Good morning, everyone. Thank you so much for joining this session. I hope you're enjoying the CubeCon. My name is Sohan Konkerka. I work at Red Hat as a senior software engineer. I'm working on cryo and signal specific projects. Today, along with me, we have... So I'm Julien Ropé. I'm working for Red Hat as a software developer. I'm also a contributor to cryo and I am involved to the Cata containers and the confidential content of projects, too. So today we want to talk about what happened in cryo in the past months following our graduation within the CNCF. We will talk about how the project behave at the community level here. So this is showing the number of stars that we have on the GitHub project. This is a steady incline, as you can see, over the years. It is showing growing interest into the project and follows all the work we do to keep having more contributors and contributions to the project. As part of it, the work we are doing to get more contributors include working with mentorship programs, with, like, the LFX mentorship, so we had successful contributions following that. So, yeah, we see a steady number of commits and contributors going on at the community level. So we can say the project is in good shape and is seeing attraction. Next, so just a glimpse of what we are going to release in the next release, 1.30. So this is just a small number of the things that are going into that release. So first, we are going to have an easier way to deploy second profiles using OCI artifacts. We're going to release support for the S390 architecture and the enablement for split image file system, which is something that Sohan is going to talk about a little more later on. So also, we added the ability to give time zone information for the pod and containers to for them to be able to process the local time and more internal is an instrumentation of calls with the NRI plug-in. So it's just a way to give visualization of internal processes within the cryo components. So this is it for that. OK, so more technical projects. So this is we want to talk about what we did to integrate confidential containers support into cryo. So confidential containers is about running your workloads in a trusted environment. And we are doing that by using a virtual machine, which is running on a hypervisor with the ability to encrypt the memory while it is in use. The goal is that while we already encrypt the disk, we can already encrypt the network connections. Now with confidential container, we can encrypt the memory while it is in use, sorry. And so even an administrator of the host cannot dump the memory and see what's happening in there. So that's the whole purpose. So that's why I wrote there. We don't even trust the host. We have to build that trust. So in the next slide, we can see how we build that trust. Yeah, so this is a drawing showing a high level, how it is working. On the left hand side, you have your regular worker node with Kubelet cryo. And at the bottom, so in place of run C C run runtime, we have the Cata runtime, which is responsible for creating a VM in which your container is going to run.  So it is running on a hypervisor that has hardware support for all the certification attestation. This is so typically it is TDX for Intel. It is SAP S&P for AMD, so things like that. The goal is that when the VM starts, you have this attestation agent that is going to run and verify that everything that runs from the host CPU up to the VM image itself is genuine and has not been altered. So this is done through certification. You have the relaying party separate from it. Key broker services that helps you validate the certificate that the CPU is giving you. And so the first thing that the attestation agent does is verify all that stack. And if anything is wrong, it just shut down the VM. So your VM, your workload, your sensitive workload is not even downloaded yet. So it is safe. If something goes wrong, it is not touched. If things are validated, then the image management kicks in. What happens is that the agent is going to talk to the registry, take the image, validate it again with certificates, with attestation, and then decrypt it and then run it inside the VM. So this is how confidential container works. The way you see it here, you could say, well, the VM is autonomous. It doesn't need anything from the cluster. So why do we need to change cryo for that? And the answer is, in order to download the image, we have to know which image we want to download. And that's an information that only the cluster knows. So we have to give away for the cluster to give that information to the agent somehow. So this is the next slide. Thank you. So how do we do that? Our first attempt at doing it was to try to relay the pool image request from Kubernetes directly to the agent inside the VM. We tried to do that in a proof of concept implementation for both container D and cryo, but we found that it was very invasive. The reason for that is even at the CRI level, you can see that there is a clear separation of workflow between the image management and the runtime management. And it has an effect on the implementation because then in cryo, you have clearly separated code pass. For image on one side and runtime on the other side. So when we tried to relay the pool image request, we had to make bridges between parts of the code that were not designed to talk together. And we were modifying the workflow even for regular container, which was a bit a bit big change for something like that.  And now we are doing something different where we modify the create container request by adding some additional options to it in the mount options of the create container request. And we do it just while it is being processed. So the idea is to add the small set of information here. You see it is very simple. The first line is just telling the agent, you have to pull the image, actually. And the other one, the second one is giving it the idea of the image to download. The rest of it are optional information that we may use later. But for now, for this feature, the two first line are the only one we need. So this has been implemented in container D using the NIDUS Snapshotter. So Snapshotter plugins are a way for container D to be able to prepare a snapshot for the container before pulling the image. And what the NIDUS Snapshotter does in the confidential container situation is to pretend that there is a snapshot and so that container D doesn't pull the image. But instead of preparing it, it is just adding that information. So from container D point of view, there is no change inside the code. It is just the plugins that modify the behavior. Now, how do we do that in cryo? The fact is that in cryo, we don't have plugins. We don't have the Snapshotter plugin. So