Okay, let's get started. Welcome everyone. Thank you very much for taking time under your day for joining today's CNCF webinar, Secure Self-Service Kubernetes. I'm Jerry Fallon and I will be moderating today's webinar. Just a few housekeeping, we would like to welcome our presenter today, Mr. Jim Baguadilla, Founder and CEO of Nermada. Just a few housekeeping items before we get started. During the webinar, you are not able to talk as an attendee. There is a Q&A box at the bottom of your screen. So please feel free to drop your questions in there and we'll get to as many as we can at the end. This is an official webinar of the CNCF and as such is subject to the CNCF Code of Conduct. Please do not add anything to the chat or questions that are in violation of the Code of Conduct. Please be respectful of your fellow participants and presenters. Please also note that the recording and slides will be posted later today to the CNCF webinar page at cncf.io slash webinars. And with that, I will hand it over for that's where our presenter for today's webinar. All right. Thank you, Jerry, and thanks everyone for joining. So today we are going to talk about secure self-service Kubernetes. So just to kind of unpack that and set the context a little bit. If you think about where we are today in the cloud-native journey as the space of walls, there's several ways that we all know and that we all use to bring up Kubernetes clusters and kind of use them for our personal use. So it's fairly easy to spin up Kubernetes, whether it's on our laptops, on different virtual machines, cloud instances, or even using a cloud provider. It's possible to get a Kubernetes cluster running fairly easily. But the challenges that when we work with enterprise customers, larger organizations, the challenges that you typically end up facing are what we think of as day two challenges. So this is once you're past that initial deployment, it's dealing with Kubernetes configuration management, especially around the security and best practices of configuration, having visibility and governance into the cluster configurations, what's running on clusters, and making sure that the required services are running. And then dealing with cost compliance, as well as managing, of course, the amount of clusters and the amount of resources that get used. And it's interesting, with every new technology, it seems like when virtualization came out, we had VM sprawl. So now, certainly, we're starting to see the signs as Kubernetes continues to explode in popularity. We're starting to see Kubernetes sprawl also happening. So what's the way to deal with this? We all know that in our space, especially, and given where we are, going back to a traditional IT approach where you're creating IT tickets and you're waiting for resources to be provisioned or some central team to manage things, those days are gone. So there's no way we want to go back to that style of doing things. But at the same time, completely going in the other direction doesn't work either. So making all of this, Kubernetes management, cluster management, developer responsibility is just not going to work also. And as we continue to, as Kubernetes evolves, if you go to any offering. So I was looking just a few days ago at the Google console, the GKE console. And it's amazing how many different features, how many options, how many different items are now available there. So how do developers know what to provision, what's required for their enterprise, and how do you manage this at scale? So certainly, this is not the best practice either. And there has to be a proper balance. So we want to get, as developers, as a software developer myself, I don't want to, if I need some resources, I want to be able to self-service, create them as needed, get them at the right time, and dispose of them if I'm not using them. But I want to make sure that I'm compliant with my enterprise policies. I want to make sure that these clusters are secure. And I want to make sure I'm, of course, managing costs and expenses correctly without having to take on the additional burden of managing things at scale, but do this in an easy manner. So that's the topic we're going to cover today. And just to actually get to the punchline, and we'll go through these in each detail. But what I'm going to show today is at least three things you're going to need to achieve what we are just saying. So to get to secure self-service Kubernetes, you require policy management, and especially workload policy management. You require some form of virtual clusters. And I'll talk about some of the work going on in various Kubernetes working groups, as well as commercial tools and things that are available for Kubernetes virtualization. And then you're going to need add-on service management in a central and scalable manner. So these three are the fundamental things that we believe are required to do secure self-service Kubernetes. And of course, as the space evolves, as more things come in, this list may grow. But at least as of today, these are the fundamentals that you will need. So just a quick introduction. I'm Jim Beguaria, founder and CEO at Nermota. Within the Kubernetes community, I work in the policy working group, as well as in the multi-tenancy. And some of the things that I will present today are directly related to ongoing efforts, things that are happening within these working groups. Certainly, if you are on the Kubernetes slack, feel free to reach out. If you're interested in any of these topics, feel free to reach out and join in in one of our sessions. All right, so before we get into the three things I mentioned, I want to take a small detour and talk about cluster sizing. Because this is often a debated point in terms of should you have large clusters, small clusters, or how do you manage clusters within a larger organization. So of course, it's possible to say, OK, well, let's just do the spinning up clusters as easy. So let's do one cluster per app. Or maybe we have a hybrid kind of model where we're doing one cluster per team. If you happen to be working with on-prem clusters or private data center type deployments, you are more likely to be on the other side of things. You'll have larger shared clusters because these are fixed cost resources. They are assets which have already been deployed. And you're going to end up trying to securely share these clusters across your teams, across your organization. So some of these you can think of as single use clusters, either one team or one application using those. And the idea is that you make it easy to provision or you just allow your teams to go to your cloud provider of choice. And with some governance, they're able to bring up their own clusters. And that seems easier because there's less to do from a central point of view. But of course, it's going to lead to inefficient resource usage because everybody is going to over provision based on their capacity requirements. And the net resources that you're going to end up using are going to be far greater. And you're going to have many more clusters to secure and manage. So perhaps if you're dealing with three to five clusters, this is not a problem. But once you get your double digit clusters or in some cases even dozens or hundreds of clusters, this becomes a daunting challenge in terms of how to manage and secure them across all of these. On the other side of things, on the other side of the spectrum, if you're using extremely large clusters, I mean, yes, you can get better utilization. You kind of now will require some team to manage these clusters. So perhaps that's a drawback or that's a benefit, depending on how you perceive that. But there will have to be an operations team managing these clusters. And then these larger clusters can be more complex to manage as well. So because of the multi-tendency, and we'll talk specifically about some of those details, what's required to achieve multi-tenancy based on namespaces and other Kubernetes constructs. So both options have some trade-offs. And really what it comes down to is that, of course, you want to share clusters whenever possible, but you have to invest in the automation to be able to do this. And we'll look at some ways of achieving that. But even if you have shared clusters, you are likely to end up with multiple clusters for DevTest, for staging, for production. Perhaps you have several regions in which your applications are deployed. So multiple clusters is going to happen. The question is just how many and who's managing them. And independently or regardless of how you end up organizing your clusters and organizing access to clusters, every cluster needs to be secured and properly configured. Because if you're running your applications on it, most likely they're accessing secrets. Even if it's a test cluster, if somebody gets access to that, bad things could happen. So every cluster needs proper security. And as you'll see, there are tools and there are things available to help with these. All right, so let's dive into the first topic that I mentioned, which is workload policies. So the goal of these policies are, if you're familiar with Kubernetes, of course, there's the Workload API and there's several constructs available as we're defining and manage applications. So like with everything in Kubernetes, there's plenty of choices and there's plenty of ways to perhaps make mistakes or even insecurely configure various things. And this is where workload policies become extremely important to make sure to audit your configurations, to make sure that they're secure. Your workloads are well configured and they're following best practices. Now, Kubernetes itself has certain policies like pod security policies or network policies, things like that. But very often, these are pod security policies in particular is right now in alpha state and there's no road map or there's no plan to take that beyond because of some of the limitations and challenges with adopting PSPs, which the way they were designed was they tie back into role bindings and to configure PSPs. Really, there's no way of rolling these out the way it's defined right now without impacting existing workloads. So the idea is, and moving forward, there will be policy management tools and I'll profile Kivarno as a policy management tool. There's, of course, open policy agent, which is also an alternative and I'll discuss briefly the comparison between the two. But there needs to be other ways of securing configurations, auditing, reporting, as well as checking for configurations and best practices. Now, the other thing to keep in mind is that these policies are not just something you want to apply at admission control or even just within your cluster, right? They need to be things which you can check offline in your CI CD pipeline. So just like you would with image scanning, the best practice would be to not even allow as bills occur, as yamls are generated or checked in and to get. You want to make sure that you're checking for the right security and best practice configurations. And you want to then, of course, have another layer of enforcement at admission control. And even with