Welcome everyone and thanks for joining us today. We are Hector and myself, Edgar Pardo. And today we are going to present and share our journey with Kubernetes cluster, managing them at scale and particularly focusing on Kubernetes networking on dosage clusters. So both of us are platform engineers working for Roche. So first, a bit of presentation about Roche for those of you who doesn't know Roche yet. It's a pharma company with more than 100,000 employees across the world which has two big divisions, Diagnostics, which is the division that takes care of building the instruments that takes blood analysis and any kind of test on the laboratories and the devices that interact with those instruments for running process data, running software on top and process like kind of algorithm for processing that data. And then there is the second division which is the pharma one that develops the medicines that treats the patients. So how was working in the past like Roche given that is present in thousands of laboratories across the world which apart from having those instruments has the devices that interacts with those instruments. Every time that they needed to like they had the need of deploying a new algorithm or software to interact with those instruments like for that blood analysis like given that they need to process that data and apply some data sets. They were assigning a team for that and that team had to brought its own device to the laboratory. This means like another device and on top of that developed that algorithm. And then potentially if needed they were building their own solution of logging as well monitoring and whatever need that the business were requiring. Then the problem was that we ended up having like those kinds of devices on the laboratory to interact with those instruments making it super hard to automate stuff and like every device had different libraries different languages and for people with our role that wanted to automate everything it was kind of an nightmare. So then this is where our team came in to going to the second approach where we have like single platform, single device where all software development teams inside ROS can deploy its software making it like single way like a single approach for deploying and like maintaining a single platform. So basically we are like internal platform inside ROS that our goal is to be present on all the places that ROS has instruments and devices that is laboratories, hospital, doctor offices and so on and basically managing clusters at the scale on the edge. But managing those clusters at the edge comes with many challenges because as you can imagine the storage solution there backup and especially networking like comes with a lot of challenges when you don't own the network given that those clusters the laboratories doesn't belong to ROS we are just inside a private network that we do not manage plus we don't manage the firewall so it comes like everything is handed or uploaded to the customer and yes so on the other hand we need to connect to many external services because those edge clusters are not air gap so they need to interact with a container like sorry a cluster that we have like a regional cluster that we have Covernance One deployed on cloud provider AWS and for China AliCloud and there is where we deployed our internal API to interact with those clusters GitOps repositories from there the clusters are pulling all the configuration and also like container registry for pulling images and so on so those clusters need to connect to many external services and as you can imagine given that we were not managing the firewall this ended up like every time we had to deploy a new cluster on a laboratory on the field we needed to ask for another ingress rule like ingress rule for allowing traffic and so on and again it was becoming a nightmare to handle all of that and so we ended up like reserving a static range inside ROS for like for exposing all our requirements or all our external services and we were leveraging Cloudflare for that so that we could leverage every CDN feature like web application firewall rate limiting and so on so on the layout you can see that whatever it's not matching our range static range was not allowed by by the firewall and then dropped and then if it was matching our static IP range then we were allowed to connect to the regional clusters but this was not covering all the use cases because the software development teams had for instance like needed for connecting to a webcook for alerting like sending data reports to SAS platform and so on and even like connecting any cloud service that we do not own right on AWS we do not own the range so for that we were not covering all the use cases so yet we had like limited support for that and again so if we go back to the scenario where we needed to ask every customer on every firewall to get a new rule given the amount of clusters we are managing this was not scaling again so this is our legacy solution we built for that and so some of the services the ones that had like a common scenario we were proxifying them through Cloudflare kind of a reverse proxy as Cloudflare was allowing us to do it but some of the services that like the software development teams had were working like on layer 4, TCP, UDP and we were not able to support them because Cloudflare doesn't support them through that proxifying feature and there were also like additional applications that needed to do some modification of the headers on fly before forwarding it to external services and again this was not covered by Cloudflare and so we ended up placing a second reverse proxy on our regional governance cluster there we were doing the header modification and then forwarding it with the request but again this came with many manual stuff to do because every time there was a new scenario or request coming from the teams as they needed to connect to another external services we needed to study that case and check if it was supported by our external Cloudflare or of loading it to our regional reverse proxy and coming with many manualities so then we ended up like contacting with Cilium guys and again thank you so Cilium was becoming the de facto networking solution for Kubernetes by that time so we approached them and explained them our problem and they came with a very interesting idea so what if you could manage your network traffic declaratively with network