All right, that looks good. Again, thank you for showing up today for our webinar, Security and Access for Kubernetes with Jonathan Canada, our sales engineer. Jonathan has a lot of experience and a lot of certifications in the industry and he's gonna go over a workflow on how to use RBAC and SSO for Kubernetes using open source teleport and GitHub Teams work around. So Jonathan, take it away. Thanks, Micah. Hi, everyone. As Micah mentioned, I'm Jonathan Canada. I'm a sales engineer here at Teleport. In this webinar, I'm going to talk about best practices for controlling access to Kubernetes clusters using role-based access control, so native Kubernetes RBAC capabilities and then tying those roles to SSO identities using open source teleport. So everything I'm going to discuss today is all open source, it's all free tools. And if any questions come up, please feel free to put them in the Q&A section of the Zoom session and we'll definitely get to them at the end. Here's the agenda for today's webinar. So I'll first start with a high-level overview of security discussing attack surfaces, security architecture, zero trust concepts and tying those into how you might approach securing Kubernetes workloads. I'll then move into speaking about using a unified access plane or an access gateway for accessing infrastructure. I'll then discuss native RBAC capabilities within Kubernetes. I'll then move into an overview of my demo environment followed by an actual demo. And finally, I'll answer any questions that have been added to the Q&A chat. In this section, I'll define a few key security concepts so that we have a common set of definitions to work from. The first is an attack surface. According to NIST, an attack surface is the set of points on the boundary of a system, a system element or an environment where an attacker can try to enter, cause an effect on or extract data from that system, system element or environment. So in other words, an attack surface describes all of the vectors for exploitation. And this slide discusses the different technology layers you'll find within an organization. And as you look at each one of these layers, you'll want to perform an attack surface analysis for each one to determine how you can best mitigate potential threats and vulnerabilities within each of these layers. So some questions to ask within each one of these. So for networks and infrastructure, how are users and devices accessing your networks and servers? Is SSH being used? Applications. What applications are running in your network? Who has access to those? How are those being secured as well as the underlying operating system and host? How is data being protected? Endpoints. How do you control which users are authorized to access different parts of your network and different parts of your infrastructure? Then lastly, cloud. Are there open S3 buckets? Are API keys being shared or not rotated? And with each one of these layers, if you look at Kubernetes, the Kubernetes deployment can cover all of these layers. So it's critical to think about how you can properly secure your Kubernetes server API, the applications running in your clusters, the infrastructure, the clusters they're running on, and the endpoints your users are accessing the Kubernetes clusters from. The last high-level security concept I'll mention is ZeroTrust. ZeroTrust is a model that was developed in response to NIST's request for feedback to a document called developing a framework to improve critical infrastructure cybersecurity. Now, according to the analysts at Forrester, the three main concepts of ZeroTrust are, ensure all resources are accessed securely regardless of location, adopt a least-privileged strategy and strictly enforce access control, and then lastly inspect and log all traffic. Now, how Teleport can fulfill each of those concepts at a high level is Teleport uses end-to-end TLS encryption. Open-source Teleport can map GitHub teams to groups and users that exist within Kubernetes clusters, so RBAC within Kubernetes.  So now we'll discuss using a unified access plane. And when you talk Kubernetes, the odds are is that you will end up with multiple clusters. You might have a development cluster, a staging cluster, a production cluster, et cetera. You might have clusters per region, but in order to deal with all of those different clusters, you really want to centralize the access.  And that gateway is a great place to attach to your SSO identities, any requests and any modifications. That way you get accountability and user attribution from everyone in your organization about who does what and when to your production and staging environments. So you really want to make sure that the gateway only allows SSO users through and records their identity with their requests. The other thing is, even though you're using Kubernetes and it hides a lot of the underlying hardware and infrastructure, as I mentioned in that layers slide, all of that is still there. The servers are still there. There are applications in your clusters. There are still operating systems and most likely you still manage everything under Kubernetes. So the worker nodes, control plane, access that via SSH or something similar. So you want to remember all those different parts that go into a Kubernetes deployment. So you should do all of the same enforcement that you do for Kubernetes as you do for SSH or internal applications that is attach SSO identities to your access control. And when using SSO identities, you should map users and groups that exist in your identity provider to users and groups that you create within your Kubernetes clusters. And groups and users within Kubernetes can be created using native Kubernetes role-based access control, which is what I will get into now. So role-based access control or RBAC is a method of regulating access to computer or network resources based on the roles of individual users within your organization. So this means use least privilege and grant access based off of a user's role within your organization. Now, Kubernetes RBAC role or a cluster role, they contain rules that represent a set of permissions. Those permissions are purely additive, so there are no deny rules. Now, the differences between roles and cluster roles, a role in Kubernetes always sets permissions within a particular namespace. So when you create a role, you have to specify the namespace it belongs in. The cluster role, on the other hand, is a non-namespace resource. So the resources have different names, role versus cluster role, because a Kubernetes object always has to be either namespaced or not namespaced, it can't be both. If you want to define a role within a namespace, use a role. If you wanted to find a role cluster-wide, use a cluster role. And in my demo, I'll demonstrate using a Kubernetes role to limit a group to a single namespace. So I won't be using a cluster role in my demo. As far as my demo goes, I'll first provide an overview of my demo environment. So I've created within GitHub, an organization that I've called Kubernetes org. I've created two GitHub users, an admin user and a dev user. I've then created two GitHub teams, an admin team and a dev team. My admin user is a member of both teams, the admin team and the dev team, whereas my dev user is only a user within this dev team. I've also limited within Kubernetes that the dev team can only be part of the dev namespace. They're not going to be able to do any actions outside of that one dev namespace. I've set up two Kubernetes clusters, two internal applications. I've enabled SSH on one of my two Kubernetes clusters and I'm using Let's Encrypt for sign HDTPS certificates on my Teleport proxy. So again, everything I'm doing here is completely freely available and open source. So these are my two users, again, the admin user, dev user, they want to access some resources down here, whether it's an SSH server, Kubernetes cluster, an internal application. From their perspective, they will never directly access any of these. So that's one added layer of protection is you can now keep your Kubernetes server API hidden from the public. From these user's perspective, they go through the proxy before they access anything down here. And how they go about accessing these different items is they can use TSH, which is Teleport CLI tool. They can use Coup Ctl, normal Coup Ctl with Kubernetes or they can use a web UI that's served from a Teleport proxy. So for my demo, I have Teleport proxy and Teleport authentication service, both running on a single EC2 instance. For production deployment, I would advise separating these two components and making each one of these highly available.  