admission controls, because there are ways to get around admission controls, as you might have seen in other KubeCon sessions or if an admission controller happens to be down for a certain amount of time, to be able to also have a layer of background scanning. So all three of these are required. And this is what we'll talk about as we're looking at some of these configuration security. So just to quickly introduce Giverno, the policy management tool that I'll talk, and we'll look at this live. We'll look at some demos in action. So the idea here is to use Kubernetes itself and to use the extensibility of Kubernetes to be able to define and manage policies, right? So what this does is to be able to, with Giverno, you can validate configurations using overlay styles. So if you're familiar with customize, overlays are a way of defining some YAML fragment, which you can use to then check whether the expected YAML exists in the configuration that you're inspecting. You can also mutate with Giverno so you can, Giverno can plug in as an admission controller. So you can mutate and be supported. Giverno supports both JSON patches, as well as a strategic merge patch, which, again, is what Kubernetes uses, KubeCuttle uses, as you are dealing with configurations. Another feature here is to be able to generate configurations. And this is especially useful for namespace-based multi-tenancy. So to generate and synchronize configurations across namespaces. And Giverno, I mentioned it acts as an admission controller. But it also does background scanning. And it also has offline scanning to be able to use this within your CI CD pipeline, right? So there was a question on chat, which was also on scanning. So if you're using Giverno, it covers all three. If you're using OPA, there's Conf test, which you can use in DevTest outside of the cluster. And I'm not sure if Gatekeeper or OPA do scanning within the cluster. But they are able to do this within the CI CD pipeline and then as admission controls. All right, so just a quick overview of what a policy in Giverno looks like. And again, we'll see some of this live. So policy is composed of one or more rules. And each rule can match certain resources. And there's a lot of flexibility. The whole point of designing Giverno is to make it as Kubernetes-native as possible. So there's a lot of flexibility in how you would match resources, exclude resources, based on namespaces, label selectors, kinds, even user roles, groups, things like that. And then once you match the right set of resources, you want to apply that policy to, you are able to mutate, validate, generate configurations through Giverno itself, right? So a sample policy looks something like this, and we'll actually, again, look at this live, look at the policy in action. But just to, if you see the structure, it's very simple to understand, right? So it's got a message that will be shown. It's saying that it's checking. It's using two patterns, right? So that's why we have the any pattern declaration. So if any of these patterns fails, then the policy itself will fail. And here we're checking the security context at the pod level. So this policy is applying to a pod. And we're checking a security context at the container level. So it's doing checks at both. And if at least if one of these is defined, then the rule passes and this configuration is, you know, at least passes this policy. In the Giverno project itself, we have about, you know, 20 or 30 best practice policies. It covers all of the PSP, you know, checks that you would want to do. And by the way, pod security policies are evolving. There's a proposal to have, you know, standard profile levels for pod security. And Giverno will support that and be able to indicate what profile level your workloads, your pods are compliant with. So just a quick comparison of, you know, how Giverno works and with OPA, which Open Policy Agent, right? So on the left, I have, you know, the same policy as on the right. On the right, we have the Giverno example. On the left, we have the OPA example. So the big difference here is if you're using Open Policy Agent, your policies are gonna be written in Rego.  And then, you know, you would need something like Gatekeeper with its constraints language and things on top to manage that Rego itself. So the complexity and the common, you know, kind of feedback we've heard, the reason why we developed Giverno as an alternative is that, you know, Rego of course has some learning curve. It is a programming language, you know, and it requires understanding it and being familiar with it. And also like using, you know, other tools on top, like Gatekeeper and Conf Test, et cetera, they start adding some complexity as well, right? So in contrast, Giverno is pretty straightforward if you understand Kubernetes resources. And if you're familiar with how, you know, different deployment spots work, stateful sets, et cetera work, Giverno is very, very much, you know, in tune with that and uses the other advantages you can use all the same tools like KubeCuttle, you can use, you know, GitHub, style workflows, customize policies themselves become Kubernetes resources, right? So it's very easy to write a customization and change your policy, which you can't really do if you're looking at Rego, right? So that's, you know, kind of the main trade-off here, but it's, you know, something that you should explore and kind of see which one works best. And what we're doing is we're, of course, as we, as these tools mature and as these get built out within the policy working group, we're looking at ways to standardize certain aspects of policy management for Kubernetes. And that's a very, you know, interesting area of development as well. So some information on Giverno, but I wanna kind of go to a demo here and we'll come back to this. And, you know, also, I'll show you what the repo and things look like, so where you can find info. But let's, you know, switch to a quick demo itself, right? So the first thing, what I'm gonna do is I'll bring up, I'll show you, you know, and we'll just follow the instructions as we would as a new user. So let me hide my meeting controls because that always gets in the way. So if you go to Kiverno.io or to the GitHub, you'll see, you know, our documentation is all in Git. And all I'm gonna do on my cluster is I'm gonna just use the simple way of installing. It's a one-line, you know, configuration. And let's take a look, let's make sure that I have a cluster available. So here I'm just using on my Windows laptop, I'm using Docker for Windows and I have a Kubernetes cluster which doesn't have anything in it right now, right? So I'm gonna paste that one line, you know, kind of configuration and this is gonna, you know, install Kiverno. So if we go back and do get namespace, we should see there's a Kiverno namespace. If I do, let's see what's running in there. We should see, you know, the Kiverno pod running, which is good and it looks like it's ready and everything's initialized, right? The way this works is when the pod comes up, it has an init container which also registers itself as a mutating and validating web book. So at this point, every API request that, you know, is sent, Kiverno has visibility into, but we haven't configured any policies yet, right? So like I mentioned, on the Kiverno site, there's several best practice policies. If you go scroll down to our documentation and look at sample policies, pretty much everything you would find in pod security policies, plus other policies are all available here. And we're constantly adding more. We also have, you know, feel free to submit a PR or even a feature request if you feel that there's a policy missing and there's more being added, you know, kind of pretty much on a daily or weekly basis. What I'm gonna do for this demo is I'm gonna go back and I have here one of these policies. So in my, in my, you know, kind of scratch folder, I have a lot of different policies. I'm gonna use the same policies I showed in the slides, right? So it's a little bit familiar. So all this is doing is it's checking to make sure that, you know, a root user, a pod is not, cannot be run as a root user. And this policy is written to authenticate or to match pods, right? So let's do, let's go ahead and apply that policy. So what I'm gonna do now is I'll say, create minus F and this is in my temp folder. So I'll pick up, you know, the policies from that. So this is the policy I wanna apply. And now if I do, you know, in my cluster, I do get C Paul cluster policy for short. I see that I have one policy, right? So let's try and run a workload at this point and see what happens, right? So I'm just gonna, I have another, you know, an engine X deployment I usually use for testing and policies and different things. So I'm just gonna say create minus F and C temp engine X YAML, right? So what you see is I have one policy and what that policy did is it scanned this resource as it was being applied and it said it was blocked and it, because, you know, running as root user is not allowed. So let's take a look at the YAML and see what we have over here and why it got blocked. And a few things I wanna kind of point out which are somewhat interesting. So this is a YAML, very, very simple, straightforward, right? So I have some resource quotas, but the thing here is I have a deployment and, you know, that deployment is, it doesn't have, you know, the required configuration from the policy, right? So run as non-root is, you know, not set to true and which is why this particular policy failed itself. The other thing I wanna mention is this, what I ran was a deployment, right? I did not run a pod, but Kivirno was smart enough to detect that, you know, a workload controller was running when there was, or was trying to run and there was a policy defined at a pod level. So what Kivirno does is it automatically generates policies for workload controllers. You can manage, you can control which, you know, workload controllers at targets, but by default it will do this for most of the common types like deployment, stateful sets, job, crown jobs, et cetera. And because of that, I got this message back when I tried to create the deployment. If Kivirno did not have this feature, what would have happened is my deployment would have been accepted, but then I would see a failure when I tried to, you know, when the pod was created, which is just a little bit kluji and hard to debug, hard to kind of figure out, right? So it's several, and that's just one little example of a feature in Kivirno. There's several such features which make it super easy to, you know, manage these policies. Because it's a Kubernetes native tool, it can take advantage of the knowledge of Kubernetes workloads and how they are structured to do some of these kind of, you know, tasks, right? So, you know, feel free to browse the repos, you know, laid out in terms of there's a number of different things documented here. You can try some of the simple examples, but that's, you know, where that's the first thing that we believe is required when you are, you know, trying to configure secure self-service. So with something like