Looks like we've got some standards in the back, too. Sorry, there's no, there's not enough seating. Let's see, do your best to, you know, when we get into the hands-on stuff, do your best to huddle around, you know, some people that already have tenant IDs. We have 50 tenant IDs that we've given out. There's, I think there's two per table on both sides of the room. So we'll get into what that's all about here in just later on in the session. So let's go ahead and get started. So I'm Cameron Cedar. I work for SUSE, I worked for SUSE for over nine years. And I've been doing a lot of open stack ever since its inception, and messing around with SUSE Cloud specifically. And then we have Jason from Rackspace. Hey everybody, thank you for coming out. What a great showing. I'm very excited to see all the interest in heat. I'm an open cloud architect on the Rackspace Private Cloud team. And even though I'm on the Private Cloud team, there is a lot of heat integration and public cloud integration. And there's a move to the enterprise and on the enterprise side, they're really looking at heat to replace some of the orchestration tools that they have, so I'm happy to be here. And I'll be helping out with the hands-on piece. And then if we get time at the end, we'll look at some other areas like load balancers of service and L3 and things like that. Thank you. Awesome. So this is what we're looking at today. This is the order of operation. We're gonna do a little bit of an introduction here to heat and then we're going to do a hands-on exercise, okay? You're gonna grab a heat stack that I've provided for you to learn and grow from this experience. You're gonna load that heat stack into the tenant ID that's been given out, okay? And then we're gonna launch that heat stack. We have what we're calling right here our lap stack.  All wired up. It's got OpenStack, SUSE Cloud Distribution with the router. We have a Wi-Fi access point. It doesn't have internet access, but just strictly access to this OpenStack environment. So you'll be connecting up to this during the session. And then we'll do some more advanced stuff which Jason will kind of run you through using some stuff there on RackSpace's infrastructure. So service deployment. That's really what heat is all about. Making it easy. Is it really easy? There's several different ways to really skin this heat stack thing. There's the easy way. There's the not quite so easy way. And then there's the hard upfront but totally easier in the end way. So there's several ways. In fact, there's actually several types of templates that you can use in heat as well. So when you dig into heat for the first time, there is lots and lots of learning that goes on here. So how do I deploy it the easy way?  You launch it, configure your networking. You now have an image launched in your open stack environment. Pretty simple. The not quite so easy way using the API. Making it service driven takes a lot longer to do. So you're going to do some programming.  So not terribly friendly to everybody. So that's the not quite so easy way. And then there's the hard upfront but totally easier in the end. So from project Grizzly, heat has been in there. Grizzly was, I mean, there's a lot of problems in that particular code, but Havana works really well. It's fully supported in SUSE Cloud 3. So this is what's going to provide your orchestration layer in OpenStack today. So heat uses an OpenStack native REST API and it also uses the cloud formation compatible query API. Okay, so that's important to know because you can actually, a lot of times I find it a lot easier to actually go out to the Amazon documentation and pull out the stuff from there to create my heat stack. It's so much easier because the OpenStack manual pages don't do it sometimes. They don't always have everything that I need. So I always go back and forth. So heat allows you to pre-divine a set of parameters like your compute infrastructure, your networking infrastructure, your storage. So you can do software defined networking, have it create its own private network, the private LAN that you have databases spinning up on, and you have applications accessing that database over that LAN, and it does it all by magic, right? That's what we all hope. So let's dig right into it. All the hands on. So this is, hopefully you don't have a lot of challenges. I've tried to make it as such where we can really dig in and learn what's in these templates, okay? So that you can get a really good understanding, get started on creating heat templates. So we have 50 tenant IDs, and the user names are user one through 50, and their passwords are also the user one through 50. So you should be able to hit this URL right now if you are hitting this Wi-Fi. The SSID is SUSE and the passphrase SUSE Gecko. And so you should be able to hit the <IP_ADDRESS> address. Everybody hitting that? It's asking for a numeric pin. You got it?  We got some folks to help, so, okay? These other URLs here, the <IP_ADDRESS> slash share, that address you're going to need here later on, okay? So keep that in mind, I'll go back to this page, okay? Yeah, it's SUSE Gecko, okay? Now, when we log into our tenant ID, the first thing that we're going to do is create some security groups, okay? Has everybody created a security group before? I certainly hope so. I'll give you just a couple more minutes while you guys are getting this stuff down. Raise your hand if you need some help. The user is user 21. Password is user 21 as well. So, on your tables, there really should only be one or two of you connecting per group because we're limited on IP addresses as well, so some of us are running into some, not being able to get an IP address, okay? So let's be careful with that on divvying up those IP addresses, all right? Okay. So once you're logged in, just hold right there and then we'll get to the templates, okay? Let's make sure that we can get at least four laptops per table logged into this web interface. That should give us enough room to kind of huddle around a little bit per table, okay? Can I get a raise of hand who is not set up? Okay, we got just a minimal few. That should work. Okay, we can't have everybody on it, so some of you aren't going to be able to connect, so you'll need to huddle around somebody that is close by you, okay? We did our best to accommodate. I'm sorry if you can't connect. Yeah, I'll show you some stuff on the screen. Absolutely. All right, let's go ahead and move on. Now the first thing we're going to do inside the web interface, inside Horizon, you've logged in with your tenant ID already. Once we've logged in, we're going to create some security groups. These security groups are required for the heat stack we're deploying. So when you deploy a heat stack, you have to make sure if you're using security groups in your heat stack, you have to make sure that those are deployed already, okay, and make sure that those are set up in the environment, in that tenant environment already, okay? And I'll show you why here in just a minute. So once you create the WWW security group, in fact, you might find that the security groups are already there. I think the security groups are already pre-populated. If they are, what you'll need to do is go in and create a rule. And so you'll need to create the HTTP rule for WWW and the MySQL rule for MySQL security group. That should be fairly easy. Raise your hand if you need some help doing that. We're gonna rock around. So let's go ahead and create those security groups, create the rules for the security groups, okay? So in the WWW security group, let's create a rule called HTTP. And it's just a drop-down list. You'll see HTTP in there, okay? It's already pre-populated for Horizon, okay? And the same goes for MySQL. Go into the MySQL security group, add a new rule. In the drop-down list, you'll see MySQL. It's pre-populated for Horizon. And go ahead and add that as well. I've also added in the command, if you wanna do it from the command line, we're not gonna do that today, however. If you were doing this in your own lab, you could in fact use the Nova security group list and list out the security groups that you have in there. There's also the Nova security group create. There's also the, Neutron also has security group creation as well. What this process is doing is creating those, the IDs that are actually required for us to create the heat stack. Yeah, just a port 80. We don't need HTTPS. We're not doing the execute, okay? That's just information. If you can take back to your own lab and run it from the command line if you'd like, okay? We're not gonna do that part. So I should probably remove that from the slides. You will take that out. Don't wanna confuse anybody. So what this process is doing is it's adding in some IDs for us that we're gonna pull out here in the next step, okay? And I'll show you what these IDs are and where they're used, okay? Again, that's just some information. You're not gonna add in any IDs, okay? You're going to be grabbing the, when you create the WWW and the MySQL security groups, it creates a long UUID and open stack. Those are the IDs that we're gonna be grabbing. No. So if you've already edited your rules, show of hands who hasn't created their rules. Okay, we got one guy in the back. Two in the back. Okay, next step. We're going to create a key pair, okay? So go to your access and security again and let's go ahead and create a key pair.  That would work fine to make it simple. Or you can give it a special name. Doesn't matter to me. Just remember what that is, okay? And then what we're going to do is we're going to input that key pair into our heat template. But we're not gonna do that step yet. All I want you to do is create that key pair. Just go into horizon and create your key pair. You can help with the key pair. Yeah, hit access and security again. No, it'll be down too far. Key pairs. Yeah, it's a little tricky. If you can't see key pairs there, you might need to click on the left bar again under access and security and then it'll show up as a tab option for you. Who needs help with the key pair? Awesome. All right, we're moving on. Now this is not a step that we're going to do. I'm going to explain a couple of things before we move on. We have the NOVA network and what you can see here, this is some JSON code that is pulled out from the heat stack template that we're going to be using. I just want to explain it just a little bit. You see the default ID in there. You'll see a long UUID. That is a UUID that we need to pull out specific for our environment. Now that UUID, the floating network, is the same across the entire open stack infrastructure. I have that in a file that I showed you earlier and you can all grab that. We're not going to grab it yet. I'll tell you when to grab it. I have some information here. You can use the NOVA net list if you're going to use the CLI in your own lab to do this. So you can play around with that. We'll actually list out all the NOVA networks and so you can grab that UUID that you'll need for your heat stack template. The next thing is the fixed network also. It also has the UUID that we'll need to pull out because we are using that in our heat template as well. So again, that's just another UUID that we're going to need to pull out for our heat stack. Okay, I'm going to go back to here. Now here's where the editing fund comes in. So whoever you have designated as your editor on the table, if you haven't designated an editor yet, let's go ahead and do so. And we're going to open up or download the one that says heat template wordpress.json. So let's go ahead and get that downloaded, open