All right, I guess we're alive now. So hello, everyone. Thank you for joining. Welcome to Cloud Native Live, where we dive into the code behind the Cloud Native. I am Itai Shakuri. I am director of open source for Aqua Security. I'm also a Cloud Native ambassador and I'm joining as co-host for today's show. So I'm happy to be here. Cloud Native Live is where our weekly show, every week we bring a new set of presenters to showcase how to work with the Cloud Native technologies. They will build things, they will break things and they will answer your questions. So this happens every Wednesdays at eight Pacific and today we have our friends from StockWorks here to talk about CubeLinter. Just a quick reminder to join us at KubeCon and Cloud NativeCon in Europe early next month to hear the latest from the Cloud Native community. And a quick admin before we hand it over, this is an official live stream of the CNCF and it's such a subject to the CNCF code of conduct. Please don't add anything to the chat or questions that would be in violation of that code of conduct. Basically in simple words, just be respectful for everyone, the fellow participants and presenters. All right, so with that I'll hand it over to Vishwa. Hey everyone, my name is Vishwa and thanks for coming depending on where you are whether early in the morning or later in the day to attend this talk. So I'm Vishwa and I'm an engineer at StackRocks or what was formerly StackRocks? It feels funny to say that because about two months ago StackRocks was acquired by Red Hat and now our product and our team are joining the Red Hat portfolio of products and companies. So at StackRocks, I've been an engineer for over three years and most recently or fairly recently I've been working on this open source project called KubeLinter, which is what I'll be talking about today. So today's talk is just gonna be a very hands-on demo of KubeLinter, I'm gonna be showing you how you can use it to find errors in your files, fix them and kind of go through that process and also go over where you can find more resources and how you can contribute to KubeLinter if you're interested or how you can find out more if you'd like to get in touch. So definitely gonna keep it informal and please at any time feel free to ask your questions in the chat, we'll be monitoring them and we'll definitely have a dedicated time for questions at the end. But if something doesn't make sense, please feel free to ask questions you don't have to wait for the end either. So before I jump into the demo itself just a very quick overview. So KubeLinter is, as the name probably suggests, a linter for Kubernetes, specifically for Kubernetes configurations which are typically in the form of YAML files. And the idea is that the real problem we're trying to solve and it's one that we had internally back at Stack Rocks is that a lot of Kubernetes configurations are A, complicated. There's like a lot of fields that you can fill in in the YAML file. Most of them are optional. So you don't know what is required or what you can kind of get away without. And B, a lot of defaults are not secure. And there's a couple of reasons for that. One is the Kubernetes initially did not have a lot of security features. And so when they added them, they had to kind of default them to off because otherwise it would break backward compatibility. And another reason is Kubernetes is kind of complicated. The part of the reason for its success, it's the level of flexibility it offers and flexibility always comes with some complexity. And the challenge they had is, they wanna make it possible for people to actually see something up and running with the tool. And what that means is some of the defaults are geared towards that and not necessarily towards security. Cause as we all know, there's generally a trade off between something that's more secure and something that's quicker to get up and running. So those are the two big problems that we tried to solve with KubeLinter. And the way we tried to do that is we looked, tried to make it so that if you run KubeLinter by default, it will complain if you have your configuration in a way that's not secure.  So that's a very high level overview of the tool itself. You can see the link to the tool in the banner on your screen and feel free to check it out, but I'll definitely be diving more into the repo later on as well. So with that preamble out of the way, let me get started with the demo. So just give me a second to share my screen. I suppose this one, what are you doing? Good. Good, I'm Paolo, I'm working here today with Itaí. Just a few questions before you start your demo. Yeah, of course, yeah. Sure. I look at the project, there is an open source brush, right? And the idea is to check the configuration. It's amazing project, it's very good. And maybe you can explain a little bit for us. For us, it was right in goal length, right? So it functions. I read the site from the project and why you decided it is a little bit similar to kubic control. So what's your reason behind the architecture that you choose to create this kind of clients to? Yeah, I think, are you referring to the decision to build it and go in a similar client to kubic control? Is that the case? Yeah, okay. So basically the idea there is that it was honestly just what is easiest for us. So the thing is like Kubernetes itself is written in Go. And so by writing in Go, we get to take advantage of the libraries that Kubernetes offers, which is like, the biggest heavy lifting in our kubilinter code comes from the Kubernetes code itself, which we use as a library. And the second is by using the similar tool, we also get a very similar feeling client. And so one that's very familiar, I think, to people who are in this ecosystem and are used to using tools like kubic control and other tools in the ecosystem. So just giving people the kind of familiar feeling, you know, it's just like a static binary. They download it, it works. They don't have to do any installation of anything in their environment. So that's the idea here. Great, great. So we can say that we have one tool to put in the SRE and developers to box, right? Like control, you have this kubilinter to use during my daily job, checking the code, checking the compliance of the code, et cetera. So it's a more one tool inside of the toolbox for us, right? That's right, yeah. Great, great, great, great, thank you. Cool, thanks, thanks Paolo. Any more questions or should I get started with the demo? Yeah, let's see the demo. And we have a comment on chat where some people are actually following alongside your steps. So requesting to go slowly or at least at a reasonable pace so that people can try at their home. Yeah, awesome. Happy to hear it and definitely we'll keep that in mind. Cool, so I am gonna share my screen and it I and Paolo I will, in case I'm sharing the wrong screen or I'm not sharing my screen correctly, please let me know but other ways I will assume that it's working as intended. Cool, so here we are and like I said, that this is gonna be a demo of the capabilities of KubeLinter. And the, what I have here is like a file, a YAML file that contains specifications for a few different Kubernetes objects. So we have a deployment which is called non-compliant in this case because as you'll see this deployment does not comply with a lot of the security best practices that KubeLinter has by default. There's another deployment defined in this file which is compliant. So as you'll see this will have fewer issues. And then there's a service account. So KubeLinter here is gonna lint this YAML file. So now how does KubeLinter itself work? So I'll go over installation and stuff later but it's extremely straightforward but I obviously have KubeLinter already in the system. So you can see that I'm able to run it and it has like a few sub commands and things like that. And the way the most important KubeLinter command that you're gonna use day-to-day is the KubeLinter lint command which lints Kubernetes YAML files in Helm charts. So here you can see, in this directory I have this myapp.yaml file which is the same one that you can see on the right side of my screen. And then when I run KubeLinter lint and pass it the name of this file you can see that it basically is gonna run again against this a bunch of checks and output the results of those checks. So when I run it you can see it's found nine lint errors over here. And there's a list of output of these are the errors it's found. So what I'm gonna do now is just kind of go over these errors and how like basically kind of this scenario here is you are a developer you're like trying to configure your deployment YAML files or you probably typically this is how I do it and I'm guessing this is how most people do it you just copy something that you know works and then change whatever you need until you have your specific deployment. And then after that when you run KubeLinter it can tell you if there are things that you're doing that are not security best practices. So for example here we see that it's telling you that this object which is a deployment in my name space called non-compliant which is this one mounting an n variable as a secret. And so you can see that here you've used I mean this is obviously not a real secret key I just put a random string in there but you can see that here we've used AWS secret key and just put it directly in the end of the container. And KubeLinter's recommendation is to not do that it's to mount the secret as a file or use as F. And the reason for that is that n variables that are stored this way are much more exposed. Anyone who can see your deployment configurations which are generally not very locked down will be able to see this key. Whereas if you put it in a secret the configurations for secrets in Kubernetes are way more locked down. Obviously things that's harder to fix because the ideal fix for this would be to create a secret and then like reference that secret here but in the interest of time I'm not gonna do that right now I'm just gonna comment out but that would be how the right way to fix this this was not just a demo. Another error that we're seeing is that the container does not really root file system and it's saying the fix is to set read only root file system to true in your container security context. So that's definitely something that we can do and the way to fix that would be to just do a secure context and then take this read only root file system and set that to true. So now I've looked at the first two errors and I've made changes in my ML file so that they are no longer errors. And so when I rerun kubelinter you can see now it's only found seven lint errors and the first two lint errors are gone. So that's kind of the high level idea of the way that we expect this tool to work. So now I'll go over like a couple more of this because I think it might be interesting. So this one is another interesting one. This one, maybe we can take a quick pause and address some of the questions in the chat. Do you mind? Yeah, yeah, sounds good. All right, just so we don't accumulate too many questions. So one question was about whether we can run kubelinter against the directory and not a single