Good afternoon, everyone. My name is Oankar Bhatt. I'm an engineering manager at Casten by Veeam. My focus has been in the areas of authentication, role-based access control, multi-cluster management, for the purposes of data protection of applications in Kubernetes. This is through our product, KTEN, that we've built at Casten.  Super grateful to the reviewers and committee that spent so much time reviewing the proposals and accepting my proposal. So very happy to be here. I'm a first-time speaker at KubeCon. Now, before I move ahead to the other slides for the tutorial today, a few things I want to highlight. You'll see that there's a QR code at the bottom right corner of my intro slide. So do make use of that to access the GitHub repo that I've created for the purposes of today's tutorial. It has a lot of prerequisites that you should set up in order to go through today's tutorial. So that's one. There's also a URL there right at the bottom which will take you to the same link. The next thing I want to highlight is I will pause about three times for 10 minutes in various stages of the tutorial to help unblock you guys if you have questions and if you're stuck. And lucky me, I have my team from Casten who's going to help the audience here as well. So during the breaks, I'll walk down and we'll help you if you're stuck somewhere. So I have Sylvan and Matt from the product team at Casten and I have Tom and Lee from the engineering team at Casten. So thank you so much guys for helping out today. All right, so let's go to the agenda next. So today I'll talk about why you might want to attend this tutorial. Hopefully some of you have already seen the proposal and that's why you're here but I'll double click on that a little. And then I'll talk about what are Active Directory and LDAP. We'll introduce the application that we're going to be deploying today for today's tutorial. That's the application that we're going to secure. I'll cover Open LDAP, DEX, OAuth 2 Proxy which is another open source project. We'll then go through the prerequisites again and we'll set up Open LDAP, DEX, OAuth 2 Proxy and the application as part of the tutorial. I will show a demo. I will be going through the same steps just like you guys today and I'll show you a demo of what secure access to that application looks like at the end of the tutorial. And then we'll do more Q&A. So that's the agenda. All right, so why attend this tutorial? You might be in that class of users who's thinking about migrating applications to Kubernetes and you're thinking about, hey, I don't want to reinvent the wheel when it comes to authentication. You might have standardized on using Active Directory in your organization and you might want to use that for meeting your authentication needs in a Kubernetes cluster as well. If that's the case, then you're in the right tutorial. You might be in another class of users who's not interested in migration but you're just deploying new applications in Kubernetes and you want to leverage your Active Directory server for authenticating access to that app. If yes, then you're in the right tutorial. If not, yeah, you can get out of the room. I'm just kidding, I'm just kidding. In a stick around. And I want to touch a little bit upon why am I doing this tutorial today. So I've been with Casting for about a little more than two years. In my time at Casting, I've worked with multiple organizations to install our product, K10, with Active Directory-based authentication enabled. So when the requirement came up initially while I was at Casting, I was the engineer responsible for integrating the open source project DEX in order to meet this Active Directory authentication requirement. And so I want to use this opportunity today to share what I've learned through my experiences of configuring and using DEX for this. And so I'm really excited about being able to do that today. All right, so what is Active Directory? It's a directory service developed by Microsoft for Windows domain networks. It uses the lightweight directory access protocol and other services like Kerberos and DNS, but we're not going to dive deep into that in today's session. And so the next question is what is that lightweight directory access protocol? In short, it's called LDAP. It's an open vendor neutral standard for accessing and maintaining a directory service, a distributed directory service. So you can think of an Active Directory server or LDAP server containing the user names and passwords for users and a client application can authenticate access to it by talking to this LDAP server or Active Directory server. So they can validate users that are trying to access that application. And so I told you in the agenda that we'll be talking about open LDAP. So open LDAP is an open source implementation of LDAP. Now for today's tutorial, we'll be using an open LDAP server as a stand-in for an Active Directory server. So I'm going to show you the Kubernetes YAML for an open LDAP deployment, an open LDAP service. We'll work through deploying that. And that's going to be your LDAP server for the purposes of today's tutorial and demo. All right, so now we introduce the super critical application that we want to secure and that's Pac-Man. So at the end of this tutorial, you'll have Pac-Man installed on your machines and we'll be securing access to it by authenticating against an open LDAP server running in your Kubernetes cluster too. All right, so we know that's our goal. We have Pac-Man application and we want to secure access to it. So I'm going to go and talk about option one first and we'll eventually lead to option three, which is our final solution. So in option one, you can rewrite the Pac-Man application so that anytime someone tries to access it, you can send an LDAP request to the open LDAP server and have Pac-Man process LDAP responses that are being sent by that LDAP server. Right, it's possible. We can spend time on looking at the code, rewriting it, but that's not the goal for today's tutorial. For today, we want to not rewrite the application at all in order to secure access to it. So that's our goal. So let's look at the pros and cons of option one here. What's the pro here? You have a nicely packaged open LDAP server. There's a container image. You can deploy it in a Kubernetes cluster and now you have a server to authenticate against. But the con here is you have to rewrite the app and we want to avoid that. So that takes us to option two. So in option two, I've introduced a new box here called DEX in the middle. DEX is an identity service that uses OpenID Connect in short called OIDC. You'll hear that very often. It uses OIDC to do authentication on behalf of other applications. So over here, as I told you, the disadvantage of option one was you had to rewrite the Pacman app so that it can speak LDAP. So we've solved that problem here by offloading that problem to DEX. So DEX is going to be the one that's going to send and receive LDAP requests and responses. So far, so good that solves one part of the problem. But the disadvantage in option two is you still have to rewrite the Pacman app so that it can talk OAuth or OIDC with DEX. So there's still some work to be done and we're super lazy in this room today. We're not going to rewrite the app at all. And obviously, you know there's an option three coming to solve this problem as well. So I touched upon a few terms, OIDC and OAuth, which I haven't introduced yet. So I'm going to do that before I move to option three. So OAuth 2.0 is an industry standard for authorization. Think of the situation where an application wants to authorize a second application to access its data or features in the first application. So that's where OAuth 2.0 comes in. It acts as an authorization layer. Now OpenID Connect is a thin layer on top of OAuth 2.0 which allows an application to obtain login and profile information about the user. So you have the authorization layer in the form of OAuth 2.0 and you have OpenID Connect which acts as the identity slash authentication layer. So that's the difference between the two. So this brings us to option three. If we have four boxes over here, we have the Pac-Man app. And in order to solve the problem in option two, what if I told you we could use a reverse proxy to handle authentication and authorization for us? So the answer is yes. That's another open source project called OAuth 2.0 proxy which we will be deploying in our tutorial today. So OAuth 2.0 proxy is the one that we offload the OAuth work to. All we have to do is redirect HTTP requests meant for Pac-Man to the OAuth 2.0 proxy which will start the authentication flow. As the authentication flow goes to DEX and the LDAP server, if the user entered the right credentials and if they were authenticated successfully, then the flow will go back all the way to DEX to OAuth 2.0 proxy and then we redirect the user back to the application. So there you have it. You have met our goal of not rewriting the application by deploying two open source projects that we'll be double-clicking on in today's tutorial. All right, so for the prerequisites, note that today's tutorial will work only on x8664 or AMD64-based machines. So unfortunately, ARM is not supported by the Pac-Man app that we're going to install in today's lab. Now the packages that you want to install are all accessible in the URL or QR code that I've pointed to here. So I'd suggest if you don't have your laptops out yet, get them out, get started on installing the prerequisites for today's tutorial. So this is a good point to take a 10-minute break, a five to 10-minute break to let you guys install all that's required. So I'm going to just go ahead and do that. Please feel free to raise your hand if you have any questions while downloading the prerequisites and one of us will come over to you. So while you're doing that, I'll talk a little bit about kind. So kind represents Kubernetes in Docker. It's a quick and easy way to install Kubernetes cluster inside a set of Docker containers. You can use brew install kind if you are on Mac. If you are on Windows, then you can use the Choco package manager to install kind or use your favorite Linux package manager if you are on Linux. In case you don't have a laptop today, then it's a good opportunity to connect with people in your community. Use your buddy's laptop to go through the tutorial. Hello, yep. Okay, so I'm going to proceed on to the next part