we can just take the Snapshotter plugin from container D and put it into cryo. So what we did instead is modify the create container request as we are processing it. This is a much smaller change compared to relaying the pull image request because we have a clear separation of code paths between the regular runtimes and the Cata container runtimes in cryo. So the chance that we did is just modifying the behavior for Cata VM-based runtimes. So that is a change that is already done. It was released with cryo 1.28. And now the other thing we need to do, which is a work in progress, we have to tell cryo to not download the image on the host because cryo is still receiving the pull image request from Kubernetes. So it wants to download it, but it is a waste of time because waste of resources because we are not going to use that image anyway. And it also can cause an issue because in confidential container, we may have encrypted containers image and we don't want to share the decryption key to the host because we don't trust it. So if we do that cryo will pull the image and will not be able to prepare it. It will fail. And if it fails as a pull image request, Kubernetes will not go further and we will never create the container. So we have to teach cryo to not pull the image. This is still in progress. So what's next on the confidential container project for cryo? So we have an alternative way of dealing with images. So you understand that the way I explained it before, each VM will have to download its version of the image. So it means that if you run the same container multiple times, you will have to download the image for each one of them. That's again a lot of resource being used. So we want to provide a way to scale that and it is always a trade-off in security. But here we want to trust the host just a little bit by letting the host download the image and share it via a volume to the various VMs. So we will have to put in place some encryption. We have to make sure that the image can still be validated to make sure that it is genuine. But this is something that is being done as a confidential container level. It is still being worked on. But when it is ready, we will have to integrate that into cryo to offer the two possible options. Yeah, just a word about KEP. The idea we have is for longer term, trying to make a Kubernetes announcement proposal to try to integrate that workflow a little better into Kubernetes. Because today, we are more or less hacking into the create container request. We would like to make it a little cleaner. I have this KEP noted. It has nothing to do with confidential container. The reason why I am putting it here is because it is a KEP that is introducing a link between the image spec, the image identification and the runtime that is going to use it. And this modification is actually helping the gap that I was talking about before because now there is a link between the image and the runtime even at the Kubernetes level. So if this KEP goes on, it will actually help us on the confidential container level to do what we were trying to do. So it's probably something we want to do in the future, trying to make our own KEP to be better integrated. Okay, so talking about KEP. So this is a signaled KEP that we are doing about CRI stats and metrics. So we did this some time ago and it is about modifying the CRI implementation to make the metrics from pod and containers reported by Kubernetes have all those metrics come from the CRI rather than coming from C-Advisor. As it is today, the metrics that Kublet reports are coming from both sources. Some from C-Advisor, some from CRI and first it is a duplication of efforts. But it is also kind of confusing about where the metrics are coming from. And it also requires C-Advisor to be aware of the runtime. So there is a dependency of C-Advisor on the runtime being used, which is counterintuitive because C-Advisor is a higher level component while container D and CRIO are just above it. They are talking to the runtime because they are running it. So it makes much more sense for them to repost the metrics. So we have this proposal to modify it. So this is how it is today. So you have those APIs at the top. You have the C-Advisor resource and summary APIs which are giving metrics and stats for pods and containers. And some of them are coming from C-Advisor and some from CRI. And at the bottom you have C-Advisor being used by Kubelet for the node level stats and the eviction manager. What we want to do next, thank you. So what we want to do is to keep the same API because a lot of people are relying on them so we don't want to change them. Their content will be exactly the same but their source will be different. Everything will come from the CRI. And at the bottom, this is what we are not changing. Everything for the node level stats and eviction manager are still relying on C-Advisor. We are not modifying that. We just want the pod and container metrics to be provided by the CRI. So status updates about that. We want to have this implemented in the next release, 1.30. We still need support on the container this side. And when we have that, we can move the KEP to beta. So that basically means that the feature is there. It is available. It is feature-gated but people can start using it and hopefully to see that there is no change because the goal is that the same metrics are available in the same places. So that's it on my side. And now, Sohana is going to continue with other signaled initiative and an idea of what is coming next in the future of CRIO. Thanks Julian for setting the stage. So before we delve into the specifics of the split image file system update, I want to talk about the common pinpoints in the world of Kubernetes, the constant battle against out of space, disk space. When provisioning a node, we intend to give adequate amount of storage for containers and for storing container images. Traditionally, container runtime uses a VOD directory to store either in a separate file system or within the root file system. And this is where the problem comes, where you might get some scarcity of disk space. In the context of this split image file system in Kubernetes 1.30 is a game changer. It's an alpha and state currently and it uses an approach where it separates the read-only image layer from the write-in layer. What it does, it basically isolates the container at the same time at this, the perennial issue of disk capacity. However, currently there is one limitation. When you separate the container runtime file system, there's a write-able layer on the file system presently. If one tries to write to volume or fmrl storage, then they try to write to node fs. So in that way, you will have two write-able layers on two file systems. And this cave doesn't