All right, welcome back. It's still the breakfast on PLOS TV, Africa. And we're still looking at the electoral act, political interest, and all of that with the president issuing a directive. Some people have described it as a sledgehammer. Let me just give you a bit of a background. President Mohamed Buhari has directed all ministers, second, elective public office, to resign before May 16. Now, this was disclosed by the Minister of Information and Culture, Lime Mohamed, at the end of Wednesday's Federal Executive Council meeting presided over by the president. Now, the special assistant to the president on digital and new media, to Lohgunglesi, also stated this in his Twitter post. Now, some of the president's ministers who have indicated an interest in elective positions are transportation, Minister Rotimia Meche, who seeks to be president, Abubaka Malamedia Tony General, who seeks to be KB governor, Labor Minister Kreese, who seeks to be president, but has yet to purchase his form, and Minister of State for Health, the Minister of State for Education, rather, Dr. Meche Mwajubah, who also seeks to be president. Now, Buhari's directive was made known on the day the Court of Appeal conditionally validated a section of electoral law that mandates political office holders like ministers to resign before they can contest for elections or vote in party primaries. We have Katch on Anoju, political affairs analyst joining us on this conversation. Good morning to you, Katch. Anoju, thanks for joining us this time around. Thank you for having me. Yes, it was a big one yesterday and it has actually generated a whole lot of reactions across various forum, various platforms, with some people saying that it is a good one. CSOs have commended the president, but others are thinking that the president seems to be very reactionary rather than being proactive. How do you reason? Well, I will say he was, yes, you're right, reacting to the Court of Appeal which said that the judgment procured by Malami in a court to do my hair, that that was wrong. So, since the National Assembly as an institution have gone to appeal against such alteration of their bill without their consent, the president simply followed what the court said because, don't forget, the advice he got from certain lawyers was that that law has not yet become effective and since it's not effective, you notice since the past fortnight, the bureaucracy itself was sending up key advices telling civil servants that even if that case is in court, that the Standing Rule still says civil servants who intend to partake in politics most resigned within a given period. So, while that was being advised, the court now came in an appeal dismissing and setting aside the OMA hair position that section 84 be expunged. So, the president simply followed that culturally yesterday and advised the ministers to follow suit on what ministers like Emeka Wajibah, who did provide this resignation on the day he picked up the form that what he did. So, it is now official and you're probably going to see a lot of the chokers may not now resign. There are a lot of people who will not resign. You saw that the central bank governor was in court litigating that he doesn't want to resign, he wants to keep his position yet and as we're talking about it, the big man at the meet also went to buy a form. So, there is a tool to break down a order in this administration in regards to the presidential elections. You could see that they brought form for several people. There were several denials and I believe we should just give it some time before these things will settle and we will probably get to know where we are going to because there's a lot of wrong signals coming in. So, it was good that he interjected himself and then brought that intervention which now puts every minister out of official notice that by Monday everybody who intends to run for election and you are now one team of the Buhari administration, whether you're minister or a central bank governor, if you're running for that office, you must resign. That is the significance of the president's intervention yesterday. Dr. Kaj, let's also look at this now. Do we need the president to emphasize this? The electoral act is very explicit. That part of it, section 84, subsection 12 is very clear about it. Do we need the president to make this statement for these political appointees to begin to act? What does it tell of the people? No. We do not need the president to provide this guidance. The law should naturally take his course but of course we've seen a lot of things also misinterpreted by certain people in government and if this also has come into that same misinterpretation, let's simply tell say it is one of the several infringements that we have seen so far with this administration. So that yesterday has given his instructions and I believe you will from today till next tomorrow find out those who are genuinely intended on running, apart from the Shirei Bursin, where every Tom Dick and Harry are now buying presidential forms. All right, so far from what we know some have resigned. God's will at Babio has resigned as the minister of Niger Dental Affairs. The president's personal assistant on new media and digital communications, Bashir Ahmad has also resigned and Mekang Wajjou by minister of state for education has resigned. But then Oman Nayon, minister of science and technology has resigned as well but there are some a bit of differentials as it is right now. The minister of labor and employment says that he needs to get clarification from the president before he actually does that he's yet to resign and of course not just him, other people as well. But I really need to understand what all of this imply for the president. Would he need to now appoint new ministers, new members of his cabinet just before the elections? That seems inevitable. He would need to reject his cabinet and allow politically supposed and election-interested people to go their way. And you also will not say as you were recounting I confirmed this morning because there were some back and front about minister Babio. But this morning I was on phone and he said yes he's resigned and I said fine. So that of Mr. Ngige, Mr. Ngige said he would be consulting his constituents. The president has spoken. You don't need to go back to the president. So minister Ngige said he would consult his constituents. You are going to hear such words from a lot more people. Now that the APC Biasa yesterday said that Golo Jonathan's name has someone living registered and also with the PDP yesterday decided not to go along with Sunday because the party is foundationally built on Sunday. But for them not to say they wouldn't do so. Of course that simply tells you there will be totally brand new permutations and we actually may see those that have been denied become real aspirants in the selection. The surprises are not yet over because if a lot of the aspirants from the east were specifically told by the president to go take the fall, then you should understand the president's mindset in regard of the kind of south that he's looking for. So when he now talks about the east, so you're now seeing even people from even the old east town region but currently in politically dual political zone of south-south and that's what you see in everybody there residing. So I believe we not know where in the south the presidency has been advising people to go get ready about the parameters. If it turns out to be Golo Jonathan and then it means that there will be no contest. There will be no contest. Probably might just be a conversation for another time but let's look at this now with Chris Ngige saying he needs to consult with the president before. Not with the president, he's not the president. He said he wants to consult with his constituents. The presidents have already given the instructions. The constituents here. Dr. Kachin Nunojou has not been explained. I mean it could be anything. A lot has been happening recently but does this not even tell us that we, does this not really portray the ideology of having a strong man or having strong men in the system rather than having a strong system itself because one will be wondering why everyone would have to wait for the president to make a statement about what the electoral law is very explicit about before they take action. It just shows that there's no regard for the rule of law. That is true. That is true. The rule of law has been severely challenged under Mr. Buhari's rule. Don't forget we are talking about election yet the most serious thing that have happened in the past one week are far more heavier than the misinterpretations of the motion of the law in regards to those who want to run for election. We have been removed from the sovereign recommendations list in the margin markets arena by a lot of banks because they've not seen any remittance in the past 90 days from our oil sales and you've also seen the British Home Office right to say that the violence would be seen in the east and not committed by the IPOB. So all this brings a lot of questions to bear and that's why I said going forward we have a lot on our hands. Would you say that all of this is a product of a disregard for the rule of law or obeying instructions? It is a disregard to the rule of law. You do not need the president to tell you to obey the law. The law should stand on its own and every person appointed to work in government should naturally know the law. But because people advise that certain things can be bent for them of course you're seeing this. Even what we're discussing does this look like a primary? No it looks like a joke. All sorts of names. Every kind of persons you know and you start to ask yourself are they already running for this office and you're going to say at the end of the day you're likely to see a repetition of what we saw in the events leading up to the emergence of the party chairmen in the last APC convention. I don't see a primary. I see they withdraw a letter in two charades. I don't think there will be primary. I think the president will simply point to somebody and everybody who submitted their form would withdraw attachment from 18 to 8. We simply be told you swore to this authorized document that you have withdrawn. So we have now considered and this is who we believe we should be endorsed. The reason for a million people buying the form is simple. If at all the 50 people or so that have the form you have up to 80 percent agreeing to the president to endorse somebody. Those people's behavior will not be used as a reference to blackmail some real genuine people that bought the form into also following suit just as they did in the emergence of the party chairman and going on to entail whoever the president wants. So I foresee the protocols being set up for blackmail those who have legitimately step forward to actually contest in the primary. I don't see a primary in any way. All right Dr. Kachan Ononuju let's look at it from another angle. I know some people are saying this might just back some legal debate over the 30-day exploration just before the primaries. That's