that up in your favorite editor and we're going to walk through editing that. Now I'm going to pull it up on my screen, okay? Is everybody able to get that downloaded? Who's not? Sweet. Okay, yes. Some people need to go back. Sorry, my shift F5 skills are not working today. You could go to just the slash share and you'll see the files in there as well. So, and then you can just save them from there. Okay, so I'm going to open up this template just in the web browser. I don't like that view. Let's enlarge it quite a bit. Can everybody see that in the back? Okay, so we have the floating network and we have the fixed network. Let's focus on those two firsts, okay? We need to grab our floating network and our fixed network, UUIDs. And so what I've done, I've actually exported those out under network-list.text, so you'll find those in there. So I've already exported them for you. You'll just need to copy them into your JSON file, okay? In that location. So that's the task right now. Copying those UUIDs over into the right location. Make sure you're putting the floating network as it's labeled in the JSON file in the right location and the fixed network in the right location, okay? Oh, it is correct. Some are saying it's correct already. So maybe I did some work for you. Does it, okay, that's probably correct then. So if it's matching already, no editing then. Okay, okay, yeah, okay. Does everybody remember when we created our key pair? Do you remember the name that you used when you created your key pair? If you did, then you'll need to enter that in right here where you see key name and the default string. The one that's in there is CCeder. That's my user ID. So you'll need to change that for your key pair. Just put in the name that you used, okay? So edit the file, drop in that key pair name. This part right here. Question. You can, however, if you import what's there from the URL, it's not gonna match everything in your tenant ID. There are some things that are different, so it won't launch correctly, okay? So you will have to modify some things. But you could in fact, and that's a great idea, you could in fact do that in your own labs, you know, have them hosted on a web server somewhere and you could actually import them using that web server, okay? Good point. Is everybody able to get that edited for the key pair? We'll go ahead and move on. We've got instance type. I've already populated this one with a special flavor called Sousa. So we won't need to touch that. In your labs, you might need to. You might need to mess with that if you want to have something larger. You could change that default value to M1 medium or large if you like, okay? The WordPress volume size we don't need to mess with. The MySQL volume size we don't need to mess with. The WordPress version and the MySQL version, those are being pulled out from the images that I've already pre-populated. So you'll see two images already in there, okay? So it's important that that image name has a version ID on there. That's where it's grabbing that version from, that string. Okay? Now we get to some fun stuff. These are gonna be different for every single one of your tenants. So this is very important that we actually copy these correctly. I have a file that is populated with everybody's UUID. I'm actually gonna run a for loop right now and get that created again. My colleague informed me that it's not up to snuff right now. So I will get that fixed really fast. This will just take me a moment here. Oh, there we go. Okay. It helps to source the right file. Okay, it should be correct now. Your sequence is only to 30 again. Your sequence is only to 30 again. You only went one to 30 again. Thank you for that. I think programming is best.  We'll recreate. Yeah, first we thought, oh, 30 will be fine. It's a good thing we did 50. All right, so it's all there. So let's skip on back over to here. So we're back to editing our template file. So open up that text file that I just copied over to that share directory. So you can go out to that web URL, go to share, and you'll see that security group text file. Find your tenant ID, and you will see all the UUIDs that you need to copy out for each one of those groups that you see in your template file. Okay, using users. Okay, let me take a look at it. Uh-huh. Some tenants don't have... Oh gosh. All right, let me... I see what the problem is. Let me fix that real quick. That's what happens when you loop over that same file a couple of times, it dirties it up. Okay, try again. That looks better. Back to the heat template. Go down where we have WWWSECGROUP and the MySQLSECGROUP and defaultSECGROUP. Pull out the UUID from that text file that I just updated for your specific tenant ID and drop them into your template file here. Who needs help? Everybody got this task done?  Raise of hands, you're ready to move on? Okay, we've got a few. Okay, we'll wait just a few more minutes so that everybody can get caught up. We're almost ready to launch our heat template. We're getting close. Then we can really see how our lap stack really holds up. Yeah, each one of these laptops has 32 gigabytes of RAM and we've got plenty of disk space to accommodate all these instances. So we'll see how well it does. We did some pre-caching on a lot of these images so it should work out. The UUIDs for these security groups, they should be different for every tenant. But at some point, we need to screen them. No? I'm gonna say that. Okay. Yeah, so if you copied the UUIDs before I actually reran my script to repopulate it, then you have the wrong ID. Because we actually, in our testing, we actually blew everything away and recreated and I didn't run that script. So you'll need to go in and copy the ones that are there now because those ones are correct, okay? Just so you're clear. All right. Okay, so the reason why we're doing this is because when you're creating a heat template and you're using security groups, you need to be aware that when you have security groups in your heat templates, they're different for every tenant ID. Okay, and so you're gonna have to go in and add in those IDs into your heat templates. Okay, manual process. Let me come over here so I can hear you. Yeah, yeah, this is JSON format. This is basic UTF-A JSON format, okay? No, no. So you brought up a good point. Is a heat template always in JSON? No, there are other formats. In fact, there is a specific heat format that you can use. There's a JSON format and there's an Amazon AWS format. Good grief. You can get lost really fast, okay? So do some homework on that. There's lots of reading you can do on the various formats. I find that the AWS one is a lot easier because there's a lot more documentation out there. Quite frankly, going through some of the JSON stuff and some of the stuff on openstack.org is some of it's a little bit limiting. Some of it works. There are some pre-canned templates that you can grab from openstack.org as well to play around with, so do some testing in your own labs with that stuff. But there are different formats, good point. Yes, say again. So he's asking, what's my recommendation? My recommendation is Amazon AWS format because if you have a public cloud and you've already got some templates written, you can utilize them in both places. Just kind of makes sense. Yeah, it just makes sense that way that you would have that backwards compatibility between your public and your private. That's correct. So she asked Amazon only supports their format. Yes. So everybody ready to move on from the UUIDs? Who still needs help on those? You need help on the floating IP? So those should be already ready to go. Okay, so don't even, yeah, I already set those up for you. Let's move on. We have some mappings going on here. These are actually for the instances that get launched. And then we have some resource set up. We're setting up some networks. We've got a data network that we're setting up. And then there's the subnet that's tied with it. So it's a 172.16. So when we launch this heat stack, you'll see that come into play here. And then we've got some ports that are gonna be opened up there. Notice how it still says quantum in there. That's some, yeah. Still some programming to do to get those all changed. So be aware of that. And there's different ports for each one of the, for WordPress, we've got multiple ports for the networking. So the WordPress image will have two networking interfaces. He's tied to the data network and the fixed network. And I believe the MySQL is only tied to the data network. So the MySQL database is completely isolated inside your cloud, which is really sweet. You can't even access it from outside at all. You can't even get to it. The only thing that can get to it is your WordPress image. Pretty darn secure. That's pretty hard. All that data is really secure behind all that security there in your cloud. We don't need to mess around with any of the floating IP stuff here. And then here's the basic instance setup. Pay attention to the term availability zone. If you have a private cloud environment where you've actually created availability zones, you would need to modify that for your specific environment if you have an availability zone. You could in fact have your web server on one availability zone and your database on another availability zone and those get tied together. So you could do it that way if that's how you have your private cloud setup. And then we've got a volume, a couple of volumes actually that we're actually creating for each instance, both WordPress and MySQL. And then it's creating a mount point reference for those. And that's it. That's our heat stack. So we've done all the heavy lifting, the editing. Not really heavy lifting, but. Now we can switch over to the horizon dashboard. Yes, question. Yes. It is not. These images are set up in a way that they automatically set that up inside the image. Now that's a good point to bring up because there are ways within a heat stack, some more advanced methodology to actually traverse into the image and actually make some changes there and have it connect up to that, the database back end and make some changes within the database, that kind of thing. We're not doing that here. These particular images were created using SUSE Studio. So we've actually already pre-populated some items within the image itself. So we don't need to do all the heavy lifting with the heat stack. So there's a couple of different methods that you can take there. Yes. How does the WordPress instance find out the IP address of the MySQL back end? In this particular case, it's being set up with the Nova Fix Network. And so it will also, on the back end, the database will also get set up with the Fix Network as well. So both of them will have that. You can do it that way. I think actually in this case, we are actually populating it on the database being populated with an IP address on the data network that we've actually created a new network called data. And so we've already populated the WordPress image with an IP address on that network so it can connect to it automatically once it's launched. But you could do that within the heat stack itself. But these are pre-populated images that have that already done, yes. So is it a mixture of open stack and AWS? This particular one is just strictly AWS. Say that again. Yes, yes, those, yes. So you make up, that's a good point. So he has, he's asking if they are mixed between the AWS and the open stack templates. There are resources that you can define within that come out of open stack that also fit in with the AWS templates as well. So, but the formatting is the same as what