespace level as well and let's look at how to set it up in this specific tutorial we'll focus only on how to set it up at a cluster level focus on the colored lines those are the most important ones in the slides essentially this is a configuration in kind which is defining an admission configuration so we use a lot of admission controls when we use Kubernetes and what we are doing here is setting up an object called port security admission .config.cage.io v1 is saying that this particular feature or API is GA or stable and the defaults if you notice here we have three pairs of lines so first one is baseline and if you see enforce version is latest so you can configure it for an older version even if you are running a version like let's say 125 but you can configure it for an older version also but we are going to go with latest for now and then restricted and again restricted but if you see the last two are audit and warn so enforce audit and warn are the three modes in which the port security admission is used and then we have something called exemptions where you can say I want this particular user to be exempted from all the standards that I am enforcing I want a runtime class maybe you have a windows workload or maybe you have something else that doesn't work well or you don't want that particular node to use port security standards then you can exempt that and then name spaces is basically I don't want this name space to be under the cluster level port security standard that I am enforcing or warning on or auditing on so this name space could be for example for all the privilege workloads in your entire cluster where you are you have to run some workloads in privilege and if you put it all in one name space and just exempt it and for all the other workloads which are running your business applications you can enforce it at cluster level so I talked about three modes basically the enforcing mode is I am going to fail the port creation if any of the port security standard that I have defined in enforce mode actually is not meeting the standard that I have defined so I am creating a port and it doesn't meet the standards of baseline port security standard the port creation wouldn't work same thing for restricted, same thing for privilege and one and audit are somewhat similar the main difference is the audience of both the modes one is going to warn the user who is trying to create the port so when you are running kubectl create port you will get a warning when you are running it saying well we have set this standard let's say restricted in one mode and your port is going to be created but we are going to tell you that if restricted was enforced your port would fail because you are missing these things in the port spec and then audit is similar but it will actually log that same warning or similar in spirit in the Kubernetes API audit logs so if I am an administrator of a cluster I want to see all my users of the cluster if they would be able to create pods if I convert all of my port security standards to enforce mode in restricted I can set the audit mode for restricted standard and then I will start getting API server audit logs for all the pods that get created and which ones are meeting especially which ones are not meeting because I will see that in one of the log lines in my API audit and exemptions like I said depends on these three things namespaces, runtimes, users and then we will use a namespace exemption where some of the privileged workloads that are needed to create the cluster are put in kubesystem namespace so we will be exempting it because it would need extra permissions but we want all the other pods that are running in normal applications to have different set of pod security standards and force and next one, next two slides and then we will go to the demo so how do we create a cluster with pod security so remember I mentioned we will use something called kind KIND and this is one of the configurations for it you can figure it out based on kind.x hyphen kh.io and kind also uses another tool internally called kubedium which allows us to configure all the flags and the settings that we have for any specific cluster so here what the cluster configuration is saying can you pick up the cluster level pod security standard yaml file that I saw here when you are creating a cluster so the colored lines that we saw is basically content of this file so what kind will know if we said this is when I am creating my cluster I am going to automatically enforce in this case baseline pod security standard so for any pod in that cluster that I am creating you will have that pod that pod would have to pass basically the pod security standard otherwise the pod creation fails it will warn you on restricted and it will audit on restricted as well and then essentially this minimal pod spec actually is going to work if our baseline pod security standard is enforced because we are not adding anything in security context here but it is going to work because baseline does not expect you to add anything that is minimally possible in a pod spec it will allow but because we have set it to enforce it is going to give you this kind of a warning that if you want this to work when restricted standard is enforced you would have to set allow privilege escalation to true you would have to drop all the capabilities you would have to run as normal and you would have to set a second profile you can keep it blank so that is what it is saying and then this allows you to then make those changes if you want it to accept a restricted pod security standard configuration and this is an example where it would pass a restricted pod security standard if you really want to run it which is something I would recommend as well because it is the safest way to run a pod if you are using pod security admission so lots of information we will jump to the demo and but if you have any questions I can take a minute to answer them before the demo all right cool we will go back to mirroring if we go here so pod security admission and if you see here so I am going to quickly check something if I have existing kind gate clusters so this might happen for you also what it basically is if you are using docker desktop your docker desktop is not running so I will start it and the best way to find that out is this is the socket unique socket that docker desktop uses and if it is erroring out there that means docker desktop was not running so now it is starting up it will also show up here with the veil icon of docker and once it started we will be able to use kind because kind wouldn't work if we don't have docker installed same thing for anyone using docker binaries on linux if the docker server is not running on your system you will probably get a similar error so let's see this command one more time and for folks wondering like I installed a bunch of stuff later after this session how do I clean it up so the best way to do this is kind delete cluster name all so we will create about four clusters if you finish everything with me and you can delete them one by one just like this so I had a cluster called all which we will also try to install and I deleted it now if I see get kind clusters no kind clusters found so now going to the part security admission if you see we are going to run this file and if you are curious how it looks like it's basically the same thing that we saw on the slides so it's saying can you create this cluster level psys.yml and then when you are creating the kind cluster can you use my file there are some extra things here which is extra amounts and extra volumes so essentially that is needed because kind is using docker so it would need to mount something in the right path inside a container so no need to like worry about the details if you don't understand this but the idea is I am going to ensure that when cubeadm is going to create the cluster I am going to pass it on this config file that is going to let it know which part security standard I want to enforce so let's run this now so kind with cluster level baseline part security enforced and if the demo doesn't work I have backup videos so you will be able to see how it looks like so what it is doing here is getting a node created with version 125.2 where we can install and configure all of the things that we want then it is writing the configuration that we set for cluster level pss with baseline enforced restricted warrant and restricted audit and now it is going to start the control plane this is the