My name is Reshan Bhatti and I'm a part of consulting services team based out in Germany. So we implement all these Red Hat Enterprise products at the customer side. And my colleague Moritz, he couldn't join today's session because he's implementing AP somewhere at the customer side. But his heart is in the session. And now I think let's begin with the agenda. So today I would really want to keep this session and the slides very interactive with you all. And at the end of the after this presentation, I would really like you all to go and play along with the demo which I've created for you. So you could install it on your local laptops or you could just pin up three VMs on any cloud and then install AP, play along with it. So today we'll be covering what exactly is an Ansible Automation Platform, some of the good practices and security implementation for your Ansible Automation Platform, as well as for the hosts which you are trying to automate. So we'll be covering both the things. And then of course configuration as code because code is important and you cannot do anything manually. I have prepared a small basic demo and I will try to show you some analytics around it. But before we move on to Ansible Automation Platform, are we all aware what exactly Ansible does? Yes, no, maybe? Perfect. So I would just say in our lives, automation is incorporated on a daily basis. Earlier we used to set up certain alarms and now we have Alexa. Earlier we used to wipe and mop our houses on our own. Now we have robots who are doing it. Similarly Ansible is an open source tool which would automate your entire infrastructure and your ideal departments. And Ansible Automation Platform, it's a box of goodies which comes along with a set of toolkit which helps you to automate multiple tasks and resources together in your infrastructure team. So the first part is let's say for example, what exactly would you want to do with the operations side? You would have a UI which would be provided by your automation controller and your automation hub which we are going to see later. But that contains your own execution environments, your collections, etc. To support that we would need the Ansible content creation. So how are you going to create your Ansible playbooks? We have certain Ansible content creation tools, Ansible build up, etc. From which you could create your execution environments, you could create your playbooks, test them, and whatnot. And finally, when you have all that in place, you would need to visualize what is running perfectly, what is failing, and you would need a beautiful analytical page to identify and to view all the tasks. So that's what is all provided by this AD platform. So now we are going to deep dive into some basics of automation controller which we just saw and some of the objects of it. So automation controller as you see, it's just a web UI based tune where you perform all the operations. So where you define all your playbooks and it comes with a role based access mechanism. So whatever object you would want to give, that's very easy. Second, it also has an API. So if you want to call an API to create something or to modify any object, that's also even possible. Plus, it's like if you want to see centralized auditing logs, who did what? That's really important in ID. Who messed up my environment? How can we resolve it? That's also even possible with this. And you could do a lot of things with this. I'm just having some other basics. Now this project, just imagine that you have a set of objects or building blocks which you would define with your automation controller. So your projects, let's say for example if you have created and it will playbooks and boards based on it. You would just use an SCM extension to import all this code in your automation platform controller. That's just the building block. And if you see this image, especially this config as code, def code, repository project code, we would be creating it in the remote cell. Inventories. So for example, you want to start your own IT company or you have your own startup. Now you would want to do certain tasks on your servers on which your application is running. Those particular servers would be added or they are known as the inventory. So they are the actual posts on which all this automation would be applied on. They are logically grouped and again it's all secure because you could define commissions who can access your inventory. For this demo, we have again created another project based only on inventory. So let's say for example if I have 1000 of posts which I want to automate, I need to group them logically. And I need to tell them okay, my development environment has 50 posts, my testing environment has 100 posts and so on. Then job templates. So job templates I would call it as like it's a glue or it's again an object which has everything. So whatever project you define or whatever playbooks, whatever your execution environments, credentials, they all stick to this job template. And the best part is it's reusable. So you create this job template once, it runs your playbook and then you are done. So you could reuse this job template again and again for your multiple automation tasks. Workflows. So to make it simple, it's just the combination of all your job templates. So it looks like a pipeline but it's not. It's a job template. So these are some of the basic terminologies which we use in automation controller. And trust me, by now you're already one step closer to being an alien spot. So let's talk about some of the good practices and security implementation for this entire platform. And so to begin with, what exactly is wrong with this picture? Any guesses? Exactly. And so when we start developing a lot of things, at the latest stage our codes start to get messy. But if we start with an organized way or organized way of writing code, it's much more easier to understand and it's much more easier to manage it. So that's one of the good practices that you need to organize everything. You need to organize your roles. You need to organize your inventories, your playbooks in a proper way. That's the basic step in my opinion to implement a good practice in your team or in your organization. Another example is you need to create simple playbooks and inventories. So if you see, that's my playbook and it's just a few roles which I've defined. I have not written any complex logic over here. I have not defined any tasks to agree or do over certain goals to automate. I've just kept it simple. All the logic resides in the roles itself. Similarly, if you look at my inventory, I have managed and I've labeled it according to my requirements. So all contains all of my roles. My dev has my host one. I have my prod with host team. And if I want to club them all, I have a child host which would contain my dev and test host. That's how you manage your inventories. Another important thing is like infra as code. We