Good morning or evening depending on where you are. Hi. Yeah afternoon, I guess for me at the minute Erica welcome back Congratulations Thank you See now. I'm curious what the congratulations is for Me too. What did I miss Erica? I got married last week. Ah Congratulations And hello Liz Long time no speakers. I know I'll put on my camera How's it going? Hey, it's going alright, so You have very nice background there So Erica that's great did you do like a COVID did you have a COVID ceremony small distanced Small distanced in the courthouse or the clerk's office with masks All that fun. Yeah, all right. Well, you'll have to have a big celebration sometime in the future. Yeah Yeah, that's the plan Maybe next year or whatever. Yep. All right. I think we usually just wait a couple minutes. Hi everyone Hello Howard was going to be able to join today. I Was hoping I Saw his power points or whatever presentation slides. So I was hoping to discuss that. I see Jim Hey folks. Hey Robert Are you doing Yes Again Yes, we can get started I let me pull up the Agenda, I know So wrong document. There we go So now we had a few things on there. So and I Liz had mentioned on our channel. So hi, Liz. Hey, Daniel I see you're on as well We had that as one of the first topics for today and After that we'll go through, you know, some updates that I have wanted to discuss on the policy report Anyone else have any other topics to add to the agenda for today? So then let's get started. So maybe Liz and Daniel welcome and I'll hand off to you Yeah, thanks for having us and I'm just gonna Daniel, I didn't completely convert too much on this beforehand But I've just been sharing a presentation about starboard to a different audience. So I have a slide in front of me so why don't I share that and And then I'm gonna ask Daniel to actually demonstrate sort of what we have so The motivation behind our starboard project was to say We have all these security tools aqua tools other third-party tools open-source tools commercial tools And they all have, you know, different user interfaces. They all create reports in different formats and this is non-ideal for the the user So the idea with starboard is to bring the reports into custom resource definitions inside Kubernetes and We have starboard, which is a Qt control plug-in to provide a common CLI into the different tools and we started off with four different types of security report that we've got in the initial release of starboard. It's very much, you know, experimental But you know, that's how you how you find out what works right by trying it. So we currently support vulnerability information from Trivi, which is our open-source vulnerability scanner Configuration audits from the Fairwinds Polaris tool Then then Qt Bench CIS benchmark reports and Qt Hunter kind of it's like basic penetration testing for a Kubernetes cluster So we've pulled all those different tools and the idea is it would be extensible to other kinds of tool, you know, we'd love to have, you know, lots of different security tools here That information gets populated into the CRDs and as I'm sure Daniel will show you, we use labels to associate the security reports with the Kubernetes resources that they relate to So Hopefully that kind of set the scene and maybe Daniel I can Ask you to show You Show you an action. Yeah, sure. Yeah, thanks for the introduction. I think it's like a great summary and now I will show you How it now it goes like can I ask one question sure The config Tools that you have what exactly are they checking in terms of configuration? I Think I'll be able to show you like a report and then we can walk through Okay type of things it is checking. All right, so Is this screen big enough for everyone? Yes I'm running a developer a cluster kind with a bunch of notes and as we mentioned we have CLI interface for starboard You can install it actually with crew which is package manager for plugins. I Have already done that but just to show you that we already included integrated there. So this is the the main interface for interacting with Security tools but then instead of learning each and every tool it's interface input and output Specification we wanted to make it easier. So for example as a first step you need to initialize the Starboard It's a one-time in it command I will explain in a moment why we need that but actually in this verb is output You see that we have to create a CRD's right? We need to send to go in a Kubernetes API the definitions of the reports that we require Just to have a closer look into those CRD's What we currently have API As you can see we have four CRD's some of them are namespace some of them are a cluster scope if we walk through them It's like a CIS Kubernetes benchmark. Those are typically run on Notes, I will run such a scanner in a second So you run it on a node since node a native resource is cluster scope also this report is cluster scope Then we have config audit reports those are generated by Polaris those are namespace because we associate them with the work so Since workloads such as deployments or stateful sets or jobs or crown jobs or namespace also this report is namespaced We have also cube hunter reports There is no such a built-in resources cluster Kubernetes But anyway, this will be like a namespace. Sorry cluster scope report and then for vulnerabilities the better name would probably be vulnerabilities report But this one is namespace, right? We could check for vulnerabilities a container Images of a given workload. So now once we initialize the The starboard we could create Deployment let's call it engines use some image that we know is vulnerable And now we could use starboard Fine wounds So now we are asking starboard to find vulnerabilities, right behind the scenes. We will create a Kubernetes job And this job will run 3d a containerized version of 3d to pull an image scan it and Create an instance of the vulnerability resource And I will also show you that we are using label selectors to link back the report to the To the actual controller, I'm not sure if it's visible, but if we say like Source name, I think this will be visible, right? So we created an instance so far we are using a uuid for the Instances, which is maybe not the bust But we are currently thinking about like a deterministic names. Anyway, the label is something that links it to the to the deployment We also we are also going to set the owner reference to the underlying deployment So whenever the deployment goes away, we will also clean up. Thanks to the Kubernetes garbage collector Let me just describe and show you this report So those are the labels and if we scroll down to the report, that's the the report sounds like is where the report Starts so we have the artifacts as you can see we have scan at the engines one that's 16 We use 3d version zero nine one and we found a bunch of vulnerabilities It's just a quick summary, but then you can also scroll and see what are the details So in the similar way we could use starboard to Find config Like in potentially insecure configuration of your deployment descriptors if we say Starboard Polaris probably will may change it to some like a similar command to define vulnerabilities like config update But for now, it's just Polaris lack of better name and Also, we are working with fair wins folks to specify the deployment It's not ready yet because the Polaris did not allow us for Polaris is scanning the whole cluster all workloads across the cluster But once we're on it, you will see the reports Showing up again The starboard doesn't have the logic how to scan it. We are using a third-party scanner And now we should be able to see Instances of the Config updates and so if we take and describe config-outlet Report for our Engines deployment You will see that there is a upsor you will see that there is a report and Polaris, we are actually reusing the model that came up with it's it's checking the deployment descriptor at the pod level and then at the container level so Since I created a deployment with a single container called engines. We have a set of container checks For example Polaris checks whether we are using a deterministic pack not the latest Right, then there are some checks for security. For example, whether we are