Final question, because this congressman, this chairman, America, you know, this is the battle between good and evil, and America is always on the side of the good. Is America always on the side of the good? No, we wish we were.  We look at our history. There's times when we've really erred on the side of, this fellow is on our side, may not be to our liking. I think there's a famous quote in American history.   And so, no, but more and more, you know, you asked a question about the use of force when it's appropriate, you know, there's just war theory and international law, and we try to follow that as much as possible. Can I ask a question and connect the two conversations before the movie and after the movie? Because the argument before the movie was to kind of try to re-Christianize Europe with the help of crusade and kind of wimpy Christianity that was associated with pacifism was kind of put down. What I wanted to ask then is, what does one make of, say, the claim of the Apostle Paul, which is a very, very famous saying, do not be overcome by evil, but overcome evil with the good, right? So, kind of, there's a fundamental framing of resistance within the moral frame of not just pursuing good but acting in a good way, right? Whether crusade is compatible with that would be my question to you, but to Mike as well. This history was narrated starting with the drive of Russians over the Soviets from Afghanistan. From your perspective, would that have been the case of trying to overcome evil with good? In helping the Afghans defend themselves? In this entire story that was there, is this the case? Is this how one overcomes in your judgment evil with good or do you accept this as a principle? That actually evil cannot be overcome by simple force but the evil has to be overcome with the good. The reason why evil doesn't thrive is if it is overcome by good. No, so I think it's both, but I mean if I understand what you're saying, would we have been better off if we didn't fight the Second World War? I think not.  I think the world is a better place because we won the Cold War in the west. I think the same thing about the war with the global jihadists in al-Qaeda that they killed a lot of Americans. I don't have any qualms about capturing them or killing some of them. I think again you have to use just war theory that you have to have a right cause, you have to have proper authority, you have to have a reasonable chance of success, you have to use proportionate means, but one of the core principles in international law is the right of self-defense. So the Soviets invade another country, does that country not have a right to defend itself? I think it does. This goes back to the conversation at the earlier, the earlier conversation at the first table when you asked why is good weak and if one considers the question in the framework of international relations, I think one of the answers has to be is that too many good people confuse goodness with innocence and goodness implies agency. If you're going to act against evil, then the word act implies that you possess the capabilities that are necessary to act efficaciously against evil, which means, and this is what I'm getting at, in order for good to be effective in the world, people who believe in good, and we can define that in a thousand ways, have to overcome a certain allergy to power that they sometimes have. I mean, one of the reasons, in my view, that the world right now is the most Hibisian place that we have seen since before World War I and why there is so much, so many atrocities and cruelties in the world committed by governments against their own citizens and against citizens in other countries is because the United States has quit the world. We are gone. Obama started pulling us out, Trump finished it, and basically it is springtime for dictators right now. Inaction will always bring trouble. Thank you. When you have a lot of... I do believe, I truly believe, even though I'm a guy who saw a lot of evil people and evil deeds with my own eyes and I survived through it, I truly believe that the mass majority of people are good and kind, and that we can all live together and we can all help each other. But when this huge amounts, huge crowds of good people see bad people saying bad ideas, radical ideas trying to attack the truth as a concept, as itself, to try to do all these harmful things and keep just asking them nicely or trying to somehow convince them that this is wrong and you should stop doing it and they keep on doing it and we don't do anything about it. That's how we lost. Inaction will eventually bring weakness and eventually will bring disaster. Syria was an example. We got sold out for the Iran deal. I spent Obama, Seoul, Syria as a part of the Iran deal to get his legacy passed. I spent a lot of time in D.C. I went to congressmen, I went to senators, to the White House, to the DOD, to United Nations, to the Security Council. I've been all over the place and unfortunately, unlike your movie, I didn't meet a nice congressman who will just take this on his shoulder and pass it on. There was a lot of good people inside the U.S. government that action is necessary in Syria, but unfortunately Obama sold us out because of his legacy. What does it take for us to become more humane or more simple?  I have some experts around the table who can tell us when we will have some peace in the Middle East. Mike, what will be your strategy? So you make your president. We get Trump out and you'll be there. Number one, Islam is a great religion and great culture. We in the West are not at war with Islam. We are at war with a small group of global jihadists. There are 1.5 billion Muslims in the world. There are about 200,000 global jihadists if you count generously. The strategy then has to be to deal with those 200,000, not try to alienate the 1.5 billion. That's precisely what the global jihadists want us to do. They want a clash of civilizations between Islam and the West or basically the Islam and everybody else.  The Islamic states are our best partners honestly in this because ultimately it's an intracivilizational conflict. You know, we have to help them restore stability to their areas. But civilizational clash would be a disaster. If you thought the Crusades turned out badly, try this one on for size.


