Hello, everyone. Thank you for coming to this talk. This is mainly a talk on Java release pipelines using Argo workflows in case you're wondering you're in the wrong room. Now's the time to leave. All right. Did you know that there's one common library which is used across hundreds of Adobe services? And we use Argo workflows to deploy these artifacts in a secure, scalable, and efficient manner. Well, I'll be talking more about this. But before that, a little bit about me. I'm Anirudh. I work in the Adobe's IDP platform team, or internal developer platform team. And I work on this cool library called ASR. I'll talk more about ASR in the next slide. Before Adobe, in my previous life, I've been doing a lot of ETL pipelines using step functions and all sorts of BPMs in biotech. And I like to wander, talk, and debate, and all that kind of stuff. So jumping into what's ASR? ASR stands for Adobe Service Runtime. Not to be confused with a Java runtime environment, this is more on the application level. So what happens in ASR is we bundle a lot of cross-cutting concerns that you would want for a production-grade application. And we kind of ship it as a pawn. So if you are an Adobe developer who wants to go from concept to cloud, using ASR will give you all the checklist that any respectable production-grade software would require. We have six major libraries that I will use today to kind of demonstrate how the release pipeline looks like. And I'll talk more about these libraries in the next slide. And almost like we have a wide amount of services at Adobe which use ASR. So the big deal for us is security and then reliability when we deliver this software and also speed. And that's where Argo workflow comes into play, which is helping us push these artifacts super fast. And these libraries are community-driven inside Adobe. So we get a lot of community contributors. So we have a lot of PR traffic that we kind of merge and release. So a sneak peek into this is a very simplified version of how ASR libraries look like. So we draw a lot of open-source springboard in Jersey and all that libraries in dependency bomb. And that's the root kind of the library that ASR shared modules that you'll see there. And then we have an imperative flavor and a reactive flavor. And the imperative flavor is the very classic, the old school way of doing things. And the reactive is the cool kid in the block. If you have an application which is low CPU, high throughput, that kind of stuff, you would use a reactive flavor. And you can see the dependency chain. Like if you make a change to any of the nodes in this dependency graph, we have to release everything below that. So if I made a change, like a spring boot update, I'll have to end up releasing every single library right here. So that's like on a very simplistic way of looking at how our workflow looks like. The development process for these libraries is pretty much like any open-source library. The maintainers, us, we focus on security patches. And then we have our own roadmap, which we think are like moon charts, are like big mountains that we deliver. And then we rely on the community for any feature request, and then we kind of crystallize that into the roadmap. And we also rely on the community for enhancements. If they think there's something minor, they can just raise a PR. And that's where most of the developments have happening these days. Right now, it's completely community-driven. So then there's a concept of connectors in ASR. Connectors are like SDKs for internal Adobe services. If one team has to talk to a service, they end up writing a connector. And then ASR is the place they come to share it. So it's like kind of that internal CNCF, if you want to say that. Now, since we have a lot of PRs that are coming into these libraries, naturally we have to handle a lot of PR traffic in terms of merge conflicts and making sure that the releases go well and all that. Our previous solution was two weeks' release kind of ceremony. And we used Jenkins for that. So every time we did a release, I had to go to therapy. So it was super painful. And I'll talk more about what the pain points were. So we had one Jenkins job per library. So that means I have to babysit every single release library until it finishes. And Jenkins kind of works out of that plugin model. Everything is a plugin. You want to pull a repo. Then you have to use the GitHub plugin. You want to publish to an artifactory. You have to use the artifactory plugin. What this does is it kind of makes your kickstart like the hello world is easy. But when you're stuck in something deep, some problem, debugging is hard. One classic example is artifactory did an upgrade. And then we used to get a data dump on the kind of a metrics that we used for dashboards. The whole thing broke because the new upgrade of the plugin kind of stopped doing that metrics dump. Things like that. So we want visibility on what we are doing, which was kind of hard in Jenkins. And also Jenkins relies on the Jenkins agents, which is kind of VM-based. So every time we need to do a JDK upgrade, or sometimes we swap out vendors based on the contract, it was super painful to do that in a VM. So a little bit about the release steps. The release itself is pretty straightforward. We pull a repo, do a Maven install, make sure the build works. And then we publish to an internal Adobe vulnerability kind of a dashboard where, based on the palm and the dependency, we get ticketed. If you have a vulnerable library, then we go back and fix it. And then we deploy to the artifactory. And we also do the basic release notes and all the stuff. But any open source library does. So what were the expectations from this library? The maintainers as us and the community, we have two different, and we're trying to merge them. So the community wanted everything fast. They wanted everything yesterday. They raised the PR. Hey, where is my release? I want to use it today. And also, they want to use the latest dependencies. OK, I have this cool feature I want to use. I don't want to wait for your two-week deadline to release. And us as maintainers, we wanted to work on cool things and not worry about babysitting a release. So we wanted it to be self-service. And again, the pipeline itself was too hard to troubleshoot. I'm not going to Jenkins. Why is it hard to debug and looking at all the logs and all that stuff? And I think the key thing was also documentation. If any maintainer wants to do a release, it was hard with the Jenkins setup because you don't have a graphical view of the process. And of course, controlling costs is always a good thing in any organization. So thankfully, Argo had everything that we were looking for. It has DAGs. It is GitOps-based. It gives you all the benefits of Kubernetes. And it uses Workflow as code. So let me jump into what exactly happens with Adobe IDP before I actually show you the solutions. So Adobe IDP is the Adobe internal developer platform. Here, any developer at Adobe can come in with the concept. We have Portal, which will help you generate code. We have different flavors. Just like the starters for a spring application has it, we give you starters like Java, Node.js, and Python. And then we have something called blessed-based containers, which are secure Adobe vetted containers, which every single application at Adobe uses, or more or less. And then comes your next step is your deployment configuration. So this is where you decide how many environments do I want to have, and submit all the PRs, the deployment statuses to stack channels, things like that. The next step is vProvision. You are based on this deployment configuration, whatever you mentioned here. And then the end result is a CI-CD pipeline. Again, I won't go into the more details. If you're interested in it, we have an Adobe IDP workshop tomorrow. Please feel free to attend that. We'll cover more in detail over there. And also, please attend the keynote today in the evening. And also, we'll talk briefly about Adobe IDP. So I mean, I personally use the Adobe IDP to spin up an Argo CD application. But it's also easy to go through the docs and do it yourself if you don't have such a big setup. So the first step is we need an Argo Git repo in our world. That is, this is where all the configurations are kind of maintained. So we make you fill a form, and then everything is stored in a Git repo. And we have a service called Provisioner, which in itself is an Argo CD kind of a workflow runner. What it does is it follows the Kubernetes Apply principle. Like it takes your configuration and manifests an Argo CD application based on what you enter there. So that's a very first step where you get an Argo CD application. So the big picture is you have an Argo CD application. And what it is doing is it contains all the definitions of the workflows that you're using to release. So every ASR Git repo, whenever there's a merge that's happening in the repo, it's going to send events to the Argo CD app, which is going to trigger a workflow. So what does the journey look like from PR to Artifactory? So step one, you raise a PR. And then if the maintainers and everyone is happy, you merge it. And then that's where the events start flowing to the Argo CD application. An Argo CD application has, I mean, I've kind of oversimplified it. It has two main components. There's a sensor and a workflow template which kind of intercept the GitHub events and then trigger an appropriate workflow which goes to the Artifactory. So the sensor that I was talking about, it looks like this. So in very simple terms, what it's doing is, is this event coming from XYZPR or repo number one? And then does it belong to the main branch? Then submit a workflow, because you'll be getting a lot of traffic to those events. And the reason why I put this snippet is it's super simple to configure this workflow, sorry, the sensor. And that's where the magic of the whole Argo ecosystem is. Everything is describable as a YAML. And it's kind of like, for me, the aha moment was when it's algebra versus geometry. You describe an equation and that becomes a graph. Something similar, like you have your YAML here and then that becomes a graph on the right. And the next step is submitting the workflow. So what's happening is, once the filtering is done, there is one workflow for one repo. And I'll be covering about how each and every single repo looks like, the workflow for each and every repo. And then we pass some parameters that are required for that workflow. So if repo one is being deployed, then I need to know what was the repo and what was the GitHub commit and who