A very good morning, good afternoon and good evening to all of you from wherever you are joining. Welcome to this webinar where we would be talking about securing requests with Key Cloak and Istio. So we would be diving into the world of Kubernetes security. Before we do that, a quick round of introductions. I'm Atul Priya Sharma. I am a CNCF ambassador and I also work as a senior developer advocate at InfraCloud where I deal in cloud native technologies like Kubernetes, Istio, and have been exploring observability of late as well. Outside of work, I am a 4D and love doing road trips. Good morning, good afternoon, good evening. I am Sherpas Pratap. I'm working as a site-level engineer at InfraCloud. I actually started using cloud native service back and now I help our clients to build robust, secure, and reliable infrastructure using cloud native technologies. Quickly getting into the agenda of what we plan to cover in this webinar. So we would start by giving an overview of the various security options in Kubernetes. We'll then dive into Istio and we'll see how authentication and authorization works when it. We'll also look at request-level authentication and authorization. Quick look at JWT tokens and finally into the demo. So to start with, we know that Kubernetes has become the operating system of the cloud and with the complexities that our application and infrastructure have, it's very important to have a robust security measure in place. So we'll start by discussing some of the existing security features that Kubernetes has. So Airbag basically helps us control who can access and perform actions without accessing your Kubernetes clusters. So you can think of them as bouncers at an exclusive club. So it allows you to define fine-grained permissions for user groups and accounts. This is one of the very popular ways for securing access to your clusters. Next one we would like to discuss about is pod admission policy. You can think of it as your vigilance security guard outside your building. And so when a pod is created, the policy kicks in and validates the configuration and ensures that only authorized folks are allowed access to your pods. And lastly and most important is the network policies. And if you are dealing with networks within Kubernetes, you would have come across network policies. These are basically like virtual fences that safeguard your network. So we can create logical boundaries that allow only authorized communication. These three are relatively the basic options, yet important options that Kubernetes provides out of the box. However, there are a few shortcomings of these particular native options. So especially looking at it from a point of view of network policies. So the first one is that network policies focuses only on controlling the traffic. And it does not provide a mechanism to force your internal traffic going through a common gateway. Apart from this, it also doesn't provide any feature to tackle with DLS related configuration. So if you are going to handle anything related to SSL certificate management and encryption, these options don't quite provide these features out of the box. So that's where we need some tool that can help us deal with all of this. And that is where Service Mesh comes in. Service Mesh such as Istio or Linkerty, it provides a dedicated infrastructure layer specifically designed to handle secure communication. So in a typical microservices architecture, you know that services communicate with each other extensively. And it's very important to ensure that all the communication that is happening is authenticated and secure. So apart from the regular features like traffic shaping, load management, as well as traffic routing, most of the service meshes also come with security features. Some of them include native support for MTLS and JWT authentication, which is basically, you can offload the authentication from your application, from your cluster to Istio or Linkerty, whatever service mesh that you're using. It also gives you an observability layer so you can control and have a visibility over the network traffic. So in a way, it also helps you secure and monitor traffic within your network. And lastly, it also gives you some fine grain access control over your network and the requests that are coming in. So this was pretty much about what Service Mesh can do when it comes to security. We will now look at how Istio can help us in this regard. So let's see Istio's authentication and authorization. How Istio provides the, out of the box authentication and authorization for your services in your Kubernetes cluster. So basically Istio provides lots of authentication. One is peer authentication and another is a request authentication. So peer authentication allows, like define how traffic is getting done to your workloads in your mesh. That means like Istio, peer authentication controls the mutual TLS traffic between your services in your mesh actually. The request authentication policy allows you to define the mode of MTLS which you are going to be used in your mesh actually. So there are three types of MTLS modes actually. One is permissive, one other is strict and the last one is disabled. So by default the mode is permissive. That means the client is sending a request to a server service and that client service don't have any certificate with it. Then it will allow the, basically it will allow plain as well as MTLS traffic. So that is what we can control through the peer authentication and request authentication used for the end user authentication. Like whenever a end user make a request to your services with any credential attached to it. So Istio request authentication is responsible for validating those credential. Most of the case Istio only supports the JSON web documents which we abbreviated as JWT. So request authentication verifies the attached JWT to your request and decide like whether the request identity is authenticated or not. And when the request get authenticated it forwarded it for the authorization. So next part of this process is authorization. So Istio provides authorization. It's a simple of the CRD custom resource authorization policy and lets us control the workload to workload and a work end user to workload traffic. So we can define multiple policies for our services in our mesh and control like how our services can authorize the end user or the service which is communicating from the same cluster. And there are basically three types of action which we can perform using authorization that allow, deny and we can provide the custom actions as well. By default the action is allowed. So whenever we create any authorization policy in our own mesh so without any action so by default get created with the allow action. It is recommended to start with all deny in your cluster and start creating some allow policies for authorizing the request coming from outside your cluster outside your mesh or the traffic coming from the same mesh or we can use authorization policies in multi cluster setup as well because Istio works very well with the setting up a multiple cluster. In this diagram we can clearly see like how traffic flows when we introduce a Istio service mesh in our cluster. If you see the traffic is like the traffic between services is MTLS like if you see