policies not only to secure the traffic but also to forward that specific traffic that you need to approach it that you can configure in many ways like for example creating a web socket tunnel to a backend where you already have access to from your edges and encapsulating the original request inside that so it looked very interesting to us so yeah we started at PUC with Cilium and we are here today giving this talk so yeah it went pretty well but let's step back for a moment and revisit what is Cilium service mesh for the people that is less familiar with it Cilium service mesh is pretty simple a set of features that allows to do advanced networking stuff EVPF is a framework well it relies heavily on EVPF and EVPF is a framework that allows to load and run progress in a secure and dynamic way into the Linux kernel so basically it's extending the Linux kernel on the way and for our solution we are using basically two features from Cilium service mesh, Cilium network policies and Cilium envoy configs what are Cilium network policies so they are basically Kubernetes network policies on asteroids they work not only at layer 3 and layer 4 but also at layer 7 and this means that you can filter traffic not only by IP and port for example you could potentially block an HTTP request that is missing some HTTP headers for example what happens is that when you create a Cilium network policy Cilium is configuring EVPF program for that particular port, name, space or cluster depending how you configure the network policy and when traffic is coming from the user space then this EVPF program is executing the logic of the policy so for example if you wanted to allow the traffic then it will forward or redirect the traffic to the Linux networking stack if you wanted to deny it it will just block it and if you want to redirect it to an envoy proxy then it will do that and we will come back to that in a moment because this is one of the new features Cilium envoy configs first of all Cilium runs one unique envoy proxy instance per Kubernetes cluster node so this means that there are no psycars and what happens is that when you create a Cilium envoy config it creates basically an envoy listener in this particular envoy proxy instance an envoy listener also called CiliumServiceMess let's say that can carry individual configurations and operate independently in this instance put it very simple envoy listeners have to envoy as C groups and MSpaces are to Linux and yeah they have basically these two CRDs, the namespace resource and the Cilium cluster envoy config that is applied to the whole cluster coming back to our new solution the thing was that CiliumServiceMess was already just jet by that time so ISOvalent has to develop new features to make it happen and being able to use this WebSocket tunneling feature the first feature was to enrich Cilium network policies with the capabilities of redirecting traffic that the traffic that you want and you define in the network policy to an envoy listener that is defined in a Cilium envoy config and then additionally it was needed to create a couple of envoy filters for doing the WebSocket tunneling functionality so one it was the WebSocket client which we use in our edge clusters this one is in charge of establishing the WebSocket and encapsulating the original request inside it and then the other one was the WebSocket server that we run in our regional clusters and this is doing the WebSocket termination and then encapsulation of the request these are our use cases that we have today so the first one is the edge to cloud connectivity here is where we have an edge cluster in customer premises and they have a firewall as Edgar was mentioning before that is only allowing traffic to our set of ROS IPs that we have exposed in Cloudflare so for this particular case we will use the WebSocket encapsulation tunnel then we have a customer proxy scenario is kind of similar but then the customer doesn't have a firewall that is blocking the traffic but in fact they have a forward proxy out of some regulations and they require that all the traffic that is leaving the customer premises has to be forwarded to that proxy and then we have another scenario which is much more complex we will not go through it today but if you are curious about that we can talk after the talk so use case number one edge to cloud connectivity so let's say that we have an application running in a pod into a specific namespace and we want to reach an S3 bucket the edge cluster is behind the firewall and it is blocking this access by default so yeah the traffic will not go so for this scenario we are leveraging the ceiling service mesh to use the WebSocket tunneling feature how it looks like so this is mainly how it looks like so let's go side by side so first on the right side you can see that we need to run the WebSocket tunneling the WebSocket termination in a place so we are running this WebSocket termination and we proxy in our regional EKJS clusters in Amazon and we are exposing it through Cloudflare in our Rosh Bringer on IP range because the edge cluster has access to this range already we are enforcing MPLS and again if you want to see in detail how we are enforcing it then after the talk we can talk about that and then on the left side for the edge cluster what we have is first of all a ceiling cluster-wide MBOY config there we are loading the WebSocket client filter that is doing the WebSocket encapsulation we are injecting the MTLS client certificate so that Cloudflare can verify and allow the traffic and then finally in the name space of the pod running the application that needs to connect to S3 packet we have the ceiling network policy that is for this particular traffic redirecting the traffic to the ceiling MBOY config okay so this is the ceiling network policy let's go and see now in detail how it looks like so here what we are saying basically in this network policy is for A please for all that traffic that is going to amazonaws.com please don't send it to the Linux Network in a stack and instead send it to this MBOY listener that is running this a ceiling cluster-wide MBOY config then we have the ceiling MBOY config for those in the room that are not familiar with MBOY in MBOY you basically define MBOY listeners and MBOY clusters in the listeners is basically for the request that is coming you can apply many filters and then the cluster is where you define the upstream