you would see in AWS. Yes, yes. These instances have already been created. They're already pre-populated images. We're using heat to orchestrate the deployment of those. He's asking would we use these fixed IP addresses in production? The answer is yes. He would use these fixed IPs in production. You're gonna have a different address space, of course, than what I'm using here, but yeah. Yes, that's if the IP address is a fixed IP address. In this case it's not, it is dynamic. So, ah, but it does DHCP. Okay, I'm sorry. The image itself is not populated with a static IP address, but it's populated to know that it can connect on that network, that data network. So, the data network that we're creating is a DHCP network. So once it's launched, it will get a DHCP address from the data network as well as the database. And so then they can communicate on that network. Yes, that's correct. I can show you more details about the image afterwards if you'd like. So, yes. I think we have kind of the same question, but we get, okay, they're on the same network. They can communicate the application and the database, but how does the application know where the database is of what IP address? I think it will all come together when we launch it. So let's do that. We're ready to launch it. So let's go to the horizon dashboard. On that 141 IP address. So you should be right back here. <IP_ADDRESS>. And if you're logged in under your project, I'm going to actually use the open stack project. At the very bottom on the left side, you're going to see orchestration. And under that is stacks. So we'll need to select stacks. And there's a button in the upper right-hand corner. You can select launch stack. In our case, we're going to point to the file that we've been editing. And hopefully it's on your local machine somewhere. So you select file and browse to it. This is going to be fun. We're all going to hit the box at once. And once you have that template file already populated in there, hit next. And now we can give it a stack name. Call it whatever you want. The password for the user admin is crowbar, all underscore, crowbar, all lowercase. Sorry, all lowercase. It was a late night last night. Sorry? No, no, no. Admin, right here. Everybody should have admin. No? If it says user, then use user one or user and the number for your tenant then. Yeah, that's right. That's right. So put in your password for that tenant user. And then scroll all the way to the bottom. You can see it's populated everything with your UIDs and everything that we have in that template. And then you can go ahead and hit launch. And when you're ready, go ahead and hit launch. And it's going to start creating your heat stack. If your heat stack fails, you've got a problem with your UIDs or something there. Who's having errors? Okay, okay. I'm going to come by and look, but do one bit of troubleshooting. I should have mentioned this earlier. If you know all of your UIDs are good, everything looks good, check your, so JSON is very sensitive to white space. So if you do a tab instead of a space or if you mess up the white space at all, it doesn't work. So what is, like what errors are you getting? Maybe what I need to do is see who's not here. Okay, so I would say that the flavor ID can't be found. Yeah, that's my problem, that's my mistake. Let me think about, no, I'm kidding. Let me fix that. I'm not kidding though, but it's good that it's gotten better at debugging. The console sometimes will say, you're each stack failed. And not give a lot of traps back. But something like that, I mean, go and double check the flavor IDs. Who's getting an error like that's vague?  I guess I don't need to be yelling this. I think the stack is back. If you got an error on the Sousa flavor, delete it and then launch it again. Delete your stack that you've created and then launch it again. How's everybody doing? So if you're getting that error about the Sousa flavor, delete your stack and start it up again, okay? Cause I just fixed it. Try the Sousa flavor. I'm getting the top of the hour and who's got their heat stack launched? Who hasn't working? Raise the hands. You got one here? Maybe? Okay. Okay. And everything's, when you click on it, is everything green? Does it look like that? Okay. Mine's still creating. At this point we're hitting the disks on this lap stack. Pretty darn hard after we've started deleting. After we deleted our stacks, it's actually deleting it over here too. So those partial creations are being deleted. So it's gonna take a little bit of time. Mine's still actually deploying. It takes a few minutes. Yes. Yeah, it's very possible we might be running out of this space too. So if we go over to instances, actually we're gonna go to admin. It can show you kind of a global view. We've got WordPress from tenant number 24. It's spawning. We've got tenant one, tenant two, tenant 11. Yeah, we've got some of you guys running. Some of them are. Yes. You won't be able to get to that floating IP on this particular network you're connected to though. Not the public IP address, no. We don't have that routed through our stuff here. Not this one, no. Now we don't have that routed out. Yeah, where's that one at? Tenant two, you're launching with an M1 medium, a 40 gigabyte disk. Okay. There's part of our problem on some of our load on our systems here. This is not an ideal production environment. You don't deploy a lap stack. But I hope you learned from this on how to deploy a heat stack, okay? It's a good exercise. I hope you learned from it. Jason Grimm's got a couple of things he wanted to talk about. So Jason, you want to jump into that right now. What I'm hoping is you can take that template back to your labs and you can play around with it some more and see if you can add some more things to that heat template. Maybe change it a little bit and deploy a different kind of database or something, possibly. Well, I would say I'm only trying to find manually, so I'm going to try to just trace it. That's pretty simple. Well, since I created that one manually, I'll be through it, so I don't know if it's going to work. What am I seeing? Oh, wait. No, there was a screen in all of these. Oh, you're right. Oh, never mind. So I did the debug all along. Well, you see what I'm seeing, there's somebody starting to do the debug. Okay. So while we're waiting for the video to switch out, we only have 15 minutes left and I'm going to go through a couple of things that you can also look at, but kind of while we're waiting, are there any questions? And if there are, okay, go ahead and go to the mic, if you would, because they're doing a recording. What's the best way to debug some of these failures that we're seeing? What do you look at other than the fact that it says to create fail? Very good question and very acute observation that the debugging leaves some to be desired in Horizon. So at the CLI and the API level, you get a much richer return on the errors. So the first suggestion is to get into a level of comfort where you can start doing more of the CLI. So Horizon is the probably smallest and most fledgling and most underserved project in the OpenStack ecosystem. So everything, all the functionality comes out at the API level and you have 100% functionality and when they go GA and bless a version becomes trunk, it's certified for like a better term. API works 100%, CLI you're gonna get about 80%, Horizon's going to lag behind at about 60% functionality. So it's just a, if it was a product that was being sold, it would be a de-emphasized feature, right? Because most of the power and most of the use case and most of the scale and all of that stuff is being done at the API and CLI level. So it's not a great answer, but we're on a six month release cycle. So, and people are, I get that question every time I talk to someone about EED, so we'll get more mature, but I would encourage you to move to the CLI or the API. Absolutely, yeah. So again, back to, you can take this log and you can take any logging aggregation, any log search, any logs consolidation, any of that stuff.  If it works on Linux, it works on OpenStack. So there's a common directory structure that those logs are in under var and you can just scrape those. So the question was, is there a common debugging app that's recommended for OpenStack? That's hard to say. So one of the blessings and one of the curses with OpenStack is that it is open and you can do anything you want with it. I go, I meet with customers every day who have very similar business models. It could be from one university to the other, one media company to the next, and they use OpenStack in vastly different ways and they manage it and operate it in vastly different ways. So one of the things I was looking at, I had a monitoring talk and what I found was early on a frustration ad was why isn't it more operationalized? You've got this stuff in there to do it. Why aren't you giving me more logging? Why aren't you giving me more richer interfaces and more alerting and things like that? So they didn't bake that in by design. They are maniacally kind of focused on infrastructure as a service and the core services because they don't want to reinvent or re-bundle or recreate a tool set. They don't want to rewrite Nagios or put that into the product when the Nagios started being around since 99 and it works on Linux. So there's an assumption that shops that OpenStack is deployed in already have a monitoring tool set and already have a logging tool set and already have a management model. And so OpenStack intentionally does not reinvent that. So the upside of that, it's very fast. There's not a lot of bloat. The downside is you've got to take your tool set and integrate it. Yes, I'll show you where mine are posted and these guys I'm sure will do the same. So this was two talks. This was the hands-on 101 workshop and the second talk was kind of an advanced topics piece. And so what you guys did by hand was difficult for your first time. But I encourage you to stick with it because once you have a repository templates and you get a little bit used to it, it is one ASCII text file and we deployed one environment here. In production we deploy very complex environments with load balancers and L3 routing and many tiers, networks auto-created and things like that. And developers now instead of saying, give me a VM, they got a little bit of the drug. Now they can have like a VM in two minutes that's all managed. Now they want a whole environment. Give me two web servers, two app servers, two database servers and give it to me in six minutes instead of two minutes. But you speed that up for them and if operations can streamline to that level that's what it's there for. So give me a second for my Windows VM on my Mac to come up actually. Okay, we got like 12 minutes. Let's see, do anything, did it clear up there? Got it, all right, out. So I'm clearly a Mac noob, no? I think it's mirrored, hold on a second. There we go, I know it's like a game, hold on a second. No, just stay there please. Okay, yeah, I'm going to mirror the displays apparently. There we go. I thought I had a mirror in the most arrangement. Mirror displays, here we go. Hey, so there it is, all right. There we go, you guys get to read on my email. Okay, so a little bit of a different tack and I'm just going to go through a couple of things here. So there's Dev, who's messed around with DevStack? Okay, all right, good. So DevStack for those of you guys don't know, it is what essentially I would, I could probably stand up here with confidence and say 100% of people developing against OpenStack are probably using DevStack. It's a single