was the person who merged it, things like that. Now, the release process. Now, I really got to use the power of Argo workflows, because I could paralyze a lot of tasks. Before, I had to babysit each and every step and then go manually. Right now, I have this kind of complex workflow where I can paralyze certain things, which was kind of linear before. And also, Argo steps, some of the steps are impotent and retribal. So this can happen in your workflow. Like, if you're talking to GitHub, your enterprise GitHub might be down and then you don't want any long running processes or sometimes our Adobe security dashboard gets too much load. Their SLA is not the same as our SLA. So you might want to throw in some retries. So this necessarily doesn't speed up, but it helps you be hands-off in your management. So the workflow template itself is how, on your left, you would describe all the steps that happen in each and every in your repo. So this is a workflow template for one repo. So in my one repo, the steps that I talked about in the previous slide have been translated into workflows inside Argo. And this is how a deployment would look like. And I just threw in on the left side to just to show you that these are reusable and then these are kind of simple if you kind of zoom in on it. So my favorite part is how we can control the characteristics of an atomic step. I mean, that's how I look at it. So an atomic step is that one job that you want to split across if you have many jobs. So here, for example, one step which says verify git commit. On my right, I'm running a BAS script for this particular step. I get to choose my image that I want. So this is where if I can go Alpine 1.2 based on any different step and kind of what meets the needs. And then sizing is a very cool thing here because not every step requires the massive amount of CPU or memory, so you can kind of right-size them. And resiliency, which I talked about, if you want to retry certain steps, you can throw in a retry kind of constraint there. So this is probably the most important slide in the stock, I would say, because what's happening here is this is how a comprehensive release would look like. If I do a release or if I do a PR in the root node or even if I have a change of a spring boot version, I have to end up deploying every single repo right here. And on my right is how the DAGs would look like. So it's a DAG of DAGs. So even though one repo is like one box that you see on the right, when you have to chain all of them, this becomes super powerful. Now I have a complex workflow calling another complex workflow, kind of a sort of inception, if you might say. And the beauty of this is it's kind of self-documenting. If someone asked me, hey, how does your release pipeline look like? You just come in and show that person this workflow and it's kind of self-describable, not self-destructive. So the other beauty of the DAGs is these are dispensable. What I mean by that is if you have a traditional step function or anything, those feel like heavy when you write that workflow, because the ease of use in a Kubernetes world, like the Argo CD world, is completely different. So you could have a workflow where you can have a lot of if-else's and make it complicated or just write another workflow. So what I mean by that is the previous slide that has so many workflows, if I want to raise a PR in many of the child node, I just want to release the bottom two after this. So I don't have to release the whole comprehensive release. So you can chop up the workflows and maintain them as independent workflows, which do its own releases. So right now what I have is every PR raised to anywhere in the node gets released. And each of them are self-living workflows that kind of are sub-trees of the same parent. And of course, these are kind of written in a library fashion. So when we do these workflows, these are actually libraries being used from here. But really the efficiency that we gained is in this chopping up of these sub-trees and then making them kind of their own organisms, like deploying that workflow. And troubleshooting is a big thing in Jenkins world, which we face a lot of problems. Because something breaks. I have to start from the line one of the logs because it's not really transparent to know what's happening. But here, since my steps are broken down in a graphical manner, now I know which box that I need to focus on. And that I just need to focus there. And then I can click on the logs and I know what's happening.  So you can do retries, which we talk about. Sometimes our tests are, since these are community contributed tests, some tests sporadically fail in some library. Then it works on a retry, mainly because someone had to tune their timeouts in their tests. This is largely seen in a reactive world where when they write, not everyone follows the best practices. And your tests might just run the next time. And also, it kind of depends on how loaded the CPU is. So the retries are super helpful in retrying those reactive tests. And timeouts, again, these are any standard resiliency feature, like if you have a long running process, because you're waiting on some remote to do something. And times you can timeout based on some configurations there. And I guess the cost saving is something which is we never really thought we could achieve it. Because of the right sizing of the CPUs, now a reactive library, which takes less CPU, can be allocated less CPU. And similarly, the imperative ones is you throw higher CPU and memory over there. Again, unit tests also based on how massive the unit tests are. Like, we have unit tests which run springboard application for every single test out there. And you might want to size them appropriately for that. And the compliance, and usually which is the boring part for developers, which has kind of made it easier, because everything resides as workflow as code.  You can just hand over that particular code, and you know what container you're using, and where it's deployed, and all that. So the audits are easier. And similarly, the swapping out of JDK vendors was one pain point for us. Now it's just a container swap out, and you're done. I guess the other problem that we kind of overlook in Jenkins is my namespace is my workflows. So once what happened is somebody accidentally deleted my container, and my whole workflow stopped in stem functions, like in the AWS console. But in this Argo world, your workspace have your own workflows, so nobody is going to mess with that area. And then you don't end up stepping on each other's foot. So the workflows are not, I mean, as you can see, it's very generic. It can be used for anything beyond a Java release pipeline. You can have a serverless CI CD pipeline, if you have an S3 bucket, and also ETL pipelines, if you may. So to conclude, most of our gains game from GitOpsification and using KITS to its fullest. Usually, I thought, OK, Argo is going to make us faster, but what ended up happening is the ease of use and workflow as code was super powerful for us. DAGs are a beauty. I mean, so many things I can go on and on about DAGs, because it's so painful when you don't have a visual view of what you write. And finally, I mean, cost and rightsizing is something it's easy to get your manager's approval for if you're using this, because, oh, it's safe cost. Go ahead, do it. Developer delight, I guess, that's in it for us. I mean, the whole process has been so smooth and enjoyable. The community is obviously great. They have so many examples.  But then the ease of use of Argo workflow is what's something which is very good for me as a developer. I guess that's probably your experiences also going to be. So that's it for this talk. If you have any questions, I'll take them. But my call to action is try Argo workflows beyond whatever CSAD pipelines or anything, get creative, and share it with the community. Thank you. All right, I'll take any questions if you have. And please come to the mic so that the live audience can also hear that. Hi. In your maven step, did you do any sort of optimizations to make that any faster? Oh, yeah. So the maven steps, we have the concept of threading. That's something where a Jenkins jobs wouldn't do it because you couldn't justify the CPU allocations there. We could multithread some of the maven jobs by just increasing the threads there. That's probably it. And then the value, I think, our main problem, the slowness, the build itself for fast, it was just not. It's just the whole end to end supply chain which was kind of slow because of not having a descriptive way of looking at things. But yeah, I think the multithreading helped there. If there are no more questions, I guess we could end this. I mean, we are there at the booth. Feel free to come and ask us more about this. And also, there's always Twitter. Please tag us, and then we'll be happy to answer any questions. Thank you.


Hello everyone, this is Ahmed Dan, just arrived at the Caves Beach Resort last night, located in Egypt's Red Sea Resort Town, Urgada. And I'm going to give you a tour of my room and the main lobby area. So you're going to see scenes from both day and night. So Caves Beach Resort is an all-inclusive resort, what it means that you know you can drink and eat for free. The full hotel interior and exterior are designed based on unique stone rock mountain style. It gives a feeling of living in caves and mountains with modern amenities wherever you look. The outside pools, trees, and all areas are designed in cave mountain themes and look beautiful and distinctive. My rooms are the all most likely all the other rooms are made of woods and rocks including the beds. It was night and I had to check a few direction signs to get to my room. It was pitch black dark outside. Beyond the resort boundaries. But I still feel the presence of the sea out there in the darkness. That was a very good feeling. The moment I entered my room, I felt like I entered modern day caves with furniture made of wood and rock with mountain themes and modern amenities like AC, freeze, TV shower, and so on. Even the ceilings, walls, and floors looked like unique and cool. I felt like I was living in the Stone Age. I had a private balcony overlooking one of the pools, gardens, and other units. Even the balcony walls looked like they were made of rock. It was a nice view and I decided to spend more time there tomorrow during the day. I would head out to the dinner after a shower and I'll show you more from this resort in my next videos. Thank you for watching this video. There will be more videos coming up. So I'll see you shortly. Thank you.