what the electoral act stipulates and then again there's also the talk of Eterm affecting the chances of these ministers in a late resignation and all of that. What are your thoughts exactly? Well definitely that's why I told you a lot of the ministers may suddenly not resign. From today you will see a lot of those who bought the form will change their mind. I don't I can't tell anybody that what's going on is normal no it's very abnormal it is injurious to an honest context it's undermined the democracy but then it simply goes to show that the system has instead of going forward has actually done one step forward and four steps backward if we now in a party that had his primary in Lagos fully televised suddenly now preparing to undermine institutions and instead seeking to listen to the voice of a strong man that's the truth instead of building institutions now we're building powerful iron bender men. I don't think this is good for the democracy. All right so invariably you're saying that most of these ministers will not resign but those who eventually will resign how do you see their chances really? Yes those who will resign will know those are those from the east where the minister the president seems to be giving all indications and that was why you saw the charades around good long term time now he's giving them his their their their conditions that yes it's not enough for minister Malami to be coming to him to say wrong that they should inform their principal which is the president that once the president is in charge of the discussions with him present good luck then he may listen positively to their begings that he should run and I believe if that happens that's why you see why I told you that a lot of them may not resign why because of the news that now came from Bayasa yesterday that a card had been procured for present good luck from Otoki because the card that was used to originally purchase those funds was arranged by people who according to him made those cards went to buy without doing full consultations which he requested when they came to him that they talked to president that when the person discussing that with him so I do not know what it is that he has not seen for which they have not agreed to yesterday to procure a phone for america for him from otoki and buy us a state and so these things are moving very fast I don't want to look at the denials no I simply look at what is going on it is very clear that the president's eye is focused on the old is down that's why you'll see the people from both the south but how can you how can you be certain doctor on how can you be certain that the president is actually eyeing given the tickets as it is of the apc to the southeast how can you be so certain I am certain I am in here and I know what goes on when you see permutations like present good luck being dragged in you should understand what that means if you see people if you see people like make a wajuba resigning on the day he bought the phone you should know that those things don't just happen and even man would not put a hundred million on a white goose chase is not true there will be some behind the same discussion it was worn for profits and they know what they did talk so once you see a one-on-one make a wajuba buy and then inform for good luck you start looking at that geography this is where it is going to so I am not surprised this is what I predicted years ago and of course if you look at the national crisis what everybody says here in abuja is for us to be able to balance the country in regards to the current agitations from the east just as it happened to the southwest when president was brought out from prison and then used to doubt the european question for due to a republic after the annulment of adela's election after president of mass and you have done eight years vice president to sit back has also done eight years so the calculations is to be able now to balance the entire game is to come to the old east to be able to situate and put off the flame of the current agitation for separatism by the young people and that's what we've seen because a lot of those from the east who are buying the forms are not regular people who were foundationally members of the apc like those from the southwest who linked up with president buerre's cpc to form the foundational platforms of the apc but now as we're having this crisis of insecurity in the country they have been advised across the country that one of the ways to be able to arrest the current agitation for separation from the east is to feel somebody from the east to be able to doubt that tension and that's why you're seeing those movements happening currently in the east so but let's come back to the party level i mean if you have those who are not obeying the instruction of the president that's by the fact that the law is very explicit explicit on it the electoral act section 84 subsection 12 very explicit on that and then the president has also we echoing what the electoral acts has said and for those who would not resign because you've said they're not going to resign what do you think might be the action of the party should the party disqualify them should they be considered the party wouldn't have to disqualify them the party will simply consider them as people who did not submit their forms don't forget you can tell the party you're running but the party will only regard you to be running when you have made their conditions and their conditions is you will submit their form they will not accept your form if you did not tender your letter of resignation this is what the presidential intervention means if you did not resign the party will not collect the the fully completed forms from you they will not do that but anybody you see that's telling you he's submitting his form you can be sure that is somebody who has resigned the party is going through that why they attach form 18 if you also don't feel from 18 for withdrawal the party will not collect your fully filled form and if your fully filled form is not accepted by the party you cannot go to court to say that you are an aspirant who the party knows and the party from there you're just on your own so I don't see anybody being able to even do anything because everything that's happening right now according to the law is in and before you can go outside to a court of law to seek redress the party's rule advices you to seek all the internal mechanisms for crisis resolution before you go out so and I don't see them because a lot of these people are very afraid of somebody I don't really see that challenge I don't but do you see do you see I mean the party acting contrary to this what if I'm just saying well nothing is nothing nothing is impossible but I can tell you we've already seen where the picture is going to and because of the development yesterday in Biasa you can be sure that a lot of people who bought form may not resign okay a lot of them who actually bought will not now progress as aspirants if it becomes real that present good luck will not tell you his conditions have been met you will see a lot of the activities towards contest in the primary all fizzle out this is what is going on right now in our budget all right thank you so much for all of the thoughts that you have shared this morning Dr. Kach and concerning the electoral act to the recent development the president's intervention and of course the fate of the ministers would you appreciate your time thank you for thank you for being part of our show we appreciate you thank you all right we'll take yet another recall comeback was to be looking at politics but from another angle this time around the people's democratic party has actually thrown its presidential party's ticket open no two zoning implications consequences in a moment we'll be talking about that stay with us


What's going on everybody? Got Kyle and Sean here with Layton sports cars from tops definitive three box case number 37 Pick your team style We have Alexandra's S with the Mariners Andre K Astros Brian G has the Mets Christopher J has the Nationals We got Cole L with the Brewers David O with the Phillies Dusty B has the Red Sox and the Cubs Edward P has the Rockies Edward S has the Padres Evan L Tigers Gary G Reds George M with the Rays Hua Sung C has the Giants we have Jeffrey H with the Yankees Joe K has the Guardians and the Twins Jonathan R has the A's we got Jordan W. Marlins Julie C with the Dodgers Pirates Lee Wei has the Blue Jays Mark R with the White Sox Matthew W. Has the Royals Michael C Has the D-backs and O's Oren has the Angels Steve W. Has the Braves Taylor R with the Cardinals and Zion Shun with the Rangers Good luck. Good luck guys. Let's do it. Let's do it Yeah, let's see a monster man Yeah, they have it up. They have it on late in gaming. They I think they might be streaming tonight, too Might be ripping some over on fanatics Maybe Jason, I don't know. I don't know Upper-deck stature. We don't have any at the moment Darth We don't have any at the moment all we have for hockey actually is the ice that we're ripping tonight It's our last case as well.  Alrighty guys. Let's do it. Good luck some definitive 12 to go 12 to go on upper-deck ice breaking next First hockey yeah, that might be it Jason. I'm not sure one two one two Microphone checker let's go Defend yeah, yeah box one. Yeah, boy I Can see it that's a thin one there. Yeah, it's a really thin one Bills all day says shorts Bills all day. Let's go bills. That's not supposed to be there. We have a it's a 40 Bobby Whit jr. On the game use men We'll switch that back up It's a 40 Bobby Whit jr. Game use men for the Royals Bobby Bobby Nice one here to 30. We have a game use patch auto of Jordan Nice you're down there for the Astros You're done Alvarez a beast a beast. Oh, yeah We have to 25 that's gonna be Logan Oh hoppy won a 25 rookie auto for the Angels Angels rookie catcher Oh hoppy there just saw him a minute ago We have Larry Walker on the pinstripe 240 on the game use Jersey out a nice one there Rockies Back to back on the Larry walkers from two different breaks Nice one there game use patch Redemption Jesus redemption is dual autograph red the 101 dual auto dual autograph red parallel Do autograph red parallel of My Schmidt and Bryce Harper for the Phillies boom that'll do Phillies Who's got the fills that is fire? That is fire. That is for David. Oh one of one dual auto Schmidt and Harper Schmidt and hoppa To autograph red to 101 That'll work and I was I was already looking at the card behind it. Yeah, I was already distracted It's a good box Cuz right behind it for mr. Oran. We have a gold frame auto to 10 Shohei Ohtani Let's go boom. We'll mag that for mr. Oran. W or the Angels Six out of ten on the gold frame auto. Let's go. Oran. We go Oran Let's go a little Shohei action six out of ten Angels You know mag on that gold frame This this box is crazy to be honest with you Completely honest with you cuz right behind that we have a gunner. Henderson RPA three-color patch to 15. Oh Orioles Michael C get a mag on that three-color patch game use a gunner To 15 it's not even over yet. We