file? Yeah, absolutely. So you can, yeah, so you can, if I had run kubelinter lint. Instead of kubelinter lint of name it would have run it on the directory and it also works recursively as well. So if you pass it a directory it will go to all the sub-directories and fetch the files. Great. Another question was about integration in the pipeline. I'm assuming kind of like a CI CD pipeline so that I don't need to manually execute the CLI but it automatically lints. Yeah, exactly. Yeah, that's definitely supported. The way the tool works it returns an error code if there are any errors. So then when you run it in CI your CI build will fail and that's something that I'm gonna touch on in a demo like once I get through the first part. All right, so we'll get to see that even. Another question came about disabling some rule. So if I don't... Yeah, that's, yep, absolutely. That's, there are like a couple of different ways to do that and I'm gonna go over them in the rest of the talk but yeah, that's absolutely something we support. Great. All right, yeah. Sorry for interrupting, I think we can... Actually, there's one that just came in. Does KubeLinter authenticate to API using the same KubeConfig like KubeControl? No, it does not. Right now KubeLinter is entirely static. So we don't need to talk to the Kubernetes API. Like we just look at the files and we don't care about like the actual cluster. So that's how we are, that's how we are architected right now. Having said that, we do have plans to do this in the future. There are some things we can do where we can help the customer, the user know, is there a way that, does your YAML files work with the version of Kubernetes you're running, right? And then for that, we can kind of infer the version of Kubernetes you're running based on your KubeConfig but we haven't implemented that yet. All right, yeah, that's actually pretty useful. All right, yeah, sorry for interrupting. I think we can carry on the demo and I'll pile on the questions and maybe do another break in a few more minutes. Sounds good, yeah. Please keep your questions coming and I definitely want to be able to get to them. So let me go back to sharing my screen. All right, so assuming you can see my screen, so again, like I was saying, the error that we're getting here is that the service account non-existent is not found. So this is an interesting one which has definitely happened to me where typically in a deployment you kind of reference a service account but maybe you rename your service account and so the reference in your deployment is stale and in real life, you'll only find out when you actually try to deploy your deployment and it's that, oh, it isn't working because the service account doesn't exist and so you're not able to do the API access that you want. But Kublinter kind of, since it has this global view of all your files and all the objects, it sees that, okay, there's no service account that I can see called non-existent, so are you sure this is correct? And sure enough, our service account here is called like my-service-account and if I go and change this to be my-service-account and I rerun Kublinter, you can see now there's only six, where there were seven and that first error is gone. So again, we've managed to work through that as well. So I have a question because we just said that Kublinter doesn't interact with the API server and now we're saying that it can validate if, for example, a reference service account doesn't exist. So that's only in the AML files that were linted not in the actual cluster, right? That's right, yeah. And I'll go over this and more like a little more later, but basically the recommendation and the kind of defaults of Kublinter are geared assuming that you're pointing to like a kind of self-contained, comprehensive list of AML files and that you keep your deployment service account, all of them in like maybe say a same directory or a same Helm chart. And then it kind of crawls all of them and builds like this global view of like these are the set of related objects you're deploying. Having said that, there are some of our users who know who just use it for one file at a time and they may want to disable checks like the service account one because maybe the service account is already in the cluster and they know that. But to go back to your point, like this is another thing where if we had the kube config access, like maybe we could make this also more seamless as well. But right now, as I said, we don't do that. All right, thanks. Cool, yeah. And then there's a few other errors here which I'll go over very quickly. I don't want to necessarily use up all the time because there's a bunch here. But here we're seeing that this object is not running as non-root, which is another good security practice. Again, I should mention that with things like run as non-root read only root file system, like you cannot blindly change to them. You need to be sure that your app doesn't depend on it. Most of the time, apps don't really depend on running as root. So that's something that should be safe. With read only root file system, you need to make sure that your code is taking that into account that maybe you only write files and like a well-known directory like slash temp and then you make it so that it can only write it in temp. But just want to throw that out there that these are security settings that constrain what your container can do. And that's a good thing for security, but you need to make sure that your code is kind of compliant with that as well or you lose functionality. And the other list of things we have here are around unset CPU requirements and memory requirements. So this practice that we encouraged by default is to set your container CPU requirements. So I'm gonna just fix those real quick and lucky for me, I have a compliant container that kind of has all this already. So I'm just gonna copy what it has in its configuration. And again, these are things that are gonna take longer to in practice because you don't actually know what the CPU requests and limits are that may require you to do some measurement or have some understanding of like the workloads that your container is how your container workloads are expected to work in our experience that does take its own time as well. So now that I've done that, if I run prove linter, you can see all the other errors are gone because I fixed all of them and now we have just one error left. This one is an interesting one. So this is in the compliant deployment and the check is that the check is basically saying that the container engine X is privileged. And the reason this is interesting is because I actually wanna run this container as privileged. Like I was saying, maybe some containers need privileges. So let's assume that for whatever reason, I want to run this as privileged. Now, how do you do that in kubelinter, right? So you have two options. One is you can disable this check itself, which means you don't care about running things as privileged, like it doesn't matter to you at all. And we support that via like an exclude flag. So you can exclude checks by name. And sorry, I think I spelled that. You can exclude checks by, oh, sorry, I don't know what happened. You can exclude checks by name and you can exclude obviously multiple checks. So this is a check that's run by default and so you need to explicitly exclude it. And then when I run with this check being excluded and you get the name of the check from the output, sorry, I seem to be struggling to spell when the word is wrapping around. You can see that, okay, it's saying no, Lynn Terrell has found. And that's because I've excluded the check, so well it's not even checking if anything is privileged. But the other way to exclude, and this is what, this may be what is more relevant for a check like privileged, is let's say you generally want to run this check, but you want to have a way of having some sort of denoting exceptions. So you want to say that like, I generally don't want to run things as privileged, but this specific deployment should need privileges. So I'm okay with just this one needing privileges. And the way we do that in Kubelinter is via an annotation on the deployment itself. So the way that annotation is structured is like this. So you basically have a key, which is ignore check.kubelinter.io. And then you pass in like the name of the check, which you again, I'll copy from there. And then you just say true, right? And then when you do that, you can see, oh, sorry, maybe I think I missed a dash. When you do that, you can see that the check goes away. And this is because although we are running the privileged check, like we haven't excluded it, we are basically running it saying that this check is ignored just for this deployment. So that's kind of how you would deal with exceptions in cases like that. And you can ignore any number of checks. There's also a way to ignore all checks for a specific deployment in case you want to like declare bankruptcy on like a specific one, but still want to run Kubelinter. Another thing, the next thing I want to go over is like the configuration file. So Kubelinter supports like a config file, which has a list of things that you can configure. You can see that we support things like include, exclude in the configuration file itself. So you can include some checks, you can exclude some checks. You can also say do not auto add defaults. And what that does is if you set that to true, then the default checks are not added automatically. As you saw, we tried to make a lot of checks run by default when you just run Kubelinter linked with no arguments. So that again, it's like security by default. But if you don't want that behavior and you just want to explicitly include the checks you care about, you can do it here. All these, we've made it so that everything in the config file under checks can be also configured directly as command line arguments. So you can do dash dash exclude like we did. You can do dash dash do not auto add defaults. So all that works. And if you specify both in a config file and in command and as a Clifflag, we will give precedence to what you pass on the command line versus what's in the config file. So definitely try to be flexible with configuration there. And the other thing I wanted to go over is custom checks. So Kubelinter does support custom checks. And the way you do custom checks is you need to pass, like, so this is an example of a custom check. And you need to pass like the name of a template. And based on the name of the template, each template is basically a piece of Go code that does something. So the template here in this case is called required annotation. And the way you would kind of figure out, you know, the list of templates is if you go to the Kubelinter documentation, you can see we have like a list of templates that we support. And this specific one is called required annotation, right? And basically what it does is it flags objects that are not carrying at least one annotation that matches the provided patterns. So you're saying that basically you're saying all my objects are required to have this annotation. And the way it works is you specify like parameters to the check. So you