All right everybody welcome again to another OpenShift Commons briefing today It's a wonderful Monday in the world and we are doing AMAs with upstream projects And today we're going to talk with two folks who are the people behind Coverno a new CNCF Sandbox project, I believe Ritesh Patel and Jim Baguadia, and I'm going to let them introduce themselves We're going to have a nice presentation about what Coverno is doing and why And where it fits into the whole CNCF landscape, and then we'll have live Q&A at the end So Ritesh and Jim take it away Hey folks, I'm Ritesh Patel, VB Products and co-founder at Nirmata. Hi everyone This is Jim Baguadia co-founder and CEO at Nirmata All right, so let's dive into it. So today we'll talk about you know Coverno, Coverno is an open source Kubernetes native policy management Solution that's now a CNCF Sandbox project. So here's the agenda I will, you know, dive deeper into why Coverno, what does it solve? Why did we feel there was a need for something like Coverno and then jump into the technical details of how it works Now we do have some use cases that we can go over to give you folks an idea of the kind of problems you can solve using Coverno I will discuss some of the other tooling around Coverno, which is more specifically that Nirmata offers to help ease the management of Coverno policies and reporting and then jump into a demo followed by a quick roadmap and Q&A So let's jump right into it Coverno actually, you know, you may kind of wonder what does Coverno mean and Coverno actually means govern It's a play in Greek basically, it's govern and you know, obviously Kubernetes, the origin of Kubernetes, the word is from Greek So we thought it would be appropriate to kind of use Coverno as the name of this project because Coverno is essentially a policy engine for Kubernetes and a policy engine is used typically to govern or for compliance of various aspects of Kubernetes So that's why the name Coverno Coverno is a Kubernetes native policy engine, which means that it understands Kubernetes resources, Kubernetes patterns So it actually is aware of Kubernetes constructs and it's designed in a way that it's familiar to Kubernetes users and essentially there is no learning curve So let's take a step back and understand why do we need policies in Kubernetes? What are policies and you know, how do they help? So if you're familiar with Kubernetes, you can configure lots of different resources whether it's your infrastructure for Kubernetes, whether your applications or workloads running in Kubernetes and all of the configuration is essentially done using YAML and it gets fairly complex, some configuration files could be, you know, 200 lines and the challenge there is now how do you ensure that the configuration can be managed and is secure There are also, you know, external tools that, for example, Helm and Customize that tweak existing configuration to adapt it to environments So that's how your configuration could change The end configuration that ends up in the cluster may be different from the source depending on where your resources are deployed So, you know, in Kubernetes, there are ways to configure admission controllers and that's where, as a best practice, a lot of the validation for configuration as well as any modification or mutation of configuration can happen and that's kind of the best place where policies, if any, can be or should be applied So what policies do is essentially let you govern or ensure that the configuration that's being applied to Kubernetes is secure It follows your best practices, you know, follows the standards And Qverno is an engine which does that without the user or the developer or the cluster operator having to build something from scratch or build something custom for their environments So that kind of brings us to why Qverno and, you know, touched on this briefly in an earlier slide But with Qverno, our goal when we started out was to enable policies for Kubernetes and make it really, really simple make it really easy for users to understand and write these policies So Qverno policies are declarative and very easy to manage And when these policies are applied, they generate policy results Basically these are, you know, violations or any kind of, any, you know, any policies that are violated, kind of reported in the results So that also is Kubernetes native These policies can be of different types, you know, you can have a validating policy which can either be in audit mode or an enforce mode Or they could actually mutate an existing configuration by, you know, changing parts of the configuration Or the policy could generate new configuration if it's in cases where this configuration is required or it's missing And that gives you a lot of flexibility to kind of ensure that the configuration of your Kubernetes applications and resources are configured correctly Being Kubernetes native, Qverno supports all of the Kubernetes resource types and can also support custom resources, right? Which is a huge benefit so that, you know, now you can use Qverno across the board without having to worry about which resources are supported and which are not And, you know, being, again, being Kubernetes native, Qverno leverages and understands, you know, some of the common patterns used in Qverno Like label selectors, labels and selectors, annotations, owner references and things like that, right? And that really makes it very easy for somebody to, you know, start with Qverno and start using it with Kubernetes Now just a little bit of background on the project itself, so Qverno today is an open source and a CNCF sandbox project It was added to sandbox projects in November last year and since then we've been tracking the downloads and it's almost approaching 2 million downloads in, you know, about three and a half months, right? Which is huge. It went to 1 million downloads about three or four weeks ago and now we're almost there at 2 million downloads Seeing a lot of, you know, interest in the community, you know, a lot of folks are looking at it and like the simplicity ease of use of Qverno And then there are other projects in the CNCF and in the community like open policy agent, which do policy management but Qverno kind of because of its simplicity has been gaining a lot of interest and a lot of users So definitely do check it out if you're interested So question when we talk about Qverno of this question that comes up is, you know, how is Qverno different from open policy agent and here are some points of differentiation You know, open policy agent was actually predated Kubernetes was built as a general purpose policy engine and then adopted or adapted to Kubernetes whereas Qverno itself is designed for Kubernetes It's Kubernetes native. The policies are Kubernetes native resources in Qverno, whereas in open policy agent, the actual policies are defined in a language called Rego, which is something that a user would have to learn to write policies. There is a project called Gatekeeper which which works or integrates with open policy agent that simplifies or that tries to adapt Kubernetes resources and to define policies but ultimately the underlying enforcement and all of the policy processing everything happens based on in based on policies written in Rego Also a few other things about Qverno which are not necessarily available or possible with OPA, OPA Gatekeeper So Qverno is, you know, secured by default, you don't need to call out any external systems for any processing and, you know, because it's an admission control path, this is very important. And also a few other scenarios that Qverno enables are around, you know, kind of the if this and that paradigm where if a particular configuration, you know, if you check for a particular configuration and if it exists, you can actually write policies to do certain things. These are very easy to do in Qverno And being Kubernetes native and Qverno policies are also Kubernetes native. It lends itself very well to tools like, you know, customized sound and can you can use gate ops to actually apply policies across your clusters. So really, just in a nutshell, there are several benefits that we get with Qverno in terms of ease of use as well as the other capabilities. Let's dig a little bit deeper in terms of, you know, at a high level from the policy perspective for Qverno or OPA and we'll go a little bit more details into how Qverno policies are defined. But here this is just to show tip kind of the difference between Qverno and OPA. On the left hand side, you see the Qverno policy, which is, you know, if you are familiar with Kubernetes and abused Kubernetes resources like deployment spots, this will be very familiar to you. Which very, you know, straightforward in terms of creating these policies, there are certain keywords like match and validate and we'll talk about those a little bit later. But overall, in this policy, just validates and checks if the file system is read only. On the right hand side, you see the same policy written in Rego and this would be something that you would use in OPA. So this is just to quickly show slight difference between Qverno and OPA. So next we'll talk about how Qverno works. I mentioned earlier Qverno is a policy engine that runs inside the cluster and it registers, you know, as an admission controller. And then every request that comes in through the API server is a process through Qverno and policies that are configured in Qverno are applied to do these requests. So Qverno gets an admission review request. It applies these policies, the policies depending on the configuration may generate certain events or a policy violation and then the response is sent back. If the policy is configured as audit only, then it's really the, it's just in a kind of like a report only mode and there's no the request itself is not blocked. But if the policy is configured as a, you know, to configure to validate and block, then the request can also be blocked. If the policy fails. So this is really at a high level, how Qverno works in Kubernetes. Here is a quick view of the policy structure. So when you're defining a policy in Qverno, a policy contains one or more rules and each rule contains match or exclude criteria, which could be mapped to Kubernetes resource kinds, names. It could be you could use label selectors namespace selectors, as well as user roles groups and so on. And then you have the various actions that Qverno can take, you know, that's either validate, mutate or generate. So, so these are the high level blocks and we'll talk about each of these blocks in the next few slides. So just to map the structure we saw earlier, here we have the same kind of the Qverno policy showing the same structure where you have on the top line number eight, we have the match block where in this case it's matching all resources of kind pod. And then on line number 12, we have validate block, which actually does the, you know, does the validation for the for every pod. And in this case, it checks if the security context run as non root, etc. So, so this kind of simply gives a quick idea of the policy structure. So validate policy is essentially it kind of matches the fields that are defined in the validate block and determines if your configuration, you know, matches the matches the fields and, you know, it is it it's validated for it validates the configuration by matching all of the fields. So in this case, you could have patterns you can match, you know, for existence of fields you can match for, you know, with operators you can have you can check if value is, you know, greater than equal to or not equal to. So a lot of the, there's a lot of flexibility in terms of doing various types of matching in these policies in the back for validate. Next on the mutate policy. So here you can, when, when you want to mutate an existing config, you can specify kind of a patch JSON patch or strategic merge patch to update the incoming resource. So for example, here if you want to, let's say, add a port or, or, you know, insert like a secret name, you can do that by specifying the patch in the policy, and you can even do that conditionally so you can even you can only add configuration if it's not there, or if, if, if, for example, you can even have if then condition where for certain port names you can use forces for certain only if port name start with certain string you can, you know, add the, add the value and so on. So this gives you again a lot of flexibility to manipulate incoming incoming configuration. And it's actually very important that I use cases where, you know, if you want to add certain labels on on every resource or on specific resources, you can now ensure that that's done by creating a mutate policy. A lot of times, these labels could be used by other tools for security for networking for monitoring and so on. So, so, you know, give or no through mutate policies allows you to address some of those use cases. And the final type of policy is a generate policy where you can actually generate certain resources. So, so on the, the example here on the right hand side kind of shows how you can generate a network policy to deny all traffic. And this could be your default network policy for your namespace. And it can, you know, it would be created, maybe anytime a new namespace is created. So there is a usually a trigger, which can trigger the generate of, of these, these resources in this case, we are generating a network policy. And it could also you could use to clone existing resources.  