Hello and welcome to this session in which we will discuss business process management BPM which is a management methodology that involves the design Implementation execution and monitoring of business processes. Simply put BPM orchestrate the function of a business from the design the implementation to execution to monitoring What is the purpose of it? Why do we have this? Well, we want to improve efficiency and what is efficiency? Efficiency is a streamlining the process to reduce waste to reduce cost Decrease cycle time. How long it takes us to perform a certain task to produce a product to produce a service to deliver a service eliminate any unnecessary or costly activities and as a result deliver faster Faster product or service. Also another another goal of this is increase agility Now, what is agility? What is that word? Well, simply put improving the ability to respond quickly to changes in the market So if the change if the market changes if customers have a new need We have to meet that need if the if the customer Taste changes we have to change quickly Whether those customers are internal or external then how do we do that? How do we do that again reducing not again, but reducing bureaucracy Empowering employees employees are on the front line Let them do make the decision Implementing processes that are flexible and adaptable that they can change so we can Respond to changes in the market quickly and the third Goal of this business process management is to enhance customer satisfaction And that's the most important and the reason is simple because this is where we generate revenues Basically improving the customer experience by providing high quality product and services And responding quickly to customers inquiries or concern and most importantly Anticipating that's the most important thing. You want to anticipate customers request customer Demand and meet that demand before your competitors before we proceed any further I have a public announcement about my company farhat lectures.com Farhat accounting lectures is a supplemental educational tool That's going to help you with your CPA exam preparation as well as your accounting courses My CPA material is aligned with your CPA review course such as Becker, Roger, Wiley, Gleam, Miles My accounting courses are aligned with your accounting courses broken down by chapter and topics My resources consist of lectures multiple choice questions through false questions as well as exercises Go ahead start your free trial today. No obligation. No credit card required Now in BPM we have activities in the business process management and I'm going to list the following activities Which are process discovery process analysis process design process modeling process implementation process monitoring and process optimization now in your textbook and your CPA review course They might have five or four or six. I believe those steps are a little bit more comprehensive Which is fine. The key is to understand the big picture If you know anything about farhat once I have a series of steps I'm going to go through each step separately explain it and give an example So you understand what does it mean in the context of the big picture starting with process discovery and the wording of each step in these process or each activity is It describes itself. What is discovery learning the activity involved identifying and documenting the current business processes It includes activities such as process mapping mapping the process process mining looking for stuff And it could include process analysis, but this will be I'm going to cover this in a separate step process analysis So this step, which is the first step provide a foundation for understanding. Remember in this process we are learning How work is currently being performed and maybe We could figure out some inefficiencies or bottleneck bottleneck means Issues that that's not allowing us to be Functioning at an optimize in an optimized fashion So process discovery is important because it's going to provide a baseline for process improvement initiative because once we know What we are then we can move forward and some examples in this step will be interviewing employees to understand their current workflow Mapping out the steps of a current process on a whiteboard or on a software Or or mapping the whole process to understand the big picture In this step, we might analyze data from existing system to understand how the process is currently executed So think of this as a learning Learning step once we learn we might want to process this information a little bit further This involves analyzing now after we learn we kind of know what's going on We have the picture now we analyze the current business processes to now to identify a little bit more What's going on in the efficient inefficiencies bottlenecks and area for improvement now? We're analyzing this process now. We could have what's called root cause Analysis, which is a systematic method for identifying and underlying causes of problem within a process now after we learn Now what we do is we do what we? Underline we underlining and identifying the causes now. We are looking for the exact cause. What's happening here root cause analysis This can help us identify the reason why the process is inefficient and ineffective We learn about it now. We need to do to do more now here We measure the cycle time or the lead time of a process to identify bottlenecks a little bit more specific Conducting the root cause to understand the underlying causes Surveying employees to understand the main points now. We're not asking them How the process work? We're trying to figure out more information from it The third step is process design here what we're doing. We're gonna create now We learn about the process. We did some analysis now We're gonna create try to create a new system this involved the creation of a new And the key improved process based on the result of the process analysis This would include defining the new process process identifying the roles and responsibilities of those involved And mapping out the flow of activities required to complete the process now We're kind of designing the new process this this involved designing creating a new process flow diagram That reduce the number of steps maybe sometime you might increase the steps But usually you want to be more efficient you want to reduce the step to complete a to The steps required to complete a task redefining the roles and responsibilities Some people may not be happy about this And or some people could be very happy and designing a new process that automate a manual task to improve efficiencies now we we're designing we're basically Drawing the new map for the business process now once we do that We're gonna model it this involved creating a visual representation of the new process Which can be used what for because we want to communicate this process when we're when we're working with the business process We want to communicate this process Maybe to hire management executives Stakeholders and to identify potential issues because sometimes once you put something on a paper you might see problems in it here to improve So you you you do process modeling to improve your understanding provide the visual representation Can help stakeholders understand the flow of activities Decision points and handoffs point between different roles and department This is also help with communication Why because you want to communicate this to stakeholders the stakeholders could be employees themselves using the system Could be customers could be vendors could be high High-level executives It could also be used this process modeling to train new employees on how to execute the process So specifically the step will involve creating flow charts to visualize the steps Using what's called business process modeling a notation will have a quick recording about this concept BPMN Tool to create a visual representation of the process develops a simulation of a process Basically pilot piloting the process to understand the impact of changes on process performance then we're gonna Implement process implementation this involved in deploying the new process or making any necessary changes Sometimes we have a new process sometimes we're going to take the existing one and tweak it a little bit The goal of this step, which is process implementation is to make sure the new step is executed as intended because okay You studied the old process you analyze it you design a new process You design it You put it on a map You you model it now you want to implement it to see if it's working as expected Expected outcome are achieved here. You'll do what's called pilot testing in this step The new the new step should be piloted and Preferably in a control environment if that's if that's if that's feasible control means not life environment To ensure that it operates as intended sometime you have to do it in a life environment This involved a small scale test with a limited number of employees Or a more extensive test with a larger group the best example of pilot testing now that's going on is google Google is launching this artificial intelligence, which is called barred in response to microsoft And what they're doing they're allowing the employees Limit all the employees at google to test this artificial intelligence versus open ai. That's basically partially owned by by a by microsoft updating an existing system to support the The new process flow chart. This is when you Implementation steps or rolling a new software tool to automate a process This is again part of the implementation or developing a new training material to teach employees how to execute the new process So those are actual examples of process implementation Then we have to do what we call process monitoring to see if everything's working as expected Tracking the performance of the new process to ensure its meeting What we designed it to do the desired goals and objective here We can track key performance indicators kpi's which we'll talk about those slaters For example, if we are looking at the cycle time or error rate to understand the process Analyze feedback from customers or employee what for to identify areas of improvement Conducting periodic processes on it to ensure that the process is being followed correctly This is part of the monitoring reporting on it report should be generated on a regular basis to communicate the performance To stakeholders. However, those stakeholders are they might include dashboards chart other visualization that provide the clear picture Of what's happening in that new process of the performance process And at the end we want to kind of go back and optimize make it even better This involves continuous improvement over time to increase efficiency reduce costs and improve overall performance and as a result Improve customer satisfaction. That's the whole purpose of business process. This will be conducting continuous process management like kaizen or lean events to eliminate waste and improvement and improve efficiencies We'll talk about those later on those are management techniques collect and analyzing data to identify pattern And the trend that could lead to process improvement again You want to keep on improving here process optimization means making it better and better and better Developing and executing a plan that implement a major process change that will deliver significant benefit again do more Now bear in mind We could do process management in a totally different way So another business management