What's up guys evil D here and I'm back for some more Esperanto slash World of Warcraft now I mentioned this in the previous um V blog which I did in Esperanto So if you didn't get this I'm just going to give it to you now Basically, I have changed the way I'm doing my videos. Um, so basically Saturdays and Sundays will be gaming no, sorry Sundays will be gaming videos and um, also Tuesdays and Fridays, yeah, I believe that's right. Anyway, I'm building like a little schedule type of thing Now you probably noticed that I look slightly different. I'm no longer a tauren Well, I'm actually just playing my other character today because Some of you guys I'm mentioned that you're just getting a bit tired of just seeing me running around killing mobs So I figured I'll do this Esperanto lesson while playing a battleground and then maybe next time I'll do one in the dungeon just kind of like jump us ahead character wise Just to just to give us something new to do type of thing. Anyway, so let's begin with the actual lesson So first up And this is going to be interesting because I'm going to be trying to save people and get them alive while teaching you So what was the word for scout? Now when I say what was the word? I mean the traditional word not the one built from the verb It was sculptor sculptor And do you guys remember the word for um scout but built from the verb? It was esploristo esploristo and what was the verb to explore? it was Esplordi esplordi and do you remember how to say to see? It was viddy viddy Um, and how do you say at the base of the tower? C'è la basso della toro C'è la basso della toro. Okay awesome. Let's begin Okay, so I am still a healer just like with my other character except now. I'm Just a high level. I'm actually only 46. So not that much more impressive Anyway, let's get into battle So Let's have a look what we got. We got the enemy over that way.  He looks high level Okay, and what was the word for spider? It was araneo araneo And do you remember how to say something? it was io Io and what about how would you say he stands at the base of the tower? Li stardas c'è la basso della toro Or not no speed boots there.  Oh, by the way, that's the objective of this battle We're fighting against other players and the objective is to basically get the flag and win the game You gotta do it three times. Okay, and how would you say? He sees the enemy Li vidas La malamicon and in fact, he doesn't actually see the enemy. I didn't see the enemy anywhere But we're all grouped up here. So we're we're pretty safe Okay, I'm going to teach you the word for that by the way. So the word for group is Gruppo Gruppo so to say we are a group. What do you think you would say based on what I've taught you in the past?  So the word for priest is pastro pastro. Okay. Oh, oh come on Can I get that? Oh, it's a thumb down for some reason Okay, I'm going to head back this way I'm still getting used to all the new stuff in this game because it's been ages since I played it. Okay, and So the word for priest is pastro, but I'm actually a healer. So my job is to heal people So the word for health is sarno sarno. Okay Now if you want to turn that into a verb you'd think naturally you'd say sarni But sarni is actually an intransitive verb and it means to be healthy Oh, this is going to get crazy Okay, so I'm going to heal him because that's my job in here. So Me the way you would say that you'd say me sarni gas limb because remember how I taught you before that Oh, I'm under heavy attack So remember how I taught you before that? The Iggy at a verb it means To do so to do the verb whatever it may be Oh shivers me timbers. So I have to heal myself.  I'm awesome Okay, and I'm going to teach you the word for um must okay So the way to say must is devas devas. So to say that You'd say um to say I must heal myself. You'd say me devas sarnigi min me devas sarnigi min And how would you think you'd say um, I must heal my friend Oh, but in this case I must heal myself me devas sarnigi min Oh man, this guy is going all out on me. You've got nothing, mate So how would you then say he must kill me? How would you say his priest must heal him?  No, that didn't work very well Oh, come on How many people are on me Jesus? Oh, this is getting really crazy right now.  He's running around in the circle basically the entire time. That's all he's been doing Okay, so I'm now a sheep. So I was just a sheep So the word for sheep is shuffle shuffle and the way to say um, he sheaped me Because that's what you do when you you polymorph someone in this game, which is you basically turn them into a sheep So, uh, bugger me timbers. They actually killed my guy because it's just me a healer versus all them So he turned me into a sheep.  Okay, so Again, like I said before the standard way to say a priest in this game is pastro But i'm actually healer. So a healer is someone who Obviously causes someone to be healed.  So li shafige's min But he doesn't realize that when you do that you actually increase the person's health like respawn rate So he basically just like defeated the whole purpose unless he just wanted to Shafige min so that he could run away so that he could fuji.  Oh, I want to help my guys Okay, let's get on my horse or it's not actually a horse. It's a deer. So what was the word for deer? It was sort of all sort of all Okay, okay, I need to heal him. So how do we say I must heal him? Mi devas sanigi lin Mi devas sanigi lin Okay, also apparently i'm still in combat. So I can't get what in god's earth is that type of mount That is a crazy mount Okay, that is an insect Um, I think it's an insect some type of creature like that. So the word for insect is Insect insect pretty easy to remember because it sounds like the english word. So Is that guy an enemy? No, he's a friend. Okay, cool. Cool. Okay, so We're gonna learn um a little bit more with the accusative case now This is going to be interesting because I am currently going to be in a massive battle in a second So let's see if we can do this. Oh Oh Okay, so the way to say where As you already know is keyer keyer Okay, now if you want to say, um, where are you going you'd say key and the edas Okay, now you notice I put the accusative actually onto the where which is keyer and the reason I did that Is because oh come on. I got it.  