have heard about this term a lot. But when we go to customers and we see that it's still not implemented properly. The versioning of infrastructure as code is not done properly yet. That's where we feel like there's a huge scope where developers, where all the IT guys, operation guys need to collaborate together to build it properly. So in this example, if you see, let's assume you're like Ansible Playbook developer or infrastructure developer. You would just do exactly same things as you do if you were a Java developer or if you were a Python developer. You would commit or create your Ansible Playbook code in the development branch. You would use the best tool set which are available as VS for extensions, ID extensions or as anything else. And then you would just do a proper peer review, approve it. Then that code gets run to your validation branch. You can call it testing branch, whatever. And then it gets merged to your exact production running system. Now, when you talk about security, integrating with LDAP based systems, I think that's again a necessity. Because every enterprise we talk about or any company, be it a startup or a medium size company, all of them, they're using certain LDAP mechanisms in their companies or LDAP servers. And with automation platform, you can seamlessly integrate all of it. So we have done integrations for multiple companies and it's pretty easy if it comes to automation platform. Then let's talk about, okay, any ideas viewing this, what are we talking about? It definitely doesn't have gold in it. So exactly, exactly. So this can be unique to use vaults and credentials in your controller. You cannot just put on simple passwords in your Git repo. That's not recommended and it's not a good practice at all. So what you do is you integrate with multiple enterprise vaults which are available in the market or open source vault. That is up to you. And then you store all your secret data in those vaults. Automation controller connects to that vault to fetch the value. That's what, again, makes it more secure. And again, using vaults and secret management is one of our good practices if you're using answerable automation platform. Okay, so this is the server hardening. So if you have worked on Linux, I'm pretty sure you must have hardened your servers, made a lot of changes in the services, default services which comes with the server or Linux server. And you must have disabled the root login. You need to be always updated to all these packages and you need to have SSL Taylor certificates, auditing, etc. Now, a question to all of you. When we were doing all of these manually or using certain shell scripts or any of the additional tools, how much time it would take to set up all of these? Any while guesses? Oh, long time is really long. But of course, yes. In the demo which we are going to have today, I would just automate all of this in the workflow which we just saw and we would see how much time it took. Then one of the best practices which we're talking about, this is configuration as code. So to give you a brief example, I've created three repositories. My first repository is where all my Ansible code is present. It's like it has all my roles to disable the root login, update packages, etc. My second repository is the inventory on which host all this job templates would actually run. And my third repository is my configuration as code, which would download my AP, configure it as per my wishes, as per the best or good security practices, and then it would make all the automations which we have defined in the playbooks repo to all your hosts. By this approach, we are not just configuring our Ansible automation platform, but we are telling the Ansible automation platform that perform all these tasks on all my hosts. So it's all in one. And for this demo, I've used two organizations, org storage, org unix. We have defined role-based access controls over here. So the teams which are over here, the storage admins and the storage developers. Storage admins have the admin access to all the objects which you see, which we just talked about. And the unix, the admins have all the accesses. Developers have the execute permissions and the operation teams can just use it. So they cannot modify or edit any of the current job template or any other project. So, well, that's my favorite line from Linus Towals. And we have seen a lot of presentations. Let's talk about code, how exactly it works. So, okay. So this is my Git repo, which is defining my automation controller. What you need is just three VMs. On this laptop, what I did is I just I'm using a tool called as UTM and I created three rail machines. One for my controller, one for my automation hub and one for my DB. I've just installed plain rail on these three machines. There's nothing else. And when I run my playbook, which is called as install configure, this downloads the AAP from the Red Hat console. It installs it and then it configures it. I need to define just my inventory file. This is my inventory. So the first part which you see over here, it asks for what automation controller host you have. So I've defined my controller host. I have defined my automation hub. These can be plain IPs of your local VMs if you're running it on your local machine. And then my database, that's all. Now if you see it already installed my automation platform, this is how it looks like. And the password is incorrect. So let me just grab the password. So that's my dashboard. This is all we were talking about. What exactly is automation controller? That's my dashboard. And these on the left-hand plane, if you see, these are all the resources which we discussed briefly. So we discussed about templates, credentials, projects. Now by default, this controller has a lot of things which it comes on. So I can define certain settings. So by default, when you install an automation controller, you would see that there are, there is a list of 100 modules which comes along with it, which includes shell and other things also. But when I was installing this, I changed this setting while installation. Over here, if you see this repository, all, this is like the generic settings or generic objects which I want in my automation controller. So over here, in my settings.yaml, I have just provided these two commands to make my automation platform more secure. I do not want a user to use an ad hoc command, shell, and then reach out to my machines and create some issues for me. Then I have whatever settings I want, which you see in my controller over here. These all can be configured via these playbooks or via these settings. It's all there. Then if you see, I just have the basic users over here, admin and student, which comes by default. I want to create certain new ad users to it through my configuration code. And if you see over here, okay, it's running, let's delete it. Well, deleting it at the production is not a good practice, but