where you are sending the request to so here in the MBOY listener part of the ceiling cluster-wide MBOY config you can see that we are leveraging the WebSocket client MBOY filter developed by ISOvalent which is establishing the WebSocket and doing the encapsulation of the original request inside the tunnel and then in the MBOY cluster here we are injecting the MTLS client certificate for validation with Cloudflare and finally specifying the destination which is the WebSocket termination endpoint this so the MBOY config configuration corresponds to the WebSocket termination that we are running in our EKS regional clusters and here we are using as you can see the WebSocket server MBOY filter which is doing basically the WebSocket termination and an encapsulation of the original request so yeah finally we migrated to Cilion all our EKS clusters are running Cilion today and with that we increased the network performance we leveled up the network security and observability with Hubble which is a tool part of the Cilion family and at the very end we brought the firewall closer to our workloads to be able to manage this edge to cloud network traffic that we needed following github's approach in a secure way so now it's demo time Edgar will walk us through a quick demo about the scenario number 2 the customer proxy and you will see it in action thanks Hector so before starting I want to mention that we have prepared a repository which is publicly accessible with the whole demo that contains Makefile and a redmi with all the steps so you can follow it yourself and before starting with the CLI let me explain to you the setup that we have prepared which is covering the second scenario that Hector was explaining where there is no firewall but there is a forward proxy that the laboratory or the hospital requires that all the traffic goes through before leaving the customer premises so basically we have prepared on the left side an easy to instance where we are hosting like Covernance Cluster where the security groups are only allowing egress traffic to the second easy to instance which is like the one that has deployed this forward proxy which is just a docker container and the second machine is the one that has egress connectivity to the outside world like 0000 range then going back to the first easy to instance where we have the cluster we have prepared tune and spaces the first one like the test the night one doesn't have any kind of silo network policy neither silo member config and so whenever he tries to reach roge.com he will be dropper out because there is no egress connectivity to that address but then we have the second in space test alone where we will be configuring a silo network policy plus the silo member config where we are going to redirect the traffic to which will go over like through the proxy IP and then like reaching the internet after that so there we have like it's very small right so let me zoom do you see now ok so here is just we have prepared the cluster for the demo and there we have the tune and space that we have mentioned before the test alone and test the night one where on each of them we have prepared just a curl pod like test one that will allow just like to show you that whether or not there is connectivity to the outside world so that is like simple image and then at the moment there is no silo network policy deployed on the cluster and there is neither like silo member config so you will see so if we try like for that we have prepared a main file to make it easy to follow and quicker so if we try to reach the like roge.com so we receive a timeout like that command like the main command that we have prepared just checking into the pod and just testing like whether or not there is connectivity to roge.com and the same goes with the make test deny again this one will just drop out because there is no like in that one we don't even need to configure anything and now there is the second like third command that we have prepared where we will be applying the manifest yeah so now like the command is just connecting to the machine and just applying the silo member config plus the silo network policy that will allow us to reach the internet right so now if we run again the command yeah so now we receive like 200 HTTP code because of the policies right so let me explain a bit like how like the policy looks like yeah basically a sector was mentioning before on the silo network policy we are like creating this egress rule that says hey whatever matches roge.com please ok now fine so whatever matches roge.com please do not send it to the linux networking stat but please send it to the silo member config that we have prepared and then if we go to the silo member config that we have prepared again like Hector mentioned before for those of you who are not familiar with the silo member config files there you can configure listeners which is basically where you apply filters and then the cluster which is basically the upstream where you are sending the request to so in that case what we have prepared is listener that has the following TCP proxy mboy filter that it's the one that where we are config config and then because of that what we are doing is opening a tcp tunnel over HTTP connect and then like saying hey send the request to the original hostname and that is where we are saying ok send it to the cluster which is the upstream where we have like the following endpoint forward it to the following address and this IP is exactly the one that host so this is the IP of the proxy so the second ac2 instance where we are forwarding the traffic to and then if we run it again there we have the like we are connected to the other matching the ac2 where we are hosting the proxy and then I think this one it's as small as well so this is just I'm just docker log so tailing the logs to see it in life if we run again make test hello and go here we can see on the timestamp we are here on the message we are opening a HTTP connect request to the original destination which is the IP like of rush.com and that would be the demo so going back here this is the manifest that I have explained it before so nothing to mention here and so yeah one last thing and is isovalent release one new lab last week it's about layer 7 envoy proxy at pan features part of the of the features that we have demoed today are included in this lab and yeah I mean I know that isovalent has put a lot of