That is not good at all Okay, so how would we say they want to kill me? Oh, come on. Why is everything No Mi ne valas ke vi modetigumin. I just totally taught you some new stuff that you didn't even know Okay, so let's just um, let's just focus on what I just taught you.  Okay, and you notice how it's actually um Oh, I've got to really save my guy right now Oh, come on. Come on. Come on. Come on. Don't run away. Mi devas sanigi lin so Oh Dammit, I'm going into the hut. I'm going into the hut. Mi en idas ladomon. Mi en idas ladomon and buss. Yes You got nothing, mate. You got nothing So to say I um, oh is that guy an enemy?  So how would you say I don't want you? Um to think of wash me. Okay, that's a verb we learn So how would you say I don't want you to kill me Mi ne volas ke Vi modetigumin and what you're doing here is when you're saying that Um, when you're joining two sentences like that, you'll notice that you use she just got owned bad That was awesome, mate. Good work So how would you say he just killed her? Okay, I haven't taught you just so I'm going to teach you that right now So the word for just is just just okay, so he just killed her is Now I know I'm throwing lots of random stuff at you But that's cool because I plan to do more of these lessons where we're in pvp And of course, we're going to be repeating the same words over and over until they're ingrained into your little caps your little heads Um So yeah, don't don't thread if you're not getting all this right now because even I'm not getting the ball I'm just kind of all over the shot. So yeah, how would you say, um, he just, uh, healed me Heal him What does that mean? I'm now healing him. Mi nun saniga slim and I'm also lagging really really really badly Like oh my god, that was terrible. That was bad on a bad scale of like one to a hundred Oh man, okay, how do you say I must heal us? Mi deva sanigi nun Mi deva sanigi nun I'm gonna get that. I'm gonna get that. I'm gonna get that.  Oh, this is not good. This is not good. This is not good. Get up here.  Mi deva sanigi nun.  So mi fujas mi fujas. Oh, you're not gonna get me at all. Okay. So how do you say I just flee? Mi just fujas Mi just fujas Oh shivers me timbers.  This is getting bad. This is getting bad You will not kill me the name or the tea cost me the name or the tea cost me.  So I hope you've enjoyed this lesson I know this was probably not the most structured lesson But I wanted to mix it up because I think some of you guys were getting a little bit bored of what I've been doing So I'm trying it new a new way of teaching you words. I will Refocus on the same words. I just taught in the next lesson So if you've enjoyed this give it a like Share it around with your friends subscribe to my channel if you haven't already and I'll see you in the next video And if you're not there, well, you're not getting any of my heels


Alright, what's going on everybody? This is Tuko from Music IDTV and this is Use the News. So we know that analytics are a huge thing when it comes to the music industry. We know we should pay attention to our data, all the metrics, but how do we kind of funnel through all these different sets of data? I mean it comes from a whole bunch of different platforms. There's so many avenues we can try and take with our music. What should we really be paying attention to outside of Spotify playlists? We already know that's one data point we really want to measure and really try and get our music on but what else should we be paying attention to? On this episode I'll be going over seven data points that you should be measuring your music by outside of Spotify playlists. Number one, SoundCloud followers. Now SoundCloud is still a viable platform with over 175 million global users and it has the power to kind of build artists up autonomously. If you had a presence on no other platform but just a presence on SoundCloud you might still have a chance of building some sort of community on that platform. So SoundCloud if you're going to take that route you should definitely pay attention to your SoundCloud followers and try and get those followers up. Number two, traditional radio. Now these charts are helped by Chartmetric which is a website I suggest people taking a look at. Kind of breaks down all your different platforms, how well you're performing on that, different artists. You may not be on there but you at least get to see what other artists are doing who have some sort of presence that Chartmetric has picked up on. Now they have radio spins here. I don't really suggest radio as a point that you should be focused on as a new artist but I wanted to go over it because I wanted to understand a little bit more of what's happening with radio. One thing to note from this chart is that the radio chart is pretty much just littered with Ariana Grande songs. Literally she's the only person on this chart. There's nobody else. So there you have it. Are we Ariana Grande or nah? I don't think that we are so let's just move on past radio. Number three, Shazam Spikes. Now Shazam is a way that the industry can use to really correct people's interest in something because Shazam is one of those things you can only do one time. When people shazam you that one time they can count that metric as hey this isn't some sort of bot being interested in the song. This Shazam spike shows that there's some sort of interest happening and kind of growing for your music or whatever that song might be. I also feel like you need to consider making sure your music is on Shazam. Of course they're going to make sure they shazam the popular song because they hear the popular songs more but if they hear your song that's going to be more of a reason for them to shazam because they aren't familiar and Shazam's going to tell them and lead them to you. So make sure your music is available on Shazam as well. Number four, regional data. Where is your audience located? Where are they located? How interested they are in your music is going to matter if you have a huge fan base in LA but it's kind of weak in Baltimore but it's decent in San Diego. Hey you got LA San Diego regional and then you'll be able to hit some sort of shows in those regions. Knowing where your fan base is will help you put together a tour to promote yourself and your music. So knowing where that is is something you