got another one We got another winner Mag that and Another man coming This one's for the Yankees Yankees is I believe Jeffrey. Yes, sir Jeffrey H It is autographed a five Aaron judge on the defining images Two out of five Good God. What a box of definitive That will do two out of five on the judge purple a mag on that Is four mags in a row It was missing a patch card. We'll take it. Yeah, we'll take it It was missing a patch card, but we'll take it. We'll do without it box to goodness gracious box to In guys 12 to go still I said upper-deck I sock that has to be one. I think it is I think it is I think it is the best one I've seen We've seen absolute monsters other stuff. I think it might have been the 101 Harper Tony Judge yeah gunner. Yeah fire. This goes on and list goes on. You ain't lying Logan I'm with you there fair fair very fair. Got a Philly's there three color patch to 30 of Kyle Schwab Well Schwab on Philly's game use patch Schwab on He Dan taking the lions in absolute and We have a Nato patch there to color for the Cardinals to 15 Game use Nato Yeah, right Vaughn imagine this is a personal. Oh god. That is mandatory mandatory Yeah You fall moving. Come on Vaughn We have an RPA on this one to 50. It's gonna be two color patch of Nick Prado for the Royals Like those light blue Royals jerseys Nick Prado to 50 on the RPA We have number to 10. That's gonna be a purple rookie auto of Tristan Casas Tristan Casas for the Red Sox Purple rookie to 10. We have a defining images auto 10 out of 10 Big Mac or the Cardinals there Cardinals Mark McGuire 10 out of 10 He's a Big Mac This one is that's 25. It's gonna be Barry Larkin on the big game user big on-card auto there the Reds 95 NL MVP Barry Larkin to 25 and gold frame is gonna be number to 30. It's gonna be the wizard another one there Cardinals Cardinals doing well, man the Big Mac there Nato and The Aussie Smith on the gold frame This one there to 30 the wizard and on the back. We have a rookie out of the 50. Why not Corbin Carroll? There we go. D-backs really nice one there on the rookie base auto Number 250 D-backs is Michael C Michael got the D-backs and the Orioles working out get that in a Mac for you, sir. I Respect the wizard. There we go toke. That's one you wouldn't wouldn't burn us. That's it's something We'll take it toke. Alrighty guys box three really really good case so far really good case so far Still at 12 to go guys upper deck ice hockey trying to break that next First up we have a two-color patch Justin Verlander number to 40 there for the Astros Well yellow and orange patch Verlander to 40 game used We have Fernando Tate's with the dirty Jersey there to 30 got a little bit of clay on there game use Jersey for the Padres Little Tate's what's on Fedon? Robert what's on Fedon? How we doing? How we doing sir? Always knows how to get the shot. I love it. Oh, it's a sick patch here. We got a four-color patch It's a 25 game use Jersey of Byron Buxton Nice one there twin sick a number patch Four color Byron Buxton one of 25. We have a rookie auto. This one's gonna be Cardinals again to 50 Nolan Gorman Nolan Gorman on the rookie that is a Taylor R with the Cardinals been a bunch of Cardinals in this one We have a Jersey out of the 40 that was gonna be Vladdie senior for the Expos that will go to the Nationals Nationals by way the Expos Vladdie senior on the um Patch out of the 40 we got Riz The 25 for the Yankees. I'll be mr. Jeffrey H with the Rizzo We got Riz you can Jeremy taking one upper deck down to 11 guys. Yeah, we can fill it. We can fill it We can rip it right now down to 11 Rizzo there to 25 Yankees Do a lot of Pete Alonzo and David writes for the Mets That is Brian G with the Mets nice one there my man the captain and Pete captain and the polar bears six out of ten Pete Alonzo Pete freaking Alonzo there. He is Nice one there mr. Brian six out of ten that is a sick one David Wright and Pete Alonzo on the dual to ten Dual patch and auto and we got another do a lot of right behind it back-to-back duals And it's gonna be Edgar Martinez and Jayrod. That's a sick one there for the Mariners 235 who's got Seattle? Who has them that is gonna be Alexandros nice one there Garin Jayrod Six out of 35 man Some fire some fire Alrighty guys that will do it that will do it for 2023 definitive three box case number 37 PYC we'll do a quick hip recap guys, and then we are on to hockey Just 11 to go on upper deck ice hockey guys. We are getting there. We are getting there get it going next Right guys do a hip recap Not a bad case there. Not a bad case there To 30 we had Fernando Tates game used Jersey to 40 Verlander to 15 Nato 30 was shorebomb and to 40 a Bobby Whitts to 25 Anthony Rizzo We had a 40 Vlad II junior or Vlad II senior sorry for the Nationals To 50 was Nolan Gorman and 25 a patch auto Byron Buxton We had on gold frame to 30 Ozzie Smith the wizard there is to 25 Barry Larkin on The big on-card auto to 10 was Mark McGuire for the Cardinals. We have the 10 just in Costas rookie we have a RPA to 50 Nick Prado to 40 patch auto of Larry Walker to 25 O'Hoppy We have your dawn to 30 patch auto We had the dual auto Edgar Martinez and Jayrod to 35 sick one their Mariners And we had the dual auto to 10 Pilonzo and David Wright And now for the max we had to 50 it's gonna be Corbin Carroll on the rookie auto for the D-backs Corbin Carroll we had to five Aaron judge on the purple auto defining images auto Finding images. I'm wondering if that's his uh His 60 second home run That would be a defining image that one that he broke the record with I think it was 62 something like that somewhere around there and A rp to 15 this one's gunner for the Orioles Three-color patch nice one oce And that's and we had a gold frame Shohei Otani six out of ten on the gold frame purple auto and 101 on the dual auto we had Mike Schmidt and Bryce Hopper Mike Schmidt and Hopper for the Phillies one of one on the red dual auto Alrighty guys, that'll do it for the definitive case 37 man. That was a fire case. We'll get that right out to you guys


Money's not the purpose of life, money's the fuel. So the purpose of life is actually social life. If you look at a good scientist, all scientists will say our brain is built for social life. So what's social life? Friends, family, romance. The purpose of life, friends, family, romance, on earth. So people sometimes forget what the purpose is. So people make so much money that they forget about social life and then they're depressed. So to me, I put health, wealth, love right up in the same importance as wealth.


From the highest heights to the lowest lows, God is there with you. You know, I just got done traveling all over the United States here for a week and a half or so and having a vacation. God is in every place. He's moving in every place. So glad you joined us today. This is Hope Today. I'm Tom. I am here with Amanda and Sydney. Sydney, we're gonna travel some places in the spirit today. Be sure you are. You know, it is time for you to receive your divine inheritance and experience a move to the Holy Spirit like never before. You don't want to miss our upcoming conversation with prophetic speaker, revivalist, destiny image publisher, Larry Sparks. He's here in studio and he's gonna reveal the revelation he received from God about the power behind Pentecost and why we are called to cultivate the upper room experience now like never before. Amanda, I am super excited because I know right now is a time for us to be charging our spirits to go after God like never before because he wants to move. Revival isn't coming. Revival is now. And we're gonna unpack that today in a greater measure in a greater way. That is so true, Sydney. You know, God is wooing people. I had the opportunity to be with a bunch of church of God women and some other women at a retreat at Markleysburg and at, let me see, Camp Sunrise Mountain. It was absolutely beautiful, but I can tell you there is a hunger for God's word and for his truth and for the Holy Spirit. Like I never have seen before among women and it's amazing not that it's not among men. Well, I just think that God responds to that expectation, that desire, that when we, he's always ready to pour out. We just need to be ready to receive and to go after him. And so stay with us. We're gonna see just an, I believe a move of God on the program today. Right now we're gonna see what we can do with Stump the Host. All right, so play along with us. These are all books of Acts, book of Acts edition questions. And I always say that I love the book of Acts and every time they give me book of Acts questions, I miss them. So here we go. Let's go ladies. You're gonna have to help us out here. What vision did God give Peter before he met Cornelius in Acts chapter 10? Was it of the sheep? In all the unclean animals?  Unclean and unclean. Unclean and unclean. I have no idea. I believe that's it. It rise Peter, kill and eat. It was a vision of animals coming down on a sheet. All right. All right, we're good. We're good. First one's good. That's from Acts 10 9 through 16. I definitely need to read that chapter because I don't think I remember that at all. All right, here's question two. What sin did a niacinth sapphire commit according to Acts 5 1 through 11? So they lied about how much they got from the property they sold. Yep, I believe. They lied and they said they give the whole amount and they didn't give the whole amount. They didn't and then they died. And then they died. Yep. Wow. We all say we want the spirit to move like it did in the book of Acts. I don't know. People who pay their time, they fall over dead. I don't know. It just, they lied to the Holy spirit though. That's what it was. So here's the last one. Paul had a dream Acts 16 6 through 10 about a man begging for help. Where was this man from? It's from Macedonia. Wow. Praise God. It's from Macedonia. Look at that. All right. I got a sprinkle of joy. Yes. I got a sprinkle of joy. Woo hoo. All right. All right. Take that producers. Oh no, I would definitely have to give it to you too. Cause sometimes I was like, I really haven't dug into the book of Acts that much. Cause I was like, I don't know about all these. But it's all good.  