And these policies are configured once these policies are configured and as their process based on based on incoming requests, there are violations that can be generated. So, here is an example in Kubernetes to see the policy result. So, on the top, you see an example of showing the of the policy results for a particular namespace. In this case, default namespace, which shows that, you know, nine policies were passed and one failed. And you can get, get more granular details, you know, like, like the example, like the second screenshot here to see which policies failed and what exactly, why exactly the policy failed, right. So you can get more details in terms of the violation so that the violation can be fixed. So that's kind of, you have that information. Again, it's all inside your cluster. You don't need an external tool to retrieve that information. So this was a quick overview of some of the features that there's lots of advanced features that are being built. And, you know, this is an ongoing kind of as as community comes up in more use cases, we're building more and more features.  You can also have variables, you can actually point to certain certain parts of your config using James path, James path. And you can also look up data external data, you know, from, from config map or through API calls. And this lets this allows you to kind of inch check, or figure, you know, violations by checking data that may not be part of the incoming request or the part of part of the resource configuration. Can also set up deny rules. One thing that's interesting is auto generation of pod controller rules. So if you have policies for parts, they automatically get applied to pod controllers like deployments, stateful sets, jobs and so on. And then finally, you want to know can also be run in offline mode. So you don't, there's a command line for Q and O which can be used offline so that you can actually check, check for violations in your configuration if it's in gate or, you know, before your check for your violations before your configuration is applied to your cluster. So that's definitely useful. You know, you want to don't want to wait till the configuration is in your cluster to check you can check upfront address those issues before applying your resource changes to your cluster. So, you know, we talked about a few use cases, but there's more use cases emerging as, as, as Kimono gets more widely used. We talked briefly about security validation and enforcement. There's also Kimono enables you to do fine drain RBAC. So based on, you know, base, for example, when namespaces are created, you can auto create some of the roles, role bindings, et cetera, depending on the namespace name or labels or any other criteria. Kimono is the enables multi-tenancy in, in Kubernetes again through some of the automation by generating RBAC rules by generating network policies can generate quotas. And, you know, we're also working with various states to kind of enable this enable more secure multi-tenancy across within, within Kubernetes. You know, for, for your applications. Auto labeling is a use case we talked about earlier. Also, we are seeing patterns like, you know, sidecars being used in for various, various tools like, you know, for, for, for example, for service mesh and Istio sidecars, it's very common to use sidecars.  So Kimono also can, can, because it can mutate existing configuration, you can create sidecars using Kimono. So you don't have to write a new operator to do that. And then finally, you can have very conditional rules like if this and that for Kubernetes. And that opens up a whole set of use cases. You know, and for your, in your, in your Kubernetes deployment. So it's very flexible and, you know, you're happy to kind of, if you have other use cases that we have not covered or not seen, be great to hear about those and see how we can help with using Kimono. One area where, you know, we really see a lot of interest today is around, you know, pop security. In the past, pop security policies have been defined using PSPs, but PSPs have been marked for deprecation by the, by the community. And there are other options and alternatives being discussed and we are part of those discussions. But today, if you want to, if you are interested in, in the pop security policies, Kimono provides a very easy way of achieving that. We already have a set of policies, you know, on the Kimono website, which kind of address all of the requirements for pop security and they are based on levels, you know, like the PSPs and some of the discussions that are happening in the community. So it would be, if you're interested in alternatives to PSPs for while, you know, communities working on, you know, the next iteration of PSP will be great to check out Kimono and let us know if that addresses the security needs. A lot of folks in the community that we know are already using Kimono for pop security.  So before we jump into the demo, the one thing I want to quickly touch on is, you know, as Kimono gets used in Kubernetes and as it's more widespread, you know, we're seeing some requirements around managing policies at scale across clusters, across multiple clusters, ensuring consistent deployments and so on. And so we've created, you know, the cloud-based solution at Nirmata to help manage policies at scale. So through Nirmata, you can actually deploy policies across clusters, you know, using GitOps. That's concept of policy groups. You can define different policy groups like, say, for pod security or for multi-tendency. And then these groups, these policy groups can be applied either automatically to new clusters or they can be applied to specific clusters. So you can manage it very easily instead of having to deal with each cluster individually, right? And then the ongoing challenge of keeping your policies up to date and automating that deployment can also happen, you know, very easily with our integration with Kimono, with the integration of Nirmata with Kimono. And then Kimono generates a lot of violations, right? So depending on the size of your clusters and the number of pods and the number of applications running, you could have tons of, you know, policy violations and failures and so on. And policy reports are available in the cluster, but through our integration with Kimono, you can actually get a very granular report of the violations and not just get the report, but then also understand what the problem is. And then, you know, either get help on remediating that problem or filing, you know, tickets to kind of get that problem remediated, you know, from the application owner and so on. So through the integration, we complete the full lifecycle and of managing Kimono policies and getting visibility into Kimono violations. You know, at scale, like if you have multiple clusters that you're managing, this becomes very, very important. Next, we'll jump into the demo, so I'll stop sharing and let Jim take over from here. Go ahead, Jim. Okay. Thanks, Sudesh. All right. Is my screen being shared or not yet? Not yet. Let's see what's going on here. And no worries, I can edit this little segue out if we use the video. Here we go. Okay, perfect. Now I'm seeing a black screen with your recycle bin. Okay. There we go. Yeah, so what I'm going to do is I'm going to just demonstrate, you know, how you would as a new user get started with Kimono, what you can do with it. We'll look at a few different examples. We'll look at, you know, like Ritesh mentioned, pod security policies get a lot of attention. So we'll start with those, see what Kimono can do in that area, and then also look at some more advanced policies. So I'll just go, you know, just again, going to the Kimono site if I go to documentation, and we'll click on installation.  There's a help chart. But for this, what I want to do is just install using a command line so we can kind of look, take a look behind the scenes and see what's going on, right? So I'm just going to copy this command, which is a single line to pull down all the YAMLs from the Kimono Git repo and install into my local cluster, right? So if I do kubectl, get namespace, you'll see I'm just using Docker for Windows here. And on this, I'm going to run, you know, this command line that we copied and have it installed Kimono, right?  That's all of these that came in about like six or seven different CRDs, including policy reports. One interesting thing I want to mention about policy reports is these are not unique to Kivarno. In fact, the policy reports are being developed, you know, in collaboration with the workgroup policy, the policy working group in the Kubernetes community. And the intent is to make these same CRs available to any other tool that wants to report policy results in the Kubernetes cluster, right? So this provides a standard way of reporting policy violations independent of the engine or the tool that's producing it. And there is some work being done to take, you know, things like kubbench and also adapt it to these policy reports. Falco is being discussed as another candidate, et cetera. So once these CRDs are installed, we also see that Kivarno created a service account. There's also a few other things done. And what's also interesting is there's some webhooks created, right? So now if we look at our namespaces again, we should see a Kivarno namespace.  