also want to pay attention to. Number five, Beeport. Now there is still a sector of the music industry who still uses downloads. We all know downloads are on a downward spiral. People are rarely downloading things but DJs often use downloads when they do performances because they don't want to have to be bound to needing Wi-Fi and enough CPU power to make sure that they can play the songs they want to play. That would be a disaster for DJ if they ran into any of those issues during a live set. So they often use Beeport. If you're trying to service your music up to DJs make sure your music is available on Beeport. If you feel like it's fitting you'll get those downloads and also the downloads cost a little bit more than they do in the iTunes store so a little bit of extra change too won't hurt your pockets. Number six, TV, film and commercial ads. If you can get your music synced in television, film and commercials that's going to do really well for not only your pocket and your exposure but I believe it also do well for your Shazams because who does not Shazam a new song they hear on a TV show to see who it is if they really like it. I mean I do that all the time. I feel like somebody I might do that too put that in the conversation if that is the case. So really look into making sure that you have some sort of strategy to at least attempt to pitch some of your songs for TV and film. It's an option and there's a way to make a lot of money and you don't have to be popular to do it so really think about it. Number seven, listeners and follower ratio. So if you have a ton of followers on Spotify but they aren't listening to the music or releasing they are helping you gauge how interested they are in your releases. You want to have this ratio at a really low number meaning that you have a ton of people who listen to what you release if you got 80 people at least 70 of them are listening. If you have 80 people following you and only 20 or 15 are actually listening that's a sign of a problem. So you want to get that ratio a little bit lower because that's a pretty large ratio from 80 to 15. So you want to make sure you're paying attention to that as well. And those are seven metrics that you should be paying attention to when you release your music. Now you don't have to do all of these things. You should choose the strategies that work best for you. If you wanted to hit them all you have the resources to do that that's fine as well but these are things you should truly be paying attention to when you release your music. Getting that data back is going to really be important when you're considering doing a new release. You need to know what went right what went wrong and what you should do next. So let us know your thoughts in the comment section below. Is there anything you feel like I miss besides Spotify playlist because this one is about not focusing on Spotify playlist. It's about what else can we focus on if that isn't the case for us. Beyond that once again I am Tuko. You can follow me on Instagram at tukoim and if you like my videos like this be sure to share with the friend like and subscribe and I will catch you in the next vid. Ciao!


Okay, so effectively, we have built magnesium in the planetary model of an atom, showing its inner shells and its vaginal shell, and all of its electrons associated. So recall what we said, that atoms are stable when what? When is an atom extremely stable? When a shell is filled, when it's what shell is filled? Outer or valence shell is filled, right? Is magnesium's valence shell filled right now? No. No, why not? It has to have eight electrons in it, but it only has two in it, okay? So this is a common occurrence with these main group elements, right, that are not noble gases. In fact, all of them have a non-filled valence shell, except for the noble gases. Does that make sense to everybody? Okay, so effectively, none of them are as stable as their noble gas neighbors. Does that make sense too? Okay, so in order for these things to become stable, these other atoms, what they do is gain or lose electrons to make them more stable, okay? Is everybody okay with that sort of analysis? So now we gotta look at magnesium in particular, since this is the particular problem we're doing, and ask ourselves, would it be easier for magnesium to gain six more electrons or lose two electrons? And now before you say anything, imagine that the ease of gaining an electron and the ease of losing an electron is equivalent, okay? Even though they're not, okay, inherently, but just pretend for these problems, okay? So if it's as easy to lose or to gain an electron, what would be easier for magnesium to do? Lose two electrons or gain six electrons? Lose two, right? Everybody knows that. So when you lose two electrons, we're gonna go from magnesium to magnesium, what did we say? Plus it's two electrons lost, so this has to be magnesium, what? Two plus, right? Magnesium two plus, like that, okay? So when we do that, this diagram is no longer accurate, right? So what do we have to show? So take off those two, but also the whole valence shell, and in fact, we have a new valence shell, right? Is everybody okay with that idea? Okay, so now, is magnesium two plus, is magnesium without those two electrons very stable? Yes, it is. Why is it stable? Well, it's got the neon electron configuration, but even more specifically, it's got a built valence shell, right? And you're absolutely right, even though we haven't discussed that, you must be ahead in your homework, right? So what's going on is what we'll say is that this has the same electron arrangement or configuration as the noble gas that it went to, okay? So this magnesium two plus is equivalent electronically to neon, okay? Or it has the same electronic configuration as neon. Is everybody okay with that? Everybody okay? Okay, so remember, for right now, you know that it's as easy to gain or lose an electron. So whichever one you're closer to losing them or gaining them to that noble gas, that's what you'll do, okay? Any more questions on this particular problem? Okay. Remember, the planetary model of an atom is not the way atoms really look. So when I see like this, I'm just like, oh man, I have to write that, but you guys know we're going to kind of change that analysis of what an atom looks like, okay?


