This video is about Chapter 8, Evaluating Constructionist Perspectives on Social Problems. In the book Thinking About Social Problems, it is the last video in this series, and it is Going Over Concepts in this last chapter. That may be on your module exam. So, Lowsky in this chapter kind of compares and contrasts what Objectivists are looking at versus what Constructionists are looking at. He points out that the main concern of Objectivists is to document and verify what social problem conditions exist in the real world and to demonstrate and try to figure out exactly how widespread these problems are, how long they have persisted, and so forth. So, you're going to be looking at a lot of data from an Objectivist point of view, and you're trying to find more information about these conditions and describe these conditions accurately. Constructionists say that these conditions can exist, but that there is a process through which people come to look at these conditions actually as a social problem. So, even though you can document that these conditions exist, understanding that these conditions are a social problem is a matter of how people construct them. Because not everybody constructs everything, you know, the same conditions as problematic. Some people is in their interest to consider it business as usual, instead of considering it a problem per se. So, constructionists are, you know, interested in why did this become this condition become considered a problem, and why when it was considered a problem did it also come to be considered a problem that needs to be solved within the public arena. Objectivists are concerned about how the world is. They are very much wanting to describe accurately the extent of problems, accurately the extent of conditions to accurately show what the conditions are. Where constructionists are more interested in what people believe. Do people believe this is a problem? Do people believe it is a problem because of how they are affected by the problem? Do they believe this is a problem? Because they believe that it will be a bigger problem if they are not addressed and so forth. So, the focus is on the subjective view of people and what they believe as opposed to the objective documentation of what is actually going on. Objectivists see social problems as a violation of belief. So, they don't really examine how these beliefs and attitudes came into being, but rather they assume or take for granted those beliefs and see the problems as a violation of those beliefs. So, take the idea of justice. So, there is an assumption when you are collecting data on particular conditions that if it is problematic, it is problematic because it has violated this belief in justice. But there is no real examination of why people think this is just and why people think this is unjust. So, constructionists are interested in knowing how people come to hold the idea that something is just or unjust. Objectivists see claims and claims making is about how the world should be set up. So, again, this is left kind of unexamined. There are assumptions made in looking at the conditions that if people are being hurt or something isn't functioning well, it should be set up better. It should function. It should be just, it should be conflict-free, where constructionists are examining that. How do people come to believe that this is the characteristics of a better world? How do they see it? And there are conflicts between groups on how they construct what is or is not a better world. And so, constructionists kind of get at the heart of these kind of conflicts where you're not just talking about interests of the groups. You know, like what's in their best interest, but you're also talking about their world view and how they see the world and how this construction of the world is contributing to the conflicts and the problems that exist in the world. So, as you can tell, objectivists are asking what questions. They want to describe accurately the conditions that are going on in the world, the phenomena that is going on in the world. Constructionists are looking at the same phenomena that they are asking how, you know, a process question. How did this come to be? A why question. What are the motives of the people that are involved? So, constructionists would say that they are not trying to fix something wrong with objectivist point of view. But rather, constructionists are saying we need to add this layer like, okay, now that we know what, let's understand the how and the why. So, constructionists see themselves as working with and giving additional information to objectivism where objectivists are concentrating on what they, what the problems are in the world and how to solve them without stopping and asking how do we get to this point. As you can imagine, there are critiques of constructionism. Constructionists are said to be diverting our attention from the most important questions and concerns which are what are the problems and how do we solve them. So, if you're over here doing what seems to be like an academic exercise of trying to understand how and why you're spending time on things that they consider not really addressing the problems and making changes to the problem. So, there is a critique that, you know, this is more of an academic exercise than anything that has practical implications for actually solving problems in the world. There is an argument that constructionists are not really paying attention to what is good and what is bad when looking at these social problems claims. They're looking at these social problems claims and trying to understand the point of view of the people who are making these claims without trying to figure out which are good claims and which are bad claims, which are good solutions and which are bad solutions. And very much related to that is whether the claims are true or not is not the relevant question and understanding the how and why. The relevant question to constructionists is the point of view of the persons who are making the claims and how those claims affect the points of view of the audience who are hearing those claims without really asking is the claim true or not. So, these are valid critiques, you know, are we spending enough time trying to solve problems? Are we in fact diverting our attention from those problems and from those solutions? Isn't there something good, you know, there's good in the world, there's bad in the world, should we be pointing out the bad stuff and should we be pointing out the lies? So, these are valid criticisms, but Loski makes a case that the, that some of this is mitigated by what constructionists have to offer in understanding social problems. So, she said these are lessons that we can learn from constructionists that indeed do help us in solving problems in the world and in understanding a sociology of social problems so that we are not just merely being political and advocating particular points of view on particular problems. Albeit, oftentimes when that happens, the sociologist is basing that much more on objective facts than upon opinion, but she's arguing that there are some lessons that you can only learn if you take a constructionist point of view. For one thing, we can understand why people worry. Humans are notoriously bad at worrying about the things that are most dangerous and not worrying about things that are, you know, peripheral. If you take a constructionist point of view, you can begin to understand how this worry came into being, why people are worrying about something out of proportion to the risks that's involved. You can understand the historical, the political, the cultural context of this worry. You can understand the symbology that has been created that creates this worry and reinforces this worry. So, it's a way of getting at, you know, the question of, you know, why can't we get people to worry about global warming and climate change and yet they will worry about whether or not children are going to be given poison on Halloween. Even though there is absolutely no evidence about Halloween candy being poisoned on any kind of regular basis and there is a lot of evidence that we are warming the planet and climate change is happening and so forth. So, you know, this is a conundrum for a lot of people who are trying to change the world and constructionists can demonstrate how come this is such a tough thing to do to get people to worry about the things that are more dangerous to them. So, most of the time when people look at conditions and look at the people who are affected by these conditions, constructionists can give you an idea of the meanings of this. How did these conditions become, call the social problem and how do the people that are categorized within these social problems claims come to be categorized that way. So, category, you know, all social problems claims categorized conditions. They're saying this is bad. This is good. This is a problem. This is a solution so forth. And they categorize people. These are victims. These are villains.  These are people in power and so forth. So constructionists instead of just accepting these categories can actually uncover how these categories are created and reproduced in our social worlds. A lot of people who study social problems, a lot of people who are active and trying to make social change, realize that there is a big sort of elephant in the living room. And that is some very big social problems have been worked on in a lot of places over a lot of time, you know, historically. And yet those problems have not been eliminated. Poverty is probably the best example of this. People have been trying to solve the problem of poverty for millennia now. And yet poverty still exists and it gets worse and it's still creating a lot of social problems in the world and it is a social problem in and of itself. So documenting poverty and explaining where poverty is and showing the what of poverty does and even documenting some of the more successful solutions for poverty. You still have not, you have still not gotten to the heart of why we have not eliminated poverty. So where constructionists can start looking at questions of victimhood and how these victims are constructed to be victims. And they can also look at the unintended consequences of solutions, which is something that we talked about in chapter seven. Very often when people propose the solution and they implement that solution, it actually creates more problems, even though they didn't intend it. If you recall in chapter seven we talked about the problem with prisons. So you send somebody to prison for committing a crime, being convicted of a crime. The idea behind this is deterrence, right? You want to tell this person, punish this person so that they won't go out and do it again. But in reality what happens is you put them with a lot of other people have done bad things and you set up a situation where they are more likely to commit a crime than they would have if they hadn't gone to prison. So you create this situation of recidivism, and it's an unintended consequence of using punishment as a way to eliminate crime. A constructionist can get at this in a way that objectivists can't. You know, objectivists can document the recidivism, the repetition of crime, but they don't necessarily have a way to get to how this is a consequence of the solution that was implemented. Even though there is a critique of constructionists that they are not paying attention to good and bad and paying attention to the truth of the claims that are being made, Loski is arguing that nonetheless, because you begin to understand how culture works, how symbology works, how typification works, you can begin to