let's see. Okay, so all is gone. And now from my terminal, I would be running this particular command before running this. Let me show you some more things. So Ansible playbook, I have defined which vault to use by default, whatever credentials I've used. I have vaulted them using the default Ansible vault and all those vaulted values are stored in Git. So everything is secure. Then I am passing on my inventory to which inventory and which host it should connect to. I'm passing my limit to Dev environment, which we just saw in the inventory. And then the playbook name, it's going to ask me password because that password I used to create the vaulted files and my environment variable. So as soon as I run it, now it would start creating everything from scratch. So if I just put time over here, let's see, let's see how much time it takes to create. And then we would come back to the controller. But up until now, did you guys understood some of the basic concepts of AAP? Any queries or any queries until now? Okay, cool. So now if you see, this gives me the logging. It tells me that it's adding the credential type. It's configuring my controller credentials. It's adding my credentials. And if I show you here, it has already started adding my credentials. So now I have all the credentials which are defined in my config code. I'm not doing anything manually over here. If I look at the projects, these are the SCM projects which got here.  Now it's adding inventory, inventory sources. So with this configuration code, you can literally do 100% of the things. You can define whatever you need. You could define your hosts. You could define your organizations, which you talk, org storage, org Unix. Then we saw teams and all of it is present here. So in my all, I have my... Okay, it's in my development environment. So that's my development environment. And this is how I've structured it. That I would need certain teams only which are a part of my development environment. I would need certain teams who are a part of production environment. So that's how you could separate or segregate this. So if you go and look at my dev environment, I have defined certain teams over here. So Team Unix, Admin, Defconn. So I have four teams defined over here. And now if you see, it has created them. It has not only created it, it has linked these teams to my organization also. That my first two teams are a part of storage organization. Another two teams are a part of Unix organization. Okay, this has finished. Let's look at our timer. So two minutes, 23 seconds. And now if I come here, this is the job templates we were talking about that you could reuse them. And it had created a workflow template for me. So let me just show you. Okay, this is running. It has created this entire set of rules for me which I have defined in my workflows.aml file. It has linked all these job templates and the slide which we just saw that you could have multiple job templates linked to each other as a workflow template. And then this is how it's working. So disabling the root passwords, updating all the packages, if I deep dive into it. So this is the first task. It's configuring my web server. This is configuring my services. This is disabling the root login. Let's look at the output. So output says okay. These are dummy tasks, but if you see at the output, it ran on my Defcon host, which I have defined in my inventory, and then it just displays the messages of now. But let me show you some more things. So, and this is how I have defined my workflow in my code. So I've put down my first job template, which has a success node, failure node. You can also have approval nodes over here. You could do a lot of things with the code itself. So within just two minutes and a few seconds or let's say three minutes, I was able to harden my host by using this particular config code repository. Now that there's a third part, we talked about analytics in the beginning. So if you see over here, that's my analytics console, which is like console.radat.com. It gives me a brief view of what job templates run, how many of them failed, if I am saving some money, which is really important by the way. So if I come here, look at my organization statistics, it loads something about the organizations and then it tells you what all clusters I have. So you could get all of it over here. This is what Ansible Automation platform is all about. You get everything in a single package. And now for you, if we go back to our slides, talk about the analytics part. As next steps, I have provided all the links to this GitHub repo, which are available for you guys. I just want you to try it out, play along with it and give us your feedback. What do you think about it? That's all we need. This entire PDF is linked to the session. So if you want to download it, feel free to do that. And now it's time for Q&A. Any question, guys? Q&A So the question for the audience is, how we are configuring this entire thing? Is there a module available in the market? So there is a module which is available, controller module. And I can show that to you in the code also. So if you come here and if you look at the playbooks over here, the playbook which we ran was controller config to configure everything. So it uses the controller configuration module over here. So that's there. Yeah, but developers tend to use... Sorry. Okay guys, any other questions? So the question is, where can we run Ansible Automation Platform on Kubernetes or directly on relvm? You could either deploy it on your relvm.  And I just created VMs, rel 8 VMs, 8.6 VMs and I installed it over there. I mean, I didn't install it. The configuration has code installed it. If you want Kubernetes, there is an operator which is available also through which code install your AAP platform. So that's also possible. For the Kubernetes installation, I need to check for the... So in the OpenShift view, if you are an OpenShift admin and if you look at the operators, there should be an AAP operator available over there which you can install. But for the exact documentation, I think I can get back to you with that exact documentation link for this. Okay. Yep. Okay. So the question is like if there is a recommended practice to install AAP. So AAP, the default recommendations like the required ones are that it needs a rel server. And so it depends completely on the organization where you would want to install AAP. If you would say, okay, we need OpenShift, use that. If you say we need to install it on the VMs, go for it. So I think... Okay. Yeah. Yeah. Yeah. It needs rel system. And I think no more questions or... Okay. Then if there are no more questions, I would request you to let me know your constructive feedback on this and give it out a try. If you feel or if you need any assistance, feel free to ping me. I'm available on GChat or on LinkedIn. Feel free to do that. So that's it from my side, guys. Thank you for attending.