And if we, let's say, do pods, we should see that we have a single pod running, which is what we expect at this point, right? So now let's go ahead and, you know, I don't have any policies. And if I do kubectl get cpaul, which is short for cluster policy, it will say I don't have any resources. Because the CRD is installed, I can actually now use something like kubectl explain. And I can say policy, so Kivarno both has a cluster policy, which is cpaul and just policy, which is a namespace policy. And if I say policies back, it will tell me, you know, because it's integrated again with Kubernetes, I can see right here what I can put into a policy. So I see I have a background option, which is a Boolean. I have a set of rules in the policy, like Ritesh was explaining. And then I have a validation failure action, which can be set to either enforce or audit, right? And if you go further, so on, it's very straightforward. And of course, if you have your, you know, visual studio code or other things integrated with Kubernetes, you get all this help and, you know, schema, etc. Now, also in your IDE, right? So it makes it easy to write policies, check the syntax, things like that. But here I can see that this is the description of rules. But so far, I don't have any policies. I just have Kivarno installed. But let's go ahead and, you know, get some policies, right? So I'm going to go back to the Kivarno site and we'll click on policies. And I see I have pod security best practices and other. So let's go to pod security. And like Ritesh mentioned, here the way these policies are organized is based on the pod security standards. So if you're not familiar with those, these are great to review and look at. Because what the Kubernetes pod security standards help you do is they organize the pod security controls into three categories. So there's privilege pods, which is basically unrestricted. There's baseline, which is typically used as a default. So this is minimally restrictive and then there's restricted, which is the highest level of security itself, right? And then it lists every control within the pod security security context structures and allowed settings, et cetera, for those. Now the, you know, the, the cap, which is being developed, which is most likely going to be called pod isolation policies is also going to be based on pod security levels. So again, it's important and pod security standards. So it's important to kind of keep these in mind. And then you'll be able to apply these, these, one of these levels to namespaces in this upcoming, you know, cap, which will be pod isolation policies. So anyways, going back to the Kibana policies, as you see, they are organized to default. So this is actually baseline. It got renamed from default. So this is the baseline setup policies and this is restricted.  If I click on any one of this, like for example, let's say the require default proc mount. So it is checking both for init containers and containers that if a proc mount is specified, it has to be default. It cannot be changed from that setting, right. But there's other, of course, several other policies. If we go back to, you know, the restricted and look at some of the more stronger or the tighter control policies. You'll see things like require, you know, that run as non-root, which is pretty important for non-privileged pods to make sure both init containers as well as containers are always run as a non-root user, right. So let's go back, you know, to this main pod security page. And what we have over here, it's showing me a one line command. So it uses customize, it pulls down policies from this Git repo. And then it's just using kubectl to apply them, right. I'm going to take that and let's see what happens if we apply to our cluster. So I'm going to, you know, it's a, this takes a few seconds to pull down all of the YAMLs. And once that's down, what we should see is it will apply into our cluster itself, right. So we see about, like about 10 or so policies got applied. And if we go back and look at the cluster policies, we should see that these are now enforced. Now, what's interesting is if I go, let's actually, you know, look at this, if I go to one of these policies. If you notice when I was browsing through the policies, most of them are written at the pod level, right. But as Ritesh mentioned, one of the things Kivarno does by default is because it understands the relationship between pod and pod controllers, it will, let's take a look at that, you know, root policy. Kivarno will automatically generate policies for different pod controllers. And of course you can control the settings. So if I say kubectl get, you know, let's say cpaul, I'm going to do this and do minus O YAML.  So you're, if you notice what happened is when I applied this policy, it was just written, the rule was written to match a pod. But in addition to a pod, what happened is Kivarno automatically generated policies for, you know, most of the standard pod controllers. And again, this can be, you know, tuned, you can specify different annotations to control, which you want to, if you want to restrict, for example, only to deployments and not to demon sets or something like that, right? But here what I wanted to make sure is now we do have all of these generated. It's this one's for a cron job. This other one is for all of these, you know, the more standard pod controllers as we see. So pretty neat that I have now all of this installed. So let me try and run a simple workload. You know, I think I have an engine X pod. So I'm just going to say create minus F and let me check if this is in my temporary. Yeah. So, okay, so immediately Kivarno is saying, and because these policies were set to enforce, it's saying that running as root is not allowed. It's telling me what exactly got violated. And it's saying that one as root must be true. Must be set to true. Run as non root must be set to true, both for init containers as well as containers, right?  So now let's try something a little bit more intrusive, right? So I'm going to actually use this site, which is pretty handy. If you haven't seen it, it's the site is Bishop Fox, and it's called bad pods. And as the name suggests, these are pods which are misbehaving, right? So pods which are misconfigured to allow, you know, all sorts of, I guess, to basically be open where if you want to, you know, allow the host bit or access to host network or other namespaces, all of that is fairly open, right? So here I'm going to go into, let's check and see so this, the, you know, which one we want to do. Let's go into everything allowed, which is probably the worst you can do, right? And we'll take a quick look at the YAML. We'll actually go to the deployment just to see how that works. And, you know, we'll look at it. So this is basically allowing, you know, different, it's saying privilege true. It's mounting host, which is also a bad thing to do. It's all, and then allowing all of our, you know, host namespaces to true, right? So let's grab that. And what we want to do is we'll go to the raw YAML. And we'll run that in our cluster, right? So I'm going to now do kubectl create minus F and we'll give it that whole YAML and see what happens. So now we see a lot more warnings or a lot more, you know, errors coming back from our admission controller, which is what we expect. So it's saying that, hey, don't, you know, don't allow host namespaces, don't use hostpat. It's a don't privilege. So all of this got blocked, which is, and of course the other error we saw before, which is run as non-root. So this is how, you know, straightforward and simple it can be to, you know, to set these policies. These policies are very flexible. You can tune them based on, you know, like Ritesh was explaining. A lot of different selectors and, you know, I have some examples in here. So this is actually a different policy. It mutates or this is generating a network policy. But if you look at another policy, like, which also can mutate things. So let's, yeah, this is an example of a mutate policy. It matches also pods, but you can write your, your selectors based on several, you know, constructs, including namespace labels, et cetera. Right? So very flexible, very simple, you know, to apply some of these. One other thing I want to quickly show is how, you know, Ritesh also mentioned some features like being able to select and get external data, right? So very often you want to write a policy, but you want to then, you know, leverage data from things like config maps, which are very natural in Kubernetes. In fact, you know, in the community, one of the policies that I was just working with somebody to develop is to make sure that workloads, workload identities are protected based on the image name. So, you know, what the author did, which is pretty nice is use the config map to make sure that a certain service account can only be used for certain images, right? And they're managing this, the data through a config map, but then it's a very generic policy to do that. Another common example is to, you know, make sure your ingresses are unique within a particular, you know, cluster, right? Your host names for your ingress, I should say, are unique. So Piverno has this ability to use James Path and also to do API look calls. So this is a combination of using those two features. So just going through the structure of the policy, this policy matches ingresses. And then there's a context, which where you can populate different data and different variables. So here, what it's doing is it's saying, it's doing a call to, you know, to the API server, which is this API call construct. It's getting all the ingresses from the API server. And then it's applying this James Path on it to extract out all of the hosts. And then it's checking if that host is, you know, the host from the request object is already is included in that list of existing hosts. It's going to deny the operation, right? So fairly complex logic, but pretty straightforward. You know, once you kind of get the hang of how this is structured. And the interesting thing is, you know, if you use kubectl and just through the command line, all of this can be tested very easily. So I can do kubectl, I think it's get minus this raw. Yeah, so if you do kubectl get minus minus raw. So you're, I don't have any ingresses in this cluster, but you can kind of see what that looks like. And even if you want to test the James Path expression, you can use JP, which is the command line for that. And if I go back to my policy, let's grab what this looks like. And of course, if I had some ingresses, this would maybe make more sense. But if I apply this right now, it will come back with an empty string, right? Because there's no, there's nothing. So just came back with an empty list over here as you see. If I had any ingresses with hosts, it would show me a list, a string list of those ingress hosts. And then in my policy, what I'm doing is I'm checking to make sure that the host, which is coming from the request object is not, you know, already used within the cluster. So, you know, this is a simple example which shows again how you can combine some of these. And the other thing, you know, which is very interesting is there's, you know, policies I think Ritesh mentioned also for multi-tenancy. I can show a few examples of, you know, those. What we're seeing is first of all, you know, adding labels to namespaces is a very common use case.  We're going to be doing this at the Cloud Security Day for GroupCon EU where we're going to talk about how Kiverno and HNC can work together and manage both namespaces.  