need to specify like a key and optionally a value as well. And what we've done here is we've said there's a required annotation and the parameter we're passing is that the key is team. And so what we're doing in practice here is that we're saying that all objects that are configured need to have an annotation of team. And maybe this is because when I'm actually running this, I wanna know which team owns which object, right? So the way I would run Kubelinter with this is I just pass a dash, dash config and you can see like I just pointing to the file I just opened. And you can see, you know, this is an error now, the non-compliant app, it's saying there's no annotation found matching team equals any where it means that the key is team and the value can be anything. And it doesn't have that annotation. Whereas here, you know, we do have that annotation for the service account as well. We do have that annotation. And if I kind of copy this annotation here and stick it into this deployment, no lint errors are found. So that's kind of how you can do your custom checks. And this is just a particularly simple example, but as you can see, we support a lot of it in templates and you can go over the documentation to figure out what is supported and we're adding more to these all the time. If I'm understanding correctly, if I'm adding my own rule, the business logic that I wanna check is in the template and I can reference that template from the config file and maybe pass some parameters to that in order to start enforcing that. Correct. So is it possible to also add my own templates? Yeah, so adding your own templates requires a code update. So you need to send the PR for that and basically you need to update the Cooblinter version. So the templates right now are go code and kind of bundled into Cooblinter and where the flexibility this gives covers, what we found is it covers like maybe 80, 90% of the use cases. So that's where we went with this and the simplicity it enables. What we're kind of exploding is how can we cover the remaining 10% of cases without requiring users to manually update the code and that we're investigating options there around, maybe we support like maybe one of our templates is just like supporting OPA, right? Like we allow people to write like regular policies that can be arbitrary and put that and make that like a template and then for like advanced users they have like a very specific thing they want. They just use a regular, but if it's something more commonly, common and is supported by Cooblinter then they can just use our like, use our built-in template. So that's kind of the approach we are thinking of taking but as of now we haven't implemented that yet. So does that make sense? Yeah, it makes complete sense actually. I was wondering as you were explaining what's your take on OPA is because a lot of similar approaches to concepts shift left for infrastructures code scanning very prevalent with Rego slash OPA technologies. So yeah, it ring the bell. So, and it makes completely sense if you are going to support or planning to support OPA as well. Yeah, yeah, I think what we found is that at least in our internal use is that there's a lot of value in like simple configuration. And so that's kind of what we focused on here. And, but tools like OPA are extremely useful because they are so expressive, right? Like that you can, if you have like this very specific thing that you want you can do that in OPA like no matter what it is. And so we think like the right way is to like give like a simple configuration mechanism for users for like the 80% of cases. So you can like kind of quickly do that and then kind of offer like a way to use something more expressive for like the more complicated cases. Yeah, there's definitely a learning curve I think for writing Rego policies. I hear it myself as well. And also just a comment. It kind of ring the bell also the separation between the templates and the instantiations of them or the usage of them from my experience in the OPA world something similar like in a contest or gatekeeper they have the constraint template. So maybe some of the listeners are familiar and to me it sounds exactly like the same concept which is a, it's a great concept where you have defining the template once and then you can reuse it multiple times. So kind of for me, it helped me understand what you are after here. So maybe it will have the readers as well. Yeah, thanks. I actually haven't used OPA and that use gatekeeper or contest in that much detail beyond just trying them out. But yeah, now that you mentioned it I think that makes sense. Yeah, thanks. Yeah, it's now a good time to also review some questions in the chat. Yeah, yeah, I think so. All right. So we have a question about supporting CRDs, custom resource definitions. Yeah, that's something we don't do right now. We, again, we'll need code changes in our current architecture but we are, this is some issue that, like an open issue on our GitHub that like has quite a few thumbs up the last time I checked and it's something we're trying to figure out. The challenge is trying to keep our simplicity of configuration that we have while also giving people like a good way to plug in their CRDs and we're still working that out but right now, no, you cannot. We do support OpenShift. So like not every CRD in OpenShift but we support anything that's like an OpenShift type. So it's like a deployment configured OpenShift, for example, even though that's like not the built-in code deployment but arbitrary CRD is not right now. Thanks. We also had another questions about integrating in the pipeline but you already mentioned that you are going to address that in the demo. We had an earlier question, kind of a more general one about now that Red Hat acquired StackRocks what are the plans in regards to the open source nature of the project or the governance of it? Yeah, so I mean, so Coob Linter is going to continue to stay on its own and it will be, it's already open source under Apache 2.0 and that will be the case for like, that's not going to change. And I think the additional thing that's going to happen as after the Red Hat acquisition and this is something I think Red Hat touched on in the press release where they announced our acquisition was that they also intend to open source the rest of our product as well at StackRocks. The rest of our product that our commercial product was proprietary and closed source but Red Hat wants to open source that as well but it's not open source yet but that's something that is an intent that he'll be working towards. Great news. So if anyone was worried that the acquisition will affect it will affect for the better open sourcing more of the product. There was another questions about scanning for RBAC's role-based access control resources. Is it something that you currently do or planning to do? No, it's not something we currently do but it's something that we're planning to do. And it's one thing we're kind of struggling with here is RBAC is a more complicated kind of configuration as anyone who's worked with Kubernetes, RBAC probably knows there's like all these links that you have to kind of keep track of. And so we're trying to see does it make sense to have it in a tool like Google Inter or does it require kind of its own tool that has a more first-class understanding? And there are a few of those as well that I've seen. And that's why we kind of hesitated to go too deep into RBAC similar things with like network policies, right? Like it's technically just a YAML file but it's its own beast in terms of like configuration surface and we haven't gone there either. But those are things that we're thinking about. But I think we'll probably be lower priority than some of the earlier things we discussed like CRDs and things like that, which I think we're seeing more user demand for those. Yeah, another question that I think you kind of touched but maybe you can clarify, can I specify one container spec as privileged, true and other as false? Can it be checked as at container spec level? So maybe reiterate the part about selectively applying the tests. Yeah, so right now the selective application is at the level of the top level object. So at the level of the deployment. So, you know, if you, this is a very good question. Like if you ignore the check, then that ignore propagates to all the spec containers in the deployment and not just the one that you, like not just the one that maybe you want as privileged. So that is a valid question and a gap in our current way. One solution that we've been thinking of, which we've been hesitant to implement for like the reason of having too many ways of doing the same thing is to have like a comment-based ignore, which we've seen in a lot of linters, right? Like definitely if you have a core linter, you can just comment above the line and say ignore this check. And if you have a comment-based ignore mechanism, then maybe you can ignore just that line and then that will help us make sure that the ignore is as localized as possible, but we haven't implemented that. Yeah. All right, thanks. I think we can resume the demo. Cool, yeah. Thanks. Let me go back to sharing my screen. Cool, so that was, I see that you have a comment. Sume, you can see my screen. Not yet. Just a second. Yes, now we can. Okay, so that was kind of, you know, all I wanted to show in terms of the hands-on demo. And now maybe in a few minutes, I'm just gonna go over kind of our GitHub and, and sorry, so first I'm just gonna go over use in CICD and I know there were questions about that too. And then I'm just gonna go over like our GitHub and docs and just talk about like how you can get involved or learn more. So, so basically the way you would use Coolinter and get in CI, it's very simple because, you know, it's a command line tool that uses download and it works out of the box.  You just need to make sure you get the right one for your operating system.  So you don't even need to make sure to download the binary. And then you just run it on your files, right? So here, you know, I have like an example PR where let's say I'm like running, running like I have like a few YAML files in a directory. And then I'm basically running Coolinter against them in CI and basically you can see that what happens is it just run like Coolinter lint dot and then this dot is at the root of the Git repo. So I think someone had a question earlier about this, about directories. So basically by default, if you pass a directory, we just crawl that directory for YAML files, kind of group them together based on the directory they're in and then lint them. And then you can see that the build has failed. I ran this last night in advance for the demo so that, you know, so that it was ready for you all. But you can see the build failed. You can see the output, the same output that you were seeing on my terminal earlier, maybe I should zoom in actually. The same output that you all were seeing on my terminal earlier. And then at the bottom, it tells you like how many errors were found. And then over here, it tells you like it had an exit code of one, which means like your build is going to fail. And when you look at the PR itself, like it's going to be red.  