get call to a repo and a single command to give you an OpenStack environment running on bare metal and all in one OpenStack environment, obviously not for production, but you can do functional testing and write all your code. All the Rackspace developers who write code for the public cloud, it has to pass the DevStack muster before it can go on and be considered for any Rackspace adoption, so we run it. So I'm going to give you the link and these are posted, but taking DevStack and for this advanced tutorial, telling it to give me Solometer and load balusters and service and L3 and some of these advanced things that I needed to do this was a little bit of a trick to get that going, so I'm not going to go through line by line, but at the end, stack.sh, there's one shell script and six minutes later, you've got a fully functioning environment, there's a, you don't have to give it a local.conf file, an answer file or a net file, but if you want to do some of the, if you don't want to take just the defaults, then you do have to put some of the stuff in, so. What you guys didn't do today was go to the command line to do some of these commands by hand. What you'll find when you do that is, you're going to have to export the variables that tell your session at the CLI and similarly, you do the same with JSON to say this is my tenant name and this is my authorization URL. It's just basically sending those variables so that when you execute a command like NovaList or Keystone tenant create or something like that, it knows to where to log in and look that stuff up, so. Excuse me. I thought it was interesting to look at how the environments were created that I built, so I took two servers, one on the East Coast and one on the West Coast, with like 90 gigs of RAM and a 300 gig SSD and what I was going to do in this exercise was each table was a team and it was going to be kind of like a hackathon, bake off competition, right, and I had some scenarios for you guys to go through, but each table was a city on the East Coast or the West Coast and what might be interesting, so with one, and this is bash, it's not heat, so this is the stepchild or this was before the section is of heat, but you can take a bash script and I created 20 instances and I set all my quotas and I actually created users for the, if I could log in and get all that stuff, so it's maybe 12 lines and I created my 20 tenants, created the quotas for all those tenants and also created the local user accounts as well. So, I mean, we're out of time on the exercise, but it's kind of too bad because you could have been a heat initiate or a heat Padawan or a heat master and you'd get 50 points, but there are 200 points or you could like make something up, right? What was, you know, earlier back here, you'll see, I do a git, so line six, there's probably 100 heat templates out there, right? I mean, if you guys went around the industry, you know the power of open source. I mean, there is a selfish and non-selfish reason, like if I put my template out there and someone uses it, debugs it, makes it better, like I have a good reason to want to share that, so just like the people who developed heat, you know, why not throw the heat templates out there? So you pretty much find something that's close to what you need to do. The manual, like learning curve, that's as bad as it gets and it gets, you know, it gets better. After that, you build some, a template library and you get more creative with it and going down the road, so probably over time. We've got five minutes. How about, is there any more Q and A? Right, so that's a good question. He's talking about inserting the IDs as the template is being created. It's like, well, correct me if I'm wrong, you're talking about if the template needs a network, creates the network and then grabs the UID from that network, so it's like the third time about that question. Yes, it's, is the short answer? Yes, it's absolutely possible. It is a bit of a chicken and egg thing and you do have to work around it, but it is a very popular use case that we do. So I've got, I'll have these posted and I think they're, I'll leave the last site up with my site that has the templates on there.


All right, I think it's all set. So hello everyone. This is the next session of the managed two ones and I'll be covering smart card authentication.  So with 11.6, if you enable the smart card, the authentication, this is how the login screen will look like. There will be a new tab for smart card, saying that login with smart card. And when you hit that button, then it will actually log into GitLab. So now it looks like that we just added a button that lets people login without authentication, but that is actually not the case. So I will elaborate with that presentation. So what is a smart card? Why it's smart? So basically smart cards are everywhere. They are in your phone as the SIM card and also your credit cards are also smart cards. So they have a built-in processor. And secure storage. And secure storage is obviously needed if you are going to store certificates on them. And because I mentioned they had a microprocessor, they are programmable. They have an embedded operating system. The most common ones are dotnet based and but there are also other ones that are Java based operating systems and custom ones. And so as they are programmable, they provide a way for certificates storage and to access those certificates and the additional features. So some smart cards, you can have automatic creation which really helps. But that's what we are most interested in. So if you want to test the smart card login, and you are thinking about acquiring a smart card, so as you might already guessed, it's mostly a business to business market. So I actually had a hard time finding where I can order a smart card which I find it was able but then the second problem is that so most of these smart card solutions, you need to download a proprietary driver which might not be available on the manufacturer. So I think we lost you and I'm hearing Martin. Can you hear me or is there something with my sound? Yeah, we can hear you now. We lost you there for a minute. We thought about the client that you need for server credentials. Great, okay, thanks. So and also if you go and find a search for the internet how to use a smart card, then many website field, for example, I think how to download, for example, certificates for DoD which might already be outdated and you will not be able to download it. So what worked for me is a UB key because it also supports and has a smart card capabilities and it was pretty easy for me to set it up and start using. So I use for the whole time a UB key to develop and test this feature. So the workflow, so the question is how we get the client certificate from the smart card to GitLab and we can split that workflow into two. So we can have the smart card reader to the browser that's one half of it and the second half is from the browser to GitLab. And we make this distinction because the first part, it doesn't require anything from our side, from GitLab side. It's purely the responsibility for the user or the system administrator, it's system administrator of the user to set up the operating system correctly. So set up the driver and the middle over for the smart card reader and also configure the browser. But the second part from the browser to GitLab, we want to configure the web server and we want to verify the client certificate. So as I mentioned, the first part, getting the certificate from the reader to the browser. So this is how a smart card reader looks. It connects to your laptop or computer via USB and you can put the smart card in and it will read the certificate. And you also need the middle over which needs to be installed on your machine. One middle over, I use this OpenSC and as you can guess from the name, it's an open source solution and it supports multiple smart cards. It's basically, it provides an API for a bunch of smart cards, not all of them because most of them are proprietary, but the most one might be supported by OpenSC as for example, the UB key. There are multiple APIs, but the one we are interested in is actually in OpenSC for UB key and you need to configure the browser to work with the middle over. So here's how I configure the Firefox. There's actually in the privacy and security settings, there's the security part and I highlighted the security devices. Actually both buttons are important for us, view certificates and the security devices. So if you click on the security devices, you will need to add the OpenSC as a security device. So here I just grew installed OpenSC and provided the path to the pkcs11.so file which is the API we need. And you can see on my computer that my UB key is working via the OpenSC middle over. So you might not be, if you don't have a UB key, you might still be able to use the smart card authentication in the browser. I haven't tested it, but if you import the certificate in Firefox, it might be available to select it when the client-side certificate pops up. So here it's actually not an imported certificate, it's the one my Firefox can see on the UB key. Oh, by the way, if you have any question, just ask in the group chat or just stop me and ask the question. So that was the first part, how we need to make sure our operating system and our browser works with our smart card readers. And the second part is getting the certificate from the browser to GitLab. So first we need to configure the web server since only bus is using Nginx. I will be mostly talking about it. So this is how you require the client-side certificate in the Nginx config. You basically just set the root certificate and there's SSL Verify client, which has three options, on, off, or optional. We don't, we always have the client-side certificate. If you have, if you set it to optional, the little window still pops up for the user to select the certificate or unlock the certificate. But if they want to use a different authentication method, it might be really annoying to like always having that screen. Here I just put the configuration, how you need to set up the server certificate when you want to use HTTPS versus the client certificate. So the top one is how you set up HTTPS for example.com. And the bottom one is how you use the clients, how you request the client certificate from the browser. And since I mentioned that Nginx needs to require the client-side certificate, it needs to run on a different board. So with, for example, with Apache HTTPS, we can, so it can renegotiate SSL for the server and we can define different clients' side certificate rule for different directories. But Nginx unfortunately doesn't support SSL renegotiation. So what we've done in Omnibus is running the same server, pretty much the same server on a different board, but this server requires the client-side certificate. And when I hit that button in GitLab to login with Smart Guard, it actually forwarded me to this second port required the client-side certificate and forwarded it back to the original GitLab port. And you also need to set the header to be forwarded to the GitLab application. And this is how you've done it. The first is the name and SSL client escape search is the name of the Nginx variable. Actually, we had a regression related to this recently because we figured that Omnibus only has Nginx version, I think 1.12. But SSL client escape search was introduced in 1.13 or something like that. And previously only SSL client certificate existed, which is now deprecated, but it returns the client certificate in a little bit different format. So we need to