Meantime, the highly anticipated Cultural Icon series staged by the Cultural Development Foundation was launched Friday. The series showcases and honors St. Lucian's who have made an indelible mark on the national artistic landscape. The Cultural Development Foundation's CDF Cultural Icon series aims to make connections and provoke conversations about the development of art and culture in St. Lucian. The newest addition to the series, Vincent Joseph Udavik, has been described as a man of undoubtable and invaluable talent who displays his love for art and culture through his sculpture pieces. On Friday, October 25, the CDF unveiled the Vincent J. Udavik Sculpture Art Exhibition, which it hopes would create an environment for persons to find passion and freedom of expression. Minister responsible for culture and creative industries, Senator Honorable Fortuna Belrose says it is by finding purpose that one can contribute meaningfully to society. Our Icon series is about celebrating our people.  You see, when you find the way to express what you want or who you are, you are in fact pursuing your own independence. And what do I mean by independence? I'm speaking of a state of mind and being in a place, being in a place where one is focused on being proactive, always beginning with the end in mind, putting first things first, setting priorities, you know, and valuing others' contribution in the space. In 2018, the Cultural Development Foundation introduced the Edutainment Component of the Icon series, which seeks to educate students about the icons through various platforms. This year, the focus was on the islands west coast from Babano to Bhutan. Director of events and production at the CDF, Junior Fredericks, elaborated on this year's undertaking. The program places emphasis on connecting our training programs with elements of production and showing young persons the value of the arts as a medium of change and what it's worth in economic returns. This year, we took a cross-section of young performers who came out of training programs from CDF and other programs in the arts done by other institutions and individuals. These young performers researched the life of Vincent Udavik, created a concept and performed around 12 schools on the island. While the icon himself was not in attendance at Friday's ceremony, his daughter Dawn Udavik represented the art studio. She expressed profound gratitude to the CDF for featuring her father's work and the work that was done to make the exhibition a success. Really and truly, they put some vitality into the Udavik's art studio, the Udavik family, the Udavik art family, and we really appreciate it. We really, really appreciate it from the bottom of our hearts. The art exhibition will run until Tuesday, October 29, 2019.


The problem is that when you get involved with a narcissist they don't want to be a part of your world, they cannot coexist in harmony with people who have different ideologies or interests but there are always going to be differences and the narcissist cannot accept anything that is different from what they like, think or believe, they also have very unique interests and beliefs, things that go against social norms and they are fully aware that most people would not accept their way of living so when they get involved with you they make you believe that you share the same interests and beliefs, they make you believe that you are on the same page but they are concealing their true identity and they are secretly plotting to conquer your world and making their own because while they may not like what you stand for or what you like or interest it in they understand the value of your world, they understand that your world has things that they need but they cannot coexist in harmony with you unless you have identical ideologies or interests, you have to think in the same way that they do and if you don't they're not just going to accept it, they're not just going to allow you to continue with your way of life as you did before you met them, when you don't do what he asks us at once they will engage in coercion although you may be unwilling they will persuade you by using force or threats, they will persuade you forcefully to do something that you don't want to do and this is how they manage to turn your world to their new home, as time goes by you are forced to change yourself more and more to please the narcissist the person you were before you met them gradually fades away, you no longer have any time for yourself you no longer get to do the things that you once enjoyed because now every second of the day revolves around the narcissist it revolves around complying with their demands and meeting their needs you may find that you begin to neglect yourself you no longer look after yourself in the way that you once did you no longer think in the way that you used to you no longer have the same ideas or beliefs because over time the narcissist has indoctrinated you with their way of thinking with their beliefs narcissists have a fixed way of thinking and they have no interest in learning new things they have no interest in changing how they think in their minds they believe that if something sounds good or favors them in some way then it must be the truth well anything that makes them look bad must be false even if there is evidence factual information or statistics that contradicts what they are saying narcissists do not care about the truth if you try to bring up the truth to the narcissist they will see it as though you're just trying to make them feel bad it will only anger and frustrate them and because you don't want to provoke their anger this gradually trains you to ignore or reject the truth it gradually changes your ideas and beliefs until you begin to think that in the same way as a narcissist you adopt their way of thinking it gradually erases the person that you used to be because when you're around the narcissist you cannot have your own several ideas or beliefs narcissists cannot coexist in harmony with people who have different ideologies or interests they do not like to be told that what they are doing is wrong they do not care about what is right or true and they do not care about the rules or standards of your world they do not enter your world to coexist with you they are only interested in conquering your world and using anything of value to meet their own needs narcissists do not care about who you are they only care about what you have what you can do for them what you can provide but no matter what you give to them nothing will ever be enough because the narcissist cannot be satisfied you will quickly waste your life away meeting their every demand but they will never be happy and you will soon lose everything that you had built before you had met them your time energy and resources your happiness and contentment your qualities and abilities the longer you spend around the narcissist the more you will lose until you have nothing left you become a shell of who you used to be and when you have nothing left to give even the narcissist won't want you anymore because they never cared about who you are it was only about what you could do for them or how you can make them feel narcissists