So how you can kind of allow those controls. So you're, anyways, in this policy, it's pretty straightforward. It's saying that if there's a namespace created, except by cluster admins or by the HNC manager, go ahead and inject like the user info. And then you can also do more complex things like you could say, okay, maybe I want three types of namespaces. I want a small, medium, large. And based on that, now I'm going to configure, you know, different quotas and different things for my tenants, right, for my users. So all of that can be fairly easily done. You can also generate very fine grained roles and permissions. So only the person who requested that namespace, the owner will get permissions to then delete that namespace. Things like that can be then generated on the fly. So these are Kiverno policies to do those kind of things. So we'll share this repo once we have this finalized for the session. But this is just a quick example of how now you can use the power of leveraging labels and then based on automatically generating different configurations for those namespaces. And of course, you can also add like validation logic to make sure that only the right settings, like in this example, it was requiring that each namespace only have a certain, you know, can only be used with a certain suffix, right? So dash SM or medium or large. And if it doesn't have those, it would be rejected itself. So these kind of things, you know, you can combine, you know, validate, mutate and generate to get exactly the right behaviors you want for your cluster. And once these policies are set, they can, they're very much data-driven. So, you know, the configurations itself can be easily automated in there. Okay, so one last thing I wanted to show, you know, before we switch is, you know, in Kiverno, I think like Shultz mentioned, and as we were looking at, there's this ability to, you can create, it creates policy reports. And something our one of our community member created and has made available this is also an open source project. He created something called a policy reporter, which takes this policy report and also provides a nice graphical UI on it. He's also got the ability to push this to Rafauna Loki and Elasticsearch and create other notifications. But really nice example of how, you know, you can have you this graphically, you can share this inside a single cluster. So, just wanted to highlight that. So, if you're looking for a single cluster tool to, you know, visualize these policy reports and even create notifications when these get created, definitely check out this policy reporter project. And, you know, we're, there's also work in progress, by the way, to take more Kiverno metrics and push these to, you know, to Prometheus, which could then be of course displayed in various UIs and dashboards like Rafauna and others as well. But this is more focused on the policy report. The other work that we're starting now is to build to push engine metrics and engine statistics out as well. All right, so let me stop there. I know we have about five minutes left for the hour. So would love to see if there's any other questions, thoughts, comments that we can help answer. And, you know, again, like there's plenty of documentation and if you want to reach out to us, feel free to reach out on the Kiverno Slack, which this is the on the Kubernetes Slack, the Kiverno channel itself. Well, that was one thing I was actually noticing is that your documentation is awesome. So, congrats on that because I think that's one of the things that drives communities and really helps people adopt. We have a couple of people on the call that had some questions. Paul Maury, if you want to pop yourself out of mute and onto the screen and Kirsten newcomer. Yeah, so I heard a lot about pods. I didn't hear whether you can write policies around custom resources. So like saying that I have a custom resource for my own bespoke controller that creates pods. It contains something that's like pretty close to a pod spec. Can I write a Kiverno policy on it? Absolutely. Yes. Yes. So one of the things right from the beginning Kiverno has supported is, you know, also full custom resources and it does help if the custom resource schemas are structural. So if they're structural, what Kiverno can also do is can validate the various paths and fields for that custom resource policy. If they're not that validation doesn't occur, but Kiverno will still apply the policies. Okay. And how about if I have like an aggregated API? So can I write policies against APIs that another API server might bring in? So you can make calls to an aggregated API server, right? So through the API called construct, if you, for example, if you want to pull metrics, things like that, that would work. There are resource definitions. Yes. Then those can still be, you know, looked up and then policies can be applied to those. Okay. All right. Thank you. Sure. There's one question in the chat. Mike, he's asking, do you need a CNI to enforce the policies? So for network policies, yes. If you're generating a network policy, you will still need a CNI to provide that runtime, you know, kind of to make sure that, you know, the right segmentation exists on the network layer. But for other policies like pod security, et cetera, those are applied directly with the API server and Kiverno itself will block configurations that are violating, you know, the policies you set. First and take it away. Sure. Thanks. Oh, but my cat, my cat, my cat a follow up. Is the, yeah, go ahead. Is the mutate policy in cash until validate is run. Yes. So there is a, there is a ordering in, in, in the admission controls. So the validate will occur to, you know, at the end. So all of the mutation logic will occur. And then once that's done, then you get a chance to sort of validate. There's also a way to re invoke admission controllers. So Kiverno by default, when it installs itself, it tries to be the last admission controller to receive. So there are, you know, there are some customers who will use both open Kiverno for various reasons. And in that case, you know, you could still run one particular policy and then register to read receive any mutate results. Great. Take it away. Thanks. So I had kind of a question about network policy generation as well. How do you inform the generation of that network policy? Are you using. Config data to inform that, or is there a, you know, or is that optional kind of, how do you decide on, on what's going to be in that policy that's generated. Right. Yes. So the few things, right? So the trigger to generate the policy could be the creation of a namespace could be the setting of a label. Or the setting of an annotation itself. So one pattern is if you're using, if you want some variations and you want to control, you know, like, for example. What exactly gets generated, you could use labels and based on labels, generate, you know, have templates for different types of network policies. And that would be, yeah, one quick way of, you know, of changing that you can also do things like because Kiverno can look up the namespace can match namespace selectors. You can say that if for certain namespaces and if there is an annotation on that namespace, then based on that, maybe you want to trigger a different network policy. So you would have two different generate rules, one for each. So, you know, a few different ways of managing those kind of variations and handling that. Great. Thank you. That's helpful. And I know we're pretty much right at the top of the hour. I'm actually I have two questions, but, but I'm going to pick one of them. I have thoughts on kind of policies or ways that we as a community might move forward to kind of apply policies to respond to events in the runtime. Yeah, great question right and something that we have been thinking about there's been discussion also in the policy working group about what other triggers. The commission controls and configuration changes. Of course, I want one trigger, but it would be very interesting to also have a set of, you know, defined runtime triggers. And there's also discussion, you know, about authorization checks right so somebody in the community was asking about, you know, the, there's a self subject review request that gets sent out from the API server when when there's an authorization check. You know, for having some more granular policies on that. But yeah, to your point, like if there's other runtime events, even those could be potentially used for triggers. But it's something that it's not supported right now and give her no but we're very open to that and interested in hearing more about the use cases and how that could be standardized. Great. Thanks so much. That's it for me. Well, thank you guys for coming today. It's, it's wonderful to have these upstream talks on Mondays because I really didn't know that much about caverno before this that way I was pretty open centric in my understanding of policy management and such. So it's really helpful to have the context set and so I think everybody appreciates that as well as Jim awesome deep dive and demo there today too. So we'll definitely you're in the sandbox now. Yes, the road ahead, more, more production users, more people using it, more feedback on it, hopefully incubation and graduation into the, you know, the real world today, sometimes soon. Absolutely. And we'll definitely get you back on as it matures and we get further down the path and congratulations on getting into the sandbox and getting it to this state. Again, if you're interested in this topic. These guys are pretty active in some of the SIGs and the CNCF, as well as I, as I mentioned earlier, the documentation is rock solid. So good on that. That's as a community person. That's one of my key tests, whether we can keep something going forward. And definitely when you get a new release, new features, new functions, reach out to us Ritesh and Jim and we'll have you back. So, good work. Good luck. And thanks. Thanks again for sharing the information with us today. Thanks for inviting us.


If you put in your homework and you go through the S&P 500, if you go through the health care space, the defense space, the oil space, the energy space, the agriculture space, you would realize that there is a massive bull market. Welcome to Access a Trader, the number one community for those who are committed to taking control of their trading in order to achieve success, profitability, and longevity. Thank you for joining us. Here's Dan Shapiro to help you find your edge, master your process, and own your future. Hey guys, good morning, everybody. Welcome to another edition of the Access a Trader.com Weekend Update Show. Hope everybody is doing well. Obviously, the big story continues to be the fluid situation going on in the Ukraine, as always, hearts and prayers and always good vibes going out to the people of Ukraine, and hopefully, this will somehow go away soon, right? It's a very, very tough, tough way to kind of look at life, but there's obviously a lot of stuff going on there. Another round of, quote unquote, talks supposedly are going on this weekend. So we're definitely hoping that this situation comes to an end with the least amount of casualties on as possible. At the end of the day, human life is very precious and we don't get a do-over. So hopefully, that goes pretty well soon. All right, so let's talk about the market. So the cool thing about trading is it's like Baskin-Robbins, right? There's 31 flavors. There's no such thing as the right way to trade, the right stocks to trade. You know, it's all about your comfortability, right?  And that's what's great about it. And the first two, three years, I've been saying this for years, it's your point to kind of figure out where you fit in, you know? Are you an options trader? Are you a futures trader? Do you like trading high beta technology names? Do you like trading, do you like trading forex? You know, NFTs, right? Crypto, you know, what is your thing, right? Nobody's going to make fun of you, right? It's not about the cool thing to trade. It's about the right thing to trade, the comfortable to trade. The one something that you can control. And in my early years, you know, especially from 2001 to 2003, after the internet craze, after 9-11, again, I didn't make a dime, literally, from 2001 to 2003, and I kept on feeling sorry for myself, right?  I'm the worst. I have the dark cloud.  The market doesn't suck, guys. Remember, the market is the market.    