make sure that both are supported in GitLab Rails. So this is just putting the pieces together in the Nginx config. This is still just a short example. I deleted most of the actual configuration. We have the server running on a different port. We require the client certificate and we verify against this root certificate and forwarded it forward the client certificate as X SSL client certificate to the Rails application. And finally in GitLab Rails, this is how we do the verification. So in the GitLab configuration, you can have the smart card CA file, which will be loaded to an open SSL certificate store. And basically we just verify against that store the certificate header we are receiving from Nginx. So this is how the pieces fit together. And when you visit gitlabexample.com on the port, which actually requires the client site certificate, this is the pop-up. This unlocks the smart card and lets you then select which certificate you want to use on this site. So I actually have only one certificate on my Ubiqui. So actually the pop-up is only populated with one item. So previously when I showed the example, you didn't see these two windows because I already used and selected this certificate. And I hit the remember this decision. So when I previously used the demonstrated house login with the smart card, these windows didn't show up. So a few words about the certificates itself. So this is an example from Wikipedia. There's a few important details we are interested in in the certificate. So for example, it has a serial number. This is usually if you generate it with open SSL, it will be auto-generated. You can set it manually, but it's much easier because it needs to be unique. There's the issuer, which signs your certificate. There's a few information on the issuer. And the subject is actually details about the holder of the certificate. And as you can see, there's a few field. For example, C is for country. O is the organization, which you can see for both the issuer and the subject as well. And there are other supported fields. Here's a list of them. There's the country, the state organization, organization unit and so on. We are mostly interested in the command name because we are actually deriving the user name in Github from the command name. And there's also another one, the email address which we also use for Github because we occasionally send out emails and we need that in the subject field. So there are different formats, how you can have the certificates. I will now show you an example, which uses the standard. But for example, if you are to import your certificate in Firefox, you might need to convert it to PKCS 11 format, which is a bit different than the standard. And by the way, PKCS stands for public key cryptography standard. So it's a standard which defines how the format should look like for the certificate. And now I will just discuss shortly how you can create a certificate with the UBK. Of course, these steps are also applicable for other devices. If you wanna play with the smart card and also useful because you can see what are the components which are required to create the certificate. So first I will just, this common just creates a private key, the private key will be 248 bit long. And using that private key, this one will generate and self sign a certificate. So here we use the minus key option providing the key which we created in the previous step. And the output of this command is going to be the CA.Pentfile. And you can see that the command is now asked for the different fields I previously mentioned so you can enter the country in the state, the common email address and so on for the certificate. And you can also check the CA file which we have, this is pretty much in the same format but you can now see that the issuer is random corporation. And because it's self sign certificate, the subject is also the random corporation. So this is the one we are going to use to create and sign the certificate for the UBK. And so if you search the internet how to create a keeper for the UBK, you might find the different guides because UBK, the company behind UBK is in the process of refactoring their tooling and most of the documentation still mentions the previous tool. I think it was called UBPIV tool or something like that. But it no longer supports all the features of the newer UBKs. For example, I have a UBK for and I found some incompatibilities which didn't work out with the previous tool but they still haven't migrated all the codes to this new tool and the documentation is still not updated. So you might need to check it twice if you are using the right tool but this is the new tool and YKman and this will create a key and 9A is actually the name of the slot because the UBK have different slots which can hold the keeper and 9A is one of them and we create the private key as a UBK.Pen and then we create the certificate signing request, the CSR also with the YKman command. We set the subject. Here you can see the common name and the email address. We set it there and the output of this will be the UBK.CPSR file which we are going to sign with the root CA we created in the first few steps. So here you can see we provide the minus CA, and the CA key with the CA.key file. We are using OpenSSR to generate the serial for this certificate and that would put via the UBK certificate file. Okay, now we are back. Right, and then pretty much the last step is to import the certificate to your UBK. We are importing it to the same slot, 9A and then you can check the status. Here you can see all the details of the, here's the subject and the issuer, distinguish name and all the details we provided the CN for the subject is heat lab user 01 and the email address is already set and you can see I can, I still, the pin tries left is still three. So for the next steps, so currently the, in GitLab, the smart card integration isn't using an app server, it now uses an internal smart card identity model in the database, but probably most important is the, is the ad-app integration because most folks wanna use it with the ad-app and this is going to be the next step for us to add an ad-app support. So user no longer uses the local DB but can check the certificate in the ad-app server and the other step is certificate extensions because previously what you've seen is we were just using the, the distinguish name, the subject, the common name and email address on the certificate but there might be other tools, for example the subject alternative name extension, which can be, which provide the finer details to what the username and email could be for the user. So these are the plans and yeah, I can see there's a few questions in the group chat. So can I come be created on first login with smart card? So yeah, so actually now if you, if you try to sign in with a smart card which you haven't used previously, it will automatically create a new user for that login. So a new user will be created and then it will be saved as a smart card identity. And next time when you will try to login with the user, that user will be found and logged in again. And the second question, NGINX config made it sound like the client certificates need to be valid. Yes, yes, that's right. The client certificate need to be valid. Otherwise the NGINX will throw an error. Right, so is this integration? I think this is my last slide. So for you. I had to go ahead. Is this intended for primarily for like on-premise customers? Cause it seems like if you were had it on like gitlab.com, there could be things where someone somehow gets a valid certificate with an email address of someone else or something like that. Like is the plan to be mostly on-premise customers? Yes, yes, this is only for on-premise customers. Otherwise like every company needs to like import their own CA file to gitlab, which we don't really want. So yeah, this is only for on-premise customers. It's bringing back, I worked in the DOD back in the day and it's bringing back memories. It was a pain because the support was iffy on some things, but it looks pretty good right now. I like that you did the client certificates first and then you'll move on to the LDAP stuff because that would be a bit big to do both all at once. Yeah, yeah. That was our first thinking because it just seems so, such a huge work and we just split into, I think there are even like three different iterations and this is basically the first one, but now it's shipping goes, so with Omnibus support in London.16 in five days. Cool. So when, I haven't read the documentation, so is it a thing that you have to do in the config file or can you do it in the UI and it'll start up the secondary Nginx? No, you need to do it in the config file. Oh, okay. Yeah, because Omnibus needs to also configure the Nginx, so this is why it's not possible. We don't need using the admin area. I'm trying to think of other questions. I'm sure we still have 30 minutes. Does it work like the email address? Is that fairly standard in terms of like you used a format that's widely used across smart cards? Like, will it work with the... Yeah, so actually... Go ahead. Yeah, so there's actually two different formats one is appending it to the common name and also as a separate field. We actually support both. Oh, okay. But probably it will be better when we add the subject alternative name extension because I think there's also option to like, that might be even more standard solution to define the email address for the user with that extension. But now we support both of the format that is applicable to the subject field. Does it support the common access card now, the DoD one? I don't know. I don't remember where the email address was on those. Yeah, I don't know. So that was one of the issue. I couldn't get a hold of a real smart card. Yeah. So it was really hard to test. I needed to figure out my own how to create a certificate and use it with my Viki. But actually, this is the one thing I'm hoping, getting back from customers to get feedback on the feature because I wasn't sure what extensions are used and how, so it will be very, very helpful to get back some feedback on this feature because I can imagine there's like many different ways. But yeah, I actually am not sure about the DoD one because I don't have a card. I can imagine it's a big requirement for them that they would be one of the groups pushing for it because I just remember like, that's what they were doing with basically everything. If it didn't support smart card, it had too soon, so. But it looks like it looks like a good work so far. And I like that you're using the client certificates because then you have that mutual authentication for the encrypted tunnel as well. So it actually, if I saw it correctly, it actually authenticates to engine X and to Rails. It verifies it twice. Okay. Yes, yes, yes. Yeah, so first, we actually use to only authenticate in engine X and like just forward the end result to GitLab Rails, but as we figured out that might not be the most secure solution because one can just forward the header to GitLab Rails itself without engine X and that could still authenticate the user which we don't want. So we added the verification to the Rails side as well. Anyway, if there's no further question, let me just quickly check back the Zoom chat. Right, so I'm not seeing any more questions, but if you have, or we have one, you can reach us on the g underscore manage channel and feel free to ask questions anytime regarding the smart card authentication. Excellent, thank you very much for the presentation. Yeah, thanks everyone attending. All right, see you, see you then. See ya.