and business process management methodology Is something called pdca which is plan do check and act very similar It has four stages It's a framework that is widely used in the business process management and quality management And it has four stages plan do act and check once again We have four steps and what the far had doing each step We're going to go through each step separately given an example starting with the plan stage the plan stage as it's You know the step it's planned We in this stage the problem or opportunities for improvement is identified You're looking for it and plan is developed to address it This should include clear objective. What are we doing a timeline and list of resources needed to complete this objective? So identify the problem Maybe the cycle time for processing customers order is too long. That's the problem objective Reduce the cycle time by 50 percent in the next three months the timeline Well an example of it implement the new process within four weeks and measure performance in the next eight weeks Resources that we need we need two full-time employees to work on the project And provide funding for the new software. This is the planning stage For once we plan we're going to do the do stage in this stage The plan is executed according to the established timeline in step one and with necessary resources This process is closely monitored to ensure that it's being followed correctly to identify and analyze any issues that arise Here the two new employees they work together to redesign the process and implement the new process flow Training is provided here to employees involved in the process to ensure they understand how they execute the process Now we're going to check we plan. We do we check in this stage The result of the executed plan and the prior step are evaluated against What would we plan? What did we plan to do now here data is collected? Analyzed and compared to the original plan to determine whether the project was successful This is what we're checking or not because this is the checking stage Here we could be review on kpi's. We'll talk about kpi's later Basically ratios or steps whatever we whatever we plan to do to determine whether the performance has improved degraded or remain constant Examples Performance is measured daily during the first two weeks of the new process and then weekly for the remaining six weeks Those are you know specific steps in check stage Data is collected on the cycle time error rate and customer satisfaction Analysis reveals that cycle time has reduced by has been reduced by 35. That's great But the error rate has increased slightly. So So now the check stage we wanted to reduce the time Yes, that happened but the error rate went up. So this is what we do We're checking to see whether what whether what we plan to do and did is actually working as Expected so analysis reveals not as we thought it will happen Then after we check we act again based on the result of the check stage We take Taking to adjust the process to improve it if the results met or exceeds the expectation of the original objective Well, then we standardize the process and we'll roll it out across the whole organization If the process did not meet the objectives Means it was not as good. The process has modified and the cycle is repeated. Basically, we'll go back to the drawing Map and we do what start again plan do Check and act again. This is how it works Based on the analysis the employee modified the new process to address the causes of the increase Error and an error rate because we find this as a problem. We need to do something Training materials are updated to reflect the changes of the process Performance is monitored for another eight weeks to ensure that the modification has the desired effect And here the problem is it seems as we reduce the Speed reduce the of the of the order. We are making more mistakes. So we're saying let let's do something to reduce The errors what should you do now go to far hat lectures? That's the way to do it is to look at multiple choice questions. That's going to help you Understand this concept better and as a result you will be able to do better on your CPA exam In your courses or any professional certification accounting Is a lucrative is a prestigious career take it seriously invest in yourself. Good luck and stay safe


Great. Hi, my name is Shawn Michael Kerner and you guys are in the open stack security session So you picked the right session because there is no more important session Than this one because if anybody tells you that they're not interested in security They might be misleading you because everybody is I'm an editor at e-week and internet news But you're not here to listen to me. You're here to listen to this panel We've got a panel of experts on open-stack security from multiple aspects from the internal project VMT project from Barbican and then people that just work on open-stack security at the largest public open-stack cloud vendor So it's a good mix because when we think about security security means a couple different things, right? There's the open-stack security project There's the VMT the vulnerability management team. There are open-stack security Projects which are things like Barbican and we have people from Barbican the Barbican project here the Ptl And then there's how we actually implement things. So all those things mean security and everything in between So just to introduce the panel and we'll just go on the line and everyone will introduce themselves Awesome. So my name is Douglas Mendes-Aval. I've been working on Barbican for about four years Formerly at Rackspace currently in between jobs And I was Barbican Ptl for a while not any longer also I've been working with the security team Sort of for fun on my off-time So I know a bunch of those guys My name is Jeremy a Lot of the community technical community probably knows me as Fungi I'm a longtime member of the community vulnerability management team since 2012 or somewhere like that and Hold a lot of other roles in the community technical committee Ptl of the infra team Foundation staff member, etc My name is Dave McCowan and I work for Cisco in our cloud solutions business unit my focus there is securing our NF BI which is the foundation for our NFV solutions and Upstream, I'm the current Ptl of Barbican taking over from from Doug working on on key management. I'm surrounded So I'm major Hayden I work at Rackspace on our private cloud product So I focus on just security among other things in general a lot of around upgrading and maintaining And lately the biggest project for me has been the open stack ansible security project which Applied stick hardening standards to any host that you have open stack or not Great, and I'm hoping that this session will be as interactive as it can be because security is not a spectator sport So feel free to to us take up one of the mics if you ever have questions. I've got a few Leading questions, but you've got experts up here. So if you have questions by all mean and to those of you They're watching in in the future in the recording. Sorry, you'll have to email us afterwards And just to go right to left And talk to you Doug first and then everyone can answer in line if you want to jump in What do you guys think is working well across open stack security today? And that's a big question because there could be the various pieces that you're working on whether it's the Barbican project other projects VMT or in general Wow, okay So one of the things that I think has been really cool in the last few cycles is the adoption of Bandit So then it's one of those security teams tools that does static code analysis and I think the community has been very receptive about adding new gates to have bandit test their code pieces Bandit for those of you that don't know One of the most amazing projects in my opinion with static analysis that fits in Garrett So that when people contribute code all the code is actually scanned for vulnerabilities if I understand it correctly Which is amazing because when you think about the vast majority of all projects in GitHub people post it Then people consume it and you have no idea whatsoever. It's if I've been audited for any kind of security But as Doug was saying a lot of open-stack projects are now running through a bandit And that's a huge difference between open-stack and just about any other infrastructure project. I'm aware of So I guess it's hard to follow that one up. That's awesome Bandit is really cool probably I know as far as things that that I touch on a regular basis from the vulnerability management perspective The recent Assistance that the the broader security team in open-stack has has given us and the community in putting together a plan for security analysis standards so that I Don't know how how many of you are familiar with VMT policy internals, but we basically have a relatively restricted set of projects that we feel comfortable taking responsibility for triaging vulnerability reports on and and providing advisories and We we need some additional level of vetting of new projects that come to us and want our assistance in an ongoing basis with these things mainly so we can Make sure that they're in a good enough shape security wise that they're not going to eat up a lot of our time and that that security analysis process that The security team has started to pioneer is providing a really good outlet for these newer projects who are looking for our help to be able to know the sorts of things they should look at in their software and come up with detailed documentation of The the security relevant Areas within their deployment configuration and so on so that then we have something we can go back to later To quickly assess impact if we get a vulnerability report that might relate to one of those areas So what I think is is awesome about open-stack is the the documentation. That's available when you're deploying a Cloud you need to secure every layer if you're going to be successful. So securing The hardware the hypervisor operating system The software running in and out of VMs For any layer and for any project. There's really good documentation and tools And best practice is available to tell you how to configure it properly to harden Your your cloud in general and each component specifically and there's a lot of warnings What happens if you don't do it correctly so the available documentation is great I think for me it's just been actually starting to have conversations around security So I'll say you know I work on a deployment project primarily open-stack ansible and it's been really nice recently because the The keystone team for example has added some scripts into their repo that'll do sanity checks on how you've configured keystone So if you've made really terrible life choices about how you configured keystone or you forgot to change the ownership of a configuration file or something Keystone has a little script that you can run that'll dump out all that data And so what we were actually able to do is implement that in our gate jobs So if anybody ever screwed up, you know a configuration The gate job would fail and we'd go in find out what's going on fix it so that it wouldn't go into production that way That's great. And by all means if anyone wants to ask questions. Otherwise, I've got a long list But it is great that we are talking about security the first Open-stack security session I went to was at the Portland Summit and that was just before there even was a security guide It's hard to believe