of the tutorial. I will take another break once we get to a certain point and we can unblock you if you're stuck on the prerequisites. But now as you can see on the screen, I've highlighted just the open LDAP box here. Our first step in this lab is going to be about setting up just the open LDAP service. So we'll deploy it in a Kubernetes cluster. We'll add users and groups to the LDAP server. And we will use LDAP utilities for interacting with this server. So you'll be able to add a group using the utility command LDAP add. And we'll also use LDAP search to search for users and groups in this LDAP server. All right, so if you haven't seen it yet, this is the page that the QR code takes you to. All the prerequisites are over here. So I'm going to go ahead and start with the open LDAP part of our tutorial. So to begin with, we're going to use kind in order to create a cluster on my laptop. So you can use kind create cluster dash dash name and hand over the name of the cluster that you want to create. In this case, it's KubeCon. You can use kind get clusters to list the clusters that you have created. Also note that once this cluster is created, your Kube config will be set up appropriately so that a KubeCut will get namespaces is against the new kind cluster that you just created. So once the cluster is created, I went ahead and cloned the GitHub repository that we are going to use for today's tutorial. I created a namespace named open LDAP. And then I'm creating a secret of a generic secret named open LDAP. And there are three fields that are going to be present in the secret. The first one is the admin password for the LDAP admin. The second is a field called users, and I've added three users in this command. So that's production admin, production basic, and production config. And then the third field of the secret is a field called passwords that contains the passwords for the three users. So the secret has been created, and the next step that I've executed is I've done a cat of the open LDAP deployment that we're going to be working with today. So let's take a look at that before we proceed. There's a metadata section, there's a spec section. The key thing I want to highlight in the open LDAP deployment is that in the spec section, for the containers, we have set up a few environment variables. The first one is the LDAP admin username that's called admin. The other three environment variables are sourced from the secret that we created in the previous step. So that's why you'll see a secret key ref, and the name of the secret is the open LDAP secret. I then run kubectl create dash n open LDAP dash f open LDAP deployment to create this deployment. Next, let's look at the service definition for the open LDAP service. So you'll see here, it's a service named open LDAP of type cluster IP. We're not interested in exposing this service outside of our cluster today. So it's of type cluster IP. It's going to be listening on port 1389, and the target port is also 1389, which matches with the deployment container port as well. I then run kubectl create dash f using that file to create the open LDAP service. Let's watch for the pods until they come up. Everything's good so far, it's in running state, and all the pods are ready. So next we're going to run the port forward command to make sure that the open LDAP service is listening on the local host IP address on port 1389. Okay, so the service is up. We finished the first stage of our tutorial. We're almost there. We're going to interact with this LDAP server next. Right, so next what we're going to look at is we'll create a new group. So you notice that we've already created three users while we were creating the open LDAP deployment. Now we're going to create a group called Pacman admins. So the way you do this with anything to do with LDAP is you create a file with the dot LDAP format and I'll get into what LDAP is in just a bit. There are multiple lines here. You'll see a DN representing the distinguished name of the record that represents a group in the LDAP server. The common name CN is Pacman admins and there are two members in this group. There's production admin and production basic. So notice I haven't added the production config user to this group. We have three users and only two out of them are members of the Pacman admins group. So LDAP stands for LDAP data interchange format. It's plain text format that's used for representing directory content and update requests. In this case our update request is about the addition of a group. As I described earlier, we went through DN and CN. So I've copied just one line from the LDAP file to describe what each field is. We've already covered distinguished name and common name. There's also a field called OU which represents an organizational unit that the user is a member of. And then there's DC which represents domain components. So if for example your organization's website domain name is www.example.org then your domain components would say DC equal to www comma DC equal to example comma DC equal to ORG. So let's carry on with the next part of the tutorial. So we're now going to interact with this LDAP server. So you'll see I'm catting the Pacman admin group dot LDAP file. We've already looked at that. So next I'm running the LDAP add command. The dash X represents simple authentication. The uppercase H represents the LDAP server that we're talking to. And as you know, we've already started a port forward command. That's why it's listening on localhost colon 1389. The uppercase D represents the distinguished name of the admin user, which is CN equal to admin, DC equal to example, DC equal to ORG. So think of that as the username of the LDAP admin that's interacting with the LDAP server. The lowercase W is that admin's password. And you'll remember this admin password was the password we created when we deployed open LDAP. And the dash F accepts a file. In this case, it's the LDAP file. You'll see a message from our LDAP server that says the entry has been added. So next we're going to use the LDAP search command against the same LDAP server. Most of the arguments are the same here. The only difference is the lowercase B. So what the lowercase B tells LDAP search is the root at which to perform the search of records. In this case, the lowercase B is set to DC equal to example comma DC equal to ORG, which means we're searching for records, all the records under that domain. So you'll see in the output, there's a distinguished name for the organizational unit named users. There are three records. There's one record for the production admin user, a record for the production basic user, a third one for the production config user. There's a group called readers that was created by default when the open LDAP server was deployed. It has all three users inside it. So make note of that because you'll see the groups show up eventually when we perform authentication successfully. So keep in mind that all members are in the group readers, but only two members are in the group named TACMA and admins. And this output is also confirmation that the LDAP ad actually worked. All right, so okay. So we've reached that part of our tutorial where everything related to the open LDAP box is all set up for us. We're next going to move to deploying decks. Notice that my red box is a little bit extended because while configuring decks, we're going to be adding configuration that's related to the open LDAP as well as the OAuth to proxy, which is a client of decks. Now before I run through the commands, I wanted to highlight the values file that I'm going to be using to install decks. So I'm going to be using Helm for decks. Helm accepts a values file and that's what I'm showing here on the screen right now. Lots of values here. I've sort of decomposed it into three pieces, which I've listed on the left. There's an LDAP connector piece which tells decks that it should communicate with the LDAP server. That's the decks issuer config, which is about decks itself. And then there's the client config, which is about the OAuth to proxy that talks to decks. So let's focus on just the LDAP connector config. So you'll see there's a host config that points to the LDAP server that we've deployed on localhost. But I'm not using localhost IP here. I'm using Kubernetes's naming convention for a service, which is servicename.namespacename, and then the port number that it's listening on. There's an SSL section, which is not relevant for today. It's all demo, so we're not going to care about SSL, but you should definitely care about it in production. We have the bind DN and bind password up top over here. So that represents the admin credentials for the purposes of today's demo. So it's the bind distinguished name and bind password for the LDAP admin. Next we have two sections that we'll cover, user search and group search. So let's start with user search here. So the user search config is telling decks how to look for users in the LDAP server. There's a base DN and an optional filter. So the base DN tells decks, you know, where do I start my search in the LDAP server? It's the root of the search or base distinguished name, in other words. The optional filter lets you filter down the records that are being returned by the server. So instead of getting overwhelmed by too many records, you can use the filter to reduce that. The user name field here tells decks that the UID field in the LDAP record should be treated as a user name. So in an active directory environment, this might typically be something like a SAM account name, or I think there's a user principle as well. So this is something where you should discuss your active directory team should get involved and they will give you the best practices for your organization, about which field is the right user name field. But since we're using open LDAP for today as a stand-in, we're just using UID as the user name. Next, you'll see email, ID, name, and preferred user name. So keep in mind, if you remember, I said decks is an open ID connect provider. It's going to generate a JSON web token for you every time you successfully authenticate with it. This token is going to have fields like email, ID, name, and preferred user name matter, and all you're saying, telling decks is to use the UID of a user's record to populate the JSON token when authentication is successful. So similarly, you have a group section that tells decks how to search