the green lines that showing traffic is going from one service A to service B is MTLS and it's secured and the traffic from end user to your services coming through the interest gateway and the JWT with the JWT plus from interest gateway to your backend service is again MTLS. So end to end your application would be secure with MTLS and proper authentication and authorization mechanism. So let us get into the request level authentication and authorization. Before we dive in it's important to understand why something of this sort is actually needed within your cluster. So request level authentication in Kubernetes cluster serves multiple purpose. It allows users to access data securely. It grants programmatic access for various applications and facilitates reliable communication between various services. So what you see here are different use cases that we have listed where request level authentication might be required rather is required. So it basically is required to allow users of your application to access data on your server through a browser or over a mobile phone app. It also is required to give your end users both people and programs programmatic access to data managed by our application which can be through means of APIs or some end points. And lastly to let other services that make up your application's infrastructure communicate with each other. So these are some scenarios where request level authentication is required. And before we deep dive into the demo and the crux of today's webinar, let us quickly go through what JWT is. So JSON WebToken is an open standard that defines compact and self-contained way of transmitting information between parties as a JSON object. And it is a very popular user authentication standard as well. So this token is made up of essentially three components. You have a header, you have a payload, and you have a signature. So in this diagram is a basic structure of a JSON WebToken. So you can see the header which defines the type of algorithm and the type of token. So here you can see the algorithm type is HS246 and type is JWT. The payload essentially has the meat of the token. So things like the name, the issuer, what's the role, the issuance time. These are the things which we define in the payload. And lastly is the signature, where basically we can use a combination of our public and private key to sign the entire token. So the JWT token is basically consisting of these three particular components. And in today's webinar, that would be the crux of the demo that we have. Yeah, so STO allows us to validate JWT tokens using the request authentication, which is a custom resource, which we will see how we can get the request authentication in the demo. So request authentication will validate whatever the access token we will attach to a request while making API calls to our applications API endpoints and validate it with a key clock, because we will be using key clock as our authentication provider in this demo. And once that JWT get authenticated, it will get passed to the authorization policy. An authorization policy verifies whether it is the authenticated identity or not. If it is authenticated identity, then it will allow us to access the API. Otherwise, we will get an RBAC access denied error. And as you can see in this diagram, it is the high level of work, like how our application workflow will look like. So we will make the API call to our working for application with the JSON web token, which we will generate from key clock and we pass like it as an authorization bearer. And that request will go through the request authentication and authorization policy. And if all the things identify that JWT, which we have attached is valid, then we will get a response like a 200 response. Otherwise, we will get a 403 RBAC access denied. So let's see how this actually will look like in the demo. So let's get started with today's demo. And for today's demo, I will be using a local client cluster with the metal LB installed on it, which will allow us to create a load balancer service because we would need a load balancer for SKU in Gray Skateway and key clock service. I have deployed one simple application, which is a book in for application. That application exposes to 8.14, adding a book and one for outweaving the book, which we have already added into the database. So this tool, like this is the application method and this is the database, which we're going to store the book information. I have already set up a SKU on this local cluster, set up with a demo profile and installing a SKU is fairly a simple step. You can follow the official documentation of the SKU, how it can get started with SKU. And I have also installed the key clock locally in this cluster. So setting up a key clock on Kubernetes is also simple, you can follow the get started with Kubernetes right on key clock official documentation. So let's see how our application actually look like. So let me first make an API call to my get, I'll first extract the IPs of key clock and SKU gateway because we would need it more frequently in this demo. So I have to just let us make an API call to get the API endpoint and see what we get. So you see, we got the empty array, means there is no books added. So let us add one sample book to the database because if we see this, means it's not added. Let us check by making a good book. Now we can see we have added one. Yeah, but in real world, you may have your application exposing the API which is allowing users to store data into the database and you don't want, anyone can access those endpoints. It should be accessed by the authorized person. So let's say in our application example, we have to restrict our ad book API. In this case, in this way, only the authenticated user can only be able to add a book and the get book API will be available for public viewing all the books from the database. Let's see how SKU help us to do that with the developer. Any authentication provider. In this case, we are using key clock. So let's first set up a key clock. I have already installed the key clock. So let me, let me craft the IP of key clock service load balancer when key clock you want. When login as a admin, so in key clock, you can, there is a very good documentation of key clock in general. Go and read about how key clock works. Other features key clock provides like O2.0 or SSO or SAML. There are lots of features which we can provide. And in key clock, everything comes under a RIA. So there is a master RIA by default. We have, we will create a new RIA. So let me create a new RIA. I'll give you the name as a studio. I'll keep it simple for the sake of this demo. Then we have to create a client. We will create an open ID connect client which will allow us to request a JWT and generate a JWT. So the client type would be open ID collect. I'll give the client ID again as a studio. So I have to keep it fairly simple actually. So like next we don't have to change anything here. Anything here, yeah, then we are done with creating a client. So now create a user. So we would use this user to generate access to open and make a API request to our application. So I'll create a user as a broker admin. So this is a fairly simple step because for the sake of demo we are taking it simple, but you can explore what all