So that's how you do it in a GitHub action.  For GitHub actions, though, we do have something, we do have a native GitHub action called stackrock slash kubel dash limter dash action. So this is also like a public repo and you can see here like an example of how to use it. So if you're using GitHub actions, then you can literally just copy this stuff into your .github slash workflows directory. And then like you have kubel running. And of course you can specify your own config file, which you may want to depending on as we discussed, but generally speaking, it will just work and it'll be very easy for you to drop in. So that's kind of how we use it in CI CD. And then the last thing I want to go over is, you know, this is our GitHub repo. I think the link has been on the stream. So I'm sure all of you have seen this, but this has like all the information you need to get started, like a lot of the things I covered written down here, how to install them, things like that. One thing I wanted to call out is that we do have a Slack workspace and you can see the link over here if you scroll down to community and the read me. So that's like a great way to get in touch with us as well as the kubel inter community. So you can feel free to join here and send us a message and, you know, we generally try to be pretty responsive over there. So that's a great way to get in touch with us. We also have a doc site, which is linked to over here, which I think I showed you earlier, but we know that from our experience that with open source projects like documentation is one of the biggest barriers for a user. And so we've tried to invest and make our documentation as comprehensive as possible. That doesn't mean that there are no gaps and that there are not things we can improve. They definitely are, but hopefully this documentation has enough for you that you can kind of figure out how to use the tool and configure it to your needs. So definitely encourage you to check it out at docs.kubelinter.io. And in case you have, there are any, in case you have issues, you find a bug or you have a feature request, you know, definitely feel free to file a GitHub issue, but very encouraging of those. And there's a template that will pop up when you click new issue and then it'll just, you can just fill it out and we'll be sure to get back to you as soon as we can. We also maintain our roadmap itself on GitHub. So if you go to project slash roadmap, you can kind of see these are the things that we have to do and these are, all of them are things that if you're ever interested in contributing, you know, you can feel free to go to the roadmap, find something that you're interested in doing, maybe comment on it and ask, does your approach make sense? And if you send a PR, we're like more than happy to, happy to take PRs. So that's how you can contribute. And of course, if you wanna discuss in more detail, you can join the Slack workspace as well. And then that's, yeah, that's, I think all I kind of had on kind of the, how to find things, how to get in touch with us. And so, you know, feel free to file issues and PRs, get in touch with us. If you, and if you wanna give us a start on GitHub, definitely wouldn't complain as that makes, that definitely helps increase the kind of visibility of our project. So, I think that's kind of all I had on in terms of how to navigate our repo and how you can get involved. So looking forward to hearing from you all. And I think the rest of the time will be just for questions. Yeah, great demo and presentation Vishwa, thank you. Let's see if we have something interesting from the chat. Actually, something I thought about while we were speaking. So we talked about linting Kubernetes YAML files manually using the CLI. So that would be like at development time before I push changes. And then we talked also doing the same thing during the pipeline. Have you thought about shifting it right a little bit into the cluster itself and like lint YAML or workload definitions from the cluster or continuously do that? Is that something you have considered? That's not something that, like the way to do that right now would just be like do a kubectl get dash or YAML and like pipe it to kubelinter. So that's been our kind of answer so far. But I would say it's something we've thought about but not something we are planning to do in the immediate future at least. Like we're kind of keeping the focus on the YAML files because I think there's a fair bit of complexity that comes with trying to have something on the cluster monitoring what's running. And that's more, and we know that because that's a lot of what we do in our commercial product. And maybe once our commercial product is open source there'll be like a easier way for us to kind of do like leverage some of the work we've done there in kubelinter as well. But right now we are kind of just focused on the Linting and CI use case. But I do know of some users who have used the approach of just running like kubectl get all dash or YAML and then piping that to kubelinter. And that gives you like effectively this but it's not as nice as all the stuff that you would get by running in the cluster like new admission controller and things like that. All right. There was another question about generating perhaps an HTML report or I'm assuming we can generalize the question to be about UI of some sorts. Yeah. So we don't have a UI right now. This is the only output format. VR, we do have a PR out one of the open PRs is actually for JSON output. And our hope is that we're trying to output JSON in a Sarif standard, just like a standard format for static analysis reporting. And our hope is that once we do that, there's actually a whole ecosystem of tools that kind of will understand that output and be able to work with them. For example, IDEs typically have a very easy way to understand those. So that's our hope that we kind of do JSON output and then enable like anyone to write a tool that passes that JSON and renders it however the user prefers. All right. And perhaps one last thing if you could share what are the checks or tests that you currently do because we've seen an example for one or two. Is there a way to see the list of checks that you perform? Yeah, there are. And the way to do that is I only went over the kublinter lint command, but there's a kublinter checks command that gives you like a list of checks. And then the same list is also there in our documentation as well. So that's the way you can see. And then you can use those names and include and exclude to customize which checks run. Richard, I have a question here. My last question, please. I'd like the interaction of link linter with the Kubernetes annotation. I think that's a good approach. We can say that when you have a team working on a team and maybe you get a configuration find common for the team, but someone can have a specific case, et cetera. So we can say that is a good, a best practice, a good practice, you adopt the annotation for control this is specifically use case where someone should to avoid some checking or put some checking that's different from the common from the other team, the old team. It makes sense to use a good practice combined with the annotation. Yeah, yeah, exactly. I think that was kind of the thought behind putting it in annotations. So that was the idea. Great, great. I think that's a very good interaction with the Kubernetes annotation. Thank you so much. Yeah, thanks for the question, Paolo. All right, I think we're close to the end. Great demo, great presentation and good interactions from the people. You already mentioned how to get started, your guitar people, your Slack channels. I would also mention that we have the cloud native live channel over the CNCF Slack so if people want to keep being engaged once this stream is over, that's another option. And if Paolo... Yes, please, I'm on that as well. Yeah, great. So if there's anything you would like to wrap up with or finish, unless we can wrap it up. No, that's kind of all I had. So thank you everyone for listening and thank you for all your questions and hope some of you are able to take advantage of this tool and that it makes your lives easier. So, yeah. Yeah, it was great to have you Vishwa and talk about CubeLinter. And just a reminder, this is a weekly show. We meet every Wednesday at 8 a.m. Pacific. By the way, this has changed, the time has changed from previously. So make note, it used to be at 3 p.m. Eastern. And yeah, so see you again next week on Cloud Native Live. Thank you everyone. Yeah, thanks Sita and Paolo and thanks everyone. Thank you so much Vishwa, take care everyone.


This sound effect is called a hit. I usually add one after a riser to emphasize a transition or key moment in a video. The specific one I always use is called a deep hit on Artlist.io. Try a few of them out in your next video.


Thanks for staying with us. As part of our efforts to preserve and protect cultural heritage, the Metropolitan Museum of Art in New York and the National Commission for Museums and Monuments in Nigeria have signed a cultural property agreement implementation grant program titled Preserving Nigeria's Heritage. The $95,000 program seeks to create a digital inventory of collections at the National Museum Lagos. In her remarks, the U.S. Assistant Secretary for the Bureau of Educational and Cultural Affairs, Leigh Statterfield, underscored the U.S. government's support for the preservation of Nigeria's rich cultural heritage using different partnership mechanisms. As a museum professional from National Museum Lagos, also speaking, the Acting Director General, National Commissions for Museums and Monuments, Babatunde Adebe, described the signing of the MOU as very significant and would impact positively on the activities of Lagos Museum. He disclosed that the federal government of Nigeria is developing concepts and culture and arts to attract the youth. Principal curator of National Museum Lagos, Efrem Chizobaljoy, expressed excitement over the materialization of the MOU on the digitalization of the digital archiving. In culture, it's very essential. So we are collaborating with several nations, particularly the United States of America, to develop concepts in culture and art that the youth will be interested in. Then to promote culture itself so that people will not see culture as something belonging to the old folks. Guns looking folks, no. Culture is trendy, art is trendy. And then we see the commerce in culture as well and the commerce in art. So soon it starts seeing the effect of this. When I go into our storage, we have close to 45,000 collections in Nigeria here. And then when you look at the way we save the information and details of these collections, it is kind of not really working because they are already stored in paper and these papers are fading away. And when the paper is faded away, the information is being lost. So when this information is lost, the object has no value anymore. But with the collaboration, they are going to do digitalization of this information and they are going to store it in the air. And when it is being stored in the air, I think we should be able to have an everlasting solution to this problem.