step that takes the most time and this is the step most times if you are using kind where it feels so we will see how it goes it worked so now it is installing CNI installing storage class which is the standard thing kind does now what it is doing saying is I have a cluster that is created if you want to use it you have to make sure that you set the config of kubectl or context of kubectl to point it to this cluster so kubectl is essentially like a client if the client doesn't know which server to talk to essentially the client is not useful so this command kubectl cluster info context will tell the client go talk to this kubapi server that I have here now the control plane of kubernetes is on this particular URL with this port we have core dns and we got the warning so I will bring it up a bit this is essentially what we wanted to see so we created that minimal port spec with nginx and then we got a warning which said oh this port violates restricted latest port security standard if you do then the reason is because you have not set all of the things that we talked about but if you notice it still ended up creating this and if you notice this was the port that we set to allow it to pass a restricted port security standard and you don't see a warning for this so the reason is because it is set in a way that the restricted port security standard would still work and if you are curious how the port spec looks like you will see this one is the minimal port spec and this one is where we set all the things that restricted port security standard was looking for so that's pretty much how you can use existing port security admission to create clusters with something as simple as baseline which would work for most workloads but gives you much better protection than not having it enabled at all or everything running in privilege which is basically you don't have any container isolation boundaries so that's the demo let's go back to the slides and we will also take a break for questions alright anybody has any questions anybody needs help we have couple of people ready to help does this give you a better idea of what port security standards are how to use port security admission yeah go ahead how do I get the if you run kubectl get parts you will see the parts I'll show you quickly so oh I see what you mean so I can do like a get pod but can I do something like get PSA so that I can see what is actually configured for in my cluster I'm not sure if anybody knows feel free to answer but essentially the idea is anything you define in the cluster level PSS YAML file that is exactly what the APS server is using so it's essentially declarative go ahead describe pod would it would show up if you're using PSA using name spaces because name with PSA with name spaces you need to add a label saying for this name space I want this particular PSS config to be enforced but because we are setting this at cluster level we will not see it in the but if you set it to like one like we saw you will see like okay restricted was in one and this one didn't work same thing will apply for API audit logs there is a good chance that if you look at the API server logs not the audit logs the logs of the binary itself in the system logs when the cluster is getting created and the API server is coming up you will see that it will try to basically hook into the config that we set for port security standard and admission and you will see that reading the config from this particular file so that will give you an idea that it is actually working or not yes I'm not aware of hand of a way to inspect like in one shot from QCTL get or inspect something right another okay so for folks virtually basically our experts who are helping us here said couple of things if you are using port security admission for namespace you will you can use QCTL describe namespace and then you will see that label where you can set the pss second is there has been an issue open where we want to get a better idea of what is my configuration of an existing cluster for a couple of years but we probably need a cap and it's probably a great thing for somebody looking to contribute and familiar with kubernetes to take it on and help the community anything I missed please correct okay okay let's actually yeah so let's take a look quickly for folks attending virtually the suggestion was maybe it is already part of the describe output as an event so if we take a look at it we might be able to see it so if you see here let's pick the nginx1 kubectl describe I think it's part nginx yeah so let's take a look okay so probably it should be here if it was implemented right so yeah so it's not here but we did get a warning so that's a pretty good idea or a pretty good indicator that the cluster config actually is working because we wouldn't have gotten a warning if it actually wasn't set correctly so that's how it would look like and now going back to the demo since we need to keep moving let's go to the next task anybody added any issue in the github repo we can take a look after this task as well so the third task is about runtime secom profile how many of you are familiar with what secom filter secom profile is okay alright so I have another analogy for you it's a system call filter system calls are essentially ways for you to ask kernel to do something if you are in user space and filtering of those system calls is going to allow you to reduce the exposure to your kernel if you are running something malicious in user space of linux so linux just very briefly divided into two roughly rough parts user space and kernel space user space is lesser privileged has to depend on things in kernel space and system calls are a way to move around between those one of the fundamental things is that the system call filter isolation has been secom filters since docker became popular there have been very great very important work done multiple years ago by somebody called jessie frazzle who created a secom profile which really worked for vast majority of workloads all around the world and she writes in her blog she literally tried it for multiple images in docker hub and made sure that whatever profile was being created was actually going to work and not break things in production for anyone so massive thanks to her most of the new secom profiles in new container run times are using that work and pretty much the profile looks similar so we will take a look later the idea is when I am going to block some system calls I want to block the ones that are going to break my container isolation boundaries so if you are running a container somebody else in your team is also running a container you end up being in the same node you don't want those two containers to be able to affect each other in any way so what the first container does should only affect this container second container shouldn't even know about it when a system call could actually change the behavior of the other container that's when we want to block it because it's essentially making the isolation boundaries and the reason you see the tea and the saucer and the filter is if you make tea with leaves or like dried leaves you need that filter in between so that when the tea goes into the cup you don't want the dried leaves in your mouth when you are drinking the tea so the filter is going to remove the stuff that you don't need so you have a very smooth very nice experience when you are having tea folks who make tea at home probably can understand what I am saying so for folks who are not aware how many system calls are there are a lot 300 and counting which makes it even more impressive the work that was done before to see which system calls would work if we removed it and whether it would break anything or not the runtime default of a Seccom profile is essentially what my container runtime is doing so in the beginning if you remember I mentioned container D, cryo and even Docker in the beginning when it was used as a runtime for Kubernetes would have a Seccom profile Kubernetes long time back made a decision for things I am not aware of to not use that container runtime profile as a default so if you are using Kubernetes and you think container D, cryo by default has a Seccom profile I am going to automatically benefit from it that's not true at least not yet unless you do what we are going to do in the rest of the tutorial so the runtime default is a new feature which tells Kubernetes can you use this container runtime's default profile for all my pods that are going to create