that there wasn't even a guide in the beginning, but now it's an integrated part of the project Just just to go a little bit further aside I think there's sometimes people in my line of work not necessarily me But people that misunderstand Open-stack security and vulnerability management, which I know is something that you work on Jeremy But we'll just go from from major back. I guess What do you think is most often misunderstood when you see media reports again? Not me because I'm usually pretty good But everyone else just general misconceptions about cloud security vulnerability management And perhaps even certificate management in the case of Barbican Yeah, so I think There was always kind of that knee-jerk reaction when you do cloud whether it's in your data center or somebody else's data center that you know Oh, I'm losing a little bit of control or you know You know, maybe VMs are close together or there's things happening in my system that I can't reach out and touch You know, for example, if you use other virtualization platforms where you have to Individually do each step. It's a little bit different than using OpenStack where you have some services that will go and take care of things for you For storage or networking and that kind of thing. So I think it's it's getting past that and then also understanding how to deploy You know how to deploy things securely so that there's certainly a way where you can go and say Oh, I'm gonna go deploy 200 VMs and just put them all on the same network and use the same SSH key for all of them That's you're gonna have a bad time But if you use, you know projects appropriately networks appropriately and and segregate the different things that you deploy I think you'll have a good experience So I think a popular misconception is that security can somehow just be configured and that you can set it and then forget it and feel comfortable you have a Secure a cloud environment. I think any ongoing security is gonna take ongoing Monitoring ongoing care and feeding most importantly keeping up-to-date on all the software packages for me, I think It seems like probably the the biggest issue is I'm gonna say it's it's related to a lack of real education and Engagement that we have as a as a technical community broader technical community even outside of OpenStack with the general public that There's this perception that security is a binary state either things are secure or they're vulnerable and really security is a broad gradient and Things are always at some point on that gradient And and frequently people perceive them to be in a different place on the gradient that they are But you know the the idea that when there's a vulnerability announced Details are frequently alighted or just completely wrong and the the readers Consumers of of these reports don't really understand the the risk The impact of the vulnerabilities are being announced And that leads them to Panic fear You know those the sorts of things that you can imagine when when faced with the unknown Okay, and I would say probably I Don't know if I've heard it a lot recently, but certainly a few years ago A lot of people looking into the cloud to go deploy our applications Sort of have this impression of you can't secure things in the cloud because you don't own the infrastructure Which I think that's changed. I think we have a lot of good tools now that I'll enable you to secure your workloads on the cloud stuff like the open stack ansible security is a great set of ansible things to help you harden your systems on the cloud so Great and then talking about Ansible because when I think ansible I think you know play books and security configurations and the like Just just to play Davos advocate open stack then by default if I understand you Dave is not secure So if I download upstream plain vanilla open stack Deploy it on my bare metal just because As at day zero minute one am I vulnerable at that point? Or do I need to make some changes whether it's installing a certain barbican? Requirements doing some ansible configuration making sure I followed the VMT advisories or whatever to make sure that I'm secure at minute one Just go from you Dave if you want or whichever way whoever wants to jump in by all means. Yeah, I'll start so You want to start before you install it? You want to make sure you design it? So open stack has has internal interfaces where we talked to the database we talked to the message broker We talked the services talk to each other that network you want to be isolated You don't want to have any external users have access to that network Whereas the rest apis where you talked to open stack they are going to be open by nest by necessarily to untrusted sources So those you want to make sure you secure with with TLS so accessing those only with HTTPS and install them with valid certificates So starts with it with a good design and treating each endpoint differently. I Think that's where the deployment projects help as well. So I mean there's like open stack ansible. There's cola There's chef there. I mean you name it There's quite a few different ways to deploy it But one of the nice things you're going to find in there is that generally the deployers will steer you in a guide of deploying in a Little bit more secure way. I'll say for example with open stack ansible we We actually go and make a lot of decisions like for example use TLS by the fault and then you know Nova doesn't use the same username password to talk to my SQL that neutron does So that way if one part of your environment becomes compromised It doesn't mean that they can take over the entire environment So sometimes it is nice. I mean My employer we we certainly do have a very opinionated set of defaults when it comes to security So sometimes if you're not entirely sure which way you should go look to one of those deployment projects and look at what their Defaults are and it's usually a good starting point And this is an answer that a lot of people generally hate but It's not really a cynical as it sounds All systems are always vulnerable. So so I mean to directly answer your question Yes, when you just play to play open stack or any software you are vulnerable And there's actually a lot you can do about it, but you can never completely solve it like I was saying security is not a binary state one of the probably the most significant challenge with system security is that you are always trying to balance security with convenience and For every new security control you ratchet on you make the system a little less flexible so without an actual risk analysis and an understanding of Your particular risk profile for your use case. There's no one way to secure a system And so for open stack or for any software the the developers can't really I mean They can make some good guesses as to what a good default deployment security Stance should be but but there's no one answer It's really gonna come down to you having to be educated and informed about the software that you're using and have a good understanding of how its risks affect you and I think to well from the keynote this morning From one of the things that Edward Snowden said when when he said was you have to eliminate a whole class of bugs Like you have to find a way to implement security so that you know Okay, if if maybe there's a black box type of your infrastructure or a part of the infrastructure that you don't understand or it's very complex Find a way to keep people out of it or find a way to isolate that from the rest of the environment So that even if like let's say someone broke in and and did something to neutron Well, they should be confined within that area and not have a way to get out and spread somewhere else in the environment So if you're not entirely sure what's secure and what's not isolated Yeah, the Snowden connection is really quite interesting for those that may not know and for the recorded audience At that same Portland summit. There was a guy Nathaniel Hawthorne, I believe From the NSA who spoke about how the NSA was deploying open stack. This was six eight months. I guess Nathaniel Bert thank you. Thank you. I first name right last name wrong 50 50, you know, it's not bad good odds So the NSA is a open stack contributor and user So which is kind of interesting whether or not Mr. Snowden was able to get documents out of a cinder or Swift store I cannot say but it's kind of ironic No pun intended on the word ironic for him to advocate for silos when the lack of a silo in an improperly configured perhaps I don't know open stack configuration allowed him to Reveal interesting secrets but from that perspective and it didn't really want to get necessary to threat attack vectors and that kind of thing but Usually in my line of work people talk about, you know, the malicious outsider Thanks to mr. Snowden people think about the insider malicious whistleblower or otherwise When people are thinking about security, whether it's a barbecue and VMT Ansible open stack just open stack in general. How do you do you take the? Zero trust lease privilege model. Is that the right way to to define things to prevent that malicious insider? Yeah, I would say yes That's one of the things that we were thinking about Iraq space with our barbecue and deployment is How can we configure this so that no one person can? Bring it down or the story or data right like yeah, we trust everybody in our team But who's to say, you know Johnny Whatever it's gonna get real upset about something tomorrow and try to take our whole system down So I think it's definitely something that you should keep in mind and plan for Yeah from a vulnerability management process perspective To take this from a different angle. We also Apply the principle of lease privilege in in our workflow So, you know General vulnerability report intake we we instruct people educate people to provide those Reports to us in private so that only the three people currently seated on the vulnerability management team know Along with the reporter presumably The details of the vulnerability that they've discovered we attempt to confirm whether they're reporting it against the correct project and Once we've done that then we let a select subset of core reviewers for that particular project in on the report So that they can comment on it vet whether or not this is a legitimate vulnerability You know and there's this progressive disclosure model where we we continue to try to limit the the information flow for for embargoed bug reports like that just to the people who are working on at least getting some sort of minimal fix Developed so they can can stem the bleeding when we eventually go public with that particular vulnerability And then at that point, you know, it can it can be further short up and improved, but at least once it's in the public eye There's also a fix handy We we also do a bit of advanced disclosure to a select set of vetted downstream consumers some major public cloud providers a lot of distribution packages so that they can incorporate those fixes into their software in preparation for that announcement the typical Coordinated disclosure model really Yeah, and and you absolutely want to think about defense in depth as you Set up your cloud assume that one of those layers of defense is gonna fail and the next one's gonna minimize the impact that that vulnerability exploit That the damage that can happen and then you want to augment your defensive measures with Comprehensive audit logs and paying attention to them so you if a breach does happen You can identify