It is seven o'clock and we'll call the meeting to order the first item on the agenda is the minutes from April 2nd 2024 Is there a motion move to approve the minutes of April the second? Before was any necessary correction. Is there a second page one? It's three Hearing no modifications all those in favor say aye. I was opposed nay the eyes have it Public comment, this is a point where anybody in the public can speak on any issue. They wish to is there anybody here who would like to Do so seeing nobody Eric is there anybody online? Next on the agenda temporary event permit maple tree place music series Justin come on up Justin I've said your name, but if you can say your name officially and Give us your presentation. Sure. My name is Justin Kelly and the property manager for maple tree place so we purchased property a few months ago and One of the things that we're really interested in trying to do is just trying to reintegrate the property with the community We thought a great way to do that was to revitalize the summer concert series So they ran for about nine years were very well attended One of the things that tenants and customers have asked me every day that have been on property Are we bringing back the concerts? So that's what we've applied to be able to do We have booked Six acts over the course of eight weeks. It'll still run on Thursdays. It'll still run kind of the same spot that 68 30 period They're predominantly tribute bands We do have one local band that we were able to tie into the event And we just think it's a great way for us to be able to try and get the community back into maple tree place And really try and make it more of a destination the input from staff question Yeah, the staff review this it's with your materials Couple notes, but nothing on staff objected to a police and fire had some notes it triggers Need to hire fire staff for the estimated attendance level and certainly monitor that and see how the attendance goes if we need to modify Yeah, I talked with Tim two two days ago And we were just discussing for the first event will go kind of a little overboard make sure everything is There because again, we're just not sure it's been a few years five years since the last show See how it kind of goes and then from there will adjust in pivot for shows that go consecutively after that You know, we've got a parking plan in place. We will Have porta potties out, you know, kind of all the same elements that were there previously will be in place So we feel like the event should be able to be well managed and be safe for Questions from the board My one question is and this was just a It's about the parking actually in the application. It says there's 1900 plus spots. Is that really the number the total number of parking stalls in maple tree places like 1924 give or take It's 65 acres. Yeah. Yeah. No, I just I'm trying to like The site map that we included I don't know if that was But it yeah, it goes all the way around the big box. Yeah, okay. Yeah, so it's including like Dicks and all of that. Yeah, so all park all parking will be available and we have the little road signage to be able to direct folks That's really the only signage we have will be public direction If there are no other questions or input we'll be looking for a motion Move to approve a temporary event permit for the maple tree place music series for the 2024 season. Is there a second Second, is there further discussion on the motion? All those in favor say aye. Hi. All those opposed any of the eyes We're happy to be back super excited to hope is everybody will have an opportunity to come to at least one of the shows throughout the summer Really excited to be a part of the community Great night. I'll sign this and get it. Yeah. Yeah, that's why so gives me a chance to come over and you're all So wait, you're not staying for the wastewater public hearing Maybe we don't want him So we are actually as rare as an eclipse we are ahead of schedule and Wondering if we should do something off of the manager's report because the next item is a public hearing that should start at 715 Through my written report we filled our planning technician position Greatest into our team here We've received a small grant $1,000 grants from the Department of Historic Preservation for an ADA assessment the Old Brick Church Actually I didn't have much in the manager's report We had some other businesses First piece was our final Liquor licenses for renewal that expired for 29 the town clerk Sarah Mason passed them on to me the other day They're unboxed enterprises a second-class license Sandry convenience store second-class license The Vista Wilson hotel, which is the Marriott on Hurricane Lane first and third class an outdoor consumption permit Staff has no concerns. There's no violations with these suggest a motion to renew the licenses for the next approval year Questions from the board Yeah, I think it's something we got a filibuster first. No, we can we can we can make the time So then what is there a motion? But is it both liquor and tobacco license the just like the licenses that Were listed by the telemanager. Is there a second? Further discussion All those in favor say aye The eyes have I have a couple of other item other business items. Are you set? Yep? the Town fair is going to be on May 4th. It's the same day as green up day and We have a select board table that we can man a woman and man Any anything? so the I Just wanted to throw that out the Table needs folks to be there from 9 until 1 p.m. On May 4th Not looking for a commitment now, but if you could make a note to get back to me if Otherwise I can I would otherwise do it myself from 9 until 1 but I think people might get sick of me So Maybe even deviate up divide it up a little bit. Yeah Yeah, I'll take whatever or you can pick up trash Behind the table and answer questions Okay, and then the another item the Chittin and solid waste district budget was Passed by its board It will go into effect if Just a simple majority of towns vote for it But there's a statutory requirement that it be Voted on by a select board or city council within a certain number of days after it gets passed and the date that we have to Decide on it or is May 12th? the interesting thing about this is that there's Actually, no legal requirement that we Vote yes or no or if there is it would be if the other towns vote for it then it would be Past we don't have a select board meeting between now in May 12th except for the one Tomorrow by a 30 to sign the warning for the new town meeting Thursday, right? You just lost your core but you can but you can come in tomorrow And then the the other issue though is that I don't know if this is an issue, but the other fact involved is that our town representative on the board actually voted against the budget and so As a you know Frankly as a matter of practicality that it sounds like that budget is going to get passed by the other municipalities anyway And we don't have a meeting scheduled But on the other hand, we are supposed to sign and we are supposed to evaluate the budget on behalf of our voters and our representative Decline to support So it would require a special meeting Select board meeting where we you know have our standard solid waste presentation Here from our representative and then make a decision And I know we haven't really had enough meetings this year So Anyway, but I wanted to bring that to people's attention Yeah, they're they're trying to require as a board or council that would Position against the budget to identify the specific line items that were not supported by that by that body More work for Jean I would But I would very much like to hear why our representative didn't vote for it. There's an email that Eric I'd ask if you could forward it. I Saw it yesterday or today It's it seems you know to summarize it seems like a lot of the A lot of the opposition in our our member was More philosophical or the taxes are already going up everywhere else kind of thing I don't want to oversimplify it and Disrespect it, but that there were no line. I guess there were a couple of items that were specifically called out, but Anyway, but you'll see Can we make a decision then whether or not we mean We feel we need to have a special meeting and a vote after we see that Email that makes sense. That's what people want No, no rule, but we have to do something right. Yeah, well No, but We probably should if So the deadlines made 12 we had originally had this plan for May 7th, and they inform me I'm just looking to reschedule with them. They told me the 45-day window ran out me 12 So that would be before the next schedule meeting but The select board decided it didn't it wanted to have the presentation after the fact It wouldn't have an opportunity to weigh in with a yes or no, but the budget would Move on depending on how the other Member municipalities voted on it. So depending if you want a yes or no vote before that period runs out It's your discretion if you want to want to have that presentation So we could review the material that Was pertinent and then let Ted know if anybody really feels they wouldn't need to call the question that we have a meeting Is that what we're saying? Otherwise, we just let it expire without our input Yes, yeah, and you could have them come later in May and just kind of give an update and walk through the budget All in waste that's like way more exciting than wastewater We're running Didn't seem to be I didn't read it that way, but read it and let you know make up Decide for yourself. What are the reasons work? I really need another budget to look at. Yeah If if we did have a special meeting I'm wondering if we could do it like that six and try to be out by 645 or something like that Do it on the May 7th that we had planned and just yeah in and out Yeah, yeah, so Yeah, let me know I mean I would say Not that I'm worried about content of emails or anything, but the emails that get forwarded are obviously going to be public records Just we just weigh in on whether we feel we need a meeting that Sure. Yes, but you can put your reasons if you want But just go to ten So that sounds like we're gonna Examine it and get back to me I'll send our Representatives email out and I'll also I'll find the materials that the districts prepared I have a meeting with the general manager tomorrow anyway And I can figure out where those are share those packages with the board to review the That does bring us to 715 so we Emily good evening to open the meeting officially so Pursuant to 24 VSA chapter 59 section 4 the town of Willis and sewer allocation ordinance The Willis and select board is considering the adoption of amendments to the sewer allocation ordinance referred to as Attachment a an existing ordinance pertaining to the allocation of public sewerage Upon adoption this attachment will designate the portion of the uncommitted reserve capacity It will be available for use during the next fiscal year, which starts July 1 2024 Public hearing is scheduled for Tuesday April 16 2024 at 715 back at McGuire meeting room Is where we are now and the public hearing is now Commenced So this is the attachment a to the sewer allocation ordinance It basically sets up how much sewer the public works department can sell during fiscal year 2025 Which will begin on July 1st the select board had a detailed introduction to this at the informational session in March What summarized in the public hearing warning is The amount of allocation that will be available for different uses in fiscal year 2025 So 10,000 gpd gallons per day for new commercial industrial 23,500 for new residential 1500 for residential additions 7,250 for affordable housing No gallons for planned public facilities 1500 for pollution abatement 10,000 for specific development and 77,700 reserve, which is what the engineer recommends. We have a total allocation Available at the tri-town plant that's dedicated towards Williston 7% is set aside by a reserve and then factoring in how much has been sold and how much is still being held How much the town can sell in the upcoming fiscal year? Looking at a 20 year I do note that these numbers are the same as at FY 2024 with two reductions So we're dropping the amount that's in the new residential and commercial new excuse me the new commercial and industrial category As well as the new residential category. So last year There were more gpd available to be sold this year. They'll be slightly less That's based on our best estimate of what might come in and it really fluctuates What comes in year to year especially in those new construction categories? Yeah, with that if you have any questions, let me know I'd like to hear from the public Do we feel that we have 72 hundred gallons of wastewater that's allocated for affordable housing will be sold? It's hard to say It would I think it would be rare right now for all of that to be sold in the upcoming fiscal year just looking at The projects that we have on the horizon. I don't know how many will be using those that affordable category So if any new projects come on in fiscal year 2025 I think it would be rare for them to purchase in this upcoming fiscal year Just because of that timeline to get a project design finance to a point where they're ready to buy allocation So if I was waging a bet, I probably would say all wouldn't be sold in FY 2025 But it's good to have that available because you don't want to stymie affordable housing Because of sewer just This is just because we have five more minutes to kill Like what just with your experience like how to be how do developers go through like what do they do first?  