So anyway. Well, well speaking of callings, it is time for you to know your divine inheritance and calling. And when we come back, we're super excited because we have Larry Sparks with us. Revivalist. He's the publisher of destiny image. He has a prophetic word that is brewing in his spirit just for you. Because right now we know you are called to experience the Holy Spirit, a move of God in your life in your family and community like never before. You ready? We'll stay tuned. We'll be right back. Cornerstone television exists because of the faithful support of our partners. Thanks to you, we get to proclaim the good news of Jesus both locally and around the world. All this month is our way of saying thanks. We are offering this beautiful and inspirational 16 month calendar for your best gift to CTVN. This special Israel calendar, 75th anniversary edition celebrates 75 years of modern Israel as a nation. Each month you'll enjoy a new and beautiful feature of the Holy land. You'll be blessed to see places in the Bible come alive. This 16 month calendar runs from September 2023 to December 2024 and has plenty of space for writing your daily activities. Request the special Israel calendar, 75th anniversary edition as our thank you gift when you give to CTVN today. To give, call<PHONE_NUMBER> or go to ctvn.org slash donate. Hope happens here. We are so glad that you've joined us today for Hope Today and we just wanna make sure that we're connected to you if you don't already have your Hope Today newsletter. Give us a call at<PHONE_NUMBER> or go to www.ctvn.org. Make sure that you get connected with what's happening. I know we have a special article in here. Russ and Norma's pictures on the front page. So you're definitely gonna wanna sign up for this. We are so glad that you are getting connected with us and we are so excited about our guests today. Larry Sparks is a prophetic minister, revivalist and publisher of Destiny Image. After a life-changing encounter, the Holy Spirit revealed to him a biblical blueprint for believers to experience supernatural awakening like never before. Larry Sparks is a dear friend to our ministry and he's joining us now today to share insights and keys from his new book, Pentecostal Fire. Larry, it is such a joy to have you with us today. Sydney, thank you and the team for having me here. I'm excited. Well, we are truly excited because you have something that has been burning in your spirit about Pentecostal Fire. So can you share what it is and what God has dropped in your spirit? Well, I was even getting ready to come up here. I actually felt like the Lord said, I want you to bombard the people who are watching with testimony. Because this is called hope today and what happens is when we hear the testimony of what God is doing right now. I wanna encourage the folks who are watching, God is actually moving right now. It wasn't like 100 years ago when he moved into the Azusa Street Revival. That's great. 20 years ago when he moved in Toronto and Brownsville. Great. We just got back from California, Southern California, we partner with a ministry there called California Will Be Saved, all Gen Z people, going up and down the coast of California, seeing thousands coming to these open air gatherings, saved, delivered, baptized, healed, filled with the Holy Spirit. They actually closed down Hollywood Boulevard and did a whole open air meeting there where again, thousands come because there is such a hunger. You guys were talking about God responding to hunger, responding to that expectation. I'm seeing that right now. That's just one place. But I felt like the Holy Spirit said, tell them California is not off limits because dark places are hard place. Have you ever heard that? Like, that place is a hard place. It's a dark place. New York City, Las Vegas, San Francisco. I just got back in March from Wales and Ireland. Hard, dark, atheistic, secular. The Lord said this, Larry, those places will always be hard and dark if you go in with gimmicks. But if you go in with the gospel and the glory of God, the manifestation of the power of the Spirit, there's no such thing as a hard or dark place for God. And we are literally seeing that.  No places off limits. Oh, I love that. It's just like, we can really feel like in those hard places, it's like God is like, His Spirit is going through those places and He wants His fire and His glory and His presence to be released like never before. Can you just share with us because you had a revelation with God that just even to burn this idea of awakening and how it's so tangible, it's right at our fingertips. Can you tell us about that? Yeah, yeah, I'll contextualize it very briefly. When I was 16 years old, I'd gone to a Christian school.  That's all I wanted. I didn't want to get left behind and I didn't want to go to hell, but I had no desire to really serve the Lord. I went to a church service at 16. God just sovereignly awakened to hunger, holy curiosity in me. I got touched by the manifestation of the presence of God. I even feel like as we're talking about God moving this way. For those of you who are watching, I don't want this, I'm just gonna be bold. I feel like God is just gonna touch you supernaturally. I'm not trying to whip anything up. We're not trying to manufacture anything. I actually feel like some of you are gonna feel heat on your hands. Some of you actually may notice a trembling. You might need to actually fall on your face before the Lord because I believe the Holy Spirit pours out His presence while we even talk about Him. So I was 16, got radically touched by the Holy Spirit and since then that has been my heart's desire. Anything I do in ministry or publishing, I want to see people connect to God, not as a concept, because he's not a concept, not as just a theology. And I believe in good theology. I got my masters from Regent University. He is a real person who does what Isaiah 64 once says, he rends the heavens. He tears open the heavens. He comes down and it was 2021. I went to a church in Peoria, Arizona, highly recommended called Fresh Start Church. Those people mean business, man. You gotta go there. You gotta have electrolytes. You gotta have a seat belt, whatever, ready to go because those services go like three, four hours but they're going after God. They called me up. They prayed over me. They prophesied over me, ministered to me. And I felt like I received something from the Lord. And I'm like, God, I came back from Arizona back to normal life. I said, God, what did you do? What did you do to me? What are you doing right now?  Say, God, what did you do to me? You were talking about the women's retreat and what God is doing. More and more we are seeing people go to these kinds of gatherings and just radically experience God.  None of us want that. Those life changing encounters with God, please seek God. When you get touched by His presence, say, God, what did you do to me? What are you saying? What are you upgrading? Because I asked him that question, Sydney, and he said this. And every time I say it, I feel a fear of God on it because he made a statement. He didn't tell me really what he did to me. He said, Larry, tell my church I'm reintroducing her to Pentecostal fire. And just one last thing, please don't be afraid of the word Pentecostal because you might be thinking a very weird, strange experience. Even when I named the book, I had some people saying, are you sure you want to call it that? And the Lord was very emphatic with me because Pentecost is not, it's not just a denomination. It's not a flavor of church. Pentecost is what birthed the church when the Spirit of God fell on a company of hungry people crying out in an upper room. They weren't just sitting there idly. It actually tells us in Acts one, what they were doing. In fact, in my Bible, there's a little heading. It says the upper room prayer meeting. They gathered together one place in one accord, God poured out his spirit. I'm gonna prophesy right now because even what we saw at Asbury University, I was there. I said, God, what are you doing? Because everybody was coming together one place in one accord. They were worshiping. They were praying. We saw it at Lee and we saw it at Liberty and other places. Seeing it at Auburn where there's all these people getting baptized. God, what are you doing? The Lord says, I'm gathering my people together in one place and in one accord. And the Spirit of the Lord would say to you even right now that will produce as it did in the book of Acts the inevitability of a suddenly. I prophesy right now. We are moving towards something guys. We're moving towards the inevitability of a suddenly outpouring of the Spirit that is gonna change the landscape of this nation. Cause this is the hope for the nation. Anyway, I answered probably more than you were talking about. Because like this is what we're all about and hope today is we wanna go where the Holy Spirit is going. And we just even feel that there's a divine interruption that's even happening in this program today. And we just wanna encourage you if you feeling the heat on your hands or you have a hunger, give us a call on our prayer line at<PHONE_NUMBER>. And Larry, you said something as you were just like just reminding something that you mentioned in your book and you talked about revival resuscitates but Pentecost sustains. And what you're talking about is this Pentecostal fire. It's not this move that is happening in church or gathering. It is something that is continually happening. We have to be on the altar of his presence and just to receive it. This is what he's desiring for all of us in this season. I love that you brought that up because that reminds me another prophetic word from a dear friend of mine, Miriam Evans. I travel very closely with Tommy and Miriam. We go to all these just different cities seeing revival break. Sometimes, listen, there's nothing special about us. We're just hungry. And we go and partner with these different churches and we basically go in and we go in and tell them it's legal for you to go after the fullness of the Holy Spirit. But my friend Miriam at a time when she actually lost her father unexpectedly and she's a revivalist. She's flying to a place to go minister and Lord gave her this vision. And in this vision, she saw Jesus with resuscitation paddles over the United States shocking the nation. Just like, and again, not shocking it in a bad way. Shocking and telling the nation be revived. Wake up, because that's what revival does. It is a shock. It is unusual. It's a powerful demonstration of God. But then it shifted because then she actually felt like in this vision the Lord said, and guess what? I'm actually turning my church into resuscitation paddles. Because we are filled with the Spirit of Christ. He resuscitates. He revives us. But we are literally filled with the resurrection power of the Holy Spirit. And I see that happening. He's raising up a company of people that would go to every place that's dry and dead.   