will take over your life they enter your world not to coexist in harmony with you but to change your world into what they wanted to be into what suits them they change you into something that can accommodate them and provide them with everything that they need while making you believe that you are not good enough which keeps you running endlessly on the hamster wheel trying to meet their demands but nothing will ever be enough and you will only be destroyed in the process which is why you need to get off the hamster wheel and put the focus back on yourself remember the person that you used to be remember how happy you were how much you enjoyed life you had your own way of living your own tastes things that you liked start doing those things again don't let someone else define what is right or okay for you don't let someone else define who you are define yourself and be yourself instead of being what the narcissist wants you to be life is too short to live for someone else if you do everything the narcissist wants you might feel more comfortable but you will never be happy and one day you will be on your deathbed feeling nothing but regret just wishing that you could go back and do what you wanted to do wishing that you had lived your own life instead of listening to what someone else wanted for you someone who only cared about themselves so live for yourself today life is meant to be lived your life was not designed to be handed over to someone who doesn't value or appreciate it someone who is only going to destroy it so take back control over your life and remember who you are even if no one likes or accepts it at least you can die knowing that you stay true to yourself thank you for watching i hope this video raised it with you please like comment share and subscribe click the bell icon to receive notifications for my future videos if you are like the denate my paypal link is in the video description coaching inquiries you can join me at nightclubofcoaching at gmail.com thank you for watching and i'll talk to you soon


Hello, everyone. My name is Sarah Miller, and my co-presenter here is Melissa Robertson. And we're here to talk about container factories and aerospace and defense. So we both work for a company called Collins Aerospace. It's actually not a company. It's a brand. We're branding a whole bunch of aerospace and defense companies together as legal entities that have a long history in the providing of equipment for commercial and military aircraft. But we're also part of a much larger organization called Raytheon Technologies that produces the Pratt and Whitney engines, produces Raytheon's missiles, helping us stay safe in our corporation, as well as Raytheon Intelligence and Space. As part of Collins Aerospace, we are in a division called Mission Systems. In Mission Systems, we provide all sorts of different material and products to our US military, as well as to mystery of defense agencies across the globe. And today, we're going to talk a little bit about our problems. Now, if you're an aerospace and defense industry, you may know that we maintain systems that have been delivered to our customers for over 30 years. This equipment is expected to stay operational, continue to run, and get updates. Because, of course, they want to upgrade things. But we're still using our legacy technologies. We're kind of stuck in those early 90s with the CRT monitors, those computers back in the day, which, you know, I have trouble using them. And I know my information technology organization that someone labeled digital technologies at some point in my history here do not want running in their network, like Windows 95 and Windows NT. How do you continue to maintain these products that are 25 and 30 years old? We're trying to figure that out for our developers to really help them and our product engineers, to really help them sustain what we have as the old, but also adapt and move to the new. And so we have all of the same questions that I'm sure your organizations have encountered. It's like, it built on my system? Why doesn't it built on yours? Or why doesn't it run there? Which package did I miss? Many of our services and setups have been servers that were maintained since the early 90s. Not something that we want to continue. We don't really want to go buy hardware on eBay. We don't really want to go trade with the National Computer Museum for hardware that's actually working. We also don't want to keep our material on floppy disks, especially when the new engineers that I hire don't know what a floppy is. They think it's the save icon. You hand them on. It's very funny, actually. But we have fun in trying to really upgrade our systems to really keep our material in a digital form. Where do we store it? How do we archive it? So it can be there for the next generation. And the systems are old. So if you remember your original UNIX flavors, bash was not a thing. So we really need to get to a state where we really want to have our systems be usable for the modern developer, for the modern engineer. And so we also want to prevent our environment disparity. We want to make sure that our engineers are all operating in the same parity of environments. They have the same things as hopefully our deployment environments. But really what I want is my build service to all match, my build environments between the developer who's been there for 25 years to the new hire that started yesterday. I also really want to, you know, I have all these legacy technologies. I really want to enable my developers to start using something new, to bring in that new technology that they can use, to start using emulation so that we don't have to keep that Windows 95 computer still operational and replace that little lithium battery that runs the clock. Don't forget about that. And then we really want to update our old practices, the practice of storing our material on a floppy disk that we know has bit rot or on the CD that we know has bit rot. If you've ever had to get an old material off of a CD-ROM drive or CD-ROM disk that was created in the early 90s, you may know something about bit rot, and it just does not come out. So we're trying to think transformatively for our engineers. And our transformational thinking today is these declarative ephemeral build environments. We want to have everything declarative so they can be recreated at a moment's notice, and we want them to be ephemeral. So we're not having a Windows 95 machine hang around for years on end where it could be exposing vulnerabilities all across the board to the network. We only want that running in a very short amount of time to create the application that still needs, that silly Boerlin C++ compiler running. And so we've kind of come up with, as a team, Melissa and I work in an organization that you could probably describe as platform engineering. We don't think of ourselves as that. We're just kind of that transitional organization keeping DT away from our engineers and our engineers away from DT. Trying to provide that interface and help our engineers get across. So we have a lot of needs as we migrate to containers. Our engineers have a lot of requirements of what they want to do. Digital technologies, or IT, has things that they want to do. And then we have our governance, risk and compliance, we build things for safety critical. So the FAA has a lot of say in how we build software. NASA has a lot of say in how we build software. The DOD has a lot of say in how we build software. And so we're starting with our infrastructure. And my engineers, all they want is quick access to compute. Give me a machine, let me run something. I want SSH, log in, do stuff. Digital technologies, I want to manage and control everything. I want to make sure that what you're running is good. And then the governance is I really, I don't want anybody to have access to your machine. We really have to control it and protect it. And I really want to know how it's going to be used. So a building upon our compute infrastructure is we really want to be using orchestration platforms. Our developers have a huge need to dynamically scale their build servers and their testing.  