containers under my container runtime so as a result of that it's minimal work it is not going to break most things there is no guarantee it wouldn't break anything there is a chance it would break so always anytime you want to change any configuration or cluster the highly recommended thing is to test it in non-production development environments let it soak for a while let it run for 6 months with that configuration and if things don't break then you try to see slowly maybe in one cluster then second cluster and then eventually have also a role black plan where you can quickly move back to original configuration if needed there are three other fields or the same for the seccom profile you can set it in three ways one is unconfined which was the default for a long time which is essentially don't use the seccom profile I have second one is the one that we talked about local host is another one where you can go really crazy and there are some really nice tools about it where you can define your own custom seccom profile any specific pod in your cluster so as a result of that many times the things that are blocked by default are great but you can block maybe more if you are using doing something simple as running a web server or running some gRPC peers who want to talk to each other then you need way fewer syscalls than you would actually need in a full-blown java application for example so you can do that with using something called localhost which is custom seccom profile for any pod that you want we won't go into too much depth details into it but that is a good option if you want to advance even more the security in your cluster if you haven't been using seccom runtime default is definitely a good first step towards improving the security of your cluster what does the default seccom profile look like for a container d or a cryo workload so these are the links to it we are slightly behind time so I won't go into details of looking into it but basically it will have a block which says which syscalls are blocked it will have a block which says which syscalls are allowed and that is the profile that the container and time uses anytime somebody like a container space says I want to use this syscall and the kernel can you help me and the filter will come in between and say no you are not allowed to talk to kernel with this syscall that's basically what it is and seccom filtering with customizing it looks somewhat like creating a pizza where you have a dough where you have toppings and there was a great keynote about pizzas in Detroit so you can create pizzas that are square shaped pizzas that are circular you can create pizzas with different types of cheese paneer, mozzarella you can make an indian pizza you could make a chicago style pizza but at the end of the day everything is a pizza so everything is a seccom profile but your profile might look different than somebody else's so that's basically how the customizing works what we are going to do with testing isolation boundaries is it blocks syscalls like I said it also the default runtime profile also blocks something called sys underscore time which is essentially something that allows you to change time system time of your container and the tricky part of it is if you change the system time in your container it changes the system time in the node so all your containers suddenly go back even if you don't want all the containers to go back in time and that can create some weird attacks that you could do so we won't go into what kind of attack would work but that is possible and that's why it is blocked because it breaks the isolation boundary so we look at one where we don't set the seccom profile to runtime default and see how the time changes and we look at another one where we try to change the time and it actually doesn't work it says operation denied so setting up the seccom profile this is this texture is a bit small hopefully you can still see it the bold ones are essentially the settings we need so the cubelet extra arguments this is similar to the other one where we had a kind cluster we had a cubium config and if you see here it's called seccom default set to true and then another one for worker nodes as well which is seccom default set to true so and then there is a feature gate called seccom default true so all of those will make sure that it is by default going to point to the runtime seccom profile and when you use it you get the benefit of it in kubernetes now so the demo is going to look something like this if you try to exec into a container that is running the default seccom profile and you try to change the date you will see that it will say oh I cannot set the date operation not permitted and if you check the date it is actually not changed it's still what it was at the time if you run it without seccom profile it will actually change the date and if you see later in another pod so if you see forever asleep again is the other pod it will actually change the date in that pod even though you change the date in just the forever asleep pod so that's big breaking container isolation boundaries we don't want that that's why having the seccom profile set to runtime default is useful so let's look at the demo now so if we go back to the terminal and go to seccom runtime default there are two files one with and one without so let's run the one with sorry without first and we'll do the same thing it will create a cluster it will use the configuration we set to default to the seccom profile that's used in your runtime and then we'll try to change the date and see if it works or not how many of you are liking using kind so far right yeah it's really cool I really enjoy using it as well any questions while this is running was the introduction to seccom did it make sense any questions on that okay cool so we got the cluster we are installing cni same thing cluster info context it's setting to the cluster name oh you had a question go ahead yeah so that's where the previous task actually comes into picture if we use privileged the seccom default can actually be overridden and so if you remember we had three port security standards restricted baseline privileged if we run a pod as a privileged pod it will essentially run as seccom default as unconfined so it will not be filtering anymore using the runtime default and as a result of that if there was anything like ptrace for example which is sometime useful and is blocked by default you'll be able to use that if you run it as privileged another option is custom seccom profiles where you can customize the existing seccom profile create a file that says I want this call I want to remove all the others and then use that as your default for that particular name space then you're able to do that as well in my experience personally the blocked ones I hardly had seen to be needed for any standard application like a web server or a database or anything like that anything that is available by default most of the time works out so we got this two pods now created pod forever asleep pod forever asleep let's see if this is working so ok I am already in root forever asleep now what I am going to do is try to see if I can change the date using this command so so we should get an operation not permitted here oh no we should actually not get the operation not permitted because we are running without a seccom profile so the date should change and if I go here again the date is actually October 28 let's try again ok so there you go so the date has actually changed most of the times if you're known as an NTP server it will reset the date so you're fine most of the times but this is an example of like it can actually do it and if you want to see how it actually breaks the container resolution boundaries we would do something like running it in another pod and see if the date has changed so if I go to this tab and how much time we have ok we are almost there so if I go here and go to seccom do kind without so it's the same command like before what I'm going to do is this is already done so we'll go here and instead of asleep I will set it to asleep too alright let's see if the date is so the date has reset let's try to change it here so date is changed here and date is changed here as well so it's two different pods but because you change it in one place it changes in the other pod which is not great which is why it's blocked so now if we go back here exit run the same thing with seccom front time it won't even allow you to change the date in your pod and as