The market doesn't suck. The market's not there to make you hold. It's not there to entitle you. It's not there to do anything. The market is just the market. Buyers, it's a format, a coliseum of buyers and sellers, right? When buyers clean up sellers, stocks go higher. When sellers clean up buyers, stocks go lower. So the idea that the market owes you anything is absolutely ridiculous. And the one thing, years and years and years went by, and lucky enough, I was able to kind of figure some things out. The one thing I started realizing that I kept on saying over and over, and I think a lot of people feel exactly the same way when you're newer, when you're younger in this business, when you don't have enough screen time. We use the word, the market sucks, right? Everybody, everybody's used that at one point or another. Subconsciously comes out of our mouths very, very freely. And the one thing, like I said a couple of minutes ago, market doesn't suck. The market's there to digest information, whether it's macro, geopolitical, financial and move in that direction. Fed obviously has a big, big part of it as well. But the one thing that I figured out a long time ago is if you don't put in that work, and it's a very generic thing to say, and a lot of people say, but it's true, if you don't put in the work and go through, especially in the weekends, go through countless charts and a lot of groups. You're not getting, you know, you're not getting a true dynamic of what's going on in the marketplace.  OK, it's an absolute crutch and it's not going to get you anywhere. Because if you use the word market sucks, figure out why. Why does the market sucks? Well, what kind of trader are you that the market is affecting you? And when you go through charts and you put in the work, you're going to realize that there is value somewhere. OK, I'm personally a technology trader. OK, I know there's a rabid bear market, OK, in technology, rabid bear market. OK, no matter what technology name you run, you're probably underwater from where you were two, three months ago, hell, maybe even two, three weeks ago. I know, for example, the banks are in a bear market, right? You've got Citibank going down. You've got JPMorgan getting destroyed, right? Bank of America is going down, right? That's a bear market. OK, and I know a lot of people, a lot of people are, you know, those specific traders of those sectors like I am. I love technology, cell site. I'm on the cell side bias predominantly the last two months because we're underneath the 200 day moving average.  OK, and if you did your research, if you put in your homework and you go through the S&P 500, right? If you go through the health care space, the defense space, the oil space, the energy space, the agriculture space, you would realize that there is a massive bull market there. OK, so using the word market sucks, which basically means you're not doing in the work. You're not putting in the work. So if you turn around and you look at the charts, you'll see oil is going out of its mind, right? Just because there's sanctions going on, right? Oil prices are absolutely going nuts and you have tons of names that are breaking out, right? Look at XOM, look at Chevron, right? Going absolutely nuts. Look at neighbors, look at these stocks, right? Look at LNG, which I really, really like for this week, right? Look at LNG. How can you turn around and say, quote, unquote, the market sucks? You got health care names going nuts. Look at Humana, right? Humana is setting up really, really nice. OK, you got Anthem setting up A-T. What's the symbol? A-N-T, I think. There you go. You have Anthem setting up really, really nice. You got McKissick setting up really, really nice. Look at the defense stocks, right? Because the war started, the defense names are popping. NOC going out of its mind. Look at Lockheed Martin going out of its mind. Look at General Dynamics going out of its mind. The agriculture, right? Because the oils are going on, the potash names are going up. They're going crazy, right?  Mosaic, international potash. Even this little stock, C, is going absolutely nuts. So when you make a general statement that the market sucks, it's a crutch, it's a weak thing to do. And basically, you're saying to yourself subconsciously, I'm not willing to put in the work to figure out where the strength is. Because if you are a permeable, that's where the strength is, right? It's right in front of the charts. Everybody has access to exactly the same amount of charts and the same data that everybody else is.    Again, this is not a part-time thing. You could be a part-time trader, but you got to put in full-time effort. And this is a type of environment. This is the type of business that there's a lot of big money that's trading against you. OK, so if you if you're trading against big money, a lot of institutional money that's going against you, you have to be on the right side of institutional money. So where's the institutional money flow? This national money flow is where the charts and where the sectors I just talked about. So if you're sitting there and you're over this weekend continuing with that mentality and that personality spilling over into Monday's session without putting in the work, well, how can you be upset about the results if you're getting if you're not putting in the work to try to to try to rectify your results? It's a losing personality. It's a losing trade. And the only and the only thing that's stopping you from figuring things out is your ability to put your tissue in the seat and go through thousands and thousands of charts. Because if you do that, you'll have a completely different view of the market. The market doesn't suck. The sectors you're watching sucks that your approach sucks, your process sucks, your process not working in a market that is very, very aggressive, fluid situations and is dominated by headlines, whether it's the war headlines, whether it's the Fed headlines. So the best thing you can do is stop the complaining, right? Stop the belly aching, stop the self pity. The woe is me. Sit down, right? Sit down, start looking at charts and you'll realize the market doesn't suck. It's that effort that needs to get better. So do yourself a favor. Again, guys, everybody has problems. Everybody has the same 24 hours of the day. Whatever you put in into those 24 hours, you're probably going to get out when all is said and done. So be better, right? All of us, myself, yourself, everybody included. Stop the complacency, complacency. Stop the self pity, get to work. So let's talk about the tape. Very, very aggressive market. Again, Fed war up and down, up and down, up and down. The common denominator continues to be, especially in the technology sector, is self bias, right? We see this every single day, no matter how strong the market gets. There's always supply to kind of end the narrative. And we saw that this week. The bulls had a great shot this week to reclaim the 20 day moving average on Wednesday. They gapped up not 20 cents, not 30 cents, not a dollar. They gapped up two and a half dollars above the daily supply. And if we were to just close the above this 20 day moving average that we talked about throughout the week, we would have had a really good grind all the way back to the next supply zone. But the bulls fumbled. And that's the bottom line. The bulls had every opportunity to live a prosperity, to build over the 20 day moving average. And they failed to do so pre-market, turned around and yada, yada, yada. You look at the scoreboard twins. End of the week, you see the NASDAQ, NASDAQ down nearly 3% very, very aggressive move down. We'll talk about the pivots in a second. But the most important part is what happens next. And the one thing that we do know, technically, and that's all about, right? It's all about opinion is technical confirmation. So now we know we failed above the 20 day moving average. The 350 area we talked about constantly throughout the week. That becomes the huge number now. Going forward, over 350, we start going higher. But the problem is this is the first close below this whole range here. And now any move below Friday's lows of 335 starts the next cycle into this lower Bollinger Band at 330. And if that closes below 330, then we go all the way back down to the February 24 lows of 318, which will exaggerate things. Obviously, technology investors are probably not going to be happy. But again, like I said, for weeks and weeks and weeks, again, if you are a long biased investor, you don't need to sit there in a fetal position. Short some cues against your book, right? Get some hedges.  If you're a long Amazon, Facebook, Apple, you know, Netflix, short some cues, right? These are your longer term positions. Short some cues against your positions until we start reclaiming bigger levels. Again, there's no reason to be a victim. Again, it kind of goes back to the conversation we just have. Be productive, right? Be productive, protect yourself. Don't just sit there, belly a complain and do nothing about it. These are all proactive steps that you can do as an investor to kind of protect your book until we start reclaiming the 200 day moving average. And then you can let go of your hedges. But why just sit there and bleed your money just doesn't make any sense. Be an adult, be proactive and stop complaining of things that you actually can control. So that's kind of what we are looking into the week ahead. As far as the technical view, we kind of don't know if these meetings, if they're actually even happening or not, if these meetings are going to help or hurt by the time the futures open up on Sunday night. We don't know, right? We don't know. We just we're just sitting there and just digesting information like everybody else. But the point is we are prepared, right? That's the name of the game. We are prepared going into the next day. So when nobody's sitting there talking about this is a bull market by the dip bears never learn bears been winning bears been winning for a long, long time. And especially in the technology in the banking space. Again, we gave plenty of examples.  And that's where my prime concentration is. And this is where things are going forward. So going into this week, again, let's see how the futures open up. I'm obviously still sell bias again. Again, it is very, very tough for me to be by bias, especially we got rejected off the 20 again, you can see how many times we've got rejected off the 20 until we at least reclaim the 20. How can you even talk about holding inventory and having exposure, especially overnight, intraday, of course, you can find some things intraday channels on especially in the 60 minute view. And that's kind of guys for all you guys. And again, we trade channels, right? If you if you've ever been interested in pivots and again, it's a very different way of trading. It's not the normal. It's not something that everybody does. I've developed this quite a while ago. And if you are interested in pivots, you know, listen, I think it's not for everybody. I've been saying that for years again, if you have a five hundred dollar account, the thousand dollar account, two thousand dollar account, three thousand, it's probably not for you, right? It's very, very tough to trade Amazon with one share. But the point is it's a process, right? It's a process. It's not for Amazon. You could trade it with crypto, you could trade it with Forex, you could trade it with anything with liquidity, anything with liquidity in a range. My concentration is technology, but you don't need to. We have an offer until tonight. If you are interested, it's a discounted offer for one day. Listen, if you've been on the fence, check it out for 30 days. See if it's a good fit for you. If it's not, no big deal. We'll still be friends. But the point is there are other avenues that you could look at things a little bit different on this side. And the most important part is see if this is one of the flavors that you like. Just like Bass and Robbins, it might not be, but you never know. It might. So kind of check that out. Going into this week, there's definitely names I like. There's definitely, definitely names that I like on the short side. Not too many on the long side as far as technology, although I just gave you guys definitely a couple of examples. LNG I really, really like to the upside for all you guys who are trading energy, Humana looks really, really good as well. Coming out of this range. Look at XOM, right? These are long, long bias setups that if you are trading, you could definitely take advantage to the upside downside pivots as well. There's a lot of them, right? There's definitely a lot of them. Let me give you guys a couple of names that I do like on that side of the market.  