Kivirno and your clusters, now you can, you know, you have not only, so by the way, here I was running Kivirno in enforce mode. I could run this in audit mode and just have it report back policy violations, which I could then, you know, later choose to, you know, manage or, you know, based on those policy violations, I can go inform the workload owner that something needs to be fixed in their particular policies, right? So lots of flexibility in how things are done and very, very native to Kubernetes and easy to use care, right? So again, that's one of the things you need, but not the only thing you're going to need to get to secure self-service Kubernetes, but something like Kivirno, you can now, you know, sort of have the peace of mind that configurations are following best practices as workloads are running in production, you want to enforce and block the things which are non-secure and which, you know, don't have things like resource quarters or probes, all of that you can do. And in DevTest, you might want to run in audit mode and just inform users of this. Oh, one thing I should show, and this goes back to the scanning. So before we kind of move to the next topic, it is the same, and here I did, I tried to apply this through KubeCuttle, right? When I created this, but I can also do something like I can say use the Kivirno KubeCuttle plugin, so I'll just run this. So this is a CLI, which you can find from using Crew and you can install as a KubeCuttle plugin. And what I want to do is I'm going to apply a policy now in my CI CD pipeline. So I'll apply that same policy to that same YAML and we'll see what happens, right? So in this case, I want to do, let's go find that policy. So we'll say this allow root users and I would say minus R for resources and you can even apply an entire folder of policies if you have these or you can apply one at a time depending on whatever is easier. And the workload here was just this Nginx workload that we wanted to do, right? So Kivirno will also, this runs in an offline mode and what happens is it applied. So there's two resources, the deployment and the service and it said one pass because of service pass because there was no policy for that, but one failed and it's telling you exactly what failed, right? So this is how you would run Kivirno in an offline mode and be able to apply and kind of manage policies as part of your CI CD pipeline itself. Okay, so let's go back to the next section and we'll take a look at virtual clusters and cluster virtualization as the next topic that you might wanna consider as you're looking at self-service. Yeah, so a couple of other questions. Let me answer on that this section before we move in. So the one question was how do you spell the, what is the language that OPA uses? It's rego, R-E-G-O, rego or rego. And the Kivirno GitHub link, if you look at the Nirmata GitHub repo, it says Kivirno. So you can go, let me just display that. It's github.com. Kivirno, I can also add that in the chat or we'll make the links available or if you just go to kivirno.io, you'll also be able to get to the GitHub from there. All right, so let's go back and talk about virtual clusters next. So Kubernetes, as many of you probably already know, the origins of Kubernetes were from basically trying to schedule and bin pack containerized workloads on infrastructure, right? So the idea is you have a pool of resources, a pool of infrastructure, and Kubernetes is gonna figure out the best placement, the best bin packing algorithm for making optimal use of those resources. So that's where, I think in that it's sort of unfair to think of Kubernetes only in that sense, but that's one of the core functions. The scheduler portion is one of the core functions of what it does, right? But of course, as we were just discussing policies and workloads, we know Kubernetes also has a fair amount of complexity and rightly so because it solves some very complex problems. So there is a learning curve and there's learning to do things to master within Kubernetes itself. And what this has done is because of that security, the challenges in deploying security, more and more, like what we've seen is teams have said, okay, I'll just deploy my own cluster. We don't sort of, and you kind of bypass that central management, right? So this is where, if you kind of look back again in the progression of most technologies, virtualization and almost every, like when you think about networking or storage or even compute, things started in the physical world and eventually we had virtual kind of abstractions for those resources, right? So similarly, we believe that Kubernetes is going through the same curve and eventually, I believe it's gonna be more popular to use virtual clusters versus actual physical clusters. Because virtualization just allows a lot of flexibility and typically when you think about virtualization, you're what we're discussing is more defining a software defined form of a resource itself. So rather than having to manage an entire cluster, if as a developer, I want my own sandbox, I can get my own virtual cluster or if I even as a team or as an application, I'm using a virtual cluster. To me, it's a Kubernetes endpoint as long as it's compliant with the Kubernetes APIs and there's no unnecessary abstractions, that makes it super easy to manage Kubernetes, right? So here what we're specifically gonna discuss is namespaces-based virtualization and how to achieve that, right? So this is more suitable and you might all have heard that, like hard multi-tenancy with Kubernetes is hard, right? It's difficult to achieve. Some might claim it could be even to completely secure Kubernetes and have a virtual cluster, you have to start replicating things and segmenting things and there are ways to do that, but that's not something you would typically do within an enterprise, right? So the type of sharing and the type of reuse we're looking at over here is for teams within an enterprise, within an organization that are looking to share a cluster and that model we see as being very popular in terms of a request and to be able to mature that and use that easily is what the multi-tenancy working group is focused on. There's various projects, there's a project called HNC which is hierarchical network controller or namespace controller. There's also the Kubernetes multi-tenancy benchmarks which I'll talk about. That's one of the tracks that I work with and that I'm leading within the working group. And then there's solutions being developed for control plane type virtualization. There's a proposal from Alibaba on actually having separate API servers and different to allow control plane based virtualization. So there's also other solutions for data plane virtualizations but again, those are more advanced topics and you require, it's not just standard Kubernetes at that point, you're extending Kubernetes in some way to be able to leverage those. So let's focus on namespaces, right? So what do you need if I have, you know, I wanna use namespaces across teams. So obviously you can deploy a workload in a namespace and if you look at the Kubernetes doc in fact says Kubernetes supports multiple virtual clusters backed by the same physical cluster and these virtual clusters are called namespaces. So problem solved, right? Well, not that easy. Namespaces are just one part of what you need to fully segment and isolate workloads. What you're also gonna need of course is some way to automate and manage access controls. So role bindings as, you know, namespaces are created, requested, things like that. You're gonna need network policies. So you don't want workloads to be necessarily talking to each other or even having access to each other. So you need network policies for that. Then you're gonna need limits and quotas, right? So you need to make sure that one sort of noisy or one, you know, namespace that misbehaves doesn't take down everything else.  So all of those things need to be checked and done, right? So there's quite a lot of configurations and things which have to be managed. But the good news is Kubernetes does have constructs for each one of these and there are ways to automate this and there are ways to measure this. And I'm gonna talk about, you know, this multi-tenancy benchmarks is what we, you know, are developing within the working group as a way to measure this. So the goal there is independently of how namespaces are configured or which tool you use or how you use to create these namespaces. How do you measure that a namespace is properly configured and, you know, doesn't have any multi-tenancy type violations, right? So this is, you know, the link that I'm sharing is within the Kubernetes 6, there's a repo and actually let me, I'm gonna do another demo where we're next gonna look at this, right? And here, I'm gonna hide the meeting controls again. So if I go to the multi-tenancy repo under Kubernetes 6, within that folder, within the benchmarks folder, so within multi-tenancy you can get your benchmarks and within benchmarks you can get to, you know, this tool called kube-cuddle-mtb. So it's another kube-cuddle plugin and the goal of this plugin is to measure multi-tenancy, right? So what I'm gonna do is I'm actually gonna, let's run this in a different namespace and I'm gonna show you how this tool works. So here, let me check my namespaces again.  Empty test, oops, I need to tell it what to create. Okay, so now the next thing I'm gonna need in this multi-tenant test namespace is I need some roles, some user roles to use to create or to build this, right? So I'm gonna go ahead and by the way, the instructions for what I'm doing right now are all on this website. So here, notice it says create a namespace user role, create a namespace. So I'm just kind of following along and doing exactly this, right? So I'm gonna use let's do minus n in multi-tenant test and I'm gonna say create minus f here under my inner root. I think I have this role, so role binding. So let's go ahead and create that. So now if I look in my namespace and if I say get role binding, or let's actually just describe it so you see what it looks like. What I'll have is one role binding for this user Allie who is a namespace admin in here, right? So the first thing now, and I, by the way, already just to save some time, I have built this too, but if I wanna just run this, if I do kubectl, mtb and if I do get, it's gonna show me all the available benchmarks and check that this tool can do, right? So there's about 16 or so benchmarks that it will do. And what I can do is now if I say, if I just look at the help, the other thing we can do is we can say run. I'm gonna say namespace multi-tenant test and just to start with, I'm gonna use a role which is not defined and it should produce some errors, right? So if I say minus as, or I think it should be minus, minus as, and we'll say let's try Jim and there's no role for Jim, right? So it should show me some errors that it can't run these checks and none of these can be applied for this particular namespace, right? So that's what you're seeing. It's going through that bunch of errors. A few things passed because I did configure a