understand what reflects and what perpetuates inequalities in our society. So she's by getting to the subjective by understanding the meanings of these typifications and the ways people use this, you can get a more, a better understanding of how inequality works. You know, the data on inequality can be very convincing at times, because you can literally see inequality by studying the differences between groups and classes and so forth. But she's saying that this gets at why it is being perpetuated, why people are using the symbologies in oppressive ways. And so because it's getting to that why it adds more information to the what. She also argues, you know, we talked about individual worries and so forth. Well, when you study how social problems claims works and most especially how formula stories work, you begin to see how worry gets constructed within a culture, and how, you know, for instance, she uses Americans in this. Americans worry about the most troublesome conditions, producing the most extremely harmed victims. Well, this worry is is part of the formula story. The formula story wants to create a plot that shows you the worst case scenarios are close to the worst case scenarios. And this itself creates a understanding within culture of these things being troublesome of these things extremely harming the victims of these troublesome conditions. And so this helps under helps us understand also how people are responding more in an emotional appeal than a logical one. Why it is that people come up with weird ideas that don't seem to be connected to the facts. In part because they are being given these simplified stories that that creates that understanding of what to worry about. This also demonstrates how we spend a lot more time thinking about harm than we do thinking about prevention. And that's another conundrum that a lot of people who try to do social change have a hard time understanding why, you know, if you know that this is harmful why we're not taking the next step and paying attention to prevention. Well, part of this is the way social problems claims are constructed. It, it emphasizes that harm more than emphasizes those solutions. It also helps us understand fear and pessimism in our culture and especially fear of others. Because when you are creating or perpetuating typifications and sometimes those typifications are stereotypes. You can create a situation where in your effort to make a social problems claim, you construct the other as being the problem. And if you understand the process of social problems claims you understand this need to simplify to be concise and so forth. You can see how these stereotypes and typifications become perpetuated. And this is, you know, a, this digs deeper than just documenting the incidences of this. It helps us understand how these, how these things work. So a constructionist approach to social problems study is good because it helps us understand the sociology of social problems much better. But it also because it's digging into the ways in which culture in gives context to these claims and the way these claims gives and changes the culture. We begin to understand social life more in general as well. The important takeaway is that Loski's argument and the argument of other constructionists as to why we should study social problems this way is it's a way of going beyond just taking positions on particular problems. We are actually looking at the sociological aspects of how social problems are how social problems claims are made and how they affect the culture at large. So, you know, the argument is that in taking an objective is approach. Many sociologists have not really gotten into the heart of the sociology of it, whether they are just simply recounting what the problems are and what the proposed solutions are. So Loski is arguing that by taking a constructionist point of view, you actually become more sociological in your approach to social problems because you begin to understand how social life in general is affected by and gives context to social problems that we're studying. So she ends this chapter and ends the book by arguing that if you become aware of the process of social problems claims making you as a practical actor in your society has a better perspective to bring to any social problems claims that you encounter. So, in essence, she's saying this makes you a critical thinker about all of the proposals that you are hearing and all of the problems and conditions that you're hearing about, so that you can better understand what people are saying to you, what to believe, what not to believe, how to ask questions and interrogate it more and to become much more savvy about your social world and about the problems that are being faced within your society. So she outlines eight things that you can take away having studied social problems in this way. One is that, you know, everybody who hears about a social problem is essentially part of the audience. And while audiences are not necessarily, you know, the social problems claims maker is not necessarily aiming at the general public as an audience or as their final audience. Still, if you want to be an informed consumer of media and you hear about this, you are part of the audience and this helps you be an active participant as an audience member, rather than just simply a passive consumer of the information that is being given to you. You also, because you understand this process, understand that it is a process whereby people are convinced of a particular point of view. They are being convinced that something is a problem. They are being convinced that this is a viable solution to that problem. They're being convinced that they should give their money, give their time, give their effort to that problem. Well, if you know that this is the process that's going on, it helps you be more open to possibilities of other people's point of view and open to the possibility that you can be convinced of this problem. Whereas if you are just reacting emotionally to it or you already have ideas or ways of thinking about something that you take for granted, you may not be as open to the possibility that somebody else's point of view might actually teach you something. So this kind of critical thinking oftentimes is characterized as making you critical of everything, but also she's arguing it makes you open to more things because you can have more confidence. You can ask questions of social problems claims makers that dig deeper than what they're going to tell you in their initial arguments. Even mine because now you know how formula stories work and why formula stories are used and what you know is what the drawbacks are of formula stories and the claims making process. You can in fact dig deeper. You can ask what are the nuances? What are the things you're not telling me? You can go and look at and see the data for yourself and then come back and ask questions about what was left out. Because you are aware that something is probably being left out because you are aware that something is probably being put in its most negative light or in a more negative light. You can begin to question and inquire about these claims in a more educated way and a more in a deeper dive into them. You can also because you understand the hierarchy of credibility kind of get past who's making the claim, right? Claims makers are chosen for a reason. They're not just people who think this way. They're people who think this way that an audience will listen to. So you can get caught up sometimes in the appeal of the claims maker and say, oh, well, that's an expert or, oh my God, that's a victim or look, that celebrity cares about this. And because you get into the appeal of the claims maker, you can miss the opportunity to actually understand the claim itself. Whereas if you understand this is part of the process that this credibility is part of what has to be addressed in order to make the social problems claims, you can in fact dig deeper and get past that emotional appeal. You can be critical of the moral problem is defined by the diagnostic frame. What she means by that is that diagnostic frames are always going to be giving you a particular understanding of what the problem is and where the problem came from and so forth and why it is wrong. That's what she means by moral problem. Well, because you understand that you're being approached with this diagnostic framework, you can essentially critique that and see whether or not it's as bad as this framework is suggesting that it is. And ask, you know, what data is being left out because when you are doing a diagnostic frame, you tend to pick the information that supports your moral claim, rather than information that might undermine it. If you are somebody who understands this process, then you know to look for sort of the stuff that has been left out. She's arguing that you can be aware of claims competition, and that will help you identify more general issues. What she means by this is, in part, is that because you understand that every claim that is being made is trying to be heard among the noise. You can, in fact, start looking for commonality between claims. You can look for, you know, what are the multiple sides of a particular claim. You can also look at, you know, that claims tend to be very narrow, but problems tend to be interrelated. Environmentalism is a good example of this. Environmentalism is not just talking about ecology. Environmentalism is also talking about race. There is a racial difference in who is impacted by pollution. There is a racial difference in who will be impacted by global warming, by rising seas, and so forth. So you begin to understand race and racism as being connected to environmentalism. If you know that these claims competitions exist, and that because of this competition, people are being very, very narrow in their telling of their formula stories, you can analyze this, think critically about it, and begin to make these connections into more identifying more general issues. Also, you know, claims making is about tugging at your heartstrings. And if you are aware of the claims making process, then you can be aware of, wow, that made me feel sad, or that made me feel angry, or that made me feel helpless. And because you can know that your feelings are being, this may be a harsh word, but manipulated, you can begin to look beyond how you feel about something and begin to ask critical questions about it, and understand the broader picture and not just how it makes you feel. And you can also understand how this idea of creating collective identities, like victims, villains, oppressed, you know, these different kinds of categories, can't, you know, while they are useful in a social problems claim formula story, you need to, you can, through this, understand what are the pitfalls of relying upon them and reproducing them. Which is what the social claims process often does. So I hope you understand that this is essentially what she's arguing is that the constructionist viewpoint, the constructionist perspective on social problems is key in making you a critical thinker. And giving you the tools that you need to not just accept what's being told to you, but also to think critically about it to consider what is being told to you and figure out ways to dig deeper in it and decide on more than just an emotional level. What you believe, what you, what you want to give your time, what to want you to give your money, what you want to give your effort to. And this is the end of the book. And I hope this has helped you on the exam and also helped you understand this framework and think more critically about sociology and about social problems.