things you can do with the key clock. So I have here, let's deal with this user. Let's set a password for this user. Let me set it as a password for this user. Again, don't use such a password. So now we are done with key clock setup actually. That's all we have created a real in that real. We have created a client and we have created a user. So let's see if we are able to generate a token or not. All the tokens usually end point to call when we want to generate a token. So here we have given the client ideas to the user name which we have created and the password and the client type. Here we are able to generate a token and we will use this access token to make an API request to our books application. So let's see how this will look like in action. Yeah, so for that first we have to create a serious request authentication to validate the access token which will attach to our request. So let's see how this authentication policy will look like. It is fairly simple. Here we have just created a match rule to where to apply this authentication policy. So here we are saying like apply this authentication policy for all the ports which are running with the label looking for and we have given the JWQ rules. So here we have given the issuer from where we are generating JWQs and here we are using this JWQs URI in the thing that Jason Webkey said URI which export its public key on this URI and Istio will go there and verify as we discussed in slides, Istio will verify the JWQs signature over this URI. So it is fairly simple. You will find more information about request authentication on Istio's official documentation, how all this works so you can go and check out that. Now let's apply this authentication policy, request authentication policy. So now authentication, request authentication policy is created. Now let's try to add a new book. This time we should not be able to add a new book because we have created the request authentication. But that is not a case here. We are able to add a new book and that's because we don't, we have to use authorization policies to restrict access to authenticated request only. We have authenticated that request but we have not restricted the access that only the authenticated request only able to access that API which is ad book in our business. So let's see, we have authorization policy as well. So this series authorization policy. So as we discussed, we have two endpoints. One is gate book and another is ad book. So gate book would be publicly available. So we have added only two. If you see there is no from here. And for the ad book, we have a from rule as well. So that from rule defines that the request is coming from the authenticated identity. And only it will allow. So here we are using star but you can find credit if you have multiple JWT issuer for the multiple endpoints. You can use that combination of issuer and the subject which you will get into the JWT payload. So as we showed in a slide, there are three parts of JWT, the header, the payload and the signature. So in a payload, we will get who is the issuer of that JWT and what is the subject. So you can use a combination of issuer and subject to find credit your access from. So here, after the sake of this demo, I'm using a star. So let's see how let's apply this authorization policy. And let's see what happens after. So the authorization policy is created. Now let's try to add a new book. Okay. This application don't allow us to add a similar book but this authentication policy is working. We should get our bank access tonight. We are not able to add a book now. Let's see if we are able to list the books or not. And yes, we are able to list books because we are not able to add because we have a restricted access to our ad book API. Now let's let me clear this. Now let's generate a JSON web token and use that token we are able to. Let me store this token into variable and access token variable. And now I'll use that access token. And here we are able to add a book using access token. We see the new book is added. Yeah, so it's fairly simple actually adding authentication authorization for your application. But it may get difficult if you have multiple endpoints, multiple authentication providers So in that case, you have to be more careful. So that is the end of our demo today. So that was a wonderful demo by Shevaz. We saw how we can use KeyClub to generate JWT tokens and then authenticate our request using STO's request authentication. So to sum it up, proper authentication and authorization are essential for securing any application that you might have. So Kubernetes native security solutions are not enough for a production grade security. So you might have to, you know, mix and match a couple of tools to create your custom security solution. And STO provides a seamless solution for controlling access and simplifies request table authentication and authorization as we saw in the demo. And it's fairly easy to use an external authentication mechanism like KeyClub which can help offload authentication from STO as well. So this approach makes the system more robust and secured. So that's pretty much it for the webinar. We would like to thank you for joining in. And we hope that the webinar was insightful and you took away something new from this webinar. You can reach out to us for any queries and any further questions. So thank you so much and have a wonderful day.


Hello, my name is Parker Wydenode, and I'm the guest host of Community Matters. For this episode, we're going to be talking about the benefits of being an athletic coach. So my guest here today is Coach Rick Hendricks of Mid-Pacific Institute, Track and Field and Cross Country. Thanks for being here. Good afternoon. Glad to be here. Thanks. So you've done, like, a lot of running in your time. So what is the best parts of being a coach at Mid-Pacific? Oh, I believe it's just being with the kids and watching them progress from the beginning of the season to the end of the season. It doesn't matter the ability of the athlete, it's just seeing the progression of making sure they do better from the beginning of the season to the end of the season. There's always going to be good athletes, but the majority of the athletes are average, so it's just good to see the progression and see them improve throughout the season. What qualities, so you mentioned, like, seeing everybody progress. What qualities do Mid-Pacific and other coaches look for in an upcoming coach? Basically it's just the attitude and the dedication that the athlete puts into it. As a coach, we can only tell the athlete what type of workout to do, but it's up to the athlete themselves to do the workout and put in the effort of it. So it's basically just showing them the way and then having the athlete do it. Yeah. So back when you were running, Cross Country and Track, I believe, I was just interested, did you draw any inspiration from your coach? Basically it was a lot of, I grew up in a real small town, so a town of 10,000. So it was basically, I played all sports and in high school, actually I started running when I was in intermediate school in seventh grade and it was just more of a social aspect back then and then as I progressed older, I got more interested in the competitive part of it. But actually in high