I feel like the Lord is saying dead things are not safe around you because you actually are the resuscitation paddles in the hands of the Lord. So... I have to ask you, you had mentioned about people being saved in the meetings you were seeing. And of course we see in Auburn, there were people being baptized, an outward sign of salvation. What are you seeing with people that are, it's not just Christians, but there are non-Christians being attracted and coming to God. It's wild, it's weird, and it's wacky. In this sense, because there's this religious lie that says, people who don't know Jesus, they don't want that stuff in our churches. I just gotta go after this because we gotta be mature enough to talk about it. It's like, they want hip, they want cool, they want TED talks, they want motivational, all I know is when we do these outdoor gatherings like you're talking about, and literally people, it's not that they're just like not saved. These are often demonized people. These are often people who are in great torment, great bondage, that type of thing. They come, it's like the sound draws them in. I remember we did a meeting, an outdoor meeting in South Florida, cardiologist actually, Dr. Chauncey Crandall, precious man who's an evangelist ministered with Reinhardt, Bonke, me and Tommy and Miriam were there. We did it in this outdoor area in Palm Beach. And there was worship and we were going after the power of God, the baptism of the spirit. And there were people who lived in these high rises. No joke, came down to the meeting, got saved. They came out of their condo. These are not, these are well-to-do people. Came down, got born again, because they heard the sound. And in Acts 2 verse 6, I love it. It says, when they heard the sound of the relevant hip, cool, it doesn't say that. I always get very facetious. It doesn't say when they heard the sound of the hip, cool, relevant preacher or the church that had a children's program that was like Disneyland. And listen, we want good, we want to be professional. We want to be excellent. I'm not devaluing that. But it says, when they heard the sound, the multitude came together. What was the sound? When you look at it in context, we're talking about the book of Acts, it was the sound of a mighty rushing wind. It was the sound of the manifestation of the spirit. It was the sound of something that sometimes we'd consider a little bit weird, unusual and supernatural. But back to your question, people who don't know Jesus, people who are in the world, whatever, the tired of the world, they want us to actually carry the otherworldly. And that is that supernatural power of the spirit to them. It is so good. So talk to us about a testimony of someone who attended and you've seen their life just be impacted. Yeah, one of the most, one that marks me as a dad. And I might cry over this because I remember, we've been doing meetings for 10 years in South Florida as well, me and my pastor. We did a meeting with Heidi Baker, Randy Clark. God just filled the building. Like you couldn't escape from the presence of God. So we're going around, just ministering to people. And there was a family there, and I knew them quite well. They attended a more traditional church, nothing kind of like what I'm talking about right now. But you know, you just know the people and you know that they're not faking an experience with God. And I went over and everybody's at the altar in front of the church getting touched by God.  Kids not going to manufacture this. And a little girl was just laying there, the smile on her face, trembling under the power of God. That's so marked me. And I went over there and again, these are not like, these are not people who are revival junkies. These are precious, solid people who are like our daughters being marked by the presence of God. I came over and I'm like, God, what do I do? I don't need to add anything to what you're doing. And I made this decree over her, and I carry this for the generation. I said, Jesus, may this encounter with you right now be an argument one day against the devil. May this encounter, as she's experiencing the real God, when the enemy comes in like a flood with temptation, with the world, peer pressure, I pray that she remember, I pray that she remember the moment at an altar where she met the real and living God that caused, it's not about the trembling, the shaking, the falling down, being slain in the spirit. I celebrate all that actually. I tell people and it disarms them. I don't tolerate the manifestations of the Holy Spirit, I celebrate them. I do, well, brother, what happens if things get weird? We pastor it, because often in times past we shut it down. Oh, no, no, no, we pastor it. There's somebody being distracted, we deal with it. Hey, well, what if it's a demon?  That's right, yeah. I mean, literally, if somebody, we see that regularly in these meetings where God comes so strongly, people will do unusual things and it's like, there might be something demonic. Well, great, let's take them aside so we can preserve their dignity and see that person liberated and set free. He just, God comes with that level of force, that level of fire. Well, Larry, how can I position myself for that? We just need to be hungry. We need to number two, welcome him when he comes. We don't, like I said, we don't tolerate him. We celebrate him. So that was one, I remember seeing that, that marked me and I said, Jesus, do the same for my daughter. Do the same for my family. And he is, he's apprehending children like that powerfully. You know, Larry, just like before you just mentioned about your family and your daughter, I just really sense that you have a father's heart for so many people where it's like you see with your daughter and this generation.  Just take a moment and just minister to them. Yeah, I wanna encourage you what our kids need, what the next generation needs. And if you're a young, I'm not that old by the way, I'm 40, we need an encounter with God. We need to know that he's real. And you know what? He responds, I was thinking in Joel two where it talks about, let the people pray. And then right after it says, and God will respond or God will reply. So I wanna encourage you. That's the greatest legacy that we can leave. That's the greatest thing that we can encourage the next generation is to cry out to God, is to pray and say, Holy Spirit, would you come and move with power? Think of Karen Wheaton, who's one of my heroes. She said, God called me to do the ramp. To me, one of the most powerful youth ministries on the planet, God called me and I gave God every reason why I was unqualified to be called. I'm not cool, I'm not hip. I don't know how to talk to young people, but you know what the Lord told Karen Wheaton? He said, yeah, but you know the way into my presence and you know that if you pray, I will come. And that is what you need to teach the next generation. So that's my encouragement to moms and dads and really my encouragement to you, whatever your age is, is that we've got to preserve that passion for God's presence above all else. And number two, when you pray, he will come. When you pray, he will respond, he will reply and he's so faithful to do that. This has been such a joy, I just appreciate your enthusiasm and your zeal for the Holy Spirit. It is truly contagious. Thank you for all that you do for the kingdom of God as you've been sharing this word of revival across the world and all that you do for Destiny Images, like dear ministry partners of ours and we're just so thankful for you and the mandate that you're carrying. Well, thank you guys for honoring the prophetic, the move of the spirit and again, that's what fuels hope in people. People actually need to know it's possible for God to do that again for him to move like that and that does fuel hope big time. Absolutely. I can't wait to, I wanna, Amanda's gonna read a verse and I can't wait to get your reactions of the verse as well. Yes, it's a good one. This comes from Acts four, verse 31.  Oh, glory to God. I think it's so important that we hear that. Yeah, yeah. Do you want me to comment? Yes, please. I can comment. I wanna say this is that that was not just for the book of Acts days because there was a revival that happened in the late 40s called the Hebrides revival in this little area of islands off the coast of Scotland. God was breaking out and there was an area of the Hebrides islands that there was revival happening but this little area did not get touched yet by revival.  He said, God, you said you would pour out water on dry ground and in our territory, it is not happening. So Lord, I appeal to you right now as the covenant keeping God, you said this, it is not happening and we appeal that you would move because your very honor is at stake. Now, that's the kind of prayer when somebody prays that you back away because you're afraid the lightning might strike them because it almost sounds irreligious but I was reading that in the history books and I actually felt like the Lord said, oh, no, no, Larry, that is the highest form of the fear of God because that man knows me so intimately that he knows I am the God who keeps my promise and if I said I would pour out my rain, my water, my outpouring on dry ground, I will do it and it says in multiple accounts, after that man, lowly blacksmith prayed that prayer, the place where they met, that house was physically shaken. The power of God filled not only that prayer meeting but it filled that territory. What's that relevant to us today? We need to pray those types of prayers.  It's really speechless. It's really speechless. I have read some of that Hephradi's revival. I mean, it's just amazing what God wants to do. I mean, look, we're gonna end a program here in a little bit but God's not going away. God wants to move in your life. He wants to open that door right now, open it. Sidney, they just need to open the door in a special way to invite Christ in. You know, it's like you just said the open door and we've been saying this over and over and over again on the Hebrew calendar. It is the year of the open door. We are in 5784 and that 80 means pay. It means your mouth. It is time for you to open your mouth and agree with what God has spoken in your life. You know, at church yesterday, it was just so powerful. The man of God our house, he's a prophet house. He just started declaring like it's time for rain. He just said over and over and over again. It is time for rain and we're speaking that over you today that the rain of the spirit would fall afresh on your house. The rain of the spirit would fall afresh on your heart. The rain of the spirit would fall afresh on your family. And Father God, right now in the name of Jesus, I thank you, Father God, that your fire is igniting around homes across the country in Pittsburgh and Dallas and Orlando and Jacksonville and Atlanta. Wherever you're watching Montgomery, Alabama, this is what we're here for. We want you to experience the fire and the presence and the power of God. There's nothing else that matters. And if it wasn't for Jesus leaving, being resurrected, and then he's like, all right, I'm out, ascending. So we could receive the Holy Spirit. When the Holy Spirit enters your life, when you have an encounter with the Holy Spirit, everything changes and you're never the same. And that's what we want for you. Not a tingly feeling, not a tickle of yours. No, we want you to experience and come into a knowing relationship with the Holy Spirit. And we are so grateful that you've joined us on this very special program of Hope Today, just like Tom said. It's not ending over here, so after we go up the air, make sure you make an altar before the Lord and just pray and thank him for all that he's done for you. We love you. On tomorrow's Hope Today, discover the true value of what it means to honor God with your body. Author Catherine Pace Sauer shares how seeking a healthier lifestyle can lead to a more fulfilling life that better serves God and others. Don't miss tomorrow's Hope Today. Cornerstone Television wishes to thank all our faithful viewers, whose consistent prayers and financial support have made this program possible.