And these simulators use a tremendous amount of compute, but we want to scale that dynamically in our cloud. We also need to have policy enforcement for digital technologies. They really want to control access and really give us those guardrails and understand and prevent us from really destroying someone else's work and network. We got to keep our developers honest. And then our governance teams really want to be able to monitor and audit what we're doing. So we can say that yes, no international person accessed our ITAR data. And then we move to our container factories. And this is what we're gonna talk about today is this is how we're developing automated workflows to help our engineers build containers so they can build and test their software. We're not yet to the point where we're putting containers in our aircraft equipment most of the time. We have some systems that might want to do that and are trying to do that. But really what we want to do is scale how we maintain our software and how we build and develop our software in our organization. We want to make sure that we can get authorizations to run all the tools within our network. And we wanna make sure that we're not gonna break someone else's software that's out there running. And we wanna meet all of the guidance that our company has and the rules. And as you can see that we were kind of a conglomeration of organizations through acquisition. And so we've come from 16,000 employees to almost 200,000 employees. And so there's a lot of rules that we have to follow. And then we also need to have a layer for container visibility and observability. We wanna make sure that the containers we're building can operate in the network and we know what they're doing. And so we also want our developers to be able to use these things so that they have little impact on performance. They don't really need to do anything to their app or their build system to be able to use these logging and it's all built into the images. And we can test it. And lastly we have the app. And this is my stuff, don't touch it. This is what I'm building for you. And our digital technologies organization really wants to understand the risk of what I'm building is gonna happen in the network. It's very important, especially when we start running tests and that we're running our non-production software, we're trying to test things that we're building in our networks and how does that affect and how can we understand the risk of those to limit the vulnerabilities that we might add to the network. For our governance we really wanna understand where did that code come from? Who wrote it?  Did you generate that through chat GTP? Who owns the copyright? So we really wanna understand where that code came from from a governance perspective. So we're trying to build on all of these things to give our developers a chance. But as you can see, what my developers want isn't necessarily what DT and our governance system will give them. So we have a little bit of a conflict and this has been kind of ongoing as our organizations grow. We end up with shadow IT services, things that just are not kosher in the environment. And so Melissa and I through our program is we're trying to create these self-service environments for our developer so they can get easy access to compute. We really wanna reduce our developer's cognitive load through some automation for policies and procedures so they don't have to know the 150 controls that they're gonna have to meet for RMF or CMMC in their environment when they just wanna launch this container to compile some software. We also wanna create all these immutable audit records so that we know who did what when. And we wanna provide them with some curated pipelines so that we have these controls and stages. So when we go to meet our FAA requirements or D178 system requirements and how we manage and build our software, then we have all of these things and stages that teams can pull in or not pull into their jobs and their pipelines. And we also wanna have these standardized containers so teams can actually use containers within their networks. We wanna create these pathways of least resistance for developers so that they stop doing shadow IT. They stop putting secrets in their software so they can log into that service account over there to get access to the get repository or haven't forbid the subversion repository or that old clear case repository that's still out there. So we're really trying to work toward bringing our teammates up, getting them the experience. We also wanna hope that they get some good cloud education and they can spend their time learning about the cloud, not learning about how to run through the policies at our organization. And so now Melissa's gonna tell us a little bit about our work that we've been doing to create some of these automated workflows for our developers. And as we move forward with this discussion is we really bring together a team of not just our team but we've brought in our product engineering teams together to build this. Let me just quick. Hi, Melissa Robertson. I have been working on our container workflow and trying to create a development workflow for our engineers to use. We have kind of just a generic, these are the stages that we're trying to go through and we really need to separate out the controls based on the different customers we have and different requirements we have. But we really need to onboard our teams and teach them how to use these requirements and have the thresholds for them, for the different environments, for the different networks, agreed upon not only by the developers but the security and quality experts as well. So we need to make sure that we choose tools. We have multiple of them currently that meet the minimum requirements for these. We need a record of review, make sure that it's auditable to the quality standards, immutable and per our company, retained for 99 years. We need controls around our source code and we really want to start to prevent the downloading of source code on local PCs and instead being able to develop in the cloud. So we really want to pull dependencies managed within our organization so that we're not going out to the internet and we know exactly what we're