for groups that a user is a member of. And once again, just like the user search, you have a base DN and a filter. And then you have this matching criteria that tells decks how to match a group with a user record. So in our case, if production admin is present in the Pacman admins group as a member, then we're going to get a hit there, and decks is going to return that group. So that was everything related to the LDAP connector. Next, let's move on to the decks config as an issuer. So the issuer URL is the URL where decks is going to be available on as an OIDC provider. So in this case, again, I've used the Kubernetes naming convention of service name dot namespace name. There's logging format. It's just info level in this config. So for storage types, decks supports multiple storage types for persistent storage. There are database options. You can look at decks' documentation to learn more about it. But for today's tutorial, I'm just using the in-memory type implementation. And then you have the web config, which indicates the clients that it allows to connect to decks. In this case, we're allowing all clients to connect to decks. And it's going to listen on port 8080. Okay, so let's get to the last piece of the Helm values file, and then we'll go and deploy decks. So the last piece is the static client configuration. So we're registering the OAuth to proxy as a client of decks here. You have an ID, a secret, and a redirect URI. So the redirect URI is important here. What this is telling decks is if authentication is successful, redirect to this specific URI to continue the flow. Okay, so over here, I'm going to continue the steps for deploying decks. I've done a cat of the decks' values file. You know, this is inside the GitHub repo that we have cloned under secure dash pacman slash decks. We've already gone through all the values. Let's proceed. So we're gonna create a namespace called decks. We're using Helm, as I mentioned earlier. So we're doing a Helm repo add decks with the URL for decks' chart. And Helm repo update decks to pull in the latest chart from there. So there's one thing left to do before we proceed to actually run Helm install. In the Helm values file that I have in my GitHub repo, I haven't updated the bind password. So let's set the bind password there before we proceed. I'm having some trouble editing this file. So it's not editing this file right now. Kind of, I guess if it's stuck, the CD secure pacman, CD decks, edit any way that works. Let's just try that. I could probably just continue from the other shell. Okay, thanks. All right, so I edited the values file so that I entered the admin password for the LDAP admin. And it made progress and ran Helm install using the updated values file. We ran a watch on Kupkar to get pods in the decks' namespace. And that's what is running right now. It's in running state. So we're good, so far so good. That was affecting the screen a little because of zooming in. All right, so thanks. So we have decks port forwarded so that it's listening on local host and port 5556 now. All right, so that's stage two for us. Among the four boxes that we have in our end-to-end flow, we've deployed open LDAP and we've deployed decks. They're both accepting connections. So this is a good point to, does anyone want to pause at this point? Are you stuck? Can you make progress? I guess I'll just keep going forward then. Don't see any hands raised, okay. So let's just keep going. Okay, so the next thing we are going to deploy is OAuth through proxy. So as I said, it's a reverse proxy for handling OAuth for us. We're going to have decks as the OIDC provider that OAuth through proxy interacts with. And once authentication is successful, OAuth through proxy will redirect to Pacman. Okay, so over here, we're going to create the namespace Pacman where our application is going to live. But before we deploy the application, we're going to deploy OAuth through proxy first. So you'll see I have cd into the OAuth through proxy directory of our GitHub repo and I've done a cat on the OAuth through proxy deployment. And then I've executed kubectl create dash f of the deployment file. So before we proceed, let me explain what the deployment looks like and what's important over here for configuring OAuth to proxy appropriately. The key thing to look at here is under the spec for the containers. We have the provider set to OIDC and the URL for that provider is represented by the OIDC issuer URL here. You'll see it's set to dex.dex which is running in our Kubernetes cluster already. The next important piece of config is the OAuth to client ID, the OAuth to client secret, and the redirect URL. So this represents OAuth to proxy as a client. And if you remember from our dex values file we had registered an OAuth to client there. So I want to highlight that over here right now because it's important for the client config index to match with the OAuth client config you're seeing here for the authentication to flow to work successfully. So if you're facing some problems this is a good place to go and debug later. The last piece of config that I want to point out before we move ahead is the upstream config. You'll see that it's set to pacman-actual.pacman. So when authentication is successful from OAuth to Proxy's point of view the upstream URL is the URL that it's going to redirect to or rather proxy to. And we're going to set up the pacman actual service towards the end of the demo. So we have done with the deployment. Let's look at the OAuth to proxy service YAML. It's of type cluster IP. We're not exposing it outside the cluster. The port number is 4180. Viran Kupkar will create dash F using the service file. Let's watch for the pods and wait for them to be ready. So so far so good over here. OAuth to proxy is running. And next we're going to port forward the OAuth to proxy service as well. It's going to be listening on local host IP and port number 4180. All right. Let's finish the third box. Now before we proceed, this is a step that we have to complete for this end to end flow to work. We want to edit the system's hosts file so that if the user or when the user accesses the pacman app through the browser the browser will be able to redirect to the local host address where the server is listening. So you know that we've deployed decks. We've deployed OAuth to proxy. We have run port forward for both of them and they're listening on the local host IP. But how do you tell a browser to access those services? You know, there's no, we're not using DNS to do that. We're using the hosts file to do that redirection for us. So there are two lines, one for decks and the other for the OAuth to proxy service. I'm going to go back to our GitHub repo where we have our steps. So let's look at the hosts file. And you'll see I have already added lines for decks.decks and OAuth to proxy.pacman. All right, so now we're getting closer to the final workable demo. We're going to install pacman now using Helm. So I'm going to run Helm repo add pacman with the URL for the chart where we have this app running. Since I've already added it previously it says it exists. I'm going to run Helm repo update for this particular Helm project. Everything looks good. We'll now run Helm install pacman in the pacman namespace. So you'll see Helm dump and output about the status of the installation. Let's watch for the pods to come up. So over here you'll see that the first entry is the OAuth to proxy pod that we deployed previously in the pacman namespace. The second one is the pacman app that has the logic for the game. And the third one is about storing persistent data related to that pacman application. So while we wait for that to complete let's talk about the next few steps here. Once the pods are all ready I'm going to run port forward for the pacman application and then try to access it from my browser without authentication, right? So we've set up the pieces but there's some glue work still left. And I'll show you that I can access it without authentication for now and we'll fix it eventually so that it works with authentication. All right, so we have all three pods running at this point. So I executed port forward of the service pacman and it's listening on port 1990. So any HTTP traffic that I open on my browser is going to be forwarded to port 1990, all right? So you see that the pacman app is right now up and running. I'm able to access it without authentication but the whole goal of today was to secure access to this highly critical pacman app. And so that takes us to our next step. So if you remember from the diagram what I had mentioned was any HTTP traffic meant for pacman needs to be redirected to OAuth to proxy. And to do that, we're going to update the pacman service to redirect it to port 4180 instead of the original port 8080. So I have these patch commands ready here for doing this. Let's stop the port forward for now. So you'll see in the patch command it's kubectl patch service followed by the service name pacman in the pacman namespace. The type of patch we're going to run is a JSON patch. The operation is a replace. And what we're replacing is the path meant for the port of the service which is slash spec slash port slash zero slash target port. And I'm setting it to the value 4180 instead of the original 8080. The other thing that we have to update in the service is the selector that's going to be present in the service. The select is responsible for which deployment that traffic has to be routed to. And so we're routing that traffic to OAuth to proxy instead of the actual pacman app. So let's run port forward again and see what happens this time. Let's go back to my tab and reload this. And you'll see... So this is open ID connects login page. We have been redirected to the second box in our flow. Since OAuth to proxy is configured with DEX as an open ID connect provider, you see a button show up here, sign in with open ID connect. So when I click here, the flow is going to take me to DEX's login page. Right, so I've come to a new window here. You'll see DEX's logo show up here by default. You'll see DEX.DEX here in the browser tab on the top. And notice the reason this works is because we updated the hosts file so that when the browser accesses DEX.DEX, it's being redirected to the local host port number 5556 where DEX is listening. So I'm going to enter the credentials for our production admin user which we added in our LDAP