running as a route or or not. So there is a bunch of Settings that visually by default by default in Kubernetes are least secure, right? So this is kind of a host port set Etc. I think for the for the latest list of all the checks and the best source is a Polaris CLI Because again, as I said, we are not adding any additional things. We're reusing what they output Some checks may sense at the pod level such as host feed and IPC set so those are reported as a separate section Before moving forward so those were namespaced CRDs and namespaced check We we can scan with Polaris and 3d It's in every type of of a controller. It can be stateful set demo set Reptica said even replication controller We also have in extension to the octant Octant is this dashboard from PMO where It allows us to Display this information in maybe a little bit nicer way, right? Sometimes this terminal output is not very readable Especially if you have multiple reports multiple containers, but since this is a CRD and we use a Kubernetes API to Read and write data. We could easily extend Dashboards with UI components and we picked octant because it has a nice plugin API So here you can see the vulnerability report for the engines container and Behind the scenes the implementation is very simple because we are just using label selectors If we go here, we also display The config audit report. This is not something that is shipped with octant but thanks to our plugin probably the thing that we should have mentioned in the beginning we have a plugin which is called starboard and then This plugin allows us to Add different sections in the UI and To complete the demo, let me show you how we display Cube bench reports Again, the same mechanism. We are creating a Kubernetes job. This job has a special command I usually we are using the containerized version of the scanner So in this case, we used cube bench and then we generated the CIS cube bench report Currently there is a little bit inconsistency in the latest version because it's still in Experimental phase some of the resources that we create have like a timestamp offended But recently we realized that probably will just store the latest and greatest scan report. We don't want to use a CRD HCD as a database for all historical data. So you will see that a little bit of inconsistency if you try it on your own But eventually we will make it consistent like either use the terministic names or UUIDs Append or do not append the timestamp just for your information and I could also run cube hunter Again, we're running cube hunter Call the help cluster and then we could get the Describe this one so again, there is a bunch of similar same actually properties, but in general Each tool reports vulnerabilities in its own Schema, so we don't have a generate schema yet And probably we won't have for each and every scanner, but you could access this information from the terminal and also We have integrated it With the octan so in octan I can also see the I Could also display the CIS benchmarks report here since this is a work worker node Cube bench automatically detects that it is a worker and worker node and it is running the tests appropriate for the worker node for Cube hunter reports, we do have this separate UI component and as you can see Cube hunter found three low vulnerabilities And with that, I think it's all from the CLI Standpoint we are also working on the operator So all the commands that I was demonstrating we would like to automate so whenever there's a new deployment created We could run this kind of so starboard CLI is a kind of a command-lining interface, but also the library that we want to reuse to build Automation around that. So yes, if you have any questions, I think We'll try to answer them Yes, a few questions and thank you Daniel and Liz a good good demo and great project So seems like I guess first off just to clarify my understanding of some of the goals and what you just demonstrated so seems like You know the the goal year is to try and give a common way of running different, you know security tools and obviously collecting data from them and a Way to output them in the same manner, right? So because the Alternative would be somebody could go run each one of these tools separately, but this gives one unified interface To perhaps I don't know if it also does installation of these tools and upgrades things like that or if it's more about just running in then Gathering the data from these tools I think we wanted to focus on them on the model rather than How these tools are run so Essentially, you know the most important part is to find a common schema for the vulnerability report because we found many integrations, and I think we started with a hardware which is this, you know Container image registry and then we had the same challenge we were trying to define a vulnerability model or Model for the vulnerability report. So then the other third-party Security vendors could implement their scanners. So actually what we've done as a first step in the in the starboard POC was to integrate 3d, but we also want to Advertise and promote this model and saying hey, this is good enough or maybe generic enough Okay, kind of a common denominator for all the vulnerability scanners that you could plug in easily I don't know Claire encore Maybe some commercial scanners. So that was the goal not how to have a Generic jobs runner, but have a common model. So then we could you know Sum up summarize Transform this model, right? We don't have to learn. What is the output of Claire? What is the output of 3d? Well, we you know, we can discuss about the vulnerabilities in terms of this common model. I think also one of the side effects of Taking that security information and putting it into Kubernetes Native resources is that we can take advantage of our back and that's something that our Customer design partners have really they were really really excited about because they can basically Give access to you know a developer team right only have access to a certain application namespace They can see the security reporting just as Right right, so it's certainly making that accessible makes sense, but Again like from the output and what you're showing here. So there's some common structure to the reports, but then each scanner or each engineer is plugging in its own custom data As part of the output, right? So Is that correct in terms of how So yes, but we would hope that I think there's a distinction between Different types of security tool, you know vulnerability scanner does not produce the same kind of output right as a benchmark But vulnerability scanners all produce something pretty similar, you know, they might not have all exactly the same fields But as we know from the the work in Harbor There's a loss of commonality. So it would be great. I think if we can establish a common Definition and then people can plug in whatever Scanners suits their needs right a question from from me if you don't mind So this have you seen the container security operator that the red hat quay and Claire team worked on Okay, so I just reached out on slack to our team Because I think I'd love to have them Collaborate so so kind of what they did was very similar to what I'm seeing here It's initially focused on vulnerability and and it initially is works just with quay and Claire but the intent was to make it pluggable for any scanner and so I Think we have an opportunity to leverage each other's thinking to get common You know common formatting and and content, etc Yes, I can also comment on that because actually I was playing with the container security operator and At the difference and this is actually a good point why and maybe explain why they are different different You can see that the vulnerability CR in our case is Namespaced because of the RBAC that Liz mentioned right which is great. Yeah It looks like data redundancy and it was very tempting to store it at the cluster level because usually you will maybe have in the multiple namespaces The same image with the same digest running So it seems maybe this is wasteful But on the other hand if we make it cluster scope, we don't have so many flexibility to give him permissions to some development teams to check what kind of vulnerabilities they have so