It's always an honor to be here with all of you. Today I was tasked with the topic of radiance, reflecting radiance. And inshallah, there's a couple of stories and people that I want to kind of bring up in this particular conversation and also turn into our attention as women and as young ladies, masha'Allah. And what does that mean to reflect radiance? So shall we begin? In thinking about radiance, one of the first people that came to mind, I don't know what to do, I'll hold this one, how about that? One of the first people that came to mind for me, and there's so many, subhanAllah, because we know that anybody who is actively worshiping Allah subhanahu wa ta'ala, actively reading Quran, actively connected to the Nur, the light of Allah subhanahu wa ta'ala, is going to reflect radiance. So I'm going to tell you the story briefly of Imam Malik. Do you know the story of Imam Malik? It's a beautiful story. How does Imam Malik become Imam Malik? Someone said it. His mom, see so many of the biographies of the greats of our scholars, if you read into their biography, who exactly had helped them, promoted them, continued, pushed them, it's almost always the mom. And I say this to a group of many moms in the room or future to be moms one day, or if it's not biological children, then it's spiritual children and mentorship that you give to so many and you're nurturing as a woman. Imam Malik, radiallahu anhu, came to his mom and said to her, came to his parents and said to them, I want to become a singer. Do you know this? The great Imam Malik, who we today honor and cherish and we quote and we love. And an entire school of Islamic law is based on his wisdoms subhanallah. He came to his mom when he was young and said, I want to go into singing, entertainment. And she said some really wise advice to him. She said, as you get older, your voice will change. Your face will change. And what they love you for now, this beautiful face and this beautiful voice, when you are older, they will mean nothing. Any fame and any, this one too, it's like we have had a long day. Any fame and any glory that she will be given when you're young will fade. But if you channel that energy into studying, it will become more honored. And so he thought about this and decided that maybe his mom is actually right. And Imam Malik was heavily criticized for his appearance. Does anyone know why? What is it? What is it? Ah, yes. Masha'Allah. Imam Malik loved to wear beautiful clothing, but he was not arrogant, nor was this ostentatious. He loved and he would quote the Hadith of the Prophet, sallallahu alayhi wasallam, that if Allah subhanahu wa ta'ala gave you wealth, material wealth, then he loves that it shows on his ibad, on his servant. But you don't do this from a place of arrogance.  And what was Imam Malik standing? Imam Malik was somebody who all the kings and all the greats consulted. They would visit him. They would have, instead of him going to their courts, they would come to him. That's how important he was. You can imagine, if you're going to be sitting and advising people, you're going to sit with dignity.  When he would wear this beautiful clothing and it said he would also wear very expensive musk, right? He would smell good. It said that often people would say, this must be in conflict with piety. How do you have somebody who's pious, who worships Allah subhanahu wa ta'ala daily and focuses so much on Islamic learning? Yet he has this beautiful clothing. He would change his clothing often. They were like pristine white, right? And musk, right? Why is he so interested in this outward form? And it goes back to his mother. When he was a little boy, a young boy, deciding to go to now study the Dean, he would say to her, is it time for me to go write my lessons? And she would say, come here. And she would literally put on him scholars clothing.  And she would tie his turban for him because he didn't know how to tie his own turban yet.  And so it connected for him that if somebody is going to be a person of scholarly tradition and somebody who Allah subhanahu wa ta'ala has given them either wealth or knowledge, that it should show on them. This concept, subhanallah, is important because many people would criticize Ibn Malik and say, what is his concern with the outward form? But in reality, we have this very funny idea that if you're somebody who is pious, if you're somebody who is dedicated to Islam, not arrogant, then you shouldn't care about what you look like. But that's simply not the tradition of the Prophet sallallahu alayhi wa sallam, nor the tradition of many of the greats. I won't say all, but many who understood that actually you did have to make sure that you can carry this, he would say, the hadith of the Prophet, he would say this is when people criticizing would specifically say, the dignity of the hadith of the Prophet demands that I look this way, that I look honorable because I am carrying the honor of this deen. And I'm working with and explaining to people this deen, how are they going to take it honorably, especially if they're people of the quote dunya. The people of the dunya only speak language of the people of the dunya. And so our teachers would tell us if you're going to make some headway in the dawah of Islam and this explaining teaching and propagating of Islam, you have to be able to speak the lingo of the people of the dunya. And Imam Malik understood this. Now all of this story is to say when we focus on the topic of radiance, people immediately think beauty. When they think beauty, they think outward beauty. And I just gave an entire explanation as to why outward beauty is important. But it's not the kind of beauty that we talk about in conventional wisdom. And in fact, conventional wisdom today just does not count anymore. There's a lot of young people here, but also all age people here. You are on various social media platforms as I am as well. And the trends, the many, many, many trends that we see. One thing that we talk about in our girls' halakas here at Rahma is how incredibly fickle beauty is. The concept of beauty, what does fickle mean? Come on girls, what does fickle mean? Yeah, it changes. One day it's like this, one day it's like that. If you roll back enough into history, what today is trending was once trending in the 70s. And then it goes out. And what's trending is trending now, what used to be the 60s. And then that goes out. And what trends again is trending, right? And it just keeps on changing. And the majority of the time, who is setting the beauty outward beauty standards? It's often men in a corporate office somewhere who decide the year before what color is going to be the color of the season that everybody buys their purses and clothes according to that. Beauty is fickle, the outer beauty. But if we want to talk about the true inner beauty, the radiance that Islam brings, I want to tell you a story of a friend of mine. I'm not a dermatologist, but she is. And a very successful one, masha'Allah. Somebody who's a skin doctor, right? And when I was growing up, she was in my community. And she was a half of the quran, masha'Allah. And she was one of the first of the girls from my community to go to Syria and study. And she came back and had memorized quran and went off to medical school and became a dermatologist. When I was in high school, I shadowed her. I shadowed her clinic. She's been older than me, so I was shadowing her as I was learning and trying to figure out what kind of medicine that I want to do. Knowing that I too wanted to become a doctor one day. So I shadowed her a few times in her dermatology clinic. And one day, she said to non-Muslim patients that she was working with and unapologetic, unapologetic Muslim, masha'Allah. She said to them, she said, Muslims have the best skin. It's like, wow, masha'Allah. And then she backed it up, but she said, and you know why we have the best skin? I'm thinking, oh my goodness, these patients are first. And she said, we have the best skin. Do you know why? Because we wash our faces five times a day. Dear sisters, it's not a judgment, but I'm just saying the stuff you cake on, that stuff that's caked on isn't allowing the radiance of what you otherwise have as a believer to come through. And it certainly prevents the water. And some of it legit says water-proof. Come on now, masha'Allah. Come on. I'm going to move this before I knock it away, masha'Allah. I get very agitated about these things. Especially when it comes to Fiqh, you know this. I'm like, come on. You're going to really risk your prayers. You risk your prayers by it not counting because the wudu didn't count, because of the stuff that was caked on didn't actually allow the water through. And in addition to this, and look, we counsel, I'm in the counseling field, and I know there's a lot of question on self-confidence that people have, and a lot of the times the reason that stuff is on there is because of self-confidence. Let me tell you, the number of women that I've met in my life, sheikhat, amazing women, scholars, who buy beauty standards, outward beauty standards would not be considered beautiful. They wouldn't. They're not like model beautiful. But you know what shines through? You know what radiance is reflected through? It's a nur. Literally, it is light. They're glowing. You look at them and you wouldn't say, no, not model beauty, but kind of beauty in which the nur that light comes through. And when you sit with them, you feel a sense of serenity and calm. You feel a person who isn't all tribulation inside of them. You feel a person who stands before their Lord at night and makes that dua and prays. And so they're holding on to the rope of Allah and the rope of Islam, and nothing shakes them. Or if they are shaken, like our teachers would say when the hurricane comes through, they would say be a palm tree. Have you ever seen a palm tree in a hurricane? Have you? I know we don't have a lot of them up in this area. We have earthquakes. What happens to a palm tree in an earthquake? Yes. What does it do? It'll bend this way and it'll bend that way and it'll toss and toss, but what will not happen to the palm tree? It will not come loose. Why? Why? Because of its root systems. A palm tree's roots are deep, deep, deep, deep down. And it's years of building. So it'll sway when a hurricane comes around, but it will not be uprooted. As they would tell us, be like the palm tree. As a believer. And so when you sit with these women of Nur, of light, you find that they are incredibly vibrant. You find that they're connected. They're pulsating. Literally. It's coming through. And what is the reflecting? What is the radiance that they're reflecting? It's the radiance of? Eman. The radiance of belief. The radiance of prayer. The radiance of dua. The radiance of quran. The whole quran is nude. It's light. So imagine, if you even have just one sura memorized, which all of us have more than one here, I'm sure, because we all at least know Fatiha. If you have at least one memorized, that is nude living within you. You are literally the vessel carrying light. And that light is reflected on you. And so when people meet you, they may not be able to tell what's special about you, but they know something is different.  