I think this AMC goes lower, right? I think AMC probably goes lower. I know Batman came out, broke this range here. Actually, you know what? Let's let's go over the pivots that I'll show you exactly why AMC and everything else that I like. By the way, thanks for listening. Anyway, so let's talk about let's talk about the pivots from Friday. So Rivian Rivian has been an absolute monster. Not all EVs are created the same. Obviously, there's Tesla and there's everything else. Rivian had a really great breakdown on Thursday, 53 held twice. If it builds below can flush, that's set it up into Friday session. I said perfect move to the January 50 lows that held twice. If 50 confirms, you can see the next leg down here was Rivian. Right here was Rivian. So here is the 53 breakdown on Friday. Right here is the 53 here, 53 here and went down all the way to 50, which was right over here the January 28 lows. It broke the 50, it went right to 46, 47. Just an absolute great move on Rivian for Thursday going into Friday. And the video got hit as well. 231.30 if it builds below can flush. Here was the video. So if you've been watching this broadcast, they were coming. They were coming really aggressively even last week. They were coming for the 230s, the 225s and the 220 puts. And again, those put buyers definitely got paid out. Here's the 231.30s breakdown traded all the way down to 224. Again, the video takes out these lows. It's going to go lower as well. Tesla, Tesla, not a big move, not a big move at all. But you know, went down like six, seven points. 832 if it builds below can flush the 814. Not a big move. I was expecting a little bit more, but the bulls kind of held up a little bit. So here is the 832 right over here. Here's the 832, this whole channel here. And this is kind of what we talk about. We trade channels. 832 was the lowest candle into rising support. Went down about seven and then kind of rebounded the rest of the day. Just kind of going a little bit of sideways. But I'm telling you, if you see this whole channel here, right? This whole sneaky channel here, this whole sneaky channel here. If it starts breaking down below this whole snake channel here, you could see that 814 level. We'll see. We'll see what happens. NET got destroyed on Friday. 101 is yesterday's low and the pre-market low. Again, you want to kind of have multiple levels that the kind of gauge that you trade off of. If it builds below can flush, 91 is the next measure potential. Didn't quite get to 91, but a nice move on NET. Nevertheless, so here is the 101 went all the way down to 97. I still like this thing. This thing starts losing 97. Could get down to this 92, 91 level. Excuse me, Lucid, right? Lucid 23. These are all Thursday spilling into Friday's trade. Nice move on Lucid on Thursday into Friday. 23, 20, 23, if it builds below can flush. Have to continue to stay patient with this play against that Tesla. It's like I have a $12 range. 22 is now the pre-market lows needs to confirm. I still like this thing that coming for the 21 and 20 puts. Amazon got absolutely destroyed Thursday in the confirmed Friday. 29, 75 builds below and closes under can see 100 points down. Here is Friday. Nice dump into the close. 29, 35, you can see a 40 point dump on Thursday into Friday. Next area that needs to establish a new ceiling, it can move down to 28, 60. Look at Amazon just got absolutely murdered. Congratulations to everybody who took Amazon. I said 28, 60, you traded down to 28, 76, but great move. Just really, really great move on Amazon there as well. So you got a perfect move, just an absolute perfect move in Rivian. Here comes Amazon. 28, 83 went down to 28, 76. AMC, again, a very emotional stock. As much as I say, as much as somebody told me, hey, Dan, you don't trade it, you shouldn't really talk about it. Well, other people do trade in. That's why we put in the channels. Again, thanks for listening. AMC 1720, 17, if it builds below, can flush. Buyers were coming in for the 318, $15 puts. Again, I don't know how good Batman is going to do. If it did well, who knows. But technical analysis is still technical analysis just by the charts alone. 1720 was the breakdown. Here's AMC, right? Here's AMC, took out the 1720 channel, traded all the way down to 1635. This thing confirms that 1620, $16 level, it should get down to $15. Again, technical analysis is technical analysis. This thing loses 16, it should get down to 15. So that's that, NET going down. Here comes Nvidia, AMC 1650 on deck. Take on the way down, 825 is a big number. That's exactly where it stopped. Humana, a nice pop on Humana. I still think it goes higher. 41 needs to build. Here is Humana, right? It closed right at the Bollinger Band here. This thing starts reclaiming back 42. You could see a pretty big move if these if these health care names continue to move. So guys, that's it. It's a pretty cut and dry business. OK, you're the only one responsible for your success or lack thereof. OK, nobody is there pulling the strings. Everybody has the same charts. OK, stocks go up, stocks go down. It's your job to stay safe and it's your job to capitalize. OK, guys, have a great weekend. God, peace and love to everyone. Have safe weekend. And with God's help, I will see you all on Monday. Take.


President Joe Biden has passed the 100 day milestone and a lot of folks are kind of stepping back and reflecting on everything that he's done and hasn't done thus far. I do have a video coming out on Saturday at 8 a.m. where I kind of give you my comprehensive breakdown. It's not an exhaustive list of every single good and negative thing that Joe Biden has done. Having said that though I do try to be really objective and go through a lot of the most significant things that this administration has done. Having said that they're putting aside my breakdown and my grading of Joe Biden's performance thus far, members of Congress are also speaking out and Republicans of course obviously hate every single thing that he's doing even if it is in their interest and what they want because they're just hacks. But in theory if somebody in Congress is going to be the most critical of Joe Biden I would expect that to be the progressives. However they don't actually seem that displeased with Joe Biden and actually AOC not necessarily in a leadership position but widely viewed as the leader of the squad at least. She actually said that she believes that Joe Biden has done a great job. In fact he's exceeded her expectations because she was expecting him to be a lot more conservative than he is in actuality. Take a look at what she had to say. One thing that I will say is that I do think that the Biden administration and President Biden has definitely exceeded expectations that progressives had. I'll be frank, I think a lot of us expected a much more conservative administration and I think that is not only what has ultimately come out but the active invitation and willingness and collaboration with progressives in his first 100 days for almost 100 days has been very impressive and so while there are very you know there are areas where there are just plain areas of disagreement. I think that the actual content of the administration has absolutely been in good faith but not just in good faith but active incorporation of progressive legislation and also for those of us individually. I can at least say that there has been a lot of openness and willingness and flexibility in incorporating many of our goals, requests, demands, etc. Okay, that's going to be a hard disagree from me AOC. Listen, I think that if I'm going to be charitable here, if your expectations are already really low like if your expectations are below the floor then any one good thing that that individual does that's pleasantly surprising you could see that as oh wow I didn't expect this you know I am surprised therefore my expectations have been exceeded but even by that standard has Joe Biden exceeded my expectations just personally? No, he's met my expectations because my expectations were there'd be a couple of good things but a lot of really bad and harmful things namely as it relates to foreign policy and immigration. So I don't like that she's saying this because here's the thing if you want to give Joe Biden credit and try to cultivate goodwill with this administration so that way he hears you out and he factors you into the equation when it comes to legislation. I understand that from a strategic perspective but what AOC did here is actually incredibly harmful because now Joe Biden he's going to see this he's going to think oh great progressives are satisfied I exceeded their expectations I didn't just meet their expectations I exceeded their expectations so therefore they're a beast I can not listen to what they have to say because they're already satisfied we're 100 days in and this group who I expected to give me the most trouble is already satisfied wow that's fantastic and AOC you know she basically speaks for the progressive so yeah that's not what we want we want Joe Biden to take away now it is the case that I don't believe we should come off as petulant children who are unreasonable unwilling to ever give Joe Biden credit for anything that he does I mean sure applaud him give him credit where it's due when he does good things but don't censor yourself don't go out of your way to compliment him especially if those compliments aren't warranted has Joe Biden done good things yes he has done good things I think he's handled the COVID-19 pandemic far better than Donald Trump but at the same time there's a lot of things in this country right now that need to be fixed and to say that is an oversimplification because there's a crisis right now when it comes to health care we are facing climate catastrophe so I'm sorry just like having your low expectations exceeded that's not any reason to be excited or give him credit for that I'm sorry it's just that's not the case now as much as the mainstream media tries to pretend as if they didn't hear the more radical things that AOC says they definitely heard this and they've been asking other lawmakers about what AOC said and thankfully Nina Turner had a much better response she basically said I mean you can give Joe Biden credit for the good things that he does but of course we should have the courage to ask for more but on CNN the chair of the Congressional Progressive Caucus from Milla Jayapal was asked to comment on AOC's remarks and she not only agreed with the AOC but she took it a step further and she gave him a grade of an A one of your progressive your fellow progressives in the house Alexandria Ocasio Cortez says that he's exceeded her expectations and expectations for progressives do you agree I do you know I think that this has been a really interesting time for us to see how the progressive movement at large all the progressive voters young voters voters of color that came out and turned out for the president in November helping us to win the White House the Senate and the House and the pandemic and the way in which it has just really shines such a bright light on all the inequalities that have existed I think President Biden has risen to the moment and I really do give him an A in what he's done so far it's been bold it's been progressive it's been what the country needs he hasn't shied away from it he has leaned into it and we're hoping that the same continues to happen as we go through the process to pass the jobs and families plan I mean that's it I know you haven't been completely on board with all of his