server. The password is test password admin. I click login. So hold off on the four or three for now and I'll explain a little bit about that later. But what has happened now is I did get authenticated successfully. The flow came all the way back to OAuth to proxy. I just have to redo this flow again. All right, so this is where I want to reach as at this stage of the tutorial. So you saw the traffic redirected from Pac-Man to OAuth to proxy. You saw the DEX login screen. I entered the production admins credentials which was correct. I got redirected back to DEX and then to OAuth to proxy and I got a 502 bad gateway error because we still have one step remaining which is the arrow over here. We still haven't completed this part of the puzzle and we need to deploy a service that OAuth to proxy can redirect to. And so that's going to be the last step to see the demo working end to end. Let's take a look at the final service that is going to help bridge everything that we need. So this service is called Pac-Man Actual which is the actual service that's going to serve traffic. It's of type cluster IP and the port is 8080. I want to show you the OAuth to proxy config again so that it puts things into context over here. So if you remember from the deployment we have an upstream field that says it's going to redirect to the Pac-Man Actual service on port 8080. So that's the service that we're deploying here which is the final piece of this puzzle where we want to fix this part of the traffic flow. So let's create the Pac-Man Actual service and then let's port forward again. I'll go back to my browser and restart the authentication flow. So just repeating all the steps in the flow again. I've been redirected to OAuth to proxy. Let's sign in. I've been redirected to DEX. I've entered the admins credentials. Just ignore that for now. I will explain what's happening there again after a few slides. So this time the flow went all the way from DEX to OAuth2 and it went to the upstream service called Pac-Man Actual and I can finally play Pac-Man happily without knowing that there's secure access to it. Nobody can really go and maybe delete my scores. Maybe the high scores are really important. So I just want to highlight that redirection part again where we changed the port 8080 to 4180 and the selectors in the Pac-Man service to OAuth to proxy is deployment for the redirection to happen to OAuth to proxy. We saw the 502 bad gateway and we fixed that by deploying that last service called Pac-Man Actual and then we went through the whole flow. So now I just want to go back to the 403 that we were seeing and to explain what was happening there. So you've already noticed twice that during the login process I saw a 403. This is to do with the token that's being stored in the session. Remember initially during my slides I said we don't want to rewrite the Pac-Man app at all. Well, that was mostly true. If it's Pac-Man or any application that you want to deploy in your cluster you have to have sign out and sign back in flows. So your sign out flow is going to clear sessions for you so that future sign-ins don't hit errors such as the 403 that we were seeing. Now the way you want to do that is OAuth to proxy for example has something called slash OAuth2 maybe this is not very visible but in my URL here I have slash OAuth2 slash sign out. So OAuth2 proxy as a service supports certain endpoints that let you handle this. Sign out makes sure that the session is clear. So once I go to sign out it takes me to OAuth's login screen. This time if everything worked as I expected it shouldn't show me the 403 this time. So you see that I don't get a 403 this time because I cleared this session that I had previously and I don't see that anymore and I'm redirected to Pac-Man on successful login. So we're almost there. I wanted to highlight the logs that you'll see in DEX that will help you understand what's happening in DEX's backend. And to also find out if the configuration that you made in DEX is actually doing what it's supposed to the logs will be useful for that purpose. So here I have four log messages that got generated when I logged in as the production admin user. So the first log here is telling you how DEX is performing a user search. You have the base DN from your DEX config. You have the optional filter called iNetOrgPerson and you have the UID set to the username that I entered on DEX's login screen. The second log message here shows that DEX was able to map the production admin username to an actual LDAP record with a distinguished name that looks like this and you'll remember this from the LDAP search that we did against the open LDAP server. So this is an example of a log when login is successful. The third log here is an info level log again that's showing how DEX is doing a group search. This is again based on the config in the DEX values file. We have the base DN and the optional filter from the group search section of DEX's config and we're looking for the member that we just found in the previous step. The last log is showing that login was successful. A user was found and notice the groups. Readers and Pac-Man admins is present in as per DEX's logs which means it's going to include it in the JSON web token that's going back to the client. You know my next slide is it's very identical to the previous one. The difference is it's a different user named production config and the other big difference is remember I told you that there were two groups in the LDAP server a group called readers that had all three users and the group that we added today called Pac-Man admins which had only two. So since the config user is not part of that Pac-Man admins group you see just one group show up over here. Alright, so having gone through today's tutorial you've deployed open LDAP, DEX, and over through proxy to sort of get a hands-on experience about how you can authenticate access to applications using an open LDAP server. When you're ready to move this to production you'll want to figure out how to configure DEX so that it can talk to an active directory server maybe. So a few things to highlight here when you are ready to do that and hopefully you walk away from here being confident enough to do that. You'll want to talk to your active directory team about the host and port number that the active directory server is available on. You definitely want to fix your SSL config so that it is secure and most likely your active directory team is going to mandate that you do that. The other thing is you remember we used LDAP admin credentials that's not a best practice in production your active directory team will create a user for the purposes of DEX talking to the active directory server so you should use that DN and password up here and I briefly touched upon this earlier too we said username UID here but in an active directory scenario this would be something like SAM account name or I think it's principal name I think that's everything active directory specific that I wanted to bring up here. All right, so a few links for further reading we have dexidp.io which is the official DEX website that has additional documentation so DEX supports lots of other connectors not just LDAP you can do GitHub based authentication, Google SAML connectors and there's a long list that you can go look up depending on your users needs or your own needs there's a Slack channel where the maintainers of DEX are active and they will answer questions so highly recommend joining that channel I have links for the OAuth 2 Proxy project as well that has great documentation about some of the configuration that I have shown you in the OAuth 2 Proxy deployment we have the link for open LDAP and the last link is my GitHub repo it's a public repo, it'll always stay that way if you want to go back and run through these steps all the prerequisites and the steps from today's tutorial are present there and that's the tutorial for today hope you all enjoyed this and I'll keep it open for Q&A if you want to come up to the mic and ask any questions I'll be happy to answer them or if you're stuck somewhere right now in the tutorial we'll be happy to unblock you the last thing I want to touch on is at Castin we're hiring you can look at our castin.io slash careers page if you're interested in working with us we have roles in the backend team, front end team automation and we have a cloud native position open as well so if you're interested come talk to me after the tutorial or even at Castin's booth and we'd love to connect with you thank you everyone, pleasure being here can you hear me? can you check if the mic works up front here? yeah I think it's working there we go so if I wanted to deploy Donkey Kong for example do I need to deploy another deck server proxy? a good question so you can reuse your decks server remember I created it in a separate namespace you'd have to deploy a separate OAuth to proxy though for the Donkey Kong app you'd have to register it as a client index so there's a bit of config that you have to update in the existing deck server notice from the values file the static clients is an array so it can accept multiple clients so all you need to do is deploy Donkey Kong a separate OAuth to proxy for it and just update your decks config and that will do thank you yeah thanks for the question alright so I think that's time then thank you very much for attending this tutorial I hope this was useful and you're walking away confident about how to deploy these projects thank you so much for your time and have an awesome group con everyone