love in this laboratory so yeah I really recommend you to do if you do it during this week here in the cubecon in their booth I think that you will get a golden batch sticker so very cool as well and with this this is everything we have for today thank you very much you can give feedback here and we will be around the whole week so if you want to yeah if you have any questions apart from the meeting today and so on just stop by say hello and it will be a pleasure to talk to you thank you and I think we have time for a few questions if people have questions in the room can you also connect the other way around from your systems towards to each node is there a tunnel in the other way so we have like kind of a reverse proxy deployed on the edge this is not has nothing to do with CNI but we have a reverse proxy deployed as an agent running on the edge clusters where we are opening a web socket connection like TCP forwarding for reaching the edge clusters as well so yeah we have an edge running on on the agents sorry we have an agent running on the edges to reach them in case of disaster or whatever we need to connect to them no normal VPN connection no no no so we are doing TCP forwarding so for this solution what we have is this other service that we need is part of our range of IPs that we have in Thoughtflare so already the edge cluster has access to that and to establish the reverse tunnel so it's deployed on our regional clusters same static range the connection is not opening from let's say from the regional cluster but the other way around so it's the edge which initiates the connectivity so that's why we are able to reach it Hi, thanks very much for the talk really interesting I'm curious about what's doing the translation or the wrapping the TCP traffic and web socket in both cases is that done by Envoy and then the cloud unwrapping it and is that the same for the tunnel that you just mentioned that goes the other way so for the first scenario that you have mentioned the filters that Cilium prepare for us are doing that translation and so on and the second one you mentioned do you mean the agent that is running on the edges? yeah the one that you used to send requests from you know centrally no so for this one it's a different agent that we have that has nothing to do with the Cilium CNI yeah so it's just TCP forwarding like opening the connectivity from the edge connecting to the agent that is running as well on the regional cluster like this one is listening and whenever the connectivity has started then there is kind of a tunnel from there we are like sending the traffic to but there is no encapsulation there thank you any other questions? yeah here in the first second row thank you great speech when you were terminating the TLS can you maybe just give some insights where you actually do the termination because it's not translated I guess so you mean for the enforcement of the TLS? so basically what we are using there is cloudflare access I don't know if you know but there what we do is well for creating the certificates and so on we have a root pqa a secret engine we have it in bold in one separate instance of bold and then for the regional clusters we run a dedicated bold instance also in the regional clusters so for each of them there we create a pqa intermediate basically and then with third manager into the DH clusters we connect to that to issue the client certificates basically these are renewed every seven days and then they are being injected into the Scylion Envoy configs when they are established in the web socket tunnel because this communication is then in cloudflare access we enforce the N TLS and we validate against the root CA that we have and then the traffic is being validated there historically it has been quite a manual work with certification do you use it as a manager or something like this well yeah we use our manager for issuing the certificates against the intermediate pqa and this certificate is stored in the Scylion secrets name and space and from there the Scylion Envoy config is fetching it and injecting it thank you very much we have time for one last question during the demo I believe I've seen some SSH connection is it a personal preference is it possible to fully configure it purely through manifests well yeah so the make file the command that we have there it's just for the demo right so we are connecting to the machine just to apply the manifest but yeah so it's just for the demo process but you have like K get nodes and stuff like that you had access to control panel why wouldn't you use just kubectl directly instead of SSH yeah it's just personal preference we would do that with a kubectl config directly okay thanks thank you very much


Hi, my name is Jackie Cretion. I'm an academic editor in the ops division and this is my square story. I've been here for a long time, just celebrated my nine-year anniversary, so I'm actually going to squeeze in two stories. The first one's relatively recent. As many of you probably know, I've been a TM in the editing division for several years, and although there was a lot that I loved about that role, I really just never stopped feeling the pull of the editing work itself. So in the spirit of trust and vulnerability, I shared that with my manager, and over a series of conversations, we came up with a plan to change my responsibilities to give me more in paper time. I'm so grateful to have had the opportunity not only to explore different paths and grow in different ways, but also the opportunity to take a non-traditional trajectory and pursue the things that I'm most passionate about. My second square story actually comes from before I was even a full-time employee, so probably 10 years ago. I just started out as a contract editor, and I was so excited about the position and really eager to do a good job. But as fate would have it, my second or third edit ever was also right around the time that my grandfather died, and I felt like a total jerk emailing in and asking for a deadline extension on like my third edit ever, but the response that I got was so kind and reassuring, and it just 100% reaffirmed all the good feelings that I had about the company. And although a lot has changed, obviously in the last 10 years, one thing that hasn't changed is the care and good faith that I think we all show each other, and that makes Research Square Company a truly special place to work, so thank you.