Maybe that's what's different. But it's not. It's more than that. And when they talk with you, they find themselves able to actually like have a sense of calm just by talking to you. What is that? It's not you. It's not me. It's not us. It's Wallahi. It's not our work. It's literally the light of Allah coming through the quran, coming through the very beings that we have as we're reading and as we're reciting and holding on to this quran, which is why we have to talk about nurturing our inner selves. I joke a lot. My Halukah folks know. I joke a lot about people and their skin routines. And you should have them. Oh, no, I'm not saying that you don't. Terella. Right. But I tell this funny story of one time I was, you know, and I'll forgive me, but I only tell the story because of this. How much I was caught off guard by the story. But anyway, it was one time I was, I never go up necessarily to the floor up where has all the administrative offices, but I had to drop something off. So I dropped off something at this office. And the person working there had never met. And I was literally just at the doorway and it said, oh, I'm here to drop these papers off. And literally she turned like this. She was in one of the wheelie chairs and she kind of turned like this and she goes, what's your skin routine? I was just caught off guard. Like, you know, and if I had one, you know, I'd be happy to offer it. And I was like, what? And she repeated the question again. And I was like, yeah, literally three times.  Come on. I know what's a secret woman out there. Secrets. Come on. You know, literally, I probably should have said to her, repeat after me. And then I reflected on this because I walked, I was kind of like, I left the, and it just kept thinking about this and thinking, and I thought, what is going on here? And I thought, Subhanallah, even a person who's not Muslim, who does not understand necessarily or know what we mean by the radiance of Quran or of Salah or we'll do it, who knows what that was? Allah, who knows, right? But I mean to say, it was something that was picked up by others. And even if you don't recognize it, it's happening, right? And you sometimes do see people or sometimes even yourselves, often yourselves, and you can't even tell, but others can. We believe in the aura, like in a vibe, an energy that is given off by Eman. And it's tangible and it's something you feel. And the presence of angels and the presence of the very thing that Allah Subhanahu wa ta'ala said and taught us in the Quran, see mahum fi wujuhihim min atherin sujud Literally, you can see it on their faces. The traces of it are on their faces from their prostration. It's in the Quran. I'm not making it up. Allah describes it directly. Right? And so when we think about how do you get to this point? There's a certain level of nurturing your inner self, of purifying your inner reality, that that glow isn't going to get there on its own and it's not going to get there as much as you rub stuff on it. Inshallah. The outer layer may be, but the inner glow isn't going to come until there's faith, niyah, intentions, thoughts, actions, motives, everything we do starts to become for the pleasure of Allah subhanahu wa ta'ala. And when it appears on your face, it literally is the sign of the righteous. And look, in the tafsir, by the way, that ayah that I just said, see mahum fi wujuhihim, some people, and this is not me talking, this is Imam al-Kurtubi in the tafsir says, some people interpret this verse and think that it's an outer mark.  I got myself in trouble a lot. Imam al-Kurtubi talking, not me. He says, some of the juhal, those who are ignorant of the meaning of the verse, believe that it's an outer mark, but actually it's an inner, it's an inner manifestation, oops, I'm excited again, inner manifestation of that anur. Does that make sense? Really important that we understand our Deen. So this slalah, this prayer that we do, these prostrations that we make, they are literally illumination.  And you are reflecting not your own work, but rather the radiance, the nur of Allah, subhanahu wa ta'ala.  How far are we from Ramadan? Exactly one month. Last Friday, so A'id was on a Friday. Last, yesterday, which was Friday, right, four Fridays ago, was the last day of Ramadan. Na'id yani. Right? You're a month out.  How is your quran? How is your extra nefin and na'ibada and charitable acts one month out of Ramadan? How are we doing? How are we doing? Let's just be real. How are we doing? Good. It's good to be honest. Wallahi. Transparency and honesty is the most important thing. My Halaka knows, every Friday of the last four Fridays, I have been insisting that people take out their phones, open up their calendar, and literally put in the app, or wherever you write your calendar, put it on. Let it pop up as a notification of, it's time for me to read quran. Because I know my schedule, right, when I open up this app, it's very colorful. Alhamdulillah. But if it does not say, read now, Rania, I may lose track of reading that day. Does that make sense? As much as we think it's a habit, and I got this, I got this, yeah, I got this, right? The reality is life is chaotic. There's just a lot of stuff going on. And so you need to make sure that you actually pin yourself to it, and then you hold yourself to account. If it's not daily, then it should be every few days. If it's not every few days, then at least once a week, right? There's gotta be anchors to this. And if you're listening to this and you're saying, Alhamdulillah, I've got this, Alhamdulillah, prayers are good, you know, I'm able to do my nafil, I'm able to actually read some quran. Can we talk about the next thing? Can we talk about the next thing? Like the next level? And even if you feel like that's too far, it's okay. Our teachers tell us and remind us, you need to know what the bar is, where you drink. But, you know, what you need to reach to, because if you don't set the bar high enough, you're keeping it pretty low. And you're like, I'm good, I'm good, all's good, Alhamdulillah, Alhamdulillah, Alhamdulillah, Alhamdulillah, who knows what that means? Who knows what that means? I don't know. But if you know what the bar is, then you know that you're still striving to get there. So they would tell us the bar in terms of, if you want that radiance, the bar that our teacher set for us, which is a hard one, but we learned it directly from the prophet, it's the extra night prayers. Now, let me tell you another story of another individual in our history who is definitely one of the most radiant women. There's two that I'll mention today, but one that I'll start with. When we think of extra worship and extra prayers and extra connection to Allah SWT, sometimes people think of men and male worship. But I want to focus you back in that in our tradition, there is this beautiful poem written about a woman, a abida, servant of Allah SWT, a worshipper of Allah SWT, but they say that her aibada, her worship outworshipped a thousand men. Who am I talking about? Rabia al-Adawiya. Rabia is beautiful, SubhanAllah. This is a pre-Rumi, okay? InshaAllah. And she's, her literally her du'as are captured as poetry. SubhanAllah, how beautiful her munajat, her kind of pleading and begging back and forth with Allah SWT. So I'm going to read one to you. And it says, O God and my Lord, eyes are at rest and stars are setting. Hushed are the stirrings of the birds in their nests or the monsters in the oceans. You are the just who knows no change, the balance that can never swerve, the eternal that never passes away. The doors of kings are bolted now and guarded by your soldiers.  My Lord, each love is now alone with his beloved and I am alone with you. That last line especially, that every person, think about this, one is to Hushed, three in the morning, four in the morning, literally middle of the night, she would say almost everyone is asleep. Everyone is in the arms of their beloved and I, Allah, am awake in your arms. That level of connection with Allah, when everything else is quiet and still, getting out of the warmth of one's bed is hard. It's hard, it's hard. I'm not going to try to rose color it any other way. But what does it do for you? If you want to know what the bar is, it's to understand that if you want the radiance, you will be able to reflect that luminosity and we'll tell you why in a moment here. But it comes down to never missing your fardh slada, your prayers, especially the obligations and if you're good with that, to add the Nawafid and if you're good with that, try to add the extra of the night prayers or these Tahesud prayers. Because the power of the light that they give, the reflection of the radiance that something like the Tahesud gives is the kind of powerful light. It's like, you know, yesterday I was telling the students at the conference, Sheikh Sharaweeh, Rahimahumma, was a really beautiful Egyptian Mufassir of the Qura'an, somebody who explained the verses of the Qura'an and he was also a linguist. So he really understood the meanings of the Qura'an so beautifully and he had this really beautiful saying where he would say that all of humanity was in darkness and so they tried to figure out how to light up the place. But some humans came to it by figuring out how to do, right, light up a match, a little match, a little bit of light, in the darkness, a little bit of light. Someone got smart and said, let's put the match on top of a candle. Okay, now we have it's lasting a little longer, but it's still a little light. Someone said, let's take multiple candles and put them around on a chandelier. Someone said, let's put it all together and make a torch, right. The next person comes around sometime later and figures out the light bulb. Then someone says, put multiple light bulbs until you get all the way to where humans are striving. They're trying, they're trying to put light forward until they built the most powerful lights there are. Have you ever been in a stadium at night? Watched a game at night? When you're in the stadium, I played sports, I was like, you're in the stadium at night. When you're in the stadium at night, it is bright. It's as though it was literally the middle of the day. That's how bright it is. Bright, bright, bright light. And the point Shashara we was trying to make is, but when the sun comes up in the morning the next day, you literally have to squint to see whether those stadium lights are still on or not. And he would say, what the Prophet Muhammad, sallallahu alaihi wa sallam, brought was like the sun compared to what all humans have attempted to put forward, even in those bright stadium lights. Does that make sense? That bright light, if you want the brightest of the lights, if you literally want the noor, it's going to come from things like the Quran and the prayers and especially the Taheshud. Why? Why am I pushing this as much as we can? Because I want to tell you this hadith. The Abu Hurayr radiallahu anhu said that the Prophet sallallahu alaihi wa sallam said, it's a beautiful one, but it's a really beautiful one. He said, verily my nation will be called on the day of judgment. So imagine, just take a moment, put yourself in these shoes, it's going to come. We believe as believers, we know it's coming. But sometimes we don't think about actually putting ourselves in the shoes of what would it be like that day. So just take a moment with me. It's the day of resurrection. Yulman Qiyamah is happening. You all heard, as I heard the stories of the chaos. The people running and screaming and shrieking and having a really hard time because the truth has come. And there's no turning back. And he says verily, my nation will be called on the day of judgment. And they will be identified in millions of people. How are we going to be identified by Muhammad? He says we will be identified by the traces of the radiance, speaking of reflecting radiance, the traces of the radiance from what? From the wudu.  