So, welcome to Cloud Native Live where we dive into the code behind Cloud Native. I am Mohamad Shahriar, almost like a middle and a senior ambassador. So I will be your host tonight. Every week we bring a new sets of presenters to showcase how to work with Cloud Native technologies. They will build things, they will break things, and they will answer your questions. In today's session, I'm stoked to introduce Symes After, a developer relations manager who will be presenting on mastering Kubernetes access management. This is an official live stream of the CNCF and search is subject to the CNCF Code of Conduct. Please do not add anything to the chat or questions that would be in violation of the Code of Connect. Basically, please be respectful to all a few fellow participants and presenters. So with that, I will hand it over to Symes After and kick off today's presentation. So let me add Syme to the screen. So, hey, Syme, how are you? Thank you very much, Syriar, for actually inviting us on this wonderful topic. And thank you very much to the folks who actually just joined us on the chat. Hello, Ahmed. Hello, Manish. And hope you can actually be able to hear me. And if you see some of the noise or anything bad happened during the presentation, do let me know. And once again, thank you very much for joining. So my name is Symes After. As Syriar, we are the fellow CNCF ambassador and it's been the first time we're actually interacting on the live stream. It's been a great story. It's going to be a good session to go forward. So today I'm talking about Kubernetes access management and why you need to take into the consideration while you're actually working with the Kubernetes cluster on a daily basis. I saw some of the challenges and I look forward to tell you some of the challenges I faced and how I ever come to some of those. So I want to know now is you now, Syriar, and then share your screen. And then I will start the procedure. Yeah, that's true. Okay, so I guess we can start. Yes, absolutely. Thank you very much. Once again, I see more folks in the chat now. And I hope and everybody can able to see the slide right now. If you don't, please do let us know. So that is actually the agenda of the topic today. Mastering Kubernetes access management. And we are watching Cloud CNCF cloud native live. So I want to, can you go to the next slide, Syriar, please? So as I said, my name is Saim Sabhar. I live in Pakistan currently in Rawalpindi. And I am a CNCF ambassador and it's been a wonderful journey so far right now. So can you go to the next slide, please? So what is the agenda today for the discussion today? We will talk about Kubernetes platform because there's a lot of moving pieces. And access management is one of those. And then we talk about sheer responsibility access metrics. A key consideration for multi-tenant or the cluster-based access management. I will let you know about the security life cycle management if you're developing app on Kubernetes. There are some very overwhelmingly complex. Some of the requirements and the control access. We're talking about some solution to solve some of those. There's a demo I prepared with you and some highlight to let you know. At the end of the day, we will cover all these highlights in every day. So can you go to the next, Syriar? So currently, if you look at the Kubernetes operational, Kubernetes platform in general, you see automation, security, visibility, and governance. And that is bare minimum to have. I can expand it to the more further. But I believe these are the actual cornerstone of every Kubernetes or infrastructure if you're actually developing app on top of it. So there are two things you'd worry about. There's a modern life cycle management. And there is a Kubernetes infrastructure management life cycle. So basically, if you're working on Kubernetes today, might be you're using on data center, might be you're using Kubernetes on their own prem data center, or might be you're using Kubernetes on EKS, Azure on AKS, might be you're using GKE, or might be you're using remote or Edge Cloud. So if you're in the Kubernetes space, you see the requirements are you need to build an automation. You have a security in place that we call it zero trust. And we call it a security preparedness.  And you want to provide them a visibility so they can look at the platform and everybody can separate the concern between what they are doing and what the other team members are doing in the shared platform. And then we need a governance. Governance basically means when you do something, we need to take into the consideration. Like I am allowed to actually change the cluster. If I am, how much of the access I granted, or even you can take a look at the Kubernetes and tools like Open Policy Agent and Policy and Governance, those are the basic governance needs. But I will talk more about these four considerations. But today my focus is, can you go to the next slide please, Sherry? Yes. So basically if you look at the summary requirement of the platform need, that the platform is now composed of not one, but there are so many moving parts right now. So, Sherry, can you go to the next slide please? Because I see the previous one. Can you go back? Yes, I can see it. Thank you. So basically if you look at the platform today, and the, no, the previous one, Sherry, the previous one. Sherry, can you go back to the previous slide? I guess let's wait a bit, because our speaker has been stuck in the date. So yeah, hello everyone from Israel, Iran. Okay, so let's wait a bit, because our speaker has been truly disconnected from us. Let's wait, let's see. Sorry, sorry, sorry. Yeah. Sorry, I think I clicked a wrong button. Sorry for that. So yes, summary of the requirement of the platform need. Yes, that's the slide. Think, yes, yes. So if you look at the platform today's, you need these major five, five, six coronas though. You need a service match. You need network policies. You need trust access. You need policy and governance, policy enforcement. Then you need get off for drift detection. And then you need multi-tenancy because developers and the operations might there, you have tens and hundreds of teams. And by giving everyone a new cluster, kind of be overwhelmingly complex. So what you do is you share the cluster with the team member, so everybody using the same cluster. So that is the summary of requirement for the platform need. You need service match for managing logs and application and have a battle separation of concern. You have zero trust access, how you can actually enable everyone access the resources to you need get offs for the drift reduction. And then you need policy enforcement, meaning you have a cluster is in place and what the cluster is doing, you have some access to it and you want to find grain and you don't allow that. You don't do Kyberno open policy agent is a feasible here. So can you go to the next slide please? Because that's where we are talking about shared responsibility access management. If you look at the Kubernetes plus cloud and the traditional cloud, in the traditional cloud, we have physical infrastructure, networking, virtualization, guest OS, application, data, user access and identity. That is enough for you and then you have the application start and you add binaries and Linux operating system and you can add more into it. But that's a peer minimum, minimum you have to take into the consideration. Look at the Kubernetes plus cloud model. You have physical infrastructure, networking, virtualization, guest OS. Then the guest OS, you install Kubernetes on top of guest operating system, meaning you have Linux installed on top of it and then you have a Kubernetes infrastructure layer and look at the Kubernetes, what Kubernetes does for you. You have CNIs, container, network interface. You have CRIs, container, runtime interfaces. You have container storage interfaces. Then you link up service meshes, GitOps, policy and governance, multi-tenancy, runtime detection with Falco, observability with Grafana and Prometheus and for all the bottom layer to the top, you need a supply chain security tooling, making sure that container images that actually you are using have actually they have secured version, not a major one, so a very less surface area of attack. So that's a big, big model now and then you're actually installing your app and then you're actually running, working with your app. So look at the model right now and the access management become way harder right now. How much of the access your app team has compared to the how much of the access your DevOps team have. You have to separate the concern between both of the infrastructure and one bad command. Then the forensic start and the forensic is overwhelmingly complex to understand who does what. So can you go to the next slide please? Yes, absolutely. So if you type one bad command in anywhere, then there is a hustle and then there is an immediacy around who does what and you start doing some kind of forensic analysis and the forensic has become very difficult because you have a CNI layer networking. Is it something complicated or is something broken in the network layer? Is it something broken in the runtime layer? Is it something broken in the storage layer? Is it something broken in the service mesh layer? So battling for the root cause is not easy. It's very difficult. So today is my focus was is to reduce some of the concept around security and how app lifecycle management work. So in app lifecycle management you need zero trust application deployment meaning when you start a consta is you actually type a command kubectl get engine acts meaning you have access to the cluster that actually provided to you by the DevOps team and you don't accidentally deploying a class application or with somebody else cluster and breaking their cluster accidentally. So that's where the zero trust application deployment model works. Then you have a separation of duties like app team is responsible for deploying app and the platform team is responsible for deploying the infrastructure for you. Then you have secret management integration then you have centralized policy enforcement drift deduction and blocking and private manifest repository. But today is my focus around if you go to the next two slides around zero trust application deployment and the separation of duties. So now the first things come up how you have to separate the concern between application and deployment and that is I actually added in the next slide. So if you go to the next slide and that's where you that's the summary of the role and permission granted to the team. You have a org team and then you have org admins and might be orgs have read only permissions for the project. Might be you have not one project but you have different projects might be you have let's say you have projects in EKS cluster then you have project in EKS cluster then you have project in GKE clusters and then the project is divided among teams. So that's in high key becomes completely complex and complex but look at the simpler version how look it different. So you have orgs wide permissions for the project and then you have infrastructure and workspace. Workspace is actually is actually give you the access to the cluster you're actually working on that you have a project admin and the project read only permission then you have a workspace and the infrastructure. So infrastructure admins can actually let's say can create the