And the role of the authentication server is to store all the logs that Teleport is generating. So those logs are a trail of who is doing what, when and it's all tied back to their identity. The other log is session recordings. So SSH sessions, Coup Ctl exact sessions and then also certificate authority. So when a user goes to authenticate to access something down here, what I have set up is this SSO integration. I created an OAuth app within my GitHub organization. And based off of one of these, each of these users group membership within my GitHub organization, they will be able to access something accordingly. So for the admin user, they're gonna be able to access everything. My developer user, they're going to be limited to only being able to SSH as an Ubuntu user, and they will be limited to the dev namespace within my Kubernetes clusters. So when either one of these successfully authenticate, they will receive a short lived SSH certificate that they can use for accessing SSH servers. And they will also receive a short lived Qube config that they will use for interacting with Kubernetes. And again, everything they do is tied back to their identity as it is within GitHub for this example. So I will now switch over to my demo environment. So the first thing that I will show here, first of all, this is my local laptop. So I'm not remotely accessing anything right now. How I've set up the integration with my GitHub organization and my Kubernetes clusters is using a GitHub authentication connector. So if I take a look at that in here, the part that I will highlight is this teams to logins piece. So what this is saying here is, here's my organization, Kubernetes org, here's a team within that organization. So anybody who is a member of this team called admins, they will be allowed to SSH as root, as Ubuntu, and here's where they get mapped to any Kubernetes groups that I've created. So in this case, they're getting mapped to the system masters group, which is an admin group within Kubernetes clusters. So they're gonna be able to do essentially anything. Whereas here, I've created this mapping also within the Kubernetes org in GitHub. This team I've created called devs, somebody who's a member of this team within GitHub, they can only SSH as the Ubuntu user, and I'm mapping them so they only can be part of the devs group within Kubernetes. And I'll show you that the devs group can only be part of the dev namespace in my clusters. So if I show you the role that I created for my two clusters, it's pretty straightforward, this one. This is saying this is in the dev namespace, this is the name of this role, and here are the rules. So somebody who has this role is going to be able to do all these verbs on these resources and API groups. So essentially everything within this dev namespace. And I've also created a role binding which is going to bind a subject to that role. So in my case, the subject is a kind of group and the group name I'm creating is devs also within the dev namespace. And this role binding is referencing this dev access role that I just showed you. So this is how I'm creating this devs group and then also mapping it to the role so that somebody in the devs group can only do things within the dev namespace. So now to actually log into my teleport cluster to show you my Kubernetes clusters and everything that the teleport can do for me here, I'm going to use TSH, which is that CLI tool used by teleport. So I'm going to TSH login to this proxy that I have. So this is its URL and this proxy is being served from that EC2 instance that I mentioned a moment ago. What I'm going to do here, so by default it's going to open my Chrome browser, but I have two other browsers open. I have a Safari browser. This is where I'm signed in as my admin user in this GitHub organization. Then I also have a Firefox browser open where I'm logged in as this dev user who's also part of that Kubernetes organization. So what I'm going to do is copy and paste that link that teleport gave me. So it allowed me to successfully log in via GitHub because I was already logged into my GitHub here as this user. So if I return back to my terminal window, I can see I've successfully logged in as this user. So that's my admin username. This is the cluster. I get these SSH users that I can log in as and here's that system masters group that I get to be a part of. So now if I do TSH, cube LS, I can see that there are two Kubernetes clusters that are part of this teleport deployment. So if I want to switch between the two, you can see right now I'm logged into cluster one, if I do TSH, cube log in cluster two. So I switches me over. And if I do any kubectl requests, like get pods, so all the usual stuff, and if I kubectl exec into one of these pods, I'll do that here. That's the pod I'm going to go into with a bash shell. So now that I'm in here, I'm in this pod. I can do any sysadmin stuff I want to do. I jump around, maybe do top, fix what I need to fix. When I'm done, I can exit out of this. And so what I'll show you now is if I go to the UI, so my teleport UI, and I'm going to do it in the Safari browser window because this is where I'm logged in as my admin user. And here if I go to the login page, so this is the same proxy I was just interacting with in my terminal window, teleport.gravitational.io. So I'm going to log in using my GitHub team. So I enter here. First of all, these are two servers that I've enabled SSH access on. This one is that cluster one. Kubernetes deployment I showed you when I first logged in via TSH. If I wanted to SSH into this, I could click connect, choose one of these two users to SSH as, and this other server here, this is my actual proxy that I'm on right now where this UI is being served from. But what I want to show you here is an activity and audit logs. So built into teleport is this robust audit log feature. So I can see even Kubernetes requests if I click the details on this. So I can see lots of information, IP addresses. I can see it was some request on this cluster. I can see that it was a get on pods and everything in here is all tied back to this user within my SSO, so within my GitHub teams. So I no longer have to guess who might be SSHing or who might be using Kube CTL against the cluster. It's all tied back here. And so even though there's all these, this robust auditing, you can also set up third party integrations. So you could have your logs be sent to something like Splunk or Elastic and I'll next show you what it might look like to use an Elk stack. But first, I'm gonna click this session player button. And so this is the full session when I use Kube CTL exact a moment ago, this is everything that just occurred. So this feature, I mean, auditors love this. I've also known a lot of developers myself included who love this when they have to go back and try to configure something that maybe they have not configured for a while. Maybe they've forgotten some steps. You can come back in here, watch one of these, copy any commands that are occurring and then use this to reconfigure something. So again, the two audits, two audit log types that Teleport produces are these who's doing what type audit logs and then also the session recordings like I just showed here. I mentioned that I'll show you an Elk stack that I've deployed here. So I have this internal Elk stack that I've deployed that I'm using to aggregate all my logs. So