Good afternoon everyone. I think I'm going to start. I will be talking today about how to use modern graphical user interface toolkits, write it in Go, name it FINE, and really write your application once and distribute it and run it everywhere. I know you have heard that quite a few times in the last few decades, so I'm going to show and see how that goes. I'm Cedric Bay. I'm the current CTO of FINE Labs. We are a company dedicated to the FINE and graphical user interface ecosystem in Go. I will start by an introduction to Go. How many of you have used Go before? Can you raise your hand? That's a pretty good number. Cool. And then I will do an introduction to FINE itself. I'm going to ask if anyone has heard of FINE before this talk. Yeah, that's cool. Two people. And I will do some demo that does integrate Go modules and the ecosystem of Go was fine and see how it does kind of the power of doing an application in Go there. I will show some of their self-updates, which are quite useful when you're distributing your application. And I will show deployment of application on desktop and on mobile as a bonus. So let's start with what is Go? Go is right now already did feel as a young language, but it has been there for over a decade. It's pretty stable. It is not changing much. You can read Go code from a decade ago and it's still completely the same as of today. So that's pretty good in terms of like readability and skills. It's used heavily for the cloud and like Kubernetes and all of these things are in Go and the ecosystem there is in Go for sure. There is a lot of command line tools that are also written in Go. It's pretty straightforward to do that. It's a very simple language. It's easy to learn and easy to read. And I think I'm going to emphasize on the read. It's something that we kind of dismiss, but being able to understand the code just by reading it and not having to wonder what is all the side effect of that function are something that is really powerful. It's very fast to compile. It executes natively. And so it's pretty fast also at execution. And it's very important. It doesn't require any dependency. And so when you distribute your application, you only distribute one binary. And that's it. And that's very interesting when you're doing a graphical user interface because you can just distribute one binary and people receive your application. We'll be back to that later. And it has a really good set of tool for guarantee the quality of your code. And that's also a very useful thing. So let's go with the first very simple LL word. Here we're just going to get some flag from the command line to know we are going to be saying LL to. And after that, we are just going to print that on the command line. And it's kind of a very, I mean, it's a classic example of what LL word could be. I just wanted there to put a little bit of command line to see how that does go. As you can see, I'm pretty sure that everyone here can read that and see what is going on. On the tooling, I think I wanted absolutely to try to cover a lot of what is done with the go tooling. And that's come right out of the box of go tool. So on the command line, you have go test. You have fuzzing with go test fuzz. You have benchmark with go test bench. All of that is just out of the box. You want tool coverage. It goes with go tool coverage. It's there with your compiler when you have installed your toolchain. You have go lint, go import, and go cycle that does give you an idea of your code complexity, of making sure that your code is following the same coding style. And the entire coding style of the entire go ecosystem is the same.   And it's also quite important there. Go, vet, and static check are trying to detect common error and bad pattern in your code and report that. So that's also a pretty useful tool out of the box. And one of the last things that I like a lot about go is that the compiler itself will compile for any of the targets supported by go. So you are on Linux, you can cross compile four windows right out of the box. You can cross compile on macOS just there with the same go compiler. And that's absolutely great. There's just a little caveat that it's only work if you don't have any dependency that are outside of the go ecosystem. If you do, right now, one of the best things to do is to use ZIG for doing the compilation of everything that is like C, C++, and link that with your go binary. And then you have the benefit of having like two compiler and you can target all the environment you want with that, which is really, really amazing. And it's also very easy to integrate with GitHub action and all the CI infrastructure. So I'm going to go to other direction later on. Now about FINE. So FINE is a graphical user toolkit that has been around for maybe four or five years now. It's a completely written in go. It's under BF33 close. So completely free software. I think one of the big things here is that it's targeting go and it's to be used by go. And there is no interest for binding in any other language. There is no interest. Like the idea is that your user community are going to be a user of go. And if they have a problem with your code, with FINE itself, it's their skill. They can actually dive into the code of FINE. And as I was saying just earlier, you have the same feeling with a piece of code that you have not looked before in go and your own. Because of all the linting and all of this general ecosystem that push the same logic. And so it's making it very easy for people that are using FINE to actually contribute to FINE. And if we were to do bindings and have something in C or C++ or REST as to do the graphical framework, you will lose. And there will be this barrier for people that are using it to cross and to be able to contribute or to be able to report bugs in a useful way. So I think it's something that is very important to emphasize here is that it is in go for go developer. And that is like a really powerful thing. It's obviously cross-platform. It does support all the major desktop there. It's also support Android and iOS. So your application without any modification will run everywhere there. It's possible to use some desktop specific feature like Cistray for example. So you can have a Cistray for your desktop and obviously on your mobile there is no Cistray. So that feature is just not there and it will not impede your application. The other statement is like saying it's easy to use but it's really easy to use. You will be able to make an application very quickly with FINE. It's something that we I have been doing graphical user interface for like 20 years now and most of the time at the end of the day I was too tired to make my own application with a framework I was developing. With FINE I'm actually enjoying doing site development of my own application. I want something because I have network router that doesn't have an app. I'm making an app for it so I can actually do things with it. I have an app for like other things and it's very easy to actually make your own application for like all kinds of things. It is the idea that you are not necessarily a designer so the toolkit is trying to do everything it can to help you make your app looks okay very quickly for you so that you can focus on making it do what you want and that's kind of the core there. It does integrate with the GoTooling so all of the tests I'm going to show that a bit later but we support all of the test infrastructure of Go into FINE so you can actually have automated tests that will check that the UI is actually doing what you expected to do and enforce that over time. The last part that is also very important is the Go ecosystem has amazing module for doing network for doing database operation and all kind of cloud operation and you can use them with FINE extremely easily and it's where it makes sense a lot to write application in FINE. So here is just a little bit of an example of what an yellow world is. You create an application this application you create a window from it you create a label and you put that label into a Vbox container virtual box vertical box container which has the label and a button and the button has a function that will when you click to it will change the label to a different text. This is basically how any application will be it's just a stack of widget and container together with function and callback that will do the work and at the end we run a show and run because it's need to be blocking until the window lifecycle is done. So that's there. So for the rest of the example I've written a big example application at this address that you can go and take a look at. It is fully tested. There is all use case there of like network that GitHub action and everything is there. I've tried to make it as clean as clear as possible and so I think it's a great demo of what you can do with FINE there and I'm just going to cover a few things during this talk but there is a lot more detail there. So I'm going to be covering the test how to use YAML and network file sharing, do a little bit of GitHub actions that are automated there and look at how the self update for the application is working. So the application itself will look like that when you use it. It's a little bit dark. I should have used the white theme for that. So that's what the application is looking like if you compile it from the Git repository. The idea is that you have a bunch of shops on the left and when you click on one of the shops there is a list of shopping stuff that you want to get from there and you can click on some of the button to add some stuff. You can filter things, you can export and save your shopping list and so we are doing a full automated test for this application and so this test here is making sure that when you click on the checks box that are here you can see it's not great on the screen. So for each item on the shopping list there is a check box and so this test is verifying that when you click on the check box it does update the internal data of the application and that it does correctly match things. So we set up an app data with temporary DB which is like a general function that I have created for that purpose. We check that the UI is properly created. We check that the UI rendered to an image that matched what you have previously checked and expected. So it generates a file or PNG that you can actually manually verify if it doesn't work out. We also render the UI to a markup language so you can actually make comparisons on the string. The obvious benefit between string and PNG comparison is that on markup or like small theme change and change on the font aliasing and things like that will not show up into a markup check. They will show up into an image check. So sometimes you want to make sure it's like pixeled perfect the same thing as it was for the previous version but sometimes you may not want to. You may just want to have the correct information so you want to have your label with the right information and things like that. So that's why there is two different ways to do our testing on your application there. We simulate a tap on the screen at their position where the check box is and we verify that in memory all the shopping list of that item that is displayed at that position get checked. We retap at the same place. We both time have been checking the markup that it does match our expected markup so that the UI has been correctly updated itself and then we check that