the the operator That Red Hat team has is actually storing the vulnerabilities Which are linked not to the workload not to do the Kubernetes container, but they are associated with the image digest and There's a kind of a naming convention where They're using like a Shun number to name the resource right so that's how they they don't use the label selectors, but they could find out whether the given image was standard or not and The other thing is that indeed you need a registry which has a vulnerability API Right, so if you have a Docker hub or your workload is running an image from the Docker hub The Docker hub API doesn't have yet the vulnerabilities endpoint So it won't get this information ready. We wanted to have something more Yeah, no, I and and honestly I was not deeply involved with the CSO with the container security operators So definitely sounds like I can't imagine though that Red Hat would not Have applied our own RBAC to the results because everything we do Consider as multi-tenancy in the cluster but but I just was thinking I'd love to to kind of have the folks who did look at that and think about it, you know Collaborate here and so I just gave them a heads up. So hopefully they can get involved and you know Maybe we don't event. You know, maybe eventually we move more towards the starboard like design for all I know, right? so I think another thing that and I Would like to touch on and I think this is particularly in the light of the work that this group has been doing around the kind of common policy CR So although from the work we've been doing We've come down on the on the sort of belief that we need more than one type of report for the Output from different tools. I think there is a summarization that probably fits into some Like we're bouncing ideas around now of you know something that takes the summaries from all the reports, perhaps all the deployments in a namespace and aggregates the results and Knowing things like how to interpret The the summaries from each of the different types of reports to come up with a sort of Single view of this namespace has an issue. You need to go and address it, you know These namespaces are fine. There's nothing to worry about And I think that would be a really valuable thing to have a common understanding of Right. Yeah, absolutely Sorry, go ahead. Yeah, this is Jay. So I think I agree with the settlers And so the way I look at it is there are different controls and Christian kind of Down into the vulnerability scanning control, right? That's just one type of control. There are several others and It is good to agree on a common format for how each of those controls provide all the details but then you know for a centralized management offering like what That's the focus of my my area, right, which is that it had Advanced advanced cluster management product, which also ties to our open cluster management community project Our focus is on managing a bunch of different Kubernetes clusters, right? Open shift and others and then being able to define policies that get propagated to those as well as retrieving the results back and then When you get a particular result back, then when you drill down, right? Then now you have to get into the details of a specific control, right? And I think Agreeing on a standard format so that it doesn't matter, you know, whether you're using trivia They're using Claire, you know, whatever scanning tool you're using You're still returning the results in a format that's easily understandable, right? So I think I think there's value for both both the summarization view as well as the drill down view, right? I think both Yeah, absolutely to totally agree and I think the problem that we were trying to solve and starting maybe with the I guess the highest order or the highest level is where we started with this working group is How do you give admins as well as workload owners, right? So that was very important and we had quite a lot of debate on whether policy Reports and a violation should be namespaced or not and I Strongly agree that they should be because these these should be visible to the workload owners And so so the idea was to give one common way One other interesting thing is we had a discussion just a few weeks ago on what are the different categories and you know For now we had security as a large placeholder But I think what you just showed you've done a good job of like categorizing the different tools and Terms of whether it's vulnerability scanning configurations Other things like CIS runtime benchmarks, etc, right? So and there could be more we wouldn't say that we've you know Everything but it seemed like a good start. Yeah so one question so let's say if somebody wants to add a new engine or Scanner to this what are the steps? It does it involve code changes? Is it you know runtime extensions? How do you plug in to this tool? So I cannot answer that so this is the main repository so currently it's a CLI So the executable binary that I use for the demo But also we if you want to implement a scanner in Govlang you could reuse the code again So we have this code generated right so you could programmatically create instances of those four types of reports, so you don't need to you know do the plumbing And then also if you don't want to use Govlang for some reason We believe that this is like something in progress, but I would love to have something which is called custom security resources Spec and That's the entry point for you, right? You could use whatever language you have as long as we know that okay This is the report. This is a The payload and we also need to explain a little bit semantics right all these things such as label selectors naming conventions This is not documented. You need to reverse and you get from the code, but if there is it is Specified how do we know why it's namespace? What is why it's cluster scope how to link it back how to drill down from this overview to a Particular workload then I believe that's the only thing we're right Yeah, and the reason why I was asking is a while ago within the working group We had also discussed what parts of a policy or We were obviously thinking more about policy engines, but it applies It's you know as you've shown like more broadly to other security tools as well is what parts could be standardized, right? some of the machinery around launching running and then collecting Some level of data from them right and we decided to start with what seemed like the easiest at that time, which was You know the the final output the high-level output But yeah, it would be very interesting to think of this almost as a So coupe cut all of course allows like binary plug-ins with CRDs, you know And I am assuming customer custom security resource definitions is meant to be like a CRD But for security tools So yeah, that would be very interesting to explore if this could be turned into some kind of a plug-in model where Anybody can come and contribute a engine without having to change like the core code in in starboard And I don't think we're exactly there today, but that is definitely where we want to get to yeah Yes, you know documentation a little bit of work to do though, but Yeah, that's that's certainly where we'd love to be Yeah, and also I wanted to mention that We haven't done that for each and every type of a report, but at least for the vulnerabilities We also have an open API spec. So that's one of the safety nets, right? So if there is someone who wants to Integrate with starboard as I said today's probably the only way is to do it programmatically We don't have a pluggable interfaces, but at least we have done this part of all right Let's define the vulnerability item because each time there is integration. We are ready inventing the wheel here You have the schema. You just need to Transform the proprietary output to this standard life form So yes, you could also apply it directly from the from this repository And you know, we'd be open to people telling us we've missed things in these definitions It's you know, it's a first pass but ideally we'd be able to different tools would be able to reuse the same definition So we don't have to keep having you know lots of very similar, but not quite the same, right? Yeah, and maybe last comment