if I come in here, the only way to access this is via Teleport. So this is in a private subnet. If I go to discover, I can come in here, use queries to search for specific items. So in this case, what I'm looking for are any cube requests or any session starts. And so I can start building out queries and start building out alerts on anything I want to. The other application that I'll show you while I'm in here is this cube UI. So you might have applications that you've deployed in your Kubernetes cluster. So what you can do here is you can expose those applications via this Teleport UI. So this Kubernetes dashboard, I've deployed into one of my clusters and it's only accessible via Teleport. So I would have to use that same S to SO login to actually access something like this. So you can get creative, imagine all kinds of different applications. You might deploy in Kubernetes and then expose via Teleport, maybe Jenkins, Grafana, all that stuff. And so if I also go back to my audit logs, you can see that even opening these applications is generating audit logs. So I can see app session started, I view the details. So I can see it was this Elastic, this Elk stack. And again, everything is tied back to this user's identity. The last thing I'll show as part of this demo is, so again, I mentioned that I created this integration with my GitHub organization and Teams within my GitHub organization. So I first showed you just now somebody who is part of the admins team, they're able to SSH as root and Ubuntu, they get to be part of the system masters group. And it's because of this mapping I set up here. I'll now show you somebody who's in the devs team and how they can only SSH as Ubuntu, they can only be part of the Kubernetes devs group. So let me log out as that admin user. I'm gonna log back in to my proxy here. And I'm going to copy and paste this into my Firefox browser because this is where I'm signed in as this dev user. So if I paste that in here, successful login, come back here, you can see that I've logged in as that dev user, I can only SSH as Ubuntu, I'm part of this devs Kubernetes group. So if I try to do something in the default namespace, it's gonna fail. Because this user, they're only allowed to do things within the dev namespace. But if I now do kubectl, get pods on the dev namespace, now I can actually get stuff here. So summarize here, I created an EC2 instance, deployed a teleport proxy onto that EC2 instance, and I used two different Kubernetes clusters that were deployed behind my teleport deployment, added two applications, one application was an Elk stack, one was a Kubernetes UI that I had deployed within a Kubernetes cluster. And I showed you how you can map teams within your GitHub organization to any groups that you create within your Kubernetes clusters. So now let me switch back to my slide deck here. So to summarize what was covered throughout this webinar, remember that Kubernetes expands the attack surface of your environment. So if you introduce a new layer, you have to make some other layer less relevant. And again, those layers I'm referring to are things like network layer, cloud layer, end user, hosts, all of those. You should also turn SSH off for the majority of your engineering team. Having both present increases the probability of you getting compromised. But if you do have SSH access enabled in your Kubernetes cluster, just be sure to apply role-based access control and synchronize the two so that they have the same authentication gateway and the same access gateway. And access to all of your different environments, dev, prod, et cetera, should all be controlled through the same gateway for access and for authentication. Then finally, role-based access control tied to your SSO identities should also be used and be sure to regularly inspect and audit all access. So thank you for attending today's webinar. For next steps, here are a few links I recommend viewing. I highly recommend watching this webinar, best practices for auditing Kubernetes. This one covers best practices for auditing, logging, generating alerts in Kubernetes.


Hi everyone, I'm Joe for jazby's casebreaks.com. We did it. We filled up another full case pick your team break of 2019 2020 Panini National Treasures basketball pick your team number five Thanks very much everybody for getting in we really appreciate it All right, so there were a number of ways people got in there were team randoms There were a number of blocks here are the people who bought their team straight up, which we appreciate There you go, and some people won those teams and team randoms Here's a multi a lot of teams here multi team number block right here So remember Mike gets any and all redemptions for those teams right there Including one-of-ones glow bug you'll still get the live one-of-ones for these teams right here So live logo man for any of these teams. That's to you All right So let's move this into this screen right over here here is a fresh case Good luck. The cases that we've been ripping folks Have been pretty strong. So let's hope the trend continues here All right, so let's slide this over here You can see all four boxes on the top camera up there good luck a Zion RPA time that would be crazy that that would make that would make Nicholas Casper very happy We'll use this blank card to hide the hits here Good luck 49 out of 49 Kyle Lowry That'll be for Manny and the Raptors The one per box printing plate the answer Allen Iverson for the Sixers That's gonna be for the Sixers number block spot. That's a one-of-one for glow bug All aboard the Big Head Express These fall one per box you have you have AI autograph it right there. It's a good good spot to have him autograph it 43 out of 49 Harrison Barnes relic For the Kings that's gonna go to Eric's and Salah with the Kings There you go Eric on the board We got Jason Tatum nice that is Kind of hard to see the number right there three out of ten just three off the jersey number Celtics number three is gonna be Ryan Ryan Shackleton with that. We got Lenny Wilkins For the st. Louis slash Atlanta Hawks, that's 25 out of 25 peerless signatures Hawks 5 is gonna be for John Cedaro. We got Apprentice, Inc. Ty Jerome 85 out of 99 Phoenix Suns, that's a number block team Phoenix 5 is gonna be John Cedaro Fox in the box deer and Fox 9 out of 49 Eric's and Salah with the Kings some validating marks for you Charles Barkley 33 out of 49. See that's what I'm not. That's why I don't know 33 out of 49 sir Charles Phoenix edition Looks young and trim there 33 Ryan Shackleton number three Charles Barkley only recently started signing like significantly so We've got two-color dual relics 71 out of 99 The next one should probably be a relic as well If this trend follows Timberwolves number block team so Alex with Timberwolves one Logo man could be a relic.  