So thank you everyone for coming out. GitHub Actions is one of the most popular CI tools in use today, but if you need to or want to run it yourself, there's really not a lot of guidance to make and there's a whole lot of decisions you need to make. A lot of them have security implications. The most popular choice in Kubernetes is Actions Runner Controller, which is an open source community project for managing and scaling your runner agents. It's a controller. So it's not terribly difficult to think through the ideas of running your agents as pods, but you're running arbitrary shell commands. There's not a lot of security guidance on that. So hi, I'm Natalie. I'm a sticker engineer at GitHub. I work exclusively with our most regulated and security focused user communities, having led one myself for years. This is a really fun intersection of security, technology, and compliance. So let's talk about developer enablement, but doing it securely and scalably and in containers. So we're gonna talk a little bit about where we're headed. So first, we're gonna talk about why on earth would you ever do this? GitHub Actions has magic already done for you. Like why would you ever want to go down this really hard path? We're gonna talk a little bit about the Kubernetes cluster settings. We're gonna talk about GitHub settings and deployment scopes, and then a little bit about how multi-tenancy works with Actions Runner Controller. We're gonna end on looking at your runner images and then have a little bit of wrap up on conclusions. I am very sorry if you came in and expected me to tell you with this one file of YAML, you will be completely unhackable because that's not how any of this works. However, this is where I've seen problems, weird edge cases, and security not being considered as companies start to adopt this. And across the spectrum of maturity of container adoption, this is a really weird use case. But first off, I wanna just be very upfront with this. I have a bias throughout my career. I have continually confirmed this bias. And that's that friction. The force of resistance of movement between two parties is the leading cause of users, administrators, and developers doing insecure things. Eliminating any and all friction when any security concern is involved will inherently lead to proportionately fewer insecure things. To be clear, I am throwing no stones in this glass house because I have totally been that developer. There are extremely few network protections that creative use of SSH port forwarding can't bypass. And this is both worrying and extremely helpful to me over my career. So let's talk a little bit about GitHub Actions. We're not here to talk in-depth about it as such, but there's some things we should all know as we start to look at self-hosting this. It's our built-in automation platform. It's frequently used for CI CD, but it runs most of GitHub if we're being uncomfortably honest here. And the cool kind of thing about it is you have this great open source marketplace. There's 17,000 or some odd actions in that marketplace of reusable workflow bits. However, when a user on github.com just uses actions, you're actually getting a ton of engineering that's designed to be completely and totally invisible to you. You just say, hey, run on a Mac. And it does, or run on Ubuntu Latest. And it does magic for you. When you do this, though, you're getting an ephemeral virtual machine with a ton of stuff that's already preloaded for you. So much so that the Ubuntu Latest image clocks in at about 50 gigabytes. Works well for a VM with a little bit unwieldy for a container. And you can get an S-bomb. It's readily available for you. It's updated weekly. It's scaled. It's magic. It's SAS. We're not here to talk about that. We're here to talk about what happens when you bring that into your own network and run it on your own Kubernetes cluster. And that is completely free. Well, you don't pay GitHub for it. You pay your commodity cloud compute, your data center co-location, whatever compute cost you have. For that, we ship the runner agent. It's open source. There's the repository in the slides. The trade-off with this is that all of the security operations and all of the rest of the operations as well are on you, on your team. And this is an uneven and often unexpected burden for our security teams. And not everyone has the option of just using SAS. Here are some really common reasons that we see self-hosted runners. The first is GitHub Enterprise Server. If you self-host GitHub, you're self-hosting all the compute that goes around GitHub as well.  So we need a controller. This is where ActionsRunnerController comes in. It's an open source project. It started out as Summer Wins, ActionRunnerController, moved to the ActionsRunnerController organization. And now it is officially the auto-scaling solution for self-hosted runners within GitHub. It does ship some images for the runners. I'm sorry. But most users build their own. I'm gonna pause here in preface that there is a ton of work going on in this project right now. So this architecture diagram is what is currently in ActionsRunnerController, as well as the current CRDs in here. Like I said, the exact CRDs and the implementation of this is about to change. The additional work will provide better scaling as a supported path. And here's a high-level overview that'll age a little bit better than milk or this diagram. Auto-scaling is pull-driven over APIs. In the current implementation, that's a very short pull length. The newer implementation will have a longer pull link on new APIs. And you can see an overview of the new CRDs, the architecture diagram, all of that good stuff in the documentation in that repository. We are collaborating completely in the open for this. In any case, users are responsible for all of the infrastructure security on this. And this leads to some really unique security challenges. The first I wanna really emphasize is that GitHub has 100 million developers, not counting all of the people that self-host. So it's really hard to provide opinionated guidance with an audience that wide. Very sorry. One of the key security challenges there is the user expectation of it just works. And it enables this weird anti-pattern where containers are used in very VM ways. Which does a couple of things, in addition to being kinda grossed out by 50 gigabyte container images, or five gigabyte container images for that matter. It increases both the true vulnerability area of your agents, and it also increases the noise from container scanners in your security tooling. So both of those things means it's really hard for the team to know where to invest their time. And then there's this continual tradeoff between caching for runtime speed versus just pulling your dependencies each and every time. That makes for some really big container images. And then the next really hard challenge is that there's some economic incentives that encourage poor security posture. Especially among smaller or less experienced teams. What I mean here is that running a build system in and of itself does not bring a company any money unless your business is in running CI systems. So there's just not a lot of reason to spend time doing this securely when you're only looking at the economics of this right up front. Because of this, I see quite a few installations with a handful of really common threat models. We'll talk a little bit more in depth about. The first is poorly scoped permissions or deployments. I have this thing where I'll screen share with somebody and I see them check all of the boxes for the API scopes. Please don't do that. The API scopes are there for a reason. Privileged pods, they are so much easier than writing things to be containerized properly. And expediency doesn't always help you here. Disabling or unsafely altering key security features. So disabling SE Linux comes up way, way more often than I'd like. Using latest to deploy images. Using latest is not continuous deployment.  Hard to debug, all of that good stuff, but it is hellishly hard to fill out an incident report when you're just deploying off of latest. So whatever you do, please, if you take nothing else, latest is literally the worst. Don't ever use it. Purge it from your vocabulary. And upstream repos or mirrors that are wildly out of date. After the whole left pad incident in 2016 and a whole bunch of other kind of related shenanigans, running your own internal everything repository became super popular and for great reason. Understanding the dependencies of your software in full is a fantastic way to increase the security posture of your code and your organization. However, it requires regular care and feeding and to not just harbor unsafe, well-known, exploitable vulnerabilities. And to understand why these challenges are really unique to actions in Kubernetes, let's take a tiny detour into what GitHub Actions really are. Like I said earlier, there's about 17,000 of those actions in the marketplace and when you just use GitHub and just use our hosted runners, things work for you. You don't actually have to look and think too in depth about what's going on in that action if you don't want to. This is the first point of, this gets tricky and weird in Kubernetes. So under the cover, a GitHub Action can be one of three things. It can be JavaScript, which has to be purely JavaScript. Node 16, don't use Node 12, it's gonna go away. And it can't rely on other binaries. Composites are what you think of when you think of a traditional CI reusable pipeline. It's a bit of a catch-all category. You can run arbitrary scripts in line, directly you can call binaries on the host, you can chain multiple other actions together. And then lastly is a Docker container. It builds a container on each and every run. It executes the container inputs and outputs defined in a YAML file. You put stuff in, magically stuff comes out. And the last thing I'll note is that Podman is not a drop-in replacement. This looks kind of like serverless if you really squint and look at it from far away. But this means really that as we're modeling threats and trying to figure out a more enterprise-y policy, internally, there's a lot more stuff you need to be aware of. Because that means there's three types of security concerns. And there's two points I'd like to highlight here for JavaScript. The first is that it likely relies on dependencies and NPM. Again, most likely this is covered by your company's internal everything repository. So we need to make sure that the repositories configured to be used on the runner image and every other container in that pod. And because the runner pods are ephemeral, that means that you're gonna be pulling and hitting that mirror quite a bit. And then the next is the possibility of script injections from your users. So two things to consider here are the trustworthiness of the action that's in use. Straightforward problem, but totally out of scope for today. And that your users can pass arbitrary input into a GitHub action. So sometimes silly, sometimes malicious, I like to think of silly a little bit more. And this is a decent way to try and escape your container or otherwise partake in security shenanigans. Script injection also a concern for composites where you can run inline scripts, call arbitrary binaries. Do you allow users to use pseudo? And the more VM like GitHub actions, you can alter your environment at runtime. It's not really all that safe to do in a container. Same for granting privileged access installing software, messing with mounts. This can get really dangerous really quickly, especially when you're adding privileged pods. And then for containers, you kind of have all the regular image provenance concerns, what's going on in that build, all that good stuff. And I kind of saved the best for last year. Docker and Docker requires privileged pods. But most importantly, you're not just allowing privileged execution of random user input, right? Right, no one does this, right? Because that's the next thing and the first thing that I really like to talk to when people are wanting to build their own in-house implementation of actions on-prem is do you really trust your neighbors? And who are your neighbors? So zero trust is not a default vanilla setting, click one button, you have zero trust in Kubernetes. It's possible, it requires skilled work and upkeep to pull off. Namespaces do a pretty good job of providing resource quotas, sharing