Here is a picture of Nefertare Vivi looking all thoughtful and pondersome. Now, here is a picture of Rebecca doing the exact same thing. And here is a picture of Viola doing it as well. And here's one of Hiori. Oh wait, that's just Vivi again. And let's not forget Pudding either. But what are these princesses looking at? Well, obviously it's the subscribe button for the Grand Line Review, the pressing of which grants them and their kingdoms regular one-piece content uploaded straight into their YouTube feeds. And being the refined ladies they are, they even press the bell as well to ensure that they do not miss any big news. Hello and welcome to the Grand Line Review, your source for everything one-piece, and today I would like to discuss what I believe is one of the greater flaws in the series, the series that is one piece because that's what I talk about. Now this channel, despite being created due to an immense love of Etcher Oda's work, has never been afraid to be critical when it is called for, which I do quite frequently in chapter reviews and various other discussionary content, at which point I am often met with comments like, shut up. And sometimes those comments even get expanded to shut up, you're not a true fan. And I would generally say yes, that's exactly why I've spent close to three years of my life making over 650 one-piece related videos because I am clearly not a true fan. I guess we just have different definitions of fandom though, because in my eyes a true fan is someone who is able to recognize both the greatness of a series, but also take into account and to be able to maturely discuss its shortcomings because they do exist in every series. There is no such thing as a perfect manga or perfect anime. One piece does come quite close though, which is why this whole channel exists, but it most certainly has its detrimental features and to begin discussion on this topic, I first want to play a little game with you. Here's how it works. I'm going to describe a character from one piece, and I want you to guess who that character is. Sounds fun, well even if you don't think so, we're gonna do it anyway. So this character is a fairly young woman, who is quite important in the grand scheme of the world, as well as an integral element of their specific arc. They spend their early time in the series acting one way, but soon enough they have a complete 180 degree flip and become the exact opposite, as well as form the center of an intended emotional payoff, and are consistently being relegated to needing to be saved by the straw hats. Who is this person? I'll give you a few more seconds to think about it as I sit here and feel for time. Alright all done, great. So if you said Rebecca, then you are correct. And if you said Viola, then you are also correct. If Vivi popped up as a thought, you're still correct. Furthermore, if your mind went to Charlotte Pudding, then I simply cannot deny how correct you are. And if any of you thought of 1-0-act-2 spoiler character, then welcome to the Winner's Club, because you are also bang on. One piece has a huge problem, and that problem is princesses. Less the concept of princesses though, and more how they are implemented by our Lord and Saviour, Etra Oda. And for Manga readers, this whole script was actually written prior to, how shall we say, certain events taking place on 1-0. And I suppose we'll call them 1-0-act-3 spoiler character, not to be confused with 1-0-act-2 spoiler character. And I may only fans, I hope you appreciate the incredible lengths I go to to keep you moderately spoiler free. But this princess problem is nothing new to the fan base, because arc after arc, at least in the post-time Skipperra, we are faced with a very similar type of character popping up. Do the extent where they serve an almost purely technical purpose at this point. Like a princess cog in some sort of kingdom arc machine. And the story of one piece has become very synonymous with Oda's arc type of princess. But do you know what's actually really interesting to think about? Despite the abundance of princesses in this series, when you actually stop and think about it in the pre-time skip era, there was only one princess. Quite literally just one prominent princess in the series, and that was Vivi. How insane is that to think about given how intrinsically linked, the very concept of a princess is to the modern series. So this whole formula has without a doubt been a product of the new old era. As every major mega arc, with the notable exception of Pancasid, has featured either a literal princess or someone with an assigned princess role. And that distinction is important, because they don't need to literally be called a princess in order to fit this archetype. It just so happens that many of them are. But it doesn't matter because these characters serve the same function either way, with tiny flares of individuality and bits of payoff here and there. But by and large, these princesses are also incredibly poorly written, as well as implemented. And the reason for that is because they exist to serve as a device, rather than a fleshed out character. A beautiful eye-pleaser to captivate the overwhelmingly teenage male manga readers, and a character who is able to inspire other characters around them to fight, as well as generate sympathy with their inevitable princess tears. And generally, they don't actually do much of anything else. They have no real role in this story, other than to be a platform and motivation for other characters to shine. And so I'm going to try and coin a term here being the princess prop, because there is very little functional difference between many of them, and a typical film or theater prop. I mean, for example, if you're shooting a scene and the script says you need a gun, then, well, we need to source a gun. The gun itself has no character of its own, it's just there to be used for a narrative purpose. And in one piece, when Otas insert New World Ark, needs a princess prop because the story takes place in a kingdom or kingdom-like structure, well, then we need a princess to fight for. And that princess is the all-important princess prop. And for the most part, the use of these characters' makeup arguably the weakest aspect of every major arc they appear in, and since the New World era, they appear so often that it is a lingering detractor of one piece as a whole. Before we hop into some more depth, though, I do want to make it clear that despite mentioning her earlier, I do not consider Nefertare Vivi to be a princess prop. Vivi is actually a very rare example of a princess, implemented extraordinarily well in one piece, and I know that a lot of people do find her annoying and whatnot, but I don't care. She drove the action of the alabaster saga, not just the arc, the entire saga. Vivi was not there just to be saved by the straw hats, she was every bit as active as the rest of them, and her drive is most prominently on display during the climax of alabaster, where she would know other options available, just continues to shout and shout and shout for the armies to stop fighting. Vivi was always the center of the action and the drama, and never at any stage on the sidelines just watching. She is a character that we got to know to the core, and without her, alabaster would be nothing but a pile of sand. And it is nigh on impossible to say the same about a modern princess who we barely get to know, and to be perfectly frank, their presence in the arcs they feature in are incidental at best, and near pointless, and completely forgettable at worst. So let's take an example of the latter by zeroing in on one, Rebecca, royalty of the Riku family on Dressrosa. Now she gets a fair bit of hate in the fan base, a lot of which I think is undeserved, primarily because it is not the fault of the character themselves, but it is an unfortunate truth that Rebecca is a princess prop, masquerading as a gladiator, whose entire purpose on Dressrosa is to serve as motivation for her father, Kuros, and actually fleshed out character with a story of his own. Meanwhile, Rebecca also serves as some sub-motivation to two key straw hats, being Luffy and of course Robin, the latter of which is assigned the task of protecting Rebecca in the final conflict, thus eliminating any chance of the princess prop actually having a profound moment of her own. So as a result of this, I would pose to you all the question of what would happen if Rebecca was removed from the Dressrosa arc. And to be perfectly frank, I think there would be very little functional difference, despite the trifecta of motivation she provides. Kuros would still hold a grudge and fight against Diamante because he killed Scarlet, and meanwhile Robin and Luffy were going to fight against the Don Quixote pirates regardless, so them meeting Rebecca changes absolutely nothing. Rebecca was not a catalyst for that action, that role fell primarily to Trafalgar Law actually, who was a far better princess on Dressrosa, and you know what, if anything removing Rebecca may have actually freed up Robin to take on some more prominent action during Dressrosa, because this draw hat pretty much just turned into Rebecca's babysitter for the most climactic segment. I will say there is one thing that does go missing without Rebecca in the picture, which is the feeling of profound sympathy towards Kuros, due to the heartbreaking flashback scenes of him in the toy soldier form with Rebecca. Those are super super effective, but once again this only goes to show that Rebecca exists almost exclusively to serve the character of Kuros rather than herself. Rebecca is no vivi to say the least, she is hollow royalty and a princess prop to be used, as a purely technical and functional source of drama, that arguably isn't even necessary. Sticking to Dressrosa though, let's take a look at another of our princesses Viola, because Dressrosa did it double princess style, because one prop was not enough for the madness of this particular art. So Viola first up fits the physical stereotype, a generally attractive woman at least in the manga, because look let's be real, the anime did her very very dirty, sometimes making her look like an alien wearing a Viola costume, but in any case Viola follows a very stereotypical princess prop path, where she is actually introduced as an antagonist, who very shortly after becomes an ally. And while we'd not seen that before now, it's not as if Nami, Robin, Vivi, Pudding, Boa Hancock all followed that path, and you know what in fact even Rebecca was also kind of an antagonist to begin with, because she did try to assassinate Luffy. Plus Dressrosa also had baby five, who followed this bad to good model, but we'll leave her out of this. The point is we'd seen it before and we were going to see it again. In any case after Viola's abrupt change of heart, she then went on to do pause for dramatic effect, very little if anything at all. And once again, I have to ask the question, if Viola had been removed from Dressrosa, what would we have lost from the arc? Yes, you would have had to forego some sanji comedy and some exposition, because Viola did primarily serve to tell the audience what was happening on the battlefield, due to her incredibly overpowered, but incredibly underutilized double fruitability. And