school I didn't really run Cross Country. I played football in the fall and then basketball in the winter and then I ran Track and Field in the spring and throughout the summer, being a small town, I'd play golf and I'd play tennis and I'd play baseball but it was just the little things that my coaches told me to do and to strive to be better. So I couldn't help but notice that you played, I heard that you played basketball and tennis. So how did that running become your main sport? Just something that when I was in high school I was good at so I stuck with it but when I was a freshman, actually when I was a sophomore I played all three sports. I played football, basketball and Track and then when I became a junior I felt like I wasn't the athlete I should have been for running Track so I kind of dropped basketball in the winter. I played football and then I started competing for Track in the winter so there were some races that I'd go to indoors and I'd run indoor Track in the winter to get ready for the spring sports and that was Track. So just out of curiosity, when you were running Track what events did you do? I ran in intermediate school, back then it was yards, it wasn't meters back when I was running so it was yards so when I was in intermediate school it was a 600, the furthest we could run when we were in intermediate school, they didn't have longer races and then when I got into high school I ran the 880 which is equivalent to an 800 meter run round and then I ran the 400, I ran the 4x440 yard relay in high school. That's neat so we actually have some pictures of that and maybe you could elaborate on it. So what races is this? This is one of the races we hosted Invitational and this is, I believe when I was a junior and this was one of my better races and if you notice it's a Cinder Track. We barely ran on any type of hard surfaces and we had to wear really long cleats back then and running shoes back there in a really crude compared to what they are now but this was one of my better races I believe I ran around two minutes in this race for the 880 and it's pretty, I like this picture because it's like all the timers are really concentrating on getting my time and the boy holding the tape is really concentrating on holding it to watch me finish but that's a picture that I really like. That's awesome. It's crazy because how you came from going from there and now seeing how Track has evolved and how the shoes, so what are your thoughts on that? The technology is so much different now but back then it was basically just go out and run. I mean the coach would give me a workout and I'd do it but now there's so much more technology involved in doing the individual sports and it's a lot more technical now than it was back when I was running in high school. Do you think that the technology helped or hurt the sport of running? It definitely helped it but I mean back then I was running two minute half miles and under two minutes and right now there's athletes in Hawaii that are running basically that amount so it really hasn't changed that much as far as times but the athletes are so much more in tune to lifting weights to get stronger in their upper body. Back then it was mainly just working on running but now technology is building up your whole body to make you be stronger. So if there's any athletes watching over here and they're wondering how do you come up with the workouts, how do you make them? It's usually a hard, easy, hard, easy type workout. Mondays could be really hard and then you want to rest the body the next day so you might do a real easy workout or even like a cross training and then hit a Wednesday and do a harder workout and then just tax the body and then Thursday easy workout maybe cross training maybe have the athlete do a bicycle workout or even do weights on Thursday and then back to Friday do a hard workout and then easy on Saturday and then do a really long easy run on Sunday. It's just a matter of you got to rest your body you've got to do a hard workout but you have to rest your body. Is that some of the mistakes that sometimes you find even in pro coaching? Oh yeah definitely I mean there's athletes that try and push themselves too hard and it's just a matter of getting injured just pushing too hard. You just got to listen to your body and if it's saying you know I'm just tired today there's no reason just to back off and take it easy that day. Yeah and many people kind of get confused of that being like according to like laziness and all that but sometimes like and I found this out kind of the hard way because now like Coach John and you are trying to like make me have less smiles that I'm putting in a week so I've been trying my best to do that like I didn't run yesterday but yeah I noticed a major like like I noticed like performance wise that I was getting better in like time trials and stuff so yeah I think that I really benefit from like resting and stuff.  So yeah so about also eating well like for people my age that don't because we have pretty high metabolism and I still try to eat pretty well because I don't restrict calories anything how do you think nutrition wise like how we should watch our nutrition. Well basically it's it's you just got to watch what you eat as far I mean vegetables is good fruits are really good to stay away from sodas and bread and rice and just eat a lot of carbs Italian food is good I mean spaghetti carb carbohydrates is really good to hydrate but the main thing is is hydrating your body make sure that you drink a lot of water especially in Hawaii where it's really hot and you're out in the sun running at three four in the afternoon you just need to replenish your body with you know hydrate we I just constantly tell my athletes you got to hydrate you got to drink water because I've seen too many cases where kids are athletes of a run and they get dehydrated and no matter how much you tell them to drink they just for some reason skip it and it shows sometimes they just you know get dehydrated yeah and I I think it really you get like I don't know about you but like it really benefited me when I actually started writing down like workouts and nutrition wise so that way I could say oh like what am I eating and like having like for me personally like having a little bit is not that bad because if you write it down you should say okay maybe I need a little bit grams of like saturated fat and all that yeah and I think keeping a notebook is good so do you like encourage that oh yeah definitely writing down what you eat the mileage that you run every day keeping a record of of of that really helps you can just you can just see and then you can look back and see how your performances are after you you know maybe there's something you can tweak and improve on or some or you can eat something different and maybe that'll look that'll change your change your performance but keeping a record of it is definitely a big plus yeah well okay so this is um I'm like back also when you were in like in collegiate running because I know that you ran for a college right what were like the big moments in your career well right out of high school it was it was fun because I was being recruited by University of New Mexico and Texas El Paso and the local school in my town Western New Mexico