it and plug it and stop it as soon as possible And I think the zero trust is critical for other reasons like obviously you can have a malicious insider But you can have an unintentional malicious insider So for example, you have five people on a team and they're great people and they love their job But one of them, you know took their computer somewhere and plugged a random USB stick into it And now all of a sudden there's data being siphoned out and they don't even know it So you got like I affectionately called an unintentional insider attack that kind of thing So you always have to find a way and I think the audit logs help with that as well But find a way to just you know have the least amount of access possible And then when there is access just audit it audit every single action Yeah, in my line of work at least half the breaches that I report on It's usually a privilege escalation that was chained to something else and that's just the way it is So if you're not monitoring those privileged administrative accounts, that's not good never never run open stack as root I would assume But that's probably not a good idea in Linux in general pseudo not aside, but we won't get into a pseudo SU conversation We've got a good 18 minutes left if anyone has any questions for the audience feel free to we've got two mics in the corner Otherwise, we'll we'll jump into lightning round and I've got a few interesting questions because when I When I think of a certificate security specifically Barbara can and that kind of thing couple years ago It wasn't considered part of Def core and when I asked people the vast majority weren't running certificates What's happened in Barbican recently and just for the Barbican guy specifically? What's happened to Barbican recently to make it easier such that everyone is actually deploying it as they probably should Yeah, one thing that's improved over the last few cycles is services other open stack services adopting it and and building in support with Barbican so Octavia or neutron load balancer as a service can You know pull the certificates that it needs when it creates a load balancer You know out of Barbican and that there's no user interaction required once it's configured Octavia pulls it right from Barbican and Nova and Cinder and Glance can all have extra security features So that integration that takes place directly service to service. I think Helps with adoption as once it's configured it You get that that support Yeah, I think maybe one of the the problems we've had with Barbican adoption is that people are maybe not thinking about the key Management problem yet or are not ready to to solve it I think adding Barbican to as a core required service would make great strides into getting bigger adoption of the service We're starting to make progress that way As of this cycle the Oslo team is going to adopt the castelon library Which you can think of as Oslo dot key manager and so moving forward any open-sec project that has key management Requirements it's going to be able to use castelon and be confident that Something that works with castelon is going to be available in their cloud Is castelon a sub project at Barbican? is Castelon yes, it's a it's been owned by the Barbican team And and it really you can think of it as also dot DB right like also dot DB doesn't tell you what database to use Other than it has to be sequel compliant Same thing with castelon. It's Like an Oslo dot key manager that lets you use a key manager with a certain feature set But doesn't mandate that it has to be Barbican Fair enough, and then the only other question on the Barbican related stuff is sometimes when I talk to people there's confusion between Keystone and identity management and certificate management in Barbican is am I the only one that hears that? I don't know if anyone else hears that or do you guys hear it? I hear it every day yeah, so the key stand keystone is the identity manager and That's where you you have your user ID. You have your roles. You have your domain That tells open stack who you are what Barbican provides is a secret storage for that user and The way it works is if I want to get access to my secrets I'll tell keystone. Hey, my name is Dave and here's my password and I get a token from keystone That's keystone's job to give tokens based on identity Then I'll get a Barbican and say please give me my secrets and here's my token and Barbican can check that keystone token and say I see you are Dave and I see that I have some secrets for Dave's and then it can return to me the secrets that I have access to so so Barbican is for secure storage of Very particular objects and keystone is for identity and they they work together One way I like to think about that is Maybe you have a safety deposit box keystone is sort of like the key to your safety deposit box But it's not the contents of your safety deposit box And I know you have a session tomorrow. So a little plug for Dave session on Barbican versus vault I believe yeah that later this afternoon. We have a hands-on workshop for Barbican So if you want to spend some time hands-on with Barbican that that's this afternoon I recommend it. I'll watch it on video and then from a vulnerability management perspective How does the VMT actually work? So if I'll give you a wild card? Let's say Tavis Ormandy decides to tweet something Friday at six o'clock. Do you guys you care? But what happens? Well first off I Probably don't find out about it right away because I don't have a Twitter account but Generally, I mean so you know Reporting things on Twitter is not really our recommended way of passing along vulnerability information It's certainly a way and it will eventually get to us through other people who are paying attention to Twitter specifically But yeah, so someone points out something like that pretty much our first order of business is to turn it into a Actual bug report in the defect tracker that we're using Which currently launchpad for the majority of projects launchpad net And I mean if it's if it's already reported in the open like that Well, we can actually move on it a lot faster because the embargo process that we follow and again I'm for those of you who are familiar with the differences between coordinated disclosure and full disclosure I tend to lean more toward the full disclosure community I think that that reporting these things in the open sooner actually solves things for a lot more people but But we do try to satisfy a lot of different Aspects of the community that would prefer a slower more Coordinated disclosure approach and so the embargo process when we get a Private vulnerability report actually does slow us down quite a bit because we're having to carefully involve just the people who might be able To solve the problem and they may have to involve other people and that whole game of telephone takes time If it happens in the open, it's a bit more of a snowball approach We we just ingest every bit of information we have about it into a bug report We immediately start working in the open on trying to get to the bottom of whatever the cause of that vulnerability is if we can confirm that it's actually vulnerable and You know the developer community generally engages far faster on on those problems So, you know the fixes get pushed right into a public code review in that case reviewed by the normal core viewers merged to the source code repositories Generally in parallel with that. We're already drafting an advisory within it, you know accurate impact description that's been confirmed by the developers and the reporter and we send that out to to every Corner of the internet As soon as we've got fixes pushed up for it and those are almost immediately incorporated into point releases for the various stable branches picked up by Downstream deployers packaged maintainers for distributions and so on and just for coordinated disclosure Is there a standard 90 or 120 a policy or is it a case-by-case? It it's it's actually I don't know flexible is probably the wrong term, but arbitrary it mostly has to do with developer bandwidth It's a lot easier and this this is one of the places where I think that the embargoed and coordinated disclosure process falls down is that it's a lot easier for developers to procrastinate on fixing vulnerabilities if they don't think they're widely known so it Because the vulnerability management team while our responsibility is to coordinate You know the the fixes and the reporting for these bugs We're not you know generally directly involved in developing the fixes. We still need to engage Developers who then find the time to provide? patches that you know those those core review teams are gonna agree on so trying to rally the the troops within those Security fixed developer sub teams within the the different projects can can sometimes be a bit of a challenge and slow the process down And so if you're running a private cloud I think these vulnerabilities closures like a full disclosure vulnerability process wouldn't be so painful because hopefully you've isolated The control plane, you know all the API is in horizon interfaces Hopefully you've isolated that so a very small amount of people in your company would actually be able to reach it So even if they said hey, there's a vulnerability in Nova where you can show up and build a VM without a token Okay, well, yeah, that's that's pretty gross like that would be better be pretty bad But on the same hand if you only have five people that can access that API you can go to them and say look this came out Here's the issue no granting any access to anyone else until this is solved But I would say on the public cloud side as you know working for a vendor that runs a public cloud You know a vulnerability like that that would allow someone to create let's say a Nova VM without having a token Would be a complete disaster so a coordinated release would really help because that could potentially allow us to get a patch put in place or Disable part of the code or change the configuration value Before that goes out to the public and then you have you know kids at home trying to write their own scripts and take down the cloud so the the place where we strike a bit of a compromised balance between the two full disclosure coordinated disclosure positions is that for Embargo private reports where we've developed the the fix in secret We we do follow a fairly aggressive disclosure schedule once we have the fix And and to that is generally that we notify the list of vetted downstream stakeholders like You know majors employer and others With five business days Advanced well three to five business days it depends a little bit on the severity as well Advanced notice and and then we go ahead and we've provided them with a copy of the fix We're going to send and as long as we don't discover within those few days That there are any changes that need to be made then we go forward with the the scheduled date that we've told them We're gonna disclose it on but that at least gives them a few days heads up to try to confirm that the fix isn't going to destroy their systems And hopefully have it ready to be rolled out when the announcement is made But also bear in mind there's more vulnerabilities within a cloud than just within OpenStack So occasionally there may be a vulnerability in Libvert Which is what Nova talks to to get VMs taken care of and that kind of thing or there could be a vulnerability in Galera that runs the database there could be something like that. So You always have to make sure you're watching