before I forget because we put some thoughts into the number of CRDs whether it should be one generic map of maps of kind of thing and when I look at that was like Realistically, how many cube benches do we have we have one from Aqua? Maybe there is a one from Docker, which is using I think some shell scripting So there are two they won't be too many third-party tools doing the same thing I don't know what can be done better probably. It's just just a matter of maintaining the existing tools and adding Checks to the CIS benchmark spec for vulnerabilities. I think this is very dynamic. Let's call it market. So I expect There will be like a potentially lots of third-party integrations for config audits Something with Polaris, Fairweings, Fox did I think it's super generic as you saw It's you know, just checking the deployment descriptor like a pod template at the Mainly looking at the security context of the pod and then containers, right? So also I believe that we could bend majority of existing tools to fit into this model But this is kind of approach like how many tools and And how to integrate them into into this common format We were able to somehow Manage it as it is now Now that's interesting and I have you guys also listened and I'm sorry. I haven't there are a lot of these meetings I haven't made haven't attended but so when we think about cube bench and you were listing, you know Kind of what's available? so you folks might know right because because often red hat work together a fair amount that that Open scap is is a key way for US government customers a key scanning tool scap and so red hat is and I know this has been discussed with this group Red Hat is investing in a compliance operator that will do open scap checks Or will run open scap and use scap content to do various types of compliance checks So that's other I'll find the repo Eric So that's another Area that it would be great to collaborate on I know not everybody wants to write scap I wish we didn't need to write scap, right? I Don't even know what scap is It stands it stands for soft security content automation protocol, okay, and it's a it's a NIST approved protocol For for types of security scanning you can use it for vulnerability skins actually also and CIS also creates scap content for their Tooling which they're their benchmark is under creative commons, but their tooling is proprietary. I See so each benchmark would map to a scap Thank you whoever found the compliance operator. Yeah I'm sorry. Go ahead Yeah, so just my question was whether each benchmark like a CIS benchmark would map to something like a scap definition or Individual controls would map to individual scap rules Okay So that and then you would have a the concept of a profile that is a collection of rules Got it. And Jaya, correct me if I've misstated anything. I Think Jaya had to drop right. Okay. Yeah. So just a scap I don't know item. I don't know what the right term is Just that and typically run like a Shell command or something It runs the open scap scanner So if you were to Google openscap, it is a it is a open source scanner scanning tool And again Yep, thanks. So NIST certified But then within that tool, how does it perform each individual check? So we might need some folks from the engineering team who aren't here today as best I can tell unless and less Erica's up to date on this there, but but again each content You know, there's a set of Content rules that are called and Right, and then there's an output report afterwards So Those are written in XC DDF I always get the acronym wrong But you can run a set of individual rules So open scap knows how to work with scap content And it runs those those rules and the goal of a profile right is to up level that so that you don't have to Select a bunch of individual rules But you can say I want to run, you know the CIS open shift profile Or I want to run the NIST 853 profile And the reason red hat invests in scap is because it's NIST certified are Federal customers US federal customers accept this type of content and And so, you know, honestly, nobody would want to use scap if they didn't have to So Yeah, I believe it runs as a game and set Yeah Okay. Yeah, that would be interesting to Understand and compare them and then as you were saying Daniel then look at the results and see what the commonality is and Similarly for configuration tools. I agree at a high level like whether it's, you know Polaris or there's Kibirno or there's OPA gatekeeper Which, you know, I think all of them also can act as admission controllers as well as configuration scanners At least Kibirno and fair Polaris scan and not certain about gatekeeper whether it does background scans or not But yeah, some commonality across those would be interesting to explore as well. I think that's another thing worth just sort of highlighting about starboard is that starboard is reporting on The security status of running resources. So starboard doesn't have a role as like admission control, right? It's kind of post post deployment if you like Just felt like that was worth separating from the kind of pre admission control, right? Now they might have a lot in common. You might do the same check as Part right in control before deployment. Yes in the CI CD pipeline. You're right Okay All right, any other questions on starboard or any anything else Daniel or Liz that you'd like to share Maybe last comment from my side So you have time to think about your question Today as I said, we are also working on the operator and we are watching and native or built-in resources Then if you want to integrate with Things like stop or maybe some more generic forms. We could also watch the Custom resources that we have created, right? We don't have to do this In this first reconciliation look, right? We can keep it simple and then Like cascade this information or maybe use some existing upstream Tools that do collect this data from the cluster. That's why we don't want to have a history And I think it's Maybe also to try out or write a quick poc and testing whether The vulnerability report or some other report that we have today fits into the Schema that you already Thought about so just to mention that I think we can play and see how it works because I believe that at the end we might have this Type strictly type reports for some use cases, but it doesn't stop us from having something generic they can do Yeah, and some way like one of the discussion Jay had brought this up a few meetings ago or and I think You know others on the team might remember this tears um There was a Discussion on how do you link from you know from the high level report to details, right? Where should the user go to find details? Is that like a reference to another cr in the cluster? Is that a url? Um, and we you know, we kind of didn't have a conclusive Opinion on that we wanted to keep it Have a field where somebody for each Each entry in the policy report could say go here for details But yeah, that that's something that we could look at and perhaps the details is another custom resource produced by the engine Yeah, that's a good point. But also I remember from harbour and just defining the common scheme This is also pretty big constraint on the third party scanner because not every scanner is able to provide such a different information so just just as a Right heads up. It's for example, like in polaris today as you saw we can scan the whole cluster and only We requested a change like an enhancement to the polaris to allow us to specify a single work So then it makes simpler to Configure our permissions for the tool etc. Uh, but this is also something to to keep in mind that okay All right, I think that sounds like a good next step to see, you know, if again the policy report schema that we've been working on if that fits in into You know your thoughts and view of a high level model to aggregate some of these results And we could try them out across some some of the categories you've defined and Certainly this is very much work in progress for us too. So Happy to get the feedback and inputs and see how we could make this better and something that's usable for everyone Great. Well, thanks for the the opportunity to show us to show you what we've been doing Oh, absolutely. It's great