role, right? So, and I did configure a namespace. So as that user, I'm not able to, well, if the user doesn't exist, so I'm not able to go ahead and do anything meaningful with that. But now let's run this as this user Allie who we configured before and see what happens, right? So at this point, instead of errors, what I'm expecting is, my check should actually fail because the user exists, but I'm not able to pass these tests based on the user. So if you just create a user by default using, or namespace by default, this is what you're gonna get. Now, how do we fix this, right? So to fix this, you can again use a policy management tool like Giverno or like OPA Gatekeeper. And there's examples for both here. Like if you want to try Gatekeeper, you want to try Giverno, you can do that. But I'm gonna apply all of the Giverno policies that are required to start passing these particular checks, right? So just following the instructions again on the multi-tenancy benchmarks website, I applied all of the policies required and there's about, if I do, kubectl get sepal again, I'll see there's a whole bunch of policies now configured, right? And let's run that test again to see what happens this time around. So we're running again as user alley in the same namespace to see is this namespace properly configured for multi-tenancy? And what I'm expecting to see is for everything where we have a standard policy, there will be, so you see a lot more passes. We still see a few failures because in this namespace, we just created it. I don't have any quotas. So let me go back and actually, we'll add some quotas, right? So here I have like namespace quota. If I add that and let's rerun this test one more time, we should see more passes again, right? So I think you get the idea of how using some of these tools now gets you to a point where you're able to apply these policies and be able to configure namespaces in a quite a secure manner where the only failure we have right now is there is no policy there's an issue logged on this. So right now there's no policy for node ports. So once we have that policy defined in here, this check will also pass. And the reason why this check is failing is because we do with kubectl with MTB, you need to define a label for how to identify multi-tenant resources. So that's expected to show an error in this case, right? So again, a simple way, a very quick way of creating namespaces and managing them. And that's how you can get to namespace based virtualization using Kiverno or other policy engines as well as you can use the benchmarking tool to now audit for this. The other thing I wanna show is and now I'm gonna show actually how this works in Nermaka. So just as an example for what can be built using this, you know, I have a Nermata account. So for those of you who are not familiar with Nermata, Nermata is a multi-cluster management tool. This is my cloud-based account. It's a SaaS-based product as well as can run on-prem as a private edition. I have, you know, a few different clusters like three clusters in this account. And what I'm gonna do is I'm actually, I've configured a user as a DevOps user which is a restricted role, right? And that user, so although I have three clusters in this account, if I do NCTL, which is the Nermata command line, or wherever I say clusters get, I only have access to one cluster. But what I can also do is I can, you know, create environments which are virtual clusters in Nermata. So I can do environments, create, and that will tell me how I can create an environment. So in this case, I could say something like minus minus.  And then I'm gonna say minus minus cluster. And I'm gonna use prod demo. Whoops. And I need to give, in Nermata, we have to give it an environment type. And these types are configurable by the admin. And in my account, I just happened to know I have a type called medium. So I'm gonna create an environment of that type, right? So really, all it took is now in a few seconds, as a developer, I can request a virtual cluster. I got in a virtual cluster. And this is a properly configured namespace with all of the policies, everything required, for security, for resource quotas, for network policies, for the roles. And only I have access to this namespace, right? So now I can invite others from my team as required to be able to provision this. So everything I did, of course, you can also do from the Nermata UI. But I just kind of wanted to show what that would look like if I did this from the command line itself. All right, so that's the second thing I wanted to cover. And I know we only have 10 minutes left, so I'll speed up a little bit. And I do wanna cover very quickly the last portion, which is add-on services and why that's necessary, right? So what I add on services, I think all of you know, like when you bring up Kubernetes or if you use the Kubernetes dashboard, there are some standard add-ons, like metric server, et cetera. And even the dashboard itself would be an add-on if you're using Minicube. But so typically within an enterprise, there's cluster-level add-ons. And these are shared services that are used by every team, by every tenant. And they must be installed. They have to be present for security, for governance, for policy management, like with Kiverno. And then there are other add-ons, which you might need which are maybe optional, but useful for on an environment basis or on a team basis, right? So good examples of this are like using Prometheus for monitoring your app, using perhaps Loki for your log management, ingress controllers for your namespace, so on, right? So the challenge with add-ons is who manages these? How do you make sure that the right version is running, that the workloads that are being deployed, again, are secure, they're maintained properly? And how do you update these across all of the clusters, right? So what I'll show you as kind of the last demo that I wanna cover here is, again, I'll kind of show first how this works in Nirmata, and then we'll talk about some of the procedures behind it. So this time what I wanna do is I wanna say NCTL cluster types, so instead of environment types, I'm looking at the available cluster types. And as a developer right now, what I have available to me is this one cluster type, which it says it's on GKE, it's a Google Cloud and Kubernetes Engine cluster. And what I wanna do is I wanna request a new cluster, right? So I'm gonna say cluster create. And if I look at that command, it requires a few flags. So I'm gonna say, let's say I'll call this GKE demo one, and then I'm gonna call, give the required flags as required has. So here I have to say cluster type, and we'll say GKE demo, because that's the only cluster type available to me as this particular user, right? So much like before we saw with virtual clusters, what happens is now Nirmata has received that request. If I go into back into the Nirmata account, I'm seeing that GKE demo cluster one has started provisioning. In fact, if I go to my Google console, it should have picked up the request and I'll see that here too. But what's interesting here is not just that, okay, we're able to create a cluster, that's fine. But what happens, how is this cluster configuration managed, right? How is it that I'm only able to specify, I really didn't specify anything other than the cluster type. And the way this is done is through separation of controls, right? So if I go look in Nirmata and I look at the cluster type that we use, GKE demo, the administrator has provisioned all of this and this is possible to do through the UI, or you can do it through Paraform or you can do it through the command line. But this is where all of the details of what's required in that cluster, including the add-on services that are required, are configured. Now, once this is configured, what this enables is when somebody wants a cluster, they don't have to repeat all of this information. They're just saying, hey, give me a cluster of this type and here's how many nodes I want in that cluster, right? So again, the idea is to have a central team manage this. And if I quickly look at how again, let's say one of these add-ons is managed, if I go into my catalog, and let's look at this application. So I wanna see how the Walt injector is managed. So this actually is pointing to a GitHub stream which controls, which has the YAMLs for this. So I can use GitOps, I can change the YAMLs and the platform team would be able to manage this application. And that would automatically then get rolled out to one or more clusters which are listening to this. And I can, as a platform team, I can create a release whenever I want. So if I have some new changes, I can also publish this release in any of these channels. And that's where, so I think this already exists. So let's call it two. And if we publish this, this will create, it'll pick up the YAMLs, the latest YAMLs, create a new release and start a rollout across all of the downstream clusters that require that particular application. Now all of this, of course, you can do also through GitOps, you can do through customize and your own CI CD tools, but the idea here is to centralize the add-on management and make it super easy for one team to be able to, a central team to manage the add-ons, the required add-ons like wallet, et cetera. So if you go back and GKE typically takes about five minutes or so to bring up the cluster, this cluster should be coming up fairly soon. And the nice thing is when that cluster comes up, not only is it provisioned with all of the required add-ons, but if I go in a separate window, I have walled open, if I actually go and look at my policies here, I will see that once that cluster is created, the authentication path is automatically created, the cluster does its handshake with vault, which I have configured. And then at that point, it's able to securely get secrets from vault, right? So again, this is not something then each developer has to manage or each team, but it can be centrally managed through a platform team. All right, so just a quick summary of what we covered and really enabling self-service security. I guess my hypothesis and what I started with was it requires at least three things. So workload policies, virtual clusters, and add-on services management. And the good thing is Kubernetes has some pretty well-defined and great constructs for all of these, as well as in the community through tools like Nirmata. There's a lot of things that you can leverage and make this easy across different cloud providers, across different infrastructure vendors. And this is where I love this kind of quote from Grady Butch. For those of you familiar with programming concepts, Grady Butch is one of the, I guess you can call him a father of object-oriented and other theories, where he says, you cannot reduce complexity, right? Complexity is natural, but the best you can do is manage it. So similarly with Kubernetes, I think we need to shift our thinking from trying to reduce that to be able to come up with the right ways of managing it. So definitely, there's a lot of topics we covered. So feel free to, again, reach out to me on the Kubernetes Slack or on