address separating the write-able layers from the node fs. This predominantly mentioned for image fs. Now let's discuss about the container runtime file system. It has two layers, read-only and the write-able layers. Read-only contains image layers where you can spin up the containers without altering the images. And write-able layers are basically writing the data on the disk. Combining we have image fs. Now, if you want to use this feature, you want to configure etsycontainerstorage.con where you can see on the slide, there's a configuration. For temporary location, you need to use run root and for persisting data, you should go for graph root. However, there's one caveat. For some reason, for graph root, you won't be able to persist the data. You might need to change the SLNX label based on what is there in Borlip container storage. So why this is important? As I described in the previous slide, it not only solves the problem for disk space, it also gives you and provides flexibility in terms of how you want to configure your Kubernetes cluster. Looking ahead, the future looks where we are trying to improve the eviction policies. At the same time, we want to have a clearer fibrous storage reporting. Since it is going beta in 1.31, we are also planning to have some runtime configuration options. Here's the blog written by one of our Red Haters. If you want to learn more about the technical aspects of it. Now, let's shift our gears and talk about some new frontiers in the container and time. We are not just talking about some incremental improvements, we are talking about unlocking the potential. Let's start with Wasson. Wasson is a web browser technology. It's a powerful technology which has gone beyond web browsers to something like client and server applications. WebAssembly in a nutshell is a fast secure, stack-based virtual machine designed to run binary code without knowing the underlying host and OS resources. Now, in this case, I want to see the benefits of Wasson with Cryo in Kubernetes. So I want to give you some real-time use cases where we feel we might want to target in the future. Since Kubernetes is a popular platform for addressing some of the edge computing use cases, with Wasson integration, we are trying to see some agility in terms of enabling multiple architectures. At the same time, Wasson binary is compact, so we are thinking about having some lighter deployments. Imagine a use case where we have a lightweight microservice deployed on Cryo containers within the Kubernetes world on different devices. The second point is dynamic scaling. Kubernetes provides dynamic scaling with the help of VPA and HPA. Here, we want to use Wasson integration in a place where Wasson binaries are compact, which utilizes less disk space. At the same time, there's a rapid startup time which can be utilized to optimize the resource efficiency. Since we talked about microservices, security is one of the important aspect of it. So let's talk about security-enhanced microservices. Kubernetes, as I mentioned, provides security for microservices with Cryo's container security. Wasson is like a cherry on the top, where it not only provides a sandbox execution environment, but also gives you model signing for code in order to maintain the integrity and authenticity. At the same time, allow users to tweak runtime configuration without knowing the underlying OS. Last but not the least, Polygot microservices architecture support. Kubernetes has hundreds of microservices support. With Wasson, we are trying to see the potential in adding Polygot programming language, where it not only helps developers to have different programming language developed with the microservices, but also enables the developer toolkit for it. Now we know the benefits of it. Now our journey started to integrating Wasson into Cryo. Every journey has some hurdles. So let's talk about the roadblocks. Cryo as a high-level runtime supports two OCR runtimes, Seren and RunSea. Seren, RunSea being the popular lower-level runtime in Kubernetes doesn't support Wasson workloads. It doesn't have the native integration with Wasson runtime. And that is where Seren comes into picture. Cryo does support Seren, and Seren has a way to run Wasson workloads with the help of an image annotation. As you can see on the left-hand side of the picture, you can use the image annotation. However, there is a caveat. Passing image annotation down to OCR runtime is not an ideal way. When you pass OCR image annotation down to runtime, it might pose some kind of security loopholes where image might try to configure the runtime in a way that basically gives some kind of security stuff. So in order to address this problem, we treated images with Wasson as Wasson. But before that, I want to talk about the right-hand side where what kind of problems we face while integrating with Cryo. So in Cryo, when the pod gets created, we try to assign the runtime class. For a normal workload, it works fine, but when it comes to Wasson, if the platform of the image is unknown, then that would definitely have some problem. And that's where we come up with the implementation where we treated Wassy-Wasson as Wasson by default. And we also introduced a field called Platform Runtime Paths under Cryo Runtime config where you can actually mention platform architecture and the corresponding runtime. Just a note here, Ciren-Wasson, under the hood we are using Wasson-H as the Wasson runtime. Now, with this, I want to show you one demo. And this is still work in progress. There are a couple of patches which are still not upstream, but I want to give you some overview as to what we can achieve with the help of Wasson integration. So what we are doing here is we are trying to run AI models within a Kubernetes pod with Wasson integration. So on the right-hand side, I'm trying to spin up the Cryo instance, but before that, I want to show you the Cryo config. So as you can see, let me just stop. So in this case, I'm using runtime environment. So you can see in the Cryo config, I'm using Wasson-H plugin mount that is required to run AI models. So I'm using this plugin mount. And as I said, Platform Runtime Paths, we have Wassy-Wasson as the given runtime. So with this configuration, so with that configuration, I'm going to spin up the Cryo instance and I'll be using that runtime to spin up the cluster. I'm just forwarding a bit. So here I want to show you the pod spec and before that I want to show you the image and the container file that I'm using. So here's the container file. We usually known that as Docker file. So in this case, I'm trying to set the environment variable which is required to run AI models. The first one is the plugin path which is required for Lama H. And the second one is the plugin that we