secrets, setting policies, all that good stuff. But the team that's running this will need to have access to that and it becomes really tedious to manage at scale, going back to security and friction. And then the opposite direction that you can take also has problems. Cluster sprawl is a thing. You're adding an extra infrastructure to inventory, to secure, to patch, to maintain, to stream into your scene, all of that good stuff. There's no right answer to this balance. I just want you to think through the risks of multi-tenancy versus managing lots of single tenant clusters. And I found all the privileged pods. So when I was learning Kubernetes a few years ago, there was this moment in reviewing all of the documentation and the security stuff and I'm like, well duh, of course you don't run stuff as root. Duh, didn't we already solve this with the SElytics and App Armor and the other fun like mandatory access control things that we built into the kernel to do this? It turns out all of the privileged pods are running various continuous integration systems in Kubernetes. It's basically the only place I see privileged pods. And I'm not here to tell you it effectively removes all the fun process protection because we all know that. And I'm not gonna tell you thou shalt never use privileged pods because you have compliance frameworks for that. It just never seems that it was a risk deliberately thought through and chosen when I say hey, did you mean to run this as privileged? And it doesn't have to be this way. So no talk about this is complete without the big yicky gross thing in the room which is Docker and Docker. And it is super, super risky. It provides the most SAS like experience though. And when we look through this, users want this for two reasons either they're building containers directly or they're using Docker actions. But there are some alternatives and some compensating controls to think through that might work a little bit better for you. The first is don't use Docker containers for GitHub actions which is easier said than done. Using VMs for working with containers. I'm not here at cloud native security con to talk about reverting to virtual machines but don't throw it off the table immediately. My small contribution to this space is a root loosen pseudo list Docker and Docker pod but it is still privileged. We're gonna talk a little bit about Cata containers and Firecracker. We're talking about runners with Kubernetes jobs and then container builders. So there's some worthwhile work. There's some hard things to do. And there's some easier things to do. So for rootless, it really is rootless. It provides some coverage by removing the user's ability to run arbitrary stuff as root. So you can see here that we're trying to mount something and we're gonna know and we tried pseudo and pseudo's not here and we can't SU into root. But Docker run hello world still works. However, there's some significant trade-offs in this approach. So on the upside, again, we're preventing a lot of that user silliness. And there's still a shell though and some common utilities that I would consider risky in this context. Things like curl or W get that are available in the pod because that pod was going to want to run a GitHub action which might curl down something or it might ask, we're like, hey, am I gonna install NPM packages? And it makes a runner image that generally just works for both Docker actions and for building containers more generally. But it's still privileged for all the same reasons that regular rootful nested containerization needs a privileged access. Next, there's no elevated access inside the container, but yeah, any software configuration changes, any of that will need to happen before runtime. In this type of situation, you cannot say, hey, yum update or apt-get install the thing I need to build my software. And this means that users need to use this only for working with containers and or rebuild that image to have more software. And then at the very bottom of this slide, I have an example Docker file that you can look at for this. And it's normally at this point in that architecture review where someone in the room says, just use Firecracker, it works for AWS. Or any other of the make Kubernetes orchestrate virtual machines technology. And I am not here to dismiss it at all. It's a solid idea. VMs are much, much more isolated both from each other and from the host than containers are. However, here's where I've seen teams going down this route have a difficult and insecure time. The first obstacle is a little bit industry specific for me. There's not many managed providers in this space, doubly so if you need specific compliance certifications like, say, FedRAMP. This means that the team is likely running their own cluster on existing and authorized bare metal or VM infrastructure. This is not a problem. This just adds cost and complexity that maybe isn't always immediately obvious. And it increases how much more of the platform security again is on your team. The next thing that the team faces is all of the paper cuts that you encounter because Kubernetes expects to manage containers and the petty hill I will die on is that containers are not VMs. The most common ways in addressing these paper cuts ultimately undermine the isolation that drives this architecture decision to begin with. So the first thing I like to talk through is shared files and mounts. Well, many workloads rely on secrets, config maps, service account credentials, all of the things that are normally shared as mounts. Sharing a mount in a VM is significantly more difficult. And while Firecracker container deep has a CNI compatible network plugin and it's super, super cool, not every pod as a VM technology has this. So keeping your isolation boundaries intact can be a little difficult. And then insecure things on the administration side are still quite possible. The first thing I see normally with teams going down this route is disabling or unsafely altering set comp. You can also drastically over-subscribe your physical resources. You can bridge networking between your pod VM thing and your host. So you're not as isolated as you're really wanting to be. And then lastly and most shockingly to everyone is if you do insecure things on a VM, it's still insecure. And what I mean here is disabling SSL verification, which is my personal pet peeve. Messing with your software repositories, downloading non-managed dependencies, piping stuff to a privileged shell. But more importantly, this is the foundation of your company's software supply chain, the way that you're building your software.  And lastly, I'm gonna call out that this is a fantastically documented project and they ship improvements super duper fast, which is amazing and also sometimes difficult for some enterprise teams to truly keep up with. Not a bad idea, actually a pretty good idea. Just lots of time, money, and smarts go into pulling it off. However, just like in this picture, there is a lovely paved path that does not require docker and docker. We call it runner with Kubernetes jobs. It's a little longer upfront to use it, so instead of cutting that corner through the muddy path, you're actually kind of staying on the paved path and keeping things clean. It uses hooks, so see the link in the slide, and a service account to un-nest docker and docker and shove that into its own non-privileged pod that's running in the same namespace. There are some trade-offs here though. The first is that docker actions don't work as is. So if you want a docker action, what I normally see people end up doing is building that docker container, keeping that in an internal registry and using it as a composite action to docker run with all of the inputs and then capture all of the outputs. And container builds will still need something like Conoco. But most importantly, just use things for what they're meant for, and docker and docker is not what it was meant for. So avoid privileged pods, friends don't let friends privilege, and we're all friends here. Segregate your workloads that need privileged access. I can't tell you that you'll never, ever, ever run into a legitimate business case for a privileged pod. But when you do, maybe put them in quarantine. The runner with Kubernetes jobs is super duper cool and you should use it. If you absolutely positively have to run docker and docker and maybe it's sometimes okay, that rootless and pseudo-list is probably a good way to go. And then multi-tenancy, especially poorly thought out multi-tenancy, can be quite hazardous. And it can come at the expense of security. So let's talk a little bit about the ins and outs of how multi-tenancy is an arc. So security is going to dictate where the right group to place your runners on the image is. You can be as broad as you would like and as narrow as you need. And runners can exist at the repository level, the organization level, or the enterprise level. But fundamentally, every machine that can access GitHub on TCP port 443 can be a runner. And this is both absolutely fantastic and it means you might need to think through your security boundary a little bit. For the controller authorization, there's two authentication methods. There's GitHub apps, which you should always use. They provide you granular control, they have higher API rate limits. However, in this case, again going back to kind of like old actions runner controller or present and the very near future state, this is only available for repositories and organizations. If you want enterprise runners, you're using a personal access token with a enterprise admin scope. So it is a narrow subset of the enterprise permissions. However, it is still an enterprise administrator.  Please don't ever just check all the boxes. You only need one in this case. And it's the only authentication method for enterprise deployments. Apart from that, there's no difference on functionality for actions runner controller. The reason I really wanna spend a little bit of time on this is being a community project, it did what was reasonably expedient and easy. The authentication is stored as a secret in the namespace in the controller. So it's normally actions runner system. And it's passed to the pod to register it as a runner. So please do not give that token or that GitHub app more than it needs. And I would like to highlight, this is changing to just-in-time authentication very soon. And lastly, this is not the token that GitHub actions uses at runtime. That is already a just-in-time generated token. So in practice, this is what multi-tenancy tends to look like. You have a shared cluster and a shared actions runner controller can manage all of these deployments. And our cluster is going to control our hardware management, ingress, egress, log forwarding, all of the good fun cluster wide things. Our namespaces are gonna set resource quotas, pod admissions controllers, security policies, network, all of the good fun stuff there. And then our deployments are gonna control the scope. So who can use it? The image to use, vertical horizontal scaling, and shared mounts. And then you can always have room to grow. And then for recommendations, the wider you go on the scope, please default to safe and allow and govern your narrow deployments as needed. Having been in this administrative enablement position in a very regulated environment, I promise you that picture is absolutely accurate. When someone says, I really, really need root access to something. And then empowerment in this situation comes in the form of no, and here's how I'm going to help you do this safer. So let's talk a little bit about that runner image. A typical runner, like I said, most users build their own, is based on a broad OS tag. This is actually not that bad. The base software is updated for you beforehand. So you don't have to bloat your image up, running apt update or yum update, and then trying to run your apt clear cache or clearing the yum cache out. Again, this is kind of a weird use of containers. Big, big, giant red flag if there's no user account setup in that Docker file. Friends don't let friends run as root. You're going to set up the runner agency and all of the dependencies, copy in some shims, and then sometimes you're going to include in a knit process dependencies that your users expect, cached tools, cached dependencies, all of that good stuff. I see there were a couple of people that kind of went, ugh, when I said they're putting in a knit system