the value of the shopping list in memory in the structure is also correct. So we have this asset files that is verifying that the double tap on the same check box will actually correctly reflect into the in-memory value to be fast also if you do a double tap. So that's kind of a quick review of what you can do on automated test on a graphical user interface with FINE. There is a lot more tests in that Github repository that are pretty interesting I think to look at. And out of this test you'd get coverage reports. So I'm using cover roles but you can use gotool automatically as a web coverage file generated if you want and it does tell you how much of your code is just covered out of the box by the goal test too. So that's kind of neat. Now if you start to integrate things, one of the nice features that we want is to be able to have you have an app already on your desktop and you want to get your shopping list to your phone or you have your wife as a different phone and you can exchange this shopping list. And so to do that without like a central server or anything the idea is to generate out of a shopping list a YAML file that you can then exchange using warm all which is a protocol that is like peer to peer kind of things and it gives you three words and you just give these three words to the other side and it will download the file. So it's pretty neat when you just want to exchange file pretty quickly but what is really cool is that it's already implemented into a Go module and so in literally two lines of code you transform your Go structure into a YAML file which is the export YAML function up there and in less than 10 line you can actually share your file across internet with nothing more than this few more lines that I have there. So you basically get your YAML from this YAML you just send it over the network you get a code which is these three words that you have to share with your other phone via a different medium and that's it for sharing file which I think is pretty cool and just work on any network and just just there. So that's one of the power of the Go ecosystem is that there is already a lot of modules that do great things with very simple API to use and well 10 line of code I am sharing things across NAT and whatever you have on your network and it just just work. And on top of that we want to add a UI obviously to display this code word so I'm wrapping this upload YAML function as always in Go you test the error return before you do anything and have this show progress bar infinite function that is actually going to create a dialogue and display this word and it will run until the other party the other side has entered the three words and has downloaded the file. And so it will look like that on the screen you have just a dialogue and those infinite progress bar bumping from one side to the other and you have a code that you can type on your phone to download things on the other side and I think I can do a quick demo if I don't want that. So here we go and so if you were to have on your phone if you were to have on your phone the same app you can type the words that are here it's not liking very much yeah it should be okay. So I have the same app on my phone it's Go it's the same thing and you can do this and I was too slow well and it does I instantly download and I get that on my phone. So I find this kind of feature very cool to be able to get them out in like literally 10 line of code so it's 10 line for sending 10 line for receiving and it's going and it's pretty easy to do these kind of things thanks to all of the Go ecosystem. One of the other thing that is really interesting is that you can automate a lot of the static analysis and the quality of your code by using all of these tools I've described earlier and actually making them part of a GitHub action and having them there you can basically copy the GitHub action that are in my repository that I gave you earlier and it will automatically run all of the Go tools to make sure that you have the static check running and make sure that you have no bad construction that your import are only the minimal needs you have that you have the linting that is correct for forgo that's a complexity of a function is not too great and all of that is just like out of the box you copy your file from like one project to the next you don't even need to think about it it just just work and that's really really cool. One of their very very important feature when you do graphical user interface is how are you going to be providing update because most people download your application like once but they don't want to be coming to your website to get the next version ever again this is not happening and so on mobile you have the marketplace you have the app stores that give you that ability to deploy new version on the desktop it's a little bit more complex not everyone like if you go on on windows there is a bunch of different app store all of them don't really necessarily support update and it's sometimes left to the application to do that on Linux it depends if you are installing the application as a user or as an admin so if you are as a user usually you don't have an ability to update your application so it become interesting to figure out how to provide a way to update your application and fine as this fine self-update module which basically require you to point it to some HTTP URL where you put your binary and yep this module will check at pretty fine interval if there is a new version there and if there is it will do download check all for all security if it's the right signature there and just replace the binary and it will just work out of the box for windows linux and macOS and literally again it's a I'm not kidding it's 10 line of code is that right maybe less it's maybe 10 line with the spacing on the screen but this is really really helpful because now your application when it starts it's asking for do you want me to update it and I think just earlier when I was starting the shopping list I think I maybe worked earlier on the new version at some point yeah and so if I just do an update there it's downloading through the network from Wi-Fi that's cool demo it's working it may take a little bit of time because that's a Wi-Fi at the conference but it's basically able to download a new version and it will replace itself when it's done and yeah it worked pretty fast actually ah good I was not expecting it so up and that's a new version it's exactly the same thing oh may have just been like a small bug fix somewhere I did deploy or whatever but with this is the code that is used for that and and the thing that is interesting here is you can share that public key it can be on your git repository because it's just a public key so the private key obviously that you use to sign is not to be put on there in your git repository but for an open source project you can actually have the code completely there and be used without any trouble your private key will have to be end up into the github secret for example to be used so the next the next cool bit is the multi-platform support so um so there is as I was saying earlier there's a little bit of a trick with go itself can compile go to all of this platform but it's relying on another compiler to compile the c library that some of the dependency may use and and in the case of fine we are using glfw and we have like dependency on x or depending on what you have on windows and so on and so there are native dependency that we have to compile uh with or binary so normally it's on the user to install all of this dependency and all the cross compiler to to get that uh working and that's a huge effort usually and so there is an amazing tool which is named fine cross and basically what fine cross does is it has a bunch of docker image that are prepared with a cross compiler and all the dependency for your application and when you say compile me for windows or linux it will pull the image that has all the dependency for linux there and it just work with the fine product kept that up to date so you you have like right now the 1.20 uh go with uh the latest version of fine and the latest version of zig in it and it just pulled this image for you and you don't have to bother with all of that uh complexity uh and it does compile out of the box for windows linux bsd oh i forgot macOS uh aios and android there is a little bit of weirdness around macOS and iOS for macOS you have to manually download the sdk from apple at the moment and to point the image and tell it like that's where i did download the sdk because the license on the sdk is not all friendly to reuse i know that tinego has made some work so that we maybe at some point we'll be able to not use apple sdk but for moment we need to use apple sdk so that's kind of a weird thing ios is a different pain for ios you have to compile on a mac to be able to compile for ios so there is nowhere around that that's how it is so the support for ios require you to be compiling on a mac uh that's kind of a life it's kind of a pain uh the other thing that is cool with fine cross we now support both amd 64 and arm 64 for the ost machine so if you have our uh so we did that first for the mac m one so that you can cross compile with fine cross to cross compile from the mac m one to any other machine but a lot of the user are actually using raspberry pi and friends like that to do the sci as a cheaper cost and cross compile the application using uh raspberry pi to uh or the target uh it does surprisingly work well enough if you're not uh in a rush so that's kind of cool a little bit of an example uh so what you have to do to compile for windows you go into your directory of your application and do fine cross windows and voila it does mean that you have to have installed docker or podman or have access to a Kubernetes cluster to be able to do uh to run fine cross because it's rely on on docker or podman or the ability to run a container to to be able to do the build but um but it just worked there out of the box uh pretty simple setup and as we as I said earlier all the image of the container are being kept up to date so right now we're like 120.4 for the go compiler in the latest image and we have fine 234 in it and the next release of fine or next release of go a new image will be pushed and on as a user you just need to say I compile and we'll check if it has the latest image and just download it if there is not a new image or just use the current one one of the nice things is that you can also include that into your ci cd pipeline so that's a demo with github action and it will actually go and compile for linux windows free bsd and android with this uh using fine cross uh and this github action so you can just drop that github action in your project and it will guarantee you that for every pull request you are doing it's able to compile it for all of his targets uh out of the box so that you if you pull a module that is not compatible with I don't know android it will tell you right away um so one of the product that we have been working on at fine labs is actually an automated test uh automated build and delivery system that put all of your uh binary behind a cdn and those all the signature and all of these things for you and so you just point into your github repository and it's instantly is able to build your application for all of this uh this all of this uh os and different architecture and it does share share with you a binary