stuff. Um, okay, so I can quick Quickly talk about Uh, just a few updates and if anyone else says anything Uh, we'll try and save some time for that as well So one thing I wanted to um show and this is in actually our repo. So if you go to the work group policy prototypes, um, you know, you've roged from my team figured out how to uh, generate I guess API docs. So this was something that's not supported right now directly in kube builder, but there's some prs and uh, you know, like based on some other submissions what we were able to do is actually take the The the API or the crd definition and then convert it into a more readable document, right? So this is here to it's html as it's checked in into the repo right now So you have to kind of use like one of these preview things and we'll add a link to the readme page But I think this was the one step that um, at least, um, you know, I wanted to make sure we we complete before we Um, you know lock the document and move over to github in terms of managing Comments and changes and other submissions So at this point, you know, we have the basic cr in in github. We have samples and you know uh, erica someone from, you know, jstm also submitted a sample. I have a sample for qvernos or and you know what we'll um start collecting is more samples. So definitely Daniel and Liz if there's something you want to submit for starboard and how it could You know fit in into this model feel free to just create a pr And at that time we'll then start going through and you know, we can even what I was thinking is we'll add a unit test Which will take each sample and validate it against the cr and make sure that it you know complies and That will help in the submission process itself Any any thoughts questions on that and you know this of course as um I think as coob builder sort of mature or adopts like this document standard will Will you know reuse or switch to whatever they're supporting but for now we're just using Someone had submitted a pr to this tool which adapts to the coob builder model So that seems to work reasonably well for us at the moment That looks really cool Yeah, it's much more readable than the open api schema, right and um, hopefully it will you know, let let Folks go through quickly and provide comments, etc Okay, we have one open pr, right? Yes. You want to discuss um, it's a somewhat minor But I believe there's one open comment on it and that is using selectors right Yes, so there was one comment. I think you had submitted on when should we use the scope versus resource um Yeah, so I can I'll uh, I can add in some Yeah, I'm trying to think what's probably the best thing to do is just add this to the now that we have the cr And the ability to generate documentation. I'll update the cr itself and add in some Um, discussion there and that that could become our standard sort of documentation format for for this Okay, um, there were a few other things I'll Go ahead Erica If you just let me know when you have that in I'll make sure to give the lg tm Okay Sounds good Yeah, and I think the only other thing on the prs. I think Robert you you still have some I guess Some things to complete to get uh, you into the approvers list. So let me know if you need. Okay. Yeah, I'll take a look. Sorry about that No worries Okay, so we'll go ahead and get those done and I think um That's all I had to discuss. Um, Erica Robert anyone else anything else that we should cover You know Oh go ahead No, go ahead. Nothing for me Uh, we have Which Howard wasn't able to make it but he's at least back and active a little bit Uh going the cube con presentation that we have to record um So I'll be getting in contact with him about that if anyone has specific items they would like to see discussed in The deep dot policy deep dive let us know Yeah, okay. So that that um, I I I did mark up and add some comments to that and added a little bit of detail on some of the slides And I'll I'll carve out some more time Uh, what is there a deadline? I believe it has to be recorded by the 31st I am a procrastinator. So as long as you get it by the 30th Perfect. I didn't get it before that Yeah All right, and that's july This is kukarni you which is mid august or so, right? Uh, something like that. I think the deadline though for the recordings was the 31st of july all right Okay, yeah, I know Howard had sent me a link also. So I'll I'll take a look and you know Add some information or you know, we can collaborate and get that done awesome Any other items anyone has or anything we can help with going once twice All right, thanks everyone Uh, look forward to talking more All right, take care. Bye. Bye. Bye


You know he kind of mentioned something about two weeks ago he said hey we're going to expand on this role kind of in passing and it's like okay and and then maybe about a week ago he said I want you to take over and and run the team for this football game and and I was excited obviously I mean just to be in front of the group and and take control of everything I think it's a big honor and I think Mike Vrable deserves a lot of credit all right he deserves a lot of credit not just for doing this for me but I think around the league hopefully more coaches will give assistant coaches opportunities to do this because there's no like you got all these different programs but there's nothing more better than actually getting the experience and then I think he deserves a lot of credit for doing that we're gonna have a meeting a little bit later and discuss all of that but you know we're gonna play the guys that we need to see and it'll be exciting absolutely I mean if I didn't then when he asked me to do this I would have said heck no so I mean I'd love to be a head coach I I think you have I've been in this league a while I've been coaching football for a while and you have a lot of some head coaches that are play callers but I believe that just because you're a play caller doesn't mean that you can run a football team and there's so much more to getting these guys to play you know when you when you're a head football coach you got to be able to reach both sides of the football and connect with players like the way the world is and the way I've always believed that it is you can't you can't be a head football coach in this league without being able to connect with the football players you can call shot plays and run plays and blitzes and all those different things but at the end of the day this game is still about people and no matter how good of a play caller you are if you can't get that offensive line in the blocker you can't get that defensive line in the turn and run to the football then what are we really doing so that's just my thought on on what I think a head football coach is and I've been fortunate enough to work for a great one here that's innovative that's thoughtful that's able to connect with players and then Joe Tiller at Purdue Bill Hayes at North Carolina A&T I've been fortunate enough to work Dennis Allen New Orleans Saints Dan Campbell I've worked for a lot of good hit football coaches and all of those guys have that ability to connect with players curious about in this I mean there Mike was telling us you know the punt card and stuff that he had no idea about the first time he did it yeah one that there's something that you're kind of most curious about yeah I'm better prepared than him because he told me everything he had to go through so it's it's you know the thing I'm probably most curious about is just going up and down the sidelines because during the games I'm focused on the defensive line and the defense usually I don't have much time to look at what's going on on offense I'm just focused on on our guys and now that's Clint's job to Clint McMillan's job to focus on the defensive line my job is to focus on the the football team and handle all the situations and talk to stretch and communicate with him and Timmy and Shane and and those guys who eventually I believe will be had football coach we got a lot of great football coaches on this staff and so I'm really just gonna lean on them just like Mike does during this football game for opportunities like throwing a challenge flag like making a fourth well hopefully the refs will make good calls and we don't have to