and then I also was recruited by a junior college in Arizona Central Arizona and I ended up going to Central Arizona my first year and the coach was George Young who was an Olympian he ran the steeple chase in the late 60s and they ran the marathon in the late or the early 70s so he was a bit influenced my life in my early collegiate career and then I transferred to Western New Mexico which is in Silver City New Mexico so I finished my collegiate career there and it was just really really neat to do a lot of traveling to go to different places different colleges and meeting different athletes on all types of levels but I think just the travel was a lot of fun in college I really enjoyed that yeah okay so we're going to take a short break and then we'll dive more into coaching itself okay Aloha and Richard Concepcion the host of Hispanic Hawaii you can watch my show every other Tuesday at 2 p.m. we will bring you entertainment educational and also we tell you what is happening right here within our community think tech Hawaii Aloha hi I'm Ethan Allen hosts on think tech Hawaii of Pacific partnerships in education every other Tuesday afternoon at 3 p.m. I hope you'll join us as we explore the value the accomplishments and the challenges of education here in the Pacific Islands hey aloha stand energy man here on think tech Hawaii where community matters this is the place to come to think about all things energy we talk about energy for the grid energy for vehicles energy and transportation energy and maritime energy and aviation we have all kinds of things on our show but we always focus on hydrogen here in Hawaii because it's my favorite thing that's what I like to do but we talk about things that make a difference here in Hawaii things that should be a big changer for Hawaii and we hope that you'll join us every Friday at noon on stand the energy man and take a look with us at new technologies and new thoughts on how we can get clean and green in Hawaii Aloha and we are back with community matters I'm here with my coach coach Rick Hendricks and now we're going to be talking more about coaching itself so the first one I want to really like ask you is what are the difference between coaching cross-country and coaching track cross-country is more just running I mean cross-country you just have to go out and get the mileage in there will be days where we do some track work like 800s to work on more speed work but most the workouts are basically running mileage anywhere from two miles up to six or eight miles once the athlete can do that whereas on track it's more refined so track you have shorter distances whereas cross-country is a two to three mile race track is more specified anywhere from well you've got your sprinters and then your distance middle distance which is 800 and then your your more distance being 15 and 3000 so those are a lot shorter distances in cross-country so you do a lot more speed work for for track so that involves more of a track workout whereas cross-country doesn't so cross-country can I just go out and run on the road and just run run run a track is more specific just more speed work on the track okay so why why do you think that there isn't a 5000 meter and 10,000 meter on the track um well college has it but not in high school and I think it it's more of a development issue for high school uh athletes um I believe they just and time too it's a lot of time consuming you know people complain about running a 3000 a lot of coaches complain or the the parents complain about 3000 because it just takes so long and they can't imagine having a five or a 10,000 which would just you know really take a long time and attract me but it's a lot of it is is time also you only have a specific amount of time that you can hold the meat yeah what are your um biggest goals for this year in terms of um coaching wise again I go back to just making sure that the uh the athletes uh progress throughout the year um and do better um a lot of times a lot of the the athletes are in it for social aspects of it and then there's athletes like you who want to compete and really do good in competition so it's it's a matter of just you have to kind of just uh look at the athlete and see what their needs are and you know which ones to push harder and which ones to kind of back off on and uh you know if they're more social aspects of it you don't push them as hard but you want to the athletes that you're not know are going to compete really well you just you you just push them harder to to improve and do really well in the in their competition especially towards the end towards uh the the conference and the the states well I I really like also the um the social aspect too because I got to meet a lot of um people that actually inspired me to like do the sport more like Charlie and like Dane and Matt guys and I think that's like really cool that if it weren't for the sport I want to have known them so that's that's a pretty um big thing and I'm so happy that I got the opportunity plus you meet plus you meet a lot of the athletes from other schools and you kind of become bonding with them too because especially when you're in a 3000 it's it or or cross country all of you're just putting so much effort into it and you know how much effort you put into it and they're putting as much effort into it as as you are so it's kind of like a special bond that you all have together that you're running together and putting in that time together and working it so you know how hard they're working and they know how hard you're working so it's kind of a bond bond for all of you pushing each other yeah what and I don't really notice like you get frustrated but I'm just curious because you're really good what is like the most frustrating part as a coach in terms um just seeing if an athlete um can do better and they they don't um just kind of cruising along um that that's kind of just disappointing because you want them to to put in the effort and we as coaches um you know it's it's more a level of the sport we're not in in it for the money we we're in for the basically the athletes and so we we just want to we don't want our our efforts to go waste to go to waste we want to see the kids improve so we just it it's just kind of frustrating to see sometimes somebody that's just kind of dogging it yeah that's that's the most frustrating part about it so what what are your thoughts like about like new athletes coming in and how do you think that will affect the team when I'm like in varsity and stuff or even graduated like how do you feel about like new people from other schools like coming to mid-pat well I think it'd be when I first started in mid-pacific the the program was just starting to to jail I mean we didn't have that many athletes that came out and it's it's good now that to see the numbers that we get out for cross country I believe last year we had 80 athletes uh we we go from we coach from seventh grade up to to twelfth grade so it's fun to see that the the intermediate athletes get to run with the the junior and the the varsity athletes because they can kind of kind of can look up to them and see how hard they work but um it it's always good to have numbers um because you you never know there there there'll be somebody that comes in that you weren't