plans and you've expressed some disappointment the refugee cap for instance and in terms of his public polling it's about how he's handling immigration that he gets some of his lowest marks so what do you need to hear from him tonight well on immigration I have spoken with the White House directly about this they are going to fix the refugee cap issue you know I I think it was a big mistake I've told them that I said it publicly I said it privately but they're going to fix it on immigration the president has you know he's sort of gone back and forth he released a very strong day one immigration bill and we really applaud him for that it's a great vision coming from the top but if we are going to be successful Democrats cannot do what Democrats and Republicans have done for too long which is you know use immigrants as a political football and run away from the issue or cave in to people who are using immigrants as a political football so I want to hear from him that he is deeply committed to getting this done and that he's going to lean in to the incredible you know promise that immigrants have and I as an immigrant member of Congress of course feel very strongly that we contribute so much and we want to be recognized for that contribution and for the values that America holds so dear they are so grounded in welcoming immigrants. Pramila Jayapal is the chair of the Congressional Progressive Caucus this is supposed to be the loudest opposition within the Democratic Party to conservative leadership and I've got to read back the quote I think President Biden has risen to the moment and I really do give him an A in what he's done so far it's been bold it's been progressive it's been what the country needs this is borderline parody I don't like to grade or rate things on a scale from 1 to 10 a through f but if I had to grade Joe Biden I would give him an F a D minus to be charitable and the reason why I give him an F is not to you know detract from the positive things that he's done his positive handling of COVID-19 but you know if you are grading a paper for example and you score 55% that doesn't necessarily mean that you got every single question on that quiz wrong you got some questions right you did good in some areas but ultimately you still failed overall because you didn't grasp the material enough you didn't do what was needed to do to pass that test so I would like to know what criteria Pramila Jayapal uses to grade Joe Biden because if the standards are this low then imagine what Bernie Sanders would have been graded as would he have gone like an A plus plus plus would our heads all collectively exploded if he said the words Medicare for all on a national stage I mean listen you can acknowledge that Joe Biden at his State of the Union he adopted the rhetoric of Bernie Sanders he said health care is a right but having said that though I don't necessarily care what he says I care what he does and to say that he's met the mo he's risen to the moment he still doesn't support Medicare for all in the middle of a pandemic and it's worse than that actually he moved away from a public option and a public option is trash right it's going to be overburdened and underfunded Republicans are going to point to its inevitable failure as proof that government-run health care doesn't work but I mean it's still better than the status quo currently but he isn't even proposing a public option I mean he seemingly moved away from it not a people about a public option but you say he's risen to the moment are we serious are we just overly naive representative Jayapal you are the chair of the congressional progressive caucus you set the tone for the rest of progressives in Congress you saying this is a signal to everyone in Congress members of the squad progressives to unilaterally disarm let your guard down because Joe Biden is based Joe Biden has risen to the moment he's bold he's progressive he's exactly what this country needs and even the CNN host it seems like she disagrees with you because she noted correctly so that Joe Biden has a high approval rating but where he gets the lowest marks is when it comes to immigration and Pramila Jayapal correctly identified his unwillingness to lift the refugee cap now he's postponed it he's gotten a lot of pushback for that but that's not the only issue Pramila the reason why he's getting low scores when it comes to immigration is because what he's been doing has been comparable to Trump there are children in cages are you just pretending like that's not happening so it's deeply frustrating because what this is doing is you're poisoning the well for future progressives there's a lot of new progressives that are right now launching their campaigns and they're trying to encourage people to donate to you know canvas for them sign up and volunteer for them and the takeaway when progressives see things like this see you just capitulate and die like that in a hundred days they're gonna think well why am i going to give up my hard earned dollars to these new progressives running if they're gonna just get elected and immediately roll over and die not even try to fight for a second like do you understand we need to see a spark we have to see some signs of life within progressive lawmakers but it's just they won't fight they they're not doing it and i know that the most popular response that i'll see to disappointment with the squad of people who are really genuinely demoralized and i don't blame them for this is i will you know this this proves it you just i can't vote for anyone who's running for congress as a democrat except even if you were able to elect someone from a third party a socialist or green party that would be really difficult to pull off in the first place but even if that were the case i mean if you're an independent in congress you still have to caucus with the democrats i said this in my last video about the squad uh you you can caucus with the republican you have to caucus with the democratic party and work with leadership so the same institutional factors that seem to not necessarily co-opped but silenced members of the squad or you know uh bully them into obedience for lack of a better word that's gonna apply to anyone else and if you don't believe me look at bernie sanders bernie sanders is not a member of the democratic party he's been an independent for uh forever and uh you can see he's overly differential to joe biden is it because they're friends i don't know but it's the institution itself that makes it very difficult so i've said this once i'll say it again the key ingredient is that um we can't just keep electing folks and expecting them on their own accord to do the right thing because there's there's just too much pressure in congress and they just they don't have the courage to fight to put it frank they're they're too afraid to fight they don't have spines that they're they're either clueless or spineless uh either way them just being there isn't enough so the there needs to be a groundswell of pressure from the bottom it has to be a bottom-up approach we have to pressure them to pressure joe biden we have to make demands we have to fight and it's tough you know it's hard to recommend grassroots activism and direct action in the middle of the pandemic but that really is the missing ingredient here and i don't necessarily blame people for getting demoralized here because think about how far we are from actually achieving anything that's truly transformative so on one hand joe biden is a conservative democrat he could speak the language of progressives as much as he wants he could sound like bernie sanders on the state of the union uh during the state of the union address rather uh but i don't care what you say i care what you do talk is cheap but actions are what actually make the difference so we have progressives who need to pressure joe biden to do better but they won't and then even if they were successfully able to pressure joe biden to do better that still doesn't necessarily mean that joe biden has the spine to stand up to conservatives within his own party i mean he needs to put pressure on kirsten sinema and joe manchin to kill the filibuster otherwise nothing you want is going to get accomplished whatever you're able to do i mean good luck getting 60 votes for it right and people cite the uh the covet relief package as like this huge achievement and it was it was truly beneficial right but the stimulus checks alone isn't enough even donald trump passed stimulus checks so we have to expect the squad to pressure joe biden and then even if they're successful there joe biden has the pressure joe manchin and kirsten sinema to do the correct thing and i think that joe manchin and kirsten sinema actually are aligned with joe biden but they're a convenient cover for joe biden so that way of things don't get accomplished that he doesn't actually want to get accomplished it could just say well look i tried to kill the filibuster but i have members of my own party that don't want to do that and i mean this goes back to what aoc said she made a comment about i think the conduct of the administration has been in good faith has it though because he's patting you on the head and listening to you i mean these are social techniques that are effective but if you're a member of congress you should take into account the fact that you know joe biden is doing his job to make you feel like you're listening to but that doesn't actually mean that he's taking into account what you want i mean the squad progressive members of congress they've been legislatively irrelevant anything that they want is not getting put into any bills and anything that they boast about is what you know just random rank and file democrats also support so is that really something that you can claim credit for it's just it's really frustrating and they have to turn it around like trying to kiss up to joe biden i think that sure you can argue strategically maybe there's some value in that but it hasn't paid off you kissing his ass rolling over and dying to leadership it hasn't paid off it hasn't been beneficial and if you're trying to somehow make it so that way you're playing a 40 chess and you're using reverse psychology you're trying to make it seem like joe biden is a good guy so joe mansion and kirsten cinema seem like the bad guys i mean whatever strategy you have it's not working and that's even if we assume that you have a strategy because i mean when i hear cori bush go on cable news and say iana pressley told me that my vote is my own i can't help but deduce okay so they literally are just like occupying the seats right now they're not fighting so you have to do better you have to do better with peace and love you have to actually fight because guess what you have a two-year window you have to assume that democrats are going to lose at least one chamber of congress in the 2022 midterm elections so everything that you're unable to accomplish now will soon be politically impossible come 2022 so if you think it's difficult now just wait so that's why i say i mean are we going to see a single achievement squarely out of you know congressional progressives are they gonna put up anything uh i'll tell you not if they continue on this current trajectory they have to turn it around they have to be courageous and they have to be indivisible and congress stick together and actually fight actually make demands and actually threaten to withhold their votes from key legislative initiatives if they don't get what they want it's exactly what joe manchin and conservative democrats do and they get what they want so it's time that progressives do the same and flex their muscles but i mean things like this from aoc and premilla jai paul this ain't it chief do better