everything that Viola does serve in this regard, could have been accomplished just by using Otis narration, much like he does in every other arc. So Viola does very much exist as another princess prop, but Dressrosa is definitely the worst of it. To be fair to any other character that I would label as a princess prop, they do tend to have a lot more meat allocated to their existence, like Charlotte putting for example, she is not a literal princess, but she does have that same narrative role. Standard attractive Otis female who herself takes very little action and spends pretty much the entirety of the arc on the sidelines, in this case, forming over Sanji being cool, which Sanji has a tendency to do, but putting is better integrated into the story, because as much as I'm not a personal fan of her split personality, the fact that she was experiencing that sort of inner conflict is actually sort of interesting, and it does pay off at the very end of the arc, with the scene of her collapsing into tears with Sanji's memories. Absolutely beautiful, 10 out of 10 scene there, even the anime did it great, that's how good the scene is. But that is not the large majority of the pudding experience, and 95% of her time is spent either doing this or this, forever depreciating comic effect. However, pudding does pass the test that Rebecca and Viola fail, because if you were to remove her from Hawkeak Island, you would need to massively rework the story, because her presence is integral. Although it can definitely be argued that at the same time, it's almost purely technical, because she does serve as the key item to get Sanji and therefore the retrieval team onto Hawkeak Island to begin with. So even though she does have a splash of character in his, granted a genuine moment at the very end of the arc, pudding's overall presence is quite princess-prop-like in nature. And heading into one, I'm not gonna say anything because at the time of this recording, I don't think things have quite happened in the anime yet, and out of respect for the fact that the arc has not ended yet, so there is always potential. However, what I will say is that if you were at all, expecting anything different from what you've already seen, about a hundred times in one piece, then prepare to be disappointed. Stepping back a bit now, you might be wondering why I started at Dressrosa and skipped over Princess Shirahoshi of Fishman Island. While that is because despite her volatile popularity within the fan base, I think she is a solid example of a New World Princess who cannot be labelled as a princess-prop. And that's because as much as she did need some saving and protection, Shirahoshi took command of her own destiny during Fishman Island and became the absolute key figure of that arc. In a similar manner to how Vivi took charge in Alabasta, although it did take Shirahoshi a long time to get there, but Shirahoshi was actually a direct participant in the art climax, and not only that, but her importance and uniqueness was seared into the series through the revelation that she is the ancient weapon Poseidon. So as much as some people out there may not like the character, it is undeniable that she is in fact a character rather than a prop. Especially because Shirahoshi's arc is entirely her own, about her living and embracing the legacy of Ultihime, rather than just providing motivation to like Luffy or her father to fight or act on her behalf while she sits quietly in a corner, waiting for the arc to be over. But even without Shirahoshi you have a series that I would say is dominated by the presence of Princess Props. And if you think that the handful of characters I've mentioned isn't much, then let's just think about it this way. We have literally only had three gigantic mega arcs featured in One Piece, being Dressrosa, Hawkeye Island and Wano, all of whom have shared the Princess Prop feature and collectively, these arcs currently make up about 250 chapters of One Piece, a fair bit more now actually, and that is roughly a quarter of the entire series, which has taken place over the last seven years. So that is seven whole years in a row where the Princess Prop has been a prominent feature. And of saying it like that, it may be somehow still doesn't sound so bad. I mean, so what if Oda sprinkles in a Princess Prop after a couple of arcs? Well, the key problem is that it's all entirely weighted towards one side of the series, being our modern events. One Piece went about 700 chapters without a Princess Prop. Yes, there was Vivian Shirahoshi, but they were already different as explained. And even when we did need a useless character to fight for, Oda branched out and made existences like Tonjit, for example. He would be the quote unquote Princess of Longering Longland, someone who served a technical purpose, but because he was designed as an old goofball rather than a stunningly attractive lady thing, he left Tonjit open to be used for excessive and weird comedy, a role which he performed quite brilliantly. But for the last seven years, Oda has very much adopted this Princess archetype, and it now seems inescapable. So much so that within three arcs, the very word Princess has become a source of size from the One Piece fan base who are exhausted with exploring, or I guess more accurately, attempting to explore this kind of character and almost never receiving a narrative reward for their existence. And who knows, there may still be more Princess Props to come following Wano. I mean, if we're visiting any kind of kingdom for a longer than Zo period of time, then I would bet large quantities of Australian currency on it. And as per usual with my more negative discussions, I do want to end by saying that this is not a series breaking feature. Luckily, Oda excels in so so many other areas that we can more or less choose to ignore this, but me being me, I just want One Piece to be that little bit better. And addressing this archetype would be one way to achieve that, as we may very well actually be seeing currently on Wano. But what do you guys think? Please do leave your thoughts in the comments below or even join my Discord server. And if you'd like to see more videos like this, then please do go and check out some of my other content or even subscribe to the channel for more glorious One Piece business uploaded straight into your YouTube feeds. But for now, this has been the Grand Line Review, and I'll see you next time.


I guess this week is officially egg week on the Frank Defano YouTube channel and today we're going to compare supermarket brands versus the eggs we now have available on frankiesfreerangemeat.com and just go over some marketing terms as well. I did a video on natural free range grass-fed organic, what those terms mean in regards to meat. I think sometime last year, I'm not sure if I touched on eggs in that video I might have. Either way, we're going to take a look and discuss those things. I will say the most significant thing that has changed is usually people look at the color of the egg yolk as an indicator of quality. The companies, the corporate shills, they quote on to that and now they can just put things like red pepper flakes in the feed that will change the egg yolk color without actually being an indicator of the nutritional status. So you really have to trust the person you're buying the eggs from, ask them what's in the chicken feed and if they can't give you a straight answer, hey it's probably not with buying the eggs. So these are lined up from lowest to highest quality and the regular extra large grade brown eggs are $3.49, the organic valley eggs are $5.79 and the vital farms pasture raised eggs are $7.49 and then with shipping and everything included, the eggs on Frankie's syringe meat are around that price point but it's a feed that you do not have access to in the stores. So again, these are basically the regular eggs you're going to get. These are organic, these are supposedly pasture raised but probably supplemented with the vegetarian feed and then these are corn and soy free feed, also absent of fish meal. So before we crack into these eggs, we're going to go over these marketing terms. So outdoor access, extra large brown grade eggs, this just means conventional eggs. That's really it. You know, they build a little like back yard for the chickens near the warehouse that they're clumped together in and they never really go out to see it so these are nothing special.  This organic valley certified organic free range. That's actually the same as outdoor access. Free range just means they have access to a certain area of land but it doesn't mean they're actually using it. No hormones, no antibiotics, that's typical with all chickens now. These eggs are getting a organic corn and soy feed. So this is basically regular conventional feed but they slap an organic certification on it so the Omega-6 is still out of whack, it's still not good for you but it does have less chemicals, less pollutants, less toxins than the regular eggs. Now we have the pasture raised eggs from Vital Farms and these are supposedly out on pasture. I don't know the specifics. They definitely supplement corn and soy in the feed on these eggs and Vital Farms also has an organic version of these eggs that are actually cheaper which doesn't make much sense to me. I guess the cheaper eggs are just on the organic corn and soy feed just like the organic valley eggs. So we're assuming that the organic valley and the organic Vital Farms eggs are going to be the same but I don't have both of those today to compare. Then we have the eggs available on Frankie Syrange Meat. This is a corn and soy free feed and that's really what you want. You want to remove those allergies, you want to remove the low quality crap and that's really what's best on the market right now unless you're about to get some wild turkey eggs. So let's crack into these and see what they look like. Now as I'm cracking these eggs it reminds me one indicator of quality eggs that they're pretty hard to crack. So a lot of the regular conventional supermarket eggs they're very, very easy to break open. Sometimes you just touch them and they start cracking but if you have eggs from a local farm generally speaking the shells are going to be more rigid. That could also have to do with the calcium content. So the regular eggs actually look really, really dark. So they're definitely putting some type of pepper flakes or