a result of that you can't affect the other pods that are running did that make sense so some of the things I was wondering about is like if I change the date and the license is set up for my software to expire after some x number of years or it cannot run for an older date than January 1st 1970 what would happen so that's an interesting thing to think about and you don't want it to happen to any of the pods we are running which is why having that kind of seccom default is always useful there are many other syscalls that are blocked as well not the only one but in terms of demo specifically this made more sense in terms of really understanding like oh I am actually breaking the containerization boundary here so joining the worker nodes again and now we'll have another cluster with seccom with runtime default and we will be able to try and run the change the date again and hopefully we should get operation not permitted error anyone been able to follow along on their laptops completely so far okay great all right I see a few hands okay so this pod is now created so you'll see that this prompt stays there for a while the idea is when you ask the pod to be created you get a response that the pod is created but it's not sometimes available because it has to go in the running state until you can execute it so I put a sleep 30 which is a random second number of seconds and after those 30 seconds or so most times the pod actually is running and then you can execute it so that's why it stays there for a while and then it goes into this patch and if we now try to change the date okay I got the wrong one so let's go back here and oh maybe in the slides so copy back here change the date as you can see it says operation not permitted so that's the goal and you'll see the date output still but if you see here the data is still old still the current one so we can try again if it was not visible earlier and if we see here the date hasn't changed so that's basically one of the ways we can do the second filtering now this was the demo and we'll take about let's say five minutes break for questions and then I have another demo where you basically end up setting PSA second together in one cluster so for the if you don't have questions we can try that otherwise there is a script in the repo where you can try that and one of the things I'll share that I didn't mention earlier is by default there is a capability called capsis time which also blocks this operation so if you use restricted port security standard and if you remember back to some of the slides it was saying you need to drop all capabilities if you want to use restricted port security standard so let's say for some reason you don't want to use or you can't use seccomp or you want to do it later if you switch to restricted first and drop all the capabilities and even if your seccomp is running unconfined it will still not allow you to change the date because you're dropping all the capabilities and capabilities is like a linux term what it essentially means is what am I allowed to do when I talk to kernel and there are about 15 plus capabilities if I remember right which give you a big set of permissions so one of them is this time then there are some other things like cap netraw which is another somewhat dangerous capability to use so if you drop them with restricted don't use seccomp it should still work if you use seccomp default don't use restricted it should still get blocked because even if you add the capability like I added here I added the capability but because I was blocking it in seccomp it didn't allow me to change the date so it can purely for system call filtering you could work around it you could use both for defense in depth so it's really up to you play around with it both of them can work together and that was one of the demos but yeah I would love to answer more questions instead of the demo unless people are interested to see the demo so who wants to see the demo who wants to ask questions demo okay alright let's try that so we go back here I will mirror again oh it's already mirroring okay great if we exit then remember the cluster I deleted that's the one we are going to create now so all together is basically combination of PSA plus seccomp and there should be one file only and it's going to do the same create a cluster pick two configs now one is the port security admission config second one is the seccomp config which is basically saying please use the runtime default seccomp and with those two configs it will create a single cluster and both of them will be set and enforced at the same time so what we should expect is the nginx pod for example should still get the warning that we got last time the forever sleep pod which we are using a minimal pod spec for it should also get a warning and if we go in that pod and try to change the date we shouldn't be allowed to change the date so that's what we should expect because we are setting both of them in the same cluster the good part I'll share later is most of the things that we talked about the official documentation in Kubernetes also goes in much more depth many of the things I've written myself in the docs and some of them I have reviewed so please continue to use that as the reference even for future because I may not be able to continue updating the repo as the new versions for Kubernetes come up but the official docs will always be updated because it's all community work not just me trying to maintain it so I'll share links in the slides for all the official docs for all the things that we did so if you see here we got the pod nginx created but with a warning same warning as before and what we should expect now is when we create the other pod it should also get the same warning because we are using minimal pod spec just like this and now if we go inside that particular pod and try to change the date it should fail any quick question anyone has before we move on and wait for the pod to go to sleep the forever asleep name is basically because we are trying to put it in sleep because if I don't run anything as the exec for kubectl the pod will basically die after it is created because it has nothing to do so we just put it in sleep so I can exec into it and then do whatever I want so it failed here it's now inside the pod so let's go up here again and hopefully I have the date command in my buffer and if you see here it's not it's saying operation not permitted and the date is still the current date so that's what we expected that's what we saw and both of them are working together essentially in this case now back to slides I will extend it again and so we brought it all together we could do the same verification step before these two as well because it would work for any release that you are using then you we could create a cluster like we did with both together so definitely I would say try this at home when you are done setting up all the three tasks one by one and see if it works try to run maybe a sample pod that you think could work or not and see if it gets whether you get a failure, whether you get a warning try to play around with PSS, different PSS baseline restricted, privileged try to set it up in different modes and see what happens and yeah try it around see if it works I am open for questions if you have any I would love to answer more and hope this was really useful thank you yes you had a question the official docs if I remember correctly say version 19 is stable but one of the things I should have here I will add it in the slides in the SCAD later there are links to the specific docs that cover all of those things and every Kubernetes document will have at the top from which version this document is valid or not so we will be able to take a look at it so if you have any questions or comments or want to say thanks or have follow up questions specific debugging questions definitely add issues to the repo if you have specific questions that you come up with later and thought I wish I could have asked if you are on twitter please tag me there I will try to answer I should be able to have some time until the end of the weekend and if you want to give specific feedback for the session to CNCF this is the QR code if you found it useful if you found things could be improved I would love to hear from you for any future sessions I do with that thank you very much hope to see you for the rest of the kubecon lot of good security track sessions for the rest of the day and if you are heading back home happy journey and see you next time