I mean do they do this first? Do they do this last? They purchase the sewer allocation towards the end. I think they factor in the cost and the timing of it More towards the beginning when they're developing a pro forma is this project kind of pencil out Usually they go through some level of a sketch plan review before they really determine. Okay I'm gonna do all my design and engineering and make sure can this project pencil out Once they have their final approvals and often large-scale projects need state permits in addition to local permits Then they're able to get their financing. So financial institutions want to see that guarantee Can you go start digging in the dirt tomorrow before they will you know finalize that funding for them? But that is a good question that I don't fully know 100% and I think even sometimes a developer gets a little bit surprised Oh, you might have to wait a couple more months to the next fiscal year because sewers already out already sold out for this year Some that has caught people by surprise Not recently but in the past And I think sometimes they might have they might buy their allocation over a couple years and then build all at once Right because they were waiting for the allocation I think sometimes it's more the opposite where they buy their allocation and then units come online more like a trickle So a good example would be The annex which purchased a good chunk of its sewer allocation, but it's gonna be The first four units might come online this year and they might still just be in a Model home stage not necessarily sold and it'll be years before they're using all of that allocation that they purchased Already Double-check with the prior share, but I don't think we need to actually continue that Hearing if nobody's here Okay, so is there a motion to close the public Unless there are other questions or comments or actually Eric. Is there anybody online? Okay, so is there a motion to adjourn move close the public hearing proposed amendments to the wastewater allocation ordinance Is there a second? All those in favor say aye. Hi. Well as opposed to the hearing is Brings us to the next agenda item Wastewater allocation ordinance I'm sure if I was reading the same line twice I knew that's what we had to do Okay, so that being said Is there further discussion on schedule a or is the board ready to act? I feel like we got a good explanation on our last meeting Explanation You know Yeah, and I think that'll probably be something that'll be part of the upcoming town plan Talking about the sewer service area map and you look at it's a giant area That's in the district, but then when you look at where there's gravity lines that people can connect to That's something that Planning staff working with public works. We could map out in GIS and show those dead zones where theoretically they're in the district But they're not Visibly able to connect and I think that's something that the new town plan is going to be looking at is how do we? refine our sewer service area or our sewer ordinance to better align with town plan goals We had Aldrich and Ellie at our Engineering firm that looks at water sewer for us I think a few years ago they look at our capacity and they know as you get increased flows You have to make sure your mains are the right size and your pump station So we have we have a report on that too. We could share Go over the board sometime to show where those Where those projects are targeted because that influences the water sewer capital plan as well Where the additional infrastructure based on flows and maybe there's a main that needs to be up sized or a force main so Those studies help influence the capital plan moving ahead too Just be interesting because that might Caused us to make you know adjustments to How easy it is to make changes to it The revised every year by the board It's an ordinance of mid-year if there was something that came up that could always be amended mid-year The last couple years that incurred specific development categories been utilized when there's some late in the year and Some looking to buy capacity that there's not enough and Approach the planning office with an opinion whether that would Meet that category and the select board makes that decision per occurs Yeah, Emily's point it will all factor in the town plan as well You'll be reviewing one of them next year and a half Want to motion? Sure move to adopt amendments to the wastewater allocation ordinance attachment a as presented. Is there a second second? for the discussion on the motion All those in favor say aye. All those opposed may the eyes have it Forget to mention They're looking for green up leaders as well Emily reminded me Yeah, so I'm the main coordinator for town fair on green up day And if you wanted to do a little bit of both the tabling and the green up route We are looking for town volunteers to have a designated route so you could pick a time and a place Anytime on green up day.  On Saturday You can just roll right in and we'll have your table all set up Wilson observer will be there. They're bringing a photo booth truck thing Rotary Club REI The Old Brick Church trustees are going to be doing tours of the Old Brick Church Library storytime, and then there's a town band cost concert from 12 to 1 so nice lineup of events And we'll be very excited to have you guys there as our local celebrities Three days before the budget Thank you So we are we're now three minutes Exercise some discretion and Call the hearing For the budget Three or two minutes early and since it'll still be going on at 730. I think this and then not going to be caused So The Wilson select board will hold a public hearing on Tuesday April 16th at 730 p.m. In the Beckett and Guire meeting room of the town hall to receive comment on a draft revised fiscal year 2025 budget for a revote in May the select board is targeting an over $300,000 2% expense reduction from the budget that was not supported a town meeting on the town original town meeting day and Cutting an estimated property tax increase in half to two cents per one hundred dollars of assessed value The median assessed home three hundred thousand dollars This would be a sixty dollar increase for the tax year or five dollars a month So the public hearing is now called to order The chair will note there is no one in the room except for town staff Is there anybody online? All right, so Eric, I'm gonna I'm gonna ask you to Make a brief presentation about the budget and we'll go from there sure Yes, as the chair stated the draft budget the board's worked on the last couple of work sections Reflects a three hundred and ten thousand dollar reduction from the town meeting day budget That's about a two percent just over two percent reduction These reductions include a new HR director position Staff training equipment part-time and on-call staff wages Expanding library hours path paving and sidewalk replacement building maintenance and technology This revised draft budget includes adding an 18th sworn police officer position to enable a detective position To be filled and body cameras for all officers As you mentioned the tax rate increase Cut would be cut in half the two cents per one hundred dollars of value This is down from four cents that town meeting that was projected It's about twenty dollars per one hundred thousand dollars of property value The median a median home assessed at three hundred thousand dollars about sixty dollars for the tax year Represents a five point nine percent increase from fy 24 So the the rate estimate would be a point three three six two cents or three five six two cents up from point three three six two cents Reminder the tax rate is set by the select board usually in the late june The grand list needs to be finalized first and that factors into How about the rate is set here? To balance the budget the select board built in the use of additional 125 000 dollars of unassigned fund balances revenue Town policy calls for there to be between 10 and 20 percent of the operating budget In the unassigned fund balance The estimate the staff has looked at is at the end of FY 25 Projecting at 16 and a half percent ratio for that fund balance These funds have been utilized to reduce taxes and for capital equipment for for several years And of course there's a projection by staff local option tax is something that factors into this as well That we look at each year That is a high level overview of where the budget proposal is right now Are you here for the meeting for the hearing of talent the budget hearing? Um, did you want to ask questions or make a presentation? Okay, well Great Thanks, so uh questions for eric from the board or actually Shirley do you want to come up or do you want to wait until the there's an actual question? Okay No, no need to move for no reason Okay, uh questions from the board I just want to you know say that I've heard from a lot of people you know in town about the increases You know, especially the school taxes They a lot of people you know the reason to support our children to pass a huge increase in the school Property taxes is really is really giving the wrong reason the proper reasoning should be more Stop raising our taxes to stop making home ownership too expensive for our kids to Work and live here in this town Many of our young people are leaving you can't afford to live here You know, I have a tenant he's rented from me for 22 years. He's 72 years old He lives on social security. He must work a full-time job to support himself Last year I raised his rent and two increments from $700 a month including he To a thousand dollars a month I have to raise his rent again.  It's the rents that go up people that are at least can afford it I can't you know raise my taxes To raise his rent.  