carotene or some type of supplement in these eggs to make them look like they're supposedly higher quality but the shells are very easy to crack open and from a visual richness perspective you can't really tell much. When we move on to the organic valley eggs I would say these are way healthier than the vital farms pasture raised eggs because we know that these aren't getting some sort of artificial carotene or red pepper flakes supplement to make the egg yolk starker so it's not that bad but we know it's also not a good quality egg. You shouldn't really include those in your diet. Vital farms pasture raised eggs you know is this coloring from the birds being on pasture or is it from them putting something in the feed it's hard to say you know it's hard to say. I think vital farms is very good at marketing I think they have an incredible profit margin on their eggs. I think they're doing very well but you know I don't think they provide a quality product to be honest and the eggs we have on Frankie Strange Meat right now are visibly the darkest colored yolks out of all of these eggs and there's nothing artificial or synthetic in the feed and it's corn and soy free. It's difficult to tell guys the visual stuff to me you know the coloring isn't really what I look at you know does it look like a healthy yolk is it fresh you know when you crack these conventional lowest quality eggs open the yolks are already broken that's a very bad sign. How tight is the yolk together these look okay these look okay but these look very like tight and uniform and the proteins are very strong. Same with the separation of the egg whites that also has a lot to do with the freshness and you could really tell where the egg whites are in these eggs. You could see the outline of the egg white on these two around the yolk and then you can see like the extra kind of watery egg white content but this it's very hard to see this it's pretty hard to see and this you can't tell it looks like a a soupy mess of egg white so visually outside of color there's still some things you can look at and if you do really want to relate to color you want to go with like how dark it is you want to look with how how rich it is you know you could almost tell by looking at it it just feels like you know even though this orange color and this orange color kind of look the same it still looks different visually speaking the richness of this yolk the firmness all that stuff it feels different than this even though the actual color on like a color wheel is almost identical and it's really about the margin guys you know these conventional eggs you know they're getting sold for 350 I would be surprised if the supermarket's paying more than a dollar a dozen for them their organic Valley you know even if they're selling for around six dollars it's probably two dollars a dozen that they're paying for them but they don't sell as much of them and the volume isn't as high and the vital farms eggs the fact that these are you know seven eight dollars a dozen in a supermarket and they're probably getting them for two dollars a dozen very hard-margin product but I'm not sure how much volume they sell and then we have you know the legit stuff the corn and soy free eggs and in my mind you know why are you gonna pay for five six seven eight dollars for eggs if you can spend a dollar or two more and get corn and soy free you know it's kind of sucks that they've been able to use these marketing terms to take advantage of the general public and people don't understand what goes into the feed but what are you gonna do well hopefully you guys have enjoyed this video and learned a little something if you could please drop a like leave a comment down below subscribe so that YouTube can unsubscribe you next week and be sure to check that notification bell so they don't notify you of my videos you guys can go to frank-default.com to check out all of my businesses and support me we have the eggs available on frankiesfreerangeme.com I'm wearing my black sweatshirt black sweat pants silver lined clothing from wifi shielding.com so definitely check that out guys hopefully we don't have too many egg issues testing out the shipping the first few weeks but if you guys have any issues please just reach out to me and we always just issue an instant refund if you can just please send us pictures and let us know what the order number is


Fairings have often been described as kind of edge, edge birds, it's an edge preference where they like foraging in the open, but they need the dense shrubs to hide in. So where you've got that combination, it's where they're happiest. So this for instance is good for nesting, quite dense but not super dense. Next to open areas where the birds like to forage. This project which has now been going for about 35 years, you realise that there probably is no such thing as normal. When they're nesting that's the busy time of year for me to keep on top of all the nest locations. We band all the chicks in the nest, we take a blood sample so we can look at paternity. The bands allow us to track individuals across their entire life and effectively follow their stories. It means that we can follow them from fledging through to adulthood. We can see what the family groups look like, who's friends with who, who's partnered with who. At the moment there are about 200 birds in the study population, divided into about 80 territory. We try to know about every single nesting attempt that the birds here make and so then we get an idea of how successful they've been. There's a young male there who's only got a few blue feathers. He's still got lots of malting to do. The aim of the project has changed a bit with time as we've learnt more about the birds. It began initially because the superb ferrieren is a cooperative breeder where you don't just have a breeding pair but you have others in the family group that stick around and help defend the territory, help look after the young. The superb ferrieren is notoriously salanderous. I think about three quarters of young are not sired by the male at home. We have a pedigree picture which won't make sense to almost anyone except the people involved in the project and you can see the really successful lineages that we've witnessed over the last 35 years. There she is. And that's her yell. She's seen us. They certainly know this action and then once you do that at them then they keep a closer eye on you and you can hear that's probably the female. There's just a pair living here that don't have any helpers. That's one of the surprising and one of the most rewarding things about this job has been learning to understand their vocalisations and they have a huge range of calls. You could walk around with your eyes closed and still have a good idea of what's going on and the sounds you hear. The climate has really been quite variable over that time period and we've seen really big changes in the population accordingly. For a very common bird that we don't think is in any danger we have seen a really big decline in the last 30 years where they have bounced back recently. We don't really know the reasons why that has happened and so I'm using genetics to try and test a few possible reasons for that. It's not just the fairer ends that keep me interested it's figuring out everything else that's going on around me. And it's also really special to be able to work with this kind of long term data. I was working with samples in the lab the other day that are older than I am which is really cool.


Good afternoon folks. This is Steve Rhodes coming to you live from the shores of sunny Delroy Beach, Florida. This year, 1 p.m. update and currently we have all the U.S. indices that we track trading to the downside. The Dow's off 50 points, less than two tenths percent. The S&P is about four tenths or 16 points. NASDAQ 147 three tenths, Russell 2000, seven tenths or 14 points, one and a quarter percent for the semis are about 46 bucks. Trade out at 35 78. You've got gold up 19 bucks. 19 37 is its print. Silver straight up 40 cents. One and six tenths percent. 25 14 lights. Recruit up to 50. 106 78 is the print there. Let's go take a look at our market update charts. I'm going to switch over to a different set than what we typically look at. Simply because I was having some trouble with the black screen charts out here. It doesn't matter if we begin by take a look at the ES mini. So what do we know about it? You've got a TD nine count pattern that completed yesterday. Right now you've got an inside bar. Typically that says that if this remains an inside bar today, that says that the trend that's in place typically continues on that would say higher price. But you've got a TD nine count top. You've got to get a close above yesterday's high. Otherwise, we really should see price go test that oscillator and change line currently printed about 44 69. And the reason is because we have a valid top and we've got a color change in that OUL. The NQ really the same playbook here. Inside bar not doing too much. Does have an oscillator change on that change color. You got the TD nine count top in there. Price should pull back to 14 479. The Dow no topping pattern other than getting back up to resistance. That's the breakdown level 35 244. It has no UL exchange colors. So all three of these want to pull back whether they will or not. Well, we're gonna have to find out. But that's the pattern that is in play out here. US dollar index is trading below a daily profile. That suggests a further retracement gold yesterday pulled back and tested its breakout level. This is June contract we're looking at 18 95 60. Price is right now trading between that level, which is support and resistance, which is about the 1959 level. That's the oscillator and change line area. You've got the silver silver's back inside its daily profile may go target the 25 60 level. That's that green oscillator and change line lights. We crude is just kind of consolidated with inside its daily profile. So not a lot there to talk about natural gas, which did form a TD nine count top has held that green oscillator and change line. It needs to still take out the highs from two days ago to get back to its bullish mode out here. But it's certainly a neutral signal as we speak right now. Folks, stay tuned for the trader said show. But if you have to start your Wednesday, we want you to have a wonderful one. Thanks again so much for joining us.