can be installed it does all of their uh self updates signature and everything for you so out of the box you just have to say that's my github repository and you're done uh your apps is now available uh for the one that are that want to have fun the application I was demonstrating just earlier that's their cure code for android for the application I just just work so we do support github githlab um the build is optimized and all the time off build is pretty optimized we support all of the desktop we have done all the integration for ios you still need to pay for the license to get the key for ios but we do all the build for you so you don't need to have a mac to actually do the build you can just rely on our infrastructure to do that for you which is I think personally uh it's it's great I just don't want to be using a mac for for all of these things um and all of that is behind a cdn so you just can share your url for delivery and it's uh that's good to go so if anyone wants to have some fun with android oh there's a cure code to go there um and uh as a conclusion and I think it's something that is hard to imagine at the beginning on how easy you can actually make an app and get it working on your desktop or your phone with literally no code spatial specific or anything like that so so earlier I did a first demo of like a very uh I would say more like a demonstration of the toolkit than any uh like integration with go and not really a good looking app um uh we have done this application which is a little bit more good looking to to be able to see uh what's the time zone and time at some point somewhere in the world uh it's also completely in go and completely in fine and you can like change time and things like that and it will reflect uh on all the time zone it's pretty useful these days when you don't know where people well you know where people are but you don't know what time it is and and the same uh oh and yes and vzapps also has a cistray down there all that is provided by fine so the same cistray will work on like windows and things or macOS also and uh I have the same I have the same application that is also uh working on my phone here so again no difference it's pure go it's the same thing all over so I think uh as I say I've been doing graphical user interface framework development for over two decades and writing my own application for like small things has always been like a huge bar to step on before doing any apps and with fine I found myself being able to very easily do new apps for like random stuff I would have never started to do an app to control my network router from from here so nice thing I have well I can maybe also do a demo here so I have at home some uh microtec router and one of the thing I really like is that I want to be able to remotely connect uh from anywhere but uh I don't want to have to set up a complex things so I'm using tail scale so there is a go module for tail scale so I've directly integrated into my app and all the connection to my router are now done via tail scale and I'm using another modules that was written to actually do all go request to a microtec router never heard of my tail scale in that module but I can just share the handler to the function that connect via tail scale to that module and I have a tail scale microtec connection and I have that integrated into an app and I can also I can just uh so that is uh kind of further away it's where is that one at my home is not here but I can actually get all of this data kind of read transponderly via tail scale and just just work so that's a really kind of the power of uh oh and I also have the SSH I don't know if that's going to work here yeah it does okay and even SSH is working through our tail scale to the other side so uh that's that's kind of showing a little bit of the power of being able to use go to do your apps there is an amazing ecosystem with everything uh I have not demo anything about like database but there are like ton of database there is all a grpc there is uh all gsrpc and all of these things are there it just work and so if you have any idea of like a small app you want to do just go ahead uh it will be possible and then you can have it on your phone with like no effort I mean you're going to say just one thing if you have android it's no effort if you have iOS you're a little bit more pain but that's just uh apple being apple so uh that's will be it for my side um do you have any question for me yeah is there a microphone for oh yeah uh yeah but I think it's recorded so it will be great I think if you yes yeah hello yeah uh so when you make a graphical application for various with this thing used to be called responsiveness was a big deal like how do you design that works for various with was there any convenience that yeah good question um it's absolutely it's a good question um it uh it depends off your application like for example uh I was showing earlier um nomad um and no where is nomad well nomad is gone um so it depends off your application if you go for with uh this one nomad uh it has a custom layout and on the phone it's all vertical like this but as soon as you go with a slightly larger it will switch to be a grid mode and things like that so you have like a bunch of container that have different layouts that will detect this kind of oh I have like more space now so I should be doing things like that um there is also another widgets container that is designed with the idea where you say oh I have this group of things and at that side of screen I wanted to be like 20 percent for this one 30 percent for this one and 50 for this one but when the screen is like way bigger let's give like 2020 and like things like that so you have like a few container with different layout and some of the widgets for example the the shopping list has a different layout if you are uh on on their kind of sit on a mobile uh but uh on a mobile some of the widget will use tabs for uh for the layout while on a desktop they will put the tab on the side so because it's more logical on a mobile to have your tab at the top and on a desktop you have so much like lateral space it makes sense to have your tab on the side sometime so some like widget are designed with that in mind so that you can actually uh adapt best to the screen but you can always write your own layout so there is a the container object that take a layout function and so you can provide it with the layout function you want if and none of the layout provided by the toolkit actually match your need thanks any other question well okay I guess thank you everyone


Hello and welcome to My Career in Data, a podcast where we discuss with industry leaders and experts how they have built their careers. I'm your host, Shannon Kemp, and today we're talking to Ryan Owens from Blue Cross Blue Shield of Louisiana. With a robust catalog of courses offered on demand and industry leading live online sessions throughout the year, the Dataversity Training Center is your launch pad for career success. Browse the complete catalog at training.dataversity.net and use code DBTOX for 20% off your purchase. Hello and welcome. My name is Shannon Kemp, and I'm the Chief Digital Officer at Dataversity, and this is My Career in Data, a Dataversity Talks podcast dedicated to learning from those who have careers in data management to understand how they got there and to be talking with people who help make those careers a little bit easier. To keep up to date in the latest in data management education, go to Dataversity.net forward slash subscribe. Today, we are joined by Ryan Owens, the Senior Data Warehouse Analyst at Blue Cross Blue Shield of Louisiana. And normally this is where a podcast host would read a short bio of the guest, but in this podcast, your bio is what we're here to talk about, Ryan. Hello and welcome. Hi. How are you today? Good, good. How are you doing? I'm doing great. It's kind of warm down here in New Orleans, Louisiana, but you know, it's, if you can't feel it, then it's, you know, so I was wrong with that, but it's been, it's good out here. I just wanted to say thank you for the opportunity to join the podcast today. Oh, thank you for joining us.  Oh yeah. It was great. Everything else is great too. Yeah. I love the music. New Orleans is the place to be. Oh yes. That's where it is. Indeed. It's been too long. I got to get myself back there sometime soon. See, I'm sporting my Mardi Gras tie right now. So, you know, I love it. Oh, I love it. So you're the Senior Data Warehouse Analyst at Blue Cross Blue Shield of Louisiana. So tell me what, especially for people who may not know worldwide. What is Blue Cross Blue Shield of Louisiana? Yeah. So Blue Cross Blue Shield of Louisiana is a health insurance company. And we have about 3,000 so employees. And one of our mission, our mission rather is to stay committed to improve the health and lives of the Louisiana Indians. Yeah. Yeah. Yeah.  And as much talking as I do publicly, it happens to me all the time. Absolutely. And so, you know, and in the United States for people who don't know, health insurance is dictated by a state. It's not a federal thing. Right. Yeah. And Louisiana Blue Cross Blue Shield of Louisiana is one of those. So, you know, we have the association and then it kind of by state. It trickles down to whoever wants that. So, so you mentioned that you're the scene. So we mentioned you're the Senior Data Warehouse Analyst. And so what's your, what is it that you do? And what's your typical work week look like? I work with a team of blue employees. So we call ourselves blue employees and some some contractors that come in and help us out as well and manage our intake and deliver, deliver a lot of projects that are from our internal business, which can, which can come from different departments and external business that could be from other vendors, partners and hospitals. And so we manage a lot of data that comes in and we may have some bi-directional deliverables, but I really try to work with our extracts. I work with our extracts rather than that's one of my roles. And we, what we do is we get all the business requirements from those internal and external business, business owners. And so I do my best to deliver as much as I can and as quickly as I can to those partners. Oh, very cool. So again, just, oh, that's got to be a lot of data that you are working with and delivering and managing and and extracting there. Yeah, yeah. So a lot of analysis as well. I mean, this is lots of data that we do have and, but it's good because you learn so much. There's so many different areas that you can learn about and data is just because data is everywhere. Why not take a look at it and why not learn all about the business? Indeed. Oh, I love that. I bet that takes some skills. So as an analyst, you're not just looking at numbers and crunching numbers. You're having to interact with the humans as well and making sure you understand the requirements and making sure you communicate it back out. It sounds like you're doing some analysis as well to let them know what their data is saying. Yes, absolutely. And trying to get them to the right data. That's the main thing.  