No 15 Opposite of a logo man Opposite of a logo man. Oppo logo No, but you would have tell you'd be able to tell because there'd be a special foil. Yeah, you'd be like that platinum foil on there Yeah, yeah, that's why that's That's how I knew All right, Nicholas cast this still probably goes like a few hundred bucks or something like that That's the crazy thing I know Boy All right, well Nicholas Casper on the board with a Zion he won that spot Does that go for more than a few hundred dollars just that relic only? Probably good luck Lou Williams Sweet Lou Williams 66 out of 99 for the Clippers Michael got the Clippers We've got Mo Wagner That's for the Lakers printing plate for who's got my Lakers in this one Andrew Tyler foster got my Lakers straight up All aboard the Big Hit Express Paul Mills app 30 out of 99 that'll be for Melanie and the Nuggets 7 out of 25 Rook Lopez tremendous treasures three color patch For the bucks that'll be for Andrew Tyler foster again ATF Timeline relic Bogdan Bogdanovich 92 out of 99 for the Kings That'll be another one for Eric's and Salah Jordan Clarkson 75 out of 99 Utah Jazz Edition going to Teddy Stevens who won the Jazz Ryan Shackleton was enjoying some family time here. He's saying telling everyone good luck He's feeling a logo man. We thought we had one earlier Thought we had it All right six out of 99 Irsan Ilyasova for the bucks that'll be for Andrew Tyler foster We've got old school while Robert Parrish 87 out of 99 Celtics are a number block team Celtics seven or sorry seven out of 99 not 87 Seven out of 99 Jim Gray on the board with old Robert Parrish We've got Another Celtic this time Bill Walton 37 out of 99 Jim Gray with number seven Two Celtics back-to-back. He's heating up and looks like the Celtics are on fire. There's Grant Williams And and another seven twenty seven out of seventy five that three state straight Celtic seven Celtic sevens That'd be a jackpot in Vegas Yeah, the look of the There you go seven seven seven All right two boxes to go Haven't seen Jim in ages and then he just pops in bang. It's like three three hits seven seven seven. I love it Jim Good to see you Absolutely, Zach Paul you can take the worst low any logo man would be great You can get the worst logo man. You can get a Terence man logo man And it would still go for like hundreds of dollars You can get I mean apologies to Terence All right, I think there's one blockchain card per case here. There it is First is Jordan pool rookie patch autographs horizontal That will be for Golden State. That'll be for Josh Proust and the Warriors Believe it or not. Some of these cards actually do sell pretty decently on the secondary market Wow the goga batadze logo auto logo man auto one-of-one got pulled and sold for 6k just like that DeMarco Rose and seven out of 49 Spurs number block another one for Jim Gray Sean Marion sons one-of-one. That'll be for number block glow bug with number one Alex all aboard One per box We've got Michael Porter, Jr. 35 out of 49 That will be for Melanie and the nugs He stays healthy if Michael poor doing pretty great Tyler hero The recolor triple relic five out of 25 Miami heat Are a number block team 15 I 25 John Tadaro with number five Jason Terry That's 80 87 37 out of 99 for the Mavs That will be for Stephen P Laurie marketing 12 out of 25 three color patch and gain gear auto for John Ross and the Bulls We got a redemption right here Let's pull this one first. Oh, there's Terence man He heard me talking about it. He was just like what you say Was that Torch them in the Western Conference finals and I'll be like tempted Terence moon Jinxed it Michael Michael V with the Clippers.   We have to we'd have to move we'd have to move Yeah, they'd be like it's your fault disabled. Yeah disabled comments. We'd have to move Yeah, he'd be like how do you like me now jasmine's? You know and then he's like showing the badge and I'm like, oh jeez Terence man with this. There's Joel MB 53 out of 99 and Doris Burke second. There you have it folks like Some local hobby shop Jaspie's sports cards and collectibles in Hermosa Beach apparently made fun of Terence man. I was like Sixers are a number block team three Ryan Shackleton with Philadelphia three the next relic is another sixer, but this time it's for number four 54 out of 99 That's for John Siddaro. Yeah, Terence man always reminds you of the of the James Earl Jones character in the field of dreams All right the redempt Definitive ink. What is that? I don't think I've seen that for card 17 P Paul Pierce Still Paul Pierce still Pascal see Oh Pascal see how did you get that? studying the checklist Studying the checklist he lies. He knows he was in it. How else he's gonna price these teams go that goes to Manny and the Raptors Good job Nick get the bell for that. All right, so there you go Manny and the Raptors I don't think you memorize the card number. I Don't know you probably probably started the checklist a lot more than I did It's got a price these teams Yeah, otherwise you'd be counting cards in Vegas Yeah He's canceled, right? Kate Mara Kate or Rooney one of the Maras is in it. I forgot about that and who the main guy Another redemption down here folks. Is that in the RPA spot? Or is that the last one the RPA? I don't know. We'll find out. It's not two relics Sometimes there's two relics on the bottom. All right last box. Here we go Russell Westbrook 56 out of 99 Houston Rockets Rockets are gonna go to Brian Crouch We've got Grant Hill Phoenix Suns edition of Grant Hill That will be for For glow bug and the one-of-one spot. Did you get like three out of the four? I think Plates maybe all of them All aboard the Big Head Express For Alex who's thinking there could should be a monster in this last one There's Kevin Porter, Jr. 60 out of 99 Cleveland Zero goes to Mike Sommach who won that spot in the mosaic cello Many ways to get into these breaks on jaspyscasebreaks.com Grant Williams 19 out of 99 Celtics 9 is John Harris also won that spot There is Charles Barkley sixers 56 out of 99 Philadelphia is a number block team and Philadelphia six is Josh Melton. You know Josh That's a nice Barkley auto in there too that Anthony Simon's 24 out of 99 for the trailblazers Robert Runkle Won the trailblazers in a team random few more to go here. We got Tom Chambers 29 out of 49 Phoenix Suns Suns 9 is gonna be for John Harris John Harris on the board We've got out of 25 Alvin Adams another Phoenix Sun 18 out of 25 So Phoenix 8 is gonna be for Ryan Shackleton Skip the redemption on the bottom. Oh nice 10 out of 10 PJ Washington, Jr. That's a strong one Very high ceiling on this PJ Washington and an out of 10 very low number two Charlotte low-key has a lot of great hits Charlotte is a number block team Charlotte zero Mike Sommage There you go Samo and go see him play all right and Just bring that RPA to games in North Carolina and just be like PJ shoot more Got this card needs to go up in value Colossal material autographs. I don't know I'll buy you dinner I'll get y'all or chocolate chip cookie. I'll make C Show the second. No One letter. Yeah one letter. Okay. I'm gonna guess Colin sex Colin sex and see a Carousel over Carousel over colossal material autographs for the Brooklyn Nets. That'll be for Brooklyn Zero Mike Sommage with that one. There you go Mike and there you have it ladies and gentlemen another solid break in The books Thanks for watching. Thanks for breaking with us. We've got some more in the store different ways to get in We've got another full case pick your team number six We're gonna do a number We got to do the team random some mini breaks to get into the team random and probably a random number block You get another case go we also have a full case tiered or random team break only 10 spots in that break So very expensive high risk, but also a very high reward and a safer floor too I think the floor is a little bit higher as well. Go check that out on jasky's case breaks calm We're halfway there We are do too many breaks and sell out five spots straight up and we can make that happen tonight. I'm Joe for jasky's case breaks calm Thanks for watching. Thanks for breaking with us, and I'll see you next time. Bye