Hello, and welcome to Admission Control. We have a problem. I'm Ryan Jarvanen from Red Hat. You can find these slides at this bit.ly.k20ac. And here's the schedule link. You can find me online as most places as Ryan Jay. I'm a developer advocate on Red Hat's OpenShift team. And I would like to give you one admission right off the bat. I have somewhat of a particular focus or motive in my approach to this talk. I am particularly interested in making sure that I can have a sustainable productivity when I'm developing using Kubernetes. Kubernetes is great, but usually I want to make sure I can also accomplish my day job. And so I want to make sure I give you a good sense of the balance between learning all about the advanced features of Kubernetes and being realistic about what you may actually be able to take advantage of. So hopefully this talk fulfills all of those goals. So like I said, I'm looking for a reliable platform that allows me to focus on my day job. Goals for this talk, I want to make sure you understand the primary role of admission controllers in Kubernetes and understand typical use cases for admission control and also when and how to avoid this topic. So first up on the agenda, I broke this into three parts. We've got admission control basics. Next up, dynamic admission control. And then, like I said, when and how to avoid this topic. So first, admission control basics. Admission controllers play a critical role in securing the Kubernetes API and control plane. This diagram is a little bit outdated. I think I have a, of course, totally fake. Let me get you a hopefully a more accurate API pipeline model that fits a little bit closer to realistic what you might experience in Kubernetes given a recent version. Admission controllers are going to, basically you'll see new requests come in, through authentication and authorization. They'll hit the admission control and first hit the admission control plugins. If you want to see the upstream docs, I definitely encourage you to take a look. Oh, I see a question from the audit. This is actually a list of questions I got, questions and answers I got from reading this doc. So is this why my operators and CRDs are failing to work correctly? Quite possibly, actually. Differences in admission controller setup are one of the major, most common reasons why an operator may fail to function correctly on a cluster. How might I enable or disable an admission control plugin? Well, it's pretty simple, actually. You just use the enable admission plugin flag when you're starting up Kube API server as one does since we've all done Kubernetes the hard way. I'm sure we're all manually starting Kube API server. How do I find out which admission controllers are enabled currently on my cluster? Another easy one, you can run kube API server dash H, grep for admission plugins and you should be able to see that's assuming you know how to find kube API server in your path and you have root access on one of the control plane nodes, right? So as much as this is theoretically easy, standard front-end developers might not have access to all of these pieces on their own. If you're using Minikube, for example, you could type in commands like this and find out the list on your setup. I ran this with Minikube, I think on a 118.2 cluster. I got the same result on a 192 cluster with Minikube, which I think is set up via kube ADM. So I did a Minikube SSH to get access to the control plane and then ran PSA UX, grep for API and then passed it through this set expression here in order to parse out just the list of admission control plugins. So this worked, it looked like this was maybe started inside a docker image so I'm not sure how easy it is to actually just call kube API server from the command line but this got me kind of what I was looking for. You can run the same type of thing against an OpenShift cluster if you have administrative credentials. You can actually get some of this information using the API which is kind of interesting that they have an API configuration available on the API but that's kind of an interesting OpenShift approach. So you could run kube CTL get API servers slash cluster dash O YAML, grep for admission and you should see something about the plugin configuration in the response. Here's a link to the dock up here on the same admission controller page just a little bit further down. There's a nice index on what each admission controller plugin, the standard plugins, what they offer. So two that I'd like to point out that are here on the page and let me enhance, zoom in a bit. Always pull images is a mutating admission control plugin and so this is actually going to rewrite some of the request when you create a new pod and enforce that the image pull policy is set to always. This is kind of a security feature. Another one that's been deprecated as of 113 is the always deny plugin. This is I think more of a validating plugin and this is going to look at every single right request and reject every right so you could still do reads to a cluster but this basically puts the cluster in a kind of read-only state essentially if you were to enable this always deny plugin. So how might that look if we were to look at this API pipeline? A deny might come in during this validation phase. You might have some type of hook to evaluate it. Similarly with mutating, you have kind of an earlier phase that occurs to perhaps modify add in that image pull always rule into the pod spec. So that's kind of how you might see this flow of interactions and it's all before you get to the basic crud access on the resources. So similarly in some ways you could say admission controllers are a bit similar to kernel modules in so much as they operate with elevated privilege scope. They are probably best configured by a system administrator or someone who's got access to updating Kube API server flags and this is absolutely not a good way to package or distribute application code or even frequent changes to policy on your cluster. If you have to change flags on the API server, this is not a dynamic API centric way of making changes to the admission process, at least what we've seen so far. Also we're also going to likely require access to a modern API release for all of this to function as expected. So specifically if you want to use some of the new pod security policies those have