Twitter or LinkedIn. You can contact me on pretty much everywhere as Jim McGuadier. And if you are interested in Kiverno or in any of the other projects I mentioned, feel free to check it out from the Git repo. Also, if you wanna try Nirmata, there's a 15-day free trial at try.nirmata.io. So feel free to sign up. There's no credit card or anything required. You can just sign up and register your clusters and start using it. All right, so I think that's everything I wanted to cover. And I know we're up on time. So let me check and see if there's any questions. There's one other question which we haven't answered. The question is what exactly was the environment that we created? It's a good question. And I kind of rushed through that. Environment is really a virtual cluster using namespaces. So it contains a namespace. It contains network policies, resource quarters, role bindings, pretty much everything that we audited for using the MTB, the multi-tenancy benchmarks too. So all of that is preconfigured in an environment. And in addition to that, Nirmata gives administrators a way to manage environment types. So this makes it easy to have either different T-shirt sizes or different quota levels. And you can manage which, you know, where these environments are registered. Okay, thank you very much for your time, Jim. That was a wonderful presentation. That's about all the time we have for today. As I said before, today's recording and slides will be posted later today to the CNCF webinar page at cncf.io slash webinars. Thank you all for attending. Thank you again, Jim, for that wonderful presentation. Everybody stay safe, take care, and we'll see you all next time. All right, thanks Sherry. Bye everyone.


Here are all the need to know locations in the business building If you're looking for the student development team, take a ride after the second automatic door Keep going straight and you'll find the student development team office on your right If you walk back to the main reception area, we call this the concourse Auditorium will be on your right. Let's head down to the lower ground and I'll show you some lecture rooms There are also some lecture rooms on the first floor and you can get there by taking the lift But if you ever get lost look out for these signs


Hi, welcome to the All Things LGBTQ interview show where we interview LGBTQ guests who are making important contributions to our communities. All Things LGBTQ is taped at Orca Media in Montpelier, Vermont, which we recognize as being unceded Indigenous land. Thanks for joining us and enjoy the show. As we reported on a recent episode of All Things LGBTQ, there has been a change at the Pride Center of Vermont. And the Pride Center has hired a new director of their health and wellness program. But it's somebody who's known to us and who makes us smile. So we wanted to take this opportunity to invite Kel back to the program to talk about their move into this new position. So welcome, Kel. Thanks so much, Keith, for having me back. It's so fun to come back and chat and bring a little central Vermont to the Pride Center. Okay, so don't lose that thought. Yeah, because we're going to come back to that. So looking at the Pride Center's announcement, their Mike Bensel's comments indicated that you had already been working basically in this program on a part-time basis, and you were moving up, and they were excited about this. So what made this the best move for you at this point in time? Totally. It was a unique moment in time last winter when the Pride Center was going to start rolling out the at-home HIV testing, and we had so few testers in the mix. We are down with HIV testers in general. We've had a lot of staff just turn over naturally and then we're in a pandemic without training. So there was a moment where the Pride Center hired me on in a part-time basis to basically go do the same job I was doing at Vermont Cares being an HIV tester at the Pride Center. So it was a really cool way for me to straddle the fence and also dip in and help support the social groups. I've always done peer-based work and I knew there would be a point I've applied at the Pride Center and past positions, and it's like one of those moments where you hope as a queer kid, like someday I'm going to work with all these queer amazing co-workers, and it helped me lean into that decision being part-time for that year, and then it's as there's been some transition at Cares, it just was feeling like the work that I'm really jazzed up about doing has to have this social component, and wow has that been so effective, and this is like part of my core being all this art and social outreach that's not part of the work at Cares. So it was like oh that's the Pride Center's work is always the message. So it was always like okay well I'll just do it on my own. And then the moment came up when I could leap to the team and then the director opening opened up and I love to be in the back burner helping other people have the structure they need to succeed and do the work. So for me it's nice to be able to be in the background a bit and out front.  Very gregarious. I was going to say in my conversation with Taylor Small about your moving into this position and she was so excited you were moving into it, Taylor shared that you really like to do prevention outreach and being proactive. So could you talk a little bit about how that's going to fold into the work of health and wellness or how that skill is going to benefit the programs and what we might see coming forward with Kel as the director of this program? It's such a treat to carry the lineage from Taylor to to be tea for tea across that little moment in time and we have such a similar perspective and gauge and come from really different perspectives. So it is going to be really exciting to continue on so much of the great work that Taylor and the team have done. For me I love participatory education. So having events that bring us joy and pleasure that we can also connect to resources and that warm relationship building. Relationships are how we make our most effective referrals. So whether that's happening over an HIV testing or happening at a social or a support group we are building trust with people one-on-one and that for me that's part of the prevention is building trust with people that have been left in the margins that we've fallen through all the holes in the nets and here we are traumatized and triggered so these are our chosen family a lot of the rainbow times and to be able to go out and envision a world where we're not waiting for somebody to be at high risk for HIV to help them understand sexual health risk. So for me I see most of our preventative what we would call preventative we're already reacting to high risk behavior we're putting band-aids on where that's not prevention that's reaction right because we need to get the folks before they're in a high risk situation. Math is a great example of a substance that has a same with heroin they have very short windows where when you're using if you're at risk to become dependent you're at risk in a really small window and have the potential to slide really fast and we know with math that there's a sexual inhibition that a guy might play across sexuality lines even though they might not identify that way so we want to get the folks before they're using math right which means we might get to them when they're drinking alcohol or exploring whatever so more holistic joy based containers that bring the both end of the health and the wellness. So building off what you just shared can you talk about some of the specific programs and outreach that the health and wellness program are already offering and maybe a little detail about them so we might entice people that they might want to attend or participate. Totally shameless promotion moment. So our health and wellness program at the Pride Center of Vermont has three programs within us where the GLAM program is the gay by trans guys. It's really like who's at risk for HIV and we're a social group for gay by trans guys so we do weekly social events we do a monthly sex chat where we dig into high-risk topics and create a space for us to unpack this risk and build peer prevention networks where hopefully folks will attend the groups and then go tell five friends about what they've learned especially why I made the HIV and PrEP comic pamphlets that it's about starting conversation it's not just about moving information so for me those are like education things right knowledge has to be useful to the person so you'll also see us coming out out more we know that HIV testing is getting harder to do with the amount of overdose prevention that's needed right now out of our incredible small teams doing the overdose and syringe support program in the state so for my coworkers and I to be able to go out and do supplementary HIV testing be that warm handoff is we have to get out of Burlington to be able to hit some of those high-risk areas and support getting more testing out those are also places that don't have the queer savvy health providers all the time so we extra need to get out to create those access points and then helping people know that there's also these social groups a lot of our groups are still happening online so that's GLAM sort of like we run the HIV testing we send folks safer sex supplies across the state if you need safer sex barriers lube we'll put it right in the mail to you you can make a request right online we have at home HIV testing for anybody that needs HIV testing we are not we don't have to screen people really hard on identity for that you reach out you let us know you need a test there's a survey we send it to your door we do a virtual session or an over the phone if you want it some people don't want that but if you do and then we help refer you depending on results if there's other stuff you want like more STI testing which we're increasing the ability to make that free for Vermonters if they need STI testing that's been a huge gap with prep we've been able to for some years now been able to make the medication free but not the three to four times a year that you need to go get STI screenings those lab fees get up into the upper hundreds to thousands now we can really help people get affordable low to no pay screening and care with Planned Parenthood and some of the providers so that's a really exciting new thing so that's one part of our umbrella and then we have the QT BIPOC program Thrive which is specifically how do we help build and bridge and connect our QT BIPOC community thank the goddess that they live here and how do we like create safer containers that they might truly thrive so they're a huge perspective part of our program my co-worker Richard and a couple of our board members are involved with that program and then glow the women and women the line program they do a lot of cervical cancer breast screening heart health like specific connection with folks and then do social groups like Pride Hikes are super popular events we'll have dog walks coffee shop nights they do movie nights we're going to do a bunch of speed-friending events virtually through the spring