You want to make sure it's curated properly as well. And one of the reasons why I wanted to get into this analyst role is because I love people. Like you said, you know, I love to talk to people before I came in with a coding background. So I, you know, I had the software developing background and yes, it was good for a while, but it was good for me to work more with people, speak more to people, not just the team, but also on the enterprise level, think more of a leadership level. And once I've gotten to that point and I was advised to look into these roles by many people. Not just because of the personality, but because of the ideas and the vision that I had for myself. I decided to take this role and see what I can do with this. See how I can make it my own and see what I can own in this role. So let's back it up then. You're talking a little bit about how, why you wanted to get into this role. So let's back it way up. Brian. So when you were, you were just a little kid in what we, in the US called the elementary school. Did you, did you want to like say, when I grow up, I want to be a senior data warehouse analyst. Oh man. What was the dream? Well, shoot, I think that's, that's a hard no, right? But the first thing, I know I wanted to work in technology, definitely in computers. I know that way back, you know, even when I was in my mom and dad's offices, whenever I would go to their offices, I would, they would always have pinball, one of those computer games up there or solitaire, one of those first computer games up there. It's, you know, working on Windows 98. Brian. It was, you know, I wanted, I wanted to work in technology. I didn't know how far it would go. And even continuing, you know, from an elementary going into middle school and high school, you know, technology was always on my brain, looking at coding, maybe a little bit of database, some web design. I was all over the place. I never really knew where I could put my foot in and have it and be able to really enjoy that. And so once I got to college, if I can continue, you know, I didn't think I would like coding as much because there are so many programming languages that I had to learn and even learning systems and learning database and then going into cybersecurity is so many avenues, right? And I didn't see where I could fit in. So then at that point, I'm like, okay, let's just, let's get this degree. Let's figure out what we can do and let's get a job.  Yeah. Yeah. Yeah. So my degree was in computer information systems. Yes. And I can concentrate it in networking and a little bit of research as well. So it was, it was all over the place. And of course at my school at university, Northwestern State University, it was very interesting because it was split into three different majors. So all of my classes went to in the, in the business department, all my classes were from business administration accounting and computer information systems. So I had a mix of all of those. But I was able to join all of that and see, okay, I can match all these to any kind of business, right? And it's not just about a standardized, you know, business administration or standardized computer information systems. I can do so much with this because it's so, it varies, right? The roles and responsibilities and all the different majors that come about it, anything you do outside of graduation, you can make your own and hopefully something that, you know, will interest you later on. So once graduating, I got a job with a consulting firm and loved everything about it. You know, I didn't know that it was really consulting. That was all technology. But then I had to learn how to interview. I have remembered how to interview with so many different, yeah, for so many roles. And it got to my very last role. I was there for four years and then my last role, I actually became a data analyst and in a way a product owner. And that sparked a little bit of data management. It gave me a little taste of it. And I was learning a little bit about informatica and the software development side. And so when I left that consulting firm, I decided to go to Blue Cross for shield and take on a full-time role as a software developer. And so that's where my taste of that life cycle, the data life cycle really stuck in for me instead of doing so many different roles, a little bit of programming, a little bit of this, a little bit of that. So I wanted to be, you know, stable in a role for a while. And so this, that's where Blue Cross for shield Louisiana gave me an opportunity and I took, took heed and went straight forward. I love everything about it so far. I've been there for six years and three months now. Wow. Congratulations. Oh, I love that. So, so you started as a software developer for them. Yes. So then where, how did you move in and transition and grow into the senior data warehouse analyst? Yes, absolutely. So once, once the opportunity came about for this role and I think data governance opened up for me first. And so I kind of walked into the data governance role as a senior data, it was still a senior data warehouse analyst, but under data governance. And I loved everything about the role as well. I loved meeting new business owners, working with business owners, analyzing data for them, solving problems, creating solutions. And of course, trying to persuade in a way that I can build trust with them. And that was the major part of the role. I wanted to be able to build trust. And not just because of who I am. And, you know, with the role that I'm in, but it's because of what I needed to do to make them aware that they're right, that they're getting the right data, that they're getting the things that they need to do for their job as well. So with the advisement of some of my peers, they also persuaded me to go ahead and take the opportunity to get into this role. And I think about a year or so later, I kind of went into another side, even though I'm still the same, the senior data warehouse analyst, I am now working with product management and with product management. This is where I now own the data extracts for the innovative project. And then that was a, that was a great surprise. That makes a lot of sense. And that's so interesting that you first started under data governance because so many people and so many companies, we hear, you know, pushback, you know, the data governance is a dirty word, we don't need data governance and panelists don't touch data governance. I don't have anything to do with data governance, but I love this, that you have analysts within the data governance office, you know, we just came from the DGIQ conference and it was wonderful.  But you have to understand what it really does for your company, your firm, your enterprise. It's a good medium to where if you go to that, you know, obviously you have legal, that's totally separate from this, but data governance is what a company needs, right? To really move forward in a lot of things, to keep things standard or whatever you decide to use data governance for. Everyone uses it differently and I know for my company, we, our data governance is for our enterprise data warehouse. We also have an IGO, an information governance office that supersedes all of that for the enterprise itself. But our data governance is for the enterprise data warehouse, we service that. Oh, that's so good. Yeah, we work, we work directly with our information governance office. Yeah. And that goes in and then it comes out. And I wanna touch on another thing that you called out too, that you really work to earn the trust of the people that you're working with. You just don't throw numbers at them and say, hey, this has data quality behind it. There's some, it's marketing and communication skills and they need to trust you as much as, you know, and just not, and you need that trust versus just throwing numbers on a piece of paper to them or, you know, in an email or PowerPoint or whatever. Right, absolutely. And it all starts with, you know, how are you, how can you be an effective communicator? I can say back in college and I still work on it today. I'm not perfect at this, you know, back in college I was a leader in a freshman orientation leader. And so with that, I had to be able to effectively communicate with parents and with students, the potential students that were coming to the school. And so if I didn't know something, I needed to also say, okay, well, I don't know this but let me figure it out. And so that's, even though you may not know the answer to something, you know, going back to that, you will have to go and figure it out and you should because that is a job, that is your role. And if you communicate that to your business owner even though you don't know the answer, it's important to them to say, okay, well, I'm glad that he doesn't know and let him go find the answer and then he'll communicate that back to me. That's building trust as well, especially, you know you don't wanna know it all. Even if you do have a know it all, it's fine but you know, you want someone to be human and say, you know what, I don't know, but let me figure it out. Oh, I really appreciate that. It took me way too long to figure out that lesson.  Absolutely. And I love that you say, you know, you're not perfect in your communication. Nobody is, you know, we've been talking about it a lot at a diversity about progress, not perfection. Absolutely. Always working to get better. More and more companies are considering investing in data literacy education but still have questions about its value, purpose and how to get the ball rolling. Introducing the newest monthly webinar series from DataVersity, Elevating Enterprise Data Literacy where we discuss the landscape of data literacy and answer your burning questions. Learn more about this new series and register for free at dataversity.net. Absolutely. That's a major, I think that's a really good rule of thumb. You have to, you know, it's a premise. You know, it's a marathon out of sprint. Right. Honestly. Absolutely. So let's talk about that then. So what has been your biggest lesson so far in your career? What's been a big aha moment? Nothing is ever going to be the same. Technology and decisions will change frequently. The, it's happening, it's happening at my enterprise. It's happening all over the country. Technology is going from, it went from C++ to, you know, Spark and all these other types of technologies that you have today. I mean, we used to have COBOL. I used to program in COBOL. Right. And use COBOL now.  You have all these different programming languages, all the different technologies and software is coming out and, you know, and it's coming in and very high frequencies actually. It's not as low as it used to be, but now because of the different research and the different genius, the minds of these, of this new generation, right? It's so much that's coming about and you have to be able to learn something new. And that's the major thing for it. You know, you have to learn something new and take it as an opportunity to learn new things to enhance your dataset. That's, I'll stick by that. Oh, I love that messaging. And things are constantly changing. We cannot expect things to stop. Absolutely. And decision will always change as well.  