throw a challenge flag so you know what I'm honestly I'm just I think in coaching you you you just be who you are and I'm gonna coach like my personality is I'm gonna you know when the situations come up we'll be ready for it and and if I'm not then we'll just ask questions like again we got great football coaches and you know you talk about reality shows I tell you a great one would be if you can do one that if you can hear what's going on on those dang headsets it's it's real interesting there there so Jeff all those guys hey okay he's acting different now he's the head coach and you know what it's been fun I mean we we spend so much time around each other that we care about each other so I think most of those guys were were happy for me to have this opportunity but what this opportunity also is is it gives Clint an opportunity to coach the defensive line I think the thing that's not talked about a lot since this was announced is Matt Matt Greg is also taken over for for Todd with the training room so I'll have a meet with Matt tomorrow and we'll kind of go over the injuries and do all of that so this organization Mike is the one that made a decision but obviously he had to cover it with ownership so I think this this team deserves deserves a lot of credit for what they're trying to do here previously so I was sitting in my office in a dark burning a candle like I normally do and and he came over shut the door and said hey I want to do this I want to make you an assistant head coach nothing's really going to change because of what you do already you know I don't a title for me doesn't doesn't change who I am or what I do with this football team I care about the football team anybody that knows me know that I love these football players like I love them and care about them and you know we're able to I'm able to reach both sides of the football and talk to those guys and communicate with them and I mean that that's really what this business is it's it's hard like it's really hard and it's long we take up a lot of we spend a lot of time together guys get banged up so I said this before you got to be able to connect with these guys or when times get tough they're not going to follow you so Mike saw that and I believe that he's a successful head coach because he also has that ability I don't I mean obviously the offensive linemen because we go against each other all the time I remember when I first got here in 2018 I showed Taylor Luan the write-up that I had on him from the Miami Dolphins what his strengths were what his weaknesses were here's what you need to work on and those guys will come in and ask questions and then I mean Ryan Tannehill I've been with Ryan Tannehill longer than any player or coach in my career I've been where I was with him when he was a white receiver at Texas A&M I was with him with the Miami Dolphins and then here in Tennessee so that's an easy relationship to have but I think it's got to come organically like you don't just go out and try to develop a relationship with a guy you just if you care you care and I think that these players know and understand that part like so so we're gonna have a staff meeting as soon as we get done here and kind of go over playtime and all of that we really haven't decided I mean when you we just finished practice so we got to come and look at the injuries and do all of that and then we'll decide more on the play time so I mean all those guys have done a good job this camp and I've watched them closely just like I watched the offensive line when you're watching your guys on tape you're obviously going against an opponent so you're able to see those guys so we'll sit down and talk about that more tonight and then a little bit more tomorrow morning and just kind of see where we are before we get on this plane yeah it's more this what raves is doing here is more than a game day all right and and I mean like I'm taking over really five o'clock today it will be my first meeting with the the football team and then that'll carry on into tomorrow and I already met with the officials and so there there have been some examples of coaches that have given play callers okay you can call this half or you can call this game or hey you're the head coach for when we get to the field but this is completely different all right and I don't know of any teams that are doing what we're doing here right now where you're taking over you're meeting with the media you're doing all of these different things and that's why I said Mike Vrable deserves a lot of credit and the thing you guys don't know like you see him and he comes up here and I know how grapes can be trust me I know how he can be but what what you don't see is what he's able to do for us as coaches and for our families like he's a lot of guys have been promoted a lot of guys have gotten jobs from here this guy I'll do anything for Mike Vrable before assistant head coach and before being put in this position because there and there's really one reason and I know that this guy cares about my family all right and trust me for a guy like me that that means a whole hell of a lot so I honestly I'm not really I mean there been I probably had 200 text messages from different people when it's when it was first announced but I'm so locked in on trying to get Jeff Simmons not to jump off sides like that's really what my job has been up until this point and now I'm focused more on the football team I'll I'll I'll talk to some more guys and and I said this before I think we have guys on this staff that I hope in the future get the same opportunity I mean Shane and Timmy and and and Ryan Crowe and Booker and and all the guys on offense Rob Moore like I hope they all get get the same opportunity I think this is you have all these different programs I came up through the minority coaching internship deal I by 1999 Jacksonville Jaguars did one with the Chicago or not Chicago Bears the the the Seahawks and the Dallas Cowboys and so I was a product of of that but I'm not sitting here today because of because of that I'm sitting here because of how hard I've worked and and and my value to the team no I don't think I mean I I've been through a lot in my life it takes a lot to overwhelm me you just roll with the punches like I Braves has kind of gone over what game day is going to be like he's gone over everything that I need to be prepared for I'm sure there's some things that's going to come up but that's what being a position coach that's what's being a coordinator that's what being a head coach is about it's just as these things come up you figure it out and and that's why you have good coaches around you because you can't do everything you we will figure it out and I'm just excited about the opportunity I definitely don't have butterflies like trust me because I'll be just fine like I'm not I'm excited for the football team and I don't I'm sitting here now and hopefully after this it's not really about me it's about the guys that are playing in this football game there's guys that are fighting for jobs and and that's really what this thing's about and and those are the guys that I'm I have if I have any butterflies trust me it's not for me it's for I want to see how Tajé Spears and some of these guys that haven't played will levis and some of these guys that haven't played in a pro football game you know I'm more concerned about them I'll I'll be fine like I've I've been in quite a few pro football games not as a head football coach but I still have been there so well I'll be just fine thinking is this a mic to do this and and how much is this show that he kind of has his pulse on this organization I think that again he deserves credit because he's very very very thoughtful and he had this in mind months ago and and he told me he said you know you can't get experience being a coordinator without being a coordinator you can't get experience without being a or being a head coach without being a head coach so here you go you're gonna be the head football coach for 48 hours every you're doing everything the way that you want to do it and that's what we're gonna do so I think it's it's I I believe and I hope that more teams will follow suit and do this just to give give guys experience no not really I mean we we the the