expecting to do really well you know you might project the year before oh yeah this athlete's going to do really good and this athlete's going to do really good but that one special person that comes in and just really shines that's a big bonus yeah um like yeah it's pretty like cool that like some other people that like like you think that they're not going to be good just because they even height wise end up being being like really good because one thing that I learned is that it doesn't matter about the height it just matters like the time and effort you put into it oh definitely no it doesn't matter what size you are when you're running you know you can be four ten and and run as good as somebody actually it might be a big benefit to be a smaller smaller person in a large one but I I know larger runners have a better stride but yet a smaller person can have the turnover with their legs and and be really good at it so there there's a lot of people going to be like watching this on youtube and I know that like most some people and I mentioned this also on my instagram which has all kinds of runners and some don't even come out for track because they're like I'm not interested but then but then they do like small road races and they end up getting like phenomenal times so what would you say to them to encourage them to come out well it's basically it's not only individual sport but it's a it's a team sport so it's good for the athletes to come out and and be involved in a team sport and be around your other fellow athletes um and you you can learn from them and then it's it's like I said it's a good social sport too not only especially like before practice you can you can have us all get together and talk around and then once you're into the workout kind of push each other and then afterwards you do your cool down and you kind of kind of that's another social aspect about it just being around your other athletes and having fun with that yeah okay so I have a quick question if we can pull the picture out okay um so I so there you are um what was it's the Maui Marathon yeah this was 1986 so um when I got out of college I I kind of quit running for a while um I was in my early 20s and I kind of concentrated on just working and then in my late 20s I got back into running and I had to kind of adjust to more longer distances um of course they didn't have really competition for the shorter distance like the the 800s so I got into running road races and then I got interested in running marathons so um I ran living in Maui I lived there for 20 years so I basically ran Maui quite a bit um and then I do Honolulu also marathon but um it was a good way to just uh I I just like competing I mean that's why I ran um I didn't do it for social I was more competitive that I I'd like to win and I like to be in the top three oh no yeah what was your um marathon PR uh my best one was I never broke three hours I was right at three hours like three hours and 16 seconds oh wow yeah but I never broke that three hour barrier oh that's crazy and that wasn't in Honolulu Honolulu well it's gonna it's kind of hard all the hills in the Honolulu marathon um so so what are your thoughts on me doing the marathon uh in between cross country and track season is that something there is no problem with it all um it's good to keep up the running um now there would be a problem if you ran a marathon during the season because it's different training is different for a marathon and as it is uh for cross country you have to put a lot more mileage in for for a marathon and your body breaks down a lot more if you're training for a marathon whereas cross country you're more specific it's a shorter distance but running a marathon between seasons there's no problem with it at all just keep up the keep up the running and actually that you keep in shape for for track yeah and you start kind of after you run the marathon you kind of start uh declining on your your mileage for for track all right so i have my final question so we already asked like what are some of the um difficulties of being like like what are the some of the things you don't really like to see but like what are some of the things that like some of the joys that come from being a coach going to the meets and watching watching all the athletes compete and doing their best that you know that's the biggest joy in just watching them improve and um seeing that big smile on their on on the athlete's face when they finish you know that you know that's one of the best things that a coach can see is just seeing the athlete do well yeah well thank you so we're going to end it here thank you so much for um coming and doing the interview with me and if you want to um watch the episode it will be up at think text youtube channel and yeah thank you for watching


Thank you, Nico, for the kind introduction. It's after lunch for me, too. But I'm here to actually, I'm just going to say it, I'm going to make a pitch for introducing genetic diversity into the kinds of gene function screens that the COMP program has pioneered. Before I get into my pitch, I want to pause and let's all look at this iconic diagram. I'm sure everybody in the room knows what it is. This is a gene-gene interaction map of essentially all the genes in the yeast genome. I was very lucky at the point in time when Charlie Boone, Brenda Andrews, and Company had done all the single knockouts in yeast to be invited to be on their advisory board. And I got to watch them wrestle with, OK, we've knocked them all out, so what? And then they came up with the idea, well, let's put them all together in all possible pairs. And clearly, that was going to be impossible. There was no way we could make all 36 million. And let me just say, creativity, corner cutting, and brute force, they did it. Now, they didn't study ribosome function or RNA processing or any of the functions that you see listed on this diagram. All they looked at is growth in permissive media. And they tracked pairwise epistasis between the genes. And the graph itself is constructed in a particular way. It's called a topological overlap map. And it's actually the same algorithm that Facebook uses to suggest friends to you.  