cluster meaning they can install third-party apps for you get-offs policy agents like Kaivorno or open policy agent or then actually deploy third-party like they have bitnami for secret management they're going to add it for you and then the developers what they do is they have access and then they have the access to the cluster and then they deploy application on top of it and remember in a team in an organization there's not a one developer there are 10 and 100,000 of developers and Kubernetes give you the namespace concept meaning there's a namespace you can actually access the same namespace that belong to you the way you actually access the namespace with a permission we call it RBAC role-based access control so basically namespace is actually in a Kubernetes is similar sort of like if you have a house and you have different rooms from your for daughters and let's say if you are in your house owner like dad and you have sister daughters and sons you actually have separate rooms for the daughter and son so basically what son can see only the resources they have in their area of a room and the daughter can see the or resources all they see in the area of room they can actually see it so in the same way Kubernetes have all the permission model and what you can do is that if you want to deploy certain apps we can give you the namespace and that's belong to you and what you do is you actually add your application and all the things that actually application or what actually project you're working on that and the way you can give access to those resources via RBAC RBAC extend for role-based access control and that's where your namespaces comes in handy and we have a in a Kubernetes we have called namespace base permission versus cluster wide base permission so the namespace said like if you have a cube CTL Katanas that's a name namespace orange in a orange namespace sign can only be the person with an organization can deploy application on that namespace if accidentally Sharon access the same namespace he get a permission denied error saying you don't have permission to access the same namespace so the way we can actually stick to it but there are criteria where we have a cluster wide resources so namespace is just belong to the developers but the cluster wide for resources being you have storage you have networking and that is an organization wide resources and that is actually basically the job of the infrastructure team and within the infrastructure team you have storage team you have security team you have networking team we are to give restriction to the infrastructure related domain Pacific needs for those person of the task so now if you go to the next slide please share your so one more yes no no go back yes thank you so right now if you look at you have cluster in geoglophical centers you have some clusters let's say in aws region us east you have some cluster in us region if vast you have some cluster in digitized oceans you have some cluster of myriad sevo kubernetes cluster or sevo cloud or you might have some cluster in let's say azurek s and gke and you want all those cluster to be have a centralized visible location for me to track those in and that's a very small screenshot i've added what i want to see in infra admin as i want to see the permission i granted to the development teams how they are accessing cluster which area of time like if let's say if they access the cluster 8 a.m in the morning and what command he actually wrote in the cluster actually declarative command he used to spend up the cluster if something bad happened to my cluster as an infrastructure admin with responsibility to make sure infrastructure will be visible and will be available for all of the precation team regardless of what area of time we're actually accessing but in order to make the highly available cluster i need a centralized visibility too so basically if you look at i look at the dashboard see who can access the cluster what the latest command that broke the cluster and then i can look at the permission i can what the command actually broke the cluster and then i can drill down in the issues and then actually for do the forenshing and make sure the cluster is back to the normal that is my need i need a single administrative plan for infrastructure is my first area of requirement security access now share now can you go to the next side please yes so in an in an electrical net is cluster we have cluster lifecycle and management you need visibility you need who can access the cluster what time is accessing what command he wrote and then we need trouble shooting and you need enterprise wide dashboard alerting notification and you need Prometheus a Givana for centralized visibility and monitoring now we go back to the next slide share and i see i think if you come with a mindset of not every dev and office team member needs an unrestricted ability to create, delete and modify resources create, delete and modify resources then what's come up with that mindset you spend a lot of time with single administrative pain you spend a lot of time in enterprise dashboard what end up happening is you need less trouble shooting you will come towards the area have you come towards the goal where you have less alerting and monitoring and you look towards the area of adopted integrated monitoring so in the next slide i tell you if you come up with a mindset of not every and dev office team member needs the unrestricted ability to create modify and delete Kubernetes resources this mindset give you less trouble shooting less alerting and monitoring and being prepared for the monitoring and you have visibility in the single administrative pain and enterprise wide dashboard now Sherry I can go to the next few slide and then I straight go to the yes next four and that I think I can get now we come into the place of the challenges associated to the control access how do you access the cluster what are the traditional approaches you have how they actually lack today where they leave where they see some kind of visibility and can you go to the next slide and we start with our journey of access management via bastion what you do is you install some of the bastion controller in front of your Kubernetes private Kubernetes cluster you access into the set that machine and that machine where the Kubernetes cluster is running you will able to access those but the issue the huge issue is everyone has a same cube config file meaning if somebody mess up the cluster the entire organization is in the hand of the recovery team to give back to the previous state of the cluster and you will end up seeing a very much fighting and I see a lot of the in only 2020 a lot of being spending a lot of time in backend recovery tool because this is happened very often and you also have a lot attack surface since entire private network accessible from bastion the next one and that's another challenge with the approach called jump host what you do is you create a jump host meaning let's say you have another machine dedicated in the public area you can access to that machine that machine will eventually access access access to the private cluster where Kubernetes cluster is running but we've done something good in here but the problem is some similar to the previous one you have same cube config file and you have a YAML secret and all the dumping ground of YAML and secret management that you have to take to worry about then there's a large attack surface since the entire network accessible from bastion the same approach different design but the approach but the problem still remains the same the next one is on the next slide and that is access via VPN gateway that is better I see some of the companies some of the people are still using Kubernetes access management during with this approach it's kind of have some of the tool associated in the marketing market right now but the problem is that it will cost to you taller to purchase and operate you need a team dedicated for the VPN and who can actually give you access to the cluster so it's a good one but it's a lack of there's so much cost associated with it remember you are accessing the cluster in the AKS, EKS, GKE if you accidentally create some of the resources in the EKS, EKS, GKE that will pile up your bills so it's a good approach but there are cons associated related to the need of VPN gateway per data center every data center required a one VPN and that's need a huge amount of resources then you have a user need of VPN client on laptop you have a laptop to connect to the VPN and the VPN connect to the data center and as I said there's a taller there's a money and there's a cost associated with this approach and why did AKS since entire private network all IPs all protocol is accessible from the laptop which accessing the VPN so that is another bad way so in the next slide if you go back if you go to the next slide Sharyar you see the manual approaches will fall apart and you can totally understand this because you are not accessing the cluster one you there are tens and hundreds of access cluster that you need to deal with on daily basis I work in a team we're an access cluster in EKS, GKS digital ocean in many different places even on data center and remote and agile locations so we can't rely on the manual solutions to fulfill our need that's where we headed towards the key takeaway from the challenges and heading toward the solution the open source solution that can effectively help you become some of the challenges in the next slide I'm talking about I'm talking about the key takeaways number one you need a cognitive you need to remove the cognitive load from accessing cluster by cluster you need to remove the manually jump host or VPN approaches because entire fleet entire network is actually in the verge of one bad access one bad command to the cluster then you need a dollar to purchase and operate and then you need some kind of custom tooling to audit because the reason why you're auditing is you're spending a lot of time in auditing because you know things going wrong and wrong in a very horrible way so that's where you can actually work with identity providers and auditing mechanism to solve the needs and then all these are human friendlier humans command type and they can actually broke in some way so basically you have this this is actually error prone increase the risk of breaches as the number of cluster grows so let's circle back over communication communications to word an open source solution that's called Parallels and the CNCF Sandbox solution how this serves solve some of the challenges or we can dive in to see what the model where Parallels operate in so Sharyar can you go to the next slide please yes so meanwhile before I'm starting jumping to the open source solution if I if you have some question related to access management because I know you have channel of them don't hesitate to ask and yes don't hesitate to ask and I will let you cover so let me give you some backstory of CNCF Sandbox project because I would like to dive into the intricacies of how the project evolve I work with a lot of the open source project as a community in the past so I would I want to be a very listener around the back storage backstories of the project so I talked to the one of the team who's actually managing this open source solution and this team is called Rafa systems and as talk to some of the team members why there's an why you actually you see a need of an open source