You know, and companies are actually starting to adopt that, right? So, you know, that agile methodology, you know, when you have to be able to work with change in no matter what, it's not all gonna be waterfall anymore. Everything changes. So how do you keep up with a change and how do you keep up with a new tech that you need to use? So I'll do my research. That's key for me. I have to do research and if something were to change within the next week, I just need to be aware of where I am in learning that one thing first before it changes. I know that I lean on our management and leadership to make those decisions for us. And of course I do my due diligence to ask the proper questions and to be in the know when it's, you know, when I need to know, especially, you know, in those times, but there are, it can be hard. It can be hard to keep up with those things. I will have to say, but do you do diligence to stay alert with all the new technologies and also be aware of what, just be aware of what could change, you know, because it's not always gonna be there. I love that. I love that you keep learning.  I won't say how old. Oh, you're young. I can see you're 25. Right? Yeah.   Oh, yes it is. And if we stop learning, then we just, we really age. Well, and here's the other thing too. I've learned so much being in this role, being at this company. And, you know, we're a big family at Blue Cross Michelle, Louisiana. We want to build others up and put people into positions to where you can achieve whatever goal that, you know, you see fit. And I love how our management and leaders really take a look at us and make sure that we are in the right place. Because if they see something that's not right with us, they'll ask about it.  That's key for our management to have with their employees. And when they see that there's something not right or they see performance, you know, they want to make sure that their employees are in the right spot. You know, are you sure you're okay? Is everything good with this? How is everything with this project? How is this research going? You know, they're really concerned with their employees and I absolutely love it. And that's why I'm still here. You know, I love everything about the role and the data that we collect and the data that we are able to put out for our business owners, honestly. And I learned so much from, you know, the diversity and the conferences and they send us the conferences. That's what I really love too, because I learned from, you know, I network with, you know, not just the sponsors and not just the people that are participating, but those that are actually presenting. You know, I network with them. I try to figure out what they're doing in their companies so that maybe I can bring a little bit back to mind, but if we don't take it in, then maybe it's something that I can learn for myself to where eventually down the line, it could, and if it does change and it does fit into what they want to do later on, then it will work. You know, this is one of my favorite parts about our community and the data management community is the networking and how much, I mean, I get inspired every day. Every webinar I produce and conferences I go to, just I'm in awe of how kind and how giving people are of their time to each other, to learn from each other and talk to each other and help support each other. It's just, it's great. It's really very great. Absolutely, absolutely. And of course the destinations are great too. So. Yeah, you can't go wrong with San Diego. San Diego. Yeah, that's right. That's right. And I went to ADW World as well at like 2019 before and all. Yeah. We're back in person finally again. Yay for ADW in fall in Anaheim, California. We're gonna be doing this next. And I really want to get to that too. That's where I first fell in love with the sort of our data management professional certification. Oh, that's cool. Well, let's get into that here in a, well, tell me about the certification first before I get into the next question. So since you mentioned it, I think it's the finest for those listeners. Yes, absolutely. So the certified data management professional certification is focused on data management. All of the, I believe it's 14, forgive me pillars of the data management, the DOMA wheel, all of that. If you don't know anything about it and you want to learn about it, I'm not sure if you can see it or not, but go ahead and get this, this, the Dembock version two. It is a data management Bible, about 600 so pages worth of it. And it's amazing. I love everything about the book and I use some of it today. There you go. Yep. I use it today. I didn't plan this, but here's my copy. You got everything there, see? And I love how you have all your tags. It's wonderful. But the test was, when I took it in 2019, that was the first time, that was the first conference I've ever been to, the management conference. And when I took the test the first time, I did not pass. And I was a little upset by it because I finally found something that I felt that I could focus my career. And I was about two years into Blue Cross Michelle, Louisiana. So I was like, you know what? I need to really get this and focus and really study hard for this exam. Because I had three chances to do it. So those other two chances I did not pass it, but then last year I came to DGIQ and my main goal was to get this certification. I studied hard for the last three years and tried to, I wanted to wait because I know we had COVID. I tried it again, while virtually when I was at home and I didn't pass it then, but then when I got to DGIQ last year, my goal was to get this certification. And the first day, first try, got it. Yes, I'm so excited. I was like relieved. I could relax for the rest of the day. My mind wasn't boggled with all the terms and it was just, it was too much. But I really, really love this book. I love everything about the university bringing this to life, partnering with DAMA and making sure that they introduced the foundation of data management to all of the participants and honestly to the world.  They don't know why it's all over the place. But in order to organize the data, these concepts, these principles are extremely important for those to understand as they move on within their careers in data management for their companies. Oh, that's some great advice and thank you. And so I'm gonna, since you worked so much with data and now that you're certified, congratulations. This is awesome. So what is your definition of data? I struggle with that, you know? I would say it's very simple, right? The definition of data is information. You look at all of the information that you collect about for instance, a person. My name is Ryan Owens. I have a social security number. I have a birth date. I have an address. I have all these characteristics and things about myself and all of those things pertain to me. And like I said, I know that this might be extremely simple, but it's really just information about something, not just about a person, but something. How, what makes that thing happen? What is it? And how can I organize it to make it something that I want to look for later? And I feel like that's what a lot of our CEOs and out of our higher leadership wants to look at data. They don't know what an analyst really does with it. They don't know what's really in a file, but they want to see how they can turn this file into a dashboard to where they can really use that data. It's all about how you can use it. That's what you want, because you can take a raw file that has information about something. But what can you do to use that data? Is I think where it has to, which goes to the next question of that. What is data, but then how can you use it? Yeah, I love that a lot. And you work with data a lot. So as someone in a career at data management, do you see the importance of data management and the number of jobs working with data, increasing or decreasing over the next 10 years and why? I see it increasing. The reason why I say that is because we have a lot of AI technology. All this automation is coming into play. I love automation. I love making things easier, quicker for a very simple task to do. But in order for, and the reason why I say increases, because even though we have all of this, we still have to have people that understand it. Because if you don't understand the build of it, the background code of it, and technology, even though technology getting smarter and smarter, even on its own, learning these machine learning models, all of this, if you don't understand it, then how can you manage it? And you have to be, because we see all of these iRobot and all of that, they're doing all the things for us, but there's someone that really understands the model, someone really understands how it's learning. And if you can learn that skill sets, you'll be able to manage those automated technologies. And that'll be extreme for that one or many individuals that get into data management now. Oh, that makes so much sense. We've seen a lot of companies try to stand up, machine learning and AI machine learning, especially, and then suddenly realize, oh, we forgot the data prep, we need a data model. Yeah, you have to start, you have to, what's your foundation? How do you look at things from a, how can I say this? What is the high point of where you see something that's so little, like a small raw file go? How do you see the AI technology and how can you manage that stuff? It's one of those things that I feel that, a lot of people look at it from a surface and they don't really understand the big picture later. So how can you look at it from the big picture and then try to be able to manage that big picture, starting from that very small thing? Ryan, you've given a lot of really great advice already. So is there anything additional that you would give advice to for people looking to get into a career in data management? Yeah, I'll just go back and reiterate, just do your research. There is so much out there to learn from, there's so many books, a lot of people write many, daily management for dummies or any type of data management or leadership related book to learn about your data because every company has data. So why not be part of that? Why not be able to be part of something that you can manage, right? And not just be a software developer because even with a software developer you still have to manage data. You're transforming it into something that's more visible for someone else. There are a lot of blogs, the working groups and even programs that are out there that allow for you to learn about data management. So I would say continue to do your research and even try to network with those that are in different roles within your company or look for partnering companies that do that as well and just try to look into those roles and see what it is and how can you see yourself in that role one day. Such good advice. Well, Ryan, this has been such a pleasure. Thank you so much for taking the time to chat with us today. Oh no, thank you so much for the opportunity. Thank you to DataVersity. I enjoyed every bit of this and I would love to be back again one day and hope to see you all soon at the next conference. Yeah, I can't wait. I look forward to seeing you again. It's so nice to be back in person and seeing and chatting with you today, so. Yes, absolutely. And say hi to New Orleans for me, because, you know, again. I sure will hope to see you in Mardi Gras next year. And to all of our listeners out there, if you'd like to keep up to date in the latest podcast and the latest in data management education, you may go to DataVersity.net forward slash subscribe. Until next time and stay curious people. Thank you for listening to DataVersity Talks, a podcast brought to you by DataVersity. Subscribe to our newsletter for podcast updates and information about our free educational webinars at DataVersity.net forward slash subscribe.