been marked beta as of Kubernetes 119. Here's a link to the docs for that. If you want to use the dynamic admission control endpoints, you need Kubernetes 116 or newer if you want to use the V1 APIs. So to review part one, first I want to make sure we have got an understanding of how admission controllers are enabled, disabled and configured on a cluster. Hopefully I covered that reasonably well. Second thing I wanted to emphasize is how configuration of admission controllers can be used to enforce basic security policies for your cluster. There are two phases of in the admission control pipeline that you want to focus on for this talk. Validating and mutating. Mutating is going to come first. Validating will be the kind of finalizing phase. User experience notes. This is a little bit like a sledgehammer. Like I said, not designed to distribute quick, frequent policy changes if you plan to do that. So and I think one of the top use cases for my purposes at least is to enforce consistent operational rules for disparate clusters that are part of a release pipeline. That's always I want to have zero surprises as my code rolls out to production and so I want to make sure the policy matches everywhere whenever possible. All right, on to part two, dynamic admission control. This is where things get a little bit more complicated. Requirements for dynamic admission control. I mentioned you're going to need these two admission control plugins enabled or else dynamic admission control won't work at all. This is like one of those things. If you don't have the plugins enabled correctly in the first place all of your operators and extension points or even the whole API might end up in a read-only state if you have that deny plugin enabled unintentionally or something. So these two, you're definitely going to need these plugins enabled. You should have those by default with 116 or newer especially if you want to use that V1 API. That'll give you V1 versions of the mutating and validating webhook configuration data types or kinds. So one more point along this topic. Since you are setting up a dynamic admission control endpoint this is going to involve basically making a webhook call out to a service that you host and that service, the name of the mutating webhook or validating webhook must be a valid DNS name at least within the cluster. So you could use a service and a deployment but if this is expected to be up as a dependency of the API you, I don't know, we want to make sure you model that correctly having the API pipeline be dependent on things hosted by the API can lead you into tricky situations when you're doing updates of services and things. So watch out on that. For more information via the docs, definitely look at there's a whole URL there. Enable the extensionable admission controllers webhook configuration section in the docs. There's a lot of nice examples in there. This is one that I actually screenshot I pulled out of the docs. Here's the URL for it. So if you were going to register a validating webhook on the API this would give you a chance to set up your own custom dynamic admission control and in this case it looks like we're going to be watching create operations on type pods with API version v1 with some namespace scope. The DNS name of this service is going to be example service so hopefully that's resolvable and we have a timeout down here as well. So on these distributed systems you can't wait forever for the webhook to respond so it's nice to have values like that. Yeah, zoom in a bit on that. So how would that look in the API pipeline? Like I said before, requests are coming in at the top corner there. We're going to get our mutating webhook after it's been registered. This will make a call out to that service. Same with a validating would come in at a later phase in the pipeline so you can make sure you're validating things that have already been modified and that there aren't going to be further modifications in the pipeline. Once that's successful this will hopefully get written to EtsyD but this always should allow you to enforce how things get written to EtsyD including security restrictions on pods and other things like that. So dynamic input validation examples. What are the use cases that I might want to build a custom controller and make my whole API pipeline dependent on some new service? Sounds crazy. Why am I going to need to do this? Usually this is kind of operational policy that you might want to implement. This may very well break some operators. You know, I don't know if this is a good idea to say we're going to always reject all images tagged with latest but it's something you could potentially do as a policy. You might be able to actually do this via a regular expression via OpenAPI. Well, I'll talk about OpenAPI spec in a minute. You could also do things like, okay, I want to make sure my EtsyD member count has to be an odd number and it has to also be between 1 and 11. You know, you could have really kind of complex functional input validation on these custom controllers. If the custom controllers are really advanced, you know, you could use the Go client. It can even make further calls to the API to update other objects as well if it's a more advanced solution. So here's a webhook example. You can actually write this in a variety of languages, but here's a Go client example if you're interested in seeing the stock example. So to review dynamic admission control, we've got a couple points here. First, I want to make sure we all understand how dynamic admission control webhooks are used to validate or to coerce any write request as they pass through the API pipeline. The validate phase, like I said, will not begin until the mutate phase has totally concluded. That's any time mutates available, at least until that timeout hits, right? Review security use cases and implications. Let's see. Oh, yeah, I mean, before I move on, you could potentially with this mutating webhook do all kinds of crazy stuff depending how much access you have. You could potentially listen in on every write request to the API and forward it out to an external cluster if, you know, or other kind of malicious purposes depending. So be careful. You want to make sure that these are locked down appropriately and kind of standardized and that's why not all of it is even possible to update via an API, right? This is really about standardizing and securing your clusters. So part three, how do I avoid admission control and why did I show up? Why did I need to learn about this? Well, okay, so you want to make sure you select the appropriate abstraction and solution for your scope of work, right? So if you're involved in securing your Kubernetes clusters, there's a couple things to establish, you know, an operational baseline for a cluster.  