solution and why you actually donated to the CNCF and they spoke about in our Rafa Kubernetes operation platform we have multicluster management that the client is using we have GitOps for Kubernetes we have visibility and monitoring tool having a single plane clicky click of a button and then the policy and cover an open policy agent features like add-on and then they have a hung dashboard in their platform then a cluster blueprint drift reduction and all of the features are listed in is actually a part of that platform they're actually providing to the customer and they tell me the one of the features their client is loving about is zero trust access meaning the way they're accessing the cluster is zero trust meaning no rotation of kube config file and there's a no rotation of R back some kind of thing is something handled automatically and they see all of the client and accessing like Rancher cluster OpenShift main upstream Kubernetes EKS, GKE or Azure and all these running in different data center AWS, Azure, Google, remote or Azure locations so they tell me like all the cluster approaches and all of the access management become a very difficult for the our customers and they have a they like our feature around zero trust and what we've done is we'll see if the Blutthorough people have already seen a demand why not make it an open source and other people can use the same feature to solve some of the needs in the next slide I'm talking about how the Parallels model works so basically if you are accessing the cluster today how the this approach works is you have you can access the cluster from kubectl, cli Raffy can so or or or browser based kubectl shell or kube api client what are they happening is you accessing the Parallels server and Parallels server is a monolith comprising a many component having a creatus for user identity meaning if user log into the Parallels we actually preserve their identity user credential and login we use creatus we have we have a bunch of other Parallels core component so we separately combine those and call them as a Parallels server so when you access the cluster the first thing up you talk to the Parallels server so there's a no rotation of anything so then there's a step two you will log in via let's say github or google or any identity provider like Azure AD or anything you would like to access or even you can add a use octa to log into the Parallels dashboard so you log in and then you then you will assign we will assign you a permission what permission this user has in order to access the cluster the next thing that will happen we will create a service account a femoral service account when you boot step the cluster in Parallels dashboard there's a relay agent install in front of your cluster that's this basically install configure service account token for you and then you can access the cluster then the service account token is actually added in the kubernetes server api server what is the next time we do you'll actually access in the command kubectl get pod we can you can see the pod you can see kubectl get deployment you can see the deployment if you don't have permissions to see the deployment it lets say orange namespace that belongs perfectly to me then the access denied error because we have already added some kind of authentication mechanism in Parallels so you don't deal with our back or role-based access control so that's the architecture we have and this architecture gives you the unified trust secured access via network terminal immutable audit logging when you access all these command there's a trial you can see who does what what time it takes for the command to run and all these kind of things are visible in the Parallels dashboard so basically with this tool the promise here and the motivation is toward zero trust model governance capabilities and integration meaning comply with DevOps policies and reduce attack surface with data centers and centralized cloud credential including IAM policy and service principle so now you can go to the next slide please share your yes so now the scenario becomes I want to access the clove kubernetes cluster using web browser base kubectl service account token and a federated RBAC I need centralized visibility centralized audit trail of all kubectl activity so basically what I need is I need a secured access with a clock-based Kubernetes environment meaning I can access the cluster jump in and then I remove and that's I need a service account token for federated and I need to see a centralized visibility of all kubectl activity so that's the scenario of where we think Parallels can best fit in and if you go back to the next few slides and then I go straight jump into the some of the demo spot and tell you how these things look like in real world so share that can you go to the next slide please yes so that is if you look at the Parallels.io website and go jump in there you see all the information available is this an open source product I want to see some of the contribution from the community members because what we like to see how community are dealing with the challenges of access management what's the problem you're facing what feature you want to add in so basically as of today we're giving you the custom roles user and groups if you log into the Parallels we have custom role associated with it and you can actually change and revoke permission on the fly meaning if somebody from the team member leave the team and then join in again there's always a hustle then the not in compliance team came up and manually remove his permissions but that is not with the case with the open source too like Parallels the permission model is actually a very automated one you can actually dashboard and remove and revoke permission then we have a same meaning you can use get as your ad or octa to authenticate it to log into the system and you have an audit log of kubectl command history and a modern we have a GUI we have a PCL tool to access the Kubernetes cluster and we have a API so Sharjah I'm hopping I'm not lost anyone so can I share my screen and give you some demo yes sure sure okay let's wait for some time okay so if you guys have any questions to allow you can just comment it out here I think there are some questions coming up okay let's wait for the speaker so yeah oh sorry guys no I'm sure for disconnecting again so Sharjah just I'm just thank you so Sharjah I'm just sharing my screen so while I'm sharing my screen I previously clicked the wrong button and I disconnected so sorry for that people so actually let me share my screen I'm sharing my entire screen and I want to give user and the listener walk through of how this thing work so unable to so Sharjah can you give me access to share my screen currently it should I think you should you should have the access actually okay can you please try joining yeah using that link yes sure sure sure so I'm actually I'm rejoining yeah sure okay sorry for the issues but I hope you guys wait for the demo part because now Saim will actually show you the demo like how it works basically okay so let's add him the game yeah yeah you can try now yes yes absolutely I think there's a one question in the chat from what is the best tool for managed Kubernetes is it the question Sharjah in the chat there are others as well but yeah there's it has been one question like what tool best best for managed gate is cluster yes absolutely so I think like actually I think right now the motion is there there's a there's a revolution we call it the momentum is towards managed Kubernetes cluster because spinning a Kubernetes cluster locally is taking a lot of our time and effort and all these things we have to do it manually because service Kubernetes is not just about just Kubernetes but the entire ecosystem is built around that so currently I see people are building platforms on Kubernetes infrastructure if you look at the right now there's a go port there is a open shift already in the for a very long time then we have a there's a tool that I know I work with the company got graphic Kubernetes operation platform and then there are a bunch of others who exist what job is to actually give you the Kubernetes inside a dashboard and basically pick and choose the services what you like if you want to use service mesh oh here's a button for you click on service mesh added behind the scene and let's focus on the app the business that you actually working on so that's where the motion is actually helping go on so I think right now there are very overlapping and there are a very overlapping for that so if you want to manage Kubernetes locally and to want to see a centralized with centralized visibility that's because the question is having two angles number one I know the Kubernetes is complex I want to have a managed tool that give everything in a single plane of glass that is what a tool I'm talking about if you're talking about just a tool that give you of visibility and you can see how the pods and replica search and did not set are listed inside the dashboard previously we have the lens open source project but now it's becoming a more of a commercial one to K9S is a really good one as somebody actually chatting over there but the K9S is give you is a terminal base you can try command the terminal base access management then you can look at the dashboard and see how the pod deployment replica set and all these things behave so if the managed Kubernetes go look at the platform tool that people are building on top of Kubernetes for the local development need visibility need go for the K9S yes for the product level yes I already tell about if you want to have a Kubernetes cluster service mesh GitOps Prometheus Grafana ingress controller if you want to lift off this responsibility to somebody else what you do go for the some of the tools I mentioned she already mentioned go to the let's say there are a bunch of them like open shape there's rancher there's a Rafi Kubernetes operation platform there is a co-port then there's Mia platform and there are few others like Weaver's platform few other like you can name it it's very difficult to tell which one is the best but these are the option exist and let me know if you have any question related to that I can answer so any more question before jump into the demo and then we can clue the pod I guess this question parallelist has high availability so how the parallelist is yes so how this how the question is actually late so if you access the cluster there is a lot of the time is actually you access the cluster to configure and your cube config is actually used by all the team members your cube config is members and that's a bad stuff with a fake file in your healthy user utilize server that's certified servers is actually utilize over access the that actually accessing that behind the scene so basically the question around like how do we available how would how does panelist become highly available is a one lacking point and that is accessing the cluster so basically there are some permission we can actually tap in the load and make it three of the past server and then actually access the cluster behind the scene but as I lost somebody you I guess your video is breaking down actually yeah okay so I guess you can start with the demo and if so as we assumed yeah sorry for the issues because our speaker is facing some internal issues I guess so sorry for this issue okay let's wait for him to join in again for the last part like the demo part