Welcome back folks. We have the Dow Industries down 203, Nasdaq off 88, S&Ps off 30. Let's go to our mam, it's the Basel Chapman, as we do each and every Tuesday at 20 past the hour. And don't forget folks, Basel is an outstanding show here. Every trading day, 12 to 1 Eastern Standard Time, also has a great newsletter. Now the way you get the newsletter, you come over to our website at TFNN, you're going to go right on the newsletters, and you're going to see it right at the top right-hand side. You hit the opening call, you hit subscribe, you can get Basel's newsletter for one month for $128. You can get it for six months for $5.95, which is the savings of $173.22 percent. You can get it for a year for $9.95, which is the savings of $5.41, or 35 percent. They all come with a 30-day money-back guarantee, folks. Check it out right on the front page of TFNN, you hit newsletters, you hit the opening call. Basel Chapman, what's going on? Hi, Tom. How are you doing there? Well, I'll tell you, man, you talk about a little volatility, man. Holy cow. You know what's interesting, Tom, you say volatility now, it absolutely is, but I'm showing this chart. If you look at the middle chart, which is the weekly chart, we've been here for the same level since April, May, June, and it depends where you want to go back. You can even go back to February, March. So we're kind of at the same level, but absolutely the trading band, you can see on this daily where we were 27,398 in the Dow on the 16th of July, went down to 25,339 a month later, August the 15th. A month later, just less than a month, the 12th of September, we're up at 27,306, 90 points away from the all-time high, and then we come back down to 25,743. So it's the volatility within a fairly small historical, fairly small trading band. But absolutely, if you look at the candles of the monthly chart, you can see red, green, red, green. Every month is, in fact, I just didn't realize this, except when you go from December with a red candle, there were two green candles for January, February, but after that, every single month after that is green, red, green, red, green, it just alternates. Basil and I are talking about, you can make a case that we've been in the same place since January of 2018. Yes. I mean, the S&P bottom line was, what, 24 points lower than we are now, which is really interesting because through this whole generation, what we have seen are corrections that have come about. Since the Fang stocks, Facebook, let's call it Facebook, Apple, Amazon, Netflix and Google, they've been consolidating, Apple is close to its all-time high. The others are really, they've been consolidating since the fall of last year. So what I wanted to show is this, that within the context of the patterns that we look at here in the Chapman Wave Method, using the Chapman Wave Methodology for subscribers to an opening call, we're always looking at the cup formation and the arch from the formation. And you just keep rotating through cup and arch and cup and arch forever. And sometimes you get a straight line move, and that has to be treated as something as a directional certainty that it's going up and up and up, well, down, down, down. But then it stops the stalls and it starts this whole pattern of cups and archers. So what I say to subscribers, you've got to be careful, we're very lucky we had shorted the Dow back in 16th of July, just off the top at $27,391 and the high was $27,398. We took profits on the way down, there was this H pattern, they went to a U-shaped pattern, runs back up to $27,306. So we went short at about 120 points off that high, we remain short. And what I had said to subscribers to my opening call on Saturday, I sent out in my newslet, I usually like to start preparing, sending out charts for the Monday opening call, all the year charts that normally would be sent every day, I start them in the weekend. And I put a little arrow, an up arrow here, and an up arrow here. What is this? This is the Dow daily chart, I wrote a whole sort of pre-see on what I was looking at. The candle that was formed on Friday, it's a pattern of a candle that has either no wick at all, it's either a big red candle or a big green candle with no wick. But I said it's like it's that type of candle, it did have a little bit of a wick, but what it did is it rounded very sharply. So you're looking at the low that was made on the 7th of August, the very next bar has that big green candle, and then there's a tiny candle, and it comes down sharp. So I said, I think we're right here in the same situation, we've got that same candle on Friday, tiny little wick, but mostly it was just open and closes, that's what you look at as the full candle. And I said, I'm anticipating that we're going to start to store here and then have a pretty sharp drop. So I'll show you the candle that we've got now, the current candle. Let me just move this away. Oops, I just made a mistake. Let me move that away. Sorry, there you are. And here it is. So we've got, I'm going to go to a cleaner chart than this. So this is the candle. There's the oval pattern, the yellow oval. That was the first one in August. And here we are. And here we are with that down move today. So that's what's matching here is that the patterns seem to be matching. I like that. What is important is that the Magdi, the moving average convergence divergence is still negative. Secastic has rallied. It's not very strong, it's at about 40%, but it has rallied. So this is a very important period in the sense that I think that we've got a confluence of factors. We've got the Fed. We've got a China trade deal, which I think we're going to play hardball. That's just my guess right now. I don't see why they need to rush to make any stands right now. So I think that we're in a tough situation. Just release for the next couple of weeks. And you can see that in the pattern of the weekly chart of the Dow, you've got this large arch. You've got a cup, then a smaller arch and a smaller cup. Now an even smaller arch. So we've got to be careful because you've got an acceleration now of the momentum of the arching and curving pattern. So that makes this base at about 25,700. Really important to hold over the next week or so. If we take that out, then all of a sudden you're starting to impact the monthly and this can last a little longer. But I do think that we're in a, I call this a consolidation phase. It's still rotational. We've been taking profits. We've also raised quite a bit of cash. We do have a long position that seems to be working quite nicely here, but today is young. Anything can happen. We're really looking to, I've said to subscribe, this is weight. There's going to be a lot of buying opportunities. We'll get your chance. You don't have to rush. I do think we're looking at lower lows and lower highs, at least for the foreseeable future. Yeah, it's going to be interesting. There's no doubt that we have this news driven market that's pretty wild, man.  And then it's the same news. If you go back... It is. It is. It's nothing. The bottom line is the way I look at it, folks, if you don't pay attention, you're great, okay? Because my take is we're not getting a deal with China. It's not even close. We're not going to resolve it very quickly, for sure. Yeah. Yeah. And guess what, folks? China sells for the rest of the world, too. I think the hand that the administration thinks they have, they don't have. That's the other side of it. Yeah, and we don't really know, but yeah, I think it's getting a little harder. But I also wanted to just point out that I always like to look at Ds in the Chapman Wave methodology and the fourth highest peak other things can happen. I'm looking at the dollar. The dollar's actually having a nice session today. It did make a peak D in the daily charge at 99.46, but it's been holding support very well. I know. It won't give it up, man. Right. Yeah, the weekly charge is in a leg D to make a peak D if it's going to go high. And so is the monthly in leg D. So I'm watching this very closely with the dollar. Folks, come over to our website at TFNN. You go right under the newsletter. As you're going to see our man, Mr. Basil Chapman, the opening call. You hit subscribe. You can get it for a month. You get it for six months. You can get it for a year. Check it out, folks. Basil, you have a great one. Safe Line, of course. Look forward to the show tomorrow. Thank you, Tom. Thank you. Stay right there, folks. Come right back.


July is going to be hotter than ever because you get up to $50 off any smartphone at Appalachian Wireless to your agreement required. Better service? Bigger savings? That's today's Appalachian Wireless, an East Kentucky network company. The Martin County Concerned citizens held a meeting Thursday at Pigeon Roost to voice their problems and concerns with the Martin County Water District. Members of the group say they hope to build up enough momentum to put pressure on the Public Service Commission to do more than simply acknowledge the problems the residents are having. People talked about concerns that they were having with the poor water pressure. It sounds like especially over on this side of the mountain a lot of times the water pressure is really bad and the water when you know when the pressure is really bad especially the water it smells like raw it smells like dead fish people were saying. Other people were saying the water is so often so chemically that it burns that has so many chemicals in it that it burns their skin when they shower and they had they get rashes they have to use lots of lotion so lots of problems with the water quality and then we had a lot of people talking about problems with the management of the water district. Representative Chris Harris of the 93rd district brought hope to the residents at the meeting. There's no question that there are some issues with the Martin County water district that need to be addressed and are being addressed. I think there's quite a bit of hope. We've got a great management consultant that is now on staff at the Martin County water district that has a proven record in other counties of being able to help straighten out messes. It's going to be a process it's not going to happen overnight but we feel like that some things are in place now that give us a good foundation to start building on and to help solve some of the problems that the Martin County water district is facing. A public forum is scheduled for August 29th in INEAS where representatives from the Energy Environmental Cabinet the Public Service Commission the Martin County water district and UK public health will all be in attendance. Reporting from Pigeon Roost I'm Sean Allen for EKB news.