reason that raves and I get along so well and we get along very well is because we see football the same like there's not I don't believe that we should throw it a hundred times or blitz every snack like we see football exactly the same and so that's why it's easy to have conversations with each other about hey what do you think here what do you what do you think there what this guy should be doing that it's trust me we'll we'll we'll be just fine from position coach to coordinator head coach do you feel like line coaches are overlooked for the coordinator positions for that coaching sessions I don't I don't think so I mean here's what I do believe is people hire people that they feel comfortable with in those positions and then there's some guys I've known coat line coaches that just didn't want to be a coordinator or head coach they love their position so and and you have to like those positions are are they're just different you know it's probably different than coaching stony and punters or whatever so it's it's a little bit different so as far as being overlooked I mean I think there's more and more guys now around the league that are line coaches that are having opportunities to to be coordinators and possibly become head coaches my gut tells me that we're gonna have a staff meeting after this and we'll we'll talk about what we're gonna do to going forward after the game on Saturday well like I said about Braves and I see football the same I think everybody's happy and excited and they're think they think oh it's just gonna be a whole bunch of fun well wait till I walk in that meeting at five o'clock so we'll do what we got to do to win all right guys yeah I think the most important thing is that they continue to improve on some of the things that we've seen here the last couple practices that they start you know and continue to work as a unit you know helping each other and protection you know making sure that we're building a pocket inside of that they're trying to see the things that have shown up here lately in practice you know trying to stay inside out on guys just the fundamentals you know the things that we preach taking the next step and in live action and how we finish you know what our conditioning level is and you know there'll be a lot of good things to be able to see well far more valuable I mean with being able to first of all that the contact and you know it's live now you know we do we try to do a great job of of rushing and our guys have worked well together to go and work and stay away from the quarterback well you know the Bears won't be staying away from the quarterback you know they'll be trying to you know they're gonna have to get hit they're gonna have to get knocked down they're gonna have to be able to you know to operate in and out of the huddle of the efficiency you know get us in a proper play make you know great decisions accuracy with with a live pass rush you know the timing you know all those things that we talked about last year with Malik that has improved right through our team periods those have to continue to improve for him and then you know Will's first exposure to the NFL well the games are obviously the most important but there is plenty of exposure the way we practice I think we practice with purpose with intent with intensity and so we'll weigh those factors you know but I think the guys that can carry over you know what we've done here in practice and and they're conditioning level and how they're able to process information quickly and the situations change in and you know being able to get back to center from positive plays or negative plays we'll see I mean I think you know Nick's a specific situation so you know we'll see you know he'll play I would imagine but you know evaluating some other guys and he has to work he has to get better it's no different than any other center we put the next guy in there see how they do my message is going to be on today and how we practice today and we'll see what with T's messages to the team here tomorrow sure man I'm gonna be there and making sure that the things that we need to do get done and obviously overseeing that and just just making sure that I'm where I need to be and I don't think that'll be too hard I think it'll be good to see how we operate with some of the new faces there and see how the communication is with maybe Chris and a secondary you know Charles and Timmy you know working that process and some of the people that we have upstairs and you know that'll be real positive for me to be able to focus on those things and making sure that overall we're playing the way that we set out to here when we started training camp you know I don't my intention is to allow it's real to operate and function as the head coach now there's gonna be things I would imagine that at some point in time you know we need to have our field goal kickers kick field goals you know and then we need that so I'll I'll have to you know if if that comes up I'll have to or need to remind them of that I will I don't know you know Bill Bryant did a fantastic job helping me with the things outside of maybe the game day operations I was always tried to be into the game but had a job to do that was different than the head coach exposed me to things the trainers and the personnel and all the things that you deal with outside of just X's and O's and dealing with the team so that that was a great advantage but you know I don't know I don't know and you know but just well I'm excited just to see T operate Jimmy I can only coach one team at a time I'm focused on the Titans not not what the Bears do for them in evaluations yeah whoever's across from them they're gonna try to block them or try to you know get past them I now we'll weigh everything as it goes to be you know they'll be they'll have 11 we'll have 11 well whether whether I'm you know working the game with the film we'll have the film will look the same way so I don't think so Tim call from sideline or from the box Tim will be on the sideline Tim will be on the sidelines on Saturday at noon that's all I can tell you after that then we'll see where it goes the red zone period there in team drills is it concerning or you just use it as a building block I mean I don't know if concerning is the best word it's I mean it's definitely a building block that no doubt at the end of the day that's why we have this practice I mean it's not gonna be perfect and there's gonna be some days where the defense gets after us and thank God we have a great defense that we have because they're getting us just ready and it's awesome to go against a defense like this because they're not gonna make it easy on us it's not gonna be just easy plays out there for us so we got to dig deep and work hard and get those plays and I think it's just something to help build us and then it's just you know iron sharpen and iron I mean we got great players out there they get paid a lot of money to and and for them to get after us you know we just got to come back the next day and get back after it not sure if there's a time period I think it just comes down to reps and I couldn't tell you how many reps it's gonna take I mean at the end of the day it's different every year and just the more reps you can get the better and and it comes down to everybody in the room being able to understand so we go back and watch film you know everybody talking getting on the same page because say somebody goes down out there and we need another piece to fill in he needs to fill in right where we're at we can't just start over and you know start gelling again so it's a just multiple reps getting with each other and then every once in a while we'll have a guy down one day and then be able to get a new guy in there and then just being able to help him you know communicate the same and then everybody understanding like what we're saying so that way when we go out there and play everybody's on the same page and it's just gonna help us mess together game reps are huge because I mean at the like going against our defense every day it's awesome but it also you know you get you kind of get used to the same things they know our tendency tendencies and then they know like our calls so that you know they're a step ahead and then it's kind