You can also establish further operational rules for platform services via the dynamic admission control or by using operators and CRDs. One of these here has a, you know, they both actually are going to require admin access, but CRDs and dynamic admission control endpoints are possible to update over the API. So huge advantage in terms of how quickly you can iterate and change these things. Solution number three, you want to also focus on offering standardized application control. So for me as a developer, I can skip the whole admin access requirement if I focus on app CRs and Helm charts. That gives me simple ways to update my application code, my config, push updates into the cluster, no admin scope required. And if I'm on the end of the team, maybe a team lead or someone who's trying to standardize that app interaction, we can use CRDs and open API spec to help restrict and validate some of the input. And hopefully once you establish these mechanisms for standardization, you are able to apply them evenly across all systems in your release pipeline. So you have a consistent operational kind of situation throughout the whole pipeline, right? No surprises for developers, maximize productivity by minimizing bad feedback. So why should you learn about admission controllers? Honestly, the answer is so that other people on your team won't have to. Not everyone needs to know about this topic if you're in the business of offering a standard interface to junior developers or other folks on your team. This is definitely something you want to make sure the right person on your team gets this info and is able to standardize the experience for other folks. Should I avoid writing and maintaining custom controllers that may impact the operational reliability of the core platform APIs? Yes, whenever possible. Always avoid this if you can. There are other solutions. Should I use Helm or application CRDs? Yes, absolutely. Yes, use those instead if you can. Like I said, if Helm's an option for you, use it, right? If you are doing dynamic admission control or application CRDs, you can take a look at actually more dynamic admission control specifically in Go. You can start with a Go client, but if you want a more modern tooling that will help you build CRDs as well. Take a look at KubeBuilder for development in Go. This operator framework is another option that will allow you to develop in Go. And it actually uses KubeBuilder as of the 1.0 release of operator framework. So you hopefully get the best of both worlds. Ansible is another option. You can import Ansible roles and run them using an operator. Also, you can import Helm charts and then make them available using CRDs. Both of these solutions, KubeBuilder and operator framework, include support for using Open API spec for schema-based validation of inputs. And here's one more link to that Go client as a potential implementation option. Open API spec schema validation. So here's an example from one of my team members. This is a custom resource definition. Let me zoom in on this a little bit. Looks like we've got here, we could see there's a validation section. Open API v3 schema. There's a couple things that we're calling out that we're going to validate. If I scroll down, we can see here in the spec area, I'm looking for a value called size. That's an integer. And size is required. It's not a super complex validation and really is just validating the schema more than the values themselves. But this hopefully can be easily done using Open API. And that can be used regardless of whether you're using admission controllers or not. Any kind of interactions with Kubernetes API that's generally considered a best practice. Part three review. So we talked about using application CRs and Helm charts as an alternative for targeting developers. No admin permission scope required there. Using Open API spec to provide schema-based input validation for custom resources. You can use kube builder or operator SDK for custom validation and translation of API requests. Hopefully all of this together gives you a reliable distributed platform that allows you to focus on your day job. Just like I am struggling to focus on my day job. Goals for this talk. Hopefully you've come away with a clear understanding of the role of admission controllers. Typical use cases and when to avoid it. If not, I'll do one quick recap. Primary role. You've got a request validator, request translator. It's there to apply security and you want to have admin access.  Denying privilege, denying host path, host PID. You can do dynamic input validation. More complex validation using the tools I recommended kube builder or operator framework. And the goal of all this is to ensure consistency of your cluster and hopefully standardize policy between clusters in a pipeline. Alternatives. Definitely developers stick with Helm or application CRDs whenever possible. Don't muck up the API pipeline unless you really have to use open API spec to provide schema based validation and consider using kube builder, operator SDK, operator framework. Or evaluating a hosting provider that includes a strong set of admission control defaults and a clear plan for distributing updates. Some of the testing I did was on learn.openshift. That'll give you a free one hour session on an OpenShift cluster if you want to see what the admission control policies look like on that system. Go ahead and give it a try. Here's a couple links to summarize and a couple talks that I found very inspiring. Go ahead and hit pause on your video if you're watching to get all those links. I don't have time for questions today, but take a look at the chat. I'll try to answer questions in chat for the live folks. Thank you very much. My name is Ryan J. Ryan Jarvinan. Look me up online. Thanks all. Hope you have an excellent kube con. This has been admission control. We have a problem. Thank you all. See you next time.