Today we want to talk to you about the app project or project in Argo CD and how to use it in your multi-tenant security I'm Luke Phillips a staff software engineer at the New York Times and I'm Serhi Martinenko senior software engineer at the same company and the very same team Here's a brief overview of our agenda for today We're going to set up some background and tell you a bit about the internal developer platform at the New York Times From there we will get into Argo CD and then the app project We will discuss various security and multi-tenancy designs and some of our best practices and summarize it all together So about the times at the times our mission is to build the essential Subscription bundle for every English-speaking curious person who seeks to understand and engage with the world We are a digital first experience leaning into technology to produce comprehensive news coverage News journalism is the times most recognizable product With many others like games wordl obviously, but also crossword and have you tried connections yet? Also cooking audio and two other products that are times properties wire cutter and the athletic Some of the most popular search terms on Google will lead you to the times like wordl This generates a ton of traffic for our site So let me hand it off to Serhi real quick to tell you how as a developer at the times We really want you to focus on building great features into our products Thank you Luke. So I want to start with Speaking about the dream of a lot of infrastructure team and probably application teams would agree on this an internal development platform IDP should consist from the set of tools and technologies Glue together by platform team the platform team should treat the IDP as a product and provide the service to the application teams I worked as a back-end engineer myself and this how I imagine my like dream life day-to-day Development process. I think a lot of application developers would be happy to focus on the things that say no and understand the best to write the code good quality code Cover it with tests and deliver the feature, but in bigger organization in modern life It's a little bit more complicated. You need to think about each of these boxes and Unfortunately, often each of these books is owned by their own team and you as a developer required to find the loose ends to find the newest version of documentation and All the things that are needed like permissions and requests That's why we created the IDP inside the New York Times and we call it the DVSP delivery engineering shared platform it's a set of Capabilities tools and best practices that are available for every developer at the New York Times and its Goal is to provide them with the easy way to follow the golden path of application development We created the self-service tool that Generates a repo templatized source code CI CD pipelines and On board your application to the shared cluster where you can Enjoy the ingress layer and even some of their ability tools since we are on the event That's called argocon. I think it's very important to highlight the important role of Argo CD in this Platform we choose Argo CD as our CD tool because it's open source It follows github's principles and it's just great at doing its job The important thing that I want to highlight here is our Kubernetes runtime We have the shared clusters that are owned and managed by delivery engineering and we as Argo CD Operators are just the regular tenant in this cluster That's why we have a lot of constraints on our architecture decisions that we Need to keep in mind when we build the system and how it works And now I want to pass the mic to Luke to speak about Argo CD Thank you, sir. Hey, thank you for the background of our developer platform given our platform and architecture Choices around container orchestration ID kubernetes and utilizing get ops patterns We went with Argo CD to help facilitate our continuous delivery So when installing Argo CD you might see documentation like this we initially installed this just following these steps And creating a namespace applying the manifest This is done in a cluster where we had full administrative access and this was mostly just used during our proof of concept phases Another screenshot of the documentation how you might add a cluster What we want to point out here is through these docs and instructions through the quick start guides Make many assumptions about the access you have in clusters. You're working with ie full administrative access After reviewing with our security architecture team as well as the rest of our design and developers We had a lot of requirements. We needed to satisfy to run Argo on our multi-tenant kubernetes platform Basically no cluster wide access means that we can't use native tools to install Argo itself We had to limit Argo to certain namespace permissions Means we can't use the Argo CD CLI to add new clusters We had to create a role bindings and roles separately And we couldn't say just out of the box install crd Is we had to create a separate process for those since we had limited administrative access So considering all these requirements how we'd solve this It was a bring-your-own RBAC model decided to separate the pipelines that this that deploy RBAC resource controls from Argo workloads And this allowed us say to install crd's and roles required admin permission separately And we integrated with the bootstrapping of kubernetes clusters to manage some of this cluster resources for Argo Likewise, we took the Argo CD Helm chart from the community It's really fantastic place to start with lots of ways to customize your Argo deploy And then we separated out the results from the chart all the cluster based resources Into separate deployment pipelines from the rest of the Argo workloads itself And likewise customizing the service account that Argo CD uses to connect to different clusters There are many architectural options to choose when going with Argo CD Whether it's instance per cluster standalone management cluster hub and spoke instance prological group or split instances Balancing the pros and cons of the various architectures We enjoyed the experience of one Argo to rule them all sort of the hub and spoke model And we also have various other smaller instances of Argo for our own testing And this is how we kind of chose to build out our platform Now finally, let's look at the component view of Argo CD There exist three phases we like to say the visualize the apply and the retrieve Each phase presents different security challenges within your Argo CD configuration Who can visualize what gets applied to which destination and what is retrieved from which source? Let's go back to Sergei now to introduce the app project Thank you. And let's start talking about the topic of our presentation application project So the app project is a CRD that is installed to your cluster during the regular Argo CD installation process The project focuses on categorizing your applications and putting the safeguards around them You can limit for main things in your app project Restrict what can be deployed, restrict where those things can be deployed What kind of objects might be deployed inside application and set up the RBAC Policies to limit who can perform certain actions inside Argo CD UI or API At this slide, you can see the YAML definition of one of the app projects Even though it was generated for specifically Argo CD Argo con But the YAML is identical to other projects that we have in Production and dev environment. We'll go over each blog and explain what happens there But let's have a step back and see how our project Live in Argo CD ecosystem. So at this slide, you can see the Project XYZ that inherits some properties and limitations from Parent project, global project then Argo CD based on YAML definitions of your project limits the source Posts that are allowed to be used there and the destinations Clusters and namespaces where your application in this project can be deployed You define their bug policies to decide who can perform Certain actions on the applications and the project And if the if your application inside project contains some resources that are not allowed Argo CD would return your error While I was preparing to this presentation, I found a couple interesting discussions Online, what is the difference between application set and app project? They both focuses on categorizing and separating applications. So what is the difference? As you can see application set does not belong to any project It's all proposed is to generate the new applications that can be placed into different projects So your application set can generate the applications that would be Placed into the project for example per environment, dev or prod And now I invite Luke to speak about security concept Thank you, sir. Hey the security aspect of Argo CD app project is critical to evaluate when hardening your Argo CD instances You will face many challenges by attackers, but there are many shields to provide you by the app project Holistically consider the importance of our back how our projects continue Contribute to a secure Argo CD environment limiting the scope and permissions for different teams or applications Clusters scoped to projects sources and destinations limited to projects the read only Argo and managing the default project Consider that there are categories of projects or shields that are appropriate for the right defense Use a dedicated project for the control plane managing Argo CD control plane through GitOps is essential When projects are shared with other applications, there's an inherent risk that these applications Could compromise the Argo CD namespace. This is why a dedicated project becomes pivotal Additionally, it is essential to recognize that our control planes attack surface isn't just limited to our immediate environment It extends to the Git repository housing the control plane resources This is just a glimpse into why securing GitOps repositories is also critical crucial Argo resources are for Argo admins only resources like application set application And that project should have projects themselves dedicated to just these resources We need to ensure that only those truly authorized such as Argo CD administrators Have the power to merge pull requests to these pivotal repositories Here's a couple of examples how we separated out our own repos and how they get loaded in Delete the default project The default project itself in Argo CD might seem benign, but it is a potential Trojan horse by allowing applications from all sources To manage resources across all destinations. It's an open invitation for security breaches It's a nag nagalist to leaving your front door wide open in a bustling chicago city Though designed for learners to quickly grasp Argo CD's functionality Its potential misuse in production scenarios is vast. That's why we advocate for its removal Even if it means directly intervening with tools like coop ctl while removal is extreme Be sure to review the default project if you can't If you can restrict any settings and finally add checks that ensure no application utilizes the default project Block cluster resources in most projects also look at creating tenant type projects Cluster resources like bindings and rolls might sound benign, but that if misuse can Grant undo privileges by blocking these resources at the project level We're essentially setting up our first line of defense against privilege escalation And while exceptions exist, especially for dedicated Argo CD