and it's called Kingsnake. Check it out, check out their page, if you ever get a chance to go along. Do you know what else I will definitely, well probably not this year, but I'll look forward to going to here the next year. Just love that bit of rock now and again, it just blows the car away, so well done, that's absolutely brilliant. But I'm telling you now, check out the video that I've done and it's just brilliant, it's a really good crack. We love the rock, we love the rock and roll. 13 minutes after eight o'clock and what's the night, is it Monday I'm forgetting the Monday nights and everything, hang on a second here. Yeah as you say, we're with you right through until 10pm as always and we say hello and we welcome to our very first guest on this Monday night sessions, the 21st of November and we say hello and welcome to future. Moio. Thank you Paul and all the listeners of Highland Radio, thank you very much for having me. You're very welcome, it's lovely to see you and thanks for dropping in. So your story, I was talking to you beforehand when we were outside and you're here about four months, you've moved from Zimbabwe, is that correct? That is very true, I'm from Zimbabwe, but before I came here I was in South Africa, which is a neighbouring country to Zimbabwe. Okay and you've moved here with your wife and your child? Yes sir. Settling in okay in these parts, yeah? Everything happy. Good, well that's the thing and tell me this and tell me no more. What was I going to say?  Of course, yeah, especially in Zimbabwe. Look my story of music starts way, way back in 1996 when we started as children going to school, so at the primary school we started as a soccer team. Then after I mean losing to opponents, yeah of course, then our coach who happened to be a teacher at the school as well called Mr. Lucius Nube, I said, you know guys, you better I mean change from I mean from soccer to music because it looks like you guys are losing. You can recall now as we sit here, there is a World Cup happening there in Qatar, so I mean you can imagine somebody saying, oh this team must rather change from soccer. To music? Yeah exactly, this is how we started singing 20 years ago I'm sure. That inspired your musical path then more so than your soccer path. Do you still play a bit of soccer? Of course, given a chance to hold and play better than Ronald and Miss. Do you? Yeah. Oh there you go, you're modest with it, aren't you? So your group over in South Africa was called Ammavinani. Of course, you tried. I thought, yeah, you tried. Do you want to give it a try one more time? Yes, you tried. Well done. I tried. My group is called Ammavevane. How many were in your group? 10 members. 10 members? All male members, yes. Oh very good. And where did you sing in South Africa? Did you sing locally or did you expand? Of course, it goes beyond locally. We sing from corporate events. We sing to wedding events, birthday parties. We sing in churches. We even comfort people. We have lost their beloved ones in funerals. We can sing there, of course, and we conduct some workshops from various places from schools to churches, individuals, communities, and large groups. Okay. Are any of your older members of your group here in Ireland with you or is it just you? No, no, no, it's just me at the moment.  I'm a solo but I carry them every time I go because I can't stop, I mean thinking of them because there's always their music in my head. Did you record much over there? Yeah, of course, we have got a couple of albums, yeah, of which and our, I mean our fans, they love, they love our music. Excellent. And from South Africa to here, it's a big step but you've brought your music with you because you are working currently with the Donegal Volunteer Center? Of course, here in letter Kenny, I was going to mention that it's amazing because I was received with warm hands by the Donegal Volunteer Center. From there we have managed to set up a local intercultural choir called the Newland Choir. Wow. So with people from more than eight different nations, it's so amazing, it's exciting, yeah. Excellent. Well, you haven't, you know, you're not here a long time you're starting to make a good headway on the music but what kind of music is the choir doing? Which choir? The Amavevani Acapella or this choir? This choir here, sorry, a bigger part. Of course, look with this choir what we're trying to achieve of course with the majority being ladies but we're trying to get them to sing what we call Acapella. Yes. All right but now having a situation whereby it's people from different nations, we go on to promote each and everybody's background, they bring their language here, we come up with something yeah, yeah we come up with something yeah but for now we are busy with Acapella music. See music travels through all nationalities doesn't it really? So it's a good way of bringing people together isn't it? Of course, they say music knows no boundaries. Right, we would love to hear you singing so you're going to do Acapella for us first? Of course and the first song you're going to do is the song that I'm going to sing now it's a gospel song called Reveal Myself and is this a song is this a traditional song or is it? This one is a gospel song as somebody who's a believer in God I'm a Christian so I felt like let me do a piece of this one. Brilliant, well we'd love to hear you when you're ready. For God so loved the world That isn't, that isn't His begotten Son Jesus That who ever, that who ever ta-la-la-la lives in Him Shall not die, shall not die, but lives longer He said I'm the bread that comes down from heaven I'm the bread that comes down from heaven I'm the bread that comes down from heaven I am the living bread Jesus, Jesus, Jesus, Jesus, Jesus, Jesus Oh come to me You know I can still go on and on and on. That's brilliant. Thank you very much. Yeah look when I'm doing this now that's when I miss my dear brothers there. I remember all my my my acapella crew there, Slinganiso, Sam, Minlaki, Musa, Bonisim, Loiso, I'm mentioning their names Makosini, Ezekiel, Mafotla, you know I start to think of them. Yes of course as I sing now I can hear their different I mean vocals, their different keys coming in. So obviously singing the guy brings back a lot of phone memories. Of course. We got someone texted and said reminds me so much of Lady Smith Black Mambazzo. Did they say so? Fabulous yes indeed there they did so there you go that's a nice compliment. Of course. And you do have a connection to Lady Smith. Yeah yeah we have a connection with them but now we also love to remind all the fans that of course the founder of the Lady Smith Black Mr. Professor Joseph Shabalala passed on a couple of years ago but the good thing is his music, the music lives on because his sons and the other members are still taking it I mean to the world. So of course we have got a connection with them because we keep on listening to them as they are a great inspiration to what we are doing. You showed me a photograph of your own. I did show you a photograph where I was sitting with next to the legend. Yeah thank you. That was a big thing for you. Of course he told me personally I remember I asked him what must I do so that I could my group also could look like you he said just keep it going love your your guys keep them you know I've never told anybody now but I'm revealing that secret to you today Mr. Paul. Keep going yes keep going. Keep going never stop we don't say a mean to me here we just keep going. Of course. Keep going that's no true words keep going keep the music going. Right we're going to take an abrick we are live in studio with Mr. Future and he's got more music for us on the way don't go away Highland Radio Monday night sessions Monday night sessions in association with Blake's bar Letter Kenny 30 17th November Blake's unplugged the haunchos with John McGrory Neil McGrory and Brian Booner. What's gravity when does the grass grow greener can people with longer legs jump higher power plastic cup mate how filthy are our parents which ingredients make the best line why do we dream are you faster than a calculator could a robot be powered by fruit or vegetables kids are full of curious questions ESB science blast delivered by the RDS empowers children to investigate the science behind simple questions just like these ones find out how your school can get involved at ESB science blast.com The cabin man is back to help you get the best price cars and dunny gore iMotors have the largest