required to run, I mean the model that is required. And I'm trying to run a Lama chart for some. Now I'm going to inspect the image that I've created out of that container file. And I'm going to show the platform and architecture for that image, it's Wasson-Wasson. Now let's see the pod spec for it. So here I'm simply using image and I'm trying to mount them volume where I'll have the respective model, AI model. I'll go ahead and create the pod and the pod got created. Let me see the logs for it. Now as you can see the model started running. I'll attach that to a container and I'll start conversing with the pod. And the first question I'm going to ask is what is the capital for North Carolina? Peter, you want to guess? All right, I think we can fast forward. So under the hood we are using Lama H, like Lama model. And since it's an experimental one, you can get the proper answer, but yeah. All right. So with this, let's transition to our next topic which is hard enough, pod man in Kubernetes. Here, what makes pod man so special in Kubernetes is its way of running containers. Here, we are talking about pod man integration. We want to talk about the concept that pod man employs that is running rootless container inside the containers. So in order to achieve this, we want to actually help take help of couple of upstream Cape that we're talking here today. With rootless containers, we're not only trying to solve the security aspect of it, but also helps in mitigating some of the issues that we are facing for a long time. So the first Cape I want to talk here is Procmod option. So before I talk about Procmod option, I want to talk about what is Proc. It gives you a system resources information and Kubelet basically instructs container runtime to mask certain parts under container under host. So containers, the information for hosts, for containers shouldn't be visible. Information for the host shouldn't be visible for the containers. However, for running the unprivileged containers, we need to ensure that certain parts under proc should be visible. And that is where this option comes into play where the moment you mentioned under security context, proc mount unmasked, you'll be able to run unprivileged containers. The second missing puzzle for this is username space pods. Here's the GitHub issue for that. What username space does is it isolates the security identifiers for enhancing your security. So you want to run few processes inside the pod that will have different set of ID and GID compared to the one on the host. This will help us in running unprivileged processes on the pods, which might be privileged processes inside the pod, which might be unprivileged on the host. And this will definitely mitigate the security because even if the container breaks out, it will still be there under that same username space and will not hamper the host specific information. Now I want to talk about the examples. So as you can see on the first two left two examples, it's about running privilege pod with rootful and rootless containers. In an interface ready Kubernetes, those use cases are very important, but getting privileges something very difficult. And that is where we thought of using unprivileged pod with rootless containers. As you can see in the pod spec, we are using annotation, which is supported in cryo releases. And you need to add SLNX options with type container ingenty. So this is a new label that we have added under container SLNX. And you can use this one for privilege SCC. Here SCC stands for security context constraint, which the administrator use for setting the permission for pods. The future work for this is to add custom SCC for running container ingenty label. You can also use username space pod. As you can see on the left side, the pod spec that we have. You need to have annotation. Then you need to mention run as user. Then in order to use username space, you need to put post users as pods. And on the right hand side, we have the cryo config that would be utilized to run unprivileged pod with rootless containers. This setup is still in flux. We might see some changes, but if you want to run this as is, you need US container SLNX package with container ingenty label. And we should also have kernel with IDMAP mounting. And since this is an experimental feature, this is supported in Kubernetes and cryo releases starting with 1.29. So future, like we are excited about cryo's feature. There are a couple of initiatives we are taking. You can definitely go through that QR code and see the future roadmap for cryo. Here are the highlights where I'm going to talk about this automatic reloading of mirror config registry. So there's a project called Spiegel. They want to add cryo support into them. So from cryo side, we already started working towards this particular feature. We also want to implement address space and our framework. We talked about wasm. Wasm is a big thing now. We want to add wasm plugins directly loaded into cryo. And last but not the least, want to add support for free BSD. Yeah, with this, those who are new to cryo, try out, we have GitHub, we have Slack. You can scan the barcodes. We want to hear from you how you like it. You need any feedback. We are here to address those. And with this, that ends the presentation. Thank you so much for your attention. And we are open for questions. Hello, hey, I've heard about your talk about the confidential computing part. And I've opened questions about that. The first one, where are the VMs exactly running? So the VM can run basically the reason for confidential container at the beginning was to be able to run your workloads in public clouds. So the idea is to be able to run your VM in any hypervisor provider and still be confident that nobody can access it. So this was the root of the project, but you can actually imagine doing that on bare metal too.  It works both ways. Okay, so it means it doesn't have to run on the worker nodes. So it can be run on a completely different machine. Yeah, totally. You don't have to run the VM on the worker node. It can be elsewhere. Okay. And how do you ensure high availability? That's a good question. I don't have the answer for that, to be honest. I am working on the virtualization side. So that's a question that I think we should ask to the other members of the confidential container team. They are around you actually. And we also have a talk at 2.30 this afternoon where you can find them. So if you want to ask questions more related to confidential containers, I think this is where you should go. Okay, thank you very much. No open questions. So I think we are out of time. So thank you very much.