Throughout our history, the graduates of these institutions have led the way for our nation, through every adversity and challenge to our nation.  Midshipmen and cadets have taken it upon themselves to establish protocols, adjust activities, and demonstrate personal responsibility through action. You've assumed increased responsibilities for everyday operations, like feeding the brigade and corps, without placing the dedicated staff at risk. And you've transformed the way we communicate and operate through virtual means. Around the world and around the clock, we are a single force, uniting purpose with no daylight between us. Except today. Except today. Except today. Some things, even 2020, can't change. Go Army. Beat Navy. Go Navy. Beat Army.


Bonjour à tout le monde, qu'est-ce qu'on donne? Bonjour à notre conférencié aujourd'hui. Vous êtes le bienvenue. Merci d'être venu. Manuel Lafond-Rapnouy is going to address us this afternoon on an important subject really in Europe today, and that is globalization, which has been requested more and more, and indeed a good deal in France as you have seen and witnessed from the events there, but elsewhere that people have lost out. It has left people not able to manage and that something needs to be done and of course the argument is to retrench again but that's not acceptable in this world of course. And of course populism has and those parties who specialize in populism have benefited from the maximum. Manuel is very qualified. He is a senior fellow at the Paris office of the European Council on Foreign Relations and he's had an interesting career even though he's young in my books, an interesting career with a French diplomatic service and he was visiting fellow at the Centre for Strategic and International Studies, a Washington based think tank. So I would ask you to switch off your, I left this as a reminder to myself, to switch off your mobiles, reminder that the main part of the proceedings are on the record, but the question and answer session is chatter rules, in other words, off the record. So without further ado, we have about half an hour or so. Yes, thank you very much and I'm looking forward to the discussion. You will see that I will open much more doors than I will close, partly because they are quite difficult to close. So I'm looking forward to discussions and reactions. But first, if you made a bet on how long it will take before I mention President Trump, you've lost because I will start with a statement last September at the UN General Assembly, which actually was precisely an attack against globalism and that's the word he used. And it's not just the traditional issues that successive U.S. administrations have had with multilateralism. We all know that at least since the end of the Cold War, it's been a lack of multilateralism, as Richard has said in 2001, and that's very much the case for this administration, which has, for instance, in the first phase of its dealing with the proliferation crisis in North Korea as insisted on UN and UN Security Council Cooperation to put pressure both on North Korea and on China. So you have sometimes, most of the time, a policy which is multilateral when we can, unilateral when we must, which was Mademoiselle Wright's phrase. Actually, less often than it may happen, you have the reverse unilateral as soon as we can, multilateral only if we must, but I think that Trump is different from that. It's not just the issues that these specific administrations, the Trump administration has with the UN, and yet there are many issues. I will just remind you quickly of the fact that under Trump the U.S. withdrew from the Paris Agreement on Climate, from the Iran nuclear deal, decided that it will not sit anymore at the Human Rights Council, withdrew from the Universal Postal Union. You maybe didn't know about that specific organization, which is one of the oldest multilateral organizations, and quite important if you work in mail affairs. It withdrew from the list of funders from the UN Relief and Work Agency, which is the agency that works in support to Palestinian refugees, et cetera, et cetera. But the reproach from the statements were much broader and deeper than that, and what Trump said when he criticized and attacked globalism is that the major threat for the U.S. right now, the major threat as easy as it is a threat to U.S. sovereignty, and that threat comes from, quote, global governance, and, quote, again, new forms of coercion and domination that has to do with international institutions and international rules. So what is it that this means, and what is it that this means, especially for Europe, is something that I believe is very important for us to realize. And I think this approach is a possible problem for Europe for at least a free reason. To start with, it's a problem because of the importance of transatlantic relations, obviously. We have a problem when we diverge on substance, that's the case on kindness. We don't agree on the fact that there is a problem and we need to tackle it. There is a problem when we diverge on strategy and tactics. That's also an issue, for instance, on trade with China. I would argue that the U.S. and the EU basically share the same reproaches against the Chinese, that they have the same economic interests at stake, or at least very similar interests, and yet the Trump administration has decided to deal with this issue from outside the WTO framework, whereas the European preference would be to deal with it through the WTO framework. But that's even more of a problem when it leads to doubts on the nature of our relations, for instance, on security, obviously. Is NATO still a security alliance, meaning an alliance based on the idea that there's a commonality of security interests at stake? Or is it an organization based on the fact that there are burden-sharing and that the Europeans should pay for U.S. security guarantee? And obviously you don't believe the same way, you don't trust security guarantee the same way, when you think it's based on commonality of threat assessment and threat perception and commonality of security interests, or when it's based just on how much you pay to the common