Good afternoon everybody. So, I represent Integrated Development Lab. So, this way we have floated one of the project, just like to tell you about it. It's called as OpenRap. So, OpenRap is an open resource access point. So, generally you have just heard of access point as a Wi-Fi access point and all this thing. But this is going to be an open source resource access point. So, what are the different resources that we are just going to explore it. So, OpenRap is used for offline localized content delivery network. You must have heard of content delivery network during your course time for the network. So, this also point towards that only. So, content delivery networks are basically you have lot of big servers and all the things are there which is used by Alkama and many other big giants company. But they have very farms of servers doing all this work. But this is going to be a very small CDN which is going to run only on Raspberry Pi. Have you heard about Raspberry Pi and worked around Raspberry Pi? Yeah. So, all these things contents will be we have to deliver through Raspberry Pi in the offline mode. So, I have just given you a very basic because this is just an origin and one user of course it takes some time. But if there is a caching server or a content delivery network in between the same content can be delivered very fast to the user and the main load to the original server will be very, very less. So, where and how we are going to use, why we are building this thing. So, preloaded digital courses like we have courses like XTEP and ITBX or many other things which are there. So, all instructions like you if you have anything offline content on your local system and student can access all these contents locally. So, it will be a very easy for the local colleges or institution to access those resources fast instead of wasting the internet bandwidth every time for each and every student. So, same thing is a preloaded image preloaded digital courses or content for the schools or institutions. So, again for the teachers training reference material offline digital library of Wikipedia and Khan Academy because this was actually we have just thought in terms of putting the contents for the school. So, that is why I have just mentioned for the Wikipedia and Khan Academy which allows to have one courses like for the school if I just say I want a whole course material for eight standard CBSC board. So, all the materials is available for me which I can download and keep it offline mode. So, I do not have to or each student do not have to go to Khan Academy and try to refer it. If that thing is available locally why do not you use local network rather than wasting the whole bandwidth. So, project deliveries are particularly this one. So, installation and configuration of open wrap with eggstep and sunbird for local and offline an online version why I am saying it is online because eggstep is one of the online system and sunbird which is going to be a local system. So, again then this is going to a very huge task installation and configuring this thing with various platform this only eggstep and sunbirds are mentioned out here, but there are various content that we have to try to configure and check it. Next is the testing. Since it is a Raspberry Pi which has got an onboard Wi-Fi over it. So, how much that small Wi-Fi has got a capability to connect a number of people. I can have say five people are connected no issue. So, five people are connected and viewing different contents it is okay, but what if there are ten users. Do the connection happens, do the video whatever your people are streaming and all this thing the bandwidth becomes low or what. So, this will be a pure load testing that we have to do whether the Raspberry Pi the Wi-Fi of the Raspberry Pi is able to deliver that part or not. If not then we have to think for some other solution. Yeah, I can have a very strong access point from where I can have Ethernet which is there on board. Gigabit Ethernet which is there on board. I can connect it directly to the high access point and try to deliver the same network and try various hardware like Raspberry Pi 0. The 0 which I wanted to put it because it is very much cheaper than the Raspberry Pi. The Raspberry Pi cost almost around 3000 while 0 cost around 800 rupees. But what if we try to put it in the cluster mode and try to see how it performs. Then again for delivering the content from the network. If we have 4G dongle or anything connected to the system and try to download it. Because many of the schools or because many of the institution like you have come from they have the internet connection by default. You have very good bandwidth and all this thing. But many schools they don't have. So, how this can be achieved with the 4G dongle and other resources where this people can connect and try to download the data. Again as I mentioned the Raspberry Pi you can connect up to 128 GB of card and all this thing. But what if I want to connect I want to store more data. So, what the solution is keeping all the database which is going to store out here just pushing all the data on the hard drive local hard drive and try to extract from there. So, this phase I think the testing and compatibility is capabilities will be much, much thing where you are going to learn how you can tweak the streaming part or any other thing to support more and more students. So, this is very brief presentation that I have given out here. And the open wrap as it says it is going to be more often content delivery network only. Now expertise or skill required people who have load.js expertise, Python, building Linux because there will be a build which is going to happen while running the script. And some knowledge of Golang is required. So, major of the script that I have seen in open wrap is majorly Python based and Golang is used to build the script, final script, the image which is formed. And this image we have to put it again on the Raspberry Pi and boot it. So, major chunks will be of Python and Node.js as a server. Thanks.


An apparent murder suicide in the Minneapolis suburb of Andover has hit close to home for many friends and family here in Bemidji. Karen Reneer along with her husband Brian were fatally shot in their home by their 27-year-old son Aaron. Karen Reneer grew up in Bemidji and was part of a movement of music that put Bemidji on the map. The music was known and the artists a friend and neighbor to many in the Bemidji area. Karen Lund Reneer was known for her beautiful voice and music throughout the 1960s and 70s. But news of an apparent murder suicide has brought many to reflect on the artist. The Inoka County Sheriff's Office says that Karen's son, 27-year-old Aaron Reneer, took his own life after fatally shooting his parents, 58-year-old Brian Reneer and his 69-year-old wife Karen. In Bemidji the word spread quickly, leaving many in disbelief. Well everybody's horrified and just in a state of disbelief, I know that a lot of us are trying to sort of wrap our minds around it. Karen was an accomplished keyboard player and vocalist. She was best known for her time spent performing in the band Padipto, who performed with artists like Elton John and The Carpenters. Miriam Tell performed with Karen prior to her time in Padipto in a group called the Benson Obermeyer Fruit Stand Band. She and I stood out front and sang duets. We did not play any instruments in the beginning. The guys played all the instruments and we did songs that were popular at the time. Karen and her bandmates were known to always draw a crowd wherever they performed. They were the hot band of the late 60s early 70s and we used to go see them at M-100 at the college and downtown and anywhere they played we would follow. For many people the thing they will always remember about Karen was the sound of her voice. She had a beautiful soprano and you know, wilting really with a vibrato. I remember Karen as the one whose voice was gorgeous. It was silky smooth and mellow. Memories of Karen will never fade and friends and family will never forget the voice, the music, the life. We will all remember her fondly. We will all remember her from her Padipto days.  The death of Karen Rainier along with her husband and son remains under investigation. If you've enjoyed this segment of Lakeland News, please consider making a tax deductible contribution to Lakeland Public Television.