so that some can be program demographic specific and then just a Pride Center wide one that we can all just meet each other we need more of that too it's like everybody is asking you know how do we break down the silos and or where do I fit as a non-binary trans identified person my gender shows up differently what group do I fit in so breaking down unpacking some of that again making risk a skill up how do we help people assess risk better for themselves and I could access all of these by going on to the Pride Center website or the Facebook page or signing up for the monthly newsletter that Justin has been sending out exactly and I use our calendar at the Pride Center when I do queer events that are not center run I put them on that calendar so there's stuff that it's all of our groups and it's stuff statewide so I think that's a really great role for the Pride Center as part of what we do we run the big Pride Fest but also just having a platform to cross pollinate so with our remaining time you were as clearly establishing yourself as an organizer an innovator and an activist in central Vermont you have kind of alluded to the Pride Center maybe inching out a little bit more out of Burlington so are we going to see a continuation of some of these central Vermont outreach that you've already spoiled us with definitely you're definitely going to see more street based stuff and then also some more formalized larger events Elaine Ball and some community folks including me are talking about us Montpelier-based Pride for June 345 somewhere in that catchment I have already booked the Berry Old Labor Hall for a double drag feature showcase evening of both the Vermont Drag Idol and the Central Vermont Drag Ball so we'll do a drag pop-up with workshops and resources all day we'll have the youth-friendly amateur contest as the first round and then we'll do the sassier adult version mature audience and that's June 11th so the first two weekends in June and we go into Juneteenth and then there's already talk of Bethel doing a Pride at the end of June potentially and Burlington People's Pride I bet will happen again too this year I would be would be surprised and we're moving back to the waterfront our Pride in Burlington so I don't know if the kitten's officially out of the bag on that so don't quote me but yeah I didn't hear a thing yeah you didn't hear a thing but yes me being in central Vermont I think that was a helpful hook like I'm HIV positive that's a hook I'm a trans person like that's something that we get right so having all these networks communities I want to both help merge some of that with the center and some of that's not mergeable because it's you know different type of work so I'm excited for more collaboration I'm excited for more of like how can the center we don't have to run everything how do we help lift up and support all these other community prides that are popping up it's incredible and gives me a place to go do HIV testing so it's really a win win win and with that I I just want to thank you and acknowledge what an absolute treasure you are and how fortunate our communities are to have you here and your level of activism and I'm going to do an invitation now for you to come back for us just to talk about prevention and not just oh you need to do things to keep yourself safe we're going to talk the real talk about this is what you need to do and this is how you do it so with that thank you thanks so much Keith always a pleasure hi everybody I'd like to introduce uh Maya cast and cast and gay is that right yes okay good um and she is I believe co-owner and a worker at rabble roses here in my appeal you're the moment if you haven't been it's a really fun place um so tell us a little bit about yourself and how you got involved in this project yeah so um my name is Maya cast and gay I am 19 uh and I'm a co-owner rabble rouser I'm also the shop team lead and uh I also do accounts payable I run the facilities team I wear many hats but mostly my main roles are as co-owner and as the shop team lead um and yeah so I'm 19 I live in waterbury I've got a dog um and uh yeah that's that's basically that's me so did somebody like walk up to you and say hey you want to be an investor in this project we're thinking about I mean how did this happen for you so um yeah so when I was in high school I went to U32 and I did the branching out program and that kind of got me into doing a business management internship um and like during high school my big focus was like trying to learn how to run a business that I never wanted to go to college um so I really really wanted to learn about like how to run a business without spending a ton of money on college um so what I did I took a business management internship um and with rabble rouser and um I was hired on to uh be on the shop team for uh opening the the Montpelier space um we had a space in middle sex uh when we were called muddy steps um we had a space in middle sex and in um August of 2019 we decided to expand and have a second location here in Montpelier um so I was hired on as one of the first shop team members here um and since we're a workaround co-op we have a uh it's called the rising owner journey um and so you spend a year and a half learning like the inner workings of the business learning how um uh the financials every month would do a financial review um uh you know all of our uh all the money we made all the money we spent everything like that learning just how to run the business um and that year and a half process uh the current owners will elect the rising owners to um become an owner and you do a buy-in and all of that so that's kind of how I uh became an owner here um and yeah so but it all started with a business management internship that's great and it's great that you it's great to know to that you knew what to do at such a young age I mean to know that that's what you wanted and and you were gonna go for it so you really need to be applauded for that I mean thank you it's it's a young age to to figure all that out most people don't figure it out till the 30s yeah so that's good um and so you opened and then the pandemic hit yes yep that was tough that was tough um actually your pandemic yeah that was tough um you know in a way I'm kind of grateful for the pandemic in a sense that it gave us a chance to like stop and look at what we're doing what's working what's not working and then as we like slowly reopen we could grow on the techniques that we're working and find new techniques um and it's really helped us grow um but yeah so beginning of the pandemic we shut down the uh the we shut down both locations um and then shortly after we just closed down the middle sex location um so now we're like totally out of uh the Montpelier space um and we were closed down for like um about just like six or seven months um and we were doing luckily we have a good um web sales and wholesale base um so that was really helpful you know through those beginning months um and then in about June yeah I think it was June uh we opened up like this little lemonade stand kind of thing in our front doorway um and we were selling coffee drinks uh shaken shaken cold brew drinks um in our mason jars um and that like really helped build our like in-person uh face back and like in our we have pretty big windows and we would have like our products displayed and we call that curbside shopping so you'd pick out what you want from the window and we'd go inside grab it for you and then that's how you do your shopping for a while yeah I remember that it was uh it was pretty interesting and yeah and I love your space I mean it's so big and airy and and comfortable uh it's really a nice space so uh I imagine once this pandemic's open that you'll probably have I know you have a Sunday Irish band that plays there usually right on Sunday afternoon I have a friend who plays there and um I imagine as the pandemic wanes hopefully it will um that you'll have more activities in there like poetry readings music I mean it's a great space for that so yeah yeah definitely definitely um we so pre-pandemic we had we had a stage that like people play music on and we actually turned that into our like designated packaging area right now um so we have some like spatial things to figure out for like music and stuff but we're definitely looking into like getting back into that um and just like activities in general we're really excited to bring back and so you foresee your future as like just sort of stabilizing this place and getting it working the way you want do you have any idea about wanting to open other places uh other stores yeah I mean it's definitely a possibility we you know we've considered it um at the moment like with the pandemic we're not really ready to do it just yet but it's definitely a work something we're considering um for for the future I would think it would be a big drawing Burlington or Brattleboro or you know any absolutely yeah yeah and the nice thing about having like the the number of owners that we have we have six owners is that you know we can send some owners to like a new location begin a new location and still have owners here yeah people who know how to run the store and can train um yeah yeah so um if you I don't know like I would think some places that don't even have good coffee shops or good places for people to go would also be an attraction if they were close to big cities or the bigger cities so what do you see yourself doing in the future are you just going to kind of hang with the business and keep moving forward and moving up and yeah yeah um I I definitely see that for myself yeah it was always a dream of mine when I was a kid like I wanted to be a business owner um you know previously I was I wanted to own a restaurant I wanted to be a chef you know all that stuff I don't want to be a chef anymore I have I don't like cooking as much as I used to but I but the business owner was always the same um so you know I yeah I mean I really love what I do I love working with all the people that I get to meet here um training new co-workers and just like all the people that I get to see here um so I mean I just can't wait to just stick with the business watch it grow um and just really see where we can take this place and even the other thing that I noticed and I really liked was um that you have a lot of local artwork you have a lot of local vendors that sell out of the store and you have sort of progressive politics by what I've noticed how you post it yes yes you know uh so that's really uh an important thing I think uh at least is for me when I go there I feel like okay you know I'm with my people yes yes yeah for sure you know and that's important uh I think for a certain demographic anyway it is for me so um and you have food limited I know but you have some and that you do yep and you offer it to people on the sliding scale which is really kind of nice that if people have a lot of money they can come in and pay what they can and and get lunch I mean that's really good you know yeah absolutely absolutely and and who decided these things I mean was it like something you decided as a group like okay you know we're