yeah let's see so yeah he has joined let me add into the stream your screen is free I guess so yeah hello Saif can you hear us yeah this has been an issue I guess let me wait a bit so is it possible to get the slide deck right okay so yeah I will talk to the speaker and if it is possible then I will add these slide deck to the stream basically yeah into the I would say is YouTube live into the description you might see these slide deck okay so yeah awesome okay so yeah as we can't I guess we can't continue the session if this seems like this but you guys can share where are you where have you joined from so yeah in the meanwhile yeah I can see Saif now okay okay so I don't know why but it's actually reloading for a long long time even I'm talking and it's take it's got me disconnected of right now this is my best experience I usually do some kind of hosting on another platform and meanwhile if you want to do some deep dive content I have a YouTube channel called cloud native fm and there's a lot of the chocolate related to Parallels is available there's a question around how does the Parallels give you some kind of availability if we have an entire session on that on the cloud native podcast YouTube so make sure you actually join it and see the discussion there I hope things what work right now I give you a very quick demo and then you actually and thank you very much Neera actually sending this Slack channel in here for so people to join it we have unanswered question here please go here and if you have some wonderful communities building up I'm going to answer those as well so I hope I can have permission to access my screen so I can literally jump in very quickly and give you some very good highlightable so I think I have to rejoin it again because of the I disconnect previously so that that's a design consideration no words I will be very quick and it's a very short demo and I will back okay yeah thank you guys and yeah thanks you know for sharing the Slack channel and in the meanwhile so what you guys can do is there is a actually blog palace dot are you blocked so this what Simon has shared with me let me share check this out okay okay you guys can check this blog I guess okay share okay I've added you to the stream so let me quickly share my screen again and there's a very short demo we hope things work right now sorry people for some kind of I'm still unable to just share my screen no worries what I do is share or can you go to the panelists repository because there's some videos in there we can actually use those as part of our discussion so palace dot IO and there's a GitHub GitHub link there can go there there's a very GIF added there so I can walk through people how this actually work in the real world because that's people who want to we have auction question so if you okay let me yes no worries no worries so guys if you're actually we have while a share I was actually sharing this we go to the parallel's website parallel is now actually listed in AWS marketplace is actually available into the civil cloud we recently added and is also available into the digital ocean why this is actually super cool because sometime we feel like installing and cloning a repo is kind of our helming you install help install and parallel is installed and something bad things and happen with the managed offering like AWS MP marketplace instant gen what you do go to the AWS marketplace click or click on the marketplace is a one click installer basically so basically when you install go to the EKS cluster look at the security in the AWS marketplace security section inside the security say you see a parallel click on that install it on your EKS cluster once you install your EKS cluster you see some of the component related to parallel's added there are some connector there are relay agent relay server is already added so this is a website we're talking about but the next step is share can you go to the get up right now if you go to the get up click on the get up and I can walk you through some of the step in there yeah I think we have added a gif in here somewhere in the down in the repo can you go there quickly contribution author parallel's website let me I share one with you so I can share one with you quickly here so people can look at how this thing work is this the gif we are talking about features yes this one so can you actually make it of make it more bigger like you click on it there is a separate yes so what how does the parallel's work is first thing first you means you log in to this parallel's via get up so the first step is you go to the parallel's dot help install parallel's and then the dashboard you already locally run into the console dot demo dot parallel's and then you actually access access the parallel's dashboard the next thing is you how do you actually log into the parallel's you can actually use get up octa azure or any favorite tool you can do next step is you actually bring on cluster on boarding process click on the cluster and import existing cluster then they import existing cluster remember we adding the relay agent in front of every cluster if we're adding relay agent in every front cluster so when you import the cluster we give you the bootstrap bootstrap.yaml file when the bootstrap.yaml file you downloaded let's say kubectl.yes thank you nirv is also added on the youtube as well this is a talk from nirv on the kcity bangalore is a video is added there so basically let's you and actually download the bootstrap.yaml kubectl bootstrap.yaml and then the relay agent is actually added into the cluster what the relay agent it does is is providing you the service account token for accessing the cluster meaning when the service account token is actually granted added in the cluster you don't need a kubectl file or all of these a roll bus and the manual processes basically you can access the cluster with infameral service account token if you install kubectl catboard the parallel server actually lift off this request to the relay agent relay agent with actually I'll give you the service account token and that service account token has a permission means he has access he can access the cluster as an admin as a read only person or as a a readable writeable person to access the cluster so with that model you can actually access the cluster and list all kind of resources let's say if you want to add more granularity and give me permission or remocking permission go to the parallel dashboard inside these settings and go to the project setting and you actually remove the permission of sign from this cluster and in that way my permission got revoked and everything back to the normal meaning there's no manual steps involved behind the revoking of permissions so that's how parallelism actually works today we have so many new requests coming up there are some issues related to it currently we're working on how you give you the centralized visibility using promises griffana tooling so can I the dashboard like more shinier and for you so we recently added cvo cloud make sure you actually access the cvo cloud cluster and let us know your opinion how this works so over to you now look at if you have any more question and then we wrap up the proceedings and you can see your screen and we can actually give some people of final places to look for some resources for parallelism okay so yeah I guess people can now ask their questions because we have just end up with our sessions right now right okay so yeah I guess there are some questions that you have already asked but yeah few questions that should be that might be added here is I guess I'm going to ask you some questions like yeah how can organizations effectively implement role-based access control in their Kubernetes cluster so what's your opinion on that and can you can you repeat a bit can you repeat again just if I lost a few okay okay so how can organizations effectively implement role-based access control which is basically Arbeck in their Kubernetes cluster so how can yes absolutely there's a manual process a little remember Arbeck why Arbeck permission model is works remember we have a namespaces concepts in Kubernetes namespaces allow you to see the resources that belongs to you how do you actually how do you actually like audit how do you actually control is you need a role-based access control and that is provided to a namespace so what what is so the role-based is actually telling you have a you are let's say I want a read only access to the namespace orange I create a role and then I create a role binding and that role binding belongs to sign because remember in Kubernetes is a no user concepts in Kubernetes like sign is a user gone access to the this for a resource or that that user is not added in Kubernetes as a resource so if that's a limitation it never comes to limitation we need a role-based access control so role-based works like you first create a role saying you can access the cluster and have a read only permission to the orange namespace how do you bind this role to me you create a role binding object and then in a role binding object you say that this is a resource name kind kind is a resource let's say resource is a namespace in that resource name space you can't see a deployment resource and if you see it you can have errors so that is how this manually work it's a lot of moving pieces between them in order to and I think people is moving toward manually accepting manually creating RBAC toward automation approaches like Parallels what the Parallels does is exactly the same what Kubernetes is actually doing is giving you the RBAC model but hiding the RBAC detail from you so basically what it does is you log in via GitHub user or Google account or Google account or any account and you log in when you log in we create a role for you let's say in this project in this resource you can actually access this namespace and you can see a deployment and that is actually added for you on the fly when you actually access the cluster so when you access the cluster being an admin being a developer I don't have any worry like if I'm accessing a bad thing or bad access because I only have permission to what already provided to me by platform engineering team so I think the question right becomes now if you are manually doing it it's great but manual process fall apart it's very complicated it's a hierarchy it's so complex and it's a learning curve behind it so I see people are moving towards some RBAC solution Parallels is one of them there's a CubeScape that give you the RBAC visualizer and there are a bunch of other in the market that give you the automated framework for RBAC management okay that's awesome actually because you have already mentioned about RBAC and right now yeah this is how it works so again there can be another question like regarding this like are there any specific tools or framework that you recommend for simplifying and enhancing Kubernetes access management so from your own opinion or experience like anything you'd like to mention yes I think like there are some different models right now in the Kubernetes we have somebody is using toward the CRD model like you have a life you have a controller installed in the Kubernetes cluster what it does is if somebody access the Kubernetes cluster from a wrong permission model it detects it and it see from the policy like this person don't have permission to do these kind of stuff and it's blocked so meaning in front of Kubernetes and it's front of the