selection the pre-owned cars from small cars that are handy and short to seven seaters for the whole family shop up online to iMotors.ie for the best price cars around it doesn't take a lot to achieve a lot particularly when it comes to covid flu and other winter viruses remember to keep doing the simple things like cleaning hands wearing masks opening windows as well as keeping up to date with your vaccine and boosters and staying home and sick or displaying symptoms we know these steps work and they'll keep working as long as we do them let's keep on top of covid flu and other winter viruses brought to you by the government of Ireland armacola jewellers in letter candy are synonymous with fine jewellery quality watches and giftware with stores at main street letter candy and the letter candy shopping center or online at armacola.com you can choose from their quality product range and a relaxed atmosphere and their sales staff will be happy to help you make the right choice whatever the occasion armacola jewellers making moments magical for generations my brother's coming home this christmas and he hasn't been home for years and we miss him so much and we cannot wait to have him back christmas is a special time of year where families should be together do you have loved ones who have not been home for christmas for a number of years have you all missed out on family get-togethers highland radio would like to change that this year for one lucky family simply email us and tell us why we should bring your family home to dunig all this christmas to home for christmas at highland radio dot com or visit highland radio dot com and complete the entry form closing date for entries is monday 28th of november this is highland radio with hall mcdevitt certainly is monday night sessions and you're very welcome back and we're delighted we are joined by the one and only mr. future who has he's got a great story about music and and i'm just i was talking off here and i'm i think it's amazing that people can bring people from different nationalities together when maybe they just might and be able to come together uh can anyone join your choir of course yeah this newland choir here if they are interested i would ask them to uh contact the dunig all volunteer center and that's here never can yeah of course they're gonna assist the authorities will assist them brilliant and what can what does it say what happens there is you know your people come together and they get so much out of singing uh plus the fact that they're making up friendships that they might never have done so you're doing very well dad um you're you have a couple of gigs coming up here in donny gall you're you're doing the uh the christmas lights yes this friday night here in larry kenny yes tell us tell us what people can expect of course look um i mean with the irish context i'm told christmas i mean it's well celebrated here which is very good we also do the same back home there oh do you yeah of course but the difference maybe would be the songs that you sing here and the songs that we sing there but everything all in all it will be christmas celebration look uh for the upcoming uh letter kenny christmas lights i would ask um the audiences or the fans to come in large numbers and have a look at this newland choir here we'll be performing a few christmas carols they can expect those harmonies i mean music you know from different people you can imagine people from ukraine i mean uh uh poland um macedonia i mean there is a lot of countries involved and zimbabwe you know all singing a christmas carol that would be so amazing but it's lovely and you're looking forward to that of course i can't wait you have another gig then this is about one and it's in the angriene theater yes on the 11th of december so tell us about that that's uh i mean an indoor gig that's my one of my favorites again i would say um i look forward to it of course yes look uh with my choir some of them maybe it will be the first time i mean to perform in front of large audiences because i'm told that wall might be full of people so i think it's gonna be amazing if people want to go along um where can you get tickets from angriene theater itself yeah of course i would say uh uh they can go there and find and inquire more about about that okay yeah of course social media are you involved in social media like facebook and have your page at the moment i do have a personal page yes i mean on social media people who are looking for me they can search for future yes index index is in n dex mojo or they can search for my group amma vevane acapella amma vevane acapella or if they still find it difficult they can be they can contact the donegal volunteer center they can get leads yeah thank you do you enjoy that kind of work down there is it just singing you do down there already i do yeah singing is my life i do of course i can be having other things that i do as party time but music runs in my blood was music uh was music a thing at home growing up when you were smaller was it was music uh in your home i started music uh at the age of seven years started it started right inside the kitchen of my mom my mom is a singer she's still there she sings she used to conduct i mean sort of like some musical sessions after supper she'll start a song a church song and expect all of us myself and my siblings to come i mean join her she was the choir director oh seeing at home there so you know you're no choice of course yeah and she was screaming if you are very good so yeah well you know i said don't know harm i don't know harm i kept you i kept you in good stay did they say kept me moving well the plans what's your plans here um as regards going forward music workshops or music or yeah look um my plans here still uh i'm still four months but i i hope i'll be i mean uh integrating and meeting a lot of people and getting to know uh i mean what irish people i mean their context i mean their lifestyle you know but i look forward to i mean engaging in special schools or and individuals i mean churches and everybody who might love to get an idea of this type of music especially with african context you know yes even drumming sometimes other people they just love drumming not singing that's right so i can also pitch up there and see that's great you know i think i think future has a big future here in ireland and we look forward it looks bright it looks bright i have to say your name is amazing when i seen the name your name future i thought i'd never met anybody called future yeah look i'll tell you a story sometime back i used to work in a restaurant as a waiter a waitron here of course and most of the customers they wouldn't believe that it was my real name don't say to me what's your real name i said that's my that's my name yeah future very proud of it back to the future we would buy the future we would love to get uh would you do us an or a cappella one yeah of course that what's right this one what oh this is uh which one can i do oh let me do this one called chocholosa tell us a wee bit about this song for us is it a hum or is it a song yeah it's it's a work song a work song okay yeah many musicians around the world i mean uh have learned about the song and they are singing it we are told it started way way back during the 1960s when i mean migrant workers were working deep down in the minds of south africa searching for gold yeah and so they were addressing all those i mean circumstances happening there law they were paid poor salaries poor working conditions i mean long made to work for long hours etc etc and they were traveling the most important thing about the song they were traveling they used to travel to and from work using a train so the train was going forward keep going forward so that's the name of the song chocholosa lovely so we are also singing it this way oh look i've taught the new land choir as well as we sing it back with my guys the the amafiv and a capella so i'll just take one or two from both choirs look lovely we're ready here you when you're ready chocholosa chocholosa chocholosa from the mountains on the train from Zimba keep on going keep on go home the mountains on the train from Zimba let me do it in Irish come come come how does Irish come in let me remind myself I come on I can't brilliant absolutely brilliant thanks for sharing that with us really appreciate that and see you that the style of music is something else and it just needs to be brought here and spread the word that's what it's all about we're