budget, or to your security-gallant budget. And obviously it's even worse when you have some degree of confrontation, and I think that's very much the case with Iran's secondary sanctions, where, for instance, on climate, the U.S. said we'll get out of the deal, but basically we agree to disagree. We go out of the deal and therefore we don't follow these rules and commitments that we see as constraints, but you do whatever you want to do, it's your problem, it will constrain you, we don't care about that, it would be the U.S. approach to that. On Iran it's not just that, it's not only we get out of the deal, but we don't want you to do what you should be doing within the framework of the deal. And therefore we'll take sanctions not just against Iran, but also against European actors who want to have economic relations with Iran, because we want you to align your foreign policy on ours. And that's a very coercive and quite different approach. So that's the first problem. The second problem for Europe with this approach from the U.S. administration of multilateral cooperation is because we know that what the U.S. is doing is very much a short-term strategy and that leaves intact quite a few problems. We just discussed with a few of you the fact that the U.S. attitude in the U.N. system is creating a vacuum and that these vacuums open the risk that the U.N. is handed over to China. It wasn't the case in 2002-2003 when there was the Iraq crisis that China was able to actually take advantage of U.S. policy. Certainly now China is in a much better position to actually exert and increase its influence in the U.N. system much more than it was 15 years ago and much more than it would be if the U.S. was still quite active and committed to the U.N. system. There's also the risk that non-cooperative policies usually make the problem bigger when the problem has to do with basically our non-zero sum game and have to do with global public goods. So migration, biodiversity, you name it, you have just this idea that non-cooperative policies kick the can further down the road but it's not just that it kicks it further down the road it's that in between the can gets bigger. And third risk, even from the U.S. perspective, you have the risk that your bilateral solution, your bilateral issues does not really serve all of your interests. If the U.S. is able to get a good bilateral deed on trade or on economy and financial relations in general with China, it leaves the problems of U.S. and China competition in other markets intact. What happens to U.S. and China competing in Sub-Saharan Africa, in Latin America, the rest of Asia and the Pacific and obviously in Europe? That's why you have a World Trade Organization and that's why before the WTO you add efforts to put in place multilateral framework for trade. And last, another problem for Europe which clearly is not the least has to do with the fact that the EU is based on cooperation and we are so much less at ease in an international environment than we are based on cooperation. It's not just that we have invested so much on multilateralism and then cooperative policies that we have more to lose than others from the undermining of cooperation and of these rules-based order but it's more than that. It's the fact that the EU is based on interdependence. It's built on the idea that not only is interdependence good but on top of it it will actually force us into more cooperation which also is good. And we realize that not only interdependence is not enough to force countries even within the EU into cooperation but actually interdependence may be asymmetric. And when it's asymmetric it can be leveraged by the sides which has the asymmetry in its favor. And that's what happens for instance in the relation between the EU and Turkey on migration. There's an asymmetry and the asymmetry can be played by Turkey in its favor. You have that on cyber, you have that on energy and you have that on economic and finance and that's the very basis for the power of US sanctions not just with smaller, less developed countries but also with the EU in spite of the size of its single market and the fact that it has a common currency etc. And we Europeans are faced with our very own challenges in this cooperation versus sovereignty topic. So let me go precisely into this idea of sovereignty and how the discussion about sovereignty plays in this context. One of the source of this fight against globalism policy is the idea that a rules-based order, a rules-based world order is providing false comfort at best and more likely is imposing illegitimate and or dangerous constraints on your foreign policy. That's one of the reasons why the US have withdrawn for instance from the INF Treaty. They don't like it because they think they're the good guys so that illegitimate to be constrained and it's dangerous because in the meantime China is developing its own intermediate nuclear capabilities which will have a big role in the strategic stability of the Asia and Pacific region. So it's not just that Russia is cheating with the treaty but it's also that on top of it you end up being the good guy and yet being cheated by your partner and being disadvantaged in another trade. But it's the same with WTO. It's not just that the US wants to have its own bilateral solution to the trade issues, the pending trade issues with China and deal with that bilaterally. But actually the US policy right now on WTO is to undermine the dispute settlement body. So there is a sense that this body which was seen when it was established as a progress is actually putting constraints on deals that the US would be able to get if it was a more kind of a pure rapport de force, pure balance of power issue. And I'm not going to mention the ICC which I'm sure everybody has in mind but I'm going to mention the Marrakesh pact on migration and the reason why I take that as another example is that unlike the ICC the Marrakesh pact on migration, compact on migration was interesting because there were also EU member states voting against it at the UN and there were a bit more EU member states not endorsing the compacts at the final ceremony. So you have this idea that this