Everyone, Drone Tech here. Watching the State of the Union last night, I was absolutely sure that the usual suspects would be losing their minds in framing the event as a racist white clan meeting. The Democrats have no convincing arguments when it comes to defending their open borders policies, so they use their list of magical words that are supposed to shut you up and grant them victory in the debate. True to form, they took to Twitter to voice their displeasure over things like low unemployment for black people. Hilarious socialist comedian Sarah Silverman was at a loss for words, tweeting only, quote, fear-mongering pig. I'm not sure that someone that's constantly fear-mongering about climate change and declaring Greta Thunberg the, quote, second coming of Jesus should really be casting stones here. Unhinged has been, Cher exploded in a caps-locked rant over Trump reciprocating Pelosi's snub, saying, quote, misunderstood, he snubbed her. I've been alive through 13 presidents, and he's the most vengeful, illiterate, limp imitation of a man ever. He uses America as his personal ATM. He didn't want to shake Nancy Pelosi's hand is because her hands are bigger than his. Also, he is afraid of her. Bruh. Right. Uses the US for his personal ATM. As far as I know, he gives all of his paychecks to charities. If he did use the office to enrich himself, he certainly wouldn't be the first. I mean, her god-king Barack Obama left the White House $20 million richer. But of course, she has no issue with that. But that's of course not all. Bill Maher also felt the need to virtue signal on Twitter and tweeted out, Republicans sure do love anecdotal help for black people.  Really, it's OK to have white hands. First of all, there's nothing anecdotal about the hard data on unemployment for black and Hispanic Americans. Don't believe me? Even Van Jones was warning Democrats that what Trump was talking about last night was real-world implications for black Americans. But he mentioned HBCUs. Our black colleges have been struggling for a long time.  He threw a lifeline to them in real life and in his budget. Talked about the criminal justice reform. He talked about opportunity zones. This school choice. He talked about school choice. Listen, wake up. That was a warning to us, a warning shot across the bowed Democrats. If Barack Obama had produced these numbers, would the media had just blown it off and called him a racist for citing it during the State of the Union? Obviously not. It's just a fact that flooding the country with millions of poor people who are willing to work for a lot less than black Americans will obviously hurt their chances for higher wages. Aren't Americans allowed to decide who comes into the country without dollars like this calling us names?  Classy, another comedy central goblin, Samantha Bee, tweeted out, quote, women in Congress are wearing white to celebrate the 19th Amendment, while the men are white to celebrate being Republicans. First, Republicans aren't all men and they're not all white. These responses are exactly what I predicted would be said about the State of the Union. That cloakroom has a lot of hoods in it. The racial fear mongering narrative is the bedrock of the left, the Democrats and their media. And it shouldn't surprise anybody because they've been using this playbook for decades now. There are real questions about separation of powers and I don't think he should go up there. And second of all, that herd of managers from the house.  They were like nightriders going on. After the Iowa debacle, race obsessed pundits in the media began zeroing in on their favorite scapegoat to blame, the whites. Over at the spew, Anglophobe Sonny Hostin lamented that Iowa has so many whites, which is clearly a bad thing.   Political analyst and former Clinton campaign aide, Zerlina Maxwell, claimed that the white majority in Iowa are guilty of systemic racism. Not positive for people saying heartland. That sounds to a lot of people sort of like a dog whistle for white voters. The Iowa caucus is essentially the perfect example of systemic racism. 91% of the voters in Iowa are white. These people are broken. And can you blame them? Over and over again, they've been sure that the walls are closing in around Trump and they're always wrong. The fact that Trump was there giving the state of the union and not removed from impeachment has driven them absolutely mad. However, you can guarantee that the Democrats in their media are already hatching some new scheme to impeach Trump again or otherwise just keep negative attention on him up until the election and after if he wins. Hey, thanks for watching everyone. If you enjoy my content and you wanna support this channel, please like, share, and subscribe. You can also subscribe to me on Patreon by clicking that link right there, subscribe star, or just sending a donation on PayPal. Either way, I really appreciate it. You can find all the links in the description and pinned comment. Thanks for watching. Keep coming back.


Last time we've been discussing political economy of economic and social policies. We've talked about the US system that it was represented in general by the doctrine of the policy set or the ideology of less affair, but that there were many exceptions to this system in practice, including the agricultural sector, the style of the US state intervening into domestic markets. This morning, I shall be talking about governance and policymaking, and here we'll talk about the main setup, the key institutional features of the US state, okay? And depending on our time, we'll continue with our discussion on representation and participation. So what does the US system look like? Okay, we have the US constitution, and according to the constitution, most power is concentrated at the state level, but we've seen in the introductory bit that the federal government has been increasing its penetrative ability in time. So we've got the expansion of federal competences vis-a-vis or at the expense of the state level in time. But we also see that centralized federal power has always been very important when it came to commerce and foreign policies, okay? So that aside, the federal level or federal government had been expanding in time. The constitution had been amended 27 times. It requires three-fourths of the states to ratify the constitution. The first 10 amendments, as we've talked about, were in the form of what's called the Bill of Rights, and the other amendments from amendment 11, the 11th amendment till the 17th amendment are mostly about election practices and procedural deficiencies of the system. So those 17 ones are really about electoral practices and other deficiencies, expansion of the vote, suffrage, and others. What's important here are the principles of the US constitution. And here we talk about two versions or two ways of separation of powers, okay? So two methods or two