your OS vendors Release lists. So if you're using red hat or a devian or a bunch or wherever make sure that you're following Their feeds so because there might be something that comes up with Libvert that no one in the OpenStack community may be talking about at the time And it may not come through proper OpenStack channels. So that's just something to keep in mind We we also not so much from the VMT but the the security team in general bridges that gap a little bit with their security notes process for some of the more esoteric related vulnerabilities like majors talking about where there may be a Vulnerability and some commonly used component that a lot of people are likely to have within their OpenStack deployment But that's not OpenStack software. So the vulnerability management team isn't coordinating any sort of fix for it or anything we do sort of cherry-pick but the The security notes editors in situations where they think it's particularly beneficial will draft a security note specifically about That related vulnerability so that hopefully at least if people have missed the report from their Distribution vendor or somewhere else, you know, they might see that security note And it gives them a bit of a heads up that that this is something they should be keeping an eye out for And if you're not running SE Linux in enforcing mode, please turn it on Thanks and or app armor, right if you happen to be an app armor person We have about ten minutes or a little bit less left if anyone has any questions We've got mics on both sides questions about how The security project VMT Barbara can security in general works And We can do that no questions, which means everybody is running securely, which is great. Oh, we've got a question. Thank you, sir had a quick question about Some of the operating system agents that are available are actually only know just a few like Marshall for grabbing the key And then using it to enable like file system encryption Is there any other tools or plans for you know updating those to be able to do file level? Or application level instead of just the whole operating system level As far as as far as open stack is concerned So some open stack projects are already looking to integrate with Barbican to provide application level encryption And so Swift is one of those projects that it's working on on having an encrypted Swift storage In which they use those encryption key or they use Barbican to store the encryption keys that are being used for that encryption I Believe cinder has also integrated to where you can get It's kind of OS level encryption because they encrypt the entire block thing But the encryption keys that are being used to do that are being stored in Barbican So it's one of the reasons we would like to see higher adoption of Barbican I think it it helps with a lot of these workflows and to being able to provide Encryption at different layers of the stack Also, be sure to fact check me on this because I'm not a hundred percent certain But I think I want to say freezer has some encrypted backup capabilities as well At least worth looking at and they probably should if they don't Any other questions? Yeah, go ahead So the question was some of the projects are are saving passwords in clear text There's there a way to make sure that that doesn't happen so There's something I would like to see there. There's a conversation that needs to happen So I think a lot of open stack projects realize this is a problem. I think Probably also config would be a good place to fix this right One of the things that we've talked about on the Barbican team is you know, could we work something out with the also folks To have Barbican support and also configs so that you wouldn't have to change every single project the projects are all already using also config and and just instead of reading Those configs from a file to be able to reach out to Barbican and grab those One of the challenges there is that because Barbican depends on keystone. You'll still need To get your keystone credentials from somewhere Right and sort of the best practice for that is to use some sort of Configuration management to provide those so that you don't have to write them to disk Yeah, there was a I want to say it was earlier today, and I missed it. There was a forum session on clear-text passwords in There's a hand waving in the background you were there Can you come up to the to the mic and and fill us in a little bit? I'm curious if there were any resolutions out of that So we actually just did a proof of concept nothing I think we're gonna start pushing up specifically starting with Oslo config basically we use custodia to Interact between Barbican and Keystone So it would pull the secrets from Barbican and then just authenticate with Keystone And then you could actually encrypt or not encrypt you would use the Barbican container Reference and the key name instead of the actual password itself in the configuration file Awesome, so that that's certainly one route There have been very recent discussions as of this week also about Mostly using for lock management, but integrating at CD into the you know Set of expected services that we can use and that it's been discussed also that it would be possible for us to store specific Configuration elements within at CD we could use it for things like passwords, so they're not kept on disk on the on the systems Those systems still need access to those passwords in some way though So it's not really buying you a whole lot of additional security if they need a clear-text password The the alternatives that we've discussed Architecturally over the years are finding ways to get rid of password based authentication for these services anyway I mean that ultimately the solution should look more like you know and Not specifically this People would probably shoot me for suggesting it though. I'm a big fan, but you know rolling out Kerberos So the services authenticate via some ticket granting system rather than relying on some fixed secret Yeah, and in the meantime until there is a solution You know make sure your config files that have sensitive information are locked down with SC Linux So only the Nova process can read the Nova config file and that'll help mitigate the concern about the clear-text passwords Policy policy is always the way SC Linux armor etc I think we're out of time right so we're right at 420. So if everyone will thank me thank me Thank the panelists for being here and thank you all for for being here today. Thank you. Thank you strong


Good morning and welcome to the weekly market update with me, David Madden. Today's date is Monday the 12th of August 2019 and the time has just gone at 9.30 for this summer time It's been a reasonably subdued start to the European session Eclipse markets largely opened higher, but we have seen a bit of a turnaround in the last 15 or 20 minutes some of the major stories from from the last aid 12 or 12 or so hours The people's Bank of China the Chinese Central Bank Devalued the the one yet again, but the fixed it at seven spot zero to one one versus the US dollar But actually even though they devalued it They didn't they didn't devalue it as much as the market expected So we didn't see a bit of a push higher in Chinese stocks overnight The Asian session was fairly quiet as the likes of Japan Singapore and India those markets were all closed because of holidays So we got off to a recently positive start in Europe, but things have turned Turned over a little It's the same old story in relation to trade tensions is still hanging over Global equity markets on the back at the last week on Friday President Trump said in relation He won't be doing any business with Hawaii the Chinese tech giant That's obviously kind of sourd relationships between the two sides Over the weekend overnight Government sacks have lowered their fourth quarter US GDP for Forecasts from two percent down to 1.8 percent And they're not and there and there is now stating they do not believe There will be a trade deal between the US and China before the US presidential election in 2020 Also, there is there is going to continue political uncertainty in Italy at the back in the last week It looks like we've an update to mainly at the back in the last week It looks like we could be heading for a general election in Italy And that political stability is also going to factor in the in markets European markets pushing lower this morning So what I do now is take a look at the week ahead article discuss some of the major topics That's that that's the front of us for the next few days. And then I look at some of the major major markets So if you go to our website see if some markets calm under insights under news analysis You'll find where you find this article and this is for the bulk of Of our analyst updates get posted to so take a look what we expect in the next few days tomorrow and tuesday we have UK wages and unemployment figures on wednesday We have UK CPI figures The two of these should be kind of will be will be quite important Total unemployment rate in the UK is very very low and wages are actually going at a fairly decent rate and you can see here wage rate extending bonuses is Most recently 3.6 percent and the inflation rate in the UK is pretty much bang in line with the bank bank of England's target of 2 percent so workers are getting a decent rate rate of A decent real wage But the question is will they actually be going out and spending it because there has been some evidence Their consumer confidence is in decline because people holding off on account of brexit Looking ahead to wednesday. We have Retail sales and industrial production figures from china. This would be a quality watch because China's obviously cooling And any kind of science that the depth of chinese economy is slowing down at a faster rate could kind of Speed up the kind of jitters that traders already have in relation to the state of the global economy On wednesday, we first have figures from balfour bt These figures should be interesting because balfour bt a number of years ago the construction company went on Underwent a major restructuring program And the manage you actually could have survived Which was very impressive in relation to because there was talk of that company being in major trouble As you as you could recall carillion Went under that that was There are parallels drawn between the between the two carillion didn't didn't survive balfour bt had a brutal Restructuring program if they managed to turn it around so those figures will be interesting On wednesday, we have first half figures from prudential We have fourth quarter numbers from sisco systems on thursday We have uk retail sales and this is what we're talking about in relation to unemployment rate in the uk The earnings rate and also the inflation rate. So um, there's a lot of evidence that in that Uh, citizen dk are in jobs in the early decent wage But are they going out and she's spending money and that's going to be the crucial bit Um on thursday, we also have second quarter figures from walmart second quarter figures from invidia And on friday, uh, we have third quarter figures from deer and co given um, given that That the long ago and the the beijing authority is instructed to state owned organizations in china to halt agriculture imports from the u.s. They the forecast Um that deer give will be very very interesting. That's what traders are going to be keeping on for Take a look now at some of the major markets starting off the footsie 100 so as you can see here, um