I also consider him a friend You know, I also support my elderly parents and a full-time caregiver and provide housing to them for no charge I believe the inclusionary zoning pass this year the town's growth center allows unlimited growth With no affordable housing The approximately $7,500 penalty does nothing to enhance developers to build Any more affordable housing But you know, it's what's happening is all these new growth coming in town is causing our schools to become more and more crowded It's causing us to have more services for police and fire We already need a new school. You know, we have temporary buildings Those that come into the all the people that are moving here to the town They're the one, you know, the impact fees are not covering Anywhere near we're seeing property tax increases They're getting worse and worse The impact fees are not covering any of that. I think the impact fees Should be covering the cost the actual cost that was costing us people that live in town To support these new houses We can't continue to keep You know putting homes in the town without You know property impact fees we need to relook at those Like, you know, we see a commercial space in the town being appraised lower and lower Past few years So our grant list is lowering. That's going to also give us less property tax revenue We're already one of the highest tax states in the country We're now the third highest rate tax We're the third highest taxes in the whole country New Hampshire, which is right next to us is the 45th tax state in the country Do you Mike think that as a town we're egregiously Contributing to that we have the Second lowest town tax rate in the county I think I just think what we need to do is the way we're With the growth that's coming into this town, we cannot afford to continue 20% of school taxes Now we can't continue 10% but we don't control school taxes. We have nothing to do with school taxes, right? It's still involved. The impact fees affect that What we need to do is we need to The impact fee should be Should be paying for, you know, the increased services that we're having to pay Do you mind doing a brief overview of what impact fees we pay currently in town and what they're for? Yeah, the the impact fees there's a transportation impact fee a recreation impact fee and a Education impact fee and by statute it allows towns to levy those impact fees based on The impact of of new development new That comes into town Those have to be mainly used for capital investment and there's a proportionality formula that we have to look at as well So for operating costs there wouldn't be something that an impact fee would be able to be utilized for We're currently using them for things like Like our work on the alambrick park with recreation impact fees Those are controlled by the development by-law and ordinance So they're reflected with a with a study that to how to levy the fee it looks at The projects and kind of works with a formula of how to set those fees based on dwelling units primarily So the the the town amended the transportation impact fee about three years ago or so The recreation fee is up for discussion probably next year or so as well I was um Is this a question I've always had that I was noodling on trying to figure out And I haven't gotten all math done yet. I'm figuring out the I'm just really curious to to see um, if you add up the local option tax and the non homestead property taxes If you added all that up how much Of that would be of the total budget and then try to figure out how many of our services Are dedicated towards Business, it's not your commercial property. I just I'm it's uh It's not it It's not a black and white You know because you'd have to decide how much of your police force you would have if you didn't have tax corners Which would be complicated, right? But I'm just really interested because I think I think A lot of folks Wonder if the growth is pay is paying for itself, you know the services that we need to provide And I would like to convince myself that I know the answer to that question But so I so I'm going to keep working on that just just out of curiosity, but really when you add up the amount of Local option taxes and commercial property, it's it's a substantial part Yeah, the substantial part of of the revenue that we have But is it Enough to pay for 24 hour police and 24 hour fire. I would like to think that doing that Not only pays for itself, but allows Me as a resident to have those services available, right? Which we wouldn't have if we didn't have the commercial growth. We look at heinsberg You know, they don't have 24 hour on-call police fire Because they don't have commercial property to support it Um, it's something I don't have the answer to I'm curious about it It doesn't seem wildly out of whack, but I really till I do a math. I I can't say that with any authority, but Um, it is something I'd be interested in If it doesn't look like it's Balanced what kind of tools we might have to get there Um, and I just don't know that's definitely not a An area of my expertise to figure out how you would raise more revenue from commercial properties if that was If the services were not in balance with that number So I'd be curious of that in the future, especially if to my exploit the commercial properties Are losing value You got to come up though, you're gonna yell that Now you're done Besides I want everybody to hear that you thought my point was interesting just a thought is um You look at all the commercial properties that are actually senior housing So those are actually the places that are using a lot of the fire Services and they are residents. So how do you they're resident? Exactly. That's where I was going. Yeah. Yeah No gene to your point though. I mean I was just thinking the other day that The question of sustainability of the entire system is something that's been on my mind Um for a long time on the select board Because you know, we we do raise taxes not every year But more often than not they go up a little bit My concern is that you know Does that say that's a symptom of a larger systemic problem when we have to keep doing that or You know, it could there could be a lot of answers to that. It could also be that That the Growth of our town that our growth of our services is not kept up with the demands of the town And there's no judgment in that. It just might be a fact. I mean we could be catching up Yeah, we might be having to catch up. I mean we we had to hire Basically hire a fire department two years ago because the Culture in vermont has changed from when I was a kid and not enough people Volunteer to be firefighters And meanwhile we have a town that goes from 10,000 people at night to 20,000 people during the day Now we get a lot of benefit from that Now we do up until now. We've had the second lowest municipal property tax rate in the county But overall The question I keep having is like, you know, why Where is this ultimately going to go? And I think it's you know, it's not our job to say anything about the education system, but I think it's a probably a more Time sensitive question for education funding on on that issue I don't know. I mean I've been on this board for a long time and one of the things that I keep saying is that our healthcare costs go up without ever going down I'm not sure why that is. I'm not sure anybody really knows why that is but You know one of the so therefore one of the 50 percent of our of our budget is public safety meaning firefighters Police officers and the administrative and capital expenses that go with them That means that there is and then the rest of the town is a lot of employees too Each of those employees gets and should get health insurance as part of their job Every time that goes up the money's got to come from somewhere and it comes from either our local options tax Or our property tax and so one of the reasons the property tax is going up is because health insurance premiums are going up every year And that's the kind of thing that I don't think there's nothing that the town can do about that We we changed our way of We went from one plan to another to save money and we did save money with this budget, right? Yeah, we saved by switching our plan. We saved about 130 thousand dollars. Yeah, so we're we're what we we meaning eric and and surely and The good good math people of the town Meaning you guys, um, you know, they keep a they watch out like a hawk And so they're doing everything they can but everything they can do is probably not enough Early on I remember saying this to um Susan lamb that the Budget person that You know We seem to the what the town has to spend money on in the early 2000s The rate of inflation for those costs was higher than the average rate of inflation for a family And at the time it was oil gasoline asphalt Road salt things like that the price of those was going up faster than the rate of inflation And again, so we had you know, we When it's not like we don't pay taxes to I do You know the so the taxpayers have to have to that comes from somewhere. It's got to come to the tax But it seems like there are so many factors that are beyond the town's control That there's no way that the town could actually do anything about you know, I've always been opposed to You know resolutions by town governments that don't really affect anything, you know Let's who's in favor of world peace all those I'm like, oh, I'm opposed to that But but you know, so You know, we could we could take symbolic action, but we couldn't take any real action But all of that is to say that I think that one of the goals that we should have in the next year or so Is some sort of overview of sustainability of Is the property tax rate Hopefully this one will go through Is that is that rate going to be basically level? Because the other systems in place the growth that's going to happen with the Zoning changes what which by the way that growth was always going to happen It's been that way for 25 more years But you know, that's going to be a different kind of growth now But is that going to basically fund itself or is that going to increase people's taxes? And you know, we don't know the answer to that yet But these are things that I want to keep an eye on and I want to start studying in some way So I hear what you're saying So and actually while while I while I've got the microphone Mike it sounded like you were you wanted more impact fees To pay for things but you were opposed to the Feed that's assigned when somebody doesn't put in enough affordable housing Because you thought that that fee cuts back on people wanting to build housing in the first place But if that's true wouldn't it also be true that the impact fee Being increased would also slow down housing growth Yeah, the impact fee for the affordable housing is a drop in the bucket. It's not going to amount to anything You know, as we have more growth more people are moving in they want services from where they came from You want a community center? You want a blue library? You know, we're gonna need a new school These are expensive things that are coming down Yeah, I get that but that my question is like if if you think impact fees should be raised And that won't affect And just impact fees in general is not just for affordable housing But impact impact fees across the board For everything if you think those should be raised to help with the budget issues Won't those also Put a damper on the growth that we would need for the impact fees to be charged against in the first place Well, would people that are coming in here by 800,000 dollar homes don't Are going to be affected by an impact fee? Well, that's not just it's not just the residential Um, but anyway, I just I'm okay What were you considering An impact fee for public safety Yeah, it's something we've talked about and we plan to study at a staff level In the over the summer months because that's a I feel that's a key tie into our capital needs as well on the public safety side And again, there's there's a matrix and analysis we need to do It's like the the communications tower project for example, we know there's a deficiency right now with some radio communication coverage We couldn't use a new public safety fee to entirely pay for that because we are it's already existing today But there's some analysis we could do there might be a proportion of that with Different components that can come from a public safety impact fee So it's it's something that the staff is planning to to look at and bring to the board here this year All against the volume for the player suppression system And the whole brick church they voted no for the bond for the parking lot enhancements You know, I just see you know, I just see you know, they're sending a message You know, I mean if we go We already know the cswd news site It's 25 under budget They're over budgeted, you know From 22 million it's gonna be another five million dollars Essentially, that's 25 percent, you know, I can see a Center we're talking 40 million dollars the time we get down to buying the land and we get down to Getting us something like that built. That's gonna be a hard sell to the town We can't do a $400,000 buyer suppression system church So I just said a couple but one The want to make it very clear that the community center is not something that's in this budget And so not something that that we're deciding on or voting on As part of this budget The other thing I did want to address though is when you were speaking about inclusionary zoning You mentioned that there is unmitigated growth and that people can kind of buy their way out of the affordable housing component I just want to make it clear that if folks choose to not Have affordable housing as part of their growth They do need to go through the