And then doing that, miraculously, genes that are sharing the same function start to cluster together. And you can start to do this guilt by association and assign function to genes of unknown function. So just hold that thought. And we're not going to propose to knock out all the genes in the mouse two at a time. That's clearly impossible. But here's what I do want to talk about. Is the mouse a good model for human biology? And I'm just going to say mostly yes. I'd also like to just make the point that the genetic background matters. And then I'm going to propose some study designs that I think are eminently practical and show you how those study designs can lead us to better understanding of function. So as a mouse geneticist, I often encounter people who kind of want to break into the field and study their favorite trait in the mouse. And they always ask me this question, which mouse is most like the human? And the answer, obviously, is C57, Black 6, J, or N. Take your choice. And we always have the concern. I always have the concern that even though it's very important to study C57 Black mice, you're really studying one mouse and one genome. And it's a room full of Waldos. But if we could look at genetic diversity in mice, we might more accurately model the kind of diversity that we see in human populations. And if I had a laser pointer, I could show you where Waldo is, but he's in there. So we're not missing out on anything. But by bringing in lots of genetic diversity, we actually get to see many, many new and unexpected phenotypes. There are at least 20 papers in the past two years that address the question, and they go back further, too, of whether the mouse is a good model for humans. I chose this one because I like the picture, the little cartoon that I stole. And there are just two points that I want to emphasize that were made in this paper. And one is that the allele and the strain in which the target mutation will address the leels in a minute, in which the target mutation is maintained can make a big difference to the phenotype. And as a minor point, but one that's going to play into my hand here, literate controls are ideal. So a Palmer's group, many people have done this, too. But a couple of years ago, did a really heroic experiment where he took some of his favorite mutations and crossed them onto a whole panel of inbred lab strains. The design here is pretty important for us. I think this works. No, I'm going to go back. Anyway, the donor of the mutation is a heterozygote. Yep. And by crossing this heterozygote to a number of strains, he generates a whole panel in which, among other things, one has literate controls. These animals are heterozygous, and these animals are basically wild type for the mutation. Every one of them is an F1 hybrid, half C57 black 6, half something else. And you can go look at the paper yourself. These backgrounds all affect the trait, but the backgrounds also affect, in some cases, the direction in which the mutation changes the phenotype. So it's just one example, and there are many, many more. This is also true. I think I'm not a medical geneticist, but I suspect that it's pretty universal that when diseases are segregating in families, there's always variability in the expression of the disease. One explanation for that is, well, there could be many explanations. There's environmental things that could be going on, but one very likely explanation is that there are other genes segregating in these families that are modifiers. And this is a very tip of the iceberg list of human diseases that are not only known to have modifier genes, but the modifiers have been identified and the mechanism by which the modifier acts has been identified. And in my opinion, modifier genes are just an open door to therapeutics. If you have a gene dysfunction and you have another gene that modifies it, you have at least one angle to take to how do I address the primary mutation with the therapy. So human diseases have modifier genes. So I'm going to segue a little bit and talk about genetically diverse reference populations. Anybody who's heard me talk in the past 15 years has heard this ad nauseam. I apologize. But there's something that I would like to say here, and that is we attempted to make many, many collaborative cross strains. Our collaborative cross paper came out right after the comp paper. And if you look at them, they're very similar. They both were vision papers. And at the time, we had no mice. And in fact, we had no mice 10 years ago. We had no mice five years ago. We had no mice two years ago. But pretty much now, except for people at UNC who have first dibs, if you want a collaborative cross mice, you couldn't get them. So there's no way this thing could be a failure because it didn't exist. And it does exist now. There are many, many fewer strains. And we thought there would be. But along the way, we did something sneaky and we siphoned off mice. And we made an outbred population. And the outbred population is easily available. And it might seem a little scary, but I'd like to talk you through it. So in a cartoon here, we have basically three genetic resources. We have eight strains that are the founders. We have approximately 70 plus or minus 20 inbred strains that have the same genetic complements as the outbred strains. And there are infinitely many outbred strains, as many as you care to make, and they're all unique. Like I said, if this makes you nervous, just think about when you order a strain from the Jackson Lab, there's a strain number.  Or if they're Balb C's, they're all white or something.  And these are actually single litters of Dio mice. There's nothing special about them. They're just a lot of mice, and you can phenotype them. In fact, we did that. We've done that in a few studies now. And one of the big concerns that people raise about outbred mice is, oh, the studies can't be reproduced. They are not reproducible. This is a chart from a plot from a paper that we published on benzene exposure using Dio mice. At low exposure, there's very little DNA damage. But when we get up to 100 ppm, some of the mice show high levels of DNA damage. We did the experiment once with about 300 mice. And then six months later, we did the experiment again with 300 more mice. And in my mind, that is highly reproducible. We have reproduced exactly the same mean phenotype and the variants and their mice, and they're reproducible. So how can we use the outbred mice to do phenotype screens? There are many, many ways that you could come up with in your imagination. And I just want to show you a couple, one very simple one. There's a dominant mutation phenotype screen. Let's imagine that we have a mutation.  And I have a heterozygous breeder. And I cross it to a Dio mouse. And I get four offspring. And I cross it to another Dio mouse and another Dio mouse, say 20 or 30 or 50 of them. I'm going to get a whole population of animals that are F1 hybrids, one half of their genome being B6, and the other half being diverse. So we're putting this mutation on a diverse genetic background. And we're also getting built in littermate controls. And if I were to do this experiment, I would do it blind. I would just take the litters. I would phenotype them. When everything is said and done, I would go back and genotype them. And I would know then which ones carried the mutation and which ones didn't. It's a very clean, very simple experiment, not unlike the APOMR experiment, but much more practical logistically because the Dio mice are just a strain, right? And you can just order them. And these matings, they're going to be highly productive. One has to be concerned about sample size because outbred mice are more variable. This is a very generic sample size curve, but I want to point out that the effect size of a mutation should always be measured in standard deviation units. Standard deviations are going to be bigger in an outbred population. And an effect size of one standard deviation is a pretty good target. If you get much smaller, you have no hope. And if you get much larger, you're going to get it every time. So really, when you're evaluating sample size, you want to be looking right around here on the curves. And what you're going to see is that at a reasonable alpha level, you want to do some multiple test corrections for your multiple phenotypes. But between 25 and 50 mice is going to be per group. So you'd have to generate 50 or 100 per mutation. It's going to be an excellent sample size with sufficient power to do a good mutant screen. Now, I want to come back to this diagram from the benzene experiment. And you could think not of benzene as an environmental exposure, but if benzene were the mutation that you introduced onto the mouse, what you're going to notice is these mice that are barely or not at all exposed to benzene, they're just nothing's happening. But in the exposure group, the variance goes up. The mean goes up for sure, but the variance explodes too. And that is the key to understanding when there might be modifier genes in the background. And so you want to have an experiment that's sufficiently power to detect changes in variance.  