We've been looking at how universal credit, which has been rolled out six benefits into one are affecting claimants at this moment in time, we've been doing outreach work, we've been given evidence sessions as well and what we've found is really quite shocking. People have to phone up a helpline that costs them a lot of money when a claimant £18 cost him. Also the fact that the money is paid not in advance but in arrears so therefore people are absolutely in arrears and in debt gyda'r Newgrin Gwym尔, mae'r ddim yn i'r gwaith ar weithio. A wneud yn meddwl am gyhoedd Gwym Gwym Mu o'n ddimensionalaeth i gefnog y blaeniau. Mae'r ddail yn gallu gwinech ar y ddechrau. Ond ydych chi'n meddwl am gyhoedd y bofyn ei fod wedi'u meddwl ar y ddod. Mae'n meddwl am gyhoedd Gwym Mu i ddim yn ei wneud ar y dddwn i'r ddych chi gawd. Mae'n meddwl am gwneud ar weithio.


In this video, I'm going to do a couple of examples of how to translate linear functions, just a couple of examples. I'm going to do one example where I translate a function to the left, and I'm going to do another example where I think the example is where I translate it down. I'll have to go to the next slide to figure that out. So again, here are the directions. Let g of x be the indicated transformation of f of x. Write the rule for g of x. Now, when the directions say write the rule for g of x, it's basically saying write the equation for it. Write the function itself. So what we're going to do, let g be the indicated transformation.  I'm going to transform it, and then the new one is going to be g of x. Sometimes these directions can be a little confusing. So let's take this function, and we're going to horizontally translate it left three units.  I'm actually going to wait and draw g of x once I get there. I'm going to draw my new function. So what I'm going to do is I'm going to show you the notation behind this, and then we're going to draw the new shape. So the horizontal translation, three units to the left. What's it going to look like? I'm going to take my original function. I'm going to change it. This is what this notation means. Take my original function, change it by. Now, since this is a horizontal translation, I'm going to add or subtract directly to the x. That's why you got a big parentheses here. So now that if I'm going three units to the left, it's actually going to be opposite of what you think. What I commonly call opposite of what you think. If you're doing a horizontal translation, if you do anything inside parentheses like this, it's always going to be opposite of what you think. Now, if you think of a number line, if you go left three units, you think you're going back three units. You're going down. You're subtracting three. Well, actually, if you ever do something inside parentheses like this, it's actually going to be opposite of what you think. So I'm actually going to add three directly to the x. I'm going to add three directly to the x. That is going to give me a shift left of three units. So what I'm going to do is I'm going to take my new function. G of x, this is my new function, is going to be the old one. But I'm going to take the x and replace it with x plus 3. So now you can see that here it's the same notation here. So my new function is going to be the old function, except for instead of an x, it's going to be an x plus 3. So I'm going to take my old function, which is x minus 2. But instead of the x, I'm going to put an x plus 3. Instead of the x, I'm going to put an x plus 3. I still got that minus 2 there at the back. So see, notice here that I used parentheses. I took out this x and put in the x plus 3. OK, so that's what I mean by take out the x and put in the x plus 3. So my new G of x function, my new function, is going to be. Now, I don't need these parentheses there. There's no reason to have them. There's no number out front to distribute or anything like that. So actually what this is going to be is x plus 1. Positive 3 and a negative 2, it makes a positive 1. So that's the equation for my new line. All right, so what I'm going to do is I'm going to take this new line. I'm going to graph it. So I got 1 right there for a y-intercept. And my slope is a 1 right there. We don't write it, but there is a 1 right there. So I got a slope of positive 1. Positive what? Positive 1, positive 1, positive 1, positive 1, positive 1, positive 1. There we go. I don't need that many points, but it's always good to put too many than not enough. OK, so that's my new function, G. That's the new function, G. OK, now that's what the graph of it looks like. So this is my answer. Now what I'm also going to do, just to really bring some full understanding to this, is now I'm actually going to graph my old function. I'm going to graph f of x.  And this f of x is actually going to be blue. OK, so what I'm going to do is I'm going to graph this, x minus 2. So minus 2 for my y-intercept right there, and then 1 for my slope. OK, 1 for my slope right here. OK, a couple of points here. Connect the dots. And there we go. OK, that's my f function. Now notice here that, OK, so what I wanted to do is I wanted to move. I wanted to take my f of x function and horizontally translate it three units to the left. So did I do that? So here's my f of x function. Did I move all my points three units to the left? Well, here's 1 point. 1, 2, 3. Yes, I did move it three units to the left. Well, let's take another point right here. 1, 2, 3. Yes, I did move it three units to the left. So we can see that, even though the function is to look a lot different now, OK, we've got different numbers here, moving it three units to the left, that did actually happen, OK? So we did do that correctly, OK? And here's the notation of how to find the new equation. Or you can just graph it to figure out what the new equation is going to be, OK? So there's a couple of different ways you can do that. Now, the only thing that we had to do here was write the rule for g of x. So I could have stopped right here with just with the function, just with this new equation here. I didn't have to graph it. But I wanted to graph it to show you guys kind of exactly what we're doing here. We have a little bit better understanding. OK, next example. Let g of x, it's basically the same thing, let g of x be the indicated transformation of f of x. Write the rule for g of x. So again, we're writing a new rule. OK, now we're going to take f of x minus 2, so it's the same function, and we're going to vertically translate it down three units. Vertically translate it down three units. OK, so what we're going to do is we're going to take my function, still using the blue pen here, take my function, change it by just simply taking the function, and if I want to go down three units, I'm just going to subtract three to it. That's it. Now notice I am not subtracting inside these parentheses, so I'm going to flip back real quick. When I did my translations left, I added three directly inside these parentheses. But now, on my next example, now since I'm doing a vertical translation, since I'm moving down three units totally different, I'm not adding or subtracting inside the parentheses. I'm doing it outside now. I'm doing it outside now. All right, so now what I'm going to do is I'm going to write the new equation. So g of x is equal to my old function, f of x, but instead of just having f of x, I want to move it down three. So now I'm going to subtract three from it. So notice I'm using the same notation here. So what I'm going to do is I'm going to take this function and just subtract three from it. So take x minus two and then just simply subtract three from it. So take my function, x minus two, and then simply just subtract three from it. There it is. And so my new function, g of x, is going to be equal to x minus five. x minus five. OK, so now what I'm going to do is I'm going to very quickly, I'm going to graph the new one, g, and then the old one, f. I'm going to graph those quick. And I'm actually going to switch up the colors here. The blue is going to be g this time, and then I'll flip my colors for black for f. OK, so x minus five, so one, two, three, four, five right there at the very bottom of this graph I have here. And then a slope of one. Slope of one. Slope of one. Slope of one. Get lots of different points here. Straight line, try to get that as straight as you can. And there's my g function. There's my new g function. OK, let's compare that to the old one, change my colors here, and change that to the old one. x minus two was the equation. All right, so I have minus two for my y intercept, and a slope of one, slope of one, slope of one, OK, slope of one. Put a bunch of different points in here. Make sure we get a nice straight line. Nice straight line there. And that's my f function. Now the question is, did I move this down three units? OK, so take your f function, did I go down three? One, two, three. Yep, I went down three. Let's pick another point. Here's another one. One, two, three. Yes, I did go down three units. OK, so I did do that correctly. They do that correctly. So this right here, this g of x, this is my new rule. That's my new function for my new equation, my new line here. OK, that's just a couple of examples of translating different functions. The first one was translating left, and then this one is translating down.