in a container, and I know that is a controversial opinion. However, keep in mind that in a knit system is actually kind of good in this use case because your runner agent is already a process. So any process that it's going to kick off as well, you're going to have multiple things in that container. So it's very, very common to have an a knit process in these. And yeah, this is starting to sound a little bit like a VM, isn't it? Here are some examples to get you started. So Actions Runner Controller currently builds three runner images all based on Ubuntu. Most people will either use them as is or build their own internally. So there's a runner without Docker, there's a Docker and Docker runner, and then there's the rootless and pseudo list Docker and Docker. And at the very bottom, there is a link with tons of other community projects where people have built their own images. You may have forgotten in building your own image. Your in-house repositories need to be configured for all the things that you're using. And they need to be up to date or at least reasonably up to date. And then if you have self-signed SSL certificates or intermediaries, your custom root CAs, whatever you're doing, if you're messing with SSL, just keep in mind that the number of developers who notice your SSL interception, let's call that X, increases the number of the jobs that bypass or disable SSL verification by like 10 X. As long as it's easier for somebody to look at Stack Overflow and say, oh, well there's this magic flag, tack K, that I can just put onto curl and my job will work again and I can continue to do my job. Not thinking that that's the flag that disables SSL verification. Lastly, your logging is easy to overlook. There's the super easy button, so let's talk about a little bit while I'm logging on what do you wanna know. There's built-in audit log streaming and that captures the things that were done, get events, package publishing, creating and editing pull requests. Super easy, hit the button, stream it to your same, you're done. A little less easy are the actions run logs, so the console output from each run. There's an API to interact with these and you set the retention policy for it. However, for actions runner controller, both the manager and all of the pods, that's gonna piggyback off of your Kubernetes settings, so make sure that you don't overlook that. And lastly, this is a quick screen grab of the default logging agent where it's just catting some stuff out to the terminal more for debug than anything else. Sharing your amounts is not caring. So here's why you see this a lot in this use case. Enter an outer docker, don't share a build cache. Your setup languages, so if you're using actions setup Python, it's gonna expect a bunch of stuff there, the thing you're asking it to set up and if it's not there, it's gonna reach out, it's gonna install it, all that good stuff, adds runtime, adds network ingress and egress. So sharing mounts is very popular there. Your IO intensive builds can get super fast disks and really at the end of the day though, rate limiting is very expensive. I had accidentally rate limited a very large company running docker pull for the next like six hours, no one could do any docker images, it was not a fun day. And your shared mounts more importantly, aren't always version controlled and then there's always that risk of accidental data persistence at the intersection of privileged pods and writing data to a disk. So think that through if you're wanting to go down that path. And then roughly speaking, a pipeline to manage your runners is gonna contain, build it, scan it, espom it, sign it, tag it, test it, ship it. GitHub actions is super modular, so swap in what's in place for scanning, signing, tagging, deploying, all that good stuff. I do wanna talk a little bit about building and tagging, just cause these are both kind of interesting in this use case, because keeping your docker files for these containers, the deployment YAML and any other files that you're adding in and a shared inner source repository is having a remarkable powerful bottom up influence in the most regulated environments. A Git repo of course is a history of who requested review to prove what changes and when, but more importantly, my project needs whatever framework and this other team already has this image. My build is failing on image tag. Here's a PR with tests to prevent this moving forward. Show me all of the images that are vulnerable to the CVE du jour. In GitHub, this is really, really simple. You search the CVE and then you search whatever tool would generate that. And then for tagging by semantic version and date is this one weird case that I've ever seen anyone tag this way, but I've seen a couple of users kind of organically do this and it seems to work well. They bump the semantic version for software changes and the date for routine rebuilds. And just like I said, if you take nothing else from this, never use latest. Balance your permissions by your scope. The user should be able to ask, like, hey, I need to change my runner. I would like a new image. I need a network exception for something. And by the scope that they're asking it for, I'm very fond of pushing this process through a pull request. That way I know which user requested it, who reviewed it, and you can always add multiple reviewers to a pull request. Everyone is a stakeholder and more importantly, in a large company, everyone has an SLO to meet here. No one should have to wait too long. The biggest risk in this foundation of your software supply chain isn't that user asking to include a small utility or to have privileged access to their one build. It's that user getting frustrated waiting, having that process heavy IT service management ticket to nowhere and having to wait another month after that for the next change management window. Just so they get frustrated, they give up. They configure their own build server. They disable SSL certificate verification. They copy in their own bootlegged version of this utility that's never gonna get updated again because no one knows it's there. Just to get things done and move on with their job. Reducing your friction makes everyone happier and safer. We're all grownups. Grownups don't ask for random things. Not without a reason. Be thoughtful and take care of your team. They'll take care of you. Questions? I think, I don't know what time we're at. I think we're right at time. I don't rightly know. So the question, sorry, because I don't think anyone could hear that was about the future of Docker actions within actions runner controller. And the answer is I don't know if there's anything to make that easier. Right now using the container hooks is the recommended solution. So the question is, does actions runner controller issue JITs? So no. However, what you're asking about for like, does that pod have a just in time token to clone a repository or publish to GitHub packages or something like that? That's actually controlled by GitHub, either github.com or enterprise server. So the authentication there is generated by the actions side of things, not actions runner controller. The token that actions runner controller uses is something that you give it. And it is a long lived credential right now that is changing to just in time access as well. However, that is not the current state of the project. And if you go to the repo, you can actually see where we're adding just in time access support and all of that good stuff now. I think we might have time for one more question if there's one. The question, sorry, just repeating it for the yeah, is about logging in GitHub actions. So as far as like having the actions runner controller stuff piggyback off of GitHub settings, I don't know. I would encourage you to open that as an issue in the actions runner controller repo because I like the idea. I think the hard part is, if we look at this slide, these things all generate logs from a different source. So the audit logs from GitHub come from enterprise server or github.com. The actions run logs are generated by the runner and then are sent to GitHub to say like, hey, we passed, we failed, here's how you view it in that nice pretty window. But I don't know about the future of actions runner controller logging. All right, any more questions? I will be floating around and hear the whole event. So always happy.


They say it all started with a big bang, and white noise on an old TV set helps to show that. That white noise reaches us in the same way that the heat causing global warming does. This heat comes from the greenhouse effect. Now what do the big bang and the greenhouse effect have in common? We'll talk about the link a little bit later, but let's just start with the greenhouse effect. The greenhouse effect is measured every day by instruments like these. And if we look at our nearest neighbor, we can see just what it's capable of. Venus has big, thick clouds so that less sunlight reaches its surface than reaches ours. But its atmosphere is about 95% carbon dioxide. This causes a super-powered greenhouse effect. At the surface, it's hot enough to melt lead. Now how can a simple gas like carbon dioxide be so powerful? The greenhouse effect works like this. We see the sun on a clear day because the gases in our sky are transparent. The sun's rays get to Earth's surface and they warm us up because light is a form of heat. This heat has to go somewhere or we just get hotter and hotter. Earth glows with infrared, a form of light that's invisible to the human eye. Greenhouse gases let through visible light from the sun, but they absorb the infrared from the Earth. They slow down its escape and they keep Earth warmer. We know how to slow down the escape of heat to keep ourselves warmer. It's called a blanket. Even though the blanket itself doesn't give off heat, we still put one on to keep warm. Now the infrared heat given off by Earth is invisible to the human eye. But we can see it with this infrared camera. Let's look at an example with a cup of cold water and a cup of hot water. If we look at them, we can't tell which one is hot. But the camera shows that hot water glows more brightly in the infrared than cold water. A similar thing happens in the atmosphere. Greenhouse gases are special, not just because they absorb infrared, but they also glow in the infrared. The glow from the Earth's surface goes upwards. Greenhouse gases absorb some of this heat and then they glow in every direction, including down towards us. This recycled heat is how the greenhouse effect warms us. We measure it every day here at the University of Reading Atmospheric Observatory. And this is a pergeometer. It has a special window that only allows infrared light through to be measured. Even during a cloudless night, it measures a constant warming greenhouse glow. Even though the greenhouse effect is an observed fact, there is a myth that claims it doesn't exist. This myth misinterprets a law of physics called the second law of thermodynamics. The second law says that even though heat moves in all directions, overall heat moves from hot to cold and not from cold to hot. The myth says that the greenhouse effect doesn't exist because it means heat going from the cooler sky to the warmer surface. But this is a misrepresentation. The greenhouse effect obeys the law. A square meter of Earth's surface sends about 500 watts upwards. So it works like a 500 watt heater. The greenhouse effect sends down about 330 watts of heat. So in total, 170 watts goes from the warmer surface to the cooler sky. Heat overall goes from hot to cold, but the greenhouse effect sends some back to warm us up. The myth misrepresents the second law of thermodynamics. Meanwhile, observatories measure the greenhouse effect every day all over the world. We know it's there. And this is where the Big Bang and Static on an old TV come in. Outer space is very cold. It's about 270 degrees Celsius below freezing. But a tiny part of the static on that TV screen is the remains of electronic noise from the Big Bang. This noise contains energy, so it is heat. And despite being unbelievably cold, some heat has flowed from the frigid outer space to a barmy living room. Now Earth sends a lot more heat into space than the other way round, so thermodynamics is safe. And even though we can't see it, we live under the faint glow of the Big Bang and the much brighter glow of the greenhouse effect. This keeps us much warmer than we'd otherwise be.