is about your sovereignty and preserving, safeguarding your sovereignty and I think that's the reason why it's mistaken is because if you only look at one side of the coin it's the idea that sovereignty is, and it is, obviously the authority to govern yourself. But that doesn't mean that it's unchecked power to act. The other side of the coin is that sovereignty is also the political and legal ability to interact with other states. So it's also about being politically and legally able to underwrite roles and to contribute to collective action. One of the key pillars of the idea of international order for sovereign states is the principle of the sovereign equality of states which means that there are boundaries to sovereignty if only because of other states' sovereignty. So you have this issue and this issue is all the more complex in a context where first sovereignty is, at least in democratic societies, also about people's control. And the issue being that it used to be that people's control of a foreign policy could be only remote because what was at stake democratically on foreign policy was less direct than many other public policies. The fact is this is not the case anymore. You deal with foreign policy that means you deal with trade, it means you deal with global pandemics, it means you deal with migration, you deal with refugees, you deal with terrorism, you deal with all these issues that people feel have a direct impact, not just on their lives in general but on their day-to-day lives. It's not the case anymore that trade is these kind of far and distant issues. It really changes whether your children will have a job tomorrow at the nearby factory or not. It's not just that it deals with big issues but deals with really what is going to happen to your neighbors, to your cousins, to your family, to your friends, to your children all the time. And this is something that you see populist movements much more aware than mainstream political parties. I have only a few examples you can find many others but you will remember I mentioned the Marrakech Compact on Migration, the Belgian government fell over the issue of endorsing that pact or not. And in Netherlands you had a referendum on Ukrainian association agreement. It really seems weird that people would actually sign a petition and ask for a referendum on this but it was the case. It had enough signatures, a referendum was held and it was negative. It was only consultative so the Dutch government could go ahead and it did so after asking its partners to clarify a few points. But this is something that we are not used to, I believe. So this issue certainly is something for us Europeans. It's not just a multilateral issue and I will now just quickly talk about European sovereignty. I know there is a problem with terminology. People say European sovereignty is a legal contradiction in terms. Some people say it's politically very inflameable. Let's not use these words. You can give the impression that you are going to deprive nations from their sovereignty. But on substance there is this different approach between people who have a more kind of purists or theological approach to sovereignty and those who have a more pragmatic approach to it. The key divide is how do you answer the question about is collective action the best option to weigh on world affairs and to be a rules maker and not a rules taker? And obviously the views that I call theologists would say yes that's all very good in theory but just it doesn't work and that's why we need to be able to stick to our own national sovereignty and I will address that in a minute. They don't answer the issue on how you weigh on world affairs and how you remain a rules maker not a rules taker if you go on the international stage just as an individual nation and how everyone can do that because that's the other difference. It's not just between pragmatism and more theological approach to it but it also has a difference between individual and collective approach. Collective action is the best tool to preserve people's sovereignty and equality. Obviously it makes sense that Trump has this kind of approach when he's motor or he's America first but all governments have to care for their country first that's for sure but first does it mean at the expense of others if you want to take into account the fact that precisely you need that the system works for everyone then you need to find a way to preserve people's sovereignty and equality and not just the idea that some people can be sovereign and the rest will have to be rules taker. Obviously this is not easy from inside there are many questions how do you organize that what do you do when there is difficulty to reach consensus that has to do with all the current discussion in Europe about viable geometry or differentiated integration how do you share the burden that's very much something that is discussed in NATO but that is also discussed in the EU but if you look at from the outside it's much more pressing that there is a need to work collectively so is there a way to do multilateralism without falling into this kind of globalist fitting this globalist or anti-globalist argument I think first we need to recognize that this is not only about the Trump administration that there were hints of this trend before Trump came to the White House but also because it's not just about the US more generally there is winning appetite for multilateral cooperation and that's including in the EU and outside of the EU it's not very hard to meet with doubts on how universalists the multilateral system is and that's the case both from the political perspective where people will say behind this kind of multilateral appearance actually this is Western hegemony but also culturally it's not just Western hegemony in terms of those who are in power but it's also Western hegemony in terms of your trend to impose your interpretation of what is the right norms etc for instance on free trade go to any Latin American embassies and they will tell you that you are free trade except on agriculture for instance and last one of the issue has to do with the ineffectiveness of multilateral policies that we need to