traditional growth management process and there is a cap on that amount of growth amount of Dwelling units that can be built per year within that traditional growth management. So there isn't there is Limitations to how much can be built within that if they're choosing to knock with it with affordable housing Just to In the next five years, right? But those those projects many of them have already gone through the growth management process and been buying um dwelling units for several years No, well There's a demographic study done by the school and there's there's There was nothing in the demographic study that says we're buying a new school and they had all of these on the on the list So I don't know if it's the same but my first year on the school board the budget went down um and Right after that There was talk of having to expand allenbrook because allenbrook had the temporary trailers Which by the way my girls were in in kindergarten and first and second grade and it was great Honestly, those were like some of the best rooms in that and they're nice. I've been in there But but at that right as we were about to uh finalize Coming up with uh, you know plans for new school or new whatever The demographic study came in and said hold your horses. Um, you're not going to need this and you know, all of our assumptions had been Wrong and based on you know, basically feel and not so much the numbers, but when the numbers came out, we didn't need it so I think the numbers are From what I remember from the gentleman presenting that that the numbers Are good based on the data you have but when The demographics of kids who haven't been born yet or are a little fuzzier in the project so So I wouldn't I wouldn't uh I wouldn't obsess over needing a whole new school. We have a couple of classroom problems, but we'll have to figure that out But anyways, the school will have to figure that out. I just want to be proactive on the wall. It's coming down You know, I thank you all for discussing it Listen Sure In general, um Let's see. There's some union contracts as well, but I'll say in generally employees pay, um 10 to 12 percent No But the the answer is no I know So we do have I would like to keep the meeting open for another seven minutes of meeting the public hearing open for another seven minutes. Um, so But I do think that we can move on Even within the public hearing and start talking about our um revised budget work session Um, so if we can turn our attention to that I think what I ask is you know General thoughts on the budget. Are there specific line items that are objectionable are there Is there anything else specific that's objectionable in the budget? And if there is then now would be the time because we've got a vote on this tonight I mean now meeting this meeting not the next 10 seconds I think we've been over the the budget and we have you know Taken things out and and made sure that you know, we are leaving our town with the highest level of possible service Um utilizing the the smallest percentage growth to get that service. Um So I I don't have any specific items to to discuss but I do Want to extend my gratitude to all of the staff and department heads at eric to surely to everyone who has spent the past Now seven eight months um Doing this budget we're working this budget. We're working it again responding to our our concerns And um, you all worked tirelessly on this and are very much appreciated and again, um to our department heads as well other comments appreciate the document that we got uh from Eric and uh surely and other staff that explains in detail What we talked about in the last month or so to come up with a revised budget and um Going through this page by page I can't see any reason to change what we're Have presenting tonight um No, I I agree. We've been through this through this a few times and things keep getting tighter I do um there was seems to be a little bit of confusion on our use of fund balance So if we could be kind of clear on the fact that we're using Quite a bit of the three million dollar fund balance At the uh someone who reached out to me thought we're only using a hundred thousand of the three million right because we added a hundred thousand Right, so with the whole original figure number and and why we couldn't take more given the where we need to have a Reserve would be um, I think would help clear up that confusion Otherwise I um I'd be a lot happier if the budget was a smaller percentage increase, but the expenses were only going up a smaller increase but I think this is the the The coveted inflationary lag. It's hard to explain to people that we Gave we had in order to keep staff We had to compensate in a way that would keep them here make it competitive But that was not this year's budget. So it's going to show us an increase in next year's budget but so it's it's It's complicated, but keeping our staff It's a it's a for public safety folks right now. It's very competitive And it's a lot cheaper for us to keep staff here than to keep retraining staff so And hiring and and hoping they stay and So I like I said, I'd be happier if it wasn't such a big increase on the expense side But I don't see that we have any choice. So I think we're I think it's going up in the right areas Lucky to have that it's important that we keep them Oh, it's much cheaper to keep them and then find Retrain someone else. I think it's We've got a great staff in the town. We're lucky to have it For public service and But for public safety as well agree with that um, I I'm in favor of What the staff and we have done? Um, you know, it cuts the tax increase by in half Um, it cuts spending by $310,000 which in a budget with the town of williston. That's no small number um, and again half half the budget is public safety and we've Cut the spending cut the tax increase in half, but we haven't cut any positions in public safety so that when people need fire ambulance or police they Are going to have to wait any longer than what they might have to otherwise because we have we have good departments. So I Yeah, there's a lot of a lot of pressures on this budget that again, we're beyond our control And I think it's as good as it's going to get so anyway, um So it is 758. So I think maybe we can we can risk it and uh chair would entertain a motion to close the public hearing So I'm going to close the public hearing on the fiscal year 2025 and budget revoked. Is there a second? For the discussion All those in favor say aye. All those opposed nay. The ayes have it the public hearing is closed um Next agenda item we've kind of bled into from uh, uh, a couple of minutes ago, but the uh, FY 25 budget revoked work session If there are other comments to be made on that That would be great If there are not then that's great too. Is there um, we maybe talk for a second if it's okay About communicating this because it is three weeks until To the date so and and one of those is the school vacation week So we got to make sure that we don't waste any time. So I maybe maybe just explain a little bit. Eric What you're thinking? Sure. Yeah, I talked to sure to sure with Ted the other day I've scheduled a manager chats. I'll be getting that out this week. I'm going to be at the library I'm going to look at my calendar so I get Oh, here they are that I worked on Monday, April 22nd. I'll be in the library community room from 5 30 to 6 30 Saturday, April 27th. I'll be in the library community room from 11 30 to 12 30 Monday, April 29th. I'll be in this room from 4 30 to 5 30 Then Wednesday, May 1st. I'll be in the library community room from 11 30 to 12 30 Then the board has the opportunity to have that table at the town fair on May 4th A couple days before the vote as well I'll be working to get some information out in the observer and front porch forum our town email list I share the public hearing draft on those. I'll follow up In those venues How many people are on your email list, you know, I think we have about 3 000 or so. Yeah I have to check the open rate the open rate Use I use the library list and the rec list as well. I have a pretty good number of folks, but That's kind of my baseline, but certainly open for oh, I'm going to take what's up Williston next week too and do an overview of the budget for that So we'll have that on a video medium as well It's kind of the baseline certainly any input from the board is welcome of other ways to get this information out there If you would just disseminate the link to the what's up Williston to all of us and then through the town's social media platforms that way folks can easily Distribute that link Within other community forums on social media But I think that would be helpful for people to see Did you have a did you mention a One of your town manager hours or whatever In the task corners area All up here. Yeah, I've seen about that. I'll add something down there.  So we know that's above and beyond and you are Available lots to our community. So thank you Maybe have like a giveaway the giveaway was uh eclipse glasses For the next eclipse I got about 35 of them at my house You could have I'll donate them So we have already voted on the budget We will be voting that there's Put it on the warning on thursday Okay, but we are Providing to the select board for the thursday night Okay I will not be here Nor will I Do you support the numbers? I do on the record and say it loudly on my record. I support. Yeah, I I do And actually if there's a chance for me to Log in remotely, I would do that. Is that actually going to be an option for thursday or is that I can make it happen? I will be mid roller coaster Yeah, we either have you zoom in or even it may it may not happen. I I don't know There's no mystery to it. We're going to be visiting our daughter in school in new york and um I have no control over the scheduling So As it goes I'm okay with that. You know, I'm okay. It's like, what were we going? Okay So yeah, so we all Our straw poll. This is the right number. This is what we're asking staff to Put together on the warning and those of us who can be here on thursday will we have a forum to approve it with you guys? On the record for approval. Yes, agreed so Okay, the warning. Um, you know, it'll it'll look a lot like the town meeting warning one article and I'll input these numbers. I got a Town attorney looked at today and I It's from the draft that put together. So I'll I'll share that with the board probably tomorrow So you have it before the meeting but Anticipate it could be a fairly brief meeting on thursday You will you will have to elect a temporary chair to preside over the meeting because the chair vice chair will be That might be the time a time-consuming moment Who or the getting power You can have the power back if you want. I know I was I was pretty sure Terry 20 minutes Okay, so I think that exhausts that agenda item We're all in favor of the number that's going to be voted on on thursday and Line items have been changed tonight and That's that so We already did cover managers report. Yeah, I'll just add for process I believe early voting can start as early as next week. I'm just confirming that with the town attorney, but Child a little bit with sarah mason clerk about it and given that we're going to do the printed Ballots, I'll I'll confirm with her and we'll get that in our communication as well It's important to have all this information out there before the early voting starts as well. So won't feel I think it'll be helpful too just to communicate the ballot will look a little different to folks because we're doing the Hand count ballots rather than using a tabulator ballot Just so people aren't surprised and No question I see it that doesn't look like what they're used to kicking it old school. Yeah The show. Yeah, I could do a photo. Yeah, so I'm just yeah, this is this is a real ballot. This is what it looks like Anything else First thing I thought of How many creamy joints do we have? I think all we have is chef's corner Adams when they're open They don't have creamies though. They don't creamies. That's hard ice cream. I know Okay, so if that exhaust manager's report, uh, other business we've covered but is there any other other business? Um That said final thoughts on agenda items from this meeting. Are there any? I think we've interspersed them. Yeah, I think that's so that uh, that being said, uh Is there a motion to adjourn? We are adjourned