gonna take a quick outbreak again and we're back with the final track from Future Mojo and I will tell you once more again about the up-and-coming gigs and this Friday night the Christmas switch on lights here in the UK is going to be an amazing night don't go away Monday night sessions in association with Blake's bar letter Kenny Sunday 20th November Sunday evening session with swamp shag shakers featuring Shaq Mikhail and James Graham trad session every Monday night all musicians welcome oh looks like last minute Liam is in a spot of bother he missed out on saving up to 50% on Expressway coach tickets and guaranteed seats by not booking them early enough online but not to worry Liam Lucy booked them in advance instead now all you have to worry about is not forgetting Lucy's birthday oh dear silly Liam offer applies on route 32 between letter Kenny and Dublin don't be a last minute Liam and Lucy book your tickets in advance online at expressway.ie from the smallest shrug to the largest tree in an awkward place Donnelly tree services provide a complete range of tree surgery services whether you need to remove a dangerous tree or some nuisance branches Donnelly tree services have the experience and expertise to carry out tree surgery to the highest of professional standards call 08 3 005 939 Donnelly tree services Donnelly call no job is too small no tree is too tall the O'Neill Sportwear Black Friday warehouse clearance sale is coming soon open from 9 a.m. Thursday 24th November ends 5 p.m. Sunday 27th of November County GAA jerseys leisurewear including t-shirts tracksuit bottoms half zips hoodies and jackets all reduced to clear common grab a bargain at O'Neill Sportswear warehouse off the Melmont Road roundabout Stravam the winds have changed for board nemona and commitment to green energy has become our home turf it started with Ireland's first onshore wind firm at our Bella Correx site in County Mayo and we didn't stop there now we're delivering renewable energy including solar wind battery and biomass surprised well now you know we're more than Mona for more on our climate solutions visit board nemona.ie choose your mastercard this winter and you could get 10 year old back when you make three purchases maybe it's the bus tour popping out for milk or bringing home food for the cat why not make us your payment card of choice register now mastercard.ie forward slash registered to get and you could be one of the first 20,000 people to get 10 year old back with three purchases 18 plus Republic of Ireland residents mastercard cardholders only from midnight 10th November until midnight GMT 11th December 2022 offer ends when 20,000 entrants have qualified for cashback full season C's MST or dot cd forward slash IE terms this is Highland radio with Paul McDevitt yes it is and it's just come in 22 minutes in front of nine o'clock on a Monday night you're very welcome and you just churned our way don't forget you can check us and follow us live on highlandradio.com and our first guest tonight has done two acapella tracks for us and the we just want to share with you the up and common event on this December the 11th and it's down at the Angrenan Theatre here in Lerner Kenny and it's the D M E P Christmas concert and it starts at five p.m. ticket price is 10 euro under 18s five euro and a family of four 25 euros so that's a brilliant so contact details for the event at theangrenantheatre.com or just call in and see them so well done. Future thank you so much for coming up to us tonight we really appreciate it. We wish you great success going forward and people don't forget come along this Friday night what time should kick off Friday night eight seven six six o'clock and it's the usual switch on with the lights. It's the usual big M.C. going to be there. Is he?  As I said we can check out I'm a VVAM me. Did I say it right? Yeah. That's that's the choir in South Africa and check out you can actually check out on on YouTube and stuff and that's right. YouTube everywhere on social media platforms everywhere. We are everywhere. We are the butterflies. And if you want every if you want any more information and go along but if you if you're interested in joining the choir it's contact the Donegal Volunteer Centre here in Lerner Kenny and they would just love to see you and welcome everybody in with open arms. Fitcher the pleasure's been ours. Thank you so much for coming up and sharing your story and sharing your music with us. This song we're going to go out with. Tell us a bit about it. This is a very famous song in Zimbabwe where I originate from so it's a folk song a traditional song. Look it reminds people who had left their homes going to different workplaces that wherever they are they can still remember that there is no place like home and it gives hope to people. So if I were to I mean bring it to our present situations I would say it tells us up to be hopeful that one day they will always be light at the end of the tunnel. Listen it's been an absolute pleasure. Thank you so much indeed. Thank you. This is a what's it's what's the song called? Kubu ka langa.


Anakota everyone and now I'm on the other side of the fence. It feels very, very, very nervous. Thank you for the opportunity to present to the VIDM conference today. It's a real honour to be talking to my colleagues and friends from around the world and it's just amazing to see where everybody has come from and some people who are staying up quite late so thank you very much for joining us today. I'm presenting on behalf of our team who have all made a contribution to this particular study and the list of them are there on the front page. This was very much a collaborative project. Our aim was designed to close the loop on a suite of student focus projects where we sought feedback from students on their experiences in the blended midwifery program at Otago Polytechnic. In the study we sought feedback from midwives who had graduated from our program. We wanted particularly to ask them about how well prepared they felt for beginning midwifery practice and what they believed would have improved their experience. An invitation to complete an online survey was sent to their last known email addresses and these were the midwives who had graduated between 2011 and 2014. No personal details were asked for in the survey and to preserve confidentiality a research fellow was employed to administer the survey and to download and de-identify the data or data rather. The survey was opened on the 20th of September 2016 and was made available for eight weeks. Reminder emails were sent at four and six-week intervals. From a possible 174, and I appreciate you won't be able to read this, 174 alumni, 163 emails were delivered. After two reminders we had 42 alumni complete the survey and this resulted in a 25.8% response rate. The questions included the midwives year of graduation, the current area of practice and the services that they offered to women. We wanted to know how prepared they had felt themselves to be when they began practice and what aspects of their midwifery program they believe had prepared them well and what additional content would have been useful. We also asked how well the program had prepared them to work with women from different cultures. Finally we asked if they had enrolled or were considering enrolling in postgraduate study and what topics would appeal to them. There was a higher response rate from midwives who had graduated in the recent years. Now it's possible that email addresses for earlier graduates had changed given the time frames. More were in lead maternity care or LMC practice than in hospital work and none were currently in education or research and just one midwife was not currently practicing. The midwives were working in a range of areas in urban, in rural and remote rural practice settings and they offered birth care in an equally wide range of areas such as community and the hospital. In response to how prepared they felt remembered feeling for practice only 16 had felt really well prepared with 20 unsure and six not feeling well prepared. These reflections contrast with those that we found in data from the three graduate cohort surveys in 2011, 12 and 13 which showed that at the end of their programs all but a few graduates felt well prepared for beginning practice. So there was a difference once they got into practice in terms of how well prepared they felt. The aspects of the program that have prepared them well included unsurprisingly the practice placements