pulling down. We want to have this continual remediation of the dependencies and we want to also have the ability to pull pre-approved images from registries such as Iron Bank or CNCF containers that meet a security threshold. So once we pull those dependencies we need to check the signatures and check the certificates that are assigned to them and then we need to link the container and make sure that depending on the different customers that we don't open ports if we don't need to, we don't have access to things we're not supposed to, we don't give pseudo access to things that shouldn't happen. Currently we're using HadoLint for this in our build pipeline. So then we have actually building the container. We need to make sure our agents are running in an authorized environment. We need to make sure it's a declarative and an informal environment and that we reduce the, we limit the amount of the effect of anything being compromised so that if you build one container and it messes up things you move on to the next one and none of that happens. And then we need a audit log and monitoring the environment and make sure there's no unauthorized access and make sure the pipeline fails if that happens. So then we need to scan the container at a OS level and make sure that we continue to have state compliance and at least have two vulnerability scanners. Sometimes the customer requires a certain one but right now we use Grape and Tritie built into GitLab. But we must show that the container is secure enough to actually put our code to build. The thresholds can be different but we really need a separation of duties so that the developers can't change those requirements and it should be done by our quality and security experts for the program. So we also need to test the container and we really need to have that baseline test results so that we can do continuous remediation anytime there's a vulnerability and pull that in automatically. It is a delicate balance between remediate quickly but sometimes accepting that are needed such as running Python 2 and not upgrading to 3 and we need to generate the artifacts. We have a lot of requirements for the documents we need before we release something. Some people want Excel sheets, some people want a pre-website but we really need to work with our governance and compliance and risk management team to not only have the vulnerabilities at the point in time the container was built but continuous remediation and tracking of the vulnerabilities when people are running these containers and we need to automate it so that there's less mistakes and then we need to sign the containers and the generated artifacts that are within each container and then limit the length of the signature validation so that we're not running the same containers 20 years later. So we have a bunch of different environments. We have our corporate network which allows some access to the internet practice, developer network which has a little more leeway and then our cloud and closed environments. We need signatures to have the automated process to get approved to use in each of these different environments but we also need to continually scan for vulnerabilities based on what is running and have the ability to revoke the signature for any of the vulnerabilities that have been flagged above a certain threshold given the different environments and this is just a generic network with different clusters. We really need to restrict signatures for each of the clusters as well and make sure that we're not running something and dev that has access to prod data or a simulation that's running for a longer time has more restrictions on vulnerability thresholds and we really need to educate our developers so that we're not spending up 2,000 containers in the cloud and ruining resources for other developers. Or charging of $4 million in the day. And we really need to have the same environment across the board instead of having five different versions of our Git repository and this is something we're leveraging is ZARF from Defense Unicorns and trying to make it declarative across the board. So yeah, so we're building this and learning this week, I've learned that we're doing some platform engineering, new term for me. I know I've read some articles on it but I didn't realize how much I was actually involved in this and we were really trying to provide developer experience to bring this environment parity. We don't want our developers to be going into their secure lab and have to go back to use the version or heaven forbid clear case and use all the old tools that they've been accustomed to maintain that Solaris server or SunOS server that's been around for many, many years. We really want to bring them up to a really new environment and we want them to be able to use the modern tools that they're expecting to use. We want to be able to recruit new people who know how to use those tools and I don't have to train them all the time and I also want to be able to upskill my existing engineers so the guys who have been running Borland C++ still can learn how to use GCC learn what those errors mean and say, hey, color coding is a thing. So we really want to bring our teams together to grow together. We're doing this in isolation with just this team. We've involved our product teams with us. We have experts from our cybersecurity teams as well as experts from our digital technologies organization working with us but we do face a tremendous amount of challenges. As we go forward, we're still trying to figure out the appropriate ways to run containers in our environments at Collins Aerospace. We get pockets of people, we do a lot of shadow IT so I have Docker installed. I don't know, she might have Docker installed. I ran her installed on my desktop or laptop. So we try and use these things but then every other day or so, MacP kicks off and says, no, you can't do that and then I go file my exception. So we really want to make those things normal. Like maybe get the developer off their laptop so I don't have to carry around this nine pound laptop with an hour of battery life. I can actually have a reasonable one and be able to do code spaces or some really cool get pods so I can just access my app in the cloud and go somewhere else and do it again. So we're working hard to build those experiences, to work with our developers to really understand what their needs are and to really look at how can we support some of the older technologies and lift them up because we will have to continue to support our development systems that were built with custom tools that run on Windows NT, Windows XP. We're still trying to figure out how to get from Code Composer 4 to Code Composer 6 for some of our DSP processing. So it's gonna be a long road but we're working on it. Thank you. Yeah, any questions? It's everything. We have, I think there's, the biggest issue I think we have is a misunderstanding between what our engineering product teams need and what our digital technologies teams is expecting. What does production mean to you? So for me to put my source code that is generally owned by the government into a network, it has to be a production network. And so, but my IT guys are like, but