progressive we're going to hire people um with that in mind uh and also about the food and I mean was this like a group decision that you made to yeah so actually a lot of the decisions that we make are um in in the teams we do something called integrative consensus uh so in our meetings we bring proposals and there's one facilitator um and there's no like set agenda to the meeting when we come into it um and we all can surface our proposals and that's the agenda the agenda is like all the proposals that everybody in the meeting brings um so like for example when we have our shop team meeting it's all of our shop workers um and we all can surface our own proposals um and then you know we'll start the agenda and um you know whatever has the most stars gets utilized by the facilitator to try and pick which ones that we're going to talk about in the allotted time that we have and then you know once somebody makes a proposal um we'll all have a chance to give questions and comments and then to uh consent or object to the proposal and if we see that the proposal would do harm to the company we can object um but if not then it goes through consensus um and those are like for things that are like outside of someone's role um and each role has accountability and everything like that so it's very like transparent across the board like everybody has kind of a say there's no like one big manager that does everything um so when we were for example for specifically the um the pay what you can sliding scale thing uh when we first open the shop up again after the pandemic uh like when we're doing that little lemonade stand thing um we uh the shop team was it was only like four people at the time now we're about 1415 people um but we it was a proposal that was made and you know we all came up with you know how we're gonna do this how we're gonna process everything and then we all you know as a group consented to it um so yeah I mean that's how we make all of our decisions and uh in that in that particular instance that's that's how we made that decision to have this sliding scale um approach do you ever have anybody I know you have a mask policy have you ever had a hassle with anybody coming in there you know a little bit a little bit you know once in a while we get people who don't want to wear them um but you know they're mostly respectful you know yeah a couple days ago I had someone I said you know the mask is required in the store we have some over there for you and they were like nope I'm not wearing it goodbye and then I just walked out so I mean that's how it usually goes it's it's not usually too big of a hassle um but yeah it happens once in a while but usually people are really good about it well I I really personally appreciate your vision there so um is there anything you would like the audience to know besides go there spend money um if people wanted to apply for a job would they just walk in and say you know hey this is a cool place I'd like to work here yeah yeah people can do that a lot of people end up doing that and um I always just forward them to our our email that fields all resumes and everything like that and yeah it's a really welcoming place to work um we have a really diverse crowd here um a lot of people you know like English isn't their first language and we're just really accepting of all of that and really we work to help each other out and that ends up helping the business out so um but yeah we're we're a really diverse crowd here um and yeah I mean just come and come and see the place the variety of things that we have half of the store is like jewelry and art and the other half is coffee and chocolate um and it's really like all that you would want especially for gifts is a real great place to get gifts um you know I saw things clearing off the racks you know I was like first you had this display and then there were none and then there was a new display so oh yeah yeah especially during Christmas time Christmas time is super busy for us yeah well that's good that's what a lot of people catch up on what they had made during the year so um okay well thank you so much for being on the show absolutely thank you for having me and everybody go over to rabble rosters and buy uh uh what is it a uh uh chocolate vaginas or chocolate yeah the volvas the volvas have a volva have a specialty mocha everything like that so go over buy yourself one or buy one for your friend thank you so much for coming and we'll see you uh soon yes thank you and uh buddy I'm here with Ann McGuire uh long time activist a writer uh even though um she links her activism in her writing fairly directly um a member of a current activist group called Revoting Lesbians which is a direct action group um that has been operating and doing a lot of exciting things in the New York area and in the past internationally um Ann is the author of Rock the Sham a 2006 volume about the irish um LGBT movement to be part of the St. Patrick's Day parade in New in New York and that was an ongoing 10-year struggle to achieve 20 25-year struggle really oh my gosh Ann hails from Ireland so let me start by asking you when you came to the U.S. and how you became how you happened to become an activist okay I came here in October 1987 and um I was already an activist um not heavily around lesbian issues much more to do with um uh reproductive rights in Ireland women in prison especially um republican or nationalist women in the north of Ireland in prison and uh the anti-abortion campaign that has been recently overturned um so I was involved in the campaign when uh it was actually inserted into the constitution that abortion would be illegal but that has been changed and I I think I became an activist for many reasons I grew up in a city that was very politically active when I came of age um my grandmother told me fantastic stories about living through the um Easter rising in 1916 in Dublin and also through the civil war and the war of independence and losing a brother during that and also my grandfather her husband who refused to speak about annual that um was in the Irish Republican army the as he called it the old IRA um so I had her stories in a sense that you know she was just an ordinary woman could live through such incredible historic moments in her own little area of Dublin in this really small little country um and then as I say I I grew up uh in my teens and um early adulthood during a time in Ireland that a lot of stuff was going on so it's not a natural move but it was one I took for some reason and I can't really tell you why I just did yeah and then you moved to the U.S. in 1987 yeah and some time along on this timeline you came out as a lesbian yeah I I came out as a lesbian in Ireland um I mean my friends people I worked with um and my family knew that I was a lesbian already and um I came here and you know went to act up meetings I mean coming here was a massive uh cultural shock even though I'm from a Western country Ireland was like so completely different to New York never mind America and I I think the first several years here um I was really adjusting and looking looking for where I could fit in and find my people and you know do my work um so it wasn't really until the Irish lesbian and gay organization was formed a few years later that um I found where I could do some good activist work in in New York what brought you to New York uh I wanted to get out of Ireland and it was horrifying for a young woman growing up there the misogyny um which was state sanctioned um church sanctioned it was just everywhere and there were several there was the anti-abortion amendment campaign um there was a horrible public trial of a woman who had given birth to a a child that was still born but the state decided um to prosecute her for another the body of another child that was found and this it ended up in in in being like a public trial of Irish woman but women were getting fired from jobs as teachers because they were having affairs with with men who were separated um and girls I mean one girl and lovers um who had been pregnant and hid us died in the grotto of a church along with the child who where she went to give birth to the child on her own and I think that just completely broke my heart and I thought I need to get out of this place it's so toxic and and I came to America so go figure and then you joined the you're one of the founders of the lesbian adventures but you before that you were involved in act up yes I mean I went to act up meetings I I went to a lot of their actions um but I was uh I found act up very intimidating and I mean that was part of the culture shock I believed when I came here that I was a lesbian of the world I was very comfortable with who I was and I got to act up and it was like oh my god I I don't know the half of it I I didn't recognize myself in these uh you know gay men and lesbians who were so confident so ferocious fierce and you know I I realized I had a lot of work to do on on that level which was you know it was good for me it was good for me to learn that yeah and then you were founder of the Avengers and you know from what I've learned that that was a group of women who um got together to make something happen absolutely that you know the Avengers were formed in 1992 I believe and so I had been here since you know almost five years and also I had been involved in the Irish lesbian and gay organization for a couple of years and that um I I mean I had to grow up very quickly as an activist and because of that uh and was also introduced a lot more to a lot of you know the New York activists that I wouldn't have known um city politics the archdiocese um and the law and um I was much more comfortable in New York and much more comfortable um in where where I could fit in so the lesbian Avengers was absolutely perfect timing at that time for for me to you know you know get involved in so yeah that was perfect timing well can you talk a little about the Irish gay and lesbian organization since that you were part of that before the Avengers you were five years or so yeah um I mean we we came together because um there was not there was a lot of Irish people in New York uh coming from you know early 80s all the way through into the 90s a lot of mostly undocumented and uh a huge amount of gay people who are fleeing Ireland um but completely closeted still completely closeted here but you know uh and we saw an ad in an Irish newspaper here saying you know there are gay Irish people here and we'd kind of like to meet so um when the the very first meeting of the group 19 gay men showed up and myself and my partner Marie we were the only two lesbians and we won our first battle in that meeting by naming the group so naming the group as exactly who we were for a start and not a gaelic name some people were pushing a gaelic name which was corda which means friends and myself and Marie were going but nobody will know what that means so nobody will know who we are and uh so we had that battle and then we wanted lesbian to go first and we said it need to be there only two of us here look at all you men lesbian it's going first we want lesbians to know that they're that they're um