In this training video, we're going to look at the use of auto-scheduling tasks. So here we've got three tasks which are joined together, linked together, and they're a summary task. Now the three training courses, Excel, Wood and Visio training, and they've got different durations. Now all these dates at the present are starting on a start date of the 23rd. Now this is coming from the project information on the project tab. So that's where the start date is coming from. So if I wanted all three to be in control from one single start date, I can with auto-scheduling. So saying I wanted this particular block of training courses all to start much later. Say I wanted them all to start on going from the, let's say the 13th of August. Now I can change the start date, and they all move on now to the 13th of August. So when you use an auto-scheduling, you're picking up on Microsoft projects automated features like the project information start and finish date. So we could also say in this example, we wanted the Excel training just itself to start a bit later. There's been a delay. The trainer wasn't feeling very well. So now I can, in this example, I can, what's called out of constraint. And we couldn't do this in manual scheduling. So I'm going to double click the Excel training task, go to advanced, delay it. So start no earlier than because we don't know exactly when the train is coming back. And then from Monday the 13th to Wednesday the, so Monday the 13th of August. We don't want that one. You want Wednesday the 15th. Now I would advise to add a note for any constraints so you know the reason. We'll put trainer unable to deliver due to sickness or due to illness. Click OK. Now we've got everything has moved now to the 15th for the start of our three dates together. But now we can see that it shifted everything two days on. So the word training has now gone to the Friday. The visual training has gone to the following Monday and we can now see the change, the effect of the constraint. Now the beauty about the constraint is it's now got a note with it to tell you what the reason was. We might have a similar problem in this example with the visual training. So the visual training couldn't be undertaken for 10 days, 10 working days from Monday the 20th of August. So now I'm going to now perform the same activity. I'm going to double click it, put a constraint on and we do want the 20th of August. We want another 10 days from there and we'll go from the 27th. We'll go to the 3rd of September. Put a note in and we'll say training room unavailable. And now you can see the link between word training and visual training has really extended because the visual training now has been severely pushed out. And you can see the duration of the three together is now increasing. So it depends on the changes you're making. You'll see the summary of all three is now increasing by the effect of the constraints. And if you see any blue behind any dates, that means the effect of what you've just done. So the last constraint had the effect of knocking the last two dates out and it affected the duration. So this gives you an idea of the use of autoscheduling and the ability to add features like constraints to make a change for you or using the project start or finish date to make a change for you. So with autoscheduling tasks, you wouldn't make any changes yourself. You just let Microsoft Project make the changes for you according to specific settings that you put in like constraints. So this completes the example in this case of autoscheduled tasks. Thank you.


What's up everyone? I'm Noah and this is our skate section here at the surf station.  These are what we go with here. Here we've got our deck wall. We've got a rail, element, anti-hero, habit, all that good stuff, some bakers in there. We've even got some demo handboards here, some demo slide boards and our carver loaded skateboards here. You can come by and try out all those if you'd like.  Come on by.


Good evening. I have a statement. Tomorrow, July 1st marked the beginning of brighter days for everyone who works, saves, and helps our economy grow. For starters, social security recipients will receive their 7.4 percent cost of living increases. Many older Americans have been cruelly misled into believing that they would be denied their social security benefits. I've said when I campaigned for this office, and I've said as president, we'll protect those benefits and we will protect the integrity of social security. We're honoring these promises. Tomorrow marks the keeping of another important commitment, the second stage of the tax cut. Those who pay taxes will see their tax rates cut by 10 percent across the board. There'll be another 10 percent cut next year. Together with reductions in the marriage penalty and increase in the child care credit and strong new incentives for retirement savings, American families finally have the means to plan ahead and get ahead. The personal savings rate was 4.6 percent the first quarter last year when we came into office. It's averaged 5.5 percent so far this year, and that's before this new cut goes into effect. These tax incentives must be preserved. They're essential to lasting economic recovery. It's ironic to hear the same people who hit us with the biggest tax increase in our history, now insisting on scrapping the third year of the tax cut and indexing and doing this in the name of fairness. With their notion of fairness, low and middle income Americans would lose nearly 40 percent of their entire tax reduction.  What our critics really believe is that those in Washington know better how to spend your money than you the people do. But we're not going to let them do it, period. A year and a half ago, we inherited 21.5 percent interest rates, double digit inflation, and a trillion dollar debt. The worst economic mess in post-war history. I told the American people it would be tough. There was no quick fix or magic wand. But if we believed in ourselves, if we stuck together, we could turn the economy around and have a future filled with opportunity and hope. We've brought interest rates down, although certainly not nearly enough. While prices are still increasing, these increases are only half what they were a year ago. The buying power of Americans is growing for the first time in years. And we've had the first increase in real wages in three years. Interest rates and unemployment may remain stubbornly high for a time. And too many Americans are still hurting economically, but we are beginning to make progress. And if we stick to our plan, if we keep the Congress from going back to its runaway spending, the recovery will take hold, strengthen and endure end of statement. Mr. President, there are some who say that by failing to condemn the Israeli invasion of Lebanon and refusing to cut up arms to the invading armies, the United States and Israeli policies have become, and goals have become, identical. If there is a difference, what is it? Also, is there a difference between the Soviet slaughter of Afghans, which the United States has condemned so often, and the killing of Lebanese and the displaced people of Palestine? If so, what's the difference? Helen, you've asked a question for several questions that I have to walk a very narrow line in answering. There's no question, but that we had hoped for a diplomatic settlement and believed there could have been a diplomatic settlement in the Middle East in that situation. We were not warned or notified of the invasion that was going to take place. On the other hand, there had been a breaking of the ceasefire which had held for about 11 months in that area. I think there are differences between some of these things that are going on and things like just the outright invasion of Afghanistan by a foreign power determined to impose its will on another country. We have a situation in Lebanon in which there was a force in the PLO, literally a government within a government and with its own army. And they had pursued aggression themselves across a border by way of rocket firing and artillery barrages. But the situation is so complicated and the goals that we would like to pursue are what are dictating our conduct right now. We want the bloodshed to end. There's no question about that. We didn't want it to start. But we've seen Lebanon for seven years now divided into several factions, each faction with its own militia. Not a government in control. We have seen, as I've said this alone, we've seen the invasion of other forces, the presence of the Syrians as well in Lebanon. Right now our goals are, as for the first time in seven years, the Lebanese seem to be trying to get together and their factions have come together seeking a way to have a central government and have control of their own country and to have a single Lebanese army. That is one of the goals we would like to see. The other goal would be the guarantee of the southern border with Israel that there would be no longer a force in Lebanon that could, when it shows, create acts of terror across that border. And the third goal is to get all