that's source code, you're building source code in your production. That's dev. I'm like, no, no, no, I have to meet all the requirements for prod for me to get my source code there but then I'm gonna have a dev environment in prod. So it just doesn't understand and we talk a different language and we continue to have the same discussions over and over again. We are working through that. We do see the developers really want to be local. They want to run local but they still are, we've migrated many teams to servers so being able to access remotely from their computer without having to use the right VPN would open them up to more stuff and to be able to have people from the different heritage organizations to work on the same project. So collaboration between RMD, Raytheon Missile Defense and Collins Aerospace is a little difficult because we both don't have access to the same networks yet. It's been three years in April. That'll be four or no, April, it'll be three. So it's just really hard. Yes sir. We have tried some virtual machine for developers. We do our... That is part of our IT policies. They do not want us to run virtualized environments on our mobile devices or on our desktop devices. That's apparently a defars violation for them because we don't want to defars the mobile image or the image inside the VM, that's mine. That's because when I'm building my app on that I want to control what compilers, what tools, everything that goes into that. And that's why we're trying to build these container factories so that my teams can create all the tools they need and get them in the factory. We have the process for them to quickly iterate on that so when they're creating their environments at the beginning of a project or trying to reuse someone else's environment they can bring that through that pipeline. We can get its initial certificate to field accredited and then they can iterate on it as they go forward. Yes sir. Ansible right now is what we're running our cloud build in an EC2 instance. Yeah, we're really trying to move to that declarative baseline to make sure everything is declarative so we can recreate it in cloud environments regardless of what our CSP provider is or on-prem data center or in our classified environments because we really want to recreate those environments. Now none of us are Kubernetes experts so we do not know how to manage Kubernetes clusters so we're learning. Our security officers who maintain our classified systems are also learning what it means to be cloud native and what it means to manage Kubernetes clusters and how we bring those forward. But I hope my developer doesn't have to understand all about a Kubernetes cluster. Maybe a little bit. No, not really. If I do it, it's shadow IT. They might issue me a Linux machine that I can use and so that's one of the things that we talk about is the cost of having to issue me multiple machines to match the development environments that I work on. So I'm issued, I have a number of machines that are in labs that I've been issued that only I use to build software, couple Linux machines, couple Windows machines. That's a lot of money. Not only is it a lot of money just buying the computer hardware and it also takes a lot of time to procure it now. It's a lot of money in managing those machines. I'm not a good about doing my own updates so I know I have a Mood 2.1404 running out there somewhere. Maybe I have a lot of servers running 14.04, I don't know. So we really, I mean this part of that management of when I added additional, additional assets that are not ephemeral, that don't get recreated at the time of need, they stay in that legacy mode. They continue to not get updated to not be sustainable.  We have one, a couple servers, 14.04 is like, we want to migrate those to the data center. And so they migrated them as they were, kind of like, just duplicate, put them in the data center. I'm like, what were you guys doing? You mean you didn't like switch to Red Hat and launch the enterprise version of the base OS so it was all on compliance and then install the software on top of that? And they're like, well the compiler doesn't work because we need to use GCC49. I'm like, well why do you have to use GCC49? Well it doesn't compile. I was like, can you fix it? Yes. We are using that to, yep, to baseline our images and to really, we're also using it to audit our images so anything that's running out there in the cloud in our EC2 instances, we're using that to audit. We are vansuring in a little bit with Azure. It's kind of a new experience for both of us. AWS is our heritage organization, preferred cloud provider. Azure seems to be the corporate preferred cloud provider so we're kind of playing with both, yeah. Someone told me they were using Google but I don't know how many people do use Google at Collins Aerospace anymore. There has been some, I would say, conflicting requirements in that area especially when we're trying to use our build environments. They tend to be a lot more dynamic and when we're testing our software, especially we want access to change priorities. We write real-time embedded software so if we're running a unit test on a piece of software that's creating a thread, we want that to have access to setting priority and my DT department says no, I can't do that so we really try and work on some of the SD Linux access controls to do that, trying to figure out how can we do that with privileged containers or not privileged containers. What happens if we don't set the priority and run the software? Does it operate? How randomly does it operate? And we also are looking at the emulation environments. How can we run QEMU within containers to really emulate our ARM processors and can we distinctly separate that kernel from the underlying OS so we can set priorities in QEMU and do what we need to do without having root access to the operating system. Right now it's very risk management focused so they look exactly what I'm doing today and then I can't change it tomorrow and so they'll prove it and then tomorrow I can't say, I need to do this other thing like open this port or something so it's really a very manual process so we end up with install my own server back in the lab, my software on it, don't update it and go be merry. Which we want to stop. I don't want my developers having to maintain their servers anymore. I want them to use corporate LDAP, all that good stuff. All right, are we out of time? Are we a few more minutes? 10 minutes. Any more questions? Well thank you for attending, we really appreciate it. Thank you.


Well, I'm making a very calming project. This is a TFT shield on top of the new IMX RT-1011 M7 Metro, and I'm sort of testing out Circuit Python with display stuff. So I just made a little demo where I have three transparent PNGs of the DVD video logo sort of bouncing around, and I'm just practicing like what happens if I add more, so maybe I'll make like six, let's see if I can handle, six DVDs, oh yeah, look at that, just bouncing away. So yeah, just trying out like what can I do with a really fast processor running at 500 megahertz, so I'm going to optimize this code a little bit, but it seems to be working, so bouncy, bouncy.