I was wondering that he had seen what he was like in the dark. I was thinking maybe something you can imagine. Can you imagine if you've ever been to somewhere where it's like a glow in the dark or something that's a glow in the dark, can you imagine glowing in the dark? I wanna glow in the dark. On the day of judgment. Mashallah. He's like, yep, that one is from Uma Muhammad. Alhamdela. Alhamdela. I'm being very serious. will do. Whoever among you is able to extend this radiance, then let them do so. I'm just going to let that sink in for a minute.  And yes, pregnancy does bring a glow to it. But I'm talking about a kind of glow that literally is seen if not here, and if not by the people here, is seen where it's more important. And it's identifiable and identifying you on a day that otherwise is chaotic. And on that day that you want to be identified from Ummat Muhammad sallallahu alaihi wasallam. So in closing and really kind of wrapping this up, remember, nur, this nur that we talk about, is a light or a glow. And when people look at you, they should see kind of a refreshing, vibrant radiance that comes from what? Our faith, our intentions, our niyah. Allah, even the niyah, even the intention will give you nur, even if you don't completely follow through, or you were prevented from or you couldn't follow through on the intention you made. You're rewarded even for the intention. And then of course our behaviors, our thoughts, our actions, and our motives. And that one of the signs of the people who are righteous is being at peace, having a good attitude, and having contentment.  Who is the radiant? Who is it? Faltima zahra. What is zahra'ameen? See everybody says flower. She's literally called Faltima the radiant. And Faltima, radiallahu anha, of course, the youngest of the daughters of the Prophet sallallahu alaihi wasallam, and the only one who outlives him, but dies very soon after him. It is the mother, of course, of the grandchildren of the Prophet sallallahu alaihi wasallam, and lives a very pious, pious, humble life because neither she or her husband, who is whom, said na'ali karram allahu wajahu, even he, we say may Allah ennoble his face. Can you imagine the ennobled face and the radiant face? Masha'Allah. What an amazing couple. That's abadakAllah. And here you have somebody who has a difficult life because they were both poor and difficult so much so that one day said na'ali said to her, can you ask your father for some help? Your father is the Prophet of God, like ask him to aah help us. They are four children and she was, they were poor. He had to sell his shield literally to have enough maharat to pay for her dowry. And so she went to her father. She didn't find him there, so she left the message with sitna'a isha radiallahu anha. And that night the Prophet sallallahu alaihi wa sallam came to her and said, you came to look for me. And she said, yes, I'm asking for help. What did he say to her? Does anyone know? What did he teach her? He said, if you want, I can get you help. But if you want, I can teach you something that's better than this. And what was that? Say it together. Subhanallah. Alhamdulillah. La ilah lallahu aqbar. And he taught her to say this. And in teaching her this, what was he teaching? Because it wasn't just teaching her. He was teaching all of us by extension. And this doesn't mean by the way you can't get help. That's not the moral of the story. Some people take that and say, I've got to be superwoman. I've got to do this all alone. That's not the point of the story. The point of the story is to be content, to be patient, to work through it. Because what the Prophet sallallahu alaihi wa sallam is teaching, he's using his daughter realizing that she will be the example. She's from the exemplars. The woman who are guaranteed paradise. And there are so many women in this globe, on this globe, who are never going to have my dear sisters. I know you all come from different communities and walks of life. But we all collectively have most women in this, on this globe, do not have and cannot access. Do you hear me? So when the Prophet sallallahu alaihi wa sallam says, can I teach you these words?  And how will they remain steadfast and content? Subhanallah, walhamdulillah, wa la ilaha illallah, Allahu Akbar. But like the original story I started off with Imam Malik, if Allah is giving you wealth, then use it. Allah wants to see that goodness on you. But if he hasn't given that to you, and that's part of your trials, your trials, then there's other ways to hold on to contentment as well. Do you hear what I'm trying to say? This Dean is for everybody. So therefore, it has to have flexibility for all times and all places and all people. Right? And so back to what we're saying of satana Fatima Zahra. Part of this is knowing that by nurturing that inner self, you're going to also be able to glow externally. And even if it does not show to the people around you or you can't see it when you look in the mirror, know that the angels have witnessed it. And know that when the day when it matters, when you want to be identified as part of the Ummah of Muhammad sallallahu alayhi wa sallam, that that radiance and luminosity comes through. That's what we're hoping for. Wallahi.  Make sure that the wudu is full. Look, as a fiqh teacher. Now people are not going to ever want to make wudu in front of me. I hold my tongue. I don't know you, so I won't say anything. But if I know you, or if you've been in my holoca for some time, and I walk in and you're making wudu next to me and you're going like this, I will tell you, sister, unpin your hijab, allow that water to get all the way through to the entire extent of the face to the entire extent of the elbows, make sure the feet are fully washed, allow the light to shine in the dunya and in the akhira. The splashes and the quick wipes aren't going to give you the kind of luminosity that we need. Did I hurt by your feelings? I love her. And so I'm going to end here, inshallah, by telling you that the Prophet Muhammad by Hadith of the Prophet Sallallahu alayhi wasallam where he said, in paradise, there is a street in which they could come, they would come every Friday. And the north wind would blow and it would scatter fragrance on their faces and on their clothes, and would add beauty and loveliness. That's what it says. And then they would go back to their families after having added this beauty and loveliness to themselves. And their family would say to them by Allah, you have been increased in beauty and loveliness after leaving us. And they would say by Allah, you have also increased in beauty and loveliness after us. Subhanallah. The point of this hadith here is to think about how this idea of jannah, that in jannah, all of it is literally light is new. And if you feel the sense of darkness here right now, in this life that you're living, there's constriction, there's tightness, there's difficulty, there's dark corners. As a believer know that there is everlasting, ever ending, never ending light that's coming forward. I hope inshallah you and I can find that kind of light in this dunya too. But if it's hard to find or there's moments or stages or years of your life in which are difficult to find that light, know that the light is coming forever after this inshallah ta'ala. And that helps the believer breathe, knowing that what's to come is greater and bigger and that Allah in His vastness in His vastness will never leave us alone inshallah. And with that will close. Please Allah, allow us to be woman of radiance, woman's who glow from the inside out, either be who's insides match their outsides, and there outsides match their insides. Ya Rabbi, we ask you to be people who are steadfast on this Deen. Ya Rabbi, allow us to have the kind of light on our faces from the traces of our wudu and our prayers, Ya Kerim. Allow us to try to be people of tahesud, to stand between your hands alone when all others are sleeping. Ya Rabbi, to experience that sweetness of faith so we are never, ever shaken. Ya Rabbi, like the palm tree. It may sway, but it's never uprooted. Ya Rabbi, we ask you, Ya Kerim, to please bless us, increase us, empower us, uplift us. Ya Rabbi, we ask you to love us because we love you, Ya Kerim, and allow that love to enter into our hearts fully and completely. And the love of the Prophet Muhammad, sallallahu alayhi wa sallam, and to be able to give that love and the knowledge of this Deen to our progeny, Ya Kerim, that our great, great grandchildren in this country still call themselves Muslimin. Ya Rabbi, wa l-Alamin, wa l-hamdulillahi Rabbi l-Alamin, wa sallallahu alayhi wa sallam, wa l-Alamin, wa l-Alamin, wa sallallahu alayhi wa sallam. Ameen.


I'm Anisa LaCount, a Kaiser Permanente physician. Summer is in full swing and many of you are making plans to gather with family and friends. Kaiser Permanente recognizes the importance of connecting with others, especially after such a challenging period of isolation. So here are four tips to stay safe and healthy this summer. Number one, know you're healthy before you go. Check for symptoms such as fever, cough, shortness of breath, chills or shaking chills, muscle pain, headache, sore throat, or a new loss of taste or smell. If you or anyone in your family has these symptoms, please stay home and call your doctor. Number two, always wear your mask. A cloth mask protects you and others. Nearly half of COVID-19 transmissions are traced to someone unaware they're infected. If you are carrying COVID-19 without symptoms, a cloth mask can significantly reduce the risk that you will transmit the infection to others. A mask also keeps you from touching your face if you do come in contact with the disease. Number three, social distance. The surest way to protect yourself and loved ones is to maintain at least six feet of physical distance from anyone outside of your immediate household. Remember that even with safe distance, you still need to wear your mask. Number four, practice good hand hygiene. Be prepared with adequate supplies of soap and water, hand sanitizer that's at least 60% alcohol, paper towels, tissue and disinfectant wipes. Use gloves to touch door handles, gas pump nozzles and other high traffic surfaces and wash or sanitize your hands frequently. As you have fun this summer, we urge you to be safe and stay healthy so we all can thrive. Thank you.