mechanisms of separating power. One is the vertical one. We've got the federal level at the top and we've got, because this is a federal system, we've got the state level in the bottom or at the bottom. So we have a separation of powers between the federal government and state governments. So we call this vertical separation of powers. So this is one what's called a check in the balance. This is one mechanism of providing checks and balances or affording checks and balances into the US system. Another is separation of powers but this time horizontally. So we're talking about the federal level and we talk about the separation of powers at the federal government level. The aim here is to limit the federal government's ability to control citizens' lives. So that's the utmost aim here. So we've got all branches of government. These are called co-equal branches of government and the operation of these should not be encroaching upon the lives of citizens. Bearing down upon the lives of citizens, okay? So civil liberties, civil rights, these have to be protected. And this also, the idea here is that the separation of powers especially at the horizontal level would prevent tyranny of majority which we've talked about in the first couple of lectures. Here when we refer to the US system we always keep in mind the term checks and balances which means that the system prevents the constitutional system, prevents one branch from becoming supreme. So no branch is supreme. No branch will say the last word unilaterally, okay? That I want you to remember. And each of these branches will have to cooperate with one another, okay? So it is this quality of the US system, the constitutional system that affords democratic legitimacy, okay? So here we've got once again, co-equal branches. So all of them are equal vis-a-vis one another. This is represented in the horizontal separation of powers. And it becomes a complex policy-making apparatus. Well, I'll explain this in a little bit detail. But this also refers to sometimes, I mean this process because it's so complex because of the fact that there are many veto points and veto players in the system, it becomes rather inefficient in the sense that for a bill to become law, it has to go through a lot of, it has to jump through several hoops, okay? It has to be, it has to gain agreement over many, many, many actors, or by many actors. And all of this is designed to protect civil rights and liberties. What happens is it is the Congress, which is the legislature, which must pass law. So for a bill to become law, the Congress has to pass it. So because it's basically the legislature. The president as the executive arm should sign or veto the legislation, the bill, okay? The Congress, in case of a veto, can override this veto by two-thirds majority in both of the houses. So the Congress can say, hey, Mr. President, we don't buy your veto, we pass the same legislation by a supermajority, by a qualified majority, by two-thirds vote in both of the houses, then you will promulgate it, you will sign it. The courts, the Supreme Court will review legislation or may review legislation or can review legislation on its own initiative. But if the Congress abides by the piece of legislation it passes and the president signs it, but the court says, forbidden, I won't allow it, then the Congress, as well as the states, can join one another and can reverse the Supreme Court decision by a constitutional amendment, okay, by basically two-thirds of the vote in the Congress and three-fourths of the states agreeing to it, okay? As you can see, it's a complex decision-making system in which we have to have cooperation among different branches of government and in case of a veto, for example, or in case of a constitutional amendment, cooperation in terms, I mean, cooperation through vertical lines in the sense that the states, three-fourths of the states must agree to this amendment, this constitutional amendment. So the most important point here is that authority is divided because of the checks and balances because of the vertical separation of powers as well as the horizontal separation of powers. It's called a presidential system, but as you can see, as we shall be talking about, the president has to coexist and should cooperate with, collaborate with other branches of government as well as the federal, representing the federal government as well as cooperate with state-level governments. So the entire system is built on cooperation. Otherwise, the system comes to a halt. That's why it's called inefficient government or inefficient policy-making structure because of many veto points and veto players in the system built into the system. So unless you cooperate among co-equal branches of government, the system will come to a halt. Is that clear? So presidential system does not necessarily mean that the president says the last word all the time, okay? It's a misconception of the U.S. system. So what does the president do? But before that, let me show you how the system works once again. The president representing the executive branch, we've got the president, his executives in the cabinet, members, departments, and independent government agencies. That's basically the bureaucracy, okay? Remember, bureaucracy is part of the executive. It's the implementing and informing part instrument of the executive. What happens is, well, we've got the Congress, as we shall be talking about, which represents the legislative branch. The Congress is a bicameral structure. We've got the House of Representatives, and we've got the Senate, okay? It has responsibilities, but what's important here? It passes legislation. So this is the only, the ultimate legislative organ in the system. The president in this sense, except for the case of decrease, exceptional cases, it is the Congress which passes legislation, okay? The courts, we've got the Supreme Court, representing judiciary, and courts of appeal, district courts, and it is there to interpret the legislation, okay? Once again, the Supreme Court can review a piece of legislation and can nullify it, can declare it null and void, okay? I won't allow this. So the Congress, once the legislation is there, the president can veto bills, but the Congress can override veto with two-thirds with a supermajority of votes in both of the houses, and the Congress also has impeachment power over the executive, the chief executive here, the commander in chief, okay? Please. Impeachment power means that the Congress can find the president in case of treason, for example, can say we find the president guilty of such and such crime, and we remove the president, okay? So that's, it's a specific process called impeachment, yes. There are historical examples. There were votes for impeachment for President