recognize I think the multilateral system is at best good at crisis management not always so good but it's doing what it can it certainly is not that good at crisis prevention and at addressing long-term challenges and you mentioned globalization in the introduction and certainly the system has been quite unresponsive at addressing people's concerns with globalization especially on the economic front even if not on the economic front so what do we do in front of this there is a temptation because that's such a big challenge there is a temptation to confuse the defense of multilateralism with the defense of the status quo the idea that it's going to be very hard at least let's keep what we have already and I think this is not going to do it precisely because of these issues of how the system is not effective enough and not responsive enough of course it's of the utmost importance to keep the time of deal working to keep Iran in the Iran nuclear deal by dividing by its commitments to keep to find more funding for the UN when it's deprived of funding for instance on humanitarian affairs but there's a need for more reform there's a need for different policies on trade, on refugees, on climates that step up to the plate given what we know of the challenges and there's a need for institutional reforms we've mentioned WTO there clearly is a need for a reform of the dispute settlement mechanism the UN Security Council which is a good example of in some cases a deadlocked institution so the reform should not be just about membership it could be also about WTO the Bretton Woods Institution is another case it was striking how China moved to the Asian to create the Asian Infrastructure Investment Bank after the US Congress deprived China of the reform of the Bretton Woods governing bodies there's also a need to move towards more work with non-state actors this is something that for instance the French presidency of the G7 is insisting a lot in terms of a digital economy there are discussions on how to deal with digital platforms but on climate I think it's a very good other example where one way to counteract after the US withdrew from the Paris deal was to work with foundations local governments, big companies, unions from the US and therefore keep the US actors more or less on track even if the federal government was actually not willing to abide by its commitments under the Paris deal and that is my last point there is clearly a need to build a more democratic way to do foreign policy I think what happened with the Marrakesh Compact on Migration which was known by everyone to be negotiated for months and even years which ended up in a few weeks in the kind of total mess up that it was it's a good example that we need to deal with these issues quite differently not only at the multilateral level not only at the European level but also probably at the national level thank you


I'm Tom Harlow, I'm the owner and operator of Kestrel Farm here. We bought this farm this past year, it's about 90 acres, certified organic. We are growing vegetables on about 50 acres of it, the rest of it is fallow or past year. This is in Westminster, Vermont. It's wholesale, probably 85% of it. The other 15% is retailed through a farm stand that we are partners in with my brother, actually two brothers. This is a flame weeder that I used at Paul Harlow bought five or six years ago for about five to six thousand dollars. It runs on vapor rather than liquid. It was custom made in Germany to fit the four foot wide beds that we were planting at that time. We use it for raised beds for carrots and parsnips mainly. It's used in carrots and parsnips on a stale seed bed which gives us at least a 50% reduction in weeds that need to be hand pulled. We make a stale seed bed about a week or ten days later we roll the top of the bed then we plant.  It works really well on broadleaf weeds. It does next to nothing on perennial weeds or grasses. Okay, this is a vapor system has four of these 20 to 25 pound tanks that go in this reservoir of water. This tank is a reservoir filled with water which is heated by a small burner which keeps the water warm and keeps these tanks from freezing. Because we use the gas at such a high rate that these tanks would freeze up and gas is no longer available if it freezes up. There are shutoffs on each tank. There is a shutoff inside the control panel which shuts off the gas. There is an electronic shutoff for the burners and the pilot. Six burners across this four foot space producing, I don't know what kind of BTUs but very hot. In dry conditions I can travel at about six miles an hour doing a very good job. Early in the morning if the weeds are wet with dew, I usually shift down to about four miles per hour. The disadvantage to this machine is that it's set up for the four foot wide bed and it's not adjustable. The burners are all attached rigidly, they can't be turned off, they can't be adjusted to different angles. So we're stuck with this four foot wide width. Since this was made we've gone down to about a two foot wide bed which means that we're actually only using about half of the burners. Generally this uses about $32 worth of gas per acre which is $8 per tank which is what it costs us to fill these up. Under dry conditions we use a little less gas because we're traveling faster. In wet conditions we use a little more gas because we have to travel at a slower speed. This is a roller that comes from off the back of a field cultivator. The brackets have been cut off and we just mount it mid-mount underneath this tractor. It's ground driven, it rolls very freely. We use this in the initial preparation of a stale seed bed. Subsoiling first and then coming back with this roller to make a nice smooth and level seed bed. Then about a week or ten days later we come back and hit the beds with this roller to kill any small weeds that have germinated just before we plant. Another very important thing to remember about tilling your stale seed bed with this is that you don't want to go so deep that you're bringing up new weed seeds. So we try to go no more than two inches deep with this. We also travel very fast to get a good stirring of the soil.