very welcome here and it's for lesbians as well so i mean the fact that both myself and Marie had some political activist experience you know we actually could go in and win our very first battle at the founding meeting yeah so we're very proud of that and from there we marched in the gay pride parade we were only about four months in existence and it was our reception in that so people thought it was really really amusing to see a banner that identified us as irish gays and they were saying things like oh my god there is no such thing is this a joke and this is so funny and i think there was a meeting after that we thought if the gay community doesn't think we exist the irish community has to be even worse and what about marching in the st patrick state parade and okay and the the result is that you know we were turned down it was completely homophobic and it took 25 years for them to allow an irish gay group marching the parade a quarter of a century it's incredible yeah yeah but it's testimony to your um stick toitiveness to your steadfast persistence in the face of opposition how many members were there by the time you achieved the uh goal of march being able to march in the parade well by then i'll go had long had long dissolved a lot of people moved back to ireland um during you know the uh later 90s early 2000s when there was a decent economy for a change in ireland a lot of people moved back people moved all over the country and um officially i'll go kind of finished up as an official group trying to get into the parade after about 12 years but there was another group called irish queers who had you know had been in i'll go and then invited new people who who turned up at the parade every single year to protest every single year and then there was an alternative parade um started in queens called um same paps for all so it was mostly that group that got invited in 25 years later into the main parade on fifth avenue along with some people who had been in ireland who were still in this in the city um yeah so i mean it was people were protesting it for the whole 25 years yeah or not the same people well so the same were you still involved at the end no i mean i would i would um come to the irish queers protests every every couple of years and stand on the sidelines but i you know i found the whole thing kind of depressing and by then i did not want to be in the same patrick's day parade i couldn't have cared less about it um uh yeah so it left a bad taste in my mouth i mean it was not the irish community in new york um really let us down and totally betrayed us left us on our own completely um people who didn't have to organizations that didn't have to do that did um and eventually the organizers of the parade only allowed a gay group in because guiness were threatening to pull their sponsorship as well as the board motor company and nbc four were saying we're not going to televised the parade anymore so it wasn't out of the goodness of their hearts that they let the queers in it was because they felt they had to financially for their for their parade to continue um interest yeah once again totally so um by the time that happened i couldn't have cared less about the same patrick's day parade it was a major victory of course after all those years it absolutely was so um i'm very glad that other people other irish queer people were were happy to march in the parade and you were involved with like avengers during this whole period yes and you know so with with the lesbian avengers and i'll go and a full-time job i kind of had a lot of push and pull so i would withdraw from avenger to focus on i'll go and then every once in a while go back in and you know do an action with the avengers yeah it was it was a very busy time the nineties were kind of fantastic yeah i know and you work at NYU are you you're still working yes i work at NYU i'm in the school of professional studies i work in um arts and humanities as a you know an office office worker and you were involved with uh barbara hammers history lessons you did a huge amount of research for that yeah well in the previous lifetime i uh worked for rick pralinger who has a fantastic um archival collection and through him i ended up becoming an archival film researcher and did it for quite a long time and in his collection i noticed when i'd be looking for material for a whole other project or um i started to see all these images that said lesbian to me and and after a while i started editing them you know i would take the clip out of something note what it came from when it was made and put it on a separate tape and then i did say it to rick i said you know i'm doing this um do you mind it's obviously not a film about lesbians it's got nothing to do like for example a us army film called the army nurse from the 1940s and i just saw images of lesbians everywhere in that so i would just take the clips that read lesbian to me and i ended up with a reel of uh lesbian imagery and um i was trying to shop it around to lesbian filmmakers for a long time and then eventually there was a moment that happened where i think sous-fritrick saw it and knew some of it and mary paterno used some of it and also barbara hammer used a lot of it in history lessons so um the great part about that was barbara hammer cast me as the ghostly archivist in in that film which was a total blast and that is actually the prelingor archive where you know i'm kind of floating through like this um archivist ghost in that movie so that was a lot of fun and just great to get that that those images out out there you know you're a renaissance person and oh yeah i'm lucky i think i've been very lucky um you know meeting the people i met on on this journey yeah i've had a lot of interesting and interesting people well let's talk about rock the sham your account of the irish gay and lesbian group and the struggle about the saint patrick's day parade as i said it was published in 2006 and i read all the reviews and they they're really they say it's funny and informative they really raved about it so i encourage the audience to get it and you're not the sham i mean i think i wrote about three different versions of that book some heavily uh involved in all the legal battles i mean we had constitute we had you know local state and federal supreme court and i became extremely interested in the constitution and was fascinated by by the law so i i think i wrote a book a rock the sham version with the law i wrote one that had everything in it that was far too long and this this version felt like uh um a very tight version of what happened which of course is much more readable um so highly edited more readable which tells the basic story of of what happened in a two-year period really which you know um at least i wrote it much later so i was able to go back and say what had happened since um yeah i i think mostly um writing it felt felt like an activist decision because lesbians are always completely wiped out of the picture women are always wiped out of the picture and i thought somewhere this is a record and and even and it has gotten lost i mean people do talk about the same patrick state grade and the gays and the whole you know what really happened is kind of lost and and also because the group the workers in the group were for the most part lesbians and so the the creativity the labor the fantastic ideas and and the determination was was mostly lesbians and and and a few gay men and some of those gay men have also been erased which is kind of interesting and so in some ways this was like here is a record here are the people who are involved and somewhere if i can put it in a few archives hopefully you know it it can get dug up when it needs to be dug up for people who want the story it's a valuable record and as you say a lot of it gets lost so you're to be commended for writing that book and you know i haven't written a book ever but i imagine it's quite undertaking so persistence and stamina one more question you have written things throughout your life most recently you contributed to sinister wisdom 113 the dump trump issue so as you're doing all your activism you're also recording it and you know that issue i tried to get your article in it sold out oh okay and well that yeah that was a revolting lesbians and it was it was they wanted to use pictures they wanted photographs of our actions over and i think about a year and we were we formed because we wanted uh uh we we formed because we wanted to work on following the money we weren't that interested in focusing solely on trump and he was just the culmination the vile culmination of stuff that's been going on here since and i think ronald dragan and and we wanted a campaign so something that we could win in and was very important to us and we also wanted to follow the money so we put a lot of research in and came upon uh rebecca mercer who's a massive donor to republicans and right wing causes climate change denier funded bright part um cambridge analytica that whole facebook scandal um um is now running parlor but put a huge amount of money into climate science denial um a lot of right anything like that's really disgusting the mercers are involved and she was also on the board of the american museum of natural history a science museum and we thought this is perfect this is her the one board she's actually sitting on that makes her a kind of legitimate in the decent world everything else it's all the right wing right wing people she doesn't belong in the decent world on the board of the american museum of natural history and we thought this is it this is where we're going to focus to try and have them shove her out she's funding climate science denial what is she doing sitting on your board um so the avenger are the revolting lesbians that was our focus and then we kind of you know we got involved in other stuff that was going on and when mariella franco the brazilian council woman was assassinated we worked with the brazilian community here um that was such a tragedy oh my god really awful and we also worked um with lesbians in chile because they have a history the last 10 15 years of butch dykes been murdered and the police and the state not following up and not taking it seriously and we worked you know we did the climate march and the the first action we were supposed to have was at the american museum of natural history and then the women's march was the day before that and it was also at a time when four black lesbians had been murdered one in dc two in upstate new york and one with her daughter in florida so we felt okay we're changing our first action it's about these lesbians who've just been murdered at the women's march so you know we had our focus on our campaign but we were very happy to to join in in other stuff that was going on in the city in the the country well and the time has flown by we'll have to have you come back and talk in greater detail thank you for joining us well thank you for having me and i'm very very happy that you you invited me to participate in your show it's fantastic you'll have to come again okay thank you thank you for joining us and until next time remember resist