with the face-to-face tutorials and the intensive classes also popular. The comments however were mixed and clearly show that the overall combination of program elements appears to have covered the range of student learning styles. So they learned from their face-to-face and practice which were their preferred learning places but they also learned from the online and the tutorial sessions as well. Midwives were asked to comment on how well they believed they'd been prepared to work with women from other cultures and it was encouraging to see that the courses focusing on cultural diversity, the Māori health paper and the Nohul Marae where they stay on a Marae overnight and engage with activities on the Marae and a Treaty of Waitangi Workshop helped shape their thinking not just for working with Māori but also with women from other cultural backgrounds. Further comments provided insights into the graduate to medwife experience and four broad-themed areas were distinguished from the survey responses. These were the importance of a sound knowledge and practice skills base, the ability to manage both the self and their practice and the need to develop confidence and the importance of a supportive environment in which to grow as midwives. These are represented in the VIN diagram as a series of intersecting circles. Each factor needed to be present for optimal transition to practice that appeared and these transition elements are further illustrated with quotes in these following slides. The theme of knowledge and practice skills included those skills associated with working in secondary and tertiary settings, supporting women to breastfeed, managing miscarriage and competence in challenging social situations. This included also the skills to work with other health professionals. The students recognised however that it would be hard to prepare completely for the range of experiences they were likely to encounter. Examples offered included working with women from communities with high levels of drug abuse and violence which some felt unprepared for. Managing time and their business was commented on by eleven of the alumni and included aspects such as tax and GST and a district health board negotiating the district health board contracts and the protocols that were present in each of these settings. And while the challenge of managing time and stress is not unique to midwives, the 24-hour nature of midwifery practice and the on-call demand for LMCs in particular made this an important issue and this was clearly demonstrated by Karen in her talk this morning. And this included preparing their families for the realities of midwifery practice. Quite a lot of midwifery literature in the recent years has addressed these challenges some by Donald and Wakeland and Skinner and there has been quite a few coming out of New Zealand and from other areas around that demand for that 24-hour coverage and the stress that is for midwives. Similarly, getting familiar with local protocols and the art of consulting and referring to obstetricians and other health professionals was a recurring theme throughout the findings. While feeling competent to practice, confidence was more elusive for the newly graduated midwives. There was a sense of nervousness and of having to prove themselves. Others commented on the awareness and overwhelming reality of the responsibility and this included not just experiencing the positives but also the negative aspects of the job. For these skills to come together required a supportive environment, a place where they could consolidate their midwifery knowledge and skills and grow their confidence. The literature tells us that supportive and approachable midwives have a facilitating effect on the confidence of new practitioners and the perception of their competence. So how well they've been supported in the time that they've been coming through their program in their placements and in those early experiences in practice are from midwives as important as anything else. So while the newly qualified midwives are frequently challenged by the transition from student to beginning practitioner, the support of others, especially mentors and fellow midwives, can ease this transition. And this is summed up by Barry et al. whose study showed that a supportive environment enables midwives to work through stages of personal development to an appreciation of the bigger picture. And this support is as Kensington in 2015 observes the responsibility of the whole profession. Eight of the 42 midwives had enrolled in postgraduate study, which is not very many, possibly reflective though of their relatively recent venture into practice. Reasons for enrolling included opportunities to advance their knowledge, their career options and access to the latest research. And the topics of interest included a range of practice issues such as lifestyle change, business management, family planning and fertility and mental health issues for women, possibly reflecting situations they had met in practice and felt challenged by or feeling they needed more information on. Current study has some limitations of course. Firstly the response rate was 25%. And therefore may not be representative of the alumni population for all five years. The response rates to online surveys do tend to be low overall, so we were happy enough with 25% given some of the low expectations from online surveys. However the midwives who did respond comprise a diverse sample of both lead maternity carers and hospital medwives working in both urban and rural areas and covering the broad range of birthing environments from home birth to tertiary facilities. And these percentages align approximately with the 2016 workforce report from the Medwifery Council of New Zealand. Secondly the method combined with the broad sweep of questions may have mitigated against an in-depth analysis of the phenomena associated with the transition to medwifery practice. And we see that there is still plenty of room for exploring this in some more depth. Further three of the four themes resonate with the extant literature relating to the support and development of medwives and studies around the transition to practice. So what's already out there is still resonates with that literature. So what can we take from the student feedback to continue to enhance our program? Firstly that the mix of modes in the Blender program does provide benefits for studying locally while providing opportunities for shared learning and face-to-face interaction. And the model from the study provides a rudimentary map of the elements that need to be blended into each aspect of the program. Specifically the results provide opportunities to focus on some of the challenges of personal and practice management within the teaching and assessment. And importantly the inclusion of simulated situations where students can safely explore and negotiation referral skills and so on to prepare them for working in multidisciplinary teams and for negotiating at the interface between medwives and other health professionals. And this is supported by Murray Davis who states that the newly qualified medwives appeared better able to integrate interprofessional training into practice when this had occurred previously in a favourable learning environment. So our key conclusions were that becoming both a competent and a confident midwife is a complex process involving not just them having had the knowledge and practice skills honed during their time in the midwifery education program but also needing the opportunities to develop skills around managing their time and also their business particularly if they're going into lead maternity care positions. Further practice confidence also requires a supportive environment and in summary a comprehensive program of knowledge, sound practice, development of interpersonal skills within a supportive environment will best equip our alumni to grow in confidence as medwives who become lifelong leaders and learners. And finally we wish to thank our alumni medwives whose candid responses helped us understand their journey into practice. That's not the people who are in our survey of course, that's just an opportunist photograph from a recent group of our new intake. We also acknowledge the work of Alex and Amanda for their help with the survey process and with the data analysis and the Otago Polytechnic Research and Postgraduate Directorate for the Financial Assistance to enable the research to proceed. Kia ora and thank you for listening.