Clinton, for example, but that this was never implemented because there was a conflict between the House of Representatives and the state, so it didn't work out that way. Power to appoint judges, the president as the chief executive has the power to appoint judges, and the president has pardoned power, so he can say I forgive those crimes. The court can declare presidential acts unconstitutional, so has the power to do that. The Congress, upon the nomination of the president, may approve federal judges, and the courts, especially the Supreme Court, can declare laws unconstitutional. So you see the horizontal checks and balances in the system, okay? So horizontal separation of powers. What this system requires is utmost collaboration, cooperation, a lot of negotiation, okay? So as long as they all agree, in most cases, at the lowest common denominator, the system will or may come to a halt. The president. Presidency, it's a presidential system, according to constitution. The institution of presidency represents continuity in the sense that elections in every four years, quadrinally, in November, since 1790s. So for more than 200 years, we've got presidential elections every four years, you know, unless there is civil war, unless there is war or unless there is extraordinary circumstances, so for over 200 years, we've been having the system in the United States, we've been having elections for presidency. There are term limits. The president comes to, I mean, enjoys office for four years for only two consecutive terms. So he may run for president next term, but for the third term, he won't be or she won't be able to run for president. The election to the presidency is called an indirect election. This is through what's called the U.S. Electoral College Process, please. Which one? Two term, after Roosevelt. It may be, it may be, it may be. I don't remember this, but I do remember that there was an amendment. When was this? We'll check, okay? It may be the case that it was through 19, before World War II. 19, he wasn't elected for three times. Yes, I think so too. Indirect election, U.S. Electoral College Process. You may have watched or read about this. So it is an indirect process. U.S. voters, citizens, elect, electors who pledged to vote for their party affiliation. Okay, so voters elect electors and each state has a number of electors. And once the election is done, there may be a discrepancy between popular vote and electoral college votes. This was the case most recently, less than two weeks ago, okay? Actually two weeks ago. So we've got popular vote, much higher for Mrs. Clinton than for Mr. Trump. But electoral college votes were much higher for Mr. Trump than for Mrs. Clinton, okay? The Constitution defines the president in a way structurally weak. So constitutionally, we have a weak president because he must receive support of the Congress to push through his agenda. The president does not in this way or in this sense does not enjoy legislative powers. So in this sense, the president is not supreme. Although this is called an archetypical form of presidentialism or presidential system, it doesn't mean that the president can do whatever he or she wants, okay? He must or she must work with Congress for pushing through his legislative agenda, okay? So to pass legislation, it's the Congress. So in that respect, the Constitution establishes the Congress to be the central branch of government. Is this clear? So despite the perception, despite the name that this is the type of system we have, it's a presidential system. We have the Congress or we have the president who needs to work with the Congress because the only way to pass legislation is through Congress. Alternation, what was alternation? Swinging from one ideology to the next or to the other, okay? Alternation had been rather frequent in the US system and it has been rare. We've seen rare cases of the same political party dominating the presidency for three consecutive terms. We had that before 1960s, but from 1960s, we don't have three-term presidents. I mean, not president himself or herself, but we do not have three terms of Democrats or three consecutive terms Republican as a general rule. We do not have that. I mean, there have been some exceptions, but the rule is that maximum two terms, okay? Then alternation. And in time, we've got the strengthening of the executive vis-a-vis other branches of government. So the role of the presidents had been increasing because they've been presenting themselves as the sole national political leader since Lincoln during civil war, 1860s. And the presidents in the 20th century and well into the 21st century, they try to establish a direct power base and increasingly they speak to the nation, okay? They speak to the nation directly and prepare policies relying on their own national constituencies, okay? But still, presidential dominance in policy making is relatively rare. So we do not have the presidents dominating the entire system, okay? Because it is the Congress who shapes bureaucracy. Just imagine, it is the Congress, it is the legislative organ which shapes bureaucracy, which is the instruments of the presidents themselves. So it is the legislative arm or branch which shapes the bureaucracy, top appointments in the system. And it is the Congress which allocates funds. It's not the president which allocates funds because the budget decisions will have to pass through the Congress, okay? So presidents find themselves in a relatively structurally weaker position vis-a-vis the Congress according to the US Constitution. As long as they work with the Congress, can they pass legislation? As long as they work with the Congress, can they push through their agendas? Because those agendas require funds. And it is the Congress which allocates those funds. Is this clear? Do you see how intricate the system is? How intricately related, how much cooperation, collaboration is required in the system for it to function, okay? So that's quite important to remember. And in time, we've got the presidents increasing their core executives. So in time, we do not have, for example, a specific number for departments or members of cabinet ministers. The administration will be composed of the president and his core advisors and his or her secretaries, okay? Secretaries of state, secretary of defense, tourney general and department of homeland security and all others. So it is the cabinet, the administration and we see in time, strengthening of the core executive, the vice president, the president and others that work closely with them such as the secretary of state, okay? So in time, we've got strengthening of the core executive and strengthening of the executive vis-a-vis other branches of government. How does the cabinet and bureaucracy