projects assigned to cluster admins The underlying mantra remains tread with caution Likewise consider your allow list or whitelist of resources We enforce restrictions in Kubernetes ourselves for more for more restriction Than just the namespace and we mimic those restrictions in our projects as well Narrow the roles on remote clusters. This is how we connect to our remote clusters in the hub and spoke model It's a collaborative dance though amongst Kubernetes administrators security and developers to hash out the details to find roles and proceed through this design Every cluster has its unique characteristics and our approach must be tailored to respect that as seen in this example Our Argo CD manager service count only gets read only at the cluster level Then our idp will generate Config to manage role bindings on a pertinent or pertinent namespace resources for Argo CD service account again We mimic the pertinent roles via projects Also look at the inheritance of that projects as mentioned before our tenants or apps Have restricted lists of Kubernetes resources available to them rather than repeat this whitelist in every project We utilize the global project properties available in Argo CD Every project is of a tenant type and this property is then applied as shown here There are a variety of other properties available in inheritance The read only Argo CD ensuring that proper Auditability and tracking of all changes to environment or application We enforce that GitOps principles are followed even through the Argo CD or API access our back policies Are designed for every tenant to limit their views to their apps and their actions are read only Looking at the source config in a project utilize glob patterns in your project sources Ideally all your application repositories are behind your organization or follow a certain naming pattern Likewise for destinations again utilize glob patterns for namespaces and cluster names This requires careful planning ahead of time for your platform to create namespaces and clusters to follow certain patterns A newer feature to Projects as clusters and repositories scoped two projects Say a developer has a need to break out of your carefully laid out platform design mentioned earlier in certain naming conventions Perhaps this is adding a way to add experimental or ephemeral clusters into the fold of your Argo CD platform All these patterns can be set all these properties can be set declaratively in Kubernetes secrets While we ourselves have not gone deep into this feature Still evaluating if it kind of holds to the rest of our GitOps concerns and controls But let's look at those GitOps controls Our GitOps controls for example at the new york times We are leveraging two utilities from opa the open policy agent to improve feedback and developer productivity We've used opa conf tests a utility for structured data configuration testing to automate permissions and configuration testing We write declarative policy capturing all of our previously mentioned business and security rules That can then be leveraged by developers locally and runs in our ci processes In this way we enforce compliance in accordance with our security concerns within our GitOps framework Code that isn't compliant does not accidentally get merged into our single source of truth Git repositories Further along in the feedback chain. We also bolster security by using opa gatekeeper a kubernetes and mission controller The opa policies are commonly shared across our workflow app engineers understand what the policy is Operations engineers get peace of mind knowing that configuration data meets a minimum level of compliance Before it is deployed to a live cluster environment. So now let me hand it back over to serhe Thanks, and let's go Um Into the topic of how we Facilitate the multi-tenancy using our project. So we use the GitOps principles to manage the argo cd installation and its structure As luc mentioned we use the open source argo helm Chart to install Argo cd on its own and also there is available another chart argo cd apps that we use to Bootstrap the initial structure of the projects and applications. Then we have two separate reports one for To store the yaml objects of projects for our tenants and another one to store the objects of application and application sets for each of our tenant That's how it looks like from the argo cdui these four applications are created by The The helm chart from argo helm and then it gives us ability to Quickly rebuild the system in case of failure To install it from the scratch. We basically need to run two commands helm install chart for Argo cd and helm install for Up of bootstrapped apps Then we have the up of tenant projects and up of tenant apps Those have the very similar concepts with small differences. So let's have a look at up of up projects. This is a Argo cd application that looks to the Special github repository there. We have the structure of the folders for each environment Application developer runs the self service tool which generates the up project definition and creates a pull request at this moment All the yaml linking and opa policy checks are kicked in and after some approval from engineer from our team Everything is merged back to the main and argo cd creates the new project in the matter of seconds The concept of Up of application sets is pretty much the similar We have the separate repository for that and we have a little bit more relaxed security rules there Um For example, we leverage the code owners feature of github to grant tenants the permission to Self-review the changes to the application sets Speaking about inheritance Luke mentions that Global project that we have is inherent is apparent for every project of our tenants in our Global project we put the limitation on the resources that can be deployed We have just one cluster Level resource that available for tenants and quite a long list of namespace resources We also limit the sources repo so we can deploy only applications from the our github organization And now we'll go to patterns and best practices Thank you, sir. Hey, so to kind of summarize or to bring together a lot of the ideas that we previously discussed um Ideally you want to create groups of projects and design projects around being say argo projects for argo itself tenant type projects or application projects operational projects for say your Cluster admins and also utilize the inheritance and global properties of argo cd Take time to design your infrastructure Use enumerated naming patterns for labels Take advantage of glob patterns to link projects to infrastructure Also take time to design your rback in tenancy common repeatable roles for tenants and apps utilize an oidc for groups and limit destinations for tenants Manage product projects with git ops use After bootstrapping your projects and apps use an app of apps or app of projects synchronization process And use governance ci security Audibility and a various other git repo security tools like say opa um And finally consider the end-to-end developer experience utilize an idp approach to be the front door to your platform Let the idp create update and manage all the project resources in your git ops repo Back to sarah. Yep. Just to summarize everything that we talk about today Couple bullet points. So application project is a must have if you have the multi tenancy argo cd You obviously probably don't want to give the all access to everyone inside the system Using git ops principles for managing argo cd is an awesome thing You have all the benefits of the git ops that application developers has but like for your own system Don't forget the limitations on the application project the sources the destinations Allowed resources and obviously there are bug policies. You probably know the structure of your organization better Leverage the ci pipelines to put some sanity checks on your YAML that you push to the Repository opa policy is a great way to do that if you want to have more information about Our idp dvsp how we call it you can check this talks one would be really soon at multi tenancy Con and the another one is on Thursday If you want to have even more information about new york times You can get this in from these talks online from cube cone in europe this year Thanks everyone feel free to ping us in cncf slug if you have some questions to one chart or ideas to collaborate and If you have question we I think we have a couple of minutes left yes the question is At the moment as far as I know you can't have App projects of app projects. So you can you can't change that down It's so how many app projects do you end up? Is it one per team one per business unit application? We're trying to model one per tenant Is how we do it We're in the way a lot of our awsma multi account tenancies working. We're actually We have different it always some a account. So We're modeling one project per tenant, but it turns into two projects pretend it under the hood And again a lot of it's a lot of that is produced by our idp So yes, it turns into a lot of project yaml But we have automated the process of generating that quick question so Assuming that you have developers that want to push out changes quickly to lower Environments say like a dev a qa or a staging and kind of validate changes quickly What solution have you guys implemented to kind of allow those changes to be Ruled out quickly without having to do a bunch of mr's and stuff like that or pull requests going forward So We have the relaxed rules for pull requests on application Repository so if they want to play with applications that Generator parameters they have the permissions in their own team to review the request for the sub directory We don't we are not involved in this process for the projects It's a bit different story because we want to make sure that the limitations are still in place and that the project Properly tied to the tenant multi account in nws Yeah, just a quick question I wanted to know what the benefits or differences would be between this and like a open source project like capsule that kind of does Multitenancy It sounds very similar, but this one is kind of based more on get ups principle. I don't know if you guys have heard of capsule capsule Yeah, oh, yeah, I'm just I'm trying to understand that multi. Thank you. Yeah Yeah, uh, yeah, it's probably Something you would run in parallel There's a tool like that or some other operator that it will have its rules and if you have argo controlling Infrastructure apps being deployed into that you're going to mimic Say that tenancy in argo projects. Um, so projects might be mimicking. However, else you manage and define your tenancy Quick question Can you tell me maybe how is the best part to add the another cluster? How do you manage the context? What do you want to add a new cluster in argo city? Um, so the process of adding a new cluster in argo city Yes, how do you manage what is the best party to manage like the context um As far as adding a new cluster out of the box, you have the argo cd cli that will Create the kubernetes secrets that argo cd uses to manage that We've kind of reverse engineered that process and our idp will manage that creation Of those resources. We had to like kind of build some tooling that Mashed together our aw we're in eks. We're in aws So tooling that works with eks and aws identities to connect to these new clusters bootstrap them with this new Argo cd service account and then we get those credentials Um, shove it back into shove it into a vault that then makes it back into argo cd