The footsie 100 had a fairly sharp sell-off at the back end of july the market has rebounded And a sizable chunk of the ground that was lost in relation to the latest round the trade tensions has been recouped And we're comfortably above the 200 a red moving average this red line here And that comes into play at 71 91 and essentially why we hold above that metric is it's likely that we could see The end of the wider market push to the upside Provider we hold above this metric and should that be the case We could be looking at targeting this area here around 7400 we can see that The water to move the average this the error line and this blue line here the fit the moving average The both have acted as support not too long ago and if metrics have acted as support in the past It's like it's possible That's might become resistance in the future and these two metrics almost kind of you know not too far, you know almost kind of flank, uh, this this the kind of 7400 kind of a psychologically psychology port number So if you do press up higher from here, we could be looking at targeting this area and if you do manage you can have a Size removed north of the fifth any moving average this blue line here and that comes into play at 74 38 If you have a size move above that, we could be looking at going to get carry on the wider trend heading up towards perhaps 7600 If the market though does manage to turn over itself yet again and fall back south of this red line here The turn they move the average we could be looking at retesting This region down here in around 7000 to 90 down to 7000 40 So this zone here could be looking at retested and of course if you go below that The psychology port and 7000 mark could be coming to play I'll take a look now. What's going on over in germany and the tax similar scenario I had a major sell-off a major sell-off last week towards the back in the last week And then at the market to recoup some of the ground But we're just about holding above the 30 movie average this red line here and that comes to play at 11 654 what we hold above that line is that it's likely that we could continue to continue to rebound Um, and if you do press on higher from here, we could be looking at targeting the psychology port 12,000 mark or perhaps even this yellow line here the 130 movie average and that comes into play at 12 104 we can see on a few occasions that metric acted as both Actors as a support in the past and it's that makes it more likely that it could be More likely that it could be significant in the future If the market those managed to turn over on itself and continuing to get over the more recent downward trend We could be looking any back down towards 11,400 or perhaps even this level here in around 11,200 and 70 Over in the u.s. Um, I'm taking a look at the dow Jones The u.s. Markets are clearly in better shape notice how the sell-offs that the at the u.s. Markets had Um, we're not not nearly as severe as those in europe also sort pointing out the u.s. Markets were coming when they were selling off Recently they're coming from all-time highs rather than say multi multi so the u.s. Markets are far better shape We can see here that the market As we reclaimed a sizable chunk of the ground that was lost some of the region of around say 50% of the ground that was lost recently We're comfortably above the two-day moving average on the dow Jones and you know While we kind of hold above that metric and hold above the kind of 26,000 mark a big psychological number While we hold above those metrics, it's likely that we could press on higher and keep them up the next year to potentially keep an eye For uh, which could be potentially important at this blue line here at the 50 moving average and that comes into play at 26,616 On a few occasions that acted as both support and and resistance so it's likely It's more likely that that that metric could be important in the future and if you have a If you have a size of break above that you could really be heading up towards 27,000 Once again the market does matter to turn lower and it does drop below 26,000 we could be heading back down towards this red line here the 30 moving average and that comes to play 25,595 I'll take a look at what's going on on the s&p 500 similar scenario the s&p with the dow Jones in that It's at a very sizable rebound. It's well above It's 200 day moving average here is well above that While we hold above that it's likely we could see the market press on higher from here If you do that, let's just kind of press on higher from these levels. We're currently at 2,912 if you press on higher from here, we could be looking at retesting this this blue line here the fifth of the moving average 2,944 A movie on that could take us up to 2,950 and if you get above that level and we get tough to be above The fifth of the moving average is it's likely that the kind of wider upward trend of within 19 Is going to continue and we could be looking at heading back towards the 3,000 mark If the market though does manage to turn over on itself Asserts it starts to drive lower. We could be looking at any back down to heading back down towards this area down here um The lows of thursday last week in around 2,871 this region here or perhaps even down and a break below that could take us back down towards this red line here The dirty moving average at just south of 2,800 2,796 Take a look at gold So gold has been one of the kind of major benefactors of the sell-off global equity markets Um, it's a it's a classic fight the quality play Combined with the fact that the u.s. Dollar has been fairly soft all the chatter and the talk that The u.s. Economy is going to get it's going to be with the global economy and in terms of the u.s. Economy It's going to slow down because of the trade tensions and whatnot That's a great chatter about the Fed reserve go to cut rates out of september and or december Uh, and that's another reason why the um the cold market has done well Last last week racked up fresh six-year highs. So we're in formally an upward trend Um, if you get a press on higher from here, we're currently just south of 11 of 1500 If you press on higher from here, we could be looking at our retesting this year over here in at 50 55 If we do see any kind of move to the downside We might see some fresh buyers end of the fold Seeing as buying of the dip has been a very popular strategy in the last couple of months So if we do drift lower from here support could be found from this area here in around 1472 or from this wider zone here 15 sorry apologies 14 53 down to 14 30 this entire zone here might might see um might see an area of support Uh, and if even if you drift below that uh support could be found from the kind of big psychological number at 1400 Take a look now. What's going on on the oil market? Oil has taken a bit of a hammering as well in you know In the kind of working if you know In the what it finished higher on friday and rallied a bit on thursday But you know the last few weeks has been taking a bit of a hammering Sit tying in with the trade story if the global economy is slowing down Is the perception is that there'd be less demand for oil So take a look here at the old market In the last few weeks been in a fairly clear downward trend to less series of lower lows and lower highs If you do manage if you can hold up of the recent lows in around this area on brand crude at 56 Spot 71 if you could hold up those lows We could be looking at any back towards the kind of psychology porn 60 mark Um, and if you go beyond that you could be looking at retesting this this blue line here the fifth removing average at 63 spot 37 But if the market does manage to continue in the recent downward trend and take out the recent lows in around the kind of 56 area We could be looking at any back down towards this is old here in around 52 But notice how Brand crude is firmly below. It's 50 moving average here the blue line That's also firmly below this red line here, which is this 200 day moving average And because I've been talking about wti west Texas immediate in one second So similar here. First thing we'll talk about moving averages wti Um, we since you know the last few weeks We said a lower low a lower high and another lower low We could even though we have bounced back on wti We could see that it's well below its blue line here the 50 moving average on this red line here It's 200 moving averages and while both markets are below their respective 50 moving averages 50 moving averages and 200 moving averages is likely that we're going to see a continuation Both markets press lower So if we do look to press lower on the wti market We could be looking at retesting this kind of zone down here It just kind of south of 51 dollars down to around kind of um, say Some 51 dollars down to around 50 36 And if we do press below that we could be looking at targeting this area here down at 48 bucks a barrel If though the market does manage to rebound We'd really need to kind of see a move back above the truly moving average Which comes to play at 56 it's about 24 At least the move kind of needs to see a market kind of move back above that and kind of close above that on a daily basis To be more confident at the recent downward trend has come to an end I take a look at another couple of currency pairs First things first euro dollar As I mentioned the public uncertain uncertainty in italy is a Is a factor The wider trend throughout 2019 has been very much of the downside on euro dollar Yes, it's a fairly size of a bounce back between late may and late june But as you can see the market quickly turned over on itself and had a fairly aggressive sell-off Into into early august the market has rebounded But it still is very much in a downward trend and we're pressing lower again today Uh, if the market does continue to drift lower we could be looking any back towards this region here in at one spot 1110 and a fairly size would break below that could could um Send the market even lower and take us back to has taken us back down to take us back towards The psychology port and one spot ted mark any bounces in a in In euro dollar would need to kind of overcome this area here This blue line here the fifth of the moving average would come to the play in around one spot 1237 we could see in a few occasions to try to get above it But I just even though I traded up to it couldn't couldn't actually get above it So if you get above that metric we could be looking heading back towards this area 113 Which coincides with the tuner date moving average I'll ask but not least the pound versus the u.s. Dollar Uh starting us out here after a rough ride racially There seems to be a lot of chatter about and no deal of brexit That's the way things appear to be going that can all change But while you you see no deal of brexit being flashed across the headlines on a regular basis That's likely to continue to put pressure on the British pound that we can see here It's been in a steady decline for recent months and we're not too far. We're currently at uh one spot 20 62 so not too far away from the kind of psychology port and one spot 20 mark And that could be an area of support should we press on lower from here If you do manage to see a rebound In pound versus u.s. Dollar we could see some resistance coming into play in around this region here in around the one spot 20 Do mark If you have any comments to make on this video or any of the other videos we've made here at cmc markets Please feel free to leave a view on the reviews. Thank you very much