Kubernetes door so meaning if you want to bypass this door there's a controller in front of you that is actually preventing you to do some harm in the cluster that's where we tools like in the past we have a dietary tools that's give you some kind of like jammer specific thing like you can't have a bad YAML actually in place in the cluster so they actually block you for doing that instead of waiting for the cluster to applying the cluster and the cluster tells you like there are some misconfiguration here it's telling you beforehand so these are the controller inside the Kubernetes I talk about policy engine like Kaivarno or open policy agent these do this kind of the great keeper thing and there are some tool that is actually apps and DevOps tools like this they create suppression of concern between application team and DevOps team and Parallels is actually one of those and what is Parallels is along you is actually platform teams can actually create permission model in the Parallels dashboard and the app team actually use the same permission model to access the cluster so that is actually overlapping what you call a separation of concern and then there's a gauge keeper tooling in Kubernetes and then remember access management in Kubernetes is as complex as landing as landing something into the into the moon because look at it you are accessing Kubernetes as CSI CNI service mesh GitOps from Mitius Grafana observability so much so having a one bad command typing then the forensic begins oh is it a runtime error is it a CRI error is it a CNI error is it a CSI error is it a service mesh error is it a GitOps error so though so much in place so I think is a better recommendation to be a prepared for security preparedness up front don't rely on day two or day three that's what we call a security preparedness with some of the open source toolie like Cubescape or Parallels and bunch of other available in the marketplace so I think having some of the tooling that provide automation is necessary but if you want to do it manually you can but you end up in a situation where you spend a lot of time configuring managing and deploying and the last time in the business domain like your job is to actually create some application that business consume and therefore do their work so actually you have very small amount of time to think about those things but I think having some automation tool or open source tool give you some good kind of visibility okay yeah that's a good explanation yeah awesome so I would like to add one last question and it would be like how can organizations strike a balance between granting developers the necessary access privileges while maintaining security and minimizing potential rates so yeah yes absolutely I think right now the organization typically need is like I think a lot of the enterprises is building Kubernetes platform and these platform has in big in functionalities like I tell you you have a zero trust security built in policy and enforcement built in GitOps and drift detection tooling built in networking tooling as well what organization is doing right now they adding a tool called zero trust security what this tool does is is similar to the same this tool is actually added in the platform what the platform team is actually do and their job is to actually create permission model for the application team because the platform team's job is to make the life of application team more easy after they actually doing something bad with the cluster they're telling them up front you have these right and if you need more rights let's talk to me I give it to the more criminal and then you work on the security so yes so I think I'll stop so I will repeat again so basically what organization is telling you doing right now you have a platform and then the platform has feature like zero stress security first thing first separate the concern between two teams platform team needs more ownership than development team and remember I tell in the slide as well not every dev and ops team member need an unrestricted ability to create delete and modify resources we all agree what we do we have a and we will tell platform team you have your job is to create permissions for application team today they can do their work best what they does is they can give grantee like let's app team you have a read only access to the resource name called deployment in that deployment anybody can actually list their deployment but if that person is from the next another team he won't access to it so you can first thing first separate the concern so you will actually look at the permission model and hierarchical model where you can give like here is a separation of concern once you identify the separation of concern next thing is that look for the automation tool that you give you the automated RBAC centralized visibility and kubectl trace of all activities like if I type kubectl get pod in a dashboard all of my activities will lock if something bad let's say my last command kubectl apply dash f broke something it's very easy to do a forensic out of it separation of concern number one separation of concern number two automation RBAC automated RBAC number three centralized visibility centralized tracing of all kubectl activity number four is do some kind of and look towards go towards policy and governance for compliance of your organization try to bring in compliance and cultural shift and what you're a virtual organization how your organization set up and then you actually create another loop out of it so I think these are the basic requirement for anybody using it I hope you get this answer to your question and thank you very much people in the chat as well if this information look useful for you yeah yeah awesome awesome thank you so much for these informative answers yeah I guess that's how we can end our session now right if there are any no questions left we can end our session yeah thank you I guess so yeah if you would like to add anything you can just mention right now like something like yeah Slack or something like that yes absolutely thank you absolutely thank you very much for I see a wonderful audience today in the chat today and number one I can tell you like I also have a YouTube channel called cloud native podcast and at the rate cloud native FM is a twitter handle where we have 80 plus episodes and I couldn't really see money to do a forensic of how and research around how other people feel like in the domain of Kubernetes and if somebody watching and we have a same domain they want to share their story do let me know we can conduct some podcasts on my YouTube channel as well also we have a cloud native Islamabad community where you can look if you look type search cloud native Islamabad on YouTube you see a bunch of very informative workshop on Kubernetes so do join those as well and if you're working on some open source project and want it to be a part of CNCF or if you are actually going to the cube gone if you have any interactions if you want to see me I would love to communicate love to hang out want to know your opinion so I can make parallels a better project thank you very much Shariah for inviting me and I really enjoy the time here despite of some difficulties yeah yeah I know issues I think this this does happen in occasionally so there's no problem yeah thank you so much time for your awesome session yeah let's just end our session now okay so yeah let's uh okay let me take you to the next with that thank you so much see you soon say bye bye everyone okay so yeah so thanks everyone for joining the latest episode of cloud native live we enjoyed the interaction and questions from the audience so thanks for joining us today and we hope to see you again


Thank you for checking out this video. So I don't really know what to call this in particular It's not really the monthly shutter updates that I've been doing where they kind of give it to you like within the last week of the month prior like what movies and Originals and exclusives are gonna be going on to shutter. They just kind of sent out a Press release kind of giving information about here's a bunch of things that are Going to be available during the month of October just kind of getting everyone ready for Halloween and just the month of October Because all of us horror fans just love to watch horror movies year-round, but even more intensely in the month of October Myself included I actually do make sure I do at least 31 movies throughout the month of October I think last year I got to like 35 so I want to see what I can get to But my feeling of why they sent this out in particular is is two reasons one I think it's to hype up creep show a little bit more which comes out. I believe the 26th Let me see. Yeah, Thursday October. Sorry Thursday September 26 So that'll be available in October and I believe they're doing it where they're releasing one episode each week Each Thursday kind of like they're doing what the show knows for a to that they have up there They're doing the same thing and I believe that's also on Thursdays that they're doing the release The other thing is for I'm not gonna give it away, but I'm gonna talk about it I mean I'll talk about it on this video But I'm gonna talk about it at the end because it's the last thing in the press release And I think that that in particular is the the main reason that they sent this out It's kind of like a hint at what's to come and I know some people watching us right now Their minds are already going so let me go through this real quick So they plug their creep show series like I was talking about don't really need to go too much into it if you want to know about it go back and watch my Video doing what's coming to shutter in September because I talked about some stuff in there As far as I know like I was saying there's gonna be one episode each Thursday and each episode is gonna have two separate stories The first one's gonna have a story from Stephen King and one from Josh Mallerman I might get early access to at least that first episode in which case I will do a pre-release No spoilers review, but we'll see about that then they put on here. I hadn't heard about this yet They're gonna have a new season of channel zero, which I believe is exclusive to them If people didn't know it was a sci-fi show originally for the first three seasons I believe and that's available for streaming on shutter right now So it looks like they're doing a fourth season, which is good because I haven't watched three But I watched one and two and I enjoyed them and I plan on watching three So this one this season is gonna be called the dream door and that's gonna be available October 10th And it says based on the creepypasta short story hidden door by Charlotte by water Channel zero the dream door follows newlyweds Gillian and Tom who have each brought secrets into their marriage when they discover a strange door in their Basement those secrets start to threaten their relationship and their lives Dun-dun-dun ooh Barbara Crampton is in it. Oh and Steven Weber. I like him and Steven Robertson I don't know who that is directed by EL cats don't really know much about him, but that sounds like a cool premise I really like that idea and Barbara Crampton's in it And I will support anything she does because I like her she's a cool person They put on here their show nose for a to which has been on there like I said they're releasing one each Thursday I think they have like three or four episodes