But if you look for a two-fold change in variance and you want 80% power, you're going to need 100 mice. So it's not ridiculous. It's not out of reach. You could do a screen to look for a shift in the mean trait and a slightly bigger screen using the same mice to look for a change in variance. If you see this change in variance, you're going to be pretty sure there's some modifier genes in the background. Oh, you can do this with recessives too. It takes two generations instead of one. And there are multiple ways to do it. And I'm just going to move on and say if you suspect there are modifier genes in the background, you can go after them. We did this recently with a modifier of PYMT and cancer metastases. This is a really nice effort by Nigel Crawford, who validated the genes in human cancer patients. But what I really want to talk about and to wrap up is a cross that was done in Ron Costania's lab to look at Alport syndrome. Alport is X-linked. And X-linked genes give us just another variation on how we can do these modifier crosses.  We get females that are het. And we get males that are hemizygous for the mutation. The mutation causes a disruption in the basement membrane in the kidney, which causes the kidneys to be leaky. So protein gets into the urine. It also causes inflammation and the glomeruli drop off. And so you get reduced filtration. And you see females are mildly affected and males are severely affected. And that's no surprise, because the males are hemizygous. But what we wanted to do next is take those. I see the cross here. I left it off. I'll show you this one. OK, that's where the cross went. So what we wanted to do next was validate that this gene, RFX3, which we mapped using 100 Dio mice, is actually a modifier. We kind of had a good idea, because we mapped it, but mappings never proof. So what we did is we took a B6 knockout mouse, probably a comp. More likely we made it with CRISPR, Rhondibus. And we cross it to a col-4A5 mutant. And we get four groups of mice. We get the female. All the mice have the col-4A5 mutant. We get the females with and without the modifier, the males with and without the modifier. This is an ongoing experiment. But this group here, females with the modifier, you can see them. They're living a long time. This group here, males without the modifier, these are the ones that are dropping off fast. So there's a way to validate your modifier gene candidates. We also looked at the proteinuria phenotype. In this case, we found two modifiers. I'd like to point out that these LOD scores are not earth-shattering. They're pretty weak candidates. But we have functional evidence. And we're going to go forward and validate them. These validations are ongoing, but just like the other picture. In this case, the only background we had the modifier on was an FVB background. So this is a slightly mixed background validation experiment for the modifier. So phenotype screens using single-end bread strains may miss important effects or may fail to generalize. I guess I didn't talk about that much because I think it's kind of obvious. Phenotype screens with genetic diversity are reproducible. They're simple, and they require manageable sample sizes. And if you do such a screen, you can then go on to identify modifier genes. You can detect them. You can identify the genes. And you can validate them. And they add significant new knowledge about gene function. In fact, what they're doing for you is they're prioritizing which pairwise knockouts you should make in your all-pairwise knockouts of the mouse model. Gets us a little bit closer to, we all have a little yeast envy here, right? So it gets us a little closer to being yeast geneticists. And there are many people to thank, but I just really want to acknowledge primarily Ron Costania for the Alport studies, which he was really bold to undertake. And just to make a final pitch for genetic uniformity versus genetic diversity. And I talked a long time, so we're going to save questions for later. Thank you.


Michael Donahue just grabbed me in the middle of the aisle to show me something in the Smart Things booth. What do we have here today? Great. Well, thanks for stopping by. So what we have is, we have what's called the Estock Air. And the Estock Air is a charging wall mount system that is also a photo frame. Yes, thank you very much. This woman's done this before. So to show you how it works, basically it's pivotable, right? It's also lockable, right? We have the ability to lock it up here. And when you take it out, it becomes a photo frame. So it's a very elegant way of storing or charging your iPad against a wall, and then having the ability to remove it, and you have rather than an unsightly hole, you've got a really nice photo. I like this because a lot of these wall mounts do something to booger up the back of your iPad or they've got to go into a permanent case sort of thing. He literally just popped it out of the Estock Air. That's right. Or I'm sorry, excuse me, you can charge an iPhone as well, so you can charge other devices. That is really slick. So on the top, he pivoted it in and then down below, he can slide it right into the dock. Now I noticed that was a 30-pin dock. You also have them for the 9-pin lightning. Yeah, we have the lightning. The lightning one is right here. And again, you can actually charge an iPhone as well. You just put the iPhone here. We destress the top. We have a little mechanism that allows you to destress. It holds this in, and then you go ahead and put your iPhone on here too. Now, in my house then the wire would be hanging down the wall, right? You could do it that way, and you can also do it from behind. It's very easy in terms of the way it's installed. The installation is simple. You just want to ask the back of it. It looks like a bannet mount back there? Yeah, and right here, this spins. This is the spinning piece, or you can do it permanently through these four holes. And then your USB charging cable, this goes through this hole. And comes nicely down this channel here. Exactly, that's right. That looks pretty cool. So how much is the S-Dock Air? So it's $199 for the S-Dock Air that's the lightning connector, or we have the other one for $169. Okay, great. And where would people find the S-Dock Air? You're going to find it on Amazon right now, yeah. Hey, that's where everybody shops anyway. You might as well be on Amazon. That's right. You did a great job, by the way, Allison. Okay, thank you very much, Michael. Okay, sure. Thanks.