the foreign forces, Syrians, Israelis and the R&P, out of Lebanon. About the people who've been displaced in Palestine. Yes, and I signed a bill this morning for $50 million in aid for Lebanon there. That's where several hundred thousand of those Palestinians are. I don't think they were all displaced from one area and they have been refugees now into ongoing generations. I think when I say PLO, one has to differentiate between the PLO and the Palestinians. And out of this also we have another goal that's been our goal for quite some time and that is to once and for all, when these other things are accomplished, once and for all to deal with the problems the Palestinians and settle that problem within the proposals and suggestions that were made in the Camp David of course. President, by all accounts Secretary of State Hay offered to resign several times. Why did you accept his offer this time? And what are you going to be doing to make sure that the sort of problems that led to his resignation don't occur again? Well once again you ask a question in which when I accepted his resignation I made a statement that I would have no further comments on that or take no questions on it. He only once offered to or came in with a resignation and submitted his resignation to me whenever else has been heard that was never in any conversation between us. And he presented his resignation and I with great regret and sorrow and that's not just a platitude, I really mean it, accepted that resignation. I must say at the same time I also stated and I will state again his service to his country and his service to our administration has been all that could be desired and I have profited and benefited by his wisdom and suggestions and he made his letter of resignation plain and to save further time for many of you as I said the first day I will comment no further on it. Mr. President, looking to the future there were some problems in this area, in the foreign policy area can you say if there are going to be any changes or if anything will be done differently so the sort of problems that led to his resignation won't reoccur? There's going to be no change in policy, foreign policy has come from the Oval Office and with the help of a fine Secretary of State and I've had that fine Secretary of State and I must say fortunately for the country, for the administration, as Secretary Hague leaves his replacement is a man of great experience and a man of unquestioned integrity and I think we're all fortunate that we have been able to have such a replacement. My system has been one and always has been one, not of having a synthesis presented to me of where there are conflicting ideas and then it's boiled down and I get a single option to approve or disapprove. I prefer debate and discussion, I debate all those who have an interest in a certain issue and a reason for that interest to have their say and not be said around as yes men and then I make my decision based on what I have heard in that discussion and that will be the procedure we'll find. Mr. President, what are you going to do about Mr. Thomas? Has he become too much of a liberal American to argue that he's sticking with him? Certainly he's going to be sticking with him. There are all the allegations that were brought, the many, many allegations and he asked for a special investor or a prosecutor. He asked to appear before a grand jury. The grand jury found nothing that caused them any concern or to take any action. The prosecutor has brought in a report of a thousand pages and has found there is no substantiation for any of the allegations. Now why should someone become an embarrassment if they have been attacked and undergone what he has undergone all these months and then a thousand pages of investigatory report says there was never any substantiation for those charges? As he had said in the beginning, there would be none. I think that it would be the most unfair thing in the world for anyone to think that he has been anything but unfairly and unjustly assailed. So that case is closed as far as you're concerned. And Andrea, have you been fine for some time? I'm sorry, I have to pass my question. Thank you, Mr. President. What I wanted to ask you is whether you felt, even though you won't discuss the reasons for Secretary Hague's resignation or why you accepted it, whether you feel that coming at the time of this crisis in the Middle East that you should have accepted his resignation, what would have propelled you to accept a resignation in the middle of such a crisis and do you think it has undermined our ability to conduct foreign policy with confidence abroad? No, I don't believe it has and I think part of this is because the continuity that anyone can see with the replacement or nominee, George Schultz, I just have to say that there is no easy time for a Secretary of State to resign. I don't know the time that we've been here in which there has not been some crisis or something of that kind going on and there are several hot spots in the world other than these that we've touched upon so there just is no easy time for that to happen. How do you respond to the state of your confusion in your foreign policy? I would respond by saying that I think that we've been pursuing this foreign policy that is sound, that we've had great successes in a number of areas with this. Granted, we have some problems in the world that we would like to be helpful in and we've not secured or been of the hope that we would like to have been but when we came here, our own national defenses were in disarray. We have started the rebuilding of those defenses. Great question with the terrible tragedy in Egypt that the Camp David first called for the return of the Sinai might not be carried out. It was carried out. We have just had 11 months of ceasefire thanks to the Herculean efforts of Phil Habib who has been there performing yeoman service, keeping the lid on that situation. We offered our help and against Secretary Hague did a superhuman job in trying to prevent bloodshed in the South Atlantic situation regarding the Falklands. We were unable to succeed in that to persuade the aggressive party to leave the islands and then have a peaceful solution to the problem but I wouldn't refuse to do it again in a lack situation. I thought we had a proper place in trying to solve that but in the southern part of Africa, the independence of Namibia, this was dead in the water. We have made great progress there and we're very optimistic about what might take place. I think there was disarray with our European allies. I think that has been largely eliminated and they have confidence in us once again. So I think that we're progressing very well with what it is we're trying to accomplish. President, what sector are you preparing to take? It's because we're going to resume fighting with Lebanon, and we're going to be on all of the West Bank routes. And what is the United States prepared to do for the intelligence with legal rights to confirm it, both in terms of the part of the U.S. courts? This is a question again where I have to beg your tolerance with the delicacy of the negotiations that are going on in the trying to achieve those three major points that I mentioned. There's just no way that I can comment on or speculate about what might happen because I don't want anything that might in any way affect those negotiations, all of which involve the very things that you're asking about, and I just have to remain silent on those. President, your proposal to grant tax credits on income tax to the parents of the children who attend private schools is now under attack, as you know on the Hill. The critics say that this will cost a billion and a half dollars a year eventually. It will help the rich, it will help schools to discriminate, and they also say this is just a political ploy for certain votes. And are you really planning to fight for the passage of this bill at this session of Congress? Yes, I am, and I'll tell you something. In eight years as Governor of California and in 17 months here, I don't practice political ploys to get votes. I do what I think is right. And for those who say that first of all that this benefits the rich, the overwhelming majority of parents or families with children in independent or parochial schools in America today have incomes of under $25,000. 