out at the moment I haven't started watching it yet, but I do plan to do that soon Movies they're gonna have one cut of the dead. They don't have a release date for this one But I guess any anywhere between now and the end of October They'll have it up. It says TBD While shooting a low-budget single-take zombie movie the crew find themselves caught between actual zombies any mad Director who won't stop rolling if you think you know what happens next in the surprising zombie comedy think again I believe this is Japanese or South Korean. I'm not a hundred percent sure Then they have also to be announced when the release date is Tigers are not afraid a haunting horror fairy tale set against the backdrop of Mexico's devastating drug wars Tigers are not afraid follows a group of orphaned children armed with three magical wishes Running from the ghosts that haunt them and the cartel that murdered their parents. That sounds interesting I do want to check that out So that so it's interesting because when I was doing my Video on what's coming to shutter in September? They had two slots of movies to be announced and they have to be announced for one cut of the dead and tigers are not afraid So I wonder if those are the two things that are gonna fit into those slots Now they have be bells bells a booth Which is currently streaming which I actually have watched when I'm doing this and it's not gonna be released super soon But not this coming Sunday, but like the Sunday after that. I think I'm gonna release it So watch for that shocking deaths on the US Mexico border lead a special agent toward an ancient demon starring Tobin Bell and by Emilio Portes I Won't say too much. I Was in the middle on it. I liked it like things about it didn't like things about it Tobin Bell was really good in it, but Wait for my review Incident in a ghost land This is also available currently a mother of two is confronted with murderous intruders on the first night in their new home And fights for her daughter's lives 16 years later when the daughters reunited the house things get really strange Okay, don't see any people. I know in this, but it's directed by Pascal Lagy a that is very very interesting I believe it was Yeah, it's Pascal Lagy a who did the original martyrs movie actually So I definitely need to check that out. I wasn't aware that he directed this film I see I'd seen it on shutter, but I didn't really like look at it closely So now I know I got to check it out because log yay if anyone's seen the French version of martyrs Oh my gosh, unbelievable. It is ridiculously brutal, but it is a very good film So if you can make it through it's worth it The wrath which I already put up a review for I got a advance I got advanced access for it from shutter. Thank you very much. My review is already available. Look at my channel When a curse kills the sons of the kings and kingdoms highest ranking official a pregnant widow must face both a vengeful spirit and vicious family politics In this remake of 1986 Korean horror essential women's whale by young Sun Yoo Definitely check out that review Once again a few things not so great about it, but some really awesome things about it So look at my review that one is available Starting tomorrow when I'm putting this video up Hell House LLC three lake of fire This is coming out September 19th in the final installment guests both past and present will be forced battle for their souls as All is revealed about the infamous abandoned hotel in the evil that dwells there. I Don't know if I'm gonna check this one out. I haven't seen the first or second one I am gonna check it out at some point. I've heard the first one people really like the second one people are like Yeah, so I don't know how the third one will be, but I'll check them out the furies Comes out October 3rd Rebellious high school students Kayla and her best friend Maddie find themselves abducted by a sinister pressure Residents and stalked along with six other women by men in terrifying masks Interesting Note the furies will be in theaters in its home country of Australia on November 7th So it's actually coming to the shutter streaming service before it's going to theaters where it's made. That's kind of crazy I mean good for shutter to get that but that sounds interesting. I'd like to check that out Gwen this one is coming out the 17th of October in this Stark and Atmospheric tale Gwen is a young girl struggling with her mother's mysterious illness her father's absence and the suspicious local community That is turned on them somehow Gwen must find the strength to guide her family through the darkness and overcome the evil that is taking grip of her home Okay. Yeah Sounds interesting enough might check that one out haunt this one is coming out the 24th of October From producer Eli Roth love Eli Roth and the writers of a quiet place also like a quiet place on Halloween a group of friends encounter an Extreme haunted house that promises to feed on their darkest fears The night turns deadly as they come to the horrifying realization that some nightmares are real Okay, bye It doesn't say who directed by Scott Beck and Brian Woods Sounds interesting. I will check that one out This one I'm I'm very excited about because I like Mick Garris and these types of films is an anthology film Glad to see shutters getting this one because I really want to check it out Coming out Tuesday October 29th nightmare cinema a new anthology movie featuring segments from the acclaimed directors of gremlins Black Mirror Bandersnatch the Stan miniseries the midnight meat train and one of the dead starring Mickey Rourke He's in there Directed by Alejandro Bruget Joe Dante Mick Garris real eye Kitamura and David Slade good directors I'm interested Then they have this thing about their ghoul log. I didn't see the ghoul log. They have ghoul log and son of ghoul log I guess it's kind of like You know like those fireplaces that people have for winter time that you just throw up on a through streaming service Just on your TV and just have them up and they just run Fan favorite the ghoul log is back accompanied by an all-new creepier sequel set the mood for your Halloween festivities with shutters 24-7 feed of a candlelit jack-o-lantern accompanied by spooky night noises that does For Halloween what the you'll log video does for Christmas. I'm gonna throw that one up at some point actually I'll try both of them out actually at some point it says coming soon so it's I guess it's not available right now, but will be available at some point between now and The end of October That's kind of cool to just kind of have on in the background where you're doing things around the house I'll probably do that and now we come to the big thing the thing that I believe was the whole reason they were putting this out it says a special Halloween treat on The 25th of October that you'll want to stay up for late Details coming soon now a lot of us are saying at this moment. That's got to be last drive-in Joe Bob Briggs Okay, most likely it is and when I'm putting this out I saw on Twitter that Joe Bob Briggs had tweeted some of this information And he treated that little teaser and said gee I wonder what that could be So very strong indicator that that's what it's going to be Joe Bob will be back on the 25th most likely So that is awesome Especially in the month of October now the big question is is it going to be the kickoff of his new season of the last drive-in and it's the first episode of a double feature or is it going to be one of the Marathons because he had said in an article recently that they were going to do some more marathons So this could be a marathon or this could be the beginning of the season. I don't know But that's the last thing I have to say about this Please everyone weigh in on your thoughts put some comments down there especially about the Joe Bob thing Do you think it's gonna be a marathon or do you think it's gonna be the kickoff to his season two? I kind of think it's actually gonna be a marathon and then his season will kick off Maybe early next year or something. I don't know but either way. I'm gonna be happy with it I love Joe Bob stuff and I love how he brings these cool cheesy and awesome and obscure films to all of us viewers, so Thank you everyone for checking this out. Do me that favor hit the subscribe I really appreciate that keeps me going with these like I said put some comments down there Give me a like if you really want you but the subscribe is what really really matters Thank you shutter for doing everything you do you guys are awesome and until next time keep it brutal


Noun types in English grammar. Nouns are naming words which make up the most common category of words in the English language. Within this category, there are several different types of nouns with specific roles to play. Nouns are the most common type of word in the English language, and therefore make up a large part of EFL language lessons, particularly in lower level classes. As an EFL teacher, it is recommended that you have a solid understanding of the different types of nouns, so you can help your students make rapid progress in this area of grammar. Common nouns. Common nouns are used to name a general type of person, place, or thing. Common nouns can be divided into smaller classes, such as countable and uncountable nouns, concrete and abstract nouns, and collective nouns. Examples of common nouns, man, town, vegetable, friend, building, water. Proper nouns. Proper nouns are used to name a specific person, place, or thing, and always start with a capital letter. Proper nouns are rarely preceded by a determiner, though there are some exceptions. Examples of proper nouns, Jane, Rome, Jupiter, Friday, Italy. Compound nouns. Compound nouns are two or more words that create a noun. They can be one word, rainfall, joined by a hyphen, or separate words, water tank. The main stress is normally on the first part of the compound word, bedroom, washing machine. Examples of compound nouns, motorcycle, policeman, boyfriend, passerby, take-off, driving license, swimming pool. Countable nouns. Countable nouns are nouns that can be counted. They have a singular and a plural form, and can be used with a number. Examples of countable nouns, bus, table, fork, shed, ear, bird. Uncountable nouns. Uncountable nouns are nouns that cannot be counted. They often refer to specific subjects, such as substances, liquids, gases, and abstract ideas. Examples of uncountable nouns, wine, tea, meat, grit, air, oxygen, silver, happiness. Collective nouns. Collective nouns are words that refer to a set or group of people, animals or things. Examples of collective nouns, gang, team, crew, shoal, pack, bunch. Concrete nouns. Concrete nouns refer to people and things that exist physically, and can be detected by our senses, seen, felt, heard, smelled, or tasted. Examples of concrete nouns, cat, flower, orange, plate, shoe, pen, rain. Abstract nouns. Abstract nouns are nouns that have no physical existence, but refer to ideas, emotions or concepts. Abstract nouns are typically uncountable. Examples of abstract nouns, anger, stress, peace, honesty, faith, energy, adventure. Thanks so much for watching. We are ITTT, the leading provider for TEFL and TESOL training courses. If you like this video, please subscribe by clicking that button down here, and click on any of the videos here on the left for more interesting teaching tips for getting certified to teach English abroad and online.