of a game within a game so it kind of it's it's nice to get out against a different team because they're gonna present different problems you know they're gonna run their games a little differently when they run their pass rush they're gonna run their twist differently they're gonna give different things away and so you're gonna be have to be able to understand that and see how those guys operate so game reps are always huge because it's a different type of player I mean it's been awesome it's it's great to go against our defense line we got several different types of rushers and then they're they're hitting a lot of different moves so you're getting the best of every world you're not just getting finesse guys you're not just getting power guys our guys work a lot of different moves and so it's nice to be able to go against players like that and then we have some very high caliber players to go against so I mean it just continually like iron sharpen and iron just getting better starters don't play at all in the preseason especially like in a preseason opener but with so many new faces on this offensive line you feel like it will be beneficial for you guys to get just get some work together on the field Saturday I'd say reps in general are always beneficial so I mean that's not my call to make that's the head coach's job but I will say no matter what getting reps is going to be beneficial whatever guys out there and at the end of the day it's a long season so whoever is out there there's going to be a lot of players that are going to be whether it's on the front end of the season or the back end of the season that are going to be playing this year so it's going to be beneficial for any guy that's out there during the offseason you guys looking at potential matchups and schemes that you'll face over the course of the whole 17 games that you see how how much do you plug back into that or is that the starting point for you when you come up to week one week two week three and how much of a sense do you start the season with about like what's ahead of you big picture even as you focus you know game by game so you're talking about like preseason like the matchups that we have using that when you get to a regular season knowing kind of how much of a sense do you have of the slate that's ahead of you from from what you do in the offseason I mean we don't try to focus too much on like week one week two I mean you're trying to focus on the day at hand so we're just right now out there focusing getting better meshing as a group and getting our communication down right now and just kind of playing ball when we were you studying you know week five I'm gonna see this guy and I need to work on this things like that I'm not necessarily it's kind of you got to you got to focus on the day at hand because at the end of the day that's in the future and then if I'm woke focus on week five when week one comes how does week five help me so it's gonna be at the end of the day we got to win day by day and so right now it's kind of winning training camp being able to focus on what what do you need to get better at and what techniques do you need to work on and then at the end of the day we all know this is a newer offensive line and how can we mesh together when we get to week five we'll focus on week five but right now it's focusing on the day at hand and then right now we got Chicago coming up at a preseason game and that's gonna be a huge game and part of the reason I asked that question about whether you meant the preseason games is Chicago's head coach comes from Indianapolis which we all know who we're gonna face so right now at this week we have a very good opportunity to go against the defense that's gonna be very similar to a defense that we'll face later on in this season so focus in on today and how we're gonna face these guys will be beneficial going forward so that's part of it I think the most rather than trying to look at the rushers that you have in the future focusing on how you can win the day is gonna just help you for the future so when you go against somebody today whether I go against a guy in camp or somebody and they happen we get to that week and there's a rusher similar to them I can think back okay what moves that I use against this guy to help me face now every is a little different there's gonna be something different but what we do right here and now is gonna be more important than trying to focus on something that's in the future I mean Chris is an experienced player he's a great player and it's awesome to be next to him he's got some insight you know that's a little different he's been in a few different places so he kind of teaches me some technique things different and then you know I kind of tell him what what I'm doing and it's just kind of a nice little mess trying to figure out okay how are you gonna take this approach this double team when we have this look and then how are you gonna approach this set when we have pass bro and just trying to get on the same page because the best we can be when we're going into a double team of fitting it so we're fitting exactly right so we're not stepping on each other hurting each other getting to the play versus like the same in pass bro like if he sets vertical and I set flat now we're on different levels so it's gonna be a big pain that we have to pass off games or if somebody's in trouble being able to help so being on that same page of how are you gonna set this look and like what types of set do you like in this situation what sets are you gonna take so the more that we can be on the same page and and kind of in unison the better it will be yeah I feel like you know especially the younger guys kind of getting a chance to be in an NFL stadium it's pretty special you know I know I am I want to go out there and hit someone else we haven't tackled to the ground really so I'm looking forward to that when you play whether it's this week or whenever you expect to play twice as much because you have two jobs I'm not quite sure I think you know we have guys I feel like the coaches kind of will rotate however they see fit I think in practice I mean in practice I've been getting both reps at nickel and safety and I haven't necessarily gotten twice as many reps I've been getting a lot of reps but not twice as many so yeah I am I feel like anytime like the transition from practice to to an actual game and the I feel like I'm I'm always a little more instinctual and I can kind of play more free just because you know I'm not it's kind of too late to worry about messing up it's like you got to perform right now so yeah I'm looking forward to kind of doing that at a new position and seeing how things go wins the day like it appears to the naked eyes you guys have done for several days out here in camp yeah how much stock do you do you guys as players and as a defense how much can you put into that yeah I mean we just try to stack those days you know I mean and it's not going to be every day but and we've had we've had kind of days where even though we I guess from the outside looking at it looked like we won or it looked like it was competitive we've had those days where it wasn't quite up to our standard you know what I mean whether that's our energy levels weren't as high or this or that but we definitely want to stack days like today I think it gives everyone confidence yeah yeah I want to play for sure because I didn't really get how much to run last year I didn't play you know I didn't do any I didn't really do any OTA's training camp you know I kind of had two games here and there kind of whatever piecing it together so I definitely want to get out there and start banking my reps so come season I can feel confident learning safety does it feel like you're still in the learning phase of figuring out how to do it or is it more just you're getting experiences and knocking the reps together a little bit of both you know there's now it's to the point where I'm learning like the little nuances and the little details that you know I'm not it's not just the basic anymore it's kind of like level 300 now and I'm just trying to like I feel like I know I know the coverages I know kind of the details and I just have to go trust it and play like I know how to play