Hi guys, it is me I'm sometimes I'm weird. Hey guys, it's Monica. I am going to Probably share with you a couple of empties only because I need to get rid of them. I'm running out of room. I I Don't like having a whole lot of empty So I'm gonna share with you a couple of empties and a couple of products that I've been using and maybe talk a little bit about our vacation That we just had So if you're interested to stay tuned Thank you so much for joining me. So I have been Gathering up empties and I don't normally do that because it drives me baddie You know to have all that stuff hanging around. I have a small house so it's it's a little bit harder to Collect things in a small house because it just doesn't honey But I do have some empties that I'm going to share with you and some of these things I've used forever So I'm not going to really go into a whole bunch of details, but first of all, I've got a lot of hair products that are empty and One is my color cool violet both my shampoo and my moisturizer conditioner I've had these for Well over a year. I buy these you can get them from Amazon I usually buy them for my hairdresser. This is the violet. Now because my bio hair Tends to go brassy. I have to use a product like this. So I love this. This is the all nutrient Color violet. I probably normally when I wash my hair. I probably use this once every Two weeks when I wash my hair and that's probably why it lasts as long as it does But I love this. I already have my replacements both the conditioner moisturizer and conditioner and the shampoo if you are a blonde and In my you know in my house, I have hard water and My the water will my hair will tend to be more brassy. So that really Saves me big time. The other thing I ran out of which have already replaced Cheap cheap Hairspray I Love the saw saw saw saw I get this in Wal-Mart. You can get this anywhere and grocery stores anywhere I get the max hold. This is the number eight. I have been using this for eons Yes, I do try all sorts of different hair sprays, especially when they're sent to me from octaly But when I when I'm going out there and I'm buying it. It's this I do use it a lot It drives my hair dresser crazy because she can feel the build-up in my hair But I still use this a lot and I love the stuff and I have my replacement the other thing that I have three empties of is The big sexy powder play have two of the big sexy powder plays I have another one that I have already One of these was in the motor home one was in the house So when I ran out of the one in the house I took the one from the motor home and there was very little bit left I love the powder play what I do, especially in the summertime when you're wearing hats or You know anything like that you put the powder play on and you push it in you know mush You know sprinkle it on very lightly and Then you in dry hair or stout hair second-day hair or whatever and you wish it around and it is amazing It can make you a flat hat hair Look good when I used to run at or walk at work I used to wear a baseball cap and when I came back in my hair my hair was flat Saturated and I still had to work. I would take some of this.  So big sexy hair powder play Love this stuff have a replacement have been using it for a long long time. I also have a Sexy powder play big sexy hair. This is just a different Color and I don't know why but it is the exact same thing. So I've got three of them actually But I finally ran out Imagine that having kept them all this time in my elf.  I love the elf Paulus. How do you plant primer? I have a basket of primers that I've been using and trying and Some of them are really expensive primers, but I go back to this one. I love it. It's empty I have a replacement. Actually, I think I have my replacement right here. I do. So I love this stuff I will continue to use this stuff. I got my replacement. I Don't know why I'm smelling it. There is no smell But I love this primer.  It really works. It works. Awesome I've talked about this a couple of videos ago because I was getting ready for the wedding I wanted my feet to look pretty. I have a pair of shoes up at a superimpose the video here So you can see my toes and my in my shoes Anyways, I had winter feet dried callus icky. So I use the this is the I've got this linked in my Amazon store. I think I'm gonna try a different brand next time I think I might have mentioned that it comes to a pack and I did this but I didn't feel like I got a really huge peel like I did the first time But so I'll probably do another one. I love that. I also ran out of my topics I use this to fill in when you're when you have thinning hair a Something like this if you sprinkle it on Really can make your hair look thick now. I'm wearing a wig so you're not gonna be able to tell but I ran out of this Have no fear Have no fear I ran out of this but I have a whole new one a whole big one It's pricey, but I really really like it The other thing that I used and I really like this This is the Emma Hardy and this is their Mourning Mourn Manigla more M-O-R-I-N-A-G-A cleansing balm. I Don't know where I got this. I don't know if it was sent to me And I don't think it was sent to me in PR But I think I might have gotten it in a boxy charm or in something it could even have been Oh gosh, I don't know, you know could have been anything really but bone dry empty. I love this cleanser It is so nice. It's a cleansing balm made my skin feel really nice Love it not gonna rebuy it though because I have a lot of cleansers And I'm currently working my way through Peaches skincare cleanser. I really like that a lot Setting spray finally finish this. This is the Bella Jade Moline Fab and Glam turned beyond to this. I love this. I am buying another one But not until I finish the two setting sprays that I have. I love this perfect setting spray This is the Sky High mascara finish it up Love it. I have a backup already, which I will be finishing. I also use my My this is the essence in purple So between these two mascaras, these are my mascaras of choice when I went away for the wedding This is the mascara I brought with me and the mascara. I use the entire time at the wedding really like it a lot Blink I think I've gone through a couple of empties on this I'm going to do an announcement on a winner for blink And I think I'm going to draw that in my next video a couple of masks I took these with me the Hydro masks from City Beauty I took out four of them five of them with me on vacation. Oh my gosh, I love these masks They make me feel so good. I also have a gin amber mask Love them and then Dr. John These are the masks that I just have a lot of but it is the City Beauty one that I've really used the most of And then the little makeup removers. I Get this at Sam's Club Members mark and I think that is Sam's Club exclusive Brand I think so I get these at Sam's Club. I really like them a lot and I probably definitely have Probably have another big box of them because I buy them at Sam's Club in a big box on point liquid eyeliner I've had this forever on point liquid eyeliner. This is by pure P. You are I like it a lot, but I've got a ton of different eyeliners that I'm going to use so I'm not going to You know not gonna rebuy that I don't remember when I got it or anything of that nature while I was away. I brought my boots number seven foundation with me with the sunblock and The rest of the time I did my Estee Lauder. So I had my Estee Lauder. This is what I wore at the wedding I really really liked it. I also brought with me I didn't mention this product beforehand, but this is from City Beauty brand new to me I'll link all the information, but this is an ultra firming dry oil. I love it I haven't used it all that long. I took it with me on vacation and I Used it twice a day. What you do is a dry oil. You apply it to your clean I can never say that word. Declatage Declatage. Declatage. Declatage and your neck and you go in an upward motion and you just massage it and I Don't know that it's making my neck look better yet But I love the way it makes my skin feel when I put it on so I put it on my chest I bring it up. I go up my neck and I'm just kind of massaging it in. I just really I think this is Ultra dry firming dry oil. I'm going to list all the ingredients. I Think this is a fantastic product. This was sent to me complimentary from City Beauty I am an affiliate member of City Beauty I know a lot of other influences are as well And I just missed their lipstick sale because I was away and I do have some City Beauty Lipsticks or glosses that I really like but I missed that this product a lot a lot That's my empties We had a great time when we were away. The weather was cooler on our last day We went from Hilton Head. We drove back to Savannah We went to Tipee Island J and I went around walked around Tipee Island and we did we did really good Then we wanted to go back to the riverfront area and walk around there But we couldn't find parking so we ended up going back to the airport a little bit early Which was fine and we got settled in the Savannah Airport is beautiful. I couldn't I couldn't believe it So it was a mixed bag COVID-wise. I saw people You know without masks people with masks now in the airport and the planes everyone had their masks on Everybody was social distancing. It was pretty good But out and about Hilton Head Island mandated mask wearing So you had to wear a mask all the time But other than that some people were without masks and people had masks on I felt totally totally fine the entire time We had our hand sanitizer. We had our masks. We bought What do they call the K 95 or whatever off of Amazon? We bought we in black right so that it would blend in not look like You know stick out so we had that and then for the wedding itself I had a really pretty fancy mask and I it was Silver with like glitters and I just put it over the black one and it looked fine. It really didn't I was totally protected So that was really awesome. I did go to my my attempt to Wait loss. Yeah, right attempt. I did really good I've been trying to do intermittent fasting and I've been taking the apple cider vinegar gummies that I had Shown you I think in a previous video. I'll link them below, but I've been taking those and I think Between the intermittent fasting and the apple cider gummies. I think that it's helping me with my appetite a little bit And also giving me a little bit of boost of energy So we were on vacation we every time we went out to dinner. I had a drink and I had the type of drinks that you have on vacation Frufru girly drinks high-calorie sugar syrup strawberry daiquiri's peanut coladas Melon colada really good tasting drinks. So I had a at least a drink. I don't think I had more than one I didn't I didn't have more than one except maybe at the wedding, but that was diet coke and wrong So but on vacation I had every time we went out to dinner I had a drink and it was high-calorie Frufru's and I came back from vacation I didn't feel like I'd gained anything in fact I thought I might have lost something and I think it's the apple cider vinegar and The intermittent fasting so keep your fingers crossed for me. I'm trying a little carb I'm just trying to be super good. I do have to place an order of my built bars I'm all out of built bars and those things really help hold my appetite big time. So I'm going to place an order for that We just had a great time at the wedding and even though the weather was colder than I expected It was nice to get away. It was nice to feel somewhat almost normal someone Someone not completely put somewhere. So anyways, um, yeah, that's the scoop. I went on my head I have Raquel Welch Real edge. No real teal. I don't know why I said real edge Maybe it is real edge.   I love this wig. I just think this wig is so I love the color It's just so it's so pretty. I'll do it quick turn So you can see what it looks like at all angles Thank you so much guys for watching and I will catch you in my next video Stay safe. Stay happy. Now. See you later