interact? This is what I meant. We've got the cabinet with no legal standing. So numbers of members of the cabinet, we do not have a specific number for that. And they're used mostly symbolically in the sense that we do not talk about U.S. cabinet. There's no cabinet meeting. Yes, the president works with his advisors and his secretaries. But can you think of a cabinet ministers coming together? We do not have that as even in the TV series, West Wing or House of Cards, you do not see presidents in cabinet meetings. Unlike the case of, for example, the British system. In Downing Street number 10, you could imagine, well, Tony Blair, Theresa May now, or David Cameron coming up with his ministers and making a collective decision. We do not have that here. And the number of members fluctuate. Bureaucracy, it's formally part of the executive but responsive to the Congress. Because top appointments has to be approved or have to be approved by the Congress. So it is the Congress which shapes the president's executive arms. In that respect, they need to work with one another. Very carefully. The US system in terms of interest intermediation is known for what's called an iron triangle relationship. And this is a relationship between or among the congressional committees, federal implementing agencies, i.e. bureaucracy, as well as private interest groups. So we have one example here. We've got the bureaucracy tobacco division of the Department of Agriculture. So Department of Agriculture is representing the bureaucracy. Congressional subcommittee or subcommittees of the House and the Senate, the agricultural committees and interest groups, tobacco lobbies, including both farmers as well as manufacturers, okay? So this system is represented in what's called an iron triangle relationship in the sense that as you can see, bureaucracy approves of, I'm sorry, bureaucracy provides information to the committees. The committees approve of requests for budget and bureaucracy may help with constituencies' complaints. Interest groups provide campaign contributions and support to members of the Congress, especially those members who are members of the subcommittees on agriculture. They provide information about the industry to the Congress, members of the Congress, and in return, legislation affecting tobacco farmers and manufacturers are passed in the parliament. And from interest groups also affecting bureaucracy, information about the industry, support for agencies' budget requests. So basically these guys lobby the Congress for expanding bureaucratic budgets, or budgets of the ministries or the administrative executive agencies. And rulings on tobacco production and prices will be shaped by bureaucracy. So we've got different departments or different agencies representing the bureaucracy with different powers over the system. We've got interest groups seeking special treatment from the bureaucracy and they try to lobby the Congress so that their proposals become, or take effect in terms of legislation or in terms of administrative decisions. So legal decisions or administrative decisions. Okay, so the reason why I wanted to talk about iron-trigal relationship here is to show you how the bureaucracy works with the Congress and that it is exposed to, excuse me, interest groups, pressure groups which seek special treatment from the bureaucracy and which help the bureaucracy get what they need in terms of funds, in terms of staff, through the Congress. So as you can see, it is an intricately related relationship among all these segments of the policy-making apparatus. It is in this way a symbiotic relationship. Okay, so they coexist, they live together which, in some respects, seen through a critical eye in the sense that this may lead to what's called regulatory capture in time, in the sense that the bureaucracy, in addition to or as opposed to serving public interests, they may end up serving private interests, okay? So the relationship becomes so intertwined that the bureaucracy may, you know, they're utmost, you know, they're utmost rationale, they're utmost aim should be serving the public interests but they may find themselves serving special interests who are seeking to influence the policy through the iron triangle here, okay? So these are, this is one example of how the iron triangle works. Sorry, we've got in terms of governance and policy-making, we've got the judiciary, the courts, the court system, they're dependent on the president for appointments and Congress for nomination and there is judicial review of laws in the sense that the US Supreme Court may or can and does review constitutionality of pieces of legislation. And they step in, the court may step in to protect civil rights vis-a-vis governments. Subnational governments, of course, it's a federal system, very important, they provide services much more directly than the federal government, especially with when it comes to, for example, education. Okay, so that's one area which is jealously guarded by, you know, state level. In fact, even city-level governments. Local governments, they provide more direct services such as fire protection, such as water and taxes are paid to both levels, to your state, as well as to the federal government. And policy-making, when you look at the system, as we've seen examples here, it's a very complex, intricately detailed system. It may come to a halt easily because of cross vetoes, but since we have a political culture which enables collaboration, cooperation, this, you know, the instances of complications may be much less in practice than in theory. And there are many venues for pursuing or seeking your interests as interest groups, as social movements, for proposing new policies or changing policies. You've got congressional committees. You've got congressmen, congresswomen. You've got regulatory agencies, as was the case for iron triangles, you know, FDA, Food and Drug Administration, Federal Environmental Agency, National Aeronautics Board, you know. So all of these agencies may be venues for shopping in the sense that may be venues for interest articulation, so that they would be exposed to interests. And you may have state-level governments who may be exposed to lobbying. So all of these for proposing new policies or changing policies, they provide different venues in this multi-tier, multi-level system of governance so that, you know, all of these venues are exposed to lobbying practices. Yes, it complicates the process, but at the same time, the fact that there are multiple venues in different branches of government, across different branches of government, and across different levels of government, provides all kinds of input legitimacy to the system. I think we can stop here and then we'll talk about the legislature next class.