40% of the students in the Catholic schools of Chicago are black. This whole measure is simply a recognition of the unfairness of people who in an effort to, they hope to improve the education or get the kind of education that they particularly want for their children are willing to pay the full burden of the taxes that support the public school system. This brings me to another charge incidentally. Those people that saved some way this would hurt the public school system. How? We're taking anything away from the public school system. What would hurt the public school system is if all of the independent schools closed and those thousands and thousands of youngsters were dumped on the public school system, which doesn't have the facilities or the means to take care of them. That would be quite additional cases. But these parents are willing to pay for one system of education by taxes that they do not use at all and then out of their own pockets pay for another system of education to educate their own children, which relieves some of the burden on the taxpayers. They don't impose on them. And I just think it's simple fairness to give them some kind of a break. And as I say, the economics of it points out that this is benefiting those people that are the lower and middle income ranges. Mr. President, in 1976, when another Secretary of State left under another President, you were critical of the explanations given and called for a fuller explanation. With all due respect, sir, don't you think that the American people deserve to know more of the reasons that led to the departure of Secretary Hague? Lou, if I thought that there was something involved in this that the American people needed to know with regard to their own welfare, then I would be frank with the American people and tell them. And I think if we're recalling the same previous resignation, I think there were some things that indicated that maybe there was something where there were sides in which the American people needed to know their own welfare. A follow-up, sir? Then you think that the entire explanation has been given as far as is necessary? Yes. I don't think there's anything that in any way would benefit the people to know or that wouldn't in any way affect the government. Mr. President, since Marine Reagan today mentioned what she termed the myopic views of the political establishment, a bohemian grove society that comes from rubbing elbows of the mighty. That's what she said, not mine. And she told us to ask you why you changed your mind on ERA. I have a two-part question. The first is why. And the second, did you ever at any time consider the possibility of selecting a female running maid like, say, Barbara Bush? Well, I came as close to Barbara as I could. My daughter's very eloquent. But since you've opened that subject, let me just make a comment of my own on that subject. I know that this was the day and the decision day, the day of reckoning. I don't think, however, that the effort over the last ten years, while there's been a difference in how to handle the problem of discrimination against women, I don't think that the effort was wasted because they didn't get the Constitutional Amendment. The only debate has been over the method of eliminating or erasing discrimination. But in these ten years, I think that their effort has brought to the attention of the people this problem. I know it did for me when I was governor, to the extent that in California, we found 14 statutes that did discriminate, and we eliminated those 14 statutes or altered them to remove the provisions in them that were discriminatory. Now, I believe in equal rights. And when I came here, I asked the 50 governors individually if each one of them would appoint someone in their own state to start looking, searching for statutes and regulations to do what we had done there in California, and this included in California to see if there are more that we didn't find. I promise to appoint and have appointed a person in our government here in our administration to also bring this together into a concerted movement and to keep helping move it along. And I found that there was a task force in the Justice Department, and I think that maybe we've made it more active since we've been here, to do the same thing with regard to federal laws and regulations and to eliminate those that are discriminatory. And now I know that many say that they will continue to try for an amendment. And I just wonder if any of them have ever thought how much of that effort and the resources that are employed in that if used in behalf of this program that I've just mentioned, if they could not achieve what it is they want to achieve and much faster, just as we did in California, and eliminate, then we're going to continue to try and do that. Mr. President, many Arab states are saying that if Israel invades Beirut, West Beirut, it can only be because you have given Israel a green light to do so. Have you done so? Will you? And what will be your attitude if Israel goes into West Beirut? Sam, this is the type of question in which, with the negotiations, the point there that I can't answer, I would like to say this. No, I've given no green light whatsoever. And an impression that I know some of the neighboring states there have had from the beginning is that somehow we were aware of this and we gave permission or something. No, we were caught as much by surprise as anyone and we wanted a diplomatic solution and believed there could have been one. Sir, if I may, last week your Deputy Press Secretary said that when Prime Minister Begin was here, he promised you that Israel would go no further into Beirut. I think also he's not having heard the written, the conversation between Prime Minister Begin and myself, that what he called a promise actually was in a discussion in which to be more accurate, the Prime Minister had said to me that they didn't want to and that they had not wanted to from the beginning. So it was not a promise not to do it. Mr. President, the British government today took steps to enable British companies to get around the U.S. embargo on sale of gas pipeline equipment to the Soviet Union. Some of your advisors including Mr. Hayk have argued all along that this embargo is going to be counterproductive and it's going to be damaging to U.S. interest in Europe. And I'm wondering if you have any second thoughts about the U.S. embargo or if you intend to take any additional steps to force our European allies to go along with it? Well, there aren't any additional steps. We're well aware that there might be legalities concerned with the contracts or the licensing of foreign countries. This is simply a matter of principle. We propose that embargo back at the time when the trouble began in Poland and as we believe firmly that the Soviet Union is the supporter of the trouble in Poland, is the one to deal with in that. And we said that these sanctions were imposed until and we specified some things that we felt should be done to relax the oppression that is going on of the people by their military government. Now if that is done, we'll lift those sanctions but I don't see any way that in principle we could back away from that simply because the Soviet Union has sat there and done nothing and this is the reason for it. I understand that it's a hardship. We tried to persuade our allies not to go forward with the pipeline for two reasons. One, we think there is a risk that they become industrially dependent in the Soviet Union for energy and all the valves are on the Soviet side of the border that the Soviet Union can engage in a kind of blackmail when that happens. The second thing is the Soviet Union is very hard-pressed financially and economically today. They have put their people literally on a starvation diet with regard to consumer items while they poured all their resources into the most massive military buildup the world has ever seen and that buildup is obviously aimed at the nations and the alliance and they, the Soviet Union, now hard-pressed for cash because of its own actions can perceive 10 to 12 billion dollars a year and return for that energy when the pipeline is completed which I assume if they continue the present policies would be used to arm further against the rest of us and against our allies and thus force more cost for armaments for the rest of the world. And for these two reasons we tried to persuade our allies not to go forward. In some instances they claim that the administrations before them see there's others that have had administrations before them had made contracts which they felt were binding on their country and so forth. We offered to help them with a source of energy closer to home Norway and the Netherlands and the gas fields that apparently have a potential that could meet their needs. We weren't able to get that agreement. We did have some success with regard to credits where the Soviet Union is concerned. But this, our sanctions, as I say, have to do with actions taken by the Soviet Union and our response to those actions. And... May I ask you a few more questions? Earlier this week one of your cabinet members was quoted as saying about you I've told him time after time that he has to stop telling those guys around him that he's not going to run again.  I didn't know that it is far too early to make a decision on a matter of that kind. But I can answer your question more completely. No, I have not been telling anyone around me that I won't run again. I have at times even expressed the idea to them that it would be unlike me, I think, to walk away from an unfinished job and I've suggested that they shouldn't waste their time reading the help wanted ads. Well, that seems the legalities of announcing a side. That seems to indicate to us that you would be indicating you're leaning in favor of running in 1984. No, what it says is no decision has been made one way or the other because it's far too early to make such a decision. Yes. Mr. President, do you intend to keep or in the near future remove the sanctions imposed on Argentina and the Falcons crisis? I can't give you an answer on that or what is going on right now. We did our best, as I said before, to try to bring about a peaceful settlement. It didn't happen. There was armed conflict and there has been a victory and a vanquish. And now it's hardly the place for us to intervene in that. We'll stand by ready to help if our help is asked for. We just haven't had a discussion on that matter as yet. Mr. President, I don't know if I'll succeed where others have failed before. I understand your reluctance to discuss the Hague Resignation. But two specific questions that seem to arise from that resignation. Do you think that there were mixed signals sent to the Middle East which resulted in the PLO getting one impression that you were pressing the Israelis to withdraw while the rest administration was trying to maintain pressure on the PLO to evacuate Nassam. And the second one is did you sort of blindside your own State Department when you suddenly made the decision to take your most severe option on the pipeline leaving the State Department dangling to explain to Western Europe? Well, there was no blindsideing on that, take the last part first. That was fully discussed and has been several times in the cabinet. There were differences of opinion about the extent to which we would do it or whether we would do it at all. And I had to come down as I did at the first on the side of what I thought was principal as to conflicting signals, no. I know there have been rumors about that. No, we have been in constant communication through the State Department with Phil Habib and taking much of our lead from his reporting of what's going on there and what we can or can't do that might be helpful. And naturally there were times I just had conversations with the ambassadors but everything that is discussed is then related to whoever was not present, National Security Council, National Security Advisor, State Department so that at all times and there has never been any dual track or confusion with regard to our communications. What initiatives of any are you going to take to make very certain that that law is enforced? I'm going to take every initiative there is it's my responsibility to see that it is enforced. I think the one prime responsibility at the federal level is to guarantee every citizen, no matter where in the land the citizen may be if those rights are being violated. It didn't take me long there was quite a bit of legislative debate in the Congress about that bill and some provisions I had said in the beginning if they wanted to just send me the original bill I would, and I offered them at the very beginning to extend it for the longest period it's ever been extended ten years. The I knew those civil rights leaders have that impression and as a matter of fact they are doing a little bit of image building about me. I would like to have any one of them point to a single instance regard to me that supports their idea that in any way I am racially prejudiced or not in full accord with providing civil rights for all our citizens and that goes back before there was a term close to the rights. I was raised in a household and actually the only intolerance I was taught was intolerance of bigotry and I will match my record against some of those critics and maybe not their words because not many of them are gifted with rhetoric but with actual deeds I appointed as governor of California to executive and policy making positions, more members of the minority community than all the other 32 governors that have preceded me in California history. Right now after 17 months we have been proceeding along the same line here in our own government and incidentally in response to another question here because regard to the sexual discrimination I think we're ahead of just about anyone at this point with regard to the appointment of women to high positions in our government but as a student I thought this when I encountered it as a sports announcer I did as much as I could do at a time when prejudice was deeply embedded in the world of professional sports I've given you the record as governor and since then and it's kind of frustrating it really does bother me. I wish sometimes one of them would tell me what it is but I just wonder sometimes if some of those critics aren't guided more by politics than Mr. President, some Israeli officials have acknowledged in recent days the use of cluster bombs in the war in Lebanon. How much does this concern you? It concerns me very much with the whole thing. We have a review going now as we must by law the use of weapons and whether American weapons sold there were used offensively and not defensively and that situation is very ambiguous the only statement that we've heard so far with Regoner to the cluster bomb was one military official Israeli military official has apparently made that statement publicly and we know more about it than what we ourselves have read in the press but the review is going forward and the review that would lead to what the law requires that we must inform the Congress as to whether we believe there was a question of just being an offensive attack or whether it was in self-defense when I said ambiguous you must recall the prior to this attack Soviet built rockets in 180 millimeter cannon were shelling villages across the border in Israel with civilian casualties